From 87e394c0c9bd3202bae02df68ac94a2a1b41b9d0 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 29 Dec 2025 16:32:23 +0300
Subject: [PATCH 001/666] [platform] Add DNS-1035 validation for Application
 names

Add validation to ensure Application names (including Tenants) conform
to DNS-1035 format. This prevents creation of resources with names
starting with digits, which would cause Kubernetes resource creation
failures (e.g., Services, Namespaces).

DNS-1035 requires names to:
- Start with a lowercase letter [a-z]
- Contain only lowercase alphanumeric or hyphens [-a-z0-9]
- End with an alphanumeric character [a-z0-9]

Also fixes broken validation.go that referenced non-existent internal
types (apps.Application, apps.ApplicationSpec).

Fixes: https://github.com/cozystack/cozystack/issues/1538

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 pkg/apis/apps/validation/validation.go      | 56 +++++++++++++++++++
 pkg/apis/apps/validation/validation_test.go | 61 +++++++++++++++++++++
 pkg/registry/apps/application/rest.go       |  7 +++
 3 files changed, 124 insertions(+)
 create mode 100644 pkg/apis/apps/validation/validation.go
 create mode 100644 pkg/apis/apps/validation/validation_test.go

diff --git a/pkg/apis/apps/validation/validation.go b/pkg/apis/apps/validation/validation.go
new file mode 100644
index 00000000..ac8e6623
--- /dev/null
+++ b/pkg/apis/apps/validation/validation.go
@@ -0,0 +1,56 @@
+/*
+Copyright 2024 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"regexp"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// dns1035LabelRegex validates DNS-1035 label format.
+// DNS-1035 labels must start with a letter, contain only lowercase alphanumeric
+// characters or hyphens, and end with an alphanumeric character.
+var dns1035LabelRegex = regexp.MustCompile(`^[a-z]([-a-z0-9]*[a-z0-9])?$`)
+
+// maxDNS1035LabelLength is the maximum length of a DNS-1035 label.
+const maxDNS1035LabelLength = 63
+
+// ValidateApplicationName validates that an Application name conforms to DNS-1035.
+// This is required because Application names are used to create Kubernetes resources
+// (Services, Namespaces, etc.) that must have DNS-1035 compliant names.
+func ValidateApplicationName(name string, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+
+	if len(name) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath, "name is required"))
+		return allErrs
+	}
+
+	if len(name) > maxDNS1035LabelLength {
+		allErrs = append(allErrs, field.TooLongMaxLength(fldPath, name, maxDNS1035LabelLength))
+	}
+
+	if !dns1035LabelRegex.MatchString(name) {
+		allErrs = append(allErrs, field.Invalid(fldPath, name,
+			"a DNS-1035 label must consist of lower case alphanumeric characters or '-', "+
+				"start with an alphabetic character, and end with an alphanumeric character "+
+				"(e.g. 'my-name', regex used for validation is '[a-z]([-a-z0-9]*[a-z0-9])?')"))
+	}
+
+	return allErrs
+}
diff --git a/pkg/apis/apps/validation/validation_test.go b/pkg/apis/apps/validation/validation_test.go
new file mode 100644
index 00000000..d1e6b2f8
--- /dev/null
+++ b/pkg/apis/apps/validation/validation_test.go
@@ -0,0 +1,61 @@
+/*
+Copyright 2024 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestValidateApplicationName(t *testing.T) {
+	tests := []struct {
+		name      string
+		appName   string
+		wantError bool
+	}{
+		// Valid names
+		{"valid simple name", "tenant-one", false},
+		{"valid single letter", "a", false},
+		{"valid with numbers", "abc-123", false},
+		{"valid lowercase", "my-tenant", false},
+		{"valid long name", "my-very-long-tenant-name-123", false},
+
+		// Invalid names
+		{"starts with digit", "1john", true},
+		{"only digits", "123", true},
+		{"starts with hyphen", "-tenant", true},
+		{"ends with hyphen", "tenant-", true},
+		{"uppercase letters", "Tenant", true},
+		{"mixed case", "myTenant", true},
+		{"underscore", "my_tenant", true},
+		{"dot", "my.tenant", true},
+		{"empty string", "", true},
+		{"space", "my tenant", true},
+		{"too long (64 chars)", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", true},
+		{"max length (63 chars)", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			errs := ValidateApplicationName(tt.appName, field.NewPath("metadata").Child("name"))
+			if (len(errs) > 0) != tt.wantError {
+				t.Errorf("ValidateApplicationName(%q) returned %d errors, wantError = %v", tt.appName, len(errs), tt.wantError)
+			}
+		})
+	}
+}
diff --git a/pkg/registry/apps/application/rest.go b/pkg/registry/apps/application/rest.go
index 00d22486..d93f55e0 100644
--- a/pkg/registry/apps/application/rest.go
+++ b/pkg/registry/apps/application/rest.go
@@ -35,6 +35,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/selection"
+	"k8s.io/apimachinery/pkg/util/validation/field"
 	"k8s.io/apimachinery/pkg/util/duration"
 	"k8s.io/apimachinery/pkg/watch"
 	"k8s.io/apiserver/pkg/endpoints/request"
@@ -43,6 +44,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
+	"github.com/cozystack/cozystack/pkg/apis/apps/validation"
 	"github.com/cozystack/cozystack/pkg/config"
 	"github.com/cozystack/cozystack/pkg/registry"
 	fieldfilter "github.com/cozystack/cozystack/pkg/registry/fields"
@@ -152,6 +154,11 @@ func (r *REST) Create(ctx context.Context, obj runtime.Object, createValidation
 		return nil, fmt.Errorf("expected *appsv1alpha1.Application object, got %T", obj)
 	}
 
+	// Validate Application name conforms to DNS-1035
+	if errs := validation.ValidateApplicationName(app.Name, field.NewPath("metadata").Child("name")); len(errs) > 0 {
+		return nil, apierrors.NewInvalid(r.gvk.GroupKind(), app.Name, errs)
+	}
+
 	// Validate that values don't contain reserved keys (starting with "_")
 	if err := validateNoInternalKeys(app.Spec); err != nil {
 		return nil, apierrors.NewBadRequest(err.Error())

From 1cbf1831641f5e695a9e7f12e0f8355832460f93 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 29 Dec 2025 16:42:05 +0300
Subject: [PATCH 002/666] fix(validation): limit name to 40 chars and add
 comprehensive tests

- Reduce maxApplicationNameLength from 63 to 40 characters
  to allow room for prefixes like "tenant-" and nested namespaces
- Add 27 test cases covering:
  - Valid names (simple, single letter, with numbers, double hyphen)
  - Invalid start characters (digit, hyphen)
  - Invalid end characters (hyphen)
  - Invalid characters (uppercase, underscore, dot, space, unicode)
  - Empty/whitespace inputs
  - Length boundary tests (40 valid, 41+ invalid)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 pkg/apis/apps/validation/validation.go      | 10 ++++---
 pkg/apis/apps/validation/validation_test.go | 32 +++++++++++++++++----
 2 files changed, 32 insertions(+), 10 deletions(-)

diff --git a/pkg/apis/apps/validation/validation.go b/pkg/apis/apps/validation/validation.go
index ac8e6623..c6c2e535 100644
--- a/pkg/apis/apps/validation/validation.go
+++ b/pkg/apis/apps/validation/validation.go
@@ -27,8 +27,10 @@ import (
 // characters or hyphens, and end with an alphanumeric character.
 var dns1035LabelRegex = regexp.MustCompile(`^[a-z]([-a-z0-9]*[a-z0-9])?$`)
 
-// maxDNS1035LabelLength is the maximum length of a DNS-1035 label.
-const maxDNS1035LabelLength = 63
+// maxApplicationNameLength is the maximum length of an Application name.
+// This is set to 40 (not 63) to allow room for prefixes like "tenant-"
+// and nested tenant namespaces (e.g., "tenant-parent-child").
+const maxApplicationNameLength = 40
 
 // ValidateApplicationName validates that an Application name conforms to DNS-1035.
 // This is required because Application names are used to create Kubernetes resources
@@ -41,8 +43,8 @@ func ValidateApplicationName(name string, fldPath *field.Path) field.ErrorList {
 		return allErrs
 	}
 
-	if len(name) > maxDNS1035LabelLength {
-		allErrs = append(allErrs, field.TooLongMaxLength(fldPath, name, maxDNS1035LabelLength))
+	if len(name) > maxApplicationNameLength {
+		allErrs = append(allErrs, field.TooLongMaxLength(fldPath, name, maxApplicationNameLength))
 	}
 
 	if !dns1035LabelRegex.MatchString(name) {
diff --git a/pkg/apis/apps/validation/validation_test.go b/pkg/apis/apps/validation/validation_test.go
index d1e6b2f8..87e80fe0 100644
--- a/pkg/apis/apps/validation/validation_test.go
+++ b/pkg/apis/apps/validation/validation_test.go
@@ -17,6 +17,7 @@ limitations under the License.
 package validation
 
 import (
+	"strings"
 	"testing"
 
 	"k8s.io/apimachinery/pkg/util/validation/field"
@@ -33,28 +34,47 @@ func TestValidateApplicationName(t *testing.T) {
 		{"valid single letter", "a", false},
 		{"valid with numbers", "abc-123", false},
 		{"valid lowercase", "my-tenant", false},
-		{"valid long name", "my-very-long-tenant-name-123", false},
+		{"valid long name", "my-very-long-tenant-name", false},
+		{"valid double hyphen", "my--tenant", false},
+		{"valid max length (40 chars)", strings.Repeat("a", 40), false},
 
-		// Invalid names
+		// Invalid: starts with wrong character
 		{"starts with digit", "1john", true},
 		{"only digits", "123", true},
 		{"starts with hyphen", "-tenant", true},
+
+		// Invalid: ends with wrong character
 		{"ends with hyphen", "tenant-", true},
+
+		// Invalid: wrong characters
 		{"uppercase letters", "Tenant", true},
 		{"mixed case", "myTenant", true},
 		{"underscore", "my_tenant", true},
 		{"dot", "my.tenant", true},
-		{"empty string", "", true},
 		{"space", "my tenant", true},
-		{"too long (64 chars)", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", true},
-		{"max length (63 chars)", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", false},
+		{"unicode cyrillic", "тенант", true},
+		{"unicode emoji", "tenant🚀", true},
+		{"special chars", "tenant@home", true},
+		{"colon", "tenant:one", true},
+		{"slash", "tenant/one", true},
+
+		// Invalid: empty or whitespace
+		{"empty string", "", true},
+		{"only spaces", "   ", true},
+		{"leading space", " tenant", true},
+		{"trailing space", "tenant ", true},
+
+		// Invalid: length
+		{"too long (41 chars)", strings.Repeat("a", 41), true},
+		{"way too long (100 chars)", strings.Repeat("a", 100), true},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			errs := ValidateApplicationName(tt.appName, field.NewPath("metadata").Child("name"))
 			if (len(errs) > 0) != tt.wantError {
-				t.Errorf("ValidateApplicationName(%q) returned %d errors, wantError = %v", tt.appName, len(errs), tt.wantError)
+				t.Errorf("ValidateApplicationName(%q) returned %d errors, wantError = %v, errors = %v",
+					tt.appName, len(errs), tt.wantError, errs)
 			}
 		})
 	}

From 9f20771cf8829001b041421145841b452da7ea4b Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 29 Dec 2025 16:42:57 +0300
Subject: [PATCH 003/666] docs(tenant): update naming requirements in README

Clarify DNS-1035 naming rules:
- Must start with lowercase letter
- Allowed characters: a-z, 0-9, hyphen
- Must end with letter or number
- Maximum 40 characters

Change wording from "not allowed" to "discouraged" for dashes
since the validation technically permits them.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/apps/tenant/README.md | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/packages/apps/tenant/README.md b/packages/apps/tenant/README.md
index 99a973c7..811197f2 100644
--- a/packages/apps/tenant/README.md
+++ b/packages/apps/tenant/README.md
@@ -6,9 +6,14 @@ Tenants can be created recursively and are subject to the following rules:
 
 ### Tenant naming
 
-Tenant names must be alphanumeric.
-Using dashes (`-`) in tenant names is not allowed, unlike with other services.
-This limitation exists to keep consistent naming in tenants, nested tenants, and services deployed in them.
+Tenant names must follow DNS-1035 naming rules:
+-   Must start with a lowercase letter (`a-z`)
+-   Can only contain lowercase letters, numbers, and hyphens (`a-z`, `0-9`, `-`)
+-   Must end with a letter or number (not a hyphen)
+-   Maximum length: 40 characters
+
+**Note:** Using dashes (`-`) in tenant names is discouraged, unlike with other services.
+This is to keep consistent naming in tenants, nested tenants, and services deployed in them.
 
 For example:
 

From 7c0e99e1af2e63ee79f4668ec872c047d23cad0a Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 29 Dec 2025 20:25:02 +0300
Subject: [PATCH 004/666] [platform] Add OpenAPI schema validation for
 Application names

Add pattern and maxLength constraints to ObjectMeta.name in OpenAPI schema.
This enables UI form validation when openapi-k8s-toolkit supports it.

- Pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$ (DNS-1035)
- MaxLength: 40

Depends on: cozystack/openapi-k8s-toolkit#1

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 pkg/cmd/server/openapi.go      | 45 ++++++++++++++++
 pkg/cmd/server/openapi_test.go | 98 ++++++++++++++++++++++++++++++++++
 2 files changed, 143 insertions(+)
 create mode 100644 pkg/cmd/server/openapi_test.go

diff --git a/pkg/cmd/server/openapi.go b/pkg/cmd/server/openapi.go
index e6a659c5..e5734b9b 100644
--- a/pkg/cmd/server/openapi.go
+++ b/pkg/cmd/server/openapi.go
@@ -19,8 +19,47 @@ const (
 	baseListRef   = apiPrefix + ".ApplicationList"
 	baseStatusRef = apiPrefix + ".ApplicationStatus"
 	smp           = "application/strategic-merge-patch+json"
+
+	// objectMetaRef is the OpenAPI reference for Kubernetes ObjectMeta.
+	objectMetaRef = "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"
+	// applicationNamePattern is DNS-1035 regex for Application names.
+	applicationNamePattern = `^[a-z]([-a-z0-9]*[a-z0-9])?$`
+	// applicationNameMaxLength is the maximum length for Application names.
+	applicationNameMaxLength = 40
 )
 
+// patchObjectMetaNameValidation adds DNS-1035 validation to metadata.name.
+// This ensures UI form validation matches backend validation.
+func patchObjectMetaNameValidation(schemas map[string]*spec.Schema) {
+	objMeta, ok := schemas[objectMetaRef]
+	if !ok || objMeta == nil {
+		return
+	}
+
+	if name, ok := objMeta.Properties["name"]; ok {
+		name.Pattern = applicationNamePattern
+		maxLen := int64(applicationNameMaxLength)
+		name.MaxLength = &maxLen
+		objMeta.Properties["name"] = name
+	}
+}
+
+// patchObjectMetaNameValidationV2 adds DNS-1035 validation for Swagger v2.
+func patchObjectMetaNameValidationV2(defs map[string]spec.Schema) {
+	objMeta, ok := defs[objectMetaRef]
+	if !ok {
+		return
+	}
+
+	if name, ok := objMeta.Properties["name"]; ok {
+		name.Pattern = applicationNamePattern
+		maxLen := int64(applicationNameMaxLength)
+		name.MaxLength = &maxLen
+		objMeta.Properties["name"] = name
+	}
+	defs[objectMetaRef] = objMeta
+}
+
 // deepCopySchema clones *spec.Schema via JSON-marshal/unmarshal.
 func deepCopySchema(in *spec.Schema) *spec.Schema {
 	if in == nil {
@@ -262,6 +301,9 @@ func buildPostProcessV3(kindSchemas map[string]string) func(*spec3.OpenAPI) (*sp
 			}
 		}
 
+		// Add name validation to ObjectMeta for UI form validation
+		patchObjectMetaNameValidation(doc.Components.Schemas)
+
 		// Rewrite all $ref in the document
 		out, err := rewriteDocRefs(doc)
 		if err != nil {
@@ -343,6 +385,9 @@ func buildPostProcessV2(kindSchemas map[string]string) func(*spec.Swagger) (*spe
 			return sw, fmt.Errorf("base Application* schemas not found")
 		}
 
+		// Add name validation to ObjectMeta for UI form validation
+		patchObjectMetaNameValidationV2(defs)
+
 		for kind, raw := range kindSchemas {
 			ref := apiPrefix + "." + kind
 			statusRef := ref + "Status"
diff --git a/pkg/cmd/server/openapi_test.go b/pkg/cmd/server/openapi_test.go
new file mode 100644
index 00000000..921b0d30
--- /dev/null
+++ b/pkg/cmd/server/openapi_test.go
@@ -0,0 +1,98 @@
+/*
+Copyright 2024 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package server
+
+import (
+	"testing"
+
+	"k8s.io/kube-openapi/pkg/validation/spec"
+)
+
+func TestPatchObjectMetaNameValidation(t *testing.T) {
+	tests := []struct {
+		name          string
+		schemas       map[string]*spec.Schema
+		wantPattern   string
+		wantMaxLength *int64
+	}{
+		{
+			name: "patches ObjectMeta name field",
+			schemas: map[string]*spec.Schema{
+				objectMetaRef: {
+					SchemaProps: spec.SchemaProps{
+						Properties: map[string]spec.Schema{
+							"name": {SchemaProps: spec.SchemaProps{Type: []string{"string"}}},
+						},
+					},
+				},
+			},
+			wantPattern:   applicationNamePattern,
+			wantMaxLength: ptr(int64(applicationNameMaxLength)),
+		},
+		{
+			name:          "no panic when ObjectMeta missing",
+			schemas:       map[string]*spec.Schema{},
+			wantPattern:   "",
+			wantMaxLength: nil,
+		},
+		{
+			name: "no panic when name field missing",
+			schemas: map[string]*spec.Schema{
+				objectMetaRef: {
+					SchemaProps: spec.SchemaProps{
+						Properties: map[string]spec.Schema{},
+					},
+				},
+			},
+			wantPattern:   "",
+			wantMaxLength: nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			patchObjectMetaNameValidation(tt.schemas)
+
+			objMeta, ok := tt.schemas[objectMetaRef]
+			if !ok {
+				if tt.wantPattern != "" || tt.wantMaxLength != nil {
+					t.Error("expected ObjectMeta to exist")
+				}
+				return
+			}
+
+			name, ok := objMeta.Properties["name"]
+			if !ok {
+				if tt.wantPattern != "" || tt.wantMaxLength != nil {
+					t.Error("expected name field to exist")
+				}
+				return
+			}
+
+			if name.Pattern != tt.wantPattern {
+				t.Errorf("Pattern = %q, want %q", name.Pattern, tt.wantPattern)
+			}
+			if (name.MaxLength == nil) != (tt.wantMaxLength == nil) {
+				t.Errorf("MaxLength nil mismatch")
+			} else if name.MaxLength != nil && *name.MaxLength != *tt.wantMaxLength {
+				t.Errorf("MaxLength = %d, want %d", *name.MaxLength, *tt.wantMaxLength)
+			}
+		})
+	}
+}
+
+func ptr[T any](v T) *T { return &v }

From 3685d49c4e3c38360a6ea6d5de186e9b617f4658 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 11 Feb 2026 12:34:51 +0300
Subject: [PATCH 005/666] feat(api): add dynamic name length validation based
 on root-host

Read root-host from cozystack-values secret at API server startup
and use it to compute maximum allowed name length for applications.

For all apps: validates prefix + name fits within the Helm release
name limit (53 chars). For Tenants: additionally checks that the
host label (name + "." + rootHost) fits within the Kubernetes label
value limit (63 chars).

This replaces the static 40-char limit with a dynamic calculation
that accounts for the actual cluster root host length.

Ref: https://github.com/cozystack/cozystack/issues/2001

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 pkg/apiserver/apiserver.go                    |   2 +-
 pkg/cmd/server/start.go                       |  47 ++++++
 pkg/cmd/server/start_test.go                  |  93 ++++++++++-
 pkg/config/config.go                          |   1 +
 pkg/registry/apps/application/rest.go         |  47 +++++-
 .../apps/application/rest_validation_test.go  | 153 ++++++++++++++++++
 6 files changed, 339 insertions(+), 4 deletions(-)
 create mode 100644 pkg/registry/apps/application/rest_validation_test.go

diff --git a/pkg/apiserver/apiserver.go b/pkg/apiserver/apiserver.go
index bc2b4857..aba9a345 100644
--- a/pkg/apiserver/apiserver.go
+++ b/pkg/apiserver/apiserver.go
@@ -208,7 +208,7 @@ func (c completedConfig) New() (*CozyServer, error) {
 	// --- dynamically-configured, per-tenant resources ---
 	appsV1alpha1Storage := map[string]rest.Storage{}
 	for _, resConfig := range c.ResourceConfig.Resources {
-		storage := applicationstorage.NewREST(cli, watchCli, &resConfig)
+		storage := applicationstorage.NewREST(cli, watchCli, &resConfig, c.ResourceConfig.RootHost)
 		appsV1alpha1Storage[resConfig.Application.Plural] = cozyregistry.RESTInPeace(storage)
 	}
 	appsApiGroupInfo := genericapiserver.NewDefaultAPIGroupInfo(apps.GroupName, Scheme, metav1.ParameterCodec, Codecs)
diff --git a/pkg/cmd/server/start.go b/pkg/cmd/server/start.go
index 6ff8d2d1..90293b39 100644
--- a/pkg/cmd/server/start.go
+++ b/pkg/cmd/server/start.go
@@ -33,6 +33,7 @@ import (
 	"github.com/cozystack/cozystack/pkg/config"
 	sampleopenapi "github.com/cozystack/cozystack/pkg/generated/openapi"
 	"github.com/spf13/cobra"
+	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	utilerrors "k8s.io/apimachinery/pkg/util/errors"
 	"k8s.io/apiserver/pkg/endpoints/openapi"
@@ -44,6 +45,7 @@ import (
 	netutils "k8s.io/utils/net"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	k8sconfig "sigs.k8s.io/controller-runtime/pkg/client/config"
+	"sigs.k8s.io/yaml"
 )
 
 // CozyServerOptions holds the state for the Cozy API server
@@ -179,9 +181,54 @@ func (o *CozyServerOptions) Complete() error {
 		o.ResourceConfig.Resources = append(o.ResourceConfig.Resources, resource)
 	}
 
+	// Read root-host from cozystack-values secret (best-effort, non-fatal)
+	coreScheme := runtime.NewScheme()
+	_ = corev1.AddToScheme(coreScheme)
+	coreClient, err := client.New(cfg, client.Options{Scheme: coreScheme})
+	if err != nil {
+		fmt.Printf("Warning: failed to create client for reading cozystack-values secret: %v\n", err)
+	} else {
+		secret := &corev1.Secret{}
+		err := coreClient.Get(context.Background(), client.ObjectKey{
+			Namespace: "cozy-system",
+			Name:      "cozystack-values",
+		}, secret)
+		if err != nil {
+			fmt.Printf("Warning: failed to read cozystack-values secret: %v\n", err)
+		} else {
+			o.ResourceConfig.RootHost = parseRootHostFromSecret(secret)
+			if o.ResourceConfig.RootHost != "" {
+				fmt.Printf("Loaded root-host: %s\n", o.ResourceConfig.RootHost)
+			}
+		}
+	}
+
 	return nil
 }
 
+// parseRootHostFromSecret extracts _cluster.root-host from the cozystack-values secret.
+func parseRootHostFromSecret(secret *corev1.Secret) string {
+	if secret == nil || secret.Data == nil {
+		return ""
+	}
+
+	valuesYAML, ok := secret.Data["values.yaml"]
+	if !ok || len(valuesYAML) == 0 {
+		return ""
+	}
+
+	var values struct {
+		Cluster struct {
+			RootHost string `json:"root-host"`
+		} `json:"_cluster"`
+	}
+	if err := yaml.Unmarshal(valuesYAML, &values); err != nil {
+		return ""
+	}
+
+	return values.Cluster.RootHost
+}
+
 // Validate checks the correctness of the options
 func (o CozyServerOptions) Validate(args []string) error {
 	var allErrors []error
diff --git a/pkg/cmd/server/start_test.go b/pkg/cmd/server/start_test.go
index df7c3547..6e19a719 100644
--- a/pkg/cmd/server/start_test.go
+++ b/pkg/cmd/server/start_test.go
@@ -16,5 +16,94 @@ limitations under the License.
 
 package server
 
-// Note: Tests for KEP-4330 component versioning functionality have been removed
-// as the functionality is not available in Kubernetes v0.34.1.
+import (
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+)
+
+func TestParseRootHostFromSecret(t *testing.T) {
+	tests := []struct {
+		name     string
+		secret   *corev1.Secret
+		expected string
+	}{
+		{
+			name: "valid secret with root-host",
+			secret: &corev1.Secret{
+				Data: map[string][]byte{
+					"values.yaml": []byte("_cluster:\n  root-host: \"example.com\"\n  bundle-name: \"paas-full\"\n"),
+				},
+			},
+			expected: "example.com",
+		},
+		{
+			name: "valid secret with unquoted root-host",
+			secret: &corev1.Secret{
+				Data: map[string][]byte{
+					"values.yaml": []byte("_cluster:\n  root-host: my.domain.org\n"),
+				},
+			},
+			expected: "my.domain.org",
+		},
+		{
+			name: "missing values.yaml key",
+			secret: &corev1.Secret{
+				Data: map[string][]byte{
+					"other-key": []byte("some data"),
+				},
+			},
+			expected: "",
+		},
+		{
+			name: "malformed YAML",
+			secret: &corev1.Secret{
+				Data: map[string][]byte{
+					"values.yaml": []byte("not: valid: yaml: [[["),
+				},
+			},
+			expected: "",
+		},
+		{
+			name: "empty root-host",
+			secret: &corev1.Secret{
+				Data: map[string][]byte{
+					"values.yaml": []byte("_cluster:\n  root-host: \"\"\n"),
+				},
+			},
+			expected: "",
+		},
+		{
+			name: "no _cluster key",
+			secret: &corev1.Secret{
+				Data: map[string][]byte{
+					"values.yaml": []byte("other:\n  key: value\n"),
+				},
+			},
+			expected: "",
+		},
+		{
+			name: "_cluster without root-host",
+			secret: &corev1.Secret{
+				Data: map[string][]byte{
+					"values.yaml": []byte("_cluster:\n  bundle-name: \"paas-full\"\n"),
+				},
+			},
+			expected: "",
+		},
+		{
+			name:     "nil data",
+			secret:   &corev1.Secret{},
+			expected: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := parseRootHostFromSecret(tt.secret)
+			if result != tt.expected {
+				t.Errorf("parseRootHostFromSecret() = %q, want %q", result, tt.expected)
+			}
+		})
+	}
+}
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 1e123e2c..260d149a 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -19,6 +19,7 @@ package config
 // ResourceConfig represents the structure of the configuration file.
 type ResourceConfig struct {
 	Resources []Resource `yaml:"resources"`
+	RootHost  string     // cluster root host from cozystack-values secret
 }
 
 // Resource describes an individual resource.
diff --git a/pkg/registry/apps/application/rest.go b/pkg/registry/apps/application/rest.go
index d93f55e0..45c54b54 100644
--- a/pkg/registry/apps/application/rest.go
+++ b/pkg/registry/apps/application/rest.go
@@ -91,10 +91,11 @@ type REST struct {
 	singularName  string
 	releaseConfig config.ReleaseConfig
 	specSchema    *structuralschema.Structural
+	rootHost      string
 }
 
 // NewREST creates a new REST storage for Application with specific configuration
-func NewREST(c client.Client, w client.WithWatch, config *config.Resource) *REST {
+func NewREST(c client.Client, w client.WithWatch, config *config.Resource, rootHost string) *REST {
 	var specSchema *structuralschema.Structural
 
 	if raw := strings.TrimSpace(config.Application.OpenAPISchema); raw != "" {
@@ -133,6 +134,7 @@ func NewREST(c client.Client, w client.WithWatch, config *config.Resource) *REST
 		singularName:  config.Application.Singular,
 		releaseConfig: config.Release,
 		specSchema:    specSchema,
+		rootHost:      rootHost,
 	}
 }
 
@@ -159,6 +161,11 @@ func (r *REST) Create(ctx context.Context, obj runtime.Object, createValidation
 		return nil, apierrors.NewInvalid(r.gvk.GroupKind(), app.Name, errs)
 	}
 
+	// Validate name length against Helm release and label limits
+	if err := r.validateNameLength(app.Name); err != nil {
+		return nil, apierrors.NewBadRequest(err.Error())
+	}
+
 	// Validate that values don't contain reserved keys (starting with "_")
 	if err := validateNoInternalKeys(app.Spec); err != nil {
 		return nil, apierrors.NewBadRequest(err.Error())
@@ -477,6 +484,11 @@ func (r *REST) Update(ctx context.Context, name string, objInfo rest.UpdatedObje
 		return nil, false, fmt.Errorf("expected *appsv1alpha1.Application object, got %T", newObj)
 	}
 
+	// Validate name length against Helm release and label limits
+	if err := r.validateNameLength(app.Name); err != nil {
+		return nil, false, apierrors.NewBadRequest(err.Error())
+	}
+
 	// Validate that values don't contain reserved keys (starting with "_")
 	if err := validateNoInternalKeys(app.Spec); err != nil {
 		return nil, false, apierrors.NewBadRequest(err.Error())
@@ -1036,6 +1048,39 @@ func validateNoInternalKeys(values *apiextv1.JSON) error {
 	return nil
 }
 
+// maxHelmReleaseName is the maximum length of a Helm release name (DNS-1123 subdomain).
+const maxHelmReleaseName = 53
+
+// maxK8sLabelValue is the maximum length of a Kubernetes label value.
+const maxK8sLabelValue = 63
+
+// validateNameLength checks that the application name won't exceed Kubernetes limits.
+// For all apps: prefix + name must fit within the Helm release name limit (53 chars).
+// For Tenants: additionally checks that the host label (name + "." + rootHost) fits
+// within the Kubernetes label value limit (63 chars).
+func (r *REST) validateNameLength(name string) error {
+	helmMax := maxHelmReleaseName - len(r.releaseConfig.Prefix)
+	maxLen := helmMax
+
+	if r.kindName == "Tenant" && r.rootHost != "" {
+		hostLabelMax := maxK8sLabelValue - len(r.rootHost) - 1 // -1 for the dot separator
+		if hostLabelMax < maxLen {
+			maxLen = hostLabelMax
+		}
+	}
+
+	if maxLen <= 0 {
+		return fmt.Errorf("configuration error: no valid name length possible (release prefix %q, root host %q)",
+			r.releaseConfig.Prefix, r.rootHost)
+	}
+
+	if len(name) > maxLen {
+		return fmt.Errorf("name %q is too long: maximum %d characters allowed (release prefix %q, root host %q)",
+			name, maxLen, r.releaseConfig.Prefix, r.rootHost)
+	}
+	return nil
+}
+
 // convertHelmReleaseToApplication implements the actual conversion logic
 func (r *REST) convertHelmReleaseToApplication(ctx context.Context, hr *helmv2.HelmRelease) (appsv1alpha1.Application, error) {
 	// Filter out internal keys (starting with "_") from spec
diff --git a/pkg/registry/apps/application/rest_validation_test.go b/pkg/registry/apps/application/rest_validation_test.go
new file mode 100644
index 00000000..adecc3ad
--- /dev/null
+++ b/pkg/registry/apps/application/rest_validation_test.go
@@ -0,0 +1,153 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package application
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/cozystack/cozystack/pkg/config"
+)
+
+func TestValidateNameLength(t *testing.T) {
+	tests := []struct {
+		name      string
+		kindName  string
+		prefix    string
+		rootHost  string
+		appName   string
+		wantError bool
+	}{
+		{
+			name:      "non-tenant short name passes",
+			kindName:  "MySQL",
+			prefix:    "mysql-",
+			rootHost:  "example.com",
+			appName:   "mydb",
+			wantError: false,
+		},
+		{
+			name:      "non-tenant at helm boundary passes",
+			kindName:  "MySQL",
+			prefix:    "mysql-",
+			rootHost:  "example.com",
+			appName:   strings.Repeat("a", 53-len("mysql-")), // exactly 47 chars
+			wantError: false,
+		},
+		{
+			name:      "non-tenant exceeding helm limit fails",
+			kindName:  "MySQL",
+			prefix:    "mysql-",
+			rootHost:  "example.com",
+			appName:   strings.Repeat("a", 53-len("mysql-")+1), // 48 chars
+			wantError: true,
+		},
+		{
+			name:      "tenant no rootHost within helm limit passes",
+			kindName:  "Tenant",
+			prefix:    "tenant-",
+			rootHost:  "",
+			appName:   strings.Repeat("a", 53-len("tenant-")), // 46 chars
+			wantError: false,
+		},
+		{
+			name:      "tenant no rootHost exceeding helm limit fails",
+			kindName:  "Tenant",
+			prefix:    "tenant-",
+			rootHost:  "",
+			appName:   strings.Repeat("a", 53-len("tenant-")+1), // 47 chars
+			wantError: true,
+		},
+		{
+			name:      "tenant with rootHost within both limits passes",
+			kindName:  "Tenant",
+			prefix:    "tenant-",
+			rootHost:  "example.com", // 11 chars → host label max = 63-11-1 = 51
+			appName:   "short",
+			wantError: false,
+		},
+		{
+			name:     "tenant with short rootHost helm limit is still stricter",
+			kindName: "Tenant",
+			prefix:   "tenant-",
+			rootHost: "example.com",                          // 11 chars → host label max = 51, helm max = 46
+			appName:  strings.Repeat("a", 53-len("tenant-")), // 46 chars — at Helm boundary
+			wantError: false,
+		},
+		{
+			name:     "tenant with long rootHost at host label boundary passes",
+			kindName: "Tenant",
+			prefix:   "tenant-",
+			rootHost: "long-subdomain.hosting.example.com",                                    // 34 chars → host label max = 63-34-1 = 28
+			appName:  strings.Repeat("a", 63-len("long-subdomain.hosting.example.com")-1), // exactly 28 chars
+			wantError: false,
+		},
+		{
+			name:     "tenant with long rootHost exceeding host label limit fails",
+			kindName: "Tenant",
+			prefix:   "tenant-",
+			rootHost: "long-subdomain.hosting.example.com",                                      // 34 chars → host label max = 28
+			appName:  strings.Repeat("a", 63-len("long-subdomain.hosting.example.com")-1+1), // 29 chars
+			wantError: true,
+		},
+		{
+			name:      "tenant host label limit stricter than helm limit",
+			kindName:  "Tenant",
+			prefix:    "tenant-",
+			rootHost:  "very-long-subdomain.hosting.example.com", // 39 chars → host label max = 63-39-1 = 23
+			appName:   strings.Repeat("a", 24),                   // 24 > 23 (host limit) but < 46 (helm limit)
+			wantError: true,
+		},
+		{
+			name:      "tenant short rootHost where helm limit is stricter",
+			kindName:  "Tenant",
+			prefix:    "tenant-",
+			rootHost:  "x.co",                                     // 4 chars → host label max = 63-4-1 = 58, helm max = 46
+			appName:   strings.Repeat("a", 53-len("tenant-")+1), // 47 > 46 (helm limit) but < 58 (host limit)
+			wantError: true,
+		},
+		{
+			name:      "non-tenant ignores rootHost for limit calculation",
+			kindName:  "MySQL",
+			prefix:    "mysql-",
+			rootHost:  "very-long-subdomain.hosting.example.com",
+			appName:   strings.Repeat("a", 53-len("mysql-")), // at helm boundary
+			wantError: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := &REST{
+				kindName: tt.kindName,
+				releaseConfig: config.ReleaseConfig{
+					Prefix: tt.prefix,
+				},
+				rootHost: tt.rootHost,
+			}
+
+			err := r.validateNameLength(tt.appName)
+
+			if tt.wantError && err == nil {
+				t.Errorf("expected error for name %q (len=%d), got nil", tt.appName, len(tt.appName))
+			}
+			if !tt.wantError && err != nil {
+				t.Errorf("unexpected error for name %q (len=%d): %v", tt.appName, len(tt.appName), err)
+			}
+		})
+	}
+}

From dd34fb581ec78db333bc9dd7707d897b9615018a Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 11 Feb 2026 12:39:51 +0300
Subject: [PATCH 006/666] fix(api): handle edge case when prefix or root host
 exhaust name capacity

Add protection against negative or zero maxLen when release prefix or
root host are too long, returning a clear configuration error instead of
a confusing "name too long" message. Add corresponding test cases.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../apps/application/rest_validation_test.go  | 32 +++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/pkg/registry/apps/application/rest_validation_test.go b/pkg/registry/apps/application/rest_validation_test.go
index adecc3ad..8c93cf37 100644
--- a/pkg/registry/apps/application/rest_validation_test.go
+++ b/pkg/registry/apps/application/rest_validation_test.go
@@ -128,6 +128,38 @@ func TestValidateNameLength(t *testing.T) {
 			appName:   strings.Repeat("a", 53-len("mysql-")), // at helm boundary
 			wantError: false,
 		},
+		{
+			name:      "prefix consuming all helm capacity returns config error",
+			kindName:  "MySQL",
+			prefix:    strings.Repeat("x", 53), // prefix == maxHelmReleaseName → helmMax = 0
+			rootHost:  "",
+			appName:   "a",
+			wantError: true,
+		},
+		{
+			name:      "prefix exceeding helm capacity returns config error",
+			kindName:  "MySQL",
+			prefix:    strings.Repeat("x", 60), // prefix > maxHelmReleaseName → helmMax < 0
+			rootHost:  "",
+			appName:   "a",
+			wantError: true,
+		},
+		{
+			name:      "tenant with rootHost consuming all label capacity returns config error",
+			kindName:  "Tenant",
+			prefix:    "t-",
+			rootHost:  strings.Repeat("h", 62), // 62 chars → hostLabelMax = 63-62-1 = 0, helmMax = 51
+			appName:   "a",
+			wantError: true,
+		},
+		{
+			name:      "tenant with rootHost exceeding label capacity returns config error",
+			kindName:  "Tenant",
+			prefix:    "t-",
+			rootHost:  strings.Repeat("h", 70), // 70 chars → hostLabelMax = 63-70-1 = -8, helmMax = 51
+			appName:   "a",
+			wantError: true,
+		},
 	}
 
 	for _, tt := range tests {

From d4556e4c53ce430d87f5488f3d0f4005163d8342 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 11 Feb 2026 12:58:44 +0300
Subject: [PATCH 007/666] fix(api): address review feedback for name validation

- Add DNS-1035 format validation to Update path (was only in Create)
- Simplify Secret reading by reusing existing scheme instead of
  creating a separate client
- Add nil secret test case for parseRootHostFromSecret

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 pkg/cmd/server/start.go               | 28 ++++++++++++---------------
 pkg/cmd/server/start_test.go          |  5 +++++
 pkg/registry/apps/application/rest.go |  5 +++++
 3 files changed, 22 insertions(+), 16 deletions(-)

diff --git a/pkg/cmd/server/start.go b/pkg/cmd/server/start.go
index 90293b39..3c1db606 100644
--- a/pkg/cmd/server/start.go
+++ b/pkg/cmd/server/start.go
@@ -115,6 +115,9 @@ func (o *CozyServerOptions) Complete() error {
 	if err := v1alpha1.AddToScheme(scheme); err != nil {
 		return fmt.Errorf("failed to register types: %w", err)
 	}
+	if err := corev1.AddToScheme(scheme); err != nil {
+		return fmt.Errorf("failed to register core types: %w", err)
+	}
 
 	cfg, err := k8sconfig.GetConfig()
 	if err != nil {
@@ -182,24 +185,17 @@ func (o *CozyServerOptions) Complete() error {
 	}
 
 	// Read root-host from cozystack-values secret (best-effort, non-fatal)
-	coreScheme := runtime.NewScheme()
-	_ = corev1.AddToScheme(coreScheme)
-	coreClient, err := client.New(cfg, client.Options{Scheme: coreScheme})
+	secret := &corev1.Secret{}
+	err = o.Client.Get(context.Background(), client.ObjectKey{
+		Namespace: "cozy-system",
+		Name:      "cozystack-values",
+	}, secret)
 	if err != nil {
-		fmt.Printf("Warning: failed to create client for reading cozystack-values secret: %v\n", err)
+		fmt.Printf("Warning: failed to read cozystack-values secret: %v\n", err)
 	} else {
-		secret := &corev1.Secret{}
-		err := coreClient.Get(context.Background(), client.ObjectKey{
-			Namespace: "cozy-system",
-			Name:      "cozystack-values",
-		}, secret)
-		if err != nil {
-			fmt.Printf("Warning: failed to read cozystack-values secret: %v\n", err)
-		} else {
-			o.ResourceConfig.RootHost = parseRootHostFromSecret(secret)
-			if o.ResourceConfig.RootHost != "" {
-				fmt.Printf("Loaded root-host: %s\n", o.ResourceConfig.RootHost)
-			}
+		o.ResourceConfig.RootHost = parseRootHostFromSecret(secret)
+		if o.ResourceConfig.RootHost != "" {
+			fmt.Printf("Loaded root-host: %s\n", o.ResourceConfig.RootHost)
 		}
 	}
 
diff --git a/pkg/cmd/server/start_test.go b/pkg/cmd/server/start_test.go
index 6e19a719..3d4d7856 100644
--- a/pkg/cmd/server/start_test.go
+++ b/pkg/cmd/server/start_test.go
@@ -96,6 +96,11 @@ func TestParseRootHostFromSecret(t *testing.T) {
 			secret:   &corev1.Secret{},
 			expected: "",
 		},
+		{
+			name:     "nil secret",
+			secret:   nil,
+			expected: "",
+		},
 	}
 
 	for _, tt := range tests {
diff --git a/pkg/registry/apps/application/rest.go b/pkg/registry/apps/application/rest.go
index 45c54b54..16f0dde4 100644
--- a/pkg/registry/apps/application/rest.go
+++ b/pkg/registry/apps/application/rest.go
@@ -484,6 +484,11 @@ func (r *REST) Update(ctx context.Context, name string, objInfo rest.UpdatedObje
 		return nil, false, fmt.Errorf("expected *appsv1alpha1.Application object, got %T", newObj)
 	}
 
+	// Validate Application name conforms to DNS-1035
+	if errs := validation.ValidateApplicationName(app.Name, field.NewPath("metadata").Child("name")); len(errs) > 0 {
+		return nil, false, apierrors.NewInvalid(r.gvk.GroupKind(), app.Name, errs)
+	}
+
 	// Validate name length against Helm release and label limits
 	if err := r.validateNameLength(app.Name); err != nil {
 		return nil, false, apierrors.NewBadRequest(err.Error())

From 9e47669f686c5adac037eedc65662ab645cb731c Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 11 Feb 2026 13:07:50 +0300
Subject: [PATCH 008/666] fix(api): remove name validation from Update path and
 use klog
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Skip DNS-1035 and length validation on Update since Kubernetes names
are immutable — validating would block updates to pre-existing resources
with non-conforming names. Replace fmt.Printf with klog for structured
logging consistency.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 pkg/cmd/server/start.go               |  5 +++--
 pkg/registry/apps/application/rest.go | 12 +++---------
 2 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/pkg/cmd/server/start.go b/pkg/cmd/server/start.go
index 3c1db606..bf0d63bd 100644
--- a/pkg/cmd/server/start.go
+++ b/pkg/cmd/server/start.go
@@ -42,6 +42,7 @@ import (
 	utilfeature "k8s.io/apiserver/pkg/util/feature"
 	basecompatibility "k8s.io/component-base/compatibility"
 	baseversion "k8s.io/component-base/version"
+	"k8s.io/klog/v2"
 	netutils "k8s.io/utils/net"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	k8sconfig "sigs.k8s.io/controller-runtime/pkg/client/config"
@@ -191,11 +192,11 @@ func (o *CozyServerOptions) Complete() error {
 		Name:      "cozystack-values",
 	}, secret)
 	if err != nil {
-		fmt.Printf("Warning: failed to read cozystack-values secret: %v\n", err)
+		klog.Warningf("failed to read cozystack-values secret: %v", err)
 	} else {
 		o.ResourceConfig.RootHost = parseRootHostFromSecret(secret)
 		if o.ResourceConfig.RootHost != "" {
-			fmt.Printf("Loaded root-host: %s\n", o.ResourceConfig.RootHost)
+			klog.Infof("Loaded root-host: %s", o.ResourceConfig.RootHost)
 		}
 	}
 
diff --git a/pkg/registry/apps/application/rest.go b/pkg/registry/apps/application/rest.go
index 16f0dde4..42734774 100644
--- a/pkg/registry/apps/application/rest.go
+++ b/pkg/registry/apps/application/rest.go
@@ -484,15 +484,9 @@ func (r *REST) Update(ctx context.Context, name string, objInfo rest.UpdatedObje
 		return nil, false, fmt.Errorf("expected *appsv1alpha1.Application object, got %T", newObj)
 	}
 
-	// Validate Application name conforms to DNS-1035
-	if errs := validation.ValidateApplicationName(app.Name, field.NewPath("metadata").Child("name")); len(errs) > 0 {
-		return nil, false, apierrors.NewInvalid(r.gvk.GroupKind(), app.Name, errs)
-	}
-
-	// Validate name length against Helm release and label limits
-	if err := r.validateNameLength(app.Name); err != nil {
-		return nil, false, apierrors.NewBadRequest(err.Error())
-	}
+	// Note: name validation (DNS-1035 format + length) is intentionally skipped on
+	// Update because Kubernetes names are immutable. Validating here would block
+	// updates to pre-existing resources whose names don't conform to the new rules.
 
 	// Validate that values don't contain reserved keys (starting with "_")
 	if err := validateNoInternalKeys(app.Spec); err != nil {

From e978e00c7e7b0157c38047c962acb7372ff41004 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 11 Feb 2026 13:18:45 +0300
Subject: [PATCH 009/666] refactor(api): use standard IsDNS1035Label and remove
 static length limit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace custom DNS-1035 regex with k8s.io/apimachinery IsDNS1035Label.
Remove hardcoded maxApplicationNameLength=40 from both validation and
OpenAPI — length validation is now handled entirely by validateNameLength
which computes dynamic limits based on Helm release prefix and root-host.
Fix README to reflect that max length depends on cluster configuration.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/apps/tenant/README.md              |  6 ++--
 pkg/apis/apps/validation/validation.go      | 26 ++++-------------
 pkg/apis/apps/validation/validation_test.go |  6 ++--
 pkg/cmd/server/openapi.go                   |  6 ----
 pkg/cmd/server/openapi_test.go              | 31 +++++++--------------
 5 files changed, 21 insertions(+), 54 deletions(-)

diff --git a/packages/apps/tenant/README.md b/packages/apps/tenant/README.md
index 811197f2..472ccce2 100644
--- a/packages/apps/tenant/README.md
+++ b/packages/apps/tenant/README.md
@@ -10,16 +10,16 @@ Tenant names must follow DNS-1035 naming rules:
 -   Must start with a lowercase letter (`a-z`)
 -   Can only contain lowercase letters, numbers, and hyphens (`a-z`, `0-9`, `-`)
 -   Must end with a letter or number (not a hyphen)
--   Maximum length: 40 characters
+-   Maximum length depends on the cluster configuration (Helm release prefix and root domain)
 
-**Note:** Using dashes (`-`) in tenant names is discouraged, unlike with other services.
+**Note:** Using dashes (`-`) in tenant names is **allowed but discouraged**, unlike with other services.
 This is to keep consistent naming in tenants, nested tenants, and services deployed in them.
+Names with dashes (e.g., `foo-bar`) may lead to ambiguous parsing of internal resource names like `tenant-foo-bar`.
 
 For example:
 
 -   The root tenant is named `root`, but internally it's referenced as `tenant-root`.
 -   A nested tenant could be named `foo`, which would result in `tenant-foo` in service names and URLs.
--   However, a tenant can not be named `foo-bar`, because parsing names such as `tenant-foo-bar` would be ambiguous.
 
 ### Unique domains
 
diff --git a/pkg/apis/apps/validation/validation.go b/pkg/apis/apps/validation/validation.go
index c6c2e535..28810b72 100644
--- a/pkg/apis/apps/validation/validation.go
+++ b/pkg/apis/apps/validation/validation.go
@@ -17,24 +17,15 @@ limitations under the License.
 package validation
 
 import (
-	"regexp"
-
+	k8svalidation "k8s.io/apimachinery/pkg/util/validation"
 	"k8s.io/apimachinery/pkg/util/validation/field"
 )
 
-// dns1035LabelRegex validates DNS-1035 label format.
-// DNS-1035 labels must start with a letter, contain only lowercase alphanumeric
-// characters or hyphens, and end with an alphanumeric character.
-var dns1035LabelRegex = regexp.MustCompile(`^[a-z]([-a-z0-9]*[a-z0-9])?$`)
-
-// maxApplicationNameLength is the maximum length of an Application name.
-// This is set to 40 (not 63) to allow room for prefixes like "tenant-"
-// and nested tenant namespaces (e.g., "tenant-parent-child").
-const maxApplicationNameLength = 40
-
 // ValidateApplicationName validates that an Application name conforms to DNS-1035.
 // This is required because Application names are used to create Kubernetes resources
 // (Services, Namespaces, etc.) that must have DNS-1035 compliant names.
+// Note: length validation is handled separately by validateNameLength in the REST
+// handler, which computes dynamic limits based on Helm release prefix and root-host.
 func ValidateApplicationName(name string, fldPath *field.Path) field.ErrorList {
 	allErrs := field.ErrorList{}
 
@@ -43,15 +34,8 @@ func ValidateApplicationName(name string, fldPath *field.Path) field.ErrorList {
 		return allErrs
 	}
 
-	if len(name) > maxApplicationNameLength {
-		allErrs = append(allErrs, field.TooLongMaxLength(fldPath, name, maxApplicationNameLength))
-	}
-
-	if !dns1035LabelRegex.MatchString(name) {
-		allErrs = append(allErrs, field.Invalid(fldPath, name,
-			"a DNS-1035 label must consist of lower case alphanumeric characters or '-', "+
-				"start with an alphabetic character, and end with an alphanumeric character "+
-				"(e.g. 'my-name', regex used for validation is '[a-z]([-a-z0-9]*[a-z0-9])?')"))
+	for _, msg := range k8svalidation.IsDNS1035Label(name) {
+		allErrs = append(allErrs, field.Invalid(fldPath, name, msg))
 	}
 
 	return allErrs
diff --git a/pkg/apis/apps/validation/validation_test.go b/pkg/apis/apps/validation/validation_test.go
index 87e80fe0..7bf194d5 100644
--- a/pkg/apis/apps/validation/validation_test.go
+++ b/pkg/apis/apps/validation/validation_test.go
@@ -36,7 +36,7 @@ func TestValidateApplicationName(t *testing.T) {
 		{"valid lowercase", "my-tenant", false},
 		{"valid long name", "my-very-long-tenant-name", false},
 		{"valid double hyphen", "my--tenant", false},
-		{"valid max length (40 chars)", strings.Repeat("a", 40), false},
+		{"valid at DNS-1035 max (63 chars)", strings.Repeat("a", 63), false},
 
 		// Invalid: starts with wrong character
 		{"starts with digit", "1john", true},
@@ -64,8 +64,8 @@ func TestValidateApplicationName(t *testing.T) {
 		{"leading space", " tenant", true},
 		{"trailing space", "tenant ", true},
 
-		// Invalid: length
-		{"too long (41 chars)", strings.Repeat("a", 41), true},
+		// Invalid: exceeds DNS-1035 max length (63)
+		{"too long (64 chars)", strings.Repeat("a", 64), true},
 		{"way too long (100 chars)", strings.Repeat("a", 100), true},
 	}
 
diff --git a/pkg/cmd/server/openapi.go b/pkg/cmd/server/openapi.go
index e5734b9b..4d89d1fd 100644
--- a/pkg/cmd/server/openapi.go
+++ b/pkg/cmd/server/openapi.go
@@ -24,8 +24,6 @@ const (
 	objectMetaRef = "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"
 	// applicationNamePattern is DNS-1035 regex for Application names.
 	applicationNamePattern = `^[a-z]([-a-z0-9]*[a-z0-9])?$`
-	// applicationNameMaxLength is the maximum length for Application names.
-	applicationNameMaxLength = 40
 )
 
 // patchObjectMetaNameValidation adds DNS-1035 validation to metadata.name.
@@ -38,8 +36,6 @@ func patchObjectMetaNameValidation(schemas map[string]*spec.Schema) {
 
 	if name, ok := objMeta.Properties["name"]; ok {
 		name.Pattern = applicationNamePattern
-		maxLen := int64(applicationNameMaxLength)
-		name.MaxLength = &maxLen
 		objMeta.Properties["name"] = name
 	}
 }
@@ -53,8 +49,6 @@ func patchObjectMetaNameValidationV2(defs map[string]spec.Schema) {
 
 	if name, ok := objMeta.Properties["name"]; ok {
 		name.Pattern = applicationNamePattern
-		maxLen := int64(applicationNameMaxLength)
-		name.MaxLength = &maxLen
 		objMeta.Properties["name"] = name
 	}
 	defs[objectMetaRef] = objMeta
diff --git a/pkg/cmd/server/openapi_test.go b/pkg/cmd/server/openapi_test.go
index 921b0d30..626581ca 100644
--- a/pkg/cmd/server/openapi_test.go
+++ b/pkg/cmd/server/openapi_test.go
@@ -24,10 +24,9 @@ import (
 
 func TestPatchObjectMetaNameValidation(t *testing.T) {
 	tests := []struct {
-		name          string
-		schemas       map[string]*spec.Schema
-		wantPattern   string
-		wantMaxLength *int64
+		name        string
+		schemas     map[string]*spec.Schema
+		wantPattern string
 	}{
 		{
 			name: "patches ObjectMeta name field",
@@ -40,14 +39,12 @@ func TestPatchObjectMetaNameValidation(t *testing.T) {
 					},
 				},
 			},
-			wantPattern:   applicationNamePattern,
-			wantMaxLength: ptr(int64(applicationNameMaxLength)),
+			wantPattern: applicationNamePattern,
 		},
 		{
-			name:          "no panic when ObjectMeta missing",
-			schemas:       map[string]*spec.Schema{},
-			wantPattern:   "",
-			wantMaxLength: nil,
+			name:        "no panic when ObjectMeta missing",
+			schemas:     map[string]*spec.Schema{},
+			wantPattern: "",
 		},
 		{
 			name: "no panic when name field missing",
@@ -58,8 +55,7 @@ func TestPatchObjectMetaNameValidation(t *testing.T) {
 					},
 				},
 			},
-			wantPattern:   "",
-			wantMaxLength: nil,
+			wantPattern: "",
 		},
 	}
 
@@ -69,7 +65,7 @@ func TestPatchObjectMetaNameValidation(t *testing.T) {
 
 			objMeta, ok := tt.schemas[objectMetaRef]
 			if !ok {
-				if tt.wantPattern != "" || tt.wantMaxLength != nil {
+				if tt.wantPattern != "" {
 					t.Error("expected ObjectMeta to exist")
 				}
 				return
@@ -77,7 +73,7 @@ func TestPatchObjectMetaNameValidation(t *testing.T) {
 
 			name, ok := objMeta.Properties["name"]
 			if !ok {
-				if tt.wantPattern != "" || tt.wantMaxLength != nil {
+				if tt.wantPattern != "" {
 					t.Error("expected name field to exist")
 				}
 				return
@@ -86,13 +82,6 @@ func TestPatchObjectMetaNameValidation(t *testing.T) {
 			if name.Pattern != tt.wantPattern {
 				t.Errorf("Pattern = %q, want %q", name.Pattern, tt.wantPattern)
 			}
-			if (name.MaxLength == nil) != (tt.wantMaxLength == nil) {
-				t.Errorf("MaxLength nil mismatch")
-			} else if name.MaxLength != nil && *name.MaxLength != *tt.wantMaxLength {
-				t.Errorf("MaxLength = %d, want %d", *name.MaxLength, *tt.wantMaxLength)
-			}
 		})
 	}
 }
-
-func ptr[T any](v T) *T { return &v }

From c932740dc5d09d7a7c3f9d66d13044a8aa35713e Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 11 Feb 2026 13:24:16 +0300
Subject: [PATCH 010/666] refactor(api): remove global ObjectMeta name patching
 from OpenAPI

Remove patchObjectMetaNameValidation and patchObjectMetaNameValidationV2
functions that were modifying the global ObjectMeta schema. This patching
affected ALL resources served by the API server, not just Application
resources. Backend validation in Create() is sufficient for enforcing
name constraints.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 pkg/cmd/server/openapi.go      | 38 ---------------
 pkg/cmd/server/openapi_test.go | 87 ----------------------------------
 2 files changed, 125 deletions(-)
 delete mode 100644 pkg/cmd/server/openapi_test.go

diff --git a/pkg/cmd/server/openapi.go b/pkg/cmd/server/openapi.go
index 4d89d1fd..b52aa989 100644
--- a/pkg/cmd/server/openapi.go
+++ b/pkg/cmd/server/openapi.go
@@ -20,40 +20,8 @@ const (
 	baseStatusRef = apiPrefix + ".ApplicationStatus"
 	smp           = "application/strategic-merge-patch+json"
 
-	// objectMetaRef is the OpenAPI reference for Kubernetes ObjectMeta.
-	objectMetaRef = "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"
-	// applicationNamePattern is DNS-1035 regex for Application names.
-	applicationNamePattern = `^[a-z]([-a-z0-9]*[a-z0-9])?$`
 )
 
-// patchObjectMetaNameValidation adds DNS-1035 validation to metadata.name.
-// This ensures UI form validation matches backend validation.
-func patchObjectMetaNameValidation(schemas map[string]*spec.Schema) {
-	objMeta, ok := schemas[objectMetaRef]
-	if !ok || objMeta == nil {
-		return
-	}
-
-	if name, ok := objMeta.Properties["name"]; ok {
-		name.Pattern = applicationNamePattern
-		objMeta.Properties["name"] = name
-	}
-}
-
-// patchObjectMetaNameValidationV2 adds DNS-1035 validation for Swagger v2.
-func patchObjectMetaNameValidationV2(defs map[string]spec.Schema) {
-	objMeta, ok := defs[objectMetaRef]
-	if !ok {
-		return
-	}
-
-	if name, ok := objMeta.Properties["name"]; ok {
-		name.Pattern = applicationNamePattern
-		objMeta.Properties["name"] = name
-	}
-	defs[objectMetaRef] = objMeta
-}
-
 // deepCopySchema clones *spec.Schema via JSON-marshal/unmarshal.
 func deepCopySchema(in *spec.Schema) *spec.Schema {
 	if in == nil {
@@ -295,9 +263,6 @@ func buildPostProcessV3(kindSchemas map[string]string) func(*spec3.OpenAPI) (*sp
 			}
 		}
 
-		// Add name validation to ObjectMeta for UI form validation
-		patchObjectMetaNameValidation(doc.Components.Schemas)
-
 		// Rewrite all $ref in the document
 		out, err := rewriteDocRefs(doc)
 		if err != nil {
@@ -379,9 +344,6 @@ func buildPostProcessV2(kindSchemas map[string]string) func(*spec.Swagger) (*spe
 			return sw, fmt.Errorf("base Application* schemas not found")
 		}
 
-		// Add name validation to ObjectMeta for UI form validation
-		patchObjectMetaNameValidationV2(defs)
-
 		for kind, raw := range kindSchemas {
 			ref := apiPrefix + "." + kind
 			statusRef := ref + "Status"
diff --git a/pkg/cmd/server/openapi_test.go b/pkg/cmd/server/openapi_test.go
deleted file mode 100644
index 626581ca..00000000
--- a/pkg/cmd/server/openapi_test.go
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
-Copyright 2024 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package server
-
-import (
-	"testing"
-
-	"k8s.io/kube-openapi/pkg/validation/spec"
-)
-
-func TestPatchObjectMetaNameValidation(t *testing.T) {
-	tests := []struct {
-		name        string
-		schemas     map[string]*spec.Schema
-		wantPattern string
-	}{
-		{
-			name: "patches ObjectMeta name field",
-			schemas: map[string]*spec.Schema{
-				objectMetaRef: {
-					SchemaProps: spec.SchemaProps{
-						Properties: map[string]spec.Schema{
-							"name": {SchemaProps: spec.SchemaProps{Type: []string{"string"}}},
-						},
-					},
-				},
-			},
-			wantPattern: applicationNamePattern,
-		},
-		{
-			name:        "no panic when ObjectMeta missing",
-			schemas:     map[string]*spec.Schema{},
-			wantPattern: "",
-		},
-		{
-			name: "no panic when name field missing",
-			schemas: map[string]*spec.Schema{
-				objectMetaRef: {
-					SchemaProps: spec.SchemaProps{
-						Properties: map[string]spec.Schema{},
-					},
-				},
-			},
-			wantPattern: "",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			patchObjectMetaNameValidation(tt.schemas)
-
-			objMeta, ok := tt.schemas[objectMetaRef]
-			if !ok {
-				if tt.wantPattern != "" {
-					t.Error("expected ObjectMeta to exist")
-				}
-				return
-			}
-
-			name, ok := objMeta.Properties["name"]
-			if !ok {
-				if tt.wantPattern != "" {
-					t.Error("expected name field to exist")
-				}
-				return
-			}
-
-			if name.Pattern != tt.wantPattern {
-				t.Errorf("Pattern = %q, want %q", name.Pattern, tt.wantPattern)
-			}
-		})
-	}
-}

From e267cfcf9dd30aef98f2fa0a4a479db5d0b305a9 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 11 Feb 2026 13:29:42 +0300
Subject: [PATCH 011/666] fix(api): address review feedback for validation
 consistency

- Return field.ErrorList from validateNameLength for consistent
  apierrors.NewInvalid error shape (was NewBadRequest)
- Add klog warning when YAML parsing fails in parseRootHostFromSecret
- Fix maxHelmReleaseName comment to accurately describe Helm convention
- Add note that root-host changes require API server restart
- Replace interface{} with any throughout openapi.go and rest.go
- Remove trailing blank line in const block

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 pkg/cmd/server/openapi.go                     | 31 ++++++++--------
 pkg/cmd/server/start.go                       |  1 +
 pkg/registry/apps/application/rest.go         | 36 ++++++++++++-------
 .../apps/application/rest_validation_test.go  | 10 +++---
 4 files changed, 44 insertions(+), 34 deletions(-)

diff --git a/pkg/cmd/server/openapi.go b/pkg/cmd/server/openapi.go
index b52aa989..616709ca 100644
--- a/pkg/cmd/server/openapi.go
+++ b/pkg/cmd/server/openapi.go
@@ -19,7 +19,6 @@ const (
 	baseListRef   = apiPrefix + ".ApplicationList"
 	baseStatusRef = apiPrefix + ".ApplicationStatus"
 	smp           = "application/strategic-merge-patch+json"
-
 )
 
 // deepCopySchema clones *spec.Schema via JSON-marshal/unmarshal.
@@ -102,9 +101,9 @@ func cloneKindSchemas(kind string, base, baseStatus, baseList *spec.Schema, v3 b
 
 	// GVK-extensions
 	setGVK := func(s *spec.Schema, k string) {
-		s.Extensions = map[string]interface{}{
-			"x-kubernetes-group-version-kind": []interface{}{
-				map[string]interface{}{"group": "apps.cozystack.io", "version": "v1alpha1", "kind": k},
+		s.Extensions = map[string]any{
+			"x-kubernetes-group-version-kind": []any{
+				map[string]any{"group": "apps.cozystack.io", "version": "v1alpha1", "kind": k},
 			},
 		}
 	}
@@ -133,35 +132,35 @@ func cloneKindSchemas(kind string, base, baseStatus, baseList *spec.Schema, v3 b
 }
 
 // rewriteDocRefs rewrites all $ref in the OpenAPI document
-func rewriteDocRefs(doc interface{}) ([]byte, error) {
+func rewriteDocRefs(doc any) ([]byte, error) {
 	raw, err := json.Marshal(doc)
 	if err != nil {
 		return nil, fmt.Errorf("failed to marshal OpenAPI document: %w", err)
 	}
-	var any interface{}
-	if err := json.Unmarshal(raw, &any); err != nil {
+	var parsed any
+	if err := json.Unmarshal(raw, &parsed); err != nil {
 		return nil, err
 	}
-	walkAndRewriteRefs(any, "")
-	return json.Marshal(any)
+	walkAndRewriteRefs(parsed, "")
+	return json.Marshal(parsed)
 }
 
 // walkAndRewriteRefs walks arbitrary JSON (map/array) and
 //   - when encountering x-kubernetes-group-version-kind, extracts kind,
 //     updating the currentKind context;
 //   - rewrites all $ref inside the current context from Application* → kind*.
-func walkAndRewriteRefs(node interface{}, currentKind string) {
+func walkAndRewriteRefs(node any, currentKind string) {
 	switch n := node.(type) {
-	case map[string]interface{}:
+	case map[string]any:
 		if gvk, ok := n["x-kubernetes-group-version-kind"]; ok {
 			switch g := gvk.(type) {
-			case map[string]interface{}:
+			case map[string]any:
 				if k, ok := g["kind"].(string); ok {
 					currentKind = k
 				}
-			case []interface{}:
+			case []any:
 				if len(g) > 0 {
-					if mm, ok := g[0].(map[string]interface{}); ok {
+					if mm, ok := g[0].(map[string]any); ok {
 						if k, ok := mm["kind"].(string); ok {
 							currentKind = k
 						}
@@ -178,7 +177,7 @@ func walkAndRewriteRefs(node interface{}, currentKind string) {
 			}
 			walkAndRewriteRefs(v, currentKind)
 		}
-	case []interface{}:
+	case []any:
 		for _, v := range n {
 			walkAndRewriteRefs(v, currentKind)
 		}
@@ -293,7 +292,7 @@ func sanitizeForV2(s *spec.Schema) {
 		if hasIntAndStringAnyOf(s.AnyOf) {
 			s.Type = spec.StringOrArray{"string"}
 			if s.Extensions == nil {
-				s.Extensions = map[string]interface{}{}
+				s.Extensions = map[string]any{}
 			}
 			s.Extensions["x-kubernetes-int-or-string"] = true
 		}
diff --git a/pkg/cmd/server/start.go b/pkg/cmd/server/start.go
index bf0d63bd..09c9485c 100644
--- a/pkg/cmd/server/start.go
+++ b/pkg/cmd/server/start.go
@@ -220,6 +220,7 @@ func parseRootHostFromSecret(secret *corev1.Secret) string {
 		} `json:"_cluster"`
 	}
 	if err := yaml.Unmarshal(valuesYAML, &values); err != nil {
+		klog.Warningf("failed to parse values.yaml from cozystack-values secret: %v", err)
 		return ""
 	}
 
diff --git a/pkg/registry/apps/application/rest.go b/pkg/registry/apps/application/rest.go
index 42734774..26e8429f 100644
--- a/pkg/registry/apps/application/rest.go
+++ b/pkg/registry/apps/application/rest.go
@@ -162,8 +162,8 @@ func (r *REST) Create(ctx context.Context, obj runtime.Object, createValidation
 	}
 
 	// Validate name length against Helm release and label limits
-	if err := r.validateNameLength(app.Name); err != nil {
-		return nil, apierrors.NewBadRequest(err.Error())
+	if nameLenErrs := r.validateNameLength(app.Name); len(nameLenErrs) > 0 {
+		return nil, apierrors.NewInvalid(r.gvk.GroupKind(), app.Name, nameLenErrs)
 	}
 
 	// Validate that values don't contain reserved keys (starting with "_")
@@ -1014,7 +1014,7 @@ func filterInternalKeys(values *apiextv1.JSON) *apiextv1.JSON {
 	if values == nil || len(values.Raw) == 0 {
 		return values
 	}
-	var data map[string]interface{}
+	var data map[string]any
 	if err := json.Unmarshal(values.Raw, &data); err != nil {
 		return values
 	}
@@ -1035,7 +1035,7 @@ func validateNoInternalKeys(values *apiextv1.JSON) error {
 	if values == nil || len(values.Raw) == 0 {
 		return nil
 	}
-	var data map[string]interface{}
+	var data map[string]any
 	if err := json.Unmarshal(values.Raw, &data); err != nil {
 		return err
 	}
@@ -1047,7 +1047,8 @@ func validateNoInternalKeys(values *apiextv1.JSON) error {
 	return nil
 }
 
-// maxHelmReleaseName is the maximum length of a Helm release name (DNS-1123 subdomain).
+// maxHelmReleaseName is the Helm release name limit. Helm reserves room for
+// chart-generated resource suffixes within the 63-char DNS-1035 label limit.
 const maxHelmReleaseName = 53
 
 // maxK8sLabelValue is the maximum length of a Kubernetes label value.
@@ -1057,7 +1058,13 @@ const maxK8sLabelValue = 63
 // For all apps: prefix + name must fit within the Helm release name limit (53 chars).
 // For Tenants: additionally checks that the host label (name + "." + rootHost) fits
 // within the Kubernetes label value limit (63 chars).
-func (r *REST) validateNameLength(name string) error {
+//
+// Note: rootHost is read once at API server startup from the cozystack-values Secret.
+// Changing root-host requires an API server restart for validation to reflect the new value.
+func (r *REST) validateNameLength(name string) field.ErrorList {
+	fldPath := field.NewPath("metadata").Child("name")
+	allErrs := field.ErrorList{}
+
 	helmMax := maxHelmReleaseName - len(r.releaseConfig.Prefix)
 	maxLen := helmMax
 
@@ -1069,15 +1076,18 @@ func (r *REST) validateNameLength(name string) error {
 	}
 
 	if maxLen <= 0 {
-		return fmt.Errorf("configuration error: no valid name length possible (release prefix %q, root host %q)",
-			r.releaseConfig.Prefix, r.rootHost)
+		allErrs = append(allErrs, field.Invalid(fldPath, name,
+			fmt.Sprintf("configuration error: no valid name length possible (release prefix %q, root host %q)",
+				r.releaseConfig.Prefix, r.rootHost)))
+		return allErrs
 	}
 
 	if len(name) > maxLen {
-		return fmt.Errorf("name %q is too long: maximum %d characters allowed (release prefix %q, root host %q)",
-			name, maxLen, r.releaseConfig.Prefix, r.rootHost)
+		allErrs = append(allErrs, field.Invalid(fldPath, name,
+			fmt.Sprintf("must be no more than %d characters (release prefix %q, root host %q)",
+				maxLen, r.releaseConfig.Prefix, r.rootHost)))
 	}
-	return nil
+	return allErrs
 }
 
 // convertHelmReleaseToApplication implements the actual conversion logic
@@ -1233,7 +1243,7 @@ func (r *REST) buildTableFromApplications(apps []appsv1alpha1.Application) metav
 	for i := range apps {
 		app := &apps[i]
 		row := metav1.TableRow{
-			Cells:  []interface{}{app.GetName(), getReadyStatus(app.Status.Conditions), computeAge(app.GetCreationTimestamp().Time, now), getVersion(app.Status.Version)},
+			Cells:  []any{app.GetName(), getReadyStatus(app.Status.Conditions), computeAge(app.GetCreationTimestamp().Time, now), getVersion(app.Status.Version)},
 			Object: runtime.RawExtension{Object: app},
 		}
 		table.Rows = append(table.Rows, row)
@@ -1257,7 +1267,7 @@ func (r *REST) buildTableFromApplication(app appsv1alpha1.Application) metav1.Ta
 
 	a := app
 	row := metav1.TableRow{
-		Cells:  []interface{}{app.GetName(), getReadyStatus(app.Status.Conditions), computeAge(app.GetCreationTimestamp().Time, now), getVersion(app.Status.Version)},
+		Cells:  []any{app.GetName(), getReadyStatus(app.Status.Conditions), computeAge(app.GetCreationTimestamp().Time, now), getVersion(app.Status.Version)},
 		Object: runtime.RawExtension{Object: &a},
 	}
 	table.Rows = append(table.Rows, row)
diff --git a/pkg/registry/apps/application/rest_validation_test.go b/pkg/registry/apps/application/rest_validation_test.go
index 8c93cf37..ee6d66da 100644
--- a/pkg/registry/apps/application/rest_validation_test.go
+++ b/pkg/registry/apps/application/rest_validation_test.go
@@ -172,13 +172,13 @@ func TestValidateNameLength(t *testing.T) {
 				rootHost: tt.rootHost,
 			}
 
-			err := r.validateNameLength(tt.appName)
+			errs := r.validateNameLength(tt.appName)
 
-			if tt.wantError && err == nil {
-				t.Errorf("expected error for name %q (len=%d), got nil", tt.appName, len(tt.appName))
+			if tt.wantError && len(errs) == 0 {
+				t.Errorf("expected error for name %q (len=%d), got none", tt.appName, len(tt.appName))
 			}
-			if !tt.wantError && err != nil {
-				t.Errorf("unexpected error for name %q (len=%d): %v", tt.appName, len(tt.appName), err)
+			if !tt.wantError && len(errs) > 0 {
+				t.Errorf("unexpected error for name %q (len=%d): %v", tt.appName, len(tt.appName), errs)
 			}
 		})
 	}

From d5e713a4e79a773ae9729c47c14f86e916a582e4 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 11 Feb 2026 13:32:59 +0300
Subject: [PATCH 012/666] fix(api): fix import order and context-aware error
 messages

- Fix goimports order: duration before validation/field
- Show rootHost in error messages only for Tenant kind where it
  actually affects the length calculation

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 pkg/registry/apps/application/rest.go | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/pkg/registry/apps/application/rest.go b/pkg/registry/apps/application/rest.go
index 26e8429f..fcbcfcef 100644
--- a/pkg/registry/apps/application/rest.go
+++ b/pkg/registry/apps/application/rest.go
@@ -35,8 +35,8 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/selection"
-	"k8s.io/apimachinery/pkg/util/validation/field"
 	"k8s.io/apimachinery/pkg/util/duration"
+	"k8s.io/apimachinery/pkg/util/validation/field"
 	"k8s.io/apimachinery/pkg/watch"
 	"k8s.io/apiserver/pkg/endpoints/request"
 	"k8s.io/apiserver/pkg/registry/rest"
@@ -1075,17 +1075,25 @@ func (r *REST) validateNameLength(name string) field.ErrorList {
 		}
 	}
 
+	isTenantWithHost := r.kindName == "Tenant" && r.rootHost != ""
+
 	if maxLen <= 0 {
-		allErrs = append(allErrs, field.Invalid(fldPath, name,
-			fmt.Sprintf("configuration error: no valid name length possible (release prefix %q, root host %q)",
-				r.releaseConfig.Prefix, r.rootHost)))
+		msg := fmt.Sprintf("configuration error: no valid name length possible (release prefix %q)", r.releaseConfig.Prefix)
+		if isTenantWithHost {
+			msg = fmt.Sprintf("configuration error: no valid name length possible (release prefix %q, root host %q)",
+				r.releaseConfig.Prefix, r.rootHost)
+		}
+		allErrs = append(allErrs, field.Invalid(fldPath, name, msg))
 		return allErrs
 	}
 
 	if len(name) > maxLen {
-		allErrs = append(allErrs, field.Invalid(fldPath, name,
-			fmt.Sprintf("must be no more than %d characters (release prefix %q, root host %q)",
-				maxLen, r.releaseConfig.Prefix, r.rootHost)))
+		msg := fmt.Sprintf("must be no more than %d characters (release prefix %q)", maxLen, r.releaseConfig.Prefix)
+		if isTenantWithHost {
+			msg = fmt.Sprintf("must be no more than %d characters (release prefix %q, root host %q)",
+				maxLen, r.releaseConfig.Prefix, r.rootHost)
+		}
+		allErrs = append(allErrs, field.Invalid(fldPath, name, msg))
 	}
 	return allErrs
 }

From 5bf481ae4dc27c051512c99fa9926e8eb834f3dc Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 11 Feb 2026 13:35:42 +0300
Subject: [PATCH 013/666] chore: update copyright year in start_test.go

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 pkg/cmd/server/start_test.go                          | 2 +-
 pkg/registry/apps/application/rest_validation_test.go | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkg/cmd/server/start_test.go b/pkg/cmd/server/start_test.go
index 3d4d7856..3a43df72 100644
--- a/pkg/cmd/server/start_test.go
+++ b/pkg/cmd/server/start_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2024 The Cozystack Authors.
+Copyright 2026 The Cozystack Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
diff --git a/pkg/registry/apps/application/rest_validation_test.go b/pkg/registry/apps/application/rest_validation_test.go
index ee6d66da..07b78e1a 100644
--- a/pkg/registry/apps/application/rest_validation_test.go
+++ b/pkg/registry/apps/application/rest_validation_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2025 The Cozystack Authors.
+Copyright 2026 The Cozystack Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

From f61c8f9859381bcf41466c8fffa7c9c82576af7c Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Wed, 11 Feb 2026 22:39:35 +0100
Subject: [PATCH 014/666] [platform] Clean up Helm secrets for removed -rd
 releases in migration 23

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/core/platform/images/migrations/migrations/23 | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/packages/core/platform/images/migrations/migrations/23 b/packages/core/platform/images/migrations/migrations/23
index 4e8c8e18..7cb9c85e 100755
--- a/packages/core/platform/images/migrations/migrations/23
+++ b/packages/core/platform/images/migrations/migrations/23
@@ -6,6 +6,13 @@ set -euo pipefail
 # Remove old cozystack-resource-definition-crd HelmRelease (renamed to application-definition-crd)
 kubectl delete hr -n cozy-system cozystack-resource-definition-crd --ignore-not-found
 
+kubectl delete secrets -n cozy-system $(
+  kubectl get secrets -n cozy-system \
+    -l owner=helm \
+    -o jsonpath='{range .items[*]}{.metadata.labels.name}{" "}{.metadata.name}{"\n"}{end}' \
+  | awk '$1 ~ /-rd$/ {print $2}'
+) --ignore-not-found
+
 # Stamp version
 kubectl create configmap -n cozy-system cozystack-version \
   --from-literal=version=24 --dry-run=client -o yaml | kubectl apply -f-

From b8ccdedbf8929ca1a9f38ee5178c23563d08b129 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 12 Feb 2026 00:14:37 +0100
Subject: [PATCH 015/666] [monitoring] Fix YAML parse error in
 monitoring-agents vmagent template

Replace unrendered Helm template expressions in values.yaml with
global.target parameter. Pass tenant-root from platform bundle,
default to cozy-monitoring. Use tpl in vmagent template to render URLs.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../core/platform/templates/bundles/system.yaml  |  3 ++-
 .../monitoring-agents/templates/vmagent.yaml     |  4 ++--
 packages/system/monitoring-agents/values.yaml    | 16 +++++++++-------
 3 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/packages/core/platform/templates/bundles/system.yaml b/packages/core/platform/templates/bundles/system.yaml
index 2d8b7e33..c24726ef 100644
--- a/packages/core/platform/templates/bundles/system.yaml
+++ b/packages/core/platform/templates/bundles/system.yaml
@@ -136,7 +136,8 @@
 {{include "cozystack.platform.package.optional.default" (list "cozystack.velero" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.vertical-pod-autoscaler" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.metrics-server" $) }}
-{{include "cozystack.platform.package.default" (list "cozystack.monitoring-agents" $) }}
+{{- $monitoringAgentsComponents := dict "monitoring-agents" (dict "values" (dict "global" (dict "target" "tenant-root"))) -}}
+{{include "cozystack.platform.package" (list "cozystack.monitoring-agents" "default" $ $monitoringAgentsComponents) }}
 {{include "cozystack.platform.package.default" (list "cozystack.goldpinger" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.prometheus-operator-crds" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.grafana-operator" $) }}
diff --git a/packages/system/monitoring-agents/templates/vmagent.yaml b/packages/system/monitoring-agents/templates/vmagent.yaml
index 56b756e7..00ab63c1 100644
--- a/packages/system/monitoring-agents/templates/vmagent.yaml
+++ b/packages/system/monitoring-agents/templates/vmagent.yaml
@@ -10,12 +10,12 @@ spec:
   shardCount: 1
   externalLabels:
     cluster: {{ .Values.vmagent.externalLabels.cluster }}
-    tenant: {{ .Values.vmagent.externalLabels.tenant }}
+    tenant: {{ .Values.global.target }}
   extraArgs:
     {{- toYaml (deepCopy .Values.vmagent.extraArgs | mergeOverwrite (fromYaml (include "monitoring-agents.vmagent.defaultExtraArgs" .))) | nindent 4 }}
   remoteWrite:
   {{- range .Values.vmagent.remoteWrite.urls }}
-  - url: {{ . | quote }}
+  - url: {{ tpl . $ | quote }}
   {{- end }}
 
   scrapeInterval: 30s
diff --git a/packages/system/monitoring-agents/values.yaml b/packages/system/monitoring-agents/values.yaml
index 3b79de95..a4d4b025 100644
--- a/packages/system/monitoring-agents/values.yaml
+++ b/packages/system/monitoring-agents/values.yaml
@@ -1,3 +1,6 @@
+global:
+  target: cozy-monitoring
+
 kube-state-metrics:
   extraArgs:
     - --metric-labels-allowlist=pods=[*],deployments=[*]
@@ -275,11 +278,10 @@ kube-state-metrics:
 vmagent:
   externalLabels:
     cluster: cozystack
-    tenant: '{{ .Release.Namespace }}'
   remoteWrite:
     urls:
-      - 'http://vminsert-shortterm.{{ .Release.Namespace }}.svc:8480/insert/0/prometheus'
-      - 'http://vminsert-longterm.{{ .Release.Namespace }}.svc:8480/insert/0/prometheus'
+      - http://vminsert-shortterm.{{ .Values.global.target }}.svc:8480/insert/0/prometheus
+      - http://vminsert-longterm.{{ .Values.global.target }}.svc:8480/insert/0/prometheus
   extraArgs: {}
 
 fluent-bit:
@@ -342,7 +344,7 @@ fluent-bit:
       [OUTPUT]
           Name http
           Match kube.*
-          Host vlogs-generic.{{ .Release.Namespace }}.svc
+          Host vlogs-generic.{{ .Values.global.target }}.svc
           port 9428
           compress gzip
           uri /insert/jsonline?_stream_fields=log_source,stream,kubernetes_pod_name,kubernetes_container_name,kubernetes_namespace_name&_msg_field=log&_time_field=date
@@ -353,7 +355,7 @@ fluent-bit:
       [OUTPUT]
           Name http
           Match events.*
-          Host vlogs-generic.{{ .Release.Namespace }}.svc
+          Host vlogs-generic.{{ .Values.global.target }}.svc
           port 9428
           compress gzip
           uri /insert/jsonline?_stream_fields=log_source,reason,meatdata_namespace,metadata_name&_msg_field=message&_time_field=date
@@ -364,7 +366,7 @@ fluent-bit:
       [OUTPUT]
           Name http
           Match audit.*
-          Host vlogs-generic.{{ .Release.Namespace }}.svc
+          Host vlogs-generic.{{ .Values.global.target }}.svc
           port 9428
           compress gzip
           uri /insert/jsonline?_stream_fields=log_source,stage,user_username,verb,requestUri&_msg_field=requestURI&_time_field=date
@@ -416,7 +418,7 @@ fluent-bit:
       [FILTER]
           Name modify
           Match *
-          Add tenant {{ .Release.Namespace }}
+          Add tenant {{ .Values.global.target }}
       [FILTER]
           Name modify
           Match *

From fb8157ef9bb07e957ab8660c78cfcf0dc857b9b7 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 12 Feb 2026 13:52:37 +0300
Subject: [PATCH 016/666] refactor(api): remove rootHost-based name length
 validation

Root-host validation for Tenant names is no longer needed here.
The underlying issue (namespace.cozystack.io/host label exceeding
63-char limit) will be addressed in #2002 by moving the label
to an annotation.

Name length validation now only checks the Helm release name
limit (53 - prefix length), which applies uniformly to all
application types.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 pkg/apis/apps/validation/validation.go        |  2 +-
 pkg/apiserver/apiserver.go                    |  2 +-
 pkg/cmd/server/start.go                       | 41 --------
 pkg/cmd/server/start_test.go                  | 97 -------------------
 pkg/config/config.go                          |  1 -
 pkg/registry/apps/application/rest.go         | 42 ++------
 .../apps/application/rest_validation_test.go  | 91 +----------------
 7 files changed, 14 insertions(+), 262 deletions(-)

diff --git a/pkg/apis/apps/validation/validation.go b/pkg/apis/apps/validation/validation.go
index 28810b72..273873a4 100644
--- a/pkg/apis/apps/validation/validation.go
+++ b/pkg/apis/apps/validation/validation.go
@@ -25,7 +25,7 @@ import (
 // This is required because Application names are used to create Kubernetes resources
 // (Services, Namespaces, etc.) that must have DNS-1035 compliant names.
 // Note: length validation is handled separately by validateNameLength in the REST
-// handler, which computes dynamic limits based on Helm release prefix and root-host.
+// handler, which computes dynamic limits based on Helm release prefix.
 func ValidateApplicationName(name string, fldPath *field.Path) field.ErrorList {
 	allErrs := field.ErrorList{}
 
diff --git a/pkg/apiserver/apiserver.go b/pkg/apiserver/apiserver.go
index aba9a345..bc2b4857 100644
--- a/pkg/apiserver/apiserver.go
+++ b/pkg/apiserver/apiserver.go
@@ -208,7 +208,7 @@ func (c completedConfig) New() (*CozyServer, error) {
 	// --- dynamically-configured, per-tenant resources ---
 	appsV1alpha1Storage := map[string]rest.Storage{}
 	for _, resConfig := range c.ResourceConfig.Resources {
-		storage := applicationstorage.NewREST(cli, watchCli, &resConfig, c.ResourceConfig.RootHost)
+		storage := applicationstorage.NewREST(cli, watchCli, &resConfig)
 		appsV1alpha1Storage[resConfig.Application.Plural] = cozyregistry.RESTInPeace(storage)
 	}
 	appsApiGroupInfo := genericapiserver.NewDefaultAPIGroupInfo(apps.GroupName, Scheme, metav1.ParameterCodec, Codecs)
diff --git a/pkg/cmd/server/start.go b/pkg/cmd/server/start.go
index 09c9485c..9a688700 100644
--- a/pkg/cmd/server/start.go
+++ b/pkg/cmd/server/start.go
@@ -42,11 +42,9 @@ import (
 	utilfeature "k8s.io/apiserver/pkg/util/feature"
 	basecompatibility "k8s.io/component-base/compatibility"
 	baseversion "k8s.io/component-base/version"
-	"k8s.io/klog/v2"
 	netutils "k8s.io/utils/net"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	k8sconfig "sigs.k8s.io/controller-runtime/pkg/client/config"
-	"sigs.k8s.io/yaml"
 )
 
 // CozyServerOptions holds the state for the Cozy API server
@@ -185,48 +183,9 @@ func (o *CozyServerOptions) Complete() error {
 		o.ResourceConfig.Resources = append(o.ResourceConfig.Resources, resource)
 	}
 
-	// Read root-host from cozystack-values secret (best-effort, non-fatal)
-	secret := &corev1.Secret{}
-	err = o.Client.Get(context.Background(), client.ObjectKey{
-		Namespace: "cozy-system",
-		Name:      "cozystack-values",
-	}, secret)
-	if err != nil {
-		klog.Warningf("failed to read cozystack-values secret: %v", err)
-	} else {
-		o.ResourceConfig.RootHost = parseRootHostFromSecret(secret)
-		if o.ResourceConfig.RootHost != "" {
-			klog.Infof("Loaded root-host: %s", o.ResourceConfig.RootHost)
-		}
-	}
-
 	return nil
 }
 
-// parseRootHostFromSecret extracts _cluster.root-host from the cozystack-values secret.
-func parseRootHostFromSecret(secret *corev1.Secret) string {
-	if secret == nil || secret.Data == nil {
-		return ""
-	}
-
-	valuesYAML, ok := secret.Data["values.yaml"]
-	if !ok || len(valuesYAML) == 0 {
-		return ""
-	}
-
-	var values struct {
-		Cluster struct {
-			RootHost string `json:"root-host"`
-		} `json:"_cluster"`
-	}
-	if err := yaml.Unmarshal(valuesYAML, &values); err != nil {
-		klog.Warningf("failed to parse values.yaml from cozystack-values secret: %v", err)
-		return ""
-	}
-
-	return values.Cluster.RootHost
-}
-
 // Validate checks the correctness of the options
 func (o CozyServerOptions) Validate(args []string) error {
 	var allErrors []error
diff --git a/pkg/cmd/server/start_test.go b/pkg/cmd/server/start_test.go
index 3a43df72..9dc2000c 100644
--- a/pkg/cmd/server/start_test.go
+++ b/pkg/cmd/server/start_test.go
@@ -15,100 +15,3 @@ limitations under the License.
 */
 
 package server
-
-import (
-	"testing"
-
-	corev1 "k8s.io/api/core/v1"
-)
-
-func TestParseRootHostFromSecret(t *testing.T) {
-	tests := []struct {
-		name     string
-		secret   *corev1.Secret
-		expected string
-	}{
-		{
-			name: "valid secret with root-host",
-			secret: &corev1.Secret{
-				Data: map[string][]byte{
-					"values.yaml": []byte("_cluster:\n  root-host: \"example.com\"\n  bundle-name: \"paas-full\"\n"),
-				},
-			},
-			expected: "example.com",
-		},
-		{
-			name: "valid secret with unquoted root-host",
-			secret: &corev1.Secret{
-				Data: map[string][]byte{
-					"values.yaml": []byte("_cluster:\n  root-host: my.domain.org\n"),
-				},
-			},
-			expected: "my.domain.org",
-		},
-		{
-			name: "missing values.yaml key",
-			secret: &corev1.Secret{
-				Data: map[string][]byte{
-					"other-key": []byte("some data"),
-				},
-			},
-			expected: "",
-		},
-		{
-			name: "malformed YAML",
-			secret: &corev1.Secret{
-				Data: map[string][]byte{
-					"values.yaml": []byte("not: valid: yaml: [[["),
-				},
-			},
-			expected: "",
-		},
-		{
-			name: "empty root-host",
-			secret: &corev1.Secret{
-				Data: map[string][]byte{
-					"values.yaml": []byte("_cluster:\n  root-host: \"\"\n"),
-				},
-			},
-			expected: "",
-		},
-		{
-			name: "no _cluster key",
-			secret: &corev1.Secret{
-				Data: map[string][]byte{
-					"values.yaml": []byte("other:\n  key: value\n"),
-				},
-			},
-			expected: "",
-		},
-		{
-			name: "_cluster without root-host",
-			secret: &corev1.Secret{
-				Data: map[string][]byte{
-					"values.yaml": []byte("_cluster:\n  bundle-name: \"paas-full\"\n"),
-				},
-			},
-			expected: "",
-		},
-		{
-			name:     "nil data",
-			secret:   &corev1.Secret{},
-			expected: "",
-		},
-		{
-			name:     "nil secret",
-			secret:   nil,
-			expected: "",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := parseRootHostFromSecret(tt.secret)
-			if result != tt.expected {
-				t.Errorf("parseRootHostFromSecret() = %q, want %q", result, tt.expected)
-			}
-		})
-	}
-}
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 260d149a..1e123e2c 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -19,7 +19,6 @@ package config
 // ResourceConfig represents the structure of the configuration file.
 type ResourceConfig struct {
 	Resources []Resource `yaml:"resources"`
-	RootHost  string     // cluster root host from cozystack-values secret
 }
 
 // Resource describes an individual resource.
diff --git a/pkg/registry/apps/application/rest.go b/pkg/registry/apps/application/rest.go
index fcbcfcef..7871bbe7 100644
--- a/pkg/registry/apps/application/rest.go
+++ b/pkg/registry/apps/application/rest.go
@@ -91,11 +91,10 @@ type REST struct {
 	singularName  string
 	releaseConfig config.ReleaseConfig
 	specSchema    *structuralschema.Structural
-	rootHost      string
 }
 
 // NewREST creates a new REST storage for Application with specific configuration
-func NewREST(c client.Client, w client.WithWatch, config *config.Resource, rootHost string) *REST {
+func NewREST(c client.Client, w client.WithWatch, config *config.Resource) *REST {
 	var specSchema *structuralschema.Structural
 
 	if raw := strings.TrimSpace(config.Application.OpenAPISchema); raw != "" {
@@ -134,7 +133,6 @@ func NewREST(c client.Client, w client.WithWatch, config *config.Resource, rootH
 		singularName:  config.Application.Singular,
 		releaseConfig: config.Release,
 		specSchema:    specSchema,
-		rootHost:      rootHost,
 	}
 }
 
@@ -1051,49 +1049,23 @@ func validateNoInternalKeys(values *apiextv1.JSON) error {
 // chart-generated resource suffixes within the 63-char DNS-1035 label limit.
 const maxHelmReleaseName = 53
 
-// maxK8sLabelValue is the maximum length of a Kubernetes label value.
-const maxK8sLabelValue = 63
-
 // validateNameLength checks that the application name won't exceed Kubernetes limits.
-// For all apps: prefix + name must fit within the Helm release name limit (53 chars).
-// For Tenants: additionally checks that the host label (name + "." + rootHost) fits
-// within the Kubernetes label value limit (63 chars).
-//
-// Note: rootHost is read once at API server startup from the cozystack-values Secret.
-// Changing root-host requires an API server restart for validation to reflect the new value.
+// prefix + name must fit within the Helm release name limit (53 chars).
 func (r *REST) validateNameLength(name string) field.ErrorList {
 	fldPath := field.NewPath("metadata").Child("name")
 	allErrs := field.ErrorList{}
 
-	helmMax := maxHelmReleaseName - len(r.releaseConfig.Prefix)
-	maxLen := helmMax
-
-	if r.kindName == "Tenant" && r.rootHost != "" {
-		hostLabelMax := maxK8sLabelValue - len(r.rootHost) - 1 // -1 for the dot separator
-		if hostLabelMax < maxLen {
-			maxLen = hostLabelMax
-		}
-	}
-
-	isTenantWithHost := r.kindName == "Tenant" && r.rootHost != ""
+	maxLen := maxHelmReleaseName - len(r.releaseConfig.Prefix)
 
 	if maxLen <= 0 {
-		msg := fmt.Sprintf("configuration error: no valid name length possible (release prefix %q)", r.releaseConfig.Prefix)
-		if isTenantWithHost {
-			msg = fmt.Sprintf("configuration error: no valid name length possible (release prefix %q, root host %q)",
-				r.releaseConfig.Prefix, r.rootHost)
-		}
-		allErrs = append(allErrs, field.Invalid(fldPath, name, msg))
+		allErrs = append(allErrs, field.Invalid(fldPath, name,
+			fmt.Sprintf("configuration error: no valid name length possible (release prefix %q)", r.releaseConfig.Prefix)))
 		return allErrs
 	}
 
 	if len(name) > maxLen {
-		msg := fmt.Sprintf("must be no more than %d characters (release prefix %q)", maxLen, r.releaseConfig.Prefix)
-		if isTenantWithHost {
-			msg = fmt.Sprintf("must be no more than %d characters (release prefix %q, root host %q)",
-				maxLen, r.releaseConfig.Prefix, r.rootHost)
-		}
-		allErrs = append(allErrs, field.Invalid(fldPath, name, msg))
+		allErrs = append(allErrs, field.Invalid(fldPath, name,
+			fmt.Sprintf("must be no more than %d characters (release prefix %q)", maxLen, r.releaseConfig.Prefix)))
 	}
 	return allErrs
 }
diff --git a/pkg/registry/apps/application/rest_validation_test.go b/pkg/registry/apps/application/rest_validation_test.go
index 07b78e1a..c5d331b2 100644
--- a/pkg/registry/apps/application/rest_validation_test.go
+++ b/pkg/registry/apps/application/rest_validation_test.go
@@ -28,111 +28,48 @@ func TestValidateNameLength(t *testing.T) {
 		name      string
 		kindName  string
 		prefix    string
-		rootHost  string
 		appName   string
 		wantError bool
 	}{
 		{
-			name:      "non-tenant short name passes",
+			name:      "short name passes",
 			kindName:  "MySQL",
 			prefix:    "mysql-",
-			rootHost:  "example.com",
 			appName:   "mydb",
 			wantError: false,
 		},
 		{
-			name:      "non-tenant at helm boundary passes",
+			name:      "at helm boundary passes",
 			kindName:  "MySQL",
 			prefix:    "mysql-",
-			rootHost:  "example.com",
 			appName:   strings.Repeat("a", 53-len("mysql-")), // exactly 47 chars
 			wantError: false,
 		},
 		{
-			name:      "non-tenant exceeding helm limit fails",
+			name:      "exceeding helm limit fails",
 			kindName:  "MySQL",
 			prefix:    "mysql-",
-			rootHost:  "example.com",
 			appName:   strings.Repeat("a", 53-len("mysql-")+1), // 48 chars
 			wantError: true,
 		},
 		{
-			name:      "tenant no rootHost within helm limit passes",
+			name:      "tenant within helm limit passes",
 			kindName:  "Tenant",
 			prefix:    "tenant-",
-			rootHost:  "",
 			appName:   strings.Repeat("a", 53-len("tenant-")), // 46 chars
 			wantError: false,
 		},
 		{
-			name:      "tenant no rootHost exceeding helm limit fails",
+			name:      "tenant exceeding helm limit fails",
 			kindName:  "Tenant",
 			prefix:    "tenant-",
-			rootHost:  "",
 			appName:   strings.Repeat("a", 53-len("tenant-")+1), // 47 chars
 			wantError: true,
 		},
-		{
-			name:      "tenant with rootHost within both limits passes",
-			kindName:  "Tenant",
-			prefix:    "tenant-",
-			rootHost:  "example.com", // 11 chars → host label max = 63-11-1 = 51
-			appName:   "short",
-			wantError: false,
-		},
-		{
-			name:     "tenant with short rootHost helm limit is still stricter",
-			kindName: "Tenant",
-			prefix:   "tenant-",
-			rootHost: "example.com",                          // 11 chars → host label max = 51, helm max = 46
-			appName:  strings.Repeat("a", 53-len("tenant-")), // 46 chars — at Helm boundary
-			wantError: false,
-		},
-		{
-			name:     "tenant with long rootHost at host label boundary passes",
-			kindName: "Tenant",
-			prefix:   "tenant-",
-			rootHost: "long-subdomain.hosting.example.com",                                    // 34 chars → host label max = 63-34-1 = 28
-			appName:  strings.Repeat("a", 63-len("long-subdomain.hosting.example.com")-1), // exactly 28 chars
-			wantError: false,
-		},
-		{
-			name:     "tenant with long rootHost exceeding host label limit fails",
-			kindName: "Tenant",
-			prefix:   "tenant-",
-			rootHost: "long-subdomain.hosting.example.com",                                      // 34 chars → host label max = 28
-			appName:  strings.Repeat("a", 63-len("long-subdomain.hosting.example.com")-1+1), // 29 chars
-			wantError: true,
-		},
-		{
-			name:      "tenant host label limit stricter than helm limit",
-			kindName:  "Tenant",
-			prefix:    "tenant-",
-			rootHost:  "very-long-subdomain.hosting.example.com", // 39 chars → host label max = 63-39-1 = 23
-			appName:   strings.Repeat("a", 24),                   // 24 > 23 (host limit) but < 46 (helm limit)
-			wantError: true,
-		},
-		{
-			name:      "tenant short rootHost where helm limit is stricter",
-			kindName:  "Tenant",
-			prefix:    "tenant-",
-			rootHost:  "x.co",                                     // 4 chars → host label max = 63-4-1 = 58, helm max = 46
-			appName:   strings.Repeat("a", 53-len("tenant-")+1), // 47 > 46 (helm limit) but < 58 (host limit)
-			wantError: true,
-		},
-		{
-			name:      "non-tenant ignores rootHost for limit calculation",
-			kindName:  "MySQL",
-			prefix:    "mysql-",
-			rootHost:  "very-long-subdomain.hosting.example.com",
-			appName:   strings.Repeat("a", 53-len("mysql-")), // at helm boundary
-			wantError: false,
-		},
 		{
 			name:      "prefix consuming all helm capacity returns config error",
 			kindName:  "MySQL",
 			prefix:    strings.Repeat("x", 53), // prefix == maxHelmReleaseName → helmMax = 0
-			rootHost:  "",
 			appName:   "a",
 			wantError: true,
 		},
@@ -140,23 +77,6 @@ func TestValidateNameLength(t *testing.T) {
 			name:      "prefix exceeding helm capacity returns config error",
 			kindName:  "MySQL",
 			prefix:    strings.Repeat("x", 60), // prefix > maxHelmReleaseName → helmMax < 0
-			rootHost:  "",
-			appName:   "a",
-			wantError: true,
-		},
-		{
-			name:      "tenant with rootHost consuming all label capacity returns config error",
-			kindName:  "Tenant",
-			prefix:    "t-",
-			rootHost:  strings.Repeat("h", 62), // 62 chars → hostLabelMax = 63-62-1 = 0, helmMax = 51
-			appName:   "a",
-			wantError: true,
-		},
-		{
-			name:      "tenant with rootHost exceeding label capacity returns config error",
-			kindName:  "Tenant",
-			prefix:    "t-",
-			rootHost:  strings.Repeat("h", 70), // 70 chars → hostLabelMax = 63-70-1 = -8, helmMax = 51
 			appName:   "a",
 			wantError: true,
 		},
@@ -169,7 +89,6 @@ func TestValidateNameLength(t *testing.T) {
 				releaseConfig: config.ReleaseConfig{
 					Prefix: tt.prefix,
 				},
-				rootHost: tt.rootHost,
 			}
 
 			errs := r.validateNameLength(tt.appName)

From bce530011699e03eaa08fefd3f0945caed55c9c3 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 10 Feb 2026 19:11:22 +0100
Subject: [PATCH 017/666] refactor: rename mysql application to mariadb

The mysql chart actually deploys MariaDB via mariadb-operator, but was
incorrectly named "mysql". Rename all references to use the correct
"mariadb" name across the codebase.

Changes:
- Rename packages/apps/mysql -> packages/apps/mariadb
- Rename packages/system/mysql-rd -> packages/system/mariadb-rd
- Rename platform source and bundle references
- Update CRD kind from MySQL to MariaDB
- Update RBAC, e2e tests, backup controller tests
- Keep real MySQL CLI/config tool names unchanged (mysqldump, [mysqld], etc.)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 Makefile                                      |  2 +-
 api/backups/v1alpha1/DESIGN.md                |  2 +-
 api/backups/v1alpha1/backupclass_types.go     |  2 +-
 docs/agents/contributing.md                   |  2 +-
 hack/e2e-apps/mariadb.bats                    | 46 +++++++++++++++++++
 hack/e2e-apps/mysql.bats                      | 46 -------------------
 .../backupclass_resolver_test.go              | 22 ++++-----
 .../factory/backupjob_test.go                 |  4 +-
 packages/apps/{mysql => mariadb}/.helmignore  |  0
 packages/apps/{mysql => mariadb}/Chart.yaml   |  2 +-
 packages/apps/{mysql => mariadb}/Makefile     |  0
 packages/apps/{mysql => mariadb}/README.md    |  2 +-
 .../apps/{mysql => mariadb}/charts/cozy-lib   |  0
 .../{mysql => mariadb}/files/versions.yaml    |  0
 .../hack/update-versions.sh                   |  6 +--
 .../images/mariadb-backup.tag                 |  0
 .../images/mariadb-backup/Dockerfile          |  0
 .../apps/{mysql => mariadb}/logos/mariadb.svg |  0
 .../{mysql => mariadb}/templates/.gitkeep     |  0
 .../templates/_resources.tpl                  |  0
 .../templates/_versions.tpl                   |  2 +-
 .../templates/backup-cronjob.yaml             |  0
 .../templates/backup-script.yaml              |  0
 .../templates/backup-secret.yaml              |  0
 .../{mysql => mariadb}/templates/config.yaml  |  0
 .../templates/dashboard-resourcemap.yaml      |  0
 .../apps/{mysql => mariadb}/templates/db.yaml |  0
 .../templates/hooks/cleanup-pvc.yaml          |  0
 .../{mysql => mariadb}/templates/mariadb.yaml |  2 +-
 .../templates/regsecret.yaml                  |  0
 .../{mysql => mariadb}/templates/secret.yaml  |  0
 .../{mysql => mariadb}/templates/user.yaml    |  0
 .../templates/workloadmonitor.yaml            |  4 +-
 .../{mysql => mariadb}/values.schema.json     |  2 +-
 packages/apps/{mysql => mariadb}/values.yaml  |  2 +-
 ...lication.yaml => mariadb-application.yaml} | 12 ++---
 .../core/platform/templates/bundles/paas.yaml |  2 +-
 .../templates/clusterroles.yaml               |  2 +-
 .../{mysql-rd => mariadb-rd}/Chart.yaml       |  2 +-
 .../system/{mysql-rd => mariadb-rd}/Makefile  |  2 +-
 .../cozyrds/mariadb.yaml}                     | 24 +++++-----
 .../templates/cozyrd.yaml                     |  0
 .../{mysql-rd => mariadb-rd}/values.yaml      |  0
 43 files changed, 96 insertions(+), 96 deletions(-)
 create mode 100644 hack/e2e-apps/mariadb.bats
 delete mode 100644 hack/e2e-apps/mysql.bats
 rename packages/apps/{mysql => mariadb}/.helmignore (100%)
 rename packages/apps/{mysql => mariadb}/Chart.yaml (93%)
 rename packages/apps/{mysql => mariadb}/Makefile (100%)
 rename packages/apps/{mysql => mariadb}/README.md (98%)
 rename packages/apps/{mysql => mariadb}/charts/cozy-lib (100%)
 rename packages/apps/{mysql => mariadb}/files/versions.yaml (100%)
 rename packages/apps/{mysql => mariadb}/hack/update-versions.sh (97%)
 rename packages/apps/{mysql => mariadb}/images/mariadb-backup.tag (100%)
 rename packages/apps/{mysql => mariadb}/images/mariadb-backup/Dockerfile (100%)
 rename packages/apps/{mysql => mariadb}/logos/mariadb.svg (100%)
 rename packages/apps/{mysql => mariadb}/templates/.gitkeep (100%)
 rename packages/apps/{mysql => mariadb}/templates/_resources.tpl (100%)
 rename packages/apps/{mysql => mariadb}/templates/_versions.tpl (89%)
 rename packages/apps/{mysql => mariadb}/templates/backup-cronjob.yaml (100%)
 rename packages/apps/{mysql => mariadb}/templates/backup-script.yaml (100%)
 rename packages/apps/{mysql => mariadb}/templates/backup-secret.yaml (100%)
 rename packages/apps/{mysql => mariadb}/templates/config.yaml (100%)
 rename packages/apps/{mysql => mariadb}/templates/dashboard-resourcemap.yaml (100%)
 rename packages/apps/{mysql => mariadb}/templates/db.yaml (100%)
 rename packages/apps/{mysql => mariadb}/templates/hooks/cleanup-pvc.yaml (100%)
 rename packages/apps/{mysql => mariadb}/templates/mariadb.yaml (97%)
 rename packages/apps/{mysql => mariadb}/templates/regsecret.yaml (100%)
 rename packages/apps/{mysql => mariadb}/templates/secret.yaml (100%)
 rename packages/apps/{mysql => mariadb}/templates/user.yaml (100%)
 rename packages/apps/{mysql => mariadb}/templates/workloadmonitor.yaml (88%)
 rename packages/apps/{mysql => mariadb}/values.schema.json (99%)
 rename packages/apps/{mysql => mariadb}/values.yaml (98%)
 rename packages/core/platform/sources/{mysql-application.yaml => mariadb-application.yaml} (71%)
 rename packages/system/{mysql-rd => mariadb-rd}/Chart.yaml (87%)
 rename packages/system/{mysql-rd => mariadb-rd}/Makefile (73%)
 rename packages/system/{mysql-rd/cozyrds/mysql.yaml => mariadb-rd/cozyrds/mariadb.yaml} (69%)
 rename packages/system/{mysql-rd => mariadb-rd}/templates/cozyrd.yaml (100%)
 rename packages/system/{mysql-rd => mariadb-rd}/values.yaml (100%)

diff --git a/Makefile b/Makefile
index 9b3b217c..e6c50458 100644
--- a/Makefile
+++ b/Makefile
@@ -11,7 +11,7 @@ build-deps:
 
 build: build-deps
 	make -C packages/apps/http-cache image
-	make -C packages/apps/mysql image
+	make -C packages/apps/mariadb image
 	make -C packages/apps/clickhouse image
 	make -C packages/apps/kubernetes image
 	make -C packages/system/monitoring image
diff --git a/api/backups/v1alpha1/DESIGN.md b/api/backups/v1alpha1/DESIGN.md
index bab753b2..7ba06fae 100644
--- a/api/backups/v1alpha1/DESIGN.md
+++ b/api/backups/v1alpha1/DESIGN.md
@@ -196,7 +196,7 @@ type ApplicationSelector struct {
     // +optional
     APIGroup *string `json:"apiGroup,omitempty"`
 
-    // Kind is the kind of the application (e.g., VirtualMachine, MySQL).
+    // Kind is the kind of the application (e.g., VirtualMachine, MariaDB).
     Kind string `json:"kind"`
 }
 ```
diff --git a/api/backups/v1alpha1/backupclass_types.go b/api/backups/v1alpha1/backupclass_types.go
index 19bcfd52..2b2dc7ff 100644
--- a/api/backups/v1alpha1/backupclass_types.go
+++ b/api/backups/v1alpha1/backupclass_types.go
@@ -73,7 +73,7 @@ type ApplicationSelector struct {
 	// +optional
 	APIGroup *string `json:"apiGroup,omitempty"`
 
-	// Kind is the kind of the application (e.g., VirtualMachine, MySQL).
+	// Kind is the kind of the application (e.g., VirtualMachine, MariaDB).
 	Kind string `json:"kind"`
 }
 
diff --git a/docs/agents/contributing.md b/docs/agents/contributing.md
index 4a2a7ef9..d5a4366e 100644
--- a/docs/agents/contributing.md
+++ b/docs/agents/contributing.md
@@ -27,7 +27,7 @@ git commit --signoff -m "[component] Brief description of changes"
 
 **Component prefixes:**
 - System: `[dashboard]`, `[platform]`, `[cilium]`, `[kube-ovn]`, `[linstor]`, `[fluxcd]`, `[cluster-api]`
-- Apps: `[postgres]`, `[mysql]`, `[redis]`, `[kafka]`, `[clickhouse]`, `[virtual-machine]`, `[kubernetes]`
+- Apps: `[postgres]`, `[mariadb]`, `[redis]`, `[kafka]`, `[clickhouse]`, `[virtual-machine]`, `[kubernetes]`
 - Other: `[tests]`, `[ci]`, `[docs]`, `[maintenance]`
 
 **Examples:**
diff --git a/hack/e2e-apps/mariadb.bats b/hack/e2e-apps/mariadb.bats
new file mode 100644
index 00000000..50e608ac
--- /dev/null
+++ b/hack/e2e-apps/mariadb.bats
@@ -0,0 +1,46 @@
+#!/usr/bin/env bats
+
+@test "Create DB MariaDB" {
+  name='test'
+  kubectl apply -f- <<EOF
+apiVersion: apps.cozystack.io/v1alpha1
+kind: MariaDB
+metadata:
+  name: $name
+  namespace: tenant-test
+spec:
+  external: false
+  size: 10Gi
+  replicas: 2
+  storageClass: ""
+  users:
+    testuser:
+      maxUserConnections: 1000
+      password: xai7Wepo
+  databases:
+    testdb:
+      roles:
+        admin:
+        - testuser
+  backup:
+    enabled: false
+    s3Region: us-east-1
+    s3Bucket: s3.example.org/postgres-backups
+    schedule: "0 2 * * *"
+    cleanupStrategy: "--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
+    s3AccessKey: oobaiRus9pah8PhohL1ThaeTa4UVa7gu
+    s3SecretKey: ju3eum4dekeich9ahM1te8waeGai0oog
+    resticPassword: ChaXoveekoh6eigh4siesheeda2quai0
+  resources: {}
+  resourcesPreset: "nano"
+EOF
+  sleep 5
+  kubectl -n tenant-test wait hr mariadb-$name --timeout=30s --for=condition=ready
+  timeout 80 sh -ec "until kubectl -n tenant-test get svc mariadb-$name -o jsonpath='{.spec.ports[0].port}' | grep -q '3306'; do sleep 10; done"
+  timeout 80 sh -ec "until kubectl -n tenant-test get endpoints mariadb-$name -o jsonpath='{.subsets[*].addresses[*].ip}' | grep -q '[0-9]'; do sleep 10; done"
+  kubectl -n tenant-test wait statefulset.apps/mariadb-$name --timeout=110s --for=jsonpath='{.status.replicas}'=2
+  timeout 80 sh -ec "until kubectl -n tenant-test get svc mariadb-$name-metrics -o jsonpath='{.spec.ports[0].port}' | grep -q '9104'; do sleep 10; done"
+  timeout 40 sh -ec "until kubectl -n tenant-test get endpoints mariadb-$name-metrics -o jsonpath='{.subsets[*].addresses[*].ip}' | grep -q '[0-9]'; do sleep 10; done"
+  kubectl -n tenant-test wait deployment.apps/mariadb-$name-metrics --timeout=90s --for=jsonpath='{.status.replicas}'=1
+  kubectl -n tenant-test delete mariadbs.apps.cozystack.io $name
+}
diff --git a/hack/e2e-apps/mysql.bats b/hack/e2e-apps/mysql.bats
deleted file mode 100644
index 031ce832..00000000
--- a/hack/e2e-apps/mysql.bats
+++ /dev/null
@@ -1,46 +0,0 @@
-#!/usr/bin/env bats
-
-@test "Create DB MySQL" {
-  name='test'
-  kubectl apply -f- <<EOF
-apiVersion: apps.cozystack.io/v1alpha1
-kind: MySQL
-metadata:
-  name: $name
-  namespace: tenant-test
-spec:
-  external: false
-  size: 10Gi
-  replicas: 2
-  storageClass: ""
-  users:
-    testuser:
-      maxUserConnections: 1000
-      password: xai7Wepo
-  databases:
-    testdb:
-      roles:
-        admin:
-        - testuser
-  backup:
-    enabled: false
-    s3Region: us-east-1
-    s3Bucket: s3.example.org/postgres-backups
-    schedule: "0 2 * * *"
-    cleanupStrategy: "--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
-    s3AccessKey: oobaiRus9pah8PhohL1ThaeTa4UVa7gu
-    s3SecretKey: ju3eum4dekeich9ahM1te8waeGai0oog
-    resticPassword: ChaXoveekoh6eigh4siesheeda2quai0
-  resources: {}
-  resourcesPreset: "nano"
-EOF
-  sleep 5
-  kubectl -n tenant-test wait hr mysql-$name --timeout=30s --for=condition=ready
-  timeout 80 sh -ec "until kubectl -n tenant-test get svc mysql-$name -o jsonpath='{.spec.ports[0].port}' | grep -q '3306'; do sleep 10; done"
-  timeout 80 sh -ec "until kubectl -n tenant-test get endpoints mysql-$name -o jsonpath='{.subsets[*].addresses[*].ip}' | grep -q '[0-9]'; do sleep 10; done"
-  kubectl -n tenant-test wait statefulset.apps/mysql-$name --timeout=110s --for=jsonpath='{.status.replicas}'=2
-  timeout 80 sh -ec "until kubectl -n tenant-test get svc mysql-$name-metrics -o jsonpath='{.spec.ports[0].port}' | grep -q '9104'; do sleep 10; done"
-  timeout 40 sh -ec "until kubectl -n tenant-test get endpoints mysql-$name-metrics -o jsonpath='{.subsets[*].addresses[*].ip}' | grep -q '[0-9]'; do sleep 10; done"
-  kubectl -n tenant-test wait deployment.apps/mysql-$name-metrics --timeout=90s --for=jsonpath='{.status.replicas}'=1
-  kubectl -n tenant-test delete mysqls.apps.cozystack.io $name
-}
diff --git a/internal/backupcontroller/backupclass_resolver_test.go b/internal/backupcontroller/backupclass_resolver_test.go
index a606f241..5e29cd02 100644
--- a/internal/backupcontroller/backupclass_resolver_test.go
+++ b/internal/backupcontroller/backupclass_resolver_test.go
@@ -141,13 +141,13 @@ func TestResolveBackupClass(t *testing.T) {
 							StrategyRef: corev1.TypedLocalObjectReference{
 								APIGroup: stringPtr("strategy.backups.cozystack.io"),
 								Kind:     "Velero",
-								Name:     "velero-strategy-mysql",
+								Name:     "velero-strategy-mariadb",
 							},
 							Application: backupsv1alpha1.ApplicationSelector{
-								Kind: "MySQL",
+								Kind: "MariaDB",
 							},
 							Parameters: map[string]string{
-								"backupStorageLocationName": "mysql-storage",
+								"backupStorageLocationName": "mariadb-storage",
 							},
 						},
 					},
@@ -169,7 +169,7 @@ func TestResolveBackupClass(t *testing.T) {
 			},
 		},
 		{
-			name: "successful resolution - matches MySQL strategy with explicit apiGroup",
+			name: "successful resolution - matches MariaDB strategy with explicit apiGroup",
 			backupClass: &backupsv1alpha1.BackupClass{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: "velero",
@@ -180,14 +180,14 @@ func TestResolveBackupClass(t *testing.T) {
 							StrategyRef: corev1.TypedLocalObjectReference{
 								APIGroup: stringPtr("strategy.backups.cozystack.io"),
 								Kind:     "Velero",
-								Name:     "velero-strategy-mysql",
+								Name:     "velero-strategy-mariadb",
 							},
 							Application: backupsv1alpha1.ApplicationSelector{
 								APIGroup: stringPtr("apps.cozystack.io"),
-								Kind:     "MySQL",
+								Kind:     "MariaDB",
 							},
 							Parameters: map[string]string{
-								"backupStorageLocationName": "mysql-storage",
+								"backupStorageLocationName": "mariadb-storage",
 							},
 						},
 					},
@@ -195,18 +195,18 @@ func TestResolveBackupClass(t *testing.T) {
 			},
 			applicationRef: corev1.TypedLocalObjectReference{
 				APIGroup: stringPtr("apps.cozystack.io"),
-				Kind:     "MySQL",
-				Name:     "mysql1",
+				Kind:     "MariaDB",
+				Name:     "mariadb1",
 			},
 			backupClassName: "velero",
 			wantErr:         false,
 			expectedStrategyRef: &corev1.TypedLocalObjectReference{
 				APIGroup: stringPtr("strategy.backups.cozystack.io"),
 				Kind:     "Velero",
-				Name:     "velero-strategy-mysql",
+				Name:     "velero-strategy-mariadb",
 			},
 			expectedParams: map[string]string{
-				"backupStorageLocationName": "mysql-storage",
+				"backupStorageLocationName": "mariadb-storage",
 			},
 		},
 		{
diff --git a/internal/backupcontroller/factory/backupjob_test.go b/internal/backupcontroller/factory/backupjob_test.go
index 2fab5ff8..afe1f155 100644
--- a/internal/backupcontroller/factory/backupjob_test.go
+++ b/internal/backupcontroller/factory/backupjob_test.go
@@ -67,8 +67,8 @@ func TestBackupJob(t *testing.T) {
 				Spec: backupsv1alpha1.PlanSpec{
 					ApplicationRef: corev1.TypedLocalObjectReference{
 						// No APIGroup specified
-						Kind: "MySQL",
-						Name: "mysql1",
+						Kind: "MariaDB",
+						Name: "mariadb1",
 					},
 					BackupClassName: "velero",
 					Schedule: backupsv1alpha1.PlanSchedule{
diff --git a/packages/apps/mysql/.helmignore b/packages/apps/mariadb/.helmignore
similarity index 100%
rename from packages/apps/mysql/.helmignore
rename to packages/apps/mariadb/.helmignore
diff --git a/packages/apps/mysql/Chart.yaml b/packages/apps/mariadb/Chart.yaml
similarity index 93%
rename from packages/apps/mysql/Chart.yaml
rename to packages/apps/mariadb/Chart.yaml
index f9cedb1b..6acc5082 100644
--- a/packages/apps/mysql/Chart.yaml
+++ b/packages/apps/mariadb/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v2
-name: mysql
+name: mariadb
 description: Managed MariaDB service
 icon: /logos/mariadb.svg
 type: application
diff --git a/packages/apps/mysql/Makefile b/packages/apps/mariadb/Makefile
similarity index 100%
rename from packages/apps/mysql/Makefile
rename to packages/apps/mariadb/Makefile
diff --git a/packages/apps/mysql/README.md b/packages/apps/mariadb/README.md
similarity index 98%
rename from packages/apps/mysql/README.md
rename to packages/apps/mariadb/README.md
index 6d47a6d5..6b3b8199 100644
--- a/packages/apps/mysql/README.md
+++ b/packages/apps/mariadb/README.md
@@ -102,7 +102,7 @@ more details:
 | `backup`                 | Backup configuration.                           | `object` | `{}`                                                   |
 | `backup.enabled`         | Enable regular backups (default: false).        | `bool`   | `false`                                                |
 | `backup.s3Region`        | AWS S3 region where backups are stored.         | `string` | `us-east-1`                                            |
-| `backup.s3Bucket`        | S3 bucket used for storing backups.             | `string` | `s3.example.org/mysql-backups`                         |
+| `backup.s3Bucket`        | S3 bucket used for storing backups.             | `string` | `s3.example.org/mariadb-backups`                         |
 | `backup.schedule`        | Cron schedule for automated backups.            | `string` | `0 2 * * *`                                            |
 | `backup.cleanupStrategy` | Retention strategy for cleaning up old backups. | `string` | `--keep-last=3 --keep-daily=3 --keep-within-weekly=1m` |
 | `backup.s3AccessKey`     | Access key for S3 authentication.               | `string` | `<your-access-key>`                                    |
diff --git a/packages/apps/mysql/charts/cozy-lib b/packages/apps/mariadb/charts/cozy-lib
similarity index 100%
rename from packages/apps/mysql/charts/cozy-lib
rename to packages/apps/mariadb/charts/cozy-lib
diff --git a/packages/apps/mysql/files/versions.yaml b/packages/apps/mariadb/files/versions.yaml
similarity index 100%
rename from packages/apps/mysql/files/versions.yaml
rename to packages/apps/mariadb/files/versions.yaml
diff --git a/packages/apps/mysql/hack/update-versions.sh b/packages/apps/mariadb/hack/update-versions.sh
similarity index 97%
rename from packages/apps/mysql/hack/update-versions.sh
rename to packages/apps/mariadb/hack/update-versions.sh
index 1b58591a..775c0327 100755
--- a/packages/apps/mysql/hack/update-versions.sh
+++ b/packages/apps/mariadb/hack/update-versions.sh
@@ -5,9 +5,9 @@ set -o nounset
 set -o pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-MYSQL_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
-VALUES_FILE="${MYSQL_DIR}/values.yaml"
-VERSIONS_FILE="${MYSQL_DIR}/files/versions.yaml"
+MARIADB_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+VALUES_FILE="${MARIADB_DIR}/values.yaml"
+VERSIONS_FILE="${MARIADB_DIR}/files/versions.yaml"
 MARIADB_API_URL="https://downloads.mariadb.org/rest-api/mariadb/"
 
 # Check if jq is installed
diff --git a/packages/apps/mysql/images/mariadb-backup.tag b/packages/apps/mariadb/images/mariadb-backup.tag
similarity index 100%
rename from packages/apps/mysql/images/mariadb-backup.tag
rename to packages/apps/mariadb/images/mariadb-backup.tag
diff --git a/packages/apps/mysql/images/mariadb-backup/Dockerfile b/packages/apps/mariadb/images/mariadb-backup/Dockerfile
similarity index 100%
rename from packages/apps/mysql/images/mariadb-backup/Dockerfile
rename to packages/apps/mariadb/images/mariadb-backup/Dockerfile
diff --git a/packages/apps/mysql/logos/mariadb.svg b/packages/apps/mariadb/logos/mariadb.svg
similarity index 100%
rename from packages/apps/mysql/logos/mariadb.svg
rename to packages/apps/mariadb/logos/mariadb.svg
diff --git a/packages/apps/mysql/templates/.gitkeep b/packages/apps/mariadb/templates/.gitkeep
similarity index 100%
rename from packages/apps/mysql/templates/.gitkeep
rename to packages/apps/mariadb/templates/.gitkeep
diff --git a/packages/apps/mysql/templates/_resources.tpl b/packages/apps/mariadb/templates/_resources.tpl
similarity index 100%
rename from packages/apps/mysql/templates/_resources.tpl
rename to packages/apps/mariadb/templates/_resources.tpl
diff --git a/packages/apps/mysql/templates/_versions.tpl b/packages/apps/mariadb/templates/_versions.tpl
similarity index 89%
rename from packages/apps/mysql/templates/_versions.tpl
rename to packages/apps/mariadb/templates/_versions.tpl
index cd4ee0e1..a896ea5f 100644
--- a/packages/apps/mysql/templates/_versions.tpl
+++ b/packages/apps/mariadb/templates/_versions.tpl
@@ -1,4 +1,4 @@
-{{- define "mysql.versionMap" }}
+{{- define "mariadb.versionMap" }}
 {{- $versionMap := .Files.Get "files/versions.yaml" | fromYaml }}
 {{- if not (hasKey $versionMap .Values.version) }}
     {{- printf `MariaDB version %s is not supported, allowed versions are %s` $.Values.version (keys $versionMap) | fail }}
diff --git a/packages/apps/mysql/templates/backup-cronjob.yaml b/packages/apps/mariadb/templates/backup-cronjob.yaml
similarity index 100%
rename from packages/apps/mysql/templates/backup-cronjob.yaml
rename to packages/apps/mariadb/templates/backup-cronjob.yaml
diff --git a/packages/apps/mysql/templates/backup-script.yaml b/packages/apps/mariadb/templates/backup-script.yaml
similarity index 100%
rename from packages/apps/mysql/templates/backup-script.yaml
rename to packages/apps/mariadb/templates/backup-script.yaml
diff --git a/packages/apps/mysql/templates/backup-secret.yaml b/packages/apps/mariadb/templates/backup-secret.yaml
similarity index 100%
rename from packages/apps/mysql/templates/backup-secret.yaml
rename to packages/apps/mariadb/templates/backup-secret.yaml
diff --git a/packages/apps/mysql/templates/config.yaml b/packages/apps/mariadb/templates/config.yaml
similarity index 100%
rename from packages/apps/mysql/templates/config.yaml
rename to packages/apps/mariadb/templates/config.yaml
diff --git a/packages/apps/mysql/templates/dashboard-resourcemap.yaml b/packages/apps/mariadb/templates/dashboard-resourcemap.yaml
similarity index 100%
rename from packages/apps/mysql/templates/dashboard-resourcemap.yaml
rename to packages/apps/mariadb/templates/dashboard-resourcemap.yaml
diff --git a/packages/apps/mysql/templates/db.yaml b/packages/apps/mariadb/templates/db.yaml
similarity index 100%
rename from packages/apps/mysql/templates/db.yaml
rename to packages/apps/mariadb/templates/db.yaml
diff --git a/packages/apps/mysql/templates/hooks/cleanup-pvc.yaml b/packages/apps/mariadb/templates/hooks/cleanup-pvc.yaml
similarity index 100%
rename from packages/apps/mysql/templates/hooks/cleanup-pvc.yaml
rename to packages/apps/mariadb/templates/hooks/cleanup-pvc.yaml
diff --git a/packages/apps/mysql/templates/mariadb.yaml b/packages/apps/mariadb/templates/mariadb.yaml
similarity index 97%
rename from packages/apps/mysql/templates/mariadb.yaml
rename to packages/apps/mariadb/templates/mariadb.yaml
index b4a888d8..8a530134 100644
--- a/packages/apps/mysql/templates/mariadb.yaml
+++ b/packages/apps/mariadb/templates/mariadb.yaml
@@ -8,7 +8,7 @@ spec:
     name: {{ .Release.Name }}-credentials
     key: root
 
-  image: "mariadb:{{ include "mysql.versionMap" $ }}"
+  image: "mariadb:{{ include "mariadb.versionMap" $ }}"
 
   port: 3306
 
diff --git a/packages/apps/mysql/templates/regsecret.yaml b/packages/apps/mariadb/templates/regsecret.yaml
similarity index 100%
rename from packages/apps/mysql/templates/regsecret.yaml
rename to packages/apps/mariadb/templates/regsecret.yaml
diff --git a/packages/apps/mysql/templates/secret.yaml b/packages/apps/mariadb/templates/secret.yaml
similarity index 100%
rename from packages/apps/mysql/templates/secret.yaml
rename to packages/apps/mariadb/templates/secret.yaml
diff --git a/packages/apps/mysql/templates/user.yaml b/packages/apps/mariadb/templates/user.yaml
similarity index 100%
rename from packages/apps/mysql/templates/user.yaml
rename to packages/apps/mariadb/templates/user.yaml
diff --git a/packages/apps/mysql/templates/workloadmonitor.yaml b/packages/apps/mariadb/templates/workloadmonitor.yaml
similarity index 88%
rename from packages/apps/mysql/templates/workloadmonitor.yaml
rename to packages/apps/mariadb/templates/workloadmonitor.yaml
index 9fc6d144..b69139bf 100644
--- a/packages/apps/mysql/templates/workloadmonitor.yaml
+++ b/packages/apps/mariadb/templates/workloadmonitor.yaml
@@ -6,8 +6,8 @@ metadata:
 spec:
   replicas: {{ .Values.replicas }}
   minReplicas: 1
-  kind: mysql
-  type: mysql
+  kind: mariadb
+  type: mariadb
   selector:
     app.kubernetes.io/instance: {{ $.Release.Name }}
   version: {{ $.Chart.Version }}
diff --git a/packages/apps/mysql/values.schema.json b/packages/apps/mariadb/values.schema.json
similarity index 99%
rename from packages/apps/mysql/values.schema.json
rename to packages/apps/mariadb/values.schema.json
index a36754b2..31c56378 100644
--- a/packages/apps/mysql/values.schema.json
+++ b/packages/apps/mariadb/values.schema.json
@@ -40,7 +40,7 @@
         "s3Bucket": {
           "description": "S3 bucket used for storing backups.",
           "type": "string",
-          "default": "s3.example.org/mysql-backups"
+          "default": "s3.example.org/mariadb-backups"
         },
         "s3Region": {
           "description": "AWS S3 region where backups are stored.",
diff --git a/packages/apps/mysql/values.yaml b/packages/apps/mariadb/values.yaml
similarity index 98%
rename from packages/apps/mysql/values.yaml
rename to packages/apps/mariadb/values.yaml
index c7726b7a..6d629a83 100644
--- a/packages/apps/mysql/values.yaml
+++ b/packages/apps/mariadb/values.yaml
@@ -98,7 +98,7 @@ databases: {}
 backup:
   enabled: false
   s3Region: us-east-1
-  s3Bucket: "s3.example.org/mysql-backups"
+  s3Bucket: "s3.example.org/mariadb-backups"
   schedule: "0 2 * * *"
   cleanupStrategy: "--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
   s3AccessKey: "<your-access-key>"
diff --git a/packages/core/platform/sources/mysql-application.yaml b/packages/core/platform/sources/mariadb-application.yaml
similarity index 71%
rename from packages/core/platform/sources/mysql-application.yaml
rename to packages/core/platform/sources/mariadb-application.yaml
index 4b22e36e..34ff901b 100644
--- a/packages/core/platform/sources/mysql-application.yaml
+++ b/packages/core/platform/sources/mariadb-application.yaml
@@ -2,7 +2,7 @@
 apiVersion: cozystack.io/v1alpha1
 kind: PackageSource
 metadata:
-  name: cozystack.mysql-application
+  name: cozystack.mariadb-application
 spec:
   sourceRef:
     kind: OCIRepository
@@ -18,11 +18,11 @@ spec:
         - name: cozy-lib
           path: library/cozy-lib
       components:
-        - name: mysql
-          path: apps/mysql
+        - name: mariadb
+          path: apps/mariadb
           libraries: ["cozy-lib"]
-        - name: mysql-rd
-          path: system/mysql-rd
+        - name: mariadb-rd
+          path: system/mariadb-rd
           install:
             namespace: cozy-system
-            releaseName: mysql-rd
+            releaseName: mariadb-rd
diff --git a/packages/core/platform/templates/bundles/paas.yaml b/packages/core/platform/templates/bundles/paas.yaml
index 1b76a74d..5a478f9d 100644
--- a/packages/core/platform/templates/bundles/paas.yaml
+++ b/packages/core/platform/templates/bundles/paas.yaml
@@ -12,7 +12,7 @@
 {{include "cozystack.platform.package.default" (list "cozystack.clickhouse-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.foundationdb-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.kafka-application" $) }}
-{{include "cozystack.platform.package.default" (list "cozystack.mysql-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.mariadb-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.mongodb-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.nats-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.postgres-application" $) }}
diff --git a/packages/system/cozystack-basics/templates/clusterroles.yaml b/packages/system/cozystack-basics/templates/clusterroles.yaml
index 2b3303ed..29395dfe 100644
--- a/packages/system/cozystack-basics/templates/clusterroles.yaml
+++ b/packages/system/cozystack-basics/templates/clusterroles.yaml
@@ -198,7 +198,7 @@ rules:
   - httpcaches
   - kafkas
   - kuberneteses
-  - mysqls
+  - mariadbs
   - natses
   - postgreses
   - rabbitmqs
diff --git a/packages/system/mysql-rd/Chart.yaml b/packages/system/mariadb-rd/Chart.yaml
similarity index 87%
rename from packages/system/mysql-rd/Chart.yaml
rename to packages/system/mariadb-rd/Chart.yaml
index d3c6b081..091d535c 100644
--- a/packages/system/mysql-rd/Chart.yaml
+++ b/packages/system/mariadb-rd/Chart.yaml
@@ -1,3 +1,3 @@
 apiVersion: v2
-name: mysql-rd
+name: mariadb-rd
 version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
diff --git a/packages/system/mysql-rd/Makefile b/packages/system/mariadb-rd/Makefile
similarity index 73%
rename from packages/system/mysql-rd/Makefile
rename to packages/system/mariadb-rd/Makefile
index 2a8af787..def401d8 100644
--- a/packages/system/mysql-rd/Makefile
+++ b/packages/system/mariadb-rd/Makefile
@@ -1,4 +1,4 @@
-export NAME=mysql-rd
+export NAME=mariadb-rd
 export NAMESPACE=cozy-system
 
 include ../../../hack/package.mk
diff --git a/packages/system/mysql-rd/cozyrds/mysql.yaml b/packages/system/mariadb-rd/cozyrds/mariadb.yaml
similarity index 69%
rename from packages/system/mysql-rd/cozyrds/mysql.yaml
rename to packages/system/mariadb-rd/cozyrds/mariadb.yaml
index 9c2d6d32..5e8088c8 100644
--- a/packages/system/mysql-rd/cozyrds/mysql.yaml
+++ b/packages/system/mariadb-rd/cozyrds/mariadb.yaml
@@ -1,26 +1,26 @@
 apiVersion: cozystack.io/v1alpha1
 kind: ApplicationDefinition
 metadata:
-  name: mysql
+  name: mariadb
 spec:
   application:
-    kind: MySQL
-    plural: mysqls
-    singular: mysql
+    kind: MariaDB
+    plural: mariadbs
+    singular: mariadb
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["cleanupStrategy","enabled","resticPassword","s3AccessKey","s3Bucket","s3Region","s3SecretKey","schedule"],"properties":{"cleanupStrategy":{"description":"Retention strategy for cleaning up old backups.","type":"string","default":"--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"},"enabled":{"description":"Enable regular backups (default: false).","type":"boolean","default":false},"resticPassword":{"description":"Password for Restic backup encryption.","type":"string","default":"<password>"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":"<your-access-key>"},"s3Bucket":{"description":"S3 bucket used for storing backups.","type":"string","default":"s3.example.org/mysql-backups"},"s3Region":{"description":"AWS S3 region where backups are stored.","type":"string","default":"us-east-1"},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":"<your-secret-key>"},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * *"}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"replicas":{"description":"Number of MariaDB replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each MariaDB replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","required":["maxUserConnections","password"],"properties":{"maxUserConnections":{"description":"Maximum number of connections.","type":"integer"},"password":{"description":"Password for the user.","type":"string"}}}},"version":{"description":"MariaDB major.minor version to deploy","type":"string","default":"v11.8","enum":["v11.8","v11.4","v10.11","v10.6"]}}}
+      {"title":"Chart Values","type":"object","properties":{"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["cleanupStrategy","enabled","resticPassword","s3AccessKey","s3Bucket","s3Region","s3SecretKey","schedule"],"properties":{"cleanupStrategy":{"description":"Retention strategy for cleaning up old backups.","type":"string","default":"--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"},"enabled":{"description":"Enable regular backups (default: false).","type":"boolean","default":false},"resticPassword":{"description":"Password for Restic backup encryption.","type":"string","default":"<password>"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":"<your-access-key>"},"s3Bucket":{"description":"S3 bucket used for storing backups.","type":"string","default":"s3.example.org/mariadb-backups"},"s3Region":{"description":"AWS S3 region where backups are stored.","type":"string","default":"us-east-1"},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":"<your-secret-key>"},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * *"}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"replicas":{"description":"Number of MariaDB replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each MariaDB replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","required":["maxUserConnections","password"],"properties":{"maxUserConnections":{"description":"Maximum number of connections.","type":"integer"},"password":{"description":"Password for the user.","type":"string"}}}},"version":{"description":"MariaDB major.minor version to deploy","type":"string","default":"v11.8","enum":["v11.8","v11.4","v10.11","v10.6"]}}}
   release:
-    prefix: mysql-
+    prefix: mariadb-
     labels:
       sharding.fluxcd.io/key: tenants
     chartRef:
       kind: ExternalArtifact
-      name: cozystack-mysql-application-default-mysql
+      name: cozystack-mariadb-application-default-mariadb
       namespace: cozy-system
   dashboard:
     category: PaaS
-    singular: MySQL
-    plural: MySQL
+    singular: MariaDB
+    plural: MariaDB
     description: Managed MariaDB service
     tags:
       - database
@@ -30,10 +30,10 @@ spec:
     exclude: []
     include:
       - resourceNames:
-          - mysql-{{ .name }}-credentials
+          - mariadb-{{ .name }}-credentials
   services:
     exclude: []
     include:
       - resourceNames:
-          - mysql-{{ .name }}-primary
-          - mysql-{{ .name }}-secondary
+          - mariadb-{{ .name }}-primary
+          - mariadb-{{ .name }}-secondary
diff --git a/packages/system/mysql-rd/templates/cozyrd.yaml b/packages/system/mariadb-rd/templates/cozyrd.yaml
similarity index 100%
rename from packages/system/mysql-rd/templates/cozyrd.yaml
rename to packages/system/mariadb-rd/templates/cozyrd.yaml
diff --git a/packages/system/mysql-rd/values.yaml b/packages/system/mariadb-rd/values.yaml
similarity index 100%
rename from packages/system/mysql-rd/values.yaml
rename to packages/system/mariadb-rd/values.yaml

From 740eb7028b7cce4060f11307650caac8f7052d87 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 10 Feb 2026 19:11:31 +0100
Subject: [PATCH 018/666] feat(platform): add migration 27 to rename mysql
 resources to mariadb

Add platform migration that auto-discovers all deployed MySQL
HelmReleases and renames their resources to use the mariadb prefix.

The migration handles PVC data preservation via PV claimRef rebinding,
temporarily disables protection-webhook for protected resource deletion,
and scales mariadb-operator once for all instances.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/apps/mariadb/README.md               |   2 +-
 .../platform/images/migrations/migrations/28  | 616 ++++++++++++++++++
 packages/core/platform/values.yaml            |   4 +-
 3 files changed, 619 insertions(+), 3 deletions(-)
 create mode 100755 packages/core/platform/images/migrations/migrations/28

diff --git a/packages/apps/mariadb/README.md b/packages/apps/mariadb/README.md
index 6b3b8199..bb3ea8ac 100644
--- a/packages/apps/mariadb/README.md
+++ b/packages/apps/mariadb/README.md
@@ -102,7 +102,7 @@ more details:
 | `backup`                 | Backup configuration.                           | `object` | `{}`                                                   |
 | `backup.enabled`         | Enable regular backups (default: false).        | `bool`   | `false`                                                |
 | `backup.s3Region`        | AWS S3 region where backups are stored.         | `string` | `us-east-1`                                            |
-| `backup.s3Bucket`        | S3 bucket used for storing backups.             | `string` | `s3.example.org/mariadb-backups`                         |
+| `backup.s3Bucket`        | S3 bucket used for storing backups.             | `string` | `s3.example.org/mariadb-backups`                       |
 | `backup.schedule`        | Cron schedule for automated backups.            | `string` | `0 2 * * *`                                            |
 | `backup.cleanupStrategy` | Retention strategy for cleaning up old backups. | `string` | `--keep-last=3 --keep-daily=3 --keep-within-weekly=1m` |
 | `backup.s3AccessKey`     | Access key for S3 authentication.               | `string` | `<your-access-key>`                                    |
diff --git a/packages/core/platform/images/migrations/migrations/28 b/packages/core/platform/images/migrations/migrations/28
new file mode 100755
index 00000000..259d5fd8
--- /dev/null
+++ b/packages/core/platform/images/migrations/migrations/28
@@ -0,0 +1,616 @@
+#!/bin/bash
+# Migration 28 --> 29
+# Rename all mysql-prefixed resources to mariadb- across the cluster.
+# Discovers all MySQL HelmReleases by label, migrates each instance.
+# Idempotent: safe to re-run.
+
+set -euo pipefail
+
+OLD_PREFIX="mysql"
+NEW_PREFIX="mariadb"
+MARIADB_OPERATOR_NS="cozy-mariadb-operator"
+MARIADB_WEBHOOK_NAME="mariadb-operator-webhook"
+PROTECTION_WEBHOOK_NAME="protection-webhook"
+PROTECTION_WEBHOOK_NS="protection-webhook"
+declare -A OPERATOR_REPLICAS=()
+declare -A ORIGINAL_PV_POLICIES=()
+
+# ============================================================
+# Helper functions
+# ============================================================
+
+resource_exists() {
+  local ns="$1" type="$2" name="$3"
+  kubectl -n "$ns" get "$type" "$name" --no-headers 2>/dev/null | grep -q .
+}
+
+delete_resource() {
+  local ns="$1" type="$2" name="$3"
+  if resource_exists "$ns" "$type" "$name"; then
+    echo "    [DELETE] ${type}/${name}"
+    kubectl -n "$ns" delete "$type" "$name" --wait=false
+  else
+    echo "    [SKIP] ${type}/${name} already gone"
+  fi
+}
+
+clone_resource() {
+  local ns="$1" type="$2" old_name="$3" new_name="$4" old_instance="$5" new_instance="$6"
+
+  if resource_exists "$ns" "$type" "$new_name"; then
+    echo "    [SKIP] ${type}/${new_name} already exists"
+    return 0
+  fi
+  if ! resource_exists "$ns" "$type" "$old_name"; then
+    echo "    [SKIP] ${type}/${old_name} not found"
+    return 0
+  fi
+
+  echo "    [CREATE] ${type}/${new_name} from ${old_name}"
+  kubectl -n "$ns" get "$type" "$old_name" -o json | \
+    jq --arg new_name "$new_name" --arg old "$old_instance" --arg new "$new_instance" '
+      .metadata.name = $new_name |
+      del(.metadata.uid, .metadata.resourceVersion, .metadata.creationTimestamp,
+          .metadata.generation, .metadata.managedFields, .metadata.selfLink,
+          .metadata.ownerReferences) |
+      del(.status) |
+      .metadata.labels = ((.metadata.labels // {}) | with_entries(
+        if (.value | type) == "string" then .value |= gsub($old; $new) else . end)) |
+      .metadata.annotations = ((.metadata.annotations // {}) | with_entries(
+        select(.key != "kubectl.kubernetes.io/last-applied-configuration") |
+        if (.value | type) == "string" then .value |= gsub($old; $new) else . end))
+    ' | kubectl -n "$ns" apply -f -
+}
+
+patch_webhook_policy() {
+  local name="$1" policy="$2"
+  echo "  [PATCH] Set failurePolicy=${policy} on ValidatingWebhookConfiguration/${name}"
+  kubectl get validatingwebhookconfiguration "$name" -o json | \
+    jq --arg p "$policy" '.webhooks[].failurePolicy = $p' | \
+    kubectl apply -f -
+}
+
+# ============================================================
+# STEP 1: Discover all MySQL instances
+# ============================================================
+echo "=== Discovering MySQL HelmReleases ==="
+INSTANCES=()
+while IFS=/ read -r ns name; do
+  [ -z "$ns" ] && continue
+  instance="${name#${OLD_PREFIX}-}"
+  INSTANCES+=("${ns}/${instance}")
+  echo "  Found: ${ns}/${name} (instance=${instance})"
+done < <(kubectl get hr -A -l "apps.cozystack.io/application.kind=MySQL" \
+  -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}' 2>/dev/null)
+
+if [ ${#INSTANCES[@]} -eq 0 ]; then
+  echo "  No MySQL HelmReleases found. Nothing to migrate."
+
+  # Recover operator if a prior run left it scaled down
+  for deploy in mariadb-operator mariadb-operator-cert-controller mariadb-operator-webhook; do
+    current=$(kubectl -n "$MARIADB_OPERATOR_NS" get deploy "$deploy" \
+      -o jsonpath='{.spec.replicas}' 2>/dev/null || echo "1")
+    if [ "$current" = "0" ]; then
+      echo "  [RECOVER] Scaling ${deploy} -> 1"
+      kubectl -n "$MARIADB_OPERATOR_NS" scale deploy "$deploy" --replicas=1
+    fi
+  done
+
+  # Restore webhook if left at Ignore
+  current_policy=$(kubectl get validatingwebhookconfiguration "$MARIADB_WEBHOOK_NAME" \
+    -o jsonpath='{.webhooks[0].failurePolicy}' 2>/dev/null || echo "unknown")
+  if [ "$current_policy" = "Ignore" ]; then
+    patch_webhook_policy "$MARIADB_WEBHOOK_NAME" "Fail"
+  fi
+
+  # Unsuspend any new HelmReleases left suspended from a prior partial run
+  while IFS=/ read -r ns name; do
+    [ -z "$ns" ] && continue
+    suspended=$(kubectl -n "$ns" get hr "$name" -o jsonpath='{.spec.suspend}' 2>/dev/null || echo "false")
+    if [ "$suspended" = "true" ]; then
+      echo "  [UNSUSPEND] ${ns}/hr/${name}"
+      kubectl -n "$ns" patch hr "$name" --type=merge -p '{"spec":{"suspend":false}}'
+    fi
+  done < <(kubectl get hr -A -l "apps.cozystack.io/application.kind=MariaDB" \
+    -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}' 2>/dev/null)
+
+  kubectl create configmap -n cozy-system cozystack-version \
+    --from-literal=version=29 --dry-run=client -o yaml | kubectl apply -f-
+  exit 0
+fi
+echo "  Total: ${#INSTANCES[@]} instance(s)"
+
+# ============================================================
+# STEP 2: Scale down mariadb-operator and disable its webhook
+# ============================================================
+echo ""
+echo "--- Step 2: Scale down mariadb-operator ---"
+for deploy in mariadb-operator mariadb-operator-cert-controller mariadb-operator-webhook; do
+  current=$(kubectl -n "$MARIADB_OPERATOR_NS" get deploy "$deploy" -o jsonpath='{.spec.replicas}' 2>/dev/null || echo "0")
+  OPERATOR_REPLICAS["$deploy"]="$current"
+  if [ "$current" != "0" ]; then
+    echo "  [SCALE] ${deploy} -> 0 (was ${current})"
+    kubectl -n "$MARIADB_OPERATOR_NS" scale deploy "$deploy" --replicas=0
+  else
+    echo "  [SKIP] ${deploy} already scaled to 0"
+  fi
+done
+
+echo "  Waiting for operator pods to terminate..."
+kubectl -n "$MARIADB_OPERATOR_NS" wait --for=delete pod \
+  -l app.kubernetes.io/instance=mariadb-operator --timeout=60s 2>/dev/null || true
+
+current_policy=$(kubectl get validatingwebhookconfiguration "$MARIADB_WEBHOOK_NAME" \
+  -o jsonpath='{.webhooks[0].failurePolicy}' 2>/dev/null || echo "unknown")
+if [ "$current_policy" = "Fail" ]; then
+  patch_webhook_policy "$MARIADB_WEBHOOK_NAME" "Ignore"
+else
+  echo "  [SKIP] Webhook ${MARIADB_WEBHOOK_NAME} already failurePolicy=${current_policy}"
+fi
+
+# ============================================================
+# STEP 3: Migrate each instance
+# ============================================================
+ALL_PV_NAMES=()
+ALL_PROTECTED_RESOURCES=()
+
+for entry in "${INSTANCES[@]}"; do
+  NAMESPACE="${entry%%/*}"
+  INSTANCE="${entry#*/}"
+  OLD_NAME="${OLD_PREFIX}-${INSTANCE}"
+  NEW_NAME="${NEW_PREFIX}-${INSTANCE}"
+
+  echo ""
+  echo "======================================================================"
+  echo "=== Migrating: ${OLD_NAME} -> ${NEW_NAME} in ${NAMESPACE}"
+  echo "======================================================================"
+
+  # --- 3a: Suspend old HelmRelease ---
+  echo "  --- Suspend HelmRelease ---"
+  if resource_exists "$NAMESPACE" "hr" "$OLD_NAME"; then
+    suspended=$(kubectl -n "$NAMESPACE" get hr "$OLD_NAME" -o jsonpath='{.spec.suspend}' 2>/dev/null || echo "false")
+    if [ "$suspended" != "true" ]; then
+      echo "    [SUSPEND] hr/${OLD_NAME}"
+      kubectl -n "$NAMESPACE" patch hr "$OLD_NAME" --type=merge -p '{"spec":{"suspend":true}}'
+    else
+      echo "    [SKIP] hr/${OLD_NAME} already suspended"
+    fi
+  else
+    echo "    [SKIP] hr/${OLD_NAME} not found"
+  fi
+
+  # --- 3b: Switch PV reclaim policy to Retain ---
+  echo "  --- Switch PV reclaim to Retain ---"
+  PV_NAMES=()
+  replicas=$(kubectl -n "$NAMESPACE" get mariadb.k8s.mariadb.com "$OLD_NAME" \
+    -o jsonpath='{.spec.replicas}' 2>/dev/null || true)
+  if [ -z "$replicas" ]; then
+    # Fallback: count existing PVCs matching the old or new name pattern
+    replicas=$(kubectl -n "$NAMESPACE" get pvc --no-headers -o name 2>/dev/null \
+      | grep -cE "storage-${OLD_NAME}-[0-9]+$|storage-${NEW_NAME}-[0-9]+$" || echo "0")
+    echo "    [INFO] MariaDB CR not found, derived replicas=${replicas} from existing PVCs"
+  fi
+  for i in $(seq 0 $((replicas - 1))); do
+    pvc_name="storage-${OLD_NAME}-${i}"
+    if resource_exists "$NAMESPACE" "pvc" "$pvc_name"; then
+      pv_name=$(kubectl -n "$NAMESPACE" get pvc "$pvc_name" -o jsonpath='{.spec.volumeName}')
+      PV_NAMES+=("$pv_name")
+      ALL_PV_NAMES+=("$pv_name")
+      current_policy=$(kubectl get pv "$pv_name" -o jsonpath='{.spec.persistentVolumeReclaimPolicy}')
+      if [ "$current_policy" != "Retain" ]; then
+        echo "    [PATCH] PV ${pv_name}: ${current_policy} -> Retain"
+        ORIGINAL_PV_POLICIES["$pv_name"]="$current_policy"
+        kubectl patch pv "$pv_name" -p '{"spec":{"persistentVolumeReclaimPolicy":"Retain"}}'
+      else
+        echo "    [SKIP] PV ${pv_name} already Retain"
+      fi
+    else
+      new_pvc_name="storage-${NEW_NAME}-${i}"
+      if resource_exists "$NAMESPACE" "pvc" "$new_pvc_name"; then
+        pv_name=$(kubectl -n "$NAMESPACE" get pvc "$new_pvc_name" -o jsonpath='{.spec.volumeName}')
+        PV_NAMES+=("$pv_name")
+        ALL_PV_NAMES+=("$pv_name")
+        echo "    [SKIP] New PVC ${new_pvc_name} already exists, PV=${pv_name}"
+      else
+        echo "    [WARN] Neither old nor new PVC found for index ${i}"
+        PV_NAMES+=("")
+      fi
+    fi
+  done
+
+  # --- 3c: Delete old StatefulSet and Deployment ---
+  echo "  --- Delete old StatefulSet/Deployment ---"
+  if resource_exists "$NAMESPACE" "statefulset" "$OLD_NAME"; then
+    echo "    [DELETE] statefulset/${OLD_NAME} (cascade=orphan)"
+    kubectl -n "$NAMESPACE" delete statefulset "$OLD_NAME" --cascade=orphan
+  else
+    echo "    [SKIP] statefulset/${OLD_NAME} already gone"
+  fi
+  if resource_exists "$NAMESPACE" "deployment" "${OLD_NAME}-metrics"; then
+    echo "    [DELETE] deployment/${OLD_NAME}-metrics"
+    kubectl -n "$NAMESPACE" delete deployment "${OLD_NAME}-metrics"
+  else
+    echo "    [SKIP] deployment/${OLD_NAME}-metrics already gone"
+  fi
+
+  # --- 3d: Delete old pods ---
+  echo "  --- Delete old pods ---"
+  for i in $(seq 0 $((replicas - 1))); do
+    pod_name="${OLD_NAME}-${i}"
+    if resource_exists "$NAMESPACE" "pod" "$pod_name"; then
+      echo "    [DELETE] pod/${pod_name}"
+      kubectl -n "$NAMESPACE" delete pod "$pod_name" --grace-period=30
+    else
+      echo "    [SKIP] pod/${pod_name} already gone"
+    fi
+  done
+  for pod in $(kubectl -n "$NAMESPACE" get pods \
+    -l app.kubernetes.io/name=mysqld-exporter,app.kubernetes.io/instance="${OLD_NAME}" \
+    -o name 2>/dev/null); do
+    echo "    [DELETE] ${pod}"
+    kubectl -n "$NAMESPACE" delete "$pod" --grace-period=30
+  done
+
+  # --- 3e: Migrate PVCs ---
+  echo "  --- Migrate PVCs ---"
+  for i in $(seq 0 $((replicas - 1))); do
+    old_pvc="storage-${OLD_NAME}-${i}"
+    new_pvc="storage-${NEW_NAME}-${i}"
+    pv_name="${PV_NAMES[$i]:-}"
+
+    if [ -z "$pv_name" ]; then
+      echo "    [WARN] No PV found for index ${i}, skipping"
+      continue
+    fi
+
+    if resource_exists "$NAMESPACE" "pvc" "$new_pvc"; then
+      new_phase=$(kubectl -n "$NAMESPACE" get pvc "$new_pvc" \
+        -o jsonpath='{.status.phase}' 2>/dev/null || echo "unknown")
+      if [ "$new_phase" = "Bound" ]; then
+        echo "    [SKIP] PVC ${new_pvc} already Bound"
+        continue
+      fi
+    fi
+
+    if resource_exists "$NAMESPACE" "pvc" "$old_pvc"; then
+      storage_size=$(kubectl -n "$NAMESPACE" get pvc "$old_pvc" \
+        -o jsonpath='{.spec.resources.requests.storage}')
+      storage_class=$(kubectl -n "$NAMESPACE" get pvc "$old_pvc" \
+        -o jsonpath='{.spec.storageClassName}')
+      old_labels=$(kubectl -n "$NAMESPACE" get pvc "$old_pvc" -o json | \
+        jq --arg old "$OLD_NAME" --arg new "$NEW_NAME" \
+          '(.metadata.labels // {}) | with_entries(
+            if (.value | type) == "string" and .value == $old then .value = $new else . end)')
+
+      if ! resource_exists "$NAMESPACE" "pvc" "$new_pvc"; then
+        echo "    [CREATE] PVC ${new_pvc} -> PV ${pv_name}"
+        cat <<PVCEOF | kubectl -n "$NAMESPACE" apply -f -
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ${new_pvc}
+  namespace: ${NAMESPACE}
+  labels: ${old_labels}
+spec:
+  accessModes: ["ReadWriteOnce"]
+  storageClassName: "${storage_class}"
+  volumeName: "${pv_name}"
+  resources:
+    requests:
+      storage: "${storage_size}"
+PVCEOF
+      fi
+
+      new_pvc_uid=$(kubectl -n "$NAMESPACE" get pvc "$new_pvc" -o jsonpath='{.metadata.uid}')
+      echo "    [PATCH] Rebind PV ${pv_name} -> ${new_pvc}"
+      kubectl patch pv "$pv_name" --type=merge -p "{
+        \"spec\":{\"claimRef\":{\"apiVersion\":\"v1\",\"kind\":\"PersistentVolumeClaim\",
+          \"name\":\"${new_pvc}\",\"namespace\":\"${NAMESPACE}\",\"uid\":\"${new_pvc_uid}\"}}
+      }"
+
+      echo "    Waiting for PVC ${new_pvc} to bind..."
+      kubectl -n "$NAMESPACE" wait pvc "$new_pvc" \
+        --for=jsonpath='{.status.phase}'=Bound --timeout=60s
+      echo "    [OK] PVC ${new_pvc} is Bound"
+    fi
+  done
+
+  # --- 3f: Clone Services ---
+  echo "  --- Clone Services ---"
+  for suffix in "" "-internal" "-primary" "-secondary" "-metrics"; do
+    old_svc="${OLD_NAME}${suffix}"
+    new_svc="${NEW_NAME}${suffix}"
+    if resource_exists "$NAMESPACE" "svc" "$old_svc"; then
+      if resource_exists "$NAMESPACE" "svc" "$new_svc"; then
+        echo "    [SKIP] svc/${new_svc} already exists"
+      else
+        echo "    [CREATE] svc/${new_svc} from ${old_svc}"
+        kubectl -n "$NAMESPACE" get svc "$old_svc" -o json | \
+          jq --arg new_svc "$new_svc" --arg old "$OLD_NAME" --arg new "$NEW_NAME" '
+            .metadata.name = $new_svc |
+            del(.metadata.uid, .metadata.resourceVersion, .metadata.creationTimestamp,
+                .metadata.generation, .metadata.managedFields, .metadata.selfLink,
+                .metadata.ownerReferences) |
+            del(.status) |
+            del(.spec.clusterIP, .spec.clusterIPs) |
+            .metadata.labels = ((.metadata.labels // {}) | with_entries(
+              if (.value | type) == "string" then .value |= gsub($old; $new) else . end)) |
+            .metadata.annotations = ((.metadata.annotations // {}) | with_entries(
+              select(.key != "kubectl.kubernetes.io/last-applied-configuration") |
+              if (.value | type) == "string" then .value |= gsub($old; $new) else . end)) |
+            .spec.selector = ((.spec.selector // {}) | with_entries(
+              if (.value | type) == "string" then .value |= gsub($old; $new) else . end))
+          ' | kubectl -n "$NAMESPACE" apply -f -
+      fi
+    fi
+  done
+
+  # --- 3g: Clone Secrets ---
+  echo "  --- Clone Secrets ---"
+  for secret in $(kubectl -n "$NAMESPACE" get secret -o name 2>/dev/null \
+    | grep "secret/${OLD_NAME}" | grep -v "sh.helm.release"); do
+    old_secret_name="${secret#secret/}"
+    new_secret_name="${NEW_NAME}${old_secret_name#${OLD_NAME}}"
+    clone_resource "$NAMESPACE" "secret" "$old_secret_name" "$new_secret_name" "$OLD_NAME" "$NEW_NAME"
+  done
+
+  # --- 3h: Clone ConfigMaps ---
+  echo "  --- Clone ConfigMaps ---"
+  for cm in $(kubectl -n "$NAMESPACE" get configmap -o name 2>/dev/null \
+    | grep "configmap/${OLD_NAME}"); do
+    old_cm_name="${cm#configmap/}"
+    new_cm_name="${NEW_NAME}${old_cm_name#${OLD_NAME}}"
+    clone_resource "$NAMESPACE" "configmap" "$old_cm_name" "$new_cm_name" "$OLD_NAME" "$NEW_NAME"
+  done
+
+  # --- 3i: Clone MariaDB CR ---
+  echo "  --- Clone MariaDB CR ---"
+  if resource_exists "$NAMESPACE" "mariadb.k8s.mariadb.com" "$OLD_NAME"; then
+    if resource_exists "$NAMESPACE" "mariadb.k8s.mariadb.com" "$NEW_NAME"; then
+      echo "    [SKIP] mariadb.k8s.mariadb.com/${NEW_NAME} already exists"
+    else
+      echo "    [CREATE] mariadb.k8s.mariadb.com/${NEW_NAME}"
+      kubectl -n "$NAMESPACE" get mariadb.k8s.mariadb.com "$OLD_NAME" -o json | \
+        jq --arg old "$OLD_NAME" --arg new "$NEW_NAME" '
+          .metadata.name = $new |
+          del(.metadata.uid, .metadata.resourceVersion, .metadata.creationTimestamp,
+              .metadata.generation, .metadata.managedFields, .metadata.selfLink,
+              .metadata.finalizers, .metadata.ownerReferences) |
+          del(.status) |
+          .metadata.labels = ((.metadata.labels // {}) | with_entries(
+            if (.value | type) == "string" then .value |= gsub($old; $new) else . end)) |
+          .metadata.annotations = ((.metadata.annotations // {}) | with_entries(
+            select(.key != "kubectl.kubernetes.io/last-applied-configuration") |
+            if (.value | type) == "string" then .value |= gsub($old; $new) else . end)) |
+          .spec = (.spec | tostring | gsub($old; $new) | fromjson)
+        ' | kubectl -n "$NAMESPACE" apply -f -
+    fi
+  fi
+
+  # --- 3j: Clone Users, Databases, Grants ---
+  echo "  --- Clone Users, Databases, Grants ---"
+  for kind in "user.k8s.mariadb.com" "database.k8s.mariadb.com" "grant.k8s.mariadb.com"; do
+    for resource in $(kubectl -n "$NAMESPACE" get "$kind" -o name 2>/dev/null | grep "${OLD_NAME}"); do
+      old_res_name="${resource##*/}"
+      new_res_name="${NEW_NAME}${old_res_name#${OLD_NAME}}"
+      if resource_exists "$NAMESPACE" "$kind" "$new_res_name"; then
+        echo "    [SKIP] ${kind}/${new_res_name} already exists"
+      else
+        echo "    [CREATE] ${kind}/${new_res_name}"
+        kubectl -n "$NAMESPACE" get "$kind" "$old_res_name" -o json | \
+          jq --arg old "$OLD_NAME" --arg new "$NEW_NAME" --arg new_name "$new_res_name" '
+            .metadata.name = $new_name |
+            del(.metadata.uid, .metadata.resourceVersion, .metadata.creationTimestamp,
+                .metadata.generation, .metadata.managedFields, .metadata.selfLink,
+                .metadata.finalizers, .metadata.ownerReferences) |
+            del(.status) |
+            .metadata.labels = ((.metadata.labels // {}) | with_entries(
+              if (.value | type) == "string" then .value |= gsub($old; $new) else . end)) |
+            .metadata.annotations = ((.metadata.annotations // {}) | with_entries(
+              select(.key != "kubectl.kubernetes.io/last-applied-configuration") |
+              if (.value | type) == "string" then .value |= gsub($old; $new) else . end)) |
+            .spec = (.spec | tostring | gsub($old; $new) | fromjson)
+          ' | kubectl -n "$NAMESPACE" apply -f -
+      fi
+    done
+  done
+
+  # --- 3k: Clone WorkloadMonitor ---
+  echo "  --- Clone WorkloadMonitor ---"
+  clone_resource "$NAMESPACE" "workloadmonitor.cozystack.io" "$OLD_NAME" "$NEW_NAME" "$OLD_NAME" "$NEW_NAME"
+
+  # --- 3l: Create new HelmRelease (suspended) ---
+  echo "  --- Create new HelmRelease (suspended) ---"
+  if resource_exists "$NAMESPACE" "hr" "$NEW_NAME"; then
+    echo "    [SKIP] hr/${NEW_NAME} already exists"
+  elif resource_exists "$NAMESPACE" "hr" "$OLD_NAME"; then
+    echo "    [CREATE] hr/${NEW_NAME} from ${OLD_NAME} (suspended)"
+    kubectl -n "$NAMESPACE" get hr "$OLD_NAME" -o json | \
+      jq --arg old "$OLD_NAME" --arg new "$NEW_NAME" \
+         --arg old_prefix "$OLD_PREFIX" --arg new_prefix "$NEW_PREFIX" '
+        .metadata.name = $new |
+        del(.metadata.uid, .metadata.resourceVersion, .metadata.creationTimestamp,
+            .metadata.generation, .metadata.managedFields, .metadata.selfLink,
+            .metadata.finalizers, .metadata.ownerReferences) |
+        del(.status) |
+        .metadata.labels = ((.metadata.labels // {}) | with_entries(
+          if (.value | type) == "string" then .value |= gsub($old; $new) else . end) |
+          if .["apps.cozystack.io/application.kind"] == "MySQL"
+          then .["apps.cozystack.io/application.kind"] = "MariaDB"
+          else . end) |
+        .metadata.annotations = ((.metadata.annotations // {}) | with_entries(
+          select(.key != "kubectl.kubernetes.io/last-applied-configuration") |
+          if (.value | type) == "string" then .value |= gsub($old; $new) else . end)) |
+        (if .spec.chart.spec.chart == $old_prefix
+         then .spec.chart.spec.chart = $new_prefix else . end) |
+        .spec.suspend = true
+      ' | kubectl -n "$NAMESPACE" apply -f -
+  else
+    echo "    [WARN] hr/${OLD_NAME} not found, cannot clone"
+  fi
+
+  # --- 3m: Delete old unprotected resources ---
+  echo "  --- Delete old resources ---"
+  for kind in "grant.k8s.mariadb.com" "database.k8s.mariadb.com" "user.k8s.mariadb.com"; do
+    for resource in $(kubectl -n "$NAMESPACE" get "$kind" -o name 2>/dev/null | grep "${OLD_NAME}"); do
+      old_res_name="${resource##*/}"
+      kubectl -n "$NAMESPACE" patch "$kind" "$old_res_name" --type=json \
+        -p='[{"op":"remove","path":"/metadata/finalizers"}]' 2>/dev/null || true
+      echo "    [DELETE] ${kind}/${old_res_name}"
+      kubectl -n "$NAMESPACE" delete "$kind" "$old_res_name" --wait=false 2>/dev/null || true
+    done
+  done
+
+  if resource_exists "$NAMESPACE" "mariadb.k8s.mariadb.com" "$OLD_NAME"; then
+    kubectl -n "$NAMESPACE" patch mariadb.k8s.mariadb.com "$OLD_NAME" --type=json \
+      -p='[{"op":"remove","path":"/metadata/finalizers"}]' 2>/dev/null || true
+    delete_resource "$NAMESPACE" "mariadb.k8s.mariadb.com" "$OLD_NAME"
+  fi
+
+  for secret in $(kubectl -n "$NAMESPACE" get secret -o name 2>/dev/null \
+    | grep "secret/${OLD_NAME}" | grep -v "sh.helm.release"); do
+    old_secret_name="${secret#secret/}"
+    delete_resource "$NAMESPACE" "secret" "$old_secret_name"
+  done
+
+  for cm in $(kubectl -n "$NAMESPACE" get configmap -o name 2>/dev/null \
+    | grep "configmap/${OLD_NAME}"); do
+    old_cm_name="${cm#configmap/}"
+    delete_resource "$NAMESPACE" "configmap" "$old_cm_name"
+  done
+
+  delete_resource "$NAMESPACE" "workloadmonitor.cozystack.io" "$OLD_NAME"
+
+  if resource_exists "$NAMESPACE" "hr" "$OLD_NAME"; then
+    kubectl -n "$NAMESPACE" patch hr "$OLD_NAME" --type=json \
+      -p='[{"op":"remove","path":"/metadata/finalizers"}]' 2>/dev/null || true
+    delete_resource "$NAMESPACE" "hr" "$OLD_NAME"
+  fi
+
+  echo "    [DELETE] secrets with label owner=helm,name=${OLD_NAME}"
+  kubectl -n "$NAMESPACE" delete secret -l "owner=helm,name=${OLD_NAME}" 2>/dev/null || true
+
+  # Collect protected resources for batch deletion
+  for suffix in "" "-internal" "-primary" "-secondary" "-metrics"; do
+    svc_name="${OLD_NAME}${suffix}"
+    if resource_exists "$NAMESPACE" "svc" "$svc_name"; then
+      ALL_PROTECTED_RESOURCES+=("${NAMESPACE}:svc/${svc_name}")
+    fi
+  done
+  for i in $(seq 0 $((replicas - 1))); do
+    old_pvc="storage-${OLD_NAME}-${i}"
+    if resource_exists "$NAMESPACE" "pvc" "$old_pvc"; then
+      ALL_PROTECTED_RESOURCES+=("${NAMESPACE}:pvc/${old_pvc}")
+    fi
+  done
+done
+
+# ============================================================
+# STEP 4: Delete protected resources (PVCs, Services)
+# ============================================================
+echo ""
+echo "--- Step 4: Delete protected resources ---"
+
+if [ ${#ALL_PROTECTED_RESOURCES[@]} -gt 0 ]; then
+  echo "  --- Temporarily disabling protection-webhook ---"
+
+  WEBHOOK_REPLICAS=$(kubectl -n "$PROTECTION_WEBHOOK_NS" get deploy "$PROTECTION_WEBHOOK_NAME" \
+    -o jsonpath='{.spec.replicas}' 2>/dev/null || echo "1")
+
+  echo "  [SCALE] ${PROTECTION_WEBHOOK_NAME} -> 0 (was ${WEBHOOK_REPLICAS})"
+  kubectl -n "$PROTECTION_WEBHOOK_NS" scale deploy "$PROTECTION_WEBHOOK_NAME" --replicas=0
+
+  patch_webhook_policy "$PROTECTION_WEBHOOK_NAME" "Ignore"
+
+  echo "  Waiting for webhook pods to terminate..."
+  kubectl -n "$PROTECTION_WEBHOOK_NS" wait --for=delete pod \
+    -l app.kubernetes.io/name=protection-webhook --timeout=60s 2>/dev/null || true
+  sleep 3
+
+  for entry in "${ALL_PROTECTED_RESOURCES[@]}"; do
+    ns="${entry%%:*}"
+    res="${entry#*:}"
+    echo "  [DELETE] ${ns}/${res}"
+    kubectl -n "$ns" delete "$res" --wait=false 2>/dev/null || true
+  done
+
+  patch_webhook_policy "$PROTECTION_WEBHOOK_NAME" "Fail"
+
+  echo "  [SCALE] ${PROTECTION_WEBHOOK_NAME} -> ${WEBHOOK_REPLICAS}"
+  kubectl -n "$PROTECTION_WEBHOOK_NS" scale deploy "$PROTECTION_WEBHOOK_NAME" \
+    --replicas="$WEBHOOK_REPLICAS"
+  echo "  --- protection-webhook restored ---"
+else
+  echo "  [SKIP] No protected resources to delete"
+fi
+
+# ============================================================
+# STEP 5: Restore PV reclaim policies
+# ============================================================
+echo ""
+echo "--- Step 5: Restore PV reclaim policies ---"
+for pv_name in "${ALL_PV_NAMES[@]}"; do
+  if [ -n "$pv_name" ]; then
+    original="${ORIGINAL_PV_POLICIES[$pv_name]:-}"
+    if [ -n "$original" ]; then
+      echo "  [PATCH] PV ${pv_name}: Retain -> ${original}"
+      kubectl patch pv "$pv_name" -p "{\"spec\":{\"persistentVolumeReclaimPolicy\":\"${original}\"}}"
+    else
+      echo "  [SKIP] PV ${pv_name} was already Retain, leaving as-is"
+    fi
+  fi
+done
+
+# ============================================================
+# STEP 6: Restore mariadb-operator
+# ============================================================
+echo ""
+echo "--- Step 6: Restore mariadb-operator ---"
+
+current_policy=$(kubectl get validatingwebhookconfiguration "$MARIADB_WEBHOOK_NAME" \
+  -o jsonpath='{.webhooks[0].failurePolicy}' 2>/dev/null || echo "unknown")
+if [ "$current_policy" = "Ignore" ]; then
+  patch_webhook_policy "$MARIADB_WEBHOOK_NAME" "Fail"
+else
+  echo "  [SKIP] Webhook ${MARIADB_WEBHOOK_NAME} already failurePolicy=${current_policy}"
+fi
+
+for deploy in mariadb-operator mariadb-operator-cert-controller mariadb-operator-webhook; do
+  current=$(kubectl -n "$MARIADB_OPERATOR_NS" get deploy "$deploy" \
+    -o jsonpath='{.spec.replicas}' 2>/dev/null || echo "1")
+  if [ "$current" = "0" ]; then
+    target="${OPERATOR_REPLICAS[$deploy]:-1}"
+    echo "  [SCALE] ${deploy} -> ${target}"
+    kubectl -n "$MARIADB_OPERATOR_NS" scale deploy "$deploy" --replicas="$target"
+  else
+    echo "  [SKIP] ${deploy} already running (replicas=${current})"
+  fi
+done
+
+# ============================================================
+# STEP 7: Unsuspend all new HelmReleases
+# ============================================================
+echo ""
+echo "--- Step 7: Unsuspend new HelmReleases ---"
+for entry in "${INSTANCES[@]}"; do
+  ns="${entry%%/*}"
+  instance="${entry#*/}"
+  new_name="${NEW_PREFIX}-${instance}"
+  if resource_exists "$ns" "hr" "$new_name"; then
+    suspended=$(kubectl -n "$ns" get hr "$new_name" \
+      -o jsonpath='{.spec.suspend}' 2>/dev/null || echo "false")
+    if [ "$suspended" = "true" ]; then
+      echo "  [UNSUSPEND] ${ns}/hr/${new_name}"
+      kubectl -n "$ns" patch hr "$new_name" --type=merge -p '{"spec":{"suspend":false}}'
+    else
+      echo "  [SKIP] ${ns}/hr/${new_name} already not suspended"
+    fi
+  fi
+done
+
+echo ""
+echo "=== Migration complete (${#INSTANCES[@]} instance(s)) ==="
+
+# Stamp version
+kubectl create configmap -n cozy-system cozystack-version \
+  --from-literal=version=29 --dry-run=client -o yaml | kubectl apply -f-
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index f923c22d..9bb8e2b1 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -5,8 +5,8 @@ sourceRef:
   path: /
 migrations:
   enabled: false
-  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0-beta.3@sha256:1ab28def39c9cb0233a03708ce00c9694edc9728789eef59abdc1d72bbe9b10a
-  targetVersion: 28
+  image: ghcr.io/cozystack/cozystack/platform-migrations:latest
+  targetVersion: 29
 # Bundle deployment configuration
 bundles:
   system:

From 9a86551e40e2f168ce935416bb02010476795a0d Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 12 Feb 2026 15:18:06 +0100
Subject: [PATCH 019/666] fix(e2e): correct s3Bucket reference in mariadb test

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 hack/e2e-apps/mariadb.bats | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hack/e2e-apps/mariadb.bats b/hack/e2e-apps/mariadb.bats
index 50e608ac..5b11c4c0 100644
--- a/hack/e2e-apps/mariadb.bats
+++ b/hack/e2e-apps/mariadb.bats
@@ -25,7 +25,7 @@ spec:
   backup:
     enabled: false
     s3Region: us-east-1
-    s3Bucket: s3.example.org/postgres-backups
+    s3Bucket: s3.example.org/mariadb-backups
     schedule: "0 2 * * *"
     cleanupStrategy: "--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
     s3AccessKey: oobaiRus9pah8PhohL1ThaeTa4UVa7gu

From 04218411784894dc88627a8630586d277d6805bd Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 12 Feb 2026 00:33:02 +0100
Subject: [PATCH 020/666] feat(nfs): add managed NFS application with
 kubernetes tenant integration

Add managed NFS application and integrate it with tenant Kubernetes clusters:
- New `nfs` app deploying NFS server as a HelmRelease with standalone RWX PVC storage
- `nfs-rd` resource definition package for the NFS app
- `system/nfs` package with Cilium egress policy for NFS traffic
- `extraStorageClasses` support in `nfs-driver` system chart
- NFS addon in `kubernetes` app with PVC-based volume lookup and top-level `nfs.instances` configuration
- `nfs-application` PackageSource for platform artifact delivery
- E2E test with NFS mount verification
- Helm-unittest tests for new templates

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 hack/e2e-apps/run-kubernetes.sh               |  88 +++++++++++-
 packages/apps/kubernetes/Makefile             |   3 +
 packages/apps/kubernetes/README.md            |  11 ++
 .../templates/helmreleases/nfs-driver.yaml    |  67 +++++++++
 .../kubernetes/tests/nfs-driver_test.yaml     |  45 ++++++
 packages/apps/kubernetes/values.schema.json   |  41 ++++++
 packages/apps/kubernetes/values.yaml          |  24 ++++
 packages/apps/nfs/.helmignore                 |   2 +
 packages/apps/nfs/Chart.yaml                  |   6 +
 packages/apps/nfs/Makefile                    |   6 +
 packages/apps/nfs/README.md                   |  20 +++
 packages/apps/nfs/charts/cozy-lib             |   1 +
 packages/apps/nfs/logos/nfs.svg               |  13 ++
 packages/apps/nfs/templates/_helpers.tpl      |  49 +++++++
 .../nfs/templates/dashboard-resourcemap.yaml  |  23 +++
 packages/apps/nfs/templates/helmrelease.yaml  |  22 +++
 packages/apps/nfs/templates/pvc.yaml          |  15 ++
 .../apps/nfs/templates/workloadmonitor.yaml   |  12 ++
 packages/apps/nfs/values.schema.json          |  25 ++++
 packages/apps/nfs/values.yaml                 |   9 ++
 .../platform/images/migrations/migrations/25  |   3 +
 .../sources/kubernetes-application.yaml       |   2 +
 .../platform/sources/nfs-application.yaml     |  29 ++++
 .../kubernetes-rd/cozyrds/kubernetes.yaml     |   4 +-
 packages/system/nfs-driver/Makefile           |   3 +
 .../templates/extra-storageclasses.yaml       |  18 +++
 .../tests/extra-storageclasses_test.yaml      | 133 ++++++++++++++++++
 packages/system/nfs-driver/values.yaml        |   2 +
 packages/system/nfs-rd/Chart.yaml             |   3 +
 packages/system/nfs-rd/Makefile               |   4 +
 packages/system/nfs-rd/cozyrds/nfs.yaml       |  21 +++
 packages/system/nfs-rd/templates/cozyrd.yaml  |   4 +
 packages/system/nfs-rd/values.yaml            |   1 +
 packages/system/nfs/.helmignore               |   2 +
 packages/system/nfs/Chart.yaml                |   3 +
 packages/system/nfs/Makefile                  |   3 +
 .../system/nfs/templates/cilium-policy.yaml   |  20 +++
 packages/system/nfs/values.yaml               |   1 +
 38 files changed, 734 insertions(+), 4 deletions(-)
 create mode 100644 packages/apps/kubernetes/templates/helmreleases/nfs-driver.yaml
 create mode 100644 packages/apps/kubernetes/tests/nfs-driver_test.yaml
 create mode 100644 packages/apps/nfs/.helmignore
 create mode 100644 packages/apps/nfs/Chart.yaml
 create mode 100644 packages/apps/nfs/Makefile
 create mode 100644 packages/apps/nfs/README.md
 create mode 120000 packages/apps/nfs/charts/cozy-lib
 create mode 100644 packages/apps/nfs/logos/nfs.svg
 create mode 100644 packages/apps/nfs/templates/_helpers.tpl
 create mode 100644 packages/apps/nfs/templates/dashboard-resourcemap.yaml
 create mode 100644 packages/apps/nfs/templates/helmrelease.yaml
 create mode 100644 packages/apps/nfs/templates/pvc.yaml
 create mode 100644 packages/apps/nfs/templates/workloadmonitor.yaml
 create mode 100644 packages/apps/nfs/values.schema.json
 create mode 100644 packages/apps/nfs/values.yaml
 create mode 100644 packages/core/platform/sources/nfs-application.yaml
 create mode 100644 packages/system/nfs-driver/templates/extra-storageclasses.yaml
 create mode 100644 packages/system/nfs-driver/tests/extra-storageclasses_test.yaml
 create mode 100644 packages/system/nfs-rd/Chart.yaml
 create mode 100644 packages/system/nfs-rd/Makefile
 create mode 100644 packages/system/nfs-rd/cozyrds/nfs.yaml
 create mode 100644 packages/system/nfs-rd/templates/cozyrd.yaml
 create mode 100644 packages/system/nfs-rd/values.yaml
 create mode 100644 packages/system/nfs/.helmignore
 create mode 100644 packages/system/nfs/Chart.yaml
 create mode 100644 packages/system/nfs/Makefile
 create mode 100644 packages/system/nfs/templates/cilium-policy.yaml
 create mode 100644 packages/system/nfs/values.yaml

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index 3e2e20f9..51dc837c 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -3,6 +3,25 @@ run_kubernetes_test() {
     local test_name="$2"
     local port="$3"
     local k8s_version=$(yq "$version_expr" packages/apps/kubernetes/files/versions.yaml)
+    local nfs_name="${test_name}"
+
+  # Create NFS volume for testing NFS mount
+  kubectl apply -f - <<EOF
+apiVersion: apps.cozystack.io/v1alpha1
+kind: NFS
+metadata:
+  name: "${nfs_name}"
+  namespace: tenant-test
+spec:
+  size: 1Gi
+  storageClass: replicated
+EOF
+
+  # Wait for NFS HelmRelease to be ready
+  kubectl -n tenant-test wait hr nfs-${nfs_name} --timeout=120s --for=condition=ready
+
+  # Wait for NFS PVC to be bound
+  kubectl -n tenant-test wait pvc nfs-${nfs_name} --timeout=120s --for=jsonpath='{.status.phase}'=Bound
 
   kubectl apply -f - <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
@@ -59,6 +78,9 @@ spec:
       minReplicas: 0
       roles:
       - ingress-nginx
+  nfs:
+    instances:
+    - name: "${nfs_name}"
   storageClass: replicated
   version: "${k8s_version}"
 EOF
@@ -214,14 +236,73 @@ fi
     exit 1
   fi
 
-  # Cleanup
+  # Cleanup LoadBalancer test
   kubectl delete deployment --kubeconfig tenantkubeconfig-${test_name} "${test_name}-backend" -n tenant-test
   kubectl delete service --kubeconfig tenantkubeconfig-${test_name} "${test_name}-backend" -n tenant-test
 
+  # Test NFS mount in tenant cluster
+  # Wait for NFS StorageClass to appear in tenant cluster
+  timeout 120 sh -ec 'until kubectl --kubeconfig tenantkubeconfig-'"${test_name}"' get sc nfs-'"${nfs_name}"' 2>/dev/null; do sleep 5; done'
+
+  # Create PVC with NFS StorageClass
+  kubectl --kubeconfig tenantkubeconfig-${test_name} apply -f - <<EOF
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nfs-test-pvc
+  namespace: tenant-test
+spec:
+  accessModes:
+  - ReadWriteMany
+  storageClassName: nfs-${nfs_name}
+  resources:
+    requests:
+      storage: 1Gi
+EOF
+
+  # Wait for PVC to be bound
+  kubectl --kubeconfig tenantkubeconfig-${test_name} wait pvc nfs-test-pvc -n tenant-test --timeout=2m --for=jsonpath='{.status.phase}'=Bound
+
+  # Create Pod that writes and reads data from NFS volume
+  kubectl --kubeconfig tenantkubeconfig-${test_name} apply -f - <<EOF
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nfs-test-pod
+  namespace: tenant-test
+spec:
+  containers:
+  - name: test
+    image: busybox
+    command: ["sh", "-c", "echo 'nfs-mount-ok' > /data/test.txt && cat /data/test.txt"]
+    volumeMounts:
+    - name: nfs-vol
+      mountPath: /data
+  volumes:
+  - name: nfs-vol
+    persistentVolumeClaim:
+      claimName: nfs-test-pvc
+  restartPolicy: Never
+EOF
+
+  # Wait for Pod to complete successfully
+  kubectl --kubeconfig tenantkubeconfig-${test_name} wait pod nfs-test-pod -n tenant-test --timeout=2m --for=jsonpath='{.status.phase}'=Succeeded
+
+  # Verify NFS data integrity
+  nfs_result=$(kubectl --kubeconfig tenantkubeconfig-${test_name} logs nfs-test-pod -n tenant-test)
+  if [ "$nfs_result" != "nfs-mount-ok" ]; then
+    echo "NFS mount test failed: expected 'nfs-mount-ok', got '$nfs_result'" >&2
+    exit 1
+  fi
+
+  # Cleanup NFS test resources in tenant cluster
+  kubectl --kubeconfig tenantkubeconfig-${test_name} delete pod nfs-test-pod -n tenant-test
+  kubectl --kubeconfig tenantkubeconfig-${test_name} delete pvc nfs-test-pvc -n tenant-test
+
   # Wait for all machine deployment replicas to be ready (timeout after 10 minutes)
   kubectl wait machinedeployment kubernetes-${test_name}-md0 -n tenant-test --timeout=10m --for=jsonpath='{.status.v1beta2.readyReplicas}'=2
 
-  for component in cilium coredns csi vsnap-crd; do
+  for component in cilium coredns csi nfs-driver vsnap-crd; do
       kubectl wait hr kubernetes-${test_name}-${component} -n tenant-test --timeout=1m --for=condition=ready
     done
     kubectl wait hr kubernetes-${test_name}-ingress-nginx -n tenant-test --timeout=5m --for=condition=ready
@@ -229,4 +310,7 @@ fi
   # Clean up by deleting the Kubernetes resource
   kubectl -n tenant-test delete kuberneteses.apps.cozystack.io $test_name
 
+  # Clean up NFS volume
+  kubectl -n tenant-test delete nfs.apps.cozystack.io ${nfs_name}
+
 }
diff --git a/packages/apps/kubernetes/Makefile b/packages/apps/kubernetes/Makefile
index e6ed7c6f..9b4dadf0 100644
--- a/packages/apps/kubernetes/Makefile
+++ b/packages/apps/kubernetes/Makefile
@@ -4,6 +4,9 @@ KUBERNETES_PKG_TAG = $(shell awk '$$1 == "version:" {print $$2}' Chart.yaml)
 include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
+test:
+	helm unittest .
+
 generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
 	../../../hack/update-crd.sh
diff --git a/packages/apps/kubernetes/README.md b/packages/apps/kubernetes/README.md
index b2fe102f..66e72a6d 100644
--- a/packages/apps/kubernetes/README.md
+++ b/packages/apps/kubernetes/README.md
@@ -108,6 +108,15 @@ See the reference for components utilized in this service:
 | `host`                              | External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty. | `string`            | `""`        |
 
 
+### NFS
+
+| Name                    | Description                                                                                                    | Type       | Value |
+| ----------------------- | -------------------------------------------------------------------------------------------------------------- | ---------- | ----- |
+| `nfs`                   | NFS configuration.                                                                                             | `object`   | `{}`  |
+| `nfs.instances`         | List of NFS volume instances to connect. Each creates a StorageClass named `nfs-<name>` in the tenant cluster. | `[]object` | `[]`  |
+| `nfs.instances[i].name` | Name of the NFS volume instance in the same namespace.                                                         | `string`   | `""`  |
+
+
 ### Cluster Addons
 
 | Name                                          | Description                                                                 | Type       | Value     |
@@ -141,6 +150,8 @@ See the reference for components utilized in this service:
 | `addons.velero.valuesOverride`                | Custom Helm values overrides.                                               | `object`   | `{}`      |
 | `addons.coredns`                              | CoreDNS addon.                                                              | `object`   | `{}`      |
 | `addons.coredns.valuesOverride`               | Custom Helm values overrides.                                               | `object`   | `{}`      |
+| `addons.nfs`                                  | NFS CSI driver addon.                                                       | `object`   | `{}`      |
+| `addons.nfs.valuesOverride`                   | Custom Helm values overrides.                                               | `object`   | `{}`      |
 
 
 ### Kubernetes Control Plane Configuration
diff --git a/packages/apps/kubernetes/templates/helmreleases/nfs-driver.yaml b/packages/apps/kubernetes/templates/helmreleases/nfs-driver.yaml
new file mode 100644
index 00000000..c00ea763
--- /dev/null
+++ b/packages/apps/kubernetes/templates/helmreleases/nfs-driver.yaml
@@ -0,0 +1,67 @@
+{{- if .Values.nfs.instances }}
+{{- $extraStorageClasses := list }}
+{{- range .Values.nfs.instances }}
+{{-   $pvcName := printf "nfs-%s" .name }}
+{{-   $pvc := lookup "v1" "PersistentVolumeClaim" $.Release.Namespace $pvcName }}
+{{-   if not $pvc }}
+{{-     fail (printf "NFS PVC not found in namespace %s: %s" $.Release.Namespace $pvcName) }}
+{{-   end }}
+{{-   if not $pvc.spec.volumeName }}
+{{-     fail (printf "NFS PVC %s is not yet bound" $pvcName) }}
+{{-   end }}
+{{-   $pv := lookup "v1" "PersistentVolume" "" $pvc.spec.volumeName }}
+{{-   if not $pv }}
+{{-     fail (printf "PersistentVolume %s not found for PVC %s" $pvc.spec.volumeName $pvcName) }}
+{{-   end }}
+{{-   $nfsExport := index $pv.spec.csi.volumeAttributes "linstor.csi.linbit.com/nfs-export" }}
+{{-   if not $nfsExport }}
+{{-     fail (printf "PV %s has no linstor.csi.linbit.com/nfs-export attribute" $pv.metadata.name) }}
+{{-   end }}
+{{-   $parsed := urlParse $nfsExport }}
+{{-   $hostParts := splitList ":" $parsed.host }}
+{{-   $server := first $hostParts }}
+{{-   $port := last $hostParts }}
+{{-   $sc := dict "name" (printf "nfs-%s" .name) "server" $server "share" $parsed.path "mountOptions" (list (printf "nfsvers=4.2") (printf "port=%s" $port)) }}
+{{-   $extraStorageClasses = append $extraStorageClasses $sc }}
+{{- end }}
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: {{ .Release.Name }}-nfs-driver
+  labels:
+    cozystack.io/repository: system
+    cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
+spec:
+  releaseName: nfs-driver
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-nfs-driver
+    namespace: cozy-system
+  kubeConfig:
+    secretRef:
+      name: {{ .Release.Name }}-admin-kubeconfig
+      key: super-admin.svc
+  targetNamespace: cozy-nfs-driver
+  storageNamespace: cozy-nfs-driver
+  interval: 5m
+  timeout: 10m
+  install:
+    createNamespace: true
+    remediation:
+      retries: -1
+  upgrade:
+    force: true
+    remediation:
+      retries: -1
+  values:
+    {{- $defaultValues := dict "csi-driver-nfs" (dict "storageClass" (dict "create" false)) "extraStorageClasses" $extraStorageClasses }}
+    {{- toYaml (deepCopy .Values.addons.nfs.valuesOverride | mergeOverwrite $defaultValues) | nindent 4 }}
+  dependsOn:
+  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
+  - name: {{ .Release.Name }}
+    namespace: {{ .Release.Namespace }}
+  {{- end }}
+  - name: {{ .Release.Name }}-cilium
+    namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/packages/apps/kubernetes/tests/nfs-driver_test.yaml b/packages/apps/kubernetes/tests/nfs-driver_test.yaml
new file mode 100644
index 00000000..902d3e69
--- /dev/null
+++ b/packages/apps/kubernetes/tests/nfs-driver_test.yaml
@@ -0,0 +1,45 @@
+suite: NFS driver HelmRelease tests
+
+templates:
+  - templates/helmreleases/nfs-driver.yaml
+
+tests:
+  - it: renders nothing when instances is empty
+    release:
+      name: kubernetes-test
+      namespace: tenant-root
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: renders nothing when instances is not set
+    release:
+      name: kubernetes-test
+      namespace: tenant-root
+    set:
+      nfs.instances: []
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: fails when NFS PVC is not found
+    release:
+      name: kubernetes-test
+      namespace: tenant-root
+    set:
+      nfs.instances:
+        - name: my-data
+    asserts:
+      - failedTemplate:
+          errorMessage: "NFS PVC not found in namespace tenant-root: nfs-my-data"
+
+  - it: constructs correct PVC name for lookup
+    release:
+      name: kubernetes-test
+      namespace: custom-ns
+    set:
+      nfs.instances:
+        - name: backup
+    asserts:
+      - failedTemplate:
+          errorMessage: "NFS PVC not found in namespace custom-ns: nfs-backup"
diff --git a/packages/apps/kubernetes/values.schema.json b/packages/apps/kubernetes/values.schema.json
index 1f6c9361..caf741b5 100644
--- a/packages/apps/kubernetes/values.schema.json
+++ b/packages/apps/kubernetes/values.schema.json
@@ -15,6 +15,7 @@
         "gpuOperator",
         "ingressNginx",
         "monitoringAgents",
+        "nfs",
         "velero",
         "verticalPodAutoscaler"
       ],
@@ -194,6 +195,22 @@
             }
           }
         },
+        "nfs": {
+          "description": "NFS CSI driver addon.",
+          "type": "object",
+          "default": {},
+          "required": [
+            "valuesOverride"
+          ],
+          "properties": {
+            "valuesOverride": {
+              "description": "Custom Helm values overrides.",
+              "type": "object",
+              "default": {},
+              "x-kubernetes-preserve-unknown-fields": true
+            }
+          }
+        },
         "velero": {
           "description": "Velero backup/restore addon.",
           "type": "object",
@@ -500,6 +517,30 @@
       "type": "string",
       "default": ""
     },
+    "nfs": {
+      "description": "NFS configuration.",
+      "type": "object",
+      "default": {},
+      "properties": {
+        "instances": {
+          "description": "List of NFS volume instances to connect. Each creates a StorageClass named `nfs-\u003cname\u003e` in the tenant cluster.",
+          "type": "array",
+          "default": [],
+          "items": {
+            "type": "object",
+            "required": [
+              "name"
+            ],
+            "properties": {
+              "name": {
+                "description": "Name of the NFS volume instance in the same namespace.",
+                "type": "string"
+              }
+            }
+          }
+        }
+      }
+    },
     "nodeGroups": {
       "description": "Worker nodes configuration map.",
       "type": "object",
diff --git a/packages/apps/kubernetes/values.yaml b/packages/apps/kubernetes/values.yaml
index 7f15752f..d4e2a1c2 100644
--- a/packages/apps/kubernetes/values.yaml
+++ b/packages/apps/kubernetes/values.yaml
@@ -62,6 +62,24 @@ version: "v1.33"
 ## @param {string} host - External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.
 host: ""
 
+##
+## @section NFS
+##
+
+## @typedef {struct} NFSInstance - Reference to an NFS volume instance.
+## @field {string} name - Name of the NFS volume instance in the same namespace.
+
+## @typedef {struct} NFS - NFS configuration.
+## @field {[]NFSInstance} instances - List of NFS volume instances to connect. Each creates a StorageClass named `nfs-<name>` in the tenant cluster.
+
+## @param {NFS} nfs - NFS configuration.
+nfs:
+  instances: []
+  ## Example:
+  ## instances:
+  ## - name: my-data
+  ## - name: my-backup
+
 ##
 ## @section Cluster Addons
 ##
@@ -108,6 +126,9 @@ host: ""
 ## @typedef {struct} CoreDNSAddon - CoreDNS addon.
 ## @field {object} valuesOverride - Custom Helm values overrides.
 
+## @typedef {struct} NFSAddon - NFS CSI driver addon.
+## @field {object} valuesOverride - Custom Helm values overrides.
+
 ## @typedef {struct} Addons - Cluster addons configuration.
 ## @field {CertManagerAddon} certManager - Cert-manager addon.
 ## @field {CiliumAddon} cilium - Cilium CNI plugin.
@@ -119,6 +140,7 @@ host: ""
 ## @field {VerticalPodAutoscalerAddon} verticalPodAutoscaler - Vertical Pod Autoscaler.
 ## @field {VeleroAddon} velero - Velero backup/restore addon.
 ## @field {CoreDNSAddon} coredns - CoreDNS addon.
+## @field {NFSAddon} nfs - NFS CSI driver addon.
 
 ## @param {Addons} addons - Cluster addons configuration.
 addons:
@@ -150,6 +172,8 @@ addons:
     valuesOverride: {}
   coredns:
     valuesOverride: {}
+  nfs:
+    valuesOverride: {}
 
 ##
 ## @section Kubernetes Control Plane Configuration
diff --git a/packages/apps/nfs/.helmignore b/packages/apps/nfs/.helmignore
new file mode 100644
index 00000000..481ff39c
--- /dev/null
+++ b/packages/apps/nfs/.helmignore
@@ -0,0 +1,2 @@
+logos/
+hack/
diff --git a/packages/apps/nfs/Chart.yaml b/packages/apps/nfs/Chart.yaml
new file mode 100644
index 00000000..3426d019
--- /dev/null
+++ b/packages/apps/nfs/Chart.yaml
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: nfs
+description: Managed NFS storage
+icon: /logos/nfs.svg
+type: application
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
diff --git a/packages/apps/nfs/Makefile b/packages/apps/nfs/Makefile
new file mode 100644
index 00000000..3df774a0
--- /dev/null
+++ b/packages/apps/nfs/Makefile
@@ -0,0 +1,6 @@
+include ../../../hack/common-envs.mk
+include ../../../hack/package.mk
+
+generate:
+	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	../../../hack/update-crd.sh
diff --git a/packages/apps/nfs/README.md b/packages/apps/nfs/README.md
new file mode 100644
index 00000000..07e46408
--- /dev/null
+++ b/packages/apps/nfs/README.md
@@ -0,0 +1,20 @@
+# Managed File Share Service
+
+NFS Ganesha based managed file sharing service that provides NFSv4 network storage accessible from multiple clients simultaneously.
+
+## Deployment Details
+
+This service deploys NFS Ganesha as a StatefulSet with persistent volume storage, exposing NFSv4 on port 2049.
+
+- Docs: <https://github.com/nfs-ganesha/nfs-ganesha/wiki>
+- GitHub: <https://github.com/nfs-ganesha/nfs-ganesha>
+
+## Parameters
+
+### Common parameters
+
+| Name           | Description                          | Type       | Value        |
+| -------------- | ------------------------------------ | ---------- | ------------ |
+| `storageClass` | StorageClass used to store the data. | `string`   | `replicated` |
+| `size`         | Volume size for NFS storage.         | `quantity` | `10Gi`       |
+
diff --git a/packages/apps/nfs/charts/cozy-lib b/packages/apps/nfs/charts/cozy-lib
new file mode 120000
index 00000000..e1813509
--- /dev/null
+++ b/packages/apps/nfs/charts/cozy-lib
@@ -0,0 +1 @@
+../../../library/cozy-lib
\ No newline at end of file
diff --git a/packages/apps/nfs/logos/nfs.svg b/packages/apps/nfs/logos/nfs.svg
new file mode 100644
index 00000000..3d57d868
--- /dev/null
+++ b/packages/apps/nfs/logos/nfs.svg
@@ -0,0 +1,13 @@
+<svg width="144" height="144" viewBox="0 0 144 144" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="144" height="144" rx="24" fill="url(#paint0_linear)"/>
+<path d="M36 58V104C36 107.314 38.6863 110 42 110H102C105.314 110 108 107.314 108 104V52C108 48.6863 105.314 46 102 46H70L62 34H42C38.6863 34 36 36.6863 36 40V58Z" fill="#1565C0"/>
+<path d="M30 62C30 58.6863 32.6863 56 36 56H108C111.314 56 114 58.6863 114 62V104C114 107.314 111.314 110 108 110H36C32.6863 110 30 107.314 30 104V62Z" fill="#42A5F5"/>
+<path d="M63 76V94M63 76L54 85M63 76L72 85" stroke="white" stroke-width="4" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M81 94V76M81 94L90 85M81 94L72 85" stroke="white" stroke-width="4" stroke-linecap="round" stroke-linejoin="round"/>
+<defs>
+<linearGradient id="paint0_linear" x1="0" y1="0" x2="144" y2="144" gradientUnits="userSpaceOnUse">
+<stop stop-color="#E3F2FD"/>
+<stop offset="1" stop-color="#64B5F6"/>
+</linearGradient>
+</defs>
+</svg>
diff --git a/packages/apps/nfs/templates/_helpers.tpl b/packages/apps/nfs/templates/_helpers.tpl
new file mode 100644
index 00000000..63d66461
--- /dev/null
+++ b/packages/apps/nfs/templates/_helpers.tpl
@@ -0,0 +1,49 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "nfs.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+*/}}
+{{- define "nfs.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "nfs.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "nfs.labels" -}}
+helm.sh/chart: {{ include "nfs.chart" . }}
+{{ include "nfs.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "nfs.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "nfs.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
diff --git a/packages/apps/nfs/templates/dashboard-resourcemap.yaml b/packages/apps/nfs/templates/dashboard-resourcemap.yaml
new file mode 100644
index 00000000..106af486
--- /dev/null
+++ b/packages/apps/nfs/templates/dashboard-resourcemap.yaml
@@ -0,0 +1,23 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - persistentvolumeclaims
+  resourceNames:
+  - {{ .Release.Name }}
+  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
diff --git a/packages/apps/nfs/templates/helmrelease.yaml b/packages/apps/nfs/templates/helmrelease.yaml
new file mode 100644
index 00000000..598f065f
--- /dev/null
+++ b/packages/apps/nfs/templates/helmrelease.yaml
@@ -0,0 +1,22 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: {{ .Release.Name }}-system
+  labels:
+    sharding.fluxcd.io/key: tenants
+spec:
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-nfs-application-default-nfs-system
+    namespace: cozy-system
+  interval: 5m
+  timeout: 10m
+  install:
+    remediation:
+      retries: -1
+  upgrade:
+    force: true
+    remediation:
+      retries: -1
+  values:
+    pvcName: {{ .Release.Name }}
diff --git a/packages/apps/nfs/templates/pvc.yaml b/packages/apps/nfs/templates/pvc.yaml
new file mode 100644
index 00000000..edfa64dc
--- /dev/null
+++ b/packages/apps/nfs/templates/pvc.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    {{- include "nfs.labels" . | nindent 4 }}
+spec:
+  accessModes:
+  - ReadWriteMany
+  {{- with .Values.storageClass }}
+  storageClassName: "{{ . }}"
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.size }}
diff --git a/packages/apps/nfs/templates/workloadmonitor.yaml b/packages/apps/nfs/templates/workloadmonitor.yaml
new file mode 100644
index 00000000..2125a1b3
--- /dev/null
+++ b/packages/apps/nfs/templates/workloadmonitor.yaml
@@ -0,0 +1,12 @@
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ $.Release.Name }}
+spec:
+  replicas: 1
+  minReplicas: 1
+  kind: nfs
+  type: nfs
+  selector:
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  version: {{ $.Chart.Version }}
diff --git a/packages/apps/nfs/values.schema.json b/packages/apps/nfs/values.schema.json
new file mode 100644
index 00000000..012171ef
--- /dev/null
+++ b/packages/apps/nfs/values.schema.json
@@ -0,0 +1,25 @@
+{
+  "title": "Chart Values",
+  "type": "object",
+  "properties": {
+    "size": {
+      "description": "Volume size for NFS storage.",
+      "default": "10Gi",
+      "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+      "anyOf": [
+        {
+          "type": "integer"
+        },
+        {
+          "type": "string"
+        }
+      ],
+      "x-kubernetes-int-or-string": true
+    },
+    "storageClass": {
+      "description": "StorageClass used to store the data.",
+      "type": "string",
+      "default": "replicated"
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/apps/nfs/values.yaml b/packages/apps/nfs/values.yaml
new file mode 100644
index 00000000..d08d9331
--- /dev/null
+++ b/packages/apps/nfs/values.yaml
@@ -0,0 +1,9 @@
+##
+## @section Common parameters
+##
+
+## @param {string} storageClass - StorageClass used to store the data.
+storageClass: "replicated"
+
+## @param {quantity} size - Volume size for NFS storage.
+size: 10Gi
diff --git a/packages/core/platform/images/migrations/migrations/25 b/packages/core/platform/images/migrations/migrations/25
index 655cce23..5085699f 100755
--- a/packages/core/platform/images/migrations/migrations/25
+++ b/packages/core/platform/images/migrations/migrations/25
@@ -12,6 +12,9 @@ kubectl delete deploy cozystack -n cozy-system --ignore-not-found
 # Delete old cozystack-assets statefulset
 kubectl delete sts cozystack-assets -n cozy-system --ignore-not-found
 
+kubectl delete helmrepositories.source.toolkit.fluxcd.io -n cozy-public cozystack-apps cozystack-extra --ignore-not-found --wait=false
+kubectl delete helmrepositories.source.toolkit.fluxcd.io -n cozy-system cozystack-system --ignore-not-found --wait=false
+
 # Delete old bootbox HelmReleases (will be recreated by new platform chart if enabled)
 kubectl delete hr bootbox -n cozy-system --ignore-not-found
 kubectl delete hr bootbox-rd -n cozy-system --ignore-not-found
diff --git a/packages/core/platform/sources/kubernetes-application.yaml b/packages/core/platform/sources/kubernetes-application.yaml
index 9787cb19..a329f002 100644
--- a/packages/core/platform/sources/kubernetes-application.yaml
+++ b/packages/core/platform/sources/kubernetes-application.yaml
@@ -58,6 +58,8 @@ spec:
           path: system/prometheus-operator-crds
         - name: kubernetes-metrics-server
           path: system/metrics-server
+        - name: kubernetes-nfs-driver
+          path: system/nfs-driver
         - name: kubernetes
           path: apps/kubernetes
           libraries: ["cozy-lib"]
diff --git a/packages/core/platform/sources/nfs-application.yaml b/packages/core/platform/sources/nfs-application.yaml
new file mode 100644
index 00000000..c9dc8575
--- /dev/null
+++ b/packages/core/platform/sources/nfs-application.yaml
@@ -0,0 +1,29 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.nfs-application
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+    path: /
+  variants:
+    - name: default
+      dependsOn:
+        - cozystack.networking
+      libraries:
+        - name: cozy-lib
+          path: library/cozy-lib
+      components:
+        - name: nfs-system
+          path: system/nfs
+        - name: nfs
+          path: apps/nfs
+          libraries: ["cozy-lib"]
+        - name: nfs-rd
+          path: system/nfs-rd
+          install:
+            namespace: cozy-system
+            releaseName: nfs-rd
diff --git a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
index 1b4c7361..7ac884ea 100644
--- a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
+++ b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
@@ -8,7 +8,7 @@ spec:
     singular: kubernetes
     plural: kuberneteses
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"addons":{"description":"Cluster addons configuration.","type":"object","default":{},"required":["certManager","cilium","coredns","fluxcd","gatewayAPI","gpuOperator","ingressNginx","monitoringAgents","velero","verticalPodAutoscaler"],"properties":{"certManager":{"description":"Cert-manager addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable cert-manager.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"cilium":{"description":"Cilium CNI plugin.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"coredns":{"description":"CoreDNS addon.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"fluxcd":{"description":"FluxCD GitOps operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable FluxCD.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"gatewayAPI":{"description":"Gateway API addon.","type":"object","default":{},"required":["enabled"],"properties":{"enabled":{"description":"Enable Gateway API.","type":"boolean","default":false}}},"gpuOperator":{"description":"NVIDIA GPU Operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable GPU Operator.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"ingressNginx":{"description":"Ingress-NGINX controller.","type":"object","default":{},"required":["enabled","exposeMethod","valuesOverride"],"properties":{"enabled":{"description":"Enable the controller (requires nodes labeled `ingress-nginx`).","type":"boolean","default":false},"exposeMethod":{"description":"Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.","type":"string","default":"Proxied","enum":["Proxied","LoadBalancer"]},"hosts":{"description":"Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.","type":"array","default":[],"items":{"type":"string"}},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"monitoringAgents":{"description":"Monitoring agents.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable monitoring agents.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"velero":{"description":"Velero backup/restore addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable Velero.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"verticalPodAutoscaler":{"description":"Vertical Pod Autoscaler.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}}}},"controlPlane":{"description":"Kubernetes control-plane configuration.","type":"object","default":{},"required":["apiServer","controllerManager","konnectivity","replicas","scheduler"],"properties":{"apiServer":{"description":"API Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for API Server.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"controllerManager":{"description":"Controller Manager configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Controller Manager.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"konnectivity":{"description":"Konnectivity configuration.","type":"object","default":{},"required":["server"],"properties":{"server":{"description":"Konnectivity Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Konnectivity.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"replicas":{"description":"Number of control-plane replicas.","type":"integer","default":2},"scheduler":{"description":"Scheduler configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Scheduler.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"host":{"description":"External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.","type":"string","default":""},"nodeGroups":{"description":"Worker nodes configuration map.","type":"object","default":{"md0":{"ephemeralStorage":"20Gi","gpus":[],"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":["ingress-nginx"]}},"additionalProperties":{"type":"object","required":["ephemeralStorage","instanceType","maxReplicas","minReplicas","resources"],"properties":{"ephemeralStorage":{"description":"Ephemeral storage size.","default":"20Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"description":"Name of GPU, such as \"nvidia.com/AD102GL_L40S\".","type":"string"}}}},"instanceType":{"description":"Virtual machine instance type.","type":"string","default":"u1.medium"},"maxReplicas":{"description":"Maximum number of replicas.","type":"integer","default":10},"minReplicas":{"description":"Minimum number of replicas.","type":"integer","default":0},"resources":{"description":"CPU and memory resources for each worker node.","type":"object","properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"roles":{"description":"List of node roles.","type":"array","items":{"type":"string"}}}}},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"},"version":{"description":"Kubernetes major.minor version to deploy","type":"string","default":"v1.33","enum":["v1.33","v1.32","v1.31","v1.30","v1.29","v1.28"]}}}
+      {"title":"Chart Values","type":"object","properties":{"addons":{"description":"Cluster addons configuration.","type":"object","default":{},"required":["certManager","cilium","coredns","fluxcd","gatewayAPI","gpuOperator","ingressNginx","monitoringAgents","nfs","velero","verticalPodAutoscaler"],"properties":{"certManager":{"description":"Cert-manager addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable cert-manager.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"cilium":{"description":"Cilium CNI plugin.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"coredns":{"description":"CoreDNS addon.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"fluxcd":{"description":"FluxCD GitOps operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable FluxCD.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"gatewayAPI":{"description":"Gateway API addon.","type":"object","default":{},"required":["enabled"],"properties":{"enabled":{"description":"Enable Gateway API.","type":"boolean","default":false}}},"gpuOperator":{"description":"NVIDIA GPU Operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable GPU Operator.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"ingressNginx":{"description":"Ingress-NGINX controller.","type":"object","default":{},"required":["enabled","exposeMethod","valuesOverride"],"properties":{"enabled":{"description":"Enable the controller (requires nodes labeled `ingress-nginx`).","type":"boolean","default":false},"exposeMethod":{"description":"Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.","type":"string","default":"Proxied","enum":["Proxied","LoadBalancer"]},"hosts":{"description":"Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.","type":"array","default":[],"items":{"type":"string"}},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"monitoringAgents":{"description":"Monitoring agents.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable monitoring agents.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"nfs":{"description":"NFS CSI driver addon.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"velero":{"description":"Velero backup/restore addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable Velero.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"verticalPodAutoscaler":{"description":"Vertical Pod Autoscaler.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}}}},"controlPlane":{"description":"Kubernetes control-plane configuration.","type":"object","default":{},"required":["apiServer","controllerManager","konnectivity","replicas","scheduler"],"properties":{"apiServer":{"description":"API Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for API Server.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"controllerManager":{"description":"Controller Manager configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Controller Manager.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"konnectivity":{"description":"Konnectivity configuration.","type":"object","default":{},"required":["server"],"properties":{"server":{"description":"Konnectivity Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Konnectivity.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"replicas":{"description":"Number of control-plane replicas.","type":"integer","default":2},"scheduler":{"description":"Scheduler configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Scheduler.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"host":{"description":"External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.","type":"string","default":""},"nfs":{"description":"NFS configuration.","type":"object","default":{},"properties":{"instances":{"description":"List of NFS volume instances to connect. Each creates a StorageClass named `nfs-<name>` in the tenant cluster.","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"name":{"description":"Name of the NFS volume instance in the same namespace.","type":"string"}}}}}},"nodeGroups":{"description":"Worker nodes configuration map.","type":"object","default":{"md0":{"ephemeralStorage":"20Gi","gpus":[],"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":["ingress-nginx"]}},"additionalProperties":{"type":"object","required":["ephemeralStorage","instanceType","maxReplicas","minReplicas","resources"],"properties":{"ephemeralStorage":{"description":"Ephemeral storage size.","default":"20Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"description":"Name of GPU, such as \"nvidia.com/AD102GL_L40S\".","type":"string"}}}},"instanceType":{"description":"Virtual machine instance type.","type":"string","default":"u1.medium"},"maxReplicas":{"description":"Maximum number of replicas.","type":"integer","default":10},"minReplicas":{"description":"Minimum number of replicas.","type":"integer","default":0},"resources":{"description":"CPU and memory resources for each worker node.","type":"object","properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"roles":{"description":"List of node roles.","type":"array","items":{"type":"string"}}}}},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"},"version":{"description":"Kubernetes major.minor version to deploy","type":"string","default":"v1.33","enum":["v1.33","v1.32","v1.31","v1.30","v1.29","v1.28"]}}}
   release:
     prefix: kubernetes-
     labels:
@@ -26,7 +26,7 @@ spec:
     tags:
       - compute
     icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl82ODFfMjg0NSkiLz4KPHBhdGggZD0iTTcxLjk5NjggMTlDNzAuMzAzOSAxOS4wMDAyIDY4LjkzMTIgMjAuNTMyMiA2OC45MzE0IDIyLjQyMjFDNjguOTMxNCAyMi40NTExIDY4LjkzNzMgMjIuNDc4OCA2OC45Mzc5IDIyLjUwNzZDNjguOTM1NCAyMi43NjQ0IDY4LjkyMzEgMjMuMDczNyA2OC45MzE0IDIzLjI5NzNDNjguOTcxNyAyNC4zODczIDY5LjIwODIgMjUuMjIxNiA2OS4zNTA2IDI2LjIyNThDNjkuNjA4NCAyOC4zNzUyIDY5LjgyNDUgMzAuMTU2OSA2OS42OTEyIDMxLjgxM0M2OS41NjE1IDMyLjQzNzUgNjkuMTAzNyAzMy4wMDg2IDY4LjY5NTYgMzMuNDA1Nkw2OC42MjM1IDM0LjcwODZDNjYuNzgzOSAzNC44NjE3IDY0LjkzMTkgMzUuMTQyMSA2My4wODIxIDM1LjU2NDFDNTUuMTIyNiAzNy4zNzk4IDQ4LjI2OTUgNDEuNDk5MSA0My4wNTIgNDcuMDYwOUM0Mi43MTM0IDQ2LjgyODggNDIuMTIxMSA0Ni40MDE5IDQxLjk0NSA0Ni4yNzEyQzQxLjM5NzcgNDYuMzQ1NCA0MC44NDQ1IDQ2LjUxNTEgNDAuMTI0MSA0Ni4wOTM1QzM4Ljc1MjIgNDUuMTY1NyAzNy41MDI4IDQzLjg4NTEgMzUuOTkxIDQyLjM0MjRDMzUuMjk4MiA0MS42MDQ0IDM0Ljc5NjYgNDAuOTAxOCAzMy45NzM1IDQwLjE5MDRDMzMuNzg2NiA0MC4wMjg5IDMzLjUwMTQgMzkuODEwNCAzMy4yOTIzIDM5LjY0NDJDMzIuNjQ4OSAzOS4xMjg4IDMxLjg5IDM4Ljg2IDMxLjE1NyAzOC44MzQ4QzMwLjIxNDcgMzguODAyNCAyOS4zMDc1IDM5LjE3MjUgMjguNzEzOCAzOS45MjA2QzI3LjY1ODQgNDEuMjUwNiAyNy45OTYzIDQzLjI4MzMgMjkuNDY3MSA0NC40NjE0QzI5LjQ4MiA0NC40NzM0IDI5LjQ5NzkgNDQuNDgyNyAyOS41MTI5IDQ0LjQ5NDNDMjkuNzE1IDQ0LjY1ODkgMjkuOTYyNSA0NC44Njk4IDMwLjE0ODMgNDUuMDA3NkMzMS4wMjE3IDQ1LjY1NTUgMzEuODE5NSA0NS45ODcyIDMyLjY4OTcgNDYuNTAxNUMzNC41MjMxIDQ3LjYzOTEgMzYuMDQzIDQ4LjU4MjMgMzcuMjQ4NiA0OS43MTk2QzM3LjcxOTQgNTAuMjIzNyAzNy44MDE2IDUxLjExMjIgMzcuODY0MyA1MS40OTY0TDM4Ljg0NjggNTIuMzc4MkMzMy41ODcyIDYwLjMzMDggMzEuMTUzIDcwLjE1MzkgMzIuNTkxNSA4MC4xNjI3TDMxLjMwNzcgODAuNTM3OEMzMC45NjkzIDgwLjk3NjggMzAuNDkxMiA4MS42Njc2IDI5Ljk5MTEgODEuODczOEMyOC40MTM4IDgyLjM3MjkgMjYuNjM4NyA4Mi41NTYyIDI0LjQ5NTYgODIuNzgxOUMyMy40ODk0IDgyLjg2NiAyMi42MjEzIDgyLjgxNTggMjEuNTU0NiA4My4wMTg4QzIxLjMxOTggODMuMDYzNSAyMC45OTI3IDgzLjE0OTEgMjAuNzM1OCA4My4yMDk3QzIwLjcyNjkgODMuMjExNiAyMC43MTg2IDgzLjIxNDIgMjAuNzA5NiA4My4yMTYyQzIwLjY5NTYgODMuMjE5NSAyMC42NzcyIDgzLjIyNjMgMjAuNjYzOCA4My4yMjk0QzE4Ljg1NyA4My42NjggMTcuNjk2MyA4NS4zMzY1IDE4LjA2OTkgODYuOTgwNUMxOC40NDM3IDg4LjYyNDggMjAuMjA4NiA4OS42MjQ4IDIyLjAyNjIgODkuMjMxMkMyMi4wMzkzIDg5LjIyODIgMjIuMDU4NCA4OS4yMjc3IDIyLjA3MiA4OS4yMjQ2QzIyLjA5MjYgODkuMjE5OSAyMi4xMTA2IDg5LjIwOTkgMjIuMTMxIDg5LjIwNDlDMjIuMzg0NCA4OS4xNDkgMjIuNzAxOSA4OS4wODY4IDIyLjkyMzYgODkuMDI3MkMyMy45NzIzIDg4Ljc0NTEgMjQuNzMxOCA4OC4zMzA2IDI1LjY3NDYgODcuOTY3N0MyNy43MDI5IDg3LjIzNjggMjkuMzgyOCA4Ni42MjYyIDMxLjAxOTUgODYuMzg4M0MzMS43MDMgODYuMzM0NSAzMi40MjMyIDg2LjgxMiAzMi43ODE0IDg3LjAxMzRMMzQuMTE3NyA4Ni43ODMxQzM3LjE5MjYgOTYuMzYxMyA0My42MzY2IDEwNC4xMDMgNTEuNzk2MyAxMDguOTYxTDUxLjIzOTYgMTEwLjMwM0M1MS40NDAzIDExMC44MjQgNTEuNjYxNiAxMTEuNTMgNTEuNTEyMSAxMTIuMDQ1QzUwLjkxNzEgMTEzLjU5NSA0OS44OTggMTE1LjIzMSA0OC43Mzc0IDExNy4wNTVDNDguMTc1NSAxMTcuODk4IDQ3LjYwMDQgMTE4LjU1MiA0Ny4wOTM0IDExOS41MTZDNDYuOTcyIDExOS43NDcgNDYuODE3NSAxMjAuMTAyIDQ2LjcwMDQgMTIwLjM0NkM0NS45MTI1IDEyMi4wMzkgNDYuNDkwNCAxMjMuOTkgNDguMDAzOCAxMjQuNzIyQzQ5LjUyNjggMTI1LjQ1OSA1MS40MTcxIDEyNC42ODIgNTIuMjM1MiAxMjIuOTg1QzUyLjIzNjQgMTIyLjk4MiA1Mi4yNDA2IDEyMi45OCA1Mi4yNDE3IDEyMi45NzhDNTIuMjQyNiAxMjIuOTc2IDUyLjI0MDkgMTIyLjk3MyA1Mi4yNDE3IDEyMi45NzFDNTIuMzU4MiAxMjIuNzMxIDUyLjUyMzMgMTIyLjQxNSA1Mi42MjE2IDEyMi4xODhDNTMuMDU2IDEyMS4xODkgNTMuMjAwNSAxMjAuMzMyIDUzLjUwNTkgMTE5LjM2NUM1NC4zMTcgMTE3LjMxOCA1NC43NjI2IDExNS4xNyA1NS44NzkxIDExMy44MzJDNTYuMTg0OSAxMTMuNDY2IDU2LjY4MzMgMTEzLjMyNSA1Ny4yMDAxIDExMy4xODZMNTcuODk0NCAxMTEuOTIyQzY1LjAwOCAxMTQuNjY1IDcyLjk3MDUgMTE1LjQwMiA4MC45MjQ1IDExMy41ODdDODIuNzM5MSAxMTMuMTczIDg0LjQ5MDggMTEyLjYzNyA4Ni4xODQzIDExMS45OTRDODYuMzc5NCAxMTIuMzQyIDg2Ljc0MiAxMTMuMDExIDg2LjgzOTMgMTEzLjE3OUM4Ny4zNjQ0IDExMy4zNTEgODcuOTM3NyAxMTMuNDM5IDg4LjQwNDcgMTE0LjEzM0M4OS4yNDAxIDExNS41NjcgODkuODExNCAxMTcuMjYzIDkwLjUwNzMgMTE5LjMxMkM5MC44MTI4IDEyMC4yNzkgOTAuOTYzOCAxMjEuMTM2IDkxLjM5ODEgMTIyLjEzNkM5MS40OTcxIDEyMi4zNjMgOTEuNjYxNCAxMjIuNjg0IDkxLjc3OCAxMjIuOTI1QzkyLjU5NDQgMTI0LjYyOCA5NC40OTA3IDEyNS40MDcgOTYuMDE1OSAxMjQuNjY5Qzk3LjUyOTIgMTIzLjkzNyA5OC4xMDc3IDEyMS45ODYgOTcuMzE5NCAxMjAuMjkzQzk3LjIwMjMgMTIwLjA0OSA5Ny4wNDEyIDExOS42OTUgOTYuOTE5OCAxMTkuNDY0Qzk2LjQxMjcgMTE4LjQ5OSA5NS44Mzc3IDExNy44NTIgOTUuMjc1OCAxMTcuMDA5Qzk0LjExNTIgMTE1LjE4NSA5My4xNTI2IDExMy42NyA5Mi41NTc1IDExMi4xMkM5Mi4zMDg3IDExMS4zMiA5Mi41OTk1IDExMC44MjMgOTIuNzkzMyAxMTAuMzAzQzkyLjY3NzIgMTEwLjE3IDkyLjQyODggMTA5LjQxNCA5Mi4yODI0IDEwOS4wNTlDMTAwLjc2MiAxMDQuMDI5IDEwNy4wMTcgOTUuOTk4NSAxMDkuOTU1IDg2LjcyMzlDMTEwLjM1MSA4Ni43ODY1IDExMS4wNDEgODYuOTA5MSAxMTEuMjY1IDg2Ljk1NDJDMTExLjcyNiA4Ni42NDg3IDExMi4xNDkgODYuMjUwMSAxMTIuOTgxIDg2LjMxNTlDMTE0LjYxNyA4Ni41NTM3IDExNi4yOTcgODcuMTY0NSAxMTguMzI2IDg3Ljg5NTNDMTE5LjI2OCA4OC4yNTgxIDEyMC4wMjggODguNjc5MyAxMjEuMDc3IDg4Ljk2MTRDMTIxLjI5OCA4OS4wMjEgMTIxLjYxNiA4OS4wNzY2IDEyMS44NjkgODkuMTMyNUMxMjEuODg5IDg5LjEzNzUgMTIxLjkwOCA4OS4xNDc1IDEyMS45MjggODkuMTUyMkMxMjEuOTQyIDg5LjE1NTMgMTIxLjk2MSA4OS4xNTU4IDEyMS45NzQgODkuMTU4OEMxMjMuNzkyIDg5LjU1MiAxMjUuNTU3IDg4LjU1MjYgMTI1LjkzIDg2LjkwODFDMTI2LjMwMyA4NS4yNjQxIDEyNS4xNDMgODMuNTk1MiAxMjMuMzM2IDgzLjE1N0MxMjMuMDc0IDgzLjA5NyAxMjIuNzAxIDgyLjk5NSAxMjIuNDQ2IDgyLjk0NjVDMTIxLjM3OSA4Mi43NDM1IDEyMC41MTEgODIuNzkzNSAxMTkuNTA1IDgyLjcwOTVDMTE3LjM2MSA4Mi40ODM5IDExNS41ODYgODIuMzAwNCAxMTQuMDA5IDgxLjgwMTRDMTEzLjM2NiA4MS41NTA3IDExMi45MDggODAuNzgxOSAxMTIuNjg2IDgwLjQ2NTVMMTExLjQ0OCA4MC4xMDM1QzExMi4wOSA3NS40MzggMTExLjkxNyA3MC41ODI1IDExMC44MDYgNjUuNzI0M0MxMDkuNjg1IDYwLjgyMDggMTA3LjcwNCA1Ni4zMzYxIDEwNS4wNjIgNTIuMzg0OEMxMDUuMzc5IDUyLjA5NDggMTA1Ljk3OSA1MS41NjEyIDEwNi4xNDkgNTEuNDA0M0MxMDYuMTk5IDUwLjg1MTcgMTA2LjE1NiA1MC4yNzIyIDEwNi43MjUgNDkuNjYwM0MxMDcuOTMxIDQ4LjUyMyAxMDkuNDUxIDQ3LjU3OTkgMTExLjI4NCA0Ni40NDIzQzExMi4xNTQgNDUuOTI3OSAxMTIuOTU5IDQ1LjU5NjQgMTEzLjgzMiA0NC45NDg0QzExNC4wMyA0NC44MDE5IDExNC4yOTkgNDQuNTY5OSAxMTQuNTA3IDQ0LjQwMjJDMTE1Ljk3NyA0My4yMjM3IDExNi4zMTYgNDEuMTkxMSAxMTUuMjYgMzkuODYxNEMxMTQuMjA0IDM4LjUzMTcgMTEyLjE1OSAzOC40MDY1IDExMC42ODggMzkuNTg1QzExMC40NzkgMzkuNzUxNiAxMTAuMTk1IDM5Ljk2ODggMTEwLjAwNyA0MC4xMzEyQzEwOS4xODQgNDAuODQyNiAxMDguNjc2IDQxLjU0NTIgMTA3Ljk4MyA0Mi4yODMyQzEwNi40NzEgNDMuODI1OSAxMDUuMjIyIDQ1LjExMyAxMDMuODUgNDYuMDQwOUMxMDMuMjU1IDQ2LjM4ODUgMTAyLjM4NSA0Ni4yNjgyIDEwMS45OSA0Ni4yNDQ5TDEwMC44MjQgNDcuMDgwNkM5NC4xNzUzIDQwLjA3NjMgODUuMTIzNSAzNS41OTgyIDc1LjM3NjYgMzQuNzI4M0M3NS4zNDk0IDM0LjMxNzkgNzUuMzEzNyAzMy41NzYxIDc1LjMwNDYgMzMuMzUyOUM3NC45MDU2IDMyLjk2OTMgNzQuNDIzNSAzMi42NDE4IDc0LjMwMjQgMzEuODEzQzc0LjE2OTEgMzAuMTU2OSA3NC4zOTE3IDI4LjM3NTIgNzQuNjQ5NiAyNi4yMjU4Qzc0Ljc5MTkgMjUuMjIxNiA3NS4wMjg0IDI0LjM4NzMgNzUuMDY4OCAyMy4yOTczQzc1LjA3OCAyMy4wNDk1IDc1LjA2MzIgMjIuNjkgNzUuMDYyMiAyMi40MjIxQzc1LjA2MiAyMC41MzIyIDczLjY4OTggMTguOTk5OCA3MS45OTY4IDE5Wk02OC4xNTg1IDQyLjg4ODZMNjcuMjQ4IDU5LjA0NDdMNjcuMTgyNSA1OS4wNzc2QzY3LjEyMTQgNjAuNTIyOSA2NS45Mzc1IDYxLjY3NyA2NC40ODM5IDYxLjY3N0M2My44ODg0IDYxLjY3NyA2My4zMzg4IDYxLjQ4NDkgNjIuODkyMiA2MS4xNTcxTDYyLjg2NiA2MS4xNzAzTDQ5LjY4MDcgNTEuNzc5NEM1My43MzMxIDQ3Ljc3NTkgNTguOTE2NCA0NC44MTcyIDY0Ljg5IDQzLjQ1NDZDNjUuOTgxMiA0My4yMDU2IDY3LjA3MTkgNDMuMDIwOSA2OC4xNTg1IDQyLjg4ODZaTTc1Ljg0MTcgNDIuODg4NkM4Mi44MTU5IDQzLjc1MDQgODkuMjY1NyA0Ni45MjMyIDk0LjIwODEgNTEuNzg2TDgxLjEwOCA2MS4xMTc2TDgxLjA2MjEgNjEuMDk3OUM3OS44OTk0IDYxLjk1MTIgNzguMjYxMSA2MS43Mzk0IDc3LjM1NDggNjAuNTk3OEM3Ni45ODM1IDYwLjEzMDEgNzYuNzg4NyA1OS41ODAxIDc2Ljc2NTMgNTkuMDI0OUw3Ni43NTIyIDU5LjAxODRMNzUuODQxNyA0Mi44ODg2Wk00NC44OTkxIDU3LjgxNEw1Ni45MzgyIDY4LjYzM0w1Ni45MjUxIDY4LjY5ODhDNTguMDExNyA2OS42NDc5IDU4LjE3MiA3MS4yOTQ5IDU3LjI2NTcgNzIuNDM2OEM1Ni44OTQ0IDcyLjkwNDUgNTYuMzk3NSA3My4yMTgyIDU1Ljg2MzkgNzMuMzY0N0w1NS44NTA4IDczLjQxNzNMNDAuNDE4OCA3Ny44OTIzQzM5LjYzMzQgNzAuNjc2NSA0MS4zMjYxIDYzLjY2MjEgNDQuODk5MSA1Ny44MTRaTTk5LjAwOTQgNTcuODIwNkMxMDAuNzk4IDYwLjczMzYgMTAyLjE1MyA2My45ODcxIDEwMi45NTkgNjcuNTE0M0MxMDMuNzU2IDcwLjk5OTEgMTAzLjk1NiA3NC40Nzc4IDEwMy42MjcgNzcuODM5N0w4OC4xMTY2IDczLjM1MTVMODguMTAzNSA3My4yODU3Qzg2LjcxNDUgNzIuOTA0MyA4NS44NjA5IDcxLjQ4NDggODYuMTg0MyA3MC4wNjExQzg2LjMxNjggNjkuNDc3OCA4Ni42MjQ5IDY4Ljk4NDQgODcuMDQyMyA2OC42MTk4TDg3LjAzNTggNjguNTg2OUw5OS4wMDk0IDU3LjgyMDZaTTY5LjUyNzQgNjkuNDY4OEg3NC40NTk2TDc3LjUyNTEgNzMuMzE4Nkw3Ni40MjQ3IDc4LjEyMjZMNzEuOTk2OCA4MC4yNjE0TDY3LjU1NTggNzguMTE2MUw2Ni40NTU0IDczLjMxMkw2OS41Mjc0IDY5LjQ2ODhaTTg1LjMzOTMgODIuNjQzN0M4NS41NDg5IDgyLjYzMzEgODUuNzU3NiA4Mi42NTIgODUuOTYxNiA4Mi42ODk4TDg1Ljk4NzggODIuNjU2OUwxMDEuOTUgODUuMzY4MkM5OS42MTQyIDkxLjk2MjQgOTUuMTQ0IDk3LjY3NSA4OS4xNzExIDEwMS40OThMODIuOTc0NyA4Ni40NjA2TDgyLjk5NDQgODYuNDM0M0M4Mi40MjUyIDg1LjEwNTUgODIuOTk0OCA4My41NDcyIDg0LjMwNDQgODIuOTEzNUM4NC42Mzk3IDgyLjc1MTMgODQuOTkgODIuNjYxNCA4NS4zMzkzIDgyLjY0MzdaTTU4LjUyOTggODIuNzA5NUM1OS43NDggODIuNzI2NyA2MC44NDA2IDgzLjU3NjEgNjEuMTIzNyA4NC44MjJDNjEuMjU2MiA4NS40MDUyIDYxLjE5MTcgODUuOTgzMSA2MC45NzMgODYuNDkzNUw2MS4wMTg5IDg2LjU1MjdMNTQuODg4IDEwMS40MzlDNDkuMTU1OSA5Ny43NDMyIDQ0LjU5MDQgOTIuMjA5OSA0Mi4xNDgxIDg1LjQyMDhMNTcuOTczMSA4Mi43MjI3TDU3Ljk5OTMgODIuNzU1NkM1OC4xNzYzIDgyLjcyMjkgNTguMzU1OCA4Mi43MDcxIDU4LjUyOTggODIuNzA5NVpNNzEuODk4NiA4OS4yMzEyQzcyLjMyMjkgODkuMjE1NSA3Mi43NTM0IDg5LjMwMyA3My4xNjI3IDg5LjUwMUM3My42OTkyIDg5Ljc2MDYgNzQuMTEzNiA5MC4xNjkyIDc0LjM3NDUgOTAuNjU5Mkg3NC40MzM0TDgyLjIzNDYgMTA0LjgyMUM4MS4yMjIxIDEwNS4xNjIgODAuMTgxMyAxMDUuNDU0IDc5LjExNjcgMTA1LjY5N0M3My4xNTA1IDEwNy4wNTggNjcuMjAzMiAxMDYuNjQ1IDYxLjgxOCAxMDQuODAyTDY5LjU5OTUgOTAuNjY1OEg2OS42MTI2QzcwLjA3OTUgODkuNzg4OCA3MC45NjUgODkuMjY1NiA3MS44OTg2IDg5LjIzMTJaIiBmaWxsPSJ3aGl0ZSIgc3Ryb2tlPSJ3aGl0ZSIgc3Ryb2tlLXdpZHRoPSIwLjI1Ii8+CjxkZWZzPgo8bGluZWFyR3JhZGllbnQgaWQ9InBhaW50MF9saW5lYXJfNjgxXzI4NDUiIHgxPSIxMCIgeTE9IjE1LjUiIHgyPSIxNDQiIHkyPSIxMzEuNSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPgo8c3RvcCBzdG9wLWNvbG9yPSIjNEQ4N0ZGIi8+CjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iIzA1NDdEMCIvPgo8L2xpbmVhckdyYWRpZW50Pgo8L2RlZnM+Cjwvc3ZnPgo=
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "storageClass"], ["spec", "nodeGroups"], ["spec", "nodeGroups", "md0"], ["spec", "nodeGroups", "md0", "minReplicas"], ["spec", "nodeGroups", "md0", "maxReplicas"], ["spec", "nodeGroups", "md0", "instanceType"], ["spec", "nodeGroups", "md0", "ephemeralStorage"], ["spec", "nodeGroups", "md0", "roles"], ["spec", "nodeGroups", "md0", "resources"], ["spec", "nodeGroups", "md0", "gpus"], ["spec", "version"], ["spec", "host"], ["spec", "addons"], ["spec", "addons", "certManager"], ["spec", "addons", "certManager", "enabled"], ["spec", "addons", "certManager", "valuesOverride"], ["spec", "addons", "cilium"], ["spec", "addons", "cilium", "valuesOverride"], ["spec", "addons", "gatewayAPI"], ["spec", "addons", "gatewayAPI", "enabled"], ["spec", "addons", "ingressNginx"], ["spec", "addons", "ingressNginx", "enabled"], ["spec", "addons", "ingressNginx", "exposeMethod"], ["spec", "addons", "ingressNginx", "hosts"], ["spec", "addons", "ingressNginx", "valuesOverride"], ["spec", "addons", "gpuOperator"], ["spec", "addons", "gpuOperator", "enabled"], ["spec", "addons", "gpuOperator", "valuesOverride"], ["spec", "addons", "fluxcd"], ["spec", "addons", "fluxcd", "enabled"], ["spec", "addons", "fluxcd", "valuesOverride"], ["spec", "addons", "monitoringAgents"], ["spec", "addons", "monitoringAgents", "enabled"], ["spec", "addons", "monitoringAgents", "valuesOverride"], ["spec", "addons", "verticalPodAutoscaler"], ["spec", "addons", "verticalPodAutoscaler", "valuesOverride"], ["spec", "addons", "velero"], ["spec", "addons", "velero", "enabled"], ["spec", "addons", "velero", "valuesOverride"], ["spec", "addons", "coredns"], ["spec", "addons", "coredns", "valuesOverride"], ["spec", "controlPlane"], ["spec", "controlPlane", "replicas"], ["spec", "controlPlane", "apiServer"], ["spec", "controlPlane", "apiServer", "resources"], ["spec", "controlPlane", "apiServer", "resourcesPreset"], ["spec", "controlPlane", "controllerManager"], ["spec", "controlPlane", "controllerManager", "resources"], ["spec", "controlPlane", "controllerManager", "resourcesPreset"], ["spec", "controlPlane", "scheduler"], ["spec", "controlPlane", "scheduler", "resources"], ["spec", "controlPlane", "scheduler", "resourcesPreset"], ["spec", "controlPlane", "konnectivity"], ["spec", "controlPlane", "konnectivity", "server"], ["spec", "controlPlane", "konnectivity", "server", "resources"], ["spec", "controlPlane", "konnectivity", "server", "resourcesPreset"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "storageClass"], ["spec", "nodeGroups"], ["spec", "nodeGroups", "md0"], ["spec", "nodeGroups", "md0", "minReplicas"], ["spec", "nodeGroups", "md0", "maxReplicas"], ["spec", "nodeGroups", "md0", "instanceType"], ["spec", "nodeGroups", "md0", "ephemeralStorage"], ["spec", "nodeGroups", "md0", "roles"], ["spec", "nodeGroups", "md0", "resources"], ["spec", "nodeGroups", "md0", "gpus"], ["spec", "version"], ["spec", "host"], ["spec", "nfs"], ["spec", "nfs", "instances"], ["spec", "addons"], ["spec", "addons", "certManager"], ["spec", "addons", "certManager", "enabled"], ["spec", "addons", "certManager", "valuesOverride"], ["spec", "addons", "cilium"], ["spec", "addons", "cilium", "valuesOverride"], ["spec", "addons", "gatewayAPI"], ["spec", "addons", "gatewayAPI", "enabled"], ["spec", "addons", "ingressNginx"], ["spec", "addons", "ingressNginx", "enabled"], ["spec", "addons", "ingressNginx", "exposeMethod"], ["spec", "addons", "ingressNginx", "hosts"], ["spec", "addons", "ingressNginx", "valuesOverride"], ["spec", "addons", "gpuOperator"], ["spec", "addons", "gpuOperator", "enabled"], ["spec", "addons", "gpuOperator", "valuesOverride"], ["spec", "addons", "fluxcd"], ["spec", "addons", "fluxcd", "enabled"], ["spec", "addons", "fluxcd", "valuesOverride"], ["spec", "addons", "monitoringAgents"], ["spec", "addons", "monitoringAgents", "enabled"], ["spec", "addons", "monitoringAgents", "valuesOverride"], ["spec", "addons", "verticalPodAutoscaler"], ["spec", "addons", "verticalPodAutoscaler", "valuesOverride"], ["spec", "addons", "velero"], ["spec", "addons", "velero", "enabled"], ["spec", "addons", "velero", "valuesOverride"], ["spec", "addons", "coredns"], ["spec", "addons", "coredns", "valuesOverride"], ["spec", "addons", "nfs"], ["spec", "addons", "nfs", "valuesOverride"], ["spec", "controlPlane"], ["spec", "controlPlane", "replicas"], ["spec", "controlPlane", "apiServer"], ["spec", "controlPlane", "apiServer", "resources"], ["spec", "controlPlane", "apiServer", "resourcesPreset"], ["spec", "controlPlane", "controllerManager"], ["spec", "controlPlane", "controllerManager", "resources"], ["spec", "controlPlane", "controllerManager", "resourcesPreset"], ["spec", "controlPlane", "scheduler"], ["spec", "controlPlane", "scheduler", "resources"], ["spec", "controlPlane", "scheduler", "resourcesPreset"], ["spec", "controlPlane", "konnectivity"], ["spec", "controlPlane", "konnectivity", "server"], ["spec", "controlPlane", "konnectivity", "server", "resources"], ["spec", "controlPlane", "konnectivity", "server", "resourcesPreset"]]
   secrets:
     exclude: []
     include:
diff --git a/packages/system/nfs-driver/Makefile b/packages/system/nfs-driver/Makefile
index 2f14aa28..6cf799f5 100644
--- a/packages/system/nfs-driver/Makefile
+++ b/packages/system/nfs-driver/Makefile
@@ -4,6 +4,9 @@ export NAMESPACE=cozy-$(NAME)
 include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
+test:
+	helm unittest .
+
 update:
 	rm -rf charts
 	helm repo add csi-driver-nfs https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
diff --git a/packages/system/nfs-driver/templates/extra-storageclasses.yaml b/packages/system/nfs-driver/templates/extra-storageclasses.yaml
new file mode 100644
index 00000000..f627a474
--- /dev/null
+++ b/packages/system/nfs-driver/templates/extra-storageclasses.yaml
@@ -0,0 +1,18 @@
+{{- range .Values.extraStorageClasses }}
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: {{ .name }}
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: {{ .server | quote }}
+  share: {{ .share | quote }}
+reclaimPolicy: Delete
+volumeBindingMode: Immediate
+allowVolumeExpansion: true
+{{- with .mountOptions }}
+mountOptions:
+{{- toYaml . | nindent 2 }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/nfs-driver/tests/extra-storageclasses_test.yaml b/packages/system/nfs-driver/tests/extra-storageclasses_test.yaml
new file mode 100644
index 00000000..6009c761
--- /dev/null
+++ b/packages/system/nfs-driver/tests/extra-storageclasses_test.yaml
@@ -0,0 +1,133 @@
+suite: Extra StorageClasses tests
+
+templates:
+  - templates/extra-storageclasses.yaml
+
+tests:
+  - it: renders nothing when extraStorageClasses is empty
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: creates one StorageClass per entry
+    set:
+      extraStorageClasses:
+        - name: nfs-data
+          server: "10.96.1.1"
+          share: "/"
+          mountOptions:
+            - nfsvers=4.1
+        - name: nfs-backup
+          server: "10.96.2.2"
+          share: "/"
+          mountOptions:
+            - nfsvers=4.1
+    asserts:
+      - hasDocuments:
+          count: 2
+
+  - it: sets correct provisioner
+    set:
+      extraStorageClasses:
+        - name: nfs-test
+          server: "10.96.1.1"
+          share: "/"
+          mountOptions:
+            - nfsvers=4.1
+    asserts:
+      - equal:
+          path: provisioner
+          value: nfs.csi.k8s.io
+
+  - it: sets server and share parameters
+    set:
+      extraStorageClasses:
+        - name: nfs-mydata
+          server: "10.96.50.100"
+          share: "/exports"
+          mountOptions:
+            - nfsvers=4.1
+    asserts:
+      - equal:
+          path: metadata.name
+          value: nfs-mydata
+      - equal:
+          path: parameters.server
+          value: "10.96.50.100"
+      - equal:
+          path: parameters.share
+          value: "/exports"
+
+  - it: sets mount options
+    set:
+      extraStorageClasses:
+        - name: nfs-test
+          server: "10.96.1.1"
+          share: "/"
+          mountOptions:
+            - nfsvers=4.1
+    asserts:
+      - equal:
+          path: mountOptions[0]
+          value: nfsvers=4.1
+
+  - it: allows volume expansion
+    set:
+      extraStorageClasses:
+        - name: nfs-test
+          server: "10.96.1.1"
+          share: "/"
+          mountOptions:
+            - nfsvers=4.1
+    asserts:
+      - equal:
+          path: allowVolumeExpansion
+          value: true
+
+  - it: uses Delete reclaim policy
+    set:
+      extraStorageClasses:
+        - name: nfs-test
+          server: "10.96.1.1"
+          share: "/"
+          mountOptions:
+            - nfsvers=4.1
+    asserts:
+      - equal:
+          path: reclaimPolicy
+          value: Delete
+
+  - it: creates distinct StorageClasses for multiple shares
+    set:
+      extraStorageClasses:
+        - name: nfs-alpha
+          server: "10.96.10.1"
+          share: "/"
+          mountOptions:
+            - nfsvers=4.1
+        - name: nfs-beta
+          server: "10.96.20.2"
+          share: "/data"
+          mountOptions:
+            - nfsvers=4.1
+    asserts:
+      - equal:
+          path: metadata.name
+          value: nfs-alpha
+        documentIndex: 0
+      - equal:
+          path: parameters.server
+          value: "10.96.10.1"
+        documentIndex: 0
+      - equal:
+          path: metadata.name
+          value: nfs-beta
+        documentIndex: 1
+      - equal:
+          path: parameters.server
+          value: "10.96.20.2"
+        documentIndex: 1
+      - equal:
+          path: parameters.share
+          value: "/data"
+        documentIndex: 1
diff --git a/packages/system/nfs-driver/values.yaml b/packages/system/nfs-driver/values.yaml
index 856e67be..eb1f99f0 100644
--- a/packages/system/nfs-driver/values.yaml
+++ b/packages/system/nfs-driver/values.yaml
@@ -1 +1,3 @@
 csi-driver-nfs: {}
+
+extraStorageClasses: []
diff --git a/packages/system/nfs-rd/Chart.yaml b/packages/system/nfs-rd/Chart.yaml
new file mode 100644
index 00000000..20c4e272
--- /dev/null
+++ b/packages/system/nfs-rd/Chart.yaml
@@ -0,0 +1,3 @@
+apiVersion: v2
+name: nfs-rd
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
diff --git a/packages/system/nfs-rd/Makefile b/packages/system/nfs-rd/Makefile
new file mode 100644
index 00000000..058bec71
--- /dev/null
+++ b/packages/system/nfs-rd/Makefile
@@ -0,0 +1,4 @@
+export NAME=nfs-rd
+export NAMESPACE=cozy-system
+
+include ../../../hack/package.mk
diff --git a/packages/system/nfs-rd/cozyrds/nfs.yaml b/packages/system/nfs-rd/cozyrds/nfs.yaml
new file mode 100644
index 00000000..125401e6
--- /dev/null
+++ b/packages/system/nfs-rd/cozyrds/nfs.yaml
@@ -0,0 +1,21 @@
+apiVersion: cozystack.io/v1alpha1
+kind: ApplicationDefinition
+metadata:
+  name: nfs
+spec:
+  application:
+    kind: NFS
+    plural: nfs
+    openAPISchema: |-
+      {"title":"Chart Values","type":"object","properties":{"size":{"description":"Volume size for NFS storage.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"}}}
+  release:
+    prefix: nfs-
+    chartRef:
+      kind: ExternalArtifact
+      name: cozystack-nfs-application-default-nfs
+      namespace: cozy-system
+  dashboard:
+    description: Managed NFS storage
+    plural: NFS
+    icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcikiLz4KPHBhdGggZD0iTTM2IDU4VjEwNEMzNiAxMDcuMzE0IDM4LjY4NjMgMTEwIDQyIDExMEgxMDJDMTA1LjMxNCAxMTAgMTA4IDEwNy4zMTQgMTA4IDEwNFY1MkMxMDggNDguNjg2MyAxMDUuMzE0IDQ2IDEwMiA0Nkg3MEw2MiAzNEg0MkMzOC42ODYzIDM0IDM2IDM2LjY4NjMgMzYgNDBWNThaIiBmaWxsPSIjMTU2NUMwIi8+CjxwYXRoIGQ9Ik0zMCA2MkMzMCA1OC42ODYzIDMyLjY4NjMgNTYgMzYgNTZIMTA4QzExMS4zMTQgNTYgMTE0IDU4LjY4NjMgMTE0IDYyVjEwNEMxMTQgMTA3LjMxNCAxMTEuMzE0IDExMCAxMDggMTEwSDM2QzMyLjY4NjMgMTEwIDMwIDEwNy4zMTQgMzAgMTA0VjYyWiIgZmlsbD0iIzQyQTVGNSIvPgo8cGF0aCBkPSJNNjMgNzZWOTRNNjMgNzZMNTQgODVNNjMgNzZMNzIgODUiIHN0cm9rZT0id2hpdGUiIHN0cm9rZS13aWR0aD0iNCIgc3Ryb2tlLWxpbmVjYXA9InJvdW5kIiBzdHJva2UtbGluZWpvaW49InJvdW5kIi8+CjxwYXRoIGQ9Ik04MSA5NFY3Nk04MSA5NEw5MCA4NU04MSA5NEw3MiA4NSIgc3Ryb2tlPSJ3aGl0ZSIgc3Ryb2tlLXdpZHRoPSI0IiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiLz4KPGRlZnM+CjxsaW5lYXJHcmFkaWVudCBpZD0icGFpbnQwX2xpbmVhciIgeDE9IjAiIHkxPSIwIiB4Mj0iMTQ0IiB5Mj0iMTQ0IiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+CjxzdG9wIHN0b3AtY29sb3I9IiNFM0YyRkQiLz4KPHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjNjRCNUY2Ii8+CjwvbGluZWFyR3JhZGllbnQ+CjwvZGVmcz4KPC9zdmc+Cg==
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "storageClass"], ["spec", "size"]]
diff --git a/packages/system/nfs-rd/templates/cozyrd.yaml b/packages/system/nfs-rd/templates/cozyrd.yaml
new file mode 100644
index 00000000..e079ddcf
--- /dev/null
+++ b/packages/system/nfs-rd/templates/cozyrd.yaml
@@ -0,0 +1,4 @@
+{{- range $path, $_ := .Files.Glob "cozyrds/*" }}
+---
+{{ $.Files.Get $path }}
+{{- end }}
diff --git a/packages/system/nfs-rd/values.yaml b/packages/system/nfs-rd/values.yaml
new file mode 100644
index 00000000..0967ef42
--- /dev/null
+++ b/packages/system/nfs-rd/values.yaml
@@ -0,0 +1 @@
+{}
diff --git a/packages/system/nfs/.helmignore b/packages/system/nfs/.helmignore
new file mode 100644
index 00000000..481ff39c
--- /dev/null
+++ b/packages/system/nfs/.helmignore
@@ -0,0 +1,2 @@
+logos/
+hack/
diff --git a/packages/system/nfs/Chart.yaml b/packages/system/nfs/Chart.yaml
new file mode 100644
index 00000000..fed4e8ae
--- /dev/null
+++ b/packages/system/nfs/Chart.yaml
@@ -0,0 +1,3 @@
+apiVersion: v2
+name: cozy-nfs
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
diff --git a/packages/system/nfs/Makefile b/packages/system/nfs/Makefile
new file mode 100644
index 00000000..194a6fa4
--- /dev/null
+++ b/packages/system/nfs/Makefile
@@ -0,0 +1,3 @@
+export NAME=nfs-system
+
+include ../../../hack/package.mk
diff --git a/packages/system/nfs/templates/cilium-policy.yaml b/packages/system/nfs/templates/cilium-policy.yaml
new file mode 100644
index 00000000..93008d07
--- /dev/null
+++ b/packages/system/nfs/templates/cilium-policy.yaml
@@ -0,0 +1,20 @@
+{{- $pvc := lookup "v1" "PersistentVolumeClaim" .Release.Namespace .Values.pvcName }}
+{{- $pv := lookup "v1" "PersistentVolume" "" $pvc.spec.volumeName }}
+{{- $nfsExport := index $pv.spec.csi.volumeAttributes "linstor.csi.linbit.com/nfs-export" }}
+{{- $parsed := urlParse $nfsExport }}
+{{- $port := last (splitList ":" $parsed.host) }}
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-nfs-{{ .Values.pvcName }}
+spec:
+  endpointSelector: {}
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        k8s:app.kubernetes.io/component: linstor-csi-nfs-server
+        k8s:io.kubernetes.pod.namespace: cozy-linstor
+    toPorts:
+    - ports:
+      - port: "{{ $port }}"
+        protocol: TCP
diff --git a/packages/system/nfs/values.yaml b/packages/system/nfs/values.yaml
new file mode 100644
index 00000000..b405be18
--- /dev/null
+++ b/packages/system/nfs/values.yaml
@@ -0,0 +1 @@
+pvcName: ""

From 053481f248b443e0791489558056a957581f1c1f Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 12 Feb 2026 15:55:24 +0100
Subject: [PATCH 021/666] fix(nfs): add required fields to
 ApplicationDefinition and include in IaaS bundle

Add missing required fields (singular, category) to NFS ApplicationDefinition
and add nfs-application to the IaaS bundle.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/core/platform/templates/bundles/iaas.yaml | 1 +
 packages/system/nfs-rd/cozyrds/nfs.yaml            | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/packages/core/platform/templates/bundles/iaas.yaml b/packages/core/platform/templates/bundles/iaas.yaml
index 7c856b8c..8ee5d101 100644
--- a/packages/core/platform/templates/bundles/iaas.yaml
+++ b/packages/core/platform/templates/bundles/iaas.yaml
@@ -12,6 +12,7 @@
 {{include "cozystack.platform.package.default" (list "cozystack.capi-provider-cp-kamaji" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.capi-provider-infra-kubevirt" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.bucket-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.nfs-application" $) }}
 {{include "cozystack.platform.package" (list "cozystack.kubernetes-application" "kubevirt" $) }}
 {{include "cozystack.platform.package" (list "cozystack.virtual-machine-application" "kubevirt" $) }}
 {{include "cozystack.platform.package" (list "cozystack.virtualprivatecloud-application" "kubevirt" $) }}
diff --git a/packages/system/nfs-rd/cozyrds/nfs.yaml b/packages/system/nfs-rd/cozyrds/nfs.yaml
index 125401e6..9a51f6af 100644
--- a/packages/system/nfs-rd/cozyrds/nfs.yaml
+++ b/packages/system/nfs-rd/cozyrds/nfs.yaml
@@ -5,6 +5,7 @@ metadata:
 spec:
   application:
     kind: NFS
+    singular: nfs
     plural: nfs
     openAPISchema: |-
       {"title":"Chart Values","type":"object","properties":{"size":{"description":"Volume size for NFS storage.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"}}}
@@ -15,6 +16,8 @@ spec:
       name: cozystack-nfs-application-default-nfs
       namespace: cozy-system
   dashboard:
+    category: IaaS
+    singular: NFS
     description: Managed NFS storage
     plural: NFS
     icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcikiLz4KPHBhdGggZD0iTTM2IDU4VjEwNEMzNiAxMDcuMzE0IDM4LjY4NjMgMTEwIDQyIDExMEgxMDJDMTA1LjMxNCAxMTAgMTA4IDEwNy4zMTQgMTA4IDEwNFY1MkMxMDggNDguNjg2MyAxMDUuMzE0IDQ2IDEwMiA0Nkg3MEw2MiAzNEg0MkMzOC42ODYzIDM0IDM2IDM2LjY4NjMgMzYgNDBWNThaIiBmaWxsPSIjMTU2NUMwIi8+CjxwYXRoIGQ9Ik0zMCA2MkMzMCA1OC42ODYzIDMyLjY4NjMgNTYgMzYgNTZIMTA4QzExMS4zMTQgNTYgMTE0IDU4LjY4NjMgMTE0IDYyVjEwNEMxMTQgMTA3LjMxNCAxMTEuMzE0IDExMCAxMDggMTEwSDM2QzMyLjY4NjMgMTEwIDMwIDEwNy4zMTQgMzAgMTA0VjYyWiIgZmlsbD0iIzQyQTVGNSIvPgo8cGF0aCBkPSJNNjMgNzZWOTRNNjMgNzZMNTQgODVNNjMgNzZMNzIgODUiIHN0cm9rZT0id2hpdGUiIHN0cm9rZS13aWR0aD0iNCIgc3Ryb2tlLWxpbmVjYXA9InJvdW5kIiBzdHJva2UtbGluZWpvaW49InJvdW5kIi8+CjxwYXRoIGQ9Ik04MSA5NFY3Nk04MSA5NEw5MCA4NU04MSA5NEw3MiA4NSIgc3Ryb2tlPSJ3aGl0ZSIgc3Ryb2tlLXdpZHRoPSI0IiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiLz4KPGRlZnM+CjxsaW5lYXJHcmFkaWVudCBpZD0icGFpbnQwX2xpbmVhciIgeDE9IjAiIHkxPSIwIiB4Mj0iMTQ0IiB5Mj0iMTQ0IiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+CjxzdG9wIHN0b3AtY29sb3I9IiNFM0YyRkQiLz4KPHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjNjRCNUY2Ii8+CjwvbGluZWFyR3JhZGllbnQ+CjwvZGVmcz4KPC9zdmc+Cg==

From a628adeb35826ff292ecd0eeefbf8f0c0b16e493 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 12 Feb 2026 17:18:14 +0100
Subject: [PATCH 022/666] [platform] Switch cozystack-api from DaemonSet to
 Deployment with PreferClose

Replace DaemonSet with direct host API access in favor of a regular
Deployment using Service trafficDistribution: PreferClose. This provides
prefer-local routing to the nearest cozystack-api pod with fallback
to remote pods when local one is unavailable.

- Replace DaemonSet/Deployment toggle with always-Deployment
- Replace internalTrafficPolicy: Local with trafficDistribution: PreferClose
- Remove KUBERNETES_SERVICE_HOST/PORT override (use default kubernetes service)
- Replace hard nodeSelector with soft nodeAffinity for control-plane nodes
- Simplify migration hook to always clean up DaemonSet if present

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../cozystack-api/templates/deployment.yaml   | 30 +++++--------------
 .../system/cozystack-api/templates/hook.yaml  | 17 ++---------
 .../cozystack-api/templates/service.yaml      |  4 +--
 packages/system/cozystack-api/values.yaml     |  7 -----
 4 files changed, 12 insertions(+), 46 deletions(-)

diff --git a/packages/system/cozystack-api/templates/deployment.yaml b/packages/system/cozystack-api/templates/deployment.yaml
index aa877266..9febfe1e 100644
--- a/packages/system/cozystack-api/templates/deployment.yaml
+++ b/packages/system/cozystack-api/templates/deployment.yaml
@@ -1,18 +1,12 @@
 apiVersion: apps/v1
-{{- if .Values.cozystackAPI.localK8sAPIEndpoint.enabled }}
-kind: DaemonSet
-{{- else }}
 kind: Deployment
-{{- end }}
 metadata:
   name: cozystack-api
   namespace: cozy-system
   labels:
     app: cozystack-api
 spec:
-  {{- if not .Values.cozystackAPI.localK8sAPIEndpoint.enabled }}
   replicas: {{ .Values.cozystackAPI.replicas }}
-  {{- end }}
   selector:
     matchLabels:
       app: cozystack-api
@@ -24,27 +18,19 @@ spec:
       tolerations:
       - operator: Exists
       serviceAccountName: cozystack-api
-      {{- if .Values.cozystackAPI.localK8sAPIEndpoint.enabled }}
-      {{- with .Values.cozystackAPI.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- end }}
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            preference:
+              matchExpressions:
+              - key: node-role.kubernetes.io/control-plane
+                operator: Exists
       containers:
       - name: cozystack-api
         args:
         - --tls-cert-file=/tmp/cozystack-api-certs/tls.crt
         - --tls-private-key-file=/tmp/cozystack-api-certs/tls.key
-        {{- if .Values.cozystackAPI.localK8sAPIEndpoint.enabled }}
-        env:
-        - name: KUBERNETES_SERVICE_HOST
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: status.hostIP
-        - name: KUBERNETES_SERVICE_PORT
-          value: "6443"
-        {{- end }}
         image: "{{ .Values.cozystackAPI.image }}"
         ports:
         - containerPort: 443
diff --git a/packages/system/cozystack-api/templates/hook.yaml b/packages/system/cozystack-api/templates/hook.yaml
index 3c6b3080..852b2db0 100644
--- a/packages/system/cozystack-api/templates/hook.yaml
+++ b/packages/system/cozystack-api/templates/hook.yaml
@@ -1,16 +1,5 @@
-{{- $shouldRunUpdateHook := false }}
-{{- $previousKind := "Deployment" }}
-{{- $previousKindPlural := "deployments" }}
-{{- if not .Values.cozystackAPI.localK8sAPIEndpoint.enabled }}
-  {{- $previousKind = "DaemonSet" }}
-  {{- $previousKindPlural = "daemonsets" }}
-{{- end }}
-{{- $previous := lookup "apps/v1" $previousKind .Release.Namespace "cozystack-api" }}
+{{- $previous := lookup "apps/v1" "DaemonSet" .Release.Namespace "cozystack-api" }}
 {{- if $previous }}
-  {{- $shouldRunUpdateHook = true }}
-{{- end }}
-
-{{- if $shouldRunUpdateHook }}
 ---
 apiVersion: batch/v1
 kind: Job
@@ -36,7 +25,7 @@ spec:
             - -exc
             - |-
               kubectl --namespace={{ .Release.Namespace }} delete --ignore-not-found \
-                {{ $previousKindPlural }}.apps cozystack-api
+                daemonsets.apps cozystack-api
       restartPolicy: Never
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -51,7 +40,7 @@ rules:
 - apiGroups:
   - "apps"
   resources:
-  - "{{ $previousKindPlural }}"
+  - "daemonsets"
   verbs:
   - get
   - delete
diff --git a/packages/system/cozystack-api/templates/service.yaml b/packages/system/cozystack-api/templates/service.yaml
index abe67abc..64ba149d 100644
--- a/packages/system/cozystack-api/templates/service.yaml
+++ b/packages/system/cozystack-api/templates/service.yaml
@@ -4,9 +4,7 @@ metadata:
   name: cozystack-api
   namespace: cozy-system
 spec:
-  {{- if .Values.cozystackAPI.localK8sAPIEndpoint.enabled }}
-  internalTrafficPolicy: Local
-  {{- end }}
+  trafficDistribution: PreferClose
   ports:
   - port: 443
     protocol: TCP
diff --git a/packages/system/cozystack-api/values.yaml b/packages/system/cozystack-api/values.yaml
index d9631b94..769cd4b6 100644
--- a/packages/system/cozystack-api/values.yaml
+++ b/packages/system/cozystack-api/values.yaml
@@ -1,10 +1,3 @@
 cozystackAPI:
   image: ghcr.io/cozystack/cozystack/cozystack-api:v1.0.0-beta.3@sha256:a263702859c36f85d097c300c1be462aaa45a3955d69e9ae72a37cabf6dadaa9
-  localK8sAPIEndpoint:
-    enabled: true
   replicas: 2
-  # nodeSelector for DaemonSet mode (localK8sAPIEndpoint.enabled: true)
-  # Talos uses empty value: "node-role.kubernetes.io/control-plane": ""
-  # Generic k8s (k3s, kubeadm) uses: "node-role.kubernetes.io/control-plane": "true"
-  nodeSelector:
-    node-role.kubernetes.io/control-plane: ""

From fe6d8bd8d173c38bb59606fedc9bb271692c08bd Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 12 Feb 2026 18:13:32 +0100
Subject: [PATCH 023/666] refactor(nfs): replace system/nfs HelmRelease with
 setup Job

Replace the system/nfs chart (which only created CiliumNetworkPolicy
via Helm lookup) with a Helm hook Job in apps/nfs that:
- Mounts the PVC to trigger WaitForFirstConsumer binding
- Reads NFS export info from PV's CSI volume attributes
- Creates CiliumNetworkPolicy for NFS server egress
- Creates credentials Secret with host, port, path, endpoint
- Sets ownerReferences to PVC for automatic cleanup

Remove system/nfs chart entirely and its PackageSource component.
Update dashboard-resourcemap to include credentials Secret.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../nfs/templates/dashboard-resourcemap.yaml  |   7 +
 packages/apps/nfs/templates/helmrelease.yaml  |  22 ---
 .../apps/nfs/templates/nfs-setup-hook.yaml    | 168 ++++++++++++++++++
 .../platform/sources/nfs-application.yaml     |   2 -
 packages/system/nfs/.helmignore               |   2 -
 packages/system/nfs/Chart.yaml                |   3 -
 packages/system/nfs/Makefile                  |   3 -
 .../system/nfs/templates/cilium-policy.yaml   |  20 ---
 packages/system/nfs/values.yaml               |   1 -
 9 files changed, 175 insertions(+), 53 deletions(-)
 delete mode 100644 packages/apps/nfs/templates/helmrelease.yaml
 create mode 100644 packages/apps/nfs/templates/nfs-setup-hook.yaml
 delete mode 100644 packages/system/nfs/.helmignore
 delete mode 100644 packages/system/nfs/Chart.yaml
 delete mode 100644 packages/system/nfs/Makefile
 delete mode 100644 packages/system/nfs/templates/cilium-policy.yaml
 delete mode 100644 packages/system/nfs/values.yaml

diff --git a/packages/apps/nfs/templates/dashboard-resourcemap.yaml b/packages/apps/nfs/templates/dashboard-resourcemap.yaml
index 106af486..e5f7f063 100644
--- a/packages/apps/nfs/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/nfs/templates/dashboard-resourcemap.yaml
@@ -10,6 +10,13 @@ rules:
   resourceNames:
   - {{ .Release.Name }}
   verbs: ["get", "list", "watch"]
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  resourceNames:
+  - {{ .Release.Name }}-credentials
+  verbs: ["get", "list", "watch"]
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
diff --git a/packages/apps/nfs/templates/helmrelease.yaml b/packages/apps/nfs/templates/helmrelease.yaml
deleted file mode 100644
index 598f065f..00000000
--- a/packages/apps/nfs/templates/helmrelease.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: {{ .Release.Name }}-system
-  labels:
-    sharding.fluxcd.io/key: tenants
-spec:
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-nfs-application-default-nfs-system
-    namespace: cozy-system
-  interval: 5m
-  timeout: 10m
-  install:
-    remediation:
-      retries: -1
-  upgrade:
-    force: true
-    remediation:
-      retries: -1
-  values:
-    pvcName: {{ .Release.Name }}
diff --git a/packages/apps/nfs/templates/nfs-setup-hook.yaml b/packages/apps/nfs/templates/nfs-setup-hook.yaml
new file mode 100644
index 00000000..759bfd21
--- /dev/null
+++ b/packages/apps/nfs/templates/nfs-setup-hook.yaml
@@ -0,0 +1,168 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Release.Name }}-nfs-setup
+  annotations:
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-weight: "-5"
+    helm.sh/hook-delete-policy: before-hook-creation
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-nfs-setup
+  annotations:
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-weight: "-5"
+    helm.sh/hook-delete-policy: before-hook-creation
+rules:
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["create", "get", "patch", "update"]
+  - apiGroups: ["cilium.io"]
+    resources: ["ciliumnetworkpolicies"]
+    verbs: ["create", "get", "patch", "update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-nfs-setup
+  annotations:
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-weight: "-5"
+    helm.sh/hook-delete-policy: before-hook-creation
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Release.Name }}-nfs-setup
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-nfs-setup
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Namespace }}-{{ .Release.Name }}-nfs-setup
+  annotations:
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-weight: "-5"
+    helm.sh/hook-delete-policy: before-hook-creation
+rules:
+  - apiGroups: [""]
+    resources: ["persistentvolumes"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ .Release.Namespace }}-{{ .Release.Name }}-nfs-setup
+  annotations:
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-weight: "-5"
+    helm.sh/hook-delete-policy: before-hook-creation
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Release.Name }}-nfs-setup
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Namespace }}-{{ .Release.Name }}-nfs-setup
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ .Release.Name }}-nfs-setup
+  annotations:
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-weight: "0"
+    helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation
+spec:
+  backoffLimit: 3
+  template:
+    metadata:
+      labels:
+        policy.cozystack.io/allow-to-apiserver: "true"
+    spec:
+      serviceAccountName: {{ .Release.Name }}-nfs-setup
+      restartPolicy: Never
+      containers:
+        - name: setup
+          image: docker.io/alpine/k8s:1.33.4
+          command: ["sh", "-xec"]
+          args:
+            - |
+              PVC_NAME="{{ .Release.Name }}"
+              NAMESPACE="{{ .Release.Namespace }}"
+
+              # Get PV name from PVC (PVC is bound since we mount it)
+              PV_NAME=$(kubectl get pvc "$PVC_NAME" -n "$NAMESPACE" -o jsonpath='{.spec.volumeName}')
+
+              # Get NFS export URL from PV
+              NFS_EXPORT=$(kubectl get pv "$PV_NAME" -o 'jsonpath={.spec.csi.volumeAttributes.linstor\.csi\.linbit\.com/nfs-export}')
+
+              # Parse port from URL (format: nfs://host:port/path)
+              PORT=$(echo "$NFS_EXPORT" | sed -E 's|.*://[^:]+:([0-9]+)/.*|\1|')
+
+              # Get PVC UID for owner reference
+              PVC_UID=$(kubectl get pvc "$PVC_NAME" -n "$NAMESPACE" -o jsonpath='{.metadata.uid}')
+
+              # Parse host and path from URL
+              HOST=$(echo "$NFS_EXPORT" | sed -E 's|.*://([^:]+):.*|\1|')
+              PATH_EXPORT=$(echo "$NFS_EXPORT" | sed -E 's|.*://[^/]+(/.*)|\1|')
+
+              # Create credentials secret with NFS access info
+              cat <<EOF | kubectl apply -f -
+              apiVersion: v1
+              kind: Secret
+              metadata:
+                name: ${PVC_NAME}-credentials
+                namespace: ${NAMESPACE}
+                ownerReferences:
+                - apiVersion: v1
+                  kind: PersistentVolumeClaim
+                  name: ${PVC_NAME}
+                  uid: ${PVC_UID}
+              type: Opaque
+              stringData:
+                host: "${HOST}"
+                port: "${PORT}"
+                path: "${PATH_EXPORT}"
+                endpoint: "nfs://${HOST}:${PORT}${PATH_EXPORT}"
+              EOF
+
+              # Apply CiliumNetworkPolicy with owner reference to PVC
+              cat <<EOF | kubectl apply -f -
+              apiVersion: cilium.io/v2
+              kind: CiliumNetworkPolicy
+              metadata:
+                name: allow-nfs-${PVC_NAME}
+                namespace: ${NAMESPACE}
+                ownerReferences:
+                - apiVersion: v1
+                  kind: PersistentVolumeClaim
+                  name: ${PVC_NAME}
+                  uid: ${PVC_UID}
+              spec:
+                endpointSelector: {}
+                egress:
+                - toEndpoints:
+                  - matchLabels:
+                      k8s:app.kubernetes.io/component: linstor-csi-nfs-server
+                      k8s:io.kubernetes.pod.namespace: cozy-linstor
+                  toPorts:
+                  - ports:
+                    - port: "${PORT}"
+                      protocol: TCP
+              EOF
+          volumeMounts:
+            - name: data
+              mountPath: /mnt/data
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}
diff --git a/packages/core/platform/sources/nfs-application.yaml b/packages/core/platform/sources/nfs-application.yaml
index c9dc8575..9d7acf94 100644
--- a/packages/core/platform/sources/nfs-application.yaml
+++ b/packages/core/platform/sources/nfs-application.yaml
@@ -17,8 +17,6 @@ spec:
         - name: cozy-lib
           path: library/cozy-lib
       components:
-        - name: nfs-system
-          path: system/nfs
         - name: nfs
           path: apps/nfs
           libraries: ["cozy-lib"]
diff --git a/packages/system/nfs/.helmignore b/packages/system/nfs/.helmignore
deleted file mode 100644
index 481ff39c..00000000
--- a/packages/system/nfs/.helmignore
+++ /dev/null
@@ -1,2 +0,0 @@
-logos/
-hack/
diff --git a/packages/system/nfs/Chart.yaml b/packages/system/nfs/Chart.yaml
deleted file mode 100644
index fed4e8ae..00000000
--- a/packages/system/nfs/Chart.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-apiVersion: v2
-name: cozy-nfs
-version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
diff --git a/packages/system/nfs/Makefile b/packages/system/nfs/Makefile
deleted file mode 100644
index 194a6fa4..00000000
--- a/packages/system/nfs/Makefile
+++ /dev/null
@@ -1,3 +0,0 @@
-export NAME=nfs-system
-
-include ../../../hack/package.mk
diff --git a/packages/system/nfs/templates/cilium-policy.yaml b/packages/system/nfs/templates/cilium-policy.yaml
deleted file mode 100644
index 93008d07..00000000
--- a/packages/system/nfs/templates/cilium-policy.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-{{- $pvc := lookup "v1" "PersistentVolumeClaim" .Release.Namespace .Values.pvcName }}
-{{- $pv := lookup "v1" "PersistentVolume" "" $pvc.spec.volumeName }}
-{{- $nfsExport := index $pv.spec.csi.volumeAttributes "linstor.csi.linbit.com/nfs-export" }}
-{{- $parsed := urlParse $nfsExport }}
-{{- $port := last (splitList ":" $parsed.host) }}
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-nfs-{{ .Values.pvcName }}
-spec:
-  endpointSelector: {}
-  egress:
-  - toEndpoints:
-    - matchLabels:
-        k8s:app.kubernetes.io/component: linstor-csi-nfs-server
-        k8s:io.kubernetes.pod.namespace: cozy-linstor
-    toPorts:
-    - ports:
-      - port: "{{ $port }}"
-        protocol: TCP
diff --git a/packages/system/nfs/values.yaml b/packages/system/nfs/values.yaml
deleted file mode 100644
index b405be18..00000000
--- a/packages/system/nfs/values.yaml
+++ /dev/null
@@ -1 +0,0 @@
-pvcName: ""

From 19f9deca9ebf75732a13aea29f8ac613c693bfb3 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 12 Feb 2026 18:13:40 +0100
Subject: [PATCH 024/666] refactor(nfs-driver): change extraStorageClasses from
 list to map

Convert extraStorageClasses from list to map format to support
Flux HelmRelease valuesFrom with targetPath deep-merge semantics.
Update template to iterate over map entries and construct
mountOptions from port parameter.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../templates/extra-storageclasses.yaml       | 13 +++--
 .../tests/extra-storageclasses_test.yaml      | 52 ++++++++-----------
 packages/system/nfs-driver/values.yaml        |  2 +-
 3 files changed, 30 insertions(+), 37 deletions(-)

diff --git a/packages/system/nfs-driver/templates/extra-storageclasses.yaml b/packages/system/nfs-driver/templates/extra-storageclasses.yaml
index f627a474..c86e1355 100644
--- a/packages/system/nfs-driver/templates/extra-storageclasses.yaml
+++ b/packages/system/nfs-driver/templates/extra-storageclasses.yaml
@@ -1,18 +1,17 @@
-{{- range .Values.extraStorageClasses }}
+{{- range $name, $config := .Values.extraStorageClasses }}
 ---
 apiVersion: storage.k8s.io/v1
 kind: StorageClass
 metadata:
-  name: {{ .name }}
+  name: {{ $name }}
 provisioner: nfs.csi.k8s.io
 parameters:
-  server: {{ .server | quote }}
-  share: {{ .share | quote }}
+  server: {{ $config.server | quote }}
+  share: {{ $config.share | quote }}
 reclaimPolicy: Delete
 volumeBindingMode: Immediate
 allowVolumeExpansion: true
-{{- with .mountOptions }}
 mountOptions:
-{{- toYaml . | nindent 2 }}
-{{- end }}
+  - nfsvers=4.2
+  - port={{ $config.port }}
 {{- end }}
diff --git a/packages/system/nfs-driver/tests/extra-storageclasses_test.yaml b/packages/system/nfs-driver/tests/extra-storageclasses_test.yaml
index 6009c761..da3bd34d 100644
--- a/packages/system/nfs-driver/tests/extra-storageclasses_test.yaml
+++ b/packages/system/nfs-driver/tests/extra-storageclasses_test.yaml
@@ -12,16 +12,14 @@ tests:
   - it: creates one StorageClass per entry
     set:
       extraStorageClasses:
-        - name: nfs-data
+        nfs-data:
           server: "10.96.1.1"
           share: "/"
-          mountOptions:
-            - nfsvers=4.1
-        - name: nfs-backup
+          port: "2049"
+        nfs-backup:
           server: "10.96.2.2"
           share: "/"
-          mountOptions:
-            - nfsvers=4.1
+          port: "2050"
     asserts:
       - hasDocuments:
           count: 2
@@ -29,11 +27,10 @@ tests:
   - it: sets correct provisioner
     set:
       extraStorageClasses:
-        - name: nfs-test
+        nfs-test:
           server: "10.96.1.1"
           share: "/"
-          mountOptions:
-            - nfsvers=4.1
+          port: "2049"
     asserts:
       - equal:
           path: provisioner
@@ -42,11 +39,10 @@ tests:
   - it: sets server and share parameters
     set:
       extraStorageClasses:
-        - name: nfs-mydata
+        nfs-mydata:
           server: "10.96.50.100"
           share: "/exports"
-          mountOptions:
-            - nfsvers=4.1
+          port: "2049"
     asserts:
       - equal:
           path: metadata.name
@@ -58,27 +54,28 @@ tests:
           path: parameters.share
           value: "/exports"
 
-  - it: sets mount options
+  - it: sets mount options with port
     set:
       extraStorageClasses:
-        - name: nfs-test
+        nfs-test:
           server: "10.96.1.1"
           share: "/"
-          mountOptions:
-            - nfsvers=4.1
+          port: "2049"
     asserts:
       - equal:
           path: mountOptions[0]
-          value: nfsvers=4.1
+          value: nfsvers=4.2
+      - equal:
+          path: mountOptions[1]
+          value: port=2049
 
   - it: allows volume expansion
     set:
       extraStorageClasses:
-        - name: nfs-test
+        nfs-test:
           server: "10.96.1.1"
           share: "/"
-          mountOptions:
-            - nfsvers=4.1
+          port: "2049"
     asserts:
       - equal:
           path: allowVolumeExpansion
@@ -87,11 +84,10 @@ tests:
   - it: uses Delete reclaim policy
     set:
       extraStorageClasses:
-        - name: nfs-test
+        nfs-test:
           server: "10.96.1.1"
           share: "/"
-          mountOptions:
-            - nfsvers=4.1
+          port: "2049"
     asserts:
       - equal:
           path: reclaimPolicy
@@ -100,16 +96,14 @@ tests:
   - it: creates distinct StorageClasses for multiple shares
     set:
       extraStorageClasses:
-        - name: nfs-alpha
+        nfs-alpha:
           server: "10.96.10.1"
           share: "/"
-          mountOptions:
-            - nfsvers=4.1
-        - name: nfs-beta
+          port: "2049"
+        nfs-beta:
           server: "10.96.20.2"
           share: "/data"
-          mountOptions:
-            - nfsvers=4.1
+          port: "2050"
     asserts:
       - equal:
           path: metadata.name
diff --git a/packages/system/nfs-driver/values.yaml b/packages/system/nfs-driver/values.yaml
index eb1f99f0..a5676ee9 100644
--- a/packages/system/nfs-driver/values.yaml
+++ b/packages/system/nfs-driver/values.yaml
@@ -1,3 +1,3 @@
 csi-driver-nfs: {}
 
-extraStorageClasses: []
+extraStorageClasses: {}

From b7df10de6c14bf674fb730200c0bfcca4685c396 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 12 Feb 2026 18:13:46 +0100
Subject: [PATCH 025/666] refactor(kubernetes): use valuesFrom for NFS driver
 credentials

Replace PVC/PV lookup logic with valuesFrom references to NFS
credentials secrets, passing host, port, and path via targetPath
to the nfs-driver extraStorageClasses map.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../templates/helmreleases/nfs-driver.yaml    | 49 +++++++++----------
 1 file changed, 22 insertions(+), 27 deletions(-)

diff --git a/packages/apps/kubernetes/templates/helmreleases/nfs-driver.yaml b/packages/apps/kubernetes/templates/helmreleases/nfs-driver.yaml
index c00ea763..590f3c4b 100644
--- a/packages/apps/kubernetes/templates/helmreleases/nfs-driver.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/nfs-driver.yaml
@@ -1,29 +1,4 @@
 {{- if .Values.nfs.instances }}
-{{- $extraStorageClasses := list }}
-{{- range .Values.nfs.instances }}
-{{-   $pvcName := printf "nfs-%s" .name }}
-{{-   $pvc := lookup "v1" "PersistentVolumeClaim" $.Release.Namespace $pvcName }}
-{{-   if not $pvc }}
-{{-     fail (printf "NFS PVC not found in namespace %s: %s" $.Release.Namespace $pvcName) }}
-{{-   end }}
-{{-   if not $pvc.spec.volumeName }}
-{{-     fail (printf "NFS PVC %s is not yet bound" $pvcName) }}
-{{-   end }}
-{{-   $pv := lookup "v1" "PersistentVolume" "" $pvc.spec.volumeName }}
-{{-   if not $pv }}
-{{-     fail (printf "PersistentVolume %s not found for PVC %s" $pvc.spec.volumeName $pvcName) }}
-{{-   end }}
-{{-   $nfsExport := index $pv.spec.csi.volumeAttributes "linstor.csi.linbit.com/nfs-export" }}
-{{-   if not $nfsExport }}
-{{-     fail (printf "PV %s has no linstor.csi.linbit.com/nfs-export attribute" $pv.metadata.name) }}
-{{-   end }}
-{{-   $parsed := urlParse $nfsExport }}
-{{-   $hostParts := splitList ":" $parsed.host }}
-{{-   $server := first $hostParts }}
-{{-   $port := last $hostParts }}
-{{-   $sc := dict "name" (printf "nfs-%s" .name) "server" $server "share" $parsed.path "mountOptions" (list (printf "nfsvers=4.2") (printf "port=%s" $port)) }}
-{{-   $extraStorageClasses = append $extraStorageClasses $sc }}
-{{- end }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -54,9 +29,29 @@ spec:
     force: true
     remediation:
       retries: -1
+  valuesFrom:
+  {{- range .Values.nfs.instances }}
+  {{- $secretName := printf "nfs-%s-credentials" .name }}
+  - kind: Secret
+    name: {{ $secretName }}
+    valuesKey: host
+    targetPath: extraStorageClasses.nfs-{{ .name }}.server
+  - kind: Secret
+    name: {{ $secretName }}
+    valuesKey: port
+    targetPath: extraStorageClasses.nfs-{{ .name }}.port
+  - kind: Secret
+    name: {{ $secretName }}
+    valuesKey: path
+    targetPath: extraStorageClasses.nfs-{{ .name }}.share
+  {{- end }}
   values:
-    {{- $defaultValues := dict "csi-driver-nfs" (dict "storageClass" (dict "create" false)) "extraStorageClasses" $extraStorageClasses }}
-    {{- toYaml (deepCopy .Values.addons.nfs.valuesOverride | mergeOverwrite $defaultValues) | nindent 4 }}
+    csi-driver-nfs:
+      storageClass:
+        create: false
+    {{- with .Values.addons.nfs.valuesOverride }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
   dependsOn:
   {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
   - name: {{ .Release.Name }}

From a05fead357c0f8b4b20f2c4b322ea45064f85073 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 12 Feb 2026 18:13:52 +0100
Subject: [PATCH 026/666] fix(nfs): add secrets section to
 ApplicationDefinition

Add secrets include/exclude configuration so the lineage webhook
sets internal.cozystack.io/tenantresource label on NFS credentials
secrets, making them visible via the tenantsecrets API.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/system/nfs-rd/cozyrds/nfs.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/packages/system/nfs-rd/cozyrds/nfs.yaml b/packages/system/nfs-rd/cozyrds/nfs.yaml
index 9a51f6af..9e720e1f 100644
--- a/packages/system/nfs-rd/cozyrds/nfs.yaml
+++ b/packages/system/nfs-rd/cozyrds/nfs.yaml
@@ -22,3 +22,8 @@ spec:
     plural: NFS
     icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcikiLz4KPHBhdGggZD0iTTM2IDU4VjEwNEMzNiAxMDcuMzE0IDM4LjY4NjMgMTEwIDQyIDExMEgxMDJDMTA1LjMxNCAxMTAgMTA4IDEwNy4zMTQgMTA4IDEwNFY1MkMxMDggNDguNjg2MyAxMDUuMzE0IDQ2IDEwMiA0Nkg3MEw2MiAzNEg0MkMzOC42ODYzIDM0IDM2IDM2LjY4NjMgMzYgNDBWNThaIiBmaWxsPSIjMTU2NUMwIi8+CjxwYXRoIGQ9Ik0zMCA2MkMzMCA1OC42ODYzIDMyLjY4NjMgNTYgMzYgNTZIMTA4QzExMS4zMTQgNTYgMTE0IDU4LjY4NjMgMTE0IDYyVjEwNEMxMTQgMTA3LjMxNCAxMTEuMzE0IDExMCAxMDggMTEwSDM2QzMyLjY4NjMgMTEwIDMwIDEwNy4zMTQgMzAgMTA0VjYyWiIgZmlsbD0iIzQyQTVGNSIvPgo8cGF0aCBkPSJNNjMgNzZWOTRNNjMgNzZMNTQgODVNNjMgNzZMNzIgODUiIHN0cm9rZT0id2hpdGUiIHN0cm9rZS13aWR0aD0iNCIgc3Ryb2tlLWxpbmVjYXA9InJvdW5kIiBzdHJva2UtbGluZWpvaW49InJvdW5kIi8+CjxwYXRoIGQ9Ik04MSA5NFY3Nk04MSA5NEw5MCA4NU04MSA5NEw3MiA4NSIgc3Ryb2tlPSJ3aGl0ZSIgc3Ryb2tlLXdpZHRoPSI0IiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiLz4KPGRlZnM+CjxsaW5lYXJHcmFkaWVudCBpZD0icGFpbnQwX2xpbmVhciIgeDE9IjAiIHkxPSIwIiB4Mj0iMTQ0IiB5Mj0iMTQ0IiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+CjxzdG9wIHN0b3AtY29sb3I9IiNFM0YyRkQiLz4KPHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjNjRCNUY2Ii8+CjwvbGluZWFyR3JhZGllbnQ+CjwvZGVmcz4KPC9zdmc+Cg==
     keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "storageClass"], ["spec", "size"]]
+  secrets:
+    exclude: []
+    include:
+      - resourceNames:
+          - nfs-{{ .name }}-credentials

From 1af999a5000dfe4475d3a8753cd1c76e378352f0 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 12 Feb 2026 23:24:43 +0100
Subject: [PATCH 027/666] feat(csi): add RWX Filesystem (NFS) support to
 kubevirt-csi-driver wrapper

Implement a wrapper around upstream kubevirt-csi-driver that adds RWX
Filesystem volume support via LINSTOR NFS exports:

- CreateVolume: intercepts RWX+Filesystem requests, creates DataVolume
  with explicit AccessMode=RWX and VolumeMode=Filesystem
- ControllerPublishVolume: waits for PVC bound, extracts NFS export URL
  from infra PV, creates CiliumNetworkPolicy with VMI ownerReferences
- ControllerUnpublishVolume: manages CNP ownerReferences per-VMI
- ControllerExpandVolume: delegates to upstream, disables node expansion
  for NFS volumes
- NodeStageVolume/NodePublishVolume: mounts NFS at target path
- NodeExpandVolume: no-op for NFS (LINSTOR handles resize)

Also includes:
- RBAC for CiliumNetworkPolicy management in infra cluster
- Explicit --run-node-service=false for controller deployment
- Explicit --run-controller-service=false for node DaemonSet
- nfs-utils in container image for NFS mount support

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../kubernetes/images/kubevirt-csi-driver.tag |   2 +-
 .../images/kubevirt-csi-driver/Dockerfile     |  28 +-
 .../images/kubevirt-csi-driver/controller.go  | 525 +++++++++++++++++
 .../images/kubevirt-csi-driver/go.mod         | 101 ++++
 .../images/kubevirt-csi-driver/go.sum         | 543 ++++++++++++++++++
 .../images/kubevirt-csi-driver/main.go        | 219 +++++++
 .../images/kubevirt-csi-driver/node.go        | 106 ++++
 .../apps/kubernetes/templates/csi/deploy.yaml |   1 +
 .../csi/infra-cluster-service-account.yaml    |   3 +
 .../kubevirt-csi-node/templates/deploy.yaml   |   1 +
 packages/system/kubevirt-csi-node/values.yaml |   2 +-
 11 files changed, 1511 insertions(+), 20 deletions(-)
 create mode 100644 packages/apps/kubernetes/images/kubevirt-csi-driver/controller.go
 create mode 100644 packages/apps/kubernetes/images/kubevirt-csi-driver/go.mod
 create mode 100644 packages/apps/kubernetes/images/kubevirt-csi-driver/go.sum
 create mode 100644 packages/apps/kubernetes/images/kubevirt-csi-driver/main.go
 create mode 100644 packages/apps/kubernetes/images/kubevirt-csi-driver/node.go

diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
index 421a4084..ca67ba13 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:8f1ab4c3b2bed3a0adc40fcc823b040fa04b4722bec7735c030e79a3a2fd6c85
+ghcr.io/cozystack/cozystack/kubevirt-csi-driver:latest@sha256:cd58760c97ba50ef74ff940cdcda4b9a6d8554eec8305fc96c2e8bbea72b75a9
diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/Dockerfile b/packages/apps/kubernetes/images/kubevirt-csi-driver/Dockerfile
index 5ae5817f..be8125d7 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver/Dockerfile
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/Dockerfile
@@ -1,31 +1,23 @@
-# Source: https://github.com/kubevirt/csi-driver/blob/main/Dockerfile
 ARG builder_image=docker.io/library/golang:1.22.5
 FROM ${builder_image} AS builder
-RUN git clone https://github.com/kubevirt/csi-driver /src/kubevirt-csi-driver \
- && cd /src/kubevirt-csi-driver \
- && git checkout a8d6605bc9997bcfda3fb9f1f82ba6445b4984cc
 
 ARG TARGETOS
 ARG TARGETARCH
-ENV GOOS=$TARGETOS
-ENV GOARCH=$TARGETARCH
 
-WORKDIR /src/kubevirt-csi-driver
+WORKDIR /src
 
-RUN make build
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY *.go ./
+RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build \
+    -ldflags "-X kubevirt.io/csi-driver/pkg/service.VendorVersion=0.2.0" \
+    -o kubevirt-csi-driver .
 
 FROM quay.io/centos/centos:stream9
-ARG git_url=https://github.com/kubevirt/csi-driver.git
-
-LABEL maintainers="The KubeVirt Project <kubevirt-dev@googlegroups.com>" \
-      description="KubeVirt CSI Driver" \
-      multi.GIT_URL=${git_url}
 
 ENTRYPOINT ["./kubevirt-csi-driver"]
 
-RUN dnf install -y e2fsprogs xfsprogs && dnf clean all
+RUN dnf install -y e2fsprogs xfsprogs nfs-utils && dnf clean all
 
-ARG git_sha=NONE
-LABEL multi.GIT_SHA=${git_sha}
-
-COPY --from=builder /src/kubevirt-csi-driver/kubevirt-csi-driver .
+COPY --from=builder /src/kubevirt-csi-driver .
diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/controller.go b/packages/apps/kubernetes/images/kubevirt-csi-driver/controller.go
new file mode 100644
index 00000000..524b45ea
--- /dev/null
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/controller.go
@@ -0,0 +1,525 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"time"
+
+	csi "github.com/container-storage-interface/spec/lib/go/csi"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/cache"
+	"k8s.io/klog/v2"
+	cdiv1 "kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1"
+
+	kubevirtclient "kubevirt.io/csi-driver/pkg/kubevirt"
+	"kubevirt.io/csi-driver/pkg/service"
+	"kubevirt.io/csi-driver/pkg/util"
+)
+
+const (
+	nfsVolumeKey    = "nfsVolume"
+	nfsExportKey    = "nfsExport"
+	busParameter    = "bus"
+	serialParameter = "serial"
+)
+
+var ciliumNetworkPolicyGVR = schema.GroupVersionResource{
+	Group:    "cilium.io",
+	Version:  "v2",
+	Resource: "ciliumnetworkpolicies",
+}
+
+var _ csi.ControllerServer = &WrappedControllerService{}
+
+// WrappedControllerService embeds the upstream ControllerService and adds RWX Filesystem (NFS) support.
+type WrappedControllerService struct {
+	*service.ControllerService
+	infraClient             kubernetes.Interface
+	dynamicClient           dynamic.Interface
+	virtClient              kubevirtclient.Client
+	infraNamespace          string
+	infraClusterLabels      map[string]string
+	storageClassEnforcement util.StorageClassEnforcement
+}
+
+// isRWXFilesystem checks if the volume capabilities request RWX access with filesystem mode.
+func isRWXFilesystem(caps []*csi.VolumeCapability) bool {
+	hasRWX := false
+	hasMount := false
+	for _, cap := range caps {
+		if cap == nil {
+			continue
+		}
+		if cap.GetMount() != nil {
+			hasMount = true
+		}
+		if am := cap.GetAccessMode(); am != nil && am.Mode == csi.VolumeCapability_AccessMode_MULTI_NODE_MULTI_WRITER {
+			hasRWX = true
+		}
+	}
+	return hasRWX && hasMount
+}
+
+// CreateVolume intercepts RWX Filesystem requests and creates a DataVolume in the infra
+// cluster with AccessMode=RWX and VolumeMode=Filesystem. Upstream rejects RWX+Filesystem,
+// so we handle DataVolume creation ourselves. Using DataVolume (not bare PVC) preserves
+// compatibility with upstream snapshot and clone operations.
+// For all other requests, delegates to upstream.
+func (w *WrappedControllerService) CreateVolume(ctx context.Context, req *csi.CreateVolumeRequest) (*csi.CreateVolumeResponse, error) {
+	if !isRWXFilesystem(req.GetVolumeCapabilities()) {
+		return w.ControllerService.CreateVolume(ctx, req)
+	}
+
+	if req == nil {
+		return nil, status.Error(codes.InvalidArgument, "missing request")
+	}
+	if len(req.GetName()) == 0 {
+		return nil, status.Error(codes.InvalidArgument, "name missing in request")
+	}
+
+	// Storage class enforcement
+	storageClassName := req.Parameters[kubevirtclient.InfraStorageClassNameParameter]
+	if !w.storageClassEnforcement.AllowAll {
+		if storageClassName == "" {
+			if !w.storageClassEnforcement.AllowDefault {
+				return nil, status.Error(codes.InvalidArgument, "infraStorageclass is not in the allowed list")
+			}
+		} else if !util.Contains(w.storageClassEnforcement.AllowList, storageClassName) {
+			return nil, status.Error(codes.InvalidArgument, "infraStorageclass is not in the allowed list")
+		}
+	}
+
+	storageSize := req.GetCapacityRange().GetRequiredBytes()
+	dvName := req.Name
+
+	// Determine DataVolume source (blank, snapshot, or clone)
+	source, err := w.determineDvSource(ctx, req)
+	if err != nil {
+		return nil, err
+	}
+
+	// Handle CSI clone: CDI doesn't allow cloning PVCs in use by a pod,
+	// so use DataSourceRef instead (same approach as upstream)
+	sourcePVCName := ""
+	if source.PVC != nil {
+		sourcePVCName = source.PVC.Name
+		source = nil
+	}
+
+	volumeMode := corev1.PersistentVolumeFilesystem
+	dv := &cdiv1.DataVolume{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "DataVolume",
+			APIVersion: cdiv1.SchemeGroupVersion.String(),
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      dvName,
+			Namespace: w.infraNamespace,
+			Labels:    w.infraClusterLabels,
+			Annotations: map[string]string{
+				"cdi.kubevirt.io/storage.deleteAfterCompletion":    "false",
+				"cdi.kubevirt.io/storage.bind.immediate.requested": "true",
+			},
+		},
+		Spec: cdiv1.DataVolumeSpec{
+			Storage: &cdiv1.StorageSpec{
+				AccessModes: []corev1.PersistentVolumeAccessMode{corev1.ReadWriteMany},
+				VolumeMode:  &volumeMode,
+				Resources: corev1.ResourceRequirements{
+					Requests: corev1.ResourceList{
+						corev1.ResourceStorage: *resource.NewScaledQuantity(storageSize, 0),
+					},
+				},
+			},
+			Source: source,
+		},
+	}
+
+	if sourcePVCName != "" {
+		dv.Spec.Storage.DataSourceRef = &corev1.TypedObjectReference{
+			Kind: "PersistentVolumeClaim",
+			Name: sourcePVCName,
+		}
+	}
+
+	if storageClassName != "" {
+		dv.Spec.Storage.StorageClassName = &storageClassName
+	}
+
+	// Idempotency: check if DataVolume already exists
+	if existingDv, err := w.virtClient.GetDataVolume(ctx, w.infraNamespace, dvName); errors.IsNotFound(err) {
+		klog.Infof("Creating NFS DataVolume %s/%s", w.infraNamespace, dvName)
+		dv, err = w.virtClient.CreateDataVolume(ctx, w.infraNamespace, dv)
+		if err != nil {
+			klog.Errorf("Failed creating NFS DataVolume %s: %v", dvName, err)
+			return nil, err
+		}
+	} else if err != nil {
+		return nil, err
+	} else {
+		if existingDv != nil && existingDv.Spec.Storage != nil {
+			existingRequest := existingDv.Spec.Storage.Resources.Requests[corev1.ResourceStorage]
+			newRequest := dv.Spec.Storage.Resources.Requests[corev1.ResourceStorage]
+			if newRequest.Cmp(existingRequest) != 0 {
+				return nil, status.Error(codes.AlreadyExists, "requested storage size does not match existing size")
+			}
+			dv = existingDv
+		}
+	}
+
+	serial := string(dv.GetUID())
+
+	return &csi.CreateVolumeResponse{
+		Volume: &csi.Volume{
+			CapacityBytes: storageSize,
+			VolumeId:      dvName,
+			VolumeContext: map[string]string{
+				busParameter:    "scsi",
+				serialParameter: serial,
+				nfsVolumeKey:    "true",
+			},
+			ContentSource: req.GetVolumeContentSource(),
+		},
+	}, nil
+}
+
+// determineDvSource determines the DataVolume source from the CSI request content source.
+// Mirrors upstream logic for blank, snapshot, and clone sources.
+func (w *WrappedControllerService) determineDvSource(ctx context.Context, req *csi.CreateVolumeRequest) (*cdiv1.DataVolumeSource, error) {
+	res := &cdiv1.DataVolumeSource{}
+	if req.GetVolumeContentSource() != nil {
+		source := req.GetVolumeContentSource()
+		switch source.Type.(type) {
+		case *csi.VolumeContentSource_Snapshot:
+			snapshot, err := w.virtClient.GetVolumeSnapshot(ctx, w.infraNamespace, source.GetSnapshot().GetSnapshotId())
+			if errors.IsNotFound(err) {
+				return nil, status.Errorf(codes.NotFound, "source snapshot %s not found", source.GetSnapshot().GetSnapshotId())
+			} else if err != nil {
+				return nil, err
+			}
+			if snapshot != nil {
+				res.Snapshot = &cdiv1.DataVolumeSourceSnapshot{
+					Name:      snapshot.Name,
+					Namespace: w.infraNamespace,
+				}
+			}
+		case *csi.VolumeContentSource_Volume:
+			volume, err := w.virtClient.GetDataVolume(ctx, w.infraNamespace, source.GetVolume().GetVolumeId())
+			if errors.IsNotFound(err) {
+				return nil, status.Errorf(codes.NotFound, "source volume %s not found", source.GetVolume().GetVolumeId())
+			} else if err != nil {
+				return nil, err
+			}
+			if volume != nil {
+				res.PVC = &cdiv1.DataVolumeSourcePVC{
+					Name:      volume.Name,
+					Namespace: w.infraNamespace,
+				}
+			}
+		default:
+			return nil, status.Error(codes.InvalidArgument, "unknown content type")
+		}
+	} else {
+		res.Blank = &cdiv1.DataVolumeBlankImage{}
+	}
+	return res, nil
+}
+
+// ControllerPublishVolume for NFS volumes: annotates infra PVC for WFFC binding,
+// waits for PVC bound, extracts NFS export from PV, and creates CiliumNetworkPolicy.
+// For RWO volumes, delegates to upstream (hotplug SCSI).
+func (w *WrappedControllerService) ControllerPublishVolume(ctx context.Context, req *csi.ControllerPublishVolumeRequest) (*csi.ControllerPublishVolumeResponse, error) {
+	if req.GetVolumeContext()[nfsVolumeKey] != "true" {
+		return w.ControllerService.ControllerPublishVolume(ctx, req)
+	}
+
+	if len(req.GetVolumeId()) == 0 {
+		return nil, status.Error(codes.InvalidArgument, "volume id missing in request")
+	}
+	if len(req.GetNodeId()) == 0 {
+		return nil, status.Error(codes.InvalidArgument, "node id missing in request")
+	}
+
+	dvName := req.GetVolumeId()
+	vmNamespace, vmName, err := cache.SplitMetaNamespaceKey(req.GetNodeId())
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to parse node ID %q: %v", req.GetNodeId(), err)
+	}
+
+	klog.V(3).Infof("Publishing NFS volume %s to node %s/%s", dvName, vmNamespace, vmName)
+
+	// Get VMI for CiliumNetworkPolicy ownerReference
+	vmi, err := w.virtClient.GetVirtualMachine(ctx, w.infraNamespace, vmName)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to get VMI %s: %v", vmName, err)
+	}
+
+	// Wait for PVC to be bound (CDI handles immediate binding via annotation)
+	klog.V(3).Infof("Waiting for PVC %s to be bound", dvName)
+	if err := wait.PollUntilContextTimeout(ctx, time.Second, 2*time.Minute, true, func(ctx context.Context) (bool, error) {
+		p, err := w.infraClient.CoreV1().PersistentVolumeClaims(w.infraNamespace).Get(ctx, dvName, metav1.GetOptions{})
+		if err != nil {
+			return false, err
+		}
+		return p.Status.Phase == corev1.ClaimBound, nil
+	}); err != nil {
+		return nil, status.Errorf(codes.Internal, "timed out waiting for PVC %s to be bound: %v", dvName, err)
+	}
+
+	// Read PV to get NFS export
+	pvc, err := w.infraClient.CoreV1().PersistentVolumeClaims(w.infraNamespace).Get(ctx, dvName, metav1.GetOptions{})
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to re-read PVC %s: %v", dvName, err)
+	}
+	pv, err := w.infraClient.CoreV1().PersistentVolumes().Get(ctx, pvc.Spec.VolumeName, metav1.GetOptions{})
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to get PV %s: %v", pvc.Spec.VolumeName, err)
+	}
+	nfsExport, err := getNFSExport(pv)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to extract NFS export from PV %s: %v", pv.Name, err)
+	}
+	klog.V(3).Infof("NFS export for volume %s: %s", dvName, nfsExport)
+
+	// Parse NFS URL for CiliumNetworkPolicy port
+	_, port, _, err := parseNFSExport(nfsExport)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to parse NFS export URL: %v", err)
+	}
+
+	// Create or update CiliumNetworkPolicy allowing egress to NFS server
+	cnpName := fmt.Sprintf("csi-nfs-%s", dvName)
+	vmiOwnerRef := map[string]interface{}{
+		"apiVersion": "kubevirt.io/v1",
+		"kind":       "VirtualMachineInstance",
+		"name":       vmName,
+		"uid":        string(vmi.UID),
+	}
+	cnp := &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": "cilium.io/v2",
+			"kind":       "CiliumNetworkPolicy",
+			"metadata": map[string]interface{}{
+				"name":            cnpName,
+				"namespace":       vmNamespace,
+				"ownerReferences": []interface{}{vmiOwnerRef},
+			},
+			"spec": map[string]interface{}{
+				"endpointSelector": map[string]interface{}{},
+				"egress": []interface{}{
+					map[string]interface{}{
+						"toEndpoints": []interface{}{
+							map[string]interface{}{
+								"matchLabels": map[string]interface{}{
+									"k8s:app.kubernetes.io/component": "linstor-csi-nfs-server",
+									"k8s:io.kubernetes.pod.namespace": "cozy-linstor",
+								},
+							},
+						},
+						"toPorts": []interface{}{
+							map[string]interface{}{
+								"ports": []interface{}{
+									map[string]interface{}{
+										"port":     port,
+										"protocol": "TCP",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	if _, err := w.dynamicClient.Resource(ciliumNetworkPolicyGVR).Namespace(vmNamespace).Create(ctx, cnp, metav1.CreateOptions{}); err != nil {
+		if !errors.IsAlreadyExists(err) {
+			return nil, status.Errorf(codes.Internal, "failed to create CiliumNetworkPolicy %s: %v", cnpName, err)
+		}
+		// CNP exists — add ownerReference for this VMI
+		if err := w.addCNPOwnerReference(ctx, vmNamespace, cnpName, vmiOwnerRef); err != nil {
+			return nil, err
+		}
+	}
+
+	klog.V(3).Infof("Successfully published NFS volume %s", dvName)
+	return &csi.ControllerPublishVolumeResponse{
+		PublishContext: map[string]string{
+			nfsExportKey: nfsExport,
+		},
+	}, nil
+}
+
+// ControllerUnpublishVolume for NFS volumes: deletes CiliumNetworkPolicy.
+// For RWO volumes, delegates to upstream (hotplug removal).
+func (w *WrappedControllerService) ControllerUnpublishVolume(ctx context.Context, req *csi.ControllerUnpublishVolumeRequest) (*csi.ControllerUnpublishVolumeResponse, error) {
+	dvName := req.GetVolumeId()
+
+	// Determine if NFS by checking infra PVC access modes
+	pvc, err := w.infraClient.CoreV1().PersistentVolumeClaims(w.infraNamespace).Get(ctx, dvName, metav1.GetOptions{})
+	if err != nil {
+		if errors.IsNotFound(err) {
+			return &csi.ControllerUnpublishVolumeResponse{}, nil
+		}
+		return nil, err
+	}
+
+	if !hasRWXAccessMode(pvc) {
+		return w.ControllerService.ControllerUnpublishVolume(ctx, req)
+	}
+
+	// NFS volume: remove VMI ownerReference from CiliumNetworkPolicy
+	vmNamespace, vmName, err := cache.SplitMetaNamespaceKey(req.GetNodeId())
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to parse node ID %q: %v", req.GetNodeId(), err)
+	}
+
+	cnpName := fmt.Sprintf("csi-nfs-%s", dvName)
+	klog.V(3).Infof("Removing VMI %s ownerReference from CiliumNetworkPolicy %s/%s", vmName, vmNamespace, cnpName)
+	if err := w.removeCNPOwnerReference(ctx, vmNamespace, cnpName, vmName); err != nil {
+		return nil, err
+	}
+
+	klog.V(3).Infof("Successfully unpublished NFS volume %s", dvName)
+	return &csi.ControllerUnpublishVolumeResponse{}, nil
+}
+
+// ControllerExpandVolume delegates to upstream for the actual DataVolume/PVC resize.
+// For NFS volumes, LINSTOR handles NFS server resize automatically, so no node expansion is needed.
+func (w *WrappedControllerService) ControllerExpandVolume(ctx context.Context, req *csi.ControllerExpandVolumeRequest) (*csi.ControllerExpandVolumeResponse, error) {
+	resp, err := w.ControllerService.ControllerExpandVolume(ctx, req)
+	if err != nil {
+		return nil, err
+	}
+
+	// For NFS volumes, no node-side expansion is needed
+	pvc, err := w.infraClient.CoreV1().PersistentVolumeClaims(w.infraNamespace).Get(ctx, req.GetVolumeId(), metav1.GetOptions{})
+	if err == nil && hasRWXAccessMode(pvc) {
+		resp.NodeExpansionRequired = false
+	}
+
+	return resp, nil
+}
+
+// addCNPOwnerReference adds a VMI ownerReference to an existing CiliumNetworkPolicy.
+func (w *WrappedControllerService) addCNPOwnerReference(ctx context.Context, namespace, cnpName string, ownerRef map[string]interface{}) error {
+	existing, err := w.dynamicClient.Resource(ciliumNetworkPolicyGVR).Namespace(namespace).Get(ctx, cnpName, metav1.GetOptions{})
+	if err != nil {
+		return status.Errorf(codes.Internal, "failed to get CiliumNetworkPolicy %s: %v", cnpName, err)
+	}
+
+	ownerRefs, _, _ := unstructured.NestedSlice(existing.Object, "metadata", "ownerReferences")
+	uid, _, _ := unstructured.NestedString(ownerRef, "uid")
+	for _, ref := range ownerRefs {
+		if refMap, ok := ref.(map[string]interface{}); ok {
+			if refMap["uid"] == uid {
+				return nil // already present
+			}
+		}
+	}
+
+	ownerRefs = append(ownerRefs, ownerRef)
+	if err := unstructured.SetNestedSlice(existing.Object, ownerRefs, "metadata", "ownerReferences"); err != nil {
+		return status.Errorf(codes.Internal, "failed to set ownerReferences: %v", err)
+	}
+	if _, err := w.dynamicClient.Resource(ciliumNetworkPolicyGVR).Namespace(namespace).Update(ctx, existing, metav1.UpdateOptions{}); err != nil {
+		return status.Errorf(codes.Internal, "failed to update CiliumNetworkPolicy %s: %v", cnpName, err)
+	}
+	klog.V(3).Infof("Added ownerReference to CiliumNetworkPolicy %s", cnpName)
+	return nil
+}
+
+// removeCNPOwnerReference removes a VMI ownerReference from a CiliumNetworkPolicy.
+// Deletes the CNP if no ownerReferences remain.
+func (w *WrappedControllerService) removeCNPOwnerReference(ctx context.Context, namespace, cnpName, vmName string) error {
+	existing, err := w.dynamicClient.Resource(ciliumNetworkPolicyGVR).Namespace(namespace).Get(ctx, cnpName, metav1.GetOptions{})
+	if err != nil {
+		if errors.IsNotFound(err) {
+			return nil
+		}
+		return status.Errorf(codes.Internal, "failed to get CiliumNetworkPolicy %s: %v", cnpName, err)
+	}
+
+	ownerRefs, _, _ := unstructured.NestedSlice(existing.Object, "metadata", "ownerReferences")
+	var remaining []interface{}
+	for _, ref := range ownerRefs {
+		if refMap, ok := ref.(map[string]interface{}); ok {
+			if refMap["name"] == vmName {
+				continue
+			}
+		}
+		remaining = append(remaining, ref)
+	}
+
+	if len(remaining) == 0 {
+		// Last owner — delete CNP
+		if err := w.dynamicClient.Resource(ciliumNetworkPolicyGVR).Namespace(namespace).Delete(ctx, cnpName, metav1.DeleteOptions{}); err != nil {
+			if !errors.IsNotFound(err) {
+				return status.Errorf(codes.Internal, "failed to delete CiliumNetworkPolicy %s: %v", cnpName, err)
+			}
+		}
+		klog.V(3).Infof("Deleted CiliumNetworkPolicy %s (no more owners)", cnpName)
+		return nil
+	}
+
+	if err := unstructured.SetNestedSlice(existing.Object, remaining, "metadata", "ownerReferences"); err != nil {
+		return status.Errorf(codes.Internal, "failed to set ownerReferences: %v", err)
+	}
+	if _, err := w.dynamicClient.Resource(ciliumNetworkPolicyGVR).Namespace(namespace).Update(ctx, existing, metav1.UpdateOptions{}); err != nil {
+		return status.Errorf(codes.Internal, "failed to update CiliumNetworkPolicy %s: %v", cnpName, err)
+	}
+	klog.V(3).Infof("Removed VMI %s ownerReference from CiliumNetworkPolicy %s", vmName, cnpName)
+	return nil
+}
+
+func hasRWXAccessMode(pvc *corev1.PersistentVolumeClaim) bool {
+	for _, mode := range pvc.Spec.AccessModes {
+		if mode == corev1.ReadWriteMany {
+			return true
+		}
+	}
+	return false
+}
+
+// getNFSExport extracts the NFS export URL from a PersistentVolume.
+// Supports both native NFS PVs and CSI PVs with nfs-export volume attribute.
+func getNFSExport(pv *corev1.PersistentVolume) (string, error) {
+	if pv.Spec.NFS != nil {
+		return fmt.Sprintf("nfs://%s:2049%s", pv.Spec.NFS.Server, pv.Spec.NFS.Path), nil
+	}
+	if pv.Spec.CSI != nil && pv.Spec.CSI.VolumeAttributes != nil {
+		if export, ok := pv.Spec.CSI.VolumeAttributes["linstor.csi.linbit.com/nfs-export"]; ok {
+			return export, nil
+		}
+	}
+	return "", fmt.Errorf("no NFS export info found in PV %s", pv.Name)
+}
+
+// parseNFSExport parses an NFS URL of the form nfs://host:port/path.
+func parseNFSExport(nfsURL string) (host, port, path string, err error) {
+	u, err := url.Parse(nfsURL)
+	if err != nil {
+		return "", "", "", fmt.Errorf("failed to parse NFS URL %q: %w", nfsURL, err)
+	}
+	host = u.Hostname()
+	port = u.Port()
+	if port == "" {
+		port = "2049"
+	}
+	path = u.Path
+	if path == "" {
+		path = "/"
+	}
+	return host, port, path, nil
+}
diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/go.mod b/packages/apps/kubernetes/images/kubevirt-csi-driver/go.mod
new file mode 100644
index 00000000..96a96107
--- /dev/null
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/go.mod
@@ -0,0 +1,101 @@
+module cozystack.io/kubevirt-csi-driver
+
+go 1.22.0
+
+toolchain go1.22.5
+
+require (
+	github.com/container-storage-interface/spec v1.10.0
+	google.golang.org/grpc v1.65.0
+	gopkg.in/yaml.v2 v2.4.0
+	k8s.io/api v0.31.4
+	k8s.io/apimachinery v0.31.4
+	k8s.io/client-go v12.0.0+incompatible
+	k8s.io/klog/v2 v2.130.1
+	k8s.io/mount-utils v0.33.1
+	kubevirt.io/containerized-data-importer-api v1.59.0
+	kubevirt.io/csi-driver v0.0.0-20250702202414-a8d6605bc999
+)
+
+require (
+	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/swag v0.22.4 // indirect
+	github.com/godbus/dbus/v5 v5.1.0 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/mock v1.6.0 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/imdario/mergo v0.3.15 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/kubernetes-csi/csi-lib-utils v0.18.1 // indirect
+	github.com/kubernetes-csi/external-snapshotter/client/v6 v6.3.0 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/moby/sys/mountinfo v0.7.1 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/opencontainers/runc v1.1.13 // indirect
+	github.com/opencontainers/runtime-spec v1.0.3-0.20220909204839-494a5a6aca78 // indirect
+	github.com/openshift/api v0.0.0-20230503133300-8bbcb7ca7183 // indirect
+	github.com/openshift/custom-resource-status v1.1.2 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	golang.org/x/net v0.33.0 // indirect
+	golang.org/x/oauth2 v0.21.0 // indirect
+	golang.org/x/sys v0.28.0 // indirect
+	golang.org/x/term v0.27.0 // indirect
+	golang.org/x/text v0.21.0 // indirect
+	golang.org/x/time v0.3.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 // indirect
+	google.golang.org/protobuf v1.34.2 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/apiextensions-apiserver v0.26.4 // indirect
+	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
+	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
+	kubevirt.io/api v1.2.2 // indirect
+	kubevirt.io/controller-lifecycle-operator-sdk/api v0.0.0-20220329064328-f3cc58c6ed90 // indirect
+	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
+)
+
+replace (
+	k8s.io/api => k8s.io/api v0.31.4
+	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.31.4
+	k8s.io/apimachinery => k8s.io/apimachinery v0.31.4
+	k8s.io/apiserver => k8s.io/apiserver v0.31.4
+	k8s.io/cli-runtime => k8s.io/cli-runtime v0.31.4
+	k8s.io/client-go => k8s.io/client-go v0.31.4
+	k8s.io/cloud-provider => k8s.io/cloud-provider v0.31.4
+	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.31.4
+	k8s.io/code-generator => k8s.io/code-generator v0.31.4
+	k8s.io/component-base => k8s.io/component-base v0.31.4
+	k8s.io/component-helpers => k8s.io/component-helpers v0.31.4
+	k8s.io/controller-manager => k8s.io/controller-manager v0.31.4
+	k8s.io/cri-api => k8s.io/cri-api v0.31.4
+	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.31.4
+	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.31.4
+	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.31.4
+	k8s.io/kube-proxy => k8s.io/kube-proxy v0.31.4
+	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.31.4
+	k8s.io/kubectl => k8s.io/kubectl v0.31.4
+	k8s.io/kubelet => k8s.io/kubelet v0.31.4
+	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.31.4
+	k8s.io/metrics => k8s.io/metrics v0.31.4
+	k8s.io/mount-utils => k8s.io/mount-utils v0.31.4
+	k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.31.4
+	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.31.4
+	kubevirt.io/csi-driver => github.com/kubevirt/csi-driver v0.0.0-20250702202414-a8d6605bc999
+)
diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/go.sum b/packages/apps/kubernetes/images/kubevirt-csi-driver/go.sum
new file mode 100644
index 00000000..a0c4ac81
--- /dev/null
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/go.sum
@@ -0,0 +1,543 @@
+github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
+github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
+github.com/chromedp/cdproto v0.0.0-20230802225258-3cf4e6d46a89/go.mod h1:GKljq0VrfU4D5yc+2qA6OVr8pmO/MBbPEWqWQ/oqGEs=
+github.com/chromedp/chromedp v0.9.2/go.mod h1:LkSXJKONWTCHAfQasKFUZI+mxqS4tZqhmtGzzhLsnLs=
+github.com/chromedp/sysutil v1.0.0/go.mod h1:kgWmDdq8fTzXYcKIBqIYvRRTnYb9aNS9moAV0xufSww=
+github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
+github.com/chzyer/logex v1.2.1/go.mod h1:JLbx6lG2kDbNRFnfkgvh4eRJRPX1QCoOIWomwysCBrQ=
+github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
+github.com/chzyer/readline v1.5.1/go.mod h1:Eh+b79XXUwfKfcPLepksvw2tcLE/Ct21YObkaSkeBlk=
+github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38GC8=
+github.com/container-storage-interface/spec v1.10.0 h1:YkzWPV39x+ZMTa6Ax2czJLLwpryrQ+dPesB34mrRMXA=
+github.com/container-storage-interface/spec v1.10.0/go.mod h1:DtUvaQszPml1YJfIK7c00mlv6/g4wNMLanLgiUbKFRI=
+github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
+github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/emicklei/go-restful v2.15.0+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/emicklei/go-restful/v3 v3.8.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
+github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
+github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/getkin/kin-openapi v0.76.0/go.mod h1:660oXbgy5JFMKreazJaQTw7o+X00qeSyhcnluiMv+Xg=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
+github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
+github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
+github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
+github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
+github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8=
+github.com/go-openapi/jsonreference v0.19.6/go.mod h1:diGHMEHg2IqXZGKxqyvWdfWU/aim5Dprw5bqpKkTvns=
+github.com/go-openapi/jsonreference v0.20.1/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
+github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
+github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
+github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/go-openapi/swag v0.21.1/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
+github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
+github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
+github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
+github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
+github.com/gobwas/ws v1.2.1/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/KY=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
+github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
+github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
+github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
+github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6/go.mod h1:kf6iHlnVGwgKolg33glAes7Yg/8iWP8ukqeldJSO7jw=
+github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af h1:kmjWCqn2qkEml422C2Rrd27c3VGxi6a/6HNq8QmHRKM=
+github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/gnostic v0.5.1/go.mod h1:6U4PtQXGIEt/Z3h5MAT7FNofLnw9vXk2cUuW7uA/OeU=
+github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/ianlancetaylor/demangle v0.0.0-20240312041847-bd984b5ce465/go.mod h1:gx7rwoVhcfuVKG5uya9Hs3Sxj7EIvldVofAWIUtGouw=
+github.com/imdario/mergo v0.3.15 h1:M8XP7IuFNsqUx6VPK2P9OSmsYsI/YFaGil0uD21V3dM=
+github.com/imdario/mergo v0.3.15/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kubernetes-csi/csi-lib-utils v0.18.1 h1:vpg1kbQ6lFVCz7mY71zcqVE7W0GAQXXBoFfHvbW3gdw=
+github.com/kubernetes-csi/csi-lib-utils v0.18.1/go.mod h1:PIcn27zmbY0KBue4JDdZVfDF56tjcS3jKroZPi+pMoY=
+github.com/kubernetes-csi/external-snapshotter/client/v6 v6.3.0 h1:qS4r4ljINLWKJ9m9Ge3Q3sGZ/eIoDVDT2RhAdQFHb1k=
+github.com/kubernetes-csi/external-snapshotter/client/v6 v6.3.0/go.mod h1:oGXx2XTEzs9ikW2V6IC1dD8trgjRsS/Mvc2JRiC618Y=
+github.com/kubevirt/csi-driver v0.0.0-20250702202414-a8d6605bc999 h1:nq11swNPIRarVZm/YTOWh9rbuEqivgpA1c4RUEFSL90=
+github.com/kubevirt/csi-driver v0.0.0-20250702202414-a8d6605bc999/go.mod h1:Pzl14YlqPpoK/ZdS79tUSuHbC2L/NPqOIjFTN5kTmUg=
+github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80/go.mod h1:imJHygn/1yfhB7XSJJKlFZKl/J+dCPAknuiaGOshXAs=
+github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
+github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/moby/spdystream v0.4.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
+github.com/moby/sys/mountinfo v0.7.1 h1:/tTvQaSJRr2FshkhXiIpux6fQ2Zvc4j7tAhMTStAG2g=
+github.com/moby/sys/mountinfo v0.7.1/go.mod h1:IJb6JQeOklcdMU9F5xQ8ZALD+CUr5VlGpwtX+VE0rpI=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
+github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
+github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
+github.com/onsi/ginkgo v1.16.4 h1:29JGrr5oVBm5ulCWet69zQkzWipVXIol6ygQUe/EzNc=
+github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
+github.com/onsi/ginkgo/v2 v2.0.0/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
+github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
+github.com/onsi/ginkgo/v2 v2.1.4/go.mod h1:um6tUpWM/cxCK3/FK8BXqEiUMUwRgSM4JXG47RKZmLU=
+github.com/onsi/ginkgo/v2 v2.1.6/go.mod h1:MEH45j8TBi6u9BMogfbp0stKC5cdGjumZj5Y7AG4VIk=
+github.com/onsi/ginkgo/v2 v2.3.0/go.mod h1:Eew0uilEqZmIEZr8JrvYlvOM7Rr6xzTmMV8AyFNU9d0=
+github.com/onsi/ginkgo/v2 v2.4.0/go.mod h1:iHkDK1fKGcBoEHT5W7YBq4RFWaQulw+caOMkAt4OrFo=
+github.com/onsi/ginkgo/v2 v2.5.0/go.mod h1:Luc4sArBICYCS8THh8v3i3i5CuSZO+RaQRaJoeNwomw=
+github.com/onsi/ginkgo/v2 v2.7.0/go.mod h1:yjiuMwPokqY1XauOgju45q3sJt6VzQ/Fict1LFVcsAo=
+github.com/onsi/ginkgo/v2 v2.8.1/go.mod h1:N1/NbDngAFcSLdyZ+/aYTYGSlq9qMCS/cNKGJjy+csc=
+github.com/onsi/ginkgo/v2 v2.9.0/go.mod h1:4xkjoL/tZv4SMWeww56BU5kAt19mVB47gTWxmrTcxyk=
+github.com/onsi/ginkgo/v2 v2.9.1/go.mod h1:FEcmzVcCHl+4o9bQZVab+4dC9+j+91t2FHSzmGAPfuo=
+github.com/onsi/ginkgo/v2 v2.9.2/go.mod h1:WHcJJG2dIlcCqVfBAwUCrJxSPFb6v4azBwgxeMeDuts=
+github.com/onsi/ginkgo/v2 v2.9.5/go.mod h1:tvAoo1QUJwNEU2ITftXTpR7R1RbCzoZUOs3RonqW57k=
+github.com/onsi/ginkgo/v2 v2.9.7/go.mod h1:cxrmXWykAwTwhQsJOPfdIDiJ+l2RYq7U8hFU+M/1uw0=
+github.com/onsi/ginkgo/v2 v2.11.0/go.mod h1:ZhrRA5XmEE3x3rhlzamx/JJvujdZoJ2uvgI7kR0iZvM=
+github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o=
+github.com/onsi/ginkgo/v2 v2.17.1/go.mod h1:llBI3WDLL9Z6taip6f33H76YcWtJv+7R3HigUjbIBOs=
+github.com/onsi/ginkgo/v2 v2.17.2/go.mod h1:nP2DPOQoNsQmsVyv5rDA8JkXQoCs6goXIvr/PRJ1eCc=
+github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
+github.com/onsi/ginkgo/v2 v2.19.0/go.mod h1:rlwLi9PilAFJ8jCg9UE1QP6VBpd6/xj3SRC0d6TU0To=
+github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
+github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
+github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
+github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
+github.com/onsi/gomega v1.18.1/go.mod h1:0q+aL8jAiMXy9hbwj2mr5GziHiwhAIQpFmmtT5hitRs=
+github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro=
+github.com/onsi/gomega v1.20.1/go.mod h1:DtrZpjmvpn2mPm4YWQa0/ALMDj9v4YxLgojwPeREyVo=
+github.com/onsi/gomega v1.21.1/go.mod h1:iYAIXgPSaDHak0LCMA+AWBpIKBr8WZicMxnE8luStNc=
+github.com/onsi/gomega v1.22.1/go.mod h1:x6n7VNe4hw0vkyYUM4mjIXx3JbLiPaBPNgB7PRQ1tuM=
+github.com/onsi/gomega v1.24.0/go.mod h1:Z/NWtiqwBrwUt4/2loMmHL63EDLnYHmVbuBpDr2vQAg=
+github.com/onsi/gomega v1.24.1/go.mod h1:3AOiACssS3/MajrniINInwbfOOtfZvplPzuRSmvt1jM=
+github.com/onsi/gomega v1.26.0/go.mod h1:r+zV744Re+DiYCIPRlYOTxn0YkOLcAnW8k1xXdMPGhM=
+github.com/onsi/gomega v1.27.1/go.mod h1:aHX5xOykVYzWOV4WqQy0sy8BQptgukenXpCXfadcIAw=
+github.com/onsi/gomega v1.27.3/go.mod h1:5vG284IBtfDAmDyrK+eGyZmUgUlmi+Wngqo557cZ6Gw=
+github.com/onsi/gomega v1.27.4/go.mod h1:riYq/GJKh8hhoM01HN6Vmuy93AarCXCBGpvFDK3q3fQ=
+github.com/onsi/gomega v1.27.6/go.mod h1:PIQNjfQwkP3aQAH7lf7j87O/5FiNr+ZR8+ipb+qQlhg=
+github.com/onsi/gomega v1.27.7/go.mod h1:1p8OOlwo2iUUDsHnOrjE5UKYJ+e3W8eQ3qSlRahPmr4=
+github.com/onsi/gomega v1.27.8/go.mod h1:2J8vzI/s+2shY9XHRApDkdgPo1TKT7P2u6fXeJKFnNQ=
+github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M=
+github.com/onsi/gomega v1.30.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
+github.com/onsi/gomega v1.33.0/go.mod h1:+925n5YtiFsLzzafLUHzVMBpvvRAzrydIBiSIxjX3wY=
+github.com/onsi/gomega v1.33.1 h1:dsYjIxxSR755MDmKVsaFQTE22ChNBcuuTWgkUDSubOk=
+github.com/onsi/gomega v1.33.1/go.mod h1:U4R44UsT+9eLIaYRB2a5qajjtQYn0hauxvRm16AVYg0=
+github.com/opencontainers/runc v1.1.13 h1:98S2srgG9vw0zWcDpFMn5TRrh8kLxa/5OFUstuUhmRs=
+github.com/opencontainers/runc v1.1.13/go.mod h1:R016aXacfp/gwQBYw2FDGa9m+n6atbLWrYY8hNMT/sA=
+github.com/opencontainers/runtime-spec v1.0.3-0.20220909204839-494a5a6aca78 h1:R5M2qXZiK/mWPMT4VldCOiSL9HIAMuxQZWdG0CSM5+4=
+github.com/opencontainers/runtime-spec v1.0.3-0.20220909204839-494a5a6aca78/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/openshift/api v0.0.0-20230503133300-8bbcb7ca7183 h1:t/CahSnpqY46sQR01SoS+Jt0jtjgmhgE6lFmRnO4q70=
+github.com/openshift/api v0.0.0-20230503133300-8bbcb7ca7183/go.mod h1:4VWG+W22wrB4HfBL88P40DxLEpSOaiBVxUnfalfJo9k=
+github.com/openshift/custom-resource-status v1.1.2 h1:C3DL44LEbvlbItfd8mT5jWrqPfHnSOQoQf/sypqA6A4=
+github.com/openshift/custom-resource-status v1.1.2/go.mod h1:DB/Mf2oTeiAmVVX1gN+NEqweonAPY0TKUwADizj8+ZA=
+github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
+golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
+golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
+golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
+golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
+golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
+golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
+golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
+golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc h1:mCRnTeVUjcrhlRmO0VK8a6k6Rrf6TF9htwo2pJVSjIU=
+golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc/go.mod h1:V1LtkGg67GoY2N1AnLN78QLrzxkLyJw7RJb1gzOOz9w=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
+golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.6.0/go.mod h1:4mET923SAdbXp2ki8ey+zGs1SLqsuM2Y0uvdZR/fUNI=
+golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/net v0.0.0-20210421230115-4e50805a0758/go.mod h1:72T/g9IO56b78aLF+1Kcs5dz7/ng1VjMUvfKvpfy+jM=
+golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
+golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
+golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
+golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
+golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
+golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
+golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
+golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
+golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs=
+golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210420072515-93ed5bcd2bfe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220422013727-9388b58f7150/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/telemetry v0.0.0-20240208230135-b75ee8823808/go.mod h1:KG1lNk5ZFNssSZLrpVb4sMXKMpGwGXOxSG3rnu2gZQQ=
+golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
+golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
+golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o=
+golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
+golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
+golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
+golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=
+golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
+golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
+golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
+golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
+golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200505023115-26f46d2f7ef8/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.9/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
+golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.2.0/go.mod h1:y4OqIKeOV/fWJetJ8bXPU1sEVniLMIyDAZWeHdV+NTA=
+golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
+golang.org/x/tools v0.9.1/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc=
+golang.org/x/tools v0.9.3/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc=
+golang.org/x/tools v0.12.0/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.16.1/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
+golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
+golang.org/x/tools v0.18.0/go.mod h1:GL7B4CwcLLeo59yx/9UWWuNOW1n3VZ4f5axWfML7Lcg=
+golang.org/x/tools v0.20.0/go.mod h1:WvitBU7JJf6A4jOdg4S1tviW9bhUxkgeCui/0JHctQg=
+golang.org/x/tools v0.21.0/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 h1:BwIjyKYGsK9dMCBOorzRri8MQwmi7mT9rGHsCEinZkA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
+google.golang.org/grpc v1.65.0 h1:bs/cUb4lp1G5iImFFd3u5ixQzweKizoZJAwBNLR42lc=
+google.golang.org/grpc v1.65.0/go.mod h1:WgYC2ypjlB0EiQi6wdKixMqukr6lBc0Vo+oOgjrM5ZQ=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
+google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
+gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+k8s.io/api v0.31.4 h1:I2QNzitPVsPeLQvexMEsj945QumYraqv9m74isPDKhM=
+k8s.io/api v0.31.4/go.mod h1:d+7vgXLvmcdT1BCo79VEgJxHHryww3V5np2OYTr6jdw=
+k8s.io/apiextensions-apiserver v0.31.4 h1:FxbqzSvy92Ca9DIs5jqot883G0Ln/PGXfm/07t39LS0=
+k8s.io/apiextensions-apiserver v0.31.4/go.mod h1:hIW9YU8UsqZqIWGG99/gsdIU0Ar45Qd3A12QOe/rvpg=
+k8s.io/apimachinery v0.31.4 h1:8xjE2C4CzhYVm9DGf60yohpNUh5AEBnPxCryPBECmlM=
+k8s.io/apimachinery v0.31.4/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
+k8s.io/client-go v0.31.4 h1:t4QEXt4jgHIkKKlx06+W3+1JOwAFU/2OPiOo7H92eRQ=
+k8s.io/client-go v0.31.4/go.mod h1:kvuMro4sFYIa8sulL5Gi5GFqUPvfH2O/dXuKstbaaeg=
+k8s.io/code-generator v0.31.4/go.mod h1:yMDt13Kn7m4MMZ4LxB1KBzdZjEyxzdT4b4qXq+lnI90=
+k8s.io/gengo v0.0.0-20210813121822-485abfe95c7c/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
+k8s.io/gengo v0.0.0-20211129171323-c02415ce4185/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
+k8s.io/gengo/v2 v2.0.0-20240228010128-51d4e06bde70/go.mod h1:VH3AT8AaQOqiGjMF9p0/IM1Dj+82ZwjfxUP1IxaHE+8=
+k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
+k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
+k8s.io/klog/v2 v2.40.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
+k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
+k8s.io/klog/v2 v2.120.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
+k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-openapi v0.0.0-20220124234850-424119656bbf/go.mod h1:sX9MT8g7NVZM5lVL/j8QyCCJe8YSMW30QvGZWaCIDIk=
+k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 h1:BZqlfIlq5YbRMFko6/PM7FjZpUb45WallggurYhKGag=
+k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340/go.mod h1:yD4MZYeKMBwQKVht279WycxKyM84kkAx2DPrTXaeb98=
+k8s.io/mount-utils v0.31.4 h1:9aWJ5BpJvs6fdIo36wWIuCC6ZMNllUT0JSFsVNJloFI=
+k8s.io/mount-utils v0.31.4/go.mod h1:HV/VYBUGqYUj4vt82YltzpWvgv8FPg0G9ItyInT3NPU=
+k8s.io/utils v0.0.0-20210802155522-efc7438f0176/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
+k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
+k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+kubevirt.io/api v1.2.2 h1:PeA937vsZawmKAsiiDQZJ/BbGH4OhEWsIzWrCNfmYXk=
+kubevirt.io/api v1.2.2/go.mod h1:SbeR9ma4EwnaOZEUkh/lNz0kzYm5LPpEDE30vKXC5Zg=
+kubevirt.io/containerized-data-importer-api v1.59.0 h1:GdDt9BlR0qHejpMaPfASbsG8JWDmBf1s7xZBj5W9qn0=
+kubevirt.io/containerized-data-importer-api v1.59.0/go.mod h1:4yOGtCE7HvgKp7wftZZ3TBvDJ0x9d6N6KaRjRYcUFpE=
+kubevirt.io/controller-lifecycle-operator-sdk/api v0.0.0-20220329064328-f3cc58c6ed90 h1:QMrd0nKP0BGbnxTqakhDZAUhGKxPiPiN5gSDqKUmGGc=
+kubevirt.io/controller-lifecycle-operator-sdk/api v0.0.0-20220329064328-f3cc58c6ed90/go.mod h1:018lASpFYBsYN6XwmA2TIrPCx6e0gviTd/ZNtSitKgc=
+sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
+sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
+sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
+sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
+sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
+sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/main.go b/packages/apps/kubernetes/images/kubevirt-csi-driver/main.go
new file mode 100644
index 00000000..3d4d8e83
--- /dev/null
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/main.go
@@ -0,0 +1,219 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"os"
+	"strings"
+
+	csi "github.com/container-storage-interface/spec/lib/go/csi"
+	"gopkg.in/yaml.v2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+	klog "k8s.io/klog/v2"
+	mount "k8s.io/mount-utils"
+
+	snapcli "kubevirt.io/csi-driver/pkg/generated/external-snapshotter/client-go/clientset/versioned"
+	"kubevirt.io/csi-driver/pkg/kubevirt"
+	"kubevirt.io/csi-driver/pkg/service"
+	"kubevirt.io/csi-driver/pkg/util"
+)
+
+var (
+	endpoint               = flag.String("endpoint", "unix:/csi/csi.sock", "CSI endpoint")
+	nodeName               = flag.String("node-name", "", "The node name - the node this pods runs on")
+	infraClusterNamespace  = flag.String("infra-cluster-namespace", "", "The infra-cluster namespace")
+	infraClusterKubeconfig = flag.String("infra-cluster-kubeconfig", "", "the infra-cluster kubeconfig file. If not set, defaults to in cluster config.")
+	infraClusterLabels     = flag.String("infra-cluster-labels", "", "The infra-cluster labels to use when creating resources in infra cluster. 'name=value' fields separated by a comma")
+	volumePrefix           = flag.String("volume-prefix", "pvc", "The prefix expected for persistent volumes")
+
+	infraStorageClassEnforcement = os.Getenv("INFRA_STORAGE_CLASS_ENFORCEMENT")
+
+	tenantClusterKubeconfig = flag.String("tenant-cluster-kubeconfig", "", "the tenant cluster kubeconfig file. If not set, defaults to in cluster config.")
+
+	runNodeService       = flag.Bool("run-node-service", true, "Specifies rather or not to run the node service, the default is true")
+	runControllerService = flag.Bool("run-controller-service", true, "Specifies rather or not to run the controller service, the default is true")
+)
+
+func init() {
+	klog.InitFlags(nil)
+}
+
+func main() {
+	flag.Parse()
+	handle()
+	os.Exit(0)
+}
+
+func handle() {
+	var tenantRestConfig *rest.Config
+	var infraRestConfig *rest.Config
+	var identityClientset *kubernetes.Clientset
+
+	if service.VendorVersion == "" {
+		klog.Fatal("VendorVersion must be set at compile time")
+	}
+	klog.V(2).Infof("Driver vendor %v %v", service.VendorName, service.VendorVersion)
+
+	if (infraClusterLabels == nil || *infraClusterLabels == "") && !*runNodeService {
+		klog.Fatal("infra-cluster-labels must be set")
+	}
+	if volumePrefix == nil || *volumePrefix == "" {
+		klog.Fatal("volume-prefix must be set")
+	}
+
+	inClusterConfig, err := rest.InClusterConfig()
+	if err != nil {
+		klog.Fatalf("Failed to build in cluster config: %v", err)
+	}
+
+	if *tenantClusterKubeconfig != "" {
+		tenantRestConfig, err = clientcmd.BuildConfigFromFlags("", *tenantClusterKubeconfig)
+		if err != nil {
+			klog.Fatalf("failed to build tenant cluster config: %v", err)
+		}
+	} else {
+		tenantRestConfig = inClusterConfig
+	}
+
+	if *infraClusterKubeconfig != "" {
+		infraRestConfig, err = clientcmd.BuildConfigFromFlags("", *infraClusterKubeconfig)
+		if err != nil {
+			klog.Fatalf("failed to build infra cluster config: %v", err)
+		}
+	} else {
+		infraRestConfig = inClusterConfig
+	}
+
+	tenantClientSet, err := kubernetes.NewForConfig(tenantRestConfig)
+	if err != nil {
+		klog.Fatalf("Failed to build tenant client set: %v", err)
+	}
+	tenantSnapshotClientSet, err := snapcli.NewForConfig(tenantRestConfig)
+	if err != nil {
+		klog.Fatalf("Failed to build tenant snapshot client set: %v", err)
+	}
+
+	infraClusterLabelsMap := parseLabels()
+	klog.V(5).Infof("Storage class enforcement string: \n%s", infraStorageClassEnforcement)
+	storageClassEnforcement := configureStorageClassEnforcement(infraStorageClassEnforcement)
+
+	virtClient, err := kubevirt.NewClient(infraRestConfig, infraClusterLabelsMap, tenantClientSet, tenantSnapshotClientSet, storageClassEnforcement, *volumePrefix)
+	if err != nil {
+		klog.Fatal(err)
+	}
+
+	var nodeID string
+	if *nodeName != "" {
+		node, err := tenantClientSet.CoreV1().Nodes().Get(context.TODO(), *nodeName, v1.GetOptions{})
+		if err != nil {
+			klog.Fatal(fmt.Errorf("failed to find node by name %v: %v", nodeName, err))
+		}
+		if node.Spec.ProviderID == "" {
+			klog.Fatal("provider name missing from node, something's not right")
+		}
+		vmName := strings.TrimPrefix(node.Spec.ProviderID, `kubevirt://`)
+		vmNamespace, ok := node.Annotations["cluster.x-k8s.io/cluster-namespace"]
+		if !ok {
+			klog.Fatal("cannot infer infra vm namespace")
+		}
+		nodeID = fmt.Sprintf("%s/%s", vmNamespace, vmName)
+		klog.Infof("Node name: %v, Node ID: %s", *nodeName, nodeID)
+	}
+
+	identityClientset = tenantClientSet
+	if *runControllerService {
+		identityClientset, err = kubernetes.NewForConfig(infraRestConfig)
+		if err != nil {
+			klog.Fatalf("Failed to build infra client set: %v", err)
+		}
+	}
+
+	// Create upstream driver (provides Identity, Controller, Node services)
+	upstreamDriver := service.NewKubevirtCSIDriver(virtClient,
+		identityClientset,
+		*infraClusterNamespace,
+		infraClusterLabelsMap,
+		storageClassEnforcement,
+		nodeID,
+		*runNodeService,
+		*runControllerService)
+
+	// Wrap controller and node services with NFS/RWX support
+	var cs csi.ControllerServer
+	if *runControllerService {
+		infraKubernetesClient, err := kubernetes.NewForConfig(infraRestConfig)
+		if err != nil {
+			klog.Fatalf("Failed to build infra kubernetes client: %v", err)
+		}
+		infraDynamicClient, err := dynamic.NewForConfig(infraRestConfig)
+		if err != nil {
+			klog.Fatalf("Failed to build infra dynamic client: %v", err)
+		}
+		cs = &WrappedControllerService{
+			ControllerService:       upstreamDriver.ControllerService,
+			infraClient:             infraKubernetesClient,
+			dynamicClient:           infraDynamicClient,
+			virtClient:              virtClient,
+			infraNamespace:          *infraClusterNamespace,
+			infraClusterLabels:      infraClusterLabelsMap,
+			storageClassEnforcement: storageClassEnforcement,
+		}
+	}
+
+	var ns csi.NodeServer
+	if *runNodeService {
+		ns = &WrappedNodeService{
+			NodeService: upstreamDriver.NodeService,
+			mounter:     mount.New(""),
+		}
+	}
+
+	// Run gRPC server with upstream Identity + wrapped Controller/Node
+	s := service.NewNonBlockingGRPCServer()
+	s.Start(*endpoint, upstreamDriver.IdentityService, cs, ns)
+	s.Wait()
+}
+
+func configureStorageClassEnforcement(infraStorageClassEnforcement string) util.StorageClassEnforcement {
+	var storageClassEnforcement util.StorageClassEnforcement
+
+	if infraStorageClassEnforcement == "" {
+		storageClassEnforcement = util.StorageClassEnforcement{
+			AllowAll:     true,
+			AllowDefault: true,
+		}
+	} else {
+		err := yaml.Unmarshal([]byte(infraStorageClassEnforcement), &storageClassEnforcement)
+		if err != nil {
+			klog.Fatalf("Failed to parse infra-storage-class-enforcement %v", err)
+		}
+	}
+	return storageClassEnforcement
+}
+
+func parseLabels() map[string]string {
+	infraClusterLabelsMap := map[string]string{}
+
+	if *infraClusterLabels == "" {
+		return infraClusterLabelsMap
+	}
+
+	labelStrings := strings.Split(*infraClusterLabels, ",")
+
+	for _, label := range labelStrings {
+		labelPair := strings.SplitN(label, "=", 2)
+
+		if len(labelPair) != 2 {
+			panic("Bad labels format. Should be 'key=value,key=value,...'")
+		}
+
+		infraClusterLabelsMap[labelPair[0]] = labelPair[1]
+	}
+
+	return infraClusterLabelsMap
+}
diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go b/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go
new file mode 100644
index 00000000..2260900b
--- /dev/null
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go
@@ -0,0 +1,106 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	csi "github.com/container-storage-interface/spec/lib/go/csi"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"k8s.io/klog/v2"
+	mount "k8s.io/mount-utils"
+
+	"kubevirt.io/csi-driver/pkg/service"
+)
+
+var _ csi.NodeServer = &WrappedNodeService{}
+
+// WrappedNodeService embeds the upstream NodeService and adds NFS mount support.
+type WrappedNodeService struct {
+	*service.NodeService
+	mounter mount.Interface
+}
+
+// NodeStageVolume for NFS volumes is a no-op (NFS doesn't need staging).
+// For RWO volumes, delegates to upstream (lsblk + mkfs).
+func (w *WrappedNodeService) NodeStageVolume(ctx context.Context, req *csi.NodeStageVolumeRequest) (*csi.NodeStageVolumeResponse, error) {
+	if req.GetPublishContext()[nfsExportKey] != "" {
+		klog.V(3).Infof("NFS volume %s: skipping stage", req.GetVolumeId())
+		return &csi.NodeStageVolumeResponse{}, nil
+	}
+	return w.NodeService.NodeStageVolume(ctx, req)
+}
+
+// NodePublishVolume for NFS volumes: mounts NFS at the target path.
+// For RWO volumes, delegates to upstream (mount block device).
+func (w *WrappedNodeService) NodePublishVolume(ctx context.Context, req *csi.NodePublishVolumeRequest) (*csi.NodePublishVolumeResponse, error) {
+	nfsExport := req.GetPublishContext()[nfsExportKey]
+	if nfsExport == "" {
+		return w.NodeService.NodePublishVolume(ctx, req)
+	}
+
+	klog.V(3).Infof("Publishing NFS volume %s at %s", req.GetVolumeId(), req.GetTargetPath())
+
+	host, port, path, err := parseNFSExport(nfsExport)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to parse NFS export: %v", err)
+	}
+
+	targetPath := req.GetTargetPath()
+
+	// Check if already mounted
+	notMnt, err := w.mounter.IsLikelyNotMountPoint(targetPath)
+	if err != nil {
+		if !os.IsNotExist(err) {
+			return nil, status.Errorf(codes.Internal, "failed to check mount point %s: %v", targetPath, err)
+		}
+		if err := os.MkdirAll(targetPath, 0750); err != nil {
+			return nil, status.Errorf(codes.Internal, "failed to create target path %s: %v", targetPath, err)
+		}
+		notMnt = true
+	}
+
+	if !notMnt {
+		klog.V(3).Infof("NFS volume %s already mounted at %s", req.GetVolumeId(), targetPath)
+		return &csi.NodePublishVolumeResponse{}, nil
+	}
+
+	source := fmt.Sprintf("%s:%s", host, path)
+	mountOptions := []string{
+		"nfsvers=4.2",
+		fmt.Sprintf("port=%s", port),
+	}
+
+	klog.V(3).Infof("Mounting NFS %s at %s with options %v", source, targetPath, mountOptions)
+	if err := w.mounter.Mount(source, targetPath, "nfs", mountOptions); err != nil {
+		return nil, status.Errorf(codes.Internal, "NFS mount of %s at %s failed: %v", source, targetPath, err)
+	}
+
+	return &csi.NodePublishVolumeResponse{}, nil
+}
+
+// NodeExpandVolume for NFS volumes is a no-op (LINSTOR handles NFS resize automatically).
+// This should not normally be called for NFS since ControllerExpandVolume returns
+// NodeExpansionRequired=false, but we handle it gracefully as a safety net.
+func (w *WrappedNodeService) NodeExpandVolume(ctx context.Context, req *csi.NodeExpandVolumeRequest) (*csi.NodeExpandVolumeResponse, error) {
+	if isNFSMount(req.GetVolumePath(), w.mounter) {
+		klog.V(3).Infof("NFS volume %s: skipping node expansion", req.GetVolumeId())
+		return &csi.NodeExpandVolumeResponse{}, nil
+	}
+	return w.NodeService.NodeExpandVolume(ctx, req)
+}
+
+// isNFSMount checks if the given path is an NFS mount point.
+func isNFSMount(path string, m mount.Interface) bool {
+	mountPoints, err := m.List()
+	if err != nil {
+		return false
+	}
+	for _, mp := range mountPoints {
+		if mp.Path == path && (mp.Type == "nfs" || mp.Type == "nfs4") {
+			return true
+		}
+	}
+	return false
+}
diff --git a/packages/apps/kubernetes/templates/csi/deploy.yaml b/packages/apps/kubernetes/templates/csi/deploy.yaml
index b79a6d64..938b6d67 100644
--- a/packages/apps/kubernetes/templates/csi/deploy.yaml
+++ b/packages/apps/kubernetes/templates/csi/deploy.yaml
@@ -32,6 +32,7 @@ spec:
             - "--endpoint=$(CSI_ENDPOINT)"
             - "--infra-cluster-namespace=$(INFRACLUSTER_NAMESPACE)"
             - "--infra-cluster-labels=$(INFRACLUSTER_LABELS)"
+            - "--run-node-service=false"
             - "--v=5"
           ports:
             - name: healthz
diff --git a/packages/apps/kubernetes/templates/csi/infra-cluster-service-account.yaml b/packages/apps/kubernetes/templates/csi/infra-cluster-service-account.yaml
index 793871d2..fb11ab25 100644
--- a/packages/apps/kubernetes/templates/csi/infra-cluster-service-account.yaml
+++ b/packages/apps/kubernetes/templates/csi/infra-cluster-service-account.yaml
@@ -24,6 +24,9 @@ rules:
 - apiGroups: [""]
   resources: ["persistentvolumeclaims"]
   verbs: ["get", "patch"]
+- apiGroups: ["cilium.io"]
+  resources: ["ciliumnetworkpolicies"]
+  verbs: ["get", "create", "update", "delete"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
diff --git a/packages/system/kubevirt-csi-node/templates/deploy.yaml b/packages/system/kubevirt-csi-node/templates/deploy.yaml
index ed3b43fb..4e95bf77 100644
--- a/packages/system/kubevirt-csi-node/templates/deploy.yaml
+++ b/packages/system/kubevirt-csi-node/templates/deploy.yaml
@@ -167,6 +167,7 @@ spec:
           args:
             - "--endpoint=unix:/csi/csi.sock"
             - "--node-name=$(KUBE_NODE_NAME)"
+            - "--run-controller-service=false"
             - "--v=5"
           env:
             - name: KUBE_NODE_NAME
diff --git a/packages/system/kubevirt-csi-node/values.yaml b/packages/system/kubevirt-csi-node/values.yaml
index cf8b4fa8..f7fd69a1 100644
--- a/packages/system/kubevirt-csi-node/values.yaml
+++ b/packages/system/kubevirt-csi-node/values.yaml
@@ -1,3 +1,3 @@
 storageClass: replicated
 csiDriver:
-  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:8f1ab4c3b2bed3a0adc40fcc823b040fa04b4722bec7735c030e79a3a2fd6c85
+  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:latest@sha256:cd58760c97ba50ef74ff940cdcda4b9a6d8554eec8305fc96c2e8bbea72b75a9

From 46103400f2ccec25a848878d7c875c7d531e5956 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 12 Feb 2026 23:27:44 +0100
Subject: [PATCH 028/666] test(e2e): adapt kubernetes NFS test for native RWX
 CSI support

Remove separate NFS Application dependency from e2e test. The kubevirt
CSI driver wrapper now handles RWX Filesystem volumes natively - PVCs
with ReadWriteMany accessMode use the standard kubevirt StorageClass.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 hack/e2e-apps/run-kubernetes.sh      | 55 ++++++++++++++++++++++++++++
 packages/apps/kubernetes/.helmignore |  1 +
 2 files changed, 56 insertions(+)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index 3e2e20f9..c62ae131 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -218,6 +218,61 @@ fi
   kubectl delete deployment --kubeconfig tenantkubeconfig-${test_name} "${test_name}-backend" -n tenant-test
   kubectl delete service --kubeconfig tenantkubeconfig-${test_name} "${test_name}-backend" -n tenant-test
 
+  # Test RWX NFS mount in tenant cluster (uses kubevirt CSI driver with RWX support)
+  kubectl --kubeconfig tenantkubeconfig-${test_name} apply -f - <<EOF
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nfs-test-pvc
+  namespace: tenant-test
+spec:
+  accessModes:
+  - ReadWriteMany
+  storageClassName: kubevirt
+  resources:
+    requests:
+      storage: 1Gi
+EOF
+
+  # Wait for PVC to be bound
+  kubectl --kubeconfig tenantkubeconfig-${test_name} wait pvc nfs-test-pvc -n tenant-test --timeout=2m --for=jsonpath='{.status.phase}'=Bound
+
+  # Create Pod that writes and reads data from NFS volume
+  kubectl --kubeconfig tenantkubeconfig-${test_name} apply -f - <<EOF
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nfs-test-pod
+  namespace: tenant-test
+spec:
+  containers:
+  - name: test
+    image: busybox
+    command: ["sh", "-c", "echo 'nfs-mount-ok' > /data/test.txt && cat /data/test.txt"]
+    volumeMounts:
+    - name: nfs-vol
+      mountPath: /data
+  volumes:
+  - name: nfs-vol
+    persistentVolumeClaim:
+      claimName: nfs-test-pvc
+  restartPolicy: Never
+EOF
+
+  # Wait for Pod to complete successfully
+  kubectl --kubeconfig tenantkubeconfig-${test_name} wait pod nfs-test-pod -n tenant-test --timeout=2m --for=jsonpath='{.status.phase}'=Succeeded
+
+  # Verify NFS data integrity
+  nfs_result=$(kubectl --kubeconfig tenantkubeconfig-${test_name} logs nfs-test-pod -n tenant-test)
+  if [ "$nfs_result" != "nfs-mount-ok" ]; then
+    echo "NFS mount test failed: expected 'nfs-mount-ok', got '$nfs_result'" >&2
+    exit 1
+  fi
+
+  # Cleanup NFS test resources in tenant cluster
+  kubectl --kubeconfig tenantkubeconfig-${test_name} delete pod nfs-test-pod -n tenant-test
+  kubectl --kubeconfig tenantkubeconfig-${test_name} delete pvc nfs-test-pvc -n tenant-test
+
   # Wait for all machine deployment replicas to be ready (timeout after 10 minutes)
   kubectl wait machinedeployment kubernetes-${test_name}-md0 -n tenant-test --timeout=10m --for=jsonpath='{.status.v1beta2.readyReplicas}'=2
 
diff --git a/packages/apps/kubernetes/.helmignore b/packages/apps/kubernetes/.helmignore
index 3de7d4a5..cdada667 100644
--- a/packages/apps/kubernetes/.helmignore
+++ b/packages/apps/kubernetes/.helmignore
@@ -2,3 +2,4 @@
 /logos
 /Makefile
 /hack
+/images/*/*

From 168f6f2445a629e24a9e326c86063bda84e567df Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Fri, 13 Feb 2026 09:04:33 +0100
Subject: [PATCH 029/666] fix(csi): address review feedback for
 kubevirt-csi-driver RWX support

- Move nil check before req dereference in CreateVolume
- Scope CiliumNetworkPolicy endpointSelector to specific VMI
- Use vmNamespace from NodeId for VMI lookup instead of infraNamespace
- Log PVC lookup errors in ControllerExpandVolume
- Wrap CNP ownerReference updates in retry.RetryOnConflict
- Fix infraClusterLabels validation to check runControllerService flag
- Dereference nodeName pointer in error message
- Replace panic with klog.Fatal for consistent error handling
- Honor CSI readonly flag in NFS NodePublishVolume
- Log mount list errors in isNFSMount
- Reorder Dockerfile ENTRYPOINT after COPY for better layer caching
- Add cleanup on e2e test failure and --wait on pod deletion

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 hack/e2e-apps/run-kubernetes.sh               |   4 +-
 .../images/kubevirt-csi-driver/Dockerfile     |   4 +-
 .../images/kubevirt-csi-driver/controller.go  | 129 ++++++++++--------
 .../images/kubevirt-csi-driver/main.go        |   6 +-
 .../images/kubevirt-csi-driver/node.go        |   4 +
 5 files changed, 82 insertions(+), 65 deletions(-)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index c62ae131..5b8b1b4b 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -266,11 +266,13 @@ EOF
   nfs_result=$(kubectl --kubeconfig tenantkubeconfig-${test_name} logs nfs-test-pod -n tenant-test)
   if [ "$nfs_result" != "nfs-mount-ok" ]; then
     echo "NFS mount test failed: expected 'nfs-mount-ok', got '$nfs_result'" >&2
+    kubectl --kubeconfig tenantkubeconfig-${test_name} delete pod nfs-test-pod -n tenant-test --wait=false 2>/dev/null || true
+    kubectl --kubeconfig tenantkubeconfig-${test_name} delete pvc nfs-test-pvc -n tenant-test --wait=false 2>/dev/null || true
     exit 1
   fi
 
   # Cleanup NFS test resources in tenant cluster
-  kubectl --kubeconfig tenantkubeconfig-${test_name} delete pod nfs-test-pod -n tenant-test
+  kubectl --kubeconfig tenantkubeconfig-${test_name} delete pod nfs-test-pod -n tenant-test --wait
   kubectl --kubeconfig tenantkubeconfig-${test_name} delete pvc nfs-test-pvc -n tenant-test
 
   # Wait for all machine deployment replicas to be ready (timeout after 10 minutes)
diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/Dockerfile b/packages/apps/kubernetes/images/kubevirt-csi-driver/Dockerfile
index be8125d7..b156d08e 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver/Dockerfile
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/Dockerfile
@@ -16,8 +16,8 @@ RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build \
 
 FROM quay.io/centos/centos:stream9
 
-ENTRYPOINT ["./kubevirt-csi-driver"]
-
 RUN dnf install -y e2fsprogs xfsprogs nfs-utils && dnf clean all
 
 COPY --from=builder /src/kubevirt-csi-driver .
+
+ENTRYPOINT ["./kubevirt-csi-driver"]
diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/controller.go b/packages/apps/kubernetes/images/kubevirt-csi-driver/controller.go
index 524b45ea..7192b95b 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver/controller.go
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/controller.go
@@ -19,6 +19,7 @@ import (
 	"k8s.io/client-go/dynamic"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/tools/cache"
+	"k8s.io/client-go/util/retry"
 	"k8s.io/klog/v2"
 	cdiv1 "kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1"
 
@@ -77,13 +78,13 @@ func isRWXFilesystem(caps []*csi.VolumeCapability) bool {
 // compatibility with upstream snapshot and clone operations.
 // For all other requests, delegates to upstream.
 func (w *WrappedControllerService) CreateVolume(ctx context.Context, req *csi.CreateVolumeRequest) (*csi.CreateVolumeResponse, error) {
+	if req == nil {
+		return nil, status.Error(codes.InvalidArgument, "missing request")
+	}
 	if !isRWXFilesystem(req.GetVolumeCapabilities()) {
 		return w.ControllerService.CreateVolume(ctx, req)
 	}
 
-	if req == nil {
-		return nil, status.Error(codes.InvalidArgument, "missing request")
-	}
 	if len(req.GetName()) == 0 {
 		return nil, status.Error(codes.InvalidArgument, "name missing in request")
 	}
@@ -260,9 +261,9 @@ func (w *WrappedControllerService) ControllerPublishVolume(ctx context.Context,
 	klog.V(3).Infof("Publishing NFS volume %s to node %s/%s", dvName, vmNamespace, vmName)
 
 	// Get VMI for CiliumNetworkPolicy ownerReference
-	vmi, err := w.virtClient.GetVirtualMachine(ctx, w.infraNamespace, vmName)
+	vmi, err := w.virtClient.GetVirtualMachine(ctx, vmNamespace, vmName)
 	if err != nil {
-		return nil, status.Errorf(codes.Internal, "failed to get VMI %s: %v", vmName, err)
+		return nil, status.Errorf(codes.Internal, "failed to get VMI %s/%s: %v", vmNamespace, vmName, err)
 	}
 
 	// Wait for PVC to be bound (CDI handles immediate binding via annotation)
@@ -316,7 +317,11 @@ func (w *WrappedControllerService) ControllerPublishVolume(ctx context.Context,
 				"ownerReferences": []interface{}{vmiOwnerRef},
 			},
 			"spec": map[string]interface{}{
-				"endpointSelector": map[string]interface{}{},
+				"endpointSelector": map[string]interface{}{
+					"matchLabels": map[string]interface{}{
+						"kubevirt.io/vm": vmName,
+					},
+				},
 				"egress": []interface{}{
 					map[string]interface{}{
 						"toEndpoints": []interface{}{
@@ -405,7 +410,9 @@ func (w *WrappedControllerService) ControllerExpandVolume(ctx context.Context, r
 
 	// For NFS volumes, no node-side expansion is needed
 	pvc, err := w.infraClient.CoreV1().PersistentVolumeClaims(w.infraNamespace).Get(ctx, req.GetVolumeId(), metav1.GetOptions{})
-	if err == nil && hasRWXAccessMode(pvc) {
+	if err != nil {
+		klog.Warningf("Failed to check PVC access mode for %s/%s: %v", w.infraNamespace, req.GetVolumeId(), err)
+	} else if hasRWXAccessMode(pvc) {
 		resp.NodeExpansionRequired = false
 	}
 
@@ -414,73 +421,77 @@ func (w *WrappedControllerService) ControllerExpandVolume(ctx context.Context, r
 
 // addCNPOwnerReference adds a VMI ownerReference to an existing CiliumNetworkPolicy.
 func (w *WrappedControllerService) addCNPOwnerReference(ctx context.Context, namespace, cnpName string, ownerRef map[string]interface{}) error {
-	existing, err := w.dynamicClient.Resource(ciliumNetworkPolicyGVR).Namespace(namespace).Get(ctx, cnpName, metav1.GetOptions{})
-	if err != nil {
-		return status.Errorf(codes.Internal, "failed to get CiliumNetworkPolicy %s: %v", cnpName, err)
-	}
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		existing, err := w.dynamicClient.Resource(ciliumNetworkPolicyGVR).Namespace(namespace).Get(ctx, cnpName, metav1.GetOptions{})
+		if err != nil {
+			return status.Errorf(codes.Internal, "failed to get CiliumNetworkPolicy %s: %v", cnpName, err)
+		}
 
-	ownerRefs, _, _ := unstructured.NestedSlice(existing.Object, "metadata", "ownerReferences")
-	uid, _, _ := unstructured.NestedString(ownerRef, "uid")
-	for _, ref := range ownerRefs {
-		if refMap, ok := ref.(map[string]interface{}); ok {
-			if refMap["uid"] == uid {
-				return nil // already present
+		ownerRefs, _, _ := unstructured.NestedSlice(existing.Object, "metadata", "ownerReferences")
+		uid, _, _ := unstructured.NestedString(ownerRef, "uid")
+		for _, ref := range ownerRefs {
+			if refMap, ok := ref.(map[string]interface{}); ok {
+				if refMap["uid"] == uid {
+					return nil // already present
+				}
 			}
 		}
-	}
 
-	ownerRefs = append(ownerRefs, ownerRef)
-	if err := unstructured.SetNestedSlice(existing.Object, ownerRefs, "metadata", "ownerReferences"); err != nil {
-		return status.Errorf(codes.Internal, "failed to set ownerReferences: %v", err)
-	}
-	if _, err := w.dynamicClient.Resource(ciliumNetworkPolicyGVR).Namespace(namespace).Update(ctx, existing, metav1.UpdateOptions{}); err != nil {
-		return status.Errorf(codes.Internal, "failed to update CiliumNetworkPolicy %s: %v", cnpName, err)
-	}
-	klog.V(3).Infof("Added ownerReference to CiliumNetworkPolicy %s", cnpName)
-	return nil
+		ownerRefs = append(ownerRefs, ownerRef)
+		if err := unstructured.SetNestedSlice(existing.Object, ownerRefs, "metadata", "ownerReferences"); err != nil {
+			return status.Errorf(codes.Internal, "failed to set ownerReferences: %v", err)
+		}
+		if _, err := w.dynamicClient.Resource(ciliumNetworkPolicyGVR).Namespace(namespace).Update(ctx, existing, metav1.UpdateOptions{}); err != nil {
+			return err
+		}
+		klog.V(3).Infof("Added ownerReference to CiliumNetworkPolicy %s", cnpName)
+		return nil
+	})
 }
 
 // removeCNPOwnerReference removes a VMI ownerReference from a CiliumNetworkPolicy.
 // Deletes the CNP if no ownerReferences remain.
 func (w *WrappedControllerService) removeCNPOwnerReference(ctx context.Context, namespace, cnpName, vmName string) error {
-	existing, err := w.dynamicClient.Resource(ciliumNetworkPolicyGVR).Namespace(namespace).Get(ctx, cnpName, metav1.GetOptions{})
-	if err != nil {
-		if errors.IsNotFound(err) {
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		existing, err := w.dynamicClient.Resource(ciliumNetworkPolicyGVR).Namespace(namespace).Get(ctx, cnpName, metav1.GetOptions{})
+		if err != nil {
+			if errors.IsNotFound(err) {
+				return nil
+			}
+			return status.Errorf(codes.Internal, "failed to get CiliumNetworkPolicy %s: %v", cnpName, err)
+		}
+
+		ownerRefs, _, _ := unstructured.NestedSlice(existing.Object, "metadata", "ownerReferences")
+		var remaining []interface{}
+		for _, ref := range ownerRefs {
+			if refMap, ok := ref.(map[string]interface{}); ok {
+				if refMap["name"] == vmName {
+					continue
+				}
+			}
+			remaining = append(remaining, ref)
+		}
+
+		if len(remaining) == 0 {
+			// Last owner — delete CNP
+			if err := w.dynamicClient.Resource(ciliumNetworkPolicyGVR).Namespace(namespace).Delete(ctx, cnpName, metav1.DeleteOptions{}); err != nil {
+				if !errors.IsNotFound(err) {
+					return status.Errorf(codes.Internal, "failed to delete CiliumNetworkPolicy %s: %v", cnpName, err)
+				}
+			}
+			klog.V(3).Infof("Deleted CiliumNetworkPolicy %s (no more owners)", cnpName)
 			return nil
 		}
-		return status.Errorf(codes.Internal, "failed to get CiliumNetworkPolicy %s: %v", cnpName, err)
-	}
 
-	ownerRefs, _, _ := unstructured.NestedSlice(existing.Object, "metadata", "ownerReferences")
-	var remaining []interface{}
-	for _, ref := range ownerRefs {
-		if refMap, ok := ref.(map[string]interface{}); ok {
-			if refMap["name"] == vmName {
-				continue
-			}
+		if err := unstructured.SetNestedSlice(existing.Object, remaining, "metadata", "ownerReferences"); err != nil {
+			return status.Errorf(codes.Internal, "failed to set ownerReferences: %v", err)
 		}
-		remaining = append(remaining, ref)
-	}
-
-	if len(remaining) == 0 {
-		// Last owner — delete CNP
-		if err := w.dynamicClient.Resource(ciliumNetworkPolicyGVR).Namespace(namespace).Delete(ctx, cnpName, metav1.DeleteOptions{}); err != nil {
-			if !errors.IsNotFound(err) {
-				return status.Errorf(codes.Internal, "failed to delete CiliumNetworkPolicy %s: %v", cnpName, err)
-			}
+		if _, err := w.dynamicClient.Resource(ciliumNetworkPolicyGVR).Namespace(namespace).Update(ctx, existing, metav1.UpdateOptions{}); err != nil {
+			return err
 		}
-		klog.V(3).Infof("Deleted CiliumNetworkPolicy %s (no more owners)", cnpName)
+		klog.V(3).Infof("Removed VMI %s ownerReference from CiliumNetworkPolicy %s", vmName, cnpName)
 		return nil
-	}
-
-	if err := unstructured.SetNestedSlice(existing.Object, remaining, "metadata", "ownerReferences"); err != nil {
-		return status.Errorf(codes.Internal, "failed to set ownerReferences: %v", err)
-	}
-	if _, err := w.dynamicClient.Resource(ciliumNetworkPolicyGVR).Namespace(namespace).Update(ctx, existing, metav1.UpdateOptions{}); err != nil {
-		return status.Errorf(codes.Internal, "failed to update CiliumNetworkPolicy %s: %v", cnpName, err)
-	}
-	klog.V(3).Infof("Removed VMI %s ownerReference from CiliumNetworkPolicy %s", vmName, cnpName)
-	return nil
+	})
 }
 
 func hasRWXAccessMode(pvc *corev1.PersistentVolumeClaim) bool {
diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/main.go b/packages/apps/kubernetes/images/kubevirt-csi-driver/main.go
index 3d4d8e83..396cee42 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver/main.go
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/main.go
@@ -59,7 +59,7 @@ func handle() {
 	}
 	klog.V(2).Infof("Driver vendor %v %v", service.VendorName, service.VendorVersion)
 
-	if (infraClusterLabels == nil || *infraClusterLabels == "") && !*runNodeService {
+	if (infraClusterLabels == nil || *infraClusterLabels == "") && *runControllerService {
 		klog.Fatal("infra-cluster-labels must be set")
 	}
 	if volumePrefix == nil || *volumePrefix == "" {
@@ -111,7 +111,7 @@ func handle() {
 	if *nodeName != "" {
 		node, err := tenantClientSet.CoreV1().Nodes().Get(context.TODO(), *nodeName, v1.GetOptions{})
 		if err != nil {
-			klog.Fatal(fmt.Errorf("failed to find node by name %v: %v", nodeName, err))
+			klog.Fatal(fmt.Errorf("failed to find node by name %v: %v", *nodeName, err))
 		}
 		if node.Spec.ProviderID == "" {
 			klog.Fatal("provider name missing from node, something's not right")
@@ -209,7 +209,7 @@ func parseLabels() map[string]string {
 		labelPair := strings.SplitN(label, "=", 2)
 
 		if len(labelPair) != 2 {
-			panic("Bad labels format. Should be 'key=value,key=value,...'")
+			klog.Fatal("Bad labels format. Should be 'key=value,key=value,...'")
 		}
 
 		infraClusterLabelsMap[labelPair[0]] = labelPair[1]
diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go b/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go
index 2260900b..5636a1d5 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go
@@ -71,6 +71,9 @@ func (w *WrappedNodeService) NodePublishVolume(ctx context.Context, req *csi.Nod
 		"nfsvers=4.2",
 		fmt.Sprintf("port=%s", port),
 	}
+	if req.GetReadonly() {
+		mountOptions = append(mountOptions, "ro")
+	}
 
 	klog.V(3).Infof("Mounting NFS %s at %s with options %v", source, targetPath, mountOptions)
 	if err := w.mounter.Mount(source, targetPath, "nfs", mountOptions); err != nil {
@@ -95,6 +98,7 @@ func (w *WrappedNodeService) NodeExpandVolume(ctx context.Context, req *csi.Node
 func isNFSMount(path string, m mount.Interface) bool {
 	mountPoints, err := m.List()
 	if err != nil {
+		klog.Warningf("Failed to list mount points: %v", err)
 		return false
 	}
 	for _, mp := range mountPoints {

From 574c636761e8a990685d26c610985f17f34f57d5 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Fri, 13 Feb 2026 16:31:09 +0500
Subject: [PATCH 030/666] [cozystack-operator] Preserve existing suspend field
 in package reconciler

Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 internal/operator/package_reconciler.go | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/internal/operator/package_reconciler.go b/internal/operator/package_reconciler.go
index 79d78a87..e15f57ac 100644
--- a/internal/operator/package_reconciler.go
+++ b/internal/operator/package_reconciler.go
@@ -211,13 +211,13 @@ func (r *PackageReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
 					Namespace: "cozy-system",
 				},
 				Install: &helmv2.Install{
-				Timeout: &metav1.Duration{Duration: 10 * 60 * 1000000000}, // 10m
+					Timeout: &metav1.Duration{Duration: 10 * 60 * 1000000000}, // 10m
 					Remediation: &helmv2.InstallRemediation{
 						Retries: -1,
 					},
 				},
 				Upgrade: &helmv2.Upgrade{
-				Timeout: &metav1.Duration{Duration: 10 * 60 * 1000000000}, // 10m
+					Timeout: &metav1.Duration{Duration: 10 * 60 * 1000000000}, // 10m
 					Remediation: &helmv2.UpgradeRemediation{
 						Retries: -1,
 					},
@@ -387,6 +387,7 @@ func (r *PackageReconciler) createOrUpdateHelmRelease(ctx context.Context, hr *h
 	}
 	hr.SetAnnotations(annotations)
 
+	hr.Spec.Suspend = existing.Spec.Suspend
 	// Update Spec
 	existing.Spec = hr.Spec
 	existing.SetLabels(hr.GetLabels())
@@ -816,7 +817,7 @@ func (r *PackageReconciler) reconcileNamespaces(ctx context.Context, pkg *cozyv1
 func (r *PackageReconciler) createOrUpdateNamespace(ctx context.Context, namespace *corev1.Namespace) error {
 	// Ensure TypeMeta is set for server-side apply
 	namespace.SetGroupVersionKind(corev1.SchemeGroupVersion.WithKind("Namespace"))
-	
+
 	// Use server-side apply with field manager
 	// This is atomic and avoids race conditions from Get/Create/Update pattern
 	// Labels and annotations will be merged automatically by the server

From 371f67276a2989e385fd28e47c4de41e39ec3bf5 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Fri, 13 Feb 2026 16:34:00 +0100
Subject: [PATCH 031/666] fix(operator): use per-Package SSA field owner for
 namespace reconciliation

When multiple Packages share a namespace (e.g. cozystack.linstor and
cozystack.linstor-scheduler both use cozy-linstor), the shared SSA field
owner "cozystack-package-controller" caused a race condition: the last
Package to reconcile would overwrite the namespace labels set by others.

This meant that if cozystack.linstor set pod-security.kubernetes.io/enforce=
privileged and then cozystack.linstor-scheduler reconciled without the
privileged flag, SSA would remove the label. On Talos clusters (which
default to "baseline" PodSecurity enforcement), this caused privileged
satellite pods to be rejected with PodSecurity violations.

Fix by using per-Package field owners (cozystack-package-{name}), so each
Package independently manages its own namespace labels without interfering
with other Packages sharing the same namespace.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 internal/operator/package_reconciler.go | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/internal/operator/package_reconciler.go b/internal/operator/package_reconciler.go
index e15f57ac..b69539e4 100644
--- a/internal/operator/package_reconciler.go
+++ b/internal/operator/package_reconciler.go
@@ -803,7 +803,7 @@ func (r *PackageReconciler) reconcileNamespaces(ctx context.Context, pkg *cozyv1
 			namespace.Labels["pod-security.kubernetes.io/enforce"] = "privileged"
 		}
 
-		if err := r.createOrUpdateNamespace(ctx, namespace); err != nil {
+		if err := r.createOrUpdateNamespace(ctx, namespace, pkg.Name); err != nil {
 			logger.Error(err, "failed to reconcile namespace", "name", nsName, "privileged", info.privileged)
 			return fmt.Errorf("failed to reconcile namespace %s: %w", nsName, err)
 		}
@@ -813,16 +813,19 @@ func (r *PackageReconciler) reconcileNamespaces(ctx context.Context, pkg *cozyv1
 	return nil
 }
 
-// createOrUpdateNamespace creates or updates a namespace using server-side apply
-func (r *PackageReconciler) createOrUpdateNamespace(ctx context.Context, namespace *corev1.Namespace) error {
+// createOrUpdateNamespace creates or updates a namespace using server-side apply.
+// Each Package uses its own field owner to prevent different Packages sharing the same
+// namespace from overwriting each other's labels. This ensures that if any Package sets
+// the privileged PSA label, other Packages reconciling the same namespace won't remove it.
+func (r *PackageReconciler) createOrUpdateNamespace(ctx context.Context, namespace *corev1.Namespace, packageName string) error {
 	// Ensure TypeMeta is set for server-side apply
 	namespace.SetGroupVersionKind(corev1.SchemeGroupVersion.WithKind("Namespace"))
 
-	// Use server-side apply with field manager
-	// This is atomic and avoids race conditions from Get/Create/Update pattern
-	// Labels and annotations will be merged automatically by the server
-	// Each label/annotation key is treated as a separate field, so existing ones are preserved
-	return r.Patch(ctx, namespace, client.Apply, client.FieldOwner("cozystack-package-controller"))
+	// Use per-Package field owner to avoid conflicts between Packages sharing a namespace.
+	// ForceOwnership is needed to take over fields from the previous shared field owner
+	// ("cozystack-package-controller") during the transition.
+	fieldOwner := fmt.Sprintf("cozystack-package-%s", packageName)
+	return r.Patch(ctx, namespace, client.Apply, client.FieldOwner(fieldOwner), client.ForceOwnership)
 }
 
 // cleanupOrphanedHelmReleases removes HelmReleases that are no longer needed

From 6576b3bb8742a2c9ae8a238194d092ee0ddd5dd6 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Fri, 13 Feb 2026 17:08:01 +0100
Subject: [PATCH 032/666] fix(operator): resolve namespace privileged flag by
 checking all Packages

Instead of using per-Package SSA field owners (which is a workaround relying
on SSA mechanics), properly resolve whether a namespace should be privileged
by iterating all PackageSources and their active Packages. A namespace gets
the privileged PodSecurity label if ANY Package has a component with
privileged: true installed in it.

This fixes the race condition where Packages sharing a namespace (e.g.
linstor and linstor-scheduler in cozy-linstor) would overwrite each other's
labels depending on reconciliation order.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 internal/operator/package_reconciler.go | 126 +++++++++++++++---------
 1 file changed, 81 insertions(+), 45 deletions(-)

diff --git a/internal/operator/package_reconciler.go b/internal/operator/package_reconciler.go
index b69539e4..32e667e4 100644
--- a/internal/operator/package_reconciler.go
+++ b/internal/operator/package_reconciler.go
@@ -736,53 +736,39 @@ func (r *PackageReconciler) updateDependentPackagesDependencies(ctx context.Cont
 	return nil
 }
 
-// reconcileNamespaces creates or updates namespaces based on components in the variant
+// reconcileNamespaces creates or updates namespaces based on components in the variant.
+// For each namespace, it checks ALL Packages sharing that namespace to determine whether
+// the namespace should be privileged — it is privileged if ANY Package has a privileged
+// component installed in it.
 func (r *PackageReconciler) reconcileNamespaces(ctx context.Context, pkg *cozyv1alpha1.Package, variant *cozyv1alpha1.Variant) error {
 	logger := log.FromContext(ctx)
 
-	// Collect namespaces from components
-	// Map: namespace -> {isPrivileged}
-	type namespaceInfo struct {
-		privileged bool
-	}
-	namespacesMap := make(map[string]namespaceInfo)
-
+	// Collect namespaces from this Package's components
+	targetNamespaces := make(map[string]struct{})
 	for _, component := range variant.Components {
-		// Skip components without Install section
 		if component.Install == nil {
 			continue
 		}
-
-		// Check if component is disabled via Package spec
 		if pkgComponent, ok := pkg.Spec.Components[component.Name]; ok {
 			if pkgComponent.Enabled != nil && !*pkgComponent.Enabled {
 				continue
 			}
 		}
-
-		// Namespace must be set
 		namespace := component.Install.Namespace
 		if namespace == "" {
 			return fmt.Errorf("component %s has empty namespace in Install section", component.Name)
 		}
+		targetNamespaces[namespace] = struct{}{}
+	}
 
-		info, exists := namespacesMap[namespace]
-		if !exists {
-			info = namespaceInfo{
-				privileged: false,
-			}
-		}
-
-		// If component is privileged, mark namespace as privileged
-		if component.Install.Privileged {
-			info.privileged = true
-		}
-
-		namespacesMap[namespace] = info
+	// Determine which namespaces should be privileged by checking ALL Packages
+	privileged, err := r.resolvePrivilegedNamespaces(ctx, targetNamespaces)
+	if err != nil {
+		return fmt.Errorf("failed to resolve privileged namespaces: %w", err)
 	}
 
 	// Create or update all namespaces
-	for nsName, info := range namespacesMap {
+	for nsName := range targetNamespaces {
 		namespace := &corev1.Namespace{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:   nsName,
@@ -793,39 +779,89 @@ func (r *PackageReconciler) reconcileNamespaces(ctx context.Context, pkg *cozyv1
 			},
 		}
 
-		// Add system label only for non-tenant namespaces
 		if !strings.HasPrefix(nsName, "tenant-") {
 			namespace.Labels["cozystack.io/system"] = "true"
 		}
 
-		// Add privileged label if needed
-		if info.privileged {
+		if privileged[nsName] {
 			namespace.Labels["pod-security.kubernetes.io/enforce"] = "privileged"
 		}
 
-		if err := r.createOrUpdateNamespace(ctx, namespace, pkg.Name); err != nil {
-			logger.Error(err, "failed to reconcile namespace", "name", nsName, "privileged", info.privileged)
+		if err := r.createOrUpdateNamespace(ctx, namespace); err != nil {
+			logger.Error(err, "failed to reconcile namespace", "name", nsName, "privileged", privileged[nsName])
 			return fmt.Errorf("failed to reconcile namespace %s: %w", nsName, err)
 		}
-		logger.Info("reconciled namespace", "name", nsName, "privileged", info.privileged)
+		logger.Info("reconciled namespace", "name", nsName, "privileged", privileged[nsName])
 	}
 
 	return nil
 }
 
-// createOrUpdateNamespace creates or updates a namespace using server-side apply.
-// Each Package uses its own field owner to prevent different Packages sharing the same
-// namespace from overwriting each other's labels. This ensures that if any Package sets
-// the privileged PSA label, other Packages reconciling the same namespace won't remove it.
-func (r *PackageReconciler) createOrUpdateNamespace(ctx context.Context, namespace *corev1.Namespace, packageName string) error {
-	// Ensure TypeMeta is set for server-side apply
-	namespace.SetGroupVersionKind(corev1.SchemeGroupVersion.WithKind("Namespace"))
+// resolvePrivilegedNamespaces checks all PackageSources and their corresponding Packages
+// to determine which of the given namespaces require the privileged PodSecurity level.
+// A namespace is privileged if ANY active Package has a component with privileged: true in it.
+func (r *PackageReconciler) resolvePrivilegedNamespaces(ctx context.Context, namespaces map[string]struct{}) (map[string]bool, error) {
+	result := make(map[string]bool)
 
-	// Use per-Package field owner to avoid conflicts between Packages sharing a namespace.
-	// ForceOwnership is needed to take over fields from the previous shared field owner
-	// ("cozystack-package-controller") during the transition.
-	fieldOwner := fmt.Sprintf("cozystack-package-%s", packageName)
-	return r.Patch(ctx, namespace, client.Apply, client.FieldOwner(fieldOwner), client.ForceOwnership)
+	packageSources := &cozyv1alpha1.PackageSourceList{}
+	if err := r.List(ctx, packageSources); err != nil {
+		return nil, fmt.Errorf("failed to list PackageSources: %w", err)
+	}
+
+	for i := range packageSources.Items {
+		ps := &packageSources.Items[i]
+
+		// Check if a Package exists for this PackageSource
+		pkg := &cozyv1alpha1.Package{}
+		if err := r.Get(ctx, types.NamespacedName{Name: ps.Name}, pkg); err != nil {
+			if apierrors.IsNotFound(err) {
+				continue
+			}
+			return nil, fmt.Errorf("failed to get Package %s: %w", ps.Name, err)
+		}
+
+		// Resolve active variant
+		variantName := pkg.Spec.Variant
+		if variantName == "" {
+			variantName = "default"
+		}
+
+		var variant *cozyv1alpha1.Variant
+		for j := range ps.Spec.Variants {
+			if ps.Spec.Variants[j].Name == variantName {
+				variant = &ps.Spec.Variants[j]
+				break
+			}
+		}
+		if variant == nil {
+			continue
+		}
+
+		for _, component := range variant.Components {
+			if component.Install == nil {
+				continue
+			}
+			if pkgComponent, ok := pkg.Spec.Components[component.Name]; ok {
+				if pkgComponent.Enabled != nil && !*pkgComponent.Enabled {
+					continue
+				}
+			}
+			if _, relevant := namespaces[component.Install.Namespace]; !relevant {
+				continue
+			}
+			if component.Install.Privileged {
+				result[component.Install.Namespace] = true
+			}
+		}
+	}
+
+	return result, nil
+}
+
+// createOrUpdateNamespace creates or updates a namespace using server-side apply.
+func (r *PackageReconciler) createOrUpdateNamespace(ctx context.Context, namespace *corev1.Namespace) error {
+	namespace.SetGroupVersionKind(corev1.SchemeGroupVersion.WithKind("Namespace"))
+	return r.Patch(ctx, namespace, client.Apply, client.FieldOwner("cozystack-package-controller"), client.ForceOwnership)
 }
 
 // cleanupOrphanedHelmReleases removes HelmReleases that are no longer needed

From 62116030dc0bbd732e257879a2c284a49f2ed7db Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Fri, 13 Feb 2026 23:03:48 +0500
Subject: [PATCH 033/666] [etcd-operator] fix dependencies: add
 vertical-pod-autoscaler

Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/core/platform/sources/etcd-operator.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/core/platform/sources/etcd-operator.yaml b/packages/core/platform/sources/etcd-operator.yaml
index 599ed2a3..5f42a4a0 100644
--- a/packages/core/platform/sources/etcd-operator.yaml
+++ b/packages/core/platform/sources/etcd-operator.yaml
@@ -14,6 +14,7 @@ spec:
     dependsOn:
     - cozystack.networking
     - cozystack.cert-manager
+    - cozystack.vertical-pod-autoscaler
     components:
     - name: etcd-operator
       path: system/etcd-operator

From 88baceae2c3297ece860b47928814b5c567307e1 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Sat, 14 Feb 2026 01:59:40 +0100
Subject: [PATCH 034/666] [platform] Make cozystack-api reconciliation always
 use Deployment

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 cmd/cozystack-controller/main.go              | 12 ++-------
 .../applicationdefinition_controller.go       | 26 +++++--------------
 .../templates/deployment.yaml                 |  3 ---
 .../system/cozystack-controller/values.yaml   |  1 -
 4 files changed, 9 insertions(+), 33 deletions(-)

diff --git a/cmd/cozystack-controller/main.go b/cmd/cozystack-controller/main.go
index 82fc673c..77c4f9dc 100644
--- a/cmd/cozystack-controller/main.go
+++ b/cmd/cozystack-controller/main.go
@@ -68,7 +68,6 @@ func main() {
 	var disableTelemetry bool
 	var telemetryEndpoint string
 	var telemetryInterval string
-	var reconcileDeployment bool
 	var tlsOpts []func(*tls.Config)
 	flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+
 		"Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.")
@@ -86,8 +85,6 @@ func main() {
 		"Endpoint for sending telemetry data")
 	flag.StringVar(&telemetryInterval, "telemetry-interval", "15m",
 		"Interval between telemetry data collection (e.g. 15m, 1h)")
-	flag.BoolVar(&reconcileDeployment, "reconcile-deployment", false,
-		"If set, the Cozystack API server is assumed to run as a Deployment, else as a DaemonSet.")
 	opts := zap.Options{
 		Development: false,
 	}
@@ -196,14 +193,9 @@ func main() {
 		os.Exit(1)
 	}
 
-	cozyAPIKind := "DaemonSet"
-	if reconcileDeployment {
-		cozyAPIKind = "Deployment"
-	}
 	if err = (&controller.ApplicationDefinitionReconciler{
-		Client:           mgr.GetClient(),
-		Scheme:           mgr.GetScheme(),
-		CozystackAPIKind: cozyAPIKind,
+		Client: mgr.GetClient(),
+		Scheme: mgr.GetScheme(),
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "ApplicationDefinitionReconciler")
 		os.Exit(1)
diff --git a/internal/controller/applicationdefinition_controller.go b/internal/controller/applicationdefinition_controller.go
index e5920b4c..6ce25249 100644
--- a/internal/controller/applicationdefinition_controller.go
+++ b/internal/controller/applicationdefinition_controller.go
@@ -32,8 +32,6 @@ type ApplicationDefinitionReconciler struct {
 	mu          sync.Mutex
 	lastEvent   time.Time
 	lastHandled time.Time
-
-	CozystackAPIKind string
 }
 
 func (r *ApplicationDefinitionReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
@@ -67,7 +65,7 @@ func (r *ApplicationDefinitionReconciler) SetupWithManager(mgr ctrl.Manager) err
 }
 
 type appDefHashView struct {
-	Name string                                `json:"name"`
+	Name string                                 `json:"name"`
 	Spec cozyv1alpha1.ApplicationDefinitionSpec `json:"spec"`
 }
 
@@ -155,23 +153,13 @@ func (r *ApplicationDefinitionReconciler) getWorkload(
 	ctx context.Context,
 	key types.NamespacedName,
 ) (tpl *corev1.PodTemplateSpec, obj client.Object, patch client.Patch, err error) {
-	if r.CozystackAPIKind == "Deployment" {
-		dep := &appsv1.Deployment{}
-		if err := r.Get(ctx, key, dep); err != nil {
-			return nil, nil, nil, err
-		}
-		obj = dep
-		tpl = &dep.Spec.Template
-		patch = client.MergeFrom(dep.DeepCopy())
-	} else {
-		ds := &appsv1.DaemonSet{}
-		if err := r.Get(ctx, key, ds); err != nil {
-			return nil, nil, nil, err
-		}
-		obj = ds
-		tpl = &ds.Spec.Template
-		patch = client.MergeFrom(ds.DeepCopy())
+	dep := &appsv1.Deployment{}
+	if err := r.Get(ctx, key, dep); err != nil {
+		return nil, nil, nil, err
 	}
+	obj = dep
+	tpl = &dep.Spec.Template
+	patch = client.MergeFrom(dep.DeepCopy())
 	if tpl.Annotations == nil {
 		tpl.Annotations = make(map[string]string)
 	}
diff --git a/packages/system/cozystack-controller/templates/deployment.yaml b/packages/system/cozystack-controller/templates/deployment.yaml
index 201aeb72..aab7bbe1 100644
--- a/packages/system/cozystack-controller/templates/deployment.yaml
+++ b/packages/system/cozystack-controller/templates/deployment.yaml
@@ -27,6 +27,3 @@ spec:
         {{- if .Values.cozystackController.disableTelemetry }}
         - --disable-telemetry
         {{- end }}
-        {{- if eq .Values.cozystackController.cozystackAPIKind "Deployment" }}
-        - --reconcile-deployment
-        {{- end }}
diff --git a/packages/system/cozystack-controller/values.yaml b/packages/system/cozystack-controller/values.yaml
index 2a1f9df4..908a955d 100644
--- a/packages/system/cozystack-controller/values.yaml
+++ b/packages/system/cozystack-controller/values.yaml
@@ -2,4 +2,3 @@ cozystackController:
   image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.0.0-beta.3@sha256:00b0ba15fef7c3ce8c0801ecb11b1953665a511990e18f51c2ca3ca40127c7aa
   debug: false
   disableTelemetry: false
-  cozystackAPIKind: "DaemonSet"

From b7e16aaa96a304bc683a083067ad72e8d1df5a4b Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Sat, 14 Feb 2026 02:49:47 +0100
Subject: [PATCH 035/666] Update kilo v0.7.1

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/system/kilo/Makefile    | 2 +-
 packages/system/kilo/values.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/system/kilo/Makefile b/packages/system/kilo/Makefile
index fcce8bd9..48dcb938 100644
--- a/packages/system/kilo/Makefile
+++ b/packages/system/kilo/Makefile
@@ -6,7 +6,7 @@ include ../../../hack/package.mk
 
 update:
 	tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/cozystack/kilo | awk -F'[/^]' 'END{print $$3}') && \
-	digest=$$(skopeo inspect --override-os linux --format '{{.Digest}}' docker://ghcr.io/cozystack/cozystack/kilo:$${tag}) && \
+	digest=$$(skopeo inspect --override-os linux --override-arch amd64 --format '{{.Digest}}' docker://ghcr.io/cozystack/cozystack/kilo:amd64-$${tag}) && \
 	REPOSITORY="ghcr.io/cozystack/cozystack/kilo" \
 		yq -i '.kilo.image.repository = strenv(REPOSITORY)' values.yaml && \
 	TAG="$${tag}@$${digest}" \
diff --git a/packages/system/kilo/values.yaml b/packages/system/kilo/values.yaml
index 279f62b0..762f3c26 100644
--- a/packages/system/kilo/values.yaml
+++ b/packages/system/kilo/values.yaml
@@ -1,7 +1,7 @@
 kilo:
   image:
     pullPolicy: IfNotPresent
-    tag: v0.7.0@sha256:69c14b8292c0dc9045fd646d332811619a2d93bcc1f9e19e11da9a9a172c988c
+    tag: v0.7.1@sha256:c2160097ef3aa4e9e460430665b743a14b8f19480211edab6f946264718340ff
     repository: ghcr.io/cozystack/cozystack/kilo
   podCIDR: 10.244.0.0/16
   serviceCIDR: 10.96.0.0/16

From 5568c0be9f0f76b5297d0499276ef031e4df39d8 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 12 Feb 2026 01:00:05 +0100
Subject: [PATCH 036/666] feat(vm-instance): port cpuModel, instancetype
 switching, and runStrategy changes

Port three features from virtual-machine to vm-instance:
- Add cpuModel field to specify CPU model without instanceType
- Allow switching between instancetype and custom resources via update hook
- Migrate from running boolean to runStrategy enum

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/apps/vm-instance/README.md           | 45 ++++++++---------
 .../apps/vm-instance/templates/_helpers.tpl   | 23 +++++++++
 .../vm-instance/templates/vm-update-hook.yaml | 48 +++++++++++++++++--
 packages/apps/vm-instance/templates/vm.yaml   | 22 +++++----
 packages/apps/vm-instance/values.schema.json  | 20 ++++++--
 packages/apps/vm-instance/values.yaml         | 14 +++++-
 .../vm-instance-rd/cozyrds/vm-instance.yaml   |  4 +-
 7 files changed, 133 insertions(+), 43 deletions(-)

diff --git a/packages/apps/vm-instance/README.md b/packages/apps/vm-instance/README.md
index dc63508a..11d1441d 100644
--- a/packages/apps/vm-instance/README.md
+++ b/packages/apps/vm-instance/README.md
@@ -36,28 +36,29 @@ virtctl ssh <user>@<vm>
 
 ### Common parameters
 
-| Name                | Description                                                         | Type       | Value       |
-| ------------------- | ------------------------------------------------------------------- | ---------- | ----------- |
-| `external`          | Enable external access from outside the cluster.                    | `bool`     | `false`     |
-| `externalMethod`    | Method to pass through traffic to the VM.                           | `string`   | `PortList`  |
-| `externalPorts`     | Ports to forward from outside the cluster.                          | `[]int`    | `[22]`      |
-| `running`           | Determines if the virtual machine should be running.                | `bool`     | `true`      |
-| `instanceType`      | Virtual Machine instance type.                                      | `string`   | `u1.medium` |
-| `instanceProfile`   | Virtual Machine preferences profile.                                | `string`   | `ubuntu`    |
-| `disks`             | List of disks to attach.                                            | `[]object` | `[]`        |
-| `disks[i].name`     | Disk name.                                                          | `string`   | `""`        |
-| `disks[i].bus`      | Disk bus type (e.g. "sata").                                        | `string`   | `""`        |
-| `subnets`           | Additional subnets                                                  | `[]object` | `[]`        |
-| `subnets[i].name`   | Subnet name                                                         | `string`   | `""`        |
-| `gpus`              | List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM). | `[]object` | `[]`        |
-| `gpus[i].name`      | The name of the GPU resource to attach.                             | `string`   | `""`        |
-| `resources`         | Resource configuration for the virtual machine.                     | `object`   | `{}`        |
-| `resources.cpu`     | Number of CPU cores allocated.                                      | `quantity` | `""`        |
-| `resources.memory`  | Amount of memory allocated.                                         | `quantity` | `""`        |
-| `resources.sockets` | Number of CPU sockets (vCPU topology).                              | `quantity` | `""`        |
-| `sshKeys`           | List of SSH public keys for authentication.                         | `[]string` | `[]`        |
-| `cloudInit`         | Cloud-init user data.                                               | `string`   | `""`        |
-| `cloudInitSeed`     | Seed string to generate SMBIOS UUID for the VM.                     | `string`   | `""`        |
+| Name                | Description                                                                                                                       | Type       | Value       |
+| ------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ---------- | ----------- |
+| `external`          | Enable external access from outside the cluster.                                                                                  | `bool`     | `false`     |
+| `externalMethod`    | Method to pass through traffic to the VM.                                                                                         | `string`   | `PortList`  |
+| `externalPorts`     | Ports to forward from outside the cluster.                                                                                        | `[]int`    | `[22]`      |
+| `runStrategy`       | Requested running state of the VirtualMachineInstance                                                                             | `string`   | `Always`    |
+| `instanceType`      | Virtual Machine instance type.                                                                                                    | `string`   | `u1.medium` |
+| `instanceProfile`   | Virtual Machine preferences profile.                                                                                              | `string`   | `ubuntu`    |
+| `disks`             | List of disks to attach.                                                                                                          | `[]object` | `[]`        |
+| `disks[i].name`     | Disk name.                                                                                                                        | `string`   | `""`        |
+| `disks[i].bus`      | Disk bus type (e.g. "sata").                                                                                                      | `string`   | `""`        |
+| `subnets`           | Additional subnets                                                                                                                | `[]object` | `[]`        |
+| `subnets[i].name`   | Subnet name                                                                                                                       | `string`   | `""`        |
+| `gpus`              | List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).                                                               | `[]object` | `[]`        |
+| `gpus[i].name`      | The name of the GPU resource to attach.                                                                                           | `string`   | `""`        |
+| `cpuModel`          | Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map | `string`   | `""`        |
+| `resources`         | Resource configuration for the virtual machine.                                                                                   | `object`   | `{}`        |
+| `resources.cpu`     | Number of CPU cores allocated.                                                                                                    | `quantity` | `""`        |
+| `resources.memory`  | Amount of memory allocated.                                                                                                       | `quantity` | `""`        |
+| `resources.sockets` | Number of CPU sockets (vCPU topology).                                                                                            | `quantity` | `""`        |
+| `sshKeys`           | List of SSH public keys for authentication.                                                                                       | `[]string` | `[]`        |
+| `cloudInit`         | Cloud-init user data.                                                                                                             | `string`   | `""`        |
+| `cloudInitSeed`     | Seed string to generate SMBIOS UUID for the VM.                                                                                   | `string`   | `""`        |
 
 
 ## U Series
diff --git a/packages/apps/vm-instance/templates/_helpers.tpl b/packages/apps/vm-instance/templates/_helpers.tpl
index e65cad9d..ddea90fe 100644
--- a/packages/apps/vm-instance/templates/_helpers.tpl
+++ b/packages/apps/vm-instance/templates/_helpers.tpl
@@ -70,6 +70,29 @@ Generate a stable UUID for cloud-init re-initialization upon upgrade.
 {{- $uuid }}
 {{- end }}
 
+{{/*
+Domain resources (cpu, memory) as a JSON object.
+Used in vm.yaml for rendering and in the update hook for merge patches.
+*/}}
+{{- define "virtual-machine.domainResources" -}}
+{{- $result := dict -}}
+{{- if or .Values.cpuModel (and .Values.resources .Values.resources.cpu .Values.resources.sockets) -}}
+  {{- $cpu := dict -}}
+  {{- if and .Values.resources .Values.resources.cpu .Values.resources.sockets -}}
+    {{- $_ := set $cpu "cores" (.Values.resources.cpu | int64) -}}
+    {{- $_ := set $cpu "sockets" (.Values.resources.sockets | int64) -}}
+  {{- end -}}
+  {{- if .Values.cpuModel -}}
+    {{- $_ := set $cpu "model" .Values.cpuModel -}}
+  {{- end -}}
+  {{- $_ := set $result "cpu" $cpu -}}
+{{- end -}}
+{{- if and .Values.resources .Values.resources.memory -}}
+  {{- $_ := set $result "resources" (dict "requests" (dict "memory" .Values.resources.memory)) -}}
+{{- end -}}
+{{- $result | toJson -}}
+{{- end -}}
+
 {{/*
 Node Affinity for Windows VMs
 */}}
diff --git a/packages/apps/vm-instance/templates/vm-update-hook.yaml b/packages/apps/vm-instance/templates/vm-update-hook.yaml
index a12e8583..995dafff 100644
--- a/packages/apps/vm-instance/templates/vm-update-hook.yaml
+++ b/packages/apps/vm-instance/templates/vm-update-hook.yaml
@@ -2,26 +2,43 @@
 {{- $namespace := .Release.Namespace -}}
 
 {{- $existingVM := lookup "kubevirt.io/v1" "VirtualMachine" $namespace $vmName -}}
+{{- $existingService := lookup "v1" "Service" $namespace $vmName -}}
 
 {{- $instanceType := .Values.instanceType | default "" -}}
 {{- $instanceProfile := .Values.instanceProfile | default "" -}}
+{{- $desiredServiceType := ternary "LoadBalancer" "ClusterIP" .Values.external -}}
 
 {{- $needUpdateType := false -}}
 {{- $needUpdateProfile := false -}}
+{{- $needRecreateService := false -}}
+{{- $needRemoveInstanceType := false -}}
+{{- $needRemoveCustomResources := false -}}
 
-{{- if and $existingVM $instanceType -}}
+{{- $existingHasInstanceType := and $existingVM $existingVM.spec.instancetype -}}
+{{- if and $existingHasInstanceType (not $instanceType) -}}
+  {{- $needRemoveInstanceType = true -}}
+{{- else if and $existingHasInstanceType $instanceType -}}
   {{- if not (eq $existingVM.spec.instancetype.name $instanceType) -}}
     {{- $needUpdateType = true -}}
   {{- end -}}
+{{- else if and $existingVM (not $existingHasInstanceType) $instanceType -}}
+  {{- $needRemoveCustomResources = true -}}
 {{- end -}}
 
-{{- if and $existingVM $instanceProfile -}}
+{{- if and $existingVM $existingVM.spec.preference $instanceProfile -}}
   {{- if not (eq $existingVM.spec.preference.name $instanceProfile) -}}
     {{- $needUpdateProfile = true -}}
   {{- end -}}
 {{- end -}}
 
-{{- if or $needUpdateType $needUpdateProfile }}
+{{- if $existingService -}}
+  {{- $currentServiceType := $existingService.spec.type -}}
+  {{- if ne $currentServiceType $desiredServiceType -}}
+    {{- $needRecreateService = true -}}
+  {{- end -}}
+{{- end -}}
+
+{{- if or $needUpdateType $needUpdateProfile $needRecreateService $needRemoveInstanceType $needRemoveCustomResources }}
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -58,13 +75,32 @@ spec:
                 --type merge \
                 -p '{"spec":{"instancetype":{"name": "{{ $instanceType }}", "revisionName": null}}}'
               {{- end }}
-              
+
               {{- if $needUpdateProfile }}
               echo "Patching VirtualMachine for preference update..."
               kubectl patch virtualmachines.kubevirt.io {{ $vmName }} -n {{ $namespace }} \
                 --type merge \
                 -p '{"spec":{"preference":{"name": "{{ $instanceProfile }}", "revisionName": null}}}'
               {{- end }}
+
+              {{- if $needRemoveInstanceType }}
+              echo "Removing instancetype from VM (switching to custom resources)..."
+              kubectl patch virtualmachines.kubevirt.io {{ $vmName }} -n {{ $namespace }} \
+                --type merge \
+                -p '{"spec":{"instancetype":null{{- if not $instanceProfile }},"preference":null{{- end }},"template":{"spec":{"domain":{{ include "virtual-machine.domainResources" . }}}}}}'
+              {{- end }}
+
+              {{- if $needRemoveCustomResources }}
+              echo "Removing custom CPU/memory from domain (switching to instancetype)..."
+              kubectl patch virtualmachines.kubevirt.io {{ $vmName }} -n {{ $namespace }} \
+                --type merge \
+                -p '{"spec":{"instancetype":{"name":"{{ $instanceType }}","revisionName":null},"template":{"spec":{"domain":{"cpu":null,"resources":null}}}}}'
+              {{- end }}
+
+              {{- if $needRecreateService }}
+              echo "Removing Service..."
+              kubectl delete service --cascade=orphan -n {{ $namespace }} {{ $vmName }}
+              {{- end }}
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -87,6 +123,10 @@ rules:
   - apiGroups: ["kubevirt.io"]
     resources: ["virtualmachines"]
     verbs: ["patch", "get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["services"]
+    resourceNames: ["{{ $vmName }}"]
+    verbs: ["delete"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
diff --git a/packages/apps/vm-instance/templates/vm.yaml b/packages/apps/vm-instance/templates/vm.yaml
index acad3475..226e5aa7 100644
--- a/packages/apps/vm-instance/templates/vm.yaml
+++ b/packages/apps/vm-instance/templates/vm.yaml
@@ -4,6 +4,9 @@
 {{- if and .Values.instanceProfile (not (lookup "instancetype.kubevirt.io/v1beta1" "VirtualMachineClusterPreference" "" .Values.instanceProfile)) }}
 {{-   fail (printf "Specified instanceProfile does not exist in the cluster: %s" .Values.instanceProfile) }}
 {{- end }}
+{{- if and (not .Values.instanceType) (not (and .Values.resources .Values.resources.cpu .Values.resources.sockets .Values.resources.memory)) }}
+{{-   fail "Either instanceType or resources (cpu, sockets, memory) must be specified" }}
+{{- end }}
 
 apiVersion: kubevirt.io/v1
 kind: VirtualMachine
@@ -12,7 +15,11 @@ metadata:
   labels:
     {{- include "virtual-machine.labels" . | nindent 4 }}
 spec:
-  running: {{ .Values.running }}
+  {{- if hasKey .Values "runStrategy" }}
+  runStrategy: {{ .Values.runStrategy }}
+  {{- else }}
+  runStrategy: {{ ternary "Always" "Halted" (.Values.running | default true) }}
+  {{- end }}
   {{- with .Values.instanceType }}
   instancetype:
     kind: VirtualMachineClusterInstancetype
@@ -31,15 +38,12 @@ spec:
         {{- include "virtual-machine.labels" . | nindent 8 }}
     spec:
       domain:
-        {{- if and .Values.resources .Values.resources.cpu .Values.resources.sockets }}
-        cpu:
-          cores: {{ .Values.resources.cpu }}
-          sockets: {{ .Values.resources.sockets }}
+        {{- $domainRes := include "virtual-machine.domainResources" . | fromJson -}}
+        {{- with $domainRes.cpu }}
+        cpu: {{- . | toYaml | nindent 10 }}
         {{- end }}
-        {{- if and .Values.resources .Values.resources.memory }}
-        resources:
-          requests:
-            memory: {{ .Values.resources.memory | quote }}
+        {{- with $domainRes.resources }}
+        resources: {{- . | toYaml | nindent 10 }}
         {{- end }}
         firmware:
           uuid: {{ include "virtual-machine.stableUuid" . }}
diff --git a/packages/apps/vm-instance/values.schema.json b/packages/apps/vm-instance/values.schema.json
index ca6b34e7..0788c879 100644
--- a/packages/apps/vm-instance/values.schema.json
+++ b/packages/apps/vm-instance/values.schema.json
@@ -12,6 +12,11 @@
       "type": "string",
       "default": ""
     },
+    "cpuModel": {
+      "description": "Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map",
+      "type": "string",
+      "default": ""
+    },
     "disks": {
       "description": "List of disks to attach.",
       "type": "array",
@@ -175,10 +180,17 @@
         }
       }
     },
-    "running": {
-      "description": "Determines if the virtual machine should be running.",
-      "type": "boolean",
-      "default": true
+    "runStrategy": {
+      "description": "Requested running state of the VirtualMachineInstance",
+      "type": "string",
+      "default": "Always",
+      "enum": [
+        "Always",
+        "Halted",
+        "Manual",
+        "RerunOnFailure",
+        "Once"
+      ]
     },
     "sshKeys": {
       "description": "List of SSH public keys for authentication.",
diff --git a/packages/apps/vm-instance/values.yaml b/packages/apps/vm-instance/values.yaml
index 9d0a1522..d5ed5679 100644
--- a/packages/apps/vm-instance/values.yaml
+++ b/packages/apps/vm-instance/values.yaml
@@ -31,8 +31,15 @@ externalMethod: PortList
 externalPorts:
 - 22
 
-## @param {bool} running - Determines if the virtual machine should be running.
-running: true
+## @enum {string} RunStrategy - Requested running state of the VirtualMachineInstance
+## @value Always - VMI should always be running
+## @value Halted - VMI should never be running
+## @value Manual - VMI can be started/stopped using API endpoints
+## @value RerunOnFailure - VMI will initially be running and restarted if a failure occurs, but will not be restarted upon successful completion
+## @value Once - VMI will run once and not be restarted upon completion regardless if the completion is of phase Failure or Success
+
+## @param {RunStrategy} runStrategy - Requested running state of the VirtualMachineInstance
+runStrategy: Always
 
 ## @param {string} instanceType - Virtual Machine instance type.
 instanceType: "u1.medium"
@@ -62,6 +69,9 @@ gpus: []
 ## gpus:
 ## - name: nvidia.com/GA102GL_A10
 
+## @param {string} cpuModel - Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map
+cpuModel: ""
+
 ## @param {Resources} [resources] - Resource configuration for the virtual machine.
 resources: {}
 
diff --git a/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml b/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml
index b03d82a0..ff7c8cfe 100644
--- a/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml
+++ b/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml
@@ -8,7 +8,7 @@ spec:
     singular: vminstance
     plural: vminstances
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"cloudInit":{"description":"Cloud-init user data.","type":"string","default":""},"cloudInitSeed":{"description":"Seed string to generate SMBIOS UUID for the VM.","type":"string","default":""},"disks":{"description":"List of disks to attach.","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"bus":{"description":"Disk bus type (e.g. \"sata\").","type":"string"},"name":{"description":"Disk name.","type":"string"}}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"externalMethod":{"description":"Method to pass through traffic to the VM.","type":"string","default":"PortList","enum":["PortList","WholeIP"]},"externalPorts":{"description":"Ports to forward from outside the cluster.","type":"array","default":[22],"items":{"type":"integer"}},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"name":{"description":"The name of the GPU resource to attach.","type":"string"}}}},"instanceProfile":{"description":"Virtual Machine preferences profile.","type":"string","default":"ubuntu","enum":["alpine","centos.7","centos.7.desktop","centos.stream10","centos.stream10.desktop","centos.stream8","centos.stream8.desktop","centos.stream8.dpdk","centos.stream9","centos.stream9.desktop","centos.stream9.dpdk","cirros","fedora","fedora.arm64","opensuse.leap","opensuse.tumbleweed","rhel.10","rhel.10.arm64","rhel.7","rhel.7.desktop","rhel.8","rhel.8.desktop","rhel.8.dpdk","rhel.9","rhel.9.arm64","rhel.9.desktop","rhel.9.dpdk","rhel.9.realtime","sles","ubuntu","windows.10","windows.10.virtio","windows.11","windows.11.virtio","windows.2k16","windows.2k16.virtio","windows.2k19","windows.2k19.virtio","windows.2k22","windows.2k22.virtio","windows.2k25","windows.2k25.virtio",""]},"instanceType":{"description":"Virtual Machine instance type.","type":"string","default":"u1.medium"},"resources":{"description":"Resource configuration for the virtual machine.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"sockets":{"description":"Number of CPU sockets (vCPU topology).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"running":{"description":"Determines if the virtual machine should be running.","type":"boolean","default":true},"sshKeys":{"description":"List of SSH public keys for authentication.","type":"array","default":[],"items":{"type":"string"}},"subnets":{"description":"Additional subnets","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Subnet name","type":"string"}}}}}}
+      {"title":"Chart Values","type":"object","properties":{"cloudInit":{"description":"Cloud-init user data.","type":"string","default":""},"cloudInitSeed":{"description":"Seed string to generate SMBIOS UUID for the VM.","type":"string","default":""},"cpuModel":{"description":"Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map","type":"string","default":""},"disks":{"description":"List of disks to attach.","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"bus":{"description":"Disk bus type (e.g. \"sata\").","type":"string"},"name":{"description":"Disk name.","type":"string"}}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"externalMethod":{"description":"Method to pass through traffic to the VM.","type":"string","default":"PortList","enum":["PortList","WholeIP"]},"externalPorts":{"description":"Ports to forward from outside the cluster.","type":"array","default":[22],"items":{"type":"integer"}},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"name":{"description":"The name of the GPU resource to attach.","type":"string"}}}},"instanceProfile":{"description":"Virtual Machine preferences profile.","type":"string","default":"ubuntu","enum":["alpine","centos.7","centos.7.desktop","centos.stream10","centos.stream10.desktop","centos.stream8","centos.stream8.desktop","centos.stream8.dpdk","centos.stream9","centos.stream9.desktop","centos.stream9.dpdk","cirros","fedora","fedora.arm64","opensuse.leap","opensuse.tumbleweed","rhel.10","rhel.10.arm64","rhel.7","rhel.7.desktop","rhel.8","rhel.8.desktop","rhel.8.dpdk","rhel.9","rhel.9.arm64","rhel.9.desktop","rhel.9.dpdk","rhel.9.realtime","sles","ubuntu","windows.10","windows.10.virtio","windows.11","windows.11.virtio","windows.2k16","windows.2k16.virtio","windows.2k19","windows.2k19.virtio","windows.2k22","windows.2k22.virtio","windows.2k25","windows.2k25.virtio",""]},"instanceType":{"description":"Virtual Machine instance type.","type":"string","default":"u1.medium"},"resources":{"description":"Resource configuration for the virtual machine.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"sockets":{"description":"Number of CPU sockets (vCPU topology).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"runStrategy":{"description":"Requested running state of the VirtualMachineInstance","type":"string","default":"Always","enum":["Always","Halted","Manual","RerunOnFailure","Once"]},"sshKeys":{"description":"List of SSH public keys for authentication.","type":"array","default":[],"items":{"type":"string"}},"subnets":{"description":"Additional subnets","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Subnet name","type":"string"}}}}}}
   release:
     prefix: vm-instance-
     labels:
@@ -26,7 +26,7 @@ spec:
     tags:
       - compute
     icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl82ODdfMzQ1NCkiLz4KPGcgY2xpcC1wYXRoPSJ1cmwoI2NsaXAwXzY4N18zNDU0KSI+CjxwYXRoIGQ9Ik04OS41MDM5IDExMS43MDdINTQuNDk3QzU0LjE3MjcgMTExLjcwNyA1NC4wMTA4IDExMS4yMjEgNTQuMzM0OSAxMTEuMDU5TDU3LjI1MjIgMTA4Ljk1MkM2MC4zMzE0IDEwNi42ODMgNjEuOTUyMiAxMDIuNjMxIDYwLjk3OTcgOTguNzQxMkg4My4wMjFDODIuMDQ4NSAxMDIuNjMxIDgzLjY2OTMgMTA2LjY4MyA4Ni43NDg1IDEwOC45NTJMODkuNjY1OCAxMTEuMDU5Qzg5Ljk5IDExMS4yMjEgODkuODI3OSAxMTEuNzA3IDg5LjUwMzkgMTExLjcwN1oiIGZpbGw9IiNCMEI2QkIiLz4KPHBhdGggZD0iTTExMy4zMjggOTguNzQxSDMwLjY3MjVDMjcuNTkzMSA5OC43NDEgMjUgOTYuMTQ4IDI1IDkzLjA2ODdWMzMuMTAzMkMyNSAzMC4wMjM5IDI3LjU5MzEgMjcuNDMwNyAzMC42NzI1IDI3LjQzMDdIMTEzLjMyOEMxMTYuNDA3IDI3LjQzMDcgMTE5IDMwLjAyMzcgMTE5IDMzLjEwMzJWOTMuMDY4N0MxMTkgOTYuMTQ4IDExNi40MDcgOTguNzQxIDExMy4zMjggOTguNzQxWiIgZmlsbD0iI0U4RURFRSIvPgo8cGF0aCBkPSJNMTE5IDg0LjE1NDlIMjVWMzMuMTAzMkMyNSAzMC4wMjM5IDI3LjU5MzEgMjcuNDMwNyAzMC42NzI1IDI3LjQzMDdIMTEzLjMyOEMxMTYuNDA3IDI3LjQzMDcgMTE5IDMwLjAyMzcgMTE5IDMzLjEwMzJMMTE5IDg0LjE1NDlaIiBmaWxsPSIjMDBCM0ZGIi8+CjxwYXRoIGQ9Ik05MC42Mzc0IDExNi41NjlINTMuMzYxNkM1Mi4wNjUxIDExNi41NjkgNTAuOTMwNyAxMTUuNDM1IDUwLjkzMDcgMTE0LjEzOEM1MC45MzA3IDExMi44NDEgNTIuMDY1MSAxMTEuNzA3IDUzLjM2MTYgMTExLjcwN0g5MC42Mzc0QzkxLjkzMzkgMTExLjcwNyA5My4wNjg0IDExMi44NDEgOTMuMDY4NCAxMTQuMTM4QzkzLjA2ODQgMTE1LjQzNSA5MS45MzM5IDExNi41NjkgOTAuNjM3NCAxMTYuNTY5WiIgZmlsbD0iI0U4RURFRSIvPgo8L2c+CjxwYXRoIGQ9Ik03Mi41Mjc1IDUzLjgzNjdDNzIuNDQzMSA1My44MzUxIDcyLjM2MDUgNTMuODEyMiA3Mi4yODczIDUzLjc3MDFMNTYuNDY5OSA0NC43OTM0QzU2LjM5ODMgNDQuNzUxOSA1Ni4zMzg4IDQ0LjY5MjMgNTYuMjk3MyA0NC42MjA3QzU2LjI1NTkgNDQuNTQ5IDU2LjIzMzggNDQuNDY3OCA1Ni4yMzM0IDQ0LjM4NUM1Ni4yMzM0IDQ0LjIxNjkgNTYuMzI1OCA0NC4wNjE3IDU2LjQ2OTkgNDMuOTc4NUw3Mi4xOTEyIDM1LjA2MDlDNzIuMjYzNyAzNS4wMjEgNzIuMzQ1IDM1IDcyLjQyNzcgMzVDNzIuNTEwNSAzNSA3Mi41OTE4IDM1LjAyMSA3Mi42NjQzIDM1LjA2MDlMODguNDg3MiA0NC4wMzk1Qzg4LjU1OTEgNDQuMDgwMSA4OC42MTg4IDQ0LjEzOTIgODguNjYgNDQuMjEwN0M4OC43MDEzIDQ0LjI4MjIgODguNzIyNyA0NC4zNjM1IDg4LjcyMTkgNDQuNDQ2Qzg4LjcyMjUgNDQuNTI4NSA4OC43MDEgNDQuNjA5NyA4OC42NTk4IDQ0LjY4MTJDODguNjE4NSA0NC43NTI2IDg4LjU1ODkgNDQuODExOCA4OC40ODcyIDQ0Ljg1MjVMNzIuNzcxNCA1My43NjgzQzcyLjY5NzIgNTMuODExNCA3Mi42MTMzIDUzLjgzNDkgNzIuNTI3NSA1My44MzY3IiBmaWxsPSJ3aGl0ZSIvPgo8cGF0aCBvcGFjaXR5PSIwLjciIGQ9Ik03MC4yNTUzIDc1LjY1MTdDNzAuMTcxIDc1LjY1MzUgNzAuMDg3OCA3NS42MzE3IDcwLjAxNTEgNzUuNTg4OEw1NC4yNDU4IDY2LjY0MTdDNTQuMTcxNSA2Ni42MDI0IDU0LjEwOTUgNjYuNTQzNiA1NC4wNjYxIDY2LjQ3MTZDNTQuMDIyOCA2Ni4zOTk3IDU0IDY2LjMxNzMgNTQgNjYuMjMzM1Y0OC4yNzhDNTQgNDguMTA4IDU0LjA5MjQgNDcuOTU0NiA1NC4yNDM5IDQ3Ljg2OTZDNTQuMzE3MiA0Ny44MjcxIDU0LjQwMDQgNDcuODA0NyA1NC40ODUxIDQ3LjgwNDdDNTQuNTY5NyA0Ny44MDQ3IDU0LjY1MjkgNDcuODI3MSA1NC43MjYyIDQ3Ljg2OTZMNzAuNDkzNyA1Ni44MTMxQzcwLjU2NDIgNTYuODU2NSA3MC42MjI1IDU2LjkxNyA3MC42NjMyIDU2Ljk4OTFDNzAuNzAzOSA1Ny4wNjEyIDcwLjcyNTcgNTcuMTQyNCA3MC43MjY1IDU3LjIyNTFWNzUuMTgwNUM3MC43MjU5IDc1LjI2MjggNzAuNzA0MiA3NS4zNDM2IDcwLjY2MzUgNzUuNDE1MUM3MC42MjI3IDc1LjQ4NjYgNzAuNTY0MiA3NS41NDY0IDcwLjQ5MzcgNzUuNTg4OEM3MC40MjA2IDc1LjYyOTEgNzAuMzM4NyA3NS42NTA3IDcwLjI1NTMgNzUuNjUxNyIgZmlsbD0id2hpdGUiLz4KPHBhdGggb3BhY2l0eT0iMC40IiBkPSJNNzQuNzE5OCA3NS42NTExQzc0LjYzMzMgNzUuNjUxMiA3NC41NDgyIDc1LjYyOTYgNzQuNDcyMiA3NS41ODgzQzc0LjQwMTYgNzUuNTQ2MSA3NC4zNDMyIDc1LjQ4NjIgNzQuMzAyNyA3NS40MTQ3Qzc0LjI2MjMgNzUuMzQzMSA3NC4yNDExIDc1LjI2MjIgNzQuMjQxMiA3NS4xOFY1Ny4zMzczQzc0LjI0MTIgNTcuMTcxIDc0LjMzMzYgNTcuMDE1OCA3NC40NzIyIDU2LjkyOUw5MC4yMzk3IDQ3Ljk4NTVDOTAuMzExOSA0Ny45NDM4IDkwLjM5MzggNDcuOTIxOSA5MC40NzcxIDQ3LjkyMTlDOTAuNTYwNSA0Ny45MjE5IDkwLjY0MjQgNDcuOTQzOCA5MC43MTQ2IDQ3Ljk4NTVDOTAuNzg3NiA0OC4wMjU1IDkwLjg0ODUgNDguMDg0MiA5MC44OTExIDQ4LjE1NTdDOTAuOTMzNyA0OC4yMjcyIDkwLjk1NjMgNDguMzA4OCA5MC45NTY2IDQ4LjM5MlY2Ni4yMzI4QzkwLjk1NyA2Ni4zMTY0IDkwLjkzNDcgNjYuMzk4NSA5MC44OTIxIDY2LjQ3MDRDOTAuODQ5NSA2Ni41NDI0IDkwLjc4ODEgNjYuNjAxNCA5MC43MTQ2IDY2LjY0MTFMNzQuOTUyNiA3NS41ODgzQzc0Ljg4MjUgNzUuNjMwNyA3NC44MDE4IDc1LjY1MjUgNzQuNzE5OCA3NS42NTExIiBmaWxsPSJ3aGl0ZSIvPgo8ZGVmcz4KPGxpbmVhckdyYWRpZW50IGlkPSJwYWludDBfbGluZWFyXzY4N18zNDU0IiB4MT0iMTYxIiB5MT0iMTgwIiB4Mj0iMy41OTI4NGUtMDciIHkyPSI0Ljk5OTk4IiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+CjxzdG9wLz4KPHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjNTk1NjU2Ii8+CjwvbGluZWFyR3JhZGllbnQ+CjxjbGlwUGF0aCBpZD0iY2xpcDBfNjg3XzM0NTQiPgo8cmVjdCB3aWR0aD0iOTQiIGhlaWdodD0iOTQiIGZpbGw9IndoaXRlIiB0cmFuc2Zvcm09InRyYW5zbGF0ZSgyNSAyNSkiLz4KPC9jbGlwUGF0aD4KPC9kZWZzPgo8L3N2Zz4K
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "external"], ["spec", "externalMethod"], ["spec", "externalPorts"], ["spec", "running"], ["spec", "instanceType"], ["spec", "instanceProfile"], ["spec", "disks"], ["spec", "subnets"], ["spec", "gpus"], ["spec", "resources"], ["spec", "sshKeys"], ["spec", "cloudInit"], ["spec", "cloudInitSeed"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "external"], ["spec", "externalMethod"], ["spec", "externalPorts"], ["spec", "runStrategy"], ["spec", "instanceType"], ["spec", "instanceProfile"], ["spec", "disks"], ["spec", "subnets"], ["spec", "gpus"], ["spec", "cpuModel"], ["spec", "resources"], ["spec", "sshKeys"], ["spec", "cloudInit"], ["spec", "cloudInitSeed"]]
   secrets:
     exclude: []
     include: []

From ee54495dfb643432d70e6f3cf9157fa3ec709619 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 12 Feb 2026 01:07:19 +0100
Subject: [PATCH 037/666] feat(platform): add migration 28 to convert
 virtual-machine to vm-disk + vm-instance

Splits virtual-machine HelmReleases into separate vm-disk and vm-instance
components. Handles PV data preservation, kube-ovn IP migration, and
LoadBalancer IP pinning via metallb annotation for external VMs.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../platform/images/migrations/migrations/29  | 691 ++++++++++++++++++
 packages/core/platform/values.yaml            |   2 +-
 2 files changed, 692 insertions(+), 1 deletion(-)
 create mode 100755 packages/core/platform/images/migrations/migrations/29

diff --git a/packages/core/platform/images/migrations/migrations/29 b/packages/core/platform/images/migrations/migrations/29
new file mode 100755
index 00000000..557fad0e
--- /dev/null
+++ b/packages/core/platform/images/migrations/migrations/29
@@ -0,0 +1,691 @@
+#!/bin/bash
+# Migration 29 --> 30
+# Convert virtual-machine HelmReleases to vm-disk + vm-instance.
+# Discovers all VirtualMachine HelmReleases by label, migrates each instance.
+# Idempotent: safe to re-run.
+
+set -euo pipefail
+
+OLD_PREFIX="virtual-machine"
+NEW_DISK_PREFIX="vm-disk"
+NEW_INSTANCE_PREFIX="vm-instance"
+PROTECTION_WEBHOOK_NAME="protection-webhook"
+PROTECTION_WEBHOOK_NS="protection-webhook"
+
+# ============================================================
+# Helper functions
+# ============================================================
+
+resource_exists() {
+  local ns="$1" type="$2" name="$3"
+  kubectl -n "$ns" get "$type" "$name" --no-headers 2>/dev/null | grep -q .
+}
+
+delete_resource() {
+  local ns="$1" type="$2" name="$3"
+  if resource_exists "$ns" "$type" "$name"; then
+    echo "    [DELETE] ${type}/${name}"
+    kubectl -n "$ns" delete "$type" "$name" --wait=false
+  else
+    echo "    [SKIP] ${type}/${name} already gone"
+  fi
+}
+
+clone_resource() {
+  local ns="$1" type="$2" old_name="$3" new_name="$4" old_instance="$5" new_instance="$6"
+
+  if resource_exists "$ns" "$type" "$new_name"; then
+    echo "    [SKIP] ${type}/${new_name} already exists"
+    return 0
+  fi
+  if ! resource_exists "$ns" "$type" "$old_name"; then
+    echo "    [SKIP] ${type}/${old_name} not found"
+    return 0
+  fi
+
+  echo "    [CREATE] ${type}/${new_name} from ${old_name}"
+  kubectl -n "$ns" get "$type" "$old_name" -o json | \
+    jq --arg new_name "$new_name" --arg old "$old_instance" --arg new "$new_instance" '
+      .metadata.name = $new_name |
+      del(.metadata.uid, .metadata.resourceVersion, .metadata.creationTimestamp,
+          .metadata.generation, .metadata.managedFields, .metadata.selfLink,
+          .metadata.ownerReferences) |
+      del(.status) |
+      .metadata.labels = ((.metadata.labels // {}) | with_entries(
+        if (.value | type) == "string" then .value |= gsub($old; $new) else . end)) |
+      .metadata.annotations = ((.metadata.annotations // {}) | with_entries(
+        select(.key != "kubectl.kubernetes.io/last-applied-configuration") |
+        if (.value | type) == "string" then .value |= gsub($old; $new) else . end))
+    ' | kubectl -n "$ns" apply -f -
+}
+
+# ============================================================
+# STEP 1: Discover all VirtualMachine instances
+# ============================================================
+echo "=== Discovering VirtualMachine HelmReleases ==="
+INSTANCES=()
+while IFS=/ read -r ns name; do
+  [ -z "$ns" ] && continue
+  instance="${name#${OLD_PREFIX}-}"
+  INSTANCES+=("${ns}/${instance}")
+  echo "  Found: ${ns}/${name} (instance=${instance})"
+done < <(kubectl get hr -A -l "apps.cozystack.io/application.kind=VirtualMachine" \
+  -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}' 2>/dev/null)
+
+if [ ${#INSTANCES[@]} -eq 0 ]; then
+  echo "  No VirtualMachine HelmReleases found. Nothing to migrate."
+  kubectl create configmap -n cozy-system cozystack-version \
+    --from-literal=version=30 --dry-run=client -o yaml | kubectl apply -f-
+  exit 0
+fi
+echo "  Total: ${#INSTANCES[@]} instance(s)"
+
+# ============================================================
+# STEP 2: Migrate each instance
+# ============================================================
+ALL_PV_NAMES=()
+ALL_PROTECTED_RESOURCES=()
+
+for entry in "${INSTANCES[@]}"; do
+  NAMESPACE="${entry%%/*}"
+  INSTANCE="${entry#*/}"
+  OLD_NAME="${OLD_PREFIX}-${INSTANCE}"
+  NEW_DISK_NAME="${NEW_DISK_PREFIX}-${INSTANCE}"
+  NEW_INSTANCE_NAME="${NEW_INSTANCE_PREFIX}-${INSTANCE}"
+
+  echo ""
+  echo "======================================================================"
+  echo "=== Migrating: ${OLD_NAME} -> ${NEW_DISK_NAME} + ${NEW_INSTANCE_NAME} in ${NAMESPACE}"
+  echo "======================================================================"
+
+  # --- 2a: Suspend old HelmRelease ---
+  echo "  --- Suspend HelmRelease ---"
+  if resource_exists "$NAMESPACE" "hr" "$OLD_NAME"; then
+    suspended=$(kubectl -n "$NAMESPACE" get hr "$OLD_NAME" -o jsonpath='{.spec.suspend}' 2>/dev/null || echo "false")
+    if [ "$suspended" != "true" ]; then
+      echo "    [SUSPEND] hr/${OLD_NAME}"
+      kubectl -n "$NAMESPACE" patch hr "$OLD_NAME" --type=merge -p '{"spec":{"suspend":true}}'
+    else
+      echo "    [SKIP] hr/${OLD_NAME} already suspended"
+    fi
+  else
+    echo "    [SKIP] hr/${OLD_NAME} not found"
+  fi
+
+  # --- 2b: Extract values from HelmRelease ---
+  echo "  --- Extract values ---"
+  VALUES_SECRET=""
+  VALUES_KEY="values.yaml"
+  if resource_exists "$NAMESPACE" "hr" "$OLD_NAME"; then
+    VALUES_SECRET=$(kubectl -n "$NAMESPACE" get hr "$OLD_NAME" -o json | \
+      jq -r '.spec.valuesFrom // [] | map(select(.kind == "Secret" and (.name | test("cozystack-values") | not))) | .[0].name // ""')
+    if [ -n "$VALUES_SECRET" ]; then
+      VALUES_KEY=$(kubectl -n "$NAMESPACE" get hr "$OLD_NAME" -o json | \
+        jq -r '.spec.valuesFrom // [] | map(select(.kind == "Secret" and (.name | test("cozystack-values") | not))) | .[0].valuesKey // "values.yaml"')
+    fi
+  fi
+
+  # Extract values from secret
+  EXTERNAL="false"
+  EXTERNAL_METHOD="PortList"
+  EXTERNAL_PORTS='[22]'
+  INSTANCE_TYPE="u1.medium"
+  INSTANCE_PROFILE="ubuntu"
+  RUN_STRATEGY="Always"
+  SYSTEM_DISK_IMAGE="ubuntu"
+  SYSTEM_DISK_STORAGE="5Gi"
+  SYSTEM_DISK_STORAGE_CLASS="replicated"
+  SSH_KEYS="[]"
+  CLOUD_INIT=""
+  CLOUD_INIT_SEED=""
+  SUBNETS="[]"
+  GPUS="[]"
+  CPU_MODEL=""
+  RESOURCES="{}"
+
+  if [ -n "$VALUES_SECRET" ] && resource_exists "$NAMESPACE" "secret" "$VALUES_SECRET"; then
+    echo "    Reading values from secret: ${VALUES_SECRET}"
+    VALUES_YAML=$(kubectl -n "$NAMESPACE" get secret "$VALUES_SECRET" -o jsonpath="{.data.${VALUES_KEY}}" 2>/dev/null | base64 -d 2>/dev/null || echo "")
+    if [ -z "$VALUES_YAML" ]; then
+      VALUES_YAML=$(kubectl -n "$NAMESPACE" get secret "$VALUES_SECRET" -o jsonpath="{.stringData.${VALUES_KEY}}" 2>/dev/null || echo "")
+    fi
+    if [ -n "$VALUES_YAML" ]; then
+      EXTERNAL=$(echo "$VALUES_YAML" | yq -r '.external // false')
+      EXTERNAL_METHOD=$(echo "$VALUES_YAML" | yq -r '.externalMethod // "PortList"')
+      EXTERNAL_PORTS=$(echo "$VALUES_YAML" | yq -c '.externalPorts // [22]')
+      INSTANCE_TYPE=$(echo "$VALUES_YAML" | yq -r '.instanceType // "u1.medium"')
+      INSTANCE_PROFILE=$(echo "$VALUES_YAML" | yq -r '.instanceProfile // "ubuntu"')
+      RUN_STRATEGY=$(echo "$VALUES_YAML" | yq -r '.runStrategy // (if .running == false then "Halted" else "Always" end)')
+      SYSTEM_DISK_IMAGE=$(echo "$VALUES_YAML" | yq -r '.systemDisk.image // "ubuntu"')
+      SYSTEM_DISK_STORAGE=$(echo "$VALUES_YAML" | yq -r '.systemDisk.storage // "5Gi"')
+      SYSTEM_DISK_STORAGE_CLASS=$(echo "$VALUES_YAML" | yq -r '.systemDisk.storageClass // "replicated"')
+      SSH_KEYS=$(echo "$VALUES_YAML" | yq -c '.sshKeys // []')
+      CLOUD_INIT=$(echo "$VALUES_YAML" | yq -r '.cloudInit // ""')
+      CLOUD_INIT_SEED=$(echo "$VALUES_YAML" | yq -r '.cloudInitSeed // ""')
+      SUBNETS=$(echo "$VALUES_YAML" | yq -c '.subnets // []')
+      GPUS=$(echo "$VALUES_YAML" | yq -c '.gpus // []')
+      CPU_MODEL=$(echo "$VALUES_YAML" | yq -r '.cpuModel // ""')
+      RESOURCES=$(echo "$VALUES_YAML" | yq -c '.resources // {}')
+    fi
+  fi
+
+  echo "    external=${EXTERNAL}, instanceType=${INSTANCE_TYPE}, image=${SYSTEM_DISK_IMAGE}"
+
+  # --- 2c: Save kube-ovn IP ---
+  echo "  --- Save kube-ovn IP ---"
+  OVN_IP=""
+  OVN_MAC=""
+  OVN_SUBNET="ovn-default"
+  OVN_IP_NAME="${OLD_NAME}.${NAMESPACE}"
+  if kubectl get ip.kubeovn.io "$OVN_IP_NAME" --no-headers 2>/dev/null | grep -q .; then
+    OVN_IP=$(kubectl get ip.kubeovn.io "$OVN_IP_NAME" -o jsonpath='{.spec.ipAddress}')
+    OVN_MAC=$(kubectl get ip.kubeovn.io "$OVN_IP_NAME" -o jsonpath='{.spec.macAddress}')
+    OVN_SUBNET=$(kubectl get ip.kubeovn.io "$OVN_IP_NAME" -o jsonpath='{.spec.subnet}')
+    echo "    kube-ovn IP: ${OVN_IP}, MAC: ${OVN_MAC}, subnet: ${OVN_SUBNET}"
+  else
+    echo "    [SKIP] No kube-ovn IP resource found"
+  fi
+
+  # --- 2d: Save LoadBalancer IP (if external=true) ---
+  echo "  --- Save LoadBalancer IP ---"
+  LB_IP=""
+  if [ "$EXTERNAL" = "true" ] && resource_exists "$NAMESPACE" "svc" "$OLD_NAME"; then
+    LB_IP=$(kubectl -n "$NAMESPACE" get svc "$OLD_NAME" -o jsonpath='{.status.loadBalancer.ingress[0].ip}' 2>/dev/null || echo "")
+    if [ -n "$LB_IP" ]; then
+      echo "    LoadBalancer IP: ${LB_IP}"
+    else
+      echo "    [WARN] external=true but no LoadBalancer IP assigned"
+    fi
+  else
+    echo "    [SKIP] Not external or no service"
+  fi
+
+  # --- 2e: Switch PV reclaim policy to Retain ---
+  echo "  --- Switch PV reclaim to Retain ---"
+  PV_NAME=""
+  if resource_exists "$NAMESPACE" "pvc" "$OLD_NAME"; then
+    PV_NAME=$(kubectl -n "$NAMESPACE" get pvc "$OLD_NAME" -o jsonpath='{.spec.volumeName}')
+    if [ -n "$PV_NAME" ]; then
+      ALL_PV_NAMES+=("$PV_NAME")
+      current_policy=$(kubectl get pv "$PV_NAME" -o jsonpath='{.spec.persistentVolumeReclaimPolicy}')
+      if [ "$current_policy" != "Retain" ]; then
+        echo "    [PATCH] PV ${PV_NAME}: ${current_policy} -> Retain"
+        kubectl patch pv "$PV_NAME" -p '{"spec":{"persistentVolumeReclaimPolicy":"Retain"}}'
+      else
+        echo "    [SKIP] PV ${PV_NAME} already Retain"
+      fi
+    fi
+  elif resource_exists "$NAMESPACE" "pvc" "$NEW_DISK_NAME"; then
+    PV_NAME=$(kubectl -n "$NAMESPACE" get pvc "$NEW_DISK_NAME" -o jsonpath='{.spec.volumeName}')
+    ALL_PV_NAMES+=("$PV_NAME")
+    echo "    [SKIP] New PVC ${NEW_DISK_NAME} already exists, PV=${PV_NAME}"
+  else
+    echo "    [WARN] No PVC found for ${OLD_NAME} or ${NEW_DISK_NAME}"
+  fi
+
+  # --- 2f: Stop and delete the VirtualMachine ---
+  echo "  --- Stop VirtualMachine ---"
+  if resource_exists "$NAMESPACE" "vm" "$OLD_NAME"; then
+    echo "    [PATCH] Stop VM ${OLD_NAME}"
+    kubectl -n "$NAMESPACE" patch vm "$OLD_NAME" --type merge -p '{"spec":{"runStrategy":"Halted"}}' 2>/dev/null || \
+    kubectl -n "$NAMESPACE" patch vm "$OLD_NAME" --type merge -p '{"spec":{"running":false}}' 2>/dev/null || true
+
+    echo "    Waiting for VMI to terminate..."
+    kubectl -n "$NAMESPACE" wait --for=delete vmi "$OLD_NAME" --timeout=120s 2>/dev/null || true
+  fi
+
+  # --- 2g: Delete VirtualMachine CR (cascades to DataVolume and PVC) ---
+  echo "  --- Delete VirtualMachine CR ---"
+  if resource_exists "$NAMESPACE" "vm" "$OLD_NAME"; then
+    echo "    [DELETE] vm/${OLD_NAME}"
+    kubectl -n "$NAMESPACE" delete vm "$OLD_NAME" --wait=true --timeout=60s 2>/dev/null || true
+  fi
+
+  echo "    Waiting for old PVC to be deleted..."
+  for i in $(seq 1 30); do
+    if ! resource_exists "$NAMESPACE" "pvc" "$OLD_NAME"; then
+      echo "    [OK] PVC ${OLD_NAME} deleted"
+      break
+    fi
+    sleep 2
+  done
+
+  # If PVC still exists (orphaned), delete it manually
+  if resource_exists "$NAMESPACE" "pvc" "$OLD_NAME"; then
+    echo "    [DELETE] Orphaned pvc/${OLD_NAME}"
+    kubectl -n "$NAMESPACE" delete pvc "$OLD_NAME" --wait=false 2>/dev/null || true
+  fi
+
+  # Delete orphaned DataVolume if still present
+  if resource_exists "$NAMESPACE" "dv" "$OLD_NAME"; then
+    echo "    [DELETE] Orphaned dv/${OLD_NAME}"
+    kubectl -n "$NAMESPACE" delete dv "$OLD_NAME" --wait=false 2>/dev/null || true
+  fi
+
+  # --- 2h: Create new PVC for vm-disk ---
+  echo "  --- Create new PVC for vm-disk ---"
+  if [ -n "$PV_NAME" ]; then
+    if resource_exists "$NAMESPACE" "pvc" "$NEW_DISK_NAME"; then
+      new_phase=$(kubectl -n "$NAMESPACE" get pvc "$NEW_DISK_NAME" \
+        -o jsonpath='{.status.phase}' 2>/dev/null || echo "unknown")
+      if [ "$new_phase" = "Bound" ]; then
+        echo "    [SKIP] PVC ${NEW_DISK_NAME} already Bound"
+      fi
+    else
+      echo "    [CREATE] PVC ${NEW_DISK_NAME} -> PV ${PV_NAME}"
+      cat <<PVCEOF | kubectl -n "$NAMESPACE" apply -f -
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ${NEW_DISK_NAME}
+  namespace: ${NAMESPACE}
+  annotations:
+    cdi.kubevirt.io/allowClaimAdoption: "true"
+  labels:
+    app.kubernetes.io/instance: ${NEW_DISK_NAME}
+spec:
+  accessModes: ["ReadWriteMany"]
+  storageClassName: "${SYSTEM_DISK_STORAGE_CLASS}"
+  volumeName: "${PV_NAME}"
+  resources:
+    requests:
+      storage: "${SYSTEM_DISK_STORAGE}"
+PVCEOF
+
+      new_pvc_uid=$(kubectl -n "$NAMESPACE" get pvc "$NEW_DISK_NAME" -o jsonpath='{.metadata.uid}')
+      echo "    [PATCH] Rebind PV ${PV_NAME} -> ${NEW_DISK_NAME}"
+      kubectl patch pv "$PV_NAME" --type=merge -p "{
+        \"spec\":{\"claimRef\":{\"apiVersion\":\"v1\",\"kind\":\"PersistentVolumeClaim\",
+          \"name\":\"${NEW_DISK_NAME}\",\"namespace\":\"${NAMESPACE}\",\"uid\":\"${new_pvc_uid}\"}}
+      }"
+
+      echo "    Waiting for PVC ${NEW_DISK_NAME} to bind..."
+      kubectl -n "$NAMESPACE" wait pvc "$NEW_DISK_NAME" \
+        --for=jsonpath='{.status.phase}'=Bound --timeout=60s
+      echo "    [OK] PVC ${NEW_DISK_NAME} is Bound"
+    fi
+  fi
+
+  # --- 2i: Clone Secrets ---
+  echo "  --- Clone Secrets ---"
+  for secret in $(kubectl -n "$NAMESPACE" get secret -o name 2>/dev/null \
+    | grep "secret/${OLD_NAME}" | grep -v "sh.helm.release" | grep -v "values"); do
+    old_secret_name="${secret#secret/}"
+    suffix="${old_secret_name#${OLD_NAME}}"
+    new_secret_name="${NEW_INSTANCE_NAME}${suffix}"
+    clone_resource "$NAMESPACE" "secret" "$old_secret_name" "$new_secret_name" "$OLD_NAME" "$NEW_INSTANCE_NAME"
+  done
+
+  # --- 2j: Clone WorkloadMonitor ---
+  echo "  --- Clone WorkloadMonitor ---"
+  clone_resource "$NAMESPACE" "workloadmonitor.cozystack.io" "$OLD_NAME" "$NEW_INSTANCE_NAME" "$OLD_NAME" "$NEW_INSTANCE_NAME"
+
+  # --- 2k: Migrate kube-ovn IP ---
+  echo "  --- Migrate kube-ovn IP ---"
+  NEW_OVN_IP_NAME="${NEW_INSTANCE_NAME}.${NAMESPACE}"
+  if [ -n "$OVN_IP" ]; then
+    if kubectl get ip.kubeovn.io "$NEW_OVN_IP_NAME" --no-headers 2>/dev/null | grep -q .; then
+      echo "    [SKIP] ip.kubeovn.io/${NEW_OVN_IP_NAME} already exists"
+    else
+      echo "    [CREATE] ip.kubeovn.io/${NEW_OVN_IP_NAME}"
+      cat <<IPEOF | kubectl apply -f -
+apiVersion: kubeovn.io/v1
+kind: IP
+metadata:
+  name: ${NEW_OVN_IP_NAME}
+  labels:
+    ${OVN_SUBNET}: ""
+    ovn.kubernetes.io/ip_reserved: "true"
+    ovn.kubernetes.io/subnet: ${OVN_SUBNET}
+spec:
+  ipAddress: "${OVN_IP}"
+  v4IpAddress: "${OVN_IP}"
+  v6IpAddress: ""
+  macAddress: "${OVN_MAC}"
+  namespace: "${NAMESPACE}"
+  podName: "${NEW_INSTANCE_NAME}"
+  podType: "VirtualMachine"
+  subnet: "${OVN_SUBNET}"
+  attachIps: []
+  attachMacs: []
+  attachSubnets: []
+IPEOF
+    fi
+
+    # Delete old kube-ovn IP resource
+    if kubectl get ip.kubeovn.io "$OVN_IP_NAME" --no-headers 2>/dev/null | grep -q .; then
+      echo "    [DELETE] ip.kubeovn.io/${OVN_IP_NAME}"
+      kubectl delete ip.kubeovn.io "$OVN_IP_NAME" 2>/dev/null || true
+    fi
+  fi
+
+  # --- 2l: Create vm-disk values secret ---
+  echo "  --- Create vm-disk values secret ---"
+  DISK_VALUES_SECRET="${NEW_DISK_NAME}-values"
+  if ! resource_exists "$NAMESPACE" "secret" "$DISK_VALUES_SECRET"; then
+    echo "    [CREATE] secret/${DISK_VALUES_SECRET}"
+    cat <<DSEOF | kubectl -n "$NAMESPACE" apply -f -
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ${DISK_VALUES_SECRET}
+  namespace: ${NAMESPACE}
+stringData:
+  values.yaml: |
+    source:
+      image:
+        name: "${SYSTEM_DISK_IMAGE}"
+    optical: false
+    storage: "${SYSTEM_DISK_STORAGE}"
+    storageClass: "${SYSTEM_DISK_STORAGE_CLASS}"
+DSEOF
+  else
+    echo "    [SKIP] secret/${DISK_VALUES_SECRET} already exists"
+  fi
+
+  # --- 2m: Create vm-disk HelmRelease (suspended) ---
+  echo "  --- Create vm-disk HelmRelease (suspended) ---"
+  if resource_exists "$NAMESPACE" "hr" "$NEW_DISK_NAME"; then
+    echo "    [SKIP] hr/${NEW_DISK_NAME} already exists"
+  else
+    echo "    [CREATE] hr/${NEW_DISK_NAME}"
+    cat <<DHREOF | kubectl -n "$NAMESPACE" apply -f -
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ${NEW_DISK_NAME}
+  namespace: ${NAMESPACE}
+  labels:
+    sharding.fluxcd.io/key: tenants
+    apps.cozystack.io/application.kind: VMDisk
+    apps.cozystack.io/application.name: vm-disk
+spec:
+  suspend: true
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-vm-disk-application-kubevirt-vm-disk
+    namespace: cozy-system
+  interval: 5m
+  timeout: 10m
+  install:
+    remediation:
+      retries: -1
+  upgrade:
+    force: true
+    remediation:
+      retries: -1
+  valuesFrom:
+  - kind: Secret
+    name: ${DISK_VALUES_SECRET}
+    valuesKey: values.yaml
+DHREOF
+  fi
+
+  # --- 2n: Create vm-instance values secret ---
+  echo "  --- Create vm-instance values secret ---"
+  INSTANCE_VALUES_SECRET="${NEW_INSTANCE_NAME}-values"
+  if ! resource_exists "$NAMESPACE" "secret" "$INSTANCE_VALUES_SECRET"; then
+    echo "    [CREATE] secret/${INSTANCE_VALUES_SECRET}"
+    cat <<ISEOF | kubectl -n "$NAMESPACE" apply -f -
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ${INSTANCE_VALUES_SECRET}
+  namespace: ${NAMESPACE}
+stringData:
+  values.yaml: |
+    external: ${EXTERNAL}
+    externalMethod: "${EXTERNAL_METHOD}"
+    externalPorts: ${EXTERNAL_PORTS}
+    runStrategy: "${RUN_STRATEGY}"
+    instanceType: "${INSTANCE_TYPE}"
+    instanceProfile: "${INSTANCE_PROFILE}"
+    disks:
+    - name: "${INSTANCE}"
+    subnets: ${SUBNETS}
+    gpus: ${GPUS}
+    cpuModel: "${CPU_MODEL}"
+    resources: ${RESOURCES}
+    sshKeys: ${SSH_KEYS}
+    cloudInit: $(echo "$CLOUD_INIT" | jq -Rs .)
+    cloudInitSeed: "${CLOUD_INIT_SEED}"
+ISEOF
+  else
+    echo "    [SKIP] secret/${INSTANCE_VALUES_SECRET} already exists"
+  fi
+
+  # --- 2o: Create vm-instance HelmRelease (suspended) ---
+  echo "  --- Create vm-instance HelmRelease (suspended) ---"
+  if resource_exists "$NAMESPACE" "hr" "$NEW_INSTANCE_NAME"; then
+    echo "    [SKIP] hr/${NEW_INSTANCE_NAME} already exists"
+  else
+    # Build valuesFrom list - include cozystack-values if the old HR had it
+    COZYSTACK_VALUES_FROM=""
+    if resource_exists "$NAMESPACE" "secret" "cozystack-values"; then
+      COZYSTACK_VALUES_FROM='  - kind: Secret
+    name: cozystack-values'
+    fi
+
+    echo "    [CREATE] hr/${NEW_INSTANCE_NAME}"
+    cat <<IHREOF | kubectl -n "$NAMESPACE" apply -f -
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ${NEW_INSTANCE_NAME}
+  namespace: ${NAMESPACE}
+  labels:
+    sharding.fluxcd.io/key: tenants
+    apps.cozystack.io/application.kind: VMInstance
+    apps.cozystack.io/application.name: vm-instance
+spec:
+  suspend: true
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-vm-instance-application-kubevirt-vm-instance
+    namespace: cozy-system
+  interval: 5m
+  timeout: 10m
+  install:
+    remediation:
+      retries: -1
+  upgrade:
+    force: true
+    remediation:
+      retries: -1
+  valuesFrom:
+  - kind: Secret
+    name: ${INSTANCE_VALUES_SECRET}
+    valuesKey: values.yaml
+${COZYSTACK_VALUES_FROM}
+IHREOF
+  fi
+
+  # --- 2p: If external=true, pre-create LoadBalancer service with metallb annotation ---
+  echo "  --- Handle external service ---"
+  if [ "$EXTERNAL" = "true" ] && [ -n "$LB_IP" ]; then
+    if resource_exists "$NAMESPACE" "svc" "$NEW_INSTANCE_NAME"; then
+      echo "    [SKIP] svc/${NEW_INSTANCE_NAME} already exists"
+    else
+      echo "    [CREATE] svc/${NEW_INSTANCE_NAME} with metallb IP ${LB_IP}"
+      cat <<SVCEOF | kubectl -n "$NAMESPACE" apply -f -
+apiVersion: v1
+kind: Service
+metadata:
+  name: ${NEW_INSTANCE_NAME}
+  namespace: ${NAMESPACE}
+  labels:
+    apps.cozystack.io/user-service: "true"
+    app.kubernetes.io/name: vm-instance
+    app.kubernetes.io/instance: ${NEW_INSTANCE_NAME}
+  annotations:
+    networking.cozystack.io/wholeIP: "true"
+    metallb.universe.tf/loadBalancerIPs: "${LB_IP}"
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  selector:
+    app.kubernetes.io/name: vm-instance
+    app.kubernetes.io/instance: ${NEW_INSTANCE_NAME}
+  ports:
+  - port: 65535
+SVCEOF
+    fi
+  fi
+
+  # --- 2q: Delete old resources ---
+  echo "  --- Delete old resources ---"
+  for secret in $(kubectl -n "$NAMESPACE" get secret -o name 2>/dev/null \
+    | grep "secret/${OLD_NAME}" | grep -v "sh.helm.release" | grep -v "values"); do
+    old_secret_name="${secret#secret/}"
+    delete_resource "$NAMESPACE" "secret" "$old_secret_name"
+  done
+
+  delete_resource "$NAMESPACE" "workloadmonitor.cozystack.io" "$OLD_NAME"
+
+  if resource_exists "$NAMESPACE" "hr" "$OLD_NAME"; then
+    kubectl -n "$NAMESPACE" patch hr "$OLD_NAME" --type=json \
+      -p='[{"op":"remove","path":"/metadata/finalizers"}]' 2>/dev/null || true
+    delete_resource "$NAMESPACE" "hr" "$OLD_NAME"
+  fi
+
+  echo "    [DELETE] secrets with label owner=helm,name=${OLD_NAME}"
+  kubectl -n "$NAMESPACE" delete secret -l "owner=helm,name=${OLD_NAME}" 2>/dev/null || true
+
+  # Delete old values secret
+  if [ -n "$VALUES_SECRET" ]; then
+    delete_resource "$NAMESPACE" "secret" "$VALUES_SECRET"
+  fi
+
+  # Collect protected resources for batch deletion
+  if resource_exists "$NAMESPACE" "svc" "$OLD_NAME"; then
+    ALL_PROTECTED_RESOURCES+=("${NAMESPACE}:svc/${OLD_NAME}")
+  fi
+done
+
+# ============================================================
+# STEP 3: Delete protected resources (Services)
+# ============================================================
+echo ""
+echo "--- Step 3: Delete protected resources ---"
+
+if [ ${#ALL_PROTECTED_RESOURCES[@]} -gt 0 ]; then
+  echo "  --- Temporarily disabling protection-webhook ---"
+
+  WEBHOOK_REPLICAS=$(kubectl -n "$PROTECTION_WEBHOOK_NS" get deploy "$PROTECTION_WEBHOOK_NAME" \
+    -o jsonpath='{.spec.replicas}' 2>/dev/null || echo "1")
+
+  echo "  [SCALE] ${PROTECTION_WEBHOOK_NAME} -> 0 (was ${WEBHOOK_REPLICAS})"
+  kubectl -n "$PROTECTION_WEBHOOK_NS" scale deploy "$PROTECTION_WEBHOOK_NAME" --replicas=0
+
+  echo "  [PATCH] Set failurePolicy=Ignore on ValidatingWebhookConfiguration/${PROTECTION_WEBHOOK_NAME}"
+  kubectl get validatingwebhookconfiguration "$PROTECTION_WEBHOOK_NAME" -o json | \
+    jq '.webhooks[].failurePolicy = "Ignore"' | \
+    kubectl apply -f -
+
+  echo "  Waiting for webhook pods to terminate..."
+  kubectl -n "$PROTECTION_WEBHOOK_NS" wait --for=delete pod \
+    -l app.kubernetes.io/name=protection-webhook --timeout=60s 2>/dev/null || true
+  sleep 3
+
+  for entry in "${ALL_PROTECTED_RESOURCES[@]}"; do
+    ns="${entry%%:*}"
+    res="${entry#*:}"
+    echo "  [DELETE] ${ns}/${res}"
+    kubectl -n "$ns" delete "$res" --wait=false 2>/dev/null || true
+  done
+
+  echo "  [PATCH] Set failurePolicy=Fail on ValidatingWebhookConfiguration/${PROTECTION_WEBHOOK_NAME}"
+  kubectl get validatingwebhookconfiguration "$PROTECTION_WEBHOOK_NAME" -o json | \
+    jq '.webhooks[].failurePolicy = "Fail"' | \
+    kubectl apply -f -
+
+  echo "  [SCALE] ${PROTECTION_WEBHOOK_NAME} -> ${WEBHOOK_REPLICAS}"
+  kubectl -n "$PROTECTION_WEBHOOK_NS" scale deploy "$PROTECTION_WEBHOOK_NAME" \
+    --replicas="$WEBHOOK_REPLICAS"
+  echo "  --- protection-webhook restored ---"
+else
+  echo "  [SKIP] No protected resources to delete"
+fi
+
+# ============================================================
+# STEP 4: Restore PV reclaim policies
+# ============================================================
+echo ""
+echo "--- Step 4: Restore PV reclaim policies ---"
+for pv_name in "${ALL_PV_NAMES[@]}"; do
+  if [ -n "$pv_name" ]; then
+    current_policy=$(kubectl get pv "$pv_name" \
+      -o jsonpath='{.spec.persistentVolumeReclaimPolicy}' 2>/dev/null || echo "unknown")
+    if [ "$current_policy" = "Retain" ]; then
+      echo "  [PATCH] PV ${pv_name}: Retain -> Delete"
+      kubectl patch pv "$pv_name" -p '{"spec":{"persistentVolumeReclaimPolicy":"Delete"}}'
+    else
+      echo "  [SKIP] PV ${pv_name} already ${current_policy}"
+    fi
+  fi
+done
+
+# ============================================================
+# STEP 5: Unsuspend vm-disk HelmReleases first
+# ============================================================
+echo ""
+echo "--- Step 5: Unsuspend vm-disk HelmReleases ---"
+for entry in "${INSTANCES[@]}"; do
+  ns="${entry%%/*}"
+  instance="${entry#*/}"
+  disk_name="${NEW_DISK_PREFIX}-${instance}"
+  if resource_exists "$ns" "hr" "$disk_name"; then
+    suspended=$(kubectl -n "$ns" get hr "$disk_name" \
+      -o jsonpath='{.spec.suspend}' 2>/dev/null || echo "false")
+    if [ "$suspended" = "true" ]; then
+      echo "  [UNSUSPEND] ${ns}/hr/${disk_name}"
+      kubectl -n "$ns" patch hr "$disk_name" --type=merge -p '{"spec":{"suspend":false}}'
+    else
+      echo "  [SKIP] ${ns}/hr/${disk_name} already not suspended"
+    fi
+  fi
+done
+
+# Wait for disk HelmReleases to become ready
+echo "  Waiting for vm-disk HelmReleases to reconcile..."
+for entry in "${INSTANCES[@]}"; do
+  ns="${entry%%/*}"
+  instance="${entry#*/}"
+  disk_name="${NEW_DISK_PREFIX}-${instance}"
+  for i in $(seq 1 30); do
+    ready=$(kubectl -n "$ns" get hr "$disk_name" -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}' 2>/dev/null || echo "")
+    if [ "$ready" = "True" ]; then
+      echo "  [OK] ${ns}/hr/${disk_name} is Ready"
+      break
+    fi
+    sleep 5
+  done
+done
+
+# ============================================================
+# STEP 6: Unsuspend vm-instance HelmReleases
+# ============================================================
+echo ""
+echo "--- Step 6: Unsuspend vm-instance HelmReleases ---"
+for entry in "${INSTANCES[@]}"; do
+  ns="${entry%%/*}"
+  instance="${entry#*/}"
+  instance_name="${NEW_INSTANCE_PREFIX}-${instance}"
+  if resource_exists "$ns" "hr" "$instance_name"; then
+    suspended=$(kubectl -n "$ns" get hr "$instance_name" \
+      -o jsonpath='{.spec.suspend}' 2>/dev/null || echo "false")
+    if [ "$suspended" = "true" ]; then
+      echo "  [UNSUSPEND] ${ns}/hr/${instance_name}"
+      kubectl -n "$ns" patch hr "$instance_name" --type=merge -p '{"spec":{"suspend":false}}'
+    else
+      echo "  [SKIP] ${ns}/hr/${instance_name} already not suspended"
+    fi
+  fi
+done
+
+echo ""
+echo "=== Migration complete (${#INSTANCES[@]} instance(s)) ==="
+
+# Stamp version
+kubectl create configmap -n cozy-system cozystack-version \
+  --from-literal=version=30 --dry-run=client -o yaml | kubectl apply -f-
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index 9bb8e2b1..38452a17 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -6,7 +6,7 @@ sourceRef:
 migrations:
   enabled: false
   image: ghcr.io/cozystack/cozystack/platform-migrations:latest
-  targetVersion: 29
+  targetVersion: 30
 # Bundle deployment configuration
 bundles:
   system:

From 783682f171ddccf6e493085c37d0859be2240050 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 12 Feb 2026 02:07:13 +0100
Subject: [PATCH 038/666] fix(platform): fix migration 28 CDI webhook and
 cloud-init issues

Disable both cdi-operator and cdi-apiserver during DataVolume creation
to prevent CDI webhook from rejecting PVC adoption. Also delete mutating
webhook configurations alongside validating ones. Fix cloud-init value
serialization to avoid spurious newline. Add volumeMode detection from PV.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../platform/images/migrations/migrations/29  | 140 ++++++++++++++----
 1 file changed, 112 insertions(+), 28 deletions(-)

diff --git a/packages/core/platform/images/migrations/migrations/29 b/packages/core/platform/images/migrations/migrations/29
index 557fad0e..96ac66eb 100755
--- a/packages/core/platform/images/migrations/migrations/29
+++ b/packages/core/platform/images/migrations/migrations/29
@@ -11,6 +11,10 @@ NEW_DISK_PREFIX="vm-disk"
 NEW_INSTANCE_PREFIX="vm-instance"
 PROTECTION_WEBHOOK_NAME="protection-webhook"
 PROTECTION_WEBHOOK_NS="protection-webhook"
+CDI_APISERVER_NS="cozy-kubevirt-cdi"
+CDI_APISERVER_DEPLOY="cdi-apiserver"
+CDI_VALIDATING_WEBHOOKS="cdi-api-datavolume-validate cdi-api-dataimportcron-validate cdi-api-populator-validate cdi-api-validate"
+CDI_MUTATING_WEBHOOKS="cdi-api-datavolume-mutate"
 
 # ============================================================
 # Helper functions
@@ -272,7 +276,8 @@ for entry in "${INSTANCES[@]}"; do
         echo "    [SKIP] PVC ${NEW_DISK_NAME} already Bound"
       fi
     else
-      echo "    [CREATE] PVC ${NEW_DISK_NAME} -> PV ${PV_NAME}"
+      PV_VOLUME_MODE=$(kubectl get pv "$PV_NAME" -o jsonpath='{.spec.volumeMode}' 2>/dev/null || echo "Filesystem")
+      echo "    [CREATE] PVC ${NEW_DISK_NAME} -> PV ${PV_NAME} (volumeMode=${PV_VOLUME_MODE})"
       cat <<PVCEOF | kubectl -n "$NAMESPACE" apply -f -
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -285,6 +290,7 @@ metadata:
     app.kubernetes.io/instance: ${NEW_DISK_NAME}
 spec:
   accessModes: ["ReadWriteMany"]
+  volumeMode: ${PV_VOLUME_MODE}
   storageClassName: "${SYSTEM_DISK_STORAGE_CLASS}"
   volumeName: "${PV_NAME}"
   resources:
@@ -447,7 +453,7 @@ stringData:
     cpuModel: "${CPU_MODEL}"
     resources: ${RESOURCES}
     sshKeys: ${SSH_KEYS}
-    cloudInit: $(echo "$CLOUD_INIT" | jq -Rs .)
+    cloudInit: $(printf '%s' "$CLOUD_INIT" | jq -Rs .)
     cloudInitSeed: "${CLOUD_INIT_SEED}"
 ISEOF
   else
@@ -569,23 +575,30 @@ echo ""
 echo "--- Step 3: Delete protected resources ---"
 
 if [ ${#ALL_PROTECTED_RESOURCES[@]} -gt 0 ]; then
-  echo "  --- Temporarily disabling protection-webhook ---"
+  WEBHOOK_EXISTS=false
+  if kubectl -n "$PROTECTION_WEBHOOK_NS" get deploy "$PROTECTION_WEBHOOK_NAME" --no-headers 2>/dev/null | grep -q .; then
+    WEBHOOK_EXISTS=true
+  fi
 
-  WEBHOOK_REPLICAS=$(kubectl -n "$PROTECTION_WEBHOOK_NS" get deploy "$PROTECTION_WEBHOOK_NAME" \
-    -o jsonpath='{.spec.replicas}' 2>/dev/null || echo "1")
+  if [ "$WEBHOOK_EXISTS" = "true" ]; then
+    echo "  --- Temporarily disabling protection-webhook ---"
 
-  echo "  [SCALE] ${PROTECTION_WEBHOOK_NAME} -> 0 (was ${WEBHOOK_REPLICAS})"
-  kubectl -n "$PROTECTION_WEBHOOK_NS" scale deploy "$PROTECTION_WEBHOOK_NAME" --replicas=0
+    WEBHOOK_REPLICAS=$(kubectl -n "$PROTECTION_WEBHOOK_NS" get deploy "$PROTECTION_WEBHOOK_NAME" \
+      -o jsonpath='{.spec.replicas}' 2>/dev/null || echo "1")
 
-  echo "  [PATCH] Set failurePolicy=Ignore on ValidatingWebhookConfiguration/${PROTECTION_WEBHOOK_NAME}"
-  kubectl get validatingwebhookconfiguration "$PROTECTION_WEBHOOK_NAME" -o json | \
-    jq '.webhooks[].failurePolicy = "Ignore"' | \
-    kubectl apply -f -
+    echo "  [SCALE] ${PROTECTION_WEBHOOK_NAME} -> 0 (was ${WEBHOOK_REPLICAS})"
+    kubectl -n "$PROTECTION_WEBHOOK_NS" scale deploy "$PROTECTION_WEBHOOK_NAME" --replicas=0
 
-  echo "  Waiting for webhook pods to terminate..."
-  kubectl -n "$PROTECTION_WEBHOOK_NS" wait --for=delete pod \
-    -l app.kubernetes.io/name=protection-webhook --timeout=60s 2>/dev/null || true
-  sleep 3
+    echo "  [PATCH] Set failurePolicy=Ignore on ValidatingWebhookConfiguration/${PROTECTION_WEBHOOK_NAME}"
+    kubectl get validatingwebhookconfiguration "$PROTECTION_WEBHOOK_NAME" -o json | \
+      jq '.webhooks[].failurePolicy = "Ignore"' | \
+      kubectl apply -f - 2>/dev/null || true
+
+    echo "  Waiting for webhook pods to terminate..."
+    kubectl -n "$PROTECTION_WEBHOOK_NS" wait --for=delete pod \
+      -l app.kubernetes.io/name=protection-webhook --timeout=60s 2>/dev/null || true
+    sleep 3
+  fi
 
   for entry in "${ALL_PROTECTED_RESOURCES[@]}"; do
     ns="${entry%%:*}"
@@ -594,15 +607,17 @@ if [ ${#ALL_PROTECTED_RESOURCES[@]} -gt 0 ]; then
     kubectl -n "$ns" delete "$res" --wait=false 2>/dev/null || true
   done
 
-  echo "  [PATCH] Set failurePolicy=Fail on ValidatingWebhookConfiguration/${PROTECTION_WEBHOOK_NAME}"
-  kubectl get validatingwebhookconfiguration "$PROTECTION_WEBHOOK_NAME" -o json | \
-    jq '.webhooks[].failurePolicy = "Fail"' | \
-    kubectl apply -f -
+  if [ "$WEBHOOK_EXISTS" = "true" ]; then
+    echo "  [PATCH] Set failurePolicy=Fail on ValidatingWebhookConfiguration/${PROTECTION_WEBHOOK_NAME}"
+    kubectl get validatingwebhookconfiguration "$PROTECTION_WEBHOOK_NAME" -o json | \
+      jq '.webhooks[].failurePolicy = "Fail"' | \
+      kubectl apply -f - 2>/dev/null || true
 
-  echo "  [SCALE] ${PROTECTION_WEBHOOK_NAME} -> ${WEBHOOK_REPLICAS}"
-  kubectl -n "$PROTECTION_WEBHOOK_NS" scale deploy "$PROTECTION_WEBHOOK_NAME" \
-    --replicas="$WEBHOOK_REPLICAS"
-  echo "  --- protection-webhook restored ---"
+    echo "  [SCALE] ${PROTECTION_WEBHOOK_NAME} -> ${WEBHOOK_REPLICAS}"
+    kubectl -n "$PROTECTION_WEBHOOK_NS" scale deploy "$PROTECTION_WEBHOOK_NAME" \
+      --replicas="$WEBHOOK_REPLICAS"
+    echo "  --- protection-webhook restored ---"
+  fi
 else
   echo "  [SKIP] No protected resources to delete"
 fi
@@ -626,10 +641,52 @@ for pv_name in "${ALL_PV_NAMES[@]}"; do
 done
 
 # ============================================================
-# STEP 5: Unsuspend vm-disk HelmReleases first
+# STEP 5: Temporarily disable CDI datavolume webhooks
+# ============================================================
+# CDI's datavolume-validate webhook rejects DataVolume creation when a PVC
+# with the same name already exists. We must disable it so that vm-disk
+# HelmReleases can reconcile and adopt the pre-created PVCs.
+# We scale down both cdi-operator (which recreates webhook configs) and
+# cdi-apiserver (which serves the webhooks), then delete webhook configs.
+# Both are restored after vm-disk HRs reconcile.
+echo ""
+echo "--- Step 5: Temporarily disable CDI webhooks ---"
+
+CDI_OPERATOR_REPLICAS=$(kubectl -n "$CDI_APISERVER_NS" get deploy cdi-operator \
+  -o jsonpath='{.spec.replicas}' 2>/dev/null || echo "1")
+CDI_APISERVER_REPLICAS=$(kubectl -n "$CDI_APISERVER_NS" get deploy "$CDI_APISERVER_DEPLOY" \
+  -o jsonpath='{.spec.replicas}' 2>/dev/null || echo "1")
+
+echo "  [SCALE] cdi-operator -> 0 (was ${CDI_OPERATOR_REPLICAS})"
+kubectl -n "$CDI_APISERVER_NS" scale deploy cdi-operator --replicas=0
+echo "  [SCALE] ${CDI_APISERVER_DEPLOY} -> 0 (was ${CDI_APISERVER_REPLICAS})"
+kubectl -n "$CDI_APISERVER_NS" scale deploy "$CDI_APISERVER_DEPLOY" --replicas=0
+
+echo "  Waiting for cdi pods to terminate..."
+kubectl -n "$CDI_APISERVER_NS" wait --for=delete pod \
+  -l cdi.kubevirt.io=cdi-apiserver --timeout=60s 2>/dev/null || true
+kubectl -n "$CDI_APISERVER_NS" wait --for=delete pod \
+  -l name=cdi-operator --timeout=60s 2>/dev/null || true
+
+for wh in $CDI_VALIDATING_WEBHOOKS; do
+  if kubectl get validatingwebhookconfiguration "$wh" >/dev/null 2>&1; then
+    echo "  [DELETE] validatingwebhookconfiguration/${wh}"
+    kubectl delete validatingwebhookconfiguration "$wh" 2>/dev/null || true
+  fi
+done
+for wh in $CDI_MUTATING_WEBHOOKS; do
+  if kubectl get mutatingwebhookconfiguration "$wh" >/dev/null 2>&1; then
+    echo "  [DELETE] mutatingwebhookconfiguration/${wh}"
+    kubectl delete mutatingwebhookconfiguration "$wh" 2>/dev/null || true
+  fi
+done
+sleep 2
+
+# ============================================================
+# STEP 6: Unsuspend vm-disk HelmReleases first
 # ============================================================
 echo ""
-echo "--- Step 5: Unsuspend vm-disk HelmReleases ---"
+echo "--- Step 6: Unsuspend vm-disk HelmReleases ---"
 for entry in "${INSTANCES[@]}"; do
   ns="${entry%%/*}"
   instance="${entry#*/}"
@@ -643,6 +700,10 @@ for entry in "${INSTANCES[@]}"; do
     else
       echo "  [SKIP] ${ns}/hr/${disk_name} already not suspended"
     fi
+    # Force immediate reconciliation
+    echo "  [TRIGGER] Reconcile ${ns}/hr/${disk_name}"
+    kubectl -n "$ns" annotate hr "$disk_name" --overwrite \
+      "reconcile.fluxcd.io/requestedAt=$(date +%s)" 2>/dev/null || true
   fi
 done
 
@@ -652,21 +713,44 @@ for entry in "${INSTANCES[@]}"; do
   ns="${entry%%/*}"
   instance="${entry#*/}"
   disk_name="${NEW_DISK_PREFIX}-${instance}"
-  for i in $(seq 1 30); do
+  for i in $(seq 1 60); do
     ready=$(kubectl -n "$ns" get hr "$disk_name" -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}' 2>/dev/null || echo "")
     if [ "$ready" = "True" ]; then
       echo "  [OK] ${ns}/hr/${disk_name} is Ready"
       break
     fi
+    if [ "$i" = "60" ]; then
+      echo "  [WARN] ${ns}/hr/${disk_name} did not become Ready within timeout"
+    fi
     sleep 5
   done
 done
 
 # ============================================================
-# STEP 6: Unsuspend vm-instance HelmReleases
+# STEP 7: Restore CDI webhooks
+# ============================================================
+# Scale cdi-operator and cdi-apiserver back up.
+# cdi-apiserver will recreate webhook configurations automatically on start.
+echo ""
+echo "--- Step 7: Restore CDI webhooks ---"
+
+echo "  [SCALE] cdi-operator -> ${CDI_OPERATOR_REPLICAS}"
+kubectl -n "$CDI_APISERVER_NS" scale deploy cdi-operator \
+  --replicas="$CDI_OPERATOR_REPLICAS"
+echo "  [SCALE] ${CDI_APISERVER_DEPLOY} -> ${CDI_APISERVER_REPLICAS}"
+kubectl -n "$CDI_APISERVER_NS" scale deploy "$CDI_APISERVER_DEPLOY" \
+  --replicas="$CDI_APISERVER_REPLICAS"
+
+echo "  Waiting for CDI to be ready..."
+kubectl -n "$CDI_APISERVER_NS" rollout status deploy cdi-operator --timeout=120s 2>/dev/null || true
+kubectl -n "$CDI_APISERVER_NS" rollout status deploy "$CDI_APISERVER_DEPLOY" --timeout=120s 2>/dev/null || true
+echo "  --- CDI webhooks restored ---"
+
+# ============================================================
+# STEP 8: Unsuspend vm-instance HelmReleases
 # ============================================================
 echo ""
-echo "--- Step 6: Unsuspend vm-instance HelmReleases ---"
+echo "--- Step 8: Unsuspend vm-instance HelmReleases ---"
 for entry in "${INSTANCES[@]}"; do
   ns="${entry%%/*}"
   instance="${entry#*/}"

From 08a5f9890e71cfd5be937ec2fd5ea7ebec531afb Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 12 Feb 2026 08:41:33 +0100
Subject: [PATCH 039/666] feat(platform): remove virtual-machine application

The virtual-machine application is replaced by separate vm-disk and
vm-instance applications. Migration 28 handles the conversion of
existing VirtualMachine HelmReleases.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/apps/virtual-machine/.helmignore     |   3 -
 packages/apps/virtual-machine/Chart.yaml      |   7 -
 packages/apps/virtual-machine/Makefile        |  10 -
 packages/apps/virtual-machine/README.md       | 278 ------------------
 packages/apps/virtual-machine/charts/cozy-lib |   1 -
 .../hack/update-instance-types.sh             |   1 -
 packages/apps/virtual-machine/logos/vm.svg    |  21 --
 .../virtual-machine/templates/_helpers.tpl    | 126 --------
 .../templates/dashboard-resourcemap.yaml      |  43 ---
 .../templates/secret-network-config.yaml      |  40 ---
 .../virtual-machine/templates/secret.yaml     |  33 ---
 .../virtual-machine/templates/service.yaml    |  38 ---
 .../templates/vm-update-hook.yaml             | 170 -----------
 .../apps/virtual-machine/templates/vm.yaml    | 159 ----------
 .../apps/virtual-machine/values.schema.json   | 230 ---------------
 packages/apps/virtual-machine/values.yaml     | 108 -------
 .../sources/virtual-machine-application.yaml  |  29 --
 .../core/platform/templates/bundles/iaas.yaml |   1 -
 packages/system/virtual-machine-rd/Chart.yaml |   3 -
 packages/system/virtual-machine-rd/Makefile   |   4 -
 .../cozyrds/virtual-machine.yaml              |  37 ---
 .../templates/backupstrategy.yaml             |  35 ---
 .../virtual-machine-rd/templates/cozyrd.yaml  |   4 -
 .../system/virtual-machine-rd/values.yaml     |   1 -
 24 files changed, 1382 deletions(-)
 delete mode 100644 packages/apps/virtual-machine/.helmignore
 delete mode 100644 packages/apps/virtual-machine/Chart.yaml
 delete mode 100644 packages/apps/virtual-machine/Makefile
 delete mode 100644 packages/apps/virtual-machine/README.md
 delete mode 120000 packages/apps/virtual-machine/charts/cozy-lib
 delete mode 100755 packages/apps/virtual-machine/hack/update-instance-types.sh
 delete mode 100644 packages/apps/virtual-machine/logos/vm.svg
 delete mode 100644 packages/apps/virtual-machine/templates/_helpers.tpl
 delete mode 100644 packages/apps/virtual-machine/templates/dashboard-resourcemap.yaml
 delete mode 100644 packages/apps/virtual-machine/templates/secret-network-config.yaml
 delete mode 100644 packages/apps/virtual-machine/templates/secret.yaml
 delete mode 100644 packages/apps/virtual-machine/templates/service.yaml
 delete mode 100644 packages/apps/virtual-machine/templates/vm-update-hook.yaml
 delete mode 100644 packages/apps/virtual-machine/templates/vm.yaml
 delete mode 100644 packages/apps/virtual-machine/values.schema.json
 delete mode 100644 packages/apps/virtual-machine/values.yaml
 delete mode 100644 packages/core/platform/sources/virtual-machine-application.yaml
 delete mode 100644 packages/system/virtual-machine-rd/Chart.yaml
 delete mode 100644 packages/system/virtual-machine-rd/Makefile
 delete mode 100644 packages/system/virtual-machine-rd/cozyrds/virtual-machine.yaml
 delete mode 100644 packages/system/virtual-machine-rd/templates/backupstrategy.yaml
 delete mode 100644 packages/system/virtual-machine-rd/templates/cozyrd.yaml
 delete mode 100644 packages/system/virtual-machine-rd/values.yaml

diff --git a/packages/apps/virtual-machine/.helmignore b/packages/apps/virtual-machine/.helmignore
deleted file mode 100644
index 1ea0ae84..00000000
--- a/packages/apps/virtual-machine/.helmignore
+++ /dev/null
@@ -1,3 +0,0 @@
-.helmignore
-/logos
-/Makefile
diff --git a/packages/apps/virtual-machine/Chart.yaml b/packages/apps/virtual-machine/Chart.yaml
deleted file mode 100644
index 7067744b..00000000
--- a/packages/apps/virtual-machine/Chart.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-apiVersion: v2
-name: virtual-machine
-description: Virtual Machine (simple)
-icon: /logos/vm.svg
-type: application
-version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
-appVersion: 0.14.0
diff --git a/packages/apps/virtual-machine/Makefile b/packages/apps/virtual-machine/Makefile
deleted file mode 100644
index 7c482228..00000000
--- a/packages/apps/virtual-machine/Makefile
+++ /dev/null
@@ -1,10 +0,0 @@
-include ../../../hack/package.mk
-
-generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
-	yq -o json -i '.properties.gpus.items.type = "object" | .properties.gpus.default = []' values.schema.json
-	# INSTANCE_TYPES=$$(yq e '.metadata.name' -o=json -r ../../system/kubevirt-instancetypes/templates/instancetypes.yaml | yq 'split(" ") | . + [""]' -o json) \
-	#  && yq -i -o json ".properties.instanceType.enum = $${INSTANCE_TYPES}" values.schema.json
-	PREFERENCES=$$(yq e '.metadata.name' -o=json -r ../../system/kubevirt-instancetypes/templates/preferences.yaml | yq 'split(" ") | . + [""]' -o json) \
-	  && yq -i -o json ".properties.instanceProfile.enum = $${PREFERENCES}" values.schema.json
-	../../../hack/update-crd.sh
diff --git a/packages/apps/virtual-machine/README.md b/packages/apps/virtual-machine/README.md
deleted file mode 100644
index c7cfe788..00000000
--- a/packages/apps/virtual-machine/README.md
+++ /dev/null
@@ -1,278 +0,0 @@
-# Virtual Machine (simple)
-
-A Virtual Machine (VM) simulates computer hardware, enabling various operating systems and applications to run in an isolated environment.
-
-## Deployment Details
-
-The virtual machine is managed and hosted through KubeVirt, allowing you to harness the benefits of virtualization within your Kubernetes ecosystem.
-
-- Docs: [KubeVirt User Guide](https://kubevirt.io/user-guide/)
-- GitHub: [KubeVirt Repository](https://github.com/kubevirt/kubevirt)
-
-## Accessing virtual machine
-
-You can access the virtual machine using the virtctl tool:
-- [KubeVirt User Guide - Virtctl Client Tool](https://kubevirt.io/user-guide/user_workloads/virtctl_client_tool/)
-
-To access the serial console:
-
-```
-virtctl console <vm>
-```
-
-To access the VM using VNC:
-
-```
-virtctl vnc <vm>
-```
-
-To SSH into the VM:
-
-```
-virtctl ssh <user>@<vm>
-```
-
-## Parameters
-
-### Common parameters
-
-| Name                      | Description                                                                                                                       | Type       | Value        |
-| ------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ---------- | ------------ |
-| `external`                | Enable external access from outside the cluster.                                                                                  | `bool`     | `false`      |
-| `externalMethod`          | Method to pass through traffic to the VM.                                                                                         | `string`   | `PortList`   |
-| `externalPorts`           | Ports to forward from outside the cluster.                                                                                        | `[]int`    | `[22]`       |
-| `runStrategy`             | Requested running state of the VirtualMachineInstance                                                                             | `string`   | `Always`     |
-| `instanceType`            | Virtual Machine instance type.                                                                                                    | `string`   | `u1.medium`  |
-| `instanceProfile`         | Virtual Machine preferences profile.                                                                                              | `string`   | `ubuntu`     |
-| `systemDisk`              | System disk configuration.                                                                                                        | `object`   | `{}`         |
-| `systemDisk.image`        | The base image for the virtual machine.                                                                                           | `string`   | `ubuntu`     |
-| `systemDisk.storage`      | The size of the disk allocated for the virtual machine.                                                                           | `string`   | `5Gi`        |
-| `systemDisk.storageClass` | StorageClass used to store the data.                                                                                              | `string`   | `replicated` |
-| `subnets`                 | Additional subnets                                                                                                                | `[]object` | `[]`         |
-| `subnets[i].name`         | Subnet name                                                                                                                       | `string`   | `""`         |
-| `gpus`                    | List of GPUs to attach.                                                                                                           | `[]object` | `[]`         |
-| `gpus[i].name`            | The name of the GPU resource to attach.                                                                                           | `string`   | `""`         |
-| `cpuModel`                | Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map | `string`   | `""`         |
-| `resources`               | Resource configuration for the virtual machine.                                                                                   | `object`   | `{}`         |
-| `resources.cpu`           | Number of CPU cores allocated.                                                                                                    | `quantity` | `""`         |
-| `resources.sockets`       | Number of CPU sockets (vCPU topology).                                                                                            | `quantity` | `""`         |
-| `resources.memory`        | Amount of memory allocated.                                                                                                       | `quantity` | `""`         |
-| `sshKeys`                 | List of SSH public keys for authentication.                                                                                       | `[]string` | `[]`         |
-| `cloudInit`               | Cloud-init user data.                                                                                                             | `string`   | `""`         |
-| `cloudInitSeed`           | Seed string to generate SMBIOS UUID for the VM.                                                                                   | `string`   | `""`         |
-
-
-## U Series
-
-The U Series is quite neutral and provides resources for
-general purpose applications.
-
-*U* is the abbreviation for "Universal", hinting at the universal
-attitude towards workloads.
-
-VMs of instance types will share physical CPU cores on a
-time-slice basis with other VMs.
-
-### U Series Characteristics
-
-Specific characteristics of this series are:
-- *Burstable CPU performance* - The workload has a baseline compute
-  performance but is permitted to burst beyond this baseline, if
-  excess compute resources are available.
-- *vCPU-To-Memory Ratio (1:4)* - A vCPU-to-Memory ratio of 1:4, for less
-  noise per node.
-
-## O Series
-
-The O Series is based on the U Series, with the only difference
-being that memory is overcommitted.
-
-*O* is the abbreviation for "Overcommitted".
-
-### UO Series Characteristics
-
-Specific characteristics of this series are:
-- *Burstable CPU performance* - The workload has a baseline compute
-  performance but is permitted to burst beyond this baseline, if
-  excess compute resources are available.
-- *Overcommitted Memory* - Memory is over-committed in order to achieve
-  a higher workload density.
-- *vCPU-To-Memory Ratio (1:4)* - A vCPU-to-Memory ratio of 1:4, for less
-  noise per node.
-
-## CX Series
-
-The CX Series provides exclusive compute resources for compute
-intensive applications.
-
-*CX* is the abbreviation of "Compute Exclusive".
-
-The exclusive resources are given to the compute threads of the
-VM. In order to ensure this, some additional cores (depending
-on the number of disks and NICs) will be requested to offload
-the IO threading from cores dedicated to the workload.
-In addition, in this series, the NUMA topology of the used
-cores is provided to the VM.
-
-### CX Series Characteristics
-
-Specific characteristics of this series are:
-- *Hugepages* - Hugepages are used in order to improve memory
-  performance.
-- *Dedicated CPU* - Physical cores are exclusively assigned to every
-  vCPU in order to provide fixed and high compute guarantees to the
-  workload.
-- *Isolated emulator threads* - Hypervisor emulator threads are isolated
-  from the vCPUs in order to reduce emaulation related impact on the
-  workload.
-- *vNUMA* - Physical NUMA topology is reflected in the guest in order to
-  optimize guest sided cache utilization.
-- *vCPU-To-Memory Ratio (1:2)* - A vCPU-to-Memory ratio of 1:2.
-
-## M Series
-
-The M Series provides resources for memory intensive
-applications.
-
-*M* is the abbreviation of "Memory".
-
-### M Series Characteristics
-
-Specific characteristics of this series are:
-- *Hugepages* - Hugepages are used in order to improve memory
-  performance.
-- *Burstable CPU performance* - The workload has a baseline compute
-  performance but is permitted to burst beyond this baseline, if
-  excess compute resources are available.
-- *vCPU-To-Memory Ratio (1:8)* - A vCPU-to-Memory ratio of 1:8, for much
-  less noise per node.
-
-## RT Series
-
-The RT Series provides resources for realtime applications, like Oslat.
-
-*RT* is the abbreviation for "realtime".
-
-This series of instance types requires nodes capable of running
-realtime applications.
-
-### RT Series Characteristics
-
-Specific characteristics of this series are:
-- *Hugepages* - Hugepages are used in order to improve memory
-  performance.
-- *Dedicated CPU* - Physical cores are exclusively assigned to every
-  vCPU in order to provide fixed and high compute guarantees to the
-  workload.
-- *Isolated emulator threads* - Hypervisor emulator threads are isolated
-  from the vCPUs in order to reduce emaulation related impact on the
-  workload.
-- *vCPU-To-Memory Ratio (1:4)* - A vCPU-to-Memory ratio of 1:4 starting from
-  the medium size.
-
-## Development
-
-To get started with customizing or creating your own instancetypes and preferences
-see [DEVELOPMENT.md](./DEVELOPMENT.md).
-
-## Resources
-
-The following instancetype resources are provided by Cozystack:
-
-Name | vCPUs | Memory
------|-------|-------
-cx1.2xlarge  |  8  |  16Gi
-cx1.4xlarge  |  16  |  32Gi
-cx1.8xlarge  |  32  |  64Gi
-cx1.large  |  2  |  4Gi
-cx1.medium  |  1  |  2Gi
-cx1.xlarge  |  4  |  8Gi
-gn1.2xlarge  |  8  |  32Gi
-gn1.4xlarge  |  16  |  64Gi
-gn1.8xlarge  |  32  |  128Gi
-gn1.xlarge  |  4  |  16Gi
-m1.2xlarge  |  8  |  64Gi
-m1.4xlarge  |  16  |  128Gi
-m1.8xlarge  |  32  |  256Gi
-m1.large  |  2  |  16Gi
-m1.xlarge  |  4  |  32Gi
-n1.2xlarge  |  16  |  32Gi
-n1.4xlarge  |  32  |  64Gi
-n1.8xlarge  |  64  |  128Gi
-n1.large  |  4  |  8Gi
-n1.medium  |  4  |  4Gi
-n1.xlarge  |  8  |  16Gi
-o1.2xlarge  |  8  |  32Gi
-o1.4xlarge  |  16  |  64Gi
-o1.8xlarge  |  32  |  128Gi
-o1.large  |  2  |  8Gi
-o1.medium  |  1  |  4Gi
-o1.micro  |  1  |  1Gi
-o1.nano  |  1  |  512Mi
-o1.small  |  1  |  2Gi
-o1.xlarge  |  4  |  16Gi
-rt1.2xlarge  |  8  |  32Gi
-rt1.4xlarge  |  16  |  64Gi
-rt1.8xlarge  |  32  |  128Gi
-rt1.large  |  2  |  8Gi
-rt1.medium  |  1  |  4Gi
-rt1.micro  |  1  |  1Gi
-rt1.small  |  1  |  2Gi
-rt1.xlarge  |  4  |  16Gi
-u1.2xlarge  |  8  |  32Gi
-u1.2xmedium  |  2  |  4Gi
-u1.4xlarge  |  16  |  64Gi
-u1.8xlarge  |  32  |  128Gi
-u1.large  |  2  |  8Gi
-u1.medium  |  1  |  4Gi
-u1.micro  |  1  |  1Gi
-u1.nano  |  1  |  512Mi
-u1.small  |  1  |  2Gi
-u1.xlarge  |  4  |  16Gi
-
-The following preference resources are provided by Cozystack:
-
-Name | Guest OS
------|---------
-alpine | Alpine
-centos.7 | CentOS 7
-centos.7.desktop | CentOS 7
-centos.stream10 | CentOS Stream 10
-centos.stream10.desktop | CentOS Stream 10
-centos.stream8 | CentOS Stream 8
-centos.stream8.desktop | CentOS Stream 8
-centos.stream8.dpdk | CentOS Stream 8
-centos.stream9 | CentOS Stream 9
-centos.stream9.desktop | CentOS Stream 9
-centos.stream9.dpdk | CentOS Stream 9
-cirros | Cirros
-fedora | Fedora (amd64)
-fedora.arm64 | Fedora (arm64)
-opensuse.leap | OpenSUSE Leap
-opensuse.tumbleweed | OpenSUSE Tumbleweed
-rhel.10 | Red Hat Enterprise Linux 10 Beta (amd64)
-rhel.10.arm64 | Red Hat Enterprise Linux 10 Beta (arm64)
-rhel.7 | Red Hat Enterprise Linux 7
-rhel.7.desktop | Red Hat Enterprise Linux 7
-rhel.8 | Red Hat Enterprise Linux 8
-rhel.8.desktop | Red Hat Enterprise Linux 8
-rhel.8.dpdk | Red Hat Enterprise Linux 8
-rhel.9 | Red Hat Enterprise Linux 9 (amd64)
-rhel.9.arm64 | Red Hat Enterprise Linux 9 (arm64)
-rhel.9.desktop | Red Hat Enterprise Linux 9 Desktop (amd64)
-rhel.9.dpdk | Red Hat Enterprise Linux 9 DPDK (amd64)
-rhel.9.realtime | Red Hat Enterprise Linux 9 Realtime (amd64)
-sles | SUSE Linux Enterprise Server
-ubuntu | Ubuntu
-windows.10 | Microsoft Windows 10
-windows.10.virtio | Microsoft Windows 10 (virtio)
-windows.11 | Microsoft Windows 11
-windows.11.virtio | Microsoft Windows 11 (virtio)
-windows.2k16 | Microsoft Windows Server 2016
-windows.2k16.virtio | Microsoft Windows Server 2016 (virtio)
-windows.2k19 | Microsoft Windows Server 2019
-windows.2k19.virtio | Microsoft Windows Server 2019 (virtio)
-windows.2k22 | Microsoft Windows Server 2022
-windows.2k22.virtio | Microsoft Windows Server 2022 (virtio)
-windows.2k25 | Microsoft Windows Server 2025
-windows.2k25.virtio | Microsoft Windows Server 2025 (virtio)
diff --git a/packages/apps/virtual-machine/charts/cozy-lib b/packages/apps/virtual-machine/charts/cozy-lib
deleted file mode 120000
index e1813509..00000000
--- a/packages/apps/virtual-machine/charts/cozy-lib
+++ /dev/null
@@ -1 +0,0 @@
-../../../library/cozy-lib
\ No newline at end of file
diff --git a/packages/apps/virtual-machine/hack/update-instance-types.sh b/packages/apps/virtual-machine/hack/update-instance-types.sh
deleted file mode 100755
index 1a248525..00000000
--- a/packages/apps/virtual-machine/hack/update-instance-types.sh
+++ /dev/null
@@ -1 +0,0 @@
-#!/bin/sh
diff --git a/packages/apps/virtual-machine/logos/vm.svg b/packages/apps/virtual-machine/logos/vm.svg
deleted file mode 100644
index 9c3e34d9..00000000
--- a/packages/apps/virtual-machine/logos/vm.svg
+++ /dev/null
@@ -1,21 +0,0 @@
-<svg width="144" height="144" viewBox="0 0 144 144" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect width="144" height="144" rx="24" fill="url(#paint0_linear_687_3454)"/>
-<g clip-path="url(#clip0_687_3454)">
-<path d="M89.5039 111.707H54.497C54.1727 111.707 54.0108 111.221 54.3349 111.059L57.2522 108.952C60.3314 106.683 61.9522 102.631 60.9797 98.7412H83.021C82.0485 102.631 83.6693 106.683 86.7485 108.952L89.6658 111.059C89.99 111.221 89.8279 111.707 89.5039 111.707Z" fill="#B0B6BB"/>
-<path d="M113.328 98.741H30.6725C27.5931 98.741 25 96.148 25 93.0687V33.1032C25 30.0239 27.5931 27.4307 30.6725 27.4307H113.328C116.407 27.4307 119 30.0237 119 33.1032V93.0687C119 96.148 116.407 98.741 113.328 98.741Z" fill="#E8EDEE"/>
-<path d="M119 84.1549H25V33.1032C25 30.0239 27.5931 27.4307 30.6725 27.4307H113.328C116.407 27.4307 119 30.0237 119 33.1032L119 84.1549Z" fill="#00B3FF"/>
-<path d="M90.6374 116.569H53.3616C52.0651 116.569 50.9307 115.435 50.9307 114.138C50.9307 112.841 52.0651 111.707 53.3616 111.707H90.6374C91.9339 111.707 93.0684 112.841 93.0684 114.138C93.0684 115.435 91.9339 116.569 90.6374 116.569Z" fill="#E8EDEE"/>
-</g>
-<path d="M72.5275 53.8367C72.4431 53.8351 72.3605 53.8122 72.2873 53.7701L56.4699 44.7934C56.3983 44.7519 56.3388 44.6923 56.2973 44.6207C56.2559 44.549 56.2338 44.4678 56.2334 44.385C56.2334 44.2169 56.3258 44.0617 56.4699 43.9785L72.1912 35.0609C72.2637 35.021 72.345 35 72.4277 35C72.5105 35 72.5918 35.021 72.6643 35.0609L88.4872 44.0395C88.5591 44.0801 88.6188 44.1392 88.66 44.2107C88.7013 44.2822 88.7227 44.3635 88.7219 44.446C88.7225 44.5285 88.701 44.6097 88.6598 44.6812C88.6185 44.7526 88.5589 44.8118 88.4872 44.8525L72.7714 53.7683C72.6972 53.8114 72.6133 53.8349 72.5275 53.8367" fill="white"/>
-<path opacity="0.7" d="M70.2553 75.6517C70.171 75.6535 70.0878 75.6317 70.0151 75.5888L54.2458 66.6417C54.1715 66.6024 54.1095 66.5436 54.0661 66.4716C54.0228 66.3997 54 66.3173 54 66.2333V48.278C54 48.108 54.0924 47.9546 54.2439 47.8696C54.3172 47.8271 54.4004 47.8047 54.4851 47.8047C54.5697 47.8047 54.6529 47.8271 54.7262 47.8696L70.4937 56.8131C70.5642 56.8565 70.6225 56.917 70.6632 56.9891C70.7039 57.0612 70.7257 57.1424 70.7265 57.2251V75.1805C70.7259 75.2628 70.7042 75.3436 70.6635 75.4151C70.6227 75.4866 70.5642 75.5464 70.4937 75.5888C70.4206 75.6291 70.3387 75.6507 70.2553 75.6517" fill="white"/>
-<path opacity="0.4" d="M74.7198 75.6511C74.6333 75.6512 74.5482 75.6296 74.4722 75.5883C74.4016 75.5461 74.3432 75.4862 74.3027 75.4147C74.2623 75.3431 74.2411 75.2622 74.2412 75.18V57.3373C74.2412 57.171 74.3336 57.0158 74.4722 56.929L90.2397 47.9855C90.3119 47.9438 90.3938 47.9219 90.4771 47.9219C90.5605 47.9219 90.6424 47.9438 90.7146 47.9855C90.7876 48.0255 90.8485 48.0842 90.8911 48.1557C90.9337 48.2272 90.9563 48.3088 90.9566 48.392V66.2328C90.957 66.3164 90.9347 66.3985 90.8921 66.4704C90.8495 66.5424 90.7881 66.6014 90.7146 66.6411L74.9526 75.5883C74.8825 75.6307 74.8018 75.6525 74.7198 75.6511" fill="white"/>
-<defs>
-<linearGradient id="paint0_linear_687_3454" x1="161" y1="180" x2="3.59284e-07" y2="4.99998" gradientUnits="userSpaceOnUse">
-<stop/>
-<stop offset="1" stop-color="#595656"/>
-</linearGradient>
-<clipPath id="clip0_687_3454">
-<rect width="94" height="94" fill="white" transform="translate(25 25)"/>
-</clipPath>
-</defs>
-</svg>
diff --git a/packages/apps/virtual-machine/templates/_helpers.tpl b/packages/apps/virtual-machine/templates/_helpers.tpl
deleted file mode 100644
index ddea90fe..00000000
--- a/packages/apps/virtual-machine/templates/_helpers.tpl
+++ /dev/null
@@ -1,126 +0,0 @@
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "virtual-machine.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "virtual-machine.fullname" -}}
-{{- if .Values.fullnameOverride }}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- $name := default .Chart.Name .Values.nameOverride }}
-{{- if contains $name .Release.Name }}
-{{- .Release.Name | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "virtual-machine.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Common labels
-*/}}
-{{- define "virtual-machine.labels" -}}
-helm.sh/chart: {{ include "virtual-machine.chart" . }}
-{{ include "virtual-machine.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "virtual-machine.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "virtual-machine.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
-{{/*
-Generate a stable UUID for cloud-init re-initialization upon upgrade.
-*/}}
-{{- define "virtual-machine.stableUuid" -}}
-{{- $source := printf "%s-%s-%s" .Release.Namespace (include "virtual-machine.fullname" .) .Values.cloudInitSeed }}
-{{- $hash := sha256sum $source }}
-{{- $uuid := printf "%s-%s-4%s-9%s-%s" (substr 0 8 $hash) (substr 8 12 $hash) (substr 13 16 $hash) (substr 17 20 $hash) (substr 20 32 $hash) }}
-{{- if eq .Values.cloudInitSeed "" }}
-  {{- /*  Try to save previous uuid to not trigger full cloud-init again if user decided to remove the seed. */}}
-  {{- $vmResource := lookup "kubevirt.io/v1" "VirtualMachine" .Release.Namespace (include "virtual-machine.fullname" .) -}}
-  {{- if $vmResource }}
-    {{- $existingUuid := $vmResource | dig "spec" "template" "spec" "domain" "firmware" "uuid" "" }}
-    {{- if $existingUuid }}
-      {{- $uuid = $existingUuid }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{- $uuid }}
-{{- end }}
-
-{{/*
-Domain resources (cpu, memory) as a JSON object.
-Used in vm.yaml for rendering and in the update hook for merge patches.
-*/}}
-{{- define "virtual-machine.domainResources" -}}
-{{- $result := dict -}}
-{{- if or .Values.cpuModel (and .Values.resources .Values.resources.cpu .Values.resources.sockets) -}}
-  {{- $cpu := dict -}}
-  {{- if and .Values.resources .Values.resources.cpu .Values.resources.sockets -}}
-    {{- $_ := set $cpu "cores" (.Values.resources.cpu | int64) -}}
-    {{- $_ := set $cpu "sockets" (.Values.resources.sockets | int64) -}}
-  {{- end -}}
-  {{- if .Values.cpuModel -}}
-    {{- $_ := set $cpu "model" .Values.cpuModel -}}
-  {{- end -}}
-  {{- $_ := set $result "cpu" $cpu -}}
-{{- end -}}
-{{- if and .Values.resources .Values.resources.memory -}}
-  {{- $_ := set $result "resources" (dict "requests" (dict "memory" .Values.resources.memory)) -}}
-{{- end -}}
-{{- $result | toJson -}}
-{{- end -}}
-
-{{/*
-Node Affinity for Windows VMs
-*/}}
-{{- define "virtual-machine.nodeAffinity" -}}
-{{- if .Values._cluster.scheduling -}}
-{{- $dedicatedNodesForWindowsVMs := get .Values._cluster.scheduling "dedicatedNodesForWindowsVMs" -}}
-{{- if eq $dedicatedNodesForWindowsVMs "true" -}}
-{{- $isWindows := hasPrefix "windows" (toString .Values.instanceProfile) -}}
-affinity:
-  nodeAffinity:
-    {{- if $isWindows }}
-    requiredDuringSchedulingIgnoredDuringExecution:
-      nodeSelectorTerms:
-      - matchExpressions:
-        - key: scheduling.cozystack.io/vm-windows
-          operator: In
-          values:
-          - "true"
-    {{- else }}
-    preferredDuringSchedulingIgnoredDuringExecution:
-    - weight: 100
-      preference:
-        matchExpressions:
-        - key: scheduling.cozystack.io/vm-windows
-          operator: NotIn
-          values:
-          - "true"
-    {{- end }}
-{{- end -}}
-{{- end -}}
-{{- end -}}
diff --git a/packages/apps/virtual-machine/templates/dashboard-resourcemap.yaml b/packages/apps/virtual-machine/templates/dashboard-resourcemap.yaml
deleted file mode 100644
index 4beac5dc..00000000
--- a/packages/apps/virtual-machine/templates/dashboard-resourcemap.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ .Release.Name }}-dashboard-resources
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - services
-  resourceNames:
-  - {{ include "virtual-machine.fullname" . }}
-  verbs: ["get", "list", "watch"]
-- apiGroups:
-  - cozystack.io
-  resources:
-  - workloadmonitors
-  resourceNames:
-  - {{ .Release.Name }}
-  verbs: ["get", "list", "watch"]
----
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-dashboard-resources
-subjects:
-{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }}
-roleRef:
-  kind: Role
-  name: {{ .Release.Name }}-dashboard-resources
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: cozystack.io/v1alpha1
-kind: WorkloadMonitor
-metadata:
-  name: {{ $.Release.Name }}
-spec:
-  replicas: 1
-  minReplicas: 1
-  kind: virtual-machine
-  type: virtual-machine
-  selector:
-    app.kubernetes.io/instance: {{ .Release.Name }}
-  version: {{ $.Chart.Version }}
diff --git a/packages/apps/virtual-machine/templates/secret-network-config.yaml b/packages/apps/virtual-machine/templates/secret-network-config.yaml
deleted file mode 100644
index 9800ceac..00000000
--- a/packages/apps/virtual-machine/templates/secret-network-config.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-# if subnets are specified and image is either ubunu or alpine
-{{- if and .Values.subnets (or (eq .Values.systemDisk.image "ubuntu") (eq .Values.systemDisk.image "alpine")) }}
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "virtual-machine.fullname" $ }}-network-config
-stringData:
-  networkData: |
-    network:
-      version: 1
-      config:
-      {{- if eq .Values.systemDisk.image "ubuntu" }}
-      # main iface
-      - type: physical
-        name: enp1s0
-        subnets:
-          - type: dhcp
-      # additional ifaces attached to subnets
-      {{- range $i, $subnet := .Values.subnets }}
-      - type: physical
-        name: enp{{ add 2 $i }}s0
-        subnets:
-          - type: dhcp
-      {{- end }}
-      {{- else if eq .Values.systemDisk.image "alpine" }}
-      #main iface
-      - type: physical
-        name: eth0
-        subnets:
-          - type: dhcp
-      # additional ifaces attached to subnets
-      {{- range $i, $subnet := .Values.subnets }}
-      - type: physical
-        name: eth{{ add1 $i }}
-        subnets:
-          - type: dhcp
-      {{- end }}
-      {{- end }}
-{{- end }}
diff --git a/packages/apps/virtual-machine/templates/secret.yaml b/packages/apps/virtual-machine/templates/secret.yaml
deleted file mode 100644
index 73cd92bf..00000000
--- a/packages/apps/virtual-machine/templates/secret.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-{{- if .Values.sshKeys }}
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "virtual-machine.fullname" $ }}-ssh-keys
-stringData:
-  {{- range $k, $v := .Values.sshKeys }}
-  key{{ $k }}: {{ quote $v }} 
-  {{- end }}
-{{- end }}
-{{- if or .Values.cloudInit .Values.sshKeys }}
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "virtual-machine.fullname" . }}-cloud-init
-stringData:
-  userdata: |
-    {{- if .Values.cloudInit }}
-    {{-   .Values.cloudInit | nindent 4 }}
-    {{- else if and (.Values.sshKeys) (not .Values.cloudInit) }}
-    {{- /*
-      We usually provide ssh keys in cloud-init metadata, because userdata it not typed and can be used for any purpose.
-      However, if user provides ssh keys but not cloud-init, we still need to provide a minimal cloud-init config to avoid errors.
-    */}}
-    #cloud-config
-    ssh_authorized_keys:
-      {{- range .Values.sshKeys }}
-      - {{ quote . }} 
-      {{- end }}
-    {{- end }}
-{{- end }}
diff --git a/packages/apps/virtual-machine/templates/service.yaml b/packages/apps/virtual-machine/templates/service.yaml
deleted file mode 100644
index b12f7612..00000000
--- a/packages/apps/virtual-machine/templates/service.yaml
+++ /dev/null
@@ -1,38 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "virtual-machine.fullname" . }}
-  labels:
-    apps.cozystack.io/user-service: "true"
-    {{- include "virtual-machine.labels" . | nindent 4 }}
-{{- if .Values.external }}
-  annotations:
-    networking.cozystack.io/wholeIP: "true"
-{{- end }}
-spec:
-  type: {{ ternary "LoadBalancer" "ClusterIP" .Values.external }}
-{{- if .Values.external }}
-  externalTrafficPolicy: Local
-    {{- if ((include "cozy-lib.network.disableLoadBalancerNodePorts" $) | fromYaml) }}
-  allocateLoadBalancerNodePorts: false
-    {{- end }}
-{{- else }}
-  clusterIP: None
-{{- end }}
-  selector:
-    {{- include "virtual-machine.selectorLabels" . | nindent 4 }}
-  ports:
-{{- if .Values.external }}
-    {{- if and (eq .Values.externalMethod "WholeIP") (not .Values.externalPorts) }}
-    - port: 65535
-    {{- else }}
-    {{- range .Values.externalPorts }}
-    - name: port-{{ . }}
-      port: {{ . }}
-      targetPort: {{ . }}
-    {{- end }}
-    {{- end }}
-{{- else }}
-    - port: 65535
-{{- end }}
diff --git a/packages/apps/virtual-machine/templates/vm-update-hook.yaml b/packages/apps/virtual-machine/templates/vm-update-hook.yaml
deleted file mode 100644
index 65ee02f0..00000000
--- a/packages/apps/virtual-machine/templates/vm-update-hook.yaml
+++ /dev/null
@@ -1,170 +0,0 @@
-{{- $vmName := include "virtual-machine.fullname" . -}}
-{{- $namespace := .Release.Namespace -}}
-
-{{- $existingVM := lookup "kubevirt.io/v1" "VirtualMachine" $namespace $vmName -}}
-{{- $existingPVC := lookup "v1" "PersistentVolumeClaim" $namespace $vmName -}}
-{{- $existingService := lookup "v1" "Service" $namespace $vmName -}}
-
-{{- $instanceType := .Values.instanceType | default "" -}}
-{{- $instanceProfile := .Values.instanceProfile | default "" -}}
-{{- $desiredStorage := .Values.systemDisk.storage | default "" -}}
-{{- $desiredServiceType := ternary "LoadBalancer" "ClusterIP" .Values.external -}}
-
-{{- $needUpdateType := false -}}
-{{- $needUpdateProfile := false -}}
-{{- $needResizePVC := false -}}
-{{- $needRecreateService := false -}}
-{{- $needRemoveInstanceType := false -}}
-{{- $needRemoveCustomResources := false -}}
-
-{{- $existingHasInstanceType := and $existingVM $existingVM.spec.instancetype -}}
-{{- if and $existingHasInstanceType (not $instanceType) -}}
-  {{- $needRemoveInstanceType = true -}}
-{{- else if and $existingHasInstanceType $instanceType -}}
-  {{- if not (eq $existingVM.spec.instancetype.name $instanceType) -}}
-    {{- $needUpdateType = true -}}
-  {{- end -}}
-{{- else if and $existingVM (not $existingHasInstanceType) $instanceType -}}
-  {{- $needRemoveCustomResources = true -}}
-{{- end -}}
-
-{{- if and $existingVM $existingVM.spec.preference $instanceProfile -}}
-  {{- if not (eq $existingVM.spec.preference.name $instanceProfile) -}}
-    {{- $needUpdateProfile = true -}}
-  {{- end -}}
-{{- end -}}
-
-{{- if and $existingPVC $desiredStorage -}}
-  {{- $currentStorage := $existingPVC.spec.resources.requests.storage | toString -}}
-  {{- if not (eq $currentStorage $desiredStorage) -}}
-    {{- $oldSize := (include "cozy-lib.resources.toFloat" $currentStorage) | float64 -}}
-    {{- $newSize := (include "cozy-lib.resources.toFloat" $desiredStorage) | float64 -}}
-    {{- if gt $newSize $oldSize -}}
-      {{- $needResizePVC = true -}}
-    {{- end -}}
-  {{- end -}}
-{{- end -}}
-
-{{- if $existingService -}}
-  {{- $currentServiceType := $existingService.spec.type -}}
-  {{- if ne $currentServiceType $desiredServiceType -}}
-    {{- $needRecreateService = true -}}
-  {{- end -}}
-{{- end -}}
-
-{{- if or $needUpdateType $needUpdateProfile $needResizePVC $needRecreateService $needRemoveInstanceType $needRemoveCustomResources }}
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: "{{ $.Release.Name }}-update-hook"
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-weight: "0"
-    helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation
-spec:
-  template:
-    metadata:
-      labels:
-        app: "{{ $.Release.Name }}-update-hook"
-        policy.cozystack.io/allow-to-apiserver: "true"
-    spec:
-      serviceAccountName: {{ $.Release.Name }}-update-hook
-      restartPolicy: Never
-      containers:
-        - name: update-resources
-          image: docker.io/alpine/k8s:1.33.4
-          resources:
-            requests:
-              memory: "16Mi"
-              cpu: "10m"
-            limits:
-              memory: "128Mi"
-              cpu: "100m"
-          command: ["sh", "-exc"]
-          args:
-            - |
-              {{- if $needUpdateType }}
-              echo "Patching VirtualMachine for instancetype update..."
-              kubectl patch virtualmachines.kubevirt.io {{ $vmName }} -n {{ $namespace }} \
-                --type merge \
-                -p '{"spec":{"instancetype":{"name": "{{ $instanceType }}", "revisionName": null}}}'
-              {{- end }}
-              
-              {{- if $needUpdateProfile }}
-              echo "Patching VirtualMachine for preference update..."
-              kubectl patch virtualmachines.kubevirt.io {{ $vmName }} -n {{ $namespace }} \
-                --type merge \
-                -p '{"spec":{"preference":{"name": "{{ $instanceProfile }}", "revisionName": null}}}'
-              {{- end }}
-
-              {{- if $needRemoveInstanceType }}
-              echo "Removing instancetype from VM (switching to custom resources)..."
-              kubectl patch virtualmachines.kubevirt.io {{ $vmName }} -n {{ $namespace }} \
-                --type merge \
-                -p '{"spec":{"instancetype":null{{- if not $instanceProfile }},"preference":null{{- end }},"template":{"spec":{"domain":{{ include "virtual-machine.domainResources" . }}}}}}'
-              {{- end }}
-
-              {{- if $needRemoveCustomResources }}
-              echo "Removing custom CPU/memory from domain (switching to instancetype)..."
-              kubectl patch virtualmachines.kubevirt.io {{ $vmName }} -n {{ $namespace }} \
-                --type merge \
-                -p '{"spec":{"instancetype":{"name":"{{ $instanceType }}","revisionName":null},"template":{"spec":{"domain":{"cpu":null,"resources":null}}}}}'
-              {{- end }}
-
-              {{- if $needResizePVC }}
-              echo "Patching PVC for storage resize..."
-              kubectl patch pvc {{ $vmName }} -n {{ $namespace }} \
-                --type merge \
-                -p '{"spec":{"resources":{"requests":{"storage":"{{ $desiredStorage }}"}}}}'
-              {{- end }}
-
-              {{- if $needRecreateService }}
-              echo "Removing Service..."
-              kubectl delete service --cascade=orphan -n {{ $namespace }} {{ $vmName }}
-              {{- end }}
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ $.Release.Name }}-update-hook
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-weight: "-5"
-    helm.sh/hook-delete-policy: before-hook-creation
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ $.Release.Name }}-update-hook
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-weight: "-5"
-    helm.sh/hook-delete-policy: before-hook-creation
-rules:
-  - apiGroups: ["kubevirt.io"]
-    resources: ["virtualmachines"]
-    verbs: ["patch", "get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["persistentvolumeclaims"]
-    verbs: ["patch", "get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["services"]
-    resourceNames: ["{{ $vmName }}"]
-    verbs: ["delete"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ $.Release.Name }}-update-hook
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-weight: "-5"
-    helm.sh/hook-delete-policy: before-hook-creation
-subjects:
-  - kind: ServiceAccount
-    name: {{ $.Release.Name }}-update-hook
-roleRef:
-  kind: Role
-  name: {{ $.Release.Name }}-update-hook
-  apiGroup: rbac.authorization.k8s.io
-{{- end }}
diff --git a/packages/apps/virtual-machine/templates/vm.yaml b/packages/apps/virtual-machine/templates/vm.yaml
deleted file mode 100644
index c1b67344..00000000
--- a/packages/apps/virtual-machine/templates/vm.yaml
+++ /dev/null
@@ -1,159 +0,0 @@
-{{- if and .Values.instanceType (not (lookup "instancetype.kubevirt.io/v1beta1" "VirtualMachineClusterInstancetype" "" .Values.instanceType)) }}
-{{-   fail (printf "Specified instancetype not exists in cluster: %s" .Values.instanceType) }}
-{{- end }}
-{{- if and .Values.instanceProfile (not (lookup "instancetype.kubevirt.io/v1beta1" "VirtualMachineClusterPreference" "" .Values.instanceProfile)) }}
-{{-   fail (printf "Specified profile not exists in cluster: %s" .Values.instanceProfile) }}
-{{- end }}
-{{- if and (not .Values.instanceType) (not (and .Values.resources .Values.resources.cpu .Values.resources.sockets .Values.resources.memory)) }}
-{{-   fail "Either instanceType or resources (cpu, sockets, memory) must be specified" }}
-{{- end }}
-
-apiVersion: kubevirt.io/v1
-kind: VirtualMachine
-metadata:
-  name: {{ include "virtual-machine.fullname" . }}
-  labels:
-    {{- include "virtual-machine.labels" . | nindent 4 }}
-spec:
-  {{- if hasKey .Values "runStrategy" }}
-  runStrategy: {{ .Values.runStrategy }}
-  {{- else }}
-  runStrategy: {{ ternary "Always" "Halted" (.Values.running | default true) }}
-  {{- end }}
-
-  {{- with .Values.instanceType }}
-  instancetype:
-    kind: VirtualMachineClusterInstancetype
-    name: {{ . }}
-  {{- end }}
-  {{- with .Values.instanceProfile }}
-  preference:
-    kind: VirtualMachineClusterPreference
-    name: {{ . }}
-  {{- end }}
-
-  dataVolumeTemplates:
-  - metadata:
-      name: {{ include "virtual-machine.fullname" . }}
-      labels:
-        app.kubernetes.io/instance: {{ .Release.Name }}
-    spec:
-      storage:
-        resources:
-          requests:
-            storage: {{ .Values.systemDisk.storage | quote }}
-        {{- with .Values.systemDisk.storageClass }}
-        storageClassName: {{ . }}
-        {{- end }}
-      source:
-        {{- $dv := lookup "cdi.kubevirt.io/v1beta1" "DataVolume" "cozy-public" (printf "vm-image-%s" .Values.systemDisk.image) }}
-        {{- if $dv }}
-        pvc:
-          name: vm-image-{{ .Values.systemDisk.image }}
-          namespace: cozy-public
-        {{- else }}
-        http:
-          {{- if eq .Values.systemDisk.image "cirros" }}
-          url: https://download.cirros-cloud.net/0.6.2/cirros-0.6.2-x86_64-disk.img
-          {{- else if eq .Values.systemDisk.image "ubuntu" }}
-          url: https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img
-          {{- else if eq .Values.systemDisk.image "fedora" }}
-          url: https://download.fedoraproject.org/pub/fedora/linux/releases/42/Cloud/x86_64/images/Fedora-Cloud-Base-Generic-42-1.1.x86_64.qcow2
-          {{- else if eq .Values.systemDisk.image "alpine" }}
-          url: https://dl-cdn.alpinelinux.org/alpine/v3.20/releases/cloud/nocloud_alpine-3.20.8-x86_64-bios-cloudinit-r0.qcow2
-          {{- else if eq .Values.systemDisk.image "talos" }}
-          url: https://github.com/siderolabs/talos/releases/download/v1.7.6/nocloud-amd64.raw.xz
-          {{- end }}
-        {{- end }}
-
-  template:
-    metadata:
-      annotations:
-        kubevirt.io/allow-pod-bridge-network-live-migration: "true"
-      labels:
-        {{- include "virtual-machine.labels" . | nindent 8 }}
-    spec:
-      domain:
-        {{- $domainRes := include "virtual-machine.domainResources" . | fromJson -}}
-        {{- with $domainRes.cpu }}
-        cpu: {{- . | toYaml | nindent 10 }}
-        {{- end }}
-        {{- with $domainRes.resources }}
-        resources: {{- . | toYaml | nindent 10 }}
-        {{- end }}
-        firmware:
-          uuid: {{ include "virtual-machine.stableUuid" . }}
-        devices:
-          {{- if .Values.gpus }}
-          gpus:
-          {{- range $i, $gpu := .Values.gpus }}
-          - name: gpu{{ add $i 1 }}
-            deviceName: {{ $gpu.name }}
-          {{- end }}
-          {{- end }}
-
-          disks:
-          - disk:
-              bus: scsi
-            name: systemdisk
-          {{- if or .Values.cloudInit .Values.sshKeys (and .Values.subnets (or (eq .Values.systemDisk.image "ubuntu") (eq .Values.systemDisk.image "alpine"))) }}
-          - disk:
-              bus: virtio
-            name: cloudinitdisk
-          {{- end }}
-
-          interfaces:
-          - name: default
-            bridge: {}
-          {{- if .Values.subnets }}
-          {{- range $i, $subnet := .Values.subnets }}
-          - name: {{ $subnet.name }}
-            bridge: {}
-          {{- end }}
-          {{- end }}
-
-        machine:
-          type: ""
-
-      {{- if .Values.sshKeys }}
-      accessCredentials:
-      - sshPublicKey:
-          source:
-            secret:
-              secretName: {{ include "virtual-machine.fullname" $ }}-ssh-keys
-          propagationMethod:
-            # keys will be injected into metadata part of cloud-init disk
-            noCloud: {}
-      {{- end }}
-
-      terminationGracePeriodSeconds: 30
-
-      {{- include "virtual-machine.nodeAffinity" . | nindent 6 }}
-
-      volumes:
-        - name: systemdisk
-          dataVolume:
-            name: {{ include "virtual-machine.fullname" . }}
-        {{- if or .Values.cloudInit .Values.sshKeys (and .Values.subnets (or (eq .Values.systemDisk.image "ubuntu") (eq .Values.systemDisk.image "alpine"))) }}
-        - name: cloudinitdisk
-          cloudInitNoCloud:
-            {{- if or .Values.cloudInit .Values.sshKeys }}
-            secretRef:
-              name: {{ include "virtual-machine.fullname" . }}-cloud-init
-            {{- end }}
-            {{- if and .Values.subnets (or (eq .Values.systemDisk.image "ubuntu") (eq .Values.systemDisk.image "alpine")) }}
-            networkDataSecretRef:
-              name: {{ include "virtual-machine.fullname" . }}-network-config
-            {{- end }}
-        {{- end }}
-
-      networks:
-      - name: default
-        pod: {}
-      {{- if .Values.subnets }}
-      {{- range $i, $subnet := .Values.subnets }}
-      - name: {{ $subnet.name }}
-        multus:
-          networkName: {{ $.Release.Namespace }}/{{ $subnet.name }}
-      {{- end }}
-      {{- end }}
diff --git a/packages/apps/virtual-machine/values.schema.json b/packages/apps/virtual-machine/values.schema.json
deleted file mode 100644
index 3cd6c226..00000000
--- a/packages/apps/virtual-machine/values.schema.json
+++ /dev/null
@@ -1,230 +0,0 @@
-{
-  "title": "Chart Values",
-  "type": "object",
-  "properties": {
-    "cloudInit": {
-      "description": "Cloud-init user data.",
-      "type": "string",
-      "default": ""
-    },
-    "cloudInitSeed": {
-      "description": "Seed string to generate SMBIOS UUID for the VM.",
-      "type": "string",
-      "default": ""
-    },
-    "cpuModel": {
-      "description": "Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map",
-      "type": "string",
-      "default": ""
-    },
-    "external": {
-      "description": "Enable external access from outside the cluster.",
-      "type": "boolean",
-      "default": false
-    },
-    "externalMethod": {
-      "description": "Method to pass through traffic to the VM.",
-      "type": "string",
-      "default": "PortList",
-      "enum": [
-        "PortList",
-        "WholeIP"
-      ]
-    },
-    "externalPorts": {
-      "description": "Ports to forward from outside the cluster.",
-      "type": "array",
-      "default": [
-        22
-      ],
-      "items": {
-        "type": "integer"
-      }
-    },
-    "gpus": {
-      "description": "List of GPUs to attach.",
-      "type": "array",
-      "default": [],
-      "items": {
-        "type": "object",
-        "required": [
-          "name"
-        ],
-        "properties": {
-          "name": {
-            "description": "The name of the GPU resource to attach.",
-            "type": "string"
-          }
-        }
-      }
-    },
-    "instanceProfile": {
-      "description": "Virtual Machine preferences profile.",
-      "type": "string",
-      "default": "ubuntu",
-      "enum": [
-        "alpine",
-        "centos.7",
-        "centos.7.desktop",
-        "centos.stream10",
-        "centos.stream10.desktop",
-        "centos.stream8",
-        "centos.stream8.desktop",
-        "centos.stream8.dpdk",
-        "centos.stream9",
-        "centos.stream9.desktop",
-        "centos.stream9.dpdk",
-        "cirros",
-        "fedora",
-        "fedora.arm64",
-        "opensuse.leap",
-        "opensuse.tumbleweed",
-        "rhel.10",
-        "rhel.10.arm64",
-        "rhel.7",
-        "rhel.7.desktop",
-        "rhel.8",
-        "rhel.8.desktop",
-        "rhel.8.dpdk",
-        "rhel.9",
-        "rhel.9.arm64",
-        "rhel.9.desktop",
-        "rhel.9.dpdk",
-        "rhel.9.realtime",
-        "sles",
-        "ubuntu",
-        "windows.10",
-        "windows.10.virtio",
-        "windows.11",
-        "windows.11.virtio",
-        "windows.2k16",
-        "windows.2k16.virtio",
-        "windows.2k19",
-        "windows.2k19.virtio",
-        "windows.2k22",
-        "windows.2k22.virtio",
-        "windows.2k25",
-        "windows.2k25.virtio",
-        ""
-      ]
-    },
-    "instanceType": {
-      "description": "Virtual Machine instance type.",
-      "type": "string",
-      "default": "u1.medium"
-    },
-    "resources": {
-      "description": "Resource configuration for the virtual machine.",
-      "type": "object",
-      "default": {},
-      "properties": {
-        "cpu": {
-          "description": "Number of CPU cores allocated.",
-          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "string"
-            }
-          ],
-          "x-kubernetes-int-or-string": true
-        },
-        "memory": {
-          "description": "Amount of memory allocated.",
-          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "string"
-            }
-          ],
-          "x-kubernetes-int-or-string": true
-        },
-        "sockets": {
-          "description": "Number of CPU sockets (vCPU topology).",
-          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "string"
-            }
-          ],
-          "x-kubernetes-int-or-string": true
-        }
-      }
-    },
-    "runStrategy": {
-      "description": "Requested running state of the VirtualMachineInstance",
-      "type": "string",
-      "default": "Always",
-      "enum": [
-        "Always",
-        "Halted",
-        "Manual",
-        "RerunOnFailure",
-        "Once"
-      ]
-    },
-    "sshKeys": {
-      "description": "List of SSH public keys for authentication.",
-      "type": "array",
-      "default": [],
-      "items": {
-        "type": "string"
-      }
-    },
-    "subnets": {
-      "description": "Additional subnets",
-      "type": "array",
-      "default": [],
-      "items": {
-        "type": "object",
-        "properties": {
-          "name": {
-            "description": "Subnet name",
-            "type": "string"
-          }
-        }
-      }
-    },
-    "systemDisk": {
-      "description": "System disk configuration.",
-      "type": "object",
-      "default": {},
-      "required": [
-        "image",
-        "storage"
-      ],
-      "properties": {
-        "image": {
-          "description": "The base image for the virtual machine.",
-          "type": "string",
-          "default": "ubuntu",
-          "enum": [
-            "ubuntu",
-            "cirros",
-            "alpine",
-            "fedora",
-            "talos"
-          ]
-        },
-        "storage": {
-          "description": "The size of the disk allocated for the virtual machine.",
-          "type": "string",
-          "default": "5Gi"
-        },
-        "storageClass": {
-          "description": "StorageClass used to store the data.",
-          "type": "string",
-          "default": "replicated"
-        }
-      }
-    }
-  }
-}
diff --git a/packages/apps/virtual-machine/values.yaml b/packages/apps/virtual-machine/values.yaml
deleted file mode 100644
index 169d7e10..00000000
--- a/packages/apps/virtual-machine/values.yaml
+++ /dev/null
@@ -1,108 +0,0 @@
-##
-## @section Common parameters
-##
-
-## @enum {string} ExternalMethod - Method to pass through traffic to the VM.
-## @value PortList - Forward selected ports only.
-## @value WholeIP - Forward all traffic for the IP.
-
-## @enum {string} SystemImage - The base image for the virtual machine.
-## @value ubuntu
-## @value cirros
-## @value alpine
-## @value fedora
-## @value talos
-
-## @typedef {struct} SystemDisk - System disk configuration.
-## @field {SystemImage} image - The base image for the virtual machine.
-## @field {string} storage - The size of the disk allocated for the virtual machine.
-## @field {string} [storageClass] - StorageClass used to store the data.
-
-## @typedef {struct} Subnet - Additional subnets
-## @field {string} [name] - Subnet name
-
-## @typedef {struct} GPU - GPU device configuration.
-## @field {string} name - The name of the GPU resource to attach.
-
-## @typedef {struct} Resources - Resource configuration for the virtual machine.
-## @field {quantity} [cpu] - Number of CPU cores allocated.
-## @field {quantity} [sockets] - Number of CPU sockets (vCPU topology).
-## @field {quantity} [memory] - Amount of memory allocated.
-
-## @param {bool} external - Enable external access from outside the cluster.
-external: false
-
-## @param {ExternalMethod} externalMethod - Method to pass through traffic to the VM.
-externalMethod: "PortList"
-
-## @param {[]int} externalPorts - Ports to forward from outside the cluster.
-externalPorts:
-  - 22
-
-## @enum {string} RunStrategy - Requested running state of the VirtualMachineInstance
-## @value Always - VMI should always be running
-## @value Halted - VMI should never be running
-## @value Manual - VMI can be started/stopped using API endpoints
-## @value RerunOnFailure - VMI will initially be running and restarted if a failure occurs, but will not be restarted upon successful completion
-## @value Once - VMI will run once and not be restarted upon completion regardless if the completion is of phase Failure or Success
-
-## @param {RunStrategy} runStrategy - Requested running state of the VirtualMachineInstance
-runStrategy: Always
-
-## @param {string} instanceType - Virtual Machine instance type.
-## @param {string} instanceProfile - Virtual Machine preferences profile.
-instanceType: "u1.medium"
-instanceProfile: ubuntu
-
-## @param {SystemDisk} systemDisk - System disk configuration.
-systemDisk:
-  image: ubuntu
-  storage: 5Gi
-  storageClass: replicated
-
-## @param {[]Subnet} subnets - Additional subnets
-subnets: []
-## Example:
-## subnets:
-##   - name: subnet-84dbec17
-##   - name: subnet-aa8896b5
-##   - name: subnet-e9b97196
-
-## @param {[]GPU} gpus - List of GPUs to attach.
-gpus: []
-## Example:
-## gpus:
-## - name: nvidia.com/GA102GL_A10
-
-## @param {string} cpuModel - Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map
-cpuModel: ""
-
-## @param {Resources} [resources] - Resource configuration for the virtual machine.
-resources: {}
-## Example:
-## resources:
-##   cpu: "4"
-##   sockets: "1"
-##   memory: "8Gi"
-
-## @param {[]string} sshKeys - List of SSH public keys for authentication.
-sshKeys: []
-## Example:
-## sshKeys:
-##   - ssh-rsa ...
-##   - ssh-ed25519 ...
-##
-
-## @param {string} cloudInit - Cloud-init user data.
-cloudInit: ""
-## Example:
-## cloudInit: |
-##   #cloud-config
-##   password: ubuntu
-##   chpasswd: { expire: False }
-##
-
-## @param {string} cloudInitSeed - Seed string to generate SMBIOS UUID for the VM.
-cloudInitSeed: ""
-## Example:
-## cloudInitSeed: "upd1"
diff --git a/packages/core/platform/sources/virtual-machine-application.yaml b/packages/core/platform/sources/virtual-machine-application.yaml
deleted file mode 100644
index b2583e7e..00000000
--- a/packages/core/platform/sources/virtual-machine-application.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
----
-apiVersion: cozystack.io/v1alpha1
-kind: PackageSource
-metadata:
-  name: cozystack.virtual-machine-application
-spec:
-  sourceRef:
-    kind: OCIRepository
-    name: cozystack-packages
-    namespace: cozy-system
-    path: /
-  variants:
-    - name: kubevirt
-      dependsOn:
-        - cozystack.networking
-        - cozystack.kubevirt
-        - cozystack.kubevirt-cdi
-      libraries:
-        - name: cozy-lib
-          path: library/cozy-lib
-      components:
-        - name: virtual-machine
-          path: apps/virtual-machine
-          libraries: [cozy-lib]
-        - name: virtual-machine-rd
-          path: system/virtual-machine-rd
-          install:
-            namespace: cozy-system
-            releaseName: virtual-machine-rd
diff --git a/packages/core/platform/templates/bundles/iaas.yaml b/packages/core/platform/templates/bundles/iaas.yaml
index 7c856b8c..41dc5181 100644
--- a/packages/core/platform/templates/bundles/iaas.yaml
+++ b/packages/core/platform/templates/bundles/iaas.yaml
@@ -13,7 +13,6 @@
 {{include "cozystack.platform.package.default" (list "cozystack.capi-provider-infra-kubevirt" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.bucket-application" $) }}
 {{include "cozystack.platform.package" (list "cozystack.kubernetes-application" "kubevirt" $) }}
-{{include "cozystack.platform.package" (list "cozystack.virtual-machine-application" "kubevirt" $) }}
 {{include "cozystack.platform.package" (list "cozystack.virtualprivatecloud-application" "kubevirt" $) }}
 {{include "cozystack.platform.package" (list "cozystack.vm-disk-application" "kubevirt" $) }}
 {{include "cozystack.platform.package" (list "cozystack.vm-instance-application" "kubevirt" $) }}
diff --git a/packages/system/virtual-machine-rd/Chart.yaml b/packages/system/virtual-machine-rd/Chart.yaml
deleted file mode 100644
index 6228a221..00000000
--- a/packages/system/virtual-machine-rd/Chart.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-apiVersion: v2
-name: virtual-machine-rd
-version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
diff --git a/packages/system/virtual-machine-rd/Makefile b/packages/system/virtual-machine-rd/Makefile
deleted file mode 100644
index 79142c9b..00000000
--- a/packages/system/virtual-machine-rd/Makefile
+++ /dev/null
@@ -1,4 +0,0 @@
-export NAME=virtual-machine-rd
-export NAMESPACE=cozy-system
-
-include ../../../hack/package.mk
diff --git a/packages/system/virtual-machine-rd/cozyrds/virtual-machine.yaml b/packages/system/virtual-machine-rd/cozyrds/virtual-machine.yaml
deleted file mode 100644
index 6b52340b..00000000
--- a/packages/system/virtual-machine-rd/cozyrds/virtual-machine.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-apiVersion: cozystack.io/v1alpha1
-kind: ApplicationDefinition
-metadata:
-  name: virtual-machine
-spec:
-  application:
-    kind: VirtualMachine
-    plural: virtualmachines
-    singular: virtualmachine
-    openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"cloudInit":{"description":"Cloud-init user data.","type":"string","default":""},"cloudInitSeed":{"description":"Seed string to generate SMBIOS UUID for the VM.","type":"string","default":""},"cpuModel":{"description":"Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"externalMethod":{"description":"Method to pass through traffic to the VM.","type":"string","default":"PortList","enum":["PortList","WholeIP"]},"externalPorts":{"description":"Ports to forward from outside the cluster.","type":"array","default":[22],"items":{"type":"integer"}},"gpus":{"description":"List of GPUs to attach.","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"name":{"description":"The name of the GPU resource to attach.","type":"string"}}}},"instanceProfile":{"description":"Virtual Machine preferences profile.","type":"string","default":"ubuntu","enum":["alpine","centos.7","centos.7.desktop","centos.stream10","centos.stream10.desktop","centos.stream8","centos.stream8.desktop","centos.stream8.dpdk","centos.stream9","centos.stream9.desktop","centos.stream9.dpdk","cirros","fedora","fedora.arm64","opensuse.leap","opensuse.tumbleweed","rhel.10","rhel.10.arm64","rhel.7","rhel.7.desktop","rhel.8","rhel.8.desktop","rhel.8.dpdk","rhel.9","rhel.9.arm64","rhel.9.desktop","rhel.9.dpdk","rhel.9.realtime","sles","ubuntu","windows.10","windows.10.virtio","windows.11","windows.11.virtio","windows.2k16","windows.2k16.virtio","windows.2k19","windows.2k19.virtio","windows.2k22","windows.2k22.virtio","windows.2k25","windows.2k25.virtio",""]},"instanceType":{"description":"Virtual Machine instance type.","type":"string","default":"u1.medium"},"resources":{"description":"Resource configuration for the virtual machine.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"sockets":{"description":"Number of CPU sockets (vCPU topology).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"runStrategy":{"description":"Requested running state of the VirtualMachineInstance","type":"string","default":"Always","enum":["Always","Halted","Manual","RerunOnFailure","Once"]},"sshKeys":{"description":"List of SSH public keys for authentication.","type":"array","default":[],"items":{"type":"string"}},"subnets":{"description":"Additional subnets","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Subnet name","type":"string"}}}},"systemDisk":{"description":"System disk configuration.","type":"object","default":{},"required":["image","storage"],"properties":{"image":{"description":"The base image for the virtual machine.","type":"string","default":"ubuntu","enum":["ubuntu","cirros","alpine","fedora","talos"]},"storage":{"description":"The size of the disk allocated for the virtual machine.","type":"string","default":"5Gi"},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"}}}}}
-  release:
-    prefix: virtual-machine-
-    labels:
-      sharding.fluxcd.io/key: tenants
-    chartRef:
-      kind: ExternalArtifact
-      name: cozystack-virtual-machine-application-kubevirt-virtual-machine
-      namespace: cozy-system
-  dashboard:
-    category: IaaS
-    singular: Virtual Machine
-    plural: Virtual Machines
-    description: Virtual Machine (simple)
-    weight: 10
-    tags:
-      - compute
-    icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl82ODdfMzQ1NCkiLz4KPGcgY2xpcC1wYXRoPSJ1cmwoI2NsaXAwXzY4N18zNDU0KSI+CjxwYXRoIGQ9Ik04OS41MDM5IDExMS43MDdINTQuNDk3QzU0LjE3MjcgMTExLjcwNyA1NC4wMTA4IDExMS4yMjEgNTQuMzM0OSAxMTEuMDU5TDU3LjI1MjIgMTA4Ljk1MkM2MC4zMzE0IDEwNi42ODMgNjEuOTUyMiAxMDIuNjMxIDYwLjk3OTcgOTguNzQxMkg4My4wMjFDODIuMDQ4NSAxMDIuNjMxIDgzLjY2OTMgMTA2LjY4MyA4Ni43NDg1IDEwOC45NTJMODkuNjY1OCAxMTEuMDU5Qzg5Ljk5IDExMS4yMjEgODkuODI3OSAxMTEuNzA3IDg5LjUwMzkgMTExLjcwN1oiIGZpbGw9IiNCMEI2QkIiLz4KPHBhdGggZD0iTTExMy4zMjggOTguNzQxSDMwLjY3MjVDMjcuNTkzMSA5OC43NDEgMjUgOTYuMTQ4IDI1IDkzLjA2ODdWMzMuMTAzMkMyNSAzMC4wMjM5IDI3LjU5MzEgMjcuNDMwNyAzMC42NzI1IDI3LjQzMDdIMTEzLjMyOEMxMTYuNDA3IDI3LjQzMDcgMTE5IDMwLjAyMzcgMTE5IDMzLjEwMzJWOTMuMDY4N0MxMTkgOTYuMTQ4IDExNi40MDcgOTguNzQxIDExMy4zMjggOTguNzQxWiIgZmlsbD0iI0U4RURFRSIvPgo8cGF0aCBkPSJNMTE5IDg0LjE1NDlIMjVWMzMuMTAzMkMyNSAzMC4wMjM5IDI3LjU5MzEgMjcuNDMwNyAzMC42NzI1IDI3LjQzMDdIMTEzLjMyOEMxMTYuNDA3IDI3LjQzMDcgMTE5IDMwLjAyMzcgMTE5IDMzLjEwMzJMMTE5IDg0LjE1NDlaIiBmaWxsPSIjMDBCM0ZGIi8+CjxwYXRoIGQ9Ik05MC42Mzc0IDExNi41NjlINTMuMzYxNkM1Mi4wNjUxIDExNi41NjkgNTAuOTMwNyAxMTUuNDM1IDUwLjkzMDcgMTE0LjEzOEM1MC45MzA3IDExMi44NDEgNTIuMDY1MSAxMTEuNzA3IDUzLjM2MTYgMTExLjcwN0g5MC42Mzc0QzkxLjkzMzkgMTExLjcwNyA5My4wNjg0IDExMi44NDEgOTMuMDY4NCAxMTQuMTM4QzkzLjA2ODQgMTE1LjQzNSA5MS45MzM5IDExNi41NjkgOTAuNjM3NCAxMTYuNTY5WiIgZmlsbD0iI0U4RURFRSIvPgo8L2c+CjxwYXRoIGQ9Ik03Mi41Mjc1IDUzLjgzNjdDNzIuNDQzMSA1My44MzUxIDcyLjM2MDUgNTMuODEyMiA3Mi4yODczIDUzLjc3MDFMNTYuNDY5OSA0NC43OTM0QzU2LjM5ODMgNDQuNzUxOSA1Ni4zMzg4IDQ0LjY5MjMgNTYuMjk3MyA0NC42MjA3QzU2LjI1NTkgNDQuNTQ5IDU2LjIzMzggNDQuNDY3OCA1Ni4yMzM0IDQ0LjM4NUM1Ni4yMzM0IDQ0LjIxNjkgNTYuMzI1OCA0NC4wNjE3IDU2LjQ2OTkgNDMuOTc4NUw3Mi4xOTEyIDM1LjA2MDlDNzIuMjYzNyAzNS4wMjEgNzIuMzQ1IDM1IDcyLjQyNzcgMzVDNzIuNTEwNSAzNSA3Mi41OTE4IDM1LjAyMSA3Mi42NjQzIDM1LjA2MDlMODguNDg3MiA0NC4wMzk1Qzg4LjU1OTEgNDQuMDgwMSA4OC42MTg4IDQ0LjEzOTIgODguNjYgNDQuMjEwN0M4OC43MDEzIDQ0LjI4MjIgODguNzIyNyA0NC4zNjM1IDg4LjcyMTkgNDQuNDQ2Qzg4LjcyMjUgNDQuNTI4NSA4OC43MDEgNDQuNjA5NyA4OC42NTk4IDQ0LjY4MTJDODguNjE4NSA0NC43NTI2IDg4LjU1ODkgNDQuODExOCA4OC40ODcyIDQ0Ljg1MjVMNzIuNzcxNCA1My43NjgzQzcyLjY5NzIgNTMuODExNCA3Mi42MTMzIDUzLjgzNDkgNzIuNTI3NSA1My44MzY3IiBmaWxsPSJ3aGl0ZSIvPgo8cGF0aCBvcGFjaXR5PSIwLjciIGQ9Ik03MC4yNTUzIDc1LjY1MTdDNzAuMTcxIDc1LjY1MzUgNzAuMDg3OCA3NS42MzE3IDcwLjAxNTEgNzUuNTg4OEw1NC4yNDU4IDY2LjY0MTdDNTQuMTcxNSA2Ni42MDI0IDU0LjEwOTUgNjYuNTQzNiA1NC4wNjYxIDY2LjQ3MTZDNTQuMDIyOCA2Ni4zOTk3IDU0IDY2LjMxNzMgNTQgNjYuMjMzM1Y0OC4yNzhDNTQgNDguMTA4IDU0LjA5MjQgNDcuOTU0NiA1NC4yNDM5IDQ3Ljg2OTZDNTQuMzE3MiA0Ny44MjcxIDU0LjQwMDQgNDcuODA0NyA1NC40ODUxIDQ3LjgwNDdDNTQuNTY5NyA0Ny44MDQ3IDU0LjY1MjkgNDcuODI3MSA1NC43MjYyIDQ3Ljg2OTZMNzAuNDkzNyA1Ni44MTMxQzcwLjU2NDIgNTYuODU2NSA3MC42MjI1IDU2LjkxNyA3MC42NjMyIDU2Ljk4OTFDNzAuNzAzOSA1Ny4wNjEyIDcwLjcyNTcgNTcuMTQyNCA3MC43MjY1IDU3LjIyNTFWNzUuMTgwNUM3MC43MjU5IDc1LjI2MjggNzAuNzA0MiA3NS4zNDM2IDcwLjY2MzUgNzUuNDE1MUM3MC42MjI3IDc1LjQ4NjYgNzAuNTY0MiA3NS41NDY0IDcwLjQ5MzcgNzUuNTg4OEM3MC40MjA2IDc1LjYyOTEgNzAuMzM4NyA3NS42NTA3IDcwLjI1NTMgNzUuNjUxNyIgZmlsbD0id2hpdGUiLz4KPHBhdGggb3BhY2l0eT0iMC40IiBkPSJNNzQuNzE5OCA3NS42NTExQzc0LjYzMzMgNzUuNjUxMiA3NC41NDgyIDc1LjYyOTYgNzQuNDcyMiA3NS41ODgzQzc0LjQwMTYgNzUuNTQ2MSA3NC4zNDMyIDc1LjQ4NjIgNzQuMzAyNyA3NS40MTQ3Qzc0LjI2MjMgNzUuMzQzMSA3NC4yNDExIDc1LjI2MjIgNzQuMjQxMiA3NS4xOFY1Ny4zMzczQzc0LjI0MTIgNTcuMTcxIDc0LjMzMzYgNTcuMDE1OCA3NC40NzIyIDU2LjkyOUw5MC4yMzk3IDQ3Ljk4NTVDOTAuMzExOSA0Ny45NDM4IDkwLjM5MzggNDcuOTIxOSA5MC40NzcxIDQ3LjkyMTlDOTAuNTYwNSA0Ny45MjE5IDkwLjY0MjQgNDcuOTQzOCA5MC43MTQ2IDQ3Ljk4NTVDOTAuNzg3NiA0OC4wMjU1IDkwLjg0ODUgNDguMDg0MiA5MC44OTExIDQ4LjE1NTdDOTAuOTMzNyA0OC4yMjcyIDkwLjk1NjMgNDguMzA4OCA5MC45NTY2IDQ4LjM5MlY2Ni4yMzI4QzkwLjk1NyA2Ni4zMTY0IDkwLjkzNDcgNjYuMzk4NSA5MC44OTIxIDY2LjQ3MDRDOTAuODQ5NSA2Ni41NDI0IDkwLjc4ODEgNjYuNjAxNCA5MC43MTQ2IDY2LjY0MTFMNzQuOTUyNiA3NS41ODgzQzc0Ljg4MjUgNzUuNjMwNyA3NC44MDE4IDc1LjY1MjUgNzQuNzE5OCA3NS42NTExIiBmaWxsPSJ3aGl0ZSIvPgo8ZGVmcz4KPGxpbmVhckdyYWRpZW50IGlkPSJwYWludDBfbGluZWFyXzY4N18zNDU0IiB4MT0iMTYxIiB5MT0iMTgwIiB4Mj0iMy41OTI4NGUtMDciIHkyPSI0Ljk5OTk4IiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+CjxzdG9wLz4KPHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjNTk1NjU2Ii8+CjwvbGluZWFyR3JhZGllbnQ+CjxjbGlwUGF0aCBpZD0iY2xpcDBfNjg3XzM0NTQiPgo8cmVjdCB3aWR0aD0iOTQiIGhlaWdodD0iOTQiIGZpbGw9IndoaXRlIiB0cmFuc2Zvcm09InRyYW5zbGF0ZSgyNSAyNSkiLz4KPC9jbGlwUGF0aD4KPC9kZWZzPgo8L3N2Zz4K
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "external"], ["spec", "externalMethod"], ["spec", "externalPorts"], ["spec", "runStrategy"], ["spec", "instanceType"], ["spec", "instanceProfile"], ["spec", "systemDisk"], ["spec", "systemDisk", "image"], ["spec", "systemDisk", "storage"], ["spec", "systemDisk", "storageClass"], ["spec", "subnets"], ["spec", "gpus"], ["spec", "cpuModel"], ["spec", "resources"], ["spec", "sshKeys"], ["spec", "cloudInit"], ["spec", "cloudInitSeed"]]
-  secrets:
-    exclude: []
-    include: []
-  services:
-    exclude: []
-    include:
-      - resourceNames:
-          - virtual-machine-{{ .name }}
diff --git a/packages/system/virtual-machine-rd/templates/backupstrategy.yaml b/packages/system/virtual-machine-rd/templates/backupstrategy.yaml
deleted file mode 100644
index ac2fe517..00000000
--- a/packages/system/virtual-machine-rd/templates/backupstrategy.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-{{- if .Capabilities.APIVersions.Has "strategy.backups.cozystack.io/v1alpha1" }}
-apiVersion: strategy.backups.cozystack.io/v1alpha1
-kind: Velero
-metadata:
-  name: velero-backup-strategy-for-virtualmachines
-spec:
-  template:
-    spec:
-      csiSnapshotTimeout: 10m0s
-      includedNamespaces:
-      - '{{ printf "{{ .Application.metadata.namespace }}" }}'
-      orLabelSelector:
-      - matchLabels:
-          apps.cozystack.io/application.group: apps.cozystack.io
-          apps.cozystack.io/application.kind: '{{ printf "{{ .Application.kind }}" }}'
-          apps.cozystack.io/application.name: '{{ printf "{{ .Application.metadata.name }}"}}'
-      - matchLabels:
-          app.kubernetes.io/instance: 'virtual-machine-{{ printf "{{ .Application.metadata.name }}"}}' 
-      includedResources:
-        - helmreleases.helm.toolkit.fluxcd.io
-        - virtualmachines.kubevirt.io
-        - virtualmachineinstances.kubevirt.io
-        - datavolumes.cdi.kubevirt.io
-        - persistentvolumeclaims
-        - services
-        - configmaps
-        - secrets
-      storageLocation: '{{ printf "{{ .Parameters.backupStorageLocationName }}" }}'
-      volumeSnapshotLocations:
-        - '{{ printf "{{ .Parameters.backupStorageLocationName }}" }}'
-      snapshotVolumes: true
-      snapshotMoveData: true
-      ttl: 720h0m0s
-      itemOperationTimeout: 24h0m0s
-{{- end }}
diff --git a/packages/system/virtual-machine-rd/templates/cozyrd.yaml b/packages/system/virtual-machine-rd/templates/cozyrd.yaml
deleted file mode 100644
index e079ddcf..00000000
--- a/packages/system/virtual-machine-rd/templates/cozyrd.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-{{- range $path, $_ := .Files.Glob "cozyrds/*" }}
----
-{{ $.Files.Get $path }}
-{{- end }}
diff --git a/packages/system/virtual-machine-rd/values.yaml b/packages/system/virtual-machine-rd/values.yaml
deleted file mode 100644
index 0967ef42..00000000
--- a/packages/system/virtual-machine-rd/values.yaml
+++ /dev/null
@@ -1 +0,0 @@
-{}

From 13aa341a28403bab0a3e8ee0a8665d17f0f91554 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 12 Feb 2026 15:26:18 +0100
Subject: [PATCH 040/666] fix(platform): address review comments in vm
 migration script

Replace `|| echo ""` with `|| true` to avoid newline bugs in variable
assignments. Switch `for x in $(cmd)` loops to `while read` for safer
iteration over kubectl output.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 hack/e2e-apps/virtualmachine.bats             | 45 -------------------
 .../platform/images/migrations/migrations/29  | 18 ++++----
 2 files changed, 10 insertions(+), 53 deletions(-)
 delete mode 100644 hack/e2e-apps/virtualmachine.bats

diff --git a/hack/e2e-apps/virtualmachine.bats b/hack/e2e-apps/virtualmachine.bats
deleted file mode 100644
index 33e87b53..00000000
--- a/hack/e2e-apps/virtualmachine.bats
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/usr/bin/env bats
-
-@test "Create a Virtual Machine" {
-  name='test'
-  kubectl apply -f - <<EOF
-apiVersion: apps.cozystack.io/v1alpha1
-kind: VirtualMachine
-metadata:
-  name: $name
-  namespace: tenant-test
-spec:
-  external: false
-  externalMethod: PortList
-  externalPorts:
-  - 22
-  instanceType: "u1.medium"
-  instanceProfile: ubuntu
-  systemDisk:
-    image: ubuntu
-    storage: 5Gi
-    storageClass: replicated
-  gpus: []
-  resources: {}
-  sshKeys:
-  - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPht0dPk5qQ+54g1hSX7A6AUxXJW5T6n/3d7Ga2F8gTF
-    test@test
-  cloudInit: |
-    #cloud-config
-    users:
-      - name: test
-        shell: /bin/bash
-        sudo: ['ALL=(ALL) NOPASSWD: ALL']
-        groups: sudo
-        ssh_authorized_keys:
-          - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPht0dPk5qQ+54g1hSX7A6AUxXJW5T6n/3d7Ga2F8gTF test@test
-  cloudInitSeed: ""
-EOF
-  sleep 5
-  kubectl -n tenant-test wait hr virtual-machine-$name --timeout=10s --for=condition=ready
-  kubectl -n tenant-test wait dv virtual-machine-$name --timeout=150s --for=condition=ready
-  kubectl -n tenant-test wait pvc virtual-machine-$name --timeout=100s --for=jsonpath='{.status.phase}'=Bound
-  kubectl -n tenant-test wait vm virtual-machine-$name --timeout=100s --for=condition=ready
-  timeout 120 sh -ec "until kubectl -n tenant-test get vmi virtual-machine-$name -o jsonpath='{.status.interfaces[0].ipAddress}' | grep -q '[0-9]'; do sleep 10; done"
-  kubectl -n tenant-test delete virtualmachines.apps.cozystack.io $name 
-}
diff --git a/packages/core/platform/images/migrations/migrations/29 b/packages/core/platform/images/migrations/migrations/29
index 96ac66eb..a76071a5 100755
--- a/packages/core/platform/images/migrations/migrations/29
+++ b/packages/core/platform/images/migrations/migrations/29
@@ -149,9 +149,9 @@ for entry in "${INSTANCES[@]}"; do
 
   if [ -n "$VALUES_SECRET" ] && resource_exists "$NAMESPACE" "secret" "$VALUES_SECRET"; then
     echo "    Reading values from secret: ${VALUES_SECRET}"
-    VALUES_YAML=$(kubectl -n "$NAMESPACE" get secret "$VALUES_SECRET" -o jsonpath="{.data.${VALUES_KEY}}" 2>/dev/null | base64 -d 2>/dev/null || echo "")
+    VALUES_YAML=$(kubectl -n "$NAMESPACE" get secret "$VALUES_SECRET" -o jsonpath="{.data.${VALUES_KEY}}" 2>/dev/null | base64 -d 2>/dev/null || true)
     if [ -z "$VALUES_YAML" ]; then
-      VALUES_YAML=$(kubectl -n "$NAMESPACE" get secret "$VALUES_SECRET" -o jsonpath="{.stringData.${VALUES_KEY}}" 2>/dev/null || echo "")
+      VALUES_YAML=$(kubectl -n "$NAMESPACE" get secret "$VALUES_SECRET" -o jsonpath="{.stringData.${VALUES_KEY}}" 2>/dev/null || true)
     fi
     if [ -n "$VALUES_YAML" ]; then
       EXTERNAL=$(echo "$VALUES_YAML" | yq -r '.external // false')
@@ -194,7 +194,7 @@ for entry in "${INSTANCES[@]}"; do
   echo "  --- Save LoadBalancer IP ---"
   LB_IP=""
   if [ "$EXTERNAL" = "true" ] && resource_exists "$NAMESPACE" "svc" "$OLD_NAME"; then
-    LB_IP=$(kubectl -n "$NAMESPACE" get svc "$OLD_NAME" -o jsonpath='{.status.loadBalancer.ingress[0].ip}' 2>/dev/null || echo "")
+    LB_IP=$(kubectl -n "$NAMESPACE" get svc "$OLD_NAME" -o jsonpath='{.status.loadBalancer.ingress[0].ip}' 2>/dev/null || true)
     if [ -n "$LB_IP" ]; then
       echo "    LoadBalancer IP: ${LB_IP}"
     else
@@ -314,8 +314,9 @@ PVCEOF
 
   # --- 2i: Clone Secrets ---
   echo "  --- Clone Secrets ---"
-  for secret in $(kubectl -n "$NAMESPACE" get secret -o name 2>/dev/null \
-    | grep "secret/${OLD_NAME}" | grep -v "sh.helm.release" | grep -v "values"); do
+  kubectl -n "$NAMESPACE" get secret -o name 2>/dev/null \
+    | grep "secret/${OLD_NAME}" | grep -v "sh.helm.release" | grep -v "values" \
+    | while IFS= read -r secret; do
     old_secret_name="${secret#secret/}"
     suffix="${old_secret_name#${OLD_NAME}}"
     new_secret_name="${NEW_INSTANCE_NAME}${suffix}"
@@ -540,8 +541,9 @@ SVCEOF
 
   # --- 2q: Delete old resources ---
   echo "  --- Delete old resources ---"
-  for secret in $(kubectl -n "$NAMESPACE" get secret -o name 2>/dev/null \
-    | grep "secret/${OLD_NAME}" | grep -v "sh.helm.release" | grep -v "values"); do
+  kubectl -n "$NAMESPACE" get secret -o name 2>/dev/null \
+    | grep "secret/${OLD_NAME}" | grep -v "sh.helm.release" | grep -v "values" \
+    | while IFS= read -r secret; do
     old_secret_name="${secret#secret/}"
     delete_resource "$NAMESPACE" "secret" "$old_secret_name"
   done
@@ -714,7 +716,7 @@ for entry in "${INSTANCES[@]}"; do
   instance="${entry#*/}"
   disk_name="${NEW_DISK_PREFIX}-${instance}"
   for i in $(seq 1 60); do
-    ready=$(kubectl -n "$ns" get hr "$disk_name" -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}' 2>/dev/null || echo "")
+    ready=$(kubectl -n "$ns" get hr "$disk_name" -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}' 2>/dev/null || true)
     if [ "$ready" = "True" ]; then
       echo "  [OK] ${ns}/hr/${disk_name} is Ready"
       break

From dbba5c325b662f8aa2821f1984f1c251243d9b68 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Sat, 14 Feb 2026 10:13:09 +0100
Subject: [PATCH 041/666] fix kubernetes e2e test

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 hack/e2e-apps/run-kubernetes.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index 5b8b1b4b..c60fdbe4 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -56,7 +56,7 @@ spec:
       gpus: []
       instanceType: u1.medium
       maxReplicas: 10
-      minReplicas: 0
+      minReplicas: 2
       roles:
       - ingress-nginx
   storageClass: replicated

From b6a840e8735ee2b4f039bd4d263149e8ca92fcf0 Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Sat, 14 Feb 2026 09:17:24 +0000
Subject: [PATCH 042/666] Prepare release v1.0.0-beta.4

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 packages/apps/kubernetes/images/cluster-autoscaler.tag      | 2 +-
 packages/apps/kubernetes/images/kubevirt-csi-driver.tag     | 2 +-
 packages/core/installer/values.yaml                         | 4 ++--
 packages/core/platform/values.yaml                          | 2 +-
 packages/core/testing/values.yaml                           | 2 +-
 packages/extra/bootbox/images/matchbox.tag                  | 2 +-
 packages/extra/seaweedfs/images/objectstorage-sidecar.tag   | 2 +-
 packages/system/backup-controller/values.yaml               | 2 +-
 packages/system/backupstrategy-controller/values.yaml       | 2 +-
 packages/system/cozystack-api/values.yaml                   | 2 +-
 packages/system/cozystack-controller/values.yaml            | 2 +-
 packages/system/dashboard/templates/configmap.yaml          | 2 +-
 packages/system/dashboard/values.yaml                       | 6 +++---
 .../system/grafana-operator/images/grafana-dashboards.tag   | 2 +-
 packages/system/kamaji/values.yaml                          | 4 ++--
 packages/system/kubeovn-plunger/values.yaml                 | 2 +-
 packages/system/kubeovn-webhook/values.yaml                 | 2 +-
 packages/system/kubevirt-csi-node/values.yaml               | 2 +-
 packages/system/lineage-controller-webhook/values.yaml      | 2 +-
 packages/system/objectstorage-controller/values.yaml        | 2 +-
 packages/system/seaweedfs/values.yaml                       | 2 +-
 21 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/packages/apps/kubernetes/images/cluster-autoscaler.tag b/packages/apps/kubernetes/images/cluster-autoscaler.tag
index e3436c68..c3d6ddef 100644
--- a/packages/apps/kubernetes/images/cluster-autoscaler.tag
+++ b/packages/apps/kubernetes/images/cluster-autoscaler.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/cluster-autoscaler:0.0.0@sha256:598331326f0c2aac420187f0cc3a49fedcb22ed5de4afe50c6ccf8e05d9fa537
+ghcr.io/cozystack/cozystack/cluster-autoscaler:0.0.0@sha256:7deeee117e7eec599cb453836ca95eadd131dfc8c875dc457ef29dc1433395e0
diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
index ca67ba13..a8e48958 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-csi-driver:latest@sha256:cd58760c97ba50ef74ff940cdcda4b9a6d8554eec8305fc96c2e8bbea72b75a9
+ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:1997d623bb60a5b540027a4e0716e7ca84f668ee09f31290e9c43324f0003137
diff --git a/packages/core/installer/values.yaml b/packages/core/installer/values.yaml
index e9de3f13..64ff817b 100644
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -1,6 +1,6 @@
 cozystackOperator:
   # Deployment variant: talos, generic, hosted
   variant: talos
-  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.0.0-beta.3@sha256:3cacecfc318e8314300bba8538b475fb8d50b2bf3106533faa8d942e4ed14448
+  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.0.0-beta.4@sha256:322dd7358df369525f76e6e43512482e38caec5315d36a878399d2d60bf2f18d
   platformSourceUrl: 'oci://ghcr.io/cozystack/cozystack/cozystack-packages'
-  platformSourceRef: 'digest=sha256:e5ddcf5a02d17b17fc7ffa8c87ddeaa25a01d928a63fb297f6b25b669bb6b7c7'
+  platformSourceRef: 'digest=sha256:b88502242b535a31ab33c06ffc0a96d1c67230d2db2c5e873fa23f6523592ff6'
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index 38452a17..b90c001b 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -5,7 +5,7 @@ sourceRef:
   path: /
 migrations:
   enabled: false
-  image: ghcr.io/cozystack/cozystack/platform-migrations:latest
+  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0-beta.4@sha256:f404d05834907b9b2695bbb37732bd1ae2e79b03da77dc91bb3fbc0fbc53dcbf
   targetVersion: 30
 # Bundle deployment configuration
 bundles:
diff --git a/packages/core/testing/values.yaml b/packages/core/testing/values.yaml
index 26ac2e55..73481ab1 100644
--- a/packages/core/testing/values.yaml
+++ b/packages/core/testing/values.yaml
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.0.0-beta.3@sha256:eac71ef0de3450fce96255629e77903630c63ade62b81e7055f1a689f92ee153
+  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.0.0-beta.4@sha256:eac71ef0de3450fce96255629e77903630c63ade62b81e7055f1a689f92ee153
diff --git a/packages/extra/bootbox/images/matchbox.tag b/packages/extra/bootbox/images/matchbox.tag
index 133eda2a..6c3054d5 100644
--- a/packages/extra/bootbox/images/matchbox.tag
+++ b/packages/extra/bootbox/images/matchbox.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/matchbox:v1.0.0-beta.3@sha256:185010911694809fe15491efe3c7994e0ce46a4f92ef1f7edbbd0b318861e8d4
+ghcr.io/cozystack/cozystack/matchbox:v1.0.0-beta.4@sha256:cba9a2761c40ae6645e28da4cbc6d91eb86ddc886f4523cf20b3c0e40597d593
diff --git a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
index 71eb27b8..bd622108 100644
--- a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
+++ b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-beta.3@sha256:f845a2c3ec0f79a8873e9f3e65ee625ec3574c5e33e174a7bf60b15d1db49979
+ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-beta.4@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0
diff --git a/packages/system/backup-controller/values.yaml b/packages/system/backup-controller/values.yaml
index 3e91ea6e..1bdab88b 100644
--- a/packages/system/backup-controller/values.yaml
+++ b/packages/system/backup-controller/values.yaml
@@ -1,5 +1,5 @@
 backupController:
-  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.0.0-beta.3@sha256:7a8d0ea7b380196fac418e0697b4218af15025eac8128dfedfd12eb933bd258d"
+  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.0.0-beta.4@sha256:2dcd5347683ee88012b0e558b3a240dec9942230e9c673a359e0196f407a0833"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/backupstrategy-controller/values.yaml b/packages/system/backupstrategy-controller/values.yaml
index 94cc6bed..21d1a9f3 100644
--- a/packages/system/backupstrategy-controller/values.yaml
+++ b/packages/system/backupstrategy-controller/values.yaml
@@ -1,5 +1,5 @@
 backupStrategyController:
-  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.0.0-beta.3@sha256:ae8fb6c7bf274a3812a6a9f3f87317fa4575250f7ee75e118d20d5ab0797577b"
+  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.0.0-beta.4@sha256:c2c150918e5609f1d6663f56b6dcbdac47bee33154524230001fcd04165f4268"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/cozystack-api/values.yaml b/packages/system/cozystack-api/values.yaml
index 769cd4b6..d9041546 100644
--- a/packages/system/cozystack-api/values.yaml
+++ b/packages/system/cozystack-api/values.yaml
@@ -1,3 +1,3 @@
 cozystackAPI:
-  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.0.0-beta.3@sha256:a263702859c36f85d097c300c1be462aaa45a3955d69e9ae72a37cabf6dadaa9
+  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.0.0-beta.4@sha256:42f8d8120f7fd3bfe37f114eedf5ca8df62ac69a0d922d91a2c392772f3b46ee
   replicas: 2
diff --git a/packages/system/cozystack-controller/values.yaml b/packages/system/cozystack-controller/values.yaml
index 908a955d..53ed1033 100644
--- a/packages/system/cozystack-controller/values.yaml
+++ b/packages/system/cozystack-controller/values.yaml
@@ -1,4 +1,4 @@
 cozystackController:
-  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.0.0-beta.3@sha256:00b0ba15fef7c3ce8c0801ecb11b1953665a511990e18f51c2ca3ca40127c7aa
+  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.0.0-beta.4@sha256:915d07ef61e1fc3bdf87e4bfc4b8ae3920e7e33d74082778c7735ba36a08cdef
   debug: false
   disableTelemetry: false
diff --git a/packages/system/dashboard/templates/configmap.yaml b/packages/system/dashboard/templates/configmap.yaml
index 03cd572b..1c79b2cb 100644
--- a/packages/system/dashboard/templates/configmap.yaml
+++ b/packages/system/dashboard/templates/configmap.yaml
@@ -1,6 +1,6 @@
 {{- $brandingConfig := .Values._cluster.branding | default dict }}
 
-{{- $tenantText := "v1.0.0-beta.3" }}
+{{- $tenantText := "v1.0.0-beta.4" }}
 {{- $footerText := "Cozystack" }}
 {{- $titleText := "Cozystack Dashboard" }}
 {{- $logoText := "" }}
diff --git a/packages/system/dashboard/values.yaml b/packages/system/dashboard/values.yaml
index 95d7bdf8..0c898a91 100644
--- a/packages/system/dashboard/values.yaml
+++ b/packages/system/dashboard/values.yaml
@@ -1,6 +1,6 @@
 openapiUI:
-  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.0.0-beta.3@sha256:adbd07c7bde083fbf3a2fb2625ec4adbe6718a0f6f643b2505cc0029c2c0f724
+  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.0.0-beta.4@sha256:adbd07c7bde083fbf3a2fb2625ec4adbe6718a0f6f643b2505cc0029c2c0f724
 openapiUIK8sBff:
-  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.0.0-beta.3@sha256:0ed112d44973dcff64b65f7f1438a35df98c7fdee4590343a790668f728d9024
+  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.0.0-beta.4@sha256:1f7827a1978bd9c81ac924dd0e78f6a3ce834a9a64af55047e220812bc15a944
 tokenProxy:
-  image: ghcr.io/cozystack/cozystack/token-proxy:v1.0.0-beta.3@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
+  image: ghcr.io/cozystack/cozystack/token-proxy:v1.0.0-beta.4@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
diff --git a/packages/system/grafana-operator/images/grafana-dashboards.tag b/packages/system/grafana-operator/images/grafana-dashboards.tag
index 726d78e9..cc81b24f 100644
--- a/packages/system/grafana-operator/images/grafana-dashboards.tag
+++ b/packages/system/grafana-operator/images/grafana-dashboards.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/grafana-dashboards:v1.0.0-beta.3@sha256:e866b5b3874b9d390b341183d2ee070e1387440c14cfe51af831695def6dc2ec
+ghcr.io/cozystack/cozystack/grafana-dashboards:v1.0.0-beta.4@sha256:e866b5b3874b9d390b341183d2ee070e1387440c14cfe51af831695def6dc2ec
diff --git a/packages/system/kamaji/values.yaml b/packages/system/kamaji/values.yaml
index bd7dfe63..26e8bfcf 100644
--- a/packages/system/kamaji/values.yaml
+++ b/packages/system/kamaji/values.yaml
@@ -3,7 +3,7 @@ kamaji:
     deploy: false
   image:
     pullPolicy: IfNotPresent
-    tag: v1.0.0-beta.3@sha256:fe9b6bb548edfc26be8aaac65801d598a4e2f9884ddf748083b9e509fa00259e
+    tag: v1.0.0-beta.4@sha256:05f8e166dc94aadb74cd6448f6f96fbd2167057a559097516a41b8f53e434918
     repository: ghcr.io/cozystack/cozystack/kamaji
   resources:
     limits:
@@ -13,4 +13,4 @@ kamaji:
       cpu: 100m
       memory: 100Mi
   extraArgs:
-    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.0.0-beta.3@sha256:fe9b6bb548edfc26be8aaac65801d598a4e2f9884ddf748083b9e509fa00259e
+    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.0.0-beta.4@sha256:05f8e166dc94aadb74cd6448f6f96fbd2167057a559097516a41b8f53e434918
diff --git a/packages/system/kubeovn-plunger/values.yaml b/packages/system/kubeovn-plunger/values.yaml
index b86cc2dc..b325a7b7 100644
--- a/packages/system/kubeovn-plunger/values.yaml
+++ b/packages/system/kubeovn-plunger/values.yaml
@@ -1,4 +1,4 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.0.0-beta.3@sha256:c89397d6a74e6de38830513a323ade3fa99a42946b40ba596136fc08930b2348
+image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.0.0-beta.4@sha256:16b362d6fa1ca30c791ea5cfc7984e085b9ea76a24c9abb3b05dad5c8b64bd0e
 ovnCentralName: ovn-central
diff --git a/packages/system/kubeovn-webhook/values.yaml b/packages/system/kubeovn-webhook/values.yaml
index 65898067..d5d8ba93 100644
--- a/packages/system/kubeovn-webhook/values.yaml
+++ b/packages/system/kubeovn-webhook/values.yaml
@@ -1,3 +1,3 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.0.0-beta.3@sha256:e18f9fd679e38f65362a8d0042f25468272f6d081136ad47027168d8e7e07a4a
+image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.0.0-beta.4@sha256:e18f9fd679e38f65362a8d0042f25468272f6d081136ad47027168d8e7e07a4a
diff --git a/packages/system/kubevirt-csi-node/values.yaml b/packages/system/kubevirt-csi-node/values.yaml
index f7fd69a1..521683be 100644
--- a/packages/system/kubevirt-csi-node/values.yaml
+++ b/packages/system/kubevirt-csi-node/values.yaml
@@ -1,3 +1,3 @@
 storageClass: replicated
 csiDriver:
-  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:latest@sha256:cd58760c97ba50ef74ff940cdcda4b9a6d8554eec8305fc96c2e8bbea72b75a9
+  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:1997d623bb60a5b540027a4e0716e7ca84f668ee09f31290e9c43324f0003137
diff --git a/packages/system/lineage-controller-webhook/values.yaml b/packages/system/lineage-controller-webhook/values.yaml
index 10ac0be5..00e593eb 100644
--- a/packages/system/lineage-controller-webhook/values.yaml
+++ b/packages/system/lineage-controller-webhook/values.yaml
@@ -1,5 +1,5 @@
 lineageControllerWebhook:
-  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.0.0-beta.3@sha256:da85b064cdef4c8a798f32a731396a9b90741654dc599a5f4f381372834765db
+  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.0.0-beta.4@sha256:e9054f9137fd73039b2d91a979f672c9258336f91e51440a77aaa09e6e0b5254
   debug: false
   localK8sAPIEndpoint:
     enabled: true
diff --git a/packages/system/objectstorage-controller/values.yaml b/packages/system/objectstorage-controller/values.yaml
index d5fe5bec..18dda28f 100644
--- a/packages/system/objectstorage-controller/values.yaml
+++ b/packages/system/objectstorage-controller/values.yaml
@@ -1,3 +1,3 @@
 objectstorage:
   controller:
-    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.0.0-beta.3@sha256:bb2b2b95cbc3d613b077a87a6c281a3ceff8ef8655d770fb2f8fd6b5f1d0c588"
+    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.0.0-beta.4@sha256:b4c972769afda76c48b58e7acf0ac66a0abf16a622f245c60338f432872f640a"
diff --git a/packages/system/seaweedfs/values.yaml b/packages/system/seaweedfs/values.yaml
index cc5e8301..63199e28 100644
--- a/packages/system/seaweedfs/values.yaml
+++ b/packages/system/seaweedfs/values.yaml
@@ -177,7 +177,7 @@ seaweedfs:
     bucketClassName: "seaweedfs"
     region: ""
     sidecar:
-      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-beta.3@sha256:f845a2c3ec0f79a8873e9f3e65ee625ec3574c5e33e174a7bf60b15d1db49979"
+      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-beta.4@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0"
   certificates:
     commonName: "SeaweedFS CA"
     ipAddresses: []

From 6b407bd4039fd2e98805518267256761fd6e3b27 Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Sat, 14 Feb 2026 09:23:50 +0000
Subject: [PATCH 043/666] docs: add changelog for v1.0.0-beta.4

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.0.0-beta.4.md | 96 ++++++++++++++++++++++++++++++++
 1 file changed, 96 insertions(+)
 create mode 100644 docs/changelogs/v1.0.0-beta.4.md

diff --git a/docs/changelogs/v1.0.0-beta.4.md b/docs/changelogs/v1.0.0-beta.4.md
new file mode 100644
index 00000000..c5694a73
--- /dev/null
+++ b/docs/changelogs/v1.0.0-beta.4.md
@@ -0,0 +1,96 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.0.0-beta.4
+-->
+
+> **⚠️ Beta Release Warning**: This is a pre-release version intended for testing and early adoption. Breaking changes may occur before the stable v1.0.0 release.
+
+## Major Features and Improvements
+
+### Virtual Machines
+
+* **[vm-instance] Complete migration from virtual-machine to vm-disk and vm-instance**: Completed the architectural redesign of virtual machine management by fully migrating from the legacy `virtual-machine` application to the new `vm-disk` and `vm-instance` applications. This includes automatic migration scripts (migration 28) that convert existing virtual machines, handle CDI webhook configurations, and update cloud-init references. The new architecture provides better separation of concerns between disk management and VM lifecycle, enabling more flexible VM configuration and improved resource management ([**@kvaps**](https://github.com/kvaps) in #2040).
+
+* **[vm-instance] Port advanced VM features**: Ported critical VM features from the legacy virtual-machine application including cpuModel field for direct CPU model specification, support for switching between instanceType and custom resource configurations, and migration from deprecated `running` field to `runStrategy` field following KubeVirt best practices ([**@kvaps**](https://github.com/kvaps) in #2040).
+
+### Storage and CSI
+
+* **[kubevirt-csi-driver] Add RWX Filesystem (NFS) support**: Added Read-Write-Many (RWX) filesystem support to kubevirt-csi-driver, enabling multiple pods to mount the same persistent volume simultaneously via NFS. This provides native NFS support for shared storage use cases without requiring external NFS provisioners, with automatic NFS server deployment per PVC and seamless integration with KubeVirt's storage layer ([**@kvaps**](https://github.com/kvaps) in #2042).
+
+### Platform and Infrastructure
+
+* **[cozystack-api] Switch from DaemonSet to Deployment**: Migrated cozystack-api from DaemonSet to Deployment with PreferClose topology spread constraints, improving resource efficiency while maintaining high availability. The Deployment approach reduces resource consumption compared to running API pods on every node, while topology spreading ensures resilient pod placement across the cluster ([**@kvaps**](https://github.com/kvaps) in #2041, #2048).
+
+* **[linstor] Move CRDs installation to dedicated chart**: Refactored LINSTOR CRDs installation by moving them to a dedicated `piraeus-operator-crds` chart, solving Helm's limitation with large CRD files that could cause unreliable installations. This ensures all LINSTOR CRDs (including linstorsatellites.io) are properly installed before the operator starts, preventing satellite pod creation failures. Includes automatic migration script to reassign existing CRDs to the new chart ([**@kvaps**](https://github.com/kvaps) in #2036).
+
+* **[installer] Unify operator templates**: Merged separate operator templates into a single variant-based template, simplifying the installation process and reducing configuration duplication. The new template supports different deployment variants (Talos, non-Talos) through a unified configuration approach ([**@kvaps**](https://github.com/kvaps) in #2034).
+
+### Applications
+
+* **[mariadb] Rename mysql application to mariadb**: Renamed the MySQL application to MariaDB to accurately reflect the underlying database engine being used. Includes automatic migration script (migration 27) that handles resource renaming and ensures seamless upgrade path for existing MySQL deployments. All resources, including databases, users, backups, and configurations, are automatically migrated to use the mariadb naming ([**@kvaps**](https://github.com/kvaps) in #2026).
+
+* **[ferretdb] Remove FerretDB application**: Removed the FerretDB application from the catalog as it has been superseded by native MongoDB support with improved performance and features ([**@kvaps**](https://github.com/kvaps) in #2028).
+
+## Improvements
+
+* **[rbac] Use hierarchical naming scheme**: Refactored RBAC configuration to use hierarchical naming scheme for cluster roles and role bindings, improving organization and maintainability of permission structures across the platform ([**@lllamnyp**](https://github.com/lllamnyp) in #2019).
+
+* **[backups] Create RBAC for backup resources**: Added comprehensive RBAC configuration for backup resources, enabling proper permission management for backup operations and restore jobs across different user roles ([**@lllamnyp**](https://github.com/lllamnyp) in #2018).
+
+* **[etcd-operator] Add vertical-pod-autoscaler dependency**: Added vertical-pod-autoscaler as a dependency to etcd-operator package, ensuring proper resource scaling and optimization for etcd clusters ([**@sircthulhu**](https://github.com/sircthulhu) in #2047).
+
+## Fixes
+
+* **[cozystack-operator] Preserve existing suspend field in package reconciler**: Fixed package reconciler to properly preserve the existing suspend field state during reconciliation, preventing unintended resumption of suspended packages ([**@sircthulhu**](https://github.com/sircthulhu) in #2043).
+
+* **[cozystack-operator] Fix namespace privileged flag resolution**: Fixed operator to correctly resolve namespace privileged flag by checking all Packages in the namespace, not just the first one. This ensures namespaces are properly marked as privileged when any package requires elevated permissions ([**@kvaps**](https://github.com/kvaps) in #2046).
+
+* **[cozystack-operator] Fix namespace reconciliation field ownership**: Fixed Server-Side Apply (SSA) field ownership conflicts by using per-Package field owner for namespace reconciliation, preventing conflicts when multiple packages reconcile the same namespace ([**@kvaps**](https://github.com/kvaps) in #2046).
+
+* **[platform] Clean up Helm secrets for removed releases**: Added cleanup logic to migration 23 to remove orphaned Helm secrets from removed -rd releases, preventing secret accumulation and reducing cluster resource usage ([**@kvaps**](https://github.com/kvaps) in #2035).
+
+* **[monitoring] Fix YAML parse error in vmagent template**: Fixed YAML parsing error in monitoring-agents vmagent template that could cause monitoring stack deployment failures ([**@kvaps**](https://github.com/kvaps) in #2037).
+
+* **[talm] Fix metadata.id type casting in physical_links_info**: Fixed Prometheus query in physical_links_info chart to properly cast metadata.id to string for regexMatch operations, preventing query failures with numeric interface IDs ([**@kvaps**](https://github.com/kvaps) in cozystack/talm#110).
+
+## Dependencies
+
+* **[kilo] Update to v0.7.1**: Updated Kilo WireGuard mesh networking to v0.7.1 with bug fixes and improvements ([**@kvaps**](https://github.com/kvaps) in #2049).
+
+## Development, Testing, and CI/CD
+
+* **[ci] Improve cozyreport functionality**: Enhanced cozyreport tool with improved reporting capabilities for CI/CD pipelines, providing better visibility into test results and build status ([**@lllamnyp**](https://github.com/lllamnyp) in #2032).
+
+* **[e2e] Increase HelmRelease readiness timeout for kubernetes test**: Increased HelmRelease readiness timeout in Kubernetes end-to-end tests to prevent false failures on slower hardware or during high load conditions, specifically targeting ingress-nginx component which may take longer to become ready ([**@lexfrei**](https://github.com/lexfrei) in #2033).
+
+## Documentation
+
+* **[website] Add documentation versioning**: Implemented comprehensive documentation versioning system with separate v0 and v1 documentation trees, version selector in the UI, proper URL redirects for unversioned docs, and improved navigation for users working with different Cozystack versions ([**@IvanStukov**](https://github.com/IvanStukov) in cozystack/website#415).
+
+* **[website] Describe upgrade to v1.0**: Added detailed upgrade instructions for migrating from v0.x to v1.0, including prerequisites, upgrade steps, and troubleshooting guidance ([**@nbykov0**](https://github.com/nbykov0) in cozystack/website@21bbe84).
+
+* **[website] Update support documentation**: Updated support documentation with current contact information and support channels ([**@xrmtech-isk**](https://github.com/xrmtech-isk) in cozystack/website#420).
+
+---
+
+## Contributors
+
+We'd like to thank all contributors who made this release possible:
+
+* [**@IvanStukov**](https://github.com/IvanStukov)
+* [**@kvaps**](https://github.com/kvaps)
+* [**@lexfrei**](https://github.com/lexfrei)
+* [**@lllamnyp**](https://github.com/lllamnyp)
+* [**@nbykov0**](https://github.com/nbykov0)
+* [**@sircthulhu**](https://github.com/sircthulhu)
+* [**@xrmtech-isk**](https://github.com/xrmtech-isk)
+
+### New Contributors
+
+We're excited to welcome our first-time contributors:
+
+* [**@IvanStukov**](https://github.com/IvanStukov) - First contribution!
+* [**@xrmtech-isk**](https://github.com/xrmtech-isk) - First contribution!
+
+---
+
+**Full Changelog**: [v1.0.0-beta.3...v1.0.0-beta.4](https://github.com/cozystack/cozystack/compare/v1.0.0-beta.3...v1.0.0-beta.4)

From 2bc5e01fda74d418d0bb929dc4e356f62f10b168 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Sat, 14 Feb 2026 11:02:12 +0100
Subject: [PATCH 044/666] fix kubernetes e2e test for rwx volume

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 hack/e2e-apps/run-kubernetes.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index c60fdbe4..d0997ecb 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -260,7 +260,7 @@ spec:
 EOF
 
   # Wait for Pod to complete successfully
-  kubectl --kubeconfig tenantkubeconfig-${test_name} wait pod nfs-test-pod -n tenant-test --timeout=2m --for=jsonpath='{.status.phase}'=Succeeded
+  kubectl --kubeconfig tenantkubeconfig-${test_name} wait pod nfs-test-pod -n tenant-test --timeout=5m --for=jsonpath='{.status.phase}'=Succeeded
 
   # Verify NFS data integrity
   nfs_result=$(kubectl --kubeconfig tenantkubeconfig-${test_name} logs nfs-test-pod -n tenant-test)

From b170a9f4f9d4f65ba677d22d0e14ae76bcdebf1a Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Sat, 14 Feb 2026 11:42:52 +0100
Subject: [PATCH 045/666] feat(cluster-autoscaler): enable
 enforce-node-group-min-size by default

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/system/cluster-autoscaler/values.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/packages/system/cluster-autoscaler/values.yaml b/packages/system/cluster-autoscaler/values.yaml
index 85eacb2d..eaef53d9 100644
--- a/packages/system/cluster-autoscaler/values.yaml
+++ b/packages/system/cluster-autoscaler/values.yaml
@@ -1 +1,3 @@
-cluster-autoscaler: {}
+cluster-autoscaler:
+  extraArgs:
+    enforce-node-group-min-size: true

From fa55b5f41f84fc6ace9edc93648a9beb7c6f7bd2 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Sun, 15 Feb 2026 16:25:00 +0500
Subject: [PATCH 046/666] [dashboard] Upgrade dashboard to version 1.4.0

- Upgrade CRDs in CozyStack dashboard controller
- Add Ingress proxy timeouts for WebSocket to work without terminations
- Add CFOMapping custom resource

Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 api/dashboard/v1alpha1/dashboard_resources.go |  22 ++
 api/dashboard/v1alpha1/groupversion_info.go   |   3 +
 .../v1alpha1/zz_generated.deepcopy.go         |  59 ++++++
 internal/controller/dashboard/breadcrumb.go   |   4 +-
 .../dashboard/customformsoverride.go          |  47 +++++
 internal/controller/dashboard/factory.go      |  94 ++++-----
 internal/controller/dashboard/manager.go      |   8 +
 .../controller/dashboard/marketplacepanel.go  |   2 +-
 internal/controller/dashboard/navigation.go   |  69 +++++++
 internal/controller/dashboard/sidebar.go      |  14 +-
 .../controller/dashboard/static_helpers.go    |   2 +-
 .../controller/dashboard/static_processor.go  |   2 +
 .../controller/dashboard/static_refactored.go | 191 ++++++++++++------
 .../dashboard.cozystack.io_cfomappings.yaml   | 118 +++++++++++
 .../images/openapi-ui-k8s-bff/Dockerfile      |   5 +-
 .../dashboard/images/openapi-ui/Dockerfile    |  19 +-
 .../patches/flatmap-dynamic-key.diff          |  90 ---------
 .../patches/tenantmodules.diff                |  12 +-
 .../system/dashboard/templates/ingress.yaml   |   2 +
 .../dashboard/templates/nginx-config.yaml     |  15 +-
 packages/system/dashboard/templates/web.yaml  |  73 +++++--
 21 files changed, 608 insertions(+), 243 deletions(-)
 create mode 100644 internal/controller/dashboard/navigation.go
 create mode 100644 packages/system/cozystack-controller/definitions/dashboard.cozystack.io_cfomappings.yaml
 delete mode 100644 packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-dynamic-key.diff

diff --git a/api/dashboard/v1alpha1/dashboard_resources.go b/api/dashboard/v1alpha1/dashboard_resources.go
index 5af3b359..afac0b05 100644
--- a/api/dashboard/v1alpha1/dashboard_resources.go
+++ b/api/dashboard/v1alpha1/dashboard_resources.go
@@ -253,3 +253,25 @@ type FactoryList struct {
 	metav1.ListMeta `json:"metadata,omitempty"`
 	Items           []Factory `json:"items"`
 }
+
+// -----------------------------------------------------------------------------
+// CustomFormsOverrideMapping
+// -----------------------------------------------------------------------------
+
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:path=cfomappings,scope=Cluster
+// +kubebuilder:subresource:status
+type CFOMapping struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   ArbitrarySpec `json:"spec"`
+	Status CommonStatus  `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+type CFOMappingList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []CFOMapping `json:"items"`
+}
diff --git a/api/dashboard/v1alpha1/groupversion_info.go b/api/dashboard/v1alpha1/groupversion_info.go
index b3c38e00..659401a7 100644
--- a/api/dashboard/v1alpha1/groupversion_info.go
+++ b/api/dashboard/v1alpha1/groupversion_info.go
@@ -69,6 +69,9 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 
 		&Factory{},
 		&FactoryList{},
+
+		&CFOMapping{},
+		&CFOMappingList{},
 	)
 	metav1.AddToGroupVersion(scheme, GroupVersion)
 	return nil
diff --git a/api/dashboard/v1alpha1/zz_generated.deepcopy.go b/api/dashboard/v1alpha1/zz_generated.deepcopy.go
index 45b1d9d7..568a1780 100644
--- a/api/dashboard/v1alpha1/zz_generated.deepcopy.go
+++ b/api/dashboard/v1alpha1/zz_generated.deepcopy.go
@@ -417,6 +417,65 @@ func (in *FactoryList) DeepCopyObject() runtime.Object {
 	return nil
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CFOMapping) DeepCopyInto(out *CFOMapping) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CFOMapping.
+func (in *CFOMapping) DeepCopy() *CFOMapping {
+	if in == nil {
+		return nil
+	}
+	out := new(CFOMapping)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *CFOMapping) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CFOMappingList) DeepCopyInto(out *CFOMappingList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]CFOMapping, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CFOMappingList.
+func (in *CFOMappingList) DeepCopy() *CFOMappingList {
+	if in == nil {
+		return nil
+	}
+	out := new(CFOMappingList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *CFOMappingList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *MarketplacePanel) DeepCopyInto(out *MarketplacePanel) {
 	*out = *in
diff --git a/internal/controller/dashboard/breadcrumb.go b/internal/controller/dashboard/breadcrumb.go
index aadcacac..6d65f2db 100644
--- a/internal/controller/dashboard/breadcrumb.go
+++ b/internal/controller/dashboard/breadcrumb.go
@@ -33,12 +33,12 @@ func (m *Manager) ensureBreadcrumb(ctx context.Context, crd *cozyv1alpha1.Applic
 
 	key := plural // e.g., "virtualmachines"
 	label := labelPlural
-	link := fmt.Sprintf("/openapi-ui/{clusterName}/{namespace}/api-table/%s/%s/%s", strings.ToLower(group), strings.ToLower(version), plural)
+	link := fmt.Sprintf("/openapi-ui/{cluster}/{namespace}/api-table/%s/%s/%s", strings.ToLower(group), strings.ToLower(version), plural)
 	// If this is a module, change the first breadcrumb item to "Tenant Modules"
 	if crd.Spec.Dashboard != nil && crd.Spec.Dashboard.Module {
 		key = "tenantmodules"
 		label = "Tenant Modules"
-		link = "/openapi-ui/{clusterName}/{namespace}/api-table/core.cozystack.io/v1alpha1/tenantmodules"
+		link = "/openapi-ui/{cluster}/{namespace}/api-table/core.cozystack.io/v1alpha1/tenantmodules"
 	}
 
 	items := []any{
diff --git a/internal/controller/dashboard/customformsoverride.go b/internal/controller/dashboard/customformsoverride.go
index 60bc82fc..dfbccf5c 100644
--- a/internal/controller/dashboard/customformsoverride.go
+++ b/internal/controller/dashboard/customformsoverride.go
@@ -84,6 +84,53 @@ func (m *Manager) ensureCustomFormsOverride(ctx context.Context, crd *cozyv1alph
 	return err
 }
 
+// ensureCFOMapping updates the CFOMapping resource to include a mapping for the given CRD
+func (m *Manager) ensureCFOMapping(ctx context.Context, crd *cozyv1alpha1.ApplicationDefinition) error {
+	g, v, kind := pickGVK(crd)
+	plural := pickPlural(kind, crd)
+
+	resourcePath := fmt.Sprintf("/%s/%s/%s", g, v, plural)
+	customizationID := fmt.Sprintf("default-%s", resourcePath)
+
+	obj := &dashv1alpha1.CFOMapping{}
+	obj.SetName("cfomapping")
+
+	_, err := controllerutil.CreateOrUpdate(ctx, m.Client, obj, func() error {
+		// Parse existing mappings
+		mappings := make(map[string]string)
+		if obj.Spec.JSON.Raw != nil {
+			var spec map[string]any
+			if err := json.Unmarshal(obj.Spec.JSON.Raw, &spec); err == nil {
+				if m, ok := spec["mappings"].(map[string]any); ok {
+					for k, val := range m {
+						if s, ok := val.(string); ok {
+							mappings[k] = s
+						}
+					}
+				}
+			}
+		}
+
+		// Add/update the mapping for this CRD
+		mappings[resourcePath] = customizationID
+
+		specData := map[string]any{
+			"mappings": mappings,
+		}
+		b, err := json.Marshal(specData)
+		if err != nil {
+			return err
+		}
+
+		newSpec := dashv1alpha1.ArbitrarySpec{JSON: apiextv1.JSON{Raw: b}}
+		if !compareArbitrarySpecs(obj.Spec, newSpec) {
+			obj.Spec = newSpec
+		}
+		return nil
+	})
+	return err
+}
+
 // buildMultilineStringSchema parses OpenAPI schema and creates schema with multilineString
 // for all string fields inside spec that don't have enum
 func buildMultilineStringSchema(openAPISchema string) (map[string]any, error) {
diff --git a/internal/controller/dashboard/factory.go b/internal/controller/dashboard/factory.go
index e55aedc7..66ee111d 100644
--- a/internal/controller/dashboard/factory.go
+++ b/internal/controller/dashboard/factory.go
@@ -47,7 +47,7 @@ func (m *Manager) ensureFactory(ctx context.Context, crd *cozyv1alpha1.Applicati
 	if prefix, ok := vncTabPrefix(kind); ok {
 		tabs = append(tabs, vncTab(prefix))
 	}
-	tabs = append(tabs, yamlTab(plural))
+	tabs = append(tabs, yamlTab(g, v, plural))
 
 	// Use unified factory creation
 	config := UnifiedResourceConfig{
@@ -160,11 +160,11 @@ func detailsTab(kind, endpoint, schemaJSON string, keysOrder [][]string) map[str
 				map[string]any{
 					"type": "EnrichedTable",
 					"data": map[string]any{
-						"id":                   "vpc-subnets-table",
-						"baseprefix":           "/openapi-ui",
-						"clusterNamePartOfUrl": "{2}",
-						"customizationId":      "virtualprivatecloud-subnets",
-						"fetchUrl":             "/api/clusters/{2}/k8s/api/v1/namespaces/{3}/configmaps",
+						"id":              "vpc-subnets-table",
+						"baseprefix":      "/openapi-ui",
+						"cluster":         "{2}",
+						"customizationId": "virtualprivatecloud-subnets",
+						"fetchUrl":        "/api/clusters/{2}/k8s/api/v1/namespaces/{3}/configmaps",
 						"fieldSelector": map[string]any{
 							"metadata.name": "virtualprivatecloud-{6}-subnets",
 						},
@@ -188,12 +188,12 @@ func detailsTab(kind, endpoint, schemaJSON string, keysOrder [][]string) map[str
 				map[string]any{
 					"type": "EnrichedTable",
 					"data": map[string]any{
-						"id":                   "resource-quotas-table",
-						"baseprefix":           "/openapi-ui",
-						"clusterNamePartOfUrl": "{2}",
-						"customizationId":      "factory-resource-quotas",
-						"fetchUrl":             "/api/clusters/{2}/k8s/api/v1/namespaces/{reqsJsonPath[0]['.status.namespace']}/resourcequotas",
-						"pathToItems":          []any{`items`},
+						"id":              "resource-quotas-table",
+						"baseprefix":      "/openapi-ui",
+						"cluster":         "{2}",
+						"customizationId": "factory-resource-quotas",
+						"fetchUrl":        "/api/clusters/{2}/k8s/api/v1/namespaces/{reqsJsonPath[0]['.status.namespace']}/resourcequotas",
+						"pathToItems":     []any{`items`},
 					},
 				},
 			}),
@@ -242,13 +242,13 @@ func detailsTab(kind, endpoint, schemaJSON string, keysOrder [][]string) map[str
 				map[string]any{
 					"type": "EnrichedTable",
 					"data": map[string]any{
-						"id":                   "conditions-table",
-						"fetchUrl":             endpoint,
-						"clusterNamePartOfUrl": "{2}",
-						"customizationId":      "factory-status-conditions",
-						"baseprefix":           "/openapi-ui",
-						"withoutControls":      true,
-						"pathToItems":          []any{"status", "conditions"},
+						"id":              "conditions-table",
+						"fetchUrl":        endpoint,
+						"cluster":         "{2}",
+						"customizationId": "factory-status-conditions",
+						"baseprefix":      "/openapi-ui",
+						"withoutControls": true,
+						"pathToItems":     []any{"status", "conditions"},
 					},
 				},
 			}),
@@ -264,12 +264,12 @@ func workloadsTab(kind string) map[string]any {
 			map[string]any{
 				"type": "EnrichedTable",
 				"data": map[string]any{
-					"id":                   "workloads-table",
-					"fetchUrl":             "/api/clusters/{2}/k8s/apis/cozystack.io/v1alpha1/namespaces/{3}/workloadmonitors",
-					"clusterNamePartOfUrl": "{2}",
-					"baseprefix":           "/openapi-ui",
-					"customizationId":      "factory-details-v1alpha1.cozystack.io.workloadmonitors",
-					"pathToItems":          []any{"items"},
+					"id":              "workloads-table",
+					"fetchUrl":        "/api/clusters/{2}/k8s/apis/cozystack.io/v1alpha1/namespaces/{3}/workloadmonitors",
+					"cluster":         "{2}",
+					"baseprefix":      "/openapi-ui",
+					"customizationId": "factory-details-v1alpha1.cozystack.io.workloadmonitors",
+					"pathToItems":     []any{"items"},
 					"labelSelector": map[string]any{
 						"apps.cozystack.io/application.group": "apps.cozystack.io",
 						"apps.cozystack.io/application.kind":  kind,
@@ -289,12 +289,12 @@ func servicesTab(kind string) map[string]any {
 			map[string]any{
 				"type": "EnrichedTable",
 				"data": map[string]any{
-					"id":                   "services-table",
-					"fetchUrl":             "/api/clusters/{2}/k8s/api/v1/namespaces/{3}/services",
-					"clusterNamePartOfUrl": "{2}",
-					"baseprefix":           "/openapi-ui",
-					"customizationId":      "factory-details-v1.services",
-					"pathToItems":          []any{"items"},
+					"id":              "services-table",
+					"fetchUrl":        "/api/clusters/{2}/k8s/api/v1/namespaces/{3}/services",
+					"cluster":         "{2}",
+					"baseprefix":      "/openapi-ui",
+					"customizationId": "factory-details-v1.services",
+					"pathToItems":     []any{"items"},
 					"labelSelector": map[string]any{
 						"apps.cozystack.io/application.group":  "apps.cozystack.io",
 						"apps.cozystack.io/application.kind":   kind,
@@ -315,12 +315,12 @@ func ingressesTab(kind string) map[string]any {
 			map[string]any{
 				"type": "EnrichedTable",
 				"data": map[string]any{
-					"id":                   "ingresses-table",
-					"fetchUrl":             "/api/clusters/{2}/k8s/apis/networking.k8s.io/v1/namespaces/{3}/ingresses",
-					"clusterNamePartOfUrl": "{2}",
-					"baseprefix":           "/openapi-ui",
-					"customizationId":      "factory-details-networking.k8s.io.v1.ingresses",
-					"pathToItems":          []any{"items"},
+					"id":              "ingresses-table",
+					"fetchUrl":        "/api/clusters/{2}/k8s/apis/networking.k8s.io/v1/namespaces/{3}/ingresses",
+					"cluster":         "{2}",
+					"baseprefix":      "/openapi-ui",
+					"customizationId": "factory-details-networking.k8s.io.v1.ingresses",
+					"pathToItems":     []any{"items"},
 					"labelSelector": map[string]any{
 						"apps.cozystack.io/application.group":  "apps.cozystack.io",
 						"apps.cozystack.io/application.kind":   kind,
@@ -341,12 +341,12 @@ func secretsTab(kind string) map[string]any {
 			map[string]any{
 				"type": "EnrichedTable",
 				"data": map[string]any{
-					"id":                   "secrets-table",
-					"fetchUrl":             "/api/clusters/{2}/k8s/apis/core.cozystack.io/v1alpha1/namespaces/{3}/tenantsecrets",
-					"clusterNamePartOfUrl": "{2}",
-					"baseprefix":           "/openapi-ui",
-					"customizationId":      "factory-details-v1alpha1.core.cozystack.io.tenantsecrets",
-					"pathToItems":          []any{"items"},
+					"id":              "secrets-table",
+					"fetchUrl":        "/api/clusters/{2}/k8s/apis/core.cozystack.io/v1alpha1/namespaces/{3}/tenantsecrets",
+					"cluster":         "{2}",
+					"baseprefix":      "/openapi-ui",
+					"customizationId": "factory-details-v1alpha1.core.cozystack.io.tenantsecrets",
+					"pathToItems":     []any{"items"},
 					"labelSelector": map[string]any{
 						"apps.cozystack.io/application.group": "apps.cozystack.io",
 						"apps.cozystack.io/application.kind":  kind,
@@ -358,7 +358,7 @@ func secretsTab(kind string) map[string]any {
 	}
 }
 
-func yamlTab(plural string) map[string]any {
+func yamlTab(group, version, plural string) map[string]any {
 	return map[string]any{
 		"key":   "yaml",
 		"label": "YAML",
@@ -369,8 +369,10 @@ func yamlTab(plural string) map[string]any {
 					"id":                        "yaml-editor",
 					"cluster":                   "{2}",
 					"isNameSpaced":              true,
-					"type":                      "builtin",
-					"typeName":                  plural,
+					"type":                      "apis",
+					"apiGroup":                  group,
+					"apiVersion":                version,
+					"plural":                    plural,
 					"prefillValuesRequestIndex": float64(0),
 					"readOnly":                  true,
 					"substractHeight":           float64(400),
diff --git a/internal/controller/dashboard/manager.go b/internal/controller/dashboard/manager.go
index 23897586..b0a4cd1b 100644
--- a/internal/controller/dashboard/manager.go
+++ b/internal/controller/dashboard/manager.go
@@ -132,6 +132,10 @@ func (m *Manager) EnsureForAppDef(ctx context.Context, crd *cozyv1alpha1.Applica
 		return reconcile.Result{}, err
 	}
 
+	if err := m.ensureCFOMapping(ctx, crd); err != nil {
+		return reconcile.Result{}, err
+	}
+
 	if err := m.ensureSidebar(ctx, crd); err != nil {
 		return reconcile.Result{}, err
 	}
@@ -139,6 +143,10 @@ func (m *Manager) EnsureForAppDef(ctx context.Context, crd *cozyv1alpha1.Applica
 	if err := m.ensureFactory(ctx, crd); err != nil {
 		return reconcile.Result{}, err
 	}
+
+	if err := m.ensureNavigation(ctx, crd); err != nil {
+		return reconcile.Result{}, err
+	}
 	return reconcile.Result{}, nil
 }
 
diff --git a/internal/controller/dashboard/marketplacepanel.go b/internal/controller/dashboard/marketplacepanel.go
index 6bfce752..fcfff799 100644
--- a/internal/controller/dashboard/marketplacepanel.go
+++ b/internal/controller/dashboard/marketplacepanel.go
@@ -74,7 +74,7 @@ func (m *Manager) ensureMarketplacePanel(ctx context.Context, crd *cozyv1alpha1.
 		"type":        "nonCrd",
 		"apiGroup":    "apps.cozystack.io",
 		"apiVersion":  "v1alpha1",
-		"typeName":    app.Plural, // e.g., "buckets"
+		"plural":      app.Plural, // e.g., "buckets"
 		"disabled":    false,
 		"hidden":      false,
 		"tags":        tags,
diff --git a/internal/controller/dashboard/navigation.go b/internal/controller/dashboard/navigation.go
new file mode 100644
index 00000000..5e4bad2e
--- /dev/null
+++ b/internal/controller/dashboard/navigation.go
@@ -0,0 +1,69 @@
+package dashboard
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	dashv1alpha1 "github.com/cozystack/cozystack/api/dashboard/v1alpha1"
+	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+
+	apiextv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+)
+
+// ensureNavigation updates the Navigation resource to include a baseFactoriesMapping entry for the given CRD
+func (m *Manager) ensureNavigation(ctx context.Context, crd *cozyv1alpha1.ApplicationDefinition) error {
+	g, v, kind := pickGVK(crd)
+	plural := pickPlural(kind, crd)
+
+	lowerKind := strings.ToLower(kind)
+	factoryKey := fmt.Sprintf("%s-details", lowerKind)
+
+	// All CRD resources are namespaced API resources
+	mappingKey := fmt.Sprintf("base-factory-namespaced-api-%s-%s-%s", g, v, plural)
+
+	obj := &dashv1alpha1.Navigation{}
+	obj.SetName("navigation")
+
+	_, err := controllerutil.CreateOrUpdate(ctx, m.Client, obj, func() error {
+		// Parse existing spec
+		spec := make(map[string]any)
+		if obj.Spec.JSON.Raw != nil {
+			if err := json.Unmarshal(obj.Spec.JSON.Raw, &spec); err != nil {
+				spec = make(map[string]any)
+			}
+		}
+
+		// Get or create baseFactoriesMapping
+		var mappings map[string]string
+		if existing, ok := spec["baseFactoriesMapping"].(map[string]any); ok {
+			mappings = make(map[string]string, len(existing))
+			for k, val := range existing {
+				if s, ok := val.(string); ok {
+					mappings[k] = s
+				}
+			}
+		} else {
+			mappings = make(map[string]string)
+		}
+
+		// Add/update the mapping for this CRD
+		mappings[mappingKey] = factoryKey
+
+		spec["baseFactoriesMapping"] = mappings
+
+		b, err := json.Marshal(spec)
+		if err != nil {
+			return err
+		}
+
+		newSpec := dashv1alpha1.ArbitrarySpec{JSON: apiextv1.JSON{Raw: b}}
+		if !compareArbitrarySpecs(obj.Spec, newSpec) {
+			obj.Spec = newSpec
+		}
+		return nil
+	})
+	return err
+}
diff --git a/internal/controller/dashboard/sidebar.go b/internal/controller/dashboard/sidebar.go
index a6ade387..b7a6eb70 100644
--- a/internal/controller/dashboard/sidebar.go
+++ b/internal/controller/dashboard/sidebar.go
@@ -22,8 +22,8 @@ import (
 //
 // Menu rules:
 //   - The first section is "Marketplace" with two hardcoded entries:
-//   - Marketplace  (/openapi-ui/{clusterName}/{namespace}/factory/marketplace)
-//   - Tenant Info  (/openapi-ui/{clusterName}/{namespace}/factory/info-details/info)
+//   - Marketplace  (/openapi-ui/{cluster}/{namespace}/factory/marketplace)
+//   - Tenant Info  (/openapi-ui/{cluster}/{namespace}/factory/info-details/info)
 //   - All other sections are built from CRDs where spec.dashboard != nil.
 //   - Categories are ordered strictly as:
 //     Marketplace, IaaS, PaaS, NaaS, <others A→Z>, Resources, Backups, Administration
@@ -91,7 +91,7 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 			// Weight (default 0)
 			weight := def.Spec.Dashboard.Weight
 
-			link := fmt.Sprintf("/openapi-ui/{clusterName}/{namespace}/api-table/%s/%s/%s", g, v, plural)
+			link := fmt.Sprintf("/openapi-ui/{cluster}/{namespace}/api-table/%s/%s/%s", g, v, plural)
 
 			categories[cat] = append(categories[cat], item{
 				Key:    plural,
@@ -146,7 +146,7 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 				map[string]any{
 					"key":   "marketplace",
 					"label": "Marketplace",
-					"link":  "/openapi-ui/{clusterName}/{namespace}/factory/marketplace",
+					"link":  "/openapi-ui/{cluster}/{namespace}/factory/marketplace",
 				},
 			},
 		},
@@ -205,12 +205,12 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 			map[string]any{
 				"key":   "info",
 				"label": "Info",
-				"link":  "/openapi-ui/{clusterName}/{namespace}/factory/info-details/info",
+				"link":  "/openapi-ui/{cluster}/{namespace}/factory/info-details/info",
 			},
 			map[string]any{
 				"key":   "modules",
 				"label": "Modules",
-				"link":  "/openapi-ui/{clusterName}/{namespace}/api-table/core.cozystack.io/v1alpha1/tenantmodules",
+				"link":  "/openapi-ui/{cluster}/{namespace}/api-table/core.cozystack.io/v1alpha1/tenantmodules",
 			},
 			map[string]any{
 				"key":   "loadbalancer-services",
@@ -220,7 +220,7 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 			map[string]any{
 				"key":   "tenants",
 				"label": "Tenants",
-				"link":  "/openapi-ui/{clusterName}/{namespace}/api-table/apps.cozystack.io/v1alpha1/tenants",
+				"link":  "/openapi-ui/{cluster}/{namespace}/api-table/apps.cozystack.io/v1alpha1/tenants",
 			},
 		},
 	})
diff --git a/internal/controller/dashboard/static_helpers.go b/internal/controller/dashboard/static_helpers.go
index af46674b..1a1018cb 100644
--- a/internal/controller/dashboard/static_helpers.go
+++ b/internal/controller/dashboard/static_helpers.go
@@ -1134,7 +1134,7 @@ func yamlEditor(id, cluster string, isNameSpaced bool, typeName string, prefillV
 			"cluster":                   cluster,
 			"isNameSpaced":              isNameSpaced,
 			"type":                      "builtin",
-			"typeName":                  typeName,
+			"plural":                    typeName,
 			"prefillValuesRequestIndex": prefillValuesRequestIndex,
 			"substractHeight":           float64(400),
 		},
diff --git a/internal/controller/dashboard/static_processor.go b/internal/controller/dashboard/static_processor.go
index 902e3818..d4b270f4 100644
--- a/internal/controller/dashboard/static_processor.go
+++ b/internal/controller/dashboard/static_processor.go
@@ -49,6 +49,8 @@ func (m *Manager) ensureStaticResource(ctx context.Context, obj client.Object) e
 			resource.(*dashv1alpha1.Navigation).Spec = o.Spec
 		case *dashv1alpha1.TableUriMapping:
 			resource.(*dashv1alpha1.TableUriMapping).Spec = o.Spec
+		case *dashv1alpha1.CFOMapping:
+			resource.(*dashv1alpha1.CFOMapping).Spec = o.Spec
 		}
 		// Ensure labels are always set
 		m.addDashboardLabels(resource, nil, ResourceTypeStatic)
diff --git a/internal/controller/dashboard/static_refactored.go b/internal/controller/dashboard/static_refactored.go
index 4b244396..d47c88da 100644
--- a/internal/controller/dashboard/static_refactored.go
+++ b/internal/controller/dashboard/static_refactored.go
@@ -17,111 +17,111 @@ func CreateAllBreadcrumbs() []*dashboardv1alpha1.Breadcrumb {
 	return []*dashboardv1alpha1.Breadcrumb{
 		// Stock project factory configmap details
 		createBreadcrumb("stock-project-factory-configmap-details", []map[string]any{
-			createBreadcrumbItem("configmaps", "v1/configmaps", "/openapi-ui/{clusterName}/{namespace}/builtin-table/configmaps"),
+			createBreadcrumbItem("configmaps", "v1/configmaps", "/openapi-ui/{cluster}/{namespace}/builtin-table/configmaps"),
 			createBreadcrumbItem("configmap", "{6}"),
 		}),
 
 		// Stock cluster factory namespace details
 		createBreadcrumb("stock-cluster-factory-namespace-details", []map[string]any{
-			createBreadcrumbItem("namespaces", "v1/namespaces", "/openapi-ui/{clusterName}/builtin-table/namespaces"),
+			createBreadcrumbItem("namespaces", "v1/namespaces", "/openapi-ui/{cluster}/builtin-table/namespaces"),
 			createBreadcrumbItem("namespace", "{5}"),
 		}),
 
 		// Stock cluster factory node details
 		createBreadcrumb("stock-cluster-factory-node-details", []map[string]any{
-			createBreadcrumbItem("node", "v1/nodes", "/openapi-ui/{clusterName}/builtin-table/nodes"),
+			createBreadcrumbItem("node", "v1/nodes", "/openapi-ui/{cluster}/builtin-table/nodes"),
 			createBreadcrumbItem("node", "{5}"),
 		}),
 
 		// Stock project factory pod details
 		createBreadcrumb("stock-project-factory-pod-details", []map[string]any{
-			createBreadcrumbItem("pods", "v1/pods", "/openapi-ui/{clusterName}/{namespace}/builtin-table/pods"),
+			createBreadcrumbItem("pods", "v1/pods", "/openapi-ui/{cluster}/{namespace}/builtin-table/pods"),
 			createBreadcrumbItem("pod", "{6}"),
 		}),
 
 		// Stock project factory secret details
 		createBreadcrumb("stock-project-factory-kube-secret-details", []map[string]any{
-			createBreadcrumbItem("secrets", "v1/secrets", "/openapi-ui/{clusterName}/{namespace}/builtin-table/secrets"),
+			createBreadcrumbItem("secrets", "v1/secrets", "/openapi-ui/{cluster}/{namespace}/builtin-table/secrets"),
 			createBreadcrumbItem("secret", "{6}"),
 		}),
 
 		// Stock project factory service details
 		createBreadcrumb("stock-project-factory-kube-service-details", []map[string]any{
-			createBreadcrumbItem("services", "v1/services", "/openapi-ui/{clusterName}/{namespace}/builtin-table/services"),
+			createBreadcrumbItem("services", "v1/services", "/openapi-ui/{cluster}/{namespace}/builtin-table/services"),
 			createBreadcrumbItem("service", "{6}"),
 		}),
 
 		// Stock project factory ingress details
 		createBreadcrumb("stock-project-factory-kube-ingress-details", []map[string]any{
-			createBreadcrumbItem("ingresses", "networking.k8s.io/v1/ingresses", "/openapi-ui/{clusterName}/{namespace}/builtin-table/ingresses"),
+			createBreadcrumbItem("ingresses", "networking.k8s.io/v1/ingresses", "/openapi-ui/{cluster}/{namespace}/builtin-table/ingresses"),
 			createBreadcrumbItem("ingress", "{6}"),
 		}),
 
 		// Stock cluster api table
 		createBreadcrumb("stock-cluster-api-table", []map[string]any{
-			createBreadcrumbItem("api", "{apiGroup}/{apiVersion}/{typeName}"),
+			createBreadcrumbItem("api", "{apiGroup}/{apiVersion}/{plural}"),
 		}),
 
 		// Stock cluster api form
 		createBreadcrumb("stock-cluster-api-form", []map[string]any{
-			createBreadcrumbItem("create-api-res-namespaced-table", "{apiGroup}/{apiVersion}/{typeName}", "/openapi-ui/{clusterName}/api-table/{apiGroup}/{apiVersion}/{typeName}"),
+			createBreadcrumbItem("create-api-res-namespaced-table", "{apiGroup}/{apiVersion}/{plural}", "/openapi-ui/{cluster}/api-table/{apiGroup}/{apiVersion}/{plural}"),
 			createBreadcrumbItem("create-api-res-namespaced-typename", "Create"),
 		}),
 
 		// Stock cluster api form edit
 		createBreadcrumb("stock-cluster-api-form-edit", []map[string]any{
-			createBreadcrumbItem("create-api-res-namespaced-table", "{apiGroup}/{apiVersion}/{typeName}", "/openapi-ui/{clusterName}/api-table/{apiGroup}/{apiVersion}/{typeName}"),
+			createBreadcrumbItem("create-api-res-namespaced-table", "{apiGroup}/{apiVersion}/{plural}", "/openapi-ui/{cluster}/api-table/{apiGroup}/{apiVersion}/{plural}"),
 			createBreadcrumbItem("create-api-res-namespaced-typename", "Update"),
 		}),
 
 		// Stock cluster builtin table
 		createBreadcrumb("stock-cluster-builtin-table", []map[string]any{
-			createBreadcrumbItem("api", "v1/{typeName}"),
+			createBreadcrumbItem("api", "v1/{plural}"),
 		}),
 
 		// Stock cluster builtin form
 		createBreadcrumb("stock-cluster-builtin-form", []map[string]any{
-			createBreadcrumbItem("create-api-res-namespaced-table", "v1/{typeName}", "/openapi-ui/{clusterName}/builtin-table/{typeName}"),
+			createBreadcrumbItem("create-api-res-namespaced-table", "v1/{plural}", "/openapi-ui/{cluster}/builtin-table/{plural}"),
 			createBreadcrumbItem("create-api-res-namespaced-typename", "Create"),
 		}),
 
 		// Stock cluster builtin form edit
 		createBreadcrumb("stock-cluster-builtin-form-edit", []map[string]any{
-			createBreadcrumbItem("create-api-res-namespaced-table", "v1/{typeName}", "/openapi-ui/{clusterName}/builtin-table/{typeName}"),
+			createBreadcrumbItem("create-api-res-namespaced-table", "v1/{plural}", "/openapi-ui/{cluster}/builtin-table/{plural}"),
 			createBreadcrumbItem("create-api-res-namespaced-typename", "Update"),
 		}),
 
 		// Stock project api table
 		createBreadcrumb("stock-project-api-table", []map[string]any{
-			createBreadcrumbItem("api", "{apiGroup}/{apiVersion}/{typeName}"),
+			createBreadcrumbItem("api", "{apiGroup}/{apiVersion}/{plural}"),
 		}),
 
 		// Stock project api form
 		createBreadcrumb("stock-project-api-form", []map[string]any{
-			createBreadcrumbItem("create-api-res-namespaced-table", "{apiGroup}/{apiVersion}/{typeName}", "/openapi-ui/{clusterName}/{namespace}/api-table/{apiGroup}/{apiVersion}/{typeName}"),
+			createBreadcrumbItem("create-api-res-namespaced-table", "{apiGroup}/{apiVersion}/{plural}", "/openapi-ui/{cluster}/{namespace}/api-table/{apiGroup}/{apiVersion}/{plural}"),
 			createBreadcrumbItem("create-api-res-namespaced-typename", "Create"),
 		}),
 
 		// Stock project api form edit
 		createBreadcrumb("stock-project-api-form-edit", []map[string]any{
-			createBreadcrumbItem("create-api-res-namespaced-table", "{apiGroup}/{apiVersion}/{typeName}", "/openapi-ui/{clusterName}/{namespace}/api-table/{apiGroup}/{apiVersion}/{typeName}"),
+			createBreadcrumbItem("create-api-res-namespaced-table", "{apiGroup}/{apiVersion}/{plural}", "/openapi-ui/{cluster}/{namespace}/api-table/{apiGroup}/{apiVersion}/{plural}"),
 			createBreadcrumbItem("create-api-res-namespaced-typename", "Update"),
 		}),
 
 		// Stock project builtin table
 		createBreadcrumb("stock-project-builtin-table", []map[string]any{
-			createBreadcrumbItem("api", "v1/{typeName}"),
+			createBreadcrumbItem("api", "v1/{plural}"),
 		}),
 
 		// Stock project builtin form
 		createBreadcrumb("stock-project-builtin-form", []map[string]any{
-			createBreadcrumbItem("create-api-res-namespaced-table", "v1/{typeName}", "/openapi-ui/{clusterName}/{namespace}/builtin-table/{typeName}"),
+			createBreadcrumbItem("create-api-res-namespaced-table", "v1/{plural}", "/openapi-ui/{cluster}/{namespace}/builtin-table/{plural}"),
 			createBreadcrumbItem("create-api-res-namespaced-typename", "Create"),
 		}),
 
 		// Stock project builtin form edit
 		createBreadcrumb("stock-project-builtin-form-edit", []map[string]any{
-			createBreadcrumbItem("create-api-res-namespaced-table", "v1/{typeName}", "/openapi-ui/{clusterName}/{namespace}/builtin-table/{typeName}"),
+			createBreadcrumbItem("create-api-res-namespaced-table", "v1/{plural}", "/openapi-ui/{cluster}/{namespace}/builtin-table/{plural}"),
 			createBreadcrumbItem("create-api-res-namespaced-typename", "Update"),
 		}),
 	}
@@ -535,14 +535,14 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 			}, []any{
 				map[string]any{
 					"data": map[string]any{
-						"baseApiVersion":       "v1alpha1",
-						"baseprefix":           "openapi-ui",
-						"clusterNamePartOfUrl": "{2}",
-						"id":                   311,
-						"mpResourceKind":       "MarketplacePanel",
-						"mpResourceName":       "marketplacepanels",
-						"namespacePartOfUrl":   "{3}",
-						"baseApiGroup":         "dashboard.cozystack.io",
+						"baseApiVersion":    "v1alpha1",
+						"baseprefix":        "openapi-ui",
+						"cluster":           "{2}",
+						"id":                311,
+						"marketplaceKind":   "MarketplacePanel",
+						"marketplacePlural": "marketplacepanels",
+						"namespace":         "{3}",
+						"baseApiGroup":      "dashboard.cozystack.io",
 					},
 					"type": "MarketplaceCard",
 				},
@@ -855,7 +855,7 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 						"prefillValuesRequestIndex": 0,
 						"substractHeight":           float64(400),
 						"type":                      "builtin",
-						"typeName":                  "secrets",
+						"plural":                    "secrets",
 						"readOnly":                  true,
 					},
 				},
@@ -1085,13 +1085,13 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 									map[string]any{
 										"type": "EnrichedTable",
 										"data": map[string]any{
-											"id":                   "service-port-mapping-table",
-											"baseprefix":           "/openapi-ui",
-											"clusterNamePartOfUrl": "{2}",
-											"customizationId":      "factory-kube-service-details-port-mapping",
-											"fetchUrl":             "/api/clusters/{2}/k8s/api/v1/namespaces/{3}/services/{6}",
-											"pathToItems":          ".spec.ports",
-											"withoutControls":      true,
+											"id":              "service-port-mapping-table",
+											"baseprefix":      "/openapi-ui",
+											"cluster":         "{2}",
+											"customizationId": "factory-kube-service-details-port-mapping",
+											"fetchUrl":        "/api/clusters/{2}/k8s/api/v1/namespaces/{3}/services/{6}",
+											"pathToItems":     ".spec.ports",
+											"withoutControls": true,
 										},
 									},
 								}),
@@ -1111,11 +1111,11 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 											map[string]any{
 												"type": "EnrichedTable",
 												"data": map[string]any{
-													"id":                   "service-pod-serving-table",
-													"baseprefix":           "/openapi-ui",
-													"clusterNamePartOfUrl": "{2}",
-													"customizationId":      "factory-kube-service-details-endpointslice",
-													"fetchUrl":             "/api/clusters/{2}/k8s/apis/discovery.k8s.io/v1/namespaces/{3}/endpointslices",
+													"id":              "service-pod-serving-table",
+													"baseprefix":      "/openapi-ui",
+													"cluster":         "{2}",
+													"customizationId": "factory-kube-service-details-endpointslice",
+													"fetchUrl":        "/api/clusters/{2}/k8s/apis/discovery.k8s.io/v1/namespaces/{3}/endpointslices",
 													"labelSelector": map[string]any{
 														"kubernetes.io/service-name": "{reqsJsonPath[0]['.metadata.name']['-']}",
 													},
@@ -1145,7 +1145,7 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 						"prefillValuesRequestIndex": 0,
 						"substractHeight":           float64(400),
 						"type":                      "builtin",
-						"typeName":                  "services",
+						"plural":                    "services",
 					},
 				},
 			},
@@ -1168,11 +1168,11 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 						map[string]any{
 							"type": "EnrichedTable",
 							"data": map[string]any{
-								"id":                   "pods-table",
-								"baseprefix":           "/openapi-ui",
-								"clusterNamePartOfUrl": "{2}",
-								"customizationId":      "factory-node-details-/v1/pods",
-								"fetchUrl":             "/api/clusters/{2}/k8s/api/v1/namespaces/{3}/pods",
+								"id":              "pods-table",
+								"baseprefix":      "/openapi-ui",
+								"cluster":         "{2}",
+								"customizationId": "factory-node-details-/v1/pods",
+								"fetchUrl":        "/api/clusters/{2}/k8s/api/v1/namespaces/{3}/pods",
 								"labelSelectorFull": map[string]any{
 									"pathToLabels": ".spec.selector",
 									"reqIndex":     0,
@@ -1300,13 +1300,13 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 					map[string]any{
 						"type": "EnrichedTable",
 						"data": map[string]any{
-							"id":                   "rules-table",
-							"fetchUrl":             "/api/clusters/{2}/k8s/apis/networking.k8s.io/v1/namespaces/{3}/ingresses/{6}",
-							"clusterNamePartOfUrl": "{2}",
-							"customizationId":      "factory-kube-ingress-details-rules",
-							"baseprefix":           "/openapi-ui",
-							"withoutControls":      true,
-							"pathToItems":          []any{"spec", "rules"},
+							"id":              "rules-table",
+							"fetchUrl":        "/api/clusters/{2}/k8s/apis/networking.k8s.io/v1/namespaces/{3}/ingresses/{6}",
+							"cluster":         "{2}",
+							"customizationId": "factory-kube-ingress-details-rules",
+							"baseprefix":      "/openapi-ui",
+							"withoutControls": true,
+							"pathToItems":     []any{"spec", "rules"},
 						},
 					},
 				}),
@@ -1322,8 +1322,10 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 						"id":                        "yaml-editor",
 						"cluster":                   "{2}",
 						"isNameSpaced":              true,
-						"type":                      "builtin",
-						"typeName":                  "ingresses",
+						"type":                      "apis",
+						"apiGroup":                  "networking.k8s.io",
+						"apiVersion":                "v1",
+						"plural":                    "ingresses",
 						"prefillValuesRequestIndex": float64(0),
 						"substractHeight":           float64(400),
 					},
@@ -1452,11 +1454,11 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 				map[string]any{
 					"type": "EnrichedTable",
 					"data": map[string]any{
-						"id":                   "workloads-table",
-						"baseprefix":           "/openapi-ui",
-						"clusterNamePartOfUrl": "{2}",
-						"customizationId":      "factory-details-v1alpha1.cozystack.io.workloads",
-						"fetchUrl":             "/api/clusters/{2}/k8s/apis/cozystack.io/v1alpha1/namespaces/{3}/workloads",
+						"id":              "workloads-table",
+						"baseprefix":      "/openapi-ui",
+						"cluster":         "{2}",
+						"customizationId": "factory-details-v1alpha1.cozystack.io.workloads",
+						"fetchUrl":        "/api/clusters/{2}/k8s/apis/cozystack.io/v1alpha1/namespaces/{3}/workloads",
 						"labelSelector": map[string]any{
 							"workloads.cozystack.io/monitor": "{reqs[0]['metadata','name']}",
 						},
@@ -1477,8 +1479,10 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 						"isNameSpaced":              true,
 						"prefillValuesRequestIndex": 0,
 						"substractHeight":           float64(400),
-						"type":                      "builtin",
-						"typeName":                  "workloadmonitors",
+						"type":                      "apis",
+						"apiGroup":                  "cozystack.io",
+						"apiVersion":                "v1alpha1",
+						"plural":                    "workloadmonitors",
 					},
 				},
 			},
@@ -1960,12 +1964,27 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 
 // CreateAllNavigations creates all navigation resources using helper functions
 func CreateAllNavigations() []*dashboardv1alpha1.Navigation {
+	// Build baseFactoriesMapping for static (built-in) factories
+	baseFactoriesMapping := map[string]string{
+		// Cluster-scoped builtin resources
+		"base-factory-clusterscoped-builtin-v1-namespaces": "namespace-details",
+		"base-factory-clusterscoped-builtin-v1-nodes":      "node-details",
+		// Namespaced builtin resources
+		"base-factory-namespaced-builtin-v1-pods":     "pod-details",
+		"base-factory-namespaced-builtin-v1-secrets":  "kube-secret-details",
+		"base-factory-namespaced-builtin-v1-services": "kube-service-details",
+		// Namespaced API resources
+		"base-factory-namespaced-api-networking.k8s.io-v1-ingresses":         "kube-ingress-details",
+		"base-factory-namespaced-api-cozystack.io-v1alpha1-workloadmonitors": "workloadmonitor-details",
+	}
+
 	return []*dashboardv1alpha1.Navigation{
 		createNavigation("navigation", map[string]any{
 			"namespaces": map[string]any{
 				"change": "/openapi-ui/{selectedCluster}/{value}/factory/marketplace",
 				"clear":  "/openapi-ui/{selectedCluster}/api-table/core.cozystack.io/v1alpha1/tenantnamespaces",
 			},
+			"baseFactoriesMapping": baseFactoriesMapping,
 		}),
 	}
 }
@@ -2342,6 +2361,51 @@ func createWorkloadmonitorHeader() map[string]any {
 	}
 }
 
+// CreateStaticCFOMapping creates the CFOMapping resource with mappings from static CustomFormsOverrides
+func CreateStaticCFOMapping() *dashboardv1alpha1.CFOMapping {
+	// Build mappings from static CustomFormsOverrides
+	customFormsOverrides := CreateAllCustomFormsOverrides()
+	mappings := make(map[string]string, len(customFormsOverrides))
+	for _, cfo := range customFormsOverrides {
+		var spec map[string]any
+		if err := json.Unmarshal(cfo.Spec.JSON.Raw, &spec); err != nil {
+			continue
+		}
+		customizationID, ok := spec["customizationId"].(string)
+		if !ok {
+			continue
+		}
+		// Extract the resource path from customizationId (remove "default-" prefix)
+		resourcePath := strings.TrimPrefix(customizationID, "default-")
+		mappings[resourcePath] = customizationID
+	}
+
+	return createCFOMapping("cfomapping", mappings)
+}
+
+// createCFOMapping creates a CFOMapping resource
+func createCFOMapping(name string, mappings map[string]string) *dashboardv1alpha1.CFOMapping {
+	spec := map[string]any{
+		"mappings": mappings,
+	}
+	jsonData, _ := json.Marshal(spec)
+
+	return &dashboardv1alpha1.CFOMapping{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "dashboard.cozystack.io/v1alpha1",
+			Kind:       "CFOMapping",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name: name,
+		},
+		Spec: dashboardv1alpha1.ArbitrarySpec{
+			JSON: v1.JSON{
+				Raw: jsonData,
+			},
+		},
+	}
+}
+
 // ---------------- Complete resource creation function ----------------
 
 // CreateAllStaticResources creates all static dashboard resources using helper functions
@@ -2378,5 +2442,8 @@ func CreateAllStaticResources() []client.Object {
 		resources = append(resources, tableUriMapping)
 	}
 
+	// Add CFOMapping
+	resources = append(resources, CreateStaticCFOMapping())
+
 	return resources
 }
diff --git a/packages/system/cozystack-controller/definitions/dashboard.cozystack.io_cfomappings.yaml b/packages/system/cozystack-controller/definitions/dashboard.cozystack.io_cfomappings.yaml
new file mode 100644
index 00000000..a46f6a23
--- /dev/null
+++ b/packages/system/cozystack-controller/definitions/dashboard.cozystack.io_cfomappings.yaml
@@ -0,0 +1,118 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.16.4
+  name: cfomappings.dashboard.cozystack.io
+spec:
+  group: dashboard.cozystack.io
+  names:
+    kind: CFOMapping
+    listKind: CFOMappingList
+    plural: cfomappings
+    singular: cfomapping
+  scope: Cluster
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: |-
+              ArbitrarySpec holds schemaless user data and preserves unknown fields.
+              We map the entire .spec to a single JSON payload to mirror the CRDs you provided.
+              NOTE: Using apiextensionsv1.JSON avoids losing arbitrary structure during round-trips.
+            type: object
+            x-kubernetes-preserve-unknown-fields: true
+          status:
+            description: CommonStatus is a generic Status block with Kubernetes conditions.
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of an object's state.
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+              observedGeneration:
+                description: ObservedGeneration reflects the most recent generation
+                  observed by the controller.
+                format: int64
+                type: integer
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/packages/system/dashboard/images/openapi-ui-k8s-bff/Dockerfile b/packages/system/dashboard/images/openapi-ui-k8s-bff/Dockerfile
index ef698698..ea0c900d 100644
--- a/packages/system/dashboard/images/openapi-ui-k8s-bff/Dockerfile
+++ b/packages/system/dashboard/images/openapi-ui-k8s-bff/Dockerfile
@@ -1,9 +1,10 @@
-# imported from https://github.com/cozystack/openapi-ui-k8s-bff
+# imported from https://github.com/PRO-Robotech/openapi-ui-k8s-bff
 ARG NODE_VERSION=20.18.1
 FROM node:${NODE_VERSION}-alpine AS builder
 WORKDIR /src
 
-ARG COMMIT_REF=183dc9dcbb0f8a1833dad642c35faa385c71e58d
+# release/1.4.0
+ARG COMMIT_REF=92e4b618eb9ad17b19827b5a2b7ceab33e8cf534
 RUN wget -O- https://github.com/PRO-Robotech/openapi-ui-k8s-bff/archive/${COMMIT_REF}.tar.gz | tar xzf - --strip-components=1
 
 ENV PATH=/src/node_modules/.bin:$PATH
diff --git a/packages/system/dashboard/images/openapi-ui/Dockerfile b/packages/system/dashboard/images/openapi-ui/Dockerfile
index f430f8e6..4b80c960 100644
--- a/packages/system/dashboard/images/openapi-ui/Dockerfile
+++ b/packages/system/dashboard/images/openapi-ui/Dockerfile
@@ -1,12 +1,13 @@
 ARG NODE_VERSION=20.18.1
 
 # openapi-k8s-toolkit
-# imported from https://github.com/cozystack/openapi-k8s-toolkit
+# imported from https://github.com/PRO-Robotech/openapi-k8s-toolkit
 FROM node:${NODE_VERSION}-alpine AS openapi-k8s-toolkit-builder
 RUN apk add git
 WORKDIR /src
-ARG COMMIT=cb2f122caafaa2fd5455750213d9e633017ec555
-RUN wget -O- https://github.com/cozystack/openapi-k8s-toolkit/archive/${COMMIT}.tar.gz | tar -xzvf- --strip-components=1
+# release/1.4.0
+ARG COMMIT=c67029cc7b7495c65ee0406033576e773a73bb01
+RUN wget -O- https://github.com/PRO-Robotech/openapi-k8s-toolkit/archive/${COMMIT}.tar.gz | tar -xzvf- --strip-components=1
 
 COPY openapi-k8s-toolkit/patches /patches
 RUN git apply /patches/*.diff
@@ -17,12 +18,13 @@ RUN npm run build
 
 
 # openapi-ui
-# imported from https://github.com/cozystack/openapi-ui
+# imported from https://github.com/PRO-Robotech/openapi-ui
 FROM node:${NODE_VERSION}-alpine AS builder
 #RUN apk add git
 WORKDIR /src
 
-ARG COMMIT_REF=3cfbbf2156b6a5e4a1f283a032019530c0c2d37d
+# release/1.4.0
+ARG COMMIT_REF=6addca6939264ef2e39801baa88c1460cc1aa53e
 RUN wget -O- https://github.com/PRO-Robotech/openapi-ui/archive/${COMMIT_REF}.tar.gz | tar xzf - --strip-components=1
 
 #COPY openapi-ui/patches /patches
@@ -56,5 +58,12 @@ COPY --from=builder2 /src/node_modules /app/node_modules
 COPY --from=builder2 /src/build /app/build
 EXPOSE 8080
 RUN sed -i -e 's|OpenAPI UI|Cozystack|g' build/index.html
+# Fix Factory component: return null while loading instead of showing "Factory Not Found" 404
+RUN APP_JS=$(find build -name "App-react.js" -type f | head -1) && \
+    if [ -n "$APP_JS" ]; then \
+      sed -i 's|const { data: factoryData } = useK8sSmartResource({|const { data: factoryData, isLoading: factoryIsLoading } = useK8sSmartResource({|' "$APP_JS" && \
+      sed -i '/Factory Not Found/s/return /return factoryIsLoading ? null : /' "$APP_JS" && \
+      echo "Factory loading patch applied to $APP_JS"; \
+    fi
 USER 1001
 CMD ["node", "/app/build/index.js"]
diff --git a/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-dynamic-key.diff b/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-dynamic-key.diff
deleted file mode 100644
index 03212014..00000000
--- a/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-dynamic-key.diff
+++ /dev/null
@@ -1,90 +0,0 @@
-diff --git a/src/components/molecules/EnrichedTable/organisms/EnrichedTableProvider/utils.ts b/src/components/molecules/EnrichedTable/organisms/EnrichedTableProvider/utils.ts
-index 87a0f12..fb2e1cc 100644
---- a/src/components/molecules/EnrichedTable/organisms/EnrichedTableProvider/utils.ts
-+++ b/src/components/molecules/EnrichedTable/organisms/EnrichedTableProvider/utils.ts
-@@ -134,22 +134,6 @@ export const prepare = ({
-       // impossible in k8s
-       return {}
-     })
--    if (customFields.length > 0) {
--      dataSource = dataSource.map((el: TJSON) => {
--        const newFieldsForComplexJsonPath: Record<string, TJSON> = {}
--        customFields.forEach(({ dataIndex, jsonPath }) => {
--          const jpQueryResult = jp.query(el, `$${jsonPath}`)
--          newFieldsForComplexJsonPath[dataIndex] =
--            Array.isArray(jpQueryResult) && jpQueryResult.length === 1 ? jpQueryResult[0] : jpQueryResult
--        })
--        if (typeof el === 'object') {
--          return { ...el, ...newFieldsForComplexJsonPath }
--        }
--        // impossible in k8s
--        return { ...newFieldsForComplexJsonPath }
--      })
--    }
--
-     // Handle flatMap: expand rows for map objects
-     // Process all flatMap columns sequentially
-     if (flatMapColumns.length > 0 && dataSource) {
-@@ -204,6 +188,62 @@ export const prepare = ({
-         currentDataSource = expandedDataSource
-       })
-       dataSource = currentDataSource
-+    }
-+
-+    if (customFields.length > 0) {
-+      dataSource = dataSource.map((el: TJSON) => {
-+        const newFieldsForComplexJsonPath: Record<string, TJSON> = {}
-+        customFields.forEach(({ dataIndex, jsonPath }) => {
-+          let fieldValue: TJSON = null
-+          let handled = false
-+
-+          const flatMapMatch = jsonPath.match(/^(.*)\[(_flatMap[^\]]+_Key)\](.*)$/)
-+          if (flatMapMatch && el && typeof el === 'object' && !Array.isArray(el)) {
-+            const basePath = flatMapMatch[1]
-+            const keyField = flatMapMatch[2]
-+            const tailPath = flatMapMatch[3]
-+            const keyValue = (el as Record<string, unknown>)[keyField]
-+            if (keyValue !== null && keyValue !== undefined) {
-+              const baseResult = jp.query(el, `$${basePath}`)[0]
-+              if (baseResult && typeof baseResult === 'object' && !Array.isArray(baseResult)) {
-+                const baseValue = (baseResult as Record<string, unknown>)[String(keyValue)]
-+                if (tailPath) {
-+                  const normalizedTailPath =
-+                    tailPath.startsWith('.') || tailPath.startsWith('[') ? tailPath : `.${tailPath}`
-+                  const tailResult = jp.query(baseValue, `$${normalizedTailPath}`)
-+                  fieldValue = Array.isArray(tailResult) && tailResult.length === 1 ? tailResult[0] : tailResult
-+                } else {
-+                  fieldValue = baseValue as TJSON
-+                }
-+                handled = true
-+              }
-+            }
-+          }
-+
-+          if (!handled) {
-+            let resolvedJsonPath = jsonPath
-+            if (el && typeof el === 'object' && !Array.isArray(el)) {
-+              resolvedJsonPath = jsonPath.replace(/\[(_flatMap[^\]]+_Key)\]/g, (match, keyField) => {
-+                const keyValue = (el as Record<string, unknown>)[keyField]
-+                if (keyValue === null || keyValue === undefined) {
-+                  return match
-+                }
-+                const escaped = String(keyValue).replace(/'/g, "\\'")
-+                return `['${escaped}']`
-+              })
-+            }
-+            const jpQueryResult = jp.query(el, `$${resolvedJsonPath}`)
-+            fieldValue = Array.isArray(jpQueryResult) && jpQueryResult.length === 1 ? jpQueryResult[0] : jpQueryResult
-+          }
-+
-+          newFieldsForComplexJsonPath[dataIndex] = fieldValue
-+        })
-+        if (typeof el === 'object') {
-+          return { ...el, ...newFieldsForComplexJsonPath }
-+        }
-+        // impossible in k8s
-+        return { ...newFieldsForComplexJsonPath }
-+      })
-     }
-   } else {
-     dataSource = dataItems.map((el: TJSON) => {
diff --git a/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/tenantmodules.diff b/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/tenantmodules.diff
index 2817a8e0..d028f09a 100644
--- a/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/tenantmodules.diff
+++ b/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/tenantmodules.diff
@@ -33,18 +33,18 @@ index 8bcef4d..2551e92 100644
                    if (key === 'edit') {
 +                    // Special case: redirect tenantmodules from core.cozystack.io to apps.cozystack.io with plural form
 +                    let apiGroupAndVersion = value.apiGroupAndVersion
-+                    let typeName = value.typeName
-+                    if (apiGroupAndVersion?.startsWith('core.cozystack.io/') && typeName === 'tenantmodules') {
++                    let plural = value.plural
++                    if (apiGroupAndVersion?.startsWith('core.cozystack.io/') && plural === 'tenantmodules') {
 +                      const appsApiVersion = apiGroupAndVersion.replace('core.cozystack.io/', 'apps.cozystack.io/')
-+                      const pluralTypeName = getPluralForm(value.entryName)
++                      const pluralName = getPluralForm(value.name)
 +                      apiGroupAndVersion = appsApiVersion
-+                      typeName = pluralTypeName
++                      plural = pluralName
 +                    }
                      navigate(
                        `${baseprefix}/${value.cluster}${value.namespace ? `/${value.namespace}` : ''}${
                          value.syntheticProject ? `/${value.syntheticProject}` : ''
--                      }/${value.pathPrefix}/${value.apiGroupAndVersion}/${value.typeName}/${value.entryName}?backlink=${
-+                      }/${value.pathPrefix}/${apiGroupAndVersion}/${typeName}/${value.entryName}?backlink=${
+-                      }/${value.pathPrefix}/${value.apiGroupAndVersion}/${value.plural}/${value.name}?backlink=${
++                      }/${value.pathPrefix}/${apiGroupAndVersion}/${plural}/${value.name}?backlink=${
                          value.backlink
                        }`,
                      )
diff --git a/packages/system/dashboard/templates/ingress.yaml b/packages/system/dashboard/templates/ingress.yaml
index aacc1bc1..b3079a72 100644
--- a/packages/system/dashboard/templates/ingress.yaml
+++ b/packages/system/dashboard/templates/ingress.yaml
@@ -18,6 +18,8 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-body-size: 100m
     nginx.ingress.kubernetes.io/proxy-buffer-size: 100m
     nginx.ingress.kubernetes.io/proxy-buffers-number: "4"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "86400"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "86400"
   name: dashboard-web-ingress
 spec:
   ingressClassName: {{ $exposeIngress }}
diff --git a/packages/system/dashboard/templates/nginx-config.yaml b/packages/system/dashboard/templates/nginx-config.yaml
index 696e9ce9..989f1470 100644
--- a/packages/system/dashboard/templates/nginx-config.yaml
+++ b/packages/system/dashboard/templates/nginx-config.yaml
@@ -32,6 +32,19 @@ data:
           proxy_pass http://incloud-web-nginx.{{ .Release.Namespace }}.svc:8080;
       }
 
+      location /k8s/clusters/default/ {
+          proxy_http_version 1.1;
+          proxy_set_header Upgrade $http_upgrade;
+          proxy_set_header Connection $connection_upgrade;
+          proxy_set_header X-Forwarded-Proto $scheme;
+          proxy_set_header Host $host;
+          proxy_read_timeout 86400s;
+          proxy_send_timeout 86400s;
+
+          rewrite /k8s/clusters/default/(.*) /$1  break;
+          proxy_pass https://kubernetes.default.svc:443;
+      }
+
       location /k8s {
           proxy_http_version 1.1;
           proxy_set_header Upgrade $http_upgrade;
@@ -40,7 +53,7 @@ data:
           proxy_set_header Host $host;
           proxy_read_timeout 86400s;
           proxy_send_timeout 86400s;
-          
+
           rewrite /k8s/(.*) /$1  break;
           proxy_pass https://kubernetes.default.svc:443;
       }
diff --git a/packages/system/dashboard/templates/web.yaml b/packages/system/dashboard/templates/web.yaml
index d1c789b6..defb087b 100644
--- a/packages/system/dashboard/templates/web.yaml
+++ b/packages/system/dashboard/templates/web.yaml
@@ -45,6 +45,24 @@ spec:
               value: v1alpha1
             - name: BASE_NAMESPACE_FULL_PATH
               value: "/apis/core.cozystack.io/v1alpha1/tenantnamespaces"
+            - name: BASE_NAVIGATION_RESOURCE_PLURAL
+              value: navigations
+            - name: BASE_NAVIGATION_RESOURCE_NAME
+              value: navigation
+            - name: BASE_FRONTEND_PREFIX
+              value: /openapi-ui
+            - name: BASE_FACTORY_NAMESPACED_API_KEY
+              value: base-factory-namespaced-api
+            - name: BASE_FACTORY_CLUSTERSCOPED_API_KEY
+              value: base-factory-clusterscoped-api
+            - name: BASE_FACTORY_NAMESPACED_BUILTIN_KEY
+              value: base-factory-namespaced-builtin
+            - name: BASE_FACTORY_CLUSTERSCOPED_BUILTIN_KEY
+              value: base-factory-clusterscoped-builtin
+            - name: BASE_NAMESPACE_FACTORY_KEY
+              value: base-factory-clusterscoped-builtin
+            - name: BASE_ALLOWED_AUTH_HEADERS
+              value: user-agent,accept,content-type,origin,referer,accept-encoding,cookie,authorization
             - name: LOGGER
               value: "true"
             - name: LOGGER_WITH_HEADERS
@@ -73,7 +91,7 @@ spec:
           name: bff
           ports:
             - containerPort: 64231
-              name: http
+              name: http-bff
               protocol: TCP
           resources:
             limits:
@@ -98,7 +116,6 @@ spec:
               type: RuntimeDefault
           terminationMessagePath: /dev/termination-log
           terminationMessagePolicy: File
-          volumeMounts: null
         - env:
             - name: BASEPREFIX
               value: /openapi-ui
@@ -108,40 +125,60 @@ spec:
               value: dashboard.cozystack.io
             - name: CUSTOMIZATION_API_VERSION
               value: v1alpha1
-            - name: CUSTOMIZATION_NAVIGATION_RESOURCE
-              value: navigation
+            - name: CUSTOMIZATION_CFOMAPPING_RESOURCE_NAME
+              value: cfomapping
+            - name: CUSTOMIZATION_CFOMAPPING_RESOURCE_PLURAL
+              value: cfomappings
+            - name: CUSTOMIZATION_CFO_FALLBACK_ID
+              value: ""
             - name: CUSTOMIZATION_NAVIGATION_RESOURCE_NAME
+              value: navigation
+            - name: CUSTOMIZATION_NAVIGATION_RESOURCE_PLURAL
               value: navigations
+            - name: CUSTOMIZATION_SIDEBAR_FALLBACK_ID
+              value: stock-project-api-table
+            - name: CUSTOMIZATION_BREADCRUMBS_FALLBACK_ID
+              value: stock-project-api-table
             - name: INSTANCES_API_GROUP
               value: dashboard.cozystack.io
-            - name: INSTANCES_RESOURCE_NAME
-              value: instances
-            - name: INSTANCES_VERSION
+            - name: INSTANCES_API_VERSION
               value: v1alpha1
-            - name: MARKETPLACE_GROUP
-              value: dashboard.cozystack.io
+            - name: INSTANCES_PLURAL
+              value: instances
             - name: MARKETPLACE_KIND
               value: MarketplacePanel
-            - name: MARKETPLACE_RESOURCE_NAME
+            - name: MARKETPLACE_PLURAL
               value: marketplacepanels
-            - name: MARKETPLACE_VERSION
-              value: v1alpha1
             - name: NAVIGATE_FROM_CLUSTERLIST
               value: /openapi-ui/~recordValue~/api-table/core.cozystack.io/v1alpha1/tenantnamespaces
             - name: PROJECTS_API_GROUP
               value: core.cozystack.io
-            - name: PROJECTS_RESOURCE_NAME
-              value: tenantnamespaces
-            - name: PROJECTS_VERSION
+            - name: PROJECTS_API_VERSION
               value: v1alpha1
+            - name: PROJECTS_PLURAL
+              value: tenantnamespaces
             - name: CUSTOM_NAMESPACE_API_RESOURCE_API_GROUP
               value: core.cozystack.io
             - name: CUSTOM_NAMESPACE_API_RESOURCE_API_VERSION
               value: v1alpha1
-            - name: CUSTOM_NAMESPACE_API_RESOURCE_RESOURCE_NAME
+            - name: CUSTOM_NAMESPACE_API_RESOURCE_PLURAL
               value: tenantnamespaces
+            - name: BASE_FACTORY_NAMESPACED_API_KEY
+              value: base-factory-namespaced-api
+            - name: BASE_FACTORY_CLUSTERSCOPED_API_KEY
+              value: base-factory-clusterscoped-api
+            - name: BASE_FACTORY_NAMESPACED_BUILTIN_KEY
+              value: base-factory-namespaced-builtin
+            - name: BASE_FACTORY_CLUSTERSCOPED_BUILTIN_KEY
+              value: base-factory-clusterscoped-builtin
+            - name: BASE_NAMESPACE_FACTORY_KEY
+              value: base-factory-clusterscoped-builtin
             - name: USE_NAMESPACE_NAV
               value: "true"
+            - name: USE_NEW_NAVIGATION
+              value: "true"
+            - name: HIDE_NAVIGATION
+              value: "true"
             - name: LOGIN_URL
               value: "/oauth2/userinfo"
             - name: LOGOUT_URL
@@ -225,17 +262,13 @@ spec:
               type: RuntimeDefault
           terminationMessagePath: /dev/termination-log
           terminationMessagePolicy: File
-          volumeMounts: null
       dnsPolicy: ClusterFirst
       enableServiceLinks: false
       hostIPC: false
       hostNetwork: false
       hostPID: false
-      preemptionPolicy: null
       priorityClassName: system-cluster-critical
       restartPolicy: Always
-      runtimeClassName: null
       schedulerName: default-scheduler
       serviceAccountName: incloud-web-web
       terminationGracePeriodSeconds: 30
-      volumes: null

From 8e8bea039f79f5b15d7358a74111df23225eb502 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Sun, 15 Feb 2026 21:34:19 +0100
Subject: [PATCH 047/666] feat(vpc): migrate subnets definition from map to
 array format
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change VPC subnets from map[string]Subnet to []Subnet with explicit
name field, aligning with the vm-instance subnet format.

Map format:  subnets: {mysubnet: {cidr: "x"}}
Array format: subnets: [{name: mysubnet, cidr: "x"}]

Subnet ID generation (sha256 of namespace/vpcId/subnetName) remains
unchanged — subnetName now comes from .name field instead of map key.
ConfigMap output format stays the same.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/apps/vpc/templates/vpc.yaml             | 16 ++++++++--------
 packages/apps/vpc/values.schema.json             | 13 ++++++++++---
 packages/apps/vpc/values.yaml                    |  9 +++++----
 .../cozyrds/virtualprivatecloud.yaml             |  2 +-
 4 files changed, 24 insertions(+), 16 deletions(-)

diff --git a/packages/apps/vpc/templates/vpc.yaml b/packages/apps/vpc/templates/vpc.yaml
index eb113b4f..6c0d2249 100644
--- a/packages/apps/vpc/templates/vpc.yaml
+++ b/packages/apps/vpc/templates/vpc.yaml
@@ -16,8 +16,8 @@ spec:
   namespaces:
     - {{ .Release.Namespace }}
 
-{{- range $subnetName, $subnetConfig := .Values.subnets  }}
-{{- $subnetId := print "subnet-" (print $.Release.Namespace "/" $vpcId "/" $subnetName | sha256sum | trunc 8) }}
+{{- range .Values.subnets }}
+{{- $subnetId := print "subnet-" (print $.Release.Namespace "/" $vpcId "/" .name | sha256sum | trunc 8) }}
 ---
 apiVersion: k8s.cni.cncf.io/v1
 kind: NetworkAttachmentDefinition
@@ -25,7 +25,7 @@ metadata:
   name: {{ $subnetId }}
   namespace: {{ $.Release.Namespace }}
   labels:
-    cozystack.io/subnetName: {{ $subnetName }}
+    cozystack.io/subnetName: {{ .name }}
     cozystack.io/vpcId: {{ $vpcId }}
     cozystack.io/vpcName: {{ $.Release.Name }}
     cozystack.io/tenantName: {{ $.Release.Namespace }}
@@ -42,13 +42,13 @@ kind: Subnet
 metadata:
   name: {{ $subnetId }}
   labels:
-    cozystack.io/subnetName: {{ $subnetName }}
+    cozystack.io/subnetName: {{ .name }}
     cozystack.io/vpcId: {{ $vpcId }}
     cozystack.io/vpcName: {{ $.Release.Name }}
     cozystack.io/tenantName: {{ $.Release.Namespace }}
 spec:
   vpc: {{ $vpcId  }}
-  cidrBlock: {{ $subnetConfig.cidr }}
+  cidrBlock: {{ .cidr }}
   provider: "{{ $subnetId }}.{{ $.Release.Namespace }}.ovn"
   protocol: IPv4
   enableLb: false
@@ -66,9 +66,9 @@ metadata:
     cozystack.io/vpcId: {{ $vpcId }}
     cozystack.io/tenantName: {{ $.Release.Namespace }}
 data:
-  {{- range $subnetName, $subnetConfig := .Values.subnets }}
-  {{ $subnetName }}.ID: {{ print "subnet-" (print $.Release.Namespace "/" $vpcId "/" $subnetName | sha256sum | trunc 8) }}
-  {{ $subnetName }}.CIDR: {{ $subnetConfig.cidr }}
+  {{- range .Values.subnets }}
+  {{ .name }}.ID: {{ print "subnet-" (print $.Release.Namespace "/" $vpcId "/" .name | sha256sum | trunc 8) }}
+  {{ .name }}.CIDR: {{ .cidr }}
   {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
diff --git a/packages/apps/vpc/values.schema.json b/packages/apps/vpc/values.schema.json
index 3e888de4..a975d2d7 100644
--- a/packages/apps/vpc/values.schema.json
+++ b/packages/apps/vpc/values.schema.json
@@ -4,14 +4,21 @@
   "properties": {
     "subnets": {
       "description": "Subnets of a VPC",
-      "type": "object",
-      "default": {},
-      "additionalProperties": {
+      "type": "array",
+      "default": [],
+      "items": {
         "type": "object",
+        "required": [
+          "name"
+        ],
         "properties": {
           "cidr": {
             "description": "IP address range",
             "type": "string"
+          },
+          "name": {
+            "description": "Subnet name",
+            "type": "string"
           }
         }
       }
diff --git a/packages/apps/vpc/values.yaml b/packages/apps/vpc/values.yaml
index e2bd5faa..3af8b26b 100644
--- a/packages/apps/vpc/values.yaml
+++ b/packages/apps/vpc/values.yaml
@@ -3,13 +3,14 @@
 ##
 
 ## @typedef {struct} Subnet - Subnet of a VPC
+## @field {string} name - Subnet name
 ## @field {string} [cidr] - IP address range
 
-## @param {map[string]Subnet} subnets - Subnets of a VPC
-subnets: {}
+## @param {[]Subnet} subnets - Subnets of a VPC
+subnets: []
 ## Example:
 ## subnets:
-##   mysubnet0:
+##   - name: mysubnet0
 ##     cidr: "172.16.0.0/24"
-##   mysubnet1:
+##   - name: mysubnet1
 ##     cidr: "172.16.1.0/24"
diff --git a/packages/system/virtualprivatecloud-rd/cozyrds/virtualprivatecloud.yaml b/packages/system/virtualprivatecloud-rd/cozyrds/virtualprivatecloud.yaml
index 3f53f984..d5694a2c 100644
--- a/packages/system/virtualprivatecloud-rd/cozyrds/virtualprivatecloud.yaml
+++ b/packages/system/virtualprivatecloud-rd/cozyrds/virtualprivatecloud.yaml
@@ -8,7 +8,7 @@ spec:
     plural: virtualprivateclouds
     singular: virtualprivatecloud
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"subnets":{"description":"Subnets of a VPC","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"cidr":{"description":"IP address range","type":"string"}}}}}}
+      {"title":"Chart Values","type":"object","properties":{"subnets":{"description":"Subnets of a VPC","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"cidr":{"description":"IP address range","type":"string"},"name":{"description":"Subnet name","type":"string"}}}}}}
   release:
     prefix: "virtualprivatecloud-"
     labels:

From 9031de05380be6b1560dae57c8c2e79441f50c33 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Sun, 15 Feb 2026 21:34:26 +0100
Subject: [PATCH 048/666] feat(platform): add migration 30 for VPC subnets
 map-to-array conversion

Add migration script that converts VPC HelmRelease values from map
format to array format. The script discovers all VirtualPrivateCloud
HelmReleases, reads their values Secrets, and converts subnets using
yq. Idempotent: skips if subnets are already an array or null.

Bumps migration targetVersion from 30 to 31.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../platform/images/migrations/migrations/30  | 116 ++++++++++++++++++
 packages/core/platform/values.yaml            |   2 +-
 2 files changed, 117 insertions(+), 1 deletion(-)
 create mode 100755 packages/core/platform/images/migrations/migrations/30

diff --git a/packages/core/platform/images/migrations/migrations/30 b/packages/core/platform/images/migrations/migrations/30
new file mode 100755
index 00000000..64b89305
--- /dev/null
+++ b/packages/core/platform/images/migrations/migrations/30
@@ -0,0 +1,116 @@
+#!/bin/bash
+# Migration 30 --> 31
+# Convert VPC subnets from map format to array format in HelmRelease values.
+# Map format:  subnets: {name: {cidr: x}}
+# Array format: subnets: [{name: name, cidr: x}]
+# Idempotent: skips if subnets is already an array or empty/null.
+
+set -euo pipefail
+
+# ============================================================
+# STEP 1: Discover all VirtualPrivateCloud HelmReleases
+# ============================================================
+echo "=== Discovering VirtualPrivateCloud HelmReleases ==="
+INSTANCES=()
+while IFS=/ read -r ns name; do
+  [ -z "$ns" ] && continue
+  INSTANCES+=("${ns}/${name}")
+  echo "  Found: ${ns}/${name}"
+done < <(kubectl get hr -A -l "apps.cozystack.io/application.kind=VirtualPrivateCloud" \
+  -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}' 2>/dev/null)
+
+if [ ${#INSTANCES[@]} -eq 0 ]; then
+  echo "  No VirtualPrivateCloud HelmReleases found. Nothing to migrate."
+  kubectl create configmap -n cozy-system cozystack-version \
+    --from-literal=version=31 --dry-run=client -o yaml | kubectl apply -f-
+  exit 0
+fi
+echo "  Total: ${#INSTANCES[@]} instance(s)"
+
+# ============================================================
+# STEP 2: Migrate each instance
+# ============================================================
+for entry in "${INSTANCES[@]}"; do
+  NAMESPACE="${entry%%/*}"
+  HR_NAME="${entry#*/}"
+
+  echo ""
+  echo "======================================================================"
+  echo "=== Processing: ${HR_NAME} in ${NAMESPACE}"
+  echo "======================================================================"
+
+  # --- Find values Secret ---
+  VALUES_SECRET=$(kubectl -n "$NAMESPACE" get hr "$HR_NAME" -o json | \
+    jq -r '.spec.valuesFrom // [] | map(select(.kind == "Secret" and (.name | test("cozystack-values") | not))) | .[0].name // ""')
+  VALUES_KEY=$(kubectl -n "$NAMESPACE" get hr "$HR_NAME" -o json | \
+    jq -r '.spec.valuesFrom // [] | map(select(.kind == "Secret" and (.name | test("cozystack-values") | not))) | .[0].valuesKey // "values.yaml"')
+
+  if [ -z "$VALUES_SECRET" ]; then
+    echo "  [SKIP] No values Secret found for hr/${HR_NAME}"
+    continue
+  fi
+
+  if ! kubectl -n "$NAMESPACE" get secret "$VALUES_SECRET" --no-headers 2>/dev/null | grep -q .; then
+    echo "  [SKIP] Secret ${VALUES_SECRET} not found"
+    continue
+  fi
+
+  echo "  Reading values from secret: ${VALUES_SECRET} (key: ${VALUES_KEY})"
+
+  # --- Decode current values ---
+  VALUES_YAML=$(kubectl -n "$NAMESPACE" get secret "$VALUES_SECRET" \
+    -o jsonpath="{.data.${VALUES_KEY}}" 2>/dev/null | base64 -d 2>/dev/null || true)
+  if [ -z "$VALUES_YAML" ]; then
+    VALUES_YAML=$(kubectl -n "$NAMESPACE" get secret "$VALUES_SECRET" \
+      -o jsonpath="{.stringData.${VALUES_KEY}}" 2>/dev/null || true)
+  fi
+
+  if [ -z "$VALUES_YAML" ]; then
+    echo "  [SKIP] Could not read values from secret"
+    continue
+  fi
+
+  # --- Check subnets type ---
+  SUBNETS_TYPE=$(echo "$VALUES_YAML" | yq -r '.subnets | type')
+
+  case "$SUBNETS_TYPE" in
+    "!!map"|"object")
+      echo "  [CONVERT] subnets is a map, converting to array"
+      ;;
+    "!!seq"|"array")
+      echo "  [SKIP] subnets is already an array"
+      continue
+      ;;
+    "!!null"|"null")
+      echo "  [SKIP] subnets is null/empty"
+      continue
+      ;;
+    *)
+      echo "  [SKIP] subnets has unexpected type: ${SUBNETS_TYPE}"
+      continue
+      ;;
+  esac
+
+  # --- Convert map to array ---
+  # {name: {cidr: x}} -> [{name: name, cidr: x}]
+  NEW_VALUES=$(echo "$VALUES_YAML" | yq '
+    .subnets = ([.subnets | to_entries[] | {"name": .key} + .value])
+  ')
+
+  # --- Patch the Secret ---
+  NEW_VALUES_B64=$(echo "$NEW_VALUES" | base64)
+  echo "  [PATCH] Updating secret/${VALUES_SECRET}"
+  kubectl -n "$NAMESPACE" get secret "$VALUES_SECRET" -o json | \
+    jq --arg key "$VALUES_KEY" --arg val "$NEW_VALUES_B64" \
+      '.data[$key] = $val' | \
+    kubectl apply -f -
+
+  echo "  [OK] Converted subnets for ${HR_NAME}"
+done
+
+echo ""
+echo "=== Migration complete (${#INSTANCES[@]} instance(s)) ==="
+
+# Stamp version
+kubectl create configmap -n cozy-system cozystack-version \
+  --from-literal=version=31 --dry-run=client -o yaml | kubectl apply -f-
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index b90c001b..74758eb0 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -6,7 +6,7 @@ sourceRef:
 migrations:
   enabled: false
   image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0-beta.4@sha256:f404d05834907b9b2695bbb37732bd1ae2e79b03da77dc91bb3fbc0fbc53dcbf
-  targetVersion: 30
+  targetVersion: 31
 # Bundle deployment configuration
 bundles:
   system:

From cf505c580d26ceea10b53c2df76fd2b2357a0115 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Sun, 15 Feb 2026 22:50:24 +0100
Subject: [PATCH 049/666] Update kilo v0.8.0

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/system/kilo/values.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/system/kilo/values.yaml b/packages/system/kilo/values.yaml
index 762f3c26..e648e32e 100644
--- a/packages/system/kilo/values.yaml
+++ b/packages/system/kilo/values.yaml
@@ -1,7 +1,7 @@
 kilo:
   image:
     pullPolicy: IfNotPresent
-    tag: v0.7.1@sha256:c2160097ef3aa4e9e460430665b743a14b8f19480211edab6f946264718340ff
+    tag: v0.8.0@sha256:d673c46ba0ff762bc31491f53b81c7e5f59b6b58560eb258df7cf55e480ebdd4
     repository: ghcr.io/cozystack/cozystack/kilo
   podCIDR: 10.244.0.0/16
   serviceCIDR: 10.96.0.0/16

From ef040c2ed283ff38022727782fef0652b50b84e8 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Mon, 16 Feb 2026 15:16:38 +0100
Subject: [PATCH 050/666] feat(kilo): add Cilium compatibility variant

Add a new "cilium" variant to the kilo PackageSource that deploys kilo
with --compatibility=cilium flag. This enables Cilium-aware IPIP
encapsulation, routing outer packets through Cilium's VxLAN overlay
instead of the host network.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/core/platform/sources/kilo.yaml | 13 +++++++++++++
 packages/system/kilo/templates/kilo.yaml |  3 +++
 packages/system/kilo/values-cilium.yaml  |  2 ++
 packages/system/kilo/values.yaml         |  2 +-
 4 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100644 packages/system/kilo/values-cilium.yaml

diff --git a/packages/core/platform/sources/kilo.yaml b/packages/core/platform/sources/kilo.yaml
index 72602164..95770667 100644
--- a/packages/core/platform/sources/kilo.yaml
+++ b/packages/core/platform/sources/kilo.yaml
@@ -20,3 +20,16 @@ spec:
         privileged: true
         namespace: cozy-kilo
         releaseName: kilo
+  - name: cilium
+    dependsOn:
+    - cozystack.networking
+    components:
+    - name: kilo
+      path: system/kilo
+      valuesFiles:
+      - values.yaml
+      - values-cilium.yaml
+      install:
+        privileged: true
+        namespace: cozy-kilo
+        releaseName: kilo
diff --git a/packages/system/kilo/templates/kilo.yaml b/packages/system/kilo/templates/kilo.yaml
index e209aed2..fef7a718 100644
--- a/packages/system/kilo/templates/kilo.yaml
+++ b/packages/system/kilo/templates/kilo.yaml
@@ -29,6 +29,9 @@ spec:
         - --hostname=$(NODE_NAME)
         - --cni=false
         - --clean-up-interface={{ .Values.kilo.cleanUpInterface | default "false" }}
+        {{- with .Values.kilo.compatibility }}
+        - --compatibility={{ . }}
+        {{- end }}
         - --encapsulate=crosssubnet
         - --local=false
         - --mesh-granularity={{ .Values.kilo.meshGranularity | default "location" }}
diff --git a/packages/system/kilo/values-cilium.yaml b/packages/system/kilo/values-cilium.yaml
new file mode 100644
index 00000000..1a75fc41
--- /dev/null
+++ b/packages/system/kilo/values-cilium.yaml
@@ -0,0 +1,2 @@
+kilo:
+  compatibility: cilium
diff --git a/packages/system/kilo/values.yaml b/packages/system/kilo/values.yaml
index 762f3c26..4057c284 100644
--- a/packages/system/kilo/values.yaml
+++ b/packages/system/kilo/values.yaml
@@ -1,7 +1,7 @@
 kilo:
   image:
     pullPolicy: IfNotPresent
-    tag: v0.7.1@sha256:c2160097ef3aa4e9e460430665b743a14b8f19480211edab6f946264718340ff
+    tag: v0.8.1@sha256:56602fa796eccea0d0e005c29e5c7094ae46d15bd5306b02b829672b178dcd5c
     repository: ghcr.io/cozystack/cozystack/kilo
   podCIDR: 10.244.0.0/16
   serviceCIDR: 10.96.0.0/16

From 7ca6e5ce9e4ea49a73b28ae86ab46bc38dafd0fa Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 16 Feb 2026 18:47:04 +0300
Subject: [PATCH 051/666] feat(installer): add variant-aware templates for
 generic Kubernetes support

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 Makefile                                          |  5 +++--
 packages/core/installer/.helmignore               | 11 +++++++++++
 packages/core/installer/Makefile                  |  8 +++++++-
 .../installer/templates/cozystack-operator.yaml   | 15 +++------------
 .../core/installer/templates/packagesource.yaml   |  4 ++++
 packages/core/installer/values.yaml               | 10 ++++++++++
 6 files changed, 38 insertions(+), 15 deletions(-)
 create mode 100644 packages/core/installer/.helmignore

diff --git a/Makefile b/Makefile
index e6c50458..12554861 100644
--- a/Makefile
+++ b/Makefile
@@ -48,15 +48,16 @@ manifests:
 		> _out/assets/cozystack-operator-talos.yaml
 	# Generic Kubernetes variant (k3s, kubeadm, RKE2)
 	helm template installer packages/core/installer -n cozy-system \
+		--set cozystackOperator.variant=generic \
+		--set cozystack.apiServerHost=REPLACE_ME \
 		-s templates/cozystack-operator.yaml \
 		-s templates/packagesource.yaml \
-		--set cozystackOperator.variant=generic \
 		> _out/assets/cozystack-operator-generic.yaml
 	# Hosted variant (managed Kubernetes)
 	helm template installer packages/core/installer -n cozy-system \
+		--set cozystackOperator.variant=hosted \
 		-s templates/cozystack-operator.yaml \
 		-s templates/packagesource.yaml \
-		--set cozystackOperator.variant=hosted \
 		> _out/assets/cozystack-operator-hosted.yaml
 
 cozypkg:
diff --git a/packages/core/installer/.helmignore b/packages/core/installer/.helmignore
new file mode 100644
index 00000000..ba88ffe8
--- /dev/null
+++ b/packages/core/installer/.helmignore
@@ -0,0 +1,11 @@
+# VCS and IDE
+.git
+.gitignore
+
+# Build artifacts
+Makefile
+images/
+example/
+*.tgz
+
+# NOTE: definitions/ is intentionally NOT excluded — needed by crds.yaml via .Files.Glob
diff --git a/packages/core/installer/Makefile b/packages/core/installer/Makefile
index ad9982b5..7038bb9c 100644
--- a/packages/core/installer/Makefile
+++ b/packages/core/installer/Makefile
@@ -15,7 +15,7 @@ apply:
 diff:
 	cozyhr show --namespace $(NAMESPACE) $(NAME) --plain | kubectl diff -f -
 
-image: pre-checks image-operator image-packages
+image: pre-checks image-operator image-packages chart
 
 image-operator:
 	docker buildx build -f images/cozystack-operator/Dockerfile ../../.. \
@@ -43,3 +43,9 @@ image-packages:
 		test -n "$$DIGEST" && \
 		yq -i '.cozystackOperator.platformSourceUrl = strenv(REPO)' values.yaml && \
 		yq -i '.cozystackOperator.platformSourceRef = "digest=" + strenv(DIGEST)' values.yaml
+
+chart:
+	set -e; \
+	PKG=$$(helm package . --version $(COZYSTACK_VERSION) | awk '{print $$NF}'); \
+	trap 'rm -f "$$PKG"' EXIT; \
+	if [ "$(PUSH)" = "1" ]; then helm push "$$PKG" oci://$(REGISTRY); fi
diff --git a/packages/core/installer/templates/cozystack-operator.yaml b/packages/core/installer/templates/cozystack-operator.yaml
index 96ce9b87..4568e18b 100644
--- a/packages/core/installer/templates/cozystack-operator.yaml
+++ b/packages/core/installer/templates/cozystack-operator.yaml
@@ -72,20 +72,11 @@ spec:
           value: "7445"
         {{- else if eq .Values.cozystackOperator.variant "generic" }}
         env:
-        # Generic Kubernetes: read from ConfigMap
-        # Create cozystack-operator-config ConfigMap before applying this manifest
+        # Generic Kubernetes: API server endpoint
         - name: KUBERNETES_SERVICE_HOST
-          valueFrom:
-            configMapKeyRef:
-              name: cozystack-operator-config
-              key: KUBERNETES_SERVICE_HOST
-              optional: false
+          value: {{ required "cozystack.apiServerHost is required in generic mode" .Values.cozystack.apiServerHost | quote }}
         - name: KUBERNETES_SERVICE_PORT
-          valueFrom:
-            configMapKeyRef:
-              name: cozystack-operator-config
-              key: KUBERNETES_SERVICE_PORT
-              optional: false
+          value: {{ .Values.cozystack.apiServerPort | quote }}
         {{- else if eq .Values.cozystackOperator.variant "hosted" }}
         # Hosted: use in-cluster service account, no env override needed
         env: []
diff --git a/packages/core/installer/templates/packagesource.yaml b/packages/core/installer/templates/packagesource.yaml
index f4a5f6d0..65b1e4bf 100644
--- a/packages/core/installer/templates/packagesource.yaml
+++ b/packages/core/installer/templates/packagesource.yaml
@@ -1,3 +1,7 @@
+{{- $validVariants := list "talos" "generic" "hosted" -}}
+{{- if not (has .Values.cozystackOperator.variant $validVariants) -}}
+{{- fail (printf "Invalid cozystackOperator.variant %q: must be one of talos, generic, hosted" .Values.cozystackOperator.variant) -}}
+{{- end -}}
 ---
 apiVersion: cozystack.io/v1alpha1
 kind: PackageSource
diff --git a/packages/core/installer/values.yaml b/packages/core/installer/values.yaml
index 64ff817b..95633e8e 100644
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -4,3 +4,13 @@ cozystackOperator:
   image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.0.0-beta.4@sha256:322dd7358df369525f76e6e43512482e38caec5315d36a878399d2d60bf2f18d
   platformSourceUrl: 'oci://ghcr.io/cozystack/cozystack/cozystack-packages'
   platformSourceRef: 'digest=sha256:b88502242b535a31ab33c06ffc0a96d1c67230d2db2c5e873fa23f6523592ff6'
+
+# Generic variant configuration (only used when cozystackOperator.variant=generic)
+cozystack:
+  # Kubernetes API server host (IP only, no protocol/port)
+  # Must be the INTERNAL IP of the control-plane node
+  # (the IP visible on the node's network interface, not a public/NAT IP)
+  # Used by the operator and networking components (cilium, kube-ovn)
+  apiServerHost: ""
+  # Kubernetes API server port
+  apiServerPort: "6443"

From bae70596fc0e121afa31d5d9a8e35961e430cf17 Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Mon, 16 Feb 2026 16:01:30 +0000
Subject: [PATCH 052/666] Prepare release v1.0.0-beta.5

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 packages/core/installer/values.yaml                         | 5 ++---
 packages/core/platform/values.yaml                          | 2 +-
 packages/core/testing/values.yaml                           | 2 +-
 packages/extra/bootbox/images/matchbox.tag                  | 2 +-
 packages/extra/seaweedfs/images/objectstorage-sidecar.tag   | 2 +-
 packages/system/backup-controller/values.yaml               | 2 +-
 packages/system/backupstrategy-controller/values.yaml       | 2 +-
 packages/system/cozystack-api/values.yaml                   | 2 +-
 packages/system/cozystack-controller/values.yaml            | 2 +-
 packages/system/dashboard/templates/configmap.yaml          | 2 +-
 packages/system/dashboard/values.yaml                       | 6 +++---
 .../system/grafana-operator/images/grafana-dashboards.tag   | 2 +-
 packages/system/kamaji/values.yaml                          | 4 ++--
 packages/system/kubeovn-plunger/values.yaml                 | 2 +-
 packages/system/kubeovn-webhook/values.yaml                 | 2 +-
 packages/system/lineage-controller-webhook/values.yaml      | 2 +-
 packages/system/objectstorage-controller/values.yaml        | 2 +-
 packages/system/seaweedfs/values.yaml                       | 2 +-
 18 files changed, 22 insertions(+), 23 deletions(-)

diff --git a/packages/core/installer/values.yaml b/packages/core/installer/values.yaml
index 95633e8e..3dd0f1d6 100644
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -1,10 +1,9 @@
 cozystackOperator:
   # Deployment variant: talos, generic, hosted
   variant: talos
-  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.0.0-beta.4@sha256:322dd7358df369525f76e6e43512482e38caec5315d36a878399d2d60bf2f18d
+  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.0.0-beta.5@sha256:9f3089cb13b3e19dab14b8edc1220efde693f6066d3474c0137953e1873d16f3
   platformSourceUrl: 'oci://ghcr.io/cozystack/cozystack/cozystack-packages'
-  platformSourceRef: 'digest=sha256:b88502242b535a31ab33c06ffc0a96d1c67230d2db2c5e873fa23f6523592ff6'
-
+  platformSourceRef: 'digest=sha256:86daf23f7b2ff2f448b273153733c55ac2f57c2bbe72c779ff14865d71e623cb'
 # Generic variant configuration (only used when cozystackOperator.variant=generic)
 cozystack:
   # Kubernetes API server host (IP only, no protocol/port)
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index 74758eb0..ca2d9d1b 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -5,7 +5,7 @@ sourceRef:
   path: /
 migrations:
   enabled: false
-  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0-beta.4@sha256:f404d05834907b9b2695bbb37732bd1ae2e79b03da77dc91bb3fbc0fbc53dcbf
+  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0-beta.5@sha256:e7a9e0f0adc33e0be007af42f50ed3af064aa965ad628e48cc6c7943f31f239d
   targetVersion: 31
 # Bundle deployment configuration
 bundles:
diff --git a/packages/core/testing/values.yaml b/packages/core/testing/values.yaml
index 73481ab1..627d3096 100644
--- a/packages/core/testing/values.yaml
+++ b/packages/core/testing/values.yaml
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.0.0-beta.4@sha256:eac71ef0de3450fce96255629e77903630c63ade62b81e7055f1a689f92ee153
+  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.0.0-beta.5@sha256:eac71ef0de3450fce96255629e77903630c63ade62b81e7055f1a689f92ee153
diff --git a/packages/extra/bootbox/images/matchbox.tag b/packages/extra/bootbox/images/matchbox.tag
index 6c3054d5..19014ae6 100644
--- a/packages/extra/bootbox/images/matchbox.tag
+++ b/packages/extra/bootbox/images/matchbox.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/matchbox:v1.0.0-beta.4@sha256:cba9a2761c40ae6645e28da4cbc6d91eb86ddc886f4523cf20b3c0e40597d593
+ghcr.io/cozystack/cozystack/matchbox:v1.0.0-beta.5@sha256:8facb6bbbaf336ff3dd606d6bcbf65f5d1fb7f079bec09966544398632005b47
diff --git a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
index bd622108..9f5222a7 100644
--- a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
+++ b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-beta.4@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0
+ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-beta.5@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0
diff --git a/packages/system/backup-controller/values.yaml b/packages/system/backup-controller/values.yaml
index 1bdab88b..63c49ed1 100644
--- a/packages/system/backup-controller/values.yaml
+++ b/packages/system/backup-controller/values.yaml
@@ -1,5 +1,5 @@
 backupController:
-  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.0.0-beta.4@sha256:2dcd5347683ee88012b0e558b3a240dec9942230e9c673a359e0196f407a0833"
+  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.0.0-beta.5@sha256:c99ff8ab11c5c016841acd9dca72c7a643dba72a98b8f816ea67ba7fa3549f88"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/backupstrategy-controller/values.yaml b/packages/system/backupstrategy-controller/values.yaml
index 21d1a9f3..5ff8efd5 100644
--- a/packages/system/backupstrategy-controller/values.yaml
+++ b/packages/system/backupstrategy-controller/values.yaml
@@ -1,5 +1,5 @@
 backupStrategyController:
-  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.0.0-beta.4@sha256:c2c150918e5609f1d6663f56b6dcbdac47bee33154524230001fcd04165f4268"
+  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.0.0-beta.5@sha256:cd92a2620c9965512977b57c2829d931e7ecb7a8afc0693d7c8ab39bd8ff77d8"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/cozystack-api/values.yaml b/packages/system/cozystack-api/values.yaml
index d9041546..511d1f33 100644
--- a/packages/system/cozystack-api/values.yaml
+++ b/packages/system/cozystack-api/values.yaml
@@ -1,3 +1,3 @@
 cozystackAPI:
-  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.0.0-beta.4@sha256:42f8d8120f7fd3bfe37f114eedf5ca8df62ac69a0d922d91a2c392772f3b46ee
+  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.0.0-beta.5@sha256:b217c3d1cca7e35b9e6ee32297ebe923fee12ca48d94062484a9dfcffda0e2e3
   replicas: 2
diff --git a/packages/system/cozystack-controller/values.yaml b/packages/system/cozystack-controller/values.yaml
index 53ed1033..5ead5eae 100644
--- a/packages/system/cozystack-controller/values.yaml
+++ b/packages/system/cozystack-controller/values.yaml
@@ -1,4 +1,4 @@
 cozystackController:
-  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.0.0-beta.4@sha256:915d07ef61e1fc3bdf87e4bfc4b8ae3920e7e33d74082778c7735ba36a08cdef
+  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.0.0-beta.5@sha256:edeb1788395d650f5f14a935c8f6b95ede7ca548cba198c18c75cc5eafd89104
   debug: false
   disableTelemetry: false
diff --git a/packages/system/dashboard/templates/configmap.yaml b/packages/system/dashboard/templates/configmap.yaml
index 1c79b2cb..c32fc638 100644
--- a/packages/system/dashboard/templates/configmap.yaml
+++ b/packages/system/dashboard/templates/configmap.yaml
@@ -1,6 +1,6 @@
 {{- $brandingConfig := .Values._cluster.branding | default dict }}
 
-{{- $tenantText := "v1.0.0-beta.4" }}
+{{- $tenantText := "v1.0.0-beta.5" }}
 {{- $footerText := "Cozystack" }}
 {{- $titleText := "Cozystack Dashboard" }}
 {{- $logoText := "" }}
diff --git a/packages/system/dashboard/values.yaml b/packages/system/dashboard/values.yaml
index 0c898a91..a2f9c642 100644
--- a/packages/system/dashboard/values.yaml
+++ b/packages/system/dashboard/values.yaml
@@ -1,6 +1,6 @@
 openapiUI:
-  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.0.0-beta.4@sha256:adbd07c7bde083fbf3a2fb2625ec4adbe6718a0f6f643b2505cc0029c2c0f724
+  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.0.0-beta.5@sha256:0d331986ac06de1fa5b660d69670cba0f2a59fcdab6cf43cb136827ecb8fcfe8
 openapiUIK8sBff:
-  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.0.0-beta.4@sha256:1f7827a1978bd9c81ac924dd0e78f6a3ce834a9a64af55047e220812bc15a944
+  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.0.0-beta.5@sha256:1b3ea6d4c7dbbe6a8def3b2807fffdfab2ac4afc39d7a846e57dd491fa168f92
 tokenProxy:
-  image: ghcr.io/cozystack/cozystack/token-proxy:v1.0.0-beta.4@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
+  image: ghcr.io/cozystack/cozystack/token-proxy:v1.0.0-beta.5@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
diff --git a/packages/system/grafana-operator/images/grafana-dashboards.tag b/packages/system/grafana-operator/images/grafana-dashboards.tag
index cc81b24f..34111c9f 100644
--- a/packages/system/grafana-operator/images/grafana-dashboards.tag
+++ b/packages/system/grafana-operator/images/grafana-dashboards.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/grafana-dashboards:v1.0.0-beta.4@sha256:e866b5b3874b9d390b341183d2ee070e1387440c14cfe51af831695def6dc2ec
+ghcr.io/cozystack/cozystack/grafana-dashboards:v1.0.0-beta.5@sha256:e866b5b3874b9d390b341183d2ee070e1387440c14cfe51af831695def6dc2ec
diff --git a/packages/system/kamaji/values.yaml b/packages/system/kamaji/values.yaml
index 26e8bfcf..cbf71457 100644
--- a/packages/system/kamaji/values.yaml
+++ b/packages/system/kamaji/values.yaml
@@ -3,7 +3,7 @@ kamaji:
     deploy: false
   image:
     pullPolicy: IfNotPresent
-    tag: v1.0.0-beta.4@sha256:05f8e166dc94aadb74cd6448f6f96fbd2167057a559097516a41b8f53e434918
+    tag: v1.0.0-beta.5@sha256:05f8e166dc94aadb74cd6448f6f96fbd2167057a559097516a41b8f53e434918
     repository: ghcr.io/cozystack/cozystack/kamaji
   resources:
     limits:
@@ -13,4 +13,4 @@ kamaji:
       cpu: 100m
       memory: 100Mi
   extraArgs:
-    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.0.0-beta.4@sha256:05f8e166dc94aadb74cd6448f6f96fbd2167057a559097516a41b8f53e434918
+    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.0.0-beta.5@sha256:05f8e166dc94aadb74cd6448f6f96fbd2167057a559097516a41b8f53e434918
diff --git a/packages/system/kubeovn-plunger/values.yaml b/packages/system/kubeovn-plunger/values.yaml
index b325a7b7..0abcc7db 100644
--- a/packages/system/kubeovn-plunger/values.yaml
+++ b/packages/system/kubeovn-plunger/values.yaml
@@ -1,4 +1,4 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.0.0-beta.4@sha256:16b362d6fa1ca30c791ea5cfc7984e085b9ea76a24c9abb3b05dad5c8b64bd0e
+image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.0.0-beta.5@sha256:67d615f86c3230e8c643b6bd347093cdb1e575c99f7c63599fd43e0c4ffc249a
 ovnCentralName: ovn-central
diff --git a/packages/system/kubeovn-webhook/values.yaml b/packages/system/kubeovn-webhook/values.yaml
index d5d8ba93..26613989 100644
--- a/packages/system/kubeovn-webhook/values.yaml
+++ b/packages/system/kubeovn-webhook/values.yaml
@@ -1,3 +1,3 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.0.0-beta.4@sha256:e18f9fd679e38f65362a8d0042f25468272f6d081136ad47027168d8e7e07a4a
+image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.0.0-beta.5@sha256:e6334c29d3aaf0dea766c88e3e05b53ad623d1bb497b3c836e6f76adade45b29
diff --git a/packages/system/lineage-controller-webhook/values.yaml b/packages/system/lineage-controller-webhook/values.yaml
index 00e593eb..d5f28f89 100644
--- a/packages/system/lineage-controller-webhook/values.yaml
+++ b/packages/system/lineage-controller-webhook/values.yaml
@@ -1,5 +1,5 @@
 lineageControllerWebhook:
-  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.0.0-beta.4@sha256:e9054f9137fd73039b2d91a979f672c9258336f91e51440a77aaa09e6e0b5254
+  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.0.0-beta.5@sha256:9dd5411d222fe7d7b0583a8e6807bf7745eb1412bf180827c5f1957e6ebbfeb4
   debug: false
   localK8sAPIEndpoint:
     enabled: true
diff --git a/packages/system/objectstorage-controller/values.yaml b/packages/system/objectstorage-controller/values.yaml
index 18dda28f..b3c9d4c6 100644
--- a/packages/system/objectstorage-controller/values.yaml
+++ b/packages/system/objectstorage-controller/values.yaml
@@ -1,3 +1,3 @@
 objectstorage:
   controller:
-    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.0.0-beta.4@sha256:b4c972769afda76c48b58e7acf0ac66a0abf16a622f245c60338f432872f640a"
+    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.0.0-beta.5@sha256:b4c972769afda76c48b58e7acf0ac66a0abf16a622f245c60338f432872f640a"
diff --git a/packages/system/seaweedfs/values.yaml b/packages/system/seaweedfs/values.yaml
index 63199e28..94aba339 100644
--- a/packages/system/seaweedfs/values.yaml
+++ b/packages/system/seaweedfs/values.yaml
@@ -177,7 +177,7 @@ seaweedfs:
     bucketClassName: "seaweedfs"
     region: ""
     sidecar:
-      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-beta.4@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0"
+      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-beta.5@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0"
   certificates:
     commonName: "SeaweedFS CA"
     ipAddresses: []

From bfba9fb5e70fa2cb33f2ceae1d318ea5780a3f5e Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Mon, 16 Feb 2026 16:08:18 +0000
Subject: [PATCH 053/666] docs: add changelog for v1.0.0-beta.5

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.0.0-beta.5.md | 36 ++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 docs/changelogs/v1.0.0-beta.5.md

diff --git a/docs/changelogs/v1.0.0-beta.5.md b/docs/changelogs/v1.0.0-beta.5.md
new file mode 100644
index 00000000..b8bc306c
--- /dev/null
+++ b/docs/changelogs/v1.0.0-beta.5.md
@@ -0,0 +1,36 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.0.0-beta.5
+-->
+
+> **⚠️ Beta Release Warning**: This is a pre-release version intended for testing and early adoption. Breaking changes may occur before the stable v1.0.0 release.
+
+## Features and Improvements
+
+* **[installer] Add variant-aware templates for generic Kubernetes support**: Extended the installer chart to support generic and hosted Kubernetes deployments via the existing `cozystackOperator.variant` parameter. When using `variant=generic`, the installer now renders separate templates for the Cozystack operator, skipping Talos-specific components. This enables users to deploy Cozystack on standard Kubernetes distributions and hosted Kubernetes services, expanding platform compatibility beyond Talos Linux ([**@lexfrei**](https://github.com/lexfrei) in #2010).
+
+* **[kilo] Add Cilium compatibility variant**: Added a new `cilium` variant to the kilo PackageSource that deploys kilo with the `--compatibility=cilium` flag. This enables Cilium-aware IPIP encapsulation where the outer packet IP matches the inner packet source, allowing Cilium's network policies to function correctly with kilo's WireGuard mesh networking. Users can now run kilo alongside Cilium CNI while maintaining full network policy enforcement capabilities ([**@kvaps**](https://github.com/kvaps) in #2055).
+
+* **[cluster-autoscaler] Enable enforce-node-group-min-size by default**: Enabled the `enforce-node-group-min-size` option for the system cluster-autoscaler chart. This ensures node groups are always scaled up to their configured minimum size, even when current workload demands are lower, preventing unexpected scale-down below minimum thresholds and improving cluster stability for production workloads ([**@kvaps**](https://github.com/kvaps) in #2050).
+
+* **[dashboard] Upgrade dashboard to version 1.4.0**: Updated the Cozystack dashboard to version 1.4.0 with new features and improvements for better user experience and cluster management capabilities ([**@sircthulhu**](https://github.com/sircthulhu) in #2051).
+
+## Breaking Changes & Upgrade Notes
+
+* **[vpc] Migrate subnets definition from map to array format**: Migrated VPC subnets definition from map format (`map[string]Subnet`) to array format (`[]Subnet`) with an explicit `name` field. This aligns VPC subnet definitions with the vm-instance `networks` field pattern and provides more intuitive configuration. Existing VPC deployments are automatically migrated via migration 30, which converts the subnet map to an array while preserving all existing subnet configurations and network connectivity ([**@kvaps**](https://github.com/kvaps) in #2052).
+
+## Dependencies
+
+* **[kilo] Update to v0.8.0**: Updated Kilo WireGuard mesh networking to v0.8.0 with performance improvements, bug fixes, and new compatibility features ([**@kvaps**](https://github.com/kvaps) in #2053).
+
+* **[talm] Skip config loading for __complete command**: Fixed CLI completion behavior by skipping config loading for the `__complete` command, preventing errors during shell completion when configuration files are not available or misconfigured ([**@kitsunoff**](https://github.com/kitsunoff) in cozystack/talm#109).
+
+## Contributors
+
+We'd like to thank all contributors who made this release possible:
+
+* [**@kitsunoff**](https://github.com/kitsunoff)
+* [**@kvaps**](https://github.com/kvaps)
+* [**@lexfrei**](https://github.com/lexfrei)
+* [**@sircthulhu**](https://github.com/sircthulhu)
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.0-beta.4...v1.0.0-beta.5

From 73b8946a7e2c398f22bb02342788ee6cf64831e6 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 16 Feb 2026 23:01:22 +0300
Subject: [PATCH 054/666] chore(codegen): regenerate stale deepcopy and CRD
 definitions

Run make generate to bring generated files up to date with current
API types. This was pre-existing staleness unrelated to any code change.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../v1alpha1/zz_generated.deepcopy.go         | 118 +++++++++---------
 .../backups.cozystack.io_backupclasses.yaml   |   2 +-
 2 files changed, 60 insertions(+), 60 deletions(-)

diff --git a/api/dashboard/v1alpha1/zz_generated.deepcopy.go b/api/dashboard/v1alpha1/zz_generated.deepcopy.go
index 568a1780..25d97a79 100644
--- a/api/dashboard/v1alpha1/zz_generated.deepcopy.go
+++ b/api/dashboard/v1alpha1/zz_generated.deepcopy.go
@@ -159,6 +159,65 @@ func (in *BreadcrumbList) DeepCopyObject() runtime.Object {
 	return nil
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CFOMapping) DeepCopyInto(out *CFOMapping) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CFOMapping.
+func (in *CFOMapping) DeepCopy() *CFOMapping {
+	if in == nil {
+		return nil
+	}
+	out := new(CFOMapping)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *CFOMapping) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CFOMappingList) DeepCopyInto(out *CFOMappingList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]CFOMapping, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CFOMappingList.
+func (in *CFOMappingList) DeepCopy() *CFOMappingList {
+	if in == nil {
+		return nil
+	}
+	out := new(CFOMappingList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *CFOMappingList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CommonStatus) DeepCopyInto(out *CommonStatus) {
 	*out = *in
@@ -417,65 +476,6 @@ func (in *FactoryList) DeepCopyObject() runtime.Object {
 	return nil
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CFOMapping) DeepCopyInto(out *CFOMapping) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CFOMapping.
-func (in *CFOMapping) DeepCopy() *CFOMapping {
-	if in == nil {
-		return nil
-	}
-	out := new(CFOMapping)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *CFOMapping) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CFOMappingList) DeepCopyInto(out *CFOMappingList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]CFOMapping, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CFOMappingList.
-func (in *CFOMappingList) DeepCopy() *CFOMappingList {
-	if in == nil {
-		return nil
-	}
-	out := new(CFOMappingList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *CFOMappingList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *MarketplacePanel) DeepCopyInto(out *MarketplacePanel) {
 	*out = *in
diff --git a/packages/system/backup-controller/definitions/backups.cozystack.io_backupclasses.yaml b/packages/system/backup-controller/definitions/backups.cozystack.io_backupclasses.yaml
index b0f0fec2..4af8cf7d 100644
--- a/packages/system/backup-controller/definitions/backups.cozystack.io_backupclasses.yaml
+++ b/packages/system/backup-controller/definitions/backups.cozystack.io_backupclasses.yaml
@@ -60,7 +60,7 @@ spec:
                           type: string
                         kind:
                           description: Kind is the kind of the application (e.g.,
-                            VirtualMachine, MySQL).
+                            VirtualMachine, MariaDB).
                           type: string
                       required:
                       - kind

From 75e25fa9779b36bbd219f9318d072c6c525a0d1f Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 16 Feb 2026 23:01:38 +0300
Subject: [PATCH 055/666] fix(codegen): add gen_client to update-codegen.sh and
 regenerate applyconfiguration

The applyconfiguration code referenced testing.TypeConverter from
k8s.io/client-go/testing, which was removed in client-go v0.34.1.

Root cause: hack/update-codegen.sh called gen_helpers and gen_openapi
but not gen_client, so applyconfiguration was never regenerated after
the client-go upgrade.

Changes:
- Fix THIS_PKG from sample-apiserver template leftover to correct
  module path
- Add kube::codegen::gen_client call with --with-applyconfig flag
- Regenerate applyconfiguration (now uses managedfields.TypeConverter)
- Add tests for ForKind and NewTypeConverter functions

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 go.mod                                        |   3 +-
 go.sum                                        |   5 -
 hack/update-codegen.sh                        |   9 +-
 .../apps/v1alpha1/application.go              |  42 ++++--
 .../apps/v1alpha1/applicationspec.go          |  48 -------
 .../apps/v1alpha1/applicationstatus.go        |  75 ++++++++++
 .../applyconfiguration/internal/internal.go   |   4 +-
 pkg/generated/applyconfiguration/utils.go     |  18 +--
 .../applyconfiguration/utils_test.go          |  64 +++++++++
 .../clientset/versioned/clientset.go          | 120 ++++++++++++++++
 .../versioned/fake/clientset_generated.go     | 131 ++++++++++++++++++
 pkg/generated/clientset/versioned/fake/doc.go |  20 +++
 .../clientset/versioned/fake/register.go      |  56 ++++++++
 .../clientset/versioned/scheme/doc.go         |  20 +++
 .../clientset/versioned/scheme/register.go    |  56 ++++++++
 .../typed/apps/v1alpha1/application.go        |  74 ++++++++++
 .../typed/apps/v1alpha1/apps_client.go        | 101 ++++++++++++++
 .../versioned/typed/apps/v1alpha1/doc.go      |  20 +++
 .../versioned/typed/apps/v1alpha1/fake/doc.go |  20 +++
 .../apps/v1alpha1/fake/fake_application.go    |  53 +++++++
 .../apps/v1alpha1/fake/fake_apps_client.go    |  40 ++++++
 .../apps/v1alpha1/generated_expansion.go      |  21 +++
 22 files changed, 925 insertions(+), 75 deletions(-)
 delete mode 100644 pkg/generated/applyconfiguration/apps/v1alpha1/applicationspec.go
 create mode 100644 pkg/generated/applyconfiguration/apps/v1alpha1/applicationstatus.go
 create mode 100644 pkg/generated/applyconfiguration/utils_test.go
 create mode 100644 pkg/generated/clientset/versioned/clientset.go
 create mode 100644 pkg/generated/clientset/versioned/fake/clientset_generated.go
 create mode 100644 pkg/generated/clientset/versioned/fake/doc.go
 create mode 100644 pkg/generated/clientset/versioned/fake/register.go
 create mode 100644 pkg/generated/clientset/versioned/scheme/doc.go
 create mode 100644 pkg/generated/clientset/versioned/scheme/register.go
 create mode 100644 pkg/generated/clientset/versioned/typed/apps/v1alpha1/application.go
 create mode 100644 pkg/generated/clientset/versioned/typed/apps/v1alpha1/apps_client.go
 create mode 100644 pkg/generated/clientset/versioned/typed/apps/v1alpha1/doc.go
 create mode 100644 pkg/generated/clientset/versioned/typed/apps/v1alpha1/fake/doc.go
 create mode 100644 pkg/generated/clientset/versioned/typed/apps/v1alpha1/fake/fake_application.go
 create mode 100644 pkg/generated/clientset/versioned/typed/apps/v1alpha1/fake/fake_apps_client.go
 create mode 100644 pkg/generated/clientset/versioned/typed/apps/v1alpha1/generated_expansion.go

diff --git a/go.mod b/go.mod
index 9944df16..3ecda336 100644
--- a/go.mod
+++ b/go.mod
@@ -29,7 +29,7 @@ require (
 	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b
 	k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d
 	sigs.k8s.io/controller-runtime v0.22.4
-	sigs.k8s.io/structured-merge-diff/v4 v4.7.0
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0
 )
 
 require (
@@ -125,7 +125,6 @@ require (
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
 
diff --git a/go.sum b/go.sum
index d2cbc779..0a69ac87 100644
--- a/go.sum
+++ b/go.sum
@@ -81,7 +81,6 @@ github.com/google/cel-go v0.26.0 h1:DPGjXackMpJWH680oGY4lZhYjIameYmR+/6RBdDGmaI=
 github.com/google/cel-go v0.26.0/go.mod h1:A9O8OU9rdvrK5MQyrqfIxo1a0u4g3sF8KB6PUIaryMM=
 github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
 github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -324,13 +323,9 @@ sigs.k8s.io/controller-runtime v0.22.4 h1:GEjV7KV3TY8e+tJ2LCTxUTanW4z/FmNB7l327U
 sigs.k8s.io/controller-runtime v0.22.4/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
-sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v4 v4.7.0 h1:qPeWmscJcXP0snki5IYF79Z8xrl8ETFxgMd7wez1XkI=
-sigs.k8s.io/structured-merge-diff/v4 v4.7.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
 sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
 sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh
index b97c2ade..293f229b 100755
--- a/hack/update-codegen.sh
+++ b/hack/update-codegen.sh
@@ -34,7 +34,7 @@ trap 'rm -rf ${TMPDIR}' EXIT
 
 source "${CODEGEN_PKG}/kube_codegen.sh"
 
-THIS_PKG="k8s.io/sample-apiserver"
+THIS_PKG="github.com/cozystack/cozystack"
 
 kube::codegen::gen_helpers \
     --boilerplate "${SCRIPT_ROOT}/hack/boilerplate.go.txt" \
@@ -60,6 +60,13 @@ kube::codegen::gen_openapi \
     --boilerplate "${SCRIPT_ROOT}/hack/boilerplate.go.txt" \
     "${SCRIPT_ROOT}/pkg/apis"
 
+kube::codegen::gen_client \
+    --with-applyconfig \
+    --output-dir "${SCRIPT_ROOT}/pkg/generated" \
+    --output-pkg "${THIS_PKG}/pkg/generated" \
+    --boilerplate "${SCRIPT_ROOT}/hack/boilerplate.go.txt" \
+    "${SCRIPT_ROOT}/pkg/apis"
+
 $CONTROLLER_GEN object:headerFile="hack/boilerplate.go.txt" paths="./api/..."
 $CONTROLLER_GEN rbac:roleName=manager-role crd paths="./api/..." output:crd:artifacts:config=${TMPDIR} 
 
diff --git a/pkg/generated/applyconfiguration/apps/v1alpha1/application.go b/pkg/generated/applyconfiguration/apps/v1alpha1/application.go
index 908e28fd..9c5e2ab5 100644
--- a/pkg/generated/applyconfiguration/apps/v1alpha1/application.go
+++ b/pkg/generated/applyconfiguration/apps/v1alpha1/application.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2024 The Cozystack Authors.
+Copyright 2025 The Cozystack Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -19,10 +19,10 @@ limitations under the License.
 package v1alpha1
 
 import (
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
-	appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
 )
 
 // ApplicationApplyConfiguration represents a declarative configuration of the Application type for use
@@ -30,8 +30,9 @@ import (
 type ApplicationApplyConfiguration struct {
 	v1.TypeMetaApplyConfiguration    `json:",inline"`
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	Spec                             *ApplicationSpecApplyConfiguration `json:"spec,omitempty"`
-	Status                           *appsv1alpha1.ApplicationStatus  `json:"status,omitempty"`
+	AppVersion                       *string                              `json:"appVersion,omitempty"`
+	Spec                             *apiextensionsv1.JSON                `json:"spec,omitempty"`
+	Status                           *ApplicationStatusApplyConfiguration `json:"status,omitempty"`
 }
 
 // Application constructs a declarative configuration of the Application type for use with
@@ -44,6 +45,7 @@ func Application(name, namespace string) *ApplicationApplyConfiguration {
 	b.WithAPIVersion("apps.cozystack.io/v1alpha1")
 	return b
 }
+func (b ApplicationApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -203,24 +205,48 @@ func (b *ApplicationApplyConfiguration) ensureObjectMetaApplyConfigurationExists
 	}
 }
 
+// WithAppVersion sets the AppVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the AppVersion field is set to the value of the last call.
+func (b *ApplicationApplyConfiguration) WithAppVersion(value string) *ApplicationApplyConfiguration {
+	b.AppVersion = &value
+	return b
+}
+
 // WithSpec sets the Spec field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Spec field is set to the value of the last call.
-func (b *ApplicationApplyConfiguration) WithSpec(value *ApplicationSpecApplyConfiguration) *ApplicationApplyConfiguration {
-	b.Spec = value
+func (b *ApplicationApplyConfiguration) WithSpec(value apiextensionsv1.JSON) *ApplicationApplyConfiguration {
+	b.Spec = &value
 	return b
 }
 
 // WithStatus sets the Status field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Status field is set to the value of the last call.
-func (b *ApplicationApplyConfiguration) WithStatus(value appsv1alpha1.ApplicationStatus) *ApplicationApplyConfiguration {
-	b.Status = &value
+func (b *ApplicationApplyConfiguration) WithStatus(value *ApplicationStatusApplyConfiguration) *ApplicationApplyConfiguration {
+	b.Status = value
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *ApplicationApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *ApplicationApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *ApplicationApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *ApplicationApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/pkg/generated/applyconfiguration/apps/v1alpha1/applicationspec.go b/pkg/generated/applyconfiguration/apps/v1alpha1/applicationspec.go
deleted file mode 100644
index 3924ebd4..00000000
--- a/pkg/generated/applyconfiguration/apps/v1alpha1/applicationspec.go
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
-Copyright 2024 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by applyconfiguration-gen. DO NOT EDIT.
-
-package v1alpha1
-
-// ApplicationSpecApplyConfiguration represents a declarative configuration of the ApplicationSpec type for use
-// with apply.
-type ApplicationSpecApplyConfiguration struct {
-	Version *string `json:"version,omitempty"`
-	Values  *string `json:"values,omitempty"`
-}
-
-// ApplicationSpecApplyConfiguration constructs a declarative configuration of the ApplicationSpec type for use with
-// apply.
-func ApplicationSpec() *ApplicationSpecApplyConfiguration {
-	return &ApplicationSpecApplyConfiguration{}
-}
-
-// WithVersion sets the Version field in the declarative configuration to the given value
-// and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the Version field is set to the value of the last call.
-func (b *ApplicationSpecApplyConfiguration) WithVersion(value string) *ApplicationSpecApplyConfiguration {
-	b.Version = &value
-	return b
-}
-
-// WithValues sets the Values field in the declarative configuration to the given value
-// and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the Values field is set to the value of the last call.
-func (b *ApplicationSpecApplyConfiguration) WithValues(value string) *ApplicationSpecApplyConfiguration {
-	b.Values = &value
-	return b
-}
diff --git a/pkg/generated/applyconfiguration/apps/v1alpha1/applicationstatus.go b/pkg/generated/applyconfiguration/apps/v1alpha1/applicationstatus.go
new file mode 100644
index 00000000..2a990861
--- /dev/null
+++ b/pkg/generated/applyconfiguration/apps/v1alpha1/applicationstatus.go
@@ -0,0 +1,75 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// ApplicationStatusApplyConfiguration represents a declarative configuration of the ApplicationStatus type for use
+// with apply.
+type ApplicationStatusApplyConfiguration struct {
+	Version          *string                          `json:"version,omitempty"`
+	Conditions       []v1.ConditionApplyConfiguration `json:"conditions,omitempty"`
+	Namespace        *string                          `json:"namespace,omitempty"`
+	ExternalIPsCount *int32                           `json:"externalIPsCount,omitempty"`
+}
+
+// ApplicationStatusApplyConfiguration constructs a declarative configuration of the ApplicationStatus type for use with
+// apply.
+func ApplicationStatus() *ApplicationStatusApplyConfiguration {
+	return &ApplicationStatusApplyConfiguration{}
+}
+
+// WithVersion sets the Version field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Version field is set to the value of the last call.
+func (b *ApplicationStatusApplyConfiguration) WithVersion(value string) *ApplicationStatusApplyConfiguration {
+	b.Version = &value
+	return b
+}
+
+// WithConditions adds the given value to the Conditions field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Conditions field.
+func (b *ApplicationStatusApplyConfiguration) WithConditions(values ...*v1.ConditionApplyConfiguration) *ApplicationStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithConditions")
+		}
+		b.Conditions = append(b.Conditions, *values[i])
+	}
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *ApplicationStatusApplyConfiguration) WithNamespace(value string) *ApplicationStatusApplyConfiguration {
+	b.Namespace = &value
+	return b
+}
+
+// WithExternalIPsCount sets the ExternalIPsCount field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ExternalIPsCount field is set to the value of the last call.
+func (b *ApplicationStatusApplyConfiguration) WithExternalIPsCount(value int32) *ApplicationStatusApplyConfiguration {
+	b.ExternalIPsCount = &value
+	return b
+}
diff --git a/pkg/generated/applyconfiguration/internal/internal.go b/pkg/generated/applyconfiguration/internal/internal.go
index 760f1229..97f12849 100644
--- a/pkg/generated/applyconfiguration/internal/internal.go
+++ b/pkg/generated/applyconfiguration/internal/internal.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2024 The Cozystack Authors.
+Copyright 2025 The Cozystack Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -22,7 +22,7 @@ import (
 	fmt "fmt"
 	sync "sync"
 
-	typed "sigs.k8s.io/structured-merge-diff/v4/typed"
+	typed "sigs.k8s.io/structured-merge-diff/v6/typed"
 )
 
 func Parser() *typed.Parser {
diff --git a/pkg/generated/applyconfiguration/utils.go b/pkg/generated/applyconfiguration/utils.go
index a27b3d20..ab73a5f1 100644
--- a/pkg/generated/applyconfiguration/utils.go
+++ b/pkg/generated/applyconfiguration/utils.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2024 The Cozystack Authors.
+Copyright 2025 The Cozystack Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -19,12 +19,12 @@ limitations under the License.
 package applyconfiguration
 
 import (
+	v1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
+	appsv1alpha1 "github.com/cozystack/cozystack/pkg/generated/applyconfiguration/apps/v1alpha1"
+	internal "github.com/cozystack/cozystack/pkg/generated/applyconfiguration/internal"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	testing "k8s.io/client-go/testing"
-	v1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
-	internal "github.com/cozystack/cozystack/pkg/generated/applyconfiguration/internal"
-	appsv1alpha1 "github.com/cozystack/cozystack/pkg/generated/applyconfiguration/apps/v1alpha1"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 )
 
 // ForKind returns an apply configuration type for the given GroupVersionKind, or nil if no
@@ -34,13 +34,13 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 	// Group=apps.cozystack.io, Version=v1alpha1
 	case v1alpha1.SchemeGroupVersion.WithKind("Application"):
 		return &appsv1alpha1.ApplicationApplyConfiguration{}
-	case v1alpha1.SchemeGroupVersion.WithKind("ApplicationSpec"):
-		return &appsv1alpha1.ApplicationSpecApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ApplicationStatus"):
+		return &appsv1alpha1.ApplicationStatusApplyConfiguration{}
 
 	}
 	return nil
 }
 
-func NewTypeConverter(scheme *runtime.Scheme) *testing.TypeConverter {
-	return &testing.TypeConverter{Scheme: scheme, TypeResolver: internal.Parser()}
+func NewTypeConverter(scheme *runtime.Scheme) managedfields.TypeConverter {
+	return managedfields.NewSchemeTypeConverter(scheme, internal.Parser())
 }
diff --git a/pkg/generated/applyconfiguration/utils_test.go b/pkg/generated/applyconfiguration/utils_test.go
new file mode 100644
index 00000000..dd6440b6
--- /dev/null
+++ b/pkg/generated/applyconfiguration/utils_test.go
@@ -0,0 +1,64 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package applyconfiguration
+
+import (
+	"testing"
+
+	v1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
+	appsv1alpha1 "github.com/cozystack/cozystack/pkg/generated/applyconfiguration/apps/v1alpha1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestForKind_Application(t *testing.T) {
+	gvk := v1alpha1.SchemeGroupVersion.WithKind("Application")
+	got := ForKind(gvk)
+	if got == nil {
+		t.Fatal("ForKind returned nil for Application GVK")
+	}
+	if _, ok := got.(*appsv1alpha1.ApplicationApplyConfiguration); !ok {
+		t.Fatalf("ForKind returned %T, want *ApplicationApplyConfiguration", got)
+	}
+}
+
+func TestForKind_ApplicationStatus(t *testing.T) {
+	gvk := v1alpha1.SchemeGroupVersion.WithKind("ApplicationStatus")
+	got := ForKind(gvk)
+	if got == nil {
+		t.Fatal("ForKind returned nil for ApplicationStatus GVK")
+	}
+	if _, ok := got.(*appsv1alpha1.ApplicationStatusApplyConfiguration); !ok {
+		t.Fatalf("ForKind returned %T, want *ApplicationStatusApplyConfiguration", got)
+	}
+}
+
+func TestForKind_Unknown(t *testing.T) {
+	gvk := schema.GroupVersionKind{Group: "unknown.io", Version: "v1", Kind: "Unknown"}
+	got := ForKind(gvk)
+	if got != nil {
+		t.Fatalf("ForKind returned %T for unknown GVK, want nil", got)
+	}
+}
+
+func TestNewTypeConverter(t *testing.T) {
+	scheme := runtime.NewScheme()
+	tc := NewTypeConverter(scheme)
+	if tc == nil {
+		t.Fatal("NewTypeConverter returned nil")
+	}
+}
diff --git a/pkg/generated/clientset/versioned/clientset.go b/pkg/generated/clientset/versioned/clientset.go
new file mode 100644
index 00000000..127a0032
--- /dev/null
+++ b/pkg/generated/clientset/versioned/clientset.go
@@ -0,0 +1,120 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package versioned
+
+import (
+	fmt "fmt"
+	http "net/http"
+
+	appsv1alpha1 "github.com/cozystack/cozystack/pkg/generated/clientset/versioned/typed/apps/v1alpha1"
+	discovery "k8s.io/client-go/discovery"
+	rest "k8s.io/client-go/rest"
+	flowcontrol "k8s.io/client-go/util/flowcontrol"
+)
+
+type Interface interface {
+	Discovery() discovery.DiscoveryInterface
+	AppsV1alpha1() appsv1alpha1.AppsV1alpha1Interface
+}
+
+// Clientset contains the clients for groups.
+type Clientset struct {
+	*discovery.DiscoveryClient
+	appsV1alpha1 *appsv1alpha1.AppsV1alpha1Client
+}
+
+// AppsV1alpha1 retrieves the AppsV1alpha1Client
+func (c *Clientset) AppsV1alpha1() appsv1alpha1.AppsV1alpha1Interface {
+	return c.appsV1alpha1
+}
+
+// Discovery retrieves the DiscoveryClient
+func (c *Clientset) Discovery() discovery.DiscoveryInterface {
+	if c == nil {
+		return nil
+	}
+	return c.DiscoveryClient
+}
+
+// NewForConfig creates a new Clientset for the given config.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfig will generate a rate-limiter in configShallowCopy.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*Clientset, error) {
+	configShallowCopy := *c
+
+	if configShallowCopy.UserAgent == "" {
+		configShallowCopy.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	// share the transport between all clients
+	httpClient, err := rest.HTTPClientFor(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewForConfigAndClient(&configShallowCopy, httpClient)
+}
+
+// NewForConfigAndClient creates a new Clientset for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfigAndClient will generate a rate-limiter in configShallowCopy.
+func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*Clientset, error) {
+	configShallowCopy := *c
+	if configShallowCopy.RateLimiter == nil && configShallowCopy.QPS > 0 {
+		if configShallowCopy.Burst <= 0 {
+			return nil, fmt.Errorf("burst is required to be greater than 0 when RateLimiter is not set and QPS is set to greater than 0")
+		}
+		configShallowCopy.RateLimiter = flowcontrol.NewTokenBucketRateLimiter(configShallowCopy.QPS, configShallowCopy.Burst)
+	}
+
+	var cs Clientset
+	var err error
+	cs.appsV1alpha1, err = appsv1alpha1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+
+	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+	return &cs, nil
+}
+
+// NewForConfigOrDie creates a new Clientset for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *Clientset {
+	cs, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return cs
+}
+
+// New creates a new Clientset for the given RESTClient.
+func New(c rest.Interface) *Clientset {
+	var cs Clientset
+	cs.appsV1alpha1 = appsv1alpha1.New(c)
+
+	cs.DiscoveryClient = discovery.NewDiscoveryClient(c)
+	return &cs
+}
diff --git a/pkg/generated/clientset/versioned/fake/clientset_generated.go b/pkg/generated/clientset/versioned/fake/clientset_generated.go
new file mode 100644
index 00000000..3ceb93c7
--- /dev/null
+++ b/pkg/generated/clientset/versioned/fake/clientset_generated.go
@@ -0,0 +1,131 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	applyconfiguration "github.com/cozystack/cozystack/pkg/generated/applyconfiguration"
+	clientset "github.com/cozystack/cozystack/pkg/generated/clientset/versioned"
+	appsv1alpha1 "github.com/cozystack/cozystack/pkg/generated/clientset/versioned/typed/apps/v1alpha1"
+	fakeappsv1alpha1 "github.com/cozystack/cozystack/pkg/generated/clientset/versioned/typed/apps/v1alpha1/fake"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/client-go/discovery"
+	fakediscovery "k8s.io/client-go/discovery/fake"
+	"k8s.io/client-go/testing"
+)
+
+// NewSimpleClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any field management, validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+//
+// DEPRECATED: NewClientset replaces this with support for field management, which significantly improves
+// server side apply testing. NewClientset is only available when apply configurations are generated (e.g.
+// via --with-applyconfig).
+func NewSimpleClientset(objects ...runtime.Object) *Clientset {
+	o := testing.NewObjectTracker(scheme, codecs.UniversalDecoder())
+	for _, obj := range objects {
+		if err := o.Add(obj); err != nil {
+			panic(err)
+		}
+	}
+
+	cs := &Clientset{tracker: o}
+	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
+	cs.AddReactor("*", "*", testing.ObjectReaction(o))
+	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
+		var opts metav1.ListOptions
+		if watchActcion, ok := action.(testing.WatchActionImpl); ok {
+			opts = watchActcion.ListOptions
+		}
+		gvr := action.GetResource()
+		ns := action.GetNamespace()
+		watch, err := o.Watch(gvr, ns, opts)
+		if err != nil {
+			return false, nil, err
+		}
+		return true, watch, nil
+	})
+
+	return cs
+}
+
+// Clientset implements clientset.Interface. Meant to be embedded into a
+// struct to get a default implementation. This makes faking out just the method
+// you want to test easier.
+type Clientset struct {
+	testing.Fake
+	discovery *fakediscovery.FakeDiscovery
+	tracker   testing.ObjectTracker
+}
+
+func (c *Clientset) Discovery() discovery.DiscoveryInterface {
+	return c.discovery
+}
+
+func (c *Clientset) Tracker() testing.ObjectTracker {
+	return c.tracker
+}
+
+// NewClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+func NewClientset(objects ...runtime.Object) *Clientset {
+	o := testing.NewFieldManagedObjectTracker(
+		scheme,
+		codecs.UniversalDecoder(),
+		applyconfiguration.NewTypeConverter(scheme),
+	)
+	for _, obj := range objects {
+		if err := o.Add(obj); err != nil {
+			panic(err)
+		}
+	}
+
+	cs := &Clientset{tracker: o}
+	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
+	cs.AddReactor("*", "*", testing.ObjectReaction(o))
+	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
+		var opts metav1.ListOptions
+		if watchAction, ok := action.(testing.WatchActionImpl); ok {
+			opts = watchAction.ListOptions
+		}
+		gvr := action.GetResource()
+		ns := action.GetNamespace()
+		watch, err := o.Watch(gvr, ns, opts)
+		if err != nil {
+			return false, nil, err
+		}
+		return true, watch, nil
+	})
+
+	return cs
+}
+
+var (
+	_ clientset.Interface = &Clientset{}
+	_ testing.FakeClient  = &Clientset{}
+)
+
+// AppsV1alpha1 retrieves the AppsV1alpha1Client
+func (c *Clientset) AppsV1alpha1() appsv1alpha1.AppsV1alpha1Interface {
+	return &fakeappsv1alpha1.FakeAppsV1alpha1{Fake: &c.Fake}
+}
diff --git a/pkg/generated/clientset/versioned/fake/doc.go b/pkg/generated/clientset/versioned/fake/doc.go
new file mode 100644
index 00000000..2d395096
--- /dev/null
+++ b/pkg/generated/clientset/versioned/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated fake clientset.
+package fake
diff --git a/pkg/generated/clientset/versioned/fake/register.go b/pkg/generated/clientset/versioned/fake/register.go
new file mode 100644
index 00000000..a05b3ada
--- /dev/null
+++ b/pkg/generated/clientset/versioned/fake/register.go
@@ -0,0 +1,56 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+var scheme = runtime.NewScheme()
+var codecs = serializer.NewCodecFactory(scheme)
+
+var localSchemeBuilder = runtime.SchemeBuilder{
+	appsv1alpha1.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//	import (
+//	  "k8s.io/client-go/kubernetes"
+//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//	)
+//
+//	kclientset, _ := kubernetes.NewForConfig(c)
+//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(scheme))
+}
diff --git a/pkg/generated/clientset/versioned/scheme/doc.go b/pkg/generated/clientset/versioned/scheme/doc.go
new file mode 100644
index 00000000..4b11a5d0
--- /dev/null
+++ b/pkg/generated/clientset/versioned/scheme/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package contains the scheme of the automatically generated clientset.
+package scheme
diff --git a/pkg/generated/clientset/versioned/scheme/register.go b/pkg/generated/clientset/versioned/scheme/register.go
new file mode 100644
index 00000000..65b15149
--- /dev/null
+++ b/pkg/generated/clientset/versioned/scheme/register.go
@@ -0,0 +1,56 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package scheme
+
+import (
+	appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+var Scheme = runtime.NewScheme()
+var Codecs = serializer.NewCodecFactory(Scheme)
+var ParameterCodec = runtime.NewParameterCodec(Scheme)
+var localSchemeBuilder = runtime.SchemeBuilder{
+	appsv1alpha1.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//	import (
+//	  "k8s.io/client-go/kubernetes"
+//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//	)
+//
+//	kclientset, _ := kubernetes.NewForConfig(c)
+//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(Scheme))
+}
diff --git a/pkg/generated/clientset/versioned/typed/apps/v1alpha1/application.go b/pkg/generated/clientset/versioned/typed/apps/v1alpha1/application.go
new file mode 100644
index 00000000..afc81aad
--- /dev/null
+++ b/pkg/generated/clientset/versioned/typed/apps/v1alpha1/application.go
@@ -0,0 +1,74 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+
+	appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
+	applyconfigurationappsv1alpha1 "github.com/cozystack/cozystack/pkg/generated/applyconfiguration/apps/v1alpha1"
+	scheme "github.com/cozystack/cozystack/pkg/generated/clientset/versioned/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+)
+
+// ApplicationsGetter has a method to return a ApplicationInterface.
+// A group's client should implement this interface.
+type ApplicationsGetter interface {
+	Applications(namespace string) ApplicationInterface
+}
+
+// ApplicationInterface has methods to work with Application resources.
+type ApplicationInterface interface {
+	Create(ctx context.Context, application *appsv1alpha1.Application, opts v1.CreateOptions) (*appsv1alpha1.Application, error)
+	Update(ctx context.Context, application *appsv1alpha1.Application, opts v1.UpdateOptions) (*appsv1alpha1.Application, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, application *appsv1alpha1.Application, opts v1.UpdateOptions) (*appsv1alpha1.Application, error)
+	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*appsv1alpha1.Application, error)
+	List(ctx context.Context, opts v1.ListOptions) (*appsv1alpha1.ApplicationList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *appsv1alpha1.Application, err error)
+	Apply(ctx context.Context, application *applyconfigurationappsv1alpha1.ApplicationApplyConfiguration, opts v1.ApplyOptions) (result *appsv1alpha1.Application, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, application *applyconfigurationappsv1alpha1.ApplicationApplyConfiguration, opts v1.ApplyOptions) (result *appsv1alpha1.Application, err error)
+	ApplicationExpansion
+}
+
+// applications implements ApplicationInterface
+type applications struct {
+	*gentype.ClientWithListAndApply[*appsv1alpha1.Application, *appsv1alpha1.ApplicationList, *applyconfigurationappsv1alpha1.ApplicationApplyConfiguration]
+}
+
+// newApplications returns a Applications
+func newApplications(c *AppsV1alpha1Client, namespace string) *applications {
+	return &applications{
+		gentype.NewClientWithListAndApply[*appsv1alpha1.Application, *appsv1alpha1.ApplicationList, *applyconfigurationappsv1alpha1.ApplicationApplyConfiguration](
+			"applications",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *appsv1alpha1.Application { return &appsv1alpha1.Application{} },
+			func() *appsv1alpha1.ApplicationList { return &appsv1alpha1.ApplicationList{} },
+		),
+	}
+}
diff --git a/pkg/generated/clientset/versioned/typed/apps/v1alpha1/apps_client.go b/pkg/generated/clientset/versioned/typed/apps/v1alpha1/apps_client.go
new file mode 100644
index 00000000..40ff64b9
--- /dev/null
+++ b/pkg/generated/clientset/versioned/typed/apps/v1alpha1/apps_client.go
@@ -0,0 +1,101 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	http "net/http"
+
+	appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
+	scheme "github.com/cozystack/cozystack/pkg/generated/clientset/versioned/scheme"
+	rest "k8s.io/client-go/rest"
+)
+
+type AppsV1alpha1Interface interface {
+	RESTClient() rest.Interface
+	ApplicationsGetter
+}
+
+// AppsV1alpha1Client is used to interact with features provided by the apps.cozystack.io group.
+type AppsV1alpha1Client struct {
+	restClient rest.Interface
+}
+
+func (c *AppsV1alpha1Client) Applications(namespace string) ApplicationInterface {
+	return newApplications(c, namespace)
+}
+
+// NewForConfig creates a new AppsV1alpha1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*AppsV1alpha1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new AppsV1alpha1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*AppsV1alpha1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
+	if err != nil {
+		return nil, err
+	}
+	return &AppsV1alpha1Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new AppsV1alpha1Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *AppsV1alpha1Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new AppsV1alpha1Client for the given RESTClient.
+func New(c rest.Interface) *AppsV1alpha1Client {
+	return &AppsV1alpha1Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := appsv1alpha1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(scheme.Scheme, scheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *AppsV1alpha1Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}
diff --git a/pkg/generated/clientset/versioned/typed/apps/v1alpha1/doc.go b/pkg/generated/clientset/versioned/typed/apps/v1alpha1/doc.go
new file mode 100644
index 00000000..b37cc8b0
--- /dev/null
+++ b/pkg/generated/clientset/versioned/typed/apps/v1alpha1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha1
diff --git a/pkg/generated/clientset/versioned/typed/apps/v1alpha1/fake/doc.go b/pkg/generated/clientset/versioned/typed/apps/v1alpha1/fake/doc.go
new file mode 100644
index 00000000..592956cf
--- /dev/null
+++ b/pkg/generated/clientset/versioned/typed/apps/v1alpha1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake
diff --git a/pkg/generated/clientset/versioned/typed/apps/v1alpha1/fake/fake_application.go b/pkg/generated/clientset/versioned/typed/apps/v1alpha1/fake/fake_application.go
new file mode 100644
index 00000000..0760721d
--- /dev/null
+++ b/pkg/generated/clientset/versioned/typed/apps/v1alpha1/fake/fake_application.go
@@ -0,0 +1,53 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
+	appsv1alpha1 "github.com/cozystack/cozystack/pkg/generated/applyconfiguration/apps/v1alpha1"
+	typedappsv1alpha1 "github.com/cozystack/cozystack/pkg/generated/clientset/versioned/typed/apps/v1alpha1"
+	gentype "k8s.io/client-go/gentype"
+)
+
+// fakeApplications implements ApplicationInterface
+type fakeApplications struct {
+	*gentype.FakeClientWithListAndApply[*v1alpha1.Application, *v1alpha1.ApplicationList, *appsv1alpha1.ApplicationApplyConfiguration]
+	Fake *FakeAppsV1alpha1
+}
+
+func newFakeApplications(fake *FakeAppsV1alpha1, namespace string) typedappsv1alpha1.ApplicationInterface {
+	return &fakeApplications{
+		gentype.NewFakeClientWithListAndApply[*v1alpha1.Application, *v1alpha1.ApplicationList, *appsv1alpha1.ApplicationApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1alpha1.SchemeGroupVersion.WithResource("applications"),
+			v1alpha1.SchemeGroupVersion.WithKind("Application"),
+			func() *v1alpha1.Application { return &v1alpha1.Application{} },
+			func() *v1alpha1.ApplicationList { return &v1alpha1.ApplicationList{} },
+			func(dst, src *v1alpha1.ApplicationList) { dst.ListMeta = src.ListMeta },
+			func(list *v1alpha1.ApplicationList) []*v1alpha1.Application {
+				return gentype.ToPointerSlice(list.Items)
+			},
+			func(list *v1alpha1.ApplicationList, items []*v1alpha1.Application) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+	}
+}
diff --git a/pkg/generated/clientset/versioned/typed/apps/v1alpha1/fake/fake_apps_client.go b/pkg/generated/clientset/versioned/typed/apps/v1alpha1/fake/fake_apps_client.go
new file mode 100644
index 00000000..40981a9d
--- /dev/null
+++ b/pkg/generated/clientset/versioned/typed/apps/v1alpha1/fake/fake_apps_client.go
@@ -0,0 +1,40 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha1 "github.com/cozystack/cozystack/pkg/generated/clientset/versioned/typed/apps/v1alpha1"
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+)
+
+type FakeAppsV1alpha1 struct {
+	*testing.Fake
+}
+
+func (c *FakeAppsV1alpha1) Applications(namespace string) v1alpha1.ApplicationInterface {
+	return newFakeApplications(c, namespace)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeAppsV1alpha1) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/pkg/generated/clientset/versioned/typed/apps/v1alpha1/generated_expansion.go b/pkg/generated/clientset/versioned/typed/apps/v1alpha1/generated_expansion.go
new file mode 100644
index 00000000..6a0aab6a
--- /dev/null
+++ b/pkg/generated/clientset/versioned/typed/apps/v1alpha1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+type ApplicationExpansion interface{}

From 25ff583f3407b76fbae6f32e7da01beb32b113f0 Mon Sep 17 00:00:00 2001
From: Matthieu <matthieu@hidora.com>
Date: Mon, 2 Feb 2026 13:11:18 +0100
Subject: [PATCH 056/666] [apps] Add managed OpenSearch service

Add OpenSearch application with operator and resource definition:
- App chart with multi-version support (v1/v2/v3), TLS, auth, dashboards
- OpenSearch operator wrapper (opster v2.8.0) with sysctl daemonset
- ApplicationDefinition for Cozystack platform integration

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: Matthieu <matthieu@hidora.com>
---
 packages/apps/opensearch/.helmignore          |   23 +
 packages/apps/opensearch/Chart.yaml           |    7 +
 packages/apps/opensearch/Makefile             |   11 +
 packages/apps/opensearch/README.md            |   60 +
 packages/apps/opensearch/charts/cozy-lib      |    1 +
 packages/apps/opensearch/files/versions.yaml  |    5 +
 .../apps/opensearch/hack/update-versions.sh   |   53 +
 packages/apps/opensearch/logos/opensearch.svg |   11 +
 packages/apps/opensearch/templates/.gitkeep   |    0
 .../apps/opensearch/templates/_versions.tpl   |   13 +
 .../templates/dashboard-resourcemap.yaml      |   42 +
 .../opensearch/templates/external-svc.yaml    |   39 +
 .../apps/opensearch/templates/opensearch.yaml |   99 +
 .../apps/opensearch/templates/security.yaml   |  120 +
 packages/apps/opensearch/templates/users.yaml |   21 +
 .../opensearch/tests/opensearch_test.yaml     |  516 ++
 .../apps/opensearch/tests/security_test.yaml  |  207 +
 .../apps/opensearch/tests/users_test.yaml     |  176 +
 packages/apps/opensearch/values.schema.json   |  239 +
 packages/apps/opensearch/values.yaml          |  111 +
 .../system/opensearch-operator/.helmignore    |   23 +
 .../system/opensearch-operator/Chart.yaml     |    3 +
 packages/system/opensearch-operator/Makefile  |   10 +
 .../charts/opensearch-operator/CHANGELOG.md   |   61 +
 .../charts/opensearch-operator/Chart.yaml     |    6 +
 .../charts/opensearch-operator/README.md      |   29 +
 ...arch.opster.io_opensearchactiongroups.yaml |   94 +
 ...ensearch.opster.io_opensearchclusters.yaml | 6372 +++++++++++++++++
 ...pster.io_opensearchcomponenttemplates.yaml |  136 +
 ...ch.opster.io_opensearchindextemplates.yaml |  163 +
 ...earch.opster.io_opensearchismpolicies.yaml |  461 ++
 .../opensearch.opster.io_opensearchroles.yaml |  123 +
 ....opster.io_opensearchsnapshotpolicies.yaml |  203 +
 ...pensearch.opster.io_opensearchtenants.yaml |   85 +
 ....opster.io_opensearchuserrolebindings.yaml |  109 +
 .../opensearch.opster.io_opensearchusers.yaml |  117 +
 .../templates/_helpers.tpl                    |   62 +
 ...perator-controller-manager-deployment.yaml |   94 +
 ...ontroller-manager-metrics-service-svc.yaml |   13 +
 ...search-operator-controller-manager-sa.yaml |    6 +
 .../templates/opensearch-operator-crds.yaml   |    5 +
 ...ch-operator-leader-election-role-role.yaml |   48 +
 ...erator-leader-election-rolebinding-rb.yaml |   11 +
 ...opensearch-operator-manager-config-cm.yaml |   17 +
 .../opensearch-operator-manager-role-cr.yaml  |  414 ++
 ...ensearch-operator-manager-rolebinding.yaml |   27 +
 ...opensearch-operator-metrics-reader-cr.yaml |    9 +
 .../opensearch-operator-proxy-role-cr.yaml    |   17 +
 ...opensearch-operator-proxy-rolebinding.yaml |   27 +
 .../charts/opensearch-operator/values.yaml    |  123 +
 .../templates/sysctl-daemonset.yaml           |   64 +
 .../system/opensearch-operator/values.yaml    |    4 +
 packages/system/opensearch-rd/Chart.yaml      |    3 +
 packages/system/opensearch-rd/Makefile        |    4 +
 .../opensearch-rd/cozyrds/opensearch.yaml     |   42 +
 .../opensearch-rd/templates/cozyrd.yaml       |    4 +
 packages/system/opensearch-rd/values.yaml     |    1 +
 57 files changed, 10744 insertions(+)
 create mode 100644 packages/apps/opensearch/.helmignore
 create mode 100644 packages/apps/opensearch/Chart.yaml
 create mode 100644 packages/apps/opensearch/Makefile
 create mode 100644 packages/apps/opensearch/README.md
 create mode 120000 packages/apps/opensearch/charts/cozy-lib
 create mode 100644 packages/apps/opensearch/files/versions.yaml
 create mode 100755 packages/apps/opensearch/hack/update-versions.sh
 create mode 100644 packages/apps/opensearch/logos/opensearch.svg
 create mode 100644 packages/apps/opensearch/templates/.gitkeep
 create mode 100644 packages/apps/opensearch/templates/_versions.tpl
 create mode 100644 packages/apps/opensearch/templates/dashboard-resourcemap.yaml
 create mode 100644 packages/apps/opensearch/templates/external-svc.yaml
 create mode 100644 packages/apps/opensearch/templates/opensearch.yaml
 create mode 100644 packages/apps/opensearch/templates/security.yaml
 create mode 100644 packages/apps/opensearch/templates/users.yaml
 create mode 100644 packages/apps/opensearch/tests/opensearch_test.yaml
 create mode 100644 packages/apps/opensearch/tests/security_test.yaml
 create mode 100644 packages/apps/opensearch/tests/users_test.yaml
 create mode 100644 packages/apps/opensearch/values.schema.json
 create mode 100644 packages/apps/opensearch/values.yaml
 create mode 100644 packages/system/opensearch-operator/.helmignore
 create mode 100644 packages/system/opensearch-operator/Chart.yaml
 create mode 100644 packages/system/opensearch-operator/Makefile
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/CHANGELOG.md
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/Chart.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/README.md
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchactiongroups.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchclusters.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchcomponenttemplates.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchindextemplates.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchismpolicies.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchroles.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchsnapshotpolicies.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchtenants.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchuserrolebindings.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchusers.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/templates/_helpers.tpl
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-deployment.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-metrics-service-svc.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-sa.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-crds.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-leader-election-role-role.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-leader-election-rolebinding-rb.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-config-cm.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-role-cr.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-rolebinding.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-metrics-reader-cr.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-proxy-role-cr.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-proxy-rolebinding.yaml
 create mode 100644 packages/system/opensearch-operator/charts/opensearch-operator/values.yaml
 create mode 100644 packages/system/opensearch-operator/templates/sysctl-daemonset.yaml
 create mode 100644 packages/system/opensearch-operator/values.yaml
 create mode 100644 packages/system/opensearch-rd/Chart.yaml
 create mode 100644 packages/system/opensearch-rd/Makefile
 create mode 100644 packages/system/opensearch-rd/cozyrds/opensearch.yaml
 create mode 100644 packages/system/opensearch-rd/templates/cozyrd.yaml
 create mode 100644 packages/system/opensearch-rd/values.yaml

diff --git a/packages/apps/opensearch/.helmignore b/packages/apps/opensearch/.helmignore
new file mode 100644
index 00000000..0e8a0eb3
--- /dev/null
+++ b/packages/apps/opensearch/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/packages/apps/opensearch/Chart.yaml b/packages/apps/opensearch/Chart.yaml
new file mode 100644
index 00000000..8abefadf
--- /dev/null
+++ b/packages/apps/opensearch/Chart.yaml
@@ -0,0 +1,7 @@
+apiVersion: v2
+name: opensearch
+description: Managed OpenSearch service
+icon: /logos/opensearch.svg
+type: application
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
+appVersion: "2.11.1"
diff --git a/packages/apps/opensearch/Makefile b/packages/apps/opensearch/Makefile
new file mode 100644
index 00000000..9440c3fd
--- /dev/null
+++ b/packages/apps/opensearch/Makefile
@@ -0,0 +1,11 @@
+include ../../../hack/package.mk
+
+.PHONY: generate update
+
+generate:
+	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	../../../hack/update-crd.sh
+
+update:
+	hack/update-versions.sh
+	make generate
diff --git a/packages/apps/opensearch/README.md b/packages/apps/opensearch/README.md
new file mode 100644
index 00000000..d968c665
--- /dev/null
+++ b/packages/apps/opensearch/README.md
@@ -0,0 +1,60 @@
+# Managed OpenSearch Service
+
+## Parameters
+
+### Common parameters
+
+| Name                   | Description                                                                                                                       | Type       | Value   |
+| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ---------- | ------- |
+| `replicas`             | Number of OpenSearch nodes in the cluster.                                                                                        | `int`      | `3`     |
+| `resources`            | Explicit CPU and memory configuration for each OpenSearch node. When omitted, the preset defined in `resourcesPreset` is applied. | `object`   | `{}`    |
+| `resources.cpu`        | CPU available to each node.                                                                                                       | `quantity` | `""`    |
+| `resources.memory`     | Memory (RAM) available to each node.                                                                                              | `quantity` | `""`    |
+| `resourcesPreset`      | Default sizing preset used when `resources` is omitted. OpenSearch requires minimum 2Gi memory.                                   | `string`   | `large` |
+| `size`                 | Persistent Volume Claim size available for application data.                                                                      | `quantity` | `10Gi`  |
+| `storageClass`         | StorageClass used to store the data.                                                                                              | `string`   | `""`    |
+| `external`             | Enable external access from outside the cluster.                                                                                  | `bool`     | `false` |
+| `topologySpreadPolicy` | How strictly to enforce pod distribution across nodes and zones.                                                                  | `string`   | `soft`  |
+| `version`              | OpenSearch major version to deploy.                                                                                               | `string`   | `v2`    |
+
+
+### Image configuration
+
+| Name                | Description                            | Type     | Value |
+| ------------------- | -------------------------------------- | -------- | ----- |
+| `images`            | Container images used by the operator. | `object` | `{}`  |
+| `images.opensearch` | OpenSearch image.                      | `string` | `""`  |
+
+
+### Node roles configuration
+
+| Name               | Description                   | Type     | Value   |
+| ------------------ | ----------------------------- | -------- | ------- |
+| `nodeRoles`        | Node roles configuration.     | `object` | `{}`    |
+| `nodeRoles.master` | Enable cluster_manager role.  | `bool`   | `true`  |
+| `nodeRoles.data`   | Enable data role.             | `bool`   | `true`  |
+| `nodeRoles.ingest` | Enable ingest role.           | `bool`   | `true`  |
+| `nodeRoles.ml`     | Enable machine learning role. | `bool`   | `false` |
+
+
+### Users configuration
+
+| Name                   | Description                                        | Type                | Value |
+| ---------------------- | -------------------------------------------------- | ------------------- | ----- |
+| `users`                | Custom OpenSearch users configuration map.         | `map[string]object` | `{}`  |
+| `users[name].password` | Password for the user (auto-generated if omitted). | `string`            | `""`  |
+| `users[name].roles`    | List of OpenSearch roles.                          | `[]string`          | `[]`  |
+
+
+### OpenSearch Dashboards configuration
+
+| Name                          | Description                                           | Type       | Value    |
+| ----------------------------- | ----------------------------------------------------- | ---------- | -------- |
+| `dashboards`                  | OpenSearch Dashboards configuration.                  | `object`   | `{}`     |
+| `dashboards.enabled`          | Enable OpenSearch Dashboards deployment.              | `bool`     | `false`  |
+| `dashboards.replicas`         | Number of Dashboards replicas.                        | `int`      | `1`      |
+| `dashboards.resources`        | Explicit CPU and memory configuration for Dashboards. | `object`   | `{}`     |
+| `dashboards.resources.cpu`    | CPU available to each node.                           | `quantity` | `""`     |
+| `dashboards.resources.memory` | Memory (RAM) available to each node.                  | `quantity` | `""`     |
+| `dashboards.resourcesPreset`  | Default sizing preset for Dashboards.                 | `string`   | `medium` |
+
diff --git a/packages/apps/opensearch/charts/cozy-lib b/packages/apps/opensearch/charts/cozy-lib
new file mode 120000
index 00000000..e1813509
--- /dev/null
+++ b/packages/apps/opensearch/charts/cozy-lib
@@ -0,0 +1 @@
+../../../library/cozy-lib
\ No newline at end of file
diff --git a/packages/apps/opensearch/files/versions.yaml b/packages/apps/opensearch/files/versions.yaml
new file mode 100644
index 00000000..5e88df94
--- /dev/null
+++ b/packages/apps/opensearch/files/versions.yaml
@@ -0,0 +1,5 @@
+# OpenSearch version mapping (major version -> image tag)
+# Auto-generated by hack/update-versions.sh - do not edit manually
+"v3": "3.0.0"
+"v2": "2.11.1"
+"v1": "1.3.20"
diff --git a/packages/apps/opensearch/hack/update-versions.sh b/packages/apps/opensearch/hack/update-versions.sh
new file mode 100755
index 00000000..19d9e7b2
--- /dev/null
+++ b/packages/apps/opensearch/hack/update-versions.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+OPENSEARCH_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+VERSIONS_FILE="${OPENSEARCH_DIR}/files/versions.yaml"
+
+# Supported major versions (newest first)
+SUPPORTED_MAJOR_VERSIONS="3 2 1"
+
+echo "Supported major versions: $SUPPORTED_MAJOR_VERSIONS"
+
+# Check if skopeo is installed
+if ! command -v skopeo &> /dev/null; then
+    echo "Error: skopeo is not installed. Please install skopeo and try again." >&2
+    exit 1
+fi
+
+# Check if jq is installed
+if ! command -v jq &> /dev/null; then
+    echo "Error: jq is not installed. Please install jq and try again." >&2
+    exit 1
+fi
+
+# Get available image tags from Docker Hub
+IMAGE="docker.io/opensearchproject/opensearch"
+echo "Fetching available image tags from registry..."
+TAGS=$(skopeo list-tags "docker://${IMAGE}" | jq -r '.Tags[]')
+
+echo "# OpenSearch version mapping (major version -> image tag)" > "${VERSIONS_FILE}"
+echo "# Auto-generated by hack/update-versions.sh - do not edit manually" >> "${VERSIONS_FILE}"
+
+for MAJOR in $SUPPORTED_MAJOR_VERSIONS; do
+    # Find the latest stable release for this major version
+    LATEST=$(echo "$TAGS" \
+        | grep -E "^${MAJOR}\.[0-9]+\.[0-9]+$" \
+        | sort -t. -k1,1n -k2,2n -k3,3n \
+        | tail -1)
+
+    if [ -n "$LATEST" ]; then
+        echo "v${MAJOR}: latest tag is ${LATEST}"
+        echo "\"v${MAJOR}\": \"${LATEST}\"" >> "${VERSIONS_FILE}"
+    else
+        echo "WARNING: No stable release found for major version ${MAJOR}" >&2
+    fi
+done
+
+echo ""
+echo "Updated ${VERSIONS_FILE}:"
+cat "${VERSIONS_FILE}"
diff --git a/packages/apps/opensearch/logos/opensearch.svg b/packages/apps/opensearch/logos/opensearch.svg
new file mode 100644
index 00000000..345fdd0a
--- /dev/null
+++ b/packages/apps/opensearch/logos/opensearch.svg
@@ -0,0 +1,11 @@
+<svg width="144" height="144" viewBox="0 0 144 144" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="144" height="144" rx="24" fill="url(#paint0_linear_opensearch)"/>
+<path d="M72 36C44 36 28 52 28 72C28 92 44 108 72 108C100 108 116 92 116 72" stroke="#005EB8" stroke-width="8" stroke-linecap="round" fill="none"/>
+<circle cx="116" cy="72" r="8" fill="#005EB8"/>
+<defs>
+<linearGradient id="paint0_linear_opensearch" x1="140" y1="130.5" x2="4" y2="9.49999" gradientUnits="userSpaceOnUse">
+<stop stop-color="#003B5C"/>
+<stop offset="1" stop-color="#005EB8"/>
+</linearGradient>
+</defs>
+</svg>
diff --git a/packages/apps/opensearch/templates/.gitkeep b/packages/apps/opensearch/templates/.gitkeep
new file mode 100644
index 00000000..e69de29b
diff --git a/packages/apps/opensearch/templates/_versions.tpl b/packages/apps/opensearch/templates/_versions.tpl
new file mode 100644
index 00000000..4eae4163
--- /dev/null
+++ b/packages/apps/opensearch/templates/_versions.tpl
@@ -0,0 +1,13 @@
+{{/*
+Version mapping helper
+Loads version mapping from files/versions.yaml and returns the full version for a given major version
+*/}}
+{{- define "opensearch.versionMap" -}}
+{{- $versions := .Files.Get "files/versions.yaml" | fromYaml -}}
+{{- $version := .Values.version | default "v2" -}}
+{{- if hasKey $versions $version -}}
+{{- index $versions $version -}}
+{{- else -}}
+{{- fail (printf "Invalid version '%s'. Available versions: %s" $version (keys $versions | join ", ")) -}}
+{{- end -}}
+{{- end -}}
diff --git a/packages/apps/opensearch/templates/dashboard-resourcemap.yaml b/packages/apps/opensearch/templates/dashboard-resourcemap.yaml
new file mode 100644
index 00000000..91dbf8cb
--- /dev/null
+++ b/packages/apps/opensearch/templates/dashboard-resourcemap.yaml
@@ -0,0 +1,42 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  resourceNames:
+  - {{ .Release.Name }}
+  - {{ .Release.Name }}-external
+  {{- if .Values.dashboards.enabled }}
+  - {{ .Release.Name }}-dashboards
+  - {{ .Release.Name }}-dashboards-external
+  {{- end }}
+  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  resourceNames:
+  - {{ .Release.Name }}-credentials
+  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - cozystack.io
+  resources:
+  - workloadmonitors
+  resourceNames:
+  - {{ .Release.Name }}
+  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
diff --git a/packages/apps/opensearch/templates/external-svc.yaml b/packages/apps/opensearch/templates/external-svc.yaml
new file mode 100644
index 00000000..f28626ab
--- /dev/null
+++ b/packages/apps/opensearch/templates/external-svc.yaml
@@ -0,0 +1,39 @@
+{{- if .Values.external }}
+{{- $clusterDomain := (index .Values._cluster "cluster-domain") | default "cozy.local" }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-external
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: {{ .Release.Name }}.{{ .Release.Namespace }}.{{ $clusterDomain }}
+spec:
+  type: LoadBalancer
+  selector:
+    opster.io/opensearch-cluster: {{ .Release.Name }}
+    opster.io/opensearch-nodepool: nodes
+  ports:
+    - name: https
+      port: 9200
+      targetPort: 9200
+      protocol: TCP
+{{- if .Values.dashboards.enabled }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-dashboards-external
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: {{ .Release.Name }}-dashboards.{{ .Release.Namespace }}.{{ $clusterDomain }}
+spec:
+  type: LoadBalancer
+  selector:
+    opster.io/opensearch-cluster: {{ .Release.Name }}
+    app.kubernetes.io/component: dashboards
+  ports:
+    - name: https
+      port: 5601
+      targetPort: 5601
+      protocol: TCP
+{{- end }}
+{{- end }}
diff --git a/packages/apps/opensearch/templates/opensearch.yaml b/packages/apps/opensearch/templates/opensearch.yaml
new file mode 100644
index 00000000..9917cf5f
--- /dev/null
+++ b/packages/apps/opensearch/templates/opensearch.yaml
@@ -0,0 +1,99 @@
+{{- $topologyMode := .Values.topologySpreadPolicy | default "soft" }}
+{{- $whenUnsatisfiable := "ScheduleAnyway" }}
+{{- if eq $topologyMode "hard" }}
+{{- $whenUnsatisfiable = "DoNotSchedule" }}
+{{- end }}
+---
+apiVersion: opensearch.opster.io/v1
+kind: OpenSearchCluster
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  general:
+    serviceName: {{ .Release.Name }}
+    version: {{ include "opensearch.versionMap" $ }}
+    httpPort: 9200
+    drainDataNodes: true
+    {{- if gt (len .Values.images.opensearch) 0 }}
+    image: {{ .Values.images.opensearch }}
+    {{- end }}
+  bootstrap:
+    resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.resourcesPreset .Values.resources $) | nindent 6 }}
+  security:
+    tls:
+      transport:
+        generate: true
+        perNode: true
+      http:
+        generate: true
+    config:
+      securityConfigSecret:
+        name: {{ .Release.Name }}-security-config
+      adminCredentialsSecret:
+        name: {{ .Release.Name }}-admin-credentials
+  {{- if .Values.dashboards.enabled }}
+  dashboards:
+    enable: true
+    version: {{ include "opensearch.versionMap" $ }}
+    replicas: {{ .Values.dashboards.replicas | default 1 }}
+    tls:
+      enable: true
+      generate: true
+    resources: {{- include "cozy-lib.resources.defaultingSanitize" (list (.Values.dashboards.resourcesPreset | default "medium") .Values.dashboards.resources $) | nindent 6 }}
+  {{- end }}
+  nodePools:
+    - component: nodes
+      replicas: {{ .Values.replicas }}
+      diskSize: {{ .Values.size }}
+      persistence:
+        pvc:
+          accessModes:
+            - ReadWriteOnce
+          {{- if .Values.storageClass }}
+          storageClass: {{ .Values.storageClass }}
+          {{- else if eq (int .Values.replicas) 1 }}
+          storageClass: replicated
+          {{- else }}
+          storageClass: local
+          {{- end }}
+      resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.resourcesPreset .Values.resources $) | nindent 8 }}
+      roles:
+        {{- if .Values.nodeRoles.master }}
+        - cluster_manager
+        {{- end }}
+        {{- if .Values.nodeRoles.data }}
+        - data
+        {{- end }}
+        {{- if .Values.nodeRoles.ingest }}
+        - ingest
+        {{- end }}
+        {{- if .Values.nodeRoles.ml }}
+        - ml
+        {{- end }}
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: {{ $whenUnsatisfiable }}
+          labelSelector:
+            matchLabels:
+              opster.io/opensearch-cluster: {{ .Release.Name }}
+        - maxSkew: 1
+          topologyKey: topology.kubernetes.io/zone
+          whenUnsatisfiable: {{ $whenUnsatisfiable }}
+          labelSelector:
+            matchLabels:
+              opster.io/opensearch-cluster: {{ .Release.Name }}
+---
+# WorkloadMonitor tracks OpenSearch pods
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  replicas: {{ .Values.replicas }}
+  minReplicas: 1
+  kind: opensearch
+  type: opensearch
+  selector:
+    opster.io/opensearch-cluster: {{ .Release.Name }}
+  version: {{ .Chart.Version }}
diff --git a/packages/apps/opensearch/templates/security.yaml b/packages/apps/opensearch/templates/security.yaml
new file mode 100644
index 00000000..d10d353a
--- /dev/null
+++ b/packages/apps/opensearch/templates/security.yaml
@@ -0,0 +1,120 @@
+{{- $clusterDomain := (index .Values._cluster "cluster-domain") | default "cozy.local" }}
+{{- $existingAdminCreds := lookup "v1" "Secret" .Release.Namespace (printf "%s-admin-credentials" .Release.Name) }}
+{{- $existingSecurityConfig := lookup "v1" "Secret" .Release.Namespace (printf "%s-security-config" .Release.Name) }}
+{{- $password := randAlphaNum 32 }}
+{{- if and $existingAdminCreds (hasKey $existingAdminCreds.data "password") }}
+{{- $password = index $existingAdminCreds.data "password" | b64dec }}
+{{- end }}
+---
+# Admin credentials for the OpenSearch operator (referenced by adminCredentialsSecret)
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-admin-credentials
+  labels:
+    app.kubernetes.io/name: opensearch
+    app.kubernetes.io/instance: {{ .Release.Name }}
+type: Opaque
+stringData:
+  username: admin
+  password: {{ $password | quote }}
+---
+# Security plugin configuration (referenced by securityConfigSecret)
+# On upgrades, the existing secret is preserved to avoid bcrypt hash regeneration
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-security-config
+  labels:
+    app.kubernetes.io/name: opensearch
+    app.kubernetes.io/instance: {{ .Release.Name }}
+type: Opaque
+{{- if and $existingSecurityConfig (hasKey $existingSecurityConfig.data "internal_users.yml") }}
+data:
+  {{- range $key, $val := $existingSecurityConfig.data }}
+  {{ $key }}: {{ $val }}
+  {{- end }}
+{{- else }}
+stringData:
+  config.yml: |
+    ---
+    _meta:
+      type: "config"
+      config_version: 2
+    config:
+      dynamic:
+        http:
+          anonymous_auth_enabled: false
+        authc:
+          basic_internal_auth_domain:
+            description: "Authenticate via HTTP Basic against internal users database"
+            http_enabled: true
+            transport_enabled: true
+            order: 0
+            http_authenticator:
+              type: basic
+              challenge: true
+            authentication_backend:
+              type: internal
+
+  internal_users.yml: |
+    ---
+    _meta:
+      type: "internalusers"
+      config_version: 2
+    admin:
+      hash: {{ htpasswd "admin" $password | trimPrefix "admin:" | quote }}
+      reserved: true
+      backend_roles:
+        - "admin"
+      description: "Admin user"
+
+  roles.yml: |
+    ---
+    _meta:
+      type: "roles"
+      config_version: 2
+
+  roles_mapping.yml: |
+    ---
+    _meta:
+      type: "rolesmapping"
+      config_version: 2
+    all_access:
+      reserved: false
+      backend_roles:
+        - "admin"
+
+  action_groups.yml: |
+    ---
+    _meta:
+      type: "actiongroups"
+      config_version: 2
+
+  tenants.yml: |
+    ---
+    _meta:
+      type: "tenants"
+      config_version: 2
+{{- end }}
+---
+# User-facing credentials with connection URI
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-credentials
+  labels:
+    app.kubernetes.io/name: opensearch
+    app.kubernetes.io/instance: {{ .Release.Name }}
+type: Opaque
+stringData:
+  username: admin
+  password: {{ $password | quote }}
+  host: {{ .Release.Name }}.{{ .Release.Namespace }}.svc.{{ $clusterDomain }}
+  port: "9200"
+  uri: https://admin:{{ $password | urlquery }}@{{ .Release.Name }}.{{ .Release.Namespace }}.svc.{{ $clusterDomain }}:9200
+  {{- if .Values.dashboards.enabled }}
+  dashboards-host: {{ .Release.Name }}-dashboards.{{ .Release.Namespace }}.svc.{{ $clusterDomain }}
+  dashboards-port: "5601"
+  dashboards-uri: https://admin:{{ $password | urlquery }}@{{ .Release.Name }}-dashboards.{{ .Release.Namespace }}.svc.{{ $clusterDomain }}:5601
+  {{- end }}
diff --git a/packages/apps/opensearch/templates/users.yaml b/packages/apps/opensearch/templates/users.yaml
new file mode 100644
index 00000000..1d326206
--- /dev/null
+++ b/packages/apps/opensearch/templates/users.yaml
@@ -0,0 +1,21 @@
+{{- range $username, $user := .Values.users }}
+{{- $existingSecret := lookup "v1" "Secret" $.Release.Namespace (printf "%s-user-%s" $.Release.Name $username) }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $.Release.Name }}-user-{{ $username }}
+  labels:
+    opensearch.opster.io/credentials: "true"
+type: kubernetes.io/basic-auth
+stringData:
+  username: {{ $username | quote }}
+  {{- if $user.password }}
+  password: {{ $user.password | quote }}
+  {{- else if and $existingSecret (hasKey $existingSecret.data "password") }}
+  password: {{ index $existingSecret.data "password" | b64dec | quote }}
+  {{- else }}
+  password: {{ randAlphaNum 16 | quote }}
+  {{- end }}
+  roles: {{ $user.roles | default (list "readall") | join "," | quote }}
+{{- end }}
diff --git a/packages/apps/opensearch/tests/opensearch_test.yaml b/packages/apps/opensearch/tests/opensearch_test.yaml
new file mode 100644
index 00000000..78850134
--- /dev/null
+++ b/packages/apps/opensearch/tests/opensearch_test.yaml
@@ -0,0 +1,516 @@
+suite: opensearch CR tests
+
+templates:
+  - templates/opensearch.yaml
+
+tests:
+  ###################
+  # Basic rendering #
+  ###################
+
+  - it: renders OpenSearchCluster and WorkloadMonitor
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - hasDocuments:
+          count: 2
+      - isKind:
+          of: OpenSearchCluster
+        documentIndex: 0
+      - isKind:
+          of: WorkloadMonitor
+        documentIndex: 1
+
+  - it: sets correct CR name
+    release:
+      name: my-opensearch
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - equal:
+          path: metadata.name
+          value: my-opensearch
+        documentIndex: 0
+
+  ##################
+  # Version        #
+  ##################
+
+  - it: defaults to version 2.11.1
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - equal:
+          path: spec.general.version
+          value: "2.11.1"
+        documentIndex: 0
+
+  - it: sets version 3.0.0 when v3 selected
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      version: v3
+    asserts:
+      - equal:
+          path: spec.general.version
+          value: "3.0.0"
+        documentIndex: 0
+
+  - it: sets version 1.3.20 when v1 selected
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      version: v1
+    asserts:
+      - equal:
+          path: spec.general.version
+          value: "1.3.20"
+        documentIndex: 0
+
+  #####################
+  # General           #
+  #####################
+
+  - it: sets drainDataNodes to true
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - equal:
+          path: spec.general.drainDataNodes
+          value: true
+        documentIndex: 0
+
+  - it: sets httpPort to 9200
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - equal:
+          path: spec.general.httpPort
+          value: 9200
+        documentIndex: 0
+
+  #####################
+  # Security          #
+  #####################
+
+  - it: always includes security section with TLS
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - equal:
+          path: spec.security.tls.transport.generate
+          value: true
+        documentIndex: 0
+      - equal:
+          path: spec.security.tls.transport.perNode
+          value: true
+        documentIndex: 0
+      - equal:
+          path: spec.security.tls.http.generate
+          value: true
+        documentIndex: 0
+
+  - it: references security config secret
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - equal:
+          path: spec.security.config.securityConfigSecret.name
+          value: test-os-security-config
+        documentIndex: 0
+
+  - it: references admin credentials secret
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - equal:
+          path: spec.security.config.adminCredentialsSecret.name
+          value: test-os-admin-credentials
+        documentIndex: 0
+
+  - it: does not disable security plugin
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - notExists:
+          path: spec.general.additionalConfig
+        documentIndex: 0
+
+  #####################
+  # Node Pools        #
+  #####################
+
+  - it: sets default replica count to 3
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - equal:
+          path: spec.nodePools[0].replicas
+          value: 3
+        documentIndex: 0
+
+  - it: sets replica count from values
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      replicas: 5
+    asserts:
+      - equal:
+          path: spec.nodePools[0].replicas
+          value: 5
+        documentIndex: 0
+
+  #####################
+  # Node Roles        #
+  #####################
+
+  - it: enables default node roles
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - contains:
+          path: spec.nodePools[0].roles
+          content: cluster_manager
+        documentIndex: 0
+      - contains:
+          path: spec.nodePools[0].roles
+          content: data
+        documentIndex: 0
+      - contains:
+          path: spec.nodePools[0].roles
+          content: ingest
+        documentIndex: 0
+
+  - it: disables master role when configured
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      nodeRoles:
+        master: false
+        data: true
+        ingest: true
+        ml: false
+    asserts:
+      - notContains:
+          path: spec.nodePools[0].roles
+          content: cluster_manager
+        documentIndex: 0
+
+  - it: enables ml role when configured
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      nodeRoles:
+        master: true
+        data: true
+        ingest: true
+        ml: true
+    asserts:
+      - contains:
+          path: spec.nodePools[0].roles
+          content: ml
+        documentIndex: 0
+
+  ###########################
+  # Topology Spread Policy  #
+  ###########################
+
+  - it: uses soft topology spread by default (ScheduleAnyway)
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - equal:
+          path: spec.nodePools[0].topologySpreadConstraints[0].whenUnsatisfiable
+          value: ScheduleAnyway
+        documentIndex: 0
+      - equal:
+          path: spec.nodePools[0].topologySpreadConstraints[1].whenUnsatisfiable
+          value: ScheduleAnyway
+        documentIndex: 0
+
+  - it: uses hard topology spread when configured (DoNotSchedule)
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      topologySpreadPolicy: hard
+    asserts:
+      - equal:
+          path: spec.nodePools[0].topologySpreadConstraints[0].whenUnsatisfiable
+          value: DoNotSchedule
+        documentIndex: 0
+      - equal:
+          path: spec.nodePools[0].topologySpreadConstraints[1].whenUnsatisfiable
+          value: DoNotSchedule
+        documentIndex: 0
+
+  - it: sets correct topology keys
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - equal:
+          path: spec.nodePools[0].topologySpreadConstraints[0].topologyKey
+          value: kubernetes.io/hostname
+        documentIndex: 0
+      - equal:
+          path: spec.nodePools[0].topologySpreadConstraints[1].topologyKey
+          value: topology.kubernetes.io/zone
+        documentIndex: 0
+
+  #####################
+  # Storage           #
+  #####################
+
+  - it: sets accessModes to ReadWriteOnce
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - contains:
+          path: spec.nodePools[0].persistence.pvc.accessModes
+          content: ReadWriteOnce
+        documentIndex: 0
+
+  - it: sets storage size from values
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      size: 50Gi
+    asserts:
+      - equal:
+          path: spec.nodePools[0].diskSize
+          value: 50Gi
+        documentIndex: 0
+
+  - it: uses local storageClass when replicas > 1 and no storageClass
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      storageClass: ""
+      replicas: 3
+    asserts:
+      - equal:
+          path: spec.nodePools[0].persistence.pvc.storageClass
+          value: local
+        documentIndex: 0
+
+  - it: uses replicated storageClass when single replica and no storageClass
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      storageClass: ""
+      replicas: 1
+    asserts:
+      - equal:
+          path: spec.nodePools[0].persistence.pvc.storageClass
+          value: replicated
+        documentIndex: 0
+
+  - it: uses custom storageClass when provided
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      storageClass: fast-ssd
+    asserts:
+      - equal:
+          path: spec.nodePools[0].persistence.pvc.storageClass
+          value: fast-ssd
+        documentIndex: 0
+
+  #####################
+  # Dashboards        #
+  #####################
+
+  - it: does not render dashboards when disabled
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      dashboards:
+        enabled: false
+        replicas: 1
+        resourcesPreset: "medium"
+        resources: {}
+    asserts:
+      - notExists:
+          path: spec.dashboards
+        documentIndex: 0
+
+  - it: renders dashboards when enabled
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      dashboards:
+        enabled: true
+        replicas: 1
+        resourcesPreset: "medium"
+        resources: {}
+    asserts:
+      - equal:
+          path: spec.dashboards.enable
+          value: true
+        documentIndex: 0
+      - equal:
+          path: spec.dashboards.replicas
+          value: 1
+        documentIndex: 0
+      - equal:
+          path: spec.dashboards.tls.enable
+          value: true
+        documentIndex: 0
+      - equal:
+          path: spec.dashboards.tls.generate
+          value: true
+        documentIndex: 0
+
+  ###########################
+  # WorkloadMonitor         #
+  ###########################
+
+  - it: creates WorkloadMonitor with correct metadata
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - equal:
+          path: metadata.name
+          value: test-os
+        documentIndex: 1
+      - equal:
+          path: spec.kind
+          value: opensearch
+        documentIndex: 1
+      - equal:
+          path: spec.type
+          value: opensearch
+        documentIndex: 1
+
+  - it: sets replicas in WorkloadMonitor
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      replicas: 5
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 5
+        documentIndex: 1
+
+  - it: sets minReplicas to 1
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - equal:
+          path: spec.minReplicas
+          value: 1
+        documentIndex: 1
+
+  - it: sets correct selector labels
+    release:
+      name: mydb
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - equal:
+          path: spec.selector["opster.io/opensearch-cluster"]
+          value: mydb
+        documentIndex: 1
diff --git a/packages/apps/opensearch/tests/security_test.yaml b/packages/apps/opensearch/tests/security_test.yaml
new file mode 100644
index 00000000..cd8740d9
--- /dev/null
+++ b/packages/apps/opensearch/tests/security_test.yaml
@@ -0,0 +1,207 @@
+suite: security secrets tests
+
+templates:
+  - templates/security.yaml
+
+tests:
+  ###################
+  # Basic rendering #
+  ###################
+
+  - it: renders three secrets (admin-credentials, security-config, credentials)
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - hasDocuments:
+          count: 3
+
+  ###########################
+  # Admin credentials       #
+  ###########################
+
+  - it: sets admin-credentials secret name
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - equal:
+          path: metadata.name
+          value: test-os-admin-credentials
+        documentIndex: 0
+
+  - it: sets admin username
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - equal:
+          path: stringData.username
+          value: admin
+        documentIndex: 0
+
+  - it: generates a 32-char alphanumeric password
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - matchRegex:
+          path: stringData.password
+          pattern: "^[a-zA-Z0-9]{32}$"
+        documentIndex: 0
+
+  ###########################
+  # Security config         #
+  ###########################
+
+  - it: sets security-config secret name
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - equal:
+          path: metadata.name
+          value: test-os-security-config
+        documentIndex: 1
+
+  - it: includes config.yml with basic auth
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - exists:
+          path: stringData["config.yml"]
+        documentIndex: 1
+
+  - it: includes internal_users.yml with bcrypt hash
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - matchRegex:
+          path: stringData["internal_users.yml"]
+          pattern: "hash:.*\\$2a\\$"
+        documentIndex: 1
+
+  - it: includes roles_mapping.yml
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - exists:
+          path: stringData["roles_mapping.yml"]
+        documentIndex: 1
+
+  ###########################
+  # User-facing credentials #
+  ###########################
+
+  - it: sets credentials secret name
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - equal:
+          path: metadata.name
+          value: test-os-credentials
+        documentIndex: 2
+
+  - it: sets correct host and port
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - equal:
+          path: stringData.host
+          value: test-os.tenant-test.svc.cozy.local
+        documentIndex: 2
+      - equal:
+          path: stringData.port
+          value: "9200"
+        documentIndex: 2
+
+  - it: sets https URI with credentials
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - matchRegex:
+          path: stringData.uri
+          pattern: "^https://admin:[a-zA-Z0-9]{32}@test-os\\.tenant-test\\.svc\\.cozy\\.local:9200$"
+        documentIndex: 2
+
+  - it: does not include dashboards fields when dashboards disabled
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      dashboards:
+        enabled: false
+        replicas: 1
+        resourcesPreset: "medium"
+        resources: {}
+    asserts:
+      - notExists:
+          path: stringData.dashboards-host
+        documentIndex: 2
+
+  - it: includes dashboards fields when dashboards enabled
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      dashboards:
+        enabled: true
+        replicas: 1
+        resourcesPreset: "medium"
+        resources: {}
+    asserts:
+      - equal:
+          path: stringData.dashboards-host
+          value: test-os-dashboards.tenant-test.svc.cozy.local
+        documentIndex: 2
+      - equal:
+          path: stringData.dashboards-port
+          value: "5601"
+        documentIndex: 2
+      - matchRegex:
+          path: stringData.dashboards-uri
+          pattern: "^https://admin:[a-zA-Z0-9]{32}@test-os-dashboards\\.tenant-test\\.svc\\.cozy\\.local:5601$"
+        documentIndex: 2
diff --git a/packages/apps/opensearch/tests/users_test.yaml b/packages/apps/opensearch/tests/users_test.yaml
new file mode 100644
index 00000000..f6b4990e
--- /dev/null
+++ b/packages/apps/opensearch/tests/users_test.yaml
@@ -0,0 +1,176 @@
+suite: users secrets tests
+
+templates:
+  - templates/users.yaml
+
+tests:
+  ###################
+  # Basic rendering #
+  ###################
+
+  - it: does not render secrets when no users defined
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      users: {}
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: renders one secret per user
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      users:
+        user1:
+          roles:
+            - readall
+        user2:
+          roles:
+            - all_access
+    asserts:
+      - hasDocuments:
+          count: 2
+
+  #####################
+  # Secret metadata   #
+  #####################
+
+  - it: sets correct secret name
+    release:
+      name: my-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      users:
+        myuser:
+          roles:
+            - readall
+    asserts:
+      - equal:
+          path: metadata.name
+          value: my-os-user-myuser
+
+  - it: sets opensearch credentials label
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      users:
+        myuser:
+          roles:
+            - readall
+    asserts:
+      - equal:
+          path: metadata.labels["opensearch.opster.io/credentials"]
+          value: "true"
+
+  - it: uses basic-auth secret type
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      users:
+        myuser:
+          roles:
+            - readall
+    asserts:
+      - equal:
+          path: type
+          value: kubernetes.io/basic-auth
+
+  #####################
+  # Secret data       #
+  #####################
+
+  - it: sets username in secret
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      users:
+        testuser:
+          roles:
+            - readall
+    asserts:
+      - equal:
+          path: stringData.username
+          value: testuser
+
+  - it: uses provided password
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      users:
+        myuser:
+          password: mysecretpassword
+          roles:
+            - readall
+    asserts:
+      - equal:
+          path: stringData.password
+          value: mysecretpassword
+
+  - it: generates password when not provided
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      users:
+        myuser:
+          roles:
+            - readall
+    asserts:
+      - matchRegex:
+          path: stringData.password
+          pattern: "^[a-zA-Z0-9]{16}$"
+
+  - it: sets roles as comma-separated string
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      users:
+        myuser:
+          roles:
+            - readall
+            - reporting_user
+            - monitoring_user
+    asserts:
+      - equal:
+          path: stringData.roles
+          value: "readall,reporting_user,monitoring_user"
+
+  - it: defaults to readall role when no roles specified
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      users:
+        myuser: {}
+    asserts:
+      - equal:
+          path: stringData.roles
+          value: "readall"
diff --git a/packages/apps/opensearch/values.schema.json b/packages/apps/opensearch/values.schema.json
new file mode 100644
index 00000000..54a6bb00
--- /dev/null
+++ b/packages/apps/opensearch/values.schema.json
@@ -0,0 +1,239 @@
+{
+  "title": "Chart Values",
+  "type": "object",
+  "properties": {
+    "dashboards": {
+      "description": "OpenSearch Dashboards configuration.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "enabled",
+        "replicas",
+        "resourcesPreset"
+      ],
+      "properties": {
+        "enabled": {
+          "description": "Enable OpenSearch Dashboards deployment.",
+          "type": "boolean",
+          "default": false
+        },
+        "replicas": {
+          "description": "Number of Dashboards replicas.",
+          "type": "integer",
+          "default": 1
+        },
+        "resources": {
+          "description": "Explicit CPU and memory configuration for Dashboards.",
+          "type": "object",
+          "default": {},
+          "properties": {
+            "cpu": {
+              "description": "CPU available to each node.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            },
+            "memory": {
+              "description": "Memory (RAM) available to each node.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            }
+          }
+        },
+        "resourcesPreset": {
+          "description": "Default sizing preset for Dashboards.",
+          "type": "string",
+          "default": "medium",
+          "enum": [
+            "nano",
+            "micro",
+            "small",
+            "medium",
+            "large",
+            "xlarge",
+            "2xlarge"
+          ]
+        }
+      }
+    },
+    "external": {
+      "description": "Enable external access from outside the cluster.",
+      "type": "boolean",
+      "default": false
+    },
+    "images": {
+      "description": "Container images used by the operator.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "opensearch"
+      ],
+      "properties": {
+        "opensearch": {
+          "description": "OpenSearch image.",
+          "type": "string",
+          "default": ""
+        }
+      }
+    },
+    "nodeRoles": {
+      "description": "Node roles configuration.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "data",
+        "ingest",
+        "master",
+        "ml"
+      ],
+      "properties": {
+        "data": {
+          "description": "Enable data role.",
+          "type": "boolean",
+          "default": true
+        },
+        "ingest": {
+          "description": "Enable ingest role.",
+          "type": "boolean",
+          "default": true
+        },
+        "master": {
+          "description": "Enable cluster_manager role.",
+          "type": "boolean",
+          "default": true
+        },
+        "ml": {
+          "description": "Enable machine learning role.",
+          "type": "boolean",
+          "default": false
+        }
+      }
+    },
+    "replicas": {
+      "description": "Number of OpenSearch nodes in the cluster.",
+      "type": "integer",
+      "default": 3
+    },
+    "resources": {
+      "description": "Explicit CPU and memory configuration for each OpenSearch node. When omitted, the preset defined in `resourcesPreset` is applied.",
+      "type": "object",
+      "default": {},
+      "properties": {
+        "cpu": {
+          "description": "CPU available to each node.",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        },
+        "memory": {
+          "description": "Memory (RAM) available to each node.",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        }
+      }
+    },
+    "resourcesPreset": {
+      "description": "Default sizing preset used when `resources` is omitted. OpenSearch requires minimum 2Gi memory.",
+      "type": "string",
+      "default": "large",
+      "enum": [
+        "nano",
+        "micro",
+        "small",
+        "medium",
+        "large",
+        "xlarge",
+        "2xlarge"
+      ]
+    },
+    "size": {
+      "description": "Persistent Volume Claim size available for application data.",
+      "default": "10Gi",
+      "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+      "anyOf": [
+        {
+          "type": "integer"
+        },
+        {
+          "type": "string"
+        }
+      ],
+      "x-kubernetes-int-or-string": true
+    },
+    "storageClass": {
+      "description": "StorageClass used to store the data.",
+      "type": "string",
+      "default": ""
+    },
+    "topologySpreadPolicy": {
+      "description": "How strictly to enforce pod distribution across nodes and zones.",
+      "type": "string",
+      "default": "soft",
+      "enum": [
+        "soft",
+        "hard"
+      ]
+    },
+    "users": {
+      "description": "Custom OpenSearch users configuration map.",
+      "type": "object",
+      "default": {},
+      "additionalProperties": {
+        "type": "object",
+        "properties": {
+          "password": {
+            "description": "Password for the user (auto-generated if omitted).",
+            "type": "string"
+          },
+          "roles": {
+            "description": "List of OpenSearch roles.",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      }
+    },
+    "version": {
+      "description": "OpenSearch major version to deploy.",
+      "type": "string",
+      "default": "v2",
+      "enum": [
+        "v3",
+        "v2",
+        "v1"
+      ]
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/apps/opensearch/values.yaml b/packages/apps/opensearch/values.yaml
new file mode 100644
index 00000000..8de805e3
--- /dev/null
+++ b/packages/apps/opensearch/values.yaml
@@ -0,0 +1,111 @@
+##
+## @section Common parameters
+##
+
+## @typedef {struct} Resources - Explicit CPU and memory configuration for each OpenSearch node.
+## @field {quantity} [cpu] - CPU available to each node.
+## @field {quantity} [memory] - Memory (RAM) available to each node.
+
+## @enum {string} ResourcesPreset - Default sizing preset.
+## @value nano
+## @value micro
+## @value small
+## @value medium
+## @value large
+## @value xlarge
+## @value 2xlarge
+
+## @param {int} replicas - Number of OpenSearch nodes in the cluster.
+replicas: 3
+
+## @param {Resources} [resources] - Explicit CPU and memory configuration for each OpenSearch node. When omitted, the preset defined in `resourcesPreset` is applied.
+resources: {}
+
+## @param {ResourcesPreset} resourcesPreset="large" - Default sizing preset used when `resources` is omitted. OpenSearch requires minimum 2Gi memory.
+resourcesPreset: "large"
+
+## @param {quantity} size - Persistent Volume Claim size available for application data.
+size: 10Gi
+
+## @param {string} storageClass - StorageClass used to store the data.
+storageClass: ""
+
+## @param {bool} external - Enable external access from outside the cluster.
+external: false
+
+## @enum {string} TopologySpreadPolicy - Pod distribution policy across nodes/zones.
+## @value soft - Best-effort distribution (ScheduleAnyway) - pods may be scheduled on same node if needed
+## @value hard - Strict distribution (DoNotSchedule) - pods will not schedule if spread cannot be achieved
+
+## @param {TopologySpreadPolicy} topologySpreadPolicy="soft" - How strictly to enforce pod distribution across nodes and zones.
+topologySpreadPolicy: "soft"
+
+##
+## @enum {string} Version
+## @value v3
+## @value v2
+## @value v1
+
+## @param {Version} version - OpenSearch major version to deploy.
+version: v2
+
+##
+## @section Image configuration
+##
+
+## @typedef {struct} Images - Container image configuration.
+## @field {string} opensearch - OpenSearch image.
+
+## @param {Images} images - Container images used by the operator.
+images:
+  opensearch: ""
+
+##
+## @section Node roles configuration
+##
+
+## @typedef {struct} NodeRoles - OpenSearch node roles.
+## @field {bool} master - Enable cluster_manager role.
+## @field {bool} data - Enable data role.
+## @field {bool} ingest - Enable ingest role.
+## @field {bool} ml - Enable machine learning role.
+
+## @param {NodeRoles} nodeRoles - Node roles configuration.
+nodeRoles:
+  master: true
+  data: true
+  ingest: true
+  ml: false
+
+##
+## @section Users configuration
+##
+
+## @typedef {struct} User - User configuration.
+## @field {string} [password] - Password for the user (auto-generated if omitted).
+## @field {[]string} roles - List of OpenSearch roles.
+
+## @param {map[string]User} users - Custom OpenSearch users configuration map.
+users: {}
+## Example:
+## users:
+##   myuser:
+##     roles:
+##       - all_access
+
+##
+## @section OpenSearch Dashboards configuration
+##
+
+## @typedef {struct} Dashboards - OpenSearch Dashboards deployment configuration.
+## @field {bool} enabled - Enable OpenSearch Dashboards deployment.
+## @field {int} replicas - Number of Dashboards replicas.
+## @field {Resources} [resources] - Explicit CPU and memory configuration for Dashboards.
+## @field {ResourcesPreset} resourcesPreset - Default sizing preset for Dashboards.
+
+## @param {Dashboards} dashboards - OpenSearch Dashboards configuration.
+dashboards:
+  enabled: false
+  replicas: 1
+  resources: {}
+  resourcesPreset: "medium"
diff --git a/packages/system/opensearch-operator/.helmignore b/packages/system/opensearch-operator/.helmignore
new file mode 100644
index 00000000..0e8a0eb3
--- /dev/null
+++ b/packages/system/opensearch-operator/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/packages/system/opensearch-operator/Chart.yaml b/packages/system/opensearch-operator/Chart.yaml
new file mode 100644
index 00000000..a991bdca
--- /dev/null
+++ b/packages/system/opensearch-operator/Chart.yaml
@@ -0,0 +1,3 @@
+apiVersion: v2
+name: cozy-opensearch-operator
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
diff --git a/packages/system/opensearch-operator/Makefile b/packages/system/opensearch-operator/Makefile
new file mode 100644
index 00000000..71b94549
--- /dev/null
+++ b/packages/system/opensearch-operator/Makefile
@@ -0,0 +1,10 @@
+export NAME=opensearch-operator
+export NAMESPACE=cozy-$(NAME)
+
+include ../../../hack/package.mk
+
+update:
+	rm -rf charts
+	helm repo add opensearch-operator https://opensearch-project.github.io/opensearch-k8s-operator/
+	helm repo update opensearch-operator
+	helm pull opensearch-operator/opensearch-operator --untar --untardir charts
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/CHANGELOG.md b/packages/system/opensearch-operator/charts/opensearch-operator/CHANGELOG.md
new file mode 100644
index 00000000..1866ab55
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/CHANGELOG.md
@@ -0,0 +1,61 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+---
+## [Unreleased]
+### Added
+- Added support for custom image used by `kubeRbacProxy`.
+### Changed
+### Deprecated
+### Removed
+### Fixed
+### Security
+
+---
+## [2.0.0]
+### Added
+### Changed
+- Modified `version` to `2.0.0` and `appVersion` to `v2.0`.
+- Allow chart image tag to pick from `appVersion`, unless explicitly passed `tag` values in `values.yaml` file.
+### Deprecated
+### Removed
+### Fixed
+### Security
+
+---
+## [1.0.3]
+### Added
+### Changed
+- Added missing spec `dashboards.additionalConfig`
+### Deprecated
+### Removed
+### Fixed
+### Security
+
+---
+## [1.0.2]
+### Added
+### Changed
+- Added README.md file to charts/ folder.
+### Deprecated
+### Removed
+### Fixed
+### Security
+
+---
+## [1.0.1]
+### Added
+### Changed
+- Updated version to 1.0.1
+### Deprecated
+### Removed
+### Fixed
+### Security
+
+[Unreleased]: https://github.com/opensearch-project/opensearch-k8s-operator/compare/opensearch-operator-2.0.0...HEAD
+[2.0.0]: https://github.com/opensearch-project/opensearch-k8s-operator/compare/opensearch-operator-1.0.3...opensearch-operator-2.0.0
+[1.0.3]: https://github.com/opensearch-project/opensearch-k8s-operator/compare/opensearch-operator-1.0.2...opensearch-operator-1.0.3
+[1.0.2]: https://github.com/opensearch-project/opensearch-k8s-operator/compare/opensearch-operator-1.0.1...opensearch-operator-1.0.2
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/Chart.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/Chart.yaml
new file mode 100644
index 00000000..331cf1e2
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/Chart.yaml
@@ -0,0 +1,6 @@
+apiVersion: v2
+appVersion: 2.8.0
+description: The OpenSearch Operator Helm chart for Kubernetes
+name: opensearch-operator
+type: application
+version: 2.8.0
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/README.md b/packages/system/opensearch-operator/charts/opensearch-operator/README.md
new file mode 100644
index 00000000..dc63c250
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/README.md
@@ -0,0 +1,29 @@
+# OpenSearch-k8s-operator
+
+The Kubernetes [OpenSearch Operator](https://github.com/opensearch-project/opensearch-k8s-operator) is used for automating the deployment, provisioning, management, and orchestration of OpenSearch clusters and OpenSearch dashboards.
+
+## Getting started
+
+The Operator can be easily installed using helm on any CNCF-certified Kubernetes cluster. Please refer to the [User Guide](https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md) for more information.
+
+### Installation Using Helm
+
+#### Get Repo Info
+```
+helm repo add opensearch-operator https://opensearch-project.github.io/opensearch-k8s-operator/
+helm repo update
+```
+#### Install Chart
+```
+helm install [RELEASE_NAME] opensearch-operator/opensearch-operator
+```
+#### Uninstall Chart
+```
+helm uninstall [RELEASE_NAME]
+```
+#### Upgrade Chart
+```
+helm repo update
+helm upgrade [RELEASE_NAME] opensearch-operator/opensearch-operator
+```
+
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchactiongroups.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchactiongroups.yaml
new file mode 100644
index 00000000..8ba4c7b2
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchactiongroups.yaml
@@ -0,0 +1,94 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.16.0
+  name: opensearchactiongroups.opensearch.opster.io
+spec:
+  group: opensearch.opster.io
+  names:
+    kind: OpensearchActionGroup
+    listKind: OpensearchActionGroupList
+    plural: opensearchactiongroups
+    shortNames:
+    - opensearchactiongroup
+    singular: opensearchactiongroup
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: OpensearchActionGroup is the Schema for the opensearchactiongroups
+          API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: OpensearchActionGroupSpec defines the desired state of OpensearchActionGroup
+            properties:
+              allowedActions:
+                items:
+                  type: string
+                type: array
+              description:
+                type: string
+              opensearchCluster:
+                description: |-
+                  LocalObjectReference contains enough information to let you locate the
+                  referenced object inside the same namespace.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+              type:
+                type: string
+            required:
+            - allowedActions
+            - opensearchCluster
+            type: object
+          status:
+            description: OpensearchActionGroupStatus defines the observed state of
+              OpensearchActionGroup
+            properties:
+              existingActionGroup:
+                type: boolean
+              managedCluster:
+                description: |-
+                  UID is a type that holds unique ID values, including UUIDs.  Because we
+                  don't ONLY use UUIDs, this is an alias to string.  Being a type captures
+                  intent and helps make sure that UIDs and names do not get conflated.
+                type: string
+              reason:
+                type: string
+              state:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchclusters.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchclusters.yaml
new file mode 100644
index 00000000..063bbd00
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchclusters.yaml
@@ -0,0 +1,6372 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.16.0
+  name: opensearchclusters.opensearch.opster.io
+spec:
+  group: opensearch.opster.io
+  names:
+    kind: OpenSearchCluster
+    listKind: OpenSearchClusterList
+    plural: opensearchclusters
+    shortNames:
+    - os
+    - opensearch
+    singular: opensearchcluster
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.health
+      name: health
+      type: string
+    - description: Available nodes
+      jsonPath: .status.availableNodes
+      name: nodes
+      type: integer
+    - description: Opensearch version
+      jsonPath: .status.version
+      name: version
+      type: string
+    - jsonPath: .status.phase
+      name: phase
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: age
+      type: date
+    name: v1
+    schema:
+      openAPIV3Schema:
+        description: Es is the Schema for the es API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: ClusterSpec defines the desired state of OpenSearchCluster
+            properties:
+              bootstrap:
+                properties:
+                  additionalConfig:
+                    additionalProperties:
+                      type: string
+                    description: Extra items to add to the opensearch.yml, defaults
+                      to General.AdditionalConfig
+                    type: object
+                  affinity:
+                    description: Affinity is a group of affinity scheduling rules.
+                    properties:
+                      nodeAffinity:
+                        description: Describes node affinity scheduling rules for
+                          the pod.
+                        properties:
+                          preferredDuringSchedulingIgnoredDuringExecution:
+                            description: |-
+                              The scheduler will prefer to schedule pods to nodes that satisfy
+                              the affinity expressions specified by this field, but it may choose
+                              a node that violates one or more of the expressions. The node that is
+                              most preferred is the one with the greatest sum of weights, i.e.
+                              for each node that meets all of the scheduling requirements (resource
+                              request, requiredDuringScheduling affinity expressions, etc.),
+                              compute a sum by iterating through the elements of this field and adding
+                              "weight" to the sum if the node matches the corresponding matchExpressions; the
+                              node(s) with the highest sum are the most preferred.
+                            items:
+                              description: |-
+                                An empty preferred scheduling term matches all objects with implicit weight 0
+                                (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+                              properties:
+                                preference:
+                                  description: A node selector term, associated with
+                                    the corresponding weight.
+                                  properties:
+                                    matchExpressions:
+                                      description: A list of node selector requirements
+                                        by node's labels.
+                                      items:
+                                        description: |-
+                                          A node selector requirement is a selector that contains values, a key, and an operator
+                                          that relates the key and values.
+                                        properties:
+                                          key:
+                                            description: The label key that the selector
+                                              applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              Represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              An array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. If the operator is Gt or Lt, the values
+                                              array must have a single element, which will be interpreted as an integer.
+                                              This array is replaced during a strategic merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchFields:
+                                      description: A list of node selector requirements
+                                        by node's fields.
+                                      items:
+                                        description: |-
+                                          A node selector requirement is a selector that contains values, a key, and an operator
+                                          that relates the key and values.
+                                        properties:
+                                          key:
+                                            description: The label key that the selector
+                                              applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              Represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              An array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. If the operator is Gt or Lt, the values
+                                              array must have a single element, which will be interpreted as an integer.
+                                              This array is replaced during a strategic merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                weight:
+                                  description: Weight associated with matching the
+                                    corresponding nodeSelectorTerm, in the range 1-100.
+                                  format: int32
+                                  type: integer
+                              required:
+                              - preference
+                              - weight
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          requiredDuringSchedulingIgnoredDuringExecution:
+                            description: |-
+                              If the affinity requirements specified by this field are not met at
+                              scheduling time, the pod will not be scheduled onto the node.
+                              If the affinity requirements specified by this field cease to be met
+                              at some point during pod execution (e.g. due to an update), the system
+                              may or may not try to eventually evict the pod from its node.
+                            properties:
+                              nodeSelectorTerms:
+                                description: Required. A list of node selector terms.
+                                  The terms are ORed.
+                                items:
+                                  description: |-
+                                    A null or empty node selector term matches no objects. The requirements of
+                                    them are ANDed.
+                                    The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+                                  properties:
+                                    matchExpressions:
+                                      description: A list of node selector requirements
+                                        by node's labels.
+                                      items:
+                                        description: |-
+                                          A node selector requirement is a selector that contains values, a key, and an operator
+                                          that relates the key and values.
+                                        properties:
+                                          key:
+                                            description: The label key that the selector
+                                              applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              Represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              An array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. If the operator is Gt or Lt, the values
+                                              array must have a single element, which will be interpreted as an integer.
+                                              This array is replaced during a strategic merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchFields:
+                                      description: A list of node selector requirements
+                                        by node's fields.
+                                      items:
+                                        description: |-
+                                          A node selector requirement is a selector that contains values, a key, and an operator
+                                          that relates the key and values.
+                                        properties:
+                                          key:
+                                            description: The label key that the selector
+                                              applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              Represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              An array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. If the operator is Gt or Lt, the values
+                                              array must have a single element, which will be interpreted as an integer.
+                                              This array is replaced during a strategic merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                type: array
+                                x-kubernetes-list-type: atomic
+                            required:
+                            - nodeSelectorTerms
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        type: object
+                      podAffinity:
+                        description: Describes pod affinity scheduling rules (e.g.
+                          co-locate this pod in the same node, zone, etc. as some
+                          other pod(s)).
+                        properties:
+                          preferredDuringSchedulingIgnoredDuringExecution:
+                            description: |-
+                              The scheduler will prefer to schedule pods to nodes that satisfy
+                              the affinity expressions specified by this field, but it may choose
+                              a node that violates one or more of the expressions. The node that is
+                              most preferred is the one with the greatest sum of weights, i.e.
+                              for each node that meets all of the scheduling requirements (resource
+                              request, requiredDuringScheduling affinity expressions, etc.),
+                              compute a sum by iterating through the elements of this field and adding
+                              "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                              node(s) with the highest sum are the most preferred.
+                            items:
+                              description: The weights of all of the matched WeightedPodAffinityTerm
+                                fields are added per-node to find the most preferred
+                                node(s)
+                              properties:
+                                podAffinityTerm:
+                                  description: Required. A pod affinity term, associated
+                                    with the corresponding weight.
+                                  properties:
+                                    labelSelector:
+                                      description: |-
+                                        A label query over a set of resources, in this case pods.
+                                        If it's null, this PodAffinityTerm matches with no Pods.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    matchLabelKeys:
+                                      description: |-
+                                        MatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mismatchLabelKeys:
+                                      description: |-
+                                        MismatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    namespaceSelector:
+                                      description: |-
+                                        A label query over the set of namespaces that the term applies to.
+                                        The term is applied to the union of the namespaces selected by this field
+                                        and the ones listed in the namespaces field.
+                                        null selector and null or empty namespaces list means "this pod's namespace".
+                                        An empty selector ({}) matches all namespaces.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    namespaces:
+                                      description: |-
+                                        namespaces specifies a static list of namespace names that the term applies to.
+                                        The term is applied to the union of the namespaces listed in this field
+                                        and the ones selected by namespaceSelector.
+                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    topologyKey:
+                                      description: |-
+                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                        whose value of the label with key topologyKey matches that of any node on which any of the
+                                        selected pods is running.
+                                        Empty topologyKey is not allowed.
+                                      type: string
+                                  required:
+                                  - topologyKey
+                                  type: object
+                                weight:
+                                  description: |-
+                                    weight associated with matching the corresponding podAffinityTerm,
+                                    in the range 1-100.
+                                  format: int32
+                                  type: integer
+                              required:
+                              - podAffinityTerm
+                              - weight
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          requiredDuringSchedulingIgnoredDuringExecution:
+                            description: |-
+                              If the affinity requirements specified by this field are not met at
+                              scheduling time, the pod will not be scheduled onto the node.
+                              If the affinity requirements specified by this field cease to be met
+                              at some point during pod execution (e.g. due to a pod label update), the
+                              system may or may not try to eventually evict the pod from its node.
+                              When there are multiple elements, the lists of nodes corresponding to each
+                              podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                            items:
+                              description: |-
+                                Defines a set of pods (namely those matching the labelSelector
+                                relative to the given namespace(s)) that this pod should be
+                                co-located (affinity) or not co-located (anti-affinity) with,
+                                where co-located is defined as running on a node whose value of
+                                the label with key <topologyKey> matches that of any node on which
+                                a pod of the set of pods is running
+                              properties:
+                                labelSelector:
+                                  description: |-
+                                    A label query over a set of resources, in this case pods.
+                                    If it's null, this PodAffinityTerm matches with no Pods.
+                                  properties:
+                                    matchExpressions:
+                                      description: matchExpressions is a list of label
+                                        selector requirements. The requirements are
+                                        ANDed.
+                                      items:
+                                        description: |-
+                                          A label selector requirement is a selector that contains values, a key, and an operator that
+                                          relates the key and values.
+                                        properties:
+                                          key:
+                                            description: key is the label key that
+                                              the selector applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              operator represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists and DoesNotExist.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              values is an array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. This array is replaced during a strategic
+                                              merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchLabels:
+                                      additionalProperties:
+                                        type: string
+                                      description: |-
+                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                      type: object
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                matchLabelKeys:
+                                  description: |-
+                                    MatchLabelKeys is a set of pod label keys to select which pods will
+                                    be taken into consideration. The keys are used to lookup values from the
+                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                    to select the group of existing pods which pods will be taken into consideration
+                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                    pod labels will be ignored. The default value is empty.
+                                    The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                    Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                mismatchLabelKeys:
+                                  description: |-
+                                    MismatchLabelKeys is a set of pod label keys to select which pods will
+                                    be taken into consideration. The keys are used to lookup values from the
+                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                    to select the group of existing pods which pods will be taken into consideration
+                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                    pod labels will be ignored. The default value is empty.
+                                    The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                    Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                namespaceSelector:
+                                  description: |-
+                                    A label query over the set of namespaces that the term applies to.
+                                    The term is applied to the union of the namespaces selected by this field
+                                    and the ones listed in the namespaces field.
+                                    null selector and null or empty namespaces list means "this pod's namespace".
+                                    An empty selector ({}) matches all namespaces.
+                                  properties:
+                                    matchExpressions:
+                                      description: matchExpressions is a list of label
+                                        selector requirements. The requirements are
+                                        ANDed.
+                                      items:
+                                        description: |-
+                                          A label selector requirement is a selector that contains values, a key, and an operator that
+                                          relates the key and values.
+                                        properties:
+                                          key:
+                                            description: key is the label key that
+                                              the selector applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              operator represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists and DoesNotExist.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              values is an array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. This array is replaced during a strategic
+                                              merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchLabels:
+                                      additionalProperties:
+                                        type: string
+                                      description: |-
+                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                      type: object
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                namespaces:
+                                  description: |-
+                                    namespaces specifies a static list of namespace names that the term applies to.
+                                    The term is applied to the union of the namespaces listed in this field
+                                    and the ones selected by namespaceSelector.
+                                    null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                topologyKey:
+                                  description: |-
+                                    This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                    the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                    whose value of the label with key topologyKey matches that of any node on which any of the
+                                    selected pods is running.
+                                    Empty topologyKey is not allowed.
+                                  type: string
+                              required:
+                              - topologyKey
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                        type: object
+                      podAntiAffinity:
+                        description: Describes pod anti-affinity scheduling rules
+                          (e.g. avoid putting this pod in the same node, zone, etc.
+                          as some other pod(s)).
+                        properties:
+                          preferredDuringSchedulingIgnoredDuringExecution:
+                            description: |-
+                              The scheduler will prefer to schedule pods to nodes that satisfy
+                              the anti-affinity expressions specified by this field, but it may choose
+                              a node that violates one or more of the expressions. The node that is
+                              most preferred is the one with the greatest sum of weights, i.e.
+                              for each node that meets all of the scheduling requirements (resource
+                              request, requiredDuringScheduling anti-affinity expressions, etc.),
+                              compute a sum by iterating through the elements of this field and adding
+                              "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                              node(s) with the highest sum are the most preferred.
+                            items:
+                              description: The weights of all of the matched WeightedPodAffinityTerm
+                                fields are added per-node to find the most preferred
+                                node(s)
+                              properties:
+                                podAffinityTerm:
+                                  description: Required. A pod affinity term, associated
+                                    with the corresponding weight.
+                                  properties:
+                                    labelSelector:
+                                      description: |-
+                                        A label query over a set of resources, in this case pods.
+                                        If it's null, this PodAffinityTerm matches with no Pods.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    matchLabelKeys:
+                                      description: |-
+                                        MatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mismatchLabelKeys:
+                                      description: |-
+                                        MismatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    namespaceSelector:
+                                      description: |-
+                                        A label query over the set of namespaces that the term applies to.
+                                        The term is applied to the union of the namespaces selected by this field
+                                        and the ones listed in the namespaces field.
+                                        null selector and null or empty namespaces list means "this pod's namespace".
+                                        An empty selector ({}) matches all namespaces.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    namespaces:
+                                      description: |-
+                                        namespaces specifies a static list of namespace names that the term applies to.
+                                        The term is applied to the union of the namespaces listed in this field
+                                        and the ones selected by namespaceSelector.
+                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    topologyKey:
+                                      description: |-
+                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                        whose value of the label with key topologyKey matches that of any node on which any of the
+                                        selected pods is running.
+                                        Empty topologyKey is not allowed.
+                                      type: string
+                                  required:
+                                  - topologyKey
+                                  type: object
+                                weight:
+                                  description: |-
+                                    weight associated with matching the corresponding podAffinityTerm,
+                                    in the range 1-100.
+                                  format: int32
+                                  type: integer
+                              required:
+                              - podAffinityTerm
+                              - weight
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          requiredDuringSchedulingIgnoredDuringExecution:
+                            description: |-
+                              If the anti-affinity requirements specified by this field are not met at
+                              scheduling time, the pod will not be scheduled onto the node.
+                              If the anti-affinity requirements specified by this field cease to be met
+                              at some point during pod execution (e.g. due to a pod label update), the
+                              system may or may not try to eventually evict the pod from its node.
+                              When there are multiple elements, the lists of nodes corresponding to each
+                              podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                            items:
+                              description: |-
+                                Defines a set of pods (namely those matching the labelSelector
+                                relative to the given namespace(s)) that this pod should be
+                                co-located (affinity) or not co-located (anti-affinity) with,
+                                where co-located is defined as running on a node whose value of
+                                the label with key <topologyKey> matches that of any node on which
+                                a pod of the set of pods is running
+                              properties:
+                                labelSelector:
+                                  description: |-
+                                    A label query over a set of resources, in this case pods.
+                                    If it's null, this PodAffinityTerm matches with no Pods.
+                                  properties:
+                                    matchExpressions:
+                                      description: matchExpressions is a list of label
+                                        selector requirements. The requirements are
+                                        ANDed.
+                                      items:
+                                        description: |-
+                                          A label selector requirement is a selector that contains values, a key, and an operator that
+                                          relates the key and values.
+                                        properties:
+                                          key:
+                                            description: key is the label key that
+                                              the selector applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              operator represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists and DoesNotExist.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              values is an array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. This array is replaced during a strategic
+                                              merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchLabels:
+                                      additionalProperties:
+                                        type: string
+                                      description: |-
+                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                      type: object
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                matchLabelKeys:
+                                  description: |-
+                                    MatchLabelKeys is a set of pod label keys to select which pods will
+                                    be taken into consideration. The keys are used to lookup values from the
+                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                    to select the group of existing pods which pods will be taken into consideration
+                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                    pod labels will be ignored. The default value is empty.
+                                    The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                    Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                mismatchLabelKeys:
+                                  description: |-
+                                    MismatchLabelKeys is a set of pod label keys to select which pods will
+                                    be taken into consideration. The keys are used to lookup values from the
+                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                    to select the group of existing pods which pods will be taken into consideration
+                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                    pod labels will be ignored. The default value is empty.
+                                    The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                    Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                namespaceSelector:
+                                  description: |-
+                                    A label query over the set of namespaces that the term applies to.
+                                    The term is applied to the union of the namespaces selected by this field
+                                    and the ones listed in the namespaces field.
+                                    null selector and null or empty namespaces list means "this pod's namespace".
+                                    An empty selector ({}) matches all namespaces.
+                                  properties:
+                                    matchExpressions:
+                                      description: matchExpressions is a list of label
+                                        selector requirements. The requirements are
+                                        ANDed.
+                                      items:
+                                        description: |-
+                                          A label selector requirement is a selector that contains values, a key, and an operator that
+                                          relates the key and values.
+                                        properties:
+                                          key:
+                                            description: key is the label key that
+                                              the selector applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              operator represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists and DoesNotExist.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              values is an array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. This array is replaced during a strategic
+                                              merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchLabels:
+                                      additionalProperties:
+                                        type: string
+                                      description: |-
+                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                      type: object
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                namespaces:
+                                  description: |-
+                                    namespaces specifies a static list of namespace names that the term applies to.
+                                    The term is applied to the union of the namespaces listed in this field
+                                    and the ones selected by namespaceSelector.
+                                    null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                topologyKey:
+                                  description: |-
+                                    This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                    the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                    whose value of the label with key topologyKey matches that of any node on which any of the
+                                    selected pods is running.
+                                    Empty topologyKey is not allowed.
+                                  type: string
+                              required:
+                              - topologyKey
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                        type: object
+                    type: object
+                  jvm:
+                    type: string
+                  keystore:
+                    items:
+                      properties:
+                        keyMappings:
+                          additionalProperties:
+                            type: string
+                          description: Key mappings from secret to keystore keys
+                          type: object
+                        secret:
+                          description: Secret containing key value pairs
+                          properties:
+                            name:
+                              default: ""
+                              description: |-
+                                Name of the referent.
+                                This field is effectively required, but due to backwards compatibility is
+                                allowed to be empty. Instances of this type with an empty value here are
+                                almost certainly wrong.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                          type: object
+                          x-kubernetes-map-type: atomic
+                      type: object
+                    type: array
+                  nodeSelector:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  pluginsList:
+                    items:
+                      type: string
+                    type: array
+                  resources:
+                    description: ResourceRequirements describes the compute resource
+                      requirements.
+                    properties:
+                      claims:
+                        description: |-
+                          Claims lists the names of resources, defined in spec.resourceClaims,
+                          that are used by this container.
+
+                          This is an alpha field and requires enabling the
+                          DynamicResourceAllocation feature gate.
+
+                          This field is immutable. It can only be set for containers.
+                        items:
+                          description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+                          properties:
+                            name:
+                              description: |-
+                                Name must match the name of one entry in pod.spec.resourceClaims of
+                                the Pod where this field is used. It makes that resource available
+                                inside a container.
+                              type: string
+                            request:
+                              description: |-
+                                Request is the name chosen for a request in the referenced claim.
+                                If empty, everything from the claim is made available, otherwise
+                                only the result of this request.
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                        x-kubernetes-list-map-keys:
+                        - name
+                        x-kubernetes-list-type: map
+                      limits:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        description: |-
+                          Limits describes the maximum amount of compute resources allowed.
+                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                        type: object
+                      requests:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        description: |-
+                          Requests describes the minimum amount of compute resources required.
+                          If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                          otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                        type: object
+                    type: object
+                  tolerations:
+                    items:
+                      description: |-
+                        The pod this Toleration is attached to tolerates any taint that matches
+                        the triple <key,value,effect> using the matching operator <operator>.
+                      properties:
+                        effect:
+                          description: |-
+                            Effect indicates the taint effect to match. Empty means match all taint effects.
+                            When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+                          type: string
+                        key:
+                          description: |-
+                            Key is the taint key that the toleration applies to. Empty means match all taint keys.
+                            If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+                          type: string
+                        operator:
+                          description: |-
+                            Operator represents a key's relationship to the value.
+                            Valid operators are Exists and Equal. Defaults to Equal.
+                            Exists is equivalent to wildcard for value, so that a pod can
+                            tolerate all taints of a particular category.
+                          type: string
+                        tolerationSeconds:
+                          description: |-
+                            TolerationSeconds represents the period of time the toleration (which must be
+                            of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+                            it is not set, which means tolerate the taint forever (do not evict). Zero and
+                            negative values will be treated as 0 (evict immediately) by the system.
+                          format: int64
+                          type: integer
+                        value:
+                          description: |-
+                            Value is the taint value the toleration matches to.
+                            If the operator is Exists, the value should be empty, otherwise just a regular string.
+                          type: string
+                      type: object
+                    type: array
+                type: object
+              confMgmt:
+                description: ConfMgmt defines which additional services will be deployed
+                properties:
+                  VerUpdate:
+                    type: boolean
+                  autoScaler:
+                    type: boolean
+                  smartScaler:
+                    type: boolean
+                type: object
+              dashboards:
+                properties:
+                  additionalConfig:
+                    additionalProperties:
+                      type: string
+                    description: Additional properties for opensearch_dashboards.yaml
+                    type: object
+                  additionalVolumes:
+                    items:
+                      properties:
+                        configMap:
+                          description: ConfigMap to use to populate the volume
+                          properties:
+                            defaultMode:
+                              description: |-
+                                defaultMode is optional: mode bits used to set permissions on created files by default.
+                                Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                Defaults to 0644.
+                                Directories within the path are not affected by this setting.
+                                This might be in conflict with other options that affect the file
+                                mode, like fsGroup, and the result can be other mode bits set.
+                              format: int32
+                              type: integer
+                            items:
+                              description: |-
+                                items if unspecified, each key-value pair in the Data field of the referenced
+                                ConfigMap will be projected into the volume as a file whose name is the
+                                key and content is the value. If specified, the listed keys will be
+                                projected into the specified paths, and unlisted keys will not be
+                                present. If a key is specified which is not present in the ConfigMap,
+                                the volume setup will error unless it is marked optional. Paths must be
+                                relative and may not contain the '..' path or start with '..'.
+                              items:
+                                description: Maps a string key to a path within a
+                                  volume.
+                                properties:
+                                  key:
+                                    description: key is the key to project.
+                                    type: string
+                                  mode:
+                                    description: |-
+                                      mode is Optional: mode bits used to set permissions on this file.
+                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                      If not specified, the volume defaultMode will be used.
+                                      This might be in conflict with other options that affect the file
+                                      mode, like fsGroup, and the result can be other mode bits set.
+                                    format: int32
+                                    type: integer
+                                  path:
+                                    description: |-
+                                      path is the relative path of the file to map the key to.
+                                      May not be an absolute path.
+                                      May not contain the path element '..'.
+                                      May not start with the string '..'.
+                                    type: string
+                                required:
+                                - key
+                                - path
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            name:
+                              default: ""
+                              description: |-
+                                Name of the referent.
+                                This field is effectively required, but due to backwards compatibility is
+                                allowed to be empty. Instances of this type with an empty value here are
+                                almost certainly wrong.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                            optional:
+                              description: optional specify whether the ConfigMap
+                                or its keys must be defined
+                              type: boolean
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        csi:
+                          description: CSI object to use to populate the volume
+                          properties:
+                            driver:
+                              description: |-
+                                driver is the name of the CSI driver that handles this volume.
+                                Consult with your admin for the correct name as registered in the cluster.
+                              type: string
+                            fsType:
+                              description: |-
+                                fsType to mount. Ex. "ext4", "xfs", "ntfs".
+                                If not provided, the empty value is passed to the associated CSI driver
+                                which will determine the default filesystem to apply.
+                              type: string
+                            nodePublishSecretRef:
+                              description: |-
+                                nodePublishSecretRef is a reference to the secret object containing
+                                sensitive information to pass to the CSI driver to complete the CSI
+                                NodePublishVolume and NodeUnpublishVolume calls.
+                                This field is optional, and  may be empty if no secret is required. If the
+                                secret object contains more than one secret, all secret references are passed.
+                              properties:
+                                name:
+                                  default: ""
+                                  description: |-
+                                    Name of the referent.
+                                    This field is effectively required, but due to backwards compatibility is
+                                    allowed to be empty. Instances of this type with an empty value here are
+                                    almost certainly wrong.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            readOnly:
+                              description: |-
+                                readOnly specifies a read-only configuration for the volume.
+                                Defaults to false (read/write).
+                              type: boolean
+                            volumeAttributes:
+                              additionalProperties:
+                                type: string
+                              description: |-
+                                volumeAttributes stores driver-specific properties that are passed to the CSI
+                                driver. Consult your driver's documentation for supported values.
+                              type: object
+                          required:
+                          - driver
+                          type: object
+                        emptyDir:
+                          description: EmptyDir to use to populate the volume
+                          properties:
+                            medium:
+                              description: |-
+                                medium represents what type of storage medium should back this directory.
+                                The default is "" which means to use the node's default medium.
+                                Must be an empty string (default) or Memory.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                              type: string
+                            sizeLimit:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: |-
+                                sizeLimit is the total amount of local storage required for this EmptyDir volume.
+                                The size limit is also applicable for memory medium.
+                                The maximum usage on memory medium EmptyDir would be the minimum value between
+                                the SizeLimit specified here and the sum of memory limits of all containers in a pod.
+                                The default is nil which means that the limit is undefined.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                          type: object
+                        name:
+                          description: Name to use for the volume. Required.
+                          type: string
+                        path:
+                          description: Path in the container to mount the volume at.
+                            Required.
+                          type: string
+                        projected:
+                          description: Projected object to use to populate the volume
+                          properties:
+                            defaultMode:
+                              description: |-
+                                defaultMode are the mode bits used to set permissions on created files by default.
+                                Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                Directories within the path are not affected by this setting.
+                                This might be in conflict with other options that affect the file
+                                mode, like fsGroup, and the result can be other mode bits set.
+                              format: int32
+                              type: integer
+                            sources:
+                              description: |-
+                                sources is the list of volume projections. Each entry in this list
+                                handles one source.
+                              items:
+                                description: |-
+                                  Projection that may be projected along with other supported volume types.
+                                  Exactly one of these fields must be set.
+                                properties:
+                                  clusterTrustBundle:
+                                    description: |-
+                                      ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field
+                                      of ClusterTrustBundle objects in an auto-updating file.
+
+                                      Alpha, gated by the ClusterTrustBundleProjection feature gate.
+
+                                      ClusterTrustBundle objects can either be selected by name, or by the
+                                      combination of signer name and a label selector.
+
+                                      Kubelet performs aggressive normalization of the PEM contents written
+                                      into the pod filesystem.  Esoteric PEM features such as inter-block
+                                      comments and block headers are stripped.  Certificates are deduplicated.
+                                      The ordering of certificates within the file is arbitrary, and Kubelet
+                                      may change the order over time.
+                                    properties:
+                                      labelSelector:
+                                        description: |-
+                                          Select all ClusterTrustBundles that match this label selector.  Only has
+                                          effect if signerName is set.  Mutually-exclusive with name.  If unset,
+                                          interpreted as "match nothing".  If set but empty, interpreted as "match
+                                          everything".
+                                        properties:
+                                          matchExpressions:
+                                            description: matchExpressions is a list
+                                              of label selector requirements. The
+                                              requirements are ANDed.
+                                            items:
+                                              description: |-
+                                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                                relates the key and values.
+                                              properties:
+                                                key:
+                                                  description: key is the label key
+                                                    that the selector applies to.
+                                                  type: string
+                                                operator:
+                                                  description: |-
+                                                    operator represents a key's relationship to a set of values.
+                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                  type: string
+                                                values:
+                                                  description: |-
+                                                    values is an array of string values. If the operator is In or NotIn,
+                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                    the values array must be empty. This array is replaced during a strategic
+                                                    merge patch.
+                                                  items:
+                                                    type: string
+                                                  type: array
+                                                  x-kubernetes-list-type: atomic
+                                              required:
+                                              - key
+                                              - operator
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          matchLabels:
+                                            additionalProperties:
+                                              type: string
+                                            description: |-
+                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                            type: object
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      name:
+                                        description: |-
+                                          Select a single ClusterTrustBundle by object name.  Mutually-exclusive
+                                          with signerName and labelSelector.
+                                        type: string
+                                      optional:
+                                        description: |-
+                                          If true, don't block pod startup if the referenced ClusterTrustBundle(s)
+                                          aren't available.  If using name, then the named ClusterTrustBundle is
+                                          allowed not to exist.  If using signerName, then the combination of
+                                          signerName and labelSelector is allowed to match zero
+                                          ClusterTrustBundles.
+                                        type: boolean
+                                      path:
+                                        description: Relative path from the volume
+                                          root to write the bundle.
+                                        type: string
+                                      signerName:
+                                        description: |-
+                                          Select all ClusterTrustBundles that match this signer name.
+                                          Mutually-exclusive with name.  The contents of all selected
+                                          ClusterTrustBundles will be unified and deduplicated.
+                                        type: string
+                                    required:
+                                    - path
+                                    type: object
+                                  configMap:
+                                    description: configMap information about the configMap
+                                      data to project
+                                    properties:
+                                      items:
+                                        description: |-
+                                          items if unspecified, each key-value pair in the Data field of the referenced
+                                          ConfigMap will be projected into the volume as a file whose name is the
+                                          key and content is the value. If specified, the listed keys will be
+                                          projected into the specified paths, and unlisted keys will not be
+                                          present. If a key is specified which is not present in the ConfigMap,
+                                          the volume setup will error unless it is marked optional. Paths must be
+                                          relative and may not contain the '..' path or start with '..'.
+                                        items:
+                                          description: Maps a string key to a path
+                                            within a volume.
+                                          properties:
+                                            key:
+                                              description: key is the key to project.
+                                              type: string
+                                            mode:
+                                              description: |-
+                                                mode is Optional: mode bits used to set permissions on this file.
+                                                Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                                YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                If not specified, the volume defaultMode will be used.
+                                                This might be in conflict with other options that affect the file
+                                                mode, like fsGroup, and the result can be other mode bits set.
+                                              format: int32
+                                              type: integer
+                                            path:
+                                              description: |-
+                                                path is the relative path of the file to map the key to.
+                                                May not be an absolute path.
+                                                May not contain the path element '..'.
+                                                May not start with the string '..'.
+                                              type: string
+                                          required:
+                                          - key
+                                          - path
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      name:
+                                        default: ""
+                                        description: |-
+                                          Name of the referent.
+                                          This field is effectively required, but due to backwards compatibility is
+                                          allowed to be empty. Instances of this type with an empty value here are
+                                          almost certainly wrong.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                      optional:
+                                        description: optional specify whether the
+                                          ConfigMap or its keys must be defined
+                                        type: boolean
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                  downwardAPI:
+                                    description: downwardAPI information about the
+                                      downwardAPI data to project
+                                    properties:
+                                      items:
+                                        description: Items is a list of DownwardAPIVolume
+                                          file
+                                        items:
+                                          description: DownwardAPIVolumeFile represents
+                                            information to create the file containing
+                                            the pod field
+                                          properties:
+                                            fieldRef:
+                                              description: 'Required: Selects a field
+                                                of the pod: only annotations, labels,
+                                                name, namespace and uid are supported.'
+                                              properties:
+                                                apiVersion:
+                                                  description: Version of the schema
+                                                    the FieldPath is written in terms
+                                                    of, defaults to "v1".
+                                                  type: string
+                                                fieldPath:
+                                                  description: Path of the field to
+                                                    select in the specified API version.
+                                                  type: string
+                                              required:
+                                              - fieldPath
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            mode:
+                                              description: |-
+                                                Optional: mode bits used to set permissions on this file, must be an octal value
+                                                between 0000 and 0777 or a decimal value between 0 and 511.
+                                                YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                If not specified, the volume defaultMode will be used.
+                                                This might be in conflict with other options that affect the file
+                                                mode, like fsGroup, and the result can be other mode bits set.
+                                              format: int32
+                                              type: integer
+                                            path:
+                                              description: 'Required: Path is  the
+                                                relative path name of the file to
+                                                be created. Must not be absolute or
+                                                contain the ''..'' path. Must be utf-8
+                                                encoded. The first item of the relative
+                                                path must not start with ''..'''
+                                              type: string
+                                            resourceFieldRef:
+                                              description: |-
+                                                Selects a resource of the container: only resources limits and requests
+                                                (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.
+                                              properties:
+                                                containerName:
+                                                  description: 'Container name: required
+                                                    for volumes, optional for env
+                                                    vars'
+                                                  type: string
+                                                divisor:
+                                                  anyOf:
+                                                  - type: integer
+                                                  - type: string
+                                                  description: Specifies the output
+                                                    format of the exposed resources,
+                                                    defaults to "1"
+                                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                  x-kubernetes-int-or-string: true
+                                                resource:
+                                                  description: 'Required: resource
+                                                    to select'
+                                                  type: string
+                                              required:
+                                              - resource
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                          required:
+                                          - path
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    type: object
+                                  secret:
+                                    description: secret information about the secret
+                                      data to project
+                                    properties:
+                                      items:
+                                        description: |-
+                                          items if unspecified, each key-value pair in the Data field of the referenced
+                                          Secret will be projected into the volume as a file whose name is the
+                                          key and content is the value. If specified, the listed keys will be
+                                          projected into the specified paths, and unlisted keys will not be
+                                          present. If a key is specified which is not present in the Secret,
+                                          the volume setup will error unless it is marked optional. Paths must be
+                                          relative and may not contain the '..' path or start with '..'.
+                                        items:
+                                          description: Maps a string key to a path
+                                            within a volume.
+                                          properties:
+                                            key:
+                                              description: key is the key to project.
+                                              type: string
+                                            mode:
+                                              description: |-
+                                                mode is Optional: mode bits used to set permissions on this file.
+                                                Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                                YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                If not specified, the volume defaultMode will be used.
+                                                This might be in conflict with other options that affect the file
+                                                mode, like fsGroup, and the result can be other mode bits set.
+                                              format: int32
+                                              type: integer
+                                            path:
+                                              description: |-
+                                                path is the relative path of the file to map the key to.
+                                                May not be an absolute path.
+                                                May not contain the path element '..'.
+                                                May not start with the string '..'.
+                                              type: string
+                                          required:
+                                          - key
+                                          - path
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      name:
+                                        default: ""
+                                        description: |-
+                                          Name of the referent.
+                                          This field is effectively required, but due to backwards compatibility is
+                                          allowed to be empty. Instances of this type with an empty value here are
+                                          almost certainly wrong.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                      optional:
+                                        description: optional field specify whether
+                                          the Secret or its key must be defined
+                                        type: boolean
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                  serviceAccountToken:
+                                    description: serviceAccountToken is information
+                                      about the serviceAccountToken data to project
+                                    properties:
+                                      audience:
+                                        description: |-
+                                          audience is the intended audience of the token. A recipient of a token
+                                          must identify itself with an identifier specified in the audience of the
+                                          token, and otherwise should reject the token. The audience defaults to the
+                                          identifier of the apiserver.
+                                        type: string
+                                      expirationSeconds:
+                                        description: |-
+                                          expirationSeconds is the requested duration of validity of the service
+                                          account token. As the token approaches expiration, the kubelet volume
+                                          plugin will proactively rotate the service account token. The kubelet will
+                                          start trying to rotate the token if the token is older than 80 percent of
+                                          its time to live or if the token is older than 24 hours.Defaults to 1 hour
+                                          and must be at least 10 minutes.
+                                        format: int64
+                                        type: integer
+                                      path:
+                                        description: |-
+                                          path is the path relative to the mount point of the file to project the
+                                          token into.
+                                        type: string
+                                    required:
+                                    - path
+                                    type: object
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                          type: object
+                        restartPods:
+                          description: Whether to restart the pods on content change
+                          type: boolean
+                        secret:
+                          description: Secret to use populate the volume
+                          properties:
+                            defaultMode:
+                              description: |-
+                                defaultMode is Optional: mode bits used to set permissions on created files by default.
+                                Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                YAML accepts both octal and decimal values, JSON requires decimal values
+                                for mode bits. Defaults to 0644.
+                                Directories within the path are not affected by this setting.
+                                This might be in conflict with other options that affect the file
+                                mode, like fsGroup, and the result can be other mode bits set.
+                              format: int32
+                              type: integer
+                            items:
+                              description: |-
+                                items If unspecified, each key-value pair in the Data field of the referenced
+                                Secret will be projected into the volume as a file whose name is the
+                                key and content is the value. If specified, the listed keys will be
+                                projected into the specified paths, and unlisted keys will not be
+                                present. If a key is specified which is not present in the Secret,
+                                the volume setup will error unless it is marked optional. Paths must be
+                                relative and may not contain the '..' path or start with '..'.
+                              items:
+                                description: Maps a string key to a path within a
+                                  volume.
+                                properties:
+                                  key:
+                                    description: key is the key to project.
+                                    type: string
+                                  mode:
+                                    description: |-
+                                      mode is Optional: mode bits used to set permissions on this file.
+                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                      If not specified, the volume defaultMode will be used.
+                                      This might be in conflict with other options that affect the file
+                                      mode, like fsGroup, and the result can be other mode bits set.
+                                    format: int32
+                                    type: integer
+                                  path:
+                                    description: |-
+                                      path is the relative path of the file to map the key to.
+                                      May not be an absolute path.
+                                      May not contain the path element '..'.
+                                      May not start with the string '..'.
+                                    type: string
+                                required:
+                                - key
+                                - path
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            optional:
+                              description: optional field specify whether the Secret
+                                or its keys must be defined
+                              type: boolean
+                            secretName:
+                              description: |-
+                                secretName is the name of the secret in the pod's namespace to use.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                              type: string
+                          type: object
+                        subPath:
+                          description: SubPath of the referenced volume to mount.
+                          type: string
+                      required:
+                      - name
+                      - path
+                      type: object
+                    type: array
+                  affinity:
+                    description: Affinity is a group of affinity scheduling rules.
+                    properties:
+                      nodeAffinity:
+                        description: Describes node affinity scheduling rules for
+                          the pod.
+                        properties:
+                          preferredDuringSchedulingIgnoredDuringExecution:
+                            description: |-
+                              The scheduler will prefer to schedule pods to nodes that satisfy
+                              the affinity expressions specified by this field, but it may choose
+                              a node that violates one or more of the expressions. The node that is
+                              most preferred is the one with the greatest sum of weights, i.e.
+                              for each node that meets all of the scheduling requirements (resource
+                              request, requiredDuringScheduling affinity expressions, etc.),
+                              compute a sum by iterating through the elements of this field and adding
+                              "weight" to the sum if the node matches the corresponding matchExpressions; the
+                              node(s) with the highest sum are the most preferred.
+                            items:
+                              description: |-
+                                An empty preferred scheduling term matches all objects with implicit weight 0
+                                (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+                              properties:
+                                preference:
+                                  description: A node selector term, associated with
+                                    the corresponding weight.
+                                  properties:
+                                    matchExpressions:
+                                      description: A list of node selector requirements
+                                        by node's labels.
+                                      items:
+                                        description: |-
+                                          A node selector requirement is a selector that contains values, a key, and an operator
+                                          that relates the key and values.
+                                        properties:
+                                          key:
+                                            description: The label key that the selector
+                                              applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              Represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              An array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. If the operator is Gt or Lt, the values
+                                              array must have a single element, which will be interpreted as an integer.
+                                              This array is replaced during a strategic merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchFields:
+                                      description: A list of node selector requirements
+                                        by node's fields.
+                                      items:
+                                        description: |-
+                                          A node selector requirement is a selector that contains values, a key, and an operator
+                                          that relates the key and values.
+                                        properties:
+                                          key:
+                                            description: The label key that the selector
+                                              applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              Represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              An array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. If the operator is Gt or Lt, the values
+                                              array must have a single element, which will be interpreted as an integer.
+                                              This array is replaced during a strategic merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                weight:
+                                  description: Weight associated with matching the
+                                    corresponding nodeSelectorTerm, in the range 1-100.
+                                  format: int32
+                                  type: integer
+                              required:
+                              - preference
+                              - weight
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          requiredDuringSchedulingIgnoredDuringExecution:
+                            description: |-
+                              If the affinity requirements specified by this field are not met at
+                              scheduling time, the pod will not be scheduled onto the node.
+                              If the affinity requirements specified by this field cease to be met
+                              at some point during pod execution (e.g. due to an update), the system
+                              may or may not try to eventually evict the pod from its node.
+                            properties:
+                              nodeSelectorTerms:
+                                description: Required. A list of node selector terms.
+                                  The terms are ORed.
+                                items:
+                                  description: |-
+                                    A null or empty node selector term matches no objects. The requirements of
+                                    them are ANDed.
+                                    The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+                                  properties:
+                                    matchExpressions:
+                                      description: A list of node selector requirements
+                                        by node's labels.
+                                      items:
+                                        description: |-
+                                          A node selector requirement is a selector that contains values, a key, and an operator
+                                          that relates the key and values.
+                                        properties:
+                                          key:
+                                            description: The label key that the selector
+                                              applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              Represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              An array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. If the operator is Gt or Lt, the values
+                                              array must have a single element, which will be interpreted as an integer.
+                                              This array is replaced during a strategic merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchFields:
+                                      description: A list of node selector requirements
+                                        by node's fields.
+                                      items:
+                                        description: |-
+                                          A node selector requirement is a selector that contains values, a key, and an operator
+                                          that relates the key and values.
+                                        properties:
+                                          key:
+                                            description: The label key that the selector
+                                              applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              Represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              An array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. If the operator is Gt or Lt, the values
+                                              array must have a single element, which will be interpreted as an integer.
+                                              This array is replaced during a strategic merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                type: array
+                                x-kubernetes-list-type: atomic
+                            required:
+                            - nodeSelectorTerms
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        type: object
+                      podAffinity:
+                        description: Describes pod affinity scheduling rules (e.g.
+                          co-locate this pod in the same node, zone, etc. as some
+                          other pod(s)).
+                        properties:
+                          preferredDuringSchedulingIgnoredDuringExecution:
+                            description: |-
+                              The scheduler will prefer to schedule pods to nodes that satisfy
+                              the affinity expressions specified by this field, but it may choose
+                              a node that violates one or more of the expressions. The node that is
+                              most preferred is the one with the greatest sum of weights, i.e.
+                              for each node that meets all of the scheduling requirements (resource
+                              request, requiredDuringScheduling affinity expressions, etc.),
+                              compute a sum by iterating through the elements of this field and adding
+                              "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                              node(s) with the highest sum are the most preferred.
+                            items:
+                              description: The weights of all of the matched WeightedPodAffinityTerm
+                                fields are added per-node to find the most preferred
+                                node(s)
+                              properties:
+                                podAffinityTerm:
+                                  description: Required. A pod affinity term, associated
+                                    with the corresponding weight.
+                                  properties:
+                                    labelSelector:
+                                      description: |-
+                                        A label query over a set of resources, in this case pods.
+                                        If it's null, this PodAffinityTerm matches with no Pods.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    matchLabelKeys:
+                                      description: |-
+                                        MatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mismatchLabelKeys:
+                                      description: |-
+                                        MismatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    namespaceSelector:
+                                      description: |-
+                                        A label query over the set of namespaces that the term applies to.
+                                        The term is applied to the union of the namespaces selected by this field
+                                        and the ones listed in the namespaces field.
+                                        null selector and null or empty namespaces list means "this pod's namespace".
+                                        An empty selector ({}) matches all namespaces.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    namespaces:
+                                      description: |-
+                                        namespaces specifies a static list of namespace names that the term applies to.
+                                        The term is applied to the union of the namespaces listed in this field
+                                        and the ones selected by namespaceSelector.
+                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    topologyKey:
+                                      description: |-
+                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                        whose value of the label with key topologyKey matches that of any node on which any of the
+                                        selected pods is running.
+                                        Empty topologyKey is not allowed.
+                                      type: string
+                                  required:
+                                  - topologyKey
+                                  type: object
+                                weight:
+                                  description: |-
+                                    weight associated with matching the corresponding podAffinityTerm,
+                                    in the range 1-100.
+                                  format: int32
+                                  type: integer
+                              required:
+                              - podAffinityTerm
+                              - weight
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          requiredDuringSchedulingIgnoredDuringExecution:
+                            description: |-
+                              If the affinity requirements specified by this field are not met at
+                              scheduling time, the pod will not be scheduled onto the node.
+                              If the affinity requirements specified by this field cease to be met
+                              at some point during pod execution (e.g. due to a pod label update), the
+                              system may or may not try to eventually evict the pod from its node.
+                              When there are multiple elements, the lists of nodes corresponding to each
+                              podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                            items:
+                              description: |-
+                                Defines a set of pods (namely those matching the labelSelector
+                                relative to the given namespace(s)) that this pod should be
+                                co-located (affinity) or not co-located (anti-affinity) with,
+                                where co-located is defined as running on a node whose value of
+                                the label with key <topologyKey> matches that of any node on which
+                                a pod of the set of pods is running
+                              properties:
+                                labelSelector:
+                                  description: |-
+                                    A label query over a set of resources, in this case pods.
+                                    If it's null, this PodAffinityTerm matches with no Pods.
+                                  properties:
+                                    matchExpressions:
+                                      description: matchExpressions is a list of label
+                                        selector requirements. The requirements are
+                                        ANDed.
+                                      items:
+                                        description: |-
+                                          A label selector requirement is a selector that contains values, a key, and an operator that
+                                          relates the key and values.
+                                        properties:
+                                          key:
+                                            description: key is the label key that
+                                              the selector applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              operator represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists and DoesNotExist.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              values is an array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. This array is replaced during a strategic
+                                              merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchLabels:
+                                      additionalProperties:
+                                        type: string
+                                      description: |-
+                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                      type: object
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                matchLabelKeys:
+                                  description: |-
+                                    MatchLabelKeys is a set of pod label keys to select which pods will
+                                    be taken into consideration. The keys are used to lookup values from the
+                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                    to select the group of existing pods which pods will be taken into consideration
+                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                    pod labels will be ignored. The default value is empty.
+                                    The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                    Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                mismatchLabelKeys:
+                                  description: |-
+                                    MismatchLabelKeys is a set of pod label keys to select which pods will
+                                    be taken into consideration. The keys are used to lookup values from the
+                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                    to select the group of existing pods which pods will be taken into consideration
+                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                    pod labels will be ignored. The default value is empty.
+                                    The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                    Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                namespaceSelector:
+                                  description: |-
+                                    A label query over the set of namespaces that the term applies to.
+                                    The term is applied to the union of the namespaces selected by this field
+                                    and the ones listed in the namespaces field.
+                                    null selector and null or empty namespaces list means "this pod's namespace".
+                                    An empty selector ({}) matches all namespaces.
+                                  properties:
+                                    matchExpressions:
+                                      description: matchExpressions is a list of label
+                                        selector requirements. The requirements are
+                                        ANDed.
+                                      items:
+                                        description: |-
+                                          A label selector requirement is a selector that contains values, a key, and an operator that
+                                          relates the key and values.
+                                        properties:
+                                          key:
+                                            description: key is the label key that
+                                              the selector applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              operator represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists and DoesNotExist.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              values is an array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. This array is replaced during a strategic
+                                              merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchLabels:
+                                      additionalProperties:
+                                        type: string
+                                      description: |-
+                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                      type: object
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                namespaces:
+                                  description: |-
+                                    namespaces specifies a static list of namespace names that the term applies to.
+                                    The term is applied to the union of the namespaces listed in this field
+                                    and the ones selected by namespaceSelector.
+                                    null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                topologyKey:
+                                  description: |-
+                                    This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                    the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                    whose value of the label with key topologyKey matches that of any node on which any of the
+                                    selected pods is running.
+                                    Empty topologyKey is not allowed.
+                                  type: string
+                              required:
+                              - topologyKey
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                        type: object
+                      podAntiAffinity:
+                        description: Describes pod anti-affinity scheduling rules
+                          (e.g. avoid putting this pod in the same node, zone, etc.
+                          as some other pod(s)).
+                        properties:
+                          preferredDuringSchedulingIgnoredDuringExecution:
+                            description: |-
+                              The scheduler will prefer to schedule pods to nodes that satisfy
+                              the anti-affinity expressions specified by this field, but it may choose
+                              a node that violates one or more of the expressions. The node that is
+                              most preferred is the one with the greatest sum of weights, i.e.
+                              for each node that meets all of the scheduling requirements (resource
+                              request, requiredDuringScheduling anti-affinity expressions, etc.),
+                              compute a sum by iterating through the elements of this field and adding
+                              "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                              node(s) with the highest sum are the most preferred.
+                            items:
+                              description: The weights of all of the matched WeightedPodAffinityTerm
+                                fields are added per-node to find the most preferred
+                                node(s)
+                              properties:
+                                podAffinityTerm:
+                                  description: Required. A pod affinity term, associated
+                                    with the corresponding weight.
+                                  properties:
+                                    labelSelector:
+                                      description: |-
+                                        A label query over a set of resources, in this case pods.
+                                        If it's null, this PodAffinityTerm matches with no Pods.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    matchLabelKeys:
+                                      description: |-
+                                        MatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mismatchLabelKeys:
+                                      description: |-
+                                        MismatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    namespaceSelector:
+                                      description: |-
+                                        A label query over the set of namespaces that the term applies to.
+                                        The term is applied to the union of the namespaces selected by this field
+                                        and the ones listed in the namespaces field.
+                                        null selector and null or empty namespaces list means "this pod's namespace".
+                                        An empty selector ({}) matches all namespaces.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    namespaces:
+                                      description: |-
+                                        namespaces specifies a static list of namespace names that the term applies to.
+                                        The term is applied to the union of the namespaces listed in this field
+                                        and the ones selected by namespaceSelector.
+                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    topologyKey:
+                                      description: |-
+                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                        whose value of the label with key topologyKey matches that of any node on which any of the
+                                        selected pods is running.
+                                        Empty topologyKey is not allowed.
+                                      type: string
+                                  required:
+                                  - topologyKey
+                                  type: object
+                                weight:
+                                  description: |-
+                                    weight associated with matching the corresponding podAffinityTerm,
+                                    in the range 1-100.
+                                  format: int32
+                                  type: integer
+                              required:
+                              - podAffinityTerm
+                              - weight
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          requiredDuringSchedulingIgnoredDuringExecution:
+                            description: |-
+                              If the anti-affinity requirements specified by this field are not met at
+                              scheduling time, the pod will not be scheduled onto the node.
+                              If the anti-affinity requirements specified by this field cease to be met
+                              at some point during pod execution (e.g. due to a pod label update), the
+                              system may or may not try to eventually evict the pod from its node.
+                              When there are multiple elements, the lists of nodes corresponding to each
+                              podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                            items:
+                              description: |-
+                                Defines a set of pods (namely those matching the labelSelector
+                                relative to the given namespace(s)) that this pod should be
+                                co-located (affinity) or not co-located (anti-affinity) with,
+                                where co-located is defined as running on a node whose value of
+                                the label with key <topologyKey> matches that of any node on which
+                                a pod of the set of pods is running
+                              properties:
+                                labelSelector:
+                                  description: |-
+                                    A label query over a set of resources, in this case pods.
+                                    If it's null, this PodAffinityTerm matches with no Pods.
+                                  properties:
+                                    matchExpressions:
+                                      description: matchExpressions is a list of label
+                                        selector requirements. The requirements are
+                                        ANDed.
+                                      items:
+                                        description: |-
+                                          A label selector requirement is a selector that contains values, a key, and an operator that
+                                          relates the key and values.
+                                        properties:
+                                          key:
+                                            description: key is the label key that
+                                              the selector applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              operator represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists and DoesNotExist.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              values is an array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. This array is replaced during a strategic
+                                              merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchLabels:
+                                      additionalProperties:
+                                        type: string
+                                      description: |-
+                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                      type: object
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                matchLabelKeys:
+                                  description: |-
+                                    MatchLabelKeys is a set of pod label keys to select which pods will
+                                    be taken into consideration. The keys are used to lookup values from the
+                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                    to select the group of existing pods which pods will be taken into consideration
+                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                    pod labels will be ignored. The default value is empty.
+                                    The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                    Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                mismatchLabelKeys:
+                                  description: |-
+                                    MismatchLabelKeys is a set of pod label keys to select which pods will
+                                    be taken into consideration. The keys are used to lookup values from the
+                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                    to select the group of existing pods which pods will be taken into consideration
+                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                    pod labels will be ignored. The default value is empty.
+                                    The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                    Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                namespaceSelector:
+                                  description: |-
+                                    A label query over the set of namespaces that the term applies to.
+                                    The term is applied to the union of the namespaces selected by this field
+                                    and the ones listed in the namespaces field.
+                                    null selector and null or empty namespaces list means "this pod's namespace".
+                                    An empty selector ({}) matches all namespaces.
+                                  properties:
+                                    matchExpressions:
+                                      description: matchExpressions is a list of label
+                                        selector requirements. The requirements are
+                                        ANDed.
+                                      items:
+                                        description: |-
+                                          A label selector requirement is a selector that contains values, a key, and an operator that
+                                          relates the key and values.
+                                        properties:
+                                          key:
+                                            description: key is the label key that
+                                              the selector applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              operator represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists and DoesNotExist.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              values is an array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. This array is replaced during a strategic
+                                              merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchLabels:
+                                      additionalProperties:
+                                        type: string
+                                      description: |-
+                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                      type: object
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                namespaces:
+                                  description: |-
+                                    namespaces specifies a static list of namespace names that the term applies to.
+                                    The term is applied to the union of the namespaces listed in this field
+                                    and the ones selected by namespaceSelector.
+                                    null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                topologyKey:
+                                  description: |-
+                                    This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                    the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                    whose value of the label with key topologyKey matches that of any node on which any of the
+                                    selected pods is running.
+                                    Empty topologyKey is not allowed.
+                                  type: string
+                              required:
+                              - topologyKey
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                        type: object
+                    type: object
+                  annotations:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  basePath:
+                    description: Base Path for Opensearch Clusters running behind
+                      a reverse proxy
+                    type: string
+                  enable:
+                    type: boolean
+                  env:
+                    items:
+                      description: EnvVar represents an environment variable present
+                        in a Container.
+                      properties:
+                        name:
+                          description: Name of the environment variable. Must be a
+                            C_IDENTIFIER.
+                          type: string
+                        value:
+                          description: |-
+                            Variable references $(VAR_NAME) are expanded
+                            using the previously defined environment variables in the container and
+                            any service environment variables. If a variable cannot be resolved,
+                            the reference in the input string will be unchanged. Double $$ are reduced
+                            to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+                            "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+                            Escaped references will never be expanded, regardless of whether the variable
+                            exists or not.
+                            Defaults to "".
+                          type: string
+                        valueFrom:
+                          description: Source for the environment variable's value.
+                            Cannot be used if value is not empty.
+                          properties:
+                            configMapKeyRef:
+                              description: Selects a key of a ConfigMap.
+                              properties:
+                                key:
+                                  description: The key to select.
+                                  type: string
+                                name:
+                                  default: ""
+                                  description: |-
+                                    Name of the referent.
+                                    This field is effectively required, but due to backwards compatibility is
+                                    allowed to be empty. Instances of this type with an empty value here are
+                                    almost certainly wrong.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                                optional:
+                                  description: Specify whether the ConfigMap or its
+                                    key must be defined
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            fieldRef:
+                              description: |-
+                                Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
+                                spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
+                              properties:
+                                apiVersion:
+                                  description: Version of the schema the FieldPath
+                                    is written in terms of, defaults to "v1".
+                                  type: string
+                                fieldPath:
+                                  description: Path of the field to select in the
+                                    specified API version.
+                                  type: string
+                              required:
+                              - fieldPath
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            resourceFieldRef:
+                              description: |-
+                                Selects a resource of the container: only resources limits and requests
+                                (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
+                              properties:
+                                containerName:
+                                  description: 'Container name: required for volumes,
+                                    optional for env vars'
+                                  type: string
+                                divisor:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  description: Specifies the output format of the
+                                    exposed resources, defaults to "1"
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                resource:
+                                  description: 'Required: resource to select'
+                                  type: string
+                              required:
+                              - resource
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            secretKeyRef:
+                              description: Selects a key of a secret in the pod's
+                                namespace
+                              properties:
+                                key:
+                                  description: The key of the secret to select from.  Must
+                                    be a valid secret key.
+                                  type: string
+                                name:
+                                  default: ""
+                                  description: |-
+                                    Name of the referent.
+                                    This field is effectively required, but due to backwards compatibility is
+                                    allowed to be empty. Instances of this type with an empty value here are
+                                    almost certainly wrong.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                                optional:
+                                  description: Specify whether the Secret or its key
+                                    must be defined
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                          type: object
+                      required:
+                      - name
+                      type: object
+                    type: array
+                  image:
+                    type: string
+                  imagePullPolicy:
+                    description: PullPolicy describes a policy for if/when to pull
+                      a container image
+                    type: string
+                  imagePullSecrets:
+                    items:
+                      description: |-
+                        LocalObjectReference contains enough information to let you locate the
+                        referenced object inside the same namespace.
+                      properties:
+                        name:
+                          default: ""
+                          description: |-
+                            Name of the referent.
+                            This field is effectively required, but due to backwards compatibility is
+                            allowed to be empty. Instances of this type with an empty value here are
+                            almost certainly wrong.
+                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          type: string
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    type: array
+                  labels:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  nodeSelector:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  opensearchCredentialsSecret:
+                    description: Secret that contains fields username and password
+                      for dashboards to use to login to opensearch, must only be supplied
+                      if a custom securityconfig is provided
+                    properties:
+                      name:
+                        default: ""
+                        description: |-
+                          Name of the referent.
+                          This field is effectively required, but due to backwards compatibility is
+                          allowed to be empty. Instances of this type with an empty value here are
+                          almost certainly wrong.
+                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                        type: string
+                    type: object
+                    x-kubernetes-map-type: atomic
+                  pluginsList:
+                    items:
+                      type: string
+                    type: array
+                  podSecurityContext:
+                    description: Set security context for the dashboards pods
+                    properties:
+                      appArmorProfile:
+                        description: |-
+                          appArmorProfile is the AppArmor options to use by the containers in this pod.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        properties:
+                          localhostProfile:
+                            description: |-
+                              localhostProfile indicates a profile loaded on the node that should be used.
+                              The profile must be preconfigured on the node to work.
+                              Must match the loaded name of the profile.
+                              Must be set if and only if type is "Localhost".
+                            type: string
+                          type:
+                            description: |-
+                              type indicates which kind of AppArmor profile will be applied.
+                              Valid options are:
+                                Localhost - a profile pre-loaded on the node.
+                                RuntimeDefault - the container runtime's default profile.
+                                Unconfined - no AppArmor enforcement.
+                            type: string
+                        required:
+                        - type
+                        type: object
+                      fsGroup:
+                        description: |-
+                          A special supplemental group that applies to all containers in a pod.
+                          Some volume types allow the Kubelet to change the ownership of that volume
+                          to be owned by the pod:
+
+                          1. The owning GID will be the FSGroup
+                          2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
+                          3. The permission bits are OR'd with rw-rw----
+
+                          If unset, the Kubelet will not modify the ownership and permissions of any volume.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        format: int64
+                        type: integer
+                      fsGroupChangePolicy:
+                        description: |-
+                          fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
+                          before being exposed inside Pod. This field will only apply to
+                          volume types which support fsGroup based ownership(and permissions).
+                          It will have no effect on ephemeral volume types such as: secret, configmaps
+                          and emptydir.
+                          Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        type: string
+                      runAsGroup:
+                        description: |-
+                          The GID to run the entrypoint of the container process.
+                          Uses runtime default if unset.
+                          May also be set in SecurityContext.  If set in both SecurityContext and
+                          PodSecurityContext, the value specified in SecurityContext takes precedence
+                          for that container.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        format: int64
+                        type: integer
+                      runAsNonRoot:
+                        description: |-
+                          Indicates that the container must run as a non-root user.
+                          If true, the Kubelet will validate the image at runtime to ensure that it
+                          does not run as UID 0 (root) and fail to start the container if it does.
+                          If unset or false, no such validation will be performed.
+                          May also be set in SecurityContext.  If set in both SecurityContext and
+                          PodSecurityContext, the value specified in SecurityContext takes precedence.
+                        type: boolean
+                      runAsUser:
+                        description: |-
+                          The UID to run the entrypoint of the container process.
+                          Defaults to user specified in image metadata if unspecified.
+                          May also be set in SecurityContext.  If set in both SecurityContext and
+                          PodSecurityContext, the value specified in SecurityContext takes precedence
+                          for that container.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        format: int64
+                        type: integer
+                      seLinuxChangePolicy:
+                        description: |-
+                          seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod.
+                          It has no effect on nodes that do not support SELinux or to volumes does not support SELinux.
+                          Valid values are "MountOption" and "Recursive".
+
+                          "Recursive" means relabeling of all files on all Pod volumes by the container runtime.
+                          This may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node.
+
+                          "MountOption" mounts all eligible Pod volumes with `-o context` mount option.
+                          This requires all Pods that share the same volume to use the same SELinux label.
+                          It is not possible to share the same volume among privileged and unprivileged Pods.
+                          Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
+                          whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
+                          CSIDriver instance. Other volumes are always re-labelled recursively.
+                          "MountOption" value is allowed only when SELinuxMount feature gate is enabled.
+
+                          If not specified and SELinuxMount feature gate is enabled, "MountOption" is used.
+                          If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes
+                          and "Recursive" for all other volumes.
+
+                          This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.
+
+                          All Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        type: string
+                      seLinuxOptions:
+                        description: |-
+                          The SELinux context to be applied to all containers.
+                          If unspecified, the container runtime will allocate a random SELinux context for each
+                          container.  May also be set in SecurityContext.  If set in
+                          both SecurityContext and PodSecurityContext, the value specified in SecurityContext
+                          takes precedence for that container.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        properties:
+                          level:
+                            description: Level is SELinux level label that applies
+                              to the container.
+                            type: string
+                          role:
+                            description: Role is a SELinux role label that applies
+                              to the container.
+                            type: string
+                          type:
+                            description: Type is a SELinux type label that applies
+                              to the container.
+                            type: string
+                          user:
+                            description: User is a SELinux user label that applies
+                              to the container.
+                            type: string
+                        type: object
+                      seccompProfile:
+                        description: |-
+                          The seccomp options to use by the containers in this pod.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        properties:
+                          localhostProfile:
+                            description: |-
+                              localhostProfile indicates a profile defined in a file on the node should be used.
+                              The profile must be preconfigured on the node to work.
+                              Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                              Must be set if type is "Localhost". Must NOT be set for any other type.
+                            type: string
+                          type:
+                            description: |-
+                              type indicates which kind of seccomp profile will be applied.
+                              Valid options are:
+
+                              Localhost - a profile defined in a file on the node should be used.
+                              RuntimeDefault - the container runtime default profile should be used.
+                              Unconfined - no profile should be applied.
+                            type: string
+                        required:
+                        - type
+                        type: object
+                      supplementalGroups:
+                        description: |-
+                          A list of groups applied to the first process run in each container, in
+                          addition to the container's primary GID and fsGroup (if specified).  If
+                          the SupplementalGroupsPolicy feature is enabled, the
+                          supplementalGroupsPolicy field determines whether these are in addition
+                          to or instead of any group memberships defined in the container image.
+                          If unspecified, no additional groups are added, though group memberships
+                          defined in the container image may still be used, depending on the
+                          supplementalGroupsPolicy field.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        items:
+                          format: int64
+                          type: integer
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      supplementalGroupsPolicy:
+                        description: |-
+                          Defines how supplemental groups of the first container processes are calculated.
+                          Valid values are "Merge" and "Strict". If not specified, "Merge" is used.
+                          (Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled
+                          and the container runtime must implement support for this feature.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        type: string
+                      sysctls:
+                        description: |-
+                          Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
+                          sysctls (by the container runtime) might fail to launch.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        items:
+                          description: Sysctl defines a kernel parameter to be set
+                          properties:
+                            name:
+                              description: Name of a property to set
+                              type: string
+                            value:
+                              description: Value of a property to set
+                              type: string
+                          required:
+                          - name
+                          - value
+                          type: object
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      windowsOptions:
+                        description: |-
+                          The Windows specific settings applied to all containers.
+                          If unspecified, the options within a container's SecurityContext will be used.
+                          If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+                          Note that this field cannot be set when spec.os.name is linux.
+                        properties:
+                          gmsaCredentialSpec:
+                            description: |-
+                              GMSACredentialSpec is where the GMSA admission webhook
+                              (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
+                              GMSA credential spec named by the GMSACredentialSpecName field.
+                            type: string
+                          gmsaCredentialSpecName:
+                            description: GMSACredentialSpecName is the name of the
+                              GMSA credential spec to use.
+                            type: string
+                          hostProcess:
+                            description: |-
+                              HostProcess determines if a container should be run as a 'Host Process' container.
+                              All of a Pod's containers must have the same effective HostProcess value
+                              (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
+                              In addition, if HostProcess is true then HostNetwork must also be set to true.
+                            type: boolean
+                          runAsUserName:
+                            description: |-
+                              The UserName in Windows to run the entrypoint of the container process.
+                              Defaults to the user specified in image metadata if unspecified.
+                              May also be set in PodSecurityContext. If set in both SecurityContext and
+                              PodSecurityContext, the value specified in SecurityContext takes precedence.
+                            type: string
+                        type: object
+                    type: object
+                  replicas:
+                    format: int32
+                    type: integer
+                  resources:
+                    description: ResourceRequirements describes the compute resource
+                      requirements.
+                    properties:
+                      claims:
+                        description: |-
+                          Claims lists the names of resources, defined in spec.resourceClaims,
+                          that are used by this container.
+
+                          This is an alpha field and requires enabling the
+                          DynamicResourceAllocation feature gate.
+
+                          This field is immutable. It can only be set for containers.
+                        items:
+                          description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+                          properties:
+                            name:
+                              description: |-
+                                Name must match the name of one entry in pod.spec.resourceClaims of
+                                the Pod where this field is used. It makes that resource available
+                                inside a container.
+                              type: string
+                            request:
+                              description: |-
+                                Request is the name chosen for a request in the referenced claim.
+                                If empty, everything from the claim is made available, otherwise
+                                only the result of this request.
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                        x-kubernetes-list-map-keys:
+                        - name
+                        x-kubernetes-list-type: map
+                      limits:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        description: |-
+                          Limits describes the maximum amount of compute resources allowed.
+                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                        type: object
+                      requests:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        description: |-
+                          Requests describes the minimum amount of compute resources required.
+                          If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                          otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                        type: object
+                    type: object
+                  securityContext:
+                    description: Set security context for the dashboards pods' container
+                    properties:
+                      allowPrivilegeEscalation:
+                        description: |-
+                          AllowPrivilegeEscalation controls whether a process can gain more
+                          privileges than its parent process. This bool directly controls if
+                          the no_new_privs flag will be set on the container process.
+                          AllowPrivilegeEscalation is true always when the container is:
+                          1) run as Privileged
+                          2) has CAP_SYS_ADMIN
+                          Note that this field cannot be set when spec.os.name is windows.
+                        type: boolean
+                      appArmorProfile:
+                        description: |-
+                          appArmorProfile is the AppArmor options to use by this container. If set, this profile
+                          overrides the pod's appArmorProfile.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        properties:
+                          localhostProfile:
+                            description: |-
+                              localhostProfile indicates a profile loaded on the node that should be used.
+                              The profile must be preconfigured on the node to work.
+                              Must match the loaded name of the profile.
+                              Must be set if and only if type is "Localhost".
+                            type: string
+                          type:
+                            description: |-
+                              type indicates which kind of AppArmor profile will be applied.
+                              Valid options are:
+                                Localhost - a profile pre-loaded on the node.
+                                RuntimeDefault - the container runtime's default profile.
+                                Unconfined - no AppArmor enforcement.
+                            type: string
+                        required:
+                        - type
+                        type: object
+                      capabilities:
+                        description: |-
+                          The capabilities to add/drop when running containers.
+                          Defaults to the default set of capabilities granted by the container runtime.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        properties:
+                          add:
+                            description: Added capabilities
+                            items:
+                              description: Capability represent POSIX capabilities
+                                type
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          drop:
+                            description: Removed capabilities
+                            items:
+                              description: Capability represent POSIX capabilities
+                                type
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: atomic
+                        type: object
+                      privileged:
+                        description: |-
+                          Run container in privileged mode.
+                          Processes in privileged containers are essentially equivalent to root on the host.
+                          Defaults to false.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        type: boolean
+                      procMount:
+                        description: |-
+                          procMount denotes the type of proc mount to use for the containers.
+                          The default value is Default which uses the container runtime defaults for
+                          readonly paths and masked paths.
+                          This requires the ProcMountType feature flag to be enabled.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        type: string
+                      readOnlyRootFilesystem:
+                        description: |-
+                          Whether this container has a read-only root filesystem.
+                          Default is false.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        type: boolean
+                      runAsGroup:
+                        description: |-
+                          The GID to run the entrypoint of the container process.
+                          Uses runtime default if unset.
+                          May also be set in PodSecurityContext.  If set in both SecurityContext and
+                          PodSecurityContext, the value specified in SecurityContext takes precedence.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        format: int64
+                        type: integer
+                      runAsNonRoot:
+                        description: |-
+                          Indicates that the container must run as a non-root user.
+                          If true, the Kubelet will validate the image at runtime to ensure that it
+                          does not run as UID 0 (root) and fail to start the container if it does.
+                          If unset or false, no such validation will be performed.
+                          May also be set in PodSecurityContext.  If set in both SecurityContext and
+                          PodSecurityContext, the value specified in SecurityContext takes precedence.
+                        type: boolean
+                      runAsUser:
+                        description: |-
+                          The UID to run the entrypoint of the container process.
+                          Defaults to user specified in image metadata if unspecified.
+                          May also be set in PodSecurityContext.  If set in both SecurityContext and
+                          PodSecurityContext, the value specified in SecurityContext takes precedence.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        format: int64
+                        type: integer
+                      seLinuxOptions:
+                        description: |-
+                          The SELinux context to be applied to the container.
+                          If unspecified, the container runtime will allocate a random SELinux context for each
+                          container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
+                          PodSecurityContext, the value specified in SecurityContext takes precedence.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        properties:
+                          level:
+                            description: Level is SELinux level label that applies
+                              to the container.
+                            type: string
+                          role:
+                            description: Role is a SELinux role label that applies
+                              to the container.
+                            type: string
+                          type:
+                            description: Type is a SELinux type label that applies
+                              to the container.
+                            type: string
+                          user:
+                            description: User is a SELinux user label that applies
+                              to the container.
+                            type: string
+                        type: object
+                      seccompProfile:
+                        description: |-
+                          The seccomp options to use by this container. If seccomp options are
+                          provided at both the pod & container level, the container options
+                          override the pod options.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        properties:
+                          localhostProfile:
+                            description: |-
+                              localhostProfile indicates a profile defined in a file on the node should be used.
+                              The profile must be preconfigured on the node to work.
+                              Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                              Must be set if type is "Localhost". Must NOT be set for any other type.
+                            type: string
+                          type:
+                            description: |-
+                              type indicates which kind of seccomp profile will be applied.
+                              Valid options are:
+
+                              Localhost - a profile defined in a file on the node should be used.
+                              RuntimeDefault - the container runtime default profile should be used.
+                              Unconfined - no profile should be applied.
+                            type: string
+                        required:
+                        - type
+                        type: object
+                      windowsOptions:
+                        description: |-
+                          The Windows specific settings applied to all containers.
+                          If unspecified, the options from the PodSecurityContext will be used.
+                          If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+                          Note that this field cannot be set when spec.os.name is linux.
+                        properties:
+                          gmsaCredentialSpec:
+                            description: |-
+                              GMSACredentialSpec is where the GMSA admission webhook
+                              (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
+                              GMSA credential spec named by the GMSACredentialSpecName field.
+                            type: string
+                          gmsaCredentialSpecName:
+                            description: GMSACredentialSpecName is the name of the
+                              GMSA credential spec to use.
+                            type: string
+                          hostProcess:
+                            description: |-
+                              HostProcess determines if a container should be run as a 'Host Process' container.
+                              All of a Pod's containers must have the same effective HostProcess value
+                              (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
+                              In addition, if HostProcess is true then HostNetwork must also be set to true.
+                            type: boolean
+                          runAsUserName:
+                            description: |-
+                              The UserName in Windows to run the entrypoint of the container process.
+                              Defaults to the user specified in image metadata if unspecified.
+                              May also be set in PodSecurityContext. If set in both SecurityContext and
+                              PodSecurityContext, the value specified in SecurityContext takes precedence.
+                            type: string
+                        type: object
+                    type: object
+                  service:
+                    properties:
+                      labels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      loadBalancerSourceRanges:
+                        items:
+                          type: string
+                        type: array
+                      type:
+                        default: ClusterIP
+                        description: Service Type string describes ingress methods
+                          for a service
+                        enum:
+                        - ClusterIP
+                        - NodePort
+                        - LoadBalancer
+                        type: string
+                    type: object
+                  tls:
+                    properties:
+                      caSecret:
+                        description: Optional, secret that contains the ca certificate
+                          as ca.crt. If this and generate=true is set the existing
+                          CA cert from that secret is used to generate the node certs.
+                          In this case must contain ca.crt and ca.key fields
+                        properties:
+                          name:
+                            default: ""
+                            description: |-
+                              Name of the referent.
+                              This field is effectively required, but due to backwards compatibility is
+                              allowed to be empty. Instances of this type with an empty value here are
+                              almost certainly wrong.
+                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                            type: string
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      enable:
+                        description: Enable HTTPS for Dashboards
+                        type: boolean
+                      generate:
+                        description: Generate certificate, if false secret must be
+                          provided
+                        type: boolean
+                      secret:
+                        description: Optional, name of a TLS secret that contains
+                          ca.crt, tls.key and tls.crt data. If ca.crt is in a different
+                          secret provide it via the caSecret field
+                        properties:
+                          name:
+                            default: ""
+                            description: |-
+                              Name of the referent.
+                              This field is effectively required, but due to backwards compatibility is
+                              allowed to be empty. Instances of this type with an empty value here are
+                              almost certainly wrong.
+                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                            type: string
+                        type: object
+                        x-kubernetes-map-type: atomic
+                    type: object
+                  tolerations:
+                    items:
+                      description: |-
+                        The pod this Toleration is attached to tolerates any taint that matches
+                        the triple <key,value,effect> using the matching operator <operator>.
+                      properties:
+                        effect:
+                          description: |-
+                            Effect indicates the taint effect to match. Empty means match all taint effects.
+                            When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+                          type: string
+                        key:
+                          description: |-
+                            Key is the taint key that the toleration applies to. Empty means match all taint keys.
+                            If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+                          type: string
+                        operator:
+                          description: |-
+                            Operator represents a key's relationship to the value.
+                            Valid operators are Exists and Equal. Defaults to Equal.
+                            Exists is equivalent to wildcard for value, so that a pod can
+                            tolerate all taints of a particular category.
+                          type: string
+                        tolerationSeconds:
+                          description: |-
+                            TolerationSeconds represents the period of time the toleration (which must be
+                            of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+                            it is not set, which means tolerate the taint forever (do not evict). Zero and
+                            negative values will be treated as 0 (evict immediately) by the system.
+                          format: int64
+                          type: integer
+                        value:
+                          description: |-
+                            Value is the taint value the toleration matches to.
+                            If the operator is Exists, the value should be empty, otherwise just a regular string.
+                          type: string
+                      type: object
+                    type: array
+                  version:
+                    type: string
+                required:
+                - replicas
+                - version
+                type: object
+              general:
+                description: |-
+                  INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
+                  Important: Run "make" to regenerate code after modifying this file
+                properties:
+                  additionalConfig:
+                    additionalProperties:
+                      type: string
+                    description: Extra items to add to the opensearch.yml
+                    type: object
+                  additionalVolumes:
+                    description: Additional volumes to mount to all pods in the cluster
+                    items:
+                      properties:
+                        configMap:
+                          description: ConfigMap to use to populate the volume
+                          properties:
+                            defaultMode:
+                              description: |-
+                                defaultMode is optional: mode bits used to set permissions on created files by default.
+                                Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                Defaults to 0644.
+                                Directories within the path are not affected by this setting.
+                                This might be in conflict with other options that affect the file
+                                mode, like fsGroup, and the result can be other mode bits set.
+                              format: int32
+                              type: integer
+                            items:
+                              description: |-
+                                items if unspecified, each key-value pair in the Data field of the referenced
+                                ConfigMap will be projected into the volume as a file whose name is the
+                                key and content is the value. If specified, the listed keys will be
+                                projected into the specified paths, and unlisted keys will not be
+                                present. If a key is specified which is not present in the ConfigMap,
+                                the volume setup will error unless it is marked optional. Paths must be
+                                relative and may not contain the '..' path or start with '..'.
+                              items:
+                                description: Maps a string key to a path within a
+                                  volume.
+                                properties:
+                                  key:
+                                    description: key is the key to project.
+                                    type: string
+                                  mode:
+                                    description: |-
+                                      mode is Optional: mode bits used to set permissions on this file.
+                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                      If not specified, the volume defaultMode will be used.
+                                      This might be in conflict with other options that affect the file
+                                      mode, like fsGroup, and the result can be other mode bits set.
+                                    format: int32
+                                    type: integer
+                                  path:
+                                    description: |-
+                                      path is the relative path of the file to map the key to.
+                                      May not be an absolute path.
+                                      May not contain the path element '..'.
+                                      May not start with the string '..'.
+                                    type: string
+                                required:
+                                - key
+                                - path
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            name:
+                              default: ""
+                              description: |-
+                                Name of the referent.
+                                This field is effectively required, but due to backwards compatibility is
+                                allowed to be empty. Instances of this type with an empty value here are
+                                almost certainly wrong.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                            optional:
+                              description: optional specify whether the ConfigMap
+                                or its keys must be defined
+                              type: boolean
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        csi:
+                          description: CSI object to use to populate the volume
+                          properties:
+                            driver:
+                              description: |-
+                                driver is the name of the CSI driver that handles this volume.
+                                Consult with your admin for the correct name as registered in the cluster.
+                              type: string
+                            fsType:
+                              description: |-
+                                fsType to mount. Ex. "ext4", "xfs", "ntfs".
+                                If not provided, the empty value is passed to the associated CSI driver
+                                which will determine the default filesystem to apply.
+                              type: string
+                            nodePublishSecretRef:
+                              description: |-
+                                nodePublishSecretRef is a reference to the secret object containing
+                                sensitive information to pass to the CSI driver to complete the CSI
+                                NodePublishVolume and NodeUnpublishVolume calls.
+                                This field is optional, and  may be empty if no secret is required. If the
+                                secret object contains more than one secret, all secret references are passed.
+                              properties:
+                                name:
+                                  default: ""
+                                  description: |-
+                                    Name of the referent.
+                                    This field is effectively required, but due to backwards compatibility is
+                                    allowed to be empty. Instances of this type with an empty value here are
+                                    almost certainly wrong.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            readOnly:
+                              description: |-
+                                readOnly specifies a read-only configuration for the volume.
+                                Defaults to false (read/write).
+                              type: boolean
+                            volumeAttributes:
+                              additionalProperties:
+                                type: string
+                              description: |-
+                                volumeAttributes stores driver-specific properties that are passed to the CSI
+                                driver. Consult your driver's documentation for supported values.
+                              type: object
+                          required:
+                          - driver
+                          type: object
+                        emptyDir:
+                          description: EmptyDir to use to populate the volume
+                          properties:
+                            medium:
+                              description: |-
+                                medium represents what type of storage medium should back this directory.
+                                The default is "" which means to use the node's default medium.
+                                Must be an empty string (default) or Memory.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                              type: string
+                            sizeLimit:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: |-
+                                sizeLimit is the total amount of local storage required for this EmptyDir volume.
+                                The size limit is also applicable for memory medium.
+                                The maximum usage on memory medium EmptyDir would be the minimum value between
+                                the SizeLimit specified here and the sum of memory limits of all containers in a pod.
+                                The default is nil which means that the limit is undefined.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                          type: object
+                        name:
+                          description: Name to use for the volume. Required.
+                          type: string
+                        path:
+                          description: Path in the container to mount the volume at.
+                            Required.
+                          type: string
+                        projected:
+                          description: Projected object to use to populate the volume
+                          properties:
+                            defaultMode:
+                              description: |-
+                                defaultMode are the mode bits used to set permissions on created files by default.
+                                Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                Directories within the path are not affected by this setting.
+                                This might be in conflict with other options that affect the file
+                                mode, like fsGroup, and the result can be other mode bits set.
+                              format: int32
+                              type: integer
+                            sources:
+                              description: |-
+                                sources is the list of volume projections. Each entry in this list
+                                handles one source.
+                              items:
+                                description: |-
+                                  Projection that may be projected along with other supported volume types.
+                                  Exactly one of these fields must be set.
+                                properties:
+                                  clusterTrustBundle:
+                                    description: |-
+                                      ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field
+                                      of ClusterTrustBundle objects in an auto-updating file.
+
+                                      Alpha, gated by the ClusterTrustBundleProjection feature gate.
+
+                                      ClusterTrustBundle objects can either be selected by name, or by the
+                                      combination of signer name and a label selector.
+
+                                      Kubelet performs aggressive normalization of the PEM contents written
+                                      into the pod filesystem.  Esoteric PEM features such as inter-block
+                                      comments and block headers are stripped.  Certificates are deduplicated.
+                                      The ordering of certificates within the file is arbitrary, and Kubelet
+                                      may change the order over time.
+                                    properties:
+                                      labelSelector:
+                                        description: |-
+                                          Select all ClusterTrustBundles that match this label selector.  Only has
+                                          effect if signerName is set.  Mutually-exclusive with name.  If unset,
+                                          interpreted as "match nothing".  If set but empty, interpreted as "match
+                                          everything".
+                                        properties:
+                                          matchExpressions:
+                                            description: matchExpressions is a list
+                                              of label selector requirements. The
+                                              requirements are ANDed.
+                                            items:
+                                              description: |-
+                                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                                relates the key and values.
+                                              properties:
+                                                key:
+                                                  description: key is the label key
+                                                    that the selector applies to.
+                                                  type: string
+                                                operator:
+                                                  description: |-
+                                                    operator represents a key's relationship to a set of values.
+                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                  type: string
+                                                values:
+                                                  description: |-
+                                                    values is an array of string values. If the operator is In or NotIn,
+                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                    the values array must be empty. This array is replaced during a strategic
+                                                    merge patch.
+                                                  items:
+                                                    type: string
+                                                  type: array
+                                                  x-kubernetes-list-type: atomic
+                                              required:
+                                              - key
+                                              - operator
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          matchLabels:
+                                            additionalProperties:
+                                              type: string
+                                            description: |-
+                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                            type: object
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      name:
+                                        description: |-
+                                          Select a single ClusterTrustBundle by object name.  Mutually-exclusive
+                                          with signerName and labelSelector.
+                                        type: string
+                                      optional:
+                                        description: |-
+                                          If true, don't block pod startup if the referenced ClusterTrustBundle(s)
+                                          aren't available.  If using name, then the named ClusterTrustBundle is
+                                          allowed not to exist.  If using signerName, then the combination of
+                                          signerName and labelSelector is allowed to match zero
+                                          ClusterTrustBundles.
+                                        type: boolean
+                                      path:
+                                        description: Relative path from the volume
+                                          root to write the bundle.
+                                        type: string
+                                      signerName:
+                                        description: |-
+                                          Select all ClusterTrustBundles that match this signer name.
+                                          Mutually-exclusive with name.  The contents of all selected
+                                          ClusterTrustBundles will be unified and deduplicated.
+                                        type: string
+                                    required:
+                                    - path
+                                    type: object
+                                  configMap:
+                                    description: configMap information about the configMap
+                                      data to project
+                                    properties:
+                                      items:
+                                        description: |-
+                                          items if unspecified, each key-value pair in the Data field of the referenced
+                                          ConfigMap will be projected into the volume as a file whose name is the
+                                          key and content is the value. If specified, the listed keys will be
+                                          projected into the specified paths, and unlisted keys will not be
+                                          present. If a key is specified which is not present in the ConfigMap,
+                                          the volume setup will error unless it is marked optional. Paths must be
+                                          relative and may not contain the '..' path or start with '..'.
+                                        items:
+                                          description: Maps a string key to a path
+                                            within a volume.
+                                          properties:
+                                            key:
+                                              description: key is the key to project.
+                                              type: string
+                                            mode:
+                                              description: |-
+                                                mode is Optional: mode bits used to set permissions on this file.
+                                                Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                                YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                If not specified, the volume defaultMode will be used.
+                                                This might be in conflict with other options that affect the file
+                                                mode, like fsGroup, and the result can be other mode bits set.
+                                              format: int32
+                                              type: integer
+                                            path:
+                                              description: |-
+                                                path is the relative path of the file to map the key to.
+                                                May not be an absolute path.
+                                                May not contain the path element '..'.
+                                                May not start with the string '..'.
+                                              type: string
+                                          required:
+                                          - key
+                                          - path
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      name:
+                                        default: ""
+                                        description: |-
+                                          Name of the referent.
+                                          This field is effectively required, but due to backwards compatibility is
+                                          allowed to be empty. Instances of this type with an empty value here are
+                                          almost certainly wrong.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                      optional:
+                                        description: optional specify whether the
+                                          ConfigMap or its keys must be defined
+                                        type: boolean
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                  downwardAPI:
+                                    description: downwardAPI information about the
+                                      downwardAPI data to project
+                                    properties:
+                                      items:
+                                        description: Items is a list of DownwardAPIVolume
+                                          file
+                                        items:
+                                          description: DownwardAPIVolumeFile represents
+                                            information to create the file containing
+                                            the pod field
+                                          properties:
+                                            fieldRef:
+                                              description: 'Required: Selects a field
+                                                of the pod: only annotations, labels,
+                                                name, namespace and uid are supported.'
+                                              properties:
+                                                apiVersion:
+                                                  description: Version of the schema
+                                                    the FieldPath is written in terms
+                                                    of, defaults to "v1".
+                                                  type: string
+                                                fieldPath:
+                                                  description: Path of the field to
+                                                    select in the specified API version.
+                                                  type: string
+                                              required:
+                                              - fieldPath
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            mode:
+                                              description: |-
+                                                Optional: mode bits used to set permissions on this file, must be an octal value
+                                                between 0000 and 0777 or a decimal value between 0 and 511.
+                                                YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                If not specified, the volume defaultMode will be used.
+                                                This might be in conflict with other options that affect the file
+                                                mode, like fsGroup, and the result can be other mode bits set.
+                                              format: int32
+                                              type: integer
+                                            path:
+                                              description: 'Required: Path is  the
+                                                relative path name of the file to
+                                                be created. Must not be absolute or
+                                                contain the ''..'' path. Must be utf-8
+                                                encoded. The first item of the relative
+                                                path must not start with ''..'''
+                                              type: string
+                                            resourceFieldRef:
+                                              description: |-
+                                                Selects a resource of the container: only resources limits and requests
+                                                (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.
+                                              properties:
+                                                containerName:
+                                                  description: 'Container name: required
+                                                    for volumes, optional for env
+                                                    vars'
+                                                  type: string
+                                                divisor:
+                                                  anyOf:
+                                                  - type: integer
+                                                  - type: string
+                                                  description: Specifies the output
+                                                    format of the exposed resources,
+                                                    defaults to "1"
+                                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                  x-kubernetes-int-or-string: true
+                                                resource:
+                                                  description: 'Required: resource
+                                                    to select'
+                                                  type: string
+                                              required:
+                                              - resource
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                          required:
+                                          - path
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    type: object
+                                  secret:
+                                    description: secret information about the secret
+                                      data to project
+                                    properties:
+                                      items:
+                                        description: |-
+                                          items if unspecified, each key-value pair in the Data field of the referenced
+                                          Secret will be projected into the volume as a file whose name is the
+                                          key and content is the value. If specified, the listed keys will be
+                                          projected into the specified paths, and unlisted keys will not be
+                                          present. If a key is specified which is not present in the Secret,
+                                          the volume setup will error unless it is marked optional. Paths must be
+                                          relative and may not contain the '..' path or start with '..'.
+                                        items:
+                                          description: Maps a string key to a path
+                                            within a volume.
+                                          properties:
+                                            key:
+                                              description: key is the key to project.
+                                              type: string
+                                            mode:
+                                              description: |-
+                                                mode is Optional: mode bits used to set permissions on this file.
+                                                Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                                YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                If not specified, the volume defaultMode will be used.
+                                                This might be in conflict with other options that affect the file
+                                                mode, like fsGroup, and the result can be other mode bits set.
+                                              format: int32
+                                              type: integer
+                                            path:
+                                              description: |-
+                                                path is the relative path of the file to map the key to.
+                                                May not be an absolute path.
+                                                May not contain the path element '..'.
+                                                May not start with the string '..'.
+                                              type: string
+                                          required:
+                                          - key
+                                          - path
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      name:
+                                        default: ""
+                                        description: |-
+                                          Name of the referent.
+                                          This field is effectively required, but due to backwards compatibility is
+                                          allowed to be empty. Instances of this type with an empty value here are
+                                          almost certainly wrong.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                      optional:
+                                        description: optional field specify whether
+                                          the Secret or its key must be defined
+                                        type: boolean
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                  serviceAccountToken:
+                                    description: serviceAccountToken is information
+                                      about the serviceAccountToken data to project
+                                    properties:
+                                      audience:
+                                        description: |-
+                                          audience is the intended audience of the token. A recipient of a token
+                                          must identify itself with an identifier specified in the audience of the
+                                          token, and otherwise should reject the token. The audience defaults to the
+                                          identifier of the apiserver.
+                                        type: string
+                                      expirationSeconds:
+                                        description: |-
+                                          expirationSeconds is the requested duration of validity of the service
+                                          account token. As the token approaches expiration, the kubelet volume
+                                          plugin will proactively rotate the service account token. The kubelet will
+                                          start trying to rotate the token if the token is older than 80 percent of
+                                          its time to live or if the token is older than 24 hours.Defaults to 1 hour
+                                          and must be at least 10 minutes.
+                                        format: int64
+                                        type: integer
+                                      path:
+                                        description: |-
+                                          path is the path relative to the mount point of the file to project the
+                                          token into.
+                                        type: string
+                                    required:
+                                    - path
+                                    type: object
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                          type: object
+                        restartPods:
+                          description: Whether to restart the pods on content change
+                          type: boolean
+                        secret:
+                          description: Secret to use populate the volume
+                          properties:
+                            defaultMode:
+                              description: |-
+                                defaultMode is Optional: mode bits used to set permissions on created files by default.
+                                Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                YAML accepts both octal and decimal values, JSON requires decimal values
+                                for mode bits. Defaults to 0644.
+                                Directories within the path are not affected by this setting.
+                                This might be in conflict with other options that affect the file
+                                mode, like fsGroup, and the result can be other mode bits set.
+                              format: int32
+                              type: integer
+                            items:
+                              description: |-
+                                items If unspecified, each key-value pair in the Data field of the referenced
+                                Secret will be projected into the volume as a file whose name is the
+                                key and content is the value. If specified, the listed keys will be
+                                projected into the specified paths, and unlisted keys will not be
+                                present. If a key is specified which is not present in the Secret,
+                                the volume setup will error unless it is marked optional. Paths must be
+                                relative and may not contain the '..' path or start with '..'.
+                              items:
+                                description: Maps a string key to a path within a
+                                  volume.
+                                properties:
+                                  key:
+                                    description: key is the key to project.
+                                    type: string
+                                  mode:
+                                    description: |-
+                                      mode is Optional: mode bits used to set permissions on this file.
+                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                      If not specified, the volume defaultMode will be used.
+                                      This might be in conflict with other options that affect the file
+                                      mode, like fsGroup, and the result can be other mode bits set.
+                                    format: int32
+                                    type: integer
+                                  path:
+                                    description: |-
+                                      path is the relative path of the file to map the key to.
+                                      May not be an absolute path.
+                                      May not contain the path element '..'.
+                                      May not start with the string '..'.
+                                    type: string
+                                required:
+                                - key
+                                - path
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            optional:
+                              description: optional field specify whether the Secret
+                                or its keys must be defined
+                              type: boolean
+                            secretName:
+                              description: |-
+                                secretName is the name of the secret in the pod's namespace to use.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                              type: string
+                          type: object
+                        subPath:
+                          description: SubPath of the referenced volume to mount.
+                          type: string
+                      required:
+                      - name
+                      - path
+                      type: object
+                    type: array
+                  annotations:
+                    additionalProperties:
+                      type: string
+                    description: Adds support for annotations in services
+                    type: object
+                  command:
+                    type: string
+                  defaultRepo:
+                    type: string
+                  drainDataNodes:
+                    description: Drain data nodes controls whether to drain data notes
+                      on rolling restart operations
+                    type: boolean
+                  httpPort:
+                    default: 9200
+                    format: int32
+                    type: integer
+                  image:
+                    type: string
+                  imagePullPolicy:
+                    description: PullPolicy describes a policy for if/when to pull
+                      a container image
+                    type: string
+                  imagePullSecrets:
+                    items:
+                      description: |-
+                        LocalObjectReference contains enough information to let you locate the
+                        referenced object inside the same namespace.
+                      properties:
+                        name:
+                          default: ""
+                          description: |-
+                            Name of the referent.
+                            This field is effectively required, but due to backwards compatibility is
+                            allowed to be empty. Instances of this type with an empty value here are
+                            almost certainly wrong.
+                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          type: string
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    type: array
+                  keystore:
+                    description: Populate opensearch keystore before startup
+                    items:
+                      properties:
+                        keyMappings:
+                          additionalProperties:
+                            type: string
+                          description: Key mappings from secret to keystore keys
+                          type: object
+                        secret:
+                          description: Secret containing key value pairs
+                          properties:
+                            name:
+                              default: ""
+                              description: |-
+                                Name of the referent.
+                                This field is effectively required, but due to backwards compatibility is
+                                allowed to be empty. Instances of this type with an empty value here are
+                                almost certainly wrong.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                          type: object
+                          x-kubernetes-map-type: atomic
+                      type: object
+                    type: array
+                  monitoring:
+                    properties:
+                      enable:
+                        type: boolean
+                      labels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      monitoringUserSecret:
+                        type: string
+                      pluginUrl:
+                        type: string
+                      scrapeInterval:
+                        type: string
+                      tlsConfig:
+                        properties:
+                          insecureSkipVerify:
+                            type: boolean
+                          serverName:
+                            type: string
+                        type: object
+                    type: object
+                  pluginsList:
+                    items:
+                      type: string
+                    type: array
+                  podSecurityContext:
+                    description: Set security context for the cluster pods
+                    properties:
+                      appArmorProfile:
+                        description: |-
+                          appArmorProfile is the AppArmor options to use by the containers in this pod.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        properties:
+                          localhostProfile:
+                            description: |-
+                              localhostProfile indicates a profile loaded on the node that should be used.
+                              The profile must be preconfigured on the node to work.
+                              Must match the loaded name of the profile.
+                              Must be set if and only if type is "Localhost".
+                            type: string
+                          type:
+                            description: |-
+                              type indicates which kind of AppArmor profile will be applied.
+                              Valid options are:
+                                Localhost - a profile pre-loaded on the node.
+                                RuntimeDefault - the container runtime's default profile.
+                                Unconfined - no AppArmor enforcement.
+                            type: string
+                        required:
+                        - type
+                        type: object
+                      fsGroup:
+                        description: |-
+                          A special supplemental group that applies to all containers in a pod.
+                          Some volume types allow the Kubelet to change the ownership of that volume
+                          to be owned by the pod:
+
+                          1. The owning GID will be the FSGroup
+                          2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
+                          3. The permission bits are OR'd with rw-rw----
+
+                          If unset, the Kubelet will not modify the ownership and permissions of any volume.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        format: int64
+                        type: integer
+                      fsGroupChangePolicy:
+                        description: |-
+                          fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
+                          before being exposed inside Pod. This field will only apply to
+                          volume types which support fsGroup based ownership(and permissions).
+                          It will have no effect on ephemeral volume types such as: secret, configmaps
+                          and emptydir.
+                          Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        type: string
+                      runAsGroup:
+                        description: |-
+                          The GID to run the entrypoint of the container process.
+                          Uses runtime default if unset.
+                          May also be set in SecurityContext.  If set in both SecurityContext and
+                          PodSecurityContext, the value specified in SecurityContext takes precedence
+                          for that container.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        format: int64
+                        type: integer
+                      runAsNonRoot:
+                        description: |-
+                          Indicates that the container must run as a non-root user.
+                          If true, the Kubelet will validate the image at runtime to ensure that it
+                          does not run as UID 0 (root) and fail to start the container if it does.
+                          If unset or false, no such validation will be performed.
+                          May also be set in SecurityContext.  If set in both SecurityContext and
+                          PodSecurityContext, the value specified in SecurityContext takes precedence.
+                        type: boolean
+                      runAsUser:
+                        description: |-
+                          The UID to run the entrypoint of the container process.
+                          Defaults to user specified in image metadata if unspecified.
+                          May also be set in SecurityContext.  If set in both SecurityContext and
+                          PodSecurityContext, the value specified in SecurityContext takes precedence
+                          for that container.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        format: int64
+                        type: integer
+                      seLinuxChangePolicy:
+                        description: |-
+                          seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod.
+                          It has no effect on nodes that do not support SELinux or to volumes does not support SELinux.
+                          Valid values are "MountOption" and "Recursive".
+
+                          "Recursive" means relabeling of all files on all Pod volumes by the container runtime.
+                          This may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node.
+
+                          "MountOption" mounts all eligible Pod volumes with `-o context` mount option.
+                          This requires all Pods that share the same volume to use the same SELinux label.
+                          It is not possible to share the same volume among privileged and unprivileged Pods.
+                          Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
+                          whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
+                          CSIDriver instance. Other volumes are always re-labelled recursively.
+                          "MountOption" value is allowed only when SELinuxMount feature gate is enabled.
+
+                          If not specified and SELinuxMount feature gate is enabled, "MountOption" is used.
+                          If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes
+                          and "Recursive" for all other volumes.
+
+                          This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.
+
+                          All Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        type: string
+                      seLinuxOptions:
+                        description: |-
+                          The SELinux context to be applied to all containers.
+                          If unspecified, the container runtime will allocate a random SELinux context for each
+                          container.  May also be set in SecurityContext.  If set in
+                          both SecurityContext and PodSecurityContext, the value specified in SecurityContext
+                          takes precedence for that container.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        properties:
+                          level:
+                            description: Level is SELinux level label that applies
+                              to the container.
+                            type: string
+                          role:
+                            description: Role is a SELinux role label that applies
+                              to the container.
+                            type: string
+                          type:
+                            description: Type is a SELinux type label that applies
+                              to the container.
+                            type: string
+                          user:
+                            description: User is a SELinux user label that applies
+                              to the container.
+                            type: string
+                        type: object
+                      seccompProfile:
+                        description: |-
+                          The seccomp options to use by the containers in this pod.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        properties:
+                          localhostProfile:
+                            description: |-
+                              localhostProfile indicates a profile defined in a file on the node should be used.
+                              The profile must be preconfigured on the node to work.
+                              Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                              Must be set if type is "Localhost". Must NOT be set for any other type.
+                            type: string
+                          type:
+                            description: |-
+                              type indicates which kind of seccomp profile will be applied.
+                              Valid options are:
+
+                              Localhost - a profile defined in a file on the node should be used.
+                              RuntimeDefault - the container runtime default profile should be used.
+                              Unconfined - no profile should be applied.
+                            type: string
+                        required:
+                        - type
+                        type: object
+                      supplementalGroups:
+                        description: |-
+                          A list of groups applied to the first process run in each container, in
+                          addition to the container's primary GID and fsGroup (if specified).  If
+                          the SupplementalGroupsPolicy feature is enabled, the
+                          supplementalGroupsPolicy field determines whether these are in addition
+                          to or instead of any group memberships defined in the container image.
+                          If unspecified, no additional groups are added, though group memberships
+                          defined in the container image may still be used, depending on the
+                          supplementalGroupsPolicy field.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        items:
+                          format: int64
+                          type: integer
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      supplementalGroupsPolicy:
+                        description: |-
+                          Defines how supplemental groups of the first container processes are calculated.
+                          Valid values are "Merge" and "Strict". If not specified, "Merge" is used.
+                          (Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled
+                          and the container runtime must implement support for this feature.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        type: string
+                      sysctls:
+                        description: |-
+                          Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
+                          sysctls (by the container runtime) might fail to launch.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        items:
+                          description: Sysctl defines a kernel parameter to be set
+                          properties:
+                            name:
+                              description: Name of a property to set
+                              type: string
+                            value:
+                              description: Value of a property to set
+                              type: string
+                          required:
+                          - name
+                          - value
+                          type: object
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      windowsOptions:
+                        description: |-
+                          The Windows specific settings applied to all containers.
+                          If unspecified, the options within a container's SecurityContext will be used.
+                          If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+                          Note that this field cannot be set when spec.os.name is linux.
+                        properties:
+                          gmsaCredentialSpec:
+                            description: |-
+                              GMSACredentialSpec is where the GMSA admission webhook
+                              (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
+                              GMSA credential spec named by the GMSACredentialSpecName field.
+                            type: string
+                          gmsaCredentialSpecName:
+                            description: GMSACredentialSpecName is the name of the
+                              GMSA credential spec to use.
+                            type: string
+                          hostProcess:
+                            description: |-
+                              HostProcess determines if a container should be run as a 'Host Process' container.
+                              All of a Pod's containers must have the same effective HostProcess value
+                              (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
+                              In addition, if HostProcess is true then HostNetwork must also be set to true.
+                            type: boolean
+                          runAsUserName:
+                            description: |-
+                              The UserName in Windows to run the entrypoint of the container process.
+                              Defaults to the user specified in image metadata if unspecified.
+                              May also be set in PodSecurityContext. If set in both SecurityContext and
+                              PodSecurityContext, the value specified in SecurityContext takes precedence.
+                            type: string
+                        type: object
+                    type: object
+                  securityContext:
+                    description: Set security context for the cluster pods' container
+                    properties:
+                      allowPrivilegeEscalation:
+                        description: |-
+                          AllowPrivilegeEscalation controls whether a process can gain more
+                          privileges than its parent process. This bool directly controls if
+                          the no_new_privs flag will be set on the container process.
+                          AllowPrivilegeEscalation is true always when the container is:
+                          1) run as Privileged
+                          2) has CAP_SYS_ADMIN
+                          Note that this field cannot be set when spec.os.name is windows.
+                        type: boolean
+                      appArmorProfile:
+                        description: |-
+                          appArmorProfile is the AppArmor options to use by this container. If set, this profile
+                          overrides the pod's appArmorProfile.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        properties:
+                          localhostProfile:
+                            description: |-
+                              localhostProfile indicates a profile loaded on the node that should be used.
+                              The profile must be preconfigured on the node to work.
+                              Must match the loaded name of the profile.
+                              Must be set if and only if type is "Localhost".
+                            type: string
+                          type:
+                            description: |-
+                              type indicates which kind of AppArmor profile will be applied.
+                              Valid options are:
+                                Localhost - a profile pre-loaded on the node.
+                                RuntimeDefault - the container runtime's default profile.
+                                Unconfined - no AppArmor enforcement.
+                            type: string
+                        required:
+                        - type
+                        type: object
+                      capabilities:
+                        description: |-
+                          The capabilities to add/drop when running containers.
+                          Defaults to the default set of capabilities granted by the container runtime.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        properties:
+                          add:
+                            description: Added capabilities
+                            items:
+                              description: Capability represent POSIX capabilities
+                                type
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          drop:
+                            description: Removed capabilities
+                            items:
+                              description: Capability represent POSIX capabilities
+                                type
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: atomic
+                        type: object
+                      privileged:
+                        description: |-
+                          Run container in privileged mode.
+                          Processes in privileged containers are essentially equivalent to root on the host.
+                          Defaults to false.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        type: boolean
+                      procMount:
+                        description: |-
+                          procMount denotes the type of proc mount to use for the containers.
+                          The default value is Default which uses the container runtime defaults for
+                          readonly paths and masked paths.
+                          This requires the ProcMountType feature flag to be enabled.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        type: string
+                      readOnlyRootFilesystem:
+                        description: |-
+                          Whether this container has a read-only root filesystem.
+                          Default is false.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        type: boolean
+                      runAsGroup:
+                        description: |-
+                          The GID to run the entrypoint of the container process.
+                          Uses runtime default if unset.
+                          May also be set in PodSecurityContext.  If set in both SecurityContext and
+                          PodSecurityContext, the value specified in SecurityContext takes precedence.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        format: int64
+                        type: integer
+                      runAsNonRoot:
+                        description: |-
+                          Indicates that the container must run as a non-root user.
+                          If true, the Kubelet will validate the image at runtime to ensure that it
+                          does not run as UID 0 (root) and fail to start the container if it does.
+                          If unset or false, no such validation will be performed.
+                          May also be set in PodSecurityContext.  If set in both SecurityContext and
+                          PodSecurityContext, the value specified in SecurityContext takes precedence.
+                        type: boolean
+                      runAsUser:
+                        description: |-
+                          The UID to run the entrypoint of the container process.
+                          Defaults to user specified in image metadata if unspecified.
+                          May also be set in PodSecurityContext.  If set in both SecurityContext and
+                          PodSecurityContext, the value specified in SecurityContext takes precedence.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        format: int64
+                        type: integer
+                      seLinuxOptions:
+                        description: |-
+                          The SELinux context to be applied to the container.
+                          If unspecified, the container runtime will allocate a random SELinux context for each
+                          container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
+                          PodSecurityContext, the value specified in SecurityContext takes precedence.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        properties:
+                          level:
+                            description: Level is SELinux level label that applies
+                              to the container.
+                            type: string
+                          role:
+                            description: Role is a SELinux role label that applies
+                              to the container.
+                            type: string
+                          type:
+                            description: Type is a SELinux type label that applies
+                              to the container.
+                            type: string
+                          user:
+                            description: User is a SELinux user label that applies
+                              to the container.
+                            type: string
+                        type: object
+                      seccompProfile:
+                        description: |-
+                          The seccomp options to use by this container. If seccomp options are
+                          provided at both the pod & container level, the container options
+                          override the pod options.
+                          Note that this field cannot be set when spec.os.name is windows.
+                        properties:
+                          localhostProfile:
+                            description: |-
+                              localhostProfile indicates a profile defined in a file on the node should be used.
+                              The profile must be preconfigured on the node to work.
+                              Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                              Must be set if type is "Localhost". Must NOT be set for any other type.
+                            type: string
+                          type:
+                            description: |-
+                              type indicates which kind of seccomp profile will be applied.
+                              Valid options are:
+
+                              Localhost - a profile defined in a file on the node should be used.
+                              RuntimeDefault - the container runtime default profile should be used.
+                              Unconfined - no profile should be applied.
+                            type: string
+                        required:
+                        - type
+                        type: object
+                      windowsOptions:
+                        description: |-
+                          The Windows specific settings applied to all containers.
+                          If unspecified, the options from the PodSecurityContext will be used.
+                          If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+                          Note that this field cannot be set when spec.os.name is linux.
+                        properties:
+                          gmsaCredentialSpec:
+                            description: |-
+                              GMSACredentialSpec is where the GMSA admission webhook
+                              (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
+                              GMSA credential spec named by the GMSACredentialSpecName field.
+                            type: string
+                          gmsaCredentialSpecName:
+                            description: GMSACredentialSpecName is the name of the
+                              GMSA credential spec to use.
+                            type: string
+                          hostProcess:
+                            description: |-
+                              HostProcess determines if a container should be run as a 'Host Process' container.
+                              All of a Pod's containers must have the same effective HostProcess value
+                              (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
+                              In addition, if HostProcess is true then HostNetwork must also be set to true.
+                            type: boolean
+                          runAsUserName:
+                            description: |-
+                              The UserName in Windows to run the entrypoint of the container process.
+                              Defaults to the user specified in image metadata if unspecified.
+                              May also be set in PodSecurityContext. If set in both SecurityContext and
+                              PodSecurityContext, the value specified in SecurityContext takes precedence.
+                            type: string
+                        type: object
+                    type: object
+                  serviceAccount:
+                    type: string
+                  serviceName:
+                    type: string
+                  setVMMaxMapCount:
+                    type: boolean
+                  snapshotRepositories:
+                    items:
+                      properties:
+                        name:
+                          type: string
+                        settings:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        type:
+                          type: string
+                      required:
+                      - name
+                      - type
+                      type: object
+                    type: array
+                  vendor:
+                    enum:
+                    - Opensearch
+                    - Op
+                    - OP
+                    - os
+                    - opensearch
+                    type: string
+                  version:
+                    type: string
+                required:
+                - serviceName
+                type: object
+              initHelper:
+                properties:
+                  image:
+                    type: string
+                  imagePullPolicy:
+                    description: PullPolicy describes a policy for if/when to pull
+                      a container image
+                    type: string
+                  imagePullSecrets:
+                    items:
+                      description: |-
+                        LocalObjectReference contains enough information to let you locate the
+                        referenced object inside the same namespace.
+                      properties:
+                        name:
+                          default: ""
+                          description: |-
+                            Name of the referent.
+                            This field is effectively required, but due to backwards compatibility is
+                            allowed to be empty. Instances of this type with an empty value here are
+                            almost certainly wrong.
+                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          type: string
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    type: array
+                  resources:
+                    description: ResourceRequirements describes the compute resource
+                      requirements.
+                    properties:
+                      claims:
+                        description: |-
+                          Claims lists the names of resources, defined in spec.resourceClaims,
+                          that are used by this container.
+
+                          This is an alpha field and requires enabling the
+                          DynamicResourceAllocation feature gate.
+
+                          This field is immutable. It can only be set for containers.
+                        items:
+                          description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+                          properties:
+                            name:
+                              description: |-
+                                Name must match the name of one entry in pod.spec.resourceClaims of
+                                the Pod where this field is used. It makes that resource available
+                                inside a container.
+                              type: string
+                            request:
+                              description: |-
+                                Request is the name chosen for a request in the referenced claim.
+                                If empty, everything from the claim is made available, otherwise
+                                only the result of this request.
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                        x-kubernetes-list-map-keys:
+                        - name
+                        x-kubernetes-list-type: map
+                      limits:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        description: |-
+                          Limits describes the maximum amount of compute resources allowed.
+                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                        type: object
+                      requests:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        description: |-
+                          Requests describes the minimum amount of compute resources required.
+                          If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                          otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                        type: object
+                    type: object
+                  version:
+                    type: string
+                type: object
+              nodePools:
+                items:
+                  properties:
+                    additionalConfig:
+                      additionalProperties:
+                        type: string
+                      type: object
+                    affinity:
+                      description: Affinity is a group of affinity scheduling rules.
+                      properties:
+                        nodeAffinity:
+                          description: Describes node affinity scheduling rules for
+                            the pod.
+                          properties:
+                            preferredDuringSchedulingIgnoredDuringExecution:
+                              description: |-
+                                The scheduler will prefer to schedule pods to nodes that satisfy
+                                the affinity expressions specified by this field, but it may choose
+                                a node that violates one or more of the expressions. The node that is
+                                most preferred is the one with the greatest sum of weights, i.e.
+                                for each node that meets all of the scheduling requirements (resource
+                                request, requiredDuringScheduling affinity expressions, etc.),
+                                compute a sum by iterating through the elements of this field and adding
+                                "weight" to the sum if the node matches the corresponding matchExpressions; the
+                                node(s) with the highest sum are the most preferred.
+                              items:
+                                description: |-
+                                  An empty preferred scheduling term matches all objects with implicit weight 0
+                                  (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+                                properties:
+                                  preference:
+                                    description: A node selector term, associated
+                                      with the corresponding weight.
+                                    properties:
+                                      matchExpressions:
+                                        description: A list of node selector requirements
+                                          by node's labels.
+                                        items:
+                                          description: |-
+                                            A node selector requirement is a selector that contains values, a key, and an operator
+                                            that relates the key and values.
+                                          properties:
+                                            key:
+                                              description: The label key that the
+                                                selector applies to.
+                                              type: string
+                                            operator:
+                                              description: |-
+                                                Represents a key's relationship to a set of values.
+                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                              type: string
+                                            values:
+                                              description: |-
+                                                An array of string values. If the operator is In or NotIn,
+                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                the values array must be empty. If the operator is Gt or Lt, the values
+                                                array must have a single element, which will be interpreted as an integer.
+                                                This array is replaced during a strategic merge patch.
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                          required:
+                                          - key
+                                          - operator
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      matchFields:
+                                        description: A list of node selector requirements
+                                          by node's fields.
+                                        items:
+                                          description: |-
+                                            A node selector requirement is a selector that contains values, a key, and an operator
+                                            that relates the key and values.
+                                          properties:
+                                            key:
+                                              description: The label key that the
+                                                selector applies to.
+                                              type: string
+                                            operator:
+                                              description: |-
+                                                Represents a key's relationship to a set of values.
+                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                              type: string
+                                            values:
+                                              description: |-
+                                                An array of string values. If the operator is In or NotIn,
+                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                the values array must be empty. If the operator is Gt or Lt, the values
+                                                array must have a single element, which will be interpreted as an integer.
+                                                This array is replaced during a strategic merge patch.
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                          required:
+                                          - key
+                                          - operator
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                  weight:
+                                    description: Weight associated with matching the
+                                      corresponding nodeSelectorTerm, in the range
+                                      1-100.
+                                    format: int32
+                                    type: integer
+                                required:
+                                - preference
+                                - weight
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            requiredDuringSchedulingIgnoredDuringExecution:
+                              description: |-
+                                If the affinity requirements specified by this field are not met at
+                                scheduling time, the pod will not be scheduled onto the node.
+                                If the affinity requirements specified by this field cease to be met
+                                at some point during pod execution (e.g. due to an update), the system
+                                may or may not try to eventually evict the pod from its node.
+                              properties:
+                                nodeSelectorTerms:
+                                  description: Required. A list of node selector terms.
+                                    The terms are ORed.
+                                  items:
+                                    description: |-
+                                      A null or empty node selector term matches no objects. The requirements of
+                                      them are ANDed.
+                                      The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+                                    properties:
+                                      matchExpressions:
+                                        description: A list of node selector requirements
+                                          by node's labels.
+                                        items:
+                                          description: |-
+                                            A node selector requirement is a selector that contains values, a key, and an operator
+                                            that relates the key and values.
+                                          properties:
+                                            key:
+                                              description: The label key that the
+                                                selector applies to.
+                                              type: string
+                                            operator:
+                                              description: |-
+                                                Represents a key's relationship to a set of values.
+                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                              type: string
+                                            values:
+                                              description: |-
+                                                An array of string values. If the operator is In or NotIn,
+                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                the values array must be empty. If the operator is Gt or Lt, the values
+                                                array must have a single element, which will be interpreted as an integer.
+                                                This array is replaced during a strategic merge patch.
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                          required:
+                                          - key
+                                          - operator
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      matchFields:
+                                        description: A list of node selector requirements
+                                          by node's fields.
+                                        items:
+                                          description: |-
+                                            A node selector requirement is a selector that contains values, a key, and an operator
+                                            that relates the key and values.
+                                          properties:
+                                            key:
+                                              description: The label key that the
+                                                selector applies to.
+                                              type: string
+                                            operator:
+                                              description: |-
+                                                Represents a key's relationship to a set of values.
+                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                              type: string
+                                            values:
+                                              description: |-
+                                                An array of string values. If the operator is In or NotIn,
+                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                the values array must be empty. If the operator is Gt or Lt, the values
+                                                array must have a single element, which will be interpreted as an integer.
+                                                This array is replaced during a strategic merge patch.
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                          required:
+                                          - key
+                                          - operator
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - nodeSelectorTerms
+                              type: object
+                              x-kubernetes-map-type: atomic
+                          type: object
+                        podAffinity:
+                          description: Describes pod affinity scheduling rules (e.g.
+                            co-locate this pod in the same node, zone, etc. as some
+                            other pod(s)).
+                          properties:
+                            preferredDuringSchedulingIgnoredDuringExecution:
+                              description: |-
+                                The scheduler will prefer to schedule pods to nodes that satisfy
+                                the affinity expressions specified by this field, but it may choose
+                                a node that violates one or more of the expressions. The node that is
+                                most preferred is the one with the greatest sum of weights, i.e.
+                                for each node that meets all of the scheduling requirements (resource
+                                request, requiredDuringScheduling affinity expressions, etc.),
+                                compute a sum by iterating through the elements of this field and adding
+                                "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                node(s) with the highest sum are the most preferred.
+                              items:
+                                description: The weights of all of the matched WeightedPodAffinityTerm
+                                  fields are added per-node to find the most preferred
+                                  node(s)
+                                properties:
+                                  podAffinityTerm:
+                                    description: Required. A pod affinity term, associated
+                                      with the corresponding weight.
+                                    properties:
+                                      labelSelector:
+                                        description: |-
+                                          A label query over a set of resources, in this case pods.
+                                          If it's null, this PodAffinityTerm matches with no Pods.
+                                        properties:
+                                          matchExpressions:
+                                            description: matchExpressions is a list
+                                              of label selector requirements. The
+                                              requirements are ANDed.
+                                            items:
+                                              description: |-
+                                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                                relates the key and values.
+                                              properties:
+                                                key:
+                                                  description: key is the label key
+                                                    that the selector applies to.
+                                                  type: string
+                                                operator:
+                                                  description: |-
+                                                    operator represents a key's relationship to a set of values.
+                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                  type: string
+                                                values:
+                                                  description: |-
+                                                    values is an array of string values. If the operator is In or NotIn,
+                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                    the values array must be empty. This array is replaced during a strategic
+                                                    merge patch.
+                                                  items:
+                                                    type: string
+                                                  type: array
+                                                  x-kubernetes-list-type: atomic
+                                              required:
+                                              - key
+                                              - operator
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          matchLabels:
+                                            additionalProperties:
+                                              type: string
+                                            description: |-
+                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                            type: object
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      matchLabelKeys:
+                                        description: |-
+                                          MatchLabelKeys is a set of pod label keys to select which pods will
+                                          be taken into consideration. The keys are used to lookup values from the
+                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                          to select the group of existing pods which pods will be taken into consideration
+                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                          pod labels will be ignored. The default value is empty.
+                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      mismatchLabelKeys:
+                                        description: |-
+                                          MismatchLabelKeys is a set of pod label keys to select which pods will
+                                          be taken into consideration. The keys are used to lookup values from the
+                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                          to select the group of existing pods which pods will be taken into consideration
+                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                          pod labels will be ignored. The default value is empty.
+                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      namespaceSelector:
+                                        description: |-
+                                          A label query over the set of namespaces that the term applies to.
+                                          The term is applied to the union of the namespaces selected by this field
+                                          and the ones listed in the namespaces field.
+                                          null selector and null or empty namespaces list means "this pod's namespace".
+                                          An empty selector ({}) matches all namespaces.
+                                        properties:
+                                          matchExpressions:
+                                            description: matchExpressions is a list
+                                              of label selector requirements. The
+                                              requirements are ANDed.
+                                            items:
+                                              description: |-
+                                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                                relates the key and values.
+                                              properties:
+                                                key:
+                                                  description: key is the label key
+                                                    that the selector applies to.
+                                                  type: string
+                                                operator:
+                                                  description: |-
+                                                    operator represents a key's relationship to a set of values.
+                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                  type: string
+                                                values:
+                                                  description: |-
+                                                    values is an array of string values. If the operator is In or NotIn,
+                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                    the values array must be empty. This array is replaced during a strategic
+                                                    merge patch.
+                                                  items:
+                                                    type: string
+                                                  type: array
+                                                  x-kubernetes-list-type: atomic
+                                              required:
+                                              - key
+                                              - operator
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          matchLabels:
+                                            additionalProperties:
+                                              type: string
+                                            description: |-
+                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                            type: object
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      namespaces:
+                                        description: |-
+                                          namespaces specifies a static list of namespace names that the term applies to.
+                                          The term is applied to the union of the namespaces listed in this field
+                                          and the ones selected by namespaceSelector.
+                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      topologyKey:
+                                        description: |-
+                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                          whose value of the label with key topologyKey matches that of any node on which any of the
+                                          selected pods is running.
+                                          Empty topologyKey is not allowed.
+                                        type: string
+                                    required:
+                                    - topologyKey
+                                    type: object
+                                  weight:
+                                    description: |-
+                                      weight associated with matching the corresponding podAffinityTerm,
+                                      in the range 1-100.
+                                    format: int32
+                                    type: integer
+                                required:
+                                - podAffinityTerm
+                                - weight
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            requiredDuringSchedulingIgnoredDuringExecution:
+                              description: |-
+                                If the affinity requirements specified by this field are not met at
+                                scheduling time, the pod will not be scheduled onto the node.
+                                If the affinity requirements specified by this field cease to be met
+                                at some point during pod execution (e.g. due to a pod label update), the
+                                system may or may not try to eventually evict the pod from its node.
+                                When there are multiple elements, the lists of nodes corresponding to each
+                                podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                              items:
+                                description: |-
+                                  Defines a set of pods (namely those matching the labelSelector
+                                  relative to the given namespace(s)) that this pod should be
+                                  co-located (affinity) or not co-located (anti-affinity) with,
+                                  where co-located is defined as running on a node whose value of
+                                  the label with key <topologyKey> matches that of any node on which
+                                  a pod of the set of pods is running
+                                properties:
+                                  labelSelector:
+                                    description: |-
+                                      A label query over a set of resources, in this case pods.
+                                      If it's null, this PodAffinityTerm matches with no Pods.
+                                    properties:
+                                      matchExpressions:
+                                        description: matchExpressions is a list of
+                                          label selector requirements. The requirements
+                                          are ANDed.
+                                        items:
+                                          description: |-
+                                            A label selector requirement is a selector that contains values, a key, and an operator that
+                                            relates the key and values.
+                                          properties:
+                                            key:
+                                              description: key is the label key that
+                                                the selector applies to.
+                                              type: string
+                                            operator:
+                                              description: |-
+                                                operator represents a key's relationship to a set of values.
+                                                Valid operators are In, NotIn, Exists and DoesNotExist.
+                                              type: string
+                                            values:
+                                              description: |-
+                                                values is an array of string values. If the operator is In or NotIn,
+                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                the values array must be empty. This array is replaced during a strategic
+                                                merge patch.
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                          required:
+                                          - key
+                                          - operator
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      matchLabels:
+                                        additionalProperties:
+                                          type: string
+                                        description: |-
+                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                        type: object
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                  matchLabelKeys:
+                                    description: |-
+                                      MatchLabelKeys is a set of pod label keys to select which pods will
+                                      be taken into consideration. The keys are used to lookup values from the
+                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                      to select the group of existing pods which pods will be taken into consideration
+                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                      pod labels will be ignored. The default value is empty.
+                                      The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                      Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  mismatchLabelKeys:
+                                    description: |-
+                                      MismatchLabelKeys is a set of pod label keys to select which pods will
+                                      be taken into consideration. The keys are used to lookup values from the
+                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                      to select the group of existing pods which pods will be taken into consideration
+                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                      pod labels will be ignored. The default value is empty.
+                                      The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                      Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  namespaceSelector:
+                                    description: |-
+                                      A label query over the set of namespaces that the term applies to.
+                                      The term is applied to the union of the namespaces selected by this field
+                                      and the ones listed in the namespaces field.
+                                      null selector and null or empty namespaces list means "this pod's namespace".
+                                      An empty selector ({}) matches all namespaces.
+                                    properties:
+                                      matchExpressions:
+                                        description: matchExpressions is a list of
+                                          label selector requirements. The requirements
+                                          are ANDed.
+                                        items:
+                                          description: |-
+                                            A label selector requirement is a selector that contains values, a key, and an operator that
+                                            relates the key and values.
+                                          properties:
+                                            key:
+                                              description: key is the label key that
+                                                the selector applies to.
+                                              type: string
+                                            operator:
+                                              description: |-
+                                                operator represents a key's relationship to a set of values.
+                                                Valid operators are In, NotIn, Exists and DoesNotExist.
+                                              type: string
+                                            values:
+                                              description: |-
+                                                values is an array of string values. If the operator is In or NotIn,
+                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                the values array must be empty. This array is replaced during a strategic
+                                                merge patch.
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                          required:
+                                          - key
+                                          - operator
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      matchLabels:
+                                        additionalProperties:
+                                          type: string
+                                        description: |-
+                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                        type: object
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                  namespaces:
+                                    description: |-
+                                      namespaces specifies a static list of namespace names that the term applies to.
+                                      The term is applied to the union of the namespaces listed in this field
+                                      and the ones selected by namespaceSelector.
+                                      null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  topologyKey:
+                                    description: |-
+                                      This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                      the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                      whose value of the label with key topologyKey matches that of any node on which any of the
+                                      selected pods is running.
+                                      Empty topologyKey is not allowed.
+                                    type: string
+                                required:
+                                - topologyKey
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                          type: object
+                        podAntiAffinity:
+                          description: Describes pod anti-affinity scheduling rules
+                            (e.g. avoid putting this pod in the same node, zone, etc.
+                            as some other pod(s)).
+                          properties:
+                            preferredDuringSchedulingIgnoredDuringExecution:
+                              description: |-
+                                The scheduler will prefer to schedule pods to nodes that satisfy
+                                the anti-affinity expressions specified by this field, but it may choose
+                                a node that violates one or more of the expressions. The node that is
+                                most preferred is the one with the greatest sum of weights, i.e.
+                                for each node that meets all of the scheduling requirements (resource
+                                request, requiredDuringScheduling anti-affinity expressions, etc.),
+                                compute a sum by iterating through the elements of this field and adding
+                                "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                node(s) with the highest sum are the most preferred.
+                              items:
+                                description: The weights of all of the matched WeightedPodAffinityTerm
+                                  fields are added per-node to find the most preferred
+                                  node(s)
+                                properties:
+                                  podAffinityTerm:
+                                    description: Required. A pod affinity term, associated
+                                      with the corresponding weight.
+                                    properties:
+                                      labelSelector:
+                                        description: |-
+                                          A label query over a set of resources, in this case pods.
+                                          If it's null, this PodAffinityTerm matches with no Pods.
+                                        properties:
+                                          matchExpressions:
+                                            description: matchExpressions is a list
+                                              of label selector requirements. The
+                                              requirements are ANDed.
+                                            items:
+                                              description: |-
+                                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                                relates the key and values.
+                                              properties:
+                                                key:
+                                                  description: key is the label key
+                                                    that the selector applies to.
+                                                  type: string
+                                                operator:
+                                                  description: |-
+                                                    operator represents a key's relationship to a set of values.
+                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                  type: string
+                                                values:
+                                                  description: |-
+                                                    values is an array of string values. If the operator is In or NotIn,
+                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                    the values array must be empty. This array is replaced during a strategic
+                                                    merge patch.
+                                                  items:
+                                                    type: string
+                                                  type: array
+                                                  x-kubernetes-list-type: atomic
+                                              required:
+                                              - key
+                                              - operator
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          matchLabels:
+                                            additionalProperties:
+                                              type: string
+                                            description: |-
+                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                            type: object
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      matchLabelKeys:
+                                        description: |-
+                                          MatchLabelKeys is a set of pod label keys to select which pods will
+                                          be taken into consideration. The keys are used to lookup values from the
+                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                          to select the group of existing pods which pods will be taken into consideration
+                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                          pod labels will be ignored. The default value is empty.
+                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      mismatchLabelKeys:
+                                        description: |-
+                                          MismatchLabelKeys is a set of pod label keys to select which pods will
+                                          be taken into consideration. The keys are used to lookup values from the
+                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                          to select the group of existing pods which pods will be taken into consideration
+                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                          pod labels will be ignored. The default value is empty.
+                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      namespaceSelector:
+                                        description: |-
+                                          A label query over the set of namespaces that the term applies to.
+                                          The term is applied to the union of the namespaces selected by this field
+                                          and the ones listed in the namespaces field.
+                                          null selector and null or empty namespaces list means "this pod's namespace".
+                                          An empty selector ({}) matches all namespaces.
+                                        properties:
+                                          matchExpressions:
+                                            description: matchExpressions is a list
+                                              of label selector requirements. The
+                                              requirements are ANDed.
+                                            items:
+                                              description: |-
+                                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                                relates the key and values.
+                                              properties:
+                                                key:
+                                                  description: key is the label key
+                                                    that the selector applies to.
+                                                  type: string
+                                                operator:
+                                                  description: |-
+                                                    operator represents a key's relationship to a set of values.
+                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                  type: string
+                                                values:
+                                                  description: |-
+                                                    values is an array of string values. If the operator is In or NotIn,
+                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                    the values array must be empty. This array is replaced during a strategic
+                                                    merge patch.
+                                                  items:
+                                                    type: string
+                                                  type: array
+                                                  x-kubernetes-list-type: atomic
+                                              required:
+                                              - key
+                                              - operator
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          matchLabels:
+                                            additionalProperties:
+                                              type: string
+                                            description: |-
+                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                            type: object
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      namespaces:
+                                        description: |-
+                                          namespaces specifies a static list of namespace names that the term applies to.
+                                          The term is applied to the union of the namespaces listed in this field
+                                          and the ones selected by namespaceSelector.
+                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      topologyKey:
+                                        description: |-
+                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                          whose value of the label with key topologyKey matches that of any node on which any of the
+                                          selected pods is running.
+                                          Empty topologyKey is not allowed.
+                                        type: string
+                                    required:
+                                    - topologyKey
+                                    type: object
+                                  weight:
+                                    description: |-
+                                      weight associated with matching the corresponding podAffinityTerm,
+                                      in the range 1-100.
+                                    format: int32
+                                    type: integer
+                                required:
+                                - podAffinityTerm
+                                - weight
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            requiredDuringSchedulingIgnoredDuringExecution:
+                              description: |-
+                                If the anti-affinity requirements specified by this field are not met at
+                                scheduling time, the pod will not be scheduled onto the node.
+                                If the anti-affinity requirements specified by this field cease to be met
+                                at some point during pod execution (e.g. due to a pod label update), the
+                                system may or may not try to eventually evict the pod from its node.
+                                When there are multiple elements, the lists of nodes corresponding to each
+                                podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                              items:
+                                description: |-
+                                  Defines a set of pods (namely those matching the labelSelector
+                                  relative to the given namespace(s)) that this pod should be
+                                  co-located (affinity) or not co-located (anti-affinity) with,
+                                  where co-located is defined as running on a node whose value of
+                                  the label with key <topologyKey> matches that of any node on which
+                                  a pod of the set of pods is running
+                                properties:
+                                  labelSelector:
+                                    description: |-
+                                      A label query over a set of resources, in this case pods.
+                                      If it's null, this PodAffinityTerm matches with no Pods.
+                                    properties:
+                                      matchExpressions:
+                                        description: matchExpressions is a list of
+                                          label selector requirements. The requirements
+                                          are ANDed.
+                                        items:
+                                          description: |-
+                                            A label selector requirement is a selector that contains values, a key, and an operator that
+                                            relates the key and values.
+                                          properties:
+                                            key:
+                                              description: key is the label key that
+                                                the selector applies to.
+                                              type: string
+                                            operator:
+                                              description: |-
+                                                operator represents a key's relationship to a set of values.
+                                                Valid operators are In, NotIn, Exists and DoesNotExist.
+                                              type: string
+                                            values:
+                                              description: |-
+                                                values is an array of string values. If the operator is In or NotIn,
+                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                the values array must be empty. This array is replaced during a strategic
+                                                merge patch.
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                          required:
+                                          - key
+                                          - operator
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      matchLabels:
+                                        additionalProperties:
+                                          type: string
+                                        description: |-
+                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                        type: object
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                  matchLabelKeys:
+                                    description: |-
+                                      MatchLabelKeys is a set of pod label keys to select which pods will
+                                      be taken into consideration. The keys are used to lookup values from the
+                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                      to select the group of existing pods which pods will be taken into consideration
+                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                      pod labels will be ignored. The default value is empty.
+                                      The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                      Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  mismatchLabelKeys:
+                                    description: |-
+                                      MismatchLabelKeys is a set of pod label keys to select which pods will
+                                      be taken into consideration. The keys are used to lookup values from the
+                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                      to select the group of existing pods which pods will be taken into consideration
+                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                      pod labels will be ignored. The default value is empty.
+                                      The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                      Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  namespaceSelector:
+                                    description: |-
+                                      A label query over the set of namespaces that the term applies to.
+                                      The term is applied to the union of the namespaces selected by this field
+                                      and the ones listed in the namespaces field.
+                                      null selector and null or empty namespaces list means "this pod's namespace".
+                                      An empty selector ({}) matches all namespaces.
+                                    properties:
+                                      matchExpressions:
+                                        description: matchExpressions is a list of
+                                          label selector requirements. The requirements
+                                          are ANDed.
+                                        items:
+                                          description: |-
+                                            A label selector requirement is a selector that contains values, a key, and an operator that
+                                            relates the key and values.
+                                          properties:
+                                            key:
+                                              description: key is the label key that
+                                                the selector applies to.
+                                              type: string
+                                            operator:
+                                              description: |-
+                                                operator represents a key's relationship to a set of values.
+                                                Valid operators are In, NotIn, Exists and DoesNotExist.
+                                              type: string
+                                            values:
+                                              description: |-
+                                                values is an array of string values. If the operator is In or NotIn,
+                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                the values array must be empty. This array is replaced during a strategic
+                                                merge patch.
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                          required:
+                                          - key
+                                          - operator
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      matchLabels:
+                                        additionalProperties:
+                                          type: string
+                                        description: |-
+                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                        type: object
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                  namespaces:
+                                    description: |-
+                                      namespaces specifies a static list of namespace names that the term applies to.
+                                      The term is applied to the union of the namespaces listed in this field
+                                      and the ones selected by namespaceSelector.
+                                      null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  topologyKey:
+                                    description: |-
+                                      This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                      the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                      whose value of the label with key topologyKey matches that of any node on which any of the
+                                      selected pods is running.
+                                      Empty topologyKey is not allowed.
+                                    type: string
+                                required:
+                                - topologyKey
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                          type: object
+                      type: object
+                    annotations:
+                      additionalProperties:
+                        type: string
+                      type: object
+                    component:
+                      type: string
+                    diskSize:
+                      type: string
+                    env:
+                      items:
+                        description: EnvVar represents an environment variable present
+                          in a Container.
+                        properties:
+                          name:
+                            description: Name of the environment variable. Must be
+                              a C_IDENTIFIER.
+                            type: string
+                          value:
+                            description: |-
+                              Variable references $(VAR_NAME) are expanded
+                              using the previously defined environment variables in the container and
+                              any service environment variables. If a variable cannot be resolved,
+                              the reference in the input string will be unchanged. Double $$ are reduced
+                              to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+                              "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+                              Escaped references will never be expanded, regardless of whether the variable
+                              exists or not.
+                              Defaults to "".
+                            type: string
+                          valueFrom:
+                            description: Source for the environment variable's value.
+                              Cannot be used if value is not empty.
+                            properties:
+                              configMapKeyRef:
+                                description: Selects a key of a ConfigMap.
+                                properties:
+                                  key:
+                                    description: The key to select.
+                                    type: string
+                                  name:
+                                    default: ""
+                                    description: |-
+                                      Name of the referent.
+                                      This field is effectively required, but due to backwards compatibility is
+                                      allowed to be empty. Instances of this type with an empty value here are
+                                      almost certainly wrong.
+                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                    type: string
+                                  optional:
+                                    description: Specify whether the ConfigMap or
+                                      its key must be defined
+                                    type: boolean
+                                required:
+                                - key
+                                type: object
+                                x-kubernetes-map-type: atomic
+                              fieldRef:
+                                description: |-
+                                  Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
+                                  spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
+                                properties:
+                                  apiVersion:
+                                    description: Version of the schema the FieldPath
+                                      is written in terms of, defaults to "v1".
+                                    type: string
+                                  fieldPath:
+                                    description: Path of the field to select in the
+                                      specified API version.
+                                    type: string
+                                required:
+                                - fieldPath
+                                type: object
+                                x-kubernetes-map-type: atomic
+                              resourceFieldRef:
+                                description: |-
+                                  Selects a resource of the container: only resources limits and requests
+                                  (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
+                                properties:
+                                  containerName:
+                                    description: 'Container name: required for volumes,
+                                      optional for env vars'
+                                    type: string
+                                  divisor:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    description: Specifies the output format of the
+                                      exposed resources, defaults to "1"
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  resource:
+                                    description: 'Required: resource to select'
+                                    type: string
+                                required:
+                                - resource
+                                type: object
+                                x-kubernetes-map-type: atomic
+                              secretKeyRef:
+                                description: Selects a key of a secret in the pod's
+                                  namespace
+                                properties:
+                                  key:
+                                    description: The key of the secret to select from.  Must
+                                      be a valid secret key.
+                                    type: string
+                                  name:
+                                    default: ""
+                                    description: |-
+                                      Name of the referent.
+                                      This field is effectively required, but due to backwards compatibility is
+                                      allowed to be empty. Instances of this type with an empty value here are
+                                      almost certainly wrong.
+                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                    type: string
+                                  optional:
+                                    description: Specify whether the Secret or its
+                                      key must be defined
+                                    type: boolean
+                                required:
+                                - key
+                                type: object
+                                x-kubernetes-map-type: atomic
+                            type: object
+                        required:
+                        - name
+                        type: object
+                      type: array
+                    jvm:
+                      type: string
+                    labels:
+                      additionalProperties:
+                        type: string
+                      type: object
+                    nodeSelector:
+                      additionalProperties:
+                        type: string
+                      type: object
+                    pdb:
+                      properties:
+                        enable:
+                          type: boolean
+                        maxUnavailable:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          x-kubernetes-int-or-string: true
+                        minAvailable:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          x-kubernetes-int-or-string: true
+                      type: object
+                    persistence:
+                      description: PersistencConfig defines options for data persistence
+                      properties:
+                        emptyDir:
+                          description: |-
+                            Represents an empty directory for a pod.
+                            Empty directory volumes support ownership management and SELinux relabeling.
+                          properties:
+                            medium:
+                              description: |-
+                                medium represents what type of storage medium should back this directory.
+                                The default is "" which means to use the node's default medium.
+                                Must be an empty string (default) or Memory.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                              type: string
+                            sizeLimit:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: |-
+                                sizeLimit is the total amount of local storage required for this EmptyDir volume.
+                                The size limit is also applicable for memory medium.
+                                The maximum usage on memory medium EmptyDir would be the minimum value between
+                                the SizeLimit specified here and the sum of memory limits of all containers in a pod.
+                                The default is nil which means that the limit is undefined.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                          type: object
+                        hostPath:
+                          description: |-
+                            Represents a host path mapped into a pod.
+                            Host path volumes do not support ownership management or SELinux relabeling.
+                          properties:
+                            path:
+                              description: |-
+                                path of the directory on the host.
+                                If the path is a symlink, it will follow the link to the real path.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
+                              type: string
+                            type:
+                              description: |-
+                                type for HostPath Volume
+                                Defaults to ""
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
+                              type: string
+                          required:
+                          - path
+                          type: object
+                        pvc:
+                          properties:
+                            accessModes:
+                              items:
+                                type: string
+                              type: array
+                            storageClass:
+                              type: string
+                          type: object
+                      type: object
+                    priorityClassName:
+                      type: string
+                    probes:
+                      properties:
+                        liveness:
+                          properties:
+                            failureThreshold:
+                              format: int32
+                              type: integer
+                            initialDelaySeconds:
+                              format: int32
+                              type: integer
+                            periodSeconds:
+                              format: int32
+                              type: integer
+                            successThreshold:
+                              format: int32
+                              type: integer
+                            timeoutSeconds:
+                              format: int32
+                              type: integer
+                          type: object
+                        readiness:
+                          properties:
+                            failureThreshold:
+                              format: int32
+                              type: integer
+                            initialDelaySeconds:
+                              format: int32
+                              type: integer
+                            periodSeconds:
+                              format: int32
+                              type: integer
+                            timeoutSeconds:
+                              format: int32
+                              type: integer
+                          type: object
+                        startup:
+                          properties:
+                            failureThreshold:
+                              format: int32
+                              type: integer
+                            initialDelaySeconds:
+                              format: int32
+                              type: integer
+                            periodSeconds:
+                              format: int32
+                              type: integer
+                            successThreshold:
+                              format: int32
+                              type: integer
+                            timeoutSeconds:
+                              format: int32
+                              type: integer
+                          type: object
+                      type: object
+                    replicas:
+                      format: int32
+                      type: integer
+                    resources:
+                      description: ResourceRequirements describes the compute resource
+                        requirements.
+                      properties:
+                        claims:
+                          description: |-
+                            Claims lists the names of resources, defined in spec.resourceClaims,
+                            that are used by this container.
+
+                            This is an alpha field and requires enabling the
+                            DynamicResourceAllocation feature gate.
+
+                            This field is immutable. It can only be set for containers.
+                          items:
+                            description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+                            properties:
+                              name:
+                                description: |-
+                                  Name must match the name of one entry in pod.spec.resourceClaims of
+                                  the Pod where this field is used. It makes that resource available
+                                  inside a container.
+                                type: string
+                              request:
+                                description: |-
+                                  Request is the name chosen for a request in the referenced claim.
+                                  If empty, everything from the claim is made available, otherwise
+                                  only the result of this request.
+                                type: string
+                            required:
+                            - name
+                            type: object
+                          type: array
+                          x-kubernetes-list-map-keys:
+                          - name
+                          x-kubernetes-list-type: map
+                        limits:
+                          additionalProperties:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                            x-kubernetes-int-or-string: true
+                          description: |-
+                            Limits describes the maximum amount of compute resources allowed.
+                            More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                          type: object
+                        requests:
+                          additionalProperties:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                            x-kubernetes-int-or-string: true
+                          description: |-
+                            Requests describes the minimum amount of compute resources required.
+                            If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                            otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                            More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                          type: object
+                      type: object
+                    roles:
+                      items:
+                        type: string
+                      type: array
+                    tolerations:
+                      items:
+                        description: |-
+                          The pod this Toleration is attached to tolerates any taint that matches
+                          the triple <key,value,effect> using the matching operator <operator>.
+                        properties:
+                          effect:
+                            description: |-
+                              Effect indicates the taint effect to match. Empty means match all taint effects.
+                              When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+                            type: string
+                          key:
+                            description: |-
+                              Key is the taint key that the toleration applies to. Empty means match all taint keys.
+                              If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+                            type: string
+                          operator:
+                            description: |-
+                              Operator represents a key's relationship to the value.
+                              Valid operators are Exists and Equal. Defaults to Equal.
+                              Exists is equivalent to wildcard for value, so that a pod can
+                              tolerate all taints of a particular category.
+                            type: string
+                          tolerationSeconds:
+                            description: |-
+                              TolerationSeconds represents the period of time the toleration (which must be
+                              of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+                              it is not set, which means tolerate the taint forever (do not evict). Zero and
+                              negative values will be treated as 0 (evict immediately) by the system.
+                            format: int64
+                            type: integer
+                          value:
+                            description: |-
+                              Value is the taint value the toleration matches to.
+                              If the operator is Exists, the value should be empty, otherwise just a regular string.
+                            type: string
+                        type: object
+                      type: array
+                    topologySpreadConstraints:
+                      items:
+                        description: TopologySpreadConstraint specifies how to spread
+                          matching pods among the given topology.
+                        properties:
+                          labelSelector:
+                            description: |-
+                              LabelSelector is used to find matching pods.
+                              Pods that match this label selector are counted to determine the number of pods
+                              in their corresponding topology domain.
+                            properties:
+                              matchExpressions:
+                                description: matchExpressions is a list of label selector
+                                  requirements. The requirements are ANDed.
+                                items:
+                                  description: |-
+                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                    relates the key and values.
+                                  properties:
+                                    key:
+                                      description: key is the label key that the selector
+                                        applies to.
+                                      type: string
+                                    operator:
+                                      description: |-
+                                        operator represents a key's relationship to a set of values.
+                                        Valid operators are In, NotIn, Exists and DoesNotExist.
+                                      type: string
+                                    values:
+                                      description: |-
+                                        values is an array of string values. If the operator is In or NotIn,
+                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                        the values array must be empty. This array is replaced during a strategic
+                                        merge patch.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  required:
+                                  - key
+                                  - operator
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              matchLabels:
+                                additionalProperties:
+                                  type: string
+                                description: |-
+                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                type: object
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          matchLabelKeys:
+                            description: |-
+                              MatchLabelKeys is a set of pod label keys to select the pods over which
+                              spreading will be calculated. The keys are used to lookup values from the
+                              incoming pod labels, those key-value labels are ANDed with labelSelector
+                              to select the group of existing pods over which spreading will be calculated
+                              for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.
+                              MatchLabelKeys cannot be set when LabelSelector isn't set.
+                              Keys that don't exist in the incoming pod labels will
+                              be ignored. A null or empty list means only match against labelSelector.
+
+                              This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).
+                            items:
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          maxSkew:
+                            description: |-
+                              MaxSkew describes the degree to which pods may be unevenly distributed.
+                              When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference
+                              between the number of matching pods in the target topology and the global minimum.
+                              The global minimum is the minimum number of matching pods in an eligible domain
+                              or zero if the number of eligible domains is less than MinDomains.
+                              For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same
+                              labelSelector spread as 2/2/1:
+                              In this case, the global minimum is 1.
+                              | zone1 | zone2 | zone3 |
+                              |  P P  |  P P  |   P   |
+                              - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2;
+                              scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2)
+                              violate MaxSkew(1).
+                              - if MaxSkew is 2, incoming pod can be scheduled onto any zone.
+                              When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence
+                              to topologies that satisfy it.
+                              It's a required field. Default value is 1 and 0 is not allowed.
+                            format: int32
+                            type: integer
+                          minDomains:
+                            description: |-
+                              MinDomains indicates a minimum number of eligible domains.
+                              When the number of eligible domains with matching topology keys is less than minDomains,
+                              Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed.
+                              And when the number of eligible domains with matching topology keys equals or greater than minDomains,
+                              this value has no effect on scheduling.
+                              As a result, when the number of eligible domains is less than minDomains,
+                              scheduler won't schedule more than maxSkew Pods to those domains.
+                              If value is nil, the constraint behaves as if MinDomains is equal to 1.
+                              Valid values are integers greater than 0.
+                              When value is not nil, WhenUnsatisfiable must be DoNotSchedule.
+
+                              For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same
+                              labelSelector spread as 2/2/2:
+                              | zone1 | zone2 | zone3 |
+                              |  P P  |  P P  |  P P  |
+                              The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0.
+                              In this situation, new pod with the same labelSelector cannot be scheduled,
+                              because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones,
+                              it will violate MaxSkew.
+                            format: int32
+                            type: integer
+                          nodeAffinityPolicy:
+                            description: |-
+                              NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector
+                              when calculating pod topology spread skew. Options are:
+                              - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.
+                              - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
+
+                              If this value is nil, the behavior is equivalent to the Honor policy.
+                            type: string
+                          nodeTaintsPolicy:
+                            description: |-
+                              NodeTaintsPolicy indicates how we will treat node taints when calculating
+                              pod topology spread skew. Options are:
+                              - Honor: nodes without taints, along with tainted nodes for which the incoming pod
+                              has a toleration, are included.
+                              - Ignore: node taints are ignored. All nodes are included.
+
+                              If this value is nil, the behavior is equivalent to the Ignore policy.
+                            type: string
+                          topologyKey:
+                            description: |-
+                              TopologyKey is the key of node labels. Nodes that have a label with this key
+                              and identical values are considered to be in the same topology.
+                              We consider each <key, value> as a "bucket", and try to put balanced number
+                              of pods into each bucket.
+                              We define a domain as a particular instance of a topology.
+                              Also, we define an eligible domain as a domain whose nodes meet the requirements of
+                              nodeAffinityPolicy and nodeTaintsPolicy.
+                              e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology.
+                              And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology.
+                              It's a required field.
+                            type: string
+                          whenUnsatisfiable:
+                            description: |-
+                              WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy
+                              the spread constraint.
+                              - DoNotSchedule (default) tells the scheduler not to schedule it.
+                              - ScheduleAnyway tells the scheduler to schedule the pod in any location,
+                                but giving higher precedence to topologies that would help reduce the
+                                skew.
+                              A constraint is considered "Unsatisfiable" for an incoming pod
+                              if and only if every possible node assignment for that pod would violate
+                              "MaxSkew" on some topology.
+                              For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same
+                              labelSelector spread as 3/1/1:
+                              | zone1 | zone2 | zone3 |
+                              | P P P |   P   |   P   |
+                              If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled
+                              to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies
+                              MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler
+                              won't make it *more* imbalanced.
+                              It's a required field.
+                            type: string
+                        required:
+                        - maxSkew
+                        - topologyKey
+                        - whenUnsatisfiable
+                        type: object
+                      type: array
+                  required:
+                  - component
+                  - replicas
+                  - roles
+                  type: object
+                type: array
+              security:
+                description: Security defines options for managing the opensearch-security
+                  plugin
+                properties:
+                  config:
+                    properties:
+                      adminCredentialsSecret:
+                        description: Secret that contains fields username and password
+                          to be used by the operator to access the opensearch cluster
+                          for node draining. Must be set if custom securityconfig
+                          is provided.
+                        properties:
+                          name:
+                            default: ""
+                            description: |-
+                              Name of the referent.
+                              This field is effectively required, but due to backwards compatibility is
+                              allowed to be empty. Instances of this type with an empty value here are
+                              almost certainly wrong.
+                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                            type: string
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      adminSecret:
+                        description: TLS Secret that contains a client certificate
+                          (tls.key, tls.crt, ca.crt) with admin rights in the opensearch
+                          cluster. Must be set if transport certificates are provided
+                          by user and not generated
+                        properties:
+                          name:
+                            default: ""
+                            description: |-
+                              Name of the referent.
+                              This field is effectively required, but due to backwards compatibility is
+                              allowed to be empty. Instances of this type with an empty value here are
+                              almost certainly wrong.
+                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                            type: string
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      securityConfigSecret:
+                        description: Secret that contains the differnt yml files of
+                          the opensearch-security config (config.yml, internal_users.yml,
+                          ...)
+                        properties:
+                          name:
+                            default: ""
+                            description: |-
+                              Name of the referent.
+                              This field is effectively required, but due to backwards compatibility is
+                              allowed to be empty. Instances of this type with an empty value here are
+                              almost certainly wrong.
+                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                            type: string
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      updateJob:
+                        description: Specific configs for the SecurityConfig update
+                          job
+                        properties:
+                          resources:
+                            description: ResourceRequirements describes the compute
+                              resource requirements.
+                            properties:
+                              claims:
+                                description: |-
+                                  Claims lists the names of resources, defined in spec.resourceClaims,
+                                  that are used by this container.
+
+                                  This is an alpha field and requires enabling the
+                                  DynamicResourceAllocation feature gate.
+
+                                  This field is immutable. It can only be set for containers.
+                                items:
+                                  description: ResourceClaim references one entry
+                                    in PodSpec.ResourceClaims.
+                                  properties:
+                                    name:
+                                      description: |-
+                                        Name must match the name of one entry in pod.spec.resourceClaims of
+                                        the Pod where this field is used. It makes that resource available
+                                        inside a container.
+                                      type: string
+                                    request:
+                                      description: |-
+                                        Request is the name chosen for a request in the referenced claim.
+                                        If empty, everything from the claim is made available, otherwise
+                                        only the result of this request.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
+                                type: array
+                                x-kubernetes-list-map-keys:
+                                - name
+                                x-kubernetes-list-type: map
+                              limits:
+                                additionalProperties:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                description: |-
+                                  Limits describes the maximum amount of compute resources allowed.
+                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                type: object
+                              requests:
+                                additionalProperties:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                description: |-
+                                  Requests describes the minimum amount of compute resources required.
+                                  If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                  otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                type: object
+                            type: object
+                        type: object
+                    type: object
+                  tls:
+                    description: Configure tls usage for transport and http interface
+                    properties:
+                      http:
+                        properties:
+                          caSecret:
+                            description: Optional, secret that contains the ca certificate
+                              as ca.crt. If this and generate=true is set the existing
+                              CA cert from that secret is used to generate the node
+                              certs. In this case must contain ca.crt and ca.key fields
+                            properties:
+                              name:
+                                default: ""
+                                description: |-
+                                  Name of the referent.
+                                  This field is effectively required, but due to backwards compatibility is
+                                  allowed to be empty. Instances of this type with an empty value here are
+                                  almost certainly wrong.
+                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                type: string
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          generate:
+                            description: If set to true the operator will generate
+                              a CA and certificates for the cluster to use, if false
+                              secrets with existing certificates must be supplied
+                            type: boolean
+                          secret:
+                            description: Optional, name of a TLS secret that contains
+                              ca.crt, tls.key and tls.crt data. If ca.crt is in a
+                              different secret provide it via the caSecret field
+                            properties:
+                              name:
+                                default: ""
+                                description: |-
+                                  Name of the referent.
+                                  This field is effectively required, but due to backwards compatibility is
+                                  allowed to be empty. Instances of this type with an empty value here are
+                                  almost certainly wrong.
+                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                type: string
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        type: object
+                      transport:
+                        properties:
+                          adminDn:
+                            description: DNs of certificates that should have admin
+                              access, mainly used for securityconfig updates via securityadmin.sh,
+                              only used when existing certificates are provided
+                            items:
+                              type: string
+                            type: array
+                          caSecret:
+                            description: Optional, secret that contains the ca certificate
+                              as ca.crt. If this and generate=true is set the existing
+                              CA cert from that secret is used to generate the node
+                              certs. In this case must contain ca.crt and ca.key fields
+                            properties:
+                              name:
+                                default: ""
+                                description: |-
+                                  Name of the referent.
+                                  This field is effectively required, but due to backwards compatibility is
+                                  allowed to be empty. Instances of this type with an empty value here are
+                                  almost certainly wrong.
+                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                type: string
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          generate:
+                            description: If set to true the operator will generate
+                              a CA and certificates for the cluster to use, if false
+                              secrets with existing certificates must be supplied
+                            type: boolean
+                          nodesDn:
+                            description: Allowed Certificate DNs for nodes, only used
+                              when existing certificates are provided
+                            items:
+                              type: string
+                            type: array
+                          perNode:
+                            description: Configure transport node certificate
+                            type: boolean
+                          secret:
+                            description: Optional, name of a TLS secret that contains
+                              ca.crt, tls.key and tls.crt data. If ca.crt is in a
+                              different secret provide it via the caSecret field
+                            properties:
+                              name:
+                                default: ""
+                                description: |-
+                                  Name of the referent.
+                                  This field is effectively required, but due to backwards compatibility is
+                                  allowed to be empty. Instances of this type with an empty value here are
+                                  almost certainly wrong.
+                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                type: string
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        type: object
+                    type: object
+                type: object
+            required:
+            - nodePools
+            type: object
+          status:
+            description: ClusterStatus defines the observed state of Es
+            properties:
+              availableNodes:
+                description: AvailableNodes is the number of available instances.
+                format: int32
+                type: integer
+              componentsStatus:
+                items:
+                  properties:
+                    component:
+                      type: string
+                    conditions:
+                      items:
+                        type: string
+                      type: array
+                    description:
+                      type: string
+                    status:
+                      type: string
+                  type: object
+                type: array
+              health:
+                description: OpenSearchHealth is the health of the cluster as returned
+                  by the health API.
+                type: string
+              initialized:
+                type: boolean
+              phase:
+                description: |-
+                  INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
+                  Important: Run "make" to regenerate code after modifying this file
+                type: string
+              version:
+                type: string
+            required:
+            - componentsStatus
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchcomponenttemplates.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchcomponenttemplates.yaml
new file mode 100644
index 00000000..7d4fd549
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchcomponenttemplates.yaml
@@ -0,0 +1,136 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.16.0
+  name: opensearchcomponenttemplates.opensearch.opster.io
+spec:
+  group: opensearch.opster.io
+  names:
+    kind: OpensearchComponentTemplate
+    listKind: OpensearchComponentTemplateList
+    plural: opensearchcomponenttemplates
+    shortNames:
+    - opensearchcomponenttemplate
+    singular: opensearchcomponenttemplate
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: OpensearchComponentTemplate is the schema for the OpenSearch
+          component templates API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              _meta:
+                description: Optional user metadata about the component template
+                x-kubernetes-preserve-unknown-fields: true
+              allowAutoCreate:
+                description: If true, then indices can be automatically created using
+                  this template
+                type: boolean
+              name:
+                description: The name of the component template. Defaults to metadata.name
+                type: string
+              opensearchCluster:
+                description: |-
+                  LocalObjectReference contains enough information to let you locate the
+                  referenced object inside the same namespace.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+              template:
+                description: The template that should be applied
+                properties:
+                  aliases:
+                    additionalProperties:
+                      description: Describes the specs of an index alias
+                      properties:
+                        alias:
+                          description: The name of the alias.
+                          type: string
+                        filter:
+                          description: Query used to limit documents the alias can
+                            access.
+                          x-kubernetes-preserve-unknown-fields: true
+                        index:
+                          description: The name of the index that the alias points
+                            to.
+                          type: string
+                        isWriteIndex:
+                          description: If true, the index is the write index for the
+                            alias
+                          type: boolean
+                        routing:
+                          description: Value used to route indexing and search operations
+                            to a specific shard.
+                          type: string
+                      type: object
+                    description: Aliases to add
+                    type: object
+                  mappings:
+                    description: Mapping for fields in the index
+                    x-kubernetes-preserve-unknown-fields: true
+                  settings:
+                    description: Configuration options for the index
+                    x-kubernetes-preserve-unknown-fields: true
+                type: object
+              version:
+                description: Version number used to manage the component template
+                  externally
+                type: integer
+            required:
+            - opensearchCluster
+            - template
+            type: object
+          status:
+            properties:
+              componentTemplateName:
+                description: Name of the currently managed component template
+                type: string
+              existingComponentTemplate:
+                type: boolean
+              managedCluster:
+                description: |-
+                  UID is a type that holds unique ID values, including UUIDs.  Because we
+                  don't ONLY use UUIDs, this is an alias to string.  Being a type captures
+                  intent and helps make sure that UIDs and names do not get conflated.
+                type: string
+              reason:
+                type: string
+              state:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchindextemplates.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchindextemplates.yaml
new file mode 100644
index 00000000..37e517ee
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchindextemplates.yaml
@@ -0,0 +1,163 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.16.0
+  name: opensearchindextemplates.opensearch.opster.io
+spec:
+  group: opensearch.opster.io
+  names:
+    kind: OpensearchIndexTemplate
+    listKind: OpensearchIndexTemplateList
+    plural: opensearchindextemplates
+    shortNames:
+    - opensearchindextemplate
+    singular: opensearchindextemplate
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: OpensearchIndexTemplate is the schema for the OpenSearch index
+          templates API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              _meta:
+                description: Optional user metadata about the index template
+                x-kubernetes-preserve-unknown-fields: true
+              composedOf:
+                description: |-
+                  An ordered list of component template names. Component templates are merged in the order specified,
+                  meaning that the last component template specified has the highest precedence
+                items:
+                  type: string
+                type: array
+              dataStream:
+                description: The dataStream config that should be applied
+                properties:
+                  timestamp_field:
+                    description: TimestampField for dataStream
+                    properties:
+                      name:
+                        description: Name of the field that are used for the DataStream
+                        type: string
+                    required:
+                    - name
+                    type: object
+                type: object
+              indexPatterns:
+                description: Array of wildcard expressions used to match the names
+                  of indices during creation
+                items:
+                  type: string
+                type: array
+              name:
+                description: The name of the index template. Defaults to metadata.name
+                type: string
+              opensearchCluster:
+                description: |-
+                  LocalObjectReference contains enough information to let you locate the
+                  referenced object inside the same namespace.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+              priority:
+                description: |-
+                  Priority to determine index template precedence when a new data stream or index is created.
+                  The index template with the highest priority is chosen
+                type: integer
+              template:
+                description: The template that should be applied
+                properties:
+                  aliases:
+                    additionalProperties:
+                      description: Describes the specs of an index alias
+                      properties:
+                        alias:
+                          description: The name of the alias.
+                          type: string
+                        filter:
+                          description: Query used to limit documents the alias can
+                            access.
+                          x-kubernetes-preserve-unknown-fields: true
+                        index:
+                          description: The name of the index that the alias points
+                            to.
+                          type: string
+                        isWriteIndex:
+                          description: If true, the index is the write index for the
+                            alias
+                          type: boolean
+                        routing:
+                          description: Value used to route indexing and search operations
+                            to a specific shard.
+                          type: string
+                      type: object
+                    description: Aliases to add
+                    type: object
+                  mappings:
+                    description: Mapping for fields in the index
+                    x-kubernetes-preserve-unknown-fields: true
+                  settings:
+                    description: Configuration options for the index
+                    x-kubernetes-preserve-unknown-fields: true
+                type: object
+              version:
+                description: Version number used to manage the component template
+                  externally
+                type: integer
+            required:
+            - indexPatterns
+            - opensearchCluster
+            type: object
+          status:
+            properties:
+              existingIndexTemplate:
+                type: boolean
+              indexTemplateName:
+                description: Name of the currently managed index template
+                type: string
+              managedCluster:
+                description: |-
+                  UID is a type that holds unique ID values, including UUIDs.  Because we
+                  don't ONLY use UUIDs, this is an alias to string.  Being a type captures
+                  intent and helps make sure that UIDs and names do not get conflated.
+                type: string
+              reason:
+                type: string
+              state:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchismpolicies.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchismpolicies.yaml
new file mode 100644
index 00000000..2f4b261d
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchismpolicies.yaml
@@ -0,0 +1,461 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.16.0
+  name: opensearchismpolicies.opensearch.opster.io
+spec:
+  group: opensearch.opster.io
+  names:
+    kind: OpenSearchISMPolicy
+    listKind: OpenSearchISMPolicyList
+    plural: opensearchismpolicies
+    shortNames:
+    - ismp
+    - ismpolicy
+    singular: opensearchismpolicy
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: ISMPolicySpec is the specification for the ISM policy for
+              OS.
+            properties:
+              applyToExistingIndices:
+                description: If true, apply the policy to existing indices that match
+                  the index patterns in the ISM template.
+                type: boolean
+              defaultState:
+                description: The default starting state for each index that uses this
+                  policy.
+                type: string
+              description:
+                description: A human-readable description of the policy.
+                type: string
+              errorNotification:
+                properties:
+                  channel:
+                    type: string
+                  destination:
+                    description: The destination URL.
+                    properties:
+                      amazon:
+                        properties:
+                          url:
+                            type: string
+                        type: object
+                      chime:
+                        properties:
+                          url:
+                            type: string
+                        type: object
+                      customWebhook:
+                        properties:
+                          url:
+                            type: string
+                        type: object
+                      slack:
+                        properties:
+                          url:
+                            type: string
+                        type: object
+                    type: object
+                  messageTemplate:
+                    description: The text of the message
+                    properties:
+                      source:
+                        type: string
+                    type: object
+                type: object
+              ismTemplate:
+                description: Specify an ISM template pattern that matches the index
+                  to apply the policy.
+                properties:
+                  indexPatterns:
+                    description: Index patterns on which this policy has to be applied
+                    items:
+                      type: string
+                    type: array
+                  priority:
+                    description: Priority of the template, defaults to 0
+                    type: integer
+                required:
+                - indexPatterns
+                type: object
+              opensearchCluster:
+                description: |-
+                  LocalObjectReference contains enough information to let you locate the
+                  referenced object inside the same namespace.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+              policyId:
+                type: string
+              states:
+                description: The states that you define in the policy.
+                items:
+                  properties:
+                    actions:
+                      description: The actions to execute after entering a state.
+                      items:
+                        description: Actions are the steps that the policy sequentially
+                          executes on entering a specific state.
+                        properties:
+                          alias:
+                            properties:
+                              actions:
+                                description: Allocate the index to a node with a specified
+                                  attribute.
+                                items:
+                                  properties:
+                                    add:
+                                      properties:
+                                        aliases:
+                                          description: The name of the alias.
+                                          items:
+                                            type: string
+                                          type: array
+                                        index:
+                                          description: The name of the index that
+                                            the alias points to.
+                                          type: string
+                                        isWriteIndex:
+                                          description: Specify the index that accepts
+                                            any write operations to the alias.
+                                          type: boolean
+                                        routing:
+                                          description: Limit search to an associated
+                                            shard value
+                                          type: string
+                                      type: object
+                                    remove:
+                                      properties:
+                                        aliases:
+                                          description: The name of the alias.
+                                          items:
+                                            type: string
+                                          type: array
+                                        index:
+                                          description: The name of the index that
+                                            the alias points to.
+                                          type: string
+                                        isWriteIndex:
+                                          description: Specify the index that accepts
+                                            any write operations to the alias.
+                                          type: boolean
+                                        routing:
+                                          description: Limit search to an associated
+                                            shard value
+                                          type: string
+                                      type: object
+                                  type: object
+                                type: array
+                            required:
+                            - actions
+                            type: object
+                          allocation:
+                            description: Allocate the index to a node with a specific
+                              attribute set
+                            properties:
+                              exclude:
+                                description: Allocate the index to a node with a specified
+                                  attribute.
+                                type: string
+                              include:
+                                description: Allocate the index to a node with any
+                                  of the specified attributes.
+                                type: string
+                              require:
+                                description: Don’t allocate the index to a node with
+                                  any of the specified attributes.
+                                type: string
+                              waitFor:
+                                description: Wait for the policy to execute before
+                                  allocating the index to a node with a specified
+                                  attribute.
+                                type: string
+                            required:
+                            - exclude
+                            - include
+                            - require
+                            - waitFor
+                            type: object
+                          close:
+                            description: Closes the managed index.
+                            type: object
+                          delete:
+                            description: Deletes a managed index.
+                            type: object
+                          forceMerge:
+                            description: Reduces the number of Lucene segments by
+                              merging the segments of individual shards.
+                            properties:
+                              maxNumSegments:
+                                description: The number of segments to reduce the
+                                  shard to.
+                                format: int64
+                                type: integer
+                            required:
+                            - maxNumSegments
+                            type: object
+                          indexPriority:
+                            description: Set the priority for the index in a specific
+                              state.
+                            properties:
+                              priority:
+                                description: The priority for the index as soon as
+                                  it enters a state.
+                                format: int64
+                                type: integer
+                            required:
+                            - priority
+                            type: object
+                          notification:
+                            description: Name          string        `json:"name,omitempty"`
+                            properties:
+                              destination:
+                                type: string
+                              messageTemplate:
+                                properties:
+                                  source:
+                                    type: string
+                                type: object
+                            required:
+                            - destination
+                            - messageTemplate
+                            type: object
+                          open:
+                            description: Opens a managed index.
+                            type: object
+                          readOnly:
+                            description: Sets a managed index to be read only.
+                            type: object
+                          readWrite:
+                            description: Sets a managed index to be writeable.
+                            type: object
+                          replicaCount:
+                            description: Sets the number of replicas to assign to
+                              an index.
+                            properties:
+                              numberOfReplicas:
+                                format: int64
+                                type: integer
+                            required:
+                            - numberOfReplicas
+                            type: object
+                          retry:
+                            description: The retry configuration for the action.
+                            properties:
+                              backoff:
+                                description: The backoff policy type to use when retrying.
+                                type: string
+                              count:
+                                description: The number of retry counts.
+                                format: int64
+                                type: integer
+                              delay:
+                                description: The time to wait between retries.
+                                type: string
+                            required:
+                            - count
+                            type: object
+                          rollover:
+                            description: Rolls an alias over to a new index when the
+                              managed index meets one of the rollover conditions.
+                            properties:
+                              minDocCount:
+                                description: The minimum number of documents required
+                                  to roll over the index.
+                                format: int64
+                                type: integer
+                              minIndexAge:
+                                description: The minimum age required to roll over
+                                  the index.
+                                type: string
+                              minPrimaryShardSize:
+                                description: The minimum storage size of a single
+                                  primary shard required to roll over the index.
+                                type: string
+                              minSize:
+                                description: The minimum size of the total primary
+                                  shard storage (not counting replicas) required to
+                                  roll over the index.
+                                type: string
+                            type: object
+                          rollup:
+                            description: Periodically reduce data granularity by rolling
+                              up old data into summarized indexes.
+                            type: object
+                          shrink:
+                            description: Allows you to reduce the number of primary
+                              shards in your indexes
+                            properties:
+                              forceUnsafe:
+                                description: If true, executes the shrink action even
+                                  if there are no replicas.
+                                type: boolean
+                              maxShardSize:
+                                description: The maximum size in bytes of a shard
+                                  for the target index.
+                                type: string
+                              numNewShards:
+                                description: The maximum number of primary shards
+                                  in the shrunken index.
+                                type: integer
+                              percentageOfSourceShards:
+                                description: Percentage of the number of original
+                                  primary shards to shrink.
+                                format: int64
+                                type: integer
+                              targetIndexNameTemplate:
+                                description: The name of the shrunken index.
+                                type: string
+                            type: object
+                          snapshot:
+                            description: Back up your cluster’s indexes and state
+                            properties:
+                              repository:
+                                description: The repository name that you register
+                                  through the native snapshot API operations.
+                                type: string
+                              snapshot:
+                                description: The name of the snapshot.
+                                type: string
+                            required:
+                            - repository
+                            - snapshot
+                            type: object
+                          timeout:
+                            description: The timeout period for the action. Accepts
+                              time units for minutes, hours, and days.
+                            type: string
+                        type: object
+                      type: array
+                    name:
+                      description: The name of the state.
+                      type: string
+                    transitions:
+                      description: The next states and the conditions required to
+                        transition to those states. If no transitions exist, the policy
+                        assumes that it’s complete and can now stop managing the index
+                      items:
+                        properties:
+                          conditions:
+                            description: conditions for the transition.
+                            properties:
+                              cron:
+                                description: The cron job that triggers the transition
+                                  if no other transition happens first.
+                                properties:
+                                  cron:
+                                    description: A wrapper for the cron job that triggers
+                                      the transition if no other transition happens
+                                      first. This wrapper is here to adhere to the
+                                      OpenSearch API.
+                                    properties:
+                                      expression:
+                                        description: The cron expression that triggers
+                                          the transition.
+                                        type: string
+                                      timezone:
+                                        description: The timezone that triggers the
+                                          transition.
+                                        type: string
+                                    required:
+                                    - expression
+                                    - timezone
+                                    type: object
+                                required:
+                                - cron
+                                type: object
+                              minDocCount:
+                                description: The minimum document count of the index
+                                  required to transition.
+                                format: int64
+                                type: integer
+                              minIndexAge:
+                                description: The minimum age of the index required
+                                  to transition.
+                                type: string
+                              minRolloverAge:
+                                description: The minimum age required after a rollover
+                                  has occurred to transition to the next state.
+                                type: string
+                              minSize:
+                                description: The minimum size of the total primary
+                                  shard storage (not counting replicas) required to
+                                  transition.
+                                type: string
+                            type: object
+                          stateName:
+                            description: The name of the state to transition to if
+                              the conditions are met.
+                            type: string
+                        required:
+                        - conditions
+                        - stateName
+                        type: object
+                      type: array
+                  required:
+                  - actions
+                  - name
+                  type: object
+                type: array
+            required:
+            - defaultState
+            - description
+            - states
+            type: object
+          status:
+            description: OpensearchISMPolicyStatus defines the observed state of OpensearchISMPolicy
+            properties:
+              existingISMPolicy:
+                type: boolean
+              managedCluster:
+                description: |-
+                  UID is a type that holds unique ID values, including UUIDs.  Because we
+                  don't ONLY use UUIDs, this is an alias to string.  Being a type captures
+                  intent and helps make sure that UIDs and names do not get conflated.
+                type: string
+              policyId:
+                type: string
+              reason:
+                type: string
+              state:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchroles.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchroles.yaml
new file mode 100644
index 00000000..36ae514a
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchroles.yaml
@@ -0,0 +1,123 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.16.0
+  name: opensearchroles.opensearch.opster.io
+spec:
+  group: opensearch.opster.io
+  names:
+    kind: OpensearchRole
+    listKind: OpensearchRoleList
+    plural: opensearchroles
+    shortNames:
+    - opensearchrole
+    singular: opensearchrole
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: OpensearchRole is the Schema for the opensearchroles API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: OpensearchRoleSpec defines the desired state of OpensearchRole
+            properties:
+              clusterPermissions:
+                items:
+                  type: string
+                type: array
+              indexPermissions:
+                items:
+                  properties:
+                    allowedActions:
+                      items:
+                        type: string
+                      type: array
+                    dls:
+                      type: string
+                    fls:
+                      items:
+                        type: string
+                      type: array
+                    indexPatterns:
+                      items:
+                        type: string
+                      type: array
+                    maskedFields:
+                      items:
+                        type: string
+                      type: array
+                  type: object
+                type: array
+              opensearchCluster:
+                description: |-
+                  LocalObjectReference contains enough information to let you locate the
+                  referenced object inside the same namespace.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+              tenantPermissions:
+                items:
+                  properties:
+                    allowedActions:
+                      items:
+                        type: string
+                      type: array
+                    tenantPatterns:
+                      items:
+                        type: string
+                      type: array
+                  type: object
+                type: array
+            required:
+            - opensearchCluster
+            type: object
+          status:
+            description: OpensearchRoleStatus defines the observed state of OpensearchRole
+            properties:
+              existingRole:
+                type: boolean
+              managedCluster:
+                description: |-
+                  UID is a type that holds unique ID values, including UUIDs.  Because we
+                  don't ONLY use UUIDs, this is an alias to string.  Being a type captures
+                  intent and helps make sure that UIDs and names do not get conflated.
+                type: string
+              reason:
+                type: string
+              state:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchsnapshotpolicies.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchsnapshotpolicies.yaml
new file mode 100644
index 00000000..2c32048d
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchsnapshotpolicies.yaml
@@ -0,0 +1,203 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.16.0
+  name: opensearchsnapshotpolicies.opensearch.opster.io
+spec:
+  group: opensearch.opster.io
+  names:
+    kind: OpensearchSnapshotPolicy
+    listKind: OpensearchSnapshotPolicyList
+    plural: opensearchsnapshotpolicies
+    singular: opensearchsnapshotpolicy
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: Existing policy state
+      jsonPath: .status.existingSnapshotPolicy
+      name: existingpolicy
+      type: boolean
+    - description: Snapshot policy name
+      jsonPath: .status.snapshotPolicyName
+      name: policyName
+      type: string
+    - jsonPath: .status.state
+      name: state
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: age
+      type: date
+    name: v1
+    schema:
+      openAPIV3Schema:
+        description: OpensearchSnapshotPolicy is the Schema for the opensearchsnapshotpolicies
+          API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              creation:
+                properties:
+                  schedule:
+                    properties:
+                      cron:
+                        properties:
+                          expression:
+                            type: string
+                          timezone:
+                            type: string
+                        required:
+                        - expression
+                        - timezone
+                        type: object
+                    required:
+                    - cron
+                    type: object
+                  timeLimit:
+                    type: string
+                required:
+                - schedule
+                type: object
+              deletion:
+                properties:
+                  deleteCondition:
+                    properties:
+                      maxAge:
+                        type: string
+                      maxCount:
+                        type: integer
+                      minCount:
+                        type: integer
+                    type: object
+                  schedule:
+                    properties:
+                      cron:
+                        properties:
+                          expression:
+                            type: string
+                          timezone:
+                            type: string
+                        required:
+                        - expression
+                        - timezone
+                        type: object
+                    required:
+                    - cron
+                    type: object
+                  timeLimit:
+                    type: string
+                type: object
+              description:
+                type: string
+              enabled:
+                type: boolean
+              notification:
+                properties:
+                  channel:
+                    properties:
+                      id:
+                        type: string
+                    required:
+                    - id
+                    type: object
+                  conditions:
+                    properties:
+                      creation:
+                        type: boolean
+                      deletion:
+                        type: boolean
+                      failure:
+                        type: boolean
+                    type: object
+                required:
+                - channel
+                type: object
+              opensearchCluster:
+                description: |-
+                  LocalObjectReference contains enough information to let you locate the
+                  referenced object inside the same namespace.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+              policyName:
+                type: string
+              snapshotConfig:
+                properties:
+                  dateFormat:
+                    type: string
+                  dateFormatTimezone:
+                    type: string
+                  ignoreUnavailable:
+                    type: boolean
+                  includeGlobalState:
+                    type: boolean
+                  indices:
+                    type: string
+                  metadata:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  partial:
+                    type: boolean
+                  repository:
+                    type: string
+                required:
+                - repository
+                type: object
+            required:
+            - creation
+            - opensearchCluster
+            - policyName
+            - snapshotConfig
+            type: object
+          status:
+            description: OpensearchSnapshotPolicyStatus defines the observed state
+              of OpensearchSnapshotPolicy
+            properties:
+              existingSnapshotPolicy:
+                type: boolean
+              managedCluster:
+                description: |-
+                  UID is a type that holds unique ID values, including UUIDs.  Because we
+                  don't ONLY use UUIDs, this is an alias to string.  Being a type captures
+                  intent and helps make sure that UIDs and names do not get conflated.
+                type: string
+              reason:
+                type: string
+              snapshotPolicyName:
+                type: string
+              state:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchtenants.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchtenants.yaml
new file mode 100644
index 00000000..d085f3ca
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchtenants.yaml
@@ -0,0 +1,85 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.16.0
+  name: opensearchtenants.opensearch.opster.io
+spec:
+  group: opensearch.opster.io
+  names:
+    kind: OpensearchTenant
+    listKind: OpensearchTenantList
+    plural: opensearchtenants
+    shortNames:
+    - opensearchtenant
+    singular: opensearchtenant
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: OpensearchTenant is the Schema for the opensearchtenants API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: OpensearchTenantSpec defines the desired state of OpensearchTenant
+            properties:
+              description:
+                type: string
+              opensearchCluster:
+                description: |-
+                  LocalObjectReference contains enough information to let you locate the
+                  referenced object inside the same namespace.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+            required:
+            - opensearchCluster
+            type: object
+          status:
+            description: OpensearchTenantStatus defines the observed state of OpensearchTenant
+            properties:
+              existingTenant:
+                type: boolean
+              managedCluster:
+                description: |-
+                  UID is a type that holds unique ID values, including UUIDs.  Because we
+                  don't ONLY use UUIDs, this is an alias to string.  Being a type captures
+                  intent and helps make sure that UIDs and names do not get conflated.
+                type: string
+              reason:
+                type: string
+              state:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchuserrolebindings.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchuserrolebindings.yaml
new file mode 100644
index 00000000..2e9453c6
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchuserrolebindings.yaml
@@ -0,0 +1,109 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.16.0
+  name: opensearchuserrolebindings.opensearch.opster.io
+spec:
+  group: opensearch.opster.io
+  names:
+    kind: OpensearchUserRoleBinding
+    listKind: OpensearchUserRoleBindingList
+    plural: opensearchuserrolebindings
+    shortNames:
+    - opensearchuserrolebinding
+    singular: opensearchuserrolebinding
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: OpensearchUserRoleBinding is the Schema for the opensearchuserrolebindings
+          API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: OpensearchUserRoleBindingSpec defines the desired state of
+              OpensearchUserRoleBinding
+            properties:
+              backendRoles:
+                items:
+                  type: string
+                type: array
+              opensearchCluster:
+                description: |-
+                  LocalObjectReference contains enough information to let you locate the
+                  referenced object inside the same namespace.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+              roles:
+                items:
+                  type: string
+                type: array
+              users:
+                items:
+                  type: string
+                type: array
+            required:
+            - opensearchCluster
+            - roles
+            type: object
+          status:
+            description: OpensearchUserRoleBindingStatus defines the observed state
+              of OpensearchUserRoleBinding
+            properties:
+              managedCluster:
+                description: |-
+                  UID is a type that holds unique ID values, including UUIDs.  Because we
+                  don't ONLY use UUIDs, this is an alias to string.  Being a type captures
+                  intent and helps make sure that UIDs and names do not get conflated.
+                type: string
+              provisionedBackendRoles:
+                items:
+                  type: string
+                type: array
+              provisionedRoles:
+                items:
+                  type: string
+                type: array
+              provisionedUsers:
+                items:
+                  type: string
+                type: array
+              reason:
+                type: string
+              state:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchusers.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchusers.yaml
new file mode 100644
index 00000000..8d573ee7
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchusers.yaml
@@ -0,0 +1,117 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.16.0
+  name: opensearchusers.opensearch.opster.io
+spec:
+  group: opensearch.opster.io
+  names:
+    kind: OpensearchUser
+    listKind: OpensearchUserList
+    plural: opensearchusers
+    shortNames:
+    - opensearchuser
+    singular: opensearchuser
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: OpensearchUser is the Schema for the opensearchusers API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: OpensearchUserSpec defines the desired state of OpensearchUser
+            properties:
+              attributes:
+                additionalProperties:
+                  type: string
+                type: object
+              backendRoles:
+                items:
+                  type: string
+                type: array
+              opendistroSecurityRoles:
+                items:
+                  type: string
+                type: array
+              opensearchCluster:
+                description: |-
+                  LocalObjectReference contains enough information to let you locate the
+                  referenced object inside the same namespace.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+              passwordFrom:
+                description: SecretKeySelector selects a key of a Secret.
+                properties:
+                  key:
+                    description: The key of the secret to select from.  Must be a
+                      valid secret key.
+                    type: string
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                  optional:
+                    description: Specify whether the Secret or its key must be defined
+                    type: boolean
+                required:
+                - key
+                type: object
+                x-kubernetes-map-type: atomic
+            required:
+            - opensearchCluster
+            - passwordFrom
+            type: object
+          status:
+            description: OpensearchUserStatus defines the observed state of OpensearchUser
+            properties:
+              managedCluster:
+                description: |-
+                  UID is a type that holds unique ID values, including UUIDs.  Because we
+                  don't ONLY use UUIDs, this is an alias to string.  Being a type captures
+                  intent and helps make sure that UIDs and names do not get conflated.
+                type: string
+              reason:
+                type: string
+              state:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/_helpers.tpl b/packages/system/opensearch-operator/charts/opensearch-operator/templates/_helpers.tpl
new file mode 100644
index 00000000..32f313e3
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/templates/_helpers.tpl
@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "opensearch-operator.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "opensearch-operator.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "opensearch-operator.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "opensearch-operator.labels" -}}
+helm.sh/chart: {{ include "opensearch-operator.chart" . }}
+{{ include "opensearch-operator.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "opensearch-operator.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "opensearch-operator.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "opensearch-operator.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (printf "%s-%s" (include "opensearch-operator.fullname" .) "controller-manager") .Values.serviceAccount.name }}
+{{- else }}
+{{- default "opensearch-operator-controller-manager" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-deployment.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-deployment.yaml
new file mode 100644
index 00000000..4b5cb194
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-deployment.yaml
@@ -0,0 +1,94 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    control-plane: controller-manager
+  name: {{ include "opensearch-operator.fullname" . }}-controller-manager
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      control-plane: controller-manager
+  template:
+    metadata:
+      labels:
+        control-plane: controller-manager
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    spec:
+      containers:
+      {{- if or (.Values.kubeRbacProxy.enable) (eq (.Values.kubeRbacProxy.enable | toString) "<nil>") }}
+      - args:
+        - --secure-listen-address=0.0.0.0:8443
+        - --upstream=http://127.0.0.1:8080/
+        - --proxy-endpoints-port=10443
+        - --logtostderr=true
+        - --v=10
+        image: "{{ .Values.kubeRbacProxy.image.repository }}:{{ .Values.kubeRbacProxy.image.tag}}"
+        name: kube-rbac-proxy
+        resources:
+{{- toYaml .Values.kubeRbacProxy.resources | nindent 10 }}
+        readinessProbe:
+{{- toYaml .Values.kubeRbacProxy.readinessProbe | nindent 10 }}
+        livenessProbe:
+{{- toYaml .Values.kubeRbacProxy.livenessProbe | nindent 10 }}
+        securityContext:
+{{- toYaml .Values.kubeRbacProxy.securityContext | nindent 10 }}
+        ports:
+        - containerPort: 8443
+          name: https
+        - containerPort: 10443
+          name: https-proxy
+          protocol: TCP
+      {{- end}}
+      - args:
+        - --health-probe-bind-address=:8081
+        - --metrics-bind-address=127.0.0.1:8080
+        - --leader-elect
+        {{- if .Values.manager.watchNamespace }}
+        - --watch-namespace={{ .Values.manager.watchNamespace }}
+        {{- end }}
+        - --loglevel={{ .Values.manager.loglevel }}
+        command:
+        - /manager
+        image: "{{ .Values.manager.image.repository }}:{{ .Values.manager.image.tag | default .Chart.AppVersion }}"
+        name: operator-controller-manager
+        imagePullPolicy: "{{ .Values.manager.image.pullPolicy }}"
+        resources:
+{{- toYaml .Values.manager.resources | nindent 10 }}
+        readinessProbe:
+{{- toYaml .Values.manager.readinessProbe | nindent 10 }}
+        livenessProbe:
+{{- toYaml .Values.manager.livenessProbe | nindent 10 }}
+        env:
+        - name: DNS_BASE
+          value: {{ .Values.manager.dnsBase }}
+        - name: PARALLEL_RECOVERY_ENABLED
+          value: "{{ .Values.manager.parallelRecoveryEnabled }}"
+        - name: PPROF_ENDPOINTS_ENABLED
+          value: "{{ .Values.manager.pprofEndpointsEnabled }}"
+        {{- if .Values.manager.extraEnv }}
+        {{- toYaml .Values.manager.extraEnv | nindent 8 }}
+        {{- end }}
+        securityContext:
+{{- toYaml .Values.manager.securityContext | nindent 10 }}
+      nodeSelector:
+{{- toYaml .Values.nodeSelector | nindent 8 }}
+      tolerations:
+{{- toYaml .Values.tolerations | nindent 8 }}
+      securityContext:
+{{- toYaml .Values.securityContext | nindent 8}}
+      {{- if .Values.manager.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml .Values.manager.imagePullSecrets | nindent 6 }}
+      {{- end }}
+      serviceAccountName: {{ include "opensearch-operator.serviceAccountName" . }}
+      terminationGracePeriodSeconds: 10
+      {{- if .Values.priorityClassName }}
+      priorityClassName: {{ .Values.priorityClassName }}
+      {{- end }}
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-metrics-service-svc.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-metrics-service-svc.yaml
new file mode 100644
index 00000000..e4c6e820
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-metrics-service-svc.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    control-plane: controller-manager
+  name: {{ include "opensearch-operator.fullname" . }}-controller-manager-metrics-service
+spec:
+  ports:
+  - name: https
+    port: 8443
+    targetPort: https
+  selector:
+    control-plane: controller-manager
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-sa.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-sa.yaml
new file mode 100644
index 00000000..ee5a1ca2
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-sa.yaml
@@ -0,0 +1,6 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "opensearch-operator.serviceAccountName" . }}
+{{- end -}}
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-crds.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-crds.yaml
new file mode 100644
index 00000000..21fdeedb
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-crds.yaml
@@ -0,0 +1,5 @@
+{{- if .Values.installCRDs -}}
+{{- range $path, $bytes := .Files.Glob "files/*.yaml" }}
+{{ $.Files.Get $path }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-leader-election-role-role.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-leader-election-role-role.yaml
new file mode 100644
index 00000000..aa8853e0
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-leader-election-role-role.yaml
@@ -0,0 +1,48 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "opensearch-operator.fullname" . }}-leader-election-role
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - servicemonitors
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-leader-election-rolebinding-rb.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-leader-election-rolebinding-rb.yaml
new file mode 100644
index 00000000..654a0a7d
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-leader-election-rolebinding-rb.yaml
@@ -0,0 +1,11 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "opensearch-operator.fullname" . }}-leader-election-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "opensearch-operator.fullname" . }}-leader-election-role
+subjects:
+- kind: ServiceAccount
+  name: {{ include "opensearch-operator.serviceAccountName" . }}
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-config-cm.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-config-cm.yaml
new file mode 100644
index 00000000..c2e9a13f
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-config-cm.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+data:
+  controller_manager_config.yaml: |
+    apiVersion: controller-runtime.sigs.k8s.io/v1alpha1
+    kind: ControllerManagerConfig
+    health:
+      healthProbeBindAddress: :8081
+    metrics:
+      bindAddress: 127.0.0.1:8080
+    webhook:
+      port: 9443
+    leaderElection:
+      leaderElect: true
+      resourceName: a867c7dc.opensearch.opster.io
+kind: ConfigMap
+metadata:
+  name: {{ include "opensearch-operator.fullname" . }}-manager-config
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-role-cr.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-role-cr.yaml
new file mode 100644
index 00000000..3daf70d4
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-role-cr.yaml
@@ -0,0 +1,414 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-manager-role
+rules:
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - statefulsets
+  - statefulsets/status
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - "policy"
+  resources:
+  - poddisruptionbudgets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchactiongroups
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchactiongroups/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchactiongroups/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchclusters
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchclusters/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchclusters/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchcomponenttemplates
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchcomponenttemplates/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchcomponenttemplates/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchindextemplates
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchindextemplates/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchindextemplates/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchroles
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchroles/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchroles/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchtenants
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchtenants/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchtenants/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchuserrolebindings
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchuserrolebindings/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchuserrolebindings/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+    - opensearch.opster.io
+  resources:
+    - opensearchismpolicies/status
+  verbs:
+    - get
+    - patch
+    - update
+- apiGroups:
+    - opensearch.opster.io
+  resources:
+    - opensearchismpolicies/finalizers
+  verbs:
+    - update
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchusers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+    - opensearch.opster.io
+  resources:
+    - opensearchismpolicies
+  verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchusers/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchusers/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - persistentvolumeclaims
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - servicemonitors
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchsnapshotpolicies
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchsnapshotpolicies/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - opensearch.opster.io
+  resources:
+  - opensearchsnapshotpolicies/finalizers
+  verbs:
+  - update
\ No newline at end of file
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-rolebinding.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-rolebinding.yaml
new file mode 100644
index 00000000..a528ffdf
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-rolebinding.yaml
@@ -0,0 +1,27 @@
+{{- if .Values.useRoleBindings }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-manager-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-manager-role
+subjects:
+- kind: ServiceAccount
+  name: {{ include "opensearch-operator.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- else }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-manager-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-manager-role
+subjects:
+- kind: ServiceAccount
+  name: {{ include "opensearch-operator.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-metrics-reader-cr.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-metrics-reader-cr.yaml
new file mode 100644
index 00000000..c8f9d89c
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-metrics-reader-cr.yaml
@@ -0,0 +1,9 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-metrics-reader
+rules:
+- nonResourceURLs:
+  - /metrics
+  verbs:
+  - get
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-proxy-role-cr.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-proxy-role-cr.yaml
new file mode 100644
index 00000000..cbd6cb77
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-proxy-role-cr.yaml
@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-proxy-role
+rules:
+- apiGroups:
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+  verbs:
+  - create
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - subjectaccessreviews
+  verbs:
+  - create
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-proxy-rolebinding.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-proxy-rolebinding.yaml
new file mode 100644
index 00000000..d9a5d339
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-proxy-rolebinding.yaml
@@ -0,0 +1,27 @@
+{{- if .Values.useRoleBindings }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-proxy-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-proxy-role
+subjects:
+- kind: ServiceAccount
+  name: {{ include "opensearch-operator.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- else }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-proxy-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-proxy-role
+subjects:
+- kind: ServiceAccount
+  name: {{ include "opensearch-operator.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/values.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/values.yaml
new file mode 100644
index 00000000..1ee839bb
--- /dev/null
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/values.yaml
@@ -0,0 +1,123 @@
+nameOverride: ""
+fullnameOverride: ""
+
+podAnnotations: {}
+podLabels: {}
+nodeSelector: {}
+tolerations: []
+securityContext:
+  runAsNonRoot: true
+priorityClassName: ""
+manager:
+  securityContext:
+    allowPrivilegeEscalation: false
+  extraEnv: []
+  resources:
+    limits:
+      cpu: 200m
+      memory: 500Mi
+    requests:
+      cpu: 100m
+      memory: 350Mi
+
+  livenessProbe:
+    failureThreshold: 3
+    httpGet:
+      path: /healthz
+      port: 8081
+    periodSeconds: 15
+    successThreshold: 1
+    timeoutSeconds: 3
+    initialDelaySeconds: 10
+
+  readinessProbe:
+    failureThreshold: 3
+    httpGet:
+      path: /readyz
+      port: 8081
+    periodSeconds: 15
+    successThreshold: 1
+    timeoutSeconds: 3
+    initialDelaySeconds: 10
+
+  # Set this to false to disable the experimental parallel recovery in case you are experiencing problems
+  parallelRecoveryEnabled: true
+  # Set this to true to enable the standard go pprof endpoints on port 6060 (https://pkg.go.dev/net/http/pprof)
+  # Should only be used for debugging purposes
+  pprofEndpointsEnabled: false
+
+  image:
+    repository: opensearchproject/opensearch-operator
+    ## tag default uses appVersion from Chart.yaml, to override specify tag tag: "v1.1"
+    tag: ""
+    pullPolicy: "Always"
+
+  ## Optional array of imagePullSecrets containing private registry credentials
+  imagePullSecrets: []
+  # - name: secretName
+
+  dnsBase: cluster.local
+
+  # Log level of the operator. Possible values: debug, info, warn, error
+  loglevel: info
+
+  # If a watchNamespace is specified, the manager's cache will be restricted to
+  # watch objects in the desired namespace. Defaults is to watch all namespaces.
+  watchNamespace:
+
+# Install the Custom Resource Definitions with Helm
+installCRDs: true
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Override the service account name. Defaults to opensearch-operator-controller-manager
+  name: ""
+
+kubeRbacProxy:
+  enable: true
+  securityContext:
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop:
+        - ALL
+  resources:
+    limits:
+      cpu: 50m
+      memory: 50Mi
+    requests:
+      cpu: 25m
+      memory: 25Mi
+
+  livenessProbe:
+    failureThreshold: 3
+    httpGet:
+      path: /healthz
+      port: 10443
+      scheme: HTTPS
+    periodSeconds: 15
+    successThreshold: 1
+    timeoutSeconds: 3
+    initialDelaySeconds: 10
+
+  readinessProbe:
+    failureThreshold: 3
+    httpGet:
+      path: /healthz
+      port: 10443
+      scheme: HTTPS
+    periodSeconds: 15
+    successThreshold: 1
+    timeoutSeconds: 3
+    initialDelaySeconds: 10
+
+  image:
+    repository: "gcr.io/kubebuilder/kube-rbac-proxy"
+    tag: "v0.15.0"
+
+## If this is set to true, RoleBindings will be used instead of ClusterRoleBindings, inorder to restrict ClusterRoles
+## to the namespace where the operator and OpenSearch cluster are in. In that case, specify the namespace where they
+## are in in manager.watchNamespace field.
+## If false, ClusterRoleBindings will be used
+useRoleBindings: false
diff --git a/packages/system/opensearch-operator/templates/sysctl-daemonset.yaml b/packages/system/opensearch-operator/templates/sysctl-daemonset.yaml
new file mode 100644
index 00000000..76c3569e
--- /dev/null
+++ b/packages/system/opensearch-operator/templates/sysctl-daemonset.yaml
@@ -0,0 +1,64 @@
+---
+# DaemonSet to configure vm.max_map_count on all nodes for OpenSearch
+# This runs once on each node to ensure the kernel parameter is set
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: opensearch-sysctl-setter
+  labels:
+    app.kubernetes.io/name: opensearch-sysctl-setter
+    app.kubernetes.io/component: sysctl
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: opensearch-sysctl-setter
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: opensearch-sysctl-setter
+    spec:
+      initContainers:
+        - name: sysctl
+          image: busybox:1.36
+          securityContext:
+            privileged: true
+          resources:
+            requests:
+              cpu: 1m
+              memory: 1Mi
+            limits:
+              cpu: 50m
+              memory: 16Mi
+          command:
+            - sh
+            - -c
+            - |
+              sysctl -w vm.max_map_count=262144
+              # Keep the value persistent by writing to sysctl.conf if writable
+              if [ -w /host-etc/sysctl.conf ]; then
+                grep -q "vm.max_map_count" /host-etc/sysctl.conf || echo "vm.max_map_count=262144" >> /host-etc/sysctl.conf
+              fi
+          volumeMounts:
+            - name: host-etc
+              mountPath: /host-etc
+              readOnly: false
+      containers:
+        - name: pause
+          image: registry.k8s.io/pause:3.9
+          resources:
+            requests:
+              cpu: 1m
+              memory: 1Mi
+            limits:
+              cpu: 10m
+              memory: 10Mi
+      volumes:
+        - name: host-etc
+          hostPath:
+            path: /etc
+            type: Directory
+      tolerations:
+        - operator: Exists
+          effect: NoSchedule
+        - operator: Exists
+          effect: NoExecute
diff --git a/packages/system/opensearch-operator/values.yaml b/packages/system/opensearch-operator/values.yaml
new file mode 100644
index 00000000..619aa99b
--- /dev/null
+++ b/packages/system/opensearch-operator/values.yaml
@@ -0,0 +1,4 @@
+opensearch-operator:
+  manager:
+    # Enable cluster-wide mode to watch all namespaces
+    watchNamespace: ""
diff --git a/packages/system/opensearch-rd/Chart.yaml b/packages/system/opensearch-rd/Chart.yaml
new file mode 100644
index 00000000..c0ca3b86
--- /dev/null
+++ b/packages/system/opensearch-rd/Chart.yaml
@@ -0,0 +1,3 @@
+apiVersion: v2
+name: opensearch-rd
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
diff --git a/packages/system/opensearch-rd/Makefile b/packages/system/opensearch-rd/Makefile
new file mode 100644
index 00000000..7d3c0311
--- /dev/null
+++ b/packages/system/opensearch-rd/Makefile
@@ -0,0 +1,4 @@
+export NAME=opensearch-rd
+export NAMESPACE=cozy-system
+
+include ../../../hack/package.mk
diff --git a/packages/system/opensearch-rd/cozyrds/opensearch.yaml b/packages/system/opensearch-rd/cozyrds/opensearch.yaml
new file mode 100644
index 00000000..be15d8a1
--- /dev/null
+++ b/packages/system/opensearch-rd/cozyrds/opensearch.yaml
@@ -0,0 +1,42 @@
+apiVersion: cozystack.io/v1alpha1
+kind: ApplicationDefinition
+metadata:
+  name: opensearch
+spec:
+  application:
+    kind: OpenSearch
+    singular: opensearch
+    plural: opensearches
+    openAPISchema: |-
+      {"title":"Chart Values","type":"object","properties":{"dashboards":{"description":"OpenSearch Dashboards configuration.","type":"object","default":{},"required":["enabled","replicas","resourcesPreset"],"properties":{"enabled":{"description":"Enable OpenSearch Dashboards deployment.","type":"boolean","default":false},"replicas":{"description":"Number of Dashboards replicas.","type":"integer","default":1},"resources":{"description":"Explicit CPU and memory configuration for Dashboards.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset for Dashboards.","type":"string","default":"medium","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"images":{"description":"Container images used by the operator.","type":"object","default":{},"required":["opensearch"],"properties":{"opensearch":{"description":"OpenSearch image.","type":"string","default":""}}},"nodeRoles":{"description":"Node roles configuration.","type":"object","default":{},"required":["data","ingest","master","ml"],"properties":{"data":{"description":"Enable data role.","type":"boolean","default":true},"ingest":{"description":"Enable ingest role.","type":"boolean","default":true},"master":{"description":"Enable cluster_manager role.","type":"boolean","default":true},"ml":{"description":"Enable machine learning role.","type":"boolean","default":false}}},"replicas":{"description":"Number of OpenSearch nodes in the cluster.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration for each OpenSearch node. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. OpenSearch requires minimum 2Gi memory.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"topologySpreadPolicy":{"description":"How strictly to enforce pod distribution across nodes and zones.","type":"string","default":"soft","enum":["soft","hard"]},"users":{"description":"Custom OpenSearch users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user (auto-generated if omitted).","type":"string"},"roles":{"description":"List of OpenSearch roles.","type":"array","items":{"type":"string"}}}}},"version":{"description":"OpenSearch major version to deploy.","type":"string","default":"v2","enum":["v3","v2","v1"]}}}
+  release:
+    prefix: opensearch-
+    labels:
+      sharding.fluxcd.io/key: tenants
+    chartRef:
+      kind: ExternalArtifact
+      name: cozystack-opensearch-application-default-opensearch
+      namespace: cozy-system
+  dashboard:
+    category: PaaS
+    singular: OpenSearch
+    plural: OpenSearch Clusters
+    description: Managed OpenSearch service
+    tags:
+      - database
+      - search
+    icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl9vcGVuc2VhcmNoKSIvPgo8cGF0aCBkPSJNNzIgMzZDNDQgMzYgMjggNTIgMjggNzJDMjggOTIgNDQgMTA4IDcyIDEwOEMxMDAgMTA4IDExNiA5MiAxMTYgNzIiIHN0cm9rZT0iIzAwNUVCOCIgc3Ryb2tlLXdpZHRoPSI4IiBzdHJva2UtbGluZWNhcD0icm91bmQiIGZpbGw9Im5vbmUiLz4KPGNpcmNsZSBjeD0iMTE2IiBjeT0iNzIiIHI9IjgiIGZpbGw9IiMwMDVFQjgiLz4KPGRlZnM+CjxsaW5lYXJHcmFkaWVudCBpZD0icGFpbnQwX2xpbmVhcl9vcGVuc2VhcmNoIiB4MT0iMTQwIiB5MT0iMTMwLjUiIHgyPSI0IiB5Mj0iOS40OTk5OSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPgo8c3RvcCBzdG9wLWNvbG9yPSIjMDAzQjVDIi8+CjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iIzAwNUVCOCIvPgo8L2xpbmVhckdyYWRpZW50Pgo8L2RlZnM+Cjwvc3ZnPgo=
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "replicas"], ["spec", "resources"], ["spec", "resourcesPreset"], ["spec", "size"], ["spec", "storageClass"], ["spec", "external"], ["spec", "topologySpreadPolicy"], ["spec", "version"], ["spec", "images"], ["spec", "images", "opensearch"], ["spec", "nodeRoles"], ["spec", "nodeRoles", "master"], ["spec", "nodeRoles", "data"], ["spec", "nodeRoles", "ingest"], ["spec", "nodeRoles", "ml"], ["spec", "users"], ["spec", "dashboards"], ["spec", "dashboards", "enabled"], ["spec", "dashboards", "replicas"], ["spec", "dashboards", "resources"], ["spec", "dashboards", "resourcesPreset"]]
+  secrets:
+    exclude: []
+    include:
+      - resourceNames:
+          - opensearch-{{ .name }}-credentials
+  services:
+    exclude: []
+    include:
+      - resourceNames:
+          - opensearch-{{ .name }}
+          - opensearch-{{ .name }}-external
+          - opensearch-{{ .name }}-dashboards
+          - opensearch-{{ .name }}-dashboards-external
diff --git a/packages/system/opensearch-rd/templates/cozyrd.yaml b/packages/system/opensearch-rd/templates/cozyrd.yaml
new file mode 100644
index 00000000..e079ddcf
--- /dev/null
+++ b/packages/system/opensearch-rd/templates/cozyrd.yaml
@@ -0,0 +1,4 @@
+{{- range $path, $_ := .Files.Glob "cozyrds/*" }}
+---
+{{ $.Files.Get $path }}
+{{- end }}
diff --git a/packages/system/opensearch-rd/values.yaml b/packages/system/opensearch-rd/values.yaml
new file mode 100644
index 00000000..0967ef42
--- /dev/null
+++ b/packages/system/opensearch-rd/values.yaml
@@ -0,0 +1 @@
+{}

From 4e59e5e656e59ca9b9055ae04cc1ea836d132756 Mon Sep 17 00:00:00 2001
From: Matthieu <matthieu@hidora.com>
Date: Mon, 16 Feb 2026 22:28:35 +0100
Subject: [PATCH 057/666] Add PackageSource definitions for OpenSearch

Add operator and application PackageSource CRs to expose OpenSearch
in the Cozystack platform:
- opensearch-operator: operator deployment in cozy-opensearch-operator namespace
- opensearch-application: app + resource definition with cozy-lib integration

This enables OpenSearch to appear in the platform dashboard and be
deployed by tenants.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Matthieu <matthieu@hidora.com>
---
 .../sources/opensearch-application.yaml       | 28 +++++++++++++++++++
 .../platform/sources/opensearch-operator.yaml | 22 +++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 packages/core/platform/sources/opensearch-application.yaml
 create mode 100644 packages/core/platform/sources/opensearch-operator.yaml

diff --git a/packages/core/platform/sources/opensearch-application.yaml b/packages/core/platform/sources/opensearch-application.yaml
new file mode 100644
index 00000000..2b499cd0
--- /dev/null
+++ b/packages/core/platform/sources/opensearch-application.yaml
@@ -0,0 +1,28 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.opensearch-application
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+    path: /
+  variants:
+    - name: default
+      dependsOn:
+        - cozystack.networking
+        - cozystack.opensearch-operator
+      libraries:
+        - name: cozy-lib
+          path: library/cozy-lib
+      components:
+        - name: opensearch
+          path: apps/opensearch
+          libraries: ["cozy-lib"]
+        - name: opensearch-rd
+          path: system/opensearch-rd
+          install:
+            namespace: cozy-system
+            releaseName: opensearch-rd
diff --git a/packages/core/platform/sources/opensearch-operator.yaml b/packages/core/platform/sources/opensearch-operator.yaml
new file mode 100644
index 00000000..21dd7a43
--- /dev/null
+++ b/packages/core/platform/sources/opensearch-operator.yaml
@@ -0,0 +1,22 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.opensearch-operator
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+    path: /
+  variants:
+  - name: default
+    dependsOn:
+    - cozystack.networking
+    - cozystack.prometheus-operator-crds
+    components:
+    - name: opensearch-operator
+      path: system/opensearch-operator
+      install:
+        namespace: cozy-opensearch-operator
+        releaseName: opensearch-operator

From 7181fd1c937a05e94073519c21135cc2d3dbbd8b Mon Sep 17 00:00:00 2001
From: Matthieu <matthieu@hidora.com>
Date: Mon, 16 Feb 2026 22:40:01 +0100
Subject: [PATCH 058/666] Fix critical issues in OpenSearch operator templates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Address CodeRabbit review feedback:
- Fix extraEnv indentation (nindent 8 → 10) in controller-manager deployment
- Fix imagePullSecrets indentation (nindent 6 → 8) for proper YAML alignment
- Change proxy-rolebinding from conditional RoleBinding to always ClusterRoleBinding
  (required for cluster-scoped tokenreviews/subjectaccessreviews permissions)
- Pin operator chart version to 2.8.0 in Makefile for reproducible builds

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Matthieu <matthieu@hidora.com>
---
 packages/system/opensearch-operator/Makefile      |  2 +-
 ...ch-operator-controller-manager-deployment.yaml |  4 ++--
 .../opensearch-operator-proxy-rolebinding.yaml    | 15 ---------------
 3 files changed, 3 insertions(+), 18 deletions(-)

diff --git a/packages/system/opensearch-operator/Makefile b/packages/system/opensearch-operator/Makefile
index 71b94549..36522495 100644
--- a/packages/system/opensearch-operator/Makefile
+++ b/packages/system/opensearch-operator/Makefile
@@ -7,4 +7,4 @@ update:
 	rm -rf charts
 	helm repo add opensearch-operator https://opensearch-project.github.io/opensearch-k8s-operator/
 	helm repo update opensearch-operator
-	helm pull opensearch-operator/opensearch-operator --untar --untardir charts
+	helm pull opensearch-operator/opensearch-operator --version 2.8.0 --untar --untardir charts
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-deployment.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-deployment.yaml
index 4b5cb194..43a70d65 100644
--- a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-deployment.yaml
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-deployment.yaml
@@ -73,7 +73,7 @@ spec:
         - name: PPROF_ENDPOINTS_ENABLED
           value: "{{ .Values.manager.pprofEndpointsEnabled }}"
         {{- if .Values.manager.extraEnv }}
-        {{- toYaml .Values.manager.extraEnv | nindent 8 }}
+        {{- toYaml .Values.manager.extraEnv | nindent 10 }}
         {{- end }}
         securityContext:
 {{- toYaml .Values.manager.securityContext | nindent 10 }}
@@ -85,7 +85,7 @@ spec:
 {{- toYaml .Values.securityContext | nindent 8}}
       {{- if .Values.manager.imagePullSecrets }}
       imagePullSecrets:
-        {{- toYaml .Values.manager.imagePullSecrets | nindent 6 }}
+        {{- toYaml .Values.manager.imagePullSecrets | nindent 8 }}
       {{- end }}
       serviceAccountName: {{ include "opensearch-operator.serviceAccountName" . }}
       terminationGracePeriodSeconds: 10
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-proxy-rolebinding.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-proxy-rolebinding.yaml
index d9a5d339..5cba0693 100644
--- a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-proxy-rolebinding.yaml
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-proxy-rolebinding.yaml
@@ -1,17 +1,3 @@
-{{- if .Values.useRoleBindings }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-proxy-rolebinding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-proxy-role
-subjects:
-- kind: ServiceAccount
-  name: {{ include "opensearch-operator.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-{{- else }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -24,4 +10,3 @@ subjects:
 - kind: ServiceAccount
   name: {{ include "opensearch-operator.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
-{{- end }}

From f7767d1ee695d9ef25e8a79d0e46617a1c018ab6 Mon Sep 17 00:00:00 2001
From: Matthieu <matthieu@hidora.com>
Date: Mon, 16 Feb 2026 22:48:28 +0100
Subject: [PATCH 059/666] Fix YAML style issues in OpenSearch packages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Address CodeRabbit nitpick feedback:
- Fix inconsistent indentation in opensearch-application.yaml (4 spaces → 2 spaces)
  to match opensearch-operator.yaml style
- Add missing space in controller-manager-deployment.yaml template
  (nindent 8}} → nindent 8 }}) for consistency

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Matthieu <matthieu@hidora.com>
---
 .../sources/opensearch-application.yaml       | 32 +++++++++----------
 ...perator-controller-manager-deployment.yaml |  2 +-
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/packages/core/platform/sources/opensearch-application.yaml b/packages/core/platform/sources/opensearch-application.yaml
index 2b499cd0..19358c21 100644
--- a/packages/core/platform/sources/opensearch-application.yaml
+++ b/packages/core/platform/sources/opensearch-application.yaml
@@ -10,19 +10,19 @@ spec:
     namespace: cozy-system
     path: /
   variants:
-    - name: default
-      dependsOn:
-        - cozystack.networking
-        - cozystack.opensearch-operator
-      libraries:
-        - name: cozy-lib
-          path: library/cozy-lib
-      components:
-        - name: opensearch
-          path: apps/opensearch
-          libraries: ["cozy-lib"]
-        - name: opensearch-rd
-          path: system/opensearch-rd
-          install:
-            namespace: cozy-system
-            releaseName: opensearch-rd
+  - name: default
+    dependsOn:
+    - cozystack.networking
+    - cozystack.opensearch-operator
+    libraries:
+    - name: cozy-lib
+      path: library/cozy-lib
+    components:
+    - name: opensearch
+      path: apps/opensearch
+      libraries: ["cozy-lib"]
+    - name: opensearch-rd
+      path: system/opensearch-rd
+      install:
+        namespace: cozy-system
+        releaseName: opensearch-rd
diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-deployment.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-deployment.yaml
index 43a70d65..114e6b20 100644
--- a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-deployment.yaml
+++ b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-deployment.yaml
@@ -82,7 +82,7 @@ spec:
       tolerations:
 {{- toYaml .Values.tolerations | nindent 8 }}
       securityContext:
-{{- toYaml .Values.securityContext | nindent 8}}
+{{- toYaml .Values.securityContext | nindent 8 }}
       {{- if .Values.manager.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml .Values.manager.imagePullSecrets | nindent 8 }}

From 315e5dc0bd9a532eaf83f7aaf3fd3edc16c17d07 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 17 Feb 2026 01:32:05 +0300
Subject: [PATCH 060/666] fix(e2e): make kubernetes test retries effective by
 cleaning up stale resources

When the kubernetes E2E test fails at the deployment wait step, set -eu
causes immediate exit before cleanup. On retry, kubectl apply outputs
"unchanged" for the stuck deployment, making retries 2 and 3 guaranteed
to fail against the same stuck pod.

Add pre-creation cleanup of backend deployment/service and NFS test
resources using --ignore-not-found, so retries start fresh. Also
increase the deployment wait timeout from 90s to 300s to handle CI
resource pressure, aligning with other timeouts in the same function.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/run-kubernetes.sh | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index d0997ecb..09e50924 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -132,8 +132,14 @@ metadata:
   name: tenant-test
 EOF
 
+  # Clean up backend resources from any previous failed attempt
+  kubectl delete deployment --kubeconfig "tenantkubeconfig-${test_name}" "${test_name}-backend" \
+    -n tenant-test --ignore-not-found --timeout=60s || true
+  kubectl delete service --kubeconfig "tenantkubeconfig-${test_name}" "${test_name}-backend" \
+    -n tenant-test --ignore-not-found --timeout=60s || true
+
   # Backend 1
-  kubectl apply --kubeconfig tenantkubeconfig-${test_name} -f- <<EOF
+  kubectl apply --kubeconfig "tenantkubeconfig-${test_name}" -f- <<EOF
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -165,7 +171,7 @@ spec:
 EOF
 
   # LoadBalancer Service
-  kubectl apply --kubeconfig tenantkubeconfig-${test_name} -f- <<EOF
+  kubectl apply --kubeconfig "tenantkubeconfig-${test_name}" -f- <<EOF
 apiVersion: v1
 kind: Service
 metadata:
@@ -182,7 +188,7 @@ spec:
 EOF
 
   # Wait for pods readiness
-  kubectl wait deployment --kubeconfig tenantkubeconfig-${test_name} ${test_name}-backend -n tenant-test --for=condition=Available --timeout=90s
+  kubectl wait deployment --kubeconfig "tenantkubeconfig-${test_name}" "${test_name}-backend" -n tenant-test --for=condition=Available --timeout=300s
   
   # Wait for LoadBalancer to be provisioned (IP or hostname)
   timeout 90 sh -ec "
@@ -218,8 +224,14 @@ fi
   kubectl delete deployment --kubeconfig tenantkubeconfig-${test_name} "${test_name}-backend" -n tenant-test
   kubectl delete service --kubeconfig tenantkubeconfig-${test_name} "${test_name}-backend" -n tenant-test
 
+  # Clean up NFS test resources from any previous failed attempt
+  kubectl --kubeconfig "tenantkubeconfig-${test_name}" delete pod nfs-test-pod \
+    -n tenant-test --ignore-not-found --timeout=60s || true
+  kubectl --kubeconfig "tenantkubeconfig-${test_name}" delete pvc nfs-test-pvc \
+    -n tenant-test --ignore-not-found --timeout=60s || true
+
   # Test RWX NFS mount in tenant cluster (uses kubevirt CSI driver with RWX support)
-  kubectl --kubeconfig tenantkubeconfig-${test_name} apply -f - <<EOF
+  kubectl --kubeconfig "tenantkubeconfig-${test_name}" apply -f - <<EOF
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:

From a52da8dd8daef63c75babbb81d7951ce09f78cf1 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 17 Feb 2026 02:00:44 +0300
Subject: [PATCH 061/666] style(e2e): consistently quote kubeconfig variable
 references

Quote all tenantkubeconfig-${test_name} references in run-kubernetes.sh
for consistent shell scripting style. The only exception is line 195
inside a sh -ec "..." double-quoted string where inner quotes would
break the outer quoting.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/run-kubernetes.sh | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index 09e50924..511fcc17 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -80,10 +80,10 @@ EOF
   # Wait for the machine deployment to scale to 2 replicas (timeout after 1 minute)
   kubectl wait machinedeployment kubernetes-${test_name}-md0 -n tenant-test --timeout=1m --for=jsonpath='{.status.replicas}'=2
   # Get the admin kubeconfig and save it to a file
-  kubectl get secret kubernetes-${test_name}-admin-kubeconfig -ojsonpath='{.data.super-admin\.conf}' -n tenant-test | base64 -d > tenantkubeconfig-${test_name}
+  kubectl get secret kubernetes-${test_name}-admin-kubeconfig -ojsonpath='{.data.super-admin\.conf}' -n tenant-test | base64 -d > "tenantkubeconfig-${test_name}"
 
   # Update the kubeconfig to use localhost for the API server
-  yq -i ".clusters[0].cluster.server = \"https://localhost:${port}\"" tenantkubeconfig-${test_name}
+  yq -i ".clusters[0].cluster.server = \"https://localhost:${port}\"" "tenantkubeconfig-${test_name}"
 
 
   # Set up port forwarding to the Kubernetes API server for a 200 second timeout
@@ -98,8 +98,8 @@ EOF
     done
   '
   # Verify the nodes are ready
-  kubectl --kubeconfig tenantkubeconfig-${test_name} wait node --all --timeout=2m --for=condition=Ready
-  kubectl --kubeconfig tenantkubeconfig-${test_name} get nodes -o wide
+  kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait node --all --timeout=2m --for=condition=Ready
+  kubectl --kubeconfig "tenantkubeconfig-${test_name}" get nodes -o wide
 
   # Verify the kubelet version matches what we expect
   versions=$(kubectl --kubeconfig "tenantkubeconfig-${test_name}" \
@@ -125,7 +125,7 @@ EOF
   fi
 
 
-  kubectl --kubeconfig tenantkubeconfig-${test_name} apply -f - <<EOF
+  kubectl --kubeconfig "tenantkubeconfig-${test_name}" apply -f - <<EOF
 apiVersion: v1
 kind: Namespace
 metadata:
@@ -199,7 +199,7 @@ EOF
   "
 
 LB_ADDR=$(
-  kubectl get svc --kubeconfig tenantkubeconfig-${test_name} "${test_name}-backend" \
+  kubectl get svc --kubeconfig "tenantkubeconfig-${test_name}" "${test_name}-backend" \
     -n tenant-test \
     -o jsonpath='{.status.loadBalancer.ingress[0].ip}{.status.loadBalancer.ingress[0].hostname}'
 )
@@ -221,8 +221,8 @@ fi
   fi
 
   # Cleanup
-  kubectl delete deployment --kubeconfig tenantkubeconfig-${test_name} "${test_name}-backend" -n tenant-test
-  kubectl delete service --kubeconfig tenantkubeconfig-${test_name} "${test_name}-backend" -n tenant-test
+  kubectl delete deployment --kubeconfig "tenantkubeconfig-${test_name}" "${test_name}-backend" -n tenant-test
+  kubectl delete service --kubeconfig "tenantkubeconfig-${test_name}" "${test_name}-backend" -n tenant-test
 
   # Clean up NFS test resources from any previous failed attempt
   kubectl --kubeconfig "tenantkubeconfig-${test_name}" delete pod nfs-test-pod \
@@ -247,10 +247,10 @@ spec:
 EOF
 
   # Wait for PVC to be bound
-  kubectl --kubeconfig tenantkubeconfig-${test_name} wait pvc nfs-test-pvc -n tenant-test --timeout=2m --for=jsonpath='{.status.phase}'=Bound
+  kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait pvc nfs-test-pvc -n tenant-test --timeout=2m --for=jsonpath='{.status.phase}'=Bound
 
   # Create Pod that writes and reads data from NFS volume
-  kubectl --kubeconfig tenantkubeconfig-${test_name} apply -f - <<EOF
+  kubectl --kubeconfig "tenantkubeconfig-${test_name}" apply -f - <<EOF
 apiVersion: v1
 kind: Pod
 metadata:
@@ -272,20 +272,20 @@ spec:
 EOF
 
   # Wait for Pod to complete successfully
-  kubectl --kubeconfig tenantkubeconfig-${test_name} wait pod nfs-test-pod -n tenant-test --timeout=5m --for=jsonpath='{.status.phase}'=Succeeded
+  kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait pod nfs-test-pod -n tenant-test --timeout=5m --for=jsonpath='{.status.phase}'=Succeeded
 
   # Verify NFS data integrity
-  nfs_result=$(kubectl --kubeconfig tenantkubeconfig-${test_name} logs nfs-test-pod -n tenant-test)
+  nfs_result=$(kubectl --kubeconfig "tenantkubeconfig-${test_name}" logs nfs-test-pod -n tenant-test)
   if [ "$nfs_result" != "nfs-mount-ok" ]; then
     echo "NFS mount test failed: expected 'nfs-mount-ok', got '$nfs_result'" >&2
-    kubectl --kubeconfig tenantkubeconfig-${test_name} delete pod nfs-test-pod -n tenant-test --wait=false 2>/dev/null || true
-    kubectl --kubeconfig tenantkubeconfig-${test_name} delete pvc nfs-test-pvc -n tenant-test --wait=false 2>/dev/null || true
+    kubectl --kubeconfig "tenantkubeconfig-${test_name}" delete pod nfs-test-pod -n tenant-test --wait=false 2>/dev/null || true
+    kubectl --kubeconfig "tenantkubeconfig-${test_name}" delete pvc nfs-test-pvc -n tenant-test --wait=false 2>/dev/null || true
     exit 1
   fi
 
   # Cleanup NFS test resources in tenant cluster
-  kubectl --kubeconfig tenantkubeconfig-${test_name} delete pod nfs-test-pod -n tenant-test --wait
-  kubectl --kubeconfig tenantkubeconfig-${test_name} delete pvc nfs-test-pvc -n tenant-test
+  kubectl --kubeconfig "tenantkubeconfig-${test_name}" delete pod nfs-test-pod -n tenant-test --wait
+  kubectl --kubeconfig "tenantkubeconfig-${test_name}" delete pvc nfs-test-pvc -n tenant-test
 
   # Wait for all machine deployment replicas to be ready (timeout after 10 minutes)
   kubectl wait machinedeployment kubernetes-${test_name}-md0 -n tenant-test --timeout=10m --for=jsonpath='{.status.v1beta2.readyReplicas}'=2

From 32aff887eb8b43b4160582b6b61f434a3ceac2c2 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 17 Feb 2026 20:03:01 +0300
Subject: [PATCH 062/666] feat(openbao): add system chart with vendored
 upstream

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/openbao/Chart.yaml            |    3 +
 packages/system/openbao/Makefile              |   10 +
 .../system/openbao/charts/openbao/.helmignore |   28 +
 .../system/openbao/charts/openbao/Chart.yaml  |   30 +
 .../system/openbao/charts/openbao/README.md   |  365 +++
 .../openbao/grafana/dashboards/dashboard.json | 2559 +++++++++++++++++
 .../charts/openbao/templates/NOTES.txt        |   18 +
 .../charts/openbao/templates/_helpers.tpl     | 1212 ++++++++
 .../templates/csi-agent-configmap.yaml        |   34 +
 .../openbao/templates/csi-clusterrole.yaml    |   23 +
 .../templates/csi-clusterrolebinding.yaml     |   24 +
 .../openbao/templates/csi-daemonset.yaml      |  157 +
 .../charts/openbao/templates/csi-role.yaml    |   32 +
 .../openbao/templates/csi-rolebinding.yaml    |   25 +
 .../openbao/templates/csi-serviceaccount.yaml |   21 +
 .../openbao/templates/extra-objects.yaml      |    8 +
 .../grafana/configmap-dashboard.yaml          |   30 +
 .../templates/injector-certs-secret.yaml      |   19 +
 .../templates/injector-clusterrole.yaml       |   30 +
 .../injector-clusterrolebinding.yaml          |   24 +
 .../templates/injector-deployment.yaml        |  179 ++
 .../templates/injector-disruptionbudget.yaml  |   25 +
 .../templates/injector-mutating-webhook.yaml  |   44 +
 .../templates/injector-network-policy.yaml    |   30 +
 .../openbao/templates/injector-psp-role.yaml  |   25 +
 .../templates/injector-psp-rolebinding.yaml   |   26 +
 .../openbao/templates/injector-psp.yaml       |   51 +
 .../openbao/templates/injector-role.yaml      |   34 +
 .../templates/injector-rolebinding.yaml       |   27 +
 .../openbao/templates/injector-service.yaml   |   30 +
 .../templates/injector-serviceaccount.yaml    |   18 +
 .../templates/prometheus-prometheusrules.yaml |   32 +
 .../templates/prometheus-servicemonitor.yaml  |   62 +
 .../templates/server-backendtlspolicy.yaml    |   43 +
 .../templates/server-clusterrolebinding.yaml  |   29 +
 .../templates/server-config-configmap.yaml    |   31 +
 .../templates/server-discovery-role.yaml      |   26 +
 .../server-discovery-rolebinding.yaml         |   34 +
 .../templates/server-disruptionbudget.yaml    |   31 +
 .../templates/server-ha-active-service.yaml   |   68 +
 .../templates/server-ha-standby-service.yaml  |   67 +
 .../templates/server-headless-service.yaml    |   46 +
 .../openbao/templates/server-httproute.yaml   |   50 +
 .../openbao/templates/server-ingress.yaml     |   67 +
 .../templates/server-network-policy.yaml      |   24 +
 .../openbao/templates/server-psp-role.yaml    |   25 +
 .../templates/server-psp-rolebinding.yaml     |   26 +
 .../charts/openbao/templates/server-psp.yaml  |   54 +
 .../openbao/templates/server-route.yaml       |   39 +
 .../openbao/templates/server-service.yaml     |   64 +
 .../server-serviceaccount-secret.yaml         |   21 +
 .../templates/server-serviceaccount.yaml      |   22 +
 .../openbao/templates/server-statefulset.yaml |  228 ++
 .../openbao/templates/server-tlsroute.yaml    |   41 +
 .../templates/snapshotagent-configmap.yaml    |   31 +
 .../templates/snapshotagent-cronjob.yaml      |   66 +
 .../snapshotagent-serviceaccount.yaml         |   16 +
 .../openbao/templates/tests/server-test.yaml  |   56 +
 .../charts/openbao/templates/ui-service.yaml  |   53 +
 .../charts/openbao/values.openshift.yaml      |   30 +
 .../openbao/charts/openbao/values.schema.json | 1207 ++++++++
 .../system/openbao/charts/openbao/values.yaml | 1583 ++++++++++
 packages/system/openbao/values.yaml           |    5 +
 63 files changed, 9318 insertions(+)
 create mode 100644 packages/system/openbao/Chart.yaml
 create mode 100644 packages/system/openbao/Makefile
 create mode 100644 packages/system/openbao/charts/openbao/.helmignore
 create mode 100644 packages/system/openbao/charts/openbao/Chart.yaml
 create mode 100644 packages/system/openbao/charts/openbao/README.md
 create mode 100644 packages/system/openbao/charts/openbao/grafana/dashboards/dashboard.json
 create mode 100644 packages/system/openbao/charts/openbao/templates/NOTES.txt
 create mode 100644 packages/system/openbao/charts/openbao/templates/_helpers.tpl
 create mode 100644 packages/system/openbao/charts/openbao/templates/csi-agent-configmap.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/csi-clusterrole.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/csi-clusterrolebinding.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/csi-daemonset.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/csi-role.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/csi-rolebinding.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/csi-serviceaccount.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/extra-objects.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/grafana/configmap-dashboard.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/injector-certs-secret.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/injector-clusterrole.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/injector-clusterrolebinding.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/injector-deployment.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/injector-disruptionbudget.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/injector-mutating-webhook.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/injector-network-policy.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/injector-psp-role.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/injector-psp-rolebinding.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/injector-psp.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/injector-role.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/injector-rolebinding.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/injector-service.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/injector-serviceaccount.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/prometheus-prometheusrules.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/prometheus-servicemonitor.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-backendtlspolicy.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-clusterrolebinding.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-config-configmap.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-discovery-role.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-discovery-rolebinding.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-disruptionbudget.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-ha-active-service.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-ha-standby-service.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-headless-service.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-httproute.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-ingress.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-network-policy.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-psp-role.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-psp-rolebinding.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-psp.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-route.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-service.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-serviceaccount-secret.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-serviceaccount.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-statefulset.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/server-tlsroute.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/snapshotagent-configmap.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/snapshotagent-cronjob.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/snapshotagent-serviceaccount.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/tests/server-test.yaml
 create mode 100644 packages/system/openbao/charts/openbao/templates/ui-service.yaml
 create mode 100644 packages/system/openbao/charts/openbao/values.openshift.yaml
 create mode 100644 packages/system/openbao/charts/openbao/values.schema.json
 create mode 100644 packages/system/openbao/charts/openbao/values.yaml
 create mode 100644 packages/system/openbao/values.yaml

diff --git a/packages/system/openbao/Chart.yaml b/packages/system/openbao/Chart.yaml
new file mode 100644
index 00000000..104a5e95
--- /dev/null
+++ b/packages/system/openbao/Chart.yaml
@@ -0,0 +1,3 @@
+apiVersion: v2
+name: cozy-openbao
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
diff --git a/packages/system/openbao/Makefile b/packages/system/openbao/Makefile
new file mode 100644
index 00000000..4ae6190e
--- /dev/null
+++ b/packages/system/openbao/Makefile
@@ -0,0 +1,10 @@
+export NAME=openbao
+export NAMESPACE=cozy-openbao
+export REPO_NAME=openbao
+export REPO_URL=https://openbao.github.io/openbao-helm
+export CHART_NAME=openbao
+export CHART_VERSION=^0.25
+
+include ../../../hack/package.mk
+
+update: clean openbao-update
diff --git a/packages/system/openbao/charts/openbao/.helmignore b/packages/system/openbao/charts/openbao/.helmignore
new file mode 100644
index 00000000..4007e243
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/.helmignore
@@ -0,0 +1,28 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.terraform/
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+
+# CI and test
+.circleci/
+.github/
+.gitlab-ci.yml
+test/
diff --git a/packages/system/openbao/charts/openbao/Chart.yaml b/packages/system/openbao/charts/openbao/Chart.yaml
new file mode 100644
index 00000000..4914439e
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/Chart.yaml
@@ -0,0 +1,30 @@
+annotations:
+  artifacthub.io/changes: |
+    - kind: changed
+      description: |
+        fix: Add extraPorts to server Service in ha
+  artifacthub.io/containsSecurityUpdates: "false"
+  charts.openshift.io/name: Openbao
+apiVersion: v2
+appVersion: v2.5.0
+description: Official OpenBao Chart
+home: https://github.com/openbao/openbao-helm
+icon: https://raw.githubusercontent.com/openbao/artwork/refs/heads/main/color/openbao-color.svg
+keywords:
+- vault
+- openbao
+- security
+- encryption
+- secrets
+- management
+- automation
+- infrastructure
+kubeVersion: '>= 1.30.0-0'
+maintainers:
+- email: openbao-security@lists.openssf.org
+  name: OpenBao
+  url: https://openbao.org
+name: openbao
+sources:
+- https://github.com/openbao/openbao-helm
+version: 0.25.3
diff --git a/packages/system/openbao/charts/openbao/README.md b/packages/system/openbao/charts/openbao/README.md
new file mode 100644
index 00000000..bcdf92b1
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/README.md
@@ -0,0 +1,365 @@
+# openbao
+
+![Version: 0.25.3](https://img.shields.io/badge/Version-0.25.3-informational?style=flat-square) ![AppVersion: v2.5.0](https://img.shields.io/badge/AppVersion-v2.5.0-informational?style=flat-square)
+
+Official OpenBao Chart
+
+**Homepage:** <https://github.com/openbao/openbao-helm>
+
+## Maintainers
+
+| Name | Email | Url |
+| ---- | ------ | --- |
+| OpenBao | <openbao-security@lists.openssf.org> | <https://openbao.org> |
+
+## Source Code
+
+* <https://github.com/openbao/openbao-helm>
+
+## Requirements
+
+Kubernetes: `>= 1.30.0-0`
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| csi.agent.enabled | bool | `true` |  |
+| csi.agent.extraArgs | list | `[]` |  |
+| csi.agent.image.pullPolicy | string | `"IfNotPresent"` | image pull policy to use for agent image. if tag is "latest", set to "Always" |
+| csi.agent.image.registry | string | `"quay.io"` | image registry to use for agent image |
+| csi.agent.image.repository | string | `"openbao/openbao"` | image repo to use for agent image |
+| csi.agent.image.tag | string | `""` | image tag to use for agent image - defaults to chart appVersion |
+| csi.agent.logFormat | string | `"standard"` |  |
+| csi.agent.logLevel | string | `"info"` |  |
+| csi.agent.resources | object | `{}` |  |
+| csi.daemonSet.annotations | object | `{}` |  |
+| csi.daemonSet.endpoint | string | `"/provider/openbao.sock"` |  |
+| csi.daemonSet.extraLabels | object | `{}` |  |
+| csi.daemonSet.kubeletRootDir | string | `"/var/lib/kubelet"` |  |
+| csi.daemonSet.providersDir | string | `"/etc/kubernetes/secrets-store-csi-providers"` |  |
+| csi.daemonSet.securityContext.container | object | `{}` |  |
+| csi.daemonSet.securityContext.pod | object | `{}` |  |
+| csi.daemonSet.updateStrategy.maxUnavailable | string | `""` |  |
+| csi.daemonSet.updateStrategy.type | string | `"RollingUpdate"` |  |
+| csi.debug | bool | `false` |  |
+| csi.enabled | bool | `false` | True if you want to install a openbao-csi-provider daemonset.  Requires installing the secrets-store-csi-driver separately, see: https://secrets-store-csi-driver.sigs.k8s.io/getting-started/installation  With the driver and provider installed, you can mount OpenBao secrets into volumes similar to the OpenBao Agent injector, and you can also sync those secrets into Kubernetes secrets. |
+| csi.extraArgs | list | `[]` |  |
+| csi.hmacSecretName | string | `""` |  |
+| csi.image.pullPolicy | string | `"IfNotPresent"` | image pull policy to use for csi image. if tag is "latest", set to "Always" |
+| csi.image.registry | string | `"quay.io"` | image registry to use for csi image |
+| csi.image.repository | string | `"openbao/openbao-csi-provider"` | image repo to use for csi image |
+| csi.image.tag | string | `"2.0.0"` | image tag to use for csi image |
+| csi.livenessProbe.failureThreshold | int | `2` |  |
+| csi.livenessProbe.initialDelaySeconds | int | `5` |  |
+| csi.livenessProbe.periodSeconds | int | `5` |  |
+| csi.livenessProbe.successThreshold | int | `1` |  |
+| csi.livenessProbe.timeoutSeconds | int | `3` |  |
+| csi.pod.affinity | object | `{}` |  |
+| csi.pod.annotations | object | `{}` |  |
+| csi.pod.extraLabels | object | `{}` |  |
+| csi.pod.nodeSelector | object | `{}` |  |
+| csi.pod.tolerations | list | `[]` |  |
+| csi.priorityClassName | string | `""` |  |
+| csi.readinessProbe.failureThreshold | int | `2` |  |
+| csi.readinessProbe.initialDelaySeconds | int | `5` |  |
+| csi.readinessProbe.periodSeconds | int | `5` |  |
+| csi.readinessProbe.successThreshold | int | `1` |  |
+| csi.readinessProbe.timeoutSeconds | int | `3` |  |
+| csi.resources | object | `{}` |  |
+| csi.serviceAccount.annotations | object | `{}` |  |
+| csi.serviceAccount.extraLabels | object | `{}` |  |
+| csi.volumeMounts | list | `[]` | volumeMounts is a list of volumeMounts for the main server container. These are rendered via toYaml rather than pre-processed like the extraVolumes value. The purpose is to make it easy to share volumes between containers. |
+| csi.volumes | list | `[]` | volumes is a list of volumes made available to all containers. These are rendered via toYaml rather than pre-processed like the extraVolumes value. The purpose is to make it easy to share volumes between containers. |
+| extraObjects | list | `[]` |  |
+| global.enabled | bool | `true` | enabled is the master enabled switch. Setting this to true or false will enable or disable all the components within this chart by default. |
+| global.externalBaoAddr | string | `""` | External openbao server address for the injector and CSI provider to use. Setting this will disable deployment of a openbao server. |
+| global.externalVaultAddr | string | `""` | Deprecated: Please use global.externalBaoAddr instead. |
+| global.imagePullSecrets | list | `[]` | Image pull secret to use for registry authentication. Alternatively, the value may be specified as an array of strings. |
+| global.namespace | string | `""` | The namespace to deploy to. Defaults to the `helm` installation namespace. |
+| global.openshift | bool | `false` | If deploying to OpenShift |
+| global.psp | object | `{"annotations":"seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default\napparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default\nseccomp.security.alpha.kubernetes.io/defaultProfileName:  runtime/default\napparmor.security.beta.kubernetes.io/defaultProfileName:  runtime/default\n","enable":false}` | Create PodSecurityPolicy for pods |
+| global.psp.annotations | string | `"seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default\napparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default\nseccomp.security.alpha.kubernetes.io/defaultProfileName:  runtime/default\napparmor.security.beta.kubernetes.io/defaultProfileName:  runtime/default\n"` | Annotation for PodSecurityPolicy. This is a multi-line templated string map, and can also be set as YAML. |
+| global.serverTelemetry.prometheusOperator | bool | `false` | Enable integration with the Prometheus Operator See the top level serverTelemetry section below before enabling this feature. |
+| global.tlsDisable | bool | `true` | TLS for end-to-end encrypted transport |
+| injector.affinity | string | `"podAntiAffinity:\n  requiredDuringSchedulingIgnoredDuringExecution:\n    - labelSelector:\n        matchLabels:\n          app.kubernetes.io/name: {{ template \"openbao.name\" . }}-agent-injector\n          app.kubernetes.io/instance: \"{{ .Release.Name }}\"\n          component: webhook\n      topologyKey: kubernetes.io/hostname\n"` |  |
+| injector.agentDefaults.cpuLimit | string | `"500m"` |  |
+| injector.agentDefaults.cpuRequest | string | `"250m"` |  |
+| injector.agentDefaults.memLimit | string | `"128Mi"` |  |
+| injector.agentDefaults.memRequest | string | `"64Mi"` |  |
+| injector.agentDefaults.template | string | `"map"` |  |
+| injector.agentDefaults.templateConfig.exitOnRetryFailure | bool | `true` |  |
+| injector.agentDefaults.templateConfig.staticSecretRenderInterval | string | `""` |  |
+| injector.agentImage | object | `{"pullPolicy":"IfNotPresent","registry":"quay.io","repository":"openbao/openbao","tag":""}` | agentImage sets the repo and tag of the OpenBao image to use for the OpenBao Agent containers.  This should be set to the official OpenBao image.  OpenBao 1.3.1+ is required. |
+| injector.agentImage.pullPolicy | string | `"IfNotPresent"` | image pull policy to use for agent image. if tag is "latest", set to "Always" |
+| injector.agentImage.registry | string | `"quay.io"` | image registry to use for agent image |
+| injector.agentImage.repository | string | `"openbao/openbao"` | image repo to use for agent image |
+| injector.agentImage.tag | string | `""` | image tag to use for agent image - defaults to chart appVersion |
+| injector.annotations | object | `{}` |  |
+| injector.authPath | string | `"auth/kubernetes"` |  |
+| injector.certs.caBundle | string | `""` |  |
+| injector.certs.certName | string | `"tls.crt"` |  |
+| injector.certs.keyName | string | `"tls.key"` |  |
+| injector.certs.secretName | string | `nil` |  |
+| injector.enabled | string | `"-"` | True if you want to enable openbao agent injection. @default: global.enabled |
+| injector.externalVaultAddr | string | `""` | Deprecated: Please use global.externalBaoAddr instead. |
+| injector.extraEnvironmentVars | object | `{}` |  |
+| injector.extraLabels | object | `{}` |  |
+| injector.failurePolicy | string | `"Ignore"` |  |
+| injector.hostNetwork | bool | `false` |  |
+| injector.image.pullPolicy | string | `"IfNotPresent"` | image pull policy to use for k8s image. if tag is "latest", set to "Always" |
+| injector.image.registry | string | `"docker.io"` | image registry to use for k8s image |
+| injector.image.repository | string | `"hashicorp/vault-k8s"` | image repo to use for k8s image |
+| injector.image.tag | string | `"1.7.2"` | image tag to use for k8s image |
+| injector.leaderElector | object | `{"enabled":true}` | If multiple replicas are specified, by default a leader will be determined so that only one injector attempts to create TLS certificates. |
+| injector.livenessProbe.failureThreshold | int | `2` | When a probe fails, Kubernetes will try failureThreshold times before giving up |
+| injector.livenessProbe.initialDelaySeconds | int | `5` | Number of seconds after the container has started before probe initiates |
+| injector.livenessProbe.periodSeconds | int | `2` | How often (in seconds) to perform the probe |
+| injector.livenessProbe.successThreshold | int | `1` | Minimum consecutive successes for the probe to be considered successful after having failed |
+| injector.livenessProbe.timeoutSeconds | int | `5` | Number of seconds after which the probe times out. |
+| injector.logFormat | string | `"standard"` | Configures the log format of the injector. Supported log formats: "standard", "json". |
+| injector.logLevel | string | `"info"` | Configures the log verbosity of the injector. Supported log levels include: trace, debug, info, warn, error |
+| injector.metrics | object | `{"enabled":false}` | If true, will enable a node exporter metrics endpoint at /metrics. |
+| injector.namespaceSelector | object | `{}` |  |
+| injector.nodeSelector | object | `{}` |  |
+| injector.objectSelector | object | `{}` |  |
+| injector.podDisruptionBudget | object | `{}` |  |
+| injector.port | int | `8080` | Configures the port the injector should listen on |
+| injector.priorityClassName | string | `""` |  |
+| injector.readinessProbe.failureThreshold | int | `2` | When a probe fails, Kubernetes will try failureThreshold times before giving up |
+| injector.readinessProbe.initialDelaySeconds | int | `5` | Number of seconds after the container has started before probe initiates |
+| injector.readinessProbe.periodSeconds | int | `2` | How often (in seconds) to perform the probe |
+| injector.readinessProbe.successThreshold | int | `1` | Minimum consecutive successes for the probe to be considered successful after having failed |
+| injector.readinessProbe.timeoutSeconds | int | `5` | Number of seconds after which the probe times out. |
+| injector.replicas | int | `1` |  |
+| injector.resources | object | `{}` |  |
+| injector.revokeOnShutdown | bool | `false` |  |
+| injector.securityContext.container | object | `{}` |  |
+| injector.securityContext.pod | object | `{}` |  |
+| injector.service.annotations | object | `{}` |  |
+| injector.service.extraLabels | object | `{}` |  |
+| injector.serviceAccount.annotations | object | `{}` |  |
+| injector.startupProbe.failureThreshold | int | `12` | When a probe fails, Kubernetes will try failureThreshold times before giving up |
+| injector.startupProbe.initialDelaySeconds | int | `5` | Number of seconds after the container has started before probe initiates |
+| injector.startupProbe.periodSeconds | int | `5` | How often (in seconds) to perform the probe |
+| injector.startupProbe.successThreshold | int | `1` | Minimum consecutive successes for the probe to be considered successful after having failed |
+| injector.startupProbe.timeoutSeconds | int | `5` | Number of seconds after which the probe times out. |
+| injector.strategy | object | `{}` |  |
+| injector.tolerations | list | `[]` |  |
+| injector.topologySpreadConstraints | list | `[]` |  |
+| injector.webhook.annotations | object | `{}` |  |
+| injector.webhook.failurePolicy | string | `"Ignore"` |  |
+| injector.webhook.matchPolicy | string | `"Exact"` |  |
+| injector.webhook.namespaceSelector | object | `{}` |  |
+| injector.webhook.objectSelector | string | `"matchExpressions:\n- key: app.kubernetes.io/name\n  operator: NotIn\n  values:\n  - {{ template \"openbao.name\" . }}-agent-injector\n"` |  |
+| injector.webhook.timeoutSeconds | int | `30` |  |
+| injector.webhookAnnotations | object | `{}` |  |
+| server.affinity | string | `"podAntiAffinity:\n  requiredDuringSchedulingIgnoredDuringExecution:\n    - labelSelector:\n        matchLabels:\n          app.kubernetes.io/name: {{ template \"openbao.name\" . }}\n          app.kubernetes.io/instance: \"{{ .Release.Name }}\"\n          component: server\n      topologyKey: kubernetes.io/hostname\n"` |  |
+| server.annotations | object | `{}` |  |
+| server.auditStorage.accessMode | string | `"ReadWriteOnce"` |  |
+| server.auditStorage.annotations | object | `{}` |  |
+| server.auditStorage.enabled | bool | `false` |  |
+| server.auditStorage.labels | object | `{}` |  |
+| server.auditStorage.mountPath | string | `"/openbao/audit"` |  |
+| server.auditStorage.size | string | `"10Gi"` |  |
+| server.auditStorage.storageClass | string | `nil` |  |
+| server.authDelegator.enabled | bool | `true` |  |
+| server.configAnnotation | bool | `false` |  |
+| server.dataStorage.accessMode | string | `"ReadWriteOnce"` |  |
+| server.dataStorage.annotations | object | `{}` |  |
+| server.dataStorage.enabled | bool | `true` |  |
+| server.dataStorage.labels | object | `{}` |  |
+| server.dataStorage.mountPath | string | `"/openbao/data"` |  |
+| server.dataStorage.size | string | `"10Gi"` |  |
+| server.dataStorage.storageClass | string | `nil` |  |
+| server.dev.devRootToken | string | `"root"` |  |
+| server.dev.enabled | bool | `false` |  |
+| server.enabled | string | `"-"` |  |
+| server.extraArgs | string | `""` | extraArgs is a string containing additional OpenBao server arguments. |
+| server.extraContainers | string | `nil` |  |
+| server.extraEnvironmentVars | object | `{}` |  |
+| server.extraInitContainers | list | `[]` | extraInitContainers is a list of init containers. Specified as a YAML list. This is useful if you need to run a script to provision TLS certificates or write out configuration files in a dynamic way. |
+| server.extraLabels | object | `{}` |  |
+| server.extraPorts | list | `[]` | extraPorts is a list of extra ports. Specified as a YAML list. This is useful if you need to add additional ports to the statefulset in dynamic way. |
+| server.extraSecretEnvironmentVars | list | `[]` |  |
+| server.extraVolumes | list | `[]` |  |
+| server.gateway.httpRoute.activeService | bool | `true` |  |
+| server.gateway.httpRoute.annotations | object | `{}` |  |
+| server.gateway.httpRoute.apiVersion | string | `"gateway.networking.k8s.io/v1"` |  |
+| server.gateway.httpRoute.enabled | bool | `false` |  |
+| server.gateway.httpRoute.filters | list | `[]` |  |
+| server.gateway.httpRoute.hosts[0] | string | `"chart-example.local"` |  |
+| server.gateway.httpRoute.labels | object | `{}` |  |
+| server.gateway.httpRoute.matches.path.type | string | `"PathPrefix"` |  |
+| server.gateway.httpRoute.matches.path.value | string | `"/"` |  |
+| server.gateway.httpRoute.matches.timeouts | object | `{}` |  |
+| server.gateway.httpRoute.parentRefs | list | `[]` |  |
+| server.gateway.tlsPolicy.activeService | bool | `true` |  |
+| server.gateway.tlsPolicy.annotations | object | `{}` |  |
+| server.gateway.tlsPolicy.apiVersion | string | `"gateway.networking.k8s.io/v1"` |  |
+| server.gateway.tlsPolicy.enabled | bool | `false` |  |
+| server.gateway.tlsPolicy.labels | object | `{}` |  |
+| server.gateway.tlsPolicy.targetRefs | list | `[]` |  |
+| server.gateway.tlsPolicy.validation | object | `{}` |  |
+| server.gateway.tlsRoute.activeService | bool | `true` |  |
+| server.gateway.tlsRoute.annotations | object | `{}` |  |
+| server.gateway.tlsRoute.apiVersion | string | `"gateway.networking.k8s.io/v1alpha3"` |  |
+| server.gateway.tlsRoute.enabled | bool | `false` |  |
+| server.gateway.tlsRoute.hosts | list | `[]` |  |
+| server.gateway.tlsRoute.labels | object | `{}` |  |
+| server.gateway.tlsRoute.parentRefs | list | `[]` |  |
+| server.ha.apiAddr | string | `nil` |  |
+| server.ha.clusterAddr | string | `nil` |  |
+| server.ha.config | string | `"ui = true\n\nlistener \"tcp\" {\n  tls_disable = 1\n  address = \"[::]:8200\"\n  cluster_address = \"[::]:8201\"\n}\nstorage \"consul\" {\n  path = \"openbao\"\n  address = \"HOST_IP:8500\"\n}\n\nservice_registration \"kubernetes\" {}\n\n# Example configuration for using auto-unseal, using Google Cloud KMS. The\n# GKMS keys must already exist, and the cluster must have a service account\n# that is authorized to access GCP KMS.\n#seal \"gcpckms\" {\n#   project     = \"openbao-helm-dev-246514\"\n#   region      = \"global\"\n#   key_ring    = \"openbao-helm-unseal-kr\"\n#   crypto_key  = \"openbao-helm-unseal-key\"\n#}\n\n# Example configuration for enabling Prometheus metrics.\n# If you are using Prometheus Operator you can enable a ServiceMonitor resource below.\n# You may wish to enable unauthenticated metrics in the listener block above.\n#telemetry {\n#  prometheus_retention_time = \"30s\"\n#  disable_hostname = true\n#}\n"` |  |
+| server.ha.disruptionBudget.enabled | bool | `true` |  |
+| server.ha.disruptionBudget.maxUnavailable | string | `nil` |  |
+| server.ha.enabled | bool | `false` |  |
+| server.ha.raft.config | string | `"ui = true\n\nlistener \"tcp\" {\n  tls_disable = 1\n  address = \"[::]:8200\"\n  cluster_address = \"[::]:8201\"\n  # Enable unauthenticated metrics access (necessary for Prometheus Operator)\n  #telemetry {\n  #  unauthenticated_metrics_access = \"true\"\n  #}\n}\n\nstorage \"raft\" {\n  path = \"/openbao/data\"\n}\n\nservice_registration \"kubernetes\" {}\n"` |  |
+| server.ha.raft.enabled | bool | `false` |  |
+| server.ha.raft.setNodeId | bool | `false` |  |
+| server.ha.replicas | int | `3` |  |
+| server.hostAliases | list | `[]` |  |
+| server.hostNetwork | bool | `false` |  |
+| server.image.pullPolicy | string | `"IfNotPresent"` | image pull policy to use for server image. if tag is "latest", set to "Always" |
+| server.image.registry | string | `"quay.io"` | image registry to use for server image |
+| server.image.repository | string | `"openbao/openbao"` | image repo to use for server image |
+| server.image.tag | string | `""` | image tag to use for server image - defaults to chart appVersion |
+| server.ingress.activeService | bool | `true` |  |
+| server.ingress.annotations | object | `{}` |  |
+| server.ingress.enabled | bool | `false` |  |
+| server.ingress.extraPaths | list | `[]` |  |
+| server.ingress.hosts[0].host | string | `"chart-example.local"` |  |
+| server.ingress.hosts[0].paths | list | `[]` |  |
+| server.ingress.ingressClassName | string | `""` |  |
+| server.ingress.labels | object | `{}` |  |
+| server.ingress.pathType | string | `"Prefix"` |  |
+| server.ingress.tls | list | `[]` |  |
+| server.livenessProbe.enabled | bool | `false` |  |
+| server.livenessProbe.execCommand | list | `[]` |  |
+| server.livenessProbe.failureThreshold | int | `2` |  |
+| server.livenessProbe.initialDelaySeconds | int | `60` |  |
+| server.livenessProbe.path | string | `"/v1/sys/health?standbyok=true"` |  |
+| server.livenessProbe.periodSeconds | int | `5` |  |
+| server.livenessProbe.port | int | `8200` |  |
+| server.livenessProbe.successThreshold | int | `1` |  |
+| server.livenessProbe.timeoutSeconds | int | `3` |  |
+| server.logFormat | string | `""` |  |
+| server.logLevel | string | `""` |  |
+| server.networkPolicy.egress | list | `[]` |  |
+| server.networkPolicy.enabled | bool | `false` |  |
+| server.networkPolicy.ingress[0].from[0].namespaceSelector | object | `{}` |  |
+| server.networkPolicy.ingress[0].ports[0].port | int | `8200` |  |
+| server.networkPolicy.ingress[0].ports[0].protocol | string | `"TCP"` |  |
+| server.networkPolicy.ingress[0].ports[1].port | int | `8201` |  |
+| server.networkPolicy.ingress[0].ports[1].protocol | string | `"TCP"` |  |
+| server.nodeSelector | object | `{}` |  |
+| server.persistentVolumeClaimRetentionPolicy | object | `{}` |  |
+| server.podManagementPolicy | string | `"OrderedReady"` |  |
+| server.postStart | list | `[]` |  |
+| server.preStopSleepSeconds | int | `5` |  |
+| server.priorityClassName | string | `""` |  |
+| server.readinessProbe.enabled | bool | `true` |  |
+| server.readinessProbe.failureThreshold | int | `2` |  |
+| server.readinessProbe.initialDelaySeconds | int | `5` |  |
+| server.readinessProbe.periodSeconds | int | `5` |  |
+| server.readinessProbe.port | int | `8200` |  |
+| server.readinessProbe.successThreshold | int | `1` |  |
+| server.readinessProbe.timeoutSeconds | int | `3` |  |
+| server.resources | object | `{}` |  |
+| server.route.activeService | bool | `true` |  |
+| server.route.annotations | object | `{}` |  |
+| server.route.enabled | bool | `false` |  |
+| server.route.host | string | `"chart-example.local"` |  |
+| server.route.labels | object | `{}` |  |
+| server.route.tls.termination | string | `"passthrough"` |  |
+| server.service.active.annotations | object | `{}` |  |
+| server.service.active.enabled | bool | `true` |  |
+| server.service.active.extraLabels | object | `{}` |  |
+| server.service.annotations | object | `{}` |  |
+| server.service.enabled | bool | `true` |  |
+| server.service.externalTrafficPolicy | string | `"Cluster"` |  |
+| server.service.extraLabels | object | `{}` |  |
+| server.service.extraPorts | list | `[]` | extraPorts is a list of extra ports. Specified as a YAML list. This is useful if you need to add additional ports to the server service in dynamic way. |
+| server.service.instanceSelector.enabled | bool | `true` |  |
+| server.service.ipFamilies | list | `[]` |  |
+| server.service.ipFamilyPolicy | string | `""` |  |
+| server.service.port | int | `8200` |  |
+| server.service.publishNotReadyAddresses | bool | `true` |  |
+| server.service.standby.annotations | object | `{}` |  |
+| server.service.standby.enabled | bool | `true` |  |
+| server.service.standby.extraLabels | object | `{}` |  |
+| server.service.targetPort | int | `8200` |  |
+| server.serviceAccount.annotations | object | `{}` |  |
+| server.serviceAccount.create | bool | `true` |  |
+| server.serviceAccount.createSecret | bool | `false` |  |
+| server.serviceAccount.extraLabels | object | `{}` |  |
+| server.serviceAccount.name | string | `""` |  |
+| server.serviceAccount.serviceDiscovery.enabled | bool | `true` |  |
+| server.shareProcessNamespace | bool | `false` | shareProcessNamespace enables process namespace sharing between OpenBao and the extraContainers This is useful if OpenBao must be signaled, e.g. to send a SIGHUP for a log rotation |
+| server.standalone.config | string | `"ui = true\n\nlistener \"tcp\" {\n  tls_disable = 1\n  address = \"[::]:8200\"\n  cluster_address = \"[::]:8201\"\n  # Enable unauthenticated metrics access (necessary for Prometheus Operator)\n  #telemetry {\n  #  unauthenticated_metrics_access = \"true\"\n  #}\n}\nstorage \"file\" {\n  path = \"/openbao/data\"\n}\n\n# Example configuration for using auto-unseal, using Google Cloud KMS. The\n# GKMS keys must already exist, and the cluster must have a service account\n# that is authorized to access GCP KMS.\n#seal \"gcpckms\" {\n#   project     = \"openbao-helm-dev\"\n#   region      = \"global\"\n#   key_ring    = \"openbao-helm-unseal-kr\"\n#   crypto_key  = \"openbao-helm-unseal-key\"\n#}\n\n# Example configuration for enabling Prometheus metrics in your config.\n#telemetry {\n#  prometheus_retention_time = \"30s\"\n#  disable_hostname = true\n#}\n"` |  |
+| server.standalone.enabled | string | `"-"` |  |
+| server.statefulSet.annotations | object | `{}` |  |
+| server.statefulSet.securityContext.container | object | `{}` |  |
+| server.statefulSet.securityContext.pod | object | `{}` |  |
+| server.terminationGracePeriodSeconds | int | `10` |  |
+| server.tolerations | list | `[]` |  |
+| server.topologySpreadConstraints | list | `[]` |  |
+| server.updateStrategyType | string | `"OnDelete"` |  |
+| server.volumeMounts | string | `nil` |  |
+| server.volumes | string | `nil` |  |
+| serverTelemetry.grafanaDashboard.defaultLabel | bool | `true` |  |
+| serverTelemetry.grafanaDashboard.enabled | bool | `false` |  |
+| serverTelemetry.grafanaDashboard.extraAnnotations | object | `{}` |  |
+| serverTelemetry.grafanaDashboard.extraLabel | object | `{}` |  |
+| serverTelemetry.prometheusRules.enabled | bool | `false` |  |
+| serverTelemetry.prometheusRules.rules | list | `[]` |  |
+| serverTelemetry.prometheusRules.selectors | object | `{}` |  |
+| serverTelemetry.serviceMonitor.authorization | object | `{}` |  |
+| serverTelemetry.serviceMonitor.enabled | bool | `false` |  |
+| serverTelemetry.serviceMonitor.interval | string | `"30s"` |  |
+| serverTelemetry.serviceMonitor.port | string | `""` | Port which Prometheus uses when scraping metrics. If empty will use `openbao.scheme` helper for its value |
+| serverTelemetry.serviceMonitor.scheme | string | `""` | scheme to use when Prometheus scrapes metrics. If empty will use `openbao.scheme` helper for its value |
+| serverTelemetry.serviceMonitor.scrapeClass | string | `""` |  |
+| serverTelemetry.serviceMonitor.scrapeTimeout | string | `"10s"` |  |
+| serverTelemetry.serviceMonitor.selectors | object | `{}` |  |
+| serverTelemetry.serviceMonitor.tlsConfig | object | `{}` |  |
+| snapshotAgent.annotations | object | `{}` |  |
+| snapshotAgent.config.baoAuthPath | string | `"kubernetes"` |  |
+| snapshotAgent.config.baoRole | string | `"snapshot"` |  |
+| snapshotAgent.config.s3Bucket | string | `"openbao-snapshots"` |  |
+| snapshotAgent.config.s3ExpireDays | string | `"14"` |  |
+| snapshotAgent.config.s3Host | string | `"s3.eu-east-1.amazonaws.com"` |  |
+| snapshotAgent.config.s3Uri | string | `"s3://openbao-snapshots"` |  |
+| snapshotAgent.config.s3cmdExtraFlag | string | `"-v"` |  |
+| snapshotAgent.enabled | bool | `false` |  |
+| snapshotAgent.extraEnvironmentVars | object | `{}` | Map of extra environment variables to set in the snapshot-agent cronjob |
+| snapshotAgent.extraSecretEnvironmentVars | list | `[]` | List of extra environment variables to set in the snapshot-agent cronjob These variables take value from existing Secret objects. |
+| snapshotAgent.extraVolumeMounts | list | `[]` | List of additional volumeMounts for the snapshot cronjob container. |
+| snapshotAgent.extraVolumes | list | `[]` | List of extraVolumes made available to the snapshot cronjob container. |
+| snapshotAgent.image.repository | string | `"ghcr.io/openbao/openbao-snapshot-agent"` |  |
+| snapshotAgent.image.tag | string | `"0.2.4"` |  |
+| snapshotAgent.resources | object | `{}` |  |
+| snapshotAgent.restartPolicy | string | `"OnFailure"` |  |
+| snapshotAgent.s3CredentialsSecret | string | `"my-s3-credentials"` |  |
+| snapshotAgent.schedule | string | `"*/15 * * * *"` |  |
+| snapshotAgent.securityContext.container | object | `{}` |  |
+| snapshotAgent.securityContext.pod | object | `{}` |  |
+| snapshotAgent.serviceAccount.annotations | object | `{}` |  |
+| snapshotAgent.serviceAccount.create | bool | `true` |  |
+| snapshotAgent.serviceAccount.extraLabels | object | `{}` |  |
+| snapshotAgent.serviceAccount.name | string | `""` |  |
+| ui.activeOpenbaoPodOnly | bool | `false` |  |
+| ui.annotations | object | `{}` |  |
+| ui.enabled | bool | `false` |  |
+| ui.externalPort | int | `8200` |  |
+| ui.externalTrafficPolicy | string | `"Cluster"` |  |
+| ui.extraLabels | object | `{}` |  |
+| ui.publishNotReadyAddresses | bool | `true` |  |
+| ui.serviceIPFamilies | list | `[]` |  |
+| ui.serviceIPFamilyPolicy | string | `""` |  |
+| ui.serviceNodePort | string | `nil` |  |
+| ui.serviceType | string | `"ClusterIP"` |  |
+| ui.targetPort | int | `8200` |  |
+
+----------------------------------------------
+Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)
diff --git a/packages/system/openbao/charts/openbao/grafana/dashboards/dashboard.json b/packages/system/openbao/charts/openbao/grafana/dashboards/dashboard.json
new file mode 100644
index 00000000..b4eb93b9
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/grafana/dashboards/dashboard.json
@@ -0,0 +1,2559 @@
+{
+  "__inputs": [
+    {
+      "name": "DS_PROMXY",
+      "label": "Prometheus",
+      "description": "",
+      "type": "datasource",
+      "pluginId": "prometheus",
+      "pluginName": "Prometheus"
+    }
+  ],
+  "__requires": [
+    {
+      "type": "grafana",
+      "id": "grafana",
+      "name": "Grafana",
+      "version": "7.0.3"
+    },
+    {
+      "type": "panel",
+      "id": "grafana-piechart-panel",
+      "name": "Pie Chart",
+      "version": "1.5.0"
+    },
+    {
+      "type": "panel",
+      "id": "graph",
+      "name": "Graph",
+      "version": ""
+    },
+    {
+      "type": "datasource",
+      "id": "prometheus",
+      "name": "Prometheus",
+      "version": "1.0.0"
+    },
+    {
+      "type": "panel",
+      "id": "stat",
+      "name": "Stat",
+      "version": ""
+    },
+    {
+      "type": "panel",
+      "id": "table",
+      "name": "Table",
+      "version": ""
+    }
+  ],
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": "${DS_PROMXY}",
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "type": "dashboard"
+      }
+    ]
+  },
+  "description": " OpenBao Metrics",
+  "editable": true,
+  "graphTooltip": 1,
+  "id": null,
+  "iteration": 1602255075192,
+  "links": [],
+  "panels": [
+    {
+      "datasource": "${DS_PROMXY}",
+      "fieldConfig": {
+        "defaults": {
+          "custom": {
+            "align": null
+          },
+          "mappings": [
+            {
+              "from": "",
+              "id": 0,
+              "operator": "",
+              "text": "Standby",
+              "to": "",
+              "type": 1,
+              "value": "0"
+            },
+            {
+              "from": "",
+              "id": 1,
+              "operator": "",
+              "text": "Active",
+              "to": "",
+              "type": 1,
+              "value": "1"
+            }
+          ],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "red",
+                "value": null
+              },
+              {
+                "color": "green",
+                "value": 1
+              }
+            ]
+          },
+          "unit": "Misc"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 9,
+        "x": 0,
+        "y": 0
+      },
+      "id": 39,
+      "maxDataPoints": 100,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "none",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": ["last"],
+          "fields": "",
+          "values": false
+        }
+      },
+      "pluginVersion": "7.0.3",
+      "targets": [
+        {
+          "expr": "up{job=\"openbao-internal\"}",
+          "format": "time_series",
+          "interval": "",
+          "legendFormat": "{{ instance }}",
+          "refId": "A"
+        }
+      ],
+      "timeFrom": null,
+      "timeShift": null,
+      "title": "Healthy Status",
+      "type": "stat"
+    },
+    {
+      "datasource": "${DS_PROMXY}",
+      "fieldConfig": {
+        "defaults": {
+          "custom": {
+            "align": null,
+            "displayMode": "auto"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Mount Path"
+            },
+            "properties": [
+              {
+                "id": "custom.width",
+                "value": 166
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 5,
+        "x": 9,
+        "y": 0
+      },
+      "id": 59,
+      "maxDataPoints": 100,
+      "options": {
+        "showHeader": true,
+        "sortBy": [
+          {
+            "desc": true,
+            "displayName": "Number of Entries"
+          }
+        ]
+      },
+      "pluginVersion": "7.0.3",
+      "targets": [
+        {
+          "expr": "sum by (exported_namespace,mount_point) (${metrics_prefix}_secret_kv_count)",
+          "format": "table",
+          "instant": true,
+          "interval": "",
+          "legendFormat": "{{ mount_point }}",
+          "refId": "A"
+        }
+      ],
+      "timeFrom": null,
+      "timeShift": null,
+      "title": "Secrets",
+      "transformations": [
+        {
+          "id": "seriesToColumns",
+          "options": {
+            "byField": "mount_point"
+          }
+        },
+        {
+          "id": "organize",
+          "options": {
+            "excludeByName": {
+              "Time": true,
+              "__name__": true,
+              "cluster": true,
+              "env": true,
+              "instance": true,
+              "job": true,
+              "namespace": true,
+              "project": true
+            },
+            "indexByName": {},
+            "renameByName": {
+              "Value": "Number of Entries",
+              "mount_point": "Mount Path",
+              "exported_namespace": "Namespace"
+            }
+          }
+        }
+      ],
+      "type": "table"
+    },
+    {
+      "datasource": "${DS_PROMXY}",
+      "fieldConfig": {
+        "defaults": {
+          "custom": {},
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 5,
+        "x": 14,
+        "y": 0
+      },
+      "id": 78,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "none",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": ["lastNotNull"],
+          "fields": "",
+          "values": false
+        }
+      },
+      "pluginVersion": "7.0.3",
+      "targets": [
+        {
+          "expr": "avg(${metrics_prefix}_identity_num_entities)",
+          "interval": "",
+          "legendFormat": "",
+          "refId": "A"
+        }
+      ],
+      "timeFrom": null,
+      "timeShift": null,
+      "title": "Number of Identity Entities",
+      "type": "stat"
+    },
+    {
+      "aliasColors": {},
+      "breakPoint": "50%",
+      "cacheTimeout": null,
+      "combine": {
+        "label": "Others",
+        "threshold": 0
+      },
+      "datasource": "${DS_PROMXY}",
+      "decimals": null,
+      "fieldConfig": {
+        "defaults": {
+          "custom": {
+            "align": null
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "fontSize": "80%",
+      "format": "short",
+      "gridPos": {
+        "h": 8,
+        "w": 5,
+        "x": 19,
+        "y": 0
+      },
+      "id": 49,
+      "interval": null,
+      "legend": {
+        "header": "count",
+        "percentage": false,
+        "show": true,
+        "sideWidth": null,
+        "values": true
+      },
+      "legendType": "Right side",
+      "links": [],
+      "maxDataPoints": 1,
+      "nullPointMode": "connected",
+      "pieType": "pie",
+      "pluginVersion": "7.0.3",
+      "strokeWidth": "3",
+      "targets": [
+        {
+          "expr": "avg without(instance) (${metrics_prefix}_identity_entity_alias_count)",
+          "format": "time_series",
+          "interval": "",
+          "legendFormat": "{{ auth_method }}",
+          "refId": "A"
+        }
+      ],
+      "timeFrom": null,
+      "timeShift": null,
+      "title": "Identity Entities Aliases by Method",
+      "type": "grafana-piechart-panel",
+      "valueName": "current"
+    },
+    {
+      "datasource": "${DS_PROMXY}",
+      "fieldConfig": {
+        "defaults": {
+          "custom": {},
+          "mappings": [
+            {
+              "from": "",
+              "id": 0,
+              "operator": "",
+              "text": "UNSEALED",
+              "to": "",
+              "type": 1,
+              "value": "2"
+            },
+            {
+              "from": "",
+              "id": 1,
+              "operator": "",
+              "text": "SEALED",
+              "to": "",
+              "type": 1,
+              "value": "1"
+            }
+          ],
+          "noValue": "N/A",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "red",
+                "value": null
+              },
+              {
+                "color": "yellow",
+                "value": 1
+              },
+              {
+                "color": "green",
+                "value": 2
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 9,
+        "x": 0,
+        "y": 4
+      },
+      "id": 47,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "none",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": ["last"],
+          "fields": "",
+          "values": false
+        }
+      },
+      "pluginVersion": "7.0.3",
+      "targets": [
+        {
+          "expr": "max(1 + ${metrics_prefix}_core_unsealed{})",
+          "format": "time_series",
+          "interval": "",
+          "legendFormat": "{{ instance }}",
+          "refId": "A"
+        }
+      ],
+      "timeFrom": null,
+      "timeShift": null,
+      "title": "Sealed Status",
+      "type": "stat"
+    },
+    {
+      "datasource": "${DS_PROMXY}",
+      "fieldConfig": {
+        "defaults": {
+          "custom": {},
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "#EAB839",
+                "value": 100
+              },
+              {
+                "color": "#EF843C",
+                "value": 200
+              },
+              {
+                "color": "red",
+                "value": 400
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 5,
+        "x": 14,
+        "y": 4
+      },
+      "id": 95,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": ["lastNotNull"],
+          "fields": "",
+          "values": false
+        }
+      },
+      "pluginVersion": "7.0.3",
+      "targets": [
+        {
+          "expr": "avg(${metrics_prefix}_expire_num_leases)",
+          "interval": "",
+          "legendFormat": "",
+          "refId": "A"
+        }
+      ],
+      "timeFrom": null,
+      "timeShift": null,
+      "title": "Number of Leases",
+      "type": "stat"
+    },
+    {
+      "collapsed": true,
+      "datasource": "${DS_PROMXY}",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 8
+      },
+      "id": 74,
+      "panels": [
+        {
+          "aliasColors": {},
+          "bars": true,
+          "dashLength": 10,
+          "dashes": false,
+          "datasource": "${DS_PROMXY}",
+          "decimals": 0,
+          "fieldConfig": {
+            "defaults": {
+              "custom": {}
+            },
+            "overrides": []
+          },
+          "fill": 1,
+          "fillGradient": 0,
+          "gridPos": {
+            "h": 9,
+            "w": 12,
+            "x": 0,
+            "y": 9
+          },
+          "hiddenSeries": false,
+          "id": 24,
+          "legend": {
+            "alignAsTable": true,
+            "avg": false,
+            "current": false,
+            "hideEmpty": false,
+            "hideZero": false,
+            "max": true,
+            "min": false,
+            "rightSide": false,
+            "show": true,
+            "sort": null,
+            "sortDesc": null,
+            "total": true,
+            "values": true
+          },
+          "lines": false,
+          "linewidth": 1,
+          "links": [],
+          "nullPointMode": "null as zero",
+          "options": {
+            "dataLinks": []
+          },
+          "percentage": false,
+          "pointradius": 5,
+          "points": false,
+          "renderer": "flot",
+          "scopedVars": {
+            "mountpoint": {
+              "selected": true,
+              "text": "secret",
+              "value": "secret"
+            }
+          },
+          "seriesOverrides": [],
+          "spaceLength": 10,
+          "stack": true,
+          "steppedLine": false,
+          "targets": [
+            {
+              "expr": "avg(increase(${metrics_prefix}_route_create_${mountpoint}__count[5m]))",
+              "format": "time_series",
+              "hide": false,
+              "interval": "5m",
+              "legendFormat": "Create",
+              "refId": "A"
+            },
+            {
+              "expr": "avg(increase(${metrics_prefix}_route_delete_${mountpoint}__count[5m]))",
+              "hide": false,
+              "interval": "5m",
+              "legendFormat": "Delete",
+              "refId": "B"
+            },
+            {
+              "expr": "avg(increase(${metrics_prefix}_route_read_${mountpoint}__count[5m]))",
+              "format": "time_series",
+              "hide": false,
+              "instant": false,
+              "interval": "5m",
+              "intervalFactor": 1,
+              "legendFormat": "Read",
+              "refId": "C"
+            },
+            {
+              "expr": "avg(increase(${metrics_prefix}_route_list_${mountpoint}__count[5m]))",
+              "format": "time_series",
+              "hide": false,
+              "interval": "5m",
+              "legendFormat": "List",
+              "refId": "D"
+            },
+            {
+              "expr": "avg(increase(${metrics_prefix}_route_rollback_${mountpoint}__count[5m]))",
+              "hide": true,
+              "interval": "5m",
+              "legendFormat": "Rollback",
+              "refId": "E"
+            }
+          ],
+          "thresholds": [],
+          "timeFrom": null,
+          "timeRegions": [],
+          "timeShift": null,
+          "title": "Number of Operations in \"$mountpoint\"",
+          "tooltip": {
+            "shared": true,
+            "sort": 0,
+            "value_type": "individual"
+          },
+          "type": "graph",
+          "xaxis": {
+            "buckets": null,
+            "mode": "time",
+            "name": null,
+            "show": true,
+            "values": []
+          },
+          "yaxes": [
+            {
+              "$$hashKey": "object:182",
+              "decimals": 0,
+              "format": "short",
+              "label": "Operations in 5 minute",
+              "logBase": 1,
+              "max": null,
+              "min": null,
+              "show": true
+            },
+            {
+              "$$hashKey": "object:183",
+              "format": "short",
+              "label": null,
+              "logBase": 1,
+              "max": null,
+              "min": null,
+              "show": false
+            }
+          ],
+          "yaxis": {
+            "align": false,
+            "alignLevel": null
+          }
+        },
+        {
+          "aliasColors": {},
+          "bars": false,
+          "dashLength": 10,
+          "dashes": false,
+          "datasource": "${DS_PROMXY}",
+          "decimals": 0,
+          "fieldConfig": {
+            "defaults": {
+              "custom": {}
+            },
+            "overrides": []
+          },
+          "fill": 1,
+          "fillGradient": 0,
+          "gridPos": {
+            "h": 9,
+            "w": 12,
+            "x": 12,
+            "y": 9
+          },
+          "hiddenSeries": false,
+          "id": 35,
+          "legend": {
+            "alignAsTable": true,
+            "avg": true,
+            "current": false,
+            "hideEmpty": false,
+            "hideZero": false,
+            "max": true,
+            "min": false,
+            "rightSide": false,
+            "show": true,
+            "sort": null,
+            "sortDesc": null,
+            "total": false,
+            "values": true
+          },
+          "lines": true,
+          "linewidth": 1,
+          "links": [],
+          "nullPointMode": "null as zero",
+          "options": {
+            "dataLinks": []
+          },
+          "percentage": false,
+          "pointradius": 5,
+          "points": false,
+          "renderer": "flot",
+          "scopedVars": {
+            "mountpoint": {
+              "selected": true,
+              "text": "secret",
+              "value": "secret"
+            }
+          },
+          "seriesOverrides": [],
+          "spaceLength": 10,
+          "stack": false,
+          "steppedLine": false,
+          "targets": [
+            {
+              "expr": "avg(rate(${metrics_prefix}_route_create_${mountpoint}__sum[1m]) / rate(${metrics_prefix}_route_create_${mountpoint}__count[1m]) * 1000)",
+              "format": "time_series",
+              "interval": "",
+              "intervalFactor": 1,
+              "legendFormat": "Create",
+              "refId": "A"
+            },
+            {
+              "expr": "avg(rate(${metrics_prefix}_route_delete_${mountpoint}__sum[1m]) / rate(${metrics_prefix}_route_delete_${mountpoint}__count[1m]) * 1000)",
+              "interval": "",
+              "legendFormat": "Delete",
+              "refId": "B"
+            },
+            {
+              "expr": "avg(rate(${metrics_prefix}_route_read_${mountpoint}__sum[1m]) / rate(${metrics_prefix}_route_read_${mountpoint}__count[1m]) * 1000)",
+              "hide": false,
+              "interval": "",
+              "legendFormat": "Read",
+              "refId": "C"
+            },
+            {
+              "expr": "avg(rate(${metrics_prefix}_route_list_${mountpoint}__sum[1m]) / rate(${metrics_prefix}_route_list_${mountpoint}__count[1m]) * 1000)",
+              "hide": false,
+              "interval": "",
+              "legendFormat": "List",
+              "refId": "D"
+            },
+            {
+              "expr": "avg(rate(${metrics_prefix}_route_rollback_${mountpoint}__sum[1m]) / rate(${metrics_prefix}_route_rollback_${mountpoint}__count[1m]) * 1000)",
+              "hide": true,
+              "interval": "",
+              "legendFormat": "Rollback",
+              "refId": "E"
+            }
+          ],
+          "thresholds": [],
+          "timeFrom": null,
+          "timeRegions": [],
+          "timeShift": null,
+          "title": "Time of Operations in \"$mountpoint\"",
+          "tooltip": {
+            "shared": true,
+            "sort": 0,
+            "value_type": "individual"
+          },
+          "type": "graph",
+          "xaxis": {
+            "buckets": null,
+            "mode": "time",
+            "name": null,
+            "show": true,
+            "values": []
+          },
+          "yaxes": [
+            {
+              "$$hashKey": "object:82",
+              "decimals": 0,
+              "format": "µs",
+              "label": "Time of one operation",
+              "logBase": 1,
+              "max": null,
+              "min": "0",
+              "show": true
+            },
+            {
+              "$$hashKey": "object:83",
+              "format": "short",
+              "label": null,
+              "logBase": 1,
+              "max": null,
+              "min": null,
+              "show": false
+            }
+          ],
+          "yaxis": {
+            "align": false,
+            "alignLevel": null
+          }
+        }
+      ],
+      "repeat": "mountpoint",
+      "title": "Path Info: $mountpoint",
+      "type": "row"
+    },
+    {
+      "collapsed": false,
+      "datasource": "${DS_PROMXY}",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 9
+      },
+      "id": 45,
+      "panels": [],
+      "repeat": null,
+      "title": "CPU/Mem Info: $node",
+      "type": "row"
+    },
+    {
+      "datasource": "${DS_PROMXY}",
+      "description": "",
+      "fieldConfig": {
+        "defaults": {
+          "custom": {},
+          "mappings": [],
+          "noValue": "N/A",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 0.2
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 3,
+        "x": 0,
+        "y": 10
+      },
+      "id": 41,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": ["last"],
+          "fields": "",
+          "values": false
+        }
+      },
+      "pluginVersion": "7.0.3",
+      "targets": [
+        {
+          "expr": "avg(${metrics_prefix}_runtime_heap_objects{} / ${metrics_prefix}_runtime_malloc_count{})",
+          "interval": "",
+          "intervalFactor": 10,
+          "legendFormat": "",
+          "refId": "A"
+        }
+      ],
+      "timeFrom": null,
+      "timeShift": null,
+      "title": "Heap Objects Used",
+      "type": "stat"
+    },
+    {
+      "datasource": "${DS_PROMXY}",
+      "fieldConfig": {
+        "defaults": {
+          "custom": {},
+          "mappings": [],
+          "noValue": "N/A",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "#EAB839",
+                "value": 70
+              },
+              {
+                "color": "#EF843C",
+                "value": 100
+              },
+              {
+                "color": "#E24D42",
+                "value": 150
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 3,
+        "x": 3,
+        "y": 10
+      },
+      "id": 76,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": ["last"],
+          "fields": "",
+          "values": false
+        }
+      },
+      "pluginVersion": "7.0.3",
+      "targets": [
+        {
+          "expr": "avg(${metrics_prefix}_runtime_num_goroutines{})",
+          "interval": "",
+          "legendFormat": "",
+          "refId": "A"
+        }
+      ],
+      "timeFrom": null,
+      "timeShift": null,
+      "title": "Number of Goroutines",
+      "type": "stat"
+    },
+    {
+      "aliasColors": {},
+      "bars": false,
+      "dashLength": 10,
+      "dashes": false,
+      "datasource": "${DS_PROMXY}",
+      "decimals": 3,
+      "fieldConfig": {
+        "defaults": {
+          "custom": {},
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "fill": 1,
+      "fillGradient": 0,
+      "gridPos": {
+        "h": 5,
+        "w": 18,
+        "x": 6,
+        "y": 10
+      },
+      "hiddenSeries": false,
+      "id": 43,
+      "legend": {
+        "alignAsTable": true,
+        "avg": true,
+        "current": true,
+        "hideEmpty": false,
+        "hideZero": false,
+        "max": true,
+        "min": true,
+        "rightSide": false,
+        "show": true,
+        "total": false,
+        "values": true
+      },
+      "lines": true,
+      "linewidth": 1,
+      "nullPointMode": "null",
+      "options": {
+        "dataLinks": []
+      },
+      "percentage": false,
+      "pluginVersion": "7.0.3",
+      "pointradius": 2,
+      "points": false,
+      "renderer": "flot",
+      "seriesOverrides": [],
+      "spaceLength": 10,
+      "stack": false,
+      "steppedLine": false,
+      "targets": [
+        {
+          "expr": "avg(${metrics_prefix}_runtime_alloc_bytes{})",
+          "interval": "",
+          "intervalFactor": 5,
+          "legendFormat": "$node",
+          "refId": "A"
+        }
+      ],
+      "thresholds": [],
+      "timeFrom": null,
+      "timeRegions": [],
+      "timeShift": null,
+      "title": "Allocated MB",
+      "tooltip": {
+        "shared": true,
+        "sort": 0,
+        "value_type": "individual"
+      },
+      "type": "graph",
+      "xaxis": {
+        "buckets": null,
+        "mode": "time",
+        "name": null,
+        "show": true,
+        "values": []
+      },
+      "yaxes": [
+        {
+          "$$hashKey": "object:373",
+          "format": "decbytes",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": true
+        },
+        {
+          "$$hashKey": "object:374",
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": true
+        }
+      ],
+      "yaxis": {
+        "align": false,
+        "alignLevel": null
+      }
+    },
+    {
+      "collapsed": false,
+      "datasource": "${DS_PROMXY}",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 15
+      },
+      "id": 16,
+      "panels": [],
+      "title": "Token",
+      "type": "row"
+    },
+    {
+      "datasource": "${DS_PROMXY}",
+      "fieldConfig": {
+        "defaults": {
+          "custom": {},
+          "mappings": [],
+          "noValue": "N/A",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 3,
+        "x": 0,
+        "y": 16
+      },
+      "id": 53,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "none",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": ["lastNotNull"],
+          "fields": "",
+          "values": false
+        }
+      },
+      "pluginVersion": "7.0.3",
+      "targets": [
+        {
+          "expr": "avg(${metrics_prefix}_token_count)",
+          "interval": "",
+          "legendFormat": "",
+          "refId": "A"
+        }
+      ],
+      "timeFrom": null,
+      "timeShift": null,
+      "title": "Available Tokens",
+      "type": "stat"
+    },
+    {
+      "aliasColors": {},
+      "bars": true,
+      "dashLength": 10,
+      "dashes": false,
+      "datasource": "${DS_PROMXY}",
+      "decimals": 0,
+      "fieldConfig": {
+        "defaults": {
+          "custom": {}
+        },
+        "overrides": []
+      },
+      "fill": 1,
+      "fillGradient": 0,
+      "gridPos": {
+        "h": 8,
+        "w": 21,
+        "x": 3,
+        "y": 16
+      },
+      "hiddenSeries": false,
+      "id": 104,
+      "legend": {
+        "alignAsTable": true,
+        "avg": false,
+        "current": true,
+        "max": true,
+        "min": false,
+        "rightSide": true,
+        "show": true,
+        "total": false,
+        "values": true
+      },
+      "lines": false,
+      "linewidth": 1,
+      "nullPointMode": "connected",
+      "options": {
+        "dataLinks": []
+      },
+      "percentage": false,
+      "pointradius": 2,
+      "points": false,
+      "renderer": "flot",
+      "seriesOverrides": [],
+      "spaceLength": 10,
+      "stack": false,
+      "steppedLine": false,
+      "targets": [
+        {
+          "expr": "avg without(instance) (${metrics_prefix}_token_count_by_policy)",
+          "interval": "",
+          "legendFormat": "{{ policy }}",
+          "refId": "A"
+        }
+      ],
+      "thresholds": [],
+      "timeFrom": null,
+      "timeRegions": [],
+      "timeShift": null,
+      "title": "Tokens by Policy",
+      "tooltip": {
+        "shared": false,
+        "sort": 0,
+        "value_type": "individual"
+      },
+      "type": "graph",
+      "xaxis": {
+        "buckets": null,
+        "mode": "series",
+        "name": null,
+        "show": true,
+        "values": ["current"]
+      },
+      "yaxes": [
+        {
+          "$$hashKey": "object:575",
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": true
+        },
+        {
+          "$$hashKey": "object:576",
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": true
+        }
+      ],
+      "yaxis": {
+        "align": false,
+        "alignLevel": null
+      }
+    },
+    {
+      "cacheTimeout": null,
+      "datasource": "${DS_PROMXY}",
+      "fieldConfig": {
+        "defaults": {
+          "custom": {},
+          "mappings": [],
+          "noValue": "0",
+          "nullValueMode": "connected",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "orange",
+                "value": 1
+              },
+              {
+                "color": "red",
+                "value": 3
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 3,
+        "x": 0,
+        "y": 20
+      },
+      "id": 8,
+      "interval": null,
+      "links": [],
+      "maxDataPoints": 100,
+      "options": {
+        "colorMode": "value",
+        "fieldOptions": {
+          "calcs": ["lastNotNull"]
+        },
+        "graphMode": "none",
+        "justifyMode": "auto",
+        "orientation": "horizontal",
+        "reduceOptions": {
+          "calcs": ["last"],
+          "fields": "",
+          "values": false
+        }
+      },
+      "pluginVersion": "7.0.3",
+      "targets": [
+        {
+          "expr": "avg(${metrics_prefix}_token_create_count - ${metrics_prefix}_token_store_count)",
+          "format": "time_series",
+          "interval": "",
+          "intervalFactor": 1,
+          "legendFormat": "",
+          "refId": "A"
+        }
+      ],
+      "timeFrom": null,
+      "timeShift": null,
+      "title": "Pending Tokens",
+      "type": "stat"
+    },
+    {
+      "aliasColors": {},
+      "bars": true,
+      "dashLength": 10,
+      "dashes": false,
+      "datasource": "${DS_PROMXY}",
+      "decimals": 0,
+      "fieldConfig": {
+        "defaults": {
+          "custom": {}
+        },
+        "overrides": []
+      },
+      "fill": 1,
+      "fillGradient": 0,
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 24
+      },
+      "hiddenSeries": false,
+      "id": 102,
+      "legend": {
+        "alignAsTable": true,
+        "avg": false,
+        "current": true,
+        "max": true,
+        "min": false,
+        "rightSide": true,
+        "show": true,
+        "total": false,
+        "values": true
+      },
+      "lines": false,
+      "linewidth": 1,
+      "nullPointMode": "connected",
+      "options": {
+        "dataLinks": []
+      },
+      "percentage": false,
+      "pointradius": 2,
+      "points": false,
+      "renderer": "flot",
+      "seriesOverrides": [],
+      "spaceLength": 10,
+      "stack": false,
+      "steppedLine": false,
+      "targets": [
+        {
+          "expr": "avg without(instance) (${metrics_prefix}_token_count_by_ttl)",
+          "format": "time_series",
+          "interval": "",
+          "legendFormat": "{{ creation_ttl }}",
+          "refId": "A"
+        }
+      ],
+      "thresholds": [],
+      "timeFrom": null,
+      "timeRegions": [],
+      "timeShift": null,
+      "title": "Tokens by TTL",
+      "tooltip": {
+        "shared": false,
+        "sort": 0,
+        "value_type": "individual"
+      },
+      "type": "graph",
+      "xaxis": {
+        "buckets": null,
+        "mode": "series",
+        "name": null,
+        "show": true,
+        "values": ["current"]
+      },
+      "yaxes": [
+        {
+          "$$hashKey": "object:390",
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": true
+        },
+        {
+          "$$hashKey": "object:391",
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": true
+        }
+      ],
+      "yaxis": {
+        "align": false,
+        "alignLevel": null
+      }
+    },
+    {
+      "aliasColors": {},
+      "bars": true,
+      "dashLength": 10,
+      "dashes": false,
+      "datasource": "${DS_PROMXY}",
+      "decimals": 0,
+      "fieldConfig": {
+        "defaults": {
+          "custom": {}
+        },
+        "overrides": []
+      },
+      "fill": 1,
+      "fillGradient": 0,
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 24
+      },
+      "hiddenSeries": false,
+      "id": 100,
+      "legend": {
+        "alignAsTable": true,
+        "avg": false,
+        "current": true,
+        "max": true,
+        "min": false,
+        "rightSide": true,
+        "show": true,
+        "total": false,
+        "values": true
+      },
+      "lines": false,
+      "linewidth": 1,
+      "nullPointMode": "connected",
+      "options": {
+        "dataLinks": []
+      },
+      "percentage": false,
+      "pointradius": 2,
+      "points": false,
+      "renderer": "flot",
+      "seriesOverrides": [],
+      "spaceLength": 10,
+      "stack": false,
+      "steppedLine": false,
+      "targets": [
+        {
+          "expr": "avg without(instance) (${metrics_prefix}_token_count_by_auth)",
+          "interval": "",
+          "legendFormat": "{{ auth_method }}",
+          "refId": "A"
+        }
+      ],
+      "thresholds": [],
+      "timeFrom": null,
+      "timeRegions": [],
+      "timeShift": null,
+      "title": "Tokens by Auth Method",
+      "tooltip": {
+        "shared": false,
+        "sort": 0,
+        "value_type": "individual"
+      },
+      "type": "graph",
+      "xaxis": {
+        "buckets": null,
+        "mode": "series",
+        "name": null,
+        "show": true,
+        "values": ["current"]
+      },
+      "yaxes": [
+        {
+          "$$hashKey": "object:136",
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": true
+        },
+        {
+          "$$hashKey": "object:137",
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": true
+        }
+      ],
+      "yaxis": {
+        "align": false,
+        "alignLevel": null
+      }
+    },
+    {
+      "aliasColors": {},
+      "bars": true,
+      "dashLength": 10,
+      "dashes": false,
+      "datasource": "${DS_PROMXY}",
+      "decimals": 0,
+      "fieldConfig": {
+        "defaults": {
+          "custom": {
+            "align": null
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "fill": 1,
+      "fillGradient": 0,
+      "gridPos": {
+        "h": 6,
+        "w": 12,
+        "x": 0,
+        "y": 32
+      },
+      "hiddenSeries": false,
+      "id": 65,
+      "legend": {
+        "alignAsTable": false,
+        "avg": false,
+        "current": false,
+        "max": false,
+        "min": false,
+        "rightSide": false,
+        "show": true,
+        "total": false,
+        "values": false
+      },
+      "lines": false,
+      "linewidth": 1,
+      "maxDataPoints": 100,
+      "nullPointMode": "null as zero",
+      "options": {
+        "dataLinks": []
+      },
+      "percentage": false,
+      "pluginVersion": "7.0.3",
+      "pointradius": 2,
+      "points": false,
+      "renderer": "flot",
+      "seriesOverrides": [],
+      "spaceLength": 10,
+      "stack": true,
+      "steppedLine": false,
+      "targets": [
+        {
+          "expr": "avg by(auth_method, creation_ttl) (${metrics_prefix}_token_creation)",
+          "format": "time_series",
+          "instant": false,
+          "interval": "",
+          "intervalFactor": 1,
+          "legendFormat": "{{ auth_method }} - {{ creation_ttl }}",
+          "refId": "A"
+        }
+      ],
+      "thresholds": [],
+      "timeFrom": null,
+      "timeRegions": [],
+      "timeShift": null,
+      "title": "Tokens Creation by Method & TTL",
+      "tooltip": {
+        "shared": true,
+        "sort": 0,
+        "value_type": "individual"
+      },
+      "type": "graph",
+      "xaxis": {
+        "buckets": null,
+        "mode": "time",
+        "name": null,
+        "show": true,
+        "values": []
+      },
+      "yaxes": [
+        {
+          "$$hashKey": "object:1956",
+          "format": "short",
+          "label": "",
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": true
+        },
+        {
+          "$$hashKey": "object:1957",
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": false
+        }
+      ],
+      "yaxis": {
+        "align": false,
+        "alignLevel": null
+      }
+    },
+    {
+      "aliasColors": {
+        "Create": "rgb(84, 183, 90)",
+        "Store": "#0a437c"
+      },
+      "bars": true,
+      "dashLength": 10,
+      "dashes": false,
+      "datasource": "${DS_PROMXY}",
+      "decimals": 0,
+      "fieldConfig": {
+        "defaults": {
+          "custom": {}
+        },
+        "overrides": []
+      },
+      "fill": 1,
+      "fillGradient": 0,
+      "gridPos": {
+        "h": 6,
+        "w": 12,
+        "x": 12,
+        "y": 32
+      },
+      "hiddenSeries": false,
+      "id": 6,
+      "legend": {
+        "avg": false,
+        "current": false,
+        "max": false,
+        "min": false,
+        "show": true,
+        "total": false,
+        "values": false
+      },
+      "lines": false,
+      "linewidth": 1,
+      "links": [],
+      "nullPointMode": "null",
+      "options": {
+        "dataLinks": []
+      },
+      "percentage": false,
+      "pointradius": 5,
+      "points": false,
+      "renderer": "flot",
+      "seriesOverrides": [],
+      "spaceLength": 10,
+      "stack": true,
+      "steppedLine": false,
+      "targets": [
+        {
+          "expr": "avg without(instance) (${metrics_prefix}_token_create_count)",
+          "format": "time_series",
+          "instant": false,
+          "interval": "",
+          "intervalFactor": 10,
+          "legendFormat": "Create",
+          "refId": "A"
+        },
+        {
+          "expr": "avg without(instance) (${metrics_prefix}_token_store_count)",
+          "format": "time_series",
+          "hide": false,
+          "instant": false,
+          "interval": "",
+          "intervalFactor": 10,
+          "legendFormat": "Store",
+          "refId": "B"
+        }
+      ],
+      "thresholds": [],
+      "timeFrom": null,
+      "timeRegions": [],
+      "timeShift": null,
+      "title": "Token Creation/Storage",
+      "tooltip": {
+        "shared": true,
+        "sort": 0,
+        "value_type": "individual"
+      },
+      "type": "graph",
+      "xaxis": {
+        "buckets": null,
+        "mode": "time",
+        "name": null,
+        "show": true,
+        "values": []
+      },
+      "yaxes": [
+        {
+          "$$hashKey": "object:877",
+          "decimals": 0,
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": true
+        },
+        {
+          "$$hashKey": "object:878",
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": false
+        }
+      ],
+      "yaxis": {
+        "align": false,
+        "alignLevel": null
+      }
+    },
+    {
+      "aliasColors": {
+        "Lookup": "#0a50a1"
+      },
+      "bars": false,
+      "dashLength": 10,
+      "dashes": false,
+      "datasource": "${DS_PROMXY}",
+      "decimals": 3,
+      "fieldConfig": {
+        "defaults": {
+          "custom": {}
+        },
+        "overrides": []
+      },
+      "fill": 1,
+      "fillGradient": 0,
+      "gridPos": {
+        "h": 6,
+        "w": 24,
+        "x": 0,
+        "y": 38
+      },
+      "hiddenSeries": false,
+      "id": 14,
+      "legend": {
+        "alignAsTable": true,
+        "avg": true,
+        "current": true,
+        "hideEmpty": false,
+        "hideZero": false,
+        "max": true,
+        "min": true,
+        "show": true,
+        "total": false,
+        "values": true
+      },
+      "lines": true,
+      "linewidth": 1,
+      "links": [],
+      "nullPointMode": "null",
+      "options": {
+        "dataLinks": []
+      },
+      "percentage": false,
+      "pointradius": 5,
+      "points": false,
+      "renderer": "flot",
+      "seriesOverrides": [],
+      "spaceLength": 10,
+      "stack": false,
+      "steppedLine": false,
+      "targets": [
+        {
+          "expr": "avg(irate(${metrics_prefix}_token_lookup_count[1m]))",
+          "hide": false,
+          "interval": "",
+          "legendFormat": "Lookups",
+          "refId": "B"
+        }
+      ],
+      "thresholds": [],
+      "timeFrom": null,
+      "timeRegions": [],
+      "timeShift": null,
+      "title": "Token Lookups",
+      "tooltip": {
+        "shared": true,
+        "sort": 0,
+        "value_type": "individual"
+      },
+      "type": "graph",
+      "xaxis": {
+        "buckets": null,
+        "mode": "time",
+        "name": null,
+        "show": true,
+        "values": []
+      },
+      "yaxes": [
+        {
+          "$$hashKey": "object:330",
+          "decimals": 0,
+          "format": "short",
+          "label": "Lookups per second",
+          "logBase": 1,
+          "max": null,
+          "min": "0",
+          "show": true
+        },
+        {
+          "$$hashKey": "object:331",
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": false
+        }
+      ],
+      "yaxis": {
+        "align": false,
+        "alignLevel": null
+      }
+    },
+    {
+      "collapsed": false,
+      "datasource": "${DS_PROMXY}",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 44
+      },
+      "id": 20,
+      "panels": [],
+      "title": "Audit",
+      "type": "row"
+    },
+    {
+      "datasource": "${DS_PROMXY}",
+      "description": "",
+      "fieldConfig": {
+        "defaults": {
+          "custom": {},
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 1
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 3,
+        "x": 0,
+        "y": 45
+      },
+      "id": 97,
+      "maxDataPoints": 100,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": ["max"],
+          "fields": "",
+          "values": false
+        }
+      },
+      "pluginVersion": "7.0.3",
+      "targets": [
+        {
+          "expr": "max(idelta(${metrics_prefix}_audit_log_request_failure[1m]))",
+          "format": "time_series",
+          "interval": "",
+          "legendFormat": "Request",
+          "refId": "A"
+        }
+      ],
+      "timeFrom": null,
+      "timeShift": null,
+      "title": "Log Request Failures",
+      "type": "stat"
+    },
+    {
+      "aliasColors": {},
+      "bars": false,
+      "dashLength": 10,
+      "dashes": false,
+      "datasource": "${DS_PROMXY}",
+      "decimals": 3,
+      "fieldConfig": {
+        "defaults": {
+          "custom": {}
+        },
+        "overrides": []
+      },
+      "fill": 1,
+      "fillGradient": 0,
+      "gridPos": {
+        "h": 10,
+        "w": 11,
+        "x": 3,
+        "y": 45
+      },
+      "hiddenSeries": false,
+      "id": 4,
+      "legend": {
+        "alignAsTable": true,
+        "avg": true,
+        "current": true,
+        "hideEmpty": false,
+        "hideZero": false,
+        "max": true,
+        "min": true,
+        "rightSide": false,
+        "show": true,
+        "total": false,
+        "values": true
+      },
+      "lines": true,
+      "linewidth": 1,
+      "links": [],
+      "nullPointMode": "null",
+      "options": {
+        "dataLinks": []
+      },
+      "percentage": false,
+      "pointradius": 5,
+      "points": false,
+      "renderer": "flot",
+      "seriesOverrides": [],
+      "spaceLength": 10,
+      "stack": false,
+      "steppedLine": false,
+      "targets": [
+        {
+          "expr": "avg(irate(${metrics_prefix}_audit_log_request_count[1m]))",
+          "format": "time_series",
+          "instant": false,
+          "interval": "",
+          "intervalFactor": 1,
+          "legendFormat": "Request ",
+          "refId": "A"
+        },
+        {
+          "expr": "avg(irate(${metrics_prefix}_audit_log_response_count[1m]))",
+          "format": "time_series",
+          "hide": false,
+          "instant": false,
+          "interval": "",
+          "intervalFactor": 1,
+          "legendFormat": "Response",
+          "refId": "B"
+        },
+        {
+          "expr": "avg(irate(${metrics_prefix}_core_handle_request_count[1m]))",
+          "format": "time_series",
+          "hide": false,
+          "interval": "",
+          "intervalFactor": 1,
+          "legendFormat": "Handled",
+          "refId": "C"
+        }
+      ],
+      "thresholds": [],
+      "timeFrom": null,
+      "timeRegions": [],
+      "timeShift": null,
+      "title": "Log Requests",
+      "tooltip": {
+        "shared": true,
+        "sort": 0,
+        "value_type": "individual"
+      },
+      "type": "graph",
+      "xaxis": {
+        "buckets": null,
+        "mode": "time",
+        "name": null,
+        "show": true,
+        "values": []
+      },
+      "yaxes": [
+        {
+          "$$hashKey": "object:109",
+          "decimals": 0,
+          "format": "short",
+          "label": "Requests per second",
+          "logBase": 1,
+          "max": null,
+          "min": "0",
+          "show": true
+        },
+        {
+          "$$hashKey": "object:110",
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": false
+        }
+      ],
+      "yaxis": {
+        "align": false,
+        "alignLevel": null
+      }
+    },
+    {
+      "aliasColors": {},
+      "bars": false,
+      "dashLength": 10,
+      "dashes": false,
+      "datasource": "${DS_PROMXY}",
+      "fieldConfig": {
+        "defaults": {
+          "custom": {}
+        },
+        "overrides": []
+      },
+      "fill": 1,
+      "fillGradient": 0,
+      "gridPos": {
+        "h": 10,
+        "w": 10,
+        "x": 14,
+        "y": 45
+      },
+      "hiddenSeries": false,
+      "id": 61,
+      "legend": {
+        "alignAsTable": true,
+        "avg": true,
+        "current": true,
+        "max": true,
+        "min": true,
+        "show": true,
+        "total": false,
+        "values": true
+      },
+      "lines": true,
+      "linewidth": 1,
+      "nullPointMode": "null as zero",
+      "options": {
+        "dataLinks": []
+      },
+      "percentage": false,
+      "pointradius": 2,
+      "points": false,
+      "renderer": "flot",
+      "seriesOverrides": [],
+      "spaceLength": 10,
+      "stack": false,
+      "steppedLine": false,
+      "targets": [
+        {
+          "expr": "avg(irate(${metrics_prefix}_consul_get_count[1m]))",
+          "interval": "",
+          "intervalFactor": 1,
+          "legendFormat": "GET",
+          "refId": "A"
+        },
+        {
+          "expr": "avg(irate(${metrics_prefix}_consul_put_count[1m]))",
+          "interval": "",
+          "legendFormat": "PUT",
+          "refId": "B"
+        },
+        {
+          "expr": "avg(irate(${metrics_prefix}_consul_delete_count[1m]))",
+          "interval": "",
+          "legendFormat": "DELETE",
+          "refId": "C"
+        },
+        {
+          "expr": "irate(${metrics_prefix}_consul_list_count{instance=\"$node:$port\"}[1m])",
+          "interval": "",
+          "legendFormat": "LIST",
+          "refId": "D"
+        }
+      ],
+      "thresholds": [],
+      "timeFrom": null,
+      "timeRegions": [],
+      "timeShift": null,
+      "title": "Consul Requests",
+      "tooltip": {
+        "shared": true,
+        "sort": 0,
+        "value_type": "individual"
+      },
+      "type": "graph",
+      "xaxis": {
+        "buckets": null,
+        "mode": "time",
+        "name": null,
+        "show": true,
+        "values": []
+      },
+      "yaxes": [
+        {
+          "$$hashKey": "object:949",
+          "format": "short",
+          "label": "Requests per second",
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": true
+        },
+        {
+          "$$hashKey": "object:950",
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": false
+        }
+      ],
+      "yaxis": {
+        "align": false,
+        "alignLevel": null
+      }
+    },
+    {
+      "datasource": "${DS_PROMXY}",
+      "description": "",
+      "fieldConfig": {
+        "defaults": {
+          "custom": {},
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 1
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 3,
+        "x": 0,
+        "y": 50
+      },
+      "id": 98,
+      "maxDataPoints": 100,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": ["max"],
+          "fields": "",
+          "values": false
+        }
+      },
+      "pluginVersion": "7.0.3",
+      "targets": [
+        {
+          "expr": "max(idelta(${metrics_prefix}_audit_log_response_failure[1m]))",
+          "format": "time_series",
+          "interval": "",
+          "legendFormat": "Request",
+          "refId": "A"
+        }
+      ],
+      "timeFrom": null,
+      "timeShift": null,
+      "title": "Log Response Failures",
+      "type": "stat"
+    },
+    {
+      "collapsed": false,
+      "datasource": "${DS_PROMXY}",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 55
+      },
+      "id": 18,
+      "panels": [],
+      "title": "Policy",
+      "type": "row"
+    },
+    {
+      "aliasColors": {
+        "set": "#629e51"
+      },
+      "bars": false,
+      "dashLength": 10,
+      "dashes": false,
+      "datasource": "${DS_PROMXY}",
+      "fieldConfig": {
+        "defaults": {
+          "custom": {}
+        },
+        "overrides": []
+      },
+      "fill": 1,
+      "fillGradient": 0,
+      "gridPos": {
+        "h": 6,
+        "w": 12,
+        "x": 0,
+        "y": 56
+      },
+      "hiddenSeries": false,
+      "id": 10,
+      "legend": {
+        "alignAsTable": false,
+        "avg": false,
+        "current": false,
+        "max": false,
+        "min": false,
+        "show": true,
+        "total": false,
+        "values": false
+      },
+      "lines": true,
+      "linewidth": 1,
+      "links": [],
+      "nullPointMode": "null",
+      "options": {
+        "dataLinks": []
+      },
+      "percentage": false,
+      "pointradius": 5,
+      "points": false,
+      "renderer": "flot",
+      "seriesOverrides": [],
+      "spaceLength": 10,
+      "stack": false,
+      "steppedLine": false,
+      "targets": [
+        {
+          "expr": "avg(irate(${metrics_prefix}_policy_set_policy_count[1m]))",
+          "format": "time_series",
+          "interval": "",
+          "intervalFactor": 1,
+          "legendFormat": "SET",
+          "refId": "A"
+        }
+      ],
+      "thresholds": [],
+      "timeFrom": null,
+      "timeRegions": [],
+      "timeShift": null,
+      "title": "Policy Set",
+      "tooltip": {
+        "shared": true,
+        "sort": 0,
+        "value_type": "individual"
+      },
+      "type": "graph",
+      "xaxis": {
+        "buckets": null,
+        "mode": "time",
+        "name": null,
+        "show": true,
+        "values": []
+      },
+      "yaxes": [
+        {
+          "$$hashKey": "object:1834",
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": "0",
+          "show": true
+        },
+        {
+          "$$hashKey": "object:1835",
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": true
+        }
+      ],
+      "yaxis": {
+        "align": false,
+        "alignLevel": null
+      }
+    },
+    {
+      "aliasColors": {
+        "GET": "#1f78c1"
+      },
+      "bars": false,
+      "dashLength": 10,
+      "dashes": false,
+      "datasource": "${DS_PROMXY}",
+      "fieldConfig": {
+        "defaults": {
+          "custom": {}
+        },
+        "overrides": []
+      },
+      "fill": 1,
+      "fillGradient": 0,
+      "gridPos": {
+        "h": 6,
+        "w": 12,
+        "x": 12,
+        "y": 56
+      },
+      "hiddenSeries": false,
+      "id": 12,
+      "legend": {
+        "avg": false,
+        "current": false,
+        "max": false,
+        "min": false,
+        "show": true,
+        "total": false,
+        "values": false
+      },
+      "lines": true,
+      "linewidth": 1,
+      "links": [],
+      "nullPointMode": "null",
+      "options": {
+        "dataLinks": []
+      },
+      "percentage": false,
+      "pointradius": 5,
+      "points": false,
+      "renderer": "flot",
+      "seriesOverrides": [],
+      "spaceLength": 10,
+      "stack": false,
+      "steppedLine": false,
+      "targets": [
+        {
+          "expr": "avg(irate(${metrics_prefix}_policy_get_policy_count[1m]))",
+          "format": "time_series",
+          "interval": "",
+          "intervalFactor": 1,
+          "legendFormat": "GET",
+          "refId": "A"
+        }
+      ],
+      "thresholds": [],
+      "timeFrom": null,
+      "timeRegions": [],
+      "timeShift": null,
+      "title": "Policy Get",
+      "tooltip": {
+        "shared": true,
+        "sort": 0,
+        "value_type": "individual"
+      },
+      "type": "graph",
+      "xaxis": {
+        "buckets": null,
+        "mode": "time",
+        "name": null,
+        "show": true,
+        "values": []
+      },
+      "yaxes": [
+        {
+          "$$hashKey": "object:2132",
+          "decimals": 0,
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": "0",
+          "show": true
+        },
+        {
+          "$$hashKey": "object:2133",
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": true
+        }
+      ],
+      "yaxis": {
+        "align": false,
+        "alignLevel": null
+      }
+    }
+  ],
+  "refresh": false,
+  "schemaVersion": 25,
+  "style": "dark",
+  "tags": ["openbao"],
+  "templating": {
+    "list": [
+      {
+        "current": {},
+        "hide": 0,
+        "includeAll": false,
+        "multi": false,
+        "name": "DS_PROMXY",
+        "label": "datasource",
+        "options": [],
+        "query": "prometheus",
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "type": "datasource"
+      },
+      {
+        "allValue": null,
+        "current": {},
+        "datasource": "${DS_PROMXY}",
+        "definition": "label_values(up{job=\"openbao-internal\"}, instance)",
+        "hide": 2,
+        "includeAll": false,
+        "label": "Host:",
+        "multi": false,
+        "name": "node",
+        "options": [],
+        "query": "label_values(up{job=\"openbao-internal\"}, instance)",
+        "refresh": 1,
+        "regex": "/([^:]+):.*/",
+        "skipUrlSync": false,
+        "sort": 1,
+        "tagValuesQuery": "",
+        "tags": [],
+        "tagsQuery": "",
+        "type": "query",
+        "useTags": false
+      },
+      {
+        "allValue": null,
+        "current": {},
+        "datasource": "${DS_PROMXY}",
+        "definition": "label_values(up{job=\"openbao-internal\",instance=~\"$node:(.*)\"}, instance)",
+        "hide": 2,
+        "includeAll": false,
+        "label": null,
+        "multi": false,
+        "name": "port",
+        "options": [],
+        "query": "label_values(up{job=\"openbao-internal\",instance=~\"$node:(.*)\"}, instance)",
+        "refresh": 1,
+        "regex": "/[^:]+:(.*)/",
+        "skipUrlSync": false,
+        "sort": 0,
+        "tagValuesQuery": "",
+        "tags": [],
+        "tagsQuery": "",
+        "type": "query",
+        "useTags": false
+      },
+      {
+        "allValue": "",
+        "current": {},
+        "datasource": "${DS_PROMXY}",
+        "definition": "label_values(${metrics_prefix}_secret_kv_count, mount_point)",
+        "hide": 0,
+        "includeAll": true,
+        "label": "Mount Point:",
+        "multi": true,
+        "name": "mountpoint",
+        "options": [],
+        "query": "label_values(${metrics_prefix}_secret_kv_count, mount_point)",
+        "refresh": 2,
+        "regex": "/(.*)//",
+        "skipUrlSync": false,
+        "sort": 1,
+        "tagValuesQuery": "",
+        "tags": [],
+        "tagsQuery": "",
+        "type": "query",
+        "useTags": false
+      },
+      {
+        "allValue": "",
+        "datasource": "${DS_PROMXY}",
+        "hide": 0,
+        "includeAll": true,
+        "label": "Metrics Prefix",
+        "current": {
+          "text": "vault",
+          "value": "vault"
+        },
+        "description": "Metrics Prefix defined in the OpenBao configuration with `metrics_prefix`",
+        "name": "metrics_prefix",
+        "refresh": 2,
+        "options": [
+          {
+            "selected": true,
+            "text": "vault",
+            "value": "vault"
+          }
+        ],
+        "query": "vault",
+        "type": "textbox"
+      }
+    ]
+  },
+  "time": {
+    "from": "now-30m",
+    "to": "now"
+  },
+  "timepicker": {
+    "refresh_intervals": [
+      "10s",
+      "30s",
+      "1m",
+      "5m",
+      "15m",
+      "30m",
+      "1h",
+      "2h",
+      "1d"
+    ],
+    "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
+  },
+  "timezone": "",
+  "title": "OpenBao",
+  "uid": "openbao",
+  "version": 1
+}
diff --git a/packages/system/openbao/charts/openbao/templates/NOTES.txt b/packages/system/openbao/charts/openbao/templates/NOTES.txt
new file mode 100644
index 00000000..fce87c26
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/NOTES.txt
@@ -0,0 +1,18 @@
+
+Thank you for installing OpenBao!
+
+Now that you have deployed OpenBao, you should look over the docs on using
+OpenBao with Kubernetes available here:
+
+https://openbao.org/docs/
+
+
+Your release is named {{ .Release.Name }}. To learn more about the release, try:
+
+  $ helm status {{ .Release.Name }}
+  $ helm get manifest {{ .Release.Name }}
+
+{{ if and (not .Values.global.tlsDisable) .Values.server.gateway.httpRoute.enabled }}
+WARNING: Terminating TLS before reaching the OpenBao Server is not recommended
+and may break things like certificate authentication. Prefer usage of `TLSRoute`.
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/_helpers.tpl b/packages/system/openbao/charts/openbao/templates/_helpers.tpl
new file mode 100644
index 00000000..3597697b
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/_helpers.tpl
@@ -0,0 +1,1212 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to
+this (by the DNS naming spec). If release name contains chart name it will
+be used as a full name.
+*/}}
+{{- define "openbao.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "openbao.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "openbao.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Allow the release namespace to be overridden
+*/}}
+{{- define "openbao.namespace" -}}
+{{- default .Release.Namespace .Values.global.namespace -}}
+{{- end -}}
+
+{{/*
+Compute if the csi driver is enabled.
+*/}}
+{{- define "openbao.csiEnabled" -}}
+{{- $_ := set . "csiEnabled" (or
+  (eq (.Values.csi.enabled | toString) "true")
+  (and (eq (.Values.csi.enabled | toString) "-") (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute if the injector is enabled.
+*/}}
+{{- define "openbao.injectorEnabled" -}}
+{{- $_ := set . "injectorEnabled" (or
+  (eq (.Values.injector.enabled | toString) "true")
+  (and (eq (.Values.injector.enabled | toString) "-") (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute if the server is enabled.
+*/}}
+{{- define "openbao.serverEnabled" -}}
+{{- $_ := set . "serverEnabled" (or
+  (eq (.Values.server.enabled | toString) "true")
+  (and (eq (.Values.server.enabled | toString) "-") (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute if the server serviceaccount is enabled.
+*/}}
+{{- define "openbao.serverServiceAccountEnabled" -}}
+{{- $_ := set . "serverServiceAccountEnabled"
+  (and
+    (eq (.Values.server.serviceAccount.create | toString) "true" )
+    (or
+      (eq (.Values.server.enabled | toString) "true")
+      (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute if the server serviceaccount should have a token created and mounted to the serviceaccount.
+*/}}
+{{- define "openbao.serverServiceAccountSecretCreationEnabled" -}}
+{{- $_ := set . "serverServiceAccountSecretCreationEnabled"
+  (and
+    (eq (.Values.server.serviceAccount.create | toString) "true")
+    (eq (.Values.server.serviceAccount.createSecret | toString) "true")) -}}
+{{- end -}}
+
+
+{{/*
+Compute if the server auth delegator serviceaccount is enabled.
+*/}}
+{{- define "openbao.serverAuthDelegator" -}}
+{{- $_ := set . "serverAuthDelegator"
+  (and
+    (eq (.Values.server.authDelegator.enabled | toString) "true" )
+    (or (eq (.Values.server.serviceAccount.create | toString) "true")
+        (not (eq .Values.server.serviceAccount.name "")))
+    (or
+      (eq (.Values.server.enabled | toString) "true")
+      (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute if the server service is enabled.
+*/}}
+{{- define "openbao.serverServiceEnabled" -}}
+{{- template "openbao.serverEnabled" . -}}
+{{- $_ := set . "serverServiceEnabled" (and .serverEnabled (eq (.Values.server.service.enabled | toString) "true")) -}}
+{{- end -}}
+
+{{/*
+Compute if the ui is enabled.
+*/}}
+{{- define "openbao.uiEnabled" -}}
+{{- $_ := set . "uiEnabled" (or
+  (eq (.Values.ui.enabled | toString) "true")
+  (and (eq (.Values.ui.enabled | toString) "-") (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute the maximum number of unavailable replicas for the PodDisruptionBudget.
+This defaults to (n/2)-1 where n is the number of members of the server cluster.
+Add a special case for replicas=1, where it should default to 0 as well.
+*/}}
+{{- define "openbao.pdb.maxUnavailable" -}}
+{{- if eq (int .Values.server.ha.replicas) 1 -}}
+{{ 0 }}
+{{- else if .Values.server.ha.disruptionBudget.maxUnavailable -}}
+{{ .Values.server.ha.disruptionBudget.maxUnavailable -}}
+{{- else -}}
+{{- div (sub (div (mul (int .Values.server.ha.replicas) 10) 2) 1) 10 -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Resolve the external OpenBao/Vault address by checking global and injector values in order of precedence:
+1. global.externalBaoAddr
+2. global.externalVaultAddr 
+*/}}
+
+{{- define "openbao.externalAddr" -}}
+  {{- if .Values.global.externalBaoAddr -}}
+    {{- .Values.global.externalBaoAddr -}}
+  {{- else -}}
+    {{- .Values.global.externalVaultAddr -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Set the variable 'mode' to the server mode requested by the user to simplify
+template logic.
+*/}}
+{{- define "openbao.mode" -}}
+  {{- template "openbao.serverEnabled" . -}}
+  {{- if or (.Values.injector.externalVaultAddr) (.Values.global.externalVaultAddr) (.Values.global.externalBaoAddr) -}}
+    {{- $_ := set . "mode" "external" -}}
+  {{- else if not .serverEnabled -}}
+    {{- $_ := set . "mode" "external" -}}
+  {{- else if eq (.Values.server.dev.enabled | toString) "true" -}}
+    {{- $_ := set . "mode" "dev" -}}
+  {{- else if eq (.Values.server.ha.enabled | toString) "true" -}}
+    {{- $_ := set . "mode" "ha" -}}
+  {{- else if or (eq (.Values.server.standalone.enabled | toString) "true") (eq (.Values.server.standalone.enabled | toString) "-") -}}
+    {{- $_ := set . "mode" "standalone" -}}
+  {{- else -}}
+    {{- $_ := set . "mode" "" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Set's the replica count based on the different modes configured by user
+*/}}
+{{- define "openbao.replicas" -}}
+  {{ if eq .mode "standalone" }}
+    {{- default 1 -}}
+  {{ else if eq .mode "ha" }}
+    {{- if or (kindIs "int64" .Values.server.ha.replicas) (kindIs "float64" .Values.server.ha.replicas) -}}
+      {{- .Values.server.ha.replicas -}}
+    {{ else }}
+      {{- 3 -}}
+    {{- end -}}
+  {{ else }}
+    {{- default 1 -}}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Set's up configmap mounts if this isn't a dev deployment and the user
+defined a custom configuration.  Additionally iterates over any
+extra volumes the user may have specified (such as a secret with TLS).
+*/}}
+{{- define "openbao.volumes" -}}
+  {{- if and (ne .mode "dev") (or (.Values.server.standalone.config) (.Values.server.ha.config)) }}
+        - name: config
+          configMap:
+            name: {{ template "openbao.fullname" . }}-config
+  {{ end }}
+  {{- range .Values.server.extraVolumes }}
+        - name: userconfig-{{ .name }}
+          {{ .type }}:
+          {{- if (eq .type "configMap") }}
+            name: {{ .name }}
+          {{- else if (eq .type "secret") }}
+            secretName: {{ .name }}
+          {{- end }}
+            defaultMode: {{ .defaultMode | default 420 }}
+  {{- end }}
+  {{- if .Values.server.volumes }}
+    {{- toYaml .Values.server.volumes | nindent 8}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Set's the args for custom command to render the OpenBao configuration
+file with IP addresses to make the out of box experience easier
+for users looking to use this chart with Consul Helm.
+*/}}
+{{- define "openbao.args" -}}
+  {{ if or (eq .mode "standalone") (eq .mode "ha") }}
+          - |
+            cp /openbao/config/extraconfig-from-values.hcl /tmp/storageconfig.hcl;
+            [ -n "${HOST_IP}" ] && sed -Ei "s|HOST_IP|${HOST_IP?}|g" /tmp/storageconfig.hcl;
+            [ -n "${POD_IP}" ] && sed -Ei "s|POD_IP|${POD_IP?}|g" /tmp/storageconfig.hcl;
+            [ -n "${HOSTNAME}" ] && sed -Ei "s|HOSTNAME|${HOSTNAME?}|g" /tmp/storageconfig.hcl;
+            [ -n "${API_ADDR}" ] && sed -Ei "s|API_ADDR|${API_ADDR?}|g" /tmp/storageconfig.hcl;
+            [ -n "${TRANSIT_ADDR}" ] && sed -Ei "s|TRANSIT_ADDR|${TRANSIT_ADDR?}|g" /tmp/storageconfig.hcl;
+            [ -n "${RAFT_ADDR}" ] && sed -Ei "s|RAFT_ADDR|${RAFT_ADDR?}|g" /tmp/storageconfig.hcl;
+            /usr/local/bin/docker-entrypoint.sh bao server -config=/tmp/storageconfig.hcl {{ .Values.server.extraArgs }}
+   {{ else if eq .mode "dev" }}
+          - |
+            /usr/local/bin/docker-entrypoint.sh bao server -dev {{ .Values.server.extraArgs }}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Set's additional environment variables based on the mode.
+*/}}
+{{- define "openbao.envs" -}}
+  {{ if eq .mode "dev" }}
+            - name: VAULT_DEV_ROOT_TOKEN_ID
+              value: {{ .Values.server.dev.devRootToken }}
+            - name: VAULT_DEV_LISTEN_ADDRESS
+              value: "[::]:8200"
+  {{ end }}
+{{- end -}}
+
+{{/*
+Set's which additional volumes should be mounted to the container
+based on the mode configured.
+*/}}
+{{- define "openbao.mounts" -}}
+  {{ if eq (.Values.server.auditStorage.enabled | toString) "true" }}
+            - name: audit
+              mountPath: {{ .Values.server.auditStorage.mountPath }}
+  {{ end }}
+  {{ if or (eq .mode "standalone") (and (eq .mode "ha") (eq (.Values.server.ha.raft.enabled | toString) "true"))  }}
+    {{ if eq (.Values.server.dataStorage.enabled | toString) "true" }}
+            - name: data
+              mountPath: {{ .Values.server.dataStorage.mountPath }}
+    {{ end }}
+  {{ end }}
+  {{ if and (ne .mode "dev") (or (.Values.server.standalone.config)  (.Values.server.ha.config)) }}
+            - name: config
+              mountPath: /openbao/config
+  {{ end }}
+  {{- range .Values.server.extraVolumes }}
+            - name: userconfig-{{ .name }}
+              readOnly: true
+              mountPath: {{ .path | default "/openbao/userconfig" }}/{{ .name }}
+  {{- end }}
+  {{- if .Values.server.volumeMounts }}
+    {{- toYaml .Values.server.volumeMounts | nindent 12}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Set's up the volumeClaimTemplates when data or audit storage is required.  HA
+might not use data storage since Consul is likely it's backend, however, audit
+storage might be desired by the user.
+*/}}
+{{- define "openbao.volumeclaims" -}}
+  {{- if and (ne .mode "dev") (or .Values.server.dataStorage.enabled .Values.server.auditStorage.enabled) }}
+  volumeClaimTemplates:
+      {{- if and (eq (.Values.server.dataStorage.enabled | toString) "true") (or (eq .mode "standalone") (eq (.Values.server.ha.raft.enabled | toString ) "true" )) }}
+    - apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: data
+        {{- include "openbao.dataVolumeClaim.annotations" . | nindent 6 }}
+        {{- include "openbao.dataVolumeClaim.labels" . | nindent 6 }}
+      spec:
+        accessModes:
+          - {{ .Values.server.dataStorage.accessMode | default "ReadWriteOnce" }}
+        resources:
+          requests:
+            storage: {{ .Values.server.dataStorage.size }}
+          {{- if .Values.server.dataStorage.storageClass }}
+        storageClassName: {{ .Values.server.dataStorage.storageClass }}
+          {{- end }}
+      {{ end }}
+      {{- if eq (.Values.server.auditStorage.enabled | toString) "true" }}
+    - apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: audit
+        {{- include "openbao.auditVolumeClaim.annotations" . | nindent 6 }}
+        {{- include "openbao.auditVolumeClaim.labels" . | nindent 6 }}
+      spec:
+        accessModes:
+          - {{ .Values.server.auditStorage.accessMode | default "ReadWriteOnce" }}
+        resources:
+          requests:
+            storage: {{ .Values.server.auditStorage.size }}
+          {{- if .Values.server.auditStorage.storageClass }}
+        storageClassName: {{ .Values.server.auditStorage.storageClass }}
+          {{- end }}
+      {{ end }}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Set's the affinity for pod placement when running in standalone and HA modes.
+*/}}
+{{- define "openbao.affinity" -}}
+  {{- if and (ne .mode "dev") .Values.server.affinity }}
+      affinity:
+        {{ $tp := typeOf .Values.server.affinity }}
+        {{- if eq $tp "string" }}
+          {{- tpl .Values.server.affinity . | nindent 8 | trim }}
+        {{- else }}
+          {{- toYaml .Values.server.affinity | nindent 8 }}
+        {{- end }}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Sets the injector affinity for pod placement
+*/}}
+{{- define "injector.affinity" -}}
+  {{- if .Values.injector.affinity }}
+      affinity:
+        {{ $tp := typeOf .Values.injector.affinity }}
+        {{- if eq $tp "string" }}
+          {{- tpl .Values.injector.affinity . | nindent 8 | trim }}
+        {{- else }}
+          {{- toYaml .Values.injector.affinity | nindent 8 }}
+        {{- end }}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Sets the topologySpreadConstraints when running in standalone and HA modes.
+*/}}
+{{- define "openbao.topologySpreadConstraints" -}}
+  {{- if and (ne .mode "dev") .Values.server.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{ $tp := typeOf .Values.server.topologySpreadConstraints }}
+        {{- if eq $tp "string" }}
+          {{- tpl .Values.server.topologySpreadConstraints . | nindent 8 | trim }}
+        {{- else }}
+          {{- toYaml .Values.server.topologySpreadConstraints | nindent 8 }}
+        {{- end }}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Sets the injector topologySpreadConstraints for pod placement
+*/}}
+{{- define "injector.topologySpreadConstraints" -}}
+  {{- if .Values.injector.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{ $tp := typeOf .Values.injector.topologySpreadConstraints }}
+        {{- if eq $tp "string" }}
+          {{- tpl .Values.injector.topologySpreadConstraints . | nindent 8 | trim }}
+        {{- else }}
+          {{- toYaml .Values.injector.topologySpreadConstraints | nindent 8 }}
+        {{- end }}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Sets the toleration for pod placement when running in standalone and HA modes.
+*/}}
+{{- define "openbao.tolerations" -}}
+  {{- if and (ne .mode "dev") .Values.server.tolerations }}
+      tolerations:
+      {{- $tp := typeOf .Values.server.tolerations }}
+      {{- if eq $tp "string" }}
+        {{ tpl .Values.server.tolerations . | nindent 8 | trim }}
+      {{- else }}
+        {{- toYaml .Values.server.tolerations | nindent 8 }}
+      {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets the injector toleration for pod placement
+*/}}
+{{- define "injector.tolerations" -}}
+  {{- if .Values.injector.tolerations }}
+      tolerations:
+      {{- $tp := typeOf .Values.injector.tolerations }}
+      {{- if eq $tp "string" }}
+        {{ tpl .Values.injector.tolerations . | nindent 8 | trim }}
+      {{- else }}
+        {{- toYaml .Values.injector.tolerations | nindent 8 }}
+      {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Set's the node selector for pod placement when running in standalone and HA modes.
+*/}}
+{{- define "openbao.nodeselector" -}}
+  {{- if and (ne .mode "dev") .Values.server.nodeSelector }}
+      nodeSelector:
+      {{- $tp := typeOf .Values.server.nodeSelector }}
+      {{- if eq $tp "string" }}
+        {{ tpl .Values.server.nodeSelector . | nindent 8 | trim }}
+      {{- else }}
+        {{- toYaml .Values.server.nodeSelector | nindent 8 }}
+      {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets the injector node selector for pod placement
+*/}}
+{{- define "injector.nodeselector" -}}
+  {{- if .Values.injector.nodeSelector }}
+      nodeSelector:
+      {{- $tp := typeOf .Values.injector.nodeSelector }}
+      {{- if eq $tp "string" }}
+        {{ tpl .Values.injector.nodeSelector . | nindent 8 | trim }}
+      {{- else }}
+        {{- toYaml .Values.injector.nodeSelector | nindent 8 }}
+      {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets the injector deployment update strategy
+*/}}
+{{- define "injector.strategy" -}}
+  {{- if .Values.injector.strategy }}
+  strategy:
+  {{- $tp := typeOf .Values.injector.strategy }}
+  {{- if eq $tp "string" }}
+    {{ tpl .Values.injector.strategy . | nindent 4 | trim }}
+  {{- else }}
+    {{- toYaml .Values.injector.strategy | nindent 4 }}
+  {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Renders service annotations from either a string (templated) or a map with indent 4.
+Usage: {{ include "openbao.annotations.render.4" (list . <annotations>) }}
+*/}}
+{{- define "openbao.annotations.render.4" -}}
+  {{- $ctx := index . 0 -}}
+  {{- $annotations := index . 1 -}}
+  {{- $annotationsType := typeOf $annotations -}}
+  {{- if eq $annotationsType "string" -}}
+    {{- tpl $annotations $ctx | nindent 4 -}}
+  {{- else -}}
+    {{- toYaml $annotations | nindent 4 -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Renders service annotations from either a string (templated) or a map with indent 8.
+Usage: {{ include "openbao.annotations.render.4" (list . <annotations>) }}
+*/}}
+{{- define "openbao.annotations.render.8" -}}
+  {{- $ctx := index . 0 -}}
+  {{- $annotations := index . 1 -}}
+  {{- $annotationsType := typeOf $annotations -}}
+  {{- if eq $annotationsType "string" -}}
+    {{- tpl $annotations $ctx | nindent 8 -}}
+  {{- else -}}
+    {{- toYaml $annotations | nindent 8 -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Sets extra pod annotations
+*/}}
+{{- define "openbao.annotations" }}
+  {{- if or .Values.server.configAnnotation .Values.server.annotations }}
+      annotations:
+  {{- if .Values.server.configAnnotation }}
+        openbao.hashicorp.com/config-checksum: {{ include "openbao.config" . | sha256sum }}
+  {{- end }}
+  {{- $generic := .Values.server.annotations -}}
+  {{- if $generic }}
+    {{- include "openbao.annotations.render.8" (list . $generic) -}}
+  {{- end }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Sets extra injector pod annotations
+*/}}
+{{- define "injector.annotations" -}}
+  {{- $generic := .Values.injector.annotations -}}
+  {{- if $generic }}
+      annotations:
+    {{- include "openbao.annotations.render.8" (list . $generic) -}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra injector service annotations
+*/}}
+{{- define "injector.service.annotations" -}}
+  {{- $generic := .Values.injector.service.annotations -}}
+  {{- if $generic }}
+  annotations:
+    {{- include "openbao.annotations.render.4" (list . $generic) -}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+securityContext for the injector pod level.
+*/}}
+{{- define "injector.securityContext.pod" -}}
+  {{- if .Values.injector.securityContext.pod }}
+      securityContext:
+        {{- $tp := typeOf .Values.injector.securityContext.pod }}
+        {{- if eq $tp "string" }}
+          {{- tpl .Values.injector.securityContext.pod . | nindent 8 }}
+        {{- else }}
+          {{- toYaml .Values.injector.securityContext.pod | nindent 8 }}
+        {{- end }}
+  {{- else if not .Values.global.openshift }}
+      securityContext:
+        runAsNonRoot: true
+        runAsGroup: {{ .Values.injector.gid | default 1000 }}
+        runAsUser: {{ .Values.injector.uid | default 100 }}
+        fsGroup: {{ .Values.injector.gid | default 1000 }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+securityContext for the injector container level.
+*/}}
+{{- define "injector.securityContext.container" -}}
+  {{- if .Values.injector.securityContext.container}}
+          securityContext:
+            {{- $tp := typeOf .Values.injector.securityContext.container }}
+            {{- if eq $tp "string" }}
+              {{- tpl .Values.injector.securityContext.container . | nindent 12 }}
+            {{- else }}
+              {{- toYaml .Values.injector.securityContext.container | nindent 12 }}
+            {{- end }}
+  {{- else if not .Values.global.openshift }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+  {{- end }}
+{{- end -}}
+
+{{/*
+securityContext for the statefulset pod template.
+*/}}
+{{- define "server.statefulSet.securityContext.pod" -}}
+  {{- if .Values.server.statefulSet.securityContext.pod }}
+      securityContext:
+        {{- $tp := typeOf .Values.server.statefulSet.securityContext.pod }}
+        {{- if eq $tp "string" }}
+          {{- tpl .Values.server.statefulSet.securityContext.pod . | nindent 8 }}
+        {{- else }}
+          {{- toYaml .Values.server.statefulSet.securityContext.pod | nindent 8 }}
+        {{- end }}
+  {{- else if not .Values.global.openshift }}
+      securityContext:
+        runAsNonRoot: true
+        runAsGroup: {{ .Values.server.gid | default 1000 }}
+        runAsUser: {{ .Values.server.uid | default 100 }}
+        fsGroup: {{ .Values.server.gid | default 1000 }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+securityContext for the statefulset openbao container
+*/}}
+{{- define "server.statefulSet.securityContext.container" -}}
+  {{- if .Values.server.statefulSet.securityContext.container }}
+          securityContext:
+            {{- $tp := typeOf .Values.server.statefulSet.securityContext.container }}
+            {{- if eq $tp "string" }}
+              {{- tpl .Values.server.statefulSet.securityContext.container . | nindent 12 }}
+            {{- else }}
+              {{- toYaml .Values.server.statefulSet.securityContext.container | nindent 12 }}
+            {{- end }}
+  {{- else if not .Values.global.openshift }}
+          securityContext:
+            allowPrivilegeEscalation: false
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra injector service account annotations
+*/}}
+{{- define "injector.serviceAccount.annotations" -}}
+  {{- $generic := .Values.injector.serviceAccount.annotations -}}
+  {{- if and (ne .mode "dev") $generic }}
+  annotations:
+    {{- include "openbao.annotations.render.4" (list . $generic) -}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra injector webhook annotations
+*/}}
+{{- define "injector.webhookAnnotations" -}}
+  {{- $wa1 := ((.Values.injector.webhook)).annotations -}}
+  {{- $wa2 := .Values.injector.webhookAnnotations -}}
+  {{- if or $wa1 $wa2 }}
+  annotations:
+    {{- if $wa1 }}
+      {{- include "openbao.annotations.render.4" (list . $wa1) -}}
+    {{- end }}
+    {{- if $wa2 }}
+      {{- include "openbao.annotations.render.4" (list . $wa2) -}}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Set's the injector webhook objectSelector
+*/}}
+{{- define "injector.objectSelector" -}}
+  {{- $v := or (((.Values.injector.webhook)).objectSelector) (.Values.injector.objectSelector) -}}
+  {{ if $v }}
+    objectSelector:
+    {{- $tp := typeOf $v -}}
+    {{ if eq $tp "string" }}
+      {{ tpl $v . | indent 6 | trim }}
+    {{ else }}
+      {{ toYaml $v | indent 6 | trim }}
+    {{ end }}
+  {{ end }}
+{{ end }}
+
+{{/*
+Sets extra ui service annotations
+*/}}
+{{- define "openbao.ui.annotations" -}}
+  {{- $generic := .Values.ui.annotations -}}
+  {{- if $generic }}
+  annotations:
+    {{- include "openbao.annotations.render.4" (list . $generic) -}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "openbao.serviceAccount.name" -}}
+{{- if .Values.server.serviceAccount.create -}}
+    {{ default (include "openbao.fullname" .) .Values.server.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.server.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Sets extra service account annotations
+*/}}
+{{- define "openbao.serviceAccount.annotations" -}}
+  {{- $generic := .Values.server.serviceAccount.annotations -}}
+  {{- if and (ne .mode "dev") $generic }}
+  annotations:
+    {{- include "openbao.annotations.render.4" (list . $generic) -}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra ingress annotations
+*/}}
+{{- define "openbao.ingress.annotations" -}}
+  {{- $generic := .Values.server.ingress.annotations -}}
+  {{- if $generic }}
+  annotations:
+    {{- include "openbao.annotations.render.4" (list . $generic) -}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra TLSRoute annotations
+*/}}
+{{- define "openbao.gateway.tlsRoute.annotations" -}}
+  {{- $generic := .Values.server.gateway.tlsRoute.annotations -}}
+  {{- if $generic }}
+  annotations:
+    {{- include "openbao.annotations.render.4" (list . $generic) -}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra HTTPRoute annotations
+*/}}
+{{- define "openbao.gateway.httpRoute.annotations" -}}
+  {{- $generic := .Values.server.gateway.httpRoute.annotations -}}
+  {{- if $generic }}
+  annotations:
+    {{- include "openbao.annotations.render.4" (list . $generic) -}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra BackendTLSPolicy annotations
+*/}}
+{{- define "openbao.gateway.tlsPolicy.annotations" -}}
+  {{- $generic := .Values.server.gateway.tlsPolicy.annotations -}}
+  {{- if $generic }}
+  annotations:
+    {{- include "openbao.annotations.render.4" (list . $generic) -}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra route annotations
+*/}}
+{{- define "openbao.route.annotations" -}}
+  {{- $generic := .Values.server.route.annotations -}}
+  {{- if $generic }}
+  annotations:
+    {{- include "openbao.annotations.render.4" (list . $generic) -}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra openbao server Service annotations
+*/}}
+{{- define "openbao.service.annotations" -}}
+  {{- $generic := .Values.server.service.annotations -}}
+  {{- if $generic }}
+  annotations:
+    {{- include "openbao.annotations.render.4" (list . $generic) -}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra openbao server Service (active) annotations
+*/}}
+{{- define "openbao.service.active.annotations" -}}
+  {{- $active := .Values.server.service.active.annotations -}}
+  {{- $generic := .Values.server.service.annotations -}}
+  {{- if or $active $generic }}
+  annotations:
+    {{- if $active }}
+      {{- include "openbao.annotations.render.4" (list . $active) -}}
+    {{- end }}
+    {{- if $generic }}
+      {{- include "openbao.annotations.render.4" (list . $generic) -}}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra openbao server Service (standby) annotations
+*/}}
+{{- define "openbao.service.standby.annotations" -}}
+  {{- $standby := .Values.server.service.standby.annotations -}}
+  {{- $generic := .Values.server.service.annotations -}}
+  {{- if or $standby $generic }}
+  annotations:
+    {{- if $standby }}
+      {{- include "openbao.annotations.render.4" (list . $standby) -}}
+    {{- end }}
+    {{- if $generic }}
+      {{- include "openbao.annotations.render.4" (list . $generic) -}}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets PodSecurityPolicy annotations
+*/}}
+{{- define "openbao.psp.annotations" -}}
+  {{- $generic := .Values.global.psp.annotations -}}
+  {{- if $generic }}
+  annotations:
+    {{- include "openbao.annotations.render.4" (list . $generic) -}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra statefulset annotations
+*/}}
+{{- define "openbao.statefulSet.annotations" -}}
+  {{- $generic := .Values.server.statefulSet.annotations -}}
+  {{- if $generic }}
+  annotations:
+    {{- include "openbao.annotations.render.4" (list . $generic) -}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets VolumeClaim annotations for data volume
+*/}}
+{{- define "openbao.dataVolumeClaim.annotations" -}}
+  {{- $generic := .Values.server.dataStorage.annotations -}}
+  {{- if and (ne .mode "dev") (.Values.server.dataStorage.enabled) $generic }}
+  annotations:
+    {{- include "openbao.annotations.render.4" (list . $generic) -}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets VolumeClaim labels for data volume
+*/}}
+{{- define "openbao.dataVolumeClaim.labels" -}}
+  {{- if and (ne .mode "dev") (.Values.server.dataStorage.enabled) (.Values.server.dataStorage.labels) }}
+  labels:
+    {{- $tp := typeOf .Values.server.dataStorage.labels }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.server.dataStorage.labels . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.server.dataStorage.labels | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets VolumeClaim annotations for audit volume
+*/}}
+{{- define "openbao.auditVolumeClaim.annotations" -}}
+  {{- $generic := .Values.server.auditStorage.annotations -}}
+  {{- if and (ne .mode "dev") (.Values.server.auditStorage.enabled) $generic }}
+  annotations:
+    {{- include "openbao.annotations.render.4" (list . $generic) -}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets VolumeClaim labels for audit volume
+*/}}
+{{- define "openbao.auditVolumeClaim.labels" -}}
+  {{- if and (ne .mode "dev") (.Values.server.auditStorage.enabled) (.Values.server.auditStorage.labels) }}
+  labels:
+    {{- $tp := typeOf .Values.server.auditStorage.labels }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.server.auditStorage.labels . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.server.auditStorage.labels | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Set's the container resources if the user has set any.
+*/}}
+{{- define "openbao.resources" -}}
+  {{- if .Values.server.resources -}}
+          resources:
+{{ toYaml .Values.server.resources | indent 12}}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Sets the container resources if the user has set any.
+*/}}
+{{- define "injector.resources" -}}
+  {{- if .Values.injector.resources -}}
+          resources:
+{{ toYaml .Values.injector.resources | indent 12}}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Sets the container resources if the user has set any.
+*/}}
+{{- define "csi.resources" -}}
+  {{- if .Values.csi.resources -}}
+          resources:
+{{ toYaml .Values.csi.resources | indent 12}}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Sets the container resources for CSI's Agent sidecar if the user has set any.
+*/}}
+{{- define "csi.agent.resources" -}}
+  {{- if .Values.csi.agent.resources -}}
+          resources:
+{{ toYaml .Values.csi.agent.resources | indent 12}}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Set's the container resources for the SnapshotAgent if the user has set any.
+*/}}
+{{- define "openbao.snapshotAgent.resources" -}}
+  {{- if .Values.snapshotAgent.resources -}}
+          resources:
+{{ toYaml .Values.snapshotAgent.resources | indent 14}}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Sets extra CSI daemonset annotations
+*/}}
+{{- define "csi.daemonSet.annotations" -}}
+  {{- $generic := .Values.csi.daemonSet.annotations -}}
+  {{- if $generic }}
+  annotations:
+    {{- include "openbao.annotations.render.4" (list . $generic) -}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets CSI daemonset securityContext for pod template
+*/}}
+{{- define "csi.daemonSet.securityContext.pod" -}}
+  {{- if .Values.csi.daemonSet.securityContext.pod }}
+      securityContext:
+    {{- $tp := typeOf .Values.csi.daemonSet.securityContext.pod }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.csi.daemonSet.securityContext.pod . | nindent 8 }}
+    {{- else }}
+      {{- toYaml .Values.csi.daemonSet.securityContext.pod | nindent 8 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets CSI daemonset securityContext for container
+*/}}
+{{- define "csi.daemonSet.securityContext.container" -}}
+  {{- if .Values.csi.daemonSet.securityContext.container }}
+          securityContext:
+    {{- $tp := typeOf .Values.csi.daemonSet.securityContext.container }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.csi.daemonSet.securityContext.container . | nindent 12 }}
+    {{- else }}
+      {{- toYaml .Values.csi.daemonSet.securityContext.container | nindent 12 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets the injector toleration for pod placement
+*/}}
+{{- define "csi.pod.tolerations" -}}
+  {{- if .Values.csi.pod.tolerations }}
+      tolerations:
+      {{- $tp := typeOf .Values.csi.pod.tolerations }}
+      {{- if eq $tp "string" }}
+        {{ tpl .Values.csi.pod.tolerations . | nindent 8 | trim }}
+      {{- else }}
+        {{- toYaml .Values.csi.pod.tolerations | nindent 8 }}
+      {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets the CSI provider nodeSelector for pod placement
+*/}}
+{{- define "csi.pod.nodeselector" -}}
+  {{- if .Values.csi.pod.nodeSelector }}
+      nodeSelector:
+      {{- $tp := typeOf .Values.csi.pod.nodeSelector }}
+      {{- if eq $tp "string" }}
+        {{ tpl .Values.csi.pod.nodeSelector . | nindent 8 | trim }}
+      {{- else }}
+        {{- toYaml .Values.csi.pod.nodeSelector | nindent 8 }}
+      {{- end }}
+  {{- end }}
+{{- end -}}
+{{/*
+Sets the CSI provider affinity for pod placement.
+*/}}
+{{- define "csi.pod.affinity" -}}
+  {{- if .Values.csi.pod.affinity }}
+      affinity:
+        {{ $tp := typeOf .Values.csi.pod.affinity }}
+        {{- if eq $tp "string" }}
+          {{- tpl .Values.csi.pod.affinity . | nindent 8 | trim }}
+        {{- else }}
+          {{- toYaml .Values.csi.pod.affinity | nindent 8 }}
+        {{- end }}
+  {{ end }}
+{{- end -}}
+{{/*
+Sets extra CSI provider pod annotations
+*/}}
+{{- define "csi.pod.annotations" -}}
+  {{- $generic := .Values.csi.pod.annotations -}}
+  {{- if $generic }}
+      annotations:
+    {{- include "openbao.annotations.render.8" (list . $generic) -}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra CSI service account annotations
+*/}}
+{{- define "csi.serviceAccount.annotations" -}}
+  {{- $generic := .Values.csi.serviceAccount.annotations -}}
+  {{- if $generic }}
+  annotations:
+    {{- include "openbao.annotations.render.4" (list . $generic) -}}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Inject extra environment vars in the format key:value, if populated
+*/}}
+{{- define "openbao.extraEnvironmentVars" -}}
+{{- if .extraEnvironmentVars -}}
+{{- range $key, $value := .extraEnvironmentVars }}
+- name: {{ printf "%s" $key | replace "." "_" | upper | quote }}
+  value: {{ $value | quote }}
+{{- end }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Inject extra environment populated by secrets, if populated
+*/}}
+{{- define "openbao.extraSecretEnvironmentVars" -}}
+{{- if .extraSecretEnvironmentVars -}}
+{{- range .extraSecretEnvironmentVars }}
+- name: {{ .envName }}
+  valueFrom:
+   secretKeyRef:
+     name: {{ .secretName }}
+     key: {{ .secretKey }}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Scheme for health check and local endpoint */}}
+{{- define "openbao.scheme" -}}
+{{- if .Values.global.tlsDisable -}}
+{{ "http" }}
+{{- else -}}
+{{ "https" }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+imagePullSecrets generates pull secrets from either string or map values.
+A map value must be indexable by the key 'name'.
+*/}}
+{{- define "imagePullSecrets" -}}
+{{- with .Values.global.imagePullSecrets -}}
+imagePullSecrets:
+{{- range . -}}
+{{- if typeIs "string" . }}
+  - name: {{ . }}
+{{- else if index . "name" }}
+  - name: {{ .name }}
+{{- end }}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+externalTrafficPolicy sets a Service's externalTrafficPolicy if applicable.
+Supported inputs are Values.server.service and Values.ui
+*/}}
+{{- define "service.externalTrafficPolicy" -}}
+{{- $type := "" -}}
+{{- if .serviceType -}}
+{{- $type = .serviceType -}}
+{{- else if .type -}}
+{{- $type = .type -}}
+{{- end -}}
+{{- if and .externalTrafficPolicy (or (eq $type "LoadBalancer") (eq $type "NodePort")) }}
+  externalTrafficPolicy: {{ .externalTrafficPolicy }}
+{{- else }}
+{{- end }}
+{{- end -}}
+
+{{/*
+loadBalancer configuration for the the UI service.
+Supported inputs are Values.ui
+*/}}
+{{- define "service.loadBalancer" -}}
+{{- if  eq (.serviceType | toString) "LoadBalancer" }}
+{{- if .loadBalancerIP }}
+  loadBalancerIP: {{ .loadBalancerIP }}
+{{- end }}
+{{- with .loadBalancerSourceRanges }}
+  loadBalancerSourceRanges:
+{{- range . }}
+  - {{ . }}
+{{- end }}
+{{- end -}}
+{{- end }}
+{{- end -}}
+
+{{/*
+config file from values
+*/}}
+{{- define "openbao.config" -}}
+  {{- if or (eq .mode "ha") (eq .mode "standalone") }}
+  {{- $type := typeOf (index .Values.server .mode).config }}
+  {{- if eq $type "string" }}
+  {{- if eq .mode "standalone" }}
+    {{ tpl .Values.server.standalone.config . | nindent 4 | trim }}
+  {{- else if and (eq .mode "ha") (eq (.Values.server.ha.raft.enabled | toString) "false") }}
+    {{ tpl .Values.server.ha.config . | nindent 4 | trim }}
+  {{- else if and (eq .mode "ha") (eq (.Values.server.ha.raft.enabled | toString) "true") }}
+    {{ tpl .Values.server.ha.raft.config . | nindent 4 | trim }}
+  {{ end }}
+  {{- else }}
+  {{- if and (eq .mode "ha") (eq (.Values.server.ha.raft.enabled | toString) "true") }}
+{{ (index .Values.server .mode).raft.config | toPrettyJson | indent 4 }}
+  {{- else }}
+{{ (index .Values.server .mode).config | toPrettyJson | indent 4 }}
+  {{- end }}
+  {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use for the snasphot-agent
+*/}}
+{{- define "openbao.snapshotAgent.serviceAccount.name" -}}
+{{- if .Values.snapshotAgent.serviceAccount.create -}}
+    {{ default (printf "%s-%s" (include "openbao.fullname" .) "snapshot") .Values.snapshotAgent.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.snapshotAgent.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Sets extra service account annotations for the snapshot-agent
+*/}}
+{{- define "openbao.snapshotAgent.serviceAccount.annotations" -}}
+  {{- if and (ne .mode "dev") .Values.snapshotAgent.serviceAccount.annotations }}
+  annotations:
+    {{- $tp := typeOf .Values.snapshotAgent.serviceAccount.annotations }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.snapshotAgent.serviceAccount.annotations . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.snapshotAgent.serviceAccount.annotations | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra snapshotAgent job annotations
+*/}}
+{{- define "openbao.snapshotAgent.annotations" -}}
+  {{- if .Values.snapshotAgent.annotations }}
+  annotations:
+    {{- $tp := typeOf .Values.snapshotAgent.annotations }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.snapshotAgent.annotations . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.snapshotAgent.annotations | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+securityContext for the snapshotAgent pod level.
+*/}}
+{{- define "snapshotAgent.securityContext.pod" -}}
+  {{- if .Values.snapshotAgent.securityContext.pod }}
+          securityContext:
+            {{- $tp := typeOf .Values.snapshotAgent.securityContext.pod }}
+            {{- if eq $tp "string" }}
+              {{- tpl .Values.snapshotAgent.securityContext.pod . | nindent 12 }}
+            {{- else }}
+              {{- toYaml .Values.snapshotAgent.securityContext.pod | nindent 12 }}
+            {{- end }}
+  {{- else if not .Values.global.openshift }}
+          securityContext:
+            runAsNonRoot: true
+            runAsGroup: {{ .Values.snapshotAgent.gid | default 1000 }}
+            runAsUser: {{ .Values.snapshotAgent.uid | default 100 }}
+            fsGroup: {{ .Values.snapshotAgent.gid | default 1000 }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+securityContext for the snapshotAgent container level.
+*/}}
+{{- define "snapshotAgent.securityContext.container" -}}
+  {{- if .Values.snapshotAgent.securityContext.container }}
+            securityContext:
+              {{- $tp := typeOf .Values.snapshotAgent.securityContext.container }}
+              {{- if eq $tp "string" }}
+                {{- tpl .Values.snapshotAgent.securityContext.container . | nindent 14 }}
+              {{- else }}
+                {{- toYaml .Values.snapshotAgent.securityContext.container | nindent 14 }}
+              {{- end }}
+  {{- else if not .Values.global.openshift }}
+            securityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                  - ALL
+  {{- end }}
+{{- end -}}
diff --git a/packages/system/openbao/charts/openbao/templates/csi-agent-configmap.yaml b/packages/system/openbao/charts/openbao/templates/csi-agent-configmap.yaml
new file mode 100644
index 00000000..cf9dded9
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/csi-agent-configmap.yaml
@@ -0,0 +1,34 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.csiEnabled" . -}}
+{{- if and (.csiEnabled) (eq (.Values.csi.agent.enabled | toString) "true") -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "openbao.fullname" . }}-csi-provider-agent-config
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}-csi-provider
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+data:
+  config.hcl: |
+    vault {
+        {{- if include "openbao.externalAddr" . }}
+        "address" = "{{ include "openbao.externalAddr" . }}"
+        {{- else }}
+        "address" = "{{ include "openbao.scheme" . }}://{{ template "openbao.fullname" . }}.{{ include "openbao.namespace" . }}.svc:{{ .Values.server.service.port }}"
+        {{- end }}
+    }
+
+    cache {}
+
+    listener "unix" {
+        address = "/var/run/vault/agent.sock"
+        tls_disable = true
+    }
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/csi-clusterrole.yaml b/packages/system/openbao/charts/openbao/templates/csi-clusterrole.yaml
new file mode 100644
index 00000000..a3fbb612
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/csi-clusterrole.yaml
@@ -0,0 +1,23 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.csiEnabled" . -}}
+{{- if .csiEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "openbao.fullname" . }}-csi-provider-clusterrole
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}-csi-provider
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts/token
+  verbs:
+  - create
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/csi-clusterrolebinding.yaml b/packages/system/openbao/charts/openbao/templates/csi-clusterrolebinding.yaml
new file mode 100644
index 00000000..3c7847af
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/csi-clusterrolebinding.yaml
@@ -0,0 +1,24 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.csiEnabled" . -}}
+{{- if .csiEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "openbao.fullname" . }}-csi-provider-clusterrolebinding
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}-csi-provider
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "openbao.fullname" . }}-csi-provider-clusterrole
+subjects:
+- kind: ServiceAccount
+  name: {{ template "openbao.fullname" . }}-csi-provider
+  namespace: {{ include "openbao.namespace" . }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/csi-daemonset.yaml b/packages/system/openbao/charts/openbao/templates/csi-daemonset.yaml
new file mode 100644
index 00000000..73168ed0
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/csi-daemonset.yaml
@@ -0,0 +1,157 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.csiEnabled" . -}}
+{{- if .csiEnabled -}}
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ template "openbao.fullname" . }}-csi-provider
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}-csi-provider
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- if  .Values.csi.daemonSet.extraLabels -}}
+      {{- toYaml .Values.csi.daemonSet.extraLabels | nindent 4 -}}
+    {{- end -}}
+  {{ template "csi.daemonSet.annotations" . }}
+spec:
+  updateStrategy:
+    type: {{ .Values.csi.daemonSet.updateStrategy.type }}
+    {{- if .Values.csi.daemonSet.updateStrategy.maxUnavailable }}
+    rollingUpdate:
+      maxUnavailable: {{ .Values.csi.daemonSet.updateStrategy.maxUnavailable }}
+    {{- end }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "openbao.name" . }}-csi-provider
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ template "openbao.name" . }}-csi-provider
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        {{- if  .Values.csi.pod.extraLabels -}}
+          {{- toYaml .Values.csi.pod.extraLabels | nindent 8 -}}
+        {{- end -}}
+      {{ template "csi.pod.annotations" . }}
+    spec:
+      {{ template "csi.daemonSet.securityContext.pod" . }}
+      {{- if .Values.csi.priorityClassName }}
+      priorityClassName: {{ .Values.csi.priorityClassName }}
+      {{- end }}
+      serviceAccountName: {{ template "openbao.fullname" . }}-csi-provider
+      {{- template "csi.pod.tolerations" . }}
+      {{- template "csi.pod.nodeselector" . }}
+      {{- template "csi.pod.affinity" . }}
+      containers:
+        - name: {{ include "openbao.name" . }}-csi-provider
+          {{ template "csi.resources" . }}
+          {{ template "csi.daemonSet.securityContext.container" . }}
+          image: "{{ .Values.csi.image.registry | default "docker.io" }}/{{ .Values.csi.image.repository }}:{{ .Values.csi.image.tag }}"
+          imagePullPolicy: {{ .Values.csi.image.pullPolicy }}
+          args:
+            - --endpoint={{ .Values.csi.daemonSet.endpoint }}
+            - --debug={{ .Values.csi.debug }}
+            {{- if .Values.csi.hmacSecretName }}
+            - --hmac-secret-name={{ .Values.csi.hmacSecretName }}
+            {{- else }}
+            - --hmac-secret-name={{- include "openbao.name" . }}-csi-provider-hmac-key
+            {{- end }}
+            {{- if .Values.csi.extraArgs }}
+            {{- toYaml .Values.csi.extraArgs | nindent 12 }}
+            {{- end }}
+          env:
+            - name: VAULT_ADDR
+            {{- if eq (.Values.csi.agent.enabled | toString) "true" }}
+              value: "unix:///var/run/vault/agent.sock"
+            {{- else if include "openbao.externalAddr" . }}
+              value: "{{ include "openbao.externalAddr" . }}"
+            {{- else }}
+              value: {{ include "openbao.scheme" . }}://{{ template "openbao.fullname" . }}.{{ include "openbao.namespace" . }}.svc:{{ .Values.server.service.port }}
+            {{- end }}
+          volumeMounts:
+            - name: providervol
+              mountPath: "/provider"
+            {{- if eq (.Values.csi.agent.enabled | toString) "true" }}
+            - name: agent-unix-socket
+              mountPath: /var/run/vault
+            {{- end }}
+            {{- if .Values.csi.volumeMounts }}
+              {{- toYaml .Values.csi.volumeMounts | nindent 12}}
+            {{- end }}
+          livenessProbe:
+            httpGet:
+              path: /health/ready
+              port: 8080
+            failureThreshold: {{ .Values.csi.livenessProbe.failureThreshold }}
+            initialDelaySeconds: {{ .Values.csi.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.csi.livenessProbe.periodSeconds }}
+            successThreshold: {{ .Values.csi.livenessProbe.successThreshold }}
+            timeoutSeconds: {{ .Values.csi.livenessProbe.timeoutSeconds }}
+          readinessProbe:
+            httpGet:
+              path: /health/ready
+              port: 8080
+            failureThreshold: {{ .Values.csi.readinessProbe.failureThreshold }}
+            initialDelaySeconds: {{ .Values.csi.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.csi.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.csi.readinessProbe.successThreshold }}
+            timeoutSeconds: {{ .Values.csi.readinessProbe.timeoutSeconds }}
+        {{- if eq (.Values.csi.agent.enabled | toString) "true" }}
+        - name: {{ include "openbao.name" . }}-agent
+          image: "{{ .Values.csi.agent.image.registry | default "docker.io" }}/{{ .Values.csi.agent.image.repository }}:{{ .Values.csi.agent.image.tag | default (trimPrefix "v" .Chart.AppVersion) }}"
+          imagePullPolicy: {{ .Values.csi.agent.image.pullPolicy }}
+          {{ template "csi.agent.resources" . }}
+          command:
+            - bao
+          args:
+            - agent
+            - -config=/etc/vault/config.hcl
+            {{- if .Values.csi.agent.extraArgs }}
+            {{- toYaml .Values.csi.agent.extraArgs | nindent 12 }}
+            {{- end }}
+          ports:
+            - containerPort: 8200
+          env:
+            - name: BAO_LOG_LEVEL
+              value: "{{ .Values.csi.agent.logLevel }}"
+            - name: BAO_LOG_FORMAT
+              value: "{{ .Values.csi.agent.logFormat }}"
+          securityContext:
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsUser: 100
+            runAsGroup: 1000
+          volumeMounts:
+            - name: agent-config
+              mountPath: /etc/vault/config.hcl
+              subPath: config.hcl
+              readOnly: true
+            - name: agent-unix-socket
+              mountPath: /var/run/vault
+            {{- if .Values.csi.volumeMounts }}
+            {{- toYaml .Values.csi.volumeMounts | nindent 12 }}
+            {{- end }}
+        {{- end }}
+      volumes:
+        - name: providervol
+          hostPath:
+            path: {{ .Values.csi.daemonSet.providersDir }}
+        {{- if eq (.Values.csi.agent.enabled | toString) "true" }}
+        - name: agent-config
+          configMap:
+            name: {{ template "openbao.fullname" . }}-csi-provider-agent-config
+        - name: agent-unix-socket
+          emptyDir:
+            medium: Memory
+        {{- end }}
+        {{- if .Values.csi.volumes }}
+        {{- toYaml .Values.csi.volumes | nindent 8}}
+        {{- end }}
+      {{- include "imagePullSecrets" . | nindent 6 }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/csi-role.yaml b/packages/system/openbao/charts/openbao/templates/csi-role.yaml
new file mode 100644
index 00000000..a7554a65
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/csi-role.yaml
@@ -0,0 +1,32 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.csiEnabled" . -}}
+{{- if .csiEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "openbao.fullname" . }}-csi-provider-role
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}-csi-provider
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get"]
+  resourceNames:
+    {{- if .Values.csi.hmacSecretName }}
+    - {{ .Values.csi.hmacSecretName }}
+    {{- else }}
+    - {{ include "openbao.name" . }}-csi-provider-hmac-key
+    {{- end }}
+# 'create' permissions cannot be restricted by resource name:
+# https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-resources
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["create"]
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/csi-rolebinding.yaml b/packages/system/openbao/charts/openbao/templates/csi-rolebinding.yaml
new file mode 100644
index 00000000..c46096e1
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/csi-rolebinding.yaml
@@ -0,0 +1,25 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.csiEnabled" . -}}
+{{- if .csiEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "openbao.fullname" . }}-csi-provider-rolebinding
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}-csi-provider
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "openbao.fullname" . }}-csi-provider-role
+subjects:
+- kind: ServiceAccount
+  name: {{ template "openbao.fullname" . }}-csi-provider
+  namespace: {{ include "openbao.namespace" . }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/csi-serviceaccount.yaml b/packages/system/openbao/charts/openbao/templates/csi-serviceaccount.yaml
new file mode 100644
index 00000000..2f5d346b
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/csi-serviceaccount.yaml
@@ -0,0 +1,21 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.csiEnabled" . -}}
+{{- if .csiEnabled -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "openbao.fullname" . }}-csi-provider
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}-csi-provider
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- if  .Values.csi.serviceAccount.extraLabels -}}
+      {{- toYaml .Values.csi.serviceAccount.extraLabels | nindent 4 -}}
+    {{- end -}}
+  {{ template "csi.serviceAccount.annotations" . }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/extra-objects.yaml b/packages/system/openbao/charts/openbao/templates/extra-objects.yaml
new file mode 100644
index 00000000..b408fb07
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/extra-objects.yaml
@@ -0,0 +1,8 @@
+{{- range .Values.extraObjects }}
+---
+{{- if typeIs "string" . }}
+{{ tpl . $ }}
+{{- else }}
+{{ tpl (. | toYaml) $ }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/grafana/configmap-dashboard.yaml b/packages/system/openbao/charts/openbao/templates/grafana/configmap-dashboard.yaml
new file mode 100644
index 00000000..970369f0
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/grafana/configmap-dashboard.yaml
@@ -0,0 +1,30 @@
+{{- if .Values.serverTelemetry.grafanaDashboard.enabled }}
+{{- $files := .Files.Glob "grafana/dashboards/*.json" }}
+{{- if $files }}
+{{- range $path, $fileContents := $files }}
+{{- $dashboardName := regexReplaceAll "(^.*/)(.*)\\.json$" $path "${2}" }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-%s" (include "openbao.fullname" $) $dashboardName | trunc 63 | trimSuffix "-" }}
+  namespace: {{ include "openbao.namespace" $ }}
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" $ }}-grafana-dashboard
+    app.kubernetes.io/instance: {{ $.Release.Name }}
+    app.kubernetes.io/managed-by: {{ $.Release.Service }}
+    {{- if $.Values.serverTelemetry.grafanaDashboard.defaultLabel }}
+    grafana_dashboard: "1"
+    {{- end }}
+    {{- if $.Values.serverTelemetry.grafanaDashboard.extraLabels }}
+    {{- $.Values.serverTelemetry.grafanaDashboard.extraLabels | toYaml | nindent 4 }}
+    {{- end }}
+  {{- if $.Values.serverTelemetry.grafanaDashboard.extraAnnotations }}
+  annotations:
+    {{- $.Values.serverTelemetry.grafanaDashboard.extraAnnotations | toYaml | nindent 4 }}
+  {{- end }}
+data:
+  {{ $dashboardName }}.json: {{ $.Files.Get $path | toJson }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/injector-certs-secret.yaml b/packages/system/openbao/charts/openbao/templates/injector-certs-secret.yaml
new file mode 100644
index 00000000..b5de48bf
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/injector-certs-secret.yaml
@@ -0,0 +1,19 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: openbao-injector-certs
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/injector-clusterrole.yaml b/packages/system/openbao/charts/openbao/templates/injector-clusterrole.yaml
new file mode 100644
index 00000000..10ea35c1
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/injector-clusterrole.yaml
@@ -0,0 +1,30 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "openbao.fullname" . }}-agent-injector-clusterrole
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+- apiGroups: ["admissionregistration.k8s.io"]
+  resources: ["mutatingwebhookconfigurations"]
+  verbs:
+    - "get"
+    - "list"
+    - "watch"
+    - "patch"
+{{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs:
+    - "get"
+{{ end }}
+{{ end }}
diff --git a/packages/system/openbao/charts/openbao/templates/injector-clusterrolebinding.yaml b/packages/system/openbao/charts/openbao/templates/injector-clusterrolebinding.yaml
new file mode 100644
index 00000000..353ee8ac
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/injector-clusterrolebinding.yaml
@@ -0,0 +1,24 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "openbao.fullname" . }}-agent-injector-binding
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "openbao.fullname" . }}-agent-injector-clusterrole
+subjects:
+- kind: ServiceAccount
+  name: {{ template "openbao.fullname" . }}-agent-injector
+  namespace: {{ include "openbao.namespace" . }}
+{{ end }}
diff --git a/packages/system/openbao/charts/openbao/templates/injector-deployment.yaml b/packages/system/openbao/charts/openbao/templates/injector-deployment.yaml
new file mode 100644
index 00000000..ac0fc915
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/injector-deployment.yaml
@@ -0,0 +1,179 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+# Deployment for the injector
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "openbao.fullname" . }}-agent-injector
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    component: webhook
+spec:
+  replicas: {{ .Values.injector.replicas }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ template "openbao.name" . }}-agent-injector
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      component: webhook
+  {{ template "injector.strategy" . }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ template "openbao.name" . }}-agent-injector
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        component: webhook
+        {{- if  .Values.injector.extraLabels -}}
+          {{- toYaml .Values.injector.extraLabels | nindent 8 -}}
+        {{- end -}}
+      {{ template "injector.annotations" . }}
+    spec:
+      {{ template "injector.affinity" . }}
+      {{ template "injector.topologySpreadConstraints" . }}
+      {{ template "injector.tolerations" . }}
+      {{ template "injector.nodeselector" . }}
+      {{- if .Values.injector.priorityClassName }}
+      priorityClassName: {{ .Values.injector.priorityClassName }}
+      {{- end }}
+      serviceAccountName: "{{ template "openbao.fullname" . }}-agent-injector"
+      {{ template "injector.securityContext.pod" . -}}
+      {{- if not .Values.global.openshift }}
+      hostNetwork: {{ .Values.injector.hostNetwork }}
+      {{- end }}
+      containers:
+        - name: sidecar-injector
+          {{ template "injector.resources" . }}
+          image: "{{ .Values.injector.image.registry | default "docker.io" }}/{{ .Values.injector.image.repository }}:{{ .Values.injector.image.tag }}"
+          imagePullPolicy: "{{ .Values.injector.image.pullPolicy }}"
+          {{- template "injector.securityContext.container" . }}
+          env:
+            - name: AGENT_INJECT_LISTEN
+              value: {{ printf ":%v" .Values.injector.port  }}
+            - name: AGENT_INJECT_LOG_LEVEL
+              value: {{ .Values.injector.logLevel | default "info" }}
+            - name: AGENT_INJECT_VAULT_ADDR
+            {{- if include "openbao.externalAddr" . }}
+              value: "{{ include "openbao.externalAddr" . }}"
+            {{- else if .Values.injector.externalVaultAddr }}
+              value: "{{ .Values.injector.externalVaultAddr }}"
+            {{- else }}
+              value: {{ include "openbao.scheme" . }}://{{ template "openbao.fullname" . }}.{{ include "openbao.namespace" . }}.svc:{{ .Values.server.service.port }}
+            {{- end }}
+            - name: AGENT_INJECT_VAULT_AUTH_PATH
+              value: {{ .Values.injector.authPath }}
+            - name: AGENT_INJECT_VAULT_IMAGE
+              value: "{{ .Values.injector.agentImage.registry | default "quay.io" }}/{{ .Values.injector.agentImage.repository }}:{{ .Values.injector.agentImage.tag | default (trimPrefix "v" .Chart.AppVersion) }}"
+            {{- if .Values.injector.certs.secretName }}
+            - name: AGENT_INJECT_TLS_CERT_FILE
+              value: "/etc/webhook/certs/{{ .Values.injector.certs.certName }}"
+            - name: AGENT_INJECT_TLS_KEY_FILE
+              value: "/etc/webhook/certs/{{ .Values.injector.certs.keyName }}"
+            {{- else }}
+            - name: AGENT_INJECT_TLS_AUTO
+              value: {{ template "openbao.fullname" . }}-agent-injector-cfg
+            - name: AGENT_INJECT_TLS_AUTO_HOSTS
+              value: {{ template "openbao.fullname" . }}-agent-injector-svc,{{ template "openbao.fullname" . }}-agent-injector-svc.{{ include "openbao.namespace" . }},{{ template "openbao.fullname" . }}-agent-injector-svc.{{ include "openbao.namespace" . }}.svc
+            {{- end }}
+            - name: AGENT_INJECT_LOG_FORMAT
+              value: {{ .Values.injector.logFormat | default "standard" }}
+            - name: AGENT_INJECT_REVOKE_ON_SHUTDOWN
+              value: "{{ .Values.injector.revokeOnShutdown | default false }}"
+            {{- if .Values.global.openshift }}
+            - name: AGENT_INJECT_SET_SECURITY_CONTEXT
+              value: "false"
+            {{- end }}
+            {{- if .Values.injector.metrics.enabled }}
+            - name: AGENT_INJECT_TELEMETRY_PATH
+              value: "/metrics"
+            {{- end }}
+            {{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
+            - name: AGENT_INJECT_USE_LEADER_ELECTOR
+              value: "true"
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            {{- end }}
+            - name: AGENT_INJECT_CPU_REQUEST
+              value: "{{ .Values.injector.agentDefaults.cpuRequest }}"
+            - name: AGENT_INJECT_CPU_LIMIT
+              value: "{{ .Values.injector.agentDefaults.cpuLimit }}"
+            - name: AGENT_INJECT_MEM_REQUEST
+              value: "{{ .Values.injector.agentDefaults.memRequest }}"
+            - name: AGENT_INJECT_MEM_LIMIT
+              value: "{{ .Values.injector.agentDefaults.memLimit }}"
+            {{- if .Values.injector.agentDefaults.ephemeralRequest }}
+            - name: AGENT_INJECT_EPHEMERAL_REQUEST
+              value: "{{ .Values.injector.agentDefaults.ephemeralRequest }}"
+            {{- end }}
+            {{- if .Values.injector.agentDefaults.ephemeralLimit }}
+            - name: AGENT_INJECT_EPHEMERAL_LIMIT
+              value: "{{ .Values.injector.agentDefaults.ephemeralLimit }}"
+            {{- end }}
+            - name: AGENT_INJECT_DEFAULT_TEMPLATE
+              value: "{{ .Values.injector.agentDefaults.template }}"
+            - name: AGENT_INJECT_TEMPLATE_CONFIG_EXIT_ON_RETRY_FAILURE
+              value: "{{ .Values.injector.agentDefaults.templateConfig.exitOnRetryFailure }}"
+            {{- if .Values.injector.agentDefaults.templateConfig.staticSecretRenderInterval }}
+            - name: AGENT_INJECT_TEMPLATE_STATIC_SECRET_RENDER_INTERVAL
+              value: "{{ .Values.injector.agentDefaults.templateConfig.staticSecretRenderInterval }}"
+            {{- end }}
+            {{- include "openbao.extraEnvironmentVars" .Values.injector | nindent 12 }}
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          args:
+            - agent-inject
+            - 2>&1
+          livenessProbe:
+            httpGet:
+              path: /health/ready
+              port: {{ .Values.injector.port }}
+              scheme: HTTPS
+            failureThreshold: {{ .Values.injector.livenessProbe.failureThreshold }}
+            initialDelaySeconds: {{ .Values.injector.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.injector.livenessProbe.periodSeconds }}
+            successThreshold: {{ .Values.injector.livenessProbe.successThreshold }}
+            timeoutSeconds: {{ .Values.injector.livenessProbe.timeoutSeconds }}
+          readinessProbe:
+            httpGet:
+              path: /health/ready
+              port: {{ .Values.injector.port }}
+              scheme: HTTPS
+            failureThreshold: {{ .Values.injector.readinessProbe.failureThreshold }}
+            initialDelaySeconds: {{ .Values.injector.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.injector.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.injector.readinessProbe.successThreshold }}
+            timeoutSeconds: {{ .Values.injector.readinessProbe.timeoutSeconds }}
+          startupProbe:
+            httpGet:
+              path: /health/ready
+              port: {{ .Values.injector.port }}
+              scheme: HTTPS
+            failureThreshold: {{ .Values.injector.startupProbe.failureThreshold }}
+            initialDelaySeconds: {{ .Values.injector.startupProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.injector.startupProbe.periodSeconds }}
+            successThreshold: {{ .Values.injector.startupProbe.successThreshold }}
+            timeoutSeconds: {{ .Values.injector.startupProbe.timeoutSeconds }}
+{{- if .Values.injector.certs.secretName }}
+          volumeMounts:
+            - name: webhook-certs
+              mountPath: /etc/webhook/certs
+              readOnly: true
+{{- end }}
+{{- if .Values.injector.certs.secretName }}
+      volumes:
+        - name: webhook-certs
+          secret:
+            secretName: "{{ .Values.injector.certs.secretName }}"
+{{- end }}
+      {{- include "imagePullSecrets" . | nindent 6 }}
+{{ end }}
diff --git a/packages/system/openbao/charts/openbao/templates/injector-disruptionbudget.yaml b/packages/system/openbao/charts/openbao/templates/injector-disruptionbudget.yaml
new file mode 100644
index 00000000..08749bd2
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/injector-disruptionbudget.yaml
@@ -0,0 +1,25 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- if .Values.injector.podDisruptionBudget }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ template "openbao.fullname" . }}-agent-injector
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    component: webhook
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ template "openbao.name" . }}-agent-injector
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      component: webhook
+  {{- toYaml .Values.injector.podDisruptionBudget | nindent 2 }}
+{{- end -}}
diff --git a/packages/system/openbao/charts/openbao/templates/injector-mutating-webhook.yaml b/packages/system/openbao/charts/openbao/templates/injector-mutating-webhook.yaml
new file mode 100644
index 00000000..8ffd2671
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/injector-mutating-webhook.yaml
@@ -0,0 +1,44 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if .Capabilities.APIVersions.Has "admissionregistration.k8s.io/v1" }}
+apiVersion: admissionregistration.k8s.io/v1
+{{- else }}
+apiVersion: admissionregistration.k8s.io/v1beta1
+{{- end }}
+kind: MutatingWebhookConfiguration
+metadata:
+  name: {{ template "openbao.fullname" . }}-agent-injector-cfg
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+  {{- template "injector.webhookAnnotations" . }}
+webhooks:
+  - name: vault.hashicorp.com
+    failurePolicy: {{ ((.Values.injector.webhook)).failurePolicy | default .Values.injector.failurePolicy }}
+    matchPolicy: {{ ((.Values.injector.webhook)).matchPolicy | default "Exact" }}
+    sideEffects: None
+    timeoutSeconds: {{ ((.Values.injector.webhook)).timeoutSeconds | default "30" }}
+    admissionReviewVersions: ["v1", "v1beta1"]
+    clientConfig:
+      service:
+        name: {{ template "openbao.fullname" . }}-agent-injector-svc
+        namespace: {{ include "openbao.namespace" . }}
+        path: "/mutate"
+      caBundle: {{ .Values.injector.certs.caBundle | quote }}
+    rules:
+      - operations: ["CREATE", "UPDATE"]
+        apiGroups: [""]
+        apiVersions: ["v1"]
+        resources: ["pods"]
+{{- if or (.Values.injector.namespaceSelector) (((.Values.injector.webhook)).namespaceSelector) }}
+    namespaceSelector:
+{{ toYaml (((.Values.injector.webhook)).namespaceSelector | default .Values.injector.namespaceSelector) | indent 6}}
+{{ end }}
+{{- template "injector.objectSelector" . -}}
+{{ end }}
diff --git a/packages/system/openbao/charts/openbao/templates/injector-network-policy.yaml b/packages/system/openbao/charts/openbao/templates/injector-network-policy.yaml
new file mode 100644
index 00000000..68a89754
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/injector-network-policy.yaml
@@ -0,0 +1,30 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if eq (.Values.global.openshift | toString) "true" }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ template "openbao.fullname" . }}-agent-injector
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ template "openbao.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: {{ template "openbao.name" . }}-agent-injector
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      component: webhook
+  ingress:
+    - from:
+        - namespaceSelector: {}
+      ports:
+      - port: 8080
+        protocol: TCP
+{{ end }}
+{{ end }}
diff --git a/packages/system/openbao/charts/openbao/templates/injector-psp-role.yaml b/packages/system/openbao/charts/openbao/templates/injector-psp-role.yaml
new file mode 100644
index 00000000..3f42450c
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/injector-psp-role.yaml
@@ -0,0 +1,25 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if eq (.Values.global.psp.enable | toString) "true" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "openbao.fullname" . }}-agent-injector-psp
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+- apiGroups: ['policy']
+  resources: ['podsecuritypolicies']
+  verbs:     ['use']
+  resourceNames:
+    - {{ template "openbao.fullname" . }}-agent-injector
+{{- end }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/injector-psp-rolebinding.yaml b/packages/system/openbao/charts/openbao/templates/injector-psp-rolebinding.yaml
new file mode 100644
index 00000000..62a609c7
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/injector-psp-rolebinding.yaml
@@ -0,0 +1,26 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if eq (.Values.global.psp.enable | toString) "true" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "openbao.fullname" . }}-agent-injector-psp
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+  kind: Role
+  name: {{ template "openbao.fullname" . }}-agent-injector-psp
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "openbao.fullname" . }}-agent-injector
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/packages/system/openbao/charts/openbao/templates/injector-psp.yaml b/packages/system/openbao/charts/openbao/templates/injector-psp.yaml
new file mode 100644
index 00000000..5c1c58f7
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/injector-psp.yaml
@@ -0,0 +1,51 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if eq (.Values.global.psp.enable | toString) "true" }}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "openbao.fullname" . }}-agent-injector
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- template "openbao.psp.annotations" . }}
+spec:
+  privileged: false
+  # Required to prevent escalations to root.
+  allowPrivilegeEscalation: false
+  volumes:
+    - configMap
+    - emptyDir
+    - projected
+    - secret
+    - downwardAPI
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    # Require the container to run without root privileges.
+    rule: MustRunAsNonRoot
+  seLinux:
+    # This policy assumes the nodes are using AppArmor rather than SELinux.
+    rule: RunAsAny
+  supplementalGroups:
+    rule: MustRunAs
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  fsGroup:
+    rule: MustRunAs
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  readOnlyRootFilesystem: false
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/packages/system/openbao/charts/openbao/templates/injector-role.yaml b/packages/system/openbao/charts/openbao/templates/injector-role.yaml
new file mode 100644
index 00000000..2e29aa7b
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/injector-role.yaml
@@ -0,0 +1,34 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "openbao.fullname" . }}-agent-injector-leader-elector-role
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+  - apiGroups: [""]
+    resources: ["secrets", "configmaps"]
+    verbs:
+      - "create"
+      - "get"
+      - "watch"
+      - "list"
+      - "update"
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+      - "get"
+      - "patch"
+      - "delete"
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/packages/system/openbao/charts/openbao/templates/injector-rolebinding.yaml b/packages/system/openbao/charts/openbao/templates/injector-rolebinding.yaml
new file mode 100644
index 00000000..8e460c4b
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/injector-rolebinding.yaml
@@ -0,0 +1,27 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "openbao.fullname" . }}-agent-injector-leader-elector-binding
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "openbao.fullname" . }}-agent-injector-leader-elector-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "openbao.fullname" . }}-agent-injector
+    namespace: {{ include "openbao.namespace" . }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/packages/system/openbao/charts/openbao/templates/injector-service.yaml b/packages/system/openbao/charts/openbao/templates/injector-service.yaml
new file mode 100644
index 00000000..f9db469f
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/injector-service.yaml
@@ -0,0 +1,30 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "openbao.fullname" . }}-agent-injector-svc
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- if  .Values.injector.service.extraLabels -}}
+      {{- toYaml .Values.injector.service.extraLabels | nindent 4 -}}
+    {{- end -}}
+  {{ template "injector.service.annotations" . }}
+spec:
+  ports:
+  - name: https
+    port: 443
+    targetPort: {{ .Values.injector.port }}
+  selector:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    component: webhook
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/injector-serviceaccount.yaml b/packages/system/openbao/charts/openbao/templates/injector-serviceaccount.yaml
new file mode 100644
index 00000000..a411788c
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/injector-serviceaccount.yaml
@@ -0,0 +1,18 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "openbao.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "openbao.fullname" . }}-agent-injector
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+  {{ template "injector.serviceAccount.annotations" . }}
+{{ end }}
diff --git a/packages/system/openbao/charts/openbao/templates/prometheus-prometheusrules.yaml b/packages/system/openbao/charts/openbao/templates/prometheus-prometheusrules.yaml
new file mode 100644
index 00000000..d371da37
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/prometheus-prometheusrules.yaml
@@ -0,0 +1,32 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ if and (.Values.serverTelemetry.prometheusRules.rules)
+     (or (.Values.global.serverTelemetry.prometheusOperator) (.Values.serverTelemetry.prometheusRules.enabled) )
+}}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: {{ template "openbao.fullname" . }}
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- /* update the selectors docs in values.yaml whenever the defaults below change. */ -}}
+    {{- $selectors := .Values.serverTelemetry.prometheusRules.selectors }}
+    {{- if $selectors }}
+    {{- toYaml $selectors | nindent 4 }}
+    {{- else }}
+    release: prometheus
+    {{- end }}
+spec:
+  groups:
+  - name: {{ include "openbao.fullname" . }}
+    rules:
+      {{- toYaml .Values.serverTelemetry.prometheusRules.rules | nindent 6 }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/prometheus-servicemonitor.yaml b/packages/system/openbao/charts/openbao/templates/prometheus-servicemonitor.yaml
new file mode 100644
index 00000000..950c6194
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/prometheus-servicemonitor.yaml
@@ -0,0 +1,62 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "openbao.mode" . }}
+{{ if or (.Values.global.serverTelemetry.prometheusOperator) (.Values.serverTelemetry.serviceMonitor.enabled) }}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ template "openbao.fullname" . }}
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- /* update the selectors docs in values.yaml whenever the defaults below change. */ -}}
+    {{- $selectors := .Values.serverTelemetry.serviceMonitor.selectors }}
+    {{- if $selectors }}
+    {{- toYaml $selectors | nindent 4 }}
+    {{- else }}
+    release: prometheus
+    {{- end }}
+spec:
+  {{- if .Values.serverTelemetry.serviceMonitor.scrapeClass }}
+  scrapeClass: {{ .Values.serverTelemetry.serviceMonitor.scrapeClass }}
+  {{- end }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ template "openbao.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      {{- if eq .mode "ha" }}
+      openbao-active: "true"
+      {{- else }}
+      openbao-internal: "true"
+      {{- end }}
+  endpoints:
+  - port: {{ .Values.serverTelemetry.serviceMonitor.port | default (include "openbao.scheme" .) }}
+    interval: {{ .Values.serverTelemetry.serviceMonitor.interval }}
+    scrapeTimeout: {{ .Values.serverTelemetry.serviceMonitor.scrapeTimeout }}
+    scheme: {{ .Values.serverTelemetry.serviceMonitor.scheme | default (include "openbao.scheme" .) | lower }}
+    path: /v1/sys/metrics
+    params:
+      format:
+      - prometheus
+    {{- with .Values.serverTelemetry.serviceMonitor.tlsConfig }}
+    tlsConfig:
+    {{- toYaml . | nindent 6 }}
+    {{- else }}
+    tlsConfig:
+      insecureSkipVerify: true
+    {{- end }}
+    {{- with .Values.serverTelemetry.serviceMonitor.authorization }}
+    authorization:
+    {{- toYaml . | nindent 6 }}
+    {{- end }}
+  namespaceSelector:
+    matchNames:
+      - {{ include "openbao.namespace" . }}
+{{ end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-backendtlspolicy.yaml b/packages/system/openbao/charts/openbao/templates/server-backendtlspolicy.yaml
new file mode 100644
index 00000000..9b492d26
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-backendtlspolicy.yaml
@@ -0,0 +1,43 @@
+{{ template "openbao.mode" . }}
+{{- if ne .mode "external" }}
+{{- if and (not .Values.global.tlsDisable) .Values.server.gateway.tlsPolicy.enabled -}}
+{{- $serviceName := include "openbao.fullname" . -}}
+{{- template "openbao.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+{{- if and (eq .mode "ha" ) (eq (.Values.server.gateway.tlsPolicy.activeService | toString) "true") }}
+{{- $serviceName = printf "%s-%s" $serviceName "active" -}}
+{{- end }}
+apiVersion: {{ .Values.server.gateway.tlsPolicy.apiVersion }}
+kind: BackendTLSPolicy
+metadata:
+  name: {{ template "openbao.fullname" . }}
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- with .Values.server.gateway.tlsPolicy.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- template "openbao.gateway.tlsPolicy.annotations" . }}
+spec:
+  targetRefs:
+  {{- if .Values.server.gateway.tlsPolicy.targetRefs }}
+  {{- with .Values.server.gateway.tlsPolicy.targetRefs }}
+  {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- else }}
+  - group: ''
+    kind: Service
+    name: {{ $serviceName }}
+    sectionName: {{ include "openbao.scheme" . }}
+  {{- end }}
+  validation:
+    {{- with .Values.server.gateway.tlsPolicy.validation }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+    hostname: {{ include "openbao.fullname" . }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-clusterrolebinding.yaml b/packages/system/openbao/charts/openbao/templates/server-clusterrolebinding.yaml
new file mode 100644
index 00000000..0f851ec1
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-clusterrolebinding.yaml
@@ -0,0 +1,29 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "openbao.serverAuthDelegator" . }}
+{{- if .serverAuthDelegator -}}
+{{- if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1" -}}
+apiVersion: rbac.authorization.k8s.io/v1
+{{- else }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+{{- end }}
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "openbao.fullname" . }}-server-binding
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+- kind: ServiceAccount
+  name: {{ template "openbao.serviceAccount.name" . }}
+  namespace: {{ include "openbao.namespace" . }}
+{{ end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-config-configmap.yaml b/packages/system/openbao/charts/openbao/templates/server-config-configmap.yaml
new file mode 100644
index 00000000..57c4b0e6
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-config-configmap.yaml
@@ -0,0 +1,31 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "openbao.mode" . }}
+{{- if ne .mode "external" }}
+{{- if .serverEnabled -}}
+{{- if ne .mode "dev" -}}
+{{ if or (.Values.server.standalone.config) (.Values.server.ha.config) -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "openbao.fullname" . }}-config
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- if .Values.server.configAnnotation }}
+  annotations:
+    vault.hashicorp.com/config-checksum: {{ include "openbao.config" . | sha256sum }}
+{{- end }}
+data:
+  extraconfig-from-values.hcl: |-
+    {{ template "openbao.config" . }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-discovery-role.yaml b/packages/system/openbao/charts/openbao/templates/server-discovery-role.yaml
new file mode 100644
index 00000000..082ff996
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-discovery-role.yaml
@@ -0,0 +1,26 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "openbao.mode" . }}
+{{- if .serverEnabled -}}
+{{- if eq .mode "ha" }}
+{{- if eq (.Values.server.serviceAccount.serviceDiscovery.enabled | toString) "true" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ include "openbao.namespace" . }}
+  name: {{ template "openbao.fullname" . }}-discovery-role
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "watch", "list", "update", "patch"]
+{{ end }}
+{{ end }}
+{{ end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-discovery-rolebinding.yaml b/packages/system/openbao/charts/openbao/templates/server-discovery-rolebinding.yaml
new file mode 100644
index 00000000..5d3f95e3
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-discovery-rolebinding.yaml
@@ -0,0 +1,34 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "openbao.mode" . }}
+{{- if .serverEnabled -}}
+{{- if eq .mode "ha" }}
+{{- if eq (.Values.server.serviceAccount.serviceDiscovery.enabled | toString) "true" }}
+{{- if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1" -}}
+apiVersion: rbac.authorization.k8s.io/v1
+{{- else }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+{{- end }}
+kind: RoleBinding
+metadata:
+  name: {{ template "openbao.fullname" . }}-discovery-rolebinding
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "openbao.fullname" . }}-discovery-role
+subjects:
+- kind: ServiceAccount
+  name: {{ template "openbao.serviceAccount.name" . }}
+  namespace: {{ include "openbao.namespace" . }}
+{{ end }}
+{{ end }}
+{{ end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-disruptionbudget.yaml b/packages/system/openbao/charts/openbao/templates/server-disruptionbudget.yaml
new file mode 100644
index 00000000..7e6660a1
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-disruptionbudget.yaml
@@ -0,0 +1,31 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "openbao.mode" . }}
+{{- if ne .mode "external" -}}
+{{- if .serverEnabled -}}
+{{- if and (eq .mode "ha") (eq (.Values.server.ha.disruptionBudget.enabled | toString) "true") -}}
+# PodDisruptionBudget to prevent degrading the server cluster through
+# voluntary cluster changes.
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ template "openbao.fullname" . }}
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+spec:
+  maxUnavailable: {{ template "openbao.pdb.maxUnavailable" . }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "openbao.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      component: server
+{{- end -}}
+{{- end -}}
+{{- end -}}
diff --git a/packages/system/openbao/charts/openbao/templates/server-ha-active-service.yaml b/packages/system/openbao/charts/openbao/templates/server-ha-active-service.yaml
new file mode 100644
index 00000000..19f5afbd
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-ha-active-service.yaml
@@ -0,0 +1,68 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "openbao.mode" . }}
+{{- if ne .mode "external" }}
+{{- template "openbao.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+{{- if eq .mode "ha" }}
+{{- if eq (.Values.server.service.active.enabled | toString) "true" }}
+# Service for active OpenBao pod
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "openbao.fullname" . }}-active
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    openbao-active: "true"
+    {{- if  .Values.server.service.active.extraLabels -}}
+      {{- toYaml .Values.server.service.active.extraLabels | nindent 4 -}}
+    {{- end -}}
+{{- template "openbao.service.active.annotations" . }}
+spec:
+  {{- if .Values.server.service.type}}
+  type: {{ .Values.server.service.type }}
+  {{- end}}
+  {{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }}
+  {{- if .Values.server.service.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.server.service.ipFamilyPolicy }}
+  {{- end }}
+  {{- if .Values.server.service.ipFamilies }}
+  ipFamilies: {{ .Values.server.service.ipFamilies | toYaml | nindent 2 }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.server.service.clusterIP }}
+  clusterIP: {{ .Values.server.service.clusterIP }}
+  {{- end }}
+  {{- include "service.externalTrafficPolicy" .Values.server.service }}
+  publishNotReadyAddresses: {{ .Values.server.service.publishNotReadyAddresses }}
+  ports:
+    - name: {{ include "openbao.scheme" . }}
+      port: {{ .Values.server.service.port }}
+      targetPort: {{ .Values.server.service.targetPort }}
+      {{- if and (.Values.server.service.activeNodePort) (eq (.Values.server.service.type | toString) "NodePort") }}
+      nodePort: {{ .Values.server.service.activeNodePort }}
+      {{- end }}
+    - name: https-internal
+      port: 8201
+      targetPort: 8201
+  {{- if .Values.server.service.extraPorts -}}
+  {{ toYaml .Values.server.service.extraPorts | nindent 4}}
+  {{- end }}
+  selector:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    {{- if eq (.Values.server.service.instanceSelector.enabled | toString) "true" }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- end }}
+    component: server
+    openbao-active: "true"
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-ha-standby-service.yaml b/packages/system/openbao/charts/openbao/templates/server-ha-standby-service.yaml
new file mode 100644
index 00000000..f9ac4d42
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-ha-standby-service.yaml
@@ -0,0 +1,67 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "openbao.mode" . }}
+{{- if ne .mode "external" }}
+{{- template "openbao.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+{{- if eq .mode "ha" }}
+{{- if eq (.Values.server.service.standby.enabled | toString) "true" }}
+# Service for standby OpenBao pod
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "openbao.fullname" . }}-standby
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- if  .Values.server.service.standby.extraLabels -}}
+      {{- toYaml .Values.server.service.standby.extraLabels | nindent 4 -}}
+    {{- end -}}
+{{- template "openbao.service.standby.annotations" . }}
+spec:
+  {{- if .Values.server.service.type}}
+  type: {{ .Values.server.service.type }}
+  {{- end}}
+  {{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }}
+  {{- if .Values.server.service.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.server.service.ipFamilyPolicy }}
+  {{- end }}
+  {{- if .Values.server.service.ipFamilies }}
+  ipFamilies: {{ .Values.server.service.ipFamilies | toYaml | nindent 2 }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.server.service.clusterIP }}
+  clusterIP: {{ .Values.server.service.clusterIP }}
+  {{- end }}
+  {{- include "service.externalTrafficPolicy" .Values.server.service }}
+  publishNotReadyAddresses: {{ .Values.server.service.publishNotReadyAddresses }}
+  ports:
+    - name: {{ include "openbao.scheme" . }}
+      port: {{ .Values.server.service.port }}
+      targetPort: {{ .Values.server.service.targetPort }}
+      {{- if and (.Values.server.service.standbyNodePort) (eq (.Values.server.service.type | toString) "NodePort") }}
+      nodePort: {{ .Values.server.service.standbyNodePort }}
+      {{- end }}
+    - name: https-internal
+      port: 8201
+      targetPort: 8201
+  {{- if .Values.server.service.extraPorts -}}
+  {{ toYaml .Values.server.service.extraPorts | nindent 4}}
+  {{- end }}
+  selector:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    {{- if eq (.Values.server.service.instanceSelector.enabled | toString) "true" }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- end }}
+    component: server
+    openbao-active: "false"
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-headless-service.yaml b/packages/system/openbao/charts/openbao/templates/server-headless-service.yaml
new file mode 100644
index 00000000..b3441c8f
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-headless-service.yaml
@@ -0,0 +1,46 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "openbao.mode" . }}
+{{- if ne .mode "external" }}
+{{- template "openbao.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+# Service for OpenBao cluster
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "openbao.fullname" . }}-internal
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    openbao-internal: "true"
+{{ template "openbao.service.annotations" .}}
+spec:
+  {{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }}
+  {{- if .Values.server.service.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.server.service.ipFamilyPolicy }}
+  {{- end }}
+  {{- if .Values.server.service.ipFamilies }}
+  ipFamilies: {{ .Values.server.service.ipFamilies | toYaml | nindent 2 }}
+  {{- end }}
+  {{- end }}
+  clusterIP: None
+  publishNotReadyAddresses: true
+  ports:
+    - name: "{{ include "openbao.scheme" . }}"
+      port: {{ .Values.server.service.port }}
+      targetPort: {{ .Values.server.service.targetPort }}
+    - name: https-internal
+      port: 8201
+      targetPort: 8201
+  selector:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    component: server
+{{- end }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-httproute.yaml b/packages/system/openbao/charts/openbao/templates/server-httproute.yaml
new file mode 100644
index 00000000..ab840b42
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-httproute.yaml
@@ -0,0 +1,50 @@
+{{ template "openbao.mode" . }}
+{{- if ne .mode "external" }}
+{{- if .Values.server.gateway.httpRoute.enabled -}}
+{{- $serviceName := include "openbao.fullname" . -}}
+{{- template "openbao.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+{{- if and (eq .mode "ha" ) (eq (.Values.server.gateway.httpRoute.activeService | toString) "true") }}
+{{- $serviceName = printf "%s-%s" $serviceName "active" -}}
+{{- end }}
+{{- $servicePort := .Values.server.service.port -}}
+apiVersion: {{ .Values.server.gateway.httpRoute.apiVersion }}
+kind: HTTPRoute
+metadata:
+  name: {{ template "openbao.fullname" . }}
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- with .Values.server.gateway.httpRoute.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- template "openbao.gateway.httpRoute.annotations" . }}
+spec:
+  hostnames:
+  {{- range .Values.server.gateway.httpRoute.hosts }}
+    - {{ . | quote }}
+  {{- end }}
+  parentRefs:
+  {{- with .Values.server.gateway.httpRoute.parentRefs }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+  - backendRefs:
+    - kind: Service
+      name: {{ $serviceName }}
+      port: {{ $servicePort }}
+    matches:
+    {{- with .Values.server.gateway.httpRoute.matches.path }}
+    - path:
+      {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.server.gateway.httpRoute.filters }}
+    filters:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-ingress.yaml b/packages/system/openbao/charts/openbao/templates/server-ingress.yaml
new file mode 100644
index 00000000..de33c66a
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-ingress.yaml
@@ -0,0 +1,67 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "openbao.mode" . }}
+{{- if ne .mode "external" }}
+{{- if .Values.server.ingress.enabled -}}
+{{- $extraPaths := .Values.server.ingress.extraPaths -}}
+{{- $serviceName := include "openbao.fullname" . -}}
+{{- template "openbao.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+{{- if and (eq .mode "ha" ) (eq (.Values.server.ingress.activeService | toString) "true") }}
+{{- $serviceName = printf "%s-%s" $serviceName "active" -}}
+{{- end }}
+{{- $servicePort := .Values.server.service.port -}}
+{{- $pathType := .Values.server.ingress.pathType -}}
+{{- $kubeVersion := .Capabilities.KubeVersion.Version }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ template "openbao.fullname" . }}
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- with .Values.server.ingress.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- template "openbao.ingress.annotations" . }}
+spec:
+{{- if .Values.server.ingress.tls }}
+  tls:
+  {{- range .Values.server.ingress.tls }}
+    - hosts:
+      {{- range .hosts }}
+        - {{ . | quote }}
+      {{- end }}
+      secretName: {{ .secretName }}
+  {{- end }}
+{{- end }}
+{{- if .Values.server.ingress.ingressClassName }}
+  ingressClassName: {{ .Values.server.ingress.ingressClassName }}
+{{- end }}
+  rules:
+  {{- range .Values.server.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+{{ if $extraPaths }}
+{{ toYaml $extraPaths | indent 10 }}
+{{- end }}
+        {{- range (.paths | default (list "/")) }}
+          - path: {{ . }}
+            pathType: {{ $pathType }}
+            backend:
+              service:
+                name: {{ $serviceName }}
+                port:
+                  number: {{ $servicePort }}
+        {{- end }}
+  {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-network-policy.yaml b/packages/system/openbao/charts/openbao/templates/server-network-policy.yaml
new file mode 100644
index 00000000..0891a508
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-network-policy.yaml
@@ -0,0 +1,24 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- if eq (.Values.server.networkPolicy.enabled | toString) "true"  }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ template "openbao.fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ template "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: {{ template "openbao.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  ingress: {{- toYaml .Values.server.networkPolicy.ingress | nindent 4 }}
+  {{- if .Values.server.networkPolicy.egress }}
+  egress:
+  {{- toYaml .Values.server.networkPolicy.egress | nindent 4 }}
+  {{ end }}
+{{ end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-psp-role.yaml b/packages/system/openbao/charts/openbao/templates/server-psp-role.yaml
new file mode 100644
index 00000000..bfb71612
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-psp-role.yaml
@@ -0,0 +1,25 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "openbao.mode" . }}
+{{- if .serverEnabled -}}
+{{- if and (ne .mode "") (eq (.Values.global.psp.enable | toString) "true") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "openbao.fullname" . }}-psp
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+- apiGroups: ['policy']
+  resources: ['podsecuritypolicies']
+  verbs:     ['use']
+  resourceNames:
+    - {{ template "openbao.fullname" . }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-psp-rolebinding.yaml b/packages/system/openbao/charts/openbao/templates/server-psp-rolebinding.yaml
new file mode 100644
index 00000000..7f8bb975
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-psp-rolebinding.yaml
@@ -0,0 +1,26 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "openbao.mode" . }}
+{{- if .serverEnabled -}}
+{{- if and (ne .mode "") (eq (.Values.global.psp.enable | toString) "true") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "openbao.fullname" . }}-psp
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+  kind: Role
+  name: {{ template "openbao.fullname" . }}-psp
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "openbao.fullname" . }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-psp.yaml b/packages/system/openbao/charts/openbao/templates/server-psp.yaml
new file mode 100644
index 00000000..d7c396a7
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-psp.yaml
@@ -0,0 +1,54 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "openbao.mode" . }}
+{{- if .serverEnabled -}}
+{{- if and (ne .mode "") (eq (.Values.global.psp.enable | toString) "true") }}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "openbao.fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- template "openbao.psp.annotations" . }}
+spec:
+  privileged: false
+  # Required to prevent escalations to root.
+  allowPrivilegeEscalation: false
+  volumes:
+    - configMap
+    - emptyDir
+    - projected
+    - secret
+    - downwardAPI
+    {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }}
+    - persistentVolumeClaim
+    {{- end }}
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    # Require the container to run without root privileges.
+    rule: MustRunAsNonRoot
+  seLinux:
+    # This policy assumes the nodes are using AppArmor rather than SELinux.
+    rule: RunAsAny
+  supplementalGroups:
+    rule: MustRunAs
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  fsGroup:
+    rule: MustRunAs
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  readOnlyRootFilesystem: false
+{{- end }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-route.yaml b/packages/system/openbao/charts/openbao/templates/server-route.yaml
new file mode 100644
index 00000000..4c350d7d
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-route.yaml
@@ -0,0 +1,39 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- if .Values.global.openshift }}
+{{- if ne .mode "external" }}
+{{- if .Values.server.route.enabled -}}
+{{- $serviceName := include "openbao.fullname" . -}}
+{{- if and (eq .mode "ha" ) (eq (.Values.server.route.activeService | toString) "true") }}
+{{- $serviceName = printf "%s-%s" $serviceName "active" -}}
+{{- end }}
+kind: Route
+apiVersion: route.openshift.io/v1
+metadata:
+  name: {{ template "openbao.fullname" . }}
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- with .Values.server.route.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- template "openbao.route.annotations" . }}
+spec:
+  host: {{ .Values.server.route.host }}
+  to:
+    kind: Service
+    name: {{ $serviceName }}
+    weight: 100
+  port:
+    targetPort: 8200
+  tls:
+    {{- toYaml .Values.server.route.tls | nindent  4 }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-service.yaml b/packages/system/openbao/charts/openbao/templates/server-service.yaml
new file mode 100644
index 00000000..7f82db8e
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-service.yaml
@@ -0,0 +1,64 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "openbao.mode" . }}
+{{- if ne .mode "external" }}
+{{- template "openbao.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+# Service for OpenBao cluster
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "openbao.fullname" . }}
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- if  .Values.server.service.extraLabels -}}
+      {{- toYaml .Values.server.service.extraLabels | nindent 4 -}}
+    {{- end -}}
+{{ template "openbao.service.annotations" .}}
+spec:
+  {{- if .Values.server.service.type}}
+  type: {{ .Values.server.service.type }}
+  {{- end}}
+  {{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }}
+  {{- if .Values.server.service.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.server.service.ipFamilyPolicy }}
+  {{- end }}
+  {{- if .Values.server.service.ipFamilies }}
+  ipFamilies: {{ .Values.server.service.ipFamilies | toYaml | nindent 2 }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.server.service.clusterIP }}
+  clusterIP: {{ .Values.server.service.clusterIP }}
+  {{- end }}
+  {{- include "service.externalTrafficPolicy" .Values.server.service }}
+  # We want the servers to become available even if they're not ready
+  # since this DNS is also used for join operations.
+  publishNotReadyAddresses: {{ .Values.server.service.publishNotReadyAddresses }}
+  ports:
+    - name: {{ include "openbao.scheme" . }}
+      port: {{ .Values.server.service.port }}
+      targetPort: {{ .Values.server.service.targetPort }}
+      {{- if and (.Values.server.service.nodePort) (eq (.Values.server.service.type | toString) "NodePort") }}
+      nodePort: {{ .Values.server.service.nodePort }}
+      {{- end }}
+    - name: https-internal
+      port: 8201
+      targetPort: 8201
+  {{- if .Values.server.service.extraPorts -}}
+  {{ toYaml .Values.server.service.extraPorts | nindent 4}}
+  {{- end }}
+  selector:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    {{- if eq (.Values.server.service.instanceSelector.enabled | toString) "true" }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- end }}
+    component: server
+{{- end }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-serviceaccount-secret.yaml b/packages/system/openbao/charts/openbao/templates/server-serviceaccount-secret.yaml
new file mode 100644
index 00000000..e9ab3575
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-serviceaccount-secret.yaml
@@ -0,0 +1,21 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "openbao.serverServiceAccountSecretCreationEnabled" . }}
+{{- if .serverServiceAccountSecretCreationEnabled -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "openbao.serviceAccount.name" . }}-token
+  namespace: {{ include "openbao.namespace" . }}
+  annotations:
+    kubernetes.io/service-account.name: {{ template "openbao.serviceAccount.name" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+type: kubernetes.io/service-account-token
+{{ end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-serviceaccount.yaml b/packages/system/openbao/charts/openbao/templates/server-serviceaccount.yaml
new file mode 100644
index 00000000..aa615200
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-serviceaccount.yaml
@@ -0,0 +1,22 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "openbao.serverServiceAccountEnabled" . }}
+{{- if .serverServiceAccountEnabled -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "openbao.serviceAccount.name" . }}
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- if  .Values.server.serviceAccount.extraLabels -}}
+      {{- toYaml .Values.server.serviceAccount.extraLabels | nindent 4 -}}
+    {{- end -}}
+  {{ template "openbao.serviceAccount.annotations" . }}
+{{ end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-statefulset.yaml b/packages/system/openbao/charts/openbao/templates/server-statefulset.yaml
new file mode 100644
index 00000000..1628d139
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-statefulset.yaml
@@ -0,0 +1,228 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "openbao.mode" . }}
+{{- if ne .mode "external" }}
+{{- if ne .mode "" }}
+{{- if .serverEnabled -}}
+# StatefulSet to run the actual openbao server cluster.
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ template "openbao.fullname" . }}
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+  {{- template "openbao.statefulSet.annotations" . }}
+spec:
+  serviceName: {{ template "openbao.fullname" . }}-internal
+  podManagementPolicy: {{ .Values.server.podManagementPolicy }}
+  replicas: {{ template "openbao.replicas" . }}
+  updateStrategy:
+    type: {{ .Values.server.updateStrategyType }}
+  {{- if and (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) (.Values.server.persistentVolumeClaimRetentionPolicy) }}
+  persistentVolumeClaimRetentionPolicy: {{ toYaml .Values.server.persistentVolumeClaimRetentionPolicy | nindent 4 }}
+  {{- end }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ template "openbao.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      component: server
+  template:
+    metadata:
+      labels:
+        helm.sh/chart: {{ template "openbao.chart" . }}
+        app.kubernetes.io/name: {{ template "openbao.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        component: server
+        {{- if  .Values.server.extraLabels -}}
+          {{- toYaml .Values.server.extraLabels | nindent 8 -}}
+        {{- end -}}
+      {{ template "openbao.annotations" . }}
+    spec:
+      {{ template "openbao.affinity" . }}
+      {{ template "openbao.topologySpreadConstraints" . }}
+      {{ template "openbao.tolerations" . }}
+      {{ template "openbao.nodeselector" . }}
+      {{- if .Values.server.priorityClassName }}
+      priorityClassName: {{ .Values.server.priorityClassName }}
+      {{- end }}
+      terminationGracePeriodSeconds: {{ .Values.server.terminationGracePeriodSeconds }}
+      serviceAccountName: {{ template "openbao.serviceAccount.name" . }}
+      {{ if  .Values.server.shareProcessNamespace }}
+      shareProcessNamespace: true
+      {{ end }}
+      {{- template "server.statefulSet.securityContext.pod" . }}
+      {{- if not .Values.global.openshift }}
+      hostNetwork: {{ .Values.server.hostNetwork }}
+      {{- end }}
+      volumes:
+        {{ template "openbao.volumes" . }}
+        - name: home
+          emptyDir: {}
+      {{- if .Values.server.hostAliases }}
+      hostAliases:
+        {{ toYaml .Values.server.hostAliases | nindent 8}}
+      {{- end }}
+      {{- if .Values.server.extraInitContainers }}
+      initContainers:
+        {{ toYaml .Values.server.extraInitContainers | nindent 8}}
+      {{- end }}
+      containers:
+        - name: openbao
+          {{ template "openbao.resources" . }}
+          image: "{{ .Values.server.image.registry | default "docker.io" }}/{{ .Values.server.image.repository }}:{{ .Values.server.image.tag | default (trimPrefix "v" .Chart.AppVersion) }}"
+          imagePullPolicy: {{ .Values.server.image.pullPolicy }}
+          command:
+          - "/bin/sh"
+          - "-ec"
+          args: {{ template "openbao.args" . }}
+          {{- template "server.statefulSet.securityContext.container" . }}
+          env:
+            - name: HOST_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.hostIP
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+            - name: BAO_K8S_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: BAO_K8S_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: BAO_ADDR
+              value: "{{ include "openbao.scheme" . }}://127.0.0.1:8200"
+            - name: BAO_API_ADDR
+              {{- if .Values.server.ha.apiAddr }}
+              value: {{ .Values.server.ha.apiAddr }}
+              {{- else }}
+              value: "{{ include "openbao.scheme" . }}://$(POD_IP):8200"
+              {{- end }}
+            - name: SKIP_CHOWN
+              value: "true"
+            - name: SKIP_SETCAP
+              value: "true"
+            - name: HOSTNAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: BAO_CLUSTER_ADDR
+              {{- if .Values.server.ha.clusterAddr }}
+              value: {{ .Values.server.ha.clusterAddr | quote }}
+              {{- else }}
+              value: "https://$(HOSTNAME).{{ template "openbao.fullname" . }}-internal:8201"
+              {{- end }}
+            {{- if and (eq (.Values.server.ha.raft.enabled | toString) "true") (eq (.Values.server.ha.raft.setNodeId | toString) "true") }}
+            - name: BAO_RAFT_NODE_ID
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            {{- end }}
+            - name: HOME
+              value: "/home/openbao"
+            {{- if .Values.server.logLevel }}
+            - name: BAO_LOG_LEVEL
+              value: "{{ .Values.server.logLevel }}"
+            {{- end }}
+            {{- if .Values.server.logFormat }}
+            - name: BAO_LOG_FORMAT
+              value: "{{ .Values.server.logFormat }}"
+            {{- end }}
+            {{ template "openbao.envs" . }}
+            {{- include "openbao.extraSecretEnvironmentVars" .Values.server | nindent 12 }}
+            {{- include "openbao.extraEnvironmentVars" .Values.server | nindent 12 }}
+          volumeMounts:
+          {{ template "openbao.mounts" . }}
+            - name: home
+              mountPath: /home/openbao
+          ports:
+            - containerPort: 8200
+              name: {{ include "openbao.scheme" . }}
+            - containerPort: 8201
+              name: https-internal
+            - containerPort: 8202
+              name: {{ include "openbao.scheme" . }}-rep
+          {{- if .Values.server.extraPorts -}}
+          {{ toYaml .Values.server.extraPorts | nindent 12}}
+          {{- end }}
+          {{- if .Values.server.readinessProbe.enabled }}
+          readinessProbe:
+            {{- if .Values.server.readinessProbe.path }}
+            httpGet:
+              path: {{ .Values.server.readinessProbe.path | quote }}
+              port: {{ .Values.server.readinessProbe.port }}
+              scheme: {{ include "openbao.scheme" . | upper }}
+            {{- else }}
+            # Check status; unsealed openbao servers return 0
+            # The exit code reflects the seal status:
+            #   0 - unsealed
+            #   1 - error
+            #   2 - sealed
+            exec:
+              command: ["/bin/sh", "-ec", "bao status -tls-skip-verify"]
+            {{- end }}
+            failureThreshold: {{ .Values.server.readinessProbe.failureThreshold }}
+            initialDelaySeconds: {{ .Values.server.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.server.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.server.readinessProbe.successThreshold }}
+            timeoutSeconds: {{ .Values.server.readinessProbe.timeoutSeconds }}
+          {{- end }}
+          {{- if .Values.server.livenessProbe.enabled }}
+          livenessProbe:
+            {{- if .Values.server.livenessProbe.execCommand }}
+            exec:
+              command:
+                {{- range (.Values.server.livenessProbe.execCommand) }}
+                - {{ . | quote }}
+                {{- end }}
+            {{- else }}
+            httpGet:
+              path: {{ .Values.server.livenessProbe.path | quote }}
+              port: {{ .Values.server.livenessProbe.port }}
+              scheme: {{ include "openbao.scheme" . | upper }}
+            {{- end }}
+            failureThreshold: {{ .Values.server.livenessProbe.failureThreshold }}
+            initialDelaySeconds: {{ .Values.server.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.server.livenessProbe.periodSeconds }}
+            successThreshold: {{ .Values.server.livenessProbe.successThreshold }}
+            timeoutSeconds: {{ .Values.server.livenessProbe.timeoutSeconds }}
+          {{- end }}
+          lifecycle:
+            # openbao container doesn't receive SIGTERM from Kubernetes
+            # and after the grace period ends, Kube sends SIGKILL.  This
+            # causes issues with graceful shutdowns such as deregistering itself
+            # from Consul (zombie services).
+            preStop:
+              exec:
+                command: [
+                  "/bin/sh", "-c",
+                  # Adding a sleep here to give the pod eviction a
+                  # chance to propagate, so requests will not be made
+                  # to this pod while it's terminating
+                  "sleep {{ .Values.server.preStopSleepSeconds }} && kill -SIGTERM $(pidof bao)",
+                ]
+            {{- if .Values.server.postStart }}
+            postStart:
+              exec:
+                command:
+                {{- range (.Values.server.postStart) }}
+                - {{ . | quote }}
+                {{- end }}
+            {{- end }}
+        {{- if .Values.server.extraContainers }}
+          {{ toYaml .Values.server.extraContainers | nindent 8}}
+        {{- end }}
+      {{- include "imagePullSecrets" . | nindent 6 }}
+  {{ template "openbao.volumeclaims" . }}
+{{ end }}
+{{ end }}
+{{ end }}
diff --git a/packages/system/openbao/charts/openbao/templates/server-tlsroute.yaml b/packages/system/openbao/charts/openbao/templates/server-tlsroute.yaml
new file mode 100644
index 00000000..14bd0d34
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/server-tlsroute.yaml
@@ -0,0 +1,41 @@
+{{ template "openbao.mode" . }}
+{{- if ne .mode "external" }}
+{{- if .Values.server.gateway.tlsRoute.enabled -}}
+{{- $serviceName := include "openbao.fullname" . -}}
+{{- template "openbao.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+{{- if and (eq .mode "ha" ) (eq (.Values.server.gateway.tlsRoute.activeService | toString) "true") }}
+{{- $serviceName = printf "%s-%s" $serviceName "active" -}}
+{{- end }}
+{{- $servicePort := .Values.server.service.port -}}
+{{- $kubeVersion := .Capabilities.KubeVersion.Version }}
+apiVersion: {{ .Values.server.gateway.tlsRoute.apiVersion }}
+kind: TLSRoute
+metadata:
+  name: {{ template "openbao.fullname" . }}
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- with .Values.server.gateway.tlsRoute.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- template "openbao.gateway.tlsRoute.annotations" . }}
+spec:
+  hostnames:
+  {{- range .Values.server.gateway.tlsRoute.hosts }}
+    - {{ . | quote }}
+  {{- end }}
+  parentRefs:
+  {{- with .Values.server.gateway.tlsRoute.parentRefs }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    - backendRefs:
+        - name: {{ $serviceName }} 
+          port: {{ $servicePort }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/snapshotagent-configmap.yaml b/packages/system/openbao/charts/openbao/templates/snapshotagent-configmap.yaml
new file mode 100644
index 00000000..60be5505
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/snapshotagent-configmap.yaml
@@ -0,0 +1,31 @@
+
+---
+{{- if .Values.snapshotAgent.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "openbao.fullname" . }}-snapshot
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+data:
+  S3_HOST: {{ .Values.snapshotAgent.config.s3Host }}
+  S3_BUCKET: {{ .Values.snapshotAgent.config.s3Bucket }}
+  {{- if .Values.snapshotAgent.config.s3cmdExtraFlag }}
+  S3CMD_EXTRA_FLAG: {{ .Values.snapshotAgent.config.s3cmdExtraFlag }}
+  {{- end }}
+  S3_URI: {{ .Values.snapshotAgent.config.s3Uri }}
+  S3_EXPIRE_DAYS: {{ .Values.snapshotAgent.config.s3ExpireDays | quote }}
+  BAO_AUTH_PATH: {{ .Values.snapshotAgent.config.baoAuthPath }}
+  BAO_ROLE: {{ .Values.snapshotAgent.config.baoRole }}
+  {{- if include "openbao.externalAddr" . }}
+  BAO_ADDR: "{{ include "openbao.externalAddr" . }}"
+  {{- else if and (eq .mode "ha") (eq (.Values.server.service.active.enabled | toString) "true")}}
+  BAO_ADDR: {{ include "openbao.scheme" . }}://{{ template "openbao.fullname" . }}-active.{{ include "openbao.namespace" . }}.svc:{{ .Values.server.service.port }}
+  {{- else }}
+  BAO_ADDR: {{ include "openbao.scheme" . }}://{{ template "openbao.fullname" . }}.{{ include "openbao.namespace" . }}.svc:{{ .Values.server.service.port }}
+  {{- end }}
+{{ end }}
diff --git a/packages/system/openbao/charts/openbao/templates/snapshotagent-cronjob.yaml b/packages/system/openbao/charts/openbao/templates/snapshotagent-cronjob.yaml
new file mode 100644
index 00000000..e1efadc0
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/snapshotagent-cronjob.yaml
@@ -0,0 +1,66 @@
+{{- if .Values.snapshotAgent.enabled }}
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  labels:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+  {{- template "openbao.snapshotAgent.annotations" . }}
+  name: {{ template "openbao.fullname" . }}-snapshot
+  namespace: {{ include "openbao.namespace" . }}
+spec:
+  schedule: {{ .Values.snapshotAgent.schedule | quote }}
+  jobTemplate:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ include "openbao.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        component: snapshot-agent
+    spec:
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: {{ include "openbao.name" . }}
+            app.kubernetes.io/instance: {{ .Release.Name }}
+            component: snapshot-agent
+        spec:
+          restartPolicy: {{ .Values.snapshotAgent.restartPolicy }}
+          serviceAccountName: {{  template "openbao.snapshotAgent.serviceAccount.name" . }}
+          {{ template "snapshotAgent.securityContext.pod" .}}
+          containers:
+          - name: bao-snapshot
+            envFrom:
+            - configMapRef:
+                name: {{ template "openbao.fullname" . }}-snapshot
+            env:
+            - name: AWS_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  key: AWS_SECRET_ACCESS_KEY
+                  name: {{ .Values.snapshotAgent.s3CredentialsSecret }}
+            - name: AWS_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  key: AWS_ACCESS_KEY_ID
+                  name: {{ .Values.snapshotAgent.s3CredentialsSecret }}
+            {{- include "openbao.extraSecretEnvironmentVars" .Values.snapshotAgent | nindent 12 }}
+            {{- include "openbao.extraEnvironmentVars" .Values.snapshotAgent | nindent 12 }}
+            image: {{ .Values.snapshotAgent.image.repository }}:{{ .Values.snapshotAgent.image.tag }}
+            {{ template "openbao.snapshotAgent.resources". }}
+            {{ template "snapshotAgent.securityContext.container" .}}
+            volumeMounts:
+              - name: snapshot-dir
+                mountPath: /bao-snapshots
+              {{- with .Values.snapshotAgent.extraVolumeMounts }}
+              {{- toYaml . | nindent 14 }}
+              {{- end }}
+            imagePullPolicy: IfNotPresent
+          volumes:
+          - name: snapshot-dir
+            emptyDir: {}
+          {{- if .Values.snapshotAgent.extraVolumes }}
+            {{- toYaml .Values.snapshotAgent.extraVolumes | nindent 10 }}
+          {{- end }}
+{{ end }}
diff --git a/packages/system/openbao/charts/openbao/templates/snapshotagent-serviceaccount.yaml b/packages/system/openbao/charts/openbao/templates/snapshotagent-serviceaccount.yaml
new file mode 100644
index 00000000..25fa3cb9
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/snapshotagent-serviceaccount.yaml
@@ -0,0 +1,16 @@
+{{- if and .Values.snapshotAgent.enabled .Values.snapshotAgent.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "openbao.snapshotAgent.serviceAccount.name" . }}
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- if  .Values.snapshotAgent.serviceAccount.extraLabels -}}
+      {{- toYaml .Values.snapshotAgent.serviceAccount.extraLabels | nindent 4 -}}
+    {{- end -}}
+  {{ template "openbao.snapshotAgent.serviceAccount.annotations" . }}
+{{ end }}
diff --git a/packages/system/openbao/charts/openbao/templates/tests/server-test.yaml b/packages/system/openbao/charts/openbao/templates/tests/server-test.yaml
new file mode 100644
index 00000000..8c42752e
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/tests/server-test.yaml
@@ -0,0 +1,56 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "openbao.mode" . }}
+{{- if ne .mode "external" }}
+{{- if .serverEnabled -}}
+apiVersion: v1
+kind: Pod
+metadata:
+  name: {{ template "openbao.fullname" . }}-server-test
+  namespace: {{ include "openbao.namespace" . }}
+  annotations:
+    "helm.sh/hook": test
+spec:
+  {{- include "imagePullSecrets" . | nindent 2 }}
+  containers:
+    - name: {{ .Release.Name }}-server-test
+      image: {{ .Values.server.image.registry | default "docker.io" }}/{{ .Values.server.image.repository }}:{{ .Values.server.image.tag | default (trimPrefix "v" .Chart.AppVersion) }}
+      imagePullPolicy: {{ .Values.server.image.pullPolicy }}
+      env:
+        - name: VAULT_ADDR
+          value: {{ include "openbao.scheme" . }}://{{ template "openbao.fullname" . }}.{{ include "openbao.namespace" . }}.svc:{{ .Values.server.service.port }}
+        {{- include "openbao.extraEnvironmentVars" .Values.server | nindent 8 }}
+      command:
+        - /bin/sh
+        - -c
+        - |
+          echo "Checking for sealed info in 'bao status' output"
+          ATTEMPTS=10
+          n=0
+          until [ "$n" -ge $ATTEMPTS ]
+          do
+            echo "Attempt" $n...
+            bao status -format yaml | grep -E '^sealed: (true|false)' && break
+            n=$((n+1))
+            sleep 5
+          done
+          if [ $n -ge $ATTEMPTS ]; then
+            echo "timed out looking for sealed info in 'bao status' output"
+            exit 1
+          fi
+
+          exit 0
+      volumeMounts:
+        {{- if .Values.server.volumeMounts }}
+          {{- toYaml .Values.server.volumeMounts | nindent 8}}
+        {{- end }}
+  volumes:
+    {{- if .Values.server.volumes }}
+      {{- toYaml .Values.server.volumes | nindent 4}}
+    {{- end }}
+  restartPolicy: Never
+{{- end }}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/templates/ui-service.yaml b/packages/system/openbao/charts/openbao/templates/ui-service.yaml
new file mode 100644
index 00000000..17ec0012
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/templates/ui-service.yaml
@@ -0,0 +1,53 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "openbao.mode" . }}
+{{- if ne .mode "external" }}
+{{- template "openbao.uiEnabled" . -}}
+{{- if .uiEnabled -}}
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "openbao.fullname" . }}-ui
+  namespace: {{ include "openbao.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "openbao.chart" . }}
+    app.kubernetes.io/name: {{ include "openbao.name" . }}-ui
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- if  .Values.ui.extraLabels -}}
+      {{- toYaml .Values.ui.extraLabels | nindent 4 -}}
+    {{- end -}}
+  {{- template "openbao.ui.annotations" . }}
+spec:
+  {{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }}
+  {{- if .Values.ui.serviceIPFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.ui.serviceIPFamilyPolicy }}
+  {{- end }}
+  {{- if .Values.ui.serviceIPFamilies }}
+  ipFamilies: {{ .Values.ui.serviceIPFamilies | toYaml | nindent 2 }}
+  {{- end }}
+  {{- end }}
+  selector:
+    app.kubernetes.io/name: {{ include "openbao.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    component: server
+    {{- if and (.Values.ui.activeOpenbaoPodOnly) (eq .mode "ha") }}
+    openbao-active: "true"
+    {{- end }}
+  publishNotReadyAddresses: {{ .Values.ui.publishNotReadyAddresses }}
+  ports:
+    - name: {{ include "openbao.scheme" . }}
+      port: {{ .Values.ui.externalPort }}
+      targetPort: {{ .Values.ui.targetPort }}
+      {{- if .Values.ui.serviceNodePort }}
+      nodePort: {{ .Values.ui.serviceNodePort }}
+      {{- end }}
+  type: {{ .Values.ui.serviceType }}
+  {{- include "service.externalTrafficPolicy" .Values.ui }}
+  {{- include "service.loadBalancer" .Values.ui }}
+{{- end -}}
+{{- end }}
diff --git a/packages/system/openbao/charts/openbao/values.openshift.yaml b/packages/system/openbao/charts/openbao/values.openshift.yaml
new file mode 100644
index 00000000..964a81b0
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/values.openshift.yaml
@@ -0,0 +1,30 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+# These overrides are appropriate defaults for deploying this chart on OpenShift
+
+global:
+  openshift: true
+
+injector:
+  image:
+    repository: "registry.connect.redhat.com/hashicorp/vault-k8s"
+    tag: "1.3.1-ubi"
+
+  agentImage:
+    registry: "quay.io"
+    repository: "openbao/openbao-ubi"
+    tag: "2.3.2"
+    # Use UBI-based OpenBao image for better OpenShift compatibility
+    # See: https://openbao.org/docs/install/#container-registries
+
+server:
+  image:
+    registry: "quay.io"
+    repository: "openbao/openbao-ubi"
+    tag: "2.3.2"
+    # Use UBI-based OpenBao image for better OpenShift compatibility
+    # See: https://openbao.org/docs/install/#container-registries
+
+  readinessProbe:
+    path: "/v1/sys/health?uninitcode=204"
diff --git a/packages/system/openbao/charts/openbao/values.schema.json b/packages/system/openbao/charts/openbao/values.schema.json
new file mode 100644
index 00000000..75298366
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/values.schema.json
@@ -0,0 +1,1207 @@
+{
+    "$schema": "http://json-schema.org/schema#",
+    "type": "object",
+    "properties": {
+        "csi": {
+            "type": "object",
+            "properties": {
+                "agent": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "extraArgs": {
+                            "type": "array"
+                        },
+                        "image": {
+                            "type": "object",
+                            "properties": {
+                                "pullPolicy": {
+                                    "type": "string"
+                                },
+                                "repository": {
+                                    "type": "string"
+                                },
+                                "tag": {
+                                    "type": "string"
+                                }
+                            }
+                        },
+                        "logFormat": {
+                            "type": "string"
+                        },
+                        "logLevel": {
+                            "type": "string"
+                        },
+                        "resources": {
+                            "type": "object"
+                        }
+                    }
+                },
+                "daemonSet": {
+                    "type": "object",
+                    "properties": {
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "extraLabels": {
+                            "type": "object"
+                        },
+                        "kubeletRootDir": {
+                            "type": "string"
+                        },
+                        "providersDir": {
+                            "type": "string"
+                        },
+                        "securityContext": {
+                            "type": "object",
+                            "properties": {
+                                "container": {
+                                    "type": [
+                                        "object",
+                                        "string"
+                                    ]
+                                },
+                                "pod": {
+                                    "type": [
+                                        "object",
+                                        "string"
+                                    ]
+                                }
+                            }
+                        },
+                        "updateStrategy": {
+                            "type": "object",
+                            "properties": {
+                                "maxUnavailable": {
+                                    "type": "string"
+                                },
+                                "type": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    }
+                },
+                "debug": {
+                    "type": "boolean"
+                },
+                "enabled": {
+                    "type": [
+                        "boolean",
+                        "string"
+                    ]
+                },
+                "extraArgs": {
+                    "type": "array"
+                },
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "pullPolicy": {
+                            "type": "string"
+                        },
+                        "repository": {
+                            "type": "string"
+                        },
+                        "tag": {
+                            "type": "string"
+                        }
+                    }
+                },
+                "livenessProbe": {
+                    "type": "object",
+                    "properties": {
+                        "failureThreshold": {
+                            "type": "integer"
+                        },
+                        "initialDelaySeconds": {
+                            "type": "integer"
+                        },
+                        "periodSeconds": {
+                            "type": "integer"
+                        },
+                        "successThreshold": {
+                            "type": "integer"
+                        },
+                        "timeoutSeconds": {
+                            "type": "integer"
+                        }
+                    }
+                },
+                "pod": {
+                    "type": "object",
+                    "properties": {
+                        "affinity": {
+                            "type": [
+                              "null",
+                              "object",
+                              "string"
+                            ]
+                        },
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "extraLabels": {
+                            "type": "object"
+                        },
+                        "nodeSelector": {
+                            "type": [
+                              "null",
+                              "object",
+                              "string"
+                            ]
+                        },
+                        "tolerations": {
+                            "type": [
+                                "null",
+                                "array",
+                                "string"
+                            ]
+                        }
+                    }
+                },
+                "priorityClassName": {
+                    "type": "string"
+                },
+                "readinessProbe": {
+                    "type": "object",
+                    "properties": {
+                        "failureThreshold": {
+                            "type": "integer"
+                        },
+                        "initialDelaySeconds": {
+                            "type": "integer"
+                        },
+                        "periodSeconds": {
+                            "type": "integer"
+                        },
+                        "successThreshold": {
+                            "type": "integer"
+                        },
+                        "timeoutSeconds": {
+                            "type": "integer"
+                        }
+                    }
+                },
+                "resources": {
+                    "type": "object"
+                },
+                "serviceAccount": {
+                    "type": "object",
+                    "properties": {
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "extraLabels": {
+                            "type": "object"
+                        }
+                    }
+                },
+                "volumeMounts": {
+                    "type": [
+                        "null",
+                        "array"
+                    ]
+                },
+                "volumes": {
+                    "type": [
+                        "null",
+                        "array"
+                    ]
+                }
+            }
+        },
+        "global": {
+            "type": "object",
+            "properties": {
+                "enabled": {
+                    "type": "boolean"
+                },
+                "namespace": {
+                    "type": "string"
+                },
+                "externalVaultAddr": {
+                    "type": "string"
+                },
+                "externalBaoAddr": {
+                    "type": "string"
+                },
+                "imagePullSecrets": {
+                    "type": "array"
+                },
+                "openshift": {
+                    "type": "boolean"
+                },
+                "psp": {
+                    "type": "object",
+                    "properties": {
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "enable": {
+                            "type": "boolean"
+                        }
+                    }
+                },
+                "tlsDisable": {
+                    "type": "boolean"
+                }
+            }
+        },
+        "injector": {
+            "type": "object",
+            "properties": {
+                "affinity": {
+                    "type": [
+                        "object",
+                        "string"
+                    ]
+                },
+                "agentDefaults": {
+                    "type": "object",
+                    "properties": {
+                        "cpuLimit": {
+                            "type": "string"
+                        },
+                        "cpuRequest": {
+                            "type": "string"
+                        },
+                        "memLimit": {
+                            "type": "string"
+                        },
+                        "memRequest": {
+                            "type": "string"
+                        },
+                        "ephemeralLimit": {
+                            "type": "string"
+                        },
+                        "ephemeralRequest": {
+                            "type": "string"
+                        },
+                        "template": {
+                            "type": "string"
+                        },
+                        "templateConfig": {
+                            "type": "object",
+                            "properties": {
+                                "exitOnRetryFailure": {
+                                    "type": "boolean"
+                                },
+                                "staticSecretRenderInterval": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    }
+                },
+                "agentImage": {
+                    "type": "object",
+                    "properties": {
+                        "repository": {
+                            "type": "string"
+                        },
+                        "tag": {
+                            "type": "string"
+                        }
+                    }
+                },
+                "annotations": {
+                    "type": [
+                        "object",
+                        "string"
+                    ]
+                },
+                "authPath": {
+                    "type": "string"
+                },
+                "certs": {
+                    "type": "object",
+                    "properties": {
+                        "caBundle": {
+                            "type": "string"
+                        },
+                        "certName": {
+                            "type": "string"
+                        },
+                        "keyName": {
+                            "type": "string"
+                        },
+                        "secretName": {
+                            "type": [
+                                "null",
+                                "string"
+                            ]
+                        }
+                    }
+                },
+                "enabled": {
+                    "type": [
+                        "boolean",
+                        "string"
+                    ]
+                },
+                "externalVaultAddr": {
+                    "type": "string"
+                },
+                "extraEnvironmentVars": {
+                    "type": "object"
+                },
+                "extraLabels": {
+                    "type": "object"
+                },
+                "failurePolicy": {
+                    "type": "string"
+                },
+                "hostNetwork": {
+                    "type": "boolean"
+                },
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "pullPolicy": {
+                            "type": "string"
+                        },
+                        "repository": {
+                            "type": "string"
+                        },
+                        "tag": {
+                            "type": "string"
+                        }
+                    }
+                },
+                "leaderElector": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean"
+                        }
+                    }
+                },
+                "logFormat": {
+                    "type": "string"
+                },
+                "logLevel": {
+                    "type": "string"
+                },
+                "metrics": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean"
+                        }
+                    }
+                },
+                "namespaceSelector": {
+                    "type": "object"
+                },
+                "nodeSelector": {
+                    "type": [
+                        "null",
+                        "object",
+                        "string"
+                    ]
+                },
+                "objectSelector": {
+                    "type": [
+                        "object",
+                        "string"
+                    ]
+                },
+                "podDisruptionBudget": {
+                    "type": "object"
+                },
+                "port": {
+                    "type": "integer"
+                },
+                "priorityClassName": {
+                    "type": "string"
+                },
+                "replicas": {
+                    "type": "integer"
+                },
+                "resources": {
+                    "type": "object"
+                },
+                "revokeOnShutdown": {
+                    "type": "boolean"
+                },
+                "securityContext": {
+                    "type": "object",
+                    "properties": {
+                        "container": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "pod": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        }
+                    }
+                },
+                "service": {
+                    "type": "object",
+                    "properties": {
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        }
+                    }
+                },
+                "serviceAccount": {
+                    "type": "object",
+                    "properties": {
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        }
+                    }
+                },
+                "strategy": {
+                    "type": [
+                        "object",
+                        "string"
+                    ]
+                },
+                "tolerations": {
+                    "type": [
+                        "null",
+                        "array",
+                        "string"
+                    ]
+                },
+                "topologySpreadConstraints": {
+                    "type": [
+                        "null",
+                        "array",
+                        "string"
+                    ]
+                },
+                "webhook": {
+                    "type": "object",
+                    "properties": {
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "failurePolicy": {
+                            "type": "string"
+                        },
+                        "matchPolicy": {
+                            "type": "string"
+                        },
+                        "namespaceSelector": {
+                            "type": "object"
+                        },
+                        "objectSelector": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "timeoutSeconds": {
+                            "type": "integer"
+                        }
+                    }
+                },
+                "webhookAnnotations": {
+                    "type": [
+                        "object",
+                        "string"
+                    ]
+                }
+            }
+        },
+        "server": {
+            "type": "object",
+            "properties": {
+                "affinity": {
+                    "type": [
+                        "object",
+                        "string"
+                    ]
+                },
+                "annotations": {
+                    "type": [
+                        "object",
+                        "string"
+                    ]
+                },
+                "auditStorage": {
+                    "type": "object",
+                    "properties": {
+                        "accessMode": {
+                            "type": "string"
+                        },
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "labels": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "enabled": {
+                            "type": [
+                                "boolean",
+                                "string"
+                            ]
+                        },
+                        "mountPath": {
+                            "type": "string"
+                        },
+                        "size": {
+                            "type": "string"
+                        },
+                        "storageClass": {
+                            "type": [
+                                "null",
+                                "string"
+                            ]
+                        }
+                    }
+                },
+                "authDelegator": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean"
+                        }
+                    }
+                },
+                "dataStorage": {
+                    "type": "object",
+                    "properties": {
+                        "accessMode": {
+                            "type": "string"
+                        },
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "labels": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "enabled": {
+                            "type": [
+                                "boolean",
+                                "string"
+                            ]
+                        },
+                        "mountPath": {
+                            "type": "string"
+                        },
+                        "size": {
+                            "type": "string"
+                        },
+                        "storageClass": {
+                            "type": [
+                                "null",
+                                "string"
+                            ]
+                        }
+                    }
+                },
+                "persistentVolumeClaimRetentionPolicy": {
+                    "type": "object",
+                    "properties": {
+                        "whenDeleted": {
+                            "type": "string"
+                        },
+                        "whenScaled": {
+                            "type": "string"
+                        }
+                    }
+                },
+                "dev": {
+                    "type": "object",
+                    "properties": {
+                        "devRootToken": {
+                            "type": "string"
+                        },
+                        "enabled": {
+                            "type": "boolean"
+                        }
+                    }
+                },
+                "enabled": {
+                    "type": [
+                        "boolean",
+                        "string"
+                    ]
+                },
+                "extraArgs": {
+                    "type": "string"
+                },
+                "extraPorts": {
+                    "type": [
+                        "null",
+                        "array"
+                    ]
+                },
+                "extraContainers": {
+                    "type": [
+                        "null",
+                        "array"
+                    ]
+                },
+                "extraEnvironmentVars": {
+                    "type": "object"
+                },
+                "extraInitContainers": {
+                    "type": [
+                        "null",
+                        "array"
+                    ]
+                },
+                "extraLabels": {
+                    "type": "object"
+                },
+                "extraSecretEnvironmentVars": {
+                    "type": "array"
+                },
+                "extraVolumes": {
+                    "type": "array"
+                },
+                "ha": {
+                    "type": "object",
+                    "properties": {
+                        "apiAddr": {
+                            "type": [
+                                "null",
+                                "string"
+                            ]
+                        },
+                        "clusterAddr": {
+                            "type": [
+                                "null",
+                                "string"
+                            ]
+                        },
+                        "config": {
+                            "type": [
+                                "string",
+                                "object"
+                            ]
+                        },
+                        "disruptionBudget": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean"
+                                },
+                                "maxUnavailable": {
+                                    "type": [
+                                        "null",
+                                        "integer"
+                                    ]
+                                }
+                            }
+                        },
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "raft": {
+                            "type": "object",
+                            "properties": {
+                                "config": {
+                                    "type": [
+                                        "string",
+                                        "object"
+                                    ]
+                                },
+                                "enabled": {
+                                    "type": "boolean"
+                                },
+                                "setNodeId": {
+                                    "type": "boolean"
+                                }
+                            }
+                        },
+                        "replicas": {
+                            "type": "integer"
+                        }
+                    }
+                },
+                "hostAliases": {
+                    "type": "array"
+                },
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "pullPolicy": {
+                            "type": "string"
+                        },
+                        "repository": {
+                            "type": "string"
+                        },
+                        "tag": {
+                            "type": "string"
+                        }
+                    }
+                },
+                "ingress": {
+                    "type": "object",
+                    "properties": {
+                        "activeService": {
+                            "type": "boolean"
+                        },
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "extraPaths": {
+                            "type": "array"
+                        },
+                        "hosts": {
+                            "type": "array",
+                            "items": {
+                                "type": "object",
+                                "properties": {
+                                    "host": {
+                                        "type": "string"
+                                    },
+                                    "paths": {
+                                        "type": "array"
+                                    }
+                                }
+                            }
+                        },
+                        "ingressClassName": {
+                            "type": "string"
+                        },
+                        "labels": {
+                            "type": "object"
+                        },
+                        "pathType": {
+                            "type": "string"
+                        },
+                        "tls": {
+                            "type": "array"
+                        }
+                    }
+                },
+                "livenessProbe": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "failureThreshold": {
+                            "type": "integer"
+                        },
+                        "initialDelaySeconds": {
+                            "type": "integer"
+                        },
+                        "path": {
+                            "type": "string"
+                        },
+                        "port": {
+                            "type": "integer"
+                        },
+                        "execCommand": {
+                            "type": "array"
+                        },
+                        "periodSeconds": {
+                            "type": "integer"
+                        },
+                        "successThreshold": {
+                            "type": "integer"
+                        },
+                        "timeoutSeconds": {
+                            "type": "integer"
+                        }
+                    }
+                },
+                "logFormat": {
+                    "type": "string"
+                },
+                "logLevel": {
+                    "type": "string"
+                },
+                "networkPolicy": {
+                    "type": "object",
+                    "properties": {
+                        "egress": {
+                            "type": "array"
+                        },
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "ingress": {
+                            "type": "array"
+                        }
+                    }
+                },
+                "nodeSelector": {
+                    "type": [
+                        "null",
+                        "object",
+                        "string"
+                    ]
+                },
+                "postStart": {
+                    "type": "array"
+                },
+                "preStopSleepSeconds": {
+                    "type": "integer"
+                },
+                "priorityClassName": {
+                    "type": "string"
+                },
+                "readinessProbe": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "failureThreshold": {
+                            "type": "integer"
+                        },
+                        "initialDelaySeconds": {
+                            "type": "integer"
+                        },
+                        "periodSeconds": {
+                            "type": "integer"
+                        },
+                        "successThreshold": {
+                            "type": "integer"
+                        },
+                        "timeoutSeconds": {
+                            "type": "integer"
+                        }
+                    }
+                },
+                "resources": {
+                    "type": "object"
+                },
+                "route": {
+                    "type": "object",
+                    "properties": {
+                        "activeService": {
+                            "type": "boolean"
+                        },
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "host": {
+                            "type": "string"
+                        },
+                        "labels": {
+                            "type": "object"
+                        },
+                        "tls": {
+                            "type": "object"
+                        }
+                    }
+                },
+                "service": {
+                    "type": "object",
+                    "properties": {
+                        "active": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean"
+                                },
+                                "annotations": {
+                                    "type": [
+                                        "object",
+                                        "string"
+                                    ]
+                                }
+                            }
+                        },
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "externalTrafficPolicy": {
+                            "type": "string"
+                        },
+                        "instanceSelector": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean"
+                                }
+                            }
+                        },
+                        "port": {
+                            "type": "integer"
+                        },
+                        "publishNotReadyAddresses": {
+                            "type": "boolean"
+                        },
+                        "standby": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean"
+                                },
+                                "annotations": {
+                                    "type": [
+                                        "object",
+                                        "string"
+                                    ]
+                                }
+                            }
+                        },
+                        "targetPort": {
+                            "type": "integer"
+                        },
+                        "nodePort": {
+                            "type": "integer"
+                        },
+                        "activeNodePort": {
+                            "type": "integer"
+                        },
+                        "standbyNodePort": {
+                            "type": "integer"
+                        },
+                        "ipFamilyPolicy": {
+                            "type": "string"
+                        },
+                        "ipFamilies": {
+                            "type": [
+                                "array"
+                            ]
+                        }
+                    }
+                },
+                "serviceAccount": {
+                    "type": "object",
+                    "properties": {
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "create": {
+                            "type": "boolean"
+                        },
+                        "extraLabels": {
+                            "type": "object"
+                        },
+                        "createSecret": {
+                            "type": "boolean"
+                        },
+                        "name": {
+                            "type": "string"
+                        },
+                        "serviceDiscovery": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean"
+                                }
+                            }
+                        }
+                    }
+                },
+                "shareProcessNamespace": {
+                    "type": "boolean"
+                },
+                "standalone": {
+                    "type": "object",
+                    "properties": {
+                        "config": {
+                            "type": [
+                                "string",
+                                "object"
+                            ]
+                        },
+                        "enabled": {
+                            "type": [
+                                "string",
+                                "boolean"
+                            ]
+                        }
+                    }
+                },
+                "statefulSet": {
+                    "type": "object",
+                    "properties": {
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "securityContext": {
+                            "type": "object",
+                            "properties": {
+                                "container": {
+                                    "type": [
+                                        "object",
+                                        "string"
+                                    ]
+                                },
+                                "pod": {
+                                    "type": [
+                                        "object",
+                                        "string"
+                                    ]
+                                }
+                            }
+                        }
+                    }
+                },
+                "terminationGracePeriodSeconds": {
+                    "type": "integer"
+                },
+                "tolerations": {
+                    "type": [
+                        "null",
+                        "array",
+                        "string"
+                    ]
+                },
+                "topologySpreadConstraints": {
+                    "type": [
+                        "null",
+                        "array",
+                        "string"
+                    ]
+                },
+                "updateStrategyType": {
+                    "type": "string"
+                },
+                "volumeMounts": {
+                    "type": [
+                        "null",
+                        "array"
+                    ]
+                },
+                "volumes": {
+                    "type": [
+                        "null",
+                        "array"
+                    ]
+                },
+                "hostNetwork": {
+                    "type": "boolean"
+                }
+            }
+        },
+        "serverTelemetry": {
+            "type": "object",
+            "properties": {
+                "prometheusRules": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "rules": {
+                            "type": "array"
+                        },
+                        "selectors": {
+                            "type": "object"
+                        }
+                    }
+                }
+            }
+        },
+        "ui": {
+            "type": "object",
+            "properties": {
+                "activeOpenbaoPodOnly": {
+                    "type": "boolean"
+                },
+                "annotations": {
+                    "type": [
+                        "object",
+                        "string"
+                    ]
+                },
+                "enabled": {
+                    "type": [
+                        "boolean",
+                        "string"
+                    ]
+                },
+                "externalPort": {
+                    "type": "integer"
+                },
+                "externalTrafficPolicy": {
+                    "type": "string"
+                },
+                "publishNotReadyAddresses": {
+                    "type": "boolean"
+                },
+                "serviceNodePort": {
+                    "type": [
+                        "null",
+                        "integer"
+                    ]
+                },
+                "serviceType": {
+                    "type": "string"
+                },
+                "targetPort": {
+                    "type": "integer"
+                },
+                "serviceIPFamilyPolicy": {
+                    "type": [
+                        "string"
+                    ]
+                },
+                "serviceIPFamilies": {
+                    "type": [
+                        "array"
+                    ]
+                }
+            }
+        }
+    }
+}
diff --git a/packages/system/openbao/charts/openbao/values.yaml b/packages/system/openbao/charts/openbao/values.yaml
new file mode 100644
index 00000000..7e2f604f
--- /dev/null
+++ b/packages/system/openbao/charts/openbao/values.yaml
@@ -0,0 +1,1583 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+# Available parameters and their default values for the OpenBao chart.
+
+global:
+  # -- enabled is the master enabled switch. Setting this to true or false
+  # will enable or disable all the components within this chart by default.
+  enabled: true
+
+  # -- The namespace to deploy to. Defaults to the `helm` installation namespace.
+  namespace: ""
+
+  # -- Image pull secret to use for registry authentication.
+  # Alternatively, the value may be specified as an array of strings.
+  imagePullSecrets: []
+  # imagePullSecrets:
+  #   - name: image-pull-secret
+
+  # -- TLS for end-to-end encrypted transport
+  tlsDisable: true
+
+  # -- External openbao server address for the injector and CSI provider to use.
+  # Setting this will disable deployment of a openbao server.
+  externalBaoAddr: ""
+  # -- Deprecated: Please use global.externalBaoAddr instead.
+  externalVaultAddr: ""
+
+  # -- If deploying to OpenShift
+  openshift: false
+
+  # -- Create PodSecurityPolicy for pods
+  psp:
+    enable: false
+    # -- Annotation for PodSecurityPolicy.
+    # This is a multi-line templated string map, and can also be set as YAML.
+    annotations: |
+      seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default
+      apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
+      seccomp.security.alpha.kubernetes.io/defaultProfileName:  runtime/default
+      apparmor.security.beta.kubernetes.io/defaultProfileName:  runtime/default
+
+  serverTelemetry:
+    # -- Enable integration with the Prometheus Operator
+    # See the top level serverTelemetry section below before enabling this feature.
+    prometheusOperator: false
+
+injector:
+  # -- True if you want to enable openbao agent injection. @default: global.enabled
+  enabled: "-"
+
+  replicas: 1
+
+  # -- Configures the port the injector should listen on
+  port: 8080
+
+  # -- If multiple replicas are specified, by default a leader will be determined
+  # so that only one injector attempts to create TLS certificates.
+  leaderElector:
+    enabled: true
+
+  # -- If true, will enable a node exporter metrics endpoint at /metrics.
+  metrics:
+    enabled: false
+
+  # -- Deprecated: Please use global.externalBaoAddr instead.
+  externalVaultAddr: ""
+
+  # image sets the repo and tag of the vault-k8s image to use for the injector.
+  image:
+    # -- image registry to use for k8s image
+    registry: "docker.io"
+    # -- image repo to use for k8s image
+    repository: "hashicorp/vault-k8s"
+    # -- image tag to use for k8s image
+    tag: "1.7.2"
+    # -- image pull policy to use for k8s image. if tag is "latest", set to "Always"
+    pullPolicy: IfNotPresent
+
+  # -- agentImage sets the repo and tag of the OpenBao image to use for the OpenBao Agent
+  # containers.  This should be set to the official OpenBao image.  OpenBao 1.3.1+ is
+  # required.
+  agentImage:
+    # -- image registry to use for agent image
+    registry: "quay.io"
+    # -- image repo to use for agent image
+    repository: "openbao/openbao"
+    # -- image tag to use for agent image - defaults to chart appVersion
+    tag: ""
+    # -- image pull policy to use for agent image. if tag is "latest", set to "Always"
+    pullPolicy: IfNotPresent
+
+  # The default values for the injected OpenBao Agent containers.
+  agentDefaults:
+    # For more information on configuring resources, see the K8s documentation:
+    # https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+    cpuLimit: "500m"
+    cpuRequest: "250m"
+    memLimit: "128Mi"
+    memRequest: "64Mi"
+    # ephemeralLimit: "128Mi"
+    # ephemeralRequest: "64Mi"
+
+    # Default template type for secrets when no custom template is specified.
+    # Possible values include: "json" and "map".
+    template: "map"
+
+    # Default values within Agent's template_config stanza.
+    templateConfig:
+      exitOnRetryFailure: true
+      staticSecretRenderInterval: ""
+
+  # Used to define custom livenessProbe settings
+  livenessProbe:
+    # -- When a probe fails, Kubernetes will try failureThreshold times before giving up
+    failureThreshold: 2
+    # -- Number of seconds after the container has started before probe initiates
+    initialDelaySeconds: 5
+    # -- How often (in seconds) to perform the probe
+    periodSeconds: 2
+    # -- Minimum consecutive successes for the probe to be considered successful after having failed
+    successThreshold: 1
+    # -- Number of seconds after which the probe times out.
+    timeoutSeconds: 5
+  # Used to define custom readinessProbe settings
+  readinessProbe:
+    # -- When a probe fails, Kubernetes will try failureThreshold times before giving up
+    failureThreshold: 2
+    # -- Number of seconds after the container has started before probe initiates
+    initialDelaySeconds: 5
+    # -- How often (in seconds) to perform the probe
+    periodSeconds: 2
+    # -- Minimum consecutive successes for the probe to be considered successful after having failed
+    successThreshold: 1
+    # -- Number of seconds after which the probe times out.
+    timeoutSeconds: 5
+  # Used to define custom startupProbe settings
+  startupProbe:
+    # -- When a probe fails, Kubernetes will try failureThreshold times before giving up
+    failureThreshold: 12
+    # -- Number of seconds after the container has started before probe initiates
+    initialDelaySeconds: 5
+    # -- How often (in seconds) to perform the probe
+    periodSeconds: 5
+    # -- Minimum consecutive successes for the probe to be considered successful after having failed
+    successThreshold: 1
+    # -- Number of seconds after which the probe times out.
+    timeoutSeconds: 5
+
+  # Mount Path of the OpenBao Kubernetes Auth Method.
+  authPath: "auth/kubernetes"
+
+  # -- Configures the log verbosity of the injector.
+  # Supported log levels include: trace, debug, info, warn, error
+  logLevel: "info"
+
+  # -- Configures the log format of the injector. Supported log formats: "standard", "json".
+  logFormat: "standard"
+
+  # Configures all OpenBao Agent sidecars to revoke their token when shutting down
+  revokeOnShutdown: false
+
+  webhook:
+    # Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
+    # API Version of the WebHook.
+    # To block pod creation while the webhook is unavailable, set the policy to `Fail` below.
+    # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
+    #
+    failurePolicy: Ignore
+
+    # matchPolicy specifies the approach to accepting changes based on the rules of
+    # the MutatingWebhookConfiguration.
+    # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy
+    # for more details.
+    #
+    matchPolicy: Exact
+
+    # timeoutSeconds is the amount of seconds before the webhook request will be ignored
+    # or fails.
+    # If it is ignored or fails depends on the failurePolicy
+    # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#timeouts
+    # for more details.
+    #
+    timeoutSeconds: 30
+
+    # namespaceSelector is the selector for restricting the webhook to only
+    # specific namespaces.
+    # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
+    # for more details.
+    # Example:
+    # namespaceSelector:
+    #    matchLabels:
+    #      sidecar-injector: enabled
+    namespaceSelector: {}
+
+    # objectSelector is the selector for restricting the webhook to only
+    # specific labels.
+    # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
+    # for more details.
+    # Example:
+    # objectSelector:
+    #    matchLabels:
+    #      vault-sidecar-injector: enabled
+    objectSelector: |
+      matchExpressions:
+      - key: app.kubernetes.io/name
+        operator: NotIn
+        values:
+        - {{ template "openbao.name" . }}-agent-injector
+
+    # Extra annotations to attach to the webhook
+    annotations: {}
+
+  # Deprecated: please use 'webhook.failurePolicy' instead
+  # Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
+  # API Version of the WebHook.
+  # To block pod creation while webhook is unavailable, set the policy to `Fail` below.
+  # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
+  #
+  failurePolicy: Ignore
+
+  # Deprecated: please use 'webhook.namespaceSelector' instead
+  # namespaceSelector is the selector for restricting the webhook to only
+  # specific namespaces.
+  # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
+  # for more details.
+  # Example:
+  # namespaceSelector:
+  #    matchLabels:
+  #      sidecar-injector: enabled
+  namespaceSelector: {}
+
+  # Deprecated: please use 'webhook.objectSelector' instead
+  # objectSelector is the selector for restricting the webhook to only
+  # specific labels.
+  # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
+  # for more details.
+  # Example:
+  # objectSelector:
+  #    matchLabels:
+  #      vault-sidecar-injector: enabled
+  objectSelector: {}
+
+  # Deprecated: please use 'webhook.annotations' instead
+  # Extra annotations to attach to the webhook
+  webhookAnnotations: {}
+
+  certs:
+    # secretName is the name of the secret that has the TLS certificate and
+    # private key to serve the injector webhook. If this is null, then the
+    # injector will default to its automatic management mode that will assign
+    # a service account to the injector to generate its own certificates.
+    secretName: null
+
+    # caBundle is a base64-encoded PEM-encoded certificate bundle for the CA
+    # that signed the TLS certificate that the webhook serves. This must be set
+    # if secretName is non-null unless an external service like cert-manager is
+    # keeping the caBundle updated.
+    caBundle: ""
+
+    # certName and keyName are the names of the files within the secret for
+    # the TLS cert and private key, respectively. These have reasonable
+    # defaults but can be customized if necessary.
+    certName: tls.crt
+    keyName: tls.key
+
+  # Security context for the pod template and the injector container
+  # The default pod securityContext is:
+  #   runAsNonRoot: true
+  #   runAsGroup: {{ .Values.injector.gid | default 1000 }}
+  #   runAsUser: {{ .Values.injector.uid | default 100 }}
+  #   fsGroup: {{ .Values.injector.gid | default 1000 }}
+  # and for container is
+  #    allowPrivilegeEscalation: false
+  #    capabilities:
+  #      drop:
+  #        - ALL
+  securityContext:
+    pod: {}
+    container: {}
+
+  resources: {}
+  # resources:
+  #   requests:
+  #     memory: 256Mi
+  #     cpu: 250m
+  #   limits:
+  #     memory: 256Mi
+  #     cpu: 250m
+
+  # extraEnvironmentVars is a list of extra environment variables to set in the
+  # injector deployment.
+  extraEnvironmentVars: {}
+    # KUBERNETES_SERVICE_HOST: kubernetes.default.svc
+
+  # Affinity Settings for injector pods
+  # This can either be a multi-line string or YAML matching the PodSpec's affinity field.
+  # Commenting out or setting as empty the affinity variable, will allow
+  # deployment of multiple replicas to single node services such as Minikube.
+  affinity: |
+    podAntiAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        - labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: {{ template "openbao.name" . }}-agent-injector
+              app.kubernetes.io/instance: "{{ .Release.Name }}"
+              component: webhook
+          topologyKey: kubernetes.io/hostname
+
+  # Topology settings for injector pods
+  # ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
+  # This should be either a multi-line string or YAML matching the topologySpreadConstraints array
+  # in a PodSpec.
+  topologySpreadConstraints: []
+
+  # Toleration Settings for injector pods
+  # This should be either a multi-line string or YAML matching the Toleration array
+  # in a PodSpec.
+  tolerations: []
+
+  # nodeSelector labels for server pod assignment, formatted as a multi-line string or YAML map.
+  # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
+  # Example:
+  # nodeSelector:
+  #   beta.kubernetes.io/arch: amd64
+  nodeSelector: {}
+
+  # Priority class for injector pods
+  priorityClassName: ""
+
+  # Extra annotations to attach to the injector pods
+  # This can either be YAML or a YAML-formatted multi-line templated string map
+  # of the annotations to apply to the injector pods
+  annotations: {}
+
+  # Extra labels to attach to the agent-injector
+  # This should be a YAML map of the labels to apply to the injector
+  extraLabels: {}
+
+  # Should the injector pods run on the host network (useful when using
+  # an alternate CNI in EKS)
+  hostNetwork: false
+
+  # Injector service specific config
+  service:
+    # Extra annotations to attach to the injector service
+    annotations: {}
+    # Extra labels for the service definition.
+    # This should be a YAML map of the labels to apply to the injector service
+    extraLabels: {}
+
+  # Injector serviceAccount specific config
+  serviceAccount:
+    # Extra annotations to attach to the injector serviceAccount
+    annotations: {}
+
+  # A disruption budget limits the number of pods of a replicated application
+  # that are down simultaneously from voluntary disruptions
+  podDisruptionBudget: {}
+  # podDisruptionBudget:
+  #   maxUnavailable: 1
+
+  # strategy for updating the deployment. This can be a multi-line string or a
+  # YAML map.
+  strategy: {}
+  # strategy: |
+  #   rollingUpdate:
+  #     maxSurge: 25%
+  #     maxUnavailable: 25%
+  #   type: RollingUpdate
+
+server:
+  # If true, or "-" with global.enabled true, OpenBao server will be installed.
+  # See openbao.mode in _helpers.tpl for implementation details.
+  enabled: "-"
+
+  # Resource requests, limits, etc. for the server cluster placement. This
+  # should map directly to the value of the resources field for a PodSpec.
+  # By default no direct resource request is made.
+
+  image:
+    # -- image registry to use for server image
+    registry: "quay.io"
+    # -- image repo to use for server image
+    repository: "openbao/openbao"
+    # -- image tag to use for server image - defaults to chart appVersion
+    tag: ""
+    # -- image pull policy to use for server image. if tag is "latest", set to "Always"
+    pullPolicy: IfNotPresent
+
+  # Configure the Update Strategy Type for the StatefulSet
+  # See https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies
+  updateStrategyType: "OnDelete"
+
+  # Configure the pod management policy for the StatefulSet
+  # See https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies
+  podManagementPolicy: "OrderedReady"
+
+  # Configure the logging verbosity for the OpenBao server.
+  # Supported log levels include: trace, debug, info, warn, error
+  logLevel: ""
+
+  # Configure the logging format for the OpenBao server.
+  # Supported log formats include: standard, json
+  logFormat: ""
+
+  resources: {}
+  # resources:
+  #   requests:
+  #     memory: 256Mi
+  #     cpu: 250m
+  #   limits:
+  #     memory: 256Mi
+  #     cpu: 250m
+
+  # Ingress allows ingress services to be created to allow external access
+  # from Kubernetes to access OpenBao pods.
+  # If deployment is on OpenShift, the following block is ignored.
+  # In order to expose the service, use the route section below
+  ingress:
+    enabled: false
+    labels: {}
+      # traffic: external
+    annotations: {}
+      # |
+      # kubernetes.io/ingress.class: nginx
+      # kubernetes.io/tls-acme: "true"
+      #   or
+      # kubernetes.io/ingress.class: nginx
+      # kubernetes.io/tls-acme: "true"
+
+    # Optionally use ingressClassName instead of deprecated annotation.
+    # See: https://kubernetes.io/docs/concepts/services-networking/ingress/#deprecated-annotation
+    ingressClassName: ""
+
+    # As of Kubernetes 1.19, all Ingress Paths must have a pathType configured. The default value below should be sufficient in most cases.
+    # See: https://kubernetes.io/docs/concepts/services-networking/ingress/#path-types for other possible values.
+    pathType: Prefix
+
+    # When HA mode is enabled and K8s service registration is being used,
+    # configure the ingress to point to the OpenBao active service.
+    activeService: true
+    hosts:
+      - host: chart-example.local
+        paths: []
+    ## Extra paths to prepend to the host configuration. This is useful when working with annotation based services.
+    extraPaths: []
+    # - path: /*
+    #   backend:
+    #     service:
+    #       name: ssl-redirect
+    #       port:
+    #         number: use-annotation
+    tls: []
+    #  - secretName: chart-example-tls
+    #    hosts:
+    #      - chart-example.local
+
+  # Gateway consolidates configuration related to the Kubernetes Gateway API
+  # Currently, only creating a TLSRoute is supported
+  # See: https://gateway-api.sigs.k8s.io/
+  gateway:
+    # Configures a TLSRoute for the OpenBao server. This can be enabled independently of the ingress configuration to allow for side-by-side scenarios for migration.
+    tlsRoute:
+      enabled: false
+      labels: {}
+      # traffic: external
+      annotations: {}
+      # external-dns.alpha.kubernetes.io/hostname: chart-example.local
+
+      hosts: []
+        # - chart-example.local
+
+      # Allows overriding the TLSRoutes apiVersion in case a different version of Gateway API is installed on the cluster.
+      apiVersion: gateway.networking.k8s.io/v1alpha3
+
+      # When HA mode is enabled and K8s service registration is being used,
+      # configure the ingress to point to the OpenBao active service.
+      activeService: true
+
+      # List of ParentRefs. As the helm chart configures no gateways itself,
+      # this should be set to at least one gateway with one or more TLS listeners
+      parentRefs: []
+        # - name: my-gw
+        #   namespace: gateway-namespace
+        #   # sectionName is optional to fix to a specific listener
+        #   sectionName: listener-name
+
+    # Configures a HTTPRoute for the OpenBao server. This can be enabled independently of the ingress configuration to allow for side-by-side scenarios for migration.
+    # WARNING: Terminating TLS before reaching the OpenBao Server is not recommended and may break things like certificate authentication. Prefer usage of `TLSRoute`.
+    httpRoute:
+      enabled: false
+      labels: {}
+      # traffic: external
+      annotations: {}
+      # external-dns.alpha.kubernetes.io/hostname: chart-example.local
+
+      hosts:
+      - chart-example.local
+
+      # Allows overriding the HTTPRoute apiVersion in case a different version of Gateway API is installed on the cluster.
+      apiVersion: gateway.networking.k8s.io/v1
+
+      # When HA mode is enabled and K8s service registration is being used,
+      # configure the ingress to point to the OpenBao active service.
+      activeService: true
+
+      # List of ParentRefs. As the helm chart configures no gateways itself,
+      # this should be set to at least one gateway with one or more HTTP listeners
+      parentRefs: []
+        # - name: my-gw
+        #   namespace: gateway-namespace
+        #   # sectionName is optional to fix to a specific listener
+        #   sectionName: listener-name
+
+      matches:
+        path:
+          type: PathPrefix
+          value: '/'
+        timeouts: {}
+          # request: 10s  #Maximum time the Gateway waits to complete the full client request and response cycle.
+          # backendRequest: 10s # Maximum time the Gateway waits for a response from the backend service.
+      filters: []
+      # - type: RequestHeaderModifier
+      #   requestHeaderModifier:
+      #     set:
+      #       - name: X-Forwarded-Proto
+      #         value: https
+
+    # If TLS is enable on server (see global.tlsDisable) the gateway must be configured
+    # with BackendTLSPolicy to correctly handles TLS connection with server in case TLS termination happens at gateway
+    tlsPolicy:
+      enabled: false
+      labels: {}
+      # traffic: external
+      annotations: {}
+      # external-dns.alpha.kubernetes.io/hostname: chart-example.local
+
+      # Allows overriding the BackendTLSPolicy apiVersion in case a different version of Gateway API is installed on the cluster.
+      apiVersion: gateway.networking.k8s.io/v1
+
+      # When HA mode is enabled and K8s service registration is being used,
+      # configure the ingress to point to the OpenBao active service.
+      activeService: true
+
+      # Identifies an API object to apply the policy to.
+      # If no one is specified the default is to target the OpenBao service
+      targetRefs: []
+
+      validation: {}
+      # caCertificateRefs:
+      # - kind: ConfigMap
+      #   name: vault-ca
+
+  # hostAliases is a list of aliases to be added to /etc/hosts. Specified as a YAML list.
+  hostAliases: []
+  # - ip: 127.0.0.1
+  #   hostnames:
+  #     - chart-example.local
+
+  # OpenShift only - create a route to expose the service
+  # By default the created route will be of type passthrough
+  route:
+    enabled: false
+
+    # When HA mode is enabled and K8s service registration is being used,
+    # configure the route to point to the OpenBao active service.
+    activeService: true
+
+    labels: {}
+    annotations: {}
+    host: chart-example.local
+    # tls will be passed directly to the route's TLS config, which
+    # can be used to configure other termination methods that terminate
+    # TLS at the router
+    tls:
+      termination: passthrough
+
+  # authDelegator enables a cluster role binding to be attached to the service
+  # account.  This cluster role binding can be used to setup Kubernetes auth
+  # method. See https://openbao.org/docs/auth/kubernetes
+  authDelegator:
+    enabled: true
+
+  # -- extraInitContainers is a list of init containers. Specified as a YAML list.
+  # This is useful if you need to run a script to provision TLS certificates or
+  # write out configuration files in a dynamic way.
+  extraInitContainers: []
+    # # This example installs a plugin pulled from github into the /usr/local/libexec/vault/oauthapp folder,
+    # # which is defined in the volumes value.
+    # - name: oauthapp
+    #   image: "alpine"
+    #   command: [sh, -c]
+    #   args:
+    #     - cd /tmp &&
+    #       wget https://github.com/puppetlabs/vault-plugin-secrets-oauthapp/releases/download/v1.2.0/vault-plugin-secrets-oauthapp-v1.2.0-linux-amd64.tar.xz -O oauthapp.xz &&
+    #       tar -xf oauthapp.xz &&
+    #       mv vault-plugin-secrets-oauthapp-v1.2.0-linux-amd64 /usr/local/libexec/vault/oauthapp &&
+    #       chmod +x /usr/local/libexec/vault/oauthapp
+    #   volumeMounts:
+    #     - name: plugins
+    #       mountPath: /usr/local/libexec/vault
+
+  # extraContainers is a list of sidecar containers. Specified as a YAML list.
+  extraContainers: null
+
+  # -- shareProcessNamespace enables process namespace sharing between OpenBao and the extraContainers
+  # This is useful if OpenBao must be signaled, e.g. to send a SIGHUP for a log rotation
+  shareProcessNamespace: false
+
+  # -- extraArgs is a string containing additional OpenBao server arguments.
+  extraArgs: ""
+
+  # -- extraPorts is a list of extra ports. Specified as a YAML list.
+  # This is useful if you need to add additional ports to the statefulset in dynamic way.
+  extraPorts: []
+    # - containerPort: 8300
+    #   name: http-monitoring
+
+  # Used to define custom readinessProbe settings
+  readinessProbe:
+    enabled: true
+    # If you need to use a http path instead of the default exec
+    # path: /v1/sys/health?standbyok=true
+
+    # Port number on which readinessProbe will be checked.
+    port: 8200
+    # When a probe fails, Kubernetes will try failureThreshold times before giving up
+    failureThreshold: 2
+    # Number of seconds after the container has started before probe initiates
+    initialDelaySeconds: 5
+    # How often (in seconds) to perform the probe
+    periodSeconds: 5
+    # Minimum consecutive successes for the probe to be considered successful after having failed
+    successThreshold: 1
+    # Number of seconds after which the probe times out.
+    timeoutSeconds: 3
+  # Used to enable a livenessProbe for the pods
+  livenessProbe:
+    enabled: false
+    # Used to define a liveness exec command. If provided, exec is preferred to httpGet (path) as the livenessProbe handler.
+    execCommand: []
+    # - /bin/sh
+    # - -c
+    # - /openbao/userconfig/mylivenessscript/run.sh
+    # Path for the livenessProbe to use httpGet as the livenessProbe handler
+    path: "/v1/sys/health?standbyok=true"
+    # Port number on which livenessProbe will be checked if httpGet is used as the livenessProbe handler
+    port: 8200
+    # When a probe fails, Kubernetes will try failureThreshold times before giving up
+    failureThreshold: 2
+    # Number of seconds after the container has started before probe initiates
+    initialDelaySeconds: 60
+    # How often (in seconds) to perform the probe
+    periodSeconds: 5
+    # Minimum consecutive successes for the probe to be considered successful after having failed
+    successThreshold: 1
+    # Number of seconds after which the probe times out.
+    timeoutSeconds: 3
+
+  # Optional duration in seconds the pod needs to terminate gracefully.
+  # See: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
+  terminationGracePeriodSeconds: 10
+
+  # Used to set the sleep time during the preStop step
+  preStopSleepSeconds: 5
+
+  # Used to define commands to run after the pod is ready.
+  # This can be used to automate processes such as initialization
+  # or bootstrapping auth methods.
+  postStart: []
+  # - /bin/sh
+  # - -c
+  # - /openbao/userconfig/myscript/run.sh
+
+  # extraEnvironmentVars is a list of extra environment variables to set with the stateful set. These could be
+  # used to include variables required for auto-unseal.
+  extraEnvironmentVars: {}
+    # GOOGLE_REGION: global
+    # GOOGLE_PROJECT: myproject
+    # GOOGLE_APPLICATION_CREDENTIALS: /openbao/userconfig/myproject/myproject-creds.json
+
+  # extraSecretEnvironmentVars is a list of extra environment variables to set with the stateful set.
+  # These variables take value from existing Secret objects.
+  extraSecretEnvironmentVars: []
+    # - envName: AWS_SECRET_ACCESS_KEY
+    #   secretName: openbao
+    #   secretKey: AWS_SECRET_ACCESS_KEY
+
+  # Deprecated: please use 'volumes' instead.
+  # extraVolumes is a list of extra volumes to mount. These will be exposed
+  # to OpenBao in the path `/openbao/userconfig/<name>/`. The value below is
+  # an array of objects, examples are shown below.
+  extraVolumes: []
+    # - type: secret (or "configMap")
+    #   name: my-secret
+    #   path: null # default is `/openbao/userconfig`
+
+  # volumes is a list of volumes made available to all containers. These are rendered
+  # via toYaml rather than pre-processed like the extraVolumes value.
+  # The purpose is to make it easy to share volumes between containers.
+  volumes: null
+  #   - name: plugins
+  #     emptyDir: {}
+
+  # volumeMounts is a list of volumeMounts for the main server container. These are rendered
+  # via toYaml rather than pre-processed like the extraVolumes value.
+  # The purpose is to make it easy to share volumes between containers.
+  volumeMounts: null
+  #   - mountPath: /usr/local/libexec/vault
+  #     name: plugins
+  #     readOnly: true
+
+  # Affinity Settings
+  # Commenting out or setting as empty the affinity variable, will allow
+  # deployment to single node services such as Minikube
+  # This should be either a multi-line string or YAML matching the PodSpec's affinity field.
+  affinity: |
+    podAntiAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        - labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: {{ template "openbao.name" . }}
+              app.kubernetes.io/instance: "{{ .Release.Name }}"
+              component: server
+          topologyKey: kubernetes.io/hostname
+
+  # Topology settings for server pods
+  # ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
+  # This should be either a multi-line string or YAML matching the topologySpreadConstraints array
+  # in a PodSpec.
+  topologySpreadConstraints: []
+
+  # Toleration Settings for server pods
+  # This should be either a multi-line string or YAML matching the Toleration array
+  # in a PodSpec.
+  tolerations: []
+
+  # nodeSelector labels for server pod assignment, formatted as a multi-line string or YAML map.
+  # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
+  # Example:
+  # nodeSelector:
+  #   beta.kubernetes.io/arch: amd64
+  nodeSelector: {}
+
+  # Enables network policy for server pods
+  networkPolicy:
+    enabled: false
+    egress: []
+    # egress:
+    # - to:
+    #   - ipBlock:
+    #       cidr: 10.0.0.0/24
+    #   ports:
+    #   - protocol: TCP
+    #     port: 443
+    ingress:
+      - from:
+          - namespaceSelector: {}
+        ports:
+          - port: 8200
+            protocol: TCP
+          - port: 8201
+            protocol: TCP
+
+  # Priority class for server pods
+  priorityClassName: ""
+
+  # Extra labels to attach to the server pods
+  # This should be a YAML map of the labels to apply to the server pods
+  extraLabels: {}
+
+  # Extra annotations to attach to the server pods
+  # This can either be YAML or a YAML-formatted multi-line templated string map
+  # of the annotations to apply to the server pods
+  annotations: {}
+
+  # Add an annotation to the server configmap and the statefulset pods,
+  # vaultproject.io/config-checksum, that is a hash of the OpenBao configuration.
+  # This can be used together with an OnDelete deployment strategy to help
+  # identify which pods still need to be deleted during a deployment to pick up
+  # any configuration changes.
+  configAnnotation: false
+
+  # Enables a headless service to be used by the OpenBao Statefulset
+  service:
+    enabled: true
+    # Enable or disable the openbao-active service, which selects OpenBao pods that
+    # have labeled themselves as the cluster leader with `openbao-active: "true"`.
+    active:
+      enabled: true
+      # Extra annotations for the service definition. This can either be YAML or a
+      # YAML-formatted multi-line templated string map of the annotations to apply
+      # to the active service.
+      annotations: {}
+      # Extra labels for the service definition.
+      # This should be a YAML map of the labels to apply to the active service
+      extraLabels: {}
+    # Enable or disable the openbao-standby service, which selects OpenBao pods that
+    # have labeled themselves as a cluster follower with `openbao-active: "false"`.
+    standby:
+      enabled: true
+      # Extra annotations for the service definition. This can either be YAML or a
+      # YAML-formatted multi-line templated string map of the annotations to apply
+      # to the standby service.
+      annotations: {}
+      # Extra labels for the service definition.
+      # This should be a YAML map of the labels to apply to the standby service
+      extraLabels: {}
+    # If enabled, the service selectors will include `app.kubernetes.io/instance: {{ .Release.Name }}`
+    # When disabled, services may select OpenBao pods not deployed from the chart.
+    # Does not affect the headless openbao-internal service with `ClusterIP: None`
+    instanceSelector:
+      enabled: true
+    # clusterIP controls whether a Cluster IP address is attached to the
+    # OpenBao service within Kubernetes.  By default, the OpenBao service will
+    # be given a Cluster IP address, set to None to disable.  When disabled
+    # Kubernetes will create a "headless" service.  Headless services can be
+    # used to communicate with pods directly through DNS instead of a round-robin
+    # load balancer.
+    # clusterIP: None
+
+    # Configures the service type for the main OpenBao service.  Can be ClusterIP
+    # or NodePort.
+    # type: ClusterIP
+
+    # The IP family and IP families options are to set the behaviour in a dual-stack environment.
+    # Omitting these values will let the service fall back to whatever the CNI dictates the defaults
+    # should be.
+    # These are only supported for kubernetes versions >=1.23.0
+    #
+    # Configures the service's supported IP family policy, can be either:
+    #     SingleStack: Single-stack service. The control plane allocates a cluster IP for the Service, using the first configured service cluster IP range.
+    #     PreferDualStack: Allocates IPv4 and IPv6 cluster IPs for the Service.
+    #     RequireDualStack: Allocates Service .spec.ClusterIPs from both IPv4 and IPv6 address ranges.
+    ipFamilyPolicy: ""
+
+    # Sets the families that should be supported and the order in which they should be applied to ClusterIP as well.
+    # Can be IPv4 and/or IPv6.
+    ipFamilies: []
+
+    # Do not wait for pods to be ready before including them in the services'
+    # targets. Does not apply to the headless service, which is used for
+    # cluster-internal communication.
+    publishNotReadyAddresses: true
+
+    # The externalTrafficPolicy can be set to either Cluster or Local
+    # and is only valid for LoadBalancer and NodePort service types.
+    # The default value is Cluster.
+    # ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-traffic-policy
+    externalTrafficPolicy: Cluster
+
+    # If type is set to "NodePort", a specific nodePort value can be configured,
+    # will be random if left blank.
+    # nodePort: 30000
+
+    # When HA mode is enabled
+    # If type is set to "NodePort", a specific nodePort value can be configured,
+    # will be random if left blank.
+    # activeNodePort: 30001
+
+    # When HA mode is enabled
+    # If type is set to "NodePort", a specific nodePort value can be configured,
+    # will be random if left blank.
+    # standbyNodePort: 30002
+
+    # Port on which OpenBao server is listening
+    port: 8200
+    # Target port to which the service should be mapped to
+    targetPort: 8200
+
+    # -- extraPorts is a list of extra ports. Specified as a YAML list.
+    # This is useful if you need to add additional ports to the server service in dynamic way.
+    extraPorts: []
+    # - name: metrics
+    #   port: 9101
+    #   targetPort: 9101
+
+    # Extra annotations for the service definition. This can either be YAML or a
+    # YAML-formatted multi-line templated string map of the annotations to apply
+    # to the service.
+    annotations: {}
+    # Extra labels for the service definition.
+    # This should be a YAML map of the labels to apply to the service
+    extraLabels: {}
+
+  # This configures the OpenBao Statefulset to create a PVC for data
+  # storage when using the file or raft backend storage engines.
+  # See https://openbao.org/docs/configuration/storage to know more
+  dataStorage:
+    enabled: true
+    # Size of the PVC created
+    size: 10Gi
+    # Location where the PVC will be mounted.
+    mountPath: "/openbao/data"
+    # Name of the storage class to use.  If null it will use the
+    # configured default Storage Class.
+    storageClass: null
+    # Access Mode of the storage device being used for the PVC
+    accessMode: ReadWriteOnce
+    # Annotations to apply to the PVC
+    annotations: {}
+    # Labels to apply to the PVC
+    labels: {}
+
+  # Persistent Volume Claim (PVC) retention policy
+  # ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention
+  # Example:
+  # persistentVolumeClaimRetentionPolicy:
+  #   whenDeleted: Retain
+  #   whenScaled: Retain
+  persistentVolumeClaimRetentionPolicy: {}
+
+  # This configures the OpenBao Statefulset to create a PVC for audit
+  # logs.  Once OpenBao is deployed, initialized, and unsealed, OpenBao must
+  # be configured to use this for audit logs.  This will be mounted to
+  # /openbao/audit
+  # See https://openbao.org/docs/audit to know more
+  auditStorage:
+    enabled: false
+    # Size of the PVC created
+    size: 10Gi
+    # Location where the PVC will be mounted.
+    mountPath: "/openbao/audit"
+    # Name of the storage class to use.  If null it will use the
+    # configured default Storage Class.
+    storageClass: null
+    # Access Mode of the storage device being used for the PVC
+    accessMode: ReadWriteOnce
+    # Annotations to apply to the PVC
+    annotations: {}
+    # Labels to apply to the PVC
+    labels: {}
+
+  # Run OpenBao in "dev" mode. This requires no further setup, no state management,
+  # and no initialization. This is useful for experimenting with OpenBao without
+  # needing to unseal, store keys, et. al. All data is lost on restart - do not
+  # use dev mode for anything other than experimenting.
+  # See https://openbao.org/docs/concepts/dev-server to know more
+  dev:
+    enabled: false
+
+    # Set VAULT_DEV_ROOT_TOKEN_ID value
+    devRootToken: "root"
+
+  # Run OpenBao in "standalone" mode. This is the default mode that will deploy if
+  # no arguments are given to helm. This requires a PVC for data storage to use
+  # the "file" backend.  This mode is not highly available and should not be scaled
+  # past a single replica.
+  standalone:
+    enabled: "-"
+
+    # config is a raw string of default configuration when using a Stateful
+    # deployment. Default is to use a PersistentVolumeClaim mounted at /openbao/data
+    # and store data there. This is only used when using a Replica count of 1, and
+    # using a stateful set. This should be HCL.
+
+    # Note: Configuration files are stored in ConfigMaps so sensitive data
+    # such as passwords should be either mounted through extraSecretEnvironmentVars
+    # or through a Kube secret.  For more information see:
+    # https://openbao.org/docs/platform/k8s/helm/run/#protecting-sensitive-openbao-configurations
+    config: |
+      ui = true
+
+      listener "tcp" {
+        tls_disable = 1
+        address = "[::]:8200"
+        cluster_address = "[::]:8201"
+        # Enable unauthenticated metrics access (necessary for Prometheus Operator)
+        #telemetry {
+        #  unauthenticated_metrics_access = "true"
+        #}
+      }
+      storage "file" {
+        path = "/openbao/data"
+      }
+
+      # Example configuration for using auto-unseal, using Google Cloud KMS. The
+      # GKMS keys must already exist, and the cluster must have a service account
+      # that is authorized to access GCP KMS.
+      #seal "gcpckms" {
+      #   project     = "openbao-helm-dev"
+      #   region      = "global"
+      #   key_ring    = "openbao-helm-unseal-kr"
+      #   crypto_key  = "openbao-helm-unseal-key"
+      #}
+
+      # Example configuration for enabling Prometheus metrics in your config.
+      #telemetry {
+      #  prometheus_retention_time = "30s"
+      #  disable_hostname = true
+      #}
+
+  # Run OpenBao in "HA" mode. There are no storage requirements unless the audit log
+  # persistence is required.  In HA mode OpenBao will configure itself to use Consul
+  # for its storage backend.  The default configuration provided will work the Consul
+  # Helm project by default.  It is possible to manually configure OpenBao to use a
+  # different HA backend.
+  ha:
+    enabled: false
+    replicas: 3
+
+    # Set the api_addr configuration for OpenBao HA
+    # See https://openbao.org/docs/configuration/#high-availability-parameters
+    # If set to null, this will be set to the Pod IP Address
+    apiAddr: null
+
+    # Set the cluster_addr configuration for OpenBao HA
+    # See https://openbao.org/docs/configuration/#high-availability-parameters
+    # If set to null, this will be set to https://$(HOSTNAME).{{ template "openbao.fullname" . }}-internal:8201
+    clusterAddr: null
+
+    # Enables OpenBao's integrated Raft storage.  Unlike the typical HA modes where
+    # OpenBao's persistence is external (such as Consul), enabling Raft mode will create
+    # persistent volumes for OpenBao to store data according to the configuration under server.dataStorage.
+    # The OpenBao cluster will coordinate leader elections and failovers internally.
+    raft:
+      # Enables Raft integrated storage
+      enabled: false
+      # Set the Node Raft ID to the name of the pod
+      setNodeId: false
+
+      # config is a raw string of default configuration when using a Stateful
+      # deployment.
+      # This should be HCL.
+
+      # Note: Configuration files are stored in ConfigMaps so sensitive data
+      # such as passwords should be either mounted through extraSecretEnvironmentVars
+      # or through a Kube secret.  For more information see:
+      # https://openbao.org/docs/platform/k8s/helm/run/#protecting-sensitive-openbao-configurations
+      config: |
+        ui = true
+
+        listener "tcp" {
+          tls_disable = 1
+          address = "[::]:8200"
+          cluster_address = "[::]:8201"
+          # Enable unauthenticated metrics access (necessary for Prometheus Operator)
+          #telemetry {
+          #  unauthenticated_metrics_access = "true"
+          #}
+        }
+
+        storage "raft" {
+          path = "/openbao/data"
+        }
+
+        service_registration "kubernetes" {}
+
+    # config is a raw string of default configuration when using a Stateful
+    # deployment. Default is to use a Consul for its HA storage backend.
+    # This should be HCL.
+
+    # Note: Configuration files are stored in ConfigMaps so sensitive data
+    # such as passwords should be either mounted through extraSecretEnvironmentVars
+    # or through a Kube secret.  For more information see:
+    # https://openbao.org/docs/platform/k8s/helm/run/#protecting-sensitive-openbao-configurations
+    config: |
+      ui = true
+
+      listener "tcp" {
+        tls_disable = 1
+        address = "[::]:8200"
+        cluster_address = "[::]:8201"
+      }
+      storage "consul" {
+        path = "openbao"
+        address = "HOST_IP:8500"
+      }
+
+      service_registration "kubernetes" {}
+
+      # Example configuration for using auto-unseal, using Google Cloud KMS. The
+      # GKMS keys must already exist, and the cluster must have a service account
+      # that is authorized to access GCP KMS.
+      #seal "gcpckms" {
+      #   project     = "openbao-helm-dev-246514"
+      #   region      = "global"
+      #   key_ring    = "openbao-helm-unseal-kr"
+      #   crypto_key  = "openbao-helm-unseal-key"
+      #}
+
+      # Example configuration for enabling Prometheus metrics.
+      # If you are using Prometheus Operator you can enable a ServiceMonitor resource below.
+      # You may wish to enable unauthenticated metrics in the listener block above.
+      #telemetry {
+      #  prometheus_retention_time = "30s"
+      #  disable_hostname = true
+      #}
+
+    # A disruption budget limits the number of pods of a replicated application
+    # that are down simultaneously from voluntary disruptions
+    disruptionBudget:
+      enabled: true
+
+      # maxUnavailable will default to (n/2)-1 where n is the number of
+      # replicas. If you'd like a custom value, you can specify an override here.
+      maxUnavailable: null
+
+  # Definition of the serviceAccount used to run Vault.
+  # These options are also used when using an external OpenBao server to validate
+  # Kubernetes tokens.
+  serviceAccount:
+    # Specifies whether a service account should be created
+    create: true
+    # The name of the service account to use.
+    # If not set and create is true, a name is generated using the fullname template
+    name: ""
+    # Create a Secret API object to store a non-expiring token for the service account.
+    # Prior to v1.24.0, Kubernetes used to generate this secret for each service account by default.
+    # Kubernetes now recommends using short-lived tokens from the TokenRequest API or projected volumes instead if possible.
+    # For more details, see https://kubernetes.io/docs/concepts/configuration/secret/#serviceaccount-token-secrets
+    # serviceAccount.create must be equal to 'true' in order to use this feature.
+    createSecret: false
+    # Extra annotations for the serviceAccount definition. This can either be
+    # YAML or a YAML-formatted multi-line templated string map of the
+    # annotations to apply to the serviceAccount.
+    annotations: {}
+    # Extra labels to attach to the serviceAccount
+    # This should be a YAML map of the labels to apply to the serviceAccount
+    extraLabels: {}
+    # Enable or disable a service account role binding with the permissions required for
+    # OpenBao's Kubernetes service_registration config option.
+    # See https://openbao.org/docs/configuration/service-registration/kubernetes
+    serviceDiscovery:
+      enabled: true
+
+  # Settings for the statefulSet used to run OpenBao.
+  statefulSet:
+    # Extra annotations for the statefulSet. This can either be YAML or a
+    # YAML-formatted multi-line templated string map of the annotations to apply
+    # to the statefulSet.
+    annotations: {}
+
+    # Set the pod and container security contexts.
+    # If not set, these will default to, and for *not* OpenShift:
+    # pod:
+    #   runAsNonRoot: true
+    #   runAsGroup: {{ .Values.server.gid | default 1000 }}
+    #   runAsUser: {{ .Values.server.uid | default 100 }}
+    #   fsGroup: {{ .Values.server.gid | default 1000 }}
+    # container:
+    #   allowPrivilegeEscalation: false
+    #
+    # If not set, these will default to, and for OpenShift:
+    # pod: {}
+    # container: {}
+    securityContext:
+      pod: {}
+      container: {}
+
+  # Should the server pods run on the host network
+  hostNetwork: false
+
+# OpenBao UI
+ui:
+  # True if you want to create a Service entry for the OpenBao UI.
+  #
+  # serviceType can be used to control the type of service created. For
+  # example, setting this to "LoadBalancer" will create an external load
+  # balancer (for supported K8S installations) to access the UI.
+  enabled: false
+  publishNotReadyAddresses: true
+  # The service should only contain selectors for active OpenBao pod
+  activeOpenbaoPodOnly: false
+  serviceType: "ClusterIP"
+  serviceNodePort: null
+  externalPort: 8200
+  targetPort: 8200
+
+  # The IP family and IP families options are to set the behaviour in a dual-stack environment.
+  # Omitting these values will let the service fall back to whatever the CNI dictates the defaults
+  # should be.
+  # These are only supported for kubernetes versions >=1.23.0
+  #
+  # Configures the service's supported IP family, can be either:
+  #     SingleStack: Single-stack service. The control plane allocates a cluster IP for the Service, using the first configured service cluster IP range.
+  #     PreferDualStack: Allocates IPv4 and IPv6 cluster IPs for the Service.
+  #     RequireDualStack: Allocates Service .spec.ClusterIPs from both IPv4 and IPv6 address ranges.
+  serviceIPFamilyPolicy: ""
+
+  # Sets the families that should be supported and the order in which they should be applied to ClusterIP as well
+  # Can be IPv4 and/or IPv6.
+  serviceIPFamilies: []
+
+  # The externalTrafficPolicy can be set to either Cluster or Local
+  # and is only valid for LoadBalancer and NodePort service types.
+  # The default value is Cluster.
+  # ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-traffic-policy
+  externalTrafficPolicy: Cluster
+
+  # loadBalancerSourceRanges:
+  #   - 10.0.0.0/16
+  #   - 1.78.23.3/32
+
+  # loadBalancerIP:
+
+  # Extra annotations to attach to the ui service
+  # This can either be YAML or a YAML-formatted multi-line templated string map
+  # of the annotations to apply to the ui service
+  annotations: {}
+
+  # Extra labels for the service definition.
+  # This should be a YAML map of the labels to apply to the ui service
+  extraLabels: {}
+
+# openbao-csi-provider
+csi:
+  # -- True if you want to install a openbao-csi-provider daemonset.
+  #
+  # Requires installing the secrets-store-csi-driver separately, see:
+  # https://secrets-store-csi-driver.sigs.k8s.io/getting-started/installation
+  #
+  # With the driver and provider installed, you can mount OpenBao secrets into volumes
+  # similar to the OpenBao Agent injector, and you can also sync those secrets into
+  # Kubernetes secrets.
+  enabled: false
+
+  image:
+    # -- image registry to use for csi image
+    registry: "quay.io"
+    # -- image repo to use for csi image
+    repository: "openbao/openbao-csi-provider"
+    # -- image tag to use for csi image
+    tag: "2.0.0"
+    # -- image pull policy to use for csi image. if tag is "latest", set to "Always"
+    pullPolicy: IfNotPresent
+
+  # -- volumes is a list of volumes made available to all containers. These are rendered
+  # via toYaml rather than pre-processed like the extraVolumes value.
+  # The purpose is to make it easy to share volumes between containers.
+  volumes: []
+  # - name: tls
+  #   secret:
+  #     secretName: openbao-tls
+
+  # -- volumeMounts is a list of volumeMounts for the main server container. These are rendered
+  # via toYaml rather than pre-processed like the extraVolumes value.
+  # The purpose is to make it easy to share volumes between containers.
+  volumeMounts: []
+  # - name: tls
+  #   mountPath: "/openbao/tls"
+  #   readOnly: true
+
+  resources: {}
+  # resources:
+  #   requests:
+  #     cpu: 50m
+  #     memory: 128Mi
+  #   limits:
+  #     cpu: 50m
+  #     memory: 128Mi
+
+  # Override the default secret name for the CSI Provider's HMAC key used for
+  # generating secret versions.
+  hmacSecretName: ""
+
+  # Settings for the daemonSet used to run the provider.
+  daemonSet:
+    updateStrategy:
+      type: RollingUpdate
+      maxUnavailable: ""
+    # Extra annotations for the daemonSet. This can either be YAML or a
+    # YAML-formatted multi-line templated string map of the annotations to apply
+    # to the daemonSet.
+    annotations: {}
+    # Provider host path (must match the CSI provider's path)
+    providersDir: "/etc/kubernetes/secrets-store-csi-providers"
+    # Kubelet host path
+    kubeletRootDir: "/var/lib/kubelet"
+    # endpoint path for the provider
+    endpoint: "/provider/openbao.sock"
+
+    # Extra labels to attach to the openbao-csi-provider daemonSet
+    # This should be a YAML map of the labels to apply to the csi provider daemonSet
+    extraLabels: {}
+    # security context for the pod template and container in the csi provider daemonSet
+    securityContext:
+      pod: {}
+      container: {}
+
+  pod:
+    # Extra annotations for the provider pods. This can either be YAML or a
+    # YAML-formatted multi-line templated string map of the annotations to apply
+    # to the pod.
+    annotations: {}
+
+    # Toleration Settings for provider pods
+    # This should be either a multi-line string or YAML matching the Toleration array
+    # in a PodSpec.
+    tolerations: []
+
+    # nodeSelector labels for csi pod assignment, formatted as a multi-line string or YAML map.
+    # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
+    # Example:
+    # nodeSelector:
+    #   beta.kubernetes.io/arch: amd64
+    nodeSelector: {}
+
+    # Affinity Settings
+    # This should be either a multi-line string or YAML matching the PodSpec's affinity field.
+    affinity: {}
+
+    # Extra labels to attach to the openbao-csi-provider pod
+    # This should be a YAML map of the labels to apply to the csi provider pod
+    extraLabels: {}
+
+  agent:
+    enabled: true
+    extraArgs: []
+
+    image:
+      # -- image registry to use for agent image
+      registry: "quay.io"
+      # -- image repo to use for agent image
+      repository: "openbao/openbao"
+      # -- image tag to use for agent image - defaults to chart appVersion
+      tag: ""
+      # -- image pull policy to use for agent image. if tag is "latest", set to "Always"
+      pullPolicy: IfNotPresent
+
+    logFormat: standard
+    logLevel: info
+
+    resources: {}
+    # resources:
+    #   requests:
+    #     memory: 256Mi
+    #     cpu: 250m
+    #   limits:
+    #     memory: 256Mi
+    #     cpu: 250m
+
+  # Priority class for csi pods
+  priorityClassName: ""
+
+  serviceAccount:
+    # Extra annotations for the serviceAccount definition. This can either be
+    # YAML or a YAML-formatted multi-line templated string map of the
+    # annotations to apply to the serviceAccount.
+    annotations: {}
+
+    # Extra labels to attach to the openbao-csi-provider serviceAccount
+    # This should be a YAML map of the labels to apply to the csi provider serviceAccount
+    extraLabels: {}
+
+  # Used to configure readinessProbe for the pods.
+  readinessProbe:
+    # When a probe fails, Kubernetes will try failureThreshold times before giving up
+    failureThreshold: 2
+    # Number of seconds after the container has started before probe initiates
+    initialDelaySeconds: 5
+    # How often (in seconds) to perform the probe
+    periodSeconds: 5
+    # Minimum consecutive successes for the probe to be considered successful after having failed
+    successThreshold: 1
+    # Number of seconds after which the probe times out.
+    timeoutSeconds: 3
+  # Used to configure livenessProbe for the pods.
+  livenessProbe:
+    # When a probe fails, Kubernetes will try failureThreshold times before giving up
+    failureThreshold: 2
+    # Number of seconds after the container has started before probe initiates
+    initialDelaySeconds: 5
+    # How often (in seconds) to perform the probe
+    periodSeconds: 5
+    # Minimum consecutive successes for the probe to be considered successful after having failed
+    successThreshold: 1
+    # Number of seconds after which the probe times out.
+    timeoutSeconds: 3
+
+  # Enables debug logging.
+  debug: false
+
+  # Pass arbitrary additional arguments to openbao-csi-provider.
+  # See https://openbao.org/docs/platform/k8s/csi/configurations
+  # for the available command line flags.
+  extraArgs: []
+
+# OpenBao is able to collect and publish various runtime metrics.
+# Enabling this feature requires setting adding `telemetry{}` stanza to
+# the OpenBao configuration. There are a few examples included in the `config` sections above.
+#
+# For more information see:
+# https://openbao.org/docs/configuration/telemetry
+# https://openbao.org/docs/internals/telemetry
+serverTelemetry:
+  # Enable support for the Prometheus Operator. If authorization is not required for
+  # OpenBao's metrics endpoint, the following OpenBao server `telemetry{}` config must be included
+  # in the `listener "tcp"{}` stanza
+  #  telemetry {
+  #    unauthenticated_metrics_access = "true"
+  #  }
+  #
+  # See the `standalone.config` for a more complete example of this.
+  #
+  # In addition, a top level `telemetry{}` stanza must also be included in the OpenBao configuration:
+  #
+  # example:
+  #  telemetry {
+  #    prometheus_retention_time = "30s"
+  #    disable_hostname = true
+  #  }
+  #
+  # Configuration for monitoring the OpenBao server.
+  serviceMonitor:
+    # The Prometheus operator *must* be installed before enabling this feature,
+    # if not the chart will fail to install due to missing CustomResourceDefinitions
+    # provided by the operator.
+    #
+    # Instructions on how to install the Helm chart can be found here:
+    #  https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack
+    # More information can be found here:
+    #  https://github.com/prometheus-operator/prometheus-operator
+    #  https://github.com/prometheus-operator/kube-prometheus
+
+    # Enable deployment of the OpenBao Server ServiceMonitor CustomResource.
+    enabled: false
+
+    # Selector labels to add to the ServiceMonitor.
+    # When empty, defaults to:
+    #  release: prometheus
+    selectors: {}
+
+    # -- Port which Prometheus uses when scraping metrics. If empty will use `openbao.scheme` helper for its value
+    port: ""
+
+    # -- scheme to use when Prometheus scrapes metrics. If empty will use `openbao.scheme` helper for its value
+    scheme: ""
+
+    # Interval at which Prometheus scrapes metrics
+    interval: 30s
+
+    # Timeout for Prometheus scrapes
+    scrapeTimeout: 10s
+
+    # tlsConfig used for scraping the Vault metrics API.
+    tlsConfig: {}
+
+    # authorization used for scraping the Vault metrics API.
+    authorization: {}
+
+    # scrapeClass to be used by the serviceMonitor
+    scrapeClass: ""
+
+  prometheusRules:
+    # The Prometheus operator *must* be installed before enabling this feature,
+    # if not the chart will fail to install due to missing CustomResourceDefinitions
+    # provided by the operator.
+
+    # Deploy the PrometheusRule custom resource for AlertManager based alerts.
+    # Requires that AlertManager is properly deployed.
+    enabled: false
+
+    # Selector labels to add to the PrometheusRules.
+    # When empty, defaults to:
+    #  release: prometheus
+    selectors: {}
+
+    # Some example rules.
+    rules: []
+    #  - alert: vault-HighResponseTime
+    #    annotations:
+    #      message: The response time of OpenBao is over 500ms on average over the last 5 minutes.
+    #    expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 500
+    #    for: 5m
+    #    labels:
+    #      severity: warning
+    #  - alert: vault-HighResponseTime
+    #    annotations:
+    #      message: The response time of OpenBao is over 1s on average over the last 10 minutes.
+    #    expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 1000
+    #    for: 10m
+    #    labels:
+    #      severity: critical
+
+  grafanaDashboard:
+    # Enable deployment of the OpenBao Grafana dashboard.
+    # https://grafana.com/grafana/dashboards/23725-openbao
+    enabled: false
+
+    # Add `grafana_dashboard: "1"` default label
+    defaultLabel: true
+
+    # Extra labels for dashboard ConfigMap
+    extraLabel: {}
+
+    # Extra annotations for dashboard ConfigMap
+    extraAnnotations: {}
+
+# extraObjects allows you to add any extra Kubernetes manifests to this chart
+extraObjects: []
+# Examples:
+# Defining as a Structured YAML Object Example:
+#   extraObjects:
+#   - apiVersion: v1
+#     kind: ConfigMap
+#     metadata:
+#       name: cert-manager-configmap-{{ .Release.Name }}
+#
+# Using a String for Advanced Templating Example:
+#   extraObjects:
+#   - |
+#     apiVersion: v1
+#     kind: ConfigMap
+#     metadata:
+#       name: cert-manager-configmap-{{ include "some-other-template" }}
+
+# Snapshot Agent Configuration
+snapshotAgent:
+  # whether or not to enable the snapshot agent cronjob
+  enabled: false
+  # extra Annotations for the job
+  annotations: {}
+  # schedule of the cronjob
+  schedule: "*/15 * * * *"
+  restartPolicy: OnFailure
+  # service account settings for the snapshot agent
+  serviceAccount:
+    create: true
+    name: ""
+    annotations: {}
+    extraLabels: {}
+  # The image settings for the snapshot agent
+  image:
+    repository: ghcr.io/openbao/openbao-snapshot-agent
+    tag: 0.2.4
+
+  # -- List of extraVolumes made available to the snapshot cronjob container.
+  extraVolumes: []
+  #   - name: openbao-tls
+  #     secret:
+  #       defaultMode: 420
+  #       secretName: openbao-tls
+
+  # -- List of additional volumeMounts for the snapshot cronjob container.
+  extraVolumeMounts: []
+  #   - mountPath: /openbao/tls/ca.crt
+  #     name: openbao-tls
+  #     readOnly: true
+  #     subPath: ca.crt
+
+  # s3CredentialsSecret to use
+  s3CredentialsSecret: "my-s3-credentials"
+
+  # configuration for the snapshot agent
+  config:
+    s3Host: "s3.eu-east-1.amazonaws.com"
+    s3Bucket: "openbao-snapshots"
+    s3Uri: "s3://openbao-snapshots"
+    s3ExpireDays: "14"
+    s3cmdExtraFlag: "-v"
+    baoAuthPath: "kubernetes"
+    baoRole: "snapshot"
+
+  # configuration of the CronJobs resources
+  resources: {}
+
+  # -- Map of extra environment variables to set in the snapshot-agent cronjob
+  extraEnvironmentVars: {}
+    # BAO_CACERT: /openbao/tls/ca.crt
+
+  # --  List of extra environment variables to set in the snapshot-agent cronjob
+  # These variables take value from existing Secret objects.
+  extraSecretEnvironmentVars: []
+    # - envName: AWS_SECRET_ACCESS_KEY
+    #   secretName: openbao
+    #   secretKey: AWS_SECRET_ACCESS_KEY
+
+  # Security context for the pod template and the snapshotAgent container
+  # The default pod securityContext is:
+  #   runAsNonRoot: true
+  #   runAsGroup: {{ .Values.snapshotAgent.gid | default 1000 }}
+  #   runAsUser: {{ .Values.snapshotAgent.uid | default 100 }}
+  #   fsGroup: {{ .Values.snapshotAgent.gid | default 1000 }}
+  # and for container is
+  #    allowPrivilegeEscalation: false
+  #    capabilities:
+  #      drop:
+  #        - ALL
+  securityContext:
+    pod: {}
+    container: {}
diff --git a/packages/system/openbao/values.yaml b/packages/system/openbao/values.yaml
new file mode 100644
index 00000000..957f37a0
--- /dev/null
+++ b/packages/system/openbao/values.yaml
@@ -0,0 +1,5 @@
+openbao:
+  injector:
+    enabled: false
+  csi:
+    enabled: false

From da59efec21b479bc541e88274eac8c4a9a62d411 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 17 Feb 2026 20:03:01 +0300
Subject: [PATCH 063/666] feat(openbao): add application chart with standalone
 and HA modes

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/apps/openbao/.helmignore             |  3 +
 packages/apps/openbao/Chart.yaml              |  7 ++
 packages/apps/openbao/Makefile                |  5 +
 packages/apps/openbao/README.md               | 27 +++++
 packages/apps/openbao/charts/cozy-lib         |  1 +
 packages/apps/openbao/logos/openbao.svg       | 11 +++
 .../apps/openbao/templates/_resources.tpl     | 49 +++++++++
 .../templates/dashboard-resourcemap.yaml      | 31 ++++++
 packages/apps/openbao/templates/openbao.yaml  | 99 +++++++++++++++++++
 .../openbao/templates/workloadmonitor.yaml    | 13 +++
 packages/apps/openbao/values.schema.json      | 87 ++++++++++++++++
 packages/apps/openbao/values.yaml             | 41 ++++++++
 12 files changed, 374 insertions(+)
 create mode 100644 packages/apps/openbao/.helmignore
 create mode 100644 packages/apps/openbao/Chart.yaml
 create mode 100644 packages/apps/openbao/Makefile
 create mode 100644 packages/apps/openbao/README.md
 create mode 120000 packages/apps/openbao/charts/cozy-lib
 create mode 100644 packages/apps/openbao/logos/openbao.svg
 create mode 100644 packages/apps/openbao/templates/_resources.tpl
 create mode 100644 packages/apps/openbao/templates/dashboard-resourcemap.yaml
 create mode 100644 packages/apps/openbao/templates/openbao.yaml
 create mode 100644 packages/apps/openbao/templates/workloadmonitor.yaml
 create mode 100644 packages/apps/openbao/values.schema.json
 create mode 100644 packages/apps/openbao/values.yaml

diff --git a/packages/apps/openbao/.helmignore b/packages/apps/openbao/.helmignore
new file mode 100644
index 00000000..1ea0ae84
--- /dev/null
+++ b/packages/apps/openbao/.helmignore
@@ -0,0 +1,3 @@
+.helmignore
+/logos
+/Makefile
diff --git a/packages/apps/openbao/Chart.yaml b/packages/apps/openbao/Chart.yaml
new file mode 100644
index 00000000..f33fc756
--- /dev/null
+++ b/packages/apps/openbao/Chart.yaml
@@ -0,0 +1,7 @@
+apiVersion: v2
+name: openbao
+description: Managed OpenBAO secrets management service
+icon: /logos/openbao.svg
+type: application
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
+appVersion: "2.5.0"
diff --git a/packages/apps/openbao/Makefile b/packages/apps/openbao/Makefile
new file mode 100644
index 00000000..d1cfda8e
--- /dev/null
+++ b/packages/apps/openbao/Makefile
@@ -0,0 +1,5 @@
+include ../../../hack/package.mk
+
+generate:
+	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	../../../hack/update-crd.sh
diff --git a/packages/apps/openbao/README.md b/packages/apps/openbao/README.md
new file mode 100644
index 00000000..c53c9d28
--- /dev/null
+++ b/packages/apps/openbao/README.md
@@ -0,0 +1,27 @@
+# Managed OpenBAO Service
+
+OpenBAO is an open-source secrets management solution forked from HashiCorp Vault.
+It provides identity-based secrets and encryption management for cloud infrastructure.
+
+## Parameters
+
+### Common parameters
+
+| Name               | Description                                                                                                                                                                           | Type       | Value   |
+| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | ------- |
+| `replicas`         | Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas > 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration. | `int`      | `1`     |
+| `resources`        | Explicit CPU and memory configuration for each OpenBAO replica. When omitted, the preset defined in `resourcesPreset` is applied.                                                     | `object`   | `{}`    |
+| `resources.cpu`    | CPU available to each replica.                                                                                                                                                        | `quantity` | `""`    |
+| `resources.memory` | Memory (RAM) available to each replica.                                                                                                                                               | `quantity` | `""`    |
+| `resourcesPreset`  | Default sizing preset used when `resources` is omitted.                                                                                                                               | `string`   | `small` |
+| `size`             | Persistent Volume Claim size for data storage.                                                                                                                                        | `quantity` | `10Gi`  |
+| `storageClass`     | StorageClass used to store the data.                                                                                                                                                  | `string`   | `""`    |
+| `external`         | Enable external access from outside the cluster.                                                                                                                                      | `bool`     | `false` |
+
+
+### Application-specific parameters
+
+| Name | Description                | Type   | Value  |
+| ---- | -------------------------- | ------ | ------ |
+| `ui` | Enable the OpenBAO web UI. | `bool` | `true` |
+
diff --git a/packages/apps/openbao/charts/cozy-lib b/packages/apps/openbao/charts/cozy-lib
new file mode 120000
index 00000000..e1813509
--- /dev/null
+++ b/packages/apps/openbao/charts/cozy-lib
@@ -0,0 +1 @@
+../../../library/cozy-lib
\ No newline at end of file
diff --git a/packages/apps/openbao/logos/openbao.svg b/packages/apps/openbao/logos/openbao.svg
new file mode 100644
index 00000000..5ce73b79
--- /dev/null
+++ b/packages/apps/openbao/logos/openbao.svg
@@ -0,0 +1,11 @@
+<svg width="144" height="144" viewBox="0 0 144 144" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="144" height="144" rx="24" fill="url(#paint0_linear)"/>
+<rect width="144" height="144" rx="24" fill="black" fill-opacity="0.3"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M72 30C53.222 30 38 45.222 38 64v8c-3.314 0-6 2.686-6 6v30c0 3.314 2.686 6 6 6h68c3.314 0 6-2.686 6-6V78c0-3.314-2.686-6-6-6v-8C106 45.222 90.778 30 72 30zm-8 42v-8c0-4.418 3.582-8 8-8s8 3.582 8 8v8H64zm26 0v-8c0-8.837-7.163-16-16-16s-16 7.163-16 16v8h-2v28h60V72H90zm-22 14a4 4 0 118 0 4 4 0 01-8 0zm4-8a8 8 0 100 16 8 8 0 000-16z" fill="white"/>
+<defs>
+<linearGradient id="paint0_linear" x1="10" y1="15.5" x2="144" y2="131.5" gradientUnits="userSpaceOnUse">
+<stop stop-color="#87d6be"/>
+<stop offset="1" stop-color="#79c0ab"/>
+</linearGradient>
+</defs>
+</svg>
diff --git a/packages/apps/openbao/templates/_resources.tpl b/packages/apps/openbao/templates/_resources.tpl
new file mode 100644
index 00000000..7aeb976e
--- /dev/null
+++ b/packages/apps/openbao/templates/_resources.tpl
@@ -0,0 +1,49 @@
+{{/*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{/* vim: set filetype=mustache: */}}
+
+{{/*
+Return a resource request/limit object based on a given preset.
+These presets are for basic testing and not meant to be used in production
+{{ include "resources.preset" (dict "type" "nano") -}}
+*/}}
+{{- define "resources.preset" -}}
+{{- $presets := dict
+  "nano" (dict
+      "requests" (dict "cpu" "100m" "memory" "128Mi" "ephemeral-storage" "50Mi")
+      "limits" (dict "memory" "128Mi" "ephemeral-storage" "2Gi")
+   )
+  "micro" (dict
+      "requests" (dict "cpu" "250m" "memory" "256Mi" "ephemeral-storage" "50Mi")
+      "limits" (dict "memory" "256Mi" "ephemeral-storage" "2Gi")
+   )
+  "small" (dict
+      "requests" (dict "cpu" "500m" "memory" "512Mi" "ephemeral-storage" "50Mi")
+      "limits" (dict "memory" "512Mi" "ephemeral-storage" "2Gi")
+   )
+  "medium" (dict
+      "requests" (dict "cpu" "500m" "memory" "1Gi" "ephemeral-storage" "50Mi")
+      "limits" (dict "memory" "1Gi" "ephemeral-storage" "2Gi")
+   )
+  "large" (dict
+      "requests" (dict "cpu" "1" "memory" "2Gi" "ephemeral-storage" "50Mi")
+      "limits" (dict "memory" "2Gi" "ephemeral-storage" "2Gi")
+   )
+  "xlarge" (dict
+      "requests" (dict "cpu" "2" "memory" "4Gi" "ephemeral-storage" "50Mi")
+      "limits" (dict "memory" "4Gi" "ephemeral-storage" "2Gi")
+   )
+  "2xlarge" (dict
+      "requests" (dict "cpu" "4" "memory" "8Gi" "ephemeral-storage" "50Mi")
+      "limits" (dict "memory" "8Gi" "ephemeral-storage" "2Gi")
+   )
+ }}
+{{- if hasKey $presets .type -}}
+{{- index $presets .type | toYaml -}}
+{{- else -}}
+{{- printf "ERROR: Preset key '%s' invalid. Allowed values are %s" .type (join "," (keys $presets)) | fail -}}
+{{- end -}}
+{{- end -}}
diff --git a/packages/apps/openbao/templates/dashboard-resourcemap.yaml b/packages/apps/openbao/templates/dashboard-resourcemap.yaml
new file mode 100644
index 00000000..452a07db
--- /dev/null
+++ b/packages/apps/openbao/templates/dashboard-resourcemap.yaml
@@ -0,0 +1,31 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  resourceNames:
+  - {{ .Release.Name }}
+  - {{ .Release.Name }}-internal
+  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - cozystack.io
+  resources:
+  - workloadmonitors
+  resourceNames:
+  - {{ .Release.Name }}
+  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
diff --git a/packages/apps/openbao/templates/openbao.yaml b/packages/apps/openbao/templates/openbao.yaml
new file mode 100644
index 00000000..daa6f9c4
--- /dev/null
+++ b/packages/apps/openbao/templates/openbao.yaml
@@ -0,0 +1,99 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: {{ .Release.Name }}-system
+  labels:
+    sharding.fluxcd.io/key: tenants
+spec:
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-openbao-application-default-openbao-system
+    namespace: cozy-system
+  interval: 5m
+  timeout: 10m
+  install:
+    remediation:
+      retries: -1
+  upgrade:
+    force: true
+    remediation:
+      retries: -1
+  valuesFrom:
+  - kind: Secret
+    name: cozystack-values
+  values:
+    openbao:
+      fullnameOverride: {{ .Release.Name }}
+      global:
+        tlsDisable: true
+      server:
+        podManagementPolicy: Parallel
+        resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.resourcesPreset .Values.resources $) | nindent 10 }}
+        dataStorage:
+          enabled: true
+          size: {{ .Values.size }}
+          {{- with .Values.storageClass }}
+          storageClass: {{ . }}
+          {{- end }}
+        {{- if gt (int .Values.replicas) 1 }}
+        standalone:
+          enabled: false
+        ha:
+          enabled: true
+          replicas: {{ .Values.replicas }}
+          raft:
+            enabled: true
+            setNodeId: true
+            config: |
+              ui = {{ .Values.ui }}
+
+              listener "tcp" {
+                address = "[::]:8200"
+                cluster_address = "[::]:8201"
+                tls_disable = true
+              }
+
+              storage "raft" {
+                path = "/openbao/data"
+              {{- range $i := until (int $.Values.replicas) }}
+                retry_join {
+                  leader_api_addr = "http://{{ $.Release.Name }}-{{ $i }}.{{ $.Release.Name }}-internal:8200"
+                }
+              {{- end }}
+              }
+
+              service_registration "kubernetes" {}
+        {{- else }}
+        standalone:
+          enabled: true
+          config: |
+            ui = {{ .Values.ui }}
+
+            listener "tcp" {
+              address = "[::]:8200"
+              cluster_address = "[::]:8201"
+              tls_disable = true
+            }
+
+            storage "file" {
+              path = "/openbao/data"
+            }
+            # Note: service_registration "kubernetes" {} is intentionally omitted
+            # in standalone mode — it requires an HA-capable storage backend and
+            # causes a fatal error with storage "file".
+        ha:
+          enabled: false
+        {{- end }}
+        {{- if .Values.external }}
+        service:
+          type: LoadBalancer
+        {{- end }}
+      ui:
+        enabled: {{ .Values.ui }}
+        {{- if .Values.external }}
+        serviceType: LoadBalancer
+        {{- end }}
+      injector:
+        enabled: false
+      csi:
+        enabled: false
diff --git a/packages/apps/openbao/templates/workloadmonitor.yaml b/packages/apps/openbao/templates/workloadmonitor.yaml
new file mode 100644
index 00000000..0a9acf76
--- /dev/null
+++ b/packages/apps/openbao/templates/workloadmonitor.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ $.Release.Name }}
+spec:
+  replicas: {{ .Values.replicas }}
+  minReplicas: 1
+  kind: openbao
+  type: openbao
+  selector:
+    app.kubernetes.io/instance: {{ $.Release.Name }}-system
+  version: {{ $.Chart.Version }}
diff --git a/packages/apps/openbao/values.schema.json b/packages/apps/openbao/values.schema.json
new file mode 100644
index 00000000..b48f28a6
--- /dev/null
+++ b/packages/apps/openbao/values.schema.json
@@ -0,0 +1,87 @@
+{
+  "title": "Chart Values",
+  "type": "object",
+  "properties": {
+    "external": {
+      "description": "Enable external access from outside the cluster.",
+      "type": "boolean",
+      "default": false
+    },
+    "replicas": {
+      "description": "Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas \u003e 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration.",
+      "type": "integer",
+      "default": 1
+    },
+    "resources": {
+      "description": "Explicit CPU and memory configuration for each OpenBAO replica. When omitted, the preset defined in `resourcesPreset` is applied.",
+      "type": "object",
+      "default": {},
+      "properties": {
+        "cpu": {
+          "description": "CPU available to each replica.",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        },
+        "memory": {
+          "description": "Memory (RAM) available to each replica.",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        }
+      }
+    },
+    "resourcesPreset": {
+      "description": "Default sizing preset used when `resources` is omitted.",
+      "type": "string",
+      "default": "small",
+      "enum": [
+        "nano",
+        "micro",
+        "small",
+        "medium",
+        "large",
+        "xlarge",
+        "2xlarge"
+      ]
+    },
+    "size": {
+      "description": "Persistent Volume Claim size for data storage.",
+      "default": "10Gi",
+      "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+      "anyOf": [
+        {
+          "type": "integer"
+        },
+        {
+          "type": "string"
+        }
+      ],
+      "x-kubernetes-int-or-string": true
+    },
+    "storageClass": {
+      "description": "StorageClass used to store the data.",
+      "type": "string",
+      "default": ""
+    },
+    "ui": {
+      "description": "Enable the OpenBAO web UI.",
+      "type": "boolean",
+      "default": true
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/apps/openbao/values.yaml b/packages/apps/openbao/values.yaml
new file mode 100644
index 00000000..fc8b75cc
--- /dev/null
+++ b/packages/apps/openbao/values.yaml
@@ -0,0 +1,41 @@
+##
+## @section Common parameters
+##
+
+## @typedef {struct} Resources - Explicit CPU and memory configuration for each OpenBAO replica.
+## @field {quantity} [cpu] - CPU available to each replica.
+## @field {quantity} [memory] - Memory (RAM) available to each replica.
+
+## @enum {string} ResourcesPreset - Default sizing preset.
+## @value nano
+## @value micro
+## @value small
+## @value medium
+## @value large
+## @value xlarge
+## @value 2xlarge
+
+## @param {int} replicas - Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas > 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration.
+replicas: 1
+
+## @param {Resources} [resources] - Explicit CPU and memory configuration for each OpenBAO replica. When omitted, the preset defined in `resourcesPreset` is applied.
+resources: {}
+
+## @param {ResourcesPreset} resourcesPreset="small" - Default sizing preset used when `resources` is omitted.
+resourcesPreset: "small"
+
+## @param {quantity} size - Persistent Volume Claim size for data storage.
+size: 10Gi
+
+## @param {string} storageClass - StorageClass used to store the data.
+storageClass: ""
+
+## @param {bool} external - Enable external access from outside the cluster.
+external: false
+
+##
+## @section Application-specific parameters
+##
+
+## @param {bool} ui - Enable the OpenBAO web UI.
+ui: true

From 088bc0ffe2285bdbf783862d602baa9498fd15b8 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 17 Feb 2026 20:03:02 +0300
Subject: [PATCH 064/666] feat(openbao): add resource definition,
 PackageSource, and PaaS bundle entry

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../platform/sources/openbao-application.yaml | 29 +++++++++++++++
 .../core/platform/templates/bundles/paas.yaml |  1 +
 packages/system/openbao-rd/Chart.yaml         |  3 ++
 packages/system/openbao-rd/Makefile           |  4 ++
 .../system/openbao-rd/cozyrds/openbao.yaml    | 37 +++++++++++++++++++
 .../system/openbao-rd/templates/cozyrd.yaml   |  4 ++
 packages/system/openbao-rd/values.yaml        |  1 +
 7 files changed, 79 insertions(+)
 create mode 100644 packages/core/platform/sources/openbao-application.yaml
 create mode 100644 packages/system/openbao-rd/Chart.yaml
 create mode 100644 packages/system/openbao-rd/Makefile
 create mode 100644 packages/system/openbao-rd/cozyrds/openbao.yaml
 create mode 100644 packages/system/openbao-rd/templates/cozyrd.yaml
 create mode 100644 packages/system/openbao-rd/values.yaml

diff --git a/packages/core/platform/sources/openbao-application.yaml b/packages/core/platform/sources/openbao-application.yaml
new file mode 100644
index 00000000..438148af
--- /dev/null
+++ b/packages/core/platform/sources/openbao-application.yaml
@@ -0,0 +1,29 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.openbao-application
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+    path: /
+  variants:
+    - name: default
+      dependsOn:
+        - cozystack.networking
+      libraries:
+        - name: cozy-lib
+          path: library/cozy-lib
+      components:
+        - name: openbao-system
+          path: system/openbao
+        - name: openbao
+          path: apps/openbao
+          libraries: ["cozy-lib"]
+        - name: openbao-rd
+          path: system/openbao-rd
+          install:
+            namespace: cozy-system
+            releaseName: openbao-rd
diff --git a/packages/core/platform/templates/bundles/paas.yaml b/packages/core/platform/templates/bundles/paas.yaml
index 5a478f9d..80eb9824 100644
--- a/packages/core/platform/templates/bundles/paas.yaml
+++ b/packages/core/platform/templates/bundles/paas.yaml
@@ -15,6 +15,7 @@
 {{include "cozystack.platform.package.default" (list "cozystack.mariadb-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.mongodb-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.nats-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.openbao-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.postgres-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.qdrant-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.rabbitmq-application" $) }}
diff --git a/packages/system/openbao-rd/Chart.yaml b/packages/system/openbao-rd/Chart.yaml
new file mode 100644
index 00000000..f93484c3
--- /dev/null
+++ b/packages/system/openbao-rd/Chart.yaml
@@ -0,0 +1,3 @@
+apiVersion: v2
+name: openbao-rd
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
diff --git a/packages/system/openbao-rd/Makefile b/packages/system/openbao-rd/Makefile
new file mode 100644
index 00000000..3ad0f7ba
--- /dev/null
+++ b/packages/system/openbao-rd/Makefile
@@ -0,0 +1,4 @@
+export NAME=openbao-rd
+export NAMESPACE=cozy-system
+
+include ../../../hack/package.mk
diff --git a/packages/system/openbao-rd/cozyrds/openbao.yaml b/packages/system/openbao-rd/cozyrds/openbao.yaml
new file mode 100644
index 00000000..9c20776e
--- /dev/null
+++ b/packages/system/openbao-rd/cozyrds/openbao.yaml
@@ -0,0 +1,37 @@
+apiVersion: cozystack.io/v1alpha1
+kind: ApplicationDefinition
+metadata:
+  name: openbao
+spec:
+  application:
+    kind: OpenBAO
+    plural: openbaos
+    singular: openbao
+    openAPISchema: |-
+      {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"replicas":{"description":"Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas > 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration.","type":"integer","default":1},"resources":{"description":"Explicit CPU and memory configuration for each OpenBAO replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size for data storage.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"ui":{"description":"Enable the OpenBAO web UI.","type":"boolean","default":true}}}
+  release:
+    prefix: openbao-
+    labels:
+      sharding.fluxcd.io/key: tenants
+    chartRef:
+      kind: ExternalArtifact
+      name: cozystack-openbao-application-default-openbao
+      namespace: cozy-system
+  dashboard:
+    category: PaaS
+    singular: OpenBAO
+    plural: OpenBAO
+    description: Managed OpenBAO secrets management service
+    tags:
+      - secrets
+    icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcikiLz4KPHJlY3Qgd2lkdGg9IjE0NCIgaGVpZ2h0PSIxNDQiIHJ4PSIyNCIgZmlsbD0iYmxhY2siIGZpbGwtb3BhY2l0eT0iMC4zIi8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNNzIgMzBDNTMuMjIyIDMwIDM4IDQ1LjIyMiAzOCA2NHY4Yy0zLjMxNCAwLTYgMi42ODYtNiA2djMwYzAgMy4zMTQgMi42ODYgNiA2IDZoNjhjMy4zMTQgMCA2LTIuNjg2IDYtNlY3OGMwLTMuMzE0LTIuNjg2LTYtNi02di04QzEwNiA0NS4yMjIgOTAuNzc4IDMwIDcyIDMwem0tOCA0MnYtOGMwLTQuNDE4IDMuNTgyLTggOC04czggMy41ODIgOCA4djhINjR6bTI2IDB2LThjMC04LjgzNy03LjE2My0xNi0xNi0xNnMtMTYgNy4xNjMtMTYgMTZ2OGgtMnYyOGg2MFY3Mkg5MHptLTIyIDE0YTQgNCAwIDExOCAwIDQgNCAwIDAxLTggMHptNC04YTggOCAwIDEwMCAxNiA4IDggMCAwMDAtMTZ6IiBmaWxsPSJ3aGl0ZSIvPgo8ZGVmcz4KPGxpbmVhckdyYWRpZW50IGlkPSJwYWludDBfbGluZWFyIiB4MT0iMTAiIHkxPSIxNS41IiB4Mj0iMTQ0IiB5Mj0iMTMxLjUiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj4KPHN0b3Agc3RvcC1jb2xvcj0iIzg3ZDZiZSIvPgo8c3RvcCBvZmZzZXQ9IjEiIHN0b3AtY29sb3I9IiM3OWMwYWIiLz4KPC9saW5lYXJHcmFkaWVudD4KPC9kZWZzPgo8L3N2Zz4K
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "replicas"], ["spec", "resources"], ["spec", "resourcesPreset"], ["spec", "size"], ["spec", "storageClass"], ["spec", "external"], ["spec", "ui"]]
+  secrets:
+    exclude: []
+    include: []
+  services:
+    exclude: []
+    include:
+      - resourceNames:
+          - openbao-{{ .name }}
+          - openbao-{{ .name }}-internal
diff --git a/packages/system/openbao-rd/templates/cozyrd.yaml b/packages/system/openbao-rd/templates/cozyrd.yaml
new file mode 100644
index 00000000..e079ddcf
--- /dev/null
+++ b/packages/system/openbao-rd/templates/cozyrd.yaml
@@ -0,0 +1,4 @@
+{{- range $path, $_ := .Files.Glob "cozyrds/*" }}
+---
+{{ $.Files.Get $path }}
+{{- end }}
diff --git a/packages/system/openbao-rd/values.yaml b/packages/system/openbao-rd/values.yaml
new file mode 100644
index 00000000..0967ef42
--- /dev/null
+++ b/packages/system/openbao-rd/values.yaml
@@ -0,0 +1 @@
+{}

From dd4723386fcbb4041d6bb6bef144c5c8597e55ac Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 17 Feb 2026 21:23:27 +0300
Subject: [PATCH 065/666] test(openbao): add E2E test for standalone mode

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/openbao.bats | 59 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 hack/e2e-apps/openbao.bats

diff --git a/hack/e2e-apps/openbao.bats b/hack/e2e-apps/openbao.bats
new file mode 100644
index 00000000..cd9d47d3
--- /dev/null
+++ b/hack/e2e-apps/openbao.bats
@@ -0,0 +1,59 @@
+#!/usr/bin/env bats
+
+@test "Create OpenBAO (standalone)" {
+  name='test'
+  kubectl apply -f- <<EOF
+apiVersion: apps.cozystack.io/v1alpha1
+kind: OpenBAO
+metadata:
+  name: $name
+  namespace: tenant-test
+spec:
+  replicas: 1
+  size: 10Gi
+  storageClass: ""
+  resourcesPreset: "small"
+  resources: {}
+  external: false
+  ui: true
+EOF
+  sleep 5
+  kubectl -n tenant-test wait hr openbao-$name --timeout=60s --for=condition=ready
+  kubectl -n tenant-test wait hr openbao-$name-system --timeout=120s --for=condition=ready
+
+  # Wait for container to be started (pod Running does not guarantee container is ready for exec on slow CI)
+  if ! timeout 120 sh -ec "until kubectl -n tenant-test get pod openbao-$name-0 --output jsonpath='{.status.containerStatuses[0].started}' 2>/dev/null | grep -q true; do sleep 5; done"; then
+    echo "=== DEBUG: Container did not start in time ===" >&2
+    kubectl -n tenant-test describe pod openbao-$name-0 >&2 || true
+    kubectl -n tenant-test logs openbao-$name-0 --previous >&2 || true
+    kubectl -n tenant-test logs openbao-$name-0 >&2 || true
+    return 1
+  fi
+
+  # Wait for OpenBAO API to accept connections
+  # bao status exit codes: 0 = unsealed, 1 = error/not ready, 2 = sealed but responsive
+  if ! timeout 60 sh -ec "until kubectl -n tenant-test exec openbao-$name-0 -- bao status >/dev/null 2>&1; rc=\$?; test \$rc -eq 0 -o \$rc -eq 2; do sleep 3; done"; then
+    echo "=== DEBUG: OpenBAO API did not become responsive ===" >&2
+    kubectl -n tenant-test describe pod openbao-$name-0 >&2 || true
+    kubectl -n tenant-test logs openbao-$name-0 --previous >&2 || true
+    kubectl -n tenant-test logs openbao-$name-0 >&2 || true
+    return 1
+  fi
+
+  # Initialize OpenBAO (single key share for testing simplicity)
+  init_output=$(kubectl -n tenant-test exec openbao-$name-0 -- bao operator init -key-shares=1 -key-threshold=1 -format=json)
+  unseal_key=$(echo "$init_output" | jq -r '.unseal_keys_b64[0]')
+  if [ -z "$unseal_key" ] || [ "$unseal_key" = "null" ]; then
+    echo "Failed to extract unseal key. Init output: $init_output" >&2
+    return 1
+  fi
+
+  # Unseal OpenBAO
+  kubectl -n tenant-test exec openbao-$name-0 -- bao operator unseal "$unseal_key"
+
+  # Now wait for pod to become ready (readiness probe checks seal status)
+  kubectl -n tenant-test wait sts openbao-$name --timeout=90s --for=jsonpath='{.status.readyReplicas}'=1
+  kubectl -n tenant-test wait pvc data-openbao-$name-0 --timeout=50s --for=jsonpath='{.status.phase}'=Bound
+  kubectl -n tenant-test delete openbao.apps.cozystack.io $name
+  kubectl -n tenant-test delete pvc data-openbao-$name-0 --ignore-not-found
+}

From 8cc8e52d157f9b9116b2f4c84650000b77f9904b Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 17 Feb 2026 19:31:57 +0100
Subject: [PATCH 066/666] chore(platform): remove standalone kilo PackageSource

Kilo is now integrated into the cilium-kilo networking variant instead
of being a separate package that users install manually.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/core/platform/sources/kilo.yaml | 35 ------------------------
 1 file changed, 35 deletions(-)
 delete mode 100644 packages/core/platform/sources/kilo.yaml

diff --git a/packages/core/platform/sources/kilo.yaml b/packages/core/platform/sources/kilo.yaml
deleted file mode 100644
index 95770667..00000000
--- a/packages/core/platform/sources/kilo.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
----
-apiVersion: cozystack.io/v1alpha1
-kind: PackageSource
-metadata:
-  name: cozystack.kilo
-spec:
-  sourceRef:
-    kind: OCIRepository
-    name: cozystack-packages
-    namespace: cozy-system
-    path: /
-  variants:
-  - name: default
-    dependsOn:
-    - cozystack.networking
-    components:
-    - name: kilo
-      path: system/kilo
-      install:
-        privileged: true
-        namespace: cozy-kilo
-        releaseName: kilo
-  - name: cilium
-    dependsOn:
-    - cozystack.networking
-    components:
-    - name: kilo
-      path: system/kilo
-      valuesFiles:
-      - values.yaml
-      - values-cilium.yaml
-      install:
-        privileged: true
-        namespace: cozy-kilo
-        releaseName: kilo

From 536766cffcf4fcebad5ef28e4ad21991ff5c2c3d Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 17 Feb 2026 19:32:19 +0100
Subject: [PATCH 067/666] feat(platform): add cilium-kilo networking variant

Add a new networking variant that integrates Kilo with Cilium
pre-configured. Cilium is deployed with host firewall disabled and
enable-ipip-termination enabled, which are required for correct IPIP
encapsulation through Cilium's overlay.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../core/platform/sources/networking.yaml     | 25 +++++++++++++++++++
 packages/system/cilium/values-kilo.yaml       |  5 ++++
 2 files changed, 30 insertions(+)
 create mode 100644 packages/system/cilium/values-kilo.yaml

diff --git a/packages/core/platform/sources/networking.yaml b/packages/core/platform/sources/networking.yaml
index 9694dcc3..8e8485b3 100644
--- a/packages/core/platform/sources/networking.yaml
+++ b/packages/core/platform/sources/networking.yaml
@@ -33,6 +33,31 @@ spec:
         releaseName: cilium-networkpolicy
         dependsOn:
         - cilium
+  - name: cilium-kilo
+    dependsOn: []
+    components:
+    - name: cilium
+      path: system/cilium
+      valuesFiles:
+      - values.yaml
+      - values-talos.yaml
+      - values-kilo.yaml
+      install:
+        privileged: true
+        namespace: cozy-cilium
+        releaseName: cilium
+        dependsOn: []
+    - name: kilo
+      path: system/kilo
+      valuesFiles:
+      - values.yaml
+      - values-cilium.yaml
+      install:
+        privileged: true
+        namespace: cozy-kilo
+        releaseName: kilo
+        dependsOn:
+        - cilium
   # Generic Cilium variant for non-Talos clusters (kubeadm, k3s, RKE2, etc.)
   - name: cilium-generic
     dependsOn: []
diff --git a/packages/system/cilium/values-kilo.yaml b/packages/system/cilium/values-kilo.yaml
new file mode 100644
index 00000000..c7e98d2a
--- /dev/null
+++ b/packages/system/cilium/values-kilo.yaml
@@ -0,0 +1,5 @@
+cilium:
+  hostFirewall:
+    enabled: false
+  extraConfig:
+    enable-ipip-termination: "true"

From 96ba3b9ca5df595d3dbc2f499e29ef763db4f2ef Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 17 Feb 2026 20:14:34 +0100
Subject: [PATCH 068/666] fix(kilo): remove service-cidr option from chart

The --service-cidr flag prevents masquerading for service IPs, but
service CIDRs are cluster-local and not useful for multi-location
mesh routing. Remove the serviceCIDR value and its template usage.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/system/kilo/templates/kilo.yaml | 3 ---
 packages/system/kilo/values.yaml         | 5 ++---
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/packages/system/kilo/templates/kilo.yaml b/packages/system/kilo/templates/kilo.yaml
index fef7a718..a0af620a 100644
--- a/packages/system/kilo/templates/kilo.yaml
+++ b/packages/system/kilo/templates/kilo.yaml
@@ -38,9 +38,6 @@ spec:
         {{- with .Values.kilo.podCIDR }}
         - --service-cidr={{ . }}
         {{- end }}
-        {{- with .Values.kilo.serviceCIDR }}
-        - --service-cidr={{ . }}
-        {{- end }}
         {{- with .Values.kilo.transitCIDR }}
         - --subnet={{ . }}
         {{- end }}
diff --git a/packages/system/kilo/values.yaml b/packages/system/kilo/values.yaml
index 4057c284..939fd222 100644
--- a/packages/system/kilo/values.yaml
+++ b/packages/system/kilo/values.yaml
@@ -1,10 +1,9 @@
 kilo:
   image:
     pullPolicy: IfNotPresent
-    tag: v0.8.1@sha256:56602fa796eccea0d0e005c29e5c7094ae46d15bd5306b02b829672b178dcd5c
-    repository: ghcr.io/cozystack/cozystack/kilo
+    tag: kilo-require-cilium-tunl
+    repository: ghcr.io/kvaps/test
   podCIDR: 10.244.0.0/16
-  serviceCIDR: 10.96.0.0/16
   transitCIDR: 100.66.0.0/16
   meshGranularity: location
   cleanUpInterface: false

From bf1e49d34bad47afeb6d25ff9350472aa1fbd6e6 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 17 Feb 2026 20:16:01 +0100
Subject: [PATCH 069/666] fix(kilo): remove podCIDR passed as --service-cidr

The podCIDR was incorrectly passed as --service-cidr to prevent
masquerading on pod traffic. This is unnecessary for multi-location
mesh and was a leftover from single-cluster assumptions.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/system/kilo/templates/kilo.yaml | 3 ---
 packages/system/kilo/values.yaml         | 1 -
 2 files changed, 4 deletions(-)

diff --git a/packages/system/kilo/templates/kilo.yaml b/packages/system/kilo/templates/kilo.yaml
index a0af620a..ceac643d 100644
--- a/packages/system/kilo/templates/kilo.yaml
+++ b/packages/system/kilo/templates/kilo.yaml
@@ -35,9 +35,6 @@ spec:
         - --encapsulate=crosssubnet
         - --local=false
         - --mesh-granularity={{ .Values.kilo.meshGranularity | default "location" }}
-        {{- with .Values.kilo.podCIDR }}
-        - --service-cidr={{ . }}
-        {{- end }}
         {{- with .Values.kilo.transitCIDR }}
         - --subnet={{ . }}
         {{- end }}
diff --git a/packages/system/kilo/values.yaml b/packages/system/kilo/values.yaml
index 939fd222..5ffd5da0 100644
--- a/packages/system/kilo/values.yaml
+++ b/packages/system/kilo/values.yaml
@@ -3,7 +3,6 @@ kilo:
     pullPolicy: IfNotPresent
     tag: kilo-require-cilium-tunl
     repository: ghcr.io/kvaps/test
-  podCIDR: 10.244.0.0/16
   transitCIDR: 100.66.0.0/16
   meshGranularity: location
   cleanUpInterface: false

From b3b73071057d3dce856f21b60eca44e9c1b12123 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 17 Feb 2026 22:14:52 +0100
Subject: [PATCH 070/666] fix(kilo): use official kilo image and clean up
 cilium-kilo config

Switch kilo image to official ghcr.io/cozystack/cozystack/kilo:v0.8.2,
remove unnecessary enable-ipip-termination from cilium-kilo values,
and update platform source digest.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/system/cilium/values-kilo.yaml | 2 --
 packages/system/kilo/values.yaml        | 4 ++--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/packages/system/cilium/values-kilo.yaml b/packages/system/cilium/values-kilo.yaml
index c7e98d2a..c303ef0a 100644
--- a/packages/system/cilium/values-kilo.yaml
+++ b/packages/system/cilium/values-kilo.yaml
@@ -1,5 +1,3 @@
 cilium:
   hostFirewall:
     enabled: false
-  extraConfig:
-    enable-ipip-termination: "true"
diff --git a/packages/system/kilo/values.yaml b/packages/system/kilo/values.yaml
index 5ffd5da0..d7c00af4 100644
--- a/packages/system/kilo/values.yaml
+++ b/packages/system/kilo/values.yaml
@@ -1,8 +1,8 @@
 kilo:
   image:
     pullPolicy: IfNotPresent
-    tag: kilo-require-cilium-tunl
-    repository: ghcr.io/kvaps/test
+    tag: v0.8.2@sha256:9f27000ffd0bbf9adf3aefd017b7835dfae57b6ea38bf7488fb636536c2467da
+    repository: ghcr.io/cozystack/cozystack/kilo
   transitCIDR: 100.66.0.0/16
   meshGranularity: location
   cleanUpInterface: false

From 153d2c48ae7215eb3b793b5ef7b2027f39edc5a9 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 16 Feb 2026 22:24:29 +0300
Subject: [PATCH 071/666] refactor(e2e): use helm install instead of kubectl
 apply for cozystack installation

Replace pre-rendered static YAML application with direct helm chart
installation in e2e tests. The chart directory with correct values is
already present in the sandbox after pr.patch application.

- Remove CRD/operator artifact upload/download from CI workflow
- Remove copy-installer-manifest target from testing Makefile
- Use helm upgrade --install from local chart in e2e-install-cozystack.bats

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .github/workflows/pull-requests.yaml | 40 +---------------------------
 hack/e2e-install-cozystack.bats      | 25 ++++++++---------
 packages/core/testing/Makefile       |  8 ++----
 3 files changed, 14 insertions(+), 59 deletions(-)

diff --git a/.github/workflows/pull-requests.yaml b/.github/workflows/pull-requests.yaml
index edc8b923..b9b7b0ac 100644
--- a/.github/workflows/pull-requests.yaml
+++ b/.github/workflows/pull-requests.yaml
@@ -71,18 +71,6 @@ jobs:
           name: pr-patch
           path: _out/assets/pr.patch
      
-      - name: Upload CRDs
-        uses: actions/upload-artifact@v4
-        with:
-          name: cozystack-crds
-          path: _out/assets/cozystack-crds.yaml
-
-      - name: Upload operator
-        uses: actions/upload-artifact@v4
-        with:
-          name: cozystack-operator
-          path: _out/assets/cozystack-operator-talos.yaml
-
       - name: Upload Talos image
         uses: actions/upload-artifact@v4
         with:
@@ -94,8 +82,6 @@ jobs:
     runs-on: ubuntu-latest
     if: contains(github.event.pull_request.labels.*.name, 'release')
     outputs:
-      crds_id:      ${{ steps.fetch_assets.outputs.crds_id }}
-      operator_id:  ${{ steps.fetch_assets.outputs.operator_id }}
       disk_id:      ${{ steps.fetch_assets.outputs.disk_id }}
 
     steps:
@@ -139,15 +125,11 @@ jobs:
               return;
             }
             const find = (n) => draft.assets.find(a => a.name === n)?.id;
-            const crdsId     = find('cozystack-crds.yaml');
-            const operatorId = find('cozystack-operator-talos.yaml');
             const diskId     = find('nocloud-amd64.raw.xz');
-            if (!crdsId || !operatorId || !diskId) {
+            if (!diskId) {
               core.setFailed('Required assets missing in draft release');
               return;
             }
-            core.setOutput('crds_id',     crdsId);
-            core.setOutput('operator_id', operatorId);
             core.setOutput('disk_id',     diskId);
 
 
@@ -174,20 +156,6 @@ jobs:
           name: talos-image
           path: _out/assets
 
-      - name: "Download CRDs (regular PR)"
-        if: "!contains(github.event.pull_request.labels.*.name, 'release')"
-        uses: actions/download-artifact@v4
-        with:
-          name: cozystack-crds
-          path: _out/assets
-
-      - name: "Download operator (regular PR)"
-        if: "!contains(github.event.pull_request.labels.*.name, 'release')"
-        uses: actions/download-artifact@v4
-        with:
-          name: cozystack-operator
-          path: _out/assets
-
       - name: Download PR patch
         if: "!contains(github.event.pull_request.labels.*.name, 'release')"
         uses: actions/download-artifact@v4
@@ -208,12 +176,6 @@ jobs:
           curl -sSL -H "Authorization: token ${GH_PAT}" -H "Accept: application/octet-stream" \
             -o _out/assets/nocloud-amd64.raw.xz \
             "https://api.github.com/repos/${GITHUB_REPOSITORY}/releases/assets/${{ needs.resolve_assets.outputs.disk_id }}"
-          curl -sSL -H "Authorization: token ${GH_PAT}" -H "Accept: application/octet-stream" \
-            -o _out/assets/cozystack-crds.yaml \
-            "https://api.github.com/repos/${GITHUB_REPOSITORY}/releases/assets/${{ needs.resolve_assets.outputs.crds_id }}"
-          curl -sSL -H "Authorization: token ${GH_PAT}" -H "Accept: application/octet-stream" \
-            -o _out/assets/cozystack-operator-talos.yaml \
-            "https://api.github.com/repos/${GITHUB_REPOSITORY}/releases/assets/${{ needs.resolve_assets.outputs.operator_id }}"
         env:
           GH_PAT: ${{ secrets.GH_PAT }}
 
diff --git a/hack/e2e-install-cozystack.bats b/hack/e2e-install-cozystack.bats
index 1abb691f..36329e93 100644
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -1,25 +1,22 @@
 #!/usr/bin/env bats
 
-@test "Required installer assets exist" {
-  if [ ! -f _out/assets/cozystack-crds.yaml ]; then
-    echo "Missing: _out/assets/cozystack-crds.yaml" >&2
-    exit 1
-  fi
-  if [ ! -f _out/assets/cozystack-operator-talos.yaml ]; then
-    echo "Missing: _out/assets/cozystack-operator-talos.yaml" >&2
+@test "Required installer chart exists" {
+  if [ ! -f packages/core/installer/Chart.yaml ]; then
+    echo "Missing: packages/core/installer/Chart.yaml" >&2
     exit 1
   fi
 }
 
 @test "Install Cozystack" {
-  # Create namespace
-  kubectl create namespace cozy-system --dry-run=client -o yaml | kubectl apply -f -
+  # Install cozy-installer chart
+  helm upgrade installer packages/core/installer \
+    --install \
+    --namespace cozy-system \
+    --create-namespace \
+    --wait \
+    --timeout 2m
 
-  # Apply installer manifests (CRDs + operator)
-  kubectl apply -f _out/assets/cozystack-crds.yaml
-  kubectl apply -f _out/assets/cozystack-operator-talos.yaml
-
-  # Wait for the operator deployment to become available
+  # Verify the operator deployment is available
   kubectl wait deployment/cozystack-operator -n cozy-system --timeout=1m --for=condition=Available
 
   # Create platform Package with isp-full variant
diff --git a/packages/core/testing/Makefile b/packages/core/testing/Makefile
index 2fb41eba..35897909 100644
--- a/packages/core/testing/Makefile
+++ b/packages/core/testing/Makefile
@@ -30,17 +30,13 @@ test: test-cluster test-openapi test-apps ## Run the end-to-end tests in existin
 copy-nocloud-image:
 	docker cp ../../../_out/assets/nocloud-amd64.raw.xz "${SANDBOX_NAME}":/workspace/_out/assets/nocloud-amd64.raw.xz
 
-copy-installer-manifest:
-	docker cp ../../../_out/assets/cozystack-crds.yaml "${SANDBOX_NAME}":/workspace/_out/assets/cozystack-crds.yaml
-	docker cp ../../../_out/assets/cozystack-operator-talos.yaml "${SANDBOX_NAME}":/workspace/_out/assets/cozystack-operator-talos.yaml
-
 prepare-cluster: copy-nocloud-image
 	docker exec "${SANDBOX_NAME}" sh -c 'cd /workspace && hack/cozytest.sh hack/e2e-prepare-cluster.bats'
 
-install-cozystack: copy-installer-manifest
+install-cozystack:
 	docker exec "${SANDBOX_NAME}" sh -c 'cd /workspace && hack/cozytest.sh hack/e2e-install-cozystack.bats'
 
-test-cluster: copy-nocloud-image copy-installer-manifest ## Run the end-to-end for creating a cluster
+test-cluster: copy-nocloud-image ## Run the end-to-end for creating a cluster
 	docker exec "${SANDBOX_NAME}" sh -c 'cd /workspace && hack/cozytest.sh hack/e2e-cluster.bats'
 
 test-openapi:

From 58dfc972019ee9db5593eb8ed3161733b8d3775f Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 16 Feb 2026 22:52:17 +0300
Subject: [PATCH 072/666] fix(e2e): apply CRDs before helm install to resolve
 dependency ordering

Helm cannot validate PackageSource CR during install because the CRD
is part of the same chart. Pre-apply CRDs via helm template + kubectl
apply --server-side before running helm upgrade --install.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-install-cozystack.bats | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hack/e2e-install-cozystack.bats b/hack/e2e-install-cozystack.bats
index 36329e93..f98c1266 100644
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -8,6 +8,12 @@
 }
 
 @test "Install Cozystack" {
+  # Install CRDs first (PackageSource CR in the chart depends on them)
+  helm template installer packages/core/installer \
+    --namespace cozy-system \
+    --show-only templates/crds.yaml \
+    | kubectl apply --server-side -f -
+
   # Install cozy-installer chart
   helm upgrade installer packages/core/installer \
     --install \

From 55cd8fc0e1ddc945d0d2523956646688c6804ecb Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 16 Feb 2026 23:04:03 +0300
Subject: [PATCH 073/666] refactor(installer): move CRDs to crds/ directory for
 proper Helm install ordering

Helm installs crds/ contents before processing templates, resolving the
chicken-and-egg problem where PackageSource CR validation fails because
its CRD hasn't been registered yet.

- Move definitions/ to crds/ in the installer chart
- Remove templates/crds.yaml (Helm auto-installs from crds/)
- Update codegen script to write CRDs to crds/
- Replace helm template with cat for static CRD manifest generation
- Remove pre-apply CRD workaround from e2e test

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 Makefile                                                  | 4 +---
 hack/e2e-install-cozystack.bats                           | 8 +-------
 hack/update-codegen.sh                                    | 2 +-
 packages/core/installer/.helmignore                       | 2 --
 .../core/installer/{definitions => crds}/.gitattributes   | 0
 .../{definitions => crds}/cozystack.io_packages.yaml      | 0
 .../cozystack.io_packagesources.yaml                      | 0
 packages/core/installer/templates/crds.yaml               | 3 ---
 8 files changed, 3 insertions(+), 16 deletions(-)
 rename packages/core/installer/{definitions => crds}/.gitattributes (100%)
 rename packages/core/installer/{definitions => crds}/cozystack.io_packages.yaml (100%)
 rename packages/core/installer/{definitions => crds}/cozystack.io_packagesources.yaml (100%)
 delete mode 100644 packages/core/installer/templates/crds.yaml

diff --git a/Makefile b/Makefile
index 12554861..dd6a249d 100644
--- a/Makefile
+++ b/Makefile
@@ -38,9 +38,7 @@ build: build-deps
 
 manifests:
 	mkdir -p _out/assets
-	helm template installer packages/core/installer -n cozy-system \
-		-s templates/crds.yaml \
-		> _out/assets/cozystack-crds.yaml
+	cat packages/core/installer/crds/*.yaml > _out/assets/cozystack-crds.yaml
 	# Talos variant (default)
 	helm template installer packages/core/installer -n cozy-system \
 		-s templates/cozystack-operator.yaml \
diff --git a/hack/e2e-install-cozystack.bats b/hack/e2e-install-cozystack.bats
index f98c1266..5e518cad 100644
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -8,13 +8,7 @@
 }
 
 @test "Install Cozystack" {
-  # Install CRDs first (PackageSource CR in the chart depends on them)
-  helm template installer packages/core/installer \
-    --namespace cozy-system \
-    --show-only templates/crds.yaml \
-    | kubectl apply --server-side -f -
-
-  # Install cozy-installer chart
+  # Install cozy-installer chart (CRDs from crds/ are applied automatically)
   helm upgrade installer packages/core/installer \
     --install \
     --namespace cozy-system \
diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh
index 293f229b..d0711cad 100755
--- a/hack/update-codegen.sh
+++ b/hack/update-codegen.sh
@@ -24,7 +24,7 @@ API_KNOWN_VIOLATIONS_DIR="${API_KNOWN_VIOLATIONS_DIR:-"${SCRIPT_ROOT}/api/api-ru
 UPDATE_API_KNOWN_VIOLATIONS="${UPDATE_API_KNOWN_VIOLATIONS:-true}"
 CONTROLLER_GEN="go run sigs.k8s.io/controller-tools/cmd/controller-gen@v0.16.4"
 TMPDIR=$(mktemp -d)
-OPERATOR_CRDDIR=packages/core/installer/definitions
+OPERATOR_CRDDIR=packages/core/installer/crds
 COZY_CONTROLLER_CRDDIR=packages/system/cozystack-controller/definitions
 COZY_RD_CRDDIR=packages/system/application-definition-crd/definition
 BACKUPS_CORE_CRDDIR=packages/system/backup-controller/definitions
diff --git a/packages/core/installer/.helmignore b/packages/core/installer/.helmignore
index ba88ffe8..6901ff3d 100644
--- a/packages/core/installer/.helmignore
+++ b/packages/core/installer/.helmignore
@@ -7,5 +7,3 @@ Makefile
 images/
 example/
 *.tgz
-
-# NOTE: definitions/ is intentionally NOT excluded — needed by crds.yaml via .Files.Glob
diff --git a/packages/core/installer/definitions/.gitattributes b/packages/core/installer/crds/.gitattributes
similarity index 100%
rename from packages/core/installer/definitions/.gitattributes
rename to packages/core/installer/crds/.gitattributes
diff --git a/packages/core/installer/definitions/cozystack.io_packages.yaml b/packages/core/installer/crds/cozystack.io_packages.yaml
similarity index 100%
rename from packages/core/installer/definitions/cozystack.io_packages.yaml
rename to packages/core/installer/crds/cozystack.io_packages.yaml
diff --git a/packages/core/installer/definitions/cozystack.io_packagesources.yaml b/packages/core/installer/crds/cozystack.io_packagesources.yaml
similarity index 100%
rename from packages/core/installer/definitions/cozystack.io_packagesources.yaml
rename to packages/core/installer/crds/cozystack.io_packagesources.yaml
diff --git a/packages/core/installer/templates/crds.yaml b/packages/core/installer/templates/crds.yaml
deleted file mode 100644
index 7c7ea584..00000000
--- a/packages/core/installer/templates/crds.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-{{- range $path, $_ := .Files.Glob "definitions/*.yaml" }}
-{{ $.Files.Get $path }}
-{{- end }}

From d8dd5adbe020e5e35da3ab5c6950c8ad03e3701e Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 16 Feb 2026 23:13:33 +0300
Subject: [PATCH 074/666] fix(testing): remove broken test-cluster target

The test-cluster target references non-existent hack/e2e-cluster.bats
file. Remove it and its dependency from the test target.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/core/testing/Makefile | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/packages/core/testing/Makefile b/packages/core/testing/Makefile
index 35897909..ce21a8e1 100644
--- a/packages/core/testing/Makefile
+++ b/packages/core/testing/Makefile
@@ -25,7 +25,7 @@ image-e2e-sandbox:
 		yq -i '.e2e.image = strenv(IMAGE)' values.yaml
 	rm -f images/e2e-sandbox.json
 
-test: test-cluster test-openapi test-apps ## Run the end-to-end tests in existing sandbox
+test: test-openapi test-apps ## Run the end-to-end tests in existing sandbox
 
 copy-nocloud-image:
 	docker cp ../../../_out/assets/nocloud-amd64.raw.xz "${SANDBOX_NAME}":/workspace/_out/assets/nocloud-amd64.raw.xz
@@ -36,9 +36,6 @@ prepare-cluster: copy-nocloud-image
 install-cozystack:
 	docker exec "${SANDBOX_NAME}" sh -c 'cd /workspace && hack/cozytest.sh hack/e2e-install-cozystack.bats'
 
-test-cluster: copy-nocloud-image ## Run the end-to-end for creating a cluster
-	docker exec "${SANDBOX_NAME}" sh -c 'cd /workspace && hack/cozytest.sh hack/e2e-cluster.bats'
-
 test-openapi:
 	docker exec "${SANDBOX_NAME}" sh -c 'cd /workspace && hack/cozytest.sh hack/e2e-test-openapi.bats'
 

From 1ddbe68bc2c28c3990af8d8d22d6309731437130 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 17 Feb 2026 23:23:10 +0300
Subject: [PATCH 075/666] feat(operator): add --install-crds flag with embedded
 CRD manifests

Embed Package and PackageSource CRDs in the operator binary using Go
embed, following the same pattern as --install-flux. The operator applies
CRDs at startup using server-side apply, ensuring they are updated on
every operator restart/upgrade.

This addresses the CRD lifecycle concern: Helm crds/ directory handles
initial install, while the operator manages updates on subsequent
deployments.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 cmd/cozystack-operator/main.go                |  16 ++
 internal/crdinstall/install.go                | 144 ++++++++++
 internal/crdinstall/manifests.embed.go        |  50 ++++
 internal/crdinstall/manifests/.gitattributes  |   1 +
 .../manifests/cozystack.io_packages.yaml      | 171 ++++++++++++
 .../cozystack.io_packagesources.yaml          | 250 ++++++++++++++++++
 6 files changed, 632 insertions(+)
 create mode 100644 internal/crdinstall/install.go
 create mode 100644 internal/crdinstall/manifests.embed.go
 create mode 100644 internal/crdinstall/manifests/.gitattributes
 create mode 100644 internal/crdinstall/manifests/cozystack.io_packages.yaml
 create mode 100644 internal/crdinstall/manifests/cozystack.io_packagesources.yaml

diff --git a/cmd/cozystack-operator/main.go b/cmd/cozystack-operator/main.go
index 188ce160..f365a076 100644
--- a/cmd/cozystack-operator/main.go
+++ b/cmd/cozystack-operator/main.go
@@ -50,6 +50,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
 
 	"github.com/cozystack/cozystack/internal/cozyvaluesreplicator"
+	"github.com/cozystack/cozystack/internal/crdinstall"
 	"github.com/cozystack/cozystack/internal/fluxinstall"
 	"github.com/cozystack/cozystack/internal/operator"
 	"github.com/cozystack/cozystack/internal/telemetry"
@@ -77,6 +78,7 @@ func main() {
 	var probeAddr string
 	var secureMetrics bool
 	var enableHTTP2 bool
+	var installCRDs bool
 	var installFlux bool
 	var disableTelemetry bool
 	var telemetryEndpoint string
@@ -97,6 +99,7 @@ func main() {
 		"If set the metrics endpoint is served securely")
 	flag.BoolVar(&enableHTTP2, "enable-http2", false,
 		"If set, HTTP/2 will be enabled for the metrics and webhook servers")
+	flag.BoolVar(&installCRDs, "install-crds", false, "Install Cozystack CRDs before starting reconcile loop")
 	flag.BoolVar(&installFlux, "install-flux", false, "Install Flux components before starting reconcile loop")
 	flag.BoolVar(&disableTelemetry, "disable-telemetry", false,
 		"Disable telemetry collection")
@@ -177,6 +180,19 @@ func main() {
 		os.Exit(1)
 	}
 
+	// Install Cozystack CRDs before starting reconcile loop
+	if installCRDs {
+		setupLog.Info("Installing Cozystack CRDs before starting reconcile loop")
+		installCtx, installCancel := context.WithTimeout(context.Background(), 2*time.Minute)
+		defer installCancel()
+
+		if err := crdinstall.Install(installCtx, directClient, crdinstall.WriteEmbeddedManifests); err != nil {
+			setupLog.Error(err, "failed to install CRDs")
+			os.Exit(1)
+		}
+		setupLog.Info("CRD installation completed successfully")
+	}
+
 	// Install Flux before starting reconcile loop
 	if installFlux {
 		setupLog.Info("Installing Flux components before starting reconcile loop")
diff --git a/internal/crdinstall/install.go b/internal/crdinstall/install.go
new file mode 100644
index 00000000..fb6e4588
--- /dev/null
+++ b/internal/crdinstall/install.go
@@ -0,0 +1,144 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package crdinstall
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	k8syaml "k8s.io/apimachinery/pkg/util/yaml"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+)
+
+// Install applies Cozystack CRDs using embedded manifests.
+// It extracts the manifests and applies them to the cluster using server-side apply.
+func Install(ctx context.Context, k8sClient client.Client, writeEmbeddedManifests func(string) error) error {
+	logger := log.FromContext(ctx)
+
+	tmpDir, err := os.MkdirTemp("", "crd-install-*")
+	if err != nil {
+		return fmt.Errorf("failed to create temp directory: %w", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	manifestsDir := filepath.Join(tmpDir, "manifests")
+	if err := os.MkdirAll(manifestsDir, 0755); err != nil {
+		return fmt.Errorf("failed to create manifests directory: %w", err)
+	}
+
+	if err := writeEmbeddedManifests(manifestsDir); err != nil {
+		return fmt.Errorf("failed to extract embedded manifests: %w", err)
+	}
+
+	entries, err := os.ReadDir(manifestsDir)
+	if err != nil {
+		return fmt.Errorf("failed to read manifests directory: %w", err)
+	}
+
+	var manifestFiles []string
+	for _, entry := range entries {
+		if strings.HasSuffix(entry.Name(), ".yaml") {
+			manifestFiles = append(manifestFiles, filepath.Join(manifestsDir, entry.Name()))
+		}
+	}
+
+	if len(manifestFiles) == 0 {
+		return fmt.Errorf("no YAML manifest files found in directory")
+	}
+
+	var objects []*unstructured.Unstructured
+	for _, manifestPath := range manifestFiles {
+		objs, err := parseManifests(manifestPath)
+		if err != nil {
+			return fmt.Errorf("failed to parse manifests from %s: %w", manifestPath, err)
+		}
+		objects = append(objects, objs...)
+	}
+
+	if len(objects) == 0 {
+		return fmt.Errorf("no objects found in manifests")
+	}
+
+	logger.Info("Applying Cozystack CRDs", "count", len(objects))
+	for _, obj := range objects {
+		patchOptions := &client.PatchOptions{
+			FieldManager: "cozystack-operator",
+			Force:        func() *bool { b := true; return &b }(),
+		}
+
+		if err := k8sClient.Patch(ctx, obj, client.Apply, patchOptions); err != nil {
+			return fmt.Errorf("failed to apply CRD %s: %w", obj.GetName(), err)
+		}
+		logger.Info("Applied CRD", "name", obj.GetName())
+	}
+
+	logger.Info("CRD installation completed successfully")
+	return nil
+}
+
+func parseManifests(manifestPath string) ([]*unstructured.Unstructured, error) {
+	data, err := os.ReadFile(manifestPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read manifest file: %w", err)
+	}
+
+	return readYAMLObjects(bytes.NewReader(data))
+}
+
+func readYAMLObjects(reader io.Reader) ([]*unstructured.Unstructured, error) {
+	var objects []*unstructured.Unstructured
+	yamlReader := k8syaml.NewYAMLReader(bufio.NewReader(reader))
+
+	for {
+		doc, err := yamlReader.Read()
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			return nil, fmt.Errorf("failed to read YAML document: %w", err)
+		}
+
+		if len(bytes.TrimSpace(doc)) == 0 {
+			continue
+		}
+
+		obj := &unstructured.Unstructured{}
+		decoder := k8syaml.NewYAMLOrJSONDecoder(bytes.NewReader(doc), len(doc))
+		if err := decoder.Decode(obj); err != nil {
+			if err == io.EOF {
+				continue
+			}
+			return nil, fmt.Errorf("failed to decode YAML document: %w", err)
+		}
+
+		if obj.GetKind() == "" {
+			continue
+		}
+
+		objects = append(objects, obj)
+	}
+
+	return objects, nil
+}
diff --git a/internal/crdinstall/manifests.embed.go b/internal/crdinstall/manifests.embed.go
new file mode 100644
index 00000000..dd578db6
--- /dev/null
+++ b/internal/crdinstall/manifests.embed.go
@@ -0,0 +1,50 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package crdinstall
+
+import (
+	"embed"
+	"fmt"
+	"io/fs"
+	"os"
+	"path"
+)
+
+//go:embed manifests/*.yaml
+var embeddedCRDManifests embed.FS
+
+// WriteEmbeddedManifests extracts embedded CRD manifests to a directory.
+func WriteEmbeddedManifests(dir string) error {
+	manifests, err := fs.ReadDir(embeddedCRDManifests, "manifests")
+	if err != nil {
+		return fmt.Errorf("failed to read embedded manifests: %w", err)
+	}
+
+	for _, manifest := range manifests {
+		data, err := fs.ReadFile(embeddedCRDManifests, path.Join("manifests", manifest.Name()))
+		if err != nil {
+			return fmt.Errorf("failed to read file %s: %w", manifest.Name(), err)
+		}
+
+		outputPath := path.Join(dir, manifest.Name())
+		if err := os.WriteFile(outputPath, data, 0666); err != nil {
+			return fmt.Errorf("failed to write file %s: %w", outputPath, err)
+		}
+	}
+
+	return nil
+}
diff --git a/internal/crdinstall/manifests/.gitattributes b/internal/crdinstall/manifests/.gitattributes
new file mode 100644
index 00000000..f581feca
--- /dev/null
+++ b/internal/crdinstall/manifests/.gitattributes
@@ -0,0 +1 @@
+*.yaml linguist-generated
diff --git a/internal/crdinstall/manifests/cozystack.io_packages.yaml b/internal/crdinstall/manifests/cozystack.io_packages.yaml
new file mode 100644
index 00000000..cb7e2763
--- /dev/null
+++ b/internal/crdinstall/manifests/cozystack.io_packages.yaml
@@ -0,0 +1,171 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.16.4
+  name: packages.cozystack.io
+spec:
+  group: cozystack.io
+  names:
+    kind: Package
+    listKind: PackageList
+    plural: packages
+    shortNames:
+    - pkg
+    - pkgs
+    singular: package
+  scope: Cluster
+  versions:
+  - additionalPrinterColumns:
+    - description: Selected variant
+      jsonPath: .spec.variant
+      name: Variant
+      type: string
+    - description: Ready status
+      jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: Ready
+      type: string
+    - description: Ready message
+      jsonPath: .status.conditions[?(@.type=='Ready')].message
+      name: Status
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: Package is the Schema for the packages API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: PackageSpec defines the desired state of Package
+            properties:
+              components:
+                additionalProperties:
+                  description: PackageComponent defines overrides for a specific component
+                  properties:
+                    enabled:
+                      description: |-
+                        Enabled indicates whether this component should be installed
+                        If false, the component will be disabled even if it's defined in the PackageSource
+                      type: boolean
+                    values:
+                      description: |-
+                        Values contains Helm chart values as a JSON object
+                        These values will be merged with the default values from the PackageSource
+                      x-kubernetes-preserve-unknown-fields: true
+                  type: object
+                description: |-
+                  Components is a map of release name to component overrides
+                  Allows overriding values and enabling/disabling specific components from the PackageSource
+                type: object
+              ignoreDependencies:
+                description: |-
+                  IgnoreDependencies is a list of package source dependencies to ignore
+                  Dependencies listed here will not be installed even if they are specified in the PackageSource
+                items:
+                  type: string
+                type: array
+              variant:
+                description: |-
+                  Variant is the name of the variant to use from the PackageSource
+                  If not specified, defaults to "default"
+                type: string
+            type: object
+          status:
+            description: PackageStatus defines the observed state of Package
+            properties:
+              conditions:
+                description: Conditions represents the latest available observations
+                  of a Package's state
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+              dependencies:
+                additionalProperties:
+                  description: DependencyStatus represents the readiness status of
+                    a dependency
+                  properties:
+                    ready:
+                      description: Ready indicates whether the dependency is ready
+                      type: boolean
+                  required:
+                  - ready
+                  type: object
+                description: |-
+                  Dependencies tracks the readiness status of each dependency
+                  Key is the dependency package name, value indicates if the dependency is ready
+                type: object
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/internal/crdinstall/manifests/cozystack.io_packagesources.yaml b/internal/crdinstall/manifests/cozystack.io_packagesources.yaml
new file mode 100644
index 00000000..0acfcdd2
--- /dev/null
+++ b/internal/crdinstall/manifests/cozystack.io_packagesources.yaml
@@ -0,0 +1,250 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.16.4
+  name: packagesources.cozystack.io
+spec:
+  group: cozystack.io
+  names:
+    kind: PackageSource
+    listKind: PackageSourceList
+    plural: packagesources
+    shortNames:
+    - pks
+    singular: packagesource
+  scope: Cluster
+  versions:
+  - additionalPrinterColumns:
+    - description: Package variants (comma-separated)
+      jsonPath: .status.variants
+      name: Variants
+      type: string
+    - description: Ready status
+      jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: Ready
+      type: string
+    - description: Ready message
+      jsonPath: .status.conditions[?(@.type=='Ready')].message
+      name: Status
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: PackageSource is the Schema for the packagesources API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: PackageSourceSpec defines the desired state of PackageSource
+            properties:
+              sourceRef:
+                description: SourceRef is the source reference for the package source
+                  charts
+                properties:
+                  kind:
+                    description: Kind of the source reference
+                    enum:
+                    - GitRepository
+                    - OCIRepository
+                    type: string
+                  name:
+                    description: Name of the source reference
+                    type: string
+                  namespace:
+                    description: Namespace of the source reference
+                    type: string
+                  path:
+                    description: |-
+                      Path is the base path where packages are located in the source.
+                      For GitRepository, defaults to "packages" if not specified.
+                      For OCIRepository, defaults to empty string (root) if not specified.
+                    type: string
+                required:
+                - kind
+                - name
+                - namespace
+                type: object
+              variants:
+                description: |-
+                  Variants is a list of package source variants
+                  Each variant defines components, applications, dependencies, and libraries for a specific configuration
+                items:
+                  description: Variant defines a single variant configuration
+                  properties:
+                    components:
+                      description: Components is a list of Helm releases to be installed
+                        as part of this variant
+                      items:
+                        description: Component defines a single Helm release component
+                          within a package source
+                        properties:
+                          install:
+                            description: Install defines installation parameters for
+                              this component
+                            properties:
+                              dependsOn:
+                                description: DependsOn is a list of component names
+                                  that must be installed before this component
+                                items:
+                                  type: string
+                                type: array
+                              namespace:
+                                description: Namespace is the Kubernetes namespace
+                                  where the release will be installed
+                                type: string
+                              privileged:
+                                description: Privileged indicates whether this release
+                                  requires privileged access
+                                type: boolean
+                              releaseName:
+                                description: |-
+                                  ReleaseName is the name of the HelmRelease resource that will be created
+                                  If not specified, defaults to the component Name field
+                                type: string
+                            type: object
+                          libraries:
+                            description: |-
+                              Libraries is a list of library names that this component depends on
+                              These libraries must be defined at the variant level
+                            items:
+                              type: string
+                            type: array
+                          name:
+                            description: Name is the unique identifier for this component
+                              within the package source
+                            type: string
+                          path:
+                            description: Path is the path to the Helm chart directory
+                            type: string
+                          valuesFiles:
+                            description: ValuesFiles is a list of values file names
+                              to use
+                            items:
+                              type: string
+                            type: array
+                        required:
+                        - name
+                        - path
+                        type: object
+                      type: array
+                    dependsOn:
+                      description: |-
+                        DependsOn is a list of package source dependencies
+                        For example: "cozystack.networking"
+                      items:
+                        type: string
+                      type: array
+                    libraries:
+                      description: Libraries is a list of Helm library charts used
+                        by components in this variant
+                      items:
+                        description: Library defines a Helm library chart
+                        properties:
+                          name:
+                            description: Name is the optional name for library placed
+                              in charts
+                            type: string
+                          path:
+                            description: Path is the path to the library chart directory
+                            type: string
+                        required:
+                        - path
+                        type: object
+                      type: array
+                    name:
+                      description: Name is the unique identifier for this variant
+                      type: string
+                  required:
+                  - name
+                  type: object
+                type: array
+            type: object
+          status:
+            description: PackageSourceStatus defines the observed state of PackageSource
+            properties:
+              conditions:
+                description: Conditions represents the latest available observations
+                  of a PackageSource's state
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+              variants:
+                description: |-
+                  Variants is a comma-separated list of package variant names
+                  This field is populated by the controller based on spec.variants keys
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

From 879b10b777d90ba5a7335d77c095eb0896846f87 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 17 Feb 2026 23:24:36 +0300
Subject: [PATCH 076/666] feat(installer): enable --install-crds in operator
 deployment

Add --install-crds=true to cozystack-operator container args so the
operator applies embedded CRD manifests on startup via server-side apply.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/core/installer/templates/cozystack-operator.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/core/installer/templates/cozystack-operator.yaml b/packages/core/installer/templates/cozystack-operator.yaml
index 4568e18b..359fb40c 100644
--- a/packages/core/installer/templates/cozystack-operator.yaml
+++ b/packages/core/installer/templates/cozystack-operator.yaml
@@ -53,6 +53,7 @@ spec:
         args:
         - --leader-elect=true
         - --install-flux=true
+        - --install-crds=true
         - --metrics-bind-address=0
         - --health-probe-bind-address=
         {{- if .Values.cozystackOperator.disableTelemetry }}

From 1558fb428aad0cfaef0cffbbd60d30834e52586a Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 17 Feb 2026 23:24:51 +0300
Subject: [PATCH 077/666] build(codegen): sync CRDs to operator embed directory

After generating CRDs to packages/core/installer/crds/, copy them to
internal/crdinstall/manifests/ so the operator binary embeds the latest
CRD definitions.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/update-codegen.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh
index d0711cad..b7f96691 100755
--- a/hack/update-codegen.sh
+++ b/hack/update-codegen.sh
@@ -25,6 +25,7 @@ UPDATE_API_KNOWN_VIOLATIONS="${UPDATE_API_KNOWN_VIOLATIONS:-true}"
 CONTROLLER_GEN="go run sigs.k8s.io/controller-tools/cmd/controller-gen@v0.16.4"
 TMPDIR=$(mktemp -d)
 OPERATOR_CRDDIR=packages/core/installer/crds
+OPERATOR_EMBEDDIR=internal/crdinstall/manifests
 COZY_CONTROLLER_CRDDIR=packages/system/cozystack-controller/definitions
 COZY_RD_CRDDIR=packages/system/application-definition-crd/definition
 BACKUPS_CORE_CRDDIR=packages/system/backup-controller/definitions
@@ -73,6 +74,9 @@ $CONTROLLER_GEN rbac:roleName=manager-role crd paths="./api/..." output:crd:arti
 mv ${TMPDIR}/cozystack.io_packages.yaml ${OPERATOR_CRDDIR}/cozystack.io_packages.yaml
 mv ${TMPDIR}/cozystack.io_packagesources.yaml ${OPERATOR_CRDDIR}/cozystack.io_packagesources.yaml
 
+cp ${OPERATOR_CRDDIR}/cozystack.io_packages.yaml ${OPERATOR_EMBEDDIR}/cozystack.io_packages.yaml
+cp ${OPERATOR_CRDDIR}/cozystack.io_packagesources.yaml ${OPERATOR_EMBEDDIR}/cozystack.io_packagesources.yaml
+
 mv ${TMPDIR}/cozystack.io_applicationdefinitions.yaml \
         ${COZY_RD_CRDDIR}/cozystack.io_applicationdefinitions.yaml
 

From 4187b5ed9460d48860736004bf07969c9e46bed3 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 17 Feb 2026 23:31:29 +0300
Subject: [PATCH 078/666] fix(crdinstall): use filepath for OS paths, restrict
 permissions, add tests

- Use filepath.Join instead of path.Join for OS file paths
- Restrict extracted manifest permissions from 0666 to 0600
- Add unit tests for readYAMLObjects, parseManifests, and
  WriteEmbeddedManifests including permission verification

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 internal/crdinstall/install_test.go    | 242 +++++++++++++++++++++++++
 internal/crdinstall/manifests.embed.go |   5 +-
 2 files changed, 245 insertions(+), 2 deletions(-)
 create mode 100644 internal/crdinstall/install_test.go

diff --git a/internal/crdinstall/install_test.go b/internal/crdinstall/install_test.go
new file mode 100644
index 00000000..fc1f1fd9
--- /dev/null
+++ b/internal/crdinstall/install_test.go
@@ -0,0 +1,242 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package crdinstall
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestReadYAMLObjects(t *testing.T) {
+	tests := []struct {
+		name      string
+		input     string
+		wantCount int
+		wantErr   bool
+	}{
+		{
+			name: "single document",
+			input: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test
+`,
+			wantCount: 1,
+		},
+		{
+			name: "multiple documents",
+			input: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test1
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test2
+`,
+			wantCount: 2,
+		},
+		{
+			name:      "empty input",
+			input:     "",
+			wantCount: 0,
+		},
+		{
+			name: "document without kind returns error",
+			input: `apiVersion: v1
+metadata:
+  name: test
+`,
+			wantErr: true,
+		},
+		{
+			name: "whitespace-only document between separators is skipped",
+			input: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test1
+---
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test2
+`,
+			wantCount: 2,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			objects, err := readYAMLObjects(strings.NewReader(tt.input))
+			if (err != nil) != tt.wantErr {
+				t.Errorf("readYAMLObjects() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if len(objects) != tt.wantCount {
+				t.Errorf("readYAMLObjects() returned %d objects, want %d", len(objects), tt.wantCount)
+			}
+		})
+	}
+}
+
+func TestReadYAMLObjects_preservesFields(t *testing.T) {
+	input := `apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: packages.cozystack.io
+spec:
+  group: cozystack.io
+`
+	objects, err := readYAMLObjects(strings.NewReader(input))
+	if err != nil {
+		t.Fatalf("readYAMLObjects() error = %v", err)
+	}
+	if len(objects) != 1 {
+		t.Fatalf("expected 1 object, got %d", len(objects))
+	}
+
+	obj := objects[0]
+	if obj.GetKind() != "CustomResourceDefinition" {
+		t.Errorf("kind = %q, want %q", obj.GetKind(), "CustomResourceDefinition")
+	}
+	if obj.GetName() != "packages.cozystack.io" {
+		t.Errorf("name = %q, want %q", obj.GetName(), "packages.cozystack.io")
+	}
+	if obj.GetAPIVersion() != "apiextensions.k8s.io/v1" {
+		t.Errorf("apiVersion = %q, want %q", obj.GetAPIVersion(), "apiextensions.k8s.io/v1")
+	}
+}
+
+func TestParseManifests(t *testing.T) {
+	tmpDir := t.TempDir()
+	manifestPath := filepath.Join(tmpDir, "test.yaml")
+
+	content := `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cm1
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cm2
+`
+	if err := os.WriteFile(manifestPath, []byte(content), 0600); err != nil {
+		t.Fatalf("failed to write test manifest: %v", err)
+	}
+
+	objects, err := parseManifests(manifestPath)
+	if err != nil {
+		t.Fatalf("parseManifests() error = %v", err)
+	}
+	if len(objects) != 2 {
+		t.Errorf("parseManifests() returned %d objects, want 2", len(objects))
+	}
+}
+
+func TestParseManifests_fileNotFound(t *testing.T) {
+	_, err := parseManifests("/nonexistent/path/test.yaml")
+	if err == nil {
+		t.Error("parseManifests() expected error for nonexistent file, got nil")
+	}
+}
+
+func TestWriteEmbeddedManifests(t *testing.T) {
+	tmpDir := t.TempDir()
+
+	if err := WriteEmbeddedManifests(tmpDir); err != nil {
+		t.Fatalf("WriteEmbeddedManifests() error = %v", err)
+	}
+
+	entries, err := os.ReadDir(tmpDir)
+	if err != nil {
+		t.Fatalf("failed to read output dir: %v", err)
+	}
+
+	var yamlFiles []string
+	for _, e := range entries {
+		if strings.HasSuffix(e.Name(), ".yaml") {
+			yamlFiles = append(yamlFiles, e.Name())
+		}
+	}
+
+	if len(yamlFiles) == 0 {
+		t.Error("WriteEmbeddedManifests() produced no YAML files")
+	}
+
+	expectedFiles := []string{
+		"cozystack.io_packages.yaml",
+		"cozystack.io_packagesources.yaml",
+	}
+	for _, expected := range expectedFiles {
+		found := false
+		for _, actual := range yamlFiles {
+			if actual == expected {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Errorf("expected file %q not found in output, got %v", expected, yamlFiles)
+		}
+	}
+
+	// Verify files are non-empty and contain valid YAML
+	for _, f := range yamlFiles {
+		data, err := os.ReadFile(filepath.Join(tmpDir, f))
+		if err != nil {
+			t.Errorf("failed to read %s: %v", f, err)
+			continue
+		}
+		if len(data) == 0 {
+			t.Errorf("file %s is empty", f)
+		}
+	}
+}
+
+func TestWriteEmbeddedManifests_filePermissions(t *testing.T) {
+	tmpDir := t.TempDir()
+
+	if err := WriteEmbeddedManifests(tmpDir); err != nil {
+		t.Fatalf("WriteEmbeddedManifests() error = %v", err)
+	}
+
+	entries, err := os.ReadDir(tmpDir)
+	if err != nil {
+		t.Fatalf("failed to read output dir: %v", err)
+	}
+
+	for _, e := range entries {
+		if !strings.HasSuffix(e.Name(), ".yaml") {
+			continue
+		}
+		info, err := e.Info()
+		if err != nil {
+			t.Errorf("failed to get info for %s: %v", e.Name(), err)
+			continue
+		}
+		perm := info.Mode().Perm()
+		if perm&0o077 != 0 {
+			t.Errorf("file %s has overly permissive mode %o, expected no group/other access", e.Name(), perm)
+		}
+	}
+}
diff --git a/internal/crdinstall/manifests.embed.go b/internal/crdinstall/manifests.embed.go
index dd578db6..7464e54e 100644
--- a/internal/crdinstall/manifests.embed.go
+++ b/internal/crdinstall/manifests.embed.go
@@ -22,6 +22,7 @@ import (
 	"io/fs"
 	"os"
 	"path"
+	"path/filepath"
 )
 
 //go:embed manifests/*.yaml
@@ -40,8 +41,8 @@ func WriteEmbeddedManifests(dir string) error {
 			return fmt.Errorf("failed to read file %s: %w", manifest.Name(), err)
 		}
 
-		outputPath := path.Join(dir, manifest.Name())
-		if err := os.WriteFile(outputPath, data, 0666); err != nil {
+		outputPath := filepath.Join(dir, manifest.Name())
+		if err := os.WriteFile(outputPath, data, 0600); err != nil {
 			return fmt.Errorf("failed to write file %s: %w", outputPath, err)
 		}
 	}

From 20d122445dfc34aea556bb2f9e33d899cf5413f6 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 17 Feb 2026 23:42:16 +0300
Subject: [PATCH 079/666] fix(crdinstall): add CRD readiness check, Install
 tests, fix fluxinstall

- Wait for CRDs to have Established condition after server-side apply,
  instead of returning immediately
- Add TestInstall with fake client and interceptor to simulate CRD
  establishment
- Add TestInstall_noManifests and TestInstall_writeManifestsFails for
  error paths
- Fix fluxinstall/manifests.embed.go: use filepath.Join for OS paths
  and restrict permissions from 0666 to 0600 (same fix as crdinstall)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 internal/crdinstall/install.go          |  68 ++++++++++++
 internal/crdinstall/install_test.go     | 141 ++++++++++++++++++++++++
 internal/fluxinstall/manifests.embed.go |   5 +-
 3 files changed, 212 insertions(+), 2 deletions(-)

diff --git a/internal/crdinstall/install.go b/internal/crdinstall/install.go
index fb6e4588..62615f68 100644
--- a/internal/crdinstall/install.go
+++ b/internal/crdinstall/install.go
@@ -25,8 +25,10 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"time"
 
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/types"
 	k8syaml "k8s.io/apimachinery/pkg/util/yaml"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/log"
@@ -94,10 +96,76 @@ func Install(ctx context.Context, k8sClient client.Client, writeEmbeddedManifest
 		logger.Info("Applied CRD", "name", obj.GetName())
 	}
 
+	if err := waitForCRDsEstablished(ctx, k8sClient, objects, logger); err != nil {
+		return fmt.Errorf("CRDs not established after apply: %w", err)
+	}
+
 	logger.Info("CRD installation completed successfully")
 	return nil
 }
 
+// waitForCRDsEstablished polls applied CRDs until all have the Established condition.
+func waitForCRDsEstablished(ctx context.Context, k8sClient client.Client, objects []*unstructured.Unstructured, logger interface{ Info(string, ...interface{}) }) error {
+	var crdNames []string
+	for _, obj := range objects {
+		if obj.GetKind() == "CustomResourceDefinition" {
+			crdNames = append(crdNames, obj.GetName())
+		}
+	}
+
+	if len(crdNames) == 0 {
+		return nil
+	}
+
+	ticker := time.NewTicker(500 * time.Millisecond)
+	defer ticker.Stop()
+
+	for {
+		allEstablished := true
+		for _, name := range crdNames {
+			crd := &unstructured.Unstructured{}
+			crd.SetGroupVersionKind(objects[0].GroupVersionKind())
+			if err := k8sClient.Get(ctx, types.NamespacedName{Name: name}, crd); err != nil {
+				allEstablished = false
+				break
+			}
+
+			conditions, found, err := unstructured.NestedSlice(crd.Object, "status", "conditions")
+			if err != nil || !found {
+				allEstablished = false
+				break
+			}
+
+			established := false
+			for _, c := range conditions {
+				cond, ok := c.(map[string]interface{})
+				if !ok {
+					continue
+				}
+				if cond["type"] == "Established" && cond["status"] == "True" {
+					established = true
+					break
+				}
+			}
+			if !established {
+				allEstablished = false
+				break
+			}
+		}
+
+		if allEstablished {
+			logger.Info("All CRDs established", "count", len(crdNames))
+			return nil
+		}
+
+		select {
+		case <-ctx.Done():
+			return fmt.Errorf("context cancelled while waiting for CRDs to be established: %w", ctx.Err())
+		case <-ticker.C:
+		}
+	}
+}
+
 func parseManifests(manifestPath string) ([]*unstructured.Unstructured, error) {
 	data, err := os.ReadFile(manifestPath)
 	if err != nil {
diff --git a/internal/crdinstall/install_test.go b/internal/crdinstall/install_test.go
index fc1f1fd9..ca49db51 100644
--- a/internal/crdinstall/install_test.go
+++ b/internal/crdinstall/install_test.go
@@ -17,10 +17,21 @@ limitations under the License.
 package crdinstall
 
 import (
+	"context"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
+	"time"
+
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 )
 
 func TestReadYAMLObjects(t *testing.T) {
@@ -213,6 +224,136 @@ func TestWriteEmbeddedManifests(t *testing.T) {
 	}
 }
 
+func TestInstall_appliesAllCRDs(t *testing.T) {
+	log.SetLogger(zap.New(zap.UseDevMode(true)))
+
+	scheme := runtime.NewScheme()
+	if err := apiextensionsv1.AddToScheme(scheme); err != nil {
+		t.Fatalf("failed to add apiextensions to scheme: %v", err)
+	}
+
+	// Intercept Get calls to simulate CRDs becoming Established
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithInterceptorFuncs(interceptor.Funcs{
+			Get: func(ctx context.Context, c client.WithWatch, key client.ObjectKey, obj client.Object, opts ...client.GetOption) error {
+				if err := c.Get(ctx, key, obj, opts...); err != nil {
+					return err
+				}
+				u, ok := obj.(*unstructured.Unstructured)
+				if !ok {
+					return nil
+				}
+				if u.GetKind() == "CustomResourceDefinition" {
+					_ = unstructured.SetNestedSlice(u.Object, []interface{}{
+						map[string]interface{}{
+							"type":   "Established",
+							"status": "True",
+						},
+					}, "status", "conditions")
+				}
+				return nil
+			},
+		}).
+		Build()
+
+	// Write two CRD manifests
+	writeManifests := func(dir string) error {
+		crd1 := `apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: packages.cozystack.io
+spec:
+  group: cozystack.io
+  names:
+    kind: Package
+    plural: packages
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    served: true
+    storage: true
+    schema:
+      openAPIV3Schema:
+        type: object
+`
+		crd2 := `apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: packagesources.cozystack.io
+spec:
+  group: cozystack.io
+  names:
+    kind: PackageSource
+    plural: packagesources
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    served: true
+    storage: true
+    schema:
+      openAPIV3Schema:
+        type: object
+`
+		if err := os.WriteFile(filepath.Join(dir, "crd1.yaml"), []byte(crd1), 0600); err != nil {
+			return err
+		}
+		return os.WriteFile(filepath.Join(dir, "crd2.yaml"), []byte(crd2), 0600)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	ctx = log.IntoContext(ctx, log.FromContext(context.Background()))
+
+	err := Install(ctx, fakeClient, writeManifests)
+	if err != nil {
+		t.Fatalf("Install() error = %v", err)
+	}
+}
+
+func TestInstall_noManifests(t *testing.T) {
+	log.SetLogger(zap.New(zap.UseDevMode(true)))
+
+	scheme := runtime.NewScheme()
+	fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
+
+	writeEmpty := func(dir string) error {
+		return nil
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	ctx = log.IntoContext(ctx, log.FromContext(context.Background()))
+
+	err := Install(ctx, fakeClient, writeEmpty)
+	if err == nil {
+		t.Error("Install() expected error for empty manifests, got nil")
+	}
+	if !strings.Contains(err.Error(), "no YAML manifest files found") {
+		t.Errorf("Install() error = %v, want error containing 'no YAML manifest files found'", err)
+	}
+}
+
+func TestInstall_writeManifestsFails(t *testing.T) {
+	log.SetLogger(zap.New(zap.UseDevMode(true)))
+
+	scheme := runtime.NewScheme()
+	fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
+
+	writeFail := func(dir string) error {
+		return os.ErrPermission
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	ctx = log.IntoContext(ctx, log.FromContext(context.Background()))
+
+	err := Install(ctx, fakeClient, writeFail)
+	if err == nil {
+		t.Error("Install() expected error when writeManifests fails, got nil")
+	}
+}
+
 func TestWriteEmbeddedManifests_filePermissions(t *testing.T) {
 	tmpDir := t.TempDir()
 
diff --git a/internal/fluxinstall/manifests.embed.go b/internal/fluxinstall/manifests.embed.go
index e6a13a99..6ff48d2d 100644
--- a/internal/fluxinstall/manifests.embed.go
+++ b/internal/fluxinstall/manifests.embed.go
@@ -22,6 +22,7 @@ import (
 	"io/fs"
 	"os"
 	"path"
+	"path/filepath"
 )
 
 //go:embed manifests/*.yaml
@@ -40,8 +41,8 @@ func WriteEmbeddedManifests(dir string) error {
 			return fmt.Errorf("failed to read file %s: %w", manifest.Name(), err)
 		}
 
-		outputPath := path.Join(dir, manifest.Name())
-		if err := os.WriteFile(outputPath, data, 0666); err != nil {
+		outputPath := filepath.Join(dir, manifest.Name())
+		if err := os.WriteFile(outputPath, data, 0600); err != nil {
 			return fmt.Errorf("failed to write file %s: %w", outputPath, err)
 		}
 	}

From 962f8e96f4f458f27641ca13248683b8d0c5f4f7 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 17 Feb 2026 23:42:59 +0300
Subject: [PATCH 080/666] ci(makefile): add CRD sync verification between Helm
 crds/ and operator embed

Add verify-crds target that diffs packages/core/installer/crds/ and
internal/crdinstall/manifests/ to catch accidental divergence. Include
it in unit-tests target so it runs in CI.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 Makefile | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index dd6a249d..85b48659 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: manifests assets unit-tests helm-unit-tests
+.PHONY: manifests assets unit-tests helm-unit-tests verify-crds
 
 include hack/common-envs.mk
 
@@ -80,7 +80,11 @@ test:
 	make -C packages/core/testing apply
 	make -C packages/core/testing test
 
-unit-tests: helm-unit-tests
+verify-crds:
+	@diff packages/core/installer/crds/ internal/crdinstall/manifests/ --exclude=.gitattributes \
+		|| (echo "ERROR: CRD manifests out of sync. Run 'make generate' to fix." && exit 1)
+
+unit-tests: helm-unit-tests verify-crds
 
 helm-unit-tests:
 	hack/helm-unit-tests.sh

From b3fe6a8c4a2af1d92e580bc17fcd136c3ba4e87e Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 17 Feb 2026 23:49:20 +0300
Subject: [PATCH 081/666] fix(crdinstall): hardcode CRD GVK, add timeout test,
 document dual install

- Use explicit apiextensions.k8s.io/v1 CRD GVK in waitForCRDsEstablished
  instead of fragile objects[0].GroupVersionKind()
- Add TestInstall_crdNotEstablished for context timeout path
- Add --recursive to diff in verify-crds Makefile target
- Document why both crds/ and --install-crds exist in deployment template

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 Makefile                                      |  2 +-
 internal/crdinstall/install.go                |  7 ++-
 internal/crdinstall/install_test.go           | 46 +++++++++++++++++++
 .../templates/cozystack-operator.yaml         |  3 ++
 4 files changed, 56 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 85b48659..9707ade4 100644
--- a/Makefile
+++ b/Makefile
@@ -81,7 +81,7 @@ test:
 	make -C packages/core/testing test
 
 verify-crds:
-	@diff packages/core/installer/crds/ internal/crdinstall/manifests/ --exclude=.gitattributes \
+	@diff --recursive packages/core/installer/crds/ internal/crdinstall/manifests/ --exclude=.gitattributes \
 		|| (echo "ERROR: CRD manifests out of sync. Run 'make generate' to fix." && exit 1)
 
 unit-tests: helm-unit-tests verify-crds
diff --git a/internal/crdinstall/install.go b/internal/crdinstall/install.go
index 62615f68..315de612 100644
--- a/internal/crdinstall/install.go
+++ b/internal/crdinstall/install.go
@@ -28,6 +28,7 @@ import (
 	"time"
 
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
 	k8syaml "k8s.io/apimachinery/pkg/util/yaml"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -124,7 +125,11 @@ func waitForCRDsEstablished(ctx context.Context, k8sClient client.Client, object
 		allEstablished := true
 		for _, name := range crdNames {
 			crd := &unstructured.Unstructured{}
-			crd.SetGroupVersionKind(objects[0].GroupVersionKind())
+			crd.SetGroupVersionKind(schema.GroupVersionKind{
+				Group:   "apiextensions.k8s.io",
+				Version: "v1",
+				Kind:    "CustomResourceDefinition",
+			})
 			if err := k8sClient.Get(ctx, types.NamespacedName{Name: name}, crd); err != nil {
 				allEstablished = false
 				break
diff --git a/internal/crdinstall/install_test.go b/internal/crdinstall/install_test.go
index ca49db51..2fd200bc 100644
--- a/internal/crdinstall/install_test.go
+++ b/internal/crdinstall/install_test.go
@@ -354,6 +354,52 @@ func TestInstall_writeManifestsFails(t *testing.T) {
 	}
 }
 
+func TestInstall_crdNotEstablished(t *testing.T) {
+	log.SetLogger(zap.New(zap.UseDevMode(true)))
+
+	scheme := runtime.NewScheme()
+	if err := apiextensionsv1.AddToScheme(scheme); err != nil {
+		t.Fatalf("failed to add apiextensions to scheme: %v", err)
+	}
+
+	// No interceptor: CRDs will never get Established condition
+	fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
+
+	writeManifests := func(dir string) error {
+		crd := `apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: packages.cozystack.io
+spec:
+  group: cozystack.io
+  names:
+    kind: Package
+    plural: packages
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    served: true
+    storage: true
+    schema:
+      openAPIV3Schema:
+        type: object
+`
+		return os.WriteFile(filepath.Join(dir, "crd.yaml"), []byte(crd), 0600)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	ctx = log.IntoContext(ctx, log.FromContext(context.Background()))
+
+	err := Install(ctx, fakeClient, writeManifests)
+	if err == nil {
+		t.Fatal("Install() expected error when CRDs never become established, got nil")
+	}
+	if !strings.Contains(err.Error(), "CRDs not established") {
+		t.Errorf("Install() error = %v, want error containing 'CRDs not established'", err)
+	}
+}
+
 func TestWriteEmbeddedManifests_filePermissions(t *testing.T) {
 	tmpDir := t.TempDir()
 
diff --git a/packages/core/installer/templates/cozystack-operator.yaml b/packages/core/installer/templates/cozystack-operator.yaml
index 359fb40c..1153ec4d 100644
--- a/packages/core/installer/templates/cozystack-operator.yaml
+++ b/packages/core/installer/templates/cozystack-operator.yaml
@@ -53,6 +53,9 @@ spec:
         args:
         - --leader-elect=true
         - --install-flux=true
+        # CRDs are also in crds/ for initial helm install, but Helm never updates
+        # them on upgrade. The operator applies embedded CRDs via server-side apply
+        # on every startup, ensuring they stay up to date.
         - --install-crds=true
         - --metrics-bind-address=0
         - --health-probe-bind-address=

From 3fbce0dba5dbe2a41e1672f6386a07f41a3e59a8 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 18 Feb 2026 00:01:46 +0300
Subject: [PATCH 082/666] refactor(operator): extract shared manifest utils
 from crdinstall and fluxinstall

Move duplicated YAML parsing (ReadYAMLObjects, ParseManifestFile) and
CRD readiness check (WaitForCRDsEstablished, CollectCRDNames) into a
shared internal/manifestutil package. Both crdinstall and fluxinstall
now import from manifestutil instead of maintaining identical copies.

Replace fluxinstall's time.Sleep(2s) after CRD apply with proper
WaitForCRDsEstablished polling, matching the crdinstall behavior.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 internal/crdinstall/install.go      | 128 +-------
 internal/crdinstall/install_test.go | 473 ++++++++++------------------
 internal/fluxinstall/install.go     |  68 +---
 internal/manifestutil/crd.go        | 116 +++++++
 internal/manifestutil/crd_test.go   | 190 +++++++++++
 internal/manifestutil/parse.go      |  76 +++++
 internal/manifestutil/parse_test.go | 161 ++++++++++
 7 files changed, 717 insertions(+), 495 deletions(-)
 create mode 100644 internal/manifestutil/crd.go
 create mode 100644 internal/manifestutil/crd_test.go
 create mode 100644 internal/manifestutil/parse.go
 create mode 100644 internal/manifestutil/parse_test.go

diff --git a/internal/crdinstall/install.go b/internal/crdinstall/install.go
index 315de612..4cd93597 100644
--- a/internal/crdinstall/install.go
+++ b/internal/crdinstall/install.go
@@ -17,26 +17,22 @@ limitations under the License.
 package crdinstall
 
 import (
-	"bufio"
-	"bytes"
 	"context"
 	"fmt"
-	"io"
 	"os"
 	"path/filepath"
 	"strings"
-	"time"
+
+	"github.com/cozystack/cozystack/internal/manifestutil"
 
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	k8syaml "k8s.io/apimachinery/pkg/util/yaml"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 )
 
 // Install applies Cozystack CRDs using embedded manifests.
-// It extracts the manifests and applies them to the cluster using server-side apply.
+// It extracts the manifests and applies them to the cluster using server-side apply,
+// then waits for all CRDs to have the Established condition.
 func Install(ctx context.Context, k8sClient client.Client, writeEmbeddedManifests func(string) error) error {
 	logger := log.FromContext(ctx)
 
@@ -73,7 +69,7 @@ func Install(ctx context.Context, k8sClient client.Client, writeEmbeddedManifest
 
 	var objects []*unstructured.Unstructured
 	for _, manifestPath := range manifestFiles {
-		objs, err := parseManifests(manifestPath)
+		objs, err := manifestutil.ParseManifestFile(manifestPath)
 		if err != nil {
 			return fmt.Errorf("failed to parse manifests from %s: %w", manifestPath, err)
 		}
@@ -97,121 +93,11 @@ func Install(ctx context.Context, k8sClient client.Client, writeEmbeddedManifest
 		logger.Info("Applied CRD", "name", obj.GetName())
 	}
 
-	if err := waitForCRDsEstablished(ctx, k8sClient, objects, logger); err != nil {
+	crdNames := manifestutil.CollectCRDNames(objects)
+	if err := manifestutil.WaitForCRDsEstablished(ctx, k8sClient, crdNames); err != nil {
 		return fmt.Errorf("CRDs not established after apply: %w", err)
 	}
 
 	logger.Info("CRD installation completed successfully")
 	return nil
 }
-
-// waitForCRDsEstablished polls applied CRDs until all have the Established condition.
-func waitForCRDsEstablished(ctx context.Context, k8sClient client.Client, objects []*unstructured.Unstructured, logger interface{ Info(string, ...interface{}) }) error {
-	var crdNames []string
-	for _, obj := range objects {
-		if obj.GetKind() == "CustomResourceDefinition" {
-			crdNames = append(crdNames, obj.GetName())
-		}
-	}
-
-	if len(crdNames) == 0 {
-		return nil
-	}
-
-	ticker := time.NewTicker(500 * time.Millisecond)
-	defer ticker.Stop()
-
-	for {
-		allEstablished := true
-		for _, name := range crdNames {
-			crd := &unstructured.Unstructured{}
-			crd.SetGroupVersionKind(schema.GroupVersionKind{
-				Group:   "apiextensions.k8s.io",
-				Version: "v1",
-				Kind:    "CustomResourceDefinition",
-			})
-			if err := k8sClient.Get(ctx, types.NamespacedName{Name: name}, crd); err != nil {
-				allEstablished = false
-				break
-			}
-
-			conditions, found, err := unstructured.NestedSlice(crd.Object, "status", "conditions")
-			if err != nil || !found {
-				allEstablished = false
-				break
-			}
-
-			established := false
-			for _, c := range conditions {
-				cond, ok := c.(map[string]interface{})
-				if !ok {
-					continue
-				}
-				if cond["type"] == "Established" && cond["status"] == "True" {
-					established = true
-					break
-				}
-			}
-			if !established {
-				allEstablished = false
-				break
-			}
-		}
-
-		if allEstablished {
-			logger.Info("All CRDs established", "count", len(crdNames))
-			return nil
-		}
-
-		select {
-		case <-ctx.Done():
-			return fmt.Errorf("context cancelled while waiting for CRDs to be established: %w", ctx.Err())
-		case <-ticker.C:
-		}
-	}
-}
-
-func parseManifests(manifestPath string) ([]*unstructured.Unstructured, error) {
-	data, err := os.ReadFile(manifestPath)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read manifest file: %w", err)
-	}
-
-	return readYAMLObjects(bytes.NewReader(data))
-}
-
-func readYAMLObjects(reader io.Reader) ([]*unstructured.Unstructured, error) {
-	var objects []*unstructured.Unstructured
-	yamlReader := k8syaml.NewYAMLReader(bufio.NewReader(reader))
-
-	for {
-		doc, err := yamlReader.Read()
-		if err != nil {
-			if err == io.EOF {
-				break
-			}
-			return nil, fmt.Errorf("failed to read YAML document: %w", err)
-		}
-
-		if len(bytes.TrimSpace(doc)) == 0 {
-			continue
-		}
-
-		obj := &unstructured.Unstructured{}
-		decoder := k8syaml.NewYAMLOrJSONDecoder(bytes.NewReader(doc), len(doc))
-		if err := decoder.Decode(obj); err != nil {
-			if err == io.EOF {
-				continue
-			}
-			return nil, fmt.Errorf("failed to decode YAML document: %w", err)
-		}
-
-		if obj.GetKind() == "" {
-			continue
-		}
-
-		objects = append(objects, obj)
-	}
-
-	return objects, nil
-}
diff --git a/internal/crdinstall/install_test.go b/internal/crdinstall/install_test.go
index 2fd200bc..a4de0da2 100644
--- a/internal/crdinstall/install_test.go
+++ b/internal/crdinstall/install_test.go
@@ -18,6 +18,7 @@ package crdinstall
 
 import (
 	"context"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -34,143 +35,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 )
 
-func TestReadYAMLObjects(t *testing.T) {
-	tests := []struct {
-		name      string
-		input     string
-		wantCount int
-		wantErr   bool
-	}{
-		{
-			name: "single document",
-			input: `apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: test
-`,
-			wantCount: 1,
-		},
-		{
-			name: "multiple documents",
-			input: `apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: test1
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: test2
-`,
-			wantCount: 2,
-		},
-		{
-			name:      "empty input",
-			input:     "",
-			wantCount: 0,
-		},
-		{
-			name: "document without kind returns error",
-			input: `apiVersion: v1
-metadata:
-  name: test
-`,
-			wantErr: true,
-		},
-		{
-			name: "whitespace-only document between separators is skipped",
-			input: `apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: test1
----
-
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: test2
-`,
-			wantCount: 2,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			objects, err := readYAMLObjects(strings.NewReader(tt.input))
-			if (err != nil) != tt.wantErr {
-				t.Errorf("readYAMLObjects() error = %v, wantErr %v", err, tt.wantErr)
-				return
-			}
-			if len(objects) != tt.wantCount {
-				t.Errorf("readYAMLObjects() returned %d objects, want %d", len(objects), tt.wantCount)
-			}
-		})
-	}
-}
-
-func TestReadYAMLObjects_preservesFields(t *testing.T) {
-	input := `apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: packages.cozystack.io
-spec:
-  group: cozystack.io
-`
-	objects, err := readYAMLObjects(strings.NewReader(input))
-	if err != nil {
-		t.Fatalf("readYAMLObjects() error = %v", err)
-	}
-	if len(objects) != 1 {
-		t.Fatalf("expected 1 object, got %d", len(objects))
-	}
-
-	obj := objects[0]
-	if obj.GetKind() != "CustomResourceDefinition" {
-		t.Errorf("kind = %q, want %q", obj.GetKind(), "CustomResourceDefinition")
-	}
-	if obj.GetName() != "packages.cozystack.io" {
-		t.Errorf("name = %q, want %q", obj.GetName(), "packages.cozystack.io")
-	}
-	if obj.GetAPIVersion() != "apiextensions.k8s.io/v1" {
-		t.Errorf("apiVersion = %q, want %q", obj.GetAPIVersion(), "apiextensions.k8s.io/v1")
-	}
-}
-
-func TestParseManifests(t *testing.T) {
-	tmpDir := t.TempDir()
-	manifestPath := filepath.Join(tmpDir, "test.yaml")
-
-	content := `apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: cm1
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: cm2
-`
-	if err := os.WriteFile(manifestPath, []byte(content), 0600); err != nil {
-		t.Fatalf("failed to write test manifest: %v", err)
-	}
-
-	objects, err := parseManifests(manifestPath)
-	if err != nil {
-		t.Fatalf("parseManifests() error = %v", err)
-	}
-	if len(objects) != 2 {
-		t.Errorf("parseManifests() returned %d objects, want 2", len(objects))
-	}
-}
-
-func TestParseManifests_fileNotFound(t *testing.T) {
-	_, err := parseManifests("/nonexistent/path/test.yaml")
-	if err == nil {
-		t.Error("parseManifests() expected error for nonexistent file, got nil")
-	}
-}
-
 func TestWriteEmbeddedManifests(t *testing.T) {
 	tmpDir := t.TempDir()
 
@@ -211,7 +75,7 @@ func TestWriteEmbeddedManifests(t *testing.T) {
 		}
 	}
 
-	// Verify files are non-empty and contain valid YAML
+	// Verify files are non-empty
 	for _, f := range yamlFiles {
 		data, err := os.ReadFile(filepath.Join(tmpDir, f))
 		if err != nil {
@@ -224,182 +88,6 @@ func TestWriteEmbeddedManifests(t *testing.T) {
 	}
 }
 
-func TestInstall_appliesAllCRDs(t *testing.T) {
-	log.SetLogger(zap.New(zap.UseDevMode(true)))
-
-	scheme := runtime.NewScheme()
-	if err := apiextensionsv1.AddToScheme(scheme); err != nil {
-		t.Fatalf("failed to add apiextensions to scheme: %v", err)
-	}
-
-	// Intercept Get calls to simulate CRDs becoming Established
-	fakeClient := fake.NewClientBuilder().
-		WithScheme(scheme).
-		WithInterceptorFuncs(interceptor.Funcs{
-			Get: func(ctx context.Context, c client.WithWatch, key client.ObjectKey, obj client.Object, opts ...client.GetOption) error {
-				if err := c.Get(ctx, key, obj, opts...); err != nil {
-					return err
-				}
-				u, ok := obj.(*unstructured.Unstructured)
-				if !ok {
-					return nil
-				}
-				if u.GetKind() == "CustomResourceDefinition" {
-					_ = unstructured.SetNestedSlice(u.Object, []interface{}{
-						map[string]interface{}{
-							"type":   "Established",
-							"status": "True",
-						},
-					}, "status", "conditions")
-				}
-				return nil
-			},
-		}).
-		Build()
-
-	// Write two CRD manifests
-	writeManifests := func(dir string) error {
-		crd1 := `apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: packages.cozystack.io
-spec:
-  group: cozystack.io
-  names:
-    kind: Package
-    plural: packages
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    served: true
-    storage: true
-    schema:
-      openAPIV3Schema:
-        type: object
-`
-		crd2 := `apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: packagesources.cozystack.io
-spec:
-  group: cozystack.io
-  names:
-    kind: PackageSource
-    plural: packagesources
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    served: true
-    storage: true
-    schema:
-      openAPIV3Schema:
-        type: object
-`
-		if err := os.WriteFile(filepath.Join(dir, "crd1.yaml"), []byte(crd1), 0600); err != nil {
-			return err
-		}
-		return os.WriteFile(filepath.Join(dir, "crd2.yaml"), []byte(crd2), 0600)
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	ctx = log.IntoContext(ctx, log.FromContext(context.Background()))
-
-	err := Install(ctx, fakeClient, writeManifests)
-	if err != nil {
-		t.Fatalf("Install() error = %v", err)
-	}
-}
-
-func TestInstall_noManifests(t *testing.T) {
-	log.SetLogger(zap.New(zap.UseDevMode(true)))
-
-	scheme := runtime.NewScheme()
-	fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
-
-	writeEmpty := func(dir string) error {
-		return nil
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-	ctx = log.IntoContext(ctx, log.FromContext(context.Background()))
-
-	err := Install(ctx, fakeClient, writeEmpty)
-	if err == nil {
-		t.Error("Install() expected error for empty manifests, got nil")
-	}
-	if !strings.Contains(err.Error(), "no YAML manifest files found") {
-		t.Errorf("Install() error = %v, want error containing 'no YAML manifest files found'", err)
-	}
-}
-
-func TestInstall_writeManifestsFails(t *testing.T) {
-	log.SetLogger(zap.New(zap.UseDevMode(true)))
-
-	scheme := runtime.NewScheme()
-	fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
-
-	writeFail := func(dir string) error {
-		return os.ErrPermission
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-	ctx = log.IntoContext(ctx, log.FromContext(context.Background()))
-
-	err := Install(ctx, fakeClient, writeFail)
-	if err == nil {
-		t.Error("Install() expected error when writeManifests fails, got nil")
-	}
-}
-
-func TestInstall_crdNotEstablished(t *testing.T) {
-	log.SetLogger(zap.New(zap.UseDevMode(true)))
-
-	scheme := runtime.NewScheme()
-	if err := apiextensionsv1.AddToScheme(scheme); err != nil {
-		t.Fatalf("failed to add apiextensions to scheme: %v", err)
-	}
-
-	// No interceptor: CRDs will never get Established condition
-	fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
-
-	writeManifests := func(dir string) error {
-		crd := `apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: packages.cozystack.io
-spec:
-  group: cozystack.io
-  names:
-    kind: Package
-    plural: packages
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    served: true
-    storage: true
-    schema:
-      openAPIV3Schema:
-        type: object
-`
-		return os.WriteFile(filepath.Join(dir, "crd.yaml"), []byte(crd), 0600)
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-	defer cancel()
-	ctx = log.IntoContext(ctx, log.FromContext(context.Background()))
-
-	err := Install(ctx, fakeClient, writeManifests)
-	if err == nil {
-		t.Fatal("Install() expected error when CRDs never become established, got nil")
-	}
-	if !strings.Contains(err.Error(), "CRDs not established") {
-		t.Errorf("Install() error = %v, want error containing 'CRDs not established'", err)
-	}
-}
-
 func TestWriteEmbeddedManifests_filePermissions(t *testing.T) {
 	tmpDir := t.TempDir()
 
@@ -427,3 +115,160 @@ func TestWriteEmbeddedManifests_filePermissions(t *testing.T) {
 		}
 	}
 }
+
+// newCRDManifestWriter returns a function that writes test CRD YAML files.
+func newCRDManifestWriter(crds ...string) func(string) error {
+	return func(dir string) error {
+		for i, crd := range crds {
+			filename := filepath.Join(dir, fmt.Sprintf("crd%d.yaml", i+1))
+			if err := os.WriteFile(filename, []byte(crd), 0600); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+}
+
+var testCRD1 = `apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: packages.cozystack.io
+spec:
+  group: cozystack.io
+  names:
+    kind: Package
+    plural: packages
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    served: true
+    storage: true
+    schema:
+      openAPIV3Schema:
+        type: object
+`
+
+var testCRD2 = `apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: packagesources.cozystack.io
+spec:
+  group: cozystack.io
+  names:
+    kind: PackageSource
+    plural: packagesources
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    served: true
+    storage: true
+    schema:
+      openAPIV3Schema:
+        type: object
+`
+
+// establishedInterceptor simulates CRDs becoming Established in the API server.
+func establishedInterceptor() interceptor.Funcs {
+	return interceptor.Funcs{
+		Get: func(ctx context.Context, c client.WithWatch, key client.ObjectKey, obj client.Object, opts ...client.GetOption) error {
+			if err := c.Get(ctx, key, obj, opts...); err != nil {
+				return err
+			}
+			u, ok := obj.(*unstructured.Unstructured)
+			if !ok {
+				return nil
+			}
+			if u.GetKind() == "CustomResourceDefinition" {
+				_ = unstructured.SetNestedSlice(u.Object, []interface{}{
+					map[string]interface{}{
+						"type":   "Established",
+						"status": "True",
+					},
+				}, "status", "conditions")
+			}
+			return nil
+		},
+	}
+}
+
+func TestInstall_appliesAllCRDs(t *testing.T) {
+	log.SetLogger(zap.New(zap.UseDevMode(true)))
+
+	scheme := runtime.NewScheme()
+	if err := apiextensionsv1.AddToScheme(scheme); err != nil {
+		t.Fatalf("failed to add apiextensions to scheme: %v", err)
+	}
+
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithInterceptorFuncs(establishedInterceptor()).
+		Build()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	ctx = log.IntoContext(ctx, log.FromContext(context.Background()))
+
+	err := Install(ctx, fakeClient, newCRDManifestWriter(testCRD1, testCRD2))
+	if err != nil {
+		t.Fatalf("Install() error = %v", err)
+	}
+}
+
+func TestInstall_noManifests(t *testing.T) {
+	log.SetLogger(zap.New(zap.UseDevMode(true)))
+
+	scheme := runtime.NewScheme()
+	fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	ctx = log.IntoContext(ctx, log.FromContext(context.Background()))
+
+	err := Install(ctx, fakeClient, func(string) error { return nil })
+	if err == nil {
+		t.Error("Install() expected error for empty manifests, got nil")
+	}
+	if !strings.Contains(err.Error(), "no YAML manifest files found") {
+		t.Errorf("Install() error = %v, want error containing 'no YAML manifest files found'", err)
+	}
+}
+
+func TestInstall_writeManifestsFails(t *testing.T) {
+	log.SetLogger(zap.New(zap.UseDevMode(true)))
+
+	scheme := runtime.NewScheme()
+	fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	ctx = log.IntoContext(ctx, log.FromContext(context.Background()))
+
+	err := Install(ctx, fakeClient, func(string) error { return os.ErrPermission })
+	if err == nil {
+		t.Error("Install() expected error when writeManifests fails, got nil")
+	}
+}
+
+func TestInstall_crdNotEstablished(t *testing.T) {
+	log.SetLogger(zap.New(zap.UseDevMode(true)))
+
+	scheme := runtime.NewScheme()
+	if err := apiextensionsv1.AddToScheme(scheme); err != nil {
+		t.Fatalf("failed to add apiextensions to scheme: %v", err)
+	}
+
+	// No interceptor: CRDs will never get Established condition
+	fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	ctx = log.IntoContext(ctx, log.FromContext(context.Background()))
+
+	err := Install(ctx, fakeClient, newCRDManifestWriter(testCRD1))
+	if err == nil {
+		t.Fatal("Install() expected error when CRDs never become established, got nil")
+	}
+	if !strings.Contains(err.Error(), "CRDs not established") {
+		t.Errorf("Install() error = %v, want error containing 'CRDs not established'", err)
+	}
+}
diff --git a/internal/fluxinstall/install.go b/internal/fluxinstall/install.go
index 2097ecfb..4ae6f4cb 100644
--- a/internal/fluxinstall/install.go
+++ b/internal/fluxinstall/install.go
@@ -17,18 +17,15 @@ limitations under the License.
 package fluxinstall
 
 import (
-	"bufio"
-	"bytes"
 	"context"
 	"fmt"
-	"io"
 	"os"
 	"path/filepath"
 	"strings"
-	"time"
+
+	"github.com/cozystack/cozystack/internal/manifestutil"
 
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	k8syaml "k8s.io/apimachinery/pkg/util/yaml"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 )
@@ -76,7 +73,7 @@ func Install(ctx context.Context, k8sClient client.Client, writeEmbeddedManifest
 	// Parse all manifest files
 	var objects []*unstructured.Unstructured
 	for _, manifestPath := range manifestFiles {
-		objs, err := parseManifests(manifestPath)
+		objs, err := manifestutil.ParseManifestFile(manifestPath)
 		if err != nil {
 			return fmt.Errorf("failed to parse manifests from %s: %w", manifestPath, err)
 		}
@@ -110,56 +107,6 @@ func Install(ctx context.Context, k8sClient client.Client, writeEmbeddedManifest
 	return nil
 }
 
-// parseManifests parses YAML manifests into unstructured objects.
-func parseManifests(manifestPath string) ([]*unstructured.Unstructured, error) {
-	data, err := os.ReadFile(manifestPath)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read manifest file: %w", err)
-	}
-
-	return readYAMLObjects(bytes.NewReader(data))
-}
-
-// readYAMLObjects parses multi-document YAML into unstructured objects.
-func readYAMLObjects(reader io.Reader) ([]*unstructured.Unstructured, error) {
-	var objects []*unstructured.Unstructured
-	yamlReader := k8syaml.NewYAMLReader(bufio.NewReader(reader))
-
-	for {
-		doc, err := yamlReader.Read()
-		if err != nil {
-			if err == io.EOF {
-				break
-			}
-			return nil, fmt.Errorf("failed to read YAML document: %w", err)
-		}
-
-		// Skip empty documents
-		if len(bytes.TrimSpace(doc)) == 0 {
-			continue
-		}
-
-		obj := &unstructured.Unstructured{}
-		decoder := k8syaml.NewYAMLOrJSONDecoder(bytes.NewReader(doc), len(doc))
-		if err := decoder.Decode(obj); err != nil {
-			// Skip documents that can't be decoded (might be comments or empty)
-			if err == io.EOF {
-				continue
-			}
-			return nil, fmt.Errorf("failed to decode YAML document: %w", err)
-		}
-
-		// Skip empty objects (no kind)
-		if obj.GetKind() == "" {
-			continue
-		}
-
-		objects = append(objects, obj)
-	}
-
-	return objects, nil
-}
-
 // applyManifests applies Kubernetes objects using server-side apply.
 func applyManifests(ctx context.Context, k8sClient client.Client, objects []*unstructured.Unstructured) error {
 	logger := log.FromContext(ctx)
@@ -183,8 +130,11 @@ func applyManifests(ctx context.Context, k8sClient client.Client, objects []*uns
 			return fmt.Errorf("failed to apply cluster definitions: %w", err)
 		}
 
-		// Wait a bit for CRDs to be registered
-		time.Sleep(2 * time.Second)
+		// Wait for CRDs to be established before applying dependent resources
+		crdNames := manifestutil.CollectCRDNames(stageOne)
+		if err := manifestutil.WaitForCRDsEstablished(ctx, k8sClient, crdNames); err != nil {
+			return fmt.Errorf("CRDs not established after apply: %w", err)
+		}
 	}
 
 	// Apply stage two (everything else)
@@ -215,7 +165,6 @@ func applyObjects(ctx context.Context, k8sClient client.Client, objects []*unstr
 	return nil
 }
 
-
 // extractNamespace extracts the namespace name from the Namespace object in the manifests.
 func extractNamespace(objects []*unstructured.Unstructured) (string, error) {
 	for _, obj := range objects {
@@ -386,4 +335,3 @@ func setEnvVar(env []interface{}, name, value string) []interface{} {
 
 	return env
 }
-
diff --git a/internal/manifestutil/crd.go b/internal/manifestutil/crd.go
new file mode 100644
index 00000000..00421c4c
--- /dev/null
+++ b/internal/manifestutil/crd.go
@@ -0,0 +1,116 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package manifestutil
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+)
+
+var crdGVK = schema.GroupVersionKind{
+	Group:   "apiextensions.k8s.io",
+	Version: "v1",
+	Kind:    "CustomResourceDefinition",
+}
+
+// WaitForCRDsEstablished polls the API server until all named CRDs have the
+// Established condition set to True, or the context is cancelled.
+func WaitForCRDsEstablished(ctx context.Context, k8sClient client.Client, crdNames []string) error {
+	if len(crdNames) == 0 {
+		return nil
+	}
+
+	logger := log.FromContext(ctx)
+	ticker := time.NewTicker(500 * time.Millisecond)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return fmt.Errorf("context cancelled while waiting for CRDs to be established: %w", ctx.Err())
+		default:
+		}
+
+		allEstablished := true
+		var pendingCRD string
+		for _, name := range crdNames {
+			crd := &unstructured.Unstructured{}
+			crd.SetGroupVersionKind(crdGVK)
+			if err := k8sClient.Get(ctx, types.NamespacedName{Name: name}, crd); err != nil {
+				allEstablished = false
+				pendingCRD = name
+				break
+			}
+
+			conditions, found, err := unstructured.NestedSlice(crd.Object, "status", "conditions")
+			if err != nil || !found {
+				allEstablished = false
+				pendingCRD = name
+				break
+			}
+
+			established := false
+			for _, c := range conditions {
+				cond, ok := c.(map[string]interface{})
+				if !ok {
+					continue
+				}
+				if cond["type"] == "Established" && cond["status"] == "True" {
+					established = true
+					break
+				}
+			}
+			if !established {
+				allEstablished = false
+				pendingCRD = name
+				break
+			}
+		}
+
+		if allEstablished {
+			logger.Info("All CRDs established", "count", len(crdNames))
+			return nil
+		}
+
+		logger.V(1).Info("Waiting for CRD to be established", "crd", pendingCRD)
+
+		select {
+		case <-ctx.Done():
+			return fmt.Errorf("context cancelled while waiting for CRD %q to be established: %w", pendingCRD, ctx.Err())
+		case <-ticker.C:
+		}
+	}
+}
+
+// CollectCRDNames returns the names of all CustomResourceDefinition objects
+// from the given list of unstructured objects.
+func CollectCRDNames(objects []*unstructured.Unstructured) []string {
+	var names []string
+	for _, obj := range objects {
+		if obj.GetKind() == "CustomResourceDefinition" {
+			names = append(names, obj.GetName())
+		}
+	}
+	return names
+}
diff --git a/internal/manifestutil/crd_test.go b/internal/manifestutil/crd_test.go
new file mode 100644
index 00000000..874377b9
--- /dev/null
+++ b/internal/manifestutil/crd_test.go
@@ -0,0 +1,190 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package manifestutil
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/log/zap"
+)
+
+func TestCollectCRDNames(t *testing.T) {
+	objects := []*unstructured.Unstructured{
+		{Object: map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "Namespace",
+			"metadata":   map[string]interface{}{"name": "test-ns"},
+		}},
+		{Object: map[string]interface{}{
+			"apiVersion": "apiextensions.k8s.io/v1",
+			"kind":       "CustomResourceDefinition",
+			"metadata":   map[string]interface{}{"name": "packages.cozystack.io"},
+		}},
+		{Object: map[string]interface{}{
+			"apiVersion": "apps/v1",
+			"kind":       "Deployment",
+			"metadata":   map[string]interface{}{"name": "test-deploy"},
+		}},
+		{Object: map[string]interface{}{
+			"apiVersion": "apiextensions.k8s.io/v1",
+			"kind":       "CustomResourceDefinition",
+			"metadata":   map[string]interface{}{"name": "packagesources.cozystack.io"},
+		}},
+	}
+
+	names := CollectCRDNames(objects)
+	if len(names) != 2 {
+		t.Fatalf("CollectCRDNames() returned %d names, want 2", len(names))
+	}
+	if names[0] != "packages.cozystack.io" {
+		t.Errorf("names[0] = %q, want %q", names[0], "packages.cozystack.io")
+	}
+	if names[1] != "packagesources.cozystack.io" {
+		t.Errorf("names[1] = %q, want %q", names[1], "packagesources.cozystack.io")
+	}
+}
+
+func TestCollectCRDNames_noCRDs(t *testing.T) {
+	objects := []*unstructured.Unstructured{
+		{Object: map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "Namespace",
+			"metadata":   map[string]interface{}{"name": "test"},
+		}},
+	}
+
+	names := CollectCRDNames(objects)
+	if len(names) != 0 {
+		t.Errorf("CollectCRDNames() returned %d names, want 0", len(names))
+	}
+}
+
+func TestWaitForCRDsEstablished_success(t *testing.T) {
+	log.SetLogger(zap.New(zap.UseDevMode(true)))
+
+	scheme := runtime.NewScheme()
+	if err := apiextensionsv1.AddToScheme(scheme); err != nil {
+		t.Fatalf("failed to add apiextensions to scheme: %v", err)
+	}
+
+	// Create a CRD object in the fake client
+	crd := &unstructured.Unstructured{Object: map[string]interface{}{
+		"apiVersion": "apiextensions.k8s.io/v1",
+		"kind":       "CustomResourceDefinition",
+		"metadata":   map[string]interface{}{"name": "packages.cozystack.io"},
+	}}
+
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(crd).
+		WithInterceptorFuncs(interceptor.Funcs{
+			Get: func(ctx context.Context, c client.WithWatch, key client.ObjectKey, obj client.Object, opts ...client.GetOption) error {
+				if err := c.Get(ctx, key, obj, opts...); err != nil {
+					return err
+				}
+				u, ok := obj.(*unstructured.Unstructured)
+				if !ok {
+					return nil
+				}
+				if u.GetKind() == "CustomResourceDefinition" {
+					_ = unstructured.SetNestedSlice(u.Object, []interface{}{
+						map[string]interface{}{
+							"type":   "Established",
+							"status": "True",
+						},
+					}, "status", "conditions")
+				}
+				return nil
+			},
+		}).
+		Build()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	ctx = log.IntoContext(ctx, log.FromContext(context.Background()))
+
+	err := WaitForCRDsEstablished(ctx, fakeClient, []string{"packages.cozystack.io"})
+	if err != nil {
+		t.Fatalf("WaitForCRDsEstablished() error = %v", err)
+	}
+}
+
+func TestWaitForCRDsEstablished_timeout(t *testing.T) {
+	log.SetLogger(zap.New(zap.UseDevMode(true)))
+
+	scheme := runtime.NewScheme()
+	if err := apiextensionsv1.AddToScheme(scheme); err != nil {
+		t.Fatalf("failed to add apiextensions to scheme: %v", err)
+	}
+
+	// CRD exists but never gets Established condition
+	crd := &unstructured.Unstructured{Object: map[string]interface{}{
+		"apiVersion": "apiextensions.k8s.io/v1",
+		"kind":       "CustomResourceDefinition",
+		"metadata":   map[string]interface{}{"name": "packages.cozystack.io"},
+	}}
+
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(crd).
+		Build()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	ctx = log.IntoContext(ctx, log.FromContext(context.Background()))
+
+	err := WaitForCRDsEstablished(ctx, fakeClient, []string{"packages.cozystack.io"})
+	if err == nil {
+		t.Fatal("WaitForCRDsEstablished() expected error on timeout, got nil")
+	}
+	if !contains(err.Error(), "packages.cozystack.io") {
+		t.Errorf("error should mention stuck CRD name, got: %v", err)
+	}
+}
+
+func TestWaitForCRDsEstablished_empty(t *testing.T) {
+	scheme := runtime.NewScheme()
+	fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
+
+	ctx := context.Background()
+	err := WaitForCRDsEstablished(ctx, fakeClient, nil)
+	if err != nil {
+		t.Fatalf("WaitForCRDsEstablished() with empty names should return nil, got: %v", err)
+	}
+}
+
+func contains(s, substr string) bool {
+	return len(s) >= len(substr) && searchString(s, substr)
+}
+
+func searchString(s, substr string) bool {
+	for i := 0; i <= len(s)-len(substr); i++ {
+		if s[i:i+len(substr)] == substr {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/manifestutil/parse.go b/internal/manifestutil/parse.go
new file mode 100644
index 00000000..009e4a96
--- /dev/null
+++ b/internal/manifestutil/parse.go
@@ -0,0 +1,76 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package manifestutil
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+	"os"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	k8syaml "k8s.io/apimachinery/pkg/util/yaml"
+)
+
+// ParseManifestFile reads a YAML file and parses it into unstructured objects.
+func ParseManifestFile(manifestPath string) ([]*unstructured.Unstructured, error) {
+	data, err := os.ReadFile(manifestPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read manifest file: %w", err)
+	}
+
+	return ReadYAMLObjects(bytes.NewReader(data))
+}
+
+// ReadYAMLObjects parses multi-document YAML from a reader into unstructured objects.
+// Empty documents and documents without a kind are skipped.
+func ReadYAMLObjects(reader io.Reader) ([]*unstructured.Unstructured, error) {
+	var objects []*unstructured.Unstructured
+	yamlReader := k8syaml.NewYAMLReader(bufio.NewReader(reader))
+
+	for {
+		doc, err := yamlReader.Read()
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			return nil, fmt.Errorf("failed to read YAML document: %w", err)
+		}
+
+		if len(bytes.TrimSpace(doc)) == 0 {
+			continue
+		}
+
+		obj := &unstructured.Unstructured{}
+		decoder := k8syaml.NewYAMLOrJSONDecoder(bytes.NewReader(doc), len(doc))
+		if err := decoder.Decode(obj); err != nil {
+			if err == io.EOF {
+				continue
+			}
+			return nil, fmt.Errorf("failed to decode YAML document: %w", err)
+		}
+
+		if obj.GetKind() == "" {
+			continue
+		}
+
+		objects = append(objects, obj)
+	}
+
+	return objects, nil
+}
diff --git a/internal/manifestutil/parse_test.go b/internal/manifestutil/parse_test.go
new file mode 100644
index 00000000..30bf7030
--- /dev/null
+++ b/internal/manifestutil/parse_test.go
@@ -0,0 +1,161 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package manifestutil
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestReadYAMLObjects(t *testing.T) {
+	tests := []struct {
+		name      string
+		input     string
+		wantCount int
+		wantErr   bool
+	}{
+		{
+			name: "single document",
+			input: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test
+`,
+			wantCount: 1,
+		},
+		{
+			name: "multiple documents",
+			input: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test1
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test2
+`,
+			wantCount: 2,
+		},
+		{
+			name:      "empty input",
+			input:     "",
+			wantCount: 0,
+		},
+		{
+			name: "document without kind returns error",
+			input: `apiVersion: v1
+metadata:
+  name: test
+`,
+			wantErr: true,
+		},
+		{
+			name: "whitespace-only document between separators is skipped",
+			input: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test1
+---
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test2
+`,
+			wantCount: 2,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			objects, err := ReadYAMLObjects(strings.NewReader(tt.input))
+			if (err != nil) != tt.wantErr {
+				t.Errorf("ReadYAMLObjects() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if len(objects) != tt.wantCount {
+				t.Errorf("ReadYAMLObjects() returned %d objects, want %d", len(objects), tt.wantCount)
+			}
+		})
+	}
+}
+
+func TestReadYAMLObjects_preservesFields(t *testing.T) {
+	input := `apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: packages.cozystack.io
+spec:
+  group: cozystack.io
+`
+	objects, err := ReadYAMLObjects(strings.NewReader(input))
+	if err != nil {
+		t.Fatalf("ReadYAMLObjects() error = %v", err)
+	}
+	if len(objects) != 1 {
+		t.Fatalf("expected 1 object, got %d", len(objects))
+	}
+
+	obj := objects[0]
+	if obj.GetKind() != "CustomResourceDefinition" {
+		t.Errorf("kind = %q, want %q", obj.GetKind(), "CustomResourceDefinition")
+	}
+	if obj.GetName() != "packages.cozystack.io" {
+		t.Errorf("name = %q, want %q", obj.GetName(), "packages.cozystack.io")
+	}
+	if obj.GetAPIVersion() != "apiextensions.k8s.io/v1" {
+		t.Errorf("apiVersion = %q, want %q", obj.GetAPIVersion(), "apiextensions.k8s.io/v1")
+	}
+}
+
+func TestParseManifestFile(t *testing.T) {
+	tmpDir := t.TempDir()
+	manifestPath := filepath.Join(tmpDir, "test.yaml")
+
+	content := `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cm1
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cm2
+`
+	if err := os.WriteFile(manifestPath, []byte(content), 0600); err != nil {
+		t.Fatalf("failed to write test manifest: %v", err)
+	}
+
+	objects, err := ParseManifestFile(manifestPath)
+	if err != nil {
+		t.Fatalf("ParseManifestFile() error = %v", err)
+	}
+	if len(objects) != 2 {
+		t.Errorf("ParseManifestFile() returned %d objects, want 2", len(objects))
+	}
+}
+
+func TestParseManifestFile_notFound(t *testing.T) {
+	_, err := ParseManifestFile("/nonexistent/path/test.yaml")
+	if err == nil {
+		t.Error("ParseManifestFile() expected error for nonexistent file, got nil")
+	}
+}

From abd644122f3ed93e8efc84a43a868c0383bd64ce Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 18 Feb 2026 00:07:09 +0300
Subject: [PATCH 083/666] fix(crdinstall): reject non-CRD objects in embedded
 manifests

Validate that all parsed objects are CustomResourceDefinition before
applying with force server-side apply. This prevents accidental
application of arbitrary resources if a non-CRD file is placed in
the manifests directory.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 internal/crdinstall/install.go      |  9 +++++++++
 internal/crdinstall/install_test.go | 28 ++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/internal/crdinstall/install.go b/internal/crdinstall/install.go
index 4cd93597..f65abf63 100644
--- a/internal/crdinstall/install.go
+++ b/internal/crdinstall/install.go
@@ -80,6 +80,15 @@ func Install(ctx context.Context, k8sClient client.Client, writeEmbeddedManifest
 		return fmt.Errorf("no objects found in manifests")
 	}
 
+	// Validate all objects are CRDs — reject anything else to prevent
+	// accidental force-apply of arbitrary resources.
+	for _, obj := range objects {
+		if obj.GetKind() != "CustomResourceDefinition" {
+			return fmt.Errorf("unexpected object %s/%s in CRD manifests, only CustomResourceDefinition is allowed",
+				obj.GetKind(), obj.GetName())
+		}
+	}
+
 	logger.Info("Applying Cozystack CRDs", "count", len(objects))
 	for _, obj := range objects {
 		patchOptions := &client.PatchOptions{
diff --git a/internal/crdinstall/install_test.go b/internal/crdinstall/install_test.go
index a4de0da2..870a146c 100644
--- a/internal/crdinstall/install_test.go
+++ b/internal/crdinstall/install_test.go
@@ -249,6 +249,34 @@ func TestInstall_writeManifestsFails(t *testing.T) {
 	}
 }
 
+func TestInstall_rejectsNonCRDObjects(t *testing.T) {
+	log.SetLogger(zap.New(zap.UseDevMode(true)))
+
+	scheme := runtime.NewScheme()
+	if err := apiextensionsv1.AddToScheme(scheme); err != nil {
+		t.Fatalf("failed to add apiextensions to scheme: %v", err)
+	}
+
+	fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
+
+	nonCRD := `apiVersion: v1
+kind: Namespace
+metadata:
+  name: should-not-be-applied
+`
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	ctx = log.IntoContext(ctx, log.FromContext(context.Background()))
+
+	err := Install(ctx, fakeClient, newCRDManifestWriter(nonCRD))
+	if err == nil {
+		t.Fatal("Install() expected error for non-CRD object, got nil")
+	}
+	if !strings.Contains(err.Error(), "unexpected object") {
+		t.Errorf("Install() error = %v, want error containing 'unexpected object'", err)
+	}
+}
+
 func TestInstall_crdNotEstablished(t *testing.T) {
 	log.SetLogger(zap.New(zap.UseDevMode(true)))
 

From cecc5861af1e8eb7aab966b11de835fa4be3b0c6 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 18 Feb 2026 00:13:25 +0300
Subject: [PATCH 084/666] fix(operator): validate CRD apiVersion, respect
 SIGTERM during install

- Check both apiVersion and kind when validating embedded CRD manifests
  to prevent applying objects with wrong API group
- Move ctrl.SetupSignalHandler() before install phases so CRD and Flux
  installs respect SIGTERM instead of blocking for up to 2 minutes
- Replace custom contains/searchString helpers with strings.Contains

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 cmd/cozystack-operator/main.go    | 10 ++++++----
 internal/crdinstall/install.go    |  6 +++---
 internal/manifestutil/crd_test.go | 15 ++-------------
 3 files changed, 11 insertions(+), 20 deletions(-)

diff --git a/cmd/cozystack-operator/main.go b/cmd/cozystack-operator/main.go
index f365a076..a0efdd84 100644
--- a/cmd/cozystack-operator/main.go
+++ b/cmd/cozystack-operator/main.go
@@ -180,10 +180,13 @@ func main() {
 		os.Exit(1)
 	}
 
+	// Set up signal handler early so install phases respect SIGTERM
+	mgrCtx := ctrl.SetupSignalHandler()
+
 	// Install Cozystack CRDs before starting reconcile loop
 	if installCRDs {
 		setupLog.Info("Installing Cozystack CRDs before starting reconcile loop")
-		installCtx, installCancel := context.WithTimeout(context.Background(), 2*time.Minute)
+		installCtx, installCancel := context.WithTimeout(mgrCtx, 2*time.Minute)
 		defer installCancel()
 
 		if err := crdinstall.Install(installCtx, directClient, crdinstall.WriteEmbeddedManifests); err != nil {
@@ -196,7 +199,7 @@ func main() {
 	// Install Flux before starting reconcile loop
 	if installFlux {
 		setupLog.Info("Installing Flux components before starting reconcile loop")
-		installCtx, installCancel := context.WithTimeout(context.Background(), 5*time.Minute)
+		installCtx, installCancel := context.WithTimeout(mgrCtx, 5*time.Minute)
 		defer installCancel()
 
 		// Use direct client for pre-start operations (cache is not ready yet)
@@ -210,7 +213,7 @@ func main() {
 	// Generate and install platform source resource if specified
 	if platformSourceURL != "" {
 		setupLog.Info("Generating platform source resource", "url", platformSourceURL, "name", platformSourceName, "ref", platformSourceRef)
-		installCtx, installCancel := context.WithTimeout(context.Background(), 2*time.Minute)
+		installCtx, installCancel := context.WithTimeout(mgrCtx, 2*time.Minute)
 		defer installCancel()
 
 		// Use direct client for pre-start operations (cache is not ready yet)
@@ -292,7 +295,6 @@ func main() {
 	}
 
 	setupLog.Info("Starting controller manager")
-	mgrCtx := ctrl.SetupSignalHandler()
 	if err := mgr.Start(mgrCtx); err != nil {
 		setupLog.Error(err, "problem running manager")
 		os.Exit(1)
diff --git a/internal/crdinstall/install.go b/internal/crdinstall/install.go
index f65abf63..5143f2e6 100644
--- a/internal/crdinstall/install.go
+++ b/internal/crdinstall/install.go
@@ -83,9 +83,9 @@ func Install(ctx context.Context, k8sClient client.Client, writeEmbeddedManifest
 	// Validate all objects are CRDs — reject anything else to prevent
 	// accidental force-apply of arbitrary resources.
 	for _, obj := range objects {
-		if obj.GetKind() != "CustomResourceDefinition" {
-			return fmt.Errorf("unexpected object %s/%s in CRD manifests, only CustomResourceDefinition is allowed",
-				obj.GetKind(), obj.GetName())
+		if obj.GetAPIVersion() != "apiextensions.k8s.io/v1" || obj.GetKind() != "CustomResourceDefinition" {
+			return fmt.Errorf("unexpected object %s %s/%s in CRD manifests, only apiextensions.k8s.io/v1 CustomResourceDefinition is allowed",
+				obj.GetAPIVersion(), obj.GetKind(), obj.GetName())
 		}
 	}
 
diff --git a/internal/manifestutil/crd_test.go b/internal/manifestutil/crd_test.go
index 874377b9..c67b2efa 100644
--- a/internal/manifestutil/crd_test.go
+++ b/internal/manifestutil/crd_test.go
@@ -18,6 +18,7 @@ package manifestutil
 
 import (
 	"context"
+	"strings"
 	"testing"
 	"time"
 
@@ -160,7 +161,7 @@ func TestWaitForCRDsEstablished_timeout(t *testing.T) {
 	if err == nil {
 		t.Fatal("WaitForCRDsEstablished() expected error on timeout, got nil")
 	}
-	if !contains(err.Error(), "packages.cozystack.io") {
+	if !strings.Contains(err.Error(), "packages.cozystack.io") {
 		t.Errorf("error should mention stuck CRD name, got: %v", err)
 	}
 }
@@ -176,15 +177,3 @@ func TestWaitForCRDsEstablished_empty(t *testing.T) {
 	}
 }
 
-func contains(s, substr string) bool {
-	return len(s) >= len(substr) && searchString(s, substr)
-}
-
-func searchString(s, substr string) bool {
-	for i := 0; i <= len(s)-len(substr); i++ {
-		if s[i:i+len(substr)] == substr {
-			return true
-		}
-	}
-	return false
-}

From 9eb13fdafe50f9970899a9f0a1e59664be2d034a Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 18 Feb 2026 00:15:08 +0300
Subject: [PATCH 085/666] fix(controller): update workload test to use current
 label name

The workload reconciler was refactored to use the label
workloads.cozystack.io/monitor but the test still used the old
workloadmonitor.cozystack.io/name label, causing the reconciler to
delete the workload instead of keeping it.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 internal/controller/workload_controller_test.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/internal/controller/workload_controller_test.go b/internal/controller/workload_controller_test.go
index b454adc3..194a20d3 100644
--- a/internal/controller/workload_controller_test.go
+++ b/internal/controller/workload_controller_test.go
@@ -43,7 +43,7 @@ func TestWorkloadReconciler_DeletesOnMissingMonitor(t *testing.T) {
 			Name:      "pod-foo",
 			Namespace: "default",
 			Labels: map[string]string{
-				"workloadmonitor.cozystack.io/name": "missing-monitor",
+				"workloads.cozystack.io/monitor": "missing-monitor",
 			},
 		},
 	}
@@ -89,7 +89,7 @@ func TestWorkloadReconciler_KeepsWhenAllExist(t *testing.T) {
 			Name:      "pod-foo",
 			Namespace: "default",
 			Labels: map[string]string{
-				"workloadmonitor.cozystack.io/name": "mon",
+				"workloads.cozystack.io/monitor": "mon",
 			},
 		},
 	}

From 92d261fc1e64a87b3b0fee5a87c5d010f86cb1fb Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 18 Feb 2026 00:25:06 +0300
Subject: [PATCH 086/666] fix: address review findings in operator and tests

- Remove duplicate "Starting controller manager" log before install
  phases, keep only the one before mgr.Start()
- Rename misleading test "document without kind returns error" to
  "decoder rejects document without kind" to match actual behavior
- Document Helm uninstall CRD behavior in deployment template comment
- Use --health-probe-bind-address=0 consistently with metrics-bind
- Exclude all dotfiles in verify-crds diff, not just .gitattributes

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 Makefile                                                  | 2 +-
 cmd/cozystack-operator/main.go                            | 3 +--
 internal/manifestutil/parse_test.go                       | 2 +-
 packages/core/installer/templates/cozystack-operator.yaml | 7 ++++---
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/Makefile b/Makefile
index 9707ade4..73bd0bea 100644
--- a/Makefile
+++ b/Makefile
@@ -81,7 +81,7 @@ test:
 	make -C packages/core/testing test
 
 verify-crds:
-	@diff --recursive packages/core/installer/crds/ internal/crdinstall/manifests/ --exclude=.gitattributes \
+	@diff --recursive packages/core/installer/crds/ internal/crdinstall/manifests/ --exclude='.*' \
 		|| (echo "ERROR: CRD manifests out of sync. Run 'make generate' to fix." && exit 1)
 
 unit-tests: helm-unit-tests verify-crds
diff --git a/cmd/cozystack-operator/main.go b/cmd/cozystack-operator/main.go
index a0efdd84..d3c40f7e 100644
--- a/cmd/cozystack-operator/main.go
+++ b/cmd/cozystack-operator/main.go
@@ -137,8 +137,7 @@ func main() {
 		os.Exit(1)
 	}
 
-	// Start the controller manager
-	setupLog.Info("Starting controller manager")
+	// Initialize the controller manager
 	mgr, err := ctrl.NewManager(config, ctrl.Options{
 		Scheme: scheme,
 		Cache: cache.Options{
diff --git a/internal/manifestutil/parse_test.go b/internal/manifestutil/parse_test.go
index 30bf7030..860405c7 100644
--- a/internal/manifestutil/parse_test.go
+++ b/internal/manifestutil/parse_test.go
@@ -59,7 +59,7 @@ metadata:
 			wantCount: 0,
 		},
 		{
-			name: "document without kind returns error",
+			name: "decoder rejects document without kind",
 			input: `apiVersion: v1
 metadata:
   name: test
diff --git a/packages/core/installer/templates/cozystack-operator.yaml b/packages/core/installer/templates/cozystack-operator.yaml
index 1153ec4d..5cd471cf 100644
--- a/packages/core/installer/templates/cozystack-operator.yaml
+++ b/packages/core/installer/templates/cozystack-operator.yaml
@@ -54,11 +54,12 @@ spec:
         - --leader-elect=true
         - --install-flux=true
         # CRDs are also in crds/ for initial helm install, but Helm never updates
-        # them on upgrade. The operator applies embedded CRDs via server-side apply
-        # on every startup, ensuring they stay up to date.
+        # them on upgrade and never deletes them on uninstall. The operator applies
+        # embedded CRDs via server-side apply on every startup, ensuring they stay
+        # up to date. To fully remove CRDs, delete them manually after helm uninstall.
         - --install-crds=true
         - --metrics-bind-address=0
-        - --health-probe-bind-address=
+        - --health-probe-bind-address=0
         {{- if .Values.cozystackOperator.disableTelemetry }}
         - --disable-telemetry
         {{- end }}

From 09805ff382a69ca5891566f7c0f6916bd78a908f Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 18 Feb 2026 00:29:52 +0300
Subject: [PATCH 087/666] fix(manifestutil): check apiVersion in
 CollectCRDNames for consistent GVK matching

CollectCRDNames now requires both apiVersion "apiextensions.k8s.io/v1"
and kind "CustomResourceDefinition", consistent with the validation in
crdinstall.Install.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 internal/manifestutil/crd.go      |  6 ++++--
 internal/manifestutil/crd_test.go | 23 +++++++++++++++++++++++
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/internal/manifestutil/crd.go b/internal/manifestutil/crd.go
index 00421c4c..08468d1b 100644
--- a/internal/manifestutil/crd.go
+++ b/internal/manifestutil/crd.go
@@ -104,11 +104,13 @@ func WaitForCRDsEstablished(ctx context.Context, k8sClient client.Client, crdNam
 }
 
 // CollectCRDNames returns the names of all CustomResourceDefinition objects
-// from the given list of unstructured objects.
+// from the given list of unstructured objects. Only objects with
+// apiVersion "apiextensions.k8s.io/v1" and kind "CustomResourceDefinition"
+// are matched.
 func CollectCRDNames(objects []*unstructured.Unstructured) []string {
 	var names []string
 	for _, obj := range objects {
-		if obj.GetKind() == "CustomResourceDefinition" {
+		if obj.GetAPIVersion() == "apiextensions.k8s.io/v1" && obj.GetKind() == "CustomResourceDefinition" {
 			names = append(names, obj.GetName())
 		}
 	}
diff --git a/internal/manifestutil/crd_test.go b/internal/manifestutil/crd_test.go
index c67b2efa..5d046353 100644
--- a/internal/manifestutil/crd_test.go
+++ b/internal/manifestutil/crd_test.go
@@ -68,6 +68,29 @@ func TestCollectCRDNames(t *testing.T) {
 	}
 }
 
+func TestCollectCRDNames_ignoresWrongAPIVersion(t *testing.T) {
+	objects := []*unstructured.Unstructured{
+		{Object: map[string]interface{}{
+			"apiVersion": "apiextensions.k8s.io/v1",
+			"kind":       "CustomResourceDefinition",
+			"metadata":   map[string]interface{}{"name": "real.crd.io"},
+		}},
+		{Object: map[string]interface{}{
+			"apiVersion": "apiextensions.k8s.io/v1beta1",
+			"kind":       "CustomResourceDefinition",
+			"metadata":   map[string]interface{}{"name": "legacy.crd.io"},
+		}},
+	}
+
+	names := CollectCRDNames(objects)
+	if len(names) != 1 {
+		t.Fatalf("CollectCRDNames() returned %d names, want 1", len(names))
+	}
+	if names[0] != "real.crd.io" {
+		t.Errorf("names[0] = %q, want %q", names[0], "real.crd.io")
+	}
+}
+
 func TestCollectCRDNames_noCRDs(t *testing.T) {
 	objects := []*unstructured.Unstructured{
 		{Object: map[string]interface{}{

From 543ce6e5fd040a33bdf1825b29c79cad9953a2b6 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 16 Feb 2026 19:48:32 +0300
Subject: [PATCH 088/666] [harbor] Add managed Harbor container registry
 application

Add Harbor v2.14.2 as a tenant-level managed service with per-component
resource configuration, ingress with TLS termination, and internal
PostgreSQL/Redis.

Includes:
- extra/harbor wrapper chart with HelmRelease, WorkloadMonitors, Ingress
- system/harbor with vendored upstream chart (helm.goharbor.io v1.18.2)
- harbor-rd ApplicationDefinition for dynamic CRD registration
- PackageSource and system.yaml bundle entry
- E2E test with Secret and Service verification

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/harbor.bats                     |   48 +
 .../platform/sources/harbor-application.yaml  |   29 +
 .../platform/templates/bundles/system.yaml    |    1 +
 packages/extra/harbor/Chart.yaml              |    7 +
 packages/extra/harbor/Makefile                |    7 +
 packages/extra/harbor/README.md               |   54 +
 packages/extra/harbor/charts/cozy-lib         |    1 +
 packages/extra/harbor/logos/harbor.svg        |    1 +
 .../templates/dashboard-resourcemap.yaml      |   46 +
 packages/extra/harbor/templates/harbor.yaml   |  153 +++
 packages/extra/harbor/templates/ingress.yaml  |   33 +
 packages/extra/harbor/values.schema.json      |  414 +++++++
 packages/extra/harbor/values.yaml             |   90 ++
 packages/system/harbor-rd/Chart.yaml          |    3 +
 packages/system/harbor-rd/Makefile            |    4 +
 packages/system/harbor-rd/cozyrds/harbor.yaml |   47 +
 .../system/harbor-rd/templates/cozyrd.yaml    |    4 +
 packages/system/harbor-rd/values.yaml         |    1 +
 packages/system/harbor/Chart.yaml             |    3 +
 packages/system/harbor/Makefile               |   10 +
 .../system/harbor/charts/harbor/.helmignore   |    6 +
 .../system/harbor/charts/harbor/Chart.yaml    |   22 +
 packages/system/harbor/charts/harbor/LICENSE  |  201 +++
 .../system/harbor/charts/harbor/README.md     |  775 ++++++++++++
 .../harbor/charts/harbor/templates/NOTES.txt  |    3 +
 .../charts/harbor/templates/_helpers.tpl      |  606 +++++++++
 .../charts/harbor/templates/core/core-cm.yaml |   92 ++
 .../harbor/templates/core/core-dpl.yaml       |  258 ++++
 .../templates/core/core-pre-upgrade-job.yaml  |   78 ++
 .../harbor/templates/core/core-secret.yaml    |   37 +
 .../harbor/templates/core/core-svc.yaml       |   32 +
 .../harbor/templates/core/core-tls.yaml       |   16 +
 .../templates/database/database-secret.yaml   |   12 +
 .../templates/database/database-ss.yaml       |  165 +++
 .../templates/database/database-svc.yaml      |   21 +
 .../templates/exporter/exporter-cm-env.yaml   |   36 +
 .../templates/exporter/exporter-dpl.yaml      |  146 +++
 .../templates/exporter/exporter-secret.yaml   |   17 +
 .../templates/exporter/exporter-svc.yaml      |   22 +
 .../harbor/templates/gateway-apis/route.yaml  |   55 +
 .../harbor/templates/ingress/ingress.yaml     |  132 ++
 .../harbor/templates/ingress/secret.yaml      |   18 +
 .../harbor/templates/internal/auto-tls.yaml   |   86 ++
 .../jobservice/jobservice-cm-env.yaml         |   37 +
 .../templates/jobservice/jobservice-cm.yaml   |   58 +
 .../templates/jobservice/jobservice-dpl.yaml  |  183 +++
 .../templates/jobservice/jobservice-pvc.yaml  |   32 +
 .../jobservice/jobservice-secrets.yaml        |   17 +
 .../templates/jobservice/jobservice-svc.yaml  |   25 +
 .../templates/jobservice/jobservice-tls.yaml  |   16 +
 .../templates/metrics/metrics-svcmon.yaml     |   29 +
 .../templates/nginx/configmap-http.yaml       |  136 ++
 .../templates/nginx/configmap-https.yaml      |  173 +++
 .../harbor/templates/nginx/deployment.yaml    |  133 ++
 .../charts/harbor/templates/nginx/secret.yaml |   26 +
 .../harbor/templates/nginx/service.yaml       |  101 ++
 .../harbor/templates/portal/configmap.yaml    |   68 +
 .../harbor/templates/portal/deployment.yaml   |  124 ++
 .../harbor/templates/portal/service.yaml      |   27 +
 .../charts/harbor/templates/portal/tls.yaml   |   16 +
 .../harbor/templates/redis/service.yaml       |   21 +
 .../harbor/templates/redis/statefulset.yaml   |  128 ++
 .../templates/registry/registry-cm.yaml       |  248 ++++
 .../templates/registry/registry-dpl.yaml      |  431 +++++++
 .../templates/registry/registry-pvc.yaml      |   34 +
 .../templates/registry/registry-secret.yaml   |   57 +
 .../templates/registry/registry-svc.yaml      |   27 +
 .../templates/registry/registry-tls.yaml      |   16 +
 .../templates/registry/registryctl-cm.yaml    |    9 +
 .../registry/registryctl-secret.yaml          |   10 +
 .../harbor/templates/trivy/trivy-secret.yaml  |   13 +
 .../harbor/templates/trivy/trivy-sts.yaml     |  237 ++++
 .../harbor/templates/trivy/trivy-svc.yaml     |   23 +
 .../harbor/templates/trivy/trivy-tls.yaml     |   16 +
 .../system/harbor/charts/harbor/values.yaml   | 1095 +++++++++++++++++
 packages/system/harbor/values.yaml            |    1 +
 76 files changed, 7359 insertions(+)
 create mode 100644 hack/e2e-apps/harbor.bats
 create mode 100644 packages/core/platform/sources/harbor-application.yaml
 create mode 100644 packages/extra/harbor/Chart.yaml
 create mode 100644 packages/extra/harbor/Makefile
 create mode 100644 packages/extra/harbor/README.md
 create mode 120000 packages/extra/harbor/charts/cozy-lib
 create mode 100644 packages/extra/harbor/logos/harbor.svg
 create mode 100644 packages/extra/harbor/templates/dashboard-resourcemap.yaml
 create mode 100644 packages/extra/harbor/templates/harbor.yaml
 create mode 100644 packages/extra/harbor/templates/ingress.yaml
 create mode 100644 packages/extra/harbor/values.schema.json
 create mode 100644 packages/extra/harbor/values.yaml
 create mode 100644 packages/system/harbor-rd/Chart.yaml
 create mode 100644 packages/system/harbor-rd/Makefile
 create mode 100644 packages/system/harbor-rd/cozyrds/harbor.yaml
 create mode 100644 packages/system/harbor-rd/templates/cozyrd.yaml
 create mode 100644 packages/system/harbor-rd/values.yaml
 create mode 100644 packages/system/harbor/Chart.yaml
 create mode 100644 packages/system/harbor/Makefile
 create mode 100644 packages/system/harbor/charts/harbor/.helmignore
 create mode 100644 packages/system/harbor/charts/harbor/Chart.yaml
 create mode 100644 packages/system/harbor/charts/harbor/LICENSE
 create mode 100644 packages/system/harbor/charts/harbor/README.md
 create mode 100644 packages/system/harbor/charts/harbor/templates/NOTES.txt
 create mode 100644 packages/system/harbor/charts/harbor/templates/_helpers.tpl
 create mode 100644 packages/system/harbor/charts/harbor/templates/core/core-cm.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/core/core-dpl.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/core/core-pre-upgrade-job.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/core/core-secret.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/core/core-svc.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/core/core-tls.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/database/database-secret.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/database/database-ss.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/database/database-svc.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/exporter/exporter-cm-env.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/exporter/exporter-dpl.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/exporter/exporter-secret.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/exporter/exporter-svc.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/gateway-apis/route.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/ingress/ingress.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/ingress/secret.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/internal/auto-tls.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/jobservice/jobservice-cm-env.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/jobservice/jobservice-cm.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/jobservice/jobservice-dpl.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/jobservice/jobservice-pvc.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/jobservice/jobservice-secrets.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/jobservice/jobservice-svc.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/jobservice/jobservice-tls.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/metrics/metrics-svcmon.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/nginx/configmap-http.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/nginx/configmap-https.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/nginx/deployment.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/nginx/secret.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/nginx/service.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/portal/configmap.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/portal/deployment.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/portal/service.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/portal/tls.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/redis/service.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/redis/statefulset.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/registry/registry-cm.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/registry/registry-dpl.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/registry/registry-pvc.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/registry/registry-secret.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/registry/registry-svc.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/registry/registry-tls.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/registry/registryctl-cm.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/registry/registryctl-secret.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/trivy/trivy-secret.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/trivy/trivy-sts.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/trivy/trivy-svc.yaml
 create mode 100644 packages/system/harbor/charts/harbor/templates/trivy/trivy-tls.yaml
 create mode 100644 packages/system/harbor/charts/harbor/values.yaml
 create mode 100644 packages/system/harbor/values.yaml

diff --git a/hack/e2e-apps/harbor.bats b/hack/e2e-apps/harbor.bats
new file mode 100644
index 00000000..8d1daecb
--- /dev/null
+++ b/hack/e2e-apps/harbor.bats
@@ -0,0 +1,48 @@
+#!/usr/bin/env bats
+
+@test "Create Harbor" {
+  name='harbor'
+  kubectl apply -f- <<EOF
+apiVersion: apps.cozystack.io/v1alpha1
+kind: Harbor
+metadata:
+  name: $name
+  namespace: tenant-test
+spec:
+  host: ""
+  storageClass: ""
+  core:
+    resources: {}
+    resourcesPreset: "nano"
+  registry:
+    size: 5Gi
+    resources: {}
+    resourcesPreset: "nano"
+  jobservice:
+    resources: {}
+    resourcesPreset: "nano"
+  trivy:
+    enabled: false
+    size: 2Gi
+    resources: {}
+    resourcesPreset: "nano"
+  database:
+    size: 2Gi
+    resources: {}
+    resourcesPreset: "nano"
+  redis:
+    size: 1Gi
+    resources: {}
+    resourcesPreset: "nano"
+EOF
+  sleep 5
+  kubectl -n tenant-test wait hr $name --timeout=60s --for=condition=ready
+  kubectl -n tenant-test wait hr $name-system --timeout=300s --for=condition=ready
+  kubectl -n tenant-test wait deploy $name-core --timeout=120s --for=condition=available
+  kubectl -n tenant-test wait deploy $name-registry --timeout=120s --for=condition=available
+  kubectl -n tenant-test wait deploy $name-portal --timeout=120s --for=condition=available
+  kubectl -n tenant-test get secret $name-credentials -o jsonpath='{.data.admin-password}' | base64 --decode | grep -q '.'
+  kubectl -n tenant-test get secret $name-credentials -o jsonpath='{.data.url}' | base64 --decode | grep -q 'https://'
+  kubectl -n tenant-test get svc $name -o jsonpath='{.spec.ports[0].port}' | grep -q '80'
+  kubectl -n tenant-test delete harbor.apps.cozystack.io $name
+}
diff --git a/packages/core/platform/sources/harbor-application.yaml b/packages/core/platform/sources/harbor-application.yaml
new file mode 100644
index 00000000..31aa70ee
--- /dev/null
+++ b/packages/core/platform/sources/harbor-application.yaml
@@ -0,0 +1,29 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.harbor-application
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+    path: /
+  variants:
+    - name: default
+      dependsOn:
+        - cozystack.networking
+      libraries:
+        - name: cozy-lib
+          path: library/cozy-lib
+      components:
+        - name: harbor-system
+          path: system/harbor
+        - name: harbor
+          path: extra/harbor
+          libraries: ["cozy-lib"]
+        - name: harbor-rd
+          path: system/harbor-rd
+          install:
+            namespace: cozy-system
+            releaseName: harbor-rd
diff --git a/packages/core/platform/templates/bundles/system.yaml b/packages/core/platform/templates/bundles/system.yaml
index c24726ef..33b882c6 100644
--- a/packages/core/platform/templates/bundles/system.yaml
+++ b/packages/core/platform/templates/bundles/system.yaml
@@ -126,6 +126,7 @@
 {{- $_ := set $tenantComponents "tenant" (dict "values" $tenantClusterValues) }}
 {{include "cozystack.platform.package" (list "cozystack.tenant-application" "default" $ $tenantComponents) }}
 {{include "cozystack.platform.package.default" (list "cozystack.ingress-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.harbor-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.seaweedfs-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.info-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.monitoring-application" $) }}
diff --git a/packages/extra/harbor/Chart.yaml b/packages/extra/harbor/Chart.yaml
new file mode 100644
index 00000000..8b6f59da
--- /dev/null
+++ b/packages/extra/harbor/Chart.yaml
@@ -0,0 +1,7 @@
+apiVersion: v2
+name: harbor
+description: Managed Harbor container registry
+icon: /logos/harbor.svg
+type: application
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
+appVersion: "2.14.2"
diff --git a/packages/extra/harbor/Makefile b/packages/extra/harbor/Makefile
new file mode 100644
index 00000000..f0ce9944
--- /dev/null
+++ b/packages/extra/harbor/Makefile
@@ -0,0 +1,7 @@
+NAME=harbor
+
+include ../../../hack/package.mk
+
+generate:
+	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	../../../hack/update-crd.sh
diff --git a/packages/extra/harbor/README.md b/packages/extra/harbor/README.md
new file mode 100644
index 00000000..62bf072e
--- /dev/null
+++ b/packages/extra/harbor/README.md
@@ -0,0 +1,54 @@
+# Managed Harbor Container Registry
+
+Harbor is an open source trusted cloud native registry project that stores, signs, and scans content.
+
+## Parameters
+
+### Common parameters
+
+| Name           | Description                                                                                  | Type     | Value |
+| -------------- | -------------------------------------------------------------------------------------------- | -------- | ----- |
+| `host`         | Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host). | `string` | `""`  |
+| `storageClass` | StorageClass used to store the data.                                                         | `string` | `""`  |
+
+
+### Component configuration
+
+| Name                          | Description                                                                                              | Type       | Value   |
+| ----------------------------- | -------------------------------------------------------------------------------------------------------- | ---------- | ------- |
+| `core`                        | Core API server configuration.                                                                           | `object`   | `{}`    |
+| `core.resources`              | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`   | `{}`    |
+| `core.resources.cpu`          | Number of CPU cores allocated.                                                                           | `quantity` | `""`    |
+| `core.resources.memory`       | Amount of memory allocated.                                                                              | `quantity` | `""`    |
+| `core.resourcesPreset`        | Default sizing preset used when `resources` is omitted.                                                  | `string`   | `small` |
+| `registry`                    | Container image registry configuration.                                                                  | `object`   | `{}`    |
+| `registry.size`               | Persistent Volume size for container image storage.                                                      | `quantity` | `50Gi`  |
+| `registry.resources`          | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`   | `{}`    |
+| `registry.resources.cpu`      | Number of CPU cores allocated.                                                                           | `quantity` | `""`    |
+| `registry.resources.memory`   | Amount of memory allocated.                                                                              | `quantity` | `""`    |
+| `registry.resourcesPreset`    | Default sizing preset used when `resources` is omitted.                                                  | `string`   | `small` |
+| `jobservice`                  | Background job service configuration.                                                                    | `object`   | `{}`    |
+| `jobservice.resources`        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`   | `{}`    |
+| `jobservice.resources.cpu`    | Number of CPU cores allocated.                                                                           | `quantity` | `""`    |
+| `jobservice.resources.memory` | Amount of memory allocated.                                                                              | `quantity` | `""`    |
+| `jobservice.resourcesPreset`  | Default sizing preset used when `resources` is omitted.                                                  | `string`   | `nano`  |
+| `trivy`                       | Trivy vulnerability scanner configuration.                                                               | `object`   | `{}`    |
+| `trivy.enabled`               | Enable or disable the vulnerability scanner.                                                             | `bool`     | `true`  |
+| `trivy.size`                  | Persistent Volume size for vulnerability database cache.                                                 | `quantity` | `5Gi`   |
+| `trivy.resources`             | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`   | `{}`    |
+| `trivy.resources.cpu`         | Number of CPU cores allocated.                                                                           | `quantity` | `""`    |
+| `trivy.resources.memory`      | Amount of memory allocated.                                                                              | `quantity` | `""`    |
+| `trivy.resourcesPreset`       | Default sizing preset used when `resources` is omitted.                                                  | `string`   | `nano`  |
+| `database`                    | Internal PostgreSQL database configuration.                                                              | `object`   | `{}`    |
+| `database.size`               | Persistent Volume size for database storage.                                                             | `quantity` | `5Gi`   |
+| `database.resources`          | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`   | `{}`    |
+| `database.resources.cpu`      | Number of CPU cores allocated.                                                                           | `quantity` | `""`    |
+| `database.resources.memory`   | Amount of memory allocated.                                                                              | `quantity` | `""`    |
+| `database.resourcesPreset`    | Default sizing preset used when `resources` is omitted.                                                  | `string`   | `nano`  |
+| `redis`                       | Internal Redis cache configuration.                                                                      | `object`   | `{}`    |
+| `redis.size`                  | Persistent Volume size for cache storage.                                                                | `quantity` | `1Gi`   |
+| `redis.resources`             | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`   | `{}`    |
+| `redis.resources.cpu`         | Number of CPU cores allocated.                                                                           | `quantity` | `""`    |
+| `redis.resources.memory`      | Amount of memory allocated.                                                                              | `quantity` | `""`    |
+| `redis.resourcesPreset`       | Default sizing preset used when `resources` is omitted.                                                  | `string`   | `nano`  |
+
diff --git a/packages/extra/harbor/charts/cozy-lib b/packages/extra/harbor/charts/cozy-lib
new file mode 120000
index 00000000..e1813509
--- /dev/null
+++ b/packages/extra/harbor/charts/cozy-lib
@@ -0,0 +1 @@
+../../../library/cozy-lib
\ No newline at end of file
diff --git a/packages/extra/harbor/logos/harbor.svg b/packages/extra/harbor/logos/harbor.svg
new file mode 100644
index 00000000..682254c3
--- /dev/null
+++ b/packages/extra/harbor/logos/harbor.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" role="img" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="1.05 -1.95 359.41 361.66"><defs><linearGradient id="linear-gradient" x1="264.79" x2="267.27" y1="952.39" y2="952.39" gradientTransform="matrix(30.43 0 0 -30.43 -7955.22 29285.75)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#60b932"/><stop offset=".28" stop-color="#60b932"/><stop offset="1" stop-color="#367c34"/></linearGradient><linearGradient id="linear-gradient-2" x1="263.77" x2="266.26" y1="955.65" y2="955.65" gradientTransform="matrix(27.21 0 0 -27.21 -7073.85 26169.41)" xlink:href="#linear-gradient"/><linearGradient id="linear-gradient-3" x1="263.28" x2="265.76" y1="953.74" y2="953.74" gradientTransform="matrix(25.75 0 0 -25.75 -6671.13 24812.23)" xlink:href="#linear-gradient"/><linearGradient id="linear-gradient-4" x1="263.77" x2="266.25" y1="953.2" y2="953.2" gradientTransform="matrix(27.1 0 0 -27.1 -7040.9 26102.49)" xlink:href="#linear-gradient"/><linearGradient id="linear-gradient-5" x1="262.73" x2="265.21" y1="954.34" y2="954.34" gradientTransform="matrix(24.4 0 0 -24.4 -6301.36 23521.97)" xlink:href="#linear-gradient"/><linearGradient id="linear-gradient-6" x1="272.14" x2="274.62" y1="955.15" y2="955.15" gradientTransform="scale(66.09 -66.09) rotate(36.52 1588.153 68.148)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#4596d8"/><stop offset=".2" stop-color="#4596d8"/><stop offset="1" stop-color="#fff"/></linearGradient><linearGradient id="linear-gradient-7" x1="270.65" x2="273.13" y1="952.38" y2="952.38" gradientTransform="scale(77.8 -77.8) rotate(-11.54 -4587.209 1803.323)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#4194d7"/><stop offset=".2" stop-color="#4194d7"/><stop offset="1" stop-color="#fff"/></linearGradient><linearGradient id="linear-gradient-8" x1="270.97" x2="273.45" y1="953.75" y2="953.75" gradientTransform="scale(71.35 -71.35) rotate(10.23 5477.37 -1024.602)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#4194d7"/><stop offset=".33" stop-color="#4496d8"/><stop offset="1" stop-color="#fff"/></linearGradient><clipPath id="clip-path"><path d="M174.4 302.52l-68.65-30.26-3.83 43.21 75.5 23.98-3.02-36.93z" class="cls-1"/></clipPath><clipPath id="clip-path-2"><path d="M119.19 135.38h38.55v32.89h-9.15v-14a10.13 10.13 0 1 0-20.26 0v14h-9.15zm-7.7 72l57.2 25.21-3.94-48.24h7.49v-16.08h-5.55v-32.89h5.55v-9.45l-30.86-30.19v-2.12a2.91 2.91 0 0 0-5.82 0v2.12l-30.86 30.19v9.45h5.56v32.89h-5.56v16.12h8.82z" class="cls-1"/></clipPath><clipPath id="clip-path-3"><path d="M108.14 245.28l63.88 28.16-.96-11.73-61.96-27.3-.96 10.87z" class="cls-1"/></clipPath><clipPath id="clip-path-4"><path d="M106.46 264.21l67.23 29.63-.96-11.72-65.31-28.78-.96 10.87z" class="cls-1"/></clipPath><clipPath id="clip-path-5"><path d="M110.77 215.48l-.96 10.87 60.54 26.68-.95-11.72-58.63-25.83z" class="cls-1"/></clipPath><clipPath id="clip-path-6"><path d="M313.13 67.59a175.31 175.31 0 0 0-29.75-28.13c-1.57-1.17-3.18-2.3-4.79-3.42L256 59.5l-82.34 85.63 113.41-58.68 29.07-15c-1.01-1.31-1.98-2.62-3.01-3.86z" class="cls-1"/></clipPath><clipPath id="clip-path-7"><path d="M353.59 177.61c0-2-.14-4-.22-5.93l-32.21-2.31-147.47-10.58L318.36 209l30.41 10.55c.09-.36.19-.71.28-1.08a173.65 173.65 0 0 0 4.57-39.47v-1.37z" class="cls-1"/></clipPath><clipPath id="clip-path-8"><path d="M348.84 138.61a172.55 172.55 0 0 0-13.84-37.7l-30.94 9.94L175.92 152l142-4.83 32.5-1.11c-.5-2.48-.99-4.98-1.58-7.45z" class="cls-1"/></clipPath><style>.cls-1{fill:none}.cls-13{fill:#696566}</style></defs><g id="g12"><path id="path14" fill="#fff" d="M30.89 179a148.87 148.87 0 1 1 148.87 148.85A148.87 148.87 0 0 1 30.89 179"/><g id="g30" clip-path="url(#clip-path)"><g id="g32"><path id="path46" fill="url(#linear-gradient)" d="M174.4 302.52l-68.65-30.25-3.82 43.2 75.5 24-3-36.93"/></g></g><g id="g48" clip-path="url(#clip-path-2)"><g id="g50"><path id="path64" fill="url(#linear-gradient-2)" d="M119.19 135.38h38.55v32.89h-9.15v-14a10.13 10.13 0 1 0-20.26 0v14h-9.15zm-7.7 72l57.2 25.21-3.94-48.24h7.49v-16.08h-5.55v-32.89h5.55v-9.45l-30.86-30.19v-2.12a2.91 2.91 0 0 0-5.82 0v2.12l-30.86 30.19v9.45h5.56v32.89h-5.56v16.12h8.82l-2 23"/></g></g><g id="g66" clip-path="url(#clip-path-3)"><g id="g68"><path id="path82" fill="url(#linear-gradient-3)" d="M108.13 245.28L172 273.44l-1-11.72-62-27.31-1 10.87"/></g></g><g id="g84" clip-path="url(#clip-path-4)"><g id="g86"><path id="path100" fill="url(#linear-gradient-4)" d="M106.46 264.21l67.23 29.63-1-11.72-65.31-28.78-1 10.87"/></g></g><g id="g102" clip-path="url(#clip-path-5)"><g id="g104"><path id="path118" fill="url(#linear-gradient-5)" d="M110.77 215.48l-1 10.88L170.35 253l-1-11.72-58.62-25.83"/></g></g><path id="path120" d="M304.07 110.85l30.93-9.94c-.11-.22-.21-.45-.32-.66a174.41 174.41 0 0 0-18.55-28.83l-29.07 15a142.71 142.71 0 0 1 16.73 23.87c.1.17.18.35.27.53" class="cls-13"/><path id="path122" d="M321.15 169.37l32.21 2.31a172.86 172.86 0 0 0-3-25.59l-32.5 1.11a141 141 0 0 1 3.25 22.17" class="cls-13"/><path id="path124" d="M182 320.81c-78.2 0-141.83-63.62-141.83-141.82S103.82 37.16 182 37.16a140.93 140.93 0 0 1 76.3 22.34L280.85 36A172.86 172.86 0 0 0 182 5.11C86.15 5.11 8.15 83.11 8.15 179s78 173.85 173.85 173.85c81.9 0 150.69-57 169-133.32L320.62 209c-13.8 63.84-70.69 111.83-138.6 111.83" class="cls-13"/><g id="g126" clip-path="url(#clip-path-6)"><g id="g128"><path id="path142" fill="url(#linear-gradient-6)" d="M313.13 67.59a175.31 175.31 0 0 0-29.75-28.13c-1.57-1.17-3.18-2.3-4.79-3.42L256 59.5l-82.34 85.63 113.41-58.68 29.07-15c-1-1.27-2-2.58-3-3.82"/></g></g><g id="g144" clip-path="url(#clip-path-7)"><g id="g146"><path id="path160" fill="url(#linear-gradient-7)" d="M353.59 177.61c0-2-.14-4-.22-5.93l-32.21-2.31-147.47-10.58L318.36 209l30.41 10.55c.09-.36.19-.71.28-1.08a173.65 173.65 0 0 0 4.57-39.47v-1.37"/></g></g><g id="g162" clip-path="url(#clip-path-8)"><g id="g164"><path id="path178" fill="url(#linear-gradient-8)" d="M348.84 138.61a172.55 172.55 0 0 0-13.84-37.7l-30.94 9.94L175.92 152l142-4.83 32.5-1.11c-.48-2.51-1-5-1.56-7.48"/></g></g></g></svg>
\ No newline at end of file
diff --git a/packages/extra/harbor/templates/dashboard-resourcemap.yaml b/packages/extra/harbor/templates/dashboard-resourcemap.yaml
new file mode 100644
index 00000000..f8d91a61
--- /dev/null
+++ b/packages/extra/harbor/templates/dashboard-resourcemap.yaml
@@ -0,0 +1,46 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  resourceNames:
+  - {{ .Release.Name }}
+  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  resourceNames:
+  - {{ .Release.Name }}-credentials
+  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses
+  resourceNames:
+  - {{ .Release.Name }}-ingress
+  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - cozystack.io
+  resources:
+  - workloadmonitors
+  resourceNames:
+  - {{ .Release.Name }}-core
+  - {{ .Release.Name }}-registry
+  - {{ .Release.Name }}-portal
+  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "super-admin" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
diff --git a/packages/extra/harbor/templates/harbor.yaml b/packages/extra/harbor/templates/harbor.yaml
new file mode 100644
index 00000000..23c06641
--- /dev/null
+++ b/packages/extra/harbor/templates/harbor.yaml
@@ -0,0 +1,153 @@
+{{- $ingress := .Values._namespace.ingress }}
+{{- $host := .Values._namespace.host }}
+{{- $harborHost := .Values.host | default (printf "harbor.%s" $host) }}
+
+{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace (printf "%s-credentials" .Release.Name) }}
+{{- $adminPassword := randAlphaNum 16 }}
+{{- if $existingSecret }}
+  {{- $adminPassword = index $existingSecret.data "admin-password" | b64dec }}
+{{- end }}
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-credentials
+stringData:
+  admin-password: {{ $adminPassword | quote }}
+  url: https://{{ $harborHost }}
+
+---
+
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: {{ .Release.Name }}-system
+  labels:
+    sharding.fluxcd.io/key: tenants
+spec:
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-harbor-application-default-harbor-system
+    namespace: cozy-system
+  interval: 5m
+  timeout: 15m
+  install:
+    remediation:
+      retries: -1
+  upgrade:
+    force: true
+    remediation:
+      retries: -1
+  valuesFrom:
+  - kind: Secret
+    name: cozystack-values
+  values:
+    harbor:
+      fullnameOverride: {{ .Release.Name }}
+      harborAdminPassword: {{ $adminPassword | quote }}
+      externalURL: https://{{ $harborHost }}
+      expose:
+        type: clusterIP
+        clusterIP:
+          name: {{ .Release.Name }}
+        tls:
+          enabled: false
+      persistence:
+        enabled: true
+        resourcePolicy: "keep"
+        persistentVolumeClaim:
+          registry:
+            size: {{ .Values.registry.size }}
+            {{- with .Values.storageClass }}
+            storageClass: {{ . }}
+            {{- end }}
+          database:
+            size: {{ .Values.database.size }}
+            {{- with .Values.storageClass }}
+            storageClass: {{ . }}
+            {{- end }}
+          redis:
+            size: {{ .Values.redis.size }}
+            {{- with .Values.storageClass }}
+            storageClass: {{ . }}
+            {{- end }}
+          {{- if .Values.trivy.enabled }}
+          trivy:
+            size: {{ .Values.trivy.size }}
+            {{- with .Values.storageClass }}
+            storageClass: {{ . }}
+            {{- end }}
+          {{- end }}
+      portal:
+        resources: {{- include "cozy-lib.resources.defaultingSanitize" (list "nano" (dict) $) | nindent 10 }}
+      core:
+        resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.core.resourcesPreset .Values.core.resources $) | nindent 10 }}
+      registry:
+        resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.registry.resourcesPreset .Values.registry.resources $) | nindent 10 }}
+      jobservice:
+        resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.jobservice.resourcesPreset .Values.jobservice.resources $) | nindent 10 }}
+      trivy:
+        enabled: {{ .Values.trivy.enabled }}
+        {{- if .Values.trivy.enabled }}
+        resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.trivy.resourcesPreset .Values.trivy.resources $) | nindent 10 }}
+        {{- end }}
+      database:
+        type: internal
+        internal:
+          resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.database.resourcesPreset .Values.database.resources $) | nindent 12 }}
+      redis:
+        type: internal
+        internal:
+          resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.redis.resourcesPreset .Values.redis.resources $) | nindent 12 }}
+      metrics:
+        enabled: true
+        serviceMonitor:
+          enabled: true
+
+---
+
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ $.Release.Name }}-core
+spec:
+  replicas: 1
+  minReplicas: 1
+  kind: harbor
+  type: core
+  selector:
+    release: {{ $.Release.Name }}-system
+    component: core
+  version: {{ $.Chart.Version }}
+
+---
+
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ $.Release.Name }}-registry
+spec:
+  replicas: 1
+  minReplicas: 1
+  kind: harbor
+  type: registry
+  selector:
+    release: {{ $.Release.Name }}-system
+    component: registry
+  version: {{ $.Chart.Version }}
+
+---
+
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ $.Release.Name }}-portal
+spec:
+  replicas: 1
+  minReplicas: 1
+  kind: harbor
+  type: portal
+  selector:
+    release: {{ $.Release.Name }}-system
+    component: portal
+  version: {{ $.Chart.Version }}
diff --git a/packages/extra/harbor/templates/ingress.yaml b/packages/extra/harbor/templates/ingress.yaml
new file mode 100644
index 00000000..785b4a79
--- /dev/null
+++ b/packages/extra/harbor/templates/ingress.yaml
@@ -0,0 +1,33 @@
+{{- $ingress := .Values._namespace.ingress }}
+{{- $host := .Values._namespace.host }}
+{{- $harborHost := .Values.host | default (printf "harbor.%s" $host) }}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Release.Name }}-ingress
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "900"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "900"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: {{ $ingress }}
+  tls:
+    - hosts:
+        - {{ $harborHost }}
+      secretName: {{ .Release.Name }}-ingress-tls
+  rules:
+    - host: {{ $harborHost }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ .Release.Name }}
+                port:
+                  number: 80
diff --git a/packages/extra/harbor/values.schema.json b/packages/extra/harbor/values.schema.json
new file mode 100644
index 00000000..a4632de7
--- /dev/null
+++ b/packages/extra/harbor/values.schema.json
@@ -0,0 +1,414 @@
+{
+  "title": "Chart Values",
+  "type": "object",
+  "properties": {
+    "core": {
+      "description": "Core API server configuration.",
+      "type": "object",
+      "default": {},
+      "properties": {
+        "resources": {
+          "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
+          "type": "object",
+          "default": {},
+          "properties": {
+            "cpu": {
+              "description": "Number of CPU cores allocated.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            },
+            "memory": {
+              "description": "Amount of memory allocated.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            }
+          }
+        },
+        "resourcesPreset": {
+          "description": "Default sizing preset used when `resources` is omitted.",
+          "type": "string",
+          "default": "small",
+          "enum": [
+            "nano",
+            "micro",
+            "small",
+            "medium",
+            "large",
+            "xlarge",
+            "2xlarge"
+          ]
+        }
+      }
+    },
+    "database": {
+      "description": "Internal PostgreSQL database configuration.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "size"
+      ],
+      "properties": {
+        "resources": {
+          "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
+          "type": "object",
+          "default": {},
+          "properties": {
+            "cpu": {
+              "description": "Number of CPU cores allocated.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            },
+            "memory": {
+              "description": "Amount of memory allocated.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            }
+          }
+        },
+        "resourcesPreset": {
+          "description": "Default sizing preset used when `resources` is omitted.",
+          "type": "string",
+          "default": "nano",
+          "enum": [
+            "nano",
+            "micro",
+            "small",
+            "medium",
+            "large",
+            "xlarge",
+            "2xlarge"
+          ]
+        },
+        "size": {
+          "description": "Persistent Volume size for database storage.",
+          "default": "5Gi",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        }
+      }
+    },
+    "host": {
+      "description": "Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).",
+      "type": "string",
+      "default": ""
+    },
+    "jobservice": {
+      "description": "Background job service configuration.",
+      "type": "object",
+      "default": {},
+      "properties": {
+        "resources": {
+          "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
+          "type": "object",
+          "default": {},
+          "properties": {
+            "cpu": {
+              "description": "Number of CPU cores allocated.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            },
+            "memory": {
+              "description": "Amount of memory allocated.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            }
+          }
+        },
+        "resourcesPreset": {
+          "description": "Default sizing preset used when `resources` is omitted.",
+          "type": "string",
+          "default": "nano",
+          "enum": [
+            "nano",
+            "micro",
+            "small",
+            "medium",
+            "large",
+            "xlarge",
+            "2xlarge"
+          ]
+        }
+      }
+    },
+    "redis": {
+      "description": "Internal Redis cache configuration.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "size"
+      ],
+      "properties": {
+        "resources": {
+          "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
+          "type": "object",
+          "default": {},
+          "properties": {
+            "cpu": {
+              "description": "Number of CPU cores allocated.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            },
+            "memory": {
+              "description": "Amount of memory allocated.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            }
+          }
+        },
+        "resourcesPreset": {
+          "description": "Default sizing preset used when `resources` is omitted.",
+          "type": "string",
+          "default": "nano",
+          "enum": [
+            "nano",
+            "micro",
+            "small",
+            "medium",
+            "large",
+            "xlarge",
+            "2xlarge"
+          ]
+        },
+        "size": {
+          "description": "Persistent Volume size for cache storage.",
+          "default": "1Gi",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        }
+      }
+    },
+    "registry": {
+      "description": "Container image registry configuration.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "size"
+      ],
+      "properties": {
+        "resources": {
+          "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
+          "type": "object",
+          "default": {},
+          "properties": {
+            "cpu": {
+              "description": "Number of CPU cores allocated.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            },
+            "memory": {
+              "description": "Amount of memory allocated.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            }
+          }
+        },
+        "resourcesPreset": {
+          "description": "Default sizing preset used when `resources` is omitted.",
+          "type": "string",
+          "default": "small",
+          "enum": [
+            "nano",
+            "micro",
+            "small",
+            "medium",
+            "large",
+            "xlarge",
+            "2xlarge"
+          ]
+        },
+        "size": {
+          "description": "Persistent Volume size for container image storage.",
+          "default": "50Gi",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        }
+      }
+    },
+    "storageClass": {
+      "description": "StorageClass used to store the data.",
+      "type": "string",
+      "default": ""
+    },
+    "trivy": {
+      "description": "Trivy vulnerability scanner configuration.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "enabled",
+        "size"
+      ],
+      "properties": {
+        "enabled": {
+          "description": "Enable or disable the vulnerability scanner.",
+          "type": "boolean",
+          "default": true
+        },
+        "resources": {
+          "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
+          "type": "object",
+          "default": {},
+          "properties": {
+            "cpu": {
+              "description": "Number of CPU cores allocated.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            },
+            "memory": {
+              "description": "Amount of memory allocated.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            }
+          }
+        },
+        "resourcesPreset": {
+          "description": "Default sizing preset used when `resources` is omitted.",
+          "type": "string",
+          "default": "nano",
+          "enum": [
+            "nano",
+            "micro",
+            "small",
+            "medium",
+            "large",
+            "xlarge",
+            "2xlarge"
+          ]
+        },
+        "size": {
+          "description": "Persistent Volume size for vulnerability database cache.",
+          "default": "5Gi",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        }
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/extra/harbor/values.yaml b/packages/extra/harbor/values.yaml
new file mode 100644
index 00000000..50d2ff5f
--- /dev/null
+++ b/packages/extra/harbor/values.yaml
@@ -0,0 +1,90 @@
+##
+## @section Common parameters
+##
+
+## @param {string} [host] - Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).
+host: ""
+
+## @param {string} storageClass - StorageClass used to store the data.
+storageClass: ""
+
+##
+## @section Component configuration
+##
+
+## @typedef {struct} Resources - Resource configuration.
+## @field {quantity} [cpu] - Number of CPU cores allocated.
+## @field {quantity} [memory] - Amount of memory allocated.
+
+## @enum {string} ResourcesPreset - Default sizing preset.
+## @value nano
+## @value micro
+## @value small
+## @value medium
+## @value large
+## @value xlarge
+## @value 2xlarge
+
+## @typedef {struct} Core - Core API server configuration.
+## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted.
+
+## @param {Core} core - Core API server configuration.
+core:
+  resources: {}
+  resourcesPreset: "small"
+
+## @typedef {struct} Registry - Container image registry configuration.
+## @field {quantity} size - Persistent Volume size for container image storage.
+## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted.
+
+## @param {Registry} registry - Container image registry configuration.
+registry:
+  size: 50Gi
+  resources: {}
+  resourcesPreset: "small"
+
+## @typedef {struct} Jobservice - Background job service configuration.
+## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted.
+
+## @param {Jobservice} jobservice - Background job service configuration.
+jobservice:
+  resources: {}
+  resourcesPreset: "nano"
+
+## @typedef {struct} Trivy - Trivy vulnerability scanner configuration.
+## @field {bool} enabled - Enable or disable the vulnerability scanner.
+## @field {quantity} size - Persistent Volume size for vulnerability database cache.
+## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted.
+
+## @param {Trivy} trivy - Trivy vulnerability scanner configuration.
+trivy:
+  enabled: true
+  size: 5Gi
+  resources: {}
+  resourcesPreset: "nano"
+
+## @typedef {struct} Database - Internal PostgreSQL database configuration.
+## @field {quantity} size - Persistent Volume size for database storage.
+## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted.
+
+## @param {Database} database - Internal PostgreSQL database configuration.
+database:
+  size: 5Gi
+  resources: {}
+  resourcesPreset: "nano"
+
+## @typedef {struct} Redis - Internal Redis cache configuration.
+## @field {quantity} size - Persistent Volume size for cache storage.
+## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted.
+
+## @param {Redis} redis - Internal Redis cache configuration.
+redis:
+  size: 1Gi
+  resources: {}
+  resourcesPreset: "nano"
diff --git a/packages/system/harbor-rd/Chart.yaml b/packages/system/harbor-rd/Chart.yaml
new file mode 100644
index 00000000..c27f19d0
--- /dev/null
+++ b/packages/system/harbor-rd/Chart.yaml
@@ -0,0 +1,3 @@
+apiVersion: v2
+name: harbor-rd
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
diff --git a/packages/system/harbor-rd/Makefile b/packages/system/harbor-rd/Makefile
new file mode 100644
index 00000000..ed36644a
--- /dev/null
+++ b/packages/system/harbor-rd/Makefile
@@ -0,0 +1,4 @@
+export NAME=harbor-rd
+export NAMESPACE=cozy-system
+
+include ../../../hack/package.mk
diff --git a/packages/system/harbor-rd/cozyrds/harbor.yaml b/packages/system/harbor-rd/cozyrds/harbor.yaml
new file mode 100644
index 00000000..da8cfb62
--- /dev/null
+++ b/packages/system/harbor-rd/cozyrds/harbor.yaml
@@ -0,0 +1,47 @@
+apiVersion: cozystack.io/v1alpha1
+kind: ApplicationDefinition
+metadata:
+  name: harbor
+spec:
+  application:
+    kind: Harbor
+    singular: harbor
+    plural: harbors
+    openAPISchema: |-
+      {"title":"Chart Values","type":"object","properties":{"core":{"description":"Core API server configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"database":{"description":"Internal PostgreSQL database configuration.","type":"object","default":{},"required":["size"],"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for database storage.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"host":{"description":"Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).","type":"string","default":""},"jobservice":{"description":"Background job service configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"redis":{"description":"Internal Redis cache configuration.","type":"object","default":{},"required":["size"],"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for cache storage.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"registry":{"description":"Container image registry configuration.","type":"object","default":{},"required":["size"],"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for container image storage.","default":"50Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"trivy":{"description":"Trivy vulnerability scanner configuration.","type":"object","default":{},"required":["enabled","size"],"properties":{"enabled":{"description":"Enable or disable the vulnerability scanner.","type":"boolean","default":true},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for vulnerability database cache.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}
+  release:
+    prefix: ""
+    labels:
+      sharding.fluxcd.io/key: tenants
+      internal.cozystack.io/tenantmodule: "true"
+    chartRef:
+      kind: ExternalArtifact
+      name: cozystack-harbor-application-default-harbor
+      namespace: cozy-system
+  dashboard:
+    category: PaaS
+    singular: Harbor
+    plural: Harbor
+    name: harbor
+    description: Managed Harbor container registry
+    module: true
+    tags:
+      - registry
+      - container
+    icon: "PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHJvbGU9ImltZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHZpZXdCb3g9IjEuMDUgLTEuOTUgMzU5LjQxIDM2MS42NiI+PGRlZnM+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQiIHgxPSIyNjQuNzkiIHgyPSIyNjcuMjciIHkxPSI5NTIuMzkiIHkyPSI5NTIuMzkiIGdyYWRpZW50VHJhbnNmb3JtPSJtYXRyaXgoMzAuNDMgMCAwIC0zMC40MyAtNzk1NS4yMiAyOTI4NS43NSkiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBvZmZzZXQ9IjAiIHN0b3AtY29sb3I9IiM2MGI5MzIiLz48c3RvcCBvZmZzZXQ9Ii4yOCIgc3RvcC1jb2xvcj0iIzYwYjkzMiIvPjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iIzM2N2MzNCIvPjwvbGluZWFyR3JhZGllbnQ+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQtMiIgeDE9IjI2My43NyIgeDI9IjI2Ni4yNiIgeTE9Ijk1NS42NSIgeTI9Ijk1NS42NSIgZ3JhZGllbnRUcmFuc2Zvcm09Im1hdHJpeCgyNy4yMSAwIDAgLTI3LjIxIC03MDczLjg1IDI2MTY5LjQxKSIgeGxpbms6aHJlZj0iI2xpbmVhci1ncmFkaWVudCIvPjxsaW5lYXJHcmFkaWVudCBpZD0ibGluZWFyLWdyYWRpZW50LTMiIHgxPSIyNjMuMjgiIHgyPSIyNjUuNzYiIHkxPSI5NTMuNzQiIHkyPSI5NTMuNzQiIGdyYWRpZW50VHJhbnNmb3JtPSJtYXRyaXgoMjUuNzUgMCAwIC0yNS43NSAtNjY3MS4xMyAyNDgxMi4yMykiIHhsaW5rOmhyZWY9IiNsaW5lYXItZ3JhZGllbnQiLz48bGluZWFyR3JhZGllbnQgaWQ9ImxpbmVhci1ncmFkaWVudC00IiB4MT0iMjYzLjc3IiB4Mj0iMjY2LjI1IiB5MT0iOTUzLjIiIHkyPSI5NTMuMiIgZ3JhZGllbnRUcmFuc2Zvcm09Im1hdHJpeCgyNy4xIDAgMCAtMjcuMSAtNzA0MC45IDI2MTAyLjQ5KSIgeGxpbms6aHJlZj0iI2xpbmVhci1ncmFkaWVudCIvPjxsaW5lYXJHcmFkaWVudCBpZD0ibGluZWFyLWdyYWRpZW50LTUiIHgxPSIyNjIuNzMiIHgyPSIyNjUuMjEiIHkxPSI5NTQuMzQiIHkyPSI5NTQuMzQiIGdyYWRpZW50VHJhbnNmb3JtPSJtYXRyaXgoMjQuNCAwIDAgLTI0LjQgLTYzMDEuMzYgMjM1MjEuOTcpIiB4bGluazpocmVmPSIjbGluZWFyLWdyYWRpZW50Ii8+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQtNiIgeDE9IjI3Mi4xNCIgeDI9IjI3NC42MiIgeTE9Ijk1NS4xNSIgeTI9Ijk1NS4xNSIgZ3JhZGllbnRUcmFuc2Zvcm09InNjYWxlKDY2LjA5IC02Ni4wOSkgcm90YXRlKDM2LjUyIDE1ODguMTUzIDY4LjE0OCkiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBvZmZzZXQ9IjAiIHN0b3AtY29sb3I9IiM0NTk2ZDgiLz48c3RvcCBvZmZzZXQ9Ii4yIiBzdG9wLWNvbG9yPSIjNDU5NmQ4Ii8+PHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjZmZmIi8+PC9saW5lYXJHcmFkaWVudD48bGluZWFyR3JhZGllbnQgaWQ9ImxpbmVhci1ncmFkaWVudC03IiB4MT0iMjcwLjY1IiB4Mj0iMjczLjEzIiB5MT0iOTUyLjM4IiB5Mj0iOTUyLjM4IiBncmFkaWVudFRyYW5zZm9ybT0ic2NhbGUoNzcuOCAtNzcuOCkgcm90YXRlKC0xMS41NCAtNDU4Ny4yMDkgMTgwMy4zMjMpIiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+PHN0b3Agb2Zmc2V0PSIwIiBzdG9wLWNvbG9yPSIjNDE5NGQ3Ii8+PHN0b3Agb2Zmc2V0PSIuMiIgc3RvcC1jb2xvcj0iIzQxOTRkNyIvPjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iI2ZmZiIvPjwvbGluZWFyR3JhZGllbnQ+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQtOCIgeDE9IjI3MC45NyIgeDI9IjI3My40NSIgeTE9Ijk1My43NSIgeTI9Ijk1My43NSIgZ3JhZGllbnRUcmFuc2Zvcm09InNjYWxlKDcxLjM1IC03MS4zNSkgcm90YXRlKDEwLjIzIDU0NzcuMzcgLTEwMjQuNjAyKSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPjxzdG9wIG9mZnNldD0iMCIgc3RvcC1jb2xvcj0iIzQxOTRkNyIvPjxzdG9wIG9mZnNldD0iLjMzIiBzdG9wLWNvbG9yPSIjNDQ5NmQ4Ii8+PHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjZmZmIi8+PC9saW5lYXJHcmFkaWVudD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aCI+PHBhdGggZD0iTTE3NC40IDMwMi41MmwtNjguNjUtMzAuMjYtMy44MyA0My4yMSA3NS41IDIzLjk4LTMuMDItMzYuOTN6IiBjbGFzcz0iY2xzLTEiLz48L2NsaXBQYXRoPjxjbGlwUGF0aCBpZD0iY2xpcC1wYXRoLTIiPjxwYXRoIGQ9Ik0xMTkuMTkgMTM1LjM4aDM4LjU1djMyLjg5aC05LjE1di0xNGExMC4xMyAxMC4xMyAwIDEgMC0yMC4yNiAwdjE0aC05LjE1em0tNy43IDcybDU3LjIgMjUuMjEtMy45NC00OC4yNGg3LjQ5di0xNi4wOGgtNS41NXYtMzIuODloNS41NXYtOS40NWwtMzAuODYtMzAuMTl2LTIuMTJhMi45MSAyLjkxIDAgMCAwLTUuODIgMHYyLjEybC0zMC44NiAzMC4xOXY5LjQ1aDUuNTZ2MzIuODloLTUuNTZ2MTYuMTJoOC44MnoiIGNsYXNzPSJjbHMtMSIvPjwvY2xpcFBhdGg+PGNsaXBQYXRoIGlkPSJjbGlwLXBhdGgtMyI+PHBhdGggZD0iTTEwOC4xNCAyNDUuMjhsNjMuODggMjguMTYtLjk2LTExLjczLTYxLjk2LTI3LjMtLjk2IDEwLjg3eiIgY2xhc3M9ImNscy0xIi8+PC9jbGlwUGF0aD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aC00Ij48cGF0aCBkPSJNMTA2LjQ2IDI2NC4yMWw2Ny4yMyAyOS42My0uOTYtMTEuNzItNjUuMzEtMjguNzgtLjk2IDEwLjg3eiIgY2xhc3M9ImNscy0xIi8+PC9jbGlwUGF0aD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aC01Ij48cGF0aCBkPSJNMTEwLjc3IDIxNS40OGwtLjk2IDEwLjg3IDYwLjU0IDI2LjY4LS45NS0xMS43Mi01OC42My0yNS44M3oiIGNsYXNzPSJjbHMtMSIvPjwvY2xpcFBhdGg+PGNsaXBQYXRoIGlkPSJjbGlwLXBhdGgtNiI+PHBhdGggZD0iTTMxMy4xMyA2Ny41OWExNzUuMzEgMTc1LjMxIDAgMCAwLTI5Ljc1LTI4LjEzYy0xLjU3LTEuMTctMy4xOC0yLjMtNC43OS0zLjQyTDI1NiA1OS41bC04Mi4zNCA4NS42MyAxMTMuNDEtNTguNjggMjkuMDctMTVjLTEuMDEtMS4zMS0xLjk4LTIuNjItMy4wMS0zLjg2eiIgY2xhc3M9ImNscy0xIi8+PC9jbGlwUGF0aD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aC03Ij48cGF0aCBkPSJNMzUzLjU5IDE3Ny42MWMwLTItLjE0LTQtLjIyLTUuOTNsLTMyLjIxLTIuMzEtMTQ3LjQ3LTEwLjU4TDMxOC4zNiAyMDlsMzAuNDEgMTAuNTVjLjA5LS4zNi4xOS0uNzEuMjgtMS4wOGExNzMuNjUgMTczLjY1IDAgMCAwIDQuNTctMzkuNDd2LTEuMzd6IiBjbGFzcz0iY2xzLTEiLz48L2NsaXBQYXRoPjxjbGlwUGF0aCBpZD0iY2xpcC1wYXRoLTgiPjxwYXRoIGQ9Ik0zNDguODQgMTM4LjYxYTE3Mi41NSAxNzIuNTUgMCAwIDAtMTMuODQtMzcuN2wtMzAuOTQgOS45NEwxNzUuOTIgMTUybDE0Mi00LjgzIDMyLjUtMS4xMWMtLjUtMi40OC0uOTktNC45OC0xLjU4LTcuNDV6IiBjbGFzcz0iY2xzLTEiLz48L2NsaXBQYXRoPjxzdHlsZT4uY2xzLTF7ZmlsbDpub25lfS5jbHMtMTN7ZmlsbDojNjk2NTY2fTwvc3R5bGU+PC9kZWZzPjxnIGlkPSJnMTIiPjxwYXRoIGlkPSJwYXRoMTQiIGZpbGw9IiNmZmYiIGQ9Ik0zMC44OSAxNzlhMTQ4Ljg3IDE0OC44NyAwIDEgMSAxNDguODcgMTQ4Ljg1QTE0OC44NyAxNDguODcgMCAwIDEgMzAuODkgMTc5Ii8+PGcgaWQ9ImczMCIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aCkiPjxnIGlkPSJnMzIiPjxwYXRoIGlkPSJwYXRoNDYiIGZpbGw9InVybCgjbGluZWFyLWdyYWRpZW50KSIgZD0iTTE3NC40IDMwMi41MmwtNjguNjUtMzAuMjUtMy44MiA0My4yIDc1LjUgMjQtMy0zNi45MyIvPjwvZz48L2c+PGcgaWQ9Imc0OCIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aC0yKSI+PGcgaWQ9Imc1MCI+PHBhdGggaWQ9InBhdGg2NCIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtMikiIGQ9Ik0xMTkuMTkgMTM1LjM4aDM4LjU1djMyLjg5aC05LjE1di0xNGExMC4xMyAxMC4xMyAwIDEgMC0yMC4yNiAwdjE0aC05LjE1em0tNy43IDcybDU3LjIgMjUuMjEtMy45NC00OC4yNGg3LjQ5di0xNi4wOGgtNS41NXYtMzIuODloNS41NXYtOS40NWwtMzAuODYtMzAuMTl2LTIuMTJhMi45MSAyLjkxIDAgMCAwLTUuODIgMHYyLjEybC0zMC44NiAzMC4xOXY5LjQ1aDUuNTZ2MzIuODloLTUuNTZ2MTYuMTJoOC44MmwtMiAyMyIvPjwvZz48L2c+PGcgaWQ9Imc2NiIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aC0zKSI+PGcgaWQ9Imc2OCI+PHBhdGggaWQ9InBhdGg4MiIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtMykiIGQ9Ik0xMDguMTMgMjQ1LjI4TDE3MiAyNzMuNDRsLTEtMTEuNzItNjItMjcuMzEtMSAxMC44NyIvPjwvZz48L2c+PGcgaWQ9Imc4NCIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aC00KSI+PGcgaWQ9Imc4NiI+PHBhdGggaWQ9InBhdGgxMDAiIGZpbGw9InVybCgjbGluZWFyLWdyYWRpZW50LTQpIiBkPSJNMTA2LjQ2IDI2NC4yMWw2Ny4yMyAyOS42My0xLTExLjcyLTY1LjMxLTI4Ljc4LTEgMTAuODciLz48L2c+PC9nPjxnIGlkPSJnMTAyIiBjbGlwLXBhdGg9InVybCgjY2xpcC1wYXRoLTUpIj48ZyBpZD0iZzEwNCI+PHBhdGggaWQ9InBhdGgxMTgiIGZpbGw9InVybCgjbGluZWFyLWdyYWRpZW50LTUpIiBkPSJNMTEwLjc3IDIxNS40OGwtMSAxMC44OEwxNzAuMzUgMjUzbC0xLTExLjcyLTU4LjYyLTI1LjgzIi8+PC9nPjwvZz48cGF0aCBpZD0icGF0aDEyMCIgZD0iTTMwNC4wNyAxMTAuODVsMzAuOTMtOS45NGMtLjExLS4yMi0uMjEtLjQ1LS4zMi0uNjZhMTc0LjQxIDE3NC40MSAwIDAgMC0xOC41NS0yOC44M2wtMjkuMDcgMTVhMTQyLjcxIDE0Mi43MSAwIDAgMSAxNi43MyAyMy44N2MuMS4xNy4xOC4zNS4yNy41MyIgY2xhc3M9ImNscy0xMyIvPjxwYXRoIGlkPSJwYXRoMTIyIiBkPSJNMzIxLjE1IDE2OS4zN2wzMi4yMSAyLjMxYTE3Mi44NiAxNzIuODYgMCAwIDAtMy0yNS41OWwtMzIuNSAxLjExYTE0MSAxNDEgMCAwIDEgMy4yNSAyMi4xNyIgY2xhc3M9ImNscy0xMyIvPjxwYXRoIGlkPSJwYXRoMTI0IiBkPSJNMTgyIDMyMC44MWMtNzguMiAwLTE0MS44My02My42Mi0xNDEuODMtMTQxLjgyUzEwMy44MiAzNy4xNiAxODIgMzcuMTZhMTQwLjkzIDE0MC45MyAwIDAgMSA3Ni4zIDIyLjM0TDI4MC44NSAzNkExNzIuODYgMTcyLjg2IDAgMCAwIDE4MiA1LjExQzg2LjE1IDUuMTEgOC4xNSA4My4xMSA4LjE1IDE3OXM3OCAxNzMuODUgMTczLjg1IDE3My44NWM4MS45IDAgMTUwLjY5LTU3IDE2OS0xMzMuMzJMMzIwLjYyIDIwOWMtMTMuOCA2My44NC03MC42OSAxMTEuODMtMTM4LjYgMTExLjgzIiBjbGFzcz0iY2xzLTEzIi8+PGcgaWQ9ImcxMjYiIGNsaXAtcGF0aD0idXJsKCNjbGlwLXBhdGgtNikiPjxnIGlkPSJnMTI4Ij48cGF0aCBpZD0icGF0aDE0MiIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtNikiIGQ9Ik0zMTMuMTMgNjcuNTlhMTc1LjMxIDE3NS4zMSAwIDAgMC0yOS43NS0yOC4xM2MtMS41Ny0xLjE3LTMuMTgtMi4zLTQuNzktMy40MkwyNTYgNTkuNWwtODIuMzQgODUuNjMgMTEzLjQxLTU4LjY4IDI5LjA3LTE1Yy0xLTEuMjctMi0yLjU4LTMtMy44MiIvPjwvZz48L2c+PGcgaWQ9ImcxNDQiIGNsaXAtcGF0aD0idXJsKCNjbGlwLXBhdGgtNykiPjxnIGlkPSJnMTQ2Ij48cGF0aCBpZD0icGF0aDE2MCIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtNykiIGQ9Ik0zNTMuNTkgMTc3LjYxYzAtMi0uMTQtNC0uMjItNS45M2wtMzIuMjEtMi4zMS0xNDcuNDctMTAuNThMMzE4LjM2IDIwOWwzMC40MSAxMC41NWMuMDktLjM2LjE5LS43MS4yOC0xLjA4YTE3My42NSAxNzMuNjUgMCAwIDAgNC41Ny0zOS40N3YtMS4zNyIvPjwvZz48L2c+PGcgaWQ9ImcxNjIiIGNsaXAtcGF0aD0idXJsKCNjbGlwLXBhdGgtOCkiPjxnIGlkPSJnMTY0Ij48cGF0aCBpZD0icGF0aDE3OCIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtOCkiIGQ9Ik0zNDguODQgMTM4LjYxYTE3Mi41NSAxNzIuNTUgMCAwIDAtMTMuODQtMzcuN2wtMzAuOTQgOS45NEwxNzUuOTIgMTUybDE0Mi00LjgzIDMyLjUtMS4xMWMtLjQ4LTIuNTEtMS01LTEuNTYtNy40OCIvPjwvZz48L2c+PC9nPjwvc3ZnPg=="
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "host"], ["spec", "storageClass"], ["spec", "core"], ["spec", "core", "resources"], ["spec", "core", "resourcesPreset"], ["spec", "registry"], ["spec", "registry", "size"], ["spec", "registry", "resources"], ["spec", "registry", "resourcesPreset"], ["spec", "jobservice"], ["spec", "jobservice", "resources"], ["spec", "jobservice", "resourcesPreset"], ["spec", "trivy"], ["spec", "trivy", "enabled"], ["spec", "trivy", "size"], ["spec", "trivy", "resources"], ["spec", "trivy", "resourcesPreset"], ["spec", "database"], ["spec", "database", "size"], ["spec", "database", "resources"], ["spec", "database", "resourcesPreset"], ["spec", "redis"], ["spec", "redis", "size"], ["spec", "redis", "resources"], ["spec", "redis", "resourcesPreset"]]
+  secrets:
+    exclude: []
+    include:
+      - resourceNames:
+          - {{ .name }}-credentials
+  services:
+    exclude: []
+    include:
+      - resourceNames:
+          - {{ .name }}
+  ingresses:
+    exclude: []
+    include:
+      - resourceNames:
+          - {{ .name }}-ingress
diff --git a/packages/system/harbor-rd/templates/cozyrd.yaml b/packages/system/harbor-rd/templates/cozyrd.yaml
new file mode 100644
index 00000000..e079ddcf
--- /dev/null
+++ b/packages/system/harbor-rd/templates/cozyrd.yaml
@@ -0,0 +1,4 @@
+{{- range $path, $_ := .Files.Glob "cozyrds/*" }}
+---
+{{ $.Files.Get $path }}
+{{- end }}
diff --git a/packages/system/harbor-rd/values.yaml b/packages/system/harbor-rd/values.yaml
new file mode 100644
index 00000000..0967ef42
--- /dev/null
+++ b/packages/system/harbor-rd/values.yaml
@@ -0,0 +1 @@
+{}
diff --git a/packages/system/harbor/Chart.yaml b/packages/system/harbor/Chart.yaml
new file mode 100644
index 00000000..5e7007b1
--- /dev/null
+++ b/packages/system/harbor/Chart.yaml
@@ -0,0 +1,3 @@
+apiVersion: v2
+name: cozy-harbor
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
diff --git a/packages/system/harbor/Makefile b/packages/system/harbor/Makefile
new file mode 100644
index 00000000..5cae60ed
--- /dev/null
+++ b/packages/system/harbor/Makefile
@@ -0,0 +1,10 @@
+export NAME=harbor-system
+export NAMESPACE=cozy-system
+
+include ../../../hack/package.mk
+
+update:
+	rm -rf charts
+	helm repo add harbor https://helm.goharbor.io
+	helm repo update harbor
+	helm pull harbor/harbor --untar --untardir charts
diff --git a/packages/system/harbor/charts/harbor/.helmignore b/packages/system/harbor/charts/harbor/.helmignore
new file mode 100644
index 00000000..b4424fd5
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/.helmignore
@@ -0,0 +1,6 @@
+.github/*
+docs/*
+.git/*
+.gitignore
+CONTRIBUTING.md
+test/*
\ No newline at end of file
diff --git a/packages/system/harbor/charts/harbor/Chart.yaml b/packages/system/harbor/charts/harbor/Chart.yaml
new file mode 100644
index 00000000..e30a1b58
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/Chart.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+appVersion: 2.14.2
+description: An open source trusted cloud native registry that stores, signs, and
+  scans content
+home: https://goharbor.io
+icon: https://raw.githubusercontent.com/goharbor/website/main/static/img/logos/harbor-icon-color.png
+keywords:
+- docker
+- registry
+- harbor
+maintainers:
+- email: yan-yw.wang@broadcom.com
+  name: Yan Wang
+- email: stone.zhang@broadcom.com
+  name: Stone Zhang
+- email: miner.yang@broadcom.com
+  name: Miner Yang
+name: harbor
+sources:
+- https://github.com/goharbor/harbor
+- https://github.com/goharbor/harbor-helm
+version: 1.18.2
diff --git a/packages/system/harbor/charts/harbor/LICENSE b/packages/system/harbor/charts/harbor/LICENSE
new file mode 100644
index 00000000..261eeb9e
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/packages/system/harbor/charts/harbor/README.md b/packages/system/harbor/charts/harbor/README.md
new file mode 100644
index 00000000..658150d6
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/README.md
@@ -0,0 +1,775 @@
+# Helm Chart for Harbor
+
+**Notes:** The master branch is in heavy development, please use the other stable versions instead. A highly available solution for Harbor based on chart can be found [here](docs/High%20Availability.md). And refer to the [guide](docs/Upgrade.md) to upgrade the existing deployment.
+
+This repository, including the issues, focuses on deploying Harbor chart via helm. For functionality issues or Harbor questions, please open issues on [goharbor/harbor](https://github.com/goharbor/harbor)
+
+## Introduction
+
+This [Helm](https://github.com/kubernetes/helm) chart installs [Harbor](https://github.com/goharbor/harbor) in a Kubernetes cluster. Welcome to [contribute](CONTRIBUTING.md) to Helm Chart for Harbor.
+
+## Prerequisites
+
+- Kubernetes cluster 1.20+
+- Helm v3.2.0+
+
+## Installation
+
+### Add Helm repository
+
+```bash
+helm repo add harbor https://helm.goharbor.io
+```
+
+### Configure the chart
+
+The following items can be set via `--set` flag during installation or configured by editing the `values.yaml` directly (need to download the chart first).
+
+#### Configure how to expose Harbor service
+
+- **Ingress**: The ingress controller must be installed in the Kubernetes cluster.
+  **Notes:** if TLS is disabled, the port must be included in the command when pulling/pushing images. Refer to issue [#5291](https://github.com/goharbor/harbor/issues/5291) for details.
+- **ClusterIP**: Exposes the service on a cluster-internal IP. Choosing this value makes the service only reachable from within the cluster.
+- **NodePort**: Exposes the service on each Node’s IP at a static port (the NodePort). You’ll be able to contact the NodePort service, from outside the cluster, by requesting `NodeIP:NodePort`.
+- **LoadBalancer**: Exposes the service externally using a cloud provider’s load balancer.
+- **Gateway APIs**: Exposes the service using gateway-api CRDs using HTTPRoute. Requires v1.0.0+
+
+#### Configure the external URL
+
+The external URL for Harbor core service is used to:
+
+1. populate the docker/helm commands showed on portal
+2. populate the token service URL returned to docker client
+
+Format: `protocol://domain[:port]`. Usually:
+
+- if service exposed via `Ingress`, the `domain` should be the value of `expose.ingress.hosts.core`
+- if service exposed via `ClusterIP`, the `domain` should be the value of `expose.clusterIP.name`
+- if service exposed via `NodePort`, the `domain` should be the IP address of one Kubernetes node
+- if service exposed via `LoadBalancer`, set the `domain` as your own domain name and add a CNAME record to map the domain name to the one you got from the cloud provider
+
+If Harbor is deployed behind the proxy, set it as the URL of proxy.
+
+#### Configure how to persist data
+
+- **Disable**: The data does not survive the termination of a pod.
+- **Persistent Volume Claim(default)**: A default `StorageClass` is needed in the Kubernetes cluster to dynamically provision the volumes. Specify another StorageClass in the `storageClass` or set `existingClaim` if you already have existing persistent volumes to use.
+- **External Storage(only for images and charts)**: For images and charts, the external storages are supported: `azure`, `gcs`, `s3` `swift` and `oss`.
+
+#### Configure the other items listed in [configuration](#configuration) section
+
+### Install the chart
+
+Install the Harbor helm chart with a release name `my-release`:
+
+```bash
+helm install my-release harbor/harbor
+```
+
+## Uninstallation
+
+To uninstall/delete the `my-release` deployment:
+
+```bash
+helm uninstall my-release
+```
+
+## Configuration
+
+The following table lists the configurable parameters of the Harbor chart and the default values.
+
+
+| Parameter                                                            | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | Default                              |
+|----------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------|
+| **Expose**                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `expose.type`                                                        | How to expose the service: `ingress`, `clusterIP`, `nodePort`, `loadBalancer` or `route`  other values will be ignored and the creation of service will be skipped.                                                                                                                                                                                                                                                                                                                                                                                                | `ingress`                            |
+| `expose.tls.enabled`                                                 | Enable TLS or not. Delete the `ssl-redirect` annotations in `expose.ingress.annotations` when TLS is disabled and `expose.type` is `ingress`. Note: if the `expose.type` is `ingress` and TLS is disabled, the port must be included in the command when pulling/pushing images. Refer to https://github.com/goharbor/harbor/issues/5291 for details.                                                                                                                                                                                                              | `true`                               |
+| `expose.tls.certSource`                                              | The source of the TLS certificate. Set as `auto`, `secret` or `none` and fill the information in the corresponding section: 1) auto: generate the TLS certificate automatically 2) secret: read the TLS certificate from the specified secret. The TLS certificate can be generated manually or by cert manager 3) none: configure no TLS certificate for the ingress. If the default TLS certificate is configured in the ingress controller, choose this option                                                                                                  | `auto`                               |
+| `expose.tls.auto.commonName`                                         | The common name used to generate the certificate, it's necessary when the type isn't `ingress`                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                      |
+| `expose.tls.secret.secretName`                                       | The name of secret which contains keys named: `tls.crt` - the certificate; `tls.key` - the private key                                                                                                                                                                                                                                                                                                                                                                                                                                                             |                                      |
+| `expose.ingress.hosts.core`                                          | The host of Harbor core service in ingress rule                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `core.harbor.domain`                 |
+| `expose.ingress.controller`                                          | The ingress controller type. Currently supports `default`, `gce`, `alb`, `f5-bigip` and `ncp`                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `default`                            |
+| `expose.ingress.kubeVersionOverride`                                 | Allows the ability to override the kubernetes version used while templating the ingress                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                      |
+| `expose.ingress.className`                                           | Specify the `ingressClassName` used to implement the Ingress (Kubernetes 1.18+)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `expose.ingress.annotations`                                         | The annotations used commonly for ingresses                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |                                      |
+| `expose.ingress.labels`                                              | The labels specific to ingress                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | {}                                   |
+| `expose.clusterIP.name`                                              | The name of ClusterIP service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `harbor`                             |
+| `expose.clusterIP.annotations`                                       | The annotations attached to the ClusterIP service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | {}                                   |
+| `expose.clusterIP.ports.httpPort`                                    | The service port Harbor listens on when serving HTTP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `80`                                 |
+| `expose.clusterIP.ports.httpsPort`                                   | The service port Harbor listens on when serving HTTPS                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `443`                                |
+| `expose.clusterIP.annotations`                                       | The annotations used commonly for clusterIP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |                                      |
+| `expose.clusterIP.labels`                                            | The labels specific to clusterIP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | {}                                   |
+| `expose.nodePort.name`                                               | The name of NodePort service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `harbor`                             |
+| `expose.nodePort.ports.http.port`                                    | The service port Harbor listens on when serving HTTP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `80`                                 |
+| `expose.nodePort.ports.http.nodePort`                                | The node port Harbor listens on when serving HTTP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `30002`                              |
+| `expose.nodePort.ports.https.port`                                   | The service port Harbor listens on when serving HTTPS                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `443`                                |
+| `expose.nodePort.ports.https.nodePort`                               | The node port Harbor listens on when serving HTTPS                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `30003`                              |
+| `expose.nodePort.annotations`                                        | The annotations used commonly for nodePort                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |                                      |
+| `expose.nodePort.labels`                                             | The labels specific to nodePort                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | {}                                   |
+| `expose.loadBalancer.name`                                           | The name of service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `harbor`                             |
+| `expose.loadBalancer.IP`                                             | The IP of the loadBalancer. It only works when loadBalancer supports assigning IP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `""`                                 |
+| `expose.loadBalancer.ports.httpPort`                                 | The service port Harbor listens on when serving HTTP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `80`                                 |
+| `expose.loadBalancer.ports.httpsPort`                                | The service port Harbor listens on when serving HTTPS                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `30002`                              |
+| `expose.loadBalancer.annotations`                                    | The annotations attached to the loadBalancer service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | {}                                   |
+| `expose.loadBalancer.labels`                                         | The labels specific to loadBalancer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | {}                                   |
+| `expose.loadBalancer.sourceRanges`                                   | List of IP address ranges to assign to loadBalancerSourceRanges                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | []                                   |
+| `expose.route.labels`                                                | The labels to attach to the HTTPRoute                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `{}`                                 |
+| `expose.route.annotations`                                           | The annotations to attach to the HTTPRoute                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `{}`                                 |
+| `expose.route.hosts`                                                 | The hosts that the HTTPRoute will request to the Gateway                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `[]`                                 |
+| `expose.route.parentRefs`                                            | The Gateways to attach to the HTTPRoute                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `{}`                                 |
+| **Internal TLS**                                                     |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `internalTLS.enabled`                                                | Enable TLS for the components (core, jobservice, portal, registry, trivy)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `false`                              |
+| `internalTLS.strong_ssl_ciphers`                                     | Enable strong ssl ciphers for nginx and portal                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `false`                              |
+| `internalTLS.certSource`                                             | Method to provide TLS for the components, options are `auto`, `manual`, `secret`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `auto`                               |
+| `internalTLS.trustCa`                                                | The content of trust CA, only available when `certSource` is `manual`. **Note**: all the internal certificates of the components must be issued by this CA                                                                                                                                                                                                                                                                                                                                                                                                         |                                      |
+| `internalTLS.core.secretName`                                        | The secret name for core component, only available when `certSource` is `secret`. The secret must contain keys named: `ca.crt` - the CA certificate which is used to issue internal key and crt pair for components and all Harbor components must be issued by the same CA, `tls.crt` - the content of the TLS cert file, `tls.key` - the content of the TLS key file.                                                                                                                                                                                            |                                      |
+| `internalTLS.core.crt`                                               | Content of core's TLS cert file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                                      |
+| `internalTLS.core.key`                                               | Content of core's TLS key file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                      |
+| `internalTLS.jobservice.secretName`                                  | The secret name for jobservice component, only available when `certSource` is `secret`. The secret must contain keys named: `ca.crt` - the CA certificate which is used to issue internal key and crt pair for components and all Harbor components must be issued by the same CA, `tls.crt` - the content of the TLS cert file, `tls.key` - the content of the TLS key file.                                                                                                                                                                                      |                                      |
+| `internalTLS.jobservice.crt`                                         | Content of jobservice's TLS cert file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                      |
+| `internalTLS.jobservice.key`                                         | Content of jobservice's TLS key file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |                                      |
+| `internalTLS.registry.secretName`                                    | The secret name for registry component, only available when `certSource` is `secret`. The secret must contain keys named: `ca.crt` - the CA certificate which is used to issue internal key and crt pair for components and all Harbor components must be issued by the same CA, `tls.crt` - the content of the TLS cert file, `tls.key` - the content of the TLS key file.                                                                                                                                                                                        |                                      |
+| `internalTLS.registry.crt`                                           | Content of registry's TLS cert file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                                      |
+| `internalTLS.registry.key`                                           | Content of registry's TLS key file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |                                      |
+| `internalTLS.portal.secretName`                                      | The secret name for portal component, only available when `certSource` is `secret`. The secret must contain keys named: `ca.crt` - the CA certificate which is used to issue internal key and crt pair for components and all Harbor components must be issued by the same CA, `tls.crt` - the content of the TLS cert file, `tls.key` - the content of the TLS key file.                                                                                                                                                                                          |                                      |
+| `internalTLS.portal.crt`                                             | Content of portal's TLS cert file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `internalTLS.portal.key`                                             | Content of portal's TLS key file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                      |
+| `internalTLS.trivy.secretName`                                       | The secret name for trivy component, only available when `certSource` is `secret`. The secret must contain keys named: `ca.crt` - the CA certificate which is used to issue internal key and crt pair for components and all Harbor components must be issued by the same CA, `tls.crt` - the content of the TLS cert file, `tls.key` - the content of the TLS key file.                                                                                                                                                                                           |                                      |
+| `internalTLS.trivy.crt`                                              | Content of trivy's TLS cert file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                      |
+| `internalTLS.trivy.key`                                              | Content of trivy's TLS key file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                                      |
+| **IPFamily**                                                         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `ipFamily.ipv4.enabled`                                              | if cluster is ipv4 enabled, all ipv4 related configs will set correspondingly, but currently it only affects the nginx related components                                                                                                                                                                                                                                                                                                                                                                                                                          | `true`                               |
+| `ipFamily.ipv6.enabled`                                              | if cluster is ipv6 enabled, all ipv6 related configs will set correspondingly, but currently it only affects the nginx related components                                                                                                                                                                                                                                                                                                                                                                                                                          | `true`                               |
+| `ipFamily.policy`                                                    | Sets the IP family policy for services to be able to configure dual-stack; see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services).                                                                                                                                                                                                                                                                                                                                                                               | `""`                                 |
+| `ipFamily.families`                                                  | A list of IP families for services that should be supported, in the order in which they should be applied. Can be "IPv4" and/or "IPv6".                                                                                                                                                                                                                                                                                                                                                                                                                            | []                                   |
+| **Persistence**                                                      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `persistence.enabled`                                                | Enable the data persistence or not                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `true`                               |
+| `persistence.resourcePolicy`                                         | Setting it to `keep` to avoid removing PVCs during a helm delete operation. Leaving it empty will delete PVCs after the chart deleted. Does not affect PVCs created for internal database and redis components.                                                                                                                                                                                                                                                                                                                                                    | `keep`                               |
+| `persistence.persistentVolumeClaim.registry.existingClaim`           | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components                                                                                                                                                                                                                                                                                                                                                                                                                             |                                      |
+| `persistence.persistentVolumeClaim.registry.storageClass`            | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used (the default). Set it to `-` to disable dynamic provisioning                                                                                                                                                                                                                                                                                                                                                                                                     |                                      |
+| `persistence.persistentVolumeClaim.registry.subPath`                 | The sub path used in the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `persistence.persistentVolumeClaim.registry.accessMode`              | The access mode of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `ReadWriteOnce`                      |
+| `persistence.persistentVolumeClaim.registry.size`                    | The size of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `5Gi`                                |
+| `persistence.persistentVolumeClaim.registry.annotations`             | The annotations of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                                      |
+| `persistence.persistentVolumeClaim.jobservice.jobLog.existingClaim`  | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components.                                                                                                                                                                                                                                                                                                                                                                                                                            |                                      |
+| `persistence.persistentVolumeClaim.jobservice.jobLog.storageClass`   | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used (the default). Set it to `-` to disable dynamic provisioning                                                                                                                                                                                                                                                                                                                                                                                                     |                                      |
+| `persistence.persistentVolumeClaim.jobservice.jobLog.subPath`        | The sub path used in the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `persistence.persistentVolumeClaim.jobservice.jobLog.accessMode`     | The access mode of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `ReadWriteOnce`                      |
+| `persistence.persistentVolumeClaim.jobservice.jobLog.size`           | The size of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `1Gi`                                |
+| `persistence.persistentVolumeClaim.jobservice.jobLog.annotations`    | The annotations of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                                      |
+| `persistence.persistentVolumeClaim.database.existingClaim`           | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components. If external database is used, the setting will be ignored                                                                                                                                                                                                                                                                                                                                                                  |                                      |
+| `persistence.persistentVolumeClaim.database.storageClass`            | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used (the default). Set it to `-` to disable dynamic provisioning. If external database is used, the setting will be ignored                                                                                                                                                                                                                                                                                                                                          |                                      |
+| `persistence.persistentVolumeClaim.database.subPath`                 | The sub path used in the volume. If external database is used, the setting will be ignored                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |                                      |
+| `persistence.persistentVolumeClaim.database.accessMode`              | The access mode of the volume. If external database is used, the setting will be ignored                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `ReadWriteOnce`                      |
+| `persistence.persistentVolumeClaim.database.size`                    | The size of the volume. If external database is used, the setting will be ignored                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `1Gi`                                |
+| `persistence.persistentVolumeClaim.database.annotations`             | The annotations of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                                      |
+| `persistence.persistentVolumeClaim.redis.existingClaim`              | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components. If external Redis is used, the setting will be ignored                                                                                                                                                                                                                                                                                                                                                                     |                                      |
+| `persistence.persistentVolumeClaim.redis.storageClass`               | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used (the default). Set it to `-` to disable dynamic provisioning. If external Redis is used, the setting will be ignored                                                                                                                                                                                                                                                                                                                                             |                                      |
+| `persistence.persistentVolumeClaim.redis.subPath`                    | The sub path used in the volume. If external Redis is used, the setting will be ignored                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                      |
+| `persistence.persistentVolumeClaim.redis.accessMode`                 | The access mode of the volume. If external Redis is used, the setting will be ignored                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `ReadWriteOnce`                      |
+| `persistence.persistentVolumeClaim.redis.size`                       | The size of the volume. If external Redis is used, the setting will be ignored                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `1Gi`                                |
+| `persistence.persistentVolumeClaim.redis.annotations`                | The annotations of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                                      |
+| `persistence.persistentVolumeClaim.trivy.existingClaim`              | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components                                                                                                                                                                                                                                                                                                                                                                                                                             |                                      |
+| `persistence.persistentVolumeClaim.trivy.storageClass`               | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used (the default). Set it to `-` to disable dynamic provisioning                                                                                                                                                                                                                                                                                                                                                                                                     |                                      |
+| `persistence.persistentVolumeClaim.trivy.subPath`                    | The sub path used in the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `persistence.persistentVolumeClaim.trivy.accessMode`                 | The access mode of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `ReadWriteOnce`                      |
+| `persistence.persistentVolumeClaim.trivy.size`                       | The size of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `1Gi`                                |
+| `persistence.persistentVolumeClaim.trivy.annotations`                | The annotations of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                                      |
+| `persistence.imageChartStorage.disableredirect`                      | The configuration for managing redirects from content backends. For backends which not supported it (such as using minio for `s3` storage type), please set it to `true` to disable redirects. Refer to the [guide](https://github.com/docker/distribution/blob/master/docs/configuration.md#redirect) for more details                                                                                                                                                                                                                                            | `false`                              |
+| `persistence.imageChartStorage.caBundleSecretName`                   | Specify the `caBundleSecretName` if the storage service uses a self-signed certificate. The secret must contain keys named `ca.crt` which will be injected into the trust store of registry's and containers.                                                                                                                                                                                                                                                                                                                                                      |                                      |
+| `persistence.imageChartStorage.type`                                 | The type of storage for images and charts: `filesystem`, `azure`, `gcs`, `s3`, `swift` or `oss`. The type must be `filesystem` if you want to use persistent volumes for registry. Refer to the [guide](https://github.com/docker/distribution/blob/master/docs/configuration.md#storage) for more details                                                                                                                                                                                                                                                         | `filesystem`                         |
+| `persistence.imageChartStorage.gcs.existingSecret`                   | An existing secret containing the gcs service account json key. The key must be gcs-key.json.                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `""`                                 |
+| `persistence.imageChartStorage.gcs.useWorkloadIdentity`              | A boolean to allow the use of workloadidentity in a GKE cluster. To use it, create a kubernetes service account and set the name in the key `serviceAccountName` of each component, then allow automounting the service account.                                                                                                                                                                                                                                                                                                                                   | `false`                              |
+| **General**                                                          |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `externalURL`                                                        | The external URL for Harbor core service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `https://core.harbor.domain`         |
+| `caBundleSecretName`                                                 | The custom CA bundle secret name, the secret must contain key named "ca.crt" which will be injected into the trust store for core, jobservice, registry, trivy components.                                                                                                                                                                                                                                                                                                                                                                                         |                                      |
+| `uaaSecretName`                                                      | If using external UAA auth which has a self signed cert, you can provide a pre-created secret containing it under the key `ca.crt`.                                                                                                                                                                                                                                                                                                                                                                                                                                |                                      |
+| `imagePullPolicy`                                                    | The image pull policy                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |                                      |
+| `imagePullSecrets`                                                   | The imagePullSecrets names for all deployments                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                      |
+| `updateStrategy.type`                                                | The update strategy for deployments with persistent volumes(jobservice, registry): `RollingUpdate` or `Recreate`. Set it as `Recreate` when `RWM` for volumes isn't supported                                                                                                                                                                                                                                                                                                                                                                                      | `RollingUpdate`                      |
+| `logLevel`                                                           | The log level: `debug`, `info`, `warning`, `error` or `fatal`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `info`                               |
+| `harborAdminPassword`                                                | The initial password of Harbor admin. Change it from portal after launching Harbor                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `Harbor12345`                        |
+| `existingSecretAdminPassword`                                        | The name of secret where admin password can be found.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |                                      |
+| `existingSecretAdminPasswordKey`                                     | The name of the key in the secret where to find harbor admin password Harbor                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `HARBOR_ADMIN_PASSWORD`              |
+| `caSecretName`                                                       | The name of the secret which contains key named `ca.crt`. Setting this enables the download link on portal to download the CA certificate when the certificate isn't generated automatically                                                                                                                                                                                                                                                                                                                                                                       |                                      |
+| `secretKey`                                                          | The key used for encryption. Must be a string of 16 chars                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `not-a-secure-key`                   |
+| `existingSecretSecretKey`                                            | An existing secret containing the encoding secretKey                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `""`                                 |
+| `proxy.httpProxy`                                                    | The URL of the HTTP proxy server                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |                                      |
+| `proxy.httpsProxy`                                                   | The URL of the HTTPS proxy server                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                                      |
+| `proxy.noProxy`                                                      | The URLs that the proxy settings not apply to                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | 127.0.0.1,localhost,.local,.internal |
+| `proxy.components`                                                   | The component list that the proxy settings apply to                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | core, jobservice, trivy              |
+| `enableMigrateHelmHook`                                              | Run the migration job via helm hook, if it is true, the database migration will be separated from harbor-core, run with a preupgrade job migration-job                                                                                                                                                                                                                                                                                                                                                                                                             | `false`                              |
+| **Nginx** (if service exposed via `ingress`, Nginx will not be used) |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `nginx.image.repository`                                             | Image repository                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `goharbor/nginx-photon`              |
+| `nginx.image.tag`                                                    | Image tag                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `dev`                                |
+| `nginx.replicas`                                                     | The replica count                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `1`                                  |
+| `nginx.revisionHistoryLimit`                                         | The revision history limit                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `10`                                 |
+| `nginx.resources`                                                    | The [resources] to allocate for container                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | undefined                            |
+| `nginx.automountServiceAccountToken`                                 | Mount serviceAccountToken?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `false`                              |
+| `nginx.nodeSelector`                                                 | Node labels for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `{}`                                 |
+| `nginx.tolerations`                                                  | Tolerations for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `[]`                                 |
+| `nginx.affinity`                                                     | Node/Pod affinities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `{}`                                 |
+| `nginx.topologySpreadConstraints`                                    | Constraints that define how Pods are spread across failure-domains like regions or availability zones                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `[]`                                 |
+| `nginx.podAnnotations`                                               | Annotations to add to the nginx pod                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `{}`                                 |
+| `nginx.priorityClassName`                                            | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                                      |
+| **Portal**                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `portal.image.repository`                                            | Repository for portal image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `goharbor/harbor-portal`             |
+| `portal.image.tag`                                                   | Tag for portal image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `dev`                                |
+| `portal.replicas`                                                    | The replica count                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `1`                                  |
+| `portal.revisionHistoryLimit`                                        | The revision history limit                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `10`                                 |
+| `portal.resources`                                                   | The [resources] to allocate for container                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | undefined                            |
+| `portal.automountServiceAccountToken`                                | Mount serviceAccountToken?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `false`                              |
+| `portal.nodeSelector`                                                | Node labels for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `{}`                                 |
+| `portal.tolerations`                                                 | Tolerations for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `[]`                                 |
+| `portal.affinity`                                                    | Node/Pod affinities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `{}`                                 |
+| `portal.topologySpreadConstraints`                                   | Constraints that define how Pods are spread across failure-domains like regions or availability zones                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `[]`                                 |
+| `portal.podAnnotations`                                              | Annotations to add to the portal pod                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `{}`                                 |
+| `portal.serviceAnnotations`                                          | Annotations to add to the portal service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `{}`                                 |
+| `portal.priorityClassName`                                           | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                                      |
+| `portal.initContainers`                                              | Init containers to be run before the controller's container starts.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `[]`                                 |
+| **Core**                                                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `core.image.repository`                                              | Repository for Harbor core image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `goharbor/harbor-core`               |
+| `core.image.tag`                                                     | Tag for Harbor core image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `dev`                                |
+| `core.replicas`                                                      | The replica count                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `1`                                  |
+| `core.revisionHistoryLimit`                                          | The revision history limit                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `10`                                 |
+| `core.startupProbe.initialDelaySeconds`                              | The initial delay in seconds for the startup probe                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `10`                                 |
+| `core.resources`                                                     | The [resources] to allocate for container                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | undefined                            |
+| `core.automountServiceAccountToken`                                  | Mount serviceAccountToken?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `false`                              |
+| `core.nodeSelector`                                                  | Node labels for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `{}`                                 |
+| `core.tolerations`                                                   | Tolerations for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `[]`                                 |
+| `core.affinity`                                                      | Node/Pod affinities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `{}`                                 |
+| `core.topologySpreadConstraints`                                     | Constraints that define how Pods are spread across failure-domains like regions or availability zones                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `[]`                                 |
+| `core.podAnnotations`                                                | Annotations to add to the core pod                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `{}`                                 |
+| `core.serviceAnnotations`                                            | Annotations to add to the core service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `{}`                                 |
+| `core.configureUserSettings`                                         | A JSON string to set in the environment variable `CONFIG_OVERWRITE_JSON` to configure user settings. See the [official docs](https://goharbor.io/docs/latest/install-config/configure-user-settings-cli/#configure-users-settings-using-an-environment-variable).                                                                                                                                                                                                                                                                                                  |                                      |
+| `core.quotaUpdateProvider`                                           | The provider for updating project quota(usage), there are 2 options, redis or db. By default it is implemented by db but you can configure it to redis which can improve the performance of high concurrent pushing to the same project, and reduce the database connections spike and occupies. Using redis will bring up some delay for quota usage updation for display, so only suggest switch provider to redis if you were ran into the db connections spike around the scenario of high concurrent pushing to same project, no improvment for other scenes. | `db`                                 |
+| `core.secret`                                                        | Secret is used when core server communicates with other components. If a secret key is not specified, Helm will generate one. Must be a string of 16 chars.                                                                                                                                                                                                                                                                                                                                                                                                        |                                      |
+| `core.secretName`                                                    | Fill the name of a kubernetes secret if you want to use your own TLS certificate and private key for token encryption/decryption. The secret must contain keys named: `tls.crt` - the certificate and `tls.key` - the private key. The default key pair will be used if it isn't set                                                                                                                                                                                                                                                                               |                                      |
+| `core.tokenKey`                                                      | PEM-formatted RSA private key used to sign service tokens.  Only used if `core.secretName` is unset. If set, `core.tokenCert` MUST also be set.                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `core.tokenCert`                                                     | PEM-formatted certificate signed by `core.tokenKey` used to validate service tokens.  Only used if `core.secretName` is unset. If set, `core.tokenKey` MUST also be set.                                                                                                                                                                                                                                                                                                                                                                                           |                                      |
+| `core.xsrfKey`                                                       | The XSRF key. Will be generated automatically if it isn't specified                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                      |
+| `core.priorityClassName`                                             | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                                      |
+| `core.artifactPullAsyncFlushDuration`                                | The time duration for async update artifact pull_time and repository pull_count                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `core.gdpr.deleteUser`                                               | Enable GDPR compliant user delete                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `false`                              |
+| `core.gdpr.auditLogsCompliant`                                       | Enable GDPR compliant for audit logs by changing username to its CRC32 value if that user was deleted from the system                                                                                                                                                                                                                                                                                                                                                                                                                                              | `false`                              |
+| `core.initContainers`                                                | Init containers to be run before the controller's container starts.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `[]`                                 |
+| **Jobservice**                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `jobservice.image.repository`                                        | Repository for jobservice image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `goharbor/harbor-jobservice`         |
+| `jobservice.image.tag`                                               | Tag for jobservice image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `dev`                                |
+| `jobservice.replicas`                                                | The replica count                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `1`                                  |
+| `jobservice.revisionHistoryLimit`                                    | The revision history limit                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `10`                                 |
+| `jobservice.maxJobWorkers`                                           | The max job workers                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `10`                                 |
+| `jobservice.jobLoggers`                                              | The loggers for jobs: `file`, `database` or `stdout`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `[file]`                             |
+| `jobservice.loggerSweeperDuration`                                   | The jobLogger sweeper duration in days (ignored if `jobLoggers` is set to `stdout`)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `14`                                 |
+| `jobservice.notification.webhook_job_max_retry`                      | The maximum retry of webhook sending notifications                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `3`                                  |
+| `jobservice.notification.webhook_job_http_client_timeout`            | The http client timeout value of webhook sending notifications                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `3`                                  |
+| `jobservice.reaper.max_update_hours`                                 | the max time to wait for a task to finish, if unfinished after max_update_hours, the task will be mark as error, but the task will continue to run, default value is 24                                                                                                                                                                                                                                                                                                                                                                                            | `24`                                 |
+| `jobservice.reaper.max_dangling_hours`                               | the max time for execution in running state without new task created                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `168`                                |
+| `jobservice.resources`                                               | The [resources] to allocate for container                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | undefined                            |
+| `jobservice.automountServiceAccountToken`                            | Mount serviceAccountToken?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `false`                              |
+| `jobservice.nodeSelector`                                            | Node labels for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `{}`                                 |
+| `jobservice.tolerations`                                             | Tolerations for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `[]`                                 |
+| `jobservice.affinity`                                                | Node/Pod affinities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `{}`                                 |
+| `jobservice.topologySpreadConstraints`                               | Constraints that define how Pods are spread across failure-domains like regions or availability zones                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `[]`                                 |
+| `jobservice.podAnnotations`                                          | Annotations to add to the jobservice pod                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `{}`                                 |
+| `jobservice.priorityClassName`                                       | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                                      |
+| `jobservice.secret`                                                  | Secret is used when job service communicates with other components. If a secret key is not specified, Helm will generate one. Must be a string of 16 chars.                                                                                                                                                                                                                                                                                                                                                                                                        |                                      |
+| `jobservice.initContainers`                                          | Init containers to be run before the controller's container starts.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `[]`                                 |
+| **Registry**                                                         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `registry.registry.image.repository`                                 | Repository for registry image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `goharbor/registry-photon`           |
+| `registry.registry.image.tag`                                        | Tag for registry image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `dev`                                |
+| `registry.registry.resources`                                        | The [resources] to allocate for container                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | undefined                            |
+| `registry.controller.image.repository`                               | Repository for registry controller image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `goharbor/harbor-registryctl`        |
+| `registry.controller.image.tag`                                      | Tag for registry controller image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `dev`                                |
+| `registry.controller.resources`                                      | The [resources] to allocate for container                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | undefined                            |
+| `registry.replicas`                                                  | The replica count                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `1`                                  |
+| `registry.revisionHistoryLimit`                                      | The revision history limit                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `10`                                 |
+| `registry.nodeSelector`                                              | Node labels for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `{}`                                 |
+| `registry.automountServiceAccountToken`                              | Mount serviceAccountToken?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `false`                              |
+| `registry.tolerations`                                               | Tolerations for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `[]`                                 |
+| `registry.affinity`                                                  | Node/Pod affinities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `{}`                                 |
+| `registry.topologySpreadConstraints`                                 | Constraints that define how Pods are spread across failure-domains like regions or availability zones                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `[]`                                 |
+| `registry.middleware`                                                | Middleware is used to add support for a CDN between backend storage and `docker pull` recipient. See [official docs](https://github.com/docker/distribution/blob/master/docs/configuration.md#middleware).                                                                                                                                                                                                                                                                                                                                                         |                                      |
+| `registry.podAnnotations`                                            | Annotations to add to the registry pod                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `{}`                                 |
+| `registry.priorityClassName`                                         | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                                      |
+| `registry.secret`                                                    | Secret is used to secure the upload state from client and registry storage backend. See [official docs](https://github.com/docker/distribution/blob/master/docs/configuration.md#http). If a secret key is not specified, Helm will generate one. Must be a string of 16 chars.                                                                                                                                                                                                                                                                                    |                                      |
+| `registry.credentials.username`                                      | The username that harbor core uses internally to access the registry instance.  Together with the `registry.credentials.password`, a htpasswd  is created. This is an alternative to providing `registry.credentials.htpasswdString`. For more details see [official docs](https://github.com/docker/distribution/blob/master/docs/configuration.md#htpasswd).                                                                                                                                                                                                     | `harbor_registry_user`               |
+| `registry.credentials.password`                                      | The password that harbor core uses internally to access the registry instance. Together with the `registry.credentials.username`, a htpasswd  is created. This is an alternative to providing `registry.credentials.htpasswdString`. For more details see [official docs](https://github.com/docker/distribution/blob/master/docs/configuration.md#htpasswd). It is suggested you update this value before installation.                                                                                                                                           | `harbor_registry_password`           |
+| `registry.credentials.existingSecret`                                | An existing secret containing the password for accessing the registry instance, which is hosted by htpasswd auth mode. More details see [official docs](https://github.com/docker/distribution/blob/master/docs/configuration.md#htpasswd). The key must be `REGISTRY_PASSWD`                                                                                                                                                                                                                                                                                      | `""`                                 |
+| `registry.credentials.htpasswdString`                                | Login and password in htpasswd string format. Excludes `registry.credentials.username`  and `registry.credentials.password`. May come in handy when integrating with tools like argocd or flux. This allows the same line to be generated each time the template is rendered, instead of the `htpasswd` function from helm, which generates different lines each time because of the salt.                                                                                                                                                                         | undefined                            |
+| `registry.relativeurls`                                              | If true, the registry returns relative URLs in Location headers. The client is responsible for resolving the correct URL. Needed if harbor is behind a reverse proxy                                                                                                                                                                                                                                                                                                                                                                                               | `false`                              |
+| `registry.upload_purging.enabled`                                    | If true, enable purge _upload directories                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `true`                               |
+| `registry.upload_purging.age`                                        | Remove files in _upload directories which exist for a period of time, default is one week.                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `168h`                               |
+| `registry.upload_purging.interval`                                   | The interval of the purge operations                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `24h`                                |
+| `registry.upload_purging.dryrun`                                     | If true, enable dryrun for purging _upload, default false                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `false`                              |
+| `registry.initContainers`                                            | Init containers to be run before the controller's container starts.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `[]`                                 |
+| **[Trivy][trivy]**                                                   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `trivy.enabled`                                                      | The flag to enable Trivy scanner                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `true`                               |
+| `trivy.image.repository`                                             | Repository for Trivy adapter image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `goharbor/trivy-adapter-photon`      |
+| `trivy.image.tag`                                                    | Tag for Trivy adapter image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `dev`                                |
+| `trivy.resources`                                                    | The [resources] to allocate for Trivy adapter container                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                      |
+| `trivy.automountServiceAccountToken`                                 | Mount serviceAccountToken?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `false`                              |
+| `trivy.replicas`                                                     | The number of Pod replicas                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `1`                                  |
+| `trivy.debugMode`                                                    | The flag to enable Trivy debug mode                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `false`                              |
+| `trivy.vulnType`                                                     | Comma-separated list of vulnerability types. Possible values `os` and `library`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `os,library`                         |
+| `trivy.severity`                                                     | Comma-separated list of severities to be checked                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL`   |
+| `trivy.ignoreUnfixed`                                                | The flag to display only fixed vulnerabilities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `false`                              |
+| `trivy.insecure`                                                     | The flag to skip verifying registry certificate                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `false`                              |
+| `trivy.skipUpdate`                                                   | The flag to disable [Trivy DB][trivy-db] downloads from GitHub                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `false`                              |
+| `trivy.skipJavaDBUpdate`                                             | If the flag is enabled you have to manually download the `trivy-java.db` file [Trivy Java DB][trivy-java-db] and mount it in the `/home/scanner/.cache/trivy/java-db/trivy-java.db` path                                                                                                                                                                                                                                                                                                                                                                           | `false`                              |
+| `trivy.offlineScan`                                                  | The flag prevents Trivy from sending API requests to identify dependencies.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `false`                              |
+| `trivy.securityCheck`                                                | Comma-separated list of what security issues to detect.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `vuln`                               |
+| `trivy.timeout`                                                      | The duration to wait for scan completion                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `5m0s`                               |
+| `trivy.gitHubToken`                                                  | The GitHub access token to download [Trivy DB][trivy-db] (see [GitHub rate limiting][trivy-rate-limiting])                                                                                                                                                                                                                                                                                                                                                                                                                                                         |                                      |
+| `trivy.priorityClassName`                                            | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                                      |
+| `trivy.topologySpreadConstraints`                                    | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                                      |
+| `trivy.initContainers`                                               | Init containers to be run before the controller's container starts.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `[]`                                 |
+| **Database**                                                         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `database.type`                                                      | If external database is used, set it to `external`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `internal`                           |
+| `database.internal.image.repository`                                 | Repository for database image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `goharbor/harbor-db`                 |
+| `database.internal.image.tag`                                        | Tag for database image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `dev`                                |
+| `database.internal.password`                                         | The password for database                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `changeit`                           |
+| `database.internal.shmSizeLimit`                                     | The limit for the size of shared memory for internal PostgreSQL, conventionally it's around 50% of the memory limit of the container                                                                                                                                                                                                                                                                                                                                                                                                                               | `512Mi`                              |
+| `database.internal.resources`                                        | The [resources] to allocate for container                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | undefined                            |
+| `database.internal.automountServiceAccountToken`                     | Mount serviceAccountToken?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `false`                              |
+| `database.internal.initContainer.migrator.resources`                 | The [resources] to allocate for the database migrator initContainer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | undefined                            |
+| `database.internal.initContainer.permissions.resources`              | The [resources] to allocate for the database permissions initContainer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | undefined                            |
+| `database.internal.nodeSelector`                                     | Node labels for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `{}`                                 |
+| `database.internal.tolerations`                                      | Tolerations for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `[]`                                 |
+| `database.internal.affinity`                                         | Node/Pod affinities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `{}`                                 |
+| `database.internal.priorityClassName`                                | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                                      |
+| `database.internal.livenessProbe.timeoutSeconds`                     | The timeout used in liveness probe; 1 to 5 seconds                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | 1                                    |
+| `database.internal.readinessProbe.timeoutSeconds`                    | The timeout used in readiness probe; 1 to 5 seconds                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | 1                                    |
+| `database.internal.extrInitContainers`                               | Extra init containers to be run before the database's container starts.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `[]`                                 |
+| `database.external.host`                                             | The hostname of external database                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `192.168.0.1`                        |
+| `database.external.port`                                             | The port of external database                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `5432`                               |
+| `database.external.username`                                         | The username of external database                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `user`                               |
+| `database.external.password`                                         | The password of external database                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `password`                           |
+| `database.external.coreDatabase`                                     | The database used by core service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `registry`                           |
+| `database.external.existingSecret`                                   | An existing password containing the database password. the key must be `password`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `""`                                 |
+| `database.external.sslmode`                                          | Connection method of external database (require, verify-full, verify-ca, disable)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `disable`                            |
+| `database.maxIdleConns`                                              | The maximum number of connections in the idle connection pool. If it <=0, no idle connections are retained.                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `50`                                 |
+| `database.maxOpenConns`                                              | The maximum number of open connections to the database. If it <= 0, then there is no limit on the number of open connections.                                                                                                                                                                                                                                                                                                                                                                                                                                      | `100`                                |
+| `database.podAnnotations`                                            | Annotations to add to the database pod                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `{}`                                 |
+| **Redis**                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `redis.type`                                                         | If external redis is used, set it to `external`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `internal`                           |
+| `redis.internal.image.repository`                                    | Repository for redis image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `goharbor/redis-photon`              |
+| `redis.internal.image.tag`                                           | Tag for redis image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `dev`                                |
+| `redis.internal.resources`                                           | The [resources] to allocate for container                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | undefined                            |
+| `redis.internal.automountServiceAccountToken`                        | Mount serviceAccountToken?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `false`                              |
+| `redis.internal.nodeSelector`                                        | Node labels for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `{}`                                 |
+| `redis.internal.tolerations`                                         | Tolerations for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `[]`                                 |
+| `redis.internal.affinity`                                            | Node/Pod affinities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `{}`                                 |
+| `redis.internal.priorityClassName`                                   | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                                      |
+| `redis.internal.jobserviceDatabaseIndex`                             | The database index for jobservice                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `1`                                  |
+| `redis.internal.registryDatabaseIndex`                               | The database index for registry                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `2`                                  |
+| `redis.internal.trivyAdapterIndex`                                   | The database index for trivy adapter                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `5`                                  |
+| `redis.internal.harborDatabaseIndex`                                 | The database index for harbor miscellaneous business logic                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `0`                                  |
+| `redis.internal.cacheLayerDatabaseIndex`                             | The database index for harbor cache layer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `0`                                  |
+| `redis.internal.initContainers`                                      | Init containers to be run before the redis's container starts.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `[]`                                 |
+| `redis.external.addr`                                                | The addr of external Redis: <host_redis>:<port_redis>. When using sentinel, it should be <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>                                                                                                                                                                                                                                                                                                                                                                     | `192.168.0.2:6379`                   |
+| `redis.external.sentinelMasterSet`                                   | The name of the set of Redis instances to monitor                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                                      |
+| `redis.external.coreDatabaseIndex`                                   | The database index for core                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `0`                                  |
+| `redis.external.jobserviceDatabaseIndex`                             | The database index for jobservice                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `1`                                  |
+| `redis.external.registryDatabaseIndex`                               | The database index for registry                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `2`                                  |
+| `redis.external.trivyAdapterIndex`                                   | The database index for trivy adapter                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `5`                                  |
+| `redis.external.harborDatabaseIndex`                                 | The database index for harbor miscellaneous business logic                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `0`                                  |
+| `redis.external.cacheLayerDatabaseIndex`                             | The database index for harbor cache layer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `0`                                  |
+| `redis.external.username`                                            | The username of external Redis                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                      |
+| `redis.external.password`                                            | The password of external Redis                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                      |
+| `redis.external.existingSecret`                                      | Use an existing secret to connect to redis. The key must be `REDIS_PASSWORD`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `""`                                 |
+| `redis.podAnnotations`                                               | Annotations to add to the redis pod                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `{}`                                 |
+| **Exporter**                                                         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `exporter.replicas`                                                  | The replica count                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `1`                                  |
+| `exporter.revisionHistoryLimit`                                      | The revision history limit                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `10`                                 |
+| `exporter.podAnnotations`                                            | Annotations to add to the exporter pod                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `{}`                                 |
+| `exporter.image.repository`                                          | Repository for redis image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `goharbor/harbor-exporter`           |
+| `exporter.image.tag`                                                 | Tag for exporter image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `dev`                                |
+| `exporter.nodeSelector`                                              | Node labels for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `{}`                                 |
+| `exporter.tolerations`                                               | Tolerations for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `[]`                                 |
+| `exporter.affinity`                                                  | Node/Pod affinities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `{}`                                 |
+| `exporter.topologySpreadConstraints`                                 | Constraints that define how Pods are spread across failure-domains like regions or availability zones                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `[]`                                 |
+| `exporter.automountServiceAccountToken`                              | Mount serviceAccountToken?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `false`                              |
+| `exporter.cacheDuration`                                             | the cache duration for information that exporter collected from Harbor                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `30`                                 |
+| `exporter.cacheCleanInterval`                                        | cache clean interval for information that exporter collected from Harbor                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `14400`                              |
+| `exporter.priorityClassName`                                         | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                                      |
+| **Metrics**                                                          |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `metrics.enabled`                                                    | if enable harbor metrics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `false`                              |
+| `metrics.core.path`                                                  | the url path for core metrics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `/metrics`                           |
+| `metrics.core.port`                                                  | the port for core metrics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `8001`                               |
+| `metrics.registry.path`                                              | the url path for registry metrics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `/metrics`                           |
+| `metrics.registry.port`                                              | the port for registry metrics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `8001`                               |
+| `metrics.exporter.path`                                              | the url path for exporter metrics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `/metrics`                           |
+| `metrics.exporter.port`                                              | the port for exporter metrics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `8001`                               |
+| `metrics.serviceMonitor.enabled`                                     | create prometheus serviceMonitor. Requires prometheus CRD's                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `false`                              |
+| `metrics.serviceMonitor.additionalLabels`                            | additional labels to upsert to the manifest                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `""`                                 |
+| `metrics.serviceMonitor.interval`                                    | scrape period for harbor metrics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `""`                                 |
+| `metrics.serviceMonitor.metricRelabelings`                           | metrics relabel to add/mod/del before ingestion                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `[]`                                 |
+| `metrics.serviceMonitor.relabelings`                                 | relabels to add/mod/del to sample before scrape                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `[]`                                 |
+| **Trace**                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `trace.enabled`                                                      | Enable tracing or not                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `false`                              |
+| `trace.provider`                                                     | The tracing provider: `jaeger` or `otel`. `jaeger` should be 1.26+                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `jaeger`                             |
+| `trace.sample_rate`                                                  | Set `sample_rate` to 1 if you want sampling 100% of trace data; set 0.5 if you want sampling 50% of trace data, and so forth                                                                                                                                                                                                                                                                                                                                                                                                                                       | `1`                                  |
+| `trace.namespace`                                                    | Namespace used to differentiate different harbor services                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |                                      |
+| `trace.attributes`                                                   | `attributes` is a key value dict contains user defined attributes used to initialize trace provider                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                      |
+| `trace.jaeger.endpoint`                                              | The endpoint of jaeger                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `http://hostname:14268/api/traces`   |
+| `trace.jaeger.username`                                              | The username of jaeger                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |                                      |
+| `trace.jaeger.password`                                              | The password of jaeger                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |                                      |
+| `trace.jaeger.agent_host`                                            | The agent host of jaeger                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |                                      |
+| `trace.jaeger.agent_port`                                            | The agent port of jaeger                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `6831`                               |
+| `trace.otel.endpoint`                                                | The endpoint of otel                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `hostname:4318`                      |
+| `trace.otel.url_path`                                                | The URL path of otel                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `/v1/traces`                         |
+| `trace.otel.compression`                                             | Whether enable compression or not for otel                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `false`                              |
+| `trace.otel.insecure`                                                | Whether establish insecure connection or not for otel                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `true`                               |
+| `trace.otel.timeout`                                                 | The timeout in seconds of otel                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `10`                                 |
+| **Cache**                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                      |
+| `cache.enabled`                                                      | Enable cache layer or not                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `false`                              |
+| `cache.expireHours`                                                  | The expire hours of cache layer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `24`                                 |
+| Parameter                                                            | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | Default                                                                  |
+|----------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------|
+| **Expose**                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `expose.type`                                                        | How to expose the service: `ingress`, `clusterIP`, `nodePort` or `loadBalancer`, other values will be ignored and the creation of service will be skipped.                                                                                                                                                                                                                                                                                                                                                                          | `ingress`                                                                |
+| `expose.tls.enabled`                                                 | Enable TLS or not. Delete the `ssl-redirect` annotations in `expose.ingress.annotations` when TLS is disabled and `expose.type` is `ingress`. Note: if the `expose.type` is `ingress` and TLS is disabled, the port must be included in the command when pulling/pushing images. Refer to https://github.com/goharbor/harbor/issues/5291 for details.                                                                                                                                                                               | `true`                                                                   |
+| `expose.tls.certSource`                                              | The source of the TLS certificate. Set as `auto`, `secret` or `none` and fill the information in the corresponding section: 1) auto: generate the TLS certificate automatically 2) secret: read the TLS certificate from the specified secret. The TLS certificate can be generated manually or by cert manager 3) none: configure no TLS certificate for the ingress. If the default TLS certificate is configured in the ingress controller, choose this option                                                                   | `auto`                                                                   |
+| `expose.tls.auto.commonName`                                         | The common name used to generate the certificate, it's necessary when the type isn't `ingress`                                                                                                                                                                                                                                                                                                                                                                                                                                      |                                                                          |
+| `expose.tls.secret.secretName`                                       | The name of secret which contains keys named: `tls.crt` - the certificate; `tls.key` - the private key                                                                                                                                                                                                                                                                                                                                                                                                                              |                                                                          |
+| `expose.ingress.hosts.core`                                          | The host of Harbor core service in ingress rule                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `core.harbor.domain`                                                     |
+| `expose.ingress.controller`                                          | The ingress controller type. Currently supports `default`, `gce`, `alb`, `f5-bigip` and `ncp`                                                                                                                                                                                                                                                                                                                                                                                                                                       | `default`                                                                |
+| `expose.ingress.kubeVersionOverride`                                 | Allows the ability to override the kubernetes version used while templating the ingress                                                                                                                                                                                                                                                                                                                                                                                                                                             |                                                                          |
+| `expose.ingress.className`                                           | Specify the `ingressClassName` used to implement the Ingress (Kubernetes 1.18+)                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `expose.ingress.annotations`                                         | The annotations used commonly for ingresses                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |                                                                          |
+| `expose.ingress.labels`                                              | The labels specific to ingress                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | {}                                                                       |
+| `expose.clusterIP.name`                                              | The name of ClusterIP service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `harbor`                                                                 |
+| `expose.clusterIP.annotations`                                       | The annotations attached to the ClusterIP service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | {}                                                                       |
+| `expose.clusterIP.ports.httpPort`                                    | The service port Harbor listens on when serving HTTP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `80`                                                                     |
+| `expose.clusterIP.ports.httpsPort`                                   | The service port Harbor listens on when serving HTTPS                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `443`                                                                    |
+| `expose.clusterIP.annotations`                                       | The annotations used commonly for clusterIP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |                                                                          |
+| `expose.clusterIP.labels`                                            | The labels specific to clusterIP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | {}                                                                       |
+| `expose.nodePort.name`                                               | The name of NodePort service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `harbor`                                                                 |
+| `expose.nodePort.ports.http.port`                                    | The service port Harbor listens on when serving HTTP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `80`                                                                     |
+| `expose.nodePort.ports.http.nodePort`                                | The node port Harbor listens on when serving HTTP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `30002`                                                                  |
+| `expose.nodePort.ports.https.port`                                   | The service port Harbor listens on when serving HTTPS                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `443`                                                                    |
+| `expose.nodePort.ports.https.nodePort`                               | The node port Harbor listens on when serving HTTPS                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `30003`                                                                  |
+| `expose.nodePort.annotations`                                        | The annotations used commonly for nodePort                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |                                                                          |
+| `expose.nodePort.labels`                                             | The labels specific to nodePort                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | {}                                                                       |
+| `expose.loadBalancer.name`                                           | The name of service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `harbor`                                                                 |
+| `expose.loadBalancer.IP`                                             | The IP of the loadBalancer. It only works when loadBalancer supports assigning IP                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `""`                                                                     |
+| `expose.loadBalancer.ports.httpPort`                                 | The service port Harbor listens on when serving HTTP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `80`                                                                     |
+| `expose.loadBalancer.ports.httpsPort`                                | The service port Harbor listens on when serving HTTPS                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `30002`                                                                  |
+| `expose.loadBalancer.annotations`                                    | The annotations attached to the loadBalancer service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | {}                                                                       |
+| `expose.loadBalancer.labels`                                         | The labels specific to loadBalancer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | {}                                                                       |
+| `expose.loadBalancer.sourceRanges`                                   | List of IP address ranges to assign to loadBalancerSourceRanges                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | []                                                                       |
+| **Internal TLS**                                                     |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `internalTLS.enabled`                                                | Enable TLS for the components (core, jobservice, portal, registry, trivy)                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `false`                                                                  |
+| `internalTLS.strong_ssl_ciphers`                                     | Enable strong ssl ciphers for nginx and portal                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `false`                                                                  |
+| `internalTLS.certSource`                                             | Method to provide TLS for the components, options are `auto`, `manual`, `secret`.                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `auto`                                                                   |
+| `internalTLS.trustCa`                                                | The content of trust CA, only available when `certSource` is `manual`. **Note**: all the internal certificates of the components must be issued by this CA                                                                                                                                                                                                                                                                                                                                                                          |                                                                          |
+| `internalTLS.core.secretName`                                        | The secret name for core component, only available when `certSource` is `secret`. The secret must contain keys named: `ca.crt` - the CA certificate which is used to issue internal key and crt pair for components and all Harbor components must be issued by the same CA, `tls.crt` - the content of the TLS cert file, `tls.key` - the content of the TLS key file.                                                                                                                                                             |                                                                          |
+| `internalTLS.core.crt`                                               | Content of core's TLS cert file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                          |
+| `internalTLS.core.key`                                               | Content of core's TLS key file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                        |                                                                          |
+| `internalTLS.jobservice.secretName`                                  | The secret name for jobservice component, only available when `certSource` is `secret`. The secret must contain keys named: `ca.crt` - the CA certificate which is used to issue internal key and crt pair for components and all Harbor components must be issued by the same CA, `tls.crt` - the content of the TLS cert file, `tls.key` - the content of the TLS key file.                                                                                                                                                       |                                                                          |
+| `internalTLS.jobservice.crt`                                         | Content of jobservice's TLS cert file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                 |                                                                          |
+| `internalTLS.jobservice.key`                                         | Content of jobservice's TLS key file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                                                                          |
+| `internalTLS.registry.secretName`                                    | The secret name for registry component, only available when `certSource` is `secret`. The secret must contain keys named: `ca.crt` - the CA certificate which is used to issue internal key and crt pair for components and all Harbor components must be issued by the same CA, `tls.crt` - the content of the TLS cert file, `tls.key` - the content of the TLS key file.                                                                                                                                                         |                                                                          |
+| `internalTLS.registry.crt`                                           | Content of registry's TLS cert file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                   |                                                                          |
+| `internalTLS.registry.key`                                           | Content of registry's TLS key file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                                                          |
+| `internalTLS.portal.secretName`                                      | The secret name for portal component, only available when `certSource` is `secret`. The secret must contain keys named: `ca.crt` - the CA certificate which is used to issue internal key and crt pair for components and all Harbor components must be issued by the same CA, `tls.crt` - the content of the TLS cert file, `tls.key` - the content of the TLS key file.                                                                                                                                                           |                                                                          |
+| `internalTLS.portal.crt`                                             | Content of portal's TLS cert file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `internalTLS.portal.key`                                             | Content of portal's TLS key file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                                                                          |
+| `internalTLS.trivy.secretName`                                       | The secret name for trivy component, only available when `certSource` is `secret`. The secret must contain keys named: `ca.crt` - the CA certificate which is used to issue internal key and crt pair for components and all Harbor components must be issued by the same CA, `tls.crt` - the content of the TLS cert file, `tls.key` - the content of the TLS key file.                                                                                                                                                            |                                                                          |
+| `internalTLS.trivy.crt`                                              | Content of trivy's TLS cert file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                                                                          |
+| `internalTLS.trivy.key`                                              | Content of trivy's TLS key file, only available when `certSource` is `manual`                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                          |
+| **IPFamily**                                                         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `ipFamily.ipv4.enabled`                                              | if cluster is ipv4 enabled, all ipv4 related configs will set correspondingly, but currently it only affects the nginx related components                                                                                                                                                                                                                                                                                                                                                                                           | `true`                                                                   |
+| `ipFamily.ipv6.enabled`                                              | if cluster is ipv6 enabled, all ipv6 related configs will set correspondingly, but currently it only affects the nginx related components                                                                                                                                                                                                                                                                                                                                                                                           | `true`                                                                   |
+| **Persistence**                                                      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `persistence.enabled`                                                | Enable the data persistence or not                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `true`                                                                   |
+| `persistence.resourcePolicy`                                         | Setting it to `keep` to avoid removing PVCs during a helm delete operation. Leaving it empty will delete PVCs after the chart deleted. Does not affect PVCs created for internal database and redis components.                                                                                                                                                                                                                                                                                                                     | `keep`                                                                   |
+| `persistence.persistentVolumeClaim.registry.existingClaim`           | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components                                                                                                                                                                                                                                                                                                                                                                                              |                                                                          |
+| `persistence.persistentVolumeClaim.registry.storageClass`            | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used (the default). Set it to `-` to disable dynamic provisioning                                                                                                                                                                                                                                                                                                                                                                      |                                                                          |
+| `persistence.persistentVolumeClaim.registry.subPath`                 | The sub path used in the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `persistence.persistentVolumeClaim.registry.accessMode`              | The access mode of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `ReadWriteOnce`                                                          |
+| `persistence.persistentVolumeClaim.registry.size`                    | The size of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `5Gi`                                                                    |
+| `persistence.persistentVolumeClaim.registry.annotations`             | The annotations of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                          |
+| `persistence.persistentVolumeClaim.jobservice.jobLog.existingClaim`  | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components.                                                                                                                                                                                                                                                                                                                                                                                             |                                                                          |
+| `persistence.persistentVolumeClaim.jobservice.jobLog.storageClass`   | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used (the default). Set it to `-` to disable dynamic provisioning                                                                                                                                                                                                                                                                                                                                                                      |                                                                          |
+| `persistence.persistentVolumeClaim.jobservice.jobLog.subPath`        | The sub path used in the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `persistence.persistentVolumeClaim.jobservice.jobLog.accessMode`     | The access mode of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `ReadWriteOnce`                                                          |
+| `persistence.persistentVolumeClaim.jobservice.jobLog.size`           | The size of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `1Gi`                                                                    |
+| `persistence.persistentVolumeClaim.jobservice.jobLog.annotations`    | The annotations of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                          |
+| `persistence.persistentVolumeClaim.database.existingClaim`           | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components. If external database is used, the setting will be ignored                                                                                                                                                                                                                                                                                                                                   |                                                                          |
+| `persistence.persistentVolumeClaim.database.storageClass`            | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used (the default). Set it to `-` to disable dynamic provisioning. If external database is used, the setting will be ignored                                                                                                                                                                                                                                                                                                           |                                                                          |
+| `persistence.persistentVolumeClaim.database.subPath`                 | The sub path used in the volume. If external database is used, the setting will be ignored                                                                                                                                                                                                                                                                                                                                                                                                                                          |                                                                          |
+| `persistence.persistentVolumeClaim.database.accessMode`              | The access mode of the volume. If external database is used, the setting will be ignored                                                                                                                                                                                                                                                                                                                                                                                                                                            | `ReadWriteOnce`                                                          |
+| `persistence.persistentVolumeClaim.database.size`                    | The size of the volume. If external database is used, the setting will be ignored                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `1Gi`                                                                    |
+| `persistence.persistentVolumeClaim.database.annotations`             | The annotations of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                          |
+| `persistence.persistentVolumeClaim.redis.existingClaim`              | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components. If external Redis is used, the setting will be ignored                                                                                                                                                                                                                                                                                                                                      |                                                                          |
+| `persistence.persistentVolumeClaim.redis.storageClass`               | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used (the default). Set it to `-` to disable dynamic provisioning. If external Redis is used, the setting will be ignored                                                                                                                                                                                                                                                                                                              |                                                                          |
+| `persistence.persistentVolumeClaim.redis.subPath`                    | The sub path used in the volume. If external Redis is used, the setting will be ignored                                                                                                                                                                                                                                                                                                                                                                                                                                             |                                                                          |
+| `persistence.persistentVolumeClaim.redis.accessMode`                 | The access mode of the volume. If external Redis is used, the setting will be ignored                                                                                                                                                                                                                                                                                                                                                                                                                                               | `ReadWriteOnce`                                                          |
+| `persistence.persistentVolumeClaim.redis.size`                       | The size of the volume. If external Redis is used, the setting will be ignored                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `1Gi`                                                                    |
+| `persistence.persistentVolumeClaim.redis.annotations`                | The annotations of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                          |
+| `persistence.persistentVolumeClaim.trivy.existingClaim`              | Use the existing PVC which must be created manually before bound, and specify the `subPath` if the PVC is shared with other components                                                                                                                                                                                                                                                                                                                                                                                              |                                                                          |
+| `persistence.persistentVolumeClaim.trivy.storageClass`               | Specify the `storageClass` used to provision the volume. Or the default StorageClass will be used (the default). Set it to `-` to disable dynamic provisioning                                                                                                                                                                                                                                                                                                                                                                      |                                                                          |
+| `persistence.persistentVolumeClaim.trivy.subPath`                    | The sub path used in the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `persistence.persistentVolumeClaim.trivy.accessMode`                 | The access mode of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `ReadWriteOnce`                                                          |
+| `persistence.persistentVolumeClaim.trivy.size`                       | The size of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `1Gi`                                                                    |
+| `persistence.persistentVolumeClaim.trivy.annotations`                | The annotations of the volume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                          |
+| `persistence.imageChartStorage.disableredirect`                      | The configuration for managing redirects from content backends. For backends which not supported it (such as using minio for `s3` storage type), please set it to `true` to disable redirects. Refer to the [guide](https://github.com/docker/distribution/blob/master/docs/configuration.md#redirect) for more details                                                                                                                                                                                                             | `false`                                                                  |
+| `persistence.imageChartStorage.caBundleSecretName`                   | Specify the `caBundleSecretName` if the storage service uses a self-signed certificate. The secret must contain keys named `ca.crt` which will be injected into the trust store of registry's and containers.                                                                                                                                                                                                                                                                                                                       |                                                                          |
+| `persistence.imageChartStorage.type`                                 | The type of storage for images and charts: `filesystem`, `azure`, `gcs`, `s3`, `swift` or `oss`. The type must be `filesystem` if you want to use persistent volumes for registry. Refer to the [guide](https://github.com/docker/distribution/blob/master/docs/configuration.md#storage) for more details                                                                                                                                                                                                                          | `filesystem`                                                             |
+| `persistence.imageChartStorage.gcs.existingSecret`                   | An existing secret containing the gcs service account json key. The key must be gcs-key.json.                                                                                                                                                                                                                                                                                                                                                                                                                                       | `""`                                                                     |
+| `persistence.imageChartStorage.gcs.useWorkloadIdentity`              | A boolean to allow the use of workloadidentity in a GKE cluster. To use it, create a kubernetes service account and set the name in the key `serviceAccountName` of each component, then allow automounting the service account.                                                                                                                                                                                                                                                                                                    | `false`                                                                  |
+| **General**                                                          |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `externalURL`                                                        | The external URL for Harbor core service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `https://core.harbor.domain`                                             |
+| `caBundleSecretName`                                                 | The custom CA bundle secret name, the secret must contain key named "ca.crt" which will be injected into the trust store for core, jobservice, registry, trivy components.                                                                                                                                                                                                                                                                                                                                                          |                                                                          |
+| `uaaSecretName`                                                      | If using external UAA auth which has a self signed cert, you can provide a pre-created secret containing it under the key `ca.crt`.                                                                                                                                                                                                                                                                                                                                                                                                 |                                                                          |
+| `imagePullPolicy`                                                    | The image pull policy                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                                                                          |
+| `imagePullSecrets`                                                   | The imagePullSecrets names for all deployments                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                                                                          |
+| `updateStrategy.type`                                                | The update strategy for deployments with persistent volumes(jobservice, registry): `RollingUpdate` or `Recreate`. Set it as `Recreate` when `RWM` for volumes isn't supported                                                                                                                                                                                                                                                                                                                                                       | `RollingUpdate`                                                          |
+| `logLevel`                                                           | The log level: `debug`, `info`, `warning`, `error` or `fatal`                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `info`                                                                   |
+| `harborAdminPassword`                                                | The initial password of Harbor admin. Change it from portal after launching Harbor                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `Harbor12345`                                                            |
+| `existingSecretAdminPassword`                                        | The name of secret where admin password can be found.                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                                                                          |
+| `existingSecretAdminPasswordKey`                                     | The name of the key in the secret where to find harbor admin password Harbor                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `HARBOR_ADMIN_PASSWORD`                                                  |
+| `caSecretName`                                                       | The name of the secret which contains key named `ca.crt`. Setting this enables the download link on portal to download the CA certificate when the certificate isn't generated automatically                                                                                                                                                                                                                                                                                                                                        |                                                                          |
+| `secretKey`                                                          | The key used for encryption. Must be a string of 16 chars                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `not-a-secure-key`                                                       |
+| `existingSecretSecretKey`                                            | An existing secret containing the encoding secretKey                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `""`                                                                     |
+| `proxy.httpProxy`                                                    | The URL of the HTTP proxy server                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                                                          |
+| `proxy.httpsProxy`                                                   | The URL of the HTTPS proxy server                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |                                                                          |
+| `proxy.noProxy`                                                      | The URLs that the proxy settings not apply to                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | 127.0.0.1,localhost,.local,.internal                                     |
+| `proxy.components`                                                   | The component list that the proxy settings apply to                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | core, jobservice, trivy                                                  |
+| `enableMigrateHelmHook`                                              | Run the migration job via helm hook, if it is true, the database migration will be separated from harbor-core, run with a preupgrade job migration-job                                                                                                                                                                                                                                                                                                                                                                              | `false`                                                                  |
+| **Nginx** (if service exposed via `ingress`, Nginx will not be used) |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `nginx.image.repository`                                             | Image repository                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `goharbor/nginx-photon`                                                  |
+| `nginx.image.tag`                                                    | Image tag                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `dev`                                                                    |
+| `nginx.replicas`                                                     | The replica count                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `1`                                                                      |
+| `nginx.revisionHistoryLimit`                                         | The revision history limit                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `10`                                                                     |
+| `nginx.resources`                                                    | The [resources] to allocate for container                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | undefined                                                                |
+| `nginx.automountServiceAccountToken`                                 | Mount serviceAccountToken?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `false`                                                                  |
+| `nginx.nodeSelector`                                                 | Node labels for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `{}`                                                                     |
+| `nginx.tolerations`                                                  | Tolerations for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `[]`                                                                     |
+| `nginx.affinity`                                                     | Node/Pod affinities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `{}`                                                                     |
+| `nginx.topologySpreadConstraints`                                    | Constraints that define how Pods are spread across failure-domains like regions or availability zones                                                                                                                                                                                                                                                                                                                                                                                                                               | `[]`                                                                     |
+| `nginx.podAnnotations`                                               | Annotations to add to the nginx pod                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `{}`                                                                     |
+| `nginx.priorityClassName`                                            | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                                                          |
+| **Portal**                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `portal.image.repository`                                            | Repository for portal image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `goharbor/harbor-portal`                                                 |
+| `portal.image.tag`                                                   | Tag for portal image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `dev`                                                                    |
+| `portal.replicas`                                                    | The replica count                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `1`                                                                      |
+| `portal.revisionHistoryLimit`                                        | The revision history limit                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `10`                                                                     |
+| `portal.resources`                                                   | The [resources] to allocate for container                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | undefined                                                                |
+| `portal.automountServiceAccountToken`                                | Mount serviceAccountToken?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `false`                                                                  |
+| `portal.nodeSelector`                                                | Node labels for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `{}`                                                                     |
+| `portal.tolerations`                                                 | Tolerations for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `[]`                                                                     |
+| `portal.affinity`                                                    | Node/Pod affinities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `{}`                                                                     |
+| `portal.topologySpreadConstraints`                                   | Constraints that define how Pods are spread across failure-domains like regions or availability zones                                                                                                                                                                                                                                                                                                                                                                                                                               | `[]`                                                                     |
+| `portal.podAnnotations`                                              | Annotations to add to the portal pod                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `{}`                                                                     |
+| `portal.serviceAnnotations`                                          | Annotations to add to the portal service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `{}`                                                                     |
+| `portal.priorityClassName`                                           | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                                                          |
+| `portal.initContainers`                                              | Init containers to be run before the controller's container starts.                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `[]`                                                                     |
+| **Core**                                                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `core.image.repository`                                              | Repository for Harbor core image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `goharbor/harbor-core`                                                   |
+| `core.image.tag`                                                     | Tag for Harbor core image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `dev`                                                                    |
+| `core.replicas`                                                      | The replica count                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `1`                                                                      |
+| `core.revisionHistoryLimit`                                          | The revision history limit                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `10`                                                                     |
+| `core.startupProbe.initialDelaySeconds`                              | The initial delay in seconds for the startup probe                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `10`                                                                     |
+| `core.resources`                                                     | The [resources] to allocate for container                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | undefined                                                                |
+| `core.automountServiceAccountToken`                                  | Mount serviceAccountToken?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `false`                                                                  |
+| `core.nodeSelector`                                                  | Node labels for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `{}`                                                                     |
+| `core.tolerations`                                                   | Tolerations for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `[]`                                                                     |
+| `core.affinity`                                                      | Node/Pod affinities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `{}`                                                                     |
+| `core.topologySpreadConstraints`                                     | Constraints that define how Pods are spread across failure-domains like regions or availability zones                                                                                                                                                                                                                                                                                                                                                                                                                               | `[]`                                                                     |
+| `core.podAnnotations`                                                | Annotations to add to the core pod                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `{}`                                                                     |
+| `core.serviceAnnotations`                                            | Annotations to add to the core service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `{}`                                                                     |
+| `core.configureUserSettings`                                         | A JSON string to set in the environment variable `CONFIG_OVERWRITE_JSON` to configure user settings. See the [official docs](https://goharbor.io/docs/latest/install-config/configure-user-settings-cli/#configure-users-settings-using-an-environment-variable).                                                                                                                                                                                                                                                                   |                                                                          |
+| `core.quotaUpdateProvider`                                           | The provider for updating project quota(usage), there are 2 options, `redis` or `db`. You can set it to be implemented by `redis` which can improve the performance of high concurrent pushing to the same project, and reduce database connection spikes and occupies. Using redis will bring up some delay for quota usage update for display, so only suggest switch provider to redis if you ran into the db connections spike around the scenario of high concurrent pushing to same project, no improvement for other scenes. | `db`                                                                     |
+| `core.secret`                                                        | Secret is used when core server communicates with other components. If a secret key is not specified, Helm will generate one. Must be a string of 16 chars.                                                                                                                                                                                                                                                                                                                                                                         |                                                                          |
+| `core.secretName`                                                    | Fill the name of a kubernetes secret if you want to use your own TLS certificate and private key for token encryption/decryption. The secret must contain keys named: `tls.crt` - the certificate and `tls.key` - the private key. The default key pair will be used if it isn't set                                                                                                                                                                                                                                                |                                                                          |
+| `core.tokenKey`                                                      | PEM-formatted RSA private key used to sign service tokens. Only used if `core.secretName` is unset. If set, `core.tokenCert` MUST also be set.                                                                                                                                                                                                                                                                                                                                                                                      |                                                                          |
+| `core.tokenCert`                                                     | PEM-formatted certificate signed by `core.tokenKey` used to validate service tokens. Only used if `core.secretName` is unset. If set, `core.tokenKey` MUST also be set.                                                                                                                                                                                                                                                                                                                                                             |                                                                          |
+| `core.xsrfKey`                                                       | The XSRF key. Will be generated automatically if it isn't specified                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |                                                                          |
+| `core.priorityClassName`                                             | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                                                          |
+| `core.artifactPullAsyncFlushDuration`                                | The time duration for async update artifact pull_time and repository pull_count                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `core.gdpr.deleteUser`                                               | Enable GDPR compliant user delete                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `false`                                                                  |
+| `core.gdpr.auditLogsCompliant`                                       | Enable GDPR compliant for audit logs by changing username to its CRC32 value if that user was deleted from the system                                                                                                                                                                                                                                                                                                                                                                                                               | `false`                                                                  |
+| `core.initContainers`                                                | Init containers to be run before the controller's container starts.                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `[]`                                                                     |
+| **Jobservice**                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `jobservice.image.repository`                                        | Repository for jobservice image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `goharbor/harbor-jobservice`                                             |
+| `jobservice.image.tag`                                               | Tag for jobservice image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `dev`                                                                    |
+| `jobservice.replicas`                                                | The replica count                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `1`                                                                      |
+| `jobservice.revisionHistoryLimit`                                    | The revision history limit                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `10`                                                                     |
+| `jobservice.maxJobWorkers`                                           | The max job workers                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `10`                                                                     |
+| `jobservice.jobLoggers`                                              | The loggers for jobs: `file`, `database` or `stdout`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `[file]`                                                                 |
+| `jobservice.loggerSweeperDuration`                                   | The jobLogger sweeper duration in days (ignored if `jobLoggers` is set to `stdout`)                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `14`                                                                     |
+| `jobservice.notification.webhook_job_max_retry`                      | The maximum retry of webhook sending notifications                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `3`                                                                      |
+| `jobservice.notification.webhook_job_http_client_timeout`            | The http client timeout value of webhook sending notifications                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `3`                                                                      |
+| `jobservice.reaper.max_update_hours`                                 | the max time to wait for a task to finish, if unfinished after max_update_hours, the task will be mark as error, but the task will continue to run                                                                                                                                                                                                                                                                                                                                                                                  | `24`                                                                     |
+| `jobservice.reaper.max_dangling_hours`                               | the max time for execution in running state without new task created                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `168`                                                                    |
+| `jobservice.resources`                                               | The [resources] to allocate for container                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | undefined                                                                |
+| `jobservice.automountServiceAccountToken`                            | Mount serviceAccountToken?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `false`                                                                  |
+| `jobservice.nodeSelector`                                            | Node labels for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `{}`                                                                     |
+| `jobservice.tolerations`                                             | Tolerations for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `[]`                                                                     |
+| `jobservice.affinity`                                                | Node/Pod affinities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `{}`                                                                     |
+| `jobservice.topologySpreadConstraints`                               | Constraints that define how Pods are spread across failure-domains like regions or availability zones                                                                                                                                                                                                                                                                                                                                                                                                                               | `[]`                                                                     |
+| `jobservice.podAnnotations`                                          | Annotations to add to the jobservice pod                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `{}`                                                                     |
+| `jobservice.priorityClassName`                                       | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                                                          |
+| `jobservice.secret`                                                  | Secret is used when job service communicates with other components. If a secret key is not specified, Helm will generate one. Must be a string of 16 chars.                                                                                                                                                                                                                                                                                                                                                                         |                                                                          |
+| `jobservice.initContainers`                                          | Init containers to be run before the controller's container starts.                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `[]`                                                                     |
+| **Registry**                                                         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `registry.registry.image.repository`                                 | Repository for registry image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `goharbor/registry-photon`                                               |
+| `registry.registry.image.tag`                                        | Tag for registry image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `dev`                                                                    |
+| `registry.registry.resources`                                        | The [resources] to allocate for container                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | undefined                                                                |
+| `registry.controller.image.repository`                               | Repository for registry controller image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `goharbor/harbor-registryctl`                                            |
+| `registry.controller.image.tag`                                      | Tag for registry controller image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `dev`                                                                    |
+| `registry.controller.resources`                                      | The [resources] to allocate for container                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | undefined                                                                |
+| `registry.replicas`                                                  | The replica count                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `1`                                                                      |
+| `registry.revisionHistoryLimit`                                      | The revision history limit                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `10`                                                                     |
+| `registry.nodeSelector`                                              | Node labels for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `{}`                                                                     |
+| `registry.automountServiceAccountToken`                              | Mount serviceAccountToken?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `false`                                                                  |
+| `registry.tolerations`                                               | Tolerations for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `[]`                                                                     |
+| `registry.affinity`                                                  | Node/Pod affinities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `{}`                                                                     |
+| `registry.topologySpreadConstraints`                                 | Constraints that define how Pods are spread across failure-domains like regions or availability zones                                                                                                                                                                                                                                                                                                                                                                                                                               | `[]`                                                                     |
+| `registry.middleware`                                                | Middleware is used to add support for a CDN between backend storage and `docker pull` recipient. See [official docs](https://github.com/docker/distribution/blob/master/docs/configuration.md#middleware).                                                                                                                                                                                                                                                                                                                          |                                                                          |
+| `registry.podAnnotations`                                            | Annotations to add to the registry pod                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `{}`                                                                     |
+| `registry.priorityClassName`                                         | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                                                          |
+| `registry.secret`                                                    | Secret is used to secure the upload state from client and registry storage backend. See [official docs](https://github.com/docker/distribution/blob/master/docs/configuration.md#http). If a secret key is not specified, Helm will generate one. Must be a string of 16 chars.                                                                                                                                                                                                                                                     |                                                                          |
+| `registry.credentials.username`                                      | The username that harbor core uses internally to access the registry instance. Together with the `registry.credentials.password`, a htpasswd  is created. This is an alternative to providing `registry.credentials.htpasswdString`. For more details see [official docs](https://github.com/docker/distribution/blob/master/docs/configuration.md#htpasswd).                                                                                                                                                                       | `harbor_registry_user`                                                   |
+| `registry.credentials.password`                                      | The password that harbor core uses internally to access the registry instance. Together with the `registry.credentials.username`, a htpasswd  is created. This is an alternative to providing `registry.credentials.htpasswdString`. For more details see [official docs](https://github.com/docker/distribution/blob/master/docs/configuration.md#htpasswd). It is suggested you update this value before installation.                                                                                                            | `harbor_registry_password`                                               |
+| `registry.credentials.existingSecret`                                | An existing secret containing the password for accessing the registry instance, which is hosted by htpasswd auth mode. More details see [official docs](https://github.com/docker/distribution/blob/master/docs/configuration.md#htpasswd). The key must be `REGISTRY_PASSWD`                                                                                                                                                                                                                                                       | `""`                                                                     |
+| `registry.credentials.htpasswdString`                                | Login and password in htpasswd string format. Excludes `registry.credentials.username` and `registry.credentials.password`. May come in handy when integrating with tools like argocd or flux. This allows the same line to be generated each time the template is rendered, instead of the `htpasswd` function from helm, which generates different lines each time because of the salt.                                                                                                                                           | undefined                                                                |
+| `registry.relativeurls`                                              | If true, the registry returns relative URLs in Location headers. The client is responsible for resolving the correct URL. Needed if harbor is behind a reverse proxy                                                                                                                                                                                                                                                                                                                                                                | `false`                                                                  |
+| `registry.upload_purging.enabled`                                    | If true, enable purge _upload directories                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `true`                                                                   |
+| `registry.upload_purging.age`                                        | Remove files in _upload directories which exist for a period of time, default is one week.                                                                                                                                                                                                                                                                                                                                                                                                                                          | `168h`                                                                   |
+| `registry.upload_purging.interval`                                   | The interval of the purge operations                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `24h`                                                                    |
+| `registry.upload_purging.dryrun`                                     | If true, enable dryrun for purging _upload                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `false`                                                                  |
+| `registry.initContainers`                                            | Init containers to be run before the controller's container starts.                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `[]`                                                                     |
+| **[Trivy][trivy]**                                                   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `trivy.enabled`                                                      | The flag to enable Trivy scanner                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `true`                                                                   |
+| `trivy.image.repository`                                             | Repository for Trivy adapter image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `goharbor/trivy-adapter-photon`                                          |
+| `trivy.image.tag`                                                    | Tag for Trivy adapter image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `dev`                                                                    |
+| `trivy.resources`                                                    | The [resources] to allocate for Trivy adapter container                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |                                                                          |
+| `trivy.automountServiceAccountToken`                                 | Mount serviceAccountToken?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `false`                                                                  |
+| `trivy.replicas`                                                     | The number of Pod replicas                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `1`                                                                      |
+| `trivy.debugMode`                                                    | The flag to enable Trivy debug mode                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `false`                                                                  |
+| `trivy.vulnType`                                                     | Comma-separated list of vulnerability types. Possible values `os` and `library`.                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `os,library`                                                             |
+| `trivy.severity`                                                     | Comma-separated list of severities to be checked                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL`                                       |
+| `trivy.ignoreUnfixed`                                                | The flag to display only fixed vulnerabilities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `false`                                                                  |
+| `trivy.insecure`                                                     | The flag to skip verifying registry certificate                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `false`                                                                  |
+| `trivy.skipUpdate`                                                   | The flag to disable [Trivy DB][trivy-db] downloads from GitHub                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `false`                                                                  |
+| `trivy.skipJavaDBUpdate`                                             | If the flag is enabled you have to manually download the `trivy-java.db` file [Trivy Java DB][trivy-java-db] and mount it in the `/home/scanner/.cache/trivy/java-db/trivy-java.db` path                                                                                                                                                                                                                                                                                                                                            | `false`                                                                  |
+| `trivy.dbRepository`                                                 | OCI repository(ies) to retrieve the trivy vulnerability database in order of priority                                                                                                                                                                                                                                                                                                                                                                                                                                               | `mirror.gcr.io/aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db`           |
+| `trivy.javaDBRepository`                                             | OCI repository(ies) to retrieve the Java trivy vulnerability database in order of priority                                                                                                                                                                                                                                                                                                                                                                                                                                          | `mirror.gcr.io/aquasec/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db` |
+| `trivy.offlineScan`                                                  | The flag prevents Trivy from sending API requests to identify dependencies.                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `false`                                                                  |
+| `trivy.securityCheck`                                                | Comma-separated list of what security issues to detect.                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `vuln`                                                                   |
+| `trivy.timeout`                                                      | The duration to wait for scan completion                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `5m0s`                                                                   |
+| `trivy.gitHubToken`                                                  | The GitHub access token to download [Trivy DB][trivy-db] (see [GitHub rate limiting][trivy-rate-limiting])                                                                                                                                                                                                                                                                                                                                                                                                                          |                                                                          |
+| `trivy.priorityClassName`                                            | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                                                          |
+| `trivy.topologySpreadConstraints`                                    | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                                                          |
+| `trivy.initContainers`                                               | Init containers to be run before the controller's container starts.                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `[]`                                                                     |
+| **Database**                                                         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `database.type`                                                      | If external database is used, set it to `external`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `internal`                                                               |
+| `database.internal.image.repository`                                 | Repository for database image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `goharbor/harbor-db`                                                     |
+| `database.internal.image.tag`                                        | Tag for database image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `dev`                                                                    |
+| `database.internal.password`                                         | The password for database                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `changeit`                                                               |
+| `database.internal.shmSizeLimit`                                     | The limit for the size of shared memory for internal PostgreSQL, conventionally it's around 50% of the memory limit of the container                                                                                                                                                                                                                                                                                                                                                                                                | `512Mi`                                                                  |
+| `database.internal.resources`                                        | The [resources] to allocate for container                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | undefined                                                                |
+| `database.internal.automountServiceAccountToken`                     | Mount serviceAccountToken?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `false`                                                                  |
+| `database.internal.initContainer.migrator.resources`                 | The [resources] to allocate for the database migrator initContainer                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | undefined                                                                |
+| `database.internal.initContainer.permissions.resources`              | The [resources] to allocate for the database permissions initContainer                                                                                                                                                                                                                                                                                                                                                                                                                                                              | undefined                                                                |
+| `database.internal.nodeSelector`                                     | Node labels for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `{}`                                                                     |
+| `database.internal.tolerations`                                      | Tolerations for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `[]`                                                                     |
+| `database.internal.affinity`                                         | Node/Pod affinities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `{}`                                                                     |
+| `database.internal.priorityClassName`                                | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                                                          |
+| `database.internal.livenessProbe.timeoutSeconds`                     | The timeout used in liveness probe; 1 to 5 seconds                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | 1                                                                        |
+| `database.internal.readinessProbe.timeoutSeconds`                    | The timeout used in readiness probe; 1 to 5 seconds                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | 1                                                                        |
+| `database.internal.extrInitContainers`                               | Extra init containers to be run before the database's container starts.                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `[]`                                                                     |
+| `database.external.host`                                             | The hostname of external database                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `192.168.0.1`                                                            |
+| `database.external.port`                                             | The port of external database                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `5432`                                                                   |
+| `database.external.username`                                         | The username of external database                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `user`                                                                   |
+| `database.external.password`                                         | The password of external database                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `password`                                                               |
+| `database.external.coreDatabase`                                     | The database used by core service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `registry`                                                               |
+| `database.external.existingSecret`                                   | An existing password containing the database password. the key must be `password`.                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `""`                                                                     |
+| `database.external.sslmode`                                          | Connection method of external database (require, verify-full, verify-ca, disable)                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `disable`                                                                |
+| `database.maxIdleConns`                                              | The maximum number of connections in the idle connection pool. If it <=0, no idle connections are retained.                                                                                                                                                                                                                                                                                                                                                                                                                         | `50`                                                                     |
+| `database.maxOpenConns`                                              | The maximum number of open connections to the database. If it <= 0, then there is no limit on the number of open connections.                                                                                                                                                                                                                                                                                                                                                                                                       | `100`                                                                    |
+| `database.podAnnotations`                                            | Annotations to add to the database pod                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `{}`                                                                     |
+| **Redis**                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `redis.type`                                                         | If external redis is used, set it to `external`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `internal`                                                               |
+| `redis.internal.image.repository`                                    | Repository for redis image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `goharbor/redis-photon`                                                  |
+| `redis.internal.image.tag`                                           | Tag for redis image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `dev`                                                                    |
+| `redis.internal.resources`                                           | The [resources] to allocate for container                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | undefined                                                                |
+| `redis.internal.automountServiceAccountToken`                        | Mount serviceAccountToken?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `false`                                                                  |
+| `redis.internal.nodeSelector`                                        | Node labels for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `{}`                                                                     |
+| `redis.internal.tolerations`                                         | Tolerations for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `[]`                                                                     |
+| `redis.internal.affinity`                                            | Node/Pod affinities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `{}`                                                                     |
+| `redis.internal.priorityClassName`                                   | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                                                          |
+| `redis.internal.jobserviceDatabaseIndex`                             | The database index for jobservice                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `1`                                                                      |
+| `redis.internal.registryDatabaseIndex`                               | The database index for registry                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `2`                                                                      |
+| `redis.internal.trivyAdapterIndex`                                   | The database index for trivy adapter                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `5`                                                                      |
+| `redis.internal.harborDatabaseIndex`                                 | The database index for harbor miscellaneous business logic                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `0`                                                                      |
+| `redis.internal.cacheLayerDatabaseIndex`                             | The database index for harbor cache layer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `0`                                                                      |
+| `redis.internal.initContainers`                                      | Init containers to be run before the redis's container starts.                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `[]`                                                                     |
+| `redis.external.addr`                                                | The addr of external Redis: <host_redis>:<port_redis>. When using sentinel, it should be <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>                                                                                                                                                                                                                                                                                                                                      | `192.168.0.2:6379`                                                       |
+| `redis.external.sentinelMasterSet`                                   | The name of the set of Redis instances to monitor                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |                                                                          |
+| `redis.external.coreDatabaseIndex`                                   | The database index for core                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `0`                                                                      |
+| `redis.external.jobserviceDatabaseIndex`                             | The database index for jobservice                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `1`                                                                      |
+| `redis.external.registryDatabaseIndex`                               | The database index for registry                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `2`                                                                      |
+| `redis.external.trivyAdapterIndex`                                   | The database index for trivy adapter                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `5`                                                                      |
+| `redis.external.harborDatabaseIndex`                                 | The database index for harbor miscellaneous business logic                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `0`                                                                      |
+| `redis.external.cacheLayerDatabaseIndex`                             | The database index for harbor cache layer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `0`                                                                      |
+| `redis.external.username`                                            | The username of external Redis                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                                                                          |
+| `redis.external.password`                                            | The password of external Redis                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                                                                          |
+| `redis.external.existingSecret`                                      | Use an existing secret to connect to redis. The key must be `REDIS_PASSWORD`.                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `""`                                                                     |
+| `redis.podAnnotations`                                               | Annotations to add to the redis pod                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `{}`                                                                     |
+| **Exporter**                                                         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `exporter.replicas`                                                  | The replica count                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `1`                                                                      |
+| `exporter.revisionHistoryLimit`                                      | The revision history limit                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `10`                                                                     |
+| `exporter.podAnnotations`                                            | Annotations to add to the exporter pod                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `{}`                                                                     |
+| `exporter.image.repository`                                          | Repository for redis image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `goharbor/harbor-exporter`                                               |
+| `exporter.image.tag`                                                 | Tag for exporter image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `dev`                                                                    |
+| `exporter.nodeSelector`                                              | Node labels for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `{}`                                                                     |
+| `exporter.tolerations`                                               | Tolerations for pod assignment                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `[]`                                                                     |
+| `exporter.affinity`                                                  | Node/Pod affinities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `{}`                                                                     |
+| `exporter.topologySpreadConstraints`                                 | Constraints that define how Pods are spread across failure-domains like regions or availability zones                                                                                                                                                                                                                                                                                                                                                                                                                               | `[]`                                                                     |
+| `exporter.automountServiceAccountToken`                              | Mount serviceAccountToken?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `false`                                                                  |
+| `exporter.cacheDuration`                                             | the cache duration for information that exporter collected from Harbor                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `30`                                                                     |
+| `exporter.cacheCleanInterval`                                        | cache clean interval for information that exporter collected from Harbor                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `14400`                                                                  |
+| `exporter.priorityClassName`                                         | The priority class to run the pod as                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                                                          |
+| **Metrics**                                                          |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `metrics.enabled`                                                    | if enable harbor metrics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `false`                                                                  |
+| `metrics.core.path`                                                  | the url path for core metrics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `/metrics`                                                               |
+| `metrics.core.port`                                                  | the port for core metrics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `8001`                                                                   |
+| `metrics.registry.path`                                              | the url path for registry metrics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `/metrics`                                                               |
+| `metrics.registry.port`                                              | the port for registry metrics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `8001`                                                                   |
+| `metrics.exporter.path`                                              | the url path for exporter metrics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `/metrics`                                                               |
+| `metrics.exporter.port`                                              | the port for exporter metrics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `8001`                                                                   |
+| `metrics.serviceMonitor.enabled`                                     | create prometheus serviceMonitor. Requires prometheus CRD's                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `false`                                                                  |
+| `metrics.serviceMonitor.additionalLabels`                            | additional labels to upsert to the manifest                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `""`                                                                     |
+| `metrics.serviceMonitor.interval`                                    | scrape period for harbor metrics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `""`                                                                     |
+| `metrics.serviceMonitor.metricRelabelings`                           | metrics relabel to add/mod/del before ingestion                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `[]`                                                                     |
+| `metrics.serviceMonitor.relabelings`                                 | relabels to add/mod/del to sample before scrape                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `[]`                                                                     |
+| **Trace**                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `trace.enabled`                                                      | Enable tracing or not                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `false`                                                                  |
+| `trace.provider`                                                     | The tracing provider: `jaeger` or `otel`. `jaeger` should be 1.26+                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `jaeger`                                                                 |
+| `trace.sample_rate`                                                  | Set `sample_rate` to 1 if you want sampling 100% of trace data; set 0.5 if you want sampling 50% of trace data, and so forth                                                                                                                                                                                                                                                                                                                                                                                                        | `1`                                                                      |
+| `trace.namespace`                                                    | Namespace used to differentiate different harbor services                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |                                                                          |
+| `trace.attributes`                                                   | `attributes` is a key value dict contains user defined attributes used to initialize trace provider                                                                                                                                                                                                                                                                                                                                                                                                                                 |                                                                          |
+| `trace.jaeger.endpoint`                                              | The endpoint of jaeger                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `http://hostname:14268/api/traces`                                       |
+| `trace.jaeger.username`                                              | The username of jaeger                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |                                                                          |
+| `trace.jaeger.password`                                              | The password of jaeger                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |                                                                          |
+| `trace.jaeger.agent_host`                                            | The agent host of jaeger                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                          |
+| `trace.jaeger.agent_port`                                            | The agent port of jaeger                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `6831`                                                                   |
+| `trace.otel.endpoint`                                                | The endpoint of otel                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `hostname:4318`                                                          |
+| `trace.otel.url_path`                                                | The URL path of otel                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `/v1/traces`                                                             |
+| `trace.otel.compression`                                             | Whether enable compression or not for otel                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `false`                                                                  |
+| `trace.otel.insecure`                                                | Whether establish insecure connection or not for otel                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `true`                                                                   |
+| `trace.otel.timeout`                                                 | The timeout in seconds of otel                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `10`                                                                     |
+| **Cache**                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                          |
+| `cache.enabled`                                                      | Enable cache layer or not                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `false`                                                                  |
+| `cache.expireHours`                                                  | The expire hours of cache layer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `24`                                                                     |
+
+[resources]: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
+[trivy]: https://github.com/aquasecurity/trivy
+[trivy-db]: https://github.com/aquasecurity/trivy-db
+[trivy-java-db]: https://github.com/aquasecurity/trivy-java-db
+[trivy-rate-limiting]: https://github.com/aquasecurity/trivy#github-rate-limiting
diff --git a/packages/system/harbor/charts/harbor/templates/NOTES.txt b/packages/system/harbor/charts/harbor/templates/NOTES.txt
new file mode 100644
index 00000000..0980c08a
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/NOTES.txt
@@ -0,0 +1,3 @@
+Please wait for several minutes for Harbor deployment to complete.
+Then you should be able to visit the Harbor portal at {{ .Values.externalURL }}
+For more details, please visit https://github.com/goharbor/harbor
diff --git a/packages/system/harbor/charts/harbor/templates/_helpers.tpl b/packages/system/harbor/charts/harbor/templates/_helpers.tpl
new file mode 100644
index 00000000..95643c49
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/_helpers.tpl
@@ -0,0 +1,606 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "harbor.name" -}}
+{{- default "harbor" .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "harbor.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default "harbor" .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/* Helm required labels: legacy */}}
+{{- define "harbor.legacy.labels" -}}
+heritage: {{ .Release.Service }}
+release: {{ .Release.Name }}
+chart: {{ .Chart.Name }}
+app: "{{ template "harbor.name" . }}"
+{{- end -}}
+
+{{/* Helm required labels */}}
+{{- define "harbor.labels" -}}
+heritage: {{ .Release.Service }}
+release: {{ .Release.Name }}
+chart: {{ .Chart.Name }}
+app: "{{ template "harbor.name" . }}"
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/name: {{ include "harbor.name" . }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+app.kubernetes.io/part-of: {{ include "harbor.name" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- end -}}
+
+{{/* matchLabels */}}
+{{- define "harbor.matchLabels" -}}
+release: {{ .Release.Name }}
+app: "{{ template "harbor.name" . }}"
+{{- end -}}
+
+{{/* Helper for printing values from existing secrets*/}}
+{{- define "harbor.secretKeyHelper" -}}
+  {{- if and (not (empty .data)) (hasKey .data .key) }}
+    {{- index .data .key | b64dec -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "harbor.autoGenCert" -}}
+  {{- if and .Values.expose.tls.enabled (eq .Values.expose.tls.certSource "auto") -}}
+    {{- printf "true" -}}
+  {{- else -}}
+    {{- printf "false" -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "harbor.autoGenCertForIngress" -}}
+  {{- if and (eq (include "harbor.autoGenCert" .) "true") (eq .Values.expose.type "ingress") -}}
+    {{- printf "true" -}}
+  {{- else -}}
+    {{- printf "false" -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "harbor.autoGenCertForNginx" -}}
+  {{- if and (eq (include "harbor.autoGenCert" .) "true") (ne .Values.expose.type "ingress") -}}
+    {{- printf "true" -}}
+  {{- else -}}
+    {{- printf "false" -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "harbor.database.host" -}}
+  {{- if eq .Values.database.type "internal" -}}
+    {{- template "harbor.database" . }}
+  {{- else -}}
+    {{- .Values.database.external.host -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "harbor.database.port" -}}
+  {{- if eq .Values.database.type "internal" -}}
+    {{- printf "%s" "5432" -}}
+  {{- else -}}
+    {{- .Values.database.external.port -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "harbor.database.username" -}}
+  {{- if eq .Values.database.type "internal" -}}
+    {{- printf "%s" "postgres" -}}
+  {{- else -}}
+    {{- .Values.database.external.username -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "harbor.database.rawPassword" -}}
+  {{- if eq .Values.database.type "internal" -}}
+    {{- $existingSecret := lookup "v1" "Secret" .Release.Namespace (include "harbor.database" .) -}}
+    {{- if and (not (empty $existingSecret)) (hasKey $existingSecret.data "POSTGRES_PASSWORD") -}}
+      {{- .Values.database.internal.password | default (index $existingSecret.data "POSTGRES_PASSWORD" | b64dec) -}}
+    {{- else -}}
+      {{- .Values.database.internal.password -}}
+    {{- end -}}
+  {{- else -}}
+    {{- .Values.database.external.password -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "harbor.database.escapedRawPassword" -}}
+  {{- include "harbor.database.rawPassword" . | urlquery | replace "+" "%20" -}}
+{{- end -}}
+
+{{- define "harbor.database.encryptedPassword" -}}
+  {{- include "harbor.database.rawPassword" . | b64enc | quote -}}
+{{- end -}}
+
+{{- define "harbor.database.coreDatabase" -}}
+  {{- if eq .Values.database.type "internal" -}}
+    {{- printf "%s" "registry" -}}
+  {{- else -}}
+    {{- .Values.database.external.coreDatabase -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "harbor.database.sslmode" -}}
+  {{- if eq .Values.database.type "internal" -}}
+    {{- printf "%s" "disable" -}}
+  {{- else -}}
+    {{- .Values.database.external.sslmode -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "harbor.redis.scheme" -}}
+  {{- with .Values.redis }}
+    {{- if eq .type "external" -}}
+      {{- if not (not .external.sentinelMasterSet) -}}
+        {{- ternary "rediss+sentinel" "redis+sentinel" (.external.tlsOptions.enable) }}
+      {{- else -}}
+        {{- ternary "rediss" "redis" (.external.tlsOptions.enable) }}
+      {{- end -}}
+    {{- else -}}
+      {{ print "redis" }}
+    {{- end -}}
+  {{- end }}
+{{- end -}}
+
+{{- define "harbor.redis.enableTLS" -}}
+  {{- with .Values.redis }}
+    {{- ternary "true" "false" (and ( eq .type "external") (.external.tlsOptions.enable)) }}
+  {{- end }}
+{{- end -}}
+
+/*host:port*/
+{{- define "harbor.redis.addr" -}}
+  {{- with .Values.redis }}
+    {{- ternary (printf "%s:6379" (include "harbor.redis" $ )) .external.addr (eq .type "internal") }}
+  {{- end }}
+{{- end -}}
+
+{{- define "harbor.redis.masterSet" -}}
+  {{- with .Values.redis }}
+    {{- ternary .external.sentinelMasterSet "" (contains "+sentinel" (include "harbor.redis.scheme" $)) }}
+  {{- end }}
+{{- end -}}
+
+{{- define "harbor.redis.password" -}}
+  {{- with .Values.redis }}
+    {{- ternary "" .external.password (eq .type "internal") }}
+  {{- end }}
+{{- end -}}
+
+
+{{- define "harbor.redis.usernamefromsecret" -}}
+  {{- $existingSecret := (lookup "v1" "Secret"  .Release.Namespace (.Values.redis.external.existingSecret)) -}}
+  {{- if and (not (empty $existingSecret)) (hasKey $existingSecret.data "REDIS_USERNAME") -}}
+    {{- printf "%s" ($existingSecret.data.REDIS_USERNAME | b64dec | trim ) }}
+  {{- end -}}
+{{- end -}}
+
+{{- define "harbor.redis.pwdfromsecret" -}}
+  {{- (lookup "v1" "Secret"  .Release.Namespace (.Values.redis.external.existingSecret)).data.REDIS_PASSWORD  | b64dec }}
+{{- end -}}
+
+{{- define "harbor.redis.cred" -}}
+  {{- with .Values.redis }}
+    {{- if (and (eq .type "external" ) (.external.existingSecret)) }}
+      {{- printf "%s:%s@" (include "harbor.redis.usernamefromsecret" $) (include "harbor.redis.pwdfromsecret" $) -}}
+    {{- else }}
+      {{- ternary (printf "%s:%s@" (.external.username | urlquery) (.external.password | urlquery)) "" (and (eq .type "external" ) (not (not .external.password))) }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+/*scheme://[:password@]host:port[/master_set]*/
+{{- define "harbor.redis.url" -}}
+  {{- with .Values.redis }}
+    {{- $path := ternary "" (printf "/%s" (include "harbor.redis.masterSet" $)) (not (include "harbor.redis.masterSet" $)) }}
+    {{- printf "%s://%s%s%s" (include "harbor.redis.scheme" $) (include "harbor.redis.cred" $) (include "harbor.redis.addr" $) $path -}}
+  {{- end }}
+{{- end -}}
+
+/*scheme://[:password@]addr/db_index?idle_timeout_seconds=30*/
+{{- define "harbor.redis.urlForCore" -}}
+  {{- with .Values.redis }}
+    {{- $index := ternary "0" .external.coreDatabaseIndex (eq .type "internal") }}
+    {{- printf "%s/%s?idle_timeout_seconds=30" (include "harbor.redis.url" $) $index -}}
+  {{- end }}
+{{- end -}}
+
+/*scheme://[:password@]addr/db_index*/
+{{- define "harbor.redis.urlForJobservice" -}}
+  {{- with .Values.redis }}
+    {{- $index := ternary .internal.jobserviceDatabaseIndex .external.jobserviceDatabaseIndex (eq .type "internal") }}
+    {{- printf "%s/%s" (include "harbor.redis.url" $) $index -}}
+  {{- end }}
+{{- end -}}
+
+/*scheme://[:password@]addr/db_index?idle_timeout_seconds=30*/
+{{- define "harbor.redis.urlForRegistry" -}}
+  {{- with .Values.redis }}
+    {{- $index := ternary .internal.registryDatabaseIndex .external.registryDatabaseIndex (eq .type "internal") }}
+    {{- printf "%s/%s?idle_timeout_seconds=30" (include "harbor.redis.url" $) $index -}}
+  {{- end }}
+{{- end -}}
+
+/*scheme://[:password@]addr/db_index?idle_timeout_seconds=30*/
+{{- define "harbor.redis.urlForTrivy" -}}
+  {{- with .Values.redis }}
+    {{- $index := ternary .internal.trivyAdapterIndex .external.trivyAdapterIndex (eq .type "internal") }}
+    {{- printf "%s/%s?idle_timeout_seconds=30" (include "harbor.redis.url" $) $index -}}
+  {{- end }}
+{{- end -}}
+
+/*scheme://[:password@]addr/db_index?idle_timeout_seconds=30*/
+{{- define "harbor.redis.urlForHarbor" -}}
+  {{- with .Values.redis }}
+    {{- $index := ternary .internal.harborDatabaseIndex .external.harborDatabaseIndex (eq .type "internal") }}
+    {{- printf "%s/%s?idle_timeout_seconds=30" (include "harbor.redis.url" $) $index -}}
+  {{- end }}
+{{- end -}}
+
+/*scheme://[:password@]addr/db_index?idle_timeout_seconds=30*/
+{{- define "harbor.redis.urlForCache" -}}
+  {{- with .Values.redis }}
+    {{- $index := ternary .internal.cacheLayerDatabaseIndex .external.cacheLayerDatabaseIndex (eq .type "internal") }}
+    {{- printf "%s/%s?idle_timeout_seconds=30" (include "harbor.redis.url" $) $index -}}
+  {{- end }}
+{{- end -}}
+
+{{- define "harbor.redis.dbForRegistry" -}}
+  {{- with .Values.redis }}
+    {{- ternary .internal.registryDatabaseIndex .external.registryDatabaseIndex (eq .type "internal") }}
+  {{- end }}
+{{- end -}}
+
+{{- define "harbor.portal" -}}
+  {{- printf "%s-portal" (include "harbor.fullname" .) -}}
+{{- end -}}
+
+{{- define "harbor.core" -}}
+  {{- printf "%s-core" (include "harbor.fullname" .) -}}
+{{- end -}}
+
+{{- define "harbor.redis" -}}
+  {{- printf "%s-redis" (include "harbor.fullname" .) -}}
+{{- end -}}
+
+{{- define "harbor.jobservice" -}}
+  {{- printf "%s-jobservice" (include "harbor.fullname" .) -}}
+{{- end -}}
+
+{{- define "harbor.registry" -}}
+  {{- printf "%s-registry" (include "harbor.fullname" .) -}}
+{{- end -}}
+
+{{- define "harbor.registryCtl" -}}
+  {{- printf "%s-registryctl" (include "harbor.fullname" .) -}}
+{{- end -}}
+
+{{- define "harbor.database" -}}
+  {{- printf "%s-database" (include "harbor.fullname" .) -}}
+{{- end -}}
+
+{{- define "harbor.trivy" -}}
+  {{- printf "%s-trivy" (include "harbor.fullname" .) -}}
+{{- end -}}
+
+{{- define "harbor.nginx" -}}
+  {{- printf "%s-nginx" (include "harbor.fullname" .) -}}
+{{- end -}}
+
+{{- define "harbor.exporter" -}}
+  {{- printf "%s-exporter" (include "harbor.fullname" .) -}}
+{{- end -}}
+
+{{- define "harbor.ingress" -}}
+  {{- printf "%s-ingress" (include "harbor.fullname" .) -}}
+{{- end -}}
+
+{{- define "harbor.route" -}}
+  {{- printf "%s-route" (include "harbor.fullname" .) -}}
+{{- end -}}
+
+{{- define "harbor.noProxy" -}}
+  {{- printf "%s,%s,%s,%s,%s,%s,%s,%s" (include "harbor.core" .) (include "harbor.jobservice" .) (include "harbor.database" .) (include "harbor.registry" .) (include "harbor.portal" .) (include "harbor.trivy" .) (include "harbor.exporter" .) .Values.proxy.noProxy -}}
+{{- end -}}
+
+{{- define "harbor.caBundleVolume" -}}
+- name: ca-bundle-certs
+  secret:
+    secretName: {{ .Values.caBundleSecretName }}
+{{- end -}}
+
+{{- define "harbor.caBundleVolumeMount" -}}
+- name: ca-bundle-certs
+  mountPath: /harbor_cust_cert/custom-ca.crt
+  subPath: ca.crt
+{{- end -}}
+
+{{/* scheme for all components because it only support http mode */}}
+{{- define "harbor.component.scheme" -}}
+  {{- if .Values.internalTLS.enabled -}}
+    {{- printf "https" -}}
+  {{- else -}}
+    {{- printf "http" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/* core component container port */}}
+{{- define "harbor.core.containerPort" -}}
+  {{- if .Values.internalTLS.enabled -}}
+    {{- printf "8443" -}}
+  {{- else -}}
+    {{- printf "8080" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/* core component service port */}}
+{{- define "harbor.core.servicePort" -}}
+  {{- if .Values.internalTLS.enabled -}}
+    {{- printf "443" -}}
+  {{- else -}}
+    {{- printf "80" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/* jobservice component container port */}}
+{{- define "harbor.jobservice.containerPort" -}}
+  {{- if .Values.internalTLS.enabled -}}
+    {{- printf "8443" -}}
+  {{- else -}}
+    {{- printf "8080" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/* jobservice component service port */}}
+{{- define "harbor.jobservice.servicePort" -}}
+  {{- if .Values.internalTLS.enabled -}}
+    {{- printf "443" -}}
+  {{- else -}}
+    {{- printf "80" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/* portal component container port */}}
+{{- define "harbor.portal.containerPort" -}}
+  {{- if .Values.internalTLS.enabled -}}
+    {{- printf "8443" -}}
+  {{- else -}}
+    {{- printf "8080" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/* portal component service port */}}
+{{- define "harbor.portal.servicePort" -}}
+  {{- if .Values.internalTLS.enabled -}}
+    {{- printf "443" -}}
+  {{- else -}}
+    {{- printf "80" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/* registry component container port */}}
+{{- define "harbor.registry.containerPort" -}}
+  {{- if .Values.internalTLS.enabled -}}
+    {{- printf "5443" -}}
+  {{- else -}}
+    {{- printf "5000" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/* registry component service port */}}
+{{- define "harbor.registry.servicePort" -}}
+  {{- if .Values.internalTLS.enabled -}}
+    {{- printf "5443" -}}
+  {{- else -}}
+    {{- printf "5000" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/* registryctl component container port */}}
+{{- define "harbor.registryctl.containerPort" -}}
+  {{- if .Values.internalTLS.enabled -}}
+    {{- printf "8443" -}}
+  {{- else -}}
+    {{- printf "8080" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/* registryctl component service port */}}
+{{- define "harbor.registryctl.servicePort" -}}
+  {{- if .Values.internalTLS.enabled -}}
+    {{- printf "8443" -}}
+  {{- else -}}
+    {{- printf "8080" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/* trivy component container port */}}
+{{- define "harbor.trivy.containerPort" -}}
+  {{- if .Values.internalTLS.enabled -}}
+    {{- printf "8443" -}}
+  {{- else -}}
+    {{- printf "8080" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/* trivy component service port */}}
+{{- define "harbor.trivy.servicePort" -}}
+  {{- if .Values.internalTLS.enabled -}}
+    {{- printf "8443" -}}
+  {{- else -}}
+    {{- printf "8080" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/* CORE_URL */}}
+{{/* port is included in this url as a workaround for issue https://github.com/aquasecurity/harbor-scanner-trivy/issues/108 */}}
+{{- define "harbor.coreURL" -}}
+  {{- printf "%s://%s:%s" (include "harbor.component.scheme" .) (include "harbor.core" .) (include "harbor.core.servicePort" .) -}}
+{{- end -}}
+
+{{/* JOBSERVICE_URL */}}
+{{- define "harbor.jobserviceURL" -}}
+  {{- printf "%s://%s-jobservice" (include "harbor.component.scheme" .)  (include "harbor.fullname" .) -}}
+{{- end -}}
+
+{{/* PORTAL_URL */}}
+{{- define "harbor.portalURL" -}}
+  {{- printf "%s://%s" (include "harbor.component.scheme" .) (include "harbor.portal" .) -}}
+{{- end -}}
+
+{{/* REGISTRY_URL */}}
+{{- define "harbor.registryURL" -}}
+  {{- printf "%s://%s:%s" (include "harbor.component.scheme" .) (include "harbor.registry" .) (include "harbor.registry.servicePort" .) -}}
+{{- end -}}
+
+{{/* REGISTRY_CONTROLLER_URL */}}
+{{- define "harbor.registryControllerURL" -}}
+  {{- printf "%s://%s:%s" (include "harbor.component.scheme" .) (include "harbor.registry" .) (include "harbor.registryctl.servicePort" .) -}}
+{{- end -}}
+
+{{/* TOKEN_SERVICE_URL */}}
+{{- define "harbor.tokenServiceURL" -}}
+  {{- printf "%s/service/token" (include "harbor.coreURL" .) -}}
+{{- end -}}
+
+{{/* TRIVY_ADAPTER_URL */}}
+{{- define "harbor.trivyAdapterURL" -}}
+  {{- printf "%s://%s:%s" (include "harbor.component.scheme" .) (include "harbor.trivy" .) (include "harbor.trivy.servicePort" .) -}}
+{{- end -}}
+
+{{- define "harbor.internalTLS.core.secretName" -}}
+  {{- if eq .Values.internalTLS.certSource "secret" -}}
+    {{- .Values.internalTLS.core.secretName -}}
+  {{- else -}}
+    {{- printf "%s-core-internal-tls" (include "harbor.fullname" .) -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "harbor.internalTLS.jobservice.secretName" -}}
+  {{- if eq .Values.internalTLS.certSource "secret" -}}
+    {{- .Values.internalTLS.jobservice.secretName -}}
+  {{- else -}}
+    {{- printf "%s-jobservice-internal-tls" (include "harbor.fullname" .) -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "harbor.internalTLS.portal.secretName" -}}
+  {{- if eq .Values.internalTLS.certSource "secret" -}}
+    {{- .Values.internalTLS.portal.secretName -}}
+  {{- else -}}
+    {{- printf "%s-portal-internal-tls" (include "harbor.fullname" .) -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "harbor.internalTLS.registry.secretName" -}}
+  {{- if eq .Values.internalTLS.certSource "secret" -}}
+    {{- .Values.internalTLS.registry.secretName -}}
+  {{- else -}}
+    {{- printf "%s-registry-internal-tls" (include "harbor.fullname" .) -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "harbor.internalTLS.trivy.secretName" -}}
+  {{- if eq .Values.internalTLS.certSource "secret" -}}
+    {{- .Values.internalTLS.trivy.secretName -}}
+  {{- else -}}
+    {{- printf "%s-trivy-internal-tls" (include "harbor.fullname" .) -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "harbor.tlsCoreSecretForIngress" -}}
+  {{- if eq .Values.expose.tls.certSource "none" -}}
+    {{- printf "" -}}
+  {{- else if eq .Values.expose.tls.certSource "secret" -}}
+    {{- .Values.expose.tls.secret.secretName -}}
+  {{- else -}}
+    {{- include "harbor.ingress" . -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "harbor.tlsSecretForNginx" -}}
+  {{- if eq .Values.expose.tls.certSource "secret" -}}
+    {{- .Values.expose.tls.secret.secretName -}}
+  {{- else -}}
+    {{- include "harbor.nginx" . -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "harbor.metricsPortName" -}}
+  {{- if .Values.internalTLS.enabled }}
+    {{- printf "https-metrics" -}}
+  {{- else -}}
+    {{- printf "http-metrics" -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "harbor.traceEnvs" -}}
+  TRACE_ENABLED: "{{ .Values.trace.enabled }}"
+  TRACE_SAMPLE_RATE: "{{ .Values.trace.sample_rate }}"
+  TRACE_NAMESPACE: "{{ .Values.trace.namespace }}"
+  {{- if .Values.trace.attributes }}
+  TRACE_ATTRIBUTES: {{ .Values.trace.attributes | toJson | squote }}
+  {{- end }}
+  {{- if eq .Values.trace.provider "jaeger" }}
+  TRACE_JAEGER_ENDPOINT: "{{ .Values.trace.jaeger.endpoint }}"
+  TRACE_JAEGER_USERNAME: "{{ .Values.trace.jaeger.username }}"
+  TRACE_JAEGER_AGENT_HOSTNAME: "{{ .Values.trace.jaeger.agent_host }}"
+  TRACE_JAEGER_AGENT_PORT: "{{ .Values.trace.jaeger.agent_port }}"
+  {{- else }}
+  TRACE_OTEL_ENDPOINT: "{{ .Values.trace.otel.endpoint }}"
+  TRACE_OTEL_URL_PATH: "{{ .Values.trace.otel.url_path }}"
+  TRACE_OTEL_COMPRESSION: "{{ .Values.trace.otel.compression }}"
+  TRACE_OTEL_INSECURE: "{{ .Values.trace.otel.insecure }}"
+  TRACE_OTEL_TIMEOUT: "{{ .Values.trace.otel.timeout }}"
+  {{- end }}
+{{- end -}}
+
+{{- define "harbor.traceEnvsForCore" -}}
+  {{- if .Values.trace.enabled }}
+  TRACE_SERVICE_NAME: "harbor-core"
+  {{ include "harbor.traceEnvs" . }}
+  {{- end }}
+{{- end -}}
+
+{{- define "harbor.traceEnvsForJobservice" -}}
+  {{- if .Values.trace.enabled }}
+  TRACE_SERVICE_NAME: "harbor-jobservice"
+  {{ include "harbor.traceEnvs" . }}
+  {{- end }}
+{{- end -}}
+
+{{- define "harbor.traceEnvsForRegistryCtl" -}}
+  {{- if .Values.trace.enabled }}
+  TRACE_SERVICE_NAME: "harbor-registryctl"
+  {{ include "harbor.traceEnvs" . }}
+  {{- end }}
+{{- end -}}
+
+{{- define "harbor.traceJaegerPassword" -}}
+  {{- if and .Values.trace.enabled (eq .Values.trace.provider "jaeger") }}
+  TRACE_JAEGER_PASSWORD: "{{ .Values.trace.jaeger.password | default "" | b64enc }}"
+  {{- end }}
+{{- end -}}
+
+{{/* Allow KubeVersion to be overridden. */}}
+{{- define "harbor.ingress.kubeVersion" -}}
+  {{- default .Capabilities.KubeVersion.Version .Values.expose.ingress.kubeVersionOverride -}}
+{{- end -}}
diff --git a/packages/system/harbor/charts/harbor/templates/core/core-cm.yaml b/packages/system/harbor/charts/harbor/templates/core/core-cm.yaml
new file mode 100644
index 00000000..17a82078
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/core/core-cm.yaml
@@ -0,0 +1,92 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "harbor.core" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+data:
+  app.conf: |+
+    appname = Harbor
+    runmode = prod
+    enablegzip = true
+
+    [prod]
+    httpport = {{ ternary "8443" "8080" .Values.internalTLS.enabled }}
+  PORT: "{{ ternary "8443" "8080" .Values.internalTLS.enabled }}"
+  DATABASE_TYPE: "postgresql"
+  POSTGRESQL_HOST: "{{ template "harbor.database.host" . }}"
+  POSTGRESQL_PORT: "{{ template "harbor.database.port" . }}"
+  POSTGRESQL_USERNAME: "{{ template "harbor.database.username" . }}"
+  POSTGRESQL_DATABASE: "{{ template "harbor.database.coreDatabase" . }}"
+  POSTGRESQL_SSLMODE: "{{ template "harbor.database.sslmode" . }}"
+  POSTGRESQL_MAX_IDLE_CONNS: "{{ .Values.database.maxIdleConns }}"
+  POSTGRESQL_MAX_OPEN_CONNS: "{{ .Values.database.maxOpenConns }}"
+  EXT_ENDPOINT: "{{ .Values.externalURL }}"
+  CORE_URL: "{{ template "harbor.coreURL" . }}"
+  JOBSERVICE_URL: "{{ template "harbor.jobserviceURL" . }}"
+  REGISTRY_URL: "{{ template "harbor.registryURL" . }}"
+  TOKEN_SERVICE_URL: "{{ template "harbor.tokenServiceURL" . }}"
+  CORE_LOCAL_URL: "{{ ternary "https://127.0.0.1:8443" "http://127.0.0.1:8080" .Values.internalTLS.enabled }}"
+  WITH_TRIVY: {{ .Values.trivy.enabled | quote }}
+  TRIVY_ADAPTER_URL: "{{ template "harbor.trivyAdapterURL" . }}"
+  REGISTRY_STORAGE_PROVIDER_NAME: "{{ .Values.persistence.imageChartStorage.type }}"
+  LOG_LEVEL: "{{ .Values.logLevel }}"
+  CONFIG_PATH: "/etc/core/app.conf"
+  CHART_CACHE_DRIVER: "redis"
+  _REDIS_URL_CORE: "{{ template "harbor.redis.urlForCore" . }}"
+  _REDIS_URL_REG: "{{ template "harbor.redis.urlForRegistry" . }}"
+  {{- if or (and (eq .Values.redis.type "internal") .Values.redis.internal.harborDatabaseIndex) (and (eq .Values.redis.type "external") .Values.redis.external.harborDatabaseIndex) }}
+  _REDIS_URL_HARBOR: "{{ template "harbor.redis.urlForHarbor" . }}"
+  {{- end }}
+  {{- if or (and (eq .Values.redis.type "internal") .Values.redis.internal.cacheLayerDatabaseIndex) (and (eq .Values.redis.type "external") .Values.redis.external.cacheLayerDatabaseIndex) }}
+  _REDIS_URL_CACHE_LAYER: "{{ template "harbor.redis.urlForCache" . }}"
+  {{- end }}  
+  PORTAL_URL: "{{ template "harbor.portalURL" . }}"
+  REGISTRY_CONTROLLER_URL: "{{ template "harbor.registryControllerURL" . }}"
+  REGISTRY_CREDENTIAL_USERNAME: "{{ .Values.registry.credentials.username }}"
+  {{- if .Values.uaaSecretName }}
+  UAA_CA_ROOT: "/etc/core/auth-ca/auth-ca.crt"
+  {{- end }}
+  {{- if has "core" .Values.proxy.components }}
+  HTTP_PROXY: "{{ .Values.proxy.httpProxy }}"
+  HTTPS_PROXY: "{{ .Values.proxy.httpsProxy }}"
+  NO_PROXY: "{{ template "harbor.noProxy" . }}"
+  {{- end }}
+  PERMITTED_REGISTRY_TYPES_FOR_PROXY_CACHE: "docker-hub,harbor,azure-acr,ali-acr,aws-ecr,google-gcr,docker-registry,github-ghcr,jfrog-artifactory"
+  REPLICATION_ADAPTER_WHITELIST: "ali-acr,aws-ecr,azure-acr,docker-hub,docker-registry,github-ghcr,google-gcr,harbor,huawei-SWR,jfrog-artifactory,tencent-tcr,volcengine-cr"
+  {{- if .Values.metrics.enabled}}
+  METRIC_ENABLE: "true"
+  METRIC_PATH: "{{ .Values.metrics.core.path }}"
+  METRIC_PORT: "{{ .Values.metrics.core.port }}"
+  METRIC_NAMESPACE: harbor
+  METRIC_SUBSYSTEM: core
+  {{- end }}
+
+  {{- if hasKey .Values.core "gcTimeWindowHours" }}
+  #make the GC time window configurable for testing
+  GC_TIME_WINDOW_HOURS: "{{ .Values.core.gcTimeWindowHours }}"
+  {{- end }}
+  {{- template "harbor.traceEnvsForCore" . }}
+
+  {{- if .Values.core.artifactPullAsyncFlushDuration }}
+  ARTIFACT_PULL_ASYNC_FLUSH_DURATION: {{ .Values.core.artifactPullAsyncFlushDuration | quote }}
+  {{- end }}
+
+  {{- if .Values.core.gdpr}}
+  {{- if .Values.core.gdpr.deleteUser}}
+  GDPR_DELETE_USER: "true"
+  {{- end }}
+  {{- if .Values.core.gdpr.auditLogsCompliant}}
+  GDPR_AUDIT_LOGS: "true"
+  {{- end }}
+  {{- end }}
+
+  {{- if .Values.cache.enabled }}
+  CACHE_ENABLED: "true"
+  CACHE_EXPIRE_HOURS: "{{ .Values.cache.expireHours }}"
+  {{- end }}
+  
+  {{- if .Values.core.quotaUpdateProvider }}
+  QUOTA_UPDATE_PROVIDER: "{{ .Values.core.quotaUpdateProvider }}"
+  {{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/core/core-dpl.yaml b/packages/system/harbor/charts/harbor/templates/core/core-dpl.yaml
new file mode 100644
index 00000000..4705c5f6
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/core/core-dpl.yaml
@@ -0,0 +1,258 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "harbor.core" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+    component: core
+    app.kubernetes.io/component: core
+spec:
+  replicas: {{ .Values.core.replicas }}
+  revisionHistoryLimit: {{ .Values.core.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+{{ include "harbor.matchLabels" . | indent 6 }}
+      component: core
+  template:
+    metadata:
+      labels:
+{{ include "harbor.labels" . | indent 8 }}
+        component: core
+        app.kubernetes.io/component: core
+{{- if .Values.core.podLabels }}
+{{ toYaml .Values.core.podLabels | indent 8 }}
+{{- end }}
+      annotations:
+        checksum/configmap: {{ include (print $.Template.BasePath "/core/core-cm.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }}
+        checksum/secret-jobservice: {{ include (print $.Template.BasePath "/jobservice/jobservice-secrets.yaml") . | sha256sum }}
+{{- if and .Values.internalTLS.enabled (eq .Values.internalTLS.certSource "auto") }}
+        checksum/tls: {{ include (print $.Template.BasePath "/internal/auto-tls.yaml") . | sha256sum }}
+{{- else if and .Values.internalTLS.enabled (eq .Values.internalTLS.certSource "manual") }}
+        checksum/tls: {{ include (print $.Template.BasePath "/core/core-tls.yaml") . | sha256sum }}
+{{- end }}
+{{- if .Values.core.podAnnotations }}
+{{ toYaml .Values.core.podAnnotations | indent 8 }}
+{{- end }}
+    spec:
+      securityContext:
+        runAsUser: 10000
+        fsGroup: 10000
+{{- if .Values.core.serviceAccountName }}
+      serviceAccountName: {{ .Values.core.serviceAccountName }}
+{{- end -}}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      automountServiceAccountToken: {{ .Values.core.automountServiceAccountToken | default false }}
+      terminationGracePeriodSeconds: 120
+{{- with .Values.core.topologySpreadConstraints}}
+      topologySpreadConstraints:
+{{- range . }}
+      - {{ . | toYaml | indent 8 | trim }}
+        labelSelector:
+          matchLabels:
+{{ include "harbor.matchLabels" $ | indent 12 }}
+            component: core
+{{- end }}
+{{- end }}
+      {{- with .Values.core.initContainers }}
+      initContainers:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: core
+        image: {{ .Values.core.image.repository }}:{{ .Values.core.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        {{- if .Values.core.startupProbe.enabled }}
+        startupProbe:
+          httpGet:
+            path: /api/v2.0/ping
+            scheme: {{ include "harbor.component.scheme" . | upper }}
+            port: {{ template "harbor.core.containerPort" . }}
+          failureThreshold: 360
+          initialDelaySeconds: {{ .Values.core.startupProbe.initialDelaySeconds }}
+          periodSeconds: 10
+        {{- end }}
+        livenessProbe:
+          httpGet:
+            path: /api/v2.0/ping
+            scheme: {{ include "harbor.component.scheme" . | upper }}
+            port: {{ template "harbor.core.containerPort" . }}
+          failureThreshold: 2
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /api/v2.0/ping
+            scheme: {{ include "harbor.component.scheme" . | upper }}
+            port: {{ template "harbor.core.containerPort" . }}
+          failureThreshold: 2
+          periodSeconds: 10
+        envFrom:
+        - configMapRef:
+            name: "{{ template "harbor.core" . }}"
+        - secretRef:
+            name: "{{ template "harbor.core" . }}"
+        env:
+          - name: CORE_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: {{ default (include "harbor.core" .) .Values.core.existingSecret }}
+                key: secret
+          - name: JOBSERVICE_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: {{ default (include "harbor.jobservice" .) .Values.jobservice.existingSecret }}
+                {{- if .Values.jobservice.existingSecret }}
+                key: {{ .Values.jobservice.existingSecretKey }}
+                {{- else }}
+                key: JOBSERVICE_SECRET
+                {{- end }}
+          {{- if .Values.existingSecretAdminPassword }}
+          - name: HARBOR_ADMIN_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Values.existingSecretAdminPassword }}
+                key: {{ .Values.existingSecretAdminPasswordKey }}
+          {{- end }}
+          {{- if .Values.internalTLS.enabled }}
+          - name: INTERNAL_TLS_ENABLED
+            value: "true"
+          - name: INTERNAL_TLS_KEY_PATH
+            value: /etc/harbor/ssl/core/tls.key
+          - name: INTERNAL_TLS_CERT_PATH
+            value: /etc/harbor/ssl/core/tls.crt
+          - name: INTERNAL_TLS_TRUST_CA_PATH
+            value: /etc/harbor/ssl/core/ca.crt
+          {{- end }}
+          {{- if .Values.database.external.existingSecret }}
+          - name: POSTGRESQL_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Values.database.external.existingSecret }}
+                key: password
+          {{- end }}
+          {{- if .Values.registry.credentials.existingSecret }}
+          - name: REGISTRY_CREDENTIAL_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Values.registry.credentials.existingSecret }}
+                key: REGISTRY_PASSWD
+          {{- end }}
+          {{- if .Values.core.existingXsrfSecret }}
+          - name: CSRF_KEY
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Values.core.existingXsrfSecret }}
+                key: {{ .Values.core.existingXsrfSecretKey }}
+          {{- end }}
+{{- with .Values.core.extraEnvVars }}
+{{- toYaml . | nindent 10 }}
+{{- end }}
+        {{- if not (empty .Values.containerSecurityContext) }}
+        securityContext: {{ .Values.containerSecurityContext | toYaml | nindent 10 }}
+        {{- end }}
+        ports:
+        - containerPort: {{ template "harbor.core.containerPort" . }}
+        volumeMounts:
+        - name: config
+          mountPath: /etc/core/app.conf
+          subPath: app.conf
+        - name: secret-key
+          mountPath: /etc/core/key
+          subPath: key
+        - name: token-service-private-key
+          mountPath: /etc/core/private_key.pem
+          subPath: tls.key
+        {{- if .Values.expose.tls.enabled }}
+        - name: ca-download
+          mountPath: /etc/core/ca
+        {{- end }}
+        {{- if .Values.uaaSecretName }}
+        - name: auth-ca-cert
+          mountPath: /etc/core/auth-ca/auth-ca.crt
+          subPath: auth-ca.crt
+        {{- end }}
+        {{- if .Values.internalTLS.enabled }}
+        - name: core-internal-certs
+          mountPath: /etc/harbor/ssl/core
+        {{- end }}
+        - name: psc
+          mountPath: /etc/core/token
+        {{- if .Values.caBundleSecretName }}
+{{ include "harbor.caBundleVolumeMount" . | indent 8 }}
+        {{- end }}
+{{- if .Values.core.resources }}
+        resources:
+{{ toYaml .Values.core.resources | indent 10 }}
+{{- end }}
+      volumes:
+      - name: config
+        configMap:
+          name: {{ template "harbor.core" . }}
+          items:
+            - key: app.conf
+              path: app.conf
+      - name: secret-key
+        secret:
+          {{- if .Values.existingSecretSecretKey }}
+          secretName: {{ .Values.existingSecretSecretKey }}
+          {{- else }}
+          secretName: {{ template "harbor.core" . }}
+          {{- end }}
+          items:
+            - key: secretKey
+              path: key
+      - name: token-service-private-key
+        secret:
+          {{- if .Values.core.secretName }}
+          secretName: {{ .Values.core.secretName }}
+          {{- else }}
+          secretName: {{ template "harbor.core" . }}
+          {{- end }}
+      {{- if .Values.expose.tls.enabled }}
+      - name: ca-download
+        secret:
+        {{- if .Values.caSecretName }}
+          secretName: {{ .Values.caSecretName }}
+        {{- else if eq (include "harbor.autoGenCertForIngress" .) "true" }}
+          secretName: "{{ template "harbor.ingress" . }}"
+        {{- else if eq (include "harbor.autoGenCertForNginx" .) "true" }}
+          secretName: {{ template "harbor.tlsSecretForNginx" . }}
+        {{- end }}
+      {{- end }}
+      {{- if .Values.uaaSecretName }}
+      - name: auth-ca-cert
+        secret:
+          secretName: {{ .Values.uaaSecretName }}
+          items:
+            - key: ca.crt
+              path: auth-ca.crt
+      {{- end }}
+      {{- if .Values.internalTLS.enabled }}
+      - name: core-internal-certs
+        secret:
+          secretName: {{ template "harbor.internalTLS.core.secretName" . }}
+      {{- end }}
+      - name: psc
+        emptyDir: {}
+      {{- if .Values.caBundleSecretName }}
+{{ include "harbor.caBundleVolume" . | indent 6 }}
+      {{- end }}
+    {{- with .Values.core.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.core.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.core.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- if .Values.core.priorityClassName }}
+      priorityClassName: {{ .Values.core.priorityClassName }}
+    {{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/core/core-pre-upgrade-job.yaml b/packages/system/harbor/charts/harbor/templates/core/core-pre-upgrade-job.yaml
new file mode 100644
index 00000000..87271569
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/core/core-pre-upgrade-job.yaml
@@ -0,0 +1,78 @@
+{{- if .Values.enableMigrateHelmHook }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: migration-job
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+    component: migrator
+  annotations:
+    # This is what defines this resource as a hook. Without this line, the
+    # job is considered part of the release.
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-weight": "-5"
+spec:
+  template:
+    metadata:
+      labels:
+{{ include "harbor.matchLabels" . | indent 8 }}
+        component: migrator
+    spec:
+      restartPolicy: Never
+      securityContext:
+        runAsUser: 10000
+        fsGroup: 10000
+{{- if .Values.core.serviceAccountName }}
+      serviceAccountName: {{ .Values.core.serviceAccountName }}
+{{- end -}}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      terminationGracePeriodSeconds: 120
+      containers:
+      - name: core-job
+        image: {{ .Values.core.image.repository }}:{{ .Values.core.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        command: ["/harbor/harbor_core", "-mode=migrate"]
+        envFrom:
+        - configMapRef:
+            name: "{{ template "harbor.core" . }}"
+        - secretRef:
+            name: "{{ template "harbor.core" . }}"
+        {{- if .Values.database.external.existingSecret }}
+        env:
+          - name: POSTGRESQL_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Values.database.external.existingSecret }}
+                key: password
+        {{- end }}
+        {{- if not (empty .Values.containerSecurityContext) }}
+        securityContext: {{ .Values.containerSecurityContext | toYaml | nindent 10 }}
+        {{- end }}               
+        volumeMounts:
+        - name: config
+          mountPath: /etc/core/app.conf
+          subPath: app.conf
+      volumes:
+      - name: config
+        configMap:
+          name: {{ template "harbor.core" . }}
+          items:
+            - key: app.conf
+              path: app.conf
+    {{- with .Values.core.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.core.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.core.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/core/core-secret.yaml b/packages/system/harbor/charts/harbor/templates/core/core-secret.yaml
new file mode 100644
index 00000000..ea9d4cfa
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/core/core-secret.yaml
@@ -0,0 +1,37 @@
+{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace (include "harbor.core" .) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "harbor.core" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: Opaque
+data:
+  {{- if not .Values.existingSecretSecretKey }}
+  secretKey: {{ .Values.secretKey | b64enc | quote }}
+  {{- end }}
+  {{- if not .Values.core.existingSecret }}
+  secret: {{ .Values.core.secret | default (include "harbor.secretKeyHelper" (dict "key" "secret" "data" $existingSecret.data)) | default (randAlphaNum 16) | b64enc | quote }}
+  {{- end }}
+  {{- if not .Values.core.secretName }}
+  {{- $ca := genCA "harbor-token-ca" 365 }}
+  tls.key: {{ .Values.core.tokenKey | default $ca.Key | b64enc | quote }}
+  tls.crt: {{ .Values.core.tokenCert | default $ca.Cert | b64enc | quote }}
+  {{- end }}
+  {{- if not .Values.existingSecretAdminPassword }}
+  HARBOR_ADMIN_PASSWORD: {{ .Values.harborAdminPassword | b64enc | quote }}
+  {{- end }}
+  {{- if not .Values.database.external.existingSecret }}
+  POSTGRESQL_PASSWORD: {{ template "harbor.database.encryptedPassword" . }}
+  {{- end }}
+  {{- if not .Values.registry.credentials.existingSecret }}
+  REGISTRY_CREDENTIAL_PASSWORD: {{ .Values.registry.credentials.password | b64enc | quote }}
+  {{- end }}
+  {{- if not .Values.core.existingXsrfSecret }}
+  CSRF_KEY: {{ .Values.core.xsrfKey | default (include "harbor.secretKeyHelper" (dict "key" "CSRF_KEY" "data" $existingSecret.data)) | default (randAlphaNum 32) | b64enc | quote }}
+  {{- end }}
+{{- if .Values.core.configureUserSettings }}
+  CONFIG_OVERWRITE_JSON: {{ .Values.core.configureUserSettings | b64enc | quote }}
+{{- end }}
+  {{- template "harbor.traceJaegerPassword" . }}
diff --git a/packages/system/harbor/charts/harbor/templates/core/core-svc.yaml b/packages/system/harbor/charts/harbor/templates/core/core-svc.yaml
new file mode 100644
index 00000000..a1d2368d
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/core/core-svc.yaml
@@ -0,0 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "harbor.core" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+{{- with .Values.core.serviceAnnotations }}
+  annotations:
+  {{- toYaml . | nindent 4 }}
+{{- end }}
+spec:
+{{- if or (eq .Values.expose.ingress.controller "gce") (eq .Values.expose.ingress.controller "alb")  (eq .Values.expose.ingress.controller "f5-bigip") }}
+  type: NodePort
+{{- end }}
+{{- if .Values.ipFamily.policy }}
+  ipFamilyPolicy: {{ .Values.ipFamily.policy }}
+{{- end }}
+{{- if .Values.ipFamily.families }}
+  ipFamilies: {{ toYaml .Values.ipFamily.families | nindent 4 }}
+{{- end }}
+  ports:
+    - name: {{ ternary "https-web" "http-web" .Values.internalTLS.enabled }}
+      port: {{ template "harbor.core.servicePort" . }}
+      targetPort: {{ template "harbor.core.containerPort" . }}
+{{- if .Values.metrics.enabled}}
+    - name: {{ template "harbor.metricsPortName" . }}
+      port: {{ .Values.metrics.core.port }}
+{{- end }}
+  selector:
+{{ include "harbor.matchLabels" . | indent 4 }}
+    component: core
diff --git a/packages/system/harbor/charts/harbor/templates/core/core-tls.yaml b/packages/system/harbor/charts/harbor/templates/core/core-tls.yaml
new file mode 100644
index 00000000..d90d30c8
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/core/core-tls.yaml
@@ -0,0 +1,16 @@
+{{- if and .Values.internalTLS.enabled }}
+{{- if eq .Values.internalTLS.certSource "manual" }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "harbor.internalTLS.core.secretName" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: kubernetes.io/tls
+data:
+  ca.crt: {{ (required "The \"internalTLS.trustCa\" is required!" .Values.internalTLS.trustCa) | b64enc | quote }}
+  tls.crt: {{ (required "The \"internalTLS.core.crt\" is required!" .Values.internalTLS.core.crt) | b64enc | quote }}
+  tls.key: {{ (required "The \"internalTLS.core.key\" is required!" .Values.internalTLS.core.key) | b64enc | quote }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/database/database-secret.yaml b/packages/system/harbor/charts/harbor/templates/database/database-secret.yaml
new file mode 100644
index 00000000..0d07ec26
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/database/database-secret.yaml
@@ -0,0 +1,12 @@
+{{- if eq .Values.database.type "internal" -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "harbor.database" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: Opaque
+data:
+  POSTGRES_PASSWORD: {{ template "harbor.database.encryptedPassword" . }}
+{{- end -}}
diff --git a/packages/system/harbor/charts/harbor/templates/database/database-ss.yaml b/packages/system/harbor/charts/harbor/templates/database/database-ss.yaml
new file mode 100644
index 00000000..8bddd291
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/database/database-ss.yaml
@@ -0,0 +1,165 @@
+{{- if eq .Values.database.type "internal" -}}
+{{- $database := .Values.persistence.persistentVolumeClaim.database -}}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: "{{ template "harbor.database" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+    component: database
+    app.kubernetes.io/component: database
+spec:
+  replicas: 1
+  serviceName: "{{ template "harbor.database" . }}"
+  selector:
+    matchLabels:
+{{ include "harbor.matchLabels" . | indent 6 }}
+      component: database
+  template:
+    metadata:
+      labels:
+{{ include "harbor.labels" . | indent 8 }}
+        component: database
+        app.kubernetes.io/component: database
+{{- if .Values.database.podLabels }}
+{{ toYaml .Values.database.podLabels | indent 8 }}
+{{- end }}
+      annotations:
+        checksum/secret: {{ include (print $.Template.BasePath "/database/database-secret.yaml") . | sha256sum }}
+{{- if .Values.database.podAnnotations }}
+{{ toYaml .Values.database.podAnnotations | indent 8 }}
+{{- end }}
+    spec:
+      securityContext:
+        runAsUser: 999
+        fsGroup: 999
+{{- if .Values.database.internal.serviceAccountName }}
+      serviceAccountName: {{ .Values.database.internal.serviceAccountName }}
+{{- end -}}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      automountServiceAccountToken: {{ .Values.database.internal.automountServiceAccountToken | default false }}
+      terminationGracePeriodSeconds: 120
+      initContainers:
+      # with "fsGroup" set, each time a volume is mounted, Kubernetes must recursively chown() and chmod() all the files and directories inside the volume
+      # this causes the postgresql reports the "data directory /var/lib/postgresql/data/pgdata has group or world access" issue when using some CSIs e.g. Ceph
+      # use this init container to correct the permission
+      # as "fsGroup" applied before the init container running, the container has enough permission to execute the command
+      - name: "data-permissions-ensurer"
+        image: {{ .Values.database.internal.image.repository }}:{{ .Values.database.internal.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        {{- if not (empty .Values.containerSecurityContext) }}
+        securityContext: {{ .Values.containerSecurityContext | toYaml | nindent 10 }}
+        {{- end }}
+        command: ["/bin/sh"]
+        args: ["-c", "chmod -R 700 /var/lib/postgresql/data/pgdata || true"]
+{{- if .Values.database.internal.initContainer.permissions.resources }}
+        resources:
+{{ toYaml .Values.database.internal.initContainer.permissions.resources | indent 10 }}
+{{- end }}
+        volumeMounts:
+          - name: database-data
+            mountPath: /var/lib/postgresql/data
+            subPath: {{ $database.subPath }}
+      {{- with .Values.database.internal.extrInitContainers }}
+      {{- toYaml . | nindent 6 }}
+      {{- end }}
+      containers:
+      - name: database
+        image: {{ .Values.database.internal.image.repository }}:{{ .Values.database.internal.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        {{- if not (empty .Values.containerSecurityContext) }}
+        securityContext: {{ .Values.containerSecurityContext | toYaml | nindent 10 }}
+        {{- end }}
+        livenessProbe:
+          exec:
+            command:
+            - /docker-healthcheck.sh
+          initialDelaySeconds: 300
+          periodSeconds: 10
+          timeoutSeconds: {{ .Values.database.internal.livenessProbe.timeoutSeconds }}
+        readinessProbe:
+          exec:
+            command:
+            - /docker-healthcheck.sh
+          initialDelaySeconds: 1
+          periodSeconds: 10
+          timeoutSeconds: {{ .Values.database.internal.readinessProbe.timeoutSeconds }}
+{{- if .Values.database.internal.resources }}
+        resources:
+{{ toYaml .Values.database.internal.resources | indent 10 }}
+{{- end }}
+        envFrom:
+          - secretRef:
+              name: "{{ template "harbor.database" . }}"
+        env:
+          # put the data into a sub directory to avoid the permission issue in k8s with restricted psp enabled
+          # more detail refer to https://github.com/goharbor/harbor-helm/issues/756
+          - name: PGDATA
+            value: "/var/lib/postgresql/data/pgdata"
+{{- with .Values.database.internal.extraEnvVars }}
+{{- toYaml . | nindent 10 }}
+{{- end }}
+        volumeMounts:
+        - name: database-data
+          mountPath: /var/lib/postgresql/data
+          subPath: {{ $database.subPath }}
+        - name: shm-volume
+          mountPath: /dev/shm
+      volumes:
+      - name: shm-volume
+        emptyDir:
+          medium: Memory
+          sizeLimit: {{ .Values.database.internal.shmSizeLimit }}
+      {{- if not .Values.persistence.enabled }}
+      - name: "database-data"
+        emptyDir: {}
+      {{- else if $database.existingClaim }}
+      - name: "database-data"
+        persistentVolumeClaim:
+          claimName: {{ $database.existingClaim }}
+      {{- end -}}
+    {{- with .Values.database.internal.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.database.internal.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.database.internal.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- if .Values.database.internal.priorityClassName }}
+      priorityClassName: {{ .Values.database.internal.priorityClassName }}
+    {{- end }}
+  {{- if and .Values.persistence.enabled (not $database.existingClaim) }}
+  volumeClaimTemplates:
+  - apiVersion: v1	
+    kind: PersistentVolumeClaim
+    metadata:
+      name: "database-data"
+      labels:
+{{ include "harbor.legacy.labels" . | indent 8 }}
+      annotations:
+      {{- range $key, $value := $database.annotations }}
+        {{ $key }}: {{ $value | quote }}
+      {{- end }}
+    spec:
+      accessModes: [{{ $database.accessMode | quote }}]
+      {{- if $database.storageClass }}
+      {{- if (eq "-" $database.storageClass) }}
+      storageClassName: ""
+      {{- else }}
+      storageClassName: "{{ $database.storageClass }}"
+      {{- end }}
+      {{- end }}
+      resources:
+        requests:
+          storage: {{ $database.size | quote }}
+  {{- end -}}
+  {{- end -}}
diff --git a/packages/system/harbor/charts/harbor/templates/database/database-svc.yaml b/packages/system/harbor/charts/harbor/templates/database/database-svc.yaml
new file mode 100644
index 00000000..aef4c6df
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/database/database-svc.yaml
@@ -0,0 +1,21 @@
+{{- if eq .Values.database.type "internal" -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ template "harbor.database" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+spec:
+{{- if .Values.ipFamily.policy }}
+  ipFamilyPolicy: {{ .Values.ipFamily.policy }}
+{{- end }}
+{{- if .Values.ipFamily.families }}
+  ipFamilies: {{ toYaml .Values.ipFamily.families | nindent 4 }}
+{{- end }}
+  ports:
+    - port: 5432
+  selector:
+{{ include "harbor.matchLabels" . | indent 4 }}
+    component: database
+{{- end -}}
diff --git a/packages/system/harbor/charts/harbor/templates/exporter/exporter-cm-env.yaml b/packages/system/harbor/charts/harbor/templates/exporter/exporter-cm-env.yaml
new file mode 100644
index 00000000..3f911032
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/exporter/exporter-cm-env.yaml
@@ -0,0 +1,36 @@
+{{- if .Values.metrics.enabled}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "{{ template "harbor.exporter" . }}-env"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+data:
+  {{- if has "jobservice" .Values.proxy.components }}
+  HTTP_PROXY: "{{ .Values.proxy.httpProxy }}"
+  HTTPS_PROXY: "{{ .Values.proxy.httpsProxy }}"
+  NO_PROXY: "{{ template "harbor.noProxy" . }}"
+  {{- end }}
+  LOG_LEVEL: "{{ .Values.logLevel }}"
+  HARBOR_EXPORTER_PORT: "{{ .Values.metrics.exporter.port }}"
+  HARBOR_EXPORTER_METRICS_PATH: "{{ .Values.metrics.exporter.path }}"
+  HARBOR_EXPORTER_METRICS_ENABLED: "{{ .Values.metrics.enabled }}"
+  HARBOR_EXPORTER_CACHE_TIME: "{{ .Values.exporter.cacheDuration }}"
+  HARBOR_EXPORTER_CACHE_CLEAN_INTERVAL: "{{ .Values.exporter.cacheCleanInterval }}"
+  HARBOR_METRIC_NAMESPACE: harbor
+  HARBOR_METRIC_SUBSYSTEM: exporter
+  HARBOR_REDIS_URL: "{{ template "harbor.redis.urlForJobservice" . }}"
+  HARBOR_REDIS_NAMESPACE: harbor_job_service_namespace
+  HARBOR_REDIS_TIMEOUT: "3600"
+  HARBOR_SERVICE_SCHEME: "{{ template "harbor.component.scheme" . }}"
+  HARBOR_SERVICE_HOST: "{{ template "harbor.core" . }}"
+  HARBOR_SERVICE_PORT: "{{ template "harbor.core.servicePort" . }}"
+  HARBOR_DATABASE_HOST: "{{ template "harbor.database.host" . }}"
+  HARBOR_DATABASE_PORT: "{{ template "harbor.database.port" . }}"
+  HARBOR_DATABASE_USERNAME: "{{ template "harbor.database.username" . }}"
+  HARBOR_DATABASE_DBNAME: "{{ template "harbor.database.coreDatabase" . }}"
+  HARBOR_DATABASE_SSLMODE: "{{ template "harbor.database.sslmode" . }}"
+  HARBOR_DATABASE_MAX_IDLE_CONNS: "{{ .Values.database.maxIdleConns }}"
+  HARBOR_DATABASE_MAX_OPEN_CONNS: "{{ .Values.database.maxOpenConns }}"
+{{- end}}
diff --git a/packages/system/harbor/charts/harbor/templates/exporter/exporter-dpl.yaml b/packages/system/harbor/charts/harbor/templates/exporter/exporter-dpl.yaml
new file mode 100644
index 00000000..30894a6d
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/exporter/exporter-dpl.yaml
@@ -0,0 +1,146 @@
+{{- if .Values.metrics.enabled}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "harbor.exporter" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+    component: exporter
+    app.kubernetes.io/component: exporter
+spec:
+  replicas: {{ .Values.exporter.replicas }}
+  revisionHistoryLimit: {{ .Values.exporter.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+{{ include "harbor.matchLabels" . | indent 6 }}
+      component: exporter
+  template:
+    metadata:
+      labels:
+{{ include "harbor.labels" . | indent 8 }}
+        component: exporter
+        app.kubernetes.io/component: exporter
+{{- if .Values.exporter.podLabels }}
+{{ toYaml .Values.exporter.podLabels | indent 8 }}
+{{- end }}
+      annotations:
+        checksum/configmap: {{ include (print $.Template.BasePath "/exporter/exporter-cm-env.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/exporter/exporter-secret.yaml") . | sha256sum }}
+{{- if and .Values.internalTLS.enabled (eq .Values.internalTLS.certSource "auto") }}
+        checksum/tls: {{ include (print $.Template.BasePath "/internal/auto-tls.yaml") . | sha256sum }}
+{{- else if and .Values.internalTLS.enabled (eq .Values.internalTLS.certSource "manual") }}
+        checksum/tls: {{ include (print $.Template.BasePath "/core/core-tls.yaml") . | sha256sum }}
+{{- end }}
+{{- if .Values.exporter.podAnnotations }}
+{{ toYaml .Values.exporter.podAnnotations | indent 8 }}
+{{- end }}
+    spec:
+      securityContext:
+        runAsUser: 10000
+        fsGroup: 10000
+{{- if .Values.exporter.serviceAccountName }}
+      serviceAccountName: {{ .Values.exporter.serviceAccountName }}
+{{- end -}}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      automountServiceAccountToken: {{ .Values.exporter.automountServiceAccountToken | default false }}
+{{- with .Values.exporter.topologySpreadConstraints }}
+      topologySpreadConstraints:
+{{- range . }}
+      - {{ . | toYaml | indent 8 | trim }}
+        labelSelector:
+          matchLabels:
+{{ include "harbor.matchLabels" $ | indent 12 }}
+            component: exporter
+{{- end }}
+{{- end }}
+      containers:
+      - name: exporter
+        image: {{ .Values.exporter.image.repository }}:{{ .Values.exporter.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        livenessProbe:
+          httpGet:
+            path: /
+            port: {{ .Values.metrics.exporter.port }}
+          initialDelaySeconds: 300
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /
+            port: {{ .Values.metrics.exporter.port }}
+          initialDelaySeconds: 30
+          periodSeconds: 10
+        args: ["-log-level", "{{ .Values.logLevel }}"]
+        envFrom:
+        - configMapRef:
+            name: "{{ template "harbor.exporter" . }}-env"
+        - secretRef:
+            name: "{{ template "harbor.exporter" . }}"
+        env:
+        {{- if .Values.database.external.existingSecret }}
+        - name: HARBOR_DATABASE_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.database.external.existingSecret }}
+              key: password
+        {{- end }}
+        {{- if .Values.existingSecretAdminPassword }}
+        - name: HARBOR_ADMIN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.existingSecretAdminPassword }}
+              key: {{ .Values.existingSecretAdminPasswordKey }}
+        {{- end }}
+        {{- with .Values.exporter.extraEnvVars }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+{{- if .Values.exporter.resources }}
+        resources:
+{{ toYaml .Values.exporter.resources | indent 10 }}
+{{- end }}
+        {{- if not (empty .Values.containerSecurityContext) }}
+        securityContext: {{ .Values.containerSecurityContext | toYaml | nindent 10 }}
+        {{- end }}
+        ports:
+        - containerPort: {{ .Values.metrics.exporter.port }}
+        volumeMounts:
+        {{- if .Values.caBundleSecretName }}
+{{ include "harbor.caBundleVolumeMount" . | indent 8 }}
+        {{- end }}
+        {{- if .Values.internalTLS.enabled }}
+        - name: core-internal-certs
+          mountPath: /etc/harbor/ssl/core
+          # There are some metric data are collectd from harbor core.
+          # When internal TLS is enabled, the Exporter need the CA file to collect these data.
+        {{- end }}
+      volumes:
+      - name: config
+        secret:
+          secretName: "{{ template "harbor.exporter" . }}"
+      {{- if .Values.internalTLS.enabled }}
+      - name: core-internal-certs
+        secret:
+          secretName: {{ template "harbor.internalTLS.core.secretName" . }}
+      {{- end }}
+      {{- if .Values.caBundleSecretName }}
+{{ include "harbor.caBundleVolume" . | indent 6 }}
+      {{- end }}
+    {{- with .Values.exporter.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.exporter.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.exporter.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- if .Values.exporter.priorityClassName }}
+      priorityClassName: {{ .Values.exporter.priorityClassName }}
+    {{- end }}
+{{ end }}
diff --git a/packages/system/harbor/charts/harbor/templates/exporter/exporter-secret.yaml b/packages/system/harbor/charts/harbor/templates/exporter/exporter-secret.yaml
new file mode 100644
index 00000000..02c74d03
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/exporter/exporter-secret.yaml
@@ -0,0 +1,17 @@
+{{- if .Values.metrics.enabled}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "harbor.exporter" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: Opaque
+data:
+{{- if not .Values.existingSecretAdminPassword }}
+  HARBOR_ADMIN_PASSWORD: {{ .Values.harborAdminPassword | b64enc | quote }}
+{{- end }}
+{{- if not .Values.database.external.existingSecret }}
+  HARBOR_DATABASE_PASSWORD: {{ template "harbor.database.encryptedPassword" . }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/exporter/exporter-svc.yaml b/packages/system/harbor/charts/harbor/templates/exporter/exporter-svc.yaml
new file mode 100644
index 00000000..11306e27
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/exporter/exporter-svc.yaml
@@ -0,0 +1,22 @@
+{{- if .Values.metrics.enabled}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ template "harbor.exporter" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+spec:
+{{- if .Values.ipFamily.policy }}
+  ipFamilyPolicy: {{ .Values.ipFamily.policy }}
+{{- end }}
+{{- if .Values.ipFamily.families }}
+  ipFamilies: {{ toYaml .Values.ipFamily.families | nindent 4 }}
+{{- end }}
+  ports:
+    - name: {{ template "harbor.metricsPortName" . }}
+      port: {{ .Values.metrics.exporter.port }}
+  selector:
+{{ include "harbor.matchLabels" . | indent 4 }}
+    component: exporter
+{{ end }}
diff --git a/packages/system/harbor/charts/harbor/templates/gateway-apis/route.yaml b/packages/system/harbor/charts/harbor/templates/gateway-apis/route.yaml
new file mode 100644
index 00000000..0999a5ff
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/gateway-apis/route.yaml
@@ -0,0 +1,55 @@
+{{- if eq .Values.expose.type "route" }}
+{{- $route := .Values.expose.route -}}
+{{- $_ := set . "path_type" "PathPrefix" -}}
+{{- $_ := set . "portal_path" "/" -}}
+{{- $_ := set . "api_path" "/api/" -}}
+{{- $_ := set . "service_path" "/service/" -}}
+{{- $_ := set . "v2_path" "/v2/" -}}
+{{- $_ := set . "controller_path" "/c/" -}}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: "{{ template "harbor.route" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+{{- if $route.labels }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+{{ toYaml $route.labels | indent 4 }}
+{{- end }}
+{{- if $route.annotations }}
+  annotations:
+{{ toYaml $route.annotations | indent 4 }}
+{{- end }}
+spec:
+  parentRefs:
+  {{- toYaml $route.parentRefs | nindent 2 }}
+  hostnames: 
+  {{- toYaml $route.hosts | nindent 2 }}
+  rules:
+  - matches:
+    - path:
+        type: {{ .path_type }}
+        value: {{ .api_path }}
+    - path:
+        type: {{ .path_type }}
+        value: {{ .service_path }}
+    - path:
+        type: {{ .path_type }}
+        value: {{ .v2_path }}
+    - path:
+        type: {{ .path_type }}
+        value: {{ .controller_path }}
+    backendRefs:
+    - name: {{ template "harbor.core" . }}
+      namespace: {{ .Release.Namespace | quote }}
+      port: {{ template "harbor.core.servicePort" . }}
+  - matches:
+    - path:
+        type: {{ .path_type }}
+        value: {{ .portal_path }}
+    backendRefs:
+    - name: {{ template "harbor.portal" . }}
+      namespace: {{ .Release.Namespace | quote }}
+      port: {{ template "harbor.portal.servicePort" . }}
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/ingress/ingress.yaml b/packages/system/harbor/charts/harbor/templates/ingress/ingress.yaml
new file mode 100644
index 00000000..06096b86
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/ingress/ingress.yaml
@@ -0,0 +1,132 @@
+{{- if eq .Values.expose.type "ingress" }}
+{{- $ingress := .Values.expose.ingress -}}
+{{- $tls := .Values.expose.tls -}}
+{{- if eq .Values.expose.ingress.controller "gce" }}
+  {{- $_ := set . "path_type" "ImplementationSpecific" -}}
+  {{- $_ := set . "portal_path" "/*" -}}
+  {{- $_ := set . "api_path" "/api/*" -}}
+  {{- $_ := set . "service_path" "/service/*" -}}
+  {{- $_ := set . "v2_path" "/v2/*" -}}
+  {{- $_ := set . "controller_path" "/c/*" -}}
+{{- else if eq .Values.expose.ingress.controller "ncp" }}
+  {{- $_ := set . "path_type" "Prefix" -}}
+  {{- $_ := set . "portal_path" "/.*" -}}
+  {{- $_ := set . "api_path" "/api/.*" -}}
+  {{- $_ := set . "service_path" "/service/.*" -}}
+  {{- $_ := set . "v2_path" "/v2/.*" -}}
+  {{- $_ := set . "controller_path" "/c/.*" -}}
+{{- else }}
+  {{- $_ := set . "path_type" "Prefix" -}}
+  {{- $_ := set . "portal_path" "/" -}}
+  {{- $_ := set . "api_path" "/api/" -}}
+  {{- $_ := set . "service_path" "/service/" -}}
+  {{- $_ := set . "v2_path" "/v2/" -}}
+  {{- $_ := set . "controller_path" "/c/" -}}
+{{- end }}
+
+---
+{{- if semverCompare "<1.14-0" (include "harbor.ingress.kubeVersion" .) }}
+apiVersion: extensions/v1beta1
+{{- else if semverCompare "<1.19-0" (include "harbor.ingress.kubeVersion" .) }}
+apiVersion: networking.k8s.io/v1beta1
+{{- else }}
+apiVersion: networking.k8s.io/v1
+{{- end }}
+kind: Ingress
+metadata:
+  name: "{{ template "harbor.ingress" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+{{- if $ingress.labels }}
+{{ toYaml $ingress.labels | indent 4 }}
+{{- end }}
+  annotations:
+{{ toYaml $ingress.annotations | indent 4 }}
+{{- if .Values.internalTLS.enabled }}
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+{{- end }}
+{{- if eq .Values.expose.ingress.controller "ncp" }}
+    ncp/use-regex: "true"
+    {{- if $tls.enabled }}
+    ncp/http-redirect: "true"
+    {{- end }}
+{{- end }}
+spec:
+  {{- if $ingress.className }}
+  ingressClassName: {{ $ingress.className }}
+  {{- end }}
+  {{- if $tls.enabled }}
+  tls:
+  - secretName: {{ template "harbor.tlsCoreSecretForIngress" . }}
+    {{- if $ingress.hosts.core }}
+    hosts:
+    - {{ $ingress.hosts.core }}
+    {{- end }}
+  {{- end }}
+  rules:
+  - http:
+      paths:
+{{- if semverCompare "<1.19-0" (include "harbor.ingress.kubeVersion" .) }}
+      - path: {{ .api_path }}
+        backend:
+          serviceName: {{ template "harbor.core" . }}
+          servicePort: {{ template "harbor.core.servicePort" . }}
+      - path: {{ .service_path }}
+        backend:
+          serviceName: {{ template "harbor.core" . }}
+          servicePort: {{ template "harbor.core.servicePort" . }}
+      - path: {{ .v2_path }}
+        backend:
+          serviceName: {{ template "harbor.core" . }}
+          servicePort: {{ template "harbor.core.servicePort" . }}
+      - path: {{ .controller_path }}
+        backend:
+          serviceName: {{ template "harbor.core" . }}
+          servicePort: {{ template "harbor.core.servicePort" . }}
+      - path: {{ .portal_path }}
+        backend:
+          serviceName: {{ template "harbor.portal" . }}
+          servicePort: {{ template "harbor.portal.servicePort" . }}
+{{- else }}
+      - path: {{ .api_path }}
+        pathType: {{ .path_type }}
+        backend:
+          service:
+            name: {{ template "harbor.core" . }}
+            port:
+              number: {{ template "harbor.core.servicePort" . }}
+      - path: {{ .service_path }}
+        pathType: {{ .path_type }}
+        backend:
+          service:
+            name: {{ template "harbor.core" . }}
+            port:
+              number: {{ template "harbor.core.servicePort" . }}
+      - path: {{ .v2_path }}
+        pathType: {{ .path_type }}
+        backend:
+          service:
+            name: {{ template "harbor.core" . }}
+            port:
+              number: {{ template "harbor.core.servicePort" . }}
+      - path: {{ .controller_path }}
+        pathType: {{ .path_type }}
+        backend:
+          service:
+            name: {{ template "harbor.core" . }}
+            port:
+              number: {{ template "harbor.core.servicePort" . }}
+      - path: {{ .portal_path }}
+        pathType: {{ .path_type }}
+        backend:
+          service:
+            name: {{ template "harbor.portal" . }}
+            port:
+              number: {{ template "harbor.portal.servicePort" . }}
+{{- end }}
+    {{- if $ingress.hosts.core }}
+    host: {{ $ingress.hosts.core }}
+    {{- end }}
+
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/ingress/secret.yaml b/packages/system/harbor/charts/harbor/templates/ingress/secret.yaml
new file mode 100644
index 00000000..48343b0f
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/ingress/secret.yaml
@@ -0,0 +1,18 @@
+{{- if eq .Values.expose.type "ingress" }}
+{{- if eq (include "harbor.autoGenCertForIngress" .) "true" }}
+{{- $ca := genCA "harbor-ca" 365 }}
+{{- $cert := genSignedCert .Values.expose.ingress.hosts.core nil (list .Values.expose.ingress.hosts.core) 365 $ca }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "harbor.ingress" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: kubernetes.io/tls
+data:
+  tls.crt: {{ $cert.Cert | b64enc | quote }}
+  tls.key: {{ $cert.Key | b64enc | quote }}
+  ca.crt: {{ $ca.Cert | b64enc | quote }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/internal/auto-tls.yaml b/packages/system/harbor/charts/harbor/templates/internal/auto-tls.yaml
new file mode 100644
index 00000000..32807cfd
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/internal/auto-tls.yaml
@@ -0,0 +1,86 @@
+{{- if and .Values.internalTLS.enabled (eq .Values.internalTLS.certSource "auto") }}
+{{- $ca := genCA "harbor-internal-ca" 365 }}
+{{- $coreCN := (include "harbor.core" .) }}
+{{- $coreCrt := genSignedCert $coreCN (list "127.0.0.1") (list "localhost" $coreCN) 365 $ca }}
+{{- $jsCN := (include "harbor.jobservice" .) }}
+{{- $jsCrt := genSignedCert $jsCN nil (list $jsCN) 365 $ca }}
+{{- $regCN := (include "harbor.registry" .) }}
+{{- $regCrt := genSignedCert $regCN nil (list $regCN) 365 $ca }}
+{{- $portalCN := (include "harbor.portal" .) }}
+{{- $portalCrt := genSignedCert $portalCN nil (list $portalCN) 365 $ca }}
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "harbor.internalTLS.core.secretName" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: kubernetes.io/tls
+data:
+  ca.crt: {{ $ca.Cert | b64enc | quote }}
+  tls.crt: {{ $coreCrt.Cert | b64enc | quote }}
+  tls.key: {{ $coreCrt.Key | b64enc | quote }}
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "harbor.internalTLS.jobservice.secretName" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: kubernetes.io/tls
+data:
+  ca.crt: {{ $ca.Cert | b64enc | quote }}
+  tls.crt: {{ $jsCrt.Cert | b64enc | quote }}
+  tls.key: {{ $jsCrt.Key | b64enc | quote }}
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "harbor.internalTLS.registry.secretName" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: kubernetes.io/tls
+data:
+  ca.crt: {{ $ca.Cert | b64enc | quote }}
+  tls.crt: {{ $regCrt.Cert | b64enc | quote }}
+  tls.key: {{ $regCrt.Key | b64enc | quote }}
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "harbor.internalTLS.portal.secretName" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: kubernetes.io/tls
+data:
+  ca.crt: {{ $ca.Cert | b64enc | quote }}
+  tls.crt: {{ $portalCrt.Cert | b64enc | quote }}
+  tls.key: {{ $portalCrt.Key | b64enc | quote }}
+
+{{- if and .Values.trivy.enabled}}
+---
+{{- $trivyCN := (include "harbor.trivy" .) }}
+{{- $trivyCrt := genSignedCert $trivyCN nil (list $trivyCN) 365 $ca }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "harbor.internalTLS.trivy.secretName" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: kubernetes.io/tls
+data:
+  ca.crt: {{ $ca.Cert | b64enc | quote }}
+  tls.crt: {{ $trivyCrt.Cert | b64enc | quote }}
+  tls.key: {{ $trivyCrt.Key | b64enc | quote }}
+{{- end }}
+
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-cm-env.yaml b/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-cm-env.yaml
new file mode 100644
index 00000000..f1359131
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-cm-env.yaml
@@ -0,0 +1,37 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "{{ template "harbor.jobservice" . }}-env"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+data:
+  CORE_URL: "{{ template "harbor.coreURL" . }}"
+  TOKEN_SERVICE_URL: "{{ template "harbor.tokenServiceURL" . }}"
+  REGISTRY_URL: "{{ template "harbor.registryURL" . }}"
+  REGISTRY_CONTROLLER_URL: "{{ template "harbor.registryControllerURL" . }}"
+  REGISTRY_CREDENTIAL_USERNAME: "{{ .Values.registry.credentials.username }}"
+
+  JOBSERVICE_WEBHOOK_JOB_MAX_RETRY: "{{ .Values.jobservice.notification.webhook_job_max_retry }}"
+  JOBSERVICE_WEBHOOK_JOB_HTTP_CLIENT_TIMEOUT: "{{ .Values.jobservice.notification.webhook_job_http_client_timeout }}"
+
+  LOG_LEVEL: "{{ .Values.logLevel }}"
+  
+  {{- if has "jobservice" .Values.proxy.components }}
+  HTTP_PROXY: "{{ .Values.proxy.httpProxy }}"
+  HTTPS_PROXY: "{{ .Values.proxy.httpsProxy }}"
+  NO_PROXY: "{{ template "harbor.noProxy" . }}"
+  {{- end }}
+  {{- if .Values.metrics.enabled}}
+  METRIC_NAMESPACE: harbor
+  METRIC_SUBSYSTEM: jobservice
+  {{- end }}
+  {{- template "harbor.traceEnvsForJobservice" . }}
+  {{- if .Values.cache.enabled }}
+  _REDIS_URL_CORE: "{{ template "harbor.redis.urlForCore" . }}"
+  CACHE_ENABLED: "true"
+  CACHE_EXPIRE_HOURS: "{{ .Values.cache.expireHours }}"
+  {{- end }}
+  {{- if or (and (eq .Values.redis.type "internal") .Values.redis.internal.cacheLayerDatabaseIndex) (and (eq .Values.redis.type "external") .Values.redis.external.cacheLayerDatabaseIndex) }}
+  _REDIS_URL_CACHE_LAYER: "{{ template "harbor.redis.urlForCache" . }}"
+  {{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-cm.yaml b/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-cm.yaml
new file mode 100644
index 00000000..c950e678
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-cm.yaml
@@ -0,0 +1,58 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "{{ template "harbor.jobservice" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+data:
+  config.yml: |+
+    #Server listening port
+    protocol: "{{ template "harbor.component.scheme" . }}"
+    port: {{ template "harbor.jobservice.containerPort". }}
+    {{- if .Values.internalTLS.enabled }}
+    https_config:
+      cert: "/etc/harbor/ssl/jobservice/tls.crt"
+      key: "/etc/harbor/ssl/jobservice/tls.key"
+    {{- end }}
+    worker_pool:
+      workers: {{ .Values.jobservice.maxJobWorkers }}
+      backend: "redis"
+      redis_pool:
+        redis_url: "{{ template "harbor.redis.urlForJobservice" . }}"
+        namespace: "harbor_job_service_namespace"
+        idle_timeout_second: 3600
+    job_loggers:
+      {{- if has "file" .Values.jobservice.jobLoggers }}
+      - name: "FILE"
+        level: {{ .Values.logLevel | upper }}
+        settings: # Customized settings of logger
+          base_dir: "/var/log/jobs"
+        sweeper:
+          duration: {{ .Values.jobservice.loggerSweeperDuration }} #days
+          settings: # Customized settings of sweeper
+            work_dir: "/var/log/jobs"
+      {{- end }}
+      {{- if has "database" .Values.jobservice.jobLoggers }}
+      - name: "DB"
+        level: {{ .Values.logLevel | upper }}
+        sweeper:
+          duration: {{ .Values.jobservice.loggerSweeperDuration }} #days
+      {{- end }}
+      {{- if has "stdout" .Values.jobservice.jobLoggers }}
+      - name: "STD_OUTPUT"
+        level: {{ .Values.logLevel | upper }}
+      {{- end }}
+    metric:
+      enabled: {{ .Values.metrics.enabled }}
+      path: {{ .Values.metrics.jobservice.path }}
+      port: {{ .Values.metrics.jobservice.port }}
+    #Loggers for the job service
+    loggers:
+      - name: "STD_OUTPUT"
+        level: {{ .Values.logLevel | upper }}
+    reaper:
+      # the max time to wait for a task to finish, if unfinished after max_update_hours, the task will be mark as error, but the task will continue to run, default value is 24
+      max_update_hours: {{ .Values.jobservice.reaper.max_update_hours }}
+      # the max time for execution in running state without new task created
+      max_dangling_hours: {{ .Values.jobservice.reaper.max_dangling_hours }}
diff --git a/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-dpl.yaml b/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-dpl.yaml
new file mode 100644
index 00000000..3e426694
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-dpl.yaml
@@ -0,0 +1,183 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ template "harbor.jobservice" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+    component: jobservice
+    app.kubernetes.io/component: jobservice
+spec:
+  replicas: {{ .Values.jobservice.replicas }}
+  revisionHistoryLimit: {{ .Values.jobservice.revisionHistoryLimit }}
+  strategy:
+    type: {{ .Values.updateStrategy.type }}
+    {{- if eq .Values.updateStrategy.type "Recreate" }}
+    rollingUpdate: null
+    {{- end }}
+  selector:
+    matchLabels:
+{{ include "harbor.matchLabels" . | indent 6 }}
+      component: jobservice
+  template:
+    metadata:
+      labels:
+{{ include "harbor.labels" . | indent 8 }}
+        component: jobservice
+        app.kubernetes.io/component: jobservice
+{{- if .Values.jobservice.podLabels }}
+{{ toYaml .Values.jobservice.podLabels | indent 8 }}
+{{- end }}
+      annotations:
+        checksum/configmap: {{ include (print $.Template.BasePath "/jobservice/jobservice-cm.yaml") . | sha256sum }}
+        checksum/configmap-env: {{ include (print $.Template.BasePath "/jobservice/jobservice-cm-env.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/jobservice/jobservice-secrets.yaml") . | sha256sum }}
+        checksum/secret-core: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }}
+{{- if and .Values.internalTLS.enabled (eq .Values.internalTLS.certSource "auto") }}
+        checksum/tls: {{ include (print $.Template.BasePath "/internal/auto-tls.yaml") . | sha256sum }}
+{{- else if and .Values.internalTLS.enabled (eq .Values.internalTLS.certSource "manual") }}
+        checksum/tls: {{ include (print $.Template.BasePath "/jobservice/jobservice-tls.yaml") . | sha256sum }}
+{{- end }}
+{{- if .Values.jobservice.podAnnotations }}
+{{ toYaml .Values.jobservice.podAnnotations | indent 8 }}
+{{- end }}
+    spec:
+      securityContext:
+        runAsUser: 10000
+        fsGroup: 10000
+{{- if .Values.jobservice.serviceAccountName }}
+      serviceAccountName: {{ .Values.jobservice.serviceAccountName }}
+{{- end -}}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      automountServiceAccountToken: {{ .Values.jobservice.automountServiceAccountToken | default false }}
+      terminationGracePeriodSeconds: 120
+{{- with .Values.jobservice.topologySpreadConstraints}}
+      topologySpreadConstraints:
+{{- range . }}
+      - {{ . | toYaml | indent 8 | trim }}
+        labelSelector:
+          matchLabels:
+{{ include "harbor.matchLabels" $ | indent 12 }}
+            component: jobservice
+{{- end }}
+{{- end }}
+      {{- with .Values.jobservice.initContainers }}
+      initContainers:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: jobservice
+        image: {{ .Values.jobservice.image.repository }}:{{ .Values.jobservice.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        livenessProbe:
+          httpGet:
+            path: /api/v1/stats
+            scheme: {{ include "harbor.component.scheme" . | upper }}
+            port: {{ template "harbor.jobservice.containerPort" . }}
+          initialDelaySeconds: 300
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /api/v1/stats
+            scheme: {{ include "harbor.component.scheme" . | upper }}
+            port: {{ template "harbor.jobservice.containerPort" . }}
+          initialDelaySeconds: 20
+          periodSeconds: 10
+{{- if .Values.jobservice.resources }}
+        resources:
+{{ toYaml .Values.jobservice.resources | indent 10 }}
+{{- end }}
+        env:
+          - name: CORE_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: {{ default (include "harbor.core" .) .Values.core.existingSecret }}
+                key: secret
+          {{- if .Values.jobservice.existingSecret }}
+          - name: JOBSERVICE_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Values.jobservice.existingSecret }}
+                key: {{ .Values.jobservice.existingSecretKey }}
+          {{- end }}
+          {{- if .Values.internalTLS.enabled }}
+          - name: INTERNAL_TLS_ENABLED
+            value: "true"
+          - name: INTERNAL_TLS_KEY_PATH
+            value: /etc/harbor/ssl/jobservice/tls.key
+          - name: INTERNAL_TLS_CERT_PATH
+            value: /etc/harbor/ssl/jobservice/tls.crt
+          - name: INTERNAL_TLS_TRUST_CA_PATH
+            value: /etc/harbor/ssl/jobservice/ca.crt
+          {{- end }}
+          {{- if .Values.registry.credentials.existingSecret }}
+          - name: REGISTRY_CREDENTIAL_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Values.registry.credentials.existingSecret }}
+                key: REGISTRY_PASSWD
+          {{- end }}
+{{- with .Values.jobservice.extraEnvVars }}
+{{- toYaml . | nindent 10 }}
+{{- end }}
+        {{- if not (empty .Values.containerSecurityContext) }}
+        securityContext: {{ .Values.containerSecurityContext | toYaml | nindent 10 }}
+        {{- end }}
+        envFrom:
+        - configMapRef:
+            name: "{{ template "harbor.jobservice" . }}-env"
+        - secretRef:
+            name: "{{ template "harbor.jobservice" . }}"
+        ports:
+        - containerPort: {{ template "harbor.jobservice.containerPort" . }}
+        volumeMounts:
+        - name: jobservice-config
+          mountPath: /etc/jobservice/config.yml
+          subPath: config.yml
+        - name: job-logs
+          mountPath: /var/log/jobs
+          subPath: {{ .Values.persistence.persistentVolumeClaim.jobservice.jobLog.subPath }}
+        {{- if .Values.internalTLS.enabled }}
+        - name: jobservice-internal-certs
+          mountPath: /etc/harbor/ssl/jobservice
+        {{- end }}
+        {{- if .Values.caBundleSecretName }}
+{{ include "harbor.caBundleVolumeMount" . | indent 8 }}
+        {{- end }}
+      volumes:
+      - name: jobservice-config
+        configMap:
+          name: "{{ template "harbor.jobservice" . }}"
+      - name: job-logs
+        {{- if and .Values.persistence.enabled (has "file" .Values.jobservice.jobLoggers) }}
+        persistentVolumeClaim:
+          claimName: {{ .Values.persistence.persistentVolumeClaim.jobservice.jobLog.existingClaim | default (include "harbor.jobservice" .) }}
+        {{- else }}
+        emptyDir: {}
+        {{- end }}
+      {{- if .Values.internalTLS.enabled }}
+      - name: jobservice-internal-certs
+        secret:
+          secretName: {{ template "harbor.internalTLS.jobservice.secretName" . }}
+      {{- end }}
+      {{- if .Values.caBundleSecretName }}
+{{ include "harbor.caBundleVolume" . | indent 6 }}
+      {{- end }}
+    {{- with .Values.jobservice.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.jobservice.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.jobservice.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- if .Values.jobservice.priorityClassName }}
+      priorityClassName: {{ .Values.jobservice.priorityClassName }}
+    {{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-pvc.yaml b/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-pvc.yaml
new file mode 100644
index 00000000..eb781eed
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-pvc.yaml
@@ -0,0 +1,32 @@
+{{- $jobLog := .Values.persistence.persistentVolumeClaim.jobservice.jobLog -}}
+{{- if and .Values.persistence.enabled (not $jobLog.existingClaim) (has "file" .Values.jobservice.jobLoggers) }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ template "harbor.jobservice" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  annotations:
+  {{- range $key, $value := $jobLog.annotations }}
+    {{ $key }}: {{ $value | quote }}
+  {{- end }}
+  {{- if eq .Values.persistence.resourcePolicy "keep" }}
+    helm.sh/resource-policy: keep
+  {{- end }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+    component: jobservice
+    app.kubernetes.io/component: jobservice
+spec:
+  accessModes: 
+    - {{ $jobLog.accessMode }}
+  resources:
+    requests:
+      storage: {{ $jobLog.size }}
+  {{- if $jobLog.storageClass }}
+    {{- if eq "-" $jobLog.storageClass }}
+  storageClassName: ""
+    {{- else }}
+  storageClassName: {{ $jobLog.storageClass }}
+    {{- end }}
+  {{- end }}
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-secrets.yaml b/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-secrets.yaml
new file mode 100644
index 00000000..7706c351
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-secrets.yaml
@@ -0,0 +1,17 @@
+{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace (include "harbor.jobservice" .) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "harbor.jobservice" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: Opaque
+data:
+  {{- if not .Values.jobservice.existingSecret }}
+  JOBSERVICE_SECRET: {{ .Values.jobservice.secret | default (include "harbor.secretKeyHelper" (dict "key" "JOBSERVICE_SECRET" "data" $existingSecret.data)) | default (randAlphaNum 16) | b64enc | quote }}
+  {{- end }}
+  {{- if not .Values.registry.credentials.existingSecret }}
+  REGISTRY_CREDENTIAL_PASSWORD: {{ .Values.registry.credentials.password | b64enc | quote }}
+  {{- end }}
+  {{- template "harbor.traceJaegerPassword" . }}
diff --git a/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-svc.yaml b/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-svc.yaml
new file mode 100644
index 00000000..9bddc43c
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-svc.yaml
@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ template "harbor.jobservice" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+spec:
+{{- if .Values.ipFamily.policy }}
+  ipFamilyPolicy: {{ .Values.ipFamily.policy }}
+{{- end }}
+{{- if .Values.ipFamily.families }}
+  ipFamilies: {{ toYaml .Values.ipFamily.families | nindent 4 }}
+{{- end }}
+  ports:
+    - name: {{ ternary "https-jobservice" "http-jobservice" .Values.internalTLS.enabled }}
+      port: {{ template "harbor.jobservice.servicePort" . }}
+      targetPort: {{ template "harbor.jobservice.containerPort" . }}
+{{- if .Values.metrics.enabled }}
+    - name: {{ template "harbor.metricsPortName" . }}
+      port: {{ .Values.metrics.jobservice.port }}
+{{- end }}
+  selector:
+{{ include "harbor.matchLabels" . | indent 4 }}
+    component: jobservice
diff --git a/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-tls.yaml b/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-tls.yaml
new file mode 100644
index 00000000..58809ec4
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/jobservice/jobservice-tls.yaml
@@ -0,0 +1,16 @@
+{{- if and .Values.internalTLS.enabled }}
+{{- if eq .Values.internalTLS.certSource "manual" }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "harbor.internalTLS.jobservice.secretName" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: kubernetes.io/tls
+data:
+  ca.crt: {{ (required "The \"internalTLS.trustCa\" is required!" .Values.internalTLS.trustCa) | b64enc | quote }}
+  tls.crt: {{ (required "The \"internalTLS.jobservice.crt\" is required!" .Values.internalTLS.jobservice.crt) | b64enc | quote }}
+  tls.key: {{ (required "The \"internalTLS.jobservice.key\" is required!" .Values.internalTLS.jobservice.key) | b64enc | quote }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/metrics/metrics-svcmon.yaml b/packages/system/harbor/charts/harbor/templates/metrics/metrics-svcmon.yaml
new file mode 100644
index 00000000..d566285e
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/metrics/metrics-svcmon.yaml
@@ -0,0 +1,29 @@
+{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ template "harbor.fullname" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels: {{ include "harbor.labels" . | nindent 4 }}
+{{- if .Values.metrics.serviceMonitor.additionalLabels }}
+{{ toYaml .Values.metrics.serviceMonitor.additionalLabels | indent 4 }}
+{{- end }}
+spec:
+  jobLabel: app.kubernetes.io/name
+  endpoints:
+  - port:  {{ template "harbor.metricsPortName" . }}
+    {{- if .Values.metrics.serviceMonitor.interval }}
+    interval: {{ .Values.metrics.serviceMonitor.interval }}
+    {{- end }}
+    honorLabels: true
+{{- if .Values.metrics.serviceMonitor.metricRelabelings }}
+    metricRelabelings:
+{{ tpl (toYaml .Values.metrics.serviceMonitor.metricRelabelings | indent 4) . }}
+{{- end }}
+{{- if .Values.metrics.serviceMonitor.relabelings }}
+    relabelings:
+{{ toYaml .Values.metrics.serviceMonitor.relabelings | indent 4 }}
+{{- end }}
+  selector:
+    matchLabels: {{ include "harbor.matchLabels" . | nindent 6 }}
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/nginx/configmap-http.yaml b/packages/system/harbor/charts/harbor/templates/nginx/configmap-http.yaml
new file mode 100644
index 00000000..78efa187
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/nginx/configmap-http.yaml
@@ -0,0 +1,136 @@
+{{- if and (ne .Values.expose.type "ingress") (ne .Values.expose.type "route") (not .Values.expose.tls.enabled) }}
+{{- $scheme := (include "harbor.component.scheme" .) -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "harbor.nginx" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+data:
+  nginx.conf: |+
+    worker_processes auto;
+    pid /tmp/nginx.pid;
+
+    events {
+      worker_connections 3096;
+      use epoll;
+      multi_accept on;
+    }
+
+    http {
+      client_body_temp_path /tmp/client_body_temp;
+      proxy_temp_path /tmp/proxy_temp;
+      fastcgi_temp_path /tmp/fastcgi_temp;
+      uwsgi_temp_path /tmp/uwsgi_temp;
+      scgi_temp_path /tmp/scgi_temp;
+      tcp_nodelay on;
+
+      # this is necessary for us to be able to disable request buffering in all cases
+      proxy_http_version 1.1;
+
+      upstream core {
+        server "{{ template "harbor.core" . }}:{{ template "harbor.core.servicePort" . }}";
+      }
+
+      upstream portal {
+        server {{ template "harbor.portal" . }}:{{ template "harbor.portal.servicePort" . }};
+      }
+
+      log_format timed_combined '[$time_local]:$remote_addr - '
+        '"$request" $status $body_bytes_sent '
+        '"$http_referer" "$http_user_agent" '
+        '$request_time $upstream_response_time $pipe';
+
+      access_log /dev/stdout timed_combined;
+
+      map $http_x_forwarded_proto $x_forwarded_proto {
+        default $http_x_forwarded_proto;
+        ""      $scheme;
+      }
+
+      server {
+        {{- if .Values.ipFamily.ipv4.enabled}}
+        listen 8080;
+        {{- end}}
+        {{- if .Values.ipFamily.ipv6.enabled }}
+        listen [::]:8080;
+        {{- end }}
+        server_tokens off;
+        # disable any limits to avoid HTTP 413 for large image uploads
+        client_max_body_size 0;
+
+        # Add extra headers
+        add_header X-Frame-Options DENY;
+        add_header Content-Security-Policy "frame-ancestors 'none'";
+
+        location / {
+          proxy_pass {{ $scheme }}://portal/;
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $x_forwarded_proto;
+
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+
+        location /api/ {
+          proxy_pass {{ $scheme }}://core/api/;
+        {{- if and .Values.internalTLS.enabled }}
+          proxy_ssl_verify        off;
+          proxy_ssl_session_reuse on;
+        {{- end }}
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $x_forwarded_proto;
+
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+
+        location /c/ {
+          proxy_pass {{ $scheme }}://core/c/;
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $x_forwarded_proto;
+
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+
+        location /v1/ {
+          return 404;
+        }
+
+        location /v2/ {
+          proxy_pass {{ $scheme }}://core/v2/;
+          proxy_set_header Host $http_host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $x_forwarded_proto;
+          proxy_buffering off;
+          proxy_request_buffering off;
+          proxy_send_timeout 900;
+          proxy_read_timeout 900;
+        }
+
+        location /service/ {
+          proxy_pass {{ $scheme }}://core/service/;
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $x_forwarded_proto;
+
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+
+      location /service/notifications {
+          return 404;
+        }
+      }
+    }
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/nginx/configmap-https.yaml b/packages/system/harbor/charts/harbor/templates/nginx/configmap-https.yaml
new file mode 100644
index 00000000..3a80e292
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/nginx/configmap-https.yaml
@@ -0,0 +1,173 @@
+{{- if and (ne .Values.expose.type "ingress") (ne .Values.expose.type "route") (.Values.expose.tls.enabled) }}
+{{- $scheme := (include "harbor.component.scheme" .) -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "harbor.nginx" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+data:
+  nginx.conf: |+
+    worker_processes auto;
+    pid /tmp/nginx.pid;
+
+    events {
+      worker_connections 3096;
+      use epoll;
+      multi_accept on;
+    }
+
+    http {
+      client_body_temp_path /tmp/client_body_temp;
+      proxy_temp_path /tmp/proxy_temp;
+      fastcgi_temp_path /tmp/fastcgi_temp;
+      uwsgi_temp_path /tmp/uwsgi_temp;
+      scgi_temp_path /tmp/scgi_temp;
+      tcp_nodelay on;
+
+      # this is necessary for us to be able to disable request buffering in all cases
+      proxy_http_version 1.1;
+
+      upstream core {
+        server "{{ template "harbor.core" . }}:{{ template "harbor.core.servicePort" . }}";
+      }
+
+      upstream portal {
+        server "{{ template "harbor.portal" . }}:{{ template "harbor.portal.servicePort" . }}";
+      }
+
+      log_format timed_combined '[$time_local]:$remote_addr - '
+        '"$request" $status $body_bytes_sent '
+        '"$http_referer" "$http_user_agent" '
+        '$request_time $upstream_response_time $pipe';
+
+      access_log /dev/stdout timed_combined;
+
+      map $http_x_forwarded_proto $x_forwarded_proto {
+        default $http_x_forwarded_proto;
+        ""      $scheme;
+      }
+
+      server {
+        {{- if .Values.ipFamily.ipv4.enabled }}
+        listen 8443 ssl;
+        {{- end}}
+        {{- if .Values.ipFamily.ipv6.enabled }}
+        listen [::]:8443 ssl;
+        {{- end }}
+    #    server_name harbordomain.com;
+        server_tokens off;
+        # SSL
+        ssl_certificate /etc/nginx/cert/tls.crt;
+        ssl_certificate_key /etc/nginx/cert/tls.key;
+
+        # Recommendations from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
+        ssl_protocols TLSv1.2 TLSv1.3;
+        {{- if .Values.internalTLS.strong_ssl_ciphers }}
+        ssl_ciphers ECDHE+AESGCM:DHE+AESGCM:ECDHE+RSA+SHA256:DHE+RSA+SHA256:!AES128;
+        {{ else }}
+        ssl_ciphers '!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES:';
+        {{- end }}
+        ssl_prefer_server_ciphers on;
+        ssl_session_cache shared:SSL:10m;
+
+        # disable any limits to avoid HTTP 413 for large image uploads
+        client_max_body_size 0;
+
+        # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
+        chunked_transfer_encoding on;
+
+        # Add extra headers
+        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
+        add_header X-Frame-Options DENY;
+        add_header Content-Security-Policy "frame-ancestors 'none'";
+
+        location / {
+          proxy_pass {{ $scheme }}://portal/;
+          proxy_set_header Host $http_host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $x_forwarded_proto;
+
+          proxy_cookie_path / "/; HttpOnly; Secure";
+
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+
+        location /api/ {
+          proxy_pass {{ $scheme }}://core/api/;
+        {{- if and .Values.internalTLS.enabled }}
+          proxy_ssl_verify        off;
+          proxy_ssl_session_reuse on;
+        {{- end }}
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $x_forwarded_proto;
+
+          proxy_cookie_path / "/; Secure";
+
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+
+        location /c/ {
+          proxy_pass {{ $scheme }}://core/c/;
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $x_forwarded_proto;
+
+          proxy_cookie_path / "/; Secure";
+
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+
+        location /v1/ {
+          return 404;
+        }
+
+        location /v2/ {
+          proxy_pass {{ $scheme }}://core/v2/;
+          proxy_set_header Host $http_host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $x_forwarded_proto;
+          proxy_buffering off;
+          proxy_request_buffering off;
+          proxy_send_timeout 900;
+          proxy_read_timeout 900;
+        }
+
+        location /service/ {
+          proxy_pass {{ $scheme }}://core/service/;
+          proxy_set_header Host $http_host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $x_forwarded_proto;
+
+          proxy_cookie_path / "/; Secure";
+
+          proxy_buffering off;
+          proxy_request_buffering off;
+        }
+
+      location /service/notifications {
+          return 404;
+        }
+      }
+        server {
+          {{- if .Values.ipFamily.ipv4.enabled }}
+          listen 8080;
+          {{- end}}
+          {{- if .Values.ipFamily.ipv6.enabled }}
+          listen [::]:8080;
+          {{- end}}
+          #server_name harbordomain.com;
+          return 301 https://$host$request_uri;
+      }
+    }
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/nginx/deployment.yaml b/packages/system/harbor/charts/harbor/templates/nginx/deployment.yaml
new file mode 100644
index 00000000..0c8bc40f
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/nginx/deployment.yaml
@@ -0,0 +1,133 @@
+{{- if and (ne .Values.expose.type "ingress") (ne .Values.expose.type "route") }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "harbor.nginx" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+    component: nginx
+    app.kubernetes.io/component: nginx
+spec:
+  replicas: {{ .Values.nginx.replicas }}
+  revisionHistoryLimit: {{ .Values.nginx.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+{{ include "harbor.matchLabels" . | indent 6 }}
+      component: nginx
+  template:
+    metadata:
+      labels:
+{{ include "harbor.labels" . | indent 8 }}
+        component: nginx
+        app.kubernetes.io/component: nginx
+{{- if .Values.nginx.podLabels }}
+{{ toYaml .Values.nginx.podLabels | indent 8 }}
+{{- end }}
+      annotations:
+      {{- if not .Values.expose.tls.enabled }}
+        checksum/configmap: {{ include (print $.Template.BasePath "/nginx/configmap-http.yaml") . | sha256sum }}
+      {{- else }}
+        checksum/configmap: {{ include (print $.Template.BasePath "/nginx/configmap-https.yaml") . | sha256sum }}
+      {{- end }}
+      {{- if eq (include "harbor.autoGenCertForNginx" .) "true" }}
+        checksum/secret: {{ include (print $.Template.BasePath "/nginx/secret.yaml") . | sha256sum }}
+      {{- end }}
+{{- if .Values.nginx.podAnnotations }}
+{{ toYaml .Values.nginx.podAnnotations | indent 8 }}
+{{- end }}
+    spec:
+{{- if .Values.nginx.serviceAccountName }}
+      serviceAccountName: {{ .Values.nginx.serviceAccountName }}
+{{- end }}
+      securityContext:
+        runAsUser: 10000
+        fsGroup: 10000
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      automountServiceAccountToken: {{ .Values.nginx.automountServiceAccountToken | default false }}
+{{- with .Values.nginx.topologySpreadConstraints}}
+      topologySpreadConstraints:
+{{- range . }}
+      - {{ . | toYaml | indent 8 | trim }}
+        labelSelector:
+          matchLabels:
+{{ include "harbor.matchLabels" $ | indent 12 }}
+            component: nginx
+{{- end }}
+{{- end }}
+      containers:
+      - name: nginx
+        image: "{{ .Values.nginx.image.repository }}:{{ .Values.nginx.image.tag }}"
+        imagePullPolicy: "{{ .Values.imagePullPolicy }}"
+        {{- $_ := set . "scheme" "HTTP" -}}
+        {{- $_ := set . "port" "8080" -}}
+        {{- if .Values.expose.tls.enabled }}
+          {{- $_ := set . "scheme" "HTTPS" -}}
+          {{- $_ := set . "port" "8443" -}}
+        {{- end }}
+        livenessProbe:
+          httpGet:
+            scheme: {{ .scheme }}
+            path: /
+            port: {{ .port }}
+          initialDelaySeconds: 300
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            scheme: {{ .scheme }}
+            path: /
+            port: {{ .port }}
+          initialDelaySeconds: 1
+          periodSeconds: 10
+{{- if .Values.nginx.resources }}
+        resources:
+{{ toYaml .Values.nginx.resources | indent 10 }}
+{{- end }}
+{{- with .Values.nginx.extraEnvVars }}
+        env:
+{{- toYaml . | nindent 10 }}
+{{- end }}
+        {{- if not (empty .Values.containerSecurityContext) }}
+        securityContext: {{ .Values.containerSecurityContext | toYaml | nindent 10 }}
+        {{- end }}
+        ports:
+        - containerPort: 8080
+        {{- if .Values.expose.tls.enabled }}
+        - containerPort: 8443
+        {{- end }}
+        volumeMounts:
+        - name: config
+          mountPath: /etc/nginx/nginx.conf
+          subPath: nginx.conf
+        {{- if .Values.expose.tls.enabled }}
+        - name: certificate
+          mountPath: /etc/nginx/cert
+        {{- end }}
+      volumes:
+      - name: config
+        configMap:
+          name: {{ template "harbor.nginx" . }}
+      {{- if .Values.expose.tls.enabled }}
+      - name: certificate
+        secret:
+          secretName: {{ template "harbor.tlsSecretForNginx" . }}
+      {{- end }}
+    {{- with .Values.nginx.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.nginx.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.nginx.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- if .Values.nginx.priorityClassName }}
+      priorityClassName: {{ .Values.nginx.priorityClassName }}
+    {{- end }}
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/nginx/secret.yaml b/packages/system/harbor/charts/harbor/templates/nginx/secret.yaml
new file mode 100644
index 00000000..b855e7e9
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/nginx/secret.yaml
@@ -0,0 +1,26 @@
+{{- if and (ne .Values.expose.type "ingress") (ne .Values.expose.type "route") (.Values.expose.tls.enabled) }}
+{{- if eq (include "harbor.autoGenCertForNginx" .) "true" }}
+{{- $ca := genCA "harbor-ca" 365 }}
+{{- $cn := (required "The \"expose.tls.auto.commonName\" is required!" .Values.expose.tls.auto.commonName) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "harbor.nginx" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: Opaque
+data:
+  {{- if regexMatch `^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$` $cn }}
+  {{- $cert := genSignedCert $cn (list $cn) nil 365 $ca }}
+  tls.crt: {{ $cert.Cert | b64enc | quote }}
+  tls.key: {{ $cert.Key | b64enc | quote }}
+  ca.crt: {{ $ca.Cert | b64enc | quote }}
+  {{- else }}
+  {{- $cert := genSignedCert $cn nil (list $cn) 365 $ca }}
+  tls.crt: {{ $cert.Cert | b64enc | quote }}
+  tls.key: {{ $cert.Key | b64enc | quote }}
+  ca.crt: {{ $ca.Cert | b64enc | quote }}
+  {{- end }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/nginx/service.yaml b/packages/system/harbor/charts/harbor/templates/nginx/service.yaml
new file mode 100644
index 00000000..9554cd43
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/nginx/service.yaml
@@ -0,0 +1,101 @@
+{{- if or (eq .Values.expose.type "clusterIP") (eq .Values.expose.type "nodePort") (eq .Values.expose.type "loadBalancer") }}
+apiVersion: v1
+kind: Service
+metadata:
+{{- if eq .Values.expose.type "clusterIP" }}
+{{- $clusterIP := .Values.expose.clusterIP }}
+  name: {{ $clusterIP.name }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+{{- if .Values.expose.clusterIP.labels }}
+{{ toYaml $clusterIP.labels | indent 4 }}
+{{- end }}
+{{- with $clusterIP.annotations }}
+  annotations:
+  {{- toYaml . | nindent 4 }}
+{{- end }}
+spec:
+  type: ClusterIP
+  {{- if .Values.expose.clusterIP.staticClusterIP }}
+  clusterIP: {{ .Values.expose.clusterIP.staticClusterIP }}
+  {{- end }}
+  {{- if .Values.ipFamily.policy }}
+  ipFamilyPolicy: {{ .Values.ipFamily.policy }}
+  {{- end }}
+  {{- if .Values.ipFamily.families }}
+  ipFamilies: {{ toYaml .Values.ipFamily.families }}
+  {{- end }}
+  ports:
+    - name: http
+      port: {{ $clusterIP.ports.httpPort }}
+      targetPort: 8080
+    {{- if .Values.expose.tls.enabled }}
+    - name: https
+      port: {{ $clusterIP.ports.httpsPort }}
+      targetPort: 8443
+    {{- end }}
+{{- else if eq .Values.expose.type "nodePort" }}
+{{- $nodePort := .Values.expose.nodePort }}
+  name: {{ $nodePort.name }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+{{- if .Values.expose.nodePort.labels }}
+{{ toYaml $nodePort.labels | indent 4 }}
+{{- end }}
+{{- with $nodePort.annotations }}
+  annotations:
+  {{- toYaml . | nindent 4 }}
+{{- end }}
+spec:
+  type: NodePort
+  ports:
+    - name: http
+      port: {{ $nodePort.ports.http.port }}
+      targetPort: 8080
+      {{- if $nodePort.ports.http.nodePort }}
+      nodePort: {{ $nodePort.ports.http.nodePort }}
+      {{- end }}
+    {{- if .Values.expose.tls.enabled }}
+    - name: https
+      port: {{ $nodePort.ports.https.port }}
+      targetPort: 8443
+      {{- if $nodePort.ports.https.nodePort }}
+      nodePort: {{ $nodePort.ports.https.nodePort }}
+      {{- end }}
+    {{- end }}
+{{- else if eq .Values.expose.type "loadBalancer" }}
+{{- $loadBalancer := .Values.expose.loadBalancer }}
+  name: {{ $loadBalancer.name }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+{{- if .Values.expose.loadBalancer.labels }}
+{{ toYaml $loadBalancer.labels | indent 4 }}
+{{- end }}
+{{- with $loadBalancer.annotations }}
+  annotations:
+  {{- toYaml . | nindent 4 }}
+{{- end }}
+spec:
+  type: LoadBalancer
+  {{- with $loadBalancer.sourceRanges }}
+  loadBalancerSourceRanges:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- if $loadBalancer.IP }}
+  loadBalancerIP: {{ $loadBalancer.IP }}
+  {{- end }}
+  ports:
+    - name: http
+      port: {{ $loadBalancer.ports.httpPort }}
+      targetPort: 8080
+    {{- if .Values.expose.tls.enabled }}
+    - name: https
+      port: {{ $loadBalancer.ports.httpsPort }}
+      targetPort: 8443
+    {{- end }}
+{{- end }}
+  selector:
+{{ include "harbor.matchLabels" . | indent 4 }}
+    component: nginx
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/portal/configmap.yaml b/packages/system/harbor/charts/harbor/templates/portal/configmap.yaml
new file mode 100644
index 00000000..af56783a
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/portal/configmap.yaml
@@ -0,0 +1,68 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "{{ template "harbor.portal" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+data:
+  nginx.conf: |+
+    worker_processes auto;
+    pid /tmp/nginx.pid;
+    events {
+        worker_connections  1024;
+    }
+    http {
+        client_body_temp_path /tmp/client_body_temp;
+        proxy_temp_path /tmp/proxy_temp;
+        fastcgi_temp_path /tmp/fastcgi_temp;
+        uwsgi_temp_path /tmp/uwsgi_temp;
+        scgi_temp_path /tmp/scgi_temp;
+        server {
+    {{- if .Values.internalTLS.enabled }}
+            {{- if .Values.ipFamily.ipv4.enabled}}
+            listen {{ template "harbor.portal.containerPort" . }} ssl;
+            {{- end }}
+            {{- if .Values.ipFamily.ipv6.enabled}}
+            listen [::]:{{ template "harbor.portal.containerPort" . }} ssl;
+            {{- end }}
+            # SSL
+            ssl_certificate /etc/harbor/ssl/portal/tls.crt;
+            ssl_certificate_key /etc/harbor/ssl/portal/tls.key;
+
+            # Recommendations from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
+            ssl_protocols TLSv1.2 TLSv1.3;
+            {{- if .Values.internalTLS.strong_ssl_ciphers }}
+            ssl_ciphers ECDHE+AESGCM:DHE+AESGCM:ECDHE+RSA+SHA256:DHE+RSA+SHA256:!AES128;
+            {{ else }}
+            ssl_ciphers '!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES:';
+            {{- end }}
+            ssl_prefer_server_ciphers on;
+            ssl_session_cache shared:SSL:10m;
+    {{- else }}
+            {{- if .Values.ipFamily.ipv4.enabled }}
+            listen {{ template "harbor.portal.containerPort" . }};
+            {{- end }}
+            {{- if .Values.ipFamily.ipv6.enabled}}
+            listen [::]:{{ template "harbor.portal.containerPort" . }};
+            {{- end }}
+    {{- end }}
+            server_name  localhost;
+            root   /usr/share/nginx/html;
+            index  index.html index.htm;
+            include /etc/nginx/mime.types;
+            gzip on;
+            gzip_min_length 1000;
+            gzip_proxied expired no-cache no-store private auth;
+            gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
+            location /devcenter-api-2.0 {
+                try_files $uri $uri/ /swagger-ui-index.html;
+            }
+            location / {
+                try_files $uri $uri/ /index.html;
+            }
+            location = /index.html {
+                add_header Cache-Control "no-store, no-cache, must-revalidate";
+            }
+        }
+    }
diff --git a/packages/system/harbor/charts/harbor/templates/portal/deployment.yaml b/packages/system/harbor/charts/harbor/templates/portal/deployment.yaml
new file mode 100644
index 00000000..88bcd497
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/portal/deployment.yaml
@@ -0,0 +1,124 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ template "harbor.portal" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+    component: portal
+    app.kubernetes.io/component: portal
+spec:
+  replicas: {{ .Values.portal.replicas }}
+  revisionHistoryLimit: {{ .Values.portal.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+{{ include "harbor.matchLabels" . | indent 6 }}
+      component: portal
+  template:
+    metadata:
+      labels:
+{{ include "harbor.labels" . | indent 8 }}
+        component: portal
+        app.kubernetes.io/component: portal
+{{- if .Values.portal.podLabels }}
+{{ toYaml .Values.portal.podLabels | indent 8 }}
+{{- end }}
+      annotations:
+{{- if and .Values.internalTLS.enabled (eq .Values.internalTLS.certSource "auto") }}
+        checksum/tls: {{ include (print $.Template.BasePath "/internal/auto-tls.yaml") . | sha256sum }}
+{{- else if and .Values.internalTLS.enabled (eq .Values.internalTLS.certSource "manual") }}
+        checksum/tls: {{ include (print $.Template.BasePath "/portal/tls.yaml") . | sha256sum }}
+{{- end }}
+        checksum/configmap: {{ include (print $.Template.BasePath "/portal/configmap.yaml") . | sha256sum }}  
+{{- if .Values.portal.podAnnotations }}
+{{ toYaml .Values.portal.podAnnotations | indent 8 }}
+{{- end }}
+    spec:
+      securityContext:
+        runAsUser: 10000
+        fsGroup: 10000
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- if .Values.portal.serviceAccountName }}
+      serviceAccountName: {{ .Values.portal.serviceAccountName }}
+{{- end }}
+      automountServiceAccountToken: {{ .Values.portal.automountServiceAccountToken | default false }}
+{{- with .Values.portal.topologySpreadConstraints}}
+      topologySpreadConstraints:
+{{- range . }}
+      - {{ . | toYaml | indent 8 | trim }}
+        labelSelector:
+          matchLabels:
+{{ include "harbor.matchLabels" $ | indent 12 }}
+            component: portal
+{{- end }}
+{{- end }}
+      {{- with .Values.portal.initContainers }}
+      initContainers:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: portal
+        image: {{ .Values.portal.image.repository }}:{{ .Values.portal.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+{{- if .Values.portal.resources }}
+        resources:
+{{ toYaml .Values.portal.resources | indent 10 }}
+{{- end }}
+{{- with .Values.portal.extraEnvVars }}
+        env:
+{{- toYaml . | nindent 10 }}
+{{- end }}
+        {{- if not (empty .Values.containerSecurityContext) }}
+        securityContext: {{ .Values.containerSecurityContext | toYaml | nindent 10 }}
+        {{- end }}
+        livenessProbe:
+          httpGet:
+            path: /
+            scheme: {{ include "harbor.component.scheme" . | upper }}
+            port: {{ template "harbor.portal.containerPort" . }}
+          initialDelaySeconds: 300
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /
+            scheme: {{ include "harbor.component.scheme" . | upper }}
+            port: {{ template "harbor.portal.containerPort" . }}
+          initialDelaySeconds: 1
+          periodSeconds: 10
+        ports:
+        - containerPort: {{ template "harbor.portal.containerPort" . }}
+        volumeMounts:
+        - name: portal-config
+          mountPath: /etc/nginx/nginx.conf
+          subPath: nginx.conf
+        {{- if .Values.internalTLS.enabled }}
+        - name: portal-internal-certs
+          mountPath: /etc/harbor/ssl/portal
+        {{- end }}
+      volumes:
+      - name: portal-config
+        configMap:
+          name: "{{ template "harbor.portal" . }}"
+      {{- if .Values.internalTLS.enabled }}
+      - name: portal-internal-certs
+        secret:
+          secretName: {{ template "harbor.internalTLS.portal.secretName" . }}
+      {{- end }}
+    {{- with .Values.portal.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.portal.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.portal.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- if .Values.portal.priorityClassName }}
+      priorityClassName: {{ .Values.portal.priorityClassName }}
+    {{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/portal/service.yaml b/packages/system/harbor/charts/harbor/templates/portal/service.yaml
new file mode 100644
index 00000000..2ce2482b
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/portal/service.yaml
@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ template "harbor.portal" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+{{- with .Values.portal.serviceAnnotations }}
+  annotations:
+  {{- toYaml . | nindent 4 }}
+{{- end }}
+spec:
+{{- if or  (eq .Values.expose.ingress.controller "gce") (eq .Values.expose.ingress.controller "alb") (eq .Values.expose.ingress.controller "f5-bigip") }}
+  type: NodePort
+{{- end }}
+{{- if .Values.ipFamily.policy }}
+  ipFamilyPolicy: {{ .Values.ipFamily.policy }}
+{{- end }}
+{{- if .Values.ipFamily.families }}
+  ipFamilies: {{ toYaml .Values.ipFamily.families | nindent 4 }}
+{{- end }}
+  ports:
+    - port: {{ template "harbor.portal.servicePort" . }}
+      targetPort: {{ template "harbor.portal.containerPort" . }}
+  selector:
+{{ include "harbor.matchLabels" . | indent 4 }}
+    component: portal
diff --git a/packages/system/harbor/charts/harbor/templates/portal/tls.yaml b/packages/system/harbor/charts/harbor/templates/portal/tls.yaml
new file mode 100644
index 00000000..e61a7d3a
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/portal/tls.yaml
@@ -0,0 +1,16 @@
+{{- if and .Values.internalTLS.enabled }}
+{{- if eq .Values.internalTLS.certSource "manual" }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "harbor.internalTLS.portal.secretName" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: kubernetes.io/tls
+data:
+  ca.crt: {{ (required "The \"internalTLS.trustCa\" is required!" .Values.internalTLS.trustCa) | b64enc | quote }}
+  tls.crt: {{ (required "The \"internalTLS.portal.crt\" is required!" .Values.internalTLS.portal.crt) | b64enc | quote }}
+  tls.key: {{ (required "The \"internalTLS.portal.key\" is required!" .Values.internalTLS.portal.key) | b64enc | quote }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/redis/service.yaml b/packages/system/harbor/charts/harbor/templates/redis/service.yaml
new file mode 100644
index 00000000..8bb8e85b
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/redis/service.yaml
@@ -0,0 +1,21 @@
+{{- if eq .Values.redis.type "internal" -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "harbor.redis" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+spec:
+  {{- if .Values.ipFamily.policy }}
+  ipFamilyPolicy: {{ .Values.ipFamily.policy }}
+  {{- end }}
+  {{- if .Values.ipFamily.families }}
+  ipFamilies: {{ toYaml .Values.ipFamily.families }}
+  {{- end }}
+  ports:
+    - port: 6379
+  selector:
+{{ include "harbor.matchLabels" . | indent 4 }}
+    component: redis
+{{- end -}}
diff --git a/packages/system/harbor/charts/harbor/templates/redis/statefulset.yaml b/packages/system/harbor/charts/harbor/templates/redis/statefulset.yaml
new file mode 100644
index 00000000..2316f69b
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/redis/statefulset.yaml
@@ -0,0 +1,128 @@
+{{- if eq .Values.redis.type "internal" -}}
+{{- $redis := .Values.persistence.persistentVolumeClaim.redis -}}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ template "harbor.redis" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+    component: redis
+    app.kubernetes.io/component: redis
+spec:
+  replicas: 1
+  serviceName: {{ template "harbor.redis" . }}
+  selector:
+    matchLabels:
+{{ include "harbor.matchLabels" . | indent 6 }}
+      component: redis
+  template:
+    metadata:
+      labels:
+{{ include "harbor.labels" . | indent 8 }}
+        component: redis
+        app.kubernetes.io/component: redis
+{{- if .Values.redis.podLabels }}
+{{ toYaml .Values.redis.podLabels | indent 8 }}
+{{- end }}
+{{- if .Values.redis.podAnnotations }}
+      annotations:
+{{ toYaml .Values.redis.podAnnotations | indent 8 }}
+{{- end }}
+    spec:
+      securityContext:
+        runAsUser: 999
+        fsGroup: 999
+{{- if .Values.redis.internal.serviceAccountName }}
+      serviceAccountName: {{ .Values.redis.internal.serviceAccountName }}
+{{- end -}}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      automountServiceAccountToken: {{ .Values.redis.internal.automountServiceAccountToken | default false }}
+      terminationGracePeriodSeconds: 120
+      {{- with .Values.redis.internal.initContainers }}
+      initContainers:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: redis
+        image: {{ .Values.redis.internal.image.repository }}:{{ .Values.redis.internal.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        {{- if not (empty .Values.containerSecurityContext) }}
+        securityContext: {{ .Values.containerSecurityContext | toYaml | nindent 10 }}
+        {{- end }}
+        livenessProbe:
+          tcpSocket:
+            port: 6379
+          initialDelaySeconds: 300
+          periodSeconds: 10
+        readinessProbe:
+          tcpSocket:
+            port: 6379
+          initialDelaySeconds: 1
+          periodSeconds: 10
+{{- if .Values.redis.internal.resources }}
+        resources:
+{{ toYaml .Values.redis.internal.resources | indent 10 }}
+{{- end }}
+{{- with .Values.redis.internal.extraEnvVars }}
+        env:
+{{- toYaml . | nindent 10 }}
+{{- end }}
+        volumeMounts:
+        - name: data
+          mountPath: /var/lib/redis
+          subPath: {{ $redis.subPath }}
+      {{- if not .Values.persistence.enabled }}
+      volumes:
+      - name: data
+        emptyDir: {}
+      {{- else if $redis.existingClaim }}
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: {{ $redis.existingClaim }}
+      {{- end -}}
+    {{- with .Values.redis.internal.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.redis.internal.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.redis.internal.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- if .Values.redis.internal.priorityClassName }}
+      priorityClassName: {{ .Values.redis.internal.priorityClassName }}
+    {{- end }}
+  {{- if and .Values.persistence.enabled (not $redis.existingClaim) }}
+  volumeClaimTemplates:
+  - apiVersion: v1	
+    kind: PersistentVolumeClaim
+    metadata:
+      name: data
+      labels:
+{{ include "harbor.legacy.labels" . | indent 8 }}
+      annotations:
+      {{- range $key, $value := $redis.annotations }}
+        {{ $key }}: {{ $value | quote }}
+      {{- end }}
+    spec:
+      accessModes: [{{ $redis.accessMode | quote }}]
+      {{- if $redis.storageClass }}
+      {{- if (eq "-" $redis.storageClass) }}
+      storageClassName: ""
+      {{- else }}
+      storageClassName: "{{ $redis.storageClass }}"
+      {{- end }}
+      {{- end }}
+      resources:
+        requests:
+          storage: {{ $redis.size | quote }}
+  {{- end -}}
+  {{- end -}}
diff --git a/packages/system/harbor/charts/harbor/templates/registry/registry-cm.yaml b/packages/system/harbor/charts/harbor/templates/registry/registry-cm.yaml
new file mode 100644
index 00000000..2ef398ed
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/registry/registry-cm.yaml
@@ -0,0 +1,248 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "{{ template "harbor.registry" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+data:
+  config.yml: |+
+    version: 0.1
+    log:
+      {{- if eq .Values.logLevel "warning" }}
+      level: warn
+      {{- else if eq .Values.logLevel "fatal" }}
+      level: error
+      {{- else }}
+      level: {{ .Values.logLevel }}
+      {{- end }}
+      fields:
+        service: registry
+    storage:
+      {{- $storage := .Values.persistence.imageChartStorage }}
+      {{- $type := $storage.type }}
+      {{- if eq $type "filesystem" }}
+      filesystem:
+        rootdirectory: {{ $storage.filesystem.rootdirectory }}
+        {{- if $storage.filesystem.maxthreads }}
+        maxthreads: {{ $storage.filesystem.maxthreads }}
+        {{- end }}
+      {{- else if eq $type "azure" }}
+      azure:
+        accountname: {{ $storage.azure.accountname }}
+        container: {{ $storage.azure.container }}
+        {{- if $storage.azure.realm }}
+        realm: {{ $storage.azure.realm }}
+        {{- end }}
+      {{- else if eq $type "gcs" }}
+      gcs:
+        bucket: {{ $storage.gcs.bucket }}
+        {{- if not .Values.persistence.imageChartStorage.gcs.useWorkloadIdentity }}
+        keyfile: /etc/registry/gcs-key.json
+        {{- end }}
+        {{- if $storage.gcs.rootdirectory }}
+        rootdirectory: {{ $storage.gcs.rootdirectory }}
+        {{- end }}
+        {{- if $storage.gcs.chunksize }}
+        chunksize: {{ $storage.gcs.chunksize }}
+        {{- end }}
+      {{- else if eq $type "s3" }}
+      s3:
+        region: {{ $storage.s3.region }}
+        bucket: {{ $storage.s3.bucket }}
+        {{- if $storage.s3.regionendpoint }}
+        regionendpoint: {{ $storage.s3.regionendpoint }}
+        {{- end }}
+        {{- if $storage.s3.encrypt }}
+        encrypt: {{ $storage.s3.encrypt }}
+        {{- end }}
+        {{- if $storage.s3.keyid }}
+        keyid: {{ $storage.s3.keyid }}
+        {{- end }}
+        {{- if $storage.s3.secure }}
+        secure: {{ $storage.s3.secure }}
+        {{- end }}
+        {{- if and $storage.s3.secure $storage.s3.skipverify }}
+        skipverify: {{ $storage.s3.skipverify }}
+        {{- end }}
+        {{- if $storage.s3.v4auth }}
+        v4auth: {{ $storage.s3.v4auth }}
+        {{- end }}
+        {{- if $storage.s3.chunksize }}
+        chunksize: {{ $storage.s3.chunksize }}
+        {{- end }}
+        {{- if $storage.s3.rootdirectory }}
+        rootdirectory: {{ $storage.s3.rootdirectory }}
+        {{- end }}
+        {{- if $storage.s3.storageclass }}
+        storageclass: {{ $storage.s3.storageclass }}
+        {{- end }}
+        {{- if $storage.s3.multipartcopychunksize }}
+        multipartcopychunksize: {{ $storage.s3.multipartcopychunksize }}
+        {{- end }}
+        {{- if $storage.s3.multipartcopymaxconcurrency }}
+        multipartcopymaxconcurrency: {{ $storage.s3.multipartcopymaxconcurrency }}
+        {{- end }}
+        {{- if $storage.s3.multipartcopythresholdsize }}
+        multipartcopythresholdsize: {{ $storage.s3.multipartcopythresholdsize }}
+        {{- end }}
+      {{- else if eq $type "swift" }}
+      swift:
+        authurl: {{ $storage.swift.authurl }}
+        username: {{ $storage.swift.username }}
+        container: {{ $storage.swift.container }}
+        {{- if $storage.swift.region }}
+        region: {{ $storage.swift.region }}
+        {{- end }}
+        {{- if $storage.swift.tenant }}
+        tenant: {{ $storage.swift.tenant }}
+        {{- end }}
+        {{- if $storage.swift.tenantid }}
+        tenantid: {{ $storage.swift.tenantid }}
+        {{- end }}
+        {{- if $storage.swift.domain }}
+        domain: {{ $storage.swift.domain }}
+        {{- end }}
+        {{- if $storage.swift.domainid }}
+        domainid: {{ $storage.swift.domainid }}
+        {{- end }}
+        {{- if $storage.swift.trustid }}
+        trustid: {{ $storage.swift.trustid }}
+        {{- end }}
+        {{- if $storage.swift.insecureskipverify }}
+        insecureskipverify: {{ $storage.swift.insecureskipverify }}
+        {{- end }}
+        {{- if $storage.swift.chunksize }}
+        chunksize: {{ $storage.swift.chunksize }}
+        {{- end }}
+        {{- if $storage.swift.prefix }}
+        prefix: {{ $storage.swift.prefix }}
+        {{- end }}
+        {{- if $storage.swift.authversion }}
+        authversion: {{ $storage.swift.authversion }}
+        {{- end }}
+        {{- if $storage.swift.endpointtype }}
+        endpointtype: {{ $storage.swift.endpointtype }}
+        {{- end }}
+        {{- if $storage.swift.tempurlcontainerkey }}
+        tempurlcontainerkey: {{ $storage.swift.tempurlcontainerkey }}
+        {{- end }}
+        {{- if $storage.swift.tempurlmethods }}
+        tempurlmethods: {{ $storage.swift.tempurlmethods }}
+        {{- end }}
+      {{- else if eq $type "oss" }}
+      oss:
+        accesskeyid: {{ $storage.oss.accesskeyid }}
+        region: {{ $storage.oss.region }}
+        bucket: {{ $storage.oss.bucket }}
+        {{- if $storage.oss.endpoint }}
+        endpoint: {{ $storage.oss.bucket }}.{{ $storage.oss.endpoint }}
+        {{- end }}
+        {{- if $storage.oss.internal }}
+        internal: {{ $storage.oss.internal }}
+        {{- end }}
+        {{- if $storage.oss.encrypt }}
+        encrypt: {{ $storage.oss.encrypt }}
+        {{- end }}
+        {{- if $storage.oss.secure }}
+        secure: {{ $storage.oss.secure }}
+        {{- end }}
+        {{- if $storage.oss.chunksize }}
+        chunksize: {{ $storage.oss.chunksize }}
+        {{- end }}
+        {{- if $storage.oss.rootdirectory }}
+        rootdirectory: {{ $storage.oss.rootdirectory }}
+        {{- end }}
+      {{- end }}
+      cache:
+        layerinfo: redis
+      maintenance:
+        uploadpurging:
+          {{- if .Values.registry.upload_purging.enabled }}
+          enabled: true
+          age: {{ .Values.registry.upload_purging.age }}
+          interval: {{ .Values.registry.upload_purging.interval }}
+          dryrun: {{ .Values.registry.upload_purging.dryrun }}
+          {{- else }}
+          enabled: false
+          {{- end }}
+      delete:
+        enabled: true
+      redirect:
+        disable: {{ $storage.disableredirect }}
+    redis:
+      addr: {{ template "harbor.redis.addr" . }}
+      {{- if eq "redis+sentinel" (include "harbor.redis.scheme" .) }}
+      sentinelMasterSet: {{ template "harbor.redis.masterSet" . }}
+      {{- end }}
+      db: {{ template "harbor.redis.dbForRegistry" . }}
+      {{- if not (eq (include "harbor.redis.password" .) "") }}
+      password: {{ template "harbor.redis.password" . }}
+      {{- end }}
+      readtimeout: 10s
+      writetimeout: 10s
+      dialtimeout: 10s
+      enableTLS: {{ template "harbor.redis.enableTLS" . }}
+      pool:
+        maxidle: 100
+        maxactive: 500
+        idletimeout: 60s
+    http:
+      addr: :{{ template "harbor.registry.containerPort" . }}
+      relativeurls: {{ .Values.registry.relativeurls }}
+      {{- if .Values.internalTLS.enabled }}
+      tls:
+        certificate: /etc/harbor/ssl/registry/tls.crt
+        key: /etc/harbor/ssl/registry/tls.key
+        minimumtls: tls1.2
+      {{- end }}
+      # set via environment variable
+      # secret: placeholder
+      debug:
+      {{- if .Values.metrics.enabled}}
+        addr: :{{ .Values.metrics.registry.port }}
+        prometheus:
+          enabled: true
+          path: {{ .Values.metrics.registry.path }}
+      {{- else }}
+        addr: localhost:5001
+      {{- end }}
+    auth:
+      htpasswd:
+        realm: harbor-registry-basic-realm
+        path: /etc/registry/passwd
+    validation:
+      disabled: true
+    compatibility:
+      schema1:
+        enabled: true
+
+    {{- if .Values.registry.middleware.enabled }}
+    {{- $middleware := .Values.registry.middleware }}
+    {{- $middlewareType := $middleware.type }}
+    {{- if eq $middlewareType "cloudFront" }}
+    middleware:
+      storage:
+        - name: cloudfront
+          options:
+            baseurl: {{ $middleware.cloudFront.baseurl }}
+            privatekey: /etc/registry/pk.pem
+            keypairid: {{ $middleware.cloudFront.keypairid }}
+            duration: {{ $middleware.cloudFront.duration }}
+            ipfilteredby: {{ $middleware.cloudFront.ipfilteredby }}
+    {{- end }}
+    {{- end }}
+  ctl-config.yml: |+
+    ---
+    {{- if .Values.internalTLS.enabled }}
+    protocol: "https"
+    port: 8443
+    https_config:
+      cert: "/etc/harbor/ssl/registry/tls.crt"
+      key: "/etc/harbor/ssl/registry/tls.key"
+    {{- else }}
+    protocol: "http"
+    port: 8080
+    {{- end }}
+    log_level: {{ .Values.logLevel }}
+    registry_config: "/etc/registry/config.yml"
diff --git a/packages/system/harbor/charts/harbor/templates/registry/registry-dpl.yaml b/packages/system/harbor/charts/harbor/templates/registry/registry-dpl.yaml
new file mode 100644
index 00000000..a86e2eee
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/registry/registry-dpl.yaml
@@ -0,0 +1,431 @@
+{{- $storage := .Values.persistence.imageChartStorage }}
+{{- $type := $storage.type }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ template "harbor.registry" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+    component: registry
+    app.kubernetes.io/component: registry
+spec:
+  replicas: {{ .Values.registry.replicas }}
+  revisionHistoryLimit: {{ .Values.registry.revisionHistoryLimit }}
+  strategy:
+    type: {{ .Values.updateStrategy.type }}
+    {{- if eq .Values.updateStrategy.type "Recreate" }}
+    rollingUpdate: null
+    {{- end }}
+  selector:
+    matchLabels:
+{{ include "harbor.matchLabels" . | indent 6 }}
+      component: registry
+  template:
+    metadata:
+      labels:
+{{ include "harbor.labels" . | indent 8 }}
+        component: registry
+        app.kubernetes.io/component: registry
+{{- if .Values.registry.podLabels }}
+{{ toYaml .Values.registry.podLabels | indent 8 }}
+{{- end }}
+      annotations:
+        checksum/configmap: {{ include (print $.Template.BasePath "/registry/registry-cm.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/registry/registry-secret.yaml") . | sha256sum }}
+        checksum/secret-jobservice: {{ include (print $.Template.BasePath "/jobservice/jobservice-secrets.yaml") . | sha256sum }}
+        checksum/secret-core: {{ include (print $.Template.BasePath "/core/core-secret.yaml") . | sha256sum }}
+{{- if and .Values.internalTLS.enabled (eq .Values.internalTLS.certSource "auto") }}
+        checksum/tls: {{ include (print $.Template.BasePath "/internal/auto-tls.yaml") . | sha256sum }}
+{{- else if and .Values.internalTLS.enabled (eq .Values.internalTLS.certSource "manual") }}
+        checksum/tls: {{ include (print $.Template.BasePath "/registry/registry-tls.yaml") . | sha256sum }}
+{{- end }}
+{{- if .Values.registry.podAnnotations }}
+{{ toYaml .Values.registry.podAnnotations | indent 8 }}
+{{- end }}
+    spec:
+      securityContext:
+        runAsUser: 10000
+        fsGroup: 10000
+        fsGroupChangePolicy: OnRootMismatch
+{{- if .Values.registry.serviceAccountName }}
+      serviceAccountName: {{ .Values.registry.serviceAccountName }}
+{{- end -}}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      automountServiceAccountToken: {{ .Values.registry.automountServiceAccountToken | default false }}
+      terminationGracePeriodSeconds: 120
+{{- with .Values.registry.topologySpreadConstraints}}
+      topologySpreadConstraints:
+{{- range . }}
+      - {{ . | toYaml | indent 8 | trim }}
+        labelSelector:
+          matchLabels:
+{{ include "harbor.matchLabels" $ | indent 12 }}
+            component: registry
+{{- end }}
+{{- end }}
+      {{- with .Values.registry.initContainers }}
+      initContainers:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: registry
+        image: {{ .Values.registry.registry.image.repository }}:{{ .Values.registry.registry.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        livenessProbe:
+          httpGet:
+            path: /
+            scheme: {{ include "harbor.component.scheme" . | upper }}
+            port: {{ template "harbor.registry.containerPort" . }}
+          initialDelaySeconds: 300
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /
+            scheme: {{ include "harbor.component.scheme" . | upper }}
+            port: {{ template "harbor.registry.containerPort" . }}
+          initialDelaySeconds: 1
+          periodSeconds: 10
+{{- if .Values.registry.registry.resources }}
+        resources:
+{{ toYaml .Values.registry.registry.resources | indent 10 }}
+{{- end }}
+        {{- if not (empty .Values.containerSecurityContext) }}
+        securityContext: {{ .Values.containerSecurityContext | toYaml | nindent 10 }}
+        {{- end }}
+        envFrom:
+        - secretRef:
+            name: "{{ template "harbor.registry" . }}"
+        {{- if .Values.persistence.imageChartStorage.s3.existingSecret }}
+        - secretRef:
+            name: {{ .Values.persistence.imageChartStorage.s3.existingSecret }}
+        {{- end }}
+        env:
+        {{- if .Values.registry.existingSecret }}
+        - name: REGISTRY_HTTP_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.registry.existingSecret }}
+              key: {{ .Values.registry.existingSecretKey }}
+        {{- end }}
+        {{- if has "registry" .Values.proxy.components }}
+        - name: HTTP_PROXY
+          value: "{{ .Values.proxy.httpProxy }}"
+        - name: HTTPS_PROXY
+          value: "{{ .Values.proxy.httpsProxy }}"
+        - name: NO_PROXY
+          value: "{{ template "harbor.noProxy" . }}"
+        {{- end }}
+        {{- if .Values.internalTLS.enabled }}
+        - name: INTERNAL_TLS_ENABLED
+          value: "true"
+        - name: INTERNAL_TLS_KEY_PATH
+          value: /etc/harbor/ssl/registry/tls.key
+        - name: INTERNAL_TLS_CERT_PATH
+          value: /etc/harbor/ssl/registry/tls.crt
+        - name: INTERNAL_TLS_TRUST_CA_PATH
+          value: /etc/harbor/ssl/registry/ca.crt
+        {{- end }}
+        {{- if .Values.redis.external.existingSecret }}
+        - name: REGISTRY_REDIS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.redis.external.existingSecret }}
+              key: REDIS_PASSWORD
+        {{- end }}
+        {{- if .Values.persistence.imageChartStorage.azure.existingSecret }}
+        - name: REGISTRY_STORAGE_AZURE_ACCOUNTKEY
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.persistence.imageChartStorage.azure.existingSecret }}
+              key: AZURE_STORAGE_ACCESS_KEY
+        {{- end }}
+        {{- if .Values.persistence.imageChartStorage.swift.existingSecret }}
+        - name: REGISTRY_STORAGE_SWIFT_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.persistence.imageChartStorage.swift.existingSecret }}
+              key: REGISTRY_STORAGE_SWIFT_PASSWORD
+        - name: REGISTRY_STORAGE_SWIFT_SECRETKEY
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.persistence.imageChartStorage.swift.existingSecret }}
+              key: REGISTRY_STORAGE_SWIFT_SECRETKEY
+              optional: true
+        - name: REGISTRY_STORAGE_SWIFT_ACCESSKEY
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.persistence.imageChartStorage.swift.existingSecret }}
+              key: REGISTRY_STORAGE_SWIFT_ACCESSKEY
+              optional: true
+        {{- end }}
+        {{- if .Values.persistence.imageChartStorage.oss.existingSecret }}
+        - name: REGISTRY_STORAGE_OSS_ACCESSKEYSECRET
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.persistence.imageChartStorage.oss.existingSecret }}
+              key: REGISTRY_STORAGE_OSS_ACCESSKEYSECRET
+              optional: true
+        {{- end}}
+{{- with .Values.registry.registry.extraEnvVars }}
+{{- toYaml . | nindent 8 }}
+{{- end }}
+        ports:
+        - containerPort: {{ template "harbor.registry.containerPort" . }}
+        - containerPort: {{ ternary .Values.metrics.registry.port 5001 .Values.metrics.enabled }}
+        volumeMounts:
+        - name: registry-data
+          mountPath: {{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }}
+          subPath: {{ .Values.persistence.persistentVolumeClaim.registry.subPath }}
+        - name: registry-htpasswd
+          mountPath: /etc/registry/passwd
+          subPath: passwd
+        - name: registry-config
+          mountPath: /etc/registry/config.yml
+          subPath: config.yml
+        {{- if .Values.internalTLS.enabled }}
+        - name: registry-internal-certs
+          mountPath: /etc/harbor/ssl/registry
+        {{- end }}
+        {{- if and (and .Values.persistence.enabled (eq .Values.persistence.imageChartStorage.type "gcs")) (not .Values.persistence.imageChartStorage.gcs.useWorkloadIdentity) }}
+        - name: gcs-key
+          mountPath: /etc/registry/gcs-key.json
+          subPath: gcs-key.json
+        {{- end }}
+        {{- if .Values.persistence.imageChartStorage.caBundleSecretName }}
+        - name: storage-service-ca
+          mountPath: /harbor_cust_cert/custom-ca-bundle.crt
+          subPath: ca.crt
+        {{- end }}
+        {{- if .Values.registry.middleware.enabled }}
+        {{- if eq .Values.registry.middleware.type "cloudFront" }}
+        - name: cloudfront-key
+          mountPath: /etc/registry/pk.pem
+          subPath: pk.pem
+        {{- end }}
+        {{- end }}
+        {{- if .Values.caBundleSecretName }}
+{{ include "harbor.caBundleVolumeMount" . | indent 8 }}
+        {{- end }}
+      - name: registryctl
+        image: {{ .Values.registry.controller.image.repository }}:{{ .Values.registry.controller.image.tag }}
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        livenessProbe:
+          httpGet:
+            path: /api/health
+            scheme: {{ include "harbor.component.scheme" . | upper }}
+            port: {{ template "harbor.registryctl.containerPort" . }}
+          initialDelaySeconds: 300
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /api/health
+            scheme: {{ include "harbor.component.scheme" . | upper }}
+            port: {{ template "harbor.registryctl.containerPort" . }}
+          initialDelaySeconds: 1
+          periodSeconds: 10
+{{- if .Values.registry.controller.resources }}
+        resources:
+{{ toYaml .Values.registry.controller.resources | indent 10 }}
+{{- end }}
+        {{- if not (empty .Values.containerSecurityContext) }}
+        securityContext: {{ .Values.containerSecurityContext | toYaml | nindent 10 }}
+        {{- end }}
+        envFrom:
+        - configMapRef:
+            name: "{{ template "harbor.registryCtl" . }}"
+        - secretRef:
+            name: "{{ template "harbor.registry" . }}"
+        - secretRef:
+            name: "{{ template "harbor.registryCtl" . }}"
+        {{- if .Values.persistence.imageChartStorage.s3.existingSecret }}
+        - secretRef:
+            name: {{ .Values.persistence.imageChartStorage.s3.existingSecret }}
+        {{- end }}
+        env:
+        {{- if .Values.registry.existingSecret }}
+        - name: REGISTRY_HTTP_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.registry.existingSecret }}
+              key: {{ .Values.registry.existingSecretKey }}
+        {{- end }}
+        - name: CORE_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: {{ default (include "harbor.core" .) .Values.core.existingSecret }}
+              key: secret
+        - name: JOBSERVICE_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: {{ default (include "harbor.jobservice" .) .Values.jobservice.existingSecret }}
+              {{- if .Values.jobservice.existingSecret }}
+              key: {{ .Values.jobservice.existingSecretKey }}
+              {{- else }}
+              key: JOBSERVICE_SECRET
+              {{- end }}
+        {{- if has "registry" .Values.proxy.components }}
+        - name: HTTP_PROXY
+          value: "{{ .Values.proxy.httpProxy }}"
+        - name: HTTPS_PROXY
+          value: "{{ .Values.proxy.httpsProxy }}"
+        - name: NO_PROXY
+          value: "{{ template "harbor.noProxy" . }}"
+        {{- end }}
+        {{- if .Values.internalTLS.enabled }}
+        - name: INTERNAL_TLS_ENABLED
+          value: "true"
+        - name: INTERNAL_TLS_KEY_PATH
+          value: /etc/harbor/ssl/registry/tls.key
+        - name: INTERNAL_TLS_CERT_PATH
+          value: /etc/harbor/ssl/registry/tls.crt
+        - name: INTERNAL_TLS_TRUST_CA_PATH
+          value: /etc/harbor/ssl/registry/ca.crt
+        {{- end }}
+        {{- if .Values.redis.external.existingSecret }}
+        - name: REGISTRY_REDIS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.redis.external.existingSecret }}
+              key: REDIS_PASSWORD
+        {{- end }}
+        {{- if .Values.persistence.imageChartStorage.azure.existingSecret }}
+        - name: REGISTRY_STORAGE_AZURE_ACCOUNTKEY
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.persistence.imageChartStorage.azure.existingSecret }}
+              key: AZURE_STORAGE_ACCESS_KEY
+        {{- end }}
+        {{- if .Values.persistence.imageChartStorage.swift.existingSecret }}
+        - name: REGISTRY_STORAGE_SWIFT_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.persistence.imageChartStorage.swift.existingSecret }}
+              key: REGISTRY_STORAGE_SWIFT_PASSWORD
+        - name: REGISTRY_STORAGE_SWIFT_SECRETKEY
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.persistence.imageChartStorage.swift.existingSecret }}
+              key: REGISTRY_STORAGE_SWIFT_SECRETKEY
+              optional: true
+        - name: REGISTRY_STORAGE_SWIFT_ACCESSKEY
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.persistence.imageChartStorage.swift.existingSecret }}
+              key: REGISTRY_STORAGE_SWIFT_ACCESSKEY
+              optional: true
+        {{- end }}
+        {{- if .Values.persistence.imageChartStorage.oss.existingSecret }}
+        - name: REGISTRY_STORAGE_OSS_ACCESSKEYSECRET
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.persistence.imageChartStorage.oss.existingSecret }}
+              key: REGISTRY_STORAGE_OSS_ACCESSKEYSECRET
+              optional: true
+        {{- end}}
+{{- with .Values.registry.controller.extraEnvVars }}
+{{- toYaml . | nindent 8 }}
+{{- end }}
+        ports:
+        - containerPort: {{ template "harbor.registryctl.containerPort" . }}
+        volumeMounts:
+        - name: registry-data
+          mountPath: {{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }}
+          subPath: {{ .Values.persistence.persistentVolumeClaim.registry.subPath }}
+        - name: registry-config
+          mountPath: /etc/registry/config.yml
+          subPath: config.yml
+        - name: registry-config
+          mountPath: /etc/registryctl/config.yml
+          subPath: ctl-config.yml
+        {{- if .Values.internalTLS.enabled }}
+        - name: registry-internal-certs
+          mountPath: /etc/harbor/ssl/registry
+        {{- end }}
+        {{- if .Values.persistence.imageChartStorage.caBundleSecretName }}
+        - name: storage-service-ca
+          mountPath: /harbor_cust_cert/custom-ca-bundle.crt
+          subPath: ca.crt
+        {{- end }}
+        {{- if and (and .Values.persistence.enabled (eq .Values.persistence.imageChartStorage.type "gcs")) (not .Values.persistence.imageChartStorage.gcs.useWorkloadIdentity ) }}
+        - name: gcs-key
+          mountPath: /etc/registry/gcs-key.json
+          subPath: gcs-key.json
+        {{- end }}
+        {{- if .Values.caBundleSecretName }}
+{{ include "harbor.caBundleVolumeMount" . | indent 8 }}
+        {{- end }}
+      volumes:
+      - name: registry-htpasswd
+        secret:
+          {{- if not .Values.registry.credentials.existingSecret }}
+          secretName: {{ template "harbor.registry" . }}-htpasswd
+          {{ else }}
+          secretName: {{ .Values.registry.credentials.existingSecret }}
+          {{- end }}
+          items:
+            - key: REGISTRY_HTPASSWD
+              path: passwd
+      - name: registry-config
+        configMap:
+          name: "{{ template "harbor.registry" . }}"
+      - name: registry-data
+      {{- if and .Values.persistence.enabled (eq .Values.persistence.imageChartStorage.type "filesystem") }}
+        persistentVolumeClaim:
+          claimName: {{ .Values.persistence.persistentVolumeClaim.registry.existingClaim | default (include "harbor.registry" .) }}
+      {{- else }}
+        emptyDir: {}
+      {{- end }}
+      {{- if .Values.internalTLS.enabled }}
+      - name: registry-internal-certs
+        secret:
+          secretName: {{ template "harbor.internalTLS.registry.secretName" . }}
+      {{- end }}
+      {{- if and (and .Values.persistence.enabled (eq .Values.persistence.imageChartStorage.type "gcs")) (not .Values.persistence.imageChartStorage.gcs.useWorkloadIdentity ) }}
+      - name: gcs-key
+        secret:
+          {{- if and (eq $type "gcs") $storage.gcs.existingSecret }}
+          secretName: {{ $storage.gcs.existingSecret }}
+          {{- else }}
+          secretName: {{ template "harbor.registry" . }}
+          {{- end }}
+          items:
+            - key: GCS_KEY_DATA
+              path: gcs-key.json
+      {{- end }}
+      {{- if .Values.persistence.imageChartStorage.caBundleSecretName }}
+      - name: storage-service-ca
+        secret:
+          secretName: {{ .Values.persistence.imageChartStorage.caBundleSecretName }}
+      {{- end }}
+      {{- if .Values.registry.middleware.enabled }}
+      {{- if eq .Values.registry.middleware.type "cloudFront" }}
+      - name: cloudfront-key
+        secret:
+          secretName: {{ .Values.registry.middleware.cloudFront.privateKeySecret }}
+          items:
+            - key: CLOUDFRONT_KEY_DATA
+              path: pk.pem
+      {{- end }}
+      {{- end }}
+      {{- if .Values.caBundleSecretName }}
+{{ include "harbor.caBundleVolume" . | indent 6 }}
+      {{- end }}
+    {{- with .Values.registry.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.registry.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.registry.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- if .Values.registry.priorityClassName }}
+      priorityClassName: {{ .Values.registry.priorityClassName }}
+    {{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/registry/registry-pvc.yaml b/packages/system/harbor/charts/harbor/templates/registry/registry-pvc.yaml
new file mode 100644
index 00000000..712c2117
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/registry/registry-pvc.yaml
@@ -0,0 +1,34 @@
+{{- if .Values.persistence.enabled }}
+{{- $registry := .Values.persistence.persistentVolumeClaim.registry -}}
+{{- if and (not $registry.existingClaim) (eq .Values.persistence.imageChartStorage.type "filesystem") }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ template "harbor.registry" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  annotations:
+  {{- range $key, $value := $registry.annotations }}
+    {{ $key }}: {{ $value | quote }}
+  {{- end }}
+  {{- if eq .Values.persistence.resourcePolicy "keep" }}
+    helm.sh/resource-policy: keep
+  {{- end }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+    component: registry
+    app.kubernetes.io/component: registry
+spec:
+  accessModes: 
+    - {{ $registry.accessMode }}
+  resources:
+    requests:
+      storage: {{ $registry.size }}
+  {{- if $registry.storageClass }}
+    {{- if eq "-" $registry.storageClass }}
+  storageClassName: ""
+    {{- else }}
+  storageClassName: {{ $registry.storageClass }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/registry/registry-secret.yaml b/packages/system/harbor/charts/harbor/templates/registry/registry-secret.yaml
new file mode 100644
index 00000000..11ada3b7
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/registry/registry-secret.yaml
@@ -0,0 +1,57 @@
+{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace (include "harbor.registry" .) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "harbor.registry" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: Opaque
+data:
+  {{- if not .Values.registry.existingSecret }}
+  REGISTRY_HTTP_SECRET: {{ .Values.registry.secret | default (include "harbor.secretKeyHelper" (dict "key" "REGISTRY_HTTP_SECRET" "data" $existingSecret.data)) | default (randAlphaNum 16) | b64enc | quote }}
+  {{- end }}
+  {{- if not .Values.redis.external.existingSecret }}
+  REGISTRY_REDIS_PASSWORD: {{ include "harbor.redis.password" . | b64enc | quote }}
+  {{- end }}
+  {{- $storage := .Values.persistence.imageChartStorage }}
+  {{- $type := $storage.type }}
+  {{- if and (eq $type "azure") (not $storage.azure.existingSecret) }}
+  REGISTRY_STORAGE_AZURE_ACCOUNTKEY: {{ $storage.azure.accountkey | b64enc | quote }}
+  {{- else if and (and (eq $type "gcs") (not $storage.gcs.existingSecret)) (not $storage.gcs.useWorkloadIdentity) }}
+  GCS_KEY_DATA: {{ $storage.gcs.encodedkey | quote }}
+  {{- else if eq $type "s3" }}
+  {{- if and (not $storage.s3.existingSecret) ($storage.s3.accesskey) }}
+  REGISTRY_STORAGE_S3_ACCESSKEY: {{ $storage.s3.accesskey | b64enc | quote }}
+  {{- end }}
+  {{- if and (not $storage.s3.existingSecret) ($storage.s3.secretkey) }}
+  REGISTRY_STORAGE_S3_SECRETKEY: {{ $storage.s3.secretkey | b64enc | quote }}
+  {{- end }}
+  {{- else if and (eq $type "swift") (not ($storage.swift.existingSecret)) }}
+  REGISTRY_STORAGE_SWIFT_PASSWORD: {{ $storage.swift.password | b64enc | quote }}
+  {{- if $storage.swift.secretkey }}
+  REGISTRY_STORAGE_SWIFT_SECRETKEY: {{ $storage.swift.secretkey | b64enc | quote }}
+  {{- end }}
+  {{- if $storage.swift.accesskey }}
+  REGISTRY_STORAGE_SWIFT_ACCESSKEY: {{ $storage.swift.accesskey | b64enc | quote }}
+  {{- end }}
+  {{- else if and (eq $type "oss") ((not ($storage.oss.existingSecret))) }}
+  REGISTRY_STORAGE_OSS_ACCESSKEYSECRET: {{ $storage.oss.accesskeysecret | b64enc | quote }}
+  {{- end }}
+{{- if not .Values.registry.credentials.existingSecret }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "harbor.registry" . }}-htpasswd"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: Opaque
+data:
+  {{- if .Values.registry.credentials.htpasswdString }}
+  REGISTRY_HTPASSWD: {{ .Values.registry.credentials.htpasswdString | b64enc | quote }}
+  {{- else }}
+  REGISTRY_HTPASSWD: {{ htpasswd .Values.registry.credentials.username .Values.registry.credentials.password | b64enc | quote }}
+  {{- end }}
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/registry/registry-svc.yaml b/packages/system/harbor/charts/harbor/templates/registry/registry-svc.yaml
new file mode 100644
index 00000000..7e30c478
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/registry/registry-svc.yaml
@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ template "harbor.registry" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+spec:
+{{- if .Values.ipFamily.policy }}
+  ipFamilyPolicy: {{ .Values.ipFamily.policy }}
+{{- end }}
+{{- if .Values.ipFamily.families }}
+  ipFamilies: {{ toYaml .Values.ipFamily.families | nindent 4 }}
+{{- end }}
+  ports:
+    - name: {{ ternary "https-registry" "http-registry" .Values.internalTLS.enabled }}
+      port: {{ template "harbor.registry.servicePort" . }}
+
+    - name: {{ ternary "https-controller" "http-controller" .Values.internalTLS.enabled }}
+      port: {{ template "harbor.registryctl.servicePort" . }}
+{{- if .Values.metrics.enabled}}
+    - name: {{ template "harbor.metricsPortName" . }}
+      port: {{ .Values.metrics.registry.port }}
+{{- end }}
+  selector:
+{{ include "harbor.matchLabels" . | indent 4 }}
+    component: registry
diff --git a/packages/system/harbor/charts/harbor/templates/registry/registry-tls.yaml b/packages/system/harbor/charts/harbor/templates/registry/registry-tls.yaml
new file mode 100644
index 00000000..ec4540c2
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/registry/registry-tls.yaml
@@ -0,0 +1,16 @@
+{{- if and .Values.internalTLS.enabled }}
+{{- if eq .Values.internalTLS.certSource "manual" }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "harbor.internalTLS.registry.secretName" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: kubernetes.io/tls
+data:
+  ca.crt: {{ (required "The \"internalTLS.trustCa\" is required!" .Values.internalTLS.trustCa) | b64enc | quote }}
+  tls.crt: {{ (required "The \"internalTLS.registry.crt\" is required!" .Values.internalTLS.registry.crt) | b64enc | quote }}
+  tls.key: {{ (required "The \"internalTLS.registry.key\" is required!" .Values.internalTLS.registry.key) | b64enc | quote }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/registry/registryctl-cm.yaml b/packages/system/harbor/charts/harbor/templates/registry/registryctl-cm.yaml
new file mode 100644
index 00000000..61b2c5e1
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/registry/registryctl-cm.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "{{ template "harbor.registryCtl" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+data:
+  {{- template "harbor.traceEnvsForRegistryCtl" . }}
diff --git a/packages/system/harbor/charts/harbor/templates/registry/registryctl-secret.yaml b/packages/system/harbor/charts/harbor/templates/registry/registryctl-secret.yaml
new file mode 100644
index 00000000..324a2e03
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/registry/registryctl-secret.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "harbor.registryCtl" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: Opaque
+data:
+  {{- template "harbor.traceJaegerPassword" . }}
diff --git a/packages/system/harbor/charts/harbor/templates/trivy/trivy-secret.yaml b/packages/system/harbor/charts/harbor/templates/trivy/trivy-secret.yaml
new file mode 100644
index 00000000..b13f8800
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/trivy/trivy-secret.yaml
@@ -0,0 +1,13 @@
+{{- if .Values.trivy.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "harbor.trivy" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: Opaque
+data:
+  redisURL: {{ include "harbor.redis.urlForTrivy" . | b64enc }}
+  gitHubToken: {{  .Values.trivy.gitHubToken | default "" | b64enc | quote }}
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/trivy/trivy-sts.yaml b/packages/system/harbor/charts/harbor/templates/trivy/trivy-sts.yaml
new file mode 100644
index 00000000..19b01a2e
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/trivy/trivy-sts.yaml
@@ -0,0 +1,237 @@
+{{- if .Values.trivy.enabled }}
+{{- $trivy := .Values.persistence.persistentVolumeClaim.trivy }}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ template "harbor.trivy" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+    component: trivy
+    app.kubernetes.io/component: trivy
+spec:
+  replicas: {{ .Values.trivy.replicas }}
+  serviceName: {{  template "harbor.trivy" . }}
+  selector:
+    matchLabels:
+{{ include "harbor.matchLabels" . | indent 6 }}
+      component: trivy
+  template:
+    metadata:
+      labels:
+{{ include "harbor.labels" . | indent 8 }}
+        component: trivy
+        app.kubernetes.io/component: trivy
+{{- if .Values.trivy.podLabels }}
+{{ toYaml .Values.trivy.podLabels | indent 8 }}
+{{- end }}
+      annotations:
+        checksum/secret: {{ include (print $.Template.BasePath "/trivy/trivy-secret.yaml") . | sha256sum }}
+{{- if and .Values.internalTLS.enabled (eq .Values.internalTLS.certSource "auto") }}
+        checksum/tls: {{ include (print $.Template.BasePath "/internal/auto-tls.yaml") . | sha256sum }}
+{{- else if and .Values.internalTLS.enabled (eq .Values.internalTLS.certSource "manual") }}
+        checksum/tls: {{ include (print $.Template.BasePath "/trivy/trivy-tls.yaml") . | sha256sum }}
+{{- end }}
+{{- if .Values.trivy.podAnnotations }}
+{{ toYaml .Values.trivy.podAnnotations | indent 8 }}
+{{- end }}
+    spec:
+{{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+{{- end }}
+{{- if .Values.trivy.serviceAccountName }}
+      serviceAccountName: {{ .Values.trivy.serviceAccountName }}
+{{- end }}
+      securityContext:
+        runAsUser: 10000
+        fsGroup: 10000
+      automountServiceAccountToken: {{ .Values.trivy.automountServiceAccountToken | default false }}
+{{- with .Values.trivy.topologySpreadConstraints}}
+      topologySpreadConstraints:
+{{- range . }}
+      - {{ . | toYaml | indent 8 | trim }}
+        labelSelector:
+          matchLabels:
+{{ include "harbor.matchLabels" $ | indent 12 }}
+            component: trivy
+{{- end }}
+{{- end }}
+      {{- with .Values.trivy.initContainers }}
+      initContainers:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: trivy
+          image: {{ .Values.trivy.image.repository }}:{{ .Values.trivy.image.tag }}
+          imagePullPolicy: {{ .Values.imagePullPolicy }}
+          {{- if not (empty .Values.containerSecurityContext) }}
+          securityContext: {{ .Values.containerSecurityContext | toYaml | nindent 12 }}
+          {{- end }}
+          env:
+          {{- if has "trivy" .Values.proxy.components }}
+            - name: HTTP_PROXY
+              value: "{{ .Values.proxy.httpProxy }}"
+            - name: HTTPS_PROXY
+              value: "{{ .Values.proxy.httpsProxy }}"
+            - name: NO_PROXY
+              value: "{{ template "harbor.noProxy" . }}"
+          {{- end }}
+            - name: "SCANNER_LOG_LEVEL"
+              value: {{ .Values.logLevel | quote }}
+            - name: "SCANNER_TRIVY_CACHE_DIR"
+              value: "/home/scanner/.cache/trivy"
+            - name: "SCANNER_TRIVY_REPORTS_DIR"
+              value: "/home/scanner/.cache/reports"
+            - name: "SCANNER_TRIVY_DEBUG_MODE"
+              value: {{ .Values.trivy.debugMode | quote }}
+            - name: "SCANNER_TRIVY_VULN_TYPE"
+              value: {{ .Values.trivy.vulnType | quote }}
+            - name: "SCANNER_TRIVY_TIMEOUT"
+              value: {{ .Values.trivy.timeout | quote }}
+            - name: "SCANNER_TRIVY_GITHUB_TOKEN"
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "harbor.trivy" . }}
+                  key: gitHubToken
+            - name: "SCANNER_TRIVY_SEVERITY"
+              value: {{ .Values.trivy.severity | quote }}
+            - name: "SCANNER_TRIVY_IGNORE_UNFIXED"
+              value: {{ .Values.trivy.ignoreUnfixed | default false | quote }}
+            - name: "SCANNER_TRIVY_SKIP_UPDATE"
+              value: {{ .Values.trivy.skipUpdate | default false | quote }}
+            - name: "SCANNER_TRIVY_SKIP_JAVA_DB_UPDATE"
+              value: {{ .Values.trivy.skipJavaDBUpdate | default false | quote }}
+            - name: "SCANNER_TRIVY_DB_REPOSITORY"
+              value: {{ .Values.trivy.dbRepository | join "," | quote }}
+            - name: "SCANNER_TRIVY_JAVA_DB_REPOSITORY"
+              value: {{ .Values.trivy.javaDBRepository | join "," | quote }}
+            - name: "SCANNER_TRIVY_OFFLINE_SCAN"
+              value: {{ .Values.trivy.offlineScan | default false | quote }}
+            - name: "SCANNER_TRIVY_SECURITY_CHECKS"
+              value: {{ .Values.trivy.securityCheck | quote }}
+            - name: "SCANNER_TRIVY_INSECURE"
+              value: {{ .Values.trivy.insecure | default false | quote }}
+            - name: SCANNER_API_SERVER_ADDR
+              value: ":{{ template "harbor.trivy.containerPort" . }}"
+            {{- if .Values.internalTLS.enabled }}
+            - name: INTERNAL_TLS_ENABLED
+              value: "true"
+            - name: SCANNER_API_SERVER_TLS_KEY
+              value: /etc/harbor/ssl/trivy/tls.key
+            - name: SCANNER_API_SERVER_TLS_CERTIFICATE
+              value: /etc/harbor/ssl/trivy/tls.crt
+            {{- end }}
+            - name: "SCANNER_REDIS_URL"
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "harbor.trivy" . }}
+                  key: redisURL
+            - name: "SCANNER_STORE_REDIS_URL"
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "harbor.trivy" . }}
+                  key: redisURL
+            - name: "SCANNER_JOB_QUEUE_REDIS_URL"
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "harbor.trivy" . }}
+                  key: redisURL
+{{- with .Values.trivy.extraEnvVars }}
+{{- toYaml . | nindent 12 }}
+{{- end }}
+          ports:
+            - name: api-server
+              containerPort: {{ template "harbor.trivy.containerPort" . }}
+          volumeMounts:
+          - name: data
+            mountPath: /home/scanner/.cache
+            subPath: {{ .Values.persistence.persistentVolumeClaim.trivy.subPath }}
+            readOnly: false
+          {{- if .Values.internalTLS.enabled }}
+          - name: trivy-internal-certs
+            mountPath: /etc/harbor/ssl/trivy
+          {{- end }}
+          {{- if .Values.caBundleSecretName }}
+{{ include "harbor.caBundleVolumeMount" . | indent 10 }}
+          {{- end }}
+          livenessProbe:
+            httpGet:
+              scheme: {{ include "harbor.component.scheme" . | upper }}
+              path: /probe/healthy
+              port: api-server
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            successThreshold: 1
+            failureThreshold: 10
+          readinessProbe:
+            httpGet:
+              scheme: {{ include "harbor.component.scheme" . | upper }}
+              path: /probe/ready
+              port: api-server
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            successThreshold: 1
+            failureThreshold: 3
+          resources:
+{{ toYaml .Values.trivy.resources | indent 12 }}
+      {{- if or (or .Values.internalTLS.enabled .Values.caBundleSecretName) (or (not .Values.persistence.enabled) $trivy.existingClaim) }}
+      volumes:
+      {{- if .Values.internalTLS.enabled }}
+      - name: trivy-internal-certs
+        secret:
+          secretName: {{ template "harbor.internalTLS.trivy.secretName" . }}
+      {{- end }}
+      {{- if .Values.caBundleSecretName }}
+{{ include "harbor.caBundleVolume" . | indent 6 }}
+      {{- end }}
+      {{- if not .Values.persistence.enabled }}
+      - name: "data"
+        emptyDir: {}
+      {{- else if $trivy.existingClaim }}
+      - name: "data"
+        persistentVolumeClaim:
+          claimName: {{ $trivy.existingClaim }}
+      {{- end }}
+      {{- end }}
+    {{- with .Values.trivy.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.trivy.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.trivy.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- if .Values.trivy.priorityClassName }}
+      priorityClassName: {{ .Values.trivy.priorityClassName }}
+    {{- end }}
+{{- if and .Values.persistence.enabled (not $trivy.existingClaim) }}
+  volumeClaimTemplates:
+  - apiVersion: v1	
+    kind: PersistentVolumeClaim
+    metadata:
+      name: data
+      labels:
+{{ include "harbor.legacy.labels" . | indent 8 }}
+      annotations:
+      {{- range $key, $value := $trivy.annotations }}
+        {{ $key }}: {{ $value | quote }}
+      {{- end }}
+    spec:
+      accessModes: [{{ $trivy.accessMode | quote }}]
+      {{- if $trivy.storageClass }}
+      {{- if (eq "-" $trivy.storageClass) }}
+      storageClassName: ""
+      {{- else }}
+      storageClassName: "{{ $trivy.storageClass }}"
+      {{- end }}
+      {{- end }}
+      resources:
+        requests:
+          storage: {{ $trivy.size | quote }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/templates/trivy/trivy-svc.yaml b/packages/system/harbor/charts/harbor/templates/trivy/trivy-svc.yaml
new file mode 100644
index 00000000..a9fb9bf4
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/trivy/trivy-svc.yaml
@@ -0,0 +1,23 @@
+{{ if .Values.trivy.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ template "harbor.trivy" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+spec:
+{{- if .Values.ipFamily.policy }}
+  ipFamilyPolicy: {{ .Values.ipFamily.policy }}
+{{- end }}
+{{- if .Values.ipFamily.families }}
+  ipFamilies: {{ toYaml .Values.ipFamily.families | nindent 4 }}
+{{- end }}
+  ports:
+    - name: {{ ternary "https-trivy" "http-trivy" .Values.internalTLS.enabled }}
+      protocol: TCP
+      port: {{ template "harbor.trivy.servicePort" . }}
+  selector:
+{{ include "harbor.matchLabels" . | indent 4 }}
+    component: trivy
+{{ end }}
diff --git a/packages/system/harbor/charts/harbor/templates/trivy/trivy-tls.yaml b/packages/system/harbor/charts/harbor/templates/trivy/trivy-tls.yaml
new file mode 100644
index 00000000..58bce4ec
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/templates/trivy/trivy-tls.yaml
@@ -0,0 +1,16 @@
+{{- if and .Values.trivy.enabled .Values.internalTLS.enabled  }}
+{{- if eq .Values.internalTLS.certSource "manual" }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "harbor.internalTLS.trivy.secretName" . }}"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+{{ include "harbor.labels" . | indent 4 }}
+type: kubernetes.io/tls
+data:
+  ca.crt: {{ (required "The \"internalTLS.trustCa\" is required!" .Values.internalTLS.trustCa) | b64enc | quote }}
+  tls.crt: {{ (required "The \"internalTLS.trivy.crt\" is required!" .Values.internalTLS.trivy.crt) | b64enc | quote }}
+  tls.key: {{ (required "The \"internalTLS.trivy.key\" is required!" .Values.internalTLS.trivy.key) | b64enc | quote }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/harbor/charts/harbor/values.yaml b/packages/system/harbor/charts/harbor/values.yaml
new file mode 100644
index 00000000..e00fafc3
--- /dev/null
+++ b/packages/system/harbor/charts/harbor/values.yaml
@@ -0,0 +1,1095 @@
+expose:
+  # Set how to expose the service. Set the type as "ingress", "clusterIP", "nodePort" or "loadBalancer"
+  # and fill the information in the corresponding section
+  type: ingress
+  tls:
+    # Enable TLS or not.
+    # Delete the "ssl-redirect" annotations in "expose.ingress.annotations" when TLS is disabled and "expose.type" is "ingress"
+    # Note: if the "expose.type" is "ingress" and TLS is disabled,
+    # the port must be included in the command when pulling/pushing images.
+    # Refer to https://github.com/goharbor/harbor/issues/5291 for details.
+    enabled: true
+    # The source of the tls certificate. Set as "auto", "secret"
+    # or "none" and fill the information in the corresponding section
+    # 1) auto: generate the tls certificate automatically
+    # 2) secret: read the tls certificate from the specified secret.
+    # The tls certificate can be generated manually or by cert manager
+    # 3) none: configure no tls certificate for the ingress. If the default
+    # tls certificate is configured in the ingress controller, choose this option
+    certSource: auto
+    auto:
+      # The common name used to generate the certificate, it's necessary
+      # when the type isn't "ingress"
+      commonName: ""
+    secret:
+      # The name of secret which contains keys named:
+      # "tls.crt" - the certificate
+      # "tls.key" - the private key
+      secretName: ""
+  ingress:
+    hosts:
+      core: core.harbor.domain
+    # set to the type of ingress controller if it has specific requirements.
+    # leave as `default` for most ingress controllers.
+    # set to `gce` if using the GCE ingress controller
+    # set to `ncp` if using the NCP (NSX-T Container Plugin) ingress controller
+    # set to `alb` if using the ALB ingress controller
+    # set to `f5-bigip` if using the F5 BIG-IP ingress controller
+    controller: default
+    ## Allow .Capabilities.KubeVersion.Version to be overridden while creating ingress
+    kubeVersionOverride: ""
+    className: ""
+    annotations:
+      # note different ingress controllers may require a different ssl-redirect annotation
+      # for Envoy, use ingress.kubernetes.io/force-ssl-redirect: "true" and remove the nginx lines below
+      ingress.kubernetes.io/ssl-redirect: "true"
+      ingress.kubernetes.io/proxy-body-size: "0"
+      nginx.ingress.kubernetes.io/ssl-redirect: "true"
+      nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    # ingress-specific labels
+    labels: {}
+  route:
+    labels: {}
+    annotations: {}
+      # - name: envoy-internal
+      #   namespace: networking
+      #   sectionName: https
+      #   group: gateway.networking.k8s.io
+      #   kind: Gateway
+    parentRefs: {}
+      # - "harbor.example.com"
+    hosts: []
+  clusterIP:
+    # The name of ClusterIP service
+    name: harbor
+    # The ip address of the ClusterIP service (leave empty for acquiring dynamic ip)
+    staticClusterIP: ""
+    ports:
+      # The service port Harbor listens on when serving HTTP
+      httpPort: 80
+      # The service port Harbor listens on when serving HTTPS
+      httpsPort: 443
+    # Annotations on the ClusterIP service
+    annotations: {}
+    # ClusterIP-specific labels
+    labels: {}
+  nodePort:
+    # The name of NodePort service
+    name: harbor
+    ports:
+      http:
+        # The service port Harbor listens on when serving HTTP
+        port: 80
+        # The node port Harbor listens on when serving HTTP
+        nodePort: 30002
+      https:
+        # The service port Harbor listens on when serving HTTPS
+        port: 443
+        # The node port Harbor listens on when serving HTTPS
+        nodePort: 30003
+    # Annotations on the nodePort service
+    annotations: {}
+    # nodePort-specific labels
+    labels: {}
+  loadBalancer:
+    # The name of LoadBalancer service
+    name: harbor
+    # Set the IP if the LoadBalancer supports assigning IP
+    IP: ""
+    ports:
+      # The service port Harbor listens on when serving HTTP
+      httpPort: 80
+      # The service port Harbor listens on when serving HTTPS
+      httpsPort: 443
+    # Annotations on the loadBalancer service
+    annotations: {}
+    # loadBalancer-specific labels
+    labels: {}
+    sourceRanges: []
+
+# The external URL for Harbor core service. It is used to
+# 1) populate the docker/helm commands showed on portal
+# 2) populate the token service URL returned to docker client
+#
+# Format: protocol://domain[:port]. Usually:
+# 1) if "expose.type" is "ingress", the "domain" should be
+# the value of "expose.ingress.hosts.core"
+# 2) if "expose.type" is "clusterIP", the "domain" should be
+# the value of "expose.clusterIP.name"
+# 3) if "expose.type" is "nodePort", the "domain" should be
+# the IP address of k8s node
+#
+# If Harbor is deployed behind the proxy, set it as the URL of proxy
+externalURL: https://core.harbor.domain
+
+# The persistence is enabled by default and a default StorageClass
+# is needed in the k8s cluster to provision volumes dynamically.
+# Specify another StorageClass in the "storageClass" or set "existingClaim"
+# if you already have existing persistent volumes to use
+#
+# For storing images and charts, you can also use "azure", "gcs", "s3",
+# "swift" or "oss". Set it in the "imageChartStorage" section
+persistence:
+  enabled: true
+  # Setting it to "keep" to avoid removing PVCs during a helm delete
+  # operation. Leaving it empty will delete PVCs after the chart deleted
+  # (this does not apply for PVCs that are created for internal database
+  # and redis components, i.e. they are never deleted automatically)
+  resourcePolicy: "keep"
+  persistentVolumeClaim:
+    registry:
+      # Use the existing PVC which must be created manually before bound,
+      # and specify the "subPath" if the PVC is shared with other components
+      existingClaim: ""
+      # Specify the "storageClass" used to provision the volume. Or the default
+      # StorageClass will be used (the default).
+      # Set it to "-" to disable dynamic provisioning
+      storageClass: ""
+      subPath: ""
+      accessMode: ReadWriteOnce
+      size: 5Gi
+      annotations: {}
+    jobservice:
+      jobLog:
+        existingClaim: ""
+        storageClass: ""
+        subPath: ""
+        accessMode: ReadWriteOnce
+        size: 1Gi
+        annotations: {}
+    # If external database is used, the following settings for database will
+    # be ignored
+    database:
+      existingClaim: ""
+      storageClass: ""
+      subPath: ""
+      accessMode: ReadWriteOnce
+      size: 1Gi
+      annotations: {}
+    # If external Redis is used, the following settings for Redis will
+    # be ignored
+    redis:
+      existingClaim: ""
+      storageClass: ""
+      subPath: ""
+      accessMode: ReadWriteOnce
+      size: 1Gi
+      annotations: {}
+    trivy:
+      existingClaim: ""
+      storageClass: ""
+      subPath: ""
+      accessMode: ReadWriteOnce
+      size: 5Gi
+      annotations: {}
+  # Define which storage backend is used for registry to store
+  # images and charts. Refer to
+  # https://github.com/distribution/distribution/blob/release/2.8/docs/configuration.md#storage
+  # for the detail.
+  imageChartStorage:
+    # Specify whether to disable `redirect` for images and chart storage, for
+    # backends which not supported it (such as using minio for `s3` storage type), please disable
+    # it. To disable redirects, simply set `disableredirect` to `true` instead.
+    # Refer to
+    # https://github.com/distribution/distribution/blob/release/2.8/docs/configuration.md#redirect
+    # for the detail.
+    disableredirect: false
+    # Specify the "caBundleSecretName" if the storage service uses a self-signed certificate.
+    # The secret must contain keys named "ca.crt" which will be injected into the trust store
+    # of registry's containers.
+    # caBundleSecretName:
+
+    # Specify the type of storage: "filesystem", "azure", "gcs", "s3", "swift",
+    # "oss" and fill the information needed in the corresponding section. The type
+    # must be "filesystem" if you want to use persistent volumes for registry
+    type: filesystem
+    filesystem:
+      rootdirectory: /storage
+      #maxthreads: 100
+    azure:
+      accountname: accountname
+      accountkey: base64encodedaccountkey
+      container: containername
+      #realm: core.windows.net
+      # To use existing secret, the key must be AZURE_STORAGE_ACCESS_KEY
+      existingSecret: ""
+    gcs:
+      bucket: bucketname
+      # The base64 encoded json file which contains the key
+      encodedkey: base64-encoded-json-key-file
+      #rootdirectory: /gcs/object/name/prefix
+      #chunksize: "5242880"
+      # To use existing secret, the key must be GCS_KEY_DATA
+      existingSecret: ""
+      useWorkloadIdentity: false
+    s3:
+      # Set an existing secret for S3 accesskey and secretkey
+      # keys in the secret should be REGISTRY_STORAGE_S3_ACCESSKEY and REGISTRY_STORAGE_S3_SECRETKEY for registry
+      #existingSecret: ""
+      region: us-west-1
+      bucket: bucketname
+      #accesskey: awsaccesskey
+      #secretkey: awssecretkey
+      #regionendpoint: http://myobjects.local
+      #encrypt: false
+      #keyid: mykeyid
+      #secure: true
+      #skipverify: false
+      #v4auth: true
+      #chunksize: "5242880"
+      #rootdirectory: /s3/object/name/prefix
+      #storageclass: STANDARD
+      #multipartcopychunksize: "33554432"
+      #multipartcopymaxconcurrency: 100
+      #multipartcopythresholdsize: "33554432"
+    swift:
+      authurl: https://storage.myprovider.com/v3/auth
+      username: username
+      password: password
+      container: containername
+      # keys in existing secret must be REGISTRY_STORAGE_SWIFT_PASSWORD, REGISTRY_STORAGE_SWIFT_SECRETKEY, REGISTRY_STORAGE_SWIFT_ACCESSKEY
+      existingSecret: ""
+      #region: fr
+      #tenant: tenantname
+      #tenantid: tenantid
+      #domain: domainname
+      #domainid: domainid
+      #trustid: trustid
+      #insecureskipverify: false
+      #chunksize: 5M
+      #prefix:
+      #secretkey: secretkey
+      #accesskey: accesskey
+      #authversion: 3
+      #endpointtype: public
+      #tempurlcontainerkey: false
+      #tempurlmethods:
+    oss:
+      accesskeyid: accesskeyid
+      accesskeysecret: accesskeysecret
+      region: regionname
+      bucket: bucketname
+      # key in existingSecret must be REGISTRY_STORAGE_OSS_ACCESSKEYSECRET
+      existingSecret: ""
+      #endpoint: endpoint
+      #internal: false
+      #encrypt: false
+      #secure: true
+      #chunksize: 10M
+      #rootdirectory: rootdirectory
+
+# The initial password of Harbor admin. Change it from portal after launching Harbor
+# or give an existing secret for it
+# key in secret is given via (default to HARBOR_ADMIN_PASSWORD)
+existingSecretAdminPassword: ""
+existingSecretAdminPasswordKey: HARBOR_ADMIN_PASSWORD
+harborAdminPassword: "Harbor12345"
+
+# The internal TLS used for harbor components secure communicating. In order to enable https
+# in each component tls cert files need to provided in advance.
+internalTLS:
+  # If internal TLS enabled
+  enabled: false
+  # enable strong ssl ciphers (default: false)
+  strong_ssl_ciphers: false
+  # There are three ways to provide tls
+  # 1) "auto" will generate cert automatically
+  # 2) "manual" need provide cert file manually in following value
+  # 3) "secret" internal certificates from secret
+  certSource: "auto"
+  # The content of trust ca, only available when `certSource` is "manual"
+  trustCa: ""
+  # core related cert configuration
+  core:
+    # secret name for core's tls certs
+    secretName: ""
+    # Content of core's TLS cert file, only available when `certSource` is "manual"
+    crt: ""
+    # Content of core's TLS key file, only available when `certSource` is "manual"
+    key: ""
+  # jobservice related cert configuration
+  jobservice:
+    # secret name for jobservice's tls certs
+    secretName: ""
+    # Content of jobservice's TLS key file, only available when `certSource` is "manual"
+    crt: ""
+    # Content of jobservice's TLS key file, only available when `certSource` is "manual"
+    key: ""
+  # registry related cert configuration
+  registry:
+    # secret name for registry's tls certs
+    secretName: ""
+    # Content of registry's TLS key file, only available when `certSource` is "manual"
+    crt: ""
+    # Content of registry's TLS key file, only available when `certSource` is "manual"
+    key: ""
+  # portal related cert configuration
+  portal:
+    # secret name for portal's tls certs
+    secretName: ""
+    # Content of portal's TLS key file, only available when `certSource` is "manual"
+    crt: ""
+    # Content of portal's TLS key file, only available when `certSource` is "manual"
+    key: ""
+  # trivy related cert configuration
+  trivy:
+    # secret name for trivy's tls certs
+    secretName: ""
+    # Content of trivy's TLS key file, only available when `certSource` is "manual"
+    crt: ""
+    # Content of trivy's TLS key file, only available when `certSource` is "manual"
+    key: ""
+
+ipFamily:
+  # ipv6Enabled set to true if ipv6 is enabled in cluster, currently it affected the nginx related component
+  ipv6:
+    enabled: true
+  # ipv4Enabled set to true if ipv4 is enabled in cluster, currently it affected the nginx related component
+  ipv4:
+    enabled: true
+
+  # Sets the IP family policy for services to be able to configure dual-stack; see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services).
+  policy: ""
+  # A list of IP families for services that should be supported, in the order in which they should be applied to ClusterIP. Can be "IPv4" and/or "IPv6".
+  families: []
+
+imagePullPolicy: IfNotPresent
+
+# Use this set to assign a list of default pullSecrets
+imagePullSecrets:
+#  - name: docker-registry-secret
+#  - name: internal-registry-secret
+
+# The update strategy for deployments with persistent volumes(jobservice, registry): "RollingUpdate" or "Recreate"
+# Set it as "Recreate" when "RWM" for volumes isn't supported
+updateStrategy:
+  type: RollingUpdate
+
+# debug, info, warning, error or fatal
+logLevel: info
+
+# The name of the secret which contains key named "ca.crt". Setting this enables the
+# download link on portal to download the CA certificate when the certificate isn't
+# generated automatically
+caSecretName: ""
+
+# The secret key used for encryption. Must be a string of 16 chars.
+secretKey: "not-a-secure-key"
+# If using existingSecretSecretKey, the key must be secretKey
+existingSecretSecretKey: ""
+
+# The proxy settings for updating trivy vulnerabilities from the Internet and replicating
+# artifacts from/to the registries that cannot be reached directly
+proxy:
+  httpProxy:
+  httpsProxy:
+  noProxy: 127.0.0.1,localhost,.local,.internal
+  components:
+    - core
+    - jobservice
+    - trivy
+
+# Run the migration job via helm hook
+enableMigrateHelmHook: false
+
+# The custom ca bundle secret, the secret must contain key named "ca.crt"
+# which will be injected into the trust store for core, jobservice, registry, trivy components
+# caBundleSecretName: ""
+
+## UAA Authentication Options
+# If you're using UAA for authentication behind a self-signed
+# certificate you will need to provide the CA Cert.
+# Set uaaSecretName below to provide a pre-created secret that
+# contains a base64 encoded CA Certificate named `ca.crt`.
+# uaaSecretName:
+
+metrics:
+  enabled: false
+  core:
+    path: /metrics
+    port: 8001
+  registry:
+    path: /metrics
+    port: 8001
+  jobservice:
+    path: /metrics
+    port: 8001
+  exporter:
+    path: /metrics
+    port: 8001
+  ## Create prometheus serviceMonitor to scrape harbor metrics.
+  ## This requires the monitoring.coreos.com/v1 CRD. Please see
+  ## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/user-guides/getting-started.md
+  ##
+  serviceMonitor:
+    enabled: false
+    additionalLabels: {}
+    # Scrape interval. If not set, the Prometheus default scrape interval is used.
+    interval: ""
+    # Metric relabel configs to apply to samples before ingestion.
+    metricRelabelings:
+      []
+      # - action: keep
+    #   regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+'
+    #   sourceLabels: [__name__]
+    # Relabel configs to apply to samples before ingestion.
+    relabelings:
+      []
+      # - sourceLabels: [__meta_kubernetes_pod_node_name]
+      #   separator: ;
+      #   regex: ^(.*)$
+      #   targetLabel: nodename
+    #   replacement: $1
+    #   action: replace
+
+trace:
+  enabled: false
+  # trace provider: jaeger or otel
+  # jaeger should be 1.26+
+  provider: jaeger
+  # set sample_rate to 1 if you wanna sampling 100% of trace data; set 0.5 if you wanna sampling 50% of trace data, and so forth
+  sample_rate: 1
+  # namespace used to differentiate different harbor services
+  # namespace:
+  # attributes is a key value dict contains user defined attributes used to initialize trace provider
+  # attributes:
+  #   application: harbor
+  jaeger:
+    # jaeger supports two modes:
+    #   collector mode(uncomment endpoint and uncomment username, password if needed)
+    #   agent mode(uncomment agent_host and agent_port)
+    endpoint: http://hostname:14268/api/traces
+    # username:
+    # password:
+    # agent_host: hostname
+    # export trace data by jaeger.thrift in compact mode
+    # agent_port: 6831
+  otel:
+    endpoint: hostname:4318
+    url_path: /v1/traces
+    compression: false
+    insecure: true
+    # timeout is in seconds
+    timeout: 10
+
+# cache layer configurations
+# if this feature enabled, harbor will cache the resource
+# `project/project_metadata/repository/artifact/manifest` in the redis
+# which help to improve the performance of high concurrent pulling manifest.
+cache:
+  # default is not enabled.
+  enabled: false
+  # default keep cache for one day.
+  expireHours: 24
+
+## set Container Security Context to comply with PSP restricted policy if necessary
+## each of the conatiner will apply the same security context
+## containerSecurityContext:{} is initially an empty yaml that you could edit it on demand, we just filled with a common template for convenience
+containerSecurityContext:
+  privileged: false
+  allowPrivilegeEscalation: false
+  seccompProfile:
+    type: RuntimeDefault
+  runAsNonRoot: true
+  capabilities:
+    drop:
+      - ALL
+
+# If service exposed via "ingress", the Nginx will not be used
+nginx:
+  image:
+    repository: goharbor/nginx-photon
+    tag: v2.14.2
+  # set the service account to be used, default if left empty
+  serviceAccountName: ""
+  # mount the service account token
+  automountServiceAccountToken: false
+  replicas: 1
+  revisionHistoryLimit: 10
+  # resources:
+  #  requests:
+  #    memory: 256Mi
+  #    cpu: 100m
+  extraEnvVars: []
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  # Spread Pods across failure-domains like regions, availability zones or nodes
+  topologySpreadConstraints: []
+  # - maxSkew: 1
+  #   topologyKey: topology.kubernetes.io/zone
+  #   nodeTaintsPolicy: Honor
+  #   whenUnsatisfiable: DoNotSchedule
+  ## Additional deployment annotations
+  podAnnotations: {}
+  ## Additional deployment labels
+  podLabels: {}
+  ## The priority class to run the pod as
+  priorityClassName:
+
+portal:
+  image:
+    repository: goharbor/harbor-portal
+    tag: v2.14.2
+  # set the service account to be used, default if left empty
+  serviceAccountName: ""
+  # mount the service account token
+  automountServiceAccountToken: false
+  replicas: 1
+  revisionHistoryLimit: 10
+  # resources:
+  #  requests:
+  #    memory: 256Mi
+  #    cpu: 100m
+  extraEnvVars: []
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  # Spread Pods across failure-domains like regions, availability zones or nodes
+  topologySpreadConstraints: []
+  # - maxSkew: 1
+  #   topologyKey: topology.kubernetes.io/zone
+  #   nodeTaintsPolicy: Honor
+  #   whenUnsatisfiable: DoNotSchedule
+  ## Additional deployment annotations
+  podAnnotations: {}
+  ## Additional deployment labels
+  podLabels: {}
+  ## Additional service annotations
+  serviceAnnotations: {}
+  ## The priority class to run the pod as
+  priorityClassName:
+  # containers to be run before the controller's container starts.
+  initContainers: []
+  # Example:
+  #
+  # - name: wait
+  #   image: busybox
+  #   command: [ 'sh', '-c', "sleep 20" ]
+
+core:
+  image:
+    repository: goharbor/harbor-core
+    tag: v2.14.2
+  # set the service account to be used, default if left empty
+  serviceAccountName: ""
+  # mount the service account token
+  automountServiceAccountToken: false
+  replicas: 1
+  revisionHistoryLimit: 10
+  ## Startup probe values
+  startupProbe:
+    enabled: true
+    initialDelaySeconds: 10
+  # resources:
+  #  requests:
+  #    memory: 256Mi
+  #    cpu: 100m
+  extraEnvVars: []
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  # Spread Pods across failure-domains like regions, availability zones or nodes
+  topologySpreadConstraints: []
+  # - maxSkew: 1
+  #   topologyKey: topology.kubernetes.io/zone
+  #   nodeTaintsPolicy: Honor
+  #   whenUnsatisfiable: DoNotSchedule
+  ## Additional deployment annotations
+  podAnnotations: {}
+  ## Additional deployment labels
+  podLabels: {}
+  ## Additional service annotations
+  serviceAnnotations: {}
+  ## The priority class to run the pod as
+  priorityClassName:
+  # containers to be run before the controller's container starts.
+  initContainers: []
+  # Example:
+  #
+  # - name: wait
+  #   image: busybox
+  #   command: [ 'sh', '-c', "sleep 20" ]
+  ## User settings configuration json string
+  configureUserSettings:
+  # The provider for updating project quota(usage), there are 2 options, redis or db.
+  # By default it is implemented by db but you can configure it to redis which
+  # can improve the performance of high concurrent pushing to the same project,
+  # and reduce the database connections spike and occupies.
+  # Using redis will bring up some delay for quota usage updation for display, so only
+  # suggest switch provider to redis if you were ran into the db connections spike around
+  # the scenario of high concurrent pushing to same project, no improvment for other scenes.
+  quotaUpdateProvider: db # Or redis
+  # Secret is used when core server communicates with other components.
+  # If a secret key is not specified, Helm will generate one. Alternatively set existingSecret to use an existing secret
+  # Must be a string of 16 chars.
+  secret: ""
+  # Fill in the name of a kubernetes secret if you want to use your own
+  # If using existingSecret, the key must be secret
+  existingSecret: ""
+  # Fill the name of a kubernetes secret if you want to use your own
+  # TLS certificate and private key for token encryption/decryption.
+  # The secret must contain keys named:
+  # "tls.key" - the private key
+  # "tls.crt" - the certificate
+  secretName: ""
+  # If not specifying a preexisting secret, a secret can be created from tokenKey and tokenCert and used instead.
+  # If none of secretName, tokenKey, and tokenCert are specified, an ephemeral key and certificate will be autogenerated.
+  # tokenKey and tokenCert must BOTH be set or BOTH unset.
+  # The tokenKey value is formatted as a multiline string containing a PEM-encoded RSA key, indented one more than tokenKey on the following line.
+  tokenKey: |
+  # If tokenKey is set, the value of tokenCert must be set as a PEM-encoded certificate signed by tokenKey, and supplied as a multiline string, indented one more than tokenCert on the following line.
+  tokenCert: |
+  # The XSRF key. Will be generated automatically if it isn't specified
+  # While you specified, Please make sure it is 32 characters, otherwise would have validation issue at the harbor-core runtime
+  # https://github.com/goharbor/harbor/pull/21154
+  xsrfKey: ""
+  # If using existingSecret, the key is defined by core.existingXsrfSecretKey
+  existingXsrfSecret: ""
+  # If using existingSecret, the key
+  existingXsrfSecretKey: CSRF_KEY
+  # The time duration for async update artifact pull_time and repository
+  # pull_count, the unit is second. Will be 10 seconds if it isn't set.
+  # eg. artifactPullAsyncFlushDuration: 10
+  artifactPullAsyncFlushDuration:
+  gdpr:
+    deleteUser: false
+    auditLogsCompliant: false
+
+jobservice:
+  image:
+    repository: goharbor/harbor-jobservice
+    tag: v2.14.2
+  # set the service account to be used, default if left empty
+  serviceAccountName: ""
+  # mount the service account token
+  automountServiceAccountToken: false
+  replicas: 1
+  revisionHistoryLimit: 10
+  # resources:
+  #   requests:
+  #     memory: 256Mi
+  #     cpu: 100m
+  extraEnvVars: []
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  # Spread Pods across failure-domains like regions, availability zones or nodes
+  topologySpreadConstraints:
+  # - maxSkew: 1
+  #   topologyKey: topology.kubernetes.io/zone
+  #   nodeTaintsPolicy: Honor
+  #   whenUnsatisfiable: DoNotSchedule
+  ## Additional deployment annotations
+  podAnnotations: {}
+  ## Additional deployment labels
+  podLabels: {}
+  ## The priority class to run the pod as
+  priorityClassName:
+  # containers to be run before the controller's container starts.
+  initContainers: []
+  # Example:
+  #
+  # - name: wait
+  #   image: busybox
+  #   command: [ 'sh', '-c', "sleep 20" ]
+  maxJobWorkers: 10
+  # The logger for jobs: "file", "database" or "stdout"
+  jobLoggers:
+    - file
+    # - database
+    # - stdout
+  # The jobLogger sweeper duration (ignored if `jobLogger` is `stdout`)
+  loggerSweeperDuration: 14 #days
+  notification:
+    webhook_job_max_retry: 3
+    webhook_job_http_client_timeout: 3 # in seconds
+  reaper:
+    # the max time to wait for a task to finish, if unfinished after max_update_hours, the task will be mark as error, but the task will continue to run, default value is 24
+    max_update_hours: 24
+    # the max time for execution in running state without new task created
+    max_dangling_hours: 168
+  # Secret is used when job service communicates with other components.
+  # If a secret key is not specified, Helm will generate one.
+  # Must be a string of 16 chars.
+  secret: ""
+  # Use an existing secret resource
+  existingSecret: ""
+  # Key within the existing secret for the job service secret
+  existingSecretKey: JOBSERVICE_SECRET
+
+registry:
+  registry:
+    image:
+      repository: goharbor/registry-photon
+      tag: v2.14.2
+    # resources:
+    #  requests:
+    #    memory: 256Mi
+    #    cpu: 100m
+    extraEnvVars: []
+  controller:
+    image:
+      repository: goharbor/harbor-registryctl
+      tag: v2.14.2
+    # resources:
+    #  requests:
+    #    memory: 256Mi
+    #    cpu: 100m
+    extraEnvVars: []
+  # set the service account to be used, default if left empty
+  serviceAccountName: ""
+  # mount the service account token
+  automountServiceAccountToken: false
+  replicas: 1
+  revisionHistoryLimit: 10
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  # Spread Pods across failure-domains like regions, availability zones or nodes
+  topologySpreadConstraints: []
+  # - maxSkew: 1
+  #   topologyKey: topology.kubernetes.io/zone
+  #   nodeTaintsPolicy: Honor
+  #   whenUnsatisfiable: DoNotSchedule
+  ## Additional deployment annotations
+  podAnnotations: {}
+  ## Additional deployment labels
+  podLabels: {}
+  ## The priority class to run the pod as
+  priorityClassName:
+  # containers to be run before the controller's container starts.
+  initContainers: []
+  # Example:
+  #
+  # - name: wait
+  #   image: busybox
+  #   command: [ 'sh', '-c', "sleep 20" ]
+  # Secret is used to secure the upload state from client
+  # and registry storage backend.
+  # See: https://github.com/distribution/distribution/blob/release/2.8/docs/configuration.md#http
+  # If a secret key is not specified, Helm will generate one.
+  # Must be a string of 16 chars.
+  secret: ""
+  # Use an existing secret resource
+  existingSecret: ""
+  # Key within the existing secret for the registry service secret
+  existingSecretKey: REGISTRY_HTTP_SECRET
+  # If true, the registry returns relative URLs in Location headers. The client is responsible for resolving the correct URL.
+  relativeurls: false
+  credentials:
+    username: "harbor_registry_user"
+    password: "harbor_registry_password"
+    # If using existingSecret, the key must be REGISTRY_PASSWD and REGISTRY_HTPASSWD
+    existingSecret: ""
+    # Login and password in htpasswd string format. Excludes `registry.credentials.username`  and `registry.credentials.password`. May come in handy when integrating with tools like argocd or flux. This allows the same line to be generated each time the template is rendered, instead of the `htpasswd` function from helm, which generates different lines each time because of the salt.
+    # htpasswdString: $apr1$XLefHzeG$Xl4.s00sMSCCcMyJljSZb0 # example string
+    htpasswdString: ""
+  middleware:
+    enabled: false
+    type: cloudFront
+    cloudFront:
+      baseurl: example.cloudfront.net
+      keypairid: KEYPAIRID
+      duration: 3000s
+      ipfilteredby: none
+      # The secret key that should be present is CLOUDFRONT_KEY_DATA, which should be the encoded private key
+      # that allows access to CloudFront
+      privateKeySecret: "my-secret"
+  # enable purge _upload directories
+  upload_purging:
+    enabled: true
+    # remove files in _upload directories which exist for a period of time, default is one week.
+    age: 168h
+    # the interval of the purge operations
+    interval: 24h
+    dryrun: false
+
+trivy:
+  # enabled the flag to enable Trivy scanner
+  enabled: true
+  image:
+    # repository the repository for Trivy adapter image
+    repository: goharbor/trivy-adapter-photon
+    # tag the tag for Trivy adapter image
+    tag: v2.14.2
+  # set the service account to be used, default if left empty
+  serviceAccountName: ""
+  # mount the service account token
+  automountServiceAccountToken: false
+  # replicas the number of Pod replicas
+  replicas: 1
+  resources:
+    requests:
+      cpu: 200m
+      memory: 512Mi
+    limits:
+      cpu: 1
+      memory: 1Gi
+  extraEnvVars: []
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  # Spread Pods across failure-domains like regions, availability zones or nodes
+  topologySpreadConstraints: []
+  # - maxSkew: 1
+  #   topologyKey: topology.kubernetes.io/zone
+  #   nodeTaintsPolicy: Honor
+  #   whenUnsatisfiable: DoNotSchedule
+  ## Additional deployment annotations
+  podAnnotations: {}
+  ## Additional deployment labels
+  podLabels: {}
+  ## The priority class to run the pod as
+  priorityClassName:
+  # containers to be run before the controller's container starts.
+  initContainers: []
+  # Example:
+  #
+  # - name: wait
+  #   image: busybox
+  #   command: [ 'sh', '-c', "sleep 20" ]
+  # debugMode the flag to enable Trivy debug mode with more verbose scanning log
+  debugMode: false
+  # vulnType a comma-separated list of vulnerability types. Possible values are `os` and `library`.
+  vulnType: "os,library"
+  # severity a comma-separated list of severities to be checked
+  severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
+  # ignoreUnfixed the flag to display only fixed vulnerabilities
+  ignoreUnfixed: false
+  # insecure the flag to skip verifying registry certificate
+  insecure: false
+  # gitHubToken the GitHub access token to download Trivy DB
+  #
+  # Trivy DB contains vulnerability information from NVD, Red Hat, and many other upstream vulnerability databases.
+  # It is downloaded by Trivy from the GitHub release page https://github.com/aquasecurity/trivy-db/releases and cached
+  # in the local file system (`/home/scanner/.cache/trivy/db/trivy.db`). In addition, the database contains the update
+  # timestamp so Trivy can detect whether it should download a newer version from the Internet or use the cached one.
+  # Currently, the database is updated every 12 hours and published as a new release to GitHub.
+  #
+  # Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough
+  # for production operations. If, for any reason, it's not enough, you could increase the rate limit to 5000
+  # requests per hour by specifying the GitHub access token. For more details on GitHub rate limiting please consult
+  # https://developer.github.com/v3/#rate-limiting
+  #
+  # You can create a GitHub token by following the instructions in
+  # https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line
+  gitHubToken: ""
+  # skipUpdate the flag to disable Trivy DB downloads from GitHub
+  #
+  # You might want to set the value of this flag to `true` in test or CI/CD environments to avoid GitHub rate limiting issues.
+  # If the value is set to `true` you have to manually download the `trivy.db` file and mount it in the
+  # `/home/scanner/.cache/trivy/db/trivy.db` path.
+  skipUpdate: false
+  # skipJavaDBUpdate If the flag is enabled you have to manually download the `trivy-java.db` file and mount it in the
+  # `/home/scanner/.cache/trivy/java-db/trivy-java.db` path
+  skipJavaDBUpdate: false
+  # The dbRepository and javaDBRepository flags can take multiple values, improving reliability when downloading databases.
+  # Databases are downloaded in priority order until one is successful.
+  # An attempt to download from the next repository is only made if a temporary error is received (e.g. status 429 or 5xx).
+  #
+  # OCI repository(ies) to retrieve the trivy vulnerability database in order of priority
+  dbRepository:
+    - "mirror.gcr.io/aquasec/trivy-db"
+    - "ghcr.io/aquasecurity/trivy-db"
+  # OCI repository(ies) to retrieve the Java trivy vulnerability database in order of priority
+  javaDBRepository:
+    - "mirror.gcr.io/aquasec/trivy-java-db"
+    - "ghcr.io/aquasecurity/trivy-java-db"
+  # The offlineScan option prevents Trivy from sending API requests to identify dependencies.
+  #
+  # Scanning JAR files and pom.xml may require Internet access for better detection, but this option tries to avoid it.
+  # For example, the offline mode will not try to resolve transitive dependencies in pom.xml when the dependency doesn't
+  # exist in the local repositories. It means a number of detected vulnerabilities might be fewer in offline mode.
+  # It would work if all the dependencies are in local.
+  # This option doesn’t affect DB download. You need to specify skipUpdate as well as offlineScan in an air-gapped environment.
+  offlineScan: false
+  # Comma-separated list of what security issues to detect. Defaults to `vuln`.
+  securityCheck: "vuln"
+  # The duration to wait for scan completion
+  timeout: 5m0s
+
+database:
+  # if external database is used, set "type" to "external"
+  # and fill the connection information in "external" section
+  type: internal
+  internal:
+    image:
+      repository: goharbor/harbor-db
+      tag: v2.14.2
+    # set the service account to be used, default if left empty
+    serviceAccountName: ""
+    # mount the service account token
+    automountServiceAccountToken: false
+    # resources:
+    #  requests:
+    #    memory: 256Mi
+    #    cpu: 100m
+    # The timeout used in livenessProbe; 1 to 5 seconds
+    livenessProbe:
+      timeoutSeconds: 1
+    # The timeout used in readinessProbe; 1 to 5 seconds
+    readinessProbe:
+      timeoutSeconds: 1
+    extraEnvVars: []
+    nodeSelector: {}
+    tolerations: []
+    affinity: {}
+    ## The priority class to run the pod as
+    priorityClassName:
+    # containers to be run before the controller's container starts.
+    extrInitContainers: []
+    # Example:
+    #
+    # - name: wait
+    #   image: busybox
+    #   command: [ 'sh', '-c', "sleep 20" ]
+    # The initial superuser password for internal database
+    password: "changeit"
+    # The size limit for Shared memory, pgSQL use it for shared_buffer
+    # More details see:
+    # https://github.com/goharbor/harbor/issues/15034
+    shmSizeLimit: 512Mi
+    initContainer:
+      migrator: {}
+      # resources:
+      #  requests:
+      #    memory: 128Mi
+      #    cpu: 100m
+      permissions: {}
+      # resources:
+      #  requests:
+      #    memory: 128Mi
+      #    cpu: 100m
+  external:
+    host: "192.168.0.1"
+    port: "5432"
+    username: "user"
+    password: "password"
+    coreDatabase: "registry"
+    # if using existing secret, the key must be "password"
+    existingSecret: ""
+    # "disable" - No SSL
+    # "require" - Always SSL (skip verification)
+    # "verify-ca" - Always SSL (verify that the certificate presented by the
+    # server was signed by a trusted CA)
+    # "verify-full" - Always SSL (verify that the certification presented by the
+    # server was signed by a trusted CA and the server host name matches the one
+    # in the certificate)
+    sslmode: "disable"
+  # The maximum number of connections in the idle connection pool per pod (core+exporter).
+  # If it <=0, no idle connections are retained.
+  maxIdleConns: 100
+  # The maximum number of open connections to the database per pod (core+exporter).
+  # If it <= 0, then there is no limit on the number of open connections.
+  # Note: the default number of connections is 1024 for harbor's postgres.
+  maxOpenConns: 900
+  ## Additional deployment annotations
+  podAnnotations: {}
+  ## Additional deployment labels
+  podLabels: {}
+
+redis:
+  # if external Redis is used, set "type" to "external"
+  # and fill the connection information in "external" section
+  type: internal
+  internal:
+    image:
+      repository: goharbor/redis-photon
+      tag: v2.14.2
+    # set the service account to be used, default if left empty
+    serviceAccountName: ""
+    # mount the service account token
+    automountServiceAccountToken: false
+    # resources:
+    #  requests:
+    #    memory: 256Mi
+    #    cpu: 100m
+    extraEnvVars: []
+    nodeSelector: {}
+    tolerations: []
+    affinity: {}
+    ## The priority class to run the pod as
+    priorityClassName:
+    # containers to be run before the controller's container starts.
+    initContainers: []
+    # Example:
+    #
+    # - name: wait
+    #   image: busybox
+    #   command: [ 'sh', '-c', "sleep 20" ]
+    # # jobserviceDatabaseIndex defaults to "1"
+    # # registryDatabaseIndex defaults to "2"
+    # # trivyAdapterIndex defaults to "5"
+    # # harborDatabaseIndex defaults to "0", but it can be configured to "6", this config is optional
+    # # cacheLayerDatabaseIndex defaults to "0", but it can be configured to "7", this config is optional
+    jobserviceDatabaseIndex: "1"
+    registryDatabaseIndex: "2"
+    trivyAdapterIndex: "5"
+    # harborDatabaseIndex: "6"
+    # cacheLayerDatabaseIndex: "7"
+  external:
+    # support redis, redis+sentinel
+    # addr for redis: <host_redis>:<port_redis>
+    # addr for redis+sentinel: <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
+    addr: "192.168.0.2:6379"
+    # The name of the set of Redis instances to monitor, it must be set to support redis+sentinel
+    sentinelMasterSet: ""
+    # TLS configuration for redis connection
+    # only server-authentication is supported, mTLS for redis connection is not supported
+    # tls connection will be disable by default
+    # Once `tlsOptions.enable` set as true, tls/ssl connection will be used for redis
+    # Please set the `caBundleSecretName` in this configuration file which conatins redis server rootCA if it is self-signed.
+    # The secret must contain keys named "ca.crt" which will be injected into the trust store
+    tlsOptions:
+      enable: false
+    # The "coreDatabaseIndex" must be "0" as the library Harbor
+    # used doesn't support configuring it
+    # harborDatabaseIndex defaults to "0", but it can be configured to "6", this config is optional
+    # cacheLayerDatabaseIndex defaults to "0", but it can be configured to "7", this config is optional
+    coreDatabaseIndex: "0"
+    jobserviceDatabaseIndex: "1"
+    registryDatabaseIndex: "2"
+    trivyAdapterIndex: "5"
+    # harborDatabaseIndex: "6"
+    # cacheLayerDatabaseIndex: "7"
+    # username field can be an empty string, and it will be authenticated against the default user
+    username: ""
+    password: ""
+    # If using existingSecret, the key must be REDIS_PASSWORD, if ACL mode enabled, also inlcudes data of username, the keys must be REDIS_USERNAME
+    existingSecret: ""
+  ## Additional deployment annotations
+  podAnnotations: {}
+  ## Additional deployment labels
+  podLabels: {}
+
+exporter:
+  image:
+    repository: goharbor/harbor-exporter
+    tag: v2.14.2
+  serviceAccountName: ""
+  # mount the service account token
+  automountServiceAccountToken: false
+  replicas: 1
+  revisionHistoryLimit: 10
+  # resources:
+  #  requests:
+  #    memory: 256Mi
+  #    cpu: 100m
+  extraEnvVars: []
+  podAnnotations: {}
+  ## Additional deployment labels
+  podLabels: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  # Spread Pods across failure-domains like regions, availability zones or nodes
+  topologySpreadConstraints: []
+  ## The priority class to run the pod as
+  priorityClassName:
+  # - maxSkew: 1
+  #   topologyKey: topology.kubernetes.io/zone
+  #   nodeTaintsPolicy: Honor
+  #   whenUnsatisfiable: DoNotSchedule
+  cacheDuration: 23
+  cacheCleanInterval: 14400
diff --git a/packages/system/harbor/values.yaml b/packages/system/harbor/values.yaml
new file mode 100644
index 00000000..4c8388fa
--- /dev/null
+++ b/packages/system/harbor/values.yaml
@@ -0,0 +1 @@
+harbor: {}

From 305495d023c652455ce63cf415ab49edaea2678e Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 16 Feb 2026 19:51:12 +0300
Subject: [PATCH 089/666] [harbor] Fix YAML quoting for Go template values in
 ApplicationDefinition

Quote resourceNames values starting with {{ to prevent YAML parser
from interpreting them as flow mappings.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/harbor-rd/cozyrds/harbor.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/system/harbor-rd/cozyrds/harbor.yaml b/packages/system/harbor-rd/cozyrds/harbor.yaml
index da8cfb62..33c0eaab 100644
--- a/packages/system/harbor-rd/cozyrds/harbor.yaml
+++ b/packages/system/harbor-rd/cozyrds/harbor.yaml
@@ -34,14 +34,14 @@ spec:
     exclude: []
     include:
       - resourceNames:
-          - {{ .name }}-credentials
+          - "{{ .name }}-credentials"
   services:
     exclude: []
     include:
       - resourceNames:
-          - {{ .name }}
+          - "{{ .name }}"
   ingresses:
     exclude: []
     include:
       - resourceNames:
-          - {{ .name }}-ingress
+          - "{{ .name }}-ingress"

From 2dd3c03279c47470a6c3014071b46cc36dd6831d Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 16 Feb 2026 20:36:52 +0300
Subject: [PATCH 090/666] [harbor] Use CPNG and redis-operator instead of
 internal databases

Replace Harbor's internal PostgreSQL with CloudNativePG operator and
internal Redis with redis-operator (RedisFailover), following established
Cozystack patterns from seaweedfs and redis apps.

Additional fixes from code review:
- Fix registry resources nesting level (registry.registry/controller)
- Persist token CA across upgrades to prevent JWT invalidation
- Update values schema and ApplicationDefinition

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/harbor.bats                     |   6 +-
 packages/extra/harbor/README.md               |  14 +--
 packages/extra/harbor/templates/harbor.yaml   |  66 ++++++++---
 packages/extra/harbor/values.schema.json      | 106 ++----------------
 packages/extra/harbor/values.yaml             |  20 ++--
 packages/system/harbor-rd/cozyrds/harbor.yaml |   4 +-
 .../system/harbor/templates/database.yaml     |  24 ++++
 packages/system/harbor/templates/redis.yaml   |  66 +++++++++++
 packages/system/harbor/values.yaml            |   8 ++
 9 files changed, 175 insertions(+), 139 deletions(-)
 create mode 100644 packages/system/harbor/templates/database.yaml
 create mode 100644 packages/system/harbor/templates/redis.yaml

diff --git a/hack/e2e-apps/harbor.bats b/hack/e2e-apps/harbor.bats
index 8d1daecb..c28eee3a 100644
--- a/hack/e2e-apps/harbor.bats
+++ b/hack/e2e-apps/harbor.bats
@@ -28,12 +28,10 @@ spec:
     resourcesPreset: "nano"
   database:
     size: 2Gi
-    resources: {}
-    resourcesPreset: "nano"
+    replicas: 1
   redis:
     size: 1Gi
-    resources: {}
-    resourcesPreset: "nano"
+    replicas: 1
 EOF
   sleep 5
   kubectl -n tenant-test wait hr $name --timeout=60s --for=condition=ready
diff --git a/packages/extra/harbor/README.md b/packages/extra/harbor/README.md
index 62bf072e..6425e6fe 100644
--- a/packages/extra/harbor/README.md
+++ b/packages/extra/harbor/README.md
@@ -39,16 +39,10 @@ Harbor is an open source trusted cloud native registry project that stores, sign
 | `trivy.resources.cpu`         | Number of CPU cores allocated.                                                                           | `quantity` | `""`    |
 | `trivy.resources.memory`      | Amount of memory allocated.                                                                              | `quantity` | `""`    |
 | `trivy.resourcesPreset`       | Default sizing preset used when `resources` is omitted.                                                  | `string`   | `nano`  |
-| `database`                    | Internal PostgreSQL database configuration.                                                              | `object`   | `{}`    |
+| `database`                    | PostgreSQL database configuration.                                                                       | `object`   | `{}`    |
 | `database.size`               | Persistent Volume size for database storage.                                                             | `quantity` | `5Gi`   |
-| `database.resources`          | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`   | `{}`    |
-| `database.resources.cpu`      | Number of CPU cores allocated.                                                                           | `quantity` | `""`    |
-| `database.resources.memory`   | Amount of memory allocated.                                                                              | `quantity` | `""`    |
-| `database.resourcesPreset`    | Default sizing preset used when `resources` is omitted.                                                  | `string`   | `nano`  |
-| `redis`                       | Internal Redis cache configuration.                                                                      | `object`   | `{}`    |
+| `database.replicas`           | Number of database instances.                                                                            | `int`      | `2`     |
+| `redis`                       | Redis cache configuration.                                                                               | `object`   | `{}`    |
 | `redis.size`                  | Persistent Volume size for cache storage.                                                                | `quantity` | `1Gi`   |
-| `redis.resources`             | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`   | `{}`    |
-| `redis.resources.cpu`         | Number of CPU cores allocated.                                                                           | `quantity` | `""`    |
-| `redis.resources.memory`      | Amount of memory allocated.                                                                              | `quantity` | `""`    |
-| `redis.resourcesPreset`       | Default sizing preset used when `resources` is omitted.                                                  | `string`   | `nano`  |
+| `redis.replicas`              | Number of Redis replicas.                                                                                | `int`      | `2`     |
 
diff --git a/packages/extra/harbor/templates/harbor.yaml b/packages/extra/harbor/templates/harbor.yaml
index 23c06641..ceef4f1f 100644
--- a/packages/extra/harbor/templates/harbor.yaml
+++ b/packages/extra/harbor/templates/harbor.yaml
@@ -8,6 +8,18 @@
   {{- $adminPassword = index $existingSecret.data "admin-password" | b64dec }}
 {{- end }}
 
+{{- $existingCoreSecret := lookup "v1" "Secret" .Release.Namespace (printf "%s-core" .Release.Name) }}
+{{- $tokenKey := "" }}
+{{- $tokenCert := "" }}
+{{- if $existingCoreSecret }}
+  {{- if hasKey $existingCoreSecret.data "tls.key" }}
+    {{- $tokenKey = index $existingCoreSecret.data "tls.key" | b64dec }}
+  {{- end }}
+  {{- if hasKey $existingCoreSecret.data "tls.crt" }}
+    {{- $tokenCert = index $existingCoreSecret.data "tls.crt" | b64dec }}
+  {{- end }}
+{{- end }}
+
 apiVersion: v1
 kind: Secret
 metadata:
@@ -42,6 +54,18 @@ spec:
   - kind: Secret
     name: cozystack-values
   values:
+    db:
+      replicas: {{ .Values.database.replicas }}
+      size: {{ .Values.database.size }}
+      {{- with .Values.storageClass }}
+      storageClass: {{ . }}
+      {{- end }}
+    redis:
+      replicas: {{ .Values.redis.replicas }}
+      size: {{ .Values.redis.size }}
+      {{- with .Values.storageClass }}
+      storageClass: {{ . }}
+      {{- end }}
     harbor:
       fullnameOverride: {{ .Release.Name }}
       harborAdminPassword: {{ $adminPassword | quote }}
@@ -61,16 +85,6 @@ spec:
             {{- with .Values.storageClass }}
             storageClass: {{ . }}
             {{- end }}
-          database:
-            size: {{ .Values.database.size }}
-            {{- with .Values.storageClass }}
-            storageClass: {{ . }}
-            {{- end }}
-          redis:
-            size: {{ .Values.redis.size }}
-            {{- with .Values.storageClass }}
-            storageClass: {{ . }}
-            {{- end }}
           {{- if .Values.trivy.enabled }}
           trivy:
             size: {{ .Values.trivy.size }}
@@ -81,9 +95,16 @@ spec:
       portal:
         resources: {{- include "cozy-lib.resources.defaultingSanitize" (list "nano" (dict) $) | nindent 10 }}
       core:
+        {{- if $tokenKey }}
+        tokenKey: {{ $tokenKey | quote }}
+        tokenCert: {{ $tokenCert | quote }}
+        {{- end }}
         resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.core.resourcesPreset .Values.core.resources $) | nindent 10 }}
       registry:
-        resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.registry.resourcesPreset .Values.registry.resources $) | nindent 10 }}
+        registry:
+          resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.registry.resourcesPreset .Values.registry.resources $) | nindent 12 }}
+        controller:
+          resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.registry.resourcesPreset .Values.registry.resources $) | nindent 12 }}
       jobservice:
         resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.jobservice.resourcesPreset .Values.jobservice.resources $) | nindent 10 }}
       trivy:
@@ -92,13 +113,24 @@ spec:
         resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.trivy.resourcesPreset .Values.trivy.resources $) | nindent 10 }}
         {{- end }}
       database:
-        type: internal
-        internal:
-          resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.database.resourcesPreset .Values.database.resources $) | nindent 12 }}
+        type: external
+        external:
+          host: "{{ .Release.Name }}-db-rw"
+          port: "5432"
+          username: app
+          coreDatabase: app
+          sslmode: disable
+          existingSecret: "{{ .Release.Name }}-db-app"
       redis:
-        type: internal
-        internal:
-          resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.redis.resourcesPreset .Values.redis.resources $) | nindent 12 }}
+        type: external
+        external:
+          addr: "rfs-{{ .Release.Name }}-redis:26379"
+          sentinelMasterSet: "mymaster"
+          existingSecret: "{{ .Release.Name }}-redis-auth"
+          coreDatabaseIndex: "0"
+          jobserviceDatabaseIndex: "1"
+          registryDatabaseIndex: "2"
+          trivyAdapterIndex: "5"
       metrics:
         enabled: true
         serviceMonitor:
diff --git a/packages/extra/harbor/values.schema.json b/packages/extra/harbor/values.schema.json
index a4632de7..2fa0beba 100644
--- a/packages/extra/harbor/values.schema.json
+++ b/packages/extra/harbor/values.schema.json
@@ -57,59 +57,18 @@
       }
     },
     "database": {
-      "description": "Internal PostgreSQL database configuration.",
+      "description": "PostgreSQL database configuration.",
       "type": "object",
       "default": {},
       "required": [
+        "replicas",
         "size"
       ],
       "properties": {
-        "resources": {
-          "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
-          "type": "object",
-          "default": {},
-          "properties": {
-            "cpu": {
-              "description": "Number of CPU cores allocated.",
-              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-              "anyOf": [
-                {
-                  "type": "integer"
-                },
-                {
-                  "type": "string"
-                }
-              ],
-              "x-kubernetes-int-or-string": true
-            },
-            "memory": {
-              "description": "Amount of memory allocated.",
-              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-              "anyOf": [
-                {
-                  "type": "integer"
-                },
-                {
-                  "type": "string"
-                }
-              ],
-              "x-kubernetes-int-or-string": true
-            }
-          }
-        },
-        "resourcesPreset": {
-          "description": "Default sizing preset used when `resources` is omitted.",
-          "type": "string",
-          "default": "nano",
-          "enum": [
-            "nano",
-            "micro",
-            "small",
-            "medium",
-            "large",
-            "xlarge",
-            "2xlarge"
-          ]
+        "replicas": {
+          "description": "Number of database instances.",
+          "type": "integer",
+          "default": 2
         },
         "size": {
           "description": "Persistent Volume size for database storage.",
@@ -187,59 +146,18 @@
       }
     },
     "redis": {
-      "description": "Internal Redis cache configuration.",
+      "description": "Redis cache configuration.",
       "type": "object",
       "default": {},
       "required": [
+        "replicas",
         "size"
       ],
       "properties": {
-        "resources": {
-          "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
-          "type": "object",
-          "default": {},
-          "properties": {
-            "cpu": {
-              "description": "Number of CPU cores allocated.",
-              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-              "anyOf": [
-                {
-                  "type": "integer"
-                },
-                {
-                  "type": "string"
-                }
-              ],
-              "x-kubernetes-int-or-string": true
-            },
-            "memory": {
-              "description": "Amount of memory allocated.",
-              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-              "anyOf": [
-                {
-                  "type": "integer"
-                },
-                {
-                  "type": "string"
-                }
-              ],
-              "x-kubernetes-int-or-string": true
-            }
-          }
-        },
-        "resourcesPreset": {
-          "description": "Default sizing preset used when `resources` is omitted.",
-          "type": "string",
-          "default": "nano",
-          "enum": [
-            "nano",
-            "micro",
-            "small",
-            "medium",
-            "large",
-            "xlarge",
-            "2xlarge"
-          ]
+        "replicas": {
+          "description": "Number of Redis replicas.",
+          "type": "integer",
+          "default": 2
         },
         "size": {
           "description": "Persistent Volume size for cache storage.",
diff --git a/packages/extra/harbor/values.yaml b/packages/extra/harbor/values.yaml
index 50d2ff5f..c5d89b1d 100644
--- a/packages/extra/harbor/values.yaml
+++ b/packages/extra/harbor/values.yaml
@@ -67,24 +67,20 @@ trivy:
   resources: {}
   resourcesPreset: "nano"
 
-## @typedef {struct} Database - Internal PostgreSQL database configuration.
+## @typedef {struct} Database - PostgreSQL database configuration (provisioned via CloudNativePG).
 ## @field {quantity} size - Persistent Volume size for database storage.
-## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
-## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted.
+## @field {int} replicas - Number of database instances.
 
-## @param {Database} database - Internal PostgreSQL database configuration.
+## @param {Database} database - PostgreSQL database configuration.
 database:
   size: 5Gi
-  resources: {}
-  resourcesPreset: "nano"
+  replicas: 2
 
-## @typedef {struct} Redis - Internal Redis cache configuration.
+## @typedef {struct} Redis - Redis cache configuration (provisioned via redis-operator).
 ## @field {quantity} size - Persistent Volume size for cache storage.
-## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
-## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted.
+## @field {int} replicas - Number of Redis replicas.
 
-## @param {Redis} redis - Internal Redis cache configuration.
+## @param {Redis} redis - Redis cache configuration.
 redis:
   size: 1Gi
-  resources: {}
-  resourcesPreset: "nano"
+  replicas: 2
diff --git a/packages/system/harbor-rd/cozyrds/harbor.yaml b/packages/system/harbor-rd/cozyrds/harbor.yaml
index 33c0eaab..8f159a45 100644
--- a/packages/system/harbor-rd/cozyrds/harbor.yaml
+++ b/packages/system/harbor-rd/cozyrds/harbor.yaml
@@ -8,7 +8,7 @@ spec:
     singular: harbor
     plural: harbors
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"core":{"description":"Core API server configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"database":{"description":"Internal PostgreSQL database configuration.","type":"object","default":{},"required":["size"],"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for database storage.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"host":{"description":"Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).","type":"string","default":""},"jobservice":{"description":"Background job service configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"redis":{"description":"Internal Redis cache configuration.","type":"object","default":{},"required":["size"],"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for cache storage.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"registry":{"description":"Container image registry configuration.","type":"object","default":{},"required":["size"],"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for container image storage.","default":"50Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"trivy":{"description":"Trivy vulnerability scanner configuration.","type":"object","default":{},"required":["enabled","size"],"properties":{"enabled":{"description":"Enable or disable the vulnerability scanner.","type":"boolean","default":true},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for vulnerability database cache.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}
+      {"title":"Chart Values","type":"object","properties":{"core":{"description":"Core API server configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"database":{"description":"PostgreSQL database configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of database instances.","type":"integer","default":2},"size":{"description":"Persistent Volume size for database storage.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"host":{"description":"Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).","type":"string","default":""},"jobservice":{"description":"Background job service configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"redis":{"description":"Redis cache configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of Redis replicas.","type":"integer","default":2},"size":{"description":"Persistent Volume size for cache storage.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"registry":{"description":"Container image registry configuration.","type":"object","default":{},"required":["size"],"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for container image storage.","default":"50Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"trivy":{"description":"Trivy vulnerability scanner configuration.","type":"object","default":{},"required":["enabled","size"],"properties":{"enabled":{"description":"Enable or disable the vulnerability scanner.","type":"boolean","default":true},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for vulnerability database cache.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}
   release:
     prefix: ""
     labels:
@@ -29,7 +29,7 @@ spec:
       - registry
       - container
     icon: "PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHJvbGU9ImltZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHZpZXdCb3g9IjEuMDUgLTEuOTUgMzU5LjQxIDM2MS42NiI+PGRlZnM+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQiIHgxPSIyNjQuNzkiIHgyPSIyNjcuMjciIHkxPSI5NTIuMzkiIHkyPSI5NTIuMzkiIGdyYWRpZW50VHJhbnNmb3JtPSJtYXRyaXgoMzAuNDMgMCAwIC0zMC40MyAtNzk1NS4yMiAyOTI4NS43NSkiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBvZmZzZXQ9IjAiIHN0b3AtY29sb3I9IiM2MGI5MzIiLz48c3RvcCBvZmZzZXQ9Ii4yOCIgc3RvcC1jb2xvcj0iIzYwYjkzMiIvPjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iIzM2N2MzNCIvPjwvbGluZWFyR3JhZGllbnQ+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQtMiIgeDE9IjI2My43NyIgeDI9IjI2Ni4yNiIgeTE9Ijk1NS42NSIgeTI9Ijk1NS42NSIgZ3JhZGllbnRUcmFuc2Zvcm09Im1hdHJpeCgyNy4yMSAwIDAgLTI3LjIxIC03MDczLjg1IDI2MTY5LjQxKSIgeGxpbms6aHJlZj0iI2xpbmVhci1ncmFkaWVudCIvPjxsaW5lYXJHcmFkaWVudCBpZD0ibGluZWFyLWdyYWRpZW50LTMiIHgxPSIyNjMuMjgiIHgyPSIyNjUuNzYiIHkxPSI5NTMuNzQiIHkyPSI5NTMuNzQiIGdyYWRpZW50VHJhbnNmb3JtPSJtYXRyaXgoMjUuNzUgMCAwIC0yNS43NSAtNjY3MS4xMyAyNDgxMi4yMykiIHhsaW5rOmhyZWY9IiNsaW5lYXItZ3JhZGllbnQiLz48bGluZWFyR3JhZGllbnQgaWQ9ImxpbmVhci1ncmFkaWVudC00IiB4MT0iMjYzLjc3IiB4Mj0iMjY2LjI1IiB5MT0iOTUzLjIiIHkyPSI5NTMuMiIgZ3JhZGllbnRUcmFuc2Zvcm09Im1hdHJpeCgyNy4xIDAgMCAtMjcuMSAtNzA0MC45IDI2MTAyLjQ5KSIgeGxpbms6aHJlZj0iI2xpbmVhci1ncmFkaWVudCIvPjxsaW5lYXJHcmFkaWVudCBpZD0ibGluZWFyLWdyYWRpZW50LTUiIHgxPSIyNjIuNzMiIHgyPSIyNjUuMjEiIHkxPSI5NTQuMzQiIHkyPSI5NTQuMzQiIGdyYWRpZW50VHJhbnNmb3JtPSJtYXRyaXgoMjQuNCAwIDAgLTI0LjQgLTYzMDEuMzYgMjM1MjEuOTcpIiB4bGluazpocmVmPSIjbGluZWFyLWdyYWRpZW50Ii8+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQtNiIgeDE9IjI3Mi4xNCIgeDI9IjI3NC42MiIgeTE9Ijk1NS4xNSIgeTI9Ijk1NS4xNSIgZ3JhZGllbnRUcmFuc2Zvcm09InNjYWxlKDY2LjA5IC02Ni4wOSkgcm90YXRlKDM2LjUyIDE1ODguMTUzIDY4LjE0OCkiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBvZmZzZXQ9IjAiIHN0b3AtY29sb3I9IiM0NTk2ZDgiLz48c3RvcCBvZmZzZXQ9Ii4yIiBzdG9wLWNvbG9yPSIjNDU5NmQ4Ii8+PHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjZmZmIi8+PC9saW5lYXJHcmFkaWVudD48bGluZWFyR3JhZGllbnQgaWQ9ImxpbmVhci1ncmFkaWVudC03IiB4MT0iMjcwLjY1IiB4Mj0iMjczLjEzIiB5MT0iOTUyLjM4IiB5Mj0iOTUyLjM4IiBncmFkaWVudFRyYW5zZm9ybT0ic2NhbGUoNzcuOCAtNzcuOCkgcm90YXRlKC0xMS41NCAtNDU4Ny4yMDkgMTgwMy4zMjMpIiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+PHN0b3Agb2Zmc2V0PSIwIiBzdG9wLWNvbG9yPSIjNDE5NGQ3Ii8+PHN0b3Agb2Zmc2V0PSIuMiIgc3RvcC1jb2xvcj0iIzQxOTRkNyIvPjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iI2ZmZiIvPjwvbGluZWFyR3JhZGllbnQ+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQtOCIgeDE9IjI3MC45NyIgeDI9IjI3My40NSIgeTE9Ijk1My43NSIgeTI9Ijk1My43NSIgZ3JhZGllbnRUcmFuc2Zvcm09InNjYWxlKDcxLjM1IC03MS4zNSkgcm90YXRlKDEwLjIzIDU0NzcuMzcgLTEwMjQuNjAyKSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPjxzdG9wIG9mZnNldD0iMCIgc3RvcC1jb2xvcj0iIzQxOTRkNyIvPjxzdG9wIG9mZnNldD0iLjMzIiBzdG9wLWNvbG9yPSIjNDQ5NmQ4Ii8+PHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjZmZmIi8+PC9saW5lYXJHcmFkaWVudD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aCI+PHBhdGggZD0iTTE3NC40IDMwMi41MmwtNjguNjUtMzAuMjYtMy44MyA0My4yMSA3NS41IDIzLjk4LTMuMDItMzYuOTN6IiBjbGFzcz0iY2xzLTEiLz48L2NsaXBQYXRoPjxjbGlwUGF0aCBpZD0iY2xpcC1wYXRoLTIiPjxwYXRoIGQ9Ik0xMTkuMTkgMTM1LjM4aDM4LjU1djMyLjg5aC05LjE1di0xNGExMC4xMyAxMC4xMyAwIDEgMC0yMC4yNiAwdjE0aC05LjE1em0tNy43IDcybDU3LjIgMjUuMjEtMy45NC00OC4yNGg3LjQ5di0xNi4wOGgtNS41NXYtMzIuODloNS41NXYtOS40NWwtMzAuODYtMzAuMTl2LTIuMTJhMi45MSAyLjkxIDAgMCAwLTUuODIgMHYyLjEybC0zMC44NiAzMC4xOXY5LjQ1aDUuNTZ2MzIuODloLTUuNTZ2MTYuMTJoOC44MnoiIGNsYXNzPSJjbHMtMSIvPjwvY2xpcFBhdGg+PGNsaXBQYXRoIGlkPSJjbGlwLXBhdGgtMyI+PHBhdGggZD0iTTEwOC4xNCAyNDUuMjhsNjMuODggMjguMTYtLjk2LTExLjczLTYxLjk2LTI3LjMtLjk2IDEwLjg3eiIgY2xhc3M9ImNscy0xIi8+PC9jbGlwUGF0aD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aC00Ij48cGF0aCBkPSJNMTA2LjQ2IDI2NC4yMWw2Ny4yMyAyOS42My0uOTYtMTEuNzItNjUuMzEtMjguNzgtLjk2IDEwLjg3eiIgY2xhc3M9ImNscy0xIi8+PC9jbGlwUGF0aD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aC01Ij48cGF0aCBkPSJNMTEwLjc3IDIxNS40OGwtLjk2IDEwLjg3IDYwLjU0IDI2LjY4LS45NS0xMS43Mi01OC42My0yNS44M3oiIGNsYXNzPSJjbHMtMSIvPjwvY2xpcFBhdGg+PGNsaXBQYXRoIGlkPSJjbGlwLXBhdGgtNiI+PHBhdGggZD0iTTMxMy4xMyA2Ny41OWExNzUuMzEgMTc1LjMxIDAgMCAwLTI5Ljc1LTI4LjEzYy0xLjU3LTEuMTctMy4xOC0yLjMtNC43OS0zLjQyTDI1NiA1OS41bC04Mi4zNCA4NS42MyAxMTMuNDEtNTguNjggMjkuMDctMTVjLTEuMDEtMS4zMS0xLjk4LTIuNjItMy4wMS0zLjg2eiIgY2xhc3M9ImNscy0xIi8+PC9jbGlwUGF0aD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aC03Ij48cGF0aCBkPSJNMzUzLjU5IDE3Ny42MWMwLTItLjE0LTQtLjIyLTUuOTNsLTMyLjIxLTIuMzEtMTQ3LjQ3LTEwLjU4TDMxOC4zNiAyMDlsMzAuNDEgMTAuNTVjLjA5LS4zNi4xOS0uNzEuMjgtMS4wOGExNzMuNjUgMTczLjY1IDAgMCAwIDQuNTctMzkuNDd2LTEuMzd6IiBjbGFzcz0iY2xzLTEiLz48L2NsaXBQYXRoPjxjbGlwUGF0aCBpZD0iY2xpcC1wYXRoLTgiPjxwYXRoIGQ9Ik0zNDguODQgMTM4LjYxYTE3Mi41NSAxNzIuNTUgMCAwIDAtMTMuODQtMzcuN2wtMzAuOTQgOS45NEwxNzUuOTIgMTUybDE0Mi00LjgzIDMyLjUtMS4xMWMtLjUtMi40OC0uOTktNC45OC0xLjU4LTcuNDV6IiBjbGFzcz0iY2xzLTEiLz48L2NsaXBQYXRoPjxzdHlsZT4uY2xzLTF7ZmlsbDpub25lfS5jbHMtMTN7ZmlsbDojNjk2NTY2fTwvc3R5bGU+PC9kZWZzPjxnIGlkPSJnMTIiPjxwYXRoIGlkPSJwYXRoMTQiIGZpbGw9IiNmZmYiIGQ9Ik0zMC44OSAxNzlhMTQ4Ljg3IDE0OC44NyAwIDEgMSAxNDguODcgMTQ4Ljg1QTE0OC44NyAxNDguODcgMCAwIDEgMzAuODkgMTc5Ii8+PGcgaWQ9ImczMCIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aCkiPjxnIGlkPSJnMzIiPjxwYXRoIGlkPSJwYXRoNDYiIGZpbGw9InVybCgjbGluZWFyLWdyYWRpZW50KSIgZD0iTTE3NC40IDMwMi41MmwtNjguNjUtMzAuMjUtMy44MiA0My4yIDc1LjUgMjQtMy0zNi45MyIvPjwvZz48L2c+PGcgaWQ9Imc0OCIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aC0yKSI+PGcgaWQ9Imc1MCI+PHBhdGggaWQ9InBhdGg2NCIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtMikiIGQ9Ik0xMTkuMTkgMTM1LjM4aDM4LjU1djMyLjg5aC05LjE1di0xNGExMC4xMyAxMC4xMyAwIDEgMC0yMC4yNiAwdjE0aC05LjE1em0tNy43IDcybDU3LjIgMjUuMjEtMy45NC00OC4yNGg3LjQ5di0xNi4wOGgtNS41NXYtMzIuODloNS41NXYtOS40NWwtMzAuODYtMzAuMTl2LTIuMTJhMi45MSAyLjkxIDAgMCAwLTUuODIgMHYyLjEybC0zMC44NiAzMC4xOXY5LjQ1aDUuNTZ2MzIuODloLTUuNTZ2MTYuMTJoOC44MmwtMiAyMyIvPjwvZz48L2c+PGcgaWQ9Imc2NiIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aC0zKSI+PGcgaWQ9Imc2OCI+PHBhdGggaWQ9InBhdGg4MiIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtMykiIGQ9Ik0xMDguMTMgMjQ1LjI4TDE3MiAyNzMuNDRsLTEtMTEuNzItNjItMjcuMzEtMSAxMC44NyIvPjwvZz48L2c+PGcgaWQ9Imc4NCIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aC00KSI+PGcgaWQ9Imc4NiI+PHBhdGggaWQ9InBhdGgxMDAiIGZpbGw9InVybCgjbGluZWFyLWdyYWRpZW50LTQpIiBkPSJNMTA2LjQ2IDI2NC4yMWw2Ny4yMyAyOS42My0xLTExLjcyLTY1LjMxLTI4Ljc4LTEgMTAuODciLz48L2c+PC9nPjxnIGlkPSJnMTAyIiBjbGlwLXBhdGg9InVybCgjY2xpcC1wYXRoLTUpIj48ZyBpZD0iZzEwNCI+PHBhdGggaWQ9InBhdGgxMTgiIGZpbGw9InVybCgjbGluZWFyLWdyYWRpZW50LTUpIiBkPSJNMTEwLjc3IDIxNS40OGwtMSAxMC44OEwxNzAuMzUgMjUzbC0xLTExLjcyLTU4LjYyLTI1LjgzIi8+PC9nPjwvZz48cGF0aCBpZD0icGF0aDEyMCIgZD0iTTMwNC4wNyAxMTAuODVsMzAuOTMtOS45NGMtLjExLS4yMi0uMjEtLjQ1LS4zMi0uNjZhMTc0LjQxIDE3NC40MSAwIDAgMC0xOC41NS0yOC44M2wtMjkuMDcgMTVhMTQyLjcxIDE0Mi43MSAwIDAgMSAxNi43MyAyMy44N2MuMS4xNy4xOC4zNS4yNy41MyIgY2xhc3M9ImNscy0xMyIvPjxwYXRoIGlkPSJwYXRoMTIyIiBkPSJNMzIxLjE1IDE2OS4zN2wzMi4yMSAyLjMxYTE3Mi44NiAxNzIuODYgMCAwIDAtMy0yNS41OWwtMzIuNSAxLjExYTE0MSAxNDEgMCAwIDEgMy4yNSAyMi4xNyIgY2xhc3M9ImNscy0xMyIvPjxwYXRoIGlkPSJwYXRoMTI0IiBkPSJNMTgyIDMyMC44MWMtNzguMiAwLTE0MS44My02My42Mi0xNDEuODMtMTQxLjgyUzEwMy44MiAzNy4xNiAxODIgMzcuMTZhMTQwLjkzIDE0MC45MyAwIDAgMSA3Ni4zIDIyLjM0TDI4MC44NSAzNkExNzIuODYgMTcyLjg2IDAgMCAwIDE4MiA1LjExQzg2LjE1IDUuMTEgOC4xNSA4My4xMSA4LjE1IDE3OXM3OCAxNzMuODUgMTczLjg1IDE3My44NWM4MS45IDAgMTUwLjY5LTU3IDE2OS0xMzMuMzJMMzIwLjYyIDIwOWMtMTMuOCA2My44NC03MC42OSAxMTEuODMtMTM4LjYgMTExLjgzIiBjbGFzcz0iY2xzLTEzIi8+PGcgaWQ9ImcxMjYiIGNsaXAtcGF0aD0idXJsKCNjbGlwLXBhdGgtNikiPjxnIGlkPSJnMTI4Ij48cGF0aCBpZD0icGF0aDE0MiIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtNikiIGQ9Ik0zMTMuMTMgNjcuNTlhMTc1LjMxIDE3NS4zMSAwIDAgMC0yOS43NS0yOC4xM2MtMS41Ny0xLjE3LTMuMTgtMi4zLTQuNzktMy40MkwyNTYgNTkuNWwtODIuMzQgODUuNjMgMTEzLjQxLTU4LjY4IDI5LjA3LTE1Yy0xLTEuMjctMi0yLjU4LTMtMy44MiIvPjwvZz48L2c+PGcgaWQ9ImcxNDQiIGNsaXAtcGF0aD0idXJsKCNjbGlwLXBhdGgtNykiPjxnIGlkPSJnMTQ2Ij48cGF0aCBpZD0icGF0aDE2MCIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtNykiIGQ9Ik0zNTMuNTkgMTc3LjYxYzAtMi0uMTQtNC0uMjItNS45M2wtMzIuMjEtMi4zMS0xNDcuNDctMTAuNThMMzE4LjM2IDIwOWwzMC40MSAxMC41NWMuMDktLjM2LjE5LS43MS4yOC0xLjA4YTE3My42NSAxNzMuNjUgMCAwIDAgNC41Ny0zOS40N3YtMS4zNyIvPjwvZz48L2c+PGcgaWQ9ImcxNjIiIGNsaXAtcGF0aD0idXJsKCNjbGlwLXBhdGgtOCkiPjxnIGlkPSJnMTY0Ij48cGF0aCBpZD0icGF0aDE3OCIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtOCkiIGQ9Ik0zNDguODQgMTM4LjYxYTE3Mi41NSAxNzIuNTUgMCAwIDAtMTMuODQtMzcuN2wtMzAuOTQgOS45NEwxNzUuOTIgMTUybDE0Mi00LjgzIDMyLjUtMS4xMWMtLjQ4LTIuNTEtMS01LTEuNTYtNy40OCIvPjwvZz48L2c+PC9nPjwvc3ZnPg=="
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "host"], ["spec", "storageClass"], ["spec", "core"], ["spec", "core", "resources"], ["spec", "core", "resourcesPreset"], ["spec", "registry"], ["spec", "registry", "size"], ["spec", "registry", "resources"], ["spec", "registry", "resourcesPreset"], ["spec", "jobservice"], ["spec", "jobservice", "resources"], ["spec", "jobservice", "resourcesPreset"], ["spec", "trivy"], ["spec", "trivy", "enabled"], ["spec", "trivy", "size"], ["spec", "trivy", "resources"], ["spec", "trivy", "resourcesPreset"], ["spec", "database"], ["spec", "database", "size"], ["spec", "database", "resources"], ["spec", "database", "resourcesPreset"], ["spec", "redis"], ["spec", "redis", "size"], ["spec", "redis", "resources"], ["spec", "redis", "resourcesPreset"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "host"], ["spec", "storageClass"], ["spec", "core"], ["spec", "core", "resources"], ["spec", "core", "resourcesPreset"], ["spec", "registry"], ["spec", "registry", "size"], ["spec", "registry", "resources"], ["spec", "registry", "resourcesPreset"], ["spec", "jobservice"], ["spec", "jobservice", "resources"], ["spec", "jobservice", "resourcesPreset"], ["spec", "trivy"], ["spec", "trivy", "enabled"], ["spec", "trivy", "size"], ["spec", "trivy", "resources"], ["spec", "trivy", "resourcesPreset"], ["spec", "database"], ["spec", "database", "size"], ["spec", "database", "replicas"], ["spec", "redis"], ["spec", "redis", "size"], ["spec", "redis", "replicas"]]
   secrets:
     exclude: []
     include:
diff --git a/packages/system/harbor/templates/database.yaml b/packages/system/harbor/templates/database.yaml
new file mode 100644
index 00000000..5d1827aa
--- /dev/null
+++ b/packages/system/harbor/templates/database.yaml
@@ -0,0 +1,24 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: {{ .Values.harbor.fullnameOverride }}-db
+spec:
+  instances: {{ .Values.db.replicas }}
+  storage:
+    size: {{ .Values.db.size }}
+    {{- with .Values.db.storageClass }}
+    storageClass: {{ . }}
+    {{- end }}
+  monitoring:
+    enablePodMonitor: true
+  resources:
+    limits:
+      cpu: "1"
+      memory: 2048Mi
+    requests:
+      cpu: 100m
+      memory: 512Mi
+  inheritedMetadata:
+    labels:
+      policy.cozystack.io/allow-to-apiserver: "true"
diff --git a/packages/system/harbor/templates/redis.yaml b/packages/system/harbor/templates/redis.yaml
new file mode 100644
index 00000000..7a71f1ce
--- /dev/null
+++ b/packages/system/harbor/templates/redis.yaml
@@ -0,0 +1,66 @@
+{{- $existingPassword := lookup "v1" "Secret" .Release.Namespace (printf "%s-redis-auth" .Values.harbor.fullnameOverride) }}
+{{- $password := randAlphaNum 32 | b64enc }}
+{{- if $existingPassword }}
+  {{- $password = index $existingPassword.data "password" }}
+{{- end }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.harbor.fullnameOverride }}-redis-auth
+data:
+  password: {{ $password }}
+---
+apiVersion: databases.spotahome.com/v1
+kind: RedisFailover
+metadata:
+  name: {{ .Values.harbor.fullnameOverride }}-redis
+  labels:
+    app.kubernetes.io/instance: {{ .Values.harbor.fullnameOverride }}-redis
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+spec:
+  sentinel:
+    replicas: 3
+    resources:
+      limits:
+        cpu: 100m
+        memory: 128Mi
+      requests:
+        cpu: 50m
+        memory: 64Mi
+  redis:
+    replicas: {{ .Values.redis.replicas }}
+    resources:
+      limits:
+        cpu: "1"
+        memory: 1024Mi
+      requests:
+        cpu: 100m
+        memory: 256Mi
+    storage:
+      persistentVolumeClaim:
+        metadata:
+          name: redisfailover-persistent-data
+        spec:
+          accessModes:
+            - ReadWriteOnce
+          resources:
+            requests:
+              storage: {{ .Values.redis.size }}
+          {{- with .Values.redis.storageClass }}
+          storageClassName: {{ . }}
+          {{- end }}
+    exporter:
+      enabled: true
+      image: oliver006/redis_exporter:v1.55.0-alpine
+      args:
+        - --web.telemetry-path
+        - /metrics
+      env:
+        - name: REDIS_EXPORTER_LOG_FORMAT
+          value: txt
+    customConfig:
+      - tcp-keepalive 0
+      - loglevel notice
+  auth:
+    secretPath: {{ .Values.harbor.fullnameOverride }}-redis-auth
diff --git a/packages/system/harbor/values.yaml b/packages/system/harbor/values.yaml
index 4c8388fa..40e924e0 100644
--- a/packages/system/harbor/values.yaml
+++ b/packages/system/harbor/values.yaml
@@ -1 +1,9 @@
 harbor: {}
+db:
+  replicas: 2
+  size: 5Gi
+  storageClass: ""
+redis:
+  replicas: 2
+  size: 1Gi
+  storageClass: ""

From 0c85639fed98637a598e019387e4be8f680c43ef Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 16 Feb 2026 21:17:10 +0300
Subject: [PATCH 091/666] [harbor] Move to apps/, use S3 via BucketClaim for
 registry storage

Move Harbor from packages/extra/ to packages/apps/ as it is a
self-sufficient end-user application, not a singleton tenant module.
Update bundle entry from system to paas accordingly.

Replace registry PVC storage with S3 via COSI BucketClaim/BucketAccess,
provisioned from the namespace's SeaweedFS instance. S3 credentials are
injected into the HelmRelease via valuesFrom with targetPath.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/harbor.bats                     |  1 -
 packages/{extra => apps}/harbor/Chart.yaml    |  0
 packages/{extra => apps}/harbor/Makefile      |  0
 packages/{extra => apps}/harbor/README.md     |  1 -
 .../{extra => apps}/harbor/charts/cozy-lib    |  0
 .../{extra => apps}/harbor/logos/harbor.svg   |  0
 packages/apps/harbor/templates/bucket.yaml    | 19 +++++++++++++
 .../templates/dashboard-resourcemap.yaml      |  0
 .../harbor/templates/harbor.yaml              | 28 ++++++++++++++-----
 .../harbor/templates/ingress.yaml             |  0
 .../{extra => apps}/harbor/values.schema.json | 17 -----------
 packages/{extra => apps}/harbor/values.yaml   |  2 --
 .../platform/sources/harbor-application.yaml  |  2 +-
 .../core/platform/templates/bundles/paas.yaml |  1 +
 .../platform/templates/bundles/system.yaml    |  1 -
 packages/system/harbor-rd/cozyrds/harbor.yaml |  6 ++--
 16 files changed, 45 insertions(+), 33 deletions(-)
 rename packages/{extra => apps}/harbor/Chart.yaml (100%)
 rename packages/{extra => apps}/harbor/Makefile (100%)
 rename packages/{extra => apps}/harbor/README.md (97%)
 rename packages/{extra => apps}/harbor/charts/cozy-lib (100%)
 rename packages/{extra => apps}/harbor/logos/harbor.svg (100%)
 create mode 100644 packages/apps/harbor/templates/bucket.yaml
 rename packages/{extra => apps}/harbor/templates/dashboard-resourcemap.yaml (100%)
 rename packages/{extra => apps}/harbor/templates/harbor.yaml (87%)
 rename packages/{extra => apps}/harbor/templates/ingress.yaml (100%)
 rename packages/{extra => apps}/harbor/values.schema.json (94%)
 rename packages/{extra => apps}/harbor/values.yaml (97%)

diff --git a/hack/e2e-apps/harbor.bats b/hack/e2e-apps/harbor.bats
index c28eee3a..d4a0055f 100644
--- a/hack/e2e-apps/harbor.bats
+++ b/hack/e2e-apps/harbor.bats
@@ -15,7 +15,6 @@ spec:
     resources: {}
     resourcesPreset: "nano"
   registry:
-    size: 5Gi
     resources: {}
     resourcesPreset: "nano"
   jobservice:
diff --git a/packages/extra/harbor/Chart.yaml b/packages/apps/harbor/Chart.yaml
similarity index 100%
rename from packages/extra/harbor/Chart.yaml
rename to packages/apps/harbor/Chart.yaml
diff --git a/packages/extra/harbor/Makefile b/packages/apps/harbor/Makefile
similarity index 100%
rename from packages/extra/harbor/Makefile
rename to packages/apps/harbor/Makefile
diff --git a/packages/extra/harbor/README.md b/packages/apps/harbor/README.md
similarity index 97%
rename from packages/extra/harbor/README.md
rename to packages/apps/harbor/README.md
index 6425e6fe..df44ca8d 100644
--- a/packages/extra/harbor/README.md
+++ b/packages/apps/harbor/README.md
@@ -22,7 +22,6 @@ Harbor is an open source trusted cloud native registry project that stores, sign
 | `core.resources.memory`       | Amount of memory allocated.                                                                              | `quantity` | `""`    |
 | `core.resourcesPreset`        | Default sizing preset used when `resources` is omitted.                                                  | `string`   | `small` |
 | `registry`                    | Container image registry configuration.                                                                  | `object`   | `{}`    |
-| `registry.size`               | Persistent Volume size for container image storage.                                                      | `quantity` | `50Gi`  |
 | `registry.resources`          | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`   | `{}`    |
 | `registry.resources.cpu`      | Number of CPU cores allocated.                                                                           | `quantity` | `""`    |
 | `registry.resources.memory`   | Amount of memory allocated.                                                                              | `quantity` | `""`    |
diff --git a/packages/extra/harbor/charts/cozy-lib b/packages/apps/harbor/charts/cozy-lib
similarity index 100%
rename from packages/extra/harbor/charts/cozy-lib
rename to packages/apps/harbor/charts/cozy-lib
diff --git a/packages/extra/harbor/logos/harbor.svg b/packages/apps/harbor/logos/harbor.svg
similarity index 100%
rename from packages/extra/harbor/logos/harbor.svg
rename to packages/apps/harbor/logos/harbor.svg
diff --git a/packages/apps/harbor/templates/bucket.yaml b/packages/apps/harbor/templates/bucket.yaml
new file mode 100644
index 00000000..a9e60988
--- /dev/null
+++ b/packages/apps/harbor/templates/bucket.yaml
@@ -0,0 +1,19 @@
+{{- $seaweedfs := .Values._namespace.seaweedfs }}
+apiVersion: objectstorage.k8s.io/v1alpha1
+kind: BucketClaim
+metadata:
+  name: {{ .Release.Name }}-registry
+spec:
+  bucketClassName: {{ $seaweedfs }}
+  protocols:
+    - s3
+---
+apiVersion: objectstorage.k8s.io/v1alpha1
+kind: BucketAccess
+metadata:
+  name: {{ .Release.Name }}-registry
+spec:
+  bucketAccessClassName: {{ $seaweedfs }}
+  bucketClaimName: {{ .Release.Name }}-registry
+  credentialsSecretName: {{ .Release.Name }}-registry-bucket
+  protocol: s3
diff --git a/packages/extra/harbor/templates/dashboard-resourcemap.yaml b/packages/apps/harbor/templates/dashboard-resourcemap.yaml
similarity index 100%
rename from packages/extra/harbor/templates/dashboard-resourcemap.yaml
rename to packages/apps/harbor/templates/dashboard-resourcemap.yaml
diff --git a/packages/extra/harbor/templates/harbor.yaml b/packages/apps/harbor/templates/harbor.yaml
similarity index 87%
rename from packages/extra/harbor/templates/harbor.yaml
rename to packages/apps/harbor/templates/harbor.yaml
index ceef4f1f..59758950 100644
--- a/packages/extra/harbor/templates/harbor.yaml
+++ b/packages/apps/harbor/templates/harbor.yaml
@@ -53,6 +53,18 @@ spec:
   valuesFrom:
   - kind: Secret
     name: cozystack-values
+  - kind: Secret
+    name: {{ .Release.Name }}-registry-bucket
+    valuesKey: accessKey
+    targetPath: harbor.persistence.imageChartStorage.s3.accesskey
+  - kind: Secret
+    name: {{ .Release.Name }}-registry-bucket
+    valuesKey: secretKey
+    targetPath: harbor.persistence.imageChartStorage.s3.secretkey
+  - kind: Secret
+    name: {{ .Release.Name }}-registry-bucket
+    valuesKey: endpoint
+    targetPath: harbor.persistence.imageChartStorage.s3.regionendpoint
   values:
     db:
       replicas: {{ .Values.database.replicas }}
@@ -79,19 +91,21 @@ spec:
       persistence:
         enabled: true
         resourcePolicy: "keep"
+        imageChartStorage:
+          type: s3
+          s3:
+            region: us-east-1
+            bucket: {{ .Release.Name }}-registry
+            secure: false
+            v4auth: true
+        {{- if .Values.trivy.enabled }}
         persistentVolumeClaim:
-          registry:
-            size: {{ .Values.registry.size }}
-            {{- with .Values.storageClass }}
-            storageClass: {{ . }}
-            {{- end }}
-          {{- if .Values.trivy.enabled }}
           trivy:
             size: {{ .Values.trivy.size }}
             {{- with .Values.storageClass }}
             storageClass: {{ . }}
             {{- end }}
-          {{- end }}
+        {{- end }}
       portal:
         resources: {{- include "cozy-lib.resources.defaultingSanitize" (list "nano" (dict) $) | nindent 10 }}
       core:
diff --git a/packages/extra/harbor/templates/ingress.yaml b/packages/apps/harbor/templates/ingress.yaml
similarity index 100%
rename from packages/extra/harbor/templates/ingress.yaml
rename to packages/apps/harbor/templates/ingress.yaml
diff --git a/packages/extra/harbor/values.schema.json b/packages/apps/harbor/values.schema.json
similarity index 94%
rename from packages/extra/harbor/values.schema.json
rename to packages/apps/harbor/values.schema.json
index 2fa0beba..1352f5dc 100644
--- a/packages/extra/harbor/values.schema.json
+++ b/packages/apps/harbor/values.schema.json
@@ -179,9 +179,6 @@
       "description": "Container image registry configuration.",
       "type": "object",
       "default": {},
-      "required": [
-        "size"
-      ],
       "properties": {
         "resources": {
           "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
@@ -229,20 +226,6 @@
             "xlarge",
             "2xlarge"
           ]
-        },
-        "size": {
-          "description": "Persistent Volume size for container image storage.",
-          "default": "50Gi",
-          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "string"
-            }
-          ],
-          "x-kubernetes-int-or-string": true
         }
       }
     },
diff --git a/packages/extra/harbor/values.yaml b/packages/apps/harbor/values.yaml
similarity index 97%
rename from packages/extra/harbor/values.yaml
rename to packages/apps/harbor/values.yaml
index c5d89b1d..de44eaff 100644
--- a/packages/extra/harbor/values.yaml
+++ b/packages/apps/harbor/values.yaml
@@ -35,13 +35,11 @@ core:
   resourcesPreset: "small"
 
 ## @typedef {struct} Registry - Container image registry configuration.
-## @field {quantity} size - Persistent Volume size for container image storage.
 ## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
 ## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted.
 
 ## @param {Registry} registry - Container image registry configuration.
 registry:
-  size: 50Gi
   resources: {}
   resourcesPreset: "small"
 
diff --git a/packages/core/platform/sources/harbor-application.yaml b/packages/core/platform/sources/harbor-application.yaml
index 31aa70ee..b05d7a01 100644
--- a/packages/core/platform/sources/harbor-application.yaml
+++ b/packages/core/platform/sources/harbor-application.yaml
@@ -20,7 +20,7 @@ spec:
         - name: harbor-system
           path: system/harbor
         - name: harbor
-          path: extra/harbor
+          path: apps/harbor
           libraries: ["cozy-lib"]
         - name: harbor-rd
           path: system/harbor-rd
diff --git a/packages/core/platform/templates/bundles/paas.yaml b/packages/core/platform/templates/bundles/paas.yaml
index 5a478f9d..6a126304 100644
--- a/packages/core/platform/templates/bundles/paas.yaml
+++ b/packages/core/platform/templates/bundles/paas.yaml
@@ -11,6 +11,7 @@
 {{include "cozystack.platform.package.default" (list "cozystack.mongodb-operator" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.clickhouse-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.foundationdb-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.harbor-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.kafka-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.mariadb-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.mongodb-application" $) }}
diff --git a/packages/core/platform/templates/bundles/system.yaml b/packages/core/platform/templates/bundles/system.yaml
index 33b882c6..c24726ef 100644
--- a/packages/core/platform/templates/bundles/system.yaml
+++ b/packages/core/platform/templates/bundles/system.yaml
@@ -126,7 +126,6 @@
 {{- $_ := set $tenantComponents "tenant" (dict "values" $tenantClusterValues) }}
 {{include "cozystack.platform.package" (list "cozystack.tenant-application" "default" $ $tenantComponents) }}
 {{include "cozystack.platform.package.default" (list "cozystack.ingress-application" $) }}
-{{include "cozystack.platform.package.default" (list "cozystack.harbor-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.seaweedfs-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.info-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.monitoring-application" $) }}
diff --git a/packages/system/harbor-rd/cozyrds/harbor.yaml b/packages/system/harbor-rd/cozyrds/harbor.yaml
index 8f159a45..0112dc11 100644
--- a/packages/system/harbor-rd/cozyrds/harbor.yaml
+++ b/packages/system/harbor-rd/cozyrds/harbor.yaml
@@ -8,9 +8,9 @@ spec:
     singular: harbor
     plural: harbors
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"core":{"description":"Core API server configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"database":{"description":"PostgreSQL database configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of database instances.","type":"integer","default":2},"size":{"description":"Persistent Volume size for database storage.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"host":{"description":"Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).","type":"string","default":""},"jobservice":{"description":"Background job service configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"redis":{"description":"Redis cache configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of Redis replicas.","type":"integer","default":2},"size":{"description":"Persistent Volume size for cache storage.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"registry":{"description":"Container image registry configuration.","type":"object","default":{},"required":["size"],"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for container image storage.","default":"50Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"trivy":{"description":"Trivy vulnerability scanner configuration.","type":"object","default":{},"required":["enabled","size"],"properties":{"enabled":{"description":"Enable or disable the vulnerability scanner.","type":"boolean","default":true},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for vulnerability database cache.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}
+      {"title":"Chart Values","type":"object","properties":{"core":{"description":"Core API server configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"database":{"description":"PostgreSQL database configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of database instances.","type":"integer","default":2},"size":{"description":"Persistent Volume size for database storage.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"host":{"description":"Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).","type":"string","default":""},"jobservice":{"description":"Background job service configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"redis":{"description":"Redis cache configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of Redis replicas.","type":"integer","default":2},"size":{"description":"Persistent Volume size for cache storage.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"registry":{"description":"Container image registry configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"trivy":{"description":"Trivy vulnerability scanner configuration.","type":"object","default":{},"required":["enabled","size"],"properties":{"enabled":{"description":"Enable or disable the vulnerability scanner.","type":"boolean","default":true},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for vulnerability database cache.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}
   release:
-    prefix: ""
+    prefix: "harbor-"
     labels:
       sharding.fluxcd.io/key: tenants
       internal.cozystack.io/tenantmodule: "true"
@@ -29,7 +29,7 @@ spec:
       - registry
       - container
     icon: "PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHJvbGU9ImltZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHZpZXdCb3g9IjEuMDUgLTEuOTUgMzU5LjQxIDM2MS42NiI+PGRlZnM+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQiIHgxPSIyNjQuNzkiIHgyPSIyNjcuMjciIHkxPSI5NTIuMzkiIHkyPSI5NTIuMzkiIGdyYWRpZW50VHJhbnNmb3JtPSJtYXRyaXgoMzAuNDMgMCAwIC0zMC40MyAtNzk1NS4yMiAyOTI4NS43NSkiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBvZmZzZXQ9IjAiIHN0b3AtY29sb3I9IiM2MGI5MzIiLz48c3RvcCBvZmZzZXQ9Ii4yOCIgc3RvcC1jb2xvcj0iIzYwYjkzMiIvPjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iIzM2N2MzNCIvPjwvbGluZWFyR3JhZGllbnQ+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQtMiIgeDE9IjI2My43NyIgeDI9IjI2Ni4yNiIgeTE9Ijk1NS42NSIgeTI9Ijk1NS42NSIgZ3JhZGllbnRUcmFuc2Zvcm09Im1hdHJpeCgyNy4yMSAwIDAgLTI3LjIxIC03MDczLjg1IDI2MTY5LjQxKSIgeGxpbms6aHJlZj0iI2xpbmVhci1ncmFkaWVudCIvPjxsaW5lYXJHcmFkaWVudCBpZD0ibGluZWFyLWdyYWRpZW50LTMiIHgxPSIyNjMuMjgiIHgyPSIyNjUuNzYiIHkxPSI5NTMuNzQiIHkyPSI5NTMuNzQiIGdyYWRpZW50VHJhbnNmb3JtPSJtYXRyaXgoMjUuNzUgMCAwIC0yNS43NSAtNjY3MS4xMyAyNDgxMi4yMykiIHhsaW5rOmhyZWY9IiNsaW5lYXItZ3JhZGllbnQiLz48bGluZWFyR3JhZGllbnQgaWQ9ImxpbmVhci1ncmFkaWVudC00IiB4MT0iMjYzLjc3IiB4Mj0iMjY2LjI1IiB5MT0iOTUzLjIiIHkyPSI5NTMuMiIgZ3JhZGllbnRUcmFuc2Zvcm09Im1hdHJpeCgyNy4xIDAgMCAtMjcuMSAtNzA0MC45IDI2MTAyLjQ5KSIgeGxpbms6aHJlZj0iI2xpbmVhci1ncmFkaWVudCIvPjxsaW5lYXJHcmFkaWVudCBpZD0ibGluZWFyLWdyYWRpZW50LTUiIHgxPSIyNjIuNzMiIHgyPSIyNjUuMjEiIHkxPSI5NTQuMzQiIHkyPSI5NTQuMzQiIGdyYWRpZW50VHJhbnNmb3JtPSJtYXRyaXgoMjQuNCAwIDAgLTI0LjQgLTYzMDEuMzYgMjM1MjEuOTcpIiB4bGluazpocmVmPSIjbGluZWFyLWdyYWRpZW50Ii8+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQtNiIgeDE9IjI3Mi4xNCIgeDI9IjI3NC42MiIgeTE9Ijk1NS4xNSIgeTI9Ijk1NS4xNSIgZ3JhZGllbnRUcmFuc2Zvcm09InNjYWxlKDY2LjA5IC02Ni4wOSkgcm90YXRlKDM2LjUyIDE1ODguMTUzIDY4LjE0OCkiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBvZmZzZXQ9IjAiIHN0b3AtY29sb3I9IiM0NTk2ZDgiLz48c3RvcCBvZmZzZXQ9Ii4yIiBzdG9wLWNvbG9yPSIjNDU5NmQ4Ii8+PHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjZmZmIi8+PC9saW5lYXJHcmFkaWVudD48bGluZWFyR3JhZGllbnQgaWQ9ImxpbmVhci1ncmFkaWVudC03IiB4MT0iMjcwLjY1IiB4Mj0iMjczLjEzIiB5MT0iOTUyLjM4IiB5Mj0iOTUyLjM4IiBncmFkaWVudFRyYW5zZm9ybT0ic2NhbGUoNzcuOCAtNzcuOCkgcm90YXRlKC0xMS41NCAtNDU4Ny4yMDkgMTgwMy4zMjMpIiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+PHN0b3Agb2Zmc2V0PSIwIiBzdG9wLWNvbG9yPSIjNDE5NGQ3Ii8+PHN0b3Agb2Zmc2V0PSIuMiIgc3RvcC1jb2xvcj0iIzQxOTRkNyIvPjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iI2ZmZiIvPjwvbGluZWFyR3JhZGllbnQ+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQtOCIgeDE9IjI3MC45NyIgeDI9IjI3My40NSIgeTE9Ijk1My43NSIgeTI9Ijk1My43NSIgZ3JhZGllbnRUcmFuc2Zvcm09InNjYWxlKDcxLjM1IC03MS4zNSkgcm90YXRlKDEwLjIzIDU0NzcuMzcgLTEwMjQuNjAyKSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPjxzdG9wIG9mZnNldD0iMCIgc3RvcC1jb2xvcj0iIzQxOTRkNyIvPjxzdG9wIG9mZnNldD0iLjMzIiBzdG9wLWNvbG9yPSIjNDQ5NmQ4Ii8+PHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjZmZmIi8+PC9saW5lYXJHcmFkaWVudD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aCI+PHBhdGggZD0iTTE3NC40IDMwMi41MmwtNjguNjUtMzAuMjYtMy44MyA0My4yMSA3NS41IDIzLjk4LTMuMDItMzYuOTN6IiBjbGFzcz0iY2xzLTEiLz48L2NsaXBQYXRoPjxjbGlwUGF0aCBpZD0iY2xpcC1wYXRoLTIiPjxwYXRoIGQ9Ik0xMTkuMTkgMTM1LjM4aDM4LjU1djMyLjg5aC05LjE1di0xNGExMC4xMyAxMC4xMyAwIDEgMC0yMC4yNiAwdjE0aC05LjE1em0tNy43IDcybDU3LjIgMjUuMjEtMy45NC00OC4yNGg3LjQ5di0xNi4wOGgtNS41NXYtMzIuODloNS41NXYtOS40NWwtMzAuODYtMzAuMTl2LTIuMTJhMi45MSAyLjkxIDAgMCAwLTUuODIgMHYyLjEybC0zMC44NiAzMC4xOXY5LjQ1aDUuNTZ2MzIuODloLTUuNTZ2MTYuMTJoOC44MnoiIGNsYXNzPSJjbHMtMSIvPjwvY2xpcFBhdGg+PGNsaXBQYXRoIGlkPSJjbGlwLXBhdGgtMyI+PHBhdGggZD0iTTEwOC4xNCAyNDUuMjhsNjMuODggMjguMTYtLjk2LTExLjczLTYxLjk2LTI3LjMtLjk2IDEwLjg3eiIgY2xhc3M9ImNscy0xIi8+PC9jbGlwUGF0aD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aC00Ij48cGF0aCBkPSJNMTA2LjQ2IDI2NC4yMWw2Ny4yMyAyOS42My0uOTYtMTEuNzItNjUuMzEtMjguNzgtLjk2IDEwLjg3eiIgY2xhc3M9ImNscy0xIi8+PC9jbGlwUGF0aD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aC01Ij48cGF0aCBkPSJNMTEwLjc3IDIxNS40OGwtLjk2IDEwLjg3IDYwLjU0IDI2LjY4LS45NS0xMS43Mi01OC42My0yNS44M3oiIGNsYXNzPSJjbHMtMSIvPjwvY2xpcFBhdGg+PGNsaXBQYXRoIGlkPSJjbGlwLXBhdGgtNiI+PHBhdGggZD0iTTMxMy4xMyA2Ny41OWExNzUuMzEgMTc1LjMxIDAgMCAwLTI5Ljc1LTI4LjEzYy0xLjU3LTEuMTctMy4xOC0yLjMtNC43OS0zLjQyTDI1NiA1OS41bC04Mi4zNCA4NS42MyAxMTMuNDEtNTguNjggMjkuMDctMTVjLTEuMDEtMS4zMS0xLjk4LTIuNjItMy4wMS0zLjg2eiIgY2xhc3M9ImNscy0xIi8+PC9jbGlwUGF0aD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aC03Ij48cGF0aCBkPSJNMzUzLjU5IDE3Ny42MWMwLTItLjE0LTQtLjIyLTUuOTNsLTMyLjIxLTIuMzEtMTQ3LjQ3LTEwLjU4TDMxOC4zNiAyMDlsMzAuNDEgMTAuNTVjLjA5LS4zNi4xOS0uNzEuMjgtMS4wOGExNzMuNjUgMTczLjY1IDAgMCAwIDQuNTctMzkuNDd2LTEuMzd6IiBjbGFzcz0iY2xzLTEiLz48L2NsaXBQYXRoPjxjbGlwUGF0aCBpZD0iY2xpcC1wYXRoLTgiPjxwYXRoIGQ9Ik0zNDguODQgMTM4LjYxYTE3Mi41NSAxNzIuNTUgMCAwIDAtMTMuODQtMzcuN2wtMzAuOTQgOS45NEwxNzUuOTIgMTUybDE0Mi00LjgzIDMyLjUtMS4xMWMtLjUtMi40OC0uOTktNC45OC0xLjU4LTcuNDV6IiBjbGFzcz0iY2xzLTEiLz48L2NsaXBQYXRoPjxzdHlsZT4uY2xzLTF7ZmlsbDpub25lfS5jbHMtMTN7ZmlsbDojNjk2NTY2fTwvc3R5bGU+PC9kZWZzPjxnIGlkPSJnMTIiPjxwYXRoIGlkPSJwYXRoMTQiIGZpbGw9IiNmZmYiIGQ9Ik0zMC44OSAxNzlhMTQ4Ljg3IDE0OC44NyAwIDEgMSAxNDguODcgMTQ4Ljg1QTE0OC44NyAxNDguODcgMCAwIDEgMzAuODkgMTc5Ii8+PGcgaWQ9ImczMCIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aCkiPjxnIGlkPSJnMzIiPjxwYXRoIGlkPSJwYXRoNDYiIGZpbGw9InVybCgjbGluZWFyLWdyYWRpZW50KSIgZD0iTTE3NC40IDMwMi41MmwtNjguNjUtMzAuMjUtMy44MiA0My4yIDc1LjUgMjQtMy0zNi45MyIvPjwvZz48L2c+PGcgaWQ9Imc0OCIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aC0yKSI+PGcgaWQ9Imc1MCI+PHBhdGggaWQ9InBhdGg2NCIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtMikiIGQ9Ik0xMTkuMTkgMTM1LjM4aDM4LjU1djMyLjg5aC05LjE1di0xNGExMC4xMyAxMC4xMyAwIDEgMC0yMC4yNiAwdjE0aC05LjE1em0tNy43IDcybDU3LjIgMjUuMjEtMy45NC00OC4yNGg3LjQ5di0xNi4wOGgtNS41NXYtMzIuODloNS41NXYtOS40NWwtMzAuODYtMzAuMTl2LTIuMTJhMi45MSAyLjkxIDAgMCAwLTUuODIgMHYyLjEybC0zMC44NiAzMC4xOXY5LjQ1aDUuNTZ2MzIuODloLTUuNTZ2MTYuMTJoOC44MmwtMiAyMyIvPjwvZz48L2c+PGcgaWQ9Imc2NiIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aC0zKSI+PGcgaWQ9Imc2OCI+PHBhdGggaWQ9InBhdGg4MiIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtMykiIGQ9Ik0xMDguMTMgMjQ1LjI4TDE3MiAyNzMuNDRsLTEtMTEuNzItNjItMjcuMzEtMSAxMC44NyIvPjwvZz48L2c+PGcgaWQ9Imc4NCIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aC00KSI+PGcgaWQ9Imc4NiI+PHBhdGggaWQ9InBhdGgxMDAiIGZpbGw9InVybCgjbGluZWFyLWdyYWRpZW50LTQpIiBkPSJNMTA2LjQ2IDI2NC4yMWw2Ny4yMyAyOS42My0xLTExLjcyLTY1LjMxLTI4Ljc4LTEgMTAuODciLz48L2c+PC9nPjxnIGlkPSJnMTAyIiBjbGlwLXBhdGg9InVybCgjY2xpcC1wYXRoLTUpIj48ZyBpZD0iZzEwNCI+PHBhdGggaWQ9InBhdGgxMTgiIGZpbGw9InVybCgjbGluZWFyLWdyYWRpZW50LTUpIiBkPSJNMTEwLjc3IDIxNS40OGwtMSAxMC44OEwxNzAuMzUgMjUzbC0xLTExLjcyLTU4LjYyLTI1LjgzIi8+PC9nPjwvZz48cGF0aCBpZD0icGF0aDEyMCIgZD0iTTMwNC4wNyAxMTAuODVsMzAuOTMtOS45NGMtLjExLS4yMi0uMjEtLjQ1LS4zMi0uNjZhMTc0LjQxIDE3NC40MSAwIDAgMC0xOC41NS0yOC44M2wtMjkuMDcgMTVhMTQyLjcxIDE0Mi43MSAwIDAgMSAxNi43MyAyMy44N2MuMS4xNy4xOC4zNS4yNy41MyIgY2xhc3M9ImNscy0xMyIvPjxwYXRoIGlkPSJwYXRoMTIyIiBkPSJNMzIxLjE1IDE2OS4zN2wzMi4yMSAyLjMxYTE3Mi44NiAxNzIuODYgMCAwIDAtMy0yNS41OWwtMzIuNSAxLjExYTE0MSAxNDEgMCAwIDEgMy4yNSAyMi4xNyIgY2xhc3M9ImNscy0xMyIvPjxwYXRoIGlkPSJwYXRoMTI0IiBkPSJNMTgyIDMyMC44MWMtNzguMiAwLTE0MS44My02My42Mi0xNDEuODMtMTQxLjgyUzEwMy44MiAzNy4xNiAxODIgMzcuMTZhMTQwLjkzIDE0MC45MyAwIDAgMSA3Ni4zIDIyLjM0TDI4MC44NSAzNkExNzIuODYgMTcyLjg2IDAgMCAwIDE4MiA1LjExQzg2LjE1IDUuMTEgOC4xNSA4My4xMSA4LjE1IDE3OXM3OCAxNzMuODUgMTczLjg1IDE3My44NWM4MS45IDAgMTUwLjY5LTU3IDE2OS0xMzMuMzJMMzIwLjYyIDIwOWMtMTMuOCA2My44NC03MC42OSAxMTEuODMtMTM4LjYgMTExLjgzIiBjbGFzcz0iY2xzLTEzIi8+PGcgaWQ9ImcxMjYiIGNsaXAtcGF0aD0idXJsKCNjbGlwLXBhdGgtNikiPjxnIGlkPSJnMTI4Ij48cGF0aCBpZD0icGF0aDE0MiIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtNikiIGQ9Ik0zMTMuMTMgNjcuNTlhMTc1LjMxIDE3NS4zMSAwIDAgMC0yOS43NS0yOC4xM2MtMS41Ny0xLjE3LTMuMTgtMi4zLTQuNzktMy40MkwyNTYgNTkuNWwtODIuMzQgODUuNjMgMTEzLjQxLTU4LjY4IDI5LjA3LTE1Yy0xLTEuMjctMi0yLjU4LTMtMy44MiIvPjwvZz48L2c+PGcgaWQ9ImcxNDQiIGNsaXAtcGF0aD0idXJsKCNjbGlwLXBhdGgtNykiPjxnIGlkPSJnMTQ2Ij48cGF0aCBpZD0icGF0aDE2MCIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtNykiIGQ9Ik0zNTMuNTkgMTc3LjYxYzAtMi0uMTQtNC0uMjItNS45M2wtMzIuMjEtMi4zMS0xNDcuNDctMTAuNThMMzE4LjM2IDIwOWwzMC40MSAxMC41NWMuMDktLjM2LjE5LS43MS4yOC0xLjA4YTE3My42NSAxNzMuNjUgMCAwIDAgNC41Ny0zOS40N3YtMS4zNyIvPjwvZz48L2c+PGcgaWQ9ImcxNjIiIGNsaXAtcGF0aD0idXJsKCNjbGlwLXBhdGgtOCkiPjxnIGlkPSJnMTY0Ij48cGF0aCBpZD0icGF0aDE3OCIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtOCkiIGQ9Ik0zNDguODQgMTM4LjYxYTE3Mi41NSAxNzIuNTUgMCAwIDAtMTMuODQtMzcuN2wtMzAuOTQgOS45NEwxNzUuOTIgMTUybDE0Mi00LjgzIDMyLjUtMS4xMWMtLjQ4LTIuNTEtMS01LTEuNTYtNy40OCIvPjwvZz48L2c+PC9nPjwvc3ZnPg=="
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "host"], ["spec", "storageClass"], ["spec", "core"], ["spec", "core", "resources"], ["spec", "core", "resourcesPreset"], ["spec", "registry"], ["spec", "registry", "size"], ["spec", "registry", "resources"], ["spec", "registry", "resourcesPreset"], ["spec", "jobservice"], ["spec", "jobservice", "resources"], ["spec", "jobservice", "resourcesPreset"], ["spec", "trivy"], ["spec", "trivy", "enabled"], ["spec", "trivy", "size"], ["spec", "trivy", "resources"], ["spec", "trivy", "resourcesPreset"], ["spec", "database"], ["spec", "database", "size"], ["spec", "database", "replicas"], ["spec", "redis"], ["spec", "redis", "size"], ["spec", "redis", "replicas"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "host"], ["spec", "storageClass"], ["spec", "core"], ["spec", "core", "resources"], ["spec", "core", "resourcesPreset"], ["spec", "registry"], ["spec", "registry", "resources"], ["spec", "registry", "resourcesPreset"], ["spec", "jobservice"], ["spec", "jobservice", "resources"], ["spec", "jobservice", "resourcesPreset"], ["spec", "trivy"], ["spec", "trivy", "enabled"], ["spec", "trivy", "size"], ["spec", "trivy", "resources"], ["spec", "trivy", "resourcesPreset"], ["spec", "database"], ["spec", "database", "size"], ["spec", "database", "replicas"], ["spec", "redis"], ["spec", "redis", "size"], ["spec", "redis", "replicas"]]
   secrets:
     exclude: []
     include:

From 6c447b2fcb87c10ecfc388ce487d6125b3245182 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 16 Feb 2026 21:47:49 +0300
Subject: [PATCH 092/666] [harbor] Improve ingress template: quote hosts,
 handle cloudflare issuer

Add | quote to host values in ingress for proper YAML escaping.
Add cloudflare issuer type handling following bucket/dashboard pattern.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/apps/harbor/templates/ingress.yaml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/packages/apps/harbor/templates/ingress.yaml b/packages/apps/harbor/templates/ingress.yaml
index 785b4a79..d2e3c204 100644
--- a/packages/apps/harbor/templates/ingress.yaml
+++ b/packages/apps/harbor/templates/ingress.yaml
@@ -1,6 +1,7 @@
 {{- $ingress := .Values._namespace.ingress }}
 {{- $host := .Values._namespace.host }}
 {{- $harborHost := .Values.host | default (printf "harbor.%s" $host) }}
+{{- $issuerType := (index .Values._cluster "clusterissuer") | default "http01" }}
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -12,16 +13,18 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-send-timeout: "900"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
     nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    {{- if ne $issuerType "cloudflare" }}
     acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
+    {{- end }}
     cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
   ingressClassName: {{ $ingress }}
   tls:
     - hosts:
-        - {{ $harborHost }}
+        - {{ $harborHost | quote }}
       secretName: {{ .Release.Name }}-ingress-tls
   rules:
-    - host: {{ $harborHost }}
+    - host: {{ $harborHost | quote }}
       http:
         paths:
           - path: /

From c815725bcfd2976cfa275030fb9688a108cebd6e Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 16 Feb 2026 23:09:35 +0300
Subject: [PATCH 093/666] [harbor] Fix E2E test: use correct HelmRelease name
 with prefix

ApplicationDefinition has prefix "harbor-", so CR name "harbor" produces
HelmRelease "harbor-harbor". Use name="test" and release="harbor-test"
to correctly reference all resources.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/harbor.bats | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/hack/e2e-apps/harbor.bats b/hack/e2e-apps/harbor.bats
index d4a0055f..7109ad4f 100644
--- a/hack/e2e-apps/harbor.bats
+++ b/hack/e2e-apps/harbor.bats
@@ -1,7 +1,8 @@
 #!/usr/bin/env bats
 
 @test "Create Harbor" {
-  name='harbor'
+  name='test'
+  release="harbor-$name"
   kubectl apply -f- <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: Harbor
@@ -33,13 +34,13 @@ spec:
     replicas: 1
 EOF
   sleep 5
-  kubectl -n tenant-test wait hr $name --timeout=60s --for=condition=ready
-  kubectl -n tenant-test wait hr $name-system --timeout=300s --for=condition=ready
-  kubectl -n tenant-test wait deploy $name-core --timeout=120s --for=condition=available
-  kubectl -n tenant-test wait deploy $name-registry --timeout=120s --for=condition=available
-  kubectl -n tenant-test wait deploy $name-portal --timeout=120s --for=condition=available
-  kubectl -n tenant-test get secret $name-credentials -o jsonpath='{.data.admin-password}' | base64 --decode | grep -q '.'
-  kubectl -n tenant-test get secret $name-credentials -o jsonpath='{.data.url}' | base64 --decode | grep -q 'https://'
-  kubectl -n tenant-test get svc $name -o jsonpath='{.spec.ports[0].port}' | grep -q '80'
+  kubectl -n tenant-test wait hr $release --timeout=60s --for=condition=ready
+  kubectl -n tenant-test wait hr $release-system --timeout=300s --for=condition=ready
+  kubectl -n tenant-test wait deploy $release-core --timeout=120s --for=condition=available
+  kubectl -n tenant-test wait deploy $release-registry --timeout=120s --for=condition=available
+  kubectl -n tenant-test wait deploy $release-portal --timeout=120s --for=condition=available
+  kubectl -n tenant-test get secret $release-credentials -o jsonpath='{.data.admin-password}' | base64 --decode | grep -q '.'
+  kubectl -n tenant-test get secret $release-credentials -o jsonpath='{.data.url}' | base64 --decode | grep -q 'https://'
+  kubectl -n tenant-test get svc $release -o jsonpath='{.spec.ports[0].port}' | grep -q '80'
   kubectl -n tenant-test delete harbor.apps.cozystack.io $name
 }

From cea57f62c86e88abccda3413582a797b292c7fd6 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 17 Feb 2026 00:36:53 +0300
Subject: [PATCH 094/666] [harbor] Make registry storage configurable: S3 or
 PVC

Add registry.storageType parameter (pvc/s3) to let users choose
between PVC storage and S3 via COSI BucketClaim. Default is pvc,
which works without SeaweedFS in the tenant namespace.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/harbor.bats                     |  2 ++
 packages/apps/harbor/README.md                |  2 ++
 packages/apps/harbor/templates/bucket.yaml    |  2 ++
 packages/apps/harbor/templates/harbor.yaml    | 15 +++++++++--
 packages/apps/harbor/values.schema.json       | 26 +++++++++++++++++++
 packages/apps/harbor/values.yaml              |  8 ++++++
 packages/system/harbor-rd/cozyrds/harbor.yaml |  4 +--
 7 files changed, 55 insertions(+), 4 deletions(-)

diff --git a/hack/e2e-apps/harbor.bats b/hack/e2e-apps/harbor.bats
index 7109ad4f..8c734565 100644
--- a/hack/e2e-apps/harbor.bats
+++ b/hack/e2e-apps/harbor.bats
@@ -16,6 +16,8 @@ spec:
     resources: {}
     resourcesPreset: "nano"
   registry:
+    storageType: "pvc"
+    size: 5Gi
     resources: {}
     resourcesPreset: "nano"
   jobservice:
diff --git a/packages/apps/harbor/README.md b/packages/apps/harbor/README.md
index df44ca8d..3c870be3 100644
--- a/packages/apps/harbor/README.md
+++ b/packages/apps/harbor/README.md
@@ -22,6 +22,8 @@ Harbor is an open source trusted cloud native registry project that stores, sign
 | `core.resources.memory`       | Amount of memory allocated.                                                                              | `quantity` | `""`    |
 | `core.resourcesPreset`        | Default sizing preset used when `resources` is omitted.                                                  | `string`   | `small` |
 | `registry`                    | Container image registry configuration.                                                                  | `object`   | `{}`    |
+| `registry.storageType`        | Storage backend type for images.                                                                         | `string`   | `pvc`   |
+| `registry.size`               | Persistent Volume size (only used when storageType is pvc).                                              | `quantity` | `10Gi`  |
 | `registry.resources`          | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`   | `{}`    |
 | `registry.resources.cpu`      | Number of CPU cores allocated.                                                                           | `quantity` | `""`    |
 | `registry.resources.memory`   | Amount of memory allocated.                                                                              | `quantity` | `""`    |
diff --git a/packages/apps/harbor/templates/bucket.yaml b/packages/apps/harbor/templates/bucket.yaml
index a9e60988..885cbfc8 100644
--- a/packages/apps/harbor/templates/bucket.yaml
+++ b/packages/apps/harbor/templates/bucket.yaml
@@ -1,3 +1,4 @@
+{{- if eq .Values.registry.storageType "s3" }}
 {{- $seaweedfs := .Values._namespace.seaweedfs }}
 apiVersion: objectstorage.k8s.io/v1alpha1
 kind: BucketClaim
@@ -17,3 +18,4 @@ spec:
   bucketClaimName: {{ .Release.Name }}-registry
   credentialsSecretName: {{ .Release.Name }}-registry-bucket
   protocol: s3
+{{- end }}
diff --git a/packages/apps/harbor/templates/harbor.yaml b/packages/apps/harbor/templates/harbor.yaml
index 59758950..97f28942 100644
--- a/packages/apps/harbor/templates/harbor.yaml
+++ b/packages/apps/harbor/templates/harbor.yaml
@@ -53,6 +53,7 @@ spec:
   valuesFrom:
   - kind: Secret
     name: cozystack-values
+  {{- if eq .Values.registry.storageType "s3" }}
   - kind: Secret
     name: {{ .Release.Name }}-registry-bucket
     valuesKey: accessKey
@@ -65,6 +66,7 @@ spec:
     name: {{ .Release.Name }}-registry-bucket
     valuesKey: endpoint
     targetPath: harbor.persistence.imageChartStorage.s3.regionendpoint
+  {{- end }}
   values:
     db:
       replicas: {{ .Values.database.replicas }}
@@ -91,6 +93,7 @@ spec:
       persistence:
         enabled: true
         resourcePolicy: "keep"
+        {{- if eq .Values.registry.storageType "s3" }}
         imageChartStorage:
           type: s3
           s3:
@@ -98,14 +101,22 @@ spec:
             bucket: {{ .Release.Name }}-registry
             secure: false
             v4auth: true
-        {{- if .Values.trivy.enabled }}
+        {{- end }}
         persistentVolumeClaim:
+          {{- if eq .Values.registry.storageType "pvc" }}
+          registry:
+            size: {{ .Values.registry.size }}
+            {{- with .Values.storageClass }}
+            storageClass: {{ . }}
+            {{- end }}
+          {{- end }}
+          {{- if .Values.trivy.enabled }}
           trivy:
             size: {{ .Values.trivy.size }}
             {{- with .Values.storageClass }}
             storageClass: {{ . }}
             {{- end }}
-        {{- end }}
+          {{- end }}
       portal:
         resources: {{- include "cozy-lib.resources.defaultingSanitize" (list "nano" (dict) $) | nindent 10 }}
       core:
diff --git a/packages/apps/harbor/values.schema.json b/packages/apps/harbor/values.schema.json
index 1352f5dc..71cc1d98 100644
--- a/packages/apps/harbor/values.schema.json
+++ b/packages/apps/harbor/values.schema.json
@@ -179,6 +179,9 @@
       "description": "Container image registry configuration.",
       "type": "object",
       "default": {},
+      "required": [
+        "storageType"
+      ],
       "properties": {
         "resources": {
           "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
@@ -226,6 +229,29 @@
             "xlarge",
             "2xlarge"
           ]
+        },
+        "size": {
+          "description": "Persistent Volume size (only used when storageType is pvc).",
+          "default": "10Gi",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        },
+        "storageType": {
+          "description": "Storage backend type for images.",
+          "type": "string",
+          "default": "pvc",
+          "enum": [
+            "s3",
+            "pvc"
+          ]
         }
       }
     },
diff --git a/packages/apps/harbor/values.yaml b/packages/apps/harbor/values.yaml
index de44eaff..f1131bd1 100644
--- a/packages/apps/harbor/values.yaml
+++ b/packages/apps/harbor/values.yaml
@@ -34,12 +34,20 @@ core:
   resources: {}
   resourcesPreset: "small"
 
+## @enum {string} StorageType - Storage backend for container image registry.
+## @value s3 - S3-compatible object storage via COSI BucketClaim (requires SeaweedFS in tenant).
+## @value pvc - Persistent Volume Claim.
+
 ## @typedef {struct} Registry - Container image registry configuration.
+## @field {StorageType} storageType - Storage backend type for images.
+## @field {quantity} [size] - Persistent Volume size (only used when storageType is pvc).
 ## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
 ## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted.
 
 ## @param {Registry} registry - Container image registry configuration.
 registry:
+  storageType: "pvc"
+  size: 10Gi
   resources: {}
   resourcesPreset: "small"
 
diff --git a/packages/system/harbor-rd/cozyrds/harbor.yaml b/packages/system/harbor-rd/cozyrds/harbor.yaml
index 0112dc11..80924530 100644
--- a/packages/system/harbor-rd/cozyrds/harbor.yaml
+++ b/packages/system/harbor-rd/cozyrds/harbor.yaml
@@ -8,7 +8,7 @@ spec:
     singular: harbor
     plural: harbors
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"core":{"description":"Core API server configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"database":{"description":"PostgreSQL database configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of database instances.","type":"integer","default":2},"size":{"description":"Persistent Volume size for database storage.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"host":{"description":"Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).","type":"string","default":""},"jobservice":{"description":"Background job service configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"redis":{"description":"Redis cache configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of Redis replicas.","type":"integer","default":2},"size":{"description":"Persistent Volume size for cache storage.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"registry":{"description":"Container image registry configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"trivy":{"description":"Trivy vulnerability scanner configuration.","type":"object","default":{},"required":["enabled","size"],"properties":{"enabled":{"description":"Enable or disable the vulnerability scanner.","type":"boolean","default":true},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for vulnerability database cache.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}
+      {"title":"Chart Values","type":"object","properties":{"core":{"description":"Core API server configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"database":{"description":"PostgreSQL database configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of database instances.","type":"integer","default":2},"size":{"description":"Persistent Volume size for database storage.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"host":{"description":"Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).","type":"string","default":""},"jobservice":{"description":"Background job service configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"redis":{"description":"Redis cache configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of Redis replicas.","type":"integer","default":2},"size":{"description":"Persistent Volume size for cache storage.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"registry":{"description":"Container image registry configuration.","type":"object","default":{},"required":["storageType"],"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size (only used when storageType is pvc).","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageType":{"description":"Storage backend type for images.","type":"string","default":"pvc","enum":["s3","pvc"]}}},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"trivy":{"description":"Trivy vulnerability scanner configuration.","type":"object","default":{},"required":["enabled","size"],"properties":{"enabled":{"description":"Enable or disable the vulnerability scanner.","type":"boolean","default":true},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for vulnerability database cache.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}
   release:
     prefix: "harbor-"
     labels:
@@ -29,7 +29,7 @@ spec:
       - registry
       - container
     icon: "PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHJvbGU9ImltZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHZpZXdCb3g9IjEuMDUgLTEuOTUgMzU5LjQxIDM2MS42NiI+PGRlZnM+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQiIHgxPSIyNjQuNzkiIHgyPSIyNjcuMjciIHkxPSI5NTIuMzkiIHkyPSI5NTIuMzkiIGdyYWRpZW50VHJhbnNmb3JtPSJtYXRyaXgoMzAuNDMgMCAwIC0zMC40MyAtNzk1NS4yMiAyOTI4NS43NSkiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBvZmZzZXQ9IjAiIHN0b3AtY29sb3I9IiM2MGI5MzIiLz48c3RvcCBvZmZzZXQ9Ii4yOCIgc3RvcC1jb2xvcj0iIzYwYjkzMiIvPjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iIzM2N2MzNCIvPjwvbGluZWFyR3JhZGllbnQ+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQtMiIgeDE9IjI2My43NyIgeDI9IjI2Ni4yNiIgeTE9Ijk1NS42NSIgeTI9Ijk1NS42NSIgZ3JhZGllbnRUcmFuc2Zvcm09Im1hdHJpeCgyNy4yMSAwIDAgLTI3LjIxIC03MDczLjg1IDI2MTY5LjQxKSIgeGxpbms6aHJlZj0iI2xpbmVhci1ncmFkaWVudCIvPjxsaW5lYXJHcmFkaWVudCBpZD0ibGluZWFyLWdyYWRpZW50LTMiIHgxPSIyNjMuMjgiIHgyPSIyNjUuNzYiIHkxPSI5NTMuNzQiIHkyPSI5NTMuNzQiIGdyYWRpZW50VHJhbnNmb3JtPSJtYXRyaXgoMjUuNzUgMCAwIC0yNS43NSAtNjY3MS4xMyAyNDgxMi4yMykiIHhsaW5rOmhyZWY9IiNsaW5lYXItZ3JhZGllbnQiLz48bGluZWFyR3JhZGllbnQgaWQ9ImxpbmVhci1ncmFkaWVudC00IiB4MT0iMjYzLjc3IiB4Mj0iMjY2LjI1IiB5MT0iOTUzLjIiIHkyPSI5NTMuMiIgZ3JhZGllbnRUcmFuc2Zvcm09Im1hdHJpeCgyNy4xIDAgMCAtMjcuMSAtNzA0MC45IDI2MTAyLjQ5KSIgeGxpbms6aHJlZj0iI2xpbmVhci1ncmFkaWVudCIvPjxsaW5lYXJHcmFkaWVudCBpZD0ibGluZWFyLWdyYWRpZW50LTUiIHgxPSIyNjIuNzMiIHgyPSIyNjUuMjEiIHkxPSI5NTQuMzQiIHkyPSI5NTQuMzQiIGdyYWRpZW50VHJhbnNmb3JtPSJtYXRyaXgoMjQuNCAwIDAgLTI0LjQgLTYzMDEuMzYgMjM1MjEuOTcpIiB4bGluazpocmVmPSIjbGluZWFyLWdyYWRpZW50Ii8+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQtNiIgeDE9IjI3Mi4xNCIgeDI9IjI3NC42MiIgeTE9Ijk1NS4xNSIgeTI9Ijk1NS4xNSIgZ3JhZGllbnRUcmFuc2Zvcm09InNjYWxlKDY2LjA5IC02Ni4wOSkgcm90YXRlKDM2LjUyIDE1ODguMTUzIDY4LjE0OCkiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBvZmZzZXQ9IjAiIHN0b3AtY29sb3I9IiM0NTk2ZDgiLz48c3RvcCBvZmZzZXQ9Ii4yIiBzdG9wLWNvbG9yPSIjNDU5NmQ4Ii8+PHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjZmZmIi8+PC9saW5lYXJHcmFkaWVudD48bGluZWFyR3JhZGllbnQgaWQ9ImxpbmVhci1ncmFkaWVudC03IiB4MT0iMjcwLjY1IiB4Mj0iMjczLjEzIiB5MT0iOTUyLjM4IiB5Mj0iOTUyLjM4IiBncmFkaWVudFRyYW5zZm9ybT0ic2NhbGUoNzcuOCAtNzcuOCkgcm90YXRlKC0xMS41NCAtNDU4Ny4yMDkgMTgwMy4zMjMpIiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+PHN0b3Agb2Zmc2V0PSIwIiBzdG9wLWNvbG9yPSIjNDE5NGQ3Ii8+PHN0b3Agb2Zmc2V0PSIuMiIgc3RvcC1jb2xvcj0iIzQxOTRkNyIvPjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iI2ZmZiIvPjwvbGluZWFyR3JhZGllbnQ+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQtOCIgeDE9IjI3MC45NyIgeDI9IjI3My40NSIgeTE9Ijk1My43NSIgeTI9Ijk1My43NSIgZ3JhZGllbnRUcmFuc2Zvcm09InNjYWxlKDcxLjM1IC03MS4zNSkgcm90YXRlKDEwLjIzIDU0NzcuMzcgLTEwMjQuNjAyKSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPjxzdG9wIG9mZnNldD0iMCIgc3RvcC1jb2xvcj0iIzQxOTRkNyIvPjxzdG9wIG9mZnNldD0iLjMzIiBzdG9wLWNvbG9yPSIjNDQ5NmQ4Ii8+PHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjZmZmIi8+PC9saW5lYXJHcmFkaWVudD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aCI+PHBhdGggZD0iTTE3NC40IDMwMi41MmwtNjguNjUtMzAuMjYtMy44MyA0My4yMSA3NS41IDIzLjk4LTMuMDItMzYuOTN6IiBjbGFzcz0iY2xzLTEiLz48L2NsaXBQYXRoPjxjbGlwUGF0aCBpZD0iY2xpcC1wYXRoLTIiPjxwYXRoIGQ9Ik0xMTkuMTkgMTM1LjM4aDM4LjU1djMyLjg5aC05LjE1di0xNGExMC4xMyAxMC4xMyAwIDEgMC0yMC4yNiAwdjE0aC05LjE1em0tNy43IDcybDU3LjIgMjUuMjEtMy45NC00OC4yNGg3LjQ5di0xNi4wOGgtNS41NXYtMzIuODloNS41NXYtOS40NWwtMzAuODYtMzAuMTl2LTIuMTJhMi45MSAyLjkxIDAgMCAwLTUuODIgMHYyLjEybC0zMC44NiAzMC4xOXY5LjQ1aDUuNTZ2MzIuODloLTUuNTZ2MTYuMTJoOC44MnoiIGNsYXNzPSJjbHMtMSIvPjwvY2xpcFBhdGg+PGNsaXBQYXRoIGlkPSJjbGlwLXBhdGgtMyI+PHBhdGggZD0iTTEwOC4xNCAyNDUuMjhsNjMuODggMjguMTYtLjk2LTExLjczLTYxLjk2LTI3LjMtLjk2IDEwLjg3eiIgY2xhc3M9ImNscy0xIi8+PC9jbGlwUGF0aD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aC00Ij48cGF0aCBkPSJNMTA2LjQ2IDI2NC4yMWw2Ny4yMyAyOS42My0uOTYtMTEuNzItNjUuMzEtMjguNzgtLjk2IDEwLjg3eiIgY2xhc3M9ImNscy0xIi8+PC9jbGlwUGF0aD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aC01Ij48cGF0aCBkPSJNMTEwLjc3IDIxNS40OGwtLjk2IDEwLjg3IDYwLjU0IDI2LjY4LS45NS0xMS43Mi01OC42My0yNS44M3oiIGNsYXNzPSJjbHMtMSIvPjwvY2xpcFBhdGg+PGNsaXBQYXRoIGlkPSJjbGlwLXBhdGgtNiI+PHBhdGggZD0iTTMxMy4xMyA2Ny41OWExNzUuMzEgMTc1LjMxIDAgMCAwLTI5Ljc1LTI4LjEzYy0xLjU3LTEuMTctMy4xOC0yLjMtNC43OS0zLjQyTDI1NiA1OS41bC04Mi4zNCA4NS42MyAxMTMuNDEtNTguNjggMjkuMDctMTVjLTEuMDEtMS4zMS0xLjk4LTIuNjItMy4wMS0zLjg2eiIgY2xhc3M9ImNscy0xIi8+PC9jbGlwUGF0aD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aC03Ij48cGF0aCBkPSJNMzUzLjU5IDE3Ny42MWMwLTItLjE0LTQtLjIyLTUuOTNsLTMyLjIxLTIuMzEtMTQ3LjQ3LTEwLjU4TDMxOC4zNiAyMDlsMzAuNDEgMTAuNTVjLjA5LS4zNi4xOS0uNzEuMjgtMS4wOGExNzMuNjUgMTczLjY1IDAgMCAwIDQuNTctMzkuNDd2LTEuMzd6IiBjbGFzcz0iY2xzLTEiLz48L2NsaXBQYXRoPjxjbGlwUGF0aCBpZD0iY2xpcC1wYXRoLTgiPjxwYXRoIGQ9Ik0zNDguODQgMTM4LjYxYTE3Mi41NSAxNzIuNTUgMCAwIDAtMTMuODQtMzcuN2wtMzAuOTQgOS45NEwxNzUuOTIgMTUybDE0Mi00LjgzIDMyLjUtMS4xMWMtLjUtMi40OC0uOTktNC45OC0xLjU4LTcuNDV6IiBjbGFzcz0iY2xzLTEiLz48L2NsaXBQYXRoPjxzdHlsZT4uY2xzLTF7ZmlsbDpub25lfS5jbHMtMTN7ZmlsbDojNjk2NTY2fTwvc3R5bGU+PC9kZWZzPjxnIGlkPSJnMTIiPjxwYXRoIGlkPSJwYXRoMTQiIGZpbGw9IiNmZmYiIGQ9Ik0zMC44OSAxNzlhMTQ4Ljg3IDE0OC44NyAwIDEgMSAxNDguODcgMTQ4Ljg1QTE0OC44NyAxNDguODcgMCAwIDEgMzAuODkgMTc5Ii8+PGcgaWQ9ImczMCIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aCkiPjxnIGlkPSJnMzIiPjxwYXRoIGlkPSJwYXRoNDYiIGZpbGw9InVybCgjbGluZWFyLWdyYWRpZW50KSIgZD0iTTE3NC40IDMwMi41MmwtNjguNjUtMzAuMjUtMy44MiA0My4yIDc1LjUgMjQtMy0zNi45MyIvPjwvZz48L2c+PGcgaWQ9Imc0OCIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aC0yKSI+PGcgaWQ9Imc1MCI+PHBhdGggaWQ9InBhdGg2NCIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtMikiIGQ9Ik0xMTkuMTkgMTM1LjM4aDM4LjU1djMyLjg5aC05LjE1di0xNGExMC4xMyAxMC4xMyAwIDEgMC0yMC4yNiAwdjE0aC05LjE1em0tNy43IDcybDU3LjIgMjUuMjEtMy45NC00OC4yNGg3LjQ5di0xNi4wOGgtNS41NXYtMzIuODloNS41NXYtOS40NWwtMzAuODYtMzAuMTl2LTIuMTJhMi45MSAyLjkxIDAgMCAwLTUuODIgMHYyLjEybC0zMC44NiAzMC4xOXY5LjQ1aDUuNTZ2MzIuODloLTUuNTZ2MTYuMTJoOC44MmwtMiAyMyIvPjwvZz48L2c+PGcgaWQ9Imc2NiIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aC0zKSI+PGcgaWQ9Imc2OCI+PHBhdGggaWQ9InBhdGg4MiIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtMykiIGQ9Ik0xMDguMTMgMjQ1LjI4TDE3MiAyNzMuNDRsLTEtMTEuNzItNjItMjcuMzEtMSAxMC44NyIvPjwvZz48L2c+PGcgaWQ9Imc4NCIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aC00KSI+PGcgaWQ9Imc4NiI+PHBhdGggaWQ9InBhdGgxMDAiIGZpbGw9InVybCgjbGluZWFyLWdyYWRpZW50LTQpIiBkPSJNMTA2LjQ2IDI2NC4yMWw2Ny4yMyAyOS42My0xLTExLjcyLTY1LjMxLTI4Ljc4LTEgMTAuODciLz48L2c+PC9nPjxnIGlkPSJnMTAyIiBjbGlwLXBhdGg9InVybCgjY2xpcC1wYXRoLTUpIj48ZyBpZD0iZzEwNCI+PHBhdGggaWQ9InBhdGgxMTgiIGZpbGw9InVybCgjbGluZWFyLWdyYWRpZW50LTUpIiBkPSJNMTEwLjc3IDIxNS40OGwtMSAxMC44OEwxNzAuMzUgMjUzbC0xLTExLjcyLTU4LjYyLTI1LjgzIi8+PC9nPjwvZz48cGF0aCBpZD0icGF0aDEyMCIgZD0iTTMwNC4wNyAxMTAuODVsMzAuOTMtOS45NGMtLjExLS4yMi0uMjEtLjQ1LS4zMi0uNjZhMTc0LjQxIDE3NC40MSAwIDAgMC0xOC41NS0yOC44M2wtMjkuMDcgMTVhMTQyLjcxIDE0Mi43MSAwIDAgMSAxNi43MyAyMy44N2MuMS4xNy4xOC4zNS4yNy41MyIgY2xhc3M9ImNscy0xMyIvPjxwYXRoIGlkPSJwYXRoMTIyIiBkPSJNMzIxLjE1IDE2OS4zN2wzMi4yMSAyLjMxYTE3Mi44NiAxNzIuODYgMCAwIDAtMy0yNS41OWwtMzIuNSAxLjExYTE0MSAxNDEgMCAwIDEgMy4yNSAyMi4xNyIgY2xhc3M9ImNscy0xMyIvPjxwYXRoIGlkPSJwYXRoMTI0IiBkPSJNMTgyIDMyMC44MWMtNzguMiAwLTE0MS44My02My42Mi0xNDEuODMtMTQxLjgyUzEwMy44MiAzNy4xNiAxODIgMzcuMTZhMTQwLjkzIDE0MC45MyAwIDAgMSA3Ni4zIDIyLjM0TDI4MC44NSAzNkExNzIuODYgMTcyLjg2IDAgMCAwIDE4MiA1LjExQzg2LjE1IDUuMTEgOC4xNSA4My4xMSA4LjE1IDE3OXM3OCAxNzMuODUgMTczLjg1IDE3My44NWM4MS45IDAgMTUwLjY5LTU3IDE2OS0xMzMuMzJMMzIwLjYyIDIwOWMtMTMuOCA2My44NC03MC42OSAxMTEuODMtMTM4LjYgMTExLjgzIiBjbGFzcz0iY2xzLTEzIi8+PGcgaWQ9ImcxMjYiIGNsaXAtcGF0aD0idXJsKCNjbGlwLXBhdGgtNikiPjxnIGlkPSJnMTI4Ij48cGF0aCBpZD0icGF0aDE0MiIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtNikiIGQ9Ik0zMTMuMTMgNjcuNTlhMTc1LjMxIDE3NS4zMSAwIDAgMC0yOS43NS0yOC4xM2MtMS41Ny0xLjE3LTMuMTgtMi4zLTQuNzktMy40MkwyNTYgNTkuNWwtODIuMzQgODUuNjMgMTEzLjQxLTU4LjY4IDI5LjA3LTE1Yy0xLTEuMjctMi0yLjU4LTMtMy44MiIvPjwvZz48L2c+PGcgaWQ9ImcxNDQiIGNsaXAtcGF0aD0idXJsKCNjbGlwLXBhdGgtNykiPjxnIGlkPSJnMTQ2Ij48cGF0aCBpZD0icGF0aDE2MCIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtNykiIGQ9Ik0zNTMuNTkgMTc3LjYxYzAtMi0uMTQtNC0uMjItNS45M2wtMzIuMjEtMi4zMS0xNDcuNDctMTAuNThMMzE4LjM2IDIwOWwzMC40MSAxMC41NWMuMDktLjM2LjE5LS43MS4yOC0xLjA4YTE3My42NSAxNzMuNjUgMCAwIDAgNC41Ny0zOS40N3YtMS4zNyIvPjwvZz48L2c+PGcgaWQ9ImcxNjIiIGNsaXAtcGF0aD0idXJsKCNjbGlwLXBhdGgtOCkiPjxnIGlkPSJnMTY0Ij48cGF0aCBpZD0icGF0aDE3OCIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtOCkiIGQ9Ik0zNDguODQgMTM4LjYxYTE3Mi41NSAxNzIuNTUgMCAwIDAtMTMuODQtMzcuN2wtMzAuOTQgOS45NEwxNzUuOTIgMTUybDE0Mi00LjgzIDMyLjUtMS4xMWMtLjQ4LTIuNTEtMS01LTEuNTYtNy40OCIvPjwvZz48L2c+PC9nPjwvc3ZnPg=="
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "host"], ["spec", "storageClass"], ["spec", "core"], ["spec", "core", "resources"], ["spec", "core", "resourcesPreset"], ["spec", "registry"], ["spec", "registry", "resources"], ["spec", "registry", "resourcesPreset"], ["spec", "jobservice"], ["spec", "jobservice", "resources"], ["spec", "jobservice", "resourcesPreset"], ["spec", "trivy"], ["spec", "trivy", "enabled"], ["spec", "trivy", "size"], ["spec", "trivy", "resources"], ["spec", "trivy", "resourcesPreset"], ["spec", "database"], ["spec", "database", "size"], ["spec", "database", "replicas"], ["spec", "redis"], ["spec", "redis", "size"], ["spec", "redis", "replicas"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "host"], ["spec", "storageClass"], ["spec", "core"], ["spec", "core", "resources"], ["spec", "core", "resourcesPreset"], ["spec", "registry"], ["spec", "registry", "storageType"], ["spec", "registry", "size"], ["spec", "registry", "resources"], ["spec", "registry", "resourcesPreset"], ["spec", "jobservice"], ["spec", "jobservice", "resources"], ["spec", "jobservice", "resourcesPreset"], ["spec", "trivy"], ["spec", "trivy", "enabled"], ["spec", "trivy", "size"], ["spec", "trivy", "resources"], ["spec", "trivy", "resourcesPreset"], ["spec", "database"], ["spec", "database", "size"], ["spec", "database", "replicas"], ["spec", "redis"], ["spec", "redis", "size"], ["spec", "redis", "replicas"]]
   secrets:
     exclude: []
     include:

From 490faaf2920c2a01622c4eeaf43b739c4072c90e Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 17 Feb 2026 02:01:12 +0300
Subject: [PATCH 095/666] fix(harbor): add operator dependencies, fix
 persistence rendering, increase E2E timeout

Add postgres-operator and redis-operator to PackageSource dependsOn
to ensure CRDs are available before Harbor system chart deploys.

Make persistentVolumeClaim conditional to avoid empty YAML mapping
when using S3 storage without Trivy.

Increase E2E system HelmRelease timeout from 300s to 600s to account
for CPNG + Redis + Harbor bootstrap time on QEMU.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/harbor.bats                              | 2 +-
 packages/apps/harbor/templates/harbor.yaml             | 2 ++
 packages/core/platform/sources/harbor-application.yaml | 2 ++
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/hack/e2e-apps/harbor.bats b/hack/e2e-apps/harbor.bats
index 8c734565..e1b6ab2b 100644
--- a/hack/e2e-apps/harbor.bats
+++ b/hack/e2e-apps/harbor.bats
@@ -37,7 +37,7 @@ spec:
 EOF
   sleep 5
   kubectl -n tenant-test wait hr $release --timeout=60s --for=condition=ready
-  kubectl -n tenant-test wait hr $release-system --timeout=300s --for=condition=ready
+  kubectl -n tenant-test wait hr $release-system --timeout=600s --for=condition=ready
   kubectl -n tenant-test wait deploy $release-core --timeout=120s --for=condition=available
   kubectl -n tenant-test wait deploy $release-registry --timeout=120s --for=condition=available
   kubectl -n tenant-test wait deploy $release-portal --timeout=120s --for=condition=available
diff --git a/packages/apps/harbor/templates/harbor.yaml b/packages/apps/harbor/templates/harbor.yaml
index 97f28942..4196ebcd 100644
--- a/packages/apps/harbor/templates/harbor.yaml
+++ b/packages/apps/harbor/templates/harbor.yaml
@@ -102,6 +102,7 @@ spec:
             secure: false
             v4auth: true
         {{- end }}
+        {{- if or (eq .Values.registry.storageType "pvc") .Values.trivy.enabled }}
         persistentVolumeClaim:
           {{- if eq .Values.registry.storageType "pvc" }}
           registry:
@@ -117,6 +118,7 @@ spec:
             storageClass: {{ . }}
             {{- end }}
           {{- end }}
+        {{- end }}
       portal:
         resources: {{- include "cozy-lib.resources.defaultingSanitize" (list "nano" (dict) $) | nindent 10 }}
       core:
diff --git a/packages/core/platform/sources/harbor-application.yaml b/packages/core/platform/sources/harbor-application.yaml
index b05d7a01..b9bc8dc3 100644
--- a/packages/core/platform/sources/harbor-application.yaml
+++ b/packages/core/platform/sources/harbor-application.yaml
@@ -13,6 +13,8 @@ spec:
     - name: default
       dependsOn:
         - cozystack.networking
+        - cozystack.postgres-operator
+        - cozystack.redis-operator
       libraries:
         - name: cozy-lib
           path: library/cozy-lib

From 0f2ba5aba25af436c7a80a2f1b676cfc340f38f5 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 17 Feb 2026 12:59:23 +0300
Subject: [PATCH 096/666] fix(harbor): add diagnostic output on E2E system
 HelmRelease timeout

Dump HelmRelease status, pods, events, and ExternalArtifact info
when harbor-test-system fails to become ready, to diagnose the
root cause of the persistent timeout.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/harbor.bats | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/hack/e2e-apps/harbor.bats b/hack/e2e-apps/harbor.bats
index e1b6ab2b..076a1841 100644
--- a/hack/e2e-apps/harbor.bats
+++ b/hack/e2e-apps/harbor.bats
@@ -37,7 +37,17 @@ spec:
 EOF
   sleep 5
   kubectl -n tenant-test wait hr $release --timeout=60s --for=condition=ready
-  kubectl -n tenant-test wait hr $release-system --timeout=600s --for=condition=ready
+  kubectl -n tenant-test wait hr $release-system --timeout=600s --for=condition=ready || {
+    echo "=== HelmRelease status ==="
+    kubectl -n tenant-test get hr $release-system -o yaml 2>&1 || true
+    echo "=== Pods ==="
+    kubectl -n tenant-test get pods 2>&1 || true
+    echo "=== Events ==="
+    kubectl -n tenant-test get events --sort-by='.lastTimestamp' 2>&1 | tail -30 || true
+    echo "=== ExternalArtifact ==="
+    kubectl -n cozy-system get externalartifact cozystack-harbor-application-default-harbor-system -o yaml 2>&1 || true
+    false
+  }
   kubectl -n tenant-test wait deploy $release-core --timeout=120s --for=condition=available
   kubectl -n tenant-test wait deploy $release-registry --timeout=120s --for=condition=available
   kubectl -n tenant-test wait deploy $release-portal --timeout=120s --for=condition=available

From 0e6ae28bb8597f7ff3af4d78c1ab6ce288784782 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 17 Feb 2026 15:15:15 +0300
Subject: [PATCH 097/666] fix(harbor): resolve Redis nil pointer on first
 install
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The vendored Harbor chart does an unsafe `lookup` of the Redis auth
Secret at template rendering time to extract the password. On first
install, the Secret doesn't exist yet (created by the same chart),
causing a nil pointer error. Failed installs are rolled back, deleting
the Secret, so retries also fail — creating an infinite failure loop.

Fix by generating the Redis password in the wrapper chart (same
pattern as admin password), storing it in the credentials Secret,
and injecting it via HelmRelease valuesFrom with targetPath. This
bypasses the vendored chart's lookup entirely — it uses the password
value directly instead of looking up the Secret.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/apps/harbor/templates/harbor.yaml  | 14 +++++++++++++-
 packages/system/harbor/templates/redis.yaml |  9 ++-------
 packages/system/harbor/values.yaml          |  1 +
 3 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/packages/apps/harbor/templates/harbor.yaml b/packages/apps/harbor/templates/harbor.yaml
index 4196ebcd..ff59b45f 100644
--- a/packages/apps/harbor/templates/harbor.yaml
+++ b/packages/apps/harbor/templates/harbor.yaml
@@ -4,8 +4,12 @@
 
 {{- $existingSecret := lookup "v1" "Secret" .Release.Namespace (printf "%s-credentials" .Release.Name) }}
 {{- $adminPassword := randAlphaNum 16 }}
+{{- $redisPassword := randAlphaNum 32 }}
 {{- if $existingSecret }}
   {{- $adminPassword = index $existingSecret.data "admin-password" | b64dec }}
+  {{- if hasKey $existingSecret.data "redis-password" }}
+    {{- $redisPassword = index $existingSecret.data "redis-password" | b64dec }}
+  {{- end }}
 {{- end }}
 
 {{- $existingCoreSecret := lookup "v1" "Secret" .Release.Namespace (printf "%s-core" .Release.Name) }}
@@ -26,6 +30,7 @@ metadata:
   name: {{ .Release.Name }}-credentials
 stringData:
   admin-password: {{ $adminPassword | quote }}
+  redis-password: {{ $redisPassword | quote }}
   url: https://{{ $harborHost }}
 
 ---
@@ -53,6 +58,14 @@ spec:
   valuesFrom:
   - kind: Secret
     name: cozystack-values
+  - kind: Secret
+    name: {{ .Release.Name }}-credentials
+    valuesKey: redis-password
+    targetPath: redis.password
+  - kind: Secret
+    name: {{ .Release.Name }}-credentials
+    valuesKey: redis-password
+    targetPath: harbor.redis.external.password
   {{- if eq .Values.registry.storageType "s3" }}
   - kind: Secret
     name: {{ .Release.Name }}-registry-bucket
@@ -153,7 +166,6 @@ spec:
         external:
           addr: "rfs-{{ .Release.Name }}-redis:26379"
           sentinelMasterSet: "mymaster"
-          existingSecret: "{{ .Release.Name }}-redis-auth"
           coreDatabaseIndex: "0"
           jobserviceDatabaseIndex: "1"
           registryDatabaseIndex: "2"
diff --git a/packages/system/harbor/templates/redis.yaml b/packages/system/harbor/templates/redis.yaml
index 7a71f1ce..b39c2b04 100644
--- a/packages/system/harbor/templates/redis.yaml
+++ b/packages/system/harbor/templates/redis.yaml
@@ -1,15 +1,10 @@
-{{- $existingPassword := lookup "v1" "Secret" .Release.Namespace (printf "%s-redis-auth" .Values.harbor.fullnameOverride) }}
-{{- $password := randAlphaNum 32 | b64enc }}
-{{- if $existingPassword }}
-  {{- $password = index $existingPassword.data "password" }}
-{{- end }}
 ---
 apiVersion: v1
 kind: Secret
 metadata:
   name: {{ .Values.harbor.fullnameOverride }}-redis-auth
-data:
-  password: {{ $password }}
+stringData:
+  password: {{ .Values.redis.password | quote }}
 ---
 apiVersion: databases.spotahome.com/v1
 kind: RedisFailover
diff --git a/packages/system/harbor/values.yaml b/packages/system/harbor/values.yaml
index 40e924e0..9038bd38 100644
--- a/packages/system/harbor/values.yaml
+++ b/packages/system/harbor/values.yaml
@@ -4,6 +4,7 @@ db:
   size: 5Gi
   storageClass: ""
 redis:
+  password: ""
   replicas: 2
   size: 1Gi
   storageClass: ""

From efb9bc70b3d09f22006f027f6b556c194b302469 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 18 Feb 2026 00:49:34 +0300
Subject: [PATCH 098/666] fix(harbor): use Release.Name for default host to
 avoid conflicts

Multiple Harbor instances in the same namespace would get the same
default hostname when derived from namespace host. Use Release.Name
instead for unique hostnames per instance.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/apps/harbor/templates/harbor.yaml  | 2 +-
 packages/apps/harbor/templates/ingress.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/apps/harbor/templates/harbor.yaml b/packages/apps/harbor/templates/harbor.yaml
index ff59b45f..0e9f4fd5 100644
--- a/packages/apps/harbor/templates/harbor.yaml
+++ b/packages/apps/harbor/templates/harbor.yaml
@@ -1,6 +1,6 @@
 {{- $ingress := .Values._namespace.ingress }}
 {{- $host := .Values._namespace.host }}
-{{- $harborHost := .Values.host | default (printf "harbor.%s" $host) }}
+{{- $harborHost := .Values.host | default (printf "harbor.%s" .Release.Name) }}
 
 {{- $existingSecret := lookup "v1" "Secret" .Release.Namespace (printf "%s-credentials" .Release.Name) }}
 {{- $adminPassword := randAlphaNum 16 }}
diff --git a/packages/apps/harbor/templates/ingress.yaml b/packages/apps/harbor/templates/ingress.yaml
index d2e3c204..3f2b8f78 100644
--- a/packages/apps/harbor/templates/ingress.yaml
+++ b/packages/apps/harbor/templates/ingress.yaml
@@ -1,6 +1,6 @@
 {{- $ingress := .Values._namespace.ingress }}
 {{- $host := .Values._namespace.host }}
-{{- $harborHost := .Values.host | default (printf "harbor.%s" $host) }}
+{{- $harborHost := .Values.host | default (printf "harbor.%s" .Release.Name) }}
 {{- $issuerType := (index .Values._cluster "clusterissuer") | default "http01" }}
 ---
 apiVersion: networking.k8s.io/v1

From 26178d97be54c60cb43f432e2b623e12417e4ff8 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 17 Feb 2026 22:51:00 +0100
Subject: [PATCH 099/666] fix(platform): adopt tenant-root into
 cozystack-basics during migration

In v0.41.x the tenant-root Namespace and HelmRelease were applied via
kubectl apply with no Helm release tracking. In v1.0 these resources
are managed by the cozystack-basics Helm release. Without proper Helm
ownership annotations the install of cozystack-basics fails because
the resources already exist.

Add migration 31 that annotates and labels both the Namespace and
HelmRelease so Helm can adopt them, matching the pattern established
in migrations 22 and 27.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../platform/images/migrations/migrations/31  | 45 +++++++++++++++++++
 packages/core/platform/values.yaml            |  2 +-
 2 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100755 packages/core/platform/images/migrations/migrations/31

diff --git a/packages/core/platform/images/migrations/migrations/31 b/packages/core/platform/images/migrations/migrations/31
new file mode 100755
index 00000000..2a261d9b
--- /dev/null
+++ b/packages/core/platform/images/migrations/migrations/31
@@ -0,0 +1,45 @@
+#!/bin/sh
+# Migration 31 --> 32
+# Adopt tenant-root resources into cozystack-basics Helm release.
+#
+# In v0.41.x tenant-root Namespace and HelmRelease were applied via
+# kubectl apply (no Helm tracking). In v1.0 they are managed by the
+# cozystack-basics Helm release. Without Helm ownership annotations
+# the install of cozystack-basics fails because the resources already
+# exist. This migration adds the required annotations and labels so
+# Helm can adopt them.
+
+set -euo pipefail
+
+RELEASE_NAME="cozystack-basics"
+RELEASE_NS="cozy-system"
+
+# Adopt Namespace tenant-root
+if kubectl get namespace tenant-root >/dev/null 2>&1; then
+  echo "Adopting Namespace tenant-root into $RELEASE_NAME"
+  kubectl annotate namespace tenant-root \
+    meta.helm.sh/release-name="$RELEASE_NAME" \
+    meta.helm.sh/release-namespace="$RELEASE_NS" \
+    --overwrite
+  kubectl label namespace tenant-root \
+    app.kubernetes.io/managed-by=Helm \
+    --overwrite
+fi
+
+# Adopt HelmRelease tenant-root
+if kubectl get helmrelease -n tenant-root tenant-root >/dev/null 2>&1; then
+  echo "Adopting HelmRelease tenant-root into $RELEASE_NAME"
+  kubectl annotate helmrelease -n tenant-root tenant-root \
+    meta.helm.sh/release-name="$RELEASE_NAME" \
+    meta.helm.sh/release-namespace="$RELEASE_NS" \
+    helm.sh/resource-policy=keep \
+    --overwrite
+  kubectl label helmrelease -n tenant-root tenant-root \
+    app.kubernetes.io/managed-by=Helm \
+    sharding.fluxcd.io/key=tenants \
+    --overwrite
+fi
+
+# Stamp version
+kubectl create configmap -n cozy-system cozystack-version \
+  --from-literal=version=32 --dry-run=client -o yaml | kubectl apply -f-
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index ca2d9d1b..f9d4c8d3 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -6,7 +6,7 @@ sourceRef:
 migrations:
   enabled: false
   image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0-beta.5@sha256:e7a9e0f0adc33e0be007af42f50ed3af064aa965ad628e48cc6c7943f31f239d
-  targetVersion: 31
+  targetVersion: 32
 # Bundle deployment configuration
 bundles:
   system:

From 7ac989923ddadcda85b4e758014f9a15716eb6c2 Mon Sep 17 00:00:00 2001
From: kklinch0 <kklinch0@gmail.com>
Date: Wed, 3 Sep 2025 15:27:38 +0300
Subject: [PATCH 100/666] Add monitoring for NATs

Co-authored-by: Andrei Kvapil <kvapss@gmail.com>
Signed-off-by: kklinch0 <kklinch0@gmail.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 dashboards/nats/nats-jetstream.json           | 1541 +++++++++++++++++
 dashboards/nats/nats-server.json              | 1463 ++++++++++++++++
 hack/download-dashboards.sh                   |    2 +
 packages/apps/nats/templates/nats.yaml        |    4 -
 packages/system/monitoring/dashboards.list    |    2 +
 packages/system/nats/charts/nats/Chart.yaml   |    4 +-
 packages/system/nats/charts/nats/README.md    |   46 +-
 .../nats/files/stateful-set/pod-template.yaml |    4 +
 .../stateful-set/prom-exporter-container.yaml |    3 +-
 .../nats/charts/nats/templates/_helpers.tpl   |   14 +-
 packages/system/nats/charts/nats/values.yaml  |   29 +-
 packages/system/nats/values.yaml              |    4 +
 12 files changed, 3086 insertions(+), 30 deletions(-)
 create mode 100644 dashboards/nats/nats-jetstream.json
 create mode 100644 dashboards/nats/nats-server.json

diff --git a/dashboards/nats/nats-jetstream.json b/dashboards/nats/nats-jetstream.json
new file mode 100644
index 00000000..d2312e7e
--- /dev/null
+++ b/dashboards/nats/nats-jetstream.json
@@ -0,0 +1,1541 @@
+{
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": {
+          "type": "datasource",
+          "uid": "grafana"
+        },
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "target": {
+          "limit": 100,
+          "matchAny": false,
+          "tags": [],
+          "type": "dashboard"
+        },
+        "type": "dashboard"
+      }
+    ]
+  },
+  "description": "NATS JetStream Dashboard",
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 1,
+  "id": 90,
+  "links": [],
+  "panels": [
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 13,
+        "x": 0,
+        "y": 0
+      },
+      "id": 34,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "prometheus"
+          },
+          "editorMode": "code",
+          "expr": "irate(nats_stream_total_messages{server_id=~\"$server\"}[5m])",
+          "instant": false,
+          "legendFormat": "__auto",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "messages per second",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "percentage",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          },
+          "unit": "bytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 3,
+        "w": 5,
+        "x": 13,
+        "y": 0
+      },
+      "id": 32,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "none",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "auto",
+        "wideLayout": true
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "sum(nats_varz_jetstream_stats_memory{server_id=\"$server\"})",
+          "interval": "",
+          "legendFormat": "",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Memory Used",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "mappings": [],
+          "min": 0,
+          "noValue": "0",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 3,
+        "w": 6,
+        "x": 18,
+        "y": 0
+      },
+      "id": 14,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "auto",
+        "wideLayout": true
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "sum(nats_varz_connections{server_id=~\"$server\"})",
+          "interval": "",
+          "legendFormat": "__auto",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Connections",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "percentage",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          },
+          "unit": "bytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 5,
+        "x": 13,
+        "y": 3
+      },
+      "id": 33,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "none",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "auto",
+        "wideLayout": true
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "sum(nats_varz_jetstream_config_max_memory{server_id=~\"$server\"})",
+          "interval": "",
+          "legendFormat": "__auto",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Total Memory",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 6,
+        "x": 18,
+        "y": 3
+      },
+      "id": 29,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "auto",
+        "wideLayout": true
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "sum(nats_server_total_consumers{server_id=~\"$server\"})",
+          "interval": "",
+          "legendFormat": "__auto",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Total Consumers",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "decimals": 3,
+          "mappings": [],
+          "max": 1,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "#EAB839",
+                "value": 0.75
+              },
+              {
+                "color": "red",
+                "value": 0.9
+              }
+            ]
+          },
+          "unit": "percentunit"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 4,
+        "x": 0,
+        "y": 8
+      },
+      "id": 28,
+      "options": {
+        "minVizHeight": 75,
+        "minVizWidth": 75,
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showThresholdLabels": false,
+        "showThresholdMarkers": true,
+        "sizing": "auto"
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "sum(nats_varz_jetstream_stats_storage{server_id=~\"$server\"})/sum(nats_varz_jetstream_config_max_storage{server_id=~\"$server\"})",
+          "interval": "",
+          "legendFormat": "",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "expr": "",
+          "interval": "",
+          "legendFormat": "",
+          "refId": "B"
+        }
+      ],
+      "title": "Storage Used",
+      "type": "gauge"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "percentage",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          },
+          "unit": "bytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 3,
+        "w": 5,
+        "x": 4,
+        "y": 8
+      },
+      "id": 15,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "none",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "auto",
+        "wideLayout": true
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "sum(nats_varz_jetstream_stats_storage{server_id=~\"$server\"})",
+          "interval": "",
+          "legendFormat": "",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Total Storage Used",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "decimals": 3,
+          "mappings": [],
+          "max": 1,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "#EAB839",
+                "value": 0.75
+              },
+              {
+                "color": "red",
+                "value": 0.9
+              }
+            ]
+          },
+          "unit": "percentunit"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 4,
+        "x": 9,
+        "y": 8
+      },
+      "id": 31,
+      "options": {
+        "minVizHeight": 75,
+        "minVizWidth": 75,
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showThresholdLabels": false,
+        "showThresholdMarkers": true,
+        "sizing": "auto"
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "sum(nats_varz_jetstream_stats_memory{server_id=~\"$server\"})/sum(nats_varz_jetstream_config_max_memory{server_id=~\"$server\"})",
+          "interval": "",
+          "legendFormat": "",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "expr": "",
+          "interval": "",
+          "legendFormat": "",
+          "refId": "B"
+        }
+      ],
+      "title": "Memory Used",
+      "type": "gauge"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "percentage",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          },
+          "unit": "bytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 3,
+        "w": 5,
+        "x": 4,
+        "y": 11
+      },
+      "id": 30,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "none",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "auto",
+        "wideLayout": true
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "sum(nats_varz_jetstream_config_max_storage{server_id=~\"$server\"})",
+          "interval": "",
+          "legendFormat": "",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Max Storage",
+      "type": "stat"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 14
+      },
+      "id": 19,
+      "panels": [],
+      "title": "Stream metrics",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "bytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 15
+      },
+      "id": 17,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "prometheus"
+          },
+          "editorMode": "code",
+          "expr": "sum(nats_stream_total_bytes) by (stream_name)",
+          "interval": "",
+          "legendFormat": "{{stream_name}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Stream data size",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 15
+      },
+      "id": 24,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "prometheus"
+          },
+          "editorMode": "code",
+          "expr": "sum(nats_stream_total_messages) by (stream_name)",
+          "interval": "",
+          "legendFormat": "{{stream_name}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Stream message count",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "mps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 16,
+        "y": 15
+      },
+      "id": 20,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "prometheus"
+          },
+          "editorMode": "code",
+          "expr": "sum(rate(nats_stream_total_messages{server_id=~\"$server\",stream_name=~\"$stream\"}[$__rate_interval])) by (stream_name)",
+          "hide": false,
+          "interval": "",
+          "legendFormat": "{{stream_name}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Message Rate (per second)",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 21
+      },
+      "id": 23,
+      "panels": [],
+      "title": "Consumer Metrics",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "description": "Messages added & processed per minute per consumer",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "mps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 24,
+        "x": 0,
+        "y": 22
+      },
+      "id": 25,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "right",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "prometheus"
+          },
+          "editorMode": "code",
+          "expr": "sum(rate(nats_consumer_num_pending{server_id=~\"$server\",stream_name=~\"$stream\",consumer_name=~\"$consumer\"}[$__rate_interval])+rate(nats_consumer_delivered_consumer_seq{server_id=~\"$server\",stream_name=~\"$stream\",consumer_name=~\"$consumer\"}[$__rate_interval])) by (consumer_name)",
+          "hide": false,
+          "instant": false,
+          "interval": "",
+          "intervalFactor": 1,
+          "legendFormat": "{{consumer_name}} +",
+          "refId": "B"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "prometheus"
+          },
+          "editorMode": "code",
+          "expr": "- sum(rate(nats_consumer_delivered_consumer_seq{server_id=~\"$server\",stream_name=~\"$stream\",consumer_name=~\"$consumer\",consumer_name=~\"$consumer\"}[$__rate_interval])) by (consumer_name)",
+          "hide": false,
+          "interval": "",
+          "legendFormat": "{{consumer_name}} -",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Messages per second (++/--)",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 28
+      },
+      "id": 21,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "prometheus"
+          },
+          "editorMode": "code",
+          "expr": "sum(nats_consumer_delivered_consumer_seq{server_id=~\"$server\",stream_name=~\"$stream\",consumer_name=~\"$consumer\"}) by (consumer_name)",
+          "hide": false,
+          "interval": "",
+          "legendFormat": "{{consumer_name}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Total delivered messages",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 28
+      },
+      "id": 26,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "prometheus"
+          },
+          "editorMode": "code",
+          "expr": "sum(nats_consumer_num_pending{server_id=~\"$server\",stream_name=~\"$stream\",consumer_name=~\"$consumer\"}) by (consumer_name)",
+          "hide": false,
+          "interval": "",
+          "legendFormat": "{{consumer_name}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Pending messages",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 16,
+        "y": 28
+      },
+      "id": 27,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "prometheus"
+          },
+          "editorMode": "code",
+          "expr": "sum(nats_consumer_num_ack_pending{server_id=~\"$server\",stream_name=~\"$stream\",consumer_name=~\"$consumer\"}) by (consumer_name)",
+          "hide": false,
+          "interval": "",
+          "legendFormat": "{{consumer_name}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Message Acks Pending",
+      "type": "timeseries"
+    }
+  ],
+  "preload": false,
+  "refresh": "10s",
+  "schemaVersion": 40,
+  "tags": [],
+  "templating": {
+    "list": [
+      {
+        "current": {
+          "text": "vm-shortterm",
+          "value": "59e01639-a99e-4945-bb94-10821e415ad5"
+        },
+        "description": "",
+        "label": "datasource",
+        "name": "DS_PROMETHEUS",
+        "options": [],
+        "query": "prometheus",
+        "refresh": 1,
+        "regex": "",
+        "type": "datasource"
+      },
+      {
+        "current": {
+          "text": "",
+          "value": ""
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${DS_PROMETHEUS}"
+        },
+        "definition": "label_values(nats_varz_jetstream_stats_memory,namespace)",
+        "includeAll": false,
+        "name": "namespace",
+        "options": [],
+        "query": {
+          "query": "label_values(nats_varz_jetstream_stats_memory,namespace)",
+          "refId": "PrometheusVariableQueryEditor-VariableQuery"
+        },
+        "refresh": 1,
+        "regex": "",
+        "type": "query"
+      },
+      {
+        "current": {
+          "text": "All",
+          "value": "$__all"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${DS_PROMETHEUS}"
+        },
+        "definition": "label_values(nats_server_total_streams{namespace=\"$namespace\"},server_id)",
+        "hide": 2,
+        "includeAll": true,
+        "label": "Server",
+        "name": "server",
+        "options": [],
+        "query": {
+          "query": "label_values(nats_server_total_streams{namespace=\"$namespace\"},server_id)",
+          "refId": "PrometheusVariableQueryEditor-VariableQuery"
+        },
+        "refresh": 2,
+        "regex": "",
+        "type": "query"
+      },
+      {
+        "current": {
+          "text": "All",
+          "value": "$__all"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${DS_PROMETHEUS}"
+        },
+        "definition": "label_values(nats_stream_last_seq{server_id=~\"$server\"},stream_name)",
+        "includeAll": true,
+        "label": "Stream",
+        "multi": true,
+        "name": "stream",
+        "options": [],
+        "query": {
+          "qryType": 1,
+          "query": "label_values(nats_stream_last_seq{server_id=~\"$server\"},stream_name)",
+          "refId": "PrometheusVariableQueryEditor-VariableQuery"
+        },
+        "refresh": 2,
+        "regex": "",
+        "type": "query"
+      },
+      {
+        "current": {
+          "text": "All",
+          "value": "$__all"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${DS_PROMETHEUS}"
+        },
+        "definition": "label_values(nats_consumer_num_pending,consumer_name)",
+        "includeAll": true,
+        "label": "Consumer",
+        "multi": true,
+        "name": "consumer",
+        "options": [],
+        "query": {
+          "query": "label_values(nats_consumer_num_pending,consumer_name)",
+          "refId": "PrometheusVariableQueryEditor-VariableQuery"
+        },
+        "refresh": 2,
+        "regex": "",
+        "type": "query"
+      }
+    ]
+  },
+  "time": {
+    "from": "now-1h",
+    "to": "now"
+  },
+  "timepicker": {},
+  "timezone": "browser",
+  "title": "NATS JetStream",
+  "uid": "yQUo5l17k",
+  "version": 6,
+  "weekStart": ""
+}
diff --git a/dashboards/nats/nats-server.json b/dashboards/nats/nats-server.json
new file mode 100644
index 00000000..02aa39b2
--- /dev/null
+++ b/dashboards/nats/nats-server.json
@@ -0,0 +1,1463 @@
+{
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": {
+          "type": "datasource",
+          "uid": "grafana"
+        },
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "target": {
+          "limit": 100,
+          "matchAny": false,
+          "tags": [],
+          "type": "dashboard"
+        },
+        "type": "dashboard"
+      }
+    ]
+  },
+  "description": "NATS Server Dashboard for use with built-in Prometheus NATS Exporter into nats official helm charts",
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 0,
+  "id": 91,
+  "links": [],
+  "panels": [
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 0
+      },
+      "id": 10,
+      "panels": [],
+      "title": "OS Metrics",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 2,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percent"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 12,
+        "x": 0,
+        "y": 1
+      },
+      "id": 1,
+      "options": {
+        "alertThreshold": true,
+        "legend": {
+          "calcs": [
+            "mean",
+            "lastNotNull",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "datasource": "PBFA97CFB590B2093",
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "exemplar": true,
+          "expr": "nats_varz_cpu",
+          "interval": "",
+          "intervalFactor": 2,
+          "legendFormat": "{{server_id}}",
+          "metric": "nats_varz_cpu",
+          "refId": "A",
+          "step": 4
+        }
+      ],
+      "title": "Server CPU",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 2,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "bytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 12,
+        "x": 12,
+        "y": 1
+      },
+      "id": 3,
+      "options": {
+        "alertThreshold": true,
+        "legend": {
+          "calcs": [
+            "mean",
+            "lastNotNull",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "datasource": "PBFA97CFB590B2093",
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "exemplar": true,
+          "expr": "nats_varz_mem",
+          "interval": "",
+          "intervalFactor": 2,
+          "legendFormat": "{{server_id}}",
+          "metric": "nats_varz_mem",
+          "refId": "A",
+          "step": 4
+        }
+      ],
+      "title": "Server Memory",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 8
+      },
+      "id": 11,
+      "panels": [],
+      "title": "Throughput",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 2,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "bytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 6,
+        "x": 0,
+        "y": 9
+      },
+      "id": 7,
+      "options": {
+        "alertThreshold": true,
+        "legend": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "datasource": "PBFA97CFB590B2093",
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "exemplar": true,
+          "expr": "nats_varz_in_bytes",
+          "interval": "",
+          "intervalFactor": 2,
+          "legendFormat": "{{server_id}}",
+          "metric": "nats_varz_in_bytes",
+          "refId": "A",
+          "step": 10
+        }
+      ],
+      "title": "Bytes In",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 2,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 6,
+        "x": 6,
+        "y": 9
+      },
+      "id": 8,
+      "options": {
+        "alertThreshold": true,
+        "legend": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "datasource": "PBFA97CFB590B2093",
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "exemplar": true,
+          "expr": "nats_varz_in_msgs",
+          "interval": "",
+          "intervalFactor": 2,
+          "legendFormat": "{{server_id}}",
+          "metric": "nats_varz_in_msgs",
+          "refId": "A",
+          "step": 10
+        }
+      ],
+      "title": "NATS Msgs In",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 2,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "bytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 6,
+        "x": 12,
+        "y": 9
+      },
+      "id": 5,
+      "options": {
+        "alertThreshold": true,
+        "legend": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "datasource": "PBFA97CFB590B2093",
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "exemplar": true,
+          "expr": "nats_varz_out_bytes",
+          "interval": "",
+          "intervalFactor": 2,
+          "legendFormat": "{{server_id}}",
+          "metric": "nats_varz_out_bytes",
+          "refId": "A",
+          "step": 10
+        }
+      ],
+      "title": "Bytes Out",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 2,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 6,
+        "x": 18,
+        "y": 9
+      },
+      "id": 6,
+      "options": {
+        "alertThreshold": true,
+        "legend": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "datasource": "PBFA97CFB590B2093",
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "exemplar": true,
+          "expr": "nats_varz_out_msgs",
+          "interval": "",
+          "intervalFactor": 2,
+          "legendFormat": "{{server_id}}",
+          "metric": "nats_varz_out_msgs",
+          "refId": "A",
+          "step": 10
+        }
+      ],
+      "title": "NATS Msgs Out",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "datasource": "PBFA97CFB590B2093",
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 2,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "bytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 6,
+        "x": 0,
+        "y": 16
+      },
+      "id": 15,
+      "options": {
+        "alertThreshold": true,
+        "legend": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "datasource": "PBFA97CFB590B2093",
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "exemplar": true,
+          "expr": "sum(rate(nats_varz_in_bytes[1m]))",
+          "interval": "",
+          "intervalFactor": 2,
+          "legendFormat": "",
+          "metric": "nats_varz_in_bytes",
+          "refId": "A",
+          "step": 10
+        }
+      ],
+      "title": "rate(Bytes In)",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "datasource": "PBFA97CFB590B2093",
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 2,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 6,
+        "x": 6,
+        "y": 16
+      },
+      "id": 13,
+      "options": {
+        "alertThreshold": true,
+        "legend": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "datasource": "PBFA97CFB590B2093",
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "exemplar": true,
+          "expr": "sum(rate(nats_varz_in_msgs[1m]))",
+          "interval": "",
+          "intervalFactor": 2,
+          "legendFormat": "",
+          "metric": "nats_varz_in_msgs",
+          "refId": "A",
+          "step": 10
+        }
+      ],
+      "title": "rate(NATS Msgs In)",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "datasource": "PBFA97CFB590B2093",
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 2,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "bytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 6,
+        "x": 12,
+        "y": 16
+      },
+      "id": 16,
+      "options": {
+        "alertThreshold": true,
+        "legend": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "datasource": "PBFA97CFB590B2093",
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "exemplar": true,
+          "expr": "sum(rate(nats_varz_out_bytes[1m]))",
+          "interval": "",
+          "intervalFactor": 2,
+          "legendFormat": "",
+          "metric": "nats_varz_out_bytes",
+          "refId": "A",
+          "step": 10
+        }
+      ],
+      "title": "rate(Bytes Out)",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "datasource": "PBFA97CFB590B2093",
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 2,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 6,
+        "x": 18,
+        "y": 16
+      },
+      "id": 14,
+      "options": {
+        "alertThreshold": true,
+        "legend": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "datasource": "PBFA97CFB590B2093",
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "exemplar": true,
+          "expr": "sum(rate(nats_varz_out_msgs[1m]))",
+          "interval": "",
+          "intervalFactor": 2,
+          "legendFormat": "",
+          "metric": "nats_varz_out_msgs",
+          "refId": "A",
+          "step": 10
+        }
+      ],
+      "title": "rate(NATS Msgs Out)",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 23
+      },
+      "id": 12,
+      "panels": [],
+      "title": "Client Metrics",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "points",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 2,
+            "pointSize": 6,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "always",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 0,
+        "y": 24
+      },
+      "id": 2,
+      "options": {
+        "alertThreshold": true,
+        "legend": {
+          "calcs": [
+            "mean",
+            "lastNotNull",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "datasource": "PBFA97CFB590B2093",
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "exemplar": true,
+          "expr": "nats_varz_connections",
+          "interval": "",
+          "intervalFactor": 1,
+          "legendFormat": "{{server_id}}",
+          "metric": "nats_varz_connections",
+          "refId": "A",
+          "step": 2
+        }
+      ],
+      "title": "Connections",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "points",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 2,
+            "pointSize": 6,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "always",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 8,
+        "y": 24
+      },
+      "id": 4,
+      "options": {
+        "alertThreshold": true,
+        "legend": {
+          "calcs": [
+            "mean",
+            "lastNotNull",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "datasource": "PBFA97CFB590B2093",
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "exemplar": true,
+          "expr": "nats_varz_subscriptions",
+          "hide": false,
+          "interval": "",
+          "intervalFactor": 2,
+          "legendFormat": "{{server_id}}",
+          "metric": "nats_varz_subscriptions",
+          "refId": "A",
+          "step": 4
+        }
+      ],
+      "title": "Subscriptions",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "points",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 2,
+            "pointSize": 6,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "always",
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 16,
+        "y": 24
+      },
+      "id": 9,
+      "options": {
+        "alertThreshold": true,
+        "legend": {
+          "calcs": [
+            "mean",
+            "lastNotNull",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "datasource": {
+            "datasource": "PBFA97CFB590B2093",
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "exemplar": true,
+          "expr": "nats_varz_slow_consumers",
+          "interval": "",
+          "intervalFactor": 1,
+          "legendFormat": "{{server_id}}",
+          "metric": "nats_varz_slow_consumers",
+          "refId": "A",
+          "step": 2
+        }
+      ],
+      "title": "Slow Consumers",
+      "type": "timeseries"
+    }
+  ],
+  "preload": false,
+  "refresh": "",
+  "schemaVersion": 40,
+  "tags": [],
+  "templating": {
+    "list": [
+      {
+        "current": {
+          "text": "vm-shortterm",
+          "value": "59e01639-a99e-4945-bb94-10821e415ad5"
+        },
+        "label": "datasource",
+        "name": "DS_PROMETHEUS",
+        "options": [],
+        "query": "prometheus",
+        "refresh": 1,
+        "regex": "",
+        "type": "datasource"
+      }
+    ]
+  },
+  "time": {
+    "from": "now-5m",
+    "to": "now"
+  },
+  "timepicker": {},
+  "timezone": "browser",
+  "title": "NATS Server Dashboard",
+  "uid": "4_zbf287k",
+  "version": 2,
+  "weekStart": ""
+}
diff --git a/hack/download-dashboards.sh b/hack/download-dashboards.sh
index a1a6082a..d761f71c 100755
--- a/hack/download-dashboards.sh
+++ b/hack/download-dashboards.sh
@@ -83,6 +83,8 @@ modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//flux/flux-stats
 modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//kafka/strimzi-kafka.json
 modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//seaweedfs/seaweedfs.json
 modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//goldpinger/goldpinger.json
+modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//nats/nats-jetstream.json
+modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//nats/nats-server.json
 EOT
 
 
diff --git a/packages/apps/nats/templates/nats.yaml b/packages/apps/nats/templates/nats.yaml
index 4f52ff11..e5f5cf5d 100644
--- a/packages/apps/nats/templates/nats.yaml
+++ b/packages/apps/nats/templates/nats.yaml
@@ -95,10 +95,6 @@ spec:
               {{- with .Values.storageClass }}
               storageClassName: {{ . }}
               {{- end }}
-      promExporter:
-        enabled: true
-        podMonitor:
-          enabled: true
       {{- if .Values.external }}
       service:
         merge:
diff --git a/packages/system/monitoring/dashboards.list b/packages/system/monitoring/dashboards.list
index 1f4b2eea..6ad8630f 100644
--- a/packages/system/monitoring/dashboards.list
+++ b/packages/system/monitoring/dashboards.list
@@ -43,3 +43,5 @@ hubble/overview
 hubble/dns-namespace
 hubble/l7-http-metrics
 hubble/network-overview
+nats/nats-jetstream
+nats/nats-server
diff --git a/packages/system/nats/charts/nats/Chart.yaml b/packages/system/nats/charts/nats/Chart.yaml
index e59601a9..2f0edf48 100644
--- a/packages/system/nats/charts/nats/Chart.yaml
+++ b/packages/system/nats/charts/nats/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 2.10.17
+appVersion: 2.11.8
 description: A Helm chart for the NATS.io High Speed Cloud Native Distributed Communications
   Technology.
 home: http://github.com/nats-io/k8s
@@ -13,4 +13,4 @@ maintainers:
   name: The NATS Authors
   url: https://github.com/nats-io
 name: nats
-version: 1.2.1
+version: 1.3.13
diff --git a/packages/system/nats/charts/nats/README.md b/packages/system/nats/charts/nats/README.md
index 0916999d..0096a1bb 100644
--- a/packages/system/nats/charts/nats/README.md
+++ b/packages/system/nats/charts/nats/README.md
@@ -44,7 +44,7 @@ Everything in the NATS Config or Kubernetes Resources can be overridden by `merg
 | `container`                      | nats [k8s Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#container-v1-core)                | yes                                     |
 | `reloader`                       | config reloader [k8s Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#container-v1-core)     | yes                                     |
 | `promExporter`                   | prometheus exporter [k8s Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#container-v1-core) | no                                      |
-| `promExporter.podMonitor`        | [prometheus PodMonitor](https://prometheus-operator.dev/docs/operator/api/#monitoring.coreos.com/v1.PodMonitor)             | no                                      |
+| `promExporter.podMonitor`        | [prometheus PodMonitor](https://prometheus-operator.dev/docs/api-reference/api/#monitoring.coreos.com/v1.PodMonitor)        | no                                      |
 | `service`                        | [k8s Service](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#service-v1-core)                         | yes                                     |
 | `statefulSet`                    | [k8s StatefulSet](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#statefulset-v1-apps)                 | yes                                     |
 | `podTemplate`                    | [k8s PodTemplate](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#pod-v1-core)                         | yes                                     |
@@ -60,7 +60,7 @@ Everything in the NATS Config or Kubernetes Resources can be overridden by `merg
 
 ### Merge
 
-Merging is performed using the Helm `merge` function.  Example - add NATS accounts and container resources:
+Merging is performed using the Helm [`merge` function](https://helm.sh/docs/chart_template_guide/function_list/#merge-mustmerge).  Example - add NATS accounts and container resources:
 
 ```yaml
 config:
@@ -119,14 +119,22 @@ podTemplate:
 
 ### NATS Container Resources
 
+We recommend setting both **requests and limits** - for both **CPU and memory** - **to the same value** for the following reasons:
+
+* It ensures your NATS pod has [predictable performance](https://www.datadoghq.com/blog/kubernetes-cpu-requests-limits/#predictability:~:text=If%20containers%20are,available%20capacity%20decreases.).  
+* The NATS server [automatically sets](https://github.com/nats-io/nats-server/blob/v2.11.0/main.go#L131-L132) [GOMAXPROCS](https://github.com/golang/go/blob/go1.24.1/src/runtime/extern.go#L230-L234) to the number of CPU cores defined in the `limits` section. If `limits` are not set, GOMAXPROCS defaults to the node's physical core count, which can lead to [poor performance](https://github.com/golang/go/issues/33803).  
+* The pod will be assigned to the ["Guaranteed" QoS class](https://kubernetes.io/docs/concepts/workloads/pods/pod-qos/#guaranteed), making it less likely to be evicted when node resources are constrained.  
+
+Deviate from this recommendation only if you fully understand the implications of your settings.  
+
 ```yaml
 container:
   env:
-    # different from k8s units, suffix must be B, KiB, MiB, GiB, or TiB
-    # should be ~90% of memory limit
-    GOMEMLIMIT: 7GiB
+    # Different from k8s units, suffix must be B, KiB, MiB, GiB, or TiB
+    # Should be ~80% of memory limit
+    GOMEMLIMIT: 6GiB
   merge:
-    # recommended limit is at least 2 CPU cores and 8Gi Memory for production JetStream clusters
+    # Recommended minimum: at least 2 CPU cores and 8Gi memory for production JetStream clusters
     resources:
       requests:
         cpu: "2"
@@ -138,11 +146,27 @@ container:
 
 ### Specify Image Version
 
-```yaml
-container:
-  image:
-    tag: x.y.z-alpine
-```
+The container image can now be overridden by specifying either the image tag, an image digest, or a full image name. Examples below illustrate the options:
+
+- To set the tag:
+  ```yaml
+  container:
+    image:
+      tag: x.y.z-alpine
+  ```
+- To use an image digest, which overrides the tag:
+  ```yaml
+  container:
+    image:
+      repository: nats
+      digest: sha256:abcdef1234567890...
+  ```
+- To override the registry, repository, tag, and digest all at once, specify a full image name:
+  ```yaml
+  container:
+    image:
+      fullImageName: custom-reg.io/myimage@sha256:abcdef1234567890...
+  ```
 
 ### Operator Mode with NATS Resolver
 
diff --git a/packages/system/nats/charts/nats/files/stateful-set/pod-template.yaml b/packages/system/nats/charts/nats/files/stateful-set/pod-template.yaml
index bb1d8d7b..9832ba34 100644
--- a/packages/system/nats/charts/nats/files/stateful-set/pod-template.yaml
+++ b/packages/system/nats/charts/nats/files/stateful-set/pod-template.yaml
@@ -69,3 +69,7 @@ spec:
   - {{ merge (dict "topologyKey" $k "labelSelector" (dict "matchLabels" (include "nats.selectorLabels" $ | fromYaml))) $v | toYaml | nindent 4 }}
   {{- end }}
   {{- end}}
+  
+  # terminationGracePeriodSeconds determines how long to wait for graceful shutdown
+  # this should be at least `lameDuckGracePeriod` + 20s shutdown overhead
+  terminationGracePeriodSeconds: 60
diff --git a/packages/system/nats/charts/nats/files/stateful-set/prom-exporter-container.yaml b/packages/system/nats/charts/nats/files/stateful-set/prom-exporter-container.yaml
index c3e1b6fb..75f8a77c 100644
--- a/packages/system/nats/charts/nats/files/stateful-set/prom-exporter-container.yaml
+++ b/packages/system/nats/charts/nats/files/stateful-set/prom-exporter-container.yaml
@@ -27,4 +27,5 @@ args:
 {{- if .Values.config.gateway.enabled }}
 - -gatewayz
 {{- end }}
-- http://localhost:{{ .Values.config.monitor.port }}/
+{{- $monitorProto := ternary "https" "http" .Values.config.monitor.tls.enabled }}
+- {{ $monitorProto }}://{{ .Values.promExporter.monitorDomain }}:{{ .Values.config.monitor.port }}/
diff --git a/packages/system/nats/charts/nats/templates/_helpers.tpl b/packages/system/nats/charts/nats/templates/_helpers.tpl
index ba831397..d8485943 100644
--- a/packages/system/nats/charts/nats/templates/_helpers.tpl
+++ b/packages/system/nats/charts/nats/templates/_helpers.tpl
@@ -147,10 +147,18 @@ app.kubernetes.io/component: nats-box
 Print the image
 */}}
 {{- define "nats.image" }}
-{{- $image := printf "%s:%s" .repository .tag }}
+{{- $image := "" }}
+{{- if .digest }}
+{{- $image = printf "%s@%s" .repository .digest }}
+{{- else }}
+{{- $image = printf "%s:%s" .repository .tag }}
+{{- end }}
 {{- if or .registry .global.image.registry }}
 {{- $image = printf "%s/%s" (.registry | default .global.image.registry) $image }}
-{{- end -}}
+{{- end }}
+{{- if .fullImageName }}
+{{- $image = .fullImageName }}
+{{- end }}
 image: {{ $image }}
 {{- if or .pullPolicy .global.image.pullPolicy }}
 imagePullPolicy: {{ .pullPolicy | default .global.image.pullPolicy }}
@@ -274,7 +282,7 @@ output: string with following format rules
 */}}
 {{- define "nats.formatConfig" -}}
   {{-
-    (regexReplaceAll "\"<<\\s+(.*)\\s+>>\""
+    (regexReplaceAll "\"<<\\s+(.*?)\\s+>>\""
       (regexReplaceAll "\".*\\$include\": \"(.*)\",?" (include "toPrettyRawJson" .) "include ${1};")
     "${1}")
   -}}
diff --git a/packages/system/nats/charts/nats/values.yaml b/packages/system/nats/charts/nats/values.yaml
index 0b14ebd4..fa402f18 100644
--- a/packages/system/nats/charts/nats/values.yaml
+++ b/packages/system/nats/charts/nats/values.yaml
@@ -238,6 +238,7 @@ config:
     tls:
       # config.nats.tls must be enabled also
       # when enabled, monitoring port will use HTTPS with the options from config.nats.tls
+      # if promExporter is also enabled, consider setting promExporter.monitorDomain
       enabled: false
 
   profiling:
@@ -312,9 +313,13 @@ config:
 container:
   image:
     repository: nats
-    tag: 2.10.17-alpine
+    tag: 2.11.8-alpine
     pullPolicy:
     registry:
+    # if digest is provided, it overrides tag (example: "sha256:abcdef1234567890")
+    digest:
+    # if fullImageName is provided, it overrides registry, repository, tag, and digest
+    fullImageName:
 
   # container port options
   # must be enabled in the config section also
@@ -353,9 +358,11 @@ reloader:
   enabled: true
   image:
     repository: natsio/nats-server-config-reloader
-    tag: 0.15.0
+    tag: 0.19.1
     pullPolicy:
     registry:
+    digest:
+    fullImageName:
 
   # env var map, see nats.env for an example
   env: {}
@@ -363,7 +370,7 @@ reloader:
   # all nats container volume mounts with the following prefixes
   # will be mounted into the reloader container
   natsVolumeMountPrefixes:
-  - /etc/
+    - /etc/
 
   # merge or patch the container
   # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#container-v1-core
@@ -378,11 +385,16 @@ promExporter:
   enabled: false
   image:
     repository: natsio/prometheus-nats-exporter
-    tag: 0.15.0
+    tag: 0.17.3
     pullPolicy:
     registry:
+    digest:
+    fullImageName:
 
   port: 7777
+  # if config.monitor.tls.enabled is set to true, monitorDomain must be set to the common name
+  # or a SAN used in the tls certificate
+  monitorDomain: localhost
   # env var map, see nats.env for an example
   env: {}
 
@@ -398,13 +410,12 @@ promExporter:
     enabled: false
 
     # merge or patch the pod monitor
-    # https://prometheus-operator.dev/docs/operator/api/#monitoring.coreos.com/v1.PodMonitor
+    # https://prometheus-operator.dev/docs/api-reference/api/#monitoring.coreos.com/v1.PodMonitor
     merge: {}
     patch: []
     # defaults to "{{ include "nats.fullname" $ }}"
     name:
 
-
 ############################################################
 # service
 ############################################################
@@ -511,7 +522,6 @@ serviceAccount:
   # defaults to "{{ include "nats.fullname" $ }}"
   name:
 
-
 ############################################################
 # natsBox
 #
@@ -564,9 +574,11 @@ natsBox:
   container:
     image:
       repository: natsio/nats-box
-      tag: 0.14.3
+      tag: 0.18.0
       pullPolicy:
       registry:
+      digest:
+      fullImageName:
 
     # env var map, see nats.env for an example
     env: {}
@@ -624,7 +636,6 @@ natsBox:
     # defaults to "{{ include "nats.fullname" $ }}-box"
     name:
 
-
 ################################################################################
 # Extra user-defined resources
 ################################################################################
diff --git a/packages/system/nats/values.yaml b/packages/system/nats/values.yaml
index a28cadbe..87f730dd 100644
--- a/packages/system/nats/values.yaml
+++ b/packages/system/nats/values.yaml
@@ -9,3 +9,7 @@ nats:
     cluster:
       routeURLs:
         k8sClusterDomain: cozy.local
+  promExporter:
+    enabled: true
+    podMonitor:
+      enabled: true

From e7ffc21743148afb55b991b0194128163bfa114b Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 18 Feb 2026 01:23:02 +0300
Subject: [PATCH 102/666] feat(harbor): switch registry storage to S3 via COSI
 BucketClaim

Replace PVC-based registry storage with S3 via COSI BucketClaim/BucketAccess.
The system chart parses BucketInfo secret and creates a registry-s3 Secret
with REGISTRY_STORAGE_S3_* env vars that override Harbor's ConfigMap values.

- Add bucket-secret.yaml to system chart (BucketInfo parser)
- Remove storageType/size from registry config (S3 is now the only option)
- Use Harbor's existingSecret support for S3 credentials injection
- Add objectstorage-controller to PackageSource dependencies
- Update E2E test with COSI bucket provisioning waits and diagnostics

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/harbor.bats                     | 15 ++++++++--
 packages/apps/harbor/README.md                |  2 --
 packages/apps/harbor/templates/bucket.yaml    |  2 --
 packages/apps/harbor/templates/harbor.yaml    | 30 +++----------------
 packages/apps/harbor/values.schema.json       | 26 ----------------
 packages/apps/harbor/values.yaml              |  8 -----
 .../platform/sources/harbor-application.yaml  |  1 +
 packages/system/harbor-rd/cozyrds/harbor.yaml |  4 +--
 .../harbor/templates/bucket-secret.yaml       | 20 +++++++++++++
 packages/system/harbor/values.yaml            |  2 ++
 10 files changed, 42 insertions(+), 68 deletions(-)
 create mode 100644 packages/system/harbor/templates/bucket-secret.yaml

diff --git a/hack/e2e-apps/harbor.bats b/hack/e2e-apps/harbor.bats
index 076a1841..09215546 100644
--- a/hack/e2e-apps/harbor.bats
+++ b/hack/e2e-apps/harbor.bats
@@ -16,8 +16,6 @@ spec:
     resources: {}
     resourcesPreset: "nano"
   registry:
-    storageType: "pvc"
-    size: 5Gi
     resources: {}
     resourcesPreset: "nano"
   jobservice:
@@ -37,6 +35,13 @@ spec:
 EOF
   sleep 5
   kubectl -n tenant-test wait hr $release --timeout=60s --for=condition=ready
+
+  # Wait for COSI to provision bucket
+  kubectl -n tenant-test wait bucketclaims.objectstorage.k8s.io $release-registry \
+    --timeout=300s --for=jsonpath='{.status.bucketReady}'=true
+  kubectl -n tenant-test wait bucketaccesses.objectstorage.k8s.io $release-registry \
+    --timeout=60s --for=jsonpath='{.status.accessGranted}'=true
+
   kubectl -n tenant-test wait hr $release-system --timeout=600s --for=condition=ready || {
     echo "=== HelmRelease status ==="
     kubectl -n tenant-test get hr $release-system -o yaml 2>&1 || true
@@ -46,6 +51,12 @@ EOF
     kubectl -n tenant-test get events --sort-by='.lastTimestamp' 2>&1 | tail -30 || true
     echo "=== ExternalArtifact ==="
     kubectl -n cozy-system get externalartifact cozystack-harbor-application-default-harbor-system -o yaml 2>&1 || true
+    echo "=== BucketClaim status ==="
+    kubectl -n tenant-test get bucketclaims.objectstorage.k8s.io $release-registry -o yaml 2>&1 || true
+    echo "=== BucketAccess status ==="
+    kubectl -n tenant-test get bucketaccesses.objectstorage.k8s.io $release-registry -o yaml 2>&1 || true
+    echo "=== BucketAccess Secret ==="
+    kubectl -n tenant-test get secret $release-registry-bucket -o jsonpath='{.data.BucketInfo}' 2>&1 | base64 -d 2>&1 || true
     false
   }
   kubectl -n tenant-test wait deploy $release-core --timeout=120s --for=condition=available
diff --git a/packages/apps/harbor/README.md b/packages/apps/harbor/README.md
index 3c870be3..df44ca8d 100644
--- a/packages/apps/harbor/README.md
+++ b/packages/apps/harbor/README.md
@@ -22,8 +22,6 @@ Harbor is an open source trusted cloud native registry project that stores, sign
 | `core.resources.memory`       | Amount of memory allocated.                                                                              | `quantity` | `""`    |
 | `core.resourcesPreset`        | Default sizing preset used when `resources` is omitted.                                                  | `string`   | `small` |
 | `registry`                    | Container image registry configuration.                                                                  | `object`   | `{}`    |
-| `registry.storageType`        | Storage backend type for images.                                                                         | `string`   | `pvc`   |
-| `registry.size`               | Persistent Volume size (only used when storageType is pvc).                                              | `quantity` | `10Gi`  |
 | `registry.resources`          | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`   | `{}`    |
 | `registry.resources.cpu`      | Number of CPU cores allocated.                                                                           | `quantity` | `""`    |
 | `registry.resources.memory`   | Amount of memory allocated.                                                                              | `quantity` | `""`    |
diff --git a/packages/apps/harbor/templates/bucket.yaml b/packages/apps/harbor/templates/bucket.yaml
index 885cbfc8..a9e60988 100644
--- a/packages/apps/harbor/templates/bucket.yaml
+++ b/packages/apps/harbor/templates/bucket.yaml
@@ -1,4 +1,3 @@
-{{- if eq .Values.registry.storageType "s3" }}
 {{- $seaweedfs := .Values._namespace.seaweedfs }}
 apiVersion: objectstorage.k8s.io/v1alpha1
 kind: BucketClaim
@@ -18,4 +17,3 @@ spec:
   bucketClaimName: {{ .Release.Name }}-registry
   credentialsSecretName: {{ .Release.Name }}-registry-bucket
   protocol: s3
-{{- end }}
diff --git a/packages/apps/harbor/templates/harbor.yaml b/packages/apps/harbor/templates/harbor.yaml
index 0e9f4fd5..3ba09bfb 100644
--- a/packages/apps/harbor/templates/harbor.yaml
+++ b/packages/apps/harbor/templates/harbor.yaml
@@ -66,21 +66,9 @@ spec:
     name: {{ .Release.Name }}-credentials
     valuesKey: redis-password
     targetPath: harbor.redis.external.password
-  {{- if eq .Values.registry.storageType "s3" }}
-  - kind: Secret
-    name: {{ .Release.Name }}-registry-bucket
-    valuesKey: accessKey
-    targetPath: harbor.persistence.imageChartStorage.s3.accesskey
-  - kind: Secret
-    name: {{ .Release.Name }}-registry-bucket
-    valuesKey: secretKey
-    targetPath: harbor.persistence.imageChartStorage.s3.secretkey
-  - kind: Secret
-    name: {{ .Release.Name }}-registry-bucket
-    valuesKey: endpoint
-    targetPath: harbor.persistence.imageChartStorage.s3.regionendpoint
-  {{- end }}
   values:
+    bucket:
+      secretName: {{ .Release.Name }}-registry-bucket
     db:
       replicas: {{ .Values.database.replicas }}
       size: {{ .Values.database.size }}
@@ -106,31 +94,21 @@ spec:
       persistence:
         enabled: true
         resourcePolicy: "keep"
-        {{- if eq .Values.registry.storageType "s3" }}
         imageChartStorage:
           type: s3
           s3:
+            existingSecret: {{ .Release.Name }}-registry-s3
             region: us-east-1
             bucket: {{ .Release.Name }}-registry
             secure: false
             v4auth: true
-        {{- end }}
-        {{- if or (eq .Values.registry.storageType "pvc") .Values.trivy.enabled }}
+        {{- if .Values.trivy.enabled }}
         persistentVolumeClaim:
-          {{- if eq .Values.registry.storageType "pvc" }}
-          registry:
-            size: {{ .Values.registry.size }}
-            {{- with .Values.storageClass }}
-            storageClass: {{ . }}
-            {{- end }}
-          {{- end }}
-          {{- if .Values.trivy.enabled }}
           trivy:
             size: {{ .Values.trivy.size }}
             {{- with .Values.storageClass }}
             storageClass: {{ . }}
             {{- end }}
-          {{- end }}
         {{- end }}
       portal:
         resources: {{- include "cozy-lib.resources.defaultingSanitize" (list "nano" (dict) $) | nindent 10 }}
diff --git a/packages/apps/harbor/values.schema.json b/packages/apps/harbor/values.schema.json
index 71cc1d98..1352f5dc 100644
--- a/packages/apps/harbor/values.schema.json
+++ b/packages/apps/harbor/values.schema.json
@@ -179,9 +179,6 @@
       "description": "Container image registry configuration.",
       "type": "object",
       "default": {},
-      "required": [
-        "storageType"
-      ],
       "properties": {
         "resources": {
           "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
@@ -229,29 +226,6 @@
             "xlarge",
             "2xlarge"
           ]
-        },
-        "size": {
-          "description": "Persistent Volume size (only used when storageType is pvc).",
-          "default": "10Gi",
-          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "string"
-            }
-          ],
-          "x-kubernetes-int-or-string": true
-        },
-        "storageType": {
-          "description": "Storage backend type for images.",
-          "type": "string",
-          "default": "pvc",
-          "enum": [
-            "s3",
-            "pvc"
-          ]
         }
       }
     },
diff --git a/packages/apps/harbor/values.yaml b/packages/apps/harbor/values.yaml
index f1131bd1..de44eaff 100644
--- a/packages/apps/harbor/values.yaml
+++ b/packages/apps/harbor/values.yaml
@@ -34,20 +34,12 @@ core:
   resources: {}
   resourcesPreset: "small"
 
-## @enum {string} StorageType - Storage backend for container image registry.
-## @value s3 - S3-compatible object storage via COSI BucketClaim (requires SeaweedFS in tenant).
-## @value pvc - Persistent Volume Claim.
-
 ## @typedef {struct} Registry - Container image registry configuration.
-## @field {StorageType} storageType - Storage backend type for images.
-## @field {quantity} [size] - Persistent Volume size (only used when storageType is pvc).
 ## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
 ## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted.
 
 ## @param {Registry} registry - Container image registry configuration.
 registry:
-  storageType: "pvc"
-  size: 10Gi
   resources: {}
   resourcesPreset: "small"
 
diff --git a/packages/core/platform/sources/harbor-application.yaml b/packages/core/platform/sources/harbor-application.yaml
index b9bc8dc3..c2773bdd 100644
--- a/packages/core/platform/sources/harbor-application.yaml
+++ b/packages/core/platform/sources/harbor-application.yaml
@@ -15,6 +15,7 @@ spec:
         - cozystack.networking
         - cozystack.postgres-operator
         - cozystack.redis-operator
+        - cozystack.objectstorage-controller
       libraries:
         - name: cozy-lib
           path: library/cozy-lib
diff --git a/packages/system/harbor-rd/cozyrds/harbor.yaml b/packages/system/harbor-rd/cozyrds/harbor.yaml
index 80924530..0112dc11 100644
--- a/packages/system/harbor-rd/cozyrds/harbor.yaml
+++ b/packages/system/harbor-rd/cozyrds/harbor.yaml
@@ -8,7 +8,7 @@ spec:
     singular: harbor
     plural: harbors
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"core":{"description":"Core API server configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"database":{"description":"PostgreSQL database configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of database instances.","type":"integer","default":2},"size":{"description":"Persistent Volume size for database storage.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"host":{"description":"Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).","type":"string","default":""},"jobservice":{"description":"Background job service configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"redis":{"description":"Redis cache configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of Redis replicas.","type":"integer","default":2},"size":{"description":"Persistent Volume size for cache storage.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"registry":{"description":"Container image registry configuration.","type":"object","default":{},"required":["storageType"],"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size (only used when storageType is pvc).","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageType":{"description":"Storage backend type for images.","type":"string","default":"pvc","enum":["s3","pvc"]}}},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"trivy":{"description":"Trivy vulnerability scanner configuration.","type":"object","default":{},"required":["enabled","size"],"properties":{"enabled":{"description":"Enable or disable the vulnerability scanner.","type":"boolean","default":true},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for vulnerability database cache.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}
+      {"title":"Chart Values","type":"object","properties":{"core":{"description":"Core API server configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"database":{"description":"PostgreSQL database configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of database instances.","type":"integer","default":2},"size":{"description":"Persistent Volume size for database storage.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"host":{"description":"Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).","type":"string","default":""},"jobservice":{"description":"Background job service configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"redis":{"description":"Redis cache configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of Redis replicas.","type":"integer","default":2},"size":{"description":"Persistent Volume size for cache storage.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"registry":{"description":"Container image registry configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"trivy":{"description":"Trivy vulnerability scanner configuration.","type":"object","default":{},"required":["enabled","size"],"properties":{"enabled":{"description":"Enable or disable the vulnerability scanner.","type":"boolean","default":true},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for vulnerability database cache.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}
   release:
     prefix: "harbor-"
     labels:
@@ -29,7 +29,7 @@ spec:
       - registry
       - container
     icon: "PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHJvbGU9ImltZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHZpZXdCb3g9IjEuMDUgLTEuOTUgMzU5LjQxIDM2MS42NiI+PGRlZnM+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQiIHgxPSIyNjQuNzkiIHgyPSIyNjcuMjciIHkxPSI5NTIuMzkiIHkyPSI5NTIuMzkiIGdyYWRpZW50VHJhbnNmb3JtPSJtYXRyaXgoMzAuNDMgMCAwIC0zMC40MyAtNzk1NS4yMiAyOTI4NS43NSkiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBvZmZzZXQ9IjAiIHN0b3AtY29sb3I9IiM2MGI5MzIiLz48c3RvcCBvZmZzZXQ9Ii4yOCIgc3RvcC1jb2xvcj0iIzYwYjkzMiIvPjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iIzM2N2MzNCIvPjwvbGluZWFyR3JhZGllbnQ+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQtMiIgeDE9IjI2My43NyIgeDI9IjI2Ni4yNiIgeTE9Ijk1NS42NSIgeTI9Ijk1NS42NSIgZ3JhZGllbnRUcmFuc2Zvcm09Im1hdHJpeCgyNy4yMSAwIDAgLTI3LjIxIC03MDczLjg1IDI2MTY5LjQxKSIgeGxpbms6aHJlZj0iI2xpbmVhci1ncmFkaWVudCIvPjxsaW5lYXJHcmFkaWVudCBpZD0ibGluZWFyLWdyYWRpZW50LTMiIHgxPSIyNjMuMjgiIHgyPSIyNjUuNzYiIHkxPSI5NTMuNzQiIHkyPSI5NTMuNzQiIGdyYWRpZW50VHJhbnNmb3JtPSJtYXRyaXgoMjUuNzUgMCAwIC0yNS43NSAtNjY3MS4xMyAyNDgxMi4yMykiIHhsaW5rOmhyZWY9IiNsaW5lYXItZ3JhZGllbnQiLz48bGluZWFyR3JhZGllbnQgaWQ9ImxpbmVhci1ncmFkaWVudC00IiB4MT0iMjYzLjc3IiB4Mj0iMjY2LjI1IiB5MT0iOTUzLjIiIHkyPSI5NTMuMiIgZ3JhZGllbnRUcmFuc2Zvcm09Im1hdHJpeCgyNy4xIDAgMCAtMjcuMSAtNzA0MC45IDI2MTAyLjQ5KSIgeGxpbms6aHJlZj0iI2xpbmVhci1ncmFkaWVudCIvPjxsaW5lYXJHcmFkaWVudCBpZD0ibGluZWFyLWdyYWRpZW50LTUiIHgxPSIyNjIuNzMiIHgyPSIyNjUuMjEiIHkxPSI5NTQuMzQiIHkyPSI5NTQuMzQiIGdyYWRpZW50VHJhbnNmb3JtPSJtYXRyaXgoMjQuNCAwIDAgLTI0LjQgLTYzMDEuMzYgMjM1MjEuOTcpIiB4bGluazpocmVmPSIjbGluZWFyLWdyYWRpZW50Ii8+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQtNiIgeDE9IjI3Mi4xNCIgeDI9IjI3NC42MiIgeTE9Ijk1NS4xNSIgeTI9Ijk1NS4xNSIgZ3JhZGllbnRUcmFuc2Zvcm09InNjYWxlKDY2LjA5IC02Ni4wOSkgcm90YXRlKDM2LjUyIDE1ODguMTUzIDY4LjE0OCkiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBvZmZzZXQ9IjAiIHN0b3AtY29sb3I9IiM0NTk2ZDgiLz48c3RvcCBvZmZzZXQ9Ii4yIiBzdG9wLWNvbG9yPSIjNDU5NmQ4Ii8+PHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjZmZmIi8+PC9saW5lYXJHcmFkaWVudD48bGluZWFyR3JhZGllbnQgaWQ9ImxpbmVhci1ncmFkaWVudC03IiB4MT0iMjcwLjY1IiB4Mj0iMjczLjEzIiB5MT0iOTUyLjM4IiB5Mj0iOTUyLjM4IiBncmFkaWVudFRyYW5zZm9ybT0ic2NhbGUoNzcuOCAtNzcuOCkgcm90YXRlKC0xMS41NCAtNDU4Ny4yMDkgMTgwMy4zMjMpIiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+PHN0b3Agb2Zmc2V0PSIwIiBzdG9wLWNvbG9yPSIjNDE5NGQ3Ii8+PHN0b3Agb2Zmc2V0PSIuMiIgc3RvcC1jb2xvcj0iIzQxOTRkNyIvPjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iI2ZmZiIvPjwvbGluZWFyR3JhZGllbnQ+PGxpbmVhckdyYWRpZW50IGlkPSJsaW5lYXItZ3JhZGllbnQtOCIgeDE9IjI3MC45NyIgeDI9IjI3My40NSIgeTE9Ijk1My43NSIgeTI9Ijk1My43NSIgZ3JhZGllbnRUcmFuc2Zvcm09InNjYWxlKDcxLjM1IC03MS4zNSkgcm90YXRlKDEwLjIzIDU0NzcuMzcgLTEwMjQuNjAyKSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPjxzdG9wIG9mZnNldD0iMCIgc3RvcC1jb2xvcj0iIzQxOTRkNyIvPjxzdG9wIG9mZnNldD0iLjMzIiBzdG9wLWNvbG9yPSIjNDQ5NmQ4Ii8+PHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjZmZmIi8+PC9saW5lYXJHcmFkaWVudD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aCI+PHBhdGggZD0iTTE3NC40IDMwMi41MmwtNjguNjUtMzAuMjYtMy44MyA0My4yMSA3NS41IDIzLjk4LTMuMDItMzYuOTN6IiBjbGFzcz0iY2xzLTEiLz48L2NsaXBQYXRoPjxjbGlwUGF0aCBpZD0iY2xpcC1wYXRoLTIiPjxwYXRoIGQ9Ik0xMTkuMTkgMTM1LjM4aDM4LjU1djMyLjg5aC05LjE1di0xNGExMC4xMyAxMC4xMyAwIDEgMC0yMC4yNiAwdjE0aC05LjE1em0tNy43IDcybDU3LjIgMjUuMjEtMy45NC00OC4yNGg3LjQ5di0xNi4wOGgtNS41NXYtMzIuODloNS41NXYtOS40NWwtMzAuODYtMzAuMTl2LTIuMTJhMi45MSAyLjkxIDAgMCAwLTUuODIgMHYyLjEybC0zMC44NiAzMC4xOXY5LjQ1aDUuNTZ2MzIuODloLTUuNTZ2MTYuMTJoOC44MnoiIGNsYXNzPSJjbHMtMSIvPjwvY2xpcFBhdGg+PGNsaXBQYXRoIGlkPSJjbGlwLXBhdGgtMyI+PHBhdGggZD0iTTEwOC4xNCAyNDUuMjhsNjMuODggMjguMTYtLjk2LTExLjczLTYxLjk2LTI3LjMtLjk2IDEwLjg3eiIgY2xhc3M9ImNscy0xIi8+PC9jbGlwUGF0aD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aC00Ij48cGF0aCBkPSJNMTA2LjQ2IDI2NC4yMWw2Ny4yMyAyOS42My0uOTYtMTEuNzItNjUuMzEtMjguNzgtLjk2IDEwLjg3eiIgY2xhc3M9ImNscy0xIi8+PC9jbGlwUGF0aD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aC01Ij48cGF0aCBkPSJNMTEwLjc3IDIxNS40OGwtLjk2IDEwLjg3IDYwLjU0IDI2LjY4LS45NS0xMS43Mi01OC42My0yNS44M3oiIGNsYXNzPSJjbHMtMSIvPjwvY2xpcFBhdGg+PGNsaXBQYXRoIGlkPSJjbGlwLXBhdGgtNiI+PHBhdGggZD0iTTMxMy4xMyA2Ny41OWExNzUuMzEgMTc1LjMxIDAgMCAwLTI5Ljc1LTI4LjEzYy0xLjU3LTEuMTctMy4xOC0yLjMtNC43OS0zLjQyTDI1NiA1OS41bC04Mi4zNCA4NS42MyAxMTMuNDEtNTguNjggMjkuMDctMTVjLTEuMDEtMS4zMS0xLjk4LTIuNjItMy4wMS0zLjg2eiIgY2xhc3M9ImNscy0xIi8+PC9jbGlwUGF0aD48Y2xpcFBhdGggaWQ9ImNsaXAtcGF0aC03Ij48cGF0aCBkPSJNMzUzLjU5IDE3Ny42MWMwLTItLjE0LTQtLjIyLTUuOTNsLTMyLjIxLTIuMzEtMTQ3LjQ3LTEwLjU4TDMxOC4zNiAyMDlsMzAuNDEgMTAuNTVjLjA5LS4zNi4xOS0uNzEuMjgtMS4wOGExNzMuNjUgMTczLjY1IDAgMCAwIDQuNTctMzkuNDd2LTEuMzd6IiBjbGFzcz0iY2xzLTEiLz48L2NsaXBQYXRoPjxjbGlwUGF0aCBpZD0iY2xpcC1wYXRoLTgiPjxwYXRoIGQ9Ik0zNDguODQgMTM4LjYxYTE3Mi41NSAxNzIuNTUgMCAwIDAtMTMuODQtMzcuN2wtMzAuOTQgOS45NEwxNzUuOTIgMTUybDE0Mi00LjgzIDMyLjUtMS4xMWMtLjUtMi40OC0uOTktNC45OC0xLjU4LTcuNDV6IiBjbGFzcz0iY2xzLTEiLz48L2NsaXBQYXRoPjxzdHlsZT4uY2xzLTF7ZmlsbDpub25lfS5jbHMtMTN7ZmlsbDojNjk2NTY2fTwvc3R5bGU+PC9kZWZzPjxnIGlkPSJnMTIiPjxwYXRoIGlkPSJwYXRoMTQiIGZpbGw9IiNmZmYiIGQ9Ik0zMC44OSAxNzlhMTQ4Ljg3IDE0OC44NyAwIDEgMSAxNDguODcgMTQ4Ljg1QTE0OC44NyAxNDguODcgMCAwIDEgMzAuODkgMTc5Ii8+PGcgaWQ9ImczMCIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aCkiPjxnIGlkPSJnMzIiPjxwYXRoIGlkPSJwYXRoNDYiIGZpbGw9InVybCgjbGluZWFyLWdyYWRpZW50KSIgZD0iTTE3NC40IDMwMi41MmwtNjguNjUtMzAuMjUtMy44MiA0My4yIDc1LjUgMjQtMy0zNi45MyIvPjwvZz48L2c+PGcgaWQ9Imc0OCIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aC0yKSI+PGcgaWQ9Imc1MCI+PHBhdGggaWQ9InBhdGg2NCIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtMikiIGQ9Ik0xMTkuMTkgMTM1LjM4aDM4LjU1djMyLjg5aC05LjE1di0xNGExMC4xMyAxMC4xMyAwIDEgMC0yMC4yNiAwdjE0aC05LjE1em0tNy43IDcybDU3LjIgMjUuMjEtMy45NC00OC4yNGg3LjQ5di0xNi4wOGgtNS41NXYtMzIuODloNS41NXYtOS40NWwtMzAuODYtMzAuMTl2LTIuMTJhMi45MSAyLjkxIDAgMCAwLTUuODIgMHYyLjEybC0zMC44NiAzMC4xOXY5LjQ1aDUuNTZ2MzIuODloLTUuNTZ2MTYuMTJoOC44MmwtMiAyMyIvPjwvZz48L2c+PGcgaWQ9Imc2NiIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aC0zKSI+PGcgaWQ9Imc2OCI+PHBhdGggaWQ9InBhdGg4MiIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtMykiIGQ9Ik0xMDguMTMgMjQ1LjI4TDE3MiAyNzMuNDRsLTEtMTEuNzItNjItMjcuMzEtMSAxMC44NyIvPjwvZz48L2c+PGcgaWQ9Imc4NCIgY2xpcC1wYXRoPSJ1cmwoI2NsaXAtcGF0aC00KSI+PGcgaWQ9Imc4NiI+PHBhdGggaWQ9InBhdGgxMDAiIGZpbGw9InVybCgjbGluZWFyLWdyYWRpZW50LTQpIiBkPSJNMTA2LjQ2IDI2NC4yMWw2Ny4yMyAyOS42My0xLTExLjcyLTY1LjMxLTI4Ljc4LTEgMTAuODciLz48L2c+PC9nPjxnIGlkPSJnMTAyIiBjbGlwLXBhdGg9InVybCgjY2xpcC1wYXRoLTUpIj48ZyBpZD0iZzEwNCI+PHBhdGggaWQ9InBhdGgxMTgiIGZpbGw9InVybCgjbGluZWFyLWdyYWRpZW50LTUpIiBkPSJNMTEwLjc3IDIxNS40OGwtMSAxMC44OEwxNzAuMzUgMjUzbC0xLTExLjcyLTU4LjYyLTI1LjgzIi8+PC9nPjwvZz48cGF0aCBpZD0icGF0aDEyMCIgZD0iTTMwNC4wNyAxMTAuODVsMzAuOTMtOS45NGMtLjExLS4yMi0uMjEtLjQ1LS4zMi0uNjZhMTc0LjQxIDE3NC40MSAwIDAgMC0xOC41NS0yOC44M2wtMjkuMDcgMTVhMTQyLjcxIDE0Mi43MSAwIDAgMSAxNi43MyAyMy44N2MuMS4xNy4xOC4zNS4yNy41MyIgY2xhc3M9ImNscy0xMyIvPjxwYXRoIGlkPSJwYXRoMTIyIiBkPSJNMzIxLjE1IDE2OS4zN2wzMi4yMSAyLjMxYTE3Mi44NiAxNzIuODYgMCAwIDAtMy0yNS41OWwtMzIuNSAxLjExYTE0MSAxNDEgMCAwIDEgMy4yNSAyMi4xNyIgY2xhc3M9ImNscy0xMyIvPjxwYXRoIGlkPSJwYXRoMTI0IiBkPSJNMTgyIDMyMC44MWMtNzguMiAwLTE0MS44My02My42Mi0xNDEuODMtMTQxLjgyUzEwMy44MiAzNy4xNiAxODIgMzcuMTZhMTQwLjkzIDE0MC45MyAwIDAgMSA3Ni4zIDIyLjM0TDI4MC44NSAzNkExNzIuODYgMTcyLjg2IDAgMCAwIDE4MiA1LjExQzg2LjE1IDUuMTEgOC4xNSA4My4xMSA4LjE1IDE3OXM3OCAxNzMuODUgMTczLjg1IDE3My44NWM4MS45IDAgMTUwLjY5LTU3IDE2OS0xMzMuMzJMMzIwLjYyIDIwOWMtMTMuOCA2My44NC03MC42OSAxMTEuODMtMTM4LjYgMTExLjgzIiBjbGFzcz0iY2xzLTEzIi8+PGcgaWQ9ImcxMjYiIGNsaXAtcGF0aD0idXJsKCNjbGlwLXBhdGgtNikiPjxnIGlkPSJnMTI4Ij48cGF0aCBpZD0icGF0aDE0MiIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtNikiIGQ9Ik0zMTMuMTMgNjcuNTlhMTc1LjMxIDE3NS4zMSAwIDAgMC0yOS43NS0yOC4xM2MtMS41Ny0xLjE3LTMuMTgtMi4zLTQuNzktMy40MkwyNTYgNTkuNWwtODIuMzQgODUuNjMgMTEzLjQxLTU4LjY4IDI5LjA3LTE1Yy0xLTEuMjctMi0yLjU4LTMtMy44MiIvPjwvZz48L2c+PGcgaWQ9ImcxNDQiIGNsaXAtcGF0aD0idXJsKCNjbGlwLXBhdGgtNykiPjxnIGlkPSJnMTQ2Ij48cGF0aCBpZD0icGF0aDE2MCIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtNykiIGQ9Ik0zNTMuNTkgMTc3LjYxYzAtMi0uMTQtNC0uMjItNS45M2wtMzIuMjEtMi4zMS0xNDcuNDctMTAuNThMMzE4LjM2IDIwOWwzMC40MSAxMC41NWMuMDktLjM2LjE5LS43MS4yOC0xLjA4YTE3My42NSAxNzMuNjUgMCAwIDAgNC41Ny0zOS40N3YtMS4zNyIvPjwvZz48L2c+PGcgaWQ9ImcxNjIiIGNsaXAtcGF0aD0idXJsKCNjbGlwLXBhdGgtOCkiPjxnIGlkPSJnMTY0Ij48cGF0aCBpZD0icGF0aDE3OCIgZmlsbD0idXJsKCNsaW5lYXItZ3JhZGllbnQtOCkiIGQ9Ik0zNDguODQgMTM4LjYxYTE3Mi41NSAxNzIuNTUgMCAwIDAtMTMuODQtMzcuN2wtMzAuOTQgOS45NEwxNzUuOTIgMTUybDE0Mi00LjgzIDMyLjUtMS4xMWMtLjQ4LTIuNTEtMS01LTEuNTYtNy40OCIvPjwvZz48L2c+PC9nPjwvc3ZnPg=="
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "host"], ["spec", "storageClass"], ["spec", "core"], ["spec", "core", "resources"], ["spec", "core", "resourcesPreset"], ["spec", "registry"], ["spec", "registry", "storageType"], ["spec", "registry", "size"], ["spec", "registry", "resources"], ["spec", "registry", "resourcesPreset"], ["spec", "jobservice"], ["spec", "jobservice", "resources"], ["spec", "jobservice", "resourcesPreset"], ["spec", "trivy"], ["spec", "trivy", "enabled"], ["spec", "trivy", "size"], ["spec", "trivy", "resources"], ["spec", "trivy", "resourcesPreset"], ["spec", "database"], ["spec", "database", "size"], ["spec", "database", "replicas"], ["spec", "redis"], ["spec", "redis", "size"], ["spec", "redis", "replicas"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "host"], ["spec", "storageClass"], ["spec", "core"], ["spec", "core", "resources"], ["spec", "core", "resourcesPreset"], ["spec", "registry"], ["spec", "registry", "resources"], ["spec", "registry", "resourcesPreset"], ["spec", "jobservice"], ["spec", "jobservice", "resources"], ["spec", "jobservice", "resourcesPreset"], ["spec", "trivy"], ["spec", "trivy", "enabled"], ["spec", "trivy", "size"], ["spec", "trivy", "resources"], ["spec", "trivy", "resourcesPreset"], ["spec", "database"], ["spec", "database", "size"], ["spec", "database", "replicas"], ["spec", "redis"], ["spec", "redis", "size"], ["spec", "redis", "replicas"]]
   secrets:
     exclude: []
     include:
diff --git a/packages/system/harbor/templates/bucket-secret.yaml b/packages/system/harbor/templates/bucket-secret.yaml
new file mode 100644
index 00000000..241fe638
--- /dev/null
+++ b/packages/system/harbor/templates/bucket-secret.yaml
@@ -0,0 +1,20 @@
+{{- if .Values.bucket.secretName }}
+{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace .Values.bucket.secretName }}
+{{- $bucketInfo := fromJson (b64dec (index $existingSecret.data "BucketInfo")) }}
+{{- $accessKeyID := index $bucketInfo.spec.secretS3 "accessKeyID" }}
+{{- $accessSecretKey := index $bucketInfo.spec.secretS3 "accessSecretKey" }}
+{{- $endpoint := index $bucketInfo.spec.secretS3 "endpoint" }}
+{{- $bucketName := $bucketInfo.spec.bucketName }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.harbor.fullnameOverride }}-registry-s3
+type: Opaque
+stringData:
+  REGISTRY_STORAGE_S3_ACCESSKEY: {{ $accessKeyID | quote }}
+  REGISTRY_STORAGE_S3_SECRETKEY: {{ $accessSecretKey | quote }}
+  REGISTRY_STORAGE_S3_REGIONENDPOINT: {{ $endpoint | quote }}
+  REGISTRY_STORAGE_S3_BUCKET: {{ $bucketName | quote }}
+  REGISTRY_STORAGE_S3_REGION: "us-east-1"
+{{- end }}
diff --git a/packages/system/harbor/values.yaml b/packages/system/harbor/values.yaml
index 9038bd38..faac7068 100644
--- a/packages/system/harbor/values.yaml
+++ b/packages/system/harbor/values.yaml
@@ -1,4 +1,6 @@
 harbor: {}
+bucket:
+  secretName: ""
 db:
   replicas: 2
   size: 5Gi

From bff5468b52319c05d3d355a1e70402ab1b552413 Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Tue, 17 Feb 2026 22:36:40 +0000
Subject: [PATCH 103/666] Prepare release v1.0.0-beta.6

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 packages/apps/http-cache/images/nginx-cache.tag             | 2 +-
 packages/apps/kubernetes/images/kubevirt-csi-driver.tag     | 2 +-
 packages/apps/kubernetes/images/ubuntu-container-disk.tag   | 2 +-
 packages/core/installer/values.yaml                         | 4 ++--
 packages/core/platform/values.yaml                          | 2 +-
 packages/core/testing/values.yaml                           | 2 +-
 packages/extra/bootbox/images/matchbox.tag                  | 2 +-
 packages/extra/seaweedfs/images/objectstorage-sidecar.tag   | 2 +-
 packages/system/backup-controller/values.yaml               | 2 +-
 packages/system/backupstrategy-controller/values.yaml       | 2 +-
 packages/system/cozystack-api/values.yaml                   | 2 +-
 packages/system/cozystack-controller/values.yaml            | 2 +-
 packages/system/dashboard/templates/configmap.yaml          | 2 +-
 packages/system/dashboard/values.yaml                       | 6 +++---
 .../system/grafana-operator/images/grafana-dashboards.tag   | 2 +-
 packages/system/kamaji/values.yaml                          | 4 ++--
 packages/system/kubeovn-plunger/values.yaml                 | 2 +-
 packages/system/kubeovn-webhook/values.yaml                 | 2 +-
 packages/system/kubevirt-csi-node/values.yaml               | 2 +-
 packages/system/lineage-controller-webhook/values.yaml      | 2 +-
 packages/system/objectstorage-controller/values.yaml        | 2 +-
 packages/system/seaweedfs/values.yaml                       | 2 +-
 22 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/packages/apps/http-cache/images/nginx-cache.tag b/packages/apps/http-cache/images/nginx-cache.tag
index ee4d8890..2d0e803a 100644
--- a/packages/apps/http-cache/images/nginx-cache.tag
+++ b/packages/apps/http-cache/images/nginx-cache.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/nginx-cache:0.0.0@sha256:9e34fd50393b418d9516aadb488067a3a63675b045811beb1c0afc9c61e149e8
+ghcr.io/cozystack/cozystack/nginx-cache:0.0.0@sha256:cb25e40cb665b8bbeee8cb1ec39da4c9a7452ef3f2f371912bbc0d1b1e2d40a8
diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
index a8e48958..d61f214a 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:1997d623bb60a5b540027a4e0716e7ca84f668ee09f31290e9c43324f0003137
+ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:604561e23df1b8eb25c24cf73fd93c7aaa6d1e7c56affbbda5c6f0f83424e4b1
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk.tag b/packages/apps/kubernetes/images/ubuntu-container-disk.tag
index 930a3fd2..5b0830a6 100644
--- a/packages/apps/kubernetes/images/ubuntu-container-disk.tag
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.33@sha256:71a74ca30f75967bae309be2758f19aa3d37c60b19426b9b622ff1c33a80362f
+ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.33@sha256:19ee4c76f0b3b7b40b97995ca78988ad8c82f6e9c75288d8b7b4b88a64f75d50
diff --git a/packages/core/installer/values.yaml b/packages/core/installer/values.yaml
index 3dd0f1d6..68894b3e 100644
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -1,9 +1,9 @@
 cozystackOperator:
   # Deployment variant: talos, generic, hosted
   variant: talos
-  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.0.0-beta.5@sha256:9f3089cb13b3e19dab14b8edc1220efde693f6066d3474c0137953e1873d16f3
+  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.0.0-beta.6@sha256:c7490da9c1ccb51bff4dd5657ca6a33a29ac71ad9861dfa8c72fdfc8b5765b93
   platformSourceUrl: 'oci://ghcr.io/cozystack/cozystack/cozystack-packages'
-  platformSourceRef: 'digest=sha256:86daf23f7b2ff2f448b273153733c55ac2f57c2bbe72c779ff14865d71e623cb'
+  platformSourceRef: 'digest=sha256:b29b87d1a2b80452ffd4db7516a102c30c55121552dcdb237055d4124d12c55d'
 # Generic variant configuration (only used when cozystackOperator.variant=generic)
 cozystack:
   # Kubernetes API server host (IP only, no protocol/port)
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index f9d4c8d3..5caab16d 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -5,7 +5,7 @@ sourceRef:
   path: /
 migrations:
   enabled: false
-  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0-beta.5@sha256:e7a9e0f0adc33e0be007af42f50ed3af064aa965ad628e48cc6c7943f31f239d
+  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0-beta.6@sha256:37c78dafcedbdad94acd9912550db0b4875897150666b8a06edfa894de99064e
   targetVersion: 32
 # Bundle deployment configuration
 bundles:
diff --git a/packages/core/testing/values.yaml b/packages/core/testing/values.yaml
index 627d3096..0692cab6 100644
--- a/packages/core/testing/values.yaml
+++ b/packages/core/testing/values.yaml
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.0.0-beta.5@sha256:eac71ef0de3450fce96255629e77903630c63ade62b81e7055f1a689f92ee153
+  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.0.0-beta.6@sha256:09af5901abcbed2b612d2d93c163e8ad3948bc55a1d8beae714b4fb2b8f7d91d
diff --git a/packages/extra/bootbox/images/matchbox.tag b/packages/extra/bootbox/images/matchbox.tag
index 19014ae6..9729ce6e 100644
--- a/packages/extra/bootbox/images/matchbox.tag
+++ b/packages/extra/bootbox/images/matchbox.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/matchbox:v1.0.0-beta.5@sha256:8facb6bbbaf336ff3dd606d6bcbf65f5d1fb7f079bec09966544398632005b47
+ghcr.io/cozystack/cozystack/matchbox:v1.0.0-beta.6@sha256:212f624957447f5a932fd5d4564eb8c97694d336b7dc877a2833c1513c0d074d
diff --git a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
index 9f5222a7..9657b956 100644
--- a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
+++ b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-beta.5@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0
+ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-beta.6@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0
diff --git a/packages/system/backup-controller/values.yaml b/packages/system/backup-controller/values.yaml
index 63c49ed1..9ce9bac9 100644
--- a/packages/system/backup-controller/values.yaml
+++ b/packages/system/backup-controller/values.yaml
@@ -1,5 +1,5 @@
 backupController:
-  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.0.0-beta.5@sha256:c99ff8ab11c5c016841acd9dca72c7a643dba72a98b8f816ea67ba7fa3549f88"
+  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.0.0-beta.6@sha256:365214a74ffc34a9314a62a7d4b491590051fc5486f6bae9913c0c1289983d43"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/backupstrategy-controller/values.yaml b/packages/system/backupstrategy-controller/values.yaml
index 5ff8efd5..d74557a0 100644
--- a/packages/system/backupstrategy-controller/values.yaml
+++ b/packages/system/backupstrategy-controller/values.yaml
@@ -1,5 +1,5 @@
 backupStrategyController:
-  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.0.0-beta.5@sha256:cd92a2620c9965512977b57c2829d931e7ecb7a8afc0693d7c8ab39bd8ff77d8"
+  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.0.0-beta.6@sha256:aa04ee61dce11950162606fc8db2d5cbc6f5b32ba700f790b3f1eee10d65efb1"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/cozystack-api/values.yaml b/packages/system/cozystack-api/values.yaml
index 511d1f33..cc6279bc 100644
--- a/packages/system/cozystack-api/values.yaml
+++ b/packages/system/cozystack-api/values.yaml
@@ -1,3 +1,3 @@
 cozystackAPI:
-  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.0.0-beta.5@sha256:b217c3d1cca7e35b9e6ee32297ebe923fee12ca48d94062484a9dfcffda0e2e3
+  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.0.0-beta.6@sha256:d89cf68fb622d0dbef7db98db09d352efc93c2cce448d11f2d73dcd363e911b7
   replicas: 2
diff --git a/packages/system/cozystack-controller/values.yaml b/packages/system/cozystack-controller/values.yaml
index 5ead5eae..7a17c992 100644
--- a/packages/system/cozystack-controller/values.yaml
+++ b/packages/system/cozystack-controller/values.yaml
@@ -1,4 +1,4 @@
 cozystackController:
-  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.0.0-beta.5@sha256:edeb1788395d650f5f14a935c8f6b95ede7ca548cba198c18c75cc5eafd89104
+  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.0.0-beta.6@sha256:d55a3c288934b1f69a00321bc8a94776915556b5f882fe6ac615e9de2701c61f
   debug: false
   disableTelemetry: false
diff --git a/packages/system/dashboard/templates/configmap.yaml b/packages/system/dashboard/templates/configmap.yaml
index c32fc638..3ac5029e 100644
--- a/packages/system/dashboard/templates/configmap.yaml
+++ b/packages/system/dashboard/templates/configmap.yaml
@@ -1,6 +1,6 @@
 {{- $brandingConfig := .Values._cluster.branding | default dict }}
 
-{{- $tenantText := "v1.0.0-beta.5" }}
+{{- $tenantText := "v1.0.0-beta.6" }}
 {{- $footerText := "Cozystack" }}
 {{- $titleText := "Cozystack Dashboard" }}
 {{- $logoText := "" }}
diff --git a/packages/system/dashboard/values.yaml b/packages/system/dashboard/values.yaml
index a2f9c642..32823845 100644
--- a/packages/system/dashboard/values.yaml
+++ b/packages/system/dashboard/values.yaml
@@ -1,6 +1,6 @@
 openapiUI:
-  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.0.0-beta.5@sha256:0d331986ac06de1fa5b660d69670cba0f2a59fcdab6cf43cb136827ecb8fcfe8
+  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.0.0-beta.6@sha256:c333637673a9e878f6c4ed0fc96db55967bbcf94b2434d075b0f0c6fcfcf9eff
 openapiUIK8sBff:
-  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.0.0-beta.5@sha256:1b3ea6d4c7dbbe6a8def3b2807fffdfab2ac4afc39d7a846e57dd491fa168f92
+  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.0.0-beta.6@sha256:1b3ea6d4c7dbbe6a8def3b2807fffdfab2ac4afc39d7a846e57dd491fa168f92
 tokenProxy:
-  image: ghcr.io/cozystack/cozystack/token-proxy:v1.0.0-beta.5@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
+  image: ghcr.io/cozystack/cozystack/token-proxy:v1.0.0-beta.6@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
diff --git a/packages/system/grafana-operator/images/grafana-dashboards.tag b/packages/system/grafana-operator/images/grafana-dashboards.tag
index 34111c9f..10837c35 100644
--- a/packages/system/grafana-operator/images/grafana-dashboards.tag
+++ b/packages/system/grafana-operator/images/grafana-dashboards.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/grafana-dashboards:v1.0.0-beta.5@sha256:e866b5b3874b9d390b341183d2ee070e1387440c14cfe51af831695def6dc2ec
+ghcr.io/cozystack/cozystack/grafana-dashboards:v1.0.0-beta.6@sha256:7a3c9af59f8d74d5a23750bbc845c7de64610dbd4d4f84011e10be037b3ce2a0
diff --git a/packages/system/kamaji/values.yaml b/packages/system/kamaji/values.yaml
index cbf71457..334a5e92 100644
--- a/packages/system/kamaji/values.yaml
+++ b/packages/system/kamaji/values.yaml
@@ -3,7 +3,7 @@ kamaji:
     deploy: false
   image:
     pullPolicy: IfNotPresent
-    tag: v1.0.0-beta.5@sha256:05f8e166dc94aadb74cd6448f6f96fbd2167057a559097516a41b8f53e434918
+    tag: v1.0.0-beta.6@sha256:05f8e166dc94aadb74cd6448f6f96fbd2167057a559097516a41b8f53e434918
     repository: ghcr.io/cozystack/cozystack/kamaji
   resources:
     limits:
@@ -13,4 +13,4 @@ kamaji:
       cpu: 100m
       memory: 100Mi
   extraArgs:
-    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.0.0-beta.5@sha256:05f8e166dc94aadb74cd6448f6f96fbd2167057a559097516a41b8f53e434918
+    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.0.0-beta.6@sha256:05f8e166dc94aadb74cd6448f6f96fbd2167057a559097516a41b8f53e434918
diff --git a/packages/system/kubeovn-plunger/values.yaml b/packages/system/kubeovn-plunger/values.yaml
index 0abcc7db..c8357c90 100644
--- a/packages/system/kubeovn-plunger/values.yaml
+++ b/packages/system/kubeovn-plunger/values.yaml
@@ -1,4 +1,4 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.0.0-beta.5@sha256:67d615f86c3230e8c643b6bd347093cdb1e575c99f7c63599fd43e0c4ffc249a
+image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.0.0-beta.6@sha256:8e964605efe54e73a94c84abec7dbb5a011c02ccece282bef8ae7b70fce3d217
 ovnCentralName: ovn-central
diff --git a/packages/system/kubeovn-webhook/values.yaml b/packages/system/kubeovn-webhook/values.yaml
index 26613989..b602e6df 100644
--- a/packages/system/kubeovn-webhook/values.yaml
+++ b/packages/system/kubeovn-webhook/values.yaml
@@ -1,3 +1,3 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.0.0-beta.5@sha256:e6334c29d3aaf0dea766c88e3e05b53ad623d1bb497b3c836e6f76adade45b29
+image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.0.0-beta.6@sha256:e18f9fd679e38f65362a8d0042f25468272f6d081136ad47027168d8e7e07a4a
diff --git a/packages/system/kubevirt-csi-node/values.yaml b/packages/system/kubevirt-csi-node/values.yaml
index 521683be..ab26cc5a 100644
--- a/packages/system/kubevirt-csi-node/values.yaml
+++ b/packages/system/kubevirt-csi-node/values.yaml
@@ -1,3 +1,3 @@
 storageClass: replicated
 csiDriver:
-  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:1997d623bb60a5b540027a4e0716e7ca84f668ee09f31290e9c43324f0003137
+  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:604561e23df1b8eb25c24cf73fd93c7aaa6d1e7c56affbbda5c6f0f83424e4b1
diff --git a/packages/system/lineage-controller-webhook/values.yaml b/packages/system/lineage-controller-webhook/values.yaml
index d5f28f89..2a9b2941 100644
--- a/packages/system/lineage-controller-webhook/values.yaml
+++ b/packages/system/lineage-controller-webhook/values.yaml
@@ -1,5 +1,5 @@
 lineageControllerWebhook:
-  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.0.0-beta.5@sha256:9dd5411d222fe7d7b0583a8e6807bf7745eb1412bf180827c5f1957e6ebbfeb4
+  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.0.0-beta.6@sha256:cf577e56ebc2b94205741d9c5b08f2983cec0811f0c2890edca8fdca22624de1
   debug: false
   localK8sAPIEndpoint:
     enabled: true
diff --git a/packages/system/objectstorage-controller/values.yaml b/packages/system/objectstorage-controller/values.yaml
index b3c9d4c6..a270a7e8 100644
--- a/packages/system/objectstorage-controller/values.yaml
+++ b/packages/system/objectstorage-controller/values.yaml
@@ -1,3 +1,3 @@
 objectstorage:
   controller:
-    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.0.0-beta.5@sha256:b4c972769afda76c48b58e7acf0ac66a0abf16a622f245c60338f432872f640a"
+    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.0.0-beta.6@sha256:b4c972769afda76c48b58e7acf0ac66a0abf16a622f245c60338f432872f640a"
diff --git a/packages/system/seaweedfs/values.yaml b/packages/system/seaweedfs/values.yaml
index 94aba339..e62cd357 100644
--- a/packages/system/seaweedfs/values.yaml
+++ b/packages/system/seaweedfs/values.yaml
@@ -177,7 +177,7 @@ seaweedfs:
     bucketClassName: "seaweedfs"
     region: ""
     sidecar:
-      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-beta.5@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0"
+      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-beta.6@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0"
   certificates:
     commonName: "SeaweedFS CA"
     ipAddresses: []

From 96467cdefd223a3ed140916ebfbfaa4f690c0c33 Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Tue, 17 Feb 2026 22:44:01 +0000
Subject: [PATCH 104/666] docs: add changelog for v1.0.0-beta.6

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.0.0-beta.6.md | 46 ++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 docs/changelogs/v1.0.0-beta.6.md

diff --git a/docs/changelogs/v1.0.0-beta.6.md b/docs/changelogs/v1.0.0-beta.6.md
new file mode 100644
index 00000000..99e565d7
--- /dev/null
+++ b/docs/changelogs/v1.0.0-beta.6.md
@@ -0,0 +1,46 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.0.0-beta.6
+-->
+
+> **⚠️ Beta Release Warning**: This is a pre-release version intended for testing and early adoption. Breaking changes may occur before the stable v1.0.0 release.
+
+## Features and Improvements
+
+* **[platform] Add cilium-kilo networking variant**: Added a new `cilium-kilo` networking variant that combines Cilium CNI with Kilo WireGuard mesh overlay. This variant enables `enable-ipip-termination` in Cilium for proper IPIP packet handling and deploys Kilo with `--compatibility=cilium` flag. Users can now select `cilium-kilo` as their networking variant during platform setup, simplifying the multi-location WireGuard setup compared to manually combining Cilium and standalone Kilo ([**@kvaps**](https://github.com/kvaps) in #2064).
+
+* **[nats] Add monitoring**: Added Grafana dashboards for NATS JetStream and server metrics monitoring, along with Prometheus monitoring support with TLS-aware endpoint configuration. Includes updated image customization options (digest and full image name) and component version upgrades for the NATS exporter and utilities. Users now have full observability into NATS message broker performance and health ([**@klinch0**](https://github.com/klinch0) in #1381).
+
+* **[platform] Add DNS-1035 validation for Application names**: Added dynamic DNS-1035 label validation for Application names in the Cozystack API, using `IsDNS1035Label` from `k8s.io/apimachinery`. Validation is performed at creation time and accounts for the root host length to prevent names that would exceed Kubernetes resource naming limits. This prevents creation of resources with invalid names that would fail downstream Kubernetes resource creation ([**@lexfrei**](https://github.com/lexfrei) in #1771).
+
+* **[operator] Add automatic CRD installation at startup**: Added `--install-crds` flag to the Cozystack operator that installs embedded CRD manifests at startup, ensuring CRDs exist before the operator begins reconciliation. CRD manifests are now embedded in the operator binary and verified for consistency with the Helm `crds/` directory via a new CI Makefile check. This eliminates ordering issues during initial cluster setup where CRDs might not yet be present ([**@lexfrei**](https://github.com/lexfrei) in #2060).
+
+## Fixes
+
+* **[platform] Adopt tenant-root into cozystack-basics during migration**: Added migration 31 to adopt existing `tenant-root` Namespace and HelmRelease into the `cozystack-basics` Helm release when upgrading from v0.41.x to v1.0. Previously these resources were applied via `kubectl apply` with no Helm release tracking, causing Helm to treat them as foreign resources and potentially delete them during reconciliation. This migration ensures a safe upgrade path by annotating and labeling these resources for Helm adoption ([**@kvaps**](https://github.com/kvaps) in #2065).
+
+* **[platform] Preserve tenant-root HelmRelease during migration**: Fixed a data-loss risk during migration from v0.41.x to v1.0.0-beta where the `tenant-root` HelmRelease (and the namespace it manages) could be deleted, causing tenant service outages. Added safety annotation to the HelmRelease and lookup logic to preserve current parameters during migration, preventing unwanted deletion of tenant-root resources ([**@sircthulhu**](https://github.com/sircthulhu) in #2063).
+
+* **[codegen] Add gen_client to update-codegen.sh and regenerate applyconfiguration**: Fixed a build error in `pkg/generated/applyconfiguration/utils.go` caused by a reference to `testing.TypeConverter` which was removed in client-go v0.34.1. The root cause was that `hack/update-codegen.sh` never called `gen_client`, leaving the generated applyconfiguration code stale. Running the full code generation now produces a consistent and compilable codebase ([**@lexfrei**](https://github.com/lexfrei) in #2061).
+
+* **[e2e] Make kubernetes test retries effective by cleaning up stale resources**: Fixed E2E test retries for the Kubernetes tenant test by adding pre-creation cleanup of backend deployment/service and NFS pod/PVC in `run-kubernetes.sh`. Previously, retries would fail immediately because stale resources from a failed attempt blocked re-creation. Also increased the tenant deployment wait timeout from 90s to 300s to handle CI resource pressure ([**@lexfrei**](https://github.com/lexfrei) in #2062).
+
+## Development, Testing, and CI/CD
+
+* **[e2e] Use helm install instead of kubectl apply for cozystack installation**: Replaced the pre-rendered static YAML application flow (`kubectl apply`) with direct `helm upgrade --install` of the `packages/core/installer` chart in E2E tests. Removed the CRD/operator artifact upload/download steps from the CI workflow, simplifying the pipeline. The chart with correct values is already present in the sandbox via workspace copy and `pr.patch` ([**@lexfrei**](https://github.com/lexfrei) in #2060).
+
+## Documentation
+
+* **[website] Improve Azure autoscaling troubleshooting guide**: Enhanced the Azure autoscaling troubleshooting documentation with serial console instructions for debugging VMSS worker nodes, a troubleshooting section for nodes stuck in maintenance mode due to invalid or missing machine config, `az vmss update --custom-data` instructions for updating machine config, and a warning that Azure does not support reading back `customData` ([**@kvaps**](https://github.com/kvaps) in cozystack/website#424).
+
+* **[website] Update multi-location documentation for cilium-kilo variant**: Updated multi-location networking documentation to reflect the new integrated `cilium-kilo` variant selection during platform setup, replacing the previous manual Kilo installation and Cilium configuration steps. Added explanation of `enable-ipip-termination` and updated the troubleshooting section ([**@kvaps**](https://github.com/kvaps) in cozystack/website@02d63f0).
+
+## Contributors
+
+We'd like to thank all contributors who made this release possible:
+
+* [**@klinch0**](https://github.com/klinch0)
+* [**@kvaps**](https://github.com/kvaps)
+* [**@lexfrei**](https://github.com/lexfrei)
+* [**@sircthulhu**](https://github.com/sircthulhu)
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.0-beta.5...v1.0.0-beta.6

From 87d03902563171e49d7ad94cb1078b612a892db6 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 18 Feb 2026 02:07:38 +0300
Subject: [PATCH 105/666] fix(harbor): include tenant domain in default
 hostname and add E2E cleanup

Use tenant base domain in default hostname construction (harbor.RELEASE.DOMAIN)
to match the pattern used by other apps (kubernetes, vpn). Remove unused $ingress
variable from harbor.yaml. Add cleanup of stale resources from previous failed
E2E runs.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/harbor.bats                   | 5 +++++
 packages/apps/harbor/templates/harbor.yaml  | 3 +--
 packages/apps/harbor/templates/ingress.yaml | 2 +-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/hack/e2e-apps/harbor.bats b/hack/e2e-apps/harbor.bats
index 09215546..26f407ea 100644
--- a/hack/e2e-apps/harbor.bats
+++ b/hack/e2e-apps/harbor.bats
@@ -3,6 +3,11 @@
 @test "Create Harbor" {
   name='test'
   release="harbor-$name"
+
+  # Clean up stale resources from previous failed runs
+  kubectl -n tenant-test delete harbor.apps.cozystack.io $name 2>/dev/null || true
+  kubectl -n tenant-test wait hr $release --timeout=60s --for=delete 2>/dev/null || true
+
   kubectl apply -f- <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: Harbor
diff --git a/packages/apps/harbor/templates/harbor.yaml b/packages/apps/harbor/templates/harbor.yaml
index 3ba09bfb..c3fab16a 100644
--- a/packages/apps/harbor/templates/harbor.yaml
+++ b/packages/apps/harbor/templates/harbor.yaml
@@ -1,6 +1,5 @@
-{{- $ingress := .Values._namespace.ingress }}
 {{- $host := .Values._namespace.host }}
-{{- $harborHost := .Values.host | default (printf "harbor.%s" .Release.Name) }}
+{{- $harborHost := .Values.host | default (printf "harbor.%s.%s" .Release.Name $host) }}
 
 {{- $existingSecret := lookup "v1" "Secret" .Release.Namespace (printf "%s-credentials" .Release.Name) }}
 {{- $adminPassword := randAlphaNum 16 }}
diff --git a/packages/apps/harbor/templates/ingress.yaml b/packages/apps/harbor/templates/ingress.yaml
index 3f2b8f78..07d73b8e 100644
--- a/packages/apps/harbor/templates/ingress.yaml
+++ b/packages/apps/harbor/templates/ingress.yaml
@@ -1,6 +1,6 @@
 {{- $ingress := .Values._namespace.ingress }}
 {{- $host := .Values._namespace.host }}
-{{- $harborHost := .Values.host | default (printf "harbor.%s" .Release.Name) }}
+{{- $harborHost := .Values.host | default (printf "harbor.%s.%s" .Release.Name $host) }}
 {{- $issuerType := (index .Values._cluster "clusterissuer") | default "http01" }}
 ---
 apiVersion: networking.k8s.io/v1

From 78f8ee2deb184664a92316d414d369fedfbf0966 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 18 Feb 2026 02:12:11 +0300
Subject: [PATCH 106/666] fix(harbor): enable database TLS and fix token
 key/cert check

Change sslmode from disable to require for CNPG PostgreSQL connection,
as CNPG supports TLS out of the box. Fix token key/cert preservation to
verify both values are present before passing to Harbor core.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/apps/harbor/templates/harbor.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/apps/harbor/templates/harbor.yaml b/packages/apps/harbor/templates/harbor.yaml
index c3fab16a..94154ec9 100644
--- a/packages/apps/harbor/templates/harbor.yaml
+++ b/packages/apps/harbor/templates/harbor.yaml
@@ -112,7 +112,7 @@ spec:
       portal:
         resources: {{- include "cozy-lib.resources.defaultingSanitize" (list "nano" (dict) $) | nindent 10 }}
       core:
-        {{- if $tokenKey }}
+        {{- if and $tokenKey $tokenCert }}
         tokenKey: {{ $tokenKey | quote }}
         tokenCert: {{ $tokenCert | quote }}
         {{- end }}
@@ -136,7 +136,7 @@ spec:
           port: "5432"
           username: app
           coreDatabase: app
-          sslmode: disable
+          sslmode: require
           existingSecret: "{{ .Release.Name }}-db-app"
       redis:
         type: external

From 0198c9896a10675bddc06277c9510527a700549c Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 18 Feb 2026 02:17:59 +0300
Subject: [PATCH 107/666] fix(harbor): use standard hostname pattern without
 double prefix

Follow the same hostname pattern as kubernetes and vpn apps: use
Release.Name directly (which already includes the harbor- prefix)
instead of adding an extra harbor. subdomain.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/apps/harbor/templates/harbor.yaml  | 2 +-
 packages/apps/harbor/templates/ingress.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/apps/harbor/templates/harbor.yaml b/packages/apps/harbor/templates/harbor.yaml
index 94154ec9..ff8e88ad 100644
--- a/packages/apps/harbor/templates/harbor.yaml
+++ b/packages/apps/harbor/templates/harbor.yaml
@@ -1,5 +1,5 @@
 {{- $host := .Values._namespace.host }}
-{{- $harborHost := .Values.host | default (printf "harbor.%s.%s" .Release.Name $host) }}
+{{- $harborHost := .Values.host | default (printf "%s.%s" .Release.Name $host) }}
 
 {{- $existingSecret := lookup "v1" "Secret" .Release.Namespace (printf "%s-credentials" .Release.Name) }}
 {{- $adminPassword := randAlphaNum 16 }}
diff --git a/packages/apps/harbor/templates/ingress.yaml b/packages/apps/harbor/templates/ingress.yaml
index 07d73b8e..28691654 100644
--- a/packages/apps/harbor/templates/ingress.yaml
+++ b/packages/apps/harbor/templates/ingress.yaml
@@ -1,6 +1,6 @@
 {{- $ingress := .Values._namespace.ingress }}
 {{- $host := .Values._namespace.host }}
-{{- $harborHost := .Values.host | default (printf "harbor.%s.%s" .Release.Name $host) }}
+{{- $harborHost := .Values.host | default (printf "%s.%s" .Release.Name $host) }}
 {{- $issuerType := (index .Values._cluster "clusterissuer") | default "http01" }}
 ---
 apiVersion: networking.k8s.io/v1

From daf1b71e7c97b2910453245c159d7f774efeef9c Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 18 Feb 2026 02:23:00 +0300
Subject: [PATCH 108/666] fix(harbor): add explicit CNPG bootstrap
 configuration

Specify initdb bootstrap with database and owner names explicitly
instead of relying on CNPG defaults which may change between versions.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/harbor/templates/database.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/packages/system/harbor/templates/database.yaml b/packages/system/harbor/templates/database.yaml
index 5d1827aa..68f047f8 100644
--- a/packages/system/harbor/templates/database.yaml
+++ b/packages/system/harbor/templates/database.yaml
@@ -10,6 +10,10 @@ spec:
     {{- with .Values.db.storageClass }}
     storageClass: {{ . }}
     {{- end }}
+  bootstrap:
+    initdb:
+      database: app
+      owner: app
   monitoring:
     enablePodMonitor: true
   resources:

From 199ffe319a1740d52c929f48991d8ec5b8d8cd60 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 18 Feb 2026 11:26:58 +0300
Subject: [PATCH 109/666] fix(harbor): set UTF-8 encoding and locale for CNPG
 database

Add encoding, localeCollate, and localeCType to initdb bootstrap
configuration to ensure fulltext search (ilike) works correctly.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/harbor/templates/database.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/packages/system/harbor/templates/database.yaml b/packages/system/harbor/templates/database.yaml
index 68f047f8..b1221e1c 100644
--- a/packages/system/harbor/templates/database.yaml
+++ b/packages/system/harbor/templates/database.yaml
@@ -14,6 +14,9 @@ spec:
     initdb:
       database: app
       owner: app
+      encoding: UTF8
+      localeCollate: en_US.UTF-8
+      localeCType: en_US.UTF-8
   monitoring:
     enablePodMonitor: true
   resources:

From b5b2f95c3e6cf36dbb6b50e83e386c4c59ed785a Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Wed, 18 Feb 2026 15:45:14 +0500
Subject: [PATCH 110/666] [cozystack-basics] Preserve existing HelmRelease
 values during reconciliations

Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .../system/cozystack-basics/templates/tenant-root.yaml     | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/packages/system/cozystack-basics/templates/tenant-root.yaml b/packages/system/cozystack-basics/templates/tenant-root.yaml
index 95af9d7f..93f5129e 100644
--- a/packages/system/cozystack-basics/templates/tenant-root.yaml
+++ b/packages/system/cozystack-basics/templates/tenant-root.yaml
@@ -23,7 +23,6 @@ spec:
     namespace: cozy-system
   interval: 1m0s
   timeout: 5m0s
-  values:
-    _cluster:
-      oidc-enabled: {{ .Values.oidcEnabled | quote }}
-      root-host: {{ .Values.rootHost | quote }}
+  valuesFrom:
+    - kind: Secret
+      name: cozystack-values

From db1425a8deef2ec3096a1a82759a81563f432a41 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Thu, 19 Feb 2026 14:33:20 +0500
Subject: [PATCH 111/666] feat(dashboard): add API-backed dropdown for
 VMInstance instanceType

Override spec.instanceType field with listInput type in schema so the
dashboard renders it as a select dropdown populated from
VirtualMachineClusterInstancetype resources. Default value is read
dynamically from the ApplicationDefinition's OpenAPI schema.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .../dashboard/customformsoverride.go          |  71 +++++++-
 .../dashboard/customformsoverride_test.go     | 164 ++++++++++++++++++
 2 files changed, 234 insertions(+), 1 deletion(-)

diff --git a/internal/controller/dashboard/customformsoverride.go b/internal/controller/dashboard/customformsoverride.go
index dfbccf5c..26afab50 100644
--- a/internal/controller/dashboard/customformsoverride.go
+++ b/internal/controller/dashboard/customformsoverride.go
@@ -46,8 +46,11 @@ func (m *Manager) ensureCustomFormsOverride(ctx context.Context, crd *cozyv1alph
 		}
 	}
 
-	// Build schema with multilineString for string fields without enum
+	// Parse OpenAPI schema once for reuse
 	l := log.FromContext(ctx)
+	openAPIProps := parseOpenAPIProperties(crd.Spec.Application.OpenAPISchema)
+
+	// Build schema with multilineString for string fields without enum
 	schema, err := buildMultilineStringSchema(crd.Spec.Application.OpenAPISchema)
 	if err != nil {
 		// If schema parsing fails, log the error and use an empty schema
@@ -55,6 +58,9 @@ func (m *Manager) ensureCustomFormsOverride(ctx context.Context, crd *cozyv1alph
 		schema = map[string]any{}
 	}
 
+	// Override specific fields with API-backed dropdowns (listInput type)
+	applyListInputOverrides(schema, kind, openAPIProps)
+
 	spec := map[string]any{
 		"customizationId": customizationID,
 		"hidden":          hidden,
@@ -176,6 +182,69 @@ func buildMultilineStringSchema(openAPISchema string) (map[string]any, error) {
 	return schema, nil
 }
 
+// applyListInputOverrides injects listInput type overrides into the schema
+// for fields that should be rendered as API-backed dropdowns in the dashboard.
+// openAPIProps are the parsed top-level properties from the OpenAPI schema.
+func applyListInputOverrides(schema map[string]any, kind string, openAPIProps map[string]any) {
+	switch kind {
+	case "VMInstance":
+		specProps := ensureSchemaPath(schema, "spec")
+		field := map[string]any{
+			"type": "listInput",
+			"customProps": map[string]any{
+				"valueUri":    "/api/clusters/{cluster}/k8s/apis/instancetype.kubevirt.io/v1beta1/virtualmachineclusterinstancetypes",
+				"keysToValue": []any{"metadata", "name"},
+				"keysToLabel": []any{"metadata", "name"},
+			},
+		}
+		if prop, _ := openAPIProps["instanceType"].(map[string]any); prop != nil {
+			if def := prop["default"]; def != nil {
+				field["default"] = def
+			}
+		}
+		specProps["instanceType"] = field
+	}
+}
+
+// parseOpenAPIProperties parses the top-level properties from an OpenAPI schema JSON string.
+func parseOpenAPIProperties(openAPISchema string) map[string]any {
+	if openAPISchema == "" {
+		return nil
+	}
+	var root map[string]any
+	if err := json.Unmarshal([]byte(openAPISchema), &root); err != nil {
+		return nil
+	}
+	props, _ := root["properties"].(map[string]any)
+	return props
+}
+
+// ensureSchemaPath ensures the nested properties structure exists in a schema
+// and returns the innermost properties map.
+// e.g. ensureSchemaPath(schema, "spec") returns schema["properties"]["spec"]["properties"]
+func ensureSchemaPath(schema map[string]any, segments ...string) map[string]any {
+	current := schema
+	for _, seg := range segments {
+		props, ok := current["properties"].(map[string]any)
+		if !ok {
+			props = map[string]any{}
+			current["properties"] = props
+		}
+		child, ok := props[seg].(map[string]any)
+		if !ok {
+			child = map[string]any{}
+			props[seg] = child
+		}
+		current = child
+	}
+	props, ok := current["properties"].(map[string]any)
+	if !ok {
+		props = map[string]any{}
+		current["properties"] = props
+	}
+	return props
+}
+
 // processSpecProperties recursively processes spec properties and adds multilineString type
 // for string fields without enum
 func processSpecProperties(props map[string]any, schemaProps map[string]any) {
diff --git a/internal/controller/dashboard/customformsoverride_test.go b/internal/controller/dashboard/customformsoverride_test.go
index 9f7babe9..3df24724 100644
--- a/internal/controller/dashboard/customformsoverride_test.go
+++ b/internal/controller/dashboard/customformsoverride_test.go
@@ -169,3 +169,167 @@ func TestBuildMultilineStringSchemaInvalidJSON(t *testing.T) {
 		t.Errorf("Expected nil schema for invalid JSON, got %v", schema)
 	}
 }
+
+func TestApplyListInputOverrides_VMInstance(t *testing.T) {
+	openAPIProps := map[string]any{
+		"instanceType": map[string]any{"type": "string", "default": "u1.medium"},
+	}
+
+	schema := map[string]any{}
+	applyListInputOverrides(schema, "VMInstance", openAPIProps)
+
+	specProps := schema["properties"].(map[string]any)["spec"].(map[string]any)["properties"].(map[string]any)
+	instanceType, ok := specProps["instanceType"].(map[string]any)
+	if !ok {
+		t.Fatal("instanceType not found in schema.properties.spec.properties")
+	}
+
+	if instanceType["type"] != "listInput" {
+		t.Errorf("expected type listInput, got %v", instanceType["type"])
+	}
+
+	if instanceType["default"] != "u1.medium" {
+		t.Errorf("expected default u1.medium, got %v", instanceType["default"])
+	}
+
+	customProps, ok := instanceType["customProps"].(map[string]any)
+	if !ok {
+		t.Fatal("customProps not found")
+	}
+
+	expectedURI := "/api/clusters/{cluster}/k8s/apis/instancetype.kubevirt.io/v1beta1/virtualmachineclusterinstancetypes"
+	if customProps["valueUri"] != expectedURI {
+		t.Errorf("expected valueUri %s, got %v", expectedURI, customProps["valueUri"])
+	}
+}
+
+func TestApplyListInputOverrides_UnknownKind(t *testing.T) {
+	schema := map[string]any{}
+	applyListInputOverrides(schema, "SomeOtherKind", map[string]any{})
+
+	if len(schema) != 0 {
+		t.Errorf("expected empty schema for unknown kind, got %v", schema)
+	}
+}
+
+func TestApplyListInputOverrides_NoDefault(t *testing.T) {
+	openAPIProps := map[string]any{
+		"instanceType": map[string]any{"type": "string"},
+	}
+
+	schema := map[string]any{}
+	applyListInputOverrides(schema, "VMInstance", openAPIProps)
+
+	specProps := schema["properties"].(map[string]any)["spec"].(map[string]any)["properties"].(map[string]any)
+	instanceType := specProps["instanceType"].(map[string]any)
+
+	if _, exists := instanceType["default"]; exists {
+		t.Errorf("expected no default key, got %v", instanceType["default"])
+	}
+}
+
+func TestApplyListInputOverrides_MergesWithExistingSchema(t *testing.T) {
+	openAPIProps := map[string]any{
+		"instanceType": map[string]any{"type": "string", "default": "u1.medium"},
+	}
+
+	// Simulate schema that already has spec.properties from buildMultilineStringSchema
+	schema := map[string]any{
+		"properties": map[string]any{
+			"spec": map[string]any{
+				"properties": map[string]any{
+					"otherField": map[string]any{"type": "multilineString"},
+				},
+			},
+		},
+	}
+	applyListInputOverrides(schema, "VMInstance", openAPIProps)
+
+	specProps := schema["properties"].(map[string]any)["spec"].(map[string]any)["properties"].(map[string]any)
+
+	// instanceType should be added
+	if _, ok := specProps["instanceType"].(map[string]any); !ok {
+		t.Fatal("instanceType not found after override")
+	}
+
+	// otherField should be preserved
+	otherField, ok := specProps["otherField"].(map[string]any)
+	if !ok {
+		t.Fatal("otherField was lost after override")
+	}
+	if otherField["type"] != "multilineString" {
+		t.Errorf("otherField type changed, got %v", otherField["type"])
+	}
+}
+
+func TestParseOpenAPIProperties(t *testing.T) {
+	t.Run("extracts properties", func(t *testing.T) {
+		props := parseOpenAPIProperties(`{"type":"object","properties":{"instanceType":{"type":"string","default":"u1.medium"}}}`)
+		field, _ := props["instanceType"].(map[string]any)
+		if field["default"] != "u1.medium" {
+			t.Errorf("expected default u1.medium, got %v", field["default"])
+		}
+	})
+
+	t.Run("empty string", func(t *testing.T) {
+		if props := parseOpenAPIProperties(""); props != nil {
+			t.Errorf("expected nil, got %v", props)
+		}
+	})
+
+	t.Run("invalid JSON", func(t *testing.T) {
+		if props := parseOpenAPIProperties("{bad"); props != nil {
+			t.Errorf("expected nil, got %v", props)
+		}
+	})
+
+	t.Run("no properties key", func(t *testing.T) {
+		if props := parseOpenAPIProperties(`{"type":"object"}`); props != nil {
+			t.Errorf("expected nil, got %v", props)
+		}
+	})
+}
+
+func TestEnsureSchemaPath(t *testing.T) {
+	t.Run("creates path from empty schema", func(t *testing.T) {
+		schema := map[string]any{}
+		props := ensureSchemaPath(schema, "spec")
+
+		props["field"] = "value"
+
+		// Verify structure: schema.properties.spec.properties.field
+		got := schema["properties"].(map[string]any)["spec"].(map[string]any)["properties"].(map[string]any)["field"]
+		if got != "value" {
+			t.Errorf("expected value, got %v", got)
+		}
+	})
+
+	t.Run("preserves existing nested properties", func(t *testing.T) {
+		schema := map[string]any{
+			"properties": map[string]any{
+				"spec": map[string]any{
+					"properties": map[string]any{
+						"existing": "keep",
+					},
+				},
+			},
+		}
+		props := ensureSchemaPath(schema, "spec")
+
+		if props["existing"] != "keep" {
+			t.Errorf("existing property lost, got %v", props["existing"])
+		}
+	})
+
+	t.Run("multi-level path", func(t *testing.T) {
+		schema := map[string]any{}
+		props := ensureSchemaPath(schema, "spec", "nested")
+
+		props["deep"] = true
+
+		got := schema["properties"].(map[string]any)["spec"].(map[string]any)["properties"].(map[string]any)["nested"].(map[string]any)["properties"].(map[string]any)["deep"]
+		if got != true {
+			t.Errorf("expected true, got %v", got)
+		}
+	})
+}

From 4387a3e95f7304bf9c1952d21d4181bb314ecb67 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Thu, 19 Feb 2026 15:58:18 +0500
Subject: [PATCH 112/666] fix(dashboard): patch FormListInput to fix value
 binding

The Flex wrapper between ResetedFormItem and Select prevented Ant
Design's Form.Item from injecting value/onChange into the Select,
causing the dropdown to appear empty even when the form store had a
value. Move Flex outside ResetedFormItem so Select is its direct child.

Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .../patches/formlistinput-value-binding.diff  | 49 +++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/formlistinput-value-binding.diff

diff --git a/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/formlistinput-value-binding.diff b/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/formlistinput-value-binding.diff
new file mode 100644
index 00000000..0da12c00
--- /dev/null
+++ b/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/formlistinput-value-binding.diff
@@ -0,0 +1,49 @@
+diff --git a/src/components/molecules/BlackholeForm/molecules/FormListInput/FormListInput.tsx b/src/components/molecules/BlackholeForm/molecules/FormListInput/FormListInput.tsx
+index d5e5230..9038dbb 100644
+--- a/src/components/molecules/BlackholeForm/molecules/FormListInput/FormListInput.tsx
++++ b/src/components/molecules/BlackholeForm/molecules/FormListInput/FormListInput.tsx
+@@ -259,14 +259,15 @@ export const FormListInput: FC<TFormListInputProps> = ({
+           <PersistedCheckbox formName={persistName || name} persistedControls={persistedControls} type="arr" />
+         </Flex>
+       </Flex>
+-      <ResetedFormItem
+-        key={arrKey !== undefined ? arrKey : Array.isArray(name) ? name.slice(-1)[0] : name}
+-        name={arrName || fixedName}
+-        rules={[getRequiredRule(forceNonRequired === false && !!required?.includes(getStringByName(name)), name)]}
+-        validateTrigger="onBlur"
+-        hasFeedback={designNewLayout ? { icons: feedbackIcons } : true}
+-      >
+-        <Flex gap={8} align="center">
++      <Flex gap={8} align="center">
++        <ResetedFormItem
++          key={arrKey !== undefined ? arrKey : Array.isArray(name) ? name.slice(-1)[0] : name}
++          name={arrName || fixedName}
++          rules={[getRequiredRule(forceNonRequired === false && !!required?.includes(getStringByName(name)), name)]}
++          validateTrigger="onBlur"
++          hasFeedback={designNewLayout ? { icons: feedbackIcons } : true}
++          style={{ flex: 1 }}
++        >
+           <Select
+             mode={customProps.mode}
+             placeholder="Select"
+@@ -277,13 +278,13 @@ export const FormListInput: FC<TFormListInputProps> = ({
+             showSearch
+             style={{ width: '100%' }}
+           />
+-          {relatedValueTooltip && (
+-            <Tooltip title={relatedValueTooltip}>
+-              <QuestionCircleOutlined />
+-            </Tooltip>
+-          )}
+-        </Flex>
+-      </ResetedFormItem>
++        </ResetedFormItem>
++        {relatedValueTooltip && (
++          <Tooltip title={relatedValueTooltip}>
++            <QuestionCircleOutlined />
++          </Tooltip>
++        )}
++      </Flex>
+     </HiddenContainer>
+   )
+ }

From 989686624cc2634cd0417f709f2e9203b5641aec Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Thu, 19 Feb 2026 16:10:51 +0500
Subject: [PATCH 113/666] feat(dashboard): add VMDisk dropdown for VMInstance

Add API-backed listInput dropdown for disks[].name in VMInstance form,
listing available VMDisk resources from the same namespace.

Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .../dashboard/customformsoverride.go          | 32 ++++++++++
 .../dashboard/customformsoverride_test.go     | 64 +++++++++++++++++++
 2 files changed, 96 insertions(+)

diff --git a/internal/controller/dashboard/customformsoverride.go b/internal/controller/dashboard/customformsoverride.go
index 26afab50..67b131cf 100644
--- a/internal/controller/dashboard/customformsoverride.go
+++ b/internal/controller/dashboard/customformsoverride.go
@@ -203,9 +203,41 @@ func applyListInputOverrides(schema map[string]any, kind string, openAPIProps ma
 			}
 		}
 		specProps["instanceType"] = field
+
+		// Override disks[].name to be an API-backed dropdown listing VMDisk resources
+		disksItemProps := ensureArrayItemProps(specProps, "disks")
+		disksItemProps["name"] = map[string]any{
+			"type": "listInput",
+			"customProps": map[string]any{
+				"valueUri":    "/api/clusters/{cluster}/k8s/apis/apps.cozystack.io/v1alpha1/namespaces/{namespace}/vmdisks",
+				"keysToValue": []any{"metadata", "name"},
+				"keysToLabel": []any{"metadata", "name"},
+			},
+		}
 	}
 }
 
+// ensureArrayItemProps ensures that parentProps[fieldName].items.properties exists
+// and returns the items properties map. Used for overriding fields inside array items.
+func ensureArrayItemProps(parentProps map[string]any, fieldName string) map[string]any {
+	field, ok := parentProps[fieldName].(map[string]any)
+	if !ok {
+		field = map[string]any{}
+		parentProps[fieldName] = field
+	}
+	items, ok := field["items"].(map[string]any)
+	if !ok {
+		items = map[string]any{}
+		field["items"] = items
+	}
+	props, ok := items["properties"].(map[string]any)
+	if !ok {
+		props = map[string]any{}
+		items["properties"] = props
+	}
+	return props
+}
+
 // parseOpenAPIProperties parses the top-level properties from an OpenAPI schema JSON string.
 func parseOpenAPIProperties(openAPISchema string) map[string]any {
 	if openAPISchema == "" {
diff --git a/internal/controller/dashboard/customformsoverride_test.go b/internal/controller/dashboard/customformsoverride_test.go
index 3df24724..37da1244 100644
--- a/internal/controller/dashboard/customformsoverride_test.go
+++ b/internal/controller/dashboard/customformsoverride_test.go
@@ -201,6 +201,35 @@ func TestApplyListInputOverrides_VMInstance(t *testing.T) {
 	if customProps["valueUri"] != expectedURI {
 		t.Errorf("expected valueUri %s, got %v", expectedURI, customProps["valueUri"])
 	}
+
+	// Check disks[].name is a listInput
+	disks, ok := specProps["disks"].(map[string]any)
+	if !ok {
+		t.Fatal("disks not found in schema.properties.spec.properties")
+	}
+	items, ok := disks["items"].(map[string]any)
+	if !ok {
+		t.Fatal("disks.items not found")
+	}
+	itemProps, ok := items["properties"].(map[string]any)
+	if !ok {
+		t.Fatal("disks.items.properties not found")
+	}
+	diskName, ok := itemProps["name"].(map[string]any)
+	if !ok {
+		t.Fatal("disks.items.properties.name not found")
+	}
+	if diskName["type"] != "listInput" {
+		t.Errorf("expected disks name type listInput, got %v", diskName["type"])
+	}
+	diskCustomProps, ok := diskName["customProps"].(map[string]any)
+	if !ok {
+		t.Fatal("disks name customProps not found")
+	}
+	expectedDiskURI := "/api/clusters/{cluster}/k8s/apis/apps.cozystack.io/v1alpha1/namespaces/{namespace}/vmdisks"
+	if diskCustomProps["valueUri"] != expectedDiskURI {
+		t.Errorf("expected disks valueUri %s, got %v", expectedDiskURI, diskCustomProps["valueUri"])
+	}
 }
 
 func TestApplyListInputOverrides_UnknownKind(t *testing.T) {
@@ -333,3 +362,38 @@ func TestEnsureSchemaPath(t *testing.T) {
 		}
 	})
 }
+
+func TestEnsureArrayItemProps(t *testing.T) {
+	t.Run("creates from empty parent", func(t *testing.T) {
+		parent := map[string]any{}
+		props := ensureArrayItemProps(parent, "disks")
+
+		props["name"] = map[string]any{"type": "listInput"}
+
+		got := parent["disks"].(map[string]any)["items"].(map[string]any)["properties"].(map[string]any)["name"].(map[string]any)["type"]
+		if got != "listInput" {
+			t.Errorf("expected listInput, got %v", got)
+		}
+	})
+
+	t.Run("preserves existing item properties", func(t *testing.T) {
+		parent := map[string]any{
+			"disks": map[string]any{
+				"items": map[string]any{
+					"properties": map[string]any{
+						"bus": map[string]any{"type": "string"},
+					},
+				},
+			},
+		}
+		props := ensureArrayItemProps(parent, "disks")
+		props["name"] = map[string]any{"type": "listInput"}
+
+		if props["bus"].(map[string]any)["type"] != "string" {
+			t.Error("existing bus property was lost")
+		}
+		if props["name"].(map[string]any)["type"] != "listInput" {
+			t.Error("name property was not added")
+		}
+	})
+}

From 6437abb35d92066d4b1946ec14a7b45f69e727ca Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 19 Feb 2026 13:43:12 +0100
Subject: [PATCH 114/666] fix(linstor): add skip-adjust patch and fix LUKS
 exists flag

Add skip-adjust-when-device-inaccessible.diff patch (upstream PR #477)
which prevents DRBD adjust and res file regeneration when child layer
devices are inaccessible (e.g. during encrypted resource deletion).

This patch also includes a fix for a missing setExists(true) call in
LuksLayer, which caused all new DRBD+LUKS+STORAGE resources to fail
with "not defined in your config" errors because the DRBD .res file
was never written.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../skip-adjust-when-device-inaccessible.diff | 155 ++++++++++++++++++
 1 file changed, 155 insertions(+)
 create mode 100644 packages/system/linstor/images/piraeus-server/patches/skip-adjust-when-device-inaccessible.diff

diff --git a/packages/system/linstor/images/piraeus-server/patches/skip-adjust-when-device-inaccessible.diff b/packages/system/linstor/images/piraeus-server/patches/skip-adjust-when-device-inaccessible.diff
new file mode 100644
index 00000000..a93d7811
--- /dev/null
+++ b/packages/system/linstor/images/piraeus-server/patches/skip-adjust-when-device-inaccessible.diff
@@ -0,0 +1,155 @@
+diff --git a/satellite/src/main/java/com/linbit/linstor/core/devmgr/DeviceHandlerImpl.java b/satellite/src/main/java/com/linbit/linstor/core/devmgr/DeviceHandlerImpl.java
+index 49138a8fd..2f768ca0d 100644
+--- a/satellite/src/main/java/com/linbit/linstor/core/devmgr/DeviceHandlerImpl.java
++++ b/satellite/src/main/java/com/linbit/linstor/core/devmgr/DeviceHandlerImpl.java
+@@ -83,6 +83,8 @@ import java.util.TreeMap;
+ import java.util.TreeSet;
+ import java.util.concurrent.atomic.AtomicBoolean;
+ import java.util.function.Function;
++import java.nio.file.Files;
++import java.nio.file.Paths;
+ 
+ @Singleton
+ public class DeviceHandlerImpl implements DeviceHandler
+@@ -1646,7 +1648,10 @@ public class DeviceHandlerImpl implements DeviceHandler
+     private void updateDiscGran(VlmProviderObject<Resource> vlmData) throws DatabaseException, StorageException
+     {
+         String devicePath = vlmData.getDevicePath();
+-        if (devicePath != null && vlmData.exists())
++        // Check if device path physically exists before calling lsblk
++        // This is important for DRBD devices which might be temporarily unavailable during adjust
++        // (drbdadm adjust brings devices down/up, and kernel might not have created the device node yet)
++        if (devicePath != null && vlmData.exists() && Files.exists(Paths.get(devicePath)))
+         {
+             if (vlmData.getDiscGran() == VlmProviderObject.UNINITIALIZED_SIZE)
+             {
+diff --git a/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java b/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java
+index 01967a31f..78b8195a4 100644
+--- a/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java
++++ b/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java
+@@ -592,7 +592,29 @@ public class DrbdLayer implements DeviceLayer
+             // The .res file might not have been generated in the prepare method since it was
+             // missing information from the child-layers. Now that we have processed them, we
+             // need to make sure the .res file exists in all circumstances.
+-            regenerateResFile(drbdRscData);
++            // However, if the underlying devices are not accessible (e.g., LUKS device is closed
++            // during resource deletion), we skip regenerating the res file to avoid errors
++            boolean canRegenerateResFile = true;
++            if (!skipDisk && !drbdRscData.getAbsResource().isDrbdDiskless(workerCtx))
++            {
++                AbsRscLayerObject<Resource> dataChild = drbdRscData.getChildBySuffix(RscLayerSuffixes.SUFFIX_DATA);
++                if (dataChild != null)
++                {
++                    for (DrbdVlmData<Resource> drbdVlmData : drbdRscData.getVlmLayerObjects().values())
++                    {
++                        VlmProviderObject<Resource> childVlm = dataChild.getVlmProviderObject(drbdVlmData.getVlmNr());
++                        if (childVlm == null || !childVlm.exists() || childVlm.getDevicePath() == null)
++                        {
++                            canRegenerateResFile = false;
++                            break;
++                        }
++                    }
++                }
++            }
++            if (canRegenerateResFile)
++            {
++                regenerateResFile(drbdRscData);
++            }
+ 
+             // createMetaData needs rendered resFile
+             for (DrbdVlmData<Resource> drbdVlmData : createMetaData)
+@@ -766,19 +788,72 @@ public class DrbdLayer implements DeviceLayer
+ 
+                 if (drbdRscData.isAdjustRequired())
+                 {
+-                    try
++                    // Check if underlying devices are accessible before adjusting
++                    // This is important for encrypted resources (LUKS) where the device
++                    // might be closed during deletion
++                    boolean canAdjust = true;
++
++                    // IMPORTANT: Check child volumes only when disk access is actually needed.
++                    // For network reconnect (StandAlone -> Connected), disk access is not required.
++                    boolean needsDiskAccess = false;
++
++                    // Check if there are pending operations that require disk access
++                    for (DrbdVlmData<Resource> drbdVlmData : drbdRscData.getVlmLayerObjects().values())
+                     {
+-                        drbdUtils.adjust(
+-                            drbdRscData,
+-                            false,
+-                            skipDisk,
+-                            false
+-                        );
++                        Volume vlm = (Volume) drbdVlmData.getVolume();
++                        StateFlags<Volume.Flags> vlmFlags = vlm.getFlags();
++
++                        // Disk access is needed if:
++                        // - creating a new volume
++                        // - resizing
++                        // - checking/creating metadata
++                        if (!drbdVlmData.exists() ||
++                            drbdVlmData.checkMetaData() ||
++                            vlmFlags.isSomeSet(workerCtx, Volume.Flags.RESIZE, Volume.Flags.DRBD_RESIZE))
++                        {
++                            needsDiskAccess = true;
++                            break;
++                        }
++                    }
++
++                    // Check child volumes only if disk access is actually needed
++                    if (needsDiskAccess && !skipDisk && !drbdRscData.getAbsResource().isDrbdDiskless(workerCtx))
++                    {
++                        AbsRscLayerObject<Resource> dataChild = drbdRscData.getChildBySuffix(RscLayerSuffixes.SUFFIX_DATA);
++                        if (dataChild != null)
++                        {
++                            for (DrbdVlmData<Resource> drbdVlmData : drbdRscData.getVlmLayerObjects().values())
++                            {
++                                VlmProviderObject<Resource> childVlm = dataChild.getVlmProviderObject(drbdVlmData.getVlmNr());
++                                if (childVlm == null || !childVlm.exists() || childVlm.getDevicePath() == null)
++                                {
++                                    canAdjust = false;
++                                    break;
++                                }
++                            }
++                        }
+                     }
+-                    catch (ExtCmdFailedException extCmdExc)
++
++                    if (canAdjust)
++                    {
++                        try
++                        {
++                            drbdUtils.adjust(
++                                drbdRscData,
++                                false,
++                                skipDisk,
++                                false
++                            );
++                        }
++                        catch (ExtCmdFailedException extCmdExc)
++                        {
++                            restoreBackupResFile(drbdRscData);
++                            throw extCmdExc;
++                        }
++                    }
++                    else
+                     {
+-                        restoreBackupResFile(drbdRscData);
+-                        throw extCmdExc;
++                        drbdRscData.setAdjustRequired(false);
+                     }
+                 }
+ 
+diff --git a/satellite/src/main/java/com/linbit/linstor/layer/luks/LuksLayer.java b/satellite/src/main/java/com/linbit/linstor/layer/luks/LuksLayer.java
+index cdca0b6d2..89c8be9da 100644
+--- a/satellite/src/main/java/com/linbit/linstor/layer/luks/LuksLayer.java
++++ b/satellite/src/main/java/com/linbit/linstor/layer/luks/LuksLayer.java
+@@ -383,6 +383,7 @@ public class LuksLayer implements DeviceLayer
+                 vlmData.setSizeState(Size.AS_EXPECTED);
+ 
+                 vlmData.setOpened(true);
++                vlmData.setExists(true);
+                 vlmData.setFailed(false);
+             }
+         }

From a6e66a021a33bb8b663fb0be0b5e3a2d12ed2c31 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 19 Feb 2026 15:56:58 +0300
Subject: [PATCH 115/666] [kamaji] Update to edge-26.2.4 with Kubernetes 1.35
 support

Update Kamaji from edge-25.4.1 to edge-26.2.4 which adds support for
Kubernetes 1.35 (KubeadmVersion bumped from v1.33.0 to v1.35.0).

- Update Dockerfile VERSION to edge-26.2.4
- Update vendored Helm charts from upstream
- Remove 992.diff patch (label preservation fix merged upstream)
- Regenerate disable-datastore-check.diff for new version

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../kamaji/charts/kamaji-crds/.helmignore     |   28 +
 .../kamaji/charts/kamaji-crds/Chart.yaml      |   39 +
 .../system/kamaji/charts/kamaji-crds/Makefile |    9 +
 .../kamaji/charts/kamaji-crds/NOTES.txt       |    2 +
 .../kamaji/charts/kamaji-crds/README.md       |   66 +
 .../charts/kamaji-crds/README.md.gotmpl       |   54 +
 .../kamaji-crds/hack/crd-conversion.yaml      |   11 +
 .../kamaji.clastix.io_datastores_spec.yaml    |  292 +
 ....clastix.io_kubeconfiggenerators_spec.yaml |  218 +
 ...i.clastix.io_tenantcontrolplanes_spec.yaml | 8851 +++++++++++++++++
 .../charts/kamaji-crds/templates/_helpers.tpl |   49 +
 .../kamaji.clastix.io_datastores.yaml         |   10 +
 ...amaji.clastix.io_kubeconfiggenerators.yaml |   10 +
 ...kamaji.clastix.io_tenantcontrolplanes.yaml |   10 +
 .../kamaji/charts/kamaji-crds/values.yaml     |   15 +
 .../system/kamaji/charts/kamaji/.helmignore   |    5 +
 .../system/kamaji/charts/kamaji/Chart.lock    |    6 +-
 .../system/kamaji/charts/kamaji/Chart.yaml    |    9 +-
 .../system/kamaji/charts/kamaji/README.md     |   27 +-
 .../system/kamaji/charts/kamaji/app-readme.md |   12 -
 .../kamaji/controller-gen/clusterrole.yaml    |   51 +-
 .../crds/kamaji.clastix.io_datastores.yaml    |    6 +-
 ...amaji.clastix.io_kubeconfiggenerators.yaml |  226 +
 ...kamaji.clastix.io_tenantcontrolplanes.yaml | 1504 ++-
 .../charts/kamaji/templates/_helpers.tpl      |   12 +
 .../kubeconfiggenerator-deployment.yaml       |   54 +
 .../system/kamaji/charts/kamaji/values.yaml   |   49 +-
 .../system/kamaji/images/kamaji/Dockerfile    |    2 +-
 .../kamaji/images/kamaji/patches/992.diff     |  156 -
 .../patches/disable-datastore-check.diff      |   13 +-
 30 files changed, 11552 insertions(+), 244 deletions(-)
 create mode 100644 packages/system/kamaji/charts/kamaji-crds/.helmignore
 create mode 100644 packages/system/kamaji/charts/kamaji-crds/Chart.yaml
 create mode 100644 packages/system/kamaji/charts/kamaji-crds/Makefile
 create mode 100644 packages/system/kamaji/charts/kamaji-crds/NOTES.txt
 create mode 100644 packages/system/kamaji/charts/kamaji-crds/README.md
 create mode 100644 packages/system/kamaji/charts/kamaji-crds/README.md.gotmpl
 create mode 100644 packages/system/kamaji/charts/kamaji-crds/hack/crd-conversion.yaml
 create mode 100644 packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml
 create mode 100644 packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_kubeconfiggenerators_spec.yaml
 create mode 100644 packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml
 create mode 100644 packages/system/kamaji/charts/kamaji-crds/templates/_helpers.tpl
 create mode 100644 packages/system/kamaji/charts/kamaji-crds/templates/kamaji.clastix.io_datastores.yaml
 create mode 100644 packages/system/kamaji/charts/kamaji-crds/templates/kamaji.clastix.io_kubeconfiggenerators.yaml
 create mode 100644 packages/system/kamaji/charts/kamaji-crds/templates/kamaji.clastix.io_tenantcontrolplanes.yaml
 create mode 100644 packages/system/kamaji/charts/kamaji-crds/values.yaml
 delete mode 100644 packages/system/kamaji/charts/kamaji/app-readme.md
 create mode 100644 packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_kubeconfiggenerators.yaml
 create mode 100644 packages/system/kamaji/charts/kamaji/templates/kubeconfiggenerator-deployment.yaml
 delete mode 100644 packages/system/kamaji/images/kamaji/patches/992.diff

diff --git a/packages/system/kamaji/charts/kamaji-crds/.helmignore b/packages/system/kamaji/charts/kamaji-crds/.helmignore
new file mode 100644
index 00000000..a03977f5
--- /dev/null
+++ b/packages/system/kamaji/charts/kamaji-crds/.helmignore
@@ -0,0 +1,28 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+# Helm source files
+README.md.gotmpl
+.helmignore
+# Build tools
+Makefile
diff --git a/packages/system/kamaji/charts/kamaji-crds/Chart.yaml b/packages/system/kamaji/charts/kamaji-crds/Chart.yaml
new file mode 100644
index 00000000..0cb9e660
--- /dev/null
+++ b/packages/system/kamaji/charts/kamaji-crds/Chart.yaml
@@ -0,0 +1,39 @@
+apiVersion: v2
+appVersion: latest
+description: Kamaji is the Hosted Control Plane Manager for Kubernetes.
+home: https://github.com/clastix/kamaji
+icon: https://github.com/clastix/kamaji/raw/master/assets/logo-colored.png
+maintainers:
+  - email: dario@tranchitella.eu
+    name: Dario Tranchitella
+    url: https://clastix.io
+  - email: me@bsctl.io
+    name: Adriano Pezzuto
+    url: https://clastix.io
+name: kamaji-crds
+sources:
+  - https://github.com/clastix/kamaji
+type: application
+version: 0.0.0+latest
+annotations:
+  artifacthub.io/crds: |
+    - kind: TenantControlPlane
+      version: v1alpha1
+      name: tenantcontrolplanes.kamaji.clastix.io
+      displayName: TenantControlPlane
+      description: TenantControlPlane defines the desired state for a Control Plane backed by Kamaji.
+    - kind: DataStore
+      version: v1alpha1
+      name: datastores.kamaji.clastix.io
+      displayName: DataStore
+      description: DataStores is holding all the required details to communicate with a Datastore, such as etcd, MySQL, PostgreSQL, and NATS.
+  artifacthub.io/links: |
+    - name: CLASTIX
+      url: https://clastix.io
+    - name: support
+      url: https://clastix.io/support
+  artifacthub.io/changes: |
+    - kind: changed
+      description: Upgrading support to Kubernetes v1.35
+    - kind: added
+      description: Supporting multiple Datastore via etcd overrides
diff --git a/packages/system/kamaji/charts/kamaji-crds/Makefile b/packages/system/kamaji/charts/kamaji-crds/Makefile
new file mode 100644
index 00000000..a191fe4c
--- /dev/null
+++ b/packages/system/kamaji/charts/kamaji-crds/Makefile
@@ -0,0 +1,9 @@
+docs: HELMDOCS_VERSION := v1.8.1
+docs: docker
+	@docker run --rm -v "$$(pwd):/helm-docs" -u $$(id -u) jnorwood/helm-docs:$(HELMDOCS_VERSION)
+
+docker:
+	@hash docker 2>/dev/null || {\
+		echo "You need docker" &&\
+		exit 1;\
+	}
diff --git a/packages/system/kamaji/charts/kamaji-crds/NOTES.txt b/packages/system/kamaji/charts/kamaji-crds/NOTES.txt
new file mode 100644
index 00000000..c9ba0004
--- /dev/null
+++ b/packages/system/kamaji/charts/kamaji-crds/NOTES.txt
@@ -0,0 +1,2 @@
+Kamaji Custom Resource Definitions have been installed properly:
+you can proceed to upgrade your Kamaji operator instance.
diff --git a/packages/system/kamaji/charts/kamaji-crds/README.md b/packages/system/kamaji/charts/kamaji-crds/README.md
new file mode 100644
index 00000000..c7b23dca
--- /dev/null
+++ b/packages/system/kamaji/charts/kamaji-crds/README.md
@@ -0,0 +1,66 @@
+# kamaji-crds
+
+![Version: 0.0.0+latest](https://img.shields.io/badge/Version-0.0.0+latest-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square)
+
+Kamaji is the Hosted Control Plane Manager for Kubernetes.
+
+## Maintainers
+
+| Name | Email | Url |
+| ---- | ------ | --- |
+| Dario Tranchitella | <dario@tranchitella.eu> | <https://clastix.io> |
+| Adriano Pezzuto | <me@bsctl.io> | <https://clastix.io> |
+
+## Source Code
+
+* <https://github.com/clastix/kamaji>
+
+[Kamaji](https://github.com/clastix/kamaji) Custom Resource Definitions packaged as Helm Charts.
+
+## How to use this chart
+
+Add `clastix` Helm repository:
+
+    helm repo add clastix https://clastix.github.io/charts
+
+Install the Chart with the release name `kamaji-crds`:
+
+    helm upgrade --install --namespace kamaji-system --create-namespace kamaji-crds clastix/kamaji-crds
+
+Show the status:
+
+    helm status kamaji-crds -n kamaji-system
+
+Upgrade the Chart
+
+    helm upgrade kamaji-crds -n kamaji-system clastix/kamaji-crds
+
+Uninstall the Chart
+
+    helm uninstall kamaji-crds -n kamaji-system
+
+## Customize the installation
+
+There are two methods for specifying overrides of values during Chart installation: `--values` and `--set`.
+
+The `--values` option is the preferred method because it allows you to keep your overrides in a YAML file, rather than specifying them all on the command line. Create a copy of the YAML file `values.yaml` and add your overrides to it.
+
+Specify your overrides file when you install the Chart:
+
+    helm upgrade kamaji-crds --install --namespace kamaji-system --create-namespace clastix/kamaji-crds --values myvalues.yaml
+
+The values in your overrides file `myvalues.yaml` will override their counterparts in the Chart's values.yaml file. Any values in `values.yaml` that weren’t overridden will keep their defaults.
+
+If you only need to make minor customizations, you can specify them on the command line by using the `--set` option. For example:
+
+    helm upgrade kamaji-crds --install --namespace kamaji-system --create-namespace clastix/kamaji-crds --set kamajiCertificateName=kamaji
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| fullnameOverride | string | `""` | Overrides the full name of the resources created by the chart. |
+| kamajiCertificateName | string | `"kamaji-serving-cert"` | The cert-manager Certificate resource name, holding the Certificate Authority for webhooks. |
+| kamajiNamespace | string | `"kamaji-system"` | The namespace where Kamaji has been installed: required to inject the Certificate Authority for cert-manager. |
+| kamajiService | string | `"kamaji-webhook-service"` | The Kamaji webhook Service name. |
+| nameOverride | string | `""` | Overrides the name of the chart for resource naming purposes. |
diff --git a/packages/system/kamaji/charts/kamaji-crds/README.md.gotmpl b/packages/system/kamaji/charts/kamaji-crds/README.md.gotmpl
new file mode 100644
index 00000000..c7c26771
--- /dev/null
+++ b/packages/system/kamaji/charts/kamaji-crds/README.md.gotmpl
@@ -0,0 +1,54 @@
+{{ template "chart.header" . }}
+{{ template "chart.deprecationWarning" . }}
+
+{{ template "chart.badgesSection" . }}
+
+{{ template "chart.description" . }}
+
+{{ template "chart.maintainersSection" . }}
+
+{{ template "chart.sourcesSection" . }}
+
+{{ template "chart.requirementsSection" . }}
+
+[Kamaji](https://github.com/clastix/kamaji) Custom Resource Definitions packaged as Helm Charts.
+
+## How to use this chart
+
+Add `clastix` Helm repository:
+
+    helm repo add clastix https://clastix.github.io/charts
+
+Install the Chart with the release name `kamaji-crds`:
+
+    helm upgrade --install --namespace kamaji-system --create-namespace kamaji-crds clastix/kamaji-crds
+
+Show the status:
+
+    helm status kamaji-crds -n kamaji-system
+
+Upgrade the Chart
+
+    helm upgrade kamaji-crds -n kamaji-system clastix/kamaji-crds
+
+Uninstall the Chart
+
+    helm uninstall kamaji-crds -n kamaji-system
+
+## Customize the installation
+
+There are two methods for specifying overrides of values during Chart installation: `--values` and `--set`.
+
+The `--values` option is the preferred method because it allows you to keep your overrides in a YAML file, rather than specifying them all on the command line. Create a copy of the YAML file `values.yaml` and add your overrides to it.
+
+Specify your overrides file when you install the Chart:
+
+    helm upgrade kamaji-crds --install --namespace kamaji-system --create-namespace clastix/kamaji-crds --values myvalues.yaml
+
+The values in your overrides file `myvalues.yaml` will override their counterparts in the Chart's values.yaml file. Any values in `values.yaml` that weren’t overridden will keep their defaults.
+
+If you only need to make minor customizations, you can specify them on the command line by using the `--set` option. For example:
+
+    helm upgrade kamaji-crds --install --namespace kamaji-system --create-namespace clastix/kamaji-crds --set kamajiCertificateName=kamaji
+
+{{ template "chart.valuesSection" . }}
diff --git a/packages/system/kamaji/charts/kamaji-crds/hack/crd-conversion.yaml b/packages/system/kamaji/charts/kamaji-crds/hack/crd-conversion.yaml
new file mode 100644
index 00000000..be48bdb0
--- /dev/null
+++ b/packages/system/kamaji/charts/kamaji-crds/hack/crd-conversion.yaml
@@ -0,0 +1,11 @@
+spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          name: kamaji-webhook-service
+          namespace: kamaji-system
+          path: /convert
+      conversionReviewVersions:
+        - v1
diff --git a/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml
new file mode 100644
index 00000000..253cebae
--- /dev/null
+++ b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml
@@ -0,0 +1,292 @@
+group: kamaji.clastix.io
+names:
+  kind: DataStore
+  listKind: DataStoreList
+  plural: datastores
+  singular: datastore
+scope: Cluster
+versions:
+  - additionalPrinterColumns:
+      - description: Kamaji data store driver
+        jsonPath: .spec.driver
+        name: Driver
+        type: string
+      - description: Age
+        jsonPath: .metadata.creationTimestamp
+        name: Age
+        type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: DataStore is the Schema for the datastores API.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: DataStoreSpec defines the desired state of DataStore.
+            properties:
+              basicAuth:
+                description: |-
+                  In case of authentication enabled for the given data store, specifies the username and password pair.
+                  This value is optional.
+                properties:
+                  password:
+                    properties:
+                      content:
+                        description: |-
+                          Bare content of the file, base64 encoded.
+                          It has precedence over the SecretReference value.
+                        format: byte
+                        type: string
+                      secretReference:
+                        properties:
+                          keyPath:
+                            description: |-
+                              Name of the key for the given Secret reference where the content is stored.
+                              This value is mandatory.
+                            minLength: 1
+                            type: string
+                          name:
+                            description: name is unique within a namespace to reference a secret resource.
+                            type: string
+                          namespace:
+                            description: namespace defines the space within which the secret name must be unique.
+                            type: string
+                        required:
+                          - keyPath
+                        type: object
+                        x-kubernetes-map-type: atomic
+                    type: object
+                  username:
+                    properties:
+                      content:
+                        description: |-
+                          Bare content of the file, base64 encoded.
+                          It has precedence over the SecretReference value.
+                        format: byte
+                        type: string
+                      secretReference:
+                        properties:
+                          keyPath:
+                            description: |-
+                              Name of the key for the given Secret reference where the content is stored.
+                              This value is mandatory.
+                            minLength: 1
+                            type: string
+                          name:
+                            description: name is unique within a namespace to reference a secret resource.
+                            type: string
+                          namespace:
+                            description: namespace defines the space within which the secret name must be unique.
+                            type: string
+                        required:
+                          - keyPath
+                        type: object
+                        x-kubernetes-map-type: atomic
+                    type: object
+                required:
+                  - password
+                  - username
+                type: object
+              driver:
+                description: The driver to use to connect to the shared datastore.
+                enum:
+                  - etcd
+                  - MySQL
+                  - PostgreSQL
+                  - NATS
+                type: string
+                x-kubernetes-validations:
+                  - message: Datastore driver is immutable
+                    rule: self == oldSelf
+              endpoints:
+                description: |-
+                  List of the endpoints to connect to the shared datastore.
+                  No need for protocol, just bare IP/FQDN and port.
+                items:
+                  type: string
+                minItems: 1
+                type: array
+              tlsConfig:
+                description: |-
+                  Defines the TLS/SSL configuration required to connect to the data store in a secure way.
+                  This value is optional.
+                properties:
+                  certificateAuthority:
+                    description: |-
+                      Retrieve the Certificate Authority certificate and private key, such as bare content of the file, or a SecretReference.
+                      The key reference is required since etcd authentication is based on certificates, and Kamaji is responsible in creating this.
+                    properties:
+                      certificate:
+                        properties:
+                          content:
+                            description: |-
+                              Bare content of the file, base64 encoded.
+                              It has precedence over the SecretReference value.
+                            format: byte
+                            type: string
+                          secretReference:
+                            properties:
+                              keyPath:
+                                description: |-
+                                  Name of the key for the given Secret reference where the content is stored.
+                                  This value is mandatory.
+                                minLength: 1
+                                type: string
+                              name:
+                                description: name is unique within a namespace to reference a secret resource.
+                                type: string
+                              namespace:
+                                description: namespace defines the space within which the secret name must be unique.
+                                type: string
+                            required:
+                              - keyPath
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        type: object
+                      privateKey:
+                        properties:
+                          content:
+                            description: |-
+                              Bare content of the file, base64 encoded.
+                              It has precedence over the SecretReference value.
+                            format: byte
+                            type: string
+                          secretReference:
+                            properties:
+                              keyPath:
+                                description: |-
+                                  Name of the key for the given Secret reference where the content is stored.
+                                  This value is mandatory.
+                                minLength: 1
+                                type: string
+                              name:
+                                description: name is unique within a namespace to reference a secret resource.
+                                type: string
+                              namespace:
+                                description: namespace defines the space within which the secret name must be unique.
+                                type: string
+                            required:
+                              - keyPath
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        type: object
+                    required:
+                      - certificate
+                    type: object
+                  clientCertificate:
+                    description: Specifies the SSL/TLS key and private key pair used to connect to the data store.
+                    properties:
+                      certificate:
+                        properties:
+                          content:
+                            description: |-
+                              Bare content of the file, base64 encoded.
+                              It has precedence over the SecretReference value.
+                            format: byte
+                            type: string
+                          secretReference:
+                            properties:
+                              keyPath:
+                                description: |-
+                                  Name of the key for the given Secret reference where the content is stored.
+                                  This value is mandatory.
+                                minLength: 1
+                                type: string
+                              name:
+                                description: name is unique within a namespace to reference a secret resource.
+                                type: string
+                              namespace:
+                                description: namespace defines the space within which the secret name must be unique.
+                                type: string
+                            required:
+                              - keyPath
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        type: object
+                      privateKey:
+                        properties:
+                          content:
+                            description: |-
+                              Bare content of the file, base64 encoded.
+                              It has precedence over the SecretReference value.
+                            format: byte
+                            type: string
+                          secretReference:
+                            properties:
+                              keyPath:
+                                description: |-
+                                  Name of the key for the given Secret reference where the content is stored.
+                                  This value is mandatory.
+                                minLength: 1
+                                type: string
+                              name:
+                                description: name is unique within a namespace to reference a secret resource.
+                                type: string
+                              namespace:
+                                description: namespace defines the space within which the secret name must be unique.
+                                type: string
+                            required:
+                              - keyPath
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        type: object
+                    required:
+                      - certificate
+                      - privateKey
+                    type: object
+                required:
+                  - certificateAuthority
+                type: object
+            required:
+              - driver
+              - endpoints
+            type: object
+            x-kubernetes-validations:
+              - message: certificateAuthority privateKey must have secretReference or content when driver is etcd
+                rule: '(self.driver == "etcd") ? (self.tlsConfig != null && (has(self.tlsConfig.certificateAuthority.privateKey.secretReference) || has(self.tlsConfig.certificateAuthority.privateKey.content))) : true'
+              - message: clientCertificate must have secretReference or content when driver is etcd
+                rule: '(self.driver == "etcd") ? (self.tlsConfig != null && (has(self.tlsConfig.clientCertificate.certificate.secretReference) || has(self.tlsConfig.clientCertificate.certificate.content))) : true'
+              - message: clientCertificate privateKey must have secretReference or content when driver is etcd
+                rule: '(self.driver == "etcd") ? (self.tlsConfig != null && (has(self.tlsConfig.clientCertificate.privateKey.secretReference) || has(self.tlsConfig.clientCertificate.privateKey.content))) : true'
+              - message: When driver is not etcd and tlsConfig exists, clientCertificate must be null or contain valid content
+                rule: '(self.driver != "etcd" && has(self.tlsConfig) && has(self.tlsConfig.clientCertificate)) ? (((has(self.tlsConfig.clientCertificate.certificate.secretReference) || has(self.tlsConfig.clientCertificate.certificate.content)))) : true'
+              - message: When driver is not etcd and basicAuth exists, username must have secretReference or content
+                rule: '(self.driver != "etcd" && has(self.basicAuth)) ? ((has(self.basicAuth.username.secretReference) || has(self.basicAuth.username.content))) : true'
+              - message: When driver is not etcd and basicAuth exists, password must have secretReference or content
+                rule: '(self.driver != "etcd" && has(self.basicAuth)) ? ((has(self.basicAuth.password.secretReference) || has(self.basicAuth.password.content))) : true'
+              - message: When driver is not etcd, either tlsConfig or basicAuth must be provided
+                rule: '(self.driver != "etcd") ? (has(self.tlsConfig) || has(self.basicAuth)) : true'
+          status:
+            description: DataStoreStatus defines the observed state of DataStore.
+            properties:
+              observedGeneration:
+                description: ObservedGeneration represents the .metadata.generation that was last reconciled.
+                format: int64
+                type: integer
+              usedBy:
+                description: List of the Tenant Control Planes, namespaced named, using this data store.
+                items:
+                  type: string
+                type: array
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_kubeconfiggenerators_spec.yaml b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_kubeconfiggenerators_spec.yaml
new file mode 100644
index 00000000..3f71f481
--- /dev/null
+++ b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_kubeconfiggenerators_spec.yaml
@@ -0,0 +1,218 @@
+group: kamaji.clastix.io
+names:
+  categories:
+    - kamaji
+  kind: KubeconfigGenerator
+  listKind: KubeconfigGeneratorList
+  plural: kubeconfiggenerators
+  shortNames:
+    - kc
+  singular: kubeconfiggenerator
+scope: Cluster
+versions:
+  - additionalPrinterColumns:
+      - description: Age
+        jsonPath: .metadata.creationTimestamp
+        name: Age
+        type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: KubeconfigGenerator is the Schema for the kubeconfiggenerators API.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              controlPlaneEndpointFrom:
+                default: admin.svc
+                description: |-
+                  ControlPlaneEndpointFrom is the key used to extract the Tenant Control Plane endpoint that must be used by the generator.
+                  The targeted Secret is the `${TCP}-admin-kubeconfig` one, default to `admin.svc`.
+                type: string
+              groups:
+                description: |-
+                  Groups is resolved a set of strings used to assign the x509 organisations field.
+                  It will be recognised by Kubernetes as user groups.
+                items:
+                  description: |-
+                    CompoundValue allows defining a static, or a dynamic value.
+                    Options are mutually exclusive, just one should be picked up.
+                  properties:
+                    fromDefinition:
+                      description: |-
+                        FromDefinition is used to generate a dynamic value,
+                        it uses the dot notation to access fields from the referenced TenantControlPlane object:
+                        e.g.: metadata.name
+                      type: string
+                    stringValue:
+                      description: StringValue is a static string value.
+                      type: string
+                  type: object
+                  x-kubernetes-validations:
+                    - message: Either stringValue or fromDefinition must be set, but not both.
+                      rule: (has(self.stringValue) || has(self.fromDefinition)) && !(has(self.stringValue) && has(self.fromDefinition))
+                type: array
+              namespaceSelector:
+                description: NamespaceSelector is used to filter Namespaces from which the generator should extract TenantControlPlane objects.
+                properties:
+                  matchExpressions:
+                    description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                    items:
+                      description: |-
+                        A label selector requirement is a selector that contains values, a key, and an operator that
+                        relates the key and values.
+                      properties:
+                        key:
+                          description: key is the label key that the selector applies to.
+                          type: string
+                        operator:
+                          description: |-
+                            operator represents a key's relationship to a set of values.
+                            Valid operators are In, NotIn, Exists and DoesNotExist.
+                          type: string
+                        values:
+                          description: |-
+                            values is an array of string values. If the operator is In or NotIn,
+                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                            the values array must be empty. This array is replaced during a strategic
+                            merge patch.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                      required:
+                        - key
+                        - operator
+                      type: object
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  matchLabels:
+                    additionalProperties:
+                      type: string
+                    description: |-
+                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                      map is equivalent to an element of matchExpressions, whose key field is "key", the
+                      operator is "In", and the values array contains only "value". The requirements are ANDed.
+                    type: object
+                type: object
+                x-kubernetes-map-type: atomic
+              tenantControlPlaneSelector:
+                description: TenantControlPlaneSelector is used to filter the TenantControlPlane objects that should be address by the generator.
+                properties:
+                  matchExpressions:
+                    description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                    items:
+                      description: |-
+                        A label selector requirement is a selector that contains values, a key, and an operator that
+                        relates the key and values.
+                      properties:
+                        key:
+                          description: key is the label key that the selector applies to.
+                          type: string
+                        operator:
+                          description: |-
+                            operator represents a key's relationship to a set of values.
+                            Valid operators are In, NotIn, Exists and DoesNotExist.
+                          type: string
+                        values:
+                          description: |-
+                            values is an array of string values. If the operator is In or NotIn,
+                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                            the values array must be empty. This array is replaced during a strategic
+                            merge patch.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                      required:
+                        - key
+                        - operator
+                      type: object
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  matchLabels:
+                    additionalProperties:
+                      type: string
+                    description: |-
+                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                      map is equivalent to an element of matchExpressions, whose key field is "key", the
+                      operator is "In", and the values array contains only "value". The requirements are ANDed.
+                    type: object
+                type: object
+                x-kubernetes-map-type: atomic
+              user:
+                description: User resolves to a string to identify the client, assigned to the x509 Common Name field.
+                properties:
+                  fromDefinition:
+                    description: |-
+                      FromDefinition is used to generate a dynamic value,
+                      it uses the dot notation to access fields from the referenced TenantControlPlane object:
+                      e.g.: metadata.name
+                    type: string
+                  stringValue:
+                    description: StringValue is a static string value.
+                    type: string
+                type: object
+                x-kubernetes-validations:
+                  - message: Either stringValue or fromDefinition must be set, but not both.
+                    rule: (has(self.stringValue) || has(self.fromDefinition)) && !(has(self.stringValue) && has(self.fromDefinition))
+            required:
+              - user
+            type: object
+          status:
+            description: KubeconfigGeneratorStatus defines the observed state of KubeconfigGenerator.
+            properties:
+              availableResources:
+                default: 0
+                description: |-
+                  AvailableResources is the sum of successfully generated resources.
+                  In case of a different value compared to Resources, check the field errors.
+                type: integer
+              errors:
+                description: Errors is the list of failed kubeconfig generations.
+                items:
+                  properties:
+                    message:
+                      description: Message is the error message recorded upon the last generator run.
+                      type: string
+                    resource:
+                      description: Resource is the Namespaced name of the errored resource.
+                      type: string
+                  required:
+                    - message
+                    - resource
+                  type: object
+                type: array
+              observedGeneration:
+                description: ObservedGeneration represents the .metadata.generation that was last reconciled.
+                format: int64
+                type: integer
+              resources:
+                default: 0
+                description: Resources is the sum of targeted TenantControlPlane objects.
+                type: integer
+            required:
+              - availableResources
+              - resources
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml
new file mode 100644
index 00000000..43fbc59a
--- /dev/null
+++ b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml
@@ -0,0 +1,8851 @@
+group: kamaji.clastix.io
+names:
+  categories:
+    - kamaji
+  kind: TenantControlPlane
+  listKind: TenantControlPlaneList
+  plural: tenantcontrolplanes
+  shortNames:
+    - tcp
+  singular: tenantcontrolplane
+scope: Namespaced
+versions:
+  - additionalPrinterColumns:
+      - description: Kubernetes version
+        jsonPath: .spec.kubernetes.version
+        name: Version
+        type: string
+      - description: The actual installed Kubernetes version from status
+        jsonPath: .status.kubernetesResources.version.version
+        name: Installed Version
+        type: string
+      - description: Status
+        jsonPath: .status.kubernetesResources.version.status
+        name: Status
+        type: string
+      - description: Tenant Control Plane Endpoint (API server)
+        jsonPath: .status.controlPlaneEndpoint
+        name: Control-Plane endpoint
+        type: string
+      - description: Secret which contains admin kubeconfig
+        jsonPath: .status.kubeconfig.admin.secretName
+        name: Kubeconfig
+        type: string
+      - description: DataStore actually used
+        jsonPath: .status.storage.dataStoreName
+        name: Datastore
+        type: string
+      - description: Age
+        jsonPath: .metadata.creationTimestamp
+        name: Age
+        type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: TenantControlPlane is the Schema for the tenantcontrolplanes API.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              addons:
+                description: Addons contain which addons are enabled
+                properties:
+                  coreDNS:
+                    description: |-
+                      Enables the DNS addon in the Tenant Cluster.
+                      The registry and the tag are configurable, the image is hard-coded to `coredns`.
+                    properties:
+                      imageRepository:
+                        description: |-
+                          ImageRepository sets the container registry to pull images from.
+                          if not set, the default ImageRepository will be used instead.
+                        type: string
+                      imageTag:
+                        description: |-
+                          ImageTag allows to specify a tag for the image.
+                          In case this value is set, kubeadm does not change automatically the version of the above components during upgrades.
+                        type: string
+                    type: object
+                  konnectivity:
+                    description: Enables the Konnectivity addon in the Tenant Cluster, required if the worker nodes are in a different network.
+                    properties:
+                      agent:
+                        default:
+                          image: registry.k8s.io/kas-network-proxy/proxy-agent
+                          mode: DaemonSet
+                        properties:
+                          extraArgs:
+                            description: |-
+                              ExtraArgs allows adding additional arguments to said component.
+                              WARNING - This option can override existing konnectivity
+                              parameters and cause konnectivity components to misbehave in
+                              unxpected ways. Only modify if you know what you are doing.
+                            items:
+                              type: string
+                            type: array
+                          hostNetwork:
+                            default: false
+                            description: |-
+                              HostNetwork enables the konnectivity agent to use the Host network namespace.
+                              By enabling this mode, the Agent doesn't need to wait for the CNI initialisation,
+                              enabling a sort of out-of-band access to nodes for troubleshooting scenarios,
+                              or when the agent needs direct access to the host network.
+                            type: boolean
+                          image:
+                            default: registry.k8s.io/kas-network-proxy/proxy-agent
+                            description: AgentImage defines the container image for Konnectivity's agent.
+                            type: string
+                          mode:
+                            default: DaemonSet
+                            description: 'Mode allows specifying the Agent deployment mode: Deployment, or DaemonSet (default).'
+                            enum:
+                              - DaemonSet
+                              - Deployment
+                            type: string
+                          replicas:
+                            description: |-
+                              Replicas defines the number of replicas when Mode is Deployment.
+                              Must be 0 if Mode is DaemonSet.
+                            format: int32
+                            type: integer
+                          tolerations:
+                            default:
+                              - key: CriticalAddonsOnly
+                                operator: Exists
+                            description: |-
+                              Tolerations for the deployed agent.
+                              Can be customized to start the konnectivity-agent even if the nodes are not ready or tainted.
+                            items:
+                              description: |-
+                                The pod this Toleration is attached to tolerates any taint that matches
+                                the triple <key,value,effect> using the matching operator <operator>.
+                              properties:
+                                effect:
+                                  description: |-
+                                    Effect indicates the taint effect to match. Empty means match all taint effects.
+                                    When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+                                  type: string
+                                key:
+                                  description: |-
+                                    Key is the taint key that the toleration applies to. Empty means match all taint keys.
+                                    If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    Operator represents a key's relationship to the value.
+                                    Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
+                                    Exists is equivalent to wildcard for value, so that a pod can
+                                    tolerate all taints of a particular category.
+                                    Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
+                                  type: string
+                                tolerationSeconds:
+                                  description: |-
+                                    TolerationSeconds represents the period of time the toleration (which must be
+                                    of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+                                    it is not set, which means tolerate the taint forever (do not evict). Zero and
+                                    negative values will be treated as 0 (evict immediately) by the system.
+                                  format: int64
+                                  type: integer
+                                value:
+                                  description: |-
+                                    Value is the taint value the toleration matches to.
+                                    If the operator is Exists, the value should be empty, otherwise just a regular string.
+                                  type: string
+                              type: object
+                            type: array
+                          version:
+                            description: |-
+                              Version for Konnectivity agent.
+                              If left empty, Kamaji will automatically inflect the version from the deployed Tenant Control Plane.
+
+                              WARNING: for last cut-off releases, the container image could be not available.
+                            type: string
+                        type: object
+                        x-kubernetes-validations:
+                          - message: replicas must be 0 (or unset) when mode is DaemonSet, and greater than 0 (or unset) when mode is Deployment
+                            rule: '!(self.mode == ''DaemonSet'' && has(self.replicas) && self.replicas != 0) && !(self.mode == ''Deployment'' && has(self.replicas) && self.replicas == 0)'
+                      server:
+                        default:
+                          image: registry.k8s.io/kas-network-proxy/proxy-server
+                          port: 8132
+                        properties:
+                          extraArgs:
+                            description: |-
+                              ExtraArgs allows adding additional arguments to said component.
+                              WARNING - This option can override existing konnectivity
+                              parameters and cause konnectivity components to misbehave in
+                              unxpected ways. Only modify if you know what you are doing.
+                            items:
+                              type: string
+                            type: array
+                          image:
+                            default: registry.k8s.io/kas-network-proxy/proxy-server
+                            description: Container image used by the Konnectivity server.
+                            type: string
+                          port:
+                            description: The port which Konnectivity server is listening to.
+                            format: int32
+                            type: integer
+                          resources:
+                            description: Resources define the amount of CPU and memory to allocate to the Konnectivity server.
+                            properties:
+                              claims:
+                                description: |-
+                                  Claims lists the names of resources, defined in spec.resourceClaims,
+                                  that are used by this container.
+
+                                  This field depends on the
+                                  DynamicResourceAllocation feature gate.
+
+                                  This field is immutable. It can only be set for containers.
+                                items:
+                                  description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+                                  properties:
+                                    name:
+                                      description: |-
+                                        Name must match the name of one entry in pod.spec.resourceClaims of
+                                        the Pod where this field is used. It makes that resource available
+                                        inside a container.
+                                      type: string
+                                    request:
+                                      description: |-
+                                        Request is the name chosen for a request in the referenced claim.
+                                        If empty, everything from the claim is made available, otherwise
+                                        only the result of this request.
+                                      type: string
+                                  required:
+                                    - name
+                                  type: object
+                                type: array
+                                x-kubernetes-list-map-keys:
+                                  - name
+                                x-kubernetes-list-type: map
+                              limits:
+                                additionalProperties:
+                                  anyOf:
+                                    - type: integer
+                                    - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                description: |-
+                                  Limits describes the maximum amount of compute resources allowed.
+                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                type: object
+                              requests:
+                                additionalProperties:
+                                  anyOf:
+                                    - type: integer
+                                    - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                description: |-
+                                  Requests describes the minimum amount of compute resources required.
+                                  If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                  otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                type: object
+                            type: object
+                          version:
+                            description: |-
+                              Container image version of the Konnectivity server.
+                              If left empty, Kamaji will automatically inflect the version from the deployed Tenant Control Plane.
+
+                              WARNING: for last cut-off releases, the container image could be not available.
+                            type: string
+                        required:
+                          - port
+                        type: object
+                    type: object
+                  kubeProxy:
+                    description: |-
+                      Enables the kube-proxy addon in the Tenant Cluster.
+                      The registry and the tag are configurable, the image is hard-coded to `kube-proxy`.
+                    properties:
+                      imageRepository:
+                        description: |-
+                          ImageRepository sets the container registry to pull images from.
+                          if not set, the default ImageRepository will be used instead.
+                        type: string
+                      imageTag:
+                        description: |-
+                          ImageTag allows to specify a tag for the image.
+                          In case this value is set, kubeadm does not change automatically the version of the above components during upgrades.
+                        type: string
+                    type: object
+                type: object
+              controlPlane:
+                description: |-
+                  ControlPlane defines how the Tenant Control Plane Kubernetes resources must be created in the Admin Cluster,
+                  such as the number of Pod replicas, the Service resource, or the Ingress.
+                properties:
+                  deployment:
+                    description: Defining the options for the deployed Tenant Control Plane as Deployment resource.
+                    properties:
+                      additionalContainers:
+                        description: AdditionalContainers allows adding additional containers to the Control Plane deployment.
+                        items:
+                          description: A single application container that you want to run within a pod.
+                          properties:
+                            args:
+                              description: |-
+                                Arguments to the entrypoint.
+                                The container image's CMD is used if this is not provided.
+                                Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+                                cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+                                to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+                                produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+                                of whether the variable exists or not. Cannot be updated.
+                                More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            command:
+                              description: |-
+                                Entrypoint array. Not executed within a shell.
+                                The container image's ENTRYPOINT is used if this is not provided.
+                                Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+                                cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+                                to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+                                produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+                                of whether the variable exists or not. Cannot be updated.
+                                More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            env:
+                              description: |-
+                                List of environment variables to set in the container.
+                                Cannot be updated.
+                              items:
+                                description: EnvVar represents an environment variable present in a Container.
+                                properties:
+                                  name:
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
+                                    type: string
+                                  value:
+                                    description: |-
+                                      Variable references $(VAR_NAME) are expanded
+                                      using the previously defined environment variables in the container and
+                                      any service environment variables. If a variable cannot be resolved,
+                                      the reference in the input string will be unchanged. Double $$ are reduced
+                                      to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+                                      "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+                                      Escaped references will never be expanded, regardless of whether the variable
+                                      exists or not.
+                                      Defaults to "".
+                                    type: string
+                                  valueFrom:
+                                    description: Source for the environment variable's value. Cannot be used if value is not empty.
+                                    properties:
+                                      configMapKeyRef:
+                                        description: Selects a key of a ConfigMap.
+                                        properties:
+                                          key:
+                                            description: The key to select.
+                                            type: string
+                                          name:
+                                            default: ""
+                                            description: |-
+                                              Name of the referent.
+                                              This field is effectively required, but due to backwards compatibility is
+                                              allowed to be empty. Instances of this type with an empty value here are
+                                              almost certainly wrong.
+                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                            type: string
+                                          optional:
+                                            description: Specify whether the ConfigMap or its key must be defined
+                                            type: boolean
+                                        required:
+                                          - key
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      fieldRef:
+                                        description: |-
+                                          Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
+                                          spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
+                                        properties:
+                                          apiVersion:
+                                            description: Version of the schema the FieldPath is written in terms of, defaults to "v1".
+                                            type: string
+                                          fieldPath:
+                                            description: Path of the field to select in the specified API version.
+                                            type: string
+                                        required:
+                                          - fieldPath
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount containing the env file.
+                                            type: string
+                                        required:
+                                          - key
+                                          - path
+                                          - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      resourceFieldRef:
+                                        description: |-
+                                          Selects a resource of the container: only resources limits and requests
+                                          (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
+                                        properties:
+                                          containerName:
+                                            description: 'Container name: required for volumes, optional for env vars'
+                                            type: string
+                                          divisor:
+                                            anyOf:
+                                              - type: integer
+                                              - type: string
+                                            description: Specifies the output format of the exposed resources, defaults to "1"
+                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                            x-kubernetes-int-or-string: true
+                                          resource:
+                                            description: 'Required: resource to select'
+                                            type: string
+                                        required:
+                                          - resource
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      secretKeyRef:
+                                        description: Selects a key of a secret in the pod's namespace
+                                        properties:
+                                          key:
+                                            description: The key of the secret to select from.  Must be a valid secret key.
+                                            type: string
+                                          name:
+                                            default: ""
+                                            description: |-
+                                              Name of the referent.
+                                              This field is effectively required, but due to backwards compatibility is
+                                              allowed to be empty. Instances of this type with an empty value here are
+                                              almost certainly wrong.
+                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                            type: string
+                                          optional:
+                                            description: Specify whether the Secret or its key must be defined
+                                            type: boolean
+                                        required:
+                                          - key
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                    type: object
+                                required:
+                                  - name
+                                type: object
+                              type: array
+                              x-kubernetes-list-map-keys:
+                                - name
+                              x-kubernetes-list-type: map
+                            envFrom:
+                              description: |-
+                                List of sources to populate environment variables in the container.
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
+                                sources, the value associated with the last source will take precedence.
+                                Values defined by an Env with a duplicate key will take precedence.
+                                Cannot be updated.
+                              items:
+                                description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                properties:
+                                  configMapRef:
+                                    description: The ConfigMap to select from
+                                    properties:
+                                      name:
+                                        default: ""
+                                        description: |-
+                                          Name of the referent.
+                                          This field is effectively required, but due to backwards compatibility is
+                                          allowed to be empty. Instances of this type with an empty value here are
+                                          almost certainly wrong.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                      optional:
+                                        description: Specify whether the ConfigMap must be defined
+                                        type: boolean
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                  prefix:
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
+                                    type: string
+                                  secretRef:
+                                    description: The Secret to select from
+                                    properties:
+                                      name:
+                                        default: ""
+                                        description: |-
+                                          Name of the referent.
+                                          This field is effectively required, but due to backwards compatibility is
+                                          allowed to be empty. Instances of this type with an empty value here are
+                                          almost certainly wrong.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                      optional:
+                                        description: Specify whether the Secret must be defined
+                                        type: boolean
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            image:
+                              description: |-
+                                Container image name.
+                                More info: https://kubernetes.io/docs/concepts/containers/images
+                                This field is optional to allow higher level config management to default or override
+                                container images in workload controllers like Deployments and StatefulSets.
+                              type: string
+                            imagePullPolicy:
+                              description: |-
+                                Image pull policy.
+                                One of Always, Never, IfNotPresent.
+                                Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+                                Cannot be updated.
+                                More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
+                              type: string
+                            lifecycle:
+                              description: |-
+                                Actions that the management system should take in response to container lifecycle events.
+                                Cannot be updated.
+                              properties:
+                                postStart:
+                                  description: |-
+                                    PostStart is called immediately after a container is created. If the handler fails,
+                                    the container is terminated and restarted according to its restart policy.
+                                    Other management of the container blocks until the hook completes.
+                                    More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
+                                  properties:
+                                    exec:
+                                      description: Exec specifies a command to execute in the container.
+                                      properties:
+                                        command:
+                                          description: |-
+                                            Command is the command line to execute inside the container, the working directory for the
+                                            command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                            not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                            a shell, you need to explicitly call out to that shell.
+                                            Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                    httpGet:
+                                      description: HTTPGet specifies an HTTP GET request to perform.
+                                      properties:
+                                        host:
+                                          description: |-
+                                            Host name to connect to, defaults to the pod IP. You probably want to set
+                                            "Host" in httpHeaders instead.
+                                          type: string
+                                        httpHeaders:
+                                          description: Custom headers to set in the request. HTTP allows repeated headers.
+                                          items:
+                                            description: HTTPHeader describes a custom header to be used in HTTP probes
+                                            properties:
+                                              name:
+                                                description: |-
+                                                  The header field name.
+                                                  This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                                type: string
+                                              value:
+                                                description: The header field value
+                                                type: string
+                                            required:
+                                              - name
+                                              - value
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        path:
+                                          description: Path to access on the HTTP server.
+                                          type: string
+                                        port:
+                                          anyOf:
+                                            - type: integer
+                                            - type: string
+                                          description: |-
+                                            Name or number of the port to access on the container.
+                                            Number must be in the range 1 to 65535.
+                                            Name must be an IANA_SVC_NAME.
+                                          x-kubernetes-int-or-string: true
+                                        scheme:
+                                          description: |-
+                                            Scheme to use for connecting to the host.
+                                            Defaults to HTTP.
+                                          type: string
+                                      required:
+                                        - port
+                                      type: object
+                                    sleep:
+                                      description: Sleep represents a duration that the container should sleep.
+                                      properties:
+                                        seconds:
+                                          description: Seconds is the number of seconds to sleep.
+                                          format: int64
+                                          type: integer
+                                      required:
+                                        - seconds
+                                      type: object
+                                    tcpSocket:
+                                      description: |-
+                                        Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept
+                                        for backward compatibility. There is no validation of this field and
+                                        lifecycle hooks will fail at runtime when it is specified.
+                                      properties:
+                                        host:
+                                          description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                          type: string
+                                        port:
+                                          anyOf:
+                                            - type: integer
+                                            - type: string
+                                          description: |-
+                                            Number or name of the port to access on the container.
+                                            Number must be in the range 1 to 65535.
+                                            Name must be an IANA_SVC_NAME.
+                                          x-kubernetes-int-or-string: true
+                                      required:
+                                        - port
+                                      type: object
+                                  type: object
+                                preStop:
+                                  description: |-
+                                    PreStop is called immediately before a container is terminated due to an
+                                    API request or management event such as liveness/startup probe failure,
+                                    preemption, resource contention, etc. The handler is not called if the
+                                    container crashes or exits. The Pod's termination grace period countdown begins before the
+                                    PreStop hook is executed. Regardless of the outcome of the handler, the
+                                    container will eventually terminate within the Pod's termination grace
+                                    period (unless delayed by finalizers). Other management of the container blocks until the hook completes
+                                    or until the termination grace period is reached.
+                                    More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
+                                  properties:
+                                    exec:
+                                      description: Exec specifies a command to execute in the container.
+                                      properties:
+                                        command:
+                                          description: |-
+                                            Command is the command line to execute inside the container, the working directory for the
+                                            command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                            not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                            a shell, you need to explicitly call out to that shell.
+                                            Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                    httpGet:
+                                      description: HTTPGet specifies an HTTP GET request to perform.
+                                      properties:
+                                        host:
+                                          description: |-
+                                            Host name to connect to, defaults to the pod IP. You probably want to set
+                                            "Host" in httpHeaders instead.
+                                          type: string
+                                        httpHeaders:
+                                          description: Custom headers to set in the request. HTTP allows repeated headers.
+                                          items:
+                                            description: HTTPHeader describes a custom header to be used in HTTP probes
+                                            properties:
+                                              name:
+                                                description: |-
+                                                  The header field name.
+                                                  This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                                type: string
+                                              value:
+                                                description: The header field value
+                                                type: string
+                                            required:
+                                              - name
+                                              - value
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        path:
+                                          description: Path to access on the HTTP server.
+                                          type: string
+                                        port:
+                                          anyOf:
+                                            - type: integer
+                                            - type: string
+                                          description: |-
+                                            Name or number of the port to access on the container.
+                                            Number must be in the range 1 to 65535.
+                                            Name must be an IANA_SVC_NAME.
+                                          x-kubernetes-int-or-string: true
+                                        scheme:
+                                          description: |-
+                                            Scheme to use for connecting to the host.
+                                            Defaults to HTTP.
+                                          type: string
+                                      required:
+                                        - port
+                                      type: object
+                                    sleep:
+                                      description: Sleep represents a duration that the container should sleep.
+                                      properties:
+                                        seconds:
+                                          description: Seconds is the number of seconds to sleep.
+                                          format: int64
+                                          type: integer
+                                      required:
+                                        - seconds
+                                      type: object
+                                    tcpSocket:
+                                      description: |-
+                                        Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept
+                                        for backward compatibility. There is no validation of this field and
+                                        lifecycle hooks will fail at runtime when it is specified.
+                                      properties:
+                                        host:
+                                          description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                          type: string
+                                        port:
+                                          anyOf:
+                                            - type: integer
+                                            - type: string
+                                          description: |-
+                                            Number or name of the port to access on the container.
+                                            Number must be in the range 1 to 65535.
+                                            Name must be an IANA_SVC_NAME.
+                                          x-kubernetes-int-or-string: true
+                                      required:
+                                        - port
+                                      type: object
+                                  type: object
+                                stopSignal:
+                                  description: |-
+                                    StopSignal defines which signal will be sent to a container when it is being stopped.
+                                    If not specified, the default is defined by the container runtime in use.
+                                    StopSignal can only be set for Pods with a non-empty .spec.os.name
+                                  type: string
+                              type: object
+                            livenessProbe:
+                              description: |-
+                                Periodic probe of container liveness.
+                                Container will be restarted if the probe fails.
+                                Cannot be updated.
+                                More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                              properties:
+                                exec:
+                                  description: Exec specifies a command to execute in the container.
+                                  properties:
+                                    command:
+                                      description: |-
+                                        Command is the command line to execute inside the container, the working directory for the
+                                        command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                        not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                        a shell, you need to explicitly call out to that shell.
+                                        Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                failureThreshold:
+                                  description: |-
+                                    Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                                    Defaults to 3. Minimum value is 1.
+                                  format: int32
+                                  type: integer
+                                grpc:
+                                  description: GRPC specifies a GRPC HealthCheckRequest.
+                                  properties:
+                                    port:
+                                      description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                      format: int32
+                                      type: integer
+                                    service:
+                                      default: ""
+                                      description: |-
+                                        Service is the name of the service to place in the gRPC HealthCheckRequest
+                                        (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                        If this is not specified, the default behavior is defined by gRPC.
+                                      type: string
+                                  required:
+                                    - port
+                                  type: object
+                                httpGet:
+                                  description: HTTPGet specifies an HTTP GET request to perform.
+                                  properties:
+                                    host:
+                                      description: |-
+                                        Host name to connect to, defaults to the pod IP. You probably want to set
+                                        "Host" in httpHeaders instead.
+                                      type: string
+                                    httpHeaders:
+                                      description: Custom headers to set in the request. HTTP allows repeated headers.
+                                      items:
+                                        description: HTTPHeader describes a custom header to be used in HTTP probes
+                                        properties:
+                                          name:
+                                            description: |-
+                                              The header field name.
+                                              This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                            type: string
+                                          value:
+                                            description: The header field value
+                                            type: string
+                                        required:
+                                          - name
+                                          - value
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    path:
+                                      description: Path to access on the HTTP server.
+                                      type: string
+                                    port:
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      description: |-
+                                        Name or number of the port to access on the container.
+                                        Number must be in the range 1 to 65535.
+                                        Name must be an IANA_SVC_NAME.
+                                      x-kubernetes-int-or-string: true
+                                    scheme:
+                                      description: |-
+                                        Scheme to use for connecting to the host.
+                                        Defaults to HTTP.
+                                      type: string
+                                  required:
+                                    - port
+                                  type: object
+                                initialDelaySeconds:
+                                  description: |-
+                                    Number of seconds after the container has started before liveness probes are initiated.
+                                    More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                  format: int32
+                                  type: integer
+                                periodSeconds:
+                                  description: |-
+                                    How often (in seconds) to perform the probe.
+                                    Default to 10 seconds. Minimum value is 1.
+                                  format: int32
+                                  type: integer
+                                successThreshold:
+                                  description: |-
+                                    Minimum consecutive successes for the probe to be considered successful after having failed.
+                                    Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                                  format: int32
+                                  type: integer
+                                tcpSocket:
+                                  description: TCPSocket specifies a connection to a TCP port.
+                                  properties:
+                                    host:
+                                      description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                      type: string
+                                    port:
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      description: |-
+                                        Number or name of the port to access on the container.
+                                        Number must be in the range 1 to 65535.
+                                        Name must be an IANA_SVC_NAME.
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                    - port
+                                  type: object
+                                terminationGracePeriodSeconds:
+                                  description: |-
+                                    Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+                                    The grace period is the duration in seconds after the processes running in the pod are sent
+                                    a termination signal and the time when the processes are forcibly halted with a kill signal.
+                                    Set this value longer than the expected cleanup time for your process.
+                                    If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+                                    value overrides the value provided by the pod spec.
+                                    Value must be non-negative integer. The value zero indicates stop immediately via
+                                    the kill signal (no opportunity to shut down).
+                                    This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+                                    Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
+                                  format: int64
+                                  type: integer
+                                timeoutSeconds:
+                                  description: |-
+                                    Number of seconds after which the probe times out.
+                                    Defaults to 1 second. Minimum value is 1.
+                                    More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                  format: int32
+                                  type: integer
+                              type: object
+                            name:
+                              description: |-
+                                Name of the container specified as a DNS_LABEL.
+                                Each container in a pod must have a unique name (DNS_LABEL).
+                                Cannot be updated.
+                              type: string
+                            ports:
+                              description: |-
+                                List of ports to expose from the container. Not specifying a port here
+                                DOES NOT prevent that port from being exposed. Any port which is
+                                listening on the default "0.0.0.0" address inside a container will be
+                                accessible from the network.
+                                Modifying this array with strategic merge patch may corrupt the data.
+                                For more information See https://github.com/kubernetes/kubernetes/issues/108255.
+                                Cannot be updated.
+                              items:
+                                description: ContainerPort represents a network port in a single container.
+                                properties:
+                                  containerPort:
+                                    description: |-
+                                      Number of port to expose on the pod's IP address.
+                                      This must be a valid port number, 0 < x < 65536.
+                                    format: int32
+                                    type: integer
+                                  hostIP:
+                                    description: What host IP to bind the external port to.
+                                    type: string
+                                  hostPort:
+                                    description: |-
+                                      Number of port to expose on the host.
+                                      If specified, this must be a valid port number, 0 < x < 65536.
+                                      If HostNetwork is specified, this must match ContainerPort.
+                                      Most containers do not need this.
+                                    format: int32
+                                    type: integer
+                                  name:
+                                    description: |-
+                                      If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
+                                      named port in a pod must have a unique name. Name for the port that can be
+                                      referred to by services.
+                                    type: string
+                                  protocol:
+                                    default: TCP
+                                    description: |-
+                                      Protocol for port. Must be UDP, TCP, or SCTP.
+                                      Defaults to "TCP".
+                                    type: string
+                                required:
+                                  - containerPort
+                                type: object
+                              type: array
+                              x-kubernetes-list-map-keys:
+                                - containerPort
+                                - protocol
+                              x-kubernetes-list-type: map
+                            readinessProbe:
+                              description: |-
+                                Periodic probe of container service readiness.
+                                Container will be removed from service endpoints if the probe fails.
+                                Cannot be updated.
+                                More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                              properties:
+                                exec:
+                                  description: Exec specifies a command to execute in the container.
+                                  properties:
+                                    command:
+                                      description: |-
+                                        Command is the command line to execute inside the container, the working directory for the
+                                        command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                        not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                        a shell, you need to explicitly call out to that shell.
+                                        Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                failureThreshold:
+                                  description: |-
+                                    Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                                    Defaults to 3. Minimum value is 1.
+                                  format: int32
+                                  type: integer
+                                grpc:
+                                  description: GRPC specifies a GRPC HealthCheckRequest.
+                                  properties:
+                                    port:
+                                      description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                      format: int32
+                                      type: integer
+                                    service:
+                                      default: ""
+                                      description: |-
+                                        Service is the name of the service to place in the gRPC HealthCheckRequest
+                                        (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                        If this is not specified, the default behavior is defined by gRPC.
+                                      type: string
+                                  required:
+                                    - port
+                                  type: object
+                                httpGet:
+                                  description: HTTPGet specifies an HTTP GET request to perform.
+                                  properties:
+                                    host:
+                                      description: |-
+                                        Host name to connect to, defaults to the pod IP. You probably want to set
+                                        "Host" in httpHeaders instead.
+                                      type: string
+                                    httpHeaders:
+                                      description: Custom headers to set in the request. HTTP allows repeated headers.
+                                      items:
+                                        description: HTTPHeader describes a custom header to be used in HTTP probes
+                                        properties:
+                                          name:
+                                            description: |-
+                                              The header field name.
+                                              This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                            type: string
+                                          value:
+                                            description: The header field value
+                                            type: string
+                                        required:
+                                          - name
+                                          - value
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    path:
+                                      description: Path to access on the HTTP server.
+                                      type: string
+                                    port:
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      description: |-
+                                        Name or number of the port to access on the container.
+                                        Number must be in the range 1 to 65535.
+                                        Name must be an IANA_SVC_NAME.
+                                      x-kubernetes-int-or-string: true
+                                    scheme:
+                                      description: |-
+                                        Scheme to use for connecting to the host.
+                                        Defaults to HTTP.
+                                      type: string
+                                  required:
+                                    - port
+                                  type: object
+                                initialDelaySeconds:
+                                  description: |-
+                                    Number of seconds after the container has started before liveness probes are initiated.
+                                    More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                  format: int32
+                                  type: integer
+                                periodSeconds:
+                                  description: |-
+                                    How often (in seconds) to perform the probe.
+                                    Default to 10 seconds. Minimum value is 1.
+                                  format: int32
+                                  type: integer
+                                successThreshold:
+                                  description: |-
+                                    Minimum consecutive successes for the probe to be considered successful after having failed.
+                                    Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                                  format: int32
+                                  type: integer
+                                tcpSocket:
+                                  description: TCPSocket specifies a connection to a TCP port.
+                                  properties:
+                                    host:
+                                      description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                      type: string
+                                    port:
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      description: |-
+                                        Number or name of the port to access on the container.
+                                        Number must be in the range 1 to 65535.
+                                        Name must be an IANA_SVC_NAME.
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                    - port
+                                  type: object
+                                terminationGracePeriodSeconds:
+                                  description: |-
+                                    Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+                                    The grace period is the duration in seconds after the processes running in the pod are sent
+                                    a termination signal and the time when the processes are forcibly halted with a kill signal.
+                                    Set this value longer than the expected cleanup time for your process.
+                                    If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+                                    value overrides the value provided by the pod spec.
+                                    Value must be non-negative integer. The value zero indicates stop immediately via
+                                    the kill signal (no opportunity to shut down).
+                                    This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+                                    Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
+                                  format: int64
+                                  type: integer
+                                timeoutSeconds:
+                                  description: |-
+                                    Number of seconds after which the probe times out.
+                                    Defaults to 1 second. Minimum value is 1.
+                                    More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                  format: int32
+                                  type: integer
+                              type: object
+                            resizePolicy:
+                              description: |-
+                                Resources resize policy for the container.
+                                This field cannot be set on ephemeral containers.
+                              items:
+                                description: ContainerResizePolicy represents resource resize policy for the container.
+                                properties:
+                                  resourceName:
+                                    description: |-
+                                      Name of the resource to which this resource resize policy applies.
+                                      Supported values: cpu, memory.
+                                    type: string
+                                  restartPolicy:
+                                    description: |-
+                                      Restart policy to apply when specified resource is resized.
+                                      If not specified, it defaults to NotRequired.
+                                    type: string
+                                required:
+                                  - resourceName
+                                  - restartPolicy
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            resources:
+                              description: |-
+                                Compute Resources required by this container.
+                                Cannot be updated.
+                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                              properties:
+                                claims:
+                                  description: |-
+                                    Claims lists the names of resources, defined in spec.resourceClaims,
+                                    that are used by this container.
+
+                                    This field depends on the
+                                    DynamicResourceAllocation feature gate.
+
+                                    This field is immutable. It can only be set for containers.
+                                  items:
+                                    description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+                                    properties:
+                                      name:
+                                        description: |-
+                                          Name must match the name of one entry in pod.spec.resourceClaims of
+                                          the Pod where this field is used. It makes that resource available
+                                          inside a container.
+                                        type: string
+                                      request:
+                                        description: |-
+                                          Request is the name chosen for a request in the referenced claim.
+                                          If empty, everything from the claim is made available, otherwise
+                                          only the result of this request.
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-map-keys:
+                                    - name
+                                  x-kubernetes-list-type: map
+                                limits:
+                                  additionalProperties:
+                                    anyOf:
+                                      - type: integer
+                                      - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  description: |-
+                                    Limits describes the maximum amount of compute resources allowed.
+                                    More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                  type: object
+                                requests:
+                                  additionalProperties:
+                                    anyOf:
+                                      - type: integer
+                                      - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  description: |-
+                                    Requests describes the minimum amount of compute resources required.
+                                    If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                    otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                                    More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                  type: object
+                              type: object
+                            restartPolicy:
+                              description: |-
+                                RestartPolicy defines the restart behavior of individual containers in a pod.
+                                This overrides the pod-level restart policy. When this field is not specified,
+                                the restart behavior is defined by the Pod's restart policy and the container type.
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
+                                this init container will be continually restarted on
+                                exit until all regular containers have terminated. Once all regular
+                                containers have completed, all init containers with restartPolicy "Always"
+                                will be shut down. This lifecycle differs from normal init containers and
+                                is often referred to as a "sidecar" container. Although this init
+                                container still starts in the init container sequence, it does not wait
+                                for the container to complete before proceeding to the next init
+                                container. Instead, the next init container starts immediately after this
+                                init container is started, or after any startupProbe has successfully
+                                completed.
+                              type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                      - operator
+                                    type: object
+                                required:
+                                  - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            securityContext:
+                              description: |-
+                                SecurityContext defines the security options the container should be run with.
+                                If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
+                                More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+                              properties:
+                                allowPrivilegeEscalation:
+                                  description: |-
+                                    AllowPrivilegeEscalation controls whether a process can gain more
+                                    privileges than its parent process. This bool directly controls if
+                                    the no_new_privs flag will be set on the container process.
+                                    AllowPrivilegeEscalation is true always when the container is:
+                                    1) run as Privileged
+                                    2) has CAP_SYS_ADMIN
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  type: boolean
+                                appArmorProfile:
+                                  description: |-
+                                    appArmorProfile is the AppArmor options to use by this container. If set, this profile
+                                    overrides the pod's appArmorProfile.
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  properties:
+                                    localhostProfile:
+                                      description: |-
+                                        localhostProfile indicates a profile loaded on the node that should be used.
+                                        The profile must be preconfigured on the node to work.
+                                        Must match the loaded name of the profile.
+                                        Must be set if and only if type is "Localhost".
+                                      type: string
+                                    type:
+                                      description: |-
+                                        type indicates which kind of AppArmor profile will be applied.
+                                        Valid options are:
+                                          Localhost - a profile pre-loaded on the node.
+                                          RuntimeDefault - the container runtime's default profile.
+                                          Unconfined - no AppArmor enforcement.
+                                      type: string
+                                  required:
+                                    - type
+                                  type: object
+                                capabilities:
+                                  description: |-
+                                    The capabilities to add/drop when running containers.
+                                    Defaults to the default set of capabilities granted by the container runtime.
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  properties:
+                                    add:
+                                      description: Added capabilities
+                                      items:
+                                        description: Capability represent POSIX capabilities type
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    drop:
+                                      description: Removed capabilities
+                                      items:
+                                        description: Capability represent POSIX capabilities type
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                privileged:
+                                  description: |-
+                                    Run container in privileged mode.
+                                    Processes in privileged containers are essentially equivalent to root on the host.
+                                    Defaults to false.
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  type: boolean
+                                procMount:
+                                  description: |-
+                                    procMount denotes the type of proc mount to use for the containers.
+                                    The default value is Default which uses the container runtime defaults for
+                                    readonly paths and masked paths.
+                                    This requires the ProcMountType feature flag to be enabled.
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  type: string
+                                readOnlyRootFilesystem:
+                                  description: |-
+                                    Whether this container has a read-only root filesystem.
+                                    Default is false.
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  type: boolean
+                                runAsGroup:
+                                  description: |-
+                                    The GID to run the entrypoint of the container process.
+                                    Uses runtime default if unset.
+                                    May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                    PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  format: int64
+                                  type: integer
+                                runAsNonRoot:
+                                  description: |-
+                                    Indicates that the container must run as a non-root user.
+                                    If true, the Kubelet will validate the image at runtime to ensure that it
+                                    does not run as UID 0 (root) and fail to start the container if it does.
+                                    If unset or false, no such validation will be performed.
+                                    May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                    PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                  type: boolean
+                                runAsUser:
+                                  description: |-
+                                    The UID to run the entrypoint of the container process.
+                                    Defaults to user specified in image metadata if unspecified.
+                                    May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                    PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  format: int64
+                                  type: integer
+                                seLinuxOptions:
+                                  description: |-
+                                    The SELinux context to be applied to the container.
+                                    If unspecified, the container runtime will allocate a random SELinux context for each
+                                    container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                    PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  properties:
+                                    level:
+                                      description: Level is SELinux level label that applies to the container.
+                                      type: string
+                                    role:
+                                      description: Role is a SELinux role label that applies to the container.
+                                      type: string
+                                    type:
+                                      description: Type is a SELinux type label that applies to the container.
+                                      type: string
+                                    user:
+                                      description: User is a SELinux user label that applies to the container.
+                                      type: string
+                                  type: object
+                                seccompProfile:
+                                  description: |-
+                                    The seccomp options to use by this container. If seccomp options are
+                                    provided at both the pod & container level, the container options
+                                    override the pod options.
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  properties:
+                                    localhostProfile:
+                                      description: |-
+                                        localhostProfile indicates a profile defined in a file on the node should be used.
+                                        The profile must be preconfigured on the node to work.
+                                        Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                                        Must be set if type is "Localhost". Must NOT be set for any other type.
+                                      type: string
+                                    type:
+                                      description: |-
+                                        type indicates which kind of seccomp profile will be applied.
+                                        Valid options are:
+
+                                        Localhost - a profile defined in a file on the node should be used.
+                                        RuntimeDefault - the container runtime default profile should be used.
+                                        Unconfined - no profile should be applied.
+                                      type: string
+                                  required:
+                                    - type
+                                  type: object
+                                windowsOptions:
+                                  description: |-
+                                    The Windows specific settings applied to all containers.
+                                    If unspecified, the options from the PodSecurityContext will be used.
+                                    If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                    Note that this field cannot be set when spec.os.name is linux.
+                                  properties:
+                                    gmsaCredentialSpec:
+                                      description: |-
+                                        GMSACredentialSpec is where the GMSA admission webhook
+                                        (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
+                                        GMSA credential spec named by the GMSACredentialSpecName field.
+                                      type: string
+                                    gmsaCredentialSpecName:
+                                      description: GMSACredentialSpecName is the name of the GMSA credential spec to use.
+                                      type: string
+                                    hostProcess:
+                                      description: |-
+                                        HostProcess determines if a container should be run as a 'Host Process' container.
+                                        All of a Pod's containers must have the same effective HostProcess value
+                                        (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
+                                        In addition, if HostProcess is true then HostNetwork must also be set to true.
+                                      type: boolean
+                                    runAsUserName:
+                                      description: |-
+                                        The UserName in Windows to run the entrypoint of the container process.
+                                        Defaults to the user specified in image metadata if unspecified.
+                                        May also be set in PodSecurityContext. If set in both SecurityContext and
+                                        PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                      type: string
+                                  type: object
+                              type: object
+                            startupProbe:
+                              description: |-
+                                StartupProbe indicates that the Pod has successfully initialized.
+                                If specified, no other probes are executed until this completes successfully.
+                                If this probe fails, the Pod will be restarted, just as if the livenessProbe failed.
+                                This can be used to provide different probe parameters at the beginning of a Pod's lifecycle,
+                                when it might take a long time to load data or warm a cache, than during steady-state operation.
+                                This cannot be updated.
+                                More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                              properties:
+                                exec:
+                                  description: Exec specifies a command to execute in the container.
+                                  properties:
+                                    command:
+                                      description: |-
+                                        Command is the command line to execute inside the container, the working directory for the
+                                        command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                        not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                        a shell, you need to explicitly call out to that shell.
+                                        Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                failureThreshold:
+                                  description: |-
+                                    Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                                    Defaults to 3. Minimum value is 1.
+                                  format: int32
+                                  type: integer
+                                grpc:
+                                  description: GRPC specifies a GRPC HealthCheckRequest.
+                                  properties:
+                                    port:
+                                      description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                      format: int32
+                                      type: integer
+                                    service:
+                                      default: ""
+                                      description: |-
+                                        Service is the name of the service to place in the gRPC HealthCheckRequest
+                                        (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                        If this is not specified, the default behavior is defined by gRPC.
+                                      type: string
+                                  required:
+                                    - port
+                                  type: object
+                                httpGet:
+                                  description: HTTPGet specifies an HTTP GET request to perform.
+                                  properties:
+                                    host:
+                                      description: |-
+                                        Host name to connect to, defaults to the pod IP. You probably want to set
+                                        "Host" in httpHeaders instead.
+                                      type: string
+                                    httpHeaders:
+                                      description: Custom headers to set in the request. HTTP allows repeated headers.
+                                      items:
+                                        description: HTTPHeader describes a custom header to be used in HTTP probes
+                                        properties:
+                                          name:
+                                            description: |-
+                                              The header field name.
+                                              This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                            type: string
+                                          value:
+                                            description: The header field value
+                                            type: string
+                                        required:
+                                          - name
+                                          - value
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    path:
+                                      description: Path to access on the HTTP server.
+                                      type: string
+                                    port:
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      description: |-
+                                        Name or number of the port to access on the container.
+                                        Number must be in the range 1 to 65535.
+                                        Name must be an IANA_SVC_NAME.
+                                      x-kubernetes-int-or-string: true
+                                    scheme:
+                                      description: |-
+                                        Scheme to use for connecting to the host.
+                                        Defaults to HTTP.
+                                      type: string
+                                  required:
+                                    - port
+                                  type: object
+                                initialDelaySeconds:
+                                  description: |-
+                                    Number of seconds after the container has started before liveness probes are initiated.
+                                    More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                  format: int32
+                                  type: integer
+                                periodSeconds:
+                                  description: |-
+                                    How often (in seconds) to perform the probe.
+                                    Default to 10 seconds. Minimum value is 1.
+                                  format: int32
+                                  type: integer
+                                successThreshold:
+                                  description: |-
+                                    Minimum consecutive successes for the probe to be considered successful after having failed.
+                                    Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                                  format: int32
+                                  type: integer
+                                tcpSocket:
+                                  description: TCPSocket specifies a connection to a TCP port.
+                                  properties:
+                                    host:
+                                      description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                      type: string
+                                    port:
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      description: |-
+                                        Number or name of the port to access on the container.
+                                        Number must be in the range 1 to 65535.
+                                        Name must be an IANA_SVC_NAME.
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                    - port
+                                  type: object
+                                terminationGracePeriodSeconds:
+                                  description: |-
+                                    Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+                                    The grace period is the duration in seconds after the processes running in the pod are sent
+                                    a termination signal and the time when the processes are forcibly halted with a kill signal.
+                                    Set this value longer than the expected cleanup time for your process.
+                                    If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+                                    value overrides the value provided by the pod spec.
+                                    Value must be non-negative integer. The value zero indicates stop immediately via
+                                    the kill signal (no opportunity to shut down).
+                                    This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+                                    Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
+                                  format: int64
+                                  type: integer
+                                timeoutSeconds:
+                                  description: |-
+                                    Number of seconds after which the probe times out.
+                                    Defaults to 1 second. Minimum value is 1.
+                                    More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                  format: int32
+                                  type: integer
+                              type: object
+                            stdin:
+                              description: |-
+                                Whether this container should allocate a buffer for stdin in the container runtime. If this
+                                is not set, reads from stdin in the container will always result in EOF.
+                                Default is false.
+                              type: boolean
+                            stdinOnce:
+                              description: |-
+                                Whether the container runtime should close the stdin channel after it has been opened by
+                                a single attach. When stdin is true the stdin stream will remain open across multiple attach
+                                sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the
+                                first client attaches to stdin, and then remains open and accepts data until the client disconnects,
+                                at which time stdin is closed and remains closed until the container is restarted. If this
+                                flag is false, a container processes that reads from stdin will never receive an EOF.
+                                Default is false
+                              type: boolean
+                            terminationMessagePath:
+                              description: |-
+                                Optional: Path at which the file to which the container's termination message
+                                will be written is mounted into the container's filesystem.
+                                Message written is intended to be brief final status, such as an assertion failure message.
+                                Will be truncated by the node if greater than 4096 bytes. The total message length across
+                                all containers will be limited to 12kb.
+                                Defaults to /dev/termination-log.
+                                Cannot be updated.
+                              type: string
+                            terminationMessagePolicy:
+                              description: |-
+                                Indicate how the termination message should be populated. File will use the contents of
+                                terminationMessagePath to populate the container status message on both success and failure.
+                                FallbackToLogsOnError will use the last chunk of container log output if the termination
+                                message file is empty and the container exited with an error.
+                                The log output is limited to 2048 bytes or 80 lines, whichever is smaller.
+                                Defaults to File.
+                                Cannot be updated.
+                              type: string
+                            tty:
+                              description: |-
+                                Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.
+                                Default is false.
+                              type: boolean
+                            volumeDevices:
+                              description: volumeDevices is the list of block devices to be used by the container.
+                              items:
+                                description: volumeDevice describes a mapping of a raw block device within a container.
+                                properties:
+                                  devicePath:
+                                    description: devicePath is the path inside of the container that the device will be mapped to.
+                                    type: string
+                                  name:
+                                    description: name must match the name of a persistentVolumeClaim in the pod
+                                    type: string
+                                required:
+                                  - devicePath
+                                  - name
+                                type: object
+                              type: array
+                              x-kubernetes-list-map-keys:
+                                - devicePath
+                              x-kubernetes-list-type: map
+                            volumeMounts:
+                              description: |-
+                                Pod volumes to mount into the container's filesystem.
+                                Cannot be updated.
+                              items:
+                                description: VolumeMount describes a mounting of a Volume within a container.
+                                properties:
+                                  mountPath:
+                                    description: |-
+                                      Path within the container at which the volume should be mounted.  Must
+                                      not contain ':'.
+                                    type: string
+                                  mountPropagation:
+                                    description: |-
+                                      mountPropagation determines how mounts are propagated from the host
+                                      to container and the other way around.
+                                      When not set, MountPropagationNone is used.
+                                      This field is beta in 1.10.
+                                      When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
+                                      (which defaults to None).
+                                    type: string
+                                  name:
+                                    description: This must match the Name of a Volume.
+                                    type: string
+                                  readOnly:
+                                    description: |-
+                                      Mounted read-only if true, read-write otherwise (false or unspecified).
+                                      Defaults to false.
+                                    type: boolean
+                                  recursiveReadOnly:
+                                    description: |-
+                                      RecursiveReadOnly specifies whether read-only mounts should be handled
+                                      recursively.
+
+                                      If ReadOnly is false, this field has no meaning and must be unspecified.
+
+                                      If ReadOnly is true, and this field is set to Disabled, the mount is not made
+                                      recursively read-only.  If this field is set to IfPossible, the mount is made
+                                      recursively read-only, if it is supported by the container runtime.  If this
+                                      field is set to Enabled, the mount is made recursively read-only if it is
+                                      supported by the container runtime, otherwise the pod will not be started and
+                                      an error will be generated to indicate the reason.
+
+                                      If this field is set to IfPossible or Enabled, MountPropagation must be set to
+                                      None (or be unspecified, which defaults to None).
+
+                                      If this field is not specified, it is treated as an equivalent of Disabled.
+                                    type: string
+                                  subPath:
+                                    description: |-
+                                      Path within the volume from which the container's volume should be mounted.
+                                      Defaults to "" (volume's root).
+                                    type: string
+                                  subPathExpr:
+                                    description: |-
+                                      Expanded path within the volume from which the container's volume should be mounted.
+                                      Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
+                                      Defaults to "" (volume's root).
+                                      SubPathExpr and SubPath are mutually exclusive.
+                                    type: string
+                                required:
+                                  - mountPath
+                                  - name
+                                type: object
+                              type: array
+                              x-kubernetes-list-map-keys:
+                                - mountPath
+                              x-kubernetes-list-type: map
+                            workingDir:
+                              description: |-
+                                Container's working directory.
+                                If not specified, the container runtime's default will be used, which
+                                might be configured in the container image.
+                                Cannot be updated.
+                              type: string
+                          required:
+                            - name
+                          type: object
+                        type: array
+                      additionalInitContainers:
+                        description: AdditionalInitContainers allows adding additional init containers to the Control Plane deployment.
+                        items:
+                          description: A single application container that you want to run within a pod.
+                          properties:
+                            args:
+                              description: |-
+                                Arguments to the entrypoint.
+                                The container image's CMD is used if this is not provided.
+                                Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+                                cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+                                to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+                                produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+                                of whether the variable exists or not. Cannot be updated.
+                                More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            command:
+                              description: |-
+                                Entrypoint array. Not executed within a shell.
+                                The container image's ENTRYPOINT is used if this is not provided.
+                                Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+                                cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+                                to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+                                produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+                                of whether the variable exists or not. Cannot be updated.
+                                More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            env:
+                              description: |-
+                                List of environment variables to set in the container.
+                                Cannot be updated.
+                              items:
+                                description: EnvVar represents an environment variable present in a Container.
+                                properties:
+                                  name:
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
+                                    type: string
+                                  value:
+                                    description: |-
+                                      Variable references $(VAR_NAME) are expanded
+                                      using the previously defined environment variables in the container and
+                                      any service environment variables. If a variable cannot be resolved,
+                                      the reference in the input string will be unchanged. Double $$ are reduced
+                                      to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+                                      "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+                                      Escaped references will never be expanded, regardless of whether the variable
+                                      exists or not.
+                                      Defaults to "".
+                                    type: string
+                                  valueFrom:
+                                    description: Source for the environment variable's value. Cannot be used if value is not empty.
+                                    properties:
+                                      configMapKeyRef:
+                                        description: Selects a key of a ConfigMap.
+                                        properties:
+                                          key:
+                                            description: The key to select.
+                                            type: string
+                                          name:
+                                            default: ""
+                                            description: |-
+                                              Name of the referent.
+                                              This field is effectively required, but due to backwards compatibility is
+                                              allowed to be empty. Instances of this type with an empty value here are
+                                              almost certainly wrong.
+                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                            type: string
+                                          optional:
+                                            description: Specify whether the ConfigMap or its key must be defined
+                                            type: boolean
+                                        required:
+                                          - key
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      fieldRef:
+                                        description: |-
+                                          Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
+                                          spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
+                                        properties:
+                                          apiVersion:
+                                            description: Version of the schema the FieldPath is written in terms of, defaults to "v1".
+                                            type: string
+                                          fieldPath:
+                                            description: Path of the field to select in the specified API version.
+                                            type: string
+                                        required:
+                                          - fieldPath
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount containing the env file.
+                                            type: string
+                                        required:
+                                          - key
+                                          - path
+                                          - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      resourceFieldRef:
+                                        description: |-
+                                          Selects a resource of the container: only resources limits and requests
+                                          (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
+                                        properties:
+                                          containerName:
+                                            description: 'Container name: required for volumes, optional for env vars'
+                                            type: string
+                                          divisor:
+                                            anyOf:
+                                              - type: integer
+                                              - type: string
+                                            description: Specifies the output format of the exposed resources, defaults to "1"
+                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                            x-kubernetes-int-or-string: true
+                                          resource:
+                                            description: 'Required: resource to select'
+                                            type: string
+                                        required:
+                                          - resource
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      secretKeyRef:
+                                        description: Selects a key of a secret in the pod's namespace
+                                        properties:
+                                          key:
+                                            description: The key of the secret to select from.  Must be a valid secret key.
+                                            type: string
+                                          name:
+                                            default: ""
+                                            description: |-
+                                              Name of the referent.
+                                              This field is effectively required, but due to backwards compatibility is
+                                              allowed to be empty. Instances of this type with an empty value here are
+                                              almost certainly wrong.
+                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                            type: string
+                                          optional:
+                                            description: Specify whether the Secret or its key must be defined
+                                            type: boolean
+                                        required:
+                                          - key
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                    type: object
+                                required:
+                                  - name
+                                type: object
+                              type: array
+                              x-kubernetes-list-map-keys:
+                                - name
+                              x-kubernetes-list-type: map
+                            envFrom:
+                              description: |-
+                                List of sources to populate environment variables in the container.
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
+                                sources, the value associated with the last source will take precedence.
+                                Values defined by an Env with a duplicate key will take precedence.
+                                Cannot be updated.
+                              items:
+                                description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                properties:
+                                  configMapRef:
+                                    description: The ConfigMap to select from
+                                    properties:
+                                      name:
+                                        default: ""
+                                        description: |-
+                                          Name of the referent.
+                                          This field is effectively required, but due to backwards compatibility is
+                                          allowed to be empty. Instances of this type with an empty value here are
+                                          almost certainly wrong.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                      optional:
+                                        description: Specify whether the ConfigMap must be defined
+                                        type: boolean
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                  prefix:
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
+                                    type: string
+                                  secretRef:
+                                    description: The Secret to select from
+                                    properties:
+                                      name:
+                                        default: ""
+                                        description: |-
+                                          Name of the referent.
+                                          This field is effectively required, but due to backwards compatibility is
+                                          allowed to be empty. Instances of this type with an empty value here are
+                                          almost certainly wrong.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                      optional:
+                                        description: Specify whether the Secret must be defined
+                                        type: boolean
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            image:
+                              description: |-
+                                Container image name.
+                                More info: https://kubernetes.io/docs/concepts/containers/images
+                                This field is optional to allow higher level config management to default or override
+                                container images in workload controllers like Deployments and StatefulSets.
+                              type: string
+                            imagePullPolicy:
+                              description: |-
+                                Image pull policy.
+                                One of Always, Never, IfNotPresent.
+                                Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+                                Cannot be updated.
+                                More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
+                              type: string
+                            lifecycle:
+                              description: |-
+                                Actions that the management system should take in response to container lifecycle events.
+                                Cannot be updated.
+                              properties:
+                                postStart:
+                                  description: |-
+                                    PostStart is called immediately after a container is created. If the handler fails,
+                                    the container is terminated and restarted according to its restart policy.
+                                    Other management of the container blocks until the hook completes.
+                                    More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
+                                  properties:
+                                    exec:
+                                      description: Exec specifies a command to execute in the container.
+                                      properties:
+                                        command:
+                                          description: |-
+                                            Command is the command line to execute inside the container, the working directory for the
+                                            command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                            not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                            a shell, you need to explicitly call out to that shell.
+                                            Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                    httpGet:
+                                      description: HTTPGet specifies an HTTP GET request to perform.
+                                      properties:
+                                        host:
+                                          description: |-
+                                            Host name to connect to, defaults to the pod IP. You probably want to set
+                                            "Host" in httpHeaders instead.
+                                          type: string
+                                        httpHeaders:
+                                          description: Custom headers to set in the request. HTTP allows repeated headers.
+                                          items:
+                                            description: HTTPHeader describes a custom header to be used in HTTP probes
+                                            properties:
+                                              name:
+                                                description: |-
+                                                  The header field name.
+                                                  This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                                type: string
+                                              value:
+                                                description: The header field value
+                                                type: string
+                                            required:
+                                              - name
+                                              - value
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        path:
+                                          description: Path to access on the HTTP server.
+                                          type: string
+                                        port:
+                                          anyOf:
+                                            - type: integer
+                                            - type: string
+                                          description: |-
+                                            Name or number of the port to access on the container.
+                                            Number must be in the range 1 to 65535.
+                                            Name must be an IANA_SVC_NAME.
+                                          x-kubernetes-int-or-string: true
+                                        scheme:
+                                          description: |-
+                                            Scheme to use for connecting to the host.
+                                            Defaults to HTTP.
+                                          type: string
+                                      required:
+                                        - port
+                                      type: object
+                                    sleep:
+                                      description: Sleep represents a duration that the container should sleep.
+                                      properties:
+                                        seconds:
+                                          description: Seconds is the number of seconds to sleep.
+                                          format: int64
+                                          type: integer
+                                      required:
+                                        - seconds
+                                      type: object
+                                    tcpSocket:
+                                      description: |-
+                                        Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept
+                                        for backward compatibility. There is no validation of this field and
+                                        lifecycle hooks will fail at runtime when it is specified.
+                                      properties:
+                                        host:
+                                          description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                          type: string
+                                        port:
+                                          anyOf:
+                                            - type: integer
+                                            - type: string
+                                          description: |-
+                                            Number or name of the port to access on the container.
+                                            Number must be in the range 1 to 65535.
+                                            Name must be an IANA_SVC_NAME.
+                                          x-kubernetes-int-or-string: true
+                                      required:
+                                        - port
+                                      type: object
+                                  type: object
+                                preStop:
+                                  description: |-
+                                    PreStop is called immediately before a container is terminated due to an
+                                    API request or management event such as liveness/startup probe failure,
+                                    preemption, resource contention, etc. The handler is not called if the
+                                    container crashes or exits. The Pod's termination grace period countdown begins before the
+                                    PreStop hook is executed. Regardless of the outcome of the handler, the
+                                    container will eventually terminate within the Pod's termination grace
+                                    period (unless delayed by finalizers). Other management of the container blocks until the hook completes
+                                    or until the termination grace period is reached.
+                                    More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
+                                  properties:
+                                    exec:
+                                      description: Exec specifies a command to execute in the container.
+                                      properties:
+                                        command:
+                                          description: |-
+                                            Command is the command line to execute inside the container, the working directory for the
+                                            command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                            not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                            a shell, you need to explicitly call out to that shell.
+                                            Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                    httpGet:
+                                      description: HTTPGet specifies an HTTP GET request to perform.
+                                      properties:
+                                        host:
+                                          description: |-
+                                            Host name to connect to, defaults to the pod IP. You probably want to set
+                                            "Host" in httpHeaders instead.
+                                          type: string
+                                        httpHeaders:
+                                          description: Custom headers to set in the request. HTTP allows repeated headers.
+                                          items:
+                                            description: HTTPHeader describes a custom header to be used in HTTP probes
+                                            properties:
+                                              name:
+                                                description: |-
+                                                  The header field name.
+                                                  This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                                type: string
+                                              value:
+                                                description: The header field value
+                                                type: string
+                                            required:
+                                              - name
+                                              - value
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        path:
+                                          description: Path to access on the HTTP server.
+                                          type: string
+                                        port:
+                                          anyOf:
+                                            - type: integer
+                                            - type: string
+                                          description: |-
+                                            Name or number of the port to access on the container.
+                                            Number must be in the range 1 to 65535.
+                                            Name must be an IANA_SVC_NAME.
+                                          x-kubernetes-int-or-string: true
+                                        scheme:
+                                          description: |-
+                                            Scheme to use for connecting to the host.
+                                            Defaults to HTTP.
+                                          type: string
+                                      required:
+                                        - port
+                                      type: object
+                                    sleep:
+                                      description: Sleep represents a duration that the container should sleep.
+                                      properties:
+                                        seconds:
+                                          description: Seconds is the number of seconds to sleep.
+                                          format: int64
+                                          type: integer
+                                      required:
+                                        - seconds
+                                      type: object
+                                    tcpSocket:
+                                      description: |-
+                                        Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept
+                                        for backward compatibility. There is no validation of this field and
+                                        lifecycle hooks will fail at runtime when it is specified.
+                                      properties:
+                                        host:
+                                          description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                          type: string
+                                        port:
+                                          anyOf:
+                                            - type: integer
+                                            - type: string
+                                          description: |-
+                                            Number or name of the port to access on the container.
+                                            Number must be in the range 1 to 65535.
+                                            Name must be an IANA_SVC_NAME.
+                                          x-kubernetes-int-or-string: true
+                                      required:
+                                        - port
+                                      type: object
+                                  type: object
+                                stopSignal:
+                                  description: |-
+                                    StopSignal defines which signal will be sent to a container when it is being stopped.
+                                    If not specified, the default is defined by the container runtime in use.
+                                    StopSignal can only be set for Pods with a non-empty .spec.os.name
+                                  type: string
+                              type: object
+                            livenessProbe:
+                              description: |-
+                                Periodic probe of container liveness.
+                                Container will be restarted if the probe fails.
+                                Cannot be updated.
+                                More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                              properties:
+                                exec:
+                                  description: Exec specifies a command to execute in the container.
+                                  properties:
+                                    command:
+                                      description: |-
+                                        Command is the command line to execute inside the container, the working directory for the
+                                        command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                        not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                        a shell, you need to explicitly call out to that shell.
+                                        Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                failureThreshold:
+                                  description: |-
+                                    Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                                    Defaults to 3. Minimum value is 1.
+                                  format: int32
+                                  type: integer
+                                grpc:
+                                  description: GRPC specifies a GRPC HealthCheckRequest.
+                                  properties:
+                                    port:
+                                      description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                      format: int32
+                                      type: integer
+                                    service:
+                                      default: ""
+                                      description: |-
+                                        Service is the name of the service to place in the gRPC HealthCheckRequest
+                                        (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                        If this is not specified, the default behavior is defined by gRPC.
+                                      type: string
+                                  required:
+                                    - port
+                                  type: object
+                                httpGet:
+                                  description: HTTPGet specifies an HTTP GET request to perform.
+                                  properties:
+                                    host:
+                                      description: |-
+                                        Host name to connect to, defaults to the pod IP. You probably want to set
+                                        "Host" in httpHeaders instead.
+                                      type: string
+                                    httpHeaders:
+                                      description: Custom headers to set in the request. HTTP allows repeated headers.
+                                      items:
+                                        description: HTTPHeader describes a custom header to be used in HTTP probes
+                                        properties:
+                                          name:
+                                            description: |-
+                                              The header field name.
+                                              This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                            type: string
+                                          value:
+                                            description: The header field value
+                                            type: string
+                                        required:
+                                          - name
+                                          - value
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    path:
+                                      description: Path to access on the HTTP server.
+                                      type: string
+                                    port:
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      description: |-
+                                        Name or number of the port to access on the container.
+                                        Number must be in the range 1 to 65535.
+                                        Name must be an IANA_SVC_NAME.
+                                      x-kubernetes-int-or-string: true
+                                    scheme:
+                                      description: |-
+                                        Scheme to use for connecting to the host.
+                                        Defaults to HTTP.
+                                      type: string
+                                  required:
+                                    - port
+                                  type: object
+                                initialDelaySeconds:
+                                  description: |-
+                                    Number of seconds after the container has started before liveness probes are initiated.
+                                    More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                  format: int32
+                                  type: integer
+                                periodSeconds:
+                                  description: |-
+                                    How often (in seconds) to perform the probe.
+                                    Default to 10 seconds. Minimum value is 1.
+                                  format: int32
+                                  type: integer
+                                successThreshold:
+                                  description: |-
+                                    Minimum consecutive successes for the probe to be considered successful after having failed.
+                                    Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                                  format: int32
+                                  type: integer
+                                tcpSocket:
+                                  description: TCPSocket specifies a connection to a TCP port.
+                                  properties:
+                                    host:
+                                      description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                      type: string
+                                    port:
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      description: |-
+                                        Number or name of the port to access on the container.
+                                        Number must be in the range 1 to 65535.
+                                        Name must be an IANA_SVC_NAME.
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                    - port
+                                  type: object
+                                terminationGracePeriodSeconds:
+                                  description: |-
+                                    Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+                                    The grace period is the duration in seconds after the processes running in the pod are sent
+                                    a termination signal and the time when the processes are forcibly halted with a kill signal.
+                                    Set this value longer than the expected cleanup time for your process.
+                                    If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+                                    value overrides the value provided by the pod spec.
+                                    Value must be non-negative integer. The value zero indicates stop immediately via
+                                    the kill signal (no opportunity to shut down).
+                                    This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+                                    Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
+                                  format: int64
+                                  type: integer
+                                timeoutSeconds:
+                                  description: |-
+                                    Number of seconds after which the probe times out.
+                                    Defaults to 1 second. Minimum value is 1.
+                                    More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                  format: int32
+                                  type: integer
+                              type: object
+                            name:
+                              description: |-
+                                Name of the container specified as a DNS_LABEL.
+                                Each container in a pod must have a unique name (DNS_LABEL).
+                                Cannot be updated.
+                              type: string
+                            ports:
+                              description: |-
+                                List of ports to expose from the container. Not specifying a port here
+                                DOES NOT prevent that port from being exposed. Any port which is
+                                listening on the default "0.0.0.0" address inside a container will be
+                                accessible from the network.
+                                Modifying this array with strategic merge patch may corrupt the data.
+                                For more information See https://github.com/kubernetes/kubernetes/issues/108255.
+                                Cannot be updated.
+                              items:
+                                description: ContainerPort represents a network port in a single container.
+                                properties:
+                                  containerPort:
+                                    description: |-
+                                      Number of port to expose on the pod's IP address.
+                                      This must be a valid port number, 0 < x < 65536.
+                                    format: int32
+                                    type: integer
+                                  hostIP:
+                                    description: What host IP to bind the external port to.
+                                    type: string
+                                  hostPort:
+                                    description: |-
+                                      Number of port to expose on the host.
+                                      If specified, this must be a valid port number, 0 < x < 65536.
+                                      If HostNetwork is specified, this must match ContainerPort.
+                                      Most containers do not need this.
+                                    format: int32
+                                    type: integer
+                                  name:
+                                    description: |-
+                                      If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
+                                      named port in a pod must have a unique name. Name for the port that can be
+                                      referred to by services.
+                                    type: string
+                                  protocol:
+                                    default: TCP
+                                    description: |-
+                                      Protocol for port. Must be UDP, TCP, or SCTP.
+                                      Defaults to "TCP".
+                                    type: string
+                                required:
+                                  - containerPort
+                                type: object
+                              type: array
+                              x-kubernetes-list-map-keys:
+                                - containerPort
+                                - protocol
+                              x-kubernetes-list-type: map
+                            readinessProbe:
+                              description: |-
+                                Periodic probe of container service readiness.
+                                Container will be removed from service endpoints if the probe fails.
+                                Cannot be updated.
+                                More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                              properties:
+                                exec:
+                                  description: Exec specifies a command to execute in the container.
+                                  properties:
+                                    command:
+                                      description: |-
+                                        Command is the command line to execute inside the container, the working directory for the
+                                        command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                        not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                        a shell, you need to explicitly call out to that shell.
+                                        Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                failureThreshold:
+                                  description: |-
+                                    Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                                    Defaults to 3. Minimum value is 1.
+                                  format: int32
+                                  type: integer
+                                grpc:
+                                  description: GRPC specifies a GRPC HealthCheckRequest.
+                                  properties:
+                                    port:
+                                      description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                      format: int32
+                                      type: integer
+                                    service:
+                                      default: ""
+                                      description: |-
+                                        Service is the name of the service to place in the gRPC HealthCheckRequest
+                                        (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                        If this is not specified, the default behavior is defined by gRPC.
+                                      type: string
+                                  required:
+                                    - port
+                                  type: object
+                                httpGet:
+                                  description: HTTPGet specifies an HTTP GET request to perform.
+                                  properties:
+                                    host:
+                                      description: |-
+                                        Host name to connect to, defaults to the pod IP. You probably want to set
+                                        "Host" in httpHeaders instead.
+                                      type: string
+                                    httpHeaders:
+                                      description: Custom headers to set in the request. HTTP allows repeated headers.
+                                      items:
+                                        description: HTTPHeader describes a custom header to be used in HTTP probes
+                                        properties:
+                                          name:
+                                            description: |-
+                                              The header field name.
+                                              This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                            type: string
+                                          value:
+                                            description: The header field value
+                                            type: string
+                                        required:
+                                          - name
+                                          - value
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    path:
+                                      description: Path to access on the HTTP server.
+                                      type: string
+                                    port:
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      description: |-
+                                        Name or number of the port to access on the container.
+                                        Number must be in the range 1 to 65535.
+                                        Name must be an IANA_SVC_NAME.
+                                      x-kubernetes-int-or-string: true
+                                    scheme:
+                                      description: |-
+                                        Scheme to use for connecting to the host.
+                                        Defaults to HTTP.
+                                      type: string
+                                  required:
+                                    - port
+                                  type: object
+                                initialDelaySeconds:
+                                  description: |-
+                                    Number of seconds after the container has started before liveness probes are initiated.
+                                    More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                  format: int32
+                                  type: integer
+                                periodSeconds:
+                                  description: |-
+                                    How often (in seconds) to perform the probe.
+                                    Default to 10 seconds. Minimum value is 1.
+                                  format: int32
+                                  type: integer
+                                successThreshold:
+                                  description: |-
+                                    Minimum consecutive successes for the probe to be considered successful after having failed.
+                                    Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                                  format: int32
+                                  type: integer
+                                tcpSocket:
+                                  description: TCPSocket specifies a connection to a TCP port.
+                                  properties:
+                                    host:
+                                      description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                      type: string
+                                    port:
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      description: |-
+                                        Number or name of the port to access on the container.
+                                        Number must be in the range 1 to 65535.
+                                        Name must be an IANA_SVC_NAME.
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                    - port
+                                  type: object
+                                terminationGracePeriodSeconds:
+                                  description: |-
+                                    Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+                                    The grace period is the duration in seconds after the processes running in the pod are sent
+                                    a termination signal and the time when the processes are forcibly halted with a kill signal.
+                                    Set this value longer than the expected cleanup time for your process.
+                                    If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+                                    value overrides the value provided by the pod spec.
+                                    Value must be non-negative integer. The value zero indicates stop immediately via
+                                    the kill signal (no opportunity to shut down).
+                                    This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+                                    Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
+                                  format: int64
+                                  type: integer
+                                timeoutSeconds:
+                                  description: |-
+                                    Number of seconds after which the probe times out.
+                                    Defaults to 1 second. Minimum value is 1.
+                                    More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                  format: int32
+                                  type: integer
+                              type: object
+                            resizePolicy:
+                              description: |-
+                                Resources resize policy for the container.
+                                This field cannot be set on ephemeral containers.
+                              items:
+                                description: ContainerResizePolicy represents resource resize policy for the container.
+                                properties:
+                                  resourceName:
+                                    description: |-
+                                      Name of the resource to which this resource resize policy applies.
+                                      Supported values: cpu, memory.
+                                    type: string
+                                  restartPolicy:
+                                    description: |-
+                                      Restart policy to apply when specified resource is resized.
+                                      If not specified, it defaults to NotRequired.
+                                    type: string
+                                required:
+                                  - resourceName
+                                  - restartPolicy
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            resources:
+                              description: |-
+                                Compute Resources required by this container.
+                                Cannot be updated.
+                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                              properties:
+                                claims:
+                                  description: |-
+                                    Claims lists the names of resources, defined in spec.resourceClaims,
+                                    that are used by this container.
+
+                                    This field depends on the
+                                    DynamicResourceAllocation feature gate.
+
+                                    This field is immutable. It can only be set for containers.
+                                  items:
+                                    description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+                                    properties:
+                                      name:
+                                        description: |-
+                                          Name must match the name of one entry in pod.spec.resourceClaims of
+                                          the Pod where this field is used. It makes that resource available
+                                          inside a container.
+                                        type: string
+                                      request:
+                                        description: |-
+                                          Request is the name chosen for a request in the referenced claim.
+                                          If empty, everything from the claim is made available, otherwise
+                                          only the result of this request.
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-map-keys:
+                                    - name
+                                  x-kubernetes-list-type: map
+                                limits:
+                                  additionalProperties:
+                                    anyOf:
+                                      - type: integer
+                                      - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  description: |-
+                                    Limits describes the maximum amount of compute resources allowed.
+                                    More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                  type: object
+                                requests:
+                                  additionalProperties:
+                                    anyOf:
+                                      - type: integer
+                                      - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  description: |-
+                                    Requests describes the minimum amount of compute resources required.
+                                    If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                    otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                                    More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                  type: object
+                              type: object
+                            restartPolicy:
+                              description: |-
+                                RestartPolicy defines the restart behavior of individual containers in a pod.
+                                This overrides the pod-level restart policy. When this field is not specified,
+                                the restart behavior is defined by the Pod's restart policy and the container type.
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
+                                this init container will be continually restarted on
+                                exit until all regular containers have terminated. Once all regular
+                                containers have completed, all init containers with restartPolicy "Always"
+                                will be shut down. This lifecycle differs from normal init containers and
+                                is often referred to as a "sidecar" container. Although this init
+                                container still starts in the init container sequence, it does not wait
+                                for the container to complete before proceeding to the next init
+                                container. Instead, the next init container starts immediately after this
+                                init container is started, or after any startupProbe has successfully
+                                completed.
+                              type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                      - operator
+                                    type: object
+                                required:
+                                  - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            securityContext:
+                              description: |-
+                                SecurityContext defines the security options the container should be run with.
+                                If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
+                                More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+                              properties:
+                                allowPrivilegeEscalation:
+                                  description: |-
+                                    AllowPrivilegeEscalation controls whether a process can gain more
+                                    privileges than its parent process. This bool directly controls if
+                                    the no_new_privs flag will be set on the container process.
+                                    AllowPrivilegeEscalation is true always when the container is:
+                                    1) run as Privileged
+                                    2) has CAP_SYS_ADMIN
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  type: boolean
+                                appArmorProfile:
+                                  description: |-
+                                    appArmorProfile is the AppArmor options to use by this container. If set, this profile
+                                    overrides the pod's appArmorProfile.
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  properties:
+                                    localhostProfile:
+                                      description: |-
+                                        localhostProfile indicates a profile loaded on the node that should be used.
+                                        The profile must be preconfigured on the node to work.
+                                        Must match the loaded name of the profile.
+                                        Must be set if and only if type is "Localhost".
+                                      type: string
+                                    type:
+                                      description: |-
+                                        type indicates which kind of AppArmor profile will be applied.
+                                        Valid options are:
+                                          Localhost - a profile pre-loaded on the node.
+                                          RuntimeDefault - the container runtime's default profile.
+                                          Unconfined - no AppArmor enforcement.
+                                      type: string
+                                  required:
+                                    - type
+                                  type: object
+                                capabilities:
+                                  description: |-
+                                    The capabilities to add/drop when running containers.
+                                    Defaults to the default set of capabilities granted by the container runtime.
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  properties:
+                                    add:
+                                      description: Added capabilities
+                                      items:
+                                        description: Capability represent POSIX capabilities type
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    drop:
+                                      description: Removed capabilities
+                                      items:
+                                        description: Capability represent POSIX capabilities type
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                privileged:
+                                  description: |-
+                                    Run container in privileged mode.
+                                    Processes in privileged containers are essentially equivalent to root on the host.
+                                    Defaults to false.
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  type: boolean
+                                procMount:
+                                  description: |-
+                                    procMount denotes the type of proc mount to use for the containers.
+                                    The default value is Default which uses the container runtime defaults for
+                                    readonly paths and masked paths.
+                                    This requires the ProcMountType feature flag to be enabled.
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  type: string
+                                readOnlyRootFilesystem:
+                                  description: |-
+                                    Whether this container has a read-only root filesystem.
+                                    Default is false.
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  type: boolean
+                                runAsGroup:
+                                  description: |-
+                                    The GID to run the entrypoint of the container process.
+                                    Uses runtime default if unset.
+                                    May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                    PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  format: int64
+                                  type: integer
+                                runAsNonRoot:
+                                  description: |-
+                                    Indicates that the container must run as a non-root user.
+                                    If true, the Kubelet will validate the image at runtime to ensure that it
+                                    does not run as UID 0 (root) and fail to start the container if it does.
+                                    If unset or false, no such validation will be performed.
+                                    May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                    PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                  type: boolean
+                                runAsUser:
+                                  description: |-
+                                    The UID to run the entrypoint of the container process.
+                                    Defaults to user specified in image metadata if unspecified.
+                                    May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                    PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  format: int64
+                                  type: integer
+                                seLinuxOptions:
+                                  description: |-
+                                    The SELinux context to be applied to the container.
+                                    If unspecified, the container runtime will allocate a random SELinux context for each
+                                    container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                    PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  properties:
+                                    level:
+                                      description: Level is SELinux level label that applies to the container.
+                                      type: string
+                                    role:
+                                      description: Role is a SELinux role label that applies to the container.
+                                      type: string
+                                    type:
+                                      description: Type is a SELinux type label that applies to the container.
+                                      type: string
+                                    user:
+                                      description: User is a SELinux user label that applies to the container.
+                                      type: string
+                                  type: object
+                                seccompProfile:
+                                  description: |-
+                                    The seccomp options to use by this container. If seccomp options are
+                                    provided at both the pod & container level, the container options
+                                    override the pod options.
+                                    Note that this field cannot be set when spec.os.name is windows.
+                                  properties:
+                                    localhostProfile:
+                                      description: |-
+                                        localhostProfile indicates a profile defined in a file on the node should be used.
+                                        The profile must be preconfigured on the node to work.
+                                        Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                                        Must be set if type is "Localhost". Must NOT be set for any other type.
+                                      type: string
+                                    type:
+                                      description: |-
+                                        type indicates which kind of seccomp profile will be applied.
+                                        Valid options are:
+
+                                        Localhost - a profile defined in a file on the node should be used.
+                                        RuntimeDefault - the container runtime default profile should be used.
+                                        Unconfined - no profile should be applied.
+                                      type: string
+                                  required:
+                                    - type
+                                  type: object
+                                windowsOptions:
+                                  description: |-
+                                    The Windows specific settings applied to all containers.
+                                    If unspecified, the options from the PodSecurityContext will be used.
+                                    If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                    Note that this field cannot be set when spec.os.name is linux.
+                                  properties:
+                                    gmsaCredentialSpec:
+                                      description: |-
+                                        GMSACredentialSpec is where the GMSA admission webhook
+                                        (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
+                                        GMSA credential spec named by the GMSACredentialSpecName field.
+                                      type: string
+                                    gmsaCredentialSpecName:
+                                      description: GMSACredentialSpecName is the name of the GMSA credential spec to use.
+                                      type: string
+                                    hostProcess:
+                                      description: |-
+                                        HostProcess determines if a container should be run as a 'Host Process' container.
+                                        All of a Pod's containers must have the same effective HostProcess value
+                                        (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
+                                        In addition, if HostProcess is true then HostNetwork must also be set to true.
+                                      type: boolean
+                                    runAsUserName:
+                                      description: |-
+                                        The UserName in Windows to run the entrypoint of the container process.
+                                        Defaults to the user specified in image metadata if unspecified.
+                                        May also be set in PodSecurityContext. If set in both SecurityContext and
+                                        PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                      type: string
+                                  type: object
+                              type: object
+                            startupProbe:
+                              description: |-
+                                StartupProbe indicates that the Pod has successfully initialized.
+                                If specified, no other probes are executed until this completes successfully.
+                                If this probe fails, the Pod will be restarted, just as if the livenessProbe failed.
+                                This can be used to provide different probe parameters at the beginning of a Pod's lifecycle,
+                                when it might take a long time to load data or warm a cache, than during steady-state operation.
+                                This cannot be updated.
+                                More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                              properties:
+                                exec:
+                                  description: Exec specifies a command to execute in the container.
+                                  properties:
+                                    command:
+                                      description: |-
+                                        Command is the command line to execute inside the container, the working directory for the
+                                        command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                        not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                        a shell, you need to explicitly call out to that shell.
+                                        Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                failureThreshold:
+                                  description: |-
+                                    Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                                    Defaults to 3. Minimum value is 1.
+                                  format: int32
+                                  type: integer
+                                grpc:
+                                  description: GRPC specifies a GRPC HealthCheckRequest.
+                                  properties:
+                                    port:
+                                      description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                      format: int32
+                                      type: integer
+                                    service:
+                                      default: ""
+                                      description: |-
+                                        Service is the name of the service to place in the gRPC HealthCheckRequest
+                                        (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                        If this is not specified, the default behavior is defined by gRPC.
+                                      type: string
+                                  required:
+                                    - port
+                                  type: object
+                                httpGet:
+                                  description: HTTPGet specifies an HTTP GET request to perform.
+                                  properties:
+                                    host:
+                                      description: |-
+                                        Host name to connect to, defaults to the pod IP. You probably want to set
+                                        "Host" in httpHeaders instead.
+                                      type: string
+                                    httpHeaders:
+                                      description: Custom headers to set in the request. HTTP allows repeated headers.
+                                      items:
+                                        description: HTTPHeader describes a custom header to be used in HTTP probes
+                                        properties:
+                                          name:
+                                            description: |-
+                                              The header field name.
+                                              This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                            type: string
+                                          value:
+                                            description: The header field value
+                                            type: string
+                                        required:
+                                          - name
+                                          - value
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    path:
+                                      description: Path to access on the HTTP server.
+                                      type: string
+                                    port:
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      description: |-
+                                        Name or number of the port to access on the container.
+                                        Number must be in the range 1 to 65535.
+                                        Name must be an IANA_SVC_NAME.
+                                      x-kubernetes-int-or-string: true
+                                    scheme:
+                                      description: |-
+                                        Scheme to use for connecting to the host.
+                                        Defaults to HTTP.
+                                      type: string
+                                  required:
+                                    - port
+                                  type: object
+                                initialDelaySeconds:
+                                  description: |-
+                                    Number of seconds after the container has started before liveness probes are initiated.
+                                    More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                  format: int32
+                                  type: integer
+                                periodSeconds:
+                                  description: |-
+                                    How often (in seconds) to perform the probe.
+                                    Default to 10 seconds. Minimum value is 1.
+                                  format: int32
+                                  type: integer
+                                successThreshold:
+                                  description: |-
+                                    Minimum consecutive successes for the probe to be considered successful after having failed.
+                                    Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                                  format: int32
+                                  type: integer
+                                tcpSocket:
+                                  description: TCPSocket specifies a connection to a TCP port.
+                                  properties:
+                                    host:
+                                      description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                      type: string
+                                    port:
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      description: |-
+                                        Number or name of the port to access on the container.
+                                        Number must be in the range 1 to 65535.
+                                        Name must be an IANA_SVC_NAME.
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                    - port
+                                  type: object
+                                terminationGracePeriodSeconds:
+                                  description: |-
+                                    Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+                                    The grace period is the duration in seconds after the processes running in the pod are sent
+                                    a termination signal and the time when the processes are forcibly halted with a kill signal.
+                                    Set this value longer than the expected cleanup time for your process.
+                                    If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+                                    value overrides the value provided by the pod spec.
+                                    Value must be non-negative integer. The value zero indicates stop immediately via
+                                    the kill signal (no opportunity to shut down).
+                                    This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+                                    Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
+                                  format: int64
+                                  type: integer
+                                timeoutSeconds:
+                                  description: |-
+                                    Number of seconds after which the probe times out.
+                                    Defaults to 1 second. Minimum value is 1.
+                                    More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                  format: int32
+                                  type: integer
+                              type: object
+                            stdin:
+                              description: |-
+                                Whether this container should allocate a buffer for stdin in the container runtime. If this
+                                is not set, reads from stdin in the container will always result in EOF.
+                                Default is false.
+                              type: boolean
+                            stdinOnce:
+                              description: |-
+                                Whether the container runtime should close the stdin channel after it has been opened by
+                                a single attach. When stdin is true the stdin stream will remain open across multiple attach
+                                sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the
+                                first client attaches to stdin, and then remains open and accepts data until the client disconnects,
+                                at which time stdin is closed and remains closed until the container is restarted. If this
+                                flag is false, a container processes that reads from stdin will never receive an EOF.
+                                Default is false
+                              type: boolean
+                            terminationMessagePath:
+                              description: |-
+                                Optional: Path at which the file to which the container's termination message
+                                will be written is mounted into the container's filesystem.
+                                Message written is intended to be brief final status, such as an assertion failure message.
+                                Will be truncated by the node if greater than 4096 bytes. The total message length across
+                                all containers will be limited to 12kb.
+                                Defaults to /dev/termination-log.
+                                Cannot be updated.
+                              type: string
+                            terminationMessagePolicy:
+                              description: |-
+                                Indicate how the termination message should be populated. File will use the contents of
+                                terminationMessagePath to populate the container status message on both success and failure.
+                                FallbackToLogsOnError will use the last chunk of container log output if the termination
+                                message file is empty and the container exited with an error.
+                                The log output is limited to 2048 bytes or 80 lines, whichever is smaller.
+                                Defaults to File.
+                                Cannot be updated.
+                              type: string
+                            tty:
+                              description: |-
+                                Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.
+                                Default is false.
+                              type: boolean
+                            volumeDevices:
+                              description: volumeDevices is the list of block devices to be used by the container.
+                              items:
+                                description: volumeDevice describes a mapping of a raw block device within a container.
+                                properties:
+                                  devicePath:
+                                    description: devicePath is the path inside of the container that the device will be mapped to.
+                                    type: string
+                                  name:
+                                    description: name must match the name of a persistentVolumeClaim in the pod
+                                    type: string
+                                required:
+                                  - devicePath
+                                  - name
+                                type: object
+                              type: array
+                              x-kubernetes-list-map-keys:
+                                - devicePath
+                              x-kubernetes-list-type: map
+                            volumeMounts:
+                              description: |-
+                                Pod volumes to mount into the container's filesystem.
+                                Cannot be updated.
+                              items:
+                                description: VolumeMount describes a mounting of a Volume within a container.
+                                properties:
+                                  mountPath:
+                                    description: |-
+                                      Path within the container at which the volume should be mounted.  Must
+                                      not contain ':'.
+                                    type: string
+                                  mountPropagation:
+                                    description: |-
+                                      mountPropagation determines how mounts are propagated from the host
+                                      to container and the other way around.
+                                      When not set, MountPropagationNone is used.
+                                      This field is beta in 1.10.
+                                      When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
+                                      (which defaults to None).
+                                    type: string
+                                  name:
+                                    description: This must match the Name of a Volume.
+                                    type: string
+                                  readOnly:
+                                    description: |-
+                                      Mounted read-only if true, read-write otherwise (false or unspecified).
+                                      Defaults to false.
+                                    type: boolean
+                                  recursiveReadOnly:
+                                    description: |-
+                                      RecursiveReadOnly specifies whether read-only mounts should be handled
+                                      recursively.
+
+                                      If ReadOnly is false, this field has no meaning and must be unspecified.
+
+                                      If ReadOnly is true, and this field is set to Disabled, the mount is not made
+                                      recursively read-only.  If this field is set to IfPossible, the mount is made
+                                      recursively read-only, if it is supported by the container runtime.  If this
+                                      field is set to Enabled, the mount is made recursively read-only if it is
+                                      supported by the container runtime, otherwise the pod will not be started and
+                                      an error will be generated to indicate the reason.
+
+                                      If this field is set to IfPossible or Enabled, MountPropagation must be set to
+                                      None (or be unspecified, which defaults to None).
+
+                                      If this field is not specified, it is treated as an equivalent of Disabled.
+                                    type: string
+                                  subPath:
+                                    description: |-
+                                      Path within the volume from which the container's volume should be mounted.
+                                      Defaults to "" (volume's root).
+                                    type: string
+                                  subPathExpr:
+                                    description: |-
+                                      Expanded path within the volume from which the container's volume should be mounted.
+                                      Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
+                                      Defaults to "" (volume's root).
+                                      SubPathExpr and SubPath are mutually exclusive.
+                                    type: string
+                                required:
+                                  - mountPath
+                                  - name
+                                type: object
+                              type: array
+                              x-kubernetes-list-map-keys:
+                                - mountPath
+                              x-kubernetes-list-type: map
+                            workingDir:
+                              description: |-
+                                Container's working directory.
+                                If not specified, the container runtime's default will be used, which
+                                might be configured in the container image.
+                                Cannot be updated.
+                              type: string
+                          required:
+                            - name
+                          type: object
+                        type: array
+                      additionalMetadata:
+                        description: AdditionalMetadata defines which additional metadata, such as labels and annotations, must be attached to the created resource.
+                        properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                        type: object
+                      additionalVolumeMounts:
+                        description: |-
+                          AdditionalVolumeMounts allows to mount an additional volume into each component of the Control Plane
+                          (kube-apiserver, controller-manager, and scheduler).
+                        properties:
+                          apiServer:
+                            items:
+                              description: VolumeMount describes a mounting of a Volume within a container.
+                              properties:
+                                mountPath:
+                                  description: |-
+                                    Path within the container at which the volume should be mounted.  Must
+                                    not contain ':'.
+                                  type: string
+                                mountPropagation:
+                                  description: |-
+                                    mountPropagation determines how mounts are propagated from the host
+                                    to container and the other way around.
+                                    When not set, MountPropagationNone is used.
+                                    This field is beta in 1.10.
+                                    When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
+                                    (which defaults to None).
+                                  type: string
+                                name:
+                                  description: This must match the Name of a Volume.
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    Mounted read-only if true, read-write otherwise (false or unspecified).
+                                    Defaults to false.
+                                  type: boolean
+                                recursiveReadOnly:
+                                  description: |-
+                                    RecursiveReadOnly specifies whether read-only mounts should be handled
+                                    recursively.
+
+                                    If ReadOnly is false, this field has no meaning and must be unspecified.
+
+                                    If ReadOnly is true, and this field is set to Disabled, the mount is not made
+                                    recursively read-only.  If this field is set to IfPossible, the mount is made
+                                    recursively read-only, if it is supported by the container runtime.  If this
+                                    field is set to Enabled, the mount is made recursively read-only if it is
+                                    supported by the container runtime, otherwise the pod will not be started and
+                                    an error will be generated to indicate the reason.
+
+                                    If this field is set to IfPossible or Enabled, MountPropagation must be set to
+                                    None (or be unspecified, which defaults to None).
+
+                                    If this field is not specified, it is treated as an equivalent of Disabled.
+                                  type: string
+                                subPath:
+                                  description: |-
+                                    Path within the volume from which the container's volume should be mounted.
+                                    Defaults to "" (volume's root).
+                                  type: string
+                                subPathExpr:
+                                  description: |-
+                                    Expanded path within the volume from which the container's volume should be mounted.
+                                    Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
+                                    Defaults to "" (volume's root).
+                                    SubPathExpr and SubPath are mutually exclusive.
+                                  type: string
+                              required:
+                                - mountPath
+                                - name
+                              type: object
+                            type: array
+                          controllerManager:
+                            items:
+                              description: VolumeMount describes a mounting of a Volume within a container.
+                              properties:
+                                mountPath:
+                                  description: |-
+                                    Path within the container at which the volume should be mounted.  Must
+                                    not contain ':'.
+                                  type: string
+                                mountPropagation:
+                                  description: |-
+                                    mountPropagation determines how mounts are propagated from the host
+                                    to container and the other way around.
+                                    When not set, MountPropagationNone is used.
+                                    This field is beta in 1.10.
+                                    When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
+                                    (which defaults to None).
+                                  type: string
+                                name:
+                                  description: This must match the Name of a Volume.
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    Mounted read-only if true, read-write otherwise (false or unspecified).
+                                    Defaults to false.
+                                  type: boolean
+                                recursiveReadOnly:
+                                  description: |-
+                                    RecursiveReadOnly specifies whether read-only mounts should be handled
+                                    recursively.
+
+                                    If ReadOnly is false, this field has no meaning and must be unspecified.
+
+                                    If ReadOnly is true, and this field is set to Disabled, the mount is not made
+                                    recursively read-only.  If this field is set to IfPossible, the mount is made
+                                    recursively read-only, if it is supported by the container runtime.  If this
+                                    field is set to Enabled, the mount is made recursively read-only if it is
+                                    supported by the container runtime, otherwise the pod will not be started and
+                                    an error will be generated to indicate the reason.
+
+                                    If this field is set to IfPossible or Enabled, MountPropagation must be set to
+                                    None (or be unspecified, which defaults to None).
+
+                                    If this field is not specified, it is treated as an equivalent of Disabled.
+                                  type: string
+                                subPath:
+                                  description: |-
+                                    Path within the volume from which the container's volume should be mounted.
+                                    Defaults to "" (volume's root).
+                                  type: string
+                                subPathExpr:
+                                  description: |-
+                                    Expanded path within the volume from which the container's volume should be mounted.
+                                    Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
+                                    Defaults to "" (volume's root).
+                                    SubPathExpr and SubPath are mutually exclusive.
+                                  type: string
+                              required:
+                                - mountPath
+                                - name
+                              type: object
+                            type: array
+                          scheduler:
+                            items:
+                              description: VolumeMount describes a mounting of a Volume within a container.
+                              properties:
+                                mountPath:
+                                  description: |-
+                                    Path within the container at which the volume should be mounted.  Must
+                                    not contain ':'.
+                                  type: string
+                                mountPropagation:
+                                  description: |-
+                                    mountPropagation determines how mounts are propagated from the host
+                                    to container and the other way around.
+                                    When not set, MountPropagationNone is used.
+                                    This field is beta in 1.10.
+                                    When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
+                                    (which defaults to None).
+                                  type: string
+                                name:
+                                  description: This must match the Name of a Volume.
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    Mounted read-only if true, read-write otherwise (false or unspecified).
+                                    Defaults to false.
+                                  type: boolean
+                                recursiveReadOnly:
+                                  description: |-
+                                    RecursiveReadOnly specifies whether read-only mounts should be handled
+                                    recursively.
+
+                                    If ReadOnly is false, this field has no meaning and must be unspecified.
+
+                                    If ReadOnly is true, and this field is set to Disabled, the mount is not made
+                                    recursively read-only.  If this field is set to IfPossible, the mount is made
+                                    recursively read-only, if it is supported by the container runtime.  If this
+                                    field is set to Enabled, the mount is made recursively read-only if it is
+                                    supported by the container runtime, otherwise the pod will not be started and
+                                    an error will be generated to indicate the reason.
+
+                                    If this field is set to IfPossible or Enabled, MountPropagation must be set to
+                                    None (or be unspecified, which defaults to None).
+
+                                    If this field is not specified, it is treated as an equivalent of Disabled.
+                                  type: string
+                                subPath:
+                                  description: |-
+                                    Path within the volume from which the container's volume should be mounted.
+                                    Defaults to "" (volume's root).
+                                  type: string
+                                subPathExpr:
+                                  description: |-
+                                    Expanded path within the volume from which the container's volume should be mounted.
+                                    Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
+                                    Defaults to "" (volume's root).
+                                    SubPathExpr and SubPath are mutually exclusive.
+                                  type: string
+                              required:
+                                - mountPath
+                                - name
+                              type: object
+                            type: array
+                        type: object
+                      additionalVolumes:
+                        description: AdditionalVolumes allows to add additional volumes to the Control Plane deployment.
+                        items:
+                          description: Volume represents a named volume in a pod that may be accessed by any container in the pod.
+                          properties:
+                            awsElasticBlockStore:
+                              description: |-
+                                awsElasticBlockStore represents an AWS Disk resource that is attached to a
+                                kubelet's host machine and then exposed to the pod.
+                                Deprecated: AWSElasticBlockStore is deprecated. All operations for the in-tree
+                                awsElasticBlockStore type are redirected to the ebs.csi.aws.com CSI driver.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type of the volume that you want to mount.
+                                    Tip: Ensure that the filesystem type is supported by the host operating system.
+                                    Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
+                                  type: string
+                                partition:
+                                  description: |-
+                                    partition is the partition in the volume that you want to mount.
+                                    If omitted, the default is to mount by volume name.
+                                    Examples: For volume /dev/sda1, you specify the partition as "1".
+                                    Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty).
+                                  format: int32
+                                  type: integer
+                                readOnly:
+                                  description: |-
+                                    readOnly value true will force the readOnly setting in VolumeMounts.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
+                                  type: boolean
+                                volumeID:
+                                  description: |-
+                                    volumeID is unique ID of the persistent disk resource in AWS (Amazon EBS volume).
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
+                                  type: string
+                              required:
+                                - volumeID
+                              type: object
+                            azureDisk:
+                              description: |-
+                                azureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.
+                                Deprecated: AzureDisk is deprecated. All operations for the in-tree azureDisk type
+                                are redirected to the disk.csi.azure.com CSI driver.
+                              properties:
+                                cachingMode:
+                                  description: 'cachingMode is the Host Caching mode: None, Read Only, Read Write.'
+                                  type: string
+                                diskName:
+                                  description: diskName is the Name of the data disk in the blob storage
+                                  type: string
+                                diskURI:
+                                  description: diskURI is the URI of data disk in the blob storage
+                                  type: string
+                                fsType:
+                                  default: ext4
+                                  description: |-
+                                    fsType is Filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                  type: string
+                                kind:
+                                  description: 'kind expected values are Shared: multiple blob disks per storage account  Dedicated: single blob disk per storage account  Managed: azure managed data disk (only in managed availability set). defaults to shared'
+                                  type: string
+                                readOnly:
+                                  default: false
+                                  description: |-
+                                    readOnly Defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                              required:
+                                - diskName
+                                - diskURI
+                              type: object
+                            azureFile:
+                              description: |-
+                                azureFile represents an Azure File Service mount on the host and bind mount to the pod.
+                                Deprecated: AzureFile is deprecated. All operations for the in-tree azureFile type
+                                are redirected to the file.csi.azure.com CSI driver.
+                              properties:
+                                readOnly:
+                                  description: |-
+                                    readOnly defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                                secretName:
+                                  description: secretName is the  name of secret that contains Azure Storage Account Name and Key
+                                  type: string
+                                shareName:
+                                  description: shareName is the azure share Name
+                                  type: string
+                              required:
+                                - secretName
+                                - shareName
+                              type: object
+                            cephfs:
+                              description: |-
+                                cephFS represents a Ceph FS mount on the host that shares a pod's lifetime.
+                                Deprecated: CephFS is deprecated and the in-tree cephfs type is no longer supported.
+                              properties:
+                                monitors:
+                                  description: |-
+                                    monitors is Required: Monitors is a collection of Ceph monitors
+                                    More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                path:
+                                  description: 'path is Optional: Used as the mounted root, rather than the full Ceph tree, default is /'
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly is Optional: Defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                    More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
+                                  type: boolean
+                                secretFile:
+                                  description: |-
+                                    secretFile is Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret
+                                    More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
+                                  type: string
+                                secretRef:
+                                  description: |-
+                                    secretRef is Optional: SecretRef is reference to the authentication secret for User, default is empty.
+                                    More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                user:
+                                  description: |-
+                                    user is optional: User is the rados user name, default is admin
+                                    More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
+                                  type: string
+                              required:
+                                - monitors
+                              type: object
+                            cinder:
+                              description: |-
+                                cinder represents a cinder volume attached and mounted on kubelets host machine.
+                                Deprecated: Cinder is deprecated. All operations for the in-tree cinder type
+                                are redirected to the cinder.csi.openstack.org CSI driver.
+                                More info: https://examples.k8s.io/mysql-cinder-pd/README.md
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                    More info: https://examples.k8s.io/mysql-cinder-pd/README.md
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                    More info: https://examples.k8s.io/mysql-cinder-pd/README.md
+                                  type: boolean
+                                secretRef:
+                                  description: |-
+                                    secretRef is optional: points to a secret object containing parameters used to connect
+                                    to OpenStack.
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                volumeID:
+                                  description: |-
+                                    volumeID used to identify the volume in cinder.
+                                    More info: https://examples.k8s.io/mysql-cinder-pd/README.md
+                                  type: string
+                              required:
+                                - volumeID
+                              type: object
+                            configMap:
+                              description: configMap represents a configMap that should populate this volume
+                              properties:
+                                defaultMode:
+                                  description: |-
+                                    defaultMode is optional: mode bits used to set permissions on created files by default.
+                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                    Defaults to 0644.
+                                    Directories within the path are not affected by this setting.
+                                    This might be in conflict with other options that affect the file
+                                    mode, like fsGroup, and the result can be other mode bits set.
+                                  format: int32
+                                  type: integer
+                                items:
+                                  description: |-
+                                    items if unspecified, each key-value pair in the Data field of the referenced
+                                    ConfigMap will be projected into the volume as a file whose name is the
+                                    key and content is the value. If specified, the listed keys will be
+                                    projected into the specified paths, and unlisted keys will not be
+                                    present. If a key is specified which is not present in the ConfigMap,
+                                    the volume setup will error unless it is marked optional. Paths must be
+                                    relative and may not contain the '..' path or start with '..'.
+                                  items:
+                                    description: Maps a string key to a path within a volume.
+                                    properties:
+                                      key:
+                                        description: key is the key to project.
+                                        type: string
+                                      mode:
+                                        description: |-
+                                          mode is Optional: mode bits used to set permissions on this file.
+                                          Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                          YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                          If not specified, the volume defaultMode will be used.
+                                          This might be in conflict with other options that affect the file
+                                          mode, like fsGroup, and the result can be other mode bits set.
+                                        format: int32
+                                        type: integer
+                                      path:
+                                        description: |-
+                                          path is the relative path of the file to map the key to.
+                                          May not be an absolute path.
+                                          May not contain the path element '..'.
+                                          May not start with the string '..'.
+                                        type: string
+                                    required:
+                                      - key
+                                      - path
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                name:
+                                  default: ""
+                                  description: |-
+                                    Name of the referent.
+                                    This field is effectively required, but due to backwards compatibility is
+                                    allowed to be empty. Instances of this type with an empty value here are
+                                    almost certainly wrong.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                                optional:
+                                  description: optional specify whether the ConfigMap or its keys must be defined
+                                  type: boolean
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            csi:
+                              description: csi (Container Storage Interface) represents ephemeral storage that is handled by certain external CSI drivers.
+                              properties:
+                                driver:
+                                  description: |-
+                                    driver is the name of the CSI driver that handles this volume.
+                                    Consult with your admin for the correct name as registered in the cluster.
+                                  type: string
+                                fsType:
+                                  description: |-
+                                    fsType to mount. Ex. "ext4", "xfs", "ntfs".
+                                    If not provided, the empty value is passed to the associated CSI driver
+                                    which will determine the default filesystem to apply.
+                                  type: string
+                                nodePublishSecretRef:
+                                  description: |-
+                                    nodePublishSecretRef is a reference to the secret object containing
+                                    sensitive information to pass to the CSI driver to complete the CSI
+                                    NodePublishVolume and NodeUnpublishVolume calls.
+                                    This field is optional, and  may be empty if no secret is required. If the
+                                    secret object contains more than one secret, all secret references are passed.
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                readOnly:
+                                  description: |-
+                                    readOnly specifies a read-only configuration for the volume.
+                                    Defaults to false (read/write).
+                                  type: boolean
+                                volumeAttributes:
+                                  additionalProperties:
+                                    type: string
+                                  description: |-
+                                    volumeAttributes stores driver-specific properties that are passed to the CSI
+                                    driver. Consult your driver's documentation for supported values.
+                                  type: object
+                              required:
+                                - driver
+                              type: object
+                            downwardAPI:
+                              description: downwardAPI represents downward API about the pod that should populate this volume
+                              properties:
+                                defaultMode:
+                                  description: |-
+                                    Optional: mode bits to use on created files by default. Must be a
+                                    Optional: mode bits used to set permissions on created files by default.
+                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                    Defaults to 0644.
+                                    Directories within the path are not affected by this setting.
+                                    This might be in conflict with other options that affect the file
+                                    mode, like fsGroup, and the result can be other mode bits set.
+                                  format: int32
+                                  type: integer
+                                items:
+                                  description: Items is a list of downward API volume file
+                                  items:
+                                    description: DownwardAPIVolumeFile represents information to create the file containing the pod field
+                                    properties:
+                                      fieldRef:
+                                        description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.'
+                                        properties:
+                                          apiVersion:
+                                            description: Version of the schema the FieldPath is written in terms of, defaults to "v1".
+                                            type: string
+                                          fieldPath:
+                                            description: Path of the field to select in the specified API version.
+                                            type: string
+                                        required:
+                                          - fieldPath
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      mode:
+                                        description: |-
+                                          Optional: mode bits used to set permissions on this file, must be an octal value
+                                          between 0000 and 0777 or a decimal value between 0 and 511.
+                                          YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                          If not specified, the volume defaultMode will be used.
+                                          This might be in conflict with other options that affect the file
+                                          mode, like fsGroup, and the result can be other mode bits set.
+                                        format: int32
+                                        type: integer
+                                      path:
+                                        description: 'Required: Path is  the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..'''
+                                        type: string
+                                      resourceFieldRef:
+                                        description: |-
+                                          Selects a resource of the container: only resources limits and requests
+                                          (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.
+                                        properties:
+                                          containerName:
+                                            description: 'Container name: required for volumes, optional for env vars'
+                                            type: string
+                                          divisor:
+                                            anyOf:
+                                              - type: integer
+                                              - type: string
+                                            description: Specifies the output format of the exposed resources, defaults to "1"
+                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                            x-kubernetes-int-or-string: true
+                                          resource:
+                                            description: 'Required: resource to select'
+                                            type: string
+                                        required:
+                                          - resource
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                    required:
+                                      - path
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              type: object
+                            emptyDir:
+                              description: |-
+                                emptyDir represents a temporary directory that shares a pod's lifetime.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                              properties:
+                                medium:
+                                  description: |-
+                                    medium represents what type of storage medium should back this directory.
+                                    The default is "" which means to use the node's default medium.
+                                    Must be an empty string (default) or Memory.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                                  type: string
+                                sizeLimit:
+                                  anyOf:
+                                    - type: integer
+                                    - type: string
+                                  description: |-
+                                    sizeLimit is the total amount of local storage required for this EmptyDir volume.
+                                    The size limit is also applicable for memory medium.
+                                    The maximum usage on memory medium EmptyDir would be the minimum value between
+                                    the SizeLimit specified here and the sum of memory limits of all containers in a pod.
+                                    The default is nil which means that the limit is undefined.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                              type: object
+                            ephemeral:
+                              description: |-
+                                ephemeral represents a volume that is handled by a cluster storage driver.
+                                The volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts,
+                                and deleted when the pod is removed.
+
+                                Use this if:
+                                a) the volume is only needed while the pod runs,
+                                b) features of normal volumes like restoring from snapshot or capacity
+                                   tracking are needed,
+                                c) the storage driver is specified through a storage class, and
+                                d) the storage driver supports dynamic volume provisioning through
+                                   a PersistentVolumeClaim (see EphemeralVolumeSource for more
+                                   information on the connection between this volume type
+                                   and PersistentVolumeClaim).
+
+                                Use PersistentVolumeClaim or one of the vendor-specific
+                                APIs for volumes that persist for longer than the lifecycle
+                                of an individual pod.
+
+                                Use CSI for light-weight local ephemeral volumes if the CSI driver is meant to
+                                be used that way - see the documentation of the driver for
+                                more information.
+
+                                A pod can use both types of ephemeral volumes and
+                                persistent volumes at the same time.
+                              properties:
+                                volumeClaimTemplate:
+                                  description: |-
+                                    Will be used to create a stand-alone PVC to provision the volume.
+                                    The pod in which this EphemeralVolumeSource is embedded will be the
+                                    owner of the PVC, i.e. the PVC will be deleted together with the
+                                    pod.  The name of the PVC will be `<pod name>-<volume name>` where
+                                    `<volume name>` is the name from the `PodSpec.Volumes` array
+                                    entry. Pod validation will reject the pod if the concatenated name
+                                    is not valid for a PVC (for example, too long).
+
+                                    An existing PVC with that name that is not owned by the pod
+                                    will *not* be used for the pod to avoid using an unrelated
+                                    volume by mistake. Starting the pod is then blocked until
+                                    the unrelated PVC is removed. If such a pre-created PVC is
+                                    meant to be used by the pod, the PVC has to updated with an
+                                    owner reference to the pod once the pod exists. Normally
+                                    this should not be necessary, but it may be useful when
+                                    manually reconstructing a broken cluster.
+
+                                    This field is read-only and no changes will be made by Kubernetes
+                                    to the PVC after it has been created.
+
+                                    Required, must not be nil.
+                                  properties:
+                                    metadata:
+                                      description: |-
+                                        May contain labels and annotations that will be copied into the PVC
+                                        when creating it. No other fields are allowed and will be rejected during
+                                        validation.
+                                      type: object
+                                    spec:
+                                      description: |-
+                                        The specification for the PersistentVolumeClaim. The entire content is
+                                        copied unchanged into the PVC that gets created from this
+                                        template. The same fields as in a PersistentVolumeClaim
+                                        are also valid here.
+                                      properties:
+                                        accessModes:
+                                          description: |-
+                                            accessModes contains the desired access modes the volume should have.
+                                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        dataSource:
+                                          description: |-
+                                            dataSource field can be used to specify either:
+                                            * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
+                                            * An existing PVC (PersistentVolumeClaim)
+                                            If the provisioner or an external controller can support the specified data source,
+                                            it will create a new volume based on the contents of the specified data source.
+                                            When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
+                                            and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
+                                            If the namespace is specified, then dataSourceRef will not be copied to dataSource.
+                                          properties:
+                                            apiGroup:
+                                              description: |-
+                                                APIGroup is the group for the resource being referenced.
+                                                If APIGroup is not specified, the specified Kind must be in the core API group.
+                                                For any other third-party types, APIGroup is required.
+                                              type: string
+                                            kind:
+                                              description: Kind is the type of resource being referenced
+                                              type: string
+                                            name:
+                                              description: Name is the name of resource being referenced
+                                              type: string
+                                          required:
+                                            - kind
+                                            - name
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        dataSourceRef:
+                                          description: |-
+                                            dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
+                                            volume is desired. This may be any object from a non-empty API group (non
+                                            core object) or a PersistentVolumeClaim object.
+                                            When this field is specified, volume binding will only succeed if the type of
+                                            the specified object matches some installed volume populator or dynamic
+                                            provisioner.
+                                            This field will replace the functionality of the dataSource field and as such
+                                            if both fields are non-empty, they must have the same value. For backwards
+                                            compatibility, when namespace isn't specified in dataSourceRef,
+                                            both fields (dataSource and dataSourceRef) will be set to the same
+                                            value automatically if one of them is empty and the other is non-empty.
+                                            When namespace is specified in dataSourceRef,
+                                            dataSource isn't set to the same value and must be empty.
+                                            There are three important differences between dataSource and dataSourceRef:
+                                            * While dataSource only allows two specific types of objects, dataSourceRef
+                                              allows any non-core object, as well as PersistentVolumeClaim objects.
+                                            * While dataSource ignores disallowed values (dropping them), dataSourceRef
+                                              preserves all values, and generates an error if a disallowed value is
+                                              specified.
+                                            * While dataSource only allows local objects, dataSourceRef allows objects
+                                              in any namespaces.
+                                            (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
+                                            (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
+                                          properties:
+                                            apiGroup:
+                                              description: |-
+                                                APIGroup is the group for the resource being referenced.
+                                                If APIGroup is not specified, the specified Kind must be in the core API group.
+                                                For any other third-party types, APIGroup is required.
+                                              type: string
+                                            kind:
+                                              description: Kind is the type of resource being referenced
+                                              type: string
+                                            name:
+                                              description: Name is the name of resource being referenced
+                                              type: string
+                                            namespace:
+                                              description: |-
+                                                Namespace is the namespace of resource being referenced
+                                                Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
+                                                (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
+                                              type: string
+                                          required:
+                                            - kind
+                                            - name
+                                          type: object
+                                        resources:
+                                          description: |-
+                                            resources represents the minimum resources the volume should have.
+                                            Users are allowed to specify resource requirements
+                                            that are lower than previous value but must still be higher than capacity recorded in the
+                                            status field of the claim.
+                                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
+                                          properties:
+                                            limits:
+                                              additionalProperties:
+                                                anyOf:
+                                                  - type: integer
+                                                  - type: string
+                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                x-kubernetes-int-or-string: true
+                                              description: |-
+                                                Limits describes the maximum amount of compute resources allowed.
+                                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                              type: object
+                                            requests:
+                                              additionalProperties:
+                                                anyOf:
+                                                  - type: integer
+                                                  - type: string
+                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                x-kubernetes-int-or-string: true
+                                              description: |-
+                                                Requests describes the minimum amount of compute resources required.
+                                                If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                                otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                              type: object
+                                          type: object
+                                        selector:
+                                          description: selector is a label query over volumes to consider for binding.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label key that the selector applies to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                  - key
+                                                  - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        storageClassName:
+                                          description: |-
+                                            storageClassName is the name of the StorageClass required by the claim.
+                                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
+                                          type: string
+                                        volumeAttributesClassName:
+                                          description: |-
+                                            volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
+                                            If specified, the CSI driver will create or update the volume with the attributes defined
+                                            in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
+                                            it can be changed after the claim is created. An empty string or nil value indicates that no
+                                            VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                            this field can be reset to its previous value (including nil) to cancel the modification.
+                                            If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
+                                            set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
+                                            exists.
+                                            More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
+                                          type: string
+                                        volumeMode:
+                                          description: |-
+                                            volumeMode defines what type of volume is required by the claim.
+                                            Value of Filesystem is implied when not included in claim spec.
+                                          type: string
+                                        volumeName:
+                                          description: volumeName is the binding reference to the PersistentVolume backing this claim.
+                                          type: string
+                                      type: object
+                                  required:
+                                    - spec
+                                  type: object
+                              type: object
+                            fc:
+                              description: fc represents a Fibre Channel resource that is attached to a kubelet's host machine and then exposed to the pod.
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                  type: string
+                                lun:
+                                  description: 'lun is Optional: FC target lun number'
+                                  format: int32
+                                  type: integer
+                                readOnly:
+                                  description: |-
+                                    readOnly is Optional: Defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                                targetWWNs:
+                                  description: 'targetWWNs is Optional: FC target worldwide names (WWNs)'
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                wwids:
+                                  description: |-
+                                    wwids Optional: FC volume world wide identifiers (wwids)
+                                    Either wwids or combination of targetWWNs and lun must be set, but not both simultaneously.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              type: object
+                            flexVolume:
+                              description: |-
+                                flexVolume represents a generic volume resource that is
+                                provisioned/attached using an exec based plugin.
+                                Deprecated: FlexVolume is deprecated. Consider using a CSIDriver instead.
+                              properties:
+                                driver:
+                                  description: driver is the name of the driver to use for this volume.
+                                  type: string
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs". The default filesystem depends on FlexVolume script.
+                                  type: string
+                                options:
+                                  additionalProperties:
+                                    type: string
+                                  description: 'options is Optional: this field holds extra command options if any.'
+                                  type: object
+                                readOnly:
+                                  description: |-
+                                    readOnly is Optional: defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                                secretRef:
+                                  description: |-
+                                    secretRef is Optional: secretRef is reference to the secret object containing
+                                    sensitive information to pass to the plugin scripts. This may be
+                                    empty if no secret object is specified. If the secret object
+                                    contains more than one secret, all secrets are passed to the plugin
+                                    scripts.
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                              required:
+                                - driver
+                              type: object
+                            flocker:
+                              description: |-
+                                flocker represents a Flocker volume attached to a kubelet's host machine. This depends on the Flocker control service being running.
+                                Deprecated: Flocker is deprecated and the in-tree flocker type is no longer supported.
+                              properties:
+                                datasetName:
+                                  description: |-
+                                    datasetName is Name of the dataset stored as metadata -> name on the dataset for Flocker
+                                    should be considered as deprecated
+                                  type: string
+                                datasetUUID:
+                                  description: datasetUUID is the UUID of the dataset. This is unique identifier of a Flocker dataset
+                                  type: string
+                              type: object
+                            gcePersistentDisk:
+                              description: |-
+                                gcePersistentDisk represents a GCE Disk resource that is attached to a
+                                kubelet's host machine and then exposed to the pod.
+                                Deprecated: GCEPersistentDisk is deprecated. All operations for the in-tree
+                                gcePersistentDisk type are redirected to the pd.csi.storage.gke.io CSI driver.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is filesystem type of the volume that you want to mount.
+                                    Tip: Ensure that the filesystem type is supported by the host operating system.
+                                    Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
+                                  type: string
+                                partition:
+                                  description: |-
+                                    partition is the partition in the volume that you want to mount.
+                                    If omitted, the default is to mount by volume name.
+                                    Examples: For volume /dev/sda1, you specify the partition as "1".
+                                    Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty).
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
+                                  format: int32
+                                  type: integer
+                                pdName:
+                                  description: |-
+                                    pdName is unique name of the PD resource in GCE. Used to identify the disk in GCE.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly here will force the ReadOnly setting in VolumeMounts.
+                                    Defaults to false.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
+                                  type: boolean
+                              required:
+                                - pdName
+                              type: object
+                            gitRepo:
+                              description: |-
+                                gitRepo represents a git repository at a particular revision.
+                                Deprecated: GitRepo is deprecated. To provision a container with a git repo, mount an
+                                EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir
+                                into the Pod's container.
+                              properties:
+                                directory:
+                                  description: |-
+                                    directory is the target directory name.
+                                    Must not contain or start with '..'.  If '.' is supplied, the volume directory will be the
+                                    git repository.  Otherwise, if specified, the volume will contain the git repository in
+                                    the subdirectory with the given name.
+                                  type: string
+                                repository:
+                                  description: repository is the URL
+                                  type: string
+                                revision:
+                                  description: revision is the commit hash for the specified revision.
+                                  type: string
+                              required:
+                                - repository
+                              type: object
+                            glusterfs:
+                              description: |-
+                                glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
+                                Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
+                              properties:
+                                endpoints:
+                                  description: endpoints is the endpoint name that details Glusterfs topology.
+                                  type: string
+                                path:
+                                  description: |-
+                                    path is the Glusterfs volume path.
+                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly here will force the Glusterfs volume to be mounted with read-only permissions.
+                                    Defaults to false.
+                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                  type: boolean
+                              required:
+                                - endpoints
+                                - path
+                              type: object
+                            hostPath:
+                              description: |-
+                                hostPath represents a pre-existing file or directory on the host
+                                machine that is directly exposed to the container. This is generally
+                                used for system agents or other privileged things that are allowed
+                                to see the host machine. Most containers will NOT need this.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
+                              properties:
+                                path:
+                                  description: |-
+                                    path of the directory on the host.
+                                    If the path is a symlink, it will follow the link to the real path.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
+                                  type: string
+                                type:
+                                  description: |-
+                                    type for HostPath Volume
+                                    Defaults to ""
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
+                                  type: string
+                              required:
+                                - path
+                              type: object
+                            image:
+                              description: |-
+                                image represents an OCI object (a container image or artifact) pulled and mounted on the kubelet's host machine.
+                                The volume is resolved at pod startup depending on which PullPolicy value is provided:
+
+                                - Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.
+                                - Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.
+                                - IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.
+
+                                The volume gets re-resolved if the pod gets deleted and recreated, which means that new remote content will become available on pod recreation.
+                                A failure to resolve or pull the image during pod startup will block containers from starting and may add significant latency. Failures will be retried using normal volume backoff and will be reported on the pod reason and message.
+                                The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
+                                The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
+                                The volume will be mounted read-only (ro) and non-executable files (noexec).
+                                Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
+                                The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
+                              properties:
+                                pullPolicy:
+                                  description: |-
+                                    Policy for pulling OCI objects. Possible values are:
+                                    Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.
+                                    Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.
+                                    IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.
+                                    Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+                                  type: string
+                                reference:
+                                  description: |-
+                                    Required: Image or artifact reference to be used.
+                                    Behaves in the same way as pod.spec.containers[*].image.
+                                    Pull secrets will be assembled in the same way as for the container image by looking up node credentials, SA image pull secrets, and pod spec image pull secrets.
+                                    More info: https://kubernetes.io/docs/concepts/containers/images
+                                    This field is optional to allow higher level config management to default or override
+                                    container images in workload controllers like Deployments and StatefulSets.
+                                  type: string
+                              type: object
+                            iscsi:
+                              description: |-
+                                iscsi represents an ISCSI Disk resource that is attached to a
+                                kubelet's host machine and then exposed to the pod.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
+                              properties:
+                                chapAuthDiscovery:
+                                  description: chapAuthDiscovery defines whether support iSCSI Discovery CHAP authentication
+                                  type: boolean
+                                chapAuthSession:
+                                  description: chapAuthSession defines whether support iSCSI Session CHAP authentication
+                                  type: boolean
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type of the volume that you want to mount.
+                                    Tip: Ensure that the filesystem type is supported by the host operating system.
+                                    Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi
+                                  type: string
+                                initiatorName:
+                                  description: |-
+                                    initiatorName is the custom iSCSI Initiator Name.
+                                    If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface
+                                    <target portal>:<volume name> will be created for the connection.
+                                  type: string
+                                iqn:
+                                  description: iqn is the target iSCSI Qualified Name.
+                                  type: string
+                                iscsiInterface:
+                                  default: default
+                                  description: |-
+                                    iscsiInterface is the interface Name that uses an iSCSI transport.
+                                    Defaults to 'default' (tcp).
+                                  type: string
+                                lun:
+                                  description: lun represents iSCSI Target Lun number.
+                                  format: int32
+                                  type: integer
+                                portals:
+                                  description: |-
+                                    portals is the iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port
+                                    is other than default (typically TCP ports 860 and 3260).
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                readOnly:
+                                  description: |-
+                                    readOnly here will force the ReadOnly setting in VolumeMounts.
+                                    Defaults to false.
+                                  type: boolean
+                                secretRef:
+                                  description: secretRef is the CHAP Secret for iSCSI target and initiator authentication
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                targetPortal:
+                                  description: |-
+                                    targetPortal is iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port
+                                    is other than default (typically TCP ports 860 and 3260).
+                                  type: string
+                              required:
+                                - iqn
+                                - lun
+                                - targetPortal
+                              type: object
+                            name:
+                              description: |-
+                                name of the volume.
+                                Must be a DNS_LABEL and unique within the pod.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                            nfs:
+                              description: |-
+                                nfs represents an NFS mount on the host that shares a pod's lifetime
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
+                              properties:
+                                path:
+                                  description: |-
+                                    path that is exported by the NFS server.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly here will force the NFS export to be mounted with read-only permissions.
+                                    Defaults to false.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
+                                  type: boolean
+                                server:
+                                  description: |-
+                                    server is the hostname or IP address of the NFS server.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
+                                  type: string
+                              required:
+                                - path
+                                - server
+                              type: object
+                            persistentVolumeClaim:
+                              description: |-
+                                persistentVolumeClaimVolumeSource represents a reference to a
+                                PersistentVolumeClaim in the same namespace.
+                                More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
+                              properties:
+                                claimName:
+                                  description: |-
+                                    claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume.
+                                    More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly Will force the ReadOnly setting in VolumeMounts.
+                                    Default false.
+                                  type: boolean
+                              required:
+                                - claimName
+                              type: object
+                            photonPersistentDisk:
+                              description: |-
+                                photonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine.
+                                Deprecated: PhotonPersistentDisk is deprecated and the in-tree photonPersistentDisk type is no longer supported.
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                  type: string
+                                pdID:
+                                  description: pdID is the ID that identifies Photon Controller persistent disk
+                                  type: string
+                              required:
+                                - pdID
+                              type: object
+                            portworxVolume:
+                              description: |-
+                                portworxVolume represents a portworx volume attached and mounted on kubelets host machine.
+                                Deprecated: PortworxVolume is deprecated. All operations for the in-tree portworxVolume type
+                                are redirected to the pxd.portworx.com CSI driver when the CSIMigrationPortworx feature-gate
+                                is on.
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fSType represents the filesystem type to mount
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs". Implicitly inferred to be "ext4" if unspecified.
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                                volumeID:
+                                  description: volumeID uniquely identifies a Portworx volume
+                                  type: string
+                              required:
+                                - volumeID
+                              type: object
+                            projected:
+                              description: projected items for all in one resources secrets, configmaps, and downward API
+                              properties:
+                                defaultMode:
+                                  description: |-
+                                    defaultMode are the mode bits used to set permissions on created files by default.
+                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                    Directories within the path are not affected by this setting.
+                                    This might be in conflict with other options that affect the file
+                                    mode, like fsGroup, and the result can be other mode bits set.
+                                  format: int32
+                                  type: integer
+                                sources:
+                                  description: |-
+                                    sources is the list of volume projections. Each entry in this list
+                                    handles one source.
+                                  items:
+                                    description: |-
+                                      Projection that may be projected along with other supported volume types.
+                                      Exactly one of these fields must be set.
+                                    properties:
+                                      clusterTrustBundle:
+                                        description: |-
+                                          ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field
+                                          of ClusterTrustBundle objects in an auto-updating file.
+
+                                          Alpha, gated by the ClusterTrustBundleProjection feature gate.
+
+                                          ClusterTrustBundle objects can either be selected by name, or by the
+                                          combination of signer name and a label selector.
+
+                                          Kubelet performs aggressive normalization of the PEM contents written
+                                          into the pod filesystem.  Esoteric PEM features such as inter-block
+                                          comments and block headers are stripped.  Certificates are deduplicated.
+                                          The ordering of certificates within the file is arbitrary, and Kubelet
+                                          may change the order over time.
+                                        properties:
+                                          labelSelector:
+                                            description: |-
+                                              Select all ClusterTrustBundles that match this label selector.  Only has
+                                              effect if signerName is set.  Mutually-exclusive with name.  If unset,
+                                              interpreted as "match nothing".  If set but empty, interpreted as "match
+                                              everything".
+                                            properties:
+                                              matchExpressions:
+                                                description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                items:
+                                                  description: |-
+                                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                                    relates the key and values.
+                                                  properties:
+                                                    key:
+                                                      description: key is the label key that the selector applies to.
+                                                      type: string
+                                                    operator:
+                                                      description: |-
+                                                        operator represents a key's relationship to a set of values.
+                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                      type: string
+                                                    values:
+                                                      description: |-
+                                                        values is an array of string values. If the operator is In or NotIn,
+                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                        the values array must be empty. This array is replaced during a strategic
+                                                        merge patch.
+                                                      items:
+                                                        type: string
+                                                      type: array
+                                                      x-kubernetes-list-type: atomic
+                                                  required:
+                                                    - key
+                                                    - operator
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              matchLabels:
+                                                additionalProperties:
+                                                  type: string
+                                                description: |-
+                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                type: object
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          name:
+                                            description: |-
+                                              Select a single ClusterTrustBundle by object name.  Mutually-exclusive
+                                              with signerName and labelSelector.
+                                            type: string
+                                          optional:
+                                            description: |-
+                                              If true, don't block pod startup if the referenced ClusterTrustBundle(s)
+                                              aren't available.  If using name, then the named ClusterTrustBundle is
+                                              allowed not to exist.  If using signerName, then the combination of
+                                              signerName and labelSelector is allowed to match zero
+                                              ClusterTrustBundles.
+                                            type: boolean
+                                          path:
+                                            description: Relative path from the volume root to write the bundle.
+                                            type: string
+                                          signerName:
+                                            description: |-
+                                              Select all ClusterTrustBundles that match this signer name.
+                                              Mutually-exclusive with name.  The contents of all selected
+                                              ClusterTrustBundles will be unified and deduplicated.
+                                            type: string
+                                        required:
+                                          - path
+                                        type: object
+                                      configMap:
+                                        description: configMap information about the configMap data to project
+                                        properties:
+                                          items:
+                                            description: |-
+                                              items if unspecified, each key-value pair in the Data field of the referenced
+                                              ConfigMap will be projected into the volume as a file whose name is the
+                                              key and content is the value. If specified, the listed keys will be
+                                              projected into the specified paths, and unlisted keys will not be
+                                              present. If a key is specified which is not present in the ConfigMap,
+                                              the volume setup will error unless it is marked optional. Paths must be
+                                              relative and may not contain the '..' path or start with '..'.
+                                            items:
+                                              description: Maps a string key to a path within a volume.
+                                              properties:
+                                                key:
+                                                  description: key is the key to project.
+                                                  type: string
+                                                mode:
+                                                  description: |-
+                                                    mode is Optional: mode bits used to set permissions on this file.
+                                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                    If not specified, the volume defaultMode will be used.
+                                                    This might be in conflict with other options that affect the file
+                                                    mode, like fsGroup, and the result can be other mode bits set.
+                                                  format: int32
+                                                  type: integer
+                                                path:
+                                                  description: |-
+                                                    path is the relative path of the file to map the key to.
+                                                    May not be an absolute path.
+                                                    May not contain the path element '..'.
+                                                    May not start with the string '..'.
+                                                  type: string
+                                              required:
+                                                - key
+                                                - path
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          name:
+                                            default: ""
+                                            description: |-
+                                              Name of the referent.
+                                              This field is effectively required, but due to backwards compatibility is
+                                              allowed to be empty. Instances of this type with an empty value here are
+                                              almost certainly wrong.
+                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                            type: string
+                                          optional:
+                                            description: optional specify whether the ConfigMap or its keys must be defined
+                                            type: boolean
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      downwardAPI:
+                                        description: downwardAPI information about the downwardAPI data to project
+                                        properties:
+                                          items:
+                                            description: Items is a list of DownwardAPIVolume file
+                                            items:
+                                              description: DownwardAPIVolumeFile represents information to create the file containing the pod field
+                                              properties:
+                                                fieldRef:
+                                                  description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.'
+                                                  properties:
+                                                    apiVersion:
+                                                      description: Version of the schema the FieldPath is written in terms of, defaults to "v1".
+                                                      type: string
+                                                    fieldPath:
+                                                      description: Path of the field to select in the specified API version.
+                                                      type: string
+                                                  required:
+                                                    - fieldPath
+                                                  type: object
+                                                  x-kubernetes-map-type: atomic
+                                                mode:
+                                                  description: |-
+                                                    Optional: mode bits used to set permissions on this file, must be an octal value
+                                                    between 0000 and 0777 or a decimal value between 0 and 511.
+                                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                    If not specified, the volume defaultMode will be used.
+                                                    This might be in conflict with other options that affect the file
+                                                    mode, like fsGroup, and the result can be other mode bits set.
+                                                  format: int32
+                                                  type: integer
+                                                path:
+                                                  description: 'Required: Path is  the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..'''
+                                                  type: string
+                                                resourceFieldRef:
+                                                  description: |-
+                                                    Selects a resource of the container: only resources limits and requests
+                                                    (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.
+                                                  properties:
+                                                    containerName:
+                                                      description: 'Container name: required for volumes, optional for env vars'
+                                                      type: string
+                                                    divisor:
+                                                      anyOf:
+                                                        - type: integer
+                                                        - type: string
+                                                      description: Specifies the output format of the exposed resources, defaults to "1"
+                                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                      x-kubernetes-int-or-string: true
+                                                    resource:
+                                                      description: 'Required: resource to select'
+                                                      type: string
+                                                  required:
+                                                    - resource
+                                                  type: object
+                                                  x-kubernetes-map-type: atomic
+                                              required:
+                                                - path
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        type: object
+                                      podCertificate:
+                                        description: |-
+                                          Projects an auto-rotating credential bundle (private key and certificate
+                                          chain) that the pod can use either as a TLS client or server.
+
+                                          Kubelet generates a private key and uses it to send a
+                                          PodCertificateRequest to the named signer.  Once the signer approves the
+                                          request and issues a certificate chain, Kubelet writes the key and
+                                          certificate chain to the pod filesystem.  The pod does not start until
+                                          certificates have been issued for each podCertificate projected volume
+                                          source in its spec.
+
+                                          Kubelet will begin trying to rotate the certificate at the time indicated
+                                          by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                          timestamp.
+
+                                          Kubelet can write a single file, indicated by the credentialBundlePath
+                                          field, or separate files, indicated by the keyPath and
+                                          certificateChainPath fields.
+
+                                          The credential bundle is a single file in PEM format.  The first PEM
+                                          entry is the private key (in PKCS#8 format), and the remaining PEM
+                                          entries are the certificate chain issued by the signer (typically,
+                                          signers will return their certificate chain in leaf-to-root order).
+
+                                          Prefer using the credential bundle format, since your application code
+                                          can read it atomically.  If you use keyPath and certificateChainPath,
+                                          your application must make two separate file reads. If these coincide
+                                          with a certificate rotation, it is possible that the private key and leaf
+                                          certificate you read may not correspond to each other.  Your application
+                                          will need to check for this condition, and re-read until they are
+                                          consistent.
+
+                                          The named signer controls chooses the format of the certificate it
+                                          issues; consult the signer implementation's documentation to learn how to
+                                          use the certificates it issues.
+                                        properties:
+                                          certificateChainPath:
+                                            description: |-
+                                              Write the certificate chain at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          credentialBundlePath:
+                                            description: |-
+                                              Write the credential bundle at this path in the projected volume.
+
+                                              The credential bundle is a single file that contains multiple PEM blocks.
+                                              The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                              key.
+
+                                              The remaining blocks are CERTIFICATE blocks, containing the issued
+                                              certificate chain from the signer (leaf and any intermediates).
+
+                                              Using credentialBundlePath lets your Pod's application code make a single
+                                              atomic read that retrieves a consistent key and certificate chain.  If you
+                                              project them to separate files, your application code will need to
+                                              additionally check that the leaf certificate was issued to the key.
+                                            type: string
+                                          keyPath:
+                                            description: |-
+                                              Write the key at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          keyType:
+                                            description: |-
+                                              The type of keypair Kubelet will generate for the pod.
+
+                                              Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                              "ECDSAP521", and "ED25519".
+                                            type: string
+                                          maxExpirationSeconds:
+                                            description: |-
+                                              maxExpirationSeconds is the maximum lifetime permitted for the
+                                              certificate.
+
+                                              Kubelet copies this value verbatim into the PodCertificateRequests it
+                                              generates for this projection.
+
+                                              If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                              will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                              value is 7862400 (91 days).
+
+                                              The signer implementation is then free to issue a certificate with any
+                                              lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                              seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                              `kubernetes.io` signers will never issue certificates with a lifetime
+                                              longer than 24 hours.
+                                            format: int32
+                                            type: integer
+                                          signerName:
+                                            description: Kubelet's generated CSRs will be addressed to this signer.
+                                            type: string
+                                          userAnnotations:
+                                            additionalProperties:
+                                              type: string
+                                            description: |-
+                                              userAnnotations allow pod authors to pass additional information to
+                                              the signer implementation.  Kubernetes does not restrict or validate this
+                                              metadata in any way.
+
+                                              These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of
+                                              the PodCertificateRequest objects that Kubelet creates.
+
+                                              Entries are subject to the same validation as object metadata annotations,
+                                              with the addition that all keys must be domain-prefixed. No restrictions
+                                              are placed on values, except an overall size limitation on the entire field.
+
+                                              Signers should document the keys and values they support. Signers should
+                                              deny requests that contain keys they do not recognize.
+                                            type: object
+                                        required:
+                                          - keyType
+                                          - signerName
+                                        type: object
+                                      secret:
+                                        description: secret information about the secret data to project
+                                        properties:
+                                          items:
+                                            description: |-
+                                              items if unspecified, each key-value pair in the Data field of the referenced
+                                              Secret will be projected into the volume as a file whose name is the
+                                              key and content is the value. If specified, the listed keys will be
+                                              projected into the specified paths, and unlisted keys will not be
+                                              present. If a key is specified which is not present in the Secret,
+                                              the volume setup will error unless it is marked optional. Paths must be
+                                              relative and may not contain the '..' path or start with '..'.
+                                            items:
+                                              description: Maps a string key to a path within a volume.
+                                              properties:
+                                                key:
+                                                  description: key is the key to project.
+                                                  type: string
+                                                mode:
+                                                  description: |-
+                                                    mode is Optional: mode bits used to set permissions on this file.
+                                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                    If not specified, the volume defaultMode will be used.
+                                                    This might be in conflict with other options that affect the file
+                                                    mode, like fsGroup, and the result can be other mode bits set.
+                                                  format: int32
+                                                  type: integer
+                                                path:
+                                                  description: |-
+                                                    path is the relative path of the file to map the key to.
+                                                    May not be an absolute path.
+                                                    May not contain the path element '..'.
+                                                    May not start with the string '..'.
+                                                  type: string
+                                              required:
+                                                - key
+                                                - path
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          name:
+                                            default: ""
+                                            description: |-
+                                              Name of the referent.
+                                              This field is effectively required, but due to backwards compatibility is
+                                              allowed to be empty. Instances of this type with an empty value here are
+                                              almost certainly wrong.
+                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                            type: string
+                                          optional:
+                                            description: optional field specify whether the Secret or its key must be defined
+                                            type: boolean
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      serviceAccountToken:
+                                        description: serviceAccountToken is information about the serviceAccountToken data to project
+                                        properties:
+                                          audience:
+                                            description: |-
+                                              audience is the intended audience of the token. A recipient of a token
+                                              must identify itself with an identifier specified in the audience of the
+                                              token, and otherwise should reject the token. The audience defaults to the
+                                              identifier of the apiserver.
+                                            type: string
+                                          expirationSeconds:
+                                            description: |-
+                                              expirationSeconds is the requested duration of validity of the service
+                                              account token. As the token approaches expiration, the kubelet volume
+                                              plugin will proactively rotate the service account token. The kubelet will
+                                              start trying to rotate the token if the token is older than 80 percent of
+                                              its time to live or if the token is older than 24 hours.Defaults to 1 hour
+                                              and must be at least 10 minutes.
+                                            format: int64
+                                            type: integer
+                                          path:
+                                            description: |-
+                                              path is the path relative to the mount point of the file to project the
+                                              token into.
+                                            type: string
+                                        required:
+                                          - path
+                                        type: object
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              type: object
+                            quobyte:
+                              description: |-
+                                quobyte represents a Quobyte mount on the host that shares a pod's lifetime.
+                                Deprecated: Quobyte is deprecated and the in-tree quobyte type is no longer supported.
+                              properties:
+                                group:
+                                  description: |-
+                                    group to map volume access to
+                                    Default is no group
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly here will force the Quobyte volume to be mounted with read-only permissions.
+                                    Defaults to false.
+                                  type: boolean
+                                registry:
+                                  description: |-
+                                    registry represents a single or multiple Quobyte Registry services
+                                    specified as a string as host:port pair (multiple entries are separated with commas)
+                                    which acts as the central registry for volumes
+                                  type: string
+                                tenant:
+                                  description: |-
+                                    tenant owning the given Quobyte volume in the Backend
+                                    Used with dynamically provisioned Quobyte volumes, value is set by the plugin
+                                  type: string
+                                user:
+                                  description: |-
+                                    user to map volume access to
+                                    Defaults to serivceaccount user
+                                  type: string
+                                volume:
+                                  description: volume is a string that references an already created Quobyte volume by name.
+                                  type: string
+                              required:
+                                - registry
+                                - volume
+                              type: object
+                            rbd:
+                              description: |-
+                                rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
+                                Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type of the volume that you want to mount.
+                                    Tip: Ensure that the filesystem type is supported by the host operating system.
+                                    Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd
+                                  type: string
+                                image:
+                                  description: |-
+                                    image is the rados image name.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  type: string
+                                keyring:
+                                  default: /etc/ceph/keyring
+                                  description: |-
+                                    keyring is the path to key ring for RBDUser.
+                                    Default is /etc/ceph/keyring.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  type: string
+                                monitors:
+                                  description: |-
+                                    monitors is a collection of Ceph monitors.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                pool:
+                                  default: rbd
+                                  description: |-
+                                    pool is the rados pool name.
+                                    Default is rbd.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly here will force the ReadOnly setting in VolumeMounts.
+                                    Defaults to false.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  type: boolean
+                                secretRef:
+                                  description: |-
+                                    secretRef is name of the authentication secret for RBDUser. If provided
+                                    overrides keyring.
+                                    Default is nil.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                user:
+                                  default: admin
+                                  description: |-
+                                    user is the rados user name.
+                                    Default is admin.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  type: string
+                              required:
+                                - image
+                                - monitors
+                              type: object
+                            scaleIO:
+                              description: |-
+                                scaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes.
+                                Deprecated: ScaleIO is deprecated and the in-tree scaleIO type is no longer supported.
+                              properties:
+                                fsType:
+                                  default: xfs
+                                  description: |-
+                                    fsType is the filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs".
+                                    Default is "xfs".
+                                  type: string
+                                gateway:
+                                  description: gateway is the host address of the ScaleIO API Gateway.
+                                  type: string
+                                protectionDomain:
+                                  description: protectionDomain is the name of the ScaleIO Protection Domain for the configured storage.
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly Defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                                secretRef:
+                                  description: |-
+                                    secretRef references to the secret for ScaleIO user and other
+                                    sensitive information. If this is not provided, Login operation will fail.
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                sslEnabled:
+                                  description: sslEnabled Flag enable/disable SSL communication with Gateway, default false
+                                  type: boolean
+                                storageMode:
+                                  default: ThinProvisioned
+                                  description: |-
+                                    storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.
+                                    Default is ThinProvisioned.
+                                  type: string
+                                storagePool:
+                                  description: storagePool is the ScaleIO Storage Pool associated with the protection domain.
+                                  type: string
+                                system:
+                                  description: system is the name of the storage system as configured in ScaleIO.
+                                  type: string
+                                volumeName:
+                                  description: |-
+                                    volumeName is the name of a volume already created in the ScaleIO system
+                                    that is associated with this volume source.
+                                  type: string
+                              required:
+                                - gateway
+                                - secretRef
+                                - system
+                              type: object
+                            secret:
+                              description: |-
+                                secret represents a secret that should populate this volume.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                              properties:
+                                defaultMode:
+                                  description: |-
+                                    defaultMode is Optional: mode bits used to set permissions on created files by default.
+                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                    YAML accepts both octal and decimal values, JSON requires decimal values
+                                    for mode bits. Defaults to 0644.
+                                    Directories within the path are not affected by this setting.
+                                    This might be in conflict with other options that affect the file
+                                    mode, like fsGroup, and the result can be other mode bits set.
+                                  format: int32
+                                  type: integer
+                                items:
+                                  description: |-
+                                    items If unspecified, each key-value pair in the Data field of the referenced
+                                    Secret will be projected into the volume as a file whose name is the
+                                    key and content is the value. If specified, the listed keys will be
+                                    projected into the specified paths, and unlisted keys will not be
+                                    present. If a key is specified which is not present in the Secret,
+                                    the volume setup will error unless it is marked optional. Paths must be
+                                    relative and may not contain the '..' path or start with '..'.
+                                  items:
+                                    description: Maps a string key to a path within a volume.
+                                    properties:
+                                      key:
+                                        description: key is the key to project.
+                                        type: string
+                                      mode:
+                                        description: |-
+                                          mode is Optional: mode bits used to set permissions on this file.
+                                          Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                          YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                          If not specified, the volume defaultMode will be used.
+                                          This might be in conflict with other options that affect the file
+                                          mode, like fsGroup, and the result can be other mode bits set.
+                                        format: int32
+                                        type: integer
+                                      path:
+                                        description: |-
+                                          path is the relative path of the file to map the key to.
+                                          May not be an absolute path.
+                                          May not contain the path element '..'.
+                                          May not start with the string '..'.
+                                        type: string
+                                    required:
+                                      - key
+                                      - path
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                optional:
+                                  description: optional field specify whether the Secret or its keys must be defined
+                                  type: boolean
+                                secretName:
+                                  description: |-
+                                    secretName is the name of the secret in the pod's namespace to use.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                                  type: string
+                              type: object
+                            storageos:
+                              description: |-
+                                storageOS represents a StorageOS volume attached and mounted on Kubernetes nodes.
+                                Deprecated: StorageOS is deprecated and the in-tree storageos type is no longer supported.
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                                secretRef:
+                                  description: |-
+                                    secretRef specifies the secret to use for obtaining the StorageOS API
+                                    credentials.  If not specified, default values will be attempted.
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                volumeName:
+                                  description: |-
+                                    volumeName is the human-readable name of the StorageOS volume.  Volume
+                                    names are only unique within a namespace.
+                                  type: string
+                                volumeNamespace:
+                                  description: |-
+                                    volumeNamespace specifies the scope of the volume within StorageOS.  If no
+                                    namespace is specified then the Pod's namespace will be used.  This allows the
+                                    Kubernetes name scoping to be mirrored within StorageOS for tighter integration.
+                                    Set VolumeName to any name to override the default behaviour.
+                                    Set to "default" if you are not using namespaces within StorageOS.
+                                    Namespaces that do not pre-exist within StorageOS will be created.
+                                  type: string
+                              type: object
+                            vsphereVolume:
+                              description: |-
+                                vsphereVolume represents a vSphere volume attached and mounted on kubelets host machine.
+                                Deprecated: VsphereVolume is deprecated. All operations for the in-tree vsphereVolume type
+                                are redirected to the csi.vsphere.vmware.com CSI driver.
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                  type: string
+                                storagePolicyID:
+                                  description: storagePolicyID is the storage Policy Based Management (SPBM) profile ID associated with the StoragePolicyName.
+                                  type: string
+                                storagePolicyName:
+                                  description: storagePolicyName is the storage Policy Based Management (SPBM) profile name.
+                                  type: string
+                                volumePath:
+                                  description: volumePath is the path that identifies vSphere volume vmdk
+                                  type: string
+                              required:
+                                - volumePath
+                              type: object
+                          required:
+                            - name
+                          type: object
+                        type: array
+                      affinity:
+                        description: |-
+                          If specified, the Tenant Control Plane pod's scheduling constraints.
+                          More info: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/
+                        properties:
+                          nodeAffinity:
+                            description: Describes node affinity scheduling rules for the pod.
+                            properties:
+                              preferredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  The scheduler will prefer to schedule pods to nodes that satisfy
+                                  the affinity expressions specified by this field, but it may choose
+                                  a node that violates one or more of the expressions. The node that is
+                                  most preferred is the one with the greatest sum of weights, i.e.
+                                  for each node that meets all of the scheduling requirements (resource
+                                  request, requiredDuringScheduling affinity expressions, etc.),
+                                  compute a sum by iterating through the elements of this field and adding
+                                  "weight" to the sum if the node matches the corresponding matchExpressions; the
+                                  node(s) with the highest sum are the most preferred.
+                                items:
+                                  description: |-
+                                    An empty preferred scheduling term matches all objects with implicit weight 0
+                                    (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+                                  properties:
+                                    preference:
+                                      description: A node selector term, associated with the corresponding weight.
+                                      properties:
+                                        matchExpressions:
+                                          description: A list of node selector requirements by node's labels.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                              - key
+                                              - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchFields:
+                                          description: A list of node selector requirements by node's fields.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                              - key
+                                              - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    weight:
+                                      description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
+                                      format: int32
+                                      type: integer
+                                  required:
+                                    - preference
+                                    - weight
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              requiredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  If the affinity requirements specified by this field are not met at
+                                  scheduling time, the pod will not be scheduled onto the node.
+                                  If the affinity requirements specified by this field cease to be met
+                                  at some point during pod execution (e.g. due to an update), the system
+                                  may or may not try to eventually evict the pod from its node.
+                                properties:
+                                  nodeSelectorTerms:
+                                    description: Required. A list of node selector terms. The terms are ORed.
+                                    items:
+                                      description: |-
+                                        A null or empty node selector term matches no objects. The requirements of
+                                        them are ANDed.
+                                        The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+                                      properties:
+                                        matchExpressions:
+                                          description: A list of node selector requirements by node's labels.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                              - key
+                                              - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchFields:
+                                          description: A list of node selector requirements by node's fields.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                              - key
+                                              - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                  - nodeSelectorTerms
+                                type: object
+                                x-kubernetes-map-type: atomic
+                            type: object
+                          podAffinity:
+                            description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
+                            properties:
+                              preferredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  The scheduler will prefer to schedule pods to nodes that satisfy
+                                  the affinity expressions specified by this field, but it may choose
+                                  a node that violates one or more of the expressions. The node that is
+                                  most preferred is the one with the greatest sum of weights, i.e.
+                                  for each node that meets all of the scheduling requirements (resource
+                                  request, requiredDuringScheduling affinity expressions, etc.),
+                                  compute a sum by iterating through the elements of this field and adding
+                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  node(s) with the highest sum are the most preferred.
+                                items:
+                                  description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+                                  properties:
+                                    podAffinityTerm:
+                                      description: Required. A pod affinity term, associated with the corresponding weight.
+                                      properties:
+                                        labelSelector:
+                                          description: |-
+                                            A label query over a set of resources, in this case pods.
+                                            If it's null, this PodAffinityTerm matches with no Pods.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label key that the selector applies to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                  - key
+                                                  - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        matchLabelKeys:
+                                          description: |-
+                                            MatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        mismatchLabelKeys:
+                                          description: |-
+                                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        namespaceSelector:
+                                          description: |-
+                                            A label query over the set of namespaces that the term applies to.
+                                            The term is applied to the union of the namespaces selected by this field
+                                            and the ones listed in the namespaces field.
+                                            null selector and null or empty namespaces list means "this pod's namespace".
+                                            An empty selector ({}) matches all namespaces.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label key that the selector applies to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                  - key
+                                                  - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        namespaces:
+                                          description: |-
+                                            namespaces specifies a static list of namespace names that the term applies to.
+                                            The term is applied to the union of the namespaces listed in this field
+                                            and the ones selected by namespaceSelector.
+                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        topologyKey:
+                                          description: |-
+                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                            whose value of the label with key topologyKey matches that of any node on which any of the
+                                            selected pods is running.
+                                            Empty topologyKey is not allowed.
+                                          type: string
+                                      required:
+                                        - topologyKey
+                                      type: object
+                                    weight:
+                                      description: |-
+                                        weight associated with matching the corresponding podAffinityTerm,
+                                        in the range 1-100.
+                                      format: int32
+                                      type: integer
+                                  required:
+                                    - podAffinityTerm
+                                    - weight
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              requiredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  If the affinity requirements specified by this field are not met at
+                                  scheduling time, the pod will not be scheduled onto the node.
+                                  If the affinity requirements specified by this field cease to be met
+                                  at some point during pod execution (e.g. due to a pod label update), the
+                                  system may or may not try to eventually evict the pod from its node.
+                                  When there are multiple elements, the lists of nodes corresponding to each
+                                  podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                items:
+                                  description: |-
+                                    Defines a set of pods (namely those matching the labelSelector
+                                    relative to the given namespace(s)) that this pod should be
+                                    co-located (affinity) or not co-located (anti-affinity) with,
+                                    where co-located is defined as running on a node whose value of
+                                    the label with key <topologyKey> matches that of any node on which
+                                    a pod of the set of pods is running
+                                  properties:
+                                    labelSelector:
+                                      description: |-
+                                        A label query over a set of resources, in this case pods.
+                                        If it's null, this PodAffinityTerm matches with no Pods.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                              - key
+                                              - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    matchLabelKeys:
+                                      description: |-
+                                        MatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mismatchLabelKeys:
+                                      description: |-
+                                        MismatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    namespaceSelector:
+                                      description: |-
+                                        A label query over the set of namespaces that the term applies to.
+                                        The term is applied to the union of the namespaces selected by this field
+                                        and the ones listed in the namespaces field.
+                                        null selector and null or empty namespaces list means "this pod's namespace".
+                                        An empty selector ({}) matches all namespaces.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                              - key
+                                              - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    namespaces:
+                                      description: |-
+                                        namespaces specifies a static list of namespace names that the term applies to.
+                                        The term is applied to the union of the namespaces listed in this field
+                                        and the ones selected by namespaceSelector.
+                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    topologyKey:
+                                      description: |-
+                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                        whose value of the label with key topologyKey matches that of any node on which any of the
+                                        selected pods is running.
+                                        Empty topologyKey is not allowed.
+                                      type: string
+                                  required:
+                                    - topologyKey
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                            type: object
+                          podAntiAffinity:
+                            description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
+                            properties:
+                              preferredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  The scheduler will prefer to schedule pods to nodes that satisfy
+                                  the anti-affinity expressions specified by this field, but it may choose
+                                  a node that violates one or more of the expressions. The node that is
+                                  most preferred is the one with the greatest sum of weights, i.e.
+                                  for each node that meets all of the scheduling requirements (resource
+                                  request, requiredDuringScheduling anti-affinity expressions, etc.),
+                                  compute a sum by iterating through the elements of this field and subtracting
+                                  "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  node(s) with the highest sum are the most preferred.
+                                items:
+                                  description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+                                  properties:
+                                    podAffinityTerm:
+                                      description: Required. A pod affinity term, associated with the corresponding weight.
+                                      properties:
+                                        labelSelector:
+                                          description: |-
+                                            A label query over a set of resources, in this case pods.
+                                            If it's null, this PodAffinityTerm matches with no Pods.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label key that the selector applies to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                  - key
+                                                  - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        matchLabelKeys:
+                                          description: |-
+                                            MatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        mismatchLabelKeys:
+                                          description: |-
+                                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        namespaceSelector:
+                                          description: |-
+                                            A label query over the set of namespaces that the term applies to.
+                                            The term is applied to the union of the namespaces selected by this field
+                                            and the ones listed in the namespaces field.
+                                            null selector and null or empty namespaces list means "this pod's namespace".
+                                            An empty selector ({}) matches all namespaces.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label key that the selector applies to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                  - key
+                                                  - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        namespaces:
+                                          description: |-
+                                            namespaces specifies a static list of namespace names that the term applies to.
+                                            The term is applied to the union of the namespaces listed in this field
+                                            and the ones selected by namespaceSelector.
+                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        topologyKey:
+                                          description: |-
+                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                            whose value of the label with key topologyKey matches that of any node on which any of the
+                                            selected pods is running.
+                                            Empty topologyKey is not allowed.
+                                          type: string
+                                      required:
+                                        - topologyKey
+                                      type: object
+                                    weight:
+                                      description: |-
+                                        weight associated with matching the corresponding podAffinityTerm,
+                                        in the range 1-100.
+                                      format: int32
+                                      type: integer
+                                  required:
+                                    - podAffinityTerm
+                                    - weight
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              requiredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  If the anti-affinity requirements specified by this field are not met at
+                                  scheduling time, the pod will not be scheduled onto the node.
+                                  If the anti-affinity requirements specified by this field cease to be met
+                                  at some point during pod execution (e.g. due to a pod label update), the
+                                  system may or may not try to eventually evict the pod from its node.
+                                  When there are multiple elements, the lists of nodes corresponding to each
+                                  podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                items:
+                                  description: |-
+                                    Defines a set of pods (namely those matching the labelSelector
+                                    relative to the given namespace(s)) that this pod should be
+                                    co-located (affinity) or not co-located (anti-affinity) with,
+                                    where co-located is defined as running on a node whose value of
+                                    the label with key <topologyKey> matches that of any node on which
+                                    a pod of the set of pods is running
+                                  properties:
+                                    labelSelector:
+                                      description: |-
+                                        A label query over a set of resources, in this case pods.
+                                        If it's null, this PodAffinityTerm matches with no Pods.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                              - key
+                                              - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    matchLabelKeys:
+                                      description: |-
+                                        MatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mismatchLabelKeys:
+                                      description: |-
+                                        MismatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    namespaceSelector:
+                                      description: |-
+                                        A label query over the set of namespaces that the term applies to.
+                                        The term is applied to the union of the namespaces selected by this field
+                                        and the ones listed in the namespaces field.
+                                        null selector and null or empty namespaces list means "this pod's namespace".
+                                        An empty selector ({}) matches all namespaces.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                              - key
+                                              - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    namespaces:
+                                      description: |-
+                                        namespaces specifies a static list of namespace names that the term applies to.
+                                        The term is applied to the union of the namespaces listed in this field
+                                        and the ones selected by namespaceSelector.
+                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    topologyKey:
+                                      description: |-
+                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                        whose value of the label with key topologyKey matches that of any node on which any of the
+                                        selected pods is running.
+                                        Empty topologyKey is not allowed.
+                                      type: string
+                                  required:
+                                    - topologyKey
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                            type: object
+                        type: object
+                      extraArgs:
+                        description: |-
+                          ExtraArgs allows adding additional arguments to the Control Plane components,
+                          such as kube-apiserver, controller-manager, and scheduler. WARNING - This option
+                          can override existing parameters and cause components to misbehave in unxpected ways.
+                          Only modify if you know what you are doing.
+                        properties:
+                          apiServer:
+                            items:
+                              type: string
+                            type: array
+                          controllerManager:
+                            items:
+                              type: string
+                            type: array
+                          kine:
+                            description: Available only if Kamaji is running using Kine as backing storage.
+                            items:
+                              type: string
+                            type: array
+                          scheduler:
+                            items:
+                              type: string
+                            type: array
+                        type: object
+                      nodeSelector:
+                        additionalProperties:
+                          type: string
+                        description: |-
+                          NodeSelector is a selector which must be true for the pod to fit on a node.
+                          Selector which must match a node's labels for the pod to be scheduled on that node.
+                          More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+                        type: object
+                      podAdditionalMetadata:
+                        description: AdditionalMetadata defines which additional metadata, such as labels and annotations, must be attached to the created resource.
+                        properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                        type: object
+                      registrySettings:
+                        default:
+                          apiServerImage: kube-apiserver
+                          controllerManagerImage: kube-controller-manager
+                          registry: registry.k8s.io
+                          schedulerImage: kube-scheduler
+                        description: |-
+                          RegistrySettings allows to override the default images for the given Tenant Control Plane instance.
+                          It could be used to point to a different container registry rather than the public one.
+                        properties:
+                          apiServerImage:
+                            default: kube-apiserver
+                            type: string
+                          controllerManagerImage:
+                            default: kube-controller-manager
+                            type: string
+                          registry:
+                            default: registry.k8s.io
+                            type: string
+                          schedulerImage:
+                            default: kube-scheduler
+                            type: string
+                          tagSuffix:
+                            description: |-
+                              The tag to append to all the Control Plane container images.
+                              Optional.
+                            type: string
+                        type: object
+                      replicas:
+                        default: 2
+                        format: int32
+                        type: integer
+                      resources:
+                        description: |-
+                          Resources defines the amount of memory and CPU to allocate to each component of the Control Plane
+                          (kube-apiserver, controller-manager, and scheduler).
+                        properties:
+                          apiServer:
+                            description: ResourceRequirements describes the compute resource requirements.
+                            properties:
+                              claims:
+                                description: |-
+                                  Claims lists the names of resources, defined in spec.resourceClaims,
+                                  that are used by this container.
+
+                                  This field depends on the
+                                  DynamicResourceAllocation feature gate.
+
+                                  This field is immutable. It can only be set for containers.
+                                items:
+                                  description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+                                  properties:
+                                    name:
+                                      description: |-
+                                        Name must match the name of one entry in pod.spec.resourceClaims of
+                                        the Pod where this field is used. It makes that resource available
+                                        inside a container.
+                                      type: string
+                                    request:
+                                      description: |-
+                                        Request is the name chosen for a request in the referenced claim.
+                                        If empty, everything from the claim is made available, otherwise
+                                        only the result of this request.
+                                      type: string
+                                  required:
+                                    - name
+                                  type: object
+                                type: array
+                                x-kubernetes-list-map-keys:
+                                  - name
+                                x-kubernetes-list-type: map
+                              limits:
+                                additionalProperties:
+                                  anyOf:
+                                    - type: integer
+                                    - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                description: |-
+                                  Limits describes the maximum amount of compute resources allowed.
+                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                type: object
+                              requests:
+                                additionalProperties:
+                                  anyOf:
+                                    - type: integer
+                                    - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                description: |-
+                                  Requests describes the minimum amount of compute resources required.
+                                  If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                  otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                type: object
+                            type: object
+                          controllerManager:
+                            description: ResourceRequirements describes the compute resource requirements.
+                            properties:
+                              claims:
+                                description: |-
+                                  Claims lists the names of resources, defined in spec.resourceClaims,
+                                  that are used by this container.
+
+                                  This field depends on the
+                                  DynamicResourceAllocation feature gate.
+
+                                  This field is immutable. It can only be set for containers.
+                                items:
+                                  description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+                                  properties:
+                                    name:
+                                      description: |-
+                                        Name must match the name of one entry in pod.spec.resourceClaims of
+                                        the Pod where this field is used. It makes that resource available
+                                        inside a container.
+                                      type: string
+                                    request:
+                                      description: |-
+                                        Request is the name chosen for a request in the referenced claim.
+                                        If empty, everything from the claim is made available, otherwise
+                                        only the result of this request.
+                                      type: string
+                                  required:
+                                    - name
+                                  type: object
+                                type: array
+                                x-kubernetes-list-map-keys:
+                                  - name
+                                x-kubernetes-list-type: map
+                              limits:
+                                additionalProperties:
+                                  anyOf:
+                                    - type: integer
+                                    - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                description: |-
+                                  Limits describes the maximum amount of compute resources allowed.
+                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                type: object
+                              requests:
+                                additionalProperties:
+                                  anyOf:
+                                    - type: integer
+                                    - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                description: |-
+                                  Requests describes the minimum amount of compute resources required.
+                                  If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                  otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                type: object
+                            type: object
+                          kine:
+                            description: |-
+                              Define the kine container resources.
+                              Available only if Kamaji is running using Kine as backing storage.
+                            properties:
+                              claims:
+                                description: |-
+                                  Claims lists the names of resources, defined in spec.resourceClaims,
+                                  that are used by this container.
+
+                                  This field depends on the
+                                  DynamicResourceAllocation feature gate.
+
+                                  This field is immutable. It can only be set for containers.
+                                items:
+                                  description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+                                  properties:
+                                    name:
+                                      description: |-
+                                        Name must match the name of one entry in pod.spec.resourceClaims of
+                                        the Pod where this field is used. It makes that resource available
+                                        inside a container.
+                                      type: string
+                                    request:
+                                      description: |-
+                                        Request is the name chosen for a request in the referenced claim.
+                                        If empty, everything from the claim is made available, otherwise
+                                        only the result of this request.
+                                      type: string
+                                  required:
+                                    - name
+                                  type: object
+                                type: array
+                                x-kubernetes-list-map-keys:
+                                  - name
+                                x-kubernetes-list-type: map
+                              limits:
+                                additionalProperties:
+                                  anyOf:
+                                    - type: integer
+                                    - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                description: |-
+                                  Limits describes the maximum amount of compute resources allowed.
+                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                type: object
+                              requests:
+                                additionalProperties:
+                                  anyOf:
+                                    - type: integer
+                                    - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                description: |-
+                                  Requests describes the minimum amount of compute resources required.
+                                  If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                  otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                type: object
+                            type: object
+                          scheduler:
+                            description: ResourceRequirements describes the compute resource requirements.
+                            properties:
+                              claims:
+                                description: |-
+                                  Claims lists the names of resources, defined in spec.resourceClaims,
+                                  that are used by this container.
+
+                                  This field depends on the
+                                  DynamicResourceAllocation feature gate.
+
+                                  This field is immutable. It can only be set for containers.
+                                items:
+                                  description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+                                  properties:
+                                    name:
+                                      description: |-
+                                        Name must match the name of one entry in pod.spec.resourceClaims of
+                                        the Pod where this field is used. It makes that resource available
+                                        inside a container.
+                                      type: string
+                                    request:
+                                      description: |-
+                                        Request is the name chosen for a request in the referenced claim.
+                                        If empty, everything from the claim is made available, otherwise
+                                        only the result of this request.
+                                      type: string
+                                  required:
+                                    - name
+                                  type: object
+                                type: array
+                                x-kubernetes-list-map-keys:
+                                  - name
+                                x-kubernetes-list-type: map
+                              limits:
+                                additionalProperties:
+                                  anyOf:
+                                    - type: integer
+                                    - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                description: |-
+                                  Limits describes the maximum amount of compute resources allowed.
+                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                type: object
+                              requests:
+                                additionalProperties:
+                                  anyOf:
+                                    - type: integer
+                                    - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                description: |-
+                                  Requests describes the minimum amount of compute resources required.
+                                  If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                  otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                type: object
+                            type: object
+                        type: object
+                      runtimeClassName:
+                        description: |-
+                          RuntimeClassName refers to a RuntimeClass object in the node.k8s.io group, which should be used
+                          to run the Tenant Control Plane pod. If no RuntimeClass resource matches the named class, the pod will not be run.
+                          If unset or empty, the "legacy" RuntimeClass will be used, which is an implicit class with an
+                          empty definition that uses the default runtime handler.
+                          More info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class
+                        type: string
+                      serviceAccountName:
+                        default: default
+                        description: ServiceAccountName allows to specify the service account to be mounted to the pods of the Control plane deployment
+                        type: string
+                      strategy:
+                        default:
+                          rollingUpdate:
+                            maxSurge: 100%
+                            maxUnavailable: 0
+                          type: RollingUpdate
+                        description: |-
+                          Strategy describes how to replace existing pods with new ones for the given Tenant Control Plane.
+                          Default value is set to Rolling Update, with a blue/green strategy.
+                        properties:
+                          rollingUpdate:
+                            description: |-
+                              Rolling update config params. Present only if DeploymentStrategyType =
+                              RollingUpdate.
+                            properties:
+                              maxSurge:
+                                anyOf:
+                                  - type: integer
+                                  - type: string
+                                description: |-
+                                  The maximum number of pods that can be scheduled above the desired number of
+                                  pods.
+                                  Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
+                                  This can not be 0 if MaxUnavailable is 0.
+                                  Absolute number is calculated from percentage by rounding up.
+                                  Defaults to 25%.
+                                  Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when
+                                  the rolling update starts, such that the total number of old and new pods do not exceed
+                                  130% of desired pods. Once old pods have been killed,
+                                  new ReplicaSet can be scaled up further, ensuring that total number of pods running
+                                  at any time during the update is at most 130% of desired pods.
+                                x-kubernetes-int-or-string: true
+                              maxUnavailable:
+                                anyOf:
+                                  - type: integer
+                                  - type: string
+                                description: |-
+                                  The maximum number of pods that can be unavailable during the update.
+                                  Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
+                                  Absolute number is calculated from percentage by rounding down.
+                                  This can not be 0 if MaxSurge is 0.
+                                  Defaults to 25%.
+                                  Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods
+                                  immediately when the rolling update starts. Once new pods are ready, old ReplicaSet
+                                  can be scaled down further, followed by scaling up the new ReplicaSet, ensuring
+                                  that the total number of pods available at all times during the update is at
+                                  least 70% of desired pods.
+                                x-kubernetes-int-or-string: true
+                            type: object
+                          type:
+                            description: Type of deployment. Can be "Recreate" or "RollingUpdate". Default is RollingUpdate.
+                            type: string
+                        type: object
+                      tolerations:
+                        description: |-
+                          If specified, the Tenant Control Plane pod's tolerations.
+                          More info: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
+                        items:
+                          description: |-
+                            The pod this Toleration is attached to tolerates any taint that matches
+                            the triple <key,value,effect> using the matching operator <operator>.
+                          properties:
+                            effect:
+                              description: |-
+                                Effect indicates the taint effect to match. Empty means match all taint effects.
+                                When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+                              type: string
+                            key:
+                              description: |-
+                                Key is the taint key that the toleration applies to. Empty means match all taint keys.
+                                If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+                              type: string
+                            operator:
+                              description: |-
+                                Operator represents a key's relationship to the value.
+                                Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
+                                Exists is equivalent to wildcard for value, so that a pod can
+                                tolerate all taints of a particular category.
+                                Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
+                              type: string
+                            tolerationSeconds:
+                              description: |-
+                                TolerationSeconds represents the period of time the toleration (which must be
+                                of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+                                it is not set, which means tolerate the taint forever (do not evict). Zero and
+                                negative values will be treated as 0 (evict immediately) by the system.
+                              format: int64
+                              type: integer
+                            value:
+                              description: |-
+                                Value is the taint value the toleration matches to.
+                                If the operator is Exists, the value should be empty, otherwise just a regular string.
+                              type: string
+                          type: object
+                        type: array
+                      topologySpreadConstraints:
+                        description: |-
+                          TopologySpreadConstraints describes how the Tenant Control Plane pods ought to spread across topology
+                          domains. Scheduler will schedule pods in a way which abides by the constraints.
+                          In case of nil underlying LabelSelector, the Kamaji one for the given Tenant Control Plane will be used.
+                          All topologySpreadConstraints are ANDed.
+                        items:
+                          description: TopologySpreadConstraint specifies how to spread matching pods among the given topology.
+                          properties:
+                            labelSelector:
+                              description: |-
+                                LabelSelector is used to find matching pods.
+                                Pods that match this label selector are counted to determine the number of pods
+                                in their corresponding topology domain.
+                              properties:
+                                matchExpressions:
+                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                  items:
+                                    description: |-
+                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                      relates the key and values.
+                                    properties:
+                                      key:
+                                        description: key is the label key that the selector applies to.
+                                        type: string
+                                      operator:
+                                        description: |-
+                                          operator represents a key's relationship to a set of values.
+                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          values is an array of string values. If the operator is In or NotIn,
+                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                          the values array must be empty. This array is replaced during a strategic
+                                          merge patch.
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    required:
+                                      - key
+                                      - operator
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                matchLabels:
+                                  additionalProperties:
+                                    type: string
+                                  description: |-
+                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                  type: object
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            matchLabelKeys:
+                              description: |-
+                                MatchLabelKeys is a set of pod label keys to select the pods over which
+                                spreading will be calculated. The keys are used to lookup values from the
+                                incoming pod labels, those key-value labels are ANDed with labelSelector
+                                to select the group of existing pods over which spreading will be calculated
+                                for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.
+                                MatchLabelKeys cannot be set when LabelSelector isn't set.
+                                Keys that don't exist in the incoming pod labels will
+                                be ignored. A null or empty list means only match against labelSelector.
+
+                                This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            maxSkew:
+                              description: |-
+                                MaxSkew describes the degree to which pods may be unevenly distributed.
+                                When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference
+                                between the number of matching pods in the target topology and the global minimum.
+                                The global minimum is the minimum number of matching pods in an eligible domain
+                                or zero if the number of eligible domains is less than MinDomains.
+                                For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same
+                                labelSelector spread as 2/2/1:
+                                In this case, the global minimum is 1.
+                                | zone1 | zone2 | zone3 |
+                                |  P P  |  P P  |   P   |
+                                - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2;
+                                scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2)
+                                violate MaxSkew(1).
+                                - if MaxSkew is 2, incoming pod can be scheduled onto any zone.
+                                When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence
+                                to topologies that satisfy it.
+                                It's a required field. Default value is 1 and 0 is not allowed.
+                              format: int32
+                              type: integer
+                            minDomains:
+                              description: |-
+                                MinDomains indicates a minimum number of eligible domains.
+                                When the number of eligible domains with matching topology keys is less than minDomains,
+                                Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed.
+                                And when the number of eligible domains with matching topology keys equals or greater than minDomains,
+                                this value has no effect on scheduling.
+                                As a result, when the number of eligible domains is less than minDomains,
+                                scheduler won't schedule more than maxSkew Pods to those domains.
+                                If value is nil, the constraint behaves as if MinDomains is equal to 1.
+                                Valid values are integers greater than 0.
+                                When value is not nil, WhenUnsatisfiable must be DoNotSchedule.
+
+                                For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same
+                                labelSelector spread as 2/2/2:
+                                | zone1 | zone2 | zone3 |
+                                |  P P  |  P P  |  P P  |
+                                The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0.
+                                In this situation, new pod with the same labelSelector cannot be scheduled,
+                                because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones,
+                                it will violate MaxSkew.
+                              format: int32
+                              type: integer
+                            nodeAffinityPolicy:
+                              description: |-
+                                NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector
+                                when calculating pod topology spread skew. Options are:
+                                - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.
+                                - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
+
+                                If this value is nil, the behavior is equivalent to the Honor policy.
+                              type: string
+                            nodeTaintsPolicy:
+                              description: |-
+                                NodeTaintsPolicy indicates how we will treat node taints when calculating
+                                pod topology spread skew. Options are:
+                                - Honor: nodes without taints, along with tainted nodes for which the incoming pod
+                                has a toleration, are included.
+                                - Ignore: node taints are ignored. All nodes are included.
+
+                                If this value is nil, the behavior is equivalent to the Ignore policy.
+                              type: string
+                            topologyKey:
+                              description: |-
+                                TopologyKey is the key of node labels. Nodes that have a label with this key
+                                and identical values are considered to be in the same topology.
+                                We consider each <key, value> as a "bucket", and try to put balanced number
+                                of pods into each bucket.
+                                We define a domain as a particular instance of a topology.
+                                Also, we define an eligible domain as a domain whose nodes meet the requirements of
+                                nodeAffinityPolicy and nodeTaintsPolicy.
+                                e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology.
+                                And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology.
+                                It's a required field.
+                              type: string
+                            whenUnsatisfiable:
+                              description: |-
+                                WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy
+                                the spread constraint.
+                                - DoNotSchedule (default) tells the scheduler not to schedule it.
+                                - ScheduleAnyway tells the scheduler to schedule the pod in any location,
+                                  but giving higher precedence to topologies that would help reduce the
+                                  skew.
+                                A constraint is considered "Unsatisfiable" for an incoming pod
+                                if and only if every possible node assignment for that pod would violate
+                                "MaxSkew" on some topology.
+                                For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same
+                                labelSelector spread as 3/1/1:
+                                | zone1 | zone2 | zone3 |
+                                | P P P |   P   |   P   |
+                                If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled
+                                to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies
+                                MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler
+                                won't make it *more* imbalanced.
+                                It's a required field.
+                              type: string
+                          required:
+                            - maxSkew
+                            - topologyKey
+                            - whenUnsatisfiable
+                          type: object
+                        type: array
+                    type: object
+                  gateway:
+                    description: Defining the options for an Optional Gateway which will expose API Server of the Tenant Control Plane
+                    properties:
+                      additionalMetadata:
+                        description: AdditionalMetadata to add Labels and Annotations support.
+                        properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                        type: object
+                      hostname:
+                        description: Hostname is an optional field which will be used as a route hostname.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                      parentRefs:
+                        description: GatewayParentRefs is the class of the Gateway resource to use.
+                        items:
+                          description: |-
+                            ParentReference identifies an API object (usually a Gateway) that can be considered
+                            a parent of this resource (usually a route). There are two kinds of parent resources
+                            with "Core" support:
+
+                            * Gateway (Gateway conformance profile)
+                            * Service (Mesh conformance profile, ClusterIP Services only)
+
+                            This API may be extended in the future to support additional kinds of parent
+                            resources.
+
+                            The API object must be valid in the cluster; the Group and Kind must
+                            be registered in the cluster for this reference to be valid.
+                          properties:
+                            group:
+                              default: gateway.networking.k8s.io
+                              description: |-
+                                Group is the group of the referent.
+                                When unspecified, "gateway.networking.k8s.io" is inferred.
+                                To set the core API group (such as for a "Service" kind referent),
+                                Group must be explicitly set to "" (empty string).
+
+                                Support: Core
+                              maxLength: 253
+                              pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            kind:
+                              default: Gateway
+                              description: |-
+                                Kind is kind of the referent.
+
+                                There are two kinds of parent resources with "Core" support:
+
+                                * Gateway (Gateway conformance profile)
+                                * Service (Mesh conformance profile, ClusterIP Services only)
+
+                                Support for other resources is Implementation-Specific.
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                              type: string
+                            name:
+                              description: |-
+                                Name is the name of the referent.
+
+                                Support: Core
+                              maxLength: 253
+                              minLength: 1
+                              type: string
+                            namespace:
+                              description: |-
+                                Namespace is the namespace of the referent. When unspecified, this refers
+                                to the local namespace of the Route.
+
+                                Note that there are specific rules for ParentRefs which cross namespace
+                                boundaries. Cross-namespace references are only valid if they are explicitly
+                                allowed by something in the namespace they are referring to. For example:
+                                Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                                generic way to enable any other kind of cross-namespace reference.
+
+                                <gateway:experimental:description>
+                                ParentRefs from a Route to a Service in the same namespace are "producer"
+                                routes, which apply default routing rules to inbound connections from
+                                any namespace to the Service.
+
+                                ParentRefs from a Route to a Service in a different namespace are
+                                "consumer" routes, and these routing rules are only applied to outbound
+                                connections originating from the same namespace as the Route, for which
+                                the intended destination of the connections are a Service targeted as a
+                                ParentRef of the Route.
+                                </gateway:experimental:description>
+
+                                Support: Core
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                              type: string
+                            port:
+                              description: |-
+                                Port is the network port this Route targets. It can be interpreted
+                                differently based on the type of parent resource.
+
+                                When the parent resource is a Gateway, this targets all listeners
+                                listening on the specified port that also support this kind of Route(and
+                                select this Route). It's not recommended to set `Port` unless the
+                                networking behaviors specified in a Route must apply to a specific port
+                                as opposed to a listener(s) whose port(s) may be changed. When both Port
+                                and SectionName are specified, the name and port of the selected listener
+                                must match both specified values.
+
+                                <gateway:experimental:description>
+                                When the parent resource is a Service, this targets a specific port in the
+                                Service spec. When both Port (experimental) and SectionName are specified,
+                                the name and port of the selected port must match both specified values.
+                                </gateway:experimental:description>
+
+                                Implementations MAY choose to support other parent resources.
+                                Implementations supporting other types of parent resources MUST clearly
+                                document how/if Port is interpreted.
+
+                                For the purpose of status, an attachment is considered successful as
+                                long as the parent resource accepts it partially. For example, Gateway
+                                listeners can restrict which Routes can attach to them by Route kind,
+                                namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                                from the referencing Route, the Route MUST be considered successfully
+                                attached. If no Gateway listeners accept attachment from this Route,
+                                the Route MUST be considered detached from the Gateway.
+
+                                Support: Extended
+                              format: int32
+                              maximum: 65535
+                              minimum: 1
+                              type: integer
+                            sectionName:
+                              description: |-
+                                SectionName is the name of a section within the target resource. In the
+                                following resources, SectionName is interpreted as the following:
+
+                                * Gateway: Listener name. When both Port (experimental) and SectionName
+                                are specified, the name and port of the selected listener must match
+                                both specified values.
+                                * Service: Port name. When both Port (experimental) and SectionName
+                                are specified, the name and port of the selected listener must match
+                                both specified values.
+
+                                Implementations MAY choose to support attaching Routes to other resources.
+                                If that is the case, they MUST clearly document how SectionName is
+                                interpreted.
+
+                                When unspecified (empty string), this will reference the entire resource.
+                                For the purpose of status, an attachment is considered successful if at
+                                least one section in the parent resource accepts it. For example, Gateway
+                                listeners can restrict which Routes can attach to them by Route kind,
+                                namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                                the referencing Route, the Route MUST be considered successfully
+                                attached. If no Gateway listeners accept attachment from this Route, the
+                                Route MUST be considered detached from the Gateway.
+
+                                Support: Core
+                              maxLength: 253
+                              minLength: 1
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                          required:
+                            - name
+                          type: object
+                        type: array
+                    type: object
+                    x-kubernetes-validations:
+                      - message: parentRefs must not specify port or sectionName, these are set automatically by Kamaji
+                        rule: '!has(self.parentRefs) || size(self.parentRefs) == 0 || self.parentRefs.all(ref, !has(ref.port) && !has(ref.sectionName))'
+                  ingress:
+                    description: Defining the options for an Optional Ingress which will expose API Server of the Tenant Control Plane
+                    properties:
+                      additionalMetadata:
+                        description: AdditionalMetadata defines which additional metadata, such as labels and annotations, must be attached to the created resource.
+                        properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                        type: object
+                      hostname:
+                        description: |-
+                          Hostname is an optional field which will be used as Ingress's Host. If it is not defined,
+                          Ingress's host will be "<tenant>.<namespace>.<domain>", where domain is specified under NetworkProfileSpec
+                        type: string
+                      ingressClassName:
+                        type: string
+                    type: object
+                  service:
+                    description: Defining the options for the Tenant Control Plane Service resource.
+                    properties:
+                      additionalMetadata:
+                        description: AdditionalMetadata defines which additional metadata, such as labels and annotations, must be attached to the created resource.
+                        properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                        type: object
+                      additionalPorts:
+                        description: |-
+                          AdditionalPorts allows adding additional ports to the Service generated Kamaji
+                          which targets the Tenant Control Plane pods.
+                        items:
+                          properties:
+                            appProtocol:
+                              description: |-
+                                The application protocol for this port.
+                                This is used as a hint for implementations to offer richer behavior for protocols that they understand.
+                                This field follows standard Kubernetes label syntax.
+                                Valid values are either:
+
+                                * Un-prefixed protocol names - reserved for IANA standard service names (as per
+                                RFC-6335 and https://www.iana.org/assignments/service-names).
+                              type: string
+                            name:
+                              description: |-
+                                The name of this port within the Service created by Kamaji.
+                                This must be a DNS_LABEL, must have unique names, and cannot be `kube-apiserver`, or `konnectivity-server`.
+                              type: string
+                            port:
+                              description: The port that will be exposed by this service.
+                              format: int32
+                              type: integer
+                            protocol:
+                              default: TCP
+                              description: The IP protocol for this port. Supports "TCP", "UDP", and "SCTP".
+                              enum:
+                                - TCP
+                                - UDP
+                                - SCTP
+                              type: string
+                            targetPort:
+                              anyOf:
+                                - type: integer
+                                - type: string
+                              description: |-
+                                Number or name of the port to access on the pods of the Tenant Control Plane.
+                                Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.
+                                If this is a string, it will be looked up as a named port in the
+                                target Pod's container ports. If this is not specified, the value
+                                of the 'port' field is used (an identity map).
+                              x-kubernetes-int-or-string: true
+                          required:
+                            - name
+                            - port
+                            - targetPort
+                          type: object
+                        type: array
+                      serviceType:
+                        description: ServiceType allows specifying how to expose the Tenant Control Plane.
+                        enum:
+                          - ClusterIP
+                          - NodePort
+                          - LoadBalancer
+                        type: string
+                    required:
+                      - serviceType
+                    type: object
+                required:
+                  - service
+                type: object
+                x-kubernetes-validations:
+                  - message: using both ingress and gateway is not supported
+                    rule: '!(has(self.ingress) && has(self.gateway))'
+              dataStore:
+                description: |-
+                  DataStore specifies the DataStore that should be used to store the Kubernetes data for the given Tenant Control Plane.
+                  When Kamaji runs with the default DataStore flag, all empty values will inherit the default value.
+                  By leaving it empty and running Kamaji with no default DataStore flag, it is possible to achieve automatic assignment to a specific DataStore object.
+
+                  Migration from one DataStore to another backed by the same Driver is possible. See: https://kamaji.clastix.io/guides/datastore-migration/
+                  Migration from one DataStore to another backed by a different Driver is not supported.
+                type: string
+              dataStoreOverrides:
+                description: DataStoreOverride defines which kubernetes resources will be stored in dedicated datastores.
+                items:
+                  description: DataStoreOverride defines which kubernetes resource will be stored in a dedicated datastore.
+                  properties:
+                    dataStore:
+                      description: DataStore specifies the DataStore that should be used to store the Kubernetes data for the given Resource.
+                      type: string
+                    resource:
+                      description: Resource specifies which kubernetes resource to target.
+                      type: string
+                  type: object
+                type: array
+              dataStoreSchema:
+                description: |-
+                  DataStoreSchema allows to specify the name of the database (for relational DataStores) or the key prefix (for etcd). This
+                  value is optional and immutable. Note that Kamaji currently doesn't ensure that DataStoreSchema values are unique. It's up
+                  to the user to avoid clashes between different TenantControlPlanes. If not set upon creation, Kamaji will default the
+                  DataStoreSchema by concatenating the namespace and name of the TenantControlPlane.
+                type: string
+                x-kubernetes-validations:
+                  - message: changing the dataStoreSchema is not supported
+                    rule: self == oldSelf
+              dataStoreUsername:
+                description: |-
+                  DataStoreUsername allows to specify the username of the database (for relational DataStores). This
+                  value is optional and immutable. Note that Kamaji currently doesn't ensure that DataStoreUsername values are unique. It's up
+                  to the user to avoid clashes between different TenantControlPlanes. If not set upon creation, Kamaji will default the
+                  DataStoreUsername by concatenating the namespace and name of the TenantControlPlane.
+                type: string
+                x-kubernetes-validations:
+                  - message: changing the dataStoreUsername is not supported
+                    rule: self == oldSelf
+              kubernetes:
+                description: Kubernetes specification for tenant control plane
+                properties:
+                  admissionControllers:
+                    default:
+                      - CertificateApproval
+                      - CertificateSigning
+                      - CertificateSubjectRestriction
+                      - DefaultIngressClass
+                      - DefaultStorageClass
+                      - DefaultTolerationSeconds
+                      - LimitRanger
+                      - MutatingAdmissionWebhook
+                      - NamespaceLifecycle
+                      - PersistentVolumeClaimResize
+                      - Priority
+                      - ResourceQuota
+                      - RuntimeClass
+                      - ServiceAccount
+                      - StorageObjectInUseProtection
+                      - TaintNodesByCondition
+                      - ValidatingAdmissionWebhook
+                    description: |-
+                      List of enabled Admission Controllers for the Tenant cluster.
+                      Full reference available here: https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers
+                    items:
+                      enum:
+                        - AlwaysAdmit
+                        - AlwaysDeny
+                        - AlwaysPullImages
+                        - CertificateApproval
+                        - CertificateSigning
+                        - CertificateSubjectRestriction
+                        - DefaultIngressClass
+                        - DefaultStorageClass
+                        - DefaultTolerationSeconds
+                        - DenyEscalatingExec
+                        - DenyExecOnPrivileged
+                        - DenyServiceExternalIPs
+                        - EventRateLimit
+                        - ExtendedResourceToleration
+                        - ImagePolicyWebhook
+                        - LimitPodHardAntiAffinityTopology
+                        - LimitRanger
+                        - MutatingAdmissionWebhook
+                        - NamespaceAutoProvision
+                        - NamespaceExists
+                        - NamespaceLifecycle
+                        - NodeRestriction
+                        - OwnerReferencesPermissionEnforcement
+                        - PersistentVolumeClaimResize
+                        - PersistentVolumeLabel
+                        - PodNodeSelector
+                        - PodSecurity
+                        - PodSecurityPolicy
+                        - PodTolerationRestriction
+                        - Priority
+                        - ResourceQuota
+                        - RuntimeClass
+                        - SecurityContextDeny
+                        - ServiceAccount
+                        - StorageObjectInUseProtection
+                        - TaintNodesByCondition
+                        - ValidatingAdmissionWebhook
+                      type: string
+                    type: array
+                  kubelet:
+                    properties:
+                      cgroupfs:
+                        description: |-
+                          CGroupFS defines the cgroup driver for Kubelet
+                          https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver/
+
+                          Deprecated: use ConfigurationJSONPatches.
+                        enum:
+                          - systemd
+                          - cgroupfs
+                        type: string
+                      configurationJSONPatches:
+                        description: |-
+                          ConfigurationJSONPatches contains the RFC 6902 JSON patches to customise the kubeadm generate configuration,
+                          useful to customise and mangling the configuration according to your needs;
+                          e.g.: configuring the cgroup driver used by Kubelet is possible via the following patch:
+
+                          [{"op": "replace", "path": "/cgroupDriver", "value": "systemd"}]
+                        items:
+                          properties:
+                            from:
+                              description: From specifies the source location for move or copy operations.
+                              type: string
+                            op:
+                              description: Op is the RFC 6902 JSON Patch operation.
+                              enum:
+                                - add
+                                - remove
+                                - replace
+                                - move
+                                - copy
+                                - test
+                              type: string
+                            path:
+                              description: Path specifies the target location in the JSON document. Use "/" to separate keys; "-" for appending to arrays.
+                              type: string
+                            value:
+                              description: Value is the operation value to be used when Op is add, replace, test.
+                              x-kubernetes-preserve-unknown-fields: true
+                          required:
+                            - op
+                            - path
+                          type: object
+                        type: array
+                      preferredAddressTypes:
+                        default:
+                          - InternalIP
+                          - ExternalIP
+                          - Hostname
+                        description: |-
+                          Ordered list of the preferred NodeAddressTypes to use for kubelet connections.
+                          Default to InternalIP, ExternalIP, Hostname.
+                        items:
+                          enum:
+                            - Hostname
+                            - InternalIP
+                            - ExternalIP
+                            - InternalDNS
+                            - ExternalDNS
+                          type: string
+                        minItems: 1
+                        type: array
+                        x-kubernetes-list-type: set
+                    type: object
+                  version:
+                    description: Kubernetes Version for the tenant control plane
+                    type: string
+                required:
+                  - kubelet
+                  - version
+                type: object
+              networkProfile:
+                description: NetworkProfile specifies how the network is
+                properties:
+                  address:
+                    description: |-
+                      Address where API server of will be exposed.
+                      In case of LoadBalancer Service, this can be empty in order to use the exposed IP provided by the cloud controller manager.
+                    type: string
+                  allowAddressAsExternalIP:
+                    description: |-
+                      AllowAddressAsExternalIP will include tenantControlPlane.Spec.NetworkProfile.Address in the section of
+                      ExternalIPs of the Kubernetes Service (only ClusterIP or NodePort)
+                    type: boolean
+                  certSANs:
+                    description: |-
+                      CertSANs sets extra Subject Alternative Names (SANs) for the API Server signing certificate.
+                      Use this field to add additional hostnames when exposing the Tenant Control Plane with third solutions.
+                    items:
+                      type: string
+                    type: array
+                  clusterDomain:
+                    default: cluster.local
+                    description: The default domain name used for DNS resolution within the cluster.
+                    pattern: .*\..*
+                    type: string
+                    x-kubernetes-validations:
+                      - message: changing the cluster domain is not supported
+                        rule: self == oldSelf
+                  dnsServiceIPs:
+                    description: |-
+                      The DNS Service for internal resolution, it must match the Service CIDR.
+                      In case of an empty value, it is automatically computed according to the Service CIDR, e.g.:
+                      Service CIDR 10.96.0.0/16, the resulting DNS Service IP will be 10.96.0.10 for IPv4,
+                      for IPv6 from the CIDR 2001:db8:abcd::/64 the resulting DNS Service IP will be 2001:db8:abcd::10.
+                    items:
+                      type: string
+                    type: array
+                  loadBalancerClass:
+                    description: |-
+                      Specify the LoadBalancer class in case of multiple load balancer implementations.
+                      Field supported only for Tenant Control Plane instances exposed using a LoadBalancer Service.
+                    minLength: 1
+                    type: string
+                    x-kubernetes-validations:
+                      - message: LoadBalancerClass is immutable
+                        rule: self == oldSelf
+                  loadBalancerSourceRanges:
+                    description: |-
+                      LoadBalancerSourceRanges restricts the IP ranges that can access
+                      the LoadBalancer type Service. This field defines a list of IP
+                      address ranges (in CIDR format) that are allowed to access the service.
+                      If left empty, the service will allow traffic from all IP ranges (0.0.0.0/0).
+                      This feature is useful for restricting access to API servers or services
+                      to specific networks for security purposes.
+                      Example: {"192.168.1.0/24", "10.0.0.0/8"}
+                    items:
+                      type: string
+                    type: array
+                  podCidr:
+                    default: 10.244.0.0/16
+                    description: 'CIDR for Kubernetes Pods: if empty, defaulted to 10.244.0.0/16.'
+                    type: string
+                  port:
+                    default: 6443
+                    description: Port where API server of will be exposed
+                    format: int32
+                    type: integer
+                  serviceCidr:
+                    default: 10.96.0.0/16
+                    description: 'CIDR for Kubernetes Services: if empty, defaulted to 10.96.0.0/16.'
+                    type: string
+                type: object
+              writePermissions:
+                description: |-
+                  WritePermissions allows to select which operations (create, delete, update) must be blocked:
+                  by default, all actions are allowed, and API Server can write to its Datastore.
+
+                  By blocking all actions, the Tenant Control Plane can enter in a Read Only mode:
+                  this phase can be used to prevent Datastore quota exhaustion or for your own business logic
+                  (e.g.: blocking creation and update, but allowing deletion to "clean up" space).
+                properties:
+                  blockCreation:
+                    type: boolean
+                  blockDeletion:
+                    type: boolean
+                  blockUpdate:
+                    type: boolean
+                type: object
+            required:
+              - controlPlane
+              - kubernetes
+            type: object
+            x-kubernetes-validations:
+              - message: unsetting the dataStore is not supported
+                rule: '!has(oldSelf.dataStore) || has(self.dataStore)'
+              - message: unsetting the dataStoreSchema is not supported
+                rule: '!has(oldSelf.dataStoreSchema) || has(self.dataStoreSchema)'
+              - message: unsetting the dataStoreUsername is not supported
+                rule: '!has(oldSelf.dataStoreUsername) || has(self.dataStoreUsername)'
+              - message: LoadBalancer source ranges are supported only with LoadBalancer service type
+                rule: '!has(self.networkProfile.loadBalancerSourceRanges) || (size(self.networkProfile.loadBalancerSourceRanges) == 0 || self.controlPlane.service.serviceType == ''LoadBalancer'')'
+              - message: LoadBalancerClass is supported only with LoadBalancer service type
+                rule: '!has(self.networkProfile.loadBalancerClass) || self.controlPlane.service.serviceType == ''LoadBalancer'''
+              - message: LoadBalancerClass cannot be set or unset at runtime
+                rule: self.controlPlane.service.serviceType != 'LoadBalancer' || (oldSelf.controlPlane.service.serviceType != 'LoadBalancer' && self.controlPlane.service.serviceType == 'LoadBalancer') || has(self.networkProfile.loadBalancerClass) == has(oldSelf.networkProfile.loadBalancerClass)
+          status:
+            description: TenantControlPlaneStatus defines the observed state of TenantControlPlane.
+            properties:
+              addons:
+                description: Addons contains the status of the different Addons
+                properties:
+                  coreDNS:
+                    description: AddonStatus defines the observed state of an Addon.
+                    properties:
+                      enabled:
+                        type: boolean
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                    required:
+                      - enabled
+                    type: object
+                  konnectivity:
+                    description: KonnectivityStatus defines the status of Konnectivity as Addon.
+                    properties:
+                      agent:
+                        properties:
+                          lastUpdate:
+                            description: Last time when k8s object was updated
+                            format: date-time
+                            type: string
+                          mode:
+                            type: string
+                          name:
+                            type: string
+                          namespace:
+                            type: string
+                        type: object
+                      certificate:
+                        description: CertificatePrivateKeyPairStatus defines the status.
+                        properties:
+                          checksum:
+                            type: string
+                          lastUpdate:
+                            format: date-time
+                            type: string
+                          secretName:
+                            type: string
+                        type: object
+                      clusterrolebinding:
+                        properties:
+                          lastUpdate:
+                            description: Last time when k8s object was updated
+                            format: date-time
+                            type: string
+                          name:
+                            type: string
+                          namespace:
+                            type: string
+                        type: object
+                      configMap:
+                        properties:
+                          checksum:
+                            type: string
+                          name:
+                            type: string
+                        type: object
+                      enabled:
+                        type: boolean
+                      gateway:
+                        description: KubernetesGatewayStatus defines the status for the Tenant Control Plane Gateway in the management cluster.
+                        properties:
+                          accessPoints:
+                            description: A list of valid access points that the route exposes.
+                            items:
+                              properties:
+                                port:
+                                  format: int32
+                                  type: integer
+                                type:
+                                  description: |-
+                                    AddressType defines how a network address is represented as a text string.
+                                    This may take two possible forms:
+
+                                    * A predefined CamelCase string identifier (currently limited to `IPAddress` or `Hostname`)
+                                    * A domain-prefixed string identifier (like `acme.io/CustomAddressType`)
+
+                                    Values `IPAddress` and `Hostname` have Extended support.
+
+                                    The `NamedAddress` value has been deprecated in favor of implementation
+                                    specific domain-prefixed strings.
+
+                                    All other values, including domain-prefixed values have Implementation-specific support,
+                                    which are used in implementation-specific behaviors. Support for additional
+                                    predefined CamelCase identifiers may be added in future releases.
+                                  maxLength: 253
+                                  minLength: 1
+                                  pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                                  type: string
+                                urls:
+                                  items:
+                                    type: string
+                                  type: array
+                                value:
+                                  type: string
+                              required:
+                                - port
+                                - type
+                                - value
+                              type: object
+                            type: array
+                          parents:
+                            description: |-
+                              Parents is a list of parent resources (usually Gateways) that are
+                              associated with the route, and the status of the route with respect to
+                              each parent. When this route attaches to a parent, the controller that
+                              manages the parent must add an entry to this list when the controller
+                              first sees the route and should update the entry as appropriate when the
+                              route or gateway is modified.
+
+                              Note that parent references that cannot be resolved by an implementation
+                              of this API will not be added to this list. Implementations of this API
+                              can only populate Route status for the Gateways/parent resources they are
+                              responsible for.
+
+                              A maximum of 32 Gateways will be represented in this list. An empty list
+                              means the route has not been attached to any Gateway.
+
+                              <gateway:util:excludeFromCRD>
+                              Notes for implementors:
+
+                              While parents is not a listType `map`, this is due to the fact that the
+                              list key is not scalar, and Kubernetes is unable to represent this.
+
+                              Parent status MUST be considered to be namespaced by the combination of
+                              the parentRef and controllerName fields, and implementations should keep
+                              the following rules in mind when updating this status:
+
+                              * Implementations MUST update only entries that have a matching value of
+                                `controllerName` for that implementation.
+                              * Implementations MUST NOT update entries with non-matching `controllerName`
+                                fields.
+                              * Implementations MUST treat each `parentRef`` in the Route separately and
+                                update its status based on the relationship with that parent.
+                              * Implementations MUST perform a read-modify-write cycle on this field
+                                before modifying it. That is, when modifying this field, implementations
+                                must be confident they have fetched the most recent version of this field,
+                                and ensure that changes they make are on that recent version.
+
+                              </gateway:util:excludeFromCRD>
+                            items:
+                              description: |-
+                                RouteParentStatus describes the status of a route with respect to an
+                                associated Parent.
+                              properties:
+                                conditions:
+                                  description: |-
+                                    Conditions describes the status of the route with respect to the Gateway.
+                                    Note that the route's availability is also subject to the Gateway's own
+                                    status conditions and listener status.
+
+                                    If the Route's ParentRef specifies an existing Gateway that supports
+                                    Routes of this kind AND that Gateway's controller has sufficient access,
+                                    then that Gateway's controller MUST set the "Accepted" condition on the
+                                    Route, to indicate whether the route has been accepted or rejected by the
+                                    Gateway, and why.
+
+                                    A Route MUST be considered "Accepted" if at least one of the Route's
+                                    rules is implemented by the Gateway.
+
+                                    There are a number of cases where the "Accepted" condition may not be set
+                                    due to lack of controller visibility, that includes when:
+
+                                    * The Route refers to a nonexistent parent.
+                                    * The Route is of a type that the controller does not support.
+                                    * The Route is in a namespace the controller does not have access to.
+
+                                    <gateway:util:excludeFromCRD>
+
+                                    Notes for implementors:
+
+                                    Conditions are a listType `map`, which means that they function like a
+                                    map with a key of the `type` field _in the k8s apiserver_.
+
+                                    This means that implementations must obey some rules when updating this
+                                    section.
+
+                                    * Implementations MUST perform a read-modify-write cycle on this field
+                                      before modifying it. That is, when modifying this field, implementations
+                                      must be confident they have fetched the most recent version of this field,
+                                      and ensure that changes they make are on that recent version.
+                                    * Implementations MUST NOT remove or reorder Conditions that they are not
+                                      directly responsible for. For example, if an implementation sees a Condition
+                                      with type `special.io/SomeField`, it MUST NOT remove, change or update that
+                                      Condition.
+                                    * Implementations MUST always _merge_ changes into Conditions of the same Type,
+                                      rather than creating more than one Condition of the same Type.
+                                    * Implementations MUST always update the `observedGeneration` field of the
+                                      Condition to the `metadata.generation` of the Gateway at the time of update creation.
+                                    * If the `observedGeneration` of a Condition is _greater than_ the value the
+                                      implementation knows about, then it MUST NOT perform the update on that Condition,
+                                      but must wait for a future reconciliation and status update. (The assumption is that
+                                      the implementation's copy of the object is stale and an update will be re-triggered
+                                      if relevant.)
+
+                                    </gateway:util:excludeFromCRD>
+                                  items:
+                                    description: Condition contains details for one aspect of the current state of this API Resource.
+                                    properties:
+                                      lastTransitionTime:
+                                        description: |-
+                                          lastTransitionTime is the last time the condition transitioned from one status to another.
+                                          This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                                        format: date-time
+                                        type: string
+                                      message:
+                                        description: |-
+                                          message is a human readable message indicating details about the transition.
+                                          This may be an empty string.
+                                        maxLength: 32768
+                                        type: string
+                                      observedGeneration:
+                                        description: |-
+                                          observedGeneration represents the .metadata.generation that the condition was set based upon.
+                                          For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                                          with respect to the current state of the instance.
+                                        format: int64
+                                        minimum: 0
+                                        type: integer
+                                      reason:
+                                        description: |-
+                                          reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                                          Producers of specific condition types may define expected values and meanings for this field,
+                                          and whether the values are considered a guaranteed API.
+                                          The value should be a CamelCase string.
+                                          This field may not be empty.
+                                        maxLength: 1024
+                                        minLength: 1
+                                        pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                                        type: string
+                                      status:
+                                        description: status of the condition, one of True, False, Unknown.
+                                        enum:
+                                          - "True"
+                                          - "False"
+                                          - Unknown
+                                        type: string
+                                      type:
+                                        description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                                        maxLength: 316
+                                        pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                                        type: string
+                                    required:
+                                      - lastTransitionTime
+                                      - message
+                                      - reason
+                                      - status
+                                      - type
+                                    type: object
+                                  maxItems: 8
+                                  minItems: 1
+                                  type: array
+                                  x-kubernetes-list-map-keys:
+                                    - type
+                                  x-kubernetes-list-type: map
+                                controllerName:
+                                  description: |-
+                                    ControllerName is a domain/path string that indicates the name of the
+                                    controller that wrote this status. This corresponds with the
+                                    controllerName field on GatewayClass.
+
+                                    Example: "example.net/gateway-controller".
+
+                                    The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
+                                    valid Kubernetes names
+                                    (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
+
+                                    Controllers MUST populate this field when writing status. Controllers should ensure that
+                                    entries to status populated with their ControllerName are cleaned up when they are no
+                                    longer necessary.
+                                  maxLength: 253
+                                  minLength: 1
+                                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                                  type: string
+                                parentRef:
+                                  description: |-
+                                    ParentRef corresponds with a ParentRef in the spec that this
+                                    RouteParentStatus struct describes the status of.
+                                  properties:
+                                    group:
+                                      default: gateway.networking.k8s.io
+                                      description: |-
+                                        Group is the group of the referent.
+                                        When unspecified, "gateway.networking.k8s.io" is inferred.
+                                        To set the core API group (such as for a "Service" kind referent),
+                                        Group must be explicitly set to "" (empty string).
+
+                                        Support: Core
+                                      maxLength: 253
+                                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
+                                    kind:
+                                      default: Gateway
+                                      description: |-
+                                        Kind is kind of the referent.
+
+                                        There are two kinds of parent resources with "Core" support:
+
+                                        * Gateway (Gateway conformance profile)
+                                        * Service (Mesh conformance profile, ClusterIP Services only)
+
+                                        Support for other resources is Implementation-Specific.
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                      type: string
+                                    name:
+                                      description: |-
+                                        Name is the name of the referent.
+
+                                        Support: Core
+                                      maxLength: 253
+                                      minLength: 1
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace is the namespace of the referent. When unspecified, this refers
+                                        to the local namespace of the Route.
+
+                                        Note that there are specific rules for ParentRefs which cross namespace
+                                        boundaries. Cross-namespace references are only valid if they are explicitly
+                                        allowed by something in the namespace they are referring to. For example:
+                                        Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                                        generic way to enable any other kind of cross-namespace reference.
+
+                                        <gateway:experimental:description>
+                                        ParentRefs from a Route to a Service in the same namespace are "producer"
+                                        routes, which apply default routing rules to inbound connections from
+                                        any namespace to the Service.
+
+                                        ParentRefs from a Route to a Service in a different namespace are
+                                        "consumer" routes, and these routing rules are only applied to outbound
+                                        connections originating from the same namespace as the Route, for which
+                                        the intended destination of the connections are a Service targeted as a
+                                        ParentRef of the Route.
+                                        </gateway:experimental:description>
+
+                                        Support: Core
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                      type: string
+                                    port:
+                                      description: |-
+                                        Port is the network port this Route targets. It can be interpreted
+                                        differently based on the type of parent resource.
+
+                                        When the parent resource is a Gateway, this targets all listeners
+                                        listening on the specified port that also support this kind of Route(and
+                                        select this Route). It's not recommended to set `Port` unless the
+                                        networking behaviors specified in a Route must apply to a specific port
+                                        as opposed to a listener(s) whose port(s) may be changed. When both Port
+                                        and SectionName are specified, the name and port of the selected listener
+                                        must match both specified values.
+
+                                        <gateway:experimental:description>
+                                        When the parent resource is a Service, this targets a specific port in the
+                                        Service spec. When both Port (experimental) and SectionName are specified,
+                                        the name and port of the selected port must match both specified values.
+                                        </gateway:experimental:description>
+
+                                        Implementations MAY choose to support other parent resources.
+                                        Implementations supporting other types of parent resources MUST clearly
+                                        document how/if Port is interpreted.
+
+                                        For the purpose of status, an attachment is considered successful as
+                                        long as the parent resource accepts it partially. For example, Gateway
+                                        listeners can restrict which Routes can attach to them by Route kind,
+                                        namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                                        from the referencing Route, the Route MUST be considered successfully
+                                        attached. If no Gateway listeners accept attachment from this Route,
+                                        the Route MUST be considered detached from the Gateway.
+
+                                        Support: Extended
+                                      format: int32
+                                      maximum: 65535
+                                      minimum: 1
+                                      type: integer
+                                    sectionName:
+                                      description: |-
+                                        SectionName is the name of a section within the target resource. In the
+                                        following resources, SectionName is interpreted as the following:
+
+                                        * Gateway: Listener name. When both Port (experimental) and SectionName
+                                        are specified, the name and port of the selected listener must match
+                                        both specified values.
+                                        * Service: Port name. When both Port (experimental) and SectionName
+                                        are specified, the name and port of the selected listener must match
+                                        both specified values.
+
+                                        Implementations MAY choose to support attaching Routes to other resources.
+                                        If that is the case, they MUST clearly document how SectionName is
+                                        interpreted.
+
+                                        When unspecified (empty string), this will reference the entire resource.
+                                        For the purpose of status, an attachment is considered successful if at
+                                        least one section in the parent resource accepts it. For example, Gateway
+                                        listeners can restrict which Routes can attach to them by Route kind,
+                                        namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                                        the referencing Route, the Route MUST be considered successfully
+                                        attached. If no Gateway listeners accept attachment from this Route, the
+                                        Route MUST be considered detached from the Gateway.
+
+                                        Support: Core
+                                      maxLength: 253
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
+                                  required:
+                                    - name
+                                  type: object
+                              required:
+                                - conditions
+                                - controllerName
+                                - parentRef
+                              type: object
+                            maxItems: 32
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          routeRef:
+                            description: Reference to the route created for this tenant.
+                            properties:
+                              name:
+                                default: ""
+                                description: |-
+                                  Name of the referent.
+                                  This field is effectively required, but due to backwards compatibility is
+                                  allowed to be empty. Instances of this type with an empty value here are
+                                  almost certainly wrong.
+                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                type: string
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        required:
+                          - parents
+                        type: object
+                      kubeconfig:
+                        description: KubeconfigStatus contains information about the generated kubeconfig.
+                        properties:
+                          checksum:
+                            type: string
+                          lastUpdate:
+                            format: date-time
+                            type: string
+                          secretName:
+                            type: string
+                        type: object
+                      sa:
+                        properties:
+                          lastUpdate:
+                            description: Last time when k8s object was updated
+                            format: date-time
+                            type: string
+                          name:
+                            type: string
+                          namespace:
+                            type: string
+                        type: object
+                      service:
+                        description: KubernetesServiceStatus defines the status for the Tenant Control Plane Service in the management cluster.
+                        properties:
+                          conditions:
+                            description: Current service state
+                            items:
+                              description: Condition contains details for one aspect of the current state of this API Resource.
+                              properties:
+                                lastTransitionTime:
+                                  description: |-
+                                    lastTransitionTime is the last time the condition transitioned from one status to another.
+                                    This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                                  format: date-time
+                                  type: string
+                                message:
+                                  description: |-
+                                    message is a human readable message indicating details about the transition.
+                                    This may be an empty string.
+                                  maxLength: 32768
+                                  type: string
+                                observedGeneration:
+                                  description: |-
+                                    observedGeneration represents the .metadata.generation that the condition was set based upon.
+                                    For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                                    with respect to the current state of the instance.
+                                  format: int64
+                                  minimum: 0
+                                  type: integer
+                                reason:
+                                  description: |-
+                                    reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                                    Producers of specific condition types may define expected values and meanings for this field,
+                                    and whether the values are considered a guaranteed API.
+                                    The value should be a CamelCase string.
+                                    This field may not be empty.
+                                  maxLength: 1024
+                                  minLength: 1
+                                  pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                                  type: string
+                                status:
+                                  description: status of the condition, one of True, False, Unknown.
+                                  enum:
+                                    - "True"
+                                    - "False"
+                                    - Unknown
+                                  type: string
+                                type:
+                                  description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                                  maxLength: 316
+                                  pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                                  type: string
+                              required:
+                                - lastTransitionTime
+                                - message
+                                - reason
+                                - status
+                                - type
+                              type: object
+                            type: array
+                            x-kubernetes-list-map-keys:
+                              - type
+                            x-kubernetes-list-type: map
+                          loadBalancer:
+                            description: |-
+                              LoadBalancer contains the current status of the load-balancer,
+                              if one is present.
+                            properties:
+                              ingress:
+                                description: |-
+                                  Ingress is a list containing ingress points for the load-balancer.
+                                  Traffic intended for the service should be sent to these ingress points.
+                                items:
+                                  description: |-
+                                    LoadBalancerIngress represents the status of a load-balancer ingress point:
+                                    traffic intended for the service should be sent to an ingress point.
+                                  properties:
+                                    hostname:
+                                      description: |-
+                                        Hostname is set for load-balancer ingress points that are DNS based
+                                        (typically AWS load-balancers)
+                                      type: string
+                                    ip:
+                                      description: |-
+                                        IP is set for load-balancer ingress points that are IP based
+                                        (typically GCE or OpenStack load-balancers)
+                                      type: string
+                                    ipMode:
+                                      description: |-
+                                        IPMode specifies how the load-balancer IP behaves, and may only be specified when the ip field is specified.
+                                        Setting this to "VIP" indicates that traffic is delivered to the node with
+                                        the destination set to the load-balancer's IP and port.
+                                        Setting this to "Proxy" indicates that traffic is delivered to the node or pod with
+                                        the destination set to the node's IP and node port or the pod's IP and port.
+                                        Service implementations may use this information to adjust traffic routing.
+                                      type: string
+                                    ports:
+                                      description: |-
+                                        Ports is a list of records of service ports
+                                        If used, every port defined in the service should have an entry in it
+                                      items:
+                                        description: PortStatus represents the error condition of a service port
+                                        properties:
+                                          error:
+                                            description: |-
+                                              Error is to record the problem with the service port
+                                              The format of the error shall comply with the following rules:
+                                              - built-in error values shall be specified in this file and those shall use
+                                                CamelCase names
+                                              - cloud provider specific error values must have names that comply with the
+                                                format foo.example.com/CamelCase.
+                                            maxLength: 316
+                                            pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                                            type: string
+                                          port:
+                                            description: Port is the port number of the service port of which status is recorded here
+                                            format: int32
+                                            type: integer
+                                          protocol:
+                                            description: |-
+                                              Protocol is the protocol of the service port of which status is recorded here
+                                              The supported values are: "TCP", "UDP", "SCTP"
+                                            type: string
+                                        required:
+                                          - error
+                                          - port
+                                          - protocol
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                            type: object
+                          name:
+                            description: The name of the Service for the given cluster.
+                            type: string
+                          namespace:
+                            description: The namespace which the Service for the given cluster is deployed.
+                            type: string
+                          port:
+                            description: The port where the service is running
+                            format: int32
+                            type: integer
+                        required:
+                          - name
+                          - namespace
+                          - port
+                        type: object
+                    required:
+                      - enabled
+                    type: object
+                  kubeProxy:
+                    description: AddonStatus defines the observed state of an Addon.
+                    properties:
+                      enabled:
+                        type: boolean
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                    required:
+                      - enabled
+                    type: object
+                type: object
+              certificates:
+                description: |-
+                  Certificates contains information about the different certificates
+                  that are necessary to run a kubernetes control plane
+                properties:
+                  apiServer:
+                    description: CertificatePrivateKeyPairStatus defines the status.
+                    properties:
+                      checksum:
+                        type: string
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                      secretName:
+                        type: string
+                    type: object
+                  apiServerKubeletClient:
+                    description: CertificatePrivateKeyPairStatus defines the status.
+                    properties:
+                      checksum:
+                        type: string
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                      secretName:
+                        type: string
+                    type: object
+                  ca:
+                    description: CertificatePrivateKeyPairStatus defines the status.
+                    properties:
+                      checksum:
+                        type: string
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                      secretName:
+                        type: string
+                    type: object
+                  etcd:
+                    description: ETCDCertificatesStatus defines the observed state of ETCD Certificate for API server.
+                    properties:
+                      apiServer:
+                        description: APIServerCertificatesStatus defines the observed state of ETCD Certificate for API server.
+                        properties:
+                          checksum:
+                            type: string
+                          lastUpdate:
+                            format: date-time
+                            type: string
+                          secretName:
+                            type: string
+                        type: object
+                      ca:
+                        description: ETCDCertificateStatus defines the observed state of ETCD Certificate for API server.
+                        properties:
+                          checksum:
+                            type: string
+                          lastUpdate:
+                            format: date-time
+                            type: string
+                          secretName:
+                            type: string
+                        type: object
+                    type: object
+                  frontProxyCA:
+                    description: CertificatePrivateKeyPairStatus defines the status.
+                    properties:
+                      checksum:
+                        type: string
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                      secretName:
+                        type: string
+                    type: object
+                  frontProxyClient:
+                    description: CertificatePrivateKeyPairStatus defines the status.
+                    properties:
+                      checksum:
+                        type: string
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                      secretName:
+                        type: string
+                    type: object
+                  sa:
+                    description: PublicKeyPrivateKeyPairStatus defines the status.
+                    properties:
+                      checksum:
+                        type: string
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                      secretName:
+                        type: string
+                    type: object
+                type: object
+              controlPlaneEndpoint:
+                description: ControlPlaneEndpoint contains the status of the kubernetes control plane
+                type: string
+              kubeadmPhase:
+                description: KubeadmPhase contains the status of the kubeadm phases action
+                properties:
+                  bootstrapToken:
+                    description: KubeadmPhaseStatus contains the status of a kubeadm phase action.
+                    properties:
+                      checksum:
+                        type: string
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                    type: object
+                required:
+                  - bootstrapToken
+                type: object
+              kubeadmconfig:
+                description: KubeadmConfig contains the status of the configuration required by kubeadm
+                properties:
+                  checksum:
+                    description: Checksum of the kubeadm configuration to detect changes
+                    type: string
+                  configmapName:
+                    type: string
+                  lastUpdate:
+                    format: date-time
+                    type: string
+                type: object
+              kubeconfig:
+                description: KubeConfig contains information about the kubenconfigs that control plane pieces need
+                properties:
+                  admin:
+                    description: KubeconfigStatus contains information about the generated kubeconfig.
+                    properties:
+                      checksum:
+                        type: string
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                      secretName:
+                        type: string
+                    type: object
+                  controllerManager:
+                    description: KubeconfigStatus contains information about the generated kubeconfig.
+                    properties:
+                      checksum:
+                        type: string
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                      secretName:
+                        type: string
+                    type: object
+                  scheduler:
+                    description: KubeconfigStatus contains information about the generated kubeconfig.
+                    properties:
+                      checksum:
+                        type: string
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                      secretName:
+                        type: string
+                    type: object
+                type: object
+              kubernetesResources:
+                description: Kubernetes contains information about the reconciliation of the required Kubernetes resources deployed in the admin cluster
+                properties:
+                  deployment:
+                    description: KubernetesDeploymentStatus defines the status for the Tenant Control Plane Deployment in the management cluster.
+                    properties:
+                      availableReplicas:
+                        description: Total number of available non-terminating pods (ready for at least minReadySeconds) targeted by this deployment.
+                        format: int32
+                        type: integer
+                      collisionCount:
+                        description: |-
+                          Count of hash collisions for the Deployment. The Deployment controller uses this
+                          field as a collision avoidance mechanism when it needs to create the name for the
+                          newest ReplicaSet.
+                        format: int32
+                        type: integer
+                      conditions:
+                        description: Represents the latest available observations of a deployment's current state.
+                        items:
+                          description: DeploymentCondition describes the state of a deployment at a certain point.
+                          properties:
+                            lastTransitionTime:
+                              description: Last time the condition transitioned from one status to another.
+                              format: date-time
+                              type: string
+                            lastUpdateTime:
+                              description: The last time this condition was updated.
+                              format: date-time
+                              type: string
+                            message:
+                              description: A human readable message indicating details about the transition.
+                              type: string
+                            reason:
+                              description: The reason for the condition's last transition.
+                              type: string
+                            status:
+                              description: Status of the condition, one of True, False, Unknown.
+                              type: string
+                            type:
+                              description: Type of deployment condition.
+                              type: string
+                          required:
+                            - status
+                            - type
+                          type: object
+                        type: array
+                        x-kubernetes-list-map-keys:
+                          - type
+                        x-kubernetes-list-type: map
+                      lastUpdate:
+                        description: Last time when deployment was updated
+                        format: date-time
+                        type: string
+                      name:
+                        description: The name of the Deployment for the given cluster.
+                        type: string
+                      namespace:
+                        description: The namespace which the Deployment for the given cluster is deployed.
+                        type: string
+                      observedGeneration:
+                        description: The generation observed by the deployment controller.
+                        format: int64
+                        type: integer
+                      readyReplicas:
+                        description: Total number of non-terminating pods targeted by this Deployment with a Ready Condition.
+                        format: int32
+                        type: integer
+                      replicas:
+                        description: Total number of non-terminating pods targeted by this deployment (their labels match the selector).
+                        format: int32
+                        type: integer
+                      selector:
+                        description: Selector is the label selector used to group the Tenant Control Plane Pods used by the scale subresource.
+                        type: string
+                      terminatingReplicas:
+                        description: |-
+                          Total number of terminating pods targeted by this deployment. Terminating pods have a non-null
+                          .metadata.deletionTimestamp and have not yet reached the Failed or Succeeded .status.phase.
+
+                          This is a beta field and requires enabling DeploymentReplicaSetTerminatingReplicas feature (enabled by default).
+                        format: int32
+                        type: integer
+                      unavailableReplicas:
+                        description: |-
+                          Total number of unavailable pods targeted by this deployment. This is the total number of
+                          pods that are still required for the deployment to have 100% available capacity. They may
+                          either be pods that are running but not yet available or pods that still have not been created.
+                        format: int32
+                        type: integer
+                      updatedReplicas:
+                        description: Total number of non-terminating pods targeted by this deployment that have the desired template spec.
+                        format: int32
+                        type: integer
+                    required:
+                      - name
+                      - namespace
+                      - selector
+                    type: object
+                  gateway:
+                    description: KubernetesGatewayStatus defines the status for the Tenant Control Plane Gateway in the management cluster.
+                    properties:
+                      accessPoints:
+                        description: A list of valid access points that the route exposes.
+                        items:
+                          properties:
+                            port:
+                              format: int32
+                              type: integer
+                            type:
+                              description: |-
+                                AddressType defines how a network address is represented as a text string.
+                                This may take two possible forms:
+
+                                * A predefined CamelCase string identifier (currently limited to `IPAddress` or `Hostname`)
+                                * A domain-prefixed string identifier (like `acme.io/CustomAddressType`)
+
+                                Values `IPAddress` and `Hostname` have Extended support.
+
+                                The `NamedAddress` value has been deprecated in favor of implementation
+                                specific domain-prefixed strings.
+
+                                All other values, including domain-prefixed values have Implementation-specific support,
+                                which are used in implementation-specific behaviors. Support for additional
+                                predefined CamelCase identifiers may be added in future releases.
+                              maxLength: 253
+                              minLength: 1
+                              pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                              type: string
+                            urls:
+                              items:
+                                type: string
+                              type: array
+                            value:
+                              type: string
+                          required:
+                            - port
+                            - type
+                            - value
+                          type: object
+                        type: array
+                      parents:
+                        description: |-
+                          Parents is a list of parent resources (usually Gateways) that are
+                          associated with the route, and the status of the route with respect to
+                          each parent. When this route attaches to a parent, the controller that
+                          manages the parent must add an entry to this list when the controller
+                          first sees the route and should update the entry as appropriate when the
+                          route or gateway is modified.
+
+                          Note that parent references that cannot be resolved by an implementation
+                          of this API will not be added to this list. Implementations of this API
+                          can only populate Route status for the Gateways/parent resources they are
+                          responsible for.
+
+                          A maximum of 32 Gateways will be represented in this list. An empty list
+                          means the route has not been attached to any Gateway.
+
+                          <gateway:util:excludeFromCRD>
+                          Notes for implementors:
+
+                          While parents is not a listType `map`, this is due to the fact that the
+                          list key is not scalar, and Kubernetes is unable to represent this.
+
+                          Parent status MUST be considered to be namespaced by the combination of
+                          the parentRef and controllerName fields, and implementations should keep
+                          the following rules in mind when updating this status:
+
+                          * Implementations MUST update only entries that have a matching value of
+                            `controllerName` for that implementation.
+                          * Implementations MUST NOT update entries with non-matching `controllerName`
+                            fields.
+                          * Implementations MUST treat each `parentRef`` in the Route separately and
+                            update its status based on the relationship with that parent.
+                          * Implementations MUST perform a read-modify-write cycle on this field
+                            before modifying it. That is, when modifying this field, implementations
+                            must be confident they have fetched the most recent version of this field,
+                            and ensure that changes they make are on that recent version.
+
+                          </gateway:util:excludeFromCRD>
+                        items:
+                          description: |-
+                            RouteParentStatus describes the status of a route with respect to an
+                            associated Parent.
+                          properties:
+                            conditions:
+                              description: |-
+                                Conditions describes the status of the route with respect to the Gateway.
+                                Note that the route's availability is also subject to the Gateway's own
+                                status conditions and listener status.
+
+                                If the Route's ParentRef specifies an existing Gateway that supports
+                                Routes of this kind AND that Gateway's controller has sufficient access,
+                                then that Gateway's controller MUST set the "Accepted" condition on the
+                                Route, to indicate whether the route has been accepted or rejected by the
+                                Gateway, and why.
+
+                                A Route MUST be considered "Accepted" if at least one of the Route's
+                                rules is implemented by the Gateway.
+
+                                There are a number of cases where the "Accepted" condition may not be set
+                                due to lack of controller visibility, that includes when:
+
+                                * The Route refers to a nonexistent parent.
+                                * The Route is of a type that the controller does not support.
+                                * The Route is in a namespace the controller does not have access to.
+
+                                <gateway:util:excludeFromCRD>
+
+                                Notes for implementors:
+
+                                Conditions are a listType `map`, which means that they function like a
+                                map with a key of the `type` field _in the k8s apiserver_.
+
+                                This means that implementations must obey some rules when updating this
+                                section.
+
+                                * Implementations MUST perform a read-modify-write cycle on this field
+                                  before modifying it. That is, when modifying this field, implementations
+                                  must be confident they have fetched the most recent version of this field,
+                                  and ensure that changes they make are on that recent version.
+                                * Implementations MUST NOT remove or reorder Conditions that they are not
+                                  directly responsible for. For example, if an implementation sees a Condition
+                                  with type `special.io/SomeField`, it MUST NOT remove, change or update that
+                                  Condition.
+                                * Implementations MUST always _merge_ changes into Conditions of the same Type,
+                                  rather than creating more than one Condition of the same Type.
+                                * Implementations MUST always update the `observedGeneration` field of the
+                                  Condition to the `metadata.generation` of the Gateway at the time of update creation.
+                                * If the `observedGeneration` of a Condition is _greater than_ the value the
+                                  implementation knows about, then it MUST NOT perform the update on that Condition,
+                                  but must wait for a future reconciliation and status update. (The assumption is that
+                                  the implementation's copy of the object is stale and an update will be re-triggered
+                                  if relevant.)
+
+                                </gateway:util:excludeFromCRD>
+                              items:
+                                description: Condition contains details for one aspect of the current state of this API Resource.
+                                properties:
+                                  lastTransitionTime:
+                                    description: |-
+                                      lastTransitionTime is the last time the condition transitioned from one status to another.
+                                      This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                                    format: date-time
+                                    type: string
+                                  message:
+                                    description: |-
+                                      message is a human readable message indicating details about the transition.
+                                      This may be an empty string.
+                                    maxLength: 32768
+                                    type: string
+                                  observedGeneration:
+                                    description: |-
+                                      observedGeneration represents the .metadata.generation that the condition was set based upon.
+                                      For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                                      with respect to the current state of the instance.
+                                    format: int64
+                                    minimum: 0
+                                    type: integer
+                                  reason:
+                                    description: |-
+                                      reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                                      Producers of specific condition types may define expected values and meanings for this field,
+                                      and whether the values are considered a guaranteed API.
+                                      The value should be a CamelCase string.
+                                      This field may not be empty.
+                                    maxLength: 1024
+                                    minLength: 1
+                                    pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                                    type: string
+                                  status:
+                                    description: status of the condition, one of True, False, Unknown.
+                                    enum:
+                                      - "True"
+                                      - "False"
+                                      - Unknown
+                                    type: string
+                                  type:
+                                    description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                                    maxLength: 316
+                                    pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                                    type: string
+                                required:
+                                  - lastTransitionTime
+                                  - message
+                                  - reason
+                                  - status
+                                  - type
+                                type: object
+                              maxItems: 8
+                              minItems: 1
+                              type: array
+                              x-kubernetes-list-map-keys:
+                                - type
+                              x-kubernetes-list-type: map
+                            controllerName:
+                              description: |-
+                                ControllerName is a domain/path string that indicates the name of the
+                                controller that wrote this status. This corresponds with the
+                                controllerName field on GatewayClass.
+
+                                Example: "example.net/gateway-controller".
+
+                                The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
+                                valid Kubernetes names
+                                (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
+
+                                Controllers MUST populate this field when writing status. Controllers should ensure that
+                                entries to status populated with their ControllerName are cleaned up when they are no
+                                longer necessary.
+                              maxLength: 253
+                              minLength: 1
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                              type: string
+                            parentRef:
+                              description: |-
+                                ParentRef corresponds with a ParentRef in the spec that this
+                                RouteParentStatus struct describes the status of.
+                              properties:
+                                group:
+                                  default: gateway.networking.k8s.io
+                                  description: |-
+                                    Group is the group of the referent.
+                                    When unspecified, "gateway.networking.k8s.io" is inferred.
+                                    To set the core API group (such as for a "Service" kind referent),
+                                    Group must be explicitly set to "" (empty string).
+
+                                    Support: Core
+                                  maxLength: 253
+                                  pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                  type: string
+                                kind:
+                                  default: Gateway
+                                  description: |-
+                                    Kind is kind of the referent.
+
+                                    There are two kinds of parent resources with "Core" support:
+
+                                    * Gateway (Gateway conformance profile)
+                                    * Service (Mesh conformance profile, ClusterIP Services only)
+
+                                    Support for other resources is Implementation-Specific.
+                                  maxLength: 63
+                                  minLength: 1
+                                  pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                  type: string
+                                name:
+                                  description: |-
+                                    Name is the name of the referent.
+
+                                    Support: Core
+                                  maxLength: 253
+                                  minLength: 1
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace is the namespace of the referent. When unspecified, this refers
+                                    to the local namespace of the Route.
+
+                                    Note that there are specific rules for ParentRefs which cross namespace
+                                    boundaries. Cross-namespace references are only valid if they are explicitly
+                                    allowed by something in the namespace they are referring to. For example:
+                                    Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                                    generic way to enable any other kind of cross-namespace reference.
+
+                                    <gateway:experimental:description>
+                                    ParentRefs from a Route to a Service in the same namespace are "producer"
+                                    routes, which apply default routing rules to inbound connections from
+                                    any namespace to the Service.
+
+                                    ParentRefs from a Route to a Service in a different namespace are
+                                    "consumer" routes, and these routing rules are only applied to outbound
+                                    connections originating from the same namespace as the Route, for which
+                                    the intended destination of the connections are a Service targeted as a
+                                    ParentRef of the Route.
+                                    </gateway:experimental:description>
+
+                                    Support: Core
+                                  maxLength: 63
+                                  minLength: 1
+                                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                  type: string
+                                port:
+                                  description: |-
+                                    Port is the network port this Route targets. It can be interpreted
+                                    differently based on the type of parent resource.
+
+                                    When the parent resource is a Gateway, this targets all listeners
+                                    listening on the specified port that also support this kind of Route(and
+                                    select this Route). It's not recommended to set `Port` unless the
+                                    networking behaviors specified in a Route must apply to a specific port
+                                    as opposed to a listener(s) whose port(s) may be changed. When both Port
+                                    and SectionName are specified, the name and port of the selected listener
+                                    must match both specified values.
+
+                                    <gateway:experimental:description>
+                                    When the parent resource is a Service, this targets a specific port in the
+                                    Service spec. When both Port (experimental) and SectionName are specified,
+                                    the name and port of the selected port must match both specified values.
+                                    </gateway:experimental:description>
+
+                                    Implementations MAY choose to support other parent resources.
+                                    Implementations supporting other types of parent resources MUST clearly
+                                    document how/if Port is interpreted.
+
+                                    For the purpose of status, an attachment is considered successful as
+                                    long as the parent resource accepts it partially. For example, Gateway
+                                    listeners can restrict which Routes can attach to them by Route kind,
+                                    namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                                    from the referencing Route, the Route MUST be considered successfully
+                                    attached. If no Gateway listeners accept attachment from this Route,
+                                    the Route MUST be considered detached from the Gateway.
+
+                                    Support: Extended
+                                  format: int32
+                                  maximum: 65535
+                                  minimum: 1
+                                  type: integer
+                                sectionName:
+                                  description: |-
+                                    SectionName is the name of a section within the target resource. In the
+                                    following resources, SectionName is interpreted as the following:
+
+                                    * Gateway: Listener name. When both Port (experimental) and SectionName
+                                    are specified, the name and port of the selected listener must match
+                                    both specified values.
+                                    * Service: Port name. When both Port (experimental) and SectionName
+                                    are specified, the name and port of the selected listener must match
+                                    both specified values.
+
+                                    Implementations MAY choose to support attaching Routes to other resources.
+                                    If that is the case, they MUST clearly document how SectionName is
+                                    interpreted.
+
+                                    When unspecified (empty string), this will reference the entire resource.
+                                    For the purpose of status, an attachment is considered successful if at
+                                    least one section in the parent resource accepts it. For example, Gateway
+                                    listeners can restrict which Routes can attach to them by Route kind,
+                                    namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                                    the referencing Route, the Route MUST be considered successfully
+                                    attached. If no Gateway listeners accept attachment from this Route, the
+                                    Route MUST be considered detached from the Gateway.
+
+                                    Support: Core
+                                  maxLength: 253
+                                  minLength: 1
+                                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                          required:
+                            - conditions
+                            - controllerName
+                            - parentRef
+                          type: object
+                        maxItems: 32
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      routeRef:
+                        description: Reference to the route created for this tenant.
+                        properties:
+                          name:
+                            default: ""
+                            description: |-
+                              Name of the referent.
+                              This field is effectively required, but due to backwards compatibility is
+                              allowed to be empty. Instances of this type with an empty value here are
+                              almost certainly wrong.
+                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                            type: string
+                        type: object
+                        x-kubernetes-map-type: atomic
+                    required:
+                      - parents
+                    type: object
+                  ingress:
+                    description: KubernetesIngressStatus defines the status for the Tenant Control Plane Ingress in the management cluster.
+                    properties:
+                      loadBalancer:
+                        description: loadBalancer contains the current status of the load-balancer.
+                        properties:
+                          ingress:
+                            description: ingress is a list containing ingress points for the load-balancer.
+                            items:
+                              description: IngressLoadBalancerIngress represents the status of a load-balancer ingress point.
+                              properties:
+                                hostname:
+                                  description: hostname is set for load-balancer ingress points that are DNS based.
+                                  type: string
+                                ip:
+                                  description: ip is set for load-balancer ingress points that are IP based.
+                                  type: string
+                                ports:
+                                  description: ports provides information about the ports exposed by this LoadBalancer.
+                                  items:
+                                    description: IngressPortStatus represents the error condition of a service port
+                                    properties:
+                                      error:
+                                        description: |-
+                                          error is to record the problem with the service port
+                                          The format of the error shall comply with the following rules:
+                                          - built-in error values shall be specified in this file and those shall use
+                                            CamelCase names
+                                          - cloud provider specific error values must have names that comply with the
+                                            format foo.example.com/CamelCase.
+                                        maxLength: 316
+                                        pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                                        type: string
+                                      port:
+                                        description: port is the port number of the ingress port.
+                                        format: int32
+                                        type: integer
+                                      protocol:
+                                        description: |-
+                                          protocol is the protocol of the ingress port.
+                                          The supported values are: "TCP", "UDP", "SCTP"
+                                        type: string
+                                    required:
+                                      - error
+                                      - port
+                                      - protocol
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                        type: object
+                      name:
+                        description: The name of the Ingress for the given cluster.
+                        type: string
+                      namespace:
+                        description: The namespace which the Ingress for the given cluster is deployed.
+                        type: string
+                    required:
+                      - name
+                      - namespace
+                    type: object
+                  service:
+                    description: KubernetesServiceStatus defines the status for the Tenant Control Plane Service in the management cluster.
+                    properties:
+                      conditions:
+                        description: Current service state
+                        items:
+                          description: Condition contains details for one aspect of the current state of this API Resource.
+                          properties:
+                            lastTransitionTime:
+                              description: |-
+                                lastTransitionTime is the last time the condition transitioned from one status to another.
+                                This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                              format: date-time
+                              type: string
+                            message:
+                              description: |-
+                                message is a human readable message indicating details about the transition.
+                                This may be an empty string.
+                              maxLength: 32768
+                              type: string
+                            observedGeneration:
+                              description: |-
+                                observedGeneration represents the .metadata.generation that the condition was set based upon.
+                                For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                                with respect to the current state of the instance.
+                              format: int64
+                              minimum: 0
+                              type: integer
+                            reason:
+                              description: |-
+                                reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                                Producers of specific condition types may define expected values and meanings for this field,
+                                and whether the values are considered a guaranteed API.
+                                The value should be a CamelCase string.
+                                This field may not be empty.
+                              maxLength: 1024
+                              minLength: 1
+                              pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                              type: string
+                            status:
+                              description: status of the condition, one of True, False, Unknown.
+                              enum:
+                                - "True"
+                                - "False"
+                                - Unknown
+                              type: string
+                            type:
+                              description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                              maxLength: 316
+                              pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                              type: string
+                          required:
+                            - lastTransitionTime
+                            - message
+                            - reason
+                            - status
+                            - type
+                          type: object
+                        type: array
+                        x-kubernetes-list-map-keys:
+                          - type
+                        x-kubernetes-list-type: map
+                      loadBalancer:
+                        description: |-
+                          LoadBalancer contains the current status of the load-balancer,
+                          if one is present.
+                        properties:
+                          ingress:
+                            description: |-
+                              Ingress is a list containing ingress points for the load-balancer.
+                              Traffic intended for the service should be sent to these ingress points.
+                            items:
+                              description: |-
+                                LoadBalancerIngress represents the status of a load-balancer ingress point:
+                                traffic intended for the service should be sent to an ingress point.
+                              properties:
+                                hostname:
+                                  description: |-
+                                    Hostname is set for load-balancer ingress points that are DNS based
+                                    (typically AWS load-balancers)
+                                  type: string
+                                ip:
+                                  description: |-
+                                    IP is set for load-balancer ingress points that are IP based
+                                    (typically GCE or OpenStack load-balancers)
+                                  type: string
+                                ipMode:
+                                  description: |-
+                                    IPMode specifies how the load-balancer IP behaves, and may only be specified when the ip field is specified.
+                                    Setting this to "VIP" indicates that traffic is delivered to the node with
+                                    the destination set to the load-balancer's IP and port.
+                                    Setting this to "Proxy" indicates that traffic is delivered to the node or pod with
+                                    the destination set to the node's IP and node port or the pod's IP and port.
+                                    Service implementations may use this information to adjust traffic routing.
+                                  type: string
+                                ports:
+                                  description: |-
+                                    Ports is a list of records of service ports
+                                    If used, every port defined in the service should have an entry in it
+                                  items:
+                                    description: PortStatus represents the error condition of a service port
+                                    properties:
+                                      error:
+                                        description: |-
+                                          Error is to record the problem with the service port
+                                          The format of the error shall comply with the following rules:
+                                          - built-in error values shall be specified in this file and those shall use
+                                            CamelCase names
+                                          - cloud provider specific error values must have names that comply with the
+                                            format foo.example.com/CamelCase.
+                                        maxLength: 316
+                                        pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                                        type: string
+                                      port:
+                                        description: Port is the port number of the service port of which status is recorded here
+                                        format: int32
+                                        type: integer
+                                      protocol:
+                                        description: |-
+                                          Protocol is the protocol of the service port of which status is recorded here
+                                          The supported values are: "TCP", "UDP", "SCTP"
+                                        type: string
+                                    required:
+                                      - error
+                                      - port
+                                      - protocol
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                        type: object
+                      name:
+                        description: The name of the Service for the given cluster.
+                        type: string
+                      namespace:
+                        description: The namespace which the Service for the given cluster is deployed.
+                        type: string
+                      port:
+                        description: The port where the service is running
+                        format: int32
+                        type: integer
+                    required:
+                      - name
+                      - namespace
+                      - port
+                    type: object
+                  version:
+                    description: KubernetesVersion contains the information regarding the running Kubernetes version, and its upgrade status.
+                    properties:
+                      status:
+                        default: Provisioning
+                        description: Status returns the current status of the Kubernetes version, such as its provisioning state, or completed upgrade.
+                        enum:
+                          - Unknown
+                          - Provisioning
+                          - CertificateAuthorityRotating
+                          - Upgrading
+                          - Migrating
+                          - Ready
+                          - NotReady
+                          - Sleeping
+                          - WriteLimited
+                        type: string
+                      version:
+                        description: Version is the running Kubernetes version of the Tenant Control Plane.
+                        type: string
+                    type: object
+                type: object
+              observedGeneration:
+                description: ObservedGeneration represents the .metadata.generation that was last reconciled.
+                format: int64
+                type: integer
+              storage:
+                description: Storage Status contains information about Kubernetes storage system
+                properties:
+                  certificate:
+                    properties:
+                      checksum:
+                        type: string
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                      secretName:
+                        type: string
+                    type: object
+                  config:
+                    properties:
+                      checksum:
+                        type: string
+                      secretName:
+                        type: string
+                    type: object
+                  dataStoreName:
+                    type: string
+                  driver:
+                    type: string
+                  setup:
+                    properties:
+                      checksum:
+                        type: string
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                      schema:
+                        type: string
+                      user:
+                        type: string
+                    type: object
+                type: object
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      scale:
+        labelSelectorPath: .status.kubernetesResources.deployment.selector
+        specReplicasPath: .spec.controlPlane.deployment.replicas
+        statusReplicasPath: .status.kubernetesResources.deployment.replicas
+      status: {}
+conversion:
+  strategy: Webhook
+  webhook:
+    clientConfig:
+      service:
+        name: '{{ .Values.kamajiService }}'
+        namespace: '{{ .Values.kamajiNamespace }}'
+        path: /convert
+    conversionReviewVersions:
+      - v1
diff --git a/packages/system/kamaji/charts/kamaji-crds/templates/_helpers.tpl b/packages/system/kamaji/charts/kamaji-crds/templates/_helpers.tpl
new file mode 100644
index 00000000..3fe45b08
--- /dev/null
+++ b/packages/system/kamaji/charts/kamaji-crds/templates/_helpers.tpl
@@ -0,0 +1,49 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "kamaji-crds.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "kamaji.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "kamaji-crds.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create the cert-manager annotation to inject Certificate CA.
+*/}}
+{{- define "kamaji-crds.certManagerAnnotation" -}}
+{{- printf "%s/%s" (required "A valid .Values.kamajiNamespace is required" .Values.kamajiNamespace) (required "A valid .Values.kamajiCertificateName is required" .Values.kamajiCertificateName) }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "kamaji-crds.labels" -}}
+helm.sh/chart: {{ include "kamaji-crds.chart" . }}
+app.kubernetes.io/name: {{ include "kamaji-crds.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/component: "crds"
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
diff --git a/packages/system/kamaji/charts/kamaji-crds/templates/kamaji.clastix.io_datastores.yaml b/packages/system/kamaji/charts/kamaji-crds/templates/kamaji.clastix.io_datastores.yaml
new file mode 100644
index 00000000..3ae0647c
--- /dev/null
+++ b/packages/system/kamaji/charts/kamaji-crds/templates/kamaji.clastix.io_datastores.yaml
@@ -0,0 +1,10 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: {{ include "kamaji-crds.certManagerAnnotation" . }}
+  labels:
+    {{- include "kamaji-crds.labels" . | nindent 4 }}
+  name: datastores.kamaji.clastix.io
+spec:
+  {{ tpl (.Files.Get "hack/kamaji.clastix.io_datastores_spec.yaml") . | nindent 2}}
diff --git a/packages/system/kamaji/charts/kamaji-crds/templates/kamaji.clastix.io_kubeconfiggenerators.yaml b/packages/system/kamaji/charts/kamaji-crds/templates/kamaji.clastix.io_kubeconfiggenerators.yaml
new file mode 100644
index 00000000..dd9b96f6
--- /dev/null
+++ b/packages/system/kamaji/charts/kamaji-crds/templates/kamaji.clastix.io_kubeconfiggenerators.yaml
@@ -0,0 +1,10 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: {{ include "kamaji-crds.certManagerAnnotation" . }}
+  labels:
+    {{- include "kamaji-crds.labels" . | nindent 4 }}
+  name: kubeconfiggenerators.kamaji.clastix.io
+spec:
+  {{ tpl (.Files.Get "hack/kamaji.clastix.io_kubeconfiggenerators_spec.yaml") . | nindent 2 }}
diff --git a/packages/system/kamaji/charts/kamaji-crds/templates/kamaji.clastix.io_tenantcontrolplanes.yaml b/packages/system/kamaji/charts/kamaji-crds/templates/kamaji.clastix.io_tenantcontrolplanes.yaml
new file mode 100644
index 00000000..8d3081c0
--- /dev/null
+++ b/packages/system/kamaji/charts/kamaji-crds/templates/kamaji.clastix.io_tenantcontrolplanes.yaml
@@ -0,0 +1,10 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: {{ include "kamaji-crds.certManagerAnnotation" . }}
+  labels:
+    {{- include "kamaji-crds.labels" . | nindent 4 }}
+  name: tenantcontrolplanes.kamaji.clastix.io
+spec:
+  {{ tpl (.Files.Get "hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml") . | nindent 2 }}
diff --git a/packages/system/kamaji/charts/kamaji-crds/values.yaml b/packages/system/kamaji/charts/kamaji-crds/values.yaml
new file mode 100644
index 00000000..074b586f
--- /dev/null
+++ b/packages/system/kamaji/charts/kamaji-crds/values.yaml
@@ -0,0 +1,15 @@
+# Default values for kamaji-crds.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+# -- Overrides the name of the chart for resource naming purposes.
+nameOverride: ""
+# -- Overrides the full name of the resources created by the chart.
+fullnameOverride: ""
+
+# -- The namespace where Kamaji has been installed: required to inject the Certificate Authority for cert-manager.
+kamajiNamespace: kamaji-system
+# -- The Kamaji webhook Service name.
+kamajiService: kamaji-webhook-service
+# -- The cert-manager Certificate resource name, holding the Certificate Authority for webhooks.
+kamajiCertificateName: kamaji-serving-cert
diff --git a/packages/system/kamaji/charts/kamaji/.helmignore b/packages/system/kamaji/charts/kamaji/.helmignore
index 0e8a0eb3..a03977f5 100644
--- a/packages/system/kamaji/charts/kamaji/.helmignore
+++ b/packages/system/kamaji/charts/kamaji/.helmignore
@@ -21,3 +21,8 @@
 .idea/
 *.tmproj
 .vscode/
+# Helm source files
+README.md.gotmpl
+.helmignore
+# Build tools
+Makefile
diff --git a/packages/system/kamaji/charts/kamaji/Chart.lock b/packages/system/kamaji/charts/kamaji/Chart.lock
index 14655f12..f22bdc05 100644
--- a/packages/system/kamaji/charts/kamaji/Chart.lock
+++ b/packages/system/kamaji/charts/kamaji/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: kamaji-etcd
   repository: https://clastix.github.io/charts
-  version: 0.9.2
-digest: sha256:ba76d3a30e5e20dbbbbcc36a0e7465d4b1adacc956061e7f6ea47b99fc8f08a6
-generated: "2025-03-14T21:23:30.421915+09:00"
+  version: 0.11.0
+digest: sha256:96b4115b8c02f771f809ec1bed3be3a3903e7e8315d6966aa54b0f73230ea421
+generated: "2025-07-03T09:19:19.835421461+02:00"
diff --git a/packages/system/kamaji/charts/kamaji/Chart.yaml b/packages/system/kamaji/charts/kamaji/Chart.yaml
index c09bfd52..a7ec5faf 100644
--- a/packages/system/kamaji/charts/kamaji/Chart.yaml
+++ b/packages/system/kamaji/charts/kamaji/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: v0.0.0
+appVersion: latest
 description: Kamaji is the Hosted Control Plane Manager for Kubernetes.
 home: https://github.com/clastix/kamaji
 icon: https://github.com/clastix/kamaji/raw/master/assets/logo-colored.png
@@ -17,11 +17,11 @@ name: kamaji
 sources:
 - https://github.com/clastix/kamaji
 type: application
-version: 0.0.0
+version: 0.0.0+latest
 dependencies:
 - name: kamaji-etcd
   repository: https://clastix.github.io/charts
-  version: ">=0.9.2"
+  version: ">=0.11.0"
   condition: kamaji-etcd.deploy
 annotations:
   catalog.cattle.io/certified: partner
@@ -46,4 +46,5 @@ annotations:
   artifacthub.io/operator: "true"
   artifacthub.io/operatorCapabilities: "full lifecycle"
   artifacthub.io/changes: |
-    - Using dependency chart `kamaji-etcd` as a default DataStore.
+    - kind: added
+      description: Releasing latest chart at every push
diff --git a/packages/system/kamaji/charts/kamaji/README.md b/packages/system/kamaji/charts/kamaji/README.md
index 780c0c48..69a9cefd 100644
--- a/packages/system/kamaji/charts/kamaji/README.md
+++ b/packages/system/kamaji/charts/kamaji/README.md
@@ -1,6 +1,6 @@
 # kamaji
 
-![Version: 0.0.0](https://img.shields.io/badge/Version-0.0.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.0.0](https://img.shields.io/badge/AppVersion-v0.0.0-informational?style=flat-square)
+![Version: 0.0.0+latest](https://img.shields.io/badge/Version-0.0.0+latest-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square)
 
 Kamaji is the Hosted Control Plane Manager for Kubernetes.
 
@@ -22,7 +22,7 @@ Kubernetes: `>=1.21.0-0`
 
 | Repository | Name | Version |
 |------------|------|---------|
-| https://clastix.github.io/charts | kamaji-etcd | >=0.9.2 |
+| https://clastix.github.io/charts | kamaji-etcd | >=0.11.0 |
 
 [Kamaji](https://github.com/clastix/kamaji) requires a [multi-tenant `etcd`](https://github.com/clastix/kamaji-internal/blob/master/deploy/getting-started-with-kamaji.md#setup-internal-multi-tenant-etcd) cluster.
 This Helm Chart starting from v0.1.1 provides the installation of an internal `etcd` in order to streamline the local test. If you'd like to use an externally managed etcd instance, you can specify the overrides and by setting the value `etcd.deploy=false`.
@@ -82,10 +82,25 @@ Here the values you can override:
 | image.repository | string | `"clastix/kamaji"` | The container image of the Kamaji controller. |
 | image.tag | string | `nil` | Overrides the image tag whose default is the chart appVersion. |
 | imagePullSecrets | list | `[]` |  |
-| kamaji-etcd.datastore.enabled | bool | `true` |  |
-| kamaji-etcd.datastore.name | string | `"default"` |  |
-| kamaji-etcd.deploy | bool | `true` |  |
-| kamaji-etcd.fullnameOverride | string | `"kamaji-etcd"` |  |
+| kamaji-etcd | object | `{"clusterDomain":"cluster.local","datastore":{"enabled":true,"name":"default"},"deploy":true,"fullnameOverride":"kamaji-etcd"}` | Subchart: See https://github.com/clastix/kamaji-etcd/blob/master/charts/kamaji-etcd/values.yaml |
+| kubeconfigGenerator.affinity | object | `{}` | Kubernetes affinity rules to apply to Kubeconfig Generator controller pods |
+| kubeconfigGenerator.enableLeaderElect | bool | `true` | Enables the leader election. |
+| kubeconfigGenerator.enabled | bool | `false` | Toggle to deploy the Kubeconfig Generator Deployment. |
+| kubeconfigGenerator.extraArgs | list | `[]` | A list of extra arguments to add to the Kubeconfig Generator controller default ones. |
+| kubeconfigGenerator.fullnameOverride | string | `""` |  |
+| kubeconfigGenerator.healthProbeBindAddress | string | `":8081"` | The address the probe endpoint binds to. |
+| kubeconfigGenerator.loggingDevel.enable | bool | `false` | Development Mode defaults(encoder=consoleEncoder,logLevel=Debug,stackTraceLevel=Warn). Production Mode defaults(encoder=jsonEncoder,logLevel=Info,stackTraceLevel=Error) |
+| kubeconfigGenerator.nodeSelector | object | `{}` | Kubernetes node selector rules to schedule Kubeconfig Generator controller |
+| kubeconfigGenerator.podAnnotations | object | `{}` | The annotations to apply to the Kubeconfig Generator controller pods. |
+| kubeconfigGenerator.podSecurityContext | object | `{"runAsNonRoot":true}` | The securityContext to apply to the Kubeconfig Generator controller pods. |
+| kubeconfigGenerator.replicaCount | int | `2` | The number of the pod replicas for the Kubeconfig Generator controller. |
+| kubeconfigGenerator.resources.limits.cpu | string | `"200m"` |  |
+| kubeconfigGenerator.resources.limits.memory | string | `"512Mi"` |  |
+| kubeconfigGenerator.resources.requests.cpu | string | `"200m"` |  |
+| kubeconfigGenerator.resources.requests.memory | string | `"512Mi"` |  |
+| kubeconfigGenerator.securityContext | object | `{"allowPrivilegeEscalation":false}` | The securityContext to apply to the Kubeconfig Generator controller container only. |
+| kubeconfigGenerator.serviceAccountOverride | string | `""` | The name of the service account to use. If not set, the root Kamaji one will be used. |
+| kubeconfigGenerator.tolerations | list | `[]` | Kubernetes node taints that the Kubeconfig Generator controller pods would tolerate |
 | livenessProbe | object | `{"httpGet":{"path":"/healthz","port":"healthcheck"},"initialDelaySeconds":15,"periodSeconds":20}` | The livenessProbe for the controller container |
 | loggingDevel.enable | bool | `false` | Development Mode defaults(encoder=consoleEncoder,logLevel=Debug,stackTraceLevel=Warn). Production Mode defaults(encoder=jsonEncoder,logLevel=Info,stackTraceLevel=Error) (default false) |
 | metricsBindAddress | string | `":8080"` | The address the metric endpoint binds to. (default ":8080") |
diff --git a/packages/system/kamaji/charts/kamaji/app-readme.md b/packages/system/kamaji/charts/kamaji/app-readme.md
deleted file mode 100644
index a87e8b7b..00000000
--- a/packages/system/kamaji/charts/kamaji/app-readme.md
+++ /dev/null
@@ -1,12 +0,0 @@
-# Kamaji
-
-Kamaji deploys and operates Kubernetes at scale with a fraction of the operational burden.
-
-Useful links:
-- [Kamaji Github repository](https://github.com/clastix/kamaji)
-- [Kamaji Documentation](https://kamaji.clastix.io)
-
-## Requirements
-
-* Kubernetes v1.22+
-* Helm v3
\ No newline at end of file
diff --git a/packages/system/kamaji/charts/kamaji/controller-gen/clusterrole.yaml b/packages/system/kamaji/charts/kamaji/controller-gen/clusterrole.yaml
index 93530197..2c2922ab 100644
--- a/packages/system/kamaji/charts/kamaji/controller-gen/clusterrole.yaml
+++ b/packages/system/kamaji/charts/kamaji/controller-gen/clusterrole.yaml
@@ -1,3 +1,25 @@
+- apiGroups:
+    - ""
+  resources:
+    - configmaps
+    - secrets
+    - services
+  verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+- apiGroups:
+    - ""
+  resources:
+    - namespaces
+  verbs:
+    - get
+    - list
+    - watch
 - apiGroups:
     - apps
   resources:
@@ -21,11 +43,19 @@
     - list
     - watch
 - apiGroups:
-    - ""
+    - gateway.networking.k8s.io
   resources:
-    - configmaps
-    - secrets
-    - services
+    - gateways
+  verbs:
+    - get
+    - list
+    - watch
+- apiGroups:
+    - gateway.networking.k8s.io
+  resources:
+    - grpcroutes
+    - httproutes
+    - tlsroutes
   verbs:
     - create
     - delete
@@ -51,6 +81,7 @@
     - kamaji.clastix.io
   resources:
     - datastores/status
+    - kubeconfiggenerators/status
     - tenantcontrolplanes/status
   verbs:
     - get
@@ -59,6 +90,18 @@
 - apiGroups:
     - kamaji.clastix.io
   resources:
+    - kubeconfiggenerators
+  verbs:
+    - create
+    - get
+    - list
+    - patch
+    - update
+    - watch
+- apiGroups:
+    - kamaji.clastix.io
+  resources:
+    - kubeconfiggenerators/finalizers
     - tenantcontrolplanes/finalizers
   verbs:
     - update
diff --git a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml
index aeb221e2..896a40e8 100644
--- a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml
+++ b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     cert-manager.io/inject-ca-from: kamaji-system/kamaji-serving-cert
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: datastores.kamaji.clastix.io
 spec:
   group: kamaji.clastix.io
@@ -284,6 +284,10 @@ spec:
             status:
               description: DataStoreStatus defines the observed state of DataStore.
               properties:
+                observedGeneration:
+                  description: ObservedGeneration represents the .metadata.generation that was last reconciled.
+                  format: int64
+                  type: integer
                 usedBy:
                   description: List of the Tenant Control Planes, namespaced named, using this data store.
                   items:
diff --git a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_kubeconfiggenerators.yaml b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_kubeconfiggenerators.yaml
new file mode 100644
index 00000000..af838f1d
--- /dev/null
+++ b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_kubeconfiggenerators.yaml
@@ -0,0 +1,226 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: kamaji-system/kamaji-serving-cert
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: kubeconfiggenerators.kamaji.clastix.io
+spec:
+  group: kamaji.clastix.io
+  names:
+    categories:
+      - kamaji
+    kind: KubeconfigGenerator
+    listKind: KubeconfigGeneratorList
+    plural: kubeconfiggenerators
+    shortNames:
+      - kc
+    singular: kubeconfiggenerator
+  scope: Cluster
+  versions:
+    - additionalPrinterColumns:
+        - description: Age
+          jsonPath: .metadata.creationTimestamp
+          name: Age
+          type: date
+      name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: KubeconfigGenerator is the Schema for the kubeconfiggenerators API.
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              properties:
+                controlPlaneEndpointFrom:
+                  default: admin.svc
+                  description: |-
+                    ControlPlaneEndpointFrom is the key used to extract the Tenant Control Plane endpoint that must be used by the generator.
+                    The targeted Secret is the `${TCP}-admin-kubeconfig` one, default to `admin.svc`.
+                  type: string
+                groups:
+                  description: |-
+                    Groups is resolved a set of strings used to assign the x509 organisations field.
+                    It will be recognised by Kubernetes as user groups.
+                  items:
+                    description: |-
+                      CompoundValue allows defining a static, or a dynamic value.
+                      Options are mutually exclusive, just one should be picked up.
+                    properties:
+                      fromDefinition:
+                        description: |-
+                          FromDefinition is used to generate a dynamic value,
+                          it uses the dot notation to access fields from the referenced TenantControlPlane object:
+                          e.g.: metadata.name
+                        type: string
+                      stringValue:
+                        description: StringValue is a static string value.
+                        type: string
+                    type: object
+                    x-kubernetes-validations:
+                      - message: Either stringValue or fromDefinition must be set, but not both.
+                        rule: (has(self.stringValue) || has(self.fromDefinition)) && !(has(self.stringValue) && has(self.fromDefinition))
+                  type: array
+                namespaceSelector:
+                  description: NamespaceSelector is used to filter Namespaces from which the generator should extract TenantControlPlane objects.
+                  properties:
+                    matchExpressions:
+                      description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                      items:
+                        description: |-
+                          A label selector requirement is a selector that contains values, a key, and an operator that
+                          relates the key and values.
+                        properties:
+                          key:
+                            description: key is the label key that the selector applies to.
+                            type: string
+                          operator:
+                            description: |-
+                              operator represents a key's relationship to a set of values.
+                              Valid operators are In, NotIn, Exists and DoesNotExist.
+                            type: string
+                          values:
+                            description: |-
+                              values is an array of string values. If the operator is In or NotIn,
+                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                              the values array must be empty. This array is replaced during a strategic
+                              merge patch.
+                            items:
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: atomic
+                        required:
+                          - key
+                          - operator
+                        type: object
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    matchLabels:
+                      additionalProperties:
+                        type: string
+                      description: |-
+                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                      type: object
+                  type: object
+                  x-kubernetes-map-type: atomic
+                tenantControlPlaneSelector:
+                  description: TenantControlPlaneSelector is used to filter the TenantControlPlane objects that should be address by the generator.
+                  properties:
+                    matchExpressions:
+                      description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                      items:
+                        description: |-
+                          A label selector requirement is a selector that contains values, a key, and an operator that
+                          relates the key and values.
+                        properties:
+                          key:
+                            description: key is the label key that the selector applies to.
+                            type: string
+                          operator:
+                            description: |-
+                              operator represents a key's relationship to a set of values.
+                              Valid operators are In, NotIn, Exists and DoesNotExist.
+                            type: string
+                          values:
+                            description: |-
+                              values is an array of string values. If the operator is In or NotIn,
+                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                              the values array must be empty. This array is replaced during a strategic
+                              merge patch.
+                            items:
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: atomic
+                        required:
+                          - key
+                          - operator
+                        type: object
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    matchLabels:
+                      additionalProperties:
+                        type: string
+                      description: |-
+                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                      type: object
+                  type: object
+                  x-kubernetes-map-type: atomic
+                user:
+                  description: User resolves to a string to identify the client, assigned to the x509 Common Name field.
+                  properties:
+                    fromDefinition:
+                      description: |-
+                        FromDefinition is used to generate a dynamic value,
+                        it uses the dot notation to access fields from the referenced TenantControlPlane object:
+                        e.g.: metadata.name
+                      type: string
+                    stringValue:
+                      description: StringValue is a static string value.
+                      type: string
+                  type: object
+                  x-kubernetes-validations:
+                    - message: Either stringValue or fromDefinition must be set, but not both.
+                      rule: (has(self.stringValue) || has(self.fromDefinition)) && !(has(self.stringValue) && has(self.fromDefinition))
+              required:
+                - user
+              type: object
+            status:
+              description: KubeconfigGeneratorStatus defines the observed state of KubeconfigGenerator.
+              properties:
+                availableResources:
+                  default: 0
+                  description: |-
+                    AvailableResources is the sum of successfully generated resources.
+                    In case of a different value compared to Resources, check the field errors.
+                  type: integer
+                errors:
+                  description: Errors is the list of failed kubeconfig generations.
+                  items:
+                    properties:
+                      message:
+                        description: Message is the error message recorded upon the last generator run.
+                        type: string
+                      resource:
+                        description: Resource is the Namespaced name of the errored resource.
+                        type: string
+                    required:
+                      - message
+                      - resource
+                    type: object
+                  type: array
+                observedGeneration:
+                  description: ObservedGeneration represents the .metadata.generation that was last reconciled.
+                  format: int64
+                  type: integer
+                resources:
+                  default: 0
+                  description: Resources is the sum of targeted TenantControlPlane objects.
+                  type: integer
+              required:
+                - availableResources
+                - resources
+              type: object
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
diff --git a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
index b3d3b668..506d4379 100644
--- a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
+++ b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
@@ -3,7 +3,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     cert-manager.io/inject-ca-from: kamaji-system/kamaji-serving-cert
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: tenantcontrolplanes.kamaji.clastix.io
 spec:
   group: kamaji.clastix.io
@@ -23,6 +23,10 @@ spec:
           jsonPath: .spec.kubernetes.version
           name: Version
           type: string
+        - description: The actual installed Kubernetes version from status
+          jsonPath: .status.kubernetesResources.version.version
+          name: Installed Version
+          type: string
         - description: Status
           jsonPath: .status.kubernetesResources.version.status
           name: Status
@@ -92,7 +96,7 @@ spec:
                         agent:
                           default:
                             image: registry.k8s.io/kas-network-proxy/proxy-agent
-                            version: v0.28.6
+                            mode: DaemonSet
                           properties:
                             extraArgs:
                               description: |-
@@ -103,10 +107,31 @@ spec:
                               items:
                                 type: string
                               type: array
+                            hostNetwork:
+                              default: false
+                              description: |-
+                                HostNetwork enables the konnectivity agent to use the Host network namespace.
+                                By enabling this mode, the Agent doesn't need to wait for the CNI initialisation,
+                                enabling a sort of out-of-band access to nodes for troubleshooting scenarios,
+                                or when the agent needs direct access to the host network.
+                              type: boolean
                             image:
                               default: registry.k8s.io/kas-network-proxy/proxy-agent
                               description: AgentImage defines the container image for Konnectivity's agent.
                               type: string
+                            mode:
+                              default: DaemonSet
+                              description: 'Mode allows specifying the Agent deployment mode: Deployment, or DaemonSet (default).'
+                              enum:
+                                - DaemonSet
+                                - Deployment
+                              type: string
+                            replicas:
+                              description: |-
+                                Replicas defines the number of replicas when Mode is Deployment.
+                                Must be 0 if Mode is DaemonSet.
+                              format: int32
+                              type: integer
                             tolerations:
                               default:
                                 - key: CriticalAddonsOnly
@@ -132,9 +157,10 @@ spec:
                                   operator:
                                     description: |-
                                       Operator represents a key's relationship to the value.
-                                      Valid operators are Exists and Equal. Defaults to Equal.
+                                      Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
                                       Exists is equivalent to wildcard for value, so that a pod can
                                       tolerate all taints of a particular category.
+                                      Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                                     type: string
                                   tolerationSeconds:
                                     description: |-
@@ -152,15 +178,20 @@ spec:
                                 type: object
                               type: array
                             version:
-                              default: v0.28.6
-                              description: Version for Konnectivity agent.
+                              description: |-
+                                Version for Konnectivity agent.
+                                If left empty, Kamaji will automatically inflect the version from the deployed Tenant Control Plane.
+
+                                WARNING: for last cut-off releases, the container image could be not available.
                               type: string
                           type: object
+                          x-kubernetes-validations:
+                            - message: replicas must be 0 (or unset) when mode is DaemonSet, and greater than 0 (or unset) when mode is Deployment
+                              rule: '!(self.mode == ''DaemonSet'' && has(self.replicas) && self.replicas != 0) && !(self.mode == ''Deployment'' && has(self.replicas) && self.replicas == 0)'
                         server:
                           default:
                             image: registry.k8s.io/kas-network-proxy/proxy-server
                             port: 8132
-                            version: v0.28.6
                           properties:
                             extraArgs:
                               description: |-
@@ -187,7 +218,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -239,8 +270,11 @@ spec:
                                   type: object
                               type: object
                             version:
-                              default: v0.28.6
-                              description: Container image version of the Konnectivity server.
+                              description: |-
+                                Container image version of the Konnectivity server.
+                                If left empty, Kamaji will automatically inflect the version from the deployed Tenant Control Plane.
+
+                                WARNING: for last cut-off releases, the container image could be not available.
                               type: string
                           required:
                             - port
@@ -312,7 +346,9 @@ spec:
                                   description: EnvVar represents an environment variable present in a Container.
                                   properties:
                                     name:
-                                      description: Name of the environment variable. Must be a C_IDENTIFIER.
+                                      description: |-
+                                        Name of the environment variable.
+                                        May consist of any printable ASCII characters except '='.
                                       type: string
                                     value:
                                       description: |-
@@ -366,6 +402,42 @@ spec:
                                             - fieldPath
                                           type: object
                                           x-kubernetes-map-type: atomic
+                                        fileKeyRef:
+                                          description: |-
+                                            FileKeyRef selects a key of the env file.
+                                            Requires the EnvFiles feature gate to be enabled.
+                                          properties:
+                                            key:
+                                              description: |-
+                                                The key within the env file. An invalid key will prevent the pod from starting.
+                                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                              type: string
+                                            optional:
+                                              default: false
+                                              description: |-
+                                                Specify whether the file or its key must be defined. If the file or key
+                                                does not exist, then the env var is not published.
+                                                If optional is set to true and the specified key does not exist,
+                                                the environment variable will not be set in the Pod's containers.
+
+                                                If optional is set to false and the specified key does not exist,
+                                                an error will be returned during Pod creation.
+                                              type: boolean
+                                            path:
+                                              description: |-
+                                                The path within the volume from which to select the file.
+                                                Must be relative and may not contain the '..' path or start with '..'.
+                                              type: string
+                                            volumeName:
+                                              description: The name of the volume mount containing the env file.
+                                              type: string
+                                          required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                          type: object
+                                          x-kubernetes-map-type: atomic
                                         resourceFieldRef:
                                           description: |-
                                             Selects a resource of the container: only resources limits and requests
@@ -421,8 +493,8 @@ spec:
                               envFrom:
                                 description: |-
                                   List of sources to populate environment variables in the container.
-                                  The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                  will be reported as an event when the container is starting. When a key exists in multiple
+                                  The keys defined within a source may consist of any printable ASCII characters except '='.
+                                  When a key exists in multiple
                                   sources, the value associated with the last source will take precedence.
                                   Values defined by an Env with a duplicate key will take precedence.
                                   Cannot be updated.
@@ -447,7 +519,9 @@ spec:
                                       type: object
                                       x-kubernetes-map-type: atomic
                                     prefix:
-                                      description: Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
+                                      description: |-
+                                        Optional text to prepend to the name of each environment variable.
+                                        May consist of any printable ASCII characters except '='.
                                       type: string
                                     secretRef:
                                       description: The Secret to select from
@@ -1061,7 +1135,9 @@ spec:
                                     type: integer
                                 type: object
                               resizePolicy:
-                                description: Resources resize policy for the container.
+                                description: |-
+                                  Resources resize policy for the container.
+                                  This field cannot be set on ephemeral containers.
                                 items:
                                   description: ContainerResizePolicy represents resource resize policy for the container.
                                   properties:
@@ -1092,7 +1168,7 @@ spec:
                                       Claims lists the names of resources, defined in spec.resourceClaims,
                                       that are used by this container.
 
-                                      This is an alpha field and requires enabling the
+                                      This field depends on the
                                       DynamicResourceAllocation feature gate.
 
                                       This field is immutable. It can only be set for containers.
@@ -1146,10 +1222,10 @@ spec:
                               restartPolicy:
                                 description: |-
                                   RestartPolicy defines the restart behavior of individual containers in a pod.
-                                  This field may only be set for init containers, and the only allowed value is "Always".
-                                  For non-init containers or when this field is not specified,
+                                  This overrides the pod-level restart policy. When this field is not specified,
                                   the restart behavior is defined by the Pod's restart policy and the container type.
-                                  Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                  Additionally, setting the RestartPolicy as "Always" for the init container will
+                                  have the following effect:
                                   this init container will be continually restarted on
                                   exit until all regular containers have terminated. Once all regular
                                   containers have completed, all init containers with restartPolicy "Always"
@@ -1161,6 +1237,57 @@ spec:
                                   init container is started, or after any startupProbe has successfully
                                   completed.
                                 type: string
+                              restartPolicyRules:
+                                description: |-
+                                  Represents a list of rules to be checked to determine if the
+                                  container should be restarted on exit. The rules are evaluated in
+                                  order. Once a rule matches a container exit condition, the remaining
+                                  rules are ignored. If no rule matches the container exit condition,
+                                  the Container-level restart policy determines the whether the container
+                                  is restarted or not. Constraints on the rules:
+                                  - At most 20 rules are allowed.
+                                  - Rules can have the same action.
+                                  - Identical rules are not forbidden in validations.
+                                  When rules are specified, container MUST set RestartPolicy explicitly
+                                  even it if matches the Pod's RestartPolicy.
+                                items:
+                                  description: ContainerRestartRule describes how a container exit is handled.
+                                  properties:
+                                    action:
+                                      description: |-
+                                        Specifies the action taken on a container exit if the requirements
+                                        are satisfied. The only possible value is "Restart" to restart the
+                                        container.
+                                      type: string
+                                    exitCodes:
+                                      description: Represents the exit codes to check on container exits.
+                                      properties:
+                                        operator:
+                                          description: |-
+                                            Represents the relationship between the container exit code(s) and the
+                                            specified values. Possible values are:
+                                            - In: the requirement is satisfied if the container exit code is in the
+                                              set of specified values.
+                                            - NotIn: the requirement is satisfied if the container exit code is
+                                              not in the set of specified values.
+                                          type: string
+                                        values:
+                                          description: |-
+                                            Specifies the set of values to check for container exit codes.
+                                            At most 255 elements are allowed.
+                                          items:
+                                            format: int32
+                                            type: integer
+                                          type: array
+                                          x-kubernetes-list-type: set
+                                      required:
+                                        - operator
+                                      type: object
+                                  required:
+                                    - action
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
                               securityContext:
                                 description: |-
                                   SecurityContext defines the security options the container should be run with.
@@ -1683,7 +1810,9 @@ spec:
                                   description: EnvVar represents an environment variable present in a Container.
                                   properties:
                                     name:
-                                      description: Name of the environment variable. Must be a C_IDENTIFIER.
+                                      description: |-
+                                        Name of the environment variable.
+                                        May consist of any printable ASCII characters except '='.
                                       type: string
                                     value:
                                       description: |-
@@ -1737,6 +1866,42 @@ spec:
                                             - fieldPath
                                           type: object
                                           x-kubernetes-map-type: atomic
+                                        fileKeyRef:
+                                          description: |-
+                                            FileKeyRef selects a key of the env file.
+                                            Requires the EnvFiles feature gate to be enabled.
+                                          properties:
+                                            key:
+                                              description: |-
+                                                The key within the env file. An invalid key will prevent the pod from starting.
+                                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                              type: string
+                                            optional:
+                                              default: false
+                                              description: |-
+                                                Specify whether the file or its key must be defined. If the file or key
+                                                does not exist, then the env var is not published.
+                                                If optional is set to true and the specified key does not exist,
+                                                the environment variable will not be set in the Pod's containers.
+
+                                                If optional is set to false and the specified key does not exist,
+                                                an error will be returned during Pod creation.
+                                              type: boolean
+                                            path:
+                                              description: |-
+                                                The path within the volume from which to select the file.
+                                                Must be relative and may not contain the '..' path or start with '..'.
+                                              type: string
+                                            volumeName:
+                                              description: The name of the volume mount containing the env file.
+                                              type: string
+                                          required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                          type: object
+                                          x-kubernetes-map-type: atomic
                                         resourceFieldRef:
                                           description: |-
                                             Selects a resource of the container: only resources limits and requests
@@ -1792,8 +1957,8 @@ spec:
                               envFrom:
                                 description: |-
                                   List of sources to populate environment variables in the container.
-                                  The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                  will be reported as an event when the container is starting. When a key exists in multiple
+                                  The keys defined within a source may consist of any printable ASCII characters except '='.
+                                  When a key exists in multiple
                                   sources, the value associated with the last source will take precedence.
                                   Values defined by an Env with a duplicate key will take precedence.
                                   Cannot be updated.
@@ -1818,7 +1983,9 @@ spec:
                                       type: object
                                       x-kubernetes-map-type: atomic
                                     prefix:
-                                      description: Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
+                                      description: |-
+                                        Optional text to prepend to the name of each environment variable.
+                                        May consist of any printable ASCII characters except '='.
                                       type: string
                                     secretRef:
                                       description: The Secret to select from
@@ -2432,7 +2599,9 @@ spec:
                                     type: integer
                                 type: object
                               resizePolicy:
-                                description: Resources resize policy for the container.
+                                description: |-
+                                  Resources resize policy for the container.
+                                  This field cannot be set on ephemeral containers.
                                 items:
                                   description: ContainerResizePolicy represents resource resize policy for the container.
                                   properties:
@@ -2463,7 +2632,7 @@ spec:
                                       Claims lists the names of resources, defined in spec.resourceClaims,
                                       that are used by this container.
 
-                                      This is an alpha field and requires enabling the
+                                      This field depends on the
                                       DynamicResourceAllocation feature gate.
 
                                       This field is immutable. It can only be set for containers.
@@ -2517,10 +2686,10 @@ spec:
                               restartPolicy:
                                 description: |-
                                   RestartPolicy defines the restart behavior of individual containers in a pod.
-                                  This field may only be set for init containers, and the only allowed value is "Always".
-                                  For non-init containers or when this field is not specified,
+                                  This overrides the pod-level restart policy. When this field is not specified,
                                   the restart behavior is defined by the Pod's restart policy and the container type.
-                                  Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                  Additionally, setting the RestartPolicy as "Always" for the init container will
+                                  have the following effect:
                                   this init container will be continually restarted on
                                   exit until all regular containers have terminated. Once all regular
                                   containers have completed, all init containers with restartPolicy "Always"
@@ -2532,6 +2701,57 @@ spec:
                                   init container is started, or after any startupProbe has successfully
                                   completed.
                                 type: string
+                              restartPolicyRules:
+                                description: |-
+                                  Represents a list of rules to be checked to determine if the
+                                  container should be restarted on exit. The rules are evaluated in
+                                  order. Once a rule matches a container exit condition, the remaining
+                                  rules are ignored. If no rule matches the container exit condition,
+                                  the Container-level restart policy determines the whether the container
+                                  is restarted or not. Constraints on the rules:
+                                  - At most 20 rules are allowed.
+                                  - Rules can have the same action.
+                                  - Identical rules are not forbidden in validations.
+                                  When rules are specified, container MUST set RestartPolicy explicitly
+                                  even it if matches the Pod's RestartPolicy.
+                                items:
+                                  description: ContainerRestartRule describes how a container exit is handled.
+                                  properties:
+                                    action:
+                                      description: |-
+                                        Specifies the action taken on a container exit if the requirements
+                                        are satisfied. The only possible value is "Restart" to restart the
+                                        container.
+                                      type: string
+                                    exitCodes:
+                                      description: Represents the exit codes to check on container exits.
+                                      properties:
+                                        operator:
+                                          description: |-
+                                            Represents the relationship between the container exit code(s) and the
+                                            specified values. Possible values are:
+                                            - In: the requirement is satisfied if the container exit code is in the
+                                              set of specified values.
+                                            - NotIn: the requirement is satisfied if the container exit code is
+                                              not in the set of specified values.
+                                          type: string
+                                        values:
+                                          description: |-
+                                            Specifies the set of values to check for container exit codes.
+                                            At most 255 elements are allowed.
+                                          items:
+                                            format: int32
+                                            type: integer
+                                          type: array
+                                          x-kubernetes-list-type: set
+                                      required:
+                                        - operator
+                                      type: object
+                                  required:
+                                    - action
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
                               securityContext:
                                 description: |-
                                   SecurityContext defines the security options the container should be run with.
@@ -3774,7 +3994,7 @@ spec:
                                           resources:
                                             description: |-
                                               resources represents the minimum resources the volume should have.
-                                              If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
+                                              Users are allowed to specify resource requirements
                                               that are lower than previous value but must still be higher than capacity recorded in the
                                               status field of the claim.
                                               More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -3858,15 +4078,13 @@ spec:
                                               volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                               If specified, the CSI driver will create or update the volume with the attributes defined
                                               in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                              it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                              will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                              If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                              will be set by the persistentvolume controller if it exists.
+                                              it can be changed after the claim is created. An empty string or nil value indicates that no
+                                              VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                              this field can be reset to its previous value (including nil) to cancel the modification.
                                               If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                               set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                               exists.
                                               More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                              (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                             type: string
                                           volumeMode:
                                             description: |-
@@ -4040,12 +4258,9 @@ spec:
                                 description: |-
                                   glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                   Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                                  More info: https://examples.k8s.io/volumes/glusterfs/README.md
                                 properties:
                                   endpoints:
-                                    description: |-
-                                      endpoints is the endpoint name that details Glusterfs topology.
-                                      More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                    description: endpoints is the endpoint name that details Glusterfs topology.
                                     type: string
                                   path:
                                     description: |-
@@ -4124,7 +4339,7 @@ spec:
                                 description: |-
                                   iscsi represents an ISCSI Disk resource that is attached to a
                                   kubelet's host machine and then exposed to the pod.
-                                  More info: https://examples.k8s.io/volumes/iscsi/README.md
+                                  More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                                 properties:
                                   chapAuthDiscovery:
                                     description: chapAuthDiscovery defines whether support iSCSI Discovery CHAP authentication
@@ -4514,6 +4729,128 @@ spec:
                                               type: array
                                               x-kubernetes-list-type: atomic
                                           type: object
+                                        podCertificate:
+                                          description: |-
+                                            Projects an auto-rotating credential bundle (private key and certificate
+                                            chain) that the pod can use either as a TLS client or server.
+
+                                            Kubelet generates a private key and uses it to send a
+                                            PodCertificateRequest to the named signer.  Once the signer approves the
+                                            request and issues a certificate chain, Kubelet writes the key and
+                                            certificate chain to the pod filesystem.  The pod does not start until
+                                            certificates have been issued for each podCertificate projected volume
+                                            source in its spec.
+
+                                            Kubelet will begin trying to rotate the certificate at the time indicated
+                                            by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                            timestamp.
+
+                                            Kubelet can write a single file, indicated by the credentialBundlePath
+                                            field, or separate files, indicated by the keyPath and
+                                            certificateChainPath fields.
+
+                                            The credential bundle is a single file in PEM format.  The first PEM
+                                            entry is the private key (in PKCS#8 format), and the remaining PEM
+                                            entries are the certificate chain issued by the signer (typically,
+                                            signers will return their certificate chain in leaf-to-root order).
+
+                                            Prefer using the credential bundle format, since your application code
+                                            can read it atomically.  If you use keyPath and certificateChainPath,
+                                            your application must make two separate file reads. If these coincide
+                                            with a certificate rotation, it is possible that the private key and leaf
+                                            certificate you read may not correspond to each other.  Your application
+                                            will need to check for this condition, and re-read until they are
+                                            consistent.
+
+                                            The named signer controls chooses the format of the certificate it
+                                            issues; consult the signer implementation's documentation to learn how to
+                                            use the certificates it issues.
+                                          properties:
+                                            certificateChainPath:
+                                              description: |-
+                                                Write the certificate chain at this path in the projected volume.
+
+                                                Most applications should use credentialBundlePath.  When using keyPath
+                                                and certificateChainPath, your application needs to check that the key
+                                                and leaf certificate are consistent, because it is possible to read the
+                                                files mid-rotation.
+                                              type: string
+                                            credentialBundlePath:
+                                              description: |-
+                                                Write the credential bundle at this path in the projected volume.
+
+                                                The credential bundle is a single file that contains multiple PEM blocks.
+                                                The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                                key.
+
+                                                The remaining blocks are CERTIFICATE blocks, containing the issued
+                                                certificate chain from the signer (leaf and any intermediates).
+
+                                                Using credentialBundlePath lets your Pod's application code make a single
+                                                atomic read that retrieves a consistent key and certificate chain.  If you
+                                                project them to separate files, your application code will need to
+                                                additionally check that the leaf certificate was issued to the key.
+                                              type: string
+                                            keyPath:
+                                              description: |-
+                                                Write the key at this path in the projected volume.
+
+                                                Most applications should use credentialBundlePath.  When using keyPath
+                                                and certificateChainPath, your application needs to check that the key
+                                                and leaf certificate are consistent, because it is possible to read the
+                                                files mid-rotation.
+                                              type: string
+                                            keyType:
+                                              description: |-
+                                                The type of keypair Kubelet will generate for the pod.
+
+                                                Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                                "ECDSAP521", and "ED25519".
+                                              type: string
+                                            maxExpirationSeconds:
+                                              description: |-
+                                                maxExpirationSeconds is the maximum lifetime permitted for the
+                                                certificate.
+
+                                                Kubelet copies this value verbatim into the PodCertificateRequests it
+                                                generates for this projection.
+
+                                                If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                                will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                                value is 7862400 (91 days).
+
+                                                The signer implementation is then free to issue a certificate with any
+                                                lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                                seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                                `kubernetes.io` signers will never issue certificates with a lifetime
+                                                longer than 24 hours.
+                                              format: int32
+                                              type: integer
+                                            signerName:
+                                              description: Kubelet's generated CSRs will be addressed to this signer.
+                                              type: string
+                                            userAnnotations:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                userAnnotations allow pod authors to pass additional information to
+                                                the signer implementation.  Kubernetes does not restrict or validate this
+                                                metadata in any way.
+
+                                                These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of
+                                                the PodCertificateRequest objects that Kubelet creates.
+
+                                                Entries are subject to the same validation as object metadata annotations,
+                                                with the addition that all keys must be domain-prefixed. No restrictions
+                                                are placed on values, except an overall size limitation on the entire field.
+
+                                                Signers should document the keys and values they support. Signers should
+                                                deny requests that contain keys they do not recognize.
+                                              type: object
+                                          required:
+                                            - keyType
+                                            - signerName
+                                          type: object
                                         secret:
                                           description: secret information about the secret data to project
                                           properties:
@@ -4643,7 +4980,6 @@ spec:
                                 description: |-
                                   rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                   Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                                  More info: https://examples.k8s.io/volumes/rbd/README.md
                                 properties:
                                   fsType:
                                     description: |-
@@ -5461,8 +5797,8 @@ spec:
                                     most preferred is the one with the greatest sum of weights, i.e.
                                     for each node that meets all of the scheduling requirements (resource
                                     request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                    compute a sum by iterating through the elements of this field and adding
-                                    "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                    compute a sum by iterating through the elements of this field and subtracting
+                                    "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                     node(s) with the highest sum are the most preferred.
                                   items:
                                     description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
@@ -5882,7 +6218,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -5941,7 +6277,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -6002,7 +6338,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -6061,7 +6397,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -6200,9 +6536,10 @@ spec:
                               operator:
                                 description: |-
                                   Operator represents a key's relationship to the value.
-                                  Valid operators are Exists and Equal. Defaults to Equal.
+                                  Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
                                   Exists is equivalent to wildcard for value, so that a pod can
                                   tolerate all taints of a particular category.
+                                  Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                                 type: string
                               tolerationSeconds:
                                 description: |-
@@ -6395,6 +6732,181 @@ spec:
                             type: object
                           type: array
                       type: object
+                    gateway:
+                      description: Defining the options for an Optional Gateway which will expose API Server of the Tenant Control Plane
+                      properties:
+                        additionalMetadata:
+                          description: AdditionalMetadata to add Labels and Annotations support.
+                          properties:
+                            annotations:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            labels:
+                              additionalProperties:
+                                type: string
+                              type: object
+                          type: object
+                        hostname:
+                          description: Hostname is an optional field which will be used as a route hostname.
+                          maxLength: 253
+                          minLength: 1
+                          pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                          type: string
+                        parentRefs:
+                          description: GatewayParentRefs is the class of the Gateway resource to use.
+                          items:
+                            description: |-
+                              ParentReference identifies an API object (usually a Gateway) that can be considered
+                              a parent of this resource (usually a route). There are two kinds of parent resources
+                              with "Core" support:
+
+                              * Gateway (Gateway conformance profile)
+                              * Service (Mesh conformance profile, ClusterIP Services only)
+
+                              This API may be extended in the future to support additional kinds of parent
+                              resources.
+
+                              The API object must be valid in the cluster; the Group and Kind must
+                              be registered in the cluster for this reference to be valid.
+                            properties:
+                              group:
+                                default: gateway.networking.k8s.io
+                                description: |-
+                                  Group is the group of the referent.
+                                  When unspecified, "gateway.networking.k8s.io" is inferred.
+                                  To set the core API group (such as for a "Service" kind referent),
+                                  Group must be explicitly set to "" (empty string).
+
+                                  Support: Core
+                                maxLength: 253
+                                pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                type: string
+                              kind:
+                                default: Gateway
+                                description: |-
+                                  Kind is kind of the referent.
+
+                                  There are two kinds of parent resources with "Core" support:
+
+                                  * Gateway (Gateway conformance profile)
+                                  * Service (Mesh conformance profile, ClusterIP Services only)
+
+                                  Support for other resources is Implementation-Specific.
+                                maxLength: 63
+                                minLength: 1
+                                pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                type: string
+                              name:
+                                description: |-
+                                  Name is the name of the referent.
+
+                                  Support: Core
+                                maxLength: 253
+                                minLength: 1
+                                type: string
+                              namespace:
+                                description: |-
+                                  Namespace is the namespace of the referent. When unspecified, this refers
+                                  to the local namespace of the Route.
+
+                                  Note that there are specific rules for ParentRefs which cross namespace
+                                  boundaries. Cross-namespace references are only valid if they are explicitly
+                                  allowed by something in the namespace they are referring to. For example:
+                                  Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                                  generic way to enable any other kind of cross-namespace reference.
+
+                                  <gateway:experimental:description>
+                                  ParentRefs from a Route to a Service in the same namespace are "producer"
+                                  routes, which apply default routing rules to inbound connections from
+                                  any namespace to the Service.
+
+                                  ParentRefs from a Route to a Service in a different namespace are
+                                  "consumer" routes, and these routing rules are only applied to outbound
+                                  connections originating from the same namespace as the Route, for which
+                                  the intended destination of the connections are a Service targeted as a
+                                  ParentRef of the Route.
+                                  </gateway:experimental:description>
+
+                                  Support: Core
+                                maxLength: 63
+                                minLength: 1
+                                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                type: string
+                              port:
+                                description: |-
+                                  Port is the network port this Route targets. It can be interpreted
+                                  differently based on the type of parent resource.
+
+                                  When the parent resource is a Gateway, this targets all listeners
+                                  listening on the specified port that also support this kind of Route(and
+                                  select this Route). It's not recommended to set `Port` unless the
+                                  networking behaviors specified in a Route must apply to a specific port
+                                  as opposed to a listener(s) whose port(s) may be changed. When both Port
+                                  and SectionName are specified, the name and port of the selected listener
+                                  must match both specified values.
+
+                                  <gateway:experimental:description>
+                                  When the parent resource is a Service, this targets a specific port in the
+                                  Service spec. When both Port (experimental) and SectionName are specified,
+                                  the name and port of the selected port must match both specified values.
+                                  </gateway:experimental:description>
+
+                                  Implementations MAY choose to support other parent resources.
+                                  Implementations supporting other types of parent resources MUST clearly
+                                  document how/if Port is interpreted.
+
+                                  For the purpose of status, an attachment is considered successful as
+                                  long as the parent resource accepts it partially. For example, Gateway
+                                  listeners can restrict which Routes can attach to them by Route kind,
+                                  namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                                  from the referencing Route, the Route MUST be considered successfully
+                                  attached. If no Gateway listeners accept attachment from this Route,
+                                  the Route MUST be considered detached from the Gateway.
+
+                                  Support: Extended
+                                format: int32
+                                maximum: 65535
+                                minimum: 1
+                                type: integer
+                              sectionName:
+                                description: |-
+                                  SectionName is the name of a section within the target resource. In the
+                                  following resources, SectionName is interpreted as the following:
+
+                                  * Gateway: Listener name. When both Port (experimental) and SectionName
+                                  are specified, the name and port of the selected listener must match
+                                  both specified values.
+                                  * Service: Port name. When both Port (experimental) and SectionName
+                                  are specified, the name and port of the selected listener must match
+                                  both specified values.
+
+                                  Implementations MAY choose to support attaching Routes to other resources.
+                                  If that is the case, they MUST clearly document how SectionName is
+                                  interpreted.
+
+                                  When unspecified (empty string), this will reference the entire resource.
+                                  For the purpose of status, an attachment is considered successful if at
+                                  least one section in the parent resource accepts it. For example, Gateway
+                                  listeners can restrict which Routes can attach to them by Route kind,
+                                  namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                                  the referencing Route, the Route MUST be considered successfully
+                                  attached. If no Gateway listeners accept attachment from this Route, the
+                                  Route MUST be considered detached from the Gateway.
+
+                                  Support: Core
+                                maxLength: 253
+                                minLength: 1
+                                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                type: string
+                            required:
+                              - name
+                            type: object
+                          type: array
+                      type: object
+                      x-kubernetes-validations:
+                        - message: parentRefs must not specify port or sectionName, these are set automatically by Kamaji
+                          rule: '!has(self.parentRefs) || size(self.parentRefs) == 0 || self.parentRefs.all(ref, !has(ref.port) && !has(ref.sectionName))'
                     ingress:
                       description: Defining the options for an Optional Ingress which will expose API Server of the Tenant Control Plane
                       properties:
@@ -6433,6 +6945,56 @@ spec:
                                 type: string
                               type: object
                           type: object
+                        additionalPorts:
+                          description: |-
+                            AdditionalPorts allows adding additional ports to the Service generated Kamaji
+                            which targets the Tenant Control Plane pods.
+                          items:
+                            properties:
+                              appProtocol:
+                                description: |-
+                                  The application protocol for this port.
+                                  This is used as a hint for implementations to offer richer behavior for protocols that they understand.
+                                  This field follows standard Kubernetes label syntax.
+                                  Valid values are either:
+
+                                  * Un-prefixed protocol names - reserved for IANA standard service names (as per
+                                  RFC-6335 and https://www.iana.org/assignments/service-names).
+                                type: string
+                              name:
+                                description: |-
+                                  The name of this port within the Service created by Kamaji.
+                                  This must be a DNS_LABEL, must have unique names, and cannot be `kube-apiserver`, or `konnectivity-server`.
+                                type: string
+                              port:
+                                description: The port that will be exposed by this service.
+                                format: int32
+                                type: integer
+                              protocol:
+                                default: TCP
+                                description: The IP protocol for this port. Supports "TCP", "UDP", and "SCTP".
+                                enum:
+                                  - TCP
+                                  - UDP
+                                  - SCTP
+                                type: string
+                              targetPort:
+                                anyOf:
+                                  - type: integer
+                                  - type: string
+                                description: |-
+                                  Number or name of the port to access on the pods of the Tenant Control Plane.
+                                  Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.
+                                  If this is a string, it will be looked up as a named port in the
+                                  target Pod's container ports. If this is not specified, the value
+                                  of the 'port' field is used (an identity map).
+                                x-kubernetes-int-or-string: true
+                            required:
+                              - name
+                              - port
+                              - targetPort
+                            type: object
+                          type: array
                         serviceType:
                           description: ServiceType allows specifying how to expose the Tenant Control Plane.
                           enum:
@@ -6446,6 +7008,9 @@ spec:
                   required:
                     - service
                   type: object
+                  x-kubernetes-validations:
+                    - message: using both ingress and gateway is not supported
+                      rule: '!(has(self.ingress) && has(self.gateway))'
                 dataStore:
                   description: |-
                     DataStore specifies the DataStore that should be used to store the Kubernetes data for the given Tenant Control Plane.
@@ -6455,6 +7020,19 @@ spec:
                     Migration from one DataStore to another backed by the same Driver is possible. See: https://kamaji.clastix.io/guides/datastore-migration/
                     Migration from one DataStore to another backed by a different Driver is not supported.
                   type: string
+                dataStoreOverrides:
+                  description: DataStoreOverride defines which kubernetes resources will be stored in dedicated datastores.
+                  items:
+                    description: DataStoreOverride defines which kubernetes resource will be stored in a dedicated datastore.
+                    properties:
+                      dataStore:
+                        description: DataStore specifies the DataStore that should be used to store the Kubernetes data for the given Resource.
+                        type: string
+                      resource:
+                        description: Resource specifies which kubernetes resource to target.
+                        type: string
+                    type: object
+                  type: array
                 dataStoreSchema:
                   description: |-
                     DataStoreSchema allows to specify the name of the database (for relational DataStores) or the key prefix (for etcd). This
@@ -6465,6 +7043,16 @@ spec:
                   x-kubernetes-validations:
                     - message: changing the dataStoreSchema is not supported
                       rule: self == oldSelf
+                dataStoreUsername:
+                  description: |-
+                    DataStoreUsername allows to specify the username of the database (for relational DataStores). This
+                    value is optional and immutable. Note that Kamaji currently doesn't ensure that DataStoreUsername values are unique. It's up
+                    to the user to avoid clashes between different TenantControlPlanes. If not set upon creation, Kamaji will default the
+                    DataStoreUsername by concatenating the namespace and name of the TenantControlPlane.
+                  type: string
+                  x-kubernetes-validations:
+                    - message: changing the dataStoreUsername is not supported
+                      rule: self == oldSelf
                 kubernetes:
                   description: Kubernetes specification for tenant control plane
                   properties:
@@ -6535,20 +7123,55 @@ spec:
                       properties:
                         cgroupfs:
                           description: |-
-                            CGroupFS defines the  cgroup driver for Kubelet
+                            CGroupFS defines the cgroup driver for Kubelet
                             https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver/
+
+                            Deprecated: use ConfigurationJSONPatches.
                           enum:
                             - systemd
                             - cgroupfs
                           type: string
+                        configurationJSONPatches:
+                          description: |-
+                            ConfigurationJSONPatches contains the RFC 6902 JSON patches to customise the kubeadm generate configuration,
+                            useful to customise and mangling the configuration according to your needs;
+                            e.g.: configuring the cgroup driver used by Kubelet is possible via the following patch:
+
+                            [{"op": "replace", "path": "/cgroupDriver", "value": "systemd"}]
+                          items:
+                            properties:
+                              from:
+                                description: From specifies the source location for move or copy operations.
+                                type: string
+                              op:
+                                description: Op is the RFC 6902 JSON Patch operation.
+                                enum:
+                                  - add
+                                  - remove
+                                  - replace
+                                  - move
+                                  - copy
+                                  - test
+                                type: string
+                              path:
+                                description: Path specifies the target location in the JSON document. Use "/" to separate keys; "-" for appending to arrays.
+                                type: string
+                              value:
+                                description: Value is the operation value to be used when Op is add, replace, test.
+                                x-kubernetes-preserve-unknown-fields: true
+                            required:
+                              - op
+                              - path
+                            type: object
+                          type: array
                         preferredAddressTypes:
                           default:
-                            - Hostname
                             - InternalIP
                             - ExternalIP
+                            - Hostname
                           description: |-
                             Ordered list of the preferred NodeAddressTypes to use for kubelet connections.
-                            Default to Hostname, InternalIP, ExternalIP.
+                            Default to InternalIP, ExternalIP, Hostname.
                           items:
                             enum:
                               - Hostname
@@ -6559,6 +7182,7 @@ spec:
                             type: string
                           minItems: 1
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     version:
                       description: Kubernetes Version for the tenant control plane
@@ -6639,6 +7263,22 @@ spec:
                       description: 'CIDR for Kubernetes Services: if empty, defaulted to 10.96.0.0/16.'
                       type: string
                   type: object
+                writePermissions:
+                  description: |-
+                    WritePermissions allows to select which operations (create, delete, update) must be blocked:
+                    by default, all actions are allowed, and API Server can write to its Datastore.
+
+                    By blocking all actions, the Tenant Control Plane can enter in a Read Only mode:
+                    this phase can be used to prevent Datastore quota exhaustion or for your own business logic
+                    (e.g.: blocking creation and update, but allowing deletion to "clean up" space).
+                  properties:
+                    blockCreation:
+                      type: boolean
+                    blockDeletion:
+                      type: boolean
+                    blockUpdate:
+                      type: boolean
+                  type: object
               required:
                 - controlPlane
                 - kubernetes
@@ -6648,6 +7288,8 @@ spec:
                   rule: '!has(oldSelf.dataStore) || has(self.dataStore)'
                 - message: unsetting the dataStoreSchema is not supported
                   rule: '!has(oldSelf.dataStoreSchema) || has(self.dataStoreSchema)'
+                - message: unsetting the dataStoreUsername is not supported
+                  rule: '!has(oldSelf.dataStoreUsername) || has(self.dataStoreUsername)'
                 - message: LoadBalancer source ranges are supported only with LoadBalancer service type
                   rule: '!has(self.networkProfile.loadBalancerSourceRanges) || (size(self.networkProfile.loadBalancerSourceRanges) == 0 || self.controlPlane.service.serviceType == ''LoadBalancer'')'
                 - message: LoadBalancerClass is supported only with LoadBalancer service type
@@ -6680,6 +7322,8 @@ spec:
                               description: Last time when k8s object was updated
                               format: date-time
                               type: string
+                            mode:
+                              type: string
                             name:
                               type: string
                             namespace:
@@ -6716,6 +7360,383 @@ spec:
                           type: object
                         enabled:
                           type: boolean
+                        gateway:
+                          description: KubernetesGatewayStatus defines the status for the Tenant Control Plane Gateway in the management cluster.
+                          properties:
+                            accessPoints:
+                              description: A list of valid access points that the route exposes.
+                              items:
+                                properties:
+                                  port:
+                                    format: int32
+                                    type: integer
+                                  type:
+                                    description: |-
+                                      AddressType defines how a network address is represented as a text string.
+                                      This may take two possible forms:
+
+                                      * A predefined CamelCase string identifier (currently limited to `IPAddress` or `Hostname`)
+                                      * A domain-prefixed string identifier (like `acme.io/CustomAddressType`)
+
+                                      Values `IPAddress` and `Hostname` have Extended support.
+
+                                      The `NamedAddress` value has been deprecated in favor of implementation
+                                      specific domain-prefixed strings.
+
+                                      All other values, including domain-prefixed values have Implementation-specific support,
+                                      which are used in implementation-specific behaviors. Support for additional
+                                      predefined CamelCase identifiers may be added in future releases.
+                                    maxLength: 253
+                                    minLength: 1
+                                    pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                                    type: string
+                                  urls:
+                                    items:
+                                      type: string
+                                    type: array
+                                  value:
+                                    type: string
+                                required:
+                                  - port
+                                  - type
+                                  - value
+                                type: object
+                              type: array
+                            parents:
+                              description: |-
+                                Parents is a list of parent resources (usually Gateways) that are
+                                associated with the route, and the status of the route with respect to
+                                each parent. When this route attaches to a parent, the controller that
+                                manages the parent must add an entry to this list when the controller
+                                first sees the route and should update the entry as appropriate when the
+                                route or gateway is modified.
+
+                                Note that parent references that cannot be resolved by an implementation
+                                of this API will not be added to this list. Implementations of this API
+                                can only populate Route status for the Gateways/parent resources they are
+                                responsible for.
+
+                                A maximum of 32 Gateways will be represented in this list. An empty list
+                                means the route has not been attached to any Gateway.
+
+                                <gateway:util:excludeFromCRD>
+                                Notes for implementors:
+
+                                While parents is not a listType `map`, this is due to the fact that the
+                                list key is not scalar, and Kubernetes is unable to represent this.
+
+                                Parent status MUST be considered to be namespaced by the combination of
+                                the parentRef and controllerName fields, and implementations should keep
+                                the following rules in mind when updating this status:
+
+                                * Implementations MUST update only entries that have a matching value of
+                                  `controllerName` for that implementation.
+                                * Implementations MUST NOT update entries with non-matching `controllerName`
+                                  fields.
+                                * Implementations MUST treat each `parentRef`` in the Route separately and
+                                  update its status based on the relationship with that parent.
+                                * Implementations MUST perform a read-modify-write cycle on this field
+                                  before modifying it. That is, when modifying this field, implementations
+                                  must be confident they have fetched the most recent version of this field,
+                                  and ensure that changes they make are on that recent version.
+
+                                </gateway:util:excludeFromCRD>
+                              items:
+                                description: |-
+                                  RouteParentStatus describes the status of a route with respect to an
+                                  associated Parent.
+                                properties:
+                                  conditions:
+                                    description: |-
+                                      Conditions describes the status of the route with respect to the Gateway.
+                                      Note that the route's availability is also subject to the Gateway's own
+                                      status conditions and listener status.
+
+                                      If the Route's ParentRef specifies an existing Gateway that supports
+                                      Routes of this kind AND that Gateway's controller has sufficient access,
+                                      then that Gateway's controller MUST set the "Accepted" condition on the
+                                      Route, to indicate whether the route has been accepted or rejected by the
+                                      Gateway, and why.
+
+                                      A Route MUST be considered "Accepted" if at least one of the Route's
+                                      rules is implemented by the Gateway.
+
+                                      There are a number of cases where the "Accepted" condition may not be set
+                                      due to lack of controller visibility, that includes when:
+
+                                      * The Route refers to a nonexistent parent.
+                                      * The Route is of a type that the controller does not support.
+                                      * The Route is in a namespace the controller does not have access to.
+
+                                      <gateway:util:excludeFromCRD>
+
+                                      Notes for implementors:
+
+                                      Conditions are a listType `map`, which means that they function like a
+                                      map with a key of the `type` field _in the k8s apiserver_.
+
+                                      This means that implementations must obey some rules when updating this
+                                      section.
+
+                                      * Implementations MUST perform a read-modify-write cycle on this field
+                                        before modifying it. That is, when modifying this field, implementations
+                                        must be confident they have fetched the most recent version of this field,
+                                        and ensure that changes they make are on that recent version.
+                                      * Implementations MUST NOT remove or reorder Conditions that they are not
+                                        directly responsible for. For example, if an implementation sees a Condition
+                                        with type `special.io/SomeField`, it MUST NOT remove, change or update that
+                                        Condition.
+                                      * Implementations MUST always _merge_ changes into Conditions of the same Type,
+                                        rather than creating more than one Condition of the same Type.
+                                      * Implementations MUST always update the `observedGeneration` field of the
+                                        Condition to the `metadata.generation` of the Gateway at the time of update creation.
+                                      * If the `observedGeneration` of a Condition is _greater than_ the value the
+                                        implementation knows about, then it MUST NOT perform the update on that Condition,
+                                        but must wait for a future reconciliation and status update. (The assumption is that
+                                        the implementation's copy of the object is stale and an update will be re-triggered
+                                        if relevant.)
+
+                                      </gateway:util:excludeFromCRD>
+                                    items:
+                                      description: Condition contains details for one aspect of the current state of this API Resource.
+                                      properties:
+                                        lastTransitionTime:
+                                          description: |-
+                                            lastTransitionTime is the last time the condition transitioned from one status to another.
+                                            This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                                          format: date-time
+                                          type: string
+                                        message:
+                                          description: |-
+                                            message is a human readable message indicating details about the transition.
+                                            This may be an empty string.
+                                          maxLength: 32768
+                                          type: string
+                                        observedGeneration:
+                                          description: |-
+                                            observedGeneration represents the .metadata.generation that the condition was set based upon.
+                                            For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                                            with respect to the current state of the instance.
+                                          format: int64
+                                          minimum: 0
+                                          type: integer
+                                        reason:
+                                          description: |-
+                                            reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                                            Producers of specific condition types may define expected values and meanings for this field,
+                                            and whether the values are considered a guaranteed API.
+                                            The value should be a CamelCase string.
+                                            This field may not be empty.
+                                          maxLength: 1024
+                                          minLength: 1
+                                          pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                                          type: string
+                                        status:
+                                          description: status of the condition, one of True, False, Unknown.
+                                          enum:
+                                            - "True"
+                                            - "False"
+                                            - Unknown
+                                          type: string
+                                        type:
+                                          description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                                          maxLength: 316
+                                          pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                                          type: string
+                                      required:
+                                        - lastTransitionTime
+                                        - message
+                                        - reason
+                                        - status
+                                        - type
+                                      type: object
+                                    maxItems: 8
+                                    minItems: 1
+                                    type: array
+                                    x-kubernetes-list-map-keys:
+                                      - type
+                                    x-kubernetes-list-type: map
+                                  controllerName:
+                                    description: |-
+                                      ControllerName is a domain/path string that indicates the name of the
+                                      controller that wrote this status. This corresponds with the
+                                      controllerName field on GatewayClass.
+
+                                      Example: "example.net/gateway-controller".
+
+                                      The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
+                                      valid Kubernetes names
+                                      (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
+
+                                      Controllers MUST populate this field when writing status. Controllers should ensure that
+                                      entries to status populated with their ControllerName are cleaned up when they are no
+                                      longer necessary.
+                                    maxLength: 253
+                                    minLength: 1
+                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                                    type: string
+                                  parentRef:
+                                    description: |-
+                                      ParentRef corresponds with a ParentRef in the spec that this
+                                      RouteParentStatus struct describes the status of.
+                                    properties:
+                                      group:
+                                        default: gateway.networking.k8s.io
+                                        description: |-
+                                          Group is the group of the referent.
+                                          When unspecified, "gateway.networking.k8s.io" is inferred.
+                                          To set the core API group (such as for a "Service" kind referent),
+                                          Group must be explicitly set to "" (empty string).
+
+                                          Support: Core
+                                        maxLength: 253
+                                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                        type: string
+                                      kind:
+                                        default: Gateway
+                                        description: |-
+                                          Kind is kind of the referent.
+
+                                          There are two kinds of parent resources with "Core" support:
+
+                                          * Gateway (Gateway conformance profile)
+                                          * Service (Mesh conformance profile, ClusterIP Services only)
+
+                                          Support for other resources is Implementation-Specific.
+                                        maxLength: 63
+                                        minLength: 1
+                                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name is the name of the referent.
+
+                                          Support: Core
+                                        maxLength: 253
+                                        minLength: 1
+                                        type: string
+                                      namespace:
+                                        description: |-
+                                          Namespace is the namespace of the referent. When unspecified, this refers
+                                          to the local namespace of the Route.
+
+                                          Note that there are specific rules for ParentRefs which cross namespace
+                                          boundaries. Cross-namespace references are only valid if they are explicitly
+                                          allowed by something in the namespace they are referring to. For example:
+                                          Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                                          generic way to enable any other kind of cross-namespace reference.
+
+                                          <gateway:experimental:description>
+                                          ParentRefs from a Route to a Service in the same namespace are "producer"
+                                          routes, which apply default routing rules to inbound connections from
+                                          any namespace to the Service.
+
+                                          ParentRefs from a Route to a Service in a different namespace are
+                                          "consumer" routes, and these routing rules are only applied to outbound
+                                          connections originating from the same namespace as the Route, for which
+                                          the intended destination of the connections are a Service targeted as a
+                                          ParentRef of the Route.
+                                          </gateway:experimental:description>
+
+                                          Support: Core
+                                        maxLength: 63
+                                        minLength: 1
+                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Port is the network port this Route targets. It can be interpreted
+                                          differently based on the type of parent resource.
+
+                                          When the parent resource is a Gateway, this targets all listeners
+                                          listening on the specified port that also support this kind of Route(and
+                                          select this Route). It's not recommended to set `Port` unless the
+                                          networking behaviors specified in a Route must apply to a specific port
+                                          as opposed to a listener(s) whose port(s) may be changed. When both Port
+                                          and SectionName are specified, the name and port of the selected listener
+                                          must match both specified values.
+
+                                          <gateway:experimental:description>
+                                          When the parent resource is a Service, this targets a specific port in the
+                                          Service spec. When both Port (experimental) and SectionName are specified,
+                                          the name and port of the selected port must match both specified values.
+                                          </gateway:experimental:description>
+
+                                          Implementations MAY choose to support other parent resources.
+                                          Implementations supporting other types of parent resources MUST clearly
+                                          document how/if Port is interpreted.
+
+                                          For the purpose of status, an attachment is considered successful as
+                                          long as the parent resource accepts it partially. For example, Gateway
+                                          listeners can restrict which Routes can attach to them by Route kind,
+                                          namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                                          from the referencing Route, the Route MUST be considered successfully
+                                          attached. If no Gateway listeners accept attachment from this Route,
+                                          the Route MUST be considered detached from the Gateway.
+
+                                          Support: Extended
+                                        format: int32
+                                        maximum: 65535
+                                        minimum: 1
+                                        type: integer
+                                      sectionName:
+                                        description: |-
+                                          SectionName is the name of a section within the target resource. In the
+                                          following resources, SectionName is interpreted as the following:
+
+                                          * Gateway: Listener name. When both Port (experimental) and SectionName
+                                          are specified, the name and port of the selected listener must match
+                                          both specified values.
+                                          * Service: Port name. When both Port (experimental) and SectionName
+                                          are specified, the name and port of the selected listener must match
+                                          both specified values.
+
+                                          Implementations MAY choose to support attaching Routes to other resources.
+                                          If that is the case, they MUST clearly document how SectionName is
+                                          interpreted.
+
+                                          When unspecified (empty string), this will reference the entire resource.
+                                          For the purpose of status, an attachment is considered successful if at
+                                          least one section in the parent resource accepts it. For example, Gateway
+                                          listeners can restrict which Routes can attach to them by Route kind,
+                                          namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                                          the referencing Route, the Route MUST be considered successfully
+                                          attached. If no Gateway listeners accept attachment from this Route, the
+                                          Route MUST be considered detached from the Gateway.
+
+                                          Support: Core
+                                        maxLength: 253
+                                        minLength: 1
+                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                required:
+                                  - conditions
+                                  - controllerName
+                                  - parentRef
+                                type: object
+                              maxItems: 32
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            routeRef:
+                              description: Reference to the route created for this tenant.
+                              properties:
+                                name:
+                                  default: ""
+                                  description: |-
+                                    Name of the referent.
+                                    This field is effectively required, but due to backwards compatibility is
+                                    allowed to be empty. Instances of this type with an empty value here are
+                                    almost certainly wrong.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                              type: object
+                              x-kubernetes-map-type: atomic
+                          required:
+                            - parents
+                          type: object
                         kubeconfig:
                           description: KubeconfigStatus contains information about the generated kubeconfig.
                           properties:
@@ -7146,7 +8167,7 @@ spec:
                             Total number of terminating pods targeted by this deployment. Terminating pods have a non-null
                             .metadata.deletionTimestamp and have not yet reached the Failed or Succeeded .status.phase.
 
-                            This is an alpha field. Enable DeploymentReplicaSetTerminatingReplicas to be able to use this field.
+                            This is a beta field and requires enabling DeploymentReplicaSetTerminatingReplicas feature (enabled by default).
                           format: int32
                           type: integer
                         unavailableReplicas:
@@ -7165,6 +8186,383 @@ spec:
                         - namespace
                         - selector
                       type: object
+                    gateway:
+                      description: KubernetesGatewayStatus defines the status for the Tenant Control Plane Gateway in the management cluster.
+                      properties:
+                        accessPoints:
+                          description: A list of valid access points that the route exposes.
+                          items:
+                            properties:
+                              port:
+                                format: int32
+                                type: integer
+                              type:
+                                description: |-
+                                  AddressType defines how a network address is represented as a text string.
+                                  This may take two possible forms:
+
+                                  * A predefined CamelCase string identifier (currently limited to `IPAddress` or `Hostname`)
+                                  * A domain-prefixed string identifier (like `acme.io/CustomAddressType`)
+
+                                  Values `IPAddress` and `Hostname` have Extended support.
+
+                                  The `NamedAddress` value has been deprecated in favor of implementation
+                                  specific domain-prefixed strings.
+
+                                  All other values, including domain-prefixed values have Implementation-specific support,
+                                  which are used in implementation-specific behaviors. Support for additional
+                                  predefined CamelCase identifiers may be added in future releases.
+                                maxLength: 253
+                                minLength: 1
+                                pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                                type: string
+                              urls:
+                                items:
+                                  type: string
+                                type: array
+                              value:
+                                type: string
+                            required:
+                              - port
+                              - type
+                              - value
+                            type: object
+                          type: array
+                        parents:
+                          description: |-
+                            Parents is a list of parent resources (usually Gateways) that are
+                            associated with the route, and the status of the route with respect to
+                            each parent. When this route attaches to a parent, the controller that
+                            manages the parent must add an entry to this list when the controller
+                            first sees the route and should update the entry as appropriate when the
+                            route or gateway is modified.
+
+                            Note that parent references that cannot be resolved by an implementation
+                            of this API will not be added to this list. Implementations of this API
+                            can only populate Route status for the Gateways/parent resources they are
+                            responsible for.
+
+                            A maximum of 32 Gateways will be represented in this list. An empty list
+                            means the route has not been attached to any Gateway.
+
+                            <gateway:util:excludeFromCRD>
+                            Notes for implementors:
+
+                            While parents is not a listType `map`, this is due to the fact that the
+                            list key is not scalar, and Kubernetes is unable to represent this.
+
+                            Parent status MUST be considered to be namespaced by the combination of
+                            the parentRef and controllerName fields, and implementations should keep
+                            the following rules in mind when updating this status:
+
+                            * Implementations MUST update only entries that have a matching value of
+                              `controllerName` for that implementation.
+                            * Implementations MUST NOT update entries with non-matching `controllerName`
+                              fields.
+                            * Implementations MUST treat each `parentRef`` in the Route separately and
+                              update its status based on the relationship with that parent.
+                            * Implementations MUST perform a read-modify-write cycle on this field
+                              before modifying it. That is, when modifying this field, implementations
+                              must be confident they have fetched the most recent version of this field,
+                              and ensure that changes they make are on that recent version.
+
+                            </gateway:util:excludeFromCRD>
+                          items:
+                            description: |-
+                              RouteParentStatus describes the status of a route with respect to an
+                              associated Parent.
+                            properties:
+                              conditions:
+                                description: |-
+                                  Conditions describes the status of the route with respect to the Gateway.
+                                  Note that the route's availability is also subject to the Gateway's own
+                                  status conditions and listener status.
+
+                                  If the Route's ParentRef specifies an existing Gateway that supports
+                                  Routes of this kind AND that Gateway's controller has sufficient access,
+                                  then that Gateway's controller MUST set the "Accepted" condition on the
+                                  Route, to indicate whether the route has been accepted or rejected by the
+                                  Gateway, and why.
+
+                                  A Route MUST be considered "Accepted" if at least one of the Route's
+                                  rules is implemented by the Gateway.
+
+                                  There are a number of cases where the "Accepted" condition may not be set
+                                  due to lack of controller visibility, that includes when:
+
+                                  * The Route refers to a nonexistent parent.
+                                  * The Route is of a type that the controller does not support.
+                                  * The Route is in a namespace the controller does not have access to.
+
+                                  <gateway:util:excludeFromCRD>
+
+                                  Notes for implementors:
+
+                                  Conditions are a listType `map`, which means that they function like a
+                                  map with a key of the `type` field _in the k8s apiserver_.
+
+                                  This means that implementations must obey some rules when updating this
+                                  section.
+
+                                  * Implementations MUST perform a read-modify-write cycle on this field
+                                    before modifying it. That is, when modifying this field, implementations
+                                    must be confident they have fetched the most recent version of this field,
+                                    and ensure that changes they make are on that recent version.
+                                  * Implementations MUST NOT remove or reorder Conditions that they are not
+                                    directly responsible for. For example, if an implementation sees a Condition
+                                    with type `special.io/SomeField`, it MUST NOT remove, change or update that
+                                    Condition.
+                                  * Implementations MUST always _merge_ changes into Conditions of the same Type,
+                                    rather than creating more than one Condition of the same Type.
+                                  * Implementations MUST always update the `observedGeneration` field of the
+                                    Condition to the `metadata.generation` of the Gateway at the time of update creation.
+                                  * If the `observedGeneration` of a Condition is _greater than_ the value the
+                                    implementation knows about, then it MUST NOT perform the update on that Condition,
+                                    but must wait for a future reconciliation and status update. (The assumption is that
+                                    the implementation's copy of the object is stale and an update will be re-triggered
+                                    if relevant.)
+
+                                  </gateway:util:excludeFromCRD>
+                                items:
+                                  description: Condition contains details for one aspect of the current state of this API Resource.
+                                  properties:
+                                    lastTransitionTime:
+                                      description: |-
+                                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                                      format: date-time
+                                      type: string
+                                    message:
+                                      description: |-
+                                        message is a human readable message indicating details about the transition.
+                                        This may be an empty string.
+                                      maxLength: 32768
+                                      type: string
+                                    observedGeneration:
+                                      description: |-
+                                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                                        with respect to the current state of the instance.
+                                      format: int64
+                                      minimum: 0
+                                      type: integer
+                                    reason:
+                                      description: |-
+                                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                                        Producers of specific condition types may define expected values and meanings for this field,
+                                        and whether the values are considered a guaranteed API.
+                                        The value should be a CamelCase string.
+                                        This field may not be empty.
+                                      maxLength: 1024
+                                      minLength: 1
+                                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                                      type: string
+                                    status:
+                                      description: status of the condition, one of True, False, Unknown.
+                                      enum:
+                                        - "True"
+                                        - "False"
+                                        - Unknown
+                                      type: string
+                                    type:
+                                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                                      maxLength: 316
+                                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                                      type: string
+                                  required:
+                                    - lastTransitionTime
+                                    - message
+                                    - reason
+                                    - status
+                                    - type
+                                  type: object
+                                maxItems: 8
+                                minItems: 1
+                                type: array
+                                x-kubernetes-list-map-keys:
+                                  - type
+                                x-kubernetes-list-type: map
+                              controllerName:
+                                description: |-
+                                  ControllerName is a domain/path string that indicates the name of the
+                                  controller that wrote this status. This corresponds with the
+                                  controllerName field on GatewayClass.
+
+                                  Example: "example.net/gateway-controller".
+
+                                  The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
+                                  valid Kubernetes names
+                                  (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
+
+                                  Controllers MUST populate this field when writing status. Controllers should ensure that
+                                  entries to status populated with their ControllerName are cleaned up when they are no
+                                  longer necessary.
+                                maxLength: 253
+                                minLength: 1
+                                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                                type: string
+                              parentRef:
+                                description: |-
+                                  ParentRef corresponds with a ParentRef in the spec that this
+                                  RouteParentStatus struct describes the status of.
+                                properties:
+                                  group:
+                                    default: gateway.networking.k8s.io
+                                    description: |-
+                                      Group is the group of the referent.
+                                      When unspecified, "gateway.networking.k8s.io" is inferred.
+                                      To set the core API group (such as for a "Service" kind referent),
+                                      Group must be explicitly set to "" (empty string).
+
+                                      Support: Core
+                                    maxLength: 253
+                                    pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                    type: string
+                                  kind:
+                                    default: Gateway
+                                    description: |-
+                                      Kind is kind of the referent.
+
+                                      There are two kinds of parent resources with "Core" support:
+
+                                      * Gateway (Gateway conformance profile)
+                                      * Service (Mesh conformance profile, ClusterIP Services only)
+
+                                      Support for other resources is Implementation-Specific.
+                                    maxLength: 63
+                                    minLength: 1
+                                    pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                    type: string
+                                  name:
+                                    description: |-
+                                      Name is the name of the referent.
+
+                                      Support: Core
+                                    maxLength: 253
+                                    minLength: 1
+                                    type: string
+                                  namespace:
+                                    description: |-
+                                      Namespace is the namespace of the referent. When unspecified, this refers
+                                      to the local namespace of the Route.
+
+                                      Note that there are specific rules for ParentRefs which cross namespace
+                                      boundaries. Cross-namespace references are only valid if they are explicitly
+                                      allowed by something in the namespace they are referring to. For example:
+                                      Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                                      generic way to enable any other kind of cross-namespace reference.
+
+                                      <gateway:experimental:description>
+                                      ParentRefs from a Route to a Service in the same namespace are "producer"
+                                      routes, which apply default routing rules to inbound connections from
+                                      any namespace to the Service.
+
+                                      ParentRefs from a Route to a Service in a different namespace are
+                                      "consumer" routes, and these routing rules are only applied to outbound
+                                      connections originating from the same namespace as the Route, for which
+                                      the intended destination of the connections are a Service targeted as a
+                                      ParentRef of the Route.
+                                      </gateway:experimental:description>
+
+                                      Support: Core
+                                    maxLength: 63
+                                    minLength: 1
+                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                    type: string
+                                  port:
+                                    description: |-
+                                      Port is the network port this Route targets. It can be interpreted
+                                      differently based on the type of parent resource.
+
+                                      When the parent resource is a Gateway, this targets all listeners
+                                      listening on the specified port that also support this kind of Route(and
+                                      select this Route). It's not recommended to set `Port` unless the
+                                      networking behaviors specified in a Route must apply to a specific port
+                                      as opposed to a listener(s) whose port(s) may be changed. When both Port
+                                      and SectionName are specified, the name and port of the selected listener
+                                      must match both specified values.
+
+                                      <gateway:experimental:description>
+                                      When the parent resource is a Service, this targets a specific port in the
+                                      Service spec. When both Port (experimental) and SectionName are specified,
+                                      the name and port of the selected port must match both specified values.
+                                      </gateway:experimental:description>
+
+                                      Implementations MAY choose to support other parent resources.
+                                      Implementations supporting other types of parent resources MUST clearly
+                                      document how/if Port is interpreted.
+
+                                      For the purpose of status, an attachment is considered successful as
+                                      long as the parent resource accepts it partially. For example, Gateway
+                                      listeners can restrict which Routes can attach to them by Route kind,
+                                      namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                                      from the referencing Route, the Route MUST be considered successfully
+                                      attached. If no Gateway listeners accept attachment from this Route,
+                                      the Route MUST be considered detached from the Gateway.
+
+                                      Support: Extended
+                                    format: int32
+                                    maximum: 65535
+                                    minimum: 1
+                                    type: integer
+                                  sectionName:
+                                    description: |-
+                                      SectionName is the name of a section within the target resource. In the
+                                      following resources, SectionName is interpreted as the following:
+
+                                      * Gateway: Listener name. When both Port (experimental) and SectionName
+                                      are specified, the name and port of the selected listener must match
+                                      both specified values.
+                                      * Service: Port name. When both Port (experimental) and SectionName
+                                      are specified, the name and port of the selected listener must match
+                                      both specified values.
+
+                                      Implementations MAY choose to support attaching Routes to other resources.
+                                      If that is the case, they MUST clearly document how SectionName is
+                                      interpreted.
+
+                                      When unspecified (empty string), this will reference the entire resource.
+                                      For the purpose of status, an attachment is considered successful if at
+                                      least one section in the parent resource accepts it. For example, Gateway
+                                      listeners can restrict which Routes can attach to them by Route kind,
+                                      namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                                      the referencing Route, the Route MUST be considered successfully
+                                      attached. If no Gateway listeners accept attachment from this Route, the
+                                      Route MUST be considered detached from the Gateway.
+
+                                      Support: Core
+                                    maxLength: 253
+                                    minLength: 1
+                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                    type: string
+                                required:
+                                  - name
+                                type: object
+                            required:
+                              - conditions
+                              - controllerName
+                              - parentRef
+                            type: object
+                          maxItems: 32
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        routeRef:
+                          description: Reference to the route created for this tenant.
+                          properties:
+                            name:
+                              default: ""
+                              description: |-
+                                Name of the referent.
+                                This field is effectively required, but due to backwards compatibility is
+                                allowed to be empty. Instances of this type with an empty value here are
+                                almost certainly wrong.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                          type: object
+                          x-kubernetes-map-type: atomic
+                      required:
+                        - parents
+                      type: object
                     ingress:
                       description: KubernetesIngressStatus defines the status for the Tenant Control Plane Ingress in the management cluster.
                       properties:
@@ -7383,6 +8781,7 @@ spec:
                           default: Provisioning
                           description: Status returns the current status of the Kubernetes version, such as its provisioning state, or completed upgrade.
                           enum:
+                            - Unknown
                             - Provisioning
                             - CertificateAuthorityRotating
                             - Upgrading
@@ -7390,12 +8789,17 @@ spec:
                             - Ready
                             - NotReady
                             - Sleeping
+                            - WriteLimited
                           type: string
                         version:
                           description: Version is the running Kubernetes version of the Tenant Control Plane.
                           type: string
                       type: object
                   type: object
+                observedGeneration:
+                  description: ObservedGeneration represents the .metadata.generation that was last reconciled.
+                  format: int64
+                  type: integer
                 storage:
                   description: Storage Status contains information about Kubernetes storage system
                   properties:
diff --git a/packages/system/kamaji/charts/kamaji/templates/_helpers.tpl b/packages/system/kamaji/charts/kamaji/templates/_helpers.tpl
index f44ca63d..f0bf1bed 100644
--- a/packages/system/kamaji/charts/kamaji/templates/_helpers.tpl
+++ b/packages/system/kamaji/charts/kamaji/templates/_helpers.tpl
@@ -89,3 +89,15 @@ Create the name of the cert-manager Certificate
 {{- define "kamaji.certificateName" -}}
 {{- printf "%s-serving-cert" (include "kamaji.fullname" .) }}
 {{- end }}
+
+
+{{/*
+Kubeconfig Generator Deployment name.
+*/}}
+{{- define "kamaji.kubeconfigGeneratorName" -}}
+{{- if .Values.kubeconfigGenerator.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name "kubeconfig-generator" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/kamaji/charts/kamaji/templates/kubeconfiggenerator-deployment.yaml b/packages/system/kamaji/charts/kamaji/templates/kubeconfiggenerator-deployment.yaml
new file mode 100644
index 00000000..d7199d21
--- /dev/null
+++ b/packages/system/kamaji/charts/kamaji/templates/kubeconfiggenerator-deployment.yaml
@@ -0,0 +1,54 @@
+{{- if .Values.kubeconfigGenerator.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    {{- include "kamaji.labels" . | nindent 4 }}
+  name: {{ include "kamaji.kubeconfigGeneratorName" . }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: {{ .Values.kubeconfigGenerator.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "kamaji.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.kubeconfigGenerator.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "kamaji.selectorLabels" . | nindent 8 }}
+    spec:
+      securityContext:
+        {{- toYaml .Values.kubeconfigGenerator.podSecurityContext | nindent 8 }}
+      serviceAccountName: {{ default .Values.kubeconfigGenerator.serviceAccountOverride (include "kamaji.serviceAccountName" .) }}
+      containers:
+        - args:
+          - kubeconfig-generator
+          - --health-probe-bind-address={{ .Values.kubeconfigGenerator.healthProbeBindAddress }}
+          - --leader-elect={{ .Values.kubeconfigGenerator.enableLeaderElect }}
+          {{- if .Values.kubeconfigGenerator.loggingDevel.enable }}- --zap-devel{{- end }}
+          {{- with .Values.kubeconfigGenerator.extraArgs }}
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          name: controller
+          resources:
+            {{- toYaml .Values.kubeconfigGenerator.resources | nindent 12 }}
+          securityContext:
+            {{- toYaml .Values.kubeconfigGenerator.securityContext | nindent 12 }}
+      {{- with .Values.kubeconfigGenerator.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kubeconfigGenerator.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kubeconfigGenerator.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}
diff --git a/packages/system/kamaji/charts/kamaji/values.yaml b/packages/system/kamaji/charts/kamaji/values.yaml
index 79dd254a..0e99af10 100644
--- a/packages/system/kamaji/charts/kamaji/values.yaml
+++ b/packages/system/kamaji/charts/kamaji/values.yaml
@@ -98,9 +98,12 @@ loggingDevel:
 # -- If specified, all the Kamaji instances with an unassigned DataStore will inherit this default value.
 defaultDatastoreName: default
 
+# -- Subchart: See https://github.com/clastix/kamaji-etcd/blob/master/charts/kamaji-etcd/values.yaml
 kamaji-etcd:
   deploy: true
   fullnameOverride: kamaji-etcd
+  ## -- Important, this must match your management cluster's clusterDomain, otherwise the init jobs will fail
+  clusterDomain: "cluster.local"
   datastore:
     enabled: true
     name: default
@@ -108,4 +111,48 @@ kamaji-etcd:
 # -- Disable the analytics traces collection
 telemetry:
   disabled: false
-  
\ No newline at end of file
+
+kubeconfigGenerator:
+  # -- Toggle to deploy the Kubeconfig Generator Deployment.
+  enabled: false
+  fullnameOverride: ""
+  # -- The number of the pod replicas for the Kubeconfig Generator controller.
+  replicaCount: 2
+  # -- The annotations to apply to the Kubeconfig Generator controller pods.
+  podAnnotations: {}
+  # -- The securityContext to apply to the Kubeconfig Generator controller pods.
+  podSecurityContext:
+    runAsNonRoot: true
+  # -- The name of the service account to use. If not set, the root Kamaji one will be used.
+  serviceAccountOverride: ""
+  # -- The address the probe endpoint binds to.
+  healthProbeBindAddress: ":8081"
+  # -- Enables the leader election.
+  enableLeaderElect: true
+  loggingDevel:
+    # -- Development Mode defaults(encoder=consoleEncoder,logLevel=Debug,stackTraceLevel=Warn). Production Mode defaults(encoder=jsonEncoder,logLevel=Info,stackTraceLevel=Error)
+    enable: false
+  # -- A list of extra arguments to add to the Kubeconfig Generator controller default ones.
+  extraArgs: []
+  resources:
+    limits:
+      cpu: 200m
+      memory: 512Mi
+    requests:
+      cpu: 200m
+      memory: 512Mi
+  # -- The securityContext to apply to the Kubeconfig Generator controller container only.
+  securityContext:
+    allowPrivilegeEscalation: false
+    # capabilities:
+    #   drop:
+    #   - ALL
+    # readOnlyRootFilesystem: true
+    # runAsNonRoot: true
+    # runAsUser: 1000
+  # -- Kubernetes node selector rules to schedule Kubeconfig Generator controller
+  nodeSelector: {}
+  # -- Kubernetes node taints that the Kubeconfig Generator controller pods would tolerate
+  tolerations: []
+  # -- Kubernetes affinity rules to apply to Kubeconfig Generator controller pods
+  affinity: {}
diff --git a/packages/system/kamaji/images/kamaji/Dockerfile b/packages/system/kamaji/images/kamaji/Dockerfile
index e7bd44be..7cde7ea3 100644
--- a/packages/system/kamaji/images/kamaji/Dockerfile
+++ b/packages/system/kamaji/images/kamaji/Dockerfile
@@ -1,7 +1,7 @@
 # Build the manager binary
 FROM golang:1.24 as builder
 
-ARG VERSION=edge-25.4.1
+ARG VERSION=edge-26.2.4
 ARG TARGETOS
 ARG TARGETARCH
 
diff --git a/packages/system/kamaji/images/kamaji/patches/992.diff b/packages/system/kamaji/images/kamaji/patches/992.diff
deleted file mode 100644
index cd9c2ad3..00000000
--- a/packages/system/kamaji/images/kamaji/patches/992.diff
+++ /dev/null
@@ -1,156 +0,0 @@
-diff --git a/internal/resources/api_server_certificate.go b/internal/resources/api_server_certificate.go
-index 436cdf9..4702b6c 100644
---- a/internal/resources/api_server_certificate.go
-+++ b/internal/resources/api_server_certificate.go
-@@ -108,6 +108,7 @@ func (r *APIServerCertificate) mutate(ctx context.Context, tenantControlPlane *k
- 		}
- 
- 		r.resource.SetLabels(utilities.MergeMaps(
-+			r.resource.GetLabels(),
- 			utilities.KamajiLabels(tenantControlPlane.GetName(), r.GetName()),
- 			map[string]string{
- 				constants.ControllerLabelResource: "x509",
-diff --git a/internal/resources/api_server_kubelet_client_certificate.go b/internal/resources/api_server_kubelet_client_certificate.go
-index 85b4d42..da18db4 100644
---- a/internal/resources/api_server_kubelet_client_certificate.go
-+++ b/internal/resources/api_server_kubelet_client_certificate.go
-@@ -95,6 +95,7 @@ func (r *APIServerKubeletClientCertificate) mutate(ctx context.Context, tenantCo
- 		}
- 
- 		r.resource.SetLabels(utilities.MergeMaps(
-+			r.resource.GetLabels(),
- 			utilities.KamajiLabels(tenantControlPlane.GetName(), r.GetName()),
- 			map[string]string{
- 				constants.ControllerLabelResource: "x509",
-diff --git a/internal/resources/ca_certificate.go b/internal/resources/ca_certificate.go
-index 5425b0b..625273f 100644
---- a/internal/resources/ca_certificate.go
-+++ b/internal/resources/ca_certificate.go
-@@ -137,7 +137,7 @@ func (r *CACertificate) mutate(ctx context.Context, tenantControlPlane *kamajiv1
- 			corev1.TLSPrivateKeyKey: ca.PrivateKey,
- 		}
- 
--		r.resource.SetLabels(utilities.KamajiLabels(tenantControlPlane.GetName(), r.GetName()))
-+		r.resource.SetLabels(utilities.MergeMaps(r.resource.GetLabels(), utilities.KamajiLabels(tenantControlPlane.GetName(), r.GetName())))
- 
- 		utilities.SetObjectChecksum(r.resource, r.resource.Data)
- 
-diff --git a/internal/resources/datastore/datastore_certificate.go b/internal/resources/datastore/datastore_certificate.go
-index dea45ae..8492a5e 100644
---- a/internal/resources/datastore/datastore_certificate.go
-+++ b/internal/resources/datastore/datastore_certificate.go
-@@ -94,6 +94,7 @@ func (r *Certificate) mutate(ctx context.Context, tenantControlPlane *kamajiv1al
- 			r.resource.Data["ca.crt"] = ca
- 
- 			r.resource.SetLabels(utilities.MergeMaps(
-+				r.resource.GetLabels(),
- 				utilities.KamajiLabels(tenantControlPlane.GetName(), r.GetName()),
- 				map[string]string{
- 					constants.ControllerLabelResource: "x509",
-diff --git a/internal/resources/datastore/datastore_storage_config.go b/internal/resources/datastore/datastore_storage_config.go
-index 7d03420..4ea9e64 100644
---- a/internal/resources/datastore/datastore_storage_config.go
-+++ b/internal/resources/datastore/datastore_storage_config.go
-@@ -181,7 +181,7 @@ func (r *Config) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.
- 
- 		utilities.SetObjectChecksum(r.resource, r.resource.Data)
- 
--		r.resource.SetLabels(utilities.KamajiLabels(tenantControlPlane.GetName(), r.GetName()))
-+		r.resource.SetLabels(utilities.MergeMaps(r.resource.GetLabels(), utilities.KamajiLabels(tenantControlPlane.GetName(), r.GetName())))
- 
- 		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())
- 	}
-diff --git a/internal/resources/front-proxy-client-certificate.go b/internal/resources/front-proxy-client-certificate.go
-index f5ed67c..2dd4eda 100644
---- a/internal/resources/front-proxy-client-certificate.go
-+++ b/internal/resources/front-proxy-client-certificate.go
-@@ -95,6 +95,7 @@ func (r *FrontProxyClientCertificate) mutate(ctx context.Context, tenantControlP
- 		}
- 
- 		r.resource.SetLabels(utilities.MergeMaps(
-+			r.resource.GetLabels(),
- 			utilities.KamajiLabels(tenantControlPlane.GetName(), r.GetName()),
- 			map[string]string{
- 				constants.ControllerLabelResource: "x509",
-diff --git a/internal/resources/front_proxy_ca_certificate.go b/internal/resources/front_proxy_ca_certificate.go
-index d410720..ccadc70 100644
---- a/internal/resources/front_proxy_ca_certificate.go
-+++ b/internal/resources/front_proxy_ca_certificate.go
-@@ -114,7 +114,7 @@ func (r *FrontProxyCACertificate) mutate(ctx context.Context, tenantControlPlane
- 			kubeadmconstants.FrontProxyCAKeyName:  ca.PrivateKey,
- 		}
- 
--		r.resource.SetLabels(utilities.KamajiLabels(tenantControlPlane.GetName(), r.GetName()))
-+		r.resource.SetLabels(utilities.MergeMaps(r.resource.GetLabels(), utilities.KamajiLabels(tenantControlPlane.GetName(), r.GetName())))
- 
- 		utilities.SetObjectChecksum(r.resource, r.resource.Data)
- 
-diff --git a/internal/resources/k8s_ingress_resource.go b/internal/resources/k8s_ingress_resource.go
-index f2e014f..e1aef59 100644
---- a/internal/resources/k8s_ingress_resource.go
-+++ b/internal/resources/k8s_ingress_resource.go
-@@ -147,7 +147,7 @@ func (r *KubernetesIngressResource) Define(_ context.Context, tenantControlPlane
- 
- func (r *KubernetesIngressResource) mutate(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
- 	return func() error {
--		labels := utilities.MergeMaps(utilities.KamajiLabels(tenantControlPlane.GetName(), r.GetName()), tenantControlPlane.Spec.ControlPlane.Ingress.AdditionalMetadata.Labels)
-+		labels := utilities.MergeMaps(r.resource.GetLabels(), utilities.KamajiLabels(tenantControlPlane.GetName(), r.GetName()), tenantControlPlane.Spec.ControlPlane.Ingress.AdditionalMetadata.Labels)
- 		r.resource.SetLabels(labels)
- 
- 		annotations := utilities.MergeMaps(r.resource.GetAnnotations(), tenantControlPlane.Spec.ControlPlane.Ingress.AdditionalMetadata.Annotations)
-diff --git a/internal/resources/k8s_service_resource.go b/internal/resources/k8s_service_resource.go
-index 7e7f11f..9c30145 100644
---- a/internal/resources/k8s_service_resource.go
-+++ b/internal/resources/k8s_service_resource.go
-@@ -76,7 +76,12 @@ func (r *KubernetesServiceResource) mutate(ctx context.Context, tenantControlPla
- 	address, _ := tenantControlPlane.DeclaredControlPlaneAddress(ctx, r.Client)
- 
- 	return func() error {
--		labels := utilities.MergeMaps(utilities.KamajiLabels(tenantControlPlane.GetName(), r.GetName()), tenantControlPlane.Spec.ControlPlane.Service.AdditionalMetadata.Labels)
-+		labels := utilities.MergeMaps(
-+			r.resource.GetLabels(),
-+			utilities.KamajiLabels(
-+				tenantControlPlane.GetName(), r.GetName()),
-+			tenantControlPlane.Spec.ControlPlane.Service.AdditionalMetadata.Labels,
-+		)
- 		r.resource.SetLabels(labels)
- 
- 		annotations := utilities.MergeMaps(r.resource.GetAnnotations(), tenantControlPlane.Spec.ControlPlane.Service.AdditionalMetadata.Annotations)
-diff --git a/internal/resources/kubeadm_config.go b/internal/resources/kubeadm_config.go
-index ae4cfc0..98dc36d 100644
---- a/internal/resources/kubeadm_config.go
-+++ b/internal/resources/kubeadm_config.go
-@@ -89,7 +89,7 @@ func (r *KubeadmConfigResource) mutate(ctx context.Context, tenantControlPlane *
- 			return err
- 		}
- 
--		r.resource.SetLabels(utilities.KamajiLabels(tenantControlPlane.GetName(), r.GetName()))
-+		r.resource.SetLabels(utilities.MergeMaps(r.resource.GetLabels(), utilities.KamajiLabels(tenantControlPlane.GetName(), r.GetName())))
- 
- 		params := kubeadm.Parameters{
- 			TenantControlPlaneAddress:       address,
-diff --git a/internal/resources/kubeconfig.go b/internal/resources/kubeconfig.go
-index a87da7f..bd77676 100644
---- a/internal/resources/kubeconfig.go
-+++ b/internal/resources/kubeconfig.go
-@@ -163,6 +163,7 @@ func (r *KubeconfigResource) mutate(ctx context.Context, tenantControlPlane *kam
- 		}
- 
- 		r.resource.SetLabels(utilities.MergeMaps(
-+			r.resource.GetLabels(),
- 			utilities.KamajiLabels(tenantControlPlane.GetName(), r.GetName()),
- 			map[string]string{
- 				constants.ControllerLabelResource: "kubeconfig",
-diff --git a/internal/resources/sa_certificate.go b/internal/resources/sa_certificate.go
-index b53c7b0..4001eca 100644
---- a/internal/resources/sa_certificate.go
-+++ b/internal/resources/sa_certificate.go
-@@ -113,7 +113,7 @@ func (r *SACertificate) mutate(ctx context.Context, tenantControlPlane *kamajiv1
- 			kubeadmconstants.ServiceAccountPrivateKeyName: sa.PrivateKey,
- 		}
- 
--		r.resource.SetLabels(utilities.KamajiLabels(tenantControlPlane.GetName(), r.GetName()))
-+		r.resource.SetLabels(utilities.MergeMaps(r.resource.GetLabels(), utilities.KamajiLabels(tenantControlPlane.GetName(), r.GetName())))
- 
- 		utilities.SetObjectChecksum(r.resource, r.resource.Data)
- 
diff --git a/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff b/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff
index 0d28b780..b003e791 100644
--- a/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff
+++ b/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff
@@ -1,20 +1,21 @@
 diff --git a/cmd/manager/cmd.go b/cmd/manager/cmd.go
-index 9a24d4e..a03a4e0 100644
+index 0b77322..4c40e8d 100644
 --- a/cmd/manager/cmd.go
 +++ b/cmd/manager/cmd.go
-@@ -31,7 +31,6 @@ import (
+@@ -34,7 +34,6 @@ import (
  	"github.com/clastix/kamaji/controllers/soot"
  	"github.com/clastix/kamaji/internal"
  	"github.com/clastix/kamaji/internal/builders/controlplane"
 -	datastoreutils "github.com/clastix/kamaji/internal/datastore/utils"
+ 	"github.com/clastix/kamaji/internal/utilities"
  	"github.com/clastix/kamaji/internal/webhook"
  	"github.com/clastix/kamaji/internal/webhook/handlers"
- 	"github.com/clastix/kamaji/internal/webhook/routes"
-@@ -80,10 +79,6 @@ func NewCmd(scheme *runtime.Scheme) *cobra.Command {
+@@ -86,11 +85,6 @@ func NewCmd(scheme *runtime.Scheme) *cobra.Command {
+ 			if webhookCABundle, err = os.ReadFile(webhookCAPath); err != nil {
  				return fmt.Errorf("unable to read webhook CA: %w", err)
  			}
- 
--			if err = datastoreutils.CheckExists(ctx, scheme, datastore); err != nil {
+-
+-			if err = datastoreutils.CheckExists(context.Background(), scheme, datastore); err != nil {
 -				return err
 -			}
 -

From 7a5eb76b6a79022d55393105748998c5fee01318 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 19 Feb 2026 15:58:42 +0300
Subject: [PATCH 116/666] [kubernetes] Update supported versions to v1.30-v1.35

Update Kubernetes version matrix to match Talos 1.12 support range:
- Add v1.35.0 (latest) and v1.34.4
- Update existing patch versions (v1.33.8, v1.32.12)
- Drop EOL versions v1.28 and v1.29
- Set default version to v1.35

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/apps/kubernetes/Makefile                     | 2 +-
 packages/apps/kubernetes/README.md                    | 2 +-
 packages/apps/kubernetes/files/versions.yaml          | 8 ++++----
 packages/apps/kubernetes/values.schema.json           | 8 ++++----
 packages/apps/kubernetes/values.yaml                  | 6 +++---
 packages/system/kubernetes-rd/cozyrds/kubernetes.yaml | 2 +-
 6 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/packages/apps/kubernetes/Makefile b/packages/apps/kubernetes/Makefile
index e6ed7c6f..48bdc33d 100644
--- a/packages/apps/kubernetes/Makefile
+++ b/packages/apps/kubernetes/Makefile
@@ -1,4 +1,4 @@
-KUBERNETES_VERSION = v1.33
+KUBERNETES_VERSION = v1.35
 KUBERNETES_PKG_TAG = $(shell awk '$$1 == "version:" {print $$2}' Chart.yaml)
 
 include ../../../hack/common-envs.mk
diff --git a/packages/apps/kubernetes/README.md b/packages/apps/kubernetes/README.md
index b2fe102f..d62d3a39 100644
--- a/packages/apps/kubernetes/README.md
+++ b/packages/apps/kubernetes/README.md
@@ -104,7 +104,7 @@ See the reference for components utilized in this service:
 | `nodeGroups[name].resources.memory` | Memory (RAM) available.                                                                        | `quantity`          | `""`        |
 | `nodeGroups[name].gpus`             | List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).                            | `[]object`          | `[]`        |
 | `nodeGroups[name].gpus[i].name`     | Name of GPU, such as "nvidia.com/AD102GL_L40S".                                                | `string`            | `""`        |
-| `version`                           | Kubernetes major.minor version to deploy                                                       | `string`            | `v1.33`     |
+| `version`                           | Kubernetes major.minor version to deploy                                                       | `string`            | `v1.35`     |
 | `host`                              | External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty. | `string`            | `""`        |
 
 
diff --git a/packages/apps/kubernetes/files/versions.yaml b/packages/apps/kubernetes/files/versions.yaml
index 51a36034..f0c190f3 100644
--- a/packages/apps/kubernetes/files/versions.yaml
+++ b/packages/apps/kubernetes/files/versions.yaml
@@ -1,6 +1,6 @@
-"v1.33": "v1.33.0"
-"v1.32": "v1.32.10"
+"v1.35": "v1.35.0"
+"v1.34": "v1.34.4"
+"v1.33": "v1.33.8"
+"v1.32": "v1.32.12"
 "v1.31": "v1.31.14"
 "v1.30": "v1.30.14"
-"v1.29": "v1.29.15"
-"v1.28": "v1.28.15"
diff --git a/packages/apps/kubernetes/values.schema.json b/packages/apps/kubernetes/values.schema.json
index 1f6c9361..15f600a8 100644
--- a/packages/apps/kubernetes/values.schema.json
+++ b/packages/apps/kubernetes/values.schema.json
@@ -621,14 +621,14 @@
     "version": {
       "description": "Kubernetes major.minor version to deploy",
       "type": "string",
-      "default": "v1.33",
+      "default": "v1.35",
       "enum": [
+        "v1.35",
+        "v1.34",
         "v1.33",
         "v1.32",
         "v1.31",
-        "v1.30",
-        "v1.29",
-        "v1.28"
+        "v1.30"
       ]
     }
   }
diff --git a/packages/apps/kubernetes/values.yaml b/packages/apps/kubernetes/values.yaml
index 7f15752f..a67b5d69 100644
--- a/packages/apps/kubernetes/values.yaml
+++ b/packages/apps/kubernetes/values.yaml
@@ -48,15 +48,15 @@ nodeGroups:
 
 ##
 ## @enum {string} Version
+## @value v1.35
+## @value v1.34
 ## @value v1.33
 ## @value v1.32
 ## @value v1.31
 ## @value v1.30
-## @value v1.29
-## @value v1.28
 
 ## @param {Version} version - Kubernetes major.minor version to deploy
-version: "v1.33"
+version: "v1.35"
 
 
 ## @param {string} host - External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.
diff --git a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
index 1b4c7361..9ed813f6 100644
--- a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
+++ b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
@@ -8,7 +8,7 @@ spec:
     singular: kubernetes
     plural: kuberneteses
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"addons":{"description":"Cluster addons configuration.","type":"object","default":{},"required":["certManager","cilium","coredns","fluxcd","gatewayAPI","gpuOperator","ingressNginx","monitoringAgents","velero","verticalPodAutoscaler"],"properties":{"certManager":{"description":"Cert-manager addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable cert-manager.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"cilium":{"description":"Cilium CNI plugin.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"coredns":{"description":"CoreDNS addon.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"fluxcd":{"description":"FluxCD GitOps operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable FluxCD.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"gatewayAPI":{"description":"Gateway API addon.","type":"object","default":{},"required":["enabled"],"properties":{"enabled":{"description":"Enable Gateway API.","type":"boolean","default":false}}},"gpuOperator":{"description":"NVIDIA GPU Operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable GPU Operator.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"ingressNginx":{"description":"Ingress-NGINX controller.","type":"object","default":{},"required":["enabled","exposeMethod","valuesOverride"],"properties":{"enabled":{"description":"Enable the controller (requires nodes labeled `ingress-nginx`).","type":"boolean","default":false},"exposeMethod":{"description":"Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.","type":"string","default":"Proxied","enum":["Proxied","LoadBalancer"]},"hosts":{"description":"Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.","type":"array","default":[],"items":{"type":"string"}},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"monitoringAgents":{"description":"Monitoring agents.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable monitoring agents.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"velero":{"description":"Velero backup/restore addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable Velero.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"verticalPodAutoscaler":{"description":"Vertical Pod Autoscaler.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}}}},"controlPlane":{"description":"Kubernetes control-plane configuration.","type":"object","default":{},"required":["apiServer","controllerManager","konnectivity","replicas","scheduler"],"properties":{"apiServer":{"description":"API Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for API Server.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"controllerManager":{"description":"Controller Manager configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Controller Manager.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"konnectivity":{"description":"Konnectivity configuration.","type":"object","default":{},"required":["server"],"properties":{"server":{"description":"Konnectivity Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Konnectivity.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"replicas":{"description":"Number of control-plane replicas.","type":"integer","default":2},"scheduler":{"description":"Scheduler configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Scheduler.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"host":{"description":"External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.","type":"string","default":""},"nodeGroups":{"description":"Worker nodes configuration map.","type":"object","default":{"md0":{"ephemeralStorage":"20Gi","gpus":[],"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":["ingress-nginx"]}},"additionalProperties":{"type":"object","required":["ephemeralStorage","instanceType","maxReplicas","minReplicas","resources"],"properties":{"ephemeralStorage":{"description":"Ephemeral storage size.","default":"20Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"description":"Name of GPU, such as \"nvidia.com/AD102GL_L40S\".","type":"string"}}}},"instanceType":{"description":"Virtual machine instance type.","type":"string","default":"u1.medium"},"maxReplicas":{"description":"Maximum number of replicas.","type":"integer","default":10},"minReplicas":{"description":"Minimum number of replicas.","type":"integer","default":0},"resources":{"description":"CPU and memory resources for each worker node.","type":"object","properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"roles":{"description":"List of node roles.","type":"array","items":{"type":"string"}}}}},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"},"version":{"description":"Kubernetes major.minor version to deploy","type":"string","default":"v1.33","enum":["v1.33","v1.32","v1.31","v1.30","v1.29","v1.28"]}}}
+      {"title":"Chart Values","type":"object","properties":{"addons":{"description":"Cluster addons configuration.","type":"object","default":{},"required":["certManager","cilium","coredns","fluxcd","gatewayAPI","gpuOperator","ingressNginx","monitoringAgents","velero","verticalPodAutoscaler"],"properties":{"certManager":{"description":"Cert-manager addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable cert-manager.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"cilium":{"description":"Cilium CNI plugin.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"coredns":{"description":"CoreDNS addon.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"fluxcd":{"description":"FluxCD GitOps operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable FluxCD.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"gatewayAPI":{"description":"Gateway API addon.","type":"object","default":{},"required":["enabled"],"properties":{"enabled":{"description":"Enable Gateway API.","type":"boolean","default":false}}},"gpuOperator":{"description":"NVIDIA GPU Operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable GPU Operator.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"ingressNginx":{"description":"Ingress-NGINX controller.","type":"object","default":{},"required":["enabled","exposeMethod","valuesOverride"],"properties":{"enabled":{"description":"Enable the controller (requires nodes labeled `ingress-nginx`).","type":"boolean","default":false},"exposeMethod":{"description":"Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.","type":"string","default":"Proxied","enum":["Proxied","LoadBalancer"]},"hosts":{"description":"Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.","type":"array","default":[],"items":{"type":"string"}},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"monitoringAgents":{"description":"Monitoring agents.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable monitoring agents.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"velero":{"description":"Velero backup/restore addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable Velero.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"verticalPodAutoscaler":{"description":"Vertical Pod Autoscaler.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}}}},"controlPlane":{"description":"Kubernetes control-plane configuration.","type":"object","default":{},"required":["apiServer","controllerManager","konnectivity","replicas","scheduler"],"properties":{"apiServer":{"description":"API Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for API Server.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"controllerManager":{"description":"Controller Manager configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Controller Manager.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"konnectivity":{"description":"Konnectivity configuration.","type":"object","default":{},"required":["server"],"properties":{"server":{"description":"Konnectivity Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Konnectivity.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"replicas":{"description":"Number of control-plane replicas.","type":"integer","default":2},"scheduler":{"description":"Scheduler configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Scheduler.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"host":{"description":"External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.","type":"string","default":""},"nodeGroups":{"description":"Worker nodes configuration map.","type":"object","default":{"md0":{"ephemeralStorage":"20Gi","gpus":[],"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":["ingress-nginx"]}},"additionalProperties":{"type":"object","required":["ephemeralStorage","instanceType","maxReplicas","minReplicas","resources"],"properties":{"ephemeralStorage":{"description":"Ephemeral storage size.","default":"20Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"description":"Name of GPU, such as \"nvidia.com/AD102GL_L40S\".","type":"string"}}}},"instanceType":{"description":"Virtual machine instance type.","type":"string","default":"u1.medium"},"maxReplicas":{"description":"Maximum number of replicas.","type":"integer","default":10},"minReplicas":{"description":"Minimum number of replicas.","type":"integer","default":0},"resources":{"description":"CPU and memory resources for each worker node.","type":"object","properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"roles":{"description":"List of node roles.","type":"array","items":{"type":"string"}}}}},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"},"version":{"description":"Kubernetes major.minor version to deploy","type":"string","default":"v1.35","enum":["v1.35","v1.34","v1.33","v1.32","v1.31","v1.30"]}}}
   release:
     prefix: kubernetes-
     labels:

From 668ddc552ece9bf2406a30be323c1047d4667b85 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 19 Feb 2026 17:23:37 +0300
Subject: [PATCH 117/666] refactor(installer): remove CRDs from Helm chart,
 rely on operator --install-crds

Remove the crds/ directory from the cozy-installer Helm chart. The operator
already installs embedded CRDs via server-side apply on every startup with
the --install-crds=true flag, making the Helm crds/ directory redundant.

Convert templates/packagesource.yaml to a Helm post-install/post-upgrade
hook so it is applied after the operator has started and installed CRDs.

Update codegen to write CRDs only to internal/crdinstall/manifests/ (single
source of truth) and update the Makefile to source build assets from there.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 Makefile                                      |  22 +-
 hack/update-codegen.sh                        |   6 +-
 packages/core/installer/crds/.gitattributes   |   1 -
 .../installer/crds/cozystack.io_packages.yaml | 171 ------------
 .../crds/cozystack.io_packagesources.yaml     | 250 ------------------
 .../templates/cozystack-operator.yaml         |   7 +-
 .../installer/templates/packagesource.yaml    |   2 +
 7 files changed, 15 insertions(+), 444 deletions(-)
 delete mode 100644 packages/core/installer/crds/.gitattributes
 delete mode 100644 packages/core/installer/crds/cozystack.io_packages.yaml
 delete mode 100644 packages/core/installer/crds/cozystack.io_packagesources.yaml

diff --git a/Makefile b/Makefile
index 73bd0bea..226ee9d0 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: manifests assets unit-tests helm-unit-tests verify-crds
+.PHONY: manifests assets unit-tests helm-unit-tests
 
 include hack/common-envs.mk
 
@@ -38,24 +38,24 @@ build: build-deps
 
 manifests:
 	mkdir -p _out/assets
-	cat packages/core/installer/crds/*.yaml > _out/assets/cozystack-crds.yaml
+	cat internal/crdinstall/manifests/*.yaml > _out/assets/cozystack-crds.yaml
 	# Talos variant (default)
 	helm template installer packages/core/installer -n cozy-system \
-		-s templates/cozystack-operator.yaml \
-		-s templates/packagesource.yaml \
+		--show-only templates/cozystack-operator.yaml \
+		--show-only templates/packagesource.yaml \
 		> _out/assets/cozystack-operator-talos.yaml
 	# Generic Kubernetes variant (k3s, kubeadm, RKE2)
 	helm template installer packages/core/installer -n cozy-system \
 		--set cozystackOperator.variant=generic \
 		--set cozystack.apiServerHost=REPLACE_ME \
-		-s templates/cozystack-operator.yaml \
-		-s templates/packagesource.yaml \
+		--show-only templates/cozystack-operator.yaml \
+		--show-only templates/packagesource.yaml \
 		> _out/assets/cozystack-operator-generic.yaml
 	# Hosted variant (managed Kubernetes)
 	helm template installer packages/core/installer -n cozy-system \
 		--set cozystackOperator.variant=hosted \
-		-s templates/cozystack-operator.yaml \
-		-s templates/packagesource.yaml \
+		--show-only templates/cozystack-operator.yaml \
+		--show-only templates/packagesource.yaml \
 		> _out/assets/cozystack-operator-hosted.yaml
 
 cozypkg:
@@ -80,11 +80,7 @@ test:
 	make -C packages/core/testing apply
 	make -C packages/core/testing test
 
-verify-crds:
-	@diff --recursive packages/core/installer/crds/ internal/crdinstall/manifests/ --exclude='.*' \
-		|| (echo "ERROR: CRD manifests out of sync. Run 'make generate' to fix." && exit 1)
-
-unit-tests: helm-unit-tests verify-crds
+unit-tests: helm-unit-tests
 
 helm-unit-tests:
 	hack/helm-unit-tests.sh
diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh
index b7f96691..6a6fc3be 100755
--- a/hack/update-codegen.sh
+++ b/hack/update-codegen.sh
@@ -24,8 +24,7 @@ API_KNOWN_VIOLATIONS_DIR="${API_KNOWN_VIOLATIONS_DIR:-"${SCRIPT_ROOT}/api/api-ru
 UPDATE_API_KNOWN_VIOLATIONS="${UPDATE_API_KNOWN_VIOLATIONS:-true}"
 CONTROLLER_GEN="go run sigs.k8s.io/controller-tools/cmd/controller-gen@v0.16.4"
 TMPDIR=$(mktemp -d)
-OPERATOR_CRDDIR=packages/core/installer/crds
-OPERATOR_EMBEDDIR=internal/crdinstall/manifests
+OPERATOR_CRDDIR=internal/crdinstall/manifests
 COZY_CONTROLLER_CRDDIR=packages/system/cozystack-controller/definitions
 COZY_RD_CRDDIR=packages/system/application-definition-crd/definition
 BACKUPS_CORE_CRDDIR=packages/system/backup-controller/definitions
@@ -74,9 +73,6 @@ $CONTROLLER_GEN rbac:roleName=manager-role crd paths="./api/..." output:crd:arti
 mv ${TMPDIR}/cozystack.io_packages.yaml ${OPERATOR_CRDDIR}/cozystack.io_packages.yaml
 mv ${TMPDIR}/cozystack.io_packagesources.yaml ${OPERATOR_CRDDIR}/cozystack.io_packagesources.yaml
 
-cp ${OPERATOR_CRDDIR}/cozystack.io_packages.yaml ${OPERATOR_EMBEDDIR}/cozystack.io_packages.yaml
-cp ${OPERATOR_CRDDIR}/cozystack.io_packagesources.yaml ${OPERATOR_EMBEDDIR}/cozystack.io_packagesources.yaml
-
 mv ${TMPDIR}/cozystack.io_applicationdefinitions.yaml \
         ${COZY_RD_CRDDIR}/cozystack.io_applicationdefinitions.yaml
 
diff --git a/packages/core/installer/crds/.gitattributes b/packages/core/installer/crds/.gitattributes
deleted file mode 100644
index f581feca..00000000
--- a/packages/core/installer/crds/.gitattributes
+++ /dev/null
@@ -1 +0,0 @@
-*.yaml linguist-generated
diff --git a/packages/core/installer/crds/cozystack.io_packages.yaml b/packages/core/installer/crds/cozystack.io_packages.yaml
deleted file mode 100644
index cb7e2763..00000000
--- a/packages/core/installer/crds/cozystack.io_packages.yaml
+++ /dev/null
@@ -1,171 +0,0 @@
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.4
-  name: packages.cozystack.io
-spec:
-  group: cozystack.io
-  names:
-    kind: Package
-    listKind: PackageList
-    plural: packages
-    shortNames:
-    - pkg
-    - pkgs
-    singular: package
-  scope: Cluster
-  versions:
-  - additionalPrinterColumns:
-    - description: Selected variant
-      jsonPath: .spec.variant
-      name: Variant
-      type: string
-    - description: Ready status
-      jsonPath: .status.conditions[?(@.type=='Ready')].status
-      name: Ready
-      type: string
-    - description: Ready message
-      jsonPath: .status.conditions[?(@.type=='Ready')].message
-      name: Status
-      type: string
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: Package is the Schema for the packages API
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: PackageSpec defines the desired state of Package
-            properties:
-              components:
-                additionalProperties:
-                  description: PackageComponent defines overrides for a specific component
-                  properties:
-                    enabled:
-                      description: |-
-                        Enabled indicates whether this component should be installed
-                        If false, the component will be disabled even if it's defined in the PackageSource
-                      type: boolean
-                    values:
-                      description: |-
-                        Values contains Helm chart values as a JSON object
-                        These values will be merged with the default values from the PackageSource
-                      x-kubernetes-preserve-unknown-fields: true
-                  type: object
-                description: |-
-                  Components is a map of release name to component overrides
-                  Allows overriding values and enabling/disabling specific components from the PackageSource
-                type: object
-              ignoreDependencies:
-                description: |-
-                  IgnoreDependencies is a list of package source dependencies to ignore
-                  Dependencies listed here will not be installed even if they are specified in the PackageSource
-                items:
-                  type: string
-                type: array
-              variant:
-                description: |-
-                  Variant is the name of the variant to use from the PackageSource
-                  If not specified, defaults to "default"
-                type: string
-            type: object
-          status:
-            description: PackageStatus defines the observed state of Package
-            properties:
-              conditions:
-                description: Conditions represents the latest available observations
-                  of a Package's state
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-              dependencies:
-                additionalProperties:
-                  description: DependencyStatus represents the readiness status of
-                    a dependency
-                  properties:
-                    ready:
-                      description: Ready indicates whether the dependency is ready
-                      type: boolean
-                  required:
-                  - ready
-                  type: object
-                description: |-
-                  Dependencies tracks the readiness status of each dependency
-                  Key is the dependency package name, value indicates if the dependency is ready
-                type: object
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
diff --git a/packages/core/installer/crds/cozystack.io_packagesources.yaml b/packages/core/installer/crds/cozystack.io_packagesources.yaml
deleted file mode 100644
index 0acfcdd2..00000000
--- a/packages/core/installer/crds/cozystack.io_packagesources.yaml
+++ /dev/null
@@ -1,250 +0,0 @@
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.4
-  name: packagesources.cozystack.io
-spec:
-  group: cozystack.io
-  names:
-    kind: PackageSource
-    listKind: PackageSourceList
-    plural: packagesources
-    shortNames:
-    - pks
-    singular: packagesource
-  scope: Cluster
-  versions:
-  - additionalPrinterColumns:
-    - description: Package variants (comma-separated)
-      jsonPath: .status.variants
-      name: Variants
-      type: string
-    - description: Ready status
-      jsonPath: .status.conditions[?(@.type=='Ready')].status
-      name: Ready
-      type: string
-    - description: Ready message
-      jsonPath: .status.conditions[?(@.type=='Ready')].message
-      name: Status
-      type: string
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: PackageSource is the Schema for the packagesources API
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: PackageSourceSpec defines the desired state of PackageSource
-            properties:
-              sourceRef:
-                description: SourceRef is the source reference for the package source
-                  charts
-                properties:
-                  kind:
-                    description: Kind of the source reference
-                    enum:
-                    - GitRepository
-                    - OCIRepository
-                    type: string
-                  name:
-                    description: Name of the source reference
-                    type: string
-                  namespace:
-                    description: Namespace of the source reference
-                    type: string
-                  path:
-                    description: |-
-                      Path is the base path where packages are located in the source.
-                      For GitRepository, defaults to "packages" if not specified.
-                      For OCIRepository, defaults to empty string (root) if not specified.
-                    type: string
-                required:
-                - kind
-                - name
-                - namespace
-                type: object
-              variants:
-                description: |-
-                  Variants is a list of package source variants
-                  Each variant defines components, applications, dependencies, and libraries for a specific configuration
-                items:
-                  description: Variant defines a single variant configuration
-                  properties:
-                    components:
-                      description: Components is a list of Helm releases to be installed
-                        as part of this variant
-                      items:
-                        description: Component defines a single Helm release component
-                          within a package source
-                        properties:
-                          install:
-                            description: Install defines installation parameters for
-                              this component
-                            properties:
-                              dependsOn:
-                                description: DependsOn is a list of component names
-                                  that must be installed before this component
-                                items:
-                                  type: string
-                                type: array
-                              namespace:
-                                description: Namespace is the Kubernetes namespace
-                                  where the release will be installed
-                                type: string
-                              privileged:
-                                description: Privileged indicates whether this release
-                                  requires privileged access
-                                type: boolean
-                              releaseName:
-                                description: |-
-                                  ReleaseName is the name of the HelmRelease resource that will be created
-                                  If not specified, defaults to the component Name field
-                                type: string
-                            type: object
-                          libraries:
-                            description: |-
-                              Libraries is a list of library names that this component depends on
-                              These libraries must be defined at the variant level
-                            items:
-                              type: string
-                            type: array
-                          name:
-                            description: Name is the unique identifier for this component
-                              within the package source
-                            type: string
-                          path:
-                            description: Path is the path to the Helm chart directory
-                            type: string
-                          valuesFiles:
-                            description: ValuesFiles is a list of values file names
-                              to use
-                            items:
-                              type: string
-                            type: array
-                        required:
-                        - name
-                        - path
-                        type: object
-                      type: array
-                    dependsOn:
-                      description: |-
-                        DependsOn is a list of package source dependencies
-                        For example: "cozystack.networking"
-                      items:
-                        type: string
-                      type: array
-                    libraries:
-                      description: Libraries is a list of Helm library charts used
-                        by components in this variant
-                      items:
-                        description: Library defines a Helm library chart
-                        properties:
-                          name:
-                            description: Name is the optional name for library placed
-                              in charts
-                            type: string
-                          path:
-                            description: Path is the path to the library chart directory
-                            type: string
-                        required:
-                        - path
-                        type: object
-                      type: array
-                    name:
-                      description: Name is the unique identifier for this variant
-                      type: string
-                  required:
-                  - name
-                  type: object
-                type: array
-            type: object
-          status:
-            description: PackageSourceStatus defines the observed state of PackageSource
-            properties:
-              conditions:
-                description: Conditions represents the latest available observations
-                  of a PackageSource's state
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-              variants:
-                description: |-
-                  Variants is a comma-separated list of package variant names
-                  This field is populated by the controller based on spec.variants keys
-                type: string
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
diff --git a/packages/core/installer/templates/cozystack-operator.yaml b/packages/core/installer/templates/cozystack-operator.yaml
index 5cd471cf..b33d186a 100644
--- a/packages/core/installer/templates/cozystack-operator.yaml
+++ b/packages/core/installer/templates/cozystack-operator.yaml
@@ -53,10 +53,9 @@ spec:
         args:
         - --leader-elect=true
         - --install-flux=true
-        # CRDs are also in crds/ for initial helm install, but Helm never updates
-        # them on upgrade and never deletes them on uninstall. The operator applies
-        # embedded CRDs via server-side apply on every startup, ensuring they stay
-        # up to date. To fully remove CRDs, delete them manually after helm uninstall.
+        # The operator applies embedded CRDs via server-side apply on every
+        # startup, ensuring they stay up to date.
+        # To fully remove CRDs, delete them manually after helm uninstall.
         - --install-crds=true
         - --metrics-bind-address=0
         - --health-probe-bind-address=0
diff --git a/packages/core/installer/templates/packagesource.yaml b/packages/core/installer/templates/packagesource.yaml
index 65b1e4bf..daaf7eb8 100644
--- a/packages/core/installer/templates/packagesource.yaml
+++ b/packages/core/installer/templates/packagesource.yaml
@@ -8,6 +8,8 @@ kind: PackageSource
 metadata:
   name: cozystack.cozystack-platform
   annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation
     operator.cozystack.io/skip-cozystack-values: "true"
 spec:
   sourceRef:

From 655133b81cf8a66fd3519704fdac129d52d9fce2 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 19 Feb 2026 17:38:23 +0300
Subject: [PATCH 118/666] fix(installer): move PackageSource creation from Helm
 template to operator

Replace the Helm hook approach with programmatic PackageSource creation
in the operator startup sequence. Helm hooks are unsuitable for persistent
resources like PackageSource because before-hook-creation policy causes
cascade deletion of owned ArtifactGenerators during upgrades.

The operator now creates the platform PackageSource after installing CRDs
and the Flux source resource, using the same create-or-update pattern as
installPlatformSourceResource(). The sourceRef.kind is derived from the
platform source URL (OCIRepository for oci://, GitRepository for git).

Also fix stale comment in e2e test referencing deleted crds/ directory.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 Makefile                                      |   3 -
 cmd/cozystack-operator/main.go                | 126 ++++++++++++++++++
 hack/e2e-install-cozystack.bats               |   2 +-
 .../installer/templates/packagesource.yaml    |  59 --------
 4 files changed, 127 insertions(+), 63 deletions(-)
 delete mode 100644 packages/core/installer/templates/packagesource.yaml

diff --git a/Makefile b/Makefile
index 226ee9d0..ca48197c 100644
--- a/Makefile
+++ b/Makefile
@@ -42,20 +42,17 @@ manifests:
 	# Talos variant (default)
 	helm template installer packages/core/installer -n cozy-system \
 		--show-only templates/cozystack-operator.yaml \
-		--show-only templates/packagesource.yaml \
 		> _out/assets/cozystack-operator-talos.yaml
 	# Generic Kubernetes variant (k3s, kubeadm, RKE2)
 	helm template installer packages/core/installer -n cozy-system \
 		--set cozystackOperator.variant=generic \
 		--set cozystack.apiServerHost=REPLACE_ME \
 		--show-only templates/cozystack-operator.yaml \
-		--show-only templates/packagesource.yaml \
 		> _out/assets/cozystack-operator-generic.yaml
 	# Hosted variant (managed Kubernetes)
 	helm template installer packages/core/installer -n cozy-system \
 		--set cozystackOperator.variant=hosted \
 		--show-only templates/cozystack-operator.yaml \
-		--show-only templates/packagesource.yaml \
 		> _out/assets/cozystack-operator-hosted.yaml
 
 cozypkg:
diff --git a/cmd/cozystack-operator/main.go b/cmd/cozystack-operator/main.go
index d3c40f7e..ba5730e2 100644
--- a/cmd/cozystack-operator/main.go
+++ b/cmd/cozystack-operator/main.go
@@ -222,6 +222,20 @@ func main() {
 		} else {
 			setupLog.Info("Platform source resource installation completed successfully")
 		}
+
+		// Create platform PackageSource that references the source resource
+		setupLog.Info("Creating platform PackageSource", "platformSourceName", platformSourceName)
+		sourceType, _, _ := parsePlatformSourceURL(platformSourceURL)
+		sourceRefKind := "OCIRepository"
+		if sourceType == "git" {
+			sourceRefKind = "GitRepository"
+		}
+		if err := installPlatformPackageSource(installCtx, directClient, platformSourceName, sourceRefKind); err != nil {
+			setupLog.Error(err, "failed to create platform PackageSource")
+			os.Exit(1)
+		} else {
+			setupLog.Info("Platform PackageSource creation completed successfully")
+		}
 	}
 
 	// Setup PackageSource reconciler
@@ -552,3 +566,115 @@ func generateGitRepository(name, repoURL string, refMap map[string]string) (*sou
 
 	return obj, nil
 }
+
+// installPlatformPackageSource creates the platform PackageSource resource
+// that references the Flux source resource (OCIRepository or GitRepository).
+func installPlatformPackageSource(ctx context.Context, k8sClient client.Client, platformSourceName, sourceRefKind string) error {
+	logger := log.FromContext(ctx)
+
+	packageSourceName := "cozystack." + platformSourceName
+
+	ps := &cozyv1alpha1.PackageSource{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: cozyv1alpha1.GroupVersion.String(),
+			Kind:       "PackageSource",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name: packageSourceName,
+			Annotations: map[string]string{
+				"operator.cozystack.io/skip-cozystack-values": "true",
+			},
+		},
+		Spec: cozyv1alpha1.PackageSourceSpec{
+			SourceRef: &cozyv1alpha1.PackageSourceRef{
+				Kind:      sourceRefKind,
+				Name:      platformSourceName,
+				Namespace: "cozy-system",
+				Path:      "/",
+			},
+			Variants: []cozyv1alpha1.Variant{
+				{
+					Name: "default",
+					Components: []cozyv1alpha1.Component{
+						{
+							Name: "platform",
+							Path: "core/platform",
+							Install: &cozyv1alpha1.ComponentInstall{
+								Namespace:   "cozy-system",
+								ReleaseName: "cozystack-platform",
+							},
+							ValuesFiles: []string{"values.yaml"},
+						},
+					},
+				},
+				{
+					Name: "isp-full",
+					Components: []cozyv1alpha1.Component{
+						{
+							Name: "platform",
+							Path: "core/platform",
+							Install: &cozyv1alpha1.ComponentInstall{
+								Namespace:   "cozy-system",
+								ReleaseName: "cozystack-platform",
+							},
+							ValuesFiles: []string{"values.yaml", "values-isp-full.yaml"},
+						},
+					},
+				},
+				{
+					Name: "isp-hosted",
+					Components: []cozyv1alpha1.Component{
+						{
+							Name: "platform",
+							Path: "core/platform",
+							Install: &cozyv1alpha1.ComponentInstall{
+								Namespace:   "cozy-system",
+								ReleaseName: "cozystack-platform",
+							},
+							ValuesFiles: []string{"values.yaml", "values-isp-hosted.yaml"},
+						},
+					},
+				},
+				{
+					Name: "isp-full-generic",
+					Components: []cozyv1alpha1.Component{
+						{
+							Name: "platform",
+							Path: "core/platform",
+							Install: &cozyv1alpha1.ComponentInstall{
+								Namespace:   "cozy-system",
+								ReleaseName: "cozystack-platform",
+							},
+							ValuesFiles: []string{"values.yaml", "values-isp-full-generic.yaml"},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	logger.Info("Applying platform PackageSource", "name", packageSourceName)
+
+	existing := &cozyv1alpha1.PackageSource{}
+	key := client.ObjectKeyFromObject(ps)
+
+	err := k8sClient.Get(ctx, key, existing)
+	if err != nil {
+		if client.IgnoreNotFound(err) == nil {
+			if err := k8sClient.Create(ctx, ps); err != nil {
+				return fmt.Errorf("failed to create PackageSource %s: %w", packageSourceName, err)
+			}
+			logger.Info("Created platform PackageSource", "name", packageSourceName)
+		} else {
+			return fmt.Errorf("failed to check if PackageSource exists: %w", err)
+		}
+	} else {
+		ps.SetResourceVersion(existing.GetResourceVersion())
+		if err := k8sClient.Update(ctx, ps); err != nil {
+			return fmt.Errorf("failed to update PackageSource %s: %w", packageSourceName, err)
+		}
+		logger.Info("Updated platform PackageSource", "name", packageSourceName)
+	}
+
+	return nil
+}
diff --git a/hack/e2e-install-cozystack.bats b/hack/e2e-install-cozystack.bats
index 5e518cad..5a705906 100644
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -8,7 +8,7 @@
 }
 
 @test "Install Cozystack" {
-  # Install cozy-installer chart (CRDs from crds/ are applied automatically)
+  # Install cozy-installer chart (operator installs CRDs on startup via --install-crds)
   helm upgrade installer packages/core/installer \
     --install \
     --namespace cozy-system \
diff --git a/packages/core/installer/templates/packagesource.yaml b/packages/core/installer/templates/packagesource.yaml
deleted file mode 100644
index daaf7eb8..00000000
--- a/packages/core/installer/templates/packagesource.yaml
+++ /dev/null
@@ -1,59 +0,0 @@
-{{- $validVariants := list "talos" "generic" "hosted" -}}
-{{- if not (has .Values.cozystackOperator.variant $validVariants) -}}
-{{- fail (printf "Invalid cozystackOperator.variant %q: must be one of talos, generic, hosted" .Values.cozystackOperator.variant) -}}
-{{- end -}}
----
-apiVersion: cozystack.io/v1alpha1
-kind: PackageSource
-metadata:
-  name: cozystack.cozystack-platform
-  annotations:
-    "helm.sh/hook": post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation
-    operator.cozystack.io/skip-cozystack-values: "true"
-spec:
-  sourceRef:
-    kind: OCIRepository
-    name: cozystack-platform
-    namespace: cozy-system
-    path: /
-  variants:
-  - name: default
-    components:
-    - install:
-        namespace: cozy-system
-        releaseName: cozystack-platform
-      name: platform
-      path: core/platform
-      valuesFiles:
-      - values.yaml
-  - name: isp-full
-    components:
-    - install:
-        namespace: cozy-system
-        releaseName: cozystack-platform
-      name: platform
-      path: core/platform
-      valuesFiles:
-      - values.yaml
-      - values-isp-full.yaml
-  - name: isp-hosted
-    components:
-    - install:
-        namespace: cozy-system
-        releaseName: cozystack-platform
-      name: platform
-      path: core/platform
-      valuesFiles:
-      - values.yaml
-      - values-isp-hosted.yaml
-  - name: isp-full-generic
-    components:
-    - install:
-        namespace: cozy-system
-        releaseName: cozystack-platform
-      name: platform
-      path: core/platform
-      valuesFiles:
-      - values.yaml
-      - values-isp-full-generic.yaml

From 0e8b6515afaa0131fbbd9665ebfa5111d602b60c Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 19 Feb 2026 17:42:31 +0300
Subject: [PATCH 119/666] fix(installer): handle parsePlatformSourceURL error,
 restore variant validation

Check error from parsePlatformSourceURL instead of discarding it, preventing
silent fallback to OCIRepository on invalid URLs.

Move variant validation from deleted packagesource.yaml to
cozystack-operator.yaml template so invalid cozystackOperator.variant
values still fail at helm template/install time.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 cmd/cozystack-operator/main.go                            | 6 +++++-
 packages/core/installer/templates/cozystack-operator.yaml | 4 ++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/cmd/cozystack-operator/main.go b/cmd/cozystack-operator/main.go
index ba5730e2..cb19a3d3 100644
--- a/cmd/cozystack-operator/main.go
+++ b/cmd/cozystack-operator/main.go
@@ -225,7 +225,11 @@ func main() {
 
 		// Create platform PackageSource that references the source resource
 		setupLog.Info("Creating platform PackageSource", "platformSourceName", platformSourceName)
-		sourceType, _, _ := parsePlatformSourceURL(platformSourceURL)
+		sourceType, _, err := parsePlatformSourceURL(platformSourceURL)
+		if err != nil {
+			setupLog.Error(err, "failed to parse platform source URL for PackageSource creation")
+			os.Exit(1)
+		}
 		sourceRefKind := "OCIRepository"
 		if sourceType == "git" {
 			sourceRefKind = "GitRepository"
diff --git a/packages/core/installer/templates/cozystack-operator.yaml b/packages/core/installer/templates/cozystack-operator.yaml
index b33d186a..fcd499a8 100644
--- a/packages/core/installer/templates/cozystack-operator.yaml
+++ b/packages/core/installer/templates/cozystack-operator.yaml
@@ -1,3 +1,7 @@
+{{- $validVariants := list "talos" "generic" "hosted" -}}
+{{- if not (has .Values.cozystackOperator.variant $validVariants) -}}
+{{- fail (printf "Invalid cozystackOperator.variant %q: must be one of talos, generic, hosted" .Values.cozystackOperator.variant) -}}
+{{- end -}}
 ---
 apiVersion: v1
 kind: Namespace

From 8450830f06d6c3cd0325c21966a028acd0642334 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 19 Feb 2026 17:50:09 +0300
Subject: [PATCH 120/666] fix(installer): add CRD wait in E2E, unit tests for
 PackageSource creation

Add explicit CRD wait (kubectl wait crd --for=condition=Established) in
E2E test before creating Package resources, preventing race condition
between operator CRD installation and resource creation.

Add unit tests for installPlatformPackageSource covering create, update,
and GitRepository sourceRef kind scenarios.

Document that hardcoded variant list is an intentional design choice
matching the previous Helm template behavior.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 cmd/cozystack-operator/main.go      |   4 +
 cmd/cozystack-operator/main_test.go | 152 ++++++++++++++++++++++++++++
 hack/e2e-install-cozystack.bats     |   4 +
 3 files changed, 160 insertions(+)
 create mode 100644 cmd/cozystack-operator/main_test.go

diff --git a/cmd/cozystack-operator/main.go b/cmd/cozystack-operator/main.go
index cb19a3d3..fb45b96c 100644
--- a/cmd/cozystack-operator/main.go
+++ b/cmd/cozystack-operator/main.go
@@ -573,6 +573,10 @@ func generateGitRepository(name, repoURL string, refMap map[string]string) (*sou
 
 // installPlatformPackageSource creates the platform PackageSource resource
 // that references the Flux source resource (OCIRepository or GitRepository).
+//
+// The variant list is intentionally hardcoded here. These are platform-defined
+// deployment profiles (not user-extensible), matching what was previously in
+// the Helm template. Changes require a new operator build and release.
 func installPlatformPackageSource(ctx context.Context, k8sClient client.Client, platformSourceName, sourceRefKind string) error {
 	logger := log.FromContext(ctx)
 
diff --git a/cmd/cozystack-operator/main_test.go b/cmd/cozystack-operator/main_test.go
new file mode 100644
index 00000000..da1769f2
--- /dev/null
+++ b/cmd/cozystack-operator/main_test.go
@@ -0,0 +1,152 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"context"
+	"testing"
+
+	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+)
+
+func newTestScheme() *runtime.Scheme {
+	s := runtime.NewScheme()
+	_ = cozyv1alpha1.AddToScheme(s)
+	return s
+}
+
+func TestInstallPlatformPackageSource_Creates(t *testing.T) {
+	s := newTestScheme()
+	k8sClient := fake.NewClientBuilder().WithScheme(s).Build()
+
+	err := installPlatformPackageSource(context.Background(), k8sClient, "cozystack-platform", "OCIRepository")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	ps := &cozyv1alpha1.PackageSource{}
+	if err := k8sClient.Get(context.Background(), client.ObjectKey{Name: "cozystack.cozystack-platform"}, ps); err != nil {
+		t.Fatalf("PackageSource not found: %v", err)
+	}
+
+	// Verify name
+	if ps.Name != "cozystack.cozystack-platform" {
+		t.Errorf("expected name %q, got %q", "cozystack.cozystack-platform", ps.Name)
+	}
+
+	// Verify annotation
+	if ps.Annotations["operator.cozystack.io/skip-cozystack-values"] != "true" {
+		t.Errorf("expected skip-cozystack-values annotation to be 'true', got %q", ps.Annotations["operator.cozystack.io/skip-cozystack-values"])
+	}
+
+	// Verify sourceRef
+	if ps.Spec.SourceRef == nil {
+		t.Fatal("expected SourceRef to be set")
+	}
+	if ps.Spec.SourceRef.Kind != "OCIRepository" {
+		t.Errorf("expected sourceRef.kind %q, got %q", "OCIRepository", ps.Spec.SourceRef.Kind)
+	}
+	if ps.Spec.SourceRef.Name != "cozystack-platform" {
+		t.Errorf("expected sourceRef.name %q, got %q", "cozystack-platform", ps.Spec.SourceRef.Name)
+	}
+	if ps.Spec.SourceRef.Namespace != "cozy-system" {
+		t.Errorf("expected sourceRef.namespace %q, got %q", "cozy-system", ps.Spec.SourceRef.Namespace)
+	}
+	if ps.Spec.SourceRef.Path != "/" {
+		t.Errorf("expected sourceRef.path %q, got %q", "/", ps.Spec.SourceRef.Path)
+	}
+
+	// Verify variants
+	expectedVariants := []string{"default", "isp-full", "isp-hosted", "isp-full-generic"}
+	if len(ps.Spec.Variants) != len(expectedVariants) {
+		t.Fatalf("expected %d variants, got %d", len(expectedVariants), len(ps.Spec.Variants))
+	}
+	for i, name := range expectedVariants {
+		if ps.Spec.Variants[i].Name != name {
+			t.Errorf("expected variant[%d].name %q, got %q", i, name, ps.Spec.Variants[i].Name)
+		}
+		if len(ps.Spec.Variants[i].Components) != 1 {
+			t.Errorf("expected variant[%d] to have 1 component, got %d", i, len(ps.Spec.Variants[i].Components))
+		}
+	}
+}
+
+func TestInstallPlatformPackageSource_Updates(t *testing.T) {
+	s := newTestScheme()
+
+	existing := &cozyv1alpha1.PackageSource{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:            "cozystack.cozystack-platform",
+			ResourceVersion: "1",
+		},
+		Spec: cozyv1alpha1.PackageSourceSpec{
+			SourceRef: &cozyv1alpha1.PackageSourceRef{
+				Kind:      "OCIRepository",
+				Name:      "old-name",
+				Namespace: "cozy-system",
+			},
+		},
+	}
+
+	k8sClient := fake.NewClientBuilder().WithScheme(s).WithObjects(existing).Build()
+
+	err := installPlatformPackageSource(context.Background(), k8sClient, "cozystack-platform", "OCIRepository")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	ps := &cozyv1alpha1.PackageSource{}
+	if err := k8sClient.Get(context.Background(), client.ObjectKey{Name: "cozystack.cozystack-platform"}, ps); err != nil {
+		t.Fatalf("PackageSource not found: %v", err)
+	}
+
+	// Verify sourceRef was updated
+	if ps.Spec.SourceRef.Name != "cozystack-platform" {
+		t.Errorf("expected updated sourceRef.name %q, got %q", "cozystack-platform", ps.Spec.SourceRef.Name)
+	}
+
+	// Verify all 4 variants are present after update
+	if len(ps.Spec.Variants) != 4 {
+		t.Errorf("expected 4 variants after update, got %d", len(ps.Spec.Variants))
+	}
+}
+
+func TestInstallPlatformPackageSource_GitRepository(t *testing.T) {
+	s := newTestScheme()
+	k8sClient := fake.NewClientBuilder().WithScheme(s).Build()
+
+	err := installPlatformPackageSource(context.Background(), k8sClient, "my-source", "GitRepository")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	ps := &cozyv1alpha1.PackageSource{}
+	if err := k8sClient.Get(context.Background(), client.ObjectKey{Name: "cozystack.my-source"}, ps); err != nil {
+		t.Fatalf("PackageSource not found: %v", err)
+	}
+
+	if ps.Spec.SourceRef.Kind != "GitRepository" {
+		t.Errorf("expected sourceRef.kind %q, got %q", "GitRepository", ps.Spec.SourceRef.Kind)
+	}
+	if ps.Spec.SourceRef.Name != "my-source" {
+		t.Errorf("expected sourceRef.name %q, got %q", "my-source", ps.Spec.SourceRef.Name)
+	}
+}
diff --git a/hack/e2e-install-cozystack.bats b/hack/e2e-install-cozystack.bats
index 5a705906..815622bc 100644
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -19,6 +19,10 @@
   # Verify the operator deployment is available
   kubectl wait deployment/cozystack-operator -n cozy-system --timeout=1m --for=condition=Available
 
+  # Wait for operator to install CRDs (happens at startup before reconcile loop)
+  kubectl wait crd/packages.cozystack.io --for=condition=Established --timeout=2m
+  kubectl wait crd/packagesources.cozystack.io --for=condition=Established --timeout=2m
+
   # Create platform Package with isp-full variant
   kubectl apply -f - <<EOF
 apiVersion: cozystack.io/v1alpha1

From 58e2b646be50f4de7ebe1ceb41771a2c8b9c5676 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 19 Feb 2026 17:54:33 +0300
Subject: [PATCH 121/666] fix(operator): use SSA for PackageSource, separate
 context, unconditional creation

Switch installPlatformPackageSource to server-side apply (SSA) with
field manager, matching the pattern used in crdinstall. SSA is idempotent
and preserves metadata fields managed by other controllers.

Create PackageSource unconditionally (not only when platformSourceURL is
set), matching the previous Helm template behavior where PackageSource
was always created regardless of source URL configuration.

Use a dedicated context with its own 2-minute timeout for PackageSource
creation, separate from the platform source resource installation.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 cmd/cozystack-operator/main.go      | 55 +++++++++++++----------------
 cmd/cozystack-operator/main_test.go |  8 +++++
 2 files changed, 32 insertions(+), 31 deletions(-)

diff --git a/cmd/cozystack-operator/main.go b/cmd/cozystack-operator/main.go
index fb45b96c..10102bc0 100644
--- a/cmd/cozystack-operator/main.go
+++ b/cmd/cozystack-operator/main.go
@@ -222,24 +222,28 @@ func main() {
 		} else {
 			setupLog.Info("Platform source resource installation completed successfully")
 		}
+	}
 
-		// Create platform PackageSource that references the source resource
-		setupLog.Info("Creating platform PackageSource", "platformSourceName", platformSourceName)
-		sourceType, _, err := parsePlatformSourceURL(platformSourceURL)
-		if err != nil {
-			setupLog.Error(err, "failed to parse platform source URL for PackageSource creation")
-			os.Exit(1)
-		}
+	// Create platform PackageSource unconditionally (it was previously created
+	// by a Helm template regardless of platformSourceURL). Derive sourceRefKind
+	// from URL when available, default to OCIRepository otherwise.
+	{
 		sourceRefKind := "OCIRepository"
-		if sourceType == "git" {
-			sourceRefKind = "GitRepository"
+		if platformSourceURL != "" {
+			sourceType, _, _ := parsePlatformSourceURL(platformSourceURL)
+			// Error already checked by installPlatformSourceResource above
+			if sourceType == "git" {
+				sourceRefKind = "GitRepository"
+			}
 		}
-		if err := installPlatformPackageSource(installCtx, directClient, platformSourceName, sourceRefKind); err != nil {
+		setupLog.Info("Creating platform PackageSource", "platformSourceName", platformSourceName)
+		psCtx, psCancel := context.WithTimeout(mgrCtx, 2*time.Minute)
+		defer psCancel()
+		if err := installPlatformPackageSource(psCtx, directClient, platformSourceName, sourceRefKind); err != nil {
 			setupLog.Error(err, "failed to create platform PackageSource")
 			os.Exit(1)
-		} else {
-			setupLog.Info("Platform PackageSource creation completed successfully")
 		}
+		setupLog.Info("Platform PackageSource creation completed successfully")
 	}
 
 	// Setup PackageSource reconciler
@@ -663,26 +667,15 @@ func installPlatformPackageSource(ctx context.Context, k8sClient client.Client,
 
 	logger.Info("Applying platform PackageSource", "name", packageSourceName)
 
-	existing := &cozyv1alpha1.PackageSource{}
-	key := client.ObjectKeyFromObject(ps)
-
-	err := k8sClient.Get(ctx, key, existing)
-	if err != nil {
-		if client.IgnoreNotFound(err) == nil {
-			if err := k8sClient.Create(ctx, ps); err != nil {
-				return fmt.Errorf("failed to create PackageSource %s: %w", packageSourceName, err)
-			}
-			logger.Info("Created platform PackageSource", "name", packageSourceName)
-		} else {
-			return fmt.Errorf("failed to check if PackageSource exists: %w", err)
-		}
-	} else {
-		ps.SetResourceVersion(existing.GetResourceVersion())
-		if err := k8sClient.Update(ctx, ps); err != nil {
-			return fmt.Errorf("failed to update PackageSource %s: %w", packageSourceName, err)
-		}
-		logger.Info("Updated platform PackageSource", "name", packageSourceName)
+	patchOptions := &client.PatchOptions{
+		FieldManager: "cozystack-operator",
+		Force:        func() *bool { b := true; return &b }(),
 	}
 
+	if err := k8sClient.Patch(ctx, ps, client.Apply, patchOptions); err != nil {
+		return fmt.Errorf("failed to apply PackageSource %s: %w", packageSourceName, err)
+	}
+
+	logger.Info("Applied platform PackageSource", "name", packageSourceName)
 	return nil
 }
diff --git a/cmd/cozystack-operator/main_test.go b/cmd/cozystack-operator/main_test.go
index da1769f2..41b0655f 100644
--- a/cmd/cozystack-operator/main_test.go
+++ b/cmd/cozystack-operator/main_test.go
@@ -96,6 +96,9 @@ func TestInstallPlatformPackageSource_Updates(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{
 			Name:            "cozystack.cozystack-platform",
 			ResourceVersion: "1",
+			Labels: map[string]string{
+				"custom-label": "should-be-preserved",
+			},
 		},
 		Spec: cozyv1alpha1.PackageSourceSpec{
 			SourceRef: &cozyv1alpha1.PackageSourceRef{
@@ -127,6 +130,11 @@ func TestInstallPlatformPackageSource_Updates(t *testing.T) {
 	if len(ps.Spec.Variants) != 4 {
 		t.Errorf("expected 4 variants after update, got %d", len(ps.Spec.Variants))
 	}
+
+	// Verify that labels set by other controllers are preserved (SSA does not overwrite unmanaged fields)
+	if ps.Labels["custom-label"] != "should-be-preserved" {
+		t.Errorf("expected custom-label to be preserved, got %q", ps.Labels["custom-label"])
+	}
 }
 
 func TestInstallPlatformPackageSource_GitRepository(t *testing.T) {

From dbfdbc8298bdbeedf3e24a7c6a843275ec356468 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 19 Feb 2026 17:57:45 +0300
Subject: [PATCH 122/666] fix(installer): check parsePlatformSourceURL error,
 wait for PackageSource in E2E

Explicitly check error from parsePlatformSourceURL instead of relying on
the implicit guarantee that installPlatformSourceResource already checked
it. This prevents latent bugs if startup order is ever restructured.

Add wait for platform PackageSource existence in E2E test before creating
Package resource, preventing flaky failures when operator startup is slow.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 cmd/cozystack-operator/main.go  | 7 +++++--
 hack/e2e-install-cozystack.bats | 3 +++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/cmd/cozystack-operator/main.go b/cmd/cozystack-operator/main.go
index 10102bc0..34172d95 100644
--- a/cmd/cozystack-operator/main.go
+++ b/cmd/cozystack-operator/main.go
@@ -230,8 +230,11 @@ func main() {
 	{
 		sourceRefKind := "OCIRepository"
 		if platformSourceURL != "" {
-			sourceType, _, _ := parsePlatformSourceURL(platformSourceURL)
-			// Error already checked by installPlatformSourceResource above
+			sourceType, _, err := parsePlatformSourceURL(platformSourceURL)
+			if err != nil {
+				setupLog.Error(err, "failed to parse platform source URL for PackageSource")
+				os.Exit(1)
+			}
 			if sourceType == "git" {
 				sourceRefKind = "GitRepository"
 			}
diff --git a/hack/e2e-install-cozystack.bats b/hack/e2e-install-cozystack.bats
index 815622bc..2cfebfbf 100644
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -23,6 +23,9 @@
   kubectl wait crd/packages.cozystack.io --for=condition=Established --timeout=2m
   kubectl wait crd/packagesources.cozystack.io --for=condition=Established --timeout=2m
 
+  # Wait for operator to create the platform PackageSource
+  timeout 120 sh -ec 'until kubectl get packagesource cozystack.cozystack-platform >/dev/null 2>&1; do sleep 2; done'
+
   # Create platform Package with isp-full variant
   kubectl apply -f - <<EOF
 apiVersion: cozystack.io/v1alpha1

From 4821f025fc7690fd6e127e78e668011f26fe8a9c Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 19 Feb 2026 18:04:50 +0300
Subject: [PATCH 123/666] fix(operator): correct default platformSourceName,
 gate PackageSource on installCRDs

Change default --platform-source-name from "cozystack-packages" to
"cozystack-platform" to match the value passed by the Helm template.

Gate PackageSource creation on --install-crds flag: when the operator
does not manage CRDs, the PackageSource CRD may not exist yet, so
skip creation and let an external process handle it.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 cmd/cozystack-operator/main.go | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/cmd/cozystack-operator/main.go b/cmd/cozystack-operator/main.go
index 34172d95..ad4a2778 100644
--- a/cmd/cozystack-operator/main.go
+++ b/cmd/cozystack-operator/main.go
@@ -108,7 +108,7 @@ func main() {
 	flag.StringVar(&telemetryInterval, "telemetry-interval", "15m",
 		"Interval between telemetry data collection (e.g. 15m, 1h)")
 	flag.StringVar(&platformSourceURL, "platform-source-url", "", "Platform source URL (oci:// or https://). If specified, generates OCIRepository or GitRepository resource.")
-	flag.StringVar(&platformSourceName, "platform-source-name", "cozystack-packages", "Name for the generated platform source resource (default: cozystack-packages)")
+	flag.StringVar(&platformSourceName, "platform-source-name", "cozystack-platform", "Name for the generated platform source resource and PackageSource")
 	flag.StringVar(&platformSourceRef, "platform-source-ref", "", "Reference specification as key=value pairs (e.g., 'branch=main' or 'digest=sha256:...,tag=v1.0'). For OCI: digest, semver, semverFilter, tag. For Git: branch, tag, semver, name, commit.")
 	flag.StringVar(&cozyValuesSecretName, "cozy-values-secret-name", "cozystack-values", "The name of the secret containing cluster-wide configuration values.")
 	flag.StringVar(&cozyValuesSecretNamespace, "cozy-values-secret-namespace", "cozy-system", "The namespace of the secret containing cluster-wide configuration values.")
@@ -224,10 +224,10 @@ func main() {
 		}
 	}
 
-	// Create platform PackageSource unconditionally (it was previously created
-	// by a Helm template regardless of platformSourceURL). Derive sourceRefKind
-	// from URL when available, default to OCIRepository otherwise.
-	{
+	// Create platform PackageSource when CRDs are managed by the operator.
+	// When --install-crds=false the PackageSource CRD may not exist yet,
+	// so we skip creation and let an external process handle it.
+	if installCRDs {
 		sourceRefKind := "OCIRepository"
 		if platformSourceURL != "" {
 			sourceType, _, err := parsePlatformSourceURL(platformSourceURL)

From 8c6c69cdab727b1ff8884be41831166f67927a6a Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 19 Feb 2026 17:44:24 +0300
Subject: [PATCH 124/666] fix(kamaji): update Go builder image to 1.25 and fix
 unused context import

Kamaji edge-26.2.4 requires Go >= 1.25.0, update base image accordingly.
Also remove unused "context" import from disable-datastore-check patch,
since removing the CheckExists call was the only usage of that package.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../system/kamaji/images/kamaji/Dockerfile    |  2 +-
 .../patches/disable-datastore-check.diff      | 22 ++++++++++++-------
 2 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/packages/system/kamaji/images/kamaji/Dockerfile b/packages/system/kamaji/images/kamaji/Dockerfile
index 7cde7ea3..75d37118 100644
--- a/packages/system/kamaji/images/kamaji/Dockerfile
+++ b/packages/system/kamaji/images/kamaji/Dockerfile
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM golang:1.24 as builder
+FROM golang:1.25 AS builder
 
 ARG VERSION=edge-26.2.4
 ARG TARGETOS
diff --git a/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff b/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff
index b003e791..1a8767b5 100644
--- a/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff
+++ b/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff
@@ -1,8 +1,15 @@
 diff --git a/cmd/manager/cmd.go b/cmd/manager/cmd.go
-index 0b77322..4c40e8d 100644
 --- a/cmd/manager/cmd.go
 +++ b/cmd/manager/cmd.go
-@@ -34,7 +34,6 @@ import (
+@@ -4,7 +4,6 @@
+ package manager
+
+ import (
+-	"context"
+ 	"flag"
+ 	"fmt"
+ 	"io"
+@@ -34,7 +33,6 @@
  	"github.com/clastix/kamaji/controllers/soot"
  	"github.com/clastix/kamaji/internal"
  	"github.com/clastix/kamaji/internal/builders/controlplane"
@@ -10,15 +17,14 @@ index 0b77322..4c40e8d 100644
  	"github.com/clastix/kamaji/internal/utilities"
  	"github.com/clastix/kamaji/internal/webhook"
  	"github.com/clastix/kamaji/internal/webhook/handlers"
-@@ -86,11 +85,6 @@ func NewCmd(scheme *runtime.Scheme) *cobra.Command {
+@@ -85,10 +83,6 @@
+
  			if webhookCABundle, err = os.ReadFile(webhookCAPath); err != nil {
  				return fmt.Errorf("unable to read webhook CA: %w", err)
- 			}
+-			}
 -
 -			if err = datastoreutils.CheckExists(context.Background(), scheme, datastore); err != nil {
 -				return err
--			}
--
- 			if controllerReconcileTimeout.Seconds() == 0 {
- 				return fmt.Errorf("the controller reconcile timeout must be greater than zero")
  			}
+
+ 			if controllerReconcileTimeout.Seconds() == 0 {

From d0a6ddd7822ef41a9db7260c8d4c79079318ca70 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 19 Feb 2026 18:25:14 +0300
Subject: [PATCH 125/666] refactor(operator): reduce variant duplication in
 installPlatformPackageSource

Replace repetitive Variant struct literals with a loop over variant
data, making it easier to add new variants and reducing copy-paste
errors.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 cmd/cozystack-operator/main.go | 87 ++++++++++++----------------------
 1 file changed, 29 insertions(+), 58 deletions(-)

diff --git a/cmd/cozystack-operator/main.go b/cmd/cozystack-operator/main.go
index ad4a2778..03855e7e 100644
--- a/cmd/cozystack-operator/main.go
+++ b/cmd/cozystack-operator/main.go
@@ -607,67 +607,38 @@ func installPlatformPackageSource(ctx context.Context, k8sClient client.Client,
 				Namespace: "cozy-system",
 				Path:      "/",
 			},
-			Variants: []cozyv1alpha1.Variant{
-				{
-					Name: "default",
-					Components: []cozyv1alpha1.Component{
-						{
-							Name: "platform",
-							Path: "core/platform",
-							Install: &cozyv1alpha1.ComponentInstall{
-								Namespace:   "cozy-system",
-								ReleaseName: "cozystack-platform",
-							},
-							ValuesFiles: []string{"values.yaml"},
-						},
-					},
-				},
-				{
-					Name: "isp-full",
-					Components: []cozyv1alpha1.Component{
-						{
-							Name: "platform",
-							Path: "core/platform",
-							Install: &cozyv1alpha1.ComponentInstall{
-								Namespace:   "cozy-system",
-								ReleaseName: "cozystack-platform",
-							},
-							ValuesFiles: []string{"values.yaml", "values-isp-full.yaml"},
-						},
-					},
-				},
-				{
-					Name: "isp-hosted",
-					Components: []cozyv1alpha1.Component{
-						{
-							Name: "platform",
-							Path: "core/platform",
-							Install: &cozyv1alpha1.ComponentInstall{
-								Namespace:   "cozy-system",
-								ReleaseName: "cozystack-platform",
-							},
-							ValuesFiles: []string{"values.yaml", "values-isp-hosted.yaml"},
-						},
-					},
-				},
-				{
-					Name: "isp-full-generic",
-					Components: []cozyv1alpha1.Component{
-						{
-							Name: "platform",
-							Path: "core/platform",
-							Install: &cozyv1alpha1.ComponentInstall{
-								Namespace:   "cozy-system",
-								ReleaseName: "cozystack-platform",
-							},
-							ValuesFiles: []string{"values.yaml", "values-isp-full-generic.yaml"},
-						},
-					},
-				},
-			},
 		},
 	}
 
+	variantData := []struct {
+		name        string
+		valuesFiles []string
+	}{
+		{"default", []string{"values.yaml"}},
+		{"isp-full", []string{"values.yaml", "values-isp-full.yaml"}},
+		{"isp-hosted", []string{"values.yaml", "values-isp-hosted.yaml"}},
+		{"isp-full-generic", []string{"values.yaml", "values-isp-full-generic.yaml"}},
+	}
+
+	variants := make([]cozyv1alpha1.Variant, len(variantData))
+	for i, v := range variantData {
+		variants[i] = cozyv1alpha1.Variant{
+			Name: v.name,
+			Components: []cozyv1alpha1.Component{
+				{
+					Name: "platform",
+					Path: "core/platform",
+					Install: &cozyv1alpha1.ComponentInstall{
+						Namespace:   "cozy-system",
+						ReleaseName: "cozystack-platform",
+					},
+					ValuesFiles: v.valuesFiles,
+				},
+			},
+		}
+	}
+	ps.Spec.Variants = variants
+
 	logger.Info("Applying platform PackageSource", "name", packageSourceName)
 
 	patchOptions := &client.PatchOptions{

From 8b9a11360e4d1bb38aa4e38b0dce2e39f85e762d Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 19 Feb 2026 18:29:55 +0300
Subject: [PATCH 126/666] fix(operator): skip PackageSource creation when
 platform source URL is empty

When platformSourceURL is empty no Flux source resource is created, so
creating a PackageSource that references it would leave a dangling
SourceRef in a permanent error state. Guard the creation block on
platformSourceURL != "".

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 cmd/cozystack-operator/main.go | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/cmd/cozystack-operator/main.go b/cmd/cozystack-operator/main.go
index 03855e7e..e215b779 100644
--- a/cmd/cozystack-operator/main.go
+++ b/cmd/cozystack-operator/main.go
@@ -224,20 +224,18 @@ func main() {
 		}
 	}
 
-	// Create platform PackageSource when CRDs are managed by the operator.
-	// When --install-crds=false the PackageSource CRD may not exist yet,
-	// so we skip creation and let an external process handle it.
-	if installCRDs {
+	// Create platform PackageSource when CRDs are managed by the operator and
+	// a platform source URL is configured. Without a URL there is no Flux source
+	// resource to reference, so creating a PackageSource would leave a dangling SourceRef.
+	if installCRDs && platformSourceURL != "" {
 		sourceRefKind := "OCIRepository"
-		if platformSourceURL != "" {
-			sourceType, _, err := parsePlatformSourceURL(platformSourceURL)
-			if err != nil {
-				setupLog.Error(err, "failed to parse platform source URL for PackageSource")
-				os.Exit(1)
-			}
-			if sourceType == "git" {
-				sourceRefKind = "GitRepository"
-			}
+		sourceType, _, err := parsePlatformSourceURL(platformSourceURL)
+		if err != nil {
+			setupLog.Error(err, "failed to parse platform source URL for PackageSource")
+			os.Exit(1)
+		}
+		if sourceType == "git" {
+			sourceRefKind = "GitRepository"
 		}
 		setupLog.Info("Creating platform PackageSource", "platformSourceName", platformSourceName)
 		psCtx, psCancel := context.WithTimeout(mgrCtx, 2*time.Minute)

From 0738fae56d5610f9871b937b37699f11e21c3f5d Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Thu, 19 Feb 2026 18:30:20 +0300
Subject: [PATCH 127/666] fix(monitoring-agents): use FQDN with cluster domain
 for metrics and logs endpoints

Monitoring agents in tenant workload clusters failed to deliver metrics
and logs because service addresses used short DNS names without the
cluster domain suffix. Tenant CoreDNS could not resolve these names
across cluster boundaries.

Append the configured cluster domain from _cluster.cluster-domain to
all vmagent remoteWrite URLs and fluent-bit output hosts, falling back
to cluster.local when not set.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 packages/system/monitoring-agents/values.yaml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/packages/system/monitoring-agents/values.yaml b/packages/system/monitoring-agents/values.yaml
index a4d4b025..2b208424 100644
--- a/packages/system/monitoring-agents/values.yaml
+++ b/packages/system/monitoring-agents/values.yaml
@@ -280,8 +280,8 @@ vmagent:
     cluster: cozystack
   remoteWrite:
     urls:
-      - http://vminsert-shortterm.{{ .Values.global.target }}.svc:8480/insert/0/prometheus
-      - http://vminsert-longterm.{{ .Values.global.target }}.svc:8480/insert/0/prometheus
+      - http://vminsert-shortterm.{{ .Values.global.target }}.svc.{{ (index .Values._cluster "cluster-domain") | default "cluster.local" }}:8480/insert/0/prometheus
+      - http://vminsert-longterm.{{ .Values.global.target }}.svc.{{ (index .Values._cluster "cluster-domain") | default "cluster.local" }}:8480/insert/0/prometheus
   extraArgs: {}
 
 fluent-bit:
@@ -344,7 +344,7 @@ fluent-bit:
       [OUTPUT]
           Name http
           Match kube.*
-          Host vlogs-generic.{{ .Values.global.target }}.svc
+          Host vlogs-generic.{{ .Values.global.target }}.svc.{{ (index .Values._cluster "cluster-domain") | default "cluster.local" }}
           port 9428
           compress gzip
           uri /insert/jsonline?_stream_fields=log_source,stream,kubernetes_pod_name,kubernetes_container_name,kubernetes_namespace_name&_msg_field=log&_time_field=date
@@ -355,7 +355,7 @@ fluent-bit:
       [OUTPUT]
           Name http
           Match events.*
-          Host vlogs-generic.{{ .Values.global.target }}.svc
+          Host vlogs-generic.{{ .Values.global.target }}.svc.{{ (index .Values._cluster "cluster-domain") | default "cluster.local" }}
           port 9428
           compress gzip
           uri /insert/jsonline?_stream_fields=log_source,reason,meatdata_namespace,metadata_name&_msg_field=message&_time_field=date
@@ -366,7 +366,7 @@ fluent-bit:
       [OUTPUT]
           Name http
           Match audit.*
-          Host vlogs-generic.{{ .Values.global.target }}.svc
+          Host vlogs-generic.{{ .Values.global.target }}.svc.{{ (index .Values._cluster "cluster-domain") | default "cluster.local" }}
           port 9428
           compress gzip
           uri /insert/jsonline?_stream_fields=log_source,stage,user_username,verb,requestUri&_msg_field=requestURI&_time_field=date

From 4843a617bc0905f9e1ba8ee997547b852fac7f8e Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 19 Feb 2026 18:31:49 +0300
Subject: [PATCH 128/666] fix(operator): skip PackageSource on empty URL, add
 comprehensive tests

Guard PackageSource creation on platformSourceURL != "" to avoid
dangling SourceRef when no Flux source resource exists.

Add tests covering all new and modified functions:
- parsePlatformSourceURL (OCI, HTTPS, SSH, empty, unsupported scheme)
- parseRefSpec (single/multi values, whitespace, equals in value,
  missing equals, empty key/value, trailing comma)
- validateOCIRef / validateGitRef (valid keys, invalid keys, format)
- generateOCIRepository / generateGitRepository (with ref, no ref,
  invalid ref)
- installPlatformPackageSource variant valuesFiles validation
- installPlatformPackageSource custom name

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 cmd/cozystack-operator/main_test.go | 414 ++++++++++++++++++++++++++++
 1 file changed, 414 insertions(+)

diff --git a/cmd/cozystack-operator/main_test.go b/cmd/cozystack-operator/main_test.go
index 41b0655f..a69bc9b5 100644
--- a/cmd/cozystack-operator/main_test.go
+++ b/cmd/cozystack-operator/main_test.go
@@ -137,6 +137,151 @@ func TestInstallPlatformPackageSource_Updates(t *testing.T) {
 	}
 }
 
+func TestParsePlatformSourceURL(t *testing.T) {
+	tests := []struct {
+		name       string
+		url        string
+		wantType   string
+		wantURL    string
+		wantErr    bool
+	}{
+		{
+			name:     "OCI URL",
+			url:      "oci://ghcr.io/cozystack/cozystack/cozystack-packages",
+			wantType: "oci",
+			wantURL:  "oci://ghcr.io/cozystack/cozystack/cozystack-packages",
+		},
+		{
+			name:     "HTTPS URL",
+			url:      "https://github.com/cozystack/cozystack",
+			wantType: "git",
+			wantURL:  "https://github.com/cozystack/cozystack",
+		},
+		{
+			name:     "SSH URL",
+			url:      "ssh://git@github.com/cozystack/cozystack",
+			wantType: "git",
+			wantURL:  "ssh://git@github.com/cozystack/cozystack",
+		},
+		{
+			name:    "empty URL",
+			url:     "",
+			wantErr: true,
+		},
+		{
+			name:    "unsupported scheme",
+			url:     "ftp://example.com/repo",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			sourceType, repoURL, err := parsePlatformSourceURL(tt.url)
+			if tt.wantErr {
+				if err == nil {
+					t.Fatalf("expected error for URL %q, got nil", tt.url)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if sourceType != tt.wantType {
+				t.Errorf("expected type %q, got %q", tt.wantType, sourceType)
+			}
+			if repoURL != tt.wantURL {
+				t.Errorf("expected URL %q, got %q", tt.wantURL, repoURL)
+			}
+		})
+	}
+}
+
+func TestInstallPlatformPackageSource_VariantValuesFiles(t *testing.T) {
+	s := newTestScheme()
+	k8sClient := fake.NewClientBuilder().WithScheme(s).Build()
+
+	err := installPlatformPackageSource(context.Background(), k8sClient, "cozystack-platform", "OCIRepository")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	ps := &cozyv1alpha1.PackageSource{}
+	if err := k8sClient.Get(context.Background(), client.ObjectKey{Name: "cozystack.cozystack-platform"}, ps); err != nil {
+		t.Fatalf("PackageSource not found: %v", err)
+	}
+
+	expectedValuesFiles := map[string][]string{
+		"default":          {"values.yaml"},
+		"isp-full":         {"values.yaml", "values-isp-full.yaml"},
+		"isp-hosted":       {"values.yaml", "values-isp-hosted.yaml"},
+		"isp-full-generic": {"values.yaml", "values-isp-full-generic.yaml"},
+	}
+
+	for _, v := range ps.Spec.Variants {
+		expected, ok := expectedValuesFiles[v.Name]
+		if !ok {
+			t.Errorf("unexpected variant %q", v.Name)
+			continue
+		}
+
+		if len(v.Components) != 1 {
+			t.Errorf("variant %q: expected 1 component, got %d", v.Name, len(v.Components))
+			continue
+		}
+
+		comp := v.Components[0]
+		if comp.Name != "platform" {
+			t.Errorf("variant %q: expected component name %q, got %q", v.Name, "platform", comp.Name)
+		}
+		if comp.Path != "core/platform" {
+			t.Errorf("variant %q: expected component path %q, got %q", v.Name, "core/platform", comp.Path)
+		}
+		if comp.Install == nil {
+			t.Errorf("variant %q: expected Install to be set", v.Name)
+		} else {
+			if comp.Install.Namespace != "cozy-system" {
+				t.Errorf("variant %q: expected install namespace %q, got %q", v.Name, "cozy-system", comp.Install.Namespace)
+			}
+			if comp.Install.ReleaseName != "cozystack-platform" {
+				t.Errorf("variant %q: expected install releaseName %q, got %q", v.Name, "cozystack-platform", comp.Install.ReleaseName)
+			}
+		}
+
+		if len(comp.ValuesFiles) != len(expected) {
+			t.Errorf("variant %q: expected %d valuesFiles, got %d", v.Name, len(expected), len(comp.ValuesFiles))
+			continue
+		}
+		for i, f := range expected {
+			if comp.ValuesFiles[i] != f {
+				t.Errorf("variant %q: expected valuesFiles[%d] %q, got %q", v.Name, i, f, comp.ValuesFiles[i])
+			}
+		}
+	}
+}
+
+func TestInstallPlatformPackageSource_CustomName(t *testing.T) {
+	s := newTestScheme()
+	k8sClient := fake.NewClientBuilder().WithScheme(s).Build()
+
+	err := installPlatformPackageSource(context.Background(), k8sClient, "custom-source", "OCIRepository")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	ps := &cozyv1alpha1.PackageSource{}
+	if err := k8sClient.Get(context.Background(), client.ObjectKey{Name: "cozystack.custom-source"}, ps); err != nil {
+		t.Fatalf("PackageSource not found: %v", err)
+	}
+
+	if ps.Name != "cozystack.custom-source" {
+		t.Errorf("expected name %q, got %q", "cozystack.custom-source", ps.Name)
+	}
+	if ps.Spec.SourceRef.Name != "custom-source" {
+		t.Errorf("expected sourceRef.name %q, got %q", "custom-source", ps.Spec.SourceRef.Name)
+	}
+}
+
 func TestInstallPlatformPackageSource_GitRepository(t *testing.T) {
 	s := newTestScheme()
 	k8sClient := fake.NewClientBuilder().WithScheme(s).Build()
@@ -158,3 +303,272 @@ func TestInstallPlatformPackageSource_GitRepository(t *testing.T) {
 		t.Errorf("expected sourceRef.name %q, got %q", "my-source", ps.Spec.SourceRef.Name)
 	}
 }
+
+func TestParseRefSpec(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string
+		want    map[string]string
+		wantErr bool
+	}{
+		{
+			name:  "empty string",
+			input: "",
+			want:  map[string]string{},
+		},
+		{
+			name:  "single key-value",
+			input: "tag=v1.0",
+			want:  map[string]string{"tag": "v1.0"},
+		},
+		{
+			name:  "multiple key-values",
+			input: "digest=sha256:abc123,tag=v1.0",
+			want:  map[string]string{"digest": "sha256:abc123", "tag": "v1.0"},
+		},
+		{
+			name:  "whitespace around pairs",
+			input: " tag=v1.0 , branch=main ",
+			want:  map[string]string{"tag": "v1.0", "branch": "main"},
+		},
+		{
+			name:  "equals sign in value",
+			input: "digest=sha256:abc=123",
+			want:  map[string]string{"digest": "sha256:abc=123"},
+		},
+		{
+			name:    "missing equals sign",
+			input:   "tag",
+			wantErr: true,
+		},
+		{
+			name:    "empty key",
+			input:   "=value",
+			wantErr: true,
+		},
+		{
+			name:    "empty value",
+			input:   "tag=",
+			wantErr: true,
+		},
+		{
+			name:  "trailing comma",
+			input: "tag=v1.0,",
+			want:  map[string]string{"tag": "v1.0"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := parseRefSpec(tt.input)
+			if tt.wantErr {
+				if err == nil {
+					t.Fatalf("expected error for input %q, got nil", tt.input)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if len(got) != len(tt.want) {
+				t.Fatalf("expected %d entries, got %d: %v", len(tt.want), len(got), got)
+			}
+			for k, v := range tt.want {
+				if got[k] != v {
+					t.Errorf("expected %q=%q, got %q=%q", k, v, k, got[k])
+				}
+			}
+		})
+	}
+}
+
+func TestValidateOCIRef(t *testing.T) {
+	tests := []struct {
+		name    string
+		refMap  map[string]string
+		wantErr bool
+	}{
+		{
+			name:   "valid tag",
+			refMap: map[string]string{"tag": "v1.0"},
+		},
+		{
+			name:   "valid digest",
+			refMap: map[string]string{"digest": "sha256:abc123def456"},
+		},
+		{
+			name:   "valid semver",
+			refMap: map[string]string{"semver": ">=1.0.0"},
+		},
+		{
+			name:   "multiple valid keys",
+			refMap: map[string]string{"tag": "v1.0", "digest": "sha256:abc"},
+		},
+		{
+			name:   "empty map",
+			refMap: map[string]string{},
+		},
+		{
+			name:    "invalid key",
+			refMap:  map[string]string{"branch": "main"},
+			wantErr: true,
+		},
+		{
+			name:    "invalid digest format",
+			refMap:  map[string]string{"digest": "md5:abc"},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateOCIRef(tt.refMap)
+			if tt.wantErr && err == nil {
+				t.Fatal("expected error, got nil")
+			}
+			if !tt.wantErr && err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+		})
+	}
+}
+
+func TestValidateGitRef(t *testing.T) {
+	tests := []struct {
+		name    string
+		refMap  map[string]string
+		wantErr bool
+	}{
+		{
+			name:   "valid branch",
+			refMap: map[string]string{"branch": "main"},
+		},
+		{
+			name:   "valid commit",
+			refMap: map[string]string{"commit": "abc1234"},
+		},
+		{
+			name:   "valid tag and branch",
+			refMap: map[string]string{"tag": "v1.0", "branch": "release"},
+		},
+		{
+			name:   "empty map",
+			refMap: map[string]string{},
+		},
+		{
+			name:    "invalid key",
+			refMap:  map[string]string{"digest": "sha256:abc"},
+			wantErr: true,
+		},
+		{
+			name:    "commit too short",
+			refMap:  map[string]string{"commit": "abc"},
+			wantErr: true,
+		},
+		{
+			name:    "commit not hex",
+			refMap:  map[string]string{"commit": "zzzzzzz"},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateGitRef(tt.refMap)
+			if tt.wantErr && err == nil {
+				t.Fatal("expected error, got nil")
+			}
+			if !tt.wantErr && err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+		})
+	}
+}
+
+func TestGenerateOCIRepository(t *testing.T) {
+	refMap := map[string]string{"tag": "v1.0", "digest": "sha256:abc123"}
+	obj, err := generateOCIRepository("my-repo", "oci://registry.example.com/repo", refMap)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if obj.Name != "my-repo" {
+		t.Errorf("expected name %q, got %q", "my-repo", obj.Name)
+	}
+	if obj.Namespace != "cozy-system" {
+		t.Errorf("expected namespace %q, got %q", "cozy-system", obj.Namespace)
+	}
+	if obj.Spec.URL != "oci://registry.example.com/repo" {
+		t.Errorf("expected URL %q, got %q", "oci://registry.example.com/repo", obj.Spec.URL)
+	}
+	if obj.Spec.Reference == nil {
+		t.Fatal("expected Reference to be set")
+	}
+	if obj.Spec.Reference.Tag != "v1.0" {
+		t.Errorf("expected tag %q, got %q", "v1.0", obj.Spec.Reference.Tag)
+	}
+	if obj.Spec.Reference.Digest != "sha256:abc123" {
+		t.Errorf("expected digest %q, got %q", "sha256:abc123", obj.Spec.Reference.Digest)
+	}
+}
+
+func TestGenerateOCIRepository_NoRef(t *testing.T) {
+	obj, err := generateOCIRepository("my-repo", "oci://registry.example.com/repo", map[string]string{})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if obj.Spec.Reference != nil {
+		t.Error("expected Reference to be nil for empty refMap")
+	}
+}
+
+func TestGenerateOCIRepository_InvalidRef(t *testing.T) {
+	_, err := generateOCIRepository("my-repo", "oci://registry.example.com/repo", map[string]string{"branch": "main"})
+	if err == nil {
+		t.Fatal("expected error for invalid OCI ref key, got nil")
+	}
+}
+
+func TestGenerateGitRepository(t *testing.T) {
+	refMap := map[string]string{"branch": "main", "commit": "abc1234def5678"}
+	obj, err := generateGitRepository("my-repo", "https://github.com/user/repo", refMap)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if obj.Name != "my-repo" {
+		t.Errorf("expected name %q, got %q", "my-repo", obj.Name)
+	}
+	if obj.Namespace != "cozy-system" {
+		t.Errorf("expected namespace %q, got %q", "cozy-system", obj.Namespace)
+	}
+	if obj.Spec.URL != "https://github.com/user/repo" {
+		t.Errorf("expected URL %q, got %q", "https://github.com/user/repo", obj.Spec.URL)
+	}
+	if obj.Spec.Reference == nil {
+		t.Fatal("expected Reference to be set")
+	}
+	if obj.Spec.Reference.Branch != "main" {
+		t.Errorf("expected branch %q, got %q", "main", obj.Spec.Reference.Branch)
+	}
+	if obj.Spec.Reference.Commit != "abc1234def5678" {
+		t.Errorf("expected commit %q, got %q", "abc1234def5678", obj.Spec.Reference.Commit)
+	}
+}
+
+func TestGenerateGitRepository_NoRef(t *testing.T) {
+	obj, err := generateGitRepository("my-repo", "https://github.com/user/repo", map[string]string{})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if obj.Spec.Reference != nil {
+		t.Error("expected Reference to be nil for empty refMap")
+	}
+}
+
+func TestGenerateGitRepository_InvalidRef(t *testing.T) {
+	_, err := generateGitRepository("my-repo", "https://github.com/user/repo", map[string]string{"digest": "sha256:abc"})
+	if err == nil {
+		t.Fatal("expected error for invalid Git ref key, got nil")
+	}
+}

From d4cb47b58b6b50d916a816571c23e4d471b2a8c4 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Thu, 19 Feb 2026 20:43:19 +0500
Subject: [PATCH 129/666] fix(cozystack-basics) deny resourcequotas deletion
 for tenant admin

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/system/cozystack-basics/templates/clusterroles.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/packages/system/cozystack-basics/templates/clusterroles.yaml b/packages/system/cozystack-basics/templates/clusterroles.yaml
index 29395dfe..72d924ef 100644
--- a/packages/system/cozystack-basics/templates/clusterroles.yaml
+++ b/packages/system/cozystack-basics/templates/clusterroles.yaml
@@ -181,7 +181,6 @@ rules:
   - persistentvolumes
   - endpoints
   - events
-  - resourcequotas
   verbs:
   - delete
 - apiGroups: ["kubevirt.io"]

From 4e5455c72cc9922fcbe750989fddeb3be7268741 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 19 Feb 2026 19:24:19 +0300
Subject: [PATCH 130/666] fix(e2e): poll for CRD existence before waiting for
 Established condition

kubectl wait fails immediately with NotFound if the CRD does not exist
yet. The operator creates CRDs asynchronously on startup, so wrap the
wait in a retry loop that tolerates the initial absence.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-install-cozystack.bats | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/hack/e2e-install-cozystack.bats b/hack/e2e-install-cozystack.bats
index 2cfebfbf..43b8ab8f 100644
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -19,9 +19,10 @@
   # Verify the operator deployment is available
   kubectl wait deployment/cozystack-operator -n cozy-system --timeout=1m --for=condition=Available
 
-  # Wait for operator to install CRDs (happens at startup before reconcile loop)
-  kubectl wait crd/packages.cozystack.io --for=condition=Established --timeout=2m
-  kubectl wait crd/packagesources.cozystack.io --for=condition=Established --timeout=2m
+  # Wait for operator to install CRDs (happens at startup before reconcile loop).
+  # kubectl wait fails immediately if the CRD does not exist yet, so poll until it appears first.
+  timeout 120 sh -ec 'until kubectl wait crd/packages.cozystack.io --for=condition=Established --timeout=10s 2>/dev/null; do sleep 2; done'
+  timeout 120 sh -ec 'until kubectl wait crd/packagesources.cozystack.io --for=condition=Established --timeout=10s 2>/dev/null; do sleep 2; done'
 
   # Wait for operator to create the platform PackageSource
   timeout 120 sh -ec 'until kubectl get packagesource cozystack.cozystack-platform >/dev/null 2>&1; do sleep 2; done'

From d18e6d1c2428569538272b68a0e30705f320e61a Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 19 Feb 2026 22:12:33 +0300
Subject: [PATCH 131/666] fix(capi-provider): update Kamaji CAPI provider to
 v0.16.0

CAPI Kamaji provider v0.15.0 is incompatible with Kamaji edge-26.2.4
due to the new dataStoreUsername field with XValidation rule. The
provider's CreateOrUpdate drops the field (not in its Go types),
triggering "unsetting the dataStoreUsername is not supported" error.

This results in KamajiControlPlane staying INITIALIZED=false even
though the underlying TenantControlPlane reaches Ready.

v0.16.0 includes support for DataStoreUsername (PR #243 in v0.15.4)
and updated Kamaji types compatible with edge-26.2.4.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../files/components.gz                       | Bin 106128 -> 116641 bytes
 .../files/control-plane-components.yaml       | 878 +++++++++++++++---
 .../files/metadata.yaml                       |   3 +
 .../templates/configmaps.yaml                 |   2 +-
 .../templates/providers.yaml                  |   2 +-
 5 files changed, 767 insertions(+), 118 deletions(-)

diff --git a/packages/system/capi-providers-cpprovider/files/components.gz b/packages/system/capi-providers-cpprovider/files/components.gz
index 60ac302a0ee0a3d29492fcd1f7e55e760cfcc83e..930a26af895fb4fa786f851e5f079b9ac2868e19 100644
GIT binary patch
literal 116641
zcmYhhb95(9us$3o8)swNwr$(lSfALoosDhVwr$(Co&5HG?|aXA|Cm!%PgOnLQ$0Or
zrn~VYp`b|hQvg7qMz%Ii4z^abc2)*9CbUMj)^@fwCN@rvbnXV$RzR0smaYfGbrkQs
zJs|3L>+#K!7Q<`PQpY44(sQFmv@_;Tq-%U_F)a%q+9X7X`nR*hBPTsO9!~67UO-!j
zlmHwjwPB)Pj}7JR+oZ>HFH92!Ebhpg-QQEPiBUUXC5B`VZBR$HruB$Miec<MzXCLL
z#yCcL0t6;c3Nr4cOv7o6`6A{68M3ApM979R^vQlR#;vtOGE+ix;_32s{_1a?gh_)N
z;=u|5C>aBIGDnEw2Hcak#f)Ch#3l#%^I5$`C3V9{5^V!Mfw|JF+@r_`g|~ad&S>6K
zbRMigEPatlOd-|yS<y8aWoo?DbF=Zb5NyADze+>(b(fW0_-!9YFxtyql1s+u;g<G8
z2li}(oU?CRI_ZrAa_-}>=5X$jtOwgB7nop<wB2z@6@lfKr*%jqwV*z=a64Jk!ez|W
ztH&uqNEJ>X5_O|>e|#SGU=$8oKZi<e^z`}?b&35V-1tyy(3fkDMK+RRFXan{x_uI6
zOu`b<i~*eNo*l;qcw+K+xi0ahao;?RGrHbJRRQd8+VA^e;+zADrz0HWk+v&5w|G7U
zp~v=V;ciDnXD?pqrb7T$L5yywlTYPDnQ;x{3f&OMdxk7&n5mK5EH18dON_9)R6oH%
zGtI<aqS*P?Oj6Ury2$~WbabcH6y<O|ku)609W0hP-g#`n+gKjiX%R+m<fvO%u_wJZ
zj-G#o;@Ks603l=0WWAhI31Js>!bM@=yD`dTW6I5fEha*!E|dWQu|@)2j#Za|1nLZW
z(Deu*cdmcrmA|BtHKL5SVUE1d%>;Fc4y=^<-PNnQ0Aj)EQ!0D9`CjZy6^h)p*))8M
zG-v2`%>*JrF=(ZWUFwk%>aYF^^S#zD23A&<8P0z04peh^dwKY=^JlRe{@hVJ#CsEc
zli7#1RgU?+6$BLI)W^6ToQo+%)4(nvLlmaU7M<*FqV`$a54WOaSCAkgzNBy$RUk73
ztI(~JVMk_~Ic;D_oI6|(=Jn+qpNU2c=8xVeY=__^?E&L&{8tSD1OqNf#9oyh21BX9
z;o1XtBt!@hI*1k`x+9=H)4Y>3H$NM@$y}Mr@6%u}dp!Jk*k-OaxgD^D{L~X$cz80!
zJX@&NF*8!2uL0mIHz!pzKr(*RQB@Sey*U$#CPy?hM#bczfBUPA0qALZTC{IQ88>MS
zTu0FKW|*7@4nn*v7;;|wKB-!XpWfbb7QUViga?_Ik{88Nf%HfI45TY^v$*N!wsZ1y
zseD@02_+7MH`D>tJJkKX1sW<8#7|Hb-R&t_2XDSM3I)<G&;G32oqqyYcG}ph#NmDT
z475Bc{yrf`R`L`!4d3L3<yY>_I;(g`)HnLA5Zu{gRY0Qxkp*p!@=ncC5D@mJc}Tb>
zH)-eCt00ChN*^qp8xQ-C0E9Y%1q3L^iyanFF<#$WCvO)9*eEpNg6od}6xL>;B*+KS
zR{t3dp2dPlUGU~vdCvN+aLa*+&X5Im9<?qS&~I;hN@U<#&q9oB)<3&8#ttB#63+tC
z{pv7`zrg%Rdgq*3fZ@T#FlXuKV4tBB9jWRWd)F}7U{6<f>=_S8em>3((%A!+GY-R2
z6)EJWm-!CcX;<~R%i+VpQ55^Ri{zLUdLVCm+qe3j2T)QYb<kSna^D@;=<x!0Lf9eS
zw|gS@IS~DlnOpINkVZtb3`s;3730u&cjv}79-fFn$Y!vb^=a3uJtU0N+%z6wagW+E
zOWeU84-Jqre3Wi}yGFO@T=64ngId;RJp68sF7A75IYaTA6MBc{g-2OxMKjT%fs+*X
zSK)vh6`4cAD0}+ivLc<jQIcV6=1&RJvCrH_g7kZ2ZiiSTE?k&Igj;XKwaW;yi@V(#
zY9am<><DC$iZbit2(}*Lg()EdF02|T8M<aj0Y%U$YH?GM8lDNXmrSwc%rQ3XoHTH=
zI!K=oX3vP?nibBt^tS9;7x{s3a$gWFaC`1x=>YbV@e4T;x!UDLiYl<&{dGGJ2@HvU
zCN;MUl#u_+9Lgu-Hq&o6x({OtelyIg^mtf(4)}|^5E#2XqfclD%r-c)Xe?Og$M|Eu
zcI<-)IdrY?ju3yd*QJts2`YeyN<g2qtY1)e98-{-C^l>uwU=!VrWqf8MqXZS$N$ku
zGLvWudKL;1h=DM2xc75wK<yxmO{Ce08y)l38T>xc%{K%@LjKAdyGVb&fubi~**+3z
zW!^b$6Vx5Zl&KXN;f>-o73jF1lc*1f!bf6amrU{|fcwzs7CGP!qjg2{LAOztaW%6#
z?YytJ0%C(@DpDC@gYB=uBviF%<^-J33i}eQ-$ads#8o9!<ZY@{es%ozd}FQ>W^>=V
z9-bRivI@{T;>YVTS0U10F7l35W=92A5KeH>?^rqcC@y01ILBG0Y)n{@Vw6Eyf-^w)
z`otb8ND-8v67i{#gE*)OAl#EdRvF}tCrGZIVrpYJ!1d-Yc|NyMf1y&$UOUh^G>$wg
z8XrSbbB+5#@)Ax3c7iB7;yTI|Y%&U+q+p7>Y<yWOj%k8@%GC#e{p8DGEmW<O*x|Yv
z=8DA^5Zr;E>nR(I8k=8a1K#U^SArlB@ib-FjX@BWDj3Mi8uvA4a{y+nG@Y)_;-oV^
zn?6bQ%oVupXS;s-$F=&sQV{X77u63zzXmT}F<K6^RHCVp4dhW!vZ>}apP}Yr%hCsX
z7Y$>Gy)^!P3myI=w4B-+M(Y8Gz}YkdW0@7QIV^GaeoxjeQFL$$FP<UR)d+hp{eWa1
zmP4ZR<N+@G*rZ87cnDM2ualdAm-6pzr;v4fzBVDfh#JiwC7Egv_ed>UQ&Va>G)|v+
za^l}aoLYI2<?Q4(y|&yMH4O42UT>-$!dhMVh<l0Xr9hx3**v#SNory!w=xe%2E@+b
zGBnA3IY3kpmApy4gP}vd1EkgAXiuT|EQnyf^S)oM8*{DpgPU%L&nKU*C>xAV@KEeA
zLhG!{%e&Qgy@UGuO5%NtlvJj6X~&<a@ek_*(H61gbs$04eiAW|Uep*}%)ncKi1knV
zaEtr~nE)_VZ(*G~fQJ|TK)tz1W-X^<_Ud00D?m$662iJh-v)#cqtm=PszM|uqNSw8
z-mrD(3+~Hj(A;~7nE+RbAb7i$$(Zq_FJruaqCF}p4<VlJ0LYX;4w^&Y?VK}}u9*SU
zWitF>!M2}N7XmCjjS0H*1LMLDfMsQpylTyQpa)XT(+aIuVQNEK+vRgcX^^<p_sk=|
z>ZoROHkrFW;nNJWuQD;p9)0LQ!PuysDRGNj9&->ZZl*R4wK~1H0JZkWxJc;i-&56y
zY<chuE&3Gk?G@A29|ZG@=XTX!#)bQ5V#wc0pcgdsAX0xtArE!xkSP6nOP077BA8c>
zSV%si77H4}4eHC(HBPMuST$-)2UYgBO5lxlOL`tIG0HDg*99_tdr)_Vaq6Oy^bR2_
z=XF#72o#790jMc=k?Wx~3djiVr!SMV`s#1>77;o95}P72G_5qPT5g1NAzg6KMb<D5
zX3m)1i&q1DYcdYhXGME|`pBWrFJI09BkqE+=;9t)f=^vb?TRTg@Jo<JN_f-YDm!Oo
zk{v{M4F9v?+<cSua#*wc8!*twAAwpliu>Qq%-1#;E835(kqFIaK{o1|*XS8Ln1F`w
z{L8E1paIOm`}Wz44V&${rPJYQBMjfFfaWbBu^xM6<?cMvK@fOW5?T21pgNQ`6`;CO
zYbaJ@g7-*mq@mLNb-(Jqv)P-_q=(I0H2MWLdt0bMnwg{s?Oz?t#7*(5+}erSYv){q
z4naa_qcV}P?NHyCwMDi8TR&#>DR)m{x?c}Dfm?r=r>|{p@qhfQML&bGcldm?KgeEv
zzi~SAYf`wGnfJEOZ@w^hv`Y}i#>Dq1qak?=g?%4bKpnn9SKy%ix9w)J;cKl|?P}q?
zZK+%7fp+IWsz@*D4LvMcU|l<r!08P#KTtIH;!z_Mbr`8hVowvPkd-1DYe_TIL9kL7
zV^skwCRJo61p_p+$o2L(S>EEU%%JU4eBfa}gmuG!mIZtD=b*Z<^}0Nm1a}eM1p~@1
zhV?8B+REpD-*;eHI1-%9^Za)cbW9KvX=!lNin@2GRhiJu6H*``&Eoko$?<^Ey{#66
z+G>hLGp|u`@k$h(TT&U=!8n%?fB_ao*p#V>;HJEt5<{LC2vijK`yGLv3EEjMm_3ol
zs+tfTuDAdfV;TVgs33x0q1mVigxMJe?!H)4Nfrt-pOmE4;mpOOF?$^pHdh8S!iWbs
zT)S~hV+ybQNCBz<%nWC2u=l_<;Y$iF^gh&#(<8GzaZ*N(Ju+)$-GhQ+`~fb#)uLTy
zVJsGS#y!K<vtZT(gH}WlGjs`nPSftU2i|(hu-{E;S@y-dWWG{AN;x?m^n4$-WH{G=
z=H%ci7p8QjGhP@&=1F>ik;YNGEcM!aIG}_m1r&Rpj~nI?UdiRj4jXx>imY(&iYYVv
z4N<l4>cKVh>mHFu5To>Hi$e(i;yHZPfSQj)fdm1+W@~y(enX{e50=eQF}LL>W7qfj
z`}vK2;H&2O*~g3Z^FTi5=F3{d_w(di{iEj;A?N01;AY3i&DGuIQ@QbHB36>KV^6;4
z@{1zY*WuFG_ore8hfJMYXf?<n9nRgvHh_qF!=N{Zs;i_yonDu+>r7@-yurb=&XWQm
zDY&wgz&g^Q?;2I^`N^%v9_#qj5P#fV(6{!6nNC;~9e%2JAi|%+PDGL1YZ(cG7weNd
zzppKZUQ-~50w4<Jjnt+OvN>i-vS<c$omcK>>jSz9+9(i38<--bbkBh}$UW-0XetW6
z*_q_MY5<Z99PD*ou*Q?jjH}DK7!Q|mQ{EPWV?=x-?38|R_9?}%bJs^pF^R5<4I{U=
zeeYN!qPMn=IYd}y+itnH;dKeTKcn#0ROVMeg?5g45K}Jc1kZbZp#RR1ijD-ia7$cC
zJZ>K&PR1&%oq8}1+S>_gn$|8)y#tCHJj@4(@mFj|8<Y(rKc0K1?z?yOyV7IEG35T(
zkA<u>nT^<Z8iP>#?c2h=eaZ;GD(wx`%OHEY<BOY$315Xtw{vH?<bUy*653}FWtu8{
z>WgZ!+|!dZMunvN;{~A-fM}Mae8|8dMCB@L;~(lc*+#hEd_tEmS&yZ35t{@SfASlc
zo2L8_?uk9oc2SZESeKGNK-%?5WXTa-pje-=YKHdhv(lZzonsof2wZD#R@v;!==Nab
zkOnlF45H68$qbgiw4XKhhLhpv(CTS+1jE7`{zC-z>|C5d7)D1^YeKsUaCG1_Zbn(V
zjKDuy0Z8Aj^oknhmLA#ZO>#>`ncHJ6a&>Q&IRRwKsSW(@a*7GEOA=v+<x2#&-pdmU
zDaK4aBnlN!o?)1g?zWLVo@=UJS!TW|u*BpGqE>CZ#n}9|?tQ(3r(1I@aN<u$)0$@d
z3&r8j3J)@{3k!f<AC0(S#D=CWHekt;DZP4oNrg6hN;tzX^C65okyXFpO9wTETA7kM
zu)lH*iFKA&MO<!H_JcZGzhmkB?lI8{Taxz^!J5LF)tEuIMR3=vBz1t^fFD2%-du`h
z_@BR%Q<672@es5Jyh`m2QV+Ae;uGJ#J57W7`>~s(kqG2ncHM`Ir#d@r-AemQ4JNh=
z&u0lo!VuMTHAawewPLz6$)G!+5bL>>&i09bHwPkcD{D?@lpZOPGpDLwW6@9Ck`{8~
zu8NF*22c~O^N#iVX3m;u!>lhj>hbNsc6k#mtET9wT{cV;)L)n)<6oH4^yRWv;CQyQ
zife{;iso8RN9C)PzZYg@lKBXfoYRD^jH|k7P?Mk}=tcWbPaP)Z=kAmwoGX?lhY}@)
z6)XxM0KMW5{@!Pt%l-=H_|WliZj4Dgq_SXBktl{s9ALk2H?3<wOj{&l?B@w@@p?_e
ze;LdcHyhUJxwZAeAQ#LRpW*&YcfRZJ2A>O6mGvRcn1V}M+*HRuNkWEQOU}|i?&P-?
zVxSPe`e>xy0?OyDtA-4>&V4{q9pIPHYQ$^wIHP=H)HUIa(Hb1%q){i*TYD2O8c?d?
z5RECWsZ`73@9vGG6Nsm<@aT{Wc&sx69rRjM>sN=q3--#VSpSuWVjSK2vt)d@#{OrH
zd3+JV7P_CGVP2_6xE`edje9`azq=h2UR2BCj5mT;k0Wz98s4Ig@X_Ogt`VHuEE1@t
z>`NoWxJwF}gLJX-S!&N$6tu)|&>p5Sy=?@6c3q1}Tm?$hlf9Ogi(v?Vb06bFKrZX_
zw#aUj3$I7<^)?M-jYKf-VS_^bR2l-K{Z54iqMfR>x^sOn&f!*%QB9N!P3(eg9>^dg
zQ2gE@hU;iteQv)o)wZU1iDPy@5zbya{pOrAjgmEHo^Q+J5>7nzH%y5`jbbMaM0q1v
zr#@Z@&436*#81X(5RrvMMdbi>5_kCM%4uf#vQMLg^m+}LPnA7IJL_|93)kZXP#$Va
z;LhY(e3gfZKs|_`-9<S88^Jr4DxU1)!@WfYZ1(<Pn047JH>hF9n}_a9+V#yPnCB*p
z7)deU?sY=*YW(i2ld*E%%q*AQ|D2++hkp$1D|mAmm^xn*C6b1$Vg#I?rj;sEfUHF^
znJiIuU(FZ^B=L&*ZEgD{^n^bL&xd2%EU8Xc5OvpjX8znp+YJ5m?VxX#H-9DYAtOmt
z@)+Db_E(TU7T<69^~ulyDFLkyk-(qi0(<+c+_n9+u6g?BO!YxROlRLv(Hn@a_qB4b
z?9Fx2Q8rs^SFrVZ*Jq>7`VKcE+g=z??Cq5*-4*$L>#K8<tNlM$7YL6i+l%tMqE|P(
zSC^v4r?giccN;G;+wJO)#9et=4@6C#{4MWr+--bqZk(=nHa2NlJ?xGd=nXX+rWGB<
z9T~+9p2v|+6PK4UXE9$Jk3v2k_#%*<7B6hqeNRUL7s*}0IaAWF;hlkc1Y$1E2r#sf
zcXj1@y9UO~H7d)vA%$9$U=s)zx0fPGiW+k1@`A%C{v9B#>1}{UVos>PiHa(9rmyS`
zgW*NBy>F_7Gp{S_y)L=e>+K&$7fS}yv?}J_sV>&bDCt$Evc9fa_MSQ}%>I978sOBm
z@0VXmTLO(}8W40Q%3a+~aq*lkaPd4sLv#N#JVGHWp5PHIu>T?3dwq_D+k1KcpCk0C
z%GGW5-&Jci%gyr$kI*$BT=g&ZpSZcLt^TJ;|8u@N(T;Wv3@Bav&y8B%-2Mx-!;Tcv
zXY*r4TX*@}|EN4}uvc|0t?pg5k&@!LQ@MWN_$wE_60QqlL(@g2t`WsrTD>%UO8U^-
z#qMH&2%e09XxG6ZQ;4rUPcm9)QWI@!pzM+cVMTy!a#;VVDb0K>z2&Jyz0jy$)2^Ou
z09!o(7D6Q?($Xfp^_*%4Ve#AGuAZ|tVvd)eHqx$h2f(;<l<Hr!A=&fi(s+tW`m13?
zN}L3$8e`Eoe_snp!-oiS!(ksFwXT+n4h=oPG*EsZz~p42pLS?cjHjg=r0P{8lkb~M
z;&~ka+YlkIOqpaCE@Ei25XSL>bAkM4Y+nu}S3PMaMUW4l&{^eJ0t2*xBQFGHSxx@7
zqzg_>dUs-?wVw$6*LgPbc(-C1Is*diRk}9?-RP=Ycza4&-S~pSJ_BzXX)X(wan+<=
z5q*9Dvj#8(Oi$t6E6BG_kc%>X@zx))qZ1+Rr}R%9)hA3*L0Z&e$=jo=d{ujKd}Bg8
zYP<tH$JRw`>EvR!M%8Z8;ZCk{FG5|<^5ybs(ssG26fGvg?A#_=>1xYAsMgC~Y$NJ6
z<xI#o8`2r-6QDvS^$tLES&tFW6A%eBv?s=?D|#n7!6-9$akUL>s4$m!Y;u+W3tPC9
zbOpvMXJsZ>$nvITm#gB`3}g^s)1IQtV06<`<Z9VbJx9_3IP!SWWGPx%D(-_#<HrU5
zU92juN2fM};E&ICT2J0N(5~QK1EY9OBH)lAwsIq-Q@GLT--OxxxlGj7szkr|$kP|B
z6Ne8WD|FOMNAb(0N3py_DynrY>t6Ct6m?ZX3sG%2!tCJ>&rLaXDVTBY<-`&w)qtbK
zs+wfNr$7SCWdUT2ZxqSkstYZBGi;KVfbDJ*SW;nxD48ZG3+h;a-{p>Z4=s0N@+Mdn
z-rG^Yed^p1%qZ_3Z+u<4lUBp={FOjbk5<Uqp6u2fIvBjE>U^~Yd%QhF3{{TNJ3}h?
zmxE5#g>MrEcCA5*XD@mNad!XidyptulCnP>=8Qt!2ZI4>6?isUX|8YP8d?Au(KaVN
zG^tvm8)_{?jh6U^uz5)E<#CYffD`=Yqru<A5Gxj00?Db@a^g&tY&GvDncfnQ>CMuP
zu1FwUCXOSj6MR}j#4sNDfv`^)niPHPaX0K1MF?{wA8yrjP8K2?Z+BJ?kkQDVeqd&V
zeJ%f?w$1s7aQDRCU&-(z>Aa4}OLc^Vs?Z2YrWjCIs@ZrH$%~8DPpN)P3`1nQAf%?3
zG2(Xg^#?Fun>f@Z>egl3IJj0_RPAfb6=dxz1lyzut#65VdJRPMyL~R(y1_bsdtt-&
zJqtJ0R7v@P<33nuZ~5E#ZZ}kpZ&AH*z;9I27GI`CV_Tg!-F4TLuemo>j4=khkIv4o
z{-}z)kqAP>xK26}I3UeOpy4QVRFMLh3MU+n!pb+fy=oCmjRI@%U;p?AcGFiz%vr;p
z88(FED-{6s*7npHv^8#IJrj#Gh(VYua86JPhtiiONQ1}9nQpk#%yw5g)WGnVSL)#h
z_s*Fjhl~BSJ7*6&nd+}1R(nM~uHWE7uIxoDRRvV3v*(N(Z-z(=@MJ%C-*uj+uhqO-
z?L#!jx)s(a=DYoV4l_>4=GC&`^=!<4x{O=$cs5tPSS!fpJzpzGUTzS_ZJBXQZn~T0
zowMXv4s@^B^3kU~%+HQ~ZKv|;S8F9zGl`K_ng^(>mt#J8yuPbS_tLaHU&1~eD;qAL
z8iyti*FPz4@3Cz}>R}GJxLv{qUs%C!u-le>46d?SOnzcvqcD=72>sHDG2bxJUX#u9
zr3U>@B!uIQNW23vSji(R__-9OTqTDa$Tr@1oQqGHwi`}m68j^=;awI>yqZuj2IVs!
zV{_yMyV^EGJ%#Vk>bHJrHo9#5h`))bDj;w8iwxD*3A-#Jo`c0bwZK*P1FsF{S7c-V
z-n0(XmO^)!CAcUHGQ|ebm!#d}-DXjH#RKVf@QBJYCJR%1k-7UaH4O`~>ct!gM<@rJ
zm0g4tJ~xl|h1yzj)oeRZvbTgtI@OF+yxs&gskef}Pk-6-F#1mT(|WLO$E>?(mrLFX
z-J*8QpVKCoE*FEXg&w6VAzQD#e`V$MTx<~kpF$7)pK+1>om4L_Z{c;PxkIdW3;{b}
z(o_*h+HX+OeibMD^5C?|sSoA6a&Zu>5sg<YEY~<q<>@85R_PEWHF$*u_9KNnmWM6@
zEXhCPZoYTd<<-+C-yO?-eh~fcRzM!X-XBy0RyNsNiNIeU20h;^Px21sujY>mZl>1T
zM~zDz*@cs{v{EwYm`-NJVrrMT_Sc^_7+=-m3Y<cn+9oYe9ZJDlYx|jX<50ceY6c%s
z#G$@hog1LTV_YaqnhYvthM;nh8!uF)6W|nU058zUPpsSeFi*aMqY@G#m89&BRLtVC
zRc83h3=h<4&eW;t-Jrty(NMhd*Zeu%_FB?=H7c2gd;?VrywEst(OHNpuMmP5f~TAb
zayx_7)}z5{r?cUz#YgOe8ci?TqR}c>WZ|DB<5fIJ<L6b1O<PUdkSR%5F#<K^9Nr^<
zlVX;E=cgvckdg>iMu}pvfu~xq)&bb!?zC1Zypij&w!uYVNB=X_?Pc{qe={L38k_GQ
zG&X*3w4S-Xhy}?S)vn`?Htcn^eaGz<l4?zx?lP-nZE-g**s+G?ao8yt1(1xNKra}@
zz#kZMOcTxsc&RPxpJEk0HTLX*8A>Aq)m=Yc=A_<8X3aw`#fj|WNwBoVG45M{*)Bo!
za)zvgt6V(ppIl>qM6BkR`p@fGTkZ@)3vNrFE?xIbDl~29!5uc!*Q%E4+P6Hm^y8*q
z1PXqvm&7M?#M6qD^ct~9Lv;@tc0;K9V)5=FRAvU>R@2;Lp)v=luy?mInZ@i!I-udx
z#8*7}i9xkj<Gg9OBuFl(DhQmOInx{=OK`U?D)nzWmLLy1idFBf`xOcLvAUZ-9UXIh
zR=CvrD)&_3I6>*U-K`a}9Y;L1(;OzYgLD^vUqqBdKE#9>p-(?0B```7QxMHc&SI{6
zw{Uwe-Asy&R2lJ`<Os}}D3~4&Hh+qieW^7e)jUw6M{56^l2@1bB%Ry+g&vH%Uz}d{
zo*m$jhm8Cxd#o&n?!{eJu5d<Z7`O_;Z#ndy-(&N{i_M|%HC%7z(3juV8pHN;kl)K(
zm(I77_WO1tYFRXqKfyW6l(hVaT6bA~sPin$meVZ*q6{jDe3uWULLx1C86mr{3&_(O
z-!_69cQTlZI_Jr!tcVD2x)Ug@^VJSi$hn@#y)BkPh*%4~0G3ysDRdcujwWa`2jyAE
zeMF|dcd4-?d&tIgzxnyx`O<3cve?~L+MD-~7PT!i2Xqzn7d<6MEXR5Nk8S7H)}q4F
z^3Ol_pMQ0pI<`ecrGLDcR7X2g#ini0!iY1b78;D@$+*?-sv)eSIqaRoU<EBR#R)pQ
z{#t8nd9+)a*h=K|E2-QKI?4S|+ZDK!`c%)N#J8h5HUdfjw`AT%iIr|~X30k;!d!#b
zz)MaNyrRLl4L=5Lo+>&gLYN`@9@Pm><>-$km!eICILt2E1c@LW(%&%L!>p6O!R)1S
z=pPN2!lyVOP2AWcBib;DFp;AMe}7HF=p8%$X=R2|Np8%vrB<UOMuP%gMOEGLyu;!x
z9>(ENcAWJEN4M<@`191eDJ1*rPUHbvH=hnk=^Ur)*7pGIoEzlPr(cKJl>V6}<xR|E
zO;^8<(l!jq+6Z2OqxHeJ9F6sc_8lLn<Ty_f!ZmRns|**;oghz$`T-LHFr!ihii?hN
zD~Ka@alrl$qX1sG&|c9QC9_l7ttaO|PrOUQNCDE#yWcfPhgi0A>%12NwnfJyZ4ng)
z0t}~$FhG&8DwaF32DR(9@Os1M{(FEcUvS|^@(Z$`8<*r#XDBgA+*dPP+ac&C!NyRb
zL2joq?dbvQ5E^SnoiojNWWI{Mn_mqNolr(QCF$8_6T@Bd6w))uSP$9#e_zIo&)gvf
zwj!rj8fXLm<iL*<J)PO%rO?jK0KIS=XhULLNR?;L?LJ2hH=nRIx(j_Lm>S=^CftB{
z%A>wN6#CrJ6CR#uX71&TAo*m--OA(bKY;D=;(f-Pz#Y2M^508cql_<vi}C(}njx1j
z<_fxgOgtZ>Tq+iF&L)#NQ5UM=3O=-wi0q73$Si>ySaXA#UI^W>;(07yY5$PvTxoyN
zdeObuw%qcp@~m-owdq>+K1<TQ=w9^rAA9A>Udy$|E}72m1;>C!9<#sx>^8{^=FeMF
zDKF1}O1t0V1eCn{uRO{boaFn~zlpLz1#bEQo~Z$zP~+0!ymmC0ptV1(^^9!yl@++e
zHp+<7CnkARe;%KVnw9yBUC_Ld(w44*QQ|aR)#TMA$>?hYb`fA=9hlaeSJ4yCV8$Q8
zP2K~TuC9(&qidf4>+dYqv{mv8$MgS`D&m*_0C@U;GF>~Tc&gxkBeXq==qVbyzo@9_
z9*@xe&3CGnS@cBBFDX5RVscw=!8AS4;0u^>mah5#npo8ShqtIaCPOcINDs9yYg7H3
zeyk3*Wv8^L|G1MQj{iYCTL0PqQ7>#~Ghspg%Q{|AxclD@{v%CN{@2~crtaLy9#O$G
zt=;hwP1RxFU*3SU?#4-_3+ahUz&|~go^~N6`7B|xt(k9ZYkZl!O?&B`#8sO3S@Qay
zT#odP?<jwgyk2hP8~c-Uc#RbMQe;y8JhozW3d2@uO<$xhtfy5>Py28qSNuNDBzsk)
zP~P1b_2u>-`i~l5-nHDd(%#biZ%jE%Yn*SIuDh1EEdGIYPg<@^{|)NT%Ut_E+JE`w
zUs8*B|8-GDPs{Wva7JCL_z2h?;SlS!qyVE3DlN-s3p6dr;Yqh`@A594@68SM){_5H
z$WKEN>|8UL=5?S*2FN6kSRcNg1%BEvPJ*fl_z|xSnD#kJuwN2?88q4<BlccuEn9?<
zd*VV7VMY!}{5PXPGR0zoV!0<%A5<rgd-Fv||Ay_=eoYaDl*R^_xd3Sc=|0tRF<SXn
zem{|oD9V9+pEC`aB?{QpJKi?7&O#ZPL`+h!9py3Zg^Hi(U@IsG4<EiWj~7>@`1~jv
z2LXd27(?jF+@VlN8V#0ha?u$v(&8{PkYi;{|2gYIg{sJqf(;(vtI<sHUY9Jv@SV)9
zYpiL{l$);lu6{7dF&6ra)w2p|TB~~-7y7#QiZO+#c9YVtObo1@9SVDQ9gy#8iL}De
z1c{uMtCDLC>aZt>cxW@%|H4DQ8%PvABA{Z1OUp4n&r?$iQ^YI^i4tsV=cOM!#nE2;
z5|IQ2z%_$X+CsHqt<>6P(<|WLm8>aJMQc;Z8veH%B^DiqAJ^AnNcN4iB;gmpX<3X0
z=MBba-aQanL9vxiu8xR0LSA<g<7!0~g8^gG9HPMv4b0lg3=Q(TR!E7)l4Paz{cmz#
zmcAyw2D8v5#hygEbIGnDpWj7|qSBqgIYNWvSU^`i;@-`r|Ndh-X0LQa<<dp8shxG;
zr1Rq*t>N#vMhVqbC99)MfE0}0Th}O2y90AHr2FmvZ=s3&DX=pqkN}D}(H-@m!n8ip
z+zZ<T5Kut`R|`b4FNZB&U3n@&cAy<qXGB$rH2+F4IU#h>3};HZhf)wYQm|{SwGYDg
z5k&@bsuWVMnQCeTHn3m@N(;+?ntyKPPI2r}_H1*AP<#2ojsw&BkoL47*MSa;10@$-
zqpK?`Bf4OCI(`m7!8v%X-C0hvyDby3d{K2K(%7*ks<)?kFx|pPF3pgNDo{zMa6X?m
zKiQ)Z>x<(=jsdX-&PJdFm((q>4FD)kKCnYVqVn_qJ5=^>#{)8W)b>7*LQse?NOx$q
ze-9K5I<)rygq{lzIv8IV)Bv(a)o@uMwIm;m?@)QI^#C3VLfm~^HuH>PvXs?2q8A6-
zqaPVBuStC9iz++AoajmyJ>JpF!~J`uA(p%(h4<);QeNI&tx-Pc9_ZaF;=EHm!Wo8m
zN|Cxo@j%)9x#caai=f|N#BzdD&c^?Hu@fymDFI;-6c}lWxTUP)qmU#T<aWG_8xS35
z$zEiqPBS68_Ud1y(#EBwk~|Hp1GAny5Lu9r07O9;G26QX$`|UO3)bPgZGE#L94&dj
z%H}e9@@{`x-JT1iZ&T1Xc>q~(s~e3PdFr=}78-Yp<B+x`ws&4Ig<jpSx{?)H{sy2E
zVO=Gw77evm)5*L}DG>h2s-AIHFC1`tl3v^kZn+GQC2=1yknB!<cTVO)d8snE052Pj
zns}%ByRGVxhLw?vF(cKJg;ouJ<ii(O3HL^DyfYr^=ze9|P)Q#LD?ZK~V@|nEvRRgK
zH@Y)1H!)yegtaC@*XqgVY)5C`0bCLO`?DK(_o|tLUY`2{O_k#6NWo3>$X3Yt<cZbF
z)G4yfz0uSbQ70*Qy5EVkKZBb9np4xuPqHh*PzG^Ht9ILFJiSy&6wuR2LJt;4{3irg
zK7w^e=);<s>`X;kS6J!m77+-Aj!9z+m!MXBoKM{a4-v^d>JupI+m_hf)h@-9eKhAl
zD5NrC5@8h9`&RpXhK-Ots{vh2oTWqG*){qRyWEciSJ{{lPYr@>pNuEPDXF*)#l}F`
z$H(iM&ue?yEmk&9nqwtejT<>EqLev=nu}3>1W5eIE8En(CMj5;&oOA0qtutg`-|YU
z<1OB(#Aowsp=HGP>t-wG+vZ2?1+PO{8-YU(m6n>=$(y4{b5?vv2rtAytNu%0Kv&6x
zPsnj)EbR@7TI=)hwDZc>5;*0BR|2^z4fINloA0SvG80wqNM<%i?|?GvSFW4D_jP?K
z1x2@9k)w1C<hz5x@#%AuIB+`r;(?ZY$$=1n)FKJiPqlC_-V8qd-PYZ#xs^ii-k^E6
z=y#lki|JeD*yxHWin9k=M(L|TdiX_K)&rrP)407u<kyKaKkN`z?bFlIU5+kIx~W={
zZb!2bMm!p63krMx%->e=aLS7{3jb!4VD<F9+z9n$C7&WKvvAX9)-TB=jx7s2jG2<d
zLoUY8^YH@wRD}wjcXUZvdzMIOQ*=GwJ4j0*ZBm~<8stN-dXXHiW^x^%%T&*>dFB4h
z%y;zfoIU;c2P#yQ$wbDrCD6HoC~U_`_f#?WWqN0zscG9zmyk<!=6=&s0G)`63y_s&
z2JG0pWy!lIu=XUr*Qn0WXe?NQo4E@jg0<Iv1*P%&Mu)fw5`8tLA<RCh0EUFjS^Y>a
z4?iTyKbVlV_Yp>Gk56pT(tjhv?dprGvk!Vtn){yx4dNu(BTtGGeo@!v#<+?X{K<yP
z1dg*x*1!9xil^4KZ)jLI)K)4ZNoEqX-h<V=5mjg1f%*A`!K%*1R=8mA)wsTxGWHEP
z>8i<5NnR|lkYF^vgM)-tr3-d)bnK<hE}4W;w;sXk;etLn5^!ctAJa_dO^tPccR)Vx
z4Rwz*?Nx)FB=}5!8>C+@uKQ%mQ0`|EhQq298XMU-;G1gZ1p&B5H^n9;LRd?vPwi$P
zlwX9xqI#*GbZn4_ADps{d+&GpKYgA;^{j^ICLty7JizMz$wQ4y{ESZq$I5K24U7xB
zJ^{#yp(QZ2leP7@sKbG_37O5Z_x)UcT|MZ9eCS<WeZ5+|j^yy|d~Ae$zs~&IxAvXG
z=iAu{-Rb$dy}rMEEiwN|!B22-8OZTj`%uLDIb0q4{#MW7l&=#T-W3S}upPqr2w!Fx
ziF-7(@AtQLGf_dC*nH7~blk`mk-sq2B<g%@+e}6c@><Aw5W?RKNj__7uxnlc?onUD
zXpTw^q2@xO>pMK)w=ZcGyGYC3N4I|;Eo#v!a-|ou3p*FTOb@hGxk`YQ-yw}4b#S5X
z!*4bk=UZhRap{SkdR=Mvs<v<@JK3u(#-kvXx^vMpq9+wpsCDc-GMk4`zDKx&9-)I7
zod-xp+hXyp8<%O6-wxL;yXU0{P%%s@hC@Fo#LTUgP3>gV>z(qp38f)5Ek-;KEDcn*
z)z2?^KJ{4pDh3H0RT#HL|Hd~WaY@)8$G9Kkj0^`npzcnGV)~Mh(>a6#S9rmmN2y!N
z`();GvmZ@JIv?cY4G8kGzB~?QE*!KLpB$y~w2|`5jSc9Pz_=ccV7lAW$L{I)HUANR
z*|=@{E>$%N?j&zR2uYt9G@h8Fa-dmx0d!O~jIKuu=vDrX^gQouep+nH`{GtM3zq1?
zn(s8Zn+D*afVWc$UY6qNNT~pj?R_CKsY?PtvGOo2E`kPEof$a575P%dkin`nK<pKD
zTC)TovllS0{ZGVY#`BX0)nMkDNa_fWhsrP(Vl}Zw++>H4B!p~b+acLL{-6*X>!jR)
zkD|$L90vun_%|@c%qSraV6k@ciF*k_a*yCRIG(q@dGR~2<qo{c@%Zt0MA$P2?jF9g
z&`xU{TKMe5*zU<Oh#kTerG+5>Mt1l;_e}uGL(%a-Ai8glew2~OijUCLQ>6G8r$wl4
zL30FYGY-L^lTm~Zc8s}gyuds!nCf>`{7Rezg2MDuT3exWFu19q4sZL=uc-?Zowou`
zoo4h??fNsrDYNziKZ}jw)Hky9sY8q=8oR2<ivZ|-EfzvETcU{uD`+<aFv3<e#mtru
zx}^h{ILf#+8YzjY0W?pCf<AeJRMU1HwsNl}c{z>9E8;&L%Wd>r3}EW^Slfq!X()=5
zk&+A8hW&>9fy;#L1#xeV<^)z@1)$8zUm|*q<6_r3Y{xpc)4$wd>6e&N%6lEBPedhg
zc$(tAkw=dICK+B~@z7|CTR2l?bn9BdPL$VR!0axnPpwN0l|UHnJ}^=r1;Ud!We4CT
z{N^eakbibTaCu2#b7v>7p(!>cPQo6L;fn=|z&G#i(4g+VWlSPO8t@XeNTOmNAsC$#
zR6aGH`K0AjF)qq)@$Bfiga^?K`lv<HaD-?9B}*}MD|~o06_CkIl*r<NU#dg$xFDz#
zQinxb@bBk7gs<DU^HwRnMJj}@Ic-d<H3;a#2x<x}L$PNx;U|)z_@PfLO4K7!?6E2f
z5reecU_Siy@|)o=TX#a$3wkrwx{sr~JH*Y}B6%KtpzBD=dRt^88<TKsruAQ3Sl)HE
zsW*rrfD$X?P2ArD3#}KT`8{BAvx40kKeXDv)b_#iEm920(l1iv+#HAS@hChQwuKnP
z^0BF~zVAm*&weVFm2%o1U=EI4FvS+_Pb7HIIAX8_R4VvQ?m<iEStX^Ofd>y%OE2nP
z*6RuC<yi2T>I~74=LShPYNo?8MaBT@Z4<#;H6>|N&gMV)x=WHOsCF>m3I|X&ey4h=
zA%K`X=fgzt6=ezsPLd-lrBao1RW+y}KO))i;e<3;#Tc^}Csj?nx)13LNn9J><3Htq
z#(#%;@n5vZN|dAr$SDjtlYcMq7)ZQvqz)pb^)hI>x;^pPJ_fkNL_gi_UmXu@j0Lt(
zj~Qn9qLCcI!gojHOh+6w+{Qbrylhr2f1i88FfW1C*az+Sz8&3kKb|6#RCt0;pB~;m
z-kwC>#8U7^S+Zl_9T(-AnvE|%xzU-UY*MtcOO`8j#w-1<1-nr;m{6N0bg=$a;dOfQ
zch`CW#|=-K^X0gQ{<g}4u*rT*RF8T{t4K}}nib0uyV5NN;5V|RF#_YG9{GeCQXv<f
z=9I<376U}!@ci*}4}$Fqatg_AL7D-PMU<&mxF-wwZ>6VchsZ0qQl*oJ>!9y8SB_s-
z&7L#!^`}cM*}Gsdh9YZcv<(~Gk3<+-`=VJ*DaV+~5}DhbIn{E5@<H3?ZI;HF4S<3Q
z6M?0qkEc+lB*Hvq;vq?|eD<T42-Z>2MZE1MU0Mx{!Rxs{kWG=Fv_!=2`CM4U`*L;h
zN%6NYlE}KNxNC}M^9qZ2CaF`5I7GuTNl}gpUJf#KL6rJvKK&>dS?7@SSi$(o0;JYM
z;5pM_IvpWD)`V=sTB26|v<u_{U!_iu!y6;0J5hA>-Of5w$sPLfehZpL75ld-(MY>2
zhMYV8+4y)SslW}2E?NStG%b*Q48tX!aM{Qi?y_~Nz9w(e0-f*$F|j8~J7SsfTET8-
za-pIqNx!P;sJ~Xdc5tsnxRdZ4V^Xao0xHm|{j;UorjLFnv8Ra;GX8`HPwl`Ht5Z-!
zCe02$@3#I57ZOMB`BoFT_>-3CY2r+N3(zxK?>5M)HW0S9E$}6+-&9o#P_=azxZR%%
zTE8yv+W!KMmn&91VDydtgJv!MgXwrSwShcg^lgEyd@BCsoZbZ2lFxX5aPdRepM4Ug
zbAaJ|2+ancX^P^WP$@f1>scUis@oSd^Ue|}tN-St%{<-=R>{&yAX<aA74e&AEK{U?
zk;_V$CHbviYZd9Oqk*3+RWjK~RmML5+2E9U(a2XiesubRw1g}95Eoc_u8P-iRQhkd
z0QQMDBf^b`_&^nf%93gpf;%D((kfiHQX905CnsV!5~YkWd0kda$RlIUNyNbis0Hpz
z8FP;2LbHNz>WRpiF~fSx_}KBnGj+UuQ*_3P$W!-W)iHgz8Gz==l#m)~v6awruYAWV
z)pg=kLfw))L5a8kz-rkqr04Sqi#J!BrWioX$6cmYFgh*{AziR$<5Zx^uPbcayT!?-
z1NV?0qWyDCS{qm2q`}3e?S9`8mljUx_tstoBOUa;g)WDE-JdC6--h4h<Lcw0Qn36u
z#11wmu8g^zNj)(SLD^V=p{x!~T%xxkD`$SK!)4tl2)}(|Ui&sCXVGtiy_;}dHev0O
zXMt`x^_NuZtbW+sAVyTx#jPGoATwlRqKHLj8q96}-U94p9yoyZ#}Tze9g-P%MJ*&M
zHotuUQM^B0q2aFENHQI{s8a#n&JyE}I=nT<6b6TrZXR5PC#<o8<d`IwGeKYcCa}r_
z?{yYJ-CGu2-&adMP}~#KjS(n&8+>M0bGPrEr%Bwuhuz=S<9#I2%Oer8FY+GmROxDL
z#!^244^+D*cJGpO_keKs4EHw3Ft9_s_qYqVb9z3B-&w8hqhh5?_2Q4jBpU5^hDr&)
zR?@dQYkNm<4>Cfx;)D-+#dqY1p<p{55mL|4X*dkKaO;g^CLQLGCac2Al>FZNf`<X>
zVm|6*#9r>c1&>}yyv0o6_fRt~Dwue@)mdV<<jrnat;Q?fEQ+(zM>364nOCMWhl<Th
z()H!hse=S|(usUIud-2d#mr*hiiwVTUY*vIyzjGzak)%au|1qrUbU*|cvq&Q{qwIf
z=7Qn20vl`tsn`}8ExbKSqRbgOCEK;Hyps{NM%s3c&-B;269d7@zhkZ#jPA`-meY%-
z40xeS)@BND*7{MNWco>loc?4Z2sB$O`H>s35a7o{b_z<#)v2OGxP1iY)1%`-ROITY
zh~d~mBN5AWqO=sMZKkLBdr1=--U64nVO|({0X9^I%7l_&?4|9yHaI#IwS%A*Qm;1Q
z%Dpf;nG#NM%0LLG+=H->N0}#q>`TI0rXGB9e1yvsrKvId{;D+fNW)YnGBMKu_|6WO
zz)x#jY_Vm?c_(Vll&RmeUM4(>x2vPvg-!D1L?#lzSfa?Bd-Zz}jrC_~BL;y0rs8%b
zPWSo6{ySUZIWD5<8Ll;bdda}VOp*z(3$fg5hlnH6`3~b9@ZB{50{!pc(oY=L=rPc=
zu!_|2F=DDe)jYYoS`i?KG=5Fo`fJd9Auk<ouXBr;4ct<{V6~|ucMl3K`aXdUOHA$t
zg;L9{^y&(bEXWP;vZIR6n_=kRDiRhmZMxZbTV{YaOiXBc+^tiL@K0Jw(D{4#KPT=!
zjvqLN^F`Fw;VYX$og&SV!iY{YKv4E_is}K^X+GMe0Vxm3$ns%>Wk`zcD$<2=NuV+j
zS_L#&w70>1Wpy5W1i;9XlKCaB2Z*-(czS<d-gpi+Ne^X&Z{{g3A<NEvVgrO}&Vu-v
zVwyKaN|}=fi7EKhHVj;KqfdRg{V`&hjh&)n6<bd;RyaT!#*mg%m@+^xq^`xH>3t+d
zEJ{ve$dWjik?necekD-AnlcT5VCDNIIc$y6P@mvHgUk}8i@#zq5111LKt*Rx4_QRI
ziE3W*7x2*U@z>~m?M2dSw?0*=>9btNA0{bA#wmJEG4wgJ8OR%%g%4Fc8nT94t4LJX
z5Yq-yT1j6)?~t2e8UHcH-{&xeVQo4|vYjAsL;a*|4gDz)dH#5&`^r@HI@Ddn&dhYT
zxkQklxs}~SU&IoP2u^viizA*Wes(B8-L~sJ2>?-F;$iq<#ZQDA0EY7`Pgf51ds^pO
za%0ZdWrcMqKNNSKk%7nGtsSch!DY;QI0;f=x9t3xW5-<!*bXd&7_!#@6!?img=yMj
zz^OAfpPGX5GaH(YpPK(-Kzd*R$~_7=6m$M!QsuZ2<o4vu%!gD1p`@Q@a4sb<!`Y&X
zoo=>^F|#0QG$_<%g+962&W5v7Dd%&xKQyIpFp0o*b2kgzIM(v*bopS7w4%>LY`bs@
zg|O%(o6~LPNif9W1ssOE<gyTdgyv4pYdfim@u|I#CEW2u|6MshP<n4oEPt}6^wyEW
zPnjPndbFo(TK-R5RmDo59Vn%1<EI#E{h#mu!Wx_T=uEsX4wSUk|Gk?&S`+1mHp*h9
z*H*=z|A%Y5{U1lAc@7W%|8gz<YlV-lC{|i??*BA^6?U{VFiO}r>C8L_G=8Rc+q7!m
zqD~h)3iu8?Q84n&{F>_bW_tY<lkIpbpP>?8R14mXleAoeOKPkpHc;DelKEBqkQbgf
z9bc&(WBNE$5anA2L1s#zKA9Qdc=vX{NP|eQ26wUb?Pi4&A(tJP^PJN|5J_86R6LD0
zlI4{P^CEfSuehkJ0GDi}<4`MKAbJH{)K#n+<eV3})ym$|SYs}FbKPi7ffJiJBwt3@
z9Uil95NY+6#E{FEz+UWyc|OJiXtg;HO9x|PIS_l)xztp@hRD^hwq7PrzAmL&l><K^
zBu_((zx{X^hNSpAxldbHJbN2Rex|_WLIkms(eE@?oQXD(>Y(6Tm+b>!HI!hiMEC;^
zIL+=d$0$B!fe>dlY8ZX#BMJ^mwPm7Gxt{1{4y_~g?HeaBoIL{M!9*6po--oP-UTku
zWmJU9=f;7e1G6Ys_CZ(Xe)Vzqn3KA$LW_wZs6<pC=o!wKAl`xOJ#P`x%`0THxEnBX
zd*OO)wbwcHq*m}ZyuLpB+#^4E_AdEQ599eJ3Wb&d#cDIwn<l$-kREXjf~cDKI}^oR
zF4KtP^ERLqZq)}2{kQi^;DQ)3H4272;9;8ZI%ljvf+eE%1BRfXh%DibAUc?&wl;l-
z2QE_ASa5M$@S6x$x@^cTLxW7SEz)stZJeq6<1j}n!^*Aw86K#N0;&!5xT~_^>`0J6
z$sMqthL@HZU(9RYrk0n3iamVacdr{;;`amom!9<>QQucDUwogR=YfuihJ&2^FFhZb
z@ijQ#cas}&_s;|)@{bQa?`5tg@$<jlXH%YBmJ`5mb53N}lHmlVfHV}G#KFmeJ-t-}
z8yJ_}=vv>^Ohz@uJiOf>S|Hs&Rni1CkEXH&Ih>Jgb~WktyV;<EH3F)jJ6me2ivbi>
zf8+M=!M48DFce7rTi|W4&6FTWfW<_|FzuXzRD@~W{~jBuOtBcZ$!!}|hNVxE$L>_G
z3$WuxBQ$1hWTlVWN5Bz9N8ims+6jO3S+mg9L209s)Eu;C#QGPOwu1*X*7q(BnKGy$
zL<iunt{Xe<IfKhLSQsxorbNzV#jTa_H8Ogr>WaH@Oi6RIh_FM@p$-bT;AM;lU!l6!
zI%4dEhkA{e^UY}j2;Za+G*HN5>2*uo+7y%1FD(5sOz)@qFeZ#BM}DW;g*UW7_ZLYT
zh5inFt_{(PYN6?5|956$qT8Z)ohw4D0qm&ge9yFKL`YoX%&>R)&ab_cUNq^u!XRwz
zeAqxnQ^dLji!oR2=+6j}6@8SzZ}EU)zoWU0h+(3`gq_5!zkW=DSGg=05mqD904EIe
zg~m*o3T4L)s#fzcuF#CXmUWhUvyLQ%c8D@7%41>9<XXcTN{bEL&^h5Q!^Fy!INI3>
z;hpq6Xh2GA;^wgDwkye_kqt5_>loXHp?^*(n7V@!QT@4r#Uwg-;>P0sz(=>JZqm?T
zVt6}oRbi3jq}&~|RGzqC6=;yIkK2J=nTGV~!sZ!`ol>i!bW@`^#NBGSkFgL&^q~Rp
z;Fkh^*SJQQgr|?mrW;fS5)m!}R|GZUr(mU*{>H)#$3s|@WeCLAc78LJn**!OWZ^Sc
zEsa$b_Ya=ax*;(l)poy7-IzMqlqIc~cw*cbjcPi;G<=4F99q;(lo4#BH?al^uKX}S
znw)*Pj8tFV=J=&D;75?`RB+s${})wo+Qr&7CkmK{QDGPhBOGNmwZfby`S6!A>aC5z
zPgqhZSG|?UlAzD)^?v+f%hN}@p;bmrzqTshOFIPlr0$}}X7U)ScrS0uVKBg>B?=Qs
zw^&29>j-SCsn;uiqZUIKLtJ)KCU28vC|V@=BccePO%u*fA>JyIgCqika-@=$6^48U
zd{Q=EZKi|bviSd4yQd&Y+pb^mWp<a@W!rXj+0L?UciFaW+qP}nwyoavJn#O#iJ93u
zW+G+|GBOXY>+FuWBme8S)?&TJ*INiVPh#s6oIfX^+b@frs||PQ*5#u|2Xa?I{E5Z%
zNwydLuCcuti3N9~CSS1X^f=!bXv}DA&k%WZV(Um|RF{?&eW=}44GuiqONq>yekSVk
z#R`RZYe%Q#4FanLWTLOiTw-pk!{A&e->Nn;aX?}RENNkzb!Dc`Z9O!lIOxvL&=j54
zSj-{(s$+?$etsZRDeW8edm`=6tbo>XJfrhlvJOOCBMt6zn>B9jz}G2u&Ffq6JA^`2
zGiOUc@_ULEbLM)+>CobF0NsRf(gV0ljP8Xb8Y=wAq)$UL1;ugRmX&mEVQ@hI?u8g^
zX&TjOp_EwlOay8QuRI#Hc}!iH2RRy94yumFaUUXxIZ<fE7CVuN;(MXAO9cvHcj-f_
zeF!C6{Ss&=>H}&-3$zU?A&H5aBi5i#*D%M;ZC{}114(+Y#ZYek#2h;tNWu*79&xOc
z?rB2Kif^HO=J7>Dl=(G>oFqHzrQ_6CUO96lK!iamuy8nfEfZdBJoYPNq&?fNfx9JY
zus}g#m!@W<fc?F_dJ|uw8bCNJ`l))jYI82K7P@}!DS!|QX&hlpg3(0xB%W{Y=<;+w
zs6*$)>+!yO(C|pILraW>MIC8t`q6Hi9D%h<J}G(-${&gzXXm!urYKc>^P|v|G)146
zZvx11st)D8-Rf5!dfRdoYVg^4n6_QTT^(DZa5!OD$e{JwPlj+#*BEv5qB%HA4PGL=
zQ;^LL{jtOgC#jXT8_V#0)mc;l8!sQ;lZr2WB|OPYT-j~L1FZw*9TN8)#cs|EP$6u=
z4fG&!|0l<rHqVlG)l#)(kX=oJUdQ4noEI;YLa_=FOrV;`gVSfXckH_{x4ZL)n<Sac
zV;h;Y&rTcqzigHXzX6_7X>s-Q&HEhQvSxKGP3|L+#*(prnH+!+FlqgB%SUXZShG?W
zX4m=y(+T&pogL!m$6@9CcG?4W&?oH$m73FN5>$Edi7^jX>&SJB)9-em1~oN>?G6M6
zJb>dFBh)|RUCp?8F+f)h+sgexH$4^4d%2vJSV=OLATkUIDJbX9kbFE8*q|&k*<RVP
ziTqaG_htl_D>OyjFsOz|+2394?z+)?a&W$1_ZyDIHTLWr*Zb@$YK8BhYO`6Se=88P
zS+lr6uL|7M3e3r4E;O&2n2-lFz1N#g^IaK-{Ub)0`jFOUL3~!TJIxJN79P|GUhm_D
zoO>aSrr=K;noi@Har)D1C`tSgq5})Xc9wlSH!D7*8s7(Zf3-JM(Hcz6e*Cz%G3qj0
z2RthuzBygy4E7VhSn?qaCLotg2t_S9zV$H>uLbbMqsm{;kXVOBX%esiub)$htOYiD
zAeq{Sr6KP}*N7kc2<W6UpQZ;@;6*%cpv8*6<D0?=a+3EMP^q<3{n{V$FjxJ7@0rp)
zK3Dh1dD-XP#pNm)P^+YdMb8{;&Q7h;@1U&bS$wCyl5&FW2d`h^0<{yNKomw=-cX?)
z7|y3tIOr(uyneJ9Xw|yyn|P30Coepz@C+`Dnu||2e3JTjfzX(_0S@L_Z02X$ZT7;&
zaM!YiinS&N$Wu!6yE8<X1D$lHA2FDVsYvih*#=og*+0rts>YU6&BvP@04w<D1ENwE
z6}w|pJYLuX617<BaxpL42IlRAd9tmtj2IGPOwbo>$6eu`X>>YvP)FK@cY{KN#>&~q
zOtytrmSGWb$YpHj0GI!uoSlsC0vR=bG(Qp0?p_CRZB$bb3Vs`6keW6ms5!|eY=86h
zRxy1M3bmo#78Q4$POWUp^J-%+LiCffvHb4fX@nT<M?Ncnu=Z!!;E<>2jom!JfZ2(g
zN+R{w_jfFnHCa_~1M&h<{Mpv)cJ8zle@{IjhR5VSKLlcJl4$4SP~ix~wT-aV;O}|L
zZM2_758Gp%W%QLvO_Dqopg5Tg_H>-$eQLW-JBe3)^7e6h=l=G}RX%5rsc+evbTO5D
zf#OfpvX*iV4@+hOlXwi*lzdVk<MfP&rbZ^DUGQj*V#3vQs@C~pCO?pD*wIwi4W$sb
z@MD5*HbB}a$d1oYKu@g135$GrTch;$HR!NK%g=(R2I6eYetK1(Q>{Zqt@RbNg2U!8
ztk)+$0TocG7qr3qQ}Sic+IkG(>S4>A>*XkSb&|Eq6!V&SAurXVl`cBd^R~%eShbnF
z>Z6Cqbc=IAzP**EPB*7Cx==51A}@EDxI*pd@x0YYOT;XejrXT3p~#X&yz{YPQh2^p
z)T&`H+~Yc-=QXb;_L3-}6aQgU+=Dy*P(Asycrs~qk(t~6!sAvLh-XqGYc%PruRt^b
zEk^nD&`@(Kn0DBM1^h|_I&y$9i=#}LRQuhLsx~dU@o@asOJbu(m^BACx}-%_)_s^l
zIMwp>$Mq5HAj5FrS*z93s-oZuV&O?p^U`=G^M1RMIe%x{d3yE*!uj7l4D2UU%(>9%
z@?l^5A&`TSi`BN|)wO+9kpg;3dvN%OA%tG)w&Bzjo@K%BHp!Ydli-TQ6&a*>QxhL9
z3+JNFa@Ydbm;O@fnD9f-8dQmq$iDb1{-eBrA!C%;O!{HODKU!5p`LJ|?UHn51p|!-
zq4k!!U+MW>HlSy`ma=ZbHiA^U4=I_FdIq&TPF_K#t9QX>*y!`DC%=?0p#x>BE)ndc
zY-Q(C0ooF%sd(iVWD<ORsd#7kO;H7(4}jDV4_&kzH38&lKB%wX4@Aqp32jo-sji(?
zW(S&n1oUmHCb8y?5o7jw0vdAU=$Jcyext-UKT60DJ`psIbcn~#WqkO&@a3%5n=%@`
z3?3j;96`$uDLBf(LH+qn-i5sS!-fh`X7mn55jPog5o-7VA6}3ejSgU|RUT56+&Spj
zlRn0JJ$6Y5<t8pXeA6dzn!g%Bn4$P{nzLf*b?aGga?y6ZEj(($oNyBSUi2XRoNA)c
zYi7(wq?L6C2(gPjglbaC*sXZ?(IvqL)D!l9mT(-|nt38u%-YjjqM&DRO{>~7dNvrS
z)!%=lOw_$94Kbi5(lF*SDc&|K0dr6ZCW${gd9UJt)j>V$fyQn6HCpwO+;+(rr1#>^
z#YyblIHh~oeghG+(GIxb&Ypei=Uav#Hlm_r;;9b(sW2+M@QjmeO1UrH7S1aBI8Za?
z?v@{iyASVFw&Q@ukgSH9%wP45RXE%Fk7-Vhxgh!bYD-tnbj607#Od$y=g!9_qAcdp
zIv#=uo&ljiQ=9fk?{cQgj5d#FJ*qgB+C5GJ4#}%lU=gPfRN1dbh&ST|Iiwd&z+i?p
zewjxT_HU<fBxbIR<&LQ4Sp%(us+3ZfCx$FOEzt9=3B53t$p5$SQ*cZin4B{$@)>9D
z#9*HLT7h?1-Dfr}BeG@0MA62kE)B=}iEA1rNmcqqtJBM<?@!A%j!v4=Ie=nGdM-$Y
zg_>sp!23w!-wjgiyByq8=HTpS0IGTCq`Tg`>x5u&^P?;G?tz0r_~!Vi(Q^@FYuy=)
zm?;xnkwsYBAW<Uwln)fBw1?hOcWNTm&7{9#8j1OCtRlexAFvXyyv&s>typuWWD}mQ
zBS2w!wMd?{w4YG~iN$zj9%^~f<Eyo=)#_hDNe&ffmZsapwIFS~E2f)rZ1fx3<GY&F
zfvOhZGli-i(MaB_NIRFXqL;66nA$2k9A7vn@&hoOslCSSTxnCh+GcXzd!%aWi}xqH
zRa7tN?3N6sS_mE5dq_41a#~+aQ^3wpzG>(5(MB;SrKQu-xBO}xfvypIW%^Q$jkd&@
z>q739RN3C3xkc8pNjFUFu6##7QR1^QVz3`sg}5?3PHeThZmUdcp(v=cu=)74sm!bP
zb1W<pqAc$rN#->DL8g#xyIex)TBA;^@Xju}dcd!?+R=ngG&z5Q>%S6N%5_Dpz$1O^
zKIQTyE=JzSYBNoLg%S&ZQ)jXRtuTAHSU;9*?%Ul-#I|}(Bz@tq23nP-M;O#`efUCq
z8{;RIO|5J5@i6C|!5Pfh*=miOSH)IVFt}O8YM0quMJ&A4EM;t7>*bHK+@BG4vgo|M
z3u3v3bYO8;RPNrX9GW5I^or<bNXzECfclb_{8n+>JSIMhn?7-cC5P08@VvgQUHoX$
z77s0gV9*=KyAkv6gjUg6xFjb%3}cm%a+=T&i&9o#vw`kIfHGR4OJhdM2aPPjVU{Q6
z!Y@o*A~wMx3w}!p-t2T&rvNZ_1R+U?>ep9_fTdS))rRFktt3q))4TGW&#KAxjBKac
zVjlX14vWAwRC;>JURx;mh|CJfuz&oHRc7V6XSbwhkzsa?ow8^ISpO5v1}Z6$VO``d
z{{Ya^Ay0$^v`K1d5BK(7DPTf@8JnR?NCxnm+~vuQAqSY<dA4f0^1}*ytwU(_4&QjO
z;dPh6ooB@BbIo=_y_%_U*CG^2Zelqx=e^Aqn$Q+3m#x!w98}9FI5?JJiAJ6#c*?j)
zXJH@WSq3WWB%Tn6fF+UE9Bk<;e453rRq)86@k^<MpSmao45U>7GT08OlpkGpQ}?5F
z*aSml>u}l7HPY~u3D!Qos$p;xh7pF$sy2$vyaigokV^|YO7KxfP|+HIpaUukBmH6U
z7e|SQB1i(Eip#dL*51dw)jZ?#mnS2peZnbb>3cqm&7!_G?GPuWO(ys13qnFNHccP3
z<K7hy5qL_B^O6*)#02V&ePCqu)lBz;RwwebMKL!*^ssZIiKY`kJ<KY6kIa!8`!s0~
zyM%GQqZ-*~xn_S9wf_=rMe4pY#uLkpkG$<YL!FyFdyf=V)=?8&6&{ZeEy2o?FQWhX
z*I)ey|6pBd+!3s*7-W|2>?M$AWUM~|PR!LTyNOmWo^F>u;k3FX8ZVUU=z`%wNmS_F
z>o9hpc~@=btL2u<5V8ff_<fi&rm}kBeDQ&kA)eL`mTE3o)~9mT!7Fr|G{cE27y3N_
z+Ni}z^as#rzI6|@H&`no6p&v;Qf>iKXU378x7;~!hO~g5k$0hwgl;J5L1nSa(_gp8
z;q87<7aHWhY6ajEB0o_E7*ltykj2f0^3~<CR+Y*ir(nH42PYGeLy*3{CyHJA{z>R(
z&t&fQJlL1KD9BR<-o>iCE4w$42hhiDCjDN9fle#FXFN*F)JfmjWUS^k0feNMTUzVU
zm<0l!VH>1d-Of%6D0>7bSfpVplyhG#d}62&w=|2c=f%GmIHu~D%c}{{T+pS)4}!wU
z(?38@g)p}plRF#3hJHU*{MqyBN=phK)t|&Af+zDGXl-n*9$)LQ$6DxidDQXNEfDy*
zh^HMp&V<i~NS(Lg(m16nx|X28D&eu2*6j{UE@$~;EmLi6e7qZp4-2(5q8bwW)1Y8N
zs}0;471}C#VU4@qHGPOAC^>&T+Z}jjO+#IyfXY+5ch6?W^=tNSMonsCli7V+A@C`}
z{7Zm|Av--JPHJPZNK_1IQR0&Y&!_z>6Vh~_P`RSOP2T1r<I8yYy%3)bIo?otAQ`nP
z9ic_5=TXkC{grQVDITNI4)F2&ycL`h+rbAb=V^N$8h4N|O)YF-QhKYg4AA(O2EM87
z*0S{lHRI++gqK+$Z{L3D^|=RuCc*y>!luHWKB&;HTZo;V?mizwrCMVk`NTuV>UZYR
z4qMR4jiLrI3$rGq#J*t`p+Lcrb}=^#Ly+vG{!PLP!(Imq9Oy1X>6HH_TRRqsMu%Wc
zuKu19dBwO0O_ZMK5Rt4@cm1h;RaT!ZN@hK1Wg{)b!U8Yw;Je+&2@V9h34K_6GDE3B
zgxf`b-+}DBkojc2q)jqF9gbQ#Na7Fs&~pBAb;hxM6v2qABh@tE&RWvQ!QM(Dv*_T#
zeFAednasKZsR6`gC2ZCyWfWJi!D@FX3R?<hy;I1{8=ZDm(IJ#EaP<WH55%LD?igfY
zY>7gFC?`0hXP^WG_=4#P%u~p+7Q0k2GYk$4;Y-2q5wzb<SnZ7w=!rz3w0x?U1$m69
zILd=9I1r5Gy(RX+$FfzRSb)T*X^9#CU;ALzb}M2XKT4H+`=->7!2Z@^sHS|Z28hOn
zH_KOzfbNCv5w2j+BO9Q5n_JM8P2vEOHU<%?KpN?f42G~uGS=Cp#D}Je&P09VtCH6D
z9)5CYrM;h}riOAvEb>132A;1WOor(tZi#bfw;guQP{I>IOB?$A{-~IoaWX~SC$#@@
z=?vPF<S+WR;6-z50S7ww*$C<RUC=w#Qr?u)Qm#cH8169^=HE9~7B<_dn=NUa9sllN
z$O`iWcu>}Al>@FUIMk-!jZMf__Pd-o487~60@mvH-&+Np)c<<=dx4uhAIrA+diT~y
ziKoKksTwl4I%(c0_?Oo~8QOn~YJtXW3S(#ny7&ZDutn+YOHXeX8C<h>%J?vK(bRa2
z&pyq{tE@c_&`vaN*0%14HQTECI`USy1y77*F$Xp%hN?4oBB?LR20YsG)4UJ4QSL2~
z$dO}zCs8yd+Cmt!$-8>Oxz<vjqDzG$>jdL@P?AMGS=-DBCviOf*V-)Q;%$h9NZmD<
zoXH%D>u{+IVtG9o>z~xD=80$ExRKLfq)<Q0)%TOi(Cc$fVhpu-vKAzISSr`0(E)KI
zq*#jkIL7hzA`sk#t>twMjaYeTKrlH^C;b}huv1Z2%e)bjn_k_k;UI`IDeJ{{2b5$=
zr1#8Siz8;Fd9&maGj~Hh)`8o3=u=>grZ)3P=r^k-%xXZdjFyOJ<W>B=^CoFlN_HDc
z6@>7Enskd>ksrWGo_|S0MDUd^Jd8gZ1eq-6)%O+>EZ{3iA;3n2erT!jM1oYH@sZK^
za3GIk9h7k*F2G0$K`2;;ui~!EbB!;K)<E9jhH$FUeS2{)p^?SUYJ^v5F9Z@Xsi2b~
zrUu&=A10|E0Lr3Vxfcdz1g9H~LqQ&tqf&BT_=JfQJ4y>twA^#y3l!*!n2hn@9&8mg
zJhMKc2?R}}Nhao50@MZb{|68b2Ul)5Gx$IeCDK)yMiw2fk;4aQG*v#XK+5^UVfI~C
zOmC8Ps&QsNC6}o*Z3T?m#||?P(FHc&&FWW1aQImKUblC#bF}x%nn{JCkfne+`VRrG
zaGhgV4gCxEs>uhp2|z~yny^Ypa{bV)GpQU3Gb*pmM|$ohCe&EH?E|!&wK>!l@lFPo
zK&%fmp3qN)h0lN5JIeobYUN$liiO)>q?5Oy**s!+Jg2s*B<b|2L^n$f1X$ey@H@-*
zKrJl&^tsD>ej7T>Ue|j9yhbZkYwv$gd=E%Fo})-}vkPS$f&%~1n*eW_%sZFa29EJw
zyzdu_8%qRpEZ)p2<59j^;V~cdTHw8K?I_J+yqyPA$ir$d``DkLh3`OMaSTz=ikF-r
zBM`vm%#XsJ%RyhNA|HX65tSO!s)mXgvxOi4MkcNeMJQT|v{>SiaO+R%Y&Jw(mba&%
zFokO$^ok$=B-b)RPlu0h8;<VX={kg{KXPS7d<~bt>JkErS=YwMm&0uZ*<JY864_o6
zr)};h5}g>?ryS8|5GB|Jy0lBlWqw%tjb@z1B8+9%>YA>TjI0}}t_FhXOvY}aqBQ1h
z`>eSMh&<w-q3=PX`X3@#PY#Mm{$sR1&+xv7+wQh^r_+^!8Gr3xWq0v>oqJz@JvhI!
zwLObjH{#i5PzEX(sLoJK`teet-O>M;g)8vN!H7Y8ThGi$jjqWXl#L1${IH?fx$6>b
zHbLhT`X1#{{LwVJ5*|7L_W8<^759Y0)~gOZn1ZiWL1wes>UlYEYj@7iQ}yV`Nt>XY
zr#uQ|dSx+LsbVArH!b6*v6V_gJC^K`LgP{@M4XhV#%scO*N7>cnKejC>6K!<=VpD(
z=>ws|D`Q>zw<9U)cRfUCeltu{@d00Feea&Nnl*;;u%DpNjRvK`=(q8PtW#CMu%Se?
zqhfrJcs95)J)jhI`ahKSmc3q5|M!5~max!W6%|~b^Hw{$yAvIIg0#y=bnhC{2Eg8O
z;2(tuZw<NoJqs;h3sm<ZBgtiZV@l!<x2Z%v1qbQEIDPptJX`J#2vdZ>NY}!SuzZiR
zu(l0dW4C$qz0b&Uk3U*FYiP#%3=5nTT~{rtr~c@YOB|&2HtOi^!ZvPtl2`GmU=soh
zDvz=BB4k4Fy>QPJ@Yz>ctSRgJBjx_->AT#_5AM+3FyT^}rguRQduG9%y2I`Hv$WHs
z09SHVzrpL~bh~ur3-zh!^*D*a?-6!QF`J=_NR4ju&wbt?B9n<xKTjR8@hVv#jq1Eh
zsE6G@&dCx<9!n%=D{7tsP((l4+gcss(<F}q%bN_Mb#Maj?Q_~NCl9D6aVJDMhQTIM
zL;m-iJIKs*_}R)X+jt$<x1oJ#ZCFCWpS7S|xi-cB?2SMWTxYRWvQO3;XJnSWE%I)m
zw^@ztm^x?U!@+lH`(AxQqEfZs06p=KuY)IM=!usMrrQrnYO$;8O+Y_?mCtgZ-d~ez
zo9w@g8-LAhu7_3n`Mw@rx3)zdhP}V*mw&^*ZeG85KfW%5os&(5`GnuQKT;CvvA!P0
zx1#S}$cAN}p1a>BT*IQL7N(?alvOm@msLcBb0;dhg>|1hOCJujj}qe~ci_UM(_&jh
zsVIPK=R}%c_K4kSD$?!MnP0=)g_7)*7y?ZDMOL+VAZ?zKO18dfq@hiyy?JF)3G7ho
z){n)^EiU-uU)~R91E`G?b&_I;wu@F#Bw87$jl@P|!VV6L=FjO~5R>$UVY*xVui(O=
z;_z!PMZ5X1-?OR?Tz@Haq7_Y&+N7(4l=hS)ykOTW{>N-%y;TAd1{{;{=}IpS_T#i1
zj0(%2&%D>a@}PXjR7UNwNO*_DF8okpZh{#O;vLYC=Z~m*GU1uN#AGxNkU*7RF%~eZ
zm$E+Cg`KU(lH<>Ygn5Ge-OR5}Lph3v?WCv28C>lpy)xp0yJgU?MxvSS_Ox;PTY;?F
zqpq5F9jwe<Q0}tI5A_!p3@Z!>8pAZhY~TLhq3zoNxQ$9d5))b5stg!7(*Wa=N@OI1
z<=!0>p;z5s(g+Ru&;!DDyZB=yGjv)CHyJX7z}(%mR155T0**A|mTh7%pDBeYT)!ec
z@u52t@7X<5N^KkMY~_7Y9JGee@in+PL7Am@DkAoO9`hFagYR-eU}AAu^KM5&Yk>wU
zSr{T@=x<Emv$yg}hcltIZrqzXkYNzrK?u9!gMgzO)YSR*{9eseS#4q^x8TJ!_m<4Z
z=dcdcFRo`5c4kdl^gClY0t^|!(y*gePPqyZdItRAz2iVztuVP{Mur^`ul~OpZ2=jR
zHiI%QKaSnuMs*!c>7gnFziGQJhJCdm3RotI!EJ?Guyp~nv@+A6QdfPXkwCq)NPw%6
z(ra0EMhzMks!sj1Cj}0h5&CpxALTrACjlunDYq$39@j5GW8sg0pLUMA#%0+j;mWHc
znd3tluv@|+(Yu9#_9ZATQNww0>@Ma+pJY*!1XP1-EH0`|Q442EoX(x975Q>H3`Q>1
zm1&KMlCL?A___Be4=GBUWZ-Uf&F(er-3_CU18bCQL8%_Nz$kn(9?pO2_>VF1|IY+F
zf@m;!rujuKHZg4L>hi0O3(64js$Yb-9o!01D(b9=E7}HP08BzvAif#*e{HZ&-U#_o
zwP}bI2Iht!6)E=g$Gn78Sz@V(2pi?PTi}j!RvR@SEz+^Pt(v1cp7vs*Kp^IZoG%Mg
zY8Pjo(#OZ^ogeilpgl1=xVjdmw3M}OzX|qo--KlRa}Gz>VET7Vrmib3;7bDd<5#QM
zwu(@Dxf8=Brf_4~6{{b?&7;rwaSF4t6=NQ`XeJrWZ!Kfet0di=H6ZBQ9|9~Cc$Uu^
zU8CMvPm-bKr><>OImK@(yH(YIM3Le|$*9KS&4y{|MN1-Sac_^<8`K=9&NyCsiS$?|
zlUG)wLhkcR)D~3eZy&Ri>hILdyAwAUVcOt=3~7wQintDF0shz`q5V;*AoAh*`*a1e
zYJuYg0w;~R!6nvs&W*2$&kej9j+TGjb!hYUK>bFn*Kfq}+62kRgHS2mlnSm6w`?}I
z-(15(Z!Wh^_q&$|z3YjFwNresNQ%2Dbek2bys&g?-#}{9{Ia^MnO;%)=9lQpXR^-M
zm1OjnRBaJe*?_CPi`&cn;In7~?oeZTq|3d6Ts@P~xf?e+GmJIL(xqUj#I1yccn(#4
z%XLm=hTy>(lJe`!G(qor5yuU8lKs`Bx6Y16V}c=u%229xq`p;Y4sK-QPi1cBa+5AM
z3V^Ru-8t<dy{PfrpS=|i%I5PUNubXikxIk)9L0e9aORFv{4S2XCyjvWn8dJTQ4?+q
z+=bI&$#Q&fG<K*h3!_ywiOZ0=*T{@^J76)!hT2AJ3zA3iqB_>vcs74mb*jFdB=|`M
zlXwyN+ME)CK~BxKq-Pwr;nFYyfM?><RJN4gW~BtdyTt!zYkdN<U!pAyqzpfjr8uQ_
zpBv86ydI;QJ>w3(#8;x<t%Pa*rhrCp-rr~^aY!*U-tD9?tnv@E&bAjfs#vaoNpeU6
zYPWwPMy5x`pF#}UG$4Ou@08RHCzFpm&ve36$HQFBp9vHr8OH@bZX}MRBt)!Y6ogxd
zgUpgFzzT~BEl<M$s@cC-u4wt}aS?qQ3n1l9s&&x~wxIlt_bF-o`gL*((Y_Qa2jKj?
zT8kH~hvoce)g1mWMg7gJ|54Q6VA}fIS6h8!>T~sf&Go+rSevy6m;Re!EB{NaZFhJ7
zwb|dy`d;Jvj<7df0FUd{`tqxMjPx=3>;S>e3c4Sy)HLN8yGm-D!<Rz%NNX5Y<E1ZJ
zYFpfh*)H=jZGripS_ho?UyJtF3mnkWguoEvO)JBJkAXmD38~5?k0NQ_Nl^}&OOSw8
z>`&gjHX<`#djvq|m_ZYEBdbqVZkLH7Vzh~2N0@+-H29jXD8ro(&20D|3;g6`#aWkF
zLY5(g_E9l08>X}<u_^eSrd)4IqBJ8Oi^bwr?E+fk`pWbP4{J|&MYZJilT>NLX$xF;
znfVpgNqt#kq<gta_d8`T$}Z8;=ZtH|!zFtTaD7hcedUaY!C`oLq{%T%BMgCtem8LQ
ziH(IC!?sCMNC{!)qy$#%tp52z{_E0~!tqWpR)r=s$zfwESuZw5CI)bNo#sD!p)=j@
zeP;byDfi;6&-qK&Q`1rA3u#?1LHKW`l>O-rMrv#LfljCfXA*h`59e*8(36>x#gVKd
zz3<pRS@~AQrB|##J?41+v`*40UFuh2)(KH*En(11)Rv6F$tr_}%-g!RCIpSA0?Ddt
zNA75I^4A=CSM5EV>5}fOjm6x`D>-BAiK!x+vu-(4i#y~cppOAt|0MDvL42OK^d%Y=
zZu1F)jCD#J$S9yULAp5ctN~1e;;rqJRiA=f$ex?sn9_mLLG;YG?_hGna;s(+Kat-&
zlio<n{!NLKjlRQok>3K<D&u)|{b@O8pnLwvkkJX|!41aU37REmY5NSd(!u7ltk!l{
zJVoi`{n*xQ-U%DJnm6bjfA%0+K8IH+;@o`Wyw}TSzIv^{=zXh6Ew(I7yw{AuW4CJz
z^~@7GPm<4G4sq7@N}=hkPFLZl-r%RkfUTq%d3>&<aGAQ$z0#ELw<8uulR3wBii3@a
z2D=TKmM3Gr9Vbkg7+nt+Ja*YNm)VJ}1!tCj_aWYBVm{&YnCf=Z7I99=tX%$jI;|Zo
zl~}sWT=kn`p|MP?^*ha<;wAWFyuj|fU_~T#dYdFXPQ)!7aK9>iM$^vs@UarsB#a)c
zgUt8DO&x;D_zFivI^E<tnY#94XuqcIe<t|TU=<3~WHSdZzJ>4Vj&|>}IXxX1a1vv4
zsNeBD5r)tvrdq1p;XxS)p`GA~>MUnd33wsp@((TM4tvaU_>fM}Sa>3(8EIilO5)HR
z2mty<q(3Zpk_*2y^frwhjEiqLawx4m%nq<;aEfnN#=XZ)k(=1K)b#Ku*}yMw)OmUC
znlNG3KGnjA(OI>de3>Yo9A1s#BZfbO4;y8);Pc&q)e&ScxLB^i4Nu~Lf*%z8`KE+q
znyi}tmEcPcDXCDB$)>5Ze_0W$iw?Z1eMk5tW-)Q`hN-%nPzzczwH-ok$rtTF+*nXx
z6Ws`j+4)5buK37ysEQn}LWSdrkSLmx@<4vzHBOM!8vn`i`O?xHoJ1*n^(>4KJv<zF
zQt*5}8mO~Wp%fD@shpSvE{P}l<7bsNopwpQ|HP%uPc9c7KXK@`S414LRbSd)?0-Bx
z>>WP`dvkbgd*BYMCX7g|`!+tsSR>Ma$b)$*`VfB9E3r=U%-g^MZtS=0_n>3hSqLSP
z%|jPT?R~`MEfNar!Mo_$S(K+CiFN%r#2+54vG*>A_hIjNvrRJE12W7`w0;GC;sZ9X
z<!wVqGH*nOW|PvP{tU&rfDI0tb6rf8BYxVDA?(`)MO57~z@U5H{}R<@<>-4;FjfQ-
z9NjFr9fUtsy+qlZEkH6c27$xC*Fy^Il`>Z47euL1sKQD$I?NFK4Wuq~52a&Zj3F(A
zkQ+PSs%nK;O&<Pfl5kA&ar{`$=W%NU+uXGX6EUO}*THDcz-V5LN!l_+dSP}!UF(vl
zT|rtK31hZsRbWIPXjQ7U`+gwhUlD#Gh&^nXTlCa%XN3t??Z*fHeB+%k;<de1m|Y(h
zy%Fx_AI~%$`3W2f-WB@pr=BlXdvk|NYj3!^pl#jIhXwbdDYsLW26@zd<X@-9o&zig
za418l(bg#bWh1gs9@Hz7_)&6|I=Tyr&Dy$HLqzKMl@W7h9Qn-mRz##R;~uk+!wyGf
zg%T5j$Up^`ze_oUwrROzA~GR`i9-WSs*ei+)Swx&QBtK-1ar(|YC;#R_|PMPe<=K`
z2oCiiB7gmGb`@>vR!Ta6HDaM$WcOopy&gD9VzHPuYU9GFNval<?%L9JUGqG8*}B^}
z_L2mJ&^hyJhCgzdcx^n%L?I%dERuT`F2UIFFG7NvTX@yj$ne>gA!AlC;+^`xT3Vs;
zU-|q^ssBTtm;UqB`5$!c@NKB2zCZuPqW^Pj=^s9A^L<^?{Z`WwFZr(2h3oq~*80eQ
z6!r4=an#HB<Kcg=1^zeBruy$+kyiP36h0uc-3MyFM0fq`>6Tk5Q_{+pee-tSMG9>9
zv^d+xvNaT&w2q`Pm%p1)gKwAiGp$F>mf-FgEI{#>TaYTX>QbinM+PBLX+;z<ed$TO
zkpu4S5hlL>aARX@cc4fTpEUaaV*C5ac?|qOiZ99|N=L3wRdzyNZxRckLuRmP|Ld-#
z1X`@v%&rP!+2lsQ(YN+<_6$Gm+V7IHgEJNFp^p{q^-sdo(MgX9GQ*a^QFP5fBUb53
z6(0GA9gZ}LfmaV|WUw(?kTU8{ki1r@8b)}@rptMFyyybeU>V?w?7+uliGf}Q6Orgt
z?C$_wv&tQ*3V#A}h^x9?fVC81eUJf1@<?J0!q${KcTZTJod292b}_*?+n=ae6PS^j
zDPtpG%TjD`vcWNRu*K8n*<YgNA7k&CQ9eZ2hJGn=q$g}zhVU-xCOvI?zKdB-Esh@%
zw^u<g)*>$wtG&0}P031Dtr)&_ApE-=!?86cD@+~HB?0Z8d(?NCJH*yvPW>=^Z+S?~
z_}fJ6>~Ia(H>X9<r*hF!ZD`<UPV8fk6-S+DGKxFTP_O~F0LCtA7^PvUSxp}F9s6Q)
zTu^GAY#!Z(*#Q`EQs$l%5{4!j1B3!~A!qEM8r50{)8rYWTt+r@DQoTGgR9z|lgb^f
z+M&Vw91ZG-`-*m<R^9M?wFPXuDCvksjgM4FJqIPDcgi}R#T5s6UHa4iKSrdh7e9&N
z)X{ai%9>bl<PfAy4e(GP4p7s?`}xPExH5mha!pwE!gU}%!KX6~QBp2|esqKPl$Za3
zK1kfEfIeU{VL-nEFu`p&;GdwDnD4Z&!=$St6rwUJXlCWCZ^M9=5#KEBPJT*_eJ`yk
zA?E;%ii$BWA%UOsh$u@9qFx?#k3f}=e?7Qe2Vk8P<=^@?IkYP(a>&&FE~sVTeFL&K
z<!gx?B0<wD_dEE5?R?J=g92#wiBU#NX<PX*be1cB1FDg3N!wAiW2PKgk@jWJ(8k30
zz7WhRQayGK1z+rH7W^Gu_Z0eJj7%9Qw$^kK!aKq3bKS;VV@#59Qqd55n_-9d9o!C{
zqtLO9DL8okw4Img;=nL)r9M;zL8i5PQvTh-Y<3~1KZCn;6MmZ%_)Ka<ZMmv4siYw~
zYnqhPp~SOM@t}GFMWOX$g%ei}{jsoQ&YR^2gT^L%1Vwnsr7{u3LRrT-yWeFXqS&6;
z3`z~Ro5rkafX7{W9Ws&}X$ejOgkbFD3P&W|zJ6L#yxAXfYYlL88nt6vWP2JX8f>?y
z02DaCQ#VS?+AE=P49PGzC(&J|*(n#putbA#2gcavz+n*nu_LI+-=CLjNUnBCrwUm8
z8W%ONIKo58F?EEtWIa%3$z+Tib>q3WO=0PQB%t}xGQ|M@gL}rUjG)I283UAZAq~u^
zoXrXPm2d(_YD~|<us-KN0a_$&D!NosA%+#g$^Kk*xxGi3T55TwR&l0?KXSwYoVtlI
zPx}gj$N&K%qS<}lHfZA;gL2yK35qnJr1&AoN|?vmGx8dG_47=_3PUQJPV;uxjP_C?
zv{GJUtkha3ZovuM-JF!Q@Hh(c=faAgIWd3usQobCvOI6c*09KY%`p%L;;a`mRZ!{(
zM^>vYFXI_}$RNg4L5X5PemQ&(!;9nAD+Af0xxlMM0*EF>mT->1Z)<7By)}91s6<%Z
z16<0-j<uI}0#?J-qt_W*_n=yilRD_7uag*v`o>Yp%bGKC+R;*E9kI~*VfRZy(<u_t
zi&|n!Y;|gxt-?ueArGOFPni6meDX3V>yhmUd3Lw~tB(=keNk&iIK&aZ>^AR2Tuj|~
z4vaJ(<vE=YuhB0ck3e*<Df9FUiv9|H*m<9~x7+mt^HPN|uUC1sHO)v3NzoR~V&g<z
z6-X)1-`8%8KR4p<u&WyN87qE5&1^#u5b|CHp2_Ow!tO}@2!{atyrMdiVWnh)O-=0}
zrqwn3IW^BC9X>p{;#%ecPd@Y{U;o5hO#U~VM!+I-qqLD?h9N|)o>sl&+)d#~=I`A&
ze_hkyzV`AYQPK)uCMc`UU)yc|u}5Xd<Qsdu`p6=Obf(Rgw~U*>)rq(+Ab6w*&(XX+
z;8x6-CsvX}&4u<#il&DcTlNebGXj7ENoNA|DQa3R$UNDYpYTrw<yiQ^J+Owo@M}$W
z0e&mu*hMUp155Mn2I%NSfdjTgUPU<hL*pg4oMyi+KSZ|ON`Zm{>Tv6PjG1S4NM7xh
zn~*NUd)rBN#{{)s$09yRYoZy%anRJ6NGM!2%w_i(nX~ejJdozl!$p}>YHI%sm-*fv
zS6cJ%BHw-wY{oH{jqLi&6qN+IT$`dKLD2z@mWpEH{oIHpblNCE{8oZj&i!t+DaK{z
z-YE-3c-Ip#TLISpG{|eF6a_c!)%9{dI2~-mmyyxb1-21rXy9Ln2p8#%eidg&gkAU=
z!i`9NE5Imot?nFlijtL!G6|+QaU6{4Go_ZK@6{|V_#p7SR=X$XsWnR#1<-yfsxy@r
zLabepZYMC7Cxcfw?^9aywHh}$AkxZ7SCMLs+l+$NK+m$W!=`EzIGKc>fy`Xgi8wPT
zo!>vz2<iyWfaoxU_c&7t_Vfuc2zl?LH=D_V({6_UgGa@3u8yBUMVxZAPz$;pore;-
zNDd0r6wCdoZIdmittRW0iMusddjBygUf=!v^XP9-Bx6Zgw78<Z)0-3b@im2X(~uK<
z>#QZkowqR@5MjR&y(22-)a(#bJg2&Qi>;#J$Gx?+y_+kr1cFC0!bhH(b;y}=eIU{}
zWB_qKw+0&cg`*-ac5X^|IeC<3ND7^<LXdp9HzQr-Fr)!~x|H)D+njbAa~_xBskNej
z`8A(-DPmzGbuEw>*)s^=%6n40U;`m~cUf$=leENhF?fT)6)+P#I+?F$5R8U?y5{8c
zD->lovSUx|W6E+zZ+xn?`Gahhz4;*rlb%c^x^ShR;BlGbn@+}lDd#rpte(uWM=mjl
zt|F=eT<Spd@AWEHKho2*!`Z#P;!bE^awcAZJ*QYb<BAMikd+G!5%y|pP@q44)l{b^
zW|um3vuhe8FD)8PaHM7HeN|2*TehEVm1%BQ;WW6UfMs8b=B3z!B&Lqcrpf5A2MML$
znA8!T;j|4%&&E;}km|bg42reaB*}tE%g8(Ee;~4+V#}Ra#FKi?$2|JiW~~!4n&E*-
z>xn@MyI7J~I13wWq{#jZ2QGlWcUDtx(k|9|nRX_#38hb>v;Yk{lKUBaXznsaS#hnT
z4U2`GDR}ey2P!;phP=7ZtYKmjpxpNMxV#~S_SAa4qrHaanX4v_TZy%dT<xqYr-TsY
z;1GkSJ_{$WDZbq&=bBj>;gapAH<<{oO1r)wR;ffnnSxx_4*|EFS2ze)sb6u4aq#yV
zJ8AkGnh9r#pfDB>`Kc*B2|5_MgJ)3U+Qw%Y>exG`lWXX*(vMs{#VWnHQ;CtYDPlni
zmZr;~>5y$pR~|Bwgde}*2?+H-6WZ^Qu6oBxhfHaejM<9u!*od6T<28q)he}rYK@#b
zYv5P2N`{@tZL<fRrc#5Uc`6yI@ZDU){LCi5ojiOer?}>*UsPU@MIUAsKsbw(rs*tR
z!gqBM$Xw{LstMvEqa<OkOUD)j)|^|NGnBK8p?y51){ubjk<~5x&8BLzIpuDj6^MCi
zU~IFd+H+aK2xl9W2&a3D)tBy6Lzh`>xq)m9yfRro(H&oSppa@?_8Q;wg?&$lW4&JZ
zx{s=r&8Ouh%jazZP^T4)pjnCAe2vT0w*^zda`@ESJ&?-1+vt5l%3K(|`syb<4;Tq=
z(2m@*9A@PyN9Usndx?u!R(?YNEfJUI`%02lQ#wI^6)Z*m1A5UK^zhA{iiLN(2D@3(
zwi0rQUrX(ZLqm!z{F#!9jnALuxKfh=!#1HVuZ(3PX1!PsT4!TY8nZ8ROT!9s`@02k
zbqJkiKQl<3IiBwMu(qCVOSuZ_9BnWW&joB!Bbd|t`MW?h-j2mq<?(mAxJS`Ai#WJI
z-D=p*jd3(~(Ok5eEt0rdcIY;O04Wb47RX=N+?9L#bF&i72VYLu*PH|KNNR(ySKVf_
z?fm+vY0NLQh&L;UG*ei<8lpli>9KsJj<(bB1grapr+!eLO1AT{V^(mm8na$94#a{@
z*rVtD(?!l2aww=D4(jalZ}!w-SDB`UlRZl5>ddq)Gx8Y|SBra>wCmAZjJ<%`w+pFZ
z*7!cjRIg3w^e02V+N__K@d;+hrcsBd_Igemr(4w(hgy#PHx<cCmbearrGrDS^&jir
zx$H?TGu+LiobGdhnet(JE>!s&ql{hBg%AhD>s>E~kg9*t-**~B$75yewOQa35MkvA
z>qXDCjV*#5Fk}10j$o`Y9uXn#Ux=axtXtE{WO;p#s&VAXZ#iU`XQqHumaL_ORnSN7
zZ^E7BeHEyy{jKB#%uu!*$r#azn0eO_I+sT63YZurB=KBgORySkh*)?Z#TvFE7hl-d
z-reY*ckgpl9!M*YWU5zHVLA_=R$hMG)*Zv^VV~FhEDHj#<=osBW)emLJr`uE9Tpah
zd<f0R4)FGkz%OcZxhvScDUcH4oj{Yv${pXs`*kD!9RUy)QqDW%d2g|>z|i)hU;rxW
z#S+y-<Yb5&!4vQ3{T;Lrh7XK7Ly8!NW7I9R`wJTU@nSw8x!rMPt5duXJqU#}5bTol
zeeC%~(G&L8>C^YEP@}3x?qLM8626(XsBKI;0a|!8ach;Lu*&=vKDMon>3!84ZCp;W
zvLhH@Ng{9BG(|rL;Gts9JoDNUZ&tHyeL>5SygoD$Wx_j8Q!`Vq>cStb3scXk2ZGSk
z4oM}=%+Rg)3g8Xa<68^PweG&&E(zO~xgINm-CzZgMFg~l6Zt0{cmiiW4=~{)k~CSJ
zw;B;PhNe~$Q~IJ<=97_Vuq5u><h_LpCeN@H2rkwH+tdVpO#IIISjp8cDM=aHKVEse
zGgKl_Oft@y@eESkzBw$KvK2wrN&M#sQ&L&;m3<=guek3W7tNwwVm!8Ly~qAsqUg*u
zAHQnV0+HKHpVRji5iPE+!7`T169Mqw!}S%L$I;(Pn_1(<?%YO37LIBojrWB~{(%4l
zIHOGu>D~4prM>vC(pK+rk}!y_OUD44$Ng5?dr&WWP$NE@Xg(nq!ZnLg)Wuuc`NTBv
zMWf0D`^2MGL4|#W!o`zddqq;m@+i!znK72H-n7Q2gInAI7F2@0qAgc3^b|WGQAhDw
zkQkmG2@~xB$ExD=>b|QX@gIgqm%QbxyZYYyYQ0G1(B6ubI;pleS2j^oEDLQEgKK0q
zs^vk2!L4J(T}C(PG0Zn_P_<_pRwJ#zv@JL<mU_+_F6OrIUs8vs4oG1;*`FHkQg~bA
z&QR1$nUE@sLRtB~b0%NYVEm-?Qdp`rw#411Y7c68B3Y^691!Y(Jf^K%t(IvsWs03N
zULQb(H+Iz`waj=XDYzbTw#gKA^`Kl%lg@__`igQ0%=65@8@L+&LD~o@=tjShKG?sz
zZ>3WP#ZEMHh26uEHVz4;#j%%~0Jy2|w%o$%9%4D_4u#2R)0=1QOQxH%ZZ~$+4L#Lu
z(Hr^n{;r?Cb5smMeL6R=41UGhXvtCRVdPjL4{ya3f>LwZ%JF5{V+eFS93k21_tqKm
z=T2+6Bcy08wHjMwyiNLH!3TH(VW{zM<ECg^JhsAfWmKUNpMGvsVhe3Sokq>aw@ztZ
zx37>?tiQyBPk&y{WzTE)vTZYvlsVIA4WxK%+*8%+UN9}L?AIQKxF7$nG?_DLew}#9
zDkEh^KStn9H18zBnQxK(JR=HhQocRs$?~Ka3a@wcxGYu5#>={?Ht#|_dT<%<OANO`
z-2XVBd~7O{`rD^rwdEBzyp%9}05eu*sw#V@`uNIBC}uJF)TLI>>2VT{hA-^7ewrV|
zOV8_Gb^|Ry6iE~%fPcC5@;*MXD<Bk@nieCenHrcbqF0a~2*EBtA}gTHE+)Ve9cK+-
zZct$#*{6`v0gUW|af9QUaSkjYwo!?IZUWc^Ya_<$1A18!$#RX`$h^?Rg($XZFlhPX
zVM$s}h-&^(+9G-i-<xS&6gLYCMLl8}#m}**LrK5`a}hMmDt@(Lb<h<Qp$gJFJxzKl
z17o~0WzrH6q_kL}@UO2PLB4hBgP)*C=TQ{%L0K3rGd=giDdGslqo3v}XdIHlak&>H
zz|`0G!ih}E9o{ki79wuYD!b!^19m#z!-qmF<UyfAM9LfzCKy33FbnhKu-V8_kKL}4
z!8*XuzJ9t)KC78ZK}jFI5+0Ks-}6nR2b^h#=QAuu)AH2DJQc3~F&y<~m!4!Ou|{g{
zqj<l#fyuxQg>O<Qr;~_4AcBwtRfVycmGcfOY|?-q01dHigc>HoM50Pd;<o9dN_y+K
znVNl9xkT9mUD`*}m)!5C6#A_8Ry>Qb>~~2zLgJM^X9|*}4^2oyM>hm%?eRm)@vUiY
zXq-n-{ll0^pf8RXRb8-^RnZx$lO$^&(Uy9TYs)}#1`)7LJ;~7Jt~>y{soMUAEiWQ8
zrPp9iL-8>RCImkrX2_Z7M_k|zS8_v~6u6|9a!Gh*l+hc>o;8TEKSFc}rgLVIQ;;TP
zoHCBGtC(<$t{RS<kNn4^tW-QB{4KG0m_G={GJ;KcGNws+(`KXI!|;z0I?X&{uJv(5
zOdrZ8JS7K^h+%x(QKO<5*1tmAAX45BYMI^fnb%<n^#g4POC~=aE<11<n3<D>gJpsh
zG3#$cz1$<26MZ%f*0if`B@cz#Eo;9-dBZ!HwdmKZTbV11YE7e-8cMrXhglqS@c!>;
zbTw=(0e2KgF~mQh5FgMK5%^$)Bc{Ld5=%}Sp5HSkAg3%D;b<OIBuc<yO(kaC2<yFX
zFP?S!U|ne9KfZ-_ga{{$u{`78B3aU$R}`hVtDAf&F1xJD-`B@L<j}d-?Q|hF_a$XG
zlhcOJ<zU|00U6RT2$<`}vGTs*yfWQ_cAEIAM5G2W^uq`Xr>?otb|Y&-6OzFR09&&R
zjap#g>o1#lIa!trB_!&Bl2U>i&cq`XeggE}mp5+Dc$xd>QTe1owLft62-kk)jIBq6
zW52xdGsEt+gjY4{O)r%q)q$Vy7aKIC&@7%zJ=viNu{Bg)+>|g?tmEJAO>{g4gJEct
zba?V(OxQODYC;_L7deAbPZ=dvMfU(?Ue6Fw{Igh%T;UDJ$KC|4th9HgP8>TIc$G%h
z^E53q)D2vU<=%Stq?w5++EE1FSK$0q-3m*DfYa|?;od*5?~|1SWN=#Atsc4xVJ;B?
zdx1y0`ngOJbvI3n+?>RAg$p|G5H0K5t^TwWd3vNr!RC7C4>oX}IuiEt9O7;w9%{QC
zr$EkBEx4rC%`e4c9!OTKtb=$7nOs8t25^p`8(*N8JG;~o$4LaW-M#I~jg05pxB4a+
z(?Q`ny>Rf=`R&RQju}&BFSsXp{tgJ%wl<0W3^bAJBtyL|6VFJRoz{ptMfbhbzY~vl
z$kI-4G_VX=7B+un42|*#M~Dq+A9ACz1UXM4-3VP`Fjz+lind74xzv2>x2rS_Qh~w#
zlF5V#to(l9crPYg5<*YiowTSAXrx5tQ*cfy|JdaeJ;8-s48P_#r)XyUrjwB$GK`u%
zs%>uU?UsxeQ_Ip)=VGhDR;~CEc~%qop8shwWxz3ra=_gcDg)lJ&bW%LbEZ&C0se{0
zK=^vs)2QNS3`D2Fu?9!9su$M8v#}E6FR53bOkQboiR4*KCx1lW86{6pVzXD!ff^p*
zD;A9k#^@O!0zqKz=m^e5e7?jw4=th>=?BG252cp*y-`zr{J0M+uH??&m?Ur<gO~bS
zXLHWg_g2^kKS$GnzL$hOPJ^8M4z~koW~V0B4pJ)PmoWk7=<TK>MKkth-A8n~Wt<A+
z+2KH>@XG|gx7|aMwW<tM+lakASaN6nQMPpK`Gy5`#OkCNS6^TGCck4?ept-wF)5Qg
zw8hQHLm%AL7R*~S)n+eLucx|`NqjT+^I0I3yMdHB5=m;$#3JZUP%=s~#lXB93)sn$
z`>y!PBGmh6hG0{NYsUDoA!PG=<%hZnTH_B6QdTO^U+D8Fg}&n=-wkMV=^Y&|<hOtW
zC8YK==_@Lde{8k|)yi&D6Ngc^4uQbZ#mRmjaORTtX3l0z#d|oUR!=np4HIF3p9`8X
zQ`iOjeklaH5u(tjbVeccqE~SS3Ad}7P!FN0^;>c#JY+FSY!j6jC1W&Wan0MBYUL5G
zzBecf`o_1-Uf8g$xc}E?58qY@WvvqpwxsbjFuua;ecGl@at^@*-@9No<ML)3IGf5J
zA}NWHjmZiYIcNY&a}`KgCpayG`kvVmw}8}Z)j=ZgF7>ZHw1>1MN^wCqWHRSR3!~K?
zHTpqmOp5;uB34|EE*nAM&ZAdk#Lm?eI@;neeZ%k{XLu)8B^a?O)Xs!bC`VfvY(v>P
z5<M9T8`jC6{P;m$+nkb6)I@bJ>*s$xCAZNsWE;>hF;q4sU8PTj!Qa@31==sA+Uf9u
z3G#Fz_M-)NZUZISRE^$Cdk<<9@e^dYnH$^>S?)RlqfSmwEcGCa9n&vnaf%O1B?Kr|
zP@U2k&iG<hnD^K5EtFUA3QX_rsvZ64-jtB|^i31?5b&{w>_kI%&=nyrDTngSd6R3a
zIt$&s1Ei*zPHT_`zzfwtaOn_;20A$8Cqpm_5YQ$GTy5d)9ymEj5xt_KiZmsTd<g=q
z-yFMgIM*8nA-(1o;R;C7!{8GB%9~5-zIPnR7Z*&_@h>XqCQL^nocdnA8@l%U92EcP
z`h<EQX$Gg-8#k3$rJq>E8DIFP{+2sPvd0*jilCICG_p_#VGnx{kh)_317bj(zvC4!
z9{DK+qvVrtpAofq-|uR30@ZJ8-=S*ynUd27_8ORWkm0Eg39SCv7AdvZGr|PUA_dwi
zjNy*M8aid^&7^p_T0MQKN3|<)#}xcXG8ok#SGEYT?lDR@l9lCOa>z3HRL9cAR?3|m
zzwCQqRl5wx7XKaA75-2eRNA+UA(WOJ5wmcyb1)Bo0wO*7`b-*fP~jde^K((~hI+v|
z<?ar}E&K`YH<ZqL69`p<btw=(4_;zmEPczI&?<{e!rTScgwSPt{Y5$5xtIKA4Z5>5
zL9@_?bjea1w&WqVxyn&vl6a?Y(}|xjwQc=SU3rucddQzs5$qRadK{2xK6p<SYx?JR
z=)mdB2X(&GagkhLrmJBz@*_3)cUEd8g;^6zkh>ev#{xO3eUAFu(_`;J!*A4>@t-i{
z2N|xbz%9shC^>FSIDb`>mffW&Q=z9WarY-~j~+<ScHTNHh~sy-sf3QsZX}_EBNNW9
zLcBsu!Ud5U(q4|&sUkWwJrJ`6F3SEC_>JUy=wCGd;BA<|-|#wdJkZGLPm9KP*uj+O
zufm%UWXy|rhKYV49qo=P-jAGy+#9oT7XjrYbR{4xt-g=Exa7bNcJRABa*@MAXs0OE
z1u-IJx7`>{!0A0jPFL~IO)^moyYnUBioHlLuR3a<c}p)8$lfHq&=(4Fb8`aBD+vtu
z6=3LhYYH&PW;ZIpY+NOq{39GOs^6GJg}0bwex`&D9h}Qwu|Y#j%efHrnQ-+3;p+5z
zB;(gn7o40kBPPD?KOglgH66ZY=;NS+y?6}Ijis5zZGTOT`MzuoRL-l*-hy$lwO40V
zr^F$A7QlzgOiZBH!;H&2>e3Aqo8rvJ4!O??6VqXiifQpQwIMZ06>x)=@%msq^E8Qp
z%zMvuSMB1^PZb#jZ>>);M0hq6cpx~4wCL(*>li2^u>+2-zakTb7$f$0A@@#?4qm=J
z8qFuazDjS0MLI0=Xc%`zqdMZcdRK*U!KAzg9;FKwWmQ;SNGgWO;`}y`G$5)<ufzy|
zK>+vcm5m^Rm@K@1NVx;ss=N0IMAkL0$jam&wMhDK<nMbkcS)Q0_->GCxw=JXmCtnw
z5p39XbQe&S8x#bwv{scQqhd^}vWL~LM%?@(TX7f3fyR9rbz*|8x8Bfj({jtlIu=Pu
z$YF_|<{};o!VybVjq6XYkH<seK45dMz}TBFZD1SvWHTHgRI5o0x_}@BzVbaipcu4C
z$-s!=`1&@?CR~~ec2`Ukjx}|xs)84hY<+N?<V8q<Y^j85l9Z!!c`4<Wok+x9UCN?!
zXLA(N#;~0r#v`hI1|pMV(K<hm2SQEV#L?}ZL@^C<@I#hd^F6{B-}^QF$D#L4RJyN;
z4;V=1EIlA!?3=4lr9lEBvE++PaqcXfq&dHXi&o(mSpK!URO2J#&u*%dgShLa62%B%
z-<wKAtyNVb`Al5jIy5O%_8i8RkwBzs9Fm7##GUvVcVuL1T6Xx?WZOZU8sJOg>rt9b
z?-N*5r@Q%G{`c9Cdm1h#hVXjO-#$eI(c^MdJc78OJ~kYm$D<29YIETO?18(+vuOd`
z+?Q1UH)kYek+1n$P<BgPN~_$cs!S@VTHRZdg0vqcXT$=ZgyzcgBs4cZPeQYKHXi(?
z&T~9LMO%UyP2{{tGM}DzKC&1tPUd(UE}X?<{fn9itUnen0A+qz7+kT+3hP0x6K3cg
z(d0l-R@2oB27{e~i?}dX2j+1u5Z-~oCJ8=L(k4luL*Y%D^AHA;ARQxQ9W$$osJKPI
z&1dkCKJn~#zxy4gnTF8xIG!)RNN@di-vQM2F9&bmXxK>tLF1mWflA}~Aozc0@822B
zs_M6-bm-;rgXMkp<riN#{6dnTDBs=WAud$b93~WnbnPgSnX_|IesV;D*6B?#fq-6u
zSX}V+!N?j+2!dhBeQELE!QV3ht$h|>!~6L+Sz0bM5~#wNm4fNqnV~g5u;(7bpq*Sh
zzK4q%t?3klAOcMot<pomBoAYqy+kpeELl_~ld%Jw!J%eJD%TD8%iowtG@y{u*>h3D
zg4-(u!A*?&xU(NLsN-%5WT8?FX*P^NTg}QtXB7+qGZ)p!I{RoCxo(xtLCzFaCQGez
zww*%{#LH>GA<YTTknV%?d?j66-c`G#7rGsq79SfYC@M<X8cx=Su_FRwEWiWVHJVL?
z|Bfh&J6AdM4!YWm!RW~b6W&#zg>VqtqtP}qkW{dK`LyHbT_?`b?O8b;usTR$eErk%
zlB!~-R)?}O-5krWXeD&EM(s_Z07Bj8(FzT^3BR5-Q|1m=dBY%`3u?~gK7a3bp9@k#
z7fz*lKEXB4&!@V~`Dso+mV<7KRFy&&j*V~re&%PRw=_S#<;8sqjJwy_T=yU?EKo|#
zWSNg%>IEkwD5(O9c{raRVby$u!iyY8sNfEKo3Ob(4KSKTgc;$&;_HoBHv}Wr6B~DL
z$%`Gj7n2?0@;bb==mK*vV{|eEJV=<1i)qZ=EaqL0WG!>p!<oV!%nY`!3G7puznqVn
z*6n>LNBu}A&E8s-HH^l=aL+7-E8Hib)i~+YTU<@-j;D1!lifIv-3>x{9PDW55*-(O
z3|Cfm8IGe}+fWoOu;6V*1p@dz1?V6kb*R1zsbPW<j2zxI?#5P$#MyjAP4#X$qE^-2
zXqWLb!{^!ZRCC)X)_t5{g>%MjfwN4t$H?`sJ-*{KLn8@y9AXgC6g5E`re#**2fgJS
zZPdG}-KZ_uR-J8$SgNX=u~cd^L0JDqm|N%{@JBkP^1arsb@s!`G0C<X@wJk{Z##HF
z?OQBnoiSd{+kj;-PRa|oTd&SG<#cQ6gTs`UV%=6b-y9r!Nghi9IhK>9G%D_pYTZ6c
zDP5YgNRa&CtL{tP%tP>YP{7AezfBgE&&P1TI;cO@`(9lRtT!l(9wxXLX;G~X1qre|
zAoX<|Dv>uWEY@~mkP%Qg6SevSDqkW$u#nLRc$nz@$%R>co?MuX&yx$&JR1)yv5P|+
zm{kS07HTjRV_Na^wKRmP^cL>H<2fi`x8Rs`bB%B^iJ4cPcyJmIl334?Y$ibRDO$(q
zvKh+Wj4j3}rY6l&tt-k=Rvc-ej^sK15Fz@~afy}+v*jirjIDHT8`pUt9J6w}gdnHh
zuq-RG%!89wJcKG1g87ZDM5vDg{5-r!%R*xY|FWIWP1b3kDy%2f=3F*b=e2rx@@GH!
zv!DFg_*Bm8F*~dAHdbY=DvU>=Aa^g=I{w0!hV`*VQb!i3DM@@%jRoF{dQ`lT#M_>I
zi`1rr!r3sxZIk(W7GbI@yWlNfKMWeK6%>L9GnPZ#f$qYKXa@h~TnG{;7g)HS{NJ(E
zo!4o=T`899%o?9?5r05%F_%g*jq{gZtI6i$t7sn5KVRV@sOn$3+-5>m0#Q5A2_OtY
zedB`CryftgEIyZNIBQPyq~aaI{iVwWw_KT~Oq>CoEMA!nPRiZGg3r(_frqolNgd&5
zeWiq-O?%JR^_mZ~?Yk-lIClHwHGlG&<MU{}=GGOa*mZ+r+;#;h?>OS9vurKWyK;If
zk2la$C0q$z%^a{~#Qn0k9DWr<$rzS&!sU*+{x}L8#tvqWWv=?NL!PK@w|ml)(<->l
zSL=%j&P>V(5gO#PUMW+g3H80yxXq<3`rqLo7j6c;AlTubj>d~}AkB>C(LBxW2D&Ny
zveLG^!DT7NWrp@iH2k<=mYBz1R?!RKf~8}gDy<tA9~pf09ZI}UvPTETKZ>75$qiQM
z$lYiQpEbmjNqiIMsY3-6^@PdYdq+ydXXwpMs=xD^Ol{H6v`G-@SZXsfJ5<E2;OjL}
z*QCRJ7h^j=z#-7#`XczRoxlF(=i%<3c6PphHvIh$zuEcgi2m`}?w@vlR)73vcNe~Y
z{q~#llcOKv-Jict%K0___4Cg6(a{f%jqL9J>0g|OSdo-qM}}!O<OO~~kjjn?sl{6N
zEEv9T3KJ-qc7w$3E4He^Jw~b3C&=j+7{25*8uID%SU^U#S53_UVF0d|FuOCwWbOgg
zbx-hX8X}CN2Se;Un#AS2cWf?d)n36{s^B2iAyn9kyrwE#h2v{hdmQWa;B#Ju_}|)+
zI07t|sO`QKO9JwpRk??|_A<e;^H8D|cch_R6f)nEM6z+rbBArm#~t4%{waEcQdg&=
z$>p;5yW+hrcJK6NH8B-PRHUSk3fkUfFiXc)^i)L%BLX~9JiygOh-8SpvJ^`O&sokv
zD)E?VtC4a`bmB~V*yud`7|-F1lsS$R3n1EUn1SA^B5{PJ7AN$hielf*`{9>odgY8Y
zi5=yljpijOMKTHz{jqp1DA!s-&UKw7?*p8~v+4;}m0$G2mWjjwK9=+LXeGXT$a!uz
zuZlzL?dsKmjg`CCt_V{Natu{Go<7SifGX$OKqMFT_--r^Z*irD6?e(xMmbeO{2ygV
zQhvRQ=#s;S_%~z}$lJ5H*ffSwSC|wQ=_+F!(=<<SI?MTfn~O^}?qJN}ZY7I5XYD<S
zq6sIY&CJNNGU*ui#cps3lP)t3ut`vfnkl`N?N{&>I^_@=4@+C-Nw|Rfy&zjmxCqB_
z(HU!BWFQGprDJsC(Ma2eHQtqk0-FY^sdvRymX^~i${ypl#<MWzguixAbz|FNZ2)=V
z4ix!#tSk0llqA}4*=Iz3c1<@7PIQ44c2gbB!gwC+<WUqHsUyMPoUxw7meTInCELH1
z>N<moK%y#(ujShB2003tdK-t_RXi7owt22FAF4AimBXTBlA3st);14Lj&s|3!e>@W
z*3cIMYOAqC^@(q77w@!$${gRslM<+$ZnMtmVQeLJibmt%ZA7+X7B>ucQ$vlHLYvXt
z9C5*`_JbIS?*J!z8{QE}vV_Z40$)_64sISs)~*ex3sZ=uW5Nf-HqbJSQZ||Xk$#9b
zEYG&<q*-N#^iTNi&(ZkXrB%6VJU52y&f$i~;FiACpYJSJgXLF7-UEv;3};B|Cm#+a
zA(T0WS4i5qx-Sx4JQ&5+MrJ{Pm>1E67`}|mB~~`QMLVSs5R7&Z#G`1W{?bjUd#p&O
zoW!9Lyt=*QaH4oBwsqfb`^P`vB=Orn4*y`4Z2RMncx^hwZvI&Nm7Q2X_Y?m0<4HO}
zBjHG@kpAdo)c|oNDM0HB;MXW=#}htrH1;g|n{oruHfb9=BF-fwHgp#L#Yb|*sd?fn
zA+6628HO2CWdJMB$lWfr%MUOk1Wp;=PrTB!S)t@SC>aYo#r@adX)ue<wrS>{!B0Qa
z#IHgvNtgnC=q8O-32EdS2{~3AU<hOvVK8$Te0U9Xc!qM89h$*=n*>x43@cS9MLcuT
zdh|GGNh}$RfCtJkiVYx-4wb~mZ#h^&q;#QL4YQU5P3l)6n<==CuZmQ5Je*631Go-p
zGBz?DZFW8i-jS#_>n3UrlVXdE_|rgMi1Iu{uMCE7$GUJXOzN_nkp$bl7-7Oixw8n4
z0jMG6n07A=F0%9*woPZ&I50mu&fG-#qFj;yw}p#-8fjPv=y^hv^I9uI-HVXw{RuBo
zy@(6is0$RAl+Uqypr<<QeQvoYLB;Jeb6_47Ay)ly%O3D|3S#!I@}hFo5G}M7O(ar?
zQj5|>Y(s3oB0BX$dJwHG0rnM0v*PZiz2?jd74?rpP(3oU#o|Y$vlqZHY!`o_msuah
z)=h23xry@`SA*Fb<!bh4BbZkfS<os@UCBO{37@Cxj`EgI5r|cXxAJxB*m@zN7mttx
zJhjVWJ!+hgQ`<}@c`DZ?3JNZp?CTQdvf&t8;_O3S&naK&$|NmuZd^{5OMZdkLh=ee
z3^Vep@WvT^V{NmUk>7{9N+%6#NW&WLI}X4x(o;QaIEdX{SL(S(2EKZbN1u5)OxL9r
z)05ni5<8@$%_QqOijljzuk>dX=}~kHZQtRPx*cWk83|b^#J}q6yK8nz!f&(f!MVj_
z35->W7b-a!Ie1j6G#;@GOUGoibYkqO1zA$1J$4OuLpG^LnGdx_m_)Z)xD9j0xK`md
zWd2l<txf&9AL;Luk?|n8<3)RE5eb|0f+-FOwZ#NI79h1)grvt)yXJwM%v-0?rTbEl
z4b=XrTOTYZRDL)z;me}Bcz`XdN2sFGR5hru)~gK+);LnvzWqayC~%s>1l@nJK0CqZ
z;N+P4QwsEy{!p@qj^DV5@Q@mKIrrtq2e!cOry;D<oPyU>=TDroDmNeREsTAp(fRfL
zidev%2%I3sWRoG5U%z9E)}S&nop$We#aeMpE)_}br?SPgM9Kjwp7)hIwdt9-<~KLa
z#I8f9Ohun)CVtUF1TGYJ*gfr+os2^Kc!wI@KSVyLa=?d^W02kE)i6F5H%RFa3utO5
zD{2Xt3@X^t0IhIv;ik!u9J|iLFs?I^wnq{d&PEX88rEp6E(|jYcHl$j9*L20o4XvU
zzrt&B;f^JUk4OQw^~7SZN(@1t2b?In-pH<!mmtPR+KMT>#9ctIFm73@d033EFhe*c
zZ0WoJ#U3+r#f`=rnUZ8CE;i@>EWyrwX)K$P7;r&76+7A`=)fG1i|_<i?emI|O-7NN
z%!Tga;3a!aECYuo9=h@F_>M#U&3Hlt6cw*5jiKN{TNc*BfTby0=t;Ki*pE0_SG=?5
zwPP*TlGwMa#XZb|Q2;3Jd@ztOm#_pj7Gixcv@*iV8i(Rs7X{OCEPT(Clp*Wwd5oF`
z#d|E6wMMcF)#XsrwB#Poai1&53-nA!&<%z(7HFfM#FrZ1M0thV_RL3T{ElJ_tk&38
zi*`I<<+rJ}XBpq2fL#o#oqAmC(mJwc++T~I4)BcLMnG`z-!`u5oPg9g$9S4B@<E&{
zi=`wv?My)2Ux?pgzPtV$DL^K>K`-gdBv|2AO``;h+>pyvV1eoCs}IK263EXQI#tK!
zvs=7*v(-EDt;aagc!>M1&Zoyl?tC2;;coD4&fBAJ1f8(vq(KWH4J*+eogd5=S61(~
zE~+znt7}vl*I}0C`8)NK4Gi%~PnG9MPpv;sdg^1-Qv<_29_sA9vn8S`|LSQS5PPnW
zAO#X!!<F{BkQm)<csBxVSCF)nDf(3P{Y{3#k7y*;c~J*d!Jk>ZU=Rb|OeSW6KHtv8
zBah!xDzx3e7{e7LJge6EGEC6~?x5HOHqU<4<#E2^(%SgtfX_ddIYs9RZrTiDGHtD>
zXgkc`yl`L7AKYxG(HIfvm_&{~F2V#==~qCKNFa((jF*5)s#bmTmWxTBdf8|sb$4M-
zgM(qa62S>8a1*Cxu96$dg0I)S5H0d5p6b%^D&m-ePO^zU+0G-#;b4||6;WkOp7l@Q
zP1XCnL4l1kI()8-^-$<4E%@aU<Fjr)vHe@m`xKu?o9a=0dP?xc=RN|#8_o{mCN6|M
zse~qzjD;2{L~Af?Oc;sZ73g`+Dv*$S^Du!!H`GHInp~zm?;Fs|CLd^EgQr8+{5%~x
zpJAK|HPw%u$O>)8ZXI<|WCrOI(~IT^wWWfU^)VV?=!1=^Ak2Y$3LJABebjZ7jUewe
z6jF+B<DA9x1Pz>Au7nQxQ1S+q{alZFOtFm6KY2NLVE+`n$NMJ?&fty{QXypZV}S$2
zP|^T)AiE1t;57L=R8KgMC!DXM{85{<Qjs$XWL?+-!rxk3W3D$;MLy&y>t(P-Vh)3}
zKOwpI;N45V<LDVXw=@AyW`ij}t7pZt*Wb`N*U^jGV2$-X1`<*%<=N$B&!KP(zp1u{
zO}ZidR-bh!h#%)7arU#SU>vV2Ren-A(0VB;ubj?`-_-C~`yLMT?%Z>d-b7~iT}=&!
z<=M^!o(s;~RlHEu%jv|ev;F*hpwMB}DWAsUWPk=J{Lc}kRS=22Orsn=rB5DoH+XWN
zVlTv%6_bOB!e|-QgVKIw%~e31-ZyyrI6;3tFX0;9l68Z-=1!Ge-S}{udX>F`KkTjQ
zbpX;iS>N~@vL;dpfl5o@!j-_GrXH~j=9x#?l<?=q&PCkJv&OZ+&ppU<oiJ<j^bl~Z
z9$y<HKW<gws=rWF=k>F-bjEcTx2I(#Ip+-}13j$Px+Xo|hvivwWq}5ZG6K8%ACy~&
z8~iVoTLzYQ5TNgN7FE6zUxL+)XZPgFLmGw#BTgtpzrGY=L@<_`)H#s)%P2eOK(8(M
zYir<T{KUs*q+7?ymcb>hFhVWXk$-=SzT4_csC@{{rjOuAG2I>_u!Ijt<hs;Z@2{zB
z+L`r^@oz~Y>L;^g6ZVF4LXh{Nuh$`YupL?1v6V5a0iSUPJ~aKnN*0D4_1vW8Qt1}F
zgq?eW#lk7+cqv*I{|-$N7q^m&<}pzYz>pRxN0T;AR3xS=Djct3(28JDW(dd0E}S}%
zd*#|l;*-i?<Xm1&`FLJ5fbc;L;0=}sv8W_a3MMfY<r3Y#?cf~t)4ahd;*s?@4LQVH
ztz=jpV}vCjNzgt{E~7Ay5loDOy3jf0u^v`HldKEsQFNc6C9dXJ+liC$tfakzb=W1d
z3|7{f@okn)bPB3>j*aCMgdNYMhSy#5=?Nwvv<GaTL$RHw(Hyxa%j(WRdG;7y%~Z-O
z%9S54XIAMDnXyEEompPN0pkn^On{A?>^uy~(cd&5=H(rllRYFh964JV*W|-4MSj$C
zKgLTq?+UJ~f;een`0sfKexSnvExt0<C=rEg&Ig&psZ*@UfTxEY&U}!OE4%iy=1Q-9
z#hITg8A4?NEFnzPPacJ!>v&18)%2XDhfL?H@(pQMI$m<@*Xgy(R%C$6o?MQrrmk1<
z1swZBxXO}fW<e&4_XLi0IKE<D8V1M@W>K*Xmn+sSoWoaGPE}<0L<3$M*pNP;l{Q+;
zRtVFs0$ZtZ+u4qWa$Rb}RE86#K#Rtz4_yoNZg&r>tLz5HbM4#$&TVeJNPd8hurhIu
zv35Q>v$C_aP8F3Ket=7Ds+GJt42m$D!c~c1CFLA$nl5<m&6J<oc=5=}ygRBs2B+#*
zlvP2Z2Ta@H+UF=hRj-l@lHoP+LGG|J=@tgui%Rm|efQlvzrtPH=69>e;Wo`?liPSA
zfu6w*zP#H-8jhw&@4}@U1tJfETbQWd3OW!THCkO;rHA3#2DG^F{~%xjQvfYshknrw
zb#N3j5*xKoRZ!+|p&LX%v$uF7;JH?o>>LXpV^AF>wqp)g9?#(zgh>RtL3hRNU*z_>
zUEQ<jBOlSe;BHNe)tjF3cMPUz{i<(m(<DDm_OwW#0oS6B(O7UM7PE31cj#^}aa5@H
zPJlMeU?~$;eZ%!v$y+bopuyp#z*#16afZFf7Hq-rI)MgLvu+hL)z1;QQp0|`p)Weq
z?vpsQQXD$BP`|D2fvi9ir}}3Wz47|=wk=Yx>v2_A-d0t_DwnNgvbjnzlNMGp!>FqH
z92vL%4Pw>abyjI~R-hhM(3<>X2wHhG&Z5F0Io7+HfoizAY?Y6f)O7w<<+hkYrVhOU
zH>X->wc@B)pj+#Uba}|Z%qw^ZogJ{1HAeLC+9>S|9&H7!ywcgY_Cw7Xk{v^e64l6n
zGG+PSc|*~0o>lh>$*enG^a&$!%{r5#@*>!BDM+=BG3}joORDrIH+xPMl{2C`h(Jb!
z_^DtpQLvnpoMNPq3#y0&t~tq8u8E1iI7S=^N@AxO;1!AYnP934<*|8NrNTRQHpd%q
z4BH9B1v9$MQrCz?Ph%~HLf*vD?VjYU4RP>8$%5V^MQiWZ^dD!7nTM3^bjsFsl)4z@
zh9a8XUsy*B;NEINNpm%WoO~!^x{Co$IHe`#;5kzb3G7^eY5lRulq{2^Gyb(IsdIA`
zF<rau<78MM_=B2KA;M&mDxiF)N{Y^6dsu+FQMg#9ec6@OG)}<gT=Eq;4<mwQQ7E~=
z@Q<PiB$YQ&2atv9z5uRNu^knt%zc>E?n_ja(S7^v@k>9=$NWwy3iR*l@(49jO`Z7f
zrEO}U@&}rd<o$kT<#c|h<H$G~UdH)#UnhB~;p&<G=I|(xPuuM4tzGnMd#|2t7+-Dp
zHD&w&L7P}pL(M=TAIPcqTpHpHC?^4dQ%N>!)RWOTk2T2W^g4pO%nCKwX#G1FsR=5X
zz({`qzKgn&txBC(wT<r5GPo7Uct<7vJYKvAj*`60A`>QF?+WGW-c)+3Igr12AV0^0
zk_tY~tQkQ!$Ue|F$>@d^=e9mb`k)z5tRzW`<Abc~YpM|wjX{^C4_&;{rFeq9Np!Q9
zPs05H4O8WWSLX!x=GOjJcMoUrJf4Nw?5<Ma-L!+8PIXAZiqE!!9rz4;#&8$V-vvWW
zIKmz41G|ro1UKV6TTC_~gK?{t2vMoz^3q(RK)P^ujj%=%F$57cm>MQ@k?|XkZ8w}5
z!p4neHS<?5=B;4a&G|@opxXrJre89}-djG6i_>V4_9m5bb2T?mT;K<39#gepgu-Bc
zH!gt@1{kiFcZT0pgh%P6CNiGeMX0QlU9p?!aSY^c=&*z8lB85Gg5nnA!qmOzEI_P)
zm5Y&Sk&5RCIuf95?g+nDt+jS(DpODmW<7&m6j)V@xOeqc*O6A(SL{|dpSxYXZ&hg-
zRiuR@L$iYSZ+kS_9?_-0J=#{H;7kVx%ROp3^{Eh6rBLYQy-L6)u-#f5vJNperD7SQ
ztxD$(7Fe<imlyV+C2V;Lx<}%)a2|YJ4b6)J>=}s$e)^`rG4XNr9Fd%H84r4qxUSKa
z))NhIof~^`9<v*BHj8#|2F=x^E?ZBx7mHR6)(i&vV*yr3jC!?xefSF3);+Wv^vnP^
zY|@L8$sz@o>lY5Af2GJzeP9)y6X-K*%0;?JXX&&v?8HNDE3W$2*ns=Utjy50hEg~r
zY&M8gQr<6DsC6Pf?dg5qJ3Tsh`SxfupZuD$7>41nyG-BXmS>lik8KBZwp4XIQ}7MQ
zbslrh+d~Pu8{L(@WL$mL+9hG2%=@xg<Z~w-N6LplRC`q>i?tVZ2_Up?5iGpE{Vkr`
z+PJdBDw8g^0CZHd$Qt=k8^{?_xvPGnE_o@|H_&<#&OB$h)<qWI!04w`xEJP<8-zRY
zXSOy^d1H~eU$j%{EqNz3Y78H$ckj=scs4mgH)@W>!E_Ll>)o<3_N+V~O+@2lGGnV1
zGx`uVcs`4h>wzxlbeRe&DAt!wt`#W(2bisY1@ycL_&BrwVguH25=`)X{8=4ywpDoX
zZimo^N41oWW{Dn{aXg1v^u>v(u?ibbg7=5Vy3U(zDByPymj;gbWr$Tv7A4j5plStj
zdCQ4g;Tdlo%(+n?DcC7bXE)e-K{akk+btL3R;T1mRTldMhH;Y4;_;n^yk}#_1UIC$
z&tY&dyAAL17xt)uPvd9k4MgiP5hPC4j+a5SUt{m!il(YA^d-o*nwymJK?ipp2Ja#a
zeXWcm!H=kkyxKP{IY~!w8xi^xq3kbhQO6kL%UZKslR~JWYrw~s@6zIg->r_DN4%o-
zaE7woo$3X*5$%Kb8miWl?B#YPHY#wMF*X}fob-iMN8hR9=h#UWNiy+3h!5*OtBm33
zmWoOjrVOhXTE<uaC%l1iA)GEw85@_jI`!`Znh|;bQgtqHmo-iDz6%14eOS1Abnx4f
z1644}Rb_2Dz2O~(!UlOfO(^9ThK@K}$@p#*2rO`JmEr|<s3Xo3DmrcI8;-Bj%gb8n
zUU5qbbKtp$Ia(sIbF4c(bzlzl(jmO+l60>akjki60XvyW7B$JBn$9xJ>YYb52*H3X
zq)Tpn>`L$zDUU*uKUHClcp~Fl^1{|xD22~;&(`9@M1^XCR5w>3NQ|VjLz$;$lfVD$
zhtZAgBcPw-b-YUj)}w5yDp1Tr*z+jI9lt~J5Q`m^qq#-G;0S}-G&=a1b-r|oZkd2l
z?RK(sR|<M3LrhyJ3pyX<+s0~I_*sYV?yS6Ek&T+K4OLZJDy&`UT&cXgSnxVUmndWG
zk3Rprd$Jr9Np0sakt{CmkfB8%i_v9H#TpI?pg=AvghNPDiJ;_zVTcw9sShL0LSKx1
z3wbh&OW{IDN`_wZ5qzIBh=B%>aR_~VBv&y$zp%>~pT~Y3ca7f`|Cti7mlp*0SOi5l
ztrdTOm9?jAaAA9N3drpGK0T*OTL_NpL{bg%7ciOb#rrzK8UT&F8$-_;SRRpQcf%-K
z>u7q7Xp-mAoazFsxGS2jJ-BsdX-X&pAekhH;sC8ugg`jU2f^8aytuHsWF#sQX<!Ns
zFZ8Z*Te!S@&vl1qRbt{($=xtTM5I>14EP86#4h7$z;M8GLHbg`IcP%yCX<2U(%EbM
zI>xQQaPnCiPORG2=#03I(AO|a?*yI;RusWaqRVo2=CFi)hJ42PIFEbNUa_&7_IiAV
z;faqey7PXvioIXcOnVRr##iCupe(LneW(D4pIor?YYT=YBHO1bq8_VVkoOM%d~kxb
z8?W%RGoVmUwsJG4GX}<6Yew?hj`^s!HaVM5kxu#)rTQRIs$GW|A7|MFG*P%Wp@&Tb
z{8bv)kp!UhrgJ$8$LbBr$Z)c)FEwhy5Xj?4%X5rCXqQ-ntBOc4Ama-69jkXbd;Nn%
z+fW76*&kp0!3uZ%qn2jGpkoUzNi=o=J#*i!zx(kec)u1f#8dx|GMw>}xh%W;@G48+
zJyOX}lz;S1d{sJ-Wzd_>DL}+vSlvowZHg>}!wfs^r)q4=EVhH4V!Y@K6y6vn58`uJ
zq72XJoHzfC#^mW5-iE@8>HPGLj3UkIEw-n8Lf-{%5O1CAEBrELoigqT3VSCgGRKSm
z4kwfB1>e-lcAItQ5u>zT=rUqT2;YHqk^0i-hbPoh9(?uXGm`#3fBxmOP8#_|!lV52
z#5Qj_+rN^tk8>n>@r+a4@sbgK#e|MjrLRUmsq!iL{3-c7cuGF6bV7%UFOS{>8?3eo
z4s`jx;;ZW9mvdG18r}d>YwPzQ;<SEmFYtX0O<nxXXY=iJCl~Z61G@C`-PwP?Ir#eM
z4ef|zPvLoslZ_aTdO6!pG?DZdbe+_~t&`y0t256?>kV4pehuU6!xy)ypf{_sUd60}
zi-;f--AcoTR|ucS9gvJm#mo2TLXkJI4Q`@u=8MGVgmRTxV10P1nYU(mKjO_8<+<Xt
zzeM`&B@A#V)4uN&xM+gU?~7?SHZH*V3isa%?yh(>+kG$1sQ<R3F;OM%H{x_@sAOV3
z;!g+wy^l+Q8rp;fS2tV-#tePd7u~rkV2gvjJP<TL=?38Qc<!9<He~bY*WTgAyfkIq
zn>}5nMVf2|0H~?$DnmM<Hx9L*++t{qRG^*3wdiJX4f_N(+lhWBO(Sd1`D>iahSUF^
zP;DO_$p2#Ei4TT9P-_kUVm(2Df8|1n!RjOMpdt~B_1+8xHXiiep7Fb@t=3Z3<hvzw
zz@B+VbqHQyVD<6iO15^q0txKnWTaXejnjFh-WW#2ke&PN_-#Dpfv7PDmr+=hSu~u&
zXgi#cLA%HG6Z5V!;$7DMxACyY$ihAy>)N=0^$&tB&1}Sz&8r`Yc@g*4F!@k34|(q)
znYtR;y%~F!{*AbiGf&sQU|%dTMa<KP87W#t2IeNrl;bkz;X*=AC+Tg1&ZFSq<hTc(
zBn0YGCCwXR#xzaLn^HRPj|(jLXV;>%%vX3T>9`llwz$xz$V2{u<s74{gFRjsQE?l=
zUGNMZTEu6+``zy-xEY!r$MfYE>8;=H?{|0kmxH%&f^bZlB9|=To@uY_#$o^d-`V?j
zibV6;w?qnhc^ot?$*_qj|H&Bc(ekQtOG5HQTDeEUC>&zu2vR+sUeR)56*(Y7V9^5W
z!!93H0D#lTIblTIJ)J$^R0kXbENLjFxG$^@Dv?qrk~=e$gV?bh&2J{!M9yaKwnsVg
zA`xS3gjF<9I0l(^gCmg8uqGz~74eqh>z!R(!OG%UA~bsHuBT8De?R+)o=+u9&M?Lh
z)kd4ljND;mAvqPSJo*?C!U9g4jkmevL*;hKq3))90vgc9MQ9x78T{w#5?9`>EaH0Q
zCl8l;;|KxqMUh<-*i+8b^&_WT6z1(8c|{z1gJo>!P~|;h3Sfe<BI%H-`zpkYj+|HX
z9LyG1;UJiXmYBKRpG89=#nUgGduf>g@*HuF6LFX_tZ00s<Q^WDV^_7>SD42NO_R}+
zayNq+7G;-?(#&}ZuT=_Flp(W&&7MxF0{cxQiLdcbrs5X*{*T_O<X^ZjGDKkQhC1U%
z1Kc4w8LeOh2P{tuDi(#U%U0yN7%hcH4k^pmeYH#~2&V^Mfsm{6B~koaEKs)$4)Hi%
zN?ByirJa<hM1&oNCi}sdh%|%dDQo|dqFi*N)}>0IFPNv1!3C6s*&Sb1vImZxA*16`
z(9|aNOIbBRHzJpM{P++)L|$h?U9LY`zY=Z`a9<?UE*~?U8C{I8<oc?Te-N-X6uN~%
z@gupau{vHljvGPdK_)Cpj6@kmACWQR0inx<VEQNk95l<QaIa(?FkyqbT`=<g7S9JH
zE`-(D;zm)f#h5ROyc#tB#Al9}t|IL_|ID9U@S&j{eOzRmRpRyA8s*fRV)z;*;Z*lt
z3C6?#I9|#Agbw+^yO-{#n;%C(rezXd<j>DR%iILQM}5PHq^fX`(iFnrIub5}x(wM^
z<Yn){WYJ8D$4A&IHOl??t>n7&#1HiB|D)PY;OLc<OzVpu=#(D4q+Hh?Z7#kO#K*h(
zwf(4_y7yGqAUeDMsyP^zX**{+z*Be?FStw$@+j0a)*=ReJ`li!>XuLGaWV+rr3L=y
zh>FV-$-PXY96qH_9(-STil1s%M8l6MhKz#cNfxB3sMS|s0D1@E?PG$|<)vJ!V+ssZ
zKnK{Z(s~HjLL!Hk`;}dTKkQBGc?i-ySsM5o0#{nh!ZF;Df*BLyDgpPJc7)fidJs;8
zj3Q$P47BBEt;>U-dy%V8Vnx$)k7SGG$F-b&{TU+P@&1jXL(d<21aUY0(0`$OTVj%t
z-r#lSNonhq2(3PAQ|bNKqBUn0hvwk|S>peo)I;3jf8o%^8L-6z1u0~ICwiIHjQ0Q*
z6q*W@4NVH#0jmBCw}fM<%dUv4mF6r$>0FO3_-kw6VGmG`&2G1jlPzQXtT0P07*d$$
z7JawXpK!d^safks>t{}w$2C=mpZlw@it-xFMHhDp0!!4$Wi8XAL()er-IdCs+lssU
zuC8&Q6)?y{EG-HfSs4w2Ns6#MY~rzj;p+H3lZMsbai~FW9yl5VC!|2`MCWISII`&#
zDoz0ZZ0gW8GfO&@{4Dgq09PUCV7pVZ(N@=0JE2E!ZDd2d)ntpYnc}A?OFi0eFyi=9
zql<^xJTCbN=Bbe4DQP%2;sql#K?^@3OL;@c_fB72(0n#}xXkuELgSldjrO@WIxK4E
zSCO$aV`T4arVZ)$BRq|aP$mpEz)n_w!|xhf=_dtu#?seE;(VQQJiyy<v4&4c|F%+H
zJG@BCLIF(3_f)L3NR?Y|L&j-O^=kcd!NC^QAfiDKp*Ix-xFI|LQQ%aP<x8ADOL=Mi
zM)ILyy`YM6tpE_^RZ%f|xx`$FoSB#)d5<2IfluMQin)wtNV<NlEDmZeFc|omK3yKY
zHO$6<r{D>Ypp`ON>IZK}&%PLM5GN5TQ=kRaLZG)4cx>SQWH<FT_?R%Pt;r*eSsP^;
z+^aAjbg0I(zVk4<#&AjzqecOOnQ8~KM~|7hz7+DUT~`T*gVmG-P=2|}l5<DiMvcn3
zgH_DgEQ7KP8DLW?4F=;7ms#kXh+&>}P0MSTl~<XRWiCR~zUHE}HR-uS=vDo>uTheM
zX<*v#mFVvlm{nX!DOrD8+9!z2sz0A9Qmg&||03Yu#`<J-(43ZboRBu_&*nq8>d!_)
zy6TTlh*$k_5BaJ;e#!|y_dTq3fv2pZ;fQELLIde{3yYDhaYp6J;bR(J<Uo>zYYnMY
zjoJ4X4O*Gl{4T9}v)1iLQU_m0>$JHh<6g%q?rRbE&?5M`hds~F0^W=D+t;4w0|2Cc
zv+mJb9}I|}hlK><=RtviRF~_+1M%}IL4x>sc$2AyVpc`T6|8GTSs`2=xEx7mQeIOj
z8L>eNoHq}-uW4UpG#s29uVK@$e!aq~VZZVC?Hb2ys<7jvUYZF=vYeNAc0YY@sq<GT
zZP<X2)}q78a`J|eOXU7nH9a_l)IHu9pLKOZ>c;^juXX<01{0sHt8AvREJHA*7wn%4
z6A(=}#%92lc=#{-7%b=lw1>nK4rtY>(c2FgiWM&6513KgjY-|~R8~jYQA?4JucCQK
z|9pi@bRwdw#2b@6Cc<dt^m0(ijoZ4}_lRpW&%L57F4Yk4y$mN6X&h;T6lgNWD*y{^
zsX{(<!|V3IQ(ixkLod}sg=O^PG3Mt}SXkDztPJ!`U$vBY58%nN@?=^0r?RYA7qz-}
z8cZfOWTLX07^w9T+bNY1L|H&g<t{eEqnUvX@gr^6EQ`zGS3#7FVd*C$sl1h8IW|n7
z*P5g~mbvQ7Hsw>>zS6+jcY;bde$|Jlv<90rB9$(RB1@&q$cSuZQln?_JeHVZ<Reku
zT4}oZ+2KY;<3%};21oN~o?>c`Y81b$^dfKUlIS)rGqed{_Pq<fP1AE98BQ;cUuc1O
zs%OX4)FPvdmK2C13)t1b=&kr^l-vN@&T?N`#phmP+a$h;^YudP!{qM0H;v;nya#8i
zwy<_YaAm{J<cedfFlf4qvJl3t4v;DZqz_I_;@)>RqnT%c_3knlz<=%h^*28ccmK4r
z^Zm2o?|=Bs&R<9LkI#1hwEMIA<2Spz@crwz-<+Qu{Sfc|{C!f+ulcW^cfOB~esFAL
zclS^Kvc_O55+v;0FwKU%{4Xd9&AUmpl=nYx=B_fupp?e&zz1r5r9ch+m!}h~XT1Lh
zHpY97b&*c21l&z#w@a#buJg(>valpmt45#1@dZ1JEWSbGlMaG0V|46pd<D1QuE{Aw
za}`R~peSg}bd*-k-<$>GSxlkgnMQ+k>_p{mPoo5bz!^2VHgqZ>6Bo=CFbmLiy(&9%
z%94u$%i{P}j{2iiTfu#lIKXg$#mOU|kRuU|xL8D<Q{cM2?7W}@J!Oi$tfV5kZcM$+
zU{y}~xqLWDqui3Nv7&Mtc>9XZ@&M~sf`E_KE1V#UL=-w!Jq1=UloO(ndW8MMj7VQY
zbOv8S5_NWptCHQ3sWlDgpz!|MizkH5<)xDe$4xr+Cx8q>E(&-xY9_i7mU1lf(bqUG
zP%YrLxH@oUgg89dxB0?*E%3B*gs+a@XS<4?tS*188Hk`txU+XMhYk4XFG4)SOoI)*
z0GX3Ix)!M)BBj&M8MVZDHO?#ZQw)+bkIkYW(GhY3367({(puqT$F2m9MgVy&HnxMU
zzdk(s^;gotu5GlKi&Ma_qgc=$>Qv1vK@Mn@Oie8c*XTd~p~NX>QBh{3_s3aNmq{>-
z!pkAuOliTe4!h3#bV9ym>nJU68n4{|_YK&@9dHXyaOO%p0oof}2`fwpnGWw2mJM)K
zI5h$5DwcVLTpJ0|bq$xsNyd(Ocny1Zn^unv4N7Og=BWF_TwQ9-^25ID%I0L^hZ#tW
z=0cVIHaC0i!o^)&<1WH=qct`0ni+7qMVgSQm+lF&$-y%JrM4!{)5CDth;7H?t7v>J
zSeh|L3nZKbI1o$4kOo7S9ZvJk!=Ddr3CgM$o3VuoRo@o|c9o{N-1Jqw)Ly;V^*&(P
z;@@bDXzjGlcZ|h0F`|gpbUTNOe_ZOnam`?B;RIi$xA2E!e|QvXgOzaK+&NX=-@Maw
z;2t78{yUu!v&`V=xZnvQo2tZd)g&Efdco%{28>vz0A!x4w49O1+ju9#$@vb`q?kzx
zgYt<{S;fkhnG~L~+#EB_Ed0W@6g#QPU0GzEumOl`;}B<D=T9lK6Thf`MoOH=lc8dK
z8%=6z+NB4k)1_;&cRF<xp{n>TSQ<74eneswWjA`cu`2SHWJgkuC#T0B4$hB)*GGTh
zj|X;OMX2N~xzs#*1j_ba6(hXy42iZ6k512zUmYLfDEZ?-J@$jeGmp-exslH4Q^Fmc
zGlt2zV~{1djbdci?m`$o-{w`Df+6gH0J4cyoKR_}y7a|TjiL%4K0z{=I`2S6AZvnz
zd&5e!<`qrm3|<Z`y7>ju{7rn3bG9y26_`c=vm%4|%uquV%<k$ub%{gXB4iv(@S@uj
zak}=k1|O5V<Y8GC?dH>^`gEz*9#{?+czE-yPmIXKDGC@wa_E*4A1k&bWtr5V{ZtRo
zqX&kC(ohyruyuNN@cFafJx9!U_~#eTe*Y!@^XTy9*}=*4-&%is{?!*-K6!fbv)?}7
z7Z8oDqnFQr``i8BdjyoNv0d}<<I%@O%tZyxB2>g4B$c(PUuAuP@8Wqm*Tn}p%BZkv
z$gg+#dTqTn#H9=NPsRdkhe2-_FzmTW7Hu>f=I&}CKE{f!wPJ&r>@{+@OH*F10aeBr
zhKpDV!_le0xGgrxfA!@T&z|i({{ocCG6PAY_PR%(Vq>B!S&j>E?yOK1RX_jo*|T70
zpE}wV3!U0#iuXrI3y=PICt!_!_tlrrzrePCzaLD(J5O=xe3kw!q==GQM2wei^qO@>
zk`H{?zb5I=WO+X0^?BQH95}NgNtajBqr+T|R%Pwk;)0N5G3QoC36*Ogn`4y*e8m1A
zD;W<zRt=Cz#FYtg8J7TRDN5X-(r9flxiAwgiy~t8@vaviwod%Sy}>ht7lF{OxWptl
zJUcZ&5>nbxiJTe};}HQ#h+N?Kwpp@G_<gx5#Tx!z{^5!Q4f*o%=VtsOFelD<HJ<<{
zJ|W-)@4*w=MDT<*@q{+<gf{V%6Y-Q2@q{)}d!EoHye{h}w23FQiIvY2+JxitPmMOg
z1k!{#Av&W0ocKq^n?U<qJdO^=W2};To?b_edGIxh#!@SI_EuRqmS27tb4OTCVzeMU
zgvCSkrNjpmd6Egjw5l(J#TB>!2<@H$DK26GTo3tkA72O(sT7sHL(+|Amzvk;VzZg0
zw2Np^8<5YPheKpRlf=r~IFFRCRm}L-4A1Sp?CdMQPOYiP3a(*hUW4&OpTfbl)Txn1
z$vwoyL3C}q8}u~d<)t7f_^A1iEuTtFmATnLPKm(M>A5v7R-vSJx?iwAK8sn2k@}=>
zQS0ieHUaxGiTcpat#0w>KJE;XU>maoc&72C{RiCNvx#yMeDw@f^D!S&FAHeSc?KAR
ziE0GiFRQ!Jo`{#$L1FKUXPkhBP$)2D0RFxI40O|^EPSxbEtT)fFE;AtxCi37*U7R~
zJNmcQ@5Gc!72<<M8Ye|v+q1%ke7Pl=Y9En9Wi!a!9xuDAKx->LPNVsInO@wrr|<a?
zn>1G~J@y~+A(K|h*Y6cd@ni(bufi;nO10a$_GPwH%S-Hll5Ae+_G7f0sgJcCC{Bh2
z`k~d(NEsoMz4C!NCGWe6T~o9|^<5sC8dU}t<+_oAzTL5S!b@e+)Rq%<I-EZYslsZV
zeNR}m%NinGljLNl9aa0SN<owINyLRNnV6VbI2jUTgk?{5sHbjSI+x)r@3cC*YdTpp
zg`=BoV4=9(>WP!!WV9NqU}Uvur|JhHUvz7&Msf}<KMedEkMIjTIqbsR(S6xjS}L|w
zb_T2ah7Pq`*s~T=)^9Fp3D9adGc&eeDf%L3&{e{u)3@!rN8D<V-s&jmDO|WoosLB>
z`8piKh1sobf19f{o!lj%Byu5}x`~n8;md0K`M?DJP+?lmkYh=-uLUfDs`_3&Z1cXn
zFK7Q!7T=5`B~W9#ea)N4<u!A)>(-f)0B~{mbH4iwdD)!;C#uto)FgM~Q=Rj0k)nqB
z0Jgr=sS!CzC)q{oSbQi6nyT{1({PgJ!Pk^u@iHP+Yf}Qs>DMnigcBUyh6R($+$FTw
z_i%EnN~17I_&T=O@-)(7VzT6I$i?<(y}PgF^LX(hI7;#|vvN1<T_IOf%cXc5Z6R0L
zqoP|35761)(Z>+u8S@vxR`jv>0>hF&Ugr3pq=5g9g5x<xw#Nwk6en<6Gi?IrAJig#
zx_k6AN#{kHh0|zH82hh*dir8y@f;fNn@FfpZNi~*#~-;>ooZN}NVaHn{S~c`ti&Fy
z#NO%A!OOQtqxt05SLrP#Wdoxhc7_u>uh4aLNAN+NYb4I2y{H)P!M<JX$uE0eTxqqU
z)B`c10iQlcF$owDhzkyeLQ7Rx8uu@4qvmN6V?FA=sadtlSNAxb%{a~+x!obGmww@q
zESO{Tm50sc0gM-jFO+tAyYwOJ=77GtjNMmR7JcHzv8-bRBYPxt@VJ%wQ}re2CUjea
zI>cb(Z&6Cvg!cZR>+WJC;2>xR2u|OX*A0_=X$2aDB_?VVDoszKu<a`YgU3jzoH%%Z
z(N~_qn|a`TXV}K6c=kxP%*V&-8dKsIO|p)KfBguOhm9S1(5R97#EX2&ND=Sr*vaj%
ze%yqcWk*OnoXk6IN^6;cDi<<+;(a00*d7U=>D4YnDpl(nN-({zStcKcv*`GJU#1yp
zu4<k+lMfeIC4n&zl<}`9&>PQ26lL~@%j>nK>>x=eU2b06KBM|-x6!C!J`y{P9JP;^
zUEHK!la9ODMhD<8wb7rUX0*aY<HHc>mpxffgJ24@a~t}}&hi_z<g^-+m8kA>MWR?Z
z<Qsmyw;=;%7OcX)OcB+^YwYzOt4Y{WrW*W-em9Vp6}A9Zoi5RkCdRGaX18%|W=Zb|
zcJRABLZI9o8O^4q_H=9HJ*Y*GO8Kx{8!B<nC>)AN=vLRUbq=j3c}xK;R@kNB2*$a|
z&0`H_5WGn-@Je`1Dj`^xVYlk>q!T>p1i_O|U_W_2J4z6IqBHKQ8aAze7QC8;(;%Wh
z_9k(T{|(O0-cXo8nJBXaZMfWex`F}o+Wy!dUpsFdawGMrg(H%j7>9e`eAA3bLkj1W
zkbQZB*k`CyhdB@#P7w@md~J;n<3Vae_7aplf9p)GGK~`_gRf0T=66c!P?yM=tPFh@
z=6O1fO$>@4Z7ES?LZV22vmxQtZz3!kH%Lxuhvkhhw<RUG$7H^}4W4Pp1#QEZnoY~~
zd1}h7$2zD)df8K60|%)oWIcar*AawB&IsYHKWNm1$oQ@AXi2I4t*&)&)8RW|JiJtR
zmgA~HX#AOkP!LmEq>FOKG3R<S+IQieo^c*S4_djECEfSQuoJNTGvw7_VWc|Hr=>X$
z{ruq)<oim9@3vu766Px^+Osde_`>1ZgI>o#OtFA0+4;m6)`&_4XRj+O28Y!ZPEL=_
zXUcChGu|f?-aQ$@$xrPadO`?1#}9<S^B}l84}rF`d5oP0K-PIEJe`fA=r~4iYz{HU
zFW=M|9j8xB9M5zicl?|6@~j>T>*kXo+<aPGn~kE`JQRk_10dJ<<JI^kF1jZzu6K|&
zj6>4{`b@8wGkqb=c(FtG%t<#a8OPkp$CWDSj<0cVRE^vdR>RkUvkBXcX}QrxrEon1
zK?&dH7_)p4a!J#2%}~5v6@7dh4~Colga?qeN=05K6mIbSSuGAif4sTy2i-+S0EC+I
zV+n!y=ZkCTJN4x8c+n?MUi8+-c+vAp-EU=OB{oX}b$VeJ+%bpy;N-Zo7gHuAA2mtZ
z%J(MnyN1v%3UtPH)7z61{mF?QJUP+r=OJBgSLHlRs5~Tj+AA?yH8}&0{|7fzBU*Se
ziWA~OnZ$oDBV%XMqTmLcl+^C#mW?IY8owQ<ONp&ASG|Oab-FDbby6{YVonA$oda-W
z&lm4E$%Y$elWc6;wrwXH+qP}n8`~4x&cwED<K_Q*?^R9L+&(pZ`c~KJnYs6#^Z7RU
zDxwrqp~3CYIvsCN4+Fx&v|=5RsL6$A!hnpFmx`X8*hQhNNKrkaXZ(liFek7!#RwrV
zK$vv9A<j=N<H#B1g-Hh_onSV5O-^E}oSV*O5<Zd@$hpX5-;guSlZElrr?Q4f*TZ3>
z^Yp?oe4Z%YfPmHxRg1_0x+N4Km;Jv?FMsTJAu=@o>F`o!O%)lNspAUTLE)LPKXk-t
z{aksEZI)zslwhT1<OSP5(6okc4>+@w&8Zi9(RE0e<LtJ7#GOqm=V2Y)h+|@IOze2X
zh}v;MhMErd5=U}fKjB7>-4$ML@8Ko<?A*fX)~2Hl_pP|x)D9)yIqF>^@BrNmf%Xzj
z>C0|Ntl7FG?2S`F@mc=e>}10BS<QDGyPDKF7+<7Y!*PKNl%AKlRNSlsNk1rzNgDPS
zfeB%%Y3R;;*>B7BZwLRKuCRHvd3<Uu?peP(KJ~a3-E3CM8ENv{9Jt<HhU+mqD#4Z7
zY}gp-<dE0yiG@ngcgN~_I20zAf%&_g4kac1Fa58bjESNcYr+Lmk#l;z6tBT*O~3hD
zJOaoNkUUo`giMoJyXL9c_7_Q1z}rxLNOOj;H*3t$r2{MWNP6l`U3A4>Fs#k48!pb2
z-$9K@Cyr1VsC3Piw7;G89BN7z%np_!XCmI{6FQQlXS24GGlS4V@PKjQDEKV#hN*<p
zuiG6;DQ7kulM^cl8lQGQ!vzPe)?YFu>w5Bvk;oQU_&yulc;IBn!GfB!BRJy?Wcp`Y
z?OfYPHC>16K|}7(H<c4@Gamdq9$WfR*dFXYp_k1yxwRfPs7=yiFW`IHD0O!3&W|BS
zBcGDeI8b!6SVf$NZvN@H&KLywKw6AFFpPmhr8O?<>~mo}-JjhX2emK)qM{6tLzN*y
zh9ysrxgTdXYN6Wd$R5bC_e{if%{#-kiPxl2rbadXY&p(Nj`CRKO`KRt%NIeGC0hNR
z{39of>GTV(P1d0byk8gHE}gXOnshS+8OKhQSxt}AxgS)JHu&i5(WT1Fl=mLFLhJhu
zNCS>#hrC477G%l<fBhC5r9bbze!Px7kNpTkr3k6~qbOxs*}Cgyb|$<O%NtW5OLxI5
zUDEYbu+7suJ{|PCx(_R=)xW4E#+1Ib`UjvoxRsj8i3uS9Dj&$~qv!p1o=uxxqPY{L
zKqG-`=q#s{l&C4n%<@|d!MS7T1i<>YE*7)^qj)9GeIzn(WQ?`b>o3R8FXi>>M)<GU
z5N=L10Pk6PVRQE4fC_BFB|q6>3({lou;&5Ap!?2Rw-zrgPWDpkrbQR2m1qMEt3hyL
zyMVP74i9UTwqx43GPhK%`7<cOKYwp5lljqNwOak0z+w+0i3W_iLN8Rg)8mMpFD!tb
z5car$1cj!xH>#=wEqew^0RTL-Lq)3uNh`hi8rD`NXuK*uyY-0NbyLlsb~c@HkafD6
zC2b`+Fvl?oDR;zigJdosEl&aE&=yJ*{gSzSadON_U5_Dlp~6o&9VzYsuezWe<V6(n
zy#1qq9ko;u6cFfJJBR|<MmW{=)ovQ1P2hQ&PyP4|>sOKirI3kLB}y1sNGf53i5WrX
zj_o5pihVxUpmWVizlu}R*a00QpxFT($=ED1CG10xFKCNmyn`Oqy_zkE1-4jqZ)H^<
z#Hc&vs(4w0&bxDv&(2@d%LMI!suS#BHPVrZf&yv|Zi?W|2WLR6EcL`?G=gH}tERr9
z5xzBybqAmkg4$I)rFbfI_<y0iudw_qVNnG;wankDfL7&}p`X9d7WDIP)gJt1e75_|
z)FkE8bH?Y9FBbgEsu@wxotk#5{|oY6;jL~L!p`*b?+|@N7(uk{-ii^n35sY5*%Z=#
znQ#Qk8m6l-B1M;R7|9X!3i$dXgQSv%ADMfGNfjc!O$e1tEBr#X*W*pcW^HG_kz#B;
z`vEo;C4w@KC|B0kUV=Xu4HVH_mZ9Fl0VO38`wg=I`ct(t*D(_hOxL2m*+rX%cIiYR
zwg@gp1vdK%Pd}v}@;|Jk=43&4l-S4(h3i~}kk4zE1;+4V?8m>6EtJF;Og~%EiJh!w
zQ!reUo0``kk2Lp2WGw&bKZ*$BDR+W4q+ypT7ofEQxrDxgi!4ZCXzn<0|NJ%BAtTSJ
zFh8*sk0Aivo}<`raGqvzlS7b<r=8W{?BvqQoA8C2s2d40U03_Tr3<V@g(pJW%-W>i
zMU=X}Yg9ZFjK1RyKuUjH+Yo_6ImxSIb14u<q7*t~l(k5-Age~H>bQ%RiV6*Z)fUVc
zt}vyJN17S@=@e;&OC~*|f>W9e63_dmUnI_?M;V=>0%#GBgHNNqhipbGh8ORAbODd&
zLn)>E#Xw|YXaF%)4`AI56^0`_Vsw2ZYjlFV`s?!cyd;t46amI#hEbPvBfnJ(7wQ<`
zkPRc|Fu~9574mCm9DXD59wnVv!YV||$B84WLlzZj1sjA2pX*^KeeHxWwmQwvQB(7j
zpdiGEeit)YR%=i$al#`DmVbcanlI(~l`-1kIf-{=B;vM*tu=>mbwK+Xf{ye1`@l2N
z*|M!Y7NybiI)UA#sOCkRQ_({?fm8^UzEe`NXY>4^%e7>dAk==A&AuAD7{&MkCRuE;
zb?k*(F!DIS$)hBfy<R#!+SXch%i`*(@_y4-u;5?Nlp3CvBGE>-Ehi}9^9@{Nt?7>N
zuT2%!iRBlEL2O;UUta|>4qs9&I2?;{DITtmt_d+_EPFEt1{(RpzoADDf;Z2QC;6|r
zuB+!H57FM6SnMK30O=Ep_VvaIJyftlk;uP2YelxKH^jsp3YCYK7NvaXweC3E&L*#~
z0kh=^<1k1S(Po6GJ0_H_xs7O1;-=1BO$du_aU5r6wiibUFq6w5mm#yHCgvVGw9J<v
zuYGODM6yG*K9!!|@<+(Yahd!}rKJo_H`p3Vz$DH}nMXpqY=y>B<$ul-^^LNfO++Xe
z)+U3N$%c)k;<49@BHZb5eItQAfzpU5P0@pniogv{yMgj<TqRhnmv+P&$jL=#5&9L{
zwmP&@hEdoaykml;l5*Da1|znAvbFIr7+Q)3ex9TnnuQ#7+2Mcu(_BhMFe6TjV|^BE
za!_nd!tn87uAowtiJZ58mPfi|`9)~4{QCKw)1jvUph)jvzmU%3ah>ObCDo{aToHh}
zkxV&m(^~3KV>mtKY`cinQE*gU#};FjVekgI7<D>D!ya}YW&i=o2xBy;2Qze$b2Uhh
zP~8zBzcfq0uS)n}>`lGDjsGUrIPiS2$2XbmgOR}x$^flGO?+0AujMRFB`_|3j4C%5
zmlZ<_NYeb18Qk_<+;C5rrC;TOE%-JumAbja6vw9pA;9Lz9Zk^^084t|a!CCQO#@Ku
z++^0a44Ojqmr@XUYp(lI;Ck#+bDiWk(Ca6P?#25~A>-FQ#jnLr)<KAh5>z|A8xUSf
z9h41tRNg@u^FTlBz3V*ke7k_WR^P=R(#M6vbon*B=udd>=-05C`o)|2<%9daep9ji
z^K<%>?z3c1O$e2ca2&u_dTRvhjxVYSO&t_`K!C&-xJ0CxarCuFi*kKM(TZ&-T$KEQ
zlW}NcC#8De?lw8p6=<&z!i2p%b=3c%Gm%)YYkP4@Dhn;FWCCc|LP}TC4LO1vm)8Kn
z<nfrar$4(v8&ri)XkWXQWkM%`&sSh?i70_e3|P@lbKdOL94V6PAXHs(TPJ{m$7#N|
zuggx{$YBxcx|H?{qK)jBw$m7ECEBzUJCdLpO31u3s&*H#U5c~;M*M)nYB9_X=Q#I(
zL?;d@Os_V%TOv%xf;TtWu#pEj5%MGfjprMIgD6)@hO>^>l0H-9RwgNtEE0A8vmMbd
zbKWL|kPsf;uj%;B4ox17U?#cJIb`!4nm7>th^ti_xC#$mV}3eGgUAJ&K)_(1G_A^3
z%=(!Gkr1)4)ysW=+!c;oFkqPw@pn(yYdH0Afb=HnD!<NNUID^h*m*DhN`s6a;8!i1
zng&8;B@$!vccU#PPKcA#q_RiRtYd4TwTKl;mAD=r$p^<Dgx%MfXa8>Nkw%Q$HkHT&
z1@yT)oADpPwP@StMT|zWPQ;SB0Xey<ChZeE3@QUf>`sDM2$TFy`ocjKO@2{Qc}2@d
zmcJ7+;pwk{;5<yk{gw?$hA*!p$ClUJi(Lxw=TczGS^)gt+W=#E?ffzSw;B63Ly(rL
zZ~_EZ8H2^`-UAXV8T(=LB5$44s}xN@wTzSN77PR!Fd)FR)~C_blo{Y6GNHC5K^T7W
zCMb(?c_eNp9FE`|4EW-ZnLP*p)f5D3a``X0|Mw?^m7xLuQ`K61APz#HVZB<%@u`3o
z3ly>2KMYH);f)>aSJ_5eFp&6>l*!g-8XDwEw#%zdqEb83qu=&GK8n=~05T!G;9$f8
zbVXAtZ+OhpZwzfsG)7EV5SdZ+Fe?PUK5iNhB)9;pjncI-&GvS}V=I(*rc(KMgtBsQ
zNBk)`B*NHYI!WcX=eF+JCC9nK=;^G#x1jYhj>3(Ulo%u&!3HL5&TMVi*5p2R79Y!b
zV2+K_3H|60PXf!rQ-2sQ1VrAwOf~hlT_a8pWj{y6&$ZAGo;fL#-bf6gEb<KEKoGg4
z4$uHtVYJES(AG=KNX@GpoU%}2ZYH!5VnX%*cnk%ucj@JuCGaM0o&2-~S-OnQcWw5!
z0tBboM1P|uh}pEJaMn|%UKz<2SJ>A*3Wya@v~F1%HLDCl2qhr}5icWSf4PD-SCI*U
z%BZ(gD>Gu`g(+Vtf3>Z0!HAceA~!ExwXRUx>$27wMV>@rP*>0_P=$l83UWMPpTUk}
z7FZG+*urF5awe^dZwQGNo$a2YHc>1qY=-28nJ@*f7BMR()dEk7HZSXO-~!7jD(V#4
z1?)-dgI{RVinIqRsnmZe{3yAB`|B^|Qb)RmzJ~IRtOg~B9JAlwww>Y{aEh{T_-#H$
zK6CC`QU9c+?L=+g-Qtf{T3%o@Z76<^^G-e;P6qTw?!%i4^14W+jEG4h&8RrWs>-$s
zXRH?yjh}ysdA?tKntpn0ue>_5m?XRRT{XgONt^Qj#g^sD^E4LjSXb_v?qV)#^#19!
z#Mt2*!yAsHoq5#WBAK%C-fGOc)SU!$`5~Yg;s`@X)OfkZoGFgqV#PU0OedTjb0qmk
zZ$#Gnb!~y0(Jy`lkA26~?8n=L#pw=Rm`w{F!(`R_W&)F1SA!FDmD}B4;1vyD7eu<L
zd&oxfhUN2yKBw*v7Ls7_sy|Wwgnk3Q25)sRCOtMIuYFgMB;W<k^-gHida+m=WRRSl
zD)#+LJKXPD(mTFcWpwT#H4-l4(0@|!7gSNjY+|pYc|oQ4MvBjjz}ZQIs~wt6k<iz)
zfIh}jvIiSVTGy2xLxb~0nN=atY%V~Y_wS+)d#!I;SCW%BjY3`s$XLlcO(#4U_<QUV
zEU8k|yxRL7tAPL9h_ZS-B^N1BU%_)G6kLQm91W@1NCB7*I6FPSiQ>bp@CG?hFHD!*
z4z+Cl<G`4k3a-dYzxmHYNgTtBCmpRp$+T3QNCkMi%2Imc16e;h0|)?gFs(<8tyLA%
zE#-NjV_R+=iwiCj)%Z)YGMIHGo9id3fW<op?$?sXu<mIIwpJVh8Gc+aY*`V;pAwZd
zJaM&$Nwft~O%d+I2(*GNesxCOE;3tqd7*zMWme7i{wcW45=Y&X?!=FSYjeYPOuzKA
zit8Z0i4xuqh-#+Pi^JN<Fh;Q~s-kY1f<GR>$YO{4MN8y6Q(j6l6Hr_e^Q@F=S9738
z2dmU+6U}w;XQTX?!OU&Y*5ro!Z*p2_tSzhy*>W`3d^FR{BxwF86Fb#c)7{e6JNNp>
z+|<<5bV&Et4jY#*4v>#`?PKn8`ZRXy{Ic(<X3NLX$KhV6<L&NAf}{Je+h_BIm-Dr^
zE`DQ!??Y-lZ!zT5j_<?P?8>4q3?}gxv?Mx$q7L_{PJlQ!@LC1jtS#*6&xU;|7k0)k
zr<%PHr@jDCHaEg0UE<a;mL}m^<fl2&+6en*1?qK$HpmtZMQG#$EO``saPJjooqfbX
z0}_$k5wYkiD?K4iPQdLe1q+dAB;44i)1MH@`V`GlkEmS@Q*t(pA-Z#6K-Ww$G}Eg`
zBIAUy5~c^15^j%iHRT+ehAkTL%8zVpY0@;fKz5PnVc$R4WNr}sD>o8*OJaCh-JcC<
zZ);62LMxzv?yf_L3c+a54|JH@AWRO2+Nc12yYoQ)B#%6aAz!ue?F#F&gR@09HQZgH
za_E=S$^f(pxL>E-*{tcu5u%!A%}{q|UUXUbV*FZ5@>YNEX}v1VIWZk-gf5%X1BmpJ
zCL3@7afm(@i{-(GYK-ot$W|nevM?8gKvl|vO&!3y_fUvSGM;Xc3XDwMp}Cq@0#i&D
zTQ8^(4FeYCA*zoxDNpU;H@?W+=AX*bUm3`3%l%q7cr5+q+uIEdQ>Kcoli&2)``B}u
zKi@3V235}x-23fqcCM~HD<k#?x4<bfC}n@z&f49wWEP}~RHJgItb6n494R1^4ic<!
z$<3^r_m_BS7e*($a<!0oIlEk6`m8I(&V#D+QJH^$a)@ZJ4W>EhGllFB4mAnP@xfmw
zbYxcSBe8p@9!MVqGE;+(u+7cSFU3Ffq#*{OK?kaR-Q41M#%$tb)!46Inx|(IzhI#B
z-HdjsV!_9okL;HtFTb}p@OS;%9{<j<QoKYEIPcT#DQ3vY1t$p&Fl-`f|ARaz-qYDs
z4hB&i=_E>5G<SgSAqr;fS#sD{FMdQIl5aPPBpLmaK^04H-U>ceH;4B<r?)1~<*Gr;
zIf^$S)eM?)phA_cUmWsQrB)17^(qY#Sk1@yw<!E9Gcy5?&|<w`b1NjFyAhd=23is>
zJMQserAGD`_c?8B?sgQ0xWzK;v3w@)n|R`-Mhexnu#PBYM-nf{{_nWpj?L85)YO(A
zXZmgzhPdklHGJ*deIc{&o(;@g`Pi|N__><LoJ1t!FFI`BVY8w8APJcp52ICfeMJ0e
ze~EFdR#Q8KKjM}~uTUvP8$3fsd0(Kut~5opkRuf&IZ@>$LSX}&0wYbeYPjjM)1`hp
zl4ogZzpf!dKst$QUB_<E!d6AZ-goWyCY)A^k|OS!ruy>;jm_3Yv5WptvIf4=Md0pK
zVchF%QrN>@bO3Z|(tKpF4PqJkaQ;7*h766;h55S(spd09lYN}t2P1!3h9Z7pP913#
z2}eQTf_+3>t@-Uh$v@F`y;a4fK_*!K%gG(a>akBRl2zW-6qWHYj55lG@$IcI9Q&c^
z?Ob?bhoR38`gDN38bZT+1OS)=ea4DL_kJT0cXNcP!-w5Z3kZg$LBd<;P~y^ZE@28}
zo^hdSQu0b#kPvMI+mGriBpyA-B<oh0N)@9Lx4>x>*}bQ3qfWvDz9x&eF5CTJn<4pI
zN4!e7T&Yo%ZA$do-Dz4?HrN4y4BhirKM8~u8Z&w+7d{l0cMy3Vgi1XLf+EmjBba%n
z-mkRHOaBnqGEvKV`)?wwsR>S5=;dpA@$)J-_Obijq7k9tyLuGzX~C#_^>r)R+9?Fv
zZ9ZJn8s)f!Q8}25H1CZZ1nr?*5v5YZd@6!OmIHV0k7P6s3oI{oZlz)r19>u{f%?fT
z0D>5a*)aP@iS;JUFpQec?t>6obRt7jcxtX5dqrgUsl`c^3!cy1KjNatSzZ|C+#8y3
zO&D}3`{140bEt$mH?1fH4L)si%WrP~?%7m$Q?>osYnv{BigslTCz!j7)GdysR3pNY
z_U}0Q&Er=q%pFcgjM%urfz9>Zw7}Z00u?sq4+pYX--yL$iV^VX>!*9E%wIj|Yip0#
z&CRaOI_UCJ6tOltW=8GROpjT1s5LOMYU$g2^rsP0kkwf`vwEKhu*HmMt42sWoSX06
zU(N0g$<3Up(SOZ8a9?k<UH*W73d;1Kh&8c{|DzzJWFek5&nf$hq2n7|-RR=zzIX7p
zS?ykp)8D2K7gx`}O^13d2^=I(V+;9&=*`{fL*0vn!87qHpq~nvv#axCE!ZcWnk{U-
zH2ozu(E^YIi=3;d&jN0A!e2>?b}8>G;Fuey`1hw?oXSwiQ(QE@3wnOKYt4tp++Kx|
zHbWjG@lQG4e`6r*^2p0MMLjgE$(<8_$0kZ@AY~udOSk{N6d>qS!Blf(>Q<K+dG-=3
z5>Qg%4&0e3OhEdqws^L+DN^dZL~P*I@8EWx1V7s{h@0y4f3E^ihtureUMY7$HAueD
ztp1hsJ%t@{4)-ahZ5y+F6W&&ovB5A*hGHO+B}<eNvDu5rVmkZ`t5|7v@n5QB#<J>O
z?sDZMt@(c9#$JRnzoa<7#xnSm9V@ZR6vL6gwv5ngEN*R;mtN7*89Y;t@w@!k4BhgH
zqi5@wlET&!%!h2Wp+c_CqnzUBPj%?b2EJ8S|1Ay?E&+I}M`jqZD~b(K(>fg8oYMFH
zqy+ZZKlKjowV3&#qLa6&4*5+n0x&Df3U<rF6&izZuK$QC@-!#F)M`^`uVrVy%Zj?6
z!WcESH*3cW<skrE%HfKC@Hn<(ZJ6`|RE4*vjM>M}GUq^|O~>Kx?=DqZ#OE~T75gbF
zP_%W=>ZC`De~(|N2#d{CCTIEfgVk&!x{?^2)=giw5zw83iCD7LCJO)j2Me@VIbZ^s
zj;!K#|8=`d$5^2jASoJZ#nyFTpNl4I(MqG);dE>WBLcfnxEimG(X>5#V2)FMi7=od
z$)c8sbmn2IT#PvtTAZ*p@0c{46|%S}@@!eK(2noXLz;rIY*Zg&&TvZU>uZUo7MlMP
z|5dCY*aQ&QS5*I*u!4MOz8kh$?_n9A>ZA+(-mqAGytwSYSUz7P8OpK_??Y4~wHT9J
zwv)Uwi*b*k_j+2oo_TU~Fh~l{9ltMb#c-QVT6f{qRCzS<)cjpYYy*DQTxiZE-85aU
zm+!ZE>gJ=}1JXOzgwQCg`zy)-cY04FZ4wIQD2hxJ`Z`4fB&jKi0JQRc%y;F*&hB;V
z3Vsv!BH<5a8Acj%`6Ia&-0#PR&rNWP_Z9}H*wUBn=R*>MUp?Ffv48S^uG`&}JxU5_
zzKBY7obyl(^N^VE{r}fDW;T3fd|JuCrL(4F;2iae&$#XOE-CFJDQ)BZy&>UD$>34R
zfR*ph&y{0@a*wO$DoM=R+qCXQCbejHx5vyuzkG`mwee``Ny5-c8q2IA#^-~^e@w3u
z#;hmcB0;jH90`f3zN*<v7B4<g!L@3_Mpg4Nr#@abz58`C-!Q>K^TMCQfV^_7-Ez7H
zSQ>nfd*XWiyb4A2jN?`*k@R49`<!6>;63%Jy@iMfsxu86pt2=I*&n#3F=C=$^2g1|
z-`Q}}nNuZM@E@mpl9<JHoF@)M#*E?hD>xC;#mzUUL(wux)?D+&Z)e1vG9zZ$>M2B+
zH8x18TK_a!F~*26h*0peT?P?V)JJ{-Y+48-U~(_D^}^TNj&LQIU@5#*K)VSoxl^GO
zw(7Do_vq5;`+tFI532yR7VD@KrKSo6XV+Cfpav*VWp7^Yw!B{!+QtiGUfHZ#Y;Qu^
ztCt-jT@-Az6M)#N(5&p(GLu|w)UEm5YjHR~&<Tv4saI1Ffd(q1Q0_LETmoQ-Opq<Y
zPq|DM<Z$8BGb45tSA3uJ7HKez*KY#WS#A}n1Ky<8dM&?8z|Qz9CF@Ht)ssifPB@A1
z;k{o5DPQ$Y4n(dilNnbB#2%N|Q?Xl6``d(!8t169lz7weC%_6u&JB&QMLDUZ=$>3?
z&w)F7{<YEU6Brt(&a(l7a?k(}xf~-Ai#()Y*H~V~$JBCicH>nI8joP@w1|%GeR#8h
zDTF|Cj6Q6b-wl3RfI3L?{@rzbJ1Cf^b3`SuRSuEC$}lBVJUlhdD-*i6>6~Un4Yjc(
z1<EeIKcA-T?<b)+FOVZ&Up#I%{ich#e3gsfoERF3`-V9%O=I5Xpl@lI5KifRB}e;n
zK7*fkwkT~Esx-=69YbiWO--+sr-lztvrlbOij@=Wr8H1Q3h@C28kz<`^g7kNPbXrx
z^&ZkA&sWb>DvPgi+1KTloU$KKM&w_w(%wHUh|Qv`x2}8uVr|8w#duwKn0=V}tLEO#
z?WE~V7^fj{x7vG_gsjXy!_qZ3RK=@9HL3%1T%`gsDLvwT>YE8RtaZVkDPen}#vN}7
z?3x?tD&s$Fq(=D(S{27(lBH)t79}hX;Y(SW9{juT7r!wnCX+Y9srW0&8uu>AdK$m3
zB8Zs<0hvL_;}BJsELNyB9n^xT7@s(-y5=-V6kuFB_PT0`A=QE)`+d6kSDaE5sPZlP
zVCO$O?1hpwmy_WXF?LH5e@Y{Tk03e4h4O@JiaP@oUo6tGRO!O|HQtrx^0hQ?AO_H3
zJroVI(hfD%THU`CE^Q}-OW_0^S}irkIKFaVzO~eygL9mJx+(?SVFq$rOCZ)lW}@v(
zP!70i>{2M4z-W75hiXH6v%M^O58XExF*ioBOC%D6E-R`}g26JUG9rzGSrhCs0wK5T
zEiv7Vy&qK@qSeJX8FJ1%mO8dQ@-u#F=p@at+N9^GQ8Vl6CALped$;mGSk#l+FNp_7
zW&x_D^vX?FD&+mPrA5$2Ro3_3*DGU9vyRJDEQ)9;93SezXI1knS0;t11^=AvUQrSF
zbzCIVfC^v8M7A$=5pY_(N?U);x<=z2$vESM%0SkCiY6~FHjU7Fk3fJ+X(!wwJ(3*^
zD&ouY!e5jtBuB9PJ};s9BgG`js4^#C;}9ogZL!Y(p<>hYSWm9i`}KZR6Vks^(<eeL
zY9B|A&T#3QfHDS2c5tzA{&k93*oxjuP^3-4MBTd_SNl$7T-D1F@?dmZCqR%P3a#?h
zM!ttJLOkDc`g*ux_BD<~S;0j0papyw&W9BpWugnPY%9y$YFinu4DmK|=F6g~7F4#Q
z;1uy8G5pt1s1CXkdtXxEk=fnnJS>3Ja~PTTVSFho1FD%@oX#qXu;7P;C&yc7(jVDL
zJ)S+ze?oHK-+k$JBSXzW@hgtLU*l{)-K}P}(#;eCzMpdFSH8C%zB*4$RkAKYRf(Hf
zX}kzK=_0<TbTqs%US;%7VUK&MEEIE`pWegHUBlRLb{8UxwQ=ZCE*5{^LSl`kU4}RG
zB14&7%ws0r5pdf+0abtu4q-N^cw{o~tlV&4od|6{ecLBY1DX`V7mavO4#j9})}@*l
zB*Q}B37yd`8L<VMG{&Wvnh?8;v2N8+N!=S8j&{IYoBR-D_N}836wr8kBLaO+^FMVR
zpcP$gNk4sHW~E;jKlEy#2=1&f@(@OboKID&Iav4Kw#DOPH!Fl3{6~1GpI}<2DVIlc
z1r3fUk0M+o{8~etT^7D}Ec)(*#y-j*vI>kEh3aTAS66A&qX*y|F)GraRyv(4LfNgf
z&DtNqhU2eyJ)R<HD+D$Hb2ckWq8|swN2Rq}s9NnAIC`~)1?|m)eC0l8r(`Nwg+lLI
z8}V(*min+QoIxMM92kaU{68$L<?k_^#bXE9MqAzKFiq=bb?qQ5`iUn<>)qE{ZJd*n
z?fdUb+icG}xyqd-lFYqM=K5q;@e>(Hij&lB>kC=Z<(>5p&F}04b}g6{z(r_$(9m{!
ztxm$T++8*Ket1ZmIyK8z7})!ni>TMKw}(YiPh7%+=Q$t5tdrAkr`Y)27`qmt8b%J8
z3R<P?Vvb1h$dTQUw05K~d;QbS2-F_KCYeVL8t1W8Py?JIYOucTBc@js5}BnteGoY3
zrAFHdz@ir&pdY0|xGS}&)}EQO!YNSaJtYObDPe(J#9583NqS6GZ?<n+yODuxN`fb7
zgU)I@y+fTLSwlOmbN1&wNFaBppD78UPt4C=6yrj&1|LsVOW>I8?c<Hqr53i6+_m+R
zqWnGq5%TDF<K48MJ#OmR+Zw3wj;~$;GrTP1iP)eE$!3CsvjODkk)aw|V>#8kPmOZZ
z#xYX5cSDto(M$-~bGj$nv0Urv^jbruCTMT*?Glqod>VSXR-d5BhV3OU@hJV!j2}S-
zw18o@esB}pwR||4%$5#wT=jLV<Hpl{5J_Z-Ml#3xw>BNt-tBd33@^~yB|BPkR`wE7
z2onqV^@=#JbUx2+%PsRWK2&?>?N9F2-7{a_*?|w#d{nl^9J#fCTZ;>rZ038x<x)io
zQk}~diTL{ygU1ar$i|xFV9FjU&t=ysl5bawex*$Ezr6NE-WLa$uuz;_(xQL=z&7go
zytC6aD>+EYx59Hjw@eo6YRNR-ocWjSP#+K?jwF=><%rco<z4wj3o8o+^|K!b-Szhp
zr;;jS7&#U~!_1+PtgkpHLK$7UJf4nyLz#bsnh3~-sOp9Qxn-tQ(O4N{-;lTG{Lhqq
z-=_(A#mZ5f@fB=D@k%H}kWJ<i63uRELv9AJVN>tIr(GdSu41;lQD8ZCBkaGao?1Y$
zWz2+F8b)U;A0(3<Y@}cZq_n!lxQ!U^Bz@#N_U^nOdwio|+A-n5?u`&ve5G#FW#sup
zWekuganKLwectz9v7^M+(Yy_KM^wM@YAom9dk!cEA$L+XtIFr+?vLfs1yxt@n?6^f
zsKcliRaY!IJIi-}`$Tpta!2SunsK`pZPZ+~P_e2Rurp?Pbmb$Il6C0NUkWA1x4`WQ
z>KcY##Wc~;k?B;>Fbw)QmFUNnV1NUQjTxlrLea(dAxbh<7@gCKNUBFwGG-OVhG)dl
zN~%`29|PS;D5bMgk;uT8@YW&l2{L$5DO0h|)MBwn<K5G&-{SSQxVuEl8xM#Flp{A(
zc0gO#vqh5DIBH6!IXQA|+d|$|M?a=^b2X@HKUlMcPXUN4GU>Mm{PHX~0jqIXioX28
z%1%eUF|cN?jj#-B_l<)|s=4_`ze5-C+3Lh9`rR^e9$E?<<kiUM2Hedi6ghVrBYP$%
z8g(#swdyRm`y=Jp3RKssk{{LMiicUsl)4e5Nzdx()?!21C8pMnFGcLq1`9>7<A9LH
zplYJ+J-tO3;>YAqjRmUdNYz59M<xXKRfT6d?(`(LF*{vUcIsUhP>7Z%$R>{w%V6P(
zgi()v8GpotcI^6Eur|eb{wmITj1NAN2Yvh-->k%4afl=oj?!rZeZi6pZrL*@H}nO$
zYO$u^&H5!0tpE8#nMH5O{^!_2%X2}pi0DOv!rw5m=fKw`Je}qlIk25jvE9$lSE|@)
zqz4l*_Cyv$wNyw!P;S~ma&|&6bd&sjgYBU){Ks)w6Q;ZQ@yW7(q^db%?f261DUiL;
zI}T}b;%{!LxZY7i#)+wR4|_Dgy+G<?f0qMirxHRwH+SGuQQ#z84O}0%HskNq%`To}
z@S8O(igve2A|yK$@83yf*()dAWqBfj;FJCGjY33qjOo{MTLe{2rWrSUGeezfzl@AA
zL)cY<@FPvU=)N;dNah`<+SSnUY8!)c{^TNWLTIiM!KUG;_{}^M@d0|^cBinc_>}>>
zD@IW^_8qIl$E0%LyAjLJ%MuIpvAbs>>W-p0Iz1xju?*5ut^1nTOmG*~LbQiQ+4`Wp
z1A*3Cu{Kj@I7><@`t645I?QS1R#uU4PzkkJk~KN`BKr3kiK+q|RN{JbKR0;W7p*JZ
z=b=<w<4?6w^?VGzN%<y5>5=q^`SATP{<nyR&`Ie@J}4UlhBIaXUs3gqC}fSF#7Lkn
zo5%Cw#^=q~47uQ3^Wc4XB8h)^b2ct0`ITt(E`?HQIT~bQYxt)SWX|%#o&#?o(k2Zc
z1)?=Y3@o9bEPeMSXHyaH2fQrw+{$zeH7}`U#(n$u{ObsRzptcMwY^vNDq(-XJ>a#h
z!mEXxvhkc<TtHH}eLW=XOgq0=7$3E56aX^C-z1s{7qW8qO>un%l>Ys`WYBn(H_a8%
z$2|xXrJ7S$K&!{WY3>HWN<;@fqq{4|s;G!#Q5~+X<_RX2KSIQ$q#=6>AD}tSzgF;u
z;Ha2~kH5&HC?iTdHFxSzJQobLR*b`)#DC@bBIE#v$D>b>tZnJOF25R{Xs4pFByz61
z17<j7XEO@hc=p26KOd*^6~?WD+ZW!6TfO09m%!plkf{*2ck_p{u6(<_lu=>uNmNk9
zBThxFD@#O>OHEA<_EOW;BP}GN%RKh_f~HT1_mI>((3xzyp+8?&`)1}iMmQl?z^pT|
zjn3|+)DssHGGq@o<PRRL-9B3bo7f4%W;a5oAeyC72Q?TqjrRT|5s`l`s!D5h$G?O(
z&QAiE^J^KG8s=n5=D9FGi5)8^6o-BXXR&FJt893xZAAOY6#;yl{>ciyWhm*gX=N%e
zPaY;>wy&thQNG3NS5Z5=G;lDOT4704ZCLRR*;=udHREOH6|6>Bqm;E~T7#9fWlr)q
zKlSB#PgpEdD|xbMtwrnjo?e+~c~V}RSf*oktZ=(7lRCRK@T5z6y)0u_QY;7o`bgPw
z=l3QL*}0zP_a`5f%Wq8_qgOQCKFii;CQWjwUh~PaV-Hjhzb|C2)@LUVr)iebDLYqK
zb4y!SxSvPn$`&%Kh-zXwl(if!o=iLe%2$(s{Q0ZNM^KKaJuoc0cV-#w=sX--Pw^vI
z2Lr%kfOGDIN5viO%8(?8F&r?ht=eyiQq}d>?%#^uO6vQj$ddD23cfQp$w<6j?gH#1
zJLMu#brEZ^39RB&kq7-l-MGQ?@YmqYE)osu@aul}`+F7B?Y!EFhg+Mn)3S0rY1I;w
zlyPGcZQPRu*+bxC6<7@IX}^93>HU^3&T;%>bUZKh9k+Ri52a5b9`?|27k7{kUc3JM
z)n>##14_*63StX7(y3wIwU1rU`b&h~bg1LRAo>uXn=h7hbT3Ka%Uwe3OB!DwI>MxH
z=r9qv-915?A7V0=pWNMx@b>8_s|Wb{^ee5O3|I0pmf?*ERg}MQdyX#@&s#bKBP@)8
zyfBvF?inN<LZE1u7lW6#&~PHwNput>my_>VvXZW{17l$w&pS#MNDq#B{Ap^>Av1R-
z<}17Rr+5#K--um0;`lmZR&rCf@QzuQEH+oi;~5s?eNSYbHwoOjH=j^7GyViSB-G9o
zmf>n&aCHU}&z;d|==tL9STgETEVhkw`v_lV1-XA%3sH8eG0`F{-O+q?xaU-lEcXZI
zLm<Je?7cC1Zs{Lp4y(MUVU%}j-Y49KL+(#u&Y|>dI;n@Y{bqh=I~qP1%Ce7`=^dr+
zYFWSq448khT#OLX)R%5C!an|7H#JHSIp1W+e8+VPs_S6lgpNaKKM*RKB=##wV@J%O
zoorN&gOWT=`=YF=g@2yX#^CeGQ|IywNX9EMkc}ds8LlSxM#GQE;R~7u_@SwAI}x7%
z-$c$;WiXjyJh`-6s8CZlw!6-2nlLXEc96q+0_uXYA(x<O7a{A|UHTCxQwi~NZ>y}8
zZQ_TV#4Mko96s2XJhT#B!fA3DJkKX<Bq7^6b+D@xcP{F3kAkk-7>1aTA>a)p+#6M>
zGF7&6(>l$l-|xKk_kAb<`8yRSZBoGCs^ul9cOEUpXj3rY*l@JpwSr?F!Ml`RuTbdL
zi0YjiE~@-eAF5tOt+4R+EO3LZo%OXQktS*h28}I?Ta$3gidSm!9CG|bVa$h}c<w%>
z+Z4x!*0<;szg!v4C8TG59nL(FFq5N?bLV3wwrD5UfT9WHP{<Ipgd+9REn~b?b(ldP
z#(}xL6Su?XfIf$*W7n~TcS@L@G>meM)ozzet^aqm)I>~r!lh?r<IdqW3wgE)2p=uV
zMN}<jBy23B4$gD=M{=&5*0Ca3EXIM%Ik0R1mjbu(Hr~WRXi-D}FU?(^&s(rGPc8g3
z9Vpg}{{r35(<s(zg_&vDBp~ojy8Ua|tqB-as6Q0=yVORb7^NAloqAibsC=6rVJhbz
zK9HjP{Rd}D%R_3UN*(DI6}^}#&Qg63su1T}C>x|H!6n-I;Vc>ffk`5fMZ)Elb&TW<
zf0%OPoUt4+U$vS_k*2<!v%PRSBACU)dWlHocsFmPBdb8Jq%Q>v`TO48!gVF5m8<~M
zM(_<CUM6maime<%H?HMaI=(n@O85@N7C3}~CWMOtu57tW@xFzIQ*tL8<)nYmxPCh0
zTmSO_694AIJ?c=bhO<QT25v`_EDt5W%c%7s8wxUJdGlQ_6R4iOL<PQGOVaPMs&~b)
z@o^cLKE+*<x~hc02c(Tjyp-_ltD@{|z1Xdg^dGa0>YdjFYFE!THp!Pgrr<jp1Q`lQ
zPYuALcdlSDkOh$ja`=X{j-(@Q{qk(;giLZNl(7J36cZ$49k$vF-3xC{?zfNo>;4<w
z_P_Je<w10ZX3<O57Byfjc<cOaNAvG?9S!y5qZ?$GwcGG^2dKGtT4@5^it4%V-yoC)
zq^RqpogPL(Gjr|%jG7;zXp8omGRi5MRV(!d6b~l0FtyRI_GIgDA}^JMZ6z|w(=Y|@
zix`83IGqi^Qk*3-oK$ig-SvIa0tePV(R+Bodr`B_QEfLHrIR8nR@7}KA_^>1?o<~A
zW|ezVS$RdYKt}6-M$}?gc&LV0aC^VznnRA-`){*%p0(imZQ;6Ik0dk0Ox$^+TETeM
z#HyT(u3zGNL;lI;@T?m3E0EIp-Kv3)SJ~xh3$+VnaMy|9%o<6Y#gXF777AskKg<!x
za2860GN1fEi<5XFy!q_^jH7c^LK**c4Ve1i&5@nNQ7pa({jUjSFhi{T?=#`wy?x*!
zflQY+x@RbJ{Pzg2QKOmvd~y|zvQrC6uigG6?Ef?~=n_lUxUceHyTn{HDBqJoOYGzU
zu$h92LkkOf2v`-TCN4xO-EaK;M@B%WV6xszgN15O4}uC`lD;Q@+sguHL*G|e0K_>z
zoa*1utR?I8Q^$2j)1=*5dsULU#mxAQV#)3B@i=UA<)f6y)e!rKaxcEPv&e<OBm4j{
z*LO>WsG&Ei^nE#w;{VBdy03YifK|ws*Wjoc@WXr(WuGO*Y6rodWs(@q!P{jdpo2W8
za8DL6f<;4Upp%A3y8wyPQ`6spyGBtKtH#J5t`dM?of#IqM9XhFNETyV+c)k3j&is!
zJM~`+DnI+)aYSQ<0W|ah*#06i=?`!HSE0uHe(W<0UsTBx`|<JJM%uav%>dq%pjkSV
zLsDsB(F!x0lwa{$&|sI&=+PdLNux?|9y{`uy5SBMJSL%qFcIprh*TKGH_zCgFNhDv
zf?<#Jyy<^X>c|m@hbqUYB;jq-Hl0l-#j0JoJmpDPd=N##qyUo3n>&4LD-Ll~g7l{d
zLupX5iwwh-+08sZ!s!S4?&Z?+m4udtQS_+sww8@%j9@g9dzbzkz3$&RC$k?s_?Yhj
z-u20qggLQIl2wpfh5ty`H)f&uiFs%3QBWIlYmH#59<qqf*0DEYUiQUpSycVdy}g!i
z(hD(JBx|>0BAyP<^GE3{G8#E*J42zhn8I^}zGpFA6ay;D>WIJhXqWs@)!oKKeCs7i
zEZ)X8WACn~F%<TaqG2)PPLoMdPgZqrJPU%I;kmUH9SOYzmS$*TF$is{VeZK!4Jl*%
z6+AW}cO92n{xjgGn(r}zeB>V{f!O+BLisH`UfjE=ox?u-%PB->E5eL%kZ}jt!zje3
z(g6FD-pMeG$zNkmfK_>pA-3jZc1?*h)mV4dWp=L3?k<dWV+c25F3@|;0bBA8-dshV
zkAhr*9Gaj<n6$%%FeOpk@))k|qV#u-u`5@{G1qBdzbw&rPP~H7&z!8B+T<7PJL^8P
z<IFvaoUhy>C3vhZ4}^OJ@88ArP|nDG(&E?g?g5MP2un+?_Gz`_z3iJqNJ84Re_1($
zom%&~H5!HUM1*i3x09V~JjGGzdpEL<TXLraEID8k6dQ_$ArcBbux~}!Tezz>jX4l=
z9pW7?HgBp!+((8PQYAdi9XjzR?wo!j(T+mx(92QK-I1Q^v!3LuKo1I8*O$t*4|V%-
zY&YBCt3Nu>5FBggI*s!4Snxpn$~2#dC@QkZjL(+}Osj1F0m~vBDIyo~2x6o5>_&JL
zn&Gs5D^f~L@T_?`+F4$BwX*}!`Nj<>v}4AB%7BxJXK&Y>vxBFGI<nNDZ(HfGjC4?1
zYYIsBz~Qwr1szQa3!6gjt1r|c&lPoKEQ%BO2{rRXZdcGT=P_lq`7J+fM%(wbQ+Uz2
zZB6O$9QKL*^9qJ{{VKa6z`?Rrh<op79j`@ybSLU;dQN_=$4n((?f1)|L;xstO{r<<
zPYq=V_H*@K$3*6nIpgj|(@oy<jrE>ngxwvG4yxL_r}`8GzVnrKAc-JV{13eiLmCUp
zw7Ncpf;Cz&#&Z7N+4v(V%Aa++3W${kxS?T?@gnwu+)zCwWI!n5cPqk~R<?{+=R@~9
zdrJu&pJbcKN5r3m1M(Zgr{2`Iyd?gu5Am)Z+y~x<o~UT7cn=!)sI+XOVOs^o0EL@4
zr+!&(C!1`yV<6|vOuqAOzTDZsx9NPKKU9+pw@dnF#__)C6UpXcfoDykbFzW2fu-F%
zmc+dori2NuAzUHgA|R@j^0!|^N!Mk!k8!$sz?w>ifNc=z#~j;Kg-xu$;Grb4cR#4j
z2h>$q6#}p(ruD<!)_V-^Hr;x&it0+@qN0LA2H{y-g1%rL1pgrz&~CtKNZ#me&fo4t
zOhl-_xf92V9nsi6Z9*(KG-R+`Rhtd(0hq&>!tbM&@VeP`3R(r|$-$C>JxhYvj=%hA
z>E)f~?w;N;XnMdaa7zV#Z3~V@EP+~vkF_jiil<}^6UYxB{0qHUn$p3ryrqW3$VX};
ztD8rlyglAb=yH7}%kGXf1=z@2O$kb4t!Tdz05RlpfP*X4H^T5nb*_6ooC8Ptfg7g2
zH#;X<sZG5h-W3rwhsDU2m56&rw&Zk00I@PR%#u7uT3XBOhtdXI_r@uY{Ta@)c)7Dm
zvHvVQ^PFeE@kU(dDUtTY@X&EBGF;x3@8$pZz5JH{Eq|kRwp;1{)*t)m-}Jj0y<>C#
zf-dtFm)k71Dqtgn(}_)PxC%@F*nDe;P2TP)YMzTsHAe0J9Cm+j_=hBReD&97GHHO&
zPMl#PUicYi&-Bx+cjR*cZOr}6;$XaseWA))J-Z_HPkyp2@Yc|NNx0%*?&n~!<lX$#
z;rM{Biv9sA`jin22HeFXnn_A#t7WK(TAF%Zys6(^Nk#gY^8{)=4uya7vmW$4-cn`I
z-7aEQx_V^mP03sHl8q;Y$as<te{cU;;aR}1s00(OHfghEXlC5yjGJ0_PE4eNrxg|J
zs@wr`Cq`J<8Y4C2i-}oRDqDAMFI!;EdJ$;-NPbCF^C|mqgm&sh3F)Z{R%{`x7$$14
z)<-YG^Mp4~1}IovoEI#2SQjo^yanCG|C`{PELzsggk8;$sjE7S%P<rmnhZHFU9Pk$
za}u^ZoIhG`Vl7s-s#s$(SC1M|Y}VML1XR)2@^T__Kv_~5MKUx3bPX(x`v(94dmEc6
z;nstX(pI0WGFCn=GCuXeZ1u_B4Ib;ROsXAl#7mvc(&Ej_UP|*cfRrOIRO)5*UugR#
z1SJ37_{eLJ*j~GP;QvvJsYti!Ok5RGOuI!N(H|xOTPd-JpzO{4dXQL(?C)O-Iez)J
z-4DUPH_bWL!pvumZoA4R;HdD|_NFztNvYtu9Jgny{Q9Wkf%zL-JyaN5#fi+Psp3}J
z3^08Ys&XwVm=O>R3_z>k;G>tApM4&1DJ74|ehaE-gQ@{<#VS*zTeRNc-t=NG<<t3=
z-$p4papq79m0BRNzhsvbt>s}{4**#a2TS05&B|6c<{muNa~qdh8|AZvi1PjS@{wEU
zOWcdg)AA+fYMS;}k+o-RKLwP8m}8=&bv3ps=kA9xgruXs%gR$NI;luw4UJ@=-xMT;
z+FsHv{T?~0t`ePH=-P31>H6%s=5|3IGU?d_kb0lv$ua+(T+uWrT~~CEftqNjzqCxd
zm~y?E5PILLsnhl9oqlTW?_DROOjo6gbEI>&<wg&=efrKgTz;SCdcD?m2Dm8Z!SsYw
zCfM<E850+H!ZG`)>97Jil%cb<^UeZ}?jS(0t9%^RD*h?tq8+wIwSSyyjxJad!0=Wc
zr?9(ypHo+j9IqEveb0xP&9r6S2bSfj8u1%dwKp0C6Vkv*^vWd{EjU%x#l8|#0fD{B
z1OEw5H473>4n%RLrpV_;{39haW9qp=toF(G^U8;2+?K^}ifGY&fHO8t<c!-OTWq4s
z8Mp2~lhxl@_ksJwY%yuT6p?Dv6p_jIJAgA*z38XS>a1S*9rC3dB}_^pmI}y5+a=-0
znfoMsakw6fDCAsRo!;9`BL}yc{tRnaaE_{l*R!CEYw*OxLqU7MN=g!~GGd|zo{}hg
zK8?0!Z<z<}s->kasmOedPk!B*QN7v<{RW#7#b7dt`jFbmNY1I#E)GHcY8nys^CU@)
zP~5+9Vu2Hkummvotl|Dt#LOKMorWpdJCec9RbHY+B4X0tq>Oynuzon0&(Ph&?&KN!
z=D|cfT&@;;q?BxswBzk#0l;e8`$B#^jaFOuwH=Nct_I^`b+LdBXIbjCFnRkqS-vyu
z#)sfKpK2-LH={FTpp7e`CRm@INnw)?&zM%be^jHuH4~@zueNSzSHHoMBNg1JELU0+
zruF0~)apAvY$f&#O_yaon0YGWrI8cOgFl)McJ{cM#<_bl`(_oV4qYS|CGgs#fjqyX
zcRiu6N_DVV(#P7c0A*WHMO)I_TM{IG`t<FJl^Fqr&Un^8W#6!-RphOpd=@{bkr2Q7
z<J3Qw<_P~et4W_y>aDRuB%7H@Vc>?)UdaPpT2tAO2;2OxXR5?wI#A)SO($ZSRb;QG
zX?Qk6vet72QaViSENo}<KXx1Tc?!Thsj`-)FIp~VXPnKC|LS43sm2^Hu;*)KZ2&4A
ze_>B+Z98qEg*K3p@K}<He9`B#n!3*Ar%WTGH_8yCOk={{clh&XLV<b!;>O@YlsraU
zbJz-U)$0i3|EU}sQRTF}#Enje&;X#4&)N4D?S@oBMQvEAZ-4E?Rte&(ohPfC9`D@+
z@l@07-@NqUETNq)ySpl%b#Se7UdbM9oOEzSR^44XZDvok&$+vL;a+rbWxJN#UH+t-
zYu`iXT|WH2L9)E<7zA5QrG3331m2D4m}07~hlRXSZP#NB1HPU>-?I?(qnh!3I<S7d
zzja;c6TrhdUe`!4vuH7fl_C5pAKiaV8oeEq99)^VxWJ)pg+4dAz)^Xjp>}>Pg3je-
zM#uK|hMtZtk{TNo*BBw$wv)<h8I{+|Nx!Wx)TN5b%dC-h@=OWkbhd+cy^Xm>CqwOO
zvB=%J&P^v{i40=4$o;`rBK1&(Z>7jRxk~Czvx(+<_?A9rgDlco>%D&YuSdpG_4Q6<
z_54Ee$!&~4FCf~u?b|gS<G8Kb^EH!RiOx>{bbNtJFoG_<?gb3q_d$DKsNDC41T;G1
zGDLpwUN1<X`vA7q5z_zN!iOZ^o0f0IeZc6uukzhYzT3B#?`i5E&w)|PUGj4}YR@xf
zYrikTtfdHX>zsoT0;{j}zvnwyMCDDgeuKeV1pVTTJq^87I+es<)KUXwIF`hR(19MP
z{`t@QOcLKk!XZ_<P%1&oRwqGwZINX3B4K|uI!`KLjbzl?{<EF9_1hl$f9*ay5)SRi
zVRYq-YHG)4gXpi{E?0RLlljk=4b(tyq;{ippoLS1+mOR7;R3vJevEw2@e#>&6=RX@
z8mjeQ6lA-a);a&bDB!$`nJ)M*3cllF+t|bPd*FX3w)<@*L2M=?x03<|{hlyo+R8I2
z<>8sym;7?u1H}E79O6R8$W)z9ikRr;8MFN+Vh{3l+mI++W-#+NL8-F{zAsfcN_Pt)
zbZx{oRM7un?;gS=i`sTUSK2lzZQHhO+qSdPwr$(Cv(mP08=e1m`gH%@XV7QR!x}`y
zwRh~;F^zcMdp#?kDk?x9o5WwDy^lLcAy$ERB-gz7Sr%6WLj?ISiIFVK02W7~3l~=Q
z4@rVufBvo*j6{3#Xb^fnU2lO;xn$=gu2v)^0xI!@Gay&#Tv5UegG#kPIXT(Ds7*iF
zaE*TjTPBzOO<l|T?b@!EEK0!7qVh1sg=x$VuzaRr^FES$o^k5~Z7Z9sq|}36zSup!
z)b4PSV}r!7{xcJ;R8$7bLnhGrK8`<D$&0qE;UA|N!Jb|o91UddwDIEf-bkG~#~b#J
z*rc|^&^wU!aPg;PkHQGeby5~6<e{)B^15%ibA@&vD0#EoVhf<lr7*lcvGON)IeG+$
z3*Cvbl1x6};g2vL-7S_QUShKr>!DCQg9*{~Ow*JWB30^lgkx>5soM?ww%FRUjzbEd
zdRE`yjhB)eh-xtQhNLVXk)#LwTjsU)uXk!%DC6R2x3WSvhHOyZl;w3e?kZ6TSe@QM
zQlm01r?mUMvRrk6ZR|XL+*M-9qy2=%9&z0Et7_ziP4|^B0)^l)qX7A-k$Wi5<`^5n
zR`UP|Dd>`kc7ywh9jALZ0q0v12@mq+unpp4!N1E+2YMPj!}pt!YH7*t12j_1K=+_d
zCPZ<!2tbgoql}C-$-Af1j@8GnbNZ<WW(gG^Qo#OuP?c6NxQUJIaZ)x>p@r-q)G;bz
zlTRgWmwZqL?&tPeq(WFaLo>Rxj}_T>v@S>w9EG2r5_C6aHZCKgIAK7K18h5wNP4%Z
z%4CK&?Lc%9Nqph7fB&K^OKv)WQs&{n19@z5c64^|Tnp`L%Vy$rOu1k2+p`hN3LQ2{
z7$#d=YADjst>|``-!5|hk2l>@cmgK4P==NYXV7B`sXj}zu#KtW(A=D&pZ&|61G#L_
zj1I|40l!`0b9e)!8csbNImoJRk*&YE{KP#g7+BI4Q|MfPJ;yj)I9<;aTs|;{BJLK>
z6U>%fuY?z_6L9SA$fw+#vTn{`fNz3@9q&R<IN}Ro4rE1^T`d{=S%-~<v1F0Ll(#nY
zrP@7h_RO!Y90s_c1?y1J`SKQh`;ihf(;jHv>`Wb}%<6ro-zDd4+6@5g)e(QYQljw!
z_8#TqPJZIhrFR2Yp-!3Pf#}6z&&-Wq+ZB1y@kI%c2XKG}TcS3K4kP)*D!~y&iVk-s
zxh#bfR)32x4Gz9~bvCqcV3@Y1{iq-{x(DtH5)yu~F{ShI=>qyNAl?(KeCBjKdAp^~
zipy>dO0;X`z}8gJXt4cZmDf1B?Q&V6D(NO!&1;#>6WwUhGGd)IdyN~#Qhl$tTpwbt
zUxm_fX%DyD%IhHp^!qfvo{33OyO~M4p0U+tvva$l4k?{Us@tbi)|I*OPM+dw>tjz-
zavq&#m|ID5X-jt_0=XZ*jz_KbWAjlnY4-32Kjsa8XS6>I1}T-z!Y)UQlkEI$%jeUU
zp}2^fbQv_NbG9^tV0a}qj;hDdf~C!j(f<e<TCjQ0728wngr^>k_UkQw{5sU+v4T?V
z;{??4hFsE~wv`GhDeIO2TYDSOaeQnaLg3pN*${ASl(et=Vd-yTJS1)Afw0&GeG&!Z
z6_uxn0Lpbga)kn|hcmY%KPqOQUq}SHi6<2F0O3!#y9Nv#!=UW*r%#zRu9dr0y1{ZG
zz|O#%#rzly7>xae^({wQfsezK$yAbo$COp-a(r$ByarFIF3d@XT|->sF7wPdeVD)r
z3hHqHt-~;)tFNzu!kLe0^UB8FL~7A^5L@`J#GND9QGM#zJop7%KG2K}eTV#d@tcTO
zk@ltJE7s7=ck?p_H^%o>x1;BC{v-Oz9+sEhXNS$`0UH*6%}JslkGCk)n+>yw_`Sy?
zu%7B3pxswC_)Rud{hoFt7wuaUt#C&+w@TfVk44iu<51IyU}{!rLg4NAxiw+{o{hG4
zcb$p?GW>7ysquV8b~~`TSf~4?d}|%Za=XHSW!o<%L3U4`R^@{?Km)iuHr7r9tjtQ<
z^*PChxl~mujfml?i*wJ-iVbhU%483as0ruoX}5c}wHvm!KA$^|DT#2tNDDW1hmMq!
z@<8uX+p;REU?$Nqn4#}mTe06IgPV_5o4t+={S}cya);Y;OX=f}1L+4=mrwQO_8jj!
zblI{H6TGtypK}Fs^Z2dq543X{`(~&pR3bn7gx3uBvW!QrhsG+zwL|W2Xs6ox;-!RD
zxnbhQsX1#Eyk+SEblOuCF8UGR-A1ACZv>{fpe3i+C(3?Gxb%rF9__r(e8l{Tu0-Y-
z%x~YatB#U)cY2LQDb^Xyy%U5cPZ!7#-aV+c%62MUVv%1EYoMyiZB6?nAzl8Wkg85M
z4ov#BnwyQJCuE`7H=5C9xJ}~QBfjrIl4{=|+>(todaN?^#IH~!b070w8O}4hFZBBY
z7PNzlVuiAuV<rDjj%}j!oy3ZtZiaQAQ8Ky+UfUp}l6rcqs&3yQ2C#}M&svGLvsd9-
zU<xrR<;~6WboqLPd}%_->Jt_$d==glQJP&oC>I<7tyYzW=SO&-na<O}IVdB&WP|5t
zNoqiMcz2qQP9a99EcYe`Z}ImYnB{=FSNf)30fS%!#e~QjH4ACd`Jom-!ph>79gBly
zJ&`U%0{>P;wX{QR-AUZFO+0mUK?d3Lm?L2RtEebP@6vPmNz+TG>0S`A%DmWFh`D-h
zKoV4v`Q*J#_R#^?0<nNaa?0`*4Y*zgxPdRy$MF_#_g6vB_vY4CP0gF{`{j9;FZ2oS
zclY<^7w%b1&GYl_J1%c$2RhC->gD&XrNUJ8YYp#{56Vc7dbg49cSlWTh=yTKt>Gur
z`F(#6KK;^dkOji}+)`Tm9z}F%Q92A_%(Zj{=x2R(uhtN1<%adRtqP_%VfXuxno**?
zu&Q#txbhrJ_)dU?ok%74n#RHP&e+ubo6tE|P1bSKZ1enmc|IOzONFrJ<mbUg*LwRy
zn7+p6f<2LS-*l_Naxz9&mFX?~FeZoRo%xJ`6@ald-;%^UhzN)5G4au8W1!F4ND5a$
ziGRL>x=1{mz=<XbN0UdulB$zRS&+nRW&{!KLgHv*ID7BxEhC~Ku;kkCnA{RYlS)eI
zc>$X6mcCt*L#cnMm!!_86((2=sk#9+3>(*&>l$K#qOC<Qj33V{Vr|FV#-U1-p;P=Y
z8t@V%p%R)>)%FRgeTQUDcf2WQnIj6~v7>m#G?96=$oK{<#JpnrLju+B8!ziZabEE`
z$#%^kBQUOKiuQG(%5hQSaO%O|r<XI2T0|V{*$%IIt2fh(RH4!cmo$m@#wIaWEO|?t
zB%9Xt%q?L=3$#ZRtF;<eOg!T{wKPGmrP)M&t%nr*bIhwsc=<qQW6>OE(9-XM^ymoc
zGIUWSZbpUxQZhfo00Ewttnw3J4m1TDRCSUQE29`Z7%XxgnE`t5v?BY+Wm{~&;y0BN
zV}q7AcYw2FWsIDFXw!yFnFU!O%w&5mDSqqbJE<4!C?pPe$B8!1lIV-6A<-!TH}vh`
zXLnk*A+~WHI|t`<R6&)v%PqrU_Pf7yBsVZgoPJp_q`)MKt#vpywX5Q>1dJU~cg}0D
zYl?k6^0sbKYKlSg>S2Vj09T^7Yv`l9p#<FJUQ3{_htKZ#CKRW%X-<E_^?Z+RfW`4p
zl1}|Vfhn4S$2>06E3nzY@b|In%$rjxYw*~Ve(%oW0E7&%t*lB#&QgHwNxKD!!wDv^
z9!454#nve9@b;$qSI~t!dR`cDfBg<(j+@L6obZdBz<0y>V#X|5O{KFUZ=*X<mC*uR
z7e!=^yq^Q60ZFmvXrBsTAkR-FO(|X`svH*5UDAF{DEl(i&6(ke1`O;xqkQYtFm+xw
zphJsyt-dmJYyBy$B5~X0DoQjOn}@vO#kYc0FT%;p2q}3Ho6=E9Q;0wqXgsI%2cbEy
z=wEUme+Dz0DWUUx>4LO##R)&lK(s089eHwrb9qK%F=Qo8By*hio3Jh-jT7aAd1kuO
zZUrsqA9;+FLcYfzSO2S}+4Zw7)T1;!{HElkfPj*Cdwc!UumvsDpb-u#fSJhNT`!hA
z_?9z9&^0m)6DcqLG~W|XU;&pwIMASO6~qQRBva3XvpWJ311D7L7$pnTq%gIX9kl3G
zkD|Xdm4OBUiu6;`i2M*n@_-eqTz$Deq6_5FsuP*xVD>uj(L17Q7}ck>6}|tSWLffL
zU}y6-2rw-kMb;?vWF5F;0De*Wz8!alOQ2Xhxd{>Qsl+)kA99-m1J+;n&xM|U$}X{n
zqEY^WR;wz>M&D2ET+*)27hXU8nZzjjPL7YW85ddaNyp+GZW4RuyB<Y}yzCNj%={m?
zRH?9lCH*~;yR_p{+pzuJpS3KsuWziRgwigV4#IQbIKSW;r91B8d}0}`D#({ZTFSK$
zn^{*h1(Lg{$|0p<1X{TXTHEq{^)W};gPo94Q>&NdQzLlTA>sv+LCfn|cgM)*60e9H
zC<)2$$#QDS_aI%&_3KWDGIHcI%3YRXbKVSn7`;!KFTMP?P#pnsS8bW{KQt#i!nE}@
zz+F9Vcv#V$_cD?CNip-ase~%TLYt|Qyw%lX6B*g~l)K|9)iwlavlLwhYE*R~opB9^
zJ9e0#9#U+7enzz5To3J5wD=#mIk<VeyuX$ZO3)s^wI_*)%OS#>!fv>5PM4`_$;Bdx
zttZtNG6B{Z50}i<m>&omY{8?v-+c09Z97}?xKj;oXkN3Al$?X)jTjFn!8iIfGt`I=
zP(8LmppcE!BksH8zp(cRrrA=!66(tIx19&p+8d$Ot@nJao};%jTJ$)QnYLdQs6`$f
zpPsY_VP1_|Z0)uEuA_h7GaJp?7s>JIEZyU7%U$v`j{M|L@0gWvq&~8lL#Sr}@h>&R
z8=XiVyGX!}955=Zg{Eq0KMZ5upf?&z&gaoM<1ZBe(n6RlC6noQ=^XEQB%ng>fFyn#
zUcKAFOkEDMjcHuk%P=Zer%vD}?QTNeZdN|C^8sFYaF5f7Am6%@yE+0eJt=AxDA9Sz
zT~_el!0r`I6_mjUnNK&3N76ndKI$}i<^yE1<MWwzm_lXT+cze;@UE_n4)qUkK2@$8
zXZw8;$%8x;`pG?BMtKigc4$ZWph3Mr2IW{u7-0@_MW+tr+`sCx0J&$(I#zptp+$mF
z{I?I8Wd8y6yhOV8qIClx1;3P<n3qNX**GqR-%drcnws!xS7PZxl*Ug}_|anAX?~6+
zxz_D@k)Qs4m#Y@=32U6PNtJ{tt}b-I6V|QGA1xn%?(Z|$<?rn!Ab*(Zt=pZc{C5Pu
zzcdCS$MV-)XZ6lFkHl5?rLH)S8s}VRa7|MMHuD@Y9>?;o7FnWQ_oeThE%&9G+-vR&
zSXGQ;JaZf|Zz}0VoG~5^KcAc`*m7T>9$9u@$oRR(e?53-y4h}jUeA}@7tl0y3h(dD
z_F_i|o`tf{vyD_@v{b%EUj>aR#*Dv!=X-2wXC?jODPTRX`XywmN9hd$FZThI*)j7q
zqI=toiqzOMPv=;EHhA1d$kZzTp_m&x+RRcTZ4!c^G!Rn~jJX~G<~(+E;%p9RC4~9E
zzyuo!t107s#in-5h-RUC3nosyaQ+x8`D~s~8BZBMxDl!6h)7j3&TX$sS21`UfZ0XN
z`BIQJ?PfJMAGbro(%76vwH107;=-vqWpKJkYR#<g`fPzN-;-=iVY#w<w#IT9%kU!I
zOHBNos*ecl(w6cYlbv5lKk`2P6igIqa1g;jjH|5cPQ@0iE>+p0y$CN*3OD3Gbl!1w
z;~<M0XX?bqF9yEVjMN@PpC5fH@xwtNZ3viuTzgUu4m*(DX0wisKx7&_@@X0GXxNp%
zRLO($!5e2!51)NZdswKxC9zkgJ(q!9s6Au3hnNhL6o*^NrGK>|XW`vckr}l1^P1Ca
zZp)f>k6r6GEA4go2*eIUh$nN^tN+MlckW1m$}8%I7=1ZB{B^YoL<IIVZJeotGa=9#
z%!mwpXg!OoAEP$l!m{N`<?c=prH)wo{wLp&JodRzU2wloyaSs#=I@ZQq03xyRt>DE
z(wqpqI1ktO;?#0*YBrc(Bf~>n3g1B(hlj{uTuAAQmKdRLVw`PSsd8eyHblJ{rM$3p
z`N~^f*peU7n%gFq=|e1>!zdE-L*!W|r-GR`8Ga4pF2y%zNAky}#1>5v3zZ#^Sgvzx
zoXU}aM%w%6@7H+=Fb$}^5}38)Axk)UL=<`So*}XhM^?PZYng1CKZYxbO3%vD{Lpe=
zuoy&T*klTP1qMr8J|&1t(-%{{%@_$Nq9itEs=i{j`jSv_z@EM52UAyA?S{q*PR$5=
znmRoSw3|Mf`09f9AL><Y4$!h0j)!nH<E=Jx#*8&N+|Q4Es=MCOpO$mNxc-qZTVLKz
z!|97jzhF=+-jQF21x^9u0B$G^ZZs`5R^h$Mf5?R;@p3gT!6Wf#(>ifJ207T4{;=OJ
zNsY61gEV1t#kzI^$6ImQld}N$c+@Xf39o6DTn!hvcWPll3C2l4c7Wu_;&_5QM)zl9
z<M<t8k{EJW)FKgJ6ZIJUN@DL=cv}A;JsxnFs4CaUu3lp1@EJWW7(;CY7U=5PgP|Jx
zKYIFOtc{Jg+88B#wrs1hoT#pLLwdM`mB`9d?pkj5TP4QD!-s+Nj2?obQpnE>h)eUH
zRM}(Wr747FZv_+t^98ONF@EnVAR!I~<1|vopgeQntQ#r<8R|V5<);?O0lC3KQUZvX
zL=~oD5YHojLX4yyogD=(7Uxbjgz}uH*>v`Sfjz}B3xNq}kt(r5SRTofQzUH@ywL>o
zL)5|V$@?L}s@>FaLWw#f<50nWxz;%W1^k44e7OLXK|o0~ar<t(IJ_j__+uDTD*ihb
z)PS#pLT=!`eEjC>Tn!2ntqOu(F*6ph`*+9_hv(~~Te^{;mrjc7Z}wiWq3TO>p$Q5;
z_R-w#o*rNC?*l!!JuT}ahE(+yg`fQzC!?Zar2dehsjNF<-`WzDec3)e#Hx3I860C1
zqfAxc^QM#AfBWke!hpAm%$z6Y)CGNDWtb&)aWJe#5m`mf)SMrm_HWsRktP|Z;zaa#
zJis1@+3c@y$)4dQSNBpTu&8X69=yThg9<-t?2tKYKp%WL`PpzxOYzJm_DjR~o6o`)
zBf-xv&V~S|_~^tc(7eP(9Ein1@l)WSWbNp7h@|u7>5wo`m!P23{4kQ<ChHxh@&fJF
z1Uj<2N1&a<)9?lPA+EjH_loxHj(7{WXm@>edfv`iw>2!dbpm&HplUoX7EuwyD^LT-
zp97~6XMJHUaX2l5uTaC{*h{6Ava4-Wi=ZSeWRL_)xiKgZ?Pl4<@8-rS!4B<NFSO4<
zYW%;!uXeuW8NVVvD?a(`c%C2|;j*B)S@%qhR9--}cpGU%6qpfR@p^MZDVM#flA7#)
ztvjS^Y0KqWEz;Roa>y<qq~FL8?=D;Vs(em`RxGiFC>}bOlU6yR_>&0I@qpF}lCFyZ
z*pOj=7u>I?uwLjCc8Nnwh}A$;TJZH}2-dK5)b$<X#@&NbSy|)&{I)B!gZ`*T{?#h~
z`6z|T)T4^09J2Ym189eWa!Tf0dQj!pi6%M#bMY+)8;hDc@wFy@H@~hAC(5tvHXXC^
zF;g7f0z|v2zR%F1F8cnsz9sXxWkqaX>Ec6uRW*qAeERTM_JD~k3mg1$FrNlKGTR`+
zMuFFk6XsjGPu0~YhqQpZpef9dU4k%Pt^KiYSQX)Wv4`97BKmh}h?hkJ?R#a2m&Q{2
z!w~ITt%>HVF2Z*M(M{?<r`H<)bIkN}(F@=C9&Q%S=^k#%&qcG3V?R$0E1H2w*L%3S
zoli4Eygt<@lQduU;y>4Qyo~(3ZI1c#bx`q^|2eWZ|DWgOTmExXud^_kuiLz*AhQ`6
zR_0i>2U>cmeKV))NN#Q<_S#bf9kmC{9kUmls&@7<iz>mQsmQWae8n{ELkiH-g3;11
zSytpqz2K~~HXsD@^hg}7csrgLLbOU=t(*3EOnIX(67<QxI&?@4Opd=++%bs6@mqM?
zH$IjhBRQ2Kg3`yZXVZy9l;yiTtO<otWn}J#82IJo6_sS?_oN`-G?A(Ga2(!6%V8Qj
z)>*Lhb`BgAp=z5)j|!YvMDZHNoZMs7vIF;zekxW2Dnfj<gptZ#uqXP7GDEv{s(euF
zUG!!<D4%~1=^Mcf-yFh-E<g=gsM4_llAOCgF|AM<n9$4V-VShsiE~kj$r9o_jV*OR
zY*RVJ3~A*)42z(8VqD^wU`8#(aYgPs4ZfLZ6Fg%eQh+w7tN(eS1?>~BYYbL*_ONo#
zBjhkG>lD-+j&mU3mykk=bR@6$+}Ok~g>3C>(&f}D_sPX}<&)v0lQI6-YgI(rRM&)!
z^wM(J*>#QPHh`;bcH1@~AhRG1Qhq|ho?t%RPy<lb9^92iA99Pt=G2lZ-7&$nl9$zJ
zMU}N~NkcTy6g-VCCLf&^GR_-TvY5!^dNVw#trjDNcPL%cqlITB=olee4U5YU7=<#l
z8mO!D?7~wf!5Fy;wG^{Q|8yw7usH(NKR#-zxEdu9RZ4Izl0h?4=s=gUl4-C&QVyez
zHi^?N#<1E|3lfFlMz1Z17+&VzKg~`H0r?UA|9^xrl_9MJxS_PTUb3b`zcvUuQiEKL
ztRPLz(~y7m78GbrK1ZkP6u};m7&5h*$`o)Ii;ne=j?K1FNL0fkHgEBcOk^-^03AhW
z=WU(lm#3XU9%6_<I9jL66Ei4rdx$N>A>?YR?^J^m{7Y<vECKj4vtW$<6K3`<aZd=f
znu~cG`e<t(LLcfNmqU$f-z3qo`s5{Zp0*lR4gOPCUH@>ZM$J}zBH9r)OpH2T9e+^T
zN#(LGvSz)>D5e7f?{BzCo`D9|H+_-C+?3g_KQm?2Y{d~VG#qk(Qw7J*8A0hpXp_IG
z1oub`ACL%l#u1=hl3#bBk8^=N+_LN4T|j*Y9&JTb*Kn3Fx3>dTt<afB{=T({lF8a}
z9vJY9`kvg&n93K{Ko99r61Ert0$O1R^Nd~u;^w0;oM+w<OQ=c)?8HM_+M>eS%;>_b
z6N=3OYD0H5TXCkCP_%8CSlrTI&e_DWcFnm1RGnqi$L4<+k}cLCIrG@W2FYfm(uIEr
zFEcMCCxpS|Dkq5>v>KhZeoIGFY|fsh(s9-th=(5Af`vw^YGJ!?cQ87tU-0514uW)I
zZMM4X4-~#@-f0TSB?S*o&l0;A)=J4m!UQhEW>BN*D``E>r4B@p+e@DO5;6=$7!_1}
zA@;!le}kMDuk{9<wq!Q7B7?DL>Unr7Zi#HKGJM`}l9Ois+c2$_X#fXh10^8twJ-*x
z0Sv$4q&3?FFW7B@-GkyvI5P}^aDzHM2_&2x`5k?=u7znpjdiU4MA!;Zsa2jGc+dZ2
zu*5Tu)V3JI%ltB7&M=asS9)|WWUJmI$2s2O!NS|rqULUHy=@Kl>e_`u4!H8!`tMTY
z@3Ghb=vqgqGzswpq6_*4?$FXTY}7tz`kL)dhNTH{`AaaTyRoC{pA9{&p&@{+-jfsP
zv2CF%nLz!e5Z%^|nSyEKniQ&q;w7nvbP=P<(J;H`EcSUnoP79g{M$R_A>Le6pJ8C@
z`0^R2(IO<9SZyKq{&4SYp}#FMb!itif(QLEvWg0Fedf3kUkN<^)B>8dzZHZKgsTDJ
z2uzmJ*2fjg65^g9rbw4T&K$;;MP?MO$DLM8`>ie*<8t6~fft|x-A`?s7-HHtVB=Te
zkQl8!K?l>5(p`$)B+lhL@r<mk&<gjct=2IBl>-sMv|gE0*bJW*nr1Cszz&FR8zh#z
z&1+bfa!naDUN;Y^(GQ;iP>Xv{hKS@8^#QsB4K;&@gt)RWt7_C}M01ege2;uS1|IK#
z`jgIn%r}~`0v+e=cM+rbB~A3tbCcPtU~xS<KT#gj#AKWNVz%w<BhYeH`Af6yg9YB4
z?><Uf?tZX$BfB3s$$B-+D&ISx!;r#6%X1|@<hy*F?=+NKr>94{XG<RsZHV7c+A3NG
z*ZAOUo^$+YV*x7147_4A1-nY7uV9{FEZ{=KSw6_Lman%M6PX?uX8|jOA*R0chwxV=
zsJiFlU~KQpkzj>THHyBE_Ud0@T<J!SD=-W56T%bs-=)k3&I45KVFr4HBkU)#c@dSD
zf3M(hPg0tBB=@x_+w;OF@nP%%B?Up)v4wb6#i#oCPNLI*QbMd%_<60QI;G~-OiYFr
z@+`39xZOg3b|JqGYyJG~IT`RXLRK37nKb{z{Ei#50Z^jm;*y=6Gu0ZxT4^i{p2hDT
zIp8!CK$|I9x5(?P??&dF9N1qzUw>b(Lu`37Gc|aj=aThI({|&~%|FPh^Mm=}=Dhg8
z2_$M0Bj+{GlZ<%6JZS_tMR2B$Lol$r^pg#AHk}p43OGShITCSIKjIy|sqz_NaM0yN
zz`dfn3hGWd*CsOr>v<co))a9sVf72?7eVdURjjOyHcfg&9<)kXD0@@!SaKLFF`$x$
z)i%QeMV!uF{0WOrJ}Elkl%%~OnA;_R-s`2xy-N+552-8wma9p{dQ@=GW?JNih#eu$
zboeHXNZo6a7xTLPN_>RitWO$mJ{}-;U(zir3xJ@?)&190ocHZwqxN54gbt06U2kWe
zA5n8ND@TAuD|_5BwUwJ0AFQVW$35n3H|#KcyE4wPOLf4g!F?n`ab|wXh#Puz4E&6H
zMG7fxv{8vJjI>89<=Nn93)md=tGmIn85XfV<KCUQc+i17k39uIsyYns&ik@WnzhWW
zN}ajJ`U^{Qp`gGn8(IPM&AV1tcF`f$v=~EJn<jNU3fq|t=mK^}?i0Q@*?69u`YsQP
z=0lSFvYxkw8P%nW*2VVgQsmM2D_Sh4^FUl}yRfYmnavJpTwmo#0m^!Y2G8)g@J0gQ
z5fI1ergFicE3(}d=NQ|*mC=vaNBTEW6dUoq_$traW&d1(Z~baWZpR-hRy%|5hCz3<
zJjkis%z#~f2(o9kWG#(<SNo#A2Z0XmOrZq7N(xv+k5H)lW~M6647El*3JuSL!&Zzs
zX(TupQl)hDizp&M9pf5&!5Zh@BPh3hVB!#V4B3yV4K?M<-#)(+Jm*Q{wN#2U2gIjT
z5)(X|A4c4!3nyr+htcYt4zm1JhJAEh-`I$XwKjTxEwhEVPh-qN0=-(OVI86TH%mI7
zcZ^Gg<dCyu0>U3|*ZY@eh6R#f{lr_17Szk5v4#|y7i2S;qE*E8HHLU5#m~fv%1Ke~
zfgICj5IrtW)0KcVAs|%d);t}rL;abZXZ8uL&Eu$ySTUU`EhLdPA{Ays9`+BG6h(59
zKU`l7p7d}lhS_9XFY}X<aDyFzf9*^NPDM7cd)k<H6Y#~H1{qZy_M0qUNsT`@HfMks
z9scj44TV@jMbJ(KJEIbEL~R1VI5l&)OG<Z$XLpdPc~q)2jAinZ%LqI}Ss%E{In1Gj
z;LYzw5f|I=8!??n5R<jkFoM7W<Z(;B&s<L7$tQJf&^9+*;=|vj2OFVjcOR)9&>|Lu
z3IkWwRFOENe-qZ~F1d3L;Zva5kstx~c3X=Yg81_=Nwm)Vuy_We;j_2-B=rHdn!BEn
zm3|Q_kN6ir@4**BrR|0|)-|zJcb8Gjp?)njBxdd9Wutf7P#!IgGrHkxr!97l_SVDP
zQ~WLr33AUnk<UTX-kRp6HBGRj5kW_4#>XB7`Kitn)tnIh9LYmclQ@D2zQp6HjtBdO
z+ke9co$E|6vYmQC+zjyQJMOD%!B8?V3V|9!R{`?s1U7>RS8J3Z$g@*sntn109gLFu
z*iU~v*3O4x{w0i!(jVL~+9Z%qC75$#E5oak%6>qH$80QE<m|@Tk`g6nUj0@MKp`_t
zJ5o{^LvcYzDLp7rL6dQlH00`0`4KTvD>mH2|9E41C4Wjqn3P4psw^axy0ee3SxiV#
zJ_B)u>Rje=36QdtJ#(#-yoFi--Y$co$MAQcKq_)ID9TSd!(ix|ClhzclcY}cs2=&j
z8$Q}pK0BdGSxaXAVXZ8pix^}Y=0Olg`VL6k##<}Yd*wlG#4A?cpJ3_|2|6_aO2osZ
zu?CoWk*sRyR1r{~1H-b%0nK%j8qL%27&rBAJmRzDa?oSoBifWn7}8{GMx`uG2NNR^
z9@R_V3I5&0g+dt3>q)h3_oAR)9{JPI?klKW(7~1m4$u^IV0;<7#dCeHC$?owrnCsz
z9;l+OK3&9>osbFK;{xkJg2q>qAPR~VX_!ps@&F2}Zh5{O<U!lZP#Kxr_^~rROc+_w
z0PQARNyI!*hKpBYzR<|MxD5O%sg9cjqFRa~uqM)KJIgURi)6<Q<YfO!w(#Iepz_%1
zv58DU(~woVdqTeOG;8sQO|havlfxyHe5O_!xpM6clKF_ptA>5ZBZs~udqrBKtG!6E
z$Mq6-xf_|f4fXXY1o^Dm@z^QIx3CwbD!^B{)Uh0|4W}|-kUn?;a#z_6WyZSE69Yzk
zs7L}GP`5n%@zG&7azZHm^>9<ce9kH{76Ci@RjfKw8Uwc;Ln-pTw>Ufis2T7e<{VWk
zOasPN@vfOfC@}h4s}LkOS=+KV?ouf{1KavqV1BYb&>^0Rw(^)VRByp~kulCdKvaBb
z1BUT~7z%gk1N_uoL<|LC$M(XeJCP|CxwYT7&}UvZU|T&d)~hPHD5@1#wj%72G^4iP
zm^pg6u0&>#T6WiFz~*OA(DtOX5I$Iq64EF=|2cP*dkWMATQQLQ3br;rUQRgM6$pE{
zY~HxnSk7JyUomDKjGpat%%%=r_$&{VSiNR#6LTwGR<Aj9`}})jp+a&e3`fi*xHP)?
z7{l)o(*EhqgD^v>eLw6XqNW=Z$$0<zfgtwV&44oSeFKl0BK2yH)PY639{bZdLbF{c
zaMIXE(VQl_7VLop=eF0Us^tR`zhA&y)Abv^YhUr}307CG6`h<|IEywYZ#!W5nS@f6
zjz=m5{l_Hs)S}uMz3>%Gr0vi|*^v;F;zq0p;18CiofjE7BebkBnW5`|v%B6%7c0hd
z%CfK9Q^#DR#w=v)KJiwDRN_?siCfz+cpdQliB&}Z*O;{=Q@$4ywBfc}(4EXmLRD=v
zL>mg*8*iCe#^Zd0^1QM?D&t<}C9l@^zb0J`B%TugW70(f5qKO9(06_yZ#KD6h>;*3
zipW3;LB;aXpjv^S3y(-Tz<&cJrswuMSdICe<v@)x<wJADrFQ*yq09y&-UK~qDruL^
z=h9xe?6oluAZpH(e;GDM4Zku&_%%HbpAp57T_rnI!d)73L^xDQhN)Gd0!Y<VW+1X{
z>qZ0DyUe3c+bePF;E~QEjAn<E?~0s$ykzebCw8c1H>i)i5{e3LP%fSxi(aEJ$RU@s
z9DiC0h`CGw9olCGT}14kR{#8`a1u9;pYHW0!Sx&Wz^j2fC5+m*UuzDcsHn@E=YJ+W
zQLk3NYS~eV_C+^LkK{)yJucGvKM>9iX!$}yPb33kBa0z-1S&y=TVU|Sv=4np5T(C_
z(>wn%H5vM8@o`$3F}F%YydRvFYjr6YsT>HA$s=ZBXXE_*SUWv=o*#f4p{dc32O*cs
z;+xpcbiK~>U>w*ex-dbWw)-pjXOc+>Pu@p<Ex_q_7mB@`Z*=VJ?HYncN&1PymE1BO
zy>{KfLA)}OQ4#VXFvF)3mye|?XtSw{sor|zPsQq7D0WN6$|CNZrh2z2+_|n}$$RjX
zS{m}^{`W3*jc!?rO;45F&la4E>69ZkjqELVhfC7!G%_kyBv{_uGisO13q2&-5BOrd
zZ%@~T^yxVz1(ve=<3qEtIW{l<BU%=M`9Pt6sba3WV6bD2+-A#=cHwMu8E~lT)M)Tn
znwF_{POxl|6jD?M+U4u~+aHH+bEly?7=w<ScB8R<mA){`I@wqQiERKm5~t^csP0Fx
zA)Cey{>w}(PgPuBq>VQ@>L+VH=9o<zS0n!knv=`FLkG7W;L|zb4`zW=1eK=_{@5iw
zbey4k_9Ye}U`CecM;cHi8A1nGQgDjZ)aiyg;>SICsS<dFl3+>5?f=%IUl{?XPe05Y
z31YqW*6`TDOo9^Go)9MzgkvXuEHJIdIfM72GP=}~3A5$~z3Rw@&)}WkjYsr|UYGC#
zUAq1fx|XK`<A(`LwL{M^dW0t5{X)OV?Q?UFo3dm^w#}buH-(I=km0KhIq6`(i(%-K
ziZoMHJ!JX)s~>GnAJrf!UryuqZS0wsS>hSAxgVVqnk1`SiC93BUG5yQ1NQaE{s=HW
z5j)zg{WwNbS|zI3|CuTScn81W<Sk+kACjm3U2ci%>OqHDL%`;Wt{iuL$&3ZNyBK4G
zB19Q84hvN=_+ZKfS;>^it5oaEN)q$ftE&VkeoTn7fpfyYFOcJg-r-6_rGbd%^|5vB
z_lo~&3nH6otxG?Bd$v>`E!$|8&pcw#3R<!UPH`tlM8!cd0_+&{cg($|Z|^I=hp$dH
zLNqL{C%~3A&a!V)Rn83kAQEldj(m=cXi{*^r7|*)wr93Sn0)+uF@ft(u;BnJC}$~M
zJ3;ZQNHt1Krbb0C)(V*WLuKN~j+z3!Jqz3y#n`SPW)Hk>lgmNIj^Fz!@!@BA&#}Y!
z4f&Z^Zv%Q%6{m6yrf8dzrz7WuYiWG(-EalQ{8GhxnkXJGLpxIhm8DT9)}}(SqOfR}
zMx+XHIii!3U->B?(H`h@6*@#>WIw7<rvoO7Py`%Zj2%I6G7kr?f3+3f!9+!K(wWv!
zrZT^;fq$a(rv5Nc)0zC(OpCfwt}+U0eEbKZOkP@f5o~a?M~@cM{ihoviD58?;B<;Q
zQT0w&pd(43T?`UvFfbD2?u`)>b=hLs>FVQmLniKxzY#L#>KFM9u24TjUTjhH{jsX=
zJJiRoA*lGj5siQ3$6y20h>$i=4Afnm)S<qXB7TcDl<t7IeNH|W&C8R1Inbf9f(<7>
z?>iYhClltZK$9ZPBZlX-51;2_B()@zqa{>#ib0B$o^WNQ&`Wc@=#W;B-BZl*1=Dn_
zNkL!nZGo>!2aHI7cVeng038?FYn2={vgmlhkzV}3L*2sbdGRlL_NjWNifMA#+vxP<
zF=mwB(z}mBB#3nRS=nK$N)FWqIgrX1NM(`;4;WeN6fr<Q!$ufV#3uVAl2fnyvuR&r
z17XPnU0r!_2s$`}Sf_$qGP(eidS;$<qNgrr?KGHJr8<_gI@DKM8XtUjUJ3^U-A6VK
zCCkqar;KZfWE<Sq4j=pvk|;^3Y5y5x%E$KR@TQU^W%yfeG0Bu#w&feouQ|RKW~lL%
ziSd@g4)%V`FFVw!V~%_}C|k<`VuMHv;^|A4iA~zU-)j=mk|t_heAd00Uz7NXP<@LW
z!OGK#wAxy52G~!a;Bd>~SX1>Z(?T7j<$D(6J&5`G93hTiE%T&nw*_pGCc%B~-U$v>
z*_xLrhd@hqy)bC&K}hpGsLv{-oAzsPyC8XzlF=fMBpVp%hfRNW=QiNzS*qXb5QBQp
zn;(p$bIOa#??pa@7)8GpLDdPIxBUq@+APED$J-X!jitK|Hd%m;%Rph-aI*zNTD$5K
z^qwcLG*+o=h^+Y7>?y1^O!zar(=jaM!1AtFnOReM`t3xL8ldD6Y5oK)Y|xWyI^qOr
zO3lUb+serQHY%PsS%Qli%PbC)!$C@E(NQ{Wt6gE>2+@1jh12PAz*)yAei|*nvL}g{
zL?`J=sK7tjnl+Yc)p*%Sr97vS5%SzL6S*-YL<=7XeM%LOI)Lb&=`(It$M=8A!xzf5
z!1rh0)EKFz0Jio=<Q0=tRt6+fAZ9rsWa1Dv;2*K873C1wr(-J;wUF1FAnlT0A_|hO
zJR|s2?qyJJ?$WRyyDaxKgp{Ii$*1R*oVeS&*%(vSs|PptW<dnWHzfo(1wqB8^`v+u
zZWEwpjQ7p)T1lnOfR?MTXpyH`MViY?%wHK}h8m%{r5eUmj^HhYN1n{46j?p-MEQI&
zvPQqCCX(wjR8|5a)dg%ha$?HRP5pa^a0bBf@cN+S0ZJ?X2i`?*)F}~B>?-+LB5km-
zm;(WVWK*9qr9WVFWrS`-iOUA;DGbQ}<L1;d5!dk~^=gyb%{6PS(A#D;YRyC?3fzV#
zQzRHc>!5s;NGmv;Y1sqg=<v`n>{TI~w9c{Z?+Jg{_C3$WD#X)ER!63SX_vsy8j1am
zHo--}@5dk?fjf=K9OJz2XmfC2W9;xfx(J9q=P5~etz==m|I{c@Y2(OUP%5~PklmuE
zllH8=JGqI7EqkZAOHY+dkXM$`o9sJJ+v5N-vu^0L>n>{9U;Gp)wAoy2lF`IH*W4Di
zrS~*Cd<(1hXqjvdzYr(*c12Z&ZiQ^bKvSrRF`Hxs*@=t9f!G_cE~|@3kyUi!UuxMU
zUc?YuD<K4eaKaseY{Kd$Q`4)*1u^rl#QC>U*543?L3#sbv%RaRjIAMXEu@l5!B01l
zr&mKw^cO4m>RGT^Cj*<`mu=e73kR<nSs(2WSSd`6#?ep@E3;^Mj@a)10&2qccC*ZP
zpS<9PtgwE5ldb5&i`x<OKG%rK9gj;3<BGCHPM85wFv2E2c{SN%m{Y?GxAk9IZ7~l+
zdOf4WWQtW`uUG0Or;*AYsYz6$xi6EGZ}UQ)T3nc19J|)XxY`1q{gv2}RTEj`Viwq}
z;)q=y2tIdVfLBTtxtlbM1=dF&9Z<>TQ3JiOV%(%?_Lvs9%7&VJgDnSS0|Q=!nlboW
zOCpfs4>#ruy|Cts1H#erD}N#$(m5e^t?f-P&=lKZ3OVU}USUNyPZ-!YiJ|OU-j{M>
zFK%L?eN#1x=xkZluf0V60sOEsI6=<pdiVK2P_?xDah*!{MnQ{-L#nHnhrNrG-I0X(
zi0FCe|AFQ$S@1@j?c1IaR~jdhXQT#>PKdTk*T31?0J=lOcmEv5qK6;#7=t3d0#!q~
zG}`p|LiPOobv;`M9oJ#8M&pE5@y}&~^<t_W-ozfw&pqVi;^koP3yr73mgn)b53z^o
zyZY9uS>L92Pyha3l>8J;d*&PJELOBkuxD1UvpHB)h4*UHrN73?1qdyt_7L;+%r>H5
z?^nGmJ@<Pk2%PpS?B`MtkS*oS8++fgI>-G1=&^ZPRG^GbLnM=nv6qK5SG>PFN^A7l
zuf6R{)AN*x1Q>7J{@0kjFDW)-40D+uHliO~1~|yQFBrY>cN5X_rGz*rTQwF4X+(Ao
zLdL8>oy&W^{H^d&Wx82<%t8VzzQ~PA1L>~lZ*Ck`c2y_$om7;h3>ZpuwXGk!y&o?8
z8*KqPBLbVs#E!{N@bo1bh?Ys@j)3SXRWvSTZ0WoK5mZ7qq|hXkGPi27%s3&-<PQXg
zMt@`u8my1ut!x{8dzqTQM}pV_Hb*%-685<Ik%cRly&m9O@V!a|Qb=J`w<*p;sypWW
zUm~7trxhvRF-SCaF8)|ayJABBe$oZ1z{R7V(cW6HPUtyH6;=bH+uXH<jj{NQ!5}){
zQ6g%aOi!j-a$P=cS?6=w3nzM~!S@Vq|3+c(wWj0ycK??4+w!@^H+_4STgC<K9xPh0
zc!3aI#N+?s@OivSKK%5)K!cyz(2qHE4M)1sAON4X+Oht;`fOoPIvPzJ-PzmultOxY
z3$b6X+*kSGtFwJQ5JTt$zSX3T>uv6rL<o+SeNEL1HySj*CgrBG;i{7b6PFZ|sJXDS
zf&X_PywV@y?t}k8c#StAVnE_(GZw39@)l23q+Vs_9aRtG06`-<ye(nFS1g4Qeo-07
zsHMa-(thXy-;Y2YOnzmkVu#OK5_Zjwu1X8rHobj)uAE@Dim>GK6daVNj-9oG*&ZRn
z^tVS=UuMwepH32yz{K!G>${kveQUS_hPtHwUEE|fV~eCS*Xp}GY|kGG4^YL#J;hi6
zzDF|A*iqXVS>Saxj@kNO7@q0w>_o2c%wwR9MdWbyP*5e6W2XI1kV(>s6V=bdDjS=+
zzB-Jix0?|lF`P<xNq-1^0)Ze^a}<ilBia)K(xyWH8udnlTA!TaPNADv*@WOIFcSGU
z;KVw#?jWoSSb#Q;GR3`coiG6Jw$%{22E;PM@dm1tiOHT$+aR_Ieo6JjLAU>3M)1mN
zuSVI9vlp=@2wF)h5mMN3(rw-fn;Mb2*d~A_68r&tUs~b>trAoe_g#y{wS84+k^6d5
zUDnhv_4Lhi-XUx#ZzKJU=?EsE+p-eQ{gDUV4?SzP2-yZsJ0%k{`Jq~N6uCz7GA-I;
z$kf5=r{IP-%>?3C2_u_7I?mSd0a3y+8^rjWEvQ!Z*qcJ`XYfGz>5j=RHeYRP=hL3j
zE@g{M@o#w(@q_G=O-JsmC6T`AjhO$Fz2_40J%6`7$JBhET>G}PJfBy5ZTq}?T;l@0
zjr9DS`3`y8KmYW8`5J+{rU@SD5q|gmNKb6A{5p^6(jB_BO{QJl{=T9-&a18jL||<S
zwKhMO(zZttT~L?=4I6nbRu1q{SJk88OQ%`dWjSQU8gt_#oMkyhGmMiTM$x`XAyF1z
zC-aA+=)<TZFtd#72_WU1K1Zs$?{vvt7Fm~>K4+hII(BI?uV~B3>~M{e{N&n`qBfl+
z8ANVG*W^>jifx*6nl!3&nUQ^ei8p;vlA|C^jw6bulW<CRtzb3tE}B76=;x9ZRSJo_
zM$Ot*kqMJ36LynsU5i5}RGVXw0o~HAT0G<~!UywKQJKd`!7j(6*p64_%^2?67f(hP
z1%j2m%W57BG`b1)HT(Y`xQAEgsfKdSt>>M$i49YL>b7|av8DTD>+@TMo4Mv?(lUBF
zwLmmov7Fi@RJBPH<@wO7js-6|l-$Zc`8Sao?b(ECRx{9OCrE=3aO7rRlom|QH1Z+`
zAjBO4&zt#+vY_@J6fOaky8>R9{6+IAiRbg1DjJW~c-$Dp;m2&I@E6lHAz$L*H{~!Z
zw;ke=xi)3M_Q1|W%k|Mox@A9cqpVRA_%Gq!d9=psgm*+tz+Fbz;do1*XL%880rupt
z7+G)uLaJI~PH%*=+NA^C18oSnol6dus?aAq8%d>C+h;<m%reXT|03<P!W_%VQ5HgR
zILgNG0UxbSe&ds3Bw66+kB5$K0w}qvC<zOEK!7Nk{zhFclgiPV0kQVcD~--*vA@fs
zOMg1WRWO$=kR6r98vyaXqVH=h4k$}Pr%D%+jDrNNqAFdKXF0X^<w$paN6lGDp*JUL
zq2E!G()dM%OJp1y=WReMFOEg|htD&0k?1p%ywzWg=SWqoHNOQu*(2i}DC^FGEpb$I
zpa!(XY7up|=ON;-)JKL;WFgt)NYx*hgFNTJvxHPCz)ejKD0&f@(*FHjHq`rO@`#cL
zDb}Q{Z}}>)C4sVY#f7}csthLW7jt=ub8$s$CDH{S`QNd6Qs$~V(WnqTZhmIdMAIUa
z18`x;zSy|-1Nm3!sKnUwv&;9&B}hK{<v>4C2M9GBG{X>`&$0bUG`+kbK_FM*2~H^d
zV~7+&o|=`5AJzyyY3ge9b-utN6ma!@dE5-ge}n23e;q;G4@B;;mTi7>!I)U?4!O)L
zPAn;yn#1<V=LzC`%BXF(tXNp>hD1c*bJ;p{1@b^|{njOmC0D-{3J&d-uH}T5-(;$J
z2bd%@N;guc#MkrH5G60asY=+zdjT1RwQLPZF_Vr9Q*hipY8Yt_(7wi_9O(Ms4>Vjz
zigoPe)rJ_!0F3O`r2dpo8)$<ocEEfz(!OJZdHFMz$Y%DN#D*Ye6~0C-7ckqqif4H=
zGg4ihKAy=RtQW|7AFgKL2#kGT35O#X##XtF$jY|1C6LNfT?vH<C&<oI$j(vtyPql6
z5&D#bj$XUwC&lx2KqQhXZ;R`Kkd=umb|Q__#1KytJ!NfFIWaq4&@<7z0a-xJ(CK`|
zc<sxnW#{ubi+P<~z~XH}Vfdpvvu;51i|O5-`Z!UYwvJK?YF7qs>lm~^Ceu;iMM$tQ
zBFGE{Vm7&`o|Y0S-T@S>beuIFCBpNh$Z_1}<#Ajx@5*q(4XtxH`|Iwq#rJJ#zpGu1
zN}w)b=iuhy=J{S$G*M^j(U~$TK9>k@3cK~vC0ntkHCOE!yGff|Qi3qHyz``ct~d@Y
z%w16FV&M7R$!EFh^`H*k(YEUtJEywHWXR35IxrWe5h`f3Y+AaMukBCw$feM&qfZFK
zwi32TcV?jDGKBvAD2+jj?`y*{y_4yJ&#~N;)23)0`sDQdtTPnzM%-fOkRzvo;nPoS
z$2k(k^XaCK96R7|*!Ta1))SY)3)=p>S+CQnt<(yLei2gsRe46X=6Yv^8m=7_@3C*?
zZU-}QKG-6vVR<XfuvnQqmW#Bl5pKIq;mpPhX!X`9RyBld>q_Q&|A+BGK`T#@)@#O+
zoZkj^hj0SFByzxfl5s4o`VP@ir@<2s0Fw=`$CTYP0^|0U0qKcHRZUc=udn@~T+KKW
z)=306++gqv=Wrp(J!HW_i@hzYJP6ZRp9cjw6z~6u)&<ZJ{%^F-;#ZU-Bwp>(YYc87
zITjNEFRXrG44=6eZ}~UWvo)UiJx+4wK9gayu`x<(Qw|rI5qAoRQm-ekQ^C_%00|?4
zt@HR#3Z)x9=C1}X-<hpjYi_*q;i`XP{hwI>C)WRo^?zdhpIHAV*8hq1e`5WgSpVOz
z5BMk6|B3Z~V*Q_3|0mY}iS>VC{hwI>C)WRo^?zdhpIHAV*8hq1e`5WgSpO&1|B3Z~
zV*Q_3|0mY}iS>VC{lAIzSmpy#*sdgYhcNv5a$gx`BJ!%HPVCW}&^w|wT9aMwAu>BF
z6o^7Kt$dXnO~_o?pYA$mhR(^DS#9j7ujuZ4N48tbfokgWie?^hyO(?RaPwtwNr}H!
zg=e})kd{LbPgU&|<3V!Pp%`4z5May#P}KuWHR0{*R8%c3YzBbIoqe}7GGTL|W!unf
zO^xGa>L8QC;<$mz9iDop<MMvdH{VUqMVC=ns_onNly-*`jR&zx6<vd;V|SzRYqJl<
z2!~IT&Rq0D{)hzddcWi%_CKCIn>BtZC@9;<ts&e^v<mw-Wpg+$J<lLAG%z@d%T#RT
zN_gII4l0E|y@kxyN@W26a1Gc|qQl)}Sli=z0dA6TX*uxiEz{gTG?mAcBgJ@-<vHLz
z=YPZwKj-}|)I`KbpfsSMz{71P<TkjRACr`uklI~#*Pc@B3+oRWg=d;>z<la+j{McR
z_}2_bZSNQ>%WU66Y1j7-^J_f<b_5d(aTL%=_4nT)UU1sKuXu^UF)d1L0MfjVw`_q5
znOCE1J&$0o3}Y~X$p(@99@M`Y7w&!m`ia~6(D4Kp>HrKRkdTE|VGeUfa*aPY%%>BU
zUSa*LaD|YP;5}QhG+Yx5uHY!nmzicA74swHdpV+#-}&nQW5ZTCrtYdPJ6>Cp#GUx2
z#2eqk&%a4jVKA50EFPAWTCt6%uHmB^V^tf%^TpHbe)VAIyNH$hrjNJrfLr@@6Efbq
zNRN-sU^6C84keq>vHwDf_ZCp|J{KDT`8CtAI}z!P{7|hUXWBI^zZ>oA?}=Hom;^CV
z9?+Z^nIrn1D#o|XP?CIMi3lP$$~~lE{jn%OP>mCqqGbuQ)dsxcrH^`=S)^`7&zJp}
zL<v?%p4mkmtlxjgSOMT1gw)%I;|rSsNSy%DDOg=}!tJhhlCzx$G>@^}s~Ori^gy05
z2mLnzw?e$DA@>(qRghZzC|T$hCPakVp;b3G4|F#4hsq?#H-w^ltoaKCgFk#^{PS93
zjw&_vpzaz|63;s3<lSQ0RyqpCHT8%<y8c9vgxy)C7vdb-U8yh5ev%pDd8kudG9@w=
zGD1OE7!AnI-Gyo3wwO-N*U$%UXO!a$mJX>5cGRov`Gi$HA<MGvPzwF%QHgml#0eg?
z%_F8xZ+LJggURvFW+h_|(p3An)MTd9z^OtRFPkhu^}YV5J3!^nrb70v-(Z=g`@~@v
z-3ARgg~c@J$0>f6HA3Z{hyMp_=hPz%6J+7BZQHhO+qP}LW81cE+qP}np8c}P{)0_U
z>Z0$flIlKv9*rYTjmjdCVoxPp-vWXSb^7(5L=imwfmpw`e1ovHel5_hma6$7{l|q-
zmuta{<$=TEj}D|kmq*}#BVcrn0V+-cpH9>_lQklJW5y3$jv;q1y%OiSP<dsaEtzEc
zdC!i=<F`PeH)CEiX6-$-r_DC6+!ADGMJc4523K{TvSr(NK4=4BP19;p_#>pI2r@1a
zY>|#nr)}Qb?m-)u_jV&Xo}ZiZdFW8_l2hYV2GK`E@&_6<I8kCRLCV}}$Cy1Wd?PB+
zG{_jj1|ZFxm*!CzjYtjRZ*;vx%BdJNt)2sIasR~=@8La<4$03(RoUsfl&LPt>K487
zUO|GW=RFTl=mYU}z_WQOOJ+!1<_faEw@R@9^aWz~Llnq?IE{A1aD=Ygb>DdqakZ)&
zeIZsrK}UkcjC_=<_`l%SDNGEjMvjrY2+PXP(B81~tx;Cj51>!Tim0+H){iC*$|A{M
z0@iG@seRozKE?T%`;bs(&N&`Nr*y9O3Wz_oit?>CBuWuSlwn{h6{!XzU}{3;bjcqR
z`E-kuflRNp8BBjlr)+?kZ}7-V{F*Ih(jCi1fY8LbP_(*nm<n8ZI5?uF3DYUUs1TOY
z%w^`OxxOulNRV?)|JSMlJ3>NRl9x;Am>@L+avDZo4NdH_u3Tb-ZU80#m&j^qRD#LR
zG*Gu^h$0d*Q!E{usT7lRa-~y=|5{{SJzMz;{yd_MURpXIEW@QSAg*X>3H$U|)r+9+
zL2S$>R7*MyCp|P&zTxPcg7im*94|A2UeE6k`Bzqjeeac3m1$^Om{e1=>?<oDGlJXC
z<Ht2NfHAM+fbg>%;{ZRY+)vGMk`d`FFpt&7*}~sF`^mx4dkT59#R!bEV#nB5_#5fo
z)^lKB3F`#r{9q8H;<g;$!VeMBBq`o`{BoX)nAGbW=e}9zT&X$4@X}E%XSp$`e?sb*
zO~uDZ^M*;s!C8S&<VZpE=EZl~8UbpkCccI<^O6(EONLvP$V*Ieq$W0l)KK{)!z?5c
z_U)1$ND_CBjvnweuPMp@dSb|TFT;LKrCa9lqt>FB(r9ItR7_dx1nAI8ad8|k1k2Ub
zXQGgUn2MH~+0=;+@nsNBBLv4F#dP*TB@o04)H9(GN}tLx2$mU`mzIiqg#=#D?&JC1
zzT5hKXa`w_=SK)|=XxdVeH)Gxbq?se?Ds4%oPY{W5DkQ5<SON!_kP~)U{=kaw3R-e
zokCKgJbq8k^1Q#55*;DqMvo8VRopnp>PKB{sZ@g%=@ojPt6d70td)Uc@B=y(pI*iw
zbYvI;ZD)P0Sf_^Ixn#H$Q}z1qD(xqYxE97ADr*7FO0%if>4mclM`YB}Qx8u*VR)OD
zC8gW0L?n4Q#O<Zjt=@(!W)n-+JyOdv6F2&SOD*J^L{h3?eQxe#Ot3H%H;kwh<BF=B
zX?o+c9N^D>=NW@l2;!He0?IZVM}o}UIJsO6DbgG2#Ll<ZvNO(CFLYF85|(^Q(Pz=#
z&LeIyG6iIuhnp(CjJ{z4oD<wv=q_O$s3ZL2Vyx4bl{dJ+wgNf`4&A5(gib&+r-J|9
zAY@CF*4gnookvG<#=+3{Sn?4Z8Root%%{ttDtHIBLHONyCvp!!W0b+F!ipyjVQKj*
zLfMKXX{b+UDTPru3+?+FA7UaPP83q8b3^9q^Bxg2xE-$vGp8}T%cLfLSb5Xr9wP`y
zIu6sb&HzV{{P46m4$S$Y!x&JsU2ISapRP@Ooxu356WHD%6FA=?YeFxPi-zZnz@3c(
z60J|?zI}_?!=tZ@r6|o#eDO}G4u~=H)C2-q-BC7^eW@4xlV}L9De|hycgkIh98btQ
z&Azo^jHY^5R1^vO9Ac45FRN<v<=#OsJn%@W=f;XJ?d4!=mD}SnU4O`yTe9TQS#$WB
zH<rJ`t+!+#PAc%N<0Gi6oN^bg+q)sH*`eN$Ecj+}UPScK6Ufsvra^ehmHq)6rif)>
zA<3R;;|#9o#2yMZnqtExO>pWEk)l2xzM&W-`2!Vkib<d$s~M8r*E$|?OIqxnidcD_
zq>5aMP5`-Sx-j$V!Rkd$vK4mXYp+K{J{<aoDa@Ecoh&4v2NjAOVZalN=8rNjuiI+0
z+eG45)1<l9D8h329K_P-pRtK<tE=W|ZnkBxT(6PT(j+sy7hx2e0JC*nZ{uTgOSsRY
zf?$nvyZM8bUnEJM;uv4{*lNJtS$IJ)4SW96mAmrvb=n-0p}Do4wT1`x)GJZ)$a+DF
zz7XvKv?;tC;j09N1lA-PpSn-!x;Hu{ZU0wpa8R~)nlyR_9FNVjyjZGJM8~?ihhj#6
zY!lgBtrioQrFomsnS1Lrx*alxl>j4^DjxngP48O1UGUv6lv^T%;bNC71pJ?}xqYEv
zHOwvgH;1NVWFyuCZ`2uD8^ElY$=Vq94zuT5QbN2RINYt*Z8<`3x2f^qluu8@0ki4-
zhtZ&~8IVah@oQ>bEZt1y!O?)xlS+Dls;gF&TW>87(vJ0h5eSo`22g0#Lrr7|sI&uq
z*tS3RJqtD4p~CcvFwoRF8{c<`$+wHhP7^+AYKAM~h`)LGXiHmaT_2|4z%tHs0j);3
zI^99NG3+OVczH)Mc>Y(_JhR8~LE;LR3Z_2TF!HKT4*Kh&-w$7*piN@yVn9}uRnw5s
z<`a>JYCM_CL8xE174Y!D1KAn;%;E4qAcS}vCZmxH0TcbK;X;HfB>O1D`Frmy6Z?JH
zOJaxbBzX0ays}{~Ot3tm)FS;vRRQumlKcc1Rq~)xFD%fY4%AkNl>?qku@`xD4vs3Q
zCdnpO!G!q-jRLeX<nN9TDbo1MCNChP!u!lhL)s32u~@sx#o(PN2_ngmOT*9$5htkH
zM<zeKG4C!jNT3|TJ<EcAXzEZOn(ocg7Rl1$UpARWvF2~`igf>pPuJH)k#2RRsy2xe
zkfs${TC~9+hj3L?<VsPHl8OlQydLp3yZ|5P-eS4flK0XNmGlE36=##P;8pq^4wTXu
zzh#U`&3A(^X}NXp2XFiVwfeJaWCYLN%p#Z=_Lfe%I0`T#xwuzcrO{D}B2oAdLsIn%
z)2GNHDeD}TY$=vy4V(O^u>0bi>|sg_{}C)L4O>RK*}kY?4!mlb=b$lN4+B4%?}=qD
z($P05NO13G*ctRC-}n&veu<=S7|JIF-}bP{|D9EaeyQ@lJh(iUqtEkBa^c-2s6+kf
zO)$yUR!KiA@j(Y=$&0Bbgtls^aFY8%crh{6-6vb%8^C-JAoM>Nt=;bnJHLC|Z*#}T
z&(rOl-}}s|zV~yS{C_7eO`k{X+S>O&S8aRQIJn>Oc0b>~e7O4e`uz5Oc{tzu>*K4d
zd44y%%b_F?+^e*cboAfSR2K&u`C7xGbEzF+G6D3YS9K5f!I4i^^Y}?D_(&ul&@kT5
zSfn3J>KYD8EqgKpAchdNGwt1sBjjlSf}IA6=vY+I=Afa!j!ZITM=8d!O7yQ%`iiEk
z6}zQ_tH-RW4eWS2^_dr%;3#=XW|TECun}Jah0mLP0*uB4@Y<+?o)Cg$er~<e&o8Ac
z?ID97+KKb4YQW<`I`<D_@G}3TcJo~>uPt5>-3CRn2?oe8UWIA>p?IpHnFt`f9w;Uw
z15jf&5cDGQ;Zg1$TpNfrjqj>);{|!EI3#Fs6>cn<q!4;Mmzdc2V(XR|vj_eIQH}{c
zyJ?&4t5=q@8BUaP{*)W$JN9+uhxF<x8k-&ipf%vBC@U$MvJ_ekfMa|Wv&KoSIm4Qv
zcxJM4hExJnp!;M>+dLZc&c*2o=>_UslS`JrpQl71aRGD@O0T05Weu!1M1rsK41z1%
zh+spBB4BRAfE=>fE-#+cX6R6!wMPBPW1^(|`(nX#)FAu|jpj|!Zl%wXVbnrS3P;w(
z%`nCv8zId_DogFHAt@$w?WQ=a0jrc8Sxx7W49%X;&cIAr+IHkC(_Vl;Gu3kP*NvUD
zDZPfZSqrY4=ZyI;CIGNe3Qt}@uVMlWUH(u|i~Edig;auL9jT+m^4M+&$40U+O_qBm
z`S!D$rqui_*>&0;wz2&%*r^R7zQZ?M74o<wiwCSgU;T6V-1Zr^UOxHLO*fQ-YY`N6
z1Gg(}<bq?fI+27+K|HGOqN#T>)%|T<Y%5Ruoa?4TV4FHF5LM|2E*Im0GMzhw7XC1=
z4~#)R`dJk<HpxdL-GjcY)jbZ5ddq5*M^H**5nX9pz_`yk_HdbRci<dBRC?V3sw~7#
z|IE_(njID>2W6)!_&+=@A7*W3XzpyWTfR5(!C;piI1geT8r`6(kFY2^$#);(d@0qX
zBRhi-yRDS&vye?Jbc3`F6fbdkO1w1GMV!a{HC21AL6uC!FXa>yDi@|si@JWy<6`_B
zqy!yCb*t6OBlnc3*@!j4UC_woC}wU!5xh5$Mt?RH#qf*Bj(vwj1kLQ6sS=2SUnb0j
zP$J^zF#w9X#UGkb@Pd0`bK3K=ey61C-|7e^`C5gD!J7pNM*|P*)|biK!_l4N;`<GL
zS6`cy;@^XK_bac_^go-QO}XvDFO<K}hjNTU$BwZn&7X7A5+FyKI>D{jeAH!$MZ!Fb
zOzDho-41q3>=t?O1XpLIFsC;ofrLSs0=w|Ik!HKB<9LJUX1Hq@^?1h~xciL}8D5Sa
zkGw~@`O?uu<5Cl;Yn%&_puWNC?5}*(50uPz6?{C@PuW4@^OQ8uX=|;7c%W@ca_|Ch
zpSWu_7(1Ax2zr0NFADw50%aLsPZ7{4<lwG~rD<vJ<)gxqMiY6U>kK#r7@&^sDiS@v
zsUa`YlART*jF#K;A}72iO-rU?Iuhccr}{Y(gM&|$kN)vS5foK=FY!XlQ$Gq0nM7La
zLw>Li@`_4~o~ZQR#8s*cNHWe$Gm?cadZlc6M*#+K4!QhUS@7m5M;9$L^!gqy;KiVg
zO;2_*ZNQTnoOT`v8uN%y-9SW`h($f?lSN-gsGhh7h?U0XQdnNm28EB^9dN(urNGhD
zE<X7tRWqZQB(71ae7_Bi134#=JOxE?99#)(V^P@1<dWqXqr^=G_4;+ap9DWiZ$bYN
z)?7eHVnVEgX!aD=5Mf1L=A|*B3T1oxlnw!(?{mRhGL);e7Ef}rT>E*M&y1=thi-_#
zh|~zsnA4S#>pzw==dEH8vJ~e3_BF#d8aR(vrKs@<VlqK>#V`%<Gr9RH_|m4zcx!x6
z0{lY=*oOZ2mde3&hP(CXkw8N%-7FK8*^Jup#u<7A9`%*}e@D<~JiX6iLr`p4SUqJ`
zH03<qbg*?@N1O<A63#C)2o?u-nW}S0@s`U$?vnfz`v!_u%)C=K^o&7VSgP|Pi6|X?
zf3rTD@wKAnOKv=J9lI)_J-P8ILR@yey)6c3#Wd4xxSnl36oB7S1EMDlBxA*a-~C0}
zMwVlVsVdQ)HT!mzB(sEQxAAe8il?SE0cR5_YCwmP)<xwETuez-;a{FVUro_>$%tO;
zeFr1kZQ&8JT??3Suq{tGyk-O?njmFkD@fY@*VEc#6XX9Z$JOlE4_48qcw_KiWj;g7
z{Q*bVmWfrCEE+MBw=Z|V2y(cM_85c1aFl=`LNLGnoE+Ig=57}VU+Q2m&7Z>(OI&<b
zECa)K`u9HVk@@OX-TpZbj?GYd$-YdGatIpE@B2n}V6#ltGj<cDIuQr5hnt_&a|4F_
zhSH|yj6$$}iwdYik5KCMU!#*jY6+d}r%9w}ySwZ#KacDv$Qy^c@!FVvdXq52M8T0b
z3@k73+5L@AosY>oNE|#W1s9T;`*Co>)`e7J!c7~YP&yh>(qA9D))2-Qz-V9Qv!a27
z65T2F2faB&Q)@IQ<{tOeD@L`avQkx151|yvzR!1=8&z+=qLtC?9L{jRj7g1(7h`Q<
znKAm2>J`Al$<gS}nUGhN=D(6`PSWyB>nB+1&@=`gwc}+IBZ&&KidJ&XGPDYI1bG%g
zCkl+HUhmYAj(^f;m~x{G{gFhC#Bybx0?XkDXyBb(SX1MgOjnNkT+@Tatw)(-ma;S~
z$odYsGhdF35|a}=d5l=W6aZ*7GlX%`@NN$3{!Yg>NIi*;XnE&mtrE?KcWG-)kJt!-
zGMvu26GJjbmG#pZS0hKOnQJ&6QQ%)4_H+3~pP(jYn&1P)9ry@(LPA^C<XkH`XDm0<
zcF;NCkwalY5wjwl!wKhFKRd!KC5*x=D<ZnzScc#J;EtSX)HKTC-?Tco>Y#4YS^De)
zfvs4&;St13(0iZ~;A;4E1)2X)0Rn~m?T+;HAoHHha`H}L4v^O*k7y-Iv4`cu$qw_g
z?P~eVqQtA|6~6H^N7S^Zm`lcr5>XZlOft`-ZsR4_m89i?x-5E!2M-CKB8Pa1{};T<
zjunx>x6BE@em_%}#I+mQTjPQKB3q0ckwb$5^gSvT=`VO~mgH=W(i&Tbh@WY_hOwuo
zsj|ZTl7tHPBKha;ll%N%P_g7+-_3`{^WV5bRT$USosDGO1b<q$T)3{bv;sWj^+V0;
zdOF6fs?XAtAfNHD%t<DPn(=$7h@l({>lF@_SiXTmjUK}~xV;>*u}B_&6$uk)ANe>;
zR{&t>lf=78)sv=2KjHR&u_f2FKjl-`$Ei~;wrQw*@@6%jakCG4ZJ3h;3>q8gZd!?+
zhMKvS?GbTFfJAFd6}UR`hd8pRb^gN%^C$zD^vGWHQ)bbTCzH$DA`l>Pv3>WIg8U7>
z5$B<(9WqgtC5cU?tWlt<w43jqUT(E|YM3x6!>VwsWA}KHpy2<sSQAFTP$VDy6#+8g
zRw?qGO0~vOTQRt7i%J-(A$`zBvg)@Wl7a6%pDAr;%qRNc-)V&NJ%==twwEjFg;VY=
z6V(?2!^?$2ZJ~ysx;lC1?13Y_ym8JP(!0DUbd#<+aDAM?KWvC#+n-$0^WdI_@K22k
zMqeG#GR|s`y2G{T8sna0EYpmGhgBxvKRw(SP{v0;5l@ACDQ0ygY8fqgYiL!x#=gg1
zg-64ynvGb=#Dmz<R*1<KQ+#Ys^cRZo6{?w{gSt(4`u|zup?@ob!9R`-SmA)Ig!h9O
zOL&5CtL}<WSY&;R(jWp4zQ#X2Chs}tsEIrI1x~|ji+Q9&Yg25(vLz&XQa(SfQvro>
zZso;)_kG#%UweR$cFxLB#8((n9p5yas4naw;4dtUZ#D$D9&;r|A{^k2U7qw4I@%>v
zcty*8sd8BGMJeF%?}}#MoV5ndcHgQ{sv7E@myr1&a(NpnkD42H5H5Cg6i<L7SMa8i
z9Rt(sHAxw;9N^@YA=ACY^y+X-M8(7M<5QdnxXzaSFx=$>BK|oGTo{TJeu*j#ls!)b
z-D1gqGG1r2YbZN;D0%P}$s=Y5UB^I$uY5t<<DX)T4N7+lyqWkO5;~ks@*5i=oxad{
zL;YLV?o13ACm5fc+>3un7cy7*L_u!^kM%%9STfFaRLVu1z3%TyZ}dcKuYK19`j2B=
zYnV$)W>-$WygD7HpK^LikNN`k<3ot+yD+2i$QG~j7Me(mziL%akV78?s%<?Gh=XPh
z{`w`KycUlA1HCS&1q8ht!(c`zjkOnXH)%!YfN`8T+5`wop1mIPK(7>zD>$mP$RW0X
ziVFRY3&0upck>(sbL^o3^Lx~=*U(`RJ6bcU4dt&<aL<-T`}`k7jAMr2ywT&HuzwN4
z{e@^n*Un$J)3EOq?ok{nK>+w$Gy+?)yO9ZlvgKNncYRKmD*+l(Af0~z_lw~!JdFax
z`bYl^4^B&vCrvsrcNv@qSdh%L$imTH10~YAy3h^}nHB`be(`?!V+S(2Bw_-R5iYlu
zc#>sA{ob{b4SsBXwvZ%%YQ|CYLcTm)F1s#)VH@Z$)Ko}%EYdhc5@tA4oFSZDzTzu$
z9)OAo^VI}aV4S4j#52z-h;(}rkW+eGV!IS#b5aofe`t<+J~jV>YUIlzm%4(HmJ@(o
znI}QE65bHk4I*bOwd9$1H`-7vBm$1Kc_%Yq(PX8eSF>NssL=dn5t}g4me4Y0ejxSK
zjXc38D+4VsW#&2-bt`;RHA+rRz=-K<ZM|!_qeY19XkE-fZ;rr&MmoQ_sa@9W0_khM
zhgLfJ@jKs0$x3rhnB2>A3XEy6$L0x4t;L-0065I%?@5&eag`}XW-z%iiuzKtTp_r6
zgHiwOy|zA3casC^HI^b1yp#}@Ad_Xjh2+D+qoN=+ZiiPurm8xsosu0FpABaoy}Gz;
z1XC<;E-V(=%(_Ko18#4Jms3fzlxPHcy!sRmhglxJ*m!(X$sd?tplV{i(7OG3${n&b
zP(hgP6)FM<@fAqA#G}u!M~quh#NY93cOyCmVW$Bwfr+_hQz~j`=fV+F)Wlk5ueF}C
zpew!R1f8|Kpv?|P-pYG^PuM?DP1EX}Mu(;JE$#&Td|>xX?=v?K{1ux^oy7*t9T2~8
zZKKMKp3SJsb{=3vfWFBx<90^fsqE^q>dVcje)iR~+{&AUhEG(}m;?y0sYAk72bcOv
z{<#pZhs`en_a_#2^w969p{Lz{Z#!M}gDrE@clN|pRfW@`>K6(?!$q<_o>M8qJhJP6
z?z_M!UJ-@V8u9h0Zv+;X#U12Q_@lfL7Rvj70uJD2pjvBWKZCehX9T7qs+VDv*D-?q
zj1U8%Z1<tUzlA)M0%y^c5(1Rz#M&js9A=KW{&cCF=C;2?6GQUB6N%Pls8xY??7S?b
z_>*xg7-zN%V->bZ!+hJTg^6G)vb9M8`$V#h7n+yl&UZ%?3$ctKne0L2$G|VL^qb0x
zOpCZ!$*-Vn+~5I(dJ)$nXjS=1_6$8+tI8i@ldtDYRDS0(yXHrd(cNDi!qGepm6aMp
z0FN?{ge&l^=c#M9rdt#*wmDI#w8t*m%}@)>sxfVZHX3BTPe2K11}oChtvGQHhYNjz
zG{4wqmsh)y_d`&XL;9`xTBJct6}$qdfmP}iv6)j_?;fK*Lwl9kLXOg(>$>|&HA<DV
zHt0tJ3Ir@b)ZPHPfrAK@V19AV;x<3>4PMgL%Wh;Pt&{9}j<+ITreiu>;KH!ZD;i<(
zXzzR1nIoK9YVesQUy~D79KQr4-Sg~O8nK5{7DHwJS45-R?x`&Ki|RkuA+jtF!I#;<
zoJd9;fmdPyz8ohgiXr_=BFhgWgY`~7GCnJWhop$(P%{v9e%*PX%z6~*JFHNZBTY+;
zyVt-3zywO^2dbLyViMk5*bE|HOtQ7Dq~sk@Nf%I1V{DY8TY2;Ux@lVgH>1}q^;i%F
z#yGZ772Q6hkXGe1G;35WdrdJ?;YE3!7(t-L+lB>r<|+vT%3=^|$yhU9mU!G_@9eF_
zwrzxI7Y*4gcWV&8C1h*R2zlsL1WD?kE_bbzbb>b3zdQ_tHp*5|<>pU|A5l3kkOR4u
zRY3}G@kN2Bu<Z+PNujU&0&=R15~v)5zL>fisTTCbes0>rz6`M{K6;eq&-Z3dkSj|!
z<1hG2TPGqWjV+~;-_)74>HQqpB%+1w_-p9YMmWv5tRCa-U*U*8p6U7$mDQ^rcv(H6
zqT5(=QWs3o2hcT(#A0L!0U_HUb(juiDZ~c{3Y5lIX+nDhQ>@}2o1#E&&8S^0XkRJ}
zhsnxqAc%iK-=8-}kyQidDla^hWs0aNVUI0~IVH*Ii-Ni{QzInXEZrkMCl_VeRFW#a
zI?Vp|g5ojwcGbZGH4}c!SBguymDr<R1bbz)fJN04T{vs!E8VKGm=`o%F2d%QsCA8)
zHu1>PwpJK+FXrn}M<tzO9scaEZQ9?K<;N`1(lC$8tnxK?@SL<(7(rF}_rlo@m~j9@
zM@%CIwNPiBhrCu-i^vaNI10#zT*nKyqe!V(so-w083AGewp)0s5v5=xM5sy&33a=_
zM~(M*?ZKMeh^?n|I#rl0Sg`f(6Ry*{E>`9L&XDU}Jo#$kk|Z0LD08#yJH(f;_$ew;
z(0;+Jr$(paz?BV_5kqm+XAOs83AMefBUZ`X9@L<%gs#oJcyK$GaBgnFJ)p14NY{vq
z+OL~;mtve#Io0B8hTl0Thl`+ar2<fH5&G0>I9+Y2@==G(Q!*B$VBm^5`o(ItxAVCc
z*E4X)jQQS>8Fwp@A}iMk#3$2O@4lM!?lj|qv(0<VrA%gBkV3{GOP}JUx@D!pc6X`!
z5vjE1C%5J)F*QraWY+6vo(>NH3HV2zmve)Qy|V*i)4XXd`hAN-aYQ&@|65(1zRg^X
zO<xf>ln!W_<eqDtaOa(C#<2Z$`Cm_Y(fg!FXdV~o(P}rjoDP`;)uS%+O)(bnq2m?p
zmi3J$Ry?Ek^B6ZB{oRcgyw)O5YqrGRT-plOVO(ZP4@vOlpxUVh2QQxMP&KRItA!SU
zW~^vMb!8%}Ih^5?p%t30o>r{a`$<h#&8)PXt9kvwPs0n9cDt0$yNKNW<A-hV@vZOt
z^Pb0s=Rde^w%c~4pZjsVgk_$ZZYAa#s-$YAJcb!F$aac-5vD}3-WXB6K>D=lvcwa3
znCiug$H(WyJ3$CkzG0^auRf`jwkTXlo`kWy81JOc=2FZBI`P_1_2<*Z118S14uemd
zcc>YX^Bkm*3Qs|AUdc|-#gO}_RGP+sE#p{YC}N%>_?*H4RAxt^&&l{!;?~<+QVtM9
zHx~A`^OZy)-!467+@5a~8{|YHw%6rkyB7HfFiXruzeJ-g`cW7ez%Z(rsqf-KxS~i{
zek~cSPoV@NmrUyyQe&}n|Ipie$?D-Q;V|^{W<H{}UW)4S<`K-tds*_vqF=L*Bss>g
zrMg3~>~ZutUi9W2);Zf`D{<(Kcn7C3OEGHYmqfYJQdFr;G(0ZZM>;rSsX#s|BQTJv
znxJb$&uYbNvy(1IA`>bA<3w5L0W!o%)#&0-B+cBQXcLZozU<DvIa7O>by>m--L8Mn
z{M=cj9t?p~W;eEF*aB{hPHYI#Vrr(G&u?MJmI9AspJew;H;^1K>f!Vqo>`e`oL@t5
zfoP{JG*N7&z^v^)r?I41rCHlSrgF%2KeW(Q$alEMGB!utSCYmdjQKA161o-jdJz&@
z{i5pq;T!P)1FR-JT1Xn1%$GoQ(M2dHH!GY0aV{nv?hM0JE3_(6yZ^<g#+pF2HhIt1
zADHk!8Vx^1w7=ZoXgRf!+bGRUa_3nv3xC^Ns#yvySltAV3J(nIWFr|)6}U*9oxxmO
ze&hksCq3sBIP6bJ0B6D1ej%!KIsou58M0nGXCtX-jE>oL4jg^NLZl}1ZKQ^NI(Uts
zcD^wthg>z}0B81VjV@)Zi-6!iBLihH7HYlvfAAq-ul$QTk>)7J#XzOl@kc&ny&zr4
zTb7eP$o2p#jx;z^ALa!Z+g0g<j@zczcMip}Oo~(oWdtKJp)HbN(58#Mf1kp4i?5ao
zbBZ+UgAarP1(n%su>oL-P?Y;%6QVSoDya`pkRimrT1$?{|5iVgj|<3*R8D3Z*9%+7
zs>iQP7-}xQ6{aE7YDVU8d^dhBD5J8MWv$OEwJdFKR(q(`W#!4c?Is{hb8>dg^E%{n
zgBmO1pvcrpUtpOAk2`N;sHn(V#ryf49tgJ;^dvyo@d<>NB`m5K24$Z|x~vFQ%{Y<l
zLP;#nyDtacP=mlM^Eu+?f5hEhj-C?qe&2asul8K=TD68y0(*K$)~~oKkDAmFnKUfD
zFTwu(3z4J9c&U`%Ygh~|9AZ;sO)3Pzne|QRldE4{-tGbxRy?cMAhLdgQ(&Lh6vs-a
zu1sWH$?H6s&2)zyx=BL?EqL-DPA2w3YL-Iea8z?G{H^WgXy`Nnkw$7UpmNsJ$fy{s
zOzVHE^~NwGCNGcI;ZTN=w=y>Ej~h?pmYO4?TVp^wRzQ^rW8*Q<BBd~z?P(hU-6oRB
zn~3x%Pb6gOPH1{263kOo+lJUCuVx8MA}z99ebd-f4NWdv$(K?u9Wg$lrTwjsGn|d%
z_3~ldntLT@c|wI?33~Eq<gS@B{3(yuP1j*wiUe&+jhEFf9;Z<4BE7r$@qB}@ZqFlD
zH|!rk{ZN_K`GPs`nwKew@jk8C)jFfW2i6%-PW}!Oo9JSK_USfdn7=>x4Z~YQq}V=}
z5kHnO95m)M3cG}zw0L^#m}apX^cokIo$?45s3ES7*%G<Eh<A({i?4Lg_WtV;86xZ%
z-N4uX-G%D<D@xrQt~Z0W;4G!CquGW)`^Go)LG)XLdOj-o$g|9TNc^;k`>V&+KH&qN
z&`<kUotd8XOfppx5vI%(G0>ouHHEcm3L^tTK`N8tP1fX%X1f{`;aoVhS^tSZKZSJR
zF-tBZV$Y(McU8ZZOeT2db~0|Z7(<5YZ5eysbq>4wLimN*CsPg<tsXk~fLKX#acuwK
zpwVkGA+qr(?Vb(29BHMCr$Nb`Rc}WyW8(0WbB(JQrTV;*HYcg|dp(jimt%Q@4r%`?
zVbp*p2shTL=zxX6)(%GU?+x=1lwSFu$|pWvtAzrAtb{+HX8K=lzgqXE2avYoS&fg!
z2a=9wfBXviK>OV8kPj%nZ@2or)KG{3w}ThFh+x^<HLPYU;8F^G7(!Cc>1B|XWk1f_
z-pk*s+1phRd-G5tZ`2vzjJj344prSlVT+HeB)KQ`4oTc@&!x9nX7#}57i6?EYVWlx
z=!8~EFZL;?jtz*XlltvybK<*Cb_9BRarbl_--%Jm)@hkla)HE%o<&v(s8zI1$Xy`P
z32-t@Vx<!M5dDQtHA!_l^;FY!)jy`X?d3|kyp9~n0ZLW&DJeHg5#06<rZe@qMqq&R
z!Q5eBbw(4*6tEfbZ%EW%%@I;@*t#L*0&Xkdv@yOf{{svvgybLzV1!xx5wU}(_q+K!
zH5+Q}nw;sl4l5{Kt}Pz=OCo*v`2FtQ%;?AP-Ss6$X0#&HVFFx~#mUq7`M7uyIPQdR
zi(QDjS;{=_3f8hT{?Ph>xaP?LW6D%kOt8bOL->{4{yq(T<^7Tr1s9jE1TU0A;%UQ+
zXjq8zN(yxy_tFh%>JiP}EJ1ZW#5*gv5$NS+UU(hLGQjOX3oqX53N-H^qwVsb=md}B
zwF~@S**OmZtLp`dh%3tsmpOyw*a6@KZIKb;lM3I%3bdW=5p903)lUzN%T3TleGgY;
zGvk1@<j;omo&>gOQdH|x(mUQzX~`Im3v^}8@0|9Mx18dC6O8D?!;Jj&CzGU9ft^eT
z-#B-CvE)db{4}*rE{kGa;$hVL8BPE`l_KE6%Ne!jNQEf;-$y9WrShcH*ax??&Xl{Y
zTy$}bw{kBPu<_c48{p?mCUZ}gO8TS@ZM<P&XkQ=p|Gu=P_yXv_E<9dEy{@8iaNlbG
z8oyp;QQ#$>&Ju%pfHt+ekk{}2Zu|a~N%UIzN*5QUO$jrn%1kFen#CMJ@q$vFF_cOG
zQmd<Cq=-*5q`*kc&01zObh5=W>QDlqkJqZGGDIDyawI71<jnFOAh~d`3ooK@YYhac
z3KIhW!4FZiD+?QHF!wiPy@<3-Z0L8;>S#n;;9zK*q8g&ZiPlD(1CVS$c<=y{GEwed
z&Fbb1$?ap7RLU&hL<%hq9@)e``(STuhANJg|8ALBAJbEBtsH?UnQ#+gA2il46(oLd
zP15OJ?wUvdplr%O>RuHG|M~Ea<UCRf_enS?quk6q&n5^T9+7f$*H1)NJd4ZCRLyMh
zKSp}KLQV0O8K>06QC@M5=A-Uhm|$3&P>aKWKmB+8`qYk`Gm@Ilw^b+VUC6pX-|gLH
zEH?f{f)N@{wG@pTvzsh3IrMbhs2YU+fSC`?)QOBHm^_k?BpoJt!CSIM6~a!L@ByTl
zol}qmC%wj4FZ`KQ0TA854{nb-4yt2AN_5jD-1S%#;Gggvy}A+vtc}WwS}>w#QpIop
z+HS1l2;rGFPxGz5P>jTcGs;N;PW6XBayS9v`ey+j#|~t$oNWUaX3rr?O6$fVu?asa
zg-YroT+T)unYk3BEd&_QX^5u}iEf6O#_rQHx$EH;8SN?n0kq8aBEONDz-?6SHTaIp
zCz9%0Ahm~2Klyln&?|YK$J>g<Sd5oF<+{ZqrZ~K5evO_u5of?!eA#~4jZKpa!sN(1
zBGGE+6oU?o$I|%>v6_zLCU7KwDJL-IB0xrJysEMQHV0248@#r)KdLx8rlArEax?uW
zIiAfpqxkvo>&cOEAS}$+o|~K<g0U<Xb+{?Zq?41lpV?f90&c{BgKzmyNXF!Cr<eb2
ze@t1R%UDTpEIe<A`;<n(?-E-qUL908B@|U0J;H%?8FV6)j2;}mQU;<iAb}zg+ba7D
zTKhuuA|4+@@;y$QJG4n@6S#)oFJD>sC2<S{Fs`+EKH>-&0g?BsJV$pEiAJFL)g$v3
zOk>m>bqPNA_Q_??6eoebFtil`@!=`JKVRi-8Wis7za^slfge2lZ1Qm2FG1y=()V%y
zYfSkcO&2*@da{ukWkrOEL1y75Dd=dCJJv2=aU*2+GBm6|P&(>8f?Hj)*kDOwbkxSL
zsrv!Ex3fA63MQCl;5#;uX12)#z^%(baFpYUzjiKXDem?wfeZ#_0~nr0b<><s8Wz7a
z;ahxghvytp;<*_<KK6HaS(Fdmds}2KFgAolYQ~zt`zVdCv;>(?(3%6m$>@;bWIVSx
z^b{tv@}JXsa|;;_SnLsG<N3eBX7TMy{eGH7r1j_8K#Jx*<exPwG7kb|sGcxnU|DD_
z#7q;6S;VpB)C<J1rg9CJ<qmJ``!zB0ez_vNFRXQrY4+%Z?t$(We;LC|?B|`)$CR)T
zxdS17J)Wl-o?go0Z<@K_d<ys2kGp3vL8r)1zN#H?7nxUpDK~$TWrp&1<sl##VZadH
zVYGY)Rk<WN78-=#I9YeLep_sE2M+TzwyGNc+JkdMp8}ve)GZj{-9*_owFl1kv+h`5
zX0H<Ci7QcfLI*~w9|Lzgh#@SYB{`h=E8SzU?i~~CCe4eoVj7^&4C83%60^K;n5XyS
zpo}uX$+2Qiy-4=7`D9w0^2Ys`A`P_9!{pPBRblJaCt`+PExnj{?_0d6%Lz{-9<=m|
zc+*Y6CLEwu39+SYL4S^Mf^En8{?#x`*jY}=8$_=ta2)d|wp^Nh;1yeiNAOS>g@oxP
zBQ0tG$`3z`HAcbjMsNq&**Jk0w+H930lAs{0l8!Y7eI(sUARiY03FHQuXa9~AGDh+
zmSdaq5OwlFs9_~Ne$*pv$?1~ugAPe5sB=wBf7IXJbXm($lOoHM8j%<TFi`%bGWPs6
z&L-x4E002wbeqh%=dd<!gS_ai=%mP$|D0ehMTa2C3WocMrfn~;!Rdw7HC0Hu+60u+
z@$d$I7y|K&opDExKtnB}HrJvMOm)C?Kwfk!u2od1>o1Cq8XBmoP^dF%(l56R>l`Z_
zef5*5Svv}5#6!M<q(O!{ho3P$$h*@`<yA(2>?5{xP#Hzp5eiTHgQ+nM;u5A`nyC+&
zfqMp;yVNTawEK-_I0XobioEa`jvIb>TtH1f0DZ+m@XlB0TY`;RnNLDI_WW1SGdBFz
zkSjL)gauhQWBkcYKf#pl-!xbETOk@#p`{c=Xpp?c;_@`39sL<;)CqCEK3ag1YrU-c
z_SVb2=9Wm4#aM0~tyyh$)`_|AojS!gp!D&g-E;+bX#h7-d8F&^Lp(InFSWs&?!x{+
zEB5HTmr+4rk53Hq0pC0j{`r?)ju?V|c);ld{P6ZhYoxpyqa6zlKd>ip4xjst<hm-N
zh!U2~tXf7vo@<Rd(o{p%Z|4qx+Q}=Ew5t?fF>z~nuH&Vo+;C2NGBSw;LBp#j=UdD{
zo*_!9u<f?CaMu9jZJ3@i$2h9Mal%VKPk8s5D(q!`yaEAR^2WNk8Cdc*DdtUCrVl|C
zy(auF*+CMcjE=ak00aLv)=UN8@_DIoo%Xv!FFjuU3DX`(e*7h1Z(HO}d1F+QUYC(n
zgPu%qmiYA#7I7oO=|A92^racR3o%@=I%crbxB(yLPc@~Imn2|4EvKB9=gs0%$MXf{
z@Il{;X%ola=sbDxJt)!Q$`_?S6bu!oVygGg7&WGaXiafx2UuwJ27o;qlX*2Kb7@T7
z`P(2dF150aKN|@PQhuhAe=iz#v@jczL8nwMP1)fyL)I6TmO^j;&&}3qww?slMVe|V
zMu1*Zuw{%{)oY`U*n&$nLgT|uDG;eXh4O=DFeaw5JOXA)>53_yfC-x{mKv)(VJYyN
ztm10HVvb_#WZW}gvY8O-ePp6zU{!2|(`WNcW^a>V!IhqBktFzxj?eSoC}c8G>9H{+
z<UF;^<y96=i?+}jEXWe*r{x}{^UovuAk{%PMU}dGrxB&WElsm*(Wq3&-s^_vqkeZu
z>zB-;rOi&5U*GT58Mv0ED19-}ngT6^E2dhhfH#r`-gsb-%QO#kZIs3s|9|ka_4Mas
zBQaguv{7_*)6!FBvb0;a3{P?Qo!+vD>ZXvr^n<%Nno7!Eq!m%qp5lD6yFG%;8Y;oi
z3WT~AmO_|FlsHOBHAbJ9tJyk4T*a`Fn|eizir@yDjb3lu?Bm!y(Iy>5nMo`Q2n;N?
zxG7L^doIO+X-ZYlmWVC9UCS8$%O>R{t8rL~TU99+G1g*MAH25RbG5nNXOy;r`c6DL
z<@`(|KnKawIt)01l+a6)l#s{|57v3EuB3Pv-9^(okJST;T(K)o{Ib*Ox;bZyPD1{0
z&>%@E36TjX)`|SyUbIBb8B4QB7O*CfOBWS@`mxC+qPAFo7F6JMk{y7NgcobhR~STo
z8o;bo^As+9BPt9Ubupl?#DN%Q2<Q#NQNP)!0|0^aq}=~7;Y)a}KmKmM^o=<JPJyv&
zdeYSgiyjL3!IckOgOKMpM>^*rY4yGkRajz*mQ;xQuES=scS|pkF*=5n>2mf8G8Vf0
z6%sdvmxp2<D%aVqa#>7oGa8SUFhqlnNI?jZa7bkyR|9%qZ;}qMOacN!>)IaH)4O}&
z|B&L^Y>bgKcBBh&O^3o#{8C}4N&wy?u~%lEVc$%{j^{XGswgAf&|h@YTk}jNeJGb^
zH&JBXo=<(_!&8I_aV0TlPg!dY`hvPX18YYB)^`A%g1F)D4aPVNmWX=8o?>a&%C-t|
z-7ZrNnm$9Sz1y6P&Wct%dIx%at+c@7#>y7sD4%}?a+dEon`pp}nV}w;TT4i{RUoW-
zW@&<&YXb$`J^{TI(UI4(M()!E63;>5%y_@ZCBmkr`P0|3KIYYhsgqxKXW)<rLk~R2
zF<O?Hm0ZVdz;U%yaQQfFwg)=Y%$F66fH%@_MG!G7Y#cYpKND4q5LsM)yHS<(y(3Ny
z`HdQlUbT(VFFt}4e_hDruM!ZzlzG`}PZa>_hn$U~ejjSm=aH%zknR*Xfo(yui_LQP
z$0w3K<Ich4m{PcSKZqdF?i|)_C1JDY8akr|)6p!0GHH7<%1j97S9kMIdjGExnUvAQ
zFp#cXv9GdCLp`jhoo!f|p`fc&Y^o^5QzKlBxC#8=jC2Cn@M+R@LrjSojUG90-B62k
ztsl?2cYF-E@;YYK#m-`h43W!hV5S*Bf5nZ6Of$ec<guMfOsbUU#K*$$-Q?j4*TDZB
z#BsazD^?$ib+`a~g(4$$Yl(53WGrEBaC7i+`na}-6`jU$-(XOpaRYPZoOp4CX+hSx
z*kRJ$h6+L*q{=*O-lNk!e6(6^+D#9Hm*+z?6cST;Zl+Rcaw#t(4~9v!s(gct!<ksc
zpVMzp6nHN1JR#D@p-Bz}F8tE<J~C=MW=8Jl2zC+*hfHe-@0hUL>hTRF)FEu9uwpc1
zATWNtb^!Dxcik9jlHB|*o&33c95rDuekC6<&K(X%r$L%R`&R-D<%>Lp*2rsSx+;=Z
z9^uX-4^dl5l#pz4{Aa9v{cfYLZ-x7QdOGX-Li+QpZ`<4B^?C?-88g@S?L|!dqv8KM
z9EtVkvc<XXdq0fI*#iafpsVjWdjH(_N_1i@_X~u&2@-&v#tv(Y9B{wz;94CS;`FMk
z9ihN=tFCs&5n<ZQ*OFP!%Z1{h1uM%PWEmxk_*W~~{;1yez_^QQ8^X|nA7}>DC@?U!
zQ4ndd<B=$JV9I5RK|ev4RoDCd{qZz|o)@&pM=R)L)q^+Rwhkg$9DfAPE~%-UD48vu
z=lk*P+1w$FYZp<XngD!)O_;1C(ATY8@7DKoIfb5QjNi8v5&9sT&*9;ewIeKnLAn@B
z2b3tIwaP3R3e}PNobaxadZVn@*5(|GZ0>h5at#IUqBDVLdkw2SjDW>rIvq_?#-wc`
zZMP^D&h>0ejC?g#YRD<yuEari2gAT;nsF}`Lc@fPRC1y;e8>Mga>#-nL9K=5k#x_a
zV1<H?CFcEO46H#yx{-2T(~!;w)K8S)%=6DQ)eZLnT1VF=pdHk1KXsVt<MC*Q@{58o
z_Ots^9zZ+}VL$xs6msW0_UylM`(GKigpofNljqd_PkM92lN(+_?EmS}FLyrXKk?*|
zyA=JWlOk+J!I>crq@8U5oFDEZ?1CLOT#~LJLB^S@q(h>IVR1{%LNl!)X5TDRtJjk-
zM&*$u!^qU!uzHn>-jw#>LVZ3F5096S`gJUH2<hWwfyE>hsMX<b&v1LV2tLw0J{$xN
zC`q<O9yvbwhQU_0%5aEfERFG;7-6%3?BTnrW+|2GfcBVb%)E8qP0cF99Bt*K6y1K`
z27n=Hyr3XAGXya!a(6QHu%(t9`h}v{w3<MkLt-4ESD#B(Rdus5&Jt?8>>*H_(Xq<Q
zkazQ-#Kijy6Xj_VqMuYR#llcYibTnlFb^ZwIDUA?x`bkW_NWN++}LY=f#31aNzs=T
zXO<M0_jPd1Vd~kaK@3}!vHRby9_|~&tu{CuZ&2VP8x|1x7(({@yPUHHj+ru730rjO
zmEXswmd>421x&K@;!P^nAML9ZBPV?12DwO<x-G3%)Lrz+nu+E=M2_!O<pPp@@!!hR
zL8#I-ia$nLIs5I!GU0H|O#9UJAN-Ga$u@(BL!1^OCNQ-#$BB<o6sIbmA3K%yI9x@h
zL+Ks)NH^7&hF0)W&$dwxI93s**KyZkBarTXL!Xg(=4QFhL{AF*0=eV?*$zB#;Aaib
z;oC`Ff+%5IFU3A^{QmjLw|vw(FGCgn>WL%`fdN_(%t$+vfprOi;YhmC<a7s~Yoy_X
zlQ9SLq}LO!$fn7StAjen)CtV`cqdrs$sZQ^P7>98bYW7(@)2G&euR#xol66jr1eMU
z!M=o$?qTF9x?kCyvK-PXqis`i@DUFj?_~fJcxRb&_>^Kx!7E2Iwf;c$|6UaVbs1-K
zjKziClD#7$sdH8w!2-p1`S1(z{czz03>?}DeY7ihF?Np|NY;t4dt@Fs2GVByDq|s^
zh2aZLSei`wDnoLCTx-2D8sbbJ&Le-SOuaZIl8J(D>a2V{x&^6=%g4Be5&?(-Iil+l
z3F~?k4g764fr;)bV9q)D@hzLHF#VUNW;3hPSk!a5VpxNf3NFa(`D4RGQGI1SZN4BY
zW~<Q7WBYdd#M6fqYc=DsRrx4U3uFSl6*KbzV-`43Q^oVpaFZ_UjOg5CzYghgvx}3`
z76kQVrK!*Qc1WEJTdE_`mr|Wmtf|DN>e*(0@N~v7>~(vh*%Gflon@xl@l@aQx<mh7
z3x^oZKuRFC(@*<JrEdPi2sIP^ZF|4El&H8Wj+#%j>d52)tkgsflp3E~tPG3hSRfPR
zSpSaKU0!CZ%9u!dqw6nlO-9-dMcU%yU*Goep2vjcWuvP@AOWGPu5rc;dXv&8Vh4UW
z>q$E{+L6B)V88zOXlrRam`TvX7QrKMa#f!@qtFK+2EHE~wzsOZXMB7sv3ckmQ{u>&
z2YH=?RrqPRV4`S_esGP4ycy`eK*zZl@)q#`+jznoJPYyk4{k(N!?$st!Ihxls3o;5
zlKW+^aP=}Aic6{Emo=Pe_(F1#O48=fIwhpHQLxqwRX!1X9UF@rnjpcSKg{PW;wF6C
zfntp)%XC+%a<!YZt*aA)btFC*oFh&IFfx*U7e;p932jkin#H+P2^$gn7%vVME}%U`
z)8YlZGBlXOBe}Lldo+z9SfbH{dURZ&#nnAFVN5PWgc+M-p9-0ch7t(nfj|?noQhAr
zsac&7udH9lmO#*KO{>Em(s26pQ7PxK?6JJPoD4y#T^Y#`nO4_YM{gP$XFDYgkp5`p
z6;sfM)*j%s_Q=0@w#~@Hz9nq^9GC0I>2&N`$%Oo#3gl?8F0DSo`uAwd{3C>k)Y3>W
zCy1Q&N2@zz*b()sY7JMDZM;d*DU!g4KK31|tFxgJ_+ZUqc!d`6hR#&(LS*ICj#N+L
zTD%i`Y#jW?R3O}>#Bv)M?`+hp)BVa`fG?8$w#!23Zu1gDwymhRP0b{&Y{CyowCI3R
z1?p6UL2XD#E;5eg^_r+k2D+(ca2wE;qfRoO#WE-NQa13fxbGDbk`-_0vU)GBn)#RO
z(n79ld)w4rtERdk7@My=`%pU5jQ;a<u8Ni?3i;E(D?|NlzkJtMa9?OyJFO-{;goeH
zrQ?HM9ZUPf`nd{>E#M5v;q{RKIj+g7&rZBTN?IufmDVkI&AS?plPv&Lh7!u%UOyV;
zXkJ4J0+|?K>yZbPv73-aJX9+F<W1^ZAze>TExtFRstTio3`{OjC`E#uDAC%fnW%)o
zCb-IbDv=t=bR5&(NGjQ$W{RuEMp-I~uTnd&Y~*EC7sQ8nlTHchPu$#ZeN3o2YIB!S
zfCVC%%q-#h4^I>&^;}Kv&PsCe#&*s1sp*7c$R9MrNdwOg?BvlLDN}UXSxKf8^Ni#|
z)^%$Jl-S&ZhPr-MqnxaYFM-WJlK(M=t2i3Q$Ezq4x_+)2|J_Vefc>_$28=*XxWw;&
z|CZ|9F+>6)7*pjZvdw~rMie=Xm9tECju?)$q$N4{N^n>U_CgAFKFD`IMao0Mc@h`*
z53v%1)}rD&<dpkg4FTy81MPP@{;dYSo?-s9c$xGue1qAe^r;%WftGfB9zD~hig(+|
z^n!~YdgHu%TMO=Jv#;)AA-)bez6c@z{3Ly&bEjJmPH7WK?Ml@@q{f7!52yYlfPXXG
z@i0R1!IcC4`>qX9?5Y%4uT=;;<+AZAE$e8N4SB+oRLwTW!Pb^N1au6$2rL+-W?bJt
z@<jN#Hsh%ul(d3j%5en0`>Nrf_<6V-%5zbF0}-ew@wg^bkbjV=k~8)BR%93|qevfZ
z@<53uN}TMaeb*uYE#+u|cE&1g^maMl&Y}d?csaFXn@pqiN}?lFUc*2+kn58dWO&Le
zBS`;G9dn0*4Dc77e0i})-BI6pL}pkGg|wW|>$Bke&*Ga5PNxV;ODyt#jIz-=N>TIH
z5K#Gkt8LxYn9a8#f{ef@gw_RVS`BV}q@}Z1Vjj~gMSihblTt&Aq&hL_(Rt=WXf+8Y
z4t9Yx5fZwTTIZxP1G#wOm_;=(%!cz^Dqg7uH$yX@0}6~<ea>R}1OKXQgfcrj5#^Jf
z-kE4i@g_cfd;8dnArnCnXNCX6dEVCQtysC?=X80QV-X(h*DJ&(**WE?y<B5e(xUXe
zM8d_PlXq8>c`W%jj1oa{8pg<FQXQD)^>)e=qWm{0DWgX3<ubwj_kAp2iVHAb3w76V
zaD#L%>b*)R*~k^UQpbe{gMdZpoRuTI6-sz5>)koQ9EmRinh|ea;EN11xDKiK-BO+;
zce<}2;T?k)wsCIh(N4#0DKrZg31i<qpIxJKYuX&)@)AtF{wF~nzTmTe^!3{<Bsj9F
z!w=`hLH6y&->nW>thE%u;@3<ofy=Q%6g4H89C>(G<{-r#wULlHFj2v}S8X<YIUZiD
zW<q`eiDvZ6z4u&4(WSk;=OyQU-JA?)@a!iUMOfWEzIZrH*$Hsud=oftm*cD^#c)>-
z<84yMSdQZELHJ!PNAo%m{{<7YS%xT!K}@Jfc!=}7sAJ1_Yrxc5#JF#v3d=8xHwp{{
zqg9Xz=t~D=i>$aA-)oX^zp1TZ-+x3x2!Q71b7nn`6)*qCHg3lkOORaBak7`e)p!4u
z<2cl2L6_w<TO&;G**%u&#z8cs+?OBA_ooR;-B(n60p3AXl++tM6B9fWbpPkc70BuL
zd1~CxL0M!O^ziKjj=RI{?k}t!a|h9sdXSWd2=R@_RWCY{=r^){fP6Q*Iwa)&!M!7%
z$^Bx2pHM%Julv)|73B~V?)Q$y^=?2QNY`Jw2~#q#t_aLL9Z$zmJ{_NOT^b@rV)YV5
zQz4t5Vv1ROT3jmALWLK<`I)P69U6C)@jj3NR|a86jYy}P$@R<Vi!Bb{k_sg#Zo(YY
z@Mtdd-p=#?*mCWdY(m(tM65hV(tR6Wf1Agbahj2x5Z-w1+TLz!;M96Hpmc{}G%7)3
zwT6F+C1IxdkWZCsA9fh}i!c7e^=E>2`Vs>ka-CLOvGwP(=l{V0W5|_`6I9<~Gz@9F
zh><9!lPDdJK{bcjWE45!426w?L6d(_{7uyXy>xJHfM4qZL+1>M78zSMa9p&-Vlzsv
z2Z?hu#tuxcO)I_VJ(ZWrgmlj1ON<4CrMXBmn5=8y?tKe3nwA(|(uop;xYfAR?RnA|
z;KIz^?e`d6m)~%`ouO(vQOk?AP7vWx$DccWr%oF7eqe0fqU<uSdKuN_)Wx1NZXBj3
zt~-b8PAz6LvyqRUg@&`dVR7Yb4Zn?1(_QYxqF2g3k)7Pi4RF5r_HSp8qvIgj-1m0A
zD(p?OO*X2=!<$ZPjE+6enTh6Xqe48lu(|jG4`$AFVwj-wwQ<X}z;n{423cX25i6{2
z<Asi0a@nvsTeK#Q>7hK<PPXX=>pBtq_MuV3qdnf*jpKy9EE~upHX1_sM$gVr_mt0<
zZ9u7uOt~EHp1o7@i7#hA;iyRF04I7VOk?7TK}!gKLuDo4j*hWl8XHyO8jB9zziLSJ
zB^8wU{Y7%qp%{k_$71|ZoN`o=4co&%*pd%h_j~oPKi;=DKAIEvyefa!0jCKVAO@N~
zty&@(1O-pE7adT{$2f`eia+ABZ@uhzR=-0IYK0Z402B!;LYDci=!;6!K@E45l;#tX
zOWzd-*U4b&c29eW9gaCiA*=n`BqZ^&QKY}&wVJ5o39xR$JGy(>F;d!X%@0R9wE#nl
zu+5GkU1f1RKyyj;Uwp_0#rQPMc|hE~q6Hd(+AXwT!k?}~@!AVDz*TL?d$j-!PcKa6
zStY3&!0gV`iL$YBR;5$ZAF!ILo&ZxdFE1_G!9S*$LTC#`{E^$S<%V!4|1nKrR0)>=
zxk|I)ATEboor*YDR27mDMC^0m7~!b+s3EqB(I+M#<)kQOmJxD{v!Zl@tn)L7>XYD6
zJvU_kPud;Xgg`E+q)ZFW1*Y<<&11UBd8j@apwN;qR?WdWR-NR!5doN<<rw0!W!-9;
zcl4sKb(pQ2&YadNW41z(P{u9?TXx&9CZM3?67?6Q_+O@jdaD=xzof)?7&j9@o}6*I
zQ!8S$7C3|$^as#<uxVSy-cnu*ci*^g%~(I}m4?46BK)B0oteewz{(c2i3H=E8YV1X
zGkNHN`9{a^G7DEp-3gi&|BhrGW5Fvr?R<8ZeAbujk*teJkrih*{R!$^d%(Qwl6cp$
z1=f>WI<ms?#1m1`8%A7Y4QgC8YVE0UFH>+N7nhrRcFqJHY4?rY2~wEKG#;gSYtn8+
zd!&stENKu!q^SVcl5X%S9Z19#bTtH>uN<d2ADE`D>c$vJpHJaJD@tJglY-48YEwL*
zvV7y5XpRThc;!@Xj#PdcTh(raE7oA5AFe`c?IfN6HPDL7p4*?$((b<7caIHP1Zco3
zzJB+PnMip-^$pwjICr(uDc~g6b;RRtxFWvnF$|Il69X!M&2bMO4Hg2gV?*^YN6RQ4
zUVQ~(B>2epw@l1C9lP+5`C~FP!YT6IVt(f70Ec-8M86vUW2poCMN+}1^vPOQo+q@<
zbr%sZ<$|Ahk>kQj`nRm_JelP%N4pp=nP-<;%&DY9rRU~F-c^Y%w@FFZtGz8t>s&hK
zuz30=tyI9mP+3u96&c}}-(j9{f|mIS*=)Ri>dDIa2_(OeJa&GTkj;+I>VW_hMLGZE
zV*vvodE<>^02M!>VO0DC&{%NQKQlKLDiD(c*wjC@DfnN67Y3|qSJgeYzmxQRs~L~3
zC$k0}Otllt4H!jR((4Fr7~bXDXs`i)ZFIacZEWVZahPuyu$Kk{(;^kc8g0;b8_N(P
zJt^Pw^~I9s%vQcmZdPW9dfVtl$+NYnF-ByQ%HNs7_91N&Gm_Yx<J1>xq<G2bEFbMR
z=G~-@a2J&}mlegubfWQ+(6{VLUuiyob!Ht<!Y+|Gg=__aPesEj!r@50h6d|swX_%K
z41tTt;?{@)G|P48QaE*JQg6&Gc?~O!(if>4-a1W(LsIm4FvutfvZ}T5c<vfHwIe=j
zvy}nG=91qSaR|}f(pJ>-XSF+46E!NCWB5Zoh4$3dM&fEZwTx(1Y~)0SnolvYsg&$u
z(qP#>Neo9^4`;}N>LzjYe&uHFmFR&O!N(NNBQCi{2Ez$87xOSbDuzvSPc%y68p~#%
zk;#<PrUfE?Q~kqWygEg6cnDuXNp`L>!h-SvMtNQ&SF2-_)Vvk%%aM|2nD&PL4?5Ko
zj(@-57@y=aAw-H4SL}4^oXtpH${+FYe4AIG6;`7ZclHna1!x4y7x`mH%<8ojazqGw
zHCm^J=}6E+9Zv&8;x+A9P1B*Ax;h3azcw~1bzz@n#c7;Ha3FCgZZkcZ`JJAT{CUS<
zNJ2@^QVOCXLz$Z&q>O$-PeM9s&9>DTomT?k1pbppZ&N8e<fx0kLT<tlL>(G!^jY_(
zA_qR7fi{LgG>W85P|*&HKPF<l7IyB`V}ma#>u+2|FScK7@3<ZCLy2=5#8uLnv#U5(
zN3_JBBb@Dy{P%_Y_p|6{$6rTB@IU*%_#ek#cU7pEEbmUIc~@X)6EXHi05og>50UsP
zyq?g~z4$LT*@oL8Fc^%9m)3SRY5H5y6?r?x@dX=;cL((}&TxR6pLKV(Fn`y6-KopV
zv>;G*nd#<^V+3D&d0xy}p2o`1Y%r<?2e%jxQ|xOuzqyKUG!s+e9y%qW^Yjei*)Z!E
zQDGce7=_>vPfAs`Id=?#kfXG5SU;=C@5CB9U(+TK>QcGOb{Jk%IW;AU#M4>mggNQw
zEF5bdwX$na_h3ct#B;cHo0)o0%{^S17^A)n^fh!L+Kb`XW;NUlXdrEA?^-1C7P*T-
zHEpuN4RRlAU6qHd<aczK!noDpf-4y}-SzI@&4(t=GjJ6W4Cf##;u(3n%dqv}S`7@e
z6BFi}#1CMBY|ZT)r^V+A^8`Ci^IK>q73TtFi?jyycQi)a9&S?DAA9`@(F?tZ^>Ac3
zLY`)PUk;2zmXJB{cvQr1t&<~LL|48~Opg_&CM=<9Zn0xXG#xWDc3@#N{_on{S{sfV
zlBc7}6Cwb?P1IZ``TUDj$we>R<f5euGyGp?8QC0^x##1HO|xoS6n8bluu!bFLSGyy
zT*SdD1z`mlTStYLH@Bg+#Fi02i4bn*7No8iQRNU+4ArHmLh?`slFv3j1JULA7M`Y@
zk1mmjEx@6WA{a#VIjUy3PmWw8mBI-vvFhQkb<B3(9gScs>l=n!Sk?9ZZl)*en#Zt`
zE5TSIT2k;!){nOB%zURV=`zrFr%0gsK9kdmbkGxgdE$SrsX~7)@}hjn!akv-nmhB>
zVGDl+HZ?TGt*qPK@p|Y+hh$%Rd0$W33Pr^#hMK|OH30W8EPaRDx0HZJm9u7l{FW9C
z_5t^Q=@FJV!xM^(T0JS-{oF~&I4Bis+9pV+-c~`hObf_pi)k&R!;tlYjK;`*@gvOB
zr5Dj4%vPwjZPcmTb1DgAg8n)UDhwfcwV)0}zG8yrQLT!i)xN)8UHJZq>B6onQjB<^
z+4kKdnitiVl3QbO-<W!Ou8w3Bw;1|nV5(Jc^jluR7Y5%+*i*$Ab#B3g{CsCx<HAUk
z^}?O~kt-B!oK6Q9Nv+(1C6`ix(*Uv!VuY$3bvMJ`NSO}N7lIvf>&~NPKou+}!bQbt
zh*ng3D#)cAuI{%OyIECqkSnQ9W{jKMo%~y>Ht~&?B(>nMSgugVto>Qpf|IXX+|z9m
zN$-rpT3Y0~(ZohY6f%Si+K_r!@1%T;o*W5qaqYW;`LKhcVY_qPN^=w_7^)GFTC(^E
z=9`a}&2DCFYO7*8v+7{;3Z($pShx%4c);?f=&DQD%g5$7M`J^x?oFdYyWTnt^)%X4
z-mj=mvP_|qDvJPWCg`kHZ@bzCyHV40Ik$1UVR4ePr{X5c3NF&@8q9@g%V+5&Ug0zL
z(0R5_wlAM2*#w~!r-Q^J4x@5Zb1)XxGH_6)mc9-)8nm*(MU-=YK?G<BIgmn?!BmhN
z_;FPcFQoe}hCj}7icJ}*s9RD>X$?ewbLwnEl)McxY8Bph*yHi?e73#g>g8F~nsG$`
z(=M6F$29}D!yLY%*QRljUA#7~t^t}UIafa0vK&00p>J#x*Y3p@uA=3Zd11L_^e<)9
zjzHa(V}^oBsp`yCQ4S>$Mu>!FR@GwWNXJUJVaRpOUEI`ZGI)}k2{`emXz={hYVz@1
zWbW{SVyeCOJxdP1_uZLG^qyZVHCxD`u?vs^Z(kYr+x#`Ovsa8KK)rcwL19M&pgcHQ
zKe4|;1ruSnWPRiJ#gc~6cV&@96QH3x-G93po<VW%*YP<1drD!(jC3P;?5|12t*DRy
zLD4dr=<SWWWiBMwa5e3gXUoXC@&qxsFU+M(xQO{Z{WiAtSblSC3--+j6fu?R=9_6Y
zcXs8T3^K^#)Fnp9U&`F0mMP%M6sDqlU%g%(Rfr4kS4?v2sjv9QE&>&&A*--LRc=|L
zN)xvrE~`YwFqtHnvP(rQU9Ro@8<<x*Q2V)?DQU0~(B(S}3@ICrr!}59xM1q$4VkcT
zq$lZMwsZ~!n@gp%9j0nAE)Pbhq1FyNcT^1fxOt7YolL2|NlQNUT0*0>2??3JV=7tD
zRF`N>8>2Gk5Uo3?9;-&^>$oEH;bxvT7dklP8(%a5%?dPHj&oNjN%L^^TSvojkp6|C
z{xMA|CwLKjLO1G|yJ^(D8=&!oFTGfeL)o!R(QW2>?ujfQ*-9casVp@)8C1YBH^#M`
zht|$mS<lWL(Fr%WyShw{%w$D7<_Ajc010iz;22Nu6HYoCOp4+67fx~Xj-$UVUKKjJ
z=eJopPVY+$$0sy*#TiV`A4<;~NN<8Ax=J{+|GW9u-~8O&`qSp-_s_e(`{6g6f9=sf
zKHd7$*3asX-)wEc_pjf6b8>X>L%Q|z_xW^u!GHa{`F(QmgJUCGTYvhs!{8Q%?(*kK
zZ)opZLYxZUjj8kl9_Y4MSNQ~)c~+-lSl=nTeYP3ByQ@3y8UbS4@rXLZ%LBK1ItKri
z$3U*-nS&s4gm)bTbrHFo1h|uRPjEvP5**Jrzb0%7LbdBg${|g~3xGbwYhB;Oz=t^u
zz{1y|l)4lxg{Yg+Ve2Z*hS8nOSS5mnA#Y_kzmSvf^rDM}gsUChWhCJ;jCYJ?KzUlD
z>ZQQ_++|IikYosSw>unS79`>--pPi#(P55fKF$u0?tJaw+Ud1Fi`&f2DzqnC%YKO0
zyjW5YTR||#f;6ROhMcyfpfa3WClaF&&_35?Qp>fdl}0bSyCvjarn2`9w)v{xsCvO2
zNwp|C^|BE6G<L_?spIOR+Kz|FsnB-Y6&o(S3m@w<m2|oHF86--2}*#$-@O`L2NK1%
z)Y>|n!Fw++Z<2R9bj~Nk`D{3y4j!EkNxd)Gv8C{AnrDSV<*aqFE8+@o!W$;XLaGii
zV=Bi0S}}{$vF6{=Q@pz=CmYWF^ya*#9^2`$p?0hL@A}To-v6$%;07oBkk&HVS%UfZ
zc73tBgB>~CgU}vUm0jo_lnN_U`7U}>#KW)IU39xBe9K)!VF7SVPLe#%>pk`x9HHC5
zhI_l76xChwo8v74uk?4{E%z4DGqDOL^{2G{k(_p}X=z+0u&Ld6lHwYoD-Q=gq9}>`
z<U`;VqiLq{5a%oz$em|}sXHp`hOur4aTZ6f{%8LkdywDlo-BbYEZO5R%&R^V*5T1o
zcL@%;Y1m*xP_e0Z{Ybux;LH2Cu0ZhYf!K_{giU8$XA2@26@g}lc9B_%`GR}@zK$4p
zIMK)&lxALmN|AJwkBpj)r*$!oDe8_(DH5ars3+QxsAji!xPSck_8eNlGqTLxZeuo+
zJWET~I4o*cN{r|tA0&GkVYLr=P;Pb!#z{AE*JD%CP(-~YdevO2WbvRHRj7=FtENU3
zw=_>`PI!rU?aIUY=nAm;TOjOJq)9cZ;f1bb6n(3?I+j$<6NMB>QJp7m`rG~fn`i>N
zRiA^Tes)f37DtBY&1AaHK)VpSA1KYubuXProu=&yr?mcUoZTV8_*jh0ot8$$sIJ22
zZO=>fvjD*nf4qg)QIjMlV03HaZh`$YrIz=M)Dodgb$`Dg9luHPv-<o#@faUx8gO$m
zb@j3>ZfT05%#wFm{`0uKIJ*Oc#D*zN@1`wFD=C|8iY&}k)@|k<X5(|oG-ijF#40Gd
zPh9F|cFJ_c;Z2Hw5(MIbg+j5y1&&Ka@s};LsFSJl6}iAoiEHwT;<~dSt(a&eqO^qO
zS6Yge6Vn{82v-k9{`fT1#7j*3b-if25$Giq2rEq;jzt4IR>Wa-%V|ccX*P=f@CU3P
z)Q5k1kXoPPmg4-(<(3F=qutUM`Uzm22NF$mcodcVxvsty4}c0>!Z&A#nQE#l3TcJ|
zF+(@d$M;${@KM%Q8Q~@z6BOztnRLqpEvYIcs5{W;1v%G|R!Pmtl2NVV6Rcm0)`1;F
zaKnyJ)F4#@i!Yef+kD=m|7|~af*9eok;o>FQbCz$M9{aqKXmwHGDWm|bQrM$O|S(r
zIHz4IA}u3{DTD=tDj7`66tt|#v?NyRGH_k;>z^AtzkAW!`SPpY4$S%mRlMI(i}2OP
zzwT|zIg~1(Uhn<3CdaE!Rn}!fT&B`yoeov<j<scd6HLma%W?e1@nHNCarEKv=sp7q
zCOZ&<9xK<{hJ_@D=Gh~-8SdV7&kDq@YR_XRIxb^&5$_+-a8K?naHh<eZgxukg+;l_
zd_r_05YWa4E#?cjNb7S<&tONfjBQ~L&K}zj?)7CT+P&vB=LK-uE2n+(7fx;wN*Z@I
z-f=BKj;xyVrDquD9kXS@<=Ou^kE=}-UwX6R{Z{nz&(U2k^lp=6=$D&S`co3{Q;?&c
z<L~L0Hn)N=o;|bY`s~@(Gv5W(Qr@FoNE+dm>k0%eKofryPVY3we_&KBm!`jW#xsNa
zKQOq)*oX*3B);d(|NPJSlWn|p?=sR0cYY83cy0rX0)L^V;q;?h)~-y>5aIHU<af=p
z)vLXWuh6CL=3cr}*mw^zV~H`#Dp7?3R&+-iSZ;y<uPR}JvRhCgx-;b@ivA1&h8Xiy
z`U>Mt#%b9-izgFkJIOE8vY=$d+naLWz&g##G401TetTs2aMhpC6dy;=oZ5y%T;TgH
z+<v0vVcw_@s52;MH=p9VC?}#xBx>&F7xz*EKHp(ad7-M?G5)KRNX6ebJwtc5=4?N3
zl(Qaj;u8(+Ly=9#$y<!-TY5z-t8Gh^izA95q&lex$G~q9xlo?2bB2RY`U!P;6vMVU
zXnr9n4cNAtLzCz+1ze-QT=Ha%&wb2At9nuN7TAJQS9p&~^U<@H&z6p3z-tAI8=uih
zUe%Jd`!Q9!7{-9UXCZVVZ>cKg%0lnd4_q?VZU`u{r2NJ=&^{JH_rT}V<r3evCh$(s
zD(>ep>S^YT5dt}E>P~OR2QTm#4Js8}AIC{Nd{6nEI&J%KbfgmW3qnCSU@Y?4!D~oC
zngt7J%D3w@7O8w`hwEZfPIf6jpen~SvSxKYT<KO`*gMG!Q#@$tBQ0e^RtEYi74NX0
zuFCAi!0--#bX5Y=wnCjZM{!oQH`fuH*e**;&A6}DX;EZ}Ly_6CO~|WSx7ib8YBXM*
zC&U`enhGB>Jo_A&h%3T@o>O+?j-_QEWLoQvon0uHuUH0weTzeVcCBp<>y3$rnWW8{
z6beLI3HzW347%9`s1(!Zd{@LQa?fChwfi(ItkvscJ$3{Wr=gikjaf@#W#!Zi&#A-q
z6g1PF8UOsT>7hCGcK`63<%AQ#2_?WcR>|v_e(zet7Xzir5@GE`u0Bh0Di%x{odP40
zRLHn0a!(k!+erX<*Zo%*|IDdNy6rZh)#m9@wUFoBW??fSp}`JbYXQIFk{WnCxRlgU
zTl%F`O;6V;2#dr^Vw;hJHHki}ZkLI@@1>26Xp>vR!i`1YR%az-^|0dBs#Xx%hJy%X
zF<J9cel57zRXR?yxXcLDug?=E#2d?`0?KyD7(o`Uz^^wy>>mH^-R|3iEfU)kH52yf
zw@2$_p|PLE_c~JZ!40H)PR$R;JDwuQ5X?Kd#*jkb$`6OFqZHPA-*iX>SaM12C&ZL_
z&l6(G6JpAJ&l6(G6Jp8}Vv2d55L2EIQ||uV6I8^bg^GAWOp)gaG3DR+7(5}SJRznm
zf|zpW3%83ZUD~~wk8f>leoJurLDHK+<(}Kh%!d>hKC}*&fW^uu-EQ|+@g)5Ki%zHM
za_3hUX+G4Up1Xqq9*tj(lR6&8b&Mm+tf<&{GHI0t&=Ddpqw+K!-1Zh*RlBD*FI8qJ
z=7D!5l%`9eG+j`|E)gKTdqGJ)x3s0wQ(me-9L)V=>MC#f34hDoUr4A=a?87<->JaA
zSk`0yt60vWTa0|Cq*7ynF@DAE$V)Id^%jp}fDQ6z-MNz`d&VTj#gNw+`DA9Jac_F@
zv_3CNiE@&#vTaQQ#|5ZzAIHXLNsMn3usbrkvdC`RPXDdHqp`Ja_$`yXb;~g%6LzZ$
z<4y_ShqkU8ZEXCiWgqNH1|H}V=*|Lt@>D)QBYcf6S<L7kS7?9WpU_UyKc|zS`sYM{
zKSUIlWVZW3QItaoKr^9?t?|HIt7P?KnYR>Jc)V_PZMDyh1{@~|VE>3tm9P~ev{UpL
zitM?JLnWiUzv=bz)LH&2eb8aM?L^6|9RJzwd6vSs1N%q!QM#dIi@cfqS1_1ukP_nz
zcCc)XOFCagmq2s%^p<6qnf;1RUl`5Ur^JirRtX&2J2=f^RB-Pu$Qy1<cI6~*&0CoD
z(?M`J2<-uYGFHZ*Oiu^s=5ZK8d{tS50Du1kziWJQp42~qQr7qkPFMlIE2hK7$H=)a
z)3R=Sm`~w4Nv|896_W&SnZZTlQxIY<lID-$1YVDe=8x+%zksz#vaIp(Wi>&Mg(F#;
zrM!iDyjQY4d9#x<YhZuXob=r7pDbyF$oI0(7CZM$vOUBmsMG7Y-PD93;C9w$x}81N
zVT#MwB2;`FlGZ%Ye%TV&BNMgmp7QNV4ZL=okeyXg<{dQgD=G%0bXjMms$$SOy2$66
zLmosQw?vqai@Klmh^8K)1{z4qwkR8*#P|{STvDcQo(TEhfRN|SctvE}(4!uJ1H(#J
zhDP@Z$q-#9VYGR-{rRIae-F)ateq;OsL{?X^IVi1&{Ol0gjsaG#e!U1Nv%-caSFa_
zf`YhBz-<c3%_E&zWJha04?qPsVNhqS%@F6J@u)TFu}Q{0vv8Y76sg5jzhJkX`UI4U
zMzU=;>Ne!C#upN?*u{v&>JJjxc-T;VgtHvs?)>4`|J>W%J34y(xBb7o+kJbu_qW4$
zua0;7C&%CJoqT(I@VC7;-}X-qj{kPFd$RZEmw%wtoqu%{1h!&QDlE%1ckqAVSMPS;
z=mw4tUL71CyxTjtw~@WFV60LiJeMZ_ws-u#-=`?;{?V@0MgJn5(B$XOx&Qj`h$lRM
zo{g0q@>+JAdZfbSuS~1+SFr!`57ECYx)=ii4DC(bZqi)DiQd3V3eb2<VuP$jZaedg
zmzU3bJ74ym>n1bI$WN;3s4Pw!QJCnD{-#~w0)zEmM%(8}oYm()HNPrK;M!k3|H{rN
z$HMMuob4xBeA7>0WJ6>NUs!KUk}@rZ`nwlqWWta1`Osfr22tugX8hGn=#cLi@y>H=
zU~@vo=LL@qCR1qh`SWq(({VB`O1MyVUVQa7wZ54jc|&dN+|tCCpIa>`EHcDwNUj^J
zLqSSMWqO%r$ystx4dRTmp*bVZdK2!2_%zMZ*<hYwSxnmg_T4vcesxdh<uu=|-WB<A
mQPhpFm8v19ymPyi@Zr2_8vi#X@QI_Djr#w;QJE4zG7kVx)VBWs

literal 106128
zcmYJaQ?w{c4=y@w+qP}nSkty`+qR80ZQHhO+vZ*WKIe@4kPhlg(jztcp;Br5C<qA4
za87doU?V$QXGc40T6=2)TN7F%I~#jDTN7JnCpr%U8*6~8ZY!_Nk#>rY?p`4A>77KZ
z#D>L5%kIuB@q}Y#@|G%E%9(SyMy&8)3T1*mpnPK&lkeBZ9a9DXL47b1QqKM-3!20}
z?Ol&sbU!>_hy@y%1GSy)NxkjR`=b=Mi`hWyo46po>A<bLxAxx)wOsUfHNoV4z1-8;
z)1u8`mG}`sJmVq;P7Lx!4<vAhpNXvZdVbgi75I{XJn*Fb<w0sY9NGpRiLf6YoY*7|
z`6P3WxGxTjnZ+Zz>^}L{pQ&H7w!&J58ApCR@Y=2`K(5Sc_h|AV;hll-ahfl;x`TC$
zm7j^IXSgMP*4IVvbnVU>fm}QvoSmP9&xA02-4P{I{@SHchz=^()Y5T!Sd;s~{X4ZD
zhuk~2J4SfJujCkG5uY*fCd5<0RGI~cJFYgkLxwPNX|tPAhs4jfW}Gg@3=4$C8g1GE
zh*W_bD+NzR&-bwTTPg*k_OA;iH~LzADSAYKZ*$+n-l{6S6Oql7m?`-pOTFHSlYR_x
zX4#}+?c3|fFb@n?5C08|#L$b!IUcX~5p__z2ll67#5l*$qPaN5^yA$s_dVJ#G5F~s
z(F^hBsN&tmERt#YD9C}kclR0okb7sucZ==GI{`MilK_Wl^1B=y+-KIOukm32{<xV1
zhEP#F(s@I)%LFn(Hn~9$xiB9O<UMo)ESWC5Cssw?1?=3{S(=F1udkC7_5o&$6u;xc
zFNF^}zdlJ*P8oeo_N#eWhMwmEEBdf|4}9Kri8$AV&U@xtDhR_kfz7zR6?w}NV1OR~
zM_tcQa+iiDUim93$-=(4&S{#du3;S8)gftghblC6cG|wwq_BnHnHW3GQb!Kh)J|1)
zZ;>{P+)fxkBu76sdRXPI$-zGAFVJ7>EisVtEd7(-#8beogTclm_}*>`pX-#<7MRaA
z`Zlw#Ot+lkr}`5x_qlHgH)wZbyyEtrtSuOAb8oGTA^E`tJ3Ln!yZ#`56yV&%K5Bms
z`eo@mcY_`a2KgWu2>fdj-|IoY+8@m5N5#LFQ3S)bcPDg(kVN=z>B8`b##qGulDiCs
zLP276hZ;BYu)&>Y+wb#47zA6&p1JSvbFi`Jw1!3eo`jV%hdPM^s-vsp)VE}_r|XqL
zK^E!MP=LwaEdcp`9QnBLwP+rRrr=3?bm4Ff_FPYk_p<4O>QO8l2m@~5*aF6;Z0{~q
zETq)1oz6M!h`G)jcp_O4WIfKq(ll~_y#v+U{5@??OEPc8Zwis(X)mHV@Hb@E^6?K|
zs}@W}d_nF^@_P(tgB(x=@bp^R(*rpDdwO+?oOn9To5Y2M{t<gKhq#%__#6@Y85#(<
z?;3YwW+A1Cu=fa6a+61}74VNQSo{>4od@P=wZEWU3LVao6$ErJcb2rhN;|clBL1)x
znWl!Sa*&jm{1Ahm?d-rnai?T3#ct08%ou&`adtdy<>K~ywes{}cnv~hPd?uH&==ce
z4ltjHJN@U%@XZ#5Ya?40+wwNA!p(<ky^+S)1=PA|07yO#m_vMhHwg?p)E#}>5<!%A
z#OJ`Ykb2YK<)^?BKsY*KN_z_W$$;NTGx~9NmOF3fAbZw8*kJBg;@VRrGrm>$B_71)
z-43DX%sAlWX4Lo%+i2ExxT0Z0KpzHE+@z)F<F|M`b(U^*K5oEMqG(5La(y5D*17!d
z8X$IXDBHd8MPrZqnlt`<(cctAOGt!7P>(>(Wq@&Vx_PyDh_(+^2GFXyn;l_aEYJ9=
zJi_80cvDF<Al?sk5wiT0ZV{a$T6CZAW2%E#S0~<pn_`RlUz^TQeddI|A$Z_{tTo@F
z$@H+2;sNR$z+)owh#2L|-<sB>)3*zGw$^@h_l}~9j`BDF2eWrrHF!E)!!YytvYUWQ
z#xTLb7U)XiZ$Yl$4$1r(9!VfAsIS)EhoklulXn(%+*8MWz-r^TcqwCV8SEMe_c~Lh
z<@_2a3^*+gp!W*XB1LF#b0S{57`1Hsy?}^zL@Wc1yX5Dz0LCyJG{n~6x9>Y7U0}HY
z5quCFZxU+JVBi?1vI4?)o6fV45W45sMQZ_C{MZv)=_t5!eqk*7!fqv7Kg0Oqe(LY$
zpBr_c_>W8cGNm!_?b>kGqZLXn!U|%b2s9!p9OdVRVtWy-qwwUQLu@)2*1Nd5dAZrX
zum_8z^^q*pZQ}O8`c4b>KwG=wYgRb(AmgdFr@m0pI<YdONOSe@ZKY2=9;NyVjSQVo
zwqM-AZK*Zr_u_r<eX^dfKf-JeJEQh4X5%1?VE*^Q4R^MOM?0P3VqpA)IP(5JIc&G0
z)G__0qGplcS>~`Yl6zY~G~SeKV2?YA`8cP+!O}S9f;s8kf;83#DcjL@PLH{owrX&O
z-j<e|8*D}Q1qE){JY5g53-Jh_g!j!5q_k#H>|5Z0kYgx>e4Bf?Jv3-#=j$Zt;^V;n
z^}~FLG$AD3RZVR}hJo(!4GN~Zw4ng-A_eOE&p-vl_r%MQVT*T)1GamhbsF2yt=IZ!
zUb!;qs_31<K(@J`huFIL0AMq`zI*49{s*UbGLMJ`#51^LXrMcJfK*^r5)l5mF^|0f
z!o|g=7x4TP1b07GKOfSY^K0{9wmgoXPB+|<*Xf?%C|r=EO;$8*do}lc!Ilo?#JB10
zFB*HJn0_Hgf1m7&KonR~LBma;gU0>KlU4f>=5ol&)-q`n47sF%^~oab!uhhvM)8C0
ziR_MUl^aL;*AP&xEn0ga@sf99TVY2G&x&iI@?TCLDPSao7uv4xdX97R?wWg!G2`D@
zDFoCcZ=*+k(Dj(|Th$DvkPr4zY35*-Ecy-h#5c=1aze!Fw7BA5ErFqA(d}#Nl691o
zM5F!e2HF>x7Ba8dzJl-p)&8RODNJulYq@^ahTz9^t;*z@TfI|vT212aO9FAjH3~h!
z>iBQ5VSb(mON5pQGzJS!kw0<1Y_^fwLdBu=r6vrZy|WM`nlmZ7=3?c@%KFib>TU%`
z0jxzvfM#B~{-iAj$O!ZShaEy2tSYoXn+ZN=-fZs%+hZTSsK-F?LK-e(z}yf%W$lDX
zA%Rw5B%H8ikCY*9u$N_y;1b_ff)8)QRE5GhT`5ieGP$*{Ic|Vj0zm-z5<I_<L3Sf=
zg&cbO9ewW-$XYI4Jk!FJ)G4_I2%$;U#y6T^HwV&p@m^rHjc71H?q8l6;4g=9pt7xQ
z^r6e3D=bp80DSGct=xrAMK|=avu6IZ_}>Nn;X%oo?Fffzf&^D8Vym?ad|*usL&UIy
zfzmF4p|K~6Br{k4A`fhi`vbD=+S7^Mb4g1Ta}i{-Ft3w?Sh>;Uy+k(fI5-kOWu>Ol
zw4SbSRF8|Pp^K+PIzY_!#4i75ZJNL5>l(fLpt#^U5_#E|E;4B)OA)ZIC^9m5=~C!I
z>MfXiC%hz>uJjv4V@l4+0N&Cx#2KX9F)&?ZAI;Es?pW+eUp}FEddom%!i^d^2G#1q
zY#hj(*4|j$Y<FQh1GF(XhRXeSbO?cTTW(Z$2w&WH%@@0)4o!TC85fNi{irAedc}()
z9#)VVKH`Y@8M)VbP@};)A#)GMG=$6ki8_i8g1C?h+*r>!1raZO%XjSnpb!p=M&#RY
z{`eAH-IhaD+;5Cr>Igf17IX^TeX-Bi6;zEci`KCzC%P*s`=0$kRKH-ZC!#Arw=+b<
zIt03Y8Hgn(Q5-6fK<o{S2Oc}5M37^y(Ks*`sAyqP^-o7sC=~WPrv~qOjQB{XoI8zG
zJ(7?h3y`zLI>BkIr9NhEBOdf;=r%A71h!Vf1j5w$nc0sG!43R|&q(j%AVk2RXBopx
z{L|-2Onr87luV2)k6nw8!YNNQlEqo{2s@<2vNN|gE4+!((jK>gv3aL2l7on~pvE&H
zc}Ud@O8$&J8nd5ab~NFkI=l#b_GxB8f0w;QQHu5XP;&k9NndEw?8-t$$e0Sx)`*tF
zCkG8rZ<vI0D6=1*NVopy7p++@4~RShn573h)ck9e4^atsEi}~AVc6@c>*-O6C&f-3
zSXO&p5&9AJE&uD!&%6BKH~s5Nk00aLB7ENMw~vV5m+9~1civLi?Cb0PtKE)|kB94*
zaNF<V>%F1tWS;NFCm+X8e?!vuH$8u2y7oDQ0dlA$*HKFM!-MlY9Po|$Ic-jNmpiFc
zQ^qf2HmxZbdbr^N5j@n11SXlaty|2a0VkYcVl=ZeFAn%)_K$uZgLbHh4$O1kU|;}8
zU00#%tA>Z}%j#a5JM2u#uFWw~u*0ROLh#rL8G!5xaX}{V4W1=J`h!&;UOtznp*sIj
zV&eNc`3~V5N8ErzI`A=VbO;(UL(}<@6~@eoB7>6csW9nX9c^j)Wx7vXP~0Ja@A3JU
zjBU?xkk(4BYBN6SX!|vVz=lQ{;W>9lrSWFh0|45Lf>skH`tg9*2PAJwl%%t(>J6`%
z*X+94KIi5gaTW2DeXKZFdLu1E;R^u6A4PhlXA6<=1;w&W^fRM9Y8|N0!l={P!DWaA
z2I#?;S`0Wl?(@aD-_RqwzvtSxx$2cvjYYni1N?WR0>=%60E4nJzu&I`x%+eJ`%KST
z<rL8VN|m3!XSibKtsKEWmkf;`-!2HNkgXS|%za4C4j0~|p*x6%?N$%DT-ip+HTccE
zZisS+o)WbDEd=pA@CbFI9*8#@zQWoPatD<5i0g_+X3xker*r_a{f3%(T8=U5_x4}*
z+5IUm^VT77u$A~h_`9QKln8GS>OWlIK)wn<JhA+a6uaXZ-*clF*)DLOB2}8-#2AaP
zB+}>nQLM{+a;4s>0E_Q;I`%F}B(2SH^X_KjN3{Y-@P|A+T_yf^VUxzWBI8YXsb_zk
zM1ox!X6C$F$1I@Xmrcww1K`B@K(akU6ZY3DSkJ}PJj<|VyI^aB?g!gcJs{%%pY4E0
zUS9=_XPdb`Xe3NHNBxQRKun)=M}%)-9AL0g9^f(fr>V3sWdGuud;QRY&93ri$k?Bt
z1BxM$K6l1NKIp?7m8@)Ne&p;MEh~WrH(#S@2OA%|L+Ss{5{-X<kPE0no58NCPotNM
z-!bY%938db#*R|_Eb|Xg9P$<vCB1FJU}{DuYd5z@I~(@P&h`x4YosWAl6Z`-1NjnX
z=v9}4SbEeCSQtw3DLTJMI1py4bWm!S4@Z)Scw!Z9HkoRnWT0!FOs5Ic*Efr@LiI{f
zoIC$@7><4Bj*#xjel_rI45TJ2?>b88n=Nlv@%~bCFy7sV=<^B(FC3?b?zCwbf9{?d
zc(Xx}XN3AS0hVt~JhyT{uwd!bcu1;TI$&Wb`s?Oi-XT+P<)-{(LSg3}$HI0L6q}pz
zg@Q{DYS6rqWF76z0zxWm9uKDNthknzX@m*kbL=e807zeAFJBaqzYi;6vQl+JP!QDl
z?5cOoHqNNZ1+oLYM&l>NZmy)Ic#W<*lb~-XGA-*k+sj<bmsYBfP%@>(E;-3pCsW|6
zX6&;NTfh(h1pVDw_B5uV2i<c^h0G^QA~-ssRi(Ke7%OS1U~}*I^bj)qb}BK!B+!^X
z8{{3YzA^-wtDQ$Gz$Or1aF;BiOqz5&Zb|Nz$;#6e-mF>g0C#X~MMYg7_1(N*F>S8v
zFeNB#y8huqwPNS;x|*v<h22F7;WwI=`hlAWi~8J2i3Iv_fya^Dr?7UT^QoxHn>`Zq
zB1QM~<oQXLuAzU?S^#99wGn3`p;|dLx9neITCe8#3ytFroW@}ppvwDtRxsQeg7Q2Z
zQrL~1-UFA80#U}%5uSuj;wdqX%M?3mgTm)6CPpR|fBD5Vb@Y*F5lE5CQC)<%>v}v)
z7CQvrVOj;`qAYgFwg6y|<#W|IjN>v9;*{5K!MLj{Q|XX@k<99-m1*~#{gjL)Zjoop
zDG~sDA0CoqO^c$6A)|Q+#PBGbIq<CdwaXGtdFS6WK?Nm?L;GbNGE;7TEgscYoI`SF
z6(fweycV=GF;{y)VObWmITbO6*3CqK>44PcB3cDc;NzmQBKEO<V3`GzYwtMJg7TFE
zR=;h{T5A^b>gL+TdjksGnn<FT$1z!h<Co1Yme+m-^K@Lq1x33U*C48wkjK6iX^$r6
zi<Pi^7>ItNL+eN%emlStp-2rppov8!kg*e-ckRQ$^E-OJ-+Abxidl(@;!t-&6LZtz
z;+mVuj|Vf4*o>FGYn?zp)`j3blpN#_yBZwC_PAe%5U<KNzqf8|p{-47-qI$t>KUE;
z7|9V@a0RK*{8_m?d%@)IV1-V&xs`QIKbN|lvFc#7lmGbuww2ntU$b>l@<nko-eNn>
zb~9E3#}c>i`vqY;dUG?fVyl*VGhBn+>*ID%-HBLx&S&ib#C9`K9owSXBgAIgud@}P
zWqNw^vw8Azd2zaSv1@+2YJNTYM)Qrq{Yk&E`(x8_&DXP-JKSyQHhbOw{2q9jx^0y=
zRsE8%Ws$cZb9KSW#s)J!nh3Gp|5Bw(8O^uuC}%RrdwF*y^1w)Mw)<CKC(^hYu*TFD
zYg!u3k(94Qo%t(E<6v#hXzwd>&fv?+#Ggao&E)C(d-B76AC0DoYpb2b3d$i>V{uo<
zYzuF9D_URe(R$Dmco)j;*wsEd@Cg@v`0Sg&lOJN)lRtb1e&F(d%KrrOZv0?t;al+e
zPeG2@rBA^pUxaRakz4Tkj%Qzlihpzh^B+*CbqBt1d}QJOB8DPYJ_Tu-ci;~eS!rH<
z5u~fZS5Kj9{&Vezoy0e~@kb5abd4V{Ryi2G(|iu;jKjQ{G(A0*;dJrx#seq=wi2cn
zGnK<D7f8t;KZinXS_ksT!`=FD!1GW-K(yz?lq1A;$aqGy7tz4;4OUv$z^eh2J&P$v
z^Qqm=Ts<zeN@UNV;lRw;kD<=Hf>7QJhsJzYoL6bNEswnK2M$LD=)!+LC%~6~$w3oV
zIX7)~;i~inP27cu@uYsh?q2CGCprqL5hs^$d@-Rs8}8g_*lK>%i8zK!^EA@cLN8*!
z5EV&J6R9vJB#KY;tuWrE@{usKABPAZX`y+4bFQh@oHBDtc2zQwbKlL~?9#-$BSnq}
zwJ$FgET+9Lv1mw70#)+Kaj56!`E*9CmhxTk9aA5@uXE6pR`RMoXY1+ml)?fn%I|Hk
z;#L{XrbF1eT1|eu7J_#fAgz0|qDwbPC|oFCAX~{uTnIFb&$x^>zW~=J*0HOJlH?Hq
zb0hDxos5!w6R;t?!$~iWQt&tBYKo0f#sU5#5#~ONuh1p0Ic%9X8*$={PKL+{6KUfY
zilS5&$oLkns?)V%h#`y~LqiWISx#V&a4pJ8iVe$?3YZ2iyaT@f1QsP5QnZrjA>s}|
zh^3SXn%;$2IXnI&d&lh3>J_<Zfhk-ZSs3hsx?~w=;Sb`_w43Utdf&iTjmH_D{UDH#
ziA?vJ{7MmSydXJ#CAt(K1=|eMIGEK@1OWnPiegPG6`X*E9ZQvE^g)^q`t7J)b?Mh!
zrdMx}=G8}eM%)w7zYO_lL9n8R%#@qYaAhzhMGedYs~{*&)J+Q_8{EaLi}G+s0Sr;+
zNv|osDQq4ZqR(oymT$nci|-Mp+cjriWC7$*IGPq~|3~A`(=roaS_h6(HGnf6z2n$k
zvg8bl=1|{bBMoMlaX70txh%z@&6Zd|0@asmg@Hp^#?Qlp)EfvL{SOrQ6i>K~4fv%H
z9V@aEMa@1fZY-nM30b6(um}}Vez65;uo$Qu_(0;tgFhTHLW);0@1kO8-;F!S=L2qy
zK;LwOfZcp5l=ggoYSiroFSFDw7wmy{bV!zT$R;YaBM_eT>GiO!4^w2nr~~gGTbE%w
z`GWwr%%itBD&co7NT#<)zSyo>C$Ndum1E^Lmn{$7b)y?@1u7=gy`Bf><(HM^3!aFC
zfJ0m-oN#YSWkwquh4<GXNgfhI4eml^)KK`7erxNyWnjOY!+blZA_fbuf)_{T(87&S
zfWErk1k?6pzeLA2AyGT1)%-guq~%)bvZRCzadP1mo`?AZvi3?J9&?%`oY;UO*;2rY
zkWqHqAdWw1wzzg7TI2YQ)l5?F7}S5#(As+1mv|1?L~u^-nwW>3D$<R64jLk`*Z2++
zcJf8;DXtL5>3F@GmONj|N}jJ0=Kt}U=PSioynher%k`qz%~Oua1^2VMV-}pt{_JJj
z-Fmc!3NzxKnmcB8RNH#R^}WPo=ZW_?%bPBo9`AW1jj`z-8Fu!x1D_TGZWfl*>bM8E
z)^*)2sN&{9BQpwZ6Q{Kv59zar7MtYscT_eCLkWr%m^PeVn>1My_F;)-F|i0jSRa}p
z_kg-hu&f+YemL)!h5onre47vRacNTyqp51bV8~MZvctQVz<Fm7e#+InVQ-*Tr#!Vx
zUSk3OjVrUUmEtFO+i(;D=(^w-5X*n3a_w83_pQR-Kc9H((2y$H`<hNa+8$=rC@AwX
z1TCT;NqcAC?XufrwkC759y0Z_`3VU$qLYm^^>fk1s=0vnsh~sqDC>N#?jIX9res<L
zDu9HK@er)2J*FhRbTuL$`D>>W<u4=Xs}au|A-bJ&9-`f@1*>$)TD3Z7&CuPh2Fr{5
zO4mYm-uo+!;=Eo<jpCyJN^AL#a(OS-i&W%)W!8(tS$o>5>|#>Z0SE0ht}P8B>ek9_
zy^QC-c`}^gFod?BFWd=Li{g?9&5BJ^czcN0Dq(~%96G^vdXqTz=AeiCi}Ox{bMD@B
zTXy%zcSo_G@5Ow&=81=~4NPSMl}+_k!|*XBKppnTk$i#$sP#qrGeGU{q{t2H;mOR7
zpCjDm7K39(l-&fmjP<4W#K#4-0~|FRCSh`f{3jM2TWT}NdXa4XKKuz1lTdZ8iya)|
z6W~N?!mxAr6#l#kL9r&*AmR=hTbTQecp1z}=V?1BU}8~`zFVV~EM0e`RXv!&0Xxr|
zIyZk9P}?{+6R&_!x}e`$SNBwofLxlZ9<K;WXeedcsxM=CGI*{zP-V@97+jXX51v#Z
z52|kXWw+J=Y%0VVT+$@Esw5d`!H-SVE4J-6?7(ED+(Zjh74vybEuIx}4YvGfgd0jO
z=<!7|!EPo|En$%p1Zi0na7Axx*o9Ol-9T+(?XByCh1dvt(pcYg&{*4k(D)Vwp_V4;
zR=Q8SII%ZX51n?|NNP83X)CSMw8q}G!A&r)Ou$S}m4dMShIm681pS6uVU}P<!WG`I
z`5~vo&Bq+xIZf=V8V8!q${@Nskg3!lH(yDP$i&N$bpq$Pf}t&#w`YVqpOWk-rr=P8
zD>S+!zdDEcZmy#!ZE8GTK23O5s9O&s`YonEHf?nboOCXjN3N3j3jnG%#%1%zaEL4F
z*5MIH6J6H(4;}y52%KP2F$QCXa3bU5GsP4sSqw5OCT`K4KuIW@>RbX2y2EVJ-Hcxm
zMAT6$@D|&;j4;Xo$1N!uKjKRRJ;s%(ekZ(LtZf#dzxp+?bDdQiiDr}3Ld6HgpPMY}
z*lf^V2B?fsIuW~Sgms;cdbHKDq7cW;<OK&yBHf<waEG`lgTLGWc#c9d<5ot#m#OHm
z^8t&<4t=S=`jtQJ5?%I5)eek<v_O9kEics~p~C&~=P=A&Sl@v6#4s7p-^e4WO71#)
zRd=sg;+=wPMfP>p$T<o*O;nTB*q=myBVlVI_&asGquX~Zqwq=Dxtqx+&MH1r3+&^A
zg<s6zWo)g5TPNOD4S`Ol7UxvG;WW@L?cc+<p>xqN+9iFh)Ze8XX!7r7k-SNwjxJf}
zU$><}NLI=~PDi<zDm$t#d?$~>YmaE;j-x&TGl;3AA~UmEe2JBd5tkWHBHsrjTChz1
z(?kJ6y?{EDkV?=%bk;bt&(V)yo01%~X}XNuvVphOl8d_l&*QfD$E!Cvp$?<1^<=GS
zCv#EDNmJ8qy56FjwbbS4Kb=PRrkZoQy7h$P|E#w>O?<3m3#qTS1Y1QWb#U-3pz8;X
zh}IQ*N>$|ZMYLH(mR&-2mh5#EE7>Qzs7bYGzUW{X5DVSTDi0?~yQbP*f#%ob`;`L`
zPi=@Ju?A?W%}*%8k}qMT`bIz6tMe3mJ4#YkF-5H7$0992;T8{Bo|y*%b%6b;T~3!v
zKbIQfvyY165Tiq+Lj*@upAAajrS?4jslSrABnE8Yz#D|$CMVe+O?(6gGeza}9sE|8
z7u1v87+0tr`BBANv|%BqdcL8BV$GbsA8ES_6?XDOo8_L*kJY%Rp`Yn?dgzLD>&j_*
zl003drf++G=Ns3}Gro;TyuutYV&2r<q*J8pp*7un?7E$!Nkh&dj-p39%R;Z;!pxHy
zx=6Q**rh(i&5q*lvA`^I)UaTQgqaP8amdETMBrG>U0AeF*MB2vPS-`QrtbtW-oa~t
zP=3RXaEByJbB|iN(E#^Er|`|T^0Nd30TxaHP%z2Y{L~HWw=Bh}iB=5Rx47;NCH!a<
z9RFRIL28EUSNj7hjy0-PCuD<gosZxEcYBeF?wDnuqXl#BnFtaqZ~5jm1S2*(u=ZMB
z!m!ccaEm-){1iUYHOg@0!;}%7+h_k;<%DH3slQqZ(_rB<k^js@)q%OU!rbHHUtd#p
z0SRj>Z*J{nDV#-o#BaGm<u>|FSNE#EuNZex{);nEm^;M#YoYzvdY<}wW}py<1oWJp
zeTUmdFYb9ZLQ*wO;0)z*5zL5BKXjfXo{1}z<=ORq=I*3aAQOi=vSc)S+(Pzpg;LW*
z2>Z!4kc`JJVsW@H8Hb<QbYEAzL$uFyze6;yMdBGHVwZ46i_|ST(D95G@mI|=YUt19
z|8$||XBs5i0zRF+8%iN>JmxO5#R6V=w3SC@MK6xfJ7>W2Q^bx(oB`Kd4r8-!`yAQe
z3yv+2PXxHnyX;e>Gy@Gs2z|fq2H}%q4Hd7kUTFcE9D2v{<b_rI4Y}`v1&t@s@QY1m
zN};BUst+lViszK@3oX5fa8134vRV=2&5tb?pPP=<mD8F=i+{pO!sq`CTv2KN_;mHG
z&gtC$LC|(Ds1a#y`=W&~epFznUURAppHU+|KQmbVi*|-A(B?x*w3(2HJahfen%-LQ
zFVDYp&DFIcOIl8zR&sXJ4p^P7CuJ-D(_&37t2w(_!~T7v=l>H*TmHc}HjP553@)h=
zeXyu<dyo|WdqHLHlz*buKkGLU6=F)EC*QQA$c^-w71A?nM5?A<lDX)m6_SUKY+(<X
zVjkdJ%QGf`l~x{LUClosP3(#p-~|&P2K^JpU-Xh0pvK$>td9?P4=e7KH6rq5JZ<&N
z%BsqG_HT=rUeX!5wn|a0<P%JSsa{f9IWKzG`YOrCu+i+l$o~wrl1u;pHeOe^N?04;
z?GPz;t!a@&u4s{{HvPBHEACyjl1*E9%yXr+lE&}u|HtuPoRAd~OAmrKh%>CW(jtiB
za01@Z4opEFxQo|`n;E>?v!pmRf4%pzQ@(K2cJkQ?lYV@<AdH$SH;^g8OpzUpqfx+R
zb3pI7Eq^30GJ<^)_{sn=A*g{Wh3`>=p#TuerNKtzHsX4IlT`C6GU8AWCWv<l9*>sF
zP@#)f$9q!P_SAI|MY-10$RCNZu^fD{w<I^*_eE5wKvy65TiBX&WkQn4MCCS=?^p+_
zJ|aUIFdV$RI2`yqxn~Kib+9PtXm+6V!ApBj#OOr=yJ8yYMRAfc84rMya(dIcLN%L3
zW(M}SCeMvV24C!<#eee&uZ~GpgVQbA+QjukDNb>Y=cr!QblLUZ&D<z&fty7UM0Hz`
z{^cDIBJ5{u0P7Y5Zq)QOu5Yg;g3*5h8el<Ezy;$wg}n|Jv;8MgEqK5NxGL@Y6*G-B
z96ASN4gve)VPfH{>N0{?pLBJ-2xAU$f|T7tv|uaYZZgNu+}sza9Z~}5{w`9q&7>$2
zABh9qV*8!^GSd_Q1aKOafWheiW3nvX8Q_*^-5bOHsrN?mx{)wa`VF@;h_4Y?i4hWj
zylD#b2dQGDOkE~bb9*M#aDU~S{OHS^ABHoEWzuwkVmkpQ@QX=|gjVuPmqVvniwcJD
zD}_fHT$=*W{j*fBX~zNF0L!#G-?{3Z1W_9DCsTH9g7YvLt>+;qFI2=)$pxP2wy_&N
z?DUs|*W0a2{vvGe5C=pM!yp0mewHaor)$K`AakgVY60NWKB8@LBmp{$uW<Yf?hqam
zx)Qpam*^x)`@H3OI&zd9gOeB2qc#bYZm)6Hyun@v?J!>>-P8zVaM28y6ovt<u)%kI
zEwA!#W@iF#Uju*70mpdGY;>OMhL7W(fW4)Rrw1#d%4SqPbx~=8Tl66~@}mp~1G|9L
ztBM1WI)?p4X%fX)ri+pK<{eodhSI#qcsaNxH@q3+L+n$AeXuq3U6(Y4{}Y$T@%GU>
zkC%(R!rkM)S)p{2!z+T<#?32&XhcPr0yRJLt$koLsIb06AbKv$4@dq`tN}P*TEmsO
zRrwG`?=joJ5!}`}2K5Og*8>@G1F@ARN)V^2dq{cr;1#@x2(;WRd!lPy^kgS*PmiD0
z##i#vG~SbQM)^1o%MJ2CkG&6TsLL+Y;SLAlXT>P^$`|{k&rR<kIRu0H!@tKkqi+6w
zQo7I%*GIe_eZ<8c#_TR$dC6^x05v&WOh+9&j?>ZNJKXaUecrzg4_J54<5@|EkFMW^
zL9PiyB%={p<()cZfue4p+x|{n&`F|byym>lymhJtC@}<R#07Mm&<maR+I}<|AwtWF
zgxIimhjWye*2qf}hS^x2rt*z6AGadQs)}?`_Y+Oi2O+Ch^fKv=qlS_-?9Z~9>Pyyi
z+bhru+7`VpT=6@oE|L+R(ERFUIZ0b9ms`^*aVaRbU+?VwgC6!aW>Pft30Is4bz*2l
zB6nNmIkKbM?{nk#b*i0}gV<NNiCk~qYltO=g&@7P0PdZ%Gvk0W#r}?ebH2XlqLP)$
zLb`fFr(tdxa^nBA!FE-O)*y-NydQ3Q2|!_D8v46+K@mUw!0R|JMkdHNXi>Vgb4>aO
ziAP8%xc{k&e@WqH-6cuEov@Igg60PU02KnO><ojxiZ_`{oeYiQfIIPU_3wFeGqCrw
z&ns>nV>=WIts<O)8{_i6v-&X0iqD!_=d3tn?bN4rhJ3cF@~6OU^xWsAx#Am=<)AzN
z-zZXR6s@CEZKGSY(@TOD`z8H$yKUPBmLQ5mj$PYcga;EKhvw9&WTfd5!K)%34j~KN
z1ioYp-<|K0o}>TrYp37O$(x<u`uD#0BYUCO)v+~?KBo$cd-NRfezK_`en<!pPFxab
z<umwESJRl7c?cKhBEEs>vV1Dv@{KZdTNk`wW-}Q#i`MzukxkB}l{fN~_s1h_?m`AU
z2K?Nv57r4M=)NRa$B}1#I5e}k8$GV&iE|&`swEdLx)gPS3KIa@ez-Iovw1-8Vb1zN
zq4s>(PT*;TNV4MdbP*9UYXz4UEnbfy_{_i(c1WWF5TgAla6AZ&_~xOS_~E-D!FIH1
zKaC{*)2KciI(SIFK`MDUKP;Fhg0HOK0lM^}x^LF;`8|;+8k8y_#KOw@5^lnojaAE+
zn%4P~YcpDCyE5z^N!8ZB39?W;^GJAoN!A|WdeY5pvYYf^H-i%-zr#`ZTiSi}%{j`f
z+Xt`M08mzIMT&mSaU$^;U~=M>iL$sy5@JfNQcjwJo3xh(K>Ky`V!z|>)16)ZUyHWi
z<DH#X`cS`*{m1U!xU;z3E5G*Nq>sDzAHJ`j>CRgE*;qe_SHBNF-6`AmMR~7X@KJts
z*M{ETW3v?{ngT|S1cO94k03n{kB&N%rDao>Zs=2}c61CW<ZN1?PHI`jB(Gc&QYAh_
z>_uYxxX1&wucEwaOF=WkzvJl9(4NsTJi@i!;`QziI9=<NM4l=lkMZ490~O5`M9FDJ
zwP9z`x7A^dTDS2C$szTvE<-gVx?2I8sotX1joK!{p)*-9V>YQFbYjM&l7NAk<d2{y
z5Oqz<&7X}5J;WveG}#8}PMOQta@~Uzfd%Pj2H-J86rWmHbrhm}PmF0$drPb)k3{*J
z0^O7yX>n^osqYYsMEzgNg8m~0th3d`uxV83_FXcmmB$M*jF*U5;-mc_v_>|3+$jBJ
zFSk&~(oKJ%a{!ozZ&0V?+FpBYviOB6F<M|2`R{o&J60{AnpRrhyRI==ZR#5gnbSC$
zgrId!rr5028qHd@HL7i`SGZ_aj2hMArZlTZRe5QpkH_TN>;J%^<<MOvVP75%?NkkJ
z00?!$@pBob4z|rDhxivdEj<*Acmaxn-HR-z-jjq`SbX9QuZJH`*-AVX%B5a2o=mJ5
zO@+QlkEA;$__CcjPBLXI^NjuVRa#h7Tvy7gTOi9WW96_)Amz?S%q(b$mSBkxOcUyQ
z*pcNBor@HpiwtIFD@xesOzC2gq?|OuYB7c^3#N)c3udR6`hxsUCsPDzd@V!}NnGV}
zjkR$>=N!XcjXEP5!=64<ZH*_hZwW7K1UV`YYp$9^%$w_<VI&;Q=CbA6eZ|rA!Px$U
zC&0)pY(4DbZs(JIU{3YP+-2`ZYDa#$@)G6z+zbAq9Iu(k<n0S$;(kRE!Fx4mku0$D
zDf?!P2|Q~<jjW#Gf(j7hi!O@MIT~bqPePHjh_)hJh9E_T7+(Q6)`p0;B1dZ#kdJnO
zr=1~`E7hOGpAJ~l&380fQ~{h-9>qgdjADr9$es>_tl;*q`dsBy(WNfe@b{k|P|obY
zZhQ4d=(6IEZg4HlA#H~3C<|shS6iEs^ThdL!6PrPm<;#Sd>_A9G4zr*UgdbLSPgJP
zB|Y4n(gNtkyEjZcN=>f|zY)Ad*se|ZaVjIU4le>`R{9drYnq^b(Pjgy<0N0}N2>nI
zqJT6!IF3j`G@}@D#^+#-M(9hux~Ct@mAEWv`KNgeB2`6~@q~@OHgh?2pwtt2?~!qM
zHpua}B{vW&so{{sU;f1v-t{$&%>!K{h(h0*Em1(2_niiW!Z-i@#!zu#Yq%#w0w$=}
zBn9b=<E~+7Qc2Hb=FslGfJX<SXM6M8!fg-q-5s9|Xffi@weJYY*|HT+4?cYU%psr2
zAzzn81RYyM^^Cv&eph{{g%@GbdK7<9JNpNLx+{OtbSO0Q1R}UOD622-0o(Pb|0??z
zZXr03)#%+s8Zv@AeJq#YyfDc>pzZ#$uY2W9kDh*Zj~DrK=;`n4^Znn4F(O*&_(JSy
zwmCSiXj|;lFVtZR6xQI^@bVj>Kd#@1_z<^8)<@s4HJ~&{6TL#`S`Dnm)yuh2EkVLJ
z1XBHt?^b*A@uj0#Fn%4RlFt6hMpbfJo*<4+Opmt49mnAkfMJNh;UMY-FEO^wU5^-&
zLk`}$f4%*NjTf`K$}BnN#PzY@m->@;Xw6!)@W&Q5vYlv%RT4=XasC~iS6z_MnmI@K
z^bZjz1m5hTE%J(lSv(dHJq9%Ugd1!|+K>Ly7``I_J&+LM<W)}K@N|w!J9LlS(A$u?
zw0&o|Ny=_n&eHSWv?R)tGTv|XgZr)n<1O<XGKwlPMG~_F^uxZ~U3l-9+qK4;+dFh$
zpSW+1U$;<C80Pq03`b$&cq2Y1o=lqUlUz!?ZdEV*P<4dd5AR6h?8Eo|e%txo&f&|c
zb!rXmjPIZC^V9L+C@R$2uwy&)|5ZS-np$~wr!z;{qR7u8QGu)_kpfEH)0sd`pWy7$
z*6L89dvlVwYq5aii3-%enex-y(>ks|NdjGcq(ZR@;Sxo$WLaTTzlU+EknO0CMgOWn
zx{Si6%Ryqc;C8USYLP#?g70+#!uA3=17mMUlns*O%he+}+=M&GI$rjTxnni`dvH9D
z2_FjX^6}FEQL;}{VVBZyRa@vPa{k4ZzUcrM&Xio=Y;8sQEJ;=Wa+NWyUt?X`(UGw%
z5VDf4>^>D(7>be(u3UArPovMywlInE@oPrff77G3B5ww{%w}0=Ca=AQEU1aou-r(V
zdNr=3q<1L}2&;P}NuA-!_GsTq9nGWG&x*zPm7<F2@TcCMt4~7vZ?d#hD*DUjG+O$5
z=yD}v-v!{h6PnYCH-fKrv0x`G<O^iCn*MhXkv?>3T&&ugNqn3JeoeGeqL3)<E}fQ7
zJ>lWfECVFph=4DQN=64Wl*AwIkRiiN!yQe58H2zl(7P{^_EC~Hr7A@tZX4z%E~W<Y
z0_X%|JRFbHze`+5Vi3hLMZg*jI_)Wj5h4X=>1cJ5@Sp$`zc=2`k(=<*ZpL<qi$mms
zNBniCkF3tYk=ZPp_|<lGRyhzj`u8^zNks>0d=S|G#%EgrUeNk>fY!7Cu(j*}uW0@M
zb-Vy-th+(&RW51$yFu&z1Dvc>u6aW18~taRGyl)5ig)vW0c^d?S^!obUS$7Ouasdu
zbu{_@3dRLAD>9Xvcu<@JO&X^!1ru--xJ9HVg;r8KUYMv|2vEu9c+(gqrx8+2w9yn?
zJpk)h2}2)dQo53E1PyXCUAx8B)}a6c&NP+I{VHObTHZ?2L#lCtO_nOoRL((Rl54?)
z{drEag3xM#kPb18-CxEovFur{V`tRO0A~h`8RQeD78fT8i+NGS3d63k0}Fo$Ycic2
zD|c}5FTp<cFI=s03ji94d9`NvG)k8r_X6`gshw_%i$S<v@ArV^pbbW+1()04ie6qG
zZb}`i&%IjUSy7h0w-=pi1gxRC7Ft`Cf(TuG)oSL#R=fIudC*qg<h;JqVW-J}EB0O@
zRT(sEXS}6}RHc61aYa0)COL601q)j>I6~$AO9R22_6*CE9hw?(zBD*Q%U50{MLSpe
zyLt*XCVqd%AY*LsI-*(9_k3;D2p1(f39F;>9+k3TLM6bhuMnTAn3S+~F>DzJfrS>`
zPGnH4Sbu8jWwmCtj(t#d)h_57{;E`WOUOn9pna1Je}KwHz_W+7RZ}PF1}naY8uZh~
z%Bh)&$4$PaV-ttn!baC~AjArqDf(qYk;yyaFqoIs!wK!UoSDUBo@S-lwo2oS<vJaO
zY1GPrY=z;f>R?TEU~?;++d)6OCF+eKqVJ0~jl`<QnRxB|<IliM_=P7@sWh01Dr_?C
z5POfYr8r{%Fi~=#1_oS3$?#)yMZvSkg`V}MqM$v>K&sq%?Km$EVk-C+a5fQnv)vd`
z$i%2-Sdd+>cLA3dUkA>Dn90AZmRaK|*XIl#_wMisDi+ns_VZa?G|XbXg|-i=f*O^=
zs@&Oj^-tvF48>~<g_anG5^<`ikd=K(p=^1&KX&WRJC8=JHc=<{dC2@PEHvSWwy&&W
zn>jW~Q{|It?v<!Za(b*y0r%UB{jn(E5FDJI`sY0;85_PV6bx#@kdhjj%u#{dfr7!N
z#sB)RL<-4W#I_JRx0<6b(tt4<9K**+>ljA3&7F!K0#~^4UmPN!+cEg(Ozb^wQ5DcP
zB|iJ;>UaRGq%vBCAUB|NGjS>^(g5&hUeW85=uWxte=5R^6Dr=D;ER+OG6RPVSQsjR
z*#^`LqQ~dvueznGc=GwQMo$=3kglgF5J47ugK8yit7Bs>6k1;-|N65~2^5**$oLqN
zfHXIpXN(#IS@0Ab2#kptDYPO^_@IAO6CZp<Cq2I$3`vjm+aelG11{<8=vxFH@$Iw%
zy0am?G5l`Pdmo|1j&~8f)Di_-II6c-@e<r}-8r@C<5g`Rq%PkvcI{4&#+95zZ!4np
z)ipOj(Ea4VO~DKJHjLqGKy>y(j<S<+V->n0o$Qa9OSS5_kLTqSn~J_~JZ;f|Tc?sR
zde^v+IzPnu_;}vOwT9{8_S*2p8PSLt6?^vuT7<Vkpa)O{_E7pG{xl<Go#fuMf>LvE
z+G*Sehi7BaOQk)yFO_rjk(9AYC254vKgl&OKLR4A&t{W&LbAi%e|+DAdeF@(&3FmU
zusqSlIHKy?{W<eE!X1JCBHo=xlM3cK^mhl@H%h^EJsl4JX+3;Tl8lV5d11s-^LfM)
z*Js1T05VeA3r*})JdC<cjJQIXH~$mC%nS$)6VCuUx<eyT{}z}xC}no{$RW8noIMBu
zp!s!zxTCL%7$R~fL|p2mXopD85cO`BZUX&wdK|^?d;f`M>r-j+)YM7hVUm16ZCr~<
z)>cP!WnoNP&ylh~O}4L&HX%hsU6zp8f7C*1DtVg34BEif0Pld)D1~_JvA@Z5r|a(b
z!Z+}%Nc1V}m1a9bMdwI=0V_9y!~Vi8g7!vs18o^2WUwC;r#`(Mx1?*^#DxL(rmUb}
znF)T<dlb}Qz>yEApyEV@UZ<V*7sF0$t<pKj#?w!nwbA(peXnl3Iuw_&;ITAVncJ%C
zbDkYnL-bbgPmn#1*aV>fBC(+=jo6@y3{2O0-)wYx#sZfnkW80{5x*^Q{8ky6HkIfq
zUUFmFFeTTPl)$kElN?P&oP~JnWKkn+_F;xhFkAFerRM(E^<^VqtW-)AUF_ABNr_B7
zF#WBy{iZdvTw0l4<Jb!hmHeihTUo(~1=6)k#bRGxa2%FLAr8g!*bN~?;}M)rN<y4U
zH|V`_Zt$4Zvje4%w$%JbTQVQr-#F>>!$1GTKbQZpmzB}KPY#sR)p64E|LFg${Xdwd
z7Jgbo$3J)4>vgAkAMJ_KgX^Wyzt+~opZ|+xqVg}szlP9k+<zIMn*X1lr6zvb!hdmN
zY>FHx?Li0pz|AC4V)3hd+GqZ*nUd84i}k-YOBf7yI=iOuvzJ(ROkE=7Tggm>+^Zhu
z*p6GQz&y@d0TZaXk!rUa`|-sIVdE<kL~~X0Z6{x)u;<c)?a-u?mWK>RB^gG5bh|1X
zp7iLQ^7wCn9F?7(fr?s-BI5pirBU9qGN}Sy(5+_*^N<wal6`P8(9Y|NS_T<;5swNo
zF9F?jac^d#Eeo-sdAOv=n4S-q6*24@ox(TpFy>aS*Wp)qJLJlSGV<+Pwh!}U4;2Gl
z4^_0OU*~ujbUm!T%;722rBto9=O+Z`>5dI>oq%{xj9rrda`ZwqcLWvT3`j4{ByKW8
zGMbG$VV|}xjKM$sH@I!ip^D&&Av&HuoXbRP!OoluE9bzbb;J;(f0Sb%EQF+VY|C^S
zr6cHH2n(u#b!j!umjeUN2g0bEPa@`a!Q;~>%mW;YHe3JH1WN1JIKR1h+PQuLjSCU>
zo<5`W_t;Qh3U+J2DV5k@w$4nVq>QS~<A4S-caOwYvUsqNG1B+ljo^itLmjRO2i&q0
z?n2>!s;-)O@!EcfxcX>`tw+)ywpeS=3Z3lwfGD5KK*a2F4uAz8dWs*Wj>z-Fzh6R$
zSSY;)FqG*X`H%%nw~)kb(%=jYIxXx3O2vYr`Ely##98Vk7A92=W=2%O8V9K(WK4aw
zL;4Q7g(5p-I^b;WE8-!Q-$}qa70XubyQRq0>*f^0=wsq@w!7EwXVLz5vb+0M59ar2
z@YKr>e;&Vg{nzoA{CWTJ+vn{&%S}%&7xx$8=J&~`D}DQ+H1DMcKGv`9%GmFBa#pjn
zrNnX_b+_wpBiq-)UFOVJT(Q=j**MV*r)q?U)bvUn{x;gwAoe~~y~eJ3zYuTVFA;#Q
z#3j;L6jwFmk&@Lp`dI}Y_!-WaAEzZjx-0g)GAg7N9dXFzyU2IUS-ud19j@-8*#hDa
z9+)&J^WNFnAJ`NDA*cjJ#zn>`uYPeD!h~_}hu2M2N%PVUhkzERMx_KG=3%e|BJs`}
z;I;ydeY$L#ud(PHwf*hsQGE%;bgN=2mIC^?`Evp6zh{DiM<GNWrwkph_zkHFCNheF
zFNsp8=AWp{Y2&A9tkTn586B`xqio?K^;zfODY^=1s%_l+_w4jXL}N|~Uew|z=w1aW
zRmaB-qEUr6_oJ5}uZf8}+IqlUtVKSt*JbB%-^%)b0AS{W6!qvLu(@Fvz!0cy#oWv8
zcK-b=Su#b#tTLk7)IUsNh6>MqsX&EG7#h8oDi5|Kii$KAt<j<3$&DSR=#@XMPYiZf
zxNt@id>w))@h4)wp^nE>>-&$$<WZ=}348v~A8rcK*l*`inFMEyWA<@FPo?b4ZB@Vk
zG9!Fjp^~BIi2}25|9ygVJQ6^?G_PKhXwq(euhzQ^ie0{jD=_3iL}oa?6F6vq^K4)~
zu;W%~>7!xHe+AL9W4u)5f@-!RBGuTF^AGrgr)=DB3@>)wg~|%8fhD#&GZTVmYLU*L
zp8>{Zprm|IxMdR|S4P-vJi|Da5^Sy=jCJ^n&ZyIBDibCt6_`Dnz`$%lRf((s=K6vS
z5DN|gO!i8(!$F)>^S(g#G|-;6jdmr-AmUV{dl|3+^#LWe6)cxdv8w@P%np?M$$|Ze
z=s=paf`ng#5f;lNTL?o*)?h7hxsDu^oTsGD^%t;FfmZ4iv(uXZo%2<RhwXTypW}&2
zk|<(x)ZdBKcdcf!Xfp4M81Cjbpa}3G=F1|WGGMvv!)4torD}@+%21CWM5saWZ8n{v
zNT<cKT^=1|E)=h*yX6`EGuS*9ZuZCFzBS4Zr^naLal`go{-H0)@jmk#(~27ECXsC=
zCed0Xk{8M@GGMOx2IY{FXRy!C6!h!;ive^FFgij5g$;H-<t8QfL7|844pkh4W|Ia+
z8zpg<({+(<HQC#5?XZj~#Z`av0khrweclpDQH-h6XkbOOKpS`T&fsDB#Ov%_kf%iZ
zSu#ISfr3hS!m|>PetkCNLuE$gk!5bIn@Q%NnOsNtT4&vuu#v7kYeOjTMlKfj$QFe_
zf=UPz#}<2B*lzhn!`RMoNojFVi_0aqm(Sv*qHUPQt4{HwqQdA;dbSQV&FnicX^~PZ
zE<~(NcG1osJ9B>m|1o<^7@HW(Q;Lr%AXH?=Duu{ozny94qb}rp_nlV8e)@@g;dJ%-
z5J0kXoTR|xal@3lMOjLb(VwkesG>Qrh;|^d<9o&r@^ULC&UAnc<E~0=`)k>56Ld~y
zcA$FF)nmZYa{SW}JOfApK1wJct<z{eICA&?Dc<_C0;{Xf1gw!e<HwmDz3eYPR0i`f
zJ=<CKa)c@zxtVv48B#YbKLXZkhXx*tdy7LvOM#?`@zJOPfriEc8#6BD{I8bs3!r-}
z{0PPYl*U3-A?`iliTab|fR&+=Ro`S@Ua2N@Z-o=@FtTjfyy6>-onVy+7$F`svab+5
zUN&4z#W~UsL%|U`*oD8#_mO!9KQ;-VDy;Ey)dPtj!de^>Z^(wuj75N9lrvvfXp0jE
z=&1qV8(z^Y50+tc4ob<y80C;0Z;9Gd*6Neu0c6y>%6<=cZ09&NbJ#i2_KWe)ITU^q
zL`)X=-kAgOaFI9l2}tuVScfCtmaP~99}J&dvS`&uP0+vZ&*N4?(a;ewLh|er$sO8G
z1DYYv)go~j?DJf6phF7yunro9qVsKXlNHKsZ;vX8yENyvo6&e{sh_wQ1<E1V9vJj4
zc}YolP!IheuxRpdiklG#L}%QxhFvdNp}okoag#Oab7B=piYgz*I)A0%Id%t<5QQHX
zMEk<tVeMrRZRw<*lbLpAHHz?Oz9=Q$+rd<)1hLGblxNC^=|rql$*3|eTJ7_6-Mu(g
zeF{l1Y9s@!jkBsLtZP$JCM_kM{pK)4D6IV*-C6*+D6E7?>ld^oen6=6it~<LoQ7)s
z8y0NxSM6H;b!AggYK1)xF-pt?Z;UKZ1v@VS^r%?83&+@@cS7$Eh)3h>M8BOKWQg63
zn(HG9UX`&(z|kL)klJ8X?N5XMdc!3P;6J1Ek!H}!f(?iEl|Tg>NS_0~A<D4!>*y=y
z76K*M-P2|#aG73=M0w}WAgvB2MC10&EEDsc>+5mJueF_Cg6gx&GyTe?CQ38zqdbxa
z{C~9FQ<QB>yC&+iXKJQx+qP}nwr$(CZD-E3X4<xG<K$X@?K=BZJFV4C)z#>T=>2Mp
zHsXsX-uNUx`cs$JB6%;0sGY-$@Mk3VPcsEI^zey8BXQ?FG3U?@L<`H&-9S$=W3W-8
z-z70uxq`%pEO7O_aLt|v`p{ZTwPy+{FLl&QR@AacRI#i?LW2J*dq!P(8tRoOe4;B(
z#U_{zhESHb(A7QlU;9pwWeYvfh2X=SKw3`quJfvm4;U2}rmnDAI9h#S<w{xVR@nhW
zoy|#U^#1Ct%GN+zoQzAWedWJyrTG;mcZWS#E>ElL<Dm66@>;JkqH<l2XtYEeRi-7Q
z0bk2BDIpx`!u+){-&#kHf6=q7M9kw^d49PQ2rOA9HaT+q{U}5#jV9rYBH2bcdw<&;
z(sw5^04GA?%-iPnWq@vsax(8*lup>taPD4Ki*iW|p1<I$8G%QQV$LDBT$ci(HEGr_
zj(ards@M6IoroleWE*pM=<q7YbsC*mb*R|%H%XCNPm%XHBY>p&-1N)!{tzu~U*K_r
zrBZzq{)Q*C7zF9dB*lTovpvzoD;3dWyt1=q_bXJ*7<yy}o?swOXJKXm6o@SjoSnh3
z<!S8Vxr_<j{I7BzGFIBcX;v_<J&DQmAp}YT;KH|6JSObAc-6iNcw3{1>3AoHXqG8T
zP_Z{1vcza~f8rCLNny}%3G!^VO$>2Xyn@CspFjcGSxNH3N=1$trmBiz<HEBw-)88g
zy!Zo46QW9NI=%>I<R$$;O26@6Tod7P5yo<<+e`D#apq9^Xd-b_5kyz=L$>%lzS&qi
zJ|*{srTC=W9tu1Tvbl~Ej3N$~^V}d_r%m}}n0Ki^TP;iuG`mnkS&wA0Ng5&n-$YHI
z!4AB^p4q>L53IYPO7P#~FwAsB;aEg-5x>FNJW*t9(R}j3CrZx94aqskJe{2B7Zznr
z#i~DUf2r%}k0%OCB)`y^T<M1qqsKSHDnKJ>Q+Lw#tfA^&M%F$Jsitb^dNr3n4ym4N
z{v6QuSlm15dM%oH-zr;q-!2yX+;BdRtj(zYx65X))%#v0_0P#$SA_S^y`Qs{9B$Ng
zRNYS{iMNL#Ro0gHpKd)bXBA7Ry4B{nT)aP@KW|d_dC1S(e%dof3sAi6RsN4wEwg)-
z>O7E`^W>dbHxXRyd$?9XD!SA&f>H2P(t2av!liGDWX<ZHcqn{Qs*$H|L;?oF%ZSI)
zuMx!?$Xt#eU($?0ZA9nwj`hW_`aa*2*S^{(aaaRv5)AgaC7<ZP2vNYqhr#USd^JFL
zLwNpm%}w@lxN^>1(R7C5SFyGtY>{f0-n)OOwvA4l8TT2*0@07AhxPqlr4wO3I}5q8
z&Zjblj{OJ-7+eaKJ;kqNg9RV*(!!}o>F>LLW~K8uXw;0QJM~!_%a-+_knFL7PxeO{
z4*_&BBvr4&jDypu5PF1hd}E5OXE^2IN;)!v(!+GAg-N}Wt)k#ms^el*W?6C6dl*6(
z9A7PC<vKk@()*D<;3Vh)K>v~;15vid!Ey~_xZu2D5Q6WzwmDgDvj>9w34DE<->Dih
z*>wPfPS1$K7^0Ww`7Tr9Y`>T=y&GoCQQH@bQ0<bfw?oM0A#NpnH)CGtx}aKFskMq&
zrB%pq>%VfN+f&8>Tb{vv1xyg#^!xqwqSb@shj%DYNR?c6$Q1jYT?Kw+#q|_@QHvx8
zNj00)^%!LOy&1{-35dhjAoXFIb3liQJ{lR|7SSn7R{V;S9B}tgqTtT0bMu$hrnZVN
z>FT?WsEv~@#sQ6Z{-`w@>P4fR%mUA=P&iS^hw7T7-E`F&-6=XQ&z(V6NNfBk8g@(D
zDEPQ4C~bB8Xt<iVy3R?r&wB5yyd+V~FPMzk8LCPp|MeH&Xfkh4x6~HN{DrqyR*ATV
zj^F_yb({KNt5%}aF|JsNftRYz(=Y`FxN@UP_<K4NwW>_Ng@6W5OgF&s(oqji(ou4H
z-q%p%_GdgTvPId~OMq6+uEXzsf{ExNXE4sWk|c)O!OW$PP0co-*WtX)jN<OD56slN
z@kYE39J`0u6b9FDs4FNa>)3@gu15D%A!ry{(Nx}dfurKqq!x%zAo!(Pz1!9su5UB9
z6Q$p-tdm>)mS%@h5?=y8Yh;%Zh|7I-GjOyKp_W<~D%Z}p-Thc-3QUNHA}tJ$A6PrL
zXhGXg(}=nWNL1QvI(jdGY62tHr@qUZa@z8Bnq#3xV0OUjKEXNoYj(8B5LsE>IUjFl
zR=!ifH8<U|3O3fX>^qXNTC`+R0|vbI$!zPm_ssY!(Ncy#5%+ewCM@Y|WRwPxPrb-m
z@}eAXFr%Gb%Bc%5FlvBH>KSAa2ol;;>1D;Eb`=@XxDYr+vRa1?@VH1$H`cv>YJ*Kf
zoFJHIvei(*&Z}i-XeLHncY_a{nKVatNFjw~S=eUP&GdOBN04O>d4rJ~hIaN)g=+5T
zi5w!8BU{QOz8Qo5b6o2WCP)lJ2F7Jdp@v@U9<Ti#G{<NGS;4M-?L^lsN-U(yrg)9P
zstB*ueW)W@@m}tGYZUyHexcE5){*HK^g@{^HW#D)MRnQ)67QP$1*I8b3?Zv0Sju3J
z)*DH#1@UAGMWGa+4Bo*KA-zBFL$u50kgj@;%!w>)Cjkt<I^crE#qw1LDTb)xL$5wD
zz!-|l3s{VxA;7yEBZ{KcEyuzb^=F~FuSfvS0@?`QkUn8NnnF2Hdv@^z<dq?P9o-uv
zLTp~-vOdWP;B~kif)z~K>u*e73q#t7No?eljk7S&fQqR0DL3G;_UHks(Un!D&(X%Y
zMTbfm-NO0e_T_0Q*$IQHr*gQ7j$?x`lcBmISHuy?&Ms7m!+hd=b9h5|UQ5O#Yz+gg
z4;aDsOMtq=9R%LyL}H&w1HJ-X&l%I#mawhj7y)N>VPb(8|H&}F;Yq59Ie>b3Rm;Lb
z5=|{`ly?d*ihAuwis$64D#Gs7)!V1GT5Z_XZK~h+o-QBuHu2d@-rIS)xlQl)qMN<7
zbX1IaQlR<=r3mgWS~m*amBLq`x7ukW^eGqjWG0ZdILbgHOw8%et6QN1j(1|~sZtaT
zF~TJlLz#}u9iCD5j|&<%D`7t6&AVErky+3q;J72RK=xN)_`@on`N3nk!A}Dw%-Tt~
z2^0IyD{ik^HJkB($&%#)8jT+dLL98fGfdj!K?O{iIArCpo&l9cEs}2l<FSuz9G@(C
zHX!pV0M=lWJBB%Lr1oj&iJE|s(Hg}L{-T$R{*VGA!qxVIi;?PbN@5KaII<SRI~gjM
zCD9aPvZa`c``9J(Ls2kp1?`j#P0g4E6ab)do)1^er=X@H&y={sM>f1xDRMi(_soyx
zSnZ>b$zbY;o8^DYNegP^(FzZv{Wl^02-9YfTg>W^LTmM!=FS=c9-!`{<j3qmf#mQg
zS``l3E7nI?T}&@3Om2?i=&j=Fy6-{+Mf~f`%uK8`B(pNwo@Oiv+5pON`Bg<^3E?V-
zrp2N2rU!4p+9_l}nt>E~LCIT&tl%zAyLZouRs(kk@thlU`qiU0;^L~`b+1fYSNYKh
z8PE$br)Sy*z_auX$jZ|~dNyM7L+S!`BjFzZ<H+)iM9#~rsMUjNf>tOHR|wcsp##`y
z8hGY{MAPuwMl(w73xp}kJpMO~3_O$ry(xodXl}Gs`ToG(3;d<D3}x~xivv(2IgzBu
zy~+ID2;6g|905X=bw6G{a{mOEv=&e|w~L*fXS*z7hygsj(_tu>Ld{8a<`>&YC!M;{
zY@m#VGF;W)VJ*qcv%o1hm3907U@^ku{{@R#F}Y}$tx=2{)9a+Suv1R6_$qD}iCcyr
zk6U+(p`5mny=sHcbt1N?7Hsvyq1<|ndKYk-yjN^E$kg{7X7hfNxUs=i1!Pr9!Vth<
z^^T72_)iXrRw#D1={{4b)6HR&XWHcmN!jmdN;4d0O#UUNEc7U~1fxp?8c%jviK-9{
zsR`jz;Zn)?C6>>lZkGb?>*Wb2=6@dreC>uTf~IDkj+d4xPX>7VOB>>vXv!gXMxFo>
zN!fYsYV2TWf;BuMb4AI6F*Hj*BY+-&44y%186353sJ&+cYv7$O;fV(33QkCzb1)c2
zJu(ej?yV_Mcb<1WXhTRi$tiFUS^=3iN$$@u6iz4QJhzgG<Sq$Ts*$D?P^Kj!b6WOd
zVvPGNg#(xddX_?VxOF#XO^XOTsKPO3jiQK@4!Ngi38k_ea}ocmA<Of~&1USIWQA0^
z_n-G;+nDdC)J<F;CSSr1(Y>Nqze6SRe)K|T8FQ2ed9~4jTeL~WJK$iGsF`0^2U5O4
z$jZFxOZRrA8oh_!e6~iI&wPvHS3kpKnWD(o?tf8Og2U+&y%K$}51tOyvC?Y0r}@yW
z{kb1^&7u<rO_B;hr4hiwgT_x>f^+;2&ApCsHHnOL5XSX@&LKtQH-}W8XN`@JS}2p0
z2djHZV*~%v-V0>NX21s!?{#S6_HkzVDJaiPnxRZ2Jn;L%9HpVb1^owv5&z-C3DTX<
zeHof#O4&AX_vjLf4;FZ4Ka6Xl7Ak0+Y+*rcb-*F14%Vkp24;h#+#}?j@dA*nxW$g3
zPM0PivB9<*A?ku|9IPN<U_HN(+SqVpO5S$VkfPQ^l1M=c5820p(LjH+mx-T$qfnB2
zmh@Z&XtV15rn~UH`ux1l4f**lUV48Uyp-bdY`?#UeZ5S6rM~l){{&WC4_t3|y}#XE
zyoB0)mtOA=U8L}SHa&aWeFPelzQ61Gm~am@GnzRlW-dO`WKkaI=#fd=wLo0dFbPXv
zxhEu1p_TIYh;suyn}Jwfn&g<!{Nuk;+4KJOUro^y7}Ksw7-~6zte(n3wGn1G4XVOw
z%__=+pxf;_aI@IknsBD)sBh*ko-Gp%k(H!&i~j|_(#I$+teh{usM=)L0Myt9=#H5x
zS+f+JH|b0YLa~`*6c%EVR$#-C+Xl+dgQAOz1dxXOi@n%3V*gQI!Syn?3v5+K?U7U=
zJ}Jb8<L#4fTE|;)KhmoltH_#Jaok3&0xF0+oUbJTCNUATQ<aW$ck8>w`U|4kV1+^I
zd+^@ubc<9M^hMCpJ9BzHM}8iKl9I(ST#&M9#(2tVz=he<<!|!h*|16VfB`p)=i_MA
zqKDPue1lTVMG_|Eq2BCiKTmtTjLgL(N7XO9rt_OZLKF5VXlZo_G7eE{+3}(9KzBT0
zi_hC%`A+z4!Ra6LS<z}!7a>fvXGW_yhBa2)!&YX0jH1X<PfY`9TB#D%Cj+(4SaFC)
zHZ_ul96^o=F82YWXJDF*g$l%BI*|5~pKbcd15`j9<cYHAM>FUjBpGnHN(t@~l#b18
zvFZ^k_zDuo*`#?(AW8NFp|Qh=Y6IPqxF!alUH5*<2k+;?P6!9lCQg-_V!zomg=Ry3
zi_i512x0l_MPak%UcaY}_Tm%U;JB5ZT(aHB)W{}&L>c407X@uVdOURtxMM|TJD6w^
zHX*`}Uv!CS*YW><U6+O_-L_g--a_c|>3Ni8pL@3w0Q=YyK8f_yky?FO7LfS=pXpM+
z{V`ohgXq7lWF&%rvoW{osx(Hiy9XNCsJ!Ybj9acH@L;Sbtcjqa%R?49v&7u8iIXZ+
z!ag?LB`#JEi6m1^IO>jDi<M(A5=uV)4D1nqqs(%fVHdnJQy@NCLSXKl^iCl0&Z1V|
zMR2D^16oZXXU6OnOIVXf?BU0U5bj|qhh6<1F+tdCb@&B)R7Uu-%xYLEa;T{35LvNf
zVy;5nx(!LIcH>WVY2I*=(kbLlV)tg?=4Y`qjVXE3e=}PZ6O>Dgd_*CA+YJ(sPDK_y
z?q{+ByMia06x`V~Alp}$Urn4h0bX5jm<ZQLP1tno6awblJvi`%v-LO#w%ljJf=>1P
zM!{ddvA%zyZ4vwru|;eNR&`U5kPLP{C?4$gL$wf@v`oP2gFg&7vjqJutgxkwY=&Iw
ztJUq6<$LR>P-3ksLHFz13$WKITqP4-d)Z?(`Eb_Pgb(W31uG2c-K}Kh<Zv?gv%N3+
z?^ZUvHS5}6{i&)a$7+Ew6^fgoCLKwq%T~BrWNQ4Tgpcd38*aRg(>q_O^c=|qreiy+
z2Uk~j#m$Pm^*yXIX=P$3U%RX$3k)0`{$B^RX0YpV<`X!i@aVKmo)%$ENYnNdd{OVr
zoimBjG_q7&#?2y{=G2#~vS=L1uC~`p1r^ZF`0ed)n|#NKM6B6tU|r4u8QuI#g{zSg
zR{c*>!5T4gm>LB{_(aj=V10X1pVA~UU`JncmC<~jp>_(EW@_ap#;)ar#85#7JJ!PK
zyCh*Jt%slc|IRMuBr&Y58Q0S-tQN^5p&&6AsV(p!ix9E0i2u<ds<gTOm?c`FUbYxn
zY9yt(7<)Qv!`%G7SV=4`=~;>e!sr@JRAIQZI@+~SMRTtSuw*iLp{!=uD>B%1@{4bi
zAWu!AqP=LX9A_@@U<Om;#`Byq(4isSwh;{Q7Pv-M`_6+{NyzYd`0rZjdrbmc*J_mQ
zu@SRIHgxE^=xtxU`KORS%srH2*loA6N4_MKoZW)1fsMXeI1?<!02kABuV8@<NeH4)
zGV4#}zSAaDAm=2NMW6xfm!9c4^uO{X#>IP>Z|tJgFEj5z?Q@~B!B7v^!!h|_4XPST
z{uobay?<5Gk2tD-{1+;1ctG!rFKGg(Hvg-Z{%v4o(;e}{mRMT;y%ha(_viBA?teA7
z*Zk>T^2fA4hl}~q87k4*T?&1AN=~(|+^n6E!7IqHeh^SA9l?%EPx3%>HDM5xohX44
ziEdG)M_Oc-JyTDK$<hTNE#m9{GEV~OE#{iN!OEclh1`B|bt7&Bt;6HDTokY>+4)?L
z&k3h-zi+697W{a-L{-7G8Ca2?Z^vx;di%I23#vYi{DUZjy9u(t?pQBj1uwYX&}$q_
z;1F)yy_9q`HH0XFdGMtb1D1)oP5rxN9UxVSU%PBIScy_m12m9YHF#o%1N~JvzuuhN
zPwiK0DyaXFL&;CjO&bQFHV0qb;kTCX*ka!VctbM5KB1Z`+i*M`=blvq?_2Vs8tGv`
zQS#k3Mg6F<pDQmuE+t_xKFu7M64uY(3sl>oKFvZs$-j>()k`#OeJV@WKo_x=#X9Q(
zmxBOo8YQ{C6qmhkTrJFNn~0Ygv0as*9@gjgjSXC`a?I=+S*+&PTORx%me7rn&a1Nx
zA7KW8-OTRyDMqD@O^348i;Y(m>ZZ+Bs7Q^%mbWCz^_G?T%PM_qnxUMxJDAN-uJsVS
zo-`;$=Ufkk%O~!>`ldq8+~M=YffSWs<0yNWx(v;QX}y355`9!K;L7uRuNsRp9t4lH
zEth3@Y*6}=r4P#oI57}^fv*5%;uF_cjp79k4XX$GT6KHmvbk}!Va*F0F65g{8B99g
zq;R@)gp83fDi=2%Olc!w=4j2eyo=?QDdbhAkF}~kA;%}mTwuu7MbPF6lZOP(Z;<e(
zNKwmMtvIe<>oZz}?_Z|FaXm3m1|eGCF$yoITEveQ4k^19p)5*kG1hutu1@ttBY;7&
zu(*FpI}uXWyckGnmH9zMRMqLieb{|?0*rIQScC{<5?ctYK{c+`hVR9G!&F&&cVkvj
z^)YLkWn6equwp(~1p!yXu}<lj+nvITpsw>hH_%jYei?`*)bc>jK&Zzf6&1vO;1Arx
z7l)DT)8OQbf(>GeUTdN96z0->dvq9Ri-4H=RdT~dCuUDN#40#)xz&dEX%yiuCP@$h
zr`vt1Mb9cDBF<%+??noH7|40@Ot2+9^oRi(s}B?Vb$v`Za`t#eh4f|X5Qja`pGye#
zKEq=kp7wjh2YRhx^+y0_G`4k2{0_L+>i}Gs5MF7%SExJ=P$Nb<@b9V!{Y>mtT1z-_
zuGlZ^T6AzrHuirlUeLC#kM>0s9fz;Tp!HTX)Im_cWx$WX@p#n_VyS|D!U6X&6S05E
zb3)$R88H>F({vq7%P2G!cv*Ycqyn=@CZO>wcOY`Sj`Z+!zl^L8)W&SH<c`pz6w)j3
z==CuTY6eB}A@Oe`^+J4Wgh@NfKCcHLXJxfkxd{l#M57i<x^tZ=Vd)_*U=)v4^`m-}
zuARO5K}?v+Aa(~~hPr+JRLHnekI9d_@k}v1QbpRK>R8Dixb9&0!N20K&7g?|vhDe}
z0&eQZVLR^)gud5rKgNiJMO5F>qAPpcqY3FUVPO30$?XKkHp^~@T*ri5BFvb|2h-F2
zfWgGlLJVzDiqyRNruB;%U)-~bP7S8?K>(<I?jdaHD#HW_-16h++sj(RP}7D!7$+J)
zKkn~_aR0n`L$~%UGI*?MCv-7L+#)wD!~E7#LwI6pNKwm@I7Lphqk=Xjjz?Y)8`E=G
zM{F#*A4>;P$6O6%i%~BQyX(5KMt7s_;`PMc{U(e5%<q<DHAO~kM|}h%HI2c1$0mUG
z`uz;rERtV$(<fSWbR}v*%c_A51MWpZR;N4(e6M@Qze<NS15j4Mo(!#4^H(8?mGDBj
zqmQNgPho~S$2YXy%7My2Oxnz=qCiD9^Va7{W=vJVGhR7A8!X`=d|ns=Jta!vE(HnL
zmer1_$b^(RHZ>s0R#!c4D}tDf(r=pN0!z5@)xUd4*fzv@cU<VCD2pRah3kj2t0+^q
zQX~SHB4^6gc3)4As{o?K<HD$-E>8@KB`f}^t}JcVEuf{63$^M-p0LTK)}@>aa{El-
zPaKQpJF@+v(OmMdNghVe@JZ?pp*7>9BNbZ#KRLYu2hIOcNoGGl>A%d-&tdt$ph&{=
zKSt^3$0(ir$0_}{X4OAjNqzIDd&<*A`w9=uq2jH}*}ekH&n&<{&uXanc?R=k;_=A8
zZwUUMB#HTdGN<8|**2s$pxr-#jYLo*a7#T}#|l=AiOYb6JMS7rb$i+zo#VNfiY(ek
z&X6<AB!~TOmA5jj2TYbBuP4obah08jHChe4xuW^ea1`(&*~+;#5>Mlp)2P6<KO@P7
z{@o$*dZ7Rv&N6$)?OI11K5HO{1;>W~f|i1?m^n`rikoJJB|!69we*25BD`#p*LJ!Z
z*_|N^Aj9{<A%3R$fJ=@pjdYZSeioEh=cI|FlU`E-`Ypqw*gCET?245dT(S>)Y?)ws
z-W`iJ!EQ{!!T_s*vX&JqtXKWc+oeYt9Qj(LN|m<UIN%(e5k5}iATM#zGg6=SZYZX9
zpn@#E3B^f-HOBDzW6}Fe6PDTG*!xFdDkdyS2+pViqX`4q^!TPs^l7kCwx3AJG!eQx
z88!j@@Nx&%^!uS2JighG0IKN6W}{r05MbN@G+H^tLQdx#o*n!gK+(u!HIKCbl=jt=
z%gg&stNUQspaCzb<MKHNdb(mTn_c$5@pYyvj6{k`$QxYtDIl_Th^<6(`m<=le?B<j
z-x08=z%^okn-#&G$?TC=meNmM*!JR894s)miF(22sBfB~6J6{P<g)1s8lBAmGGalG
zaKY3NxV?Mzipml2rIrB%(?7!PF@S016FLv+oFaq&3OWW?FeR<In>aXf5POP(Ns@vc
z6OggMLT(BeRhe!Qzkq5YP4yq~Iaz%Px&O^&$77NF)mrJZF5k)h>=;Gw{eNOzR<)w0
zV)I3W?be(+rjNOswCR`V9Q8}15yCN6<setFiRDVH4fN4&v|aE@m2H(?KF*FW0sw81
zGvtAA_7ccldGiCblX5Ju6YRksEM|DA&S<lWh#>0J`2I()f-ey#IsCL%*xFOZQwRgN
zz~TUOJ13{|5D7f|;L)<Q)3l-P9m0^fQ6rw$ck4=`CdJJ*zV-IiaxwpOgFvzPLhWb3
zjhQMtR2dW>qv5H_o2w&3x+1a(W(DMonbeUJr@Ux|hdjJHf%q=Re-;a=OO`Q|knwwp
z7dtk6Mx_5exc{3`Y?3Xt36^Y#DO9jB`4A{UO9oB3@sr7tiRyrG&_3FoOn4vJJtMJn
z=dfBJEdTtn?;PMME^b>>3%Hdr%QND#@G#;-K}QY{a?)2un>rYc4Tc6BhRjOHrQ~MY
z5$2_6l9EngNV&FSkkl9vn(0iI90M;XV)vI6_^bd5(rB1!ld3yAdZ3JZ#-t7b*iGKt
z39<jFAA+cS&`ezor@PvRyujFDfZ-lf&Y&DSiD1O1!>~k*BkC^Gh`yU#X40n8k1w$v
zjul^VPvdZgQK;7rUJ5S3ul8^EHp6hjR&KZEi&T;=uDVNL_-+_FIId$TsGrjmAa3B@
zdNJ|c9*ksJLv?GKGbMKL8gqOCl^tm>A2}RFgI)u8q03f8MljW{LQB(Q0k}q{3EUYe
z;LJL53VZph79rAwI30##v;zqNCK`e0+waJ<8coKM0U~1lsbjIUbf)A*NHSo~_g?@b
zz(IhCp2)UY@#4!~=D$65H>Pc%pYYHM+U08>`K&>`K?!XHNTrglsX!Yr0jIsQqCdmh
z5~MA|;Z&mpMbk;-Ly&%}vlKmEg!7M2lT&5S`Kgzo6yHZ_^Tb7Fy_4f)I$Y{uc_b6X
z4_+Gfwqx*GEg#Mv%6=h$KY#bm0=$ZRHT5p`S}1*X{J3fr8+g!q+BgCHRk9CLsiavN
z&F+m-XdpAe*jb(Rw@7aRCecvS@3xoqAzoPBKb-8=tzV?>JL2tblV4HI$e^y`nCBwm
zECfS1!K_1kCmOC1w@5kqJFJaBUtT_GKqmmhgH%wNAtw^g60+`Ox~MM^gg`0QC}1>D
zW7k-n=BbtvJ-iq8O6d}ub=I#@T1_8j%;98&>6`TW=LK>#F@`U6uNL>*4-a@aiZyRU
za^hr2$@s?Ii+-sW#{!=e#})1vW(PXxB)4mcG!;)ZRt<6LsT<PP`24P<Bd`vvQ1C>^
z`7p4p(Fggh7VlIItn6pyr@PeI9MihFOrFXc1}WStWZue)^yE@gHOMK)AN~om<?FB@
zBP>($w&ko$eDHimZ7?A%!%>b%-X{JL;b<yk!sEQxCL9i1kaAqt>uEcv#xwX*RV)1f
ziB2)%eRoFn5-X=ANCk$zSGvLSW`ToRfQff6XrGA-%;{KC0M-m!%0DCSlC6fwtaMEO
zm4x#<zxjpOdx6+G5WHL@Q2%O25!}$<U3y13Y7aBaPoHAH4BZ;sO|NNXzWzX=H4V_V
z9%m{+sKAmQdtn_XbXN1mWjwK|=QO=E-9j+ui60*956R)JuFkYDVpGWZtSdSDyG6$i
zqUlGd&qC#6-{2prIgayL8q8brj_2SIuR-&WIra$to+^=5aD}n$uMh&m$ASL+)nAK~
z852czg6Lh3XP63hI(OzaG)?#2G8#~UA$FpoFCLIjjYaeUN#Bt+>o<U8>f;h=ZhQ;<
zw-@-5TLi<sSunMYd>kQa0R+oSoW_Ku>adV6G1<0)*Bvg?30CzaT1KSJeDqBwiPsn*
zy$Oy-T3-xY_<2Pv+{`oD-jJtR69&&a%{!YUQpI5{`1|ASfEj-{cu*w26w_EjyM|rA
zy8lh3U}PfG4EqGgpe#0|jcT^QOsmvbnL_L1m14{`#i`X=1kUR3Cv22lMSnC`RBFfc
z*w4D4SG@qRNYc=<OCbn^hinphop<Sh?eLTlV^t|LLgnx>3h#!Rxnl4v+ugCSeD_m=
zoq-Rqwh{<d)M5__^y}lQSvb=#q@oWkV9F!B=tg0R;{^lM0%pqJ$x@G+ZL&YH*jeX1
z@`y0YMSLs`lPX9p%j4t5%|so%W-tUuEPU;pngG~I%=rmw<}^gU0m-s+({~;0d#Zfu
zrz|t)t(ttbB$5%!`Caxf^No1V^-U3Z+K;`o$QV5G2brL@18%qR`y;IdJ{@c&2wnAS
zD}yth6u%Mzp<l%zH^3;{9Qze`z$NlxJ)m|HCQ?WO4FvTRLHp~99{@feN-}n6>d0i}
z{YP70P^QGN8J+iqdE`vP&v(U!VfBvB5OSUBXtPPJHtrvR>M}{weMu$9iqq^OUK4x2
zknVNW<kpK{3BzfobHldxr?)kdQ$P)!+E)`cUlXzo>_9Xz9bfgg$I}HG#Cx9*bCk%5
zze@d=P6<@)yQ2)ON0zw%M&_c3c*zV~5)RLi5{r-Zeqc$jC`~{=6NZg(!Y$eW)BYlu
z;vsl`O*w4S4zOgd13K$>nC?r>rrL5=vGD<;<iyY!JPA#$E2vm3O<6D1hpfFiDuLNm
zxn5lFV}+Y^X}PU1?wXfVW_)$fh2?y|us#e>YbC4k8X+Xx@`yr3#9m@lG~)lZM3ofG
zo+!vu9r2~Pe>;ScVJU1H#mo)iLcl+77GGn}HvW>2m={UJ7D=>)e)Rsl+N<M2tOrJn
zz@E9z;Y|-#7wKr)IU^CbsqWaaq!Qtr=r?!4TQ&@X9>$Q3f3ha=M{QiIQyBH2-%_g$
znG%n{k6<0Sb7=p-&v_UYU%De-GafHTsVmQQl;%%ddu06Xe06}Cu+R6f$y}r|f^f?n
zPymARWt3!3?cNY)?2&}zK3vpZw)+;WY6v#8gNWA`qqQ(Q0|LYv4a7=k*L*j6@>I%*
zYC5Etfr6DfbDHXpW&7QD>;MA23UKDzGWsj@l4!}k5_m(sk?~MFn{bK|x_^!*4T|_c
zWLMl1uTfsWa6aNhhIIsSN{pP^5D#A-$$4JF!b(}TDVnmfUj6KyCGTqBsf@@2Qv<Sc
zWCFf0dgv)lUvjtM5U#O6sW4rs<mIVJ`!Hi5O(da+kubb7$stQjF7HH?4X=XB;#_Q8
zRu>r_8_8VT>6Zd_=c8;tZpT%bM2L5ZuB|2pd#YWq!IVc5sRT7)pD*HCfIxe0fA<um
z;a!Uk=zN^F*e|BqLh#H&+3;`REN<vhR+v9Cz$S{1N%ctBN!%SBXlG}oj72J6FCkR5
zbcbUE#S&g<jL&p~2~ndO;N`(#H7T3_C6j)vkmNt?XyHc-J^sfZHM@8G2&JZ;7mAji
z7mL}S8y!CgY4ShB$VRW_2Nk9KoOtUD_54eWl&z+7B7gLe4+XLJ&jrl&(VuR*Ue3xt
z8fmFXHV5}VD(N5o^z*i#-WekJ$p6Zue_O4a-7Zq)21TDHY0J0?=V0B!u?SSwqMYE1
zK%|h=9c&dSev&7xRdK^Z<CRnnIdLK4*B4lZ-<Nm|DO^G2u={+MpbKavJg&5_%ze=P
z`96C7L*pbCqmM<L-X=T$73B{x?4NMgpQVJS3K(Y)$G4)f##RPb#*rhER!{Ui!b+GW
zT=mp*qnl#O@X(Qdi(b?Rb8os&*ZWZ-9`dy*k2B?LI=Sb_hk$_IIa|?9^jzAH?;$rK
zl#-bCx+V66C5Me#)ljlYm#MyRP6ryn79;Rre~|9rM;l#S={nfZFO>qZO%TgFGRJa~
zT?VeGE!{6QSesIi*dxI*3|^@sCR%xd8B3*$E|}i_(JWfF$z3R=5A_9JjOG_$oCxKg
ztSJVLWB7{`&O16j@P<>Xqxm|EKVZAh>(ktB$)M4$-7i>5S|oZejV#w!sUlm;<%rRJ
zA6>S}o@j`2t5mHmOeQyBJ>I(s!$QXe#p*(pW#|HxT$)SYl?&~b;#Z*MN$dx}SfNcX
zq^}o^E)-v!L%w{9#DYV{$fwK_uqzAByU3F&R2fK$nZ%Yyf8+PnQ0^B19G*JK7o)60
zS~SdoFhAGOCTY@~SF8lTyN6<V7Y^;qA!@6t3ZBICw;tjKHkv4VRD${ax(ujSwGt9D
ze9vrwI0bKtYvM-ZMGH)ah}aBQIxPW>@x2K6HBCdmql&<Um9gXgQi6(FN9_)a{iD*n
zI8m=aQU(X8O6AN47~a7+?zRqzZKC-T50A_|5p^y8T|CML)t+XJc*#8+ks^H$C9S6+
za&%yYdgb7!R7MIVsXjA4HQb1fpQELtE}X>uxRl)Y-q7{eXet!5lCKv(&9q%Rq&~ut
z$Q(x?wz;B2y6T>^<<}LpmcN(bjLqbnj?P!Kr2C;dyfz%$o2X=Zrx2(sXmE?Dg>}wq
zmt+BGNNVBVTyOmQIZX-8ARj=8bJe;RO}89hCN8In@XkyV+g;`+2N7c5{B+*j^RR@4
zKeW=ZG?1X@nrF(FkJns$n5goN346lL^^R|u+SjQ88%|OQItafhwOF-xTmYB(hpdmk
zl{92G<Z9PMgAKv#fLFeNv+-1KXpq7)GrO|i+{`X~{{~juaLLHqSl6&^O2BH;luGvL
z_t+<~uHe`=<tf8R?)yO6+vyxNqp6Zo>_s^7AZf}Cv%f@(aC|JF$p8Aa3^=crUJ8LQ
zw(&QulxX;-933Vn44ZID(~uq>C(-HZvS)3RY;6xa;MZfRN^pONm69_IBLj}R!CSU8
zs-rv9fV|QaY}3*jn%wVu5G8iGJ>e_*Hnw2-s;($;?7~IEYl=i(={-L49BU6osC0vR
z2BnGt`W~!qFMaM*M;QL8{>~k(1XoOo%*1oXxYhp3u#cskNW&?y9xi+9<UHiw0g<Sd
zA*m;{0%>Sg7bAUz6&i%%&uaKtMQI`Q0V}5%ioiD(oAIBZ9VGHO!DOKH9sy!Oy#;|S
zLY-EJG!=6s4kRHv@xVA0eizKnW-nSOQAA~*x)t$022h+HKq3V7z8;-lBFUOuvdup;
zycBD^g#2(8QHFVYb@5^_<x2h=Qwm2Q&-G|(XrJj}qBBG1biW_`o`u>VSimMe!lQYc
z>rsb}VxS~#oCksUm4~%VyZjF}hV@a5F03ki4%AOA+LcRdXHVxg&P_{5P3TqL7r;$6
z9qEM{4b<j1!}p7|x1fvfW)fzY!sx?to6*N%sp)BaLh?Ud09G7s!gANf5dWCa<IUD`
zpEP=D3SBFR=66&TAmWeonh5djo1h4r`>m8!Hp?3%QrF-_dL#2Buhe)Xze~t0#cy3)
zxOr|Y(}Z5wri90FbAGY4j>??(*v{0-u6@21+U%&JrJ&1|1kl~hhjDSzxRq}$5<CaI
z&`2esNj|wFH3qT9QurHYWK6tUT@UQCyBA$bk|3*(5GXe9O}1lfau2_HSWvrJ3H@1E
zv#V(oo(kUo*?z&ypUpK8-mvm(rvG4C;9b8lgJv8~{OFd$s>_RJ`D)Z}yjTgpTHVKj
zAUhMvEQ7{aKt4knE=ehryHA;6o!A@TaKu9^+XqvQHNc$Gk0sFLhF;b?rAq}szmTI`
zBwlIZv5<lx2}eGToIECumcaQMhRFM&&p6lHpo(tHwp=HhPN9-zMWpj!+jPWi7-~c}
zf9eAW@8`cWxwCib60T?Hwl-d;edHCy7y))A2W$FW^$tiy^Z=518oBB<jLtw1_u6mZ
zQNaY{Awmq6sCCOMeDng{-H()1zEh9|MnW0&G6yl_K4g6^5RyuC-=!;fVxcGVN;GyP
zN4T1XSvF|V8=NDRn;06IE^&+&FbR&1R%1H2wqx*ul22wB)ElO;x&U6*>c1+L?%CQJ
z2gxpnmTjuWs^m_i9awpNyYO}TQ~1dMerDmpw&rZUpaFdHY2`L$9Pu%DN`9b;b80G)
zoL?t~25lF~t-xfbuAIQO$NSD9--GNQoOd!N9IA*|jH4oJrh&S4w4L{5@PU&Vf71ht
z(ALb{vMa?ZVxSANz6iEJRsaxWO-{5F#gz~-Qs4oQ(1&QS`2aC&0d7Yt526yJKT@;g
zBd0&}8%W?kU34^*r2oiyz4dMc7T^lGS@21yd>e!YX<(txgNXP`tWkvR`fp-rxSw7I
zxvg4oYv+qTQu>S>e28(OE#j(nK+Im*r`Ul|4)hoy7~d!@&xxpx2WE9`Jq%a)u;XjK
z(5|Sy<PnrLS)*%{{o)}oIx@JnJNm}-dw8jYJ{=VZ@@yHM7U{)2`(=69sR_dRz0J2B
z$GMIsSjJK1;Q!M7jDc-<syZAbqHbhxR8vP1M6-WBHGbNc{laQES6vKwmd+9+d9+qX
z3f?oB5{vPBgws1!Y9p;&dtX@ijtuW1>`y7dO0C!<8{T5qa}Lwe!?CMbuX!|hGs#(-
zIE#77UmK>ogp7}J1PyVUr69y07sDrd*_tyF)6dJ-@cW`&Y-ZDs-#<C_^UcO>#EjSu
zF`9-`+e&T5o-`F@Gm3|8tRptDIN`G`JRDSE`!4O}K`}8lL?uDoziDi|i13AbLH#lM
zbwUo50I@4@AXb4;j6I>c2yb!TqTf)rUg^C;Mj-e7g=BDlp=}!iD^~g5U3=}&*Y-mI
zfBJE*;U-t%qD#9Qjt=L5CS}f`_|-MN(|qhD0IshOY{QNU!D8k|7bu|?>5;EL4%-1w
zEgP|0ukvzE3E^KXg#u981bMp8E4)vnd*X{eaa;xa$dR+Qj`VgRjM%Ayg>0RV_Tpu1
zQUEtP$6MVwwizh>q5tJz%2MtoO^?0Cp6Y8598#9T2zUbBcNQA3c<K$ZZyV6!<ggT$
zcGL0hv7l+eE@g6JSqs|DCN&LPjGVdtk(P1aVfIUCD)T&=ec!;=mS$WeobY8TkTx|w
ztw`rtk><Kgk~PjYf*FT%k6uzts*|0fXz1@k!~&aqI3`nUE94-f<Q{yl*M9v~g>Kec
zI}qV@_APY>glK#bctE6BW{u8yK^}w<99zdHVL6!)x_vLEyPc2M%iHFy8O!UVv;*%%
z;w}Mnh<+w(g|Uw6aRnU<JNfdcsCi;!!vxhdF;ZdJ-Ukb`lYkPkPB;z#Fx<&SbUHtX
zW5dlW{sF91^;O^Rx+-jOBlFwo3}SDt8`t6q>kSf?Wnc;q8r)goQ%`IG5O5bvE;pq^
zFm!&ZYGtr7Jly#jEWO7{1lR8gmyHm|JojAiYWBX4OI9bX*3G--Ct(GwhCh6gjyN&I
z0|<`F&F``$vB$uBG-F3rzYT5wH2IgGBo6%S$)N#jFaruQcAI?q;O8|%0xc7D5^H<?
z>C|7`zT+e;tgo&(Qbys1JUZ)1YM=6cFq#rpNn+2=k&-Ilvl=FJvRFdJ0mmXpVhu9_
zX~kvIEbDLFK&5ePa@(t<_)oeTo{p4Y)<+!s@`c}BB<@GXS3R0HX7Ux~1u#c~x+7c|
zDr>ZI*&H4*0sTv)lK#~~E)hC!V5Ukxs@hj`x6(f2z_d%jk5jTFMGQ{s_c0_ucvL|N
zKj5VIwp=FCJ#}PjjbbB6{*1#qAix=vZYN|sFI(Mh6>kl6w*a7xwiOlU&>pETgK}*Q
zz0jSF6UCS!1>Ldc^YMg&D>ybTa|83?&t$W+nifUzSUT$$WdrsMH(iHu<EJhEvK>xO
z3jSl#koS<%mMqdPubi&bV9|^#4Yc6{uL}=#k$$9bo_@5p#5gIu-f{m^?$`wZwYE2*
z;yMmabobbJo$zX7OWV)pZ8eE~#6(6>^QBe+i1=V|unVT3umbkV#uGG+C4u&1=%D$H
z=Hzl$)8B=MjW)tQ@&KD<l`tnNu|h=eG}<NZ3Ok{9L2M|cJ~DbnF?vnEdjxGpB-`~8
z`~3n3!}yqgZqKIa6PNS$DH&PR;>+pvtWug?L}bRr;39X%h3WQvJ@h_LV5<D8ipcTs
z)K+}xeH*&{Ikoo-GN8cinE=+lrr?M!Z<Ms5P|YM}O89Gx;dc|PEfhKA33J^Ldm`La
zRi7UoJC!@t<d^2kPnc)3=q@!^?mva1_9>8xy9tRtC!8uj=2oL=OsBvWhRZe`nzJSX
zMVKxCBK-vkIAYRv+_MwnyH}&Bf{FAf>N#{Q^Q0n!O@KciiT*;QND2&|BnD}&zJcO)
z`~6-U9IzA%w@k#w`G_#)%vt^|SjnNo6lp*rG!^O1G4hO#o0OY@QTP@Jw2xD>E+~ZX
zG^LR5O(b1{9xyTY$#(YcD%lBJCr1lSD-&G&{5^4nyL#SfoF;lO#J7ANkru!E{t!m&
zO)0^22UnrkGkE-D!^0IX2(X23&YGnnh!M2=yteE=TeD8hU8r|p*KtA^NPU@miYw6z
zR(h|dyF?wTG$DeW%Xuo|`88bKTY-XIrs<AkkTXIn=rD?(2V^kjA75{tv>Qp7{Z&+N
zBE{R^$cadEtc2rDiL_}@Di%OV$+peqaa^ZJK04CS*=X)<^Uj{EK{dA_Dqavvxjkv#
zvQr31Aj^vjef&gFnp7SAGY$~sfYaLy{d;{LB#<mG3xS2KXDyu{pUsdv-~K%(YbM{D
zeih%Qc1ZEQ#Rzr?s~QO~cCW;+5Tj8wl6{%*v<TLdOL?WRysx98H%H>r*n6?b>Kcgs
zj2N5A(^hGTj0jfdc|xmg{2inYW4PKOvN~e(uEj-hHM(&|2R|uzD@R7V;4?th&!~9$
zi*1D!S-1}idaFbU&o5UI5}QaIJK`G10!<HuG1L^=(U4Hopqi(khNXtRKnK~H>F*2j
z{PE(Q0;3}Nl25i?DC5*RkZZa{Z2YONrq_sggajhaiYRFjxkP|TMv9rgt`*ghS>=+l
zwTN|Ci^Zknih}ZCRJ+1&$o{YC&xz45K->iS<ZEV`YG*8znDEv`bX`e=j}m{>!Jbzx
zi^rcmD!`}$?OWP_);t{RsS7nX(Jo554$fP~Urh8@A{*tPM(J~@isf&El&+7ICBn=^
z{EdFXP1nLb>S4!P17Uc4-mST4y?MdjEbzaQPP++UsaVUfxMA$@`wP~v9T1It_|DGN
zln83q)v7N0#YOmbq86{<%Dlq6^o&Fb2M0i|yCEAlJbs&4pG&9x{2pkAt7CPDHCD`3
zzjCBY<ZIYBHZQbQSWRpO9y_KDnD;T8k6?TmAu`l(IrcKa;>}LRX;JyTC@#bx)T58D
zM*SKjt00M1_=RXZMj6ATDEfir8&3X~a0|qYJQR-#t6x>z$l108t&g6(J`AEB9b&AG
zV2qQ)d?ZMAEI_tJ9}Mx>9J>9kI!3U}9>{CG@0jg^kq31y&WxT4UF}$k;Nj_FJAHMz
zx+3xX7!<uI7OkvaiMS`P9=Fa~71@2`?Ej`lP;P=!1|jaH2>q*T_p!{5u)Y<ug<2sO
z1;}&~$~AIyITAondlkfX<xPK%PbChrAglgj57zEj7Zl;+Z$12=%v8M{_v#<Pa?aWT
zzjXns&MJ&dUN~Mo2l`A2hUW9s)<uKHTWPxc(`nW=$cndAnpSkhWWFR=Cjbc2{GP_K
zxzdb6ZIt!q44IMOoa8D&w;my@o6%&8iW|nf%puOkA>ma`wYp!C)OK`FYT<+%9ni!Z
zE!N!E7R<P2o381<>abc`GoDo(t)`bOY~tvGYb;^*OUU`uN9bcY?w9(zDGOU0+<>`~
zH<D)-CSWB&JO7N<hWb7PxWQ<0>^h8S`C_5R2*8<48J7$*Xy=sKa&nx8nJafpvTm+|
zSQ07IA#jYDHY=3a{XTOox6c$;fAH-Sp1MSG%V`~{jTycl;_E=43{X$tfpJoOF)X)r
z5BR|bsN`p)^0$VGjYVcxT@hOVnOYpelmj06dxXKYCHX<`L>^9ZE26jScs&D9*y-3-
z`scklQvIEDl2jCVWk>(yVd5jK&!A@}{Ue}_=V_ZH;CIz57#TT~daLJ_E%R#ZLTRm&
zE;j%K^ZFi>pL0EZzduTMzfwItxBsAho&N00_r+7d>(lss_$7NbaQyy$^UiwR)5FF2
zg}?EA`tC;Gc__<!>5Yr^t+zV%^_7~dE?YlH-WLv&=roG?5ure#=~Bc}d9F=%<0GHO
zciW^1;-cE3EPci9P)#EvlbiRRuxK?}(%1*YQ1QpX43-X<Pv_$ypNynYq@sp7QFk6m
z9|u!za4JB&EzO#X74^~LYKL3dF76C|+*%k%5xM5$mO7F<<<X-~J4Ny1`XUS$5Jhsq
zL-&pt@N24UV?dCzTyNElOefNFZkC53{W^?r)nm#r(s0BicboLX^#-NAMny33SG_CY
ztxV7+dzU)36g%P}BxF&7_4Qh0Lj5kcvOzxtKrAwB9Ww#}+FsejP(nZB_=-3&mZCK?
zq79@>l|CG2_ABlH`bNBP2;&e?m<jHX(6w?r+jud`@PmSQo$biy%~9}HyFlh(h(o+c
zBPgUW1GN5Uy&Db0a)#iPQ#SE2G*+nmD_G??t%o6M{R;q3>id%wdk^yq7w3582Ry5Y
zN3)?}_)`Y5{<us`&)vwp>nch9c(DpRWFHQ16!DOzT7~|QAVZtH)FS+MA(HrbjVrQN
z<2(ExK?(mV_J~Mj!xQIVetrKMhG8D*#)F#Xtn1eFG@}8O!HetEf;PsKt$n;SJ3bAi
z2`=qH>ieFx=NkRl$Runl1Ec~1;?{;QC?A1Btdik@xfJz_Y5$(%qR89hFSZFy@5_56
zHoyv}C=;#>^ZTaZcSJe8em?dGnm^)+Lk}SZBQNFl2c}pz%U0zzmzqt#dS$u%@Ni?C
zhj1Pegs^GWqs%5+4&S!YY3lk-Dhfy8Ot*AUK(^{T5I_Ec{uQqxw|>@UxYP`<VMLRZ
zP%6G<mU_PwkKqd0S|e{oo)*rl)}^cpJ)4j`ti#J83jQNzm>X(JnqJPm%SlOWc>*qO
zQRx_dhPk~$JJ*ypj<p?}2+GGU-?(&`Z%h0uLSlc{o3F#rgca(dqy&Seou#mYeJ4P5
z5|ti)9gyZ}%Quf`Y>!6M!Am}wqs=o-y^$#oq69$tZvY&mb)E@EyOqKx;Rn2pnvV6l
zG~+nTscPDjY1xN$VuclPPAAX>jemck<KL2@+-n%cKz&t_4d6_=2g0DoMmSMK_;Iv>
zG2%;w*+?~1IFXiS6m>a)iAp^I2wfACeag&@!W;zv2ouhmet9~DTqo6tn8UH8KsF^m
z)y`xr8zkDHg{w^O?-x@oqOZ5q-Q4H|Yu{Idv6A5HquAuuiC&-r*_YFipFKt;`s0=G
zKW8N>0WT!70vC?^)<?}lfA`okJu|(OG62ugn`3jBWJQKsn^Av6N*fH7d-hZETu$SV
zhp?B91GwZcx~?zK@D7H-w;7A&x|N>Rd4;>naiPFQ9M>k6_EBiOmn46K>3l|m`5an^
zPaus7x{8-ch!HM@jnx^%hw#ZDkT3?0y|)5{qK=xT*Pwf~)Qf`l)hRe<g~lf@6dv<y
z8r<k5x#`i1v;e-$=I_0{kV8|4CDAB#%3mDv1-?a3TR_$9S8^p&(;h4A09*+o#zN=B
zz;a@`mkw44U-C`bC{)EGcw*c@^QXL;CG$UD%ArmL3v1I7?CGtu4#c*TxnlG(1JE1M
zm(1UHS2DE+8_vfwql`{JFw%B;#nXlZt^?)gf^krTL~-GdzKTE#US`If+~3y9cR@IE
zlu;U`CQa6R7aXr$dYhz?@(*qr9rRL-dRM&}qH^!pAPt^q8w(rP;;)$vWQw)H6QdB{
z&q&n+W|}d>j`26OCe_i3rXf4BW;2WGkk$HT1z^O-Q={-|sA&R11z8)?Iw_nJu6I-q
zv{8L{4I7(2Y4l`VuBJ^;{)$?lP!Swsr!nY}J^X!0m}@|wa=A5ru+Z?VrAC{BPw#e?
zB<!iwiC5W!F4G`1O2Poe5_(~Qc+{|aqG@0)cxCdl;kPmfwY`;=NQR`3--kehf)AR=
z0qa+`^HcPcMPq<3?iockQ#HP{<;$D{P)bftg)<%edS;E1CLxe6^WZG14A^|lj6xKV
zl7d%gQ){}AHaNb4>U;K=bhsxHy5PAhTak?{xt9nK3dO$e>+NSuAmY7dt!LfUtq_)B
z@=maTj06}CGDWm1)zBP0xpg*~CxuLkl6kE3z$JO6lH!>lHNtRTw~5VXl%p1<E2e@k
z#q?5#{blWgtHhWa8t+X>H;Z48vd0!uY0#WO6bkf?1`OZaeR-TaK<Qrj{mz;Xr5LzH
zj|D5(J!CPeXz+VO7!B-Lit_I=GG}EMimE6J60pkb^2?R08nFX5X`6s2TPIP{71(JR
zGcIC2+0(#1?xycyWxv!WF<R3<pDQ~M6ZRGx9FdwgzZQSum8v2pMLU9frkOZf>$l;d
z+~7lgucSFK4Bnl?Rn1}~nUoB~V27L>j2J1#FIW{5mQX8z$<=q&a+O=x4zl#LyAYdT
za}-l}6ePE~!^u13*9l*n^H>!l?HyhG%wt7%sSf+aj*Q@SOpe=lP1wZE;A6}T!l*1@
z(UB|Fl>%Dq`t6Y1#=&$h&67!)_FKme(q<*&1u;jhq6s36j;;sNR*Mn|4SQcTR(?TM
zjwO53@LTnRrv20i`zTmIta0oL!@A;ih<~y%{~yxMaY?kGLAGt%wrzKxwr$(CZJ)Mn
z+qP}nwlU|MxOe6O=10YjdV?KVD_7#1)0XTZd4Y8Yx0zI$`ttSkL+l4TN||v&ykMkL
zo3ikY1#>Vn)@%GVV{m=ZGCE5V4uC!=Kbx-+05c8KmX_0B;-hC=FG3j?*D;@k(`{TH
zlD9YCBaD3g_vd-sI)FqZp%8C;jspc(XL6*8!N6|9#Cu<J{)srEv(D|L<27PRTkrFk
zu{}tEkqj`52k&`sazGCd^RA8$(;Qvb7$V?M5*29i2d(6B$YjiyTer|t)FB3z`9)kd
zzYEtg9c=fI<5nv90f=@H5GIH&hV!C~e7||duApi_#_WWM*;kAYOw_KbQiK;T@8MJU
zvJq-CpQIBb3EYL?YJt1Jlt&LZ7w#^02OPlu&JJ0%8IHd~$A}|_^HCs;GNu@W^IFD#
zJ2z_Euw~aL=7=D1CqJ2m3aIL??B6(pi0#-Bl|?|rlM1;}CFIeHK#3)%H(S&yev7B5
zuS*&^75x3y^0za`Sa)sU*6wT1^qV`2$Q+=RDpC_kkpba`!QG&_uTiw^L;+VpYnNED
z2X3)MN_K@>3&XIkZ1T!v`SQOrD<k_1b#<@qcDr;GKJjKH^y%Mz>gb?IFtV&yUi%0+
z|Bv?~j&mhVOi>ict*q~rjekds7;2-xD5!Wc8=*KG@=q$iOV7J?W3C@NyhVYsab*y7
z19h0Kfa%F9F$ZFyXp+b@V-w+_Q$wh(Mh3U;rE!UjMcrz_Dhh96?JAIA|2+tBq4ncm
zp9x|#%`-ya{NZ>tLMh$_5GV4d;HRttQC4iW&SaOC{#cn5ATHZvcH-j1c%jD2ssna2
zXc$wrA0#q+$T%hv*$GzC;nMZMNnDiRnrGki1jE#x5>cHgV<MaUKvq|J=Cq49I1GnF
zPnf5L)+q;XRX4QOIgFTg!#$^LF~h!4u*HVD8*YIUx=SexYKx*4kfX{ghZqrzK{2(W
zm`fu-Vn;f2pOvH}gg5ntNwqC2WuP%khs&bOOO)MNjDY=+QrrEII%SG+3Mjc~M%K+g
z-*7=h4>5~lWb85zEpJI`Z0HdMcJ^U#qJnTF$OQVt0mpa2Jr0a_%YcF$el-}e_Kb#-
zrBf43^`>wLlJu)F<0aD*#mKF~;i=aHxpD9fNn~C-g`@;*@YGlUETAq2Cy(QEAG1fh
z=T?^EfF{SOEx1zHTvCi@gmTy60GjAs)-bGbRi5!4lUmu-Zy34)v+x!2zTH2!YP~!=
z<8EyN5Hk)U<gZj4u3YV%<6Yf}(lm&9<^?-Yq&Z$cHW)3hgZERgf$eOXeA2SjAqdZO
ziRWmnrotHgluXW5hH2W7jHE8@JZNFD&OWazl{1?b;Q~(Qbme5hXfb0?eA2exwH;`$
z(3NGcnY?%U<gXdDl<$clzXw2-f170tQ9%grmJNjIDYnCVW^s3rb3ikkfEw=;wr$E<
z4jS+^nN1eT=3{sNAQAQAvoi=Ykm&3edd!oo)m^i{6isdngg;TRaRy@Iu-JV=Um#0>
z4uF!{8%XxgFM;cU5y=ESPkNY*sg7zxtp?WEYXNh2b!ep90K=(Kaav|{Y^;P*^A!@v
zUbM<K9;wOf%(o%sJEa8$=B-)UK*U=W@EFld&+jjY_P_aoen%Ss`;|FP0X)X_H1CWF
zT(C2gV(4(d$&vPe7@RZc0}L@=O%;qzi!L5;fh+o9dVt%Qw*u$8hRI6GU6U5>a6-C8
z@sN=E&+eJ=?r#3BE8FlAU#M{-<f*vAHlBeYWGYF#PJSbouFiTB^kMoy4{1P|T*-LJ
z7WN9Dz)Wh7X4uiZtnqQ5=unmHTQvDy{tYOxI)?1heO!uEG4?s>)EY7knykR6)K0_O
zI(=l@TCz5c=Ke7NghfsryT!F&h*3xW!2JX`?dwSt%A!L9WGU2<Y&{#&TM-ckXNsB-
z-wt{<|65(cUd*(VC{hJSxnA(IcTy%Xv>n$hf?No2rQ3Su5JORZSz>07_??bL4$Ad(
zdVQ6XfDtf<#!yIZ<iN!<okNoAC6&eykRp}Aswo?YTAASC^Bqu}D21wf%w>|lYpP3%
zw%-^@uH<%I*a!Bd48Q!HI(c{j(5>J1${5jAJe!wGffV~L3=1O|a1EOWF6OZ$5X>n|
z?eON+K%FogM{7V48ABthmfWBV_Nrtt8%^DKoV?#&-g=YcMCE8<<u+DV_tD2j+3=#~
zuvBww(^$z|yyYb#{)9`dVoGv@Et&(2)dL_t1gqd*yU56_v<T}F_ZXcC<SHq~STsXt
zGn%kB(@E~_^eOaOYCcI3K^l|wGD9H8!PUL<rp(w%=RGT%;T^(k$w{G<Lrq@S?KIqc
zXR_79hK^eqchJ>$h%pZwVbKlqdIG?V`%(7jO&|DsB@_ag?*5G!<~K;G38>;ImxWs*
zmkF{3DVyfJT7VJ_$X4ak)@J<d8Q1c^1zb4<pc^b`zv0sJjn~9gH7r-zQ%wQz6cPd<
zz#f2<UHysHRc&@n=Ct(6GtzMMd#dQDT01x%?YXi6&WCdMhG0pxv?A}WlJ+*;{-ze&
zw8`|{PS0o}DG1aclP&r}YsiYrS4Rcb;$(afuv$acQxQG}GJKu4J=`wTx-D8=txz~O
zi7XjgVaN`y&o6iT-)wVr%A;K9cH5Rru6wHn`L^8VfbL5c|N3_{kzSYcCj-9$`=CW}
z189rb*XMY#LNlUb-%6xum<Ufq)P@c%;)r*;)Hc4M!?_9sg?qlyMw0`W+Q5I{5=2&X
zUA_`|bh#IBLGj-sZK;m!=8e)9lwg$N)tV(Qus>;l_{qUDNarL@1ON7`JK9VY4zpNG
z06b%vg=l<|0b~vvQ(~!q53rh#8wrF86i-@7oMQs-Kd}#J)uD}^gQ0ndRA%%S0P&FB
zE|t$-Gs$ZX+RnmN8;8-sibOK<_^Tkum4Rge+I9WG=0+>mc<G{&zO9h7BsH`O|6+#}
zMIN**In!XvBs^HT)$iE}Taip&0a`j_(oD<+FH8nKWErCc3eKkHDvO=mRQ>RjkUrH@
z@s?AVS~g_qJ5j!^RwO`+O0x2Z4-eCxs!BpGZ~<7^3r!Q~W|Cr#l<;Cs!n3&6-aIhP
zO2ON%FkBw@F9><Rttz?Ws;%$|GhU{J?`Tt87u^|G@i@L-Lpi=EkmhDBD}n-STs%!;
zP6ShiM(PW1$f;1y8&j7>tNN?Fjy<7)X?@rL%Pg=T<QUk_LJ^m%>Q91no_>^!I%aej
zDhaO7xdubIhY^eH53TB)OV*;B9y?*=4BibL^a&iXiG6Ssh6L%$AGp$Adya1vlMb9}
z<1*QS6=jp;C}c3bVz$Bv|1ff4DB*@0lI2Zl-4O#M%TU~Zvd6208__*FxCCZ^NZS#9
zsEWVGR64Vryyk3k1a)W-3(2sQ;AlX0D2xhSS3zbm-SWv9j@=$(x`C>LsdES<Jw^H_
z9*{L}iG@n3j{Pf29LV8ZA_>s=a09Y0hKi#otJx#ku$6tdV&baj`{k%P^GK<y6a@66
zvx^rf#&{3rx0yi&RvAc8D1oOpT}5Mi_nd<Q2DWza%2kQoqx|q8`{(0qEzvIX=`u#h
zTJ=@8XOp3K;)#0TjgYLyPy&_|IQd(^w)=1e!Iqy75+G}00kbhDdPJiPIa}5aIL{=s
zb6C|1U_ct$=pDrL19FY7La>GE)o{tpQygulyJ)%<<$!+ho%)tz2F*ggZ9*+fu*cJg
zh<90MOqVwy`%pmuG?UeGWQe#3e~o4AEEe^IttXrvkeNVTB2RNYpLEKZJj4wGQ3}1y
zy>JrI13Yo>h9L8e9-Ku66<tpkd2Tv8mHV1lJGk*5dT^GneAIIW&X|oAhr_1#k65_F
zjg796C+L;J<Lrlkr-4^@|HH%dZx`I1E!R2-{7@Gbtw4GD#6>_9&^f?0rcM@x5X68L
z1B*;}>@DKd6>9~;;8L<N^23Vwg4S+*>RnncPY2YDT#sp}W;!?Y-Gf1nZ6w*z4V76w
z?GRl8O>x*n8hqf*whKV`%z!SgsyS3F!Xrt6isrCbBYYA<3#~gMXO!PuC<;$G)ucEB
z)89kxfZ@+Vwj&9ND&VB>IE&nnBM7iWg99FfpK3QNoQCpg9@mm5C^n+L3hzlwRBcB}
z%f#=n>GOdX_rj-a@~T3JWkS-W{loiptY{}O(MM;Y&M=hdhJfaoIb)erauZYV0L85e
z0v9Px&6}YW`(=SP-Dx@XV0#Ey%F{p;wbQ~u2QTP4amxk=cvnry2?*dxq%hDQzs`2f
zdl#3i_$`NYc+L2>mc^J9Wav_J?k7WDGwvg8>x~VF3~Eaq_8nVtlxnUj3Ye$W1Z^U^
zA!<RF^_ai09m<HBk~b|XPF4Cgyn>B_wQ2fd$-1-#se)eV6Zqu9U;KYv|Nm3!zwzA$
zkrn}-baMY`_8W^rZq>fp9tO!@i3d)j!AIj9;qfLd7q77FPgXHQm~R8GashBa*536l
zYbbYB*Sa+_+Nfi+{q|Y=(wtx?y$!yV1OzmNW`w8*Uwbc8LNN|LG^yTYrF9hc+FKXq
zS@^hiIst)b-xbGVZ2;kCH8OH_3ng@KL0&vmz&Y<&0Ua!EH7>K_t`j_fSgMZGK&6!u
z0NK24Razx<4pd&^F*n9j%)O(oN0zRjb-8kB<|<O^2h7OhmU^#9Bp4{kifOakF}O-6
zko#gTA3urWh4G_Km0@Pt63{ejiS3oS#)kVPz?fvmxM!#6GarsU4U~~qV4a>zu6Ud}
zbs3%>l{^p(f(uz7HgAZvs(HU2(C$C=`tE;zDrz{bOtS1-LlQ?DHzcJ%r@-PIID%BH
zp^%l#NLg^aZvV<UtNc+S9hfylBWgQX<y$FBr!Vt_UM@j6pk=oWf#*Lorh^tp-|A=}
z=@{H`sxX&!{5GV61Hl2JCiS1u$NF#4v~vKk>ZSA@Kh`LYXV`rAZ(KK%8LT^2uTUrX
z#W*B^LwSiA!ig&#3%7Q!stRB)n69Q#Vu<&AV0PG!g}-c1vB%IGs!M$GXbCO(4MZ8@
zF;-y)l$6*K)978t0<9VWqPcnI-T1RbLhgOzvBzVy+S85L*d}k8!X1VJa>t5tv#_~s
zD{Y+u=VlV~J>t-~I)uwpCY8(IprU}_Sa^`PDf#=o9Lexgk$D{j%9#4Cct7yR0S0Al
zCRaM2W=kwM3lZZ}>80*Ir4@$pQ@Z!ismX!CLh7J#PWkQ%>1Bn|&C5S|i?yjCi)ofH
zgG-E+nmoQ39tj{FWwU8u{&3B9KGLKkQI;u(TG92i=$2@}RRrL=ow@llsNkbihf2^#
z^0X*}oph9FC_swu$Vpa;6$6G*b!xC?lp{*B|FSyqzs~(qa4;N6#*0Pah>%VyCh7wb
zQ+DG!+9LT!6l*=2!0^Z@6`+dA#u6M#_FP^lMp`%zuf6XE&SsiIXD%e8pB(hk)WsJu
zQ{Ehp1cS(a{C5c3B&hfuVtx90krPascj*qj&H}C){Dd3V#p69mc7MY#^6JOVedAE^
ztxEUZXjLbohEW@>mwZerDq2)+vm`HNO`@o;>P)sKu~l+IJ|^`a{%L**kf8Za3NNE4
z9B>q%pa^Bt?ucZE{v^>00hU4VWXf;MvNCS57?D@Dp-lztDfOAN1?~z+jvg*j2GZbo
z<wCv>zeFJFThC^Lv`+6DzhffVC#faPF~2(cX;R(-a$C{0k9~CtB!*SlF1DU(OF-;M
zpo&ir!X(g@`8@VO)lCS|_K1#lV6lkpt?w{CEOM#xm)4Fq=!<f)sLq9PDS{`FNg_?e
z18j*$b5iB0J^0-fTJP!LOawU@iO;Z#TEo!fp9I82t&5(Rl-OL)n34Yd6(&-OWMWi|
zAp-gmK<mA<zi=2hO+Ru}su3$=2O>!ftXtr+Oa?hr$ZPaYdP62Qfy>ae1#T)59uFeX
z55gT*X6k<?>Zn^Akl|_yUFU#iC#yF!LydSo0?MY(&AhD$(oIKeR<K%l8_C6|d%#{p
zskl5CfuZTPF;0OLAE&%ZLa(S!J&pbGbPpxvw7ZM^8xd$NPN`dU9{7mssu|z4*?{-F
z#HRL$g4ob~cwNY`v*5CWA_PQ4jv$3$fXx?OJk#t1BHlVKT{95j85k&Cm2@VRjh2II
zyis_~88IIhTD&|Vfd*D2vR^OsEPYw#hXzhWWsUuPyqpUQztd}uCd$H2)`|pv==vQs
zY4JS?OW*&9icg{Y@vHHMXqP_SvME>F^nA^n94GZ|wAiN>3cL>HbB41l3=wKlrT#)D
z=hHT2zhL_?TvKJZx;Z)esJeSvU5q)9L=5&jVAXLn=vTQ2(=1~rm9yaN$95A)w0%L$
zmg+6q>tV+j!$+y|W&l-mtV}nypG}yHGxNJIM|MtKvLq>y*%Bs79F=o<VITRp6XX-$
zu%9Yswxo3OeGg9`e*Afj?&m%aMVxCqlByTm`O<=nk+guYhZUjMwO8gt!W3AGF^5>e
zV&Qy9_38e>m$P$ucrFz*S8RAt?*I>0Xg6WsAzhoMobAI^WLfA7)7Q-Q14ko!czXg?
zTd89?=tdW2Cu+Y=GDP(t-u*vC>xBq$evF+~hMOwdjgRe?zzBCI-y?_NAf6Z5U2P7o
zzjltum5$s~cF16DHXf~*pvY2|s9VBQne%ik)*fMXymqrjTU0weW~WYFF-CPpK1!=c
zfvORmip0MJJC-BWlnY`-(E=%y(w~$Ax1wL)p$%6q5_?@Wg8e0Nt~RHNnf%GB3|(zf
zB~zwBlaU$7p)T<dYg_oO@%u5TW#udRd097^1W-%!Y%FaZhn6*RyC#0~p_M$1Xd=U)
zoke+ao&ak(@YC<MQe1zhFSxJbQbVhn=NDxX$nRYpv6i28M8(aXh7=U!N&pyTd-7<9
zP}xoE!8_d<GV7zvT$rukjH+~|QWBG%BRq3;wgcaX7>_Y~@?Nlh3^@gknI}Pzx|h}V
z6f}s^E;k@R;qZ=jU`t8pUo|6S5_eOO@N6;6l1lfIcB{Djw#G*S)JWJrIWWs}L=TNs
zsffdD8H!GOI6Tm0J%}u4DlQffD(RXr2)j+AE|Cvwpa*nD-r4u-PQwRs;9P97`#;i2
zrc7B5!cUf^3Ur4WY2&(T<HLAf)5LYAt!;*K$bLzzjbj#{v8|&>i^2gh3CVj^Z~Qg(
zwI*iLnEmK{OA?RxL=WTL++7<0vq%6emENW~tz_p}3GE`c`{30Ka*`#Zu`Z~KBsXqD
z2B;!0+~B^@txqvzaINn<pdLN}%=@9un<D6c4*&cF@nrljOf#8!E%bAJx2-jcpI9`e
zqV8_YMcwGc(fj*)@NJ=hQ1?Y05V(T}Eg>anAqeG6h4NbFp&~%Sr$H1$KrDcQ#^;no
z%9ph>=W1xc10cjdpHLny!&gxPI2z@Y6kfnvO}wWFe)UFOPcAZTx`vBFR7^t!ugV`Q
z@;!I$o;kL?)pny$(`7$&hHbDUfD$cGp>vDD!2)kjajbhlJUpru))tUG+$jwCV$lZM
z9@)0JKKtY;xo;0@_@rRX(qFa5{cl9FG9zyk-$%08f70~WhD<;{T|=b2n;Ja~Y{@}k
zBW4oi=iM@Z+fMDgUQ1-Uuy}q=h~HYFXcgosiP8Cc%mK~g{^@TQaY|u7+X_q>5Dw!C
zy{KNivA9U4ie+@l-bw+k=p(itf3iGlW;;&~ppfac@}&Znsy~NV^dSh2NU@eOpQ13l
z+@xcfBqu$LdPt4Lxr9K5?oki~88B)2Gg6O&gOWhx7#y4zmk2SaD)2tU>fNpgB4g7x
zey@^34?lyVG}UHKcTDEYdf1+_I4E(OzD9!5H}#cHEYae#?>MWY_<q+*r^=9@J<c60
zLpv1%(t7VZj)~MQL@lxC&k0UDc&b?gKjDC#OtuQkQ-rwUS<b*??f9gKn<awE#7$s7
zCM81Nk{o`T@;IhCTxfVKwYO3(3th;9`?bV~veTf@8blWzNQbrFh3?ksqdSeEWom6Y
zT)@mIyI{}6-mM1>?EA}cJ1=S;R>fuUcN?P}-(B!K5U)aLznJipyFhrG{E2{yKF`=S
zbc+|v8iDPpwzPiODliWE$?W>RY`Nwek=bmez&ACW)sQ{v`R)g+n|;5i(m#?~j<aIu
zd>iUWx$}UBHFA(Lx7#op60oi};T=}zVQ_Kvr8P5?lz6cYg8c5(b*+wVe7VqfpQN$^
zEg=EL`<4xXCa3}CT>Z%4bi4>~xYV)D=8ix6fy0)29W|$|f9!@{MHa}cw#|4$?@KW3
z>5TT7(u(RrTN^!mx;?LTeMzFadkK!;ELKkye30$h6b9TK+HQbTtw#VSBtev1fA1xL
zNutc)Jtb!d_?Bh-KG#S(Zsh381<Cl1*5~o;bU@0xLJ1M_4+%b#V+y%$TuOnfo(aGl
zIfPuUe5n4;ge-8PQQm~D{~%R)7?OJU>D@z{qvc&cPZO-1Kq$Ek@UNgo(n<UuFf7V(
z1Me-;KHWvM*9{fe$Iv)MW9#@U>vk6+ysZ@=wbZ`Ijuz3n;eY!b<txpE2e_whC^%d_
zXM00BuLYl?cGgi5VxCb)Q-}*4D!jC<Gx8mHnk*|*S94Rj#FAh1N1hN`U+mf&44_T!
zWsczKy%E}`&WAh!ob4q*#zLtH2LK{|GnK(k<qtJ!{M6%VAq(|*+;<jcdwKBk)55LX
z<oB}qUo?bL(-;Yvr*PjbjhrWKi`C~(imzi41?!<u4qAG_DsgIsbRC}Z?KQ&D+9^!9
zU?d((aXRG-os?~xxt3wj)eQkWBP&FW@pOR!>=F#<@RjaUF!swuyonjxyOS@tp}~~`
zoWaU$-0|<6=s4$3j>qKw_?KY+%yJ2Uq<qk{4E`z<Vs)J64s#=OCcOEB<}&(1ZO!3m
zMy$iVK`ahuy`m9^P%&(1Ck5+6#3<Duk*6g4TM?+y3t(99#0$aj!Pd7=gQ(SJm8q2+
zIc8<v%uVxj&V?d{t{%uJ8KzHHF+|nkdhmD7rokdp<6vuJ7d3C!_DQzd_LcNLE@Uf5
zN#B4w?~ib7q~EsX`fYy6G>*yog1)66l^z9Cj#`Sc+>vVAx1iiwN!j6Gy8bK5`g@_)
zUt*z34k@(`-&4n=Dv?J(gPuaDM_6zK6BPyCPfYjiNPNt6Sx2~{%20gCb1F+FO@ax}
z)XBc`jsfF+Rv)gM(W;FZL>^E(01lcOLsEwXF3vbni7*F5-o;QXip}z_T8=z)j$h*z
z7e@991{h+Apj@0baV7j}2E69-uoix1zMfGxNduxWJX4w#uv2ivC6V6cD6OXD6j^X+
z;R#dslOcsw;Et-6NjJDxh9j1kM<(KcnexrdX<=zo-k1E*1uiPIZt~Q%ij<R@ASF7>
zBH5(p=^>XY&DE7jBxYFZFJ8kRo1CV{?25RnI;k%pIU36^$~l_LU~f@OUn?ov%-JU_
ztwzbZjT<eu11dIJF6R|&=;*bUjc)H1Z0!5Nn;ogkRYyrFBsc~#;T8n%wzdQfaBj-t
zaC%C=RKRglHc=wg7gI%gEEdIvPQ;qawy+ms+Te+WbUv=aTRKe#HCPVdl!2RAA3W@^
zZ=y}RH6J{wAp95EHEOk9Oa!)nGm*kK3(3F~g<R#}hps6TK^(lilgnp%t1hZ4n`%f6
zLLMFf97xh7G-Qg|hR|5;XE=;?mU|-2Ie56w^A;I)bn}-Pa@~JCV~|x<(tH(bqd>*$
zvXH%6a=Kbs-ms6@rh?-}N(N^f??n4kA->gyxz|FLc6Kqe)Yjuh>ctaQ+kUo*5c#as
zG-Qm-L-i$U*Z59H`!eeOPW!Xo-_dVkL@$As!9$W?%~c2$y5Y~GPUeQ;GZeJ&lDp_o
zU&lTbwh&?Of-vX)cn4`YlT}r|VJGsD@!K6AdCEt|Y_@xy@2#pgHFwd}ETgRMgf=3v
z$JPk|u}~hW06|xm3-UORe!h%J-Q0}lw_en5F|ipjp1h!7rPO332b4US$V5DXcuq^!
zYP^eBsKN+VkIBYN3`wV#J&}o2JR@FGCL;-3@JAx)RE3JM0#hG|Y1X&@4>9%!Q=+{Z
z<+8>ApgV<Rx_xR%y@V?F!}S=9YY_z1{>v1(N)enzqfWU4DbhN*2A8-?1rZDP->9;8
zB;sEX4I_#3kCxHw=>Je-TsZ%zvA}%Z3Z<`lmPnp@xvEX~_ySpg!dsh%&821+caCme
z+Zs?2>fP*uI5bKVmQsEUjRYN7sCLv|*aL3<O^Xw#%C!~4O|pHRG#97(*Tb;a8HQM!
zHZW7_*SU4#HfMcw!2@+_n1mbec<2LFbn)fidGyi&hu$W&LR6brksHOdzW=*BbH$*6
z6b?z&Hmyi#=SS@*<YcROW8(Q%OQ13mN?y{?{RnzlheBTI_sKZWcH%R)o@vLSCM&xr
zs3lfU``=>;er|8<P2wGILI+&;;XE=I-aY1%u9)tv%aRxFv#waTZPjYbzi;x&e_vCo
zU%4zTx>w^(K1IB68U2^u@gk<wIq<%-zGLgsBsk#UMvbOYywbP8QhpFnV@4F|m4j?T
zLXF<{M-|-Oq9nqxf=B1v%j&0)+V4RIpO@eR4;;4uVD9ArQBLzgc0Rwl2mL{c613j{
z1=z!DSZn4b!jy!}(O2@A2+=dbl#E3a*Csw0f)2YS&=4)Re#<#DHTH`+Q_4f!u$R;$
zuk!xD+ejgvr*{(P>>ctPU7h<AB)C6Ncs3RbK-(rwIb@NDo^o^z3JZ&OB~c^kv7*-<
zYnA6SQOhDINftwv%*{r7)I*SRK3y-UXWHP=mH>p2*eTpbDi^|Q=+hN&HA@+(dv6=a
zpXfh61>ig&IWg#3xZC&weBjC`yNv$n;h*=OT3wO=&QORI!l4&r1UjF*Fz9*927jfP
z7B$UpNPWtlv?ySciui2@H-`A}eFrjLbdT>Gs>3GQ#rHjRpWF)WW+mFqwoRejnBUdx
zK~|wk<;Ws8$Wklj%~#Z^BQ3Y|dqLcQga0FVZ(X_mWfiZ@dxT9bO|+e?H201FzEJI1
z;zNnF?B_I0#M(@YPMJ}FX1QoFP_9&LuTX+5akZ5*Cxm)(AflwFI`@tfX}+W~qI_Dd
z82CrWMcPY(9Ja*XWs%kz<yEW4A)yPRd897K9uGCswMG}=r$EP&mcwkfZtzW;BfL^H
z5z<NSZ-~Z)(D-x~sMDY4=W+cMvt6Pvc&!!h2Y4gPe_C-Uq$=I|{hTIBdoYdRzgjk%
zGprruYV_@^@d!!;Z4RihB6RN)_`v<vsV%+JOF6Q5hJIwEt$;GyArLorM(w}W1d`}8
zu~ke}%;X*Au-e9%wX=~vHBp~TE%e3v+Z^&RtS_DAF1yVsuLG(|L}E-pkJ&_yWw1Y4
zj4XoMFL{>*%KD;?i+?OdTwDOL@hy|XtJ)HuCVIMLp-BYPOmIAI<PxSnBOBtn;l!6V
z(1IL)mM_sxK+IO-8Ov47!SKJ=aTZ;+f8v!h0)gQ4vw|KE2Ul-n#Tv;_9<!vFQX+RA
zA$dulZ+A|mV^fZ?{x@hZim!nSDRVSRo_!P6<yC|nZN8KPF0+Q>4rM-bU*s3ew(LgG
zG5wjKE7n+*dc4d$@(pK|ZP3Tqknlj`cE;w3v$MR!ix9aW7#jt*w`B)^I0<D}^Q5(a
z0>GH3;@>5{1yzT2M}WRAB=n=1{#4>F(?AMKyYgO~tNJkU)sJqL8<p(#0QoG&cPGO(
zJzqG^8}k5(fk2a$(UdX&NN6_VUsW2}pQMQDsUK7yVGT^@Mdond$q0-=Wo=c1<hkhC
zG{;+O+#u?iY<JDRNJ~>4^y=5sx7@^8bR+^pUbRg$&J)9us6d8pWWw50a%Xz1vIs4|
zhblC4G^PvH(h@^uM^C0R4Z5+V{CgSqP*y{6$&t@f{29T_+0tO*>^4%Tgbo@0nW#}&
zP?2a`E*y7`Z5Al)<VEIgS~!7+RF0J^AAR1@kz;)&)<6C!bM95t*)Ve|*pp=h6&r1+
zk|fGFJ3lm=foUQIaPS-xYE3UoX47J%bY3`OsrprBVY^OcQdt^b`EuU@n`y0DY*gFg
z5s37xDRLNy(AM@{l4e$A?|IvKKl2c~;kW_o$JC!d7MVkhFkHo=_jrh%$;59uLv(d%
z3?{r_akHGdOe9UGB=aNv=W={-Rl>4}MK6y?CP@ohYkQ?QowR-MKMk!i|Nft{IBP0H
zxlZ98!1^-{Nc_-lVG&?7pfDh$f{P7<*@9ON=yB?iyW=EB3j<Y<uX+&XyB)H#Y0@?_
z#NHaKUY(~ilR#avJJ0k!YYjBqQT3|Q<@Cy{sA|2(9pRrP=(E9olBqkr+k*qzcRU)y
z;*>mK^or6&BZiu7oDZXh#~GqM#a+!dqI(U4;a!#;8dDGec7^Af7!ClBz`4@e!}#@1
zOj|^0J8!Eg_-tt^C0D~FoZaS7RgIDK<bl=T!UNu67YZUrLT;hnca4<j!GZdaDH2d>
zCPGzXr%J+;WgEgN>{WZ&i{N9(Kg^t@c}5L8F)}#@V`Lif)GX+{YOCdhtrz_H1&_zl
z9`H16WVy#*#Y$oH%eeW$6n`%w33+@EnKP6ueJgD6uZ-VTwg_a2cpe>0X4!sZznCB>
zrxV|a48>f1FlOM8=~5hW2EmFPiJv?d*$1O9T;V&_QbUZblS+%Z!Qa2`3vSp^O?GPr
zDMa>Dg`3d*-nMUP#_*yeo8JYg%tX_vn_O^xNEOQV;@pde_4T^9CeG@=?>?(TH#>t@
zH^tP|*UPhY<S43V$BB!dJ(7(1{>BfOeMWfU5$enuk)E$xTH;CF##|TgJ3t#Y%eFU;
z3v<UZioZy>bb#9Nssd$`OJzPbjXSnv5S`W|9r6fr;k=S?)Xc}d#K&#ZEu<uFS`!pc
ziz2UEQ~AUob2Y(_Hc81FVb;BO9nfDVx>jXZ3^t3#RRWq}cVrfvYT_nKqD{=n1)z)I
zqPAs6#n!lEqdwJZ=)!P+L&_0Y97Sd+Q*7;jMn&QW|9E=cz<Y+HfkQMOogM()Pd-|$
zIiHO`))&ZmQhORvSDk54mUk^QAZ3t-a<wy2d!VL%-dz>Bpqxb|to8v$UvSu%cp?Aj
zIIN}F`m(i_RnKA1dl7f6V$V;%q>;5|4p03J3s)Oo(0!P%xWlyn{<BsrSr9{B%u(#1
zKD6J9CXjEoP_>5^owRiO(h|eD2GxU0E)`JSpxPY*<+5Re3#+K;YbXu&?5Ao_B83Ip
zPv?Ao%`!?B6)yJIDjq~BErnQkx-3m<`nWC???QME7`qwxihJ32mENDphawN5IgT-`
z|8SQ|GdQJ!Vp7Haa5rRpfJps5@O&q>OR@_-6rK8W3dqR{r8AW_SLqU=ba=ApDxE}<
zkQau}aC^46TT!e?QiZob+%a_;G04wc#(vL{STZ|BB(W3vqg;j|9>qK>cqp@<nc!tZ
ziX2}OnL>hs_!fap>+`{6BU@R5=6L*&j14Zz9~j+V+D}?^oShX~Y+?S)7VL-<1JLE=
z|22V0p1tUZ<mhkoo!le>=kaBA-JGNj+)%Hlo1~C@Z+(snN%ykx2i=M&w>mjKFShxB
z{xz%ihq-!-p&K6;r;m}#Y1Y$mH9R{H8`#r`L=+q|7wTEhb!RHhU)Sozk6)%L&Tehl
z+P9~Mu5ltGHEP7zH$<@)(yQL;n}1D@X{jpOTJ|ag9sYG$8WNtXP!n5h?Ix{H$B*RU
zU+Kntrrx#wq~Q|rRbI+J^}whPKNKObBFYu=vkK|N6DCSrRlthFd?Fg^rvYfT-Zxl~
zz&5c;;+ay5thq*-NZYZ7ci`YmZ=cwz`!m}eI%TR&0#nK#*rVZy_&=x>?xd6_HLAMZ
zl8xfnFQR7jIL>>(N}@j`eEFghw7SWqTkT__=!ENtrezUJBk@KBdF{cgSyXK9GsqM`
zcz(IUtyTnRt~1M=ZsoV;;SDdZ3>LXJS|4RcphHQt_qoy3=A>2sZu0@my0fM?8ey6J
zj7EuUq*RX<q?AZ4ONV`=*-lZBNrj?@G!9Qip*K>?=E(F3Qpi{Bt9SS|^vwbOQnf1;
z7>SC=KU>*Iik~&bjK1+hF=8$?!A%l)^^dCU+`g_?3og(SX97E^F6Or{I??NW{rzqM
zlt>x9A0qk&61d9#z298xeH;vbV!a!RYVn1mMlRMZWNhD-?YcxEK{x79OB?k>l*72#
z{9xOr=zaVCHTTkfFz*%&GOrq}XG+=d`#kWgI|MTfcm!DY#s~HEnc>5GFuVzA#0)oP
z_zb71tbT`&2S~YPTwiPi9HTzWBnnW^$(xh}w3HZ1pq>efl{Nm}JLE8LUg!xvR-W}e
z>MqTCj`tsk@eAW)uS0D$0Ex14(zn`7yA+8uJqbY9w`9pqs_US`!iJFEs<{=mOL+@O
z^p{gk4cHJ}Vg;lQWYWEM#OBs39J{P?hV)ffvo+BEDF*g%rKsY*NGEx%-WXDWNHEVs
zwcLXG7`W_yNIB@ZJO5Shp`#5_tKYHgA~P2)q*XP1PYe?<v85$mnbI~&yA-C8vNwMN
zkShT5K_4qam8s<)>;i**4o@fumsf0oB5#HnW(Bp3)tADU6ciuFcJU!qcBJ%RArDzQ
z!M#_w&H}G8+3Dx*QZl4-6E!``A>D1S0mvqgR~%lct(i|>M+?$zNJZQolj0>A3@po2
zKswQ*V5gsB!LKB#W4Jz5Cp3PhBTz0$!u_0W?H}~FE(C7b{t=0WQuYP>?1!(q4<>$V
z{J5mAd|3-^JdI~7?)_u>x<urklp@xN7=CIwAcg5MY7CtN>YH`1=KUHSrgbyr7G4hH
z251t8<_0J%Q#u|}cL$tQRuk0p7W!7Zc=Tq(pv$tzPTjC|5OvcKwTl9G(S>_tp}EHZ
z8~lSKPk793z9ahtV!bn&Xm!01Sp&Sbng_sIjL0Qg&-JP2jX5%YMHTHq#8btkg{6@V
zWSO>Sw24ynqAp{ug#E2cTW4$$Sbk%A00c93OqNBhgD%$1;`$CK1$Q37g!0fbuZr_)
z6+nnj=G3Rhsz-eTAa|k{g<y(kFM0UMkP-c_H%xg8>Ey0KlyeZ=GD3?d3}uJfm*9|e
zg;VAezNLJzFOx%NVFZQ2J)9h>9hIO!cj~Tjy~ZQ2SPpKHW*?2Zj6<bY$Q%1xAJG?p
z2NG{F#mErpb4&`KWsg-D;kBCw_aXbYtF{SSv(Xyugo=q$C`Igq3SCyVmLC-WvLE+h
zQ!=j$di4Eg?6X%O^5xESo(Znx>P7dyZG!Y_5xfVT!})6A2=g_$rF9$3Op9Y&*0R9D
z7Al;tj0j@bw4qQDR5Q4swc`g`a#<Y3^TdmX!agGYkHEe*tkkct{S#v)-?m_nmeo!_
zD=mcwlU#xEhdrZM&M!oqQ4Z3KdMaS2_I&+595L2TbPmND;mMwvM7e)x#wk}cV);wv
zv<NG-ML>P4=|3q7mEa{;G<B3ESPe667xOUbkdP7>4dFKNIcAg@2n-|OI#G5ABe1gu
zn58H`34AC&L;_0O1&;xvrcHy0B(zp9i00(InDDknV}F>I#bqVE(}*?9RG*6Ki|ADx
z#lEpN_v}|_%gx=BOJ_{4R9{gt{+YpGbTM1_M~Djt4sz1DJja0%nBhKk9Ri;<Bag!$
z0Ys9BZTs0-y3oYe@*yI0wLJZ}>Jj_s>!y7%HJUyy8d`@v1s_EWhkdEa!UNUO#(xp8
zzJue}sJ@;axd7Pi0=w3_Le3l8tCD(VT;&--{vd2(9s7DK*M<*L;Z9KNkRyf62{Wen
zxPk)`eDdHE6&;`$bF0_2fC<0rVUgZ|G^RAU<mNGTRF%v5lZHRmJm>h6YOQ*Kv__0o
zzt}3$gH_7kU2p!vz~B|JTrGLx`Q27pIK(aOZK5d^_5MJo<QT&nX>G<4^tk~)i{vdo
zrJYz9XeB8`-bZ#wF_w;c496atIiv94p@)Gpl~_}PckZ|q3qq&=z@}9^4KgH+|6xr9
z_DF;CH6R~&*Z#4lD+UQPgv$^0w*BzK^WMlj*3$QPHA|HTla2<J&?~|dQzBHZxkYGC
z;${v#4lpV12%J`Sb~dL84YM2oIiU$;1tje{Q!YEeO(D(wVi<o7e$`(PTFF4D0NEvU
z3cE&@`Www;Bor;@+0rxnhNTn=6(3e8TZ$ddV}Ma>)`u(HYnh(VP;U@(I-tmrkuW@v
z+~X;Sg^%^`bCQf(Q+N!ITSt!uMPKNqR)Z`rD+n-dPp;e1%9tZy`p}<}Dy3Awmo>q0
z8fEJepb)jX_`zS53!20o4SA6XffTM~5m}Fph48;CG<eBZr12B|%e=+fin)})>GHZP
z$Qi@iOq%`wW4cZ;$xN7t8k`|%KF#?k9Ftfv7iiHJ%nBskFt-xxh}2bU?f*WRLv=BG
zo30mIL>WYv&y{Yqo$<|rzd}aX0!3krD#jhG6tPNz)G+ZCCirEW;pZB!5#mYz{pJFc
zRbAKh#R=DBX4gih5R!@Ah?H=r)u_|VOI4akdd4(aj@yde0;gl8cSei6lPNr!_*)0S
zBb)DGk}5TOi8?kKDuG}EUrNZS7B^6&F`MQ2D;i_tuA`w-jNGA?qz!c^c-0L}%IFz&
z^$KRk>4gJh?z&?a_A6`HSBoePZ62(ar^rFrW$c=NS2hKj%@(UXfGp{CYPN$8u7}fQ
z-Q!Pw0M7W*s4wrN$<dlZBlyRots?c|7X9JYt~*zA=V4~g@1*xlZc<C=n22ce#Zi7_
z{Oo~0yy-|C0((-4$Q$f0coVDMSFLG||8D7?;}c@CuI|k|(`&ca0@du7mg);`>|+T2
z{?Lmrw|Dzr2gQ@a7@_SDNYeSF<m+zh`>Ar<L3Gwl`3=AfUd?F-rfvHuLF%yk!S3I@
z_$b3LdCIHpU?u6qz<F&9mz_Y(u_C!PBIS8^9s&k9TICOt-Dz>V*#yGG&H(|zRZZXV
z^M)h`v8vUSk;D-kDc6z2^bu5SV)_oTLEygH{#X?fQ-=#$^*DqC(GINXT_`nO{V~Jk
zX(-e^z9y9c<e#7^eFCoJ`8l}s;U=14B^B=qWlQB$Kye&ALu^>yXz~zz)ln62b5%0h
zg`_IC^34xUGdl2#&m=FAs~q(<8Kc}3lRMtNx43|1Pp<5w0TKch1hpzYuf|}hw~@#g
zq)G`Q#~9SRY;AOQwtu0#(BS~T2;vYRYN1${*%kmN5K%T8A8_bqr1o}|w=*qWn6pe|
zJCJ1lyRX`CiYB4@!I-A{8yyU={?CK&*lX`D3;w+bGk!fIng6fNF(NcTZOG;BEox_j
z+z*x%1n9ct;L#3H{s5T?A%cf62k>!@#?H<J8kS%=(eU&uOdB$OV~>6V0t#>!%wH|Y
zliux5+PEL|Pj_g;9!uvVvce!?T}R9#b_&Nm&Zey!d894XwYX8@L=0AUcOO`>#6R}x
z=Otsu=Zdpn>%va2-ADQa>hkB9(W!7#;UgpY5bu^5Bw1-C=#H6pJYorANq6#@R-bx_
z91?nrN>UnqP?}AS8G*Y1HqwzrpJ2__0;58=!B42Q8=`ZXu#!kT^Wn`Fd#-M9GRQKP
z1QH|*CN6Y8l9?c%F{hhkdKs1p1|SJ;MJ{+$Mj`p9eLIMuvi1sP1Ste}VAJC+N41xN
z1MCM0TYPMO_*1^vcEGZNoK-6MoeoJdf_%VehU>=hlh$+atb{S72fANSLBnSPOOg$d
z#T9i{I5(jWZs>U8K}ZyxTj<ROXza#PtpR3_jU8}MX+7&%z;`C|#p&f-?I%jc*Eiv+
z)B}_uUhjtX6jX6d={WI-ha|v<L~=}@u)~;N^2U7#!RZcc*`}{lw!5g^_E6prcBcYA
z1Dxk>HE4&M1ZtsWNr?`FDnPanjp5}Klcp-`&58~AX!zg<x>{zV`S)pM8I!;ZNie;u
z@{Z~CLRH%Z@P#y(1Qm+e^yS~~81GsS_srKYf!ahDu*6zY-seni0|p_e${RfA`Yfbk
z!BA`0NsUDYJ*d(%b;PK!vZVKIx-j*wzP6o8_s0HHhA#5ot{%?DsLNv{?#}q_x&n=K
zSn3OsHc*%}(Do)B;x#@!Tb?f;p*FDp)L?Zw5vXdk2flgX283HJ@hJ%a=hu{-QK{ex
zMGvWz>o_K`EWhQYn@#3IwN*=%*GpIOQx#QKes=}IlkLsz)B1cv7Vcrr?h-=krJ%;s
z7cvObj2?@IIO^&<jc5U&-QO_DK*Or$Pn}9!pSX0rXq!&(0MN?2iVqNZPH(_nNhZOG
z;W=-223U!!{ml>LB=_+vR0(Q_1l&X^*KwW{^(BaMc42SV{gZ6m!fN0BnBQ{P@I2VW
zK>GU`pEawx9S&?SA#9}V)!|bBz1!^42)!bgQ+PMi=$~y;p@93)gZ_EDN$V{|LoCt|
zN3vobledY^M0EF#XH5w-=)-~>N>c#j^vkWi8hfNF1ep8)$Uk5z0lkbJp58$7Id9@g
zNz{JqZ&S&$G>G}Aay6*nb9WE4cRZ8S)}^kyeO_YY)^Kwur=kfGb}$Hl1V45wMbxcu
zIH6DSUtMQOb9R(6M0Rjy+E(IRO94Gl*uICeUw)xS5aXQCBnJ=J2ir`N@lxZ*s>u<y
zFD`I=K$3r?OLY#2X$FndIPr=AQ*pKD{m#W_j@O+M?`b|E!WZP+v|RIQaSOI#z5iL>
z6VXF?Q=Nr*<0mB*nEZ*>pZH*uAwi0mF;tlp|J+Z?L<4~@QG!#e_{)491)9F1(~bbS
zM4hlV-_Vl`OBUG)snz1^YwWAzqC?ya93}A>ZI~&6luesP;n0KZ9d=3c7s<Bh8U^Xr
zET@*Bt(mV*6K#vX0A?sIedaYh0?n2^ITzZ_v0e0$&9_#5QWO)AG)6{_P%hx6ri9p<
zv(~NVh=g-GD_86)Vf8uY5t^Ox8U&I@SM-!~bqib~5He=-zr&2#rYHG`{`%1dRx!@t
zWL}QsI<*!H5*j6y8&N7{Re+O}hSb!Ij+Jg3;bJgFOcBp;l3%wxlpV>om2D2KSrA9p
zx&U-Ih!F8+v;Rwf%S?>09qG}GnmNuk-UeyC2J`W6Z3>NSC$CgF*91nXcOnKf+Nc~6
zGb<B4t=I@YwfR@l{ZG`P2}3#`{_m~<R_O{SI^@sI-;|k}fkKKug1L^chawe@wCORa
zF-GkGDnywO_kg9nI2V9npn$yQ?M&4kN`Tl;dmj>km2u^y{-~p6Wd17QosfnBqUVVI
zjwA;nlPL1Q1RlfbA$CVdAq6}lUejXP0G(r%3k-GfZ~lgAg33pE;{2%wWf-=UXqBfF
zHQ-s7vL*Ks+hZf(86d{8a(d*%PCDrs^CKt}4%yuaUr;WR*_;k+0OVnbkfG29M5P;-
ze_Nzh4p)ENkq$wh3lkeRa{vCR`D%B@jy-}<r~QPb*Hmdp+6wO}I+14<gGot9g_-f$
zi>QKU7>9gVW^04m_x#)d-A_(^3y(DIX{RVwO35Lm|D(gMaUQ9Q<<I`wxOvr=OCZUQ
zyC&~!@I>QX9l(Y0P$q=ej28^tm-IY|%hreRQ^8gVc&29PVTEBG{DOvH1G<35a6E4_
z^W`%E<(@2%2UB&_WmL6T6+xPcqhJ?JnugV-nWV<hRgK2Wu)@xeqPQzkc-M^ur|GtC
zm`m%radrHBE@H)AnQL*(uy>L*r|VA7UOpde73q?fh0t;|Qi6rOvpJOOJ#2Yuf@cZ3
zK+=fkziEQ->EJu$InAtWl>uqQH<P%bIY@hk@K2u1qXUn7k&Z=qOpn&&m$L;`W2#hU
zy)O&%?Gf%3MCF^c$Ev}o#)x5`S%V%Q>0iDMrLSHhp`alC0*ouqkREy4{r;y`Ze7sX
z(|vvarK&t2duSaLcwl^8vlBM8;H)fsrugZj6g}tbr2lVaT{H<M2M{0BuD{SBOsMDs
z&k@KZaQboX7&_3|Tm>Kps$QN^8l^u2ur5+v`q^4Jw_iLtb8eSR+ZYsR5RhI4E0ray
z7<uh1{_oTtZSb~>Y-L7r90tKgAktmMw#<BCfHjh}hyOPBz61+&a8`cfopBbbh-|Qn
zx)AlQGP=G6xh^(Md<NGt+MHW&R~{=<AXU^vVsdaD`umhlzC`MUb=yt!sZV7+AsTKJ
zaPneAS2W$OE{?W#7w9|J<OBBJUJ3iqpT-ase5gS^kgejrQ}y~I8?yz7$fmBAA^6Qd
zvB$Wn6lb>jYi-8I(9MvW$((k}cHjVnU5!9t@@m3x^9U*f{q}Ss_w|K=R9<7mRe11i
z)vW?N({`%$T5FoKbsE&XOPl+2fnK`CcREwG>iW;G6(gP!VR>?cN5?3sqZ7!cd`!Tb
zt(k>3aSj%!;mYiQ4(N(pz7`U}AMpkHW3(ZRMi%%}GSQFny6F}ovx{Y&9)rUdF86Fq
zZhO8=LZxvD<TTlI_?2y(0cQ_9ArfnB?uOJB;I|C&l`(fPyn9~E1S2Lpxe^5y&Nge!
z&H?3n{|1_0eqMh^rY_L$N<qW5>u`7fmddOx3(WQu*eS~o^u!Er_&S~xe|6W8@BQ6J
z$=nJ^@&8-#Ri4NSyDWLCNb;yfX=A8lNs>N~=g-WPh=kUphw&H#G{U1bj=Kt^H6$z6
z?@|L3G@><dY&eQ1pJzo<KeS=!xow#Gq8okY2TqR_RPF&k)HG|VdjwcRiHURjM+Yw5
zJ5Z#R7p;!sPKj*U9V(*K0}#<AUEj3dJ>HP@?45{oX@x~Wr)#g*RrlvSYJT$1m%|g1
z>MQ87x_3F+=V<n??z&hde1MQi)pE-yT0*|1CL=&KF$l(7Wu#RdO7XuX85fh@Nx?@A
z3Q?ci!SQvfevE86N^&@89nDpLf<Vi1=Dw!qQWK5E%9w87DJBo5QnHr^$dbkm?}{4u
z-Lltxa#(RiL;CDO5@MQY5uy|zgK@jL>ttGPCUi5{JH*K_>gH0YP}Q%kj=B+E+bumW
z!_L656myh=H>g8_jXY1fnjUR><b&<s(~;SiIGn#J>k~e=rMX=t;G&fjEZyy?A-`~3
zT~OZr(B8Q_EcF0ib)8l<4sLFKtFFMTsSj6dv8F9{ora^Jsm#v(*P26b;2jDM^+U<j
z+8I;7z=@R8A#fV%Z7Jlxr@vKt+UMmfHih6=eqjzct+=KEc4a2&-OB5YENO;t<rxH=
zG0e-vg`0m0EUGkgbfvs^GgWq)i`Cq!lm@04m(v}sN$CxZr>u0md2eg^?M2=Twt_he
z6Y)z1%m3sG<qCMCmq=*qoi_mzmuOFyfeoMQXv7-W?S?H9fd?!RC<0p;q$m~BUoKy|
z<|$8Ez6YFyf0D5yT~F^Gu-eMb^($npo?TGx81gH~y9C}fXewBaQsxX53sQ0AnP9q(
z`vrMBPcqc3sCLyO#nt<W4a*~|&;=v+NnDe8*H*pN-WIEL*%~zF%+cqB{_rnX?dGpe
zZxlmE_rSzXp9a1v*FhGFy;E}OLOEGJ*EKtsl@M+~#dfwWDWW>28(~5)KFEmGNWne~
zpl}{i0Ta)9fv?s%K#(*pRJVRwx?R^v?EtUQ_(`&xD`_cQw^HQxDWpDeKc+c(NG9Vd
zM{bS$0LEi=Qm;dh5>5E|`_^mbiwxlFpr7cN43r{~bbg>!s>VX*p=8^0(2LRAAi-r9
z<`4k0c;USzzM`lW7B0)y%qnLY2=-@;;#BwYXk;gbn@)eFGUc<*2uQxB+1jj$6lxCB
zjf+U7@wa<J-slhi{wja{E^q63iI!X6jWje%SRh=vl>rsZ?K|}8ZI}9kz@qnd|JypK
z2wO~mnLENhdw$VrlT4s6FVjp`1+-QAtcMvFxljMh^sh0kS9AP@#&HKuZKK^&oaOa2
zpRF~}rP$~Uz<ef@SZDY{pXp8Z0f#wy$OeVaM@)=NTDJFJti5A&Ez#088t&N1j&0kv
zZQHhO+qP}nwr$(V&dqzyd+)g4|L@Q0s+u)xuI@Fv$5_=*J+(-ecq#eEw7@OF9C{Gf
zN>#_|plpm#0lSh9J9)k%nkg>sEkTcxT@YF((zx3|BN|w_v?_jc!Rzw0sC0=<;?rsJ
zc@#+eOITc6tzdYdy1%IT4fVsih`gi>;h!zWkdk&32uZRdpMdfgRXDZcP!*5H5b-sU
zzpf=#MA-<=lS+t>GF5d5N85B(Sk*bD;`m&MrfN|KU{P(&#D*BJrj~VLKaxz$T1r6g
zB3?^o^~rP9{lA%**3oXg;S3^knW^grN;M39!(>U`nf(C0>K)OIf?6VbqrWo)W3q%3
z-j4lHg?z4pg#ZH@6XgI=ZsW5rJXkqDhfjCg_dNCa{u=!9Oe<N&g#iOr+p{x@kE4P3
z90e<ZkD1hTp#W8kZ(<M`H!H^BR00>teoYVIe|}b(Esvi8*SrB<D%PI>*P>;AKfD22
zY`g(noU3>MJcl2>g(zEj06O9NYHWLz?5=_9J^`$3&M?(2NhmO%-^vx*Y8i@r3sq}4
z9O>Rx8vzBE7i&{E)is3wgm#wcr7Rq!7Dm&YB`;VcP&y!I%efAb()Oz8tXll@i9+dD
zWwWSGlCC)MzR3r-%>=ot6|yBtinf+H799%c6;o7-I$KAY4Ea|pp;sPw%7Q@r(D=ph
z><=~Ct`$-VilVvHxMe8cg3)HMv`Zl!ZN*oUtMVeG#f{6c>(KF3SxYIN7R(^As;xeh
zh!>3$=S?GmxtqtiE>zy-T|M6$o%osNv|gVtSMYv;W8XPEp4^E~?-?cLXS9K$sI)_X
z#MZG7c}ih*jo*7P*L;F5&YC6vW&-#Yk@TcRDf~ThVe2w!)b~_NcFuVd!PAhU7+>Ha
z97I%Yy)4-$LrxpH>vNCm`)0Umt)TjCxpK;iHg4@|)h^n|!EQ5d_NNmB>?*con6ZP$
z6VUgSXA`u>3-Tq6)f%59QW=oIXs#R^<XIpJ%P*|wD<CmsA?Xb^8q(_ddlXlMS<)Zp
zA5+;BQu#+f-E0v#Doy)s9}j#*LS6-ik}^m~(>8)$=)b#8<-7i^Ny=McLL;X7SgSF0
zRIIjCAm`68v(j?jLOMoqI=C<b=304u(S;oik4{%c{@A~$P-)gugINg;@}mrBZ%GY|
zd((+};@NUS#hs#y<eBoxj#&!VRVLkDHFLru`VELnB{Q$x=L4b4M`I>{Emi_>3!(n)
z-nZZ&H)r64e=_KW#jC?4Q5JDiy=+BkX?4Bk0gSBUm4fB&zxVHcJ_db%>PUS7etu&6
zD{*}cy}tCDspcZaF4%GllJk_$jQ4Lx=jiYZAa`{V%0FQ;mwThbH>x+vPN*<A*Oq54
za?PWbdneblTZweh!{pZCBWef$MGKqO{AdNL0lvq@7VLpDvaru~t;Lomd7B1CcV3}E
z0q_LhFIg`r;R*Q-tUkPdSiy)aE%ZM2KlK6C2$4CXcV9RI)DsJA)COmlc}T1TuWh5A
zEPM^hs=v*HGrNP)lu99>iFPMA6Q)T>7I*i;v?!xmk-`s`1JR42{WK)>An%hiRLMZY
zR-R-O7~%MYE6kyp5bC)aC0Ht589V;W*u?+2RiRHosjcPXA~|XcC#QFsi>T4B6?<3!
z5H@<-tR*#vi6cki)a9?8tQTVKA=(*eoh!;FLB=Ort0Tb#<+2wI)>s>W(LyhgC527H
zLO~!j+l6yPK#{$4D!yB;W1-SP{E&aU?T~D3I%E#ln?seDwpVakZJT^PjrH=i_7gBh
zL_E-j(3yGj-eO?8-9+TF9KGpiJB3Z;vJJzeBmIT;7%35T>FiO<%R^fM50j^I9YoSy
zNq2m(3Ue?`vB@0Zd+sE(P7_KoB~l<vB3T0*2v^be9M3NuOk7+<+gK{%ox8cy*y+&6
zTt-(I8aX>FD7Gs{br}?<`$^-pG(JbNN2n&o^l1a4)Vyr8(dx)^O>PBap_x{&h?g9|
z)Xd6!y7k}ZY80s)Bq*rTTH;9~OsH*7jaoz@^If2WvasaUTIu0Y$YQK@KS1@%Z@XT+
zrTSEUb5v6Lu~&7*Et5|4ttb<AJ`qzQL%WDqh^FmQ)uem{Hq_hxjix}U!pG&S?pM>G
z4=C3N@kq+XqL4g<t%!A~O%4@ad-!+R>&uJ<>w7#aC?5eV$_{t`br_Z4Yge_?zdfnD
z4aE97!C4?iRUA@$#WF<oBVlf77wyA5;-y7In(>Do<)=d<2;q)ssU73vX87zFSA?ue
zL`0}9;4)S)J?g+z$Gugk{4%%0GrS*`Hh(qs2t5dh#=Ue*lYz8D5|TLXpO`Oa#mhV8
zmTMOB@x0eDGw;-3xiH`DBGK~1d42|6$#kM^)bgDP?W02~gS-d$_1$h0*BeWcTr#^|
zn$J?3+n=3GqG{R4@WG~sdo4X&c<{fomKVpW;Fl0O7#Bu2u@KB-=!&I+>|lp_Y$|pq
zm6$--Lw#!AZ`Z=-mnxcJ8Z8ThkC(zZ1Iv-LmUb7`5F^aw`Y|RGv6p4_Y~wL`@gbz@
zznyoC=Ri;99jjP`mx7Cc5t<RHpm|P)hGh+fCKg;v*Z?&wWS*c9x+0LYUT{RY6*1&I
z%7v|-Ml0$rxGbc?7U@*SfZJZz11R1XW<ph=_-xnvK`ec6jP{+*O8Lee(4d0yfY*-j
zsfkXW1RKX|nOUm)S0#<2YhniP_h1Yz{ftcXq_+{hd3bx;sJ42}iimzx^09TDdD=4T
zxcwD)DZonca;A`~AV;4#iKHJ6BA`bnNC9JNHm>7g%}^;+z4wOZ{&791$BVdxh3YwL
zkgS*SbXj4cJarzJsTKk|xl}Q~vaE?Ncec1F1dD5|^)3UG7iicU_HE}U`C(Pim-K=7
ztzhuyCjR0z+eUa+bA_)dR5qY!_^i_2&V^uYSr@x&78q>MahC6z3tK&#Y3do8;kd0?
zBp6?bIt6I!wvGZ`j0A>*(MzYl*y}6%g_e<+@6vN4K^ygn7*4p&-U0UL!^2wSY76ZB
zj6v0E*}5Sge~VBc!TGKyfYasm24DsO4kU5KC`NFgG9mKSA1v`GpQ+M=R*fD^^c?RU
z%3U4QjmGk6{MxzbSe%V(|K=FaCz{S!fnbXlh#$e_16Nx~fzE3uwdh9aa=d0rxPq4E
z6e;4a19`~UxBb`v<#8XtysL@Ntgo7$c0b|{^=pRnAsX-{M84qavlo!p#CV=wnPq}N
z>{Q*%&82u-gm;vi_?OU~H(FPLU9i1_w!a`owifBoDx`=zoCBJEguHus?WrwjjtBUn
z*0cz3h`>d;$C=Q&u;RMF@=-0AOFCS&6;)YJlxa0dD#S{bprb72ekvOOH7RAoUX(az
zx%*`TW(FxBI{FmVIwG3!vBH^Q*&3iga6h*nh4&i)Ii@&n6Hahw<Tl~?Wl$AaC^Nx!
zmFL>Jil;p!6w3m8B!U8LXAWs`bmXl{e1LD8Ojp5HX&^2a5>G(;!@7L(G;m2k9h|OP
z!qFrd@?OAh#XbGGpd0_bYK8rJk4W1}gs+g!gd5iza+@rYPmd{EE;<e?4usceh{Zh3
zwwyavR>WB<hacJr`Gv^=Y<&4xo6xC{P&po8_G-W*{VmRTe`wOZt<q1f6OP5UXOAT9
zYv?o|R0}2yVOmb$|1MpQ_AQj<Ook437lxdiREb=cInZTyXKy*CEXkbZK&Yo7k>p}`
zX)2h`nYaV|aT`aXH(y<@`+X2wsGNf(+_(#DMg5*rG5yV8z^M{gh8Z5kh`}C-NbJL*
zZD&Wlqr#ho%sO}yVDNc!_w{u2WNAA_qngFro0UTO25u?{-2hmcvOW8~l&fEoFU4k3
zMQ-$BxMQp~L^V}I7Keqm?hqzig|&C{4W?JI>&StGoTTIq=p+sV2#Ln~74&M9z|@hO
zKAjO_;8;*N48_uvbi!bH2S?MYEDpZfqlx0iGqf7!mb4_Dd}XaAJ;ml)CC1wvqBv?j
zohX*2TWwp$JVNlvcXv0zDIrLp6iTFux1>G*Zh(P%eQ!5R-{Td@cGR#2F5T-~j1u}y
z3QE<$LP3q+_>vS6JPkcE&p@Q_W?6Nn#Ge<p*4U3-dKh{gPORkE5xU(HDU2h<CdegO
z?^#4M=7`(KnV|3Qi*LILrW3M2>d&;Bmfy9tww)t^_=TQl(YF!~aQ4df6Nym9_nojK
z>NooNKUj<w(KC_5wtK0o+}obVwHR}z#qbyqnJw)c@Obd8h<H~i24oHn(*nW%tf!Mf
zl?3(qir^R}4(~yf52p6GuN>gpD1qKc+pwN&l2P2i`vMt+?hf`vXsfUQoO7if2%IGQ
z_*T^A%8lImzUG|Y{-*ftJS@0y6dPMJB9K1Y4^l)vI=Z06)A~*yy-B)K@xe)@`Ff!y
z25gguqO0W29E{O#xaWI2l`sqe>RwtDB)t#>B~YyUTImw(RSV`}aA`|gv{AMYxWLxe
z^dCmi669`gl&npC*azdN>g9Qqajm3=O<j2ANS!t*Vh$(*hle3Up3c(y&p>L7Gw$GC
zRPdfpAaWYJf3|g{d$s$D+tg9d3OVfgHZS|9jh*)_n2@nt!8;=v+9BT<=lqW9k~Ghm
z7@o+&bPN|9INB5%(#@kXhP?wZEU}m$dOYN`v=#gA9iW`Y@XRTUr~~*wI3Sh4<3i23
zy1K;$Zb4l4*>-W=e^|v5SD>Aj|AM7a+{lRTl6fb@r(XxRiVEtLWa}Xgtj-ViNEDA2
z+iCADkWf|Dtp9mP#iYKh_j?OeU_%KV<|u<~f*e&jbe!7?A~GicA*9d2KyF*AvY}v-
z9DLxt_sC;U_=?m3E=bV?%Q7fmsOZt7%&vL*Q*Eii)2uvyC&|oztvv5w8Bjd<V!vEa
zs+4>WP4zMClvUfs+f!x#t!>k7P_0_^9Kp;wobfDORgR!vF&ClbkCF%oSBD~vfe-dt
z-iSf0EdF9?68VJK?H-s$sk1rV!>*8D)9ye)ZBA2J&4QFaAvN%qGCT70>`D`2CWqK6
z>WO{dAP=N&ru3p_!(1|Xy-ki(#cHygsnR-oDPy^%Unz6B#eXTYxpCW$V#dO8V0{gT
zSlP7MdEUvOQT%wljZYLEbknftqpC$z>|5RXrkpR8WLr2iV46YMthw5=Zc~<6!&+08
zTEp711f#kohSVxCqG>}zF>z&fn%{{=r{S2t-C5jN!#bwYQPx?*+PYk}a(Wre?fkn%
zD{<K**VAD+b4Kr-%2828^HeK&c?Db3hVj{=ncL@J)Z)@lbVIROMbo$Y<Fa@oMR8bV
zGqE_Px<yoiSkpQeFT~z!Kfd`(nObca|IHp*|Ap!#?nx(;k$BAmA2=#Izr|iNpGX*a
ziZP6goTRZnFM&rPKUV2YU6ewN3*-`-QEN~h!Kp3WKq4((&^8idFv=?FqTcBf*xQTw
zJ^$?B^RW(l9`goQO|`*Cje@ZR@+JOXaRzS%4ZFu+nah%{r3WlsyHg4bV497=$89g%
zlT_%4l&a#7O0bn;i>#I4EuFyU4t~_8kp7ZmZD5;tdOi*(@RcxX^Ej%@88*I44~gyU
zAiGKXJ>ljl?ST1~7vn@ME%?(caF^U+R|aJHM@d^%_K@P<NJHV+Yz8X9tgf8}(dB8X
zR<(vs1a1s{En+d22w3^c=zjj|y*ebc0!V>+q99@~9$*N?`0=><V^R$LV;_6*ws|1#
z6(ZCJdACpf%g8Et#0(<*ADkYj8k>ZpmV5h*QFVrQ$~x#!dmJ1c#etI0$^X!tpu3zO
zI||)RAB*o$J8%RDI;&folr#ck16{KXM#)G*w5#+iV36x^eX?}Hj=&v?5OZ_EZY5nC
zyZORRjkmL`X6egtXuQzpaj=c6J06YAaSCpQkL+YciYA@|iP*ws>-yYMj})@@#!J~5
zqdJQ(S>$y0NwiGspcbE^!EWZz;BC5u?gx-mKgyw={!k^LtaCplYDu(W!<0MYC&TcZ
zRF7%b4eq-|Sp=SlqNDVXHhCiYX6E|^m`iTF93W;t-@!N5;yB?)kFbtGtv?HB)T>@&
zc<qVMXk>M#9H|e_Vv*m-H8!vche>PmXiUpsr1wRBg<YBw!m|g--I!O>FGV}^hD-9i
zbNF91JPB^(CzLAr7}hN;uQjm9d~jkxxbfY?vmO&5)JoZxwX;S(-EUE)yGn+#QZ{xL
zcFmcj6qM6%6l<(xrWvgJHlA(D$$V%Xrx;|<J?7*pphRI`jnc>fbkx;Et5inPv}lxd
z0O<3wPSDj-bwd{n6ErHG#>Y);dv?~kSRd(<YOhr(ta)i_s$hdbEz2=z0VHG|<@lPS
z+tA3CLkhMfvxXo0)L)g$2s$Ygaf|edp5czvEBPyer>pcSQT8b+yB_Q7FYB%sf+czu
zY+N6o9Yck_XAy>vJ}jO3^Wx*qC^uiybCfoFaaRN3uv{!?P8-`AUw^!~X74SogqI%F
zg~cEk(`G5&56H8b9WqKE^R+k!{_<ty*@qle`oEx5APeYj1D~Rzg(P%aR$a@pYgGbM
zsH&IRT)9^AP<}Z`R{C{Sdu#U4Td*={6P2zh_6vf}{Pw3pRNsN@E;;L8SdE3Y8W!$3
zNuUjZLsfwTuo0C2s2?rg(mqt{j2`J56k8CI4v^6aP0xd4phq-L)uV9YaM+GFNL1!-
z&7g-uRzY{}{zbQejs_S<vTry+o>~SP8naiX<t+Ox6Pp!vGW~qCpO>pgukd_3gkgjA
zAxTn^tCCOgrm2lK>W5HP5Ei^ykeiOIV4`eaqo6ci`PYMjz`Hgl()mnVh!wba&RM>{
zl(qF?SgcqR4>2KkGwz|=`?eJeUs1vnJ1?`yBsB~#8!`+G+#_zP-1TD!xi&6y)iY{u
ztlz)1u|oUFBzQeeg<kF4kG3l(xu#+V^>`~47Jy9^+8nDQ^MbU}WCh3PiWn7l?SU#P
z58(AcEfR@X<AHCQi@i(1(BA(4^KY3tOA--Ws3%s@H#nD7+|4*#d<Bjc-fX+;1iEqU
zv~OYMSAdkZXg*fk&>_Kn8y`i%q-BMS0+|PW3_&F<40~CweulRbIFiagM9rFw9ZW~Z
zCbf{iB=+{bZL!FI8pH2Wse`($=(dbA^=Vf2sbeu#4lrg85Jwi4>+k3XRdDFFiapaJ
z8Zj#k)g)E}J-X<UM4@=s<<`Ov!`p+>)xh-F-gP>H6049z4A?(!^a)$`3ADf0s=rsa
zzgM!qmvftQKQ{iI->99_4{+zqKy2>wY=$~Nt?r$=!r+io9gYvu<FG>?BDK9|KCDo0
z3AURV-})^$h;#!>NMB;hd4MJD01jJZ?En_L@}2*${(p+*w!gl=b2#(Xrs`bz?mfVe
zEq*PQ|D8QS<oQ1#gqwdO)IY<L^=eIe-ue+#yYjsg>jwTOtokgV@xdt%iMzS|QXQD|
z6zqF6@8b`;N3HU%n}ym&*;PnG7Dmmv)eLZ(L?5C8SbTbvjKnW2c%fSWSg?gJ#~v)!
zDob<+S%^)`Bt&ssq?M^1!7f1^$0ulUOP#w4)MEiNjM>Pv=lE|AO|Nny=sa@p*gD8g
z+rxN|$S_~~Ln$tbw()1q6>W-IHZT;9&rxZh7uUM3WxSFN25nZiZvqjJ5aDNpkYBBH
zEl^>IjJzqL6`!07qBZ~P4rqJqW}CQg(O~h8`pdWyqCg>@dQf<6krp)pN%?uTg+lB3
zDx#nUKLBe>tUau`#oLXwM56JOqbJr#%f;)xkFUjJi`QIgk{fJaRl`}l%1ma-xPeR#
z#KmP)r5>SGaby{FXE`^#{{EX_<vES?d-I89UE;FhauFzsaJ67t`M`-&J|I$e$x$t;
z#~D(M_N1<3v1Vx2hBh+2n3nOmKbpuX$8q@w;H%#poJ~4eBSYKZdb2ek(txH#rN8Om
zReDeb(_)G9K#>4u+&+mA*OQ+`{*VUD;bZ#(*6jdM0Z`uoCX?U{e_1YlIKs8SeMT`L
zrgp!d`CMqZk~&-33qf{5H8RempJzz^ZJ?b;;IiIeytA}5L7U%PH2DnB6k_yonK3)b
zTSiL+_b{_Y4DrG)pW~x4d^Pt7AOlFD_omR7gv*_|YTV!iIXyx7HDI`u`)z>O-}t1d
z1)=LQmeON8&aQLLh`s$hd|S-xvYKbf6)d(1tC)9CeU_(5`}&z5V{?_h5baw)uwwrG
zKP35h{j$LK6?FJ!P@oK*6{c{8Dj67i)_!OlTo=}aWJCuE_XhGQ0_jqI+n)N|7dShR
zYI`;!uWo5mucABosI*KP78zn$XYOL6Z0%I!9}QVzsRH(n)p<8sV7GDo^oc~pO>O?C
zrs@o^<NE`5(yaMOt?%>{`^vY28pDgQ&2!2+E)c$e4t=_ScxkT=)Ho+v>2)Rr*cDyw
zlA-2R5$(kXX$bj|VzlljfcYO}jxa&ZtItE6QbJO)QsBu{q1z8)H_t~MKya*R-IJEg
z$wm-(X3R}O16LNZ-|TsLu*aLqms-kknH)7RRZU2D`kZig84JV&Y68AU@%N3Hb}}Bc
z3?hS|SCEifWV1CojGaBX|7C5!l~Lfn)A<GM>dueGzdFzKeXq3R;I%T#hN*rfodP4L
zNSU<#bU`~qUxlEaVGDcNBN75na&Fl3Jq#Bh80j6mqLJRmg?V3(d3mvQxcgz|4qZTa
zWgqU@7P~<7ZrM8-icxsLq5`~dFI1I0<SM}yn7N7VW1#HB7(|?TD36H;nevD1yB`$_
zYex9JfrI;%mhPjmeK}#|xf^&bTGz!S#cpP_R%%8|HdZqne4qucDedO<IFtXGunuc$
z9MsGvcPULMIH}ZT@ebUS<~qPkTEa=@CR(pEh0E5Q#c?s?_B@;Oc&U@TTp!HgzFHqt
zt~Q0^m42x^yplXD95gH4SC`#T=l;aDY^?lHJ8+F;!&juo#3U}I5l^qoN-tMCn%tj6
zO+k3vs!2o^A@ptA_1W*bv{7!;t{s}2^V94dAT_WQyi)03!`WF4c~E9)9A&+P%wB5g
zNSJFHIFX1#9~J^$J>ATSFptVl+ujh<rY9<tO-9?lvsoMPDP4{N&h7rB%b}~&hSg|E
zM6bacdZLwbvuF3`V6mk|lNP;8bime{BK3oLaX(%c{1ddi;uCeHE%CD_A|AX8U`Z;$
zx2w%I^Bkiv1@ytYahu&qr!uS#%OybkCf3ET3i)8RgSg50Eq?d<Z>zYjixH_2)|SRa
zjA<m%*vXxlIb|#!xs?TA1%Ch>GmB?45>8gP^9qIqOH;Xx2`*XAaQ{)_BV;&P%rnWb
z2ne*>zP{#pqfp0lDgSwcFm%N-wxj7+v5fV&p0D`Tc%-l8ZMB*#xjof(e=m9S^Hsj^
z<+|YNN@FOur`e{*i(GRK_m@*tr1na$e{v__s-1fGt)95!+WPa$l75>zgE}WXvNdJp
zA>aBIqfAH=hRlQ4KBd9rG+hx+tMlGBXE-oyuwaz53z5tkZ0xP^=ihr#Z!B}i%R{kG
zwuJ)jMmB{hI~n+ysI7~--}k)uu>Xb%B@oU)vB=+g0Z4ZI!`)^;5*r^ngsTM>LjwDj
z`uRDG_N4Yi%iZPMu^WI>7_X5h)N@QsKO4+}Xy?;TQP;#jpodYbiq$Xi5^*9pK<Pw2
z_=b}qul?eKQqHJJqJ?{5yG(By#>bh#Pz&*OBaoEz6}C4#%V(Tc^z)pXlrA;;>yu%N
zHt;P0l0On%dsKeZ4?E`OVf;5S1olIka9}F61!*PVT(cHPoD0`h7Gn)As|bfxI7qc(
z>likbQVldUjq7SQkT*^Ima?EI%yGnHBc>%%CGa#9N_mdUs|zKDTiO|sh6{>FeU*+W
zT1@lxth2(T1~j1BN3d2_bPY5mL&L3s_quy%kTye})7LsKnd+SvEgv#1)d*J?Z2#7}
za!0}70^d8^QX?%;x7Ltfq-<u`^*|t7U4b$>Fy<o8f1^HF21WnFoa0Y3A&UrKAO4b7
zau;F6E~PKcY7!PEdVxm;1(_+Eh%Q_v9Z!2-90qpTTb$|Rr<AiH3D{*1cU3ZOf;3pU
zqCT$v4`uW8Q?0f9+0%uI(#INP+}j9+sCRoc)aI>3Atib+00atTM)e6-?T~!rL-@0t
zJ~DeOL=nfUEiePC0)#>pSATjKI-41n_5^57c*2njy=q@E1tl9C)`%e+4n(V7s8tuR
z182xm_l#SFactZ~<jv7&0??tTQtyx0gXq=ueB>u@2j<{YN&}Eeg65ww{Bfqn3mew!
zoZpVJe<U0YUDjXfPDkC_YMCVnWA_4sD#a0RPq-w5SCznSZdg8uARC!7|Dqu)bzAUY
z3V9D5vBx@=Uy%_o4ouVzjDxfw9O^GA)F7hRsA@qBSrs?B;(pOhB=9%uia$|5d)(CP
zS(~G!5!*0+tr<5fjD|^`vMAG25c(yq&8Z|)AiH}4rlJZ_w`D~*cW^FqICNRg{g~=8
zjclB+BN@J5fOrVqMxE_9ytMr@4ZTdI89ABzR#@d8X|>7a7%4>zb@avJB8)`699k#V
zmZqg#I!4y%h^f#DUPnYz;6*YX)fqxtp<>ZAv>ORiPK7*;PregBX1d!0y5=;57V+++
zjTCTz(gcE5hFG8$!AnF<!38T<W53U%mgAn6Yc^C~R8M$@e))ZA@+z4g9|`fKGPD!1
zrinnUVJm!99rjY)O7QYOCbLCxTj3?!7ZoA%Zj^enZj^beZWMb*l_3FeFDvOl@)^l6
zkZ>}!09!4P{>sv~+EQiCG>U*}GHfZ~k%XJl!WsSI5dKTN6p@XxhkewFj!ELob=Di8
zlMdB$1yG-KW?^Cq=;o(_;^K_*GI5%3wA1}MH-XR3M0$Q>cxPTIVq{bfi*WJ9c{xxg
zf@tuCg)Bj;$En~L@4W(4`=~8OEeTj3ha5O0d=~hzZj<!v70CckdoK~MC|R+wSmII~
zDL-lIH<;H$E)?%$^H9NVj@L~esn)G5x3u|p4rCuz%~8y?U{#!qMHjbPq-ib2&YHvE
zE?1cm&F~BRL>b=|ch5;o!*8A3uGZ$~anD@W2c5z8fvE$_PS2#vSA>Q)j~!RDn3-^&
zL{X5xS2?Kdf($(EVas-_h`QP%zHFqvUWV*?pyYF9N%2I44HNdGMtcWa-4eW``&;{s
z6~-SKZdnbI(kIvWmdM;;hvMOONp2LE`f8;<sATUZkiMg!z#$L-NqWl0MAf5eq5Dmx
zZZ%N`!S{_gr6K%Zjs5js#o5A5I1#lSkPfVUd3rF`wjyA{s;74w&kxGHB5K!!K}$T5
zK?}130RMu}L35MmKTlH>?&71icmt;bep^TQNCm!-=BnR8z^u&<xP32$T=F>U=62j7
zNo}{L;CnENoH6UUYA?M*L(k6koqcIR&tTgwB%0)2;q*1ZUh%lNT_g%oahKLDk-{i?
zY`_<fg3Ed|&@G9=@O#Jfi($9T#5{FiHa6mmm{!XzHq$*HhNk_qihIV$FXry?VR`dd
z%rA<?7TGYoCLP?c434x}3uv6Cn=gex*w%16TMQ1dp{8nT4Ju#J9B6w^soO#P6;d>9
zAug%)yNRn>gPh%)TZ8^HaN?bjQfHH&a@lvS7^21_>~`EDK$*)`^?+J1bAcw%K7-<}
zlb<+CZuO8JBxOUQ<&c=4fNhiFd6wzvcH|gq=tz|f;cCfv%s4ICQ4vz&n;Hb5AE`z0
z^z6)(x_LZ(xI9mlt*$Hem`GF7enIsakzrk3Tehycv~}lD|BS-?Yw)Jo;z6~^g?eQ_
zQoeTF-)P}Mt!XmV7qZS0%Y|z7B=x4z`ZmdhQq}m?%x3%GCl}ou45?a94dRAh%1;Nb
zDJ^^!f>%B$EVBg->bOTKEWL%NdwMi<<r_txe#Kngnp;YX7c|}Go&pnHdB^tORV_7b
zg{?H@Y=yP9Jtz%+@7t~a9;(ACo>hiIRx}Z|cW<i0n*Vz*OZRT5E?rSttTdCteGk1r
zDR2LVh<?cu5Ul4;ypyx?7M8C4&pBDy{)*<awFM^R5)Y^HDvRFY-qzC&mzI_u-qyc9
z)$6M(O}4)#o<h56fsd$x;}uin7He;jeV)R)ZRlUaugJXDJ4?1@itJ+cANw6GSD~G*
z=3^qo>dLCc=aFUeb2IZNh4pWgke5dOmEU77aL<jU<%?S9?*eN%Bx+5y)#khQwh)Td
ztwHwx?=Mc>`kzhUA*uGe3mz=~cPmVNGEwXQhUjTA(ba6Uzw2o^d4$OGBI!^3{lb&3
zIi5n9&tFuy&^$oyfIbgoK<CtAv-LQd@Uej>+%AJCqm(0hb@7uW296H6LmgX*rpFEk
zaH;&zWdoc*C1lbBw^R>@eiooW*#b0T;kih0Oo^c`dP#AWbd*v`_GtEb$r#^vS0Fb=
zSF-8MSe4@8{gKd_zbH$t%NG3jjM}ZJgkzD(1%p0(EB;{$;-i}xIKr>-&X_Or$bnIv
z+fmO@OKxTGg?b`N8u?z!ES$Opw8cN6Q>SFV&~7zu4oa4BK>xjHV3QAyEFF+vp7m<7
z!-WQTbxK7Rt;{9VM%($$7IVy`5K$}L8LFt=Kle<%?#JC*CmZ*6Sg5wc(0j1=-~moa
zZv`|h_0kro<a_X~@<`tB=7<2k&hufg3)a947J;#<1d!P9$I^jl#k9tYkQ8tMdfuTg
zZ>P=%+BF5s^$35pf)isFh$bU8u}m;<Ax=!_eD#8Nh`LH%A2dMpuzt{rt|_??*P{1k
zVyxd_@r{UYnC9A?a6nhv85V-S#P+=ZgY73?BCNBRTI;*U6cTXhnyiBbZtao}+``)J
zi)R^<Ec%DA`+;YT&!RG*29eV&5C*bOkIsjjAm4U?ukQBBbLr&wTStjFf`z@|l0kDq
zkN2vQV1$}~L6=RVR!^9~^OembH`R$9=q;|!u+$U8sHe+k!sGFZVN18aBPT%u^~qzJ
zWjfyLd$$;;7OS+~```BD@4PZ_yV$ph929SCVE#BF8b-o9u<7$O1@WD9(gs?@>J(mW
zU0dbL(2%%TLYMQ{BbAKLa^U=)EYqm%4dZ8-*s->BhoeSE-7<gM;%0dY#Rs3YqJTM#
zAuzYmaCkAv_M_?vl8<Lb{%KKfZ)INrw(K8L#?<b<PraFs?tsC;LYGcd{i&rXpjbz6
zGJj%wh_T1%AL62v0YJ!W9apwjP+Rl7C`}|AyK<^fYy2YV%K|NEM=k?zN`{y*JHkG1
zJb;Ey;d`OU4+2>or@SSZJzcL13>2`z2p;bzLN^6#&)qfw(~k->2k-tA1ZKsmgXaZ7
z2XuQIpG);*UW#+OvqT6C?eU?A+81;|Qp*ks6d9M_aYmwCMW!&m-V`t!#qhlk5Hb5s
z%EBhtgpVoF)&(2J&eh5JxxV@yKR1p&_mEmO?7&%6#?%_M)^Be$0B5l2`h#-czKXN@
zp>@Sqgk;2?rDonfdXK%=ov<pe)k!9ca|iB@+fF^cjY{33ptVE;0g6@3Ua2`g=1Gb{
zrZ&neqXUf1?(XQ|Wm7wQlQ&Ib-+UO5HN{AyG?l*@umgy-6+BK5iPN-Q^bb)fA2-?u
zmayQO5Ne^*PRln+J$PV6UKSN<_;5iT-3e)FMZXK9!%Ef>d*oawTUA~s)P9m_V}E!R
zi<Uplb5y@vo4!AjDcyPK4{Fi+(mkKEs-fzVAu)~c+u^`h{85cO$F^34`uo#Nt}hZ-
z7TBr{$@{~?cnx_>y%D{zz)*JQI!h;~sH;O%O*74z9fND=2(wqm7I>uvqU;kS&8SD@
z?UA3Qf)hV^_E#KjWKvSuc27^pG~6wnb)Lc+Y*(dl4Wfk3`{AZ1pA0%Wj{j>9Bw<ts
zWaknHd||s$zmiSoZ%^hR9He-yd!u!}gUULjo_Y#Rqtbj+2s$o905`m$x(!c0H0%bl
zO$l1N{n37|Sy;M}a~kLyxSPbMzrzSxYjMnz>wxaYSih~A-KQ|)rq;_HrY*htSK<)I
z7uLYV;Y~n?J$2SN!!<A3mMV$Dfp)1)nldwMJ0opPakr(FP4hUrajfk{q(JEnq6ps1
zbEE)hP#@hB3Ni)aKFNAx;U~b3V~uXm-FPo(+528Tw|RXXzgl~*{@oS6W6s;h0MX;v
zWiepfiJa*>Ni^oi4jACZjE)CP%K<yMXc-YU4di5<$JRAml>YQ~``TI_jXenO|C}lw
z<$K!ZQHN7>c8+SBntbU+P&jG{*8^^L>b8zzi-nKj|MJ>FA#>;4{;Sax5-9-@3Zju~
zamX=8O<=gGzqxGXa+DotrxEMl9Th%@-mv1WwoXxjb~(GF$RYbU#oQW30!>04yZZ&R
zp%7a`5!m>wFG|G)4`rqTHj|*{X{36%LD2wA%bCoAwTfHjLSzkwrD5vSGt00fS)~(y
zG=-(Ys<=HC2}#8Y<iZrT^d9&<krWX~lY|q6?8^-2*}K1V3`#?XEOwAi!;st)(cVnu
z-XqhHP~?9%Oh7Tmc$P5wOn(j2wuCT#vTSmPIQth6PKkgw*}{9X0WwaW|BYYt*68fA
zuCk??&V&+__^qj5L5gx(c7WAHY`|24o4j^jsFHU`Ou~0hrs(|KbBDV-2UFHe^X8?S
zw~TR16JxN|Q8g1kAV3^pd$-R>H6o_Jo2LHzxS+cVL=75fq9gp%{@6O}bAId7-1vAH
z`A^s9!|K!)_+u2;rFY|7_~(B8hQ{mX`m^<vG?bUPv-c})InnapWokC=;b1Nn=KA*c
z#p{lsb-e6ay^qe5`@XKQviv6nhX(>`w`OU^I}`Fe-59e@jvP)I*tdCopTZ~u^)}BC
zwdHt8qU^(XdKB~lw{!)<79FB9yt+>`=EQZ%Zhs~w(jwvP$WRkKy>rf~xxs?`D&}Xx
zU?bMQqwVh9j;C-v4-ieZSfhD8D6M)+Q7yq!^)1vz!0dJqr#6q7zYrI588q+<<~-F1
ziKFwQ*Eq8xZs8mLJ0QdLL+t6edGObz<WA#L*qC+~(x26lY05ei`V(zMD1sZ!+fRK2
ze#XdYJ&b!%fGMRz?U08{pp{u2tR2zgZn@=eqwWdD#ig=@B1=NhENCNyPk5apck&|L
zI;&7kP<m03cbs~iSR%s*N^ZQDG4uV3v@yDrN})#lhRyVKd?Qf%E<9hLnuqhxh^wYV
z8zY(vDMqSSu`j5yg2Ic#Lkq@XMY6;(Jn>{5SoBZsVR`-srfFyA`|DalThK_%fkVB<
zVLp6jw286)$Tqx|RCN$_DUj9vpySAV1BX^cmTV#c_`4b>q!0>5p8W<w-&Q%+27>eF
z>vB&p!oDoX+B6roAz8KRt}ht4#Z1)_mE2~gG6>CDCJhnoEF!^FuVtjIoAV@QA;tz~
zObJ<M6zGTX()_y8!jE<G9DA-9UOcqm%AI0Z@}3;z#zh+k(Xx)r1+<Y|()uj&8GaFO
z8%Gw6x1Uu&-M0-gvj-F8&?A>Gi+(Z}Ox)xAy3P)`L0Hj*9Po-D2N?>YHm3)`f{9n9
ztrxJ!pN3HvH^QQ+qwdZF9p##wE=$a;AqW$-;K1lED$(PA^9$uY+WK8c<zt4fSjbh&
zn`nKYd_=qPG3|R$bWDk*`Tn$FmQWJneF{c!TJqggU6Lv<f<i=Dk=sSK$+53`+1jL|
zlWpc;1&#)|OsmFZ1;p8hh}0^p((=w@3o8||3%f-dF@%en!2;ilXsal#w;RU*i%27_
z()FtH`TEfbr&5SZzT)+vGvbD{5Tmc}vw4MF`Mj;#rJ;7raDAX3QPNWQ&w?ScRy{66
z(?rlLc)4kdFrSH%%hJr&imOSV`>?yB_()Ilex3xq*dyZ|G3(BQ&3F{{{tbj!=m+o#
zy>o!7QE1>n?+Rn61(sgkM;aI<T>jc=2W@kNGkO8yu0<sbHg8o0vAl0m4W3>icoij_
zD}`6MlPTSFgA;z0Ci7yStIxjfzTQrsUK2qei%!pgCEDMXDv;V^*_v-_^@kx*4)a9|
zCkrSVt0D&MMNM{BLXjYZc`SV^tSAe<xwZOf*p57~XoG?ZJhriO*NbB(L2-{Abc#Bo
zR<A;6nWM?oGs8g?j!HG)Lf&J;;RAeee4{TXQbYfJ?sC9LiOmBi1T1v9qEt3@9PIH6
zDgKyh9f6R<jk8)(7}fh#zN7nTfss3j74DAAeErS+tNwQK^#!uiTCO94D`E>b>r6zZ
zzIgyNc(cNPL#OAn-E@P=6q_eO+MpuxJpSN9mOsQJEJ_-9R%>^y7l3*JR81a`qcrmG
zSfZuwlA6f4Ep>OuBB%pV0rt%ljm^0artU+>>>Ta_amL$;c+t%CZqgp(4lohqmoycT
zIo>s=;0z`v)RZ<?m+rHbl#ql|1|XR;01OY0$fQ1lLEm2gjjA*R%t2Wlv4yowQ{aR-
zg{k>21hP#OD2wu))L>AGzCVb-C%hY08U2;q1g{c=wriYtG*R)G{k}*-weL`#N4q?k
z_-bLwKymOgcb=e_ChO2)qc(W@Ns-ox9%f8BV_Hg}ao0}F3_!{wTuVP8<HsAEhZT+V
zFgyQmLPMR}z<|IxWMqQUi!qA4itHW$^Lnf>b7v?&N2$}`v?Xou$!J(FLibS4zpqkW
z@B30e7yCDoDT>ILm)KWdp3i@NeKcN~nidqm#Y7&8d%~@cQ69sfpzQul+VRB0;6o|t
zaSysJ@u;+q88-Id+qaAF+RZ15CH7n}E1olV*DlFz^3%^jn84PCI!J?5&+V`%WkOZ!
z^9BWP=&kwFtT4gxBjRkY+3-ABKEg*Yv%b(AA^(CnuCOMgRK1Za_n)Y6b!hWKJQFfj
z-E2awrg(VS_Gj!1V|lY!#nYo2eq=BWdl4L2HOy-c%X6KAilo5!n+);Brc}WH!kSLq
zF)!3ZmryjShDN6bN{vum6c*zIQ84u>j}x8LX*L`(|ErcA5UBs=7bSGl#PMo8WjWXc
zo*g*Igjbfq-wCsoMBL4(T-yJJj5}|naQ&+ou${j(%{?<0`G%P7aiLRN4ASlnf{R}e
z%mRB#Jxg>dn8ZwQSMP}z$XO@qGwU(&m$Bf`8KLu2OCOsa5_Y9{l?eIJi4G5$H>wi<
z)3ZrYHE;dN;Z51s;;)5T8DgZQ{>{&*Q0gU5K8RX(z}VFY=n6l8Ny5<>u0L<|gC<o4
z-H1j|12B)^oTh}27PLI_(J8;vM!-j6lbhan$k!O+Te7-UiBwifOMS?2rzLE}Ol|p%
zF5oN7aq>nvW5yVn%rdrVhSo2~69Co3cK<<)?I~dYA6DzF&PJsqRsV!jd=o3K3(VLK
zF3i}EEYm~zUAHC8*^xq@-NyT}&i^rv6y7}l$Hhae^Ve^&5;NB0bUn=o*Np||+0;B?
z+ij`ycS6s7nJw2v%;DyLRU6*lsob-+GG4!i>EBqiPmb4KJp7pp6%8G-WAtgz!;LVf
z%QH(SfNUmat=x55ezFYVNbP?{JbNapY;9AEMLfw~{R$R-m|!I*70<0UAB_okXeOH5
zNd?*T{WKjAJU*qi;%5g@-m$jgF75bhw!hK#WWbYn2d1JW>6twmc_92bdVvUhlS^k@
zd7gTDWgCnXWbZhV-KzC7pV1@~K@;DhI*so_?GVavAirQ`!Tc?>$}zhhjA07YuC!2a
za5wiJhWnz%k`}zqH<F5Je1HFg{CNi-IyAr-QQpbP!D?!Q^uB}H&I+vj<#M3V=|pir
z)KxCDz7sL;wC2TL%xW83*8^Q}97{PsDmfh!`ua--a$$#X<3*yJ+1xy?5bDHl8bu(c
ztZ3%W^^@oB+^INHAOA5T?yRf}?KgX~@4WZZF7_DN9S+2zm4`>RRlqxhgK+J^uz~#*
zshTTluojmm4OIzgTI@egV^GA+KJ20~x5Q?iTllw6%d44`c6vP1*-fOZikO2qNaTIP
z>u<Z1EK+nslUNd-KN%g+F+`y(kkD{x1P4Sc8$|VGqgm1TLV;9{anLvr$z<PHg0fI@
zRrg%FE0MSuvbY||I8ue<KY7B+NHhozq@IV~)=d1ZVfZT@wIGlhd<r8Jn&9Ggq?8kh
zyI3G~F)$7Br%{4<+}y60I3w}ovL|K}t?YMD;h>wNd#OB-%!CaDd{qewl6;L(2*(Y7
z0w4@!+>?9HWh@^9*FQX$^y>C08yPOonO}cfkS9BD0jd+Tx0{_tM~cp@35Qg4dgh{e
zd^Pda1t%ZGtJ@huMyJ~!1}8bJGo99_FimE?*OfHf#lJHvBY8l^|9SuWJi~TfQUQ|M
zliMsE!-6V?f@i){723<KHaC{eXToe($q7E%SPq^1`g^o-N?f3Rerikq`DK)CrLFsq
z#G`fp=A@#~HsiJj5G;?&eUJPcThm`d4DLoVA|%OXf}0)iB&sByAfIvHTR7WzY$`+H
zn26axtl<$&2?`)jYNQPd`ES4)0Etw?HvJ2blto%z|C>Z{2~}xC&HT~ubQ|puddiQ0
zB<AA;Q|M<%qVksg7lIn}3;j?9|8vr4aMmkLEfhD+>rE5Xh}{X5xTi|<E7+`&;Swdi
z-%B73*+L;p_Gq8?<pE={@&$5<BQS1!uc$5MgWBu6yttyE16>(@<Y)v4DgHB-!oatE
zpCC&CL1|eEURwlcxkDn^X^wr@3PhMo1J?w3UfWDv2-?O{ZQYWZPv-T97P3nkd75l-
zMw*`V<OJEwl5m8pKhWOHsg0f!dL<-{8HnY+z2xbbeHShqE)q08IeS+1pZ;Za5XkUY
zIQV~ie~z7>ha~Q=l^MDkhF?LdPv~m+`n582g<k$mo6YHDZ7jzkIq+Q}hN{d&y+k_V
z3|t;I=I&nmdcVzB<HFU8m4E^UgO<m~AWDOvz#H!P5quY>s0Cs#_7EyVLb5z3q{o|a
zXio`Gq$rXix}_E_*N>56zq50&$V0k{>7ht&r8Vy_EnmWgnkK0;P@~aC2E3QSTwD{3
zsI>dGwSTT-`;IsD#}^jd5|XHk9r<F5);}BY{j{Q#&zJFm{^m?zJL$({xa%_j17e%i
z_|VCq7s~x#-^G5DMDPypb$1|Oz%mPL=pu=2eFT;j0VrvGtAkx+7v!bM{pN}`+}-?5
z4AN6^d3iyuEW8KB`F1b7i49fzyuW2n@9()-%{k2}?5z4n$ivGMqlw)6jY6-zLCmt<
z%!7Ffr_*^rlLsE=BQUPZ9d%nLT#Z2+g-G6@UQRLzT~QAc5E@%Bo~a)5k!QOFv3EaZ
z=s)Y-=XH2(@SdO>za)G>tOsC3Dr-PBxEiQP^3eyeczt<cl$JdU6q9Uzrw$oj+H!eT
z%?4X4PB~?SO#9fA!?vsbRv+2$%GUC*xjH+F*7|{(U>VTC_x1psP7heNe!9pqZ}aYE
zm7FfL3p+wUjd_3lm0-l&9?wurSsTv2fE{-Hf~5}`^MGSmy~-F=0sU|*hPB1)FFCP`
zF6uu4l>pS_li?g=D`rUIUcdH?U_N~bfQvv$8hh=Nyk0+wLJRXEs!YLre9SaQHv>dk
zRNAI|R_1*&H#^IBE~_b`lWS`af14-_`*L_YQUv}PO$@~6`EWs~lz%8fkKusdjw0e(
zwolmAtAMzG>sV&Plzs#;UX}iLC^$><W1slbHty@>#qu7TZTcTM>(%N3m-Rh%x^dih
z>xh>p@h<Jxm*i*uc>Rdi<^i|**UfGAcks!>IPr(=_SgE+)BYO+>xD4_Y4?cN=V4=z
z<mY}Bqx;vI_4watnO~x{=D#8@e!I(mm-+nv2L9J2w!41Zx9j#j`hWI5MvdCT>>H76
z;(oU4)w#JAP&y95V1bEWfj*~*^JBvDUzuc%<`RQaDHMhYV`v7U`1x<#T5|P%8BS)$
zP|2cOBZu3BvU4VBFN1IY{>%yuC&Ee9c{`2Q0&%W!s91nbyg(xIqZ`rG+&gFPW7ubd
zd=rLYGik)aj4GYRmhhgxIx-IM`W*9w;>!w3v5yx@Am64*)OxrMuc{d^PKVZ)(sXwY
z?dPCs>L!o;Jn05_jnYo;v1&O%hbQ6_D@dwvKW$PY1#ef<N+l!qyHzT^<7}IbXWOYC
zu!_lTV1_{pA;1^G4$YZ#tdLSHk5}n>wL#&-e7?i9uUtg-%JDfO0%uv(uc$qZV#SM<
zp~JShZf~oubpYdXxl7+n)1g%%EuhZ5@egNqV~OJ0{dEWYPDAK6?th%#2ukX3?rX>M
z9f;#|_&FVi@ixR|@*)|#^4vqtX_f6mGkt(CKyExQS8=*ns8oJ)f2Q?l*&`$)=VdN)
zrk3n<_zpANe!K23VcdNi1ei1iolPZY=1yWH7a2<SR0-wpjUDph5u;;`gX&qJyp8)n
z#G!_}9~qI>B|<wb0j{B{>|x7JlSvTGO!-a@Poh$8-oSZ$FX5z%7d5EEtoHVy<Bf(;
z?SVC@B|8=I&7R$4t0@?>H(?fGNl`Z(+Ud=AkyfXqW~$%7Ib4C+0g>z<AXL;T8R4<3
zRe!}>hDd)?K9~S7JQhWbB{D$Zb)}~yOSVX7&FK}8^*H}mvMe)#S_zg!Nw7VIjRwQ}
z1np^Mu||OkiCr@kGsVX1TVbA9qFn=bF~t(gZ*Gc^`3aek$ksFqhp}OZjH=>O?Qq(~
z1DhLw4ngN|Z|rBcC>mvICiM-zoGB>nS4kx`Vi)xdDwu&$k91L50xbnp14lb<K!|kO
z8$BxE<8~}&B3wqzT>rw#!x_qSsj=^wRX)?d1Y|DDx5Le@i~k~x1DGka?X?wnUX!3N
zQ#98*GHFF_wy1AV8x%Mvt4E<UVcepV(tOLINgu+mZ^+s%YoCJ?2gq5RiC#Gc)T15X
zv^<x$7%xnlu-fi#wA&W+Tc@6cZs1TOSr1U&x3x)MQPoh?YdW<kF<TmC0bHLqlBUVI
z+)Ykmt)}&T(a`Q^b=2d}fMzYyjMn$>?adXrs(9aVIa;udY`Ny8h(~0?-Ns%jt+T+P
zx5HZS>AHk`*gP7tZmO5^7fq4N#mmQLT;!lZBAIQ=HBQNFpEuLn90BS=A38>gKv3~M
z31R4m<TS0z_r=>^z^nrWdvCajf{e8XZ+y$4XtF3B`Dkb#KfhJ1EB6wE_y=U2wy_nf
zq;iH93jG1V9QGoQeec+&80|6nQpdU;@hmZnCodqtQTIPp|Eh;fo5SNc0O`}|OkPQH
zZ%`TXk8!q#E<IyPOPjL*(mWX9qg#qkN5=0%SR-L$a#l2$Uf1E+AQx%*EAAX>BcWEL
zY+v2z!b;s!914G|IP!4@urM$#BO0`;XzCQbO-2<^FpP4`YY*Pw<_cB-tk1RsM#QeC
z1fH_dWiODA@*+9;B&bx;Wiyo37Hi|h_{!bQ^n~!#1&Iq{f0hU|6ol*)Kj=`VkkF!X
zoxIjts=M()AS-!vM^;c!H4v|2B!xS;0N+&+YOcXS&fWx7d{$0jm+1_Sy7&;uB@1c_
z=CAj}hUl6}i;($sO4aj??g?rVS7ATM$!Byi68<3?zujpE!k|b<D%`R%G`mhTq5TUN
zkwk?ZOFo~BcHMt`r$Oil{7%fB{pa!W`0w&nbo54^(;cNT#xUGf@DOH5nMvlFUk7&V
zPV&3~ozCPm*@)wpOPi8)UPQX|6BLU(?<g#x=>l`%TxPTV_4qJE$Khn9s&=}-AL95`
zkMZV1pHd|5w^CTpfw#$WV-cPf+2cn+z~gyS#p|!Vp3`Tu0e<pM6*ys+*vsDqh6rY|
z<dcXap@)mNtizo$Z|o{|YJ<Tbj_u=k&aoDsomOothDepSu3HF(=?Qyr8gW3v-_1*4
zmnq)sRhqgCT+J}YD?nR)-gNgh1+i~dZYd-j0?JIpZ(Di7hQ)B~&eKC`rzfrLC;xGB
zok<<`u_7NrxRT2~(<9TSs6<U#Kcj!?%BIz?Yn%FKp5!b~c-|F#8>|WNNk4BIaTNT5
zhe&X}angKPM#WeTx1zj5Y+)$0Ed<AH0K4gf@Y<DW0~65QlqX*i{!5U2Bfpd71tHut
z^*UxWc%otimdSC>2L%g0g(WTOI`&Rr)AHp1VecNAEDN|b0ax0#ZQHhO+qP}H5|y@X
z+qTV0+nwL-xZTkaJ?K%7YI1(TiP(Fu^}O$zo6lEg25Z-%%4g+#wRe5+;~E+H)V;Ys
z3n1zr@0|v-J1EmXuw|Y1yj<XKV?MteXUY$FZjO3q)(H~58kmrimQ?FN*-+LTMED{W
zA_fuuV-wB9-vTkfTFMwG^GT<o$;*d$Rr5O^W{;<xT+IhiT5J|@Qqx%|QKrrw#2c%w
zVo?yu;#LNZ)yKBZ^niEX5pSZ$1;cGBq(2R7h61{eXjdXeJdfX)P_`nc^bT_ZdlxJ_
z!iZEdg<IV7XxgF9IhP_m44vCwP{T*~u_;@$X4RYJ?N^jLq}oFaK$7m`*oQ!Lhz%0B
zMjkRunH-js^FUzh6A4zUe-COofSO5<x7J}(!)k3f_xIB&3&NGAqZPw^YW%aA)vQOR
za8FXD@%ynC8NcY9R|xC{BO7U`b@roP2kOm5RA+m}Ek!Hm>rJ{%k6F<ns|A+?>w=7k
zz<_ycgxKkCFIO^09*iRA$hdpxv8nQz+l0EF(et&ERA~!CMm6Ln{y|XpWHDgY;&3#V
z$*^6mcv7WJ=*DCDF;bPf63X;a2kf$OY|p{knep~`AD4%;c};V*YUod{))KmW9PD>m
z2mWBRTwu#cpHp^Z+9tMDt4L?MISI+a#;~W9dQe|lCt<VDW_^h11hvY2yM0Wsc`y8w
zA<ofHH!9-iX7IR`imqO7Hd2S8TH}IRfX|>QigVr`N>lma>%_{h(HBZ92BmBq#ke_n
zJ7L?kt)>tLe3X+?7i+I)a}Hq=6tY@_X*qxqnw&{!$ferVlJ?9ap-t`J61LgmTbaKK
zzSU0oJ9``Kiayk(ZR9HWI^x}=X3KQ;+CogxcOV~CB^*CR!RhF%&(z0F@n$#L+UZlB
zqrG?7$0}apa7_1ta|JwfhTC#{baqKr7;p^4b}|n5C)mVcJnh5YjeeD#fknU|kj+7-
zt)YQ$JE-pjfb&NZ^O<hm5oZFJFD~+bPq38@kKU*lLz@73c|&FqDGj49kj;>3qL0^f
zl?N#bVjw<SO+P&{uflNsyRl`0VaUGekRurB-hzMDSbLk(slD#ISuiQnZGa!%>j;!v
zDtfN|kt^@_2TH1LRGWsX?Fdv*E^9D)={8LIM|`j7s01HY%5Z+WxJ}cH!h-%0d_`4+
zhTW3kVb<BPrFJ2GB)^x6*2NQfyLj?<d^A0^A_-3^P5f^QmBBz{!E{!`tLteMKb}6<
zd^^k#y?_IWi?4}TGKftinwMYpDQ9ZB+E>$+x~C(3$&(z~$X2T2paPmqm6GlSLLr2E
zjEr)h5A*ZVaV{&63)0A|*3O(>J-9Kb%-R|{uEHu;Xq-9xXq_NYr*+VlkyQ0SV@PC~
z52_p1vz#F=?Kusk&*oGSUC6w`xtTVATWM=-!}<^Z8l~v}jZzY->P1QPl5r(P+1wwL
zPL{q@ct`X2N$pG=R?S5;)%Go>MUsw*VJB<}aoxvzE8h1!^$rf5kTbbM@Mt@9DEtXg
zB$yhai#>oW^43M$h!0of{Fwi?e`DvlVTg?jvCThuB_<1hh=7)p0<3V1++B#V)=75)
z#uMwfL7eJ;;f@HegRMwhnYm1!PdTz)x2PDaJi$_!YG12tzf0h%B*%>t4HQ|mosX?D
z6jrzG9!9s8r9|^WBO7e?a=TJE5rS~{U9-|(7iMO)xb8ab3Acr~5mll)8|=K|{P{2)
zKo-@(Z1@>e$s~@DkRZg6mj7y3KsY)+>JA@)80plq9x=}8$is=phUPX-jIMd%<(CTg
z#5=<Wl%5R_XT~24q$C}cS-OcNMASbmXwMx#{H^7)GJ^PA>Npq@1|dQ>fZ5BF7L#yU
z0kS&>GtUUOHzXU7ITn0F>ga>#oYCF#ftWuo{(Q0j2aIt;*b3@{>>TbAg}mu=HE^nr
z&*9)U%kgKOht6$NV{qyVL4{%D;oAJ%>}H1Q+tEk_$>C9y&L7dr>Bf9)6Dsvoy6hhp
zJH^l&d!&+8to+tQnJikhFIRTupa8c9THEkB;Yt@-u}4cS-mFvC#KKATr`HO)c%h@S
zxSzNa2GrL)oHV-AG(GknY461MZjb;l3}2*7g2uZqk$8nem1ItbBFNXQP@|ea0njSm
z&bu92T=NB{5J{XRos6b|)X2SY9MfsXHG~BboWB=}y8dbCo-UV_w%9=X=<;k#AgW>(
zY-e_gqct*YrNnnOpCD_nrB%J-m~MH~GA-?A0JpzS3J~B6;?gMCjGRO7&zBy)130(m
zgJRPLfN|D>N{&7elw}r_c$;LLX&6AU7I6C!bZquPe!!k#<T7~C`|Xr)jOK*|V%^Fw
zAm1wD7tRA{fi5lDfm^!$Vy<HVs$H4F?g?j)F8j9DrlzW)1jBY>qpu@YiSW^^v&3*<
zx&5=3fJt;xdU;q=b%mxkdQ<j`{(?kAuNMkonYBeZ(M+k^(OK`eZMkvX&+Z$-W}wAC
zbE#-SW%B{0y9bDW@kZ1coArRfEVMf|^7bE9jyzLWLM1)=gAx_VRFY|CO%NTZY9=Q*
zh()_iVzyJ^iNt5X|MBt?bbHW%9?HdAN<W5Jdk+h?AGOj8Ln4#jnFk0$fKg8qIYAN_
z$XG=+pA}jj{mxb{ego*h1ATxpb>pn;A!`{{w|5Wz8HQ5IxGMyB8py@i(E6nd<{fCZ
z7e^2mM;6Q7v(MM?>*MvfiA?f-M83oxK+`~2uf?1u0TX#^8D5~Bf_Brl6<c#|&XRQ~
zgeRa!zy*-O&u6=f>3mAo32kkvpZ0Npq<4f>c(>?7#sY4i(-WuU{3_xi=;uFlc!&sZ
z3{bu#i@zZ^bl~P{vU`t3@rohw=Zxj@ob9zLm+YE3q|%LMtB!%<?d032Z3V4;?!=A?
z`S~<S)5!!nF4GB1&vv8m;=p*QL?zQr->^wf@%#8ZA5P%objA<we=ZlmFx95vWM3|0
z<q|khCDHILcWc6X`Lq_sS;4N#A5vP@jJ=3fsx_)nmNgp{_}Cn)a<tz&g&V=BW@<8;
zPAB3R$N}ALT07d#Pcx4@YA&SkgAeGBPl@XRSseIW_6UCE5`<(R8i;oA9mo6(21`Is
zrHNF>8HW1u7sG#<O&iHS!3vu&4j;{$h_e%D2l=w$7}0@iWc=4ykbGE?1sX+1X$j17
z*oR=+Frv{+H)2nSS%X9%1}|VpS=op|RfFfqf#9TT;=;dG^fHhki$jX|F`l3dk2~p7
zIqX!3gd`3fal-?8(+vwglaJ{v5z#YtLoxz%+Qv`r(mXLp07irRn3?sz=Yc^G!&DXC
z>y!o#{}~2Sh*Wa`%)yH8D0Dq=3K5GomR(qq;R5s*+tN*zc(z*74bA?U+3J<0(OsGT
z@4+9%@OcbI6Rt8;r+|kJPo3f<giq>AwmixiC%o5f5pz%Y-_OjsT%MpHu?VHt*mxvI
zxasUe4Rv{9G#1fD#Jv)Lso*ILa1)vRtxDnjh>?0w@C&kZ+h=Ej7jk7dq4CpxJ6OI>
z2QCAGTt8n5NM_qgzoxg(j5J5e4OZ!U#d#HToUq=>26d}F2@%rTD0E?{*%$WqzA`6}
zN)oJ+aAno9y`^72LDnwIJK@75#DY)KPBRhiK2Ew-9C9cTT|-?NO%kPr-<hvO#n3H@
z3-Aw`O6sOb{_|F%#0wKPSz7f752f3Ls(!2nr?!M2CW^nz@QNXZUGGORb_3s-m+lzT
z9VnDS<rKs+3?(F^hgtue7mG?zSlXSTzE?4uQ`&WAGuU(;&u|02j-Jm~JD3n2d|uHI
z{5k)LMI4#4<d-Y+UvFA+!ecCN#?re1kq|ZYlIXtSGz&*P)5EdE%3=FB6QH%%1;jJe
ztf`her7)KN++T)OY<3BQfLkmRqY>IcRWD7Jg$ejj%o0Q^FT#PoT<oUK*y42@wjMMX
zp1l`I7)+a`9pX?5wvPh<LJ5JOVCM#rk!s}R;c5Bui+=^684Vp5d@mXFgNGPF4x#3p
z#?$*anz;c&rW2>Fxq}oX!4b8{ig8d2H*VXSP`zu>u%-l>hPt`CzksSKkbN+*L*DtT
zp|ve{U#CR{M$m?#OIpmqW?Ceo#A0jaoU&72&FzI!sXX^XDU^O<Xv6+LmpYRy@XIE;
zS&^bR<Jkn;&t}yj0#*jbNgQOO4?q(a*4%GFWmiKmb#qRx?;KtUxTqsL&1Wc7MhmLX
z|7KWWV`b%dQwuP0zK><ZD4lqsw)>+r%&v`>sk1DulGKwAGqe{Y4OKa$J}td|4B_=0
zPDG}T(&@=VLcqfj#t$mUBmeG&Z2PH}pn4i^tDeNHR&J`_IH11E$@xx^0#q}}(tTp*
zS~UOM7@TSeDeN%&s@4VX8C$^I)1Y@=ljyRoGQ6;{K^c6(?UX{RWna1R`kIftxj;>J
zNKX+%-tQu^9>SAdbhc!KgmT%yq}34x9Jp<qd4CUS6;dm+n1;>-eE^j{+sR^NNz%4)
zRG*SgKil_&-?L}q2X0mU*r(RIpN#hUDOV}}q=JN5Aj#s|mEBp0#Ve#tR|h>=k{O?o
znQM8PxCJ?}@6D~WT9NNwgXd*u_`G<TJ}dN+eeZS`IGs<(SLlN93p^f0rPs-LC+Ht`
z;Y-bj2X>f{-+%FGP_|hQ&q3cG?a?HXD7-?;4cEQWB+O!LVJ)&QOY7W7&84>7^}oI0
z<{Z3Ck<GtU+n^$8=}fEzu>7mC>Ye~{`D8(~m<ubo(_m#w+0*YV8nYInfXE8~)z)Q1
zsKpf9PZQ{jJe#Se3YLBro&M-!#yH}EY84kDS8)QvjfScvdIE3#J<&ITwr#{EVjjoX
z79m%(8f`Mq)y@sD#nmQGQH{#WemKtAfW)B7mVxlG+AnyEJ_ox4&vgfk^<bY~r52v+
za|(_yA{wqQ*)m^u0V#0N8gV_OxRm@$(m4X=4LnBHQDc??`!YUujssfvMjQ$m9V&p0
zvR%ypr-IY#JENCTr@2eRA<q?NrxlPe#dC{+NlMt`*8TdFv0frrJ%=Wj|H0ZAzpFQp
zsG%fLPY^|ORD93p&cLYN8i}7kttLrv6lq&1A%As@MS&>C8`UZ%V+fBK0eLGMOK|PX
z3*+;tkQLfhO-a5_NJW{5P7jc8>kOTdk16eyh#BbN^!~Q&fm$;kNN_cPz&;sK{3^_=
zNXAf931<W&@TxXNY9vVfs(=z9a^$DS&5=JImv>t9l_f4V;`)kz<8p)asm%l1B|*c5
zvGvtn6P&1ZR3<?}KlIJAIvFGNaY!lRm2f6$m1D=mxn>Y=6t1N?AIH`ylfXrlig;`t
z*Eh>knFd@>?^G;d#qy09>XW4(elVClxv*TEBJd(Q4Zpp#f_&OGk#MHg*+aOk#=Rlx
zxBtj2_v`zg>t{KNc^9?#6=Pl(2@9D&3|dn>LmuG|oAzE2J?Cxvt7I-JPFt&S1C65V
zJ^e|?R$q+cpLXMKM@$zY(RzSikDLze4+JZpz3m`O@<!9-!A|fZrh^fe^SRNhd6oSH
zTiW)(Pb2B9?cn{<f5Pkqa>D2)9vL}wpiX|w6Uu&^N?vSzAtTvtLc_IjiZxE34-!+z
zuUqZR{EK#eWLB8ZfLZ%tYKZw`qmDhJNaZ1SljDO=Lv6Xy1X|PsP?(ji+YOFhdo9@Q
zp5_7%n+IH+ip%AX=LwT|_q~+8c3C2Gdd8^M$ptJK;z|Dp7Fosz@B5>AeQNqhyXfV$
z6^|IC*UxK<S^K8*yn;I!4+BSBznUS(KBc^T$0K=}$HmJfiferg-tNdm0CG32o|f+Q
ze1!I&Qw*hugyIcSdx9vGA*5BPU~>eqL6zL5HI=1xQKluc=S-?Y<S{q{PW&*fO@ibx
ztH^%9#li|8wPHc^`KOrO+GTg`n^KI#hCa|>f3+G7;t)#S06Esw9BbZ=iLX9o9p&D}
zKPbm`;Q%ePtF4BVoHdny-3rd${9=G1Fb{*tV3RTTPocnkFcd1_$z?c6Y8^PZU+Bs9
zX6NMHk#C17+W61U1+P7hn#j?%g#H4zmLOW_)Ph8}YRk8QE08msz@GnMJbL7Dj|V8?
zE5Hf}mwMBVA3)D`U5Yu69Vt+S>vrFaSWQ42b{7XHw@w+v^pE)1d^sK%;?A&n!O05B
zB(9lwnD+Oc?g4HPK+bOd;tDF@Yzcx5`!mAh69~3EVOF$YVy_kVb$nyumVIFa0J}H+
z?4TRxyTQ%5ir(QVc~d+}7O=QWT@z(sO>cax6JsNRWG6vE__M+}AWtzuZ-2KQpl4az
ze$ticiMf_FqN|O&T0B5T>Y_K|>pq~50orQC>lR_>B!B1xCYQwKgMeVqYYMao&Cd+Y
zwYqRa6A^9VXpc|!7r7ACO}8{YgfTO+io+Hz$WTaMym><nM_O3}SbHawK!ERUum|B&
z&HHJ$biU0msH{Xz7|~`{E625(=OdR2wxdR&c_`DjapMvAolAi2u0IH#1`RyG08#$w
zUYt&(I4Fa-a~0u~8;5k!fYQE6)VkKSGxw7R0&@Jr(Yh+ZOO!UG6J>&7iR|zOw&jF_
zia)QotLziiwTA@B303gqNd(W=T(FaeMgtD1YN(HTK(ifOW*{o90NuE7ni3mFArrz;
z-n?%0ts%Pv&->o-O0R<Ep!wDMX}5#>^~l%k_tx==bL*h^eTnA|n-0%UpLzdVRLCzf
zyo(PzUrVt&cd-K?bO-m(Z$1Oltsd@+yAUUx_`sf#O4yuQlh4M1%{COJQh-}2l+SyZ
zt9;o%3>>W(MQ;Q?wnpVPTb&Py;jbG0mOAHqG_Ajwh0=NOw28vZt4hjnTm2l7w{9Y<
z9P0CoC#dI2L^|cQL=wKHk`NhqBGaiE)H9=riNAF3B&C2%kb{Pg)-GV#7|>-evYFX_
z4<>cCGWiWF0i%MFH0r5(<P9U2O#ZpGI;QijW64@;S-WDWghIw)kX8euua5FhKYFO@
z8kfWRo>SjZ&tO9fO%@yzImh4#qk&k1DGw`x`$fzLHTz%CwM}d?-M3SL;1yyd)Vc?c
zd97{VfRNlGF=Yx};y=b!5}fGR(nWnz%1;NX5qVc__S5g`<FY~TtwZnf@5f92cUlhb
z#_NXv*KOEVjjP|BpLcTy)Q;c#*X8Tjp4`|K9iQprVaE5H$;rse4cUmOt6R@o*Ry<D
zsQYxB?x4u^a+xVFj0iKdV@w)ZGT6C*pC)x}beM>CRsRob)f(&BFfk6kmYX&<9*>$U
z#O#A1vLtzr|HNdYlo5S%yEz^nd>CzDV6c&v{&V7y@q7A3*6yzq?Tq6~lG}5)!%a_Y
ztLumcHR3$1W^~1gbwVy|)!F*4vMsOevpcJ{+5x{^;J*5P)+C&K_)}RU3zM65ZyDQV
z3$5YUS`u~*R#qgyxNQKIqAPAH<Po#ee*|lWF=*g?nODIEv-w;(^*zB-xB;(mZHw_6
z^S-2xQf(hSZXVbgODNpBoeG{vxbUnG$eEY26FN$i(%xq!mnfKA7rSqjJWe7=%#x_W
zB*MplJHh63SdYFHcf0QXTeR?oyVQE(-^kCouYHSB^Y-8B?a&DiWrK5Mh$3l3p}cSi
z%<>=5NIX2;nNi`H2KlD(FD=k>aNw6FcMS3Umu4{_tN_c3c`Wh%>c#4TYy}et6?-Uk
zgb2hL_NgV{|4)*YTPm~TmYnL!!v^!^isyXn(zOvH!yp|UGlrO~U2@pnSZP*GX^uNT
zVm#MperV5)lZl&7+J>+so9jQ0^?aQC!6bnQpV6~ZK*SqIZsEh0kOQ&c^#1}`br|s3
zal$QP40ab2Hrig|5wJE&0tvfL(F@wW=H`wZbpO=ap2HDN#TW$NQ8l*wQYdd#3<QDs
zg=OtF&ktQCZ=v^r`Vs3X#JcZI)j1tmw%JgR>_Qo<!D`>P{Ak3j1hXpGoD3Z0o~%^q
zy&h`J3}mvAWOSoGTm3qopajo2J$u@8Uam;iPDIHW=zme5y2nV%Qm}s9N)W^(QG^hK
zr3U}iWweImZ93^)%$`f@Z7AOsI?#zO0b}>TG^(bn42W0GY?hOT0c{z$PFqDurRL!)
z({CyHJkeHhW3`Ul$w<~1SMZCV<~5Snei`et30*oKwi?_EoX*X1U2&PL?01$2j(It3
z4m>Yz+41u<P46Es{01~==Pq>hhukhg;HYg)6jr4f|Fu(Rtn0kf?lNO}SZ8Z9FFP+c
zQ>OLP*~A-LQUy|btSj@)4a~YJFJf_F1Y!|W8i<#!(!p~%%jED)k(~Xw@_f|xp8q|d
zl5W<SyX(bwlBT@F4Ld`h)2fxFu!C4XLV}(W$`8L)j1B|D9swfn^@ZglO`#<OR6Y>_
zJA%E?yVe<^tg2>rhnM<!rIaWXy^FDH!6o&5*XUjPTT-$*6UZs$2A&OxGk@B0<<fa;
zkq}}xJtMc>OyyzrVDRvCqb(MwIdrumaOGX$IU`N!zx=BDEA9(&1r~~nvNEV*E@^yq
zrY?2{)wL_65c>HpQ$0prO>i9G`=N`ykFEFIE3b&JREqt1E=9WFPaoZgMK72%qVrs&
z)S~dV22$1UHW2Q2RP*oI>}VZZk_4`Om9++sexuzRh$yH5v)dP1@A!)G#M-XDEkwqe
zy23I=R^?tE#9i$%J_Ib#2`i^Ty1JD-$^+gZXk%}cD$hxb>@3Qe2(kn|v>L`ZMr(7Z
z5PB~ll+~GNy4<GKpQoW2GHO9^oS3%kdsA&XC>RG16o$XxOqWxVDO1wy-w}{)N763g
zYI=#OZ(iUWtmvfMX?Z9K4RvY*gFNRD5edro`bcsnlX{I&^71tv=y{GJEL&YK3T8gh
zkC;=Er-u{1&$B2#kVY#?aUFS#rGn3c&zzZVKKxp!o#WJuaej)3ZDjYkOYQ<)2Z1_t
zLdy<9sYnFzG^1NRi;dB!G!K~;_Ta1MvyW=cdx{12Y|slHvlmyW8VbxMkbweBpi5~N
z!E+}ZN_eyeJ!xdV1J=gZ;yn6!c8HViA1+O)@O{DuiX-GFh~o-tQe43sxn%E|3Ri<B
zKfog~WyReh#A=#@mt}v_IyZthT~&^Vo`>1BFuZCvxEZ6Gap8VWhC@KHAOL@f4$jzs
z5*RXo!Q>rtr#b}8w@5jGBa~{5@HnR!Co<^V=K<M~Qjag=fbuMxJt<hXwYc@v#QkDA
zV>8$SmK`$0Mo=D7mf41|lZxNXqgFQXj)K2nrgBAH4BR2qmg$w1hjvTC`MB7nD+S?r
z56&wn3}u5ot(7e?9Y$^?yleE#59+2L_mTaWOk>)<-`X*QvW!r$tFPlJBUra6TLO1r
zIr@crxrk!U+J&8_Yg=NP7aBrY)4I)uibB_xge2+TG|?Rg1wsV)zYyvMbgFNbanUwF
z4#6o62_J1JIpp0vKBtYqr-UYVt+9}=F@$G;5~-}z#wdy0q(Gh3>}CVt71lUalad*8
zf<jg~*EDlmFzDPb_2iDAA)K9QpnOE1_82cW)U7yl>%T<*0O~)0`VXM~1E~K1>OX+`
z51{@7sQ&=!KY;oVp#B4>{{ZSgfcg)h{sXB00O~)0`VXM~1E~K1>OX+`51{@7sQ&=!
zKY;oVp#B4>{{ZSgfcpO#psEY`9?o*56P=(FX1<*$izMn-g>c00Ask6K>Pau+9Fg1G
zqCga?Yv-%vXaUcTu#S#!mf21SIiryc)Xb?lgOd50)LGrXSysuRUVht$8m_a1k{r1(
zEI!gn;aCm*dY9c|IT9>o9R$`D>lHxC1Nlo&mzi%13pFugh0Oqx+Sz|QEgPX9^k4@H
zO;g3dl3CbBd=XT8J`8qTjg4|D-xw@inb9_gcBHRP3giyQkdhzNP++c1JnjE0+n|*s
z8til`yA{qCY-^ZX+mU~Nh4%iTsa!Ah1ou&1@QD9P<edO(CyXM=RwCG09YIL}=oLQh
zA-qYhxQ3s>3bJSV!Z90CmP{KKBk<Tmb%6Jy6yCqZ8^s1d;^RP-ZvD+&W8beH@{21x
zmJ}2VF&5;snlv>^51ek|CyfV#XIEwqnc=&C-~i6!P+TzlYQsC4>aodhK1POKxB|d0
zMGc3KO@B58H(bJ@Xy?BxfrLD$8oMYZihFeLxROp(dZk6z!j1U5(RZ<7rPu-vqWbE0
zBxlzuArVOIuf5C#^`LhsfcAr0QnM`+9*Ti()u-8olJ|rU7|3%{4V0wmXc@`MLG4e_
zxS}Js$5BwP^NVYv%oEu--5O6IXFllQ%nzVtysue|7E)4Rp<x;h3WGfhGr#;Vh@aEh
z7fcqTLLh$UTlS>GypWzd)TIr&2c`BEet<cm7A_`$4Oh8TBnKyRR?@_|cIk>zPb?9D
z<cGTYRjgl@1PCk8{ZiFUpx4@f*4^|`Cs{=r)(rgFk114Pg%r^{Ck6C-jvJQz4fcTS
z?7K4tO1UPC0nejN$UgXRP@nf;&ib4OSnf~^t-pCql-3PA?&`A_>p(#GEog)jg+&D(
zmc_*fDb4P;&J=EpcXfEsKFFkxB#QScM!^N?CAY1Ve7Bt&;r%Qc${yC1%u{Qop_eO1
z-R(F~=b?#cl>--ykCNht6U5BaAT<n=)WyWmW*j37gLntc4GD{XDQAC1-^3n1rn4RQ
z+~}Izuzh5aJ23C@RdF>8#I8<y7uh0@9-~P_LY(5$T)}GU_9ljQG8&%HF-}Z5%1|Gq
zp(Zz&0ZQlNeAvbbYUuY#-vBJVTM0Y3eS>Y5E|5h0?KW)4DJ;f_zK;vAtPw8vI#560
zP%keKF7!~u@yR1tQ=?n$N)X1?>x<pilCKqFtyS%_y`+3NUGZ*W!0}QaRH<cO>#Po;
zPx|Q9s|%3Q#xK&2XWEl|?@u}P=|tTbuD<Eojt+iNe&K%H@XVOxJv$gp*aU&zh<jko
z+<S83DKSafG2rfM*Vae`YW_N|yiDfupCNp)PhFKfBT|tE?ORMXFF<Fr^YrTVX$h}_
zxLzJiDY1k8)TjnXkB;ty>}MZq0IpsduQPY%V{cOO;VyVyF8LjqPz-1U9_-I5*3%qL
zK!xh{u=^&(Xc94J8HeV5{b2w7_&(5Q{LoSH(X4m$*&h8KVYS$8#uKo6p2UlOB-Kmy
z+(&9hMWH0IWi<=aO=SesTeAmBFIb8ekmX=P6id*Ib<MRMp8Zp%;3Zn#ADAy-<-kjU
zqW`%<rOfD%vVRM)HCtTrl$zbd%SKUI+qZJ7Bdo%vP&=I1e@TR^CZyTKQ~AWTdz|w+
z{UWZ&oU^csLFH2C6A*iB6Xk7fNYW&lZy60;HcKfO9!(uGy+!7Tz`H|*1bBR*MQ{39
zG;ST#V4Y1y?8jv>h3r@&445kBiLAv{jxnnVQ)8#Xu#Y%oPdS);q;bDce&vfWF&7bA
zU$6Lc%T~&qOTq_~DJYj^6++5bkHc%hxdaK>Fw7pB->3gv5hOe@Tcq!kI}p6gBWbY3
z3sGckWb8rXj_$dXc4qtfln=K+-KWadTXP=~wBJ)oO1wr*W~mgA8z57|Q6-N<I#1MN
ztfx=Jc8=;N-(1aMK9e2yQr3)n9+Xp_p>I)^QdYj`sil%KLp(SXEKF$wXI#kz;cY#_
z1A1DqnV#byFWQ=G60b$DfxmwO@CREL?#{3?nt%9;BYQLDTl{^~$dA(!_73vl?+JX}
zODB%o3^}YrIv7aKNllWk;_*4lReH~Hn=MF50$8y};w>y?RS!Maf~&LkT^S`mZz+6k
zZ7RIG0G`XvICf(>I~UP>r-CG_WQ0`-R*~@^$+7hyRTdrzQFHNx-7C@q3F3|uu>-!k
zRVCRkubSfR^DvKw0?prXLl+|H6R5=&`3)Ir_-Igbu(7QV?4_z|Hp3AD>2o5AEYt|M
zaK+&FgSiL5M6@@6#NY+9R8t_}3mVCA2$sJi&VFkB3Gv^d+{JUeZfm~ZYQPtAbE6Cx
z(?1D5&*kWNBB?%HzCXEugk<p>xdE+9mn7DrzIqzqMqrlB-nA6pCLKdkqTFv!_`c>2
zWF&@3xHCxM{K^{!7y?ufHWtgl3v_e6&os^k3s*>iG5sLUMTh>zA+)~qf;V$KTP#w;
z@tu-iiC8$oT&LJYb!KB8y6dd`Vp5`I{;TH1IuMy&Nl!C0@rdDRQI-^IyAox{(kW;s
zsb~3II%qtmXw5C9Y%^wk3ZUeyFP=ZW1ls<j=RFEdpWi%`oR2HkqNeUmVAao)^)565
zpA8sLxD3fX6-$NN*f23y1|`%N?ZYE@(tSKR*eLs4eu$)D#?)os+$ttFXk-o;c^vMx
z@G$g(0eC{#v(#bE+FL~o$je%7puJS@0^JPcBrtd>>>nIy#heE5i3gt{SypGq?R=6P
z#gzafyVaBn??As1)W?ccu5Bqt&(b%eV^?qHE^v|BcfL1gd>fjYqb!6qFFY36rZf&O
z5<A_ZxAw9ue0V6ILX{noWx#htQ0uxsD8!u3<Sv(z_-^Gz`{xizK-_VN!7iH&S?a~Z
zaxXaNl^$16-g>T1C49Oe>2VC>qf%sjmrVG0m#h)9TrL`sFG^>!3`Ej4oNwV-szJcm
zm`p_yiR${DyfV0^u$_DlTy;~yT!~dJA7I2ndR2k9vUH<#Xs-1RsSe{CHE6WnjzvXz
zwB}DiaM@cqRVflL0BAND#Kk>B*;}Sk&;>HBv8YZDgv;gef{09soDJ(^_x>;|lH=XO
z1gP=;a(UK@xvTbea1&OH7law_Sk|Mk9$ErfiuxolH#L$UkU_dI7bxP?p%ylP6)o)&
z{dN;f*zE)4Z*hT;&KEb#S_%GuIcy>^R3udc(wmLpm}}xZk4&VpvlK1FGBg^fRg<~Q
zvs=p>#pGs$rO)+#+2m+6Fy>%OS|#$hh)(ol5X=$xUywnVBc*j4we}V<c$L&?E>#LJ
zq~3c0)OshZBAY8JIU4IN5zK#Alv7Y8(LWO4km>>0I{t3rVR4DO(W3xsj&iyBgOr{v
zSe#=Uop;%&!(JD5|H9Zmx7Lxp@bGb5ACacM@|m`R1M^TNRdmmMM2tQY=>V|KzZ&W;
z=YRmRpdOvLN$I$mpOmuymhbDA>zOF7nhC>ab1yBjX%l5)S>9nb#m8F(o~hSmfwVPk
z6Fc{8pTKZJ!?hA-B-cPC7-#w}6+41G0)g^Kg*2G$S_=lX76i)T+6o4(WMbC8+%u7p
zfiUTNvO?D~>0QT6()w-ZAbYw#-rwb(^^WqFRa?mIyhyYl*y2^<*AW!EVHAifGZHZe
zURCuV^Lu@XP?Uev*nI7;s3p(wWgw!D#LWpj!eB?<$~ng+>~vE2l&W4|tSj$Z?m24h
z5TP1{=(`PQiI1-cq$>ri`%;e;)%}MN1m9}fyLQGVTHmcc{QFKSd(FDoE1^Ezm=@!_
zY*q)-O!g$1tg-O}=~#Am;38O^;TDk_XBN2U5S>B1?{<Q|N(9#gf6j4ArNH3^V-W`{
zOquh(NT27$u&@CA>B$zX!LSB&0$g_E;mEmwv0qridGVHr_K^r#dM*ehH+s_+L=N8N
zp_PU!W8t=@KyiDJ2(_b@y9LE#&)~!7N&$*|mx2JBk-EW-?kIA|KN%I;*y_OOL~9f#
zU}k!##eV5PJT$$wTLGD6Iel(m-v26O@0FPFiaZJUO^AzN({H^WayoqXpPb59wy5{p
z6e0+_P}ib>FRB{ktA<;nlzFn$%!~E9VXWD6CV84na+I7}j&^d?kS7aQI#RD;N3An5
z)G~&lj&LI`PI5kx;x2Y`KMun~5D+dFOIbDTyPl{6YcNTe>vY*CV7HJ!d0pJPQTl23
z-*^ejjkq2#MQ@mjFH?uQkxX>f{saKGG!n)ke__e_9U{s#Vglqb1cm6<$`9yng~tE0
z2;Q?;;-h{k>?3eu0_Fnna>M-ezK_x>+g@XmIvP$?@4oR`^5BgWENJgj*a_q@cV!T5
zx5U9U2<1hxry*hnaDRooO=5hr05RWJ+4Z^aUie@Eu2}c-If!&)t&qt`a@Z?jWvQ_`
znEGNOe}XGrYCa)V?~Og+1z<cF0J<jsd-HX}tmnb4XMOGUR^*$G&!_pm1>o}l?k6Vm
zmH+)>?S|I<{q(tUpEQt@xTWVic|OMS{Wvilce^JS8}s+d_tEP*ubEijziZzWB;aO1
z9|>taTQGSSkzeNPzcA_KO4)0`J}D&b2?P>*`fJ5%6cXv2LO{q|-Y=1*;Y0mx%J-`&
zc-w%%=Ru;{XXOpJspuc%_7xQ6RAV_LyH=@uq*9g&Ju_jol5)->yDZ(OEQ`%><h`di
ziW-}niLbz-=CQs3hoS?xtyO@J2!PXH)?R7nR=DPOX(3OpB?Ps!VDRG(0^|66^?&;M
za3o8nV^#4C$fO4$5Um3Z_#OaHdj}}VfC6*T^h7Oq8}k{o`l)bEg=D<Eb^f|n*10Xi
zj^<{kVi%@Dmpw6KkeqgU<d|4{=kt;xwFbFF5RC{vxN1%H+PNs$^e4(NdX|~wI-Kat
z_NQyi4UdlkP#f})TPZ4<Fy~wLfuX+}Gsn#@I>C@4Ya}*PgjD~sK<%6+W_@kjJ~5*s
zpc9~dN+Ndlei#>qK=R*8B>4-OaH(%ybPxa&a|58v#TF`vAROu@6woT8+2q`2#ao^1
zv@!BM2P$&8(;ZI7Q5nBOU?g{zdO1O=6umr1yuYd}cDy<w;TzO4SXOi`31K0QjS;eL
zlb4Zf9W%D?J_s>o!BmhxjeX)&ho#e>zX$@hYEn8`yuRJ*D)R#QX8{~X`w+jv*b?$i
zQiPSAMP;DSaoVOFGTy$H#L;SDbSso&Gewy0{codEdqo9d&4^mE%VZB`art4eV+(kE
zn@_k3#9>i~bik|~rH|nQ>l^4QnWRq#ZBV4Fw19}~2<}fJTA0fOTP*C&@|Ml4vZnrM
zi>G<+>EyUr){7MWdA&eCWU)1fOw=3dSk_?W;ATb-=r@_@+d1Tj1M7IEJ6%chvs|p?
zhUGA`fTa37n&M`!eh*gU{vz+4zH@j!iM8^84Z+m~w@vhCu|RH8z8_XnP2f;TX!&^_
z8B-a~>2`SAP4xyy+)znKlzqij>1k;2cMIUUvk1=>sOV|2jD;v&*pvgoQ-pM$8E_M#
zqr~1T5him7WHs9=rIMwtiAJ$7Sy08(d4<9@^T;zcF&eb0R+Hyz&=Fz7K1=*lpW&lQ
zq}%D?I}iZ1z9b6rzGwBT7O5g()V)&#GC;E4Ad#UsqhJoU{|D;j&QF))Ll-&5Akb%;
zh2s4VC7zSxA6a16IMD#C38jWEIafTtZ?-IE-*>!EzXnN#?~$E^ORvG--(C03e_BO8
zkiXyFC3po7?)=jlK04A;AP4Iz0d2SfRpp5!M7;|vXhlBs*1IG&%)L3oD>D<=liSdM
zBAHDgU4)#a=h`phg#sDoJ!_e?1%^{_b{pc-J?*^`a_(ejiz&w#78prfV^0SCd-^N0
z-g8l2ftYW>oIIRQ*&yO_)wU1mYubqkKuVQFVFlq{aMx_mH-SkDs`oy!^Smv>WN$G>
z2`SaFi8f_Y3U${DFwkgHNW2jB<#>b{zz^@bQ{7+HaF?klF00kbG%m8+DAj(BA1)xc
z5MW?rr}>ZqK&_C?gvL-yh2>)lj}T`RU!?^O5U<sfei_C4?bj=x>I^=l6wZ%H(~nJX
zl0<C#Bq*yM`0K;k|Ka~r5!N_C*-n0EwW^y0a3)}V*_lbI1#naaUCIqkeX!a~+XpV{
zJm1YSUi7|yXo|N)Qf?w4g5?=tnD^Ax0r#<32qHu6=95}jF*%qqn9@&~>$|4DC+jGj
zGphiGjU$d_BmxteT(mUhov|vfR=cYEncyqoCE!1VvJC)1l*iPMVaI6&8J6#5nja^k
zXk|yIGQjWsaVl^{ihQxs<Z&Xyy;J+=fk_Q+&m936iN+8LbE-mW?VIz!Yl9cUTX`7#
zw_X302KLS0BE*CwG3mf+UK~T5EG~f>-j}SDwpt%#e{WbZ^Kg*R$`q2}V2=?~YE<Zj
z^L7c*qpY(;>WvSe$P-Gf7rROO>cto~Ox4=8#yPLI^}z9gi-nsvIv%in42$X<5I~v_
zorX6JK*ku~__Qn#5NvAC^^EM0cd5zT2vHQ~1a^V*>mDXQbBUGw1`ICT676gAfo=ZS
z6j4swZ*RB0X$g(rc3gM1ui}6&O@UG4Mgp-CFs}h>Exq%xAT(v@_nduO$`U^Z`Zfvh
z9t)->M1f}ZwF-bs6RiqP={XsbF2dhEKHrm~@fs04`8p1UylrquSuaJ6urV!9Fgz#u
zB^zL~Fx14X1B_Na&Y8O(^f2pFHe^~KhaBZDh6Iv)2`KgX>tH@d%Pd&dU?r~}Y=PpZ
zaq6zo`-NaB0D}9YKX<gVr1u*99ECrvgob~A&DJMJ)U=1+*0bHTd~F27S*L96WZm2z
zqxwiaj*+kn7|r7I4Q;|;nyjL4!%MUw^<fP*7%t`n3i^$pPUu<%gMJa_R)p*$*BCrO
z;X!B$Uhbxer+B$JZ!tX#ZOzJAg}U-s+q`*^GC@bd65IC;&hgsz9GW~Fkg*rqdr$}}
zWHR#o$qKd3vkn7lKo^nBQXhBX^4Ky5HzprQ^)!zG2_TqxL%!MN$r?tX)*R!%(_1YS
zQJ%m|SyB-~F2H%2?Jy&(+<c-fq24-}>bMz^92P6Y+`u$N@TJksgM+oDt~0AoN?|GG
zsjG8@g1J{S){GWOwa+i#Lm^Z+R8}giRF15JS;v{g`jZ4qS#5ajOCzxCH%7gYhyGPk
zhRAhp@&|^);g^9&V@XYgb38)@@qJwny7!na_XNEOESAGL*YQ*-8XGPLK)M*J6@4(^
zbbbiOqS4tL>Q%iB*D&Q6DvH&m$CY{%JJHn@CIean1WWI4zO5MIN$DkiT9jo7(F&$Y
z_XF~r-}}9!zR^c0i5bRtfHiyG0v-@h7FB=#Dte_qG}5%u+T)&JVnPzJ7@ookWm7#k
zL?=oG;T0DU;{NnAZoPv=PSt6eWb&@t1h{M-57Vx_^nyT_uUv8S<0t6GqwI3jp1Q(a
zzu7>8A%DHYKR(GmWO1DsXE6lIDOyG~5vN>5^W$Vh`dQa^ykt?}SG5XU`>hi<@2kch
zKt~BHiU%Z{;iGQiB-a$B<$yTPi@`#Kg-!Ayzp>rf^tR54N1q7o-221qymD4A+CJ!v
zZJ4tsND#Z$%Y)xwVNn2r*5%07R4S};b_;l$*XUSzgNf*-j=ZIyz`7KCbMaz*?mVuY
zen0c%M1JA1ES{HLJ=M{iHJzO#u0YgTQ9+y&1n6v8#i<C}+bwP31HDEgFg022E645G
z1oUT_TQ2h~2J;W(YIf<@!Z}Wp4u|vZ(2_8M^pK50cLWfG-iyB&m)vW(_afX34uZL^
z_%btb^@OEY$7t*|Fj!4_Nyk37Pszgo2Br8Il#sCSsi&G@vfo;83m<CoT8813Pzosx
zVX^PK&prfLbxNOhQLi&lrcy1)BXQunyL^PG0lh_BN(r-7j>;si6v<APQ=vkQOE%tC
z7<(7_RWhNIhgYCuMDFn<BGUTmG$#y&B1_x_EBrdfu2kSZl5T=WZARy`sVJhagz!ck
z%B<Z0PX@a2c%rbmG#l%Md!ZJ}^%&7e+FT5Y7y5IvMqHB*f}jwBSx*5>7471+y@QJU
zxGijApZ;!2{z<yxMEBbX?A4kOsI{SOGIQeNA?;OJ*65itYVv;8MOT;xZB6WLxN!nP
z(D3{a%!$Vf9n#q76a1Dy5BY?45Rbuvr;J+JbL3;>N@zHIqtKXzR49lwZHb6*KF!<a
zQjehkPqC6QI;hi_yLX2<2Ff?3FX+ReRufHtjgY<%T@klW7R3z#a$V+&Ff|;&z-!RM
zWBs~Kwt|R*PvAI=hKPGIga&yFbVGcs6WP?m8YN&L>rzhqYlqJl$F&Q{NXLv6S$vTm
z<?d_kuKc%Mc<gU;<DVxIrz4MqNVt7m%9q1#JbO!NnP;@jy9&EGUsM*iZ)X(y#*7ch
zACIjv#q!}!dMTL~Lg(lH;^>)vM<HWZCy69D-ohvK^?0~i?~S5f^M0Og$zttuET1;}
zBs31z4{tdNuy&{JOEC>NnDCbzAxXFbqBqVssh4D4k9nN~3BE8MBs42QSUJcVvj>Vm
zr}(ZpfI3sZy%jNx;kp|{x>+8L9Cz@|wx=0p28eslG@cN?zce~y{KoLcCP#Lop3-?t
zoIa6IYd|8{V1p0LGsLvR!Ax8aw8fj;P_<OPsrH>{5-aA}B&4>dWQ)s_ae67oPnmBI
zpk3YZvE8Sp)E-#k)m~y_3365}>Ni<*LBLv8eSz4hW?*;kJLEM8EN^)DU=jet?tJ~f
zLzr!S$hxU2(t8c!tuU`anX#P=*@k<>30#3OF2oPeMbgr!Khl3q(!5wzpc!M2jF8@F
ziLI#yC2bQ<igp&gq|v<DTCE9wE15@6KnJ2GeFFeuhxp6UdA4_a&QOVYn|>DGjzGru
zCV7d1V~uk$F#axezF6Z~o8IDrhl1!s?(O~a=DQ8`a}DCJ_pT|fj%$zy^=~4s5?FK4
zAn8frxr3c@3dB=2!7h&sa{_$-g{*?{6IpFy5n)MrQrE`FVwZs0oxh5Ibz^h01SNhg
zr5{Ak>D$6?vnk;l^Z*Tx+sZ*rGEAJv4SQ*GW~HYX1$B%F8S=;2#Lm}acb8JCx=Q1F
zFJsc>`Owc7y2(I$?_w`$Ab}OPjeo?e1~zn#UP#Agf%a=(0q#Y!7)N4+Vrx^8u(S<&
zK=n$Dc4`s0A?GWKe{OcXvhiRB2%^-%psP@Br@cy%B;A_9Vh_bo5O^oevfw_qN`9DF
zrqo3-`0%zRm(DUx1Z^8hV+YjNRVcc{kvV&y1=3%#DVNDrlET(nbAc>Pm&`neeG7BF
z9u=u<%(Y2Y`Jx^M@Pe>DHeeTvHH9!Un?uEPj1_1mX5H~5=$m6q{7rE)8G^t(Es|ii
zC)e#K#wu<C{zH!<!r6R`qoEFMkum3(J3W~p;C8NvDf!MY!e!nBWQK=7@}7bA)|eT~
z_k<m{GDG)A-c{4flfydGV}}@xUlx`hdu)G^vVb642H(xneW+7RM4W5^-6VjjvWhpL
zW_R9VIxC%!0_JdqQXhkE!bzKW<PoljVKa*NC2h)wY#)$`xW)Nb=a;mWOp^tHY-4Ms
zDpF?APW!X-ivzsP5MBjeAZ7RCZT;Z4G0KM<JdR9s0VcaXk;>p5pd@YT<dNF*`ayYd
zlT-SH>kyhdLQ7%U&GRvSxiSOj9B|M0IfT9A$~@f#1xp3ga?M-sx$pYLy*SDHsdA4<
zx-&6mf4zIS5jF!&jQFjgvDXfiT{V*%K@8e6;mpD+f_?n+R~TOGK;)|}+x3oHrR_Z-
z&K4;VL`IzJ%}7VJ*yKVbUhjQ&?hDMRP%XXz)s;hTS<+LsITpZ`gm5O{Hyk7gd<9^0
z=(c?r7N<12N$OkPcn}i2J?7%!u{C~}&|7|&l>Ib@MPjcJy<Mv`sr{5P>WND_r&;|M
zWn5Sec+xOlx^iWCp}>NW)?HrK9O!cw)f;=$7V%TuQ*@~@zv)5Tt$b~Mu?3GTb^w~*
z0Xf2u8?ae726vvosU7HCKrD9R)$Hh#X6_&pJo=)fF<tXM$kqqwNvD-Us$F4n0tL-M
znE9m-8>`{rzzmS#VVjA5Lny!q)3m6v(i&$=r!CcnXxZz9cCQ72*kOK3db3N&erl~j
zx_|Z0OS!)a9X+56qrkAycHbMY+ce5q7s_4<in3Ubtw7U%ia9)f$pEW8%;PkrwLIQN
zzlQcKd8F=_Kh|~pQlddBZ?Q%r7sw@U)U@>a#UMZcZUVJ1+D7z5Ppm#y%w);cu_%n!
z<h#EaajPQNngt)KXWCwen<sbEv!)Z{)L4njEcKj{v}Es1KzumQHlSI(UtvB`Qu=eK
zV$(<pbC#mZ_o<(?-&4A2XOA5*vLlpUEWk&(VN1IJu}LA+`&NM3O&!U}H5gqHm|KWR
za5?Tn!~Wq2xPeJ-V8z{)Q(&4m*yvXnvZ=e)VYk9Twk$lfR*%H~2G7{S)q(L_pme=h
z<n4bJEZeE;zifstSm`jc_KdKvqR2bENgysHDl2^}nRghVC&Kb^+t33;^0f@{x6QWV
zU&M%lZzM1q12`wLoN(7O5ZE>pqoR}8$KFr?1<%S<2!qYqXc3Q8RJOHb6j4fjQsTf!
zlf5-{_JD09DfJX~1*PHb+v^1vzv1S3>zC;io)be{%=FdT{flKy_qsE5G*V9K3cjv7
z3RVm-E$+KjXHR!7kCK#R06@q1EH@5?Nd_h*l6PuMn{^)yxudbdHZKZ0by1FfpOwl8
zZR28#-kk~gl9W`d9(Y+UAfwxvapDwA@B%8<i^gE4i;5vyBDER|XUfM0M+qI}RcS<n
z4lpwGULIVayEmZ7Hl=24(eIP4ngA1hp}ah_4<qTM&XzlQrmf6XB}?5g&u5V>sLdIu
zE{kjy;=6PR`<R@OVwEqbbZa(zUrWTI^KMfE0d$XkHJlfia?WQBz2R#eYXFI;A*O8v
z*hyGmTICOipM_<WuoeF`ZDfnIdm2yhTq`iJ+Dv=G4*0g~+H|}=qfRF-qf{JDX4&m1
z<|%A!H-cpLt3$c$HDd>aE|WHj;iF1EiG8GwBQGW6?7wgjloPv%7imM2Qnpkv@ZJgs
zum|y9fvvTrM8HQVdqIu~zrCZ&e!ucS%5B2Z;5wc!$`B}6y9tyt9@&&>@qOdl@h_UV
zmvF(9yHAn0-Si&e$xwa~&?T+CaZ|TbW8lGE<}W20+^76wHP#eteO5)JnX>_6^K%Kk
zE;If1A-IHNeG4uDs#6xSdJZ&epIoXOXo1~q+el?gF*<HRo4b5A4>@KJ_SR}ELuo}u
zrPaGphm}b)qAvg$Y_&8c6U$i)R4#eIIAi8hIQqH0vXHhHT)Jzpy}a}KXSMR=ADngB
z*NmF3l%!7RD7fGu?y~<R5w^{14v$KCI6G#-U_ohNIV|nocKN=)2Y}Bf;$t8usHi`j
zdtjmqh1nbT5FaEP%VSiRo7JtgrJl|W9II>|6^+zYp^f!8etIiYAA#p_pB;s#WP$2&
z79B$MQ;)BZj=!AGb&4K3IRbc<%yLebaCj$aKo~5@1v~rGW)Q7Y(dpJ2b9QDR<iIow
zA~WO!f<=+5W9hAhVE80m<5d#&UbBM-OG-PesCNu+R$u|UX?}#@RZQeF_5h|@W(P3S
z#9BOF;*k-@GtNid+~0Em-O+vCk%kUO&#bIg(ZcX6CqBhCb>Vb61q^$LtTul}&?!U1
zv^g6AWua+4^KRQ-iVVVRn=eJODOE>1h1KLVBJ&D_%y$hMkz+pMKn0e=zWtNcE7<Qz
z#z3VJOX-$^2v2i!z6|M-YHk|M7Gm0L#BAQ2eE4W6L}h-F#{GBwh{A6~F1FJPjDt`6
zgb<5_&0cHz+qOW2m<iAm4MK{n_B`sR)&%tE_g9`F5%fuc?#`bUi~{OoTAZ4_z+wpO
z<O72TlOro5s&z2V>sb$sk~P}NXvx05--QycTTDkTbWVNeaYP@2cp|yNXZzIFBAKCa
zZ13gEyE}w)DAzk|8I`pvbm7nLz<xXzMbFH;RsIpgNWU-3*}+-14e>M{_I5{=znf(&
zKD2}dfD@g{YKIRRi!H;Hqhx~7+s>W`U)W*JI~kJYTP@N{*jA-N-mo{^&dY!y8I*&Q
zm$?J>vJNd6JDET_R;k(hVVuu9@GgJuMpk>9%mBVX`Gz`xoucIf#VWNB!PbF_8(|O|
zfM0@07xSAjELNt%VYf-}amF%O<g;W$^W_(hKcSmbiF*RuO0JeE6Iq*H;9^)gu34l~
z-HuT>;Jo}-htCby<?a3G^_fT!Ind78w!PP!V9#uP%&;w8&$R)z(Wq@7_>ePUksNo*
z!xlIh*>hevNMsRN*g~jogx%gd#BzJW`pNnO`ygZfIp}a$Ei}7}wf4GWGx_BLG=(qz
z$}^bTPL>8QT%eJ;9wjblDDhe%{8B_wj=k-C_<r>g__owA#xl9^HB<h8=|G17@&738
zoO*O&qHW!_ZLPL#+csCPwr$%s-?nYrwr$(oU-n7%A2@e4le(-_rN)?ZJi`K+o;PA}
zM=MAF9hF8|xpsB7F7Yd9>*n`vFm@=WeKtk1jhFhzHd>~<VUOPqa5N80unkF6`WT%e
z5e!&(*!e#G^hXUMgmKavAZv*uuXJd}ff}%wY-S+v9icR0S#jo`4EI?2^I{;AS1ldq
zZ28h$N{pAqKF65g77;Ae>5|{KFaQKci$<KjMEzgP(XhIdj@%v5e(Z1=USKzO-Jue>
zVQ#zoJo_pYGw#@@*$%%C_p=DriU;|G+XZdZz_U?zO$}#1N=pbU>_fBIov+4^Kr#7?
z5*BB@!IlQs%lQ<VOIYi<`rk(yy|nlZIzwhL<!$2oC;|1L$;62Xd?c`BMjo)-3C9SX
zQ<+6PV_w}#dmK6VM!n|0)Qw$eFrlM0T${&0Jq(jzt($@no}{$AEUt006ccy%9yheR
zE(9&qgA`z1USdFJYO3W9rFi&NO?=NKD1$J1cFdP*yFDt^z+w{HBFpmNsOf^QVn5s?
z6-G|);1GK=#Ffrf+dP6keMj2Z=^YKx6u}-Yh=9yd&w#^X5BYRaA~KV3Z18I3tpw>w
zediVifoyF(=2WT(4aO8M0nH4Lfr{+@t`)ww{{Y=7G7x`NFqA5aiUs4wf_yTf|IlwS
zA;W3m3x~V%5NU%`8q9RNiGgjA$l^#lu{97q%oV%g7nagb--5lNtK;M!987ZaJ!)>K
zK`c-l*U74vv>P4bPk*1m1$6?vrn<ra0p#t<w<mYfa<7*cFc>ixSfS7?EY+Ifj!f9K
zV!F{N-C_@&L3S?+Bx;9&>UrXZPBf0WtWJDJyr&_i)Hb}#3g4A3GY?!uEY>I>xva$g
zV<Qz{42s7A=OS^J;Sshjrh##m>35<vYY9K#WVaq%8m2gQB<W-5a+B`K`GuG=e_Dki
zJ&lJCm`Fc3X1af~z<%~U)Xx37J~(Iw_XMKL$T3)Ts3#d&yi5|*>h^x23Zw4yDM}L3
zPJWlDkIA0b34RS*TPA!U5-S*fHJ=S_0Tf#FPVSta$xwKg4H;F2YLrAI_R0fKtu`6k
zu1zZNr88XkRzYN<=8Q72hg^V1Vo$Tb(0XCrCDBM7tu%<xNw!l;^=T);JyAP`S`^Hg
z_i@mD0r~5SB>X~rq!~X|;)Mt3GUOZP25lmqdDN;I7jxQ!>j5sH7UbYBZoc-ybgA=c
ze!fB^514@8_mD@ePc@QuzNEZLv-p|@+dcq>E@BPv_^w&BY0#AF8MOf^Z?!lYRMG-R
z8}lOoz9w1&7grbCZDS%WEn{!uPf%44RK0I1A`2}4yR+7v^kJYNkNpRJc%Xc5BZu+2
zx{O8#o@4q|v_7H#3`Fb0^Zokl?MpAew*(Ju#DM#4lC>et(S~`<s@9}>nn98avsJ^{
z+jNGR@-#I@r`2qLL(M=yca6Db<($_fZ&*}}yZX(<cBVQCK!IftBrQ4Zef?Cu%5n2c
zHHHK&c^y`>sqQW-p@NZtQjuS9oQPg#8rxUy^&i>&ppRCrN#oCXSENDZKYk~kq)dYj
z=Zuu)1sFDar@uQYm(vd)sDrr``IT4=O~OgrA9kvT=IFAqIQn6w1I|ms<{JE;{!Cch
z2aUGW+3x}E0#Pvor|*w*gzDBbI@LK-ac!BX9nK9NDH<Lv1XDvEKF!d_(BB7n<rM39
zh7c0W2}C(f@DZ<2<7;(JCkiJqcl%H8?Md1!XBSRTxNoAc+`MTWe;1XAl4*L%Ucr8b
zKQc!w=#E7tUJc64h`9&wQsvk7fVNMDBW13dyv~o9C*4>C7ibFfuJhgZTU}2BXs%iP
zz4~+nVj(()`xyaE6Mv1~@ZVi#Vs|Kv2;vDkYaTX6scU2VK@)UDhgpit%|unIogR^F
zzR@HvABoGYFeUwtLv+)l!5gT)8`8V)tyyKIu@A_4y%1!j;@r=p%g27B%8EG@nC%>=
zz>ytfhh*9$qY$#_v#@*-906tJLyvL)x$`+q^FQPBFy<w?K!Cutesga*jiF%5wEwVN
zl6xR4D4Q{3KdJ3#?bQ*Jg-;zNmhS#rFq8bEX~bT+3<nqN5IZj*1lm`a|MdX<N@G*Z
z4Krp;{lxn|m!>gncm7=de7YszB%aJJV|su!wYpN&?f&krhaHyGd4B3}bDOsFvKmRX
z%TfxpIOyh=3Q}NFN21jwDu*a~48f_m6d8MqO-6?d?PGz;ARCLi7GG@qjV>Hm56X1o
zehrqHI}C;!m%G9SM^uN80Sd2&E8LUMLJd7e#_QBlP|e!<PT3p?844c>s8>_(_Q+Q}
z$_z&kN{sOzK_w?81pjJx($J_wb(bgyLU-vbh;O>%%tB?^Ro8YEDMPRLeW|xOVxSpb
zK7>#<<`Kf$Z>U?$PcGVAs9Ct!F_r{E+mMA8zwGk=_0~I-fA8wnv{ymHpL&`}5IHy`
z<Kc-PPgFSH<sz)L^!;|zXPVVFY(I6bLVaZ7;2Xqh>M~G}m=M(D3S?uQ_2uqX?l!NY
zW%6k;xV(y35w&xFed&vif01H@!>?FEa%J^YIiW<HZJd;EHw63VPd|1hp9iW`AxM^r
z@HpTly?fEM-6nVd8}^S^oC06{+z2e}2q0H)6#dQRT{}<fUyrV-+J`@!N*Lr3Jz6{8
z0by@A*;U}#xfW%OPTmFNqDmGP{|enQ;D?^|B{b6A268M&@lmMBn^SN@h`;wNUi2R!
zU~2y%#!_`5nWf3>@o$x?z90vffs>SyQ;CBNCD9YR><*2;Ax1@;(F(QK;W`z{3UNP#
z;^vY-vAOuoUfBn9q1)SBJ#UiA`R79cDI(!bR`Acdl~tZl#ePcN<_lXS$qIjpfh4&A
z$Xxu{rR9TdojlsukXlTF_4nH!W{58Hp(m*R3=~(v!?;R)!BJ<S67ZnK<avx)L{hn-
z`OSk7rI}Gp)kv`GX+JXKne-FNZ}(mT->JKNVnW|+jO-AsCGpcCmn>slZo2;F*+_M~
z@IHI*qHk#Agzv-EpQRu|1>oxdDR8|%zAuF7jelRx?XYMKR>hZbQX^}O@-53?6XE52
z@p#Kf$g?3r0pYi04mS+e#h83yUwx7T1~*q&GtyRwO+Rk|Qt)gtHBi?CHWvA)qZC9W
zo-gw}olRt#dvhCy7M-|%v0G*M1>8Gp6R9++L^r~5HiW~%0k_ciQf{-Vdz6=AqaGo@
zT%vpG7!vxY4$y!F3WXj&-sjT>uYUnjl%^?(nUWACR2O;+P`sw4|EZy>#DQs^`M`=m
zjpDciH_a=OK&pujOq;z|^k0T{H<6(vgG4e&ej?_Pi>mMerLb>V18Sg_T&}V_ZMQ<a
zjLiSw`2;o003qo(0y11T#L!NUxn!jC)BODGZypMS=el>DAH0z4Nb$5RwE=fAS|6$L
zvTq3M_Iu-Mg-QdQJQT2#*sy?~<9G`zIZe3iGOEP0UvZ1LvgKc(dPx|f#ZR25xgYr_
zgUXD(09mRh0$Vs%IwUdkM8hp{JQa-+iN2XG<N5ic8=HOuoo*nW7+-7lI+tV{Ht`3H
zdv*}!kaD|uH=Rih0*sCj*zPX(6P?GmlK6*4UerMTcBd&nOg9`am8Dm$YyLc=21v~o
zP+noWpvYefP5-~<&UK}0AZRs_+&5x{cuc=*&SrnsUHgG0oLntRx8TokY6uK5ER*%?
zrx{!5)}3ka0YQE<munn_8r-Q}`cFt8=!H0luBX%eb)j=DsE|(|a}Iwtc8qZwwax(!
z36M`Lqga@pnLZ@UnWGehRUX<B@5!vAxc4V0)(s(`YDZlTXp_PQx^uj%o)%fxUtrO-
zsTzNRXZijq@%2XH#(|qs7nM8A(Vha~k`{6sArT=kL%HG6);$|)2RX?ry9MtY0FSPB
zX)J<!=as-q|MbNJS3r6utfoN3C*Dd_C<k9o67;cg34knb4&UNK@-zoQcqv8CgA=X2
zaFs!TJJNadjyxNlbKE*E#CIBE=<h<&Ajx=rJ4f45F{P1&naL?D3C?Z+RRz2ZTT8Q$
z<I0r^Q&<KwQo2uX?fC1TPSpTw4C0dY8@sSC{zq`^<HxSTrYLTTSPOJ6qy|e?oc~KY
zX`6Ko%_OF!qcKtvE~tw}MA-Mm=uedI0w_Dc8Eh7_#uE)Ew*#RE@uX+%Tqc9QQm*5q
zr3Iovk1&ND^mN0r&bHh(&^%6@wxw)L*yk_37-OV&_@=%MZavXjQmgmRI^f3)nNqqD
zE%W&At{NHoQ`GQDJLxXhZ&yc4*mQA(VXws$s~BEZ2B3&;yW&^C4_No{*H;z`YcI~c
zCer#d?a`m@26zrJbp<pBTe<?`=caEC2`AQl29kMvQ(fM#BP+#ZRM3#4f(aH1OELC!
z_hw*aj;w0wr8yT;>>O4<ahl(0<%F|T2h*)uJ)(4yo`$X*6Iw8hiK5)~g!$-!H!uZc
z>TW|lG*d71pqp<)fxs`^FuO0Jf*>9qS?2=2c%l9CZaf{ZgnV;B(}@HW?EZ1M@M?~<
zv)F&r9mm;!_^&6?R}?}OL2TgA)%Q19Y1NSB>^J*4Hu=*{SRNBtC4WaLtP;2km5}iu
zJh-qhNrfVy=%f|e&BC3)OKY+3wKQ|pfo5;5j2V%fp8a#f%e(=+`p*`0a6MlF!)*Cz
zUp8!`x&Eu<&Dy4oB9whb|IAl|Ai*9TdR_ws`!z901K$pMsWKi4c!a1h`h*stUuJzL
zNWj^$%9--gt|Y%cC!-G2xEGxl*xg&m2@hv@M>IBwV)7#Cy=r#MYPHpe7!u)_RW8V;
ze~wRU;iaInftW?XW*s{(1O`Nlp`7o)*Pfy>3?Cq?nNk6$X)W6m(7$*gqqNG3tISB#
zTZU=eiEw4sN0eLYlli{3DE^waaE?BihzMJKYN&je^|@Nv3@u<(m5?%Ydd$%d#pVVu
zIj=68{7zENgx0YY1|%=j)%`Gov}3_<6HJP}nsi2%T`N+V8txPUQ|-{IJn8u3aTFAk
zGg8V}SaL*8tqEEbjguy1Llh}EXoZM7iO(Z&u>Wr+H1B_z(0D3;Tn^t%DmmVV=_5)8
zI|Q@f3VPr6#;3hfi3>ALU}48Ca$mNsU``W}rzJUupux5pR@cDq7CAeCU6qpa&F}%m
z;l+hV<W!h4=*sKcVSAl{3VzVZP1_3t*wEGR{HPdHJHcHwB`#!eq6U(BfJNP*Scr#(
zUEU2|71~(6KEWTSQ#-)-!tS@F+36_eckkEJ`phoGQ=Gt+Z}Vr=&tc=X-rLXStKF;u
zf}gaj-#b$!#p>581CPK+m;e`hL+9u6Ehd(;jBseq^{E)3^%z|&34)_K&E4a*bw5Xr
zOru(g?;c!FS8GA#<M~WFiYv@_P(HVhi;;U3WJSw%k6^IM`~7^wSYRAWs9d218p%5p
zIIxQ&>#PqlSI&8FaF(2V&I0bgGG^Mz=<&%jH(}Zd6~8S4;mMbMJ|OE%aMtX9OI=@Q
zBEm8croe(M4&cDv<2OOto;0|_?|r07@a)sodNXgOQ53dCoMp|PQD(N!!%`-da?j+v
z;!`SGwGKNv`uwxB7{+dGKVs6B0dV2)43O9-R^&d+VF0AFY?yu|{nox(_@a!+p)6DA
z0CPn+)DpHP)a(dxqoDl3tBvx2L)*k98Xxa(F&j|EefxIl^)vM4R%T{ZRVH~48TYj8
z0JQ#>L#BN*E|H`MyC(|I`4kaOdCt}}T#ad6f*sNwVn#Ir_7M%9<JJ30mWm!bPpo2`
zSZr~Ew3T;Ng|rQ6Zv)W_i`*qsw$Xy!e{IB;e`U?B6)Jd!oGQJ%`SP4npDGVxLF}D6
zRdPKXEq;L?B)AvU4tl)<N)m|;KL5Klq}ImP>>@9)9(q4JKfmITw?+%_)<Oae7R-n{
zW7K7AQp-vHCf(hpF%(E8E~`PYM;2TDzQ+Z$vdfO^gEUCb$u+B4ezeY44j;`F&y;#3
zs_D_`w4IYIWy*fy2FKl{eW^`{pv%@O{S?kH+*G8Xk0hOJA~pX?@E;XsHM$FdkBwnz
z>X(zG!XRv7dAeYC7ItnH-#H5)YTPV|=sMNUFlke0=#_+U&qHurdnN~B-2iEHAki}*
zG@rYC0G#Su<l))5u|KxX7HEx0=TdN_R7X}n(MZhSnYw6TInWQ(HL9z_M+Jo=*=Q+W
z7kkb@=)?8l((Rb#vWEGV8N#=YZC%V+QBB^l(J^PdLpW0PzIaL$s`!&7r=ys2D}*z0
zhAyxtKt<yCrXmj{GH42|)ytZ+fN6Lg)K<Zq#ZtINV}oy~UQv!)$(^j>0wq?u2@42)
zt3!zx+jNwAXr2k8Z<xWW;0<TuqjyN%bM_`(1xys8?R0H~HHHkwebr#~2G4b$nT-f1
z3+Bl_HKLA8v8==(HVu|Pwm8$4ht1@vB+Kji+|t*2q5BMtpU^C>bIMm&xxAEv%*BR9
zzNy75LH3@E%;Z*NGHK|)CZ)J@Rn0r(HWijB847Emo1a`{D;_JrI~HpV1W2a#DKXKG
zPH<KZ<1CrQIA<>z#+&F#Ef7C8dHA;czJKf)9f*Bqo4)RX$hO5Qmllw2&h+#pS|bz6
z_$Ipn|K|iGf1bHUkoumZM|waSRJVh5wE{}29)x3ze1?1>C9Kt!crpYfD*1JnBI+4X
z=J(>hh?GPaj&ExoHu+Z$Xbyc3N}Ii^j$FJYnBHcrs0g;Y+i-6Bdkn6nU}<*X&WlZy
z0!3nX7(eh#H1ZmVvOF}0>Avkv`Fm60|AQ$74%@2x=r{||V!}VNrX0j-I-{&Cf9++^
zSD8Us_~+k2(^~em3LU@nY~3XDJT>jrZ4{;O-xpS`Jcl3)EIK_~XeY`)rzwBoxR{9B
zd&DU(a?6S<G$`<6P|v8|kHI3;XjSu&9QQ^3Q)WxWDMOmUqpB{NS*t?&V?NHz^Z<q0
z@1F&-L;1%}-&{vG=_$k3MRG61u1`m^Y?H*cb$D<ym%Q#;N_Zm`dFlmkU@dSMiNRp+
zpkK%LM6#XRlGTAdp5A!S8k*!us*Xt5$hXAVu2@`DIVQ)q96i8f6KOJE`mhkOvf+>P
zqm9l%hBv1eWp$z>Rx?>w1tV!VozDg&r0j=|Q&IsfVf#qp+KA}(=^%s{-xix!n9sGZ
z<FbH$hjRCFI?VTU0J)V_N%b)<5aet6k1!Nka~(;m$bZfR?M?;bw%E?Hj%a0x_#ayM
zvSS>dC*<xMx?gV-m4GCJdgwzJeqdr^bNOxYrz2}BeT9pmFZM)2gOd<7?o#o=8Z0dh
z_RD4~0LzDAQ_$|UQhv?0P+^4YlB%1`G|KY2g0NK6S3GxTw-Vg5;UB6|FjlXp#1v?;
zdo891Wm_()EHKv<POte+yh4qTmt&Ms&+;v`!I&EM-}N&~Ts@nc#<m*u)N{koVYZwg
ztxYbrljk$JiV-DQzpI!;lwaJOobJN4V(vv#8g9ygX?R(T$H3(T6Vt+5K7UBK6#vS!
z9M*aM%96`z$$g->GH1i}3B)7=Bo7UU+n`33z0?8wu+<fJrm||55F#PwI`~^1qD7v2
zN8`2AdJh8`gG}h$@ril2|8oBg7r@pMvg(n?#Yq#ZZBvWTg5}~};<yrv`LQ2h)ix4I
z?@YA9Qsg3M3lQ7>ozYo%UepA&BX9fD#?<^V3s@Z!sZh1P&ER6Y%kK#SYkHv-?h<Wv
z{HRVK-S)liu=Q=hGmEY#QbCv;ybd?`kv-@Mcb9*($Z;G<T3^}|qy>y&6HLNXv0xZa
zRM-{8%p4$A7BWz+tIx%fOoOkPt;AI{(xTzJZK}iClol)ZzC9BDp7rk-qG{^z=0A)F
zyPFi)Fhby`@Pu~Fuh7L>)O2MBUk0sf!B)vbMaTMy12nv)?Z<HYkqD}>L+z{gf-Zyc
zbP4D7aQ4Ah;i=m&D1~OvYL^EgLIXtHMZju6uoxM`RtUlD>q(DYK!5nSrgk5JUUguL
zb~^&TR-kq<5jHR*N%rE1>ehyJQL%PWh~Lyfx>~K<x``UD5Uutg%TA&F?=1GP-hzVY
z;Gi+ISy-3y+Yz$#7Z-ImOCS<XH^ren<@iMN5S|0`M`)PV_6|LezpqSr>$apU;h1wA
zAPHx<9TZOvm%{`yY6zhH7i8|YMDp10Wh>=PynmD!3+2#cFSU4KO03Z>7FK-z!4~x$
zVY-^^hn8Id@VH(fY*07}t=InMnil%37jRg_KumJTl@K(~vI{Xj0_2dU$e~Pc8r_km
zR61&EFCr#BB!8*?m7vpXBsBV8dEY|PN#Tmm-~|R$G#(MUY^_nnKy`=a0bQ8+OipGB
zg)zWAV&_3=!8R^sHht1DxvVe`7}XFwJ1r=wYp2rZTZ$Tg@#40a$4Ee&lK166fu`n#
z=ntS>ojW8mZA>ttLR5?3Ri4Z1%=kC@?q>gM@->6A3;JDI4`y|lMrJsmaY;IAmT36F
ze!Qi#2s9Q7ew_0i$6@NsRHHL{oo}x^EJ0>Qh;_W?JRc=YYRJ?R=?>{|zF|=Wx0|4H
z%)HGBh!wWgtW0W=c6Smt;449b5v2>t6GMHIO9Usn^4`UflwrXW{jB36hiGRteAZU6
zRsg|VFZbegx6dClnK=L&zDOGv#KGH=72FDkB(f2OG?SPwlf)Cs0(4HaD{&Bd4v63x
zvbsssV!}Edu{Y5wWg<y@@qTFMn_YHK?6EY+-e%``fBRx0;%P1K4|_Poo4Fp2Ru0l#
z(u&o+u`NpPIaVPR$jOjX5bUIIF*;M|rJEqgE~Vd_q`~dVimz5?#2X0yWBE9K;9FIC
zvaln3PjKqBm4{$;cZ7c(g|V)jr!=JKi(sL!-=QDXl6#!*!5;Z+Q`WpZ*cW<ZN=@>>
z5C08BbZ&(EPmz+{<9?x@L<;M<-)5J*rv1m;qS$_%CKd|<+Ha0d3KDwmZ=G=BmLwsE
za+AG*^Kz&`dIU7L<$Y5%+I(>QyEJnBHV8tRW{g5u)b~MP#uY1KqY<U0--!MXD2}jR
z_CKbGQ}XPQ$@>q9c==~4HBX<NB0AYK#O)B;E!h1pZ4WrtH<LolCm-blYY0J4)_{xK
z-p$Xz1(h4p@={O{uP9V5FBRl`glKQVGw4z0`Z6)`>+UwsK?W~9`5W{z>hpaSy{;01
z(EiV!x$Z3_Sm4ulaTX&PXjE$7RFV{5M1!YeznI+_BT9K1WhTnFcMO&31xfFGNeBwI
z-(zN_13r#h%6$(7Xbs#zEKY*F+d*7yfxxxnTWYd^kOS&TUYLYa{%*JTeXpw?4|x{S
z3k@<2!`)er24U~yQjD~61L^>Sep^fHE;eU#E&|oIA(|dWUcL5UZ=WZN3;Ti2@kSVa
z=+8UgC+*TI(Cq^Tlz=%&UAN)+Gz#-K3Unl%I%lM;hl&+0!zuqxacPk<LspP2Y`qAL
zYd^X%CQvBLSMf`39kkooeHo}%ohx*PO@dWny&>SRfDR)|>B|9&N5ZHp_}pc7g6KoA
zxl);nTjK)42-wh~CJBxF5~uBREl_U-JT&d80E^fbzRblfmlfh~dPe6rLE&Ws5B&+t
zg50R5$NUO33Est<Q|axJ)Z`9ga5Vtar$nu`prTCgiYsZwWJ7VAOSQEne0oZp-wOpt
z{z3e`x{>XRUs$edD@wFB*_(u`Jq>5i`+oJ8+Y28ba=y6dby1DjF4Vd~NiF8aGlz-$
zh1ZNcv_bFWpgm-InDFlJNnKJX6nA5c*BZ#|_!bUnh=p`fT~{0ix9d3D_=)v=CS^(3
zgC^H{iB8d_?%k$D3=RSQ-HL6_$d$>uFi!n4%0MfGYiLKQcaJrwbV}*Q@!j23PNIT0
z)hCyP7&AC0hsZt)c@0)m@EwP0BZzy`fTgvysuH?7tGD;^-4dp1^~r9{VJE>b=MyK!
zp}-K8#PLoY-&YXbd!5T~$?r2^+;vRc$q--d#IDPj1qeJ6s2o6@E)^~?yOcW|f$GEv
zrLyWM?(IfLz_qJVfC#*KAkrBqG8mnBoOfncl<Xou)C(JPnu0Wq;53Zz(C~Vsw0j6)
zG`lc<`KLun^1!4}@;7uPQ>3~?umk$`Y~N&5(xR13po6s>97{Xc<|VVRk}fvPoSy2}
zpvQR7+cCkIm*_?x0FD!|L)Y|o08k@xzX8kFr)Dz-*$qUez#wbVnXC#=<f<{Qx~a)k
zxln$7Td!J~0R*tr*Vk?s^jk_7His4aO4w{Z4z;KFRia?5NSE>7B0o1Ti$qTAA(=o=
zX*UK#e#he$=d|SBz-vjIrzjyhCZ#mNKvs@+(B~9ddB+x=mb;^z#%=gL-HyEq5~MF{
zlXRQ`FWIQRw(1!4DC5V@n@dDe7wPv@M?R@Q2TqS>fpb`IZp+Na4?43#HN7lhp-7oY
zr&A(LuAdxE-L{oP&CYv+c*d-L+a(>ebVK_7Jpeg0+>!<Q4^HY_DnDdSW)B7P1Uctj
zXQ4B)v#by6w%cYWq%Clr653lK^43jXvO>!bsqQMDCCNBbZYcZ!pAbfnZu^9zZMsiw
zk^6V%z;C}^T~jW~mS=aHZ1<VWi?q@^v-JJ##yXOF6&UHZf@q`JI^g*$H@3>2_g*yl
zDN0<|7~V3m73TfifkDNd6f-T$%XJ0}fA)r_6P4GHd-08VoIA;tr-@=jaxf7BSu_(y
zk?tHq>s*nfCa)6t%zK!0{B5AgMU7)X^1~Yhj*h|qO~Hvh=}hk4f8rs=sep^XS2R_n
zgG>3{!bYtXxkfW6!nX}3r#Z<TWJyq_rrg#~Sf<nOYlDy7961lT_U+>v(v+kb_L;-_
z@NjE+p~yc;cNI0xO9cIXlwgpkoY7VgypHQ;KdE1M&&9f&V0zgS4Y9TdgbBs_=+le*
zBquh<YwRl$F2+8}yEPr)!QH2{0y<wi@T+;zcgah?ukv9`M>C76ecBNPm2S_bWPH?C
zm-s_>$)jM(H8Dp&B6G4{jO-+Ru6Wt5mHX^cFzKU=@?vQ>xxk$k%SD^pBPESr$GD)b
zTKwk^-Xl+@8A_pvuQWSutp=YImq5TM18H0ifXuk@u+ftU$fqFN;9a#3NOH&h6iaYe
z!5j-+0N9MS?ZSYC1A`hV33P194_D>x7fBy0zQRXOb^Awt;kDY7w<C83$C+_io{{4(
znx0fGMVsN+WX$|u*q@CH50j0xA-hY;P0K!gZLq0uRWz$6v0WQFk?<$p_gn!3T92Cb
z3A@A26zqbXR?qndYcfmOKMhh^_o_yp@$3=UQr0sL7g21=#?0iCqi-=D9OZwu#Hy!@
zJ$&^P;Pp{HQuSsv65$PVv>=n~WO%b3t-%8oBnB^n1`|B#;8*4?Ef{970;0waRw6;H
zQ!o3A?Jw%2x-Cq{tu+57_egHvRYn=Jl86BygMtHzD!FmvUTca~cn%s{bg-4J>EC0J
z!;rS=^u+i!Yqsh$%aq3P1~I46I#gD1BP!3Am<zP(6HuWo)s6nC5U&px^*8t=LdCWb
zj7SDnyzFCrMP;>X6hNW{##v-b=sE_$g`!$AoG7^_#%-MBo-wPVr%n?jjVCXbfRp%2
z{1*1RyF{MdA@u|%Ug??ygCB!NKXk>~X-JTld(iBp{UIAoe+m6T>{wQb_3J&v0=$uv
zi$;QJTot&^n36Ia@7_Onr={efr=~&QT=n+O2>qGs8S8x=s?ygYmI$uX$ak?!)`jsb
zJGA*L+0}wyX~UhYqd^t_P&p!AjQzqn&7g|YA2O8RHvQy%!pHLG{V||FJ~%NN6{dhh
zBqNKkDEucPH~6T5WmDeB*#J5i^-KYyTcPMKzL5S0q8wTR>Djz#9`oDp1bglst%(V)
zU|ymEn%Z;xK;b_+C^VPbMZH*B)3Zj({HYh<w%fULPXgtXRn=rGtFe+(U7~5ofF%1`
z=Kc2cVV9x60B<)|e((3{_rMQt_vTWONoyyqo4vMgj-2GG8pwPNh=62X?af10=Joye
zl6=#i2Mi*J>3(5j5<m0D)>&pJHloAS=>Dg!LM;+>>%HLD5%baQ8o=Y?k#q!BLC>=7
zagNo$s+T)^N~>UHV$P1W92le%9cuB=4A|bT;1L;WY73K(IHSh?!;5Q*|A#vI4|E|C
zUV&7^4Et%U5Rzjudu+vZ;+K3?K1-G@NWN`T=M~vtlx1m&Xo5R8Yz`yEcXkM>NTK=&
zgdC#!QS5&YNaxVf;S#TKN(3X0>EE@vW^)Gk|Ac_SX@7`?)cYDS61#*>EY(GJ>@AYl
z`gt{vF>POoFsf)B1Ny(?ZRa&zege2`4!Hr9NJgBHTF9eE*YpD`K~`*x|9z;YI3fu9
zK-NPyxa6a5(NCaXvQJv)<Si$_ConAFKW@zf+xWJM;sstljtek7@mC5bLrILKCcYfk
zIE|q*Kx-wWo>n@z8pMVkeExY>F|rXun|MXxixiw^vKc|5h#&su%T&kgw~={pSMU;p
zAlVnZaF3t*X{YEuwP)!zIU9!lUef;Iz%;q}ep{4pwCqH4V-u-UtZET9z*A@o4>AE6
zfI(@=MPRVA6ETaR`{R#6ymdn-sRyHUjHC*;TwFGEm=8~CaODkLFd3!SC5LUG$4$}#
z6eb+`7fDT{EOVcqOF2dqhQfKMqSWj%{kq4`16oIGn`vvHV(s%@Rskbxv@TJnU$daG
zXg{qg?d599yOcfx8*7IOrEK5KQRf~H4$L6;3}96;$KjERS*y85k-QXYw!>qcUn^K5
zF6TfK)ydNk=Ibo_Qmhg8Y+R+NTJ_Hu>PrOF9&wPFck4tM1V?Qu^ZQ;$n{^Fx%TI%E
zhu!XZ@r_(Qrds-sn$`=|75MB1vOEet3`om^|L`TV+9U$-VU~-$p>}1jhN}SL4mDmf
zg7@_fLg|jWL(tn_lI7V;Y4Nc8M=q_p1k62&bXHjb(M#5>p^i}PQrp@xemT^DH7mV{
z_|H<zrTvlWH`n_zU({6@!T~#tv^D!3XG0C$aR!gobsEOJWu!u&;%{mPYqk^!J-sW+
zaAwN6y7I$*hX5^T1J*GO;WioZTPN7YqtmbwHhOHacfqZ7Kl|&F>L^cle2oo5ZTkf5
zwoIaDV$X`19XFN;eak{>&xkq^+ii~~IJTe=^|mc;`1#0H1+c{w(D!c)BLTWcf<(#f
z@#yum&Llq>KAMwf2VH34m}64cA(r%%4o<pmk%?_`WW*7)yG5=V9h)W1Au|!iV!CoP
zSK1JlsUyiIwUk>J(?SB6>FpUgnro%Ju__5cn9YMf>2{hr?Clx#>@|^RQ`8eSzVi9~
z(q*t_y?qZ9XG78JzvH1&5-hS+8SX~9_9g*z!+aa_zWrtY*{_E!mO9WE)@LIty{^rf
zFNG~iZnlT6gDCuc{Mnt9)9v2PR_VA0ig8J}$rPrv!;e*c)*ii)i&TNKD}!r)go~Y3
zftaM%n7<VfvJ4@0sv8@IkBeFS%AsbEl!;<mgQS?<?i{sH=tzA__u?GHm3Y#)2{M*k
zv_a>sbGSEAp53CReA+n>z4(7>8D8`|K6){lAG7CvvCY(u4x2!37{hAPn=Q7DG5u02
z7lTcuZA%$k=~h=U&)By5n?JoVHRc^PeQdd^rm~nVC7_%pO~edaRO3$B8N?GwNW+3n
z)z$w2Nt0{088Ui`=xxEl8^e%8;wc^o<WapLswd5cCA5PwL?VCA?`k=|753&B7Q}Vc
zFY!``jnoK1borTVwZFH{%?R;l44h9>!;<pi42%a=J}bN&oiWl}rCud|dDS!h)BTrF
zI*&Fp7Zf}11FD-}{@Q9;@I#XiWIY0u2={9zH9}WD1QPJXJah3K(|PPXL>Rz!jd^Ht
zROm6l!;1l=I;6Yv-&CxQju-W9_C}x&54%M4SjoF9$U=}_d+9iwN=lok!n;fc<Pvj8
z0UKE-CF(|%hC&*p$WP?CALuuF?-hxnLtqO++fqmw*$%ratR2e<^xnhylclXYt`-GY
z|3LousvG0BaapT}z_Rc^8ju+uXSsim#>yJ*$N{&iHY3=LQ^qGZe@|UvbF#eLEz&ZX
zXR)lq_r1%e219d?3R$)mS88*tXM42t`N3_42REU)Gq)nRI~%A*=QG(u>u0zoZzzMS
znDU*@Qui`9Bd&F^55mELm5|^<81IB<^vFn$f<*srV~q-ZXe@k4;HSyE)4m1UE>XEH
zQloK-X2CoP7mwyo>&T@zl84@82oT*#pKw?(qkEV*2Xk<Y4A)Am%xGF1%;3+%+xbVz
z=@Dm)N4icS4sQaBbYce?fdndiU0XlVozUp=kP&dk{`3GDoSh}OEgC2Crb@*rm^Z|+
zeB=qd<Z(Rgp;=|3+nfFV{~KHQ5Uq?W83Jma5?=p}m^*hh7HDI;=XWmXpQEOnYRyDB
z#9O(_T{CTY>^g7Rfrayp(p*H3A}(1v!TTny3a&j&iN*I#hS3L_iqdlcyEmLea~jjH
zgH63p_m`CEb<UOOE{JA>p1ppV!wj&xTOokf0Yy+kG6{i_R9HK&e`xO;a#opEp*Rj<
z^)qK1j8D6L<VWoXPm1sv^Xzw|AV!-?M%bhs)AUPtj*W4WjU&x$|Ck3`6heu<6JZZ%
zg1-3iy%iS1K?h04$rF67?~h9Ot#pJyHZ))5zNKQyP={MhS(44^dYVdFz(x)Xwm*~9
zqxY|$3afjzW3cU{o49er^Gd5C?EK5Jo6$BAE}|%}6<gI;KS)?1XyZ+xuASs#6IKpk
z-|ks+J#W3MZ&!5yc-=bPA{yjlQGN|h&bx6IzR`5IA*9_Y-5mRz<k;pMF5CCu#jXZP
zoH~{8qg~xCKnY$?3ipSsbgZ!jhj0={jn_R@i6rODO!%um9XwUNzgAK4ZzU%opWZ*7
zbjc8W9@VS3R@TPNW@q_)waz5sZr%OSo;*9|<^>ist;@X;hLf|LRGjWT)2k6TXyiHb
z&3GXw5wi8;yg79!X}IwJ2BA2^s0+B^mw$X97Me=H?^Bq0iA$SAn3AnhRx)F&_9Jag
zt@L20M{aBMVUx3mpH~Y5?Jc4V9|hxUdrotyU|~F^#fFMM>?&`gz6=d;fx0Ov;P^d#
zX7UP;d!0?Q?@YUz$1*v_Cafw<D!xI{T`AdzKo6R*#s`Q!=z$sVi}Qhdp8*{ic%!oC
zAXn4b8z-M_;%^+gP?f;Gy&B;&9XVPvic$9WfNcYnHNW+hX{l+viz=z&V<wO?g3qx;
ziz&|D?43QIKW;jigWrxZyLCpX%LP)=X<as)=}|HMi}H@Xk_uktKM-oi#=;`*iQojV
z4&#X#>lCa`74u^uR;c+^BC9<wm93=bOI<@VAeZZVDFXD)x%^ZDyCYf4)$#l0QlblP
z;nYU|EofCSF;iJSer>Pstgm;P!*r_Y1q|`^koZLW5tuT4XqOj~iFf*s2bq4U&yDYr
z*+LV)^wH|z8V0s)TyJ#K#L5lfg3fQ_rQZPnN5GpO^)kn2lllk3U82(k{?bUr>@z1x
zhdiMg_X?|g)5(dep%E9+{>BLa=CD)RrQJLrFQk;F^GG`uK)e|)CnX|nvHoYuVWXuj
zvu=%NY*^FOmf?jJgP3G7jgT=!E&qhARNlExg&HLyAE}4~W)MiGT;Bp2D<g4^iT_!W
zH2nbo-jH>$bF?$$VkV@GIxi_|0o~0IgGR?u!l#d1lY8-YxY$s!`*)y`rtn%KFD;p<
zs>y{D1O6%xF>IO6lJ;G7<lN-x_BS>qX=V>VAaNain5fF`x{m_<Q|I*|93)Wns8|pZ
zD_;;Oz~M5wgd`sz<9;$_SYr9`5xfS>w&A+w&o5wE+$WJGXA;a~FQ-_R#=5ahPARo&
zCbS(O&XC?8YnHN<&DvAtoEPxiVvfHi1cvv5A_lL_R(B=Z=*hzX@#N>lklm-|ZbK>>
zF({`<-a$HNutV74&78rzA;1->89?3#ft|fbf1HqzFoZS$B8-iANdin~rHv_SsRv;j
zne+X+GTH0R@BV(u0Lfsu0{C^P#I)&Nin=>q`Q_b6b&^#TEIt@D!p74A)KE=9I%G&^
zx$rpG3#_EVQ>0@!01lsU5rq%`D$c)3P{d&?GG+wSfoiq0v(xfAnw#<g&)nVBc&+HW
zs(Iy#w7Xz8M!Ek+hkE^(TX5LSI5(<1;I51>pP+J6fcS26CJlQ7M>lm0Ji)%aO{`(O
z4B^#%?<v&=^LNI5O?d!kzf4#FzCx0`f)g=j#R*oCkH#vv3_L>}_!)IDbX$G_G-@|_
zZ_MfFw{C?7z7Yf;{d@dUp*vetNq!^1wSjogAiJd;HkRN9)^?jt+dDhkFM5i9j`=o2
zijZ$QY6SN{ni4ejUskYxKnHa$;bbKFxDPY>zXcfER@Tmt!X>}P7=B-Wa|PB{Y6<kj
zKl+1qMFes;feQOLo>;T>JIt;l-J{oX5lLHdGpqf$+kQ~=4sCCWAwyyiiC8eOysJ=^
zC?AHLjftL1plm8pNhrO*(F-6|qzle)kr;>4OBYqJ98}1}{HjV+%z0*P6G=*q2S2kM
z^ZLkRCYh>7*?ql?@9et^=g<fwX0vxf|LE?G(rx(`94oC<M4K~{nsER?nkd`zeI%c@
zvN#C%px?gy`AphtE=R{&mGLlk?Yu$>Y^T?K_bAQy4u{BbHeNln6%Jmpa$BFY|Eh1M
zQkIgyKor5$L$&tx790wDw9S;m@OzLh9Y+M(xXgVCJEGRv@P)nPkD}RuvN;VV*?8Ze
z(yy|G7rY8$WOoSjQ%_55*0!X@s`OcbM^%nECuuYrZ~JC?n!u?D?lvNErx=`nTyF^9
zE+H~vTXBFPXe)az<2S_}@AAb%%jJ)~=0M}Y;tU_EiVIvHF%0O3$@y@(p9dwoM?$2a
ztc_Y!i4#)#Ef$#&>gAq+ePt^mAYg}@x!ys@CYbhvWWHQ;$B0?_ZaB2AB`4`kAfit)
z5mxD?A!&3Z?YYoG>t{mH`4oj%k4@~^7OxP#EUspBV(o7q#@WIWZKzK@%oIyc-kfk3
zFmHl;lw-dxcZ@x<x>DBaI3qq(tk}Gaur5>C)&3)apU#BAw={o2M?%&B17#_Fn!#_I
z>=|oX;p350oU^S50{g^}IJwc@#96^5Bp^>@w^*P=l%hHcB4G?~gcYSZ>3^@0Y#a-M
zsH@sE6B*#{re85qV6@ZDZ1+#nLZP84oxaQFzLM`p+RnJ2CCtLkRI!Ug?A4Rx!U$Fs
zPBTjBQhw^Odj1EOObs(MhuZFmXQoP?!O9KKPRbQiF~y=V)$thzv`{muh1GkqMCQ<m
zZ{F<V<&1vDwMA=9PRhF0Z-qamqq_hRg_xe$V<}@MZQ@feFQiGTkFtrwwT3r;{otFi
zmc?LWBgV6ZlUg<9)C$8wTp89pqTU=h$F3{NiLuDWaJ(7_rB9wjswO6#=VQieDBM&p
zOPyzp84YX<4EE)F`uV*Gh<n{7yh&UmxXh?i=;hI-fQ|X4?O9F8MYJWl=i(E<yDbt&
zB2IVvN{FYjOQl2c{CjF1@;q<A4fe#)p8f`bY_iiRB)U#iV2z~29!`1ke=9_OT*`0*
zLbM?WWU*X$k_o$aod35ail~71E$CA$h5veIYV@^*y_c-*o9KMn-(l9q<U}MAlTZs&
zhVkEVl5g)XgJq^SVw8OA`N?swF2(wosQ(ROm^<5#35teg5p~EPnd-k<Y&ovfAnAPx
z8cGiNp|9VOG1cEuof_PRXp4iND29urP+9zC|2V><c6v*;0A3plS~RuJ-UuaN59ic3
z9wEKQH??FSls%`dMZ4$jf@GIWzonYP1ptE&c`36g5W}y;%>=^!y{B4tG!g4~fy>z(
z+6=A|7)%l0kv?*k{{jYC6kS|WFj2lp=S{s%pt4W$CVX&k0V6Pea_%>hXOX<!c0Av$
zKLH~v9s94c4?A?Dl5%U+{LwtbK!h6|zD>=~4ET+P1}Kk$X@U%xXGxe3@9A^iAI6e}
zep?0K0S5UwMSd%b2|uSx-U7n$sqQVGhPjx3B4n&c@OTab+Eec@Mw#uX>QKCv&o?Xq
zxbSWAD62ov+tkD~&U5s036u?|%=9VI5BDXjGAd^0l}|!x*FCso0>^c8wzG{C(L8kq
zo>xU26zkkO-d`Gw>3s1hYA`&S&Ld<wwFNSqPHH~0%u`doVyz5UQ){h5Q75TPx|@)c
z)Bj5M=JnzY+K|^%2tBNJgsV6(`}awlA%P||^93_%!p=?{umU^is)K<1eo=R<d>qj=
ze!+^Xp0T&;@OCCIl`f5nwm77en)#<J|5A*Pu9&^Eiqo@n+4{f;Pq}RQV%zSGO6~Zz
zOE*|)W^u~t5bh?cJZW+gT$)nda`ElZtmk+)Cb3xk^;^z;+PVhNTLeqKE->5}<Yf@N
zc_SbJ@}&7^Y#K@MfLo*Z8lfBAIAvwtwMoMjM5;0=Mj3RvJWU;!2UU6uf&u_JBgU%B
z6psNc_YA6c5;Qe4II81)E<??y8~nMV?=43u3YX4y$)PO^d5}2nsW$Cwf=2f|TTXGz
zK8;*sy#YbIb|W<0Ep)}_(3Ff-&g<FptHGw>zKL~>?{)R>NsTUXna7%+<<SM|Jg-wu
z^N0Sn85*Qh1pql{7ze6nL61?Yg$j7M19sq6Dsw=rvnf80_M-<8bsO{`^|f`VI|}Zr
z)+cXET>UKV)(NthC(|?T)!-t)UwK}-?ONhH6>sH3cmVYiD_8TUGnk2>`3WzdmZFX4
z_viDMe@%ds>;2_))sJt-&(HbpasEDQ@w@SH@fKmGmxu4`eQ(>%>@=)Y0B{8$^nSe9
zrSduT^Te6aMy0|JT4r^7^V_dJ{B|n|SRCXCD-9ck42xrTR6L5-kcONs9tR-G3uNag
z6}_yF_bd;uyD%4z&jKFTTO}xX_un6_tFOXW8+O%k*m``|o4EbJXZ63mo&;9f)BAw2
z*0VZR`JIp{yg=#3g}Uj&;Tka7Pi0y3x4W>qz83dFESQI@zS?LNBEJgI9V2E=Telt2
zvFd)QH##HLwDrClzt!}CmVX|G(_GcLFzggmKe*+Wx3%E@;1X-SB|S%3=#svVdB1wF
zFqcSdll7q$40-jvt>~S(6Jp&=Vy^U^3`NhvqT<S1nLiFkNnI{V@s7jpkuwPV{wEFk
zun3HVZn%3Wp!)q3E(b#V5t$2pGqQ4_#5*sNv`u6s7!5mCEY3!lrt(-}2%sv9B9${8
zbQKrlzxG^t-R=HNli+5!u<qrZX<X#3)dr?Ek&)zbHIjO>|Hl^dYXdBLU~F3W^ZVUo
K{oWIZ0Q5h>n~=5u

diff --git a/packages/system/capi-providers-cpprovider/files/control-plane-components.yaml b/packages/system/capi-providers-cpprovider/files/control-plane-components.yaml
index d30e7373..64fc7d6d 100644
--- a/packages/system/capi-providers-cpprovider/files/control-plane-components.yaml
+++ b/packages/system/capi-providers-cpprovider/files/control-plane-components.yaml
@@ -109,7 +109,7 @@ spec:
                       agent:
                         default:
                           image: registry.k8s.io/kas-network-proxy/proxy-agent
-                          version: v0.28.6
+                          mode: DaemonSet
                         properties:
                           extraArgs:
                             description: |-
@@ -120,10 +120,31 @@ spec:
                             items:
                               type: string
                             type: array
+                          hostNetwork:
+                            default: false
+                            description: |-
+                              HostNetwork enables the konnectivity agent to use the Host network namespace.
+                              By enabling this mode, the Agent doesn't need to wait for the CNI initialisation,
+                              enabling a sort of out-of-band access to nodes for troubleshooting scenarios,
+                              or when the agent needs direct access to the host network.
+                            type: boolean
                           image:
                             default: registry.k8s.io/kas-network-proxy/proxy-agent
                             description: AgentImage defines the container image for Konnectivity's agent.
                             type: string
+                          mode:
+                            default: DaemonSet
+                            description: 'Mode allows specifying the Agent deployment mode: Deployment, or DaemonSet (default).'
+                            enum:
+                            - DaemonSet
+                            - Deployment
+                            type: string
+                          replicas:
+                            description: |-
+                              Replicas defines the number of replicas when Mode is Deployment.
+                              Must be 0 if Mode is DaemonSet.
+                            format: int32
+                            type: integer
                           tolerations:
                             default:
                             - key: CriticalAddonsOnly
@@ -169,15 +190,20 @@ spec:
                               type: object
                             type: array
                           version:
-                            default: v0.28.6
-                            description: Version for Konnectivity agent.
+                            description: |-
+                              Version for Konnectivity agent.
+                              If left empty, Kamaji will automatically inflect the version from the deployed Tenant Control Plane.
+
+                              WARNING: for last cut-off releases, the container image could be not available.
                             type: string
                         type: object
+                        x-kubernetes-validations:
+                        - message: replicas must be 0 when mode is DaemonSet, and greater than 0 when mode is Deployment
+                          rule: '!(self.mode == ''DaemonSet'' && has(self.replicas) && self.replicas != 0) && !(self.mode == ''Deployment'' && self.replicas == 0)'
                       server:
                         default:
                           image: registry.k8s.io/kas-network-proxy/proxy-server
                           port: 8132
-                          version: v0.28.6
                         properties:
                           extraArgs:
                             description: |-
@@ -204,7 +230,7 @@ spec:
                                   Claims lists the names of resources, defined in spec.resourceClaims,
                                   that are used by this container.
 
-                                  This is an alpha field and requires enabling the
+                                  This field depends on the
                                   DynamicResourceAllocation feature gate.
 
                                   This field is immutable. It can only be set for containers.
@@ -256,8 +282,11 @@ spec:
                                 type: object
                             type: object
                           version:
-                            default: v0.28.6
-                            description: Container image version of the Konnectivity server.
+                            description: |-
+                              Container image version of the Konnectivity server.
+                              If left empty, Kamaji will automatically inflect the version from the deployed Tenant Control Plane.
+
+                              WARNING: for last cut-off releases, the container image could be not available.
                             type: string
                         required:
                         - port
@@ -410,7 +439,7 @@ spec:
                           Claims lists the names of resources, defined in spec.resourceClaims,
                           that are used by this container.
 
-                          This is an alpha field and requires enabling the
+                          This field depends on the
                           DynamicResourceAllocation feature gate.
 
                           This field is immutable. It can only be set for containers.
@@ -560,7 +589,7 @@ spec:
                           Claims lists the names of resources, defined in spec.resourceClaims,
                           that are used by this container.
 
-                          This is an alpha field and requires enabling the
+                          This field depends on the
                           DynamicResourceAllocation feature gate.
 
                           This field is immutable. It can only be set for containers.
@@ -620,6 +649,16 @@ spec:
               dataStoreSchema:
                 description: DataStoreSchema allows to specify the name of the database (for relational DataStores) or the key prefix (for etcd)
                 type: string
+              dataStoreUsername:
+                description: |-
+                  DataStoreUsername allows to specify the username of the database (for relational DataStores). This
+                  value is optional and immutable. Note that Kamaji currently doesn't ensure that DataStoreUsername values are unique. It's up
+                  to the user to avoid clashes between different TenantControlPlanes. If not set upon creation, Kamaji will default the
+                  DataStoreUsername by concatenating the namespace and name of the TenantControlPlane.
+                type: string
+                x-kubernetes-validations:
+                - message: changing the dataStoreUsername is not supported
+                  rule: self == oldSelf
               deployment:
                 description: Configure how the TenantControlPlane Deployment object should be configured.
                 properties:
@@ -903,7 +942,6 @@ spec:
                                         pod labels will be ignored. The default value is empty.
                                         The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                         Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                       items:
                                         type: string
                                       type: array
@@ -918,7 +956,6 @@ spec:
                                         pod labels will be ignored. The default value is empty.
                                         The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                         Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                       items:
                                         type: string
                                       type: array
@@ -1079,7 +1116,6 @@ spec:
                                     pod labels will be ignored. The default value is empty.
                                     The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                     Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                   items:
                                     type: string
                                   type: array
@@ -1094,7 +1130,6 @@ spec:
                                     pod labels will be ignored. The default value is empty.
                                     The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                     Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                   items:
                                     type: string
                                   type: array
@@ -1183,8 +1218,8 @@ spec:
                               most preferred is the one with the greatest sum of weights, i.e.
                               for each node that meets all of the scheduling requirements (resource
                               request, requiredDuringScheduling anti-affinity expressions, etc.),
-                              compute a sum by iterating through the elements of this field and adding
-                              "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                              compute a sum by iterating through the elements of this field and subtracting
+                              "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                               node(s) with the highest sum are the most preferred.
                             items:
                               description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
@@ -1248,7 +1283,6 @@ spec:
                                         pod labels will be ignored. The default value is empty.
                                         The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                         Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                       items:
                                         type: string
                                       type: array
@@ -1263,7 +1297,6 @@ spec:
                                         pod labels will be ignored. The default value is empty.
                                         The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                         Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                       items:
                                         type: string
                                       type: array
@@ -1424,7 +1457,6 @@ spec:
                                     pod labels will be ignored. The default value is empty.
                                     The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                     Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                   items:
                                     type: string
                                   type: array
@@ -1439,7 +1471,6 @@ spec:
                                     pod labels will be ignored. The default value is empty.
                                     The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                     Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                   items:
                                     type: string
                                   type: array
@@ -1587,7 +1618,9 @@ spec:
                             description: EnvVar represents an environment variable present in a Container.
                             properties:
                               name:
-                                description: Name of the environment variable. Must be a C_IDENTIFIER.
+                                description: |-
+                                  Name of the environment variable.
+                                  May consist of any printable ASCII characters except '='.
                                 type: string
                               value:
                                 description: |-
@@ -1641,6 +1674,42 @@ spec:
                                     - fieldPath
                                     type: object
                                     x-kubernetes-map-type: atomic
+                                  fileKeyRef:
+                                    description: |-
+                                      FileKeyRef selects a key of the env file.
+                                      Requires the EnvFiles feature gate to be enabled.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key within the env file. An invalid key will prevent the pod from starting.
+                                          The keys defined within a source may consist of any printable ASCII characters except '='.
+                                          During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                        type: string
+                                      optional:
+                                        default: false
+                                        description: |-
+                                          Specify whether the file or its key must be defined. If the file or key
+                                          does not exist, then the env var is not published.
+                                          If optional is set to true and the specified key does not exist,
+                                          the environment variable will not be set in the Pod's containers.
+
+                                          If optional is set to false and the specified key does not exist,
+                                          an error will be returned during Pod creation.
+                                        type: boolean
+                                      path:
+                                        description: |-
+                                          The path within the volume from which to select the file.
+                                          Must be relative and may not contain the '..' path or start with '..'.
+                                        type: string
+                                      volumeName:
+                                        description: The name of the volume mount containing the env file.
+                                        type: string
+                                    required:
+                                    - key
+                                    - path
+                                    - volumeName
+                                    type: object
+                                    x-kubernetes-map-type: atomic
                                   resourceFieldRef:
                                     description: |-
                                       Selects a resource of the container: only resources limits and requests
@@ -1696,13 +1765,13 @@ spec:
                         envFrom:
                           description: |-
                             List of sources to populate environment variables in the container.
-                            The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                            will be reported as an event when the container is starting. When a key exists in multiple
+                            The keys defined within a source may consist of any printable ASCII characters except '='.
+                            When a key exists in multiple
                             sources, the value associated with the last source will take precedence.
                             Values defined by an Env with a duplicate key will take precedence.
                             Cannot be updated.
                           items:
-                            description: EnvFromSource represents the source of a set of ConfigMaps
+                            description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
                             properties:
                               configMapRef:
                                 description: The ConfigMap to select from
@@ -1722,7 +1791,9 @@ spec:
                                 type: object
                                 x-kubernetes-map-type: atomic
                               prefix:
-                                description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+                                description: |-
+                                  Optional text to prepend to the name of each environment variable.
+                                  May consist of any printable ASCII characters except '='.
                                 type: string
                               secretRef:
                                 description: The Secret to select from
@@ -1971,6 +2042,12 @@ spec:
                                   - port
                                   type: object
                               type: object
+                            stopSignal:
+                              description: |-
+                                StopSignal defines which signal will be sent to a container when it is being stopped.
+                                If not specified, the default is defined by the container runtime in use.
+                                StopSignal can only be set for Pods with a non-empty .spec.os.name
+                              type: string
                           type: object
                         livenessProbe:
                           description: |-
@@ -2361,7 +2438,7 @@ spec:
                                 Claims lists the names of resources, defined in spec.resourceClaims,
                                 that are used by this container.
 
-                                This is an alpha field and requires enabling the
+                                This field depends on the
                                 DynamicResourceAllocation feature gate.
 
                                 This field is immutable. It can only be set for containers.
@@ -2415,10 +2492,10 @@ spec:
                         restartPolicy:
                           description: |-
                             RestartPolicy defines the restart behavior of individual containers in a pod.
-                            This field may only be set for init containers, and the only allowed value is "Always".
-                            For non-init containers or when this field is not specified,
+                            This overrides the pod-level restart policy. When this field is not specified,
                             the restart behavior is defined by the Pod's restart policy and the container type.
-                            Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                            Additionally, setting the RestartPolicy as "Always" for the init container will
+                            have the following effect:
                             this init container will be continually restarted on
                             exit until all regular containers have terminated. Once all regular
                             containers have completed, all init containers with restartPolicy "Always"
@@ -2430,6 +2507,57 @@ spec:
                             init container is started, or after any startupProbe has successfully
                             completed.
                           type: string
+                        restartPolicyRules:
+                          description: |-
+                            Represents a list of rules to be checked to determine if the
+                            container should be restarted on exit. The rules are evaluated in
+                            order. Once a rule matches a container exit condition, the remaining
+                            rules are ignored. If no rule matches the container exit condition,
+                            the Container-level restart policy determines the whether the container
+                            is restarted or not. Constraints on the rules:
+                            - At most 20 rules are allowed.
+                            - Rules can have the same action.
+                            - Identical rules are not forbidden in validations.
+                            When rules are specified, container MUST set RestartPolicy explicitly
+                            even it if matches the Pod's RestartPolicy.
+                          items:
+                            description: ContainerRestartRule describes how a container exit is handled.
+                            properties:
+                              action:
+                                description: |-
+                                  Specifies the action taken on a container exit if the requirements
+                                  are satisfied. The only possible value is "Restart" to restart the
+                                  container.
+                                type: string
+                              exitCodes:
+                                description: Represents the exit codes to check on container exits.
+                                properties:
+                                  operator:
+                                    description: |-
+                                      Represents the relationship between the container exit code(s) and the
+                                      specified values. Possible values are:
+                                      - In: the requirement is satisfied if the container exit code is in the
+                                        set of specified values.
+                                      - NotIn: the requirement is satisfied if the container exit code is
+                                        not in the set of specified values.
+                                    type: string
+                                  values:
+                                    description: |-
+                                      Specifies the set of values to check for container exit codes.
+                                      At most 255 elements are allowed.
+                                    items:
+                                      format: int32
+                                      type: integer
+                                    type: array
+                                    x-kubernetes-list-type: set
+                                required:
+                                - operator
+                                type: object
+                            required:
+                            - action
+                            type: object
+                          type: array
+                          x-kubernetes-list-type: atomic
                         securityContext:
                           description: |-
                             SecurityContext defines the security options the container should be run with.
@@ -2951,7 +3079,9 @@ spec:
                             description: EnvVar represents an environment variable present in a Container.
                             properties:
                               name:
-                                description: Name of the environment variable. Must be a C_IDENTIFIER.
+                                description: |-
+                                  Name of the environment variable.
+                                  May consist of any printable ASCII characters except '='.
                                 type: string
                               value:
                                 description: |-
@@ -3005,6 +3135,42 @@ spec:
                                     - fieldPath
                                     type: object
                                     x-kubernetes-map-type: atomic
+                                  fileKeyRef:
+                                    description: |-
+                                      FileKeyRef selects a key of the env file.
+                                      Requires the EnvFiles feature gate to be enabled.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key within the env file. An invalid key will prevent the pod from starting.
+                                          The keys defined within a source may consist of any printable ASCII characters except '='.
+                                          During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                        type: string
+                                      optional:
+                                        default: false
+                                        description: |-
+                                          Specify whether the file or its key must be defined. If the file or key
+                                          does not exist, then the env var is not published.
+                                          If optional is set to true and the specified key does not exist,
+                                          the environment variable will not be set in the Pod's containers.
+
+                                          If optional is set to false and the specified key does not exist,
+                                          an error will be returned during Pod creation.
+                                        type: boolean
+                                      path:
+                                        description: |-
+                                          The path within the volume from which to select the file.
+                                          Must be relative and may not contain the '..' path or start with '..'.
+                                        type: string
+                                      volumeName:
+                                        description: The name of the volume mount containing the env file.
+                                        type: string
+                                    required:
+                                    - key
+                                    - path
+                                    - volumeName
+                                    type: object
+                                    x-kubernetes-map-type: atomic
                                   resourceFieldRef:
                                     description: |-
                                       Selects a resource of the container: only resources limits and requests
@@ -3060,13 +3226,13 @@ spec:
                         envFrom:
                           description: |-
                             List of sources to populate environment variables in the container.
-                            The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                            will be reported as an event when the container is starting. When a key exists in multiple
+                            The keys defined within a source may consist of any printable ASCII characters except '='.
+                            When a key exists in multiple
                             sources, the value associated with the last source will take precedence.
                             Values defined by an Env with a duplicate key will take precedence.
                             Cannot be updated.
                           items:
-                            description: EnvFromSource represents the source of a set of ConfigMaps
+                            description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
                             properties:
                               configMapRef:
                                 description: The ConfigMap to select from
@@ -3086,7 +3252,9 @@ spec:
                                 type: object
                                 x-kubernetes-map-type: atomic
                               prefix:
-                                description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+                                description: |-
+                                  Optional text to prepend to the name of each environment variable.
+                                  May consist of any printable ASCII characters except '='.
                                 type: string
                               secretRef:
                                 description: The Secret to select from
@@ -3335,6 +3503,12 @@ spec:
                                   - port
                                   type: object
                               type: object
+                            stopSignal:
+                              description: |-
+                                StopSignal defines which signal will be sent to a container when it is being stopped.
+                                If not specified, the default is defined by the container runtime in use.
+                                StopSignal can only be set for Pods with a non-empty .spec.os.name
+                              type: string
                           type: object
                         livenessProbe:
                           description: |-
@@ -3725,7 +3899,7 @@ spec:
                                 Claims lists the names of resources, defined in spec.resourceClaims,
                                 that are used by this container.
 
-                                This is an alpha field and requires enabling the
+                                This field depends on the
                                 DynamicResourceAllocation feature gate.
 
                                 This field is immutable. It can only be set for containers.
@@ -3779,10 +3953,10 @@ spec:
                         restartPolicy:
                           description: |-
                             RestartPolicy defines the restart behavior of individual containers in a pod.
-                            This field may only be set for init containers, and the only allowed value is "Always".
-                            For non-init containers or when this field is not specified,
+                            This overrides the pod-level restart policy. When this field is not specified,
                             the restart behavior is defined by the Pod's restart policy and the container type.
-                            Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                            Additionally, setting the RestartPolicy as "Always" for the init container will
+                            have the following effect:
                             this init container will be continually restarted on
                             exit until all regular containers have terminated. Once all regular
                             containers have completed, all init containers with restartPolicy "Always"
@@ -3794,6 +3968,57 @@ spec:
                             init container is started, or after any startupProbe has successfully
                             completed.
                           type: string
+                        restartPolicyRules:
+                          description: |-
+                            Represents a list of rules to be checked to determine if the
+                            container should be restarted on exit. The rules are evaluated in
+                            order. Once a rule matches a container exit condition, the remaining
+                            rules are ignored. If no rule matches the container exit condition,
+                            the Container-level restart policy determines the whether the container
+                            is restarted or not. Constraints on the rules:
+                            - At most 20 rules are allowed.
+                            - Rules can have the same action.
+                            - Identical rules are not forbidden in validations.
+                            When rules are specified, container MUST set RestartPolicy explicitly
+                            even it if matches the Pod's RestartPolicy.
+                          items:
+                            description: ContainerRestartRule describes how a container exit is handled.
+                            properties:
+                              action:
+                                description: |-
+                                  Specifies the action taken on a container exit if the requirements
+                                  are satisfied. The only possible value is "Restart" to restart the
+                                  container.
+                                type: string
+                              exitCodes:
+                                description: Represents the exit codes to check on container exits.
+                                properties:
+                                  operator:
+                                    description: |-
+                                      Represents the relationship between the container exit code(s) and the
+                                      specified values. Possible values are:
+                                      - In: the requirement is satisfied if the container exit code is in the
+                                        set of specified values.
+                                      - NotIn: the requirement is satisfied if the container exit code is
+                                        not in the set of specified values.
+                                    type: string
+                                  values:
+                                    description: |-
+                                      Specifies the set of values to check for container exit codes.
+                                      At most 255 elements are allowed.
+                                    items:
+                                      format: int32
+                                      type: integer
+                                    type: array
+                                    x-kubernetes-list-type: set
+                                required:
+                                - operator
+                                type: object
+                            required:
+                            - action
+                            type: object
+                          type: array
+                          x-kubernetes-list-type: atomic
                         securityContext:
                           description: |-
                             SecurityContext defines the security options the container should be run with.
@@ -4915,15 +5140,13 @@ spec:
                                         volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                         If specified, the CSI driver will create or update the volume with the attributes defined
                                         in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                        it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                        will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                        If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                        will be set by the persistentvolume controller if it exists.
+                                        it can be changed after the claim is created. An empty string or nil value indicates that no
+                                        VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                        this field can be reset to its previous value (including nil) to cancel the modification.
                                         If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                         set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                         exists.
                                         More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                        (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                       type: string
                                     volumeMode:
                                       description: |-
@@ -5097,12 +5320,9 @@ spec:
                           description: |-
                             glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                             Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                            More info: https://examples.k8s.io/volumes/glusterfs/README.md
                           properties:
                             endpoints:
-                              description: |-
-                                endpoints is the endpoint name that details Glusterfs topology.
-                                More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                              description: endpoints is the endpoint name that details Glusterfs topology.
                               type: string
                             path:
                               description: |-
@@ -5156,7 +5376,7 @@ spec:
                             The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
                             The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
                             The volume will be mounted read-only (ro) and non-executable files (noexec).
-                            Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
+                            Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
                             The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
                           properties:
                             pullPolicy:
@@ -5181,7 +5401,7 @@ spec:
                           description: |-
                             iscsi represents an ISCSI Disk resource that is attached to a
                             kubelet's host machine and then exposed to the pod.
-                            More info: https://examples.k8s.io/volumes/iscsi/README.md
+                            More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                           properties:
                             chapAuthDiscovery:
                               description: chapAuthDiscovery defines whether support iSCSI Discovery CHAP authentication
@@ -5571,6 +5791,110 @@ spec:
                                         type: array
                                         x-kubernetes-list-type: atomic
                                     type: object
+                                  podCertificate:
+                                    description: |-
+                                      Projects an auto-rotating credential bundle (private key and certificate
+                                      chain) that the pod can use either as a TLS client or server.
+
+                                      Kubelet generates a private key and uses it to send a
+                                      PodCertificateRequest to the named signer.  Once the signer approves the
+                                      request and issues a certificate chain, Kubelet writes the key and
+                                      certificate chain to the pod filesystem.  The pod does not start until
+                                      certificates have been issued for each podCertificate projected volume
+                                      source in its spec.
+
+                                      Kubelet will begin trying to rotate the certificate at the time indicated
+                                      by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                      timestamp.
+
+                                      Kubelet can write a single file, indicated by the credentialBundlePath
+                                      field, or separate files, indicated by the keyPath and
+                                      certificateChainPath fields.
+
+                                      The credential bundle is a single file in PEM format.  The first PEM
+                                      entry is the private key (in PKCS#8 format), and the remaining PEM
+                                      entries are the certificate chain issued by the signer (typically,
+                                      signers will return their certificate chain in leaf-to-root order).
+
+                                      Prefer using the credential bundle format, since your application code
+                                      can read it atomically.  If you use keyPath and certificateChainPath,
+                                      your application must make two separate file reads. If these coincide
+                                      with a certificate rotation, it is possible that the private key and leaf
+                                      certificate you read may not correspond to each other.  Your application
+                                      will need to check for this condition, and re-read until they are
+                                      consistent.
+
+                                      The named signer controls chooses the format of the certificate it
+                                      issues; consult the signer implementation's documentation to learn how to
+                                      use the certificates it issues.
+                                    properties:
+                                      certificateChainPath:
+                                        description: |-
+                                          Write the certificate chain at this path in the projected volume.
+
+                                          Most applications should use credentialBundlePath.  When using keyPath
+                                          and certificateChainPath, your application needs to check that the key
+                                          and leaf certificate are consistent, because it is possible to read the
+                                          files mid-rotation.
+                                        type: string
+                                      credentialBundlePath:
+                                        description: |-
+                                          Write the credential bundle at this path in the projected volume.
+
+                                          The credential bundle is a single file that contains multiple PEM blocks.
+                                          The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                          key.
+
+                                          The remaining blocks are CERTIFICATE blocks, containing the issued
+                                          certificate chain from the signer (leaf and any intermediates).
+
+                                          Using credentialBundlePath lets your Pod's application code make a single
+                                          atomic read that retrieves a consistent key and certificate chain.  If you
+                                          project them to separate files, your application code will need to
+                                          additionally check that the leaf certificate was issued to the key.
+                                        type: string
+                                      keyPath:
+                                        description: |-
+                                          Write the key at this path in the projected volume.
+
+                                          Most applications should use credentialBundlePath.  When using keyPath
+                                          and certificateChainPath, your application needs to check that the key
+                                          and leaf certificate are consistent, because it is possible to read the
+                                          files mid-rotation.
+                                        type: string
+                                      keyType:
+                                        description: |-
+                                          The type of keypair Kubelet will generate for the pod.
+
+                                          Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                          "ECDSAP521", and "ED25519".
+                                        type: string
+                                      maxExpirationSeconds:
+                                        description: |-
+                                          maxExpirationSeconds is the maximum lifetime permitted for the
+                                          certificate.
+
+                                          Kubelet copies this value verbatim into the PodCertificateRequests it
+                                          generates for this projection.
+
+                                          If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                          will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                          value is 7862400 (91 days).
+
+                                          The signer implementation is then free to issue a certificate with any
+                                          lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                          seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                          `kubernetes.io` signers will never issue certificates with a lifetime
+                                          longer than 24 hours.
+                                        format: int32
+                                        type: integer
+                                      signerName:
+                                        description: Kubelet's generated CSRs will be addressed to this signer.
+                                        type: string
+                                    required:
+                                    - keyType
+                                    - signerName
+                                    type: object
                                   secret:
                                     description: secret information about the secret data to project
                                     properties:
@@ -5700,7 +6024,6 @@ spec:
                           description: |-
                             rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                             Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                            More info: https://examples.k8s.io/volumes/rbd/README.md
                           properties:
                             fsType:
                               description: |-
@@ -6199,7 +6522,6 @@ spec:
                             - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
 
                             If this value is nil, the behavior is equivalent to the Honor policy.
-                            This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                           type: string
                         nodeTaintsPolicy:
                           description: |-
@@ -6210,7 +6532,6 @@ spec:
                             - Ignore: node taints are ignored. All nodes are included.
 
                             If this value is nil, the behavior is equivalent to the Ignore policy.
-                            This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                           type: string
                         topologyKey:
                           description: |-
@@ -6270,7 +6591,7 @@ spec:
                           Claims lists the names of resources, defined in spec.resourceClaims,
                           that are used by this container.
 
-                          This is an alpha field and requires enabling the
+                          This field depends on the
                           DynamicResourceAllocation feature gate.
 
                           This field is immutable. It can only be set for containers.
@@ -6326,14 +6647,14 @@ spec:
                 default:
                   cgroupfs: systemd
                   preferredAddressTypes:
-                  - Hostname
                   - InternalIP
                   - ExternalIP
+                  - Hostname
                 description: Configure the Kubelet options, such as the preferred address types, or the expected cgroupfs.
                 properties:
                   cgroupfs:
                     description: |-
-                      CGroupFS defines the  cgroup driver for Kubelet
+                      CGroupFS defines the cgroup driver for Kubelet
                       https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver/
                     enum:
                     - systemd
@@ -6341,12 +6662,12 @@ spec:
                     type: string
                   preferredAddressTypes:
                     default:
-                    - Hostname
                     - InternalIP
                     - ExternalIP
+                    - Hostname
                     description: |-
                       Ordered list of the preferred NodeAddressTypes to use for kubelet connections.
-                      Default to Hostname, InternalIP, ExternalIP.
+                      Default to InternalIP, ExternalIP, Hostname.
                     items:
                       enum:
                       - Hostname
@@ -6357,6 +6678,7 @@ spec:
                       type: string
                     minItems: 1
                     type: array
+                    x-kubernetes-list-type: set
                 type: object
               network:
                 default:
@@ -6557,7 +6879,7 @@ spec:
                           Claims lists the names of resources, defined in spec.resourceClaims,
                           that are used by this container.
 
-                          This is an alpha field and requires enabling the
+                          This field depends on the
                           DynamicResourceAllocation feature gate.
 
                           This field is immutable. It can only be set for containers.
@@ -6844,7 +7166,7 @@ spec:
                               agent:
                                 default:
                                   image: registry.k8s.io/kas-network-proxy/proxy-agent
-                                  version: v0.28.6
+                                  mode: DaemonSet
                                 properties:
                                   extraArgs:
                                     description: |-
@@ -6855,10 +7177,31 @@ spec:
                                     items:
                                       type: string
                                     type: array
+                                  hostNetwork:
+                                    default: false
+                                    description: |-
+                                      HostNetwork enables the konnectivity agent to use the Host network namespace.
+                                      By enabling this mode, the Agent doesn't need to wait for the CNI initialisation,
+                                      enabling a sort of out-of-band access to nodes for troubleshooting scenarios,
+                                      or when the agent needs direct access to the host network.
+                                    type: boolean
                                   image:
                                     default: registry.k8s.io/kas-network-proxy/proxy-agent
                                     description: AgentImage defines the container image for Konnectivity's agent.
                                     type: string
+                                  mode:
+                                    default: DaemonSet
+                                    description: 'Mode allows specifying the Agent deployment mode: Deployment, or DaemonSet (default).'
+                                    enum:
+                                    - DaemonSet
+                                    - Deployment
+                                    type: string
+                                  replicas:
+                                    description: |-
+                                      Replicas defines the number of replicas when Mode is Deployment.
+                                      Must be 0 if Mode is DaemonSet.
+                                    format: int32
+                                    type: integer
                                   tolerations:
                                     default:
                                     - key: CriticalAddonsOnly
@@ -6904,15 +7247,20 @@ spec:
                                       type: object
                                     type: array
                                   version:
-                                    default: v0.28.6
-                                    description: Version for Konnectivity agent.
+                                    description: |-
+                                      Version for Konnectivity agent.
+                                      If left empty, Kamaji will automatically inflect the version from the deployed Tenant Control Plane.
+
+                                      WARNING: for last cut-off releases, the container image could be not available.
                                     type: string
                                 type: object
+                                x-kubernetes-validations:
+                                - message: replicas must be 0 when mode is DaemonSet, and greater than 0 when mode is Deployment
+                                  rule: '!(self.mode == ''DaemonSet'' && has(self.replicas) && self.replicas != 0) && !(self.mode == ''Deployment'' && self.replicas == 0)'
                               server:
                                 default:
                                   image: registry.k8s.io/kas-network-proxy/proxy-server
                                   port: 8132
-                                  version: v0.28.6
                                 properties:
                                   extraArgs:
                                     description: |-
@@ -6939,7 +7287,7 @@ spec:
                                           Claims lists the names of resources, defined in spec.resourceClaims,
                                           that are used by this container.
 
-                                          This is an alpha field and requires enabling the
+                                          This field depends on the
                                           DynamicResourceAllocation feature gate.
 
                                           This field is immutable. It can only be set for containers.
@@ -6991,8 +7339,11 @@ spec:
                                         type: object
                                     type: object
                                   version:
-                                    default: v0.28.6
-                                    description: Container image version of the Konnectivity server.
+                                    description: |-
+                                      Container image version of the Konnectivity server.
+                                      If left empty, Kamaji will automatically inflect the version from the deployed Tenant Control Plane.
+
+                                      WARNING: for last cut-off releases, the container image could be not available.
                                     type: string
                                 required:
                                 - port
@@ -7145,7 +7496,7 @@ spec:
                                   Claims lists the names of resources, defined in spec.resourceClaims,
                                   that are used by this container.
 
-                                  This is an alpha field and requires enabling the
+                                  This field depends on the
                                   DynamicResourceAllocation feature gate.
 
                                   This field is immutable. It can only be set for containers.
@@ -7280,7 +7631,7 @@ spec:
                                   Claims lists the names of resources, defined in spec.resourceClaims,
                                   that are used by this container.
 
-                                  This is an alpha field and requires enabling the
+                                  This field depends on the
                                   DynamicResourceAllocation feature gate.
 
                                   This field is immutable. It can only be set for containers.
@@ -7340,6 +7691,16 @@ spec:
                       dataStoreSchema:
                         description: DataStoreSchema allows to specify the name of the database (for relational DataStores) or the key prefix (for etcd)
                         type: string
+                      dataStoreUsername:
+                        description: |-
+                          DataStoreUsername allows to specify the username of the database (for relational DataStores). This
+                          value is optional and immutable. Note that Kamaji currently doesn't ensure that DataStoreUsername values are unique. It's up
+                          to the user to avoid clashes between different TenantControlPlanes. If not set upon creation, Kamaji will default the
+                          DataStoreUsername by concatenating the namespace and name of the TenantControlPlane.
+                        type: string
+                        x-kubernetes-validations:
+                        - message: changing the dataStoreUsername is not supported
+                          rule: self == oldSelf
                       deployment:
                         description: Configure how the TenantControlPlane Deployment object should be configured.
                         properties:
@@ -7623,7 +7984,6 @@ spec:
                                                 pod labels will be ignored. The default value is empty.
                                                 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                 Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                               items:
                                                 type: string
                                               type: array
@@ -7638,7 +7998,6 @@ spec:
                                                 pod labels will be ignored. The default value is empty.
                                                 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                               items:
                                                 type: string
                                               type: array
@@ -7799,7 +8158,6 @@ spec:
                                             pod labels will be ignored. The default value is empty.
                                             The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                             Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                           items:
                                             type: string
                                           type: array
@@ -7814,7 +8172,6 @@ spec:
                                             pod labels will be ignored. The default value is empty.
                                             The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                             Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                           items:
                                             type: string
                                           type: array
@@ -7903,8 +8260,8 @@ spec:
                                       most preferred is the one with the greatest sum of weights, i.e.
                                       for each node that meets all of the scheduling requirements (resource
                                       request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                      compute a sum by iterating through the elements of this field and adding
-                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                      compute a sum by iterating through the elements of this field and subtracting
+                                      "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                       node(s) with the highest sum are the most preferred.
                                     items:
                                       description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
@@ -7968,7 +8325,6 @@ spec:
                                                 pod labels will be ignored. The default value is empty.
                                                 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                 Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                               items:
                                                 type: string
                                               type: array
@@ -7983,7 +8339,6 @@ spec:
                                                 pod labels will be ignored. The default value is empty.
                                                 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                               items:
                                                 type: string
                                               type: array
@@ -8144,7 +8499,6 @@ spec:
                                             pod labels will be ignored. The default value is empty.
                                             The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                             Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                           items:
                                             type: string
                                           type: array
@@ -8159,7 +8513,6 @@ spec:
                                             pod labels will be ignored. The default value is empty.
                                             The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                             Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                           items:
                                             type: string
                                           type: array
@@ -8307,7 +8660,9 @@ spec:
                                     description: EnvVar represents an environment variable present in a Container.
                                     properties:
                                       name:
-                                        description: Name of the environment variable. Must be a C_IDENTIFIER.
+                                        description: |-
+                                          Name of the environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       value:
                                         description: |-
@@ -8361,6 +8716,42 @@ spec:
                                             - fieldPath
                                             type: object
                                             x-kubernetes-map-type: atomic
+                                          fileKeyRef:
+                                            description: |-
+                                              FileKeyRef selects a key of the env file.
+                                              Requires the EnvFiles feature gate to be enabled.
+                                            properties:
+                                              key:
+                                                description: |-
+                                                  The key within the env file. An invalid key will prevent the pod from starting.
+                                                  The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                  During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                type: string
+                                              optional:
+                                                default: false
+                                                description: |-
+                                                  Specify whether the file or its key must be defined. If the file or key
+                                                  does not exist, then the env var is not published.
+                                                  If optional is set to true and the specified key does not exist,
+                                                  the environment variable will not be set in the Pod's containers.
+
+                                                  If optional is set to false and the specified key does not exist,
+                                                  an error will be returned during Pod creation.
+                                                type: boolean
+                                              path:
+                                                description: |-
+                                                  The path within the volume from which to select the file.
+                                                  Must be relative and may not contain the '..' path or start with '..'.
+                                                type: string
+                                              volumeName:
+                                                description: The name of the volume mount containing the env file.
+                                                type: string
+                                            required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                            type: object
+                                            x-kubernetes-map-type: atomic
                                           resourceFieldRef:
                                             description: |-
                                               Selects a resource of the container: only resources limits and requests
@@ -8416,13 +8807,13 @@ spec:
                                 envFrom:
                                   description: |-
                                     List of sources to populate environment variables in the container.
-                                    The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                    will be reported as an event when the container is starting. When a key exists in multiple
+                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                    When a key exists in multiple
                                     sources, the value associated with the last source will take precedence.
                                     Values defined by an Env with a duplicate key will take precedence.
                                     Cannot be updated.
                                   items:
-                                    description: EnvFromSource represents the source of a set of ConfigMaps
+                                    description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
                                     properties:
                                       configMapRef:
                                         description: The ConfigMap to select from
@@ -8442,7 +8833,9 @@ spec:
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       prefix:
-                                        description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+                                        description: |-
+                                          Optional text to prepend to the name of each environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       secretRef:
                                         description: The Secret to select from
@@ -8691,6 +9084,12 @@ spec:
                                           - port
                                           type: object
                                       type: object
+                                    stopSignal:
+                                      description: |-
+                                        StopSignal defines which signal will be sent to a container when it is being stopped.
+                                        If not specified, the default is defined by the container runtime in use.
+                                        StopSignal can only be set for Pods with a non-empty .spec.os.name
+                                      type: string
                                   type: object
                                 livenessProbe:
                                   description: |-
@@ -9081,7 +9480,7 @@ spec:
                                         Claims lists the names of resources, defined in spec.resourceClaims,
                                         that are used by this container.
 
-                                        This is an alpha field and requires enabling the
+                                        This field depends on the
                                         DynamicResourceAllocation feature gate.
 
                                         This field is immutable. It can only be set for containers.
@@ -9135,10 +9534,10 @@ spec:
                                 restartPolicy:
                                   description: |-
                                     RestartPolicy defines the restart behavior of individual containers in a pod.
-                                    This field may only be set for init containers, and the only allowed value is "Always".
-                                    For non-init containers or when this field is not specified,
+                                    This overrides the pod-level restart policy. When this field is not specified,
                                     the restart behavior is defined by the Pod's restart policy and the container type.
-                                    Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                    Additionally, setting the RestartPolicy as "Always" for the init container will
+                                    have the following effect:
                                     this init container will be continually restarted on
                                     exit until all regular containers have terminated. Once all regular
                                     containers have completed, all init containers with restartPolicy "Always"
@@ -9150,6 +9549,57 @@ spec:
                                     init container is started, or after any startupProbe has successfully
                                     completed.
                                   type: string
+                                restartPolicyRules:
+                                  description: |-
+                                    Represents a list of rules to be checked to determine if the
+                                    container should be restarted on exit. The rules are evaluated in
+                                    order. Once a rule matches a container exit condition, the remaining
+                                    rules are ignored. If no rule matches the container exit condition,
+                                    the Container-level restart policy determines the whether the container
+                                    is restarted or not. Constraints on the rules:
+                                    - At most 20 rules are allowed.
+                                    - Rules can have the same action.
+                                    - Identical rules are not forbidden in validations.
+                                    When rules are specified, container MUST set RestartPolicy explicitly
+                                    even it if matches the Pod's RestartPolicy.
+                                  items:
+                                    description: ContainerRestartRule describes how a container exit is handled.
+                                    properties:
+                                      action:
+                                        description: |-
+                                          Specifies the action taken on a container exit if the requirements
+                                          are satisfied. The only possible value is "Restart" to restart the
+                                          container.
+                                        type: string
+                                      exitCodes:
+                                        description: Represents the exit codes to check on container exits.
+                                        properties:
+                                          operator:
+                                            description: |-
+                                              Represents the relationship between the container exit code(s) and the
+                                              specified values. Possible values are:
+                                              - In: the requirement is satisfied if the container exit code is in the
+                                                set of specified values.
+                                              - NotIn: the requirement is satisfied if the container exit code is
+                                                not in the set of specified values.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              Specifies the set of values to check for container exit codes.
+                                              At most 255 elements are allowed.
+                                            items:
+                                              format: int32
+                                              type: integer
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        required:
+                                        - operator
+                                        type: object
+                                    required:
+                                    - action
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
                                 securityContext:
                                   description: |-
                                     SecurityContext defines the security options the container should be run with.
@@ -9671,7 +10121,9 @@ spec:
                                     description: EnvVar represents an environment variable present in a Container.
                                     properties:
                                       name:
-                                        description: Name of the environment variable. Must be a C_IDENTIFIER.
+                                        description: |-
+                                          Name of the environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       value:
                                         description: |-
@@ -9725,6 +10177,42 @@ spec:
                                             - fieldPath
                                             type: object
                                             x-kubernetes-map-type: atomic
+                                          fileKeyRef:
+                                            description: |-
+                                              FileKeyRef selects a key of the env file.
+                                              Requires the EnvFiles feature gate to be enabled.
+                                            properties:
+                                              key:
+                                                description: |-
+                                                  The key within the env file. An invalid key will prevent the pod from starting.
+                                                  The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                  During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                type: string
+                                              optional:
+                                                default: false
+                                                description: |-
+                                                  Specify whether the file or its key must be defined. If the file or key
+                                                  does not exist, then the env var is not published.
+                                                  If optional is set to true and the specified key does not exist,
+                                                  the environment variable will not be set in the Pod's containers.
+
+                                                  If optional is set to false and the specified key does not exist,
+                                                  an error will be returned during Pod creation.
+                                                type: boolean
+                                              path:
+                                                description: |-
+                                                  The path within the volume from which to select the file.
+                                                  Must be relative and may not contain the '..' path or start with '..'.
+                                                type: string
+                                              volumeName:
+                                                description: The name of the volume mount containing the env file.
+                                                type: string
+                                            required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                            type: object
+                                            x-kubernetes-map-type: atomic
                                           resourceFieldRef:
                                             description: |-
                                               Selects a resource of the container: only resources limits and requests
@@ -9780,13 +10268,13 @@ spec:
                                 envFrom:
                                   description: |-
                                     List of sources to populate environment variables in the container.
-                                    The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                    will be reported as an event when the container is starting. When a key exists in multiple
+                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                    When a key exists in multiple
                                     sources, the value associated with the last source will take precedence.
                                     Values defined by an Env with a duplicate key will take precedence.
                                     Cannot be updated.
                                   items:
-                                    description: EnvFromSource represents the source of a set of ConfigMaps
+                                    description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
                                     properties:
                                       configMapRef:
                                         description: The ConfigMap to select from
@@ -9806,7 +10294,9 @@ spec:
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       prefix:
-                                        description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+                                        description: |-
+                                          Optional text to prepend to the name of each environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       secretRef:
                                         description: The Secret to select from
@@ -10055,6 +10545,12 @@ spec:
                                           - port
                                           type: object
                                       type: object
+                                    stopSignal:
+                                      description: |-
+                                        StopSignal defines which signal will be sent to a container when it is being stopped.
+                                        If not specified, the default is defined by the container runtime in use.
+                                        StopSignal can only be set for Pods with a non-empty .spec.os.name
+                                      type: string
                                   type: object
                                 livenessProbe:
                                   description: |-
@@ -10445,7 +10941,7 @@ spec:
                                         Claims lists the names of resources, defined in spec.resourceClaims,
                                         that are used by this container.
 
-                                        This is an alpha field and requires enabling the
+                                        This field depends on the
                                         DynamicResourceAllocation feature gate.
 
                                         This field is immutable. It can only be set for containers.
@@ -10499,10 +10995,10 @@ spec:
                                 restartPolicy:
                                   description: |-
                                     RestartPolicy defines the restart behavior of individual containers in a pod.
-                                    This field may only be set for init containers, and the only allowed value is "Always".
-                                    For non-init containers or when this field is not specified,
+                                    This overrides the pod-level restart policy. When this field is not specified,
                                     the restart behavior is defined by the Pod's restart policy and the container type.
-                                    Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                    Additionally, setting the RestartPolicy as "Always" for the init container will
+                                    have the following effect:
                                     this init container will be continually restarted on
                                     exit until all regular containers have terminated. Once all regular
                                     containers have completed, all init containers with restartPolicy "Always"
@@ -10514,6 +11010,57 @@ spec:
                                     init container is started, or after any startupProbe has successfully
                                     completed.
                                   type: string
+                                restartPolicyRules:
+                                  description: |-
+                                    Represents a list of rules to be checked to determine if the
+                                    container should be restarted on exit. The rules are evaluated in
+                                    order. Once a rule matches a container exit condition, the remaining
+                                    rules are ignored. If no rule matches the container exit condition,
+                                    the Container-level restart policy determines the whether the container
+                                    is restarted or not. Constraints on the rules:
+                                    - At most 20 rules are allowed.
+                                    - Rules can have the same action.
+                                    - Identical rules are not forbidden in validations.
+                                    When rules are specified, container MUST set RestartPolicy explicitly
+                                    even it if matches the Pod's RestartPolicy.
+                                  items:
+                                    description: ContainerRestartRule describes how a container exit is handled.
+                                    properties:
+                                      action:
+                                        description: |-
+                                          Specifies the action taken on a container exit if the requirements
+                                          are satisfied. The only possible value is "Restart" to restart the
+                                          container.
+                                        type: string
+                                      exitCodes:
+                                        description: Represents the exit codes to check on container exits.
+                                        properties:
+                                          operator:
+                                            description: |-
+                                              Represents the relationship between the container exit code(s) and the
+                                              specified values. Possible values are:
+                                              - In: the requirement is satisfied if the container exit code is in the
+                                                set of specified values.
+                                              - NotIn: the requirement is satisfied if the container exit code is
+                                                not in the set of specified values.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              Specifies the set of values to check for container exit codes.
+                                              At most 255 elements are allowed.
+                                            items:
+                                              format: int32
+                                              type: integer
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        required:
+                                        - operator
+                                        type: object
+                                    required:
+                                    - action
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
                                 securityContext:
                                   description: |-
                                     SecurityContext defines the security options the container should be run with.
@@ -11635,15 +12182,13 @@ spec:
                                                 volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                                 If specified, the CSI driver will create or update the volume with the attributes defined
                                                 in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                                it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                                will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                                If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                                will be set by the persistentvolume controller if it exists.
+                                                it can be changed after the claim is created. An empty string or nil value indicates that no
+                                                VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                                this field can be reset to its previous value (including nil) to cancel the modification.
                                                 If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                                 set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                                 exists.
                                                 More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                                (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                               type: string
                                             volumeMode:
                                               description: |-
@@ -11817,12 +12362,9 @@ spec:
                                   description: |-
                                     glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                     Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md
                                   properties:
                                     endpoints:
-                                      description: |-
-                                        endpoints is the endpoint name that details Glusterfs topology.
-                                        More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                      description: endpoints is the endpoint name that details Glusterfs topology.
                                       type: string
                                     path:
                                       description: |-
@@ -11876,7 +12418,7 @@ spec:
                                     The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
                                     The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
                                     The volume will be mounted read-only (ro) and non-executable files (noexec).
-                                    Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
+                                    Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
                                     The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
                                   properties:
                                     pullPolicy:
@@ -11901,7 +12443,7 @@ spec:
                                   description: |-
                                     iscsi represents an ISCSI Disk resource that is attached to a
                                     kubelet's host machine and then exposed to the pod.
-                                    More info: https://examples.k8s.io/volumes/iscsi/README.md
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                                   properties:
                                     chapAuthDiscovery:
                                       description: chapAuthDiscovery defines whether support iSCSI Discovery CHAP authentication
@@ -12291,6 +12833,110 @@ spec:
                                                 type: array
                                                 x-kubernetes-list-type: atomic
                                             type: object
+                                          podCertificate:
+                                            description: |-
+                                              Projects an auto-rotating credential bundle (private key and certificate
+                                              chain) that the pod can use either as a TLS client or server.
+
+                                              Kubelet generates a private key and uses it to send a
+                                              PodCertificateRequest to the named signer.  Once the signer approves the
+                                              request and issues a certificate chain, Kubelet writes the key and
+                                              certificate chain to the pod filesystem.  The pod does not start until
+                                              certificates have been issued for each podCertificate projected volume
+                                              source in its spec.
+
+                                              Kubelet will begin trying to rotate the certificate at the time indicated
+                                              by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                              timestamp.
+
+                                              Kubelet can write a single file, indicated by the credentialBundlePath
+                                              field, or separate files, indicated by the keyPath and
+                                              certificateChainPath fields.
+
+                                              The credential bundle is a single file in PEM format.  The first PEM
+                                              entry is the private key (in PKCS#8 format), and the remaining PEM
+                                              entries are the certificate chain issued by the signer (typically,
+                                              signers will return their certificate chain in leaf-to-root order).
+
+                                              Prefer using the credential bundle format, since your application code
+                                              can read it atomically.  If you use keyPath and certificateChainPath,
+                                              your application must make two separate file reads. If these coincide
+                                              with a certificate rotation, it is possible that the private key and leaf
+                                              certificate you read may not correspond to each other.  Your application
+                                              will need to check for this condition, and re-read until they are
+                                              consistent.
+
+                                              The named signer controls chooses the format of the certificate it
+                                              issues; consult the signer implementation's documentation to learn how to
+                                              use the certificates it issues.
+                                            properties:
+                                              certificateChainPath:
+                                                description: |-
+                                                  Write the certificate chain at this path in the projected volume.
+
+                                                  Most applications should use credentialBundlePath.  When using keyPath
+                                                  and certificateChainPath, your application needs to check that the key
+                                                  and leaf certificate are consistent, because it is possible to read the
+                                                  files mid-rotation.
+                                                type: string
+                                              credentialBundlePath:
+                                                description: |-
+                                                  Write the credential bundle at this path in the projected volume.
+
+                                                  The credential bundle is a single file that contains multiple PEM blocks.
+                                                  The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                                  key.
+
+                                                  The remaining blocks are CERTIFICATE blocks, containing the issued
+                                                  certificate chain from the signer (leaf and any intermediates).
+
+                                                  Using credentialBundlePath lets your Pod's application code make a single
+                                                  atomic read that retrieves a consistent key and certificate chain.  If you
+                                                  project them to separate files, your application code will need to
+                                                  additionally check that the leaf certificate was issued to the key.
+                                                type: string
+                                              keyPath:
+                                                description: |-
+                                                  Write the key at this path in the projected volume.
+
+                                                  Most applications should use credentialBundlePath.  When using keyPath
+                                                  and certificateChainPath, your application needs to check that the key
+                                                  and leaf certificate are consistent, because it is possible to read the
+                                                  files mid-rotation.
+                                                type: string
+                                              keyType:
+                                                description: |-
+                                                  The type of keypair Kubelet will generate for the pod.
+
+                                                  Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                                  "ECDSAP521", and "ED25519".
+                                                type: string
+                                              maxExpirationSeconds:
+                                                description: |-
+                                                  maxExpirationSeconds is the maximum lifetime permitted for the
+                                                  certificate.
+
+                                                  Kubelet copies this value verbatim into the PodCertificateRequests it
+                                                  generates for this projection.
+
+                                                  If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                                  will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                                  value is 7862400 (91 days).
+
+                                                  The signer implementation is then free to issue a certificate with any
+                                                  lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                                  seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                                  `kubernetes.io` signers will never issue certificates with a lifetime
+                                                  longer than 24 hours.
+                                                format: int32
+                                                type: integer
+                                              signerName:
+                                                description: Kubelet's generated CSRs will be addressed to this signer.
+                                                type: string
+                                            required:
+                                            - keyType
+                                            - signerName
+                                            type: object
                                           secret:
                                             description: secret information about the secret data to project
                                             properties:
@@ -12420,7 +13066,6 @@ spec:
                                   description: |-
                                     rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                     Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                                    More info: https://examples.k8s.io/volumes/rbd/README.md
                                   properties:
                                     fsType:
                                       description: |-
@@ -12919,7 +13564,6 @@ spec:
                                     - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
 
                                     If this value is nil, the behavior is equivalent to the Honor policy.
-                                    This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                                   type: string
                                 nodeTaintsPolicy:
                                   description: |-
@@ -12930,7 +13574,6 @@ spec:
                                     - Ignore: node taints are ignored. All nodes are included.
 
                                     If this value is nil, the behavior is equivalent to the Ignore policy.
-                                    This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                                   type: string
                                 topologyKey:
                                   description: |-
@@ -12990,7 +13633,7 @@ spec:
                                   Claims lists the names of resources, defined in spec.resourceClaims,
                                   that are used by this container.
 
-                                  This is an alpha field and requires enabling the
+                                  This field depends on the
                                   DynamicResourceAllocation feature gate.
 
                                   This field is immutable. It can only be set for containers.
@@ -13046,14 +13689,14 @@ spec:
                         default:
                           cgroupfs: systemd
                           preferredAddressTypes:
-                          - Hostname
                           - InternalIP
                           - ExternalIP
+                          - Hostname
                         description: Configure the Kubelet options, such as the preferred address types, or the expected cgroupfs.
                         properties:
                           cgroupfs:
                             description: |-
-                              CGroupFS defines the  cgroup driver for Kubelet
+                              CGroupFS defines the cgroup driver for Kubelet
                               https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver/
                             enum:
                             - systemd
@@ -13061,12 +13704,12 @@ spec:
                             type: string
                           preferredAddressTypes:
                             default:
-                            - Hostname
                             - InternalIP
                             - ExternalIP
+                            - Hostname
                             description: |-
                               Ordered list of the preferred NodeAddressTypes to use for kubelet connections.
-                              Default to Hostname, InternalIP, ExternalIP.
+                              Default to InternalIP, ExternalIP, Hostname.
                             items:
                               enum:
                               - Hostname
@@ -13077,6 +13720,7 @@ spec:
                               type: string
                             minItems: 1
                             type: array
+                            x-kubernetes-list-type: set
                         type: object
                       network:
                         default:
@@ -13270,7 +13914,7 @@ spec:
                                   Claims lists the names of resources, defined in spec.resourceClaims,
                                   that are used by this container.
 
-                                  This is an alpha field and requires enabling the
+                                  This field depends on the
                                   DynamicResourceAllocation feature gate.
 
                                   This field is immutable. It can only be set for containers.
@@ -13516,6 +14160,8 @@ rules:
   - metal3clusters
   verbs:
   - get
+  - list
+  - watch
 - apiGroups:
   - kamaji.clastix.io
   resources:
@@ -13626,14 +14272,14 @@ spec:
         - --dynamic-infrastructure-clusters=${CACPPK_INFRASTRUCTURE_CLUSTERS:= }
         command:
         - /manager
-        image: docker.io/clastix/cluster-api-control-plane-provider-kamaji:v0.15.0
+        image: docker.io/clastix/cluster-api-control-plane-provider-kamaji:v0.16.0
         livenessProbe:
           httpGet:
             path: /healthz
             port: 8081
           initialDelaySeconds: 15
           periodSeconds: 20
-        name: manager
+        name: controller
         readinessProbe:
           httpGet:
             path: /readyz
diff --git a/packages/system/capi-providers-cpprovider/files/metadata.yaml b/packages/system/capi-providers-cpprovider/files/metadata.yaml
index b282734a..d22c9ab0 100644
--- a/packages/system/capi-providers-cpprovider/files/metadata.yaml
+++ b/packages/system/capi-providers-cpprovider/files/metadata.yaml
@@ -5,6 +5,9 @@
 # update this file only when a new major or minor version is released
 apiVersion: clusterctl.cluster.x-k8s.io/v1alpha3
 releaseSeries:
+  - major: 0
+    minor: 16
+    contract: v1beta1
   - major: 0
     minor: 15
     contract: v1beta1
diff --git a/packages/system/capi-providers-cpprovider/templates/configmaps.yaml b/packages/system/capi-providers-cpprovider/templates/configmaps.yaml
index d69ab12b..736c06a5 100644
--- a/packages/system/capi-providers-cpprovider/templates/configmaps.yaml
+++ b/packages/system/capi-providers-cpprovider/templates/configmaps.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: v0.15.1-cp
+  name: v0.16.0-cp
   labels:
     cp-components: cozy
   annotations:
diff --git a/packages/system/capi-providers-cpprovider/templates/providers.yaml b/packages/system/capi-providers-cpprovider/templates/providers.yaml
index b173be14..125a82c7 100644
--- a/packages/system/capi-providers-cpprovider/templates/providers.yaml
+++ b/packages/system/capi-providers-cpprovider/templates/providers.yaml
@@ -4,7 +4,7 @@ metadata:
   name: kamaji
 spec:
   # https://github.com/clastix/cluster-api-control-plane-provider-kamaji
-  version: v0.15.1-cp
+  version: v0.16.0-cp
   fetchConfig:
     selector:
       matchLabels:

From 5c5a170589643238e5a19da1a03217ee82e9087c Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 19 Feb 2026 23:27:05 +0300
Subject: [PATCH 132/666] chore(kamaji): update Go builder image to 1.26

Go 1.26 was released on 2026-02-10 and is fully compatible with
Kamaji edge-26.2.4 (which requires go 1.25.0 in go.mod).
Verified by local build.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/kamaji/images/kamaji/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/system/kamaji/images/kamaji/Dockerfile b/packages/system/kamaji/images/kamaji/Dockerfile
index 75d37118..ddb49636 100644
--- a/packages/system/kamaji/images/kamaji/Dockerfile
+++ b/packages/system/kamaji/images/kamaji/Dockerfile
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM golang:1.25 AS builder
+FROM golang:1.26 AS builder
 
 ARG VERSION=edge-26.2.4
 ARG TARGETOS

From e39ba9fb8c59f79a832559150c4ff5b52aaef6dc Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 19 Feb 2026 23:27:11 +0300
Subject: [PATCH 133/666] fix(kubernetes): bump v1.35 patch version to v1.35.1

v1.35.1 was released on 2026-02-10.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/apps/kubernetes/files/versions.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/apps/kubernetes/files/versions.yaml b/packages/apps/kubernetes/files/versions.yaml
index f0c190f3..58942b97 100644
--- a/packages/apps/kubernetes/files/versions.yaml
+++ b/packages/apps/kubernetes/files/versions.yaml
@@ -1,4 +1,4 @@
-"v1.35": "v1.35.0"
+"v1.35": "v1.35.1"
 "v1.34": "v1.34.4"
 "v1.33": "v1.33.8"
 "v1.32": "v1.32.12"

From 3d89d3732c191892366ef6e6e0b23e60af8652f9 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 19 Feb 2026 23:46:50 +0300
Subject: [PATCH 134/666] fix(kubernetes): pin konnectivity version for K8s
 v1.35

Kamaji auto-derives the konnectivity proxy image tag as v0.{minor}.0
from the Kubernetes version. For K8s v1.35, this produces v0.35.0,
but the kas-network-proxy/proxy-server:v0.35.0 image does not exist
in registry.k8s.io yet, causing ImagePullBackOff on new TCP pods.

Add konnectivity-versions.yaml mapping to explicitly override the
konnectivity version when the auto-derived tag is unavailable.
For v1.35, pin to v0.34.0 (latest available).

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/apps/kubernetes/files/konnectivity-versions.yaml | 4 ++++
 packages/apps/kubernetes/templates/_versions.tpl          | 7 +++++++
 packages/apps/kubernetes/templates/cluster.yaml           | 8 ++++++++
 3 files changed, 19 insertions(+)
 create mode 100644 packages/apps/kubernetes/files/konnectivity-versions.yaml

diff --git a/packages/apps/kubernetes/files/konnectivity-versions.yaml b/packages/apps/kubernetes/files/konnectivity-versions.yaml
new file mode 100644
index 00000000..09ef4fa7
--- /dev/null
+++ b/packages/apps/kubernetes/files/konnectivity-versions.yaml
@@ -0,0 +1,4 @@
+# Konnectivity proxy version overrides per Kubernetes minor version.
+# When empty or absent, Kamaji auto-derives v0.{minor}.0 from the Kubernetes version.
+# Add entries here only when the auto-derived image tag does not exist in the registry.
+"v1.35": "v0.34.0"
diff --git a/packages/apps/kubernetes/templates/_versions.tpl b/packages/apps/kubernetes/templates/_versions.tpl
index fcd4cee1..403caff1 100644
--- a/packages/apps/kubernetes/templates/_versions.tpl
+++ b/packages/apps/kubernetes/templates/_versions.tpl
@@ -5,3 +5,10 @@
 {{- end }}
 {{- index $versionMap .Values.version }}
 {{- end }}
+
+{{- define "kubernetes.konnectivityVersion" }}
+{{- $konnVersionMap := .Files.Get "files/konnectivity-versions.yaml" | fromYaml }}
+{{- if hasKey $konnVersionMap .Values.version }}
+{{- index $konnVersionMap .Values.version }}
+{{- end }}
+{{- end }}
diff --git a/packages/apps/kubernetes/templates/cluster.yaml b/packages/apps/kubernetes/templates/cluster.yaml
index 3d9c854a..b97af93e 100644
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -126,8 +126,16 @@ spec:
   dataStoreName: "{{ $etcd }}"
   addons:
     konnectivity:
+      {{- $konnVersion := include "kubernetes.konnectivityVersion" $ | trim }}
+      {{- if $konnVersion }}
+      agent:
+        version: {{ $konnVersion }}
+      {{- end }}
       server:
         port: 8132
+        {{- if $konnVersion }}
+        version: {{ $konnVersion }}
+        {{- end }}
         resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.controlPlane.konnectivity.server.resourcesPreset .Values.controlPlane.konnectivity.server.resources $) | nindent 10 }}
   kubelet:
     cgroupfs: systemd

From 00ab6e792c3e5ff5e0d9054a2d9860bd73fa5c3e Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Fri, 20 Feb 2026 01:30:10 +0300
Subject: [PATCH 135/666] test(e2e): increase worker node join timeout to 5
 minutes

When running kubernetes-latest and kubernetes-previous E2E tests
simultaneously, worker VMs compete for resources in the sandbox
environment. 3 minutes was insufficient for nodes to boot and
join the tenant cluster under load. Increase to 5 minutes.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/run-kubernetes.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index 511fcc17..b1a4cfcb 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -91,8 +91,8 @@ EOF
   # Verify the Kubernetes version matches what we expect (retry for up to 20 seconds)
   timeout 20 sh -ec 'until kubectl --kubeconfig tenantkubeconfig-'"${test_name}"' version 2>/dev/null | grep -Fq "Server Version: ${k8s_version}"; do sleep 5; done'
 
-  # Wait for the nodes to be ready (timeout after 2 minutes)
-  timeout 3m bash -c '
+  # Wait for the nodes to be ready (timeout after 5 minutes)
+  timeout 5m bash -c '
     until [ "$(kubectl --kubeconfig tenantkubeconfig-'"${test_name}"' get nodes -o jsonpath="{.items[*].metadata.name}" | wc -w)" -eq 2 ]; do
       sleep 2
     done

From 8f1e52690d2087df3c774ac39f8861f865c19e04 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Fri, 20 Feb 2026 03:23:50 +0300
Subject: [PATCH 136/666] test(e2e): fix kubernetes-previous retry failures

- Kill stale port-forward processes before starting a new one;
  on retries, the previous attempt's port-forward still holds the
  port, causing all kubectl commands to get "connection refused"
- Use -ge 2 instead of -eq 2 for node count check; MachineHealthCheck
  may create a 3rd VM, leading to 3 nodes joining the tenant cluster
  which would never satisfy the exact equality check
- Increase node join timeout from 5m to 8m; QEMU VMs with v1.34 need
  more time to boot and join when running after kubernetes-latest

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/run-kubernetes.sh | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index b1a4cfcb..f195f3ea 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -86,14 +86,18 @@ EOF
   yq -i ".clusters[0].cluster.server = \"https://localhost:${port}\"" "tenantkubeconfig-${test_name}"
 
 
-  # Set up port forwarding to the Kubernetes API server for a 200 second timeout
+  # Kill any stale port-forward on this port from a previous retry
+  pkill -f "port-forward.*${port}:" 2>/dev/null || true
+  sleep 1
+
+  # Set up port forwarding to the Kubernetes API server
   bash -c 'timeout 500s kubectl port-forward service/kubernetes-'"${test_name}"' -n tenant-test '"${port}"':6443 > /dev/null 2>&1 &'
   # Verify the Kubernetes version matches what we expect (retry for up to 20 seconds)
   timeout 20 sh -ec 'until kubectl --kubeconfig tenantkubeconfig-'"${test_name}"' version 2>/dev/null | grep -Fq "Server Version: ${k8s_version}"; do sleep 5; done'
 
-  # Wait for the nodes to be ready (timeout after 5 minutes)
-  timeout 5m bash -c '
-    until [ "$(kubectl --kubeconfig tenantkubeconfig-'"${test_name}"' get nodes -o jsonpath="{.items[*].metadata.name}" | wc -w)" -eq 2 ]; do
+  # Wait for at least 2 nodes to join (timeout after 8 minutes)
+  timeout 8m bash -c '
+    until [ "$(kubectl --kubeconfig tenantkubeconfig-'"${test_name}"' get nodes -o jsonpath="{.items[*].metadata.name}" | wc -w)" -ge 2 ]; do
       sleep 2
     done
   '

From 4aa1f0332149d107ff22f85561dc5c1be72c806a Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Fri, 20 Feb 2026 10:43:48 +0500
Subject: [PATCH 137/666] feat(platform): Added parameters to override
 ClusterIssuer

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/apps/harbor/templates/ingress.yaml               | 7 ++++---
 packages/core/platform/templates/apps.yaml                | 3 ++-
 packages/core/platform/values.yaml                        | 3 ++-
 packages/extra/bootbox/templates/matchbox/ingress.yaml    | 7 ++++---
 packages/extra/seaweedfs/templates/seaweedfs.yaml         | 6 +++++-
 packages/system/bucket/templates/ingress.yaml             | 7 ++++---
 .../cert-manager-issuers/templates/cluster-issuers.yaml   | 6 +++---
 packages/system/dashboard/templates/ingress.yaml          | 8 ++++----
 packages/system/keycloak/templates/ingress.yaml           | 7 ++++---
 packages/system/monitoring/templates/alerta/alerta.yaml   | 7 ++++---
 packages/system/monitoring/templates/grafana/grafana.yaml | 7 ++++---
 11 files changed, 40 insertions(+), 28 deletions(-)

diff --git a/packages/apps/harbor/templates/ingress.yaml b/packages/apps/harbor/templates/ingress.yaml
index 28691654..cc65d081 100644
--- a/packages/apps/harbor/templates/ingress.yaml
+++ b/packages/apps/harbor/templates/ingress.yaml
@@ -1,7 +1,8 @@
 {{- $ingress := .Values._namespace.ingress }}
 {{- $host := .Values._namespace.host }}
 {{- $harborHost := .Values.host | default (printf "%s.%s" .Release.Name $host) }}
-{{- $issuerType := (index .Values._cluster "clusterissuer") | default "http01" }}
+{{- $solver := (index .Values._cluster "solver") | default "http01" }}
+{{- $clusterIssuer := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }}
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -13,10 +14,10 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-send-timeout: "900"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
     nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
-    {{- if ne $issuerType "cloudflare" }}
+    {{- if ne $solver "dns01" }}
     acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
     {{- end }}
-    cert-manager.io/cluster-issuer: letsencrypt-prod
+    cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
 spec:
   ingressClassName: {{ $ingress }}
   tls:
diff --git a/packages/core/platform/templates/apps.yaml b/packages/core/platform/templates/apps.yaml
index 8484fe4c..96415325 100644
--- a/packages/core/platform/templates/apps.yaml
+++ b/packages/core/platform/templates/apps.yaml
@@ -21,7 +21,8 @@ stringData:
     _cluster:
       root-host: {{ $rootHost | quote }}
       bundle-name: {{ .Values.bundles.system.variant | quote }}
-      clusterissuer: {{ .Values.publishing.certificates.issuerType | quote }}
+      solver: {{ .Values.publishing.certificates.solver | quote }}
+      issuer-name: {{ .Values.publishing.certificates.issuerName | quote }}
       oidc-enabled: {{ .Values.authentication.oidc.enabled | quote }}
       oidc-insecure-skip-verify: {{ .Values.authentication.oidc.insecureSkipVerify | quote }}
       extra-keycloak-redirect-uri-for-dashboard: {{ index .Values.authentication.oidc.keycloakExtraRedirectUri | quote }}
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index 5caab16d..dbf1f4e6 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -46,7 +46,8 @@ publishing:
   apiServerEndpoint: "" # example: "https://api.example.org"
   externalIPs: []
   certificates:
-    issuerType: http01 # "http01" or "cloudflare"
+    solver: http01      # "http01" or "dns01"
+    issuerName: letsencrypt-prod
 # Authentication configuration
 authentication:
   oidc:
diff --git a/packages/extra/bootbox/templates/matchbox/ingress.yaml b/packages/extra/bootbox/templates/matchbox/ingress.yaml
index fa62165b..3bbf70ed 100644
--- a/packages/extra/bootbox/templates/matchbox/ingress.yaml
+++ b/packages/extra/bootbox/templates/matchbox/ingress.yaml
@@ -1,4 +1,5 @@
-{{- $issuerType := (index .Values._cluster "clusterissuer") | default "http01" }}
+{{- $solver := (index .Values._cluster "solver") | default "http01" }}
+{{- $clusterIssuer := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }}
 {{- $ingress := .Values._namespace.ingress }}
 {{- $host := .Values._namespace.host }}
 apiVersion: networking.k8s.io/v1
@@ -8,10 +9,10 @@ metadata:
   labels:
     app: bootbox
   annotations:
-    {{- if ne $issuerType "cloudflare" }}
+    {{- if ne $solver "dns01" }}
     acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
     {{- end }}
-    cert-manager.io/cluster-issuer: letsencrypt-prod
+    cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
     {{- if .Values.whitelistHTTP }}
     nginx.ingress.kubernetes.io/whitelist-source-range: "{{ join "," (.Values.whitelist | default "0.0.0.0/32") }}"
     {{- end }}
diff --git a/packages/extra/seaweedfs/templates/seaweedfs.yaml b/packages/extra/seaweedfs/templates/seaweedfs.yaml
index b04318bb..3ebb57f6 100644
--- a/packages/extra/seaweedfs/templates/seaweedfs.yaml
+++ b/packages/extra/seaweedfs/templates/seaweedfs.yaml
@@ -36,6 +36,8 @@
 {{- if not (eq .Values.topology "Client") }}
 {{- $ingress := .Values._namespace.ingress }}
 {{- $host := .Values._namespace.host }}
+{{- $solver := (index .Values._cluster "solver") | default "http01" }}
+{{- $clusterIssuer := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -134,8 +136,10 @@ spec:
           annotations:
             nginx.ingress.kubernetes.io/proxy-body-size: "0"
             nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+            {{- if ne $solver "dns01" }}
             acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
-            cert-manager.io/cluster-issuer: letsencrypt-prod
+            {{- end }}
+            cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
           tls:
             - hosts:
               - {{ .Values.host | default (printf "s3.%s" $host) }}
diff --git a/packages/system/bucket/templates/ingress.yaml b/packages/system/bucket/templates/ingress.yaml
index f7b4eed4..735c94ec 100644
--- a/packages/system/bucket/templates/ingress.yaml
+++ b/packages/system/bucket/templates/ingress.yaml
@@ -1,6 +1,7 @@
 {{- $host := .Values._namespace.host }}
 {{- $ingress := .Values._namespace.ingress }}
-{{- $issuerType := (index .Values._cluster "clusterissuer") | default "http01" }}
+{{- $solver := (index .Values._cluster "solver") | default "http01" }}
+{{- $clusterIssuer := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }}
 
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -13,10 +14,10 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
     nginx.ingress.kubernetes.io/proxy-read-timeout: "99999"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "99999"
-    {{- if ne $issuerType "cloudflare" }}
+    {{- if ne $solver "dns01" }}
     acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
     {{- end }}
-    cert-manager.io/cluster-issuer: letsencrypt-prod
+    cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
 spec:
   ingressClassName: {{ $ingress }}
   tls:
diff --git a/packages/system/cert-manager-issuers/templates/cluster-issuers.yaml b/packages/system/cert-manager-issuers/templates/cluster-issuers.yaml
index e93f3f67..442f1fb3 100644
--- a/packages/system/cert-manager-issuers/templates/cluster-issuers.yaml
+++ b/packages/system/cert-manager-issuers/templates/cluster-issuers.yaml
@@ -1,4 +1,4 @@
-{{- $issuerType := (index .Values._cluster "clusterissuer") | default "http01" }}  
+{{- $solver := (index .Values._cluster "solver") | default "http01" }}
 
 apiVersion: cert-manager.io/v1 
 kind: ClusterIssuer  
@@ -10,7 +10,7 @@ spec:
       name: letsencrypt-prod  
     server: https://acme-v02.api.letsencrypt.org/directory  
     solvers:  
-    - {{- if eq $issuerType "cloudflare" }}  
+    - {{- if eq $solver "dns01" }}  
         dns01:  
           cloudflare:  
             apiTokenSecretRef:  
@@ -34,7 +34,7 @@ spec:
       name: letsencrypt-stage
     server: https://acme-staging-v02.api.letsencrypt.org/directory  
     solvers:  
-    - {{- if eq $issuerType "cloudflare" }}  
+    - {{- if eq $solver "dns01" }}  
         dns01:  
           cloudflare:  
             apiTokenSecretRef:  
diff --git a/packages/system/dashboard/templates/ingress.yaml b/packages/system/dashboard/templates/ingress.yaml
index b3079a72..62327514 100644
--- a/packages/system/dashboard/templates/ingress.yaml
+++ b/packages/system/dashboard/templates/ingress.yaml
@@ -1,4 +1,5 @@
-{{- $issuerType := (index .Values._cluster "clusterissuer") | default "http01" }}
+{{- $solver := (index .Values._cluster "solver") | default "http01" }}
+{{- $clusterIssuer := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }}
 {{- $host := index .Values._cluster "root-host" }}
 {{- $exposeServices := splitList "," ((index .Values._cluster "expose-services") | default "") }}
 {{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
@@ -8,9 +9,8 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    {{- if eq $issuerType "cloudflare" }}
-    {{- else }}
+    cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
+    {{- if ne $solver "dns01" }}
     acme.cert-manager.io/http01-ingress-class: {{ $exposeIngress }}
     {{- end }}
     nginx.ingress.kubernetes.io/rewrite-target: /
diff --git a/packages/system/keycloak/templates/ingress.yaml b/packages/system/keycloak/templates/ingress.yaml
index 0e0f56cb..72f236cd 100644
--- a/packages/system/keycloak/templates/ingress.yaml
+++ b/packages/system/keycloak/templates/ingress.yaml
@@ -1,5 +1,6 @@
 {{- $host := index .Values._cluster "root-host" }}
-{{- $issuerType := (index .Values._cluster "clusterissuer") | default "http01" }}
+{{- $solver := (index .Values._cluster "solver") | default "http01" }}
+{{- $clusterIssuer := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }}
 {{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
 
 apiVersion: networking.k8s.io/v1
@@ -8,10 +9,10 @@ metadata:
   name: keycloak-ingress
   {{- with .Values.ingress.annotations }}
   annotations:
-    {{- if ne $issuerType "cloudflare" }}
+    {{- if ne $solver "dns01" }}
     acme.cert-manager.io/http01-ingress-class: {{ $exposeIngress }}
     {{- end }}
-    cert-manager.io/cluster-issuer: letsencrypt-prod
+    cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
 spec:
diff --git a/packages/system/monitoring/templates/alerta/alerta.yaml b/packages/system/monitoring/templates/alerta/alerta.yaml
index d8baaa02..417b7bda 100644
--- a/packages/system/monitoring/templates/alerta/alerta.yaml
+++ b/packages/system/monitoring/templates/alerta/alerta.yaml
@@ -1,4 +1,5 @@
-{{- $issuerType := (index .Values._cluster "clusterissuer") | default "http01" }}
+{{- $solver := (index .Values._cluster "solver") | default "http01" }}
+{{- $clusterIssuer := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }}
 {{- $ingress := .Values._namespace.ingress }}
 {{- $host := .Values._namespace.host }}
 
@@ -171,10 +172,10 @@ metadata:
   labels:
     app: alerta
   annotations:
-    {{- if ne $issuerType "cloudflare" }}
+    {{- if ne $solver "dns01" }}
     acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
     {{- end }}
-    cert-manager.io/cluster-issuer: letsencrypt-prod
+    cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
 spec:
   ingressClassName: {{ $ingress }}
   tls:
diff --git a/packages/system/monitoring/templates/grafana/grafana.yaml b/packages/system/monitoring/templates/grafana/grafana.yaml
index 314a1682..3632a70b 100644
--- a/packages/system/monitoring/templates/grafana/grafana.yaml
+++ b/packages/system/monitoring/templates/grafana/grafana.yaml
@@ -1,4 +1,5 @@
-{{- $issuerType := (index .Values._cluster "clusterissuer") | default "http01" }}
+{{- $solver := (index .Values._cluster "solver") | default "http01" }}
+{{- $clusterIssuer := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }}
 {{- $ingress := .Values._namespace.ingress }}
 {{- $host := .Values._namespace.host }}
 ---
@@ -72,10 +73,10 @@ spec:
   ingress:
     metadata:
       annotations:
-        {{- if ne $issuerType "cloudflare" }}
+        {{- if ne $solver "dns01" }}
         acme.cert-manager.io/http01-ingress-class: "{{ $ingress }}"
         {{- end }}
-        cert-manager.io/cluster-issuer: letsencrypt-prod
+        cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
     spec:
       ingressClassName: "{{ $ingress }}"
       rules:

From 356070615c7904fc9b12c24c77ee0244bd8efad8 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Fri, 20 Feb 2026 11:45:04 +0500
Subject: [PATCH 138/666] feat(platform): Changed ingress annotation rendering
 for http01 solver

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/apps/harbor/templates/ingress.yaml               | 2 +-
 packages/extra/bootbox/templates/matchbox/ingress.yaml    | 2 +-
 packages/extra/seaweedfs/templates/seaweedfs.yaml         | 2 +-
 packages/system/bucket/templates/ingress.yaml             | 2 +-
 packages/system/dashboard/templates/ingress.yaml          | 2 +-
 packages/system/keycloak/templates/ingress.yaml           | 2 +-
 packages/system/monitoring/templates/alerta/alerta.yaml   | 2 +-
 packages/system/monitoring/templates/grafana/grafana.yaml | 2 +-
 8 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/packages/apps/harbor/templates/ingress.yaml b/packages/apps/harbor/templates/ingress.yaml
index cc65d081..bb6ef07c 100644
--- a/packages/apps/harbor/templates/ingress.yaml
+++ b/packages/apps/harbor/templates/ingress.yaml
@@ -14,7 +14,7 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-send-timeout: "900"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
     nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
-    {{- if ne $solver "dns01" }}
+    {{- if eq $solver "http01" }}
     acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
     {{- end }}
     cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
diff --git a/packages/extra/bootbox/templates/matchbox/ingress.yaml b/packages/extra/bootbox/templates/matchbox/ingress.yaml
index 3bbf70ed..4262cd10 100644
--- a/packages/extra/bootbox/templates/matchbox/ingress.yaml
+++ b/packages/extra/bootbox/templates/matchbox/ingress.yaml
@@ -9,7 +9,7 @@ metadata:
   labels:
     app: bootbox
   annotations:
-    {{- if ne $solver "dns01" }}
+    {{- if eq $solver "http01" }}
     acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
     {{- end }}
     cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
diff --git a/packages/extra/seaweedfs/templates/seaweedfs.yaml b/packages/extra/seaweedfs/templates/seaweedfs.yaml
index 3ebb57f6..03f9c45b 100644
--- a/packages/extra/seaweedfs/templates/seaweedfs.yaml
+++ b/packages/extra/seaweedfs/templates/seaweedfs.yaml
@@ -136,7 +136,7 @@ spec:
           annotations:
             nginx.ingress.kubernetes.io/proxy-body-size: "0"
             nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
-            {{- if ne $solver "dns01" }}
+            {{- if eq $solver "http01" }}
             acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
             {{- end }}
             cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
diff --git a/packages/system/bucket/templates/ingress.yaml b/packages/system/bucket/templates/ingress.yaml
index 735c94ec..9ad9f46d 100644
--- a/packages/system/bucket/templates/ingress.yaml
+++ b/packages/system/bucket/templates/ingress.yaml
@@ -14,7 +14,7 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
     nginx.ingress.kubernetes.io/proxy-read-timeout: "99999"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "99999"
-    {{- if ne $solver "dns01" }}
+    {{- if eq $solver "http01" }}
     acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
     {{- end }}
     cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
diff --git a/packages/system/dashboard/templates/ingress.yaml b/packages/system/dashboard/templates/ingress.yaml
index 62327514..a10797fb 100644
--- a/packages/system/dashboard/templates/ingress.yaml
+++ b/packages/system/dashboard/templates/ingress.yaml
@@ -10,7 +10,7 @@ kind: Ingress
 metadata:
   annotations:
     cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
-    {{- if ne $solver "dns01" }}
+    {{- if eq $solver "http01" }}
     acme.cert-manager.io/http01-ingress-class: {{ $exposeIngress }}
     {{- end }}
     nginx.ingress.kubernetes.io/rewrite-target: /
diff --git a/packages/system/keycloak/templates/ingress.yaml b/packages/system/keycloak/templates/ingress.yaml
index 72f236cd..58a303df 100644
--- a/packages/system/keycloak/templates/ingress.yaml
+++ b/packages/system/keycloak/templates/ingress.yaml
@@ -9,7 +9,7 @@ metadata:
   name: keycloak-ingress
   {{- with .Values.ingress.annotations }}
   annotations:
-    {{- if ne $solver "dns01" }}
+    {{- if eq $solver "http01" }}
     acme.cert-manager.io/http01-ingress-class: {{ $exposeIngress }}
     {{- end }}
     cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
diff --git a/packages/system/monitoring/templates/alerta/alerta.yaml b/packages/system/monitoring/templates/alerta/alerta.yaml
index 417b7bda..d727d5e6 100644
--- a/packages/system/monitoring/templates/alerta/alerta.yaml
+++ b/packages/system/monitoring/templates/alerta/alerta.yaml
@@ -172,7 +172,7 @@ metadata:
   labels:
     app: alerta
   annotations:
-    {{- if ne $solver "dns01" }}
+    {{- if eq $solver "http01" }}
     acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
     {{- end }}
     cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
diff --git a/packages/system/monitoring/templates/grafana/grafana.yaml b/packages/system/monitoring/templates/grafana/grafana.yaml
index 3632a70b..d7f51e31 100644
--- a/packages/system/monitoring/templates/grafana/grafana.yaml
+++ b/packages/system/monitoring/templates/grafana/grafana.yaml
@@ -73,7 +73,7 @@ spec:
   ingress:
     metadata:
       annotations:
-        {{- if ne $solver "dns01" }}
+        {{- if eq $solver "http01" }}
         acme.cert-manager.io/http01-ingress-class: "{{ $ingress }}"
         {{- end }}
         cert-manager.io/cluster-issuer: {{ $clusterIssuer }}

From 376e4d1fd33b4ca566089d397e4a656023d278ea Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Fri, 20 Feb 2026 05:08:08 +0300
Subject: [PATCH 139/666] [kamaji] Fix kubelet-config compatibility for
 Kubernetes < 1.35

Kamaji edge-26.2.4 is compiled against Kubernetes 1.35 libraries.
SetDefaults_KubeletConfiguration() from 1.35 injects two fields
gated by feature gates that are not enabled in earlier versions:
- crashLoopBackOff.maxContainerRestartPeriod (KubeletCrashLoopBackOffMax)
- imagePullCredentialsVerificationPolicy (KubeletEnsureSecretPulledImages)

Kubelets < 1.35 reject these fields during configuration validation,
causing worker nodes to fail to join the tenant cluster.

Add a Go patch that clears these fields from the kubelet-config
ConfigMap when the target Kubernetes version is below 1.35.

See: https://github.com/clastix/kamaji/issues/1062

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../patches/fix-kubelet-config-compat.diff    | 49 +++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 packages/system/kamaji/images/kamaji/patches/fix-kubelet-config-compat.diff

diff --git a/packages/system/kamaji/images/kamaji/patches/fix-kubelet-config-compat.diff b/packages/system/kamaji/images/kamaji/patches/fix-kubelet-config-compat.diff
new file mode 100644
index 00000000..ceb10686
--- /dev/null
+++ b/packages/system/kamaji/images/kamaji/patches/fix-kubelet-config-compat.diff
@@ -0,0 +1,49 @@
+diff --git a/internal/kubeadm/uploadconfig.go b/internal/kubeadm/uploadconfig.go
+index 89c9b54..1ee38cd 100644
+--- a/internal/kubeadm/uploadconfig.go
++++ b/internal/kubeadm/uploadconfig.go
+@@ -41,7 +41,7 @@ func UploadKubeletConfig(client kubernetes.Interface, config *Configuration, pat
+ 		TenantControlPlaneCgroupDriver:  config.Parameters.TenantControlPlaneCGroupDriver,
+ 	}
+ 
+-	content, err := getKubeletConfigmapContent(kubeletConfiguration, patches)
++	content, err := getKubeletConfigmapContent(kubeletConfiguration, patches, config.Parameters.TenantControlPlaneVersion)
+ 	if err != nil {
+ 		return nil, err
+ 	}
+@@ -72,7 +72,13 @@ func UploadKubeletConfig(client kubernetes.Interface, config *Configuration, pat
+ 	return nil, nil
+ }
+ 
+-func getKubeletConfigmapContent(kubeletConfiguration KubeletConfiguration, patch jsonpatchv5.Patch) ([]byte, error) {
++// minVerKubeletNewDefaults is the minimum Kubernetes version that supports the
++// CrashLoopBackOff and ImagePullCredentialsVerificationPolicy kubelet
++// configuration fields (gated by KubeletCrashLoopBackOffMax and
++// KubeletEnsureSecretPulledImages feature gates respectively).
++var minVerKubeletNewDefaults = semver.MustParse("1.35.0")
++
++func getKubeletConfigmapContent(kubeletConfiguration KubeletConfiguration, patch jsonpatchv5.Patch, version string) ([]byte, error) {
+ 	var kc kubelettypes.KubeletConfiguration
+ 
+ 	kubeletv1beta1.SetDefaults_KubeletConfiguration(&kc)
+@@ -94,6 +100,20 @@ func getKubeletConfigmapContent(kubeletConfiguration KubeletConfiguration, patch
+ 	// determine the resolvConf location, as reported in clastix/kamaji#581.
+ 	kc.ResolverConfig = nil
+ 
++	// Clear fields set by SetDefaults_KubeletConfiguration from Kubernetes >= 1.35.
++	// Older kubelets reject these fields because the corresponding feature gates
++	// (KubeletCrashLoopBackOffMax, KubeletEnsureSecretPulledImages) are not enabled.
++	// See: https://github.com/clastix/kamaji/issues/1062
++	parsedVer, parseErr := semver.ParseTolerant(version)
++	if parseErr != nil {
++		return nil, fmt.Errorf("failed to parse kubernetes version %q for kubelet config: %w", version, parseErr)
++	}
++
++	if parsedVer.LT(minVerKubeletNewDefaults) {
++		kc.CrashLoopBackOff = kubelettypes.CrashLoopBackOffConfig{}
++		kc.ImagePullCredentialsVerificationPolicy = ""
++	}
++
+ 	if len(patch) > 0 {
+ 		kubeletConfig, patchErr := utilities.EncodeToJSON(&kc)
+ 		if patchErr != nil {

From c98b6203a7d11431734e0af97177c25cc91283a2 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Fri, 20 Feb 2026 16:41:41 +0500
Subject: [PATCH 140/666] fix(platform): fix migrate script to account
 clusterissuer parameter

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 hack/migrate-to-version-1.0.sh | 36 ++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/hack/migrate-to-version-1.0.sh b/hack/migrate-to-version-1.0.sh
index 3c0c64f8..5a7bc381 100755
--- a/hack/migrate-to-version-1.0.sh
+++ b/hack/migrate-to-version-1.0.sh
@@ -53,6 +53,39 @@ KEYCLOAK_REDIRECTS=$(echo "$COZYSTACK_CM" | jq -r '.data["extra-keycloak-redirec
 TELEMETRY_ENABLED=$(echo "$COZYSTACK_CM" | jq -r '.data["telemetry-enabled"] // "true"')
 BUNDLE_NAME=$(echo "$COZYSTACK_CM" | jq -r '.data["bundle-name"] // "paas-full"')
 
+# Certificate issuer configuration (old undocumented field: clusterissuer)
+OLD_CLUSTER_ISSUER=$(echo "$COZYSTACK_CM" | jq -r '.data["clusterissuer"] // ""')
+
+# Convert old clusterissuer value to new solver/issuerName fields
+SOLVER=""
+ISSUER_NAME=""
+case "$OLD_CLUSTER_ISSUER" in
+    cloudflare)
+        SOLVER="dns01"
+        ISSUER_NAME="letsencrypt-prod"
+        ;;
+    http01)
+        SOLVER="http01"
+        ISSUER_NAME="letsencrypt-prod"
+        ;;
+    "")
+        # Field not set; omit from Package so chart defaults apply
+        ;;
+    *)
+        # Unrecognised value — treat as custom ClusterIssuer name with no solver override
+        ISSUER_NAME="$OLD_CLUSTER_ISSUER"
+        ;;
+esac
+
+# Build certificates YAML block (empty string when no override needed)
+if [ -n "$SOLVER" ] || [ -n "$ISSUER_NAME" ]; then
+    CERTIFICATES_SECTION="          certificates:
+            solver: \"${SOLVER}\"
+            issuerName: \"${ISSUER_NAME}\""
+else
+    CERTIFICATES_SECTION=""
+fi
+
 # Network configuration
 POD_CIDR=$(echo "$COZYSTACK_CM" | jq -r '.data["ipv4-pod-cidr"] // "10.244.0.0/16"')
 POD_GATEWAY=$(echo "$COZYSTACK_CM" | jq -r '.data["ipv4-pod-gateway"] // "10.244.0.1"')
@@ -110,6 +143,8 @@ echo "  OIDC Enabled: $OIDC_ENABLED"
 echo "  Bundle Name: $BUNDLE_NAME"
 echo "  System Enabled: $SYSTEM_ENABLED"
 echo "  System Type: $SYSTEM_TYPE"
+echo "  Certificate Solver: ${SOLVER:-http01 (default)}"
+echo "  Issuer Name: ${ISSUER_NAME:-letsencrypt-prod (default)}"
 echo ""
 
 # Generate Package YAML
@@ -144,6 +179,7 @@ spec:
           host: "$ROOT_HOST"
           apiServerEndpoint: "$API_SERVER_ENDPOINT"
           externalIPs: $EXTERNAL_IPS
+${CERTIFICATES_SECTION}
         authentication:
           oidc:
             enabled: $OIDC_ENABLED

From 17c2ea0e9c20d3631e045c0bff8d07e77913756b Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Fri, 20 Feb 2026 17:03:23 +0500
Subject: [PATCH 141/666] feat(platform): Added migration to convert issuer
 configuration

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .../platform/images/migrations/migrations/32  | 92 +++++++++++++++++++
 packages/core/platform/values.yaml            |  2 +-
 2 files changed, 93 insertions(+), 1 deletion(-)
 create mode 100755 packages/core/platform/images/migrations/migrations/32

diff --git a/packages/core/platform/images/migrations/migrations/32 b/packages/core/platform/images/migrations/migrations/32
new file mode 100755
index 00000000..c93a9312
--- /dev/null
+++ b/packages/core/platform/images/migrations/migrations/32
@@ -0,0 +1,92 @@
+#!/bin/sh
+# Migration 32 --> 33
+# Convert publishing.certificates.issuerType to solver + issuerName in
+# the cozystack-platform Package resource.
+#
+# Old field (pre-refactor schema):
+#   publishing.certificates.issuerType: "http01" | "cloudflare"
+# New fields:
+#   publishing.certificates.solver: "http01" | "dns01"
+#   publishing.certificates.issuerName: "letsencrypt-prod" (or custom)
+#
+# Conversion table:
+#   cloudflare  -> solver: dns01,  issuerName: letsencrypt-prod
+#   http01      -> solver: http01, issuerName: letsencrypt-prod
+#   <custom>    -> issuerName: <custom>  (solver left at chart default)
+#   <absent>    -> no-op
+
+set -euo pipefail
+
+PACKAGE_NAME="cozystack.cozystack-platform"
+
+# Check if Package exists
+if ! kubectl get package "$PACKAGE_NAME" >/dev/null 2>&1; then
+  echo "Package $PACKAGE_NAME not found, skipping migration"
+  kubectl create configmap -n cozy-system cozystack-version \
+    --from-literal=version=33 --dry-run=client -o yaml | kubectl apply -f -
+  exit 0
+fi
+
+# Read current issuerType value
+ISSUER_TYPE=$(kubectl get package "$PACKAGE_NAME" -o json | \
+  jq -r '.spec.components.platform.values.publishing.certificates.issuerType // ""')
+
+if [ -z "$ISSUER_TYPE" ]; then
+  echo "No issuerType found in Package $PACKAGE_NAME, nothing to migrate"
+  kubectl create configmap -n cozy-system cozystack-version \
+    --from-literal=version=33 --dry-run=client -o yaml | kubectl apply -f -
+  exit 0
+fi
+
+echo "Found issuerType: $ISSUER_TYPE"
+
+# Convert old issuerType to new solver/issuerName
+SOLVER=""
+ISSUER_NAME=""
+case "$ISSUER_TYPE" in
+  cloudflare)
+    SOLVER="dns01"
+    ISSUER_NAME="letsencrypt-prod"
+    ;;
+  http01)
+    SOLVER="http01"
+    ISSUER_NAME="letsencrypt-prod"
+    ;;
+  *)
+    # Unrecognised value — treat as custom ClusterIssuer name, no solver override
+    ISSUER_NAME="$ISSUER_TYPE"
+    ;;
+esac
+
+echo "Converting to: solver=${SOLVER:-<chart default>}, issuerName=${ISSUER_NAME:-<chart default>}"
+
+# Build the certificates patch:
+#   - null removes issuerType (JSON merge patch semantics)
+#   - solver and issuerName are included only when non-empty
+CERTS_PATCH=$(jq -n --arg solver "$SOLVER" --arg issuerName "$ISSUER_NAME" '
+  {"issuerType": null}
+  + (if $solver != "" then {"solver": $solver} else {} end)
+  + (if $issuerName != "" then {"issuerName": $issuerName} else {} end)
+')
+
+PATCH_JSON=$(jq -n --argjson certs "$CERTS_PATCH" '{
+  "spec": {
+    "components": {
+      "platform": {
+        "values": {
+          "publishing": {
+            "certificates": $certs
+          }
+        }
+      }
+    }
+  }
+}')
+
+kubectl patch package "$PACKAGE_NAME" --type=merge --patch "$PATCH_JSON"
+
+echo "Migration complete: issuerType=$ISSUER_TYPE -> solver=${SOLVER:-<unset>} issuerName=${ISSUER_NAME:-<unset>}"
+
+# Stamp version
+kubectl create configmap -n cozy-system cozystack-version \
+  --from-literal=version=33 --dry-run=client -o yaml | kubectl apply -f -
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index dbf1f4e6..1d62c87f 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -6,7 +6,7 @@ sourceRef:
 migrations:
   enabled: false
   image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0-beta.6@sha256:37c78dafcedbdad94acd9912550db0b4875897150666b8a06edfa894de99064e
-  targetVersion: 32
+  targetVersion: 33
 # Bundle deployment configuration
 bundles:
   system:

From d2f7c9ab82b82a828265c36557be90e2dbcfbf4b Mon Sep 17 00:00:00 2001
From: nbykov0 <166552198+nbykov0@users.noreply.github.com>
Date: Thu, 8 Jan 2026 18:19:01 +0300
Subject: [PATCH 142/666] [cdi-operator] Update to v1.64.0

Signed-off-by: nbykov0 <166552198+nbykov0@users.noreply.github.com>
---
 .../templates/cdi-operator.yaml               | 97 ++++++++++++++-----
 1 file changed, 75 insertions(+), 22 deletions(-)

diff --git a/packages/system/kubevirt-cdi-operator/templates/cdi-operator.yaml b/packages/system/kubevirt-cdi-operator/templates/cdi-operator.yaml
index f7b69eb0..f46ba09e 100644
--- a/packages/system/kubevirt-cdi-operator/templates/cdi-operator.yaml
+++ b/packages/system/kubevirt-cdi-operator/templates/cdi-operator.yaml
@@ -124,7 +124,7 @@ spec:
                   filesystemOverhead:
                     description: FilesystemOverhead describes the space reserved for
                       overhead when using Filesystem volumes. A value is between 0
-                      and 1, if not defined it is 0.055 (5.5% overhead)
+                      and 1, if not defined it is 0.06 (6% overhead)
                     properties:
                       global:
                         description: Global is how much space of a Filesystem volume
@@ -2656,7 +2656,7 @@ spec:
                   filesystemOverhead:
                     description: FilesystemOverhead describes the space reserved for
                       overhead when using Filesystem volumes. A value is between 0
-                      and 1, if not defined it is 0.055 (5.5% overhead)
+                      and 1, if not defined it is 0.06 (6% overhead)
                     properties:
                       global:
                         description: Global is how much space of a Filesystem volume
@@ -5164,6 +5164,14 @@ rules:
   - get
   - update
   - delete
+- apiGroups:
+  - admissionregistration.k8s.io
+  resourceNames:
+  - cdi-api-dataimportcron-mutate
+  resources:
+  - mutatingwebhookconfigurations
+  verbs:
+  - delete
 - apiGroups:
   - apiregistration.k8s.io
   resources:
@@ -5175,6 +5183,17 @@ rules:
   - create
   - update
   - delete
+- apiGroups:
+  - populator.storage.k8s.io
+  resources:
+  - volumepopulators
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - delete
 - apiGroups:
   - authorization.k8s.io
   resources:
@@ -5285,6 +5304,9 @@ rules:
   verbs:
   - create
   - patch
+  - get
+  - list
+  - watch
 - apiGroups:
   - ""
   resources:
@@ -5325,6 +5347,14 @@ rules:
   - watch
   - create
   - delete
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - ""
   resources:
@@ -5358,6 +5388,7 @@ rules:
   - get
 - apiGroups:
   - cdi.kubevirt.io
+  - forklift.cdi.kubevirt.io
   resources:
   - '*'
   verbs:
@@ -5418,14 +5449,11 @@ rules:
   verbs:
   - update
 - apiGroups:
-  - forklift.cdi.kubevirt.io
+  - authorization.k8s.io
   resources:
-  - ovirtvolumepopulators
-  - openstackvolumepopulators
+  - subjectaccessreviews
   verbs:
-  - get
-  - list
-  - watch
+  - create
 - apiGroups:
   - ""
   resources:
@@ -5670,6 +5698,7 @@ metadata:
   labels:
     cdi.kubevirt.io: cdi-operator
     name: cdi-operator
+    np.kubevirt.io/allow-access-cluster-services: "true"
     operator.cdi.kubevirt.io: ""
     prometheus.cdi.kubevirt.io: "true"
   name: cdi-operator
@@ -5688,6 +5717,7 @@ spec:
       labels:
         cdi.kubevirt.io: cdi-operator
         name: cdi-operator
+        np.kubevirt.io/allow-access-cluster-services: "true"
         operator.cdi.kubevirt.io: ""
         prometheus.cdi.kubevirt.io: "true"
     spec:
@@ -5708,33 +5738,50 @@ spec:
         - name: DEPLOY_CLUSTER_RESOURCES
           value: "true"
         - name: OPERATOR_VERSION
-          value: v1.62.0
+          value: v1.64.0
         - name: CONTROLLER_IMAGE
-          value: quay.io/kubevirt/cdi-controller:v1.62.0
+          value: quay.io/kubevirt/cdi-controller:v1.64.0
         - name: IMPORTER_IMAGE
-          value: quay.io/kubevirt/cdi-importer:v1.62.0
+          value: quay.io/kubevirt/cdi-importer:v1.64.0
         - name: CLONER_IMAGE
-          value: quay.io/kubevirt/cdi-cloner:v1.62.0
+          value: quay.io/kubevirt/cdi-cloner:v1.64.0
         - name: OVIRT_POPULATOR_IMAGE
-          value: quay.io/kubevirt/cdi-importer:v1.62.0
+          value: quay.io/kubevirt/cdi-importer:v1.64.0
         - name: APISERVER_IMAGE
-          value: quay.io/kubevirt/cdi-apiserver:v1.62.0
+          value: quay.io/kubevirt/cdi-apiserver:v1.64.0
         - name: UPLOAD_SERVER_IMAGE
-          value: quay.io/kubevirt/cdi-uploadserver:v1.62.0
+          value: quay.io/kubevirt/cdi-uploadserver:v1.64.0
         - name: UPLOAD_PROXY_IMAGE
-          value: quay.io/kubevirt/cdi-uploadproxy:v1.62.0
+          value: quay.io/kubevirt/cdi-uploadproxy:v1.64.0
         - name: VERBOSITY
           value: "1"
         - name: PULL_POLICY
           value: IfNotPresent
         - name: MONITORING_NAMESPACE
-        image: quay.io/kubevirt/cdi-operator:v1.62.0
+        image: quay.io/kubevirt/cdi-operator:v1.64.0
         imagePullPolicy: IfNotPresent
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8444
+            scheme: HTTP
+          initialDelaySeconds: 5
+          timeoutSeconds: 10
         name: cdi-operator
         ports:
-        - containerPort: 8080
+        - containerPort: 8443
           name: metrics
           protocol: TCP
+        - containerPort: 8444
+          name: health
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /readyz
+            port: 8444
+            scheme: HTTP
+          initialDelaySeconds: 5
+          timeoutSeconds: 10
         resources:
           requests:
             cpu: 100m
@@ -5748,13 +5795,19 @@ spec:
           seccompProfile:
             type: RuntimeDefault
         terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
+        terminationMessagePolicy: FallbackToLogsOnError
       nodeSelector:
         kubernetes.io/os: linux
       securityContext:
         runAsNonRoot: true
       serviceAccountName: cdi-operator
       tolerations:
-      - key: CriticalAddonsOnly
-        operator: Exists
----
\ No newline at end of file
+       - key: CriticalAddonsOnly
+         operator: Exists
+       - effect: NoSchedule
+         key: node-role.kubernetes.io/control-plane
+         operator: Exists
+       - effect: NoSchedule
+         key: node-role.kubernetes.io/master
+         operator: Exists
+---

From 7bc93c50450f35f763daf8d00e1aad3e4c414eb2 Mon Sep 17 00:00:00 2001
From: nbykov0 <166552198+nbykov0@users.noreply.github.com>
Date: Thu, 8 Jan 2026 18:34:02 +0300
Subject: [PATCH 143/666] [kubevirt-operator] Update to v1.6.4

Co-authored-by: Andrei Kvapil <kvapss@gmail.com>
Signed-off-by: nbykov0 <166552198+nbykov0@users.noreply.github.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/system/kubevirt-operator/Makefile    |   3 +-
 .../templates/kubevirt-operator.yaml          | 130 +++++++++++++++++-
 2 files changed, 128 insertions(+), 5 deletions(-)

diff --git a/packages/system/kubevirt-operator/Makefile b/packages/system/kubevirt-operator/Makefile
index 69b6a692..1734aa2a 100644
--- a/packages/system/kubevirt-operator/Makefile
+++ b/packages/system/kubevirt-operator/Makefile
@@ -6,7 +6,8 @@ include ../../../hack/package.mk
 update:
 	rm -rf templates
 	mkdir templates
-	export RELEASE=$$(curl https://storage.googleapis.com/kubevirt-prow/release/kubevirt/kubevirt/stable.txt) && \
+	# v1.7.0 blocked by https://github.com/kubevirt/kubevirt/issues/16386
+	export RELEASE=v1.6.3 && \
 	wget https://github.com/kubevirt/kubevirt/releases/download/$${RELEASE}/kubevirt-operator.yaml -O templates/kubevirt-operator.yaml && \
 	sed -i 's/namespace: kubevirt/namespace: $(NAMESPACE)/g' templates/kubevirt-operator.yaml
 	awk -i inplace -v RS="---" '!/kind: Namespace/{printf "%s", $$0 RS}' templates/kubevirt-operator.yaml
diff --git a/packages/system/kubevirt-operator/templates/kubevirt-operator.yaml b/packages/system/kubevirt-operator/templates/kubevirt-operator.yaml
index b6761454..8350d457 100644
--- a/packages/system/kubevirt-operator/templates/kubevirt-operator.yaml
+++ b/packages/system/kubevirt-operator/templates/kubevirt-operator.yaml
@@ -288,6 +288,10 @@ spec:
                   developerConfiguration:
                     description: DeveloperConfiguration holds developer options
                     properties:
+                      clusterProfiler:
+                        description: Enable the ability to pprof profile KubeVirt
+                          control plane
+                        type: boolean
                       cpuAllocationRatio:
                         description: |-
                           For each requested virtual CPU, CPUAllocationRatio defines how much physical CPU to request per VMI
@@ -337,6 +341,8 @@ spec:
                             type: integer
                           virtOperator:
                             type: integer
+                          virtSynchronizationController:
+                            type: integer
                         type: object
                       memoryOvercommit:
                         description: |-
@@ -2132,6 +2138,10 @@ spec:
                    When ServiceMonitorNamespace is set, then we'll install the service monitor object in that namespace
                   otherwise we will use the monitoring namespace.
                 type: string
+              synchronizationPort:
+                description: Specify the port to listen on for VMI status synchronization
+                  traffic. Default is 9185
+                type: string
               uninstallStrategy:
                 description: |-
                   Specifies if kubevirt can be deleted if workloads are still present.
@@ -3263,6 +3273,11 @@ spec:
                 description: KubeVirtPhase is a label for the phase of a KubeVirt
                   deployment at the current time.
                 type: string
+              synchronizationAddresses:
+                items:
+                  type: string
+                type: array
+                x-kubernetes-list-type: atomic
               targetDeploymentConfig:
                 type: string
               targetDeploymentID:
@@ -3552,6 +3567,10 @@ spec:
                   developerConfiguration:
                     description: DeveloperConfiguration holds developer options
                     properties:
+                      clusterProfiler:
+                        description: Enable the ability to pprof profile KubeVirt
+                          control plane
+                        type: boolean
                       cpuAllocationRatio:
                         description: |-
                           For each requested virtual CPU, CPUAllocationRatio defines how much physical CPU to request per VMI
@@ -3601,6 +3620,8 @@ spec:
                             type: integer
                           virtOperator:
                             type: integer
+                          virtSynchronizationController:
+                            type: integer
                         type: object
                       memoryOvercommit:
                         description: |-
@@ -5396,6 +5417,10 @@ spec:
                    When ServiceMonitorNamespace is set, then we'll install the service monitor object in that namespace
                   otherwise we will use the monitoring namespace.
                 type: string
+              synchronizationPort:
+                description: Specify the port to listen on for VMI status synchronization
+                  traffic. Default is 9185
+                type: string
               uninstallStrategy:
                 description: |-
                   Specifies if kubevirt can be deleted if workloads are still present.
@@ -6527,6 +6552,11 @@ spec:
                 description: KubeVirtPhase is a label for the phase of a KubeVirt
                   deployment at the current time.
                 type: string
+              synchronizationAddresses:
+                items:
+                  type: string
+                type: array
+                x-kubernetes-list-type: atomic
               targetDeploymentConfig:
                 type: string
               targetDeploymentID:
@@ -6602,6 +6632,8 @@ rules:
   - kubevirt-virt-api-certs
   - kubevirt-controller-certs
   - kubevirt-exportproxy-certs
+  - kubevirt-synchronization-controller-certs
+  - kubevirt-synchronization-controller-server-certs
   resources:
   - secrets
   verbs:
@@ -6713,6 +6745,28 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - ""
+  resourceNames:
+  - kubevirt-ca
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - get
+  - list
+  - watch
+  - delete
+  - update
+  - create
+  - patch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -6936,6 +6990,7 @@ rules:
   - persistentvolumeclaims
   verbs:
   - get
+  - list
 - apiGroups:
   - kubevirt.io
   resources:
@@ -7331,6 +7386,15 @@ rules:
   - create
   - get
   - delete
+- apiGroups:
+  - resource.k8s.io
+  resources:
+  - resourceslices
+  - resourceclaims
+  verbs:
+  - list
+  - watch
+  - get
 - apiGroups:
   - kubevirt.io
   resources:
@@ -7402,6 +7466,50 @@ rules:
   verbs:
   - list
   - watch
+- apiGroups:
+  - kubevirt.io
+  resources:
+  - virtualmachineinstances
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch
+- apiGroups:
+  - kubevirt.io
+  resources:
+  - virtualmachineinstancemigrations
+  verbs:
+  - get
+  - list
+  - watch
+  - patch
+  - delete
+- apiGroups:
+  - kubevirt.io
+  resources:
+  - kubevirts
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - update
+  - create
+  - patch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - kubevirt.io
   resources:
@@ -7430,6 +7538,8 @@ rules:
   - virtualmachineinstances/sev/fetchcertchain
   - virtualmachineinstances/sev/querylaunchmeasurement
   - virtualmachineinstances/usbredir
+  - virtualmachines/objectgraph
+  - virtualmachineinstances/objectgraph
   verbs:
   - get
 - apiGroups:
@@ -7586,6 +7696,8 @@ rules:
   - virtualmachineinstances/sev/fetchcertchain
   - virtualmachineinstances/sev/querylaunchmeasurement
   - virtualmachineinstances/usbredir
+  - virtualmachines/objectgraph
+  - virtualmachineinstances/objectgraph
   verbs:
   - get
 - apiGroups:
@@ -7746,6 +7858,8 @@ rules:
   - virtualmachineinstances/userlist
   - virtualmachineinstances/sev/fetchcertchain
   - virtualmachineinstances/sev/querylaunchmeasurement
+  - virtualmachines/objectgraph
+  - virtualmachineinstances/objectgraph
   verbs:
   - get
 - apiGroups:
@@ -7922,15 +8036,22 @@ spec:
         - virt-operator
         env:
         - name: VIRT_OPERATOR_IMAGE
-          value: quay.io/kubevirt/virt-operator:v1.5.2
+          value: quay.io/kubevirt/virt-operator:v1.6.3
         - name: WATCH_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.annotations['olm.targetNamespaces']
         - name: KUBEVIRT_VERSION
-          value: v1.5.2
-        image: quay.io/kubevirt/virt-operator:v1.5.2
+          value: v1.6.3
+        image: quay.io/kubevirt/virt-operator:v1.6.3
         imagePullPolicy: IfNotPresent
+        livenessProbe:
+          httpGet:
+            path: /metrics
+            port: 8443
+            scheme: HTTPS
+          initialDelaySeconds: 5
+          timeoutSeconds: 10
         name: virt-operator
         ports:
         - containerPort: 8443
@@ -7957,6 +8078,7 @@ spec:
             - ALL
           seccompProfile:
             type: RuntimeDefault
+        terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /etc/virt-operator/certificates
           name: kubevirt-operator-certs
@@ -7981,4 +8103,4 @@ spec:
           secretName: kubevirt-operator-certs
       - emptyDir: {}
         name: profile-data
----
\ No newline at end of file
+---

From 2c372ae378f3f1ee146218a5f460133c12be03b0 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 21 Feb 2026 19:09:09 +0300
Subject: [PATCH 144/666] [kamaji] Update to 309d9889 (post edge-26.2.4), drop
 disable-datastore-check patch

Upstream PR clastix/kamaji#1087 (refactor!: datastore conditions) removed
the startup datastore existence check that our disable-datastore-check.diff
patch was working around. Update to the merge commit and drop the now
redundant patch.

Remaining patches:
- fix-kubelet-config-compat.diff (pending upstream PR #1084)
- increase-startup-probe-threshold.diff (no upstream fix)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../kamaji.clastix.io_datastores_spec.yaml    | 69 +++++++++++++++++++
 ...i.clastix.io_tenantcontrolplanes_spec.yaml |  3 -
 .../controller-gen/validating-webhook.yaml    | 40 -----------
 .../crds/kamaji.clastix.io_datastores.yaml    | 69 +++++++++++++++++++
 ...kamaji.clastix.io_tenantcontrolplanes.yaml |  3 -
 .../system/kamaji/images/kamaji/Dockerfile    |  4 +-
 .../patches/disable-datastore-check.diff      | 30 --------
 7 files changed, 140 insertions(+), 78 deletions(-)
 delete mode 100644 packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff

diff --git a/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml
index 253cebae..c02419af 100644
--- a/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml
+++ b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml
@@ -11,6 +11,10 @@ versions:
         jsonPath: .spec.driver
         name: Driver
         type: string
+      - description: DataStore validated and ready for use
+        jsonPath: .status.ready
+        name: Ready
+        type: boolean
       - description: Age
         jsonPath: .metadata.creationTimestamp
         name: Age
@@ -272,18 +276,83 @@ versions:
                 rule: '(self.driver != "etcd" && has(self.basicAuth)) ? ((has(self.basicAuth.password.secretReference) || has(self.basicAuth.password.content))) : true'
               - message: When driver is not etcd, either tlsConfig or basicAuth must be provided
                 rule: '(self.driver != "etcd") ? (has(self.tlsConfig) || has(self.basicAuth)) : true'
+              - message: driver is immutable and cannot be changed after creation
+                rule: oldSelf == null || self.driver == oldSelf.driver
           status:
             description: DataStoreStatus defines the observed state of DataStore.
             properties:
+              conditions:
+                description: Conditions contains the validation conditions for the given Datastore.
+                items:
+                  description: Condition contains details for one aspect of the current state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                        - "True"
+                        - "False"
+                        - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                    - lastTransitionTime
+                    - message
+                    - reason
+                    - status
+                    - type
+                  type: object
+                type: array
               observedGeneration:
                 description: ObservedGeneration represents the .metadata.generation that was last reconciled.
                 format: int64
                 type: integer
+              ready:
+                description: |-
+                  Ready returns if the DataStore is accepted and ready to get used:
+                  Kamaji will ensure certificates are available, or correctly referenced.
+                type: boolean
               usedBy:
                 description: List of the Tenant Control Planes, namespaced named, using this data store.
                 items:
                   type: string
                 type: array
+            required:
+              - ready
             type: object
         type: object
     served: true
diff --git a/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml
index 43fbc59a..2dab2e09 100644
--- a/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml
+++ b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml
@@ -6896,9 +6896,6 @@ versions:
                           type: object
                         type: array
                     type: object
-                    x-kubernetes-validations:
-                      - message: parentRefs must not specify port or sectionName, these are set automatically by Kamaji
-                        rule: '!has(self.parentRefs) || size(self.parentRefs) == 0 || self.parentRefs.all(ref, !has(ref.port) && !has(ref.sectionName))'
                   ingress:
                     description: Defining the options for an Optional Ingress which will expose API Server of the Tenant Control Plane
                     properties:
diff --git a/packages/system/kamaji/charts/kamaji/controller-gen/validating-webhook.yaml b/packages/system/kamaji/charts/kamaji/controller-gen/validating-webhook.yaml
index 7042df0b..b7eb1690 100644
--- a/packages/system/kamaji/charts/kamaji/controller-gen/validating-webhook.yaml
+++ b/packages/system/kamaji/charts/kamaji/controller-gen/validating-webhook.yaml
@@ -19,46 +19,6 @@
       resources:
         - tenantcontrolplanes
   sideEffects: None
-- admissionReviewVersions:
-    - v1
-  clientConfig:
-    service:
-      name: '{{ include "kamaji.webhookServiceName" . }}'
-      namespace: '{{ .Release.Namespace }}'
-      path: /validate-kamaji-clastix-io-v1alpha1-datastore
-  failurePolicy: Fail
-  name: vdatastore.kb.io
-  rules:
-    - apiGroups:
-        - kamaji.clastix.io
-      apiVersions:
-        - v1alpha1
-      operations:
-        - CREATE
-        - UPDATE
-        - DELETE
-      resources:
-        - datastores
-  sideEffects: None
-- admissionReviewVersions:
-    - v1
-  clientConfig:
-    service:
-      name: '{{ include "kamaji.webhookServiceName" . }}'
-      namespace: '{{ .Release.Namespace }}'
-      path: /validate--v1-secret
-  failurePolicy: Ignore
-  name: vdatastoresecrets.kb.io
-  rules:
-    - apiGroups:
-        - ""
-      apiVersions:
-        - v1
-      operations:
-        - DELETE
-      resources:
-        - secrets
-  sideEffects: None
 - admissionReviewVersions:
     - v1
   clientConfig:
diff --git a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml
index 896a40e8..903f7c69 100644
--- a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml
+++ b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml
@@ -20,6 +20,10 @@ spec:
           jsonPath: .spec.driver
           name: Driver
           type: string
+        - description: DataStore validated and ready for use
+          jsonPath: .status.ready
+          name: Ready
+          type: boolean
         - description: Age
           jsonPath: .metadata.creationTimestamp
           name: Age
@@ -281,18 +285,83 @@ spec:
                   rule: '(self.driver != "etcd" && has(self.basicAuth)) ? ((has(self.basicAuth.password.secretReference) || has(self.basicAuth.password.content))) : true'
                 - message: When driver is not etcd, either tlsConfig or basicAuth must be provided
                   rule: '(self.driver != "etcd") ? (has(self.tlsConfig) || has(self.basicAuth)) : true'
+                - message: driver is immutable and cannot be changed after creation
+                  rule: oldSelf == null || self.driver == oldSelf.driver
             status:
               description: DataStoreStatus defines the observed state of DataStore.
               properties:
+                conditions:
+                  description: Conditions contains the validation conditions for the given Datastore.
+                  items:
+                    description: Condition contains details for one aspect of the current state of this API Resource.
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          lastTransitionTime is the last time the condition transitioned from one status to another.
+                          This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                        format: date-time
+                        type: string
+                      message:
+                        description: |-
+                          message is a human readable message indicating details about the transition.
+                          This may be an empty string.
+                        maxLength: 32768
+                        type: string
+                      observedGeneration:
+                        description: |-
+                          observedGeneration represents the .metadata.generation that the condition was set based upon.
+                          For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                          with respect to the current state of the instance.
+                        format: int64
+                        minimum: 0
+                        type: integer
+                      reason:
+                        description: |-
+                          reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                          Producers of specific condition types may define expected values and meanings for this field,
+                          and whether the values are considered a guaranteed API.
+                          The value should be a CamelCase string.
+                          This field may not be empty.
+                        maxLength: 1024
+                        minLength: 1
+                        pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                        type: string
+                      status:
+                        description: status of the condition, one of True, False, Unknown.
+                        enum:
+                          - "True"
+                          - "False"
+                          - Unknown
+                        type: string
+                      type:
+                        description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                        maxLength: 316
+                        pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                        type: string
+                    required:
+                      - lastTransitionTime
+                      - message
+                      - reason
+                      - status
+                      - type
+                    type: object
+                  type: array
                 observedGeneration:
                   description: ObservedGeneration represents the .metadata.generation that was last reconciled.
                   format: int64
                   type: integer
+                ready:
+                  description: |-
+                    Ready returns if the DataStore is accepted and ready to get used:
+                    Kamaji will ensure certificates are available, or correctly referenced.
+                  type: boolean
                 usedBy:
                   description: List of the Tenant Control Planes, namespaced named, using this data store.
                   items:
                     type: string
                   type: array
+              required:
+                - ready
               type: object
           type: object
       served: true
diff --git a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
index 506d4379..acb79b38 100644
--- a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
+++ b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
@@ -6904,9 +6904,6 @@ spec:
                             type: object
                           type: array
                       type: object
-                      x-kubernetes-validations:
-                        - message: parentRefs must not specify port or sectionName, these are set automatically by Kamaji
-                          rule: '!has(self.parentRefs) || size(self.parentRefs) == 0 || self.parentRefs.all(ref, !has(ref.port) && !has(ref.sectionName))'
                     ingress:
                       description: Defining the options for an Optional Ingress which will expose API Server of the Tenant Control Plane
                       properties:
diff --git a/packages/system/kamaji/images/kamaji/Dockerfile b/packages/system/kamaji/images/kamaji/Dockerfile
index ddb49636..307e684c 100644
--- a/packages/system/kamaji/images/kamaji/Dockerfile
+++ b/packages/system/kamaji/images/kamaji/Dockerfile
@@ -1,13 +1,13 @@
 # Build the manager binary
 FROM golang:1.26 AS builder
 
-ARG VERSION=edge-26.2.4
+ARG VERSION=309d9889e8eefe40b4c6c6843ad9683959f02e5e
 ARG TARGETOS
 ARG TARGETARCH
 
 WORKDIR /workspace
 
-RUN curl -sSL https://github.com/clastix/kamaji/archive/refs/tags/${VERSION}.tar.gz | tar -xzvf- --strip=1
+RUN curl -sSL https://github.com/clastix/kamaji/archive/${VERSION}.tar.gz | tar -xzvf- --strip=1
 
 COPY patches /patches
 RUN git apply /patches/*.diff
diff --git a/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff b/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff
deleted file mode 100644
index 1a8767b5..00000000
--- a/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff
+++ /dev/null
@@ -1,30 +0,0 @@
-diff --git a/cmd/manager/cmd.go b/cmd/manager/cmd.go
---- a/cmd/manager/cmd.go
-+++ b/cmd/manager/cmd.go
-@@ -4,7 +4,6 @@
- package manager
-
- import (
--	"context"
- 	"flag"
- 	"fmt"
- 	"io"
-@@ -34,7 +33,6 @@
- 	"github.com/clastix/kamaji/controllers/soot"
- 	"github.com/clastix/kamaji/internal"
- 	"github.com/clastix/kamaji/internal/builders/controlplane"
--	datastoreutils "github.com/clastix/kamaji/internal/datastore/utils"
- 	"github.com/clastix/kamaji/internal/utilities"
- 	"github.com/clastix/kamaji/internal/webhook"
- 	"github.com/clastix/kamaji/internal/webhook/handlers"
-@@ -85,10 +83,6 @@
-
- 			if webhookCABundle, err = os.ReadFile(webhookCAPath); err != nil {
- 				return fmt.Errorf("unable to read webhook CA: %w", err)
--			}
--
--			if err = datastoreutils.CheckExists(context.Background(), scheme, datastore); err != nil {
--				return err
- 			}
-
- 			if controllerReconcileTimeout.Seconds() == 0 {

From 8dbd6d51673e7e294ba0784a68cee21e457cb40f Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 21 Feb 2026 20:26:18 +0300
Subject: [PATCH 145/666] Revert "[kamaji] Update to 309d9889 (post
 edge-26.2.4), drop disable-datastore-check patch"

This reverts commit 2c372ae378f3f1ee146218a5f460133c12be03b0.
---
 .../kamaji.clastix.io_datastores_spec.yaml    | 69 -------------------
 ...i.clastix.io_tenantcontrolplanes_spec.yaml |  3 +
 .../controller-gen/validating-webhook.yaml    | 40 +++++++++++
 .../crds/kamaji.clastix.io_datastores.yaml    | 69 -------------------
 ...kamaji.clastix.io_tenantcontrolplanes.yaml |  3 +
 .../system/kamaji/images/kamaji/Dockerfile    |  4 +-
 .../patches/disable-datastore-check.diff      | 30 ++++++++
 7 files changed, 78 insertions(+), 140 deletions(-)
 create mode 100644 packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff

diff --git a/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml
index c02419af..253cebae 100644
--- a/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml
+++ b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml
@@ -11,10 +11,6 @@ versions:
         jsonPath: .spec.driver
         name: Driver
         type: string
-      - description: DataStore validated and ready for use
-        jsonPath: .status.ready
-        name: Ready
-        type: boolean
       - description: Age
         jsonPath: .metadata.creationTimestamp
         name: Age
@@ -276,83 +272,18 @@ versions:
                 rule: '(self.driver != "etcd" && has(self.basicAuth)) ? ((has(self.basicAuth.password.secretReference) || has(self.basicAuth.password.content))) : true'
               - message: When driver is not etcd, either tlsConfig or basicAuth must be provided
                 rule: '(self.driver != "etcd") ? (has(self.tlsConfig) || has(self.basicAuth)) : true'
-              - message: driver is immutable and cannot be changed after creation
-                rule: oldSelf == null || self.driver == oldSelf.driver
           status:
             description: DataStoreStatus defines the observed state of DataStore.
             properties:
-              conditions:
-                description: Conditions contains the validation conditions for the given Datastore.
-                items:
-                  description: Condition contains details for one aspect of the current state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                        - "True"
-                        - "False"
-                        - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                    - lastTransitionTime
-                    - message
-                    - reason
-                    - status
-                    - type
-                  type: object
-                type: array
               observedGeneration:
                 description: ObservedGeneration represents the .metadata.generation that was last reconciled.
                 format: int64
                 type: integer
-              ready:
-                description: |-
-                  Ready returns if the DataStore is accepted and ready to get used:
-                  Kamaji will ensure certificates are available, or correctly referenced.
-                type: boolean
               usedBy:
                 description: List of the Tenant Control Planes, namespaced named, using this data store.
                 items:
                   type: string
                 type: array
-            required:
-              - ready
             type: object
         type: object
     served: true
diff --git a/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml
index 2dab2e09..43fbc59a 100644
--- a/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml
+++ b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml
@@ -6896,6 +6896,9 @@ versions:
                           type: object
                         type: array
                     type: object
+                    x-kubernetes-validations:
+                      - message: parentRefs must not specify port or sectionName, these are set automatically by Kamaji
+                        rule: '!has(self.parentRefs) || size(self.parentRefs) == 0 || self.parentRefs.all(ref, !has(ref.port) && !has(ref.sectionName))'
                   ingress:
                     description: Defining the options for an Optional Ingress which will expose API Server of the Tenant Control Plane
                     properties:
diff --git a/packages/system/kamaji/charts/kamaji/controller-gen/validating-webhook.yaml b/packages/system/kamaji/charts/kamaji/controller-gen/validating-webhook.yaml
index b7eb1690..7042df0b 100644
--- a/packages/system/kamaji/charts/kamaji/controller-gen/validating-webhook.yaml
+++ b/packages/system/kamaji/charts/kamaji/controller-gen/validating-webhook.yaml
@@ -19,6 +19,46 @@
       resources:
         - tenantcontrolplanes
   sideEffects: None
+- admissionReviewVersions:
+    - v1
+  clientConfig:
+    service:
+      name: '{{ include "kamaji.webhookServiceName" . }}'
+      namespace: '{{ .Release.Namespace }}'
+      path: /validate-kamaji-clastix-io-v1alpha1-datastore
+  failurePolicy: Fail
+  name: vdatastore.kb.io
+  rules:
+    - apiGroups:
+        - kamaji.clastix.io
+      apiVersions:
+        - v1alpha1
+      operations:
+        - CREATE
+        - UPDATE
+        - DELETE
+      resources:
+        - datastores
+  sideEffects: None
+- admissionReviewVersions:
+    - v1
+  clientConfig:
+    service:
+      name: '{{ include "kamaji.webhookServiceName" . }}'
+      namespace: '{{ .Release.Namespace }}'
+      path: /validate--v1-secret
+  failurePolicy: Ignore
+  name: vdatastoresecrets.kb.io
+  rules:
+    - apiGroups:
+        - ""
+      apiVersions:
+        - v1
+      operations:
+        - DELETE
+      resources:
+        - secrets
+  sideEffects: None
 - admissionReviewVersions:
     - v1
   clientConfig:
diff --git a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml
index 903f7c69..896a40e8 100644
--- a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml
+++ b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml
@@ -20,10 +20,6 @@ spec:
           jsonPath: .spec.driver
           name: Driver
           type: string
-        - description: DataStore validated and ready for use
-          jsonPath: .status.ready
-          name: Ready
-          type: boolean
         - description: Age
           jsonPath: .metadata.creationTimestamp
           name: Age
@@ -285,83 +281,18 @@ spec:
                   rule: '(self.driver != "etcd" && has(self.basicAuth)) ? ((has(self.basicAuth.password.secretReference) || has(self.basicAuth.password.content))) : true'
                 - message: When driver is not etcd, either tlsConfig or basicAuth must be provided
                   rule: '(self.driver != "etcd") ? (has(self.tlsConfig) || has(self.basicAuth)) : true'
-                - message: driver is immutable and cannot be changed after creation
-                  rule: oldSelf == null || self.driver == oldSelf.driver
             status:
               description: DataStoreStatus defines the observed state of DataStore.
               properties:
-                conditions:
-                  description: Conditions contains the validation conditions for the given Datastore.
-                  items:
-                    description: Condition contains details for one aspect of the current state of this API Resource.
-                    properties:
-                      lastTransitionTime:
-                        description: |-
-                          lastTransitionTime is the last time the condition transitioned from one status to another.
-                          This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                        format: date-time
-                        type: string
-                      message:
-                        description: |-
-                          message is a human readable message indicating details about the transition.
-                          This may be an empty string.
-                        maxLength: 32768
-                        type: string
-                      observedGeneration:
-                        description: |-
-                          observedGeneration represents the .metadata.generation that the condition was set based upon.
-                          For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                          with respect to the current state of the instance.
-                        format: int64
-                        minimum: 0
-                        type: integer
-                      reason:
-                        description: |-
-                          reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                          Producers of specific condition types may define expected values and meanings for this field,
-                          and whether the values are considered a guaranteed API.
-                          The value should be a CamelCase string.
-                          This field may not be empty.
-                        maxLength: 1024
-                        minLength: 1
-                        pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                        type: string
-                      status:
-                        description: status of the condition, one of True, False, Unknown.
-                        enum:
-                          - "True"
-                          - "False"
-                          - Unknown
-                        type: string
-                      type:
-                        description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                        maxLength: 316
-                        pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                        type: string
-                    required:
-                      - lastTransitionTime
-                      - message
-                      - reason
-                      - status
-                      - type
-                    type: object
-                  type: array
                 observedGeneration:
                   description: ObservedGeneration represents the .metadata.generation that was last reconciled.
                   format: int64
                   type: integer
-                ready:
-                  description: |-
-                    Ready returns if the DataStore is accepted and ready to get used:
-                    Kamaji will ensure certificates are available, or correctly referenced.
-                  type: boolean
                 usedBy:
                   description: List of the Tenant Control Planes, namespaced named, using this data store.
                   items:
                     type: string
                   type: array
-              required:
-                - ready
               type: object
           type: object
       served: true
diff --git a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
index acb79b38..506d4379 100644
--- a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
+++ b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
@@ -6904,6 +6904,9 @@ spec:
                             type: object
                           type: array
                       type: object
+                      x-kubernetes-validations:
+                        - message: parentRefs must not specify port or sectionName, these are set automatically by Kamaji
+                          rule: '!has(self.parentRefs) || size(self.parentRefs) == 0 || self.parentRefs.all(ref, !has(ref.port) && !has(ref.sectionName))'
                     ingress:
                       description: Defining the options for an Optional Ingress which will expose API Server of the Tenant Control Plane
                       properties:
diff --git a/packages/system/kamaji/images/kamaji/Dockerfile b/packages/system/kamaji/images/kamaji/Dockerfile
index 307e684c..ddb49636 100644
--- a/packages/system/kamaji/images/kamaji/Dockerfile
+++ b/packages/system/kamaji/images/kamaji/Dockerfile
@@ -1,13 +1,13 @@
 # Build the manager binary
 FROM golang:1.26 AS builder
 
-ARG VERSION=309d9889e8eefe40b4c6c6843ad9683959f02e5e
+ARG VERSION=edge-26.2.4
 ARG TARGETOS
 ARG TARGETARCH
 
 WORKDIR /workspace
 
-RUN curl -sSL https://github.com/clastix/kamaji/archive/${VERSION}.tar.gz | tar -xzvf- --strip=1
+RUN curl -sSL https://github.com/clastix/kamaji/archive/refs/tags/${VERSION}.tar.gz | tar -xzvf- --strip=1
 
 COPY patches /patches
 RUN git apply /patches/*.diff
diff --git a/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff b/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff
new file mode 100644
index 00000000..1a8767b5
--- /dev/null
+++ b/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff
@@ -0,0 +1,30 @@
+diff --git a/cmd/manager/cmd.go b/cmd/manager/cmd.go
+--- a/cmd/manager/cmd.go
++++ b/cmd/manager/cmd.go
+@@ -4,7 +4,6 @@
+ package manager
+
+ import (
+-	"context"
+ 	"flag"
+ 	"fmt"
+ 	"io"
+@@ -34,7 +33,6 @@
+ 	"github.com/clastix/kamaji/controllers/soot"
+ 	"github.com/clastix/kamaji/internal"
+ 	"github.com/clastix/kamaji/internal/builders/controlplane"
+-	datastoreutils "github.com/clastix/kamaji/internal/datastore/utils"
+ 	"github.com/clastix/kamaji/internal/utilities"
+ 	"github.com/clastix/kamaji/internal/webhook"
+ 	"github.com/clastix/kamaji/internal/webhook/handlers"
+@@ -85,10 +83,6 @@
+
+ 			if webhookCABundle, err = os.ReadFile(webhookCAPath); err != nil {
+ 				return fmt.Errorf("unable to read webhook CA: %w", err)
+-			}
+-
+-			if err = datastoreutils.CheckExists(context.Background(), scheme, datastore); err != nil {
+-				return err
+ 			}
+
+ 			if controllerReconcileTimeout.Seconds() == 0 {

From 7dfb819a9c22c83739179f706e80f332b076ea43 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Sat, 21 Feb 2026 20:46:31 +0100
Subject: [PATCH 146/666] fix(kubevirt): disable serial console log to fix VM
 pod initialization

KubeVirt v1.6.x has a known issue (#15989) where the guest-console-log
init container blocks virt-launcher pods from starting. The container
runs virt-tail as a long-running sidecar but fails to properly function
as a Kubernetes native sidecar, causing all VM pods to get stuck in
PodInitializing state indefinitely.

Disable serial console logging globally via the KubeVirt CR to prevent
the problematic init container from being created.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/system/kubevirt/templates/kubevirt-cr.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/packages/system/kubevirt/templates/kubevirt-cr.yaml b/packages/system/kubevirt/templates/kubevirt-cr.yaml
index 7897789b..e6538a68 100644
--- a/packages/system/kubevirt/templates/kubevirt-cr.yaml
+++ b/packages/system/kubevirt/templates/kubevirt-cr.yaml
@@ -22,6 +22,8 @@ spec:
       - GPU
       - VMExport
     evictionStrategy: LiveMigrate
+    virtualMachineOptions:
+      disableSerialConsoleLog: {}
     vmRolloutStrategy: LiveUpdate
   workloadUpdateStrategy:
     workloadUpdateMethods:

From 799497605217b37c2a9feddd389f386705c8b49c Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Sat, 21 Feb 2026 20:58:57 +0000
Subject: [PATCH 147/666] Prepare release v1.0.0-rc.1

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 packages/apps/kubernetes/images/ubuntu-container-disk.tag   | 2 +-
 packages/core/installer/values.yaml                         | 4 ++--
 packages/core/platform/values.yaml                          | 4 ++--
 packages/core/testing/values.yaml                           | 2 +-
 packages/extra/bootbox/images/matchbox.tag                  | 2 +-
 packages/extra/seaweedfs/images/objectstorage-sidecar.tag   | 2 +-
 packages/system/backup-controller/values.yaml               | 2 +-
 packages/system/backupstrategy-controller/values.yaml       | 2 +-
 packages/system/cozystack-api/values.yaml                   | 2 +-
 packages/system/cozystack-controller/values.yaml            | 2 +-
 packages/system/dashboard/templates/configmap.yaml          | 2 +-
 packages/system/dashboard/values.yaml                       | 6 +++---
 .../system/grafana-operator/images/grafana-dashboards.tag   | 2 +-
 packages/system/kamaji/values.yaml                          | 4 ++--
 packages/system/kubeovn-plunger/values.yaml                 | 2 +-
 packages/system/kubeovn-webhook/values.yaml                 | 2 +-
 packages/system/lineage-controller-webhook/values.yaml      | 2 +-
 packages/system/linstor/values.yaml                         | 2 +-
 packages/system/objectstorage-controller/values.yaml        | 2 +-
 packages/system/seaweedfs/values.yaml                       | 2 +-
 20 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk.tag b/packages/apps/kubernetes/images/ubuntu-container-disk.tag
index 5b0830a6..ddc7baa4 100644
--- a/packages/apps/kubernetes/images/ubuntu-container-disk.tag
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.33@sha256:19ee4c76f0b3b7b40b97995ca78988ad8c82f6e9c75288d8b7b4b88a64f75d50
+ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.35@sha256:39f626c802dd84f95720ffb54fcd80dfb8a58ac280498870d0a1aa30d4252f94
diff --git a/packages/core/installer/values.yaml b/packages/core/installer/values.yaml
index 68894b3e..4fe99292 100644
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -1,9 +1,9 @@
 cozystackOperator:
   # Deployment variant: talos, generic, hosted
   variant: talos
-  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.0.0-beta.6@sha256:c7490da9c1ccb51bff4dd5657ca6a33a29ac71ad9861dfa8c72fdfc8b5765b93
+  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.0.0-rc.1@sha256:5c0148116b2ab425106f6b86bbc1dfec593a83c993947c24eae92946d1c6116a
   platformSourceUrl: 'oci://ghcr.io/cozystack/cozystack/cozystack-packages'
-  platformSourceRef: 'digest=sha256:b29b87d1a2b80452ffd4db7516a102c30c55121552dcdb237055d4124d12c55d'
+  platformSourceRef: 'digest=sha256:b4ee831911b9c259a073f00390559f0bd5d8c78e22e48427a64ef05ed90ca008'
 # Generic variant configuration (only used when cozystackOperator.variant=generic)
 cozystack:
   # Kubernetes API server host (IP only, no protocol/port)
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index 1d62c87f..ae005a89 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -5,7 +5,7 @@ sourceRef:
   path: /
 migrations:
   enabled: false
-  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0-beta.6@sha256:37c78dafcedbdad94acd9912550db0b4875897150666b8a06edfa894de99064e
+  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0-rc.1@sha256:21a09c9f8dfd0a0c9b8c14c70029a39bfce021c66f1d4cacad9764c35dce6e8f
   targetVersion: 33
 # Bundle deployment configuration
 bundles:
@@ -46,7 +46,7 @@ publishing:
   apiServerEndpoint: "" # example: "https://api.example.org"
   externalIPs: []
   certificates:
-    solver: http01      # "http01" or "dns01"
+    solver: http01 # "http01" or "dns01"
     issuerName: letsencrypt-prod
 # Authentication configuration
 authentication:
diff --git a/packages/core/testing/values.yaml b/packages/core/testing/values.yaml
index 0692cab6..2ee9cb53 100644
--- a/packages/core/testing/values.yaml
+++ b/packages/core/testing/values.yaml
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.0.0-beta.6@sha256:09af5901abcbed2b612d2d93c163e8ad3948bc55a1d8beae714b4fb2b8f7d91d
+  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.0.0-rc.1@sha256:0eae9f519669667d60b160ebb93c127843c470ad9ca3447fceaa54604503a7ba
diff --git a/packages/extra/bootbox/images/matchbox.tag b/packages/extra/bootbox/images/matchbox.tag
index 9729ce6e..3ecbbec2 100644
--- a/packages/extra/bootbox/images/matchbox.tag
+++ b/packages/extra/bootbox/images/matchbox.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/matchbox:v1.0.0-beta.6@sha256:212f624957447f5a932fd5d4564eb8c97694d336b7dc877a2833c1513c0d074d
+ghcr.io/cozystack/cozystack/matchbox:v1.0.0-rc.1@sha256:3306de19f1ad49a02c735d16b82d7c2ec015c8e0563f120f216274e9a3804431
diff --git a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
index 9657b956..6b014ed4 100644
--- a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
+++ b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-beta.6@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0
+ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-rc.1@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0
diff --git a/packages/system/backup-controller/values.yaml b/packages/system/backup-controller/values.yaml
index 9ce9bac9..a58e33fa 100644
--- a/packages/system/backup-controller/values.yaml
+++ b/packages/system/backup-controller/values.yaml
@@ -1,5 +1,5 @@
 backupController:
-  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.0.0-beta.6@sha256:365214a74ffc34a9314a62a7d4b491590051fc5486f6bae9913c0c1289983d43"
+  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.0.0-rc.1@sha256:0bb4173bdcd3d917a7bd358ecc2c6a053a06ab0bd1fcdb89d1016a66173e6dfb"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/backupstrategy-controller/values.yaml b/packages/system/backupstrategy-controller/values.yaml
index d74557a0..748f515a 100644
--- a/packages/system/backupstrategy-controller/values.yaml
+++ b/packages/system/backupstrategy-controller/values.yaml
@@ -1,5 +1,5 @@
 backupStrategyController:
-  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.0.0-beta.6@sha256:aa04ee61dce11950162606fc8db2d5cbc6f5b32ba700f790b3f1eee10d65efb1"
+  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.0.0-rc.1@sha256:c2d975574ea9edcd785b533e01add37909959a64ef815529162dfe1f472ea702"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/cozystack-api/values.yaml b/packages/system/cozystack-api/values.yaml
index cc6279bc..f316ec8d 100644
--- a/packages/system/cozystack-api/values.yaml
+++ b/packages/system/cozystack-api/values.yaml
@@ -1,3 +1,3 @@
 cozystackAPI:
-  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.0.0-beta.6@sha256:d89cf68fb622d0dbef7db98db09d352efc93c2cce448d11f2d73dcd363e911b7
+  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.0.0-rc.1@sha256:9195ac6ef1d29aba3e1903f29a9aeeb72f5bf7ba3dbd7ebd866a06a4433e5915
   replicas: 2
diff --git a/packages/system/cozystack-controller/values.yaml b/packages/system/cozystack-controller/values.yaml
index 7a17c992..03f0aa4d 100644
--- a/packages/system/cozystack-controller/values.yaml
+++ b/packages/system/cozystack-controller/values.yaml
@@ -1,4 +1,4 @@
 cozystackController:
-  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.0.0-beta.6@sha256:d55a3c288934b1f69a00321bc8a94776915556b5f882fe6ac615e9de2701c61f
+  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.0.0-rc.1@sha256:0ac4b6d55daf79e2a7a045cd21b48ba598ac2628442fd9c4d0556cf9af6b83be
   debug: false
   disableTelemetry: false
diff --git a/packages/system/dashboard/templates/configmap.yaml b/packages/system/dashboard/templates/configmap.yaml
index 3ac5029e..0e47e906 100644
--- a/packages/system/dashboard/templates/configmap.yaml
+++ b/packages/system/dashboard/templates/configmap.yaml
@@ -1,6 +1,6 @@
 {{- $brandingConfig := .Values._cluster.branding | default dict }}
 
-{{- $tenantText := "v1.0.0-beta.6" }}
+{{- $tenantText := "v1.0.0-rc.1" }}
 {{- $footerText := "Cozystack" }}
 {{- $titleText := "Cozystack Dashboard" }}
 {{- $logoText := "" }}
diff --git a/packages/system/dashboard/values.yaml b/packages/system/dashboard/values.yaml
index 32823845..3f075524 100644
--- a/packages/system/dashboard/values.yaml
+++ b/packages/system/dashboard/values.yaml
@@ -1,6 +1,6 @@
 openapiUI:
-  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.0.0-beta.6@sha256:c333637673a9e878f6c4ed0fc96db55967bbcf94b2434d075b0f0c6fcfcf9eff
+  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.0.0-rc.1@sha256:26e787b259ab8722d61f89e07eda200ef2180ed10b0df8596d75bba15526feb0
 openapiUIK8sBff:
-  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.0.0-beta.6@sha256:1b3ea6d4c7dbbe6a8def3b2807fffdfab2ac4afc39d7a846e57dd491fa168f92
+  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.0.0-rc.1@sha256:0f508427bfa5a650eda6c5ef01ea32a586ac485a54902d7649ec49cc84f676f7
 tokenProxy:
-  image: ghcr.io/cozystack/cozystack/token-proxy:v1.0.0-beta.6@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
+  image: ghcr.io/cozystack/cozystack/token-proxy:v1.0.0-rc.1@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
diff --git a/packages/system/grafana-operator/images/grafana-dashboards.tag b/packages/system/grafana-operator/images/grafana-dashboards.tag
index 10837c35..2c79dbbf 100644
--- a/packages/system/grafana-operator/images/grafana-dashboards.tag
+++ b/packages/system/grafana-operator/images/grafana-dashboards.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/grafana-dashboards:v1.0.0-beta.6@sha256:7a3c9af59f8d74d5a23750bbc845c7de64610dbd4d4f84011e10be037b3ce2a0
+ghcr.io/cozystack/cozystack/grafana-dashboards:v1.0.0-rc.1@sha256:7a3c9af59f8d74d5a23750bbc845c7de64610dbd4d4f84011e10be037b3ce2a0
diff --git a/packages/system/kamaji/values.yaml b/packages/system/kamaji/values.yaml
index 334a5e92..98f7750d 100644
--- a/packages/system/kamaji/values.yaml
+++ b/packages/system/kamaji/values.yaml
@@ -3,7 +3,7 @@ kamaji:
     deploy: false
   image:
     pullPolicy: IfNotPresent
-    tag: v1.0.0-beta.6@sha256:05f8e166dc94aadb74cd6448f6f96fbd2167057a559097516a41b8f53e434918
+    tag: v1.0.0-rc.1@sha256:0ca47c0d72a198f52f029bea30e89557680eac65c7914369b092d8ed9cc9997b
     repository: ghcr.io/cozystack/cozystack/kamaji
   resources:
     limits:
@@ -13,4 +13,4 @@ kamaji:
       cpu: 100m
       memory: 100Mi
   extraArgs:
-    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.0.0-beta.6@sha256:05f8e166dc94aadb74cd6448f6f96fbd2167057a559097516a41b8f53e434918
+    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.0.0-rc.1@sha256:0ca47c0d72a198f52f029bea30e89557680eac65c7914369b092d8ed9cc9997b
diff --git a/packages/system/kubeovn-plunger/values.yaml b/packages/system/kubeovn-plunger/values.yaml
index c8357c90..05396993 100644
--- a/packages/system/kubeovn-plunger/values.yaml
+++ b/packages/system/kubeovn-plunger/values.yaml
@@ -1,4 +1,4 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.0.0-beta.6@sha256:8e964605efe54e73a94c84abec7dbb5a011c02ccece282bef8ae7b70fce3d217
+image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.0.0-rc.1@sha256:6be9aa4b2dda15bf7300bd961cbc71c8bbf9ce97bc3cf613ef5a012d329b4e70
 ovnCentralName: ovn-central
diff --git a/packages/system/kubeovn-webhook/values.yaml b/packages/system/kubeovn-webhook/values.yaml
index b602e6df..3e266917 100644
--- a/packages/system/kubeovn-webhook/values.yaml
+++ b/packages/system/kubeovn-webhook/values.yaml
@@ -1,3 +1,3 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.0.0-beta.6@sha256:e18f9fd679e38f65362a8d0042f25468272f6d081136ad47027168d8e7e07a4a
+image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.0.0-rc.1@sha256:e18f9fd679e38f65362a8d0042f25468272f6d081136ad47027168d8e7e07a4a
diff --git a/packages/system/lineage-controller-webhook/values.yaml b/packages/system/lineage-controller-webhook/values.yaml
index 2a9b2941..f0afeb75 100644
--- a/packages/system/lineage-controller-webhook/values.yaml
+++ b/packages/system/lineage-controller-webhook/values.yaml
@@ -1,5 +1,5 @@
 lineageControllerWebhook:
-  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.0.0-beta.6@sha256:cf577e56ebc2b94205741d9c5b08f2983cec0811f0c2890edca8fdca22624de1
+  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.0.0-rc.1@sha256:473ed28fcd7ddc35319a0fd33dd0fff3e56491b572677545a6e317b53578c53d
   debug: false
   localK8sAPIEndpoint:
     enabled: true
diff --git a/packages/system/linstor/values.yaml b/packages/system/linstor/values.yaml
index bec791ee..23240e86 100644
--- a/packages/system/linstor/values.yaml
+++ b/packages/system/linstor/values.yaml
@@ -1,7 +1,7 @@
 piraeusServer:
   image:
     repository: ghcr.io/cozystack/cozystack/piraeus-server
-    tag: 1.32.3@sha256:66eadfc98cd809d2b3c4e6fd631bcd0c4b4cd72a7fb819ac4a0cab7904280546
+    tag: 1.32.3@sha256:59806529a090cb42e2fa2696e09814282b80e76a299b5fe9feec46772edd6876
 # Talos-specific workarounds (disable for generic Linux like Ubuntu/Debian)
 talos:
   enabled: true
diff --git a/packages/system/objectstorage-controller/values.yaml b/packages/system/objectstorage-controller/values.yaml
index a270a7e8..d402d874 100644
--- a/packages/system/objectstorage-controller/values.yaml
+++ b/packages/system/objectstorage-controller/values.yaml
@@ -1,3 +1,3 @@
 objectstorage:
   controller:
-    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.0.0-beta.6@sha256:b4c972769afda76c48b58e7acf0ac66a0abf16a622f245c60338f432872f640a"
+    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.0.0-rc.1@sha256:b4c972769afda76c48b58e7acf0ac66a0abf16a622f245c60338f432872f640a"
diff --git a/packages/system/seaweedfs/values.yaml b/packages/system/seaweedfs/values.yaml
index e62cd357..7e646322 100644
--- a/packages/system/seaweedfs/values.yaml
+++ b/packages/system/seaweedfs/values.yaml
@@ -177,7 +177,7 @@ seaweedfs:
     bucketClassName: "seaweedfs"
     region: ""
     sidecar:
-      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-beta.6@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0"
+      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-rc.1@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0"
   certificates:
     commonName: "SeaweedFS CA"
     ipAddresses: []

From 9fa311e5acd75a3af44648ff36a4d3b89d6f356b Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Sat, 21 Feb 2026 21:07:45 +0000
Subject: [PATCH 148/666] docs: add changelog for v1.0.0-rc.1

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.0.0-rc.1.md | 65 ++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)
 create mode 100644 docs/changelogs/v1.0.0-rc.1.md

diff --git a/docs/changelogs/v1.0.0-rc.1.md b/docs/changelogs/v1.0.0-rc.1.md
new file mode 100644
index 00000000..0fabe1b6
--- /dev/null
+++ b/docs/changelogs/v1.0.0-rc.1.md
@@ -0,0 +1,65 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.0.0-rc.1
+-->
+
+> **⚠️ Release Candidate Warning**: This is a release candidate intended for final validation before the stable v1.0.0 release. Breaking changes are not expected at this stage, but please test thoroughly before deploying to production.
+
+## Features and Improvements
+
+* **[harbor] Add managed Harbor container registry**: Added Harbor v2.14.2 as a managed tenant-level container registry service. The application uses CloudNativePG for PostgreSQL, the Redis operator for caching, and S3 via COSI BucketClaim (from SeaweedFS) for registry image storage. Auto-generated admin credentials are persisted across upgrades, TLS is handled by cert-manager, and Trivy vulnerability scanner is included. Users can now deploy a fully managed, production-ready OCI container registry within their tenant ([**@lexfrei**](https://github.com/lexfrei) in #2058).
+
+* **[kubernetes] Update supported Kubernetes versions to v1.30–v1.35**: Updated the tenant Kubernetes version matrix to v1.30, v1.31, v1.32, v1.33, v1.34, and v1.35 (now the default). EOL versions v1.28 and v1.29 are removed. Kamaji is updated to edge-26.2.4 with full Kubernetes 1.35 support, and the CAPI Kamaji provider is updated to v0.16.0. A compatibility patch ensures kubelets older than v1.35 are not broken by Kamaji injecting 1.35-specific kubelet fields ([**@lexfrei**](https://github.com/lexfrei) in #2073).
+
+* **[platform] Make cluster issuer name and ACME solver configurable**: Added `publishing.certificates.solver` (`http01` or `dns01`) and `publishing.certificates.issuerName` (default: `letsencrypt-prod`) parameters to the platform chart. This allows operators to point all ingress TLS annotations at any ClusterIssuer — custom ACME, self-signed, or internal CA — without modifying individual package templates. See the Breaking Changes section for the rename from the previous `issuerType` field ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2077).
+
+* **[dashboard] VMInstance dropdowns for disks and instanceType**: The VM instance creation form now renders API-backed dropdowns for the `instanceType` field (populated from `VirtualMachineClusterInstancetype` cluster resources) and for disk `name` fields (populated from `VMDisk` resources in the same namespace). Default values are read from the ApplicationDefinition's OpenAPI schema. This eliminates manual lookups and reduces misconfiguration when attaching disks or selecting VM instance types ([**@sircthulhu**](https://github.com/sircthulhu) in #2071).
+
+* **[installer] Remove CRDs from Helm chart, delegate lifecycle to operator**: The `cozy-installer` Helm chart no longer ships CRDs in its `crds/` directory. CRD lifecycle is now fully managed by the Cozystack operator via the `--install-crds` flag, which applies embedded CRD manifests on every startup using server-side apply. The platform PackageSource is also created by the operator instead of a Helm template. This ensures CRDs and the PackageSource are always up to date after each operator restart, eliminating stale CRDs from Helm's install-only behavior ([**@lexfrei**](https://github.com/lexfrei) in #2074).
+
+## Fixes
+
+* **[kubevirt] Update KubeVirt to v1.6.4 and CDI to v1.64.0, fix VM pod initialization**: Updated KubeVirt operator to v1.6.4 and CDI operator to v1.64.0, including live migration of existing VMs during the upgrade. Additionally, disabled serial console logging globally via the KubeVirt CR to prevent a known v1.6.x issue ([upstream #15989](https://github.com/kubevirt/kubevirt/issues/15989)) where the `guest-console-log` init container blocked virt-launcher pods from starting, causing all VMs to get stuck in `PodInitializing` state ([**@nbykov0**](https://github.com/nbykov0) in #1833; [**@kvaps**](https://github.com/kvaps) in 7dfb819).
+
+* **[linstor] Fix DRBD+LUKS+STORAGE resource creation failure**: All newly created encrypted volumes were failing because the DRBD `.res` file was never written due to a missing `setExists(true)` call in the `LuksLayer`. Applied the upstream `skip-adjust-when-device-inaccessible` patch ([LINBIT/linstor-server#477](https://github.com/LINBIT/linstor-server/pull/477)) which fixes the root cause and also prevents unnecessary lsblk calls when devices are not yet physically present ([**@kvaps**](https://github.com/kvaps) in #2072).
+
+* **[system] Fix monitoring-agents FQDN resolution for tenant workload clusters**: Monitoring agents (`vmagent`, `fluent-bit`) in tenant workload clusters were failing to deliver metrics and logs because service addresses used short DNS names without the cluster domain suffix. Fixed by appending the configured cluster domain from `_cluster.cluster-domain` (with fallback to `cluster.local`) to all vmagent remoteWrite URLs and fluent-bit output hosts ([**@IvanHunters**](https://github.com/IvanHunters) in #2075).
+
+* **[cozystack-basics] Preserve existing HelmRelease values during reconciliations**: Fixed a data-loss bug where changes made to the `tenant-root` HelmRelease were silently dropped on the next forced or upgrade reconciliation of the `cozystack-basics` HelmRelease. The reconciler now merges new configuration with existing values instead of overwriting them ([**@sircthulhu**](https://github.com/sircthulhu) in #2068).
+
+* **[cozystack-basics] Deny resourcequotas deletion for tenant admin**: Fixed the `cozy:tenant:admin:base` ClusterRole to explicitly deny deletion of `ResourceQuota` objects for tenant admins and superadmins, preventing accidental removal of tenant resource limits ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2076).
+
+## Breaking Changes & Upgrade Notes
+
+* **[platform] Certificate issuer configuration parameters renamed**: The `publishing.certificates.issuerType` field is renamed to `publishing.certificates.solver`, and the value `cloudflare` is renamed to `dns01` to align with standard ACME terminology. A new `publishing.certificates.issuerName` field (default: `letsencrypt-prod`) is introduced to allow pointing all ingresses at a custom ClusterIssuer. Migration 32 is included and automatically converts existing configurations during upgrade — no manual action is required ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2077).
+
+## Documentation
+
+* **[website] Migrate ConfigMap references to Platform Package in v1 documentation**: Updated the entire v1 documentation tree to replace legacy ConfigMap-based configuration references with the new Platform Package API, ensuring guides are consistent with the v1 configuration model ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#426).
+
+* **[website] Add generic Kubernetes deployment guide for v1**: Added a new installation guide covering Cozystack deployment on any generic Kubernetes cluster, expanding the set of supported deployment targets beyond provider-specific guides ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#408).
+
+* **[website] Refactor resource planning documentation**: Improved the resource planning guide with a clearer structure and more comprehensive coverage of planning considerations for Cozystack deployments ([**@IvanStukov**](https://github.com/IvanStukov) in cozystack/website#423).
+
+* **[website] Add ServiceAccount API access documentation and update FAQ**: Added a new article documenting ServiceAccount API access token configuration and updated the FAQ to include related troubleshooting guidance ([**@IvanStukov**](https://github.com/IvanStukov) in cozystack/website#421).
+
+* **[website] Update networking-mesh allowed-location-ips example**: Replaced provider-specific CLI usage with standard `kubectl` commands in the multi-location networking guide's `allowed-location-ips` example, making the documentation more universally applicable ([**@kvaps**](https://github.com/kvaps) in cozystack/website#425).
+
+## Contributors
+
+We'd like to thank all contributors who made this release possible:
+
+* [**@IvanHunters**](https://github.com/IvanHunters)
+* [**@IvanStukov**](https://github.com/IvanStukov)
+* [**@kvaps**](https://github.com/kvaps)
+* [**@lexfrei**](https://github.com/lexfrei)
+* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
+* [**@nbykov0**](https://github.com/nbykov0)
+* [**@sircthulhu**](https://github.com/sircthulhu)
+
+### New Contributors
+
+We're excited to welcome our first-time contributors:
+
+* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil) - First contribution!
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.0-beta.6...v1.0.0-rc.1

From 473ac87d704dffd6b30a837f9fe74d286928e803 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Sat, 21 Feb 2026 22:17:08 +0100
Subject: [PATCH 149/666] docs(changelogs): add missing changelogs for
 v0.40.5-v0.40.7 and v0.41.4-v0.41.9

Add 9 missing patch release changelogs covering changes from
January to February 2026. All PR authors verified via GitHub CLI.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 docs/changelogs/v0.40.5.md | 15 +++++++++++++++
 docs/changelogs/v0.40.6.md | 11 +++++++++++
 docs/changelogs/v0.40.7.md | 11 +++++++++++
 docs/changelogs/v0.41.4.md | 11 +++++++++++
 docs/changelogs/v0.41.5.md | 21 +++++++++++++++++++++
 docs/changelogs/v0.41.6.md | 17 +++++++++++++++++
 docs/changelogs/v0.41.7.md | 15 +++++++++++++++
 docs/changelogs/v0.41.8.md | 17 +++++++++++++++++
 docs/changelogs/v0.41.9.md | 15 +++++++++++++++
 9 files changed, 133 insertions(+)
 create mode 100644 docs/changelogs/v0.40.5.md
 create mode 100644 docs/changelogs/v0.40.6.md
 create mode 100644 docs/changelogs/v0.40.7.md
 create mode 100644 docs/changelogs/v0.41.4.md
 create mode 100644 docs/changelogs/v0.41.5.md
 create mode 100644 docs/changelogs/v0.41.6.md
 create mode 100644 docs/changelogs/v0.41.7.md
 create mode 100644 docs/changelogs/v0.41.8.md
 create mode 100644 docs/changelogs/v0.41.9.md

diff --git a/docs/changelogs/v0.40.5.md b/docs/changelogs/v0.40.5.md
new file mode 100644
index 00000000..40ebd107
--- /dev/null
+++ b/docs/changelogs/v0.40.5.md
@@ -0,0 +1,15 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v0.40.5
+-->
+
+## Improvements
+
+* **[dashboard] Improve dashboard session params**: Improved session parameter handling in the dashboard for better user experience and more reliable session management ([**@lllamnyp**](https://github.com/lllamnyp) in #1913, #1919).
+
+## Dependencies
+
+* **Update cozyhr to v1.6.1**: Updated cozyhr to v1.6.1, which fixes a critical bug causing helm-controller v0.37.0+ to unexpectedly uninstall HelmReleases after cozyhr apply by correcting history snapshot fields for helm-controller compatibility ([**@kvaps**](https://github.com/kvaps) in cozystack/cozyhr#10).
+
+---
+
+**Full Changelog**: [v0.40.4...v0.40.5](https://github.com/cozystack/cozystack/compare/v0.40.4...v0.40.5)
diff --git a/docs/changelogs/v0.40.6.md b/docs/changelogs/v0.40.6.md
new file mode 100644
index 00000000..40e499f5
--- /dev/null
+++ b/docs/changelogs/v0.40.6.md
@@ -0,0 +1,11 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v0.40.6
+-->
+
+## Fixes
+
+* **[kubernetes] Fix manifests for kubernetes deployment**: Fixed incorrect manifests that prevented proper Kubernetes deployment, restoring correct application behavior ([**@IvanHunters**](https://github.com/IvanHunters) in #1943, #1944).
+
+---
+
+**Full Changelog**: [v0.40.5...v0.40.6](https://github.com/cozystack/cozystack/compare/v0.40.5...v0.40.6)
diff --git a/docs/changelogs/v0.40.7.md b/docs/changelogs/v0.40.7.md
new file mode 100644
index 00000000..f1b7a52e
--- /dev/null
+++ b/docs/changelogs/v0.40.7.md
@@ -0,0 +1,11 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v0.40.7
+-->
+
+## Security
+
+* **[dashboard] Verify JWT token**: Added JWT token verification to the dashboard, ensuring that authentication tokens are properly validated before granting access. This prevents unauthorized access through forged or expired tokens ([**@lllamnyp**](https://github.com/lllamnyp) in #1980, #1984).
+
+---
+
+**Full Changelog**: [v0.40.6...v0.40.7](https://github.com/cozystack/cozystack/compare/v0.40.6...v0.40.7)
diff --git a/docs/changelogs/v0.41.4.md b/docs/changelogs/v0.41.4.md
new file mode 100644
index 00000000..70f1daeb
--- /dev/null
+++ b/docs/changelogs/v0.41.4.md
@@ -0,0 +1,11 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v0.41.4
+-->
+
+## Dependencies
+
+* **Update cozyhr to v1.6.1**: Updated cozyhr to v1.6.1, which fixes a critical bug causing helm-controller v0.37.0+ to unexpectedly uninstall HelmReleases after cozyhr apply by correcting history snapshot fields for helm-controller compatibility ([**@kvaps**](https://github.com/kvaps) in cozystack/cozyhr#10).
+
+---
+
+**Full Changelog**: [v0.41.3...v0.41.4](https://github.com/cozystack/cozystack/compare/v0.41.3...v0.41.4)
diff --git a/docs/changelogs/v0.41.5.md b/docs/changelogs/v0.41.5.md
new file mode 100644
index 00000000..fb96fcf4
--- /dev/null
+++ b/docs/changelogs/v0.41.5.md
@@ -0,0 +1,21 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v0.41.5
+-->
+
+## Features and Improvements
+
+* **[dashboard] Add "Edit" button to all resources**: Added an "Edit" button across all resource views in the dashboard, allowing users to modify resource configurations directly from the UI ([**@sircthulhu**](https://github.com/sircthulhu) in #1928, #1931).
+
+* **[dashboard] Add resource quota usage to tenant details page**: Added resource quota usage display to the tenant details page, giving administrators visibility into how much of allocated resources each tenant is consuming ([**@sircthulhu**](https://github.com/sircthulhu) in #1929, #1932).
+
+* **[branding] Separate values for keycloak**: Separated Keycloak branding values into dedicated configuration, allowing more granular customization of Keycloak appearance without affecting other branding settings ([**@nbykov0**](https://github.com/nbykov0) in #1946).
+
+* **Add instance profile label to workload monitor**: Added instance profile metadata labels to the workload monitor, enabling better resource tracking and monitoring by instance profile type ([**@matthieu-robin**](https://github.com/matthieu-robin) in #1954, #1957).
+
+## Fixes
+
+* **[kubernetes] Fix manifests for kubernetes deployment**: Fixed incorrect manifests that prevented proper Kubernetes deployment, restoring correct application behavior ([**@IvanHunters**](https://github.com/IvanHunters) in #1943, #1945).
+
+---
+
+**Full Changelog**: [v0.41.4...v0.41.5](https://github.com/cozystack/cozystack/compare/v0.41.4...v0.41.5)
diff --git a/docs/changelogs/v0.41.6.md b/docs/changelogs/v0.41.6.md
new file mode 100644
index 00000000..8e7783df
--- /dev/null
+++ b/docs/changelogs/v0.41.6.md
@@ -0,0 +1,17 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v0.41.6
+-->
+
+## Improvements
+
+* **[vm] Allow changing field external after creation**: Users can now modify the external network field on virtual machines after initial creation, providing more flexibility in VM networking configuration without requiring recreation ([**@sircthulhu**](https://github.com/sircthulhu) in #1956, #1962).
+
+* **[branding] Separate values for keycloak**: Separated Keycloak branding values into dedicated configuration for more granular customization of Keycloak appearance ([**@nbykov0**](https://github.com/nbykov0) in #1947, #1963).
+
+## Fixes
+
+* **[kubernetes] Fix coredns serviceaccount to match kubernetes bootstrap RBAC**: Configured the CoreDNS chart to create a `kube-dns` ServiceAccount matching the Kubernetes bootstrap ClusterRoleBinding, fixing RBAC errors (`Failed to watch`) when CoreDNS pods restart ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #1958, #1978).
+
+---
+
+**Full Changelog**: [v0.41.5...v0.41.6](https://github.com/cozystack/cozystack/compare/v0.41.5...v0.41.6)
diff --git a/docs/changelogs/v0.41.7.md b/docs/changelogs/v0.41.7.md
new file mode 100644
index 00000000..5a77664d
--- /dev/null
+++ b/docs/changelogs/v0.41.7.md
@@ -0,0 +1,15 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v0.41.7
+-->
+
+## Security
+
+* **[dashboard] Verify JWT token**: Added JWT token verification to the dashboard, ensuring that authentication tokens are properly validated before granting access. This prevents unauthorized access through forged or expired tokens ([**@lllamnyp**](https://github.com/lllamnyp) in #1980, #1983).
+
+## Fixes
+
+* **[postgres-operator] Correct PromQL syntax in CNPGClusterOffline alert**: Fixed incorrect PromQL syntax in the `CNPGClusterOffline` alert rule for CloudNativePG, ensuring the alert fires correctly when all instances of a PostgreSQL cluster are offline ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #1981, #1989).
+
+---
+
+**Full Changelog**: [v0.41.6...v0.41.7](https://github.com/cozystack/cozystack/compare/v0.41.6...v0.41.7)
diff --git a/docs/changelogs/v0.41.8.md b/docs/changelogs/v0.41.8.md
new file mode 100644
index 00000000..9984c87d
--- /dev/null
+++ b/docs/changelogs/v0.41.8.md
@@ -0,0 +1,17 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v0.41.8
+-->
+
+## Features and Improvements
+
+* **[kubernetes] Auto-enable Gateway API support in cert-manager**: cert-manager now automatically enables `enableGatewayAPI` when the Gateway API addon is active in the Kubernetes application. Users no longer need to manually configure this setting, and the option can still be overridden via `valuesOverride` ([**@kvaps**](https://github.com/kvaps) in #1997, #2012).
+
+* **[vm] Allow switching between instancetype and custom resources**: Users can now switch virtual machines between instancetype-based and custom resource configurations after creation. The upgrade hook atomically patches VM resources, providing more flexibility in adjusting VM sizing without recreation ([**@sircthulhu**](https://github.com/sircthulhu) in #2008, #2013).
+
+## Fixes
+
+* **[dashboard] Add startupProbe to prevent container restarts on slow hardware**: Added `startupProbe` to both `bff` and `web` containers in the dashboard deployment. On slow hardware, kubelet was killing containers because the `livenessProbe` only allowed ~33 seconds for startup. The `startupProbe` gives containers up to 60 seconds to start before `livenessProbe` kicks in ([**@kvaps**](https://github.com/kvaps) in #1996, #2014).
+
+---
+
+**Full Changelog**: [v0.41.7...v0.41.8](https://github.com/cozystack/cozystack/compare/v0.41.7...v0.41.8)
diff --git a/docs/changelogs/v0.41.9.md b/docs/changelogs/v0.41.9.md
new file mode 100644
index 00000000..d0cd3ff9
--- /dev/null
+++ b/docs/changelogs/v0.41.9.md
@@ -0,0 +1,15 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v0.41.9
+-->
+
+## Fixes
+
+* **[cozystack-basics] Deny resourcequotas deletion for tenant admin**: Prevented tenant administrators from deleting resource quotas, ensuring that resource limits set by platform administrators cannot be bypassed by tenant-level users ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2076).
+
+## Dependencies
+
+* **Update Kube-OVN to v1.15.3**: Updated Kube-OVN CNI to v1.15.3 with latest bug fixes and improvements ([**@kvaps**](https://github.com/kvaps)).
+
+---
+
+**Full Changelog**: [v0.41.8...v0.41.9](https://github.com/cozystack/cozystack/compare/v0.41.8...v0.41.9)

From d8bb3527de35b300beec8cf7f2cde2deb9ca6936 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Mon, 23 Feb 2026 16:15:36 +0100
Subject: [PATCH 150/666] fix(monitoring-agents): revert _cluster FQDN and use
 cluster-domain in tenant HelmRelease

PR #2075 added _cluster.cluster-domain references to monitoring-agents
values.yaml for FQDN resolution. This broke fluent-bit because it is
a subchart where _cluster values are not accessible (only global
values are shared with subcharts), causing "index of untyped nil".

Revert values.yaml to short DNS names (.svc) for the management
cluster where they resolve locally, and add FQDN with cluster-domain
suffix in the tenant kubernetes HelmRelease where _cluster values are
available and cross-cluster DNS resolution is needed.

Closes #2084

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../templates/helmreleases/monitoring-agents.yaml      |  5 +++--
 packages/system/monitoring-agents/values.yaml          | 10 +++++-----
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml b/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml
index ff54b6e2..602f7efb 100644
--- a/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml
@@ -1,4 +1,5 @@
 {{- $targetTenant := .Values._namespace.monitoring }}
+{{- $clusterDomain := (index .Values._cluster "cluster-domain") | default "cozy.local" }}
 {{- if .Values.addons.monitoringAgents.enabled }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
@@ -49,7 +50,7 @@ spec:
         cluster: {{ .Release.Name }}
         tenant: {{ .Release.Namespace }}
       remoteWrite:
-        url: http://vminsert-shortterm.{{ $targetTenant }}.svc:8480/insert/0/prometheus
+        url: http://vminsert-shortterm.{{ $targetTenant }}.svc.{{ $clusterDomain }}:8480/insert/0/prometheus
     fluent-bit:
       readinessProbe:
         httpGet:
@@ -72,7 +73,7 @@ spec:
           [OUTPUT]
               Name http
               Match kube.*
-              Host vlogs-generic.{{ $targetTenant }}.svc
+              Host vlogs-generic.{{ $targetTenant }}.svc.{{ $clusterDomain }}
               port 9428
               compress gzip
               uri /insert/jsonline?_stream_fields=stream,kubernetes_pod_name,kubernetes_container_name,kubernetes_namespace_name&_msg_field=log&_time_field=date
diff --git a/packages/system/monitoring-agents/values.yaml b/packages/system/monitoring-agents/values.yaml
index 2b208424..a4d4b025 100644
--- a/packages/system/monitoring-agents/values.yaml
+++ b/packages/system/monitoring-agents/values.yaml
@@ -280,8 +280,8 @@ vmagent:
     cluster: cozystack
   remoteWrite:
     urls:
-      - http://vminsert-shortterm.{{ .Values.global.target }}.svc.{{ (index .Values._cluster "cluster-domain") | default "cluster.local" }}:8480/insert/0/prometheus
-      - http://vminsert-longterm.{{ .Values.global.target }}.svc.{{ (index .Values._cluster "cluster-domain") | default "cluster.local" }}:8480/insert/0/prometheus
+      - http://vminsert-shortterm.{{ .Values.global.target }}.svc:8480/insert/0/prometheus
+      - http://vminsert-longterm.{{ .Values.global.target }}.svc:8480/insert/0/prometheus
   extraArgs: {}
 
 fluent-bit:
@@ -344,7 +344,7 @@ fluent-bit:
       [OUTPUT]
           Name http
           Match kube.*
-          Host vlogs-generic.{{ .Values.global.target }}.svc.{{ (index .Values._cluster "cluster-domain") | default "cluster.local" }}
+          Host vlogs-generic.{{ .Values.global.target }}.svc
           port 9428
           compress gzip
           uri /insert/jsonline?_stream_fields=log_source,stream,kubernetes_pod_name,kubernetes_container_name,kubernetes_namespace_name&_msg_field=log&_time_field=date
@@ -355,7 +355,7 @@ fluent-bit:
       [OUTPUT]
           Name http
           Match events.*
-          Host vlogs-generic.{{ .Values.global.target }}.svc.{{ (index .Values._cluster "cluster-domain") | default "cluster.local" }}
+          Host vlogs-generic.{{ .Values.global.target }}.svc
           port 9428
           compress gzip
           uri /insert/jsonline?_stream_fields=log_source,reason,meatdata_namespace,metadata_name&_msg_field=message&_time_field=date
@@ -366,7 +366,7 @@ fluent-bit:
       [OUTPUT]
           Name http
           Match audit.*
-          Host vlogs-generic.{{ .Values.global.target }}.svc.{{ (index .Values._cluster "cluster-domain") | default "cluster.local" }}
+          Host vlogs-generic.{{ .Values.global.target }}.svc
           port 9428
           compress gzip
           uri /insert/jsonline?_stream_fields=log_source,stage,user_username,verb,requestUri&_msg_field=requestURI&_time_field=date

From 211e01bd875f41892df7488d91934c0f0f696bcd Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Mon, 23 Feb 2026 16:33:27 +0100
Subject: [PATCH 151/666] fix(dashboard): hide Ingresses/Services/Secrets tabs
 when no selectors defined

Show these tabs only when the ApplicationDefinition has non-empty
Include or Exclude resource selectors for the corresponding type.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 internal/controller/dashboard/factory.go | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/internal/controller/dashboard/factory.go b/internal/controller/dashboard/factory.go
index 66ee111d..c0bed1f4 100644
--- a/internal/controller/dashboard/factory.go
+++ b/internal/controller/dashboard/factory.go
@@ -582,15 +582,18 @@ type factoryFlags struct {
 	Secrets   bool
 }
 
-// factoryFeatureFlags tries several conventional locations so you can evolve the API
-// without breaking the controller. Defaults are false (hidden).
+// factoryFeatureFlags determines which tabs to show based on whether the
+// ApplicationDefinition has non-empty resource selectors (Include or Exclude).
+// Workloads tab is always shown.
 func factoryFeatureFlags(crd *cozyv1alpha1.ApplicationDefinition) factoryFlags {
-	var f factoryFlags
-
-	f.Workloads = true
-	f.Ingresses = true
-	f.Services = true
-	f.Secrets = true
-
-	return f
+	return factoryFlags{
+		Workloads: true,
+		Ingresses: hasSelectors(crd.Spec.Ingresses),
+		Services:  hasSelectors(crd.Spec.Services),
+		Secrets:   hasSelectors(crd.Spec.Secrets),
+	}
+}
+
+func hasSelectors(res cozyv1alpha1.ApplicationDefinitionResources) bool {
+	return len(res.Include) > 0 || len(res.Exclude) > 0
 }

From 4f2578a32b16a2ae574dc8314512a8e8ce70e9bb Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Mon, 23 Feb 2026 20:20:03 +0100
Subject: [PATCH 152/666] fix(dashboard): check only Include selectors for tab
 visibility

Only show Ingresses/Services/Secrets tabs when Include selectors are
defined. Exclude selectors alone don't make resources visible as tenant
resources, so tabs would be empty.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 internal/controller/dashboard/factory.go | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/internal/controller/dashboard/factory.go b/internal/controller/dashboard/factory.go
index c0bed1f4..539e503b 100644
--- a/internal/controller/dashboard/factory.go
+++ b/internal/controller/dashboard/factory.go
@@ -583,17 +583,13 @@ type factoryFlags struct {
 }
 
 // factoryFeatureFlags determines which tabs to show based on whether the
-// ApplicationDefinition has non-empty resource selectors (Include or Exclude).
+// ApplicationDefinition has non-empty Include resource selectors.
 // Workloads tab is always shown.
 func factoryFeatureFlags(crd *cozyv1alpha1.ApplicationDefinition) factoryFlags {
 	return factoryFlags{
 		Workloads: true,
-		Ingresses: hasSelectors(crd.Spec.Ingresses),
-		Services:  hasSelectors(crd.Spec.Services),
-		Secrets:   hasSelectors(crd.Spec.Secrets),
+		Ingresses: len(crd.Spec.Ingresses.Include) > 0,
+		Services:  len(crd.Spec.Services.Include) > 0,
+		Secrets:   len(crd.Spec.Secrets.Include) > 0,
 	}
 }
-
-func hasSelectors(res cozyv1alpha1.ApplicationDefinitionResources) bool {
-	return len(res.Include) > 0 || len(res.Exclude) > 0
-}

From 2b1b5e8fa935ee7654581d847f835ed1e11f6935 Mon Sep 17 00:00:00 2001
From: Andrey Kolkov <androndo@gmail.com>
Date: Tue, 24 Feb 2026 17:47:32 +0400
Subject: [PATCH 153/666] fix(dashboard): updated legacy templating

Signed-off-by: Andrey Kolkov <androndo@gmail.com>
---
 internal/controller/dashboard/README.md            | 4 ++--
 internal/controller/dashboard/sidebar.go           | 8 ++++----
 internal/controller/dashboard/static_refactored.go | 2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/internal/controller/dashboard/README.md b/internal/controller/dashboard/README.md
index c3b2152e..2efe9f45 100644
--- a/internal/controller/dashboard/README.md
+++ b/internal/controller/dashboard/README.md
@@ -156,7 +156,7 @@ menuItems = append(menuItems, map[string]any{
         map[string]any{
             "key":   "{plural}",
             "label": "{ResourceLabel}",
-            "link":  "/openapi-ui/{clusterName}/{namespace}/api-table/{group}/{version}/{plural}",
+            "link":  "/openapi-ui/{cluster}/{namespace}/api-table/{group}/{version}/{plural}",
         },
     },
 }),
@@ -174,7 +174,7 @@ menuItems = append(menuItems, map[string]any{
 
 **Important Notes**:
 - The sidebar tag (`{lowercase-kind}-sidebar`) must match what the Factory uses
-- The link format: `/openapi-ui/{clusterName}/{namespace}/api-table/{group}/{version}/{plural}`
+- The link format: `/openapi-ui/{cluster}/{namespace}/api-table/{group}/{version}/{plural}`
 - All sidebars share the same `keysAndTags` and `menuItems`, so changes affect all sidebar instances
 
 ### Step 4: Verify Integration
diff --git a/internal/controller/dashboard/sidebar.go b/internal/controller/dashboard/sidebar.go
index b7a6eb70..6de5537e 100644
--- a/internal/controller/dashboard/sidebar.go
+++ b/internal/controller/dashboard/sidebar.go
@@ -182,17 +182,17 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 			map[string]any{
 				"key":   "plans",
 				"label": "Plans",
-				"link":  "/openapi-ui/{clusterName}/{namespace}/api-table/backups.cozystack.io/v1alpha1/plans",
+				"link":  "/openapi-ui/{cluster}/{namespace}/api-table/backups.cozystack.io/v1alpha1/plans",
 			},
 			map[string]any{
 				"key":   "backupjobs",
 				"label": "BackupJobs",
-				"link":  "/openapi-ui/{clusterName}/{namespace}/api-table/backups.cozystack.io/v1alpha1/backupjobs",
+				"link":  "/openapi-ui/{cluster}/{namespace}/api-table/backups.cozystack.io/v1alpha1/backupjobs",
 			},
 			map[string]any{
 				"key":   "backups",
 				"label": "Backups",
-				"link":  "/openapi-ui/{clusterName}/{namespace}/api-table/backups.cozystack.io/v1alpha1/backups",
+				"link":  "/openapi-ui/{cluster}/{namespace}/api-table/backups.cozystack.io/v1alpha1/backups",
 			},
 		},
 	})
@@ -215,7 +215,7 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 			map[string]any{
 				"key":   "loadbalancer-services",
 				"label": "External IPs",
-				"link":  "/openapi-ui/{clusterName}/{namespace}/factory/external-ips",
+				"link":  "/openapi-ui/{cluster}/{namespace}/factory/external-ips",
 			},
 			map[string]any{
 				"key":   "tenants",
diff --git a/internal/controller/dashboard/static_refactored.go b/internal/controller/dashboard/static_refactored.go
index d47c88da..9c3d8461 100644
--- a/internal/controller/dashboard/static_refactored.go
+++ b/internal/controller/dashboard/static_refactored.go
@@ -505,7 +505,7 @@ func CreateAllCustomFormsOverrides() []*dashboardv1alpha1.CustomFormsOverride {
 				createFormItem("spec.applicationRef.name", "Application Name", "text"),
 				createFormItemWithAPI("spec.backupClassName", "Backup Class", "select", map[string]any{
 					"api": map[string]any{
-						"fetchUrl":       "/api/clusters/{clusterName}/k8s/apis/backups.cozystack.io/v1alpha1/backupclasses",
+						"fetchUrl":       "/api/clusters/{cluster}/k8s/apis/backups.cozystack.io/v1alpha1/backupclasses",
 						"pathToItems":    []any{"items"},
 						"pathToValue":    []any{"metadata", "name"},
 						"pathToLabel":    []any{"metadata", "name"},

From c7290f3521876529f12ba4eb24b3b9e83c62fdcd Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 24 Feb 2026 23:05:03 +0100
Subject: [PATCH 154/666] fix(platform): make migration 26 helm secret deletion
 robust

Migration 26 silently skipped namespace processing when kubectl
queries failed, leaving helm release secrets intact. This caused
helm to diff old vs new chart manifests during upgrade, deleting
VLogs/CNPG resources and their PVCs.

- Remove silent error suppression (2>/dev/null || true) from
  namespace discovery and HR suspend commands
- Add fallback secret deletion by name pattern when label selector
  does not match
- Add verification that all helm release secrets are deleted

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../platform/images/migrations/migrations/26  | 40 +++++++++++++++++--
 1 file changed, 36 insertions(+), 4 deletions(-)

diff --git a/packages/core/platform/images/migrations/migrations/26 b/packages/core/platform/images/migrations/migrations/26
index 5f385b6e..c60af4d4 100755
--- a/packages/core/platform/images/migrations/migrations/26
+++ b/packages/core/platform/images/migrations/migrations/26
@@ -2,6 +2,7 @@
 # Migration 26 --> 27
 # Migrate monitoring resources from extra/monitoring to system/monitoring
 # This migration re-labels resources so they become owned by monitoring-system HelmRelease
+# and deletes old helm release secrets so that helm does not diff old vs new chart manifests.
 
 set -euo pipefail
 
@@ -35,10 +36,39 @@ relabel_resources() {
   done
 }
 
+# Delete all helm release secrets for a given release name in a namespace.
+# Uses both label selector and name-pattern matching to ensure complete cleanup.
+delete_helm_secrets() {
+  local ns="$1"
+  local release="$2"
+
+  # Primary: delete by label selector
+  kubectl delete secrets -n "$ns" -l "name=${release},owner=helm" --ignore-not-found
+
+  # Fallback: find and delete by name pattern (in case labels were modified)
+  local remaining
+  remaining=$(kubectl get secrets -n "$ns" -o name | { grep "^secret/sh\.helm\.release\.v1\.${release}\." || true; })
+  if [ -n "$remaining" ]; then
+    echo "  Found secrets not matched by label selector, deleting by name..."
+    echo "$remaining" | while IFS= read -r secret; do
+      echo "    Deleting $secret"
+      kubectl delete -n "$ns" "$secret" --ignore-not-found
+    done
+  fi
+
+  # Verify all secrets are gone
+  remaining=$(kubectl get secrets -n "$ns" -o name | { grep "^secret/sh\.helm\.release\.v1\.${release}\." || true; })
+  if [ -n "$remaining" ]; then
+    echo "  ERROR: Failed to delete helm release secrets:"
+    echo "$remaining"
+    return 1
+  fi
+}
+
 # Find all tenant namespaces with monitoring HelmRelease
 echo "Finding tenant namespaces with monitoring HelmRelease..."
 NAMESPACES=$(kubectl get hr --all-namespaces -l apps.cozystack.io/application.kind=Monitoring \
-  -o jsonpath='{range .items[*]}{.metadata.namespace}{"\n"}{end}' 2>/dev/null | sort -u || true)
+  -o jsonpath='{range .items[*]}{.metadata.namespace}{"\n"}{end}' | sort -u)
 
 if [ -z "$NAMESPACES" ]; then
   echo "No monitoring HelmReleases found in tenant namespaces, skipping migration"
@@ -66,7 +96,7 @@ for ns in $NAMESPACES; do
   # Step 1: Suspend the HelmRelease
   echo ""
   echo "Step 1: Suspending HelmRelease monitoring..."
-  kubectl patch hr -n "$ns" monitoring --type=merge -p '{"spec":{"suspend":true}}' 2>/dev/null || true
+  kubectl patch hr -n "$ns" monitoring --type=merge -p '{"spec":{"suspend":true}}'
 
   # Wait a moment for reconciliation to stop
   sleep 2
@@ -74,7 +104,7 @@ for ns in $NAMESPACES; do
   # Step 2: Delete helm secrets for the monitoring release
   echo ""
   echo "Step 2: Deleting helm secrets for monitoring release..."
-  kubectl delete secrets -n "$ns" -l name=monitoring,owner=helm --ignore-not-found
+  delete_helm_secrets "$ns" "monitoring"
 
   # Step 3: Relabel resources to be owned by monitoring-system
   echo ""
@@ -121,7 +151,9 @@ for ns in $NAMESPACES; do
   echo "Processing Cozystack resources..."
   relabel_resources "$ns" "workloadmonitors.cozystack.io"
 
-  # Step 4: Delete the suspended HelmRelease (Flux won't delete resources when HR is suspended)
+  # Step 4: Delete the suspended HelmRelease
+  # Helm secrets are already gone, so flux finalizer will find no release to uninstall
+  # and will simply remove the finalizer without deleting any resources.
   echo ""
   echo "Step 4: Deleting suspended HelmRelease monitoring..."
   kubectl delete hr -n "$ns" monitoring --ignore-not-found

From 880b99f3f77be9cb398ab01152f7b5246574af7d Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 24 Feb 2026 23:34:34 +0100
Subject: [PATCH 155/666] fix(platform): wrap grep in migrations 28 and 29 to
 prevent pipefail exits

grep returns exit code 1 when no lines match. With set -euo pipefail,
this kills the script when all secrets are helm-release secrets or when
no matching resources exist. Wrap grep calls with { ... || true; }.

Also fix reconcile annotation in migration 29 to use RFC3339 timestamp
format instead of Unix epoch, which Flux v2 expects.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/core/platform/images/migrations/migrations/28 | 8 ++++----
 packages/core/platform/images/migrations/migrations/29 | 6 +++---
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/packages/core/platform/images/migrations/migrations/28 b/packages/core/platform/images/migrations/migrations/28
index 259d5fd8..1d3de565 100755
--- a/packages/core/platform/images/migrations/migrations/28
+++ b/packages/core/platform/images/migrations/migrations/28
@@ -348,7 +348,7 @@ PVCEOF
   # --- 3g: Clone Secrets ---
   echo "  --- Clone Secrets ---"
   for secret in $(kubectl -n "$NAMESPACE" get secret -o name 2>/dev/null \
-    | grep "secret/${OLD_NAME}" | grep -v "sh.helm.release"); do
+    | { grep "secret/${OLD_NAME}" || true; } | { grep -v "sh.helm.release" || true; }); do
     old_secret_name="${secret#secret/}"
     new_secret_name="${NEW_NAME}${old_secret_name#${OLD_NAME}}"
     clone_resource "$NAMESPACE" "secret" "$old_secret_name" "$new_secret_name" "$OLD_NAME" "$NEW_NAME"
@@ -357,7 +357,7 @@ PVCEOF
   # --- 3h: Clone ConfigMaps ---
   echo "  --- Clone ConfigMaps ---"
   for cm in $(kubectl -n "$NAMESPACE" get configmap -o name 2>/dev/null \
-    | grep "configmap/${OLD_NAME}"); do
+    | { grep "configmap/${OLD_NAME}" || true; }); do
     old_cm_name="${cm#configmap/}"
     new_cm_name="${NEW_NAME}${old_cm_name#${OLD_NAME}}"
     clone_resource "$NAMESPACE" "configmap" "$old_cm_name" "$new_cm_name" "$OLD_NAME" "$NEW_NAME"
@@ -468,13 +468,13 @@ PVCEOF
   fi
 
   for secret in $(kubectl -n "$NAMESPACE" get secret -o name 2>/dev/null \
-    | grep "secret/${OLD_NAME}" | grep -v "sh.helm.release"); do
+    | { grep "secret/${OLD_NAME}" || true; } | { grep -v "sh.helm.release" || true; }); do
     old_secret_name="${secret#secret/}"
     delete_resource "$NAMESPACE" "secret" "$old_secret_name"
   done
 
   for cm in $(kubectl -n "$NAMESPACE" get configmap -o name 2>/dev/null \
-    | grep "configmap/${OLD_NAME}"); do
+    | { grep "configmap/${OLD_NAME}" || true; }); do
     old_cm_name="${cm#configmap/}"
     delete_resource "$NAMESPACE" "configmap" "$old_cm_name"
   done
diff --git a/packages/core/platform/images/migrations/migrations/29 b/packages/core/platform/images/migrations/migrations/29
index a76071a5..1ec33cda 100755
--- a/packages/core/platform/images/migrations/migrations/29
+++ b/packages/core/platform/images/migrations/migrations/29
@@ -315,7 +315,7 @@ PVCEOF
   # --- 2i: Clone Secrets ---
   echo "  --- Clone Secrets ---"
   kubectl -n "$NAMESPACE" get secret -o name 2>/dev/null \
-    | grep "secret/${OLD_NAME}" | grep -v "sh.helm.release" | grep -v "values" \
+    | { grep "secret/${OLD_NAME}" || true; } | { grep -v "sh.helm.release" || true; } | { grep -v "values" || true; } \
     | while IFS= read -r secret; do
     old_secret_name="${secret#secret/}"
     suffix="${old_secret_name#${OLD_NAME}}"
@@ -542,7 +542,7 @@ SVCEOF
   # --- 2q: Delete old resources ---
   echo "  --- Delete old resources ---"
   kubectl -n "$NAMESPACE" get secret -o name 2>/dev/null \
-    | grep "secret/${OLD_NAME}" | grep -v "sh.helm.release" | grep -v "values" \
+    | { grep "secret/${OLD_NAME}" || true; } | { grep -v "sh.helm.release" || true; } | { grep -v "values" || true; } \
     | while IFS= read -r secret; do
     old_secret_name="${secret#secret/}"
     delete_resource "$NAMESPACE" "secret" "$old_secret_name"
@@ -705,7 +705,7 @@ for entry in "${INSTANCES[@]}"; do
     # Force immediate reconciliation
     echo "  [TRIGGER] Reconcile ${ns}/hr/${disk_name}"
     kubectl -n "$ns" annotate hr "$disk_name" --overwrite \
-      "reconcile.fluxcd.io/requestedAt=$(date +%s)" 2>/dev/null || true
+      "reconcile.fluxcd.io/requestedAt=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" 2>/dev/null || true
   fi
 done
 

From a9adda5e880791f7ef6093f8d79898ee7774dc58 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 24 Feb 2026 23:34:40 +0100
Subject: [PATCH 156/666] fix(platform): make migration 27 skip missing CRDs
 and add secret cleanup fallback

Migration 27 failed with set -e when Piraeus CRDs did not exist on
clusters without linstor. Add existence check before annotating CRDs.
Also add name-pattern fallback for helm secret deletion, consistent
with migration 26.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../platform/images/migrations/migrations/27   | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/packages/core/platform/images/migrations/migrations/27 b/packages/core/platform/images/migrations/migrations/27
index 3e8719e9..5708ebbb 100755
--- a/packages/core/platform/images/migrations/migrations/27
+++ b/packages/core/platform/images/migrations/migrations/27
@@ -5,10 +5,24 @@ set -euo pipefail
 
 # Migrate Piraeus CRDs to piraeus-operator-crds Helm release
 for crd in linstorclusters.piraeus.io linstornodeconnections.piraeus.io linstorsatelliteconfigurations.piraeus.io linstorsatellites.piraeus.io; do
-  kubectl annotate crd "$crd" meta.helm.sh/release-namespace=cozy-linstor meta.helm.sh/release-name=piraeus-operator-crds --overwrite
-  kubectl label crd "$crd" app.kubernetes.io/managed-by=Helm helm.toolkit.fluxcd.io/namespace=cozy-linstor helm.toolkit.fluxcd.io/name=piraeus-operator-crds --overwrite
+  if kubectl get crd "$crd" >/dev/null 2>&1; then
+    echo "  Relabeling CRD $crd"
+    kubectl annotate crd "$crd" meta.helm.sh/release-namespace=cozy-linstor meta.helm.sh/release-name=piraeus-operator-crds --overwrite
+    kubectl label crd "$crd" app.kubernetes.io/managed-by=Helm helm.toolkit.fluxcd.io/namespace=cozy-linstor helm.toolkit.fluxcd.io/name=piraeus-operator-crds --overwrite
+  else
+    echo "  CRD $crd not found, skipping"
+  fi
 done
+
+# Delete old piraeus-operator helm secrets (by label and by name pattern)
 kubectl delete secret -n cozy-linstor -l name=piraeus-operator,owner=helm --ignore-not-found
+remaining=$(kubectl get secrets -n cozy-linstor -o name 2>/dev/null | { grep "^secret/sh\.helm\.release\.v1\.piraeus-operator\." || true; })
+if [ -n "$remaining" ]; then
+  echo "  Deleting remaining piraeus-operator helm secrets by name..."
+  echo "$remaining" | while IFS= read -r secret; do
+    kubectl delete -n cozy-linstor "$secret" --ignore-not-found
+  done
+fi
 
 # Stamp version
 kubectl create configmap -n cozy-system cozystack-version \

From 7871d425dd4ec5f6f1e73a2f2bc0d1c0bd276d9b Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 24 Feb 2026 23:34:47 +0100
Subject: [PATCH 157/666] fix(etcd): increase HelmRelease timeout to 30m for
 cert rotation

The post-upgrade hook deletes TLS certificates and etcd pods to trigger
cert-manager regeneration. With 3 replicas and startup probes allowing
up to 25 minutes per pod, the previous 10m timeout was insufficient.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/apps/tenant/templates/etcd.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/apps/tenant/templates/etcd.yaml b/packages/apps/tenant/templates/etcd.yaml
index 97b39205..9a122da2 100644
--- a/packages/apps/tenant/templates/etcd.yaml
+++ b/packages/apps/tenant/templates/etcd.yaml
@@ -18,7 +18,7 @@ spec:
     name: cozystack-etcd-application-default-etcd
     namespace: cozy-system
   interval: 5m
-  timeout: 10m
+  timeout: 30m
   install:
     remediation:
       retries: -1

From da597225d152975ce0dc721432464f5120fa9c8d Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 24 Feb 2026 23:34:53 +0100
Subject: [PATCH 158/666] fix(platform): add missing field mappings in
 migrate-to-version-1.0.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add ConfigMap fields that were not converted to Package values:
- bundle-disable → bundles.disabledPackages
- bundle-enable → bundles.enabledPackages
- expose-ingress → publishing.ingressName
- expose-services → publishing.exposedServices

Remove incorrect bundles.system.type field that is not part of the
Package values schema.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 hack/migrate-to-version-1.0.sh | 32 +++++++++++++++++++++++++++-----
 1 file changed, 27 insertions(+), 5 deletions(-)

diff --git a/hack/migrate-to-version-1.0.sh b/hack/migrate-to-version-1.0.sh
index 5a7bc381..516816d1 100755
--- a/hack/migrate-to-version-1.0.sh
+++ b/hack/migrate-to-version-1.0.sh
@@ -52,6 +52,10 @@ OIDC_ENABLED=$(echo "$COZYSTACK_CM" | jq -r '.data["oidc-enabled"] // "false"')
 KEYCLOAK_REDIRECTS=$(echo "$COZYSTACK_CM" | jq -r '.data["extra-keycloak-redirect-uri-for-dashboard"] // ""' )
 TELEMETRY_ENABLED=$(echo "$COZYSTACK_CM" | jq -r '.data["telemetry-enabled"] // "true"')
 BUNDLE_NAME=$(echo "$COZYSTACK_CM" | jq -r '.data["bundle-name"] // "paas-full"')
+BUNDLE_DISABLE=$(echo "$COZYSTACK_CM" | jq -r '.data["bundle-disable"] // ""')
+BUNDLE_ENABLE=$(echo "$COZYSTACK_CM" | jq -r '.data["bundle-enable"] // ""')
+EXPOSE_INGRESS=$(echo "$COZYSTACK_CM" | jq -r '.data["expose-ingress"] // "tenant-root"')
+EXPOSE_SERVICES=$(echo "$COZYSTACK_CM" | jq -r '.data["expose-services"] // ""')
 
 # Certificate issuer configuration (old undocumented field: clusterissuer)
 OLD_CLUSTER_ISSUER=$(echo "$COZYSTACK_CM" | jq -r '.data["clusterissuer"] // ""')
@@ -99,19 +103,35 @@ else
     EXTERNAL_IPS=$(echo "$EXTERNAL_IPS" | sed 's/,/\n/g' | awk 'BEGIN{print}{print "          - "$0}')
 fi
 
+# Convert comma-separated lists to YAML arrays
+if [ -z "$BUNDLE_DISABLE" ]; then
+    DISABLED_PACKAGES="[]"
+else
+    DISABLED_PACKAGES=$(echo "$BUNDLE_DISABLE" | sed 's/,/\n/g' | awk 'BEGIN{print}{print "          - "$0}')
+fi
+
+if [ -z "$BUNDLE_ENABLE" ]; then
+    ENABLED_PACKAGES="[]"
+else
+    ENABLED_PACKAGES=$(echo "$BUNDLE_ENABLE" | sed 's/,/\n/g' | awk 'BEGIN{print}{print "          - "$0}')
+fi
+
+if [ -z "$EXPOSE_SERVICES" ]; then
+    EXPOSED_SERVICES_YAML="[]"
+else
+    EXPOSED_SERVICES_YAML=$(echo "$EXPOSE_SERVICES" | sed 's/,/\n/g' | awk 'BEGIN{print}{print "            - "$0}')
+fi
+
 # Determine bundle type
 case "$BUNDLE_NAME" in
     paas-full|distro-full)
         SYSTEM_ENABLED="true"
-        SYSTEM_TYPE="full"
         ;;
     paas-hosted|distro-hosted)
         SYSTEM_ENABLED="false"
-        SYSTEM_TYPE="hosted"
         ;;
     *)
         SYSTEM_ENABLED="false"
-        SYSTEM_TYPE="hosted"
         ;;
 esac
 
@@ -142,7 +162,6 @@ echo "  API Server Endpoint: $API_SERVER_ENDPOINT"
 echo "  OIDC Enabled: $OIDC_ENABLED"
 echo "  Bundle Name: $BUNDLE_NAME"
 echo "  System Enabled: $SYSTEM_ENABLED"
-echo "  System Type: $SYSTEM_TYPE"
 echo "  Certificate Solver: ${SOLVER:-http01 (default)}"
 echo "  Issuer Name: ${ISSUER_NAME:-letsencrypt-prod (default)}"
 echo ""
@@ -162,13 +181,14 @@ spec:
         bundles:
           system:
             enabled: $SYSTEM_ENABLED
-            type: "$SYSTEM_TYPE"
           iaas:
             enabled: true
           paas:
             enabled: true
           naas:
             enabled: true
+          disabledPackages: $DISABLED_PACKAGES
+          enabledPackages: $ENABLED_PACKAGES
         networking:
           clusterDomain: "$CLUSTER_DOMAIN"
           podCIDR: "$POD_CIDR"
@@ -177,6 +197,8 @@ spec:
           joinCIDR: "$JOIN_CIDR"
         publishing:
           host: "$ROOT_HOST"
+          ingressName: "$EXPOSE_INGRESS"
+          exposedServices: $EXPOSED_SERVICES_YAML
           apiServerEndpoint: "$API_SERVER_ENDPOINT"
           externalIPs: $EXTERNAL_IPS
 ${CERTIFICATES_SECTION}

From 948346ef6d655af2e58c63f4172be7646c126e06 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 24 Feb 2026 23:49:43 +0100
Subject: [PATCH 159/666] fix(platform): use original cozystack.io/ui label in
 migration 26 and simplify migration script

Migration 26 was using apps.cozystack.io/application.kind=Monitoring label
which is added by migration 22 and may not be present on v0.41.1 clusters.
Switch to cozystack.io/ui=true (guaranteed on old HRs) with field-selector
for exact name match.

Also remove redundant bundle enabled flags from migrate-to-version-1.0.sh
since the variant already determines them via its values file.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 hack/migrate-to-version-1.0.sh                | 22 -------------------
 .../platform/images/migrations/migrations/26  |  2 +-
 2 files changed, 1 insertion(+), 23 deletions(-)

diff --git a/hack/migrate-to-version-1.0.sh b/hack/migrate-to-version-1.0.sh
index 516816d1..7cc0cf73 100755
--- a/hack/migrate-to-version-1.0.sh
+++ b/hack/migrate-to-version-1.0.sh
@@ -122,19 +122,6 @@ else
     EXPOSED_SERVICES_YAML=$(echo "$EXPOSE_SERVICES" | sed 's/,/\n/g' | awk 'BEGIN{print}{print "            - "$0}')
 fi
 
-# Determine bundle type
-case "$BUNDLE_NAME" in
-    paas-full|distro-full)
-        SYSTEM_ENABLED="true"
-        ;;
-    paas-hosted|distro-hosted)
-        SYSTEM_ENABLED="false"
-        ;;
-    *)
-        SYSTEM_ENABLED="false"
-        ;;
-esac
-
 # Update bundle naming
 BUNDLE_NAME=$(echo "$BUNDLE_NAME" | sed 's/paas/isp/')
 
@@ -161,7 +148,6 @@ echo "  Root Host: $ROOT_HOST"
 echo "  API Server Endpoint: $API_SERVER_ENDPOINT"
 echo "  OIDC Enabled: $OIDC_ENABLED"
 echo "  Bundle Name: $BUNDLE_NAME"
-echo "  System Enabled: $SYSTEM_ENABLED"
 echo "  Certificate Solver: ${SOLVER:-http01 (default)}"
 echo "  Issuer Name: ${ISSUER_NAME:-letsencrypt-prod (default)}"
 echo ""
@@ -179,14 +165,6 @@ spec:
     platform:
       values:
         bundles:
-          system:
-            enabled: $SYSTEM_ENABLED
-          iaas:
-            enabled: true
-          paas:
-            enabled: true
-          naas:
-            enabled: true
           disabledPackages: $DISABLED_PACKAGES
           enabledPackages: $ENABLED_PACKAGES
         networking:
diff --git a/packages/core/platform/images/migrations/migrations/26 b/packages/core/platform/images/migrations/migrations/26
index c60af4d4..96fb9851 100755
--- a/packages/core/platform/images/migrations/migrations/26
+++ b/packages/core/platform/images/migrations/migrations/26
@@ -67,7 +67,7 @@ delete_helm_secrets() {
 
 # Find all tenant namespaces with monitoring HelmRelease
 echo "Finding tenant namespaces with monitoring HelmRelease..."
-NAMESPACES=$(kubectl get hr --all-namespaces -l apps.cozystack.io/application.kind=Monitoring \
+NAMESPACES=$(kubectl get hr --all-namespaces -l cozystack.io/ui=true --field-selector=metadata.name=monitoring \
   -o jsonpath='{range .items[*]}{.metadata.namespace}{"\n"}{end}' | sort -u)
 
 if [ -z "$NAMESPACES" ]; then

From cfb5914cdd8ade6867b5f765463751ba9b4d9bc3 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Wed, 25 Feb 2026 00:30:54 +0100
Subject: [PATCH 160/666] fix(platform): remove protection-webhook handling
 from migration 29

The protection-webhook is not part of the cozystack platform and should
not be managed by the migration script. Old services are now deleted
directly instead of being batched through the webhook disable/enable cycle.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../platform/images/migrations/migrations/29  | 81 +++----------------
 1 file changed, 12 insertions(+), 69 deletions(-)

diff --git a/packages/core/platform/images/migrations/migrations/29 b/packages/core/platform/images/migrations/migrations/29
index 1ec33cda..05ba7de0 100755
--- a/packages/core/platform/images/migrations/migrations/29
+++ b/packages/core/platform/images/migrations/migrations/29
@@ -9,8 +9,6 @@ set -euo pipefail
 OLD_PREFIX="virtual-machine"
 NEW_DISK_PREFIX="vm-disk"
 NEW_INSTANCE_PREFIX="vm-instance"
-PROTECTION_WEBHOOK_NAME="protection-webhook"
-PROTECTION_WEBHOOK_NS="protection-webhook"
 CDI_APISERVER_NS="cozy-kubevirt-cdi"
 CDI_APISERVER_DEPLOY="cdi-apiserver"
 CDI_VALIDATING_WEBHOOKS="cdi-api-datavolume-validate cdi-api-dataimportcron-validate cdi-api-populator-validate cdi-api-validate"
@@ -88,7 +86,6 @@ echo "  Total: ${#INSTANCES[@]} instance(s)"
 # STEP 2: Migrate each instance
 # ============================================================
 ALL_PV_NAMES=()
-ALL_PROTECTED_RESOURCES=()
 
 for entry in "${INSTANCES[@]}"; do
   NAMESPACE="${entry%%/*}"
@@ -564,71 +561,17 @@ SVCEOF
     delete_resource "$NAMESPACE" "secret" "$VALUES_SECRET"
   fi
 
-  # Collect protected resources for batch deletion
+  # Delete old service (if exists)
   if resource_exists "$NAMESPACE" "svc" "$OLD_NAME"; then
-    ALL_PROTECTED_RESOURCES+=("${NAMESPACE}:svc/${OLD_NAME}")
+    delete_resource "$NAMESPACE" "svc" "$OLD_NAME"
   fi
 done
 
 # ============================================================
-# STEP 3: Delete protected resources (Services)
+# STEP 3: Restore PV reclaim policies
 # ============================================================
 echo ""
-echo "--- Step 3: Delete protected resources ---"
-
-if [ ${#ALL_PROTECTED_RESOURCES[@]} -gt 0 ]; then
-  WEBHOOK_EXISTS=false
-  if kubectl -n "$PROTECTION_WEBHOOK_NS" get deploy "$PROTECTION_WEBHOOK_NAME" --no-headers 2>/dev/null | grep -q .; then
-    WEBHOOK_EXISTS=true
-  fi
-
-  if [ "$WEBHOOK_EXISTS" = "true" ]; then
-    echo "  --- Temporarily disabling protection-webhook ---"
-
-    WEBHOOK_REPLICAS=$(kubectl -n "$PROTECTION_WEBHOOK_NS" get deploy "$PROTECTION_WEBHOOK_NAME" \
-      -o jsonpath='{.spec.replicas}' 2>/dev/null || echo "1")
-
-    echo "  [SCALE] ${PROTECTION_WEBHOOK_NAME} -> 0 (was ${WEBHOOK_REPLICAS})"
-    kubectl -n "$PROTECTION_WEBHOOK_NS" scale deploy "$PROTECTION_WEBHOOK_NAME" --replicas=0
-
-    echo "  [PATCH] Set failurePolicy=Ignore on ValidatingWebhookConfiguration/${PROTECTION_WEBHOOK_NAME}"
-    kubectl get validatingwebhookconfiguration "$PROTECTION_WEBHOOK_NAME" -o json | \
-      jq '.webhooks[].failurePolicy = "Ignore"' | \
-      kubectl apply -f - 2>/dev/null || true
-
-    echo "  Waiting for webhook pods to terminate..."
-    kubectl -n "$PROTECTION_WEBHOOK_NS" wait --for=delete pod \
-      -l app.kubernetes.io/name=protection-webhook --timeout=60s 2>/dev/null || true
-    sleep 3
-  fi
-
-  for entry in "${ALL_PROTECTED_RESOURCES[@]}"; do
-    ns="${entry%%:*}"
-    res="${entry#*:}"
-    echo "  [DELETE] ${ns}/${res}"
-    kubectl -n "$ns" delete "$res" --wait=false 2>/dev/null || true
-  done
-
-  if [ "$WEBHOOK_EXISTS" = "true" ]; then
-    echo "  [PATCH] Set failurePolicy=Fail on ValidatingWebhookConfiguration/${PROTECTION_WEBHOOK_NAME}"
-    kubectl get validatingwebhookconfiguration "$PROTECTION_WEBHOOK_NAME" -o json | \
-      jq '.webhooks[].failurePolicy = "Fail"' | \
-      kubectl apply -f - 2>/dev/null || true
-
-    echo "  [SCALE] ${PROTECTION_WEBHOOK_NAME} -> ${WEBHOOK_REPLICAS}"
-    kubectl -n "$PROTECTION_WEBHOOK_NS" scale deploy "$PROTECTION_WEBHOOK_NAME" \
-      --replicas="$WEBHOOK_REPLICAS"
-    echo "  --- protection-webhook restored ---"
-  fi
-else
-  echo "  [SKIP] No protected resources to delete"
-fi
-
-# ============================================================
-# STEP 4: Restore PV reclaim policies
-# ============================================================
-echo ""
-echo "--- Step 4: Restore PV reclaim policies ---"
+echo "--- Step 3: Restore PV reclaim policies ---"
 for pv_name in "${ALL_PV_NAMES[@]}"; do
   if [ -n "$pv_name" ]; then
     current_policy=$(kubectl get pv "$pv_name" \
@@ -643,7 +586,7 @@ for pv_name in "${ALL_PV_NAMES[@]}"; do
 done
 
 # ============================================================
-# STEP 5: Temporarily disable CDI datavolume webhooks
+# STEP 4: Temporarily disable CDI datavolume webhooks
 # ============================================================
 # CDI's datavolume-validate webhook rejects DataVolume creation when a PVC
 # with the same name already exists. We must disable it so that vm-disk
@@ -652,7 +595,7 @@ done
 # cdi-apiserver (which serves the webhooks), then delete webhook configs.
 # Both are restored after vm-disk HRs reconcile.
 echo ""
-echo "--- Step 5: Temporarily disable CDI webhooks ---"
+echo "--- Step 4: Temporarily disable CDI webhooks ---"
 
 CDI_OPERATOR_REPLICAS=$(kubectl -n "$CDI_APISERVER_NS" get deploy cdi-operator \
   -o jsonpath='{.spec.replicas}' 2>/dev/null || echo "1")
@@ -685,10 +628,10 @@ done
 sleep 2
 
 # ============================================================
-# STEP 6: Unsuspend vm-disk HelmReleases first
+# STEP 5: Unsuspend vm-disk HelmReleases first
 # ============================================================
 echo ""
-echo "--- Step 6: Unsuspend vm-disk HelmReleases ---"
+echo "--- Step 5: Unsuspend vm-disk HelmReleases ---"
 for entry in "${INSTANCES[@]}"; do
   ns="${entry%%/*}"
   instance="${entry#*/}"
@@ -729,12 +672,12 @@ for entry in "${INSTANCES[@]}"; do
 done
 
 # ============================================================
-# STEP 7: Restore CDI webhooks
+# STEP 6: Restore CDI webhooks
 # ============================================================
 # Scale cdi-operator and cdi-apiserver back up.
 # cdi-apiserver will recreate webhook configurations automatically on start.
 echo ""
-echo "--- Step 7: Restore CDI webhooks ---"
+echo "--- Step 6: Restore CDI webhooks ---"
 
 echo "  [SCALE] cdi-operator -> ${CDI_OPERATOR_REPLICAS}"
 kubectl -n "$CDI_APISERVER_NS" scale deploy cdi-operator \
@@ -749,10 +692,10 @@ kubectl -n "$CDI_APISERVER_NS" rollout status deploy "$CDI_APISERVER_DEPLOY" --t
 echo "  --- CDI webhooks restored ---"
 
 # ============================================================
-# STEP 8: Unsuspend vm-instance HelmReleases
+# STEP 7: Unsuspend vm-instance HelmReleases
 # ============================================================
 echo ""
-echo "--- Step 8: Unsuspend vm-instance HelmReleases ---"
+echo "--- Step 7: Unsuspend vm-instance HelmReleases ---"
 for entry in "${INSTANCES[@]}"; do
   ns="${entry%%/*}"
   instance="${entry#*/}"

From 4c73ac54a0c091df66006774454b716559923243 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Wed, 25 Feb 2026 13:09:21 +0500
Subject: [PATCH 161/666] chore: add @sircthulhu to CODEOWNERS

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .github/CODEOWNERS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 716776ea..2045ec5a 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1 +1 @@
-* @kvaps @lllamnyp @lexfrei @androndo @IvanHunters
+* @kvaps @lllamnyp @lexfrei @androndo @IvanHunters @sircthulhu

From 9cbd948b08130218f37b84fc0046080db20f68e4 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Wed, 25 Feb 2026 17:36:53 +0500
Subject: [PATCH 162/666] feat(keycloak): allow custom Ingress hostname via
 values

Add ingress.host field to values.yaml for cozy-keycloak. When set,
it overrides the default "keycloak.<root-host>" hostname in both the
Ingress resource and the KC_HOSTNAME environment variable. When left
empty, behavior is unchanged for backward compatibility.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/system/keycloak/templates/ingress.yaml | 5 +++--
 packages/system/keycloak/templates/sts.yaml     | 3 ++-
 packages/system/keycloak/values.yaml            | 4 ++++
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/packages/system/keycloak/templates/ingress.yaml b/packages/system/keycloak/templates/ingress.yaml
index 58a303df..aa282f71 100644
--- a/packages/system/keycloak/templates/ingress.yaml
+++ b/packages/system/keycloak/templates/ingress.yaml
@@ -1,4 +1,5 @@
 {{- $host := index .Values._cluster "root-host" }}
+{{- $ingressHost := .Values.ingress.host | default (printf "keycloak.%s" $host) }}
 {{- $solver := (index .Values._cluster "solver") | default "http01" }}
 {{- $clusterIssuer := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }}
 {{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
@@ -19,10 +20,10 @@ spec:
   ingressClassName: {{ $exposeIngress }}
   tls:
   - hosts:
-      - keycloak.{{ $host }}
+      - {{ $ingressHost }}
     secretName: web-tls
   rules:
-  - host: keycloak.{{ $host }}
+  - host: {{ $ingressHost }}
     http:
       paths:
       - path: /
diff --git a/packages/system/keycloak/templates/sts.yaml b/packages/system/keycloak/templates/sts.yaml
index 96d30601..1cdbec62 100644
--- a/packages/system/keycloak/templates/sts.yaml
+++ b/packages/system/keycloak/templates/sts.yaml
@@ -1,4 +1,5 @@
 {{- $host := index .Values._cluster "root-host" }}
+{{- $ingressHost := .Values.ingress.host | default (printf "keycloak.%s" $host) }}
 {{- $clusterDomain := (index .Values._cluster "cluster-domain") | default "cozy.local" }}
 
 {{- $existingPassword := lookup "v1" "Secret" "cozy-keycloak" (printf "%s-credentials" .Release.Name) }}
@@ -120,7 +121,7 @@ spec:
             - name: KC_FEATURES
               value: "docker"
             - name: KC_HOSTNAME
-              value: https://keycloak.{{ $host }}
+              value: https://{{ $ingressHost }}
             - name: JAVA_OPTS_APPEND
               value: "-Djgroups.dns.query=keycloak-headless.cozy-keycloak.svc.{{ $clusterDomain }}"
           ports:
diff --git a/packages/system/keycloak/values.yaml b/packages/system/keycloak/values.yaml
index e93de556..708edc2c 100644
--- a/packages/system/keycloak/values.yaml
+++ b/packages/system/keycloak/values.yaml
@@ -1,6 +1,10 @@
 image: quay.io/keycloak/keycloak:26.0.4
 
 ingress:
+  # Custom hostname for the Keycloak Ingress.
+  # If set, this value will be used as the Ingress hostname (e.g., "auth.example.com").
+  # If left empty, defaults to "keycloak.<root-host>" based on the cluster root-host setting.
+  host: ""
   annotations:
     nginx.ingress.kubernetes.io/affinity: "cookie"
     nginx.ingress.kubernetes.io/session-cookie-expires: "86400"

From e0dfc8a3214b3f09cf04d101f4e5dd7a333cb5b0 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Wed, 25 Feb 2026 16:01:58 +0100
Subject: [PATCH 163/666] fix(platform): clean up orphaned -rd HelmReleases in
 migrations 28 and 29
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Migrations 28 (mysql→mariadb) and 29 (virtual-machine→vm-disk+vm-instance)
only handled user-facing HelmReleases but left the system-level -rd
HelmReleases (mysql-rd, virtual-machine-rd) orphaned in cozy-system.
These HRs reference ExternalArtifacts that no longer exist, causing
persistent reconciliation failures.

Add cleanup steps to delete the orphaned -rd HRs and their Helm secrets.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../core/platform/images/migrations/migrations/28   | 13 +++++++++++++
 .../core/platform/images/migrations/migrations/29   | 13 +++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/packages/core/platform/images/migrations/migrations/28 b/packages/core/platform/images/migrations/migrations/28
index 1d3de565..5174c9b0 100755
--- a/packages/core/platform/images/migrations/migrations/28
+++ b/packages/core/platform/images/migrations/migrations/28
@@ -611,6 +611,19 @@ done
 echo ""
 echo "=== Migration complete (${#INSTANCES[@]} instance(s)) ==="
 
+# ============================================================
+# STEP 8: Clean up orphaned mysql-rd system HelmRelease
+# ============================================================
+echo ""
+echo "--- Step 8: Clean up orphaned mysql-rd HelmRelease ---"
+if kubectl -n cozy-system get hr mysql-rd --no-headers 2>/dev/null | grep -q .; then
+  echo "  [DELETE] hr/mysql-rd"
+  kubectl -n cozy-system delete hr mysql-rd --wait=false
+else
+  echo "  [SKIP] hr/mysql-rd already gone"
+fi
+kubectl -n cozy-system delete secret -l "owner=helm,name=mysql-rd" --ignore-not-found
+
 # Stamp version
 kubectl create configmap -n cozy-system cozystack-version \
   --from-literal=version=29 --dry-run=client -o yaml | kubectl apply -f-
diff --git a/packages/core/platform/images/migrations/migrations/29 b/packages/core/platform/images/migrations/migrations/29
index 05ba7de0..b72c2a93 100755
--- a/packages/core/platform/images/migrations/migrations/29
+++ b/packages/core/platform/images/migrations/migrations/29
@@ -715,6 +715,19 @@ done
 echo ""
 echo "=== Migration complete (${#INSTANCES[@]} instance(s)) ==="
 
+# ============================================================
+# STEP 8: Clean up orphaned virtual-machine-rd system HelmRelease
+# ============================================================
+echo ""
+echo "--- Step 8: Clean up orphaned virtual-machine-rd HelmRelease ---"
+if kubectl -n cozy-system get hr virtual-machine-rd --no-headers 2>/dev/null | grep -q .; then
+  echo "  [DELETE] hr/virtual-machine-rd"
+  kubectl -n cozy-system delete hr virtual-machine-rd --wait=false
+else
+  echo "  [SKIP] hr/virtual-machine-rd already gone"
+fi
+kubectl -n cozy-system delete secret -l "owner=helm,name=virtual-machine-rd" --ignore-not-found
+
 # Stamp version
 kubectl create configmap -n cozy-system cozystack-version \
   --from-literal=version=30 --dry-run=client -o yaml | kubectl apply -f-

From da89203a3242d7960f9d071b3ea0d9f021d5f373 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Wed, 25 Feb 2026 16:02:10 +0100
Subject: [PATCH 164/666] fix(platform): add migration 33 to clean up orphaned
 -rd HelmReleases
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a safety-net migration for users who already passed migrations 28/29
and still have orphaned -rd HelmReleases in cozy-system:

- ferretdb-rd (replaced by mongodb-rd, never had a dedicated migration)
- mysql-rd (migration 28 only handled user HRs)
- virtual-machine-rd (migration 29 only handled user HRs)

These HRs reference ExternalArtifacts that no longer exist after the
application renames (ferretdb→mongodb, mysql→mariadb,
virtual-machine→vm-disk+vm-instance), causing persistent errors.

Bump targetVersion from 33 to 34.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../platform/images/migrations/migrations/33  | 30 +++++++++++++++++++
 packages/core/platform/values.yaml            |  2 +-
 2 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100755 packages/core/platform/images/migrations/migrations/33

diff --git a/packages/core/platform/images/migrations/migrations/33 b/packages/core/platform/images/migrations/migrations/33
new file mode 100755
index 00000000..5da6788f
--- /dev/null
+++ b/packages/core/platform/images/migrations/migrations/33
@@ -0,0 +1,30 @@
+#!/bin/sh
+# Migration 33 --> 34
+# Clean up orphaned system -rd HelmReleases left after application renames.
+#
+# These HelmReleases reference ExternalArtifacts that no longer exist:
+#   ferretdb-rd   -> replaced by mongodb-rd
+#   mysql-rd      -> replaced by mariadb-rd (migration 28 handled user HRs only)
+#   virtual-machine-rd -> replaced by vm-disk-rd + vm-instance-rd (migration 29 handled user HRs only)
+#
+# Idempotent: safe to re-run.
+
+set -euo pipefail
+
+echo "=== Cleaning up orphaned -rd HelmReleases ==="
+
+for hr_name in ferretdb-rd mysql-rd virtual-machine-rd; do
+  if kubectl -n cozy-system get hr "$hr_name" --no-headers 2>/dev/null | grep -q .; then
+    echo "  [DELETE] hr/${hr_name}"
+    kubectl -n cozy-system delete hr "$hr_name" --wait=false
+  else
+    echo "  [SKIP] hr/${hr_name} already gone"
+  fi
+  kubectl -n cozy-system delete secret -l "owner=helm,name=${hr_name}" --ignore-not-found
+done
+
+echo "=== Cleanup complete ==="
+
+# Stamp version
+kubectl create configmap -n cozy-system cozystack-version \
+  --from-literal=version=34 --dry-run=client -o yaml | kubectl apply -f-
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index ae005a89..f6c3b6ba 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -6,7 +6,7 @@ sourceRef:
 migrations:
   enabled: false
   image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0-rc.1@sha256:21a09c9f8dfd0a0c9b8c14c70029a39bfce021c66f1d4cacad9764c35dce6e8f
-  targetVersion: 33
+  targetVersion: 34
 # Bundle deployment configuration
 bundles:
   system:

From 7427bbdaa3cc94986479f8abc1386fec087bff38 Mon Sep 17 00:00:00 2001
From: Andrey Kolkov <androndo@gmail.com>
Date: Wed, 25 Feb 2026 19:56:07 +0400
Subject: [PATCH 165/666] fix(dashboard): backupjobs creation form fixes and
 category idetifier in sidebar

Signed-off-by: Andrey Kolkov <androndo@gmail.com>
---
 internal/controller/dashboard/sidebar.go      |  2 +-
 .../controller/dashboard/static_refactored.go | 21 +++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/internal/controller/dashboard/sidebar.go b/internal/controller/dashboard/sidebar.go
index 6de5537e..8216d39a 100644
--- a/internal/controller/dashboard/sidebar.go
+++ b/internal/controller/dashboard/sidebar.go
@@ -176,7 +176,7 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 
 	// Add hardcoded Backups section
 	menuItems = append(menuItems, map[string]any{
-		"key":   "backups",
+		"key":   "backups-category",
 		"label": "Backups",
 		"children": []any{
 			map[string]any{
diff --git a/internal/controller/dashboard/static_refactored.go b/internal/controller/dashboard/static_refactored.go
index 9c3d8461..3974c105 100644
--- a/internal/controller/dashboard/static_refactored.go
+++ b/internal/controller/dashboard/static_refactored.go
@@ -516,6 +516,27 @@ func CreateAllCustomFormsOverrides() []*dashboardv1alpha1.CustomFormsOverride {
 				createFormItem("spec.schedule.cron", "Schedule Cron", "text"),
 			},
 		}),
+
+		// BackupJobs form override - backups.cozystack.io/v1alpha1
+		createCustomFormsOverride("default-/backups.cozystack.io/v1alpha1/backupjobs", map[string]any{
+			"formItems": []any{
+				createFormItem("metadata.name", "Name", "text"),
+				createFormItem("metadata.namespace", "Namespace", "text"),
+				createFormItem("spec.planRef.name", "Plan Name (optional)", "text"),
+				createFormItem("spec.applicationRef.apiGroup", "Application API Group", "text"),
+				createFormItem("spec.applicationRef.kind", "Application Kind", "text"),
+				createFormItem("spec.applicationRef.name", "Application Name", "text"),
+				createFormItemWithAPI("spec.backupClassName", "Backup Class", "select", map[string]any{
+					"api": map[string]any{
+						"fetchUrl":       "/api/clusters/{cluster}/k8s/apis/backups.cozystack.io/v1alpha1/backupclasses",
+						"pathToItems":    []any{"items"},
+						"pathToValue":    []any{"metadata", "name"},
+						"pathToLabel":    []any{"metadata", "name"},
+						"clusterNameVar": "clusterName",
+					},
+				}),
+			},
+		}),
 	}
 }
 

From 65c6936e9547bc2752411f76173c4cf68dcc8b15 Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Wed, 25 Feb 2026 16:09:50 +0000
Subject: [PATCH 166/666] Prepare release v1.0.0-rc.2

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 packages/apps/kubernetes/images/kubevirt-csi-driver.tag     | 2 +-
 packages/core/installer/values.yaml                         | 4 ++--
 packages/core/platform/values.yaml                          | 2 +-
 packages/core/testing/values.yaml                           | 2 +-
 packages/extra/bootbox/images/matchbox.tag                  | 2 +-
 packages/extra/seaweedfs/images/objectstorage-sidecar.tag   | 2 +-
 packages/system/backup-controller/values.yaml               | 2 +-
 packages/system/backupstrategy-controller/values.yaml       | 2 +-
 packages/system/bucket/images/s3manager.tag                 | 2 +-
 packages/system/cozystack-api/values.yaml                   | 2 +-
 packages/system/cozystack-controller/values.yaml            | 2 +-
 packages/system/dashboard/templates/configmap.yaml          | 2 +-
 packages/system/dashboard/values.yaml                       | 6 +++---
 .../system/grafana-operator/images/grafana-dashboards.tag   | 2 +-
 packages/system/kamaji/values.yaml                          | 4 ++--
 packages/system/kubeovn-plunger/values.yaml                 | 2 +-
 packages/system/kubeovn-webhook/values.yaml                 | 2 +-
 packages/system/kubevirt-csi-node/values.yaml               | 2 +-
 packages/system/lineage-controller-webhook/values.yaml      | 2 +-
 packages/system/linstor/values.yaml                         | 4 ++--
 packages/system/objectstorage-controller/values.yaml        | 2 +-
 packages/system/seaweedfs/values.yaml                       | 2 +-
 22 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
index d61f214a..42929b3d 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:604561e23df1b8eb25c24cf73fd93c7aaa6d1e7c56affbbda5c6f0f83424e4b1
+ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:434aa3b8e2a3cbf6681426b174e1c4fde23bafd12a6cccd046b5cb1749092ec4
diff --git a/packages/core/installer/values.yaml b/packages/core/installer/values.yaml
index 4fe99292..0e142387 100644
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -1,9 +1,9 @@
 cozystackOperator:
   # Deployment variant: talos, generic, hosted
   variant: talos
-  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.0.0-rc.1@sha256:5c0148116b2ab425106f6b86bbc1dfec593a83c993947c24eae92946d1c6116a
+  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.0.0-rc.2@sha256:e3fc5fc87761c31ee522f36420aa69683815d4057146be5d0fd4b5104ede8eae
   platformSourceUrl: 'oci://ghcr.io/cozystack/cozystack/cozystack-packages'
-  platformSourceRef: 'digest=sha256:b4ee831911b9c259a073f00390559f0bd5d8c78e22e48427a64ef05ed90ca008'
+  platformSourceRef: 'digest=sha256:5a03183c490e0d932207b010b94c0e38350652d75e13ef5a582fa818077043bb'
 # Generic variant configuration (only used when cozystackOperator.variant=generic)
 cozystack:
   # Kubernetes API server host (IP only, no protocol/port)
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index f6c3b6ba..83c01ecb 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -5,7 +5,7 @@ sourceRef:
   path: /
 migrations:
   enabled: false
-  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0-rc.1@sha256:21a09c9f8dfd0a0c9b8c14c70029a39bfce021c66f1d4cacad9764c35dce6e8f
+  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0-rc.2@sha256:68dabdebc38ac439228ae07031cc70e0fa184a24bd4e5b3b22c17466b2a55201
   targetVersion: 34
 # Bundle deployment configuration
 bundles:
diff --git a/packages/core/testing/values.yaml b/packages/core/testing/values.yaml
index 2ee9cb53..bfa830ac 100644
--- a/packages/core/testing/values.yaml
+++ b/packages/core/testing/values.yaml
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.0.0-rc.1@sha256:0eae9f519669667d60b160ebb93c127843c470ad9ca3447fceaa54604503a7ba
+  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.0.0-rc.2@sha256:0eae9f519669667d60b160ebb93c127843c470ad9ca3447fceaa54604503a7ba
diff --git a/packages/extra/bootbox/images/matchbox.tag b/packages/extra/bootbox/images/matchbox.tag
index 3ecbbec2..aad6f3ec 100644
--- a/packages/extra/bootbox/images/matchbox.tag
+++ b/packages/extra/bootbox/images/matchbox.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/matchbox:v1.0.0-rc.1@sha256:3306de19f1ad49a02c735d16b82d7c2ec015c8e0563f120f216274e9a3804431
+ghcr.io/cozystack/cozystack/matchbox:v1.0.0-rc.2@sha256:9f9cacb1e8e9c74c50f7e2d944e50ffb3efd0a7c6365f47c40a327d072e8c9cd
diff --git a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
index 6b014ed4..233de89e 100644
--- a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
+++ b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-rc.1@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0
+ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-rc.2@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0
diff --git a/packages/system/backup-controller/values.yaml b/packages/system/backup-controller/values.yaml
index a58e33fa..2b03c247 100644
--- a/packages/system/backup-controller/values.yaml
+++ b/packages/system/backup-controller/values.yaml
@@ -1,5 +1,5 @@
 backupController:
-  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.0.0-rc.1@sha256:0bb4173bdcd3d917a7bd358ecc2c6a053a06ab0bd1fcdb89d1016a66173e6dfb"
+  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.0.0-rc.2@sha256:0959df20e3422cd90a4f995873c0bcef57355984542eb5344c4937dced170c61"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/backupstrategy-controller/values.yaml b/packages/system/backupstrategy-controller/values.yaml
index 748f515a..ee85be3d 100644
--- a/packages/system/backupstrategy-controller/values.yaml
+++ b/packages/system/backupstrategy-controller/values.yaml
@@ -1,5 +1,5 @@
 backupStrategyController:
-  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.0.0-rc.1@sha256:c2d975574ea9edcd785b533e01add37909959a64ef815529162dfe1f472ea702"
+  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.0.0-rc.2@sha256:6f2cc68e0146aec114afb0d20ee0f95d90d539d5a4d6cf8b54c878389fba3c8e"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/bucket/images/s3manager.tag b/packages/system/bucket/images/s3manager.tag
index 261f2041..4b03d92c 100644
--- a/packages/system/bucket/images/s3manager.tag
+++ b/packages/system/bucket/images/s3manager.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:291427de7db54a1d19dc9c2c807bdcc664a14caa9538786f31317e8c01a4a008
+ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:279008f87460d709e99ed25ee8a1e4568a290bb9afa0e3dd3a06d524163a132b
diff --git a/packages/system/cozystack-api/values.yaml b/packages/system/cozystack-api/values.yaml
index f316ec8d..ba97e22a 100644
--- a/packages/system/cozystack-api/values.yaml
+++ b/packages/system/cozystack-api/values.yaml
@@ -1,3 +1,3 @@
 cozystackAPI:
-  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.0.0-rc.1@sha256:9195ac6ef1d29aba3e1903f29a9aeeb72f5bf7ba3dbd7ebd866a06a4433e5915
+  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.0.0-rc.2@sha256:5b05ca6621888da5309cbd743c30186d518c9d67161a432890777988ec9e6604
   replicas: 2
diff --git a/packages/system/cozystack-controller/values.yaml b/packages/system/cozystack-controller/values.yaml
index 03f0aa4d..af556329 100644
--- a/packages/system/cozystack-controller/values.yaml
+++ b/packages/system/cozystack-controller/values.yaml
@@ -1,4 +1,4 @@
 cozystackController:
-  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.0.0-rc.1@sha256:0ac4b6d55daf79e2a7a045cd21b48ba598ac2628442fd9c4d0556cf9af6b83be
+  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.0.0-rc.2@sha256:04511034749f7e3bfc30bef6492eae17890d09e57609a4ed8065d9081e87fa88
   debug: false
   disableTelemetry: false
diff --git a/packages/system/dashboard/templates/configmap.yaml b/packages/system/dashboard/templates/configmap.yaml
index 0e47e906..ade2c3a0 100644
--- a/packages/system/dashboard/templates/configmap.yaml
+++ b/packages/system/dashboard/templates/configmap.yaml
@@ -1,6 +1,6 @@
 {{- $brandingConfig := .Values._cluster.branding | default dict }}
 
-{{- $tenantText := "v1.0.0-rc.1" }}
+{{- $tenantText := "v1.0.0-rc.2" }}
 {{- $footerText := "Cozystack" }}
 {{- $titleText := "Cozystack Dashboard" }}
 {{- $logoText := "" }}
diff --git a/packages/system/dashboard/values.yaml b/packages/system/dashboard/values.yaml
index 3f075524..8f4b178e 100644
--- a/packages/system/dashboard/values.yaml
+++ b/packages/system/dashboard/values.yaml
@@ -1,6 +1,6 @@
 openapiUI:
-  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.0.0-rc.1@sha256:26e787b259ab8722d61f89e07eda200ef2180ed10b0df8596d75bba15526feb0
+  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.0.0-rc.2@sha256:3138ad113fbf5a04b43629a4633987eeb298c921679c079595b11f450c43e9b6
 openapiUIK8sBff:
-  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.0.0-rc.1@sha256:0f508427bfa5a650eda6c5ef01ea32a586ac485a54902d7649ec49cc84f676f7
+  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.0.0-rc.2@sha256:325de4753a9a21ebef61637c1cf32cc98559d4bc506980ce5155c11513f7dcba
 tokenProxy:
-  image: ghcr.io/cozystack/cozystack/token-proxy:v1.0.0-rc.1@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
+  image: ghcr.io/cozystack/cozystack/token-proxy:v1.0.0-rc.2@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
diff --git a/packages/system/grafana-operator/images/grafana-dashboards.tag b/packages/system/grafana-operator/images/grafana-dashboards.tag
index 2c79dbbf..ab4d20b9 100644
--- a/packages/system/grafana-operator/images/grafana-dashboards.tag
+++ b/packages/system/grafana-operator/images/grafana-dashboards.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/grafana-dashboards:v1.0.0-rc.1@sha256:7a3c9af59f8d74d5a23750bbc845c7de64610dbd4d4f84011e10be037b3ce2a0
+ghcr.io/cozystack/cozystack/grafana-dashboards:v1.0.0-rc.2@sha256:7a3c9af59f8d74d5a23750bbc845c7de64610dbd4d4f84011e10be037b3ce2a0
diff --git a/packages/system/kamaji/values.yaml b/packages/system/kamaji/values.yaml
index 98f7750d..bd0ff4e8 100644
--- a/packages/system/kamaji/values.yaml
+++ b/packages/system/kamaji/values.yaml
@@ -3,7 +3,7 @@ kamaji:
     deploy: false
   image:
     pullPolicy: IfNotPresent
-    tag: v1.0.0-rc.1@sha256:0ca47c0d72a198f52f029bea30e89557680eac65c7914369b092d8ed9cc9997b
+    tag: v1.0.0-rc.2@sha256:69e00bbed5dedbd57f6c0e9d02d1c32b96d5ca1379d6b3af9338a3a8e5e9f6ab
     repository: ghcr.io/cozystack/cozystack/kamaji
   resources:
     limits:
@@ -13,4 +13,4 @@ kamaji:
       cpu: 100m
       memory: 100Mi
   extraArgs:
-    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.0.0-rc.1@sha256:0ca47c0d72a198f52f029bea30e89557680eac65c7914369b092d8ed9cc9997b
+    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.0.0-rc.2@sha256:69e00bbed5dedbd57f6c0e9d02d1c32b96d5ca1379d6b3af9338a3a8e5e9f6ab
diff --git a/packages/system/kubeovn-plunger/values.yaml b/packages/system/kubeovn-plunger/values.yaml
index 05396993..47b66258 100644
--- a/packages/system/kubeovn-plunger/values.yaml
+++ b/packages/system/kubeovn-plunger/values.yaml
@@ -1,4 +1,4 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.0.0-rc.1@sha256:6be9aa4b2dda15bf7300bd961cbc71c8bbf9ce97bc3cf613ef5a012d329b4e70
+image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.0.0-rc.2@sha256:64a668dd7f23de401514f41dd58a10e98b2bc3649eb4396e2e8332309e5b6454
 ovnCentralName: ovn-central
diff --git a/packages/system/kubeovn-webhook/values.yaml b/packages/system/kubeovn-webhook/values.yaml
index 3e266917..df760329 100644
--- a/packages/system/kubeovn-webhook/values.yaml
+++ b/packages/system/kubeovn-webhook/values.yaml
@@ -1,3 +1,3 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.0.0-rc.1@sha256:e18f9fd679e38f65362a8d0042f25468272f6d081136ad47027168d8e7e07a4a
+image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.0.0-rc.2@sha256:e18f9fd679e38f65362a8d0042f25468272f6d081136ad47027168d8e7e07a4a
diff --git a/packages/system/kubevirt-csi-node/values.yaml b/packages/system/kubevirt-csi-node/values.yaml
index ab26cc5a..eb9c5f00 100644
--- a/packages/system/kubevirt-csi-node/values.yaml
+++ b/packages/system/kubevirt-csi-node/values.yaml
@@ -1,3 +1,3 @@
 storageClass: replicated
 csiDriver:
-  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:604561e23df1b8eb25c24cf73fd93c7aaa6d1e7c56affbbda5c6f0f83424e4b1
+  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:434aa3b8e2a3cbf6681426b174e1c4fde23bafd12a6cccd046b5cb1749092ec4
diff --git a/packages/system/lineage-controller-webhook/values.yaml b/packages/system/lineage-controller-webhook/values.yaml
index f0afeb75..805f8f94 100644
--- a/packages/system/lineage-controller-webhook/values.yaml
+++ b/packages/system/lineage-controller-webhook/values.yaml
@@ -1,5 +1,5 @@
 lineageControllerWebhook:
-  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.0.0-rc.1@sha256:473ed28fcd7ddc35319a0fd33dd0fff3e56491b572677545a6e317b53578c53d
+  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.0.0-rc.2@sha256:f0e6e2d767301c80e6f05d505a5bb7864c3e370ef13e0ba22d46ff3f23c39d72
   debug: false
   localK8sAPIEndpoint:
     enabled: true
diff --git a/packages/system/linstor/values.yaml b/packages/system/linstor/values.yaml
index 23240e86..88511bd0 100644
--- a/packages/system/linstor/values.yaml
+++ b/packages/system/linstor/values.yaml
@@ -1,7 +1,7 @@
 piraeusServer:
   image:
     repository: ghcr.io/cozystack/cozystack/piraeus-server
-    tag: 1.32.3@sha256:59806529a090cb42e2fa2696e09814282b80e76a299b5fe9feec46772edd6876
+    tag: 1.32.3@sha256:aa97f39d90c0726b587f0a376504f13d1f308adeb42db7d98cec9ac7de237361
 # Talos-specific workarounds (disable for generic Linux like Ubuntu/Debian)
 talos:
   enabled: true
@@ -13,4 +13,4 @@ linstor:
 linstorCSI:
   image:
     repository: ghcr.io/cozystack/cozystack/linstor-csi
-    tag: v1.10.5@sha256:6e6cf48cb994f3918df946e02ec454ac64916678b3e60d78c136b431f1a26155
+    tag: v1.10.5@sha256:3eb68a89decdf8ea8a3944bec288c179719f84ed7237849b561cf043cb0482f5
diff --git a/packages/system/objectstorage-controller/values.yaml b/packages/system/objectstorage-controller/values.yaml
index d402d874..e39580c9 100644
--- a/packages/system/objectstorage-controller/values.yaml
+++ b/packages/system/objectstorage-controller/values.yaml
@@ -1,3 +1,3 @@
 objectstorage:
   controller:
-    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.0.0-rc.1@sha256:b4c972769afda76c48b58e7acf0ac66a0abf16a622f245c60338f432872f640a"
+    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.0.0-rc.2@sha256:b4c972769afda76c48b58e7acf0ac66a0abf16a622f245c60338f432872f640a"
diff --git a/packages/system/seaweedfs/values.yaml b/packages/system/seaweedfs/values.yaml
index 7e646322..5119bb23 100644
--- a/packages/system/seaweedfs/values.yaml
+++ b/packages/system/seaweedfs/values.yaml
@@ -177,7 +177,7 @@ seaweedfs:
     bucketClassName: "seaweedfs"
     region: ""
     sidecar:
-      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-rc.1@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0"
+      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-rc.2@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0"
   certificates:
     commonName: "SeaweedFS CA"
     ipAddresses: []

From 78cc4c09550a14959df0b27f64454ddb0efc6930 Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Wed, 25 Feb 2026 16:18:20 +0000
Subject: [PATCH 167/666] docs: add changelog for v1.0.0-rc.2

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.0.0-rc.2.md | 57 ++++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 docs/changelogs/v1.0.0-rc.2.md

diff --git a/docs/changelogs/v1.0.0-rc.2.md b/docs/changelogs/v1.0.0-rc.2.md
new file mode 100644
index 00000000..a056ff8f
--- /dev/null
+++ b/docs/changelogs/v1.0.0-rc.2.md
@@ -0,0 +1,57 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.0.0-rc.2
+-->
+
+> **⚠️ Release Candidate Warning**: This is a release candidate intended for final validation before the stable v1.0.0 release. Breaking changes are not expected at this stage, but please test thoroughly before deploying to production.
+
+## Features and Improvements
+
+* **[keycloak] Allow custom Ingress hostname via values**: Added an `ingress.host` field to the cozy-keycloak chart values, allowing operators to override the default `keycloak.<root-host>` Ingress hostname. The custom hostname is applied to both the Ingress resource and the `KC_HOSTNAME` environment variable in the StatefulSet. When left empty, the original behavior is preserved (fully backward compatible) ([**@sircthulhu**](https://github.com/sircthulhu) in #2101).
+
+## Fixes
+
+* **[platform] Fix upgrade issues in migrations, etcd timeout, and migration script**: Fixed multiple upgrade failures discovered during v0.41.1 → v1.0 upgrade testing. Migration 26 now uses the `cozystack.io/ui=true` label (always present on v0.41.1) instead of the new label that depends on migration 22 having run, and adds robust Helm secret deletion with fallback and verification. Migrations 28 and 29 wrap `grep` calls to prevent `pipefail` exits and fix the reconcile annotation to use RFC3339 format. Migration 27 now skips missing CRDs and adds a name-pattern fallback for Helm secret deletion. The etcd HelmRelease timeout is increased from 10m to 30m to accommodate TLS cert rotation hooks. The `migrate-to-version-1.0.sh` script gains the missing `bundle-disable`, `bundle-enable`, `expose-ingress`, and `expose-services` field mappings ([**@kvaps**](https://github.com/kvaps) in #2096).
+
+* **[platform] Fix orphaned -rd HelmReleases after application renames**: After the `ferretdb→mongodb`, `mysql→mariadb`, and `virtual-machine→vm-disk+vm-instance` renames, the system-level `-rd` HelmReleases in `cozy-system` (`ferretdb-rd`, `mysql-rd`, `virtual-machine-rd`) were left orphaned, referencing ExternalArtifacts that no longer exist and causing persistent reconciliation failures. Migrations 28 and 29 are updated to remove these resources, and migration 33 is added as a safety net for clusters that already passed those migrations ([**@kvaps**](https://github.com/kvaps) in #2102).
+
+* **[monitoring-agents] Fix FQDN resolution regression in tenant workload clusters**: The fix introduced in #2075 used `_cluster.cluster-domain` references in `values.yaml`, but `_cluster` values are not accessible from Helm subchart contexts — meaning fluent-bit received empty hostnames and failed to forward logs. This PR replaces the `_cluster` references with a new `global.clusterDomain` variable (empty by default for management clusters, set to the cluster domain for tenant clusters), which is correctly shared with all subcharts ([**@kvaps**](https://github.com/kvaps) in #2086).
+
+* **[dashboard] Fix legacy templating and cluster identifier in sidebar links**: Standardized the cluster identifier used across dashboard menu links, administration links, and API request paths, resolving incorrect or broken link targets for the Backups and External IPs sidebar sections ([**@androndo**](https://github.com/androndo) in #2093).
+
+* **[dashboard] Fix backupjobs creation form and sidebar backup category identifier**: Fixed the backup job creation form configuration, adding the required Name, Namespace, Plan Name, Application, and Backup Class fields. Fixed the sidebar backup category identifier that was causing incorrect navigation ([**@androndo**](https://github.com/androndo) in #2103).
+
+## Documentation
+
+* **[website] Add Helm chart development principles guide**: Added a new developer guide section documenting Cozystack's four core Helm chart principles: easy upstream updates, local-first artifacts, local dev/test workflow, and no external dependencies ([**@kvaps**](https://github.com/kvaps) in cozystack/website#418).
+
+* **[website] Add network architecture overview**: Added comprehensive network architecture documentation covering the multi-layered networking stack — MetalLB (L2/BGP), Cilium eBPF (kube-proxy replacement), Kube-OVN (centralized IPAM), and tenant isolation with identity-based eBPF policies — with Mermaid diagrams for all major traffic flows ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#422).
+
+* **[website] Update documentation to use jsonpatch for service exposure**: Improved `kubectl patch` commands throughout installation and configuration guides to use JSON Patch `add` operations for extending arrays instead of replacing them wholesale, making the documented commands safer and more precise ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#427).
+
+* **[website] Update certificates section in Platform Package documentation**: Updated the certificate configuration documentation to reflect the new `solver` and `issuerName` fields introduced in v1.0.0-rc.1, replacing the legacy `issuerType` references ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#429).
+
+* **[website] Add tenant Kubernetes cluster log querying guide**: Added documentation for querying logs from tenant Kubernetes clusters in Grafana using VictoriaLogs labels (`tenant`, `kubernetes_namespace_name`, `kubernetes_pod_name`), including the `monitoringAgents` addon prerequisite and step-by-step filtering examples ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#430).
+
+* **[website] Replace non-idempotent commands with idempotent alternatives**: Updated `helm install` to `helm upgrade --install`, `kubectl create -f` to `kubectl apply -f`, and `kubectl create ns` to the dry-run+apply pattern across all installation and deployment guides so commands can be safely re-run ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#431).
+
+* **[website] Fix broken documentation links with `.md` suffix**: Fixed incorrect internal links with `.md` suffix across virtualization guides for both v0 and v1 documentation, standardizing link text to "Developer Guide" ([**@cheese**](https://github.com/cheese) in cozystack/website#432).
+
+## Contributors
+
+We'd like to thank all contributors who made this release possible:
+
+* [**@androndo**](https://github.com/androndo)
+* [**@cheese**](https://github.com/cheese)
+* [**@IvanHunters**](https://github.com/IvanHunters)
+* [**@kvaps**](https://github.com/kvaps)
+* [**@lexfrei**](https://github.com/lexfrei)
+* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
+* [**@sircthulhu**](https://github.com/sircthulhu)
+
+### New Contributors
+
+We're excited to welcome our first-time contributors:
+
+* [**@cheese**](https://github.com/cheese) - First contribution!
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.0-rc.1...v1.0.0-rc.2

From 0ab7cc780a55511a512b50d818a7971a160eb8aa Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Wed, 25 Feb 2026 23:51:42 +0300
Subject: [PATCH 168/666] feat(bucket): add readonly S3 access credentials

Add a readonly BucketAccessClass to the seaweedfs COSI chart and a
second fixed BucketAccess per bucket so each bucket automatically
gets both readWrite and readonly S3 credentials.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 packages/apps/bucket/templates/bucketclaim.yaml        | 10 ++++++++++
 .../apps/bucket/templates/dashboard-resourcemap.yaml   |  1 +
 packages/system/bucket-rd/cozyrds/bucket.yaml          |  1 +
 .../seaweedfs/templates/cosi/cosi-bucket-class.yaml    |  9 +++++++++
 4 files changed, 21 insertions(+)

diff --git a/packages/apps/bucket/templates/bucketclaim.yaml b/packages/apps/bucket/templates/bucketclaim.yaml
index 5cfdc1c1..e27dd0ed 100644
--- a/packages/apps/bucket/templates/bucketclaim.yaml
+++ b/packages/apps/bucket/templates/bucketclaim.yaml
@@ -17,3 +17,13 @@ spec:
   bucketClaimName: {{ .Release.Name }}
   credentialsSecretName: {{ .Release.Name }}
   protocol: s3
+---
+apiVersion: objectstorage.k8s.io/v1alpha1
+kind: BucketAccess
+metadata:
+  name: {{ .Release.Name }}-readonly
+spec:
+  bucketAccessClassName: {{ $seaweedfs }}-readonly
+  bucketClaimName: {{ .Release.Name }}
+  credentialsSecretName: {{ .Release.Name }}-readonly
+  protocol: s3
diff --git a/packages/apps/bucket/templates/dashboard-resourcemap.yaml b/packages/apps/bucket/templates/dashboard-resourcemap.yaml
index 5edc8b7a..f10b5d32 100644
--- a/packages/apps/bucket/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/bucket/templates/dashboard-resourcemap.yaml
@@ -10,6 +10,7 @@ rules:
   resourceNames:
   - {{ .Release.Name }}
   - {{ .Release.Name }}-credentials
+  - {{ .Release.Name }}-readonly
   verbs: ["get", "list", "watch"]
 - apiGroups:
   - networking.k8s.io
diff --git a/packages/system/bucket-rd/cozyrds/bucket.yaml b/packages/system/bucket-rd/cozyrds/bucket.yaml
index 2a19f89e..5974b03d 100644
--- a/packages/system/bucket-rd/cozyrds/bucket.yaml
+++ b/packages/system/bucket-rd/cozyrds/bucket.yaml
@@ -33,6 +33,7 @@ spec:
       - resourceNames:
           - bucket-{{ .name }}
           - bucket-{{ .name }}-credentials
+          - bucket-{{ .name }}-readonly
   ingresses:
     exclude: []
     include:
diff --git a/packages/system/seaweedfs/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml b/packages/system/seaweedfs/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml
index e5503abd..5184a042 100644
--- a/packages/system/seaweedfs/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml
+++ b/packages/system/seaweedfs/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml
@@ -13,4 +13,13 @@ metadata:
   name: {{ .Values.cosi.bucketClassName }}
 driverName: {{ .Values.cosi.driverName }}
 authenticationType: KEY
+---
+kind: BucketAccessClass
+apiVersion: objectstorage.k8s.io/v1alpha1
+metadata:
+  name: {{ .Values.cosi.bucketClassName }}-readonly
+driverName: {{ .Values.cosi.driverName }}
+authenticationType: KEY
+parameters:
+  accessPolicy: "readonly"
 {{- end }}

From 7a107296e517ed2cb8fd78de50720e091e188605 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Thu, 26 Feb 2026 13:43:07 +0500
Subject: [PATCH 169/666] fix(dashboard): hide sidebar on cluster-level pages
 when no tenant selected

Remove stock-instance-* sidebars that were populated with namespace-scoped
menu items, causing the sidebar to incorrectly appear on cluster-level pages.
Clear the sidebar fallback ID so the frontend gracefully renders no sidebar
when no matching sidebar resource exists.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 internal/controller/dashboard/manager.go     |  4 ----
 internal/controller/dashboard/sidebar.go     | 11 ++---------
 packages/system/dashboard/templates/web.yaml |  2 +-
 3 files changed, 3 insertions(+), 14 deletions(-)

diff --git a/internal/controller/dashboard/manager.go b/internal/controller/dashboard/manager.go
index b0a4cd1b..339c9b9e 100644
--- a/internal/controller/dashboard/manager.go
+++ b/internal/controller/dashboard/manager.go
@@ -299,10 +299,6 @@ func (m *Manager) buildExpectedResourceSet(crds []cozyv1alpha1.ApplicationDefini
 
 		// Add other stock sidebars that are created for each CRD
 		stockSidebars := []string{
-			"stock-instance-api-form",
-			"stock-instance-api-table",
-			"stock-instance-builtin-form",
-			"stock-instance-builtin-table",
 			"stock-project-factory-marketplace",
 			"stock-project-factory-workloadmonitor-details",
 			"stock-project-api-form",
diff --git a/internal/controller/dashboard/sidebar.go b/internal/controller/dashboard/sidebar.go
index 8216d39a..0ea41f0d 100644
--- a/internal/controller/dashboard/sidebar.go
+++ b/internal/controller/dashboard/sidebar.go
@@ -17,8 +17,7 @@ import (
 
 // ensureSidebar creates/updates multiple Sidebar resources that share the same menu:
 //   - The "details" sidebar tied to the current kind (stock-project-factory-<kind>-details)
-//   - The stock-instance sidebars: api-form, api-table, builtin-form, builtin-table
-//   - The stock-project sidebars:  api-form, api-table, builtin-form, builtin-table, crd-form, crd-table
+//   - The stock-project sidebars: api-form, api-table, builtin-form, builtin-table, crd-form, crd-table
 //
 // Menu rules:
 //   - The first section is "Marketplace" with two hardcoded entries:
@@ -228,13 +227,7 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 	// 6) Prepare the list of Sidebar IDs to upsert with the SAME content
 	// Create sidebars for ALL CRDs with dashboard config
 	targetIDs := []string{
-		// stock-instance sidebars
-		"stock-instance-api-form",
-		"stock-instance-api-table",
-		"stock-instance-builtin-form",
-		"stock-instance-builtin-table",
-
-		// stock-project sidebars
+		// stock-project sidebars (namespace-level, full menu)
 		"stock-project-factory-marketplace",
 		"stock-project-factory-workloadmonitor-details",
 		"stock-project-factory-kube-service-details",
diff --git a/packages/system/dashboard/templates/web.yaml b/packages/system/dashboard/templates/web.yaml
index defb087b..7799afbf 100644
--- a/packages/system/dashboard/templates/web.yaml
+++ b/packages/system/dashboard/templates/web.yaml
@@ -136,7 +136,7 @@ spec:
             - name: CUSTOMIZATION_NAVIGATION_RESOURCE_PLURAL
               value: navigations
             - name: CUSTOMIZATION_SIDEBAR_FALLBACK_ID
-              value: stock-project-api-table
+              value: ""
             - name: CUSTOMIZATION_BREADCRUMBS_FALLBACK_ID
               value: stock-project-api-table
             - name: INSTANCES_API_GROUP

From 4df456fdcd87a0bf96aedfbdbcd5578ec9a1ade9 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Thu, 26 Feb 2026 15:18:43 +0500
Subject: [PATCH 170/666] [cert-manager] Updated cert-manager to 1.19.3 with
 new crd packaging

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/system/cert-manager-crds/Makefile    |     9 +-
 .../charts/cert-manager/Chart.yaml            |    26 -
 .../charts/cert-manager/README.md             |  1994 ---
 .../charts/cert-manager/templates/crds.yaml   | 12013 ---------------
 .../charts/cert-manager/values.schema.json    |  2135 ---
 .../charts/cert-manager/values.yaml           |  1455 --
 .../cert-manager => }/templates/_helpers.tpl  |    11 +
 .../crd-acme.cert-manager.io_challenges.yaml  |  3281 +++++
 .../crd-acme.cert-manager.io_orders.yaml      |   274 +
 ...d-cert-manager.io_certificaterequests.yaml |   319 +
 .../crd-cert-manager.io_certificates.yaml     |   816 ++
 .../crd-cert-manager.io_clusterissuers.yaml   |  3815 +++++
 .../crd-cert-manager.io_issuers.yaml          |  3814 +++++
 packages/system/cert-manager-crds/values.yaml |    10 +-
 packages/system/cert-manager/Makefile         |     2 +
 .../charts/cert-manager/Chart.yaml            |     4 +-
 .../charts/cert-manager/README.md             |   107 +-
 .../charts/cert-manager/templates/NOTES.txt   |     6 +
 .../cert-manager/templates/_helpers.tpl       |    11 +
 .../templates/cainjector-deployment.yaml      |    11 +-
 .../charts/cert-manager/templates/crds.yaml   | 12036 ----------------
 .../cert-manager/templates/deployment.yaml    |    13 +-
 .../charts/cert-manager/templates/rbac.yaml   |    10 +-
 .../templates/serviceaccount.yaml             |     3 +-
 .../templates/servicemonitor.yaml             |     6 +
 .../templates/startupapicheck-job.yaml        |    11 +-
 .../templates/webhook-deployment.yaml         |    25 +-
 .../charts/cert-manager/values.schema.json    |    50 +-
 .../charts/cert-manager/values.yaml           |    59 +-
 packages/system/cert-manager/values.yaml      |     2 -
 30 files changed, 12568 insertions(+), 29760 deletions(-)
 delete mode 100644 packages/system/cert-manager-crds/charts/cert-manager/Chart.yaml
 delete mode 100644 packages/system/cert-manager-crds/charts/cert-manager/README.md
 delete mode 100644 packages/system/cert-manager-crds/charts/cert-manager/templates/crds.yaml
 delete mode 100644 packages/system/cert-manager-crds/charts/cert-manager/values.schema.json
 delete mode 100644 packages/system/cert-manager-crds/charts/cert-manager/values.yaml
 rename packages/system/cert-manager-crds/{charts/cert-manager => }/templates/_helpers.tpl (95%)
 create mode 100644 packages/system/cert-manager-crds/templates/crd-acme.cert-manager.io_challenges.yaml
 create mode 100644 packages/system/cert-manager-crds/templates/crd-acme.cert-manager.io_orders.yaml
 create mode 100644 packages/system/cert-manager-crds/templates/crd-cert-manager.io_certificaterequests.yaml
 create mode 100644 packages/system/cert-manager-crds/templates/crd-cert-manager.io_certificates.yaml
 create mode 100644 packages/system/cert-manager-crds/templates/crd-cert-manager.io_clusterissuers.yaml
 create mode 100644 packages/system/cert-manager-crds/templates/crd-cert-manager.io_issuers.yaml
 delete mode 100644 packages/system/cert-manager/charts/cert-manager/templates/crds.yaml

diff --git a/packages/system/cert-manager-crds/Makefile b/packages/system/cert-manager-crds/Makefile
index 48e5644c..7e7370ac 100644
--- a/packages/system/cert-manager-crds/Makefile
+++ b/packages/system/cert-manager-crds/Makefile
@@ -1,8 +1,5 @@
+export NAME=cert-manager-crds
+export NAMESPACE=cozy-cert-manager
+
 include ../../../hack/package.mk
 
-update:
-	rm -rf charts
-	helm repo add jetstack https://charts.jetstack.io
-	helm repo update jetstack
-	helm pull jetstack/cert-manager --untar --untardir charts
-	rm -f -- `find charts/cert-manager/templates -maxdepth 1 -mindepth 1 | grep -v 'crds.yaml\|_helpers.tpl'`
diff --git a/packages/system/cert-manager-crds/charts/cert-manager/Chart.yaml b/packages/system/cert-manager-crds/charts/cert-manager/Chart.yaml
deleted file mode 100644
index 300db669..00000000
--- a/packages/system/cert-manager-crds/charts/cert-manager/Chart.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-annotations:
-  artifacthub.io/category: security
-  artifacthub.io/license: Apache-2.0
-  artifacthub.io/prerelease: "false"
-  artifacthub.io/signKey: |
-    fingerprint: 1020CF3C033D4F35BAE1C19E1226061C665DF13E
-    url: https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg
-apiVersion: v2
-appVersion: v1.16.3
-description: A Helm chart for cert-manager
-home: https://cert-manager.io
-icon: https://raw.githubusercontent.com/cert-manager/community/4d35a69437d21b76322157e6284be4cd64e6d2b7/logo/logo-small.png
-keywords:
-- cert-manager
-- kube-lego
-- letsencrypt
-- tls
-kubeVersion: '>= 1.22.0-0'
-maintainers:
-- email: cert-manager-maintainers@googlegroups.com
-  name: cert-manager-maintainers
-  url: https://cert-manager.io
-name: cert-manager
-sources:
-- https://github.com/cert-manager/cert-manager
-version: v1.16.3
diff --git a/packages/system/cert-manager-crds/charts/cert-manager/README.md b/packages/system/cert-manager-crds/charts/cert-manager/README.md
deleted file mode 100644
index 6fa25cc9..00000000
--- a/packages/system/cert-manager-crds/charts/cert-manager/README.md
+++ /dev/null
@@ -1,1994 +0,0 @@
-# cert-manager
-
-cert-manager is a Kubernetes addon to automate the management and issuance of
-TLS certificates from various issuing sources.
-
-It will ensure certificates are valid and up to date periodically, and attempt
-to renew certificates at an appropriate time before expiry.
-
-## Prerequisites
-
-- Kubernetes 1.22+
-
-## Installing the Chart
-
-Full installation instructions, including details on how to configure extra
-functionality in cert-manager can be found in the [installation docs](https://cert-manager.io/docs/installation/kubernetes/).
-
-Before installing the chart, you must first install the cert-manager CustomResourceDefinition resources.
-This is performed in a separate step to allow you to easily uninstall and reinstall cert-manager without deleting your installed custom resources.
-
-```bash
-$ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.3/cert-manager.crds.yaml
-```
-
-To install the chart with the release name `cert-manager`:
-
-```console
-## Add the Jetstack Helm repository
-$ helm repo add jetstack https://charts.jetstack.io --force-update
-
-## Install the cert-manager helm chart
-$ helm install cert-manager --namespace cert-manager --version v1.16.3 jetstack/cert-manager
-```
-
-In order to begin issuing certificates, you will need to set up a ClusterIssuer
-or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).
-
-More information on the different types of issuers and how to configure them
-can be found in [our documentation](https://cert-manager.io/docs/configuration/).
-
-For information on how to configure cert-manager to automatically provision
-Certificates for Ingress resources, take a look at the
-[Securing Ingresses documentation](https://cert-manager.io/docs/usage/ingress/).
-
-> **Tip**: List all releases using `helm list`
-
-## Upgrading the Chart
-
-Special considerations may be required when upgrading the Helm chart, and these
-are documented in our full [upgrading guide](https://cert-manager.io/docs/installation/upgrading/).
-
-**Please check here before performing upgrades!**
-
-## Uninstalling the Chart
-
-To uninstall/delete the `cert-manager` deployment:
-
-```console
-$ helm delete cert-manager --namespace cert-manager
-```
-
-The command removes all the Kubernetes components associated with the chart and deletes the release.
-
-If you want to completely uninstall cert-manager from your cluster, you will also need to
-delete the previously installed CustomResourceDefinition resources:
-
-```console
-$ kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.3/cert-manager.crds.yaml
-```
-
-## Configuration
-<!-- AUTO-GENERATED -->
-
-### Global
-
-#### **global.imagePullSecrets** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-Reference to one or more secrets to be used when pulling images. For more information, see [Pull an Image from a Private Registry](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/).  
-  
-For example:
-
-```yaml
-imagePullSecrets:
-  - name: "image-pull-secret"
-```
-#### **global.commonLabels** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-Labels to apply to all resources.  
-Please note that this does not add labels to the resources created dynamically by the controllers. For these resources, you have to add the labels in the template in the cert-manager custom resource: For example, podTemplate/ ingressTemplate in ACMEChallengeSolverHTTP01Ingress. For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#acme.cert-manager.io/v1.ACMEChallengeSolverHTTP01Ingress).  
-For example, secretTemplate in CertificateSpec  
-For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec).
-#### **global.revisionHistoryLimit** ~ `number`
-
-The number of old ReplicaSets to retain to allow rollback (if not set, the default Kubernetes value is set to 10).
-
-#### **global.priorityClassName** ~ `string`
-> Default value:
-> ```yaml
-> ""
-> ```
-
-The optional priority class to be used for the cert-manager pods.
-#### **global.rbac.create** ~ `bool`
-> Default value:
-> ```yaml
-> true
-> ```
-
-Create required ClusterRoles and ClusterRoleBindings for cert-manager.
-#### **global.rbac.aggregateClusterRoles** ~ `bool`
-> Default value:
-> ```yaml
-> true
-> ```
-
-Aggregate ClusterRoles to Kubernetes default user-facing roles. For more information, see [User-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles)
-#### **global.podSecurityPolicy.enabled** ~ `bool`
-> Default value:
-> ```yaml
-> false
-> ```
-
-Create PodSecurityPolicy for cert-manager.  
-  
-Note that PodSecurityPolicy was deprecated in Kubernetes 1.21 and removed in Kubernetes 1.25.
-#### **global.podSecurityPolicy.useAppArmor** ~ `bool`
-> Default value:
-> ```yaml
-> true
-> ```
-
-Configure the PodSecurityPolicy to use AppArmor.
-#### **global.logLevel** ~ `number`
-> Default value:
-> ```yaml
-> 2
-> ```
-
-Set the verbosity of cert-manager. A range of 0 - 6, with 6 being the most verbose.
-#### **global.leaderElection.namespace** ~ `string`
-> Default value:
-> ```yaml
-> kube-system
-> ```
-
-Override the namespace used for the leader election lease.
-#### **global.leaderElection.leaseDuration** ~ `string`
-
-The duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate.
-
-#### **global.leaderElection.renewDeadline** ~ `string`
-
-The interval between attempts by the acting master to renew a leadership slot before it stops leading. This must be less than or equal to the lease duration.
-
-#### **global.leaderElection.retryPeriod** ~ `string`
-
-The duration the clients should wait between attempting acquisition and renewal of a leadership.
-
-#### **installCRDs** ~ `bool`
-> Default value:
-> ```yaml
-> false
-> ```
-
-This option is equivalent to setting crds.enabled=true and crds.keep=true. Deprecated: use crds.enabled and crds.keep instead.
-#### **crds.enabled** ~ `bool`
-> Default value:
-> ```yaml
-> false
-> ```
-
-This option decides if the CRDs should be installed as part of the Helm installation.
-#### **crds.keep** ~ `bool`
-> Default value:
-> ```yaml
-> true
-> ```
-
-This option makes it so that the "helm.sh/resource-policy": keep annotation is added to the CRD. This will prevent Helm from uninstalling the CRD when the Helm release is uninstalled. WARNING: when the CRDs are removed, all cert-manager custom resources  
-(Certificates, Issuers, ...) will be removed too by the garbage collector.
-### Controller
-
-#### **replicaCount** ~ `number`
-> Default value:
-> ```yaml
-> 1
-> ```
-
-The number of replicas of the cert-manager controller to run.  
-  
-The default is 1, but in production set this to 2 or 3 to provide high availability.  
-  
-If `replicas > 1`, consider setting `podDisruptionBudget.enabled=true`.  
-  
-Note that cert-manager uses leader election to ensure that there can only be a single instance active at a time.
-#### **strategy** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-Deployment update strategy for the cert-manager controller deployment. For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy).  
-  
-For example:
-
-```yaml
-strategy:
-  type: RollingUpdate
-  rollingUpdate:
-    maxSurge: 0
-    maxUnavailable: 1
-```
-#### **podDisruptionBudget.enabled** ~ `bool`
-> Default value:
-> ```yaml
-> false
-> ```
-
-Enable or disable the PodDisruptionBudget resource.  
-  
-This prevents downtime during voluntary disruptions such as during a Node upgrade. For example, the PodDisruptionBudget will block `kubectl drain` if it is used on the Node where the only remaining cert-manager  
-Pod is currently running.
-#### **podDisruptionBudget.minAvailable** ~ `unknown`
-
-This configures the minimum available pods for disruptions. It can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%).  
-It cannot be used if `maxUnavailable` is set.
-
-
-#### **podDisruptionBudget.maxUnavailable** ~ `unknown`
-
-This configures the maximum unavailable pods for disruptions. It can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%). it cannot be used if `minAvailable` is set.
-
-
-#### **featureGates** ~ `string`
-> Default value:
-> ```yaml
-> ""
-> ```
-
-A comma-separated list of feature gates that should be enabled on the controller pod.
-#### **maxConcurrentChallenges** ~ `number`
-> Default value:
-> ```yaml
-> 60
-> ```
-
-The maximum number of challenges that can be scheduled as 'processing' at once.
-#### **image.registry** ~ `string`
-
-The container registry to pull the manager image from.
-
-#### **image.repository** ~ `string`
-> Default value:
-> ```yaml
-> quay.io/jetstack/cert-manager-controller
-> ```
-
-The container image for the cert-manager controller.
-
-#### **image.tag** ~ `string`
-
-Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.
-
-#### **image.digest** ~ `string`
-
-Setting a digest will override any tag.
-
-#### **image.pullPolicy** ~ `string`
-> Default value:
-> ```yaml
-> IfNotPresent
-> ```
-
-Kubernetes imagePullPolicy on Deployment.
-#### **clusterResourceNamespace** ~ `string`
-> Default value:
-> ```yaml
-> ""
-> ```
-
-Override the namespace used to store DNS provider credentials etc. for ClusterIssuer resources. By default, the same namespace as cert-manager is deployed within is used. This namespace will not be automatically created by the Helm chart.
-#### **namespace** ~ `string`
-> Default value:
-> ```yaml
-> ""
-> ```
-
-This namespace allows you to define where the services are installed into. If not set then they use the namespace of the release. This is helpful when installing cert manager as a chart dependency (sub chart).
-#### **fullnameOverride** ~ `string`
-
-Override the "cert-manager.fullname" value. This value is used as part of most of the names of the resources created by this Helm chart.
-
-#### **nameOverride** ~ `string`
-
-Override the "cert-manager.name" value, which is used to annotate some of the resources that are created by this Chart (using "app.kubernetes.io/name"). NOTE: There are some inconsistencies in the Helm chart when it comes to these annotations (some resources use eg. "cainjector.name" which resolves to the value "cainjector").
-
-#### **serviceAccount.create** ~ `bool`
-> Default value:
-> ```yaml
-> true
-> ```
-
-Specifies whether a service account should be created.
-#### **serviceAccount.name** ~ `string`
-
-The name of the service account to use.  
-If not set and create is true, a name is generated using the fullname template.
-
-#### **serviceAccount.annotations** ~ `object`
-
-Optional additional annotations to add to the controller's Service Account.
-
-#### **serviceAccount.labels** ~ `object`
-
-Optional additional labels to add to the controller's Service Account.
-
-#### **serviceAccount.automountServiceAccountToken** ~ `bool`
-> Default value:
-> ```yaml
-> true
-> ```
-
-Automount API credentials for a Service Account.
-#### **automountServiceAccountToken** ~ `bool`
-
-Automounting API credentials for a particular pod.
-
-#### **enableCertificateOwnerRef** ~ `bool`
-> Default value:
-> ```yaml
-> false
-> ```
-
-When this flag is enabled, secrets will be automatically removed when the certificate resource is deleted.
-#### **config** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-This property is used to configure options for the controller pod. This allows setting options that would usually be provided using flags.  
-  
-If `apiVersion` and `kind` are unspecified they default to the current latest version (currently `controller.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.  
-  
-For example:
-
-```yaml
-config:
-  apiVersion: controller.config.cert-manager.io/v1alpha1
-  kind: ControllerConfiguration
-  logging:
-    verbosity: 2
-    format: text
-  leaderElectionConfig:
-    namespace: kube-system
-  kubernetesAPIQPS: 9000
-  kubernetesAPIBurst: 9000
-  numberOfConcurrentWorkers: 200
-  featureGates:
-    AdditionalCertificateOutputFormats: true
-    DisallowInsecureCSRUsageDefinition: true
-    ExperimentalCertificateSigningRequestControllers: true
-    ExperimentalGatewayAPISupport: true
-    LiteralCertificateSubject: true
-    SecretsFilteredCaching: true
-    ServerSideApply: true
-    StableCertificateRequestName: true
-    UseCertificateRequestBasicConstraints: true
-    ValidateCAA: true
-  # Configure the metrics server for TLS
-  # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
-  metricsTLSConfig:
-    dynamic:
-      secretNamespace: "cert-manager"
-      secretName: "cert-manager-metrics-ca"
-      dnsNames:
-      - cert-manager-metrics
-```
-#### **dns01RecursiveNameservers** ~ `string`
-> Default value:
-> ```yaml
-> ""
-> ```
-
-A comma-separated string with the host and port of the recursive nameservers cert-manager should query.
-#### **dns01RecursiveNameserversOnly** ~ `bool`
-> Default value:
-> ```yaml
-> false
-> ```
-
-Forces cert-manager to use only the recursive nameservers for verification. Enabling this option could cause the DNS01 self check to take longer owing to caching performed by the recursive nameservers.
-#### **disableAutoApproval** ~ `bool`
-> Default value:
-> ```yaml
-> false
-> ```
-
-Option to disable cert-manager's build-in auto-approver. The auto-approver approves all CertificateRequests that reference issuers matching the 'approveSignerNames' option. This 'disableAutoApproval' option is useful when you want to make all approval decisions using a different approver (like approver-policy - https://github.com/cert-manager/approver-policy).
-#### **approveSignerNames** ~ `array`
-> Default value:
-> ```yaml
-> - issuers.cert-manager.io/*
-> - clusterissuers.cert-manager.io/*
-> ```
-
-List of signer names that cert-manager will approve by default. CertificateRequests referencing these signer names will be auto-approved by cert-manager. Defaults to just approving the cert-manager.io Issuer and ClusterIssuer issuers. When set to an empty array, ALL issuers will be auto-approved by cert-manager. To disable the auto-approval, because eg. you are using approver-policy, you can enable 'disableAutoApproval'.  
-ref: https://cert-manager.io/docs/concepts/certificaterequest/#approval
-
-#### **extraArgs** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-Additional command line flags to pass to cert-manager controller binary. To see all available flags run `docker run quay.io/jetstack/cert-manager-controller:<version> --help`.  
-  
-Use this flag to enable or disable arbitrary controllers. For example, to disable the CertificateRequests approver.  
-  
-For example:
-
-```yaml
-extraArgs:
-  - --controllers=*,-certificaterequests-approver
-```
-#### **extraEnv** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-Additional environment variables to pass to cert-manager controller binary.  
-For example:
-
-```yaml
-extraEnv:
-- name: SOME_VAR
-  value: 'some value'
-```
-#### **resources** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-Resources to provide to the cert-manager controller pod.  
-  
-For example:
-
-```yaml
-requests:
-  cpu: 10m
-  memory: 32Mi
-```
-
-For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
-#### **securityContext** ~ `object`
-> Default value:
-> ```yaml
-> runAsNonRoot: true
-> seccompProfile:
->   type: RuntimeDefault
-> ```
-
-Pod Security Context.  
-For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
-
-#### **containerSecurityContext** ~ `object`
-> Default value:
-> ```yaml
-> allowPrivilegeEscalation: false
-> capabilities:
->   drop:
->     - ALL
-> readOnlyRootFilesystem: true
-> ```
-
-Container Security Context to be set on the controller component container. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
-
-#### **volumes** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-Additional volumes to add to the cert-manager controller pod.
-#### **volumeMounts** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-Additional volume mounts to add to the cert-manager controller container.
-#### **deploymentAnnotations** ~ `object`
-
-Optional additional annotations to add to the controller Deployment.
-
-#### **podAnnotations** ~ `object`
-
-Optional additional annotations to add to the controller Pods.
-
-#### **podLabels** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-Optional additional labels to add to the controller Pods.
-#### **serviceAnnotations** ~ `object`
-
-Optional annotations to add to the controller Service.
-
-#### **serviceLabels** ~ `object`
-
-Optional additional labels to add to the controller Service.
-
-#### **serviceIPFamilyPolicy** ~ `string`
-
-Optionally set the IP family policy for the controller Service to configure dual-stack; see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services).
-
-#### **serviceIPFamilies** ~ `array`
-
-Optionally set the IP families for the controller Service that should be supported, in the order in which they should be applied to ClusterIP. Can be IPv4 and/or IPv6.
-
-#### **podDnsPolicy** ~ `string`
-
-Pod DNS policy.  
-For more information, see [Pod's DNS Policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy).
-
-#### **podDnsConfig** ~ `object`
-
-Pod DNS configuration. The podDnsConfig field is optional and can work with any podDnsPolicy settings. However, when a Pod's dnsPolicy is set to "None", the dnsConfig field has to be specified. For more information, see [Pod's DNS Config](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config).
-
-#### **hostAliases** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-Optional hostAliases for cert-manager-controller pods. May be useful when performing ACME DNS-01 self checks.
-#### **nodeSelector** ~ `object`
-> Default value:
-> ```yaml
-> kubernetes.io/os: linux
-> ```
-
-The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).  
-  
-This default ensures that Pods are only scheduled to Linux nodes. It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
-
-#### **ingressShim.defaultIssuerName** ~ `string`
-
-Optional default issuer to use for ingress resources.
-
-#### **ingressShim.defaultIssuerKind** ~ `string`
-
-Optional default issuer kind to use for ingress resources.
-
-#### **ingressShim.defaultIssuerGroup** ~ `string`
-
-Optional default issuer group to use for ingress resources.
-
-#### **http_proxy** ~ `string`
-
-Configures the HTTP_PROXY environment variable where a HTTP proxy is required.
-
-#### **https_proxy** ~ `string`
-
-Configures the HTTPS_PROXY environment variable where a HTTP proxy is required.
-
-#### **no_proxy** ~ `string`
-
-Configures the NO_PROXY environment variable where a HTTP proxy is required, but certain domains should be excluded.
-
-#### **affinity** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).  
-  
-For example:
-
-```yaml
-affinity:
-  nodeAffinity:
-   requiredDuringSchedulingIgnoredDuringExecution:
-     nodeSelectorTerms:
-     - matchExpressions:
-       - key: foo.bar.com/role
-         operator: In
-         values:
-         - master
-```
-#### **tolerations** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).  
-  
-For example:
-
-```yaml
-tolerations:
-- key: foo.bar.com/role
-  operator: Equal
-  value: master
-  effect: NoSchedule
-```
-#### **topologySpreadConstraints** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core  
-  
-For example:
-
-```yaml
-topologySpreadConstraints:
-- maxSkew: 2
-  topologyKey: topology.kubernetes.io/zone
-  whenUnsatisfiable: ScheduleAnyway
-  labelSelector:
-    matchLabels:
-      app.kubernetes.io/instance: cert-manager
-      app.kubernetes.io/component: controller
-```
-#### **livenessProbe** ~ `object`
-> Default value:
-> ```yaml
-> enabled: true
-> failureThreshold: 8
-> initialDelaySeconds: 10
-> periodSeconds: 10
-> successThreshold: 1
-> timeoutSeconds: 15
-> ```
-
-LivenessProbe settings for the controller container of the controller Pod.  
-  
-This is enabled by default, in order to enable the clock-skew liveness probe that restarts the controller in case of a skew between the system clock and the monotonic clock. LivenessProbe durations and thresholds are based on those used for the Kubernetes controller-manager. For more information see the following on the  
-[Kubernetes GitHub repository](https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245)
-
-#### **enableServiceLinks** ~ `bool`
-> Default value:
-> ```yaml
-> false
-> ```
-
-enableServiceLinks indicates whether information about services should be injected into the pod's environment variables, matching the syntax of Docker links.
-### Prometheus
-
-#### **prometheus.enabled** ~ `bool`
-> Default value:
-> ```yaml
-> true
-> ```
-
-Enable Prometheus monitoring for the cert-manager controller and webhook. If you use the Prometheus Operator, set prometheus.podmonitor.enabled or prometheus.servicemonitor.enabled, to create a PodMonitor or a  
-ServiceMonitor resource.  
-Otherwise, 'prometheus.io' annotations are added to the cert-manager and cert-manager-webhook Deployments. Note that you can not enable both PodMonitor and ServiceMonitor as they are mutually exclusive. Enabling both will result in an error.
-#### **prometheus.servicemonitor.enabled** ~ `bool`
-> Default value:
-> ```yaml
-> false
-> ```
-
-Create a ServiceMonitor to add cert-manager to Prometheus.
-#### **prometheus.servicemonitor.namespace** ~ `string`
-
-The namespace that the service monitor should live in, defaults to the cert-manager namespace.
-
-#### **prometheus.servicemonitor.prometheusInstance** ~ `string`
-> Default value:
-> ```yaml
-> default
-> ```
-
-Specifies the `prometheus` label on the created ServiceMonitor. This is used when different Prometheus instances have label selectors matching different ServiceMonitors.
-#### **prometheus.servicemonitor.targetPort** ~ `number`
-> Default value:
-> ```yaml
-> 9402
-> ```
-
-The target port to set on the ServiceMonitor. This must match the port that the cert-manager controller is listening on for metrics.
-#### **prometheus.servicemonitor.path** ~ `string`
-> Default value:
-> ```yaml
-> /metrics
-> ```
-
-The path to scrape for metrics.
-#### **prometheus.servicemonitor.interval** ~ `string`
-> Default value:
-> ```yaml
-> 60s
-> ```
-
-The interval to scrape metrics.
-#### **prometheus.servicemonitor.scrapeTimeout** ~ `string`
-> Default value:
-> ```yaml
-> 30s
-> ```
-
-The timeout before a metrics scrape fails.
-#### **prometheus.servicemonitor.labels** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-Additional labels to add to the ServiceMonitor.
-#### **prometheus.servicemonitor.annotations** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-Additional annotations to add to the ServiceMonitor.
-#### **prometheus.servicemonitor.honorLabels** ~ `bool`
-> Default value:
-> ```yaml
-> false
-> ```
-
-Keep labels from scraped data, overriding server-side labels.
-#### **prometheus.servicemonitor.endpointAdditionalProperties** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-EndpointAdditionalProperties allows setting additional properties on the endpoint such as relabelings, metricRelabelings etc.  
-  
-For example:
-
-```yaml
-endpointAdditionalProperties:
- relabelings:
- - action: replace
-   sourceLabels:
-   - __meta_kubernetes_pod_node_name
-   targetLabel: instance
-```
-
-
-
-#### **prometheus.podmonitor.enabled** ~ `bool`
-> Default value:
-> ```yaml
-> false
-> ```
-
-Create a PodMonitor to add cert-manager to Prometheus.
-#### **prometheus.podmonitor.namespace** ~ `string`
-
-The namespace that the pod monitor should live in, defaults to the cert-manager namespace.
-
-#### **prometheus.podmonitor.prometheusInstance** ~ `string`
-> Default value:
-> ```yaml
-> default
-> ```
-
-Specifies the `prometheus` label on the created PodMonitor. This is used when different Prometheus instances have label selectors matching different PodMonitors.
-#### **prometheus.podmonitor.path** ~ `string`
-> Default value:
-> ```yaml
-> /metrics
-> ```
-
-The path to scrape for metrics.
-#### **prometheus.podmonitor.interval** ~ `string`
-> Default value:
-> ```yaml
-> 60s
-> ```
-
-The interval to scrape metrics.
-#### **prometheus.podmonitor.scrapeTimeout** ~ `string`
-> Default value:
-> ```yaml
-> 30s
-> ```
-
-The timeout before a metrics scrape fails.
-#### **prometheus.podmonitor.labels** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-Additional labels to add to the PodMonitor.
-#### **prometheus.podmonitor.annotations** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-Additional annotations to add to the PodMonitor.
-#### **prometheus.podmonitor.honorLabels** ~ `bool`
-> Default value:
-> ```yaml
-> false
-> ```
-
-Keep labels from scraped data, overriding server-side labels.
-#### **prometheus.podmonitor.endpointAdditionalProperties** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-EndpointAdditionalProperties allows setting additional properties on the endpoint such as relabelings, metricRelabelings etc.  
-  
-For example:
-
-```yaml
-endpointAdditionalProperties:
- relabelings:
- - action: replace
-   sourceLabels:
-   - __meta_kubernetes_pod_node_name
-   targetLabel: instance
- # Configure the PodMonitor for TLS connections
- # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
- scheme: https
- tlsConfig:
-   serverName: cert-manager-metrics
-   ca:
-     secret:
-       name: cert-manager-metrics-ca
-       key: "tls.crt"
-```
-
-
-
-### Webhook
-
-#### **webhook.replicaCount** ~ `number`
-> Default value:
-> ```yaml
-> 1
-> ```
-
-Number of replicas of the cert-manager webhook to run.  
-  
-The default is 1, but in production set this to 2 or 3 to provide high availability.  
-  
-If `replicas > 1`, consider setting `webhook.podDisruptionBudget.enabled=true`.
-#### **webhook.timeoutSeconds** ~ `number`
-> Default value:
-> ```yaml
-> 30
-> ```
-
-The number of seconds the API server should wait for the webhook to respond before treating the call as a failure. The value must be between 1 and 30 seconds. For more information, see  
-[Validating webhook configuration v1](https://kubernetes.io/docs/reference/kubernetes-api/extend-resources/validating-webhook-configuration-v1/).  
-  
-The default is set to the maximum value of 30 seconds as users sometimes report that the connection between the K8S API server and the cert-manager webhook server times out. If *this* timeout is reached, the error message will be "context deadline exceeded", which doesn't help the user diagnose what phase of the HTTPS connection timed out. For example, it could be during DNS resolution, TCP connection, TLS negotiation, HTTP negotiation, or slow HTTP response from the webhook server. By setting this timeout to its maximum value the underlying timeout error message has more chance of being returned to the end user.
-#### **webhook.config** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-This is used to configure options for the webhook pod. This allows setting options that would usually be provided using flags.  
-  
-If `apiVersion` and `kind` are unspecified they default to the current latest version (currently `webhook.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.  
-  
-For example:
-
-```yaml
-apiVersion: webhook.config.cert-manager.io/v1alpha1
-kind: WebhookConfiguration
-# The port that the webhook listens on for requests.
-# In GKE private clusters, by default Kubernetes apiservers are allowed to
-# talk to the cluster nodes only on 443 and 10250. Configuring
-# securePort: 10250 therefore will work out-of-the-box without needing to add firewall
-# rules or requiring NET_BIND_SERVICE capabilities to bind port numbers < 1000.
-# This should be uncommented and set as a default by the chart once
-# the apiVersion of WebhookConfiguration graduates beyond v1alpha1.
-securePort: 10250
-# Configure the metrics server for TLS
-# See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
-metricsTLSConfig:
-  dynamic:
-    secretNamespace: "cert-manager"
-    secretName: "cert-manager-metrics-ca"
-    dnsNames:
-    - cert-manager-metrics
-```
-#### **webhook.strategy** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-The update strategy for the cert-manager webhook deployment. For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy)  
-  
-For example:
-
-```yaml
-strategy:
-  type: RollingUpdate
-  rollingUpdate:
-    maxSurge: 0
-    maxUnavailable: 1
-```
-#### **webhook.securityContext** ~ `object`
-> Default value:
-> ```yaml
-> runAsNonRoot: true
-> seccompProfile:
->   type: RuntimeDefault
-> ```
-
-Pod Security Context to be set on the webhook component Pod. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
-
-#### **webhook.containerSecurityContext** ~ `object`
-> Default value:
-> ```yaml
-> allowPrivilegeEscalation: false
-> capabilities:
->   drop:
->     - ALL
-> readOnlyRootFilesystem: true
-> ```
-
-Container Security Context to be set on the webhook component container. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
-
-#### **webhook.podDisruptionBudget.enabled** ~ `bool`
-> Default value:
-> ```yaml
-> false
-> ```
-
-Enable or disable the PodDisruptionBudget resource.  
-  
-This prevents downtime during voluntary disruptions such as during a Node upgrade. For example, the PodDisruptionBudget will block `kubectl drain` if it is used on the Node where the only remaining cert-manager  
-Pod is currently running.
-#### **webhook.podDisruptionBudget.minAvailable** ~ `unknown`
-
-This property configures the minimum available pods for disruptions. Can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%).  
-It cannot be used if `maxUnavailable` is set.
-
-
-#### **webhook.podDisruptionBudget.maxUnavailable** ~ `unknown`
-
-This property configures the maximum unavailable pods for disruptions. Can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%).  
-It cannot be used if `minAvailable` is set.
-
-
-#### **webhook.deploymentAnnotations** ~ `object`
-
-Optional additional annotations to add to the webhook Deployment.
-
-#### **webhook.podAnnotations** ~ `object`
-
-Optional additional annotations to add to the webhook Pods.
-
-#### **webhook.serviceAnnotations** ~ `object`
-
-Optional additional annotations to add to the webhook Service.
-
-#### **webhook.mutatingWebhookConfigurationAnnotations** ~ `object`
-
-Optional additional annotations to add to the webhook MutatingWebhookConfiguration.
-
-#### **webhook.validatingWebhookConfigurationAnnotations** ~ `object`
-
-Optional additional annotations to add to the webhook ValidatingWebhookConfiguration.
-
-#### **webhook.validatingWebhookConfiguration.namespaceSelector** ~ `object`
-> Default value:
-> ```yaml
-> matchExpressions:
->   - key: cert-manager.io/disable-validation
->     operator: NotIn
->     values:
->       - "true"
-> ```
-
-Configure spec.namespaceSelector for validating webhooks.
-
-#### **webhook.mutatingWebhookConfiguration.namespaceSelector** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-Configure spec.namespaceSelector for mutating webhooks.
-
-#### **webhook.extraArgs** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-Additional command line flags to pass to cert-manager webhook binary. To see all available flags run `docker run quay.io/jetstack/cert-manager-webhook:<version> --help`.
-#### **webhook.extraEnv** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-Additional environment variables to pass to cert-manager webhook binary.  
-For example:
-
-```yaml
-extraEnv:
-- name: SOME_VAR
-  value: 'some value'
-```
-#### **webhook.featureGates** ~ `string`
-> Default value:
-> ```yaml
-> ""
-> ```
-
-Comma separated list of feature gates that should be enabled on the webhook pod.
-#### **webhook.resources** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-Resources to provide to the cert-manager webhook pod.  
-  
-For example:
-
-```yaml
-requests:
-  cpu: 10m
-  memory: 32Mi
-```
-
-For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
-#### **webhook.livenessProbe** ~ `object`
-> Default value:
-> ```yaml
-> failureThreshold: 3
-> initialDelaySeconds: 60
-> periodSeconds: 10
-> successThreshold: 1
-> timeoutSeconds: 1
-> ```
-
-Liveness probe values.  
-For more information, see [Container probes](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes).
-
-#### **webhook.readinessProbe** ~ `object`
-> Default value:
-> ```yaml
-> failureThreshold: 3
-> initialDelaySeconds: 5
-> periodSeconds: 5
-> successThreshold: 1
-> timeoutSeconds: 1
-> ```
-
-Readiness probe values.  
-For more information, see [Container probes](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes).
-
-#### **webhook.nodeSelector** ~ `object`
-> Default value:
-> ```yaml
-> kubernetes.io/os: linux
-> ```
-
-The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).  
-  
-This default ensures that Pods are only scheduled to Linux nodes. It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
-
-#### **webhook.affinity** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).  
-  
-For example:
-
-```yaml
-affinity:
-  nodeAffinity:
-   requiredDuringSchedulingIgnoredDuringExecution:
-     nodeSelectorTerms:
-     - matchExpressions:
-       - key: foo.bar.com/role
-         operator: In
-         values:
-         - master
-```
-#### **webhook.tolerations** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).  
-  
-For example:
-
-```yaml
-tolerations:
-- key: foo.bar.com/role
-  operator: Equal
-  value: master
-  effect: NoSchedule
-```
-#### **webhook.topologySpreadConstraints** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core).  
-  
-For example:
-
-```yaml
-topologySpreadConstraints:
-- maxSkew: 2
-  topologyKey: topology.kubernetes.io/zone
-  whenUnsatisfiable: ScheduleAnyway
-  labelSelector:
-    matchLabels:
-      app.kubernetes.io/instance: cert-manager
-      app.kubernetes.io/component: controller
-```
-#### **webhook.podLabels** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-Optional additional labels to add to the Webhook Pods.
-#### **webhook.serviceLabels** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-Optional additional labels to add to the Webhook Service.
-#### **webhook.serviceIPFamilyPolicy** ~ `string`
-> Default value:
-> ```yaml
-> ""
-> ```
-
-Optionally set the IP family policy for the controller Service to configure dual-stack; see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services).
-#### **webhook.serviceIPFamilies** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-Optionally set the IP families for the controller Service that should be supported, in the order in which they should be applied to ClusterIP. Can be IPv4 and/or IPv6.
-#### **webhook.image.registry** ~ `string`
-
-The container registry to pull the webhook image from.
-
-#### **webhook.image.repository** ~ `string`
-> Default value:
-> ```yaml
-> quay.io/jetstack/cert-manager-webhook
-> ```
-
-The container image for the cert-manager webhook
-
-#### **webhook.image.tag** ~ `string`
-
-Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion will be used.
-
-#### **webhook.image.digest** ~ `string`
-
-Setting a digest will override any tag
-
-#### **webhook.image.pullPolicy** ~ `string`
-> Default value:
-> ```yaml
-> IfNotPresent
-> ```
-
-Kubernetes imagePullPolicy on Deployment.
-#### **webhook.serviceAccount.create** ~ `bool`
-> Default value:
-> ```yaml
-> true
-> ```
-
-Specifies whether a service account should be created.
-#### **webhook.serviceAccount.name** ~ `string`
-
-The name of the service account to use.  
-If not set and create is true, a name is generated using the fullname template.
-
-#### **webhook.serviceAccount.annotations** ~ `object`
-
-Optional additional annotations to add to the webhook's Service Account.
-
-#### **webhook.serviceAccount.labels** ~ `object`
-
-Optional additional labels to add to the webhook's Service Account.
-
-#### **webhook.serviceAccount.automountServiceAccountToken** ~ `bool`
-> Default value:
-> ```yaml
-> true
-> ```
-
-Automount API credentials for a Service Account.
-#### **webhook.automountServiceAccountToken** ~ `bool`
-
-Automounting API credentials for a particular pod.
-
-#### **webhook.securePort** ~ `number`
-> Default value:
-> ```yaml
-> 10250
-> ```
-
-The port that the webhook listens on for requests. In GKE private clusters, by default Kubernetes apiservers are allowed to talk to the cluster nodes only on 443 and 10250. Configuring securePort: 10250, therefore will work out-of-the-box without needing to add firewall rules or requiring NET_BIND_SERVICE capabilities to bind port numbers <1000.
-#### **webhook.hostNetwork** ~ `bool`
-> Default value:
-> ```yaml
-> false
-> ```
-
-Specifies if the webhook should be started in hostNetwork mode.  
-  
-Required for use in some managed kubernetes clusters (such as AWS EKS) with custom. CNI (such as calico), because control-plane managed by AWS cannot communicate with pods' IP CIDR and admission webhooks are not working  
-  
-Since the default port for the webhook conflicts with kubelet on the host network, `webhook.securePort` should be changed to an available port if running in hostNetwork mode.
-#### **webhook.serviceType** ~ `string`
-> Default value:
-> ```yaml
-> ClusterIP
-> ```
-
-Specifies how the service should be handled. Useful if you want to expose the webhook outside of the cluster. In some cases, the control plane cannot reach internal services.
-#### **webhook.loadBalancerIP** ~ `string`
-
-Specify the load balancer IP for the created service.
-
-#### **webhook.url** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-Overrides the mutating webhook and validating webhook so they reach the webhook service using the `url` field instead of a service.
-#### **webhook.networkPolicy.enabled** ~ `bool`
-> Default value:
-> ```yaml
-> false
-> ```
-
-Create network policies for the webhooks.
-#### **webhook.networkPolicy.ingress** ~ `array`
-> Default value:
-> ```yaml
-> - from:
->     - ipBlock:
->         cidr: 0.0.0.0/0
-> ```
-
-Ingress rule for the webhook network policy. By default, it allows all inbound traffic.
-
-#### **webhook.networkPolicy.egress** ~ `array`
-> Default value:
-> ```yaml
-> - ports:
->     - port: 80
->       protocol: TCP
->     - port: 443
->       protocol: TCP
->     - port: 53
->       protocol: TCP
->     - port: 53
->       protocol: UDP
->     - port: 6443
->       protocol: TCP
->   to:
->     - ipBlock:
->         cidr: 0.0.0.0/0
-> ```
-
-Egress rule for the webhook network policy. By default, it allows all outbound traffic to ports 80 and 443, as well as DNS ports.
-
-#### **webhook.volumes** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-Additional volumes to add to the cert-manager controller pod.
-#### **webhook.volumeMounts** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-Additional volume mounts to add to the cert-manager controller container.
-#### **webhook.enableServiceLinks** ~ `bool`
-> Default value:
-> ```yaml
-> false
-> ```
-
-enableServiceLinks indicates whether information about services should be injected into the pod's environment variables, matching the syntax of Docker links.
-### CA Injector
-
-#### **cainjector.enabled** ~ `bool`
-> Default value:
-> ```yaml
-> true
-> ```
-
-Create the CA Injector deployment
-#### **cainjector.replicaCount** ~ `number`
-> Default value:
-> ```yaml
-> 1
-> ```
-
-The number of replicas of the cert-manager cainjector to run.  
-  
-The default is 1, but in production set this to 2 or 3 to provide high availability.  
-  
-If `replicas > 1`, consider setting `cainjector.podDisruptionBudget.enabled=true`.  
-  
-Note that cert-manager uses leader election to ensure that there can only be a single instance active at a time.
-#### **cainjector.config** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-This is used to configure options for the cainjector pod. It allows setting options that are usually provided via flags.  
-  
-If `apiVersion` and `kind` are unspecified they default to the current latest version (currently `cainjector.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.  
-  
-For example:
-
-```yaml
-apiVersion: cainjector.config.cert-manager.io/v1alpha1
-kind: CAInjectorConfiguration
-logging:
- verbosity: 2
- format: text
-leaderElectionConfig:
- namespace: kube-system
-# Configure the metrics server for TLS
-# See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
-metricsTLSConfig:
-  dynamic:
-    secretNamespace: "cert-manager"
-    secretName: "cert-manager-metrics-ca"
-    dnsNames:
-    - cert-manager-metrics
-```
-#### **cainjector.strategy** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-Deployment update strategy for the cert-manager cainjector deployment. For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy).  
-  
-For example:
-
-```yaml
-strategy:
-  type: RollingUpdate
-  rollingUpdate:
-    maxSurge: 0
-    maxUnavailable: 1
-```
-#### **cainjector.securityContext** ~ `object`
-> Default value:
-> ```yaml
-> runAsNonRoot: true
-> seccompProfile:
->   type: RuntimeDefault
-> ```
-
-Pod Security Context to be set on the cainjector component Pod. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
-
-#### **cainjector.containerSecurityContext** ~ `object`
-> Default value:
-> ```yaml
-> allowPrivilegeEscalation: false
-> capabilities:
->   drop:
->     - ALL
-> readOnlyRootFilesystem: true
-> ```
-
-Container Security Context to be set on the cainjector component container. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
-
-#### **cainjector.podDisruptionBudget.enabled** ~ `bool`
-> Default value:
-> ```yaml
-> false
-> ```
-
-Enable or disable the PodDisruptionBudget resource.  
-  
-This prevents downtime during voluntary disruptions such as during a Node upgrade. For example, the PodDisruptionBudget will block `kubectl drain` if it is used on the Node where the only remaining cert-manager  
-Pod is currently running.
-#### **cainjector.podDisruptionBudget.minAvailable** ~ `unknown`
-
-`minAvailable` configures the minimum available pods for disruptions. It can either be set to  
-an integer (e.g. 1) or a percentage value (e.g. 25%).  
-Cannot be used if `maxUnavailable` is set.
-
-
-#### **cainjector.podDisruptionBudget.maxUnavailable** ~ `unknown`
-
-`maxUnavailable` configures the maximum unavailable pods for disruptions. It can either be set to  
-an integer (e.g. 1) or a percentage value (e.g. 25%).  
-Cannot be used if `minAvailable` is set.
-
-
-#### **cainjector.deploymentAnnotations** ~ `object`
-
-Optional additional annotations to add to the cainjector Deployment.
-
-#### **cainjector.podAnnotations** ~ `object`
-
-Optional additional annotations to add to the cainjector Pods.
-
-#### **cainjector.serviceAnnotations** ~ `object`
-
-Optional additional annotations to add to the cainjector metrics Service.
-
-#### **cainjector.extraArgs** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-Additional command line flags to pass to cert-manager cainjector binary. To see all available flags run `docker run quay.io/jetstack/cert-manager-cainjector:<version> --help`.
-#### **cainjector.extraEnv** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-Additional environment variables to pass to cert-manager cainjector binary.  
-For example:
-
-```yaml
-extraEnv:
-- name: SOME_VAR
-  value: 'some value'
-```
-#### **cainjector.featureGates** ~ `string`
-> Default value:
-> ```yaml
-> ""
-> ```
-
-Comma separated list of feature gates that should be enabled on the cainjector pod.
-#### **cainjector.resources** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-Resources to provide to the cert-manager cainjector pod.  
-  
-For example:
-
-```yaml
-requests:
-  cpu: 10m
-  memory: 32Mi
-```
-
-For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
-#### **cainjector.nodeSelector** ~ `object`
-> Default value:
-> ```yaml
-> kubernetes.io/os: linux
-> ```
-
-The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).  
-  
-This default ensures that Pods are only scheduled to Linux nodes. It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
-
-#### **cainjector.affinity** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).  
-  
-For example:
-
-```yaml
-affinity:
-  nodeAffinity:
-   requiredDuringSchedulingIgnoredDuringExecution:
-     nodeSelectorTerms:
-     - matchExpressions:
-       - key: foo.bar.com/role
-         operator: In
-         values:
-         - master
-```
-#### **cainjector.tolerations** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).  
-  
-For example:
-
-```yaml
-tolerations:
-- key: foo.bar.com/role
-  operator: Equal
-  value: master
-  effect: NoSchedule
-```
-#### **cainjector.topologySpreadConstraints** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core).  
-  
-For example:
-
-```yaml
-topologySpreadConstraints:
-- maxSkew: 2
-  topologyKey: topology.kubernetes.io/zone
-  whenUnsatisfiable: ScheduleAnyway
-  labelSelector:
-    matchLabels:
-      app.kubernetes.io/instance: cert-manager
-      app.kubernetes.io/component: controller
-```
-#### **cainjector.podLabels** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-Optional additional labels to add to the CA Injector Pods.
-#### **cainjector.serviceLabels** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-Optional additional labels to add to the CA Injector metrics Service.
-#### **cainjector.image.registry** ~ `string`
-
-The container registry to pull the cainjector image from.
-
-#### **cainjector.image.repository** ~ `string`
-> Default value:
-> ```yaml
-> quay.io/jetstack/cert-manager-cainjector
-> ```
-
-The container image for the cert-manager cainjector
-
-#### **cainjector.image.tag** ~ `string`
-
-Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion will be used.
-
-#### **cainjector.image.digest** ~ `string`
-
-Setting a digest will override any tag.
-
-#### **cainjector.image.pullPolicy** ~ `string`
-> Default value:
-> ```yaml
-> IfNotPresent
-> ```
-
-Kubernetes imagePullPolicy on Deployment.
-#### **cainjector.serviceAccount.create** ~ `bool`
-> Default value:
-> ```yaml
-> true
-> ```
-
-Specifies whether a service account should be created.
-#### **cainjector.serviceAccount.name** ~ `string`
-
-The name of the service account to use.  
-If not set and create is true, a name is generated using the fullname template
-
-#### **cainjector.serviceAccount.annotations** ~ `object`
-
-Optional additional annotations to add to the cainjector's Service Account.
-
-#### **cainjector.serviceAccount.labels** ~ `object`
-
-Optional additional labels to add to the cainjector's Service Account.
-
-#### **cainjector.serviceAccount.automountServiceAccountToken** ~ `bool`
-> Default value:
-> ```yaml
-> true
-> ```
-
-Automount API credentials for a Service Account.
-#### **cainjector.automountServiceAccountToken** ~ `bool`
-
-Automounting API credentials for a particular pod.
-
-#### **cainjector.volumes** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-Additional volumes to add to the cert-manager controller pod.
-#### **cainjector.volumeMounts** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-Additional volume mounts to add to the cert-manager controller container.
-#### **cainjector.enableServiceLinks** ~ `bool`
-> Default value:
-> ```yaml
-> false
-> ```
-
-enableServiceLinks indicates whether information about services should be injected into the pod's environment variables, matching the syntax of Docker links.
-### ACME Solver
-
-#### **acmesolver.image.registry** ~ `string`
-
-The container registry to pull the acmesolver image from.
-
-#### **acmesolver.image.repository** ~ `string`
-> Default value:
-> ```yaml
-> quay.io/jetstack/cert-manager-acmesolver
-> ```
-
-The container image for the cert-manager acmesolver.
-
-#### **acmesolver.image.tag** ~ `string`
-
-Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.
-
-#### **acmesolver.image.digest** ~ `string`
-
-Setting a digest will override any tag.
-
-#### **acmesolver.image.pullPolicy** ~ `string`
-> Default value:
-> ```yaml
-> IfNotPresent
-> ```
-
-Kubernetes imagePullPolicy on Deployment.
-### Startup API Check
-
-
-This startupapicheck is a Helm post-install hook that waits for the webhook endpoints to become available. The check is implemented using a Kubernetes Job - if you are injecting mesh sidecar proxies into cert-manager pods, ensure that they are not injected into this Job's pod. Otherwise, the installation may time out owing to the Job never being completed because the sidecar proxy does not exit. For more information, see [this note](https://github.com/cert-manager/cert-manager/pull/4414).
-#### **startupapicheck.enabled** ~ `bool`
-> Default value:
-> ```yaml
-> true
-> ```
-
-Enables the startup api check.
-#### **startupapicheck.securityContext** ~ `object`
-> Default value:
-> ```yaml
-> runAsNonRoot: true
-> seccompProfile:
->   type: RuntimeDefault
-> ```
-
-Pod Security Context to be set on the startupapicheck component Pod. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
-
-#### **startupapicheck.containerSecurityContext** ~ `object`
-> Default value:
-> ```yaml
-> allowPrivilegeEscalation: false
-> capabilities:
->   drop:
->     - ALL
-> readOnlyRootFilesystem: true
-> ```
-
-Container Security Context to be set on the controller component container. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
-
-#### **startupapicheck.timeout** ~ `string`
-> Default value:
-> ```yaml
-> 1m
-> ```
-
-Timeout for 'kubectl check api' command.
-#### **startupapicheck.backoffLimit** ~ `number`
-> Default value:
-> ```yaml
-> 4
-> ```
-
-Job backoffLimit
-#### **startupapicheck.jobAnnotations** ~ `object`
-> Default value:
-> ```yaml
-> helm.sh/hook: post-install
-> helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-> helm.sh/hook-weight: "1"
-> ```
-
-Optional additional annotations to add to the startupapicheck Job.
-
-#### **startupapicheck.podAnnotations** ~ `object`
-
-Optional additional annotations to add to the startupapicheck Pods.
-
-#### **startupapicheck.extraArgs** ~ `array`
-> Default value:
-> ```yaml
-> - -v
-> ```
-
-Additional command line flags to pass to startupapicheck binary. To see all available flags run `docker run quay.io/jetstack/cert-manager-startupapicheck:<version> --help`.  
-  
-Verbose logging is enabled by default so that if startupapicheck fails, you can know what exactly caused the failure. Verbose logs include details of the webhook URL, IP address and TCP connect errors for example.
-
-#### **startupapicheck.extraEnv** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-Additional environment variables to pass to cert-manager startupapicheck binary.  
-For example:
-
-```yaml
-extraEnv:
-- name: SOME_VAR
-  value: 'some value'
-```
-#### **startupapicheck.resources** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-Resources to provide to the cert-manager controller pod.  
-  
-For example:
-
-```yaml
-requests:
-  cpu: 10m
-  memory: 32Mi
-```
-
-For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
-#### **startupapicheck.nodeSelector** ~ `object`
-> Default value:
-> ```yaml
-> kubernetes.io/os: linux
-> ```
-
-The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).  
-  
-This default ensures that Pods are only scheduled to Linux nodes. It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
-
-#### **startupapicheck.affinity** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).  
-For example:
-
-```yaml
-affinity:
-  nodeAffinity:
-   requiredDuringSchedulingIgnoredDuringExecution:
-     nodeSelectorTerms:
-     - matchExpressions:
-       - key: foo.bar.com/role
-         operator: In
-         values:
-         - master
-```
-#### **startupapicheck.tolerations** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).  
-  
-For example:
-
-```yaml
-tolerations:
-- key: foo.bar.com/role
-  operator: Equal
-  value: master
-  effect: NoSchedule
-```
-#### **startupapicheck.podLabels** ~ `object`
-> Default value:
-> ```yaml
-> {}
-> ```
-
-Optional additional labels to add to the startupapicheck Pods.
-#### **startupapicheck.image.registry** ~ `string`
-
-The container registry to pull the startupapicheck image from.
-
-#### **startupapicheck.image.repository** ~ `string`
-> Default value:
-> ```yaml
-> quay.io/jetstack/cert-manager-startupapicheck
-> ```
-
-The container image for the cert-manager startupapicheck.
-
-#### **startupapicheck.image.tag** ~ `string`
-
-Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.
-
-#### **startupapicheck.image.digest** ~ `string`
-
-Setting a digest will override any tag.
-
-#### **startupapicheck.image.pullPolicy** ~ `string`
-> Default value:
-> ```yaml
-> IfNotPresent
-> ```
-
-Kubernetes imagePullPolicy on Deployment.
-#### **startupapicheck.rbac.annotations** ~ `object`
-> Default value:
-> ```yaml
-> helm.sh/hook: post-install
-> helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-> helm.sh/hook-weight: "-5"
-> ```
-
-annotations for the startup API Check job RBAC and PSP resources.
-
-#### **startupapicheck.automountServiceAccountToken** ~ `bool`
-
-Automounting API credentials for a particular pod.
-
-#### **startupapicheck.serviceAccount.create** ~ `bool`
-> Default value:
-> ```yaml
-> true
-> ```
-
-Specifies whether a service account should be created.
-#### **startupapicheck.serviceAccount.name** ~ `string`
-
-The name of the service account to use.  
-If not set and create is true, a name is generated using the fullname template.
-
-#### **startupapicheck.serviceAccount.annotations** ~ `object`
-> Default value:
-> ```yaml
-> helm.sh/hook: post-install
-> helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-> helm.sh/hook-weight: "-5"
-> ```
-
-Optional additional annotations to add to the Job's Service Account.
-
-#### **startupapicheck.serviceAccount.automountServiceAccountToken** ~ `bool`
-> Default value:
-> ```yaml
-> true
-> ```
-
-Automount API credentials for a Service Account.
-
-#### **startupapicheck.serviceAccount.labels** ~ `object`
-
-Optional additional labels to add to the startupapicheck's Service Account.
-
-#### **startupapicheck.volumes** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-Additional volumes to add to the cert-manager controller pod.
-#### **startupapicheck.volumeMounts** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-Additional volume mounts to add to the cert-manager controller container.
-#### **startupapicheck.enableServiceLinks** ~ `bool`
-> Default value:
-> ```yaml
-> false
-> ```
-
-enableServiceLinks indicates whether information about services should be injected into pod's environment variables, matching the syntax of Docker links.
-#### **extraObjects** ~ `array`
-> Default value:
-> ```yaml
-> []
-> ```
-
-Create dynamic manifests via values.  
-  
-For example:
-
-```yaml
-extraObjects:
-  - |
-    apiVersion: v1
-    kind: ConfigMap
-    metadata:
-      name: '{{ template "cert-manager.fullname" . }}-extra-configmap'
-```
-
-<!-- /AUTO-GENERATED -->
-### Default Security Contexts
-
-The default pod-level and container-level security contexts, below, adhere to the [restricted](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted) Pod Security Standards policies.
-
-Default pod-level securityContext:
-```yaml
-runAsNonRoot: true
-seccompProfile:
-  type: RuntimeDefault
-```
-
-Default containerSecurityContext:
-```yaml
-allowPrivilegeEscalation: false
-capabilities:
-  drop:
-  - ALL
-```
-
-### Assigning Values
-
-Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
-
-Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example,
-
-```console
-$ helm install my-release -f values.yaml .
-```
-> **Tip**: You can use the default [values.yaml](https://github.com/cert-manager/cert-manager/blob/master/deploy/charts/cert-manager/values.yaml)
-
-## Contributing
-
-This chart is maintained at [github.com/cert-manager/cert-manager](https://github.com/cert-manager/cert-manager/tree/master/deploy/charts/cert-manager).
diff --git a/packages/system/cert-manager-crds/charts/cert-manager/templates/crds.yaml b/packages/system/cert-manager-crds/charts/cert-manager/templates/crds.yaml
deleted file mode 100644
index 00930f9c..00000000
--- a/packages/system/cert-manager-crds/charts/cert-manager/templates/crds.yaml
+++ /dev/null
@@ -1,12013 +0,0 @@
-# {{- include "cert-manager.crd-check" . }}
-# START crd {{- if or .Values.crds.enabled .Values.installCRDs }}
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: certificaterequests.cert-manager.io
-  # START annotations {{- if .Values.crds.keep }}
-  annotations:
-    helm.sh/resource-policy: keep
-  # END annotations {{- end }}
-  labels:
-    app: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/instance: '{{ .Release.Name }}'
-    # Generated labels {{- include "labels" . | nindent 4 }}
-spec:
-  group: cert-manager.io
-  names:
-    kind: CertificateRequest
-    listKind: CertificateRequestList
-    plural: certificaterequests
-    shortNames:
-      - cr
-      - crs
-    singular: certificaterequest
-    categories:
-      - cert-manager
-  scope: Namespaced
-  versions:
-    - name: v1
-      subresources:
-        status: {}
-      additionalPrinterColumns:
-        - jsonPath: .status.conditions[?(@.type=="Approved")].status
-          name: Approved
-          type: string
-        - jsonPath: .status.conditions[?(@.type=="Denied")].status
-          name: Denied
-          type: string
-        - jsonPath: .status.conditions[?(@.type=="Ready")].status
-          name: Ready
-          type: string
-        - jsonPath: .spec.issuerRef.name
-          name: Issuer
-          type: string
-        - jsonPath: .spec.username
-          name: Requester
-          type: string
-        - jsonPath: .status.conditions[?(@.type=="Ready")].message
-          name: Status
-          priority: 1
-          type: string
-        - jsonPath: .metadata.creationTimestamp
-          description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
-          name: Age
-          type: date
-      schema:
-        openAPIV3Schema:
-          description: |-
-            A CertificateRequest is used to request a signed certificate from one of the
-            configured issuers.
-
-            All fields within the CertificateRequest's `spec` are immutable after creation.
-            A CertificateRequest will either succeed or fail, as denoted by its `Ready` status
-            condition and its `status.failureTime` field.
-
-            A CertificateRequest is a one-shot resource, meaning it represents a single
-            point in time request for a certificate and cannot be re-used.
-          type: object
-          properties:
-            apiVersion:
-              description: |-
-                APIVersion defines the versioned schema of this representation of an object.
-                Servers should convert recognized schemas to the latest internal value, and
-                may reject unrecognized values.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-              type: string
-            kind:
-              description: |-
-                Kind is a string value representing the REST resource this object represents.
-                Servers may infer this from the endpoint the client submits requests to.
-                Cannot be updated.
-                In CamelCase.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: |-
-                Specification of the desired state of the CertificateRequest resource.
-                https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-              type: object
-              required:
-                - issuerRef
-                - request
-              properties:
-                duration:
-                  description: |-
-                    Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
-                    issuer may choose to ignore the requested duration, just like any other
-                    requested attribute.
-                  type: string
-                extra:
-                  description: |-
-                    Extra contains extra attributes of the user that created the CertificateRequest.
-                    Populated by the cert-manager webhook on creation and immutable.
-                  type: object
-                  additionalProperties:
-                    type: array
-                    items:
-                      type: string
-                groups:
-                  description: |-
-                    Groups contains group membership of the user that created the CertificateRequest.
-                    Populated by the cert-manager webhook on creation and immutable.
-                  type: array
-                  items:
-                    type: string
-                  x-kubernetes-list-type: atomic
-                isCA:
-                  description: |-
-                    Requested basic constraints isCA value. Note that the issuer may choose
-                    to ignore the requested isCA value, just like any other requested attribute.
-
-                    NOTE: If the CSR in the `Request` field has a BasicConstraints extension,
-                    it must have the same isCA value as specified here.
-
-                    If true, this will automatically add the `cert sign` usage to the list
-                    of requested `usages`.
-                  type: boolean
-                issuerRef:
-                  description: |-
-                    Reference to the issuer responsible for issuing the certificate.
-                    If the issuer is namespace-scoped, it must be in the same namespace
-                    as the Certificate. If the issuer is cluster-scoped, it can be used
-                    from any namespace.
-
-                    The `name` field of the reference must always be specified.
-                  type: object
-                  required:
-                    - name
-                  properties:
-                    group:
-                      description: Group of the resource being referred to.
-                      type: string
-                    kind:
-                      description: Kind of the resource being referred to.
-                      type: string
-                    name:
-                      description: Name of the resource being referred to.
-                      type: string
-                request:
-                  description: |-
-                    The PEM-encoded X.509 certificate signing request to be submitted to the
-                    issuer for signing.
-
-                    If the CSR has a BasicConstraints extension, its isCA attribute must
-                    match the `isCA` value of this CertificateRequest.
-                    If the CSR has a KeyUsage extension, its key usages must match the
-                    key usages in the `usages` field of this CertificateRequest.
-                    If the CSR has a ExtKeyUsage extension, its extended key usages
-                    must match the extended key usages in the `usages` field of this
-                    CertificateRequest.
-                  type: string
-                  format: byte
-                uid:
-                  description: |-
-                    UID contains the uid of the user that created the CertificateRequest.
-                    Populated by the cert-manager webhook on creation and immutable.
-                  type: string
-                usages:
-                  description: |-
-                    Requested key usages and extended key usages.
-
-                    NOTE: If the CSR in the `Request` field has uses the KeyUsage or
-                    ExtKeyUsage extension, these extensions must have the same values
-                    as specified here without any additional values.
-
-                    If unset, defaults to `digital signature` and `key encipherment`.
-                  type: array
-                  items:
-                    description: |-
-                      KeyUsage specifies valid usage contexts for keys.
-                      See:
-                      https://tools.ietf.org/html/rfc5280#section-4.2.1.3
-                      https://tools.ietf.org/html/rfc5280#section-4.2.1.12
-
-                      Valid KeyUsage values are as follows:
-                      "signing",
-                      "digital signature",
-                      "content commitment",
-                      "key encipherment",
-                      "key agreement",
-                      "data encipherment",
-                      "cert sign",
-                      "crl sign",
-                      "encipher only",
-                      "decipher only",
-                      "any",
-                      "server auth",
-                      "client auth",
-                      "code signing",
-                      "email protection",
-                      "s/mime",
-                      "ipsec end system",
-                      "ipsec tunnel",
-                      "ipsec user",
-                      "timestamping",
-                      "ocsp signing",
-                      "microsoft sgc",
-                      "netscape sgc"
-                    type: string
-                    enum:
-                      - signing
-                      - digital signature
-                      - content commitment
-                      - key encipherment
-                      - key agreement
-                      - data encipherment
-                      - cert sign
-                      - crl sign
-                      - encipher only
-                      - decipher only
-                      - any
-                      - server auth
-                      - client auth
-                      - code signing
-                      - email protection
-                      - s/mime
-                      - ipsec end system
-                      - ipsec tunnel
-                      - ipsec user
-                      - timestamping
-                      - ocsp signing
-                      - microsoft sgc
-                      - netscape sgc
-                username:
-                  description: |-
-                    Username contains the name of the user that created the CertificateRequest.
-                    Populated by the cert-manager webhook on creation and immutable.
-                  type: string
-            status:
-              description: |-
-                Status of the CertificateRequest.
-                This is set and managed automatically.
-                Read-only.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-              type: object
-              properties:
-                ca:
-                  description: |-
-                    The PEM encoded X.509 certificate of the signer, also known as the CA
-                    (Certificate Authority).
-                    This is set on a best-effort basis by different issuers.
-                    If not set, the CA is assumed to be unknown/not available.
-                  type: string
-                  format: byte
-                certificate:
-                  description: |-
-                    The PEM encoded X.509 certificate resulting from the certificate
-                    signing request.
-                    If not set, the CertificateRequest has either not been completed or has
-                    failed. More information on failure can be found by checking the
-                    `conditions` field.
-                  type: string
-                  format: byte
-                conditions:
-                  description: |-
-                    List of status conditions to indicate the status of a CertificateRequest.
-                    Known condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`.
-                  type: array
-                  items:
-                    description: CertificateRequestCondition contains condition information for a CertificateRequest.
-                    type: object
-                    required:
-                      - status
-                      - type
-                    properties:
-                      lastTransitionTime:
-                        description: |-
-                          LastTransitionTime is the timestamp corresponding to the last status
-                          change of this condition.
-                        type: string
-                        format: date-time
-                      message:
-                        description: |-
-                          Message is a human readable description of the details of the last
-                          transition, complementing reason.
-                        type: string
-                      reason:
-                        description: |-
-                          Reason is a brief machine readable explanation for the condition's last
-                          transition.
-                        type: string
-                      status:
-                        description: Status of the condition, one of (`True`, `False`, `Unknown`).
-                        type: string
-                        enum:
-                          - "True"
-                          - "False"
-                          - Unknown
-                      type:
-                        description: |-
-                          Type of the condition, known values are (`Ready`, `InvalidRequest`,
-                          `Approved`, `Denied`).
-                        type: string
-                  x-kubernetes-list-map-keys:
-                    - type
-                  x-kubernetes-list-type: map
-                failureTime:
-                  description: |-
-                    FailureTime stores the time that this CertificateRequest failed. This is
-                    used to influence garbage collection and back-off.
-                  type: string
-                  format: date-time
-      served: true
-      storage: true
-
-# END crd {{- end }}
-
----
-# START crd {{- if or .Values.crds.enabled .Values.installCRDs }}
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: certificates.cert-manager.io
-  # START annotations {{- if .Values.crds.keep }}
-  annotations:
-    helm.sh/resource-policy: keep
-  # END annotations {{- end }}
-  labels:
-    app: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/instance: '{{ .Release.Name }}'
-    # Generated labels {{- include "labels" . | nindent 4 }}
-spec:
-  group: cert-manager.io
-  names:
-    kind: Certificate
-    listKind: CertificateList
-    plural: certificates
-    shortNames:
-      - cert
-      - certs
-    singular: certificate
-    categories:
-      - cert-manager
-  scope: Namespaced
-  versions:
-    - name: v1
-      subresources:
-        status: {}
-      additionalPrinterColumns:
-        - jsonPath: .status.conditions[?(@.type=="Ready")].status
-          name: Ready
-          type: string
-        - jsonPath: .spec.secretName
-          name: Secret
-          type: string
-        - jsonPath: .spec.issuerRef.name
-          name: Issuer
-          priority: 1
-          type: string
-        - jsonPath: .status.conditions[?(@.type=="Ready")].message
-          name: Status
-          priority: 1
-          type: string
-        - jsonPath: .metadata.creationTimestamp
-          description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
-          name: Age
-          type: date
-      schema:
-        openAPIV3Schema:
-          description: |-
-            A Certificate resource should be created to ensure an up to date and signed
-            X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.
-
-            The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).
-          type: object
-          properties:
-            apiVersion:
-              description: |-
-                APIVersion defines the versioned schema of this representation of an object.
-                Servers should convert recognized schemas to the latest internal value, and
-                may reject unrecognized values.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-              type: string
-            kind:
-              description: |-
-                Kind is a string value representing the REST resource this object represents.
-                Servers may infer this from the endpoint the client submits requests to.
-                Cannot be updated.
-                In CamelCase.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: |-
-                Specification of the desired state of the Certificate resource.
-                https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-              type: object
-              required:
-                - issuerRef
-                - secretName
-              properties:
-                additionalOutputFormats:
-                  description: |-
-                    Defines extra output formats of the private key and signed certificate chain
-                    to be written to this Certificate's target Secret.
-
-                    This is a Beta Feature enabled by default. It can be disabled with the
-                    `--feature-gates=AdditionalCertificateOutputFormats=false` option set on both
-                    the controller and webhook components.
-                  type: array
-                  items:
-                    description: |-
-                      CertificateAdditionalOutputFormat defines an additional output format of a
-                      Certificate resource. These contain supplementary data formats of the signed
-                      certificate chain and paired private key.
-                    type: object
-                    required:
-                      - type
-                    properties:
-                      type:
-                        description: |-
-                          Type is the name of the format type that should be written to the
-                          Certificate's target Secret.
-                        type: string
-                        enum:
-                          - DER
-                          - CombinedPEM
-                commonName:
-                  description: |-
-                    Requested common name X509 certificate subject attribute.
-                    More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
-                    NOTE: TLS clients will ignore this value when any subject alternative name is
-                    set (see https://tools.ietf.org/html/rfc6125#section-6.4.4).
-
-                    Should have a length of 64 characters or fewer to avoid generating invalid CSRs.
-                    Cannot be set if the `literalSubject` field is set.
-                  type: string
-                dnsNames:
-                  description: Requested DNS subject alternative names.
-                  type: array
-                  items:
-                    type: string
-                duration:
-                  description: |-
-                    Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
-                    issuer may choose to ignore the requested duration, just like any other
-                    requested attribute.
-
-                    If unset, this defaults to 90 days.
-                    Minimum accepted duration is 1 hour.
-                    Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
-                  type: string
-                emailAddresses:
-                  description: Requested email subject alternative names.
-                  type: array
-                  items:
-                    type: string
-                encodeUsagesInRequest:
-                  description: |-
-                    Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.
-
-                    This option defaults to true, and should only be disabled if the target
-                    issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.
-                  type: boolean
-                ipAddresses:
-                  description: Requested IP address subject alternative names.
-                  type: array
-                  items:
-                    type: string
-                isCA:
-                  description: |-
-                    Requested basic constraints isCA value.
-                    The isCA value is used to set the `isCA` field on the created CertificateRequest
-                    resources. Note that the issuer may choose to ignore the requested isCA value, just
-                    like any other requested attribute.
-
-                    If true, this will automatically add the `cert sign` usage to the list
-                    of requested `usages`.
-                  type: boolean
-                issuerRef:
-                  description: |-
-                    Reference to the issuer responsible for issuing the certificate.
-                    If the issuer is namespace-scoped, it must be in the same namespace
-                    as the Certificate. If the issuer is cluster-scoped, it can be used
-                    from any namespace.
-
-                    The `name` field of the reference must always be specified.
-                  type: object
-                  required:
-                    - name
-                  properties:
-                    group:
-                      description: Group of the resource being referred to.
-                      type: string
-                    kind:
-                      description: Kind of the resource being referred to.
-                      type: string
-                    name:
-                      description: Name of the resource being referred to.
-                      type: string
-                keystores:
-                  description: Additional keystore output formats to be stored in the Certificate's Secret.
-                  type: object
-                  properties:
-                    jks:
-                      description: |-
-                        JKS configures options for storing a JKS keystore in the
-                        `spec.secretName` Secret resource.
-                      type: object
-                      required:
-                        - create
-                        - passwordSecretRef
-                      properties:
-                        alias:
-                          description: |-
-                            Alias specifies the alias of the key in the keystore, required by the JKS format.
-                            If not provided, the default alias `certificate` will be used.
-                          type: string
-                        create:
-                          description: |-
-                            Create enables JKS keystore creation for the Certificate.
-                            If true, a file named `keystore.jks` will be created in the target
-                            Secret resource, encrypted using the password stored in
-                            `passwordSecretRef`.
-                            The keystore file will be updated immediately.
-                            If the issuer provided a CA certificate, a file named `truststore.jks`
-                            will also be created in the target Secret resource, encrypted using the
-                            password stored in `passwordSecretRef`
-                            containing the issuing Certificate Authority
-                          type: boolean
-                        passwordSecretRef:
-                          description: |-
-                            PasswordSecretRef is a reference to a key in a Secret resource
-                            containing the password used to encrypt the JKS keystore.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                    pkcs12:
-                      description: |-
-                        PKCS12 configures options for storing a PKCS12 keystore in the
-                        `spec.secretName` Secret resource.
-                      type: object
-                      required:
-                        - create
-                        - passwordSecretRef
-                      properties:
-                        create:
-                          description: |-
-                            Create enables PKCS12 keystore creation for the Certificate.
-                            If true, a file named `keystore.p12` will be created in the target
-                            Secret resource, encrypted using the password stored in
-                            `passwordSecretRef`.
-                            The keystore file will be updated immediately.
-                            If the issuer provided a CA certificate, a file named `truststore.p12` will
-                            also be created in the target Secret resource, encrypted using the
-                            password stored in `passwordSecretRef` containing the issuing Certificate
-                            Authority
-                          type: boolean
-                        passwordSecretRef:
-                          description: |-
-                            PasswordSecretRef is a reference to a key in a Secret resource
-                            containing the password used to encrypt the PKCS12 keystore.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                        profile:
-                          description: |-
-                            Profile specifies the key and certificate encryption algorithms and the HMAC algorithm
-                            used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.
-
-                            If provided, allowed values are:
-                            `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
-                            `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
-                            `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
-                            (eg. because of company policy). Please note that the security of the algorithm is not that important
-                            in reality, because the unencrypted certificate and private key are also stored in the Secret.
-                          type: string
-                          enum:
-                            - LegacyRC2
-                            - LegacyDES
-                            - Modern2023
-                literalSubject:
-                  description: |-
-                    Requested X.509 certificate subject, represented using the LDAP "String
-                    Representation of a Distinguished Name" [1].
-                    Important: the LDAP string format also specifies the order of the attributes
-                    in the subject, this is important when issuing certs for LDAP authentication.
-                    Example: `CN=foo,DC=corp,DC=example,DC=com`
-                    More info [1]: https://datatracker.ietf.org/doc/html/rfc4514
-                    More info: https://github.com/cert-manager/cert-manager/issues/3203
-                    More info: https://github.com/cert-manager/cert-manager/issues/4424
-
-                    Cannot be set if the `subject` or `commonName` field is set.
-                  type: string
-                nameConstraints:
-                  description: |-
-                    x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.
-                    More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10
-
-                    This is an Alpha Feature and is only enabled with the
-                    `--feature-gates=NameConstraints=true` option set on both
-                    the controller and webhook components.
-                  type: object
-                  properties:
-                    critical:
-                      description: if true then the name constraints are marked critical.
-                      type: boolean
-                    excluded:
-                      description: |-
-                        Excluded contains the constraints which must be disallowed. Any name matching a
-                        restriction in the excluded field is invalid regardless
-                        of information appearing in the permitted
-                      type: object
-                      properties:
-                        dnsDomains:
-                          description: DNSDomains is a list of DNS domains that are permitted or excluded.
-                          type: array
-                          items:
-                            type: string
-                        emailAddresses:
-                          description: EmailAddresses is a list of Email Addresses that are permitted or excluded.
-                          type: array
-                          items:
-                            type: string
-                        ipRanges:
-                          description: |-
-                            IPRanges is a list of IP Ranges that are permitted or excluded.
-                            This should be a valid CIDR notation.
-                          type: array
-                          items:
-                            type: string
-                        uriDomains:
-                          description: URIDomains is a list of URI domains that are permitted or excluded.
-                          type: array
-                          items:
-                            type: string
-                    permitted:
-                      description: Permitted contains the constraints in which the names must be located.
-                      type: object
-                      properties:
-                        dnsDomains:
-                          description: DNSDomains is a list of DNS domains that are permitted or excluded.
-                          type: array
-                          items:
-                            type: string
-                        emailAddresses:
-                          description: EmailAddresses is a list of Email Addresses that are permitted or excluded.
-                          type: array
-                          items:
-                            type: string
-                        ipRanges:
-                          description: |-
-                            IPRanges is a list of IP Ranges that are permitted or excluded.
-                            This should be a valid CIDR notation.
-                          type: array
-                          items:
-                            type: string
-                        uriDomains:
-                          description: URIDomains is a list of URI domains that are permitted or excluded.
-                          type: array
-                          items:
-                            type: string
-                otherNames:
-                  description: |-
-                    `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37
-                    Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.
-                    Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3
-                    You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.
-                  type: array
-                  items:
-                    type: object
-                    properties:
-                      oid:
-                        description: |-
-                          OID is the object identifier for the otherName SAN.
-                          The object identifier must be expressed as a dotted string, for
-                          example, "1.2.840.113556.1.4.221".
-                        type: string
-                      utf8Value:
-                        description: |-
-                          utf8Value is the string value of the otherName SAN.
-                          The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.
-                        type: string
-                privateKey:
-                  description: |-
-                    Private key options. These include the key algorithm and size, the used
-                    encoding and the rotation policy.
-                  type: object
-                  properties:
-                    algorithm:
-                      description: |-
-                        Algorithm is the private key algorithm of the corresponding private key
-                        for this certificate.
-
-                        If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.
-                        If `algorithm` is specified and `size` is not provided,
-                        key size of 2048 will be used for `RSA` key algorithm and
-                        key size of 256 will be used for `ECDSA` key algorithm.
-                        key size is ignored when using the `Ed25519` key algorithm.
-                      type: string
-                      enum:
-                        - RSA
-                        - ECDSA
-                        - Ed25519
-                    encoding:
-                      description: |-
-                        The private key cryptography standards (PKCS) encoding for this
-                        certificate's private key to be encoded in.
-
-                        If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1
-                        and PKCS#8, respectively.
-                        Defaults to `PKCS1` if not specified.
-                      type: string
-                      enum:
-                        - PKCS1
-                        - PKCS8
-                    rotationPolicy:
-                      description: |-
-                        RotationPolicy controls how private keys should be regenerated when a
-                        re-issuance is being processed.
-
-                        If set to `Never`, a private key will only be generated if one does not
-                        already exist in the target `spec.secretName`. If one does exist but it
-                        does not have the correct algorithm or size, a warning will be raised
-                        to await user intervention.
-                        If set to `Always`, a private key matching the specified requirements
-                        will be generated whenever a re-issuance occurs.
-                        Default is `Never` for backward compatibility.
-                      type: string
-                      enum:
-                        - Never
-                        - Always
-                    size:
-                      description: |-
-                        Size is the key bit size of the corresponding private key for this certificate.
-
-                        If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,
-                        and will default to `2048` if not specified.
-                        If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,
-                        and will default to `256` if not specified.
-                        If `algorithm` is set to `Ed25519`, Size is ignored.
-                        No other values are allowed.
-                      type: integer
-                renewBefore:
-                  description: |-
-                    How long before the currently issued certificate's expiry cert-manager should
-                    renew the certificate. For example, if a certificate is valid for 60 minutes,
-                    and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate
-                    50 minutes after it was issued (i.e. when there are 10 minutes remaining until
-                    the certificate is no longer valid).
-
-                    NOTE: The actual lifetime of the issued certificate is used to determine the
-                    renewal time. If an issuer returns a certificate with a different lifetime than
-                    the one requested, cert-manager will use the lifetime of the issued certificate.
-
-                    If unset, this defaults to 1/3 of the issued certificate's lifetime.
-                    Minimum accepted value is 5 minutes.
-                    Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
-                    Cannot be set if the `renewBeforePercentage` field is set.
-                  type: string
-                renewBeforePercentage:
-                  description: |-
-                    `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage
-                    rather than an absolute duration. For example, if a certificate is valid for 60
-                    minutes, and  `renewBeforePercentage=25`, cert-manager will begin to attempt to
-                    renew the certificate 45 minutes after it was issued (i.e. when there are 15
-                    minutes (25%) remaining until the certificate is no longer valid).
-
-                    NOTE: The actual lifetime of the issued certificate is used to determine the
-                    renewal time. If an issuer returns a certificate with a different lifetime than
-                    the one requested, cert-manager will use the lifetime of the issued certificate.
-
-                    Value must be an integer in the range (0,100). The minimum effective
-                    `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5
-                    minutes.
-                    Cannot be set if the `renewBefore` field is set.
-                  type: integer
-                  format: int32
-                revisionHistoryLimit:
-                  description: |-
-                    The maximum number of CertificateRequest revisions that are maintained in
-                    the Certificate's history. Each revision represents a single `CertificateRequest`
-                    created by this Certificate, either when it was created, renewed, or Spec
-                    was changed. Revisions will be removed by oldest first if the number of
-                    revisions exceeds this number.
-
-                    If set, revisionHistoryLimit must be a value of `1` or greater.
-                    If unset (`nil`), revisions will not be garbage collected.
-                    Default value is `nil`.
-                  type: integer
-                  format: int32
-                secretName:
-                  description: |-
-                    Name of the Secret resource that will be automatically created and
-                    managed by this Certificate resource. It will be populated with a
-                    private key and certificate, signed by the denoted issuer. The Secret
-                    resource lives in the same namespace as the Certificate resource.
-                  type: string
-                secretTemplate:
-                  description: |-
-                    Defines annotations and labels to be copied to the Certificate's Secret.
-                    Labels and annotations on the Secret will be changed as they appear on the
-                    SecretTemplate when added or removed. SecretTemplate annotations are added
-                    in conjunction with, and cannot overwrite, the base set of annotations
-                    cert-manager sets on the Certificate's Secret.
-                  type: object
-                  properties:
-                    annotations:
-                      description: Annotations is a key value map to be copied to the target Kubernetes Secret.
-                      type: object
-                      additionalProperties:
-                        type: string
-                    labels:
-                      description: Labels is a key value map to be copied to the target Kubernetes Secret.
-                      type: object
-                      additionalProperties:
-                        type: string
-                subject:
-                  description: |-
-                    Requested set of X509 certificate subject attributes.
-                    More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
-
-                    The common name attribute is specified separately in the `commonName` field.
-                    Cannot be set if the `literalSubject` field is set.
-                  type: object
-                  properties:
-                    countries:
-                      description: Countries to be used on the Certificate.
-                      type: array
-                      items:
-                        type: string
-                    localities:
-                      description: Cities to be used on the Certificate.
-                      type: array
-                      items:
-                        type: string
-                    organizationalUnits:
-                      description: Organizational Units to be used on the Certificate.
-                      type: array
-                      items:
-                        type: string
-                    organizations:
-                      description: Organizations to be used on the Certificate.
-                      type: array
-                      items:
-                        type: string
-                    postalCodes:
-                      description: Postal codes to be used on the Certificate.
-                      type: array
-                      items:
-                        type: string
-                    provinces:
-                      description: State/Provinces to be used on the Certificate.
-                      type: array
-                      items:
-                        type: string
-                    serialNumber:
-                      description: Serial number to be used on the Certificate.
-                      type: string
-                    streetAddresses:
-                      description: Street addresses to be used on the Certificate.
-                      type: array
-                      items:
-                        type: string
-                uris:
-                  description: Requested URI subject alternative names.
-                  type: array
-                  items:
-                    type: string
-                usages:
-                  description: |-
-                    Requested key usages and extended key usages.
-                    These usages are used to set the `usages` field on the created CertificateRequest
-                    resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages
-                    will additionally be encoded in the `request` field which contains the CSR blob.
-
-                    If unset, defaults to `digital signature` and `key encipherment`.
-                  type: array
-                  items:
-                    description: |-
-                      KeyUsage specifies valid usage contexts for keys.
-                      See:
-                      https://tools.ietf.org/html/rfc5280#section-4.2.1.3
-                      https://tools.ietf.org/html/rfc5280#section-4.2.1.12
-
-                      Valid KeyUsage values are as follows:
-                      "signing",
-                      "digital signature",
-                      "content commitment",
-                      "key encipherment",
-                      "key agreement",
-                      "data encipherment",
-                      "cert sign",
-                      "crl sign",
-                      "encipher only",
-                      "decipher only",
-                      "any",
-                      "server auth",
-                      "client auth",
-                      "code signing",
-                      "email protection",
-                      "s/mime",
-                      "ipsec end system",
-                      "ipsec tunnel",
-                      "ipsec user",
-                      "timestamping",
-                      "ocsp signing",
-                      "microsoft sgc",
-                      "netscape sgc"
-                    type: string
-                    enum:
-                      - signing
-                      - digital signature
-                      - content commitment
-                      - key encipherment
-                      - key agreement
-                      - data encipherment
-                      - cert sign
-                      - crl sign
-                      - encipher only
-                      - decipher only
-                      - any
-                      - server auth
-                      - client auth
-                      - code signing
-                      - email protection
-                      - s/mime
-                      - ipsec end system
-                      - ipsec tunnel
-                      - ipsec user
-                      - timestamping
-                      - ocsp signing
-                      - microsoft sgc
-                      - netscape sgc
-            status:
-              description: |-
-                Status of the Certificate.
-                This is set and managed automatically.
-                Read-only.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-              type: object
-              properties:
-                conditions:
-                  description: |-
-                    List of status conditions to indicate the status of certificates.
-                    Known condition types are `Ready` and `Issuing`.
-                  type: array
-                  items:
-                    description: CertificateCondition contains condition information for a Certificate.
-                    type: object
-                    required:
-                      - status
-                      - type
-                    properties:
-                      lastTransitionTime:
-                        description: |-
-                          LastTransitionTime is the timestamp corresponding to the last status
-                          change of this condition.
-                        type: string
-                        format: date-time
-                      message:
-                        description: |-
-                          Message is a human readable description of the details of the last
-                          transition, complementing reason.
-                        type: string
-                      observedGeneration:
-                        description: |-
-                          If set, this represents the .metadata.generation that the condition was
-                          set based upon.
-                          For instance, if .metadata.generation is currently 12, but the
-                          .status.condition[x].observedGeneration is 9, the condition is out of date
-                          with respect to the current state of the Certificate.
-                        type: integer
-                        format: int64
-                      reason:
-                        description: |-
-                          Reason is a brief machine readable explanation for the condition's last
-                          transition.
-                        type: string
-                      status:
-                        description: Status of the condition, one of (`True`, `False`, `Unknown`).
-                        type: string
-                        enum:
-                          - "True"
-                          - "False"
-                          - Unknown
-                      type:
-                        description: Type of the condition, known values are (`Ready`, `Issuing`).
-                        type: string
-                  x-kubernetes-list-map-keys:
-                    - type
-                  x-kubernetes-list-type: map
-                failedIssuanceAttempts:
-                  description: |-
-                    The number of continuous failed issuance attempts up till now. This
-                    field gets removed (if set) on a successful issuance and gets set to
-                    1 if unset and an issuance has failed. If an issuance has failed, the
-                    delay till the next issuance will be calculated using formula
-                    time.Hour * 2 ^ (failedIssuanceAttempts - 1).
-                  type: integer
-                lastFailureTime:
-                  description: |-
-                    LastFailureTime is set only if the latest issuance for this
-                    Certificate failed and contains the time of the failure. If an
-                    issuance has failed, the delay till the next issuance will be
-                    calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -
-                    1). If the latest issuance has succeeded this field will be unset.
-                  type: string
-                  format: date-time
-                nextPrivateKeySecretName:
-                  description: |-
-                    The name of the Secret resource containing the private key to be used
-                    for the next certificate iteration.
-                    The keymanager controller will automatically set this field if the
-                    `Issuing` condition is set to `True`.
-                    It will automatically unset this field when the Issuing condition is
-                    not set or False.
-                  type: string
-                notAfter:
-                  description: |-
-                    The expiration time of the certificate stored in the secret named
-                    by this resource in `spec.secretName`.
-                  type: string
-                  format: date-time
-                notBefore:
-                  description: |-
-                    The time after which the certificate stored in the secret named
-                    by this resource in `spec.secretName` is valid.
-                  type: string
-                  format: date-time
-                renewalTime:
-                  description: |-
-                    RenewalTime is the time at which the certificate will be next
-                    renewed.
-                    If not set, no upcoming renewal is scheduled.
-                  type: string
-                  format: date-time
-                revision:
-                  description: |-
-                    The current 'revision' of the certificate as issued.
-
-                    When a CertificateRequest resource is created, it will have the
-                    `cert-manager.io/certificate-revision` set to one greater than the
-                    current value of this field.
-
-                    Upon issuance, this field will be set to the value of the annotation
-                    on the CertificateRequest resource used to issue the certificate.
-
-                    Persisting the value on the CertificateRequest resource allows the
-                    certificates controller to know whether a request is part of an old
-                    issuance or if it is part of the ongoing revision's issuance by
-                    checking if the revision value in the annotation is greater than this
-                    field.
-                  type: integer
-      served: true
-      storage: true
-
-# END crd {{- end }}
-
----
-# START crd {{- if or .Values.crds.enabled .Values.installCRDs }}
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: challenges.acme.cert-manager.io
-  # START annotations {{- if .Values.crds.keep }}
-  annotations:
-    helm.sh/resource-policy: keep
-  # END annotations {{- end }}
-  labels:
-    app: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/instance: '{{ .Release.Name }}'
-    # Generated labels {{- include "labels" . | nindent 4 }}
-spec:
-  group: acme.cert-manager.io
-  names:
-    kind: Challenge
-    listKind: ChallengeList
-    plural: challenges
-    singular: challenge
-    categories:
-      - cert-manager
-      - cert-manager-acme
-  scope: Namespaced
-  versions:
-    - additionalPrinterColumns:
-        - jsonPath: .status.state
-          name: State
-          type: string
-        - jsonPath: .spec.dnsName
-          name: Domain
-          type: string
-        - jsonPath: .status.reason
-          name: Reason
-          priority: 1
-          type: string
-        - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
-          jsonPath: .metadata.creationTimestamp
-          name: Age
-          type: date
-      name: v1
-      schema:
-        openAPIV3Schema:
-          description: Challenge is a type to represent a Challenge request with an ACME server
-          type: object
-          required:
-            - metadata
-            - spec
-          properties:
-            apiVersion:
-              description: |-
-                APIVersion defines the versioned schema of this representation of an object.
-                Servers should convert recognized schemas to the latest internal value, and
-                may reject unrecognized values.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-              type: string
-            kind:
-              description: |-
-                Kind is a string value representing the REST resource this object represents.
-                Servers may infer this from the endpoint the client submits requests to.
-                Cannot be updated.
-                In CamelCase.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-              type: string
-            metadata:
-              type: object
-            spec:
-              type: object
-              required:
-                - authorizationURL
-                - dnsName
-                - issuerRef
-                - key
-                - solver
-                - token
-                - type
-                - url
-              properties:
-                authorizationURL:
-                  description: |-
-                    The URL to the ACME Authorization resource that this
-                    challenge is a part of.
-                  type: string
-                dnsName:
-                  description: |-
-                    dnsName is the identifier that this challenge is for, e.g. example.com.
-                    If the requested DNSName is a 'wildcard', this field MUST be set to the
-                    non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`.
-                  type: string
-                issuerRef:
-                  description: |-
-                    References a properly configured ACME-type Issuer which should
-                    be used to create this Challenge.
-                    If the Issuer does not exist, processing will be retried.
-                    If the Issuer is not an 'ACME' Issuer, an error will be returned and the
-                    Challenge will be marked as failed.
-                  type: object
-                  required:
-                    - name
-                  properties:
-                    group:
-                      description: Group of the resource being referred to.
-                      type: string
-                    kind:
-                      description: Kind of the resource being referred to.
-                      type: string
-                    name:
-                      description: Name of the resource being referred to.
-                      type: string
-                key:
-                  description: |-
-                    The ACME challenge key for this challenge
-                    For HTTP01 challenges, this is the value that must be responded with to
-                    complete the HTTP01 challenge in the format:
-                    `<private key JWK thumbprint>.<key from acme server for challenge>`.
-                    For DNS01 challenges, this is the base64 encoded SHA256 sum of the
-                    `<private key JWK thumbprint>.<key from acme server for challenge>`
-                    text that must be set as the TXT record content.
-                  type: string
-                solver:
-                  description: |-
-                    Contains the domain solving configuration that should be used to
-                    solve this challenge resource.
-                  type: object
-                  properties:
-                    dns01:
-                      description: |-
-                        Configures cert-manager to attempt to complete authorizations by
-                        performing the DNS01 challenge flow.
-                      type: object
-                      properties:
-                        acmeDNS:
-                          description: |-
-                            Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
-                            DNS01 challenge records.
-                          type: object
-                          required:
-                            - accountSecretRef
-                            - host
-                          properties:
-                            accountSecretRef:
-                              description: |-
-                                A reference to a specific 'key' within a Secret resource.
-                                In some instances, `key` is a required field.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            host:
-                              type: string
-                        akamai:
-                          description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
-                          type: object
-                          required:
-                            - accessTokenSecretRef
-                            - clientSecretSecretRef
-                            - clientTokenSecretRef
-                            - serviceConsumerDomain
-                          properties:
-                            accessTokenSecretRef:
-                              description: |-
-                                A reference to a specific 'key' within a Secret resource.
-                                In some instances, `key` is a required field.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            clientSecretSecretRef:
-                              description: |-
-                                A reference to a specific 'key' within a Secret resource.
-                                In some instances, `key` is a required field.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            clientTokenSecretRef:
-                              description: |-
-                                A reference to a specific 'key' within a Secret resource.
-                                In some instances, `key` is a required field.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            serviceConsumerDomain:
-                              type: string
-                        azureDNS:
-                          description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
-                          type: object
-                          required:
-                            - resourceGroupName
-                            - subscriptionID
-                          properties:
-                            clientID:
-                              description: |-
-                                Auth: Azure Service Principal:
-                                The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
-                                If set, ClientSecret and TenantID must also be set.
-                              type: string
-                            clientSecretSecretRef:
-                              description: |-
-                                Auth: Azure Service Principal:
-                                A reference to a Secret containing the password associated with the Service Principal.
-                                If set, ClientID and TenantID must also be set.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            environment:
-                              description: name of the Azure environment (default AzurePublicCloud)
-                              type: string
-                              enum:
-                                - AzurePublicCloud
-                                - AzureChinaCloud
-                                - AzureGermanCloud
-                                - AzureUSGovernmentCloud
-                            hostedZoneName:
-                              description: name of the DNS zone that should be used
-                              type: string
-                            managedIdentity:
-                              description: |-
-                                Auth: Azure Workload Identity or Azure Managed Service Identity:
-                                Settings to enable Azure Workload Identity or Azure Managed Service Identity
-                                If set, ClientID, ClientSecret and TenantID must not be set.
-                              type: object
-                              properties:
-                                clientID:
-                                  description: client ID of the managed identity, can not be used at the same time as resourceID
-                                  type: string
-                                resourceID:
-                                  description: |-
-                                    resource ID of the managed identity, can not be used at the same time as clientID
-                                    Cannot be used for Azure Managed Service Identity
-                                  type: string
-                            resourceGroupName:
-                              description: resource group the DNS zone is located in
-                              type: string
-                            subscriptionID:
-                              description: ID of the Azure subscription
-                              type: string
-                            tenantID:
-                              description: |-
-                                Auth: Azure Service Principal:
-                                The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
-                                If set, ClientID and ClientSecret must also be set.
-                              type: string
-                        cloudDNS:
-                          description: Use the Google Cloud DNS API to manage DNS01 challenge records.
-                          type: object
-                          required:
-                            - project
-                          properties:
-                            hostedZoneName:
-                              description: |-
-                                HostedZoneName is an optional field that tells cert-manager in which
-                                Cloud DNS zone the challenge record has to be created.
-                                If left empty cert-manager will automatically choose a zone.
-                              type: string
-                            project:
-                              type: string
-                            serviceAccountSecretRef:
-                              description: |-
-                                A reference to a specific 'key' within a Secret resource.
-                                In some instances, `key` is a required field.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                        cloudflare:
-                          description: Use the Cloudflare API to manage DNS01 challenge records.
-                          type: object
-                          properties:
-                            apiKeySecretRef:
-                              description: |-
-                                API key to use to authenticate with Cloudflare.
-                                Note: using an API token to authenticate is now the recommended method
-                                as it allows greater control of permissions.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            apiTokenSecretRef:
-                              description: API token used to authenticate with Cloudflare.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            email:
-                              description: Email of the account, only required when using API key based authentication.
-                              type: string
-                        cnameStrategy:
-                          description: |-
-                            CNAMEStrategy configures how the DNS01 provider should handle CNAME
-                            records when found in DNS zones.
-                          type: string
-                          enum:
-                            - None
-                            - Follow
-                        digitalocean:
-                          description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
-                          type: object
-                          required:
-                            - tokenSecretRef
-                          properties:
-                            tokenSecretRef:
-                              description: |-
-                                A reference to a specific 'key' within a Secret resource.
-                                In some instances, `key` is a required field.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                        rfc2136:
-                          description: |-
-                            Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
-                            to manage DNS01 challenge records.
-                          type: object
-                          required:
-                            - nameserver
-                          properties:
-                            nameserver:
-                              description: |-
-                                The IP address or hostname of an authoritative DNS server supporting
-                                RFC2136 in the form host:port. If the host is an IPv6 address it must be
-                                enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
-                                This field is required.
-                              type: string
-                            tsigAlgorithm:
-                              description: |-
-                                The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
-                                when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
-                                Supported values are (case-insensitive): ``HMACMD5`` (default),
-                                ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
-                              type: string
-                            tsigKeyName:
-                              description: |-
-                                The TSIG Key name configured in the DNS.
-                                If ``tsigSecretSecretRef`` is defined, this field is required.
-                              type: string
-                            tsigSecretSecretRef:
-                              description: |-
-                                The name of the secret containing the TSIG value.
-                                If ``tsigKeyName`` is defined, this field is required.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                        route53:
-                          description: Use the AWS Route53 API to manage DNS01 challenge records.
-                          type: object
-                          properties:
-                            accessKeyID:
-                              description: |-
-                                The AccessKeyID is used for authentication.
-                                Cannot be set when SecretAccessKeyID is set.
-                                If neither the Access Key nor Key ID are set, we fall-back to using env
-                                vars, shared credentials file or AWS Instance metadata,
-                                see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
-                              type: string
-                            accessKeyIDSecretRef:
-                              description: |-
-                                The SecretAccessKey is used for authentication. If set, pull the AWS
-                                access key ID from a key within a Kubernetes Secret.
-                                Cannot be set when AccessKeyID is set.
-                                If neither the Access Key nor Key ID are set, we fall-back to using env
-                                vars, shared credentials file or AWS Instance metadata,
-                                see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            auth:
-                              description: Auth configures how cert-manager authenticates.
-                              type: object
-                              required:
-                                - kubernetes
-                              properties:
-                                kubernetes:
-                                  description: |-
-                                    Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
-                                    by passing a bound ServiceAccount token.
-                                  type: object
-                                  required:
-                                    - serviceAccountRef
-                                  properties:
-                                    serviceAccountRef:
-                                      description: |-
-                                        A reference to a service account that will be used to request a bound
-                                        token (also known as "projected token"). To use this field, you must
-                                        configure an RBAC rule to let cert-manager request a token.
-                                      type: object
-                                      required:
-                                        - name
-                                      properties:
-                                        audiences:
-                                          description: |-
-                                            TokenAudiences is an optional list of audiences to include in the
-                                            token passed to AWS. The default token consisting of the issuer's namespace
-                                            and name is always included.
-                                            If unset the audience defaults to `sts.amazonaws.com`.
-                                          type: array
-                                          items:
-                                            type: string
-                                        name:
-                                          description: Name of the ServiceAccount used to request a token.
-                                          type: string
-                            hostedZoneID:
-                              description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.
-                              type: string
-                            region:
-                              description: |-
-                                Override the AWS region.
-
-                                Route53 is a global service and does not have regional endpoints but the
-                                region specified here (or via environment variables) is used as a hint to
-                                help compute the correct AWS credential scope and partition when it
-                                connects to Route53. See:
-                                - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
-                                - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)
-
-                                If you omit this region field, cert-manager will use the region from
-                                AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
-                                in the cert-manager controller Pod.
-
-                                The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
-                                Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
-                                [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
-                                In this case this `region` field value is ignored.
-
-                                The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
-                                Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
-                                [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
-                                In this case this `region` field value is ignored.
-                              type: string
-                            role:
-                              description: |-
-                                Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
-                                or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
-                              type: string
-                            secretAccessKeySecretRef:
-                              description: |-
-                                The SecretAccessKey is used for authentication.
-                                If neither the Access Key nor Key ID are set, we fall-back to using env
-                                vars, shared credentials file or AWS Instance metadata,
-                                see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                        webhook:
-                          description: |-
-                            Configure an external webhook based DNS01 challenge solver to manage
-                            DNS01 challenge records.
-                          type: object
-                          required:
-                            - groupName
-                            - solverName
-                          properties:
-                            config:
-                              description: |-
-                                Additional configuration that should be passed to the webhook apiserver
-                                when challenges are processed.
-                                This can contain arbitrary JSON data.
-                                Secret values should not be specified in this stanza.
-                                If secret values are needed (e.g. credentials for a DNS service), you
-                                should use a SecretKeySelector to reference a Secret resource.
-                                For details on the schema of this field, consult the webhook provider
-                                implementation's documentation.
-                              x-kubernetes-preserve-unknown-fields: true
-                            groupName:
-                              description: |-
-                                The API group name that should be used when POSTing ChallengePayload
-                                resources to the webhook apiserver.
-                                This should be the same as the GroupName specified in the webhook
-                                provider implementation.
-                              type: string
-                            solverName:
-                              description: |-
-                                The name of the solver to use, as defined in the webhook provider
-                                implementation.
-                                This will typically be the name of the provider, e.g. 'cloudflare'.
-                              type: string
-                    http01:
-                      description: |-
-                        Configures cert-manager to attempt to complete authorizations by
-                        performing the HTTP01 challenge flow.
-                        It is not possible to obtain certificates for wildcard domain names
-                        (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
-                      type: object
-                      properties:
-                        gatewayHTTPRoute:
-                          description: |-
-                            The Gateway API is a sig-network community API that models service networking
-                            in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
-                            create HTTPRoutes with the specified labels in the same namespace as the challenge.
-                            This solver is experimental, and fields / behaviour may change in the future.
-                          type: object
-                          properties:
-                            labels:
-                              description: |-
-                                Custom labels that will be applied to HTTPRoutes created by cert-manager
-                                while solving HTTP-01 challenges.
-                              type: object
-                              additionalProperties:
-                                type: string
-                            parentRefs:
-                              description: |-
-                                When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
-                                cert-manager needs to know which parentRefs should be used when creating
-                                the HTTPRoute. Usually, the parentRef references a Gateway. See:
-                                https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
-                              type: array
-                              items:
-                                description: |-
-                                  ParentReference identifies an API object (usually a Gateway) that can be considered
-                                  a parent of this resource (usually a route). There are two kinds of parent resources
-                                  with "Core" support:
-
-                                  * Gateway (Gateway conformance profile)
-                                  * Service (Mesh conformance profile, ClusterIP Services only)
-
-                                  This API may be extended in the future to support additional kinds of parent
-                                  resources.
-
-                                  The API object must be valid in the cluster; the Group and Kind must
-                                  be registered in the cluster for this reference to be valid.
-                                type: object
-                                required:
-                                  - name
-                                properties:
-                                  group:
-                                    description: |-
-                                      Group is the group of the referent.
-                                      When unspecified, "gateway.networking.k8s.io" is inferred.
-                                      To set the core API group (such as for a "Service" kind referent),
-                                      Group must be explicitly set to "" (empty string).
-
-                                      Support: Core
-                                    type: string
-                                    default: gateway.networking.k8s.io
-                                    maxLength: 253
-                                    pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                  kind:
-                                    description: |-
-                                      Kind is kind of the referent.
-
-                                      There are two kinds of parent resources with "Core" support:
-
-                                      * Gateway (Gateway conformance profile)
-                                      * Service (Mesh conformance profile, ClusterIP Services only)
-
-                                      Support for other resources is Implementation-Specific.
-                                    type: string
-                                    default: Gateway
-                                    maxLength: 63
-                                    minLength: 1
-                                    pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                                  name:
-                                    description: |-
-                                      Name is the name of the referent.
-
-                                      Support: Core
-                                    type: string
-                                    maxLength: 253
-                                    minLength: 1
-                                  namespace:
-                                    description: |-
-                                      Namespace is the namespace of the referent. When unspecified, this refers
-                                      to the local namespace of the Route.
-
-                                      Note that there are specific rules for ParentRefs which cross namespace
-                                      boundaries. Cross-namespace references are only valid if they are explicitly
-                                      allowed by something in the namespace they are referring to. For example:
-                                      Gateway has the AllowedRoutes field, and ReferenceGrant provides a
-                                      generic way to enable any other kind of cross-namespace reference.
-
-                                      <gateway:experimental:description>
-                                      ParentRefs from a Route to a Service in the same namespace are "producer"
-                                      routes, which apply default routing rules to inbound connections from
-                                      any namespace to the Service.
-
-                                      ParentRefs from a Route to a Service in a different namespace are
-                                      "consumer" routes, and these routing rules are only applied to outbound
-                                      connections originating from the same namespace as the Route, for which
-                                      the intended destination of the connections are a Service targeted as a
-                                      ParentRef of the Route.
-                                      </gateway:experimental:description>
-
-                                      Support: Core
-                                    type: string
-                                    maxLength: 63
-                                    minLength: 1
-                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                                  port:
-                                    description: |-
-                                      Port is the network port this Route targets. It can be interpreted
-                                      differently based on the type of parent resource.
-
-                                      When the parent resource is a Gateway, this targets all listeners
-                                      listening on the specified port that also support this kind of Route(and
-                                      select this Route). It's not recommended to set `Port` unless the
-                                      networking behaviors specified in a Route must apply to a specific port
-                                      as opposed to a listener(s) whose port(s) may be changed. When both Port
-                                      and SectionName are specified, the name and port of the selected listener
-                                      must match both specified values.
-
-                                      <gateway:experimental:description>
-                                      When the parent resource is a Service, this targets a specific port in the
-                                      Service spec. When both Port (experimental) and SectionName are specified,
-                                      the name and port of the selected port must match both specified values.
-                                      </gateway:experimental:description>
-
-                                      Implementations MAY choose to support other parent resources.
-                                      Implementations supporting other types of parent resources MUST clearly
-                                      document how/if Port is interpreted.
-
-                                      For the purpose of status, an attachment is considered successful as
-                                      long as the parent resource accepts it partially. For example, Gateway
-                                      listeners can restrict which Routes can attach to them by Route kind,
-                                      namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
-                                      from the referencing Route, the Route MUST be considered successfully
-                                      attached. If no Gateway listeners accept attachment from this Route,
-                                      the Route MUST be considered detached from the Gateway.
-
-                                      Support: Extended
-                                    type: integer
-                                    format: int32
-                                    maximum: 65535
-                                    minimum: 1
-                                  sectionName:
-                                    description: |-
-                                      SectionName is the name of a section within the target resource. In the
-                                      following resources, SectionName is interpreted as the following:
-
-                                      * Gateway: Listener name. When both Port (experimental) and SectionName
-                                      are specified, the name and port of the selected listener must match
-                                      both specified values.
-                                      * Service: Port name. When both Port (experimental) and SectionName
-                                      are specified, the name and port of the selected listener must match
-                                      both specified values.
-
-                                      Implementations MAY choose to support attaching Routes to other resources.
-                                      If that is the case, they MUST clearly document how SectionName is
-                                      interpreted.
-
-                                      When unspecified (empty string), this will reference the entire resource.
-                                      For the purpose of status, an attachment is considered successful if at
-                                      least one section in the parent resource accepts it. For example, Gateway
-                                      listeners can restrict which Routes can attach to them by Route kind,
-                                      namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
-                                      the referencing Route, the Route MUST be considered successfully
-                                      attached. If no Gateway listeners accept attachment from this Route, the
-                                      Route MUST be considered detached from the Gateway.
-
-                                      Support: Core
-                                    type: string
-                                    maxLength: 253
-                                    minLength: 1
-                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                            podTemplate:
-                              description: |-
-                                Optional pod template used to configure the ACME challenge solver pods
-                                used for HTTP01 challenges.
-                              type: object
-                              properties:
-                                metadata:
-                                  description: |-
-                                    ObjectMeta overrides for the pod used to solve HTTP01 challenges.
-                                    Only the 'labels' and 'annotations' fields may be set.
-                                    If labels or annotations overlap with in-built values, the values here
-                                    will override the in-built values.
-                                  type: object
-                                  properties:
-                                    annotations:
-                                      description: Annotations that should be added to the created ACME HTTP01 solver pods.
-                                      type: object
-                                      additionalProperties:
-                                        type: string
-                                    labels:
-                                      description: Labels that should be added to the created ACME HTTP01 solver pods.
-                                      type: object
-                                      additionalProperties:
-                                        type: string
-                                spec:
-                                  description: |-
-                                    PodSpec defines overrides for the HTTP01 challenge solver pod.
-                                    Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
-                                    All other fields will be ignored.
-                                  type: object
-                                  properties:
-                                    affinity:
-                                      description: If specified, the pod's scheduling constraints
-                                      type: object
-                                      properties:
-                                        nodeAffinity:
-                                          description: Describes node affinity scheduling rules for the pod.
-                                          type: object
-                                          properties:
-                                            preferredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                The scheduler will prefer to schedule pods to nodes that satisfy
-                                                the affinity expressions specified by this field, but it may choose
-                                                a node that violates one or more of the expressions. The node that is
-                                                most preferred is the one with the greatest sum of weights, i.e.
-                                                for each node that meets all of the scheduling requirements (resource
-                                                request, requiredDuringScheduling affinity expressions, etc.),
-                                                compute a sum by iterating through the elements of this field and adding
-                                                "weight" to the sum if the node matches the corresponding matchExpressions; the
-                                                node(s) with the highest sum are the most preferred.
-                                              type: array
-                                              items:
-                                                description: |-
-                                                  An empty preferred scheduling term matches all objects with implicit weight 0
-                                                  (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
-                                                type: object
-                                                required:
-                                                  - preference
-                                                  - weight
-                                                properties:
-                                                  preference:
-                                                    description: A node selector term, associated with the corresponding weight.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: A list of node selector requirements by node's labels.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A node selector requirement is a selector that contains values, a key, and an operator
-                                                            that relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: The label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                Represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                An array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. If the operator is Gt or Lt, the values
-                                                                array must have a single element, which will be interpreted as an integer.
-                                                                This array is replaced during a strategic merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchFields:
-                                                        description: A list of node selector requirements by node's fields.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A node selector requirement is a selector that contains values, a key, and an operator
-                                                            that relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: The label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                Represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                An array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. If the operator is Gt or Lt, the values
-                                                                array must have a single element, which will be interpreted as an integer.
-                                                                This array is replaced during a strategic merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                    x-kubernetes-map-type: atomic
-                                                  weight:
-                                                    description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
-                                                    type: integer
-                                                    format: int32
-                                              x-kubernetes-list-type: atomic
-                                            requiredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                If the affinity requirements specified by this field are not met at
-                                                scheduling time, the pod will not be scheduled onto the node.
-                                                If the affinity requirements specified by this field cease to be met
-                                                at some point during pod execution (e.g. due to an update), the system
-                                                may or may not try to eventually evict the pod from its node.
-                                              type: object
-                                              required:
-                                                - nodeSelectorTerms
-                                              properties:
-                                                nodeSelectorTerms:
-                                                  description: Required. A list of node selector terms. The terms are ORed.
-                                                  type: array
-                                                  items:
-                                                    description: |-
-                                                      A null or empty node selector term matches no objects. The requirements of
-                                                      them are ANDed.
-                                                      The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: A list of node selector requirements by node's labels.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A node selector requirement is a selector that contains values, a key, and an operator
-                                                            that relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: The label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                Represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                An array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. If the operator is Gt or Lt, the values
-                                                                array must have a single element, which will be interpreted as an integer.
-                                                                This array is replaced during a strategic merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchFields:
-                                                        description: A list of node selector requirements by node's fields.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A node selector requirement is a selector that contains values, a key, and an operator
-                                                            that relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: The label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                Represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                An array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. If the operator is Gt or Lt, the values
-                                                                array must have a single element, which will be interpreted as an integer.
-                                                                This array is replaced during a strategic merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                    x-kubernetes-map-type: atomic
-                                                  x-kubernetes-list-type: atomic
-                                              x-kubernetes-map-type: atomic
-                                        podAffinity:
-                                          description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
-                                          type: object
-                                          properties:
-                                            preferredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                The scheduler will prefer to schedule pods to nodes that satisfy
-                                                the affinity expressions specified by this field, but it may choose
-                                                a node that violates one or more of the expressions. The node that is
-                                                most preferred is the one with the greatest sum of weights, i.e.
-                                                for each node that meets all of the scheduling requirements (resource
-                                                request, requiredDuringScheduling affinity expressions, etc.),
-                                                compute a sum by iterating through the elements of this field and adding
-                                                "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                node(s) with the highest sum are the most preferred.
-                                              type: array
-                                              items:
-                                                description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                type: object
-                                                required:
-                                                  - podAffinityTerm
-                                                  - weight
-                                                properties:
-                                                  podAffinityTerm:
-                                                    description: Required. A pod affinity term, associated with the corresponding weight.
-                                                    type: object
-                                                    required:
-                                                      - topologyKey
-                                                    properties:
-                                                      labelSelector:
-                                                        description: |-
-                                                          A label query over a set of resources, in this case pods.
-                                                          If it's null, this PodAffinityTerm matches with no Pods.
-                                                        type: object
-                                                        properties:
-                                                          matchExpressions:
-                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                            type: array
-                                                            items:
-                                                              description: |-
-                                                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                relates the key and values.
-                                                              type: object
-                                                              required:
-                                                                - key
-                                                                - operator
-                                                              properties:
-                                                                key:
-                                                                  description: key is the label key that the selector applies to.
-                                                                  type: string
-                                                                operator:
-                                                                  description: |-
-                                                                    operator represents a key's relationship to a set of values.
-                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                  type: string
-                                                                values:
-                                                                  description: |-
-                                                                    values is an array of string values. If the operator is In or NotIn,
-                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                    the values array must be empty. This array is replaced during a strategic
-                                                                    merge patch.
-                                                                  type: array
-                                                                  items:
-                                                                    type: string
-                                                                  x-kubernetes-list-type: atomic
-                                                            x-kubernetes-list-type: atomic
-                                                          matchLabels:
-                                                            description: |-
-                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                            type: object
-                                                            additionalProperties:
-                                                              type: string
-                                                        x-kubernetes-map-type: atomic
-                                                      matchLabelKeys:
-                                                        description: |-
-                                                          MatchLabelKeys is a set of pod label keys to select which pods will
-                                                          be taken into consideration. The keys are used to lookup values from the
-                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                          to select the group of existing pods which pods will be taken into consideration
-                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                          pod labels will be ignored. The default value is empty.
-                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      mismatchLabelKeys:
-                                                        description: |-
-                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                          be taken into consideration. The keys are used to lookup values from the
-                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                          to select the group of existing pods which pods will be taken into consideration
-                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                          pod labels will be ignored. The default value is empty.
-                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      namespaceSelector:
-                                                        description: |-
-                                                          A label query over the set of namespaces that the term applies to.
-                                                          The term is applied to the union of the namespaces selected by this field
-                                                          and the ones listed in the namespaces field.
-                                                          null selector and null or empty namespaces list means "this pod's namespace".
-                                                          An empty selector ({}) matches all namespaces.
-                                                        type: object
-                                                        properties:
-                                                          matchExpressions:
-                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                            type: array
-                                                            items:
-                                                              description: |-
-                                                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                relates the key and values.
-                                                              type: object
-                                                              required:
-                                                                - key
-                                                                - operator
-                                                              properties:
-                                                                key:
-                                                                  description: key is the label key that the selector applies to.
-                                                                  type: string
-                                                                operator:
-                                                                  description: |-
-                                                                    operator represents a key's relationship to a set of values.
-                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                  type: string
-                                                                values:
-                                                                  description: |-
-                                                                    values is an array of string values. If the operator is In or NotIn,
-                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                    the values array must be empty. This array is replaced during a strategic
-                                                                    merge patch.
-                                                                  type: array
-                                                                  items:
-                                                                    type: string
-                                                                  x-kubernetes-list-type: atomic
-                                                            x-kubernetes-list-type: atomic
-                                                          matchLabels:
-                                                            description: |-
-                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                            type: object
-                                                            additionalProperties:
-                                                              type: string
-                                                        x-kubernetes-map-type: atomic
-                                                      namespaces:
-                                                        description: |-
-                                                          namespaces specifies a static list of namespace names that the term applies to.
-                                                          The term is applied to the union of the namespaces listed in this field
-                                                          and the ones selected by namespaceSelector.
-                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      topologyKey:
-                                                        description: |-
-                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                          whose value of the label with key topologyKey matches that of any node on which any of the
-                                                          selected pods is running.
-                                                          Empty topologyKey is not allowed.
-                                                        type: string
-                                                  weight:
-                                                    description: |-
-                                                      weight associated with matching the corresponding podAffinityTerm,
-                                                      in the range 1-100.
-                                                    type: integer
-                                                    format: int32
-                                              x-kubernetes-list-type: atomic
-                                            requiredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                If the affinity requirements specified by this field are not met at
-                                                scheduling time, the pod will not be scheduled onto the node.
-                                                If the affinity requirements specified by this field cease to be met
-                                                at some point during pod execution (e.g. due to a pod label update), the
-                                                system may or may not try to eventually evict the pod from its node.
-                                                When there are multiple elements, the lists of nodes corresponding to each
-                                                podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                              type: array
-                                              items:
-                                                description: |-
-                                                  Defines a set of pods (namely those matching the labelSelector
-                                                  relative to the given namespace(s)) that this pod should be
-                                                  co-located (affinity) or not co-located (anti-affinity) with,
-                                                  where co-located is defined as running on a node whose value of
-                                                  the label with key <topologyKey> matches that of any node on which
-                                                  a pod of the set of pods is running
-                                                type: object
-                                                required:
-                                                  - topologyKey
-                                                properties:
-                                                  labelSelector:
-                                                    description: |-
-                                                      A label query over a set of resources, in this case pods.
-                                                      If it's null, this PodAffinityTerm matches with no Pods.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A label selector requirement is a selector that contains values, a key, and an operator that
-                                                            relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: key is the label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                operator represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                values is an array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. This array is replaced during a strategic
-                                                                merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchLabels:
-                                                        description: |-
-                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                        type: object
-                                                        additionalProperties:
-                                                          type: string
-                                                    x-kubernetes-map-type: atomic
-                                                  matchLabelKeys:
-                                                    description: |-
-                                                      MatchLabelKeys is a set of pod label keys to select which pods will
-                                                      be taken into consideration. The keys are used to lookup values from the
-                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                      to select the group of existing pods which pods will be taken into consideration
-                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                      pod labels will be ignored. The default value is empty.
-                                                      The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                      Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  mismatchLabelKeys:
-                                                    description: |-
-                                                      MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                      be taken into consideration. The keys are used to lookup values from the
-                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                      to select the group of existing pods which pods will be taken into consideration
-                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                      pod labels will be ignored. The default value is empty.
-                                                      The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                      Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  namespaceSelector:
-                                                    description: |-
-                                                      A label query over the set of namespaces that the term applies to.
-                                                      The term is applied to the union of the namespaces selected by this field
-                                                      and the ones listed in the namespaces field.
-                                                      null selector and null or empty namespaces list means "this pod's namespace".
-                                                      An empty selector ({}) matches all namespaces.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A label selector requirement is a selector that contains values, a key, and an operator that
-                                                            relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: key is the label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                operator represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                values is an array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. This array is replaced during a strategic
-                                                                merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchLabels:
-                                                        description: |-
-                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                        type: object
-                                                        additionalProperties:
-                                                          type: string
-                                                    x-kubernetes-map-type: atomic
-                                                  namespaces:
-                                                    description: |-
-                                                      namespaces specifies a static list of namespace names that the term applies to.
-                                                      The term is applied to the union of the namespaces listed in this field
-                                                      and the ones selected by namespaceSelector.
-                                                      null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  topologyKey:
-                                                    description: |-
-                                                      This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                      the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                      whose value of the label with key topologyKey matches that of any node on which any of the
-                                                      selected pods is running.
-                                                      Empty topologyKey is not allowed.
-                                                    type: string
-                                              x-kubernetes-list-type: atomic
-                                        podAntiAffinity:
-                                          description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
-                                          type: object
-                                          properties:
-                                            preferredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                The scheduler will prefer to schedule pods to nodes that satisfy
-                                                the anti-affinity expressions specified by this field, but it may choose
-                                                a node that violates one or more of the expressions. The node that is
-                                                most preferred is the one with the greatest sum of weights, i.e.
-                                                for each node that meets all of the scheduling requirements (resource
-                                                request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                                compute a sum by iterating through the elements of this field and adding
-                                                "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                node(s) with the highest sum are the most preferred.
-                                              type: array
-                                              items:
-                                                description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                type: object
-                                                required:
-                                                  - podAffinityTerm
-                                                  - weight
-                                                properties:
-                                                  podAffinityTerm:
-                                                    description: Required. A pod affinity term, associated with the corresponding weight.
-                                                    type: object
-                                                    required:
-                                                      - topologyKey
-                                                    properties:
-                                                      labelSelector:
-                                                        description: |-
-                                                          A label query over a set of resources, in this case pods.
-                                                          If it's null, this PodAffinityTerm matches with no Pods.
-                                                        type: object
-                                                        properties:
-                                                          matchExpressions:
-                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                            type: array
-                                                            items:
-                                                              description: |-
-                                                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                relates the key and values.
-                                                              type: object
-                                                              required:
-                                                                - key
-                                                                - operator
-                                                              properties:
-                                                                key:
-                                                                  description: key is the label key that the selector applies to.
-                                                                  type: string
-                                                                operator:
-                                                                  description: |-
-                                                                    operator represents a key's relationship to a set of values.
-                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                  type: string
-                                                                values:
-                                                                  description: |-
-                                                                    values is an array of string values. If the operator is In or NotIn,
-                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                    the values array must be empty. This array is replaced during a strategic
-                                                                    merge patch.
-                                                                  type: array
-                                                                  items:
-                                                                    type: string
-                                                                  x-kubernetes-list-type: atomic
-                                                            x-kubernetes-list-type: atomic
-                                                          matchLabels:
-                                                            description: |-
-                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                            type: object
-                                                            additionalProperties:
-                                                              type: string
-                                                        x-kubernetes-map-type: atomic
-                                                      matchLabelKeys:
-                                                        description: |-
-                                                          MatchLabelKeys is a set of pod label keys to select which pods will
-                                                          be taken into consideration. The keys are used to lookup values from the
-                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                          to select the group of existing pods which pods will be taken into consideration
-                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                          pod labels will be ignored. The default value is empty.
-                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      mismatchLabelKeys:
-                                                        description: |-
-                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                          be taken into consideration. The keys are used to lookup values from the
-                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                          to select the group of existing pods which pods will be taken into consideration
-                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                          pod labels will be ignored. The default value is empty.
-                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      namespaceSelector:
-                                                        description: |-
-                                                          A label query over the set of namespaces that the term applies to.
-                                                          The term is applied to the union of the namespaces selected by this field
-                                                          and the ones listed in the namespaces field.
-                                                          null selector and null or empty namespaces list means "this pod's namespace".
-                                                          An empty selector ({}) matches all namespaces.
-                                                        type: object
-                                                        properties:
-                                                          matchExpressions:
-                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                            type: array
-                                                            items:
-                                                              description: |-
-                                                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                relates the key and values.
-                                                              type: object
-                                                              required:
-                                                                - key
-                                                                - operator
-                                                              properties:
-                                                                key:
-                                                                  description: key is the label key that the selector applies to.
-                                                                  type: string
-                                                                operator:
-                                                                  description: |-
-                                                                    operator represents a key's relationship to a set of values.
-                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                  type: string
-                                                                values:
-                                                                  description: |-
-                                                                    values is an array of string values. If the operator is In or NotIn,
-                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                    the values array must be empty. This array is replaced during a strategic
-                                                                    merge patch.
-                                                                  type: array
-                                                                  items:
-                                                                    type: string
-                                                                  x-kubernetes-list-type: atomic
-                                                            x-kubernetes-list-type: atomic
-                                                          matchLabels:
-                                                            description: |-
-                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                            type: object
-                                                            additionalProperties:
-                                                              type: string
-                                                        x-kubernetes-map-type: atomic
-                                                      namespaces:
-                                                        description: |-
-                                                          namespaces specifies a static list of namespace names that the term applies to.
-                                                          The term is applied to the union of the namespaces listed in this field
-                                                          and the ones selected by namespaceSelector.
-                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      topologyKey:
-                                                        description: |-
-                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                          whose value of the label with key topologyKey matches that of any node on which any of the
-                                                          selected pods is running.
-                                                          Empty topologyKey is not allowed.
-                                                        type: string
-                                                  weight:
-                                                    description: |-
-                                                      weight associated with matching the corresponding podAffinityTerm,
-                                                      in the range 1-100.
-                                                    type: integer
-                                                    format: int32
-                                              x-kubernetes-list-type: atomic
-                                            requiredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                If the anti-affinity requirements specified by this field are not met at
-                                                scheduling time, the pod will not be scheduled onto the node.
-                                                If the anti-affinity requirements specified by this field cease to be met
-                                                at some point during pod execution (e.g. due to a pod label update), the
-                                                system may or may not try to eventually evict the pod from its node.
-                                                When there are multiple elements, the lists of nodes corresponding to each
-                                                podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                              type: array
-                                              items:
-                                                description: |-
-                                                  Defines a set of pods (namely those matching the labelSelector
-                                                  relative to the given namespace(s)) that this pod should be
-                                                  co-located (affinity) or not co-located (anti-affinity) with,
-                                                  where co-located is defined as running on a node whose value of
-                                                  the label with key <topologyKey> matches that of any node on which
-                                                  a pod of the set of pods is running
-                                                type: object
-                                                required:
-                                                  - topologyKey
-                                                properties:
-                                                  labelSelector:
-                                                    description: |-
-                                                      A label query over a set of resources, in this case pods.
-                                                      If it's null, this PodAffinityTerm matches with no Pods.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A label selector requirement is a selector that contains values, a key, and an operator that
-                                                            relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: key is the label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                operator represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                values is an array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. This array is replaced during a strategic
-                                                                merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchLabels:
-                                                        description: |-
-                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                        type: object
-                                                        additionalProperties:
-                                                          type: string
-                                                    x-kubernetes-map-type: atomic
-                                                  matchLabelKeys:
-                                                    description: |-
-                                                      MatchLabelKeys is a set of pod label keys to select which pods will
-                                                      be taken into consideration. The keys are used to lookup values from the
-                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                      to select the group of existing pods which pods will be taken into consideration
-                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                      pod labels will be ignored. The default value is empty.
-                                                      The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                      Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  mismatchLabelKeys:
-                                                    description: |-
-                                                      MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                      be taken into consideration. The keys are used to lookup values from the
-                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                      to select the group of existing pods which pods will be taken into consideration
-                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                      pod labels will be ignored. The default value is empty.
-                                                      The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                      Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  namespaceSelector:
-                                                    description: |-
-                                                      A label query over the set of namespaces that the term applies to.
-                                                      The term is applied to the union of the namespaces selected by this field
-                                                      and the ones listed in the namespaces field.
-                                                      null selector and null or empty namespaces list means "this pod's namespace".
-                                                      An empty selector ({}) matches all namespaces.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A label selector requirement is a selector that contains values, a key, and an operator that
-                                                            relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: key is the label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                operator represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                values is an array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. This array is replaced during a strategic
-                                                                merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchLabels:
-                                                        description: |-
-                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                        type: object
-                                                        additionalProperties:
-                                                          type: string
-                                                    x-kubernetes-map-type: atomic
-                                                  namespaces:
-                                                    description: |-
-                                                      namespaces specifies a static list of namespace names that the term applies to.
-                                                      The term is applied to the union of the namespaces listed in this field
-                                                      and the ones selected by namespaceSelector.
-                                                      null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  topologyKey:
-                                                    description: |-
-                                                      This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                      the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                      whose value of the label with key topologyKey matches that of any node on which any of the
-                                                      selected pods is running.
-                                                      Empty topologyKey is not allowed.
-                                                    type: string
-                                              x-kubernetes-list-type: atomic
-                                    imagePullSecrets:
-                                      description: If specified, the pod's imagePullSecrets
-                                      type: array
-                                      items:
-                                        description: |-
-                                          LocalObjectReference contains enough information to let you locate the
-                                          referenced object inside the same namespace.
-                                        type: object
-                                        properties:
-                                          name:
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                            default: ""
-                                        x-kubernetes-map-type: atomic
-                                    nodeSelector:
-                                      description: |-
-                                        NodeSelector is a selector which must be true for the pod to fit on a node.
-                                        Selector which must match a node's labels for the pod to be scheduled on that node.
-                                        More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
-                                      type: object
-                                      additionalProperties:
-                                        type: string
-                                    priorityClassName:
-                                      description: If specified, the pod's priorityClassName.
-                                      type: string
-                                    securityContext:
-                                      description: If specified, the pod's security context
-                                      type: object
-                                      properties:
-                                        fsGroup:
-                                          description: |-
-                                            A special supplemental group that applies to all containers in a pod.
-                                            Some volume types allow the Kubelet to change the ownership of that volume
-                                            to be owned by the pod:
-
-                                            1. The owning GID will be the FSGroup
-                                            2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
-                                            3. The permission bits are OR'd with rw-rw----
-
-                                            If unset, the Kubelet will not modify the ownership and permissions of any volume.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: integer
-                                          format: int64
-                                        fsGroupChangePolicy:
-                                          description: |-
-                                            fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
-                                            before being exposed inside Pod. This field will only apply to
-                                            volume types which support fsGroup based ownership(and permissions).
-                                            It will have no effect on ephemeral volume types such as: secret, configmaps
-                                            and emptydir.
-                                            Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: string
-                                        runAsGroup:
-                                          description: |-
-                                            The GID to run the entrypoint of the container process.
-                                            Uses runtime default if unset.
-                                            May also be set in SecurityContext.  If set in both SecurityContext and
-                                            PodSecurityContext, the value specified in SecurityContext takes precedence
-                                            for that container.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: integer
-                                          format: int64
-                                        runAsNonRoot:
-                                          description: |-
-                                            Indicates that the container must run as a non-root user.
-                                            If true, the Kubelet will validate the image at runtime to ensure that it
-                                            does not run as UID 0 (root) and fail to start the container if it does.
-                                            If unset or false, no such validation will be performed.
-                                            May also be set in SecurityContext.  If set in both SecurityContext and
-                                            PodSecurityContext, the value specified in SecurityContext takes precedence.
-                                          type: boolean
-                                        runAsUser:
-                                          description: |-
-                                            The UID to run the entrypoint of the container process.
-                                            Defaults to user specified in image metadata if unspecified.
-                                            May also be set in SecurityContext.  If set in both SecurityContext and
-                                            PodSecurityContext, the value specified in SecurityContext takes precedence
-                                            for that container.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: integer
-                                          format: int64
-                                        seLinuxOptions:
-                                          description: |-
-                                            The SELinux context to be applied to all containers.
-                                            If unspecified, the container runtime will allocate a random SELinux context for each
-                                            container.  May also be set in SecurityContext.  If set in
-                                            both SecurityContext and PodSecurityContext, the value specified in SecurityContext
-                                            takes precedence for that container.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: object
-                                          properties:
-                                            level:
-                                              description: Level is SELinux level label that applies to the container.
-                                              type: string
-                                            role:
-                                              description: Role is a SELinux role label that applies to the container.
-                                              type: string
-                                            type:
-                                              description: Type is a SELinux type label that applies to the container.
-                                              type: string
-                                            user:
-                                              description: User is a SELinux user label that applies to the container.
-                                              type: string
-                                        seccompProfile:
-                                          description: |-
-                                            The seccomp options to use by the containers in this pod.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: object
-                                          required:
-                                            - type
-                                          properties:
-                                            localhostProfile:
-                                              description: |-
-                                                localhostProfile indicates a profile defined in a file on the node should be used.
-                                                The profile must be preconfigured on the node to work.
-                                                Must be a descending path, relative to the kubelet's configured seccomp profile location.
-                                                Must be set if type is "Localhost". Must NOT be set for any other type.
-                                              type: string
-                                            type:
-                                              description: |-
-                                                type indicates which kind of seccomp profile will be applied.
-                                                Valid options are:
-
-                                                Localhost - a profile defined in a file on the node should be used.
-                                                RuntimeDefault - the container runtime default profile should be used.
-                                                Unconfined - no profile should be applied.
-                                              type: string
-                                        supplementalGroups:
-                                          description: |-
-                                            A list of groups applied to the first process run in each container, in addition
-                                            to the container's primary GID, the fsGroup (if specified), and group memberships
-                                            defined in the container image for the uid of the container process. If unspecified,
-                                            no additional groups are added to any container. Note that group memberships
-                                            defined in the container image for the uid of the container process are still effective,
-                                            even if they are not included in this list.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: array
-                                          items:
-                                            type: integer
-                                            format: int64
-                                        sysctls:
-                                          description: |-
-                                            Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
-                                            sysctls (by the container runtime) might fail to launch.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: array
-                                          items:
-                                            description: Sysctl defines a kernel parameter to be set
-                                            type: object
-                                            required:
-                                              - name
-                                              - value
-                                            properties:
-                                              name:
-                                                description: Name of a property to set
-                                                type: string
-                                              value:
-                                                description: Value of a property to set
-                                                type: string
-                                    serviceAccountName:
-                                      description: If specified, the pod's service account
-                                      type: string
-                                    tolerations:
-                                      description: If specified, the pod's tolerations.
-                                      type: array
-                                      items:
-                                        description: |-
-                                          The pod this Toleration is attached to tolerates any taint that matches
-                                          the triple <key,value,effect> using the matching operator <operator>.
-                                        type: object
-                                        properties:
-                                          effect:
-                                            description: |-
-                                              Effect indicates the taint effect to match. Empty means match all taint effects.
-                                              When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                                            type: string
-                                          key:
-                                            description: |-
-                                              Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                                              If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              Operator represents a key's relationship to the value.
-                                              Valid operators are Exists and Equal. Defaults to Equal.
-                                              Exists is equivalent to wildcard for value, so that a pod can
-                                              tolerate all taints of a particular category.
-                                            type: string
-                                          tolerationSeconds:
-                                            description: |-
-                                              TolerationSeconds represents the period of time the toleration (which must be
-                                              of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                                              it is not set, which means tolerate the taint forever (do not evict). Zero and
-                                              negative values will be treated as 0 (evict immediately) by the system.
-                                            type: integer
-                                            format: int64
-                                          value:
-                                            description: |-
-                                              Value is the taint value the toleration matches to.
-                                              If the operator is Exists, the value should be empty, otherwise just a regular string.
-                                            type: string
-                            serviceType:
-                              description: |-
-                                Optional service type for Kubernetes solver service. Supported values
-                                are NodePort or ClusterIP. If unset, defaults to NodePort.
-                              type: string
-                        ingress:
-                          description: |-
-                            The ingress based HTTP01 challenge solver will solve challenges by
-                            creating or modifying Ingress resources in order to route requests for
-                            '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
-                            provisioned by cert-manager for each Challenge to be completed.
-                          type: object
-                          properties:
-                            class:
-                              description: |-
-                                This field configures the annotation `kubernetes.io/ingress.class` when
-                                creating Ingress resources to solve ACME challenges that use this
-                                challenge solver. Only one of `class`, `name` or `ingressClassName` may
-                                be specified.
-                              type: string
-                            ingressClassName:
-                              description: |-
-                                This field configures the field `ingressClassName` on the created Ingress
-                                resources used to solve ACME challenges that use this challenge solver.
-                                This is the recommended way of configuring the ingress class. Only one of
-                                `class`, `name` or `ingressClassName` may be specified.
-                              type: string
-                            ingressTemplate:
-                              description: |-
-                                Optional ingress template used to configure the ACME challenge solver
-                                ingress used for HTTP01 challenges.
-                              type: object
-                              properties:
-                                metadata:
-                                  description: |-
-                                    ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
-                                    Only the 'labels' and 'annotations' fields may be set.
-                                    If labels or annotations overlap with in-built values, the values here
-                                    will override the in-built values.
-                                  type: object
-                                  properties:
-                                    annotations:
-                                      description: Annotations that should be added to the created ACME HTTP01 solver ingress.
-                                      type: object
-                                      additionalProperties:
-                                        type: string
-                                    labels:
-                                      description: Labels that should be added to the created ACME HTTP01 solver ingress.
-                                      type: object
-                                      additionalProperties:
-                                        type: string
-                            name:
-                              description: |-
-                                The name of the ingress resource that should have ACME challenge solving
-                                routes inserted into it in order to solve HTTP01 challenges.
-                                This is typically used in conjunction with ingress controllers like
-                                ingress-gce, which maintains a 1:1 mapping between external IPs and
-                                ingress resources. Only one of `class`, `name` or `ingressClassName` may
-                                be specified.
-                              type: string
-                            podTemplate:
-                              description: |-
-                                Optional pod template used to configure the ACME challenge solver pods
-                                used for HTTP01 challenges.
-                              type: object
-                              properties:
-                                metadata:
-                                  description: |-
-                                    ObjectMeta overrides for the pod used to solve HTTP01 challenges.
-                                    Only the 'labels' and 'annotations' fields may be set.
-                                    If labels or annotations overlap with in-built values, the values here
-                                    will override the in-built values.
-                                  type: object
-                                  properties:
-                                    annotations:
-                                      description: Annotations that should be added to the created ACME HTTP01 solver pods.
-                                      type: object
-                                      additionalProperties:
-                                        type: string
-                                    labels:
-                                      description: Labels that should be added to the created ACME HTTP01 solver pods.
-                                      type: object
-                                      additionalProperties:
-                                        type: string
-                                spec:
-                                  description: |-
-                                    PodSpec defines overrides for the HTTP01 challenge solver pod.
-                                    Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
-                                    All other fields will be ignored.
-                                  type: object
-                                  properties:
-                                    affinity:
-                                      description: If specified, the pod's scheduling constraints
-                                      type: object
-                                      properties:
-                                        nodeAffinity:
-                                          description: Describes node affinity scheduling rules for the pod.
-                                          type: object
-                                          properties:
-                                            preferredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                The scheduler will prefer to schedule pods to nodes that satisfy
-                                                the affinity expressions specified by this field, but it may choose
-                                                a node that violates one or more of the expressions. The node that is
-                                                most preferred is the one with the greatest sum of weights, i.e.
-                                                for each node that meets all of the scheduling requirements (resource
-                                                request, requiredDuringScheduling affinity expressions, etc.),
-                                                compute a sum by iterating through the elements of this field and adding
-                                                "weight" to the sum if the node matches the corresponding matchExpressions; the
-                                                node(s) with the highest sum are the most preferred.
-                                              type: array
-                                              items:
-                                                description: |-
-                                                  An empty preferred scheduling term matches all objects with implicit weight 0
-                                                  (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
-                                                type: object
-                                                required:
-                                                  - preference
-                                                  - weight
-                                                properties:
-                                                  preference:
-                                                    description: A node selector term, associated with the corresponding weight.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: A list of node selector requirements by node's labels.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A node selector requirement is a selector that contains values, a key, and an operator
-                                                            that relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: The label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                Represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                An array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. If the operator is Gt or Lt, the values
-                                                                array must have a single element, which will be interpreted as an integer.
-                                                                This array is replaced during a strategic merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchFields:
-                                                        description: A list of node selector requirements by node's fields.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A node selector requirement is a selector that contains values, a key, and an operator
-                                                            that relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: The label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                Represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                An array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. If the operator is Gt or Lt, the values
-                                                                array must have a single element, which will be interpreted as an integer.
-                                                                This array is replaced during a strategic merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                    x-kubernetes-map-type: atomic
-                                                  weight:
-                                                    description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
-                                                    type: integer
-                                                    format: int32
-                                              x-kubernetes-list-type: atomic
-                                            requiredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                If the affinity requirements specified by this field are not met at
-                                                scheduling time, the pod will not be scheduled onto the node.
-                                                If the affinity requirements specified by this field cease to be met
-                                                at some point during pod execution (e.g. due to an update), the system
-                                                may or may not try to eventually evict the pod from its node.
-                                              type: object
-                                              required:
-                                                - nodeSelectorTerms
-                                              properties:
-                                                nodeSelectorTerms:
-                                                  description: Required. A list of node selector terms. The terms are ORed.
-                                                  type: array
-                                                  items:
-                                                    description: |-
-                                                      A null or empty node selector term matches no objects. The requirements of
-                                                      them are ANDed.
-                                                      The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: A list of node selector requirements by node's labels.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A node selector requirement is a selector that contains values, a key, and an operator
-                                                            that relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: The label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                Represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                An array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. If the operator is Gt or Lt, the values
-                                                                array must have a single element, which will be interpreted as an integer.
-                                                                This array is replaced during a strategic merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchFields:
-                                                        description: A list of node selector requirements by node's fields.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A node selector requirement is a selector that contains values, a key, and an operator
-                                                            that relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: The label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                Represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                An array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. If the operator is Gt or Lt, the values
-                                                                array must have a single element, which will be interpreted as an integer.
-                                                                This array is replaced during a strategic merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                    x-kubernetes-map-type: atomic
-                                                  x-kubernetes-list-type: atomic
-                                              x-kubernetes-map-type: atomic
-                                        podAffinity:
-                                          description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
-                                          type: object
-                                          properties:
-                                            preferredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                The scheduler will prefer to schedule pods to nodes that satisfy
-                                                the affinity expressions specified by this field, but it may choose
-                                                a node that violates one or more of the expressions. The node that is
-                                                most preferred is the one with the greatest sum of weights, i.e.
-                                                for each node that meets all of the scheduling requirements (resource
-                                                request, requiredDuringScheduling affinity expressions, etc.),
-                                                compute a sum by iterating through the elements of this field and adding
-                                                "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                node(s) with the highest sum are the most preferred.
-                                              type: array
-                                              items:
-                                                description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                type: object
-                                                required:
-                                                  - podAffinityTerm
-                                                  - weight
-                                                properties:
-                                                  podAffinityTerm:
-                                                    description: Required. A pod affinity term, associated with the corresponding weight.
-                                                    type: object
-                                                    required:
-                                                      - topologyKey
-                                                    properties:
-                                                      labelSelector:
-                                                        description: |-
-                                                          A label query over a set of resources, in this case pods.
-                                                          If it's null, this PodAffinityTerm matches with no Pods.
-                                                        type: object
-                                                        properties:
-                                                          matchExpressions:
-                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                            type: array
-                                                            items:
-                                                              description: |-
-                                                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                relates the key and values.
-                                                              type: object
-                                                              required:
-                                                                - key
-                                                                - operator
-                                                              properties:
-                                                                key:
-                                                                  description: key is the label key that the selector applies to.
-                                                                  type: string
-                                                                operator:
-                                                                  description: |-
-                                                                    operator represents a key's relationship to a set of values.
-                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                  type: string
-                                                                values:
-                                                                  description: |-
-                                                                    values is an array of string values. If the operator is In or NotIn,
-                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                    the values array must be empty. This array is replaced during a strategic
-                                                                    merge patch.
-                                                                  type: array
-                                                                  items:
-                                                                    type: string
-                                                                  x-kubernetes-list-type: atomic
-                                                            x-kubernetes-list-type: atomic
-                                                          matchLabels:
-                                                            description: |-
-                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                            type: object
-                                                            additionalProperties:
-                                                              type: string
-                                                        x-kubernetes-map-type: atomic
-                                                      matchLabelKeys:
-                                                        description: |-
-                                                          MatchLabelKeys is a set of pod label keys to select which pods will
-                                                          be taken into consideration. The keys are used to lookup values from the
-                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                          to select the group of existing pods which pods will be taken into consideration
-                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                          pod labels will be ignored. The default value is empty.
-                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      mismatchLabelKeys:
-                                                        description: |-
-                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                          be taken into consideration. The keys are used to lookup values from the
-                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                          to select the group of existing pods which pods will be taken into consideration
-                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                          pod labels will be ignored. The default value is empty.
-                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      namespaceSelector:
-                                                        description: |-
-                                                          A label query over the set of namespaces that the term applies to.
-                                                          The term is applied to the union of the namespaces selected by this field
-                                                          and the ones listed in the namespaces field.
-                                                          null selector and null or empty namespaces list means "this pod's namespace".
-                                                          An empty selector ({}) matches all namespaces.
-                                                        type: object
-                                                        properties:
-                                                          matchExpressions:
-                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                            type: array
-                                                            items:
-                                                              description: |-
-                                                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                relates the key and values.
-                                                              type: object
-                                                              required:
-                                                                - key
-                                                                - operator
-                                                              properties:
-                                                                key:
-                                                                  description: key is the label key that the selector applies to.
-                                                                  type: string
-                                                                operator:
-                                                                  description: |-
-                                                                    operator represents a key's relationship to a set of values.
-                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                  type: string
-                                                                values:
-                                                                  description: |-
-                                                                    values is an array of string values. If the operator is In or NotIn,
-                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                    the values array must be empty. This array is replaced during a strategic
-                                                                    merge patch.
-                                                                  type: array
-                                                                  items:
-                                                                    type: string
-                                                                  x-kubernetes-list-type: atomic
-                                                            x-kubernetes-list-type: atomic
-                                                          matchLabels:
-                                                            description: |-
-                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                            type: object
-                                                            additionalProperties:
-                                                              type: string
-                                                        x-kubernetes-map-type: atomic
-                                                      namespaces:
-                                                        description: |-
-                                                          namespaces specifies a static list of namespace names that the term applies to.
-                                                          The term is applied to the union of the namespaces listed in this field
-                                                          and the ones selected by namespaceSelector.
-                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      topologyKey:
-                                                        description: |-
-                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                          whose value of the label with key topologyKey matches that of any node on which any of the
-                                                          selected pods is running.
-                                                          Empty topologyKey is not allowed.
-                                                        type: string
-                                                  weight:
-                                                    description: |-
-                                                      weight associated with matching the corresponding podAffinityTerm,
-                                                      in the range 1-100.
-                                                    type: integer
-                                                    format: int32
-                                              x-kubernetes-list-type: atomic
-                                            requiredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                If the affinity requirements specified by this field are not met at
-                                                scheduling time, the pod will not be scheduled onto the node.
-                                                If the affinity requirements specified by this field cease to be met
-                                                at some point during pod execution (e.g. due to a pod label update), the
-                                                system may or may not try to eventually evict the pod from its node.
-                                                When there are multiple elements, the lists of nodes corresponding to each
-                                                podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                              type: array
-                                              items:
-                                                description: |-
-                                                  Defines a set of pods (namely those matching the labelSelector
-                                                  relative to the given namespace(s)) that this pod should be
-                                                  co-located (affinity) or not co-located (anti-affinity) with,
-                                                  where co-located is defined as running on a node whose value of
-                                                  the label with key <topologyKey> matches that of any node on which
-                                                  a pod of the set of pods is running
-                                                type: object
-                                                required:
-                                                  - topologyKey
-                                                properties:
-                                                  labelSelector:
-                                                    description: |-
-                                                      A label query over a set of resources, in this case pods.
-                                                      If it's null, this PodAffinityTerm matches with no Pods.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A label selector requirement is a selector that contains values, a key, and an operator that
-                                                            relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: key is the label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                operator represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                values is an array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. This array is replaced during a strategic
-                                                                merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchLabels:
-                                                        description: |-
-                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                        type: object
-                                                        additionalProperties:
-                                                          type: string
-                                                    x-kubernetes-map-type: atomic
-                                                  matchLabelKeys:
-                                                    description: |-
-                                                      MatchLabelKeys is a set of pod label keys to select which pods will
-                                                      be taken into consideration. The keys are used to lookup values from the
-                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                      to select the group of existing pods which pods will be taken into consideration
-                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                      pod labels will be ignored. The default value is empty.
-                                                      The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                      Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  mismatchLabelKeys:
-                                                    description: |-
-                                                      MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                      be taken into consideration. The keys are used to lookup values from the
-                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                      to select the group of existing pods which pods will be taken into consideration
-                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                      pod labels will be ignored. The default value is empty.
-                                                      The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                      Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  namespaceSelector:
-                                                    description: |-
-                                                      A label query over the set of namespaces that the term applies to.
-                                                      The term is applied to the union of the namespaces selected by this field
-                                                      and the ones listed in the namespaces field.
-                                                      null selector and null or empty namespaces list means "this pod's namespace".
-                                                      An empty selector ({}) matches all namespaces.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A label selector requirement is a selector that contains values, a key, and an operator that
-                                                            relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: key is the label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                operator represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                values is an array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. This array is replaced during a strategic
-                                                                merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchLabels:
-                                                        description: |-
-                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                        type: object
-                                                        additionalProperties:
-                                                          type: string
-                                                    x-kubernetes-map-type: atomic
-                                                  namespaces:
-                                                    description: |-
-                                                      namespaces specifies a static list of namespace names that the term applies to.
-                                                      The term is applied to the union of the namespaces listed in this field
-                                                      and the ones selected by namespaceSelector.
-                                                      null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  topologyKey:
-                                                    description: |-
-                                                      This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                      the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                      whose value of the label with key topologyKey matches that of any node on which any of the
-                                                      selected pods is running.
-                                                      Empty topologyKey is not allowed.
-                                                    type: string
-                                              x-kubernetes-list-type: atomic
-                                        podAntiAffinity:
-                                          description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
-                                          type: object
-                                          properties:
-                                            preferredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                The scheduler will prefer to schedule pods to nodes that satisfy
-                                                the anti-affinity expressions specified by this field, but it may choose
-                                                a node that violates one or more of the expressions. The node that is
-                                                most preferred is the one with the greatest sum of weights, i.e.
-                                                for each node that meets all of the scheduling requirements (resource
-                                                request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                                compute a sum by iterating through the elements of this field and adding
-                                                "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                node(s) with the highest sum are the most preferred.
-                                              type: array
-                                              items:
-                                                description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                type: object
-                                                required:
-                                                  - podAffinityTerm
-                                                  - weight
-                                                properties:
-                                                  podAffinityTerm:
-                                                    description: Required. A pod affinity term, associated with the corresponding weight.
-                                                    type: object
-                                                    required:
-                                                      - topologyKey
-                                                    properties:
-                                                      labelSelector:
-                                                        description: |-
-                                                          A label query over a set of resources, in this case pods.
-                                                          If it's null, this PodAffinityTerm matches with no Pods.
-                                                        type: object
-                                                        properties:
-                                                          matchExpressions:
-                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                            type: array
-                                                            items:
-                                                              description: |-
-                                                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                relates the key and values.
-                                                              type: object
-                                                              required:
-                                                                - key
-                                                                - operator
-                                                              properties:
-                                                                key:
-                                                                  description: key is the label key that the selector applies to.
-                                                                  type: string
-                                                                operator:
-                                                                  description: |-
-                                                                    operator represents a key's relationship to a set of values.
-                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                  type: string
-                                                                values:
-                                                                  description: |-
-                                                                    values is an array of string values. If the operator is In or NotIn,
-                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                    the values array must be empty. This array is replaced during a strategic
-                                                                    merge patch.
-                                                                  type: array
-                                                                  items:
-                                                                    type: string
-                                                                  x-kubernetes-list-type: atomic
-                                                            x-kubernetes-list-type: atomic
-                                                          matchLabels:
-                                                            description: |-
-                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                            type: object
-                                                            additionalProperties:
-                                                              type: string
-                                                        x-kubernetes-map-type: atomic
-                                                      matchLabelKeys:
-                                                        description: |-
-                                                          MatchLabelKeys is a set of pod label keys to select which pods will
-                                                          be taken into consideration. The keys are used to lookup values from the
-                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                          to select the group of existing pods which pods will be taken into consideration
-                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                          pod labels will be ignored. The default value is empty.
-                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      mismatchLabelKeys:
-                                                        description: |-
-                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                          be taken into consideration. The keys are used to lookup values from the
-                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                          to select the group of existing pods which pods will be taken into consideration
-                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                          pod labels will be ignored. The default value is empty.
-                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      namespaceSelector:
-                                                        description: |-
-                                                          A label query over the set of namespaces that the term applies to.
-                                                          The term is applied to the union of the namespaces selected by this field
-                                                          and the ones listed in the namespaces field.
-                                                          null selector and null or empty namespaces list means "this pod's namespace".
-                                                          An empty selector ({}) matches all namespaces.
-                                                        type: object
-                                                        properties:
-                                                          matchExpressions:
-                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                            type: array
-                                                            items:
-                                                              description: |-
-                                                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                relates the key and values.
-                                                              type: object
-                                                              required:
-                                                                - key
-                                                                - operator
-                                                              properties:
-                                                                key:
-                                                                  description: key is the label key that the selector applies to.
-                                                                  type: string
-                                                                operator:
-                                                                  description: |-
-                                                                    operator represents a key's relationship to a set of values.
-                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                  type: string
-                                                                values:
-                                                                  description: |-
-                                                                    values is an array of string values. If the operator is In or NotIn,
-                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                    the values array must be empty. This array is replaced during a strategic
-                                                                    merge patch.
-                                                                  type: array
-                                                                  items:
-                                                                    type: string
-                                                                  x-kubernetes-list-type: atomic
-                                                            x-kubernetes-list-type: atomic
-                                                          matchLabels:
-                                                            description: |-
-                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                            type: object
-                                                            additionalProperties:
-                                                              type: string
-                                                        x-kubernetes-map-type: atomic
-                                                      namespaces:
-                                                        description: |-
-                                                          namespaces specifies a static list of namespace names that the term applies to.
-                                                          The term is applied to the union of the namespaces listed in this field
-                                                          and the ones selected by namespaceSelector.
-                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      topologyKey:
-                                                        description: |-
-                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                          whose value of the label with key topologyKey matches that of any node on which any of the
-                                                          selected pods is running.
-                                                          Empty topologyKey is not allowed.
-                                                        type: string
-                                                  weight:
-                                                    description: |-
-                                                      weight associated with matching the corresponding podAffinityTerm,
-                                                      in the range 1-100.
-                                                    type: integer
-                                                    format: int32
-                                              x-kubernetes-list-type: atomic
-                                            requiredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                If the anti-affinity requirements specified by this field are not met at
-                                                scheduling time, the pod will not be scheduled onto the node.
-                                                If the anti-affinity requirements specified by this field cease to be met
-                                                at some point during pod execution (e.g. due to a pod label update), the
-                                                system may or may not try to eventually evict the pod from its node.
-                                                When there are multiple elements, the lists of nodes corresponding to each
-                                                podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                              type: array
-                                              items:
-                                                description: |-
-                                                  Defines a set of pods (namely those matching the labelSelector
-                                                  relative to the given namespace(s)) that this pod should be
-                                                  co-located (affinity) or not co-located (anti-affinity) with,
-                                                  where co-located is defined as running on a node whose value of
-                                                  the label with key <topologyKey> matches that of any node on which
-                                                  a pod of the set of pods is running
-                                                type: object
-                                                required:
-                                                  - topologyKey
-                                                properties:
-                                                  labelSelector:
-                                                    description: |-
-                                                      A label query over a set of resources, in this case pods.
-                                                      If it's null, this PodAffinityTerm matches with no Pods.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A label selector requirement is a selector that contains values, a key, and an operator that
-                                                            relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: key is the label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                operator represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                values is an array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. This array is replaced during a strategic
-                                                                merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchLabels:
-                                                        description: |-
-                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                        type: object
-                                                        additionalProperties:
-                                                          type: string
-                                                    x-kubernetes-map-type: atomic
-                                                  matchLabelKeys:
-                                                    description: |-
-                                                      MatchLabelKeys is a set of pod label keys to select which pods will
-                                                      be taken into consideration. The keys are used to lookup values from the
-                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                      to select the group of existing pods which pods will be taken into consideration
-                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                      pod labels will be ignored. The default value is empty.
-                                                      The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                      Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  mismatchLabelKeys:
-                                                    description: |-
-                                                      MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                      be taken into consideration. The keys are used to lookup values from the
-                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                      to select the group of existing pods which pods will be taken into consideration
-                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                      pod labels will be ignored. The default value is empty.
-                                                      The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                      Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  namespaceSelector:
-                                                    description: |-
-                                                      A label query over the set of namespaces that the term applies to.
-                                                      The term is applied to the union of the namespaces selected by this field
-                                                      and the ones listed in the namespaces field.
-                                                      null selector and null or empty namespaces list means "this pod's namespace".
-                                                      An empty selector ({}) matches all namespaces.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A label selector requirement is a selector that contains values, a key, and an operator that
-                                                            relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: key is the label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                operator represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                values is an array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. This array is replaced during a strategic
-                                                                merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchLabels:
-                                                        description: |-
-                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                        type: object
-                                                        additionalProperties:
-                                                          type: string
-                                                    x-kubernetes-map-type: atomic
-                                                  namespaces:
-                                                    description: |-
-                                                      namespaces specifies a static list of namespace names that the term applies to.
-                                                      The term is applied to the union of the namespaces listed in this field
-                                                      and the ones selected by namespaceSelector.
-                                                      null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  topologyKey:
-                                                    description: |-
-                                                      This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                      the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                      whose value of the label with key topologyKey matches that of any node on which any of the
-                                                      selected pods is running.
-                                                      Empty topologyKey is not allowed.
-                                                    type: string
-                                              x-kubernetes-list-type: atomic
-                                    imagePullSecrets:
-                                      description: If specified, the pod's imagePullSecrets
-                                      type: array
-                                      items:
-                                        description: |-
-                                          LocalObjectReference contains enough information to let you locate the
-                                          referenced object inside the same namespace.
-                                        type: object
-                                        properties:
-                                          name:
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                            default: ""
-                                        x-kubernetes-map-type: atomic
-                                    nodeSelector:
-                                      description: |-
-                                        NodeSelector is a selector which must be true for the pod to fit on a node.
-                                        Selector which must match a node's labels for the pod to be scheduled on that node.
-                                        More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
-                                      type: object
-                                      additionalProperties:
-                                        type: string
-                                    priorityClassName:
-                                      description: If specified, the pod's priorityClassName.
-                                      type: string
-                                    securityContext:
-                                      description: If specified, the pod's security context
-                                      type: object
-                                      properties:
-                                        fsGroup:
-                                          description: |-
-                                            A special supplemental group that applies to all containers in a pod.
-                                            Some volume types allow the Kubelet to change the ownership of that volume
-                                            to be owned by the pod:
-
-                                            1. The owning GID will be the FSGroup
-                                            2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
-                                            3. The permission bits are OR'd with rw-rw----
-
-                                            If unset, the Kubelet will not modify the ownership and permissions of any volume.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: integer
-                                          format: int64
-                                        fsGroupChangePolicy:
-                                          description: |-
-                                            fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
-                                            before being exposed inside Pod. This field will only apply to
-                                            volume types which support fsGroup based ownership(and permissions).
-                                            It will have no effect on ephemeral volume types such as: secret, configmaps
-                                            and emptydir.
-                                            Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: string
-                                        runAsGroup:
-                                          description: |-
-                                            The GID to run the entrypoint of the container process.
-                                            Uses runtime default if unset.
-                                            May also be set in SecurityContext.  If set in both SecurityContext and
-                                            PodSecurityContext, the value specified in SecurityContext takes precedence
-                                            for that container.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: integer
-                                          format: int64
-                                        runAsNonRoot:
-                                          description: |-
-                                            Indicates that the container must run as a non-root user.
-                                            If true, the Kubelet will validate the image at runtime to ensure that it
-                                            does not run as UID 0 (root) and fail to start the container if it does.
-                                            If unset or false, no such validation will be performed.
-                                            May also be set in SecurityContext.  If set in both SecurityContext and
-                                            PodSecurityContext, the value specified in SecurityContext takes precedence.
-                                          type: boolean
-                                        runAsUser:
-                                          description: |-
-                                            The UID to run the entrypoint of the container process.
-                                            Defaults to user specified in image metadata if unspecified.
-                                            May also be set in SecurityContext.  If set in both SecurityContext and
-                                            PodSecurityContext, the value specified in SecurityContext takes precedence
-                                            for that container.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: integer
-                                          format: int64
-                                        seLinuxOptions:
-                                          description: |-
-                                            The SELinux context to be applied to all containers.
-                                            If unspecified, the container runtime will allocate a random SELinux context for each
-                                            container.  May also be set in SecurityContext.  If set in
-                                            both SecurityContext and PodSecurityContext, the value specified in SecurityContext
-                                            takes precedence for that container.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: object
-                                          properties:
-                                            level:
-                                              description: Level is SELinux level label that applies to the container.
-                                              type: string
-                                            role:
-                                              description: Role is a SELinux role label that applies to the container.
-                                              type: string
-                                            type:
-                                              description: Type is a SELinux type label that applies to the container.
-                                              type: string
-                                            user:
-                                              description: User is a SELinux user label that applies to the container.
-                                              type: string
-                                        seccompProfile:
-                                          description: |-
-                                            The seccomp options to use by the containers in this pod.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: object
-                                          required:
-                                            - type
-                                          properties:
-                                            localhostProfile:
-                                              description: |-
-                                                localhostProfile indicates a profile defined in a file on the node should be used.
-                                                The profile must be preconfigured on the node to work.
-                                                Must be a descending path, relative to the kubelet's configured seccomp profile location.
-                                                Must be set if type is "Localhost". Must NOT be set for any other type.
-                                              type: string
-                                            type:
-                                              description: |-
-                                                type indicates which kind of seccomp profile will be applied.
-                                                Valid options are:
-
-                                                Localhost - a profile defined in a file on the node should be used.
-                                                RuntimeDefault - the container runtime default profile should be used.
-                                                Unconfined - no profile should be applied.
-                                              type: string
-                                        supplementalGroups:
-                                          description: |-
-                                            A list of groups applied to the first process run in each container, in addition
-                                            to the container's primary GID, the fsGroup (if specified), and group memberships
-                                            defined in the container image for the uid of the container process. If unspecified,
-                                            no additional groups are added to any container. Note that group memberships
-                                            defined in the container image for the uid of the container process are still effective,
-                                            even if they are not included in this list.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: array
-                                          items:
-                                            type: integer
-                                            format: int64
-                                        sysctls:
-                                          description: |-
-                                            Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
-                                            sysctls (by the container runtime) might fail to launch.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: array
-                                          items:
-                                            description: Sysctl defines a kernel parameter to be set
-                                            type: object
-                                            required:
-                                              - name
-                                              - value
-                                            properties:
-                                              name:
-                                                description: Name of a property to set
-                                                type: string
-                                              value:
-                                                description: Value of a property to set
-                                                type: string
-                                    serviceAccountName:
-                                      description: If specified, the pod's service account
-                                      type: string
-                                    tolerations:
-                                      description: If specified, the pod's tolerations.
-                                      type: array
-                                      items:
-                                        description: |-
-                                          The pod this Toleration is attached to tolerates any taint that matches
-                                          the triple <key,value,effect> using the matching operator <operator>.
-                                        type: object
-                                        properties:
-                                          effect:
-                                            description: |-
-                                              Effect indicates the taint effect to match. Empty means match all taint effects.
-                                              When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                                            type: string
-                                          key:
-                                            description: |-
-                                              Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                                              If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              Operator represents a key's relationship to the value.
-                                              Valid operators are Exists and Equal. Defaults to Equal.
-                                              Exists is equivalent to wildcard for value, so that a pod can
-                                              tolerate all taints of a particular category.
-                                            type: string
-                                          tolerationSeconds:
-                                            description: |-
-                                              TolerationSeconds represents the period of time the toleration (which must be
-                                              of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                                              it is not set, which means tolerate the taint forever (do not evict). Zero and
-                                              negative values will be treated as 0 (evict immediately) by the system.
-                                            type: integer
-                                            format: int64
-                                          value:
-                                            description: |-
-                                              Value is the taint value the toleration matches to.
-                                              If the operator is Exists, the value should be empty, otherwise just a regular string.
-                                            type: string
-                            serviceType:
-                              description: |-
-                                Optional service type for Kubernetes solver service. Supported values
-                                are NodePort or ClusterIP. If unset, defaults to NodePort.
-                              type: string
-                    selector:
-                      description: |-
-                        Selector selects a set of DNSNames on the Certificate resource that
-                        should be solved using this challenge solver.
-                        If not specified, the solver will be treated as the 'default' solver
-                        with the lowest priority, i.e. if any other solver has a more specific
-                        match, it will be used instead.
-                      type: object
-                      properties:
-                        dnsNames:
-                          description: |-
-                            List of DNSNames that this solver will be used to solve.
-                            If specified and a match is found, a dnsNames selector will take
-                            precedence over a dnsZones selector.
-                            If multiple solvers match with the same dnsNames value, the solver
-                            with the most matching labels in matchLabels will be selected.
-                            If neither has more matches, the solver defined earlier in the list
-                            will be selected.
-                          type: array
-                          items:
-                            type: string
-                        dnsZones:
-                          description: |-
-                            List of DNSZones that this solver will be used to solve.
-                            The most specific DNS zone match specified here will take precedence
-                            over other DNS zone matches, so a solver specifying sys.example.com
-                            will be selected over one specifying example.com for the domain
-                            www.sys.example.com.
-                            If multiple solvers match with the same dnsZones value, the solver
-                            with the most matching labels in matchLabels will be selected.
-                            If neither has more matches, the solver defined earlier in the list
-                            will be selected.
-                          type: array
-                          items:
-                            type: string
-                        matchLabels:
-                          description: |-
-                            A label selector that is used to refine the set of certificate's that
-                            this challenge solver will apply to.
-                          type: object
-                          additionalProperties:
-                            type: string
-                token:
-                  description: |-
-                    The ACME challenge token for this challenge.
-                    This is the raw value returned from the ACME server.
-                  type: string
-                type:
-                  description: |-
-                    The type of ACME challenge this resource represents.
-                    One of "HTTP-01" or "DNS-01".
-                  type: string
-                  enum:
-                    - HTTP-01
-                    - DNS-01
-                url:
-                  description: |-
-                    The URL of the ACME Challenge resource for this challenge.
-                    This can be used to lookup details about the status of this challenge.
-                  type: string
-                wildcard:
-                  description: |-
-                    wildcard will be true if this challenge is for a wildcard identifier,
-                    for example '*.example.com'.
-                  type: boolean
-            status:
-              type: object
-              properties:
-                presented:
-                  description: |-
-                    presented will be set to true if the challenge values for this challenge
-                    are currently 'presented'.
-                    This *does not* imply the self check is passing. Only that the values
-                    have been 'submitted' for the appropriate challenge mechanism (i.e. the
-                    DNS01 TXT record has been presented, or the HTTP01 configuration has been
-                    configured).
-                  type: boolean
-                processing:
-                  description: |-
-                    Used to denote whether this challenge should be processed or not.
-                    This field will only be set to true by the 'scheduling' component.
-                    It will only be set to false by the 'challenges' controller, after the
-                    challenge has reached a final state or timed out.
-                    If this field is set to false, the challenge controller will not take
-                    any more action.
-                  type: boolean
-                reason:
-                  description: |-
-                    Contains human readable information on why the Challenge is in the
-                    current state.
-                  type: string
-                state:
-                  description: |-
-                    Contains the current 'state' of the challenge.
-                    If not set, the state of the challenge is unknown.
-                  type: string
-                  enum:
-                    - valid
-                    - ready
-                    - pending
-                    - processing
-                    - invalid
-                    - expired
-                    - errored
-      served: true
-      storage: true
-      subresources:
-        status: {}
-
-# END crd {{- end }}
-
----
-# START crd {{- if or .Values.crds.enabled .Values.installCRDs }}
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: clusterissuers.cert-manager.io
-  # START annotations {{- if .Values.crds.keep }}
-  annotations:
-    helm.sh/resource-policy: keep
-  # END annotations {{- end }}
-  labels:
-    app: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/instance: '{{ .Release.Name }}'
-    # Generated labels {{- include "labels" . | nindent 4 }}
-spec:
-  group: cert-manager.io
-  names:
-    kind: ClusterIssuer
-    listKind: ClusterIssuerList
-    plural: clusterissuers
-    singular: clusterissuer
-    categories:
-      - cert-manager
-  scope: Cluster
-  versions:
-    - name: v1
-      subresources:
-        status: {}
-      additionalPrinterColumns:
-        - jsonPath: .status.conditions[?(@.type=="Ready")].status
-          name: Ready
-          type: string
-        - jsonPath: .status.conditions[?(@.type=="Ready")].message
-          name: Status
-          priority: 1
-          type: string
-        - jsonPath: .metadata.creationTimestamp
-          description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
-          name: Age
-          type: date
-      schema:
-        openAPIV3Schema:
-          description: |-
-            A ClusterIssuer represents a certificate issuing authority which can be
-            referenced as part of `issuerRef` fields.
-            It is similar to an Issuer, however it is cluster-scoped and therefore can
-            be referenced by resources that exist in *any* namespace, not just the same
-            namespace as the referent.
-          type: object
-          required:
-            - spec
-          properties:
-            apiVersion:
-              description: |-
-                APIVersion defines the versioned schema of this representation of an object.
-                Servers should convert recognized schemas to the latest internal value, and
-                may reject unrecognized values.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-              type: string
-            kind:
-              description: |-
-                Kind is a string value representing the REST resource this object represents.
-                Servers may infer this from the endpoint the client submits requests to.
-                Cannot be updated.
-                In CamelCase.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: Desired state of the ClusterIssuer resource.
-              type: object
-              properties:
-                acme:
-                  description: |-
-                    ACME configures this issuer to communicate with a RFC8555 (ACME) server
-                    to obtain signed x509 certificates.
-                  type: object
-                  required:
-                    - privateKeySecretRef
-                    - server
-                  properties:
-                    caBundle:
-                      description: |-
-                        Base64-encoded bundle of PEM CAs which can be used to validate the certificate
-                        chain presented by the ACME server.
-                        Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various
-                        kinds of security vulnerabilities.
-                        If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
-                        the container is used to validate the TLS connection.
-                      type: string
-                      format: byte
-                    disableAccountKeyGeneration:
-                      description: |-
-                        Enables or disables generating a new ACME account key.
-                        If true, the Issuer resource will *not* request a new account but will expect
-                        the account key to be supplied via an existing secret.
-                        If false, the cert-manager system will generate a new ACME account key
-                        for the Issuer.
-                        Defaults to false.
-                      type: boolean
-                    email:
-                      description: |-
-                        Email is the email address to be associated with the ACME account.
-                        This field is optional, but it is strongly recommended to be set.
-                        It will be used to contact you in case of issues with your account or
-                        certificates, including expiry notification emails.
-                        This field may be updated after the account is initially registered.
-                      type: string
-                    enableDurationFeature:
-                      description: |-
-                        Enables requesting a Not After date on certificates that matches the
-                        duration of the certificate. This is not supported by all ACME servers
-                        like Let's Encrypt. If set to true when the ACME server does not support
-                        it, it will create an error on the Order.
-                        Defaults to false.
-                      type: boolean
-                    externalAccountBinding:
-                      description: |-
-                        ExternalAccountBinding is a reference to a CA external account of the ACME
-                        server.
-                        If set, upon registration cert-manager will attempt to associate the given
-                        external account credentials with the registered ACME account.
-                      type: object
-                      required:
-                        - keyID
-                        - keySecretRef
-                      properties:
-                        keyAlgorithm:
-                          description: |-
-                            Deprecated: keyAlgorithm field exists for historical compatibility
-                            reasons and should not be used. The algorithm is now hardcoded to HS256
-                            in golang/x/crypto/acme.
-                          type: string
-                          enum:
-                            - HS256
-                            - HS384
-                            - HS512
-                        keyID:
-                          description: keyID is the ID of the CA key that the External Account is bound to.
-                          type: string
-                        keySecretRef:
-                          description: |-
-                            keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes
-                            Secret which holds the symmetric MAC key of the External Account Binding.
-                            The `key` is the index string that is paired with the key data in the
-                            Secret and should not be confused with the key data itself, or indeed with
-                            the External Account Binding keyID above.
-                            The secret key stored in the Secret **must** be un-padded, base64 URL
-                            encoded data.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                    preferredChain:
-                      description: |-
-                        PreferredChain is the chain to use if the ACME server outputs multiple.
-                        PreferredChain is no guarantee that this one gets delivered by the ACME
-                        endpoint.
-                        For example, for Let's Encrypt's DST crosssign you would use:
-                        "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
-                        This value picks the first certificate bundle in the combined set of
-                        ACME default and alternative chains that has a root-most certificate with
-                        this value as its issuer's commonname.
-                      type: string
-                      maxLength: 64
-                    privateKeySecretRef:
-                      description: |-
-                        PrivateKey is the name of a Kubernetes Secret resource that will be used to
-                        store the automatically generated ACME account private key.
-                        Optionally, a `key` may be specified to select a specific entry within
-                        the named Secret resource.
-                        If `key` is not specified, a default of `tls.key` will be used.
-                      type: object
-                      required:
-                        - name
-                      properties:
-                        key:
-                          description: |-
-                            The key of the entry in the Secret resource's `data` field to be used.
-                            Some instances of this field may be defaulted, in others it may be
-                            required.
-                          type: string
-                        name:
-                          description: |-
-                            Name of the resource being referred to.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                    server:
-                      description: |-
-                        Server is the URL used to access the ACME server's 'directory' endpoint.
-                        For example, for Let's Encrypt's staging endpoint, you would use:
-                        "https://acme-staging-v02.api.letsencrypt.org/directory".
-                        Only ACME v2 endpoints (i.e. RFC 8555) are supported.
-                      type: string
-                    skipTLSVerify:
-                      description: |-
-                        INSECURE: Enables or disables validation of the ACME server TLS certificate.
-                        If true, requests to the ACME server will not have the TLS certificate chain
-                        validated.
-                        Mutually exclusive with CABundle; prefer using CABundle to prevent various
-                        kinds of security vulnerabilities.
-                        Only enable this option in development environments.
-                        If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
-                        the container is used to validate the TLS connection.
-                        Defaults to false.
-                      type: boolean
-                    solvers:
-                      description: |-
-                        Solvers is a list of challenge solvers that will be used to solve
-                        ACME challenges for the matching domains.
-                        Solver configurations must be provided in order to obtain certificates
-                        from an ACME server.
-                        For more information, see: https://cert-manager.io/docs/configuration/acme/
-                      type: array
-                      items:
-                        description: |-
-                          An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of.
-                          A selector may be provided to use different solving strategies for different DNS names.
-                          Only one of HTTP01 or DNS01 must be provided.
-                        type: object
-                        properties:
-                          dns01:
-                            description: |-
-                              Configures cert-manager to attempt to complete authorizations by
-                              performing the DNS01 challenge flow.
-                            type: object
-                            properties:
-                              acmeDNS:
-                                description: |-
-                                  Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
-                                  DNS01 challenge records.
-                                type: object
-                                required:
-                                  - accountSecretRef
-                                  - host
-                                properties:
-                                  accountSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  host:
-                                    type: string
-                              akamai:
-                                description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - accessTokenSecretRef
-                                  - clientSecretSecretRef
-                                  - clientTokenSecretRef
-                                  - serviceConsumerDomain
-                                properties:
-                                  accessTokenSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  clientSecretSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  clientTokenSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  serviceConsumerDomain:
-                                    type: string
-                              azureDNS:
-                                description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - resourceGroupName
-                                  - subscriptionID
-                                properties:
-                                  clientID:
-                                    description: |-
-                                      Auth: Azure Service Principal:
-                                      The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
-                                      If set, ClientSecret and TenantID must also be set.
-                                    type: string
-                                  clientSecretSecretRef:
-                                    description: |-
-                                      Auth: Azure Service Principal:
-                                      A reference to a Secret containing the password associated with the Service Principal.
-                                      If set, ClientID and TenantID must also be set.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  environment:
-                                    description: name of the Azure environment (default AzurePublicCloud)
-                                    type: string
-                                    enum:
-                                      - AzurePublicCloud
-                                      - AzureChinaCloud
-                                      - AzureGermanCloud
-                                      - AzureUSGovernmentCloud
-                                  hostedZoneName:
-                                    description: name of the DNS zone that should be used
-                                    type: string
-                                  managedIdentity:
-                                    description: |-
-                                      Auth: Azure Workload Identity or Azure Managed Service Identity:
-                                      Settings to enable Azure Workload Identity or Azure Managed Service Identity
-                                      If set, ClientID, ClientSecret and TenantID must not be set.
-                                    type: object
-                                    properties:
-                                      clientID:
-                                        description: client ID of the managed identity, can not be used at the same time as resourceID
-                                        type: string
-                                      resourceID:
-                                        description: |-
-                                          resource ID of the managed identity, can not be used at the same time as clientID
-                                          Cannot be used for Azure Managed Service Identity
-                                        type: string
-                                  resourceGroupName:
-                                    description: resource group the DNS zone is located in
-                                    type: string
-                                  subscriptionID:
-                                    description: ID of the Azure subscription
-                                    type: string
-                                  tenantID:
-                                    description: |-
-                                      Auth: Azure Service Principal:
-                                      The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
-                                      If set, ClientID and ClientSecret must also be set.
-                                    type: string
-                              cloudDNS:
-                                description: Use the Google Cloud DNS API to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - project
-                                properties:
-                                  hostedZoneName:
-                                    description: |-
-                                      HostedZoneName is an optional field that tells cert-manager in which
-                                      Cloud DNS zone the challenge record has to be created.
-                                      If left empty cert-manager will automatically choose a zone.
-                                    type: string
-                                  project:
-                                    type: string
-                                  serviceAccountSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                              cloudflare:
-                                description: Use the Cloudflare API to manage DNS01 challenge records.
-                                type: object
-                                properties:
-                                  apiKeySecretRef:
-                                    description: |-
-                                      API key to use to authenticate with Cloudflare.
-                                      Note: using an API token to authenticate is now the recommended method
-                                      as it allows greater control of permissions.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  apiTokenSecretRef:
-                                    description: API token used to authenticate with Cloudflare.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  email:
-                                    description: Email of the account, only required when using API key based authentication.
-                                    type: string
-                              cnameStrategy:
-                                description: |-
-                                  CNAMEStrategy configures how the DNS01 provider should handle CNAME
-                                  records when found in DNS zones.
-                                type: string
-                                enum:
-                                  - None
-                                  - Follow
-                              digitalocean:
-                                description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - tokenSecretRef
-                                properties:
-                                  tokenSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                              rfc2136:
-                                description: |-
-                                  Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
-                                  to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - nameserver
-                                properties:
-                                  nameserver:
-                                    description: |-
-                                      The IP address or hostname of an authoritative DNS server supporting
-                                      RFC2136 in the form host:port. If the host is an IPv6 address it must be
-                                      enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
-                                      This field is required.
-                                    type: string
-                                  tsigAlgorithm:
-                                    description: |-
-                                      The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
-                                      when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
-                                      Supported values are (case-insensitive): ``HMACMD5`` (default),
-                                      ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
-                                    type: string
-                                  tsigKeyName:
-                                    description: |-
-                                      The TSIG Key name configured in the DNS.
-                                      If ``tsigSecretSecretRef`` is defined, this field is required.
-                                    type: string
-                                  tsigSecretSecretRef:
-                                    description: |-
-                                      The name of the secret containing the TSIG value.
-                                      If ``tsigKeyName`` is defined, this field is required.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                              route53:
-                                description: Use the AWS Route53 API to manage DNS01 challenge records.
-                                type: object
-                                properties:
-                                  accessKeyID:
-                                    description: |-
-                                      The AccessKeyID is used for authentication.
-                                      Cannot be set when SecretAccessKeyID is set.
-                                      If neither the Access Key nor Key ID are set, we fall-back to using env
-                                      vars, shared credentials file or AWS Instance metadata,
-                                      see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
-                                    type: string
-                                  accessKeyIDSecretRef:
-                                    description: |-
-                                      The SecretAccessKey is used for authentication. If set, pull the AWS
-                                      access key ID from a key within a Kubernetes Secret.
-                                      Cannot be set when AccessKeyID is set.
-                                      If neither the Access Key nor Key ID are set, we fall-back to using env
-                                      vars, shared credentials file or AWS Instance metadata,
-                                      see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  auth:
-                                    description: Auth configures how cert-manager authenticates.
-                                    type: object
-                                    required:
-                                      - kubernetes
-                                    properties:
-                                      kubernetes:
-                                        description: |-
-                                          Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
-                                          by passing a bound ServiceAccount token.
-                                        type: object
-                                        required:
-                                          - serviceAccountRef
-                                        properties:
-                                          serviceAccountRef:
-                                            description: |-
-                                              A reference to a service account that will be used to request a bound
-                                              token (also known as "projected token"). To use this field, you must
-                                              configure an RBAC rule to let cert-manager request a token.
-                                            type: object
-                                            required:
-                                              - name
-                                            properties:
-                                              audiences:
-                                                description: |-
-                                                  TokenAudiences is an optional list of audiences to include in the
-                                                  token passed to AWS. The default token consisting of the issuer's namespace
-                                                  and name is always included.
-                                                  If unset the audience defaults to `sts.amazonaws.com`.
-                                                type: array
-                                                items:
-                                                  type: string
-                                              name:
-                                                description: Name of the ServiceAccount used to request a token.
-                                                type: string
-                                  hostedZoneID:
-                                    description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.
-                                    type: string
-                                  region:
-                                    description: |-
-                                      Override the AWS region.
-
-                                      Route53 is a global service and does not have regional endpoints but the
-                                      region specified here (or via environment variables) is used as a hint to
-                                      help compute the correct AWS credential scope and partition when it
-                                      connects to Route53. See:
-                                      - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
-                                      - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)
-
-                                      If you omit this region field, cert-manager will use the region from
-                                      AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
-                                      in the cert-manager controller Pod.
-
-                                      The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
-                                      Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
-                                      [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
-                                      In this case this `region` field value is ignored.
-
-                                      The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
-                                      Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
-                                      [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
-                                      In this case this `region` field value is ignored.
-                                    type: string
-                                  role:
-                                    description: |-
-                                      Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
-                                      or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
-                                    type: string
-                                  secretAccessKeySecretRef:
-                                    description: |-
-                                      The SecretAccessKey is used for authentication.
-                                      If neither the Access Key nor Key ID are set, we fall-back to using env
-                                      vars, shared credentials file or AWS Instance metadata,
-                                      see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                              webhook:
-                                description: |-
-                                  Configure an external webhook based DNS01 challenge solver to manage
-                                  DNS01 challenge records.
-                                type: object
-                                required:
-                                  - groupName
-                                  - solverName
-                                properties:
-                                  config:
-                                    description: |-
-                                      Additional configuration that should be passed to the webhook apiserver
-                                      when challenges are processed.
-                                      This can contain arbitrary JSON data.
-                                      Secret values should not be specified in this stanza.
-                                      If secret values are needed (e.g. credentials for a DNS service), you
-                                      should use a SecretKeySelector to reference a Secret resource.
-                                      For details on the schema of this field, consult the webhook provider
-                                      implementation's documentation.
-                                    x-kubernetes-preserve-unknown-fields: true
-                                  groupName:
-                                    description: |-
-                                      The API group name that should be used when POSTing ChallengePayload
-                                      resources to the webhook apiserver.
-                                      This should be the same as the GroupName specified in the webhook
-                                      provider implementation.
-                                    type: string
-                                  solverName:
-                                    description: |-
-                                      The name of the solver to use, as defined in the webhook provider
-                                      implementation.
-                                      This will typically be the name of the provider, e.g. 'cloudflare'.
-                                    type: string
-                          http01:
-                            description: |-
-                              Configures cert-manager to attempt to complete authorizations by
-                              performing the HTTP01 challenge flow.
-                              It is not possible to obtain certificates for wildcard domain names
-                              (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
-                            type: object
-                            properties:
-                              gatewayHTTPRoute:
-                                description: |-
-                                  The Gateway API is a sig-network community API that models service networking
-                                  in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
-                                  create HTTPRoutes with the specified labels in the same namespace as the challenge.
-                                  This solver is experimental, and fields / behaviour may change in the future.
-                                type: object
-                                properties:
-                                  labels:
-                                    description: |-
-                                      Custom labels that will be applied to HTTPRoutes created by cert-manager
-                                      while solving HTTP-01 challenges.
-                                    type: object
-                                    additionalProperties:
-                                      type: string
-                                  parentRefs:
-                                    description: |-
-                                      When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
-                                      cert-manager needs to know which parentRefs should be used when creating
-                                      the HTTPRoute. Usually, the parentRef references a Gateway. See:
-                                      https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
-                                    type: array
-                                    items:
-                                      description: |-
-                                        ParentReference identifies an API object (usually a Gateway) that can be considered
-                                        a parent of this resource (usually a route). There are two kinds of parent resources
-                                        with "Core" support:
-
-                                        * Gateway (Gateway conformance profile)
-                                        * Service (Mesh conformance profile, ClusterIP Services only)
-
-                                        This API may be extended in the future to support additional kinds of parent
-                                        resources.
-
-                                        The API object must be valid in the cluster; the Group and Kind must
-                                        be registered in the cluster for this reference to be valid.
-                                      type: object
-                                      required:
-                                        - name
-                                      properties:
-                                        group:
-                                          description: |-
-                                            Group is the group of the referent.
-                                            When unspecified, "gateway.networking.k8s.io" is inferred.
-                                            To set the core API group (such as for a "Service" kind referent),
-                                            Group must be explicitly set to "" (empty string).
-
-                                            Support: Core
-                                          type: string
-                                          default: gateway.networking.k8s.io
-                                          maxLength: 253
-                                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                        kind:
-                                          description: |-
-                                            Kind is kind of the referent.
-
-                                            There are two kinds of parent resources with "Core" support:
-
-                                            * Gateway (Gateway conformance profile)
-                                            * Service (Mesh conformance profile, ClusterIP Services only)
-
-                                            Support for other resources is Implementation-Specific.
-                                          type: string
-                                          default: Gateway
-                                          maxLength: 63
-                                          minLength: 1
-                                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                                        name:
-                                          description: |-
-                                            Name is the name of the referent.
-
-                                            Support: Core
-                                          type: string
-                                          maxLength: 253
-                                          minLength: 1
-                                        namespace:
-                                          description: |-
-                                            Namespace is the namespace of the referent. When unspecified, this refers
-                                            to the local namespace of the Route.
-
-                                            Note that there are specific rules for ParentRefs which cross namespace
-                                            boundaries. Cross-namespace references are only valid if they are explicitly
-                                            allowed by something in the namespace they are referring to. For example:
-                                            Gateway has the AllowedRoutes field, and ReferenceGrant provides a
-                                            generic way to enable any other kind of cross-namespace reference.
-
-                                            <gateway:experimental:description>
-                                            ParentRefs from a Route to a Service in the same namespace are "producer"
-                                            routes, which apply default routing rules to inbound connections from
-                                            any namespace to the Service.
-
-                                            ParentRefs from a Route to a Service in a different namespace are
-                                            "consumer" routes, and these routing rules are only applied to outbound
-                                            connections originating from the same namespace as the Route, for which
-                                            the intended destination of the connections are a Service targeted as a
-                                            ParentRef of the Route.
-                                            </gateway:experimental:description>
-
-                                            Support: Core
-                                          type: string
-                                          maxLength: 63
-                                          minLength: 1
-                                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                                        port:
-                                          description: |-
-                                            Port is the network port this Route targets. It can be interpreted
-                                            differently based on the type of parent resource.
-
-                                            When the parent resource is a Gateway, this targets all listeners
-                                            listening on the specified port that also support this kind of Route(and
-                                            select this Route). It's not recommended to set `Port` unless the
-                                            networking behaviors specified in a Route must apply to a specific port
-                                            as opposed to a listener(s) whose port(s) may be changed. When both Port
-                                            and SectionName are specified, the name and port of the selected listener
-                                            must match both specified values.
-
-                                            <gateway:experimental:description>
-                                            When the parent resource is a Service, this targets a specific port in the
-                                            Service spec. When both Port (experimental) and SectionName are specified,
-                                            the name and port of the selected port must match both specified values.
-                                            </gateway:experimental:description>
-
-                                            Implementations MAY choose to support other parent resources.
-                                            Implementations supporting other types of parent resources MUST clearly
-                                            document how/if Port is interpreted.
-
-                                            For the purpose of status, an attachment is considered successful as
-                                            long as the parent resource accepts it partially. For example, Gateway
-                                            listeners can restrict which Routes can attach to them by Route kind,
-                                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
-                                            from the referencing Route, the Route MUST be considered successfully
-                                            attached. If no Gateway listeners accept attachment from this Route,
-                                            the Route MUST be considered detached from the Gateway.
-
-                                            Support: Extended
-                                          type: integer
-                                          format: int32
-                                          maximum: 65535
-                                          minimum: 1
-                                        sectionName:
-                                          description: |-
-                                            SectionName is the name of a section within the target resource. In the
-                                            following resources, SectionName is interpreted as the following:
-
-                                            * Gateway: Listener name. When both Port (experimental) and SectionName
-                                            are specified, the name and port of the selected listener must match
-                                            both specified values.
-                                            * Service: Port name. When both Port (experimental) and SectionName
-                                            are specified, the name and port of the selected listener must match
-                                            both specified values.
-
-                                            Implementations MAY choose to support attaching Routes to other resources.
-                                            If that is the case, they MUST clearly document how SectionName is
-                                            interpreted.
-
-                                            When unspecified (empty string), this will reference the entire resource.
-                                            For the purpose of status, an attachment is considered successful if at
-                                            least one section in the parent resource accepts it. For example, Gateway
-                                            listeners can restrict which Routes can attach to them by Route kind,
-                                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
-                                            the referencing Route, the Route MUST be considered successfully
-                                            attached. If no Gateway listeners accept attachment from this Route, the
-                                            Route MUST be considered detached from the Gateway.
-
-                                            Support: Core
-                                          type: string
-                                          maxLength: 253
-                                          minLength: 1
-                                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                  podTemplate:
-                                    description: |-
-                                      Optional pod template used to configure the ACME challenge solver pods
-                                      used for HTTP01 challenges.
-                                    type: object
-                                    properties:
-                                      metadata:
-                                        description: |-
-                                          ObjectMeta overrides for the pod used to solve HTTP01 challenges.
-                                          Only the 'labels' and 'annotations' fields may be set.
-                                          If labels or annotations overlap with in-built values, the values here
-                                          will override the in-built values.
-                                        type: object
-                                        properties:
-                                          annotations:
-                                            description: Annotations that should be added to the created ACME HTTP01 solver pods.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          labels:
-                                            description: Labels that should be added to the created ACME HTTP01 solver pods.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                      spec:
-                                        description: |-
-                                          PodSpec defines overrides for the HTTP01 challenge solver pod.
-                                          Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
-                                          All other fields will be ignored.
-                                        type: object
-                                        properties:
-                                          affinity:
-                                            description: If specified, the pod's scheduling constraints
-                                            type: object
-                                            properties:
-                                              nodeAffinity:
-                                                description: Describes node affinity scheduling rules for the pod.
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node matches the corresponding matchExpressions; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        An empty preferred scheduling term matches all objects with implicit weight 0
-                                                        (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
-                                                      type: object
-                                                      required:
-                                                        - preference
-                                                        - weight
-                                                      properties:
-                                                        preference:
-                                                          description: A node selector term, associated with the corresponding weight.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: A list of node selector requirements by node's labels.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchFields:
-                                                              description: A list of node selector requirements by node's fields.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                          x-kubernetes-map-type: atomic
-                                                        weight:
-                                                          description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to an update), the system
-                                                      may or may not try to eventually evict the pod from its node.
-                                                    type: object
-                                                    required:
-                                                      - nodeSelectorTerms
-                                                    properties:
-                                                      nodeSelectorTerms:
-                                                        description: Required. A list of node selector terms. The terms are ORed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A null or empty node selector term matches no objects. The requirements of
-                                                            them are ANDed.
-                                                            The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: A list of node selector requirements by node's labels.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchFields:
-                                                              description: A list of node selector requirements by node's fields.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                          x-kubernetes-map-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                    x-kubernetes-map-type: atomic
-                                              podAffinity:
-                                                description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                      type: object
-                                                      required:
-                                                        - podAffinityTerm
-                                                        - weight
-                                                      properties:
-                                                        podAffinityTerm:
-                                                          description: Required. A pod affinity term, associated with the corresponding weight.
-                                                          type: object
-                                                          required:
-                                                            - topologyKey
-                                                          properties:
-                                                            labelSelector:
-                                                              description: |-
-                                                                A label query over a set of resources, in this case pods.
-                                                                If it's null, this PodAffinityTerm matches with no Pods.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            matchLabelKeys:
-                                                              description: |-
-                                                                MatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            mismatchLabelKeys:
-                                                              description: |-
-                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            namespaceSelector:
-                                                              description: |-
-                                                                A label query over the set of namespaces that the term applies to.
-                                                                The term is applied to the union of the namespaces selected by this field
-                                                                and the ones listed in the namespaces field.
-                                                                null selector and null or empty namespaces list means "this pod's namespace".
-                                                                An empty selector ({}) matches all namespaces.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            namespaces:
-                                                              description: |-
-                                                                namespaces specifies a static list of namespace names that the term applies to.
-                                                                The term is applied to the union of the namespaces listed in this field
-                                                                and the ones selected by namespaceSelector.
-                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            topologyKey:
-                                                              description: |-
-                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                                whose value of the label with key topologyKey matches that of any node on which any of the
-                                                                selected pods is running.
-                                                                Empty topologyKey is not allowed.
-                                                              type: string
-                                                        weight:
-                                                          description: |-
-                                                            weight associated with matching the corresponding podAffinityTerm,
-                                                            in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to a pod label update), the
-                                                      system may or may not try to eventually evict the pod from its node.
-                                                      When there are multiple elements, the lists of nodes corresponding to each
-                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        Defines a set of pods (namely those matching the labelSelector
-                                                        relative to the given namespace(s)) that this pod should be
-                                                        co-located (affinity) or not co-located (anti-affinity) with,
-                                                        where co-located is defined as running on a node whose value of
-                                                        the label with key <topologyKey> matches that of any node on which
-                                                        a pod of the set of pods is running
-                                                      type: object
-                                                      required:
-                                                        - topologyKey
-                                                      properties:
-                                                        labelSelector:
-                                                          description: |-
-                                                            A label query over a set of resources, in this case pods.
-                                                            If it's null, this PodAffinityTerm matches with no Pods.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        matchLabelKeys:
-                                                          description: |-
-                                                            MatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        mismatchLabelKeys:
-                                                          description: |-
-                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        namespaceSelector:
-                                                          description: |-
-                                                            A label query over the set of namespaces that the term applies to.
-                                                            The term is applied to the union of the namespaces selected by this field
-                                                            and the ones listed in the namespaces field.
-                                                            null selector and null or empty namespaces list means "this pod's namespace".
-                                                            An empty selector ({}) matches all namespaces.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        namespaces:
-                                                          description: |-
-                                                            namespaces specifies a static list of namespace names that the term applies to.
-                                                            The term is applied to the union of the namespaces listed in this field
-                                                            and the ones selected by namespaceSelector.
-                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        topologyKey:
-                                                          description: |-
-                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                            whose value of the label with key topologyKey matches that of any node on which any of the
-                                                            selected pods is running.
-                                                            Empty topologyKey is not allowed.
-                                                          type: string
-                                                    x-kubernetes-list-type: atomic
-                                              podAntiAffinity:
-                                                description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the anti-affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                      type: object
-                                                      required:
-                                                        - podAffinityTerm
-                                                        - weight
-                                                      properties:
-                                                        podAffinityTerm:
-                                                          description: Required. A pod affinity term, associated with the corresponding weight.
-                                                          type: object
-                                                          required:
-                                                            - topologyKey
-                                                          properties:
-                                                            labelSelector:
-                                                              description: |-
-                                                                A label query over a set of resources, in this case pods.
-                                                                If it's null, this PodAffinityTerm matches with no Pods.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            matchLabelKeys:
-                                                              description: |-
-                                                                MatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            mismatchLabelKeys:
-                                                              description: |-
-                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            namespaceSelector:
-                                                              description: |-
-                                                                A label query over the set of namespaces that the term applies to.
-                                                                The term is applied to the union of the namespaces selected by this field
-                                                                and the ones listed in the namespaces field.
-                                                                null selector and null or empty namespaces list means "this pod's namespace".
-                                                                An empty selector ({}) matches all namespaces.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            namespaces:
-                                                              description: |-
-                                                                namespaces specifies a static list of namespace names that the term applies to.
-                                                                The term is applied to the union of the namespaces listed in this field
-                                                                and the ones selected by namespaceSelector.
-                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            topologyKey:
-                                                              description: |-
-                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                                whose value of the label with key topologyKey matches that of any node on which any of the
-                                                                selected pods is running.
-                                                                Empty topologyKey is not allowed.
-                                                              type: string
-                                                        weight:
-                                                          description: |-
-                                                            weight associated with matching the corresponding podAffinityTerm,
-                                                            in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the anti-affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the anti-affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to a pod label update), the
-                                                      system may or may not try to eventually evict the pod from its node.
-                                                      When there are multiple elements, the lists of nodes corresponding to each
-                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        Defines a set of pods (namely those matching the labelSelector
-                                                        relative to the given namespace(s)) that this pod should be
-                                                        co-located (affinity) or not co-located (anti-affinity) with,
-                                                        where co-located is defined as running on a node whose value of
-                                                        the label with key <topologyKey> matches that of any node on which
-                                                        a pod of the set of pods is running
-                                                      type: object
-                                                      required:
-                                                        - topologyKey
-                                                      properties:
-                                                        labelSelector:
-                                                          description: |-
-                                                            A label query over a set of resources, in this case pods.
-                                                            If it's null, this PodAffinityTerm matches with no Pods.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        matchLabelKeys:
-                                                          description: |-
-                                                            MatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        mismatchLabelKeys:
-                                                          description: |-
-                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        namespaceSelector:
-                                                          description: |-
-                                                            A label query over the set of namespaces that the term applies to.
-                                                            The term is applied to the union of the namespaces selected by this field
-                                                            and the ones listed in the namespaces field.
-                                                            null selector and null or empty namespaces list means "this pod's namespace".
-                                                            An empty selector ({}) matches all namespaces.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        namespaces:
-                                                          description: |-
-                                                            namespaces specifies a static list of namespace names that the term applies to.
-                                                            The term is applied to the union of the namespaces listed in this field
-                                                            and the ones selected by namespaceSelector.
-                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        topologyKey:
-                                                          description: |-
-                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                            whose value of the label with key topologyKey matches that of any node on which any of the
-                                                            selected pods is running.
-                                                            Empty topologyKey is not allowed.
-                                                          type: string
-                                                    x-kubernetes-list-type: atomic
-                                          imagePullSecrets:
-                                            description: If specified, the pod's imagePullSecrets
-                                            type: array
-                                            items:
-                                              description: |-
-                                                LocalObjectReference contains enough information to let you locate the
-                                                referenced object inside the same namespace.
-                                              type: object
-                                              properties:
-                                                name:
-                                                  description: |-
-                                                    Name of the referent.
-                                                    This field is effectively required, but due to backwards compatibility is
-                                                    allowed to be empty. Instances of this type with an empty value here are
-                                                    almost certainly wrong.
-                                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                                  type: string
-                                                  default: ""
-                                              x-kubernetes-map-type: atomic
-                                          nodeSelector:
-                                            description: |-
-                                              NodeSelector is a selector which must be true for the pod to fit on a node.
-                                              Selector which must match a node's labels for the pod to be scheduled on that node.
-                                              More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          priorityClassName:
-                                            description: If specified, the pod's priorityClassName.
-                                            type: string
-                                          securityContext:
-                                            description: If specified, the pod's security context
-                                            type: object
-                                            properties:
-                                              fsGroup:
-                                                description: |-
-                                                  A special supplemental group that applies to all containers in a pod.
-                                                  Some volume types allow the Kubelet to change the ownership of that volume
-                                                  to be owned by the pod:
-
-                                                  1. The owning GID will be the FSGroup
-                                                  2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
-                                                  3. The permission bits are OR'd with rw-rw----
-
-                                                  If unset, the Kubelet will not modify the ownership and permissions of any volume.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              fsGroupChangePolicy:
-                                                description: |-
-                                                  fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
-                                                  before being exposed inside Pod. This field will only apply to
-                                                  volume types which support fsGroup based ownership(and permissions).
-                                                  It will have no effect on ephemeral volume types such as: secret, configmaps
-                                                  and emptydir.
-                                                  Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: string
-                                              runAsGroup:
-                                                description: |-
-                                                  The GID to run the entrypoint of the container process.
-                                                  Uses runtime default if unset.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
-                                                  for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              runAsNonRoot:
-                                                description: |-
-                                                  Indicates that the container must run as a non-root user.
-                                                  If true, the Kubelet will validate the image at runtime to ensure that it
-                                                  does not run as UID 0 (root) and fail to start the container if it does.
-                                                  If unset or false, no such validation will be performed.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
-                                                type: boolean
-                                              runAsUser:
-                                                description: |-
-                                                  The UID to run the entrypoint of the container process.
-                                                  Defaults to user specified in image metadata if unspecified.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
-                                                  for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              seLinuxOptions:
-                                                description: |-
-                                                  The SELinux context to be applied to all containers.
-                                                  If unspecified, the container runtime will allocate a random SELinux context for each
-                                                  container.  May also be set in SecurityContext.  If set in
-                                                  both SecurityContext and PodSecurityContext, the value specified in SecurityContext
-                                                  takes precedence for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: object
-                                                properties:
-                                                  level:
-                                                    description: Level is SELinux level label that applies to the container.
-                                                    type: string
-                                                  role:
-                                                    description: Role is a SELinux role label that applies to the container.
-                                                    type: string
-                                                  type:
-                                                    description: Type is a SELinux type label that applies to the container.
-                                                    type: string
-                                                  user:
-                                                    description: User is a SELinux user label that applies to the container.
-                                                    type: string
-                                              seccompProfile:
-                                                description: |-
-                                                  The seccomp options to use by the containers in this pod.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: object
-                                                required:
-                                                  - type
-                                                properties:
-                                                  localhostProfile:
-                                                    description: |-
-                                                      localhostProfile indicates a profile defined in a file on the node should be used.
-                                                      The profile must be preconfigured on the node to work.
-                                                      Must be a descending path, relative to the kubelet's configured seccomp profile location.
-                                                      Must be set if type is "Localhost". Must NOT be set for any other type.
-                                                    type: string
-                                                  type:
-                                                    description: |-
-                                                      type indicates which kind of seccomp profile will be applied.
-                                                      Valid options are:
-
-                                                      Localhost - a profile defined in a file on the node should be used.
-                                                      RuntimeDefault - the container runtime default profile should be used.
-                                                      Unconfined - no profile should be applied.
-                                                    type: string
-                                              supplementalGroups:
-                                                description: |-
-                                                  A list of groups applied to the first process run in each container, in addition
-                                                  to the container's primary GID, the fsGroup (if specified), and group memberships
-                                                  defined in the container image for the uid of the container process. If unspecified,
-                                                  no additional groups are added to any container. Note that group memberships
-                                                  defined in the container image for the uid of the container process are still effective,
-                                                  even if they are not included in this list.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: array
-                                                items:
-                                                  type: integer
-                                                  format: int64
-                                              sysctls:
-                                                description: |-
-                                                  Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
-                                                  sysctls (by the container runtime) might fail to launch.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: array
-                                                items:
-                                                  description: Sysctl defines a kernel parameter to be set
-                                                  type: object
-                                                  required:
-                                                    - name
-                                                    - value
-                                                  properties:
-                                                    name:
-                                                      description: Name of a property to set
-                                                      type: string
-                                                    value:
-                                                      description: Value of a property to set
-                                                      type: string
-                                          serviceAccountName:
-                                            description: If specified, the pod's service account
-                                            type: string
-                                          tolerations:
-                                            description: If specified, the pod's tolerations.
-                                            type: array
-                                            items:
-                                              description: |-
-                                                The pod this Toleration is attached to tolerates any taint that matches
-                                                the triple <key,value,effect> using the matching operator <operator>.
-                                              type: object
-                                              properties:
-                                                effect:
-                                                  description: |-
-                                                    Effect indicates the taint effect to match. Empty means match all taint effects.
-                                                    When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                                                  type: string
-                                                key:
-                                                  description: |-
-                                                    Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                                                    If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                                                  type: string
-                                                operator:
-                                                  description: |-
-                                                    Operator represents a key's relationship to the value.
-                                                    Valid operators are Exists and Equal. Defaults to Equal.
-                                                    Exists is equivalent to wildcard for value, so that a pod can
-                                                    tolerate all taints of a particular category.
-                                                  type: string
-                                                tolerationSeconds:
-                                                  description: |-
-                                                    TolerationSeconds represents the period of time the toleration (which must be
-                                                    of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                                                    it is not set, which means tolerate the taint forever (do not evict). Zero and
-                                                    negative values will be treated as 0 (evict immediately) by the system.
-                                                  type: integer
-                                                  format: int64
-                                                value:
-                                                  description: |-
-                                                    Value is the taint value the toleration matches to.
-                                                    If the operator is Exists, the value should be empty, otherwise just a regular string.
-                                                  type: string
-                                  serviceType:
-                                    description: |-
-                                      Optional service type for Kubernetes solver service. Supported values
-                                      are NodePort or ClusterIP. If unset, defaults to NodePort.
-                                    type: string
-                              ingress:
-                                description: |-
-                                  The ingress based HTTP01 challenge solver will solve challenges by
-                                  creating or modifying Ingress resources in order to route requests for
-                                  '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
-                                  provisioned by cert-manager for each Challenge to be completed.
-                                type: object
-                                properties:
-                                  class:
-                                    description: |-
-                                      This field configures the annotation `kubernetes.io/ingress.class` when
-                                      creating Ingress resources to solve ACME challenges that use this
-                                      challenge solver. Only one of `class`, `name` or `ingressClassName` may
-                                      be specified.
-                                    type: string
-                                  ingressClassName:
-                                    description: |-
-                                      This field configures the field `ingressClassName` on the created Ingress
-                                      resources used to solve ACME challenges that use this challenge solver.
-                                      This is the recommended way of configuring the ingress class. Only one of
-                                      `class`, `name` or `ingressClassName` may be specified.
-                                    type: string
-                                  ingressTemplate:
-                                    description: |-
-                                      Optional ingress template used to configure the ACME challenge solver
-                                      ingress used for HTTP01 challenges.
-                                    type: object
-                                    properties:
-                                      metadata:
-                                        description: |-
-                                          ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
-                                          Only the 'labels' and 'annotations' fields may be set.
-                                          If labels or annotations overlap with in-built values, the values here
-                                          will override the in-built values.
-                                        type: object
-                                        properties:
-                                          annotations:
-                                            description: Annotations that should be added to the created ACME HTTP01 solver ingress.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          labels:
-                                            description: Labels that should be added to the created ACME HTTP01 solver ingress.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                  name:
-                                    description: |-
-                                      The name of the ingress resource that should have ACME challenge solving
-                                      routes inserted into it in order to solve HTTP01 challenges.
-                                      This is typically used in conjunction with ingress controllers like
-                                      ingress-gce, which maintains a 1:1 mapping between external IPs and
-                                      ingress resources. Only one of `class`, `name` or `ingressClassName` may
-                                      be specified.
-                                    type: string
-                                  podTemplate:
-                                    description: |-
-                                      Optional pod template used to configure the ACME challenge solver pods
-                                      used for HTTP01 challenges.
-                                    type: object
-                                    properties:
-                                      metadata:
-                                        description: |-
-                                          ObjectMeta overrides for the pod used to solve HTTP01 challenges.
-                                          Only the 'labels' and 'annotations' fields may be set.
-                                          If labels or annotations overlap with in-built values, the values here
-                                          will override the in-built values.
-                                        type: object
-                                        properties:
-                                          annotations:
-                                            description: Annotations that should be added to the created ACME HTTP01 solver pods.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          labels:
-                                            description: Labels that should be added to the created ACME HTTP01 solver pods.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                      spec:
-                                        description: |-
-                                          PodSpec defines overrides for the HTTP01 challenge solver pod.
-                                          Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
-                                          All other fields will be ignored.
-                                        type: object
-                                        properties:
-                                          affinity:
-                                            description: If specified, the pod's scheduling constraints
-                                            type: object
-                                            properties:
-                                              nodeAffinity:
-                                                description: Describes node affinity scheduling rules for the pod.
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node matches the corresponding matchExpressions; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        An empty preferred scheduling term matches all objects with implicit weight 0
-                                                        (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
-                                                      type: object
-                                                      required:
-                                                        - preference
-                                                        - weight
-                                                      properties:
-                                                        preference:
-                                                          description: A node selector term, associated with the corresponding weight.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: A list of node selector requirements by node's labels.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchFields:
-                                                              description: A list of node selector requirements by node's fields.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                          x-kubernetes-map-type: atomic
-                                                        weight:
-                                                          description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to an update), the system
-                                                      may or may not try to eventually evict the pod from its node.
-                                                    type: object
-                                                    required:
-                                                      - nodeSelectorTerms
-                                                    properties:
-                                                      nodeSelectorTerms:
-                                                        description: Required. A list of node selector terms. The terms are ORed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A null or empty node selector term matches no objects. The requirements of
-                                                            them are ANDed.
-                                                            The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: A list of node selector requirements by node's labels.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchFields:
-                                                              description: A list of node selector requirements by node's fields.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                          x-kubernetes-map-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                    x-kubernetes-map-type: atomic
-                                              podAffinity:
-                                                description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                      type: object
-                                                      required:
-                                                        - podAffinityTerm
-                                                        - weight
-                                                      properties:
-                                                        podAffinityTerm:
-                                                          description: Required. A pod affinity term, associated with the corresponding weight.
-                                                          type: object
-                                                          required:
-                                                            - topologyKey
-                                                          properties:
-                                                            labelSelector:
-                                                              description: |-
-                                                                A label query over a set of resources, in this case pods.
-                                                                If it's null, this PodAffinityTerm matches with no Pods.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            matchLabelKeys:
-                                                              description: |-
-                                                                MatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            mismatchLabelKeys:
-                                                              description: |-
-                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            namespaceSelector:
-                                                              description: |-
-                                                                A label query over the set of namespaces that the term applies to.
-                                                                The term is applied to the union of the namespaces selected by this field
-                                                                and the ones listed in the namespaces field.
-                                                                null selector and null or empty namespaces list means "this pod's namespace".
-                                                                An empty selector ({}) matches all namespaces.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            namespaces:
-                                                              description: |-
-                                                                namespaces specifies a static list of namespace names that the term applies to.
-                                                                The term is applied to the union of the namespaces listed in this field
-                                                                and the ones selected by namespaceSelector.
-                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            topologyKey:
-                                                              description: |-
-                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                                whose value of the label with key topologyKey matches that of any node on which any of the
-                                                                selected pods is running.
-                                                                Empty topologyKey is not allowed.
-                                                              type: string
-                                                        weight:
-                                                          description: |-
-                                                            weight associated with matching the corresponding podAffinityTerm,
-                                                            in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to a pod label update), the
-                                                      system may or may not try to eventually evict the pod from its node.
-                                                      When there are multiple elements, the lists of nodes corresponding to each
-                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        Defines a set of pods (namely those matching the labelSelector
-                                                        relative to the given namespace(s)) that this pod should be
-                                                        co-located (affinity) or not co-located (anti-affinity) with,
-                                                        where co-located is defined as running on a node whose value of
-                                                        the label with key <topologyKey> matches that of any node on which
-                                                        a pod of the set of pods is running
-                                                      type: object
-                                                      required:
-                                                        - topologyKey
-                                                      properties:
-                                                        labelSelector:
-                                                          description: |-
-                                                            A label query over a set of resources, in this case pods.
-                                                            If it's null, this PodAffinityTerm matches with no Pods.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        matchLabelKeys:
-                                                          description: |-
-                                                            MatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        mismatchLabelKeys:
-                                                          description: |-
-                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        namespaceSelector:
-                                                          description: |-
-                                                            A label query over the set of namespaces that the term applies to.
-                                                            The term is applied to the union of the namespaces selected by this field
-                                                            and the ones listed in the namespaces field.
-                                                            null selector and null or empty namespaces list means "this pod's namespace".
-                                                            An empty selector ({}) matches all namespaces.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        namespaces:
-                                                          description: |-
-                                                            namespaces specifies a static list of namespace names that the term applies to.
-                                                            The term is applied to the union of the namespaces listed in this field
-                                                            and the ones selected by namespaceSelector.
-                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        topologyKey:
-                                                          description: |-
-                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                            whose value of the label with key topologyKey matches that of any node on which any of the
-                                                            selected pods is running.
-                                                            Empty topologyKey is not allowed.
-                                                          type: string
-                                                    x-kubernetes-list-type: atomic
-                                              podAntiAffinity:
-                                                description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the anti-affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                      type: object
-                                                      required:
-                                                        - podAffinityTerm
-                                                        - weight
-                                                      properties:
-                                                        podAffinityTerm:
-                                                          description: Required. A pod affinity term, associated with the corresponding weight.
-                                                          type: object
-                                                          required:
-                                                            - topologyKey
-                                                          properties:
-                                                            labelSelector:
-                                                              description: |-
-                                                                A label query over a set of resources, in this case pods.
-                                                                If it's null, this PodAffinityTerm matches with no Pods.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            matchLabelKeys:
-                                                              description: |-
-                                                                MatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            mismatchLabelKeys:
-                                                              description: |-
-                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            namespaceSelector:
-                                                              description: |-
-                                                                A label query over the set of namespaces that the term applies to.
-                                                                The term is applied to the union of the namespaces selected by this field
-                                                                and the ones listed in the namespaces field.
-                                                                null selector and null or empty namespaces list means "this pod's namespace".
-                                                                An empty selector ({}) matches all namespaces.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            namespaces:
-                                                              description: |-
-                                                                namespaces specifies a static list of namespace names that the term applies to.
-                                                                The term is applied to the union of the namespaces listed in this field
-                                                                and the ones selected by namespaceSelector.
-                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            topologyKey:
-                                                              description: |-
-                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                                whose value of the label with key topologyKey matches that of any node on which any of the
-                                                                selected pods is running.
-                                                                Empty topologyKey is not allowed.
-                                                              type: string
-                                                        weight:
-                                                          description: |-
-                                                            weight associated with matching the corresponding podAffinityTerm,
-                                                            in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the anti-affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the anti-affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to a pod label update), the
-                                                      system may or may not try to eventually evict the pod from its node.
-                                                      When there are multiple elements, the lists of nodes corresponding to each
-                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        Defines a set of pods (namely those matching the labelSelector
-                                                        relative to the given namespace(s)) that this pod should be
-                                                        co-located (affinity) or not co-located (anti-affinity) with,
-                                                        where co-located is defined as running on a node whose value of
-                                                        the label with key <topologyKey> matches that of any node on which
-                                                        a pod of the set of pods is running
-                                                      type: object
-                                                      required:
-                                                        - topologyKey
-                                                      properties:
-                                                        labelSelector:
-                                                          description: |-
-                                                            A label query over a set of resources, in this case pods.
-                                                            If it's null, this PodAffinityTerm matches with no Pods.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        matchLabelKeys:
-                                                          description: |-
-                                                            MatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        mismatchLabelKeys:
-                                                          description: |-
-                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        namespaceSelector:
-                                                          description: |-
-                                                            A label query over the set of namespaces that the term applies to.
-                                                            The term is applied to the union of the namespaces selected by this field
-                                                            and the ones listed in the namespaces field.
-                                                            null selector and null or empty namespaces list means "this pod's namespace".
-                                                            An empty selector ({}) matches all namespaces.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        namespaces:
-                                                          description: |-
-                                                            namespaces specifies a static list of namespace names that the term applies to.
-                                                            The term is applied to the union of the namespaces listed in this field
-                                                            and the ones selected by namespaceSelector.
-                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        topologyKey:
-                                                          description: |-
-                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                            whose value of the label with key topologyKey matches that of any node on which any of the
-                                                            selected pods is running.
-                                                            Empty topologyKey is not allowed.
-                                                          type: string
-                                                    x-kubernetes-list-type: atomic
-                                          imagePullSecrets:
-                                            description: If specified, the pod's imagePullSecrets
-                                            type: array
-                                            items:
-                                              description: |-
-                                                LocalObjectReference contains enough information to let you locate the
-                                                referenced object inside the same namespace.
-                                              type: object
-                                              properties:
-                                                name:
-                                                  description: |-
-                                                    Name of the referent.
-                                                    This field is effectively required, but due to backwards compatibility is
-                                                    allowed to be empty. Instances of this type with an empty value here are
-                                                    almost certainly wrong.
-                                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                                  type: string
-                                                  default: ""
-                                              x-kubernetes-map-type: atomic
-                                          nodeSelector:
-                                            description: |-
-                                              NodeSelector is a selector which must be true for the pod to fit on a node.
-                                              Selector which must match a node's labels for the pod to be scheduled on that node.
-                                              More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          priorityClassName:
-                                            description: If specified, the pod's priorityClassName.
-                                            type: string
-                                          securityContext:
-                                            description: If specified, the pod's security context
-                                            type: object
-                                            properties:
-                                              fsGroup:
-                                                description: |-
-                                                  A special supplemental group that applies to all containers in a pod.
-                                                  Some volume types allow the Kubelet to change the ownership of that volume
-                                                  to be owned by the pod:
-
-                                                  1. The owning GID will be the FSGroup
-                                                  2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
-                                                  3. The permission bits are OR'd with rw-rw----
-
-                                                  If unset, the Kubelet will not modify the ownership and permissions of any volume.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              fsGroupChangePolicy:
-                                                description: |-
-                                                  fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
-                                                  before being exposed inside Pod. This field will only apply to
-                                                  volume types which support fsGroup based ownership(and permissions).
-                                                  It will have no effect on ephemeral volume types such as: secret, configmaps
-                                                  and emptydir.
-                                                  Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: string
-                                              runAsGroup:
-                                                description: |-
-                                                  The GID to run the entrypoint of the container process.
-                                                  Uses runtime default if unset.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
-                                                  for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              runAsNonRoot:
-                                                description: |-
-                                                  Indicates that the container must run as a non-root user.
-                                                  If true, the Kubelet will validate the image at runtime to ensure that it
-                                                  does not run as UID 0 (root) and fail to start the container if it does.
-                                                  If unset or false, no such validation will be performed.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
-                                                type: boolean
-                                              runAsUser:
-                                                description: |-
-                                                  The UID to run the entrypoint of the container process.
-                                                  Defaults to user specified in image metadata if unspecified.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
-                                                  for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              seLinuxOptions:
-                                                description: |-
-                                                  The SELinux context to be applied to all containers.
-                                                  If unspecified, the container runtime will allocate a random SELinux context for each
-                                                  container.  May also be set in SecurityContext.  If set in
-                                                  both SecurityContext and PodSecurityContext, the value specified in SecurityContext
-                                                  takes precedence for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: object
-                                                properties:
-                                                  level:
-                                                    description: Level is SELinux level label that applies to the container.
-                                                    type: string
-                                                  role:
-                                                    description: Role is a SELinux role label that applies to the container.
-                                                    type: string
-                                                  type:
-                                                    description: Type is a SELinux type label that applies to the container.
-                                                    type: string
-                                                  user:
-                                                    description: User is a SELinux user label that applies to the container.
-                                                    type: string
-                                              seccompProfile:
-                                                description: |-
-                                                  The seccomp options to use by the containers in this pod.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: object
-                                                required:
-                                                  - type
-                                                properties:
-                                                  localhostProfile:
-                                                    description: |-
-                                                      localhostProfile indicates a profile defined in a file on the node should be used.
-                                                      The profile must be preconfigured on the node to work.
-                                                      Must be a descending path, relative to the kubelet's configured seccomp profile location.
-                                                      Must be set if type is "Localhost". Must NOT be set for any other type.
-                                                    type: string
-                                                  type:
-                                                    description: |-
-                                                      type indicates which kind of seccomp profile will be applied.
-                                                      Valid options are:
-
-                                                      Localhost - a profile defined in a file on the node should be used.
-                                                      RuntimeDefault - the container runtime default profile should be used.
-                                                      Unconfined - no profile should be applied.
-                                                    type: string
-                                              supplementalGroups:
-                                                description: |-
-                                                  A list of groups applied to the first process run in each container, in addition
-                                                  to the container's primary GID, the fsGroup (if specified), and group memberships
-                                                  defined in the container image for the uid of the container process. If unspecified,
-                                                  no additional groups are added to any container. Note that group memberships
-                                                  defined in the container image for the uid of the container process are still effective,
-                                                  even if they are not included in this list.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: array
-                                                items:
-                                                  type: integer
-                                                  format: int64
-                                              sysctls:
-                                                description: |-
-                                                  Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
-                                                  sysctls (by the container runtime) might fail to launch.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: array
-                                                items:
-                                                  description: Sysctl defines a kernel parameter to be set
-                                                  type: object
-                                                  required:
-                                                    - name
-                                                    - value
-                                                  properties:
-                                                    name:
-                                                      description: Name of a property to set
-                                                      type: string
-                                                    value:
-                                                      description: Value of a property to set
-                                                      type: string
-                                          serviceAccountName:
-                                            description: If specified, the pod's service account
-                                            type: string
-                                          tolerations:
-                                            description: If specified, the pod's tolerations.
-                                            type: array
-                                            items:
-                                              description: |-
-                                                The pod this Toleration is attached to tolerates any taint that matches
-                                                the triple <key,value,effect> using the matching operator <operator>.
-                                              type: object
-                                              properties:
-                                                effect:
-                                                  description: |-
-                                                    Effect indicates the taint effect to match. Empty means match all taint effects.
-                                                    When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                                                  type: string
-                                                key:
-                                                  description: |-
-                                                    Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                                                    If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                                                  type: string
-                                                operator:
-                                                  description: |-
-                                                    Operator represents a key's relationship to the value.
-                                                    Valid operators are Exists and Equal. Defaults to Equal.
-                                                    Exists is equivalent to wildcard for value, so that a pod can
-                                                    tolerate all taints of a particular category.
-                                                  type: string
-                                                tolerationSeconds:
-                                                  description: |-
-                                                    TolerationSeconds represents the period of time the toleration (which must be
-                                                    of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                                                    it is not set, which means tolerate the taint forever (do not evict). Zero and
-                                                    negative values will be treated as 0 (evict immediately) by the system.
-                                                  type: integer
-                                                  format: int64
-                                                value:
-                                                  description: |-
-                                                    Value is the taint value the toleration matches to.
-                                                    If the operator is Exists, the value should be empty, otherwise just a regular string.
-                                                  type: string
-                                  serviceType:
-                                    description: |-
-                                      Optional service type for Kubernetes solver service. Supported values
-                                      are NodePort or ClusterIP. If unset, defaults to NodePort.
-                                    type: string
-                          selector:
-                            description: |-
-                              Selector selects a set of DNSNames on the Certificate resource that
-                              should be solved using this challenge solver.
-                              If not specified, the solver will be treated as the 'default' solver
-                              with the lowest priority, i.e. if any other solver has a more specific
-                              match, it will be used instead.
-                            type: object
-                            properties:
-                              dnsNames:
-                                description: |-
-                                  List of DNSNames that this solver will be used to solve.
-                                  If specified and a match is found, a dnsNames selector will take
-                                  precedence over a dnsZones selector.
-                                  If multiple solvers match with the same dnsNames value, the solver
-                                  with the most matching labels in matchLabels will be selected.
-                                  If neither has more matches, the solver defined earlier in the list
-                                  will be selected.
-                                type: array
-                                items:
-                                  type: string
-                              dnsZones:
-                                description: |-
-                                  List of DNSZones that this solver will be used to solve.
-                                  The most specific DNS zone match specified here will take precedence
-                                  over other DNS zone matches, so a solver specifying sys.example.com
-                                  will be selected over one specifying example.com for the domain
-                                  www.sys.example.com.
-                                  If multiple solvers match with the same dnsZones value, the solver
-                                  with the most matching labels in matchLabels will be selected.
-                                  If neither has more matches, the solver defined earlier in the list
-                                  will be selected.
-                                type: array
-                                items:
-                                  type: string
-                              matchLabels:
-                                description: |-
-                                  A label selector that is used to refine the set of certificate's that
-                                  this challenge solver will apply to.
-                                type: object
-                                additionalProperties:
-                                  type: string
-                ca:
-                  description: |-
-                    CA configures this issuer to sign certificates using a signing CA keypair
-                    stored in a Secret resource.
-                    This is used to build internal PKIs that are managed by cert-manager.
-                  type: object
-                  required:
-                    - secretName
-                  properties:
-                    crlDistributionPoints:
-                      description: |-
-                        The CRL distribution points is an X.509 v3 certificate extension which identifies
-                        the location of the CRL from which the revocation of this certificate can be checked.
-                        If not set, certificates will be issued without distribution points set.
-                      type: array
-                      items:
-                        type: string
-                    issuingCertificateURLs:
-                      description: |-
-                        IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates
-                        it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.
-                        As an example, such a URL might be "http://ca.domain.com/ca.crt".
-                      type: array
-                      items:
-                        type: string
-                    ocspServers:
-                      description: |-
-                        The OCSP server list is an X.509 v3 extension that defines a list of
-                        URLs of OCSP responders. The OCSP responders can be queried for the
-                        revocation status of an issued certificate. If not set, the
-                        certificate will be issued with no OCSP servers set. For example, an
-                        OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
-                      type: array
-                      items:
-                        type: string
-                    secretName:
-                      description: |-
-                        SecretName is the name of the secret used to sign Certificates issued
-                        by this Issuer.
-                      type: string
-                selfSigned:
-                  description: |-
-                    SelfSigned configures this issuer to 'self sign' certificates using the
-                    private key used to create the CertificateRequest object.
-                  type: object
-                  properties:
-                    crlDistributionPoints:
-                      description: |-
-                        The CRL distribution points is an X.509 v3 certificate extension which identifies
-                        the location of the CRL from which the revocation of this certificate can be checked.
-                        If not set certificate will be issued without CDP. Values are strings.
-                      type: array
-                      items:
-                        type: string
-                vault:
-                  description: |-
-                    Vault configures this issuer to sign certificates using a HashiCorp Vault
-                    PKI backend.
-                  type: object
-                  required:
-                    - auth
-                    - path
-                    - server
-                  properties:
-                    auth:
-                      description: Auth configures how cert-manager authenticates with the Vault server.
-                      type: object
-                      properties:
-                        appRole:
-                          description: |-
-                            AppRole authenticates with Vault using the App Role auth mechanism,
-                            with the role and secret stored in a Kubernetes Secret resource.
-                          type: object
-                          required:
-                            - path
-                            - roleId
-                            - secretRef
-                          properties:
-                            path:
-                              description: |-
-                                Path where the App Role authentication backend is mounted in Vault, e.g:
-                                "approle"
-                              type: string
-                            roleId:
-                              description: |-
-                                RoleID configured in the App Role authentication backend when setting
-                                up the authentication backend in Vault.
-                              type: string
-                            secretRef:
-                              description: |-
-                                Reference to a key in a Secret that contains the App Role secret used
-                                to authenticate with Vault.
-                                The `key` field must be specified and denotes which entry within the Secret
-                                resource is used as the app role secret.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                        clientCertificate:
-                          description: |-
-                            ClientCertificate authenticates with Vault by presenting a client
-                            certificate during the request's TLS handshake.
-                            Works only when using HTTPS protocol.
-                          type: object
-                          properties:
-                            mountPath:
-                              description: |-
-                                The Vault mountPath here is the mount path to use when authenticating with
-                                Vault. For example, setting a value to `/v1/auth/foo`, will use the path
-                                `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
-                                default value "/v1/auth/cert" will be used.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the certificate role to authenticate against.
-                                If not set, matching any certificate role, if available.
-                              type: string
-                            secretName:
-                              description: |-
-                                Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing
-                                tls.crt and tls.key) used to authenticate to Vault using TLS client
-                                authentication.
-                              type: string
-                        kubernetes:
-                          description: |-
-                            Kubernetes authenticates with Vault by passing the ServiceAccount
-                            token stored in the named Secret resource to the Vault server.
-                          type: object
-                          required:
-                            - role
-                          properties:
-                            mountPath:
-                              description: |-
-                                The Vault mountPath here is the mount path to use when authenticating with
-                                Vault. For example, setting a value to `/v1/auth/foo`, will use the path
-                                `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
-                                default value "/v1/auth/kubernetes" will be used.
-                              type: string
-                            role:
-                              description: |-
-                                A required field containing the Vault Role to assume. A Role binds a
-                                Kubernetes ServiceAccount with a set of Vault policies.
-                              type: string
-                            secretRef:
-                              description: |-
-                                The required Secret field containing a Kubernetes ServiceAccount JWT used
-                                for authenticating with Vault. Use of 'ambient credentials' is not
-                                supported.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            serviceAccountRef:
-                              description: |-
-                                A reference to a service account that will be used to request a bound
-                                token (also known as "projected token"). Compared to using "secretRef",
-                                using this field means that you don't rely on statically bound tokens. To
-                                use this field, you must configure an RBAC rule to let cert-manager
-                                request a token.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                audiences:
-                                  description: |-
-                                    TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token
-                                    consisting of the issuer's namespace and name is always included.
-                                  type: array
-                                  items:
-                                    type: string
-                                name:
-                                  description: Name of the ServiceAccount used to request a token.
-                                  type: string
-                        tokenSecretRef:
-                          description: TokenSecretRef authenticates with Vault by presenting a token.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                    caBundle:
-                      description: |-
-                        Base64-encoded bundle of PEM CAs which will be used to validate the certificate
-                        chain presented by Vault. Only used if using HTTPS to connect to Vault and
-                        ignored for HTTP connections.
-                        Mutually exclusive with CABundleSecretRef.
-                        If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
-                        the cert-manager controller container is used to validate the TLS connection.
-                      type: string
-                      format: byte
-                    caBundleSecretRef:
-                      description: |-
-                        Reference to a Secret containing a bundle of PEM-encoded CAs to use when
-                        verifying the certificate chain presented by Vault when using HTTPS.
-                        Mutually exclusive with CABundle.
-                        If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
-                        the cert-manager controller container is used to validate the TLS connection.
-                        If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
-                      type: object
-                      required:
-                        - name
-                      properties:
-                        key:
-                          description: |-
-                            The key of the entry in the Secret resource's `data` field to be used.
-                            Some instances of this field may be defaulted, in others it may be
-                            required.
-                          type: string
-                        name:
-                          description: |-
-                            Name of the resource being referred to.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                    clientCertSecretRef:
-                      description: |-
-                        Reference to a Secret containing a PEM-encoded Client Certificate to use when the
-                        Vault server requires mTLS.
-                      type: object
-                      required:
-                        - name
-                      properties:
-                        key:
-                          description: |-
-                            The key of the entry in the Secret resource's `data` field to be used.
-                            Some instances of this field may be defaulted, in others it may be
-                            required.
-                          type: string
-                        name:
-                          description: |-
-                            Name of the resource being referred to.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                    clientKeySecretRef:
-                      description: |-
-                        Reference to a Secret containing a PEM-encoded Client Private Key to use when the
-                        Vault server requires mTLS.
-                      type: object
-                      required:
-                        - name
-                      properties:
-                        key:
-                          description: |-
-                            The key of the entry in the Secret resource's `data` field to be used.
-                            Some instances of this field may be defaulted, in others it may be
-                            required.
-                          type: string
-                        name:
-                          description: |-
-                            Name of the resource being referred to.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                    namespace:
-                      description: |-
-                        Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1"
-                        More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
-                      type: string
-                    path:
-                      description: |-
-                        Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
-                        "my_pki_mount/sign/my-role-name".
-                      type: string
-                    server:
-                      description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
-                      type: string
-                venafi:
-                  description: |-
-                    Venafi configures this issuer to sign certificates using a Venafi TPP
-                    or Venafi Cloud policy zone.
-                  type: object
-                  required:
-                    - zone
-                  properties:
-                    cloud:
-                      description: |-
-                        Cloud specifies the Venafi cloud configuration settings.
-                        Only one of TPP or Cloud may be specified.
-                      type: object
-                      required:
-                        - apiTokenSecretRef
-                      properties:
-                        apiTokenSecretRef:
-                          description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                        url:
-                          description: |-
-                            URL is the base URL for Venafi Cloud.
-                            Defaults to "https://api.venafi.cloud/v1".
-                          type: string
-                    tpp:
-                      description: |-
-                        TPP specifies Trust Protection Platform configuration settings.
-                        Only one of TPP or Cloud may be specified.
-                      type: object
-                      required:
-                        - credentialsRef
-                        - url
-                      properties:
-                        caBundle:
-                          description: |-
-                            Base64-encoded bundle of PEM CAs which will be used to validate the certificate
-                            chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
-                            If undefined, the certificate bundle in the cert-manager controller container
-                            is used to validate the chain.
-                          type: string
-                          format: byte
-                        caBundleSecretRef:
-                          description: |-
-                            Reference to a Secret containing a base64-encoded bundle of PEM CAs
-                            which will be used to validate the certificate chain presented by the TPP server.
-                            Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
-                            If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
-                            the cert-manager controller container is used to validate the TLS connection.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                        credentialsRef:
-                          description: |-
-                            CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.
-                            The secret must contain the key 'access-token' for the Access Token Authentication,
-                            or two keys, 'username' and 'password' for the API Keys Authentication.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                        url:
-                          description: |-
-                            URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
-                            for example: "https://tpp.example.com/vedsdk".
-                          type: string
-                    zone:
-                      description: |-
-                        Zone is the Venafi Policy Zone to use for this issuer.
-                        All requests made to the Venafi platform will be restricted by the named
-                        zone policy.
-                        This field is required.
-                      type: string
-            status:
-              description: Status of the ClusterIssuer. This is set and managed automatically.
-              type: object
-              properties:
-                acme:
-                  description: |-
-                    ACME specific status options.
-                    This field should only be set if the Issuer is configured to use an ACME
-                    server to issue certificates.
-                  type: object
-                  properties:
-                    lastPrivateKeyHash:
-                      description: |-
-                        LastPrivateKeyHash is a hash of the private key associated with the latest
-                        registered ACME account, in order to track changes made to registered account
-                        associated with the Issuer
-                      type: string
-                    lastRegisteredEmail:
-                      description: |-
-                        LastRegisteredEmail is the email associated with the latest registered
-                        ACME account, in order to track changes made to registered account
-                        associated with the  Issuer
-                      type: string
-                    uri:
-                      description: |-
-                        URI is the unique account identifier, which can also be used to retrieve
-                        account details from the CA
-                      type: string
-                conditions:
-                  description: |-
-                    List of status conditions to indicate the status of a CertificateRequest.
-                    Known condition types are `Ready`.
-                  type: array
-                  items:
-                    description: IssuerCondition contains condition information for an Issuer.
-                    type: object
-                    required:
-                      - status
-                      - type
-                    properties:
-                      lastTransitionTime:
-                        description: |-
-                          LastTransitionTime is the timestamp corresponding to the last status
-                          change of this condition.
-                        type: string
-                        format: date-time
-                      message:
-                        description: |-
-                          Message is a human readable description of the details of the last
-                          transition, complementing reason.
-                        type: string
-                      observedGeneration:
-                        description: |-
-                          If set, this represents the .metadata.generation that the condition was
-                          set based upon.
-                          For instance, if .metadata.generation is currently 12, but the
-                          .status.condition[x].observedGeneration is 9, the condition is out of date
-                          with respect to the current state of the Issuer.
-                        type: integer
-                        format: int64
-                      reason:
-                        description: |-
-                          Reason is a brief machine readable explanation for the condition's last
-                          transition.
-                        type: string
-                      status:
-                        description: Status of the condition, one of (`True`, `False`, `Unknown`).
-                        type: string
-                        enum:
-                          - "True"
-                          - "False"
-                          - Unknown
-                      type:
-                        description: Type of the condition, known values are (`Ready`).
-                        type: string
-                  x-kubernetes-list-map-keys:
-                    - type
-                  x-kubernetes-list-type: map
-      served: true
-      storage: true
-
-# END crd {{- end }}
-
----
-# START crd {{- if or .Values.crds.enabled .Values.installCRDs }}
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: issuers.cert-manager.io
-  # START annotations {{- if .Values.crds.keep }}
-  annotations:
-    helm.sh/resource-policy: keep
-  # END annotations {{- end }}
-  labels:
-    app: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/instance: '{{ .Release.Name }}'
-    app.kubernetes.io/component: "crds"
-    # Generated labels {{- include "labels" . | nindent 4 }}
-spec:
-  group: cert-manager.io
-  names:
-    kind: Issuer
-    listKind: IssuerList
-    plural: issuers
-    singular: issuer
-    categories:
-      - cert-manager
-  scope: Namespaced
-  versions:
-    - name: v1
-      subresources:
-        status: {}
-      additionalPrinterColumns:
-        - jsonPath: .status.conditions[?(@.type=="Ready")].status
-          name: Ready
-          type: string
-        - jsonPath: .status.conditions[?(@.type=="Ready")].message
-          name: Status
-          priority: 1
-          type: string
-        - jsonPath: .metadata.creationTimestamp
-          description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
-          name: Age
-          type: date
-      schema:
-        openAPIV3Schema:
-          description: |-
-            An Issuer represents a certificate issuing authority which can be
-            referenced as part of `issuerRef` fields.
-            It is scoped to a single namespace and can therefore only be referenced by
-            resources within the same namespace.
-          type: object
-          required:
-            - spec
-          properties:
-            apiVersion:
-              description: |-
-                APIVersion defines the versioned schema of this representation of an object.
-                Servers should convert recognized schemas to the latest internal value, and
-                may reject unrecognized values.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-              type: string
-            kind:
-              description: |-
-                Kind is a string value representing the REST resource this object represents.
-                Servers may infer this from the endpoint the client submits requests to.
-                Cannot be updated.
-                In CamelCase.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: Desired state of the Issuer resource.
-              type: object
-              properties:
-                acme:
-                  description: |-
-                    ACME configures this issuer to communicate with a RFC8555 (ACME) server
-                    to obtain signed x509 certificates.
-                  type: object
-                  required:
-                    - privateKeySecretRef
-                    - server
-                  properties:
-                    caBundle:
-                      description: |-
-                        Base64-encoded bundle of PEM CAs which can be used to validate the certificate
-                        chain presented by the ACME server.
-                        Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various
-                        kinds of security vulnerabilities.
-                        If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
-                        the container is used to validate the TLS connection.
-                      type: string
-                      format: byte
-                    disableAccountKeyGeneration:
-                      description: |-
-                        Enables or disables generating a new ACME account key.
-                        If true, the Issuer resource will *not* request a new account but will expect
-                        the account key to be supplied via an existing secret.
-                        If false, the cert-manager system will generate a new ACME account key
-                        for the Issuer.
-                        Defaults to false.
-                      type: boolean
-                    email:
-                      description: |-
-                        Email is the email address to be associated with the ACME account.
-                        This field is optional, but it is strongly recommended to be set.
-                        It will be used to contact you in case of issues with your account or
-                        certificates, including expiry notification emails.
-                        This field may be updated after the account is initially registered.
-                      type: string
-                    enableDurationFeature:
-                      description: |-
-                        Enables requesting a Not After date on certificates that matches the
-                        duration of the certificate. This is not supported by all ACME servers
-                        like Let's Encrypt. If set to true when the ACME server does not support
-                        it, it will create an error on the Order.
-                        Defaults to false.
-                      type: boolean
-                    externalAccountBinding:
-                      description: |-
-                        ExternalAccountBinding is a reference to a CA external account of the ACME
-                        server.
-                        If set, upon registration cert-manager will attempt to associate the given
-                        external account credentials with the registered ACME account.
-                      type: object
-                      required:
-                        - keyID
-                        - keySecretRef
-                      properties:
-                        keyAlgorithm:
-                          description: |-
-                            Deprecated: keyAlgorithm field exists for historical compatibility
-                            reasons and should not be used. The algorithm is now hardcoded to HS256
-                            in golang/x/crypto/acme.
-                          type: string
-                          enum:
-                            - HS256
-                            - HS384
-                            - HS512
-                        keyID:
-                          description: keyID is the ID of the CA key that the External Account is bound to.
-                          type: string
-                        keySecretRef:
-                          description: |-
-                            keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes
-                            Secret which holds the symmetric MAC key of the External Account Binding.
-                            The `key` is the index string that is paired with the key data in the
-                            Secret and should not be confused with the key data itself, or indeed with
-                            the External Account Binding keyID above.
-                            The secret key stored in the Secret **must** be un-padded, base64 URL
-                            encoded data.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                    preferredChain:
-                      description: |-
-                        PreferredChain is the chain to use if the ACME server outputs multiple.
-                        PreferredChain is no guarantee that this one gets delivered by the ACME
-                        endpoint.
-                        For example, for Let's Encrypt's DST crosssign you would use:
-                        "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
-                        This value picks the first certificate bundle in the combined set of
-                        ACME default and alternative chains that has a root-most certificate with
-                        this value as its issuer's commonname.
-                      type: string
-                      maxLength: 64
-                    privateKeySecretRef:
-                      description: |-
-                        PrivateKey is the name of a Kubernetes Secret resource that will be used to
-                        store the automatically generated ACME account private key.
-                        Optionally, a `key` may be specified to select a specific entry within
-                        the named Secret resource.
-                        If `key` is not specified, a default of `tls.key` will be used.
-                      type: object
-                      required:
-                        - name
-                      properties:
-                        key:
-                          description: |-
-                            The key of the entry in the Secret resource's `data` field to be used.
-                            Some instances of this field may be defaulted, in others it may be
-                            required.
-                          type: string
-                        name:
-                          description: |-
-                            Name of the resource being referred to.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                    server:
-                      description: |-
-                        Server is the URL used to access the ACME server's 'directory' endpoint.
-                        For example, for Let's Encrypt's staging endpoint, you would use:
-                        "https://acme-staging-v02.api.letsencrypt.org/directory".
-                        Only ACME v2 endpoints (i.e. RFC 8555) are supported.
-                      type: string
-                    skipTLSVerify:
-                      description: |-
-                        INSECURE: Enables or disables validation of the ACME server TLS certificate.
-                        If true, requests to the ACME server will not have the TLS certificate chain
-                        validated.
-                        Mutually exclusive with CABundle; prefer using CABundle to prevent various
-                        kinds of security vulnerabilities.
-                        Only enable this option in development environments.
-                        If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
-                        the container is used to validate the TLS connection.
-                        Defaults to false.
-                      type: boolean
-                    solvers:
-                      description: |-
-                        Solvers is a list of challenge solvers that will be used to solve
-                        ACME challenges for the matching domains.
-                        Solver configurations must be provided in order to obtain certificates
-                        from an ACME server.
-                        For more information, see: https://cert-manager.io/docs/configuration/acme/
-                      type: array
-                      items:
-                        description: |-
-                          An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of.
-                          A selector may be provided to use different solving strategies for different DNS names.
-                          Only one of HTTP01 or DNS01 must be provided.
-                        type: object
-                        properties:
-                          dns01:
-                            description: |-
-                              Configures cert-manager to attempt to complete authorizations by
-                              performing the DNS01 challenge flow.
-                            type: object
-                            properties:
-                              acmeDNS:
-                                description: |-
-                                  Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
-                                  DNS01 challenge records.
-                                type: object
-                                required:
-                                  - accountSecretRef
-                                  - host
-                                properties:
-                                  accountSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  host:
-                                    type: string
-                              akamai:
-                                description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - accessTokenSecretRef
-                                  - clientSecretSecretRef
-                                  - clientTokenSecretRef
-                                  - serviceConsumerDomain
-                                properties:
-                                  accessTokenSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  clientSecretSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  clientTokenSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  serviceConsumerDomain:
-                                    type: string
-                              azureDNS:
-                                description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - resourceGroupName
-                                  - subscriptionID
-                                properties:
-                                  clientID:
-                                    description: |-
-                                      Auth: Azure Service Principal:
-                                      The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
-                                      If set, ClientSecret and TenantID must also be set.
-                                    type: string
-                                  clientSecretSecretRef:
-                                    description: |-
-                                      Auth: Azure Service Principal:
-                                      A reference to a Secret containing the password associated with the Service Principal.
-                                      If set, ClientID and TenantID must also be set.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  environment:
-                                    description: name of the Azure environment (default AzurePublicCloud)
-                                    type: string
-                                    enum:
-                                      - AzurePublicCloud
-                                      - AzureChinaCloud
-                                      - AzureGermanCloud
-                                      - AzureUSGovernmentCloud
-                                  hostedZoneName:
-                                    description: name of the DNS zone that should be used
-                                    type: string
-                                  managedIdentity:
-                                    description: |-
-                                      Auth: Azure Workload Identity or Azure Managed Service Identity:
-                                      Settings to enable Azure Workload Identity or Azure Managed Service Identity
-                                      If set, ClientID, ClientSecret and TenantID must not be set.
-                                    type: object
-                                    properties:
-                                      clientID:
-                                        description: client ID of the managed identity, can not be used at the same time as resourceID
-                                        type: string
-                                      resourceID:
-                                        description: |-
-                                          resource ID of the managed identity, can not be used at the same time as clientID
-                                          Cannot be used for Azure Managed Service Identity
-                                        type: string
-                                  resourceGroupName:
-                                    description: resource group the DNS zone is located in
-                                    type: string
-                                  subscriptionID:
-                                    description: ID of the Azure subscription
-                                    type: string
-                                  tenantID:
-                                    description: |-
-                                      Auth: Azure Service Principal:
-                                      The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
-                                      If set, ClientID and ClientSecret must also be set.
-                                    type: string
-                              cloudDNS:
-                                description: Use the Google Cloud DNS API to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - project
-                                properties:
-                                  hostedZoneName:
-                                    description: |-
-                                      HostedZoneName is an optional field that tells cert-manager in which
-                                      Cloud DNS zone the challenge record has to be created.
-                                      If left empty cert-manager will automatically choose a zone.
-                                    type: string
-                                  project:
-                                    type: string
-                                  serviceAccountSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                              cloudflare:
-                                description: Use the Cloudflare API to manage DNS01 challenge records.
-                                type: object
-                                properties:
-                                  apiKeySecretRef:
-                                    description: |-
-                                      API key to use to authenticate with Cloudflare.
-                                      Note: using an API token to authenticate is now the recommended method
-                                      as it allows greater control of permissions.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  apiTokenSecretRef:
-                                    description: API token used to authenticate with Cloudflare.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  email:
-                                    description: Email of the account, only required when using API key based authentication.
-                                    type: string
-                              cnameStrategy:
-                                description: |-
-                                  CNAMEStrategy configures how the DNS01 provider should handle CNAME
-                                  records when found in DNS zones.
-                                type: string
-                                enum:
-                                  - None
-                                  - Follow
-                              digitalocean:
-                                description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - tokenSecretRef
-                                properties:
-                                  tokenSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                              rfc2136:
-                                description: |-
-                                  Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
-                                  to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - nameserver
-                                properties:
-                                  nameserver:
-                                    description: |-
-                                      The IP address or hostname of an authoritative DNS server supporting
-                                      RFC2136 in the form host:port. If the host is an IPv6 address it must be
-                                      enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
-                                      This field is required.
-                                    type: string
-                                  tsigAlgorithm:
-                                    description: |-
-                                      The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
-                                      when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
-                                      Supported values are (case-insensitive): ``HMACMD5`` (default),
-                                      ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
-                                    type: string
-                                  tsigKeyName:
-                                    description: |-
-                                      The TSIG Key name configured in the DNS.
-                                      If ``tsigSecretSecretRef`` is defined, this field is required.
-                                    type: string
-                                  tsigSecretSecretRef:
-                                    description: |-
-                                      The name of the secret containing the TSIG value.
-                                      If ``tsigKeyName`` is defined, this field is required.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                              route53:
-                                description: Use the AWS Route53 API to manage DNS01 challenge records.
-                                type: object
-                                properties:
-                                  accessKeyID:
-                                    description: |-
-                                      The AccessKeyID is used for authentication.
-                                      Cannot be set when SecretAccessKeyID is set.
-                                      If neither the Access Key nor Key ID are set, we fall-back to using env
-                                      vars, shared credentials file or AWS Instance metadata,
-                                      see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
-                                    type: string
-                                  accessKeyIDSecretRef:
-                                    description: |-
-                                      The SecretAccessKey is used for authentication. If set, pull the AWS
-                                      access key ID from a key within a Kubernetes Secret.
-                                      Cannot be set when AccessKeyID is set.
-                                      If neither the Access Key nor Key ID are set, we fall-back to using env
-                                      vars, shared credentials file or AWS Instance metadata,
-                                      see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  auth:
-                                    description: Auth configures how cert-manager authenticates.
-                                    type: object
-                                    required:
-                                      - kubernetes
-                                    properties:
-                                      kubernetes:
-                                        description: |-
-                                          Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
-                                          by passing a bound ServiceAccount token.
-                                        type: object
-                                        required:
-                                          - serviceAccountRef
-                                        properties:
-                                          serviceAccountRef:
-                                            description: |-
-                                              A reference to a service account that will be used to request a bound
-                                              token (also known as "projected token"). To use this field, you must
-                                              configure an RBAC rule to let cert-manager request a token.
-                                            type: object
-                                            required:
-                                              - name
-                                            properties:
-                                              audiences:
-                                                description: |-
-                                                  TokenAudiences is an optional list of audiences to include in the
-                                                  token passed to AWS. The default token consisting of the issuer's namespace
-                                                  and name is always included.
-                                                  If unset the audience defaults to `sts.amazonaws.com`.
-                                                type: array
-                                                items:
-                                                  type: string
-                                              name:
-                                                description: Name of the ServiceAccount used to request a token.
-                                                type: string
-                                  hostedZoneID:
-                                    description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.
-                                    type: string
-                                  region:
-                                    description: |-
-                                      Override the AWS region.
-
-                                      Route53 is a global service and does not have regional endpoints but the
-                                      region specified here (or via environment variables) is used as a hint to
-                                      help compute the correct AWS credential scope and partition when it
-                                      connects to Route53. See:
-                                      - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
-                                      - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)
-
-                                      If you omit this region field, cert-manager will use the region from
-                                      AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
-                                      in the cert-manager controller Pod.
-
-                                      The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
-                                      Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
-                                      [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
-                                      In this case this `region` field value is ignored.
-
-                                      The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
-                                      Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
-                                      [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
-                                      In this case this `region` field value is ignored.
-                                    type: string
-                                  role:
-                                    description: |-
-                                      Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
-                                      or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
-                                    type: string
-                                  secretAccessKeySecretRef:
-                                    description: |-
-                                      The SecretAccessKey is used for authentication.
-                                      If neither the Access Key nor Key ID are set, we fall-back to using env
-                                      vars, shared credentials file or AWS Instance metadata,
-                                      see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                              webhook:
-                                description: |-
-                                  Configure an external webhook based DNS01 challenge solver to manage
-                                  DNS01 challenge records.
-                                type: object
-                                required:
-                                  - groupName
-                                  - solverName
-                                properties:
-                                  config:
-                                    description: |-
-                                      Additional configuration that should be passed to the webhook apiserver
-                                      when challenges are processed.
-                                      This can contain arbitrary JSON data.
-                                      Secret values should not be specified in this stanza.
-                                      If secret values are needed (e.g. credentials for a DNS service), you
-                                      should use a SecretKeySelector to reference a Secret resource.
-                                      For details on the schema of this field, consult the webhook provider
-                                      implementation's documentation.
-                                    x-kubernetes-preserve-unknown-fields: true
-                                  groupName:
-                                    description: |-
-                                      The API group name that should be used when POSTing ChallengePayload
-                                      resources to the webhook apiserver.
-                                      This should be the same as the GroupName specified in the webhook
-                                      provider implementation.
-                                    type: string
-                                  solverName:
-                                    description: |-
-                                      The name of the solver to use, as defined in the webhook provider
-                                      implementation.
-                                      This will typically be the name of the provider, e.g. 'cloudflare'.
-                                    type: string
-                          http01:
-                            description: |-
-                              Configures cert-manager to attempt to complete authorizations by
-                              performing the HTTP01 challenge flow.
-                              It is not possible to obtain certificates for wildcard domain names
-                              (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
-                            type: object
-                            properties:
-                              gatewayHTTPRoute:
-                                description: |-
-                                  The Gateway API is a sig-network community API that models service networking
-                                  in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
-                                  create HTTPRoutes with the specified labels in the same namespace as the challenge.
-                                  This solver is experimental, and fields / behaviour may change in the future.
-                                type: object
-                                properties:
-                                  labels:
-                                    description: |-
-                                      Custom labels that will be applied to HTTPRoutes created by cert-manager
-                                      while solving HTTP-01 challenges.
-                                    type: object
-                                    additionalProperties:
-                                      type: string
-                                  parentRefs:
-                                    description: |-
-                                      When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
-                                      cert-manager needs to know which parentRefs should be used when creating
-                                      the HTTPRoute. Usually, the parentRef references a Gateway. See:
-                                      https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
-                                    type: array
-                                    items:
-                                      description: |-
-                                        ParentReference identifies an API object (usually a Gateway) that can be considered
-                                        a parent of this resource (usually a route). There are two kinds of parent resources
-                                        with "Core" support:
-
-                                        * Gateway (Gateway conformance profile)
-                                        * Service (Mesh conformance profile, ClusterIP Services only)
-
-                                        This API may be extended in the future to support additional kinds of parent
-                                        resources.
-
-                                        The API object must be valid in the cluster; the Group and Kind must
-                                        be registered in the cluster for this reference to be valid.
-                                      type: object
-                                      required:
-                                        - name
-                                      properties:
-                                        group:
-                                          description: |-
-                                            Group is the group of the referent.
-                                            When unspecified, "gateway.networking.k8s.io" is inferred.
-                                            To set the core API group (such as for a "Service" kind referent),
-                                            Group must be explicitly set to "" (empty string).
-
-                                            Support: Core
-                                          type: string
-                                          default: gateway.networking.k8s.io
-                                          maxLength: 253
-                                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                        kind:
-                                          description: |-
-                                            Kind is kind of the referent.
-
-                                            There are two kinds of parent resources with "Core" support:
-
-                                            * Gateway (Gateway conformance profile)
-                                            * Service (Mesh conformance profile, ClusterIP Services only)
-
-                                            Support for other resources is Implementation-Specific.
-                                          type: string
-                                          default: Gateway
-                                          maxLength: 63
-                                          minLength: 1
-                                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                                        name:
-                                          description: |-
-                                            Name is the name of the referent.
-
-                                            Support: Core
-                                          type: string
-                                          maxLength: 253
-                                          minLength: 1
-                                        namespace:
-                                          description: |-
-                                            Namespace is the namespace of the referent. When unspecified, this refers
-                                            to the local namespace of the Route.
-
-                                            Note that there are specific rules for ParentRefs which cross namespace
-                                            boundaries. Cross-namespace references are only valid if they are explicitly
-                                            allowed by something in the namespace they are referring to. For example:
-                                            Gateway has the AllowedRoutes field, and ReferenceGrant provides a
-                                            generic way to enable any other kind of cross-namespace reference.
-
-                                            <gateway:experimental:description>
-                                            ParentRefs from a Route to a Service in the same namespace are "producer"
-                                            routes, which apply default routing rules to inbound connections from
-                                            any namespace to the Service.
-
-                                            ParentRefs from a Route to a Service in a different namespace are
-                                            "consumer" routes, and these routing rules are only applied to outbound
-                                            connections originating from the same namespace as the Route, for which
-                                            the intended destination of the connections are a Service targeted as a
-                                            ParentRef of the Route.
-                                            </gateway:experimental:description>
-
-                                            Support: Core
-                                          type: string
-                                          maxLength: 63
-                                          minLength: 1
-                                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                                        port:
-                                          description: |-
-                                            Port is the network port this Route targets. It can be interpreted
-                                            differently based on the type of parent resource.
-
-                                            When the parent resource is a Gateway, this targets all listeners
-                                            listening on the specified port that also support this kind of Route(and
-                                            select this Route). It's not recommended to set `Port` unless the
-                                            networking behaviors specified in a Route must apply to a specific port
-                                            as opposed to a listener(s) whose port(s) may be changed. When both Port
-                                            and SectionName are specified, the name and port of the selected listener
-                                            must match both specified values.
-
-                                            <gateway:experimental:description>
-                                            When the parent resource is a Service, this targets a specific port in the
-                                            Service spec. When both Port (experimental) and SectionName are specified,
-                                            the name and port of the selected port must match both specified values.
-                                            </gateway:experimental:description>
-
-                                            Implementations MAY choose to support other parent resources.
-                                            Implementations supporting other types of parent resources MUST clearly
-                                            document how/if Port is interpreted.
-
-                                            For the purpose of status, an attachment is considered successful as
-                                            long as the parent resource accepts it partially. For example, Gateway
-                                            listeners can restrict which Routes can attach to them by Route kind,
-                                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
-                                            from the referencing Route, the Route MUST be considered successfully
-                                            attached. If no Gateway listeners accept attachment from this Route,
-                                            the Route MUST be considered detached from the Gateway.
-
-                                            Support: Extended
-                                          type: integer
-                                          format: int32
-                                          maximum: 65535
-                                          minimum: 1
-                                        sectionName:
-                                          description: |-
-                                            SectionName is the name of a section within the target resource. In the
-                                            following resources, SectionName is interpreted as the following:
-
-                                            * Gateway: Listener name. When both Port (experimental) and SectionName
-                                            are specified, the name and port of the selected listener must match
-                                            both specified values.
-                                            * Service: Port name. When both Port (experimental) and SectionName
-                                            are specified, the name and port of the selected listener must match
-                                            both specified values.
-
-                                            Implementations MAY choose to support attaching Routes to other resources.
-                                            If that is the case, they MUST clearly document how SectionName is
-                                            interpreted.
-
-                                            When unspecified (empty string), this will reference the entire resource.
-                                            For the purpose of status, an attachment is considered successful if at
-                                            least one section in the parent resource accepts it. For example, Gateway
-                                            listeners can restrict which Routes can attach to them by Route kind,
-                                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
-                                            the referencing Route, the Route MUST be considered successfully
-                                            attached. If no Gateway listeners accept attachment from this Route, the
-                                            Route MUST be considered detached from the Gateway.
-
-                                            Support: Core
-                                          type: string
-                                          maxLength: 253
-                                          minLength: 1
-                                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                  podTemplate:
-                                    description: |-
-                                      Optional pod template used to configure the ACME challenge solver pods
-                                      used for HTTP01 challenges.
-                                    type: object
-                                    properties:
-                                      metadata:
-                                        description: |-
-                                          ObjectMeta overrides for the pod used to solve HTTP01 challenges.
-                                          Only the 'labels' and 'annotations' fields may be set.
-                                          If labels or annotations overlap with in-built values, the values here
-                                          will override the in-built values.
-                                        type: object
-                                        properties:
-                                          annotations:
-                                            description: Annotations that should be added to the created ACME HTTP01 solver pods.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          labels:
-                                            description: Labels that should be added to the created ACME HTTP01 solver pods.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                      spec:
-                                        description: |-
-                                          PodSpec defines overrides for the HTTP01 challenge solver pod.
-                                          Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
-                                          All other fields will be ignored.
-                                        type: object
-                                        properties:
-                                          affinity:
-                                            description: If specified, the pod's scheduling constraints
-                                            type: object
-                                            properties:
-                                              nodeAffinity:
-                                                description: Describes node affinity scheduling rules for the pod.
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node matches the corresponding matchExpressions; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        An empty preferred scheduling term matches all objects with implicit weight 0
-                                                        (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
-                                                      type: object
-                                                      required:
-                                                        - preference
-                                                        - weight
-                                                      properties:
-                                                        preference:
-                                                          description: A node selector term, associated with the corresponding weight.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: A list of node selector requirements by node's labels.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchFields:
-                                                              description: A list of node selector requirements by node's fields.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                          x-kubernetes-map-type: atomic
-                                                        weight:
-                                                          description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to an update), the system
-                                                      may or may not try to eventually evict the pod from its node.
-                                                    type: object
-                                                    required:
-                                                      - nodeSelectorTerms
-                                                    properties:
-                                                      nodeSelectorTerms:
-                                                        description: Required. A list of node selector terms. The terms are ORed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A null or empty node selector term matches no objects. The requirements of
-                                                            them are ANDed.
-                                                            The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: A list of node selector requirements by node's labels.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchFields:
-                                                              description: A list of node selector requirements by node's fields.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                          x-kubernetes-map-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                    x-kubernetes-map-type: atomic
-                                              podAffinity:
-                                                description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                      type: object
-                                                      required:
-                                                        - podAffinityTerm
-                                                        - weight
-                                                      properties:
-                                                        podAffinityTerm:
-                                                          description: Required. A pod affinity term, associated with the corresponding weight.
-                                                          type: object
-                                                          required:
-                                                            - topologyKey
-                                                          properties:
-                                                            labelSelector:
-                                                              description: |-
-                                                                A label query over a set of resources, in this case pods.
-                                                                If it's null, this PodAffinityTerm matches with no Pods.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            matchLabelKeys:
-                                                              description: |-
-                                                                MatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            mismatchLabelKeys:
-                                                              description: |-
-                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            namespaceSelector:
-                                                              description: |-
-                                                                A label query over the set of namespaces that the term applies to.
-                                                                The term is applied to the union of the namespaces selected by this field
-                                                                and the ones listed in the namespaces field.
-                                                                null selector and null or empty namespaces list means "this pod's namespace".
-                                                                An empty selector ({}) matches all namespaces.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            namespaces:
-                                                              description: |-
-                                                                namespaces specifies a static list of namespace names that the term applies to.
-                                                                The term is applied to the union of the namespaces listed in this field
-                                                                and the ones selected by namespaceSelector.
-                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            topologyKey:
-                                                              description: |-
-                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                                whose value of the label with key topologyKey matches that of any node on which any of the
-                                                                selected pods is running.
-                                                                Empty topologyKey is not allowed.
-                                                              type: string
-                                                        weight:
-                                                          description: |-
-                                                            weight associated with matching the corresponding podAffinityTerm,
-                                                            in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to a pod label update), the
-                                                      system may or may not try to eventually evict the pod from its node.
-                                                      When there are multiple elements, the lists of nodes corresponding to each
-                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        Defines a set of pods (namely those matching the labelSelector
-                                                        relative to the given namespace(s)) that this pod should be
-                                                        co-located (affinity) or not co-located (anti-affinity) with,
-                                                        where co-located is defined as running on a node whose value of
-                                                        the label with key <topologyKey> matches that of any node on which
-                                                        a pod of the set of pods is running
-                                                      type: object
-                                                      required:
-                                                        - topologyKey
-                                                      properties:
-                                                        labelSelector:
-                                                          description: |-
-                                                            A label query over a set of resources, in this case pods.
-                                                            If it's null, this PodAffinityTerm matches with no Pods.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        matchLabelKeys:
-                                                          description: |-
-                                                            MatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        mismatchLabelKeys:
-                                                          description: |-
-                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        namespaceSelector:
-                                                          description: |-
-                                                            A label query over the set of namespaces that the term applies to.
-                                                            The term is applied to the union of the namespaces selected by this field
-                                                            and the ones listed in the namespaces field.
-                                                            null selector and null or empty namespaces list means "this pod's namespace".
-                                                            An empty selector ({}) matches all namespaces.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        namespaces:
-                                                          description: |-
-                                                            namespaces specifies a static list of namespace names that the term applies to.
-                                                            The term is applied to the union of the namespaces listed in this field
-                                                            and the ones selected by namespaceSelector.
-                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        topologyKey:
-                                                          description: |-
-                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                            whose value of the label with key topologyKey matches that of any node on which any of the
-                                                            selected pods is running.
-                                                            Empty topologyKey is not allowed.
-                                                          type: string
-                                                    x-kubernetes-list-type: atomic
-                                              podAntiAffinity:
-                                                description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the anti-affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                      type: object
-                                                      required:
-                                                        - podAffinityTerm
-                                                        - weight
-                                                      properties:
-                                                        podAffinityTerm:
-                                                          description: Required. A pod affinity term, associated with the corresponding weight.
-                                                          type: object
-                                                          required:
-                                                            - topologyKey
-                                                          properties:
-                                                            labelSelector:
-                                                              description: |-
-                                                                A label query over a set of resources, in this case pods.
-                                                                If it's null, this PodAffinityTerm matches with no Pods.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            matchLabelKeys:
-                                                              description: |-
-                                                                MatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            mismatchLabelKeys:
-                                                              description: |-
-                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            namespaceSelector:
-                                                              description: |-
-                                                                A label query over the set of namespaces that the term applies to.
-                                                                The term is applied to the union of the namespaces selected by this field
-                                                                and the ones listed in the namespaces field.
-                                                                null selector and null or empty namespaces list means "this pod's namespace".
-                                                                An empty selector ({}) matches all namespaces.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            namespaces:
-                                                              description: |-
-                                                                namespaces specifies a static list of namespace names that the term applies to.
-                                                                The term is applied to the union of the namespaces listed in this field
-                                                                and the ones selected by namespaceSelector.
-                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            topologyKey:
-                                                              description: |-
-                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                                whose value of the label with key topologyKey matches that of any node on which any of the
-                                                                selected pods is running.
-                                                                Empty topologyKey is not allowed.
-                                                              type: string
-                                                        weight:
-                                                          description: |-
-                                                            weight associated with matching the corresponding podAffinityTerm,
-                                                            in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the anti-affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the anti-affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to a pod label update), the
-                                                      system may or may not try to eventually evict the pod from its node.
-                                                      When there are multiple elements, the lists of nodes corresponding to each
-                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        Defines a set of pods (namely those matching the labelSelector
-                                                        relative to the given namespace(s)) that this pod should be
-                                                        co-located (affinity) or not co-located (anti-affinity) with,
-                                                        where co-located is defined as running on a node whose value of
-                                                        the label with key <topologyKey> matches that of any node on which
-                                                        a pod of the set of pods is running
-                                                      type: object
-                                                      required:
-                                                        - topologyKey
-                                                      properties:
-                                                        labelSelector:
-                                                          description: |-
-                                                            A label query over a set of resources, in this case pods.
-                                                            If it's null, this PodAffinityTerm matches with no Pods.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        matchLabelKeys:
-                                                          description: |-
-                                                            MatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        mismatchLabelKeys:
-                                                          description: |-
-                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        namespaceSelector:
-                                                          description: |-
-                                                            A label query over the set of namespaces that the term applies to.
-                                                            The term is applied to the union of the namespaces selected by this field
-                                                            and the ones listed in the namespaces field.
-                                                            null selector and null or empty namespaces list means "this pod's namespace".
-                                                            An empty selector ({}) matches all namespaces.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        namespaces:
-                                                          description: |-
-                                                            namespaces specifies a static list of namespace names that the term applies to.
-                                                            The term is applied to the union of the namespaces listed in this field
-                                                            and the ones selected by namespaceSelector.
-                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        topologyKey:
-                                                          description: |-
-                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                            whose value of the label with key topologyKey matches that of any node on which any of the
-                                                            selected pods is running.
-                                                            Empty topologyKey is not allowed.
-                                                          type: string
-                                                    x-kubernetes-list-type: atomic
-                                          imagePullSecrets:
-                                            description: If specified, the pod's imagePullSecrets
-                                            type: array
-                                            items:
-                                              description: |-
-                                                LocalObjectReference contains enough information to let you locate the
-                                                referenced object inside the same namespace.
-                                              type: object
-                                              properties:
-                                                name:
-                                                  description: |-
-                                                    Name of the referent.
-                                                    This field is effectively required, but due to backwards compatibility is
-                                                    allowed to be empty. Instances of this type with an empty value here are
-                                                    almost certainly wrong.
-                                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                                  type: string
-                                                  default: ""
-                                              x-kubernetes-map-type: atomic
-                                          nodeSelector:
-                                            description: |-
-                                              NodeSelector is a selector which must be true for the pod to fit on a node.
-                                              Selector which must match a node's labels for the pod to be scheduled on that node.
-                                              More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          priorityClassName:
-                                            description: If specified, the pod's priorityClassName.
-                                            type: string
-                                          securityContext:
-                                            description: If specified, the pod's security context
-                                            type: object
-                                            properties:
-                                              fsGroup:
-                                                description: |-
-                                                  A special supplemental group that applies to all containers in a pod.
-                                                  Some volume types allow the Kubelet to change the ownership of that volume
-                                                  to be owned by the pod:
-
-                                                  1. The owning GID will be the FSGroup
-                                                  2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
-                                                  3. The permission bits are OR'd with rw-rw----
-
-                                                  If unset, the Kubelet will not modify the ownership and permissions of any volume.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              fsGroupChangePolicy:
-                                                description: |-
-                                                  fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
-                                                  before being exposed inside Pod. This field will only apply to
-                                                  volume types which support fsGroup based ownership(and permissions).
-                                                  It will have no effect on ephemeral volume types such as: secret, configmaps
-                                                  and emptydir.
-                                                  Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: string
-                                              runAsGroup:
-                                                description: |-
-                                                  The GID to run the entrypoint of the container process.
-                                                  Uses runtime default if unset.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
-                                                  for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              runAsNonRoot:
-                                                description: |-
-                                                  Indicates that the container must run as a non-root user.
-                                                  If true, the Kubelet will validate the image at runtime to ensure that it
-                                                  does not run as UID 0 (root) and fail to start the container if it does.
-                                                  If unset or false, no such validation will be performed.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
-                                                type: boolean
-                                              runAsUser:
-                                                description: |-
-                                                  The UID to run the entrypoint of the container process.
-                                                  Defaults to user specified in image metadata if unspecified.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
-                                                  for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              seLinuxOptions:
-                                                description: |-
-                                                  The SELinux context to be applied to all containers.
-                                                  If unspecified, the container runtime will allocate a random SELinux context for each
-                                                  container.  May also be set in SecurityContext.  If set in
-                                                  both SecurityContext and PodSecurityContext, the value specified in SecurityContext
-                                                  takes precedence for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: object
-                                                properties:
-                                                  level:
-                                                    description: Level is SELinux level label that applies to the container.
-                                                    type: string
-                                                  role:
-                                                    description: Role is a SELinux role label that applies to the container.
-                                                    type: string
-                                                  type:
-                                                    description: Type is a SELinux type label that applies to the container.
-                                                    type: string
-                                                  user:
-                                                    description: User is a SELinux user label that applies to the container.
-                                                    type: string
-                                              seccompProfile:
-                                                description: |-
-                                                  The seccomp options to use by the containers in this pod.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: object
-                                                required:
-                                                  - type
-                                                properties:
-                                                  localhostProfile:
-                                                    description: |-
-                                                      localhostProfile indicates a profile defined in a file on the node should be used.
-                                                      The profile must be preconfigured on the node to work.
-                                                      Must be a descending path, relative to the kubelet's configured seccomp profile location.
-                                                      Must be set if type is "Localhost". Must NOT be set for any other type.
-                                                    type: string
-                                                  type:
-                                                    description: |-
-                                                      type indicates which kind of seccomp profile will be applied.
-                                                      Valid options are:
-
-                                                      Localhost - a profile defined in a file on the node should be used.
-                                                      RuntimeDefault - the container runtime default profile should be used.
-                                                      Unconfined - no profile should be applied.
-                                                    type: string
-                                              supplementalGroups:
-                                                description: |-
-                                                  A list of groups applied to the first process run in each container, in addition
-                                                  to the container's primary GID, the fsGroup (if specified), and group memberships
-                                                  defined in the container image for the uid of the container process. If unspecified,
-                                                  no additional groups are added to any container. Note that group memberships
-                                                  defined in the container image for the uid of the container process are still effective,
-                                                  even if they are not included in this list.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: array
-                                                items:
-                                                  type: integer
-                                                  format: int64
-                                              sysctls:
-                                                description: |-
-                                                  Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
-                                                  sysctls (by the container runtime) might fail to launch.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: array
-                                                items:
-                                                  description: Sysctl defines a kernel parameter to be set
-                                                  type: object
-                                                  required:
-                                                    - name
-                                                    - value
-                                                  properties:
-                                                    name:
-                                                      description: Name of a property to set
-                                                      type: string
-                                                    value:
-                                                      description: Value of a property to set
-                                                      type: string
-                                          serviceAccountName:
-                                            description: If specified, the pod's service account
-                                            type: string
-                                          tolerations:
-                                            description: If specified, the pod's tolerations.
-                                            type: array
-                                            items:
-                                              description: |-
-                                                The pod this Toleration is attached to tolerates any taint that matches
-                                                the triple <key,value,effect> using the matching operator <operator>.
-                                              type: object
-                                              properties:
-                                                effect:
-                                                  description: |-
-                                                    Effect indicates the taint effect to match. Empty means match all taint effects.
-                                                    When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                                                  type: string
-                                                key:
-                                                  description: |-
-                                                    Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                                                    If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                                                  type: string
-                                                operator:
-                                                  description: |-
-                                                    Operator represents a key's relationship to the value.
-                                                    Valid operators are Exists and Equal. Defaults to Equal.
-                                                    Exists is equivalent to wildcard for value, so that a pod can
-                                                    tolerate all taints of a particular category.
-                                                  type: string
-                                                tolerationSeconds:
-                                                  description: |-
-                                                    TolerationSeconds represents the period of time the toleration (which must be
-                                                    of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                                                    it is not set, which means tolerate the taint forever (do not evict). Zero and
-                                                    negative values will be treated as 0 (evict immediately) by the system.
-                                                  type: integer
-                                                  format: int64
-                                                value:
-                                                  description: |-
-                                                    Value is the taint value the toleration matches to.
-                                                    If the operator is Exists, the value should be empty, otherwise just a regular string.
-                                                  type: string
-                                  serviceType:
-                                    description: |-
-                                      Optional service type for Kubernetes solver service. Supported values
-                                      are NodePort or ClusterIP. If unset, defaults to NodePort.
-                                    type: string
-                              ingress:
-                                description: |-
-                                  The ingress based HTTP01 challenge solver will solve challenges by
-                                  creating or modifying Ingress resources in order to route requests for
-                                  '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
-                                  provisioned by cert-manager for each Challenge to be completed.
-                                type: object
-                                properties:
-                                  class:
-                                    description: |-
-                                      This field configures the annotation `kubernetes.io/ingress.class` when
-                                      creating Ingress resources to solve ACME challenges that use this
-                                      challenge solver. Only one of `class`, `name` or `ingressClassName` may
-                                      be specified.
-                                    type: string
-                                  ingressClassName:
-                                    description: |-
-                                      This field configures the field `ingressClassName` on the created Ingress
-                                      resources used to solve ACME challenges that use this challenge solver.
-                                      This is the recommended way of configuring the ingress class. Only one of
-                                      `class`, `name` or `ingressClassName` may be specified.
-                                    type: string
-                                  ingressTemplate:
-                                    description: |-
-                                      Optional ingress template used to configure the ACME challenge solver
-                                      ingress used for HTTP01 challenges.
-                                    type: object
-                                    properties:
-                                      metadata:
-                                        description: |-
-                                          ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
-                                          Only the 'labels' and 'annotations' fields may be set.
-                                          If labels or annotations overlap with in-built values, the values here
-                                          will override the in-built values.
-                                        type: object
-                                        properties:
-                                          annotations:
-                                            description: Annotations that should be added to the created ACME HTTP01 solver ingress.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          labels:
-                                            description: Labels that should be added to the created ACME HTTP01 solver ingress.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                  name:
-                                    description: |-
-                                      The name of the ingress resource that should have ACME challenge solving
-                                      routes inserted into it in order to solve HTTP01 challenges.
-                                      This is typically used in conjunction with ingress controllers like
-                                      ingress-gce, which maintains a 1:1 mapping between external IPs and
-                                      ingress resources. Only one of `class`, `name` or `ingressClassName` may
-                                      be specified.
-                                    type: string
-                                  podTemplate:
-                                    description: |-
-                                      Optional pod template used to configure the ACME challenge solver pods
-                                      used for HTTP01 challenges.
-                                    type: object
-                                    properties:
-                                      metadata:
-                                        description: |-
-                                          ObjectMeta overrides for the pod used to solve HTTP01 challenges.
-                                          Only the 'labels' and 'annotations' fields may be set.
-                                          If labels or annotations overlap with in-built values, the values here
-                                          will override the in-built values.
-                                        type: object
-                                        properties:
-                                          annotations:
-                                            description: Annotations that should be added to the created ACME HTTP01 solver pods.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          labels:
-                                            description: Labels that should be added to the created ACME HTTP01 solver pods.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                      spec:
-                                        description: |-
-                                          PodSpec defines overrides for the HTTP01 challenge solver pod.
-                                          Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
-                                          All other fields will be ignored.
-                                        type: object
-                                        properties:
-                                          affinity:
-                                            description: If specified, the pod's scheduling constraints
-                                            type: object
-                                            properties:
-                                              nodeAffinity:
-                                                description: Describes node affinity scheduling rules for the pod.
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node matches the corresponding matchExpressions; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        An empty preferred scheduling term matches all objects with implicit weight 0
-                                                        (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
-                                                      type: object
-                                                      required:
-                                                        - preference
-                                                        - weight
-                                                      properties:
-                                                        preference:
-                                                          description: A node selector term, associated with the corresponding weight.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: A list of node selector requirements by node's labels.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchFields:
-                                                              description: A list of node selector requirements by node's fields.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                          x-kubernetes-map-type: atomic
-                                                        weight:
-                                                          description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to an update), the system
-                                                      may or may not try to eventually evict the pod from its node.
-                                                    type: object
-                                                    required:
-                                                      - nodeSelectorTerms
-                                                    properties:
-                                                      nodeSelectorTerms:
-                                                        description: Required. A list of node selector terms. The terms are ORed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A null or empty node selector term matches no objects. The requirements of
-                                                            them are ANDed.
-                                                            The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: A list of node selector requirements by node's labels.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchFields:
-                                                              description: A list of node selector requirements by node's fields.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                          x-kubernetes-map-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                    x-kubernetes-map-type: atomic
-                                              podAffinity:
-                                                description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                      type: object
-                                                      required:
-                                                        - podAffinityTerm
-                                                        - weight
-                                                      properties:
-                                                        podAffinityTerm:
-                                                          description: Required. A pod affinity term, associated with the corresponding weight.
-                                                          type: object
-                                                          required:
-                                                            - topologyKey
-                                                          properties:
-                                                            labelSelector:
-                                                              description: |-
-                                                                A label query over a set of resources, in this case pods.
-                                                                If it's null, this PodAffinityTerm matches with no Pods.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            matchLabelKeys:
-                                                              description: |-
-                                                                MatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            mismatchLabelKeys:
-                                                              description: |-
-                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            namespaceSelector:
-                                                              description: |-
-                                                                A label query over the set of namespaces that the term applies to.
-                                                                The term is applied to the union of the namespaces selected by this field
-                                                                and the ones listed in the namespaces field.
-                                                                null selector and null or empty namespaces list means "this pod's namespace".
-                                                                An empty selector ({}) matches all namespaces.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            namespaces:
-                                                              description: |-
-                                                                namespaces specifies a static list of namespace names that the term applies to.
-                                                                The term is applied to the union of the namespaces listed in this field
-                                                                and the ones selected by namespaceSelector.
-                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            topologyKey:
-                                                              description: |-
-                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                                whose value of the label with key topologyKey matches that of any node on which any of the
-                                                                selected pods is running.
-                                                                Empty topologyKey is not allowed.
-                                                              type: string
-                                                        weight:
-                                                          description: |-
-                                                            weight associated with matching the corresponding podAffinityTerm,
-                                                            in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to a pod label update), the
-                                                      system may or may not try to eventually evict the pod from its node.
-                                                      When there are multiple elements, the lists of nodes corresponding to each
-                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        Defines a set of pods (namely those matching the labelSelector
-                                                        relative to the given namespace(s)) that this pod should be
-                                                        co-located (affinity) or not co-located (anti-affinity) with,
-                                                        where co-located is defined as running on a node whose value of
-                                                        the label with key <topologyKey> matches that of any node on which
-                                                        a pod of the set of pods is running
-                                                      type: object
-                                                      required:
-                                                        - topologyKey
-                                                      properties:
-                                                        labelSelector:
-                                                          description: |-
-                                                            A label query over a set of resources, in this case pods.
-                                                            If it's null, this PodAffinityTerm matches with no Pods.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        matchLabelKeys:
-                                                          description: |-
-                                                            MatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        mismatchLabelKeys:
-                                                          description: |-
-                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        namespaceSelector:
-                                                          description: |-
-                                                            A label query over the set of namespaces that the term applies to.
-                                                            The term is applied to the union of the namespaces selected by this field
-                                                            and the ones listed in the namespaces field.
-                                                            null selector and null or empty namespaces list means "this pod's namespace".
-                                                            An empty selector ({}) matches all namespaces.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        namespaces:
-                                                          description: |-
-                                                            namespaces specifies a static list of namespace names that the term applies to.
-                                                            The term is applied to the union of the namespaces listed in this field
-                                                            and the ones selected by namespaceSelector.
-                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        topologyKey:
-                                                          description: |-
-                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                            whose value of the label with key topologyKey matches that of any node on which any of the
-                                                            selected pods is running.
-                                                            Empty topologyKey is not allowed.
-                                                          type: string
-                                                    x-kubernetes-list-type: atomic
-                                              podAntiAffinity:
-                                                description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the anti-affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                      type: object
-                                                      required:
-                                                        - podAffinityTerm
-                                                        - weight
-                                                      properties:
-                                                        podAffinityTerm:
-                                                          description: Required. A pod affinity term, associated with the corresponding weight.
-                                                          type: object
-                                                          required:
-                                                            - topologyKey
-                                                          properties:
-                                                            labelSelector:
-                                                              description: |-
-                                                                A label query over a set of resources, in this case pods.
-                                                                If it's null, this PodAffinityTerm matches with no Pods.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            matchLabelKeys:
-                                                              description: |-
-                                                                MatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            mismatchLabelKeys:
-                                                              description: |-
-                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            namespaceSelector:
-                                                              description: |-
-                                                                A label query over the set of namespaces that the term applies to.
-                                                                The term is applied to the union of the namespaces selected by this field
-                                                                and the ones listed in the namespaces field.
-                                                                null selector and null or empty namespaces list means "this pod's namespace".
-                                                                An empty selector ({}) matches all namespaces.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            namespaces:
-                                                              description: |-
-                                                                namespaces specifies a static list of namespace names that the term applies to.
-                                                                The term is applied to the union of the namespaces listed in this field
-                                                                and the ones selected by namespaceSelector.
-                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            topologyKey:
-                                                              description: |-
-                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                                whose value of the label with key topologyKey matches that of any node on which any of the
-                                                                selected pods is running.
-                                                                Empty topologyKey is not allowed.
-                                                              type: string
-                                                        weight:
-                                                          description: |-
-                                                            weight associated with matching the corresponding podAffinityTerm,
-                                                            in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the anti-affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the anti-affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to a pod label update), the
-                                                      system may or may not try to eventually evict the pod from its node.
-                                                      When there are multiple elements, the lists of nodes corresponding to each
-                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        Defines a set of pods (namely those matching the labelSelector
-                                                        relative to the given namespace(s)) that this pod should be
-                                                        co-located (affinity) or not co-located (anti-affinity) with,
-                                                        where co-located is defined as running on a node whose value of
-                                                        the label with key <topologyKey> matches that of any node on which
-                                                        a pod of the set of pods is running
-                                                      type: object
-                                                      required:
-                                                        - topologyKey
-                                                      properties:
-                                                        labelSelector:
-                                                          description: |-
-                                                            A label query over a set of resources, in this case pods.
-                                                            If it's null, this PodAffinityTerm matches with no Pods.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        matchLabelKeys:
-                                                          description: |-
-                                                            MatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        mismatchLabelKeys:
-                                                          description: |-
-                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        namespaceSelector:
-                                                          description: |-
-                                                            A label query over the set of namespaces that the term applies to.
-                                                            The term is applied to the union of the namespaces selected by this field
-                                                            and the ones listed in the namespaces field.
-                                                            null selector and null or empty namespaces list means "this pod's namespace".
-                                                            An empty selector ({}) matches all namespaces.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        namespaces:
-                                                          description: |-
-                                                            namespaces specifies a static list of namespace names that the term applies to.
-                                                            The term is applied to the union of the namespaces listed in this field
-                                                            and the ones selected by namespaceSelector.
-                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        topologyKey:
-                                                          description: |-
-                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                            whose value of the label with key topologyKey matches that of any node on which any of the
-                                                            selected pods is running.
-                                                            Empty topologyKey is not allowed.
-                                                          type: string
-                                                    x-kubernetes-list-type: atomic
-                                          imagePullSecrets:
-                                            description: If specified, the pod's imagePullSecrets
-                                            type: array
-                                            items:
-                                              description: |-
-                                                LocalObjectReference contains enough information to let you locate the
-                                                referenced object inside the same namespace.
-                                              type: object
-                                              properties:
-                                                name:
-                                                  description: |-
-                                                    Name of the referent.
-                                                    This field is effectively required, but due to backwards compatibility is
-                                                    allowed to be empty. Instances of this type with an empty value here are
-                                                    almost certainly wrong.
-                                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                                  type: string
-                                                  default: ""
-                                              x-kubernetes-map-type: atomic
-                                          nodeSelector:
-                                            description: |-
-                                              NodeSelector is a selector which must be true for the pod to fit on a node.
-                                              Selector which must match a node's labels for the pod to be scheduled on that node.
-                                              More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          priorityClassName:
-                                            description: If specified, the pod's priorityClassName.
-                                            type: string
-                                          securityContext:
-                                            description: If specified, the pod's security context
-                                            type: object
-                                            properties:
-                                              fsGroup:
-                                                description: |-
-                                                  A special supplemental group that applies to all containers in a pod.
-                                                  Some volume types allow the Kubelet to change the ownership of that volume
-                                                  to be owned by the pod:
-
-                                                  1. The owning GID will be the FSGroup
-                                                  2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
-                                                  3. The permission bits are OR'd with rw-rw----
-
-                                                  If unset, the Kubelet will not modify the ownership and permissions of any volume.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              fsGroupChangePolicy:
-                                                description: |-
-                                                  fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
-                                                  before being exposed inside Pod. This field will only apply to
-                                                  volume types which support fsGroup based ownership(and permissions).
-                                                  It will have no effect on ephemeral volume types such as: secret, configmaps
-                                                  and emptydir.
-                                                  Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: string
-                                              runAsGroup:
-                                                description: |-
-                                                  The GID to run the entrypoint of the container process.
-                                                  Uses runtime default if unset.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
-                                                  for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              runAsNonRoot:
-                                                description: |-
-                                                  Indicates that the container must run as a non-root user.
-                                                  If true, the Kubelet will validate the image at runtime to ensure that it
-                                                  does not run as UID 0 (root) and fail to start the container if it does.
-                                                  If unset or false, no such validation will be performed.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
-                                                type: boolean
-                                              runAsUser:
-                                                description: |-
-                                                  The UID to run the entrypoint of the container process.
-                                                  Defaults to user specified in image metadata if unspecified.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
-                                                  for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              seLinuxOptions:
-                                                description: |-
-                                                  The SELinux context to be applied to all containers.
-                                                  If unspecified, the container runtime will allocate a random SELinux context for each
-                                                  container.  May also be set in SecurityContext.  If set in
-                                                  both SecurityContext and PodSecurityContext, the value specified in SecurityContext
-                                                  takes precedence for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: object
-                                                properties:
-                                                  level:
-                                                    description: Level is SELinux level label that applies to the container.
-                                                    type: string
-                                                  role:
-                                                    description: Role is a SELinux role label that applies to the container.
-                                                    type: string
-                                                  type:
-                                                    description: Type is a SELinux type label that applies to the container.
-                                                    type: string
-                                                  user:
-                                                    description: User is a SELinux user label that applies to the container.
-                                                    type: string
-                                              seccompProfile:
-                                                description: |-
-                                                  The seccomp options to use by the containers in this pod.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: object
-                                                required:
-                                                  - type
-                                                properties:
-                                                  localhostProfile:
-                                                    description: |-
-                                                      localhostProfile indicates a profile defined in a file on the node should be used.
-                                                      The profile must be preconfigured on the node to work.
-                                                      Must be a descending path, relative to the kubelet's configured seccomp profile location.
-                                                      Must be set if type is "Localhost". Must NOT be set for any other type.
-                                                    type: string
-                                                  type:
-                                                    description: |-
-                                                      type indicates which kind of seccomp profile will be applied.
-                                                      Valid options are:
-
-                                                      Localhost - a profile defined in a file on the node should be used.
-                                                      RuntimeDefault - the container runtime default profile should be used.
-                                                      Unconfined - no profile should be applied.
-                                                    type: string
-                                              supplementalGroups:
-                                                description: |-
-                                                  A list of groups applied to the first process run in each container, in addition
-                                                  to the container's primary GID, the fsGroup (if specified), and group memberships
-                                                  defined in the container image for the uid of the container process. If unspecified,
-                                                  no additional groups are added to any container. Note that group memberships
-                                                  defined in the container image for the uid of the container process are still effective,
-                                                  even if they are not included in this list.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: array
-                                                items:
-                                                  type: integer
-                                                  format: int64
-                                              sysctls:
-                                                description: |-
-                                                  Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
-                                                  sysctls (by the container runtime) might fail to launch.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: array
-                                                items:
-                                                  description: Sysctl defines a kernel parameter to be set
-                                                  type: object
-                                                  required:
-                                                    - name
-                                                    - value
-                                                  properties:
-                                                    name:
-                                                      description: Name of a property to set
-                                                      type: string
-                                                    value:
-                                                      description: Value of a property to set
-                                                      type: string
-                                          serviceAccountName:
-                                            description: If specified, the pod's service account
-                                            type: string
-                                          tolerations:
-                                            description: If specified, the pod's tolerations.
-                                            type: array
-                                            items:
-                                              description: |-
-                                                The pod this Toleration is attached to tolerates any taint that matches
-                                                the triple <key,value,effect> using the matching operator <operator>.
-                                              type: object
-                                              properties:
-                                                effect:
-                                                  description: |-
-                                                    Effect indicates the taint effect to match. Empty means match all taint effects.
-                                                    When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                                                  type: string
-                                                key:
-                                                  description: |-
-                                                    Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                                                    If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                                                  type: string
-                                                operator:
-                                                  description: |-
-                                                    Operator represents a key's relationship to the value.
-                                                    Valid operators are Exists and Equal. Defaults to Equal.
-                                                    Exists is equivalent to wildcard for value, so that a pod can
-                                                    tolerate all taints of a particular category.
-                                                  type: string
-                                                tolerationSeconds:
-                                                  description: |-
-                                                    TolerationSeconds represents the period of time the toleration (which must be
-                                                    of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                                                    it is not set, which means tolerate the taint forever (do not evict). Zero and
-                                                    negative values will be treated as 0 (evict immediately) by the system.
-                                                  type: integer
-                                                  format: int64
-                                                value:
-                                                  description: |-
-                                                    Value is the taint value the toleration matches to.
-                                                    If the operator is Exists, the value should be empty, otherwise just a regular string.
-                                                  type: string
-                                  serviceType:
-                                    description: |-
-                                      Optional service type for Kubernetes solver service. Supported values
-                                      are NodePort or ClusterIP. If unset, defaults to NodePort.
-                                    type: string
-                          selector:
-                            description: |-
-                              Selector selects a set of DNSNames on the Certificate resource that
-                              should be solved using this challenge solver.
-                              If not specified, the solver will be treated as the 'default' solver
-                              with the lowest priority, i.e. if any other solver has a more specific
-                              match, it will be used instead.
-                            type: object
-                            properties:
-                              dnsNames:
-                                description: |-
-                                  List of DNSNames that this solver will be used to solve.
-                                  If specified and a match is found, a dnsNames selector will take
-                                  precedence over a dnsZones selector.
-                                  If multiple solvers match with the same dnsNames value, the solver
-                                  with the most matching labels in matchLabels will be selected.
-                                  If neither has more matches, the solver defined earlier in the list
-                                  will be selected.
-                                type: array
-                                items:
-                                  type: string
-                              dnsZones:
-                                description: |-
-                                  List of DNSZones that this solver will be used to solve.
-                                  The most specific DNS zone match specified here will take precedence
-                                  over other DNS zone matches, so a solver specifying sys.example.com
-                                  will be selected over one specifying example.com for the domain
-                                  www.sys.example.com.
-                                  If multiple solvers match with the same dnsZones value, the solver
-                                  with the most matching labels in matchLabels will be selected.
-                                  If neither has more matches, the solver defined earlier in the list
-                                  will be selected.
-                                type: array
-                                items:
-                                  type: string
-                              matchLabels:
-                                description: |-
-                                  A label selector that is used to refine the set of certificate's that
-                                  this challenge solver will apply to.
-                                type: object
-                                additionalProperties:
-                                  type: string
-                ca:
-                  description: |-
-                    CA configures this issuer to sign certificates using a signing CA keypair
-                    stored in a Secret resource.
-                    This is used to build internal PKIs that are managed by cert-manager.
-                  type: object
-                  required:
-                    - secretName
-                  properties:
-                    crlDistributionPoints:
-                      description: |-
-                        The CRL distribution points is an X.509 v3 certificate extension which identifies
-                        the location of the CRL from which the revocation of this certificate can be checked.
-                        If not set, certificates will be issued without distribution points set.
-                      type: array
-                      items:
-                        type: string
-                    issuingCertificateURLs:
-                      description: |-
-                        IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates
-                        it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.
-                        As an example, such a URL might be "http://ca.domain.com/ca.crt".
-                      type: array
-                      items:
-                        type: string
-                    ocspServers:
-                      description: |-
-                        The OCSP server list is an X.509 v3 extension that defines a list of
-                        URLs of OCSP responders. The OCSP responders can be queried for the
-                        revocation status of an issued certificate. If not set, the
-                        certificate will be issued with no OCSP servers set. For example, an
-                        OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
-                      type: array
-                      items:
-                        type: string
-                    secretName:
-                      description: |-
-                        SecretName is the name of the secret used to sign Certificates issued
-                        by this Issuer.
-                      type: string
-                selfSigned:
-                  description: |-
-                    SelfSigned configures this issuer to 'self sign' certificates using the
-                    private key used to create the CertificateRequest object.
-                  type: object
-                  properties:
-                    crlDistributionPoints:
-                      description: |-
-                        The CRL distribution points is an X.509 v3 certificate extension which identifies
-                        the location of the CRL from which the revocation of this certificate can be checked.
-                        If not set certificate will be issued without CDP. Values are strings.
-                      type: array
-                      items:
-                        type: string
-                vault:
-                  description: |-
-                    Vault configures this issuer to sign certificates using a HashiCorp Vault
-                    PKI backend.
-                  type: object
-                  required:
-                    - auth
-                    - path
-                    - server
-                  properties:
-                    auth:
-                      description: Auth configures how cert-manager authenticates with the Vault server.
-                      type: object
-                      properties:
-                        appRole:
-                          description: |-
-                            AppRole authenticates with Vault using the App Role auth mechanism,
-                            with the role and secret stored in a Kubernetes Secret resource.
-                          type: object
-                          required:
-                            - path
-                            - roleId
-                            - secretRef
-                          properties:
-                            path:
-                              description: |-
-                                Path where the App Role authentication backend is mounted in Vault, e.g:
-                                "approle"
-                              type: string
-                            roleId:
-                              description: |-
-                                RoleID configured in the App Role authentication backend when setting
-                                up the authentication backend in Vault.
-                              type: string
-                            secretRef:
-                              description: |-
-                                Reference to a key in a Secret that contains the App Role secret used
-                                to authenticate with Vault.
-                                The `key` field must be specified and denotes which entry within the Secret
-                                resource is used as the app role secret.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                        clientCertificate:
-                          description: |-
-                            ClientCertificate authenticates with Vault by presenting a client
-                            certificate during the request's TLS handshake.
-                            Works only when using HTTPS protocol.
-                          type: object
-                          properties:
-                            mountPath:
-                              description: |-
-                                The Vault mountPath here is the mount path to use when authenticating with
-                                Vault. For example, setting a value to `/v1/auth/foo`, will use the path
-                                `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
-                                default value "/v1/auth/cert" will be used.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the certificate role to authenticate against.
-                                If not set, matching any certificate role, if available.
-                              type: string
-                            secretName:
-                              description: |-
-                                Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing
-                                tls.crt and tls.key) used to authenticate to Vault using TLS client
-                                authentication.
-                              type: string
-                        kubernetes:
-                          description: |-
-                            Kubernetes authenticates with Vault by passing the ServiceAccount
-                            token stored in the named Secret resource to the Vault server.
-                          type: object
-                          required:
-                            - role
-                          properties:
-                            mountPath:
-                              description: |-
-                                The Vault mountPath here is the mount path to use when authenticating with
-                                Vault. For example, setting a value to `/v1/auth/foo`, will use the path
-                                `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
-                                default value "/v1/auth/kubernetes" will be used.
-                              type: string
-                            role:
-                              description: |-
-                                A required field containing the Vault Role to assume. A Role binds a
-                                Kubernetes ServiceAccount with a set of Vault policies.
-                              type: string
-                            secretRef:
-                              description: |-
-                                The required Secret field containing a Kubernetes ServiceAccount JWT used
-                                for authenticating with Vault. Use of 'ambient credentials' is not
-                                supported.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            serviceAccountRef:
-                              description: |-
-                                A reference to a service account that will be used to request a bound
-                                token (also known as "projected token"). Compared to using "secretRef",
-                                using this field means that you don't rely on statically bound tokens. To
-                                use this field, you must configure an RBAC rule to let cert-manager
-                                request a token.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                audiences:
-                                  description: |-
-                                    TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token
-                                    consisting of the issuer's namespace and name is always included.
-                                  type: array
-                                  items:
-                                    type: string
-                                name:
-                                  description: Name of the ServiceAccount used to request a token.
-                                  type: string
-                        tokenSecretRef:
-                          description: TokenSecretRef authenticates with Vault by presenting a token.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                    caBundle:
-                      description: |-
-                        Base64-encoded bundle of PEM CAs which will be used to validate the certificate
-                        chain presented by Vault. Only used if using HTTPS to connect to Vault and
-                        ignored for HTTP connections.
-                        Mutually exclusive with CABundleSecretRef.
-                        If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
-                        the cert-manager controller container is used to validate the TLS connection.
-                      type: string
-                      format: byte
-                    caBundleSecretRef:
-                      description: |-
-                        Reference to a Secret containing a bundle of PEM-encoded CAs to use when
-                        verifying the certificate chain presented by Vault when using HTTPS.
-                        Mutually exclusive with CABundle.
-                        If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
-                        the cert-manager controller container is used to validate the TLS connection.
-                        If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
-                      type: object
-                      required:
-                        - name
-                      properties:
-                        key:
-                          description: |-
-                            The key of the entry in the Secret resource's `data` field to be used.
-                            Some instances of this field may be defaulted, in others it may be
-                            required.
-                          type: string
-                        name:
-                          description: |-
-                            Name of the resource being referred to.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                    clientCertSecretRef:
-                      description: |-
-                        Reference to a Secret containing a PEM-encoded Client Certificate to use when the
-                        Vault server requires mTLS.
-                      type: object
-                      required:
-                        - name
-                      properties:
-                        key:
-                          description: |-
-                            The key of the entry in the Secret resource's `data` field to be used.
-                            Some instances of this field may be defaulted, in others it may be
-                            required.
-                          type: string
-                        name:
-                          description: |-
-                            Name of the resource being referred to.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                    clientKeySecretRef:
-                      description: |-
-                        Reference to a Secret containing a PEM-encoded Client Private Key to use when the
-                        Vault server requires mTLS.
-                      type: object
-                      required:
-                        - name
-                      properties:
-                        key:
-                          description: |-
-                            The key of the entry in the Secret resource's `data` field to be used.
-                            Some instances of this field may be defaulted, in others it may be
-                            required.
-                          type: string
-                        name:
-                          description: |-
-                            Name of the resource being referred to.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                    namespace:
-                      description: |-
-                        Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1"
-                        More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
-                      type: string
-                    path:
-                      description: |-
-                        Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
-                        "my_pki_mount/sign/my-role-name".
-                      type: string
-                    server:
-                      description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
-                      type: string
-                venafi:
-                  description: |-
-                    Venafi configures this issuer to sign certificates using a Venafi TPP
-                    or Venafi Cloud policy zone.
-                  type: object
-                  required:
-                    - zone
-                  properties:
-                    cloud:
-                      description: |-
-                        Cloud specifies the Venafi cloud configuration settings.
-                        Only one of TPP or Cloud may be specified.
-                      type: object
-                      required:
-                        - apiTokenSecretRef
-                      properties:
-                        apiTokenSecretRef:
-                          description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                        url:
-                          description: |-
-                            URL is the base URL for Venafi Cloud.
-                            Defaults to "https://api.venafi.cloud/v1".
-                          type: string
-                    tpp:
-                      description: |-
-                        TPP specifies Trust Protection Platform configuration settings.
-                        Only one of TPP or Cloud may be specified.
-                      type: object
-                      required:
-                        - credentialsRef
-                        - url
-                      properties:
-                        caBundle:
-                          description: |-
-                            Base64-encoded bundle of PEM CAs which will be used to validate the certificate
-                            chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
-                            If undefined, the certificate bundle in the cert-manager controller container
-                            is used to validate the chain.
-                          type: string
-                          format: byte
-                        caBundleSecretRef:
-                          description: |-
-                            Reference to a Secret containing a base64-encoded bundle of PEM CAs
-                            which will be used to validate the certificate chain presented by the TPP server.
-                            Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
-                            If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
-                            the cert-manager controller container is used to validate the TLS connection.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                        credentialsRef:
-                          description: |-
-                            CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.
-                            The secret must contain the key 'access-token' for the Access Token Authentication,
-                            or two keys, 'username' and 'password' for the API Keys Authentication.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                        url:
-                          description: |-
-                            URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
-                            for example: "https://tpp.example.com/vedsdk".
-                          type: string
-                    zone:
-                      description: |-
-                        Zone is the Venafi Policy Zone to use for this issuer.
-                        All requests made to the Venafi platform will be restricted by the named
-                        zone policy.
-                        This field is required.
-                      type: string
-            status:
-              description: Status of the Issuer. This is set and managed automatically.
-              type: object
-              properties:
-                acme:
-                  description: |-
-                    ACME specific status options.
-                    This field should only be set if the Issuer is configured to use an ACME
-                    server to issue certificates.
-                  type: object
-                  properties:
-                    lastPrivateKeyHash:
-                      description: |-
-                        LastPrivateKeyHash is a hash of the private key associated with the latest
-                        registered ACME account, in order to track changes made to registered account
-                        associated with the Issuer
-                      type: string
-                    lastRegisteredEmail:
-                      description: |-
-                        LastRegisteredEmail is the email associated with the latest registered
-                        ACME account, in order to track changes made to registered account
-                        associated with the  Issuer
-                      type: string
-                    uri:
-                      description: |-
-                        URI is the unique account identifier, which can also be used to retrieve
-                        account details from the CA
-                      type: string
-                conditions:
-                  description: |-
-                    List of status conditions to indicate the status of a CertificateRequest.
-                    Known condition types are `Ready`.
-                  type: array
-                  items:
-                    description: IssuerCondition contains condition information for an Issuer.
-                    type: object
-                    required:
-                      - status
-                      - type
-                    properties:
-                      lastTransitionTime:
-                        description: |-
-                          LastTransitionTime is the timestamp corresponding to the last status
-                          change of this condition.
-                        type: string
-                        format: date-time
-                      message:
-                        description: |-
-                          Message is a human readable description of the details of the last
-                          transition, complementing reason.
-                        type: string
-                      observedGeneration:
-                        description: |-
-                          If set, this represents the .metadata.generation that the condition was
-                          set based upon.
-                          For instance, if .metadata.generation is currently 12, but the
-                          .status.condition[x].observedGeneration is 9, the condition is out of date
-                          with respect to the current state of the Issuer.
-                        type: integer
-                        format: int64
-                      reason:
-                        description: |-
-                          Reason is a brief machine readable explanation for the condition's last
-                          transition.
-                        type: string
-                      status:
-                        description: Status of the condition, one of (`True`, `False`, `Unknown`).
-                        type: string
-                        enum:
-                          - "True"
-                          - "False"
-                          - Unknown
-                      type:
-                        description: Type of the condition, known values are (`Ready`).
-                        type: string
-                  x-kubernetes-list-map-keys:
-                    - type
-                  x-kubernetes-list-type: map
-      served: true
-      storage: true
-
-# END crd {{- end }}
-
----
-# START crd {{- if or .Values.crds.enabled .Values.installCRDs }}
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: orders.acme.cert-manager.io
-  # START annotations {{- if .Values.crds.keep }}
-  annotations:
-    helm.sh/resource-policy: keep
-  # END annotations {{- end }}
-  labels:
-    app: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/instance: '{{ .Release.Name }}'
-    app.kubernetes.io/component: "crds"
-    # Generated labels {{- include "labels" . | nindent 4 }}
-spec:
-  group: acme.cert-manager.io
-  names:
-    kind: Order
-    listKind: OrderList
-    plural: orders
-    singular: order
-    categories:
-      - cert-manager
-      - cert-manager-acme
-  scope: Namespaced
-  versions:
-    - name: v1
-      subresources:
-        status: {}
-      additionalPrinterColumns:
-        - jsonPath: .status.state
-          name: State
-          type: string
-        - jsonPath: .spec.issuerRef.name
-          name: Issuer
-          priority: 1
-          type: string
-        - jsonPath: .status.reason
-          name: Reason
-          priority: 1
-          type: string
-        - jsonPath: .metadata.creationTimestamp
-          description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
-          name: Age
-          type: date
-      schema:
-        openAPIV3Schema:
-          description: Order is a type to represent an Order with an ACME server
-          type: object
-          required:
-            - metadata
-            - spec
-          properties:
-            apiVersion:
-              description: |-
-                APIVersion defines the versioned schema of this representation of an object.
-                Servers should convert recognized schemas to the latest internal value, and
-                may reject unrecognized values.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-              type: string
-            kind:
-              description: |-
-                Kind is a string value representing the REST resource this object represents.
-                Servers may infer this from the endpoint the client submits requests to.
-                Cannot be updated.
-                In CamelCase.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-              type: string
-            metadata:
-              type: object
-            spec:
-              type: object
-              required:
-                - issuerRef
-                - request
-              properties:
-                commonName:
-                  description: |-
-                    CommonName is the common name as specified on the DER encoded CSR.
-                    If specified, this value must also be present in `dnsNames` or `ipAddresses`.
-                    This field must match the corresponding field on the DER encoded CSR.
-                  type: string
-                dnsNames:
-                  description: |-
-                    DNSNames is a list of DNS names that should be included as part of the Order
-                    validation process.
-                    This field must match the corresponding field on the DER encoded CSR.
-                  type: array
-                  items:
-                    type: string
-                duration:
-                  description: |-
-                    Duration is the duration for the not after date for the requested certificate.
-                    this is set on order creation as pe the ACME spec.
-                  type: string
-                ipAddresses:
-                  description: |-
-                    IPAddresses is a list of IP addresses that should be included as part of the Order
-                    validation process.
-                    This field must match the corresponding field on the DER encoded CSR.
-                  type: array
-                  items:
-                    type: string
-                issuerRef:
-                  description: |-
-                    IssuerRef references a properly configured ACME-type Issuer which should
-                    be used to create this Order.
-                    If the Issuer does not exist, processing will be retried.
-                    If the Issuer is not an 'ACME' Issuer, an error will be returned and the
-                    Order will be marked as failed.
-                  type: object
-                  required:
-                    - name
-                  properties:
-                    group:
-                      description: Group of the resource being referred to.
-                      type: string
-                    kind:
-                      description: Kind of the resource being referred to.
-                      type: string
-                    name:
-                      description: Name of the resource being referred to.
-                      type: string
-                request:
-                  description: |-
-                    Certificate signing request bytes in DER encoding.
-                    This will be used when finalizing the order.
-                    This field must be set on the order.
-                  type: string
-                  format: byte
-            status:
-              type: object
-              properties:
-                authorizations:
-                  description: |-
-                    Authorizations contains data returned from the ACME server on what
-                    authorizations must be completed in order to validate the DNS names
-                    specified on the Order.
-                  type: array
-                  items:
-                    description: |-
-                      ACMEAuthorization contains data returned from the ACME server on an
-                      authorization that must be completed in order validate a DNS name on an ACME
-                      Order resource.
-                    type: object
-                    required:
-                      - url
-                    properties:
-                      challenges:
-                        description: |-
-                          Challenges specifies the challenge types offered by the ACME server.
-                          One of these challenge types will be selected when validating the DNS
-                          name and an appropriate Challenge resource will be created to perform
-                          the ACME challenge process.
-                        type: array
-                        items:
-                          description: |-
-                            Challenge specifies a challenge offered by the ACME server for an Order.
-                            An appropriate Challenge resource can be created to perform the ACME
-                            challenge process.
-                          type: object
-                          required:
-                            - token
-                            - type
-                            - url
-                          properties:
-                            token:
-                              description: |-
-                                Token is the token that must be presented for this challenge.
-                                This is used to compute the 'key' that must also be presented.
-                              type: string
-                            type:
-                              description: |-
-                                Type is the type of challenge being offered, e.g. 'http-01', 'dns-01',
-                                'tls-sni-01', etc.
-                                This is the raw value retrieved from the ACME server.
-                                Only 'http-01' and 'dns-01' are supported by cert-manager, other values
-                                will be ignored.
-                              type: string
-                            url:
-                              description: |-
-                                URL is the URL of this challenge. It can be used to retrieve additional
-                                metadata about the Challenge from the ACME server.
-                              type: string
-                      identifier:
-                        description: Identifier is the DNS name to be validated as part of this authorization
-                        type: string
-                      initialState:
-                        description: |-
-                          InitialState is the initial state of the ACME authorization when first
-                          fetched from the ACME server.
-                          If an Authorization is already 'valid', the Order controller will not
-                          create a Challenge resource for the authorization. This will occur when
-                          working with an ACME server that enables 'authz reuse' (such as Let's
-                          Encrypt's production endpoint).
-                          If not set and 'identifier' is set, the state is assumed to be pending
-                          and a Challenge will be created.
-                        type: string
-                        enum:
-                          - valid
-                          - ready
-                          - pending
-                          - processing
-                          - invalid
-                          - expired
-                          - errored
-                      url:
-                        description: URL is the URL of the Authorization that must be completed
-                        type: string
-                      wildcard:
-                        description: |-
-                          Wildcard will be true if this authorization is for a wildcard DNS name.
-                          If this is true, the identifier will be the *non-wildcard* version of
-                          the DNS name.
-                          For example, if '*.example.com' is the DNS name being validated, this
-                          field will be 'true' and the 'identifier' field will be 'example.com'.
-                        type: boolean
-                certificate:
-                  description: |-
-                    Certificate is a copy of the PEM encoded certificate for this Order.
-                    This field will be populated after the order has been successfully
-                    finalized with the ACME server, and the order has transitioned to the
-                    'valid' state.
-                  type: string
-                  format: byte
-                failureTime:
-                  description: |-
-                    FailureTime stores the time that this order failed.
-                    This is used to influence garbage collection and back-off.
-                  type: string
-                  format: date-time
-                finalizeURL:
-                  description: |-
-                    FinalizeURL of the Order.
-                    This is used to obtain certificates for this order once it has been completed.
-                  type: string
-                reason:
-                  description: |-
-                    Reason optionally provides more information about a why the order is in
-                    the current state.
-                  type: string
-                state:
-                  description: |-
-                    State contains the current state of this Order resource.
-                    States 'success' and 'expired' are 'final'
-                  type: string
-                  enum:
-                    - valid
-                    - ready
-                    - pending
-                    - processing
-                    - invalid
-                    - expired
-                    - errored
-                url:
-                  description: |-
-                    URL of the Order.
-                    This will initially be empty when the resource is first created.
-                    The Order controller will populate this field when the Order is first processed.
-                    This field will be immutable after it is initially set.
-                  type: string
-      served: true
-      storage: true
-
-# END crd {{- end }}
diff --git a/packages/system/cert-manager-crds/charts/cert-manager/values.schema.json b/packages/system/cert-manager-crds/charts/cert-manager/values.schema.json
deleted file mode 100644
index d04da90c..00000000
--- a/packages/system/cert-manager-crds/charts/cert-manager/values.schema.json
+++ /dev/null
@@ -1,2135 +0,0 @@
-{
-  "$defs": {
-    "helm-values": {
-      "additionalProperties": false,
-      "properties": {
-        "acmesolver": {
-          "$ref": "#/$defs/helm-values.acmesolver"
-        },
-        "affinity": {
-          "$ref": "#/$defs/helm-values.affinity"
-        },
-        "approveSignerNames": {
-          "$ref": "#/$defs/helm-values.approveSignerNames"
-        },
-        "automountServiceAccountToken": {
-          "$ref": "#/$defs/helm-values.automountServiceAccountToken"
-        },
-        "cainjector": {
-          "$ref": "#/$defs/helm-values.cainjector"
-        },
-        "clusterResourceNamespace": {
-          "$ref": "#/$defs/helm-values.clusterResourceNamespace"
-        },
-        "config": {
-          "$ref": "#/$defs/helm-values.config"
-        },
-        "containerSecurityContext": {
-          "$ref": "#/$defs/helm-values.containerSecurityContext"
-        },
-        "crds": {
-          "$ref": "#/$defs/helm-values.crds"
-        },
-        "creator": {
-          "$ref": "#/$defs/helm-values.creator"
-        },
-        "deploymentAnnotations": {
-          "$ref": "#/$defs/helm-values.deploymentAnnotations"
-        },
-        "disableAutoApproval": {
-          "$ref": "#/$defs/helm-values.disableAutoApproval"
-        },
-        "dns01RecursiveNameservers": {
-          "$ref": "#/$defs/helm-values.dns01RecursiveNameservers"
-        },
-        "dns01RecursiveNameserversOnly": {
-          "$ref": "#/$defs/helm-values.dns01RecursiveNameserversOnly"
-        },
-        "enableCertificateOwnerRef": {
-          "$ref": "#/$defs/helm-values.enableCertificateOwnerRef"
-        },
-        "enableServiceLinks": {
-          "$ref": "#/$defs/helm-values.enableServiceLinks"
-        },
-        "enabled": {
-          "$ref": "#/$defs/helm-values.enabled"
-        },
-        "extraArgs": {
-          "$ref": "#/$defs/helm-values.extraArgs"
-        },
-        "extraEnv": {
-          "$ref": "#/$defs/helm-values.extraEnv"
-        },
-        "extraObjects": {
-          "$ref": "#/$defs/helm-values.extraObjects"
-        },
-        "featureGates": {
-          "$ref": "#/$defs/helm-values.featureGates"
-        },
-        "fullnameOverride": {
-          "$ref": "#/$defs/helm-values.fullnameOverride"
-        },
-        "global": {
-          "$ref": "#/$defs/helm-values.global"
-        },
-        "hostAliases": {
-          "$ref": "#/$defs/helm-values.hostAliases"
-        },
-        "http_proxy": {
-          "$ref": "#/$defs/helm-values.http_proxy"
-        },
-        "https_proxy": {
-          "$ref": "#/$defs/helm-values.https_proxy"
-        },
-        "image": {
-          "$ref": "#/$defs/helm-values.image"
-        },
-        "ingressShim": {
-          "$ref": "#/$defs/helm-values.ingressShim"
-        },
-        "installCRDs": {
-          "$ref": "#/$defs/helm-values.installCRDs"
-        },
-        "livenessProbe": {
-          "$ref": "#/$defs/helm-values.livenessProbe"
-        },
-        "maxConcurrentChallenges": {
-          "$ref": "#/$defs/helm-values.maxConcurrentChallenges"
-        },
-        "nameOverride": {
-          "$ref": "#/$defs/helm-values.nameOverride"
-        },
-        "namespace": {
-          "$ref": "#/$defs/helm-values.namespace"
-        },
-        "no_proxy": {
-          "$ref": "#/$defs/helm-values.no_proxy"
-        },
-        "nodeSelector": {
-          "$ref": "#/$defs/helm-values.nodeSelector"
-        },
-        "podAnnotations": {
-          "$ref": "#/$defs/helm-values.podAnnotations"
-        },
-        "podDisruptionBudget": {
-          "$ref": "#/$defs/helm-values.podDisruptionBudget"
-        },
-        "podDnsConfig": {
-          "$ref": "#/$defs/helm-values.podDnsConfig"
-        },
-        "podDnsPolicy": {
-          "$ref": "#/$defs/helm-values.podDnsPolicy"
-        },
-        "podLabels": {
-          "$ref": "#/$defs/helm-values.podLabels"
-        },
-        "prometheus": {
-          "$ref": "#/$defs/helm-values.prometheus"
-        },
-        "replicaCount": {
-          "$ref": "#/$defs/helm-values.replicaCount"
-        },
-        "resources": {
-          "$ref": "#/$defs/helm-values.resources"
-        },
-        "securityContext": {
-          "$ref": "#/$defs/helm-values.securityContext"
-        },
-        "serviceAccount": {
-          "$ref": "#/$defs/helm-values.serviceAccount"
-        },
-        "serviceAnnotations": {
-          "$ref": "#/$defs/helm-values.serviceAnnotations"
-        },
-        "serviceIPFamilies": {
-          "$ref": "#/$defs/helm-values.serviceIPFamilies"
-        },
-        "serviceIPFamilyPolicy": {
-          "$ref": "#/$defs/helm-values.serviceIPFamilyPolicy"
-        },
-        "serviceLabels": {
-          "$ref": "#/$defs/helm-values.serviceLabels"
-        },
-        "startupapicheck": {
-          "$ref": "#/$defs/helm-values.startupapicheck"
-        },
-        "strategy": {
-          "$ref": "#/$defs/helm-values.strategy"
-        },
-        "tolerations": {
-          "$ref": "#/$defs/helm-values.tolerations"
-        },
-        "topologySpreadConstraints": {
-          "$ref": "#/$defs/helm-values.topologySpreadConstraints"
-        },
-        "volumeMounts": {
-          "$ref": "#/$defs/helm-values.volumeMounts"
-        },
-        "volumes": {
-          "$ref": "#/$defs/helm-values.volumes"
-        },
-        "webhook": {
-          "$ref": "#/$defs/helm-values.webhook"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.acmesolver": {
-      "additionalProperties": false,
-      "properties": {
-        "image": {
-          "$ref": "#/$defs/helm-values.acmesolver.image"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.acmesolver.image": {
-      "additionalProperties": false,
-      "properties": {
-        "digest": {
-          "$ref": "#/$defs/helm-values.acmesolver.image.digest"
-        },
-        "pullPolicy": {
-          "$ref": "#/$defs/helm-values.acmesolver.image.pullPolicy"
-        },
-        "registry": {
-          "$ref": "#/$defs/helm-values.acmesolver.image.registry"
-        },
-        "repository": {
-          "$ref": "#/$defs/helm-values.acmesolver.image.repository"
-        },
-        "tag": {
-          "$ref": "#/$defs/helm-values.acmesolver.image.tag"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.acmesolver.image.digest": {
-      "description": "Setting a digest will override any tag.",
-      "type": "string"
-    },
-    "helm-values.acmesolver.image.pullPolicy": {
-      "default": "IfNotPresent",
-      "description": "Kubernetes imagePullPolicy on Deployment.",
-      "type": "string"
-    },
-    "helm-values.acmesolver.image.registry": {
-      "description": "The container registry to pull the acmesolver image from.",
-      "type": "string"
-    },
-    "helm-values.acmesolver.image.repository": {
-      "default": "quay.io/jetstack/cert-manager-acmesolver",
-      "description": "The container image for the cert-manager acmesolver.",
-      "type": "string"
-    },
-    "helm-values.acmesolver.image.tag": {
-      "description": "Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.",
-      "type": "string"
-    },
-    "helm-values.affinity": {
-      "default": {},
-      "description": "A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).\n\nFor example:\naffinity:\n  nodeAffinity:\n   requiredDuringSchedulingIgnoredDuringExecution:\n     nodeSelectorTerms:\n     - matchExpressions:\n       - key: foo.bar.com/role\n         operator: In\n         values:\n         - master",
-      "type": "object"
-    },
-    "helm-values.approveSignerNames": {
-      "default": [
-        "issuers.cert-manager.io/*",
-        "clusterissuers.cert-manager.io/*"
-      ],
-      "description": "List of signer names that cert-manager will approve by default. CertificateRequests referencing these signer names will be auto-approved by cert-manager. Defaults to just approving the cert-manager.io Issuer and ClusterIssuer issuers. When set to an empty array, ALL issuers will be auto-approved by cert-manager. To disable the auto-approval, because eg. you are using approver-policy, you can enable 'disableAutoApproval'.\nref: https://cert-manager.io/docs/concepts/certificaterequest/#approval",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.automountServiceAccountToken": {
-      "description": "Automounting API credentials for a particular pod.",
-      "type": "boolean"
-    },
-    "helm-values.cainjector": {
-      "additionalProperties": false,
-      "properties": {
-        "affinity": {
-          "$ref": "#/$defs/helm-values.cainjector.affinity"
-        },
-        "automountServiceAccountToken": {
-          "$ref": "#/$defs/helm-values.cainjector.automountServiceAccountToken"
-        },
-        "config": {
-          "$ref": "#/$defs/helm-values.cainjector.config"
-        },
-        "containerSecurityContext": {
-          "$ref": "#/$defs/helm-values.cainjector.containerSecurityContext"
-        },
-        "deploymentAnnotations": {
-          "$ref": "#/$defs/helm-values.cainjector.deploymentAnnotations"
-        },
-        "enableServiceLinks": {
-          "$ref": "#/$defs/helm-values.cainjector.enableServiceLinks"
-        },
-        "enabled": {
-          "$ref": "#/$defs/helm-values.cainjector.enabled"
-        },
-        "extraArgs": {
-          "$ref": "#/$defs/helm-values.cainjector.extraArgs"
-        },
-        "extraEnv": {
-          "$ref": "#/$defs/helm-values.cainjector.extraEnv"
-        },
-        "featureGates": {
-          "$ref": "#/$defs/helm-values.cainjector.featureGates"
-        },
-        "image": {
-          "$ref": "#/$defs/helm-values.cainjector.image"
-        },
-        "nodeSelector": {
-          "$ref": "#/$defs/helm-values.cainjector.nodeSelector"
-        },
-        "podAnnotations": {
-          "$ref": "#/$defs/helm-values.cainjector.podAnnotations"
-        },
-        "podDisruptionBudget": {
-          "$ref": "#/$defs/helm-values.cainjector.podDisruptionBudget"
-        },
-        "podLabels": {
-          "$ref": "#/$defs/helm-values.cainjector.podLabels"
-        },
-        "replicaCount": {
-          "$ref": "#/$defs/helm-values.cainjector.replicaCount"
-        },
-        "resources": {
-          "$ref": "#/$defs/helm-values.cainjector.resources"
-        },
-        "securityContext": {
-          "$ref": "#/$defs/helm-values.cainjector.securityContext"
-        },
-        "serviceAccount": {
-          "$ref": "#/$defs/helm-values.cainjector.serviceAccount"
-        },
-        "serviceAnnotations": {
-          "$ref": "#/$defs/helm-values.cainjector.serviceAnnotations"
-        },
-        "serviceLabels": {
-          "$ref": "#/$defs/helm-values.cainjector.serviceLabels"
-        },
-        "strategy": {
-          "$ref": "#/$defs/helm-values.cainjector.strategy"
-        },
-        "tolerations": {
-          "$ref": "#/$defs/helm-values.cainjector.tolerations"
-        },
-        "topologySpreadConstraints": {
-          "$ref": "#/$defs/helm-values.cainjector.topologySpreadConstraints"
-        },
-        "volumeMounts": {
-          "$ref": "#/$defs/helm-values.cainjector.volumeMounts"
-        },
-        "volumes": {
-          "$ref": "#/$defs/helm-values.cainjector.volumes"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.cainjector.affinity": {
-      "default": {},
-      "description": "A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).\n\nFor example:\naffinity:\n  nodeAffinity:\n   requiredDuringSchedulingIgnoredDuringExecution:\n     nodeSelectorTerms:\n     - matchExpressions:\n       - key: foo.bar.com/role\n         operator: In\n         values:\n         - master",
-      "type": "object"
-    },
-    "helm-values.cainjector.automountServiceAccountToken": {
-      "description": "Automounting API credentials for a particular pod.",
-      "type": "boolean"
-    },
-    "helm-values.cainjector.config": {
-      "default": {},
-      "description": "This is used to configure options for the cainjector pod. It allows setting options that are usually provided via flags.\n\nIf `apiVersion` and `kind` are unspecified they default to the current latest version (currently `cainjector.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.\n\nFor example:\napiVersion: cainjector.config.cert-manager.io/v1alpha1\nkind: CAInjectorConfiguration\nlogging:\n verbosity: 2\n format: text\nleaderElectionConfig:\n namespace: kube-system\n# Configure the metrics server for TLS\n# See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls\nmetricsTLSConfig:\n  dynamic:\n    secretNamespace: \"cert-manager\"\n    secretName: \"cert-manager-metrics-ca\"\n    dnsNames:\n    - cert-manager-metrics",
-      "type": "object"
-    },
-    "helm-values.cainjector.containerSecurityContext": {
-      "default": {
-        "allowPrivilegeEscalation": false,
-        "capabilities": {
-          "drop": [
-            "ALL"
-          ]
-        },
-        "readOnlyRootFilesystem": true
-      },
-      "description": "Container Security Context to be set on the cainjector component container. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).",
-      "type": "object"
-    },
-    "helm-values.cainjector.deploymentAnnotations": {
-      "description": "Optional additional annotations to add to the cainjector Deployment.",
-      "type": "object"
-    },
-    "helm-values.cainjector.enableServiceLinks": {
-      "default": false,
-      "description": "enableServiceLinks indicates whether information about services should be injected into the pod's environment variables, matching the syntax of Docker links.",
-      "type": "boolean"
-    },
-    "helm-values.cainjector.enabled": {
-      "default": true,
-      "description": "Create the CA Injector deployment",
-      "type": "boolean"
-    },
-    "helm-values.cainjector.extraArgs": {
-      "default": [],
-      "description": "Additional command line flags to pass to cert-manager cainjector binary. To see all available flags run `docker run quay.io/jetstack/cert-manager-cainjector:<version> --help`.",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.cainjector.extraEnv": {
-      "default": [],
-      "description": "Additional environment variables to pass to cert-manager cainjector binary.\nFor example:\nextraEnv:\n- name: SOME_VAR\n  value: 'some value'",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.cainjector.featureGates": {
-      "default": "",
-      "description": "Comma separated list of feature gates that should be enabled on the cainjector pod.",
-      "type": "string"
-    },
-    "helm-values.cainjector.image": {
-      "additionalProperties": false,
-      "properties": {
-        "digest": {
-          "$ref": "#/$defs/helm-values.cainjector.image.digest"
-        },
-        "pullPolicy": {
-          "$ref": "#/$defs/helm-values.cainjector.image.pullPolicy"
-        },
-        "registry": {
-          "$ref": "#/$defs/helm-values.cainjector.image.registry"
-        },
-        "repository": {
-          "$ref": "#/$defs/helm-values.cainjector.image.repository"
-        },
-        "tag": {
-          "$ref": "#/$defs/helm-values.cainjector.image.tag"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.cainjector.image.digest": {
-      "description": "Setting a digest will override any tag.",
-      "type": "string"
-    },
-    "helm-values.cainjector.image.pullPolicy": {
-      "default": "IfNotPresent",
-      "description": "Kubernetes imagePullPolicy on Deployment.",
-      "type": "string"
-    },
-    "helm-values.cainjector.image.registry": {
-      "description": "The container registry to pull the cainjector image from.",
-      "type": "string"
-    },
-    "helm-values.cainjector.image.repository": {
-      "default": "quay.io/jetstack/cert-manager-cainjector",
-      "description": "The container image for the cert-manager cainjector",
-      "type": "string"
-    },
-    "helm-values.cainjector.image.tag": {
-      "description": "Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion will be used.",
-      "type": "string"
-    },
-    "helm-values.cainjector.nodeSelector": {
-      "default": {
-        "kubernetes.io/os": "linux"
-      },
-      "description": "The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).\n\nThis default ensures that Pods are only scheduled to Linux nodes. It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.",
-      "type": "object"
-    },
-    "helm-values.cainjector.podAnnotations": {
-      "description": "Optional additional annotations to add to the cainjector Pods.",
-      "type": "object"
-    },
-    "helm-values.cainjector.podDisruptionBudget": {
-      "additionalProperties": false,
-      "properties": {
-        "enabled": {
-          "$ref": "#/$defs/helm-values.cainjector.podDisruptionBudget.enabled"
-        },
-        "maxUnavailable": {
-          "$ref": "#/$defs/helm-values.cainjector.podDisruptionBudget.maxUnavailable"
-        },
-        "minAvailable": {
-          "$ref": "#/$defs/helm-values.cainjector.podDisruptionBudget.minAvailable"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.cainjector.podDisruptionBudget.enabled": {
-      "default": false,
-      "description": "Enable or disable the PodDisruptionBudget resource.\n\nThis prevents downtime during voluntary disruptions such as during a Node upgrade. For example, the PodDisruptionBudget will block `kubectl drain` if it is used on the Node where the only remaining cert-manager\nPod is currently running.",
-      "type": "boolean"
-    },
-    "helm-values.cainjector.podDisruptionBudget.maxUnavailable": {
-      "description": "`maxUnavailable` configures the maximum unavailable pods for disruptions. It can either be set to\nan integer (e.g. 1) or a percentage value (e.g. 25%).\nCannot be used if `minAvailable` is set."
-    },
-    "helm-values.cainjector.podDisruptionBudget.minAvailable": {
-      "description": "`minAvailable` configures the minimum available pods for disruptions. It can either be set to\nan integer (e.g. 1) or a percentage value (e.g. 25%).\nCannot be used if `maxUnavailable` is set."
-    },
-    "helm-values.cainjector.podLabels": {
-      "default": {},
-      "description": "Optional additional labels to add to the CA Injector Pods.",
-      "type": "object"
-    },
-    "helm-values.cainjector.replicaCount": {
-      "default": 1,
-      "description": "The number of replicas of the cert-manager cainjector to run.\n\nThe default is 1, but in production set this to 2 or 3 to provide high availability.\n\nIf `replicas > 1`, consider setting `cainjector.podDisruptionBudget.enabled=true`.\n\nNote that cert-manager uses leader election to ensure that there can only be a single instance active at a time.",
-      "type": "number"
-    },
-    "helm-values.cainjector.resources": {
-      "default": {},
-      "description": "Resources to provide to the cert-manager cainjector pod.\n\nFor example:\nrequests:\n  cpu: 10m\n  memory: 32Mi\nFor more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).",
-      "type": "object"
-    },
-    "helm-values.cainjector.securityContext": {
-      "default": {
-        "runAsNonRoot": true,
-        "seccompProfile": {
-          "type": "RuntimeDefault"
-        }
-      },
-      "description": "Pod Security Context to be set on the cainjector component Pod. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).",
-      "type": "object"
-    },
-    "helm-values.cainjector.serviceAccount": {
-      "additionalProperties": false,
-      "properties": {
-        "annotations": {
-          "$ref": "#/$defs/helm-values.cainjector.serviceAccount.annotations"
-        },
-        "automountServiceAccountToken": {
-          "$ref": "#/$defs/helm-values.cainjector.serviceAccount.automountServiceAccountToken"
-        },
-        "create": {
-          "$ref": "#/$defs/helm-values.cainjector.serviceAccount.create"
-        },
-        "labels": {
-          "$ref": "#/$defs/helm-values.cainjector.serviceAccount.labels"
-        },
-        "name": {
-          "$ref": "#/$defs/helm-values.cainjector.serviceAccount.name"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.cainjector.serviceAccount.annotations": {
-      "description": "Optional additional annotations to add to the cainjector's Service Account.",
-      "type": "object"
-    },
-    "helm-values.cainjector.serviceAccount.automountServiceAccountToken": {
-      "default": true,
-      "description": "Automount API credentials for a Service Account.",
-      "type": "boolean"
-    },
-    "helm-values.cainjector.serviceAccount.create": {
-      "default": true,
-      "description": "Specifies whether a service account should be created.",
-      "type": "boolean"
-    },
-    "helm-values.cainjector.serviceAccount.labels": {
-      "description": "Optional additional labels to add to the cainjector's Service Account.",
-      "type": "object"
-    },
-    "helm-values.cainjector.serviceAccount.name": {
-      "description": "The name of the service account to use.\nIf not set and create is true, a name is generated using the fullname template",
-      "type": "string"
-    },
-    "helm-values.cainjector.serviceAnnotations": {
-      "description": "Optional additional annotations to add to the cainjector metrics Service.",
-      "type": "object"
-    },
-    "helm-values.cainjector.serviceLabels": {
-      "default": {},
-      "description": "Optional additional labels to add to the CA Injector metrics Service.",
-      "type": "object"
-    },
-    "helm-values.cainjector.strategy": {
-      "default": {},
-      "description": "Deployment update strategy for the cert-manager cainjector deployment. For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy).\n\nFor example:\nstrategy:\n  type: RollingUpdate\n  rollingUpdate:\n    maxSurge: 0\n    maxUnavailable: 1",
-      "type": "object"
-    },
-    "helm-values.cainjector.tolerations": {
-      "default": [],
-      "description": "A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).\n\nFor example:\ntolerations:\n- key: foo.bar.com/role\n  operator: Equal\n  value: master\n  effect: NoSchedule",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.cainjector.topologySpreadConstraints": {
-      "default": [],
-      "description": "A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core).\n\nFor example:\ntopologySpreadConstraints:\n- maxSkew: 2\n  topologyKey: topology.kubernetes.io/zone\n  whenUnsatisfiable: ScheduleAnyway\n  labelSelector:\n    matchLabels:\n      app.kubernetes.io/instance: cert-manager\n      app.kubernetes.io/component: controller",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.cainjector.volumeMounts": {
-      "default": [],
-      "description": "Additional volume mounts to add to the cert-manager controller container.",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.cainjector.volumes": {
-      "default": [],
-      "description": "Additional volumes to add to the cert-manager controller pod.",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.clusterResourceNamespace": {
-      "default": "",
-      "description": "Override the namespace used to store DNS provider credentials etc. for ClusterIssuer resources. By default, the same namespace as cert-manager is deployed within is used. This namespace will not be automatically created by the Helm chart.",
-      "type": "string"
-    },
-    "helm-values.config": {
-      "default": {},
-      "description": "This property is used to configure options for the controller pod. This allows setting options that would usually be provided using flags.\n\nIf `apiVersion` and `kind` are unspecified they default to the current latest version (currently `controller.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.\n\nFor example:\nconfig:\n  apiVersion: controller.config.cert-manager.io/v1alpha1\n  kind: ControllerConfiguration\n  logging:\n    verbosity: 2\n    format: text\n  leaderElectionConfig:\n    namespace: kube-system\n  kubernetesAPIQPS: 9000\n  kubernetesAPIBurst: 9000\n  numberOfConcurrentWorkers: 200\n  featureGates:\n    AdditionalCertificateOutputFormats: true\n    DisallowInsecureCSRUsageDefinition: true\n    ExperimentalCertificateSigningRequestControllers: true\n    ExperimentalGatewayAPISupport: true\n    LiteralCertificateSubject: true\n    SecretsFilteredCaching: true\n    ServerSideApply: true\n    StableCertificateRequestName: true\n    UseCertificateRequestBasicConstraints: true\n    ValidateCAA: true\n  # Configure the metrics server for TLS\n  # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls\n  metricsTLSConfig:\n    dynamic:\n      secretNamespace: \"cert-manager\"\n      secretName: \"cert-manager-metrics-ca\"\n      dnsNames:\n      - cert-manager-metrics",
-      "type": "object"
-    },
-    "helm-values.containerSecurityContext": {
-      "default": {
-        "allowPrivilegeEscalation": false,
-        "capabilities": {
-          "drop": [
-            "ALL"
-          ]
-        },
-        "readOnlyRootFilesystem": true
-      },
-      "description": "Container Security Context to be set on the controller component container. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).",
-      "type": "object"
-    },
-    "helm-values.crds": {
-      "additionalProperties": false,
-      "properties": {
-        "enabled": {
-          "$ref": "#/$defs/helm-values.crds.enabled"
-        },
-        "keep": {
-          "$ref": "#/$defs/helm-values.crds.keep"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.crds.enabled": {
-      "default": false,
-      "description": "This option decides if the CRDs should be installed as part of the Helm installation.",
-      "type": "boolean"
-    },
-    "helm-values.crds.keep": {
-      "default": true,
-      "description": "This option makes it so that the \"helm.sh/resource-policy\": keep annotation is added to the CRD. This will prevent Helm from uninstalling the CRD when the Helm release is uninstalled. WARNING: when the CRDs are removed, all cert-manager custom resources\n(Certificates, Issuers, ...) will be removed too by the garbage collector.",
-      "type": "boolean"
-    },
-    "helm-values.creator": {
-      "default": "helm",
-      "description": "Field used by our release pipeline to produce the static manifests. The field defaults to \"helm\" but is set to \"static\" when we render the static YAML manifests.",
-      "type": "string"
-    },
-    "helm-values.deploymentAnnotations": {
-      "description": "Optional additional annotations to add to the controller Deployment.",
-      "type": "object"
-    },
-    "helm-values.disableAutoApproval": {
-      "default": false,
-      "description": "Option to disable cert-manager's build-in auto-approver. The auto-approver approves all CertificateRequests that reference issuers matching the 'approveSignerNames' option. This 'disableAutoApproval' option is useful when you want to make all approval decisions using a different approver (like approver-policy - https://github.com/cert-manager/approver-policy).",
-      "type": "boolean"
-    },
-    "helm-values.dns01RecursiveNameservers": {
-      "default": "",
-      "description": "A comma-separated string with the host and port of the recursive nameservers cert-manager should query.",
-      "type": "string"
-    },
-    "helm-values.dns01RecursiveNameserversOnly": {
-      "default": false,
-      "description": "Forces cert-manager to use only the recursive nameservers for verification. Enabling this option could cause the DNS01 self check to take longer owing to caching performed by the recursive nameservers.",
-      "type": "boolean"
-    },
-    "helm-values.enableCertificateOwnerRef": {
-      "default": false,
-      "description": "When this flag is enabled, secrets will be automatically removed when the certificate resource is deleted.",
-      "type": "boolean"
-    },
-    "helm-values.enableServiceLinks": {
-      "default": false,
-      "description": "enableServiceLinks indicates whether information about services should be injected into the pod's environment variables, matching the syntax of Docker links.",
-      "type": "boolean"
-    },
-    "helm-values.enabled": {
-      "default": true,
-      "description": "Field that can be used as a condition when cert-manager is a dependency. This definition is only here as a placeholder such that it is included in the json schema. See https://helm.sh/docs/chart_best_practices/dependencies/#conditions-and-tags for more info.",
-      "type": "boolean"
-    },
-    "helm-values.extraArgs": {
-      "default": [],
-      "description": "Additional command line flags to pass to cert-manager controller binary. To see all available flags run `docker run quay.io/jetstack/cert-manager-controller:<version> --help`.\n\nUse this flag to enable or disable arbitrary controllers. For example, to disable the CertificateRequests approver.\n\nFor example:\nextraArgs:\n  - --controllers=*,-certificaterequests-approver",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.extraEnv": {
-      "default": [],
-      "description": "Additional environment variables to pass to cert-manager controller binary.\nFor example:\nextraEnv:\n- name: SOME_VAR\n  value: 'some value'",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.extraObjects": {
-      "default": [],
-      "description": "Create dynamic manifests via values.\n\nFor example:\nextraObjects:\n  - |\n    apiVersion: v1\n    kind: ConfigMap\n    metadata:\n      name: '{{ template \"cert-manager.fullname\" . }}-extra-configmap'",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.featureGates": {
-      "default": "",
-      "description": "A comma-separated list of feature gates that should be enabled on the controller pod.",
-      "type": "string"
-    },
-    "helm-values.fullnameOverride": {
-      "description": "Override the \"cert-manager.fullname\" value. This value is used as part of most of the names of the resources created by this Helm chart.",
-      "type": "string"
-    },
-    "helm-values.global": {
-      "description": "Global values shared across all (sub)charts",
-      "properties": {
-        "commonLabels": {
-          "$ref": "#/$defs/helm-values.global.commonLabels"
-        },
-        "imagePullSecrets": {
-          "$ref": "#/$defs/helm-values.global.imagePullSecrets"
-        },
-        "leaderElection": {
-          "$ref": "#/$defs/helm-values.global.leaderElection"
-        },
-        "logLevel": {
-          "$ref": "#/$defs/helm-values.global.logLevel"
-        },
-        "podSecurityPolicy": {
-          "$ref": "#/$defs/helm-values.global.podSecurityPolicy"
-        },
-        "priorityClassName": {
-          "$ref": "#/$defs/helm-values.global.priorityClassName"
-        },
-        "rbac": {
-          "$ref": "#/$defs/helm-values.global.rbac"
-        },
-        "revisionHistoryLimit": {
-          "$ref": "#/$defs/helm-values.global.revisionHistoryLimit"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.global.commonLabels": {
-      "default": {},
-      "description": "Labels to apply to all resources.\nPlease note that this does not add labels to the resources created dynamically by the controllers. For these resources, you have to add the labels in the template in the cert-manager custom resource: For example, podTemplate/ ingressTemplate in ACMEChallengeSolverHTTP01Ingress. For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#acme.cert-manager.io/v1.ACMEChallengeSolverHTTP01Ingress).\nFor example, secretTemplate in CertificateSpec\nFor more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec).",
-      "type": "object"
-    },
-    "helm-values.global.imagePullSecrets": {
-      "default": [],
-      "description": "Reference to one or more secrets to be used when pulling images. For more information, see [Pull an Image from a Private Registry](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/).\n\nFor example:\nimagePullSecrets:\n  - name: \"image-pull-secret\"",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.global.leaderElection": {
-      "properties": {
-        "leaseDuration": {
-          "$ref": "#/$defs/helm-values.global.leaderElection.leaseDuration"
-        },
-        "namespace": {
-          "$ref": "#/$defs/helm-values.global.leaderElection.namespace"
-        },
-        "renewDeadline": {
-          "$ref": "#/$defs/helm-values.global.leaderElection.renewDeadline"
-        },
-        "retryPeriod": {
-          "$ref": "#/$defs/helm-values.global.leaderElection.retryPeriod"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.global.leaderElection.leaseDuration": {
-      "description": "The duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate.",
-      "type": "string"
-    },
-    "helm-values.global.leaderElection.namespace": {
-      "default": "kube-system",
-      "description": "Override the namespace used for the leader election lease.",
-      "type": "string"
-    },
-    "helm-values.global.leaderElection.renewDeadline": {
-      "description": "The interval between attempts by the acting master to renew a leadership slot before it stops leading. This must be less than or equal to the lease duration.",
-      "type": "string"
-    },
-    "helm-values.global.leaderElection.retryPeriod": {
-      "description": "The duration the clients should wait between attempting acquisition and renewal of a leadership.",
-      "type": "string"
-    },
-    "helm-values.global.logLevel": {
-      "default": 2,
-      "description": "Set the verbosity of cert-manager. A range of 0 - 6, with 6 being the most verbose.",
-      "type": "number"
-    },
-    "helm-values.global.podSecurityPolicy": {
-      "properties": {
-        "enabled": {
-          "$ref": "#/$defs/helm-values.global.podSecurityPolicy.enabled"
-        },
-        "useAppArmor": {
-          "$ref": "#/$defs/helm-values.global.podSecurityPolicy.useAppArmor"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.global.podSecurityPolicy.enabled": {
-      "default": false,
-      "description": "Create PodSecurityPolicy for cert-manager.\n\nNote that PodSecurityPolicy was deprecated in Kubernetes 1.21 and removed in Kubernetes 1.25.",
-      "type": "boolean"
-    },
-    "helm-values.global.podSecurityPolicy.useAppArmor": {
-      "default": true,
-      "description": "Configure the PodSecurityPolicy to use AppArmor.",
-      "type": "boolean"
-    },
-    "helm-values.global.priorityClassName": {
-      "default": "",
-      "description": "The optional priority class to be used for the cert-manager pods.",
-      "type": "string"
-    },
-    "helm-values.global.rbac": {
-      "properties": {
-        "aggregateClusterRoles": {
-          "$ref": "#/$defs/helm-values.global.rbac.aggregateClusterRoles"
-        },
-        "create": {
-          "$ref": "#/$defs/helm-values.global.rbac.create"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.global.rbac.aggregateClusterRoles": {
-      "default": true,
-      "description": "Aggregate ClusterRoles to Kubernetes default user-facing roles. For more information, see [User-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles)",
-      "type": "boolean"
-    },
-    "helm-values.global.rbac.create": {
-      "default": true,
-      "description": "Create required ClusterRoles and ClusterRoleBindings for cert-manager.",
-      "type": "boolean"
-    },
-    "helm-values.global.revisionHistoryLimit": {
-      "description": "The number of old ReplicaSets to retain to allow rollback (if not set, the default Kubernetes value is set to 10).",
-      "type": "number"
-    },
-    "helm-values.hostAliases": {
-      "default": [],
-      "description": "Optional hostAliases for cert-manager-controller pods. May be useful when performing ACME DNS-01 self checks.",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.http_proxy": {
-      "description": "Configures the HTTP_PROXY environment variable where a HTTP proxy is required.",
-      "type": "string"
-    },
-    "helm-values.https_proxy": {
-      "description": "Configures the HTTPS_PROXY environment variable where a HTTP proxy is required.",
-      "type": "string"
-    },
-    "helm-values.image": {
-      "additionalProperties": false,
-      "properties": {
-        "digest": {
-          "$ref": "#/$defs/helm-values.image.digest"
-        },
-        "pullPolicy": {
-          "$ref": "#/$defs/helm-values.image.pullPolicy"
-        },
-        "registry": {
-          "$ref": "#/$defs/helm-values.image.registry"
-        },
-        "repository": {
-          "$ref": "#/$defs/helm-values.image.repository"
-        },
-        "tag": {
-          "$ref": "#/$defs/helm-values.image.tag"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.image.digest": {
-      "description": "Setting a digest will override any tag.",
-      "type": "string"
-    },
-    "helm-values.image.pullPolicy": {
-      "default": "IfNotPresent",
-      "description": "Kubernetes imagePullPolicy on Deployment.",
-      "type": "string"
-    },
-    "helm-values.image.registry": {
-      "description": "The container registry to pull the manager image from.",
-      "type": "string"
-    },
-    "helm-values.image.repository": {
-      "default": "quay.io/jetstack/cert-manager-controller",
-      "description": "The container image for the cert-manager controller.",
-      "type": "string"
-    },
-    "helm-values.image.tag": {
-      "description": "Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.",
-      "type": "string"
-    },
-    "helm-values.ingressShim": {
-      "additionalProperties": false,
-      "properties": {
-        "defaultIssuerGroup": {
-          "$ref": "#/$defs/helm-values.ingressShim.defaultIssuerGroup"
-        },
-        "defaultIssuerKind": {
-          "$ref": "#/$defs/helm-values.ingressShim.defaultIssuerKind"
-        },
-        "defaultIssuerName": {
-          "$ref": "#/$defs/helm-values.ingressShim.defaultIssuerName"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.ingressShim.defaultIssuerGroup": {
-      "description": "Optional default issuer group to use for ingress resources.",
-      "type": "string"
-    },
-    "helm-values.ingressShim.defaultIssuerKind": {
-      "description": "Optional default issuer kind to use for ingress resources.",
-      "type": "string"
-    },
-    "helm-values.ingressShim.defaultIssuerName": {
-      "description": "Optional default issuer to use for ingress resources.",
-      "type": "string"
-    },
-    "helm-values.installCRDs": {
-      "default": false,
-      "description": "This option is equivalent to setting crds.enabled=true and crds.keep=true. Deprecated: use crds.enabled and crds.keep instead.",
-      "type": "boolean"
-    },
-    "helm-values.livenessProbe": {
-      "default": {
-        "enabled": true,
-        "failureThreshold": 8,
-        "initialDelaySeconds": 10,
-        "periodSeconds": 10,
-        "successThreshold": 1,
-        "timeoutSeconds": 15
-      },
-      "description": "LivenessProbe settings for the controller container of the controller Pod.\n\nThis is enabled by default, in order to enable the clock-skew liveness probe that restarts the controller in case of a skew between the system clock and the monotonic clock. LivenessProbe durations and thresholds are based on those used for the Kubernetes controller-manager. For more information see the following on the\n[Kubernetes GitHub repository](https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245)",
-      "type": "object"
-    },
-    "helm-values.maxConcurrentChallenges": {
-      "default": 60,
-      "description": "The maximum number of challenges that can be scheduled as 'processing' at once.",
-      "type": "number"
-    },
-    "helm-values.nameOverride": {
-      "description": "Override the \"cert-manager.name\" value, which is used to annotate some of the resources that are created by this Chart (using \"app.kubernetes.io/name\"). NOTE: There are some inconsistencies in the Helm chart when it comes to these annotations (some resources use eg. \"cainjector.name\" which resolves to the value \"cainjector\").",
-      "type": "string"
-    },
-    "helm-values.namespace": {
-      "default": "",
-      "description": "This namespace allows you to define where the services are installed into. If not set then they use the namespace of the release. This is helpful when installing cert manager as a chart dependency (sub chart).",
-      "type": "string"
-    },
-    "helm-values.no_proxy": {
-      "description": "Configures the NO_PROXY environment variable where a HTTP proxy is required, but certain domains should be excluded.",
-      "type": "string"
-    },
-    "helm-values.nodeSelector": {
-      "default": {
-        "kubernetes.io/os": "linux"
-      },
-      "description": "The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).\n\nThis default ensures that Pods are only scheduled to Linux nodes. It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.",
-      "type": "object"
-    },
-    "helm-values.podAnnotations": {
-      "description": "Optional additional annotations to add to the controller Pods.",
-      "type": "object"
-    },
-    "helm-values.podDisruptionBudget": {
-      "additionalProperties": false,
-      "properties": {
-        "enabled": {
-          "$ref": "#/$defs/helm-values.podDisruptionBudget.enabled"
-        },
-        "maxUnavailable": {
-          "$ref": "#/$defs/helm-values.podDisruptionBudget.maxUnavailable"
-        },
-        "minAvailable": {
-          "$ref": "#/$defs/helm-values.podDisruptionBudget.minAvailable"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.podDisruptionBudget.enabled": {
-      "default": false,
-      "description": "Enable or disable the PodDisruptionBudget resource.\n\nThis prevents downtime during voluntary disruptions such as during a Node upgrade. For example, the PodDisruptionBudget will block `kubectl drain` if it is used on the Node where the only remaining cert-manager\nPod is currently running.",
-      "type": "boolean"
-    },
-    "helm-values.podDisruptionBudget.maxUnavailable": {
-      "description": "This configures the maximum unavailable pods for disruptions. It can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%). it cannot be used if `minAvailable` is set."
-    },
-    "helm-values.podDisruptionBudget.minAvailable": {
-      "description": "This configures the minimum available pods for disruptions. It can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%).\nIt cannot be used if `maxUnavailable` is set."
-    },
-    "helm-values.podDnsConfig": {
-      "description": "Pod DNS configuration. The podDnsConfig field is optional and can work with any podDnsPolicy settings. However, when a Pod's dnsPolicy is set to \"None\", the dnsConfig field has to be specified. For more information, see [Pod's DNS Config](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config).",
-      "type": "object"
-    },
-    "helm-values.podDnsPolicy": {
-      "description": "Pod DNS policy.\nFor more information, see [Pod's DNS Policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy).",
-      "type": "string"
-    },
-    "helm-values.podLabels": {
-      "default": {},
-      "description": "Optional additional labels to add to the controller Pods.",
-      "type": "object"
-    },
-    "helm-values.prometheus": {
-      "additionalProperties": false,
-      "properties": {
-        "enabled": {
-          "$ref": "#/$defs/helm-values.prometheus.enabled"
-        },
-        "podmonitor": {
-          "$ref": "#/$defs/helm-values.prometheus.podmonitor"
-        },
-        "servicemonitor": {
-          "$ref": "#/$defs/helm-values.prometheus.servicemonitor"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.prometheus.enabled": {
-      "default": true,
-      "description": "Enable Prometheus monitoring for the cert-manager controller and webhook. If you use the Prometheus Operator, set prometheus.podmonitor.enabled or prometheus.servicemonitor.enabled, to create a PodMonitor or a\nServiceMonitor resource.\nOtherwise, 'prometheus.io' annotations are added to the cert-manager and cert-manager-webhook Deployments. Note that you can not enable both PodMonitor and ServiceMonitor as they are mutually exclusive. Enabling both will result in an error.",
-      "type": "boolean"
-    },
-    "helm-values.prometheus.podmonitor": {
-      "additionalProperties": false,
-      "properties": {
-        "annotations": {
-          "$ref": "#/$defs/helm-values.prometheus.podmonitor.annotations"
-        },
-        "enabled": {
-          "$ref": "#/$defs/helm-values.prometheus.podmonitor.enabled"
-        },
-        "endpointAdditionalProperties": {
-          "$ref": "#/$defs/helm-values.prometheus.podmonitor.endpointAdditionalProperties"
-        },
-        "honorLabels": {
-          "$ref": "#/$defs/helm-values.prometheus.podmonitor.honorLabels"
-        },
-        "interval": {
-          "$ref": "#/$defs/helm-values.prometheus.podmonitor.interval"
-        },
-        "labels": {
-          "$ref": "#/$defs/helm-values.prometheus.podmonitor.labels"
-        },
-        "namespace": {
-          "$ref": "#/$defs/helm-values.prometheus.podmonitor.namespace"
-        },
-        "path": {
-          "$ref": "#/$defs/helm-values.prometheus.podmonitor.path"
-        },
-        "prometheusInstance": {
-          "$ref": "#/$defs/helm-values.prometheus.podmonitor.prometheusInstance"
-        },
-        "scrapeTimeout": {
-          "$ref": "#/$defs/helm-values.prometheus.podmonitor.scrapeTimeout"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.prometheus.podmonitor.annotations": {
-      "default": {},
-      "description": "Additional annotations to add to the PodMonitor.",
-      "type": "object"
-    },
-    "helm-values.prometheus.podmonitor.enabled": {
-      "default": false,
-      "description": "Create a PodMonitor to add cert-manager to Prometheus.",
-      "type": "boolean"
-    },
-    "helm-values.prometheus.podmonitor.endpointAdditionalProperties": {
-      "default": {},
-      "description": "EndpointAdditionalProperties allows setting additional properties on the endpoint such as relabelings, metricRelabelings etc.\n\nFor example:\nendpointAdditionalProperties:\n relabelings:\n - action: replace\n   sourceLabels:\n   - __meta_kubernetes_pod_node_name\n   targetLabel: instance\n # Configure the PodMonitor for TLS connections\n # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls\n scheme: https\n tlsConfig:\n   serverName: cert-manager-metrics\n   ca:\n     secret:\n       name: cert-manager-metrics-ca\n       key: \"tls.crt\"",
-      "type": "object"
-    },
-    "helm-values.prometheus.podmonitor.honorLabels": {
-      "default": false,
-      "description": "Keep labels from scraped data, overriding server-side labels.",
-      "type": "boolean"
-    },
-    "helm-values.prometheus.podmonitor.interval": {
-      "default": "60s",
-      "description": "The interval to scrape metrics.",
-      "type": "string"
-    },
-    "helm-values.prometheus.podmonitor.labels": {
-      "default": {},
-      "description": "Additional labels to add to the PodMonitor.",
-      "type": "object"
-    },
-    "helm-values.prometheus.podmonitor.namespace": {
-      "description": "The namespace that the pod monitor should live in, defaults to the cert-manager namespace.",
-      "type": "string"
-    },
-    "helm-values.prometheus.podmonitor.path": {
-      "default": "/metrics",
-      "description": "The path to scrape for metrics.",
-      "type": "string"
-    },
-    "helm-values.prometheus.podmonitor.prometheusInstance": {
-      "default": "default",
-      "description": "Specifies the `prometheus` label on the created PodMonitor. This is used when different Prometheus instances have label selectors matching different PodMonitors.",
-      "type": "string"
-    },
-    "helm-values.prometheus.podmonitor.scrapeTimeout": {
-      "default": "30s",
-      "description": "The timeout before a metrics scrape fails.",
-      "type": "string"
-    },
-    "helm-values.prometheus.servicemonitor": {
-      "additionalProperties": false,
-      "properties": {
-        "annotations": {
-          "$ref": "#/$defs/helm-values.prometheus.servicemonitor.annotations"
-        },
-        "enabled": {
-          "$ref": "#/$defs/helm-values.prometheus.servicemonitor.enabled"
-        },
-        "endpointAdditionalProperties": {
-          "$ref": "#/$defs/helm-values.prometheus.servicemonitor.endpointAdditionalProperties"
-        },
-        "honorLabels": {
-          "$ref": "#/$defs/helm-values.prometheus.servicemonitor.honorLabels"
-        },
-        "interval": {
-          "$ref": "#/$defs/helm-values.prometheus.servicemonitor.interval"
-        },
-        "labels": {
-          "$ref": "#/$defs/helm-values.prometheus.servicemonitor.labels"
-        },
-        "namespace": {
-          "$ref": "#/$defs/helm-values.prometheus.servicemonitor.namespace"
-        },
-        "path": {
-          "$ref": "#/$defs/helm-values.prometheus.servicemonitor.path"
-        },
-        "prometheusInstance": {
-          "$ref": "#/$defs/helm-values.prometheus.servicemonitor.prometheusInstance"
-        },
-        "scrapeTimeout": {
-          "$ref": "#/$defs/helm-values.prometheus.servicemonitor.scrapeTimeout"
-        },
-        "targetPort": {
-          "$ref": "#/$defs/helm-values.prometheus.servicemonitor.targetPort"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.prometheus.servicemonitor.annotations": {
-      "default": {},
-      "description": "Additional annotations to add to the ServiceMonitor.",
-      "type": "object"
-    },
-    "helm-values.prometheus.servicemonitor.enabled": {
-      "default": false,
-      "description": "Create a ServiceMonitor to add cert-manager to Prometheus.",
-      "type": "boolean"
-    },
-    "helm-values.prometheus.servicemonitor.endpointAdditionalProperties": {
-      "default": {},
-      "description": "EndpointAdditionalProperties allows setting additional properties on the endpoint such as relabelings, metricRelabelings etc.\n\nFor example:\nendpointAdditionalProperties:\n relabelings:\n - action: replace\n   sourceLabels:\n   - __meta_kubernetes_pod_node_name\n   targetLabel: instance",
-      "type": "object"
-    },
-    "helm-values.prometheus.servicemonitor.honorLabels": {
-      "default": false,
-      "description": "Keep labels from scraped data, overriding server-side labels.",
-      "type": "boolean"
-    },
-    "helm-values.prometheus.servicemonitor.interval": {
-      "default": "60s",
-      "description": "The interval to scrape metrics.",
-      "type": "string"
-    },
-    "helm-values.prometheus.servicemonitor.labels": {
-      "default": {},
-      "description": "Additional labels to add to the ServiceMonitor.",
-      "type": "object"
-    },
-    "helm-values.prometheus.servicemonitor.namespace": {
-      "description": "The namespace that the service monitor should live in, defaults to the cert-manager namespace.",
-      "type": "string"
-    },
-    "helm-values.prometheus.servicemonitor.path": {
-      "default": "/metrics",
-      "description": "The path to scrape for metrics.",
-      "type": "string"
-    },
-    "helm-values.prometheus.servicemonitor.prometheusInstance": {
-      "default": "default",
-      "description": "Specifies the `prometheus` label on the created ServiceMonitor. This is used when different Prometheus instances have label selectors matching different ServiceMonitors.",
-      "type": "string"
-    },
-    "helm-values.prometheus.servicemonitor.scrapeTimeout": {
-      "default": "30s",
-      "description": "The timeout before a metrics scrape fails.",
-      "type": "string"
-    },
-    "helm-values.prometheus.servicemonitor.targetPort": {
-      "default": 9402,
-      "description": "The target port to set on the ServiceMonitor. This must match the port that the cert-manager controller is listening on for metrics.",
-      "type": "number"
-    },
-    "helm-values.replicaCount": {
-      "default": 1,
-      "description": "The number of replicas of the cert-manager controller to run.\n\nThe default is 1, but in production set this to 2 or 3 to provide high availability.\n\nIf `replicas > 1`, consider setting `podDisruptionBudget.enabled=true`.\n\nNote that cert-manager uses leader election to ensure that there can only be a single instance active at a time.",
-      "type": "number"
-    },
-    "helm-values.resources": {
-      "default": {},
-      "description": "Resources to provide to the cert-manager controller pod.\n\nFor example:\nrequests:\n  cpu: 10m\n  memory: 32Mi\nFor more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).",
-      "type": "object"
-    },
-    "helm-values.securityContext": {
-      "default": {
-        "runAsNonRoot": true,
-        "seccompProfile": {
-          "type": "RuntimeDefault"
-        }
-      },
-      "description": "Pod Security Context.\nFor more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).",
-      "type": "object"
-    },
-    "helm-values.serviceAccount": {
-      "additionalProperties": false,
-      "properties": {
-        "annotations": {
-          "$ref": "#/$defs/helm-values.serviceAccount.annotations"
-        },
-        "automountServiceAccountToken": {
-          "$ref": "#/$defs/helm-values.serviceAccount.automountServiceAccountToken"
-        },
-        "create": {
-          "$ref": "#/$defs/helm-values.serviceAccount.create"
-        },
-        "labels": {
-          "$ref": "#/$defs/helm-values.serviceAccount.labels"
-        },
-        "name": {
-          "$ref": "#/$defs/helm-values.serviceAccount.name"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.serviceAccount.annotations": {
-      "description": "Optional additional annotations to add to the controller's Service Account.",
-      "type": "object"
-    },
-    "helm-values.serviceAccount.automountServiceAccountToken": {
-      "default": true,
-      "description": "Automount API credentials for a Service Account.",
-      "type": "boolean"
-    },
-    "helm-values.serviceAccount.create": {
-      "default": true,
-      "description": "Specifies whether a service account should be created.",
-      "type": "boolean"
-    },
-    "helm-values.serviceAccount.labels": {
-      "description": "Optional additional labels to add to the controller's Service Account.",
-      "type": "object"
-    },
-    "helm-values.serviceAccount.name": {
-      "description": "The name of the service account to use.\nIf not set and create is true, a name is generated using the fullname template.",
-      "type": "string"
-    },
-    "helm-values.serviceAnnotations": {
-      "description": "Optional annotations to add to the controller Service.",
-      "type": "object"
-    },
-    "helm-values.serviceIPFamilies": {
-      "description": "Optionally set the IP families for the controller Service that should be supported, in the order in which they should be applied to ClusterIP. Can be IPv4 and/or IPv6.",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.serviceIPFamilyPolicy": {
-      "description": "Optionally set the IP family policy for the controller Service to configure dual-stack; see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services).",
-      "type": "string"
-    },
-    "helm-values.serviceLabels": {
-      "description": "Optional additional labels to add to the controller Service.",
-      "type": "object"
-    },
-    "helm-values.startupapicheck": {
-      "additionalProperties": false,
-      "properties": {
-        "affinity": {
-          "$ref": "#/$defs/helm-values.startupapicheck.affinity"
-        },
-        "automountServiceAccountToken": {
-          "$ref": "#/$defs/helm-values.startupapicheck.automountServiceAccountToken"
-        },
-        "backoffLimit": {
-          "$ref": "#/$defs/helm-values.startupapicheck.backoffLimit"
-        },
-        "containerSecurityContext": {
-          "$ref": "#/$defs/helm-values.startupapicheck.containerSecurityContext"
-        },
-        "enableServiceLinks": {
-          "$ref": "#/$defs/helm-values.startupapicheck.enableServiceLinks"
-        },
-        "enabled": {
-          "$ref": "#/$defs/helm-values.startupapicheck.enabled"
-        },
-        "extraArgs": {
-          "$ref": "#/$defs/helm-values.startupapicheck.extraArgs"
-        },
-        "extraEnv": {
-          "$ref": "#/$defs/helm-values.startupapicheck.extraEnv"
-        },
-        "image": {
-          "$ref": "#/$defs/helm-values.startupapicheck.image"
-        },
-        "jobAnnotations": {
-          "$ref": "#/$defs/helm-values.startupapicheck.jobAnnotations"
-        },
-        "nodeSelector": {
-          "$ref": "#/$defs/helm-values.startupapicheck.nodeSelector"
-        },
-        "podAnnotations": {
-          "$ref": "#/$defs/helm-values.startupapicheck.podAnnotations"
-        },
-        "podLabels": {
-          "$ref": "#/$defs/helm-values.startupapicheck.podLabels"
-        },
-        "rbac": {
-          "$ref": "#/$defs/helm-values.startupapicheck.rbac"
-        },
-        "resources": {
-          "$ref": "#/$defs/helm-values.startupapicheck.resources"
-        },
-        "securityContext": {
-          "$ref": "#/$defs/helm-values.startupapicheck.securityContext"
-        },
-        "serviceAccount": {
-          "$ref": "#/$defs/helm-values.startupapicheck.serviceAccount"
-        },
-        "timeout": {
-          "$ref": "#/$defs/helm-values.startupapicheck.timeout"
-        },
-        "tolerations": {
-          "$ref": "#/$defs/helm-values.startupapicheck.tolerations"
-        },
-        "volumeMounts": {
-          "$ref": "#/$defs/helm-values.startupapicheck.volumeMounts"
-        },
-        "volumes": {
-          "$ref": "#/$defs/helm-values.startupapicheck.volumes"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.startupapicheck.affinity": {
-      "default": {},
-      "description": "A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).\nFor example:\naffinity:\n  nodeAffinity:\n   requiredDuringSchedulingIgnoredDuringExecution:\n     nodeSelectorTerms:\n     - matchExpressions:\n       - key: foo.bar.com/role\n         operator: In\n         values:\n         - master",
-      "type": "object"
-    },
-    "helm-values.startupapicheck.automountServiceAccountToken": {
-      "description": "Automounting API credentials for a particular pod.",
-      "type": "boolean"
-    },
-    "helm-values.startupapicheck.backoffLimit": {
-      "default": 4,
-      "description": "Job backoffLimit",
-      "type": "number"
-    },
-    "helm-values.startupapicheck.containerSecurityContext": {
-      "default": {
-        "allowPrivilegeEscalation": false,
-        "capabilities": {
-          "drop": [
-            "ALL"
-          ]
-        },
-        "readOnlyRootFilesystem": true
-      },
-      "description": "Container Security Context to be set on the controller component container. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).",
-      "type": "object"
-    },
-    "helm-values.startupapicheck.enableServiceLinks": {
-      "default": false,
-      "description": "enableServiceLinks indicates whether information about services should be injected into pod's environment variables, matching the syntax of Docker links.",
-      "type": "boolean"
-    },
-    "helm-values.startupapicheck.enabled": {
-      "default": true,
-      "description": "Enables the startup api check.",
-      "type": "boolean"
-    },
-    "helm-values.startupapicheck.extraArgs": {
-      "default": [
-        "-v"
-      ],
-      "description": "Additional command line flags to pass to startupapicheck binary. To see all available flags run `docker run quay.io/jetstack/cert-manager-startupapicheck:<version> --help`.\n\nVerbose logging is enabled by default so that if startupapicheck fails, you can know what exactly caused the failure. Verbose logs include details of the webhook URL, IP address and TCP connect errors for example.",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.startupapicheck.extraEnv": {
-      "default": [],
-      "description": "Additional environment variables to pass to cert-manager startupapicheck binary.\nFor example:\nextraEnv:\n- name: SOME_VAR\n  value: 'some value'",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.startupapicheck.image": {
-      "additionalProperties": false,
-      "properties": {
-        "digest": {
-          "$ref": "#/$defs/helm-values.startupapicheck.image.digest"
-        },
-        "pullPolicy": {
-          "$ref": "#/$defs/helm-values.startupapicheck.image.pullPolicy"
-        },
-        "registry": {
-          "$ref": "#/$defs/helm-values.startupapicheck.image.registry"
-        },
-        "repository": {
-          "$ref": "#/$defs/helm-values.startupapicheck.image.repository"
-        },
-        "tag": {
-          "$ref": "#/$defs/helm-values.startupapicheck.image.tag"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.startupapicheck.image.digest": {
-      "description": "Setting a digest will override any tag.",
-      "type": "string"
-    },
-    "helm-values.startupapicheck.image.pullPolicy": {
-      "default": "IfNotPresent",
-      "description": "Kubernetes imagePullPolicy on Deployment.",
-      "type": "string"
-    },
-    "helm-values.startupapicheck.image.registry": {
-      "description": "The container registry to pull the startupapicheck image from.",
-      "type": "string"
-    },
-    "helm-values.startupapicheck.image.repository": {
-      "default": "quay.io/jetstack/cert-manager-startupapicheck",
-      "description": "The container image for the cert-manager startupapicheck.",
-      "type": "string"
-    },
-    "helm-values.startupapicheck.image.tag": {
-      "description": "Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.",
-      "type": "string"
-    },
-    "helm-values.startupapicheck.jobAnnotations": {
-      "default": {
-        "helm.sh/hook": "post-install",
-        "helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded",
-        "helm.sh/hook-weight": "1"
-      },
-      "description": "Optional additional annotations to add to the startupapicheck Job.",
-      "type": "object"
-    },
-    "helm-values.startupapicheck.nodeSelector": {
-      "default": {
-        "kubernetes.io/os": "linux"
-      },
-      "description": "The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).\n\nThis default ensures that Pods are only scheduled to Linux nodes. It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.",
-      "type": "object"
-    },
-    "helm-values.startupapicheck.podAnnotations": {
-      "description": "Optional additional annotations to add to the startupapicheck Pods.",
-      "type": "object"
-    },
-    "helm-values.startupapicheck.podLabels": {
-      "default": {},
-      "description": "Optional additional labels to add to the startupapicheck Pods.",
-      "type": "object"
-    },
-    "helm-values.startupapicheck.rbac": {
-      "additionalProperties": false,
-      "properties": {
-        "annotations": {
-          "$ref": "#/$defs/helm-values.startupapicheck.rbac.annotations"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.startupapicheck.rbac.annotations": {
-      "default": {
-        "helm.sh/hook": "post-install",
-        "helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded",
-        "helm.sh/hook-weight": "-5"
-      },
-      "description": "annotations for the startup API Check job RBAC and PSP resources.",
-      "type": "object"
-    },
-    "helm-values.startupapicheck.resources": {
-      "default": {},
-      "description": "Resources to provide to the cert-manager controller pod.\n\nFor example:\nrequests:\n  cpu: 10m\n  memory: 32Mi\nFor more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).",
-      "type": "object"
-    },
-    "helm-values.startupapicheck.securityContext": {
-      "default": {
-        "runAsNonRoot": true,
-        "seccompProfile": {
-          "type": "RuntimeDefault"
-        }
-      },
-      "description": "Pod Security Context to be set on the startupapicheck component Pod. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).",
-      "type": "object"
-    },
-    "helm-values.startupapicheck.serviceAccount": {
-      "additionalProperties": false,
-      "properties": {
-        "annotations": {
-          "$ref": "#/$defs/helm-values.startupapicheck.serviceAccount.annotations"
-        },
-        "automountServiceAccountToken": {
-          "$ref": "#/$defs/helm-values.startupapicheck.serviceAccount.automountServiceAccountToken"
-        },
-        "create": {
-          "$ref": "#/$defs/helm-values.startupapicheck.serviceAccount.create"
-        },
-        "labels": {
-          "$ref": "#/$defs/helm-values.startupapicheck.serviceAccount.labels"
-        },
-        "name": {
-          "$ref": "#/$defs/helm-values.startupapicheck.serviceAccount.name"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.startupapicheck.serviceAccount.annotations": {
-      "default": {
-        "helm.sh/hook": "post-install",
-        "helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded",
-        "helm.sh/hook-weight": "-5"
-      },
-      "description": "Optional additional annotations to add to the Job's Service Account.",
-      "type": "object"
-    },
-    "helm-values.startupapicheck.serviceAccount.automountServiceAccountToken": {
-      "default": true,
-      "description": "Automount API credentials for a Service Account.",
-      "type": "boolean"
-    },
-    "helm-values.startupapicheck.serviceAccount.create": {
-      "default": true,
-      "description": "Specifies whether a service account should be created.",
-      "type": "boolean"
-    },
-    "helm-values.startupapicheck.serviceAccount.labels": {
-      "description": "Optional additional labels to add to the startupapicheck's Service Account.",
-      "type": "object"
-    },
-    "helm-values.startupapicheck.serviceAccount.name": {
-      "description": "The name of the service account to use.\nIf not set and create is true, a name is generated using the fullname template.",
-      "type": "string"
-    },
-    "helm-values.startupapicheck.timeout": {
-      "default": "1m",
-      "description": "Timeout for 'kubectl check api' command.",
-      "type": "string"
-    },
-    "helm-values.startupapicheck.tolerations": {
-      "default": [],
-      "description": "A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).\n\nFor example:\ntolerations:\n- key: foo.bar.com/role\n  operator: Equal\n  value: master\n  effect: NoSchedule",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.startupapicheck.volumeMounts": {
-      "default": [],
-      "description": "Additional volume mounts to add to the cert-manager controller container.",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.startupapicheck.volumes": {
-      "default": [],
-      "description": "Additional volumes to add to the cert-manager controller pod.",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.strategy": {
-      "default": {},
-      "description": "Deployment update strategy for the cert-manager controller deployment. For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy).\n\nFor example:\nstrategy:\n  type: RollingUpdate\n  rollingUpdate:\n    maxSurge: 0\n    maxUnavailable: 1",
-      "type": "object"
-    },
-    "helm-values.tolerations": {
-      "default": [],
-      "description": "A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).\n\nFor example:\ntolerations:\n- key: foo.bar.com/role\n  operator: Equal\n  value: master\n  effect: NoSchedule",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.topologySpreadConstraints": {
-      "default": [],
-      "description": "A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core\n\nFor example:\ntopologySpreadConstraints:\n- maxSkew: 2\n  topologyKey: topology.kubernetes.io/zone\n  whenUnsatisfiable: ScheduleAnyway\n  labelSelector:\n    matchLabels:\n      app.kubernetes.io/instance: cert-manager\n      app.kubernetes.io/component: controller",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.volumeMounts": {
-      "default": [],
-      "description": "Additional volume mounts to add to the cert-manager controller container.",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.volumes": {
-      "default": [],
-      "description": "Additional volumes to add to the cert-manager controller pod.",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.webhook": {
-      "additionalProperties": false,
-      "properties": {
-        "affinity": {
-          "$ref": "#/$defs/helm-values.webhook.affinity"
-        },
-        "automountServiceAccountToken": {
-          "$ref": "#/$defs/helm-values.webhook.automountServiceAccountToken"
-        },
-        "config": {
-          "$ref": "#/$defs/helm-values.webhook.config"
-        },
-        "containerSecurityContext": {
-          "$ref": "#/$defs/helm-values.webhook.containerSecurityContext"
-        },
-        "deploymentAnnotations": {
-          "$ref": "#/$defs/helm-values.webhook.deploymentAnnotations"
-        },
-        "enableServiceLinks": {
-          "$ref": "#/$defs/helm-values.webhook.enableServiceLinks"
-        },
-        "extraArgs": {
-          "$ref": "#/$defs/helm-values.webhook.extraArgs"
-        },
-        "extraEnv": {
-          "$ref": "#/$defs/helm-values.webhook.extraEnv"
-        },
-        "featureGates": {
-          "$ref": "#/$defs/helm-values.webhook.featureGates"
-        },
-        "hostNetwork": {
-          "$ref": "#/$defs/helm-values.webhook.hostNetwork"
-        },
-        "image": {
-          "$ref": "#/$defs/helm-values.webhook.image"
-        },
-        "livenessProbe": {
-          "$ref": "#/$defs/helm-values.webhook.livenessProbe"
-        },
-        "loadBalancerIP": {
-          "$ref": "#/$defs/helm-values.webhook.loadBalancerIP"
-        },
-        "mutatingWebhookConfiguration": {
-          "$ref": "#/$defs/helm-values.webhook.mutatingWebhookConfiguration"
-        },
-        "mutatingWebhookConfigurationAnnotations": {
-          "$ref": "#/$defs/helm-values.webhook.mutatingWebhookConfigurationAnnotations"
-        },
-        "networkPolicy": {
-          "$ref": "#/$defs/helm-values.webhook.networkPolicy"
-        },
-        "nodeSelector": {
-          "$ref": "#/$defs/helm-values.webhook.nodeSelector"
-        },
-        "podAnnotations": {
-          "$ref": "#/$defs/helm-values.webhook.podAnnotations"
-        },
-        "podDisruptionBudget": {
-          "$ref": "#/$defs/helm-values.webhook.podDisruptionBudget"
-        },
-        "podLabels": {
-          "$ref": "#/$defs/helm-values.webhook.podLabels"
-        },
-        "readinessProbe": {
-          "$ref": "#/$defs/helm-values.webhook.readinessProbe"
-        },
-        "replicaCount": {
-          "$ref": "#/$defs/helm-values.webhook.replicaCount"
-        },
-        "resources": {
-          "$ref": "#/$defs/helm-values.webhook.resources"
-        },
-        "securePort": {
-          "$ref": "#/$defs/helm-values.webhook.securePort"
-        },
-        "securityContext": {
-          "$ref": "#/$defs/helm-values.webhook.securityContext"
-        },
-        "serviceAccount": {
-          "$ref": "#/$defs/helm-values.webhook.serviceAccount"
-        },
-        "serviceAnnotations": {
-          "$ref": "#/$defs/helm-values.webhook.serviceAnnotations"
-        },
-        "serviceIPFamilies": {
-          "$ref": "#/$defs/helm-values.webhook.serviceIPFamilies"
-        },
-        "serviceIPFamilyPolicy": {
-          "$ref": "#/$defs/helm-values.webhook.serviceIPFamilyPolicy"
-        },
-        "serviceLabels": {
-          "$ref": "#/$defs/helm-values.webhook.serviceLabels"
-        },
-        "serviceType": {
-          "$ref": "#/$defs/helm-values.webhook.serviceType"
-        },
-        "strategy": {
-          "$ref": "#/$defs/helm-values.webhook.strategy"
-        },
-        "timeoutSeconds": {
-          "$ref": "#/$defs/helm-values.webhook.timeoutSeconds"
-        },
-        "tolerations": {
-          "$ref": "#/$defs/helm-values.webhook.tolerations"
-        },
-        "topologySpreadConstraints": {
-          "$ref": "#/$defs/helm-values.webhook.topologySpreadConstraints"
-        },
-        "url": {
-          "$ref": "#/$defs/helm-values.webhook.url"
-        },
-        "validatingWebhookConfiguration": {
-          "$ref": "#/$defs/helm-values.webhook.validatingWebhookConfiguration"
-        },
-        "validatingWebhookConfigurationAnnotations": {
-          "$ref": "#/$defs/helm-values.webhook.validatingWebhookConfigurationAnnotations"
-        },
-        "volumeMounts": {
-          "$ref": "#/$defs/helm-values.webhook.volumeMounts"
-        },
-        "volumes": {
-          "$ref": "#/$defs/helm-values.webhook.volumes"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.webhook.affinity": {
-      "default": {},
-      "description": "A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).\n\nFor example:\naffinity:\n  nodeAffinity:\n   requiredDuringSchedulingIgnoredDuringExecution:\n     nodeSelectorTerms:\n     - matchExpressions:\n       - key: foo.bar.com/role\n         operator: In\n         values:\n         - master",
-      "type": "object"
-    },
-    "helm-values.webhook.automountServiceAccountToken": {
-      "description": "Automounting API credentials for a particular pod.",
-      "type": "boolean"
-    },
-    "helm-values.webhook.config": {
-      "default": {},
-      "description": "This is used to configure options for the webhook pod. This allows setting options that would usually be provided using flags.\n\nIf `apiVersion` and `kind` are unspecified they default to the current latest version (currently `webhook.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.\n\nFor example:\napiVersion: webhook.config.cert-manager.io/v1alpha1\nkind: WebhookConfiguration\n# The port that the webhook listens on for requests.\n# In GKE private clusters, by default Kubernetes apiservers are allowed to\n# talk to the cluster nodes only on 443 and 10250. Configuring\n# securePort: 10250 therefore will work out-of-the-box without needing to add firewall\n# rules or requiring NET_BIND_SERVICE capabilities to bind port numbers < 1000.\n# This should be uncommented and set as a default by the chart once\n# the apiVersion of WebhookConfiguration graduates beyond v1alpha1.\nsecurePort: 10250\n# Configure the metrics server for TLS\n# See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls\nmetricsTLSConfig:\n  dynamic:\n    secretNamespace: \"cert-manager\"\n    secretName: \"cert-manager-metrics-ca\"\n    dnsNames:\n    - cert-manager-metrics",
-      "type": "object"
-    },
-    "helm-values.webhook.containerSecurityContext": {
-      "default": {
-        "allowPrivilegeEscalation": false,
-        "capabilities": {
-          "drop": [
-            "ALL"
-          ]
-        },
-        "readOnlyRootFilesystem": true
-      },
-      "description": "Container Security Context to be set on the webhook component container. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).",
-      "type": "object"
-    },
-    "helm-values.webhook.deploymentAnnotations": {
-      "description": "Optional additional annotations to add to the webhook Deployment.",
-      "type": "object"
-    },
-    "helm-values.webhook.enableServiceLinks": {
-      "default": false,
-      "description": "enableServiceLinks indicates whether information about services should be injected into the pod's environment variables, matching the syntax of Docker links.",
-      "type": "boolean"
-    },
-    "helm-values.webhook.extraArgs": {
-      "default": [],
-      "description": "Additional command line flags to pass to cert-manager webhook binary. To see all available flags run `docker run quay.io/jetstack/cert-manager-webhook:<version> --help`.",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.webhook.extraEnv": {
-      "default": [],
-      "description": "Additional environment variables to pass to cert-manager webhook binary.\nFor example:\nextraEnv:\n- name: SOME_VAR\n  value: 'some value'",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.webhook.featureGates": {
-      "default": "",
-      "description": "Comma separated list of feature gates that should be enabled on the webhook pod.",
-      "type": "string"
-    },
-    "helm-values.webhook.hostNetwork": {
-      "default": false,
-      "description": "Specifies if the webhook should be started in hostNetwork mode.\n\nRequired for use in some managed kubernetes clusters (such as AWS EKS) with custom. CNI (such as calico), because control-plane managed by AWS cannot communicate with pods' IP CIDR and admission webhooks are not working\n\nSince the default port for the webhook conflicts with kubelet on the host network, `webhook.securePort` should be changed to an available port if running in hostNetwork mode.",
-      "type": "boolean"
-    },
-    "helm-values.webhook.image": {
-      "additionalProperties": false,
-      "properties": {
-        "digest": {
-          "$ref": "#/$defs/helm-values.webhook.image.digest"
-        },
-        "pullPolicy": {
-          "$ref": "#/$defs/helm-values.webhook.image.pullPolicy"
-        },
-        "registry": {
-          "$ref": "#/$defs/helm-values.webhook.image.registry"
-        },
-        "repository": {
-          "$ref": "#/$defs/helm-values.webhook.image.repository"
-        },
-        "tag": {
-          "$ref": "#/$defs/helm-values.webhook.image.tag"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.webhook.image.digest": {
-      "description": "Setting a digest will override any tag",
-      "type": "string"
-    },
-    "helm-values.webhook.image.pullPolicy": {
-      "default": "IfNotPresent",
-      "description": "Kubernetes imagePullPolicy on Deployment.",
-      "type": "string"
-    },
-    "helm-values.webhook.image.registry": {
-      "description": "The container registry to pull the webhook image from.",
-      "type": "string"
-    },
-    "helm-values.webhook.image.repository": {
-      "default": "quay.io/jetstack/cert-manager-webhook",
-      "description": "The container image for the cert-manager webhook",
-      "type": "string"
-    },
-    "helm-values.webhook.image.tag": {
-      "description": "Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion will be used.",
-      "type": "string"
-    },
-    "helm-values.webhook.livenessProbe": {
-      "default": {
-        "failureThreshold": 3,
-        "initialDelaySeconds": 60,
-        "periodSeconds": 10,
-        "successThreshold": 1,
-        "timeoutSeconds": 1
-      },
-      "description": "Liveness probe values.\nFor more information, see [Container probes](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes).",
-      "type": "object"
-    },
-    "helm-values.webhook.loadBalancerIP": {
-      "description": "Specify the load balancer IP for the created service.",
-      "type": "string"
-    },
-    "helm-values.webhook.mutatingWebhookConfiguration": {
-      "additionalProperties": false,
-      "properties": {
-        "namespaceSelector": {
-          "$ref": "#/$defs/helm-values.webhook.mutatingWebhookConfiguration.namespaceSelector"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.webhook.mutatingWebhookConfiguration.namespaceSelector": {
-      "default": {},
-      "description": "Configure spec.namespaceSelector for mutating webhooks.",
-      "type": "object"
-    },
-    "helm-values.webhook.mutatingWebhookConfigurationAnnotations": {
-      "description": "Optional additional annotations to add to the webhook MutatingWebhookConfiguration.",
-      "type": "object"
-    },
-    "helm-values.webhook.networkPolicy": {
-      "additionalProperties": false,
-      "properties": {
-        "egress": {
-          "$ref": "#/$defs/helm-values.webhook.networkPolicy.egress"
-        },
-        "enabled": {
-          "$ref": "#/$defs/helm-values.webhook.networkPolicy.enabled"
-        },
-        "ingress": {
-          "$ref": "#/$defs/helm-values.webhook.networkPolicy.ingress"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.webhook.networkPolicy.egress": {
-      "default": [
-        {
-          "ports": [
-            {
-              "port": 80,
-              "protocol": "TCP"
-            },
-            {
-              "port": 443,
-              "protocol": "TCP"
-            },
-            {
-              "port": 53,
-              "protocol": "TCP"
-            },
-            {
-              "port": 53,
-              "protocol": "UDP"
-            },
-            {
-              "port": 6443,
-              "protocol": "TCP"
-            }
-          ],
-          "to": [
-            {
-              "ipBlock": {
-                "cidr": "0.0.0.0/0"
-              }
-            }
-          ]
-        }
-      ],
-      "description": "Egress rule for the webhook network policy. By default, it allows all outbound traffic to ports 80 and 443, as well as DNS ports.",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.webhook.networkPolicy.enabled": {
-      "default": false,
-      "description": "Create network policies for the webhooks.",
-      "type": "boolean"
-    },
-    "helm-values.webhook.networkPolicy.ingress": {
-      "default": [
-        {
-          "from": [
-            {
-              "ipBlock": {
-                "cidr": "0.0.0.0/0"
-              }
-            }
-          ]
-        }
-      ],
-      "description": "Ingress rule for the webhook network policy. By default, it allows all inbound traffic.",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.webhook.nodeSelector": {
-      "default": {
-        "kubernetes.io/os": "linux"
-      },
-      "description": "The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).\n\nThis default ensures that Pods are only scheduled to Linux nodes. It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.",
-      "type": "object"
-    },
-    "helm-values.webhook.podAnnotations": {
-      "description": "Optional additional annotations to add to the webhook Pods.",
-      "type": "object"
-    },
-    "helm-values.webhook.podDisruptionBudget": {
-      "additionalProperties": false,
-      "properties": {
-        "enabled": {
-          "$ref": "#/$defs/helm-values.webhook.podDisruptionBudget.enabled"
-        },
-        "maxUnavailable": {
-          "$ref": "#/$defs/helm-values.webhook.podDisruptionBudget.maxUnavailable"
-        },
-        "minAvailable": {
-          "$ref": "#/$defs/helm-values.webhook.podDisruptionBudget.minAvailable"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.webhook.podDisruptionBudget.enabled": {
-      "default": false,
-      "description": "Enable or disable the PodDisruptionBudget resource.\n\nThis prevents downtime during voluntary disruptions such as during a Node upgrade. For example, the PodDisruptionBudget will block `kubectl drain` if it is used on the Node where the only remaining cert-manager\nPod is currently running.",
-      "type": "boolean"
-    },
-    "helm-values.webhook.podDisruptionBudget.maxUnavailable": {
-      "description": "This property configures the maximum unavailable pods for disruptions. Can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%).\nIt cannot be used if `minAvailable` is set."
-    },
-    "helm-values.webhook.podDisruptionBudget.minAvailable": {
-      "description": "This property configures the minimum available pods for disruptions. Can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%).\nIt cannot be used if `maxUnavailable` is set."
-    },
-    "helm-values.webhook.podLabels": {
-      "default": {},
-      "description": "Optional additional labels to add to the Webhook Pods.",
-      "type": "object"
-    },
-    "helm-values.webhook.readinessProbe": {
-      "default": {
-        "failureThreshold": 3,
-        "initialDelaySeconds": 5,
-        "periodSeconds": 5,
-        "successThreshold": 1,
-        "timeoutSeconds": 1
-      },
-      "description": "Readiness probe values.\nFor more information, see [Container probes](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes).",
-      "type": "object"
-    },
-    "helm-values.webhook.replicaCount": {
-      "default": 1,
-      "description": "Number of replicas of the cert-manager webhook to run.\n\nThe default is 1, but in production set this to 2 or 3 to provide high availability.\n\nIf `replicas > 1`, consider setting `webhook.podDisruptionBudget.enabled=true`.",
-      "type": "number"
-    },
-    "helm-values.webhook.resources": {
-      "default": {},
-      "description": "Resources to provide to the cert-manager webhook pod.\n\nFor example:\nrequests:\n  cpu: 10m\n  memory: 32Mi\nFor more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).",
-      "type": "object"
-    },
-    "helm-values.webhook.securePort": {
-      "default": 10250,
-      "description": "The port that the webhook listens on for requests. In GKE private clusters, by default Kubernetes apiservers are allowed to talk to the cluster nodes only on 443 and 10250. Configuring securePort: 10250, therefore will work out-of-the-box without needing to add firewall rules or requiring NET_BIND_SERVICE capabilities to bind port numbers <1000.",
-      "type": "number"
-    },
-    "helm-values.webhook.securityContext": {
-      "default": {
-        "runAsNonRoot": true,
-        "seccompProfile": {
-          "type": "RuntimeDefault"
-        }
-      },
-      "description": "Pod Security Context to be set on the webhook component Pod. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).",
-      "type": "object"
-    },
-    "helm-values.webhook.serviceAccount": {
-      "additionalProperties": false,
-      "properties": {
-        "annotations": {
-          "$ref": "#/$defs/helm-values.webhook.serviceAccount.annotations"
-        },
-        "automountServiceAccountToken": {
-          "$ref": "#/$defs/helm-values.webhook.serviceAccount.automountServiceAccountToken"
-        },
-        "create": {
-          "$ref": "#/$defs/helm-values.webhook.serviceAccount.create"
-        },
-        "labels": {
-          "$ref": "#/$defs/helm-values.webhook.serviceAccount.labels"
-        },
-        "name": {
-          "$ref": "#/$defs/helm-values.webhook.serviceAccount.name"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.webhook.serviceAccount.annotations": {
-      "description": "Optional additional annotations to add to the webhook's Service Account.",
-      "type": "object"
-    },
-    "helm-values.webhook.serviceAccount.automountServiceAccountToken": {
-      "default": true,
-      "description": "Automount API credentials for a Service Account.",
-      "type": "boolean"
-    },
-    "helm-values.webhook.serviceAccount.create": {
-      "default": true,
-      "description": "Specifies whether a service account should be created.",
-      "type": "boolean"
-    },
-    "helm-values.webhook.serviceAccount.labels": {
-      "description": "Optional additional labels to add to the webhook's Service Account.",
-      "type": "object"
-    },
-    "helm-values.webhook.serviceAccount.name": {
-      "description": "The name of the service account to use.\nIf not set and create is true, a name is generated using the fullname template.",
-      "type": "string"
-    },
-    "helm-values.webhook.serviceAnnotations": {
-      "description": "Optional additional annotations to add to the webhook Service.",
-      "type": "object"
-    },
-    "helm-values.webhook.serviceIPFamilies": {
-      "default": [],
-      "description": "Optionally set the IP families for the controller Service that should be supported, in the order in which they should be applied to ClusterIP. Can be IPv4 and/or IPv6.",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.webhook.serviceIPFamilyPolicy": {
-      "default": "",
-      "description": "Optionally set the IP family policy for the controller Service to configure dual-stack; see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services).",
-      "type": "string"
-    },
-    "helm-values.webhook.serviceLabels": {
-      "default": {},
-      "description": "Optional additional labels to add to the Webhook Service.",
-      "type": "object"
-    },
-    "helm-values.webhook.serviceType": {
-      "default": "ClusterIP",
-      "description": "Specifies how the service should be handled. Useful if you want to expose the webhook outside of the cluster. In some cases, the control plane cannot reach internal services.",
-      "type": "string"
-    },
-    "helm-values.webhook.strategy": {
-      "default": {},
-      "description": "The update strategy for the cert-manager webhook deployment. For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy)\n\nFor example:\nstrategy:\n  type: RollingUpdate\n  rollingUpdate:\n    maxSurge: 0\n    maxUnavailable: 1",
-      "type": "object"
-    },
-    "helm-values.webhook.timeoutSeconds": {
-      "default": 30,
-      "description": "The number of seconds the API server should wait for the webhook to respond before treating the call as a failure. The value must be between 1 and 30 seconds. For more information, see\n[Validating webhook configuration v1](https://kubernetes.io/docs/reference/kubernetes-api/extend-resources/validating-webhook-configuration-v1/).\n\nThe default is set to the maximum value of 30 seconds as users sometimes report that the connection between the K8S API server and the cert-manager webhook server times out. If *this* timeout is reached, the error message will be \"context deadline exceeded\", which doesn't help the user diagnose what phase of the HTTPS connection timed out. For example, it could be during DNS resolution, TCP connection, TLS negotiation, HTTP negotiation, or slow HTTP response from the webhook server. By setting this timeout to its maximum value the underlying timeout error message has more chance of being returned to the end user.",
-      "type": "number"
-    },
-    "helm-values.webhook.tolerations": {
-      "default": [],
-      "description": "A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).\n\nFor example:\ntolerations:\n- key: foo.bar.com/role\n  operator: Equal\n  value: master\n  effect: NoSchedule",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.webhook.topologySpreadConstraints": {
-      "default": [],
-      "description": "A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core).\n\nFor example:\ntopologySpreadConstraints:\n- maxSkew: 2\n  topologyKey: topology.kubernetes.io/zone\n  whenUnsatisfiable: ScheduleAnyway\n  labelSelector:\n    matchLabels:\n      app.kubernetes.io/instance: cert-manager\n      app.kubernetes.io/component: controller",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.webhook.url": {
-      "default": {},
-      "description": "Overrides the mutating webhook and validating webhook so they reach the webhook service using the `url` field instead of a service.",
-      "type": "object"
-    },
-    "helm-values.webhook.validatingWebhookConfiguration": {
-      "additionalProperties": false,
-      "properties": {
-        "namespaceSelector": {
-          "$ref": "#/$defs/helm-values.webhook.validatingWebhookConfiguration.namespaceSelector"
-        }
-      },
-      "type": "object"
-    },
-    "helm-values.webhook.validatingWebhookConfiguration.namespaceSelector": {
-      "default": {
-        "matchExpressions": [
-          {
-            "key": "cert-manager.io/disable-validation",
-            "operator": "NotIn",
-            "values": [
-              "true"
-            ]
-          }
-        ]
-      },
-      "description": "Configure spec.namespaceSelector for validating webhooks.",
-      "type": "object"
-    },
-    "helm-values.webhook.validatingWebhookConfigurationAnnotations": {
-      "description": "Optional additional annotations to add to the webhook ValidatingWebhookConfiguration.",
-      "type": "object"
-    },
-    "helm-values.webhook.volumeMounts": {
-      "default": [],
-      "description": "Additional volume mounts to add to the cert-manager controller container.",
-      "items": {},
-      "type": "array"
-    },
-    "helm-values.webhook.volumes": {
-      "default": [],
-      "description": "Additional volumes to add to the cert-manager controller pod.",
-      "items": {},
-      "type": "array"
-    }
-  },
-  "$ref": "#/$defs/helm-values",
-  "$schema": "http://json-schema.org/draft-07/schema#"
-}
diff --git a/packages/system/cert-manager-crds/charts/cert-manager/values.yaml b/packages/system/cert-manager-crds/charts/cert-manager/values.yaml
deleted file mode 100644
index 7a1c2953..00000000
--- a/packages/system/cert-manager-crds/charts/cert-manager/values.yaml
+++ /dev/null
@@ -1,1455 +0,0 @@
-# +docs:section=Global
-
-# Default values for cert-manager.
-# This is a YAML-formatted file.
-# Declare variables to be passed into your templates.
-global:
-  # Reference to one or more secrets to be used when pulling images.
-  # For more information, see [Pull an Image from a Private Registry](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/).
-  #
-  # For example:
-  #  imagePullSecrets:
-  #    - name: "image-pull-secret"
-  imagePullSecrets: []
-
-  # Labels to apply to all resources.
-  # Please note that this does not add labels to the resources created dynamically by the controllers.
-  # For these resources, you have to add the labels in the template in the cert-manager custom resource:
-  # For example, podTemplate/ ingressTemplate in ACMEChallengeSolverHTTP01Ingress
-  # For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#acme.cert-manager.io/v1.ACMEChallengeSolverHTTP01Ingress).
-  # For example, secretTemplate in CertificateSpec
-  # For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec).
-  commonLabels: {}
-
-  # The number of old ReplicaSets to retain to allow rollback (if not set, the default Kubernetes value is set to 10).
-  # +docs:property
-  # revisionHistoryLimit: 1
-
-  # The optional priority class to be used for the cert-manager pods.
-  priorityClassName: ""
-
-  rbac:
-    # Create required ClusterRoles and ClusterRoleBindings for cert-manager.
-    create: true
-    # Aggregate ClusterRoles to Kubernetes default user-facing roles. For more information, see [User-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles)
-    aggregateClusterRoles: true
-
-  podSecurityPolicy:
-    # Create PodSecurityPolicy for cert-manager.
-    #
-    # Note that PodSecurityPolicy was deprecated in Kubernetes 1.21 and removed in Kubernetes 1.25.
-    enabled: false
-    # Configure the PodSecurityPolicy to use AppArmor.
-    useAppArmor: true
-
-  # Set the verbosity of cert-manager. A range of 0 - 6, with 6 being the most verbose.
-  logLevel: 2
-
-  leaderElection:
-    # Override the namespace used for the leader election lease.
-    namespace: "kube-system"
-
-    # The duration that non-leader candidates will wait after observing a
-    # leadership renewal until attempting to acquire leadership of a led but
-    # unrenewed leader slot. This is effectively the maximum duration that a
-    # leader can be stopped before it is replaced by another candidate.
-    # +docs:property
-    # leaseDuration: 60s
-
-    # The interval between attempts by the acting master to renew a leadership
-    # slot before it stops leading. This must be less than or equal to the
-    # lease duration.
-    # +docs:property
-    # renewDeadline: 40s
-
-    # The duration the clients should wait between attempting acquisition and
-    # renewal of a leadership.
-    # +docs:property
-    # retryPeriod: 15s
-
-# This option is equivalent to setting crds.enabled=true and crds.keep=true.
-# Deprecated: use crds.enabled and crds.keep instead.
-installCRDs: false
-
-crds:
-  # This option decides if the CRDs should be installed
-  # as part of the Helm installation.
-  enabled: false
-
-  # This option makes it so that the "helm.sh/resource-policy": keep
-  # annotation is added to the CRD. This will prevent Helm from uninstalling
-  # the CRD when the Helm release is uninstalled.
-  # WARNING: when the CRDs are removed, all cert-manager custom resources
-  # (Certificates, Issuers, ...) will be removed too by the garbage collector.
-  keep: true
-
-# +docs:section=Controller
-
-# The number of replicas of the cert-manager controller to run.
-#
-# The default is 1, but in production set this to 2 or 3 to provide high
-# availability.
-#
-# If `replicas > 1`, consider setting `podDisruptionBudget.enabled=true`.
-#
-# Note that cert-manager uses leader election to ensure that there can
-# only be a single instance active at a time.
-replicaCount: 1
-
-# Deployment update strategy for the cert-manager controller deployment.
-# For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy).
-#
-# For example:
-#  strategy:
-#    type: RollingUpdate
-#    rollingUpdate:
-#      maxSurge: 0
-#      maxUnavailable: 1
-strategy: {}
-
-podDisruptionBudget:
-  # Enable or disable the PodDisruptionBudget resource.
-  #
-  # This prevents downtime during voluntary disruptions such as during a Node upgrade.
-  # For example, the PodDisruptionBudget will block `kubectl drain`
-  # if it is used on the Node where the only remaining cert-manager
-  # Pod is currently running.
-  enabled: false
-
-  # This configures the minimum available pods for disruptions. It can either be set to
-  # an integer (e.g. 1) or a percentage value (e.g. 25%).
-  # It cannot be used if `maxUnavailable` is set.
-  # +docs:property
-  # +docs:type=unknown
-  # minAvailable: 1
-
-  # This configures the maximum unavailable pods for disruptions. It can either be set to
-  # an integer (e.g. 1) or a percentage value (e.g. 25%).
-  # it cannot be used if `minAvailable` is set.
-  # +docs:property
-  # +docs:type=unknown
-  # maxUnavailable: 1
-
-# A comma-separated list of feature gates that should be enabled on the
-# controller pod.
-featureGates: ""
-
-# The maximum number of challenges that can be scheduled as 'processing' at once.
-maxConcurrentChallenges: 60
-
-image:
-  # The container registry to pull the manager image from.
-  # +docs:property
-  # registry: quay.io
-
-  # The container image for the cert-manager controller.
-  # +docs:property
-  repository: quay.io/jetstack/cert-manager-controller
-
-  # Override the image tag to deploy by setting this variable.
-  # If no value is set, the chart's appVersion is used.
-  # +docs:property
-  # tag: vX.Y.Z
-
-  # Setting a digest will override any tag.
-  # +docs:property
-  # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
-
-  # Kubernetes imagePullPolicy on Deployment.
-  pullPolicy: IfNotPresent
-
-# Override the namespace used to store DNS provider credentials etc. for ClusterIssuer
-# resources. By default, the same namespace as cert-manager is deployed within is
-# used. This namespace will not be automatically created by the Helm chart.
-clusterResourceNamespace: ""
-
-# This namespace allows you to define where the services are installed into.
-# If not set then they use the namespace of the release.
-# This is helpful when installing cert manager as a chart dependency (sub chart).
-namespace: ""
-
-# Override the "cert-manager.fullname" value. This value is used as part of
-# most of the names of the resources created by this Helm chart.
-# +docs:property
-# fullnameOverride: "my-cert-manager"
-
-# Override the "cert-manager.name" value, which is used to annotate some of
-# the resources that are created by this Chart (using "app.kubernetes.io/name").
-# NOTE: There are some inconsistencies in the Helm chart when it comes to
-# these annotations (some resources use eg. "cainjector.name" which resolves
-# to the value "cainjector").
-# +docs:property
-# nameOverride: "my-cert-manager"
-
-serviceAccount:
-  # Specifies whether a service account should be created.
-  create: true
-
-  # The name of the service account to use.
-  # If not set and create is true, a name is generated using the fullname template.
-  # +docs:property
-  # name: ""
-
-  # Optional additional annotations to add to the controller's Service Account.
-  # +docs:property
-  # annotations: {}
-
-  # Optional additional labels to add to the controller's Service Account.
-  # +docs:property
-  # labels: {}
-
-  # Automount API credentials for a Service Account.
-  automountServiceAccountToken: true
-
-# Automounting API credentials for a particular pod.
-# +docs:property
-# automountServiceAccountToken: true
-
-# When this flag is enabled, secrets will be automatically removed when the certificate resource is deleted.
-enableCertificateOwnerRef: false
-
-# This property is used to configure options for the controller pod.
-# This allows setting options that would usually be provided using flags.
-#
-# If `apiVersion` and `kind` are unspecified they default to the current latest
-# version (currently `controller.config.cert-manager.io/v1alpha1`). You can pin
-# the version by specifying the `apiVersion` yourself.
-#
-# For example:
-#  config:
-#    apiVersion: controller.config.cert-manager.io/v1alpha1
-#    kind: ControllerConfiguration
-#    logging:
-#      verbosity: 2
-#      format: text
-#    leaderElectionConfig:
-#      namespace: kube-system
-#    kubernetesAPIQPS: 9000
-#    kubernetesAPIBurst: 9000
-#    numberOfConcurrentWorkers: 200
-#    featureGates:
-#      AdditionalCertificateOutputFormats: true
-#      DisallowInsecureCSRUsageDefinition: true
-#      ExperimentalCertificateSigningRequestControllers: true
-#      ExperimentalGatewayAPISupport: true
-#      LiteralCertificateSubject: true
-#      SecretsFilteredCaching: true
-#      ServerSideApply: true
-#      StableCertificateRequestName: true
-#      UseCertificateRequestBasicConstraints: true
-#      ValidateCAA: true
-#    # Configure the metrics server for TLS
-#    # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
-#    metricsTLSConfig:
-#      dynamic:
-#        secretNamespace: "cert-manager"
-#        secretName: "cert-manager-metrics-ca"
-#        dnsNames:
-#        - cert-manager-metrics
-config: {}
-
-# Setting Nameservers for DNS01 Self Check.
-# For more information, see the [cert-manager documentation](https://cert-manager.io/docs/configuration/acme/dns01/#setting-nameservers-for-dns01-self-check).
-
-# A comma-separated string with the host and port of the recursive nameservers cert-manager should query.
-dns01RecursiveNameservers: ""
-
-# Forces cert-manager to use only the recursive nameservers for verification.
-# Enabling this option could cause the DNS01 self check to take longer owing to caching performed by the recursive nameservers.
-dns01RecursiveNameserversOnly: false
-
-# Option to disable cert-manager's build-in auto-approver. The auto-approver
-# approves all CertificateRequests that reference issuers matching the 'approveSignerNames'
-# option. This 'disableAutoApproval' option is useful when you want to make all approval decisions
-# using a different approver (like approver-policy - https://github.com/cert-manager/approver-policy).
-disableAutoApproval: false
-
-# List of signer names that cert-manager will approve by default. CertificateRequests
-# referencing these signer names will be auto-approved by cert-manager. Defaults to just
-# approving the cert-manager.io Issuer and ClusterIssuer issuers. When set to an empty
-# array, ALL issuers will be auto-approved by cert-manager. To disable the auto-approval,
-# because eg. you are using approver-policy, you can enable 'disableAutoApproval'.
-# ref: https://cert-manager.io/docs/concepts/certificaterequest/#approval
-# +docs:property
-approveSignerNames:
-- issuers.cert-manager.io/*
-- clusterissuers.cert-manager.io/*
-
-# Additional command line flags to pass to cert-manager controller binary.
-# To see all available flags run `docker run quay.io/jetstack/cert-manager-controller:<version> --help`.
-#
-# Use this flag to enable or disable arbitrary controllers. For example, to disable the CertificateRequests approver.
-#
-# For example:
-#  extraArgs:
-#    - --controllers=*,-certificaterequests-approver
-extraArgs: []
-
-# Additional environment variables to pass to cert-manager controller binary.
-# For example:
-#  extraEnv:
-#  - name: SOME_VAR
-#    value: 'some value'
-extraEnv: []
-
-# Resources to provide to the cert-manager controller pod.
-#
-# For example:
-#  requests:
-#    cpu: 10m
-#    memory: 32Mi
-#
-# For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
-resources: {}
-
-# Pod Security Context.
-# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
-# +docs:property
-securityContext:
-  runAsNonRoot: true
-  seccompProfile:
-    type: RuntimeDefault
-
-# Container Security Context to be set on the controller component container.
-# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
-# +docs:property
-containerSecurityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop:
-    - ALL
-  readOnlyRootFilesystem: true
-
-# Additional volumes to add to the cert-manager controller pod.
-volumes: []
-
-# Additional volume mounts to add to the cert-manager controller container.
-volumeMounts: []
-
-# Optional additional annotations to add to the controller Deployment.
-# +docs:property
-# deploymentAnnotations: {}
-
-# Optional additional annotations to add to the controller Pods.
-# +docs:property
-# podAnnotations: {}
-
-# Optional additional labels to add to the controller Pods.
-podLabels: {}
-
-# Optional annotations to add to the controller Service.
-# +docs:property
-# serviceAnnotations: {}
-
-# Optional additional labels to add to the controller Service.
-# +docs:property
-# serviceLabels: {}
-
-# Optionally set the IP family policy for the controller Service to configure dual-stack; see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services).
-# +docs:property
-# serviceIPFamilyPolicy: ""
-
-# Optionally set the IP families for the controller Service that should be supported, in the order in which they should be applied to ClusterIP. Can be IPv4 and/or IPv6.
-# +docs:property
-# serviceIPFamilies: []
-
-# Optional DNS settings. These are useful if you have a public and private DNS zone for
-# the same domain on Route 53. The following is an example of ensuring
-# cert-manager can access an ingress or DNS TXT records at all times.
-# Note that this requires Kubernetes 1.10 or `CustomPodDNS` feature gate enabled for
-# the cluster to work.
-
-# Pod DNS policy.
-# For more information, see [Pod's DNS Policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy).
-# +docs:property
-# podDnsPolicy: "None"
-
-# Pod DNS configuration. The podDnsConfig field is optional and can work with any podDnsPolicy
-# settings. However, when a Pod's dnsPolicy is set to "None", the dnsConfig field has to be specified.
-# For more information, see [Pod's DNS Config](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config).
-# +docs:property
-# podDnsConfig:
-#   nameservers:
-#     - "1.1.1.1"
-#     - "8.8.8.8"
-
-# Optional hostAliases for cert-manager-controller pods. May be useful when performing ACME DNS-01 self checks.
-hostAliases: []
-# - ip: 127.0.0.1
-#   hostnames:
-#   - foo.local
-#   - bar.local
-# - ip: 10.1.2.3
-#   hostnames:
-#   - foo.remote
-#   - bar.remote
-
-# The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
-# matching labels.
-# For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
-#
-# This default ensures that Pods are only scheduled to Linux nodes.
-# It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
-# +docs:property
-nodeSelector:
-  kubernetes.io/os: linux
-
-# +docs:ignore
-ingressShim: {}
-
-  # Optional default issuer to use for ingress resources.
-  # +docs:property=ingressShim.defaultIssuerName
-  # defaultIssuerName: ""
-
-  # Optional default issuer kind to use for ingress resources.
-  # +docs:property=ingressShim.defaultIssuerKind
-  # defaultIssuerKind: ""
-
-  # Optional default issuer group to use for ingress resources.
-  # +docs:property=ingressShim.defaultIssuerGroup
-  # defaultIssuerGroup: ""
-
-# Use these variables to configure the HTTP_PROXY environment variables.
-
-# Configures the HTTP_PROXY environment variable where a HTTP proxy is required.
-# +docs:property
-# http_proxy: "http://proxy:8080"
-
-# Configures the HTTPS_PROXY environment variable where a HTTP proxy is required.
-# +docs:property
-# https_proxy: "https://proxy:8080"
-
-# Configures the NO_PROXY environment variable where a HTTP proxy is required,
-# but certain domains should be excluded.
-# +docs:property
-# no_proxy: 127.0.0.1,localhost
-
-
-# A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
-#
-# For example:
-#   affinity:
-#     nodeAffinity:
-#      requiredDuringSchedulingIgnoredDuringExecution:
-#        nodeSelectorTerms:
-#        - matchExpressions:
-#          - key: foo.bar.com/role
-#            operator: In
-#            values:
-#            - master
-affinity: {}
-
-# A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
-#
-# For example:
-#   tolerations:
-#   - key: foo.bar.com/role
-#     operator: Equal
-#     value: master
-#     effect: NoSchedule
-tolerations: []
-
-# A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core
-#
-# For example:
-#   topologySpreadConstraints:
-#   - maxSkew: 2
-#     topologyKey: topology.kubernetes.io/zone
-#     whenUnsatisfiable: ScheduleAnyway
-#     labelSelector:
-#       matchLabels:
-#         app.kubernetes.io/instance: cert-manager
-#         app.kubernetes.io/component: controller
-topologySpreadConstraints: []
-
-# LivenessProbe settings for the controller container of the controller Pod.
-#
-# This is enabled by default, in order to enable the clock-skew liveness probe that
-# restarts the controller in case of a skew between the system clock and the monotonic clock.
-# LivenessProbe durations and thresholds are based on those used for the Kubernetes
-# controller-manager. For more information see the following on the
-# [Kubernetes GitHub repository](https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245)
-# +docs:property
-livenessProbe:
-  enabled: true
-  initialDelaySeconds: 10
-  periodSeconds: 10
-  timeoutSeconds: 15
-  successThreshold: 1
-  failureThreshold: 8
-
-# enableServiceLinks indicates whether information about services should be
-# injected into the pod's environment variables, matching the syntax of Docker
-# links.
-enableServiceLinks: false
-
-# +docs:section=Prometheus
-
-prometheus:
-  # Enable Prometheus monitoring for the cert-manager controller and webhook.
-  # If you use the Prometheus Operator, set prometheus.podmonitor.enabled or
-  # prometheus.servicemonitor.enabled, to create a PodMonitor or a
-  # ServiceMonitor resource.
-  # Otherwise, 'prometheus.io' annotations are added to the cert-manager and
-  # cert-manager-webhook Deployments.
-  # Note that you can not enable both PodMonitor and ServiceMonitor as they are
-  # mutually exclusive. Enabling both will result in an error.
-  enabled: true
-
-  servicemonitor:
-    # Create a ServiceMonitor to add cert-manager to Prometheus.
-    enabled: false
-
-    # The namespace that the service monitor should live in, defaults
-    # to the cert-manager namespace.
-    # +docs:property
-    # namespace: cert-manager
-
-    # Specifies the `prometheus` label on the created ServiceMonitor. This is
-    # used when different Prometheus instances have label selectors matching
-    # different ServiceMonitors.
-    prometheusInstance: default
-
-    # The target port to set on the ServiceMonitor. This must match the port that the
-    # cert-manager controller is listening on for metrics.
-    targetPort: 9402
-
-    # The path to scrape for metrics.
-    path: /metrics
-
-    # The interval to scrape metrics.
-    interval: 60s
-
-    # The timeout before a metrics scrape fails.
-    scrapeTimeout: 30s
-
-    # Additional labels to add to the ServiceMonitor.
-    labels: {}
-
-    # Additional annotations to add to the ServiceMonitor.
-    annotations: {}
-
-    # Keep labels from scraped data, overriding server-side labels.
-    honorLabels: false
-
-    # EndpointAdditionalProperties allows setting additional properties on the
-    # endpoint such as relabelings, metricRelabelings etc.
-    #
-    # For example:
-    #  endpointAdditionalProperties:
-    #   relabelings:
-    #   - action: replace
-    #     sourceLabels:
-    #     - __meta_kubernetes_pod_node_name
-    #     targetLabel: instance
-    #
-    # +docs:property
-    endpointAdditionalProperties: {}
-
-  # Note that you can not enable both PodMonitor and ServiceMonitor as they are mutually exclusive. Enabling both will result in an error.
-  podmonitor:
-    # Create a PodMonitor to add cert-manager to Prometheus.
-    enabled: false
-
-    # The namespace that the pod monitor should live in, defaults
-    # to the cert-manager namespace.
-    # +docs:property
-    # namespace: cert-manager
-
-    # Specifies the `prometheus` label on the created PodMonitor. This is
-    # used when different Prometheus instances have label selectors matching
-    # different PodMonitors.
-    prometheusInstance: default
-
-    # The path to scrape for metrics.
-    path: /metrics
-
-    # The interval to scrape metrics.
-    interval: 60s
-
-    # The timeout before a metrics scrape fails.
-    scrapeTimeout: 30s
-
-    # Additional labels to add to the PodMonitor.
-    labels: {}
-
-    # Additional annotations to add to the PodMonitor.
-    annotations: {}
-
-    # Keep labels from scraped data, overriding server-side labels.
-    honorLabels: false
-
-    # EndpointAdditionalProperties allows setting additional properties on the
-    # endpoint such as relabelings, metricRelabelings etc.
-    #
-    # For example:
-    #  endpointAdditionalProperties:
-    #   relabelings:
-    #   - action: replace
-    #     sourceLabels:
-    #     - __meta_kubernetes_pod_node_name
-    #     targetLabel: instance
-    #   # Configure the PodMonitor for TLS connections
-    #   # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
-    #   scheme: https
-    #   tlsConfig:
-    #     serverName: cert-manager-metrics
-    #     ca:
-    #       secret:
-    #         name: cert-manager-metrics-ca
-    #         key: "tls.crt"
-    #
-    # +docs:property
-    endpointAdditionalProperties: {}
-
-# +docs:section=Webhook
-
-webhook:
-  # Number of replicas of the cert-manager webhook to run.
-  #
-  # The default is 1, but in production set this to 2 or 3 to provide high
-  # availability.
-  #
-  # If `replicas > 1`, consider setting `webhook.podDisruptionBudget.enabled=true`.
-  replicaCount: 1
-
-  # The number of seconds the API server should wait for the webhook to respond before treating the call as a failure.
-  # The value must be between 1 and 30 seconds. For more information, see
-  # [Validating webhook configuration v1](https://kubernetes.io/docs/reference/kubernetes-api/extend-resources/validating-webhook-configuration-v1/).
-  #
-  # The default is set to the maximum value of 30 seconds as
-  # users sometimes report that the connection between the K8S API server and
-  # the cert-manager webhook server times out.
-  # If *this* timeout is reached, the error message will be "context deadline exceeded",
-  # which doesn't help the user diagnose what phase of the HTTPS connection timed out.
-  # For example, it could be during DNS resolution, TCP connection, TLS
-  # negotiation, HTTP negotiation, or slow HTTP response from the webhook
-  # server.
-  # By setting this timeout to its maximum value the underlying timeout error
-  # message has more chance of being returned to the end user.
-  timeoutSeconds: 30
-
-  # This is used to configure options for the webhook pod.
-  # This allows setting options that would usually be provided using flags.
-  #
-  # If `apiVersion` and `kind` are unspecified they default to the current latest
-  # version (currently `webhook.config.cert-manager.io/v1alpha1`). You can pin
-  # the version by specifying the `apiVersion` yourself.
-  #
-  # For example:
-  #  apiVersion: webhook.config.cert-manager.io/v1alpha1
-  #  kind: WebhookConfiguration
-  #  # The port that the webhook listens on for requests.
-  #  # In GKE private clusters, by default Kubernetes apiservers are allowed to
-  #  # talk to the cluster nodes only on 443 and 10250. Configuring
-  #  # securePort: 10250 therefore will work out-of-the-box without needing to add firewall
-  #  # rules or requiring NET_BIND_SERVICE capabilities to bind port numbers < 1000.
-  #  # This should be uncommented and set as a default by the chart once
-  #  # the apiVersion of WebhookConfiguration graduates beyond v1alpha1.
-  #  securePort: 10250
-  #  # Configure the metrics server for TLS
-  #  # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
-  #  metricsTLSConfig:
-  #    dynamic:
-  #      secretNamespace: "cert-manager"
-  #      secretName: "cert-manager-metrics-ca"
-  #      dnsNames:
-  #      - cert-manager-metrics
-  config: {}
-
-  # The update strategy for the cert-manager webhook deployment.
-  # For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy)
-  #
-  # For example:
-  #  strategy:
-  #    type: RollingUpdate
-  #    rollingUpdate:
-  #      maxSurge: 0
-  #      maxUnavailable: 1
-  strategy: {}
-
-  # Pod Security Context to be set on the webhook component Pod.
-  # For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
-  # +docs:property
-  securityContext:
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-  # Container Security Context to be set on the webhook component container.
-  # For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
-  # +docs:property
-  containerSecurityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-      - ALL
-    readOnlyRootFilesystem: true
-
-  podDisruptionBudget:
-    # Enable or disable the PodDisruptionBudget resource.
-    #
-    # This prevents downtime during voluntary disruptions such as during a Node upgrade.
-    # For example, the PodDisruptionBudget will block `kubectl drain`
-    # if it is used on the Node where the only remaining cert-manager
-    # Pod is currently running.
-    enabled: false
-
-    # This property configures the minimum available pods for disruptions. Can either be set to
-    # an integer (e.g. 1) or a percentage value (e.g. 25%).
-    # It cannot be used if `maxUnavailable` is set.
-    # +docs:property
-    # +docs:type=unknown
-    # minAvailable: 1
-
-    # This property configures the maximum unavailable pods for disruptions. Can either be set to
-    # an integer (e.g. 1) or a percentage value (e.g. 25%).
-    # It cannot be used if `minAvailable` is set.
-    # +docs:property
-    # +docs:type=unknown
-    # maxUnavailable: 1
-
-  # Optional additional annotations to add to the webhook Deployment.
-  # +docs:property
-  # deploymentAnnotations: {}
-
-  # Optional additional annotations to add to the webhook Pods.
-  # +docs:property
-  # podAnnotations: {}
-
-  # Optional additional annotations to add to the webhook Service.
-  # +docs:property
-  # serviceAnnotations: {}
-
-  # Optional additional annotations to add to the webhook MutatingWebhookConfiguration.
-  # +docs:property
-  # mutatingWebhookConfigurationAnnotations: {}
-
-  # Optional additional annotations to add to the webhook ValidatingWebhookConfiguration.
-  # +docs:property
-  # validatingWebhookConfigurationAnnotations: {}
-
-  validatingWebhookConfiguration:
-    # Configure spec.namespaceSelector for validating webhooks.
-    # +docs:property
-    namespaceSelector:
-      matchExpressions:
-        - key: "cert-manager.io/disable-validation"
-          operator: "NotIn"
-          values:
-            - "true"
-
-  mutatingWebhookConfiguration:
-    # Configure spec.namespaceSelector for mutating webhooks.
-    # +docs:property
-    namespaceSelector: {}
-    #  matchLabels:
-    #    key: value
-    #  matchExpressions:
-    #    - key: kubernetes.io/metadata.name
-    #      operator: NotIn
-    #      values:
-    #        - kube-system
-
-
-  # Additional command line flags to pass to cert-manager webhook binary.
-  # To see all available flags run `docker run quay.io/jetstack/cert-manager-webhook:<version> --help`.
-  extraArgs: []
-  # Path to a file containing a WebhookConfiguration object used to configure the webhook.
-  # - --config=<path-to-config-file>
-
-  # Additional environment variables to pass to cert-manager webhook binary.
-  # For example:
-  #  extraEnv:
-  #  - name: SOME_VAR
-  #    value: 'some value'
-  extraEnv: []
-
-  # Comma separated list of feature gates that should be enabled on the
-  # webhook pod.
-  featureGates: ""
-
-  # Resources to provide to the cert-manager webhook pod.
-  #
-  # For example:
-  #  requests:
-  #    cpu: 10m
-  #    memory: 32Mi
-  #
-  # For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
-  resources: {}
-
-  # Liveness probe values.
-  # For more information, see [Container probes](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes).
-  #
-  # +docs:property
-  livenessProbe:
-    failureThreshold: 3
-    initialDelaySeconds: 60
-    periodSeconds: 10
-    successThreshold: 1
-    timeoutSeconds: 1
-
-  # Readiness probe values.
-  # For more information, see [Container probes](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes).
-  #
-  # +docs:property
-  readinessProbe:
-    failureThreshold: 3
-    initialDelaySeconds: 5
-    periodSeconds: 5
-    successThreshold: 1
-    timeoutSeconds: 1
-
-  # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
-  # matching labels.
-  # For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
-  #
-  # This default ensures that Pods are only scheduled to Linux nodes.
-  # It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
-  # +docs:property
-  nodeSelector:
-    kubernetes.io/os: linux
-
-  # A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
-  #
-  # For example:
-  #   affinity:
-  #     nodeAffinity:
-  #      requiredDuringSchedulingIgnoredDuringExecution:
-  #        nodeSelectorTerms:
-  #        - matchExpressions:
-  #          - key: foo.bar.com/role
-  #            operator: In
-  #            values:
-  #            - master
-  affinity: {}
-
-  # A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
-  #
-  # For example:
-  #   tolerations:
-  #   - key: foo.bar.com/role
-  #     operator: Equal
-  #     value: master
-  #     effect: NoSchedule
-  tolerations: []
-
-  # A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core).
-  #
-  # For example:
-  #   topologySpreadConstraints:
-  #   - maxSkew: 2
-  #     topologyKey: topology.kubernetes.io/zone
-  #     whenUnsatisfiable: ScheduleAnyway
-  #     labelSelector:
-  #       matchLabels:
-  #         app.kubernetes.io/instance: cert-manager
-  #         app.kubernetes.io/component: controller
-  topologySpreadConstraints: []
-
-  # Optional additional labels to add to the Webhook Pods.
-  podLabels: {}
-
-  # Optional additional labels to add to the Webhook Service.
-  serviceLabels: {}
-
-  # Optionally set the IP family policy for the controller Service to configure dual-stack; see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services).
-  serviceIPFamilyPolicy: ""
-
-  # Optionally set the IP families for the controller Service that should be supported, in the order in which they should be applied to ClusterIP. Can be IPv4 and/or IPv6.
-  serviceIPFamilies: []
-
-  image:
-    # The container registry to pull the webhook image from.
-    # +docs:property
-    # registry: quay.io
-
-    # The container image for the cert-manager webhook
-    # +docs:property
-    repository: quay.io/jetstack/cert-manager-webhook
-
-    # Override the image tag to deploy by setting this variable.
-    # If no value is set, the chart's appVersion will be used.
-    # +docs:property
-    # tag: vX.Y.Z
-
-    # Setting a digest will override any tag
-    # +docs:property
-    # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
-
-    # Kubernetes imagePullPolicy on Deployment.
-    pullPolicy: IfNotPresent
-
-  serviceAccount:
-    # Specifies whether a service account should be created.
-    create: true
-
-    # The name of the service account to use.
-    # If not set and create is true, a name is generated using the fullname template.
-    # +docs:property
-    # name: ""
-
-    # Optional additional annotations to add to the webhook's Service Account.
-    # +docs:property
-    # annotations: {}
-
-    # Optional additional labels to add to the webhook's Service Account.
-    # +docs:property
-    # labels: {}
-
-    # Automount API credentials for a Service Account.
-    automountServiceAccountToken: true
-
-  # Automounting API credentials for a particular pod.
-  # +docs:property
-  # automountServiceAccountToken: true
-
-  # The port that the webhook listens on for requests.
-  # In GKE private clusters, by default Kubernetes apiservers are allowed to
-  # talk to the cluster nodes only on 443 and 10250. Configuring
-  # securePort: 10250, therefore will work out-of-the-box without needing to add firewall
-  # rules or requiring NET_BIND_SERVICE capabilities to bind port numbers <1000.
-  securePort: 10250
-
-  # Specifies if the webhook should be started in hostNetwork mode.
-  #
-  # Required for use in some managed kubernetes clusters (such as AWS EKS) with custom
-  # CNI (such as calico), because control-plane managed by AWS cannot communicate
-  # with pods' IP CIDR and admission webhooks are not working
-  #
-  # Since the default port for the webhook conflicts with kubelet on the host
-  # network, `webhook.securePort` should be changed to an available port if
-  # running in hostNetwork mode.
-  hostNetwork: false
-
-  # Specifies how the service should be handled. Useful if you want to expose the
-  # webhook outside of the cluster. In some cases, the control plane cannot
-  # reach internal services.
-  serviceType: ClusterIP
-
-  # Specify the load balancer IP for the created service.
-  # +docs:property
-  # loadBalancerIP: "10.10.10.10"
-
-  # Overrides the mutating webhook and validating webhook so they reach the webhook
-  # service using the `url` field instead of a service.
-  url: {}
-    # host:
-
-  # Enables default network policies for webhooks.
-  networkPolicy:
-    # Create network policies for the webhooks.
-    enabled: false
-
-    # Ingress rule for the webhook network policy. By default, it allows all
-    # inbound traffic.
-    # +docs:property
-    ingress:
-    - from:
-      - ipBlock:
-          cidr: 0.0.0.0/0
-
-    # Egress rule for the webhook network policy. By default, it allows all
-    # outbound traffic to ports 80 and 443, as well as DNS ports.
-    # +docs:property
-    egress:
-    - ports:
-      - port: 80
-        protocol: TCP
-      - port: 443
-        protocol: TCP
-      - port: 53
-        protocol: TCP
-      - port: 53
-        protocol: UDP
-      # On OpenShift and OKD, the Kubernetes API server listens on.
-      # port 6443.
-      - port: 6443
-        protocol: TCP
-      to:
-      - ipBlock:
-          cidr: 0.0.0.0/0
-
-  # Additional volumes to add to the cert-manager controller pod.
-  volumes: []
-
-  # Additional volume mounts to add to the cert-manager controller container.
-  volumeMounts: []
-
-  # enableServiceLinks indicates whether information about services should be
-  # injected into the pod's environment variables, matching the syntax of Docker
-  # links.
-  enableServiceLinks: false
-
-# +docs:section=CA Injector
-
-cainjector:
-  # Create the CA Injector deployment
-  enabled: true
-
-  # The number of replicas of the cert-manager cainjector to run.
-  #
-  # The default is 1, but in production set this to 2 or 3 to provide high
-  # availability.
-  #
-  # If `replicas > 1`, consider setting `cainjector.podDisruptionBudget.enabled=true`.
-  #
-  # Note that cert-manager uses leader election to ensure that there can
-  # only be a single instance active at a time.
-  replicaCount: 1
-
-  # This is used to configure options for the cainjector pod.
-  # It allows setting options that are usually provided via flags.
-  #
-  # If `apiVersion` and `kind` are unspecified they default to the current latest
-  # version (currently `cainjector.config.cert-manager.io/v1alpha1`). You can pin
-  # the version by specifying the `apiVersion` yourself.
-  #
-  # For example:
-  #  apiVersion: cainjector.config.cert-manager.io/v1alpha1
-  #  kind: CAInjectorConfiguration
-  #  logging:
-  #   verbosity: 2
-  #   format: text
-  #  leaderElectionConfig:
-  #   namespace: kube-system
-  #  # Configure the metrics server for TLS
-  #  # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
-  #  metricsTLSConfig:
-  #    dynamic:
-  #      secretNamespace: "cert-manager"
-  #      secretName: "cert-manager-metrics-ca"
-  #      dnsNames:
-  #      - cert-manager-metrics
-  config: {}
-
-  # Deployment update strategy for the cert-manager cainjector deployment.
-  # For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy).
-  #
-  # For example:
-  #  strategy:
-  #    type: RollingUpdate
-  #    rollingUpdate:
-  #      maxSurge: 0
-  #      maxUnavailable: 1
-  strategy: {}
-
-  # Pod Security Context to be set on the cainjector component Pod
-  # For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
-  # +docs:property
-  securityContext:
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-  # Container Security Context to be set on the cainjector component container
-  # For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
-  # +docs:property
-  containerSecurityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-      - ALL
-    readOnlyRootFilesystem: true
-
-  podDisruptionBudget:
-    # Enable or disable the PodDisruptionBudget resource.
-    #
-    # This prevents downtime during voluntary disruptions such as during a Node upgrade.
-    # For example, the PodDisruptionBudget will block `kubectl drain`
-    # if it is used on the Node where the only remaining cert-manager
-    # Pod is currently running.
-    enabled: false
-
-    # `minAvailable` configures the minimum available pods for disruptions. It can either be set to
-    # an integer (e.g. 1) or a percentage value (e.g. 25%).
-    # Cannot be used if `maxUnavailable` is set.
-    # +docs:property
-    # +docs:type=unknown
-    # minAvailable: 1
-
-    # `maxUnavailable` configures the maximum unavailable pods for disruptions. It can either be set to
-    # an integer (e.g. 1) or a percentage value (e.g. 25%).
-    # Cannot be used if `minAvailable` is set.
-    # +docs:property
-    # +docs:type=unknown
-    # maxUnavailable: 1
-
-  # Optional additional annotations to add to the cainjector Deployment.
-  # +docs:property
-  # deploymentAnnotations: {}
-
-  # Optional additional annotations to add to the cainjector Pods.
-  # +docs:property
-  # podAnnotations: {}
-
-  # Optional additional annotations to add to the cainjector metrics Service.
-  # +docs:property
-  # serviceAnnotations: {}
-
-  # Additional command line flags to pass to cert-manager cainjector binary.
-  # To see all available flags run `docker run quay.io/jetstack/cert-manager-cainjector:<version> --help`.
-  extraArgs: []
-  # Enable profiling for cainjector.
-  # - --enable-profiling=true
-
-  # Additional environment variables to pass to cert-manager cainjector binary.
-  # For example:
-  #  extraEnv:
-  #  - name: SOME_VAR
-  #    value: 'some value'
-  extraEnv: []
-
-  # Comma separated list of feature gates that should be enabled on the
-  # cainjector pod.
-  featureGates: ""
-
-  # Resources to provide to the cert-manager cainjector pod.
-  #
-  # For example:
-  #  requests:
-  #    cpu: 10m
-  #    memory: 32Mi
-  #
-  # For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
-  resources: {}
-
-
-  # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
-  # matching labels.
-  # For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
-  #
-  # This default ensures that Pods are only scheduled to Linux nodes.
-  # It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
-  # +docs:property
-  nodeSelector:
-    kubernetes.io/os: linux
-
-  # A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
-  #
-  # For example:
-  #   affinity:
-  #     nodeAffinity:
-  #      requiredDuringSchedulingIgnoredDuringExecution:
-  #        nodeSelectorTerms:
-  #        - matchExpressions:
-  #          - key: foo.bar.com/role
-  #            operator: In
-  #            values:
-  #            - master
-  affinity: {}
-
-  # A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
-  #
-  # For example:
-  #   tolerations:
-  #   - key: foo.bar.com/role
-  #     operator: Equal
-  #     value: master
-  #     effect: NoSchedule
-  tolerations: []
-
-  # A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core).
-  #
-  # For example:
-  #   topologySpreadConstraints:
-  #   - maxSkew: 2
-  #     topologyKey: topology.kubernetes.io/zone
-  #     whenUnsatisfiable: ScheduleAnyway
-  #     labelSelector:
-  #       matchLabels:
-  #         app.kubernetes.io/instance: cert-manager
-  #         app.kubernetes.io/component: controller
-  topologySpreadConstraints: []
-
-  # Optional additional labels to add to the CA Injector Pods.
-  podLabels: {}
-
-  # Optional additional labels to add to the CA Injector metrics Service.
-  serviceLabels: {}
-
-  image:
-    # The container registry to pull the cainjector image from.
-    # +docs:property
-    # registry: quay.io
-
-    # The container image for the cert-manager cainjector
-    # +docs:property
-    repository: quay.io/jetstack/cert-manager-cainjector
-
-    # Override the image tag to deploy by setting this variable.
-    # If no value is set, the chart's appVersion will be used.
-    # +docs:property
-    # tag: vX.Y.Z
-
-    # Setting a digest will override any tag.
-    # +docs:property
-    # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
-
-    # Kubernetes imagePullPolicy on Deployment.
-    pullPolicy: IfNotPresent
-
-  serviceAccount:
-    # Specifies whether a service account should be created.
-    create: true
-
-    # The name of the service account to use.
-    # If not set and create is true, a name is generated using the fullname template
-    # +docs:property
-    # name: ""
-
-    # Optional additional annotations to add to the cainjector's Service Account.
-    # +docs:property
-    # annotations: {}
-
-    # Optional additional labels to add to the cainjector's Service Account.
-    # +docs:property
-    # labels: {}
-
-    # Automount API credentials for a Service Account.
-    automountServiceAccountToken: true
-
-  # Automounting API credentials for a particular pod.
-  # +docs:property
-  # automountServiceAccountToken: true
-
-  # Additional volumes to add to the cert-manager controller pod.
-  volumes: []
-
-  # Additional volume mounts to add to the cert-manager controller container.
-  volumeMounts: []
-
-  # enableServiceLinks indicates whether information about services should be
-  # injected into the pod's environment variables, matching the syntax of Docker
-  # links.
-  enableServiceLinks: false
-
-# +docs:section=ACME Solver
-
-acmesolver:
-  image:
-    # The container registry to pull the acmesolver image from.
-    # +docs:property
-    # registry: quay.io
-
-    # The container image for the cert-manager acmesolver.
-    # +docs:property
-    repository: quay.io/jetstack/cert-manager-acmesolver
-
-    # Override the image tag to deploy by setting this variable.
-    # If no value is set, the chart's appVersion is used.
-    # +docs:property
-    # tag: vX.Y.Z
-
-    # Setting a digest will override any tag.
-    # +docs:property
-    # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
-
-    # Kubernetes imagePullPolicy on Deployment.
-    pullPolicy: IfNotPresent
-
-# +docs:section=Startup API Check
-# This startupapicheck is a Helm post-install hook that waits for the webhook
-# endpoints to become available.
-# The check is implemented using a Kubernetes Job - if you are injecting mesh
-# sidecar proxies into cert-manager pods, ensure that they
-# are not injected into this Job's pod. Otherwise, the installation may time out
-# owing to the Job never being completed because the sidecar proxy does not exit.
-# For more information, see [this note](https://github.com/cert-manager/cert-manager/pull/4414).
-
-startupapicheck:
-  # Enables the startup api check.
-  enabled: true
-
-  # Pod Security Context to be set on the startupapicheck component Pod.
-  # For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
-  # +docs:property
-  securityContext:
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-  # Container Security Context to be set on the controller component container.
-  # For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
-  # +docs:property
-  containerSecurityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-      - ALL
-    readOnlyRootFilesystem: true
-
-  # Timeout for 'kubectl check api' command.
-  timeout: 1m
-
-  # Job backoffLimit
-  backoffLimit: 4
-
-  # Optional additional annotations to add to the startupapicheck Job.
-  # +docs:property
-  jobAnnotations:
-    helm.sh/hook: post-install
-    helm.sh/hook-weight: "1"
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-
-  # Optional additional annotations to add to the startupapicheck Pods.
-  # +docs:property
-  # podAnnotations: {}
-
-  # Additional command line flags to pass to startupapicheck binary.
-  # To see all available flags run `docker run quay.io/jetstack/cert-manager-startupapicheck:<version> --help`.
-  #
-  # Verbose logging is enabled by default so that if startupapicheck fails, you
-  # can know what exactly caused the failure. Verbose logs include details of
-  # the webhook URL, IP address and TCP connect errors for example.
-  # +docs:property
-  extraArgs:
-  - -v
-
-  # Additional environment variables to pass to cert-manager startupapicheck binary.
-  # For example:
-  #  extraEnv:
-  #  - name: SOME_VAR
-  #    value: 'some value'
-  extraEnv: []
-
-  # Resources to provide to the cert-manager controller pod.
-  #
-  # For example:
-  #  requests:
-  #    cpu: 10m
-  #    memory: 32Mi
-  #
-  # For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
-  resources: {}
-
-
-  # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
-  # matching labels.
-  # For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
-  #
-  # This default ensures that Pods are only scheduled to Linux nodes.
-  # It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
-  # +docs:property
-  nodeSelector:
-    kubernetes.io/os: linux
-
-  # A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
-  # For example:
-  #   affinity:
-  #     nodeAffinity:
-  #      requiredDuringSchedulingIgnoredDuringExecution:
-  #        nodeSelectorTerms:
-  #        - matchExpressions:
-  #          - key: foo.bar.com/role
-  #            operator: In
-  #            values:
-  #            - master
-  affinity: {}
-
-  # A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
-  #
-  # For example:
-  #   tolerations:
-  #   - key: foo.bar.com/role
-  #     operator: Equal
-  #     value: master
-  #     effect: NoSchedule
-  tolerations: []
-
-  # Optional additional labels to add to the startupapicheck Pods.
-  podLabels: {}
-
-  image:
-    # The container registry to pull the startupapicheck image from.
-    # +docs:property
-    # registry: quay.io
-
-    # The container image for the cert-manager startupapicheck.
-    # +docs:property
-    repository: quay.io/jetstack/cert-manager-startupapicheck
-
-    # Override the image tag to deploy by setting this variable.
-    # If no value is set, the chart's appVersion is used.
-    # +docs:property
-    # tag: vX.Y.Z
-
-    # Setting a digest will override any tag.
-    # +docs:property
-    # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
-
-    # Kubernetes imagePullPolicy on Deployment.
-    pullPolicy: IfNotPresent
-
-  rbac:
-    # annotations for the startup API Check job RBAC and PSP resources.
-    # +docs:property
-    annotations:
-      helm.sh/hook: post-install
-      helm.sh/hook-weight: "-5"
-      helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-
-  # Automounting API credentials for a particular pod.
-  # +docs:property
-  # automountServiceAccountToken: true
-
-  serviceAccount:
-    # Specifies whether a service account should be created.
-    create: true
-
-    # The name of the service account to use.
-    # If not set and create is true, a name is generated using the fullname template.
-    # +docs:property
-    # name: ""
-
-    # Optional additional annotations to add to the Job's Service Account.
-    # +docs:property
-    annotations:
-      helm.sh/hook: post-install
-      helm.sh/hook-weight: "-5"
-      helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-
-    # Automount API credentials for a Service Account.
-    # +docs:property
-    automountServiceAccountToken: true
-
-    # Optional additional labels to add to the startupapicheck's Service Account.
-    # +docs:property
-    # labels: {}
-
-  # Additional volumes to add to the cert-manager controller pod.
-  volumes: []
-
-  # Additional volume mounts to add to the cert-manager controller container.
-  volumeMounts: []
-
-  # enableServiceLinks indicates whether information about services should be
-  # injected into pod's environment variables, matching the syntax of Docker
-  # links.
-  enableServiceLinks: false
-
-# Create dynamic manifests via values.
-#
-# For example:
-# extraObjects:
-#   - |
-#     apiVersion: v1
-#     kind: ConfigMap
-#     metadata:
-#       name: '{{ template "cert-manager.fullname" . }}-extra-configmap'
-extraObjects: []
-
-# Field used by our release pipeline to produce the static manifests.
-# The field defaults to "helm" but is set to "static" when we render
-# the static YAML manifests.
-# +docs:hidden
-creator: "helm"
-
-# Field that can be used as a condition when cert-manager is a dependency.
-# This definition is only here as a placeholder such that it is included in
-# the json schema.
-# See https://helm.sh/docs/chart_best_practices/dependencies/#conditions-and-tags
-# for more info.
-# +docs:hidden
-enabled: true
diff --git a/packages/system/cert-manager-crds/charts/cert-manager/templates/_helpers.tpl b/packages/system/cert-manager-crds/templates/_helpers.tpl
similarity index 95%
rename from packages/system/cert-manager-crds/charts/cert-manager/templates/_helpers.tpl
rename to packages/system/cert-manager-crds/templates/_helpers.tpl
index e15fa191..f85373f3 100644
--- a/packages/system/cert-manager-crds/charts/cert-manager/templates/_helpers.tpl
+++ b/packages/system/cert-manager-crds/templates/_helpers.tpl
@@ -187,6 +187,17 @@ See https://github.com/cert-manager/cert-manager/issues/6329 for a list of linke
 {{- end }}
 {{- end }}
 
+{{/*
+Labels for the CRD resources.
+*/}}
+{{- define "cert-manager.crd-labels" -}}
+app: "{{ template "cert-manager.name" . }}"
+app.kubernetes.io/name: "{{ template "cert-manager.name" . }}"
+app.kubernetes.io/instance: "{{ .Release.Name }}"
+app.kubernetes.io/component: "crds"
+{{ include "labels" . }}
+{{- end -}}
+
 {{/*
 Check that the user has not set both .installCRDs and .crds.enabled or
 set .installCRDs and disabled .crds.keep.
diff --git a/packages/system/cert-manager-crds/templates/crd-acme.cert-manager.io_challenges.yaml b/packages/system/cert-manager-crds/templates/crd-acme.cert-manager.io_challenges.yaml
new file mode 100644
index 00000000..5bed0cd8
--- /dev/null
+++ b/packages/system/cert-manager-crds/templates/crd-acme.cert-manager.io_challenges.yaml
@@ -0,0 +1,3281 @@
+{{- if or .Values.crds.enabled .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: "challenges.acme.cert-manager.io"
+  {{- if .Values.crds.keep }}
+  annotations:
+    helm.sh/resource-policy: keep
+  {{- end }}
+  labels:
+    {{- include "cert-manager.crd-labels" . | nindent 4 }}
+spec:
+  group: acme.cert-manager.io
+  names:
+    categories:
+      - cert-manager
+      - cert-manager-acme
+    kind: Challenge
+    listKind: ChallengeList
+    plural: challenges
+    singular: challenge
+  scope: Namespaced
+  versions:
+    - additionalPrinterColumns:
+        - jsonPath: .status.state
+          name: State
+          type: string
+        - jsonPath: .spec.dnsName
+          name: Domain
+          type: string
+        - jsonPath: .status.reason
+          name: Reason
+          priority: 1
+          type: string
+        - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+          jsonPath: .metadata.creationTimestamp
+          name: Age
+          type: date
+      name: v1
+      schema:
+        openAPIV3Schema:
+          description: Challenge is a type to represent a Challenge request with an ACME server
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              properties:
+                authorizationURL:
+                  description: |-
+                    The URL to the ACME Authorization resource that this
+                    challenge is a part of.
+                  type: string
+                dnsName:
+                  description: |-
+                    dnsName is the identifier that this challenge is for, e.g., example.com.
+                    If the requested DNSName is a 'wildcard', this field MUST be set to the
+                    non-wildcard domain, e.g., for `*.example.com`, it must be `example.com`.
+                  type: string
+                issuerRef:
+                  description: |-
+                    References a properly configured ACME-type Issuer which should
+                    be used to create this Challenge.
+                    If the Issuer does not exist, processing will be retried.
+                    If the Issuer is not an 'ACME' Issuer, an error will be returned and the
+                    Challenge will be marked as failed.
+                  properties:
+                    group:
+                      description: |-
+                        Group of the issuer being referred to.
+                        Defaults to 'cert-manager.io'.
+                      type: string
+                    kind:
+                      description: |-
+                        Kind of the issuer being referred to.
+                        Defaults to 'Issuer'.
+                      type: string
+                    name:
+                      description: Name of the issuer being referred to.
+                      type: string
+                  required:
+                    - name
+                  type: object
+                key:
+                  description: |-
+                    The ACME challenge key for this challenge
+                    For HTTP01 challenges, this is the value that must be responded with to
+                    complete the HTTP01 challenge in the format:
+                    `<private key JWK thumbprint>.<key from acme server for challenge>`.
+                    For DNS01 challenges, this is the base64 encoded SHA256 sum of the
+                    `<private key JWK thumbprint>.<key from acme server for challenge>`
+                    text that must be set as the TXT record content.
+                  type: string
+                solver:
+                  description: |-
+                    Contains the domain solving configuration that should be used to
+                    solve this challenge resource.
+                  properties:
+                    dns01:
+                      description: |-
+                        Configures cert-manager to attempt to complete authorizations by
+                        performing the DNS01 challenge flow.
+                      properties:
+                        acmeDNS:
+                          description: |-
+                            Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
+                            DNS01 challenge records.
+                          properties:
+                            accountSecretRef:
+                              description: |-
+                                A reference to a specific 'key' within a Secret resource.
+                                In some instances, `key` is a required field.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used.
+                                    Some instances of this field may be defaulted, in others it may be
+                                    required.
+                                  type: string
+                                name:
+                                  description: |-
+                                    Name of the resource being referred to.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                            host:
+                              type: string
+                          required:
+                            - accountSecretRef
+                            - host
+                          type: object
+                        akamai:
+                          description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
+                          properties:
+                            accessTokenSecretRef:
+                              description: |-
+                                A reference to a specific 'key' within a Secret resource.
+                                In some instances, `key` is a required field.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used.
+                                    Some instances of this field may be defaulted, in others it may be
+                                    required.
+                                  type: string
+                                name:
+                                  description: |-
+                                    Name of the resource being referred to.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                            clientSecretSecretRef:
+                              description: |-
+                                A reference to a specific 'key' within a Secret resource.
+                                In some instances, `key` is a required field.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used.
+                                    Some instances of this field may be defaulted, in others it may be
+                                    required.
+                                  type: string
+                                name:
+                                  description: |-
+                                    Name of the resource being referred to.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                            clientTokenSecretRef:
+                              description: |-
+                                A reference to a specific 'key' within a Secret resource.
+                                In some instances, `key` is a required field.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used.
+                                    Some instances of this field may be defaulted, in others it may be
+                                    required.
+                                  type: string
+                                name:
+                                  description: |-
+                                    Name of the resource being referred to.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                            serviceConsumerDomain:
+                              type: string
+                          required:
+                            - accessTokenSecretRef
+                            - clientSecretSecretRef
+                            - clientTokenSecretRef
+                            - serviceConsumerDomain
+                          type: object
+                        azureDNS:
+                          description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
+                          properties:
+                            clientID:
+                              description: |-
+                                Auth: Azure Service Principal:
+                                The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
+                                If set, ClientSecret and TenantID must also be set.
+                              type: string
+                            clientSecretSecretRef:
+                              description: |-
+                                Auth: Azure Service Principal:
+                                A reference to a Secret containing the password associated with the Service Principal.
+                                If set, ClientID and TenantID must also be set.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used.
+                                    Some instances of this field may be defaulted, in others it may be
+                                    required.
+                                  type: string
+                                name:
+                                  description: |-
+                                    Name of the resource being referred to.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                            environment:
+                              description: name of the Azure environment (default AzurePublicCloud)
+                              enum:
+                                - AzurePublicCloud
+                                - AzureChinaCloud
+                                - AzureGermanCloud
+                                - AzureUSGovernmentCloud
+                              type: string
+                            hostedZoneName:
+                              description: name of the DNS zone that should be used
+                              type: string
+                            managedIdentity:
+                              description: |-
+                                Auth: Azure Workload Identity or Azure Managed Service Identity:
+                                Settings to enable Azure Workload Identity or Azure Managed Service Identity
+                                If set, ClientID, ClientSecret and TenantID must not be set.
+                              properties:
+                                clientID:
+                                  description: client ID of the managed identity, cannot be used at the same time as resourceID
+                                  type: string
+                                resourceID:
+                                  description: |-
+                                    resource ID of the managed identity, cannot be used at the same time as clientID
+                                    Cannot be used for Azure Managed Service Identity
+                                  type: string
+                                tenantID:
+                                  description: tenant ID of the managed identity, cannot be used at the same time as resourceID
+                                  type: string
+                              type: object
+                            resourceGroupName:
+                              description: resource group the DNS zone is located in
+                              type: string
+                            subscriptionID:
+                              description: ID of the Azure subscription
+                              type: string
+                            tenantID:
+                              description: |-
+                                Auth: Azure Service Principal:
+                                The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
+                                If set, ClientID and ClientSecret must also be set.
+                              type: string
+                          required:
+                            - resourceGroupName
+                            - subscriptionID
+                          type: object
+                        cloudDNS:
+                          description: Use the Google Cloud DNS API to manage DNS01 challenge records.
+                          properties:
+                            hostedZoneName:
+                              description: |-
+                                HostedZoneName is an optional field that tells cert-manager in which
+                                Cloud DNS zone the challenge record has to be created.
+                                If left empty cert-manager will automatically choose a zone.
+                              type: string
+                            project:
+                              type: string
+                            serviceAccountSecretRef:
+                              description: |-
+                                A reference to a specific 'key' within a Secret resource.
+                                In some instances, `key` is a required field.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used.
+                                    Some instances of this field may be defaulted, in others it may be
+                                    required.
+                                  type: string
+                                name:
+                                  description: |-
+                                    Name of the resource being referred to.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                          required:
+                            - project
+                          type: object
+                        cloudflare:
+                          description: Use the Cloudflare API to manage DNS01 challenge records.
+                          properties:
+                            apiKeySecretRef:
+                              description: |-
+                                API key to use to authenticate with Cloudflare.
+                                Note: using an API token to authenticate is now the recommended method
+                                as it allows greater control of permissions.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used.
+                                    Some instances of this field may be defaulted, in others it may be
+                                    required.
+                                  type: string
+                                name:
+                                  description: |-
+                                    Name of the resource being referred to.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                            apiTokenSecretRef:
+                              description: API token used to authenticate with Cloudflare.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used.
+                                    Some instances of this field may be defaulted, in others it may be
+                                    required.
+                                  type: string
+                                name:
+                                  description: |-
+                                    Name of the resource being referred to.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                            email:
+                              description: Email of the account, only required when using API key based authentication.
+                              type: string
+                          type: object
+                        cnameStrategy:
+                          description: |-
+                            CNAMEStrategy configures how the DNS01 provider should handle CNAME
+                            records when found in DNS zones.
+                          enum:
+                            - None
+                            - Follow
+                          type: string
+                        digitalocean:
+                          description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
+                          properties:
+                            tokenSecretRef:
+                              description: |-
+                                A reference to a specific 'key' within a Secret resource.
+                                In some instances, `key` is a required field.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used.
+                                    Some instances of this field may be defaulted, in others it may be
+                                    required.
+                                  type: string
+                                name:
+                                  description: |-
+                                    Name of the resource being referred to.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                          required:
+                            - tokenSecretRef
+                          type: object
+                        rfc2136:
+                          description: |-
+                            Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
+                            to manage DNS01 challenge records.
+                          properties:
+                            nameserver:
+                              description: |-
+                                The IP address or hostname of an authoritative DNS server supporting
+                                RFC2136 in the form host:port. If the host is an IPv6 address it must be
+                                enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
+                                This field is required.
+                              type: string
+                            protocol:
+                              description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default).
+                              enum:
+                                - TCP
+                                - UDP
+                              type: string
+                            tsigAlgorithm:
+                              description: |-
+                                The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
+                                when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
+                                Supported values are (case-insensitive): ``HMACMD5`` (default),
+                                ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
+                              type: string
+                            tsigKeyName:
+                              description: |-
+                                The TSIG Key name configured in the DNS.
+                                If ``tsigSecretSecretRef`` is defined, this field is required.
+                              type: string
+                            tsigSecretSecretRef:
+                              description: |-
+                                The name of the secret containing the TSIG value.
+                                If ``tsigKeyName`` is defined, this field is required.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used.
+                                    Some instances of this field may be defaulted, in others it may be
+                                    required.
+                                  type: string
+                                name:
+                                  description: |-
+                                    Name of the resource being referred to.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                          required:
+                            - nameserver
+                          type: object
+                        route53:
+                          description: Use the AWS Route53 API to manage DNS01 challenge records.
+                          properties:
+                            accessKeyID:
+                              description: |-
+                                The AccessKeyID is used for authentication.
+                                Cannot be set when SecretAccessKeyID is set.
+                                If neither the Access Key nor Key ID are set, we fall-back to using env
+                                vars, shared credentials file or AWS Instance metadata,
+                                see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+                              type: string
+                            accessKeyIDSecretRef:
+                              description: |-
+                                The SecretAccessKey is used for authentication. If set, pull the AWS
+                                access key ID from a key within a Kubernetes Secret.
+                                Cannot be set when AccessKeyID is set.
+                                If neither the Access Key nor Key ID are set, we fall-back to using env
+                                vars, shared credentials file or AWS Instance metadata,
+                                see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used.
+                                    Some instances of this field may be defaulted, in others it may be
+                                    required.
+                                  type: string
+                                name:
+                                  description: |-
+                                    Name of the resource being referred to.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                            auth:
+                              description: Auth configures how cert-manager authenticates.
+                              properties:
+                                kubernetes:
+                                  description: |-
+                                    Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
+                                    by passing a bound ServiceAccount token.
+                                  properties:
+                                    serviceAccountRef:
+                                      description: |-
+                                        A reference to a service account that will be used to request a bound
+                                        token (also known as "projected token"). To use this field, you must
+                                        configure an RBAC rule to let cert-manager request a token.
+                                      properties:
+                                        audiences:
+                                          description: |-
+                                            TokenAudiences is an optional list of audiences to include in the
+                                            token passed to AWS. The default token consisting of the issuer's namespace
+                                            and name is always included.
+                                            If unset the audience defaults to `sts.amazonaws.com`.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        name:
+                                          description: Name of the ServiceAccount used to request a token.
+                                          type: string
+                                      required:
+                                        - name
+                                      type: object
+                                  required:
+                                    - serviceAccountRef
+                                  type: object
+                              required:
+                                - kubernetes
+                              type: object
+                            hostedZoneID:
+                              description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.
+                              type: string
+                            region:
+                              description: |-
+                                Override the AWS region.
+
+                                Route53 is a global service and does not have regional endpoints but the
+                                region specified here (or via environment variables) is used as a hint to
+                                help compute the correct AWS credential scope and partition when it
+                                connects to Route53. See:
+                                - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
+                                - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)
+
+                                If you omit this region field, cert-manager will use the region from
+                                AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
+                                in the cert-manager controller Pod.
+
+                                The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
+                                Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
+                                [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
+                                In this case this `region` field value is ignored.
+
+                                The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
+                                Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
+                                [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
+                                In this case this `region` field value is ignored.
+                              type: string
+                            role:
+                              description: |-
+                                Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
+                                or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
+                              type: string
+                            secretAccessKeySecretRef:
+                              description: |-
+                                The SecretAccessKey is used for authentication.
+                                If neither the Access Key nor Key ID are set, we fall-back to using env
+                                vars, shared credentials file or AWS Instance metadata,
+                                see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used.
+                                    Some instances of this field may be defaulted, in others it may be
+                                    required.
+                                  type: string
+                                name:
+                                  description: |-
+                                    Name of the resource being referred to.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                          type: object
+                        webhook:
+                          description: |-
+                            Configure an external webhook based DNS01 challenge solver to manage
+                            DNS01 challenge records.
+                          properties:
+                            config:
+                              description: |-
+                                Additional configuration that should be passed to the webhook apiserver
+                                when challenges are processed.
+                                This can contain arbitrary JSON data.
+                                Secret values should not be specified in this stanza.
+                                If secret values are needed (e.g., credentials for a DNS service), you
+                                should use a SecretKeySelector to reference a Secret resource.
+                                For details on the schema of this field, consult the webhook provider
+                                implementation's documentation.
+                              x-kubernetes-preserve-unknown-fields: true
+                            groupName:
+                              description: |-
+                                The API group name that should be used when POSTing ChallengePayload
+                                resources to the webhook apiserver.
+                                This should be the same as the GroupName specified in the webhook
+                                provider implementation.
+                              type: string
+                            solverName:
+                              description: |-
+                                The name of the solver to use, as defined in the webhook provider
+                                implementation.
+                                This will typically be the name of the provider, e.g., 'cloudflare'.
+                              type: string
+                          required:
+                            - groupName
+                            - solverName
+                          type: object
+                      type: object
+                    http01:
+                      description: |-
+                        Configures cert-manager to attempt to complete authorizations by
+                        performing the HTTP01 challenge flow.
+                        It is not possible to obtain certificates for wildcard domain names
+                        (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
+                      properties:
+                        gatewayHTTPRoute:
+                          description: |-
+                            The Gateway API is a sig-network community API that models service networking
+                            in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
+                            create HTTPRoutes with the specified labels in the same namespace as the challenge.
+                            This solver is experimental, and fields / behaviour may change in the future.
+                          properties:
+                            labels:
+                              additionalProperties:
+                                type: string
+                              description: |-
+                                Custom labels that will be applied to HTTPRoutes created by cert-manager
+                                while solving HTTP-01 challenges.
+                              type: object
+                            parentRefs:
+                              description: |-
+                                When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
+                                cert-manager needs to know which parentRefs should be used when creating
+                                the HTTPRoute. Usually, the parentRef references a Gateway. See:
+                                https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
+                              items:
+                                description: |-
+                                  ParentReference identifies an API object (usually a Gateway) that can be considered
+                                  a parent of this resource (usually a route). There are two kinds of parent resources
+                                  with "Core" support:
+
+                                  * Gateway (Gateway conformance profile)
+                                  * Service (Mesh conformance profile, ClusterIP Services only)
+
+                                  This API may be extended in the future to support additional kinds of parent
+                                  resources.
+
+                                  The API object must be valid in the cluster; the Group and Kind must
+                                  be registered in the cluster for this reference to be valid.
+                                properties:
+                                  group:
+                                    default: gateway.networking.k8s.io
+                                    description: |-
+                                      Group is the group of the referent.
+                                      When unspecified, "gateway.networking.k8s.io" is inferred.
+                                      To set the core API group (such as for a "Service" kind referent),
+                                      Group must be explicitly set to "" (empty string).
+
+                                      Support: Core
+                                    maxLength: 253
+                                    pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                    type: string
+                                  kind:
+                                    default: Gateway
+                                    description: |-
+                                      Kind is kind of the referent.
+
+                                      There are two kinds of parent resources with "Core" support:
+
+                                      * Gateway (Gateway conformance profile)
+                                      * Service (Mesh conformance profile, ClusterIP Services only)
+
+                                      Support for other resources is Implementation-Specific.
+                                    maxLength: 63
+                                    minLength: 1
+                                    pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                    type: string
+                                  name:
+                                    description: |-
+                                      Name is the name of the referent.
+
+                                      Support: Core
+                                    maxLength: 253
+                                    minLength: 1
+                                    type: string
+                                  namespace:
+                                    description: |-
+                                      Namespace is the namespace of the referent. When unspecified, this refers
+                                      to the local namespace of the Route.
+
+                                      Note that there are specific rules for ParentRefs which cross namespace
+                                      boundaries. Cross-namespace references are only valid if they are explicitly
+                                      allowed by something in the namespace they are referring to. For example:
+                                      Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                                      generic way to enable any other kind of cross-namespace reference.
+
+                                      <gateway:experimental:description>
+                                      ParentRefs from a Route to a Service in the same namespace are "producer"
+                                      routes, which apply default routing rules to inbound connections from
+                                      any namespace to the Service.
+
+                                      ParentRefs from a Route to a Service in a different namespace are
+                                      "consumer" routes, and these routing rules are only applied to outbound
+                                      connections originating from the same namespace as the Route, for which
+                                      the intended destination of the connections are a Service targeted as a
+                                      ParentRef of the Route.
+                                      </gateway:experimental:description>
+
+                                      Support: Core
+                                    maxLength: 63
+                                    minLength: 1
+                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                    type: string
+                                  port:
+                                    description: |-
+                                      Port is the network port this Route targets. It can be interpreted
+                                      differently based on the type of parent resource.
+
+                                      When the parent resource is a Gateway, this targets all listeners
+                                      listening on the specified port that also support this kind of Route(and
+                                      select this Route). It's not recommended to set `Port` unless the
+                                      networking behaviors specified in a Route must apply to a specific port
+                                      as opposed to a listener(s) whose port(s) may be changed. When both Port
+                                      and SectionName are specified, the name and port of the selected listener
+                                      must match both specified values.
+
+                                      <gateway:experimental:description>
+                                      When the parent resource is a Service, this targets a specific port in the
+                                      Service spec. When both Port (experimental) and SectionName are specified,
+                                      the name and port of the selected port must match both specified values.
+                                      </gateway:experimental:description>
+
+                                      Implementations MAY choose to support other parent resources.
+                                      Implementations supporting other types of parent resources MUST clearly
+                                      document how/if Port is interpreted.
+
+                                      For the purpose of status, an attachment is considered successful as
+                                      long as the parent resource accepts it partially. For example, Gateway
+                                      listeners can restrict which Routes can attach to them by Route kind,
+                                      namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                                      from the referencing Route, the Route MUST be considered successfully
+                                      attached. If no Gateway listeners accept attachment from this Route,
+                                      the Route MUST be considered detached from the Gateway.
+
+                                      Support: Extended
+                                    format: int32
+                                    maximum: 65535
+                                    minimum: 1
+                                    type: integer
+                                  sectionName:
+                                    description: |-
+                                      SectionName is the name of a section within the target resource. In the
+                                      following resources, SectionName is interpreted as the following:
+
+                                      * Gateway: Listener name. When both Port (experimental) and SectionName
+                                      are specified, the name and port of the selected listener must match
+                                      both specified values.
+                                      * Service: Port name. When both Port (experimental) and SectionName
+                                      are specified, the name and port of the selected listener must match
+                                      both specified values.
+
+                                      Implementations MAY choose to support attaching Routes to other resources.
+                                      If that is the case, they MUST clearly document how SectionName is
+                                      interpreted.
+
+                                      When unspecified (empty string), this will reference the entire resource.
+                                      For the purpose of status, an attachment is considered successful if at
+                                      least one section in the parent resource accepts it. For example, Gateway
+                                      listeners can restrict which Routes can attach to them by Route kind,
+                                      namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                                      the referencing Route, the Route MUST be considered successfully
+                                      attached. If no Gateway listeners accept attachment from this Route, the
+                                      Route MUST be considered detached from the Gateway.
+
+                                      Support: Core
+                                    maxLength: 253
+                                    minLength: 1
+                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                    type: string
+                                required:
+                                  - name
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            podTemplate:
+                              description: |-
+                                Optional pod template used to configure the ACME challenge solver pods
+                                used for HTTP01 challenges.
+                              properties:
+                                metadata:
+                                  description: |-
+                                    ObjectMeta overrides for the pod used to solve HTTP01 challenges.
+                                    Only the 'labels' and 'annotations' fields may be set.
+                                    If labels or annotations overlap with in-built values, the values here
+                                    will override the in-built values.
+                                  properties:
+                                    annotations:
+                                      additionalProperties:
+                                        type: string
+                                      description: Annotations that should be added to the created ACME HTTP01 solver pods.
+                                      type: object
+                                    labels:
+                                      additionalProperties:
+                                        type: string
+                                      description: Labels that should be added to the created ACME HTTP01 solver pods.
+                                      type: object
+                                  type: object
+                                spec:
+                                  description: |-
+                                    PodSpec defines overrides for the HTTP01 challenge solver pod.
+                                    Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
+                                    All other fields will be ignored.
+                                  properties:
+                                    affinity:
+                                      description: If specified, the pod's scheduling constraints
+                                      properties:
+                                        nodeAffinity:
+                                          description: Describes node affinity scheduling rules for the pod.
+                                          properties:
+                                            preferredDuringSchedulingIgnoredDuringExecution:
+                                              description: |-
+                                                The scheduler will prefer to schedule pods to nodes that satisfy
+                                                the affinity expressions specified by this field, but it may choose
+                                                a node that violates one or more of the expressions. The node that is
+                                                most preferred is the one with the greatest sum of weights, i.e.
+                                                for each node that meets all of the scheduling requirements (resource
+                                                request, requiredDuringScheduling affinity expressions, etc.),
+                                                compute a sum by iterating through the elements of this field and adding
+                                                "weight" to the sum if the node matches the corresponding matchExpressions; the
+                                                node(s) with the highest sum are the most preferred.
+                                              items:
+                                                description: |-
+                                                  An empty preferred scheduling term matches all objects with implicit weight 0
+                                                  (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+                                                properties:
+                                                  preference:
+                                                    description: A node selector term, associated with the corresponding weight.
+                                                    properties:
+                                                      matchExpressions:
+                                                        description: A list of node selector requirements by node's labels.
+                                                        items:
+                                                          description: |-
+                                                            A node selector requirement is a selector that contains values, a key, and an operator
+                                                            that relates the key and values.
+                                                          properties:
+                                                            key:
+                                                              description: The label key that the selector applies to.
+                                                              type: string
+                                                            operator:
+                                                              description: |-
+                                                                Represents a key's relationship to a set of values.
+                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                              type: string
+                                                            values:
+                                                              description: |-
+                                                                An array of string values. If the operator is In or NotIn,
+                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                the values array must be empty. If the operator is Gt or Lt, the values
+                                                                array must have a single element, which will be interpreted as an integer.
+                                                                This array is replaced during a strategic merge patch.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          required:
+                                                            - key
+                                                            - operator
+                                                          type: object
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      matchFields:
+                                                        description: A list of node selector requirements by node's fields.
+                                                        items:
+                                                          description: |-
+                                                            A node selector requirement is a selector that contains values, a key, and an operator
+                                                            that relates the key and values.
+                                                          properties:
+                                                            key:
+                                                              description: The label key that the selector applies to.
+                                                              type: string
+                                                            operator:
+                                                              description: |-
+                                                                Represents a key's relationship to a set of values.
+                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                              type: string
+                                                            values:
+                                                              description: |-
+                                                                An array of string values. If the operator is In or NotIn,
+                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                the values array must be empty. If the operator is Gt or Lt, the values
+                                                                array must have a single element, which will be interpreted as an integer.
+                                                                This array is replaced during a strategic merge patch.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          required:
+                                                            - key
+                                                            - operator
+                                                          type: object
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                    type: object
+                                                    x-kubernetes-map-type: atomic
+                                                  weight:
+                                                    description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
+                                                    format: int32
+                                                    type: integer
+                                                required:
+                                                  - preference
+                                                  - weight
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            requiredDuringSchedulingIgnoredDuringExecution:
+                                              description: |-
+                                                If the affinity requirements specified by this field are not met at
+                                                scheduling time, the pod will not be scheduled onto the node.
+                                                If the affinity requirements specified by this field cease to be met
+                                                at some point during pod execution (e.g. due to an update), the system
+                                                may or may not try to eventually evict the pod from its node.
+                                              properties:
+                                                nodeSelectorTerms:
+                                                  description: Required. A list of node selector terms. The terms are ORed.
+                                                  items:
+                                                    description: |-
+                                                      A null or empty node selector term matches no objects. The requirements of
+                                                      them are ANDed.
+                                                      The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+                                                    properties:
+                                                      matchExpressions:
+                                                        description: A list of node selector requirements by node's labels.
+                                                        items:
+                                                          description: |-
+                                                            A node selector requirement is a selector that contains values, a key, and an operator
+                                                            that relates the key and values.
+                                                          properties:
+                                                            key:
+                                                              description: The label key that the selector applies to.
+                                                              type: string
+                                                            operator:
+                                                              description: |-
+                                                                Represents a key's relationship to a set of values.
+                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                              type: string
+                                                            values:
+                                                              description: |-
+                                                                An array of string values. If the operator is In or NotIn,
+                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                the values array must be empty. If the operator is Gt or Lt, the values
+                                                                array must have a single element, which will be interpreted as an integer.
+                                                                This array is replaced during a strategic merge patch.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          required:
+                                                            - key
+                                                            - operator
+                                                          type: object
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      matchFields:
+                                                        description: A list of node selector requirements by node's fields.
+                                                        items:
+                                                          description: |-
+                                                            A node selector requirement is a selector that contains values, a key, and an operator
+                                                            that relates the key and values.
+                                                          properties:
+                                                            key:
+                                                              description: The label key that the selector applies to.
+                                                              type: string
+                                                            operator:
+                                                              description: |-
+                                                                Represents a key's relationship to a set of values.
+                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                              type: string
+                                                            values:
+                                                              description: |-
+                                                                An array of string values. If the operator is In or NotIn,
+                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                the values array must be empty. If the operator is Gt or Lt, the values
+                                                                array must have a single element, which will be interpreted as an integer.
+                                                                This array is replaced during a strategic merge patch.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          required:
+                                                            - key
+                                                            - operator
+                                                          type: object
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                    type: object
+                                                    x-kubernetes-map-type: atomic
+                                                  type: array
+                                                  x-kubernetes-list-type: atomic
+                                              required:
+                                                - nodeSelectorTerms
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                          type: object
+                                        podAffinity:
+                                          description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
+                                          properties:
+                                            preferredDuringSchedulingIgnoredDuringExecution:
+                                              description: |-
+                                                The scheduler will prefer to schedule pods to nodes that satisfy
+                                                the affinity expressions specified by this field, but it may choose
+                                                a node that violates one or more of the expressions. The node that is
+                                                most preferred is the one with the greatest sum of weights, i.e.
+                                                for each node that meets all of the scheduling requirements (resource
+                                                request, requiredDuringScheduling affinity expressions, etc.),
+                                                compute a sum by iterating through the elements of this field and adding
+                                                "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                                node(s) with the highest sum are the most preferred.
+                                              items:
+                                                description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+                                                properties:
+                                                  podAffinityTerm:
+                                                    description: Required. A pod affinity term, associated with the corresponding weight.
+                                                    properties:
+                                                      labelSelector:
+                                                        description: |-
+                                                          A label query over a set of resources, in this case pods.
+                                                          If it's null, this PodAffinityTerm matches with no Pods.
+                                                        properties:
+                                                          matchExpressions:
+                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                            items:
+                                                              description: |-
+                                                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                relates the key and values.
+                                                              properties:
+                                                                key:
+                                                                  description: key is the label key that the selector applies to.
+                                                                  type: string
+                                                                operator:
+                                                                  description: |-
+                                                                    operator represents a key's relationship to a set of values.
+                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                  type: string
+                                                                values:
+                                                                  description: |-
+                                                                    values is an array of string values. If the operator is In or NotIn,
+                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                    the values array must be empty. This array is replaced during a strategic
+                                                                    merge patch.
+                                                                  items:
+                                                                    type: string
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                              required:
+                                                                - key
+                                                                - operator
+                                                              type: object
+                                                            type: array
+                                                            x-kubernetes-list-type: atomic
+                                                          matchLabels:
+                                                            additionalProperties:
+                                                              type: string
+                                                            description: |-
+                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                            type: object
+                                                        type: object
+                                                        x-kubernetes-map-type: atomic
+                                                      matchLabelKeys:
+                                                        description: |-
+                                                          MatchLabelKeys is a set of pod label keys to select which pods will
+                                                          be taken into consideration. The keys are used to lookup values from the
+                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                          to select the group of existing pods which pods will be taken into consideration
+                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                          pod labels will be ignored. The default value is empty.
+                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                        items:
+                                                          type: string
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      mismatchLabelKeys:
+                                                        description: |-
+                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                          be taken into consideration. The keys are used to lookup values from the
+                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                          to select the group of existing pods which pods will be taken into consideration
+                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                          pod labels will be ignored. The default value is empty.
+                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                        items:
+                                                          type: string
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      namespaceSelector:
+                                                        description: |-
+                                                          A label query over the set of namespaces that the term applies to.
+                                                          The term is applied to the union of the namespaces selected by this field
+                                                          and the ones listed in the namespaces field.
+                                                          null selector and null or empty namespaces list means "this pod's namespace".
+                                                          An empty selector ({}) matches all namespaces.
+                                                        properties:
+                                                          matchExpressions:
+                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                            items:
+                                                              description: |-
+                                                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                relates the key and values.
+                                                              properties:
+                                                                key:
+                                                                  description: key is the label key that the selector applies to.
+                                                                  type: string
+                                                                operator:
+                                                                  description: |-
+                                                                    operator represents a key's relationship to a set of values.
+                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                  type: string
+                                                                values:
+                                                                  description: |-
+                                                                    values is an array of string values. If the operator is In or NotIn,
+                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                    the values array must be empty. This array is replaced during a strategic
+                                                                    merge patch.
+                                                                  items:
+                                                                    type: string
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                              required:
+                                                                - key
+                                                                - operator
+                                                              type: object
+                                                            type: array
+                                                            x-kubernetes-list-type: atomic
+                                                          matchLabels:
+                                                            additionalProperties:
+                                                              type: string
+                                                            description: |-
+                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                            type: object
+                                                        type: object
+                                                        x-kubernetes-map-type: atomic
+                                                      namespaces:
+                                                        description: |-
+                                                          namespaces specifies a static list of namespace names that the term applies to.
+                                                          The term is applied to the union of the namespaces listed in this field
+                                                          and the ones selected by namespaceSelector.
+                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                        items:
+                                                          type: string
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      topologyKey:
+                                                        description: |-
+                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                          whose value of the label with key topologyKey matches that of any node on which any of the
+                                                          selected pods is running.
+                                                          Empty topologyKey is not allowed.
+                                                        type: string
+                                                    required:
+                                                      - topologyKey
+                                                    type: object
+                                                  weight:
+                                                    description: |-
+                                                      weight associated with matching the corresponding podAffinityTerm,
+                                                      in the range 1-100.
+                                                    format: int32
+                                                    type: integer
+                                                required:
+                                                  - podAffinityTerm
+                                                  - weight
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            requiredDuringSchedulingIgnoredDuringExecution:
+                                              description: |-
+                                                If the affinity requirements specified by this field are not met at
+                                                scheduling time, the pod will not be scheduled onto the node.
+                                                If the affinity requirements specified by this field cease to be met
+                                                at some point during pod execution (e.g. due to a pod label update), the
+                                                system may or may not try to eventually evict the pod from its node.
+                                                When there are multiple elements, the lists of nodes corresponding to each
+                                                podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                              items:
+                                                description: |-
+                                                  Defines a set of pods (namely those matching the labelSelector
+                                                  relative to the given namespace(s)) that this pod should be
+                                                  co-located (affinity) or not co-located (anti-affinity) with,
+                                                  where co-located is defined as running on a node whose value of
+                                                  the label with key <topologyKey> matches that of any node on which
+                                                  a pod of the set of pods is running
+                                                properties:
+                                                  labelSelector:
+                                                    description: |-
+                                                      A label query over a set of resources, in this case pods.
+                                                      If it's null, this PodAffinityTerm matches with no Pods.
+                                                    properties:
+                                                      matchExpressions:
+                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                        items:
+                                                          description: |-
+                                                            A label selector requirement is a selector that contains values, a key, and an operator that
+                                                            relates the key and values.
+                                                          properties:
+                                                            key:
+                                                              description: key is the label key that the selector applies to.
+                                                              type: string
+                                                            operator:
+                                                              description: |-
+                                                                operator represents a key's relationship to a set of values.
+                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                              type: string
+                                                            values:
+                                                              description: |-
+                                                                values is an array of string values. If the operator is In or NotIn,
+                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                the values array must be empty. This array is replaced during a strategic
+                                                                merge patch.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          required:
+                                                            - key
+                                                            - operator
+                                                          type: object
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      matchLabels:
+                                                        additionalProperties:
+                                                          type: string
+                                                        description: |-
+                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                        type: object
+                                                    type: object
+                                                    x-kubernetes-map-type: atomic
+                                                  matchLabelKeys:
+                                                    description: |-
+                                                      MatchLabelKeys is a set of pod label keys to select which pods will
+                                                      be taken into consideration. The keys are used to lookup values from the
+                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                      to select the group of existing pods which pods will be taken into consideration
+                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                      pod labels will be ignored. The default value is empty.
+                                                      The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                      Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  mismatchLabelKeys:
+                                                    description: |-
+                                                      MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                      be taken into consideration. The keys are used to lookup values from the
+                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                      to select the group of existing pods which pods will be taken into consideration
+                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                      pod labels will be ignored. The default value is empty.
+                                                      The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                      Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  namespaceSelector:
+                                                    description: |-
+                                                      A label query over the set of namespaces that the term applies to.
+                                                      The term is applied to the union of the namespaces selected by this field
+                                                      and the ones listed in the namespaces field.
+                                                      null selector and null or empty namespaces list means "this pod's namespace".
+                                                      An empty selector ({}) matches all namespaces.
+                                                    properties:
+                                                      matchExpressions:
+                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                        items:
+                                                          description: |-
+                                                            A label selector requirement is a selector that contains values, a key, and an operator that
+                                                            relates the key and values.
+                                                          properties:
+                                                            key:
+                                                              description: key is the label key that the selector applies to.
+                                                              type: string
+                                                            operator:
+                                                              description: |-
+                                                                operator represents a key's relationship to a set of values.
+                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                              type: string
+                                                            values:
+                                                              description: |-
+                                                                values is an array of string values. If the operator is In or NotIn,
+                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                the values array must be empty. This array is replaced during a strategic
+                                                                merge patch.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          required:
+                                                            - key
+                                                            - operator
+                                                          type: object
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      matchLabels:
+                                                        additionalProperties:
+                                                          type: string
+                                                        description: |-
+                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                        type: object
+                                                    type: object
+                                                    x-kubernetes-map-type: atomic
+                                                  namespaces:
+                                                    description: |-
+                                                      namespaces specifies a static list of namespace names that the term applies to.
+                                                      The term is applied to the union of the namespaces listed in this field
+                                                      and the ones selected by namespaceSelector.
+                                                      null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  topologyKey:
+                                                    description: |-
+                                                      This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                      the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                      whose value of the label with key topologyKey matches that of any node on which any of the
+                                                      selected pods is running.
+                                                      Empty topologyKey is not allowed.
+                                                    type: string
+                                                required:
+                                                  - topologyKey
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                          type: object
+                                        podAntiAffinity:
+                                          description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
+                                          properties:
+                                            preferredDuringSchedulingIgnoredDuringExecution:
+                                              description: |-
+                                                The scheduler will prefer to schedule pods to nodes that satisfy
+                                                the anti-affinity expressions specified by this field, but it may choose
+                                                a node that violates one or more of the expressions. The node that is
+                                                most preferred is the one with the greatest sum of weights, i.e.
+                                                for each node that meets all of the scheduling requirements (resource
+                                                request, requiredDuringScheduling anti-affinity expressions, etc.),
+                                                compute a sum by iterating through the elements of this field and subtracting
+                                                "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                                node(s) with the highest sum are the most preferred.
+                                              items:
+                                                description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+                                                properties:
+                                                  podAffinityTerm:
+                                                    description: Required. A pod affinity term, associated with the corresponding weight.
+                                                    properties:
+                                                      labelSelector:
+                                                        description: |-
+                                                          A label query over a set of resources, in this case pods.
+                                                          If it's null, this PodAffinityTerm matches with no Pods.
+                                                        properties:
+                                                          matchExpressions:
+                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                            items:
+                                                              description: |-
+                                                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                relates the key and values.
+                                                              properties:
+                                                                key:
+                                                                  description: key is the label key that the selector applies to.
+                                                                  type: string
+                                                                operator:
+                                                                  description: |-
+                                                                    operator represents a key's relationship to a set of values.
+                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                  type: string
+                                                                values:
+                                                                  description: |-
+                                                                    values is an array of string values. If the operator is In or NotIn,
+                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                    the values array must be empty. This array is replaced during a strategic
+                                                                    merge patch.
+                                                                  items:
+                                                                    type: string
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                              required:
+                                                                - key
+                                                                - operator
+                                                              type: object
+                                                            type: array
+                                                            x-kubernetes-list-type: atomic
+                                                          matchLabels:
+                                                            additionalProperties:
+                                                              type: string
+                                                            description: |-
+                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                            type: object
+                                                        type: object
+                                                        x-kubernetes-map-type: atomic
+                                                      matchLabelKeys:
+                                                        description: |-
+                                                          MatchLabelKeys is a set of pod label keys to select which pods will
+                                                          be taken into consideration. The keys are used to lookup values from the
+                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                          to select the group of existing pods which pods will be taken into consideration
+                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                          pod labels will be ignored. The default value is empty.
+                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                        items:
+                                                          type: string
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      mismatchLabelKeys:
+                                                        description: |-
+                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                          be taken into consideration. The keys are used to lookup values from the
+                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                          to select the group of existing pods which pods will be taken into consideration
+                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                          pod labels will be ignored. The default value is empty.
+                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                        items:
+                                                          type: string
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      namespaceSelector:
+                                                        description: |-
+                                                          A label query over the set of namespaces that the term applies to.
+                                                          The term is applied to the union of the namespaces selected by this field
+                                                          and the ones listed in the namespaces field.
+                                                          null selector and null or empty namespaces list means "this pod's namespace".
+                                                          An empty selector ({}) matches all namespaces.
+                                                        properties:
+                                                          matchExpressions:
+                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                            items:
+                                                              description: |-
+                                                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                relates the key and values.
+                                                              properties:
+                                                                key:
+                                                                  description: key is the label key that the selector applies to.
+                                                                  type: string
+                                                                operator:
+                                                                  description: |-
+                                                                    operator represents a key's relationship to a set of values.
+                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                  type: string
+                                                                values:
+                                                                  description: |-
+                                                                    values is an array of string values. If the operator is In or NotIn,
+                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                    the values array must be empty. This array is replaced during a strategic
+                                                                    merge patch.
+                                                                  items:
+                                                                    type: string
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                              required:
+                                                                - key
+                                                                - operator
+                                                              type: object
+                                                            type: array
+                                                            x-kubernetes-list-type: atomic
+                                                          matchLabels:
+                                                            additionalProperties:
+                                                              type: string
+                                                            description: |-
+                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                            type: object
+                                                        type: object
+                                                        x-kubernetes-map-type: atomic
+                                                      namespaces:
+                                                        description: |-
+                                                          namespaces specifies a static list of namespace names that the term applies to.
+                                                          The term is applied to the union of the namespaces listed in this field
+                                                          and the ones selected by namespaceSelector.
+                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                        items:
+                                                          type: string
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      topologyKey:
+                                                        description: |-
+                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                          whose value of the label with key topologyKey matches that of any node on which any of the
+                                                          selected pods is running.
+                                                          Empty topologyKey is not allowed.
+                                                        type: string
+                                                    required:
+                                                      - topologyKey
+                                                    type: object
+                                                  weight:
+                                                    description: |-
+                                                      weight associated with matching the corresponding podAffinityTerm,
+                                                      in the range 1-100.
+                                                    format: int32
+                                                    type: integer
+                                                required:
+                                                  - podAffinityTerm
+                                                  - weight
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            requiredDuringSchedulingIgnoredDuringExecution:
+                                              description: |-
+                                                If the anti-affinity requirements specified by this field are not met at
+                                                scheduling time, the pod will not be scheduled onto the node.
+                                                If the anti-affinity requirements specified by this field cease to be met
+                                                at some point during pod execution (e.g. due to a pod label update), the
+                                                system may or may not try to eventually evict the pod from its node.
+                                                When there are multiple elements, the lists of nodes corresponding to each
+                                                podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                              items:
+                                                description: |-
+                                                  Defines a set of pods (namely those matching the labelSelector
+                                                  relative to the given namespace(s)) that this pod should be
+                                                  co-located (affinity) or not co-located (anti-affinity) with,
+                                                  where co-located is defined as running on a node whose value of
+                                                  the label with key <topologyKey> matches that of any node on which
+                                                  a pod of the set of pods is running
+                                                properties:
+                                                  labelSelector:
+                                                    description: |-
+                                                      A label query over a set of resources, in this case pods.
+                                                      If it's null, this PodAffinityTerm matches with no Pods.
+                                                    properties:
+                                                      matchExpressions:
+                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                        items:
+                                                          description: |-
+                                                            A label selector requirement is a selector that contains values, a key, and an operator that
+                                                            relates the key and values.
+                                                          properties:
+                                                            key:
+                                                              description: key is the label key that the selector applies to.
+                                                              type: string
+                                                            operator:
+                                                              description: |-
+                                                                operator represents a key's relationship to a set of values.
+                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                              type: string
+                                                            values:
+                                                              description: |-
+                                                                values is an array of string values. If the operator is In or NotIn,
+                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                the values array must be empty. This array is replaced during a strategic
+                                                                merge patch.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          required:
+                                                            - key
+                                                            - operator
+                                                          type: object
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      matchLabels:
+                                                        additionalProperties:
+                                                          type: string
+                                                        description: |-
+                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                        type: object
+                                                    type: object
+                                                    x-kubernetes-map-type: atomic
+                                                  matchLabelKeys:
+                                                    description: |-
+                                                      MatchLabelKeys is a set of pod label keys to select which pods will
+                                                      be taken into consideration. The keys are used to lookup values from the
+                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                      to select the group of existing pods which pods will be taken into consideration
+                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                      pod labels will be ignored. The default value is empty.
+                                                      The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                      Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  mismatchLabelKeys:
+                                                    description: |-
+                                                      MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                      be taken into consideration. The keys are used to lookup values from the
+                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                      to select the group of existing pods which pods will be taken into consideration
+                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                      pod labels will be ignored. The default value is empty.
+                                                      The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                      Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  namespaceSelector:
+                                                    description: |-
+                                                      A label query over the set of namespaces that the term applies to.
+                                                      The term is applied to the union of the namespaces selected by this field
+                                                      and the ones listed in the namespaces field.
+                                                      null selector and null or empty namespaces list means "this pod's namespace".
+                                                      An empty selector ({}) matches all namespaces.
+                                                    properties:
+                                                      matchExpressions:
+                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                        items:
+                                                          description: |-
+                                                            A label selector requirement is a selector that contains values, a key, and an operator that
+                                                            relates the key and values.
+                                                          properties:
+                                                            key:
+                                                              description: key is the label key that the selector applies to.
+                                                              type: string
+                                                            operator:
+                                                              description: |-
+                                                                operator represents a key's relationship to a set of values.
+                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                              type: string
+                                                            values:
+                                                              description: |-
+                                                                values is an array of string values. If the operator is In or NotIn,
+                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                the values array must be empty. This array is replaced during a strategic
+                                                                merge patch.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          required:
+                                                            - key
+                                                            - operator
+                                                          type: object
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      matchLabels:
+                                                        additionalProperties:
+                                                          type: string
+                                                        description: |-
+                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                        type: object
+                                                    type: object
+                                                    x-kubernetes-map-type: atomic
+                                                  namespaces:
+                                                    description: |-
+                                                      namespaces specifies a static list of namespace names that the term applies to.
+                                                      The term is applied to the union of the namespaces listed in this field
+                                                      and the ones selected by namespaceSelector.
+                                                      null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  topologyKey:
+                                                    description: |-
+                                                      This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                      the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                      whose value of the label with key topologyKey matches that of any node on which any of the
+                                                      selected pods is running.
+                                                      Empty topologyKey is not allowed.
+                                                    type: string
+                                                required:
+                                                  - topologyKey
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                          type: object
+                                      type: object
+                                    imagePullSecrets:
+                                      description: If specified, the pod's imagePullSecrets
+                                      items:
+                                        description: |-
+                                          LocalObjectReference contains enough information to let you locate the
+                                          referenced object inside the same namespace.
+                                        properties:
+                                          name:
+                                            default: ""
+                                            description: |-
+                                              Name of the referent.
+                                              This field is effectively required, but due to backwards compatibility is
+                                              allowed to be empty. Instances of this type with an empty value here are
+                                              almost certainly wrong.
+                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                            type: string
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      type: array
+                                      x-kubernetes-list-map-keys:
+                                        - name
+                                      x-kubernetes-list-type: map
+                                    nodeSelector:
+                                      additionalProperties:
+                                        type: string
+                                      description: |-
+                                        NodeSelector is a selector which must be true for the pod to fit on a node.
+                                        Selector which must match a node's labels for the pod to be scheduled on that node.
+                                        More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+                                      type: object
+                                    priorityClassName:
+                                      description: If specified, the pod's priorityClassName.
+                                      type: string
+                                    resources:
+                                      description: |-
+                                        If specified, the pod's resource requirements.
+                                        These values override the global resource configuration flags.
+                                        Note that when only specifying resource limits, ensure they are greater than or equal
+                                        to the corresponding global resource requests configured via controller flags
+                                        (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
+                                        Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
+                                      properties:
+                                        limits:
+                                          additionalProperties:
+                                            anyOf:
+                                              - type: integer
+                                              - type: string
+                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                            x-kubernetes-int-or-string: true
+                                          description: |-
+                                            Limits describes the maximum amount of compute resources allowed.
+                                            More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                          type: object
+                                        requests:
+                                          additionalProperties:
+                                            anyOf:
+                                              - type: integer
+                                              - type: string
+                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                            x-kubernetes-int-or-string: true
+                                          description: |-
+                                            Requests describes the minimum amount of compute resources required.
+                                            If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                            otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
+                                            More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                          type: object
+                                      type: object
+                                    securityContext:
+                                      description: If specified, the pod's security context
+                                      properties:
+                                        fsGroup:
+                                          description: |-
+                                            A special supplemental group that applies to all containers in a pod.
+                                            Some volume types allow the Kubelet to change the ownership of that volume
+                                            to be owned by the pod:
+
+                                            1. The owning GID will be the FSGroup
+                                            2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
+                                            3. The permission bits are OR'd with rw-rw----
+
+                                            If unset, the Kubelet will not modify the ownership and permissions of any volume.
+                                            Note that this field cannot be set when spec.os.name is windows.
+                                          format: int64
+                                          type: integer
+                                        fsGroupChangePolicy:
+                                          description: |-
+                                            fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
+                                            before being exposed inside Pod. This field will only apply to
+                                            volume types which support fsGroup based ownership(and permissions).
+                                            It will have no effect on ephemeral volume types such as: secret, configmaps
+                                            and emptydir.
+                                            Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
+                                            Note that this field cannot be set when spec.os.name is windows.
+                                          type: string
+                                        runAsGroup:
+                                          description: |-
+                                            The GID to run the entrypoint of the container process.
+                                            Uses runtime default if unset.
+                                            May also be set in SecurityContext.  If set in both SecurityContext and
+                                            PodSecurityContext, the value specified in SecurityContext takes precedence
+                                            for that container.
+                                            Note that this field cannot be set when spec.os.name is windows.
+                                          format: int64
+                                          type: integer
+                                        runAsNonRoot:
+                                          description: |-
+                                            Indicates that the container must run as a non-root user.
+                                            If true, the Kubelet will validate the image at runtime to ensure that it
+                                            does not run as UID 0 (root) and fail to start the container if it does.
+                                            If unset or false, no such validation will be performed.
+                                            May also be set in SecurityContext.  If set in both SecurityContext and
+                                            PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                          type: boolean
+                                        runAsUser:
+                                          description: |-
+                                            The UID to run the entrypoint of the container process.
+                                            Defaults to user specified in image metadata if unspecified.
+                                            May also be set in SecurityContext.  If set in both SecurityContext and
+                                            PodSecurityContext, the value specified in SecurityContext takes precedence
+                                            for that container.
+                                            Note that this field cannot be set when spec.os.name is windows.
+                                          format: int64
+                                          type: integer
+                                        seLinuxOptions:
+                                          description: |-
+                                            The SELinux context to be applied to all containers.
+                                            If unspecified, the container runtime will allocate a random SELinux context for each
+                                            container.  May also be set in SecurityContext.  If set in
+                                            both SecurityContext and PodSecurityContext, the value specified in SecurityContext
+                                            takes precedence for that container.
+                                            Note that this field cannot be set when spec.os.name is windows.
+                                          properties:
+                                            level:
+                                              description: Level is SELinux level label that applies to the container.
+                                              type: string
+                                            role:
+                                              description: Role is a SELinux role label that applies to the container.
+                                              type: string
+                                            type:
+                                              description: Type is a SELinux type label that applies to the container.
+                                              type: string
+                                            user:
+                                              description: User is a SELinux user label that applies to the container.
+                                              type: string
+                                          type: object
+                                        seccompProfile:
+                                          description: |-
+                                            The seccomp options to use by the containers in this pod.
+                                            Note that this field cannot be set when spec.os.name is windows.
+                                          properties:
+                                            localhostProfile:
+                                              description: |-
+                                                localhostProfile indicates a profile defined in a file on the node should be used.
+                                                The profile must be preconfigured on the node to work.
+                                                Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                                                Must be set if type is "Localhost". Must NOT be set for any other type.
+                                              type: string
+                                            type:
+                                              description: |-
+                                                type indicates which kind of seccomp profile will be applied.
+                                                Valid options are:
+
+                                                Localhost - a profile defined in a file on the node should be used.
+                                                RuntimeDefault - the container runtime default profile should be used.
+                                                Unconfined - no profile should be applied.
+                                              type: string
+                                          required:
+                                            - type
+                                          type: object
+                                        supplementalGroups:
+                                          description: |-
+                                            A list of groups applied to the first process run in each container, in addition
+                                            to the container's primary GID, the fsGroup (if specified), and group memberships
+                                            defined in the container image for the uid of the container process. If unspecified,
+                                            no additional groups are added to any container. Note that group memberships
+                                            defined in the container image for the uid of the container process are still effective,
+                                            even if they are not included in this list.
+                                            Note that this field cannot be set when spec.os.name is windows.
+                                          items:
+                                            format: int64
+                                            type: integer
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        sysctls:
+                                          description: |-
+                                            Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
+                                            sysctls (by the container runtime) might fail to launch.
+                                            Note that this field cannot be set when spec.os.name is windows.
+                                          items:
+                                            description: Sysctl defines a kernel parameter to be set
+                                            properties:
+                                              name:
+                                                description: Name of a property to set
+                                                type: string
+                                              value:
+                                                description: Value of a property to set
+                                                type: string
+                                            required:
+                                              - name
+                                              - value
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                    serviceAccountName:
+                                      description: If specified, the pod's service account
+                                      type: string
+                                    tolerations:
+                                      description: If specified, the pod's tolerations.
+                                      items:
+                                        description: |-
+                                          The pod this Toleration is attached to tolerates any taint that matches
+                                          the triple <key,value,effect> using the matching operator <operator>.
+                                        properties:
+                                          effect:
+                                            description: |-
+                                              Effect indicates the taint effect to match. Empty means match all taint effects.
+                                              When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+                                            type: string
+                                          key:
+                                            description: |-
+                                              Key is the taint key that the toleration applies to. Empty means match all taint keys.
+                                              If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              Operator represents a key's relationship to the value.
+                                              Valid operators are Exists and Equal. Defaults to Equal.
+                                              Exists is equivalent to wildcard for value, so that a pod can
+                                              tolerate all taints of a particular category.
+                                            type: string
+                                          tolerationSeconds:
+                                            description: |-
+                                              TolerationSeconds represents the period of time the toleration (which must be
+                                              of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+                                              it is not set, which means tolerate the taint forever (do not evict). Zero and
+                                              negative values will be treated as 0 (evict immediately) by the system.
+                                            format: int64
+                                            type: integer
+                                          value:
+                                            description: |-
+                                              Value is the taint value the toleration matches to.
+                                              If the operator is Exists, the value should be empty, otherwise just a regular string.
+                                            type: string
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                              type: object
+                            serviceType:
+                              description: |-
+                                Optional service type for Kubernetes solver service. Supported values
+                                are NodePort or ClusterIP. If unset, defaults to NodePort.
+                              type: string
+                          type: object
+                        ingress:
+                          description: |-
+                            The ingress based HTTP01 challenge solver will solve challenges by
+                            creating or modifying Ingress resources in order to route requests for
+                            '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
+                            provisioned by cert-manager for each Challenge to be completed.
+                          properties:
+                            class:
+                              description: |-
+                                This field configures the annotation `kubernetes.io/ingress.class` when
+                                creating Ingress resources to solve ACME challenges that use this
+                                challenge solver. Only one of `class`, `name` or `ingressClassName` may
+                                be specified.
+                              type: string
+                            ingressClassName:
+                              description: |-
+                                This field configures the field `ingressClassName` on the created Ingress
+                                resources used to solve ACME challenges that use this challenge solver.
+                                This is the recommended way of configuring the ingress class. Only one of
+                                `class`, `name` or `ingressClassName` may be specified.
+                              type: string
+                            ingressTemplate:
+                              description: |-
+                                Optional ingress template used to configure the ACME challenge solver
+                                ingress used for HTTP01 challenges.
+                              properties:
+                                metadata:
+                                  description: |-
+                                    ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
+                                    Only the 'labels' and 'annotations' fields may be set.
+                                    If labels or annotations overlap with in-built values, the values here
+                                    will override the in-built values.
+                                  properties:
+                                    annotations:
+                                      additionalProperties:
+                                        type: string
+                                      description: Annotations that should be added to the created ACME HTTP01 solver ingress.
+                                      type: object
+                                    labels:
+                                      additionalProperties:
+                                        type: string
+                                      description: Labels that should be added to the created ACME HTTP01 solver ingress.
+                                      type: object
+                                  type: object
+                              type: object
+                            name:
+                              description: |-
+                                The name of the ingress resource that should have ACME challenge solving
+                                routes inserted into it in order to solve HTTP01 challenges.
+                                This is typically used in conjunction with ingress controllers like
+                                ingress-gce, which maintains a 1:1 mapping between external IPs and
+                                ingress resources. Only one of `class`, `name` or `ingressClassName` may
+                                be specified.
+                              type: string
+                            podTemplate:
+                              description: |-
+                                Optional pod template used to configure the ACME challenge solver pods
+                                used for HTTP01 challenges.
+                              properties:
+                                metadata:
+                                  description: |-
+                                    ObjectMeta overrides for the pod used to solve HTTP01 challenges.
+                                    Only the 'labels' and 'annotations' fields may be set.
+                                    If labels or annotations overlap with in-built values, the values here
+                                    will override the in-built values.
+                                  properties:
+                                    annotations:
+                                      additionalProperties:
+                                        type: string
+                                      description: Annotations that should be added to the created ACME HTTP01 solver pods.
+                                      type: object
+                                    labels:
+                                      additionalProperties:
+                                        type: string
+                                      description: Labels that should be added to the created ACME HTTP01 solver pods.
+                                      type: object
+                                  type: object
+                                spec:
+                                  description: |-
+                                    PodSpec defines overrides for the HTTP01 challenge solver pod.
+                                    Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
+                                    All other fields will be ignored.
+                                  properties:
+                                    affinity:
+                                      description: If specified, the pod's scheduling constraints
+                                      properties:
+                                        nodeAffinity:
+                                          description: Describes node affinity scheduling rules for the pod.
+                                          properties:
+                                            preferredDuringSchedulingIgnoredDuringExecution:
+                                              description: |-
+                                                The scheduler will prefer to schedule pods to nodes that satisfy
+                                                the affinity expressions specified by this field, but it may choose
+                                                a node that violates one or more of the expressions. The node that is
+                                                most preferred is the one with the greatest sum of weights, i.e.
+                                                for each node that meets all of the scheduling requirements (resource
+                                                request, requiredDuringScheduling affinity expressions, etc.),
+                                                compute a sum by iterating through the elements of this field and adding
+                                                "weight" to the sum if the node matches the corresponding matchExpressions; the
+                                                node(s) with the highest sum are the most preferred.
+                                              items:
+                                                description: |-
+                                                  An empty preferred scheduling term matches all objects with implicit weight 0
+                                                  (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+                                                properties:
+                                                  preference:
+                                                    description: A node selector term, associated with the corresponding weight.
+                                                    properties:
+                                                      matchExpressions:
+                                                        description: A list of node selector requirements by node's labels.
+                                                        items:
+                                                          description: |-
+                                                            A node selector requirement is a selector that contains values, a key, and an operator
+                                                            that relates the key and values.
+                                                          properties:
+                                                            key:
+                                                              description: The label key that the selector applies to.
+                                                              type: string
+                                                            operator:
+                                                              description: |-
+                                                                Represents a key's relationship to a set of values.
+                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                              type: string
+                                                            values:
+                                                              description: |-
+                                                                An array of string values. If the operator is In or NotIn,
+                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                the values array must be empty. If the operator is Gt or Lt, the values
+                                                                array must have a single element, which will be interpreted as an integer.
+                                                                This array is replaced during a strategic merge patch.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          required:
+                                                            - key
+                                                            - operator
+                                                          type: object
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      matchFields:
+                                                        description: A list of node selector requirements by node's fields.
+                                                        items:
+                                                          description: |-
+                                                            A node selector requirement is a selector that contains values, a key, and an operator
+                                                            that relates the key and values.
+                                                          properties:
+                                                            key:
+                                                              description: The label key that the selector applies to.
+                                                              type: string
+                                                            operator:
+                                                              description: |-
+                                                                Represents a key's relationship to a set of values.
+                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                              type: string
+                                                            values:
+                                                              description: |-
+                                                                An array of string values. If the operator is In or NotIn,
+                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                the values array must be empty. If the operator is Gt or Lt, the values
+                                                                array must have a single element, which will be interpreted as an integer.
+                                                                This array is replaced during a strategic merge patch.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          required:
+                                                            - key
+                                                            - operator
+                                                          type: object
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                    type: object
+                                                    x-kubernetes-map-type: atomic
+                                                  weight:
+                                                    description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
+                                                    format: int32
+                                                    type: integer
+                                                required:
+                                                  - preference
+                                                  - weight
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            requiredDuringSchedulingIgnoredDuringExecution:
+                                              description: |-
+                                                If the affinity requirements specified by this field are not met at
+                                                scheduling time, the pod will not be scheduled onto the node.
+                                                If the affinity requirements specified by this field cease to be met
+                                                at some point during pod execution (e.g. due to an update), the system
+                                                may or may not try to eventually evict the pod from its node.
+                                              properties:
+                                                nodeSelectorTerms:
+                                                  description: Required. A list of node selector terms. The terms are ORed.
+                                                  items:
+                                                    description: |-
+                                                      A null or empty node selector term matches no objects. The requirements of
+                                                      them are ANDed.
+                                                      The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+                                                    properties:
+                                                      matchExpressions:
+                                                        description: A list of node selector requirements by node's labels.
+                                                        items:
+                                                          description: |-
+                                                            A node selector requirement is a selector that contains values, a key, and an operator
+                                                            that relates the key and values.
+                                                          properties:
+                                                            key:
+                                                              description: The label key that the selector applies to.
+                                                              type: string
+                                                            operator:
+                                                              description: |-
+                                                                Represents a key's relationship to a set of values.
+                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                              type: string
+                                                            values:
+                                                              description: |-
+                                                                An array of string values. If the operator is In or NotIn,
+                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                the values array must be empty. If the operator is Gt or Lt, the values
+                                                                array must have a single element, which will be interpreted as an integer.
+                                                                This array is replaced during a strategic merge patch.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          required:
+                                                            - key
+                                                            - operator
+                                                          type: object
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      matchFields:
+                                                        description: A list of node selector requirements by node's fields.
+                                                        items:
+                                                          description: |-
+                                                            A node selector requirement is a selector that contains values, a key, and an operator
+                                                            that relates the key and values.
+                                                          properties:
+                                                            key:
+                                                              description: The label key that the selector applies to.
+                                                              type: string
+                                                            operator:
+                                                              description: |-
+                                                                Represents a key's relationship to a set of values.
+                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                              type: string
+                                                            values:
+                                                              description: |-
+                                                                An array of string values. If the operator is In or NotIn,
+                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                the values array must be empty. If the operator is Gt or Lt, the values
+                                                                array must have a single element, which will be interpreted as an integer.
+                                                                This array is replaced during a strategic merge patch.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          required:
+                                                            - key
+                                                            - operator
+                                                          type: object
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                    type: object
+                                                    x-kubernetes-map-type: atomic
+                                                  type: array
+                                                  x-kubernetes-list-type: atomic
+                                              required:
+                                                - nodeSelectorTerms
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                          type: object
+                                        podAffinity:
+                                          description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
+                                          properties:
+                                            preferredDuringSchedulingIgnoredDuringExecution:
+                                              description: |-
+                                                The scheduler will prefer to schedule pods to nodes that satisfy
+                                                the affinity expressions specified by this field, but it may choose
+                                                a node that violates one or more of the expressions. The node that is
+                                                most preferred is the one with the greatest sum of weights, i.e.
+                                                for each node that meets all of the scheduling requirements (resource
+                                                request, requiredDuringScheduling affinity expressions, etc.),
+                                                compute a sum by iterating through the elements of this field and adding
+                                                "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                                node(s) with the highest sum are the most preferred.
+                                              items:
+                                                description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+                                                properties:
+                                                  podAffinityTerm:
+                                                    description: Required. A pod affinity term, associated with the corresponding weight.
+                                                    properties:
+                                                      labelSelector:
+                                                        description: |-
+                                                          A label query over a set of resources, in this case pods.
+                                                          If it's null, this PodAffinityTerm matches with no Pods.
+                                                        properties:
+                                                          matchExpressions:
+                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                            items:
+                                                              description: |-
+                                                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                relates the key and values.
+                                                              properties:
+                                                                key:
+                                                                  description: key is the label key that the selector applies to.
+                                                                  type: string
+                                                                operator:
+                                                                  description: |-
+                                                                    operator represents a key's relationship to a set of values.
+                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                  type: string
+                                                                values:
+                                                                  description: |-
+                                                                    values is an array of string values. If the operator is In or NotIn,
+                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                    the values array must be empty. This array is replaced during a strategic
+                                                                    merge patch.
+                                                                  items:
+                                                                    type: string
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                              required:
+                                                                - key
+                                                                - operator
+                                                              type: object
+                                                            type: array
+                                                            x-kubernetes-list-type: atomic
+                                                          matchLabels:
+                                                            additionalProperties:
+                                                              type: string
+                                                            description: |-
+                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                            type: object
+                                                        type: object
+                                                        x-kubernetes-map-type: atomic
+                                                      matchLabelKeys:
+                                                        description: |-
+                                                          MatchLabelKeys is a set of pod label keys to select which pods will
+                                                          be taken into consideration. The keys are used to lookup values from the
+                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                          to select the group of existing pods which pods will be taken into consideration
+                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                          pod labels will be ignored. The default value is empty.
+                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                        items:
+                                                          type: string
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      mismatchLabelKeys:
+                                                        description: |-
+                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                          be taken into consideration. The keys are used to lookup values from the
+                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                          to select the group of existing pods which pods will be taken into consideration
+                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                          pod labels will be ignored. The default value is empty.
+                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                        items:
+                                                          type: string
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      namespaceSelector:
+                                                        description: |-
+                                                          A label query over the set of namespaces that the term applies to.
+                                                          The term is applied to the union of the namespaces selected by this field
+                                                          and the ones listed in the namespaces field.
+                                                          null selector and null or empty namespaces list means "this pod's namespace".
+                                                          An empty selector ({}) matches all namespaces.
+                                                        properties:
+                                                          matchExpressions:
+                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                            items:
+                                                              description: |-
+                                                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                relates the key and values.
+                                                              properties:
+                                                                key:
+                                                                  description: key is the label key that the selector applies to.
+                                                                  type: string
+                                                                operator:
+                                                                  description: |-
+                                                                    operator represents a key's relationship to a set of values.
+                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                  type: string
+                                                                values:
+                                                                  description: |-
+                                                                    values is an array of string values. If the operator is In or NotIn,
+                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                    the values array must be empty. This array is replaced during a strategic
+                                                                    merge patch.
+                                                                  items:
+                                                                    type: string
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                              required:
+                                                                - key
+                                                                - operator
+                                                              type: object
+                                                            type: array
+                                                            x-kubernetes-list-type: atomic
+                                                          matchLabels:
+                                                            additionalProperties:
+                                                              type: string
+                                                            description: |-
+                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                            type: object
+                                                        type: object
+                                                        x-kubernetes-map-type: atomic
+                                                      namespaces:
+                                                        description: |-
+                                                          namespaces specifies a static list of namespace names that the term applies to.
+                                                          The term is applied to the union of the namespaces listed in this field
+                                                          and the ones selected by namespaceSelector.
+                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                        items:
+                                                          type: string
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      topologyKey:
+                                                        description: |-
+                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                          whose value of the label with key topologyKey matches that of any node on which any of the
+                                                          selected pods is running.
+                                                          Empty topologyKey is not allowed.
+                                                        type: string
+                                                    required:
+                                                      - topologyKey
+                                                    type: object
+                                                  weight:
+                                                    description: |-
+                                                      weight associated with matching the corresponding podAffinityTerm,
+                                                      in the range 1-100.
+                                                    format: int32
+                                                    type: integer
+                                                required:
+                                                  - podAffinityTerm
+                                                  - weight
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            requiredDuringSchedulingIgnoredDuringExecution:
+                                              description: |-
+                                                If the affinity requirements specified by this field are not met at
+                                                scheduling time, the pod will not be scheduled onto the node.
+                                                If the affinity requirements specified by this field cease to be met
+                                                at some point during pod execution (e.g. due to a pod label update), the
+                                                system may or may not try to eventually evict the pod from its node.
+                                                When there are multiple elements, the lists of nodes corresponding to each
+                                                podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                              items:
+                                                description: |-
+                                                  Defines a set of pods (namely those matching the labelSelector
+                                                  relative to the given namespace(s)) that this pod should be
+                                                  co-located (affinity) or not co-located (anti-affinity) with,
+                                                  where co-located is defined as running on a node whose value of
+                                                  the label with key <topologyKey> matches that of any node on which
+                                                  a pod of the set of pods is running
+                                                properties:
+                                                  labelSelector:
+                                                    description: |-
+                                                      A label query over a set of resources, in this case pods.
+                                                      If it's null, this PodAffinityTerm matches with no Pods.
+                                                    properties:
+                                                      matchExpressions:
+                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                        items:
+                                                          description: |-
+                                                            A label selector requirement is a selector that contains values, a key, and an operator that
+                                                            relates the key and values.
+                                                          properties:
+                                                            key:
+                                                              description: key is the label key that the selector applies to.
+                                                              type: string
+                                                            operator:
+                                                              description: |-
+                                                                operator represents a key's relationship to a set of values.
+                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                              type: string
+                                                            values:
+                                                              description: |-
+                                                                values is an array of string values. If the operator is In or NotIn,
+                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                the values array must be empty. This array is replaced during a strategic
+                                                                merge patch.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          required:
+                                                            - key
+                                                            - operator
+                                                          type: object
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      matchLabels:
+                                                        additionalProperties:
+                                                          type: string
+                                                        description: |-
+                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                        type: object
+                                                    type: object
+                                                    x-kubernetes-map-type: atomic
+                                                  matchLabelKeys:
+                                                    description: |-
+                                                      MatchLabelKeys is a set of pod label keys to select which pods will
+                                                      be taken into consideration. The keys are used to lookup values from the
+                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                      to select the group of existing pods which pods will be taken into consideration
+                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                      pod labels will be ignored. The default value is empty.
+                                                      The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                      Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  mismatchLabelKeys:
+                                                    description: |-
+                                                      MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                      be taken into consideration. The keys are used to lookup values from the
+                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                      to select the group of existing pods which pods will be taken into consideration
+                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                      pod labels will be ignored. The default value is empty.
+                                                      The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                      Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  namespaceSelector:
+                                                    description: |-
+                                                      A label query over the set of namespaces that the term applies to.
+                                                      The term is applied to the union of the namespaces selected by this field
+                                                      and the ones listed in the namespaces field.
+                                                      null selector and null or empty namespaces list means "this pod's namespace".
+                                                      An empty selector ({}) matches all namespaces.
+                                                    properties:
+                                                      matchExpressions:
+                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                        items:
+                                                          description: |-
+                                                            A label selector requirement is a selector that contains values, a key, and an operator that
+                                                            relates the key and values.
+                                                          properties:
+                                                            key:
+                                                              description: key is the label key that the selector applies to.
+                                                              type: string
+                                                            operator:
+                                                              description: |-
+                                                                operator represents a key's relationship to a set of values.
+                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                              type: string
+                                                            values:
+                                                              description: |-
+                                                                values is an array of string values. If the operator is In or NotIn,
+                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                the values array must be empty. This array is replaced during a strategic
+                                                                merge patch.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          required:
+                                                            - key
+                                                            - operator
+                                                          type: object
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      matchLabels:
+                                                        additionalProperties:
+                                                          type: string
+                                                        description: |-
+                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                        type: object
+                                                    type: object
+                                                    x-kubernetes-map-type: atomic
+                                                  namespaces:
+                                                    description: |-
+                                                      namespaces specifies a static list of namespace names that the term applies to.
+                                                      The term is applied to the union of the namespaces listed in this field
+                                                      and the ones selected by namespaceSelector.
+                                                      null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  topologyKey:
+                                                    description: |-
+                                                      This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                      the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                      whose value of the label with key topologyKey matches that of any node on which any of the
+                                                      selected pods is running.
+                                                      Empty topologyKey is not allowed.
+                                                    type: string
+                                                required:
+                                                  - topologyKey
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                          type: object
+                                        podAntiAffinity:
+                                          description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
+                                          properties:
+                                            preferredDuringSchedulingIgnoredDuringExecution:
+                                              description: |-
+                                                The scheduler will prefer to schedule pods to nodes that satisfy
+                                                the anti-affinity expressions specified by this field, but it may choose
+                                                a node that violates one or more of the expressions. The node that is
+                                                most preferred is the one with the greatest sum of weights, i.e.
+                                                for each node that meets all of the scheduling requirements (resource
+                                                request, requiredDuringScheduling anti-affinity expressions, etc.),
+                                                compute a sum by iterating through the elements of this field and subtracting
+                                                "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                                node(s) with the highest sum are the most preferred.
+                                              items:
+                                                description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+                                                properties:
+                                                  podAffinityTerm:
+                                                    description: Required. A pod affinity term, associated with the corresponding weight.
+                                                    properties:
+                                                      labelSelector:
+                                                        description: |-
+                                                          A label query over a set of resources, in this case pods.
+                                                          If it's null, this PodAffinityTerm matches with no Pods.
+                                                        properties:
+                                                          matchExpressions:
+                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                            items:
+                                                              description: |-
+                                                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                relates the key and values.
+                                                              properties:
+                                                                key:
+                                                                  description: key is the label key that the selector applies to.
+                                                                  type: string
+                                                                operator:
+                                                                  description: |-
+                                                                    operator represents a key's relationship to a set of values.
+                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                  type: string
+                                                                values:
+                                                                  description: |-
+                                                                    values is an array of string values. If the operator is In or NotIn,
+                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                    the values array must be empty. This array is replaced during a strategic
+                                                                    merge patch.
+                                                                  items:
+                                                                    type: string
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                              required:
+                                                                - key
+                                                                - operator
+                                                              type: object
+                                                            type: array
+                                                            x-kubernetes-list-type: atomic
+                                                          matchLabels:
+                                                            additionalProperties:
+                                                              type: string
+                                                            description: |-
+                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                            type: object
+                                                        type: object
+                                                        x-kubernetes-map-type: atomic
+                                                      matchLabelKeys:
+                                                        description: |-
+                                                          MatchLabelKeys is a set of pod label keys to select which pods will
+                                                          be taken into consideration. The keys are used to lookup values from the
+                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                          to select the group of existing pods which pods will be taken into consideration
+                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                          pod labels will be ignored. The default value is empty.
+                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                        items:
+                                                          type: string
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      mismatchLabelKeys:
+                                                        description: |-
+                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                          be taken into consideration. The keys are used to lookup values from the
+                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                          to select the group of existing pods which pods will be taken into consideration
+                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                          pod labels will be ignored. The default value is empty.
+                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                        items:
+                                                          type: string
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      namespaceSelector:
+                                                        description: |-
+                                                          A label query over the set of namespaces that the term applies to.
+                                                          The term is applied to the union of the namespaces selected by this field
+                                                          and the ones listed in the namespaces field.
+                                                          null selector and null or empty namespaces list means "this pod's namespace".
+                                                          An empty selector ({}) matches all namespaces.
+                                                        properties:
+                                                          matchExpressions:
+                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                            items:
+                                                              description: |-
+                                                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                relates the key and values.
+                                                              properties:
+                                                                key:
+                                                                  description: key is the label key that the selector applies to.
+                                                                  type: string
+                                                                operator:
+                                                                  description: |-
+                                                                    operator represents a key's relationship to a set of values.
+                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                  type: string
+                                                                values:
+                                                                  description: |-
+                                                                    values is an array of string values. If the operator is In or NotIn,
+                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                    the values array must be empty. This array is replaced during a strategic
+                                                                    merge patch.
+                                                                  items:
+                                                                    type: string
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                              required:
+                                                                - key
+                                                                - operator
+                                                              type: object
+                                                            type: array
+                                                            x-kubernetes-list-type: atomic
+                                                          matchLabels:
+                                                            additionalProperties:
+                                                              type: string
+                                                            description: |-
+                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                            type: object
+                                                        type: object
+                                                        x-kubernetes-map-type: atomic
+                                                      namespaces:
+                                                        description: |-
+                                                          namespaces specifies a static list of namespace names that the term applies to.
+                                                          The term is applied to the union of the namespaces listed in this field
+                                                          and the ones selected by namespaceSelector.
+                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                        items:
+                                                          type: string
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      topologyKey:
+                                                        description: |-
+                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                          whose value of the label with key topologyKey matches that of any node on which any of the
+                                                          selected pods is running.
+                                                          Empty topologyKey is not allowed.
+                                                        type: string
+                                                    required:
+                                                      - topologyKey
+                                                    type: object
+                                                  weight:
+                                                    description: |-
+                                                      weight associated with matching the corresponding podAffinityTerm,
+                                                      in the range 1-100.
+                                                    format: int32
+                                                    type: integer
+                                                required:
+                                                  - podAffinityTerm
+                                                  - weight
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            requiredDuringSchedulingIgnoredDuringExecution:
+                                              description: |-
+                                                If the anti-affinity requirements specified by this field are not met at
+                                                scheduling time, the pod will not be scheduled onto the node.
+                                                If the anti-affinity requirements specified by this field cease to be met
+                                                at some point during pod execution (e.g. due to a pod label update), the
+                                                system may or may not try to eventually evict the pod from its node.
+                                                When there are multiple elements, the lists of nodes corresponding to each
+                                                podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                              items:
+                                                description: |-
+                                                  Defines a set of pods (namely those matching the labelSelector
+                                                  relative to the given namespace(s)) that this pod should be
+                                                  co-located (affinity) or not co-located (anti-affinity) with,
+                                                  where co-located is defined as running on a node whose value of
+                                                  the label with key <topologyKey> matches that of any node on which
+                                                  a pod of the set of pods is running
+                                                properties:
+                                                  labelSelector:
+                                                    description: |-
+                                                      A label query over a set of resources, in this case pods.
+                                                      If it's null, this PodAffinityTerm matches with no Pods.
+                                                    properties:
+                                                      matchExpressions:
+                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                        items:
+                                                          description: |-
+                                                            A label selector requirement is a selector that contains values, a key, and an operator that
+                                                            relates the key and values.
+                                                          properties:
+                                                            key:
+                                                              description: key is the label key that the selector applies to.
+                                                              type: string
+                                                            operator:
+                                                              description: |-
+                                                                operator represents a key's relationship to a set of values.
+                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                              type: string
+                                                            values:
+                                                              description: |-
+                                                                values is an array of string values. If the operator is In or NotIn,
+                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                the values array must be empty. This array is replaced during a strategic
+                                                                merge patch.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          required:
+                                                            - key
+                                                            - operator
+                                                          type: object
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      matchLabels:
+                                                        additionalProperties:
+                                                          type: string
+                                                        description: |-
+                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                        type: object
+                                                    type: object
+                                                    x-kubernetes-map-type: atomic
+                                                  matchLabelKeys:
+                                                    description: |-
+                                                      MatchLabelKeys is a set of pod label keys to select which pods will
+                                                      be taken into consideration. The keys are used to lookup values from the
+                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                      to select the group of existing pods which pods will be taken into consideration
+                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                      pod labels will be ignored. The default value is empty.
+                                                      The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                      Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  mismatchLabelKeys:
+                                                    description: |-
+                                                      MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                      be taken into consideration. The keys are used to lookup values from the
+                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                      to select the group of existing pods which pods will be taken into consideration
+                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                      pod labels will be ignored. The default value is empty.
+                                                      The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                      Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  namespaceSelector:
+                                                    description: |-
+                                                      A label query over the set of namespaces that the term applies to.
+                                                      The term is applied to the union of the namespaces selected by this field
+                                                      and the ones listed in the namespaces field.
+                                                      null selector and null or empty namespaces list means "this pod's namespace".
+                                                      An empty selector ({}) matches all namespaces.
+                                                    properties:
+                                                      matchExpressions:
+                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                        items:
+                                                          description: |-
+                                                            A label selector requirement is a selector that contains values, a key, and an operator that
+                                                            relates the key and values.
+                                                          properties:
+                                                            key:
+                                                              description: key is the label key that the selector applies to.
+                                                              type: string
+                                                            operator:
+                                                              description: |-
+                                                                operator represents a key's relationship to a set of values.
+                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                              type: string
+                                                            values:
+                                                              description: |-
+                                                                values is an array of string values. If the operator is In or NotIn,
+                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                the values array must be empty. This array is replaced during a strategic
+                                                                merge patch.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          required:
+                                                            - key
+                                                            - operator
+                                                          type: object
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                      matchLabels:
+                                                        additionalProperties:
+                                                          type: string
+                                                        description: |-
+                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                        type: object
+                                                    type: object
+                                                    x-kubernetes-map-type: atomic
+                                                  namespaces:
+                                                    description: |-
+                                                      namespaces specifies a static list of namespace names that the term applies to.
+                                                      The term is applied to the union of the namespaces listed in this field
+                                                      and the ones selected by namespaceSelector.
+                                                      null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  topologyKey:
+                                                    description: |-
+                                                      This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                      the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                      whose value of the label with key topologyKey matches that of any node on which any of the
+                                                      selected pods is running.
+                                                      Empty topologyKey is not allowed.
+                                                    type: string
+                                                required:
+                                                  - topologyKey
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                          type: object
+                                      type: object
+                                    imagePullSecrets:
+                                      description: If specified, the pod's imagePullSecrets
+                                      items:
+                                        description: |-
+                                          LocalObjectReference contains enough information to let you locate the
+                                          referenced object inside the same namespace.
+                                        properties:
+                                          name:
+                                            default: ""
+                                            description: |-
+                                              Name of the referent.
+                                              This field is effectively required, but due to backwards compatibility is
+                                              allowed to be empty. Instances of this type with an empty value here are
+                                              almost certainly wrong.
+                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                            type: string
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      type: array
+                                      x-kubernetes-list-map-keys:
+                                        - name
+                                      x-kubernetes-list-type: map
+                                    nodeSelector:
+                                      additionalProperties:
+                                        type: string
+                                      description: |-
+                                        NodeSelector is a selector which must be true for the pod to fit on a node.
+                                        Selector which must match a node's labels for the pod to be scheduled on that node.
+                                        More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+                                      type: object
+                                    priorityClassName:
+                                      description: If specified, the pod's priorityClassName.
+                                      type: string
+                                    resources:
+                                      description: |-
+                                        If specified, the pod's resource requirements.
+                                        These values override the global resource configuration flags.
+                                        Note that when only specifying resource limits, ensure they are greater than or equal
+                                        to the corresponding global resource requests configured via controller flags
+                                        (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
+                                        Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
+                                      properties:
+                                        limits:
+                                          additionalProperties:
+                                            anyOf:
+                                              - type: integer
+                                              - type: string
+                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                            x-kubernetes-int-or-string: true
+                                          description: |-
+                                            Limits describes the maximum amount of compute resources allowed.
+                                            More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                          type: object
+                                        requests:
+                                          additionalProperties:
+                                            anyOf:
+                                              - type: integer
+                                              - type: string
+                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                            x-kubernetes-int-or-string: true
+                                          description: |-
+                                            Requests describes the minimum amount of compute resources required.
+                                            If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                            otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
+                                            More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                          type: object
+                                      type: object
+                                    securityContext:
+                                      description: If specified, the pod's security context
+                                      properties:
+                                        fsGroup:
+                                          description: |-
+                                            A special supplemental group that applies to all containers in a pod.
+                                            Some volume types allow the Kubelet to change the ownership of that volume
+                                            to be owned by the pod:
+
+                                            1. The owning GID will be the FSGroup
+                                            2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
+                                            3. The permission bits are OR'd with rw-rw----
+
+                                            If unset, the Kubelet will not modify the ownership and permissions of any volume.
+                                            Note that this field cannot be set when spec.os.name is windows.
+                                          format: int64
+                                          type: integer
+                                        fsGroupChangePolicy:
+                                          description: |-
+                                            fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
+                                            before being exposed inside Pod. This field will only apply to
+                                            volume types which support fsGroup based ownership(and permissions).
+                                            It will have no effect on ephemeral volume types such as: secret, configmaps
+                                            and emptydir.
+                                            Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
+                                            Note that this field cannot be set when spec.os.name is windows.
+                                          type: string
+                                        runAsGroup:
+                                          description: |-
+                                            The GID to run the entrypoint of the container process.
+                                            Uses runtime default if unset.
+                                            May also be set in SecurityContext.  If set in both SecurityContext and
+                                            PodSecurityContext, the value specified in SecurityContext takes precedence
+                                            for that container.
+                                            Note that this field cannot be set when spec.os.name is windows.
+                                          format: int64
+                                          type: integer
+                                        runAsNonRoot:
+                                          description: |-
+                                            Indicates that the container must run as a non-root user.
+                                            If true, the Kubelet will validate the image at runtime to ensure that it
+                                            does not run as UID 0 (root) and fail to start the container if it does.
+                                            If unset or false, no such validation will be performed.
+                                            May also be set in SecurityContext.  If set in both SecurityContext and
+                                            PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                          type: boolean
+                                        runAsUser:
+                                          description: |-
+                                            The UID to run the entrypoint of the container process.
+                                            Defaults to user specified in image metadata if unspecified.
+                                            May also be set in SecurityContext.  If set in both SecurityContext and
+                                            PodSecurityContext, the value specified in SecurityContext takes precedence
+                                            for that container.
+                                            Note that this field cannot be set when spec.os.name is windows.
+                                          format: int64
+                                          type: integer
+                                        seLinuxOptions:
+                                          description: |-
+                                            The SELinux context to be applied to all containers.
+                                            If unspecified, the container runtime will allocate a random SELinux context for each
+                                            container.  May also be set in SecurityContext.  If set in
+                                            both SecurityContext and PodSecurityContext, the value specified in SecurityContext
+                                            takes precedence for that container.
+                                            Note that this field cannot be set when spec.os.name is windows.
+                                          properties:
+                                            level:
+                                              description: Level is SELinux level label that applies to the container.
+                                              type: string
+                                            role:
+                                              description: Role is a SELinux role label that applies to the container.
+                                              type: string
+                                            type:
+                                              description: Type is a SELinux type label that applies to the container.
+                                              type: string
+                                            user:
+                                              description: User is a SELinux user label that applies to the container.
+                                              type: string
+                                          type: object
+                                        seccompProfile:
+                                          description: |-
+                                            The seccomp options to use by the containers in this pod.
+                                            Note that this field cannot be set when spec.os.name is windows.
+                                          properties:
+                                            localhostProfile:
+                                              description: |-
+                                                localhostProfile indicates a profile defined in a file on the node should be used.
+                                                The profile must be preconfigured on the node to work.
+                                                Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                                                Must be set if type is "Localhost". Must NOT be set for any other type.
+                                              type: string
+                                            type:
+                                              description: |-
+                                                type indicates which kind of seccomp profile will be applied.
+                                                Valid options are:
+
+                                                Localhost - a profile defined in a file on the node should be used.
+                                                RuntimeDefault - the container runtime default profile should be used.
+                                                Unconfined - no profile should be applied.
+                                              type: string
+                                          required:
+                                            - type
+                                          type: object
+                                        supplementalGroups:
+                                          description: |-
+                                            A list of groups applied to the first process run in each container, in addition
+                                            to the container's primary GID, the fsGroup (if specified), and group memberships
+                                            defined in the container image for the uid of the container process. If unspecified,
+                                            no additional groups are added to any container. Note that group memberships
+                                            defined in the container image for the uid of the container process are still effective,
+                                            even if they are not included in this list.
+                                            Note that this field cannot be set when spec.os.name is windows.
+                                          items:
+                                            format: int64
+                                            type: integer
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        sysctls:
+                                          description: |-
+                                            Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
+                                            sysctls (by the container runtime) might fail to launch.
+                                            Note that this field cannot be set when spec.os.name is windows.
+                                          items:
+                                            description: Sysctl defines a kernel parameter to be set
+                                            properties:
+                                              name:
+                                                description: Name of a property to set
+                                                type: string
+                                              value:
+                                                description: Value of a property to set
+                                                type: string
+                                            required:
+                                              - name
+                                              - value
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                    serviceAccountName:
+                                      description: If specified, the pod's service account
+                                      type: string
+                                    tolerations:
+                                      description: If specified, the pod's tolerations.
+                                      items:
+                                        description: |-
+                                          The pod this Toleration is attached to tolerates any taint that matches
+                                          the triple <key,value,effect> using the matching operator <operator>.
+                                        properties:
+                                          effect:
+                                            description: |-
+                                              Effect indicates the taint effect to match. Empty means match all taint effects.
+                                              When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+                                            type: string
+                                          key:
+                                            description: |-
+                                              Key is the taint key that the toleration applies to. Empty means match all taint keys.
+                                              If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              Operator represents a key's relationship to the value.
+                                              Valid operators are Exists and Equal. Defaults to Equal.
+                                              Exists is equivalent to wildcard for value, so that a pod can
+                                              tolerate all taints of a particular category.
+                                            type: string
+                                          tolerationSeconds:
+                                            description: |-
+                                              TolerationSeconds represents the period of time the toleration (which must be
+                                              of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+                                              it is not set, which means tolerate the taint forever (do not evict). Zero and
+                                              negative values will be treated as 0 (evict immediately) by the system.
+                                            format: int64
+                                            type: integer
+                                          value:
+                                            description: |-
+                                              Value is the taint value the toleration matches to.
+                                              If the operator is Exists, the value should be empty, otherwise just a regular string.
+                                            type: string
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                              type: object
+                            serviceType:
+                              description: |-
+                                Optional service type for Kubernetes solver service. Supported values
+                                are NodePort or ClusterIP. If unset, defaults to NodePort.
+                              type: string
+                          type: object
+                      type: object
+                    selector:
+                      description: |-
+                        Selector selects a set of DNSNames on the Certificate resource that
+                        should be solved using this challenge solver.
+                        If not specified, the solver will be treated as the 'default' solver
+                        with the lowest priority, i.e. if any other solver has a more specific
+                        match, it will be used instead.
+                      properties:
+                        dnsNames:
+                          description: |-
+                            List of DNSNames that this solver will be used to solve.
+                            If specified and a match is found, a dnsNames selector will take
+                            precedence over a dnsZones selector.
+                            If multiple solvers match with the same dnsNames value, the solver
+                            with the most matching labels in matchLabels will be selected.
+                            If neither has more matches, the solver defined earlier in the list
+                            will be selected.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        dnsZones:
+                          description: |-
+                            List of DNSZones that this solver will be used to solve.
+                            The most specific DNS zone match specified here will take precedence
+                            over other DNS zone matches, so a solver specifying sys.example.com
+                            will be selected over one specifying example.com for the domain
+                            www.sys.example.com.
+                            If multiple solvers match with the same dnsZones value, the solver
+                            with the most matching labels in matchLabels will be selected.
+                            If neither has more matches, the solver defined earlier in the list
+                            will be selected.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        matchLabels:
+                          additionalProperties:
+                            type: string
+                          description: |-
+                            A label selector that is used to refine the set of certificate's that
+                            this challenge solver will apply to.
+                          type: object
+                      type: object
+                  type: object
+                token:
+                  description: |-
+                    The ACME challenge token for this challenge.
+                    This is the raw value returned from the ACME server.
+                  type: string
+                type:
+                  description: |-
+                    The type of ACME challenge this resource represents.
+                    One of "HTTP-01" or "DNS-01".
+                  enum:
+                    - HTTP-01
+                    - DNS-01
+                  type: string
+                url:
+                  description: |-
+                    The URL of the ACME Challenge resource for this challenge.
+                    This can be used to lookup details about the status of this challenge.
+                  type: string
+                wildcard:
+                  description: |-
+                    wildcard will be true if this challenge is for a wildcard identifier,
+                    for example '*.example.com'.
+                  type: boolean
+              required:
+                - authorizationURL
+                - dnsName
+                - issuerRef
+                - key
+                - solver
+                - token
+                - type
+                - url
+              type: object
+            status:
+              properties:
+                presented:
+                  description: |-
+                    presented will be set to true if the challenge values for this challenge
+                    are currently 'presented'.
+                    This *does not* imply the self check is passing. Only that the values
+                    have been 'submitted' for the appropriate challenge mechanism (i.e. the
+                    DNS01 TXT record has been presented, or the HTTP01 configuration has been
+                    configured).
+                  type: boolean
+                processing:
+                  description: |-
+                    Used to denote whether this challenge should be processed or not.
+                    This field will only be set to true by the 'scheduling' component.
+                    It will only be set to false by the 'challenges' controller, after the
+                    challenge has reached a final state or timed out.
+                    If this field is set to false, the challenge controller will not take
+                    any more action.
+                  type: boolean
+                reason:
+                  description: |-
+                    Contains human readable information on why the Challenge is in the
+                    current state.
+                  type: string
+                state:
+                  description: |-
+                    Contains the current 'state' of the challenge.
+                    If not set, the state of the challenge is unknown.
+                  enum:
+                    - valid
+                    - ready
+                    - pending
+                    - processing
+                    - invalid
+                    - expired
+                    - errored
+                  type: string
+              type: object
+          required:
+            - metadata
+            - spec
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+{{- end }}
diff --git a/packages/system/cert-manager-crds/templates/crd-acme.cert-manager.io_orders.yaml b/packages/system/cert-manager-crds/templates/crd-acme.cert-manager.io_orders.yaml
new file mode 100644
index 00000000..3242fc41
--- /dev/null
+++ b/packages/system/cert-manager-crds/templates/crd-acme.cert-manager.io_orders.yaml
@@ -0,0 +1,274 @@
+{{- if or .Values.crds.enabled .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: "orders.acme.cert-manager.io"
+  {{- if .Values.crds.keep }}
+  annotations:
+    helm.sh/resource-policy: keep
+  {{- end }}
+  labels:
+    {{- include "cert-manager.crd-labels" . | nindent 4 }}
+spec:
+  group: acme.cert-manager.io
+  names:
+    categories:
+      - cert-manager
+      - cert-manager-acme
+    kind: Order
+    listKind: OrderList
+    plural: orders
+    singular: order
+  scope: Namespaced
+  versions:
+    - additionalPrinterColumns:
+        - jsonPath: .status.state
+          name: State
+          type: string
+        - jsonPath: .spec.issuerRef.name
+          name: Issuer
+          priority: 1
+          type: string
+        - jsonPath: .status.reason
+          name: Reason
+          priority: 1
+          type: string
+        - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+          jsonPath: .metadata.creationTimestamp
+          name: Age
+          type: date
+      name: v1
+      schema:
+        openAPIV3Schema:
+          description: Order is a type to represent an Order with an ACME server
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              properties:
+                commonName:
+                  description: |-
+                    CommonName is the common name as specified on the DER encoded CSR.
+                    If specified, this value must also be present in `dnsNames` or `ipAddresses`.
+                    This field must match the corresponding field on the DER encoded CSR.
+                  type: string
+                dnsNames:
+                  description: |-
+                    DNSNames is a list of DNS names that should be included as part of the Order
+                    validation process.
+                    This field must match the corresponding field on the DER encoded CSR.
+                  items:
+                    type: string
+                  type: array
+                  x-kubernetes-list-type: atomic
+                duration:
+                  description: |-
+                    Duration is the duration for the not after date for the requested certificate.
+                    this is set on order creation as pe the ACME spec.
+                  type: string
+                ipAddresses:
+                  description: |-
+                    IPAddresses is a list of IP addresses that should be included as part of the Order
+                    validation process.
+                    This field must match the corresponding field on the DER encoded CSR.
+                  items:
+                    type: string
+                  type: array
+                  x-kubernetes-list-type: atomic
+                issuerRef:
+                  description: |-
+                    IssuerRef references a properly configured ACME-type Issuer which should
+                    be used to create this Order.
+                    If the Issuer does not exist, processing will be retried.
+                    If the Issuer is not an 'ACME' Issuer, an error will be returned and the
+                    Order will be marked as failed.
+                  properties:
+                    group:
+                      description: |-
+                        Group of the issuer being referred to.
+                        Defaults to 'cert-manager.io'.
+                      type: string
+                    kind:
+                      description: |-
+                        Kind of the issuer being referred to.
+                        Defaults to 'Issuer'.
+                      type: string
+                    name:
+                      description: Name of the issuer being referred to.
+                      type: string
+                  required:
+                    - name
+                  type: object
+                profile:
+                  description: |-
+                    Profile allows requesting a certificate profile from the ACME server.
+                    Supported profiles are listed by the server's ACME directory URL.
+                  type: string
+                request:
+                  description: |-
+                    Certificate signing request bytes in DER encoding.
+                    This will be used when finalizing the order.
+                    This field must be set on the order.
+                  format: byte
+                  type: string
+              required:
+                - issuerRef
+                - request
+              type: object
+            status:
+              properties:
+                authorizations:
+                  description: |-
+                    Authorizations contains data returned from the ACME server on what
+                    authorizations must be completed in order to validate the DNS names
+                    specified on the Order.
+                  items:
+                    description: |-
+                      ACMEAuthorization contains data returned from the ACME server on an
+                      authorization that must be completed in order validate a DNS name on an ACME
+                      Order resource.
+                    properties:
+                      challenges:
+                        description: |-
+                          Challenges specifies the challenge types offered by the ACME server.
+                          One of these challenge types will be selected when validating the DNS
+                          name and an appropriate Challenge resource will be created to perform
+                          the ACME challenge process.
+                        items:
+                          description: |-
+                            Challenge specifies a challenge offered by the ACME server for an Order.
+                            An appropriate Challenge resource can be created to perform the ACME
+                            challenge process.
+                          properties:
+                            token:
+                              description: |-
+                                Token is the token that must be presented for this challenge.
+                                This is used to compute the 'key' that must also be presented.
+                              type: string
+                            type:
+                              description: |-
+                                Type is the type of challenge being offered, e.g., 'http-01', 'dns-01',
+                                'tls-sni-01', etc.
+                                This is the raw value retrieved from the ACME server.
+                                Only 'http-01' and 'dns-01' are supported by cert-manager, other values
+                                will be ignored.
+                              type: string
+                            url:
+                              description: |-
+                                URL is the URL of this challenge. It can be used to retrieve additional
+                                metadata about the Challenge from the ACME server.
+                              type: string
+                          required:
+                            - token
+                            - type
+                            - url
+                          type: object
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      identifier:
+                        description: Identifier is the DNS name to be validated as part of this authorization
+                        type: string
+                      initialState:
+                        description: |-
+                          InitialState is the initial state of the ACME authorization when first
+                          fetched from the ACME server.
+                          If an Authorization is already 'valid', the Order controller will not
+                          create a Challenge resource for the authorization. This will occur when
+                          working with an ACME server that enables 'authz reuse' (such as Let's
+                          Encrypt's production endpoint).
+                          If not set and 'identifier' is set, the state is assumed to be pending
+                          and a Challenge will be created.
+                        enum:
+                          - valid
+                          - ready
+                          - pending
+                          - processing
+                          - invalid
+                          - expired
+                          - errored
+                        type: string
+                      url:
+                        description: URL is the URL of the Authorization that must be completed
+                        type: string
+                      wildcard:
+                        description: |-
+                          Wildcard will be true if this authorization is for a wildcard DNS name.
+                          If this is true, the identifier will be the *non-wildcard* version of
+                          the DNS name.
+                          For example, if '*.example.com' is the DNS name being validated, this
+                          field will be 'true' and the 'identifier' field will be 'example.com'.
+                        type: boolean
+                    required:
+                      - url
+                    type: object
+                  type: array
+                  x-kubernetes-list-type: atomic
+                certificate:
+                  description: |-
+                    Certificate is a copy of the PEM encoded certificate for this Order.
+                    This field will be populated after the order has been successfully
+                    finalized with the ACME server, and the order has transitioned to the
+                    'valid' state.
+                  format: byte
+                  type: string
+                failureTime:
+                  description: |-
+                    FailureTime stores the time that this order failed.
+                    This is used to influence garbage collection and back-off.
+                  format: date-time
+                  type: string
+                finalizeURL:
+                  description: |-
+                    FinalizeURL of the Order.
+                    This is used to obtain certificates for this order once it has been completed.
+                  type: string
+                reason:
+                  description: |-
+                    Reason optionally provides more information about a why the order is in
+                    the current state.
+                  type: string
+                state:
+                  description: |-
+                    State contains the current state of this Order resource.
+                    States 'success' and 'expired' are 'final'
+                  enum:
+                    - valid
+                    - ready
+                    - pending
+                    - processing
+                    - invalid
+                    - expired
+                    - errored
+                  type: string
+                url:
+                  description: |-
+                    URL of the Order.
+                    This will initially be empty when the resource is first created.
+                    The Order controller will populate this field when the Order is first processed.
+                    This field will be immutable after it is initially set.
+                  type: string
+              type: object
+          required:
+            - metadata
+            - spec
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+{{- end }}
diff --git a/packages/system/cert-manager-crds/templates/crd-cert-manager.io_certificaterequests.yaml b/packages/system/cert-manager-crds/templates/crd-cert-manager.io_certificaterequests.yaml
new file mode 100644
index 00000000..e25ad1d0
--- /dev/null
+++ b/packages/system/cert-manager-crds/templates/crd-cert-manager.io_certificaterequests.yaml
@@ -0,0 +1,319 @@
+{{- if or .Values.crds.enabled .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: "certificaterequests.cert-manager.io"
+  {{- if .Values.crds.keep }}
+  annotations:
+    helm.sh/resource-policy: keep
+  {{- end }}
+  labels:
+    {{- include "cert-manager.crd-labels" . | nindent 4 }}
+spec:
+  group: cert-manager.io
+  names:
+    categories:
+      - cert-manager
+    kind: CertificateRequest
+    listKind: CertificateRequestList
+    plural: certificaterequests
+    shortNames:
+      - cr
+      - crs
+    singular: certificaterequest
+  scope: Namespaced
+  versions:
+    - additionalPrinterColumns:
+        - jsonPath: .status.conditions[?(@.type == "Approved")].status
+          name: Approved
+          type: string
+        - jsonPath: .status.conditions[?(@.type == "Denied")].status
+          name: Denied
+          type: string
+        - jsonPath: .status.conditions[?(@.type == "Ready")].status
+          name: Ready
+          type: string
+        - jsonPath: .spec.issuerRef.name
+          name: Issuer
+          type: string
+        - jsonPath: .spec.username
+          name: Requester
+          type: string
+        - jsonPath: .status.conditions[?(@.type == "Ready")].message
+          name: Status
+          priority: 1
+          type: string
+        - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+          jsonPath: .metadata.creationTimestamp
+          name: Age
+          type: date
+      name: v1
+      schema:
+        openAPIV3Schema:
+          description: |-
+            A CertificateRequest is used to request a signed certificate from one of the
+            configured issuers.
+
+            All fields within the CertificateRequest's `spec` are immutable after creation.
+            A CertificateRequest will either succeed or fail, as denoted by its `Ready` status
+            condition and its `status.failureTime` field.
+
+            A CertificateRequest is a one-shot resource, meaning it represents a single
+            point in time request for a certificate and cannot be re-used.
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: |-
+                Specification of the desired state of the CertificateRequest resource.
+                https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              properties:
+                duration:
+                  description: |-
+                    Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
+                    issuer may choose to ignore the requested duration, just like any other
+                    requested attribute.
+                  type: string
+                extra:
+                  additionalProperties:
+                    items:
+                      type: string
+                    type: array
+                  description: |-
+                    Extra contains extra attributes of the user that created the CertificateRequest.
+                    Populated by the cert-manager webhook on creation and immutable.
+                  type: object
+                groups:
+                  description: |-
+                    Groups contains group membership of the user that created the CertificateRequest.
+                    Populated by the cert-manager webhook on creation and immutable.
+                  items:
+                    type: string
+                  type: array
+                  x-kubernetes-list-type: atomic
+                isCA:
+                  description: |-
+                    Requested basic constraints isCA value. Note that the issuer may choose
+                    to ignore the requested isCA value, just like any other requested attribute.
+
+                    NOTE: If the CSR in the `Request` field has a BasicConstraints extension,
+                    it must have the same isCA value as specified here.
+
+                    If true, this will automatically add the `cert sign` usage to the list
+                    of requested `usages`.
+                  type: boolean
+                issuerRef:
+                  description: |-
+                    Reference to the issuer responsible for issuing the certificate.
+                    If the issuer is namespace-scoped, it must be in the same namespace
+                    as the Certificate. If the issuer is cluster-scoped, it can be used
+                    from any namespace.
+
+                    The `name` field of the reference must always be specified.
+                  properties:
+                    group:
+                      description: |-
+                        Group of the issuer being referred to.
+                        Defaults to 'cert-manager.io'.
+                      type: string
+                    kind:
+                      description: |-
+                        Kind of the issuer being referred to.
+                        Defaults to 'Issuer'.
+                      type: string
+                    name:
+                      description: Name of the issuer being referred to.
+                      type: string
+                  required:
+                    - name
+                  type: object
+                request:
+                  description: |-
+                    The PEM-encoded X.509 certificate signing request to be submitted to the
+                    issuer for signing.
+
+                    If the CSR has a BasicConstraints extension, its isCA attribute must
+                    match the `isCA` value of this CertificateRequest.
+                    If the CSR has a KeyUsage extension, its key usages must match the
+                    key usages in the `usages` field of this CertificateRequest.
+                    If the CSR has a ExtKeyUsage extension, its extended key usages
+                    must match the extended key usages in the `usages` field of this
+                    CertificateRequest.
+                  format: byte
+                  type: string
+                uid:
+                  description: |-
+                    UID contains the uid of the user that created the CertificateRequest.
+                    Populated by the cert-manager webhook on creation and immutable.
+                  type: string
+                usages:
+                  description: |-
+                    Requested key usages and extended key usages.
+
+                    NOTE: If the CSR in the `Request` field has uses the KeyUsage or
+                    ExtKeyUsage extension, these extensions must have the same values
+                    as specified here without any additional values.
+
+                    If unset, defaults to `digital signature` and `key encipherment`.
+                  items:
+                    description: |-
+                      KeyUsage specifies valid usage contexts for keys.
+                      See:
+                      https://tools.ietf.org/html/rfc5280#section-4.2.1.3
+                      https://tools.ietf.org/html/rfc5280#section-4.2.1.12
+
+                      Valid KeyUsage values are as follows:
+                      "signing",
+                      "digital signature",
+                      "content commitment",
+                      "key encipherment",
+                      "key agreement",
+                      "data encipherment",
+                      "cert sign",
+                      "crl sign",
+                      "encipher only",
+                      "decipher only",
+                      "any",
+                      "server auth",
+                      "client auth",
+                      "code signing",
+                      "email protection",
+                      "s/mime",
+                      "ipsec end system",
+                      "ipsec tunnel",
+                      "ipsec user",
+                      "timestamping",
+                      "ocsp signing",
+                      "microsoft sgc",
+                      "netscape sgc"
+                    enum:
+                      - signing
+                      - digital signature
+                      - content commitment
+                      - key encipherment
+                      - key agreement
+                      - data encipherment
+                      - cert sign
+                      - crl sign
+                      - encipher only
+                      - decipher only
+                      - any
+                      - server auth
+                      - client auth
+                      - code signing
+                      - email protection
+                      - s/mime
+                      - ipsec end system
+                      - ipsec tunnel
+                      - ipsec user
+                      - timestamping
+                      - ocsp signing
+                      - microsoft sgc
+                      - netscape sgc
+                    type: string
+                  type: array
+                  x-kubernetes-list-type: atomic
+                username:
+                  description: |-
+                    Username contains the name of the user that created the CertificateRequest.
+                    Populated by the cert-manager webhook on creation and immutable.
+                  type: string
+              required:
+                - issuerRef
+                - request
+              type: object
+            status:
+              description: |-
+                Status of the CertificateRequest.
+                This is set and managed automatically.
+                Read-only.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              properties:
+                ca:
+                  description: |-
+                    The PEM encoded X.509 certificate of the signer, also known as the CA
+                    (Certificate Authority).
+                    This is set on a best-effort basis by different issuers.
+                    If not set, the CA is assumed to be unknown/not available.
+                  format: byte
+                  type: string
+                certificate:
+                  description: |-
+                    The PEM encoded X.509 certificate resulting from the certificate
+                    signing request.
+                    If not set, the CertificateRequest has either not been completed or has
+                    failed. More information on failure can be found by checking the
+                    `conditions` field.
+                  format: byte
+                  type: string
+                conditions:
+                  description: |-
+                    List of status conditions to indicate the status of a CertificateRequest.
+                    Known condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`.
+                  items:
+                    description: CertificateRequestCondition contains condition information for a CertificateRequest.
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the timestamp corresponding to the last status
+                          change of this condition.
+                        format: date-time
+                        type: string
+                      message:
+                        description: |-
+                          Message is a human readable description of the details of the last
+                          transition, complementing reason.
+                        type: string
+                      reason:
+                        description: |-
+                          Reason is a brief machine readable explanation for the condition's last
+                          transition.
+                        type: string
+                      status:
+                        description: Status of the condition, one of (`True`, `False`, `Unknown`).
+                        enum:
+                          - "True"
+                          - "False"
+                          - Unknown
+                        type: string
+                      type:
+                        description: |-
+                          Type of the condition, known values are (`Ready`, `InvalidRequest`,
+                          `Approved`, `Denied`).
+                        type: string
+                    required:
+                      - status
+                      - type
+                    type: object
+                  type: array
+                  x-kubernetes-list-map-keys:
+                    - type
+                  x-kubernetes-list-type: map
+                failureTime:
+                  description: |-
+                    FailureTime stores the time that this CertificateRequest failed. This is
+                    used to influence garbage collection and back-off.
+                  format: date-time
+                  type: string
+              type: object
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+{{- end }}
diff --git a/packages/system/cert-manager-crds/templates/crd-cert-manager.io_certificates.yaml b/packages/system/cert-manager-crds/templates/crd-cert-manager.io_certificates.yaml
new file mode 100644
index 00000000..6689de66
--- /dev/null
+++ b/packages/system/cert-manager-crds/templates/crd-cert-manager.io_certificates.yaml
@@ -0,0 +1,816 @@
+{{- if or .Values.crds.enabled .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: "certificates.cert-manager.io"
+  {{- if .Values.crds.keep }}
+  annotations:
+    helm.sh/resource-policy: keep
+  {{- end }}
+  labels:
+    {{- include "cert-manager.crd-labels" . | nindent 4 }}
+spec:
+  group: cert-manager.io
+  names:
+    categories:
+      - cert-manager
+    kind: Certificate
+    listKind: CertificateList
+    plural: certificates
+    shortNames:
+      - cert
+      - certs
+    singular: certificate
+  scope: Namespaced
+  versions:
+    - additionalPrinterColumns:
+        - jsonPath: .status.conditions[?(@.type == "Ready")].status
+          name: Ready
+          type: string
+        - jsonPath: .spec.secretName
+          name: Secret
+          type: string
+        - jsonPath: .spec.issuerRef.name
+          name: Issuer
+          priority: 1
+          type: string
+        - jsonPath: .status.conditions[?(@.type == "Ready")].message
+          name: Status
+          priority: 1
+          type: string
+        - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+          jsonPath: .metadata.creationTimestamp
+          name: Age
+          type: date
+      name: v1
+      schema:
+        openAPIV3Schema:
+          description: |-
+            A Certificate resource should be created to ensure an up to date and signed
+            X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.
+
+            The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: |-
+                Specification of the desired state of the Certificate resource.
+                https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              properties:
+                additionalOutputFormats:
+                  description: |-
+                    Defines extra output formats of the private key and signed certificate chain
+                    to be written to this Certificate's target Secret.
+                  items:
+                    description: |-
+                      CertificateAdditionalOutputFormat defines an additional output format of a
+                      Certificate resource. These contain supplementary data formats of the signed
+                      certificate chain and paired private key.
+                    properties:
+                      type:
+                        description: |-
+                          Type is the name of the format type that should be written to the
+                          Certificate's target Secret.
+                        enum:
+                          - DER
+                          - CombinedPEM
+                        type: string
+                    required:
+                      - type
+                    type: object
+                  type: array
+                  x-kubernetes-list-type: atomic
+                commonName:
+                  description: |-
+                    Requested common name X509 certificate subject attribute.
+                    More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
+                    NOTE: TLS clients will ignore this value when any subject alternative name is
+                    set (see https://tools.ietf.org/html/rfc6125#section-6.4.4).
+
+                    Should have a length of 64 characters or fewer to avoid generating invalid CSRs.
+                    Cannot be set if the `literalSubject` field is set.
+                  type: string
+                dnsNames:
+                  description: Requested DNS subject alternative names.
+                  items:
+                    type: string
+                  type: array
+                  x-kubernetes-list-type: atomic
+                duration:
+                  description: |-
+                    Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
+                    issuer may choose to ignore the requested duration, just like any other
+                    requested attribute.
+
+                    If unset, this defaults to 90 days.
+                    Minimum accepted duration is 1 hour.
+                    Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
+                  type: string
+                emailAddresses:
+                  description: Requested email subject alternative names.
+                  items:
+                    type: string
+                  type: array
+                  x-kubernetes-list-type: atomic
+                encodeUsagesInRequest:
+                  description: |-
+                    Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.
+
+                    This option defaults to true, and should only be disabled if the target
+                    issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.
+                  type: boolean
+                ipAddresses:
+                  description: Requested IP address subject alternative names.
+                  items:
+                    type: string
+                  type: array
+                  x-kubernetes-list-type: atomic
+                isCA:
+                  description: |-
+                    Requested basic constraints isCA value.
+                    The isCA value is used to set the `isCA` field on the created CertificateRequest
+                    resources. Note that the issuer may choose to ignore the requested isCA value, just
+                    like any other requested attribute.
+
+                    If true, this will automatically add the `cert sign` usage to the list
+                    of requested `usages`.
+                  type: boolean
+                issuerRef:
+                  description: |-
+                    Reference to the issuer responsible for issuing the certificate.
+                    If the issuer is namespace-scoped, it must be in the same namespace
+                    as the Certificate. If the issuer is cluster-scoped, it can be used
+                    from any namespace.
+
+                    The `name` field of the reference must always be specified.
+                  properties:
+                    group:
+                      description: |-
+                        Group of the issuer being referred to.
+                        Defaults to 'cert-manager.io'.
+                      type: string
+                    kind:
+                      description: |-
+                        Kind of the issuer being referred to.
+                        Defaults to 'Issuer'.
+                      type: string
+                    name:
+                      description: Name of the issuer being referred to.
+                      type: string
+                  required:
+                    - name
+                  type: object
+                keystores:
+                  description: Additional keystore output formats to be stored in the Certificate's Secret.
+                  properties:
+                    jks:
+                      description: |-
+                        JKS configures options for storing a JKS keystore in the
+                        `spec.secretName` Secret resource.
+                      properties:
+                        alias:
+                          description: |-
+                            Alias specifies the alias of the key in the keystore, required by the JKS format.
+                            If not provided, the default alias `certificate` will be used.
+                          type: string
+                        create:
+                          description: |-
+                            Create enables JKS keystore creation for the Certificate.
+                            If true, a file named `keystore.jks` will be created in the target
+                            Secret resource, encrypted using the password stored in
+                            `passwordSecretRef` or `password`.
+                            The keystore file will be updated immediately.
+                            If the issuer provided a CA certificate, a file named `truststore.jks`
+                            will also be created in the target Secret resource, encrypted using the
+                            password stored in `passwordSecretRef`
+                            containing the issuing Certificate Authority
+                          type: boolean
+                        password:
+                          description: |-
+                            Password provides a literal password used to encrypt the JKS keystore.
+                            Mutually exclusive with passwordSecretRef.
+                            One of password or passwordSecretRef must provide a password with a non-zero length.
+                          type: string
+                        passwordSecretRef:
+                          description: |-
+                            PasswordSecretRef is a reference to a non-empty key in a Secret resource
+                            containing the password used to encrypt the JKS keystore.
+                            Mutually exclusive with password.
+                            One of password or passwordSecretRef must provide a password with a non-zero length.
+                          properties:
+                            key:
+                              description: |-
+                                The key of the entry in the Secret resource's `data` field to be used.
+                                Some instances of this field may be defaulted, in others it may be
+                                required.
+                              type: string
+                            name:
+                              description: |-
+                                Name of the resource being referred to.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                          required:
+                            - name
+                          type: object
+                      required:
+                        - create
+                      type: object
+                    pkcs12:
+                      description: |-
+                        PKCS12 configures options for storing a PKCS12 keystore in the
+                        `spec.secretName` Secret resource.
+                      properties:
+                        create:
+                          description: |-
+                            Create enables PKCS12 keystore creation for the Certificate.
+                            If true, a file named `keystore.p12` will be created in the target
+                            Secret resource, encrypted using the password stored in
+                            `passwordSecretRef` or in `password`.
+                            The keystore file will be updated immediately.
+                            If the issuer provided a CA certificate, a file named `truststore.p12` will
+                            also be created in the target Secret resource, encrypted using the
+                            password stored in `passwordSecretRef` containing the issuing Certificate
+                            Authority
+                          type: boolean
+                        password:
+                          description: |-
+                            Password provides a literal password used to encrypt the PKCS#12 keystore.
+                            Mutually exclusive with passwordSecretRef.
+                            One of password or passwordSecretRef must provide a password with a non-zero length.
+                          type: string
+                        passwordSecretRef:
+                          description: |-
+                            PasswordSecretRef is a reference to a non-empty key in a Secret resource
+                            containing the password used to encrypt the PKCS#12 keystore.
+                            Mutually exclusive with password.
+                            One of password or passwordSecretRef must provide a password with a non-zero length.
+                          properties:
+                            key:
+                              description: |-
+                                The key of the entry in the Secret resource's `data` field to be used.
+                                Some instances of this field may be defaulted, in others it may be
+                                required.
+                              type: string
+                            name:
+                              description: |-
+                                Name of the resource being referred to.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                          required:
+                            - name
+                          type: object
+                        profile:
+                          description: |-
+                            Profile specifies the key and certificate encryption algorithms and the HMAC algorithm
+                            used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.
+
+                            If provided, allowed values are:
+                            `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
+                            `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
+                            `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
+                            (e.g., because of company policy). Please note that the security of the algorithm is not that important
+                            in reality, because the unencrypted certificate and private key are also stored in the Secret.
+                          enum:
+                            - LegacyRC2
+                            - LegacyDES
+                            - Modern2023
+                          type: string
+                      required:
+                        - create
+                      type: object
+                  type: object
+                literalSubject:
+                  description: |-
+                    Requested X.509 certificate subject, represented using the LDAP "String
+                    Representation of a Distinguished Name" [1].
+                    Important: the LDAP string format also specifies the order of the attributes
+                    in the subject, this is important when issuing certs for LDAP authentication.
+                    Example: `CN=foo,DC=corp,DC=example,DC=com`
+                    More info [1]: https://datatracker.ietf.org/doc/html/rfc4514
+                    More info: https://github.com/cert-manager/cert-manager/issues/3203
+                    More info: https://github.com/cert-manager/cert-manager/issues/4424
+
+                    Cannot be set if the `subject` or `commonName` field is set.
+                  type: string
+                nameConstraints:
+                  description: |-
+                    x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.
+                    More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10
+
+                    This is an Alpha Feature and is only enabled with the
+                    `--feature-gates=NameConstraints=true` option set on both
+                    the controller and webhook components.
+                  properties:
+                    critical:
+                      description: if true then the name constraints are marked critical.
+                      type: boolean
+                    excluded:
+                      description: |-
+                        Excluded contains the constraints which must be disallowed. Any name matching a
+                        restriction in the excluded field is invalid regardless
+                        of information appearing in the permitted
+                      properties:
+                        dnsDomains:
+                          description: DNSDomains is a list of DNS domains that are permitted or excluded.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        emailAddresses:
+                          description: EmailAddresses is a list of Email Addresses that are permitted or excluded.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        ipRanges:
+                          description: |-
+                            IPRanges is a list of IP Ranges that are permitted or excluded.
+                            This should be a valid CIDR notation.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        uriDomains:
+                          description: URIDomains is a list of URI domains that are permitted or excluded.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                      type: object
+                    permitted:
+                      description: Permitted contains the constraints in which the names must be located.
+                      properties:
+                        dnsDomains:
+                          description: DNSDomains is a list of DNS domains that are permitted or excluded.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        emailAddresses:
+                          description: EmailAddresses is a list of Email Addresses that are permitted or excluded.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        ipRanges:
+                          description: |-
+                            IPRanges is a list of IP Ranges that are permitted or excluded.
+                            This should be a valid CIDR notation.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        uriDomains:
+                          description: URIDomains is a list of URI domains that are permitted or excluded.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                      type: object
+                  type: object
+                otherNames:
+                  description: |-
+                    `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37
+                    Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.
+                    Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3
+                    You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.
+                  items:
+                    properties:
+                      oid:
+                        description: |-
+                          OID is the object identifier for the otherName SAN.
+                          The object identifier must be expressed as a dotted string, for
+                          example, "1.2.840.113556.1.4.221".
+                        type: string
+                      utf8Value:
+                        description: |-
+                          utf8Value is the string value of the otherName SAN.
+                          The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.
+                        type: string
+                    type: object
+                  type: array
+                  x-kubernetes-list-type: atomic
+                privateKey:
+                  description: |-
+                    Private key options. These include the key algorithm and size, the used
+                    encoding and the rotation policy.
+                  properties:
+                    algorithm:
+                      description: |-
+                        Algorithm is the private key algorithm of the corresponding private key
+                        for this certificate.
+
+                        If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.
+                        If `algorithm` is specified and `size` is not provided,
+                        key size of 2048 will be used for `RSA` key algorithm and
+                        key size of 256 will be used for `ECDSA` key algorithm.
+                        key size is ignored when using the `Ed25519` key algorithm.
+                      enum:
+                        - RSA
+                        - ECDSA
+                        - Ed25519
+                      type: string
+                    encoding:
+                      description: |-
+                        The private key cryptography standards (PKCS) encoding for this
+                        certificate's private key to be encoded in.
+
+                        If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1
+                        and PKCS#8, respectively.
+                        Defaults to `PKCS1` if not specified.
+                      enum:
+                        - PKCS1
+                        - PKCS8
+                      type: string
+                    rotationPolicy:
+                      description: |-
+                        RotationPolicy controls how private keys should be regenerated when a
+                        re-issuance is being processed.
+
+                        If set to `Never`, a private key will only be generated if one does not
+                        already exist in the target `spec.secretName`. If one does exist but it
+                        does not have the correct algorithm or size, a warning will be raised
+                        to await user intervention.
+                        If set to `Always`, a private key matching the specified requirements
+                        will be generated whenever a re-issuance occurs.
+                        Default is `Always`.
+                        The default was changed from `Never` to `Always` in cert-manager >=v1.18.0.
+                        The new default can be disabled by setting the
+                        `--feature-gates=DefaultPrivateKeyRotationPolicyAlways=false` option on
+                        the controller component.
+                      enum:
+                        - Never
+                        - Always
+                      type: string
+                    size:
+                      description: |-
+                        Size is the key bit size of the corresponding private key for this certificate.
+
+                        If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,
+                        and will default to `2048` if not specified.
+                        If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,
+                        and will default to `256` if not specified.
+                        If `algorithm` is set to `Ed25519`, Size is ignored.
+                        No other values are allowed.
+                      type: integer
+                  type: object
+                renewBefore:
+                  description: |-
+                    How long before the currently issued certificate's expiry cert-manager should
+                    renew the certificate. For example, if a certificate is valid for 60 minutes,
+                    and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate
+                    50 minutes after it was issued (i.e. when there are 10 minutes remaining until
+                    the certificate is no longer valid).
+
+                    NOTE: The actual lifetime of the issued certificate is used to determine the
+                    renewal time. If an issuer returns a certificate with a different lifetime than
+                    the one requested, cert-manager will use the lifetime of the issued certificate.
+
+                    If unset, this defaults to 1/3 of the issued certificate's lifetime.
+                    Minimum accepted value is 5 minutes.
+                    Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
+                    Cannot be set if the `renewBeforePercentage` field is set.
+                  type: string
+                renewBeforePercentage:
+                  description: |-
+                    `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage
+                    rather than an absolute duration. For example, if a certificate is valid for 60
+                    minutes, and  `renewBeforePercentage=25`, cert-manager will begin to attempt to
+                    renew the certificate 45 minutes after it was issued (i.e. when there are 15
+                    minutes (25%) remaining until the certificate is no longer valid).
+
+                    NOTE: The actual lifetime of the issued certificate is used to determine the
+                    renewal time. If an issuer returns a certificate with a different lifetime than
+                    the one requested, cert-manager will use the lifetime of the issued certificate.
+
+                    Value must be an integer in the range (0,100). The minimum effective
+                    `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5
+                    minutes.
+                    Cannot be set if the `renewBefore` field is set.
+                  format: int32
+                  type: integer
+                revisionHistoryLimit:
+                  description: |-
+                    The maximum number of CertificateRequest revisions that are maintained in
+                    the Certificate's history. Each revision represents a single `CertificateRequest`
+                    created by this Certificate, either when it was created, renewed, or Spec
+                    was changed. Revisions will be removed by oldest first if the number of
+                    revisions exceeds this number.
+
+                    If set, revisionHistoryLimit must be a value of `1` or greater.
+                    Default value is `1`.
+                  format: int32
+                  type: integer
+                secretName:
+                  description: |-
+                    Name of the Secret resource that will be automatically created and
+                    managed by this Certificate resource. It will be populated with a
+                    private key and certificate, signed by the denoted issuer. The Secret
+                    resource lives in the same namespace as the Certificate resource.
+                  type: string
+                secretTemplate:
+                  description: |-
+                    Defines annotations and labels to be copied to the Certificate's Secret.
+                    Labels and annotations on the Secret will be changed as they appear on the
+                    SecretTemplate when added or removed. SecretTemplate annotations are added
+                    in conjunction with, and cannot overwrite, the base set of annotations
+                    cert-manager sets on the Certificate's Secret.
+                  properties:
+                    annotations:
+                      additionalProperties:
+                        type: string
+                      description: Annotations is a key value map to be copied to the target Kubernetes Secret.
+                      type: object
+                    labels:
+                      additionalProperties:
+                        type: string
+                      description: Labels is a key value map to be copied to the target Kubernetes Secret.
+                      type: object
+                  type: object
+                signatureAlgorithm:
+                  description: |-
+                    Signature algorithm to use.
+                    Allowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA.
+                    Allowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512.
+                    Allowed values for Ed25519 keys: PureEd25519.
+                  enum:
+                    - SHA256WithRSA
+                    - SHA384WithRSA
+                    - SHA512WithRSA
+                    - ECDSAWithSHA256
+                    - ECDSAWithSHA384
+                    - ECDSAWithSHA512
+                    - PureEd25519
+                  type: string
+                subject:
+                  description: |-
+                    Requested set of X509 certificate subject attributes.
+                    More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
+
+                    The common name attribute is specified separately in the `commonName` field.
+                    Cannot be set if the `literalSubject` field is set.
+                  properties:
+                    countries:
+                      description: Countries to be used on the Certificate.
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    localities:
+                      description: Cities to be used on the Certificate.
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    organizationalUnits:
+                      description: Organizational Units to be used on the Certificate.
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    organizations:
+                      description: Organizations to be used on the Certificate.
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    postalCodes:
+                      description: Postal codes to be used on the Certificate.
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    provinces:
+                      description: State/Provinces to be used on the Certificate.
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    serialNumber:
+                      description: Serial number to be used on the Certificate.
+                      type: string
+                    streetAddresses:
+                      description: Street addresses to be used on the Certificate.
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                  type: object
+                uris:
+                  description: Requested URI subject alternative names.
+                  items:
+                    type: string
+                  type: array
+                  x-kubernetes-list-type: atomic
+                usages:
+                  description: |-
+                    Requested key usages and extended key usages.
+                    These usages are used to set the `usages` field on the created CertificateRequest
+                    resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages
+                    will additionally be encoded in the `request` field which contains the CSR blob.
+
+                    If unset, defaults to `digital signature` and `key encipherment`.
+                  items:
+                    description: |-
+                      KeyUsage specifies valid usage contexts for keys.
+                      See:
+                      https://tools.ietf.org/html/rfc5280#section-4.2.1.3
+                      https://tools.ietf.org/html/rfc5280#section-4.2.1.12
+
+                      Valid KeyUsage values are as follows:
+                      "signing",
+                      "digital signature",
+                      "content commitment",
+                      "key encipherment",
+                      "key agreement",
+                      "data encipherment",
+                      "cert sign",
+                      "crl sign",
+                      "encipher only",
+                      "decipher only",
+                      "any",
+                      "server auth",
+                      "client auth",
+                      "code signing",
+                      "email protection",
+                      "s/mime",
+                      "ipsec end system",
+                      "ipsec tunnel",
+                      "ipsec user",
+                      "timestamping",
+                      "ocsp signing",
+                      "microsoft sgc",
+                      "netscape sgc"
+                    enum:
+                      - signing
+                      - digital signature
+                      - content commitment
+                      - key encipherment
+                      - key agreement
+                      - data encipherment
+                      - cert sign
+                      - crl sign
+                      - encipher only
+                      - decipher only
+                      - any
+                      - server auth
+                      - client auth
+                      - code signing
+                      - email protection
+                      - s/mime
+                      - ipsec end system
+                      - ipsec tunnel
+                      - ipsec user
+                      - timestamping
+                      - ocsp signing
+                      - microsoft sgc
+                      - netscape sgc
+                    type: string
+                  type: array
+                  x-kubernetes-list-type: atomic
+              required:
+                - issuerRef
+                - secretName
+              type: object
+            status:
+              description: |-
+                Status of the Certificate.
+                This is set and managed automatically.
+                Read-only.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              properties:
+                conditions:
+                  description: |-
+                    List of status conditions to indicate the status of certificates.
+                    Known condition types are `Ready` and `Issuing`.
+                  items:
+                    description: CertificateCondition contains condition information for a Certificate.
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the timestamp corresponding to the last status
+                          change of this condition.
+                        format: date-time
+                        type: string
+                      message:
+                        description: |-
+                          Message is a human readable description of the details of the last
+                          transition, complementing reason.
+                        type: string
+                      observedGeneration:
+                        description: |-
+                          If set, this represents the .metadata.generation that the condition was
+                          set based upon.
+                          For instance, if .metadata.generation is currently 12, but the
+                          .status.condition[x].observedGeneration is 9, the condition is out of date
+                          with respect to the current state of the Certificate.
+                        format: int64
+                        type: integer
+                      reason:
+                        description: |-
+                          Reason is a brief machine readable explanation for the condition's last
+                          transition.
+                        type: string
+                      status:
+                        description: Status of the condition, one of (`True`, `False`, `Unknown`).
+                        enum:
+                          - "True"
+                          - "False"
+                          - Unknown
+                        type: string
+                      type:
+                        description: Type of the condition, known values are (`Ready`, `Issuing`).
+                        type: string
+                    required:
+                      - status
+                      - type
+                    type: object
+                  type: array
+                  x-kubernetes-list-map-keys:
+                    - type
+                  x-kubernetes-list-type: map
+                failedIssuanceAttempts:
+                  description: |-
+                    The number of continuous failed issuance attempts up till now. This
+                    field gets removed (if set) on a successful issuance and gets set to
+                    1 if unset and an issuance has failed. If an issuance has failed, the
+                    delay till the next issuance will be calculated using formula
+                    time.Hour * 2 ^ (failedIssuanceAttempts - 1).
+                  type: integer
+                lastFailureTime:
+                  description: |-
+                    LastFailureTime is set only if the latest issuance for this
+                    Certificate failed and contains the time of the failure. If an
+                    issuance has failed, the delay till the next issuance will be
+                    calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -
+                    1). If the latest issuance has succeeded this field will be unset.
+                  format: date-time
+                  type: string
+                nextPrivateKeySecretName:
+                  description: |-
+                    The name of the Secret resource containing the private key to be used
+                    for the next certificate iteration.
+                    The keymanager controller will automatically set this field if the
+                    `Issuing` condition is set to `True`.
+                    It will automatically unset this field when the Issuing condition is
+                    not set or False.
+                  type: string
+                notAfter:
+                  description: |-
+                    The expiration time of the certificate stored in the secret named
+                    by this resource in `spec.secretName`.
+                  format: date-time
+                  type: string
+                notBefore:
+                  description: |-
+                    The time after which the certificate stored in the secret named
+                    by this resource in `spec.secretName` is valid.
+                  format: date-time
+                  type: string
+                renewalTime:
+                  description: |-
+                    RenewalTime is the time at which the certificate will be next
+                    renewed.
+                    If not set, no upcoming renewal is scheduled.
+                  format: date-time
+                  type: string
+                revision:
+                  description: |-
+                    The current 'revision' of the certificate as issued.
+
+                    When a CertificateRequest resource is created, it will have the
+                    `cert-manager.io/certificate-revision` set to one greater than the
+                    current value of this field.
+
+                    Upon issuance, this field will be set to the value of the annotation
+                    on the CertificateRequest resource used to issue the certificate.
+
+                    Persisting the value on the CertificateRequest resource allows the
+                    certificates controller to know whether a request is part of an old
+                    issuance or if it is part of the ongoing revision's issuance by
+                    checking if the revision value in the annotation is greater than this
+                    field.
+                  type: integer
+              type: object
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+{{- end }}
diff --git a/packages/system/cert-manager-crds/templates/crd-cert-manager.io_clusterissuers.yaml b/packages/system/cert-manager-crds/templates/crd-cert-manager.io_clusterissuers.yaml
new file mode 100644
index 00000000..790d4b5c
--- /dev/null
+++ b/packages/system/cert-manager-crds/templates/crd-cert-manager.io_clusterissuers.yaml
@@ -0,0 +1,3815 @@
+{{- if or .Values.crds.enabled .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: "clusterissuers.cert-manager.io"
+  {{- if .Values.crds.keep }}
+  annotations:
+    helm.sh/resource-policy: keep
+  {{- end }}
+  labels:
+    {{- include "cert-manager.crd-labels" . | nindent 4 }}
+spec:
+  group: cert-manager.io
+  names:
+    categories:
+      - cert-manager
+    kind: ClusterIssuer
+    listKind: ClusterIssuerList
+    plural: clusterissuers
+    shortNames:
+      - ciss
+    singular: clusterissuer
+  scope: Cluster
+  versions:
+    - additionalPrinterColumns:
+        - jsonPath: .status.conditions[?(@.type == "Ready")].status
+          name: Ready
+          type: string
+        - jsonPath: .status.conditions[?(@.type == "Ready")].message
+          name: Status
+          priority: 1
+          type: string
+        - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+          jsonPath: .metadata.creationTimestamp
+          name: Age
+          type: date
+      name: v1
+      schema:
+        openAPIV3Schema:
+          description: |-
+            A ClusterIssuer represents a certificate issuing authority which can be
+            referenced as part of `issuerRef` fields.
+            It is similar to an Issuer, however it is cluster-scoped and therefore can
+            be referenced by resources that exist in *any* namespace, not just the same
+            namespace as the referent.
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: Desired state of the ClusterIssuer resource.
+              properties:
+                acme:
+                  description: |-
+                    ACME configures this issuer to communicate with a RFC8555 (ACME) server
+                    to obtain signed x509 certificates.
+                  properties:
+                    caBundle:
+                      description: |-
+                        Base64-encoded bundle of PEM CAs which can be used to validate the certificate
+                        chain presented by the ACME server.
+                        Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various
+                        kinds of security vulnerabilities.
+                        If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
+                        the container is used to validate the TLS connection.
+                      format: byte
+                      type: string
+                    disableAccountKeyGeneration:
+                      description: |-
+                        Enables or disables generating a new ACME account key.
+                        If true, the Issuer resource will *not* request a new account but will expect
+                        the account key to be supplied via an existing secret.
+                        If false, the cert-manager system will generate a new ACME account key
+                        for the Issuer.
+                        Defaults to false.
+                      type: boolean
+                    email:
+                      description: |-
+                        Email is the email address to be associated with the ACME account.
+                        This field is optional, but it is strongly recommended to be set.
+                        It will be used to contact you in case of issues with your account or
+                        certificates, including expiry notification emails.
+                        This field may be updated after the account is initially registered.
+                      type: string
+                    enableDurationFeature:
+                      description: |-
+                        Enables requesting a Not After date on certificates that matches the
+                        duration of the certificate. This is not supported by all ACME servers
+                        like Let's Encrypt. If set to true when the ACME server does not support
+                        it, it will create an error on the Order.
+                        Defaults to false.
+                      type: boolean
+                    externalAccountBinding:
+                      description: |-
+                        ExternalAccountBinding is a reference to a CA external account of the ACME
+                        server.
+                        If set, upon registration cert-manager will attempt to associate the given
+                        external account credentials with the registered ACME account.
+                      properties:
+                        keyAlgorithm:
+                          description: |-
+                            Deprecated: keyAlgorithm field exists for historical compatibility
+                            reasons and should not be used. The algorithm is now hardcoded to HS256
+                            in golang/x/crypto/acme.
+                          enum:
+                            - HS256
+                            - HS384
+                            - HS512
+                          type: string
+                        keyID:
+                          description: keyID is the ID of the CA key that the External Account is bound to.
+                          type: string
+                        keySecretRef:
+                          description: |-
+                            keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes
+                            Secret which holds the symmetric MAC key of the External Account Binding.
+                            The `key` is the index string that is paired with the key data in the
+                            Secret and should not be confused with the key data itself, or indeed with
+                            the External Account Binding keyID above.
+                            The secret key stored in the Secret **must** be un-padded, base64 URL
+                            encoded data.
+                          properties:
+                            key:
+                              description: |-
+                                The key of the entry in the Secret resource's `data` field to be used.
+                                Some instances of this field may be defaulted, in others it may be
+                                required.
+                              type: string
+                            name:
+                              description: |-
+                                Name of the resource being referred to.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                          required:
+                            - name
+                          type: object
+                      required:
+                        - keyID
+                        - keySecretRef
+                      type: object
+                    preferredChain:
+                      description: |-
+                        PreferredChain is the chain to use if the ACME server outputs multiple.
+                        PreferredChain is no guarantee that this one gets delivered by the ACME
+                        endpoint.
+                        For example, for Let's Encrypt's DST cross-sign you would use:
+                        "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
+                        This value picks the first certificate bundle in the combined set of
+                        ACME default and alternative chains that has a root-most certificate with
+                        this value as its issuer's commonname.
+                      maxLength: 64
+                      type: string
+                    privateKeySecretRef:
+                      description: |-
+                        PrivateKey is the name of a Kubernetes Secret resource that will be used to
+                        store the automatically generated ACME account private key.
+                        Optionally, a `key` may be specified to select a specific entry within
+                        the named Secret resource.
+                        If `key` is not specified, a default of `tls.key` will be used.
+                      properties:
+                        key:
+                          description: |-
+                            The key of the entry in the Secret resource's `data` field to be used.
+                            Some instances of this field may be defaulted, in others it may be
+                            required.
+                          type: string
+                        name:
+                          description: |-
+                            Name of the resource being referred to.
+                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          type: string
+                      required:
+                        - name
+                      type: object
+                    profile:
+                      description: |-
+                        Profile allows requesting a certificate profile from the ACME server.
+                        Supported profiles are listed by the server's ACME directory URL.
+                      type: string
+                    server:
+                      description: |-
+                        Server is the URL used to access the ACME server's 'directory' endpoint.
+                        For example, for Let's Encrypt's staging endpoint, you would use:
+                        "https://acme-staging-v02.api.letsencrypt.org/directory".
+                        Only ACME v2 endpoints (i.e. RFC 8555) are supported.
+                      type: string
+                    skipTLSVerify:
+                      description: |-
+                        INSECURE: Enables or disables validation of the ACME server TLS certificate.
+                        If true, requests to the ACME server will not have the TLS certificate chain
+                        validated.
+                        Mutually exclusive with CABundle; prefer using CABundle to prevent various
+                        kinds of security vulnerabilities.
+                        Only enable this option in development environments.
+                        If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
+                        the container is used to validate the TLS connection.
+                        Defaults to false.
+                      type: boolean
+                    solvers:
+                      description: |-
+                        Solvers is a list of challenge solvers that will be used to solve
+                        ACME challenges for the matching domains.
+                        Solver configurations must be provided in order to obtain certificates
+                        from an ACME server.
+                        For more information, see: https://cert-manager.io/docs/configuration/acme/
+                      items:
+                        description: |-
+                          An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of.
+                          A selector may be provided to use different solving strategies for different DNS names.
+                          Only one of HTTP01 or DNS01 must be provided.
+                        properties:
+                          dns01:
+                            description: |-
+                              Configures cert-manager to attempt to complete authorizations by
+                              performing the DNS01 challenge flow.
+                            properties:
+                              acmeDNS:
+                                description: |-
+                                  Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
+                                  DNS01 challenge records.
+                                properties:
+                                  accountSecretRef:
+                                    description: |-
+                                      A reference to a specific 'key' within a Secret resource.
+                                      In some instances, `key` is a required field.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                  host:
+                                    type: string
+                                required:
+                                  - accountSecretRef
+                                  - host
+                                type: object
+                              akamai:
+                                description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
+                                properties:
+                                  accessTokenSecretRef:
+                                    description: |-
+                                      A reference to a specific 'key' within a Secret resource.
+                                      In some instances, `key` is a required field.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                  clientSecretSecretRef:
+                                    description: |-
+                                      A reference to a specific 'key' within a Secret resource.
+                                      In some instances, `key` is a required field.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                  clientTokenSecretRef:
+                                    description: |-
+                                      A reference to a specific 'key' within a Secret resource.
+                                      In some instances, `key` is a required field.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                  serviceConsumerDomain:
+                                    type: string
+                                required:
+                                  - accessTokenSecretRef
+                                  - clientSecretSecretRef
+                                  - clientTokenSecretRef
+                                  - serviceConsumerDomain
+                                type: object
+                              azureDNS:
+                                description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
+                                properties:
+                                  clientID:
+                                    description: |-
+                                      Auth: Azure Service Principal:
+                                      The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
+                                      If set, ClientSecret and TenantID must also be set.
+                                    type: string
+                                  clientSecretSecretRef:
+                                    description: |-
+                                      Auth: Azure Service Principal:
+                                      A reference to a Secret containing the password associated with the Service Principal.
+                                      If set, ClientID and TenantID must also be set.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                  environment:
+                                    description: name of the Azure environment (default AzurePublicCloud)
+                                    enum:
+                                      - AzurePublicCloud
+                                      - AzureChinaCloud
+                                      - AzureGermanCloud
+                                      - AzureUSGovernmentCloud
+                                    type: string
+                                  hostedZoneName:
+                                    description: name of the DNS zone that should be used
+                                    type: string
+                                  managedIdentity:
+                                    description: |-
+                                      Auth: Azure Workload Identity or Azure Managed Service Identity:
+                                      Settings to enable Azure Workload Identity or Azure Managed Service Identity
+                                      If set, ClientID, ClientSecret and TenantID must not be set.
+                                    properties:
+                                      clientID:
+                                        description: client ID of the managed identity, cannot be used at the same time as resourceID
+                                        type: string
+                                      resourceID:
+                                        description: |-
+                                          resource ID of the managed identity, cannot be used at the same time as clientID
+                                          Cannot be used for Azure Managed Service Identity
+                                        type: string
+                                      tenantID:
+                                        description: tenant ID of the managed identity, cannot be used at the same time as resourceID
+                                        type: string
+                                    type: object
+                                  resourceGroupName:
+                                    description: resource group the DNS zone is located in
+                                    type: string
+                                  subscriptionID:
+                                    description: ID of the Azure subscription
+                                    type: string
+                                  tenantID:
+                                    description: |-
+                                      Auth: Azure Service Principal:
+                                      The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
+                                      If set, ClientID and ClientSecret must also be set.
+                                    type: string
+                                required:
+                                  - resourceGroupName
+                                  - subscriptionID
+                                type: object
+                              cloudDNS:
+                                description: Use the Google Cloud DNS API to manage DNS01 challenge records.
+                                properties:
+                                  hostedZoneName:
+                                    description: |-
+                                      HostedZoneName is an optional field that tells cert-manager in which
+                                      Cloud DNS zone the challenge record has to be created.
+                                      If left empty cert-manager will automatically choose a zone.
+                                    type: string
+                                  project:
+                                    type: string
+                                  serviceAccountSecretRef:
+                                    description: |-
+                                      A reference to a specific 'key' within a Secret resource.
+                                      In some instances, `key` is a required field.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                required:
+                                  - project
+                                type: object
+                              cloudflare:
+                                description: Use the Cloudflare API to manage DNS01 challenge records.
+                                properties:
+                                  apiKeySecretRef:
+                                    description: |-
+                                      API key to use to authenticate with Cloudflare.
+                                      Note: using an API token to authenticate is now the recommended method
+                                      as it allows greater control of permissions.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                  apiTokenSecretRef:
+                                    description: API token used to authenticate with Cloudflare.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                  email:
+                                    description: Email of the account, only required when using API key based authentication.
+                                    type: string
+                                type: object
+                              cnameStrategy:
+                                description: |-
+                                  CNAMEStrategy configures how the DNS01 provider should handle CNAME
+                                  records when found in DNS zones.
+                                enum:
+                                  - None
+                                  - Follow
+                                type: string
+                              digitalocean:
+                                description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
+                                properties:
+                                  tokenSecretRef:
+                                    description: |-
+                                      A reference to a specific 'key' within a Secret resource.
+                                      In some instances, `key` is a required field.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                required:
+                                  - tokenSecretRef
+                                type: object
+                              rfc2136:
+                                description: |-
+                                  Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
+                                  to manage DNS01 challenge records.
+                                properties:
+                                  nameserver:
+                                    description: |-
+                                      The IP address or hostname of an authoritative DNS server supporting
+                                      RFC2136 in the form host:port. If the host is an IPv6 address it must be
+                                      enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
+                                      This field is required.
+                                    type: string
+                                  protocol:
+                                    description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default).
+                                    enum:
+                                      - TCP
+                                      - UDP
+                                    type: string
+                                  tsigAlgorithm:
+                                    description: |-
+                                      The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
+                                      when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
+                                      Supported values are (case-insensitive): ``HMACMD5`` (default),
+                                      ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
+                                    type: string
+                                  tsigKeyName:
+                                    description: |-
+                                      The TSIG Key name configured in the DNS.
+                                      If ``tsigSecretSecretRef`` is defined, this field is required.
+                                    type: string
+                                  tsigSecretSecretRef:
+                                    description: |-
+                                      The name of the secret containing the TSIG value.
+                                      If ``tsigKeyName`` is defined, this field is required.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                required:
+                                  - nameserver
+                                type: object
+                              route53:
+                                description: Use the AWS Route53 API to manage DNS01 challenge records.
+                                properties:
+                                  accessKeyID:
+                                    description: |-
+                                      The AccessKeyID is used for authentication.
+                                      Cannot be set when SecretAccessKeyID is set.
+                                      If neither the Access Key nor Key ID are set, we fall-back to using env
+                                      vars, shared credentials file or AWS Instance metadata,
+                                      see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+                                    type: string
+                                  accessKeyIDSecretRef:
+                                    description: |-
+                                      The SecretAccessKey is used for authentication. If set, pull the AWS
+                                      access key ID from a key within a Kubernetes Secret.
+                                      Cannot be set when AccessKeyID is set.
+                                      If neither the Access Key nor Key ID are set, we fall-back to using env
+                                      vars, shared credentials file or AWS Instance metadata,
+                                      see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                  auth:
+                                    description: Auth configures how cert-manager authenticates.
+                                    properties:
+                                      kubernetes:
+                                        description: |-
+                                          Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
+                                          by passing a bound ServiceAccount token.
+                                        properties:
+                                          serviceAccountRef:
+                                            description: |-
+                                              A reference to a service account that will be used to request a bound
+                                              token (also known as "projected token"). To use this field, you must
+                                              configure an RBAC rule to let cert-manager request a token.
+                                            properties:
+                                              audiences:
+                                                description: |-
+                                                  TokenAudiences is an optional list of audiences to include in the
+                                                  token passed to AWS. The default token consisting of the issuer's namespace
+                                                  and name is always included.
+                                                  If unset the audience defaults to `sts.amazonaws.com`.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              name:
+                                                description: Name of the ServiceAccount used to request a token.
+                                                type: string
+                                            required:
+                                              - name
+                                            type: object
+                                        required:
+                                          - serviceAccountRef
+                                        type: object
+                                    required:
+                                      - kubernetes
+                                    type: object
+                                  hostedZoneID:
+                                    description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.
+                                    type: string
+                                  region:
+                                    description: |-
+                                      Override the AWS region.
+
+                                      Route53 is a global service and does not have regional endpoints but the
+                                      region specified here (or via environment variables) is used as a hint to
+                                      help compute the correct AWS credential scope and partition when it
+                                      connects to Route53. See:
+                                      - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
+                                      - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)
+
+                                      If you omit this region field, cert-manager will use the region from
+                                      AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
+                                      in the cert-manager controller Pod.
+
+                                      The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
+                                      Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
+                                      [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
+                                      In this case this `region` field value is ignored.
+
+                                      The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
+                                      Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
+                                      [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
+                                      In this case this `region` field value is ignored.
+                                    type: string
+                                  role:
+                                    description: |-
+                                      Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
+                                      or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
+                                    type: string
+                                  secretAccessKeySecretRef:
+                                    description: |-
+                                      The SecretAccessKey is used for authentication.
+                                      If neither the Access Key nor Key ID are set, we fall-back to using env
+                                      vars, shared credentials file or AWS Instance metadata,
+                                      see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                type: object
+                              webhook:
+                                description: |-
+                                  Configure an external webhook based DNS01 challenge solver to manage
+                                  DNS01 challenge records.
+                                properties:
+                                  config:
+                                    description: |-
+                                      Additional configuration that should be passed to the webhook apiserver
+                                      when challenges are processed.
+                                      This can contain arbitrary JSON data.
+                                      Secret values should not be specified in this stanza.
+                                      If secret values are needed (e.g., credentials for a DNS service), you
+                                      should use a SecretKeySelector to reference a Secret resource.
+                                      For details on the schema of this field, consult the webhook provider
+                                      implementation's documentation.
+                                    x-kubernetes-preserve-unknown-fields: true
+                                  groupName:
+                                    description: |-
+                                      The API group name that should be used when POSTing ChallengePayload
+                                      resources to the webhook apiserver.
+                                      This should be the same as the GroupName specified in the webhook
+                                      provider implementation.
+                                    type: string
+                                  solverName:
+                                    description: |-
+                                      The name of the solver to use, as defined in the webhook provider
+                                      implementation.
+                                      This will typically be the name of the provider, e.g., 'cloudflare'.
+                                    type: string
+                                required:
+                                  - groupName
+                                  - solverName
+                                type: object
+                            type: object
+                          http01:
+                            description: |-
+                              Configures cert-manager to attempt to complete authorizations by
+                              performing the HTTP01 challenge flow.
+                              It is not possible to obtain certificates for wildcard domain names
+                              (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
+                            properties:
+                              gatewayHTTPRoute:
+                                description: |-
+                                  The Gateway API is a sig-network community API that models service networking
+                                  in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
+                                  create HTTPRoutes with the specified labels in the same namespace as the challenge.
+                                  This solver is experimental, and fields / behaviour may change in the future.
+                                properties:
+                                  labels:
+                                    additionalProperties:
+                                      type: string
+                                    description: |-
+                                      Custom labels that will be applied to HTTPRoutes created by cert-manager
+                                      while solving HTTP-01 challenges.
+                                    type: object
+                                  parentRefs:
+                                    description: |-
+                                      When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
+                                      cert-manager needs to know which parentRefs should be used when creating
+                                      the HTTPRoute. Usually, the parentRef references a Gateway. See:
+                                      https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
+                                    items:
+                                      description: |-
+                                        ParentReference identifies an API object (usually a Gateway) that can be considered
+                                        a parent of this resource (usually a route). There are two kinds of parent resources
+                                        with "Core" support:
+
+                                        * Gateway (Gateway conformance profile)
+                                        * Service (Mesh conformance profile, ClusterIP Services only)
+
+                                        This API may be extended in the future to support additional kinds of parent
+                                        resources.
+
+                                        The API object must be valid in the cluster; the Group and Kind must
+                                        be registered in the cluster for this reference to be valid.
+                                      properties:
+                                        group:
+                                          default: gateway.networking.k8s.io
+                                          description: |-
+                                            Group is the group of the referent.
+                                            When unspecified, "gateway.networking.k8s.io" is inferred.
+                                            To set the core API group (such as for a "Service" kind referent),
+                                            Group must be explicitly set to "" (empty string).
+
+                                            Support: Core
+                                          maxLength: 253
+                                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                          type: string
+                                        kind:
+                                          default: Gateway
+                                          description: |-
+                                            Kind is kind of the referent.
+
+                                            There are two kinds of parent resources with "Core" support:
+
+                                            * Gateway (Gateway conformance profile)
+                                            * Service (Mesh conformance profile, ClusterIP Services only)
+
+                                            Support for other resources is Implementation-Specific.
+                                          maxLength: 63
+                                          minLength: 1
+                                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                          type: string
+                                        name:
+                                          description: |-
+                                            Name is the name of the referent.
+
+                                            Support: Core
+                                          maxLength: 253
+                                          minLength: 1
+                                          type: string
+                                        namespace:
+                                          description: |-
+                                            Namespace is the namespace of the referent. When unspecified, this refers
+                                            to the local namespace of the Route.
+
+                                            Note that there are specific rules for ParentRefs which cross namespace
+                                            boundaries. Cross-namespace references are only valid if they are explicitly
+                                            allowed by something in the namespace they are referring to. For example:
+                                            Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                                            generic way to enable any other kind of cross-namespace reference.
+
+                                            <gateway:experimental:description>
+                                            ParentRefs from a Route to a Service in the same namespace are "producer"
+                                            routes, which apply default routing rules to inbound connections from
+                                            any namespace to the Service.
+
+                                            ParentRefs from a Route to a Service in a different namespace are
+                                            "consumer" routes, and these routing rules are only applied to outbound
+                                            connections originating from the same namespace as the Route, for which
+                                            the intended destination of the connections are a Service targeted as a
+                                            ParentRef of the Route.
+                                            </gateway:experimental:description>
+
+                                            Support: Core
+                                          maxLength: 63
+                                          minLength: 1
+                                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                          type: string
+                                        port:
+                                          description: |-
+                                            Port is the network port this Route targets. It can be interpreted
+                                            differently based on the type of parent resource.
+
+                                            When the parent resource is a Gateway, this targets all listeners
+                                            listening on the specified port that also support this kind of Route(and
+                                            select this Route). It's not recommended to set `Port` unless the
+                                            networking behaviors specified in a Route must apply to a specific port
+                                            as opposed to a listener(s) whose port(s) may be changed. When both Port
+                                            and SectionName are specified, the name and port of the selected listener
+                                            must match both specified values.
+
+                                            <gateway:experimental:description>
+                                            When the parent resource is a Service, this targets a specific port in the
+                                            Service spec. When both Port (experimental) and SectionName are specified,
+                                            the name and port of the selected port must match both specified values.
+                                            </gateway:experimental:description>
+
+                                            Implementations MAY choose to support other parent resources.
+                                            Implementations supporting other types of parent resources MUST clearly
+                                            document how/if Port is interpreted.
+
+                                            For the purpose of status, an attachment is considered successful as
+                                            long as the parent resource accepts it partially. For example, Gateway
+                                            listeners can restrict which Routes can attach to them by Route kind,
+                                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                                            from the referencing Route, the Route MUST be considered successfully
+                                            attached. If no Gateway listeners accept attachment from this Route,
+                                            the Route MUST be considered detached from the Gateway.
+
+                                            Support: Extended
+                                          format: int32
+                                          maximum: 65535
+                                          minimum: 1
+                                          type: integer
+                                        sectionName:
+                                          description: |-
+                                            SectionName is the name of a section within the target resource. In the
+                                            following resources, SectionName is interpreted as the following:
+
+                                            * Gateway: Listener name. When both Port (experimental) and SectionName
+                                            are specified, the name and port of the selected listener must match
+                                            both specified values.
+                                            * Service: Port name. When both Port (experimental) and SectionName
+                                            are specified, the name and port of the selected listener must match
+                                            both specified values.
+
+                                            Implementations MAY choose to support attaching Routes to other resources.
+                                            If that is the case, they MUST clearly document how SectionName is
+                                            interpreted.
+
+                                            When unspecified (empty string), this will reference the entire resource.
+                                            For the purpose of status, an attachment is considered successful if at
+                                            least one section in the parent resource accepts it. For example, Gateway
+                                            listeners can restrict which Routes can attach to them by Route kind,
+                                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                                            the referencing Route, the Route MUST be considered successfully
+                                            attached. If no Gateway listeners accept attachment from this Route, the
+                                            Route MUST be considered detached from the Gateway.
+
+                                            Support: Core
+                                          maxLength: 253
+                                          minLength: 1
+                                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                          type: string
+                                      required:
+                                        - name
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  podTemplate:
+                                    description: |-
+                                      Optional pod template used to configure the ACME challenge solver pods
+                                      used for HTTP01 challenges.
+                                    properties:
+                                      metadata:
+                                        description: |-
+                                          ObjectMeta overrides for the pod used to solve HTTP01 challenges.
+                                          Only the 'labels' and 'annotations' fields may be set.
+                                          If labels or annotations overlap with in-built values, the values here
+                                          will override the in-built values.
+                                        properties:
+                                          annotations:
+                                            additionalProperties:
+                                              type: string
+                                            description: Annotations that should be added to the created ACME HTTP01 solver pods.
+                                            type: object
+                                          labels:
+                                            additionalProperties:
+                                              type: string
+                                            description: Labels that should be added to the created ACME HTTP01 solver pods.
+                                            type: object
+                                        type: object
+                                      spec:
+                                        description: |-
+                                          PodSpec defines overrides for the HTTP01 challenge solver pod.
+                                          Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
+                                          All other fields will be ignored.
+                                        properties:
+                                          affinity:
+                                            description: If specified, the pod's scheduling constraints
+                                            properties:
+                                              nodeAffinity:
+                                                description: Describes node affinity scheduling rules for the pod.
+                                                properties:
+                                                  preferredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      The scheduler will prefer to schedule pods to nodes that satisfy
+                                                      the affinity expressions specified by this field, but it may choose
+                                                      a node that violates one or more of the expressions. The node that is
+                                                      most preferred is the one with the greatest sum of weights, i.e.
+                                                      for each node that meets all of the scheduling requirements (resource
+                                                      request, requiredDuringScheduling affinity expressions, etc.),
+                                                      compute a sum by iterating through the elements of this field and adding
+                                                      "weight" to the sum if the node matches the corresponding matchExpressions; the
+                                                      node(s) with the highest sum are the most preferred.
+                                                    items:
+                                                      description: |-
+                                                        An empty preferred scheduling term matches all objects with implicit weight 0
+                                                        (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+                                                      properties:
+                                                        preference:
+                                                          description: A node selector term, associated with the corresponding weight.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: A list of node selector requirements by node's labels.
+                                                              items:
+                                                                description: |-
+                                                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                                                  that relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: The label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      Represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      An array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                                                      array must have a single element, which will be interpreted as an integer.
+                                                                      This array is replaced during a strategic merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchFields:
+                                                              description: A list of node selector requirements by node's fields.
+                                                              items:
+                                                                description: |-
+                                                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                                                  that relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: The label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      Represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      An array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                                                      array must have a single element, which will be interpreted as an integer.
+                                                                      This array is replaced during a strategic merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        weight:
+                                                          description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
+                                                          format: int32
+                                                          type: integer
+                                                      required:
+                                                        - preference
+                                                        - weight
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  requiredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      If the affinity requirements specified by this field are not met at
+                                                      scheduling time, the pod will not be scheduled onto the node.
+                                                      If the affinity requirements specified by this field cease to be met
+                                                      at some point during pod execution (e.g. due to an update), the system
+                                                      may or may not try to eventually evict the pod from its node.
+                                                    properties:
+                                                      nodeSelectorTerms:
+                                                        description: Required. A list of node selector terms. The terms are ORed.
+                                                        items:
+                                                          description: |-
+                                                            A null or empty node selector term matches no objects. The requirements of
+                                                            them are ANDed.
+                                                            The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: A list of node selector requirements by node's labels.
+                                                              items:
+                                                                description: |-
+                                                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                                                  that relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: The label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      Represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      An array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                                                      array must have a single element, which will be interpreted as an integer.
+                                                                      This array is replaced during a strategic merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchFields:
+                                                              description: A list of node selector requirements by node's fields.
+                                                              items:
+                                                                description: |-
+                                                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                                                  that relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: The label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      Represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      An array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                                                      array must have a single element, which will be interpreted as an integer.
+                                                                      This array is replaced during a strategic merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                    required:
+                                                      - nodeSelectorTerms
+                                                    type: object
+                                                    x-kubernetes-map-type: atomic
+                                                type: object
+                                              podAffinity:
+                                                description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
+                                                properties:
+                                                  preferredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      The scheduler will prefer to schedule pods to nodes that satisfy
+                                                      the affinity expressions specified by this field, but it may choose
+                                                      a node that violates one or more of the expressions. The node that is
+                                                      most preferred is the one with the greatest sum of weights, i.e.
+                                                      for each node that meets all of the scheduling requirements (resource
+                                                      request, requiredDuringScheduling affinity expressions, etc.),
+                                                      compute a sum by iterating through the elements of this field and adding
+                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                                      node(s) with the highest sum are the most preferred.
+                                                    items:
+                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+                                                      properties:
+                                                        podAffinityTerm:
+                                                          description: Required. A pod affinity term, associated with the corresponding weight.
+                                                          properties:
+                                                            labelSelector:
+                                                              description: |-
+                                                                A label query over a set of resources, in this case pods.
+                                                                If it's null, this PodAffinityTerm matches with no Pods.
+                                                              properties:
+                                                                matchExpressions:
+                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                  items:
+                                                                    description: |-
+                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                      relates the key and values.
+                                                                    properties:
+                                                                      key:
+                                                                        description: key is the label key that the selector applies to.
+                                                                        type: string
+                                                                      operator:
+                                                                        description: |-
+                                                                          operator represents a key's relationship to a set of values.
+                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                        type: string
+                                                                      values:
+                                                                        description: |-
+                                                                          values is an array of string values. If the operator is In or NotIn,
+                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                          the values array must be empty. This array is replaced during a strategic
+                                                                          merge patch.
+                                                                        items:
+                                                                          type: string
+                                                                        type: array
+                                                                        x-kubernetes-list-type: atomic
+                                                                    required:
+                                                                      - key
+                                                                      - operator
+                                                                    type: object
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                                matchLabels:
+                                                                  additionalProperties:
+                                                                    type: string
+                                                                  description: |-
+                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                  type: object
+                                                              type: object
+                                                              x-kubernetes-map-type: atomic
+                                                            matchLabelKeys:
+                                                              description: |-
+                                                                MatchLabelKeys is a set of pod label keys to select which pods will
+                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                pod labels will be ignored. The default value is empty.
+                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            mismatchLabelKeys:
+                                                              description: |-
+                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                pod labels will be ignored. The default value is empty.
+                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            namespaceSelector:
+                                                              description: |-
+                                                                A label query over the set of namespaces that the term applies to.
+                                                                The term is applied to the union of the namespaces selected by this field
+                                                                and the ones listed in the namespaces field.
+                                                                null selector and null or empty namespaces list means "this pod's namespace".
+                                                                An empty selector ({}) matches all namespaces.
+                                                              properties:
+                                                                matchExpressions:
+                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                  items:
+                                                                    description: |-
+                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                      relates the key and values.
+                                                                    properties:
+                                                                      key:
+                                                                        description: key is the label key that the selector applies to.
+                                                                        type: string
+                                                                      operator:
+                                                                        description: |-
+                                                                          operator represents a key's relationship to a set of values.
+                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                        type: string
+                                                                      values:
+                                                                        description: |-
+                                                                          values is an array of string values. If the operator is In or NotIn,
+                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                          the values array must be empty. This array is replaced during a strategic
+                                                                          merge patch.
+                                                                        items:
+                                                                          type: string
+                                                                        type: array
+                                                                        x-kubernetes-list-type: atomic
+                                                                    required:
+                                                                      - key
+                                                                      - operator
+                                                                    type: object
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                                matchLabels:
+                                                                  additionalProperties:
+                                                                    type: string
+                                                                  description: |-
+                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                  type: object
+                                                              type: object
+                                                              x-kubernetes-map-type: atomic
+                                                            namespaces:
+                                                              description: |-
+                                                                namespaces specifies a static list of namespace names that the term applies to.
+                                                                The term is applied to the union of the namespaces listed in this field
+                                                                and the ones selected by namespaceSelector.
+                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            topologyKey:
+                                                              description: |-
+                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                                whose value of the label with key topologyKey matches that of any node on which any of the
+                                                                selected pods is running.
+                                                                Empty topologyKey is not allowed.
+                                                              type: string
+                                                          required:
+                                                            - topologyKey
+                                                          type: object
+                                                        weight:
+                                                          description: |-
+                                                            weight associated with matching the corresponding podAffinityTerm,
+                                                            in the range 1-100.
+                                                          format: int32
+                                                          type: integer
+                                                      required:
+                                                        - podAffinityTerm
+                                                        - weight
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  requiredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      If the affinity requirements specified by this field are not met at
+                                                      scheduling time, the pod will not be scheduled onto the node.
+                                                      If the affinity requirements specified by this field cease to be met
+                                                      at some point during pod execution (e.g. due to a pod label update), the
+                                                      system may or may not try to eventually evict the pod from its node.
+                                                      When there are multiple elements, the lists of nodes corresponding to each
+                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                                    items:
+                                                      description: |-
+                                                        Defines a set of pods (namely those matching the labelSelector
+                                                        relative to the given namespace(s)) that this pod should be
+                                                        co-located (affinity) or not co-located (anti-affinity) with,
+                                                        where co-located is defined as running on a node whose value of
+                                                        the label with key <topologyKey> matches that of any node on which
+                                                        a pod of the set of pods is running
+                                                      properties:
+                                                        labelSelector:
+                                                          description: |-
+                                                            A label query over a set of resources, in this case pods.
+                                                            If it's null, this PodAffinityTerm matches with no Pods.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                              items:
+                                                                description: |-
+                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                  relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: key is the label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      operator represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      values is an array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. This array is replaced during a strategic
+                                                                      merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchLabels:
+                                                              additionalProperties:
+                                                                type: string
+                                                              description: |-
+                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                              type: object
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        matchLabelKeys:
+                                                          description: |-
+                                                            MatchLabelKeys is a set of pod label keys to select which pods will
+                                                            be taken into consideration. The keys are used to lookup values from the
+                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                            to select the group of existing pods which pods will be taken into consideration
+                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                            pod labels will be ignored. The default value is empty.
+                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        mismatchLabelKeys:
+                                                          description: |-
+                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                            be taken into consideration. The keys are used to lookup values from the
+                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                            to select the group of existing pods which pods will be taken into consideration
+                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                            pod labels will be ignored. The default value is empty.
+                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        namespaceSelector:
+                                                          description: |-
+                                                            A label query over the set of namespaces that the term applies to.
+                                                            The term is applied to the union of the namespaces selected by this field
+                                                            and the ones listed in the namespaces field.
+                                                            null selector and null or empty namespaces list means "this pod's namespace".
+                                                            An empty selector ({}) matches all namespaces.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                              items:
+                                                                description: |-
+                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                  relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: key is the label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      operator represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      values is an array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. This array is replaced during a strategic
+                                                                      merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchLabels:
+                                                              additionalProperties:
+                                                                type: string
+                                                              description: |-
+                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                              type: object
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        namespaces:
+                                                          description: |-
+                                                            namespaces specifies a static list of namespace names that the term applies to.
+                                                            The term is applied to the union of the namespaces listed in this field
+                                                            and the ones selected by namespaceSelector.
+                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        topologyKey:
+                                                          description: |-
+                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                            whose value of the label with key topologyKey matches that of any node on which any of the
+                                                            selected pods is running.
+                                                            Empty topologyKey is not allowed.
+                                                          type: string
+                                                      required:
+                                                        - topologyKey
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                type: object
+                                              podAntiAffinity:
+                                                description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
+                                                properties:
+                                                  preferredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      The scheduler will prefer to schedule pods to nodes that satisfy
+                                                      the anti-affinity expressions specified by this field, but it may choose
+                                                      a node that violates one or more of the expressions. The node that is
+                                                      most preferred is the one with the greatest sum of weights, i.e.
+                                                      for each node that meets all of the scheduling requirements (resource
+                                                      request, requiredDuringScheduling anti-affinity expressions, etc.),
+                                                      compute a sum by iterating through the elements of this field and subtracting
+                                                      "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                                      node(s) with the highest sum are the most preferred.
+                                                    items:
+                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+                                                      properties:
+                                                        podAffinityTerm:
+                                                          description: Required. A pod affinity term, associated with the corresponding weight.
+                                                          properties:
+                                                            labelSelector:
+                                                              description: |-
+                                                                A label query over a set of resources, in this case pods.
+                                                                If it's null, this PodAffinityTerm matches with no Pods.
+                                                              properties:
+                                                                matchExpressions:
+                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                  items:
+                                                                    description: |-
+                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                      relates the key and values.
+                                                                    properties:
+                                                                      key:
+                                                                        description: key is the label key that the selector applies to.
+                                                                        type: string
+                                                                      operator:
+                                                                        description: |-
+                                                                          operator represents a key's relationship to a set of values.
+                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                        type: string
+                                                                      values:
+                                                                        description: |-
+                                                                          values is an array of string values. If the operator is In or NotIn,
+                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                          the values array must be empty. This array is replaced during a strategic
+                                                                          merge patch.
+                                                                        items:
+                                                                          type: string
+                                                                        type: array
+                                                                        x-kubernetes-list-type: atomic
+                                                                    required:
+                                                                      - key
+                                                                      - operator
+                                                                    type: object
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                                matchLabels:
+                                                                  additionalProperties:
+                                                                    type: string
+                                                                  description: |-
+                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                  type: object
+                                                              type: object
+                                                              x-kubernetes-map-type: atomic
+                                                            matchLabelKeys:
+                                                              description: |-
+                                                                MatchLabelKeys is a set of pod label keys to select which pods will
+                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                pod labels will be ignored. The default value is empty.
+                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            mismatchLabelKeys:
+                                                              description: |-
+                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                pod labels will be ignored. The default value is empty.
+                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            namespaceSelector:
+                                                              description: |-
+                                                                A label query over the set of namespaces that the term applies to.
+                                                                The term is applied to the union of the namespaces selected by this field
+                                                                and the ones listed in the namespaces field.
+                                                                null selector and null or empty namespaces list means "this pod's namespace".
+                                                                An empty selector ({}) matches all namespaces.
+                                                              properties:
+                                                                matchExpressions:
+                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                  items:
+                                                                    description: |-
+                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                      relates the key and values.
+                                                                    properties:
+                                                                      key:
+                                                                        description: key is the label key that the selector applies to.
+                                                                        type: string
+                                                                      operator:
+                                                                        description: |-
+                                                                          operator represents a key's relationship to a set of values.
+                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                        type: string
+                                                                      values:
+                                                                        description: |-
+                                                                          values is an array of string values. If the operator is In or NotIn,
+                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                          the values array must be empty. This array is replaced during a strategic
+                                                                          merge patch.
+                                                                        items:
+                                                                          type: string
+                                                                        type: array
+                                                                        x-kubernetes-list-type: atomic
+                                                                    required:
+                                                                      - key
+                                                                      - operator
+                                                                    type: object
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                                matchLabels:
+                                                                  additionalProperties:
+                                                                    type: string
+                                                                  description: |-
+                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                  type: object
+                                                              type: object
+                                                              x-kubernetes-map-type: atomic
+                                                            namespaces:
+                                                              description: |-
+                                                                namespaces specifies a static list of namespace names that the term applies to.
+                                                                The term is applied to the union of the namespaces listed in this field
+                                                                and the ones selected by namespaceSelector.
+                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            topologyKey:
+                                                              description: |-
+                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                                whose value of the label with key topologyKey matches that of any node on which any of the
+                                                                selected pods is running.
+                                                                Empty topologyKey is not allowed.
+                                                              type: string
+                                                          required:
+                                                            - topologyKey
+                                                          type: object
+                                                        weight:
+                                                          description: |-
+                                                            weight associated with matching the corresponding podAffinityTerm,
+                                                            in the range 1-100.
+                                                          format: int32
+                                                          type: integer
+                                                      required:
+                                                        - podAffinityTerm
+                                                        - weight
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  requiredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      If the anti-affinity requirements specified by this field are not met at
+                                                      scheduling time, the pod will not be scheduled onto the node.
+                                                      If the anti-affinity requirements specified by this field cease to be met
+                                                      at some point during pod execution (e.g. due to a pod label update), the
+                                                      system may or may not try to eventually evict the pod from its node.
+                                                      When there are multiple elements, the lists of nodes corresponding to each
+                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                                    items:
+                                                      description: |-
+                                                        Defines a set of pods (namely those matching the labelSelector
+                                                        relative to the given namespace(s)) that this pod should be
+                                                        co-located (affinity) or not co-located (anti-affinity) with,
+                                                        where co-located is defined as running on a node whose value of
+                                                        the label with key <topologyKey> matches that of any node on which
+                                                        a pod of the set of pods is running
+                                                      properties:
+                                                        labelSelector:
+                                                          description: |-
+                                                            A label query over a set of resources, in this case pods.
+                                                            If it's null, this PodAffinityTerm matches with no Pods.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                              items:
+                                                                description: |-
+                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                  relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: key is the label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      operator represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      values is an array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. This array is replaced during a strategic
+                                                                      merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchLabels:
+                                                              additionalProperties:
+                                                                type: string
+                                                              description: |-
+                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                              type: object
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        matchLabelKeys:
+                                                          description: |-
+                                                            MatchLabelKeys is a set of pod label keys to select which pods will
+                                                            be taken into consideration. The keys are used to lookup values from the
+                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                            to select the group of existing pods which pods will be taken into consideration
+                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                            pod labels will be ignored. The default value is empty.
+                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        mismatchLabelKeys:
+                                                          description: |-
+                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                            be taken into consideration. The keys are used to lookup values from the
+                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                            to select the group of existing pods which pods will be taken into consideration
+                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                            pod labels will be ignored. The default value is empty.
+                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        namespaceSelector:
+                                                          description: |-
+                                                            A label query over the set of namespaces that the term applies to.
+                                                            The term is applied to the union of the namespaces selected by this field
+                                                            and the ones listed in the namespaces field.
+                                                            null selector and null or empty namespaces list means "this pod's namespace".
+                                                            An empty selector ({}) matches all namespaces.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                              items:
+                                                                description: |-
+                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                  relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: key is the label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      operator represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      values is an array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. This array is replaced during a strategic
+                                                                      merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchLabels:
+                                                              additionalProperties:
+                                                                type: string
+                                                              description: |-
+                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                              type: object
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        namespaces:
+                                                          description: |-
+                                                            namespaces specifies a static list of namespace names that the term applies to.
+                                                            The term is applied to the union of the namespaces listed in this field
+                                                            and the ones selected by namespaceSelector.
+                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        topologyKey:
+                                                          description: |-
+                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                            whose value of the label with key topologyKey matches that of any node on which any of the
+                                                            selected pods is running.
+                                                            Empty topologyKey is not allowed.
+                                                          type: string
+                                                      required:
+                                                        - topologyKey
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                type: object
+                                            type: object
+                                          imagePullSecrets:
+                                            description: If specified, the pod's imagePullSecrets
+                                            items:
+                                              description: |-
+                                                LocalObjectReference contains enough information to let you locate the
+                                                referenced object inside the same namespace.
+                                              properties:
+                                                name:
+                                                  default: ""
+                                                  description: |-
+                                                    Name of the referent.
+                                                    This field is effectively required, but due to backwards compatibility is
+                                                    allowed to be empty. Instances of this type with an empty value here are
+                                                    almost certainly wrong.
+                                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                                  type: string
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            type: array
+                                            x-kubernetes-list-map-keys:
+                                              - name
+                                            x-kubernetes-list-type: map
+                                          nodeSelector:
+                                            additionalProperties:
+                                              type: string
+                                            description: |-
+                                              NodeSelector is a selector which must be true for the pod to fit on a node.
+                                              Selector which must match a node's labels for the pod to be scheduled on that node.
+                                              More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+                                            type: object
+                                          priorityClassName:
+                                            description: If specified, the pod's priorityClassName.
+                                            type: string
+                                          resources:
+                                            description: |-
+                                              If specified, the pod's resource requirements.
+                                              These values override the global resource configuration flags.
+                                              Note that when only specifying resource limits, ensure they are greater than or equal
+                                              to the corresponding global resource requests configured via controller flags
+                                              (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
+                                              Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
+                                            properties:
+                                              limits:
+                                                additionalProperties:
+                                                  anyOf:
+                                                    - type: integer
+                                                    - type: string
+                                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                  x-kubernetes-int-or-string: true
+                                                description: |-
+                                                  Limits describes the maximum amount of compute resources allowed.
+                                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                                type: object
+                                              requests:
+                                                additionalProperties:
+                                                  anyOf:
+                                                    - type: integer
+                                                    - type: string
+                                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                  x-kubernetes-int-or-string: true
+                                                description: |-
+                                                  Requests describes the minimum amount of compute resources required.
+                                                  If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                                  otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
+                                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                                type: object
+                                            type: object
+                                          securityContext:
+                                            description: If specified, the pod's security context
+                                            properties:
+                                              fsGroup:
+                                                description: |-
+                                                  A special supplemental group that applies to all containers in a pod.
+                                                  Some volume types allow the Kubelet to change the ownership of that volume
+                                                  to be owned by the pod:
+
+                                                  1. The owning GID will be the FSGroup
+                                                  2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
+                                                  3. The permission bits are OR'd with rw-rw----
+
+                                                  If unset, the Kubelet will not modify the ownership and permissions of any volume.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                format: int64
+                                                type: integer
+                                              fsGroupChangePolicy:
+                                                description: |-
+                                                  fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
+                                                  before being exposed inside Pod. This field will only apply to
+                                                  volume types which support fsGroup based ownership(and permissions).
+                                                  It will have no effect on ephemeral volume types such as: secret, configmaps
+                                                  and emptydir.
+                                                  Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                type: string
+                                              runAsGroup:
+                                                description: |-
+                                                  The GID to run the entrypoint of the container process.
+                                                  Uses runtime default if unset.
+                                                  May also be set in SecurityContext.  If set in both SecurityContext and
+                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
+                                                  for that container.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                format: int64
+                                                type: integer
+                                              runAsNonRoot:
+                                                description: |-
+                                                  Indicates that the container must run as a non-root user.
+                                                  If true, the Kubelet will validate the image at runtime to ensure that it
+                                                  does not run as UID 0 (root) and fail to start the container if it does.
+                                                  If unset or false, no such validation will be performed.
+                                                  May also be set in SecurityContext.  If set in both SecurityContext and
+                                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                                type: boolean
+                                              runAsUser:
+                                                description: |-
+                                                  The UID to run the entrypoint of the container process.
+                                                  Defaults to user specified in image metadata if unspecified.
+                                                  May also be set in SecurityContext.  If set in both SecurityContext and
+                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
+                                                  for that container.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                format: int64
+                                                type: integer
+                                              seLinuxOptions:
+                                                description: |-
+                                                  The SELinux context to be applied to all containers.
+                                                  If unspecified, the container runtime will allocate a random SELinux context for each
+                                                  container.  May also be set in SecurityContext.  If set in
+                                                  both SecurityContext and PodSecurityContext, the value specified in SecurityContext
+                                                  takes precedence for that container.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                properties:
+                                                  level:
+                                                    description: Level is SELinux level label that applies to the container.
+                                                    type: string
+                                                  role:
+                                                    description: Role is a SELinux role label that applies to the container.
+                                                    type: string
+                                                  type:
+                                                    description: Type is a SELinux type label that applies to the container.
+                                                    type: string
+                                                  user:
+                                                    description: User is a SELinux user label that applies to the container.
+                                                    type: string
+                                                type: object
+                                              seccompProfile:
+                                                description: |-
+                                                  The seccomp options to use by the containers in this pod.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                properties:
+                                                  localhostProfile:
+                                                    description: |-
+                                                      localhostProfile indicates a profile defined in a file on the node should be used.
+                                                      The profile must be preconfigured on the node to work.
+                                                      Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                                                      Must be set if type is "Localhost". Must NOT be set for any other type.
+                                                    type: string
+                                                  type:
+                                                    description: |-
+                                                      type indicates which kind of seccomp profile will be applied.
+                                                      Valid options are:
+
+                                                      Localhost - a profile defined in a file on the node should be used.
+                                                      RuntimeDefault - the container runtime default profile should be used.
+                                                      Unconfined - no profile should be applied.
+                                                    type: string
+                                                required:
+                                                  - type
+                                                type: object
+                                              supplementalGroups:
+                                                description: |-
+                                                  A list of groups applied to the first process run in each container, in addition
+                                                  to the container's primary GID, the fsGroup (if specified), and group memberships
+                                                  defined in the container image for the uid of the container process. If unspecified,
+                                                  no additional groups are added to any container. Note that group memberships
+                                                  defined in the container image for the uid of the container process are still effective,
+                                                  even if they are not included in this list.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                items:
+                                                  format: int64
+                                                  type: integer
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              sysctls:
+                                                description: |-
+                                                  Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
+                                                  sysctls (by the container runtime) might fail to launch.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                items:
+                                                  description: Sysctl defines a kernel parameter to be set
+                                                  properties:
+                                                    name:
+                                                      description: Name of a property to set
+                                                      type: string
+                                                    value:
+                                                      description: Value of a property to set
+                                                      type: string
+                                                  required:
+                                                    - name
+                                                    - value
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            type: object
+                                          serviceAccountName:
+                                            description: If specified, the pod's service account
+                                            type: string
+                                          tolerations:
+                                            description: If specified, the pod's tolerations.
+                                            items:
+                                              description: |-
+                                                The pod this Toleration is attached to tolerates any taint that matches
+                                                the triple <key,value,effect> using the matching operator <operator>.
+                                              properties:
+                                                effect:
+                                                  description: |-
+                                                    Effect indicates the taint effect to match. Empty means match all taint effects.
+                                                    When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+                                                  type: string
+                                                key:
+                                                  description: |-
+                                                    Key is the taint key that the toleration applies to. Empty means match all taint keys.
+                                                    If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+                                                  type: string
+                                                operator:
+                                                  description: |-
+                                                    Operator represents a key's relationship to the value.
+                                                    Valid operators are Exists and Equal. Defaults to Equal.
+                                                    Exists is equivalent to wildcard for value, so that a pod can
+                                                    tolerate all taints of a particular category.
+                                                  type: string
+                                                tolerationSeconds:
+                                                  description: |-
+                                                    TolerationSeconds represents the period of time the toleration (which must be
+                                                    of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+                                                    it is not set, which means tolerate the taint forever (do not evict). Zero and
+                                                    negative values will be treated as 0 (evict immediately) by the system.
+                                                  format: int64
+                                                  type: integer
+                                                value:
+                                                  description: |-
+                                                    Value is the taint value the toleration matches to.
+                                                    If the operator is Exists, the value should be empty, otherwise just a regular string.
+                                                  type: string
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        type: object
+                                    type: object
+                                  serviceType:
+                                    description: |-
+                                      Optional service type for Kubernetes solver service. Supported values
+                                      are NodePort or ClusterIP. If unset, defaults to NodePort.
+                                    type: string
+                                type: object
+                              ingress:
+                                description: |-
+                                  The ingress based HTTP01 challenge solver will solve challenges by
+                                  creating or modifying Ingress resources in order to route requests for
+                                  '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
+                                  provisioned by cert-manager for each Challenge to be completed.
+                                properties:
+                                  class:
+                                    description: |-
+                                      This field configures the annotation `kubernetes.io/ingress.class` when
+                                      creating Ingress resources to solve ACME challenges that use this
+                                      challenge solver. Only one of `class`, `name` or `ingressClassName` may
+                                      be specified.
+                                    type: string
+                                  ingressClassName:
+                                    description: |-
+                                      This field configures the field `ingressClassName` on the created Ingress
+                                      resources used to solve ACME challenges that use this challenge solver.
+                                      This is the recommended way of configuring the ingress class. Only one of
+                                      `class`, `name` or `ingressClassName` may be specified.
+                                    type: string
+                                  ingressTemplate:
+                                    description: |-
+                                      Optional ingress template used to configure the ACME challenge solver
+                                      ingress used for HTTP01 challenges.
+                                    properties:
+                                      metadata:
+                                        description: |-
+                                          ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
+                                          Only the 'labels' and 'annotations' fields may be set.
+                                          If labels or annotations overlap with in-built values, the values here
+                                          will override the in-built values.
+                                        properties:
+                                          annotations:
+                                            additionalProperties:
+                                              type: string
+                                            description: Annotations that should be added to the created ACME HTTP01 solver ingress.
+                                            type: object
+                                          labels:
+                                            additionalProperties:
+                                              type: string
+                                            description: Labels that should be added to the created ACME HTTP01 solver ingress.
+                                            type: object
+                                        type: object
+                                    type: object
+                                  name:
+                                    description: |-
+                                      The name of the ingress resource that should have ACME challenge solving
+                                      routes inserted into it in order to solve HTTP01 challenges.
+                                      This is typically used in conjunction with ingress controllers like
+                                      ingress-gce, which maintains a 1:1 mapping between external IPs and
+                                      ingress resources. Only one of `class`, `name` or `ingressClassName` may
+                                      be specified.
+                                    type: string
+                                  podTemplate:
+                                    description: |-
+                                      Optional pod template used to configure the ACME challenge solver pods
+                                      used for HTTP01 challenges.
+                                    properties:
+                                      metadata:
+                                        description: |-
+                                          ObjectMeta overrides for the pod used to solve HTTP01 challenges.
+                                          Only the 'labels' and 'annotations' fields may be set.
+                                          If labels or annotations overlap with in-built values, the values here
+                                          will override the in-built values.
+                                        properties:
+                                          annotations:
+                                            additionalProperties:
+                                              type: string
+                                            description: Annotations that should be added to the created ACME HTTP01 solver pods.
+                                            type: object
+                                          labels:
+                                            additionalProperties:
+                                              type: string
+                                            description: Labels that should be added to the created ACME HTTP01 solver pods.
+                                            type: object
+                                        type: object
+                                      spec:
+                                        description: |-
+                                          PodSpec defines overrides for the HTTP01 challenge solver pod.
+                                          Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
+                                          All other fields will be ignored.
+                                        properties:
+                                          affinity:
+                                            description: If specified, the pod's scheduling constraints
+                                            properties:
+                                              nodeAffinity:
+                                                description: Describes node affinity scheduling rules for the pod.
+                                                properties:
+                                                  preferredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      The scheduler will prefer to schedule pods to nodes that satisfy
+                                                      the affinity expressions specified by this field, but it may choose
+                                                      a node that violates one or more of the expressions. The node that is
+                                                      most preferred is the one with the greatest sum of weights, i.e.
+                                                      for each node that meets all of the scheduling requirements (resource
+                                                      request, requiredDuringScheduling affinity expressions, etc.),
+                                                      compute a sum by iterating through the elements of this field and adding
+                                                      "weight" to the sum if the node matches the corresponding matchExpressions; the
+                                                      node(s) with the highest sum are the most preferred.
+                                                    items:
+                                                      description: |-
+                                                        An empty preferred scheduling term matches all objects with implicit weight 0
+                                                        (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+                                                      properties:
+                                                        preference:
+                                                          description: A node selector term, associated with the corresponding weight.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: A list of node selector requirements by node's labels.
+                                                              items:
+                                                                description: |-
+                                                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                                                  that relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: The label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      Represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      An array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                                                      array must have a single element, which will be interpreted as an integer.
+                                                                      This array is replaced during a strategic merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchFields:
+                                                              description: A list of node selector requirements by node's fields.
+                                                              items:
+                                                                description: |-
+                                                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                                                  that relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: The label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      Represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      An array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                                                      array must have a single element, which will be interpreted as an integer.
+                                                                      This array is replaced during a strategic merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        weight:
+                                                          description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
+                                                          format: int32
+                                                          type: integer
+                                                      required:
+                                                        - preference
+                                                        - weight
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  requiredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      If the affinity requirements specified by this field are not met at
+                                                      scheduling time, the pod will not be scheduled onto the node.
+                                                      If the affinity requirements specified by this field cease to be met
+                                                      at some point during pod execution (e.g. due to an update), the system
+                                                      may or may not try to eventually evict the pod from its node.
+                                                    properties:
+                                                      nodeSelectorTerms:
+                                                        description: Required. A list of node selector terms. The terms are ORed.
+                                                        items:
+                                                          description: |-
+                                                            A null or empty node selector term matches no objects. The requirements of
+                                                            them are ANDed.
+                                                            The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: A list of node selector requirements by node's labels.
+                                                              items:
+                                                                description: |-
+                                                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                                                  that relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: The label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      Represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      An array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                                                      array must have a single element, which will be interpreted as an integer.
+                                                                      This array is replaced during a strategic merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchFields:
+                                                              description: A list of node selector requirements by node's fields.
+                                                              items:
+                                                                description: |-
+                                                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                                                  that relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: The label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      Represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      An array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                                                      array must have a single element, which will be interpreted as an integer.
+                                                                      This array is replaced during a strategic merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                    required:
+                                                      - nodeSelectorTerms
+                                                    type: object
+                                                    x-kubernetes-map-type: atomic
+                                                type: object
+                                              podAffinity:
+                                                description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
+                                                properties:
+                                                  preferredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      The scheduler will prefer to schedule pods to nodes that satisfy
+                                                      the affinity expressions specified by this field, but it may choose
+                                                      a node that violates one or more of the expressions. The node that is
+                                                      most preferred is the one with the greatest sum of weights, i.e.
+                                                      for each node that meets all of the scheduling requirements (resource
+                                                      request, requiredDuringScheduling affinity expressions, etc.),
+                                                      compute a sum by iterating through the elements of this field and adding
+                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                                      node(s) with the highest sum are the most preferred.
+                                                    items:
+                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+                                                      properties:
+                                                        podAffinityTerm:
+                                                          description: Required. A pod affinity term, associated with the corresponding weight.
+                                                          properties:
+                                                            labelSelector:
+                                                              description: |-
+                                                                A label query over a set of resources, in this case pods.
+                                                                If it's null, this PodAffinityTerm matches with no Pods.
+                                                              properties:
+                                                                matchExpressions:
+                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                  items:
+                                                                    description: |-
+                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                      relates the key and values.
+                                                                    properties:
+                                                                      key:
+                                                                        description: key is the label key that the selector applies to.
+                                                                        type: string
+                                                                      operator:
+                                                                        description: |-
+                                                                          operator represents a key's relationship to a set of values.
+                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                        type: string
+                                                                      values:
+                                                                        description: |-
+                                                                          values is an array of string values. If the operator is In or NotIn,
+                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                          the values array must be empty. This array is replaced during a strategic
+                                                                          merge patch.
+                                                                        items:
+                                                                          type: string
+                                                                        type: array
+                                                                        x-kubernetes-list-type: atomic
+                                                                    required:
+                                                                      - key
+                                                                      - operator
+                                                                    type: object
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                                matchLabels:
+                                                                  additionalProperties:
+                                                                    type: string
+                                                                  description: |-
+                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                  type: object
+                                                              type: object
+                                                              x-kubernetes-map-type: atomic
+                                                            matchLabelKeys:
+                                                              description: |-
+                                                                MatchLabelKeys is a set of pod label keys to select which pods will
+                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                pod labels will be ignored. The default value is empty.
+                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            mismatchLabelKeys:
+                                                              description: |-
+                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                pod labels will be ignored. The default value is empty.
+                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            namespaceSelector:
+                                                              description: |-
+                                                                A label query over the set of namespaces that the term applies to.
+                                                                The term is applied to the union of the namespaces selected by this field
+                                                                and the ones listed in the namespaces field.
+                                                                null selector and null or empty namespaces list means "this pod's namespace".
+                                                                An empty selector ({}) matches all namespaces.
+                                                              properties:
+                                                                matchExpressions:
+                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                  items:
+                                                                    description: |-
+                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                      relates the key and values.
+                                                                    properties:
+                                                                      key:
+                                                                        description: key is the label key that the selector applies to.
+                                                                        type: string
+                                                                      operator:
+                                                                        description: |-
+                                                                          operator represents a key's relationship to a set of values.
+                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                        type: string
+                                                                      values:
+                                                                        description: |-
+                                                                          values is an array of string values. If the operator is In or NotIn,
+                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                          the values array must be empty. This array is replaced during a strategic
+                                                                          merge patch.
+                                                                        items:
+                                                                          type: string
+                                                                        type: array
+                                                                        x-kubernetes-list-type: atomic
+                                                                    required:
+                                                                      - key
+                                                                      - operator
+                                                                    type: object
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                                matchLabels:
+                                                                  additionalProperties:
+                                                                    type: string
+                                                                  description: |-
+                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                  type: object
+                                                              type: object
+                                                              x-kubernetes-map-type: atomic
+                                                            namespaces:
+                                                              description: |-
+                                                                namespaces specifies a static list of namespace names that the term applies to.
+                                                                The term is applied to the union of the namespaces listed in this field
+                                                                and the ones selected by namespaceSelector.
+                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            topologyKey:
+                                                              description: |-
+                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                                whose value of the label with key topologyKey matches that of any node on which any of the
+                                                                selected pods is running.
+                                                                Empty topologyKey is not allowed.
+                                                              type: string
+                                                          required:
+                                                            - topologyKey
+                                                          type: object
+                                                        weight:
+                                                          description: |-
+                                                            weight associated with matching the corresponding podAffinityTerm,
+                                                            in the range 1-100.
+                                                          format: int32
+                                                          type: integer
+                                                      required:
+                                                        - podAffinityTerm
+                                                        - weight
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  requiredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      If the affinity requirements specified by this field are not met at
+                                                      scheduling time, the pod will not be scheduled onto the node.
+                                                      If the affinity requirements specified by this field cease to be met
+                                                      at some point during pod execution (e.g. due to a pod label update), the
+                                                      system may or may not try to eventually evict the pod from its node.
+                                                      When there are multiple elements, the lists of nodes corresponding to each
+                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                                    items:
+                                                      description: |-
+                                                        Defines a set of pods (namely those matching the labelSelector
+                                                        relative to the given namespace(s)) that this pod should be
+                                                        co-located (affinity) or not co-located (anti-affinity) with,
+                                                        where co-located is defined as running on a node whose value of
+                                                        the label with key <topologyKey> matches that of any node on which
+                                                        a pod of the set of pods is running
+                                                      properties:
+                                                        labelSelector:
+                                                          description: |-
+                                                            A label query over a set of resources, in this case pods.
+                                                            If it's null, this PodAffinityTerm matches with no Pods.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                              items:
+                                                                description: |-
+                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                  relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: key is the label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      operator represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      values is an array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. This array is replaced during a strategic
+                                                                      merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchLabels:
+                                                              additionalProperties:
+                                                                type: string
+                                                              description: |-
+                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                              type: object
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        matchLabelKeys:
+                                                          description: |-
+                                                            MatchLabelKeys is a set of pod label keys to select which pods will
+                                                            be taken into consideration. The keys are used to lookup values from the
+                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                            to select the group of existing pods which pods will be taken into consideration
+                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                            pod labels will be ignored. The default value is empty.
+                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        mismatchLabelKeys:
+                                                          description: |-
+                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                            be taken into consideration. The keys are used to lookup values from the
+                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                            to select the group of existing pods which pods will be taken into consideration
+                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                            pod labels will be ignored. The default value is empty.
+                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        namespaceSelector:
+                                                          description: |-
+                                                            A label query over the set of namespaces that the term applies to.
+                                                            The term is applied to the union of the namespaces selected by this field
+                                                            and the ones listed in the namespaces field.
+                                                            null selector and null or empty namespaces list means "this pod's namespace".
+                                                            An empty selector ({}) matches all namespaces.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                              items:
+                                                                description: |-
+                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                  relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: key is the label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      operator represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      values is an array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. This array is replaced during a strategic
+                                                                      merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchLabels:
+                                                              additionalProperties:
+                                                                type: string
+                                                              description: |-
+                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                              type: object
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        namespaces:
+                                                          description: |-
+                                                            namespaces specifies a static list of namespace names that the term applies to.
+                                                            The term is applied to the union of the namespaces listed in this field
+                                                            and the ones selected by namespaceSelector.
+                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        topologyKey:
+                                                          description: |-
+                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                            whose value of the label with key topologyKey matches that of any node on which any of the
+                                                            selected pods is running.
+                                                            Empty topologyKey is not allowed.
+                                                          type: string
+                                                      required:
+                                                        - topologyKey
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                type: object
+                                              podAntiAffinity:
+                                                description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
+                                                properties:
+                                                  preferredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      The scheduler will prefer to schedule pods to nodes that satisfy
+                                                      the anti-affinity expressions specified by this field, but it may choose
+                                                      a node that violates one or more of the expressions. The node that is
+                                                      most preferred is the one with the greatest sum of weights, i.e.
+                                                      for each node that meets all of the scheduling requirements (resource
+                                                      request, requiredDuringScheduling anti-affinity expressions, etc.),
+                                                      compute a sum by iterating through the elements of this field and subtracting
+                                                      "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                                      node(s) with the highest sum are the most preferred.
+                                                    items:
+                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+                                                      properties:
+                                                        podAffinityTerm:
+                                                          description: Required. A pod affinity term, associated with the corresponding weight.
+                                                          properties:
+                                                            labelSelector:
+                                                              description: |-
+                                                                A label query over a set of resources, in this case pods.
+                                                                If it's null, this PodAffinityTerm matches with no Pods.
+                                                              properties:
+                                                                matchExpressions:
+                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                  items:
+                                                                    description: |-
+                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                      relates the key and values.
+                                                                    properties:
+                                                                      key:
+                                                                        description: key is the label key that the selector applies to.
+                                                                        type: string
+                                                                      operator:
+                                                                        description: |-
+                                                                          operator represents a key's relationship to a set of values.
+                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                        type: string
+                                                                      values:
+                                                                        description: |-
+                                                                          values is an array of string values. If the operator is In or NotIn,
+                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                          the values array must be empty. This array is replaced during a strategic
+                                                                          merge patch.
+                                                                        items:
+                                                                          type: string
+                                                                        type: array
+                                                                        x-kubernetes-list-type: atomic
+                                                                    required:
+                                                                      - key
+                                                                      - operator
+                                                                    type: object
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                                matchLabels:
+                                                                  additionalProperties:
+                                                                    type: string
+                                                                  description: |-
+                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                  type: object
+                                                              type: object
+                                                              x-kubernetes-map-type: atomic
+                                                            matchLabelKeys:
+                                                              description: |-
+                                                                MatchLabelKeys is a set of pod label keys to select which pods will
+                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                pod labels will be ignored. The default value is empty.
+                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            mismatchLabelKeys:
+                                                              description: |-
+                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                pod labels will be ignored. The default value is empty.
+                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            namespaceSelector:
+                                                              description: |-
+                                                                A label query over the set of namespaces that the term applies to.
+                                                                The term is applied to the union of the namespaces selected by this field
+                                                                and the ones listed in the namespaces field.
+                                                                null selector and null or empty namespaces list means "this pod's namespace".
+                                                                An empty selector ({}) matches all namespaces.
+                                                              properties:
+                                                                matchExpressions:
+                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                  items:
+                                                                    description: |-
+                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                      relates the key and values.
+                                                                    properties:
+                                                                      key:
+                                                                        description: key is the label key that the selector applies to.
+                                                                        type: string
+                                                                      operator:
+                                                                        description: |-
+                                                                          operator represents a key's relationship to a set of values.
+                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                        type: string
+                                                                      values:
+                                                                        description: |-
+                                                                          values is an array of string values. If the operator is In or NotIn,
+                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                          the values array must be empty. This array is replaced during a strategic
+                                                                          merge patch.
+                                                                        items:
+                                                                          type: string
+                                                                        type: array
+                                                                        x-kubernetes-list-type: atomic
+                                                                    required:
+                                                                      - key
+                                                                      - operator
+                                                                    type: object
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                                matchLabels:
+                                                                  additionalProperties:
+                                                                    type: string
+                                                                  description: |-
+                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                  type: object
+                                                              type: object
+                                                              x-kubernetes-map-type: atomic
+                                                            namespaces:
+                                                              description: |-
+                                                                namespaces specifies a static list of namespace names that the term applies to.
+                                                                The term is applied to the union of the namespaces listed in this field
+                                                                and the ones selected by namespaceSelector.
+                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            topologyKey:
+                                                              description: |-
+                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                                whose value of the label with key topologyKey matches that of any node on which any of the
+                                                                selected pods is running.
+                                                                Empty topologyKey is not allowed.
+                                                              type: string
+                                                          required:
+                                                            - topologyKey
+                                                          type: object
+                                                        weight:
+                                                          description: |-
+                                                            weight associated with matching the corresponding podAffinityTerm,
+                                                            in the range 1-100.
+                                                          format: int32
+                                                          type: integer
+                                                      required:
+                                                        - podAffinityTerm
+                                                        - weight
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  requiredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      If the anti-affinity requirements specified by this field are not met at
+                                                      scheduling time, the pod will not be scheduled onto the node.
+                                                      If the anti-affinity requirements specified by this field cease to be met
+                                                      at some point during pod execution (e.g. due to a pod label update), the
+                                                      system may or may not try to eventually evict the pod from its node.
+                                                      When there are multiple elements, the lists of nodes corresponding to each
+                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                                    items:
+                                                      description: |-
+                                                        Defines a set of pods (namely those matching the labelSelector
+                                                        relative to the given namespace(s)) that this pod should be
+                                                        co-located (affinity) or not co-located (anti-affinity) with,
+                                                        where co-located is defined as running on a node whose value of
+                                                        the label with key <topologyKey> matches that of any node on which
+                                                        a pod of the set of pods is running
+                                                      properties:
+                                                        labelSelector:
+                                                          description: |-
+                                                            A label query over a set of resources, in this case pods.
+                                                            If it's null, this PodAffinityTerm matches with no Pods.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                              items:
+                                                                description: |-
+                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                  relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: key is the label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      operator represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      values is an array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. This array is replaced during a strategic
+                                                                      merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchLabels:
+                                                              additionalProperties:
+                                                                type: string
+                                                              description: |-
+                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                              type: object
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        matchLabelKeys:
+                                                          description: |-
+                                                            MatchLabelKeys is a set of pod label keys to select which pods will
+                                                            be taken into consideration. The keys are used to lookup values from the
+                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                            to select the group of existing pods which pods will be taken into consideration
+                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                            pod labels will be ignored. The default value is empty.
+                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        mismatchLabelKeys:
+                                                          description: |-
+                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                            be taken into consideration. The keys are used to lookup values from the
+                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                            to select the group of existing pods which pods will be taken into consideration
+                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                            pod labels will be ignored. The default value is empty.
+                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        namespaceSelector:
+                                                          description: |-
+                                                            A label query over the set of namespaces that the term applies to.
+                                                            The term is applied to the union of the namespaces selected by this field
+                                                            and the ones listed in the namespaces field.
+                                                            null selector and null or empty namespaces list means "this pod's namespace".
+                                                            An empty selector ({}) matches all namespaces.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                              items:
+                                                                description: |-
+                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                  relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: key is the label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      operator represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      values is an array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. This array is replaced during a strategic
+                                                                      merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchLabels:
+                                                              additionalProperties:
+                                                                type: string
+                                                              description: |-
+                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                              type: object
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        namespaces:
+                                                          description: |-
+                                                            namespaces specifies a static list of namespace names that the term applies to.
+                                                            The term is applied to the union of the namespaces listed in this field
+                                                            and the ones selected by namespaceSelector.
+                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        topologyKey:
+                                                          description: |-
+                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                            whose value of the label with key topologyKey matches that of any node on which any of the
+                                                            selected pods is running.
+                                                            Empty topologyKey is not allowed.
+                                                          type: string
+                                                      required:
+                                                        - topologyKey
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                type: object
+                                            type: object
+                                          imagePullSecrets:
+                                            description: If specified, the pod's imagePullSecrets
+                                            items:
+                                              description: |-
+                                                LocalObjectReference contains enough information to let you locate the
+                                                referenced object inside the same namespace.
+                                              properties:
+                                                name:
+                                                  default: ""
+                                                  description: |-
+                                                    Name of the referent.
+                                                    This field is effectively required, but due to backwards compatibility is
+                                                    allowed to be empty. Instances of this type with an empty value here are
+                                                    almost certainly wrong.
+                                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                                  type: string
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            type: array
+                                            x-kubernetes-list-map-keys:
+                                              - name
+                                            x-kubernetes-list-type: map
+                                          nodeSelector:
+                                            additionalProperties:
+                                              type: string
+                                            description: |-
+                                              NodeSelector is a selector which must be true for the pod to fit on a node.
+                                              Selector which must match a node's labels for the pod to be scheduled on that node.
+                                              More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+                                            type: object
+                                          priorityClassName:
+                                            description: If specified, the pod's priorityClassName.
+                                            type: string
+                                          resources:
+                                            description: |-
+                                              If specified, the pod's resource requirements.
+                                              These values override the global resource configuration flags.
+                                              Note that when only specifying resource limits, ensure they are greater than or equal
+                                              to the corresponding global resource requests configured via controller flags
+                                              (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
+                                              Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
+                                            properties:
+                                              limits:
+                                                additionalProperties:
+                                                  anyOf:
+                                                    - type: integer
+                                                    - type: string
+                                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                  x-kubernetes-int-or-string: true
+                                                description: |-
+                                                  Limits describes the maximum amount of compute resources allowed.
+                                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                                type: object
+                                              requests:
+                                                additionalProperties:
+                                                  anyOf:
+                                                    - type: integer
+                                                    - type: string
+                                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                  x-kubernetes-int-or-string: true
+                                                description: |-
+                                                  Requests describes the minimum amount of compute resources required.
+                                                  If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                                  otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
+                                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                                type: object
+                                            type: object
+                                          securityContext:
+                                            description: If specified, the pod's security context
+                                            properties:
+                                              fsGroup:
+                                                description: |-
+                                                  A special supplemental group that applies to all containers in a pod.
+                                                  Some volume types allow the Kubelet to change the ownership of that volume
+                                                  to be owned by the pod:
+
+                                                  1. The owning GID will be the FSGroup
+                                                  2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
+                                                  3. The permission bits are OR'd with rw-rw----
+
+                                                  If unset, the Kubelet will not modify the ownership and permissions of any volume.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                format: int64
+                                                type: integer
+                                              fsGroupChangePolicy:
+                                                description: |-
+                                                  fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
+                                                  before being exposed inside Pod. This field will only apply to
+                                                  volume types which support fsGroup based ownership(and permissions).
+                                                  It will have no effect on ephemeral volume types such as: secret, configmaps
+                                                  and emptydir.
+                                                  Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                type: string
+                                              runAsGroup:
+                                                description: |-
+                                                  The GID to run the entrypoint of the container process.
+                                                  Uses runtime default if unset.
+                                                  May also be set in SecurityContext.  If set in both SecurityContext and
+                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
+                                                  for that container.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                format: int64
+                                                type: integer
+                                              runAsNonRoot:
+                                                description: |-
+                                                  Indicates that the container must run as a non-root user.
+                                                  If true, the Kubelet will validate the image at runtime to ensure that it
+                                                  does not run as UID 0 (root) and fail to start the container if it does.
+                                                  If unset or false, no such validation will be performed.
+                                                  May also be set in SecurityContext.  If set in both SecurityContext and
+                                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                                type: boolean
+                                              runAsUser:
+                                                description: |-
+                                                  The UID to run the entrypoint of the container process.
+                                                  Defaults to user specified in image metadata if unspecified.
+                                                  May also be set in SecurityContext.  If set in both SecurityContext and
+                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
+                                                  for that container.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                format: int64
+                                                type: integer
+                                              seLinuxOptions:
+                                                description: |-
+                                                  The SELinux context to be applied to all containers.
+                                                  If unspecified, the container runtime will allocate a random SELinux context for each
+                                                  container.  May also be set in SecurityContext.  If set in
+                                                  both SecurityContext and PodSecurityContext, the value specified in SecurityContext
+                                                  takes precedence for that container.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                properties:
+                                                  level:
+                                                    description: Level is SELinux level label that applies to the container.
+                                                    type: string
+                                                  role:
+                                                    description: Role is a SELinux role label that applies to the container.
+                                                    type: string
+                                                  type:
+                                                    description: Type is a SELinux type label that applies to the container.
+                                                    type: string
+                                                  user:
+                                                    description: User is a SELinux user label that applies to the container.
+                                                    type: string
+                                                type: object
+                                              seccompProfile:
+                                                description: |-
+                                                  The seccomp options to use by the containers in this pod.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                properties:
+                                                  localhostProfile:
+                                                    description: |-
+                                                      localhostProfile indicates a profile defined in a file on the node should be used.
+                                                      The profile must be preconfigured on the node to work.
+                                                      Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                                                      Must be set if type is "Localhost". Must NOT be set for any other type.
+                                                    type: string
+                                                  type:
+                                                    description: |-
+                                                      type indicates which kind of seccomp profile will be applied.
+                                                      Valid options are:
+
+                                                      Localhost - a profile defined in a file on the node should be used.
+                                                      RuntimeDefault - the container runtime default profile should be used.
+                                                      Unconfined - no profile should be applied.
+                                                    type: string
+                                                required:
+                                                  - type
+                                                type: object
+                                              supplementalGroups:
+                                                description: |-
+                                                  A list of groups applied to the first process run in each container, in addition
+                                                  to the container's primary GID, the fsGroup (if specified), and group memberships
+                                                  defined in the container image for the uid of the container process. If unspecified,
+                                                  no additional groups are added to any container. Note that group memberships
+                                                  defined in the container image for the uid of the container process are still effective,
+                                                  even if they are not included in this list.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                items:
+                                                  format: int64
+                                                  type: integer
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              sysctls:
+                                                description: |-
+                                                  Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
+                                                  sysctls (by the container runtime) might fail to launch.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                items:
+                                                  description: Sysctl defines a kernel parameter to be set
+                                                  properties:
+                                                    name:
+                                                      description: Name of a property to set
+                                                      type: string
+                                                    value:
+                                                      description: Value of a property to set
+                                                      type: string
+                                                  required:
+                                                    - name
+                                                    - value
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            type: object
+                                          serviceAccountName:
+                                            description: If specified, the pod's service account
+                                            type: string
+                                          tolerations:
+                                            description: If specified, the pod's tolerations.
+                                            items:
+                                              description: |-
+                                                The pod this Toleration is attached to tolerates any taint that matches
+                                                the triple <key,value,effect> using the matching operator <operator>.
+                                              properties:
+                                                effect:
+                                                  description: |-
+                                                    Effect indicates the taint effect to match. Empty means match all taint effects.
+                                                    When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+                                                  type: string
+                                                key:
+                                                  description: |-
+                                                    Key is the taint key that the toleration applies to. Empty means match all taint keys.
+                                                    If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+                                                  type: string
+                                                operator:
+                                                  description: |-
+                                                    Operator represents a key's relationship to the value.
+                                                    Valid operators are Exists and Equal. Defaults to Equal.
+                                                    Exists is equivalent to wildcard for value, so that a pod can
+                                                    tolerate all taints of a particular category.
+                                                  type: string
+                                                tolerationSeconds:
+                                                  description: |-
+                                                    TolerationSeconds represents the period of time the toleration (which must be
+                                                    of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+                                                    it is not set, which means tolerate the taint forever (do not evict). Zero and
+                                                    negative values will be treated as 0 (evict immediately) by the system.
+                                                  format: int64
+                                                  type: integer
+                                                value:
+                                                  description: |-
+                                                    Value is the taint value the toleration matches to.
+                                                    If the operator is Exists, the value should be empty, otherwise just a regular string.
+                                                  type: string
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        type: object
+                                    type: object
+                                  serviceType:
+                                    description: |-
+                                      Optional service type for Kubernetes solver service. Supported values
+                                      are NodePort or ClusterIP. If unset, defaults to NodePort.
+                                    type: string
+                                type: object
+                            type: object
+                          selector:
+                            description: |-
+                              Selector selects a set of DNSNames on the Certificate resource that
+                              should be solved using this challenge solver.
+                              If not specified, the solver will be treated as the 'default' solver
+                              with the lowest priority, i.e. if any other solver has a more specific
+                              match, it will be used instead.
+                            properties:
+                              dnsNames:
+                                description: |-
+                                  List of DNSNames that this solver will be used to solve.
+                                  If specified and a match is found, a dnsNames selector will take
+                                  precedence over a dnsZones selector.
+                                  If multiple solvers match with the same dnsNames value, the solver
+                                  with the most matching labels in matchLabels will be selected.
+                                  If neither has more matches, the solver defined earlier in the list
+                                  will be selected.
+                                items:
+                                  type: string
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              dnsZones:
+                                description: |-
+                                  List of DNSZones that this solver will be used to solve.
+                                  The most specific DNS zone match specified here will take precedence
+                                  over other DNS zone matches, so a solver specifying sys.example.com
+                                  will be selected over one specifying example.com for the domain
+                                  www.sys.example.com.
+                                  If multiple solvers match with the same dnsZones value, the solver
+                                  with the most matching labels in matchLabels will be selected.
+                                  If neither has more matches, the solver defined earlier in the list
+                                  will be selected.
+                                items:
+                                  type: string
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              matchLabels:
+                                additionalProperties:
+                                  type: string
+                                description: |-
+                                  A label selector that is used to refine the set of certificate's that
+                                  this challenge solver will apply to.
+                                type: object
+                            type: object
+                        type: object
+                      type: array
+                      x-kubernetes-list-type: atomic
+                  required:
+                    - privateKeySecretRef
+                    - server
+                  type: object
+                ca:
+                  description: |-
+                    CA configures this issuer to sign certificates using a signing CA keypair
+                    stored in a Secret resource.
+                    This is used to build internal PKIs that are managed by cert-manager.
+                  properties:
+                    crlDistributionPoints:
+                      description: |-
+                        The CRL distribution points is an X.509 v3 certificate extension which identifies
+                        the location of the CRL from which the revocation of this certificate can be checked.
+                        If not set, certificates will be issued without distribution points set.
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    issuingCertificateURLs:
+                      description: |-
+                        IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates
+                        it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.
+                        As an example, such a URL might be "http://ca.domain.com/ca.crt".
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    ocspServers:
+                      description: |-
+                        The OCSP server list is an X.509 v3 extension that defines a list of
+                        URLs of OCSP responders. The OCSP responders can be queried for the
+                        revocation status of an issued certificate. If not set, the
+                        certificate will be issued with no OCSP servers set. For example, an
+                        OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    secretName:
+                      description: |-
+                        SecretName is the name of the secret used to sign Certificates issued
+                        by this Issuer.
+                      type: string
+                  required:
+                    - secretName
+                  type: object
+                selfSigned:
+                  description: |-
+                    SelfSigned configures this issuer to 'self sign' certificates using the
+                    private key used to create the CertificateRequest object.
+                  properties:
+                    crlDistributionPoints:
+                      description: |-
+                        The CRL distribution points is an X.509 v3 certificate extension which identifies
+                        the location of the CRL from which the revocation of this certificate can be checked.
+                        If not set certificate will be issued without CDP. Values are strings.
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                  type: object
+                vault:
+                  description: |-
+                    Vault configures this issuer to sign certificates using a HashiCorp Vault
+                    PKI backend.
+                  properties:
+                    auth:
+                      description: Auth configures how cert-manager authenticates with the Vault server.
+                      properties:
+                        appRole:
+                          description: |-
+                            AppRole authenticates with Vault using the App Role auth mechanism,
+                            with the role and secret stored in a Kubernetes Secret resource.
+                          properties:
+                            path:
+                              description: |-
+                                Path where the App Role authentication backend is mounted in Vault, e.g:
+                                "approle"
+                              type: string
+                            roleId:
+                              description: |-
+                                RoleID configured in the App Role authentication backend when setting
+                                up the authentication backend in Vault.
+                              type: string
+                            secretRef:
+                              description: |-
+                                Reference to a key in a Secret that contains the App Role secret used
+                                to authenticate with Vault.
+                                The `key` field must be specified and denotes which entry within the Secret
+                                resource is used as the app role secret.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used.
+                                    Some instances of this field may be defaulted, in others it may be
+                                    required.
+                                  type: string
+                                name:
+                                  description: |-
+                                    Name of the resource being referred to.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                          required:
+                            - path
+                            - roleId
+                            - secretRef
+                          type: object
+                        clientCertificate:
+                          description: |-
+                            ClientCertificate authenticates with Vault by presenting a client
+                            certificate during the request's TLS handshake.
+                            Works only when using HTTPS protocol.
+                          properties:
+                            mountPath:
+                              description: |-
+                                The Vault mountPath here is the mount path to use when authenticating with
+                                Vault. For example, setting a value to `/v1/auth/foo`, will use the path
+                                `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
+                                default value "/v1/auth/cert" will be used.
+                              type: string
+                            name:
+                              description: |-
+                                Name of the certificate role to authenticate against.
+                                If not set, matching any certificate role, if available.
+                              type: string
+                            secretName:
+                              description: |-
+                                Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing
+                                tls.crt and tls.key) used to authenticate to Vault using TLS client
+                                authentication.
+                              type: string
+                          type: object
+                        kubernetes:
+                          description: |-
+                            Kubernetes authenticates with Vault by passing the ServiceAccount
+                            token stored in the named Secret resource to the Vault server.
+                          properties:
+                            mountPath:
+                              description: |-
+                                The Vault mountPath here is the mount path to use when authenticating with
+                                Vault. For example, setting a value to `/v1/auth/foo`, will use the path
+                                `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
+                                default value "/v1/auth/kubernetes" will be used.
+                              type: string
+                            role:
+                              description: |-
+                                A required field containing the Vault Role to assume. A Role binds a
+                                Kubernetes ServiceAccount with a set of Vault policies.
+                              type: string
+                            secretRef:
+                              description: |-
+                                The required Secret field containing a Kubernetes ServiceAccount JWT used
+                                for authenticating with Vault. Use of 'ambient credentials' is not
+                                supported.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used.
+                                    Some instances of this field may be defaulted, in others it may be
+                                    required.
+                                  type: string
+                                name:
+                                  description: |-
+                                    Name of the resource being referred to.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                            serviceAccountRef:
+                              description: |-
+                                A reference to a service account that will be used to request a bound
+                                token (also known as "projected token"). Compared to using "secretRef",
+                                using this field means that you don't rely on statically bound tokens. To
+                                use this field, you must configure an RBAC rule to let cert-manager
+                                request a token.
+                              properties:
+                                audiences:
+                                  description: |-
+                                    TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token
+                                    consisting of the issuer's namespace and name is always included.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                name:
+                                  description: Name of the ServiceAccount used to request a token.
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                          required:
+                            - role
+                          type: object
+                        tokenSecretRef:
+                          description: TokenSecretRef authenticates with Vault by presenting a token.
+                          properties:
+                            key:
+                              description: |-
+                                The key of the entry in the Secret resource's `data` field to be used.
+                                Some instances of this field may be defaulted, in others it may be
+                                required.
+                              type: string
+                            name:
+                              description: |-
+                                Name of the resource being referred to.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                          required:
+                            - name
+                          type: object
+                      type: object
+                    caBundle:
+                      description: |-
+                        Base64-encoded bundle of PEM CAs which will be used to validate the certificate
+                        chain presented by Vault. Only used if using HTTPS to connect to Vault and
+                        ignored for HTTP connections.
+                        Mutually exclusive with CABundleSecretRef.
+                        If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
+                        the cert-manager controller container is used to validate the TLS connection.
+                      format: byte
+                      type: string
+                    caBundleSecretRef:
+                      description: |-
+                        Reference to a Secret containing a bundle of PEM-encoded CAs to use when
+                        verifying the certificate chain presented by Vault when using HTTPS.
+                        Mutually exclusive with CABundle.
+                        If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
+                        the cert-manager controller container is used to validate the TLS connection.
+                        If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
+                      properties:
+                        key:
+                          description: |-
+                            The key of the entry in the Secret resource's `data` field to be used.
+                            Some instances of this field may be defaulted, in others it may be
+                            required.
+                          type: string
+                        name:
+                          description: |-
+                            Name of the resource being referred to.
+                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          type: string
+                      required:
+                        - name
+                      type: object
+                    clientCertSecretRef:
+                      description: |-
+                        Reference to a Secret containing a PEM-encoded Client Certificate to use when the
+                        Vault server requires mTLS.
+                      properties:
+                        key:
+                          description: |-
+                            The key of the entry in the Secret resource's `data` field to be used.
+                            Some instances of this field may be defaulted, in others it may be
+                            required.
+                          type: string
+                        name:
+                          description: |-
+                            Name of the resource being referred to.
+                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          type: string
+                      required:
+                        - name
+                      type: object
+                    clientKeySecretRef:
+                      description: |-
+                        Reference to a Secret containing a PEM-encoded Client Private Key to use when the
+                        Vault server requires mTLS.
+                      properties:
+                        key:
+                          description: |-
+                            The key of the entry in the Secret resource's `data` field to be used.
+                            Some instances of this field may be defaulted, in others it may be
+                            required.
+                          type: string
+                        name:
+                          description: |-
+                            Name of the resource being referred to.
+                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          type: string
+                      required:
+                        - name
+                      type: object
+                    namespace:
+                      description: |-
+                        Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1"
+                        More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
+                      type: string
+                    path:
+                      description: |-
+                        Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
+                        "my_pki_mount/sign/my-role-name".
+                      type: string
+                    server:
+                      description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
+                      type: string
+                    serverName:
+                      description: |-
+                        ServerName is used to verify the hostname on the returned certificates
+                        by the Vault server.
+                      type: string
+                  required:
+                    - auth
+                    - path
+                    - server
+                  type: object
+                venafi:
+                  description: |-
+                    Venafi configures this issuer to sign certificates using a Venafi TPP
+                    or Venafi Cloud policy zone.
+                  properties:
+                    cloud:
+                      description: |-
+                        Cloud specifies the Venafi cloud configuration settings.
+                        Only one of TPP or Cloud may be specified.
+                      properties:
+                        apiTokenSecretRef:
+                          description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
+                          properties:
+                            key:
+                              description: |-
+                                The key of the entry in the Secret resource's `data` field to be used.
+                                Some instances of this field may be defaulted, in others it may be
+                                required.
+                              type: string
+                            name:
+                              description: |-
+                                Name of the resource being referred to.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                          required:
+                            - name
+                          type: object
+                        url:
+                          description: |-
+                            URL is the base URL for Venafi Cloud.
+                            Defaults to "https://api.venafi.cloud/".
+                          type: string
+                      required:
+                        - apiTokenSecretRef
+                      type: object
+                    tpp:
+                      description: |-
+                        TPP specifies Trust Protection Platform configuration settings.
+                        Only one of TPP or Cloud may be specified.
+                      properties:
+                        caBundle:
+                          description: |-
+                            Base64-encoded bundle of PEM CAs which will be used to validate the certificate
+                            chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
+                            If undefined, the certificate bundle in the cert-manager controller container
+                            is used to validate the chain.
+                          format: byte
+                          type: string
+                        caBundleSecretRef:
+                          description: |-
+                            Reference to a Secret containing a base64-encoded bundle of PEM CAs
+                            which will be used to validate the certificate chain presented by the TPP server.
+                            Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
+                            If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
+                            the cert-manager controller container is used to validate the TLS connection.
+                          properties:
+                            key:
+                              description: |-
+                                The key of the entry in the Secret resource's `data` field to be used.
+                                Some instances of this field may be defaulted, in others it may be
+                                required.
+                              type: string
+                            name:
+                              description: |-
+                                Name of the resource being referred to.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                          required:
+                            - name
+                          type: object
+                        credentialsRef:
+                          description: |-
+                            CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.
+                            The secret must contain the key 'access-token' for the Access Token Authentication,
+                            or two keys, 'username' and 'password' for the API Keys Authentication.
+                          properties:
+                            name:
+                              description: |-
+                                Name of the resource being referred to.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                          required:
+                            - name
+                          type: object
+                        url:
+                          description: |-
+                            URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
+                            for example: "https://tpp.example.com/vedsdk".
+                          type: string
+                      required:
+                        - credentialsRef
+                        - url
+                      type: object
+                    zone:
+                      description: |-
+                        Zone is the Venafi Policy Zone to use for this issuer.
+                        All requests made to the Venafi platform will be restricted by the named
+                        zone policy.
+                        This field is required.
+                      type: string
+                  required:
+                    - zone
+                  type: object
+              type: object
+            status:
+              description: Status of the ClusterIssuer. This is set and managed automatically.
+              properties:
+                acme:
+                  description: |-
+                    ACME specific status options.
+                    This field should only be set if the Issuer is configured to use an ACME
+                    server to issue certificates.
+                  properties:
+                    lastPrivateKeyHash:
+                      description: |-
+                        LastPrivateKeyHash is a hash of the private key associated with the latest
+                        registered ACME account, in order to track changes made to registered account
+                        associated with the Issuer
+                      type: string
+                    lastRegisteredEmail:
+                      description: |-
+                        LastRegisteredEmail is the email associated with the latest registered
+                        ACME account, in order to track changes made to registered account
+                        associated with the  Issuer
+                      type: string
+                    uri:
+                      description: |-
+                        URI is the unique account identifier, which can also be used to retrieve
+                        account details from the CA
+                      type: string
+                  type: object
+                conditions:
+                  description: |-
+                    List of status conditions to indicate the status of a CertificateRequest.
+                    Known condition types are `Ready`.
+                  items:
+                    description: IssuerCondition contains condition information for an Issuer.
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the timestamp corresponding to the last status
+                          change of this condition.
+                        format: date-time
+                        type: string
+                      message:
+                        description: |-
+                          Message is a human readable description of the details of the last
+                          transition, complementing reason.
+                        type: string
+                      observedGeneration:
+                        description: |-
+                          If set, this represents the .metadata.generation that the condition was
+                          set based upon.
+                          For instance, if .metadata.generation is currently 12, but the
+                          .status.condition[x].observedGeneration is 9, the condition is out of date
+                          with respect to the current state of the Issuer.
+                        format: int64
+                        type: integer
+                      reason:
+                        description: |-
+                          Reason is a brief machine readable explanation for the condition's last
+                          transition.
+                        type: string
+                      status:
+                        description: Status of the condition, one of (`True`, `False`, `Unknown`).
+                        enum:
+                          - "True"
+                          - "False"
+                          - Unknown
+                        type: string
+                      type:
+                        description: Type of the condition, known values are (`Ready`).
+                        type: string
+                    required:
+                      - status
+                      - type
+                    type: object
+                  type: array
+                  x-kubernetes-list-map-keys:
+                    - type
+                  x-kubernetes-list-type: map
+              type: object
+          required:
+            - spec
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+{{- end }}
diff --git a/packages/system/cert-manager-crds/templates/crd-cert-manager.io_issuers.yaml b/packages/system/cert-manager-crds/templates/crd-cert-manager.io_issuers.yaml
new file mode 100644
index 00000000..43277f84
--- /dev/null
+++ b/packages/system/cert-manager-crds/templates/crd-cert-manager.io_issuers.yaml
@@ -0,0 +1,3814 @@
+{{- if or .Values.crds.enabled .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: "issuers.cert-manager.io"
+  {{- if .Values.crds.keep }}
+  annotations:
+    helm.sh/resource-policy: keep
+  {{- end }}
+  labels:
+    {{- include "cert-manager.crd-labels" . | nindent 4 }}
+spec:
+  group: cert-manager.io
+  names:
+    categories:
+      - cert-manager
+    kind: Issuer
+    listKind: IssuerList
+    plural: issuers
+    shortNames:
+      - iss
+    singular: issuer
+  scope: Namespaced
+  versions:
+    - additionalPrinterColumns:
+        - jsonPath: .status.conditions[?(@.type == "Ready")].status
+          name: Ready
+          type: string
+        - jsonPath: .status.conditions[?(@.type == "Ready")].message
+          name: Status
+          priority: 1
+          type: string
+        - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+          jsonPath: .metadata.creationTimestamp
+          name: Age
+          type: date
+      name: v1
+      schema:
+        openAPIV3Schema:
+          description: |-
+            An Issuer represents a certificate issuing authority which can be
+            referenced as part of `issuerRef` fields.
+            It is scoped to a single namespace and can therefore only be referenced by
+            resources within the same namespace.
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: Desired state of the Issuer resource.
+              properties:
+                acme:
+                  description: |-
+                    ACME configures this issuer to communicate with a RFC8555 (ACME) server
+                    to obtain signed x509 certificates.
+                  properties:
+                    caBundle:
+                      description: |-
+                        Base64-encoded bundle of PEM CAs which can be used to validate the certificate
+                        chain presented by the ACME server.
+                        Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various
+                        kinds of security vulnerabilities.
+                        If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
+                        the container is used to validate the TLS connection.
+                      format: byte
+                      type: string
+                    disableAccountKeyGeneration:
+                      description: |-
+                        Enables or disables generating a new ACME account key.
+                        If true, the Issuer resource will *not* request a new account but will expect
+                        the account key to be supplied via an existing secret.
+                        If false, the cert-manager system will generate a new ACME account key
+                        for the Issuer.
+                        Defaults to false.
+                      type: boolean
+                    email:
+                      description: |-
+                        Email is the email address to be associated with the ACME account.
+                        This field is optional, but it is strongly recommended to be set.
+                        It will be used to contact you in case of issues with your account or
+                        certificates, including expiry notification emails.
+                        This field may be updated after the account is initially registered.
+                      type: string
+                    enableDurationFeature:
+                      description: |-
+                        Enables requesting a Not After date on certificates that matches the
+                        duration of the certificate. This is not supported by all ACME servers
+                        like Let's Encrypt. If set to true when the ACME server does not support
+                        it, it will create an error on the Order.
+                        Defaults to false.
+                      type: boolean
+                    externalAccountBinding:
+                      description: |-
+                        ExternalAccountBinding is a reference to a CA external account of the ACME
+                        server.
+                        If set, upon registration cert-manager will attempt to associate the given
+                        external account credentials with the registered ACME account.
+                      properties:
+                        keyAlgorithm:
+                          description: |-
+                            Deprecated: keyAlgorithm field exists for historical compatibility
+                            reasons and should not be used. The algorithm is now hardcoded to HS256
+                            in golang/x/crypto/acme.
+                          enum:
+                            - HS256
+                            - HS384
+                            - HS512
+                          type: string
+                        keyID:
+                          description: keyID is the ID of the CA key that the External Account is bound to.
+                          type: string
+                        keySecretRef:
+                          description: |-
+                            keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes
+                            Secret which holds the symmetric MAC key of the External Account Binding.
+                            The `key` is the index string that is paired with the key data in the
+                            Secret and should not be confused with the key data itself, or indeed with
+                            the External Account Binding keyID above.
+                            The secret key stored in the Secret **must** be un-padded, base64 URL
+                            encoded data.
+                          properties:
+                            key:
+                              description: |-
+                                The key of the entry in the Secret resource's `data` field to be used.
+                                Some instances of this field may be defaulted, in others it may be
+                                required.
+                              type: string
+                            name:
+                              description: |-
+                                Name of the resource being referred to.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                          required:
+                            - name
+                          type: object
+                      required:
+                        - keyID
+                        - keySecretRef
+                      type: object
+                    preferredChain:
+                      description: |-
+                        PreferredChain is the chain to use if the ACME server outputs multiple.
+                        PreferredChain is no guarantee that this one gets delivered by the ACME
+                        endpoint.
+                        For example, for Let's Encrypt's DST cross-sign you would use:
+                        "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
+                        This value picks the first certificate bundle in the combined set of
+                        ACME default and alternative chains that has a root-most certificate with
+                        this value as its issuer's commonname.
+                      maxLength: 64
+                      type: string
+                    privateKeySecretRef:
+                      description: |-
+                        PrivateKey is the name of a Kubernetes Secret resource that will be used to
+                        store the automatically generated ACME account private key.
+                        Optionally, a `key` may be specified to select a specific entry within
+                        the named Secret resource.
+                        If `key` is not specified, a default of `tls.key` will be used.
+                      properties:
+                        key:
+                          description: |-
+                            The key of the entry in the Secret resource's `data` field to be used.
+                            Some instances of this field may be defaulted, in others it may be
+                            required.
+                          type: string
+                        name:
+                          description: |-
+                            Name of the resource being referred to.
+                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          type: string
+                      required:
+                        - name
+                      type: object
+                    profile:
+                      description: |-
+                        Profile allows requesting a certificate profile from the ACME server.
+                        Supported profiles are listed by the server's ACME directory URL.
+                      type: string
+                    server:
+                      description: |-
+                        Server is the URL used to access the ACME server's 'directory' endpoint.
+                        For example, for Let's Encrypt's staging endpoint, you would use:
+                        "https://acme-staging-v02.api.letsencrypt.org/directory".
+                        Only ACME v2 endpoints (i.e. RFC 8555) are supported.
+                      type: string
+                    skipTLSVerify:
+                      description: |-
+                        INSECURE: Enables or disables validation of the ACME server TLS certificate.
+                        If true, requests to the ACME server will not have the TLS certificate chain
+                        validated.
+                        Mutually exclusive with CABundle; prefer using CABundle to prevent various
+                        kinds of security vulnerabilities.
+                        Only enable this option in development environments.
+                        If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
+                        the container is used to validate the TLS connection.
+                        Defaults to false.
+                      type: boolean
+                    solvers:
+                      description: |-
+                        Solvers is a list of challenge solvers that will be used to solve
+                        ACME challenges for the matching domains.
+                        Solver configurations must be provided in order to obtain certificates
+                        from an ACME server.
+                        For more information, see: https://cert-manager.io/docs/configuration/acme/
+                      items:
+                        description: |-
+                          An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of.
+                          A selector may be provided to use different solving strategies for different DNS names.
+                          Only one of HTTP01 or DNS01 must be provided.
+                        properties:
+                          dns01:
+                            description: |-
+                              Configures cert-manager to attempt to complete authorizations by
+                              performing the DNS01 challenge flow.
+                            properties:
+                              acmeDNS:
+                                description: |-
+                                  Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
+                                  DNS01 challenge records.
+                                properties:
+                                  accountSecretRef:
+                                    description: |-
+                                      A reference to a specific 'key' within a Secret resource.
+                                      In some instances, `key` is a required field.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                  host:
+                                    type: string
+                                required:
+                                  - accountSecretRef
+                                  - host
+                                type: object
+                              akamai:
+                                description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
+                                properties:
+                                  accessTokenSecretRef:
+                                    description: |-
+                                      A reference to a specific 'key' within a Secret resource.
+                                      In some instances, `key` is a required field.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                  clientSecretSecretRef:
+                                    description: |-
+                                      A reference to a specific 'key' within a Secret resource.
+                                      In some instances, `key` is a required field.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                  clientTokenSecretRef:
+                                    description: |-
+                                      A reference to a specific 'key' within a Secret resource.
+                                      In some instances, `key` is a required field.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                  serviceConsumerDomain:
+                                    type: string
+                                required:
+                                  - accessTokenSecretRef
+                                  - clientSecretSecretRef
+                                  - clientTokenSecretRef
+                                  - serviceConsumerDomain
+                                type: object
+                              azureDNS:
+                                description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
+                                properties:
+                                  clientID:
+                                    description: |-
+                                      Auth: Azure Service Principal:
+                                      The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
+                                      If set, ClientSecret and TenantID must also be set.
+                                    type: string
+                                  clientSecretSecretRef:
+                                    description: |-
+                                      Auth: Azure Service Principal:
+                                      A reference to a Secret containing the password associated with the Service Principal.
+                                      If set, ClientID and TenantID must also be set.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                  environment:
+                                    description: name of the Azure environment (default AzurePublicCloud)
+                                    enum:
+                                      - AzurePublicCloud
+                                      - AzureChinaCloud
+                                      - AzureGermanCloud
+                                      - AzureUSGovernmentCloud
+                                    type: string
+                                  hostedZoneName:
+                                    description: name of the DNS zone that should be used
+                                    type: string
+                                  managedIdentity:
+                                    description: |-
+                                      Auth: Azure Workload Identity or Azure Managed Service Identity:
+                                      Settings to enable Azure Workload Identity or Azure Managed Service Identity
+                                      If set, ClientID, ClientSecret and TenantID must not be set.
+                                    properties:
+                                      clientID:
+                                        description: client ID of the managed identity, cannot be used at the same time as resourceID
+                                        type: string
+                                      resourceID:
+                                        description: |-
+                                          resource ID of the managed identity, cannot be used at the same time as clientID
+                                          Cannot be used for Azure Managed Service Identity
+                                        type: string
+                                      tenantID:
+                                        description: tenant ID of the managed identity, cannot be used at the same time as resourceID
+                                        type: string
+                                    type: object
+                                  resourceGroupName:
+                                    description: resource group the DNS zone is located in
+                                    type: string
+                                  subscriptionID:
+                                    description: ID of the Azure subscription
+                                    type: string
+                                  tenantID:
+                                    description: |-
+                                      Auth: Azure Service Principal:
+                                      The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
+                                      If set, ClientID and ClientSecret must also be set.
+                                    type: string
+                                required:
+                                  - resourceGroupName
+                                  - subscriptionID
+                                type: object
+                              cloudDNS:
+                                description: Use the Google Cloud DNS API to manage DNS01 challenge records.
+                                properties:
+                                  hostedZoneName:
+                                    description: |-
+                                      HostedZoneName is an optional field that tells cert-manager in which
+                                      Cloud DNS zone the challenge record has to be created.
+                                      If left empty cert-manager will automatically choose a zone.
+                                    type: string
+                                  project:
+                                    type: string
+                                  serviceAccountSecretRef:
+                                    description: |-
+                                      A reference to a specific 'key' within a Secret resource.
+                                      In some instances, `key` is a required field.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                required:
+                                  - project
+                                type: object
+                              cloudflare:
+                                description: Use the Cloudflare API to manage DNS01 challenge records.
+                                properties:
+                                  apiKeySecretRef:
+                                    description: |-
+                                      API key to use to authenticate with Cloudflare.
+                                      Note: using an API token to authenticate is now the recommended method
+                                      as it allows greater control of permissions.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                  apiTokenSecretRef:
+                                    description: API token used to authenticate with Cloudflare.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                  email:
+                                    description: Email of the account, only required when using API key based authentication.
+                                    type: string
+                                type: object
+                              cnameStrategy:
+                                description: |-
+                                  CNAMEStrategy configures how the DNS01 provider should handle CNAME
+                                  records when found in DNS zones.
+                                enum:
+                                  - None
+                                  - Follow
+                                type: string
+                              digitalocean:
+                                description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
+                                properties:
+                                  tokenSecretRef:
+                                    description: |-
+                                      A reference to a specific 'key' within a Secret resource.
+                                      In some instances, `key` is a required field.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                required:
+                                  - tokenSecretRef
+                                type: object
+                              rfc2136:
+                                description: |-
+                                  Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
+                                  to manage DNS01 challenge records.
+                                properties:
+                                  nameserver:
+                                    description: |-
+                                      The IP address or hostname of an authoritative DNS server supporting
+                                      RFC2136 in the form host:port. If the host is an IPv6 address it must be
+                                      enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
+                                      This field is required.
+                                    type: string
+                                  protocol:
+                                    description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default).
+                                    enum:
+                                      - TCP
+                                      - UDP
+                                    type: string
+                                  tsigAlgorithm:
+                                    description: |-
+                                      The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
+                                      when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
+                                      Supported values are (case-insensitive): ``HMACMD5`` (default),
+                                      ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
+                                    type: string
+                                  tsigKeyName:
+                                    description: |-
+                                      The TSIG Key name configured in the DNS.
+                                      If ``tsigSecretSecretRef`` is defined, this field is required.
+                                    type: string
+                                  tsigSecretSecretRef:
+                                    description: |-
+                                      The name of the secret containing the TSIG value.
+                                      If ``tsigKeyName`` is defined, this field is required.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                required:
+                                  - nameserver
+                                type: object
+                              route53:
+                                description: Use the AWS Route53 API to manage DNS01 challenge records.
+                                properties:
+                                  accessKeyID:
+                                    description: |-
+                                      The AccessKeyID is used for authentication.
+                                      Cannot be set when SecretAccessKeyID is set.
+                                      If neither the Access Key nor Key ID are set, we fall-back to using env
+                                      vars, shared credentials file or AWS Instance metadata,
+                                      see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+                                    type: string
+                                  accessKeyIDSecretRef:
+                                    description: |-
+                                      The SecretAccessKey is used for authentication. If set, pull the AWS
+                                      access key ID from a key within a Kubernetes Secret.
+                                      Cannot be set when AccessKeyID is set.
+                                      If neither the Access Key nor Key ID are set, we fall-back to using env
+                                      vars, shared credentials file or AWS Instance metadata,
+                                      see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                  auth:
+                                    description: Auth configures how cert-manager authenticates.
+                                    properties:
+                                      kubernetes:
+                                        description: |-
+                                          Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
+                                          by passing a bound ServiceAccount token.
+                                        properties:
+                                          serviceAccountRef:
+                                            description: |-
+                                              A reference to a service account that will be used to request a bound
+                                              token (also known as "projected token"). To use this field, you must
+                                              configure an RBAC rule to let cert-manager request a token.
+                                            properties:
+                                              audiences:
+                                                description: |-
+                                                  TokenAudiences is an optional list of audiences to include in the
+                                                  token passed to AWS. The default token consisting of the issuer's namespace
+                                                  and name is always included.
+                                                  If unset the audience defaults to `sts.amazonaws.com`.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              name:
+                                                description: Name of the ServiceAccount used to request a token.
+                                                type: string
+                                            required:
+                                              - name
+                                            type: object
+                                        required:
+                                          - serviceAccountRef
+                                        type: object
+                                    required:
+                                      - kubernetes
+                                    type: object
+                                  hostedZoneID:
+                                    description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.
+                                    type: string
+                                  region:
+                                    description: |-
+                                      Override the AWS region.
+
+                                      Route53 is a global service and does not have regional endpoints but the
+                                      region specified here (or via environment variables) is used as a hint to
+                                      help compute the correct AWS credential scope and partition when it
+                                      connects to Route53. See:
+                                      - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
+                                      - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)
+
+                                      If you omit this region field, cert-manager will use the region from
+                                      AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
+                                      in the cert-manager controller Pod.
+
+                                      The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
+                                      Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
+                                      [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
+                                      In this case this `region` field value is ignored.
+
+                                      The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
+                                      Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
+                                      [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
+                                      In this case this `region` field value is ignored.
+                                    type: string
+                                  role:
+                                    description: |-
+                                      Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
+                                      or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
+                                    type: string
+                                  secretAccessKeySecretRef:
+                                    description: |-
+                                      The SecretAccessKey is used for authentication.
+                                      If neither the Access Key nor Key ID are set, we fall-back to using env
+                                      vars, shared credentials file or AWS Instance metadata,
+                                      see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key of the entry in the Secret resource's `data` field to be used.
+                                          Some instances of this field may be defaulted, in others it may be
+                                          required.
+                                        type: string
+                                      name:
+                                        description: |-
+                                          Name of the resource being referred to.
+                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                        type: string
+                                    required:
+                                      - name
+                                    type: object
+                                type: object
+                              webhook:
+                                description: |-
+                                  Configure an external webhook based DNS01 challenge solver to manage
+                                  DNS01 challenge records.
+                                properties:
+                                  config:
+                                    description: |-
+                                      Additional configuration that should be passed to the webhook apiserver
+                                      when challenges are processed.
+                                      This can contain arbitrary JSON data.
+                                      Secret values should not be specified in this stanza.
+                                      If secret values are needed (e.g., credentials for a DNS service), you
+                                      should use a SecretKeySelector to reference a Secret resource.
+                                      For details on the schema of this field, consult the webhook provider
+                                      implementation's documentation.
+                                    x-kubernetes-preserve-unknown-fields: true
+                                  groupName:
+                                    description: |-
+                                      The API group name that should be used when POSTing ChallengePayload
+                                      resources to the webhook apiserver.
+                                      This should be the same as the GroupName specified in the webhook
+                                      provider implementation.
+                                    type: string
+                                  solverName:
+                                    description: |-
+                                      The name of the solver to use, as defined in the webhook provider
+                                      implementation.
+                                      This will typically be the name of the provider, e.g., 'cloudflare'.
+                                    type: string
+                                required:
+                                  - groupName
+                                  - solverName
+                                type: object
+                            type: object
+                          http01:
+                            description: |-
+                              Configures cert-manager to attempt to complete authorizations by
+                              performing the HTTP01 challenge flow.
+                              It is not possible to obtain certificates for wildcard domain names
+                              (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
+                            properties:
+                              gatewayHTTPRoute:
+                                description: |-
+                                  The Gateway API is a sig-network community API that models service networking
+                                  in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
+                                  create HTTPRoutes with the specified labels in the same namespace as the challenge.
+                                  This solver is experimental, and fields / behaviour may change in the future.
+                                properties:
+                                  labels:
+                                    additionalProperties:
+                                      type: string
+                                    description: |-
+                                      Custom labels that will be applied to HTTPRoutes created by cert-manager
+                                      while solving HTTP-01 challenges.
+                                    type: object
+                                  parentRefs:
+                                    description: |-
+                                      When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
+                                      cert-manager needs to know which parentRefs should be used when creating
+                                      the HTTPRoute. Usually, the parentRef references a Gateway. See:
+                                      https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
+                                    items:
+                                      description: |-
+                                        ParentReference identifies an API object (usually a Gateway) that can be considered
+                                        a parent of this resource (usually a route). There are two kinds of parent resources
+                                        with "Core" support:
+
+                                        * Gateway (Gateway conformance profile)
+                                        * Service (Mesh conformance profile, ClusterIP Services only)
+
+                                        This API may be extended in the future to support additional kinds of parent
+                                        resources.
+
+                                        The API object must be valid in the cluster; the Group and Kind must
+                                        be registered in the cluster for this reference to be valid.
+                                      properties:
+                                        group:
+                                          default: gateway.networking.k8s.io
+                                          description: |-
+                                            Group is the group of the referent.
+                                            When unspecified, "gateway.networking.k8s.io" is inferred.
+                                            To set the core API group (such as for a "Service" kind referent),
+                                            Group must be explicitly set to "" (empty string).
+
+                                            Support: Core
+                                          maxLength: 253
+                                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                          type: string
+                                        kind:
+                                          default: Gateway
+                                          description: |-
+                                            Kind is kind of the referent.
+
+                                            There are two kinds of parent resources with "Core" support:
+
+                                            * Gateway (Gateway conformance profile)
+                                            * Service (Mesh conformance profile, ClusterIP Services only)
+
+                                            Support for other resources is Implementation-Specific.
+                                          maxLength: 63
+                                          minLength: 1
+                                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                          type: string
+                                        name:
+                                          description: |-
+                                            Name is the name of the referent.
+
+                                            Support: Core
+                                          maxLength: 253
+                                          minLength: 1
+                                          type: string
+                                        namespace:
+                                          description: |-
+                                            Namespace is the namespace of the referent. When unspecified, this refers
+                                            to the local namespace of the Route.
+
+                                            Note that there are specific rules for ParentRefs which cross namespace
+                                            boundaries. Cross-namespace references are only valid if they are explicitly
+                                            allowed by something in the namespace they are referring to. For example:
+                                            Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                                            generic way to enable any other kind of cross-namespace reference.
+
+                                            <gateway:experimental:description>
+                                            ParentRefs from a Route to a Service in the same namespace are "producer"
+                                            routes, which apply default routing rules to inbound connections from
+                                            any namespace to the Service.
+
+                                            ParentRefs from a Route to a Service in a different namespace are
+                                            "consumer" routes, and these routing rules are only applied to outbound
+                                            connections originating from the same namespace as the Route, for which
+                                            the intended destination of the connections are a Service targeted as a
+                                            ParentRef of the Route.
+                                            </gateway:experimental:description>
+
+                                            Support: Core
+                                          maxLength: 63
+                                          minLength: 1
+                                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                          type: string
+                                        port:
+                                          description: |-
+                                            Port is the network port this Route targets. It can be interpreted
+                                            differently based on the type of parent resource.
+
+                                            When the parent resource is a Gateway, this targets all listeners
+                                            listening on the specified port that also support this kind of Route(and
+                                            select this Route). It's not recommended to set `Port` unless the
+                                            networking behaviors specified in a Route must apply to a specific port
+                                            as opposed to a listener(s) whose port(s) may be changed. When both Port
+                                            and SectionName are specified, the name and port of the selected listener
+                                            must match both specified values.
+
+                                            <gateway:experimental:description>
+                                            When the parent resource is a Service, this targets a specific port in the
+                                            Service spec. When both Port (experimental) and SectionName are specified,
+                                            the name and port of the selected port must match both specified values.
+                                            </gateway:experimental:description>
+
+                                            Implementations MAY choose to support other parent resources.
+                                            Implementations supporting other types of parent resources MUST clearly
+                                            document how/if Port is interpreted.
+
+                                            For the purpose of status, an attachment is considered successful as
+                                            long as the parent resource accepts it partially. For example, Gateway
+                                            listeners can restrict which Routes can attach to them by Route kind,
+                                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                                            from the referencing Route, the Route MUST be considered successfully
+                                            attached. If no Gateway listeners accept attachment from this Route,
+                                            the Route MUST be considered detached from the Gateway.
+
+                                            Support: Extended
+                                          format: int32
+                                          maximum: 65535
+                                          minimum: 1
+                                          type: integer
+                                        sectionName:
+                                          description: |-
+                                            SectionName is the name of a section within the target resource. In the
+                                            following resources, SectionName is interpreted as the following:
+
+                                            * Gateway: Listener name. When both Port (experimental) and SectionName
+                                            are specified, the name and port of the selected listener must match
+                                            both specified values.
+                                            * Service: Port name. When both Port (experimental) and SectionName
+                                            are specified, the name and port of the selected listener must match
+                                            both specified values.
+
+                                            Implementations MAY choose to support attaching Routes to other resources.
+                                            If that is the case, they MUST clearly document how SectionName is
+                                            interpreted.
+
+                                            When unspecified (empty string), this will reference the entire resource.
+                                            For the purpose of status, an attachment is considered successful if at
+                                            least one section in the parent resource accepts it. For example, Gateway
+                                            listeners can restrict which Routes can attach to them by Route kind,
+                                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                                            the referencing Route, the Route MUST be considered successfully
+                                            attached. If no Gateway listeners accept attachment from this Route, the
+                                            Route MUST be considered detached from the Gateway.
+
+                                            Support: Core
+                                          maxLength: 253
+                                          minLength: 1
+                                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                          type: string
+                                      required:
+                                        - name
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  podTemplate:
+                                    description: |-
+                                      Optional pod template used to configure the ACME challenge solver pods
+                                      used for HTTP01 challenges.
+                                    properties:
+                                      metadata:
+                                        description: |-
+                                          ObjectMeta overrides for the pod used to solve HTTP01 challenges.
+                                          Only the 'labels' and 'annotations' fields may be set.
+                                          If labels or annotations overlap with in-built values, the values here
+                                          will override the in-built values.
+                                        properties:
+                                          annotations:
+                                            additionalProperties:
+                                              type: string
+                                            description: Annotations that should be added to the created ACME HTTP01 solver pods.
+                                            type: object
+                                          labels:
+                                            additionalProperties:
+                                              type: string
+                                            description: Labels that should be added to the created ACME HTTP01 solver pods.
+                                            type: object
+                                        type: object
+                                      spec:
+                                        description: |-
+                                          PodSpec defines overrides for the HTTP01 challenge solver pod.
+                                          Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
+                                          All other fields will be ignored.
+                                        properties:
+                                          affinity:
+                                            description: If specified, the pod's scheduling constraints
+                                            properties:
+                                              nodeAffinity:
+                                                description: Describes node affinity scheduling rules for the pod.
+                                                properties:
+                                                  preferredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      The scheduler will prefer to schedule pods to nodes that satisfy
+                                                      the affinity expressions specified by this field, but it may choose
+                                                      a node that violates one or more of the expressions. The node that is
+                                                      most preferred is the one with the greatest sum of weights, i.e.
+                                                      for each node that meets all of the scheduling requirements (resource
+                                                      request, requiredDuringScheduling affinity expressions, etc.),
+                                                      compute a sum by iterating through the elements of this field and adding
+                                                      "weight" to the sum if the node matches the corresponding matchExpressions; the
+                                                      node(s) with the highest sum are the most preferred.
+                                                    items:
+                                                      description: |-
+                                                        An empty preferred scheduling term matches all objects with implicit weight 0
+                                                        (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+                                                      properties:
+                                                        preference:
+                                                          description: A node selector term, associated with the corresponding weight.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: A list of node selector requirements by node's labels.
+                                                              items:
+                                                                description: |-
+                                                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                                                  that relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: The label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      Represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      An array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                                                      array must have a single element, which will be interpreted as an integer.
+                                                                      This array is replaced during a strategic merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchFields:
+                                                              description: A list of node selector requirements by node's fields.
+                                                              items:
+                                                                description: |-
+                                                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                                                  that relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: The label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      Represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      An array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                                                      array must have a single element, which will be interpreted as an integer.
+                                                                      This array is replaced during a strategic merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        weight:
+                                                          description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
+                                                          format: int32
+                                                          type: integer
+                                                      required:
+                                                        - preference
+                                                        - weight
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  requiredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      If the affinity requirements specified by this field are not met at
+                                                      scheduling time, the pod will not be scheduled onto the node.
+                                                      If the affinity requirements specified by this field cease to be met
+                                                      at some point during pod execution (e.g. due to an update), the system
+                                                      may or may not try to eventually evict the pod from its node.
+                                                    properties:
+                                                      nodeSelectorTerms:
+                                                        description: Required. A list of node selector terms. The terms are ORed.
+                                                        items:
+                                                          description: |-
+                                                            A null or empty node selector term matches no objects. The requirements of
+                                                            them are ANDed.
+                                                            The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: A list of node selector requirements by node's labels.
+                                                              items:
+                                                                description: |-
+                                                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                                                  that relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: The label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      Represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      An array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                                                      array must have a single element, which will be interpreted as an integer.
+                                                                      This array is replaced during a strategic merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchFields:
+                                                              description: A list of node selector requirements by node's fields.
+                                                              items:
+                                                                description: |-
+                                                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                                                  that relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: The label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      Represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      An array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                                                      array must have a single element, which will be interpreted as an integer.
+                                                                      This array is replaced during a strategic merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                    required:
+                                                      - nodeSelectorTerms
+                                                    type: object
+                                                    x-kubernetes-map-type: atomic
+                                                type: object
+                                              podAffinity:
+                                                description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
+                                                properties:
+                                                  preferredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      The scheduler will prefer to schedule pods to nodes that satisfy
+                                                      the affinity expressions specified by this field, but it may choose
+                                                      a node that violates one or more of the expressions. The node that is
+                                                      most preferred is the one with the greatest sum of weights, i.e.
+                                                      for each node that meets all of the scheduling requirements (resource
+                                                      request, requiredDuringScheduling affinity expressions, etc.),
+                                                      compute a sum by iterating through the elements of this field and adding
+                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                                      node(s) with the highest sum are the most preferred.
+                                                    items:
+                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+                                                      properties:
+                                                        podAffinityTerm:
+                                                          description: Required. A pod affinity term, associated with the corresponding weight.
+                                                          properties:
+                                                            labelSelector:
+                                                              description: |-
+                                                                A label query over a set of resources, in this case pods.
+                                                                If it's null, this PodAffinityTerm matches with no Pods.
+                                                              properties:
+                                                                matchExpressions:
+                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                  items:
+                                                                    description: |-
+                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                      relates the key and values.
+                                                                    properties:
+                                                                      key:
+                                                                        description: key is the label key that the selector applies to.
+                                                                        type: string
+                                                                      operator:
+                                                                        description: |-
+                                                                          operator represents a key's relationship to a set of values.
+                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                        type: string
+                                                                      values:
+                                                                        description: |-
+                                                                          values is an array of string values. If the operator is In or NotIn,
+                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                          the values array must be empty. This array is replaced during a strategic
+                                                                          merge patch.
+                                                                        items:
+                                                                          type: string
+                                                                        type: array
+                                                                        x-kubernetes-list-type: atomic
+                                                                    required:
+                                                                      - key
+                                                                      - operator
+                                                                    type: object
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                                matchLabels:
+                                                                  additionalProperties:
+                                                                    type: string
+                                                                  description: |-
+                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                  type: object
+                                                              type: object
+                                                              x-kubernetes-map-type: atomic
+                                                            matchLabelKeys:
+                                                              description: |-
+                                                                MatchLabelKeys is a set of pod label keys to select which pods will
+                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                pod labels will be ignored. The default value is empty.
+                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            mismatchLabelKeys:
+                                                              description: |-
+                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                pod labels will be ignored. The default value is empty.
+                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            namespaceSelector:
+                                                              description: |-
+                                                                A label query over the set of namespaces that the term applies to.
+                                                                The term is applied to the union of the namespaces selected by this field
+                                                                and the ones listed in the namespaces field.
+                                                                null selector and null or empty namespaces list means "this pod's namespace".
+                                                                An empty selector ({}) matches all namespaces.
+                                                              properties:
+                                                                matchExpressions:
+                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                  items:
+                                                                    description: |-
+                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                      relates the key and values.
+                                                                    properties:
+                                                                      key:
+                                                                        description: key is the label key that the selector applies to.
+                                                                        type: string
+                                                                      operator:
+                                                                        description: |-
+                                                                          operator represents a key's relationship to a set of values.
+                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                        type: string
+                                                                      values:
+                                                                        description: |-
+                                                                          values is an array of string values. If the operator is In or NotIn,
+                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                          the values array must be empty. This array is replaced during a strategic
+                                                                          merge patch.
+                                                                        items:
+                                                                          type: string
+                                                                        type: array
+                                                                        x-kubernetes-list-type: atomic
+                                                                    required:
+                                                                      - key
+                                                                      - operator
+                                                                    type: object
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                                matchLabels:
+                                                                  additionalProperties:
+                                                                    type: string
+                                                                  description: |-
+                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                  type: object
+                                                              type: object
+                                                              x-kubernetes-map-type: atomic
+                                                            namespaces:
+                                                              description: |-
+                                                                namespaces specifies a static list of namespace names that the term applies to.
+                                                                The term is applied to the union of the namespaces listed in this field
+                                                                and the ones selected by namespaceSelector.
+                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            topologyKey:
+                                                              description: |-
+                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                                whose value of the label with key topologyKey matches that of any node on which any of the
+                                                                selected pods is running.
+                                                                Empty topologyKey is not allowed.
+                                                              type: string
+                                                          required:
+                                                            - topologyKey
+                                                          type: object
+                                                        weight:
+                                                          description: |-
+                                                            weight associated with matching the corresponding podAffinityTerm,
+                                                            in the range 1-100.
+                                                          format: int32
+                                                          type: integer
+                                                      required:
+                                                        - podAffinityTerm
+                                                        - weight
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  requiredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      If the affinity requirements specified by this field are not met at
+                                                      scheduling time, the pod will not be scheduled onto the node.
+                                                      If the affinity requirements specified by this field cease to be met
+                                                      at some point during pod execution (e.g. due to a pod label update), the
+                                                      system may or may not try to eventually evict the pod from its node.
+                                                      When there are multiple elements, the lists of nodes corresponding to each
+                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                                    items:
+                                                      description: |-
+                                                        Defines a set of pods (namely those matching the labelSelector
+                                                        relative to the given namespace(s)) that this pod should be
+                                                        co-located (affinity) or not co-located (anti-affinity) with,
+                                                        where co-located is defined as running on a node whose value of
+                                                        the label with key <topologyKey> matches that of any node on which
+                                                        a pod of the set of pods is running
+                                                      properties:
+                                                        labelSelector:
+                                                          description: |-
+                                                            A label query over a set of resources, in this case pods.
+                                                            If it's null, this PodAffinityTerm matches with no Pods.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                              items:
+                                                                description: |-
+                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                  relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: key is the label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      operator represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      values is an array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. This array is replaced during a strategic
+                                                                      merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchLabels:
+                                                              additionalProperties:
+                                                                type: string
+                                                              description: |-
+                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                              type: object
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        matchLabelKeys:
+                                                          description: |-
+                                                            MatchLabelKeys is a set of pod label keys to select which pods will
+                                                            be taken into consideration. The keys are used to lookup values from the
+                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                            to select the group of existing pods which pods will be taken into consideration
+                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                            pod labels will be ignored. The default value is empty.
+                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        mismatchLabelKeys:
+                                                          description: |-
+                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                            be taken into consideration. The keys are used to lookup values from the
+                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                            to select the group of existing pods which pods will be taken into consideration
+                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                            pod labels will be ignored. The default value is empty.
+                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        namespaceSelector:
+                                                          description: |-
+                                                            A label query over the set of namespaces that the term applies to.
+                                                            The term is applied to the union of the namespaces selected by this field
+                                                            and the ones listed in the namespaces field.
+                                                            null selector and null or empty namespaces list means "this pod's namespace".
+                                                            An empty selector ({}) matches all namespaces.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                              items:
+                                                                description: |-
+                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                  relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: key is the label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      operator represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      values is an array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. This array is replaced during a strategic
+                                                                      merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchLabels:
+                                                              additionalProperties:
+                                                                type: string
+                                                              description: |-
+                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                              type: object
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        namespaces:
+                                                          description: |-
+                                                            namespaces specifies a static list of namespace names that the term applies to.
+                                                            The term is applied to the union of the namespaces listed in this field
+                                                            and the ones selected by namespaceSelector.
+                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        topologyKey:
+                                                          description: |-
+                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                            whose value of the label with key topologyKey matches that of any node on which any of the
+                                                            selected pods is running.
+                                                            Empty topologyKey is not allowed.
+                                                          type: string
+                                                      required:
+                                                        - topologyKey
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                type: object
+                                              podAntiAffinity:
+                                                description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
+                                                properties:
+                                                  preferredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      The scheduler will prefer to schedule pods to nodes that satisfy
+                                                      the anti-affinity expressions specified by this field, but it may choose
+                                                      a node that violates one or more of the expressions. The node that is
+                                                      most preferred is the one with the greatest sum of weights, i.e.
+                                                      for each node that meets all of the scheduling requirements (resource
+                                                      request, requiredDuringScheduling anti-affinity expressions, etc.),
+                                                      compute a sum by iterating through the elements of this field and subtracting
+                                                      "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                                      node(s) with the highest sum are the most preferred.
+                                                    items:
+                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+                                                      properties:
+                                                        podAffinityTerm:
+                                                          description: Required. A pod affinity term, associated with the corresponding weight.
+                                                          properties:
+                                                            labelSelector:
+                                                              description: |-
+                                                                A label query over a set of resources, in this case pods.
+                                                                If it's null, this PodAffinityTerm matches with no Pods.
+                                                              properties:
+                                                                matchExpressions:
+                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                  items:
+                                                                    description: |-
+                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                      relates the key and values.
+                                                                    properties:
+                                                                      key:
+                                                                        description: key is the label key that the selector applies to.
+                                                                        type: string
+                                                                      operator:
+                                                                        description: |-
+                                                                          operator represents a key's relationship to a set of values.
+                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                        type: string
+                                                                      values:
+                                                                        description: |-
+                                                                          values is an array of string values. If the operator is In or NotIn,
+                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                          the values array must be empty. This array is replaced during a strategic
+                                                                          merge patch.
+                                                                        items:
+                                                                          type: string
+                                                                        type: array
+                                                                        x-kubernetes-list-type: atomic
+                                                                    required:
+                                                                      - key
+                                                                      - operator
+                                                                    type: object
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                                matchLabels:
+                                                                  additionalProperties:
+                                                                    type: string
+                                                                  description: |-
+                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                  type: object
+                                                              type: object
+                                                              x-kubernetes-map-type: atomic
+                                                            matchLabelKeys:
+                                                              description: |-
+                                                                MatchLabelKeys is a set of pod label keys to select which pods will
+                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                pod labels will be ignored. The default value is empty.
+                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            mismatchLabelKeys:
+                                                              description: |-
+                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                pod labels will be ignored. The default value is empty.
+                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            namespaceSelector:
+                                                              description: |-
+                                                                A label query over the set of namespaces that the term applies to.
+                                                                The term is applied to the union of the namespaces selected by this field
+                                                                and the ones listed in the namespaces field.
+                                                                null selector and null or empty namespaces list means "this pod's namespace".
+                                                                An empty selector ({}) matches all namespaces.
+                                                              properties:
+                                                                matchExpressions:
+                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                  items:
+                                                                    description: |-
+                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                      relates the key and values.
+                                                                    properties:
+                                                                      key:
+                                                                        description: key is the label key that the selector applies to.
+                                                                        type: string
+                                                                      operator:
+                                                                        description: |-
+                                                                          operator represents a key's relationship to a set of values.
+                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                        type: string
+                                                                      values:
+                                                                        description: |-
+                                                                          values is an array of string values. If the operator is In or NotIn,
+                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                          the values array must be empty. This array is replaced during a strategic
+                                                                          merge patch.
+                                                                        items:
+                                                                          type: string
+                                                                        type: array
+                                                                        x-kubernetes-list-type: atomic
+                                                                    required:
+                                                                      - key
+                                                                      - operator
+                                                                    type: object
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                                matchLabels:
+                                                                  additionalProperties:
+                                                                    type: string
+                                                                  description: |-
+                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                  type: object
+                                                              type: object
+                                                              x-kubernetes-map-type: atomic
+                                                            namespaces:
+                                                              description: |-
+                                                                namespaces specifies a static list of namespace names that the term applies to.
+                                                                The term is applied to the union of the namespaces listed in this field
+                                                                and the ones selected by namespaceSelector.
+                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            topologyKey:
+                                                              description: |-
+                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                                whose value of the label with key topologyKey matches that of any node on which any of the
+                                                                selected pods is running.
+                                                                Empty topologyKey is not allowed.
+                                                              type: string
+                                                          required:
+                                                            - topologyKey
+                                                          type: object
+                                                        weight:
+                                                          description: |-
+                                                            weight associated with matching the corresponding podAffinityTerm,
+                                                            in the range 1-100.
+                                                          format: int32
+                                                          type: integer
+                                                      required:
+                                                        - podAffinityTerm
+                                                        - weight
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  requiredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      If the anti-affinity requirements specified by this field are not met at
+                                                      scheduling time, the pod will not be scheduled onto the node.
+                                                      If the anti-affinity requirements specified by this field cease to be met
+                                                      at some point during pod execution (e.g. due to a pod label update), the
+                                                      system may or may not try to eventually evict the pod from its node.
+                                                      When there are multiple elements, the lists of nodes corresponding to each
+                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                                    items:
+                                                      description: |-
+                                                        Defines a set of pods (namely those matching the labelSelector
+                                                        relative to the given namespace(s)) that this pod should be
+                                                        co-located (affinity) or not co-located (anti-affinity) with,
+                                                        where co-located is defined as running on a node whose value of
+                                                        the label with key <topologyKey> matches that of any node on which
+                                                        a pod of the set of pods is running
+                                                      properties:
+                                                        labelSelector:
+                                                          description: |-
+                                                            A label query over a set of resources, in this case pods.
+                                                            If it's null, this PodAffinityTerm matches with no Pods.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                              items:
+                                                                description: |-
+                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                  relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: key is the label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      operator represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      values is an array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. This array is replaced during a strategic
+                                                                      merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchLabels:
+                                                              additionalProperties:
+                                                                type: string
+                                                              description: |-
+                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                              type: object
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        matchLabelKeys:
+                                                          description: |-
+                                                            MatchLabelKeys is a set of pod label keys to select which pods will
+                                                            be taken into consideration. The keys are used to lookup values from the
+                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                            to select the group of existing pods which pods will be taken into consideration
+                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                            pod labels will be ignored. The default value is empty.
+                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        mismatchLabelKeys:
+                                                          description: |-
+                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                            be taken into consideration. The keys are used to lookup values from the
+                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                            to select the group of existing pods which pods will be taken into consideration
+                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                            pod labels will be ignored. The default value is empty.
+                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        namespaceSelector:
+                                                          description: |-
+                                                            A label query over the set of namespaces that the term applies to.
+                                                            The term is applied to the union of the namespaces selected by this field
+                                                            and the ones listed in the namespaces field.
+                                                            null selector and null or empty namespaces list means "this pod's namespace".
+                                                            An empty selector ({}) matches all namespaces.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                              items:
+                                                                description: |-
+                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                  relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: key is the label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      operator represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      values is an array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. This array is replaced during a strategic
+                                                                      merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchLabels:
+                                                              additionalProperties:
+                                                                type: string
+                                                              description: |-
+                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                              type: object
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        namespaces:
+                                                          description: |-
+                                                            namespaces specifies a static list of namespace names that the term applies to.
+                                                            The term is applied to the union of the namespaces listed in this field
+                                                            and the ones selected by namespaceSelector.
+                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        topologyKey:
+                                                          description: |-
+                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                            whose value of the label with key topologyKey matches that of any node on which any of the
+                                                            selected pods is running.
+                                                            Empty topologyKey is not allowed.
+                                                          type: string
+                                                      required:
+                                                        - topologyKey
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                type: object
+                                            type: object
+                                          imagePullSecrets:
+                                            description: If specified, the pod's imagePullSecrets
+                                            items:
+                                              description: |-
+                                                LocalObjectReference contains enough information to let you locate the
+                                                referenced object inside the same namespace.
+                                              properties:
+                                                name:
+                                                  default: ""
+                                                  description: |-
+                                                    Name of the referent.
+                                                    This field is effectively required, but due to backwards compatibility is
+                                                    allowed to be empty. Instances of this type with an empty value here are
+                                                    almost certainly wrong.
+                                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                                  type: string
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            type: array
+                                            x-kubernetes-list-map-keys:
+                                              - name
+                                            x-kubernetes-list-type: map
+                                          nodeSelector:
+                                            additionalProperties:
+                                              type: string
+                                            description: |-
+                                              NodeSelector is a selector which must be true for the pod to fit on a node.
+                                              Selector which must match a node's labels for the pod to be scheduled on that node.
+                                              More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+                                            type: object
+                                          priorityClassName:
+                                            description: If specified, the pod's priorityClassName.
+                                            type: string
+                                          resources:
+                                            description: |-
+                                              If specified, the pod's resource requirements.
+                                              These values override the global resource configuration flags.
+                                              Note that when only specifying resource limits, ensure they are greater than or equal
+                                              to the corresponding global resource requests configured via controller flags
+                                              (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
+                                              Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
+                                            properties:
+                                              limits:
+                                                additionalProperties:
+                                                  anyOf:
+                                                    - type: integer
+                                                    - type: string
+                                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                  x-kubernetes-int-or-string: true
+                                                description: |-
+                                                  Limits describes the maximum amount of compute resources allowed.
+                                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                                type: object
+                                              requests:
+                                                additionalProperties:
+                                                  anyOf:
+                                                    - type: integer
+                                                    - type: string
+                                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                  x-kubernetes-int-or-string: true
+                                                description: |-
+                                                  Requests describes the minimum amount of compute resources required.
+                                                  If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                                  otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
+                                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                                type: object
+                                            type: object
+                                          securityContext:
+                                            description: If specified, the pod's security context
+                                            properties:
+                                              fsGroup:
+                                                description: |-
+                                                  A special supplemental group that applies to all containers in a pod.
+                                                  Some volume types allow the Kubelet to change the ownership of that volume
+                                                  to be owned by the pod:
+
+                                                  1. The owning GID will be the FSGroup
+                                                  2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
+                                                  3. The permission bits are OR'd with rw-rw----
+
+                                                  If unset, the Kubelet will not modify the ownership and permissions of any volume.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                format: int64
+                                                type: integer
+                                              fsGroupChangePolicy:
+                                                description: |-
+                                                  fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
+                                                  before being exposed inside Pod. This field will only apply to
+                                                  volume types which support fsGroup based ownership(and permissions).
+                                                  It will have no effect on ephemeral volume types such as: secret, configmaps
+                                                  and emptydir.
+                                                  Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                type: string
+                                              runAsGroup:
+                                                description: |-
+                                                  The GID to run the entrypoint of the container process.
+                                                  Uses runtime default if unset.
+                                                  May also be set in SecurityContext.  If set in both SecurityContext and
+                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
+                                                  for that container.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                format: int64
+                                                type: integer
+                                              runAsNonRoot:
+                                                description: |-
+                                                  Indicates that the container must run as a non-root user.
+                                                  If true, the Kubelet will validate the image at runtime to ensure that it
+                                                  does not run as UID 0 (root) and fail to start the container if it does.
+                                                  If unset or false, no such validation will be performed.
+                                                  May also be set in SecurityContext.  If set in both SecurityContext and
+                                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                                type: boolean
+                                              runAsUser:
+                                                description: |-
+                                                  The UID to run the entrypoint of the container process.
+                                                  Defaults to user specified in image metadata if unspecified.
+                                                  May also be set in SecurityContext.  If set in both SecurityContext and
+                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
+                                                  for that container.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                format: int64
+                                                type: integer
+                                              seLinuxOptions:
+                                                description: |-
+                                                  The SELinux context to be applied to all containers.
+                                                  If unspecified, the container runtime will allocate a random SELinux context for each
+                                                  container.  May also be set in SecurityContext.  If set in
+                                                  both SecurityContext and PodSecurityContext, the value specified in SecurityContext
+                                                  takes precedence for that container.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                properties:
+                                                  level:
+                                                    description: Level is SELinux level label that applies to the container.
+                                                    type: string
+                                                  role:
+                                                    description: Role is a SELinux role label that applies to the container.
+                                                    type: string
+                                                  type:
+                                                    description: Type is a SELinux type label that applies to the container.
+                                                    type: string
+                                                  user:
+                                                    description: User is a SELinux user label that applies to the container.
+                                                    type: string
+                                                type: object
+                                              seccompProfile:
+                                                description: |-
+                                                  The seccomp options to use by the containers in this pod.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                properties:
+                                                  localhostProfile:
+                                                    description: |-
+                                                      localhostProfile indicates a profile defined in a file on the node should be used.
+                                                      The profile must be preconfigured on the node to work.
+                                                      Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                                                      Must be set if type is "Localhost". Must NOT be set for any other type.
+                                                    type: string
+                                                  type:
+                                                    description: |-
+                                                      type indicates which kind of seccomp profile will be applied.
+                                                      Valid options are:
+
+                                                      Localhost - a profile defined in a file on the node should be used.
+                                                      RuntimeDefault - the container runtime default profile should be used.
+                                                      Unconfined - no profile should be applied.
+                                                    type: string
+                                                required:
+                                                  - type
+                                                type: object
+                                              supplementalGroups:
+                                                description: |-
+                                                  A list of groups applied to the first process run in each container, in addition
+                                                  to the container's primary GID, the fsGroup (if specified), and group memberships
+                                                  defined in the container image for the uid of the container process. If unspecified,
+                                                  no additional groups are added to any container. Note that group memberships
+                                                  defined in the container image for the uid of the container process are still effective,
+                                                  even if they are not included in this list.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                items:
+                                                  format: int64
+                                                  type: integer
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              sysctls:
+                                                description: |-
+                                                  Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
+                                                  sysctls (by the container runtime) might fail to launch.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                items:
+                                                  description: Sysctl defines a kernel parameter to be set
+                                                  properties:
+                                                    name:
+                                                      description: Name of a property to set
+                                                      type: string
+                                                    value:
+                                                      description: Value of a property to set
+                                                      type: string
+                                                  required:
+                                                    - name
+                                                    - value
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            type: object
+                                          serviceAccountName:
+                                            description: If specified, the pod's service account
+                                            type: string
+                                          tolerations:
+                                            description: If specified, the pod's tolerations.
+                                            items:
+                                              description: |-
+                                                The pod this Toleration is attached to tolerates any taint that matches
+                                                the triple <key,value,effect> using the matching operator <operator>.
+                                              properties:
+                                                effect:
+                                                  description: |-
+                                                    Effect indicates the taint effect to match. Empty means match all taint effects.
+                                                    When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+                                                  type: string
+                                                key:
+                                                  description: |-
+                                                    Key is the taint key that the toleration applies to. Empty means match all taint keys.
+                                                    If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+                                                  type: string
+                                                operator:
+                                                  description: |-
+                                                    Operator represents a key's relationship to the value.
+                                                    Valid operators are Exists and Equal. Defaults to Equal.
+                                                    Exists is equivalent to wildcard for value, so that a pod can
+                                                    tolerate all taints of a particular category.
+                                                  type: string
+                                                tolerationSeconds:
+                                                  description: |-
+                                                    TolerationSeconds represents the period of time the toleration (which must be
+                                                    of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+                                                    it is not set, which means tolerate the taint forever (do not evict). Zero and
+                                                    negative values will be treated as 0 (evict immediately) by the system.
+                                                  format: int64
+                                                  type: integer
+                                                value:
+                                                  description: |-
+                                                    Value is the taint value the toleration matches to.
+                                                    If the operator is Exists, the value should be empty, otherwise just a regular string.
+                                                  type: string
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        type: object
+                                    type: object
+                                  serviceType:
+                                    description: |-
+                                      Optional service type for Kubernetes solver service. Supported values
+                                      are NodePort or ClusterIP. If unset, defaults to NodePort.
+                                    type: string
+                                type: object
+                              ingress:
+                                description: |-
+                                  The ingress based HTTP01 challenge solver will solve challenges by
+                                  creating or modifying Ingress resources in order to route requests for
+                                  '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
+                                  provisioned by cert-manager for each Challenge to be completed.
+                                properties:
+                                  class:
+                                    description: |-
+                                      This field configures the annotation `kubernetes.io/ingress.class` when
+                                      creating Ingress resources to solve ACME challenges that use this
+                                      challenge solver. Only one of `class`, `name` or `ingressClassName` may
+                                      be specified.
+                                    type: string
+                                  ingressClassName:
+                                    description: |-
+                                      This field configures the field `ingressClassName` on the created Ingress
+                                      resources used to solve ACME challenges that use this challenge solver.
+                                      This is the recommended way of configuring the ingress class. Only one of
+                                      `class`, `name` or `ingressClassName` may be specified.
+                                    type: string
+                                  ingressTemplate:
+                                    description: |-
+                                      Optional ingress template used to configure the ACME challenge solver
+                                      ingress used for HTTP01 challenges.
+                                    properties:
+                                      metadata:
+                                        description: |-
+                                          ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
+                                          Only the 'labels' and 'annotations' fields may be set.
+                                          If labels or annotations overlap with in-built values, the values here
+                                          will override the in-built values.
+                                        properties:
+                                          annotations:
+                                            additionalProperties:
+                                              type: string
+                                            description: Annotations that should be added to the created ACME HTTP01 solver ingress.
+                                            type: object
+                                          labels:
+                                            additionalProperties:
+                                              type: string
+                                            description: Labels that should be added to the created ACME HTTP01 solver ingress.
+                                            type: object
+                                        type: object
+                                    type: object
+                                  name:
+                                    description: |-
+                                      The name of the ingress resource that should have ACME challenge solving
+                                      routes inserted into it in order to solve HTTP01 challenges.
+                                      This is typically used in conjunction with ingress controllers like
+                                      ingress-gce, which maintains a 1:1 mapping between external IPs and
+                                      ingress resources. Only one of `class`, `name` or `ingressClassName` may
+                                      be specified.
+                                    type: string
+                                  podTemplate:
+                                    description: |-
+                                      Optional pod template used to configure the ACME challenge solver pods
+                                      used for HTTP01 challenges.
+                                    properties:
+                                      metadata:
+                                        description: |-
+                                          ObjectMeta overrides for the pod used to solve HTTP01 challenges.
+                                          Only the 'labels' and 'annotations' fields may be set.
+                                          If labels or annotations overlap with in-built values, the values here
+                                          will override the in-built values.
+                                        properties:
+                                          annotations:
+                                            additionalProperties:
+                                              type: string
+                                            description: Annotations that should be added to the created ACME HTTP01 solver pods.
+                                            type: object
+                                          labels:
+                                            additionalProperties:
+                                              type: string
+                                            description: Labels that should be added to the created ACME HTTP01 solver pods.
+                                            type: object
+                                        type: object
+                                      spec:
+                                        description: |-
+                                          PodSpec defines overrides for the HTTP01 challenge solver pod.
+                                          Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
+                                          All other fields will be ignored.
+                                        properties:
+                                          affinity:
+                                            description: If specified, the pod's scheduling constraints
+                                            properties:
+                                              nodeAffinity:
+                                                description: Describes node affinity scheduling rules for the pod.
+                                                properties:
+                                                  preferredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      The scheduler will prefer to schedule pods to nodes that satisfy
+                                                      the affinity expressions specified by this field, but it may choose
+                                                      a node that violates one or more of the expressions. The node that is
+                                                      most preferred is the one with the greatest sum of weights, i.e.
+                                                      for each node that meets all of the scheduling requirements (resource
+                                                      request, requiredDuringScheduling affinity expressions, etc.),
+                                                      compute a sum by iterating through the elements of this field and adding
+                                                      "weight" to the sum if the node matches the corresponding matchExpressions; the
+                                                      node(s) with the highest sum are the most preferred.
+                                                    items:
+                                                      description: |-
+                                                        An empty preferred scheduling term matches all objects with implicit weight 0
+                                                        (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+                                                      properties:
+                                                        preference:
+                                                          description: A node selector term, associated with the corresponding weight.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: A list of node selector requirements by node's labels.
+                                                              items:
+                                                                description: |-
+                                                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                                                  that relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: The label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      Represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      An array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                                                      array must have a single element, which will be interpreted as an integer.
+                                                                      This array is replaced during a strategic merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchFields:
+                                                              description: A list of node selector requirements by node's fields.
+                                                              items:
+                                                                description: |-
+                                                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                                                  that relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: The label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      Represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      An array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                                                      array must have a single element, which will be interpreted as an integer.
+                                                                      This array is replaced during a strategic merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        weight:
+                                                          description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
+                                                          format: int32
+                                                          type: integer
+                                                      required:
+                                                        - preference
+                                                        - weight
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  requiredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      If the affinity requirements specified by this field are not met at
+                                                      scheduling time, the pod will not be scheduled onto the node.
+                                                      If the affinity requirements specified by this field cease to be met
+                                                      at some point during pod execution (e.g. due to an update), the system
+                                                      may or may not try to eventually evict the pod from its node.
+                                                    properties:
+                                                      nodeSelectorTerms:
+                                                        description: Required. A list of node selector terms. The terms are ORed.
+                                                        items:
+                                                          description: |-
+                                                            A null or empty node selector term matches no objects. The requirements of
+                                                            them are ANDed.
+                                                            The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: A list of node selector requirements by node's labels.
+                                                              items:
+                                                                description: |-
+                                                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                                                  that relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: The label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      Represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      An array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                                                      array must have a single element, which will be interpreted as an integer.
+                                                                      This array is replaced during a strategic merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchFields:
+                                                              description: A list of node selector requirements by node's fields.
+                                                              items:
+                                                                description: |-
+                                                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                                                  that relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: The label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      Represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      An array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                                                      array must have a single element, which will be interpreted as an integer.
+                                                                      This array is replaced during a strategic merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                    required:
+                                                      - nodeSelectorTerms
+                                                    type: object
+                                                    x-kubernetes-map-type: atomic
+                                                type: object
+                                              podAffinity:
+                                                description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
+                                                properties:
+                                                  preferredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      The scheduler will prefer to schedule pods to nodes that satisfy
+                                                      the affinity expressions specified by this field, but it may choose
+                                                      a node that violates one or more of the expressions. The node that is
+                                                      most preferred is the one with the greatest sum of weights, i.e.
+                                                      for each node that meets all of the scheduling requirements (resource
+                                                      request, requiredDuringScheduling affinity expressions, etc.),
+                                                      compute a sum by iterating through the elements of this field and adding
+                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                                      node(s) with the highest sum are the most preferred.
+                                                    items:
+                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+                                                      properties:
+                                                        podAffinityTerm:
+                                                          description: Required. A pod affinity term, associated with the corresponding weight.
+                                                          properties:
+                                                            labelSelector:
+                                                              description: |-
+                                                                A label query over a set of resources, in this case pods.
+                                                                If it's null, this PodAffinityTerm matches with no Pods.
+                                                              properties:
+                                                                matchExpressions:
+                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                  items:
+                                                                    description: |-
+                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                      relates the key and values.
+                                                                    properties:
+                                                                      key:
+                                                                        description: key is the label key that the selector applies to.
+                                                                        type: string
+                                                                      operator:
+                                                                        description: |-
+                                                                          operator represents a key's relationship to a set of values.
+                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                        type: string
+                                                                      values:
+                                                                        description: |-
+                                                                          values is an array of string values. If the operator is In or NotIn,
+                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                          the values array must be empty. This array is replaced during a strategic
+                                                                          merge patch.
+                                                                        items:
+                                                                          type: string
+                                                                        type: array
+                                                                        x-kubernetes-list-type: atomic
+                                                                    required:
+                                                                      - key
+                                                                      - operator
+                                                                    type: object
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                                matchLabels:
+                                                                  additionalProperties:
+                                                                    type: string
+                                                                  description: |-
+                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                  type: object
+                                                              type: object
+                                                              x-kubernetes-map-type: atomic
+                                                            matchLabelKeys:
+                                                              description: |-
+                                                                MatchLabelKeys is a set of pod label keys to select which pods will
+                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                pod labels will be ignored. The default value is empty.
+                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            mismatchLabelKeys:
+                                                              description: |-
+                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                pod labels will be ignored. The default value is empty.
+                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            namespaceSelector:
+                                                              description: |-
+                                                                A label query over the set of namespaces that the term applies to.
+                                                                The term is applied to the union of the namespaces selected by this field
+                                                                and the ones listed in the namespaces field.
+                                                                null selector and null or empty namespaces list means "this pod's namespace".
+                                                                An empty selector ({}) matches all namespaces.
+                                                              properties:
+                                                                matchExpressions:
+                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                  items:
+                                                                    description: |-
+                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                      relates the key and values.
+                                                                    properties:
+                                                                      key:
+                                                                        description: key is the label key that the selector applies to.
+                                                                        type: string
+                                                                      operator:
+                                                                        description: |-
+                                                                          operator represents a key's relationship to a set of values.
+                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                        type: string
+                                                                      values:
+                                                                        description: |-
+                                                                          values is an array of string values. If the operator is In or NotIn,
+                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                          the values array must be empty. This array is replaced during a strategic
+                                                                          merge patch.
+                                                                        items:
+                                                                          type: string
+                                                                        type: array
+                                                                        x-kubernetes-list-type: atomic
+                                                                    required:
+                                                                      - key
+                                                                      - operator
+                                                                    type: object
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                                matchLabels:
+                                                                  additionalProperties:
+                                                                    type: string
+                                                                  description: |-
+                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                  type: object
+                                                              type: object
+                                                              x-kubernetes-map-type: atomic
+                                                            namespaces:
+                                                              description: |-
+                                                                namespaces specifies a static list of namespace names that the term applies to.
+                                                                The term is applied to the union of the namespaces listed in this field
+                                                                and the ones selected by namespaceSelector.
+                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            topologyKey:
+                                                              description: |-
+                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                                whose value of the label with key topologyKey matches that of any node on which any of the
+                                                                selected pods is running.
+                                                                Empty topologyKey is not allowed.
+                                                              type: string
+                                                          required:
+                                                            - topologyKey
+                                                          type: object
+                                                        weight:
+                                                          description: |-
+                                                            weight associated with matching the corresponding podAffinityTerm,
+                                                            in the range 1-100.
+                                                          format: int32
+                                                          type: integer
+                                                      required:
+                                                        - podAffinityTerm
+                                                        - weight
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  requiredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      If the affinity requirements specified by this field are not met at
+                                                      scheduling time, the pod will not be scheduled onto the node.
+                                                      If the affinity requirements specified by this field cease to be met
+                                                      at some point during pod execution (e.g. due to a pod label update), the
+                                                      system may or may not try to eventually evict the pod from its node.
+                                                      When there are multiple elements, the lists of nodes corresponding to each
+                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                                    items:
+                                                      description: |-
+                                                        Defines a set of pods (namely those matching the labelSelector
+                                                        relative to the given namespace(s)) that this pod should be
+                                                        co-located (affinity) or not co-located (anti-affinity) with,
+                                                        where co-located is defined as running on a node whose value of
+                                                        the label with key <topologyKey> matches that of any node on which
+                                                        a pod of the set of pods is running
+                                                      properties:
+                                                        labelSelector:
+                                                          description: |-
+                                                            A label query over a set of resources, in this case pods.
+                                                            If it's null, this PodAffinityTerm matches with no Pods.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                              items:
+                                                                description: |-
+                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                  relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: key is the label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      operator represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      values is an array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. This array is replaced during a strategic
+                                                                      merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchLabels:
+                                                              additionalProperties:
+                                                                type: string
+                                                              description: |-
+                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                              type: object
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        matchLabelKeys:
+                                                          description: |-
+                                                            MatchLabelKeys is a set of pod label keys to select which pods will
+                                                            be taken into consideration. The keys are used to lookup values from the
+                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                            to select the group of existing pods which pods will be taken into consideration
+                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                            pod labels will be ignored. The default value is empty.
+                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        mismatchLabelKeys:
+                                                          description: |-
+                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                            be taken into consideration. The keys are used to lookup values from the
+                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                            to select the group of existing pods which pods will be taken into consideration
+                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                            pod labels will be ignored. The default value is empty.
+                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        namespaceSelector:
+                                                          description: |-
+                                                            A label query over the set of namespaces that the term applies to.
+                                                            The term is applied to the union of the namespaces selected by this field
+                                                            and the ones listed in the namespaces field.
+                                                            null selector and null or empty namespaces list means "this pod's namespace".
+                                                            An empty selector ({}) matches all namespaces.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                              items:
+                                                                description: |-
+                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                  relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: key is the label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      operator represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      values is an array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. This array is replaced during a strategic
+                                                                      merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchLabels:
+                                                              additionalProperties:
+                                                                type: string
+                                                              description: |-
+                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                              type: object
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        namespaces:
+                                                          description: |-
+                                                            namespaces specifies a static list of namespace names that the term applies to.
+                                                            The term is applied to the union of the namespaces listed in this field
+                                                            and the ones selected by namespaceSelector.
+                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        topologyKey:
+                                                          description: |-
+                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                            whose value of the label with key topologyKey matches that of any node on which any of the
+                                                            selected pods is running.
+                                                            Empty topologyKey is not allowed.
+                                                          type: string
+                                                      required:
+                                                        - topologyKey
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                type: object
+                                              podAntiAffinity:
+                                                description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
+                                                properties:
+                                                  preferredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      The scheduler will prefer to schedule pods to nodes that satisfy
+                                                      the anti-affinity expressions specified by this field, but it may choose
+                                                      a node that violates one or more of the expressions. The node that is
+                                                      most preferred is the one with the greatest sum of weights, i.e.
+                                                      for each node that meets all of the scheduling requirements (resource
+                                                      request, requiredDuringScheduling anti-affinity expressions, etc.),
+                                                      compute a sum by iterating through the elements of this field and subtracting
+                                                      "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                                      node(s) with the highest sum are the most preferred.
+                                                    items:
+                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+                                                      properties:
+                                                        podAffinityTerm:
+                                                          description: Required. A pod affinity term, associated with the corresponding weight.
+                                                          properties:
+                                                            labelSelector:
+                                                              description: |-
+                                                                A label query over a set of resources, in this case pods.
+                                                                If it's null, this PodAffinityTerm matches with no Pods.
+                                                              properties:
+                                                                matchExpressions:
+                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                  items:
+                                                                    description: |-
+                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                      relates the key and values.
+                                                                    properties:
+                                                                      key:
+                                                                        description: key is the label key that the selector applies to.
+                                                                        type: string
+                                                                      operator:
+                                                                        description: |-
+                                                                          operator represents a key's relationship to a set of values.
+                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                        type: string
+                                                                      values:
+                                                                        description: |-
+                                                                          values is an array of string values. If the operator is In or NotIn,
+                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                          the values array must be empty. This array is replaced during a strategic
+                                                                          merge patch.
+                                                                        items:
+                                                                          type: string
+                                                                        type: array
+                                                                        x-kubernetes-list-type: atomic
+                                                                    required:
+                                                                      - key
+                                                                      - operator
+                                                                    type: object
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                                matchLabels:
+                                                                  additionalProperties:
+                                                                    type: string
+                                                                  description: |-
+                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                  type: object
+                                                              type: object
+                                                              x-kubernetes-map-type: atomic
+                                                            matchLabelKeys:
+                                                              description: |-
+                                                                MatchLabelKeys is a set of pod label keys to select which pods will
+                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                pod labels will be ignored. The default value is empty.
+                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            mismatchLabelKeys:
+                                                              description: |-
+                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                pod labels will be ignored. The default value is empty.
+                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            namespaceSelector:
+                                                              description: |-
+                                                                A label query over the set of namespaces that the term applies to.
+                                                                The term is applied to the union of the namespaces selected by this field
+                                                                and the ones listed in the namespaces field.
+                                                                null selector and null or empty namespaces list means "this pod's namespace".
+                                                                An empty selector ({}) matches all namespaces.
+                                                              properties:
+                                                                matchExpressions:
+                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                  items:
+                                                                    description: |-
+                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                      relates the key and values.
+                                                                    properties:
+                                                                      key:
+                                                                        description: key is the label key that the selector applies to.
+                                                                        type: string
+                                                                      operator:
+                                                                        description: |-
+                                                                          operator represents a key's relationship to a set of values.
+                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                        type: string
+                                                                      values:
+                                                                        description: |-
+                                                                          values is an array of string values. If the operator is In or NotIn,
+                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                          the values array must be empty. This array is replaced during a strategic
+                                                                          merge patch.
+                                                                        items:
+                                                                          type: string
+                                                                        type: array
+                                                                        x-kubernetes-list-type: atomic
+                                                                    required:
+                                                                      - key
+                                                                      - operator
+                                                                    type: object
+                                                                  type: array
+                                                                  x-kubernetes-list-type: atomic
+                                                                matchLabels:
+                                                                  additionalProperties:
+                                                                    type: string
+                                                                  description: |-
+                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                  type: object
+                                                              type: object
+                                                              x-kubernetes-map-type: atomic
+                                                            namespaces:
+                                                              description: |-
+                                                                namespaces specifies a static list of namespace names that the term applies to.
+                                                                The term is applied to the union of the namespaces listed in this field
+                                                                and the ones selected by namespaceSelector.
+                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                              items:
+                                                                type: string
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            topologyKey:
+                                                              description: |-
+                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                                whose value of the label with key topologyKey matches that of any node on which any of the
+                                                                selected pods is running.
+                                                                Empty topologyKey is not allowed.
+                                                              type: string
+                                                          required:
+                                                            - topologyKey
+                                                          type: object
+                                                        weight:
+                                                          description: |-
+                                                            weight associated with matching the corresponding podAffinityTerm,
+                                                            in the range 1-100.
+                                                          format: int32
+                                                          type: integer
+                                                      required:
+                                                        - podAffinityTerm
+                                                        - weight
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  requiredDuringSchedulingIgnoredDuringExecution:
+                                                    description: |-
+                                                      If the anti-affinity requirements specified by this field are not met at
+                                                      scheduling time, the pod will not be scheduled onto the node.
+                                                      If the anti-affinity requirements specified by this field cease to be met
+                                                      at some point during pod execution (e.g. due to a pod label update), the
+                                                      system may or may not try to eventually evict the pod from its node.
+                                                      When there are multiple elements, the lists of nodes corresponding to each
+                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                                    items:
+                                                      description: |-
+                                                        Defines a set of pods (namely those matching the labelSelector
+                                                        relative to the given namespace(s)) that this pod should be
+                                                        co-located (affinity) or not co-located (anti-affinity) with,
+                                                        where co-located is defined as running on a node whose value of
+                                                        the label with key <topologyKey> matches that of any node on which
+                                                        a pod of the set of pods is running
+                                                      properties:
+                                                        labelSelector:
+                                                          description: |-
+                                                            A label query over a set of resources, in this case pods.
+                                                            If it's null, this PodAffinityTerm matches with no Pods.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                              items:
+                                                                description: |-
+                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                  relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: key is the label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      operator represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      values is an array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. This array is replaced during a strategic
+                                                                      merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchLabels:
+                                                              additionalProperties:
+                                                                type: string
+                                                              description: |-
+                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                              type: object
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        matchLabelKeys:
+                                                          description: |-
+                                                            MatchLabelKeys is a set of pod label keys to select which pods will
+                                                            be taken into consideration. The keys are used to lookup values from the
+                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                            to select the group of existing pods which pods will be taken into consideration
+                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                            pod labels will be ignored. The default value is empty.
+                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        mismatchLabelKeys:
+                                                          description: |-
+                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                            be taken into consideration. The keys are used to lookup values from the
+                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                            to select the group of existing pods which pods will be taken into consideration
+                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                            pod labels will be ignored. The default value is empty.
+                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        namespaceSelector:
+                                                          description: |-
+                                                            A label query over the set of namespaces that the term applies to.
+                                                            The term is applied to the union of the namespaces selected by this field
+                                                            and the ones listed in the namespaces field.
+                                                            null selector and null or empty namespaces list means "this pod's namespace".
+                                                            An empty selector ({}) matches all namespaces.
+                                                          properties:
+                                                            matchExpressions:
+                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                              items:
+                                                                description: |-
+                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                  relates the key and values.
+                                                                properties:
+                                                                  key:
+                                                                    description: key is the label key that the selector applies to.
+                                                                    type: string
+                                                                  operator:
+                                                                    description: |-
+                                                                      operator represents a key's relationship to a set of values.
+                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                    type: string
+                                                                  values:
+                                                                    description: |-
+                                                                      values is an array of string values. If the operator is In or NotIn,
+                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                      the values array must be empty. This array is replaced during a strategic
+                                                                      merge patch.
+                                                                    items:
+                                                                      type: string
+                                                                    type: array
+                                                                    x-kubernetes-list-type: atomic
+                                                                required:
+                                                                  - key
+                                                                  - operator
+                                                                type: object
+                                                              type: array
+                                                              x-kubernetes-list-type: atomic
+                                                            matchLabels:
+                                                              additionalProperties:
+                                                                type: string
+                                                              description: |-
+                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                              type: object
+                                                          type: object
+                                                          x-kubernetes-map-type: atomic
+                                                        namespaces:
+                                                          description: |-
+                                                            namespaces specifies a static list of namespace names that the term applies to.
+                                                            The term is applied to the union of the namespaces listed in this field
+                                                            and the ones selected by namespaceSelector.
+                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                        topologyKey:
+                                                          description: |-
+                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                            whose value of the label with key topologyKey matches that of any node on which any of the
+                                                            selected pods is running.
+                                                            Empty topologyKey is not allowed.
+                                                          type: string
+                                                      required:
+                                                        - topologyKey
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                type: object
+                                            type: object
+                                          imagePullSecrets:
+                                            description: If specified, the pod's imagePullSecrets
+                                            items:
+                                              description: |-
+                                                LocalObjectReference contains enough information to let you locate the
+                                                referenced object inside the same namespace.
+                                              properties:
+                                                name:
+                                                  default: ""
+                                                  description: |-
+                                                    Name of the referent.
+                                                    This field is effectively required, but due to backwards compatibility is
+                                                    allowed to be empty. Instances of this type with an empty value here are
+                                                    almost certainly wrong.
+                                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                                  type: string
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            type: array
+                                            x-kubernetes-list-map-keys:
+                                              - name
+                                            x-kubernetes-list-type: map
+                                          nodeSelector:
+                                            additionalProperties:
+                                              type: string
+                                            description: |-
+                                              NodeSelector is a selector which must be true for the pod to fit on a node.
+                                              Selector which must match a node's labels for the pod to be scheduled on that node.
+                                              More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+                                            type: object
+                                          priorityClassName:
+                                            description: If specified, the pod's priorityClassName.
+                                            type: string
+                                          resources:
+                                            description: |-
+                                              If specified, the pod's resource requirements.
+                                              These values override the global resource configuration flags.
+                                              Note that when only specifying resource limits, ensure they are greater than or equal
+                                              to the corresponding global resource requests configured via controller flags
+                                              (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
+                                              Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
+                                            properties:
+                                              limits:
+                                                additionalProperties:
+                                                  anyOf:
+                                                    - type: integer
+                                                    - type: string
+                                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                  x-kubernetes-int-or-string: true
+                                                description: |-
+                                                  Limits describes the maximum amount of compute resources allowed.
+                                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                                type: object
+                                              requests:
+                                                additionalProperties:
+                                                  anyOf:
+                                                    - type: integer
+                                                    - type: string
+                                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                  x-kubernetes-int-or-string: true
+                                                description: |-
+                                                  Requests describes the minimum amount of compute resources required.
+                                                  If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                                  otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
+                                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                                type: object
+                                            type: object
+                                          securityContext:
+                                            description: If specified, the pod's security context
+                                            properties:
+                                              fsGroup:
+                                                description: |-
+                                                  A special supplemental group that applies to all containers in a pod.
+                                                  Some volume types allow the Kubelet to change the ownership of that volume
+                                                  to be owned by the pod:
+
+                                                  1. The owning GID will be the FSGroup
+                                                  2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
+                                                  3. The permission bits are OR'd with rw-rw----
+
+                                                  If unset, the Kubelet will not modify the ownership and permissions of any volume.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                format: int64
+                                                type: integer
+                                              fsGroupChangePolicy:
+                                                description: |-
+                                                  fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
+                                                  before being exposed inside Pod. This field will only apply to
+                                                  volume types which support fsGroup based ownership(and permissions).
+                                                  It will have no effect on ephemeral volume types such as: secret, configmaps
+                                                  and emptydir.
+                                                  Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                type: string
+                                              runAsGroup:
+                                                description: |-
+                                                  The GID to run the entrypoint of the container process.
+                                                  Uses runtime default if unset.
+                                                  May also be set in SecurityContext.  If set in both SecurityContext and
+                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
+                                                  for that container.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                format: int64
+                                                type: integer
+                                              runAsNonRoot:
+                                                description: |-
+                                                  Indicates that the container must run as a non-root user.
+                                                  If true, the Kubelet will validate the image at runtime to ensure that it
+                                                  does not run as UID 0 (root) and fail to start the container if it does.
+                                                  If unset or false, no such validation will be performed.
+                                                  May also be set in SecurityContext.  If set in both SecurityContext and
+                                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                                type: boolean
+                                              runAsUser:
+                                                description: |-
+                                                  The UID to run the entrypoint of the container process.
+                                                  Defaults to user specified in image metadata if unspecified.
+                                                  May also be set in SecurityContext.  If set in both SecurityContext and
+                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
+                                                  for that container.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                format: int64
+                                                type: integer
+                                              seLinuxOptions:
+                                                description: |-
+                                                  The SELinux context to be applied to all containers.
+                                                  If unspecified, the container runtime will allocate a random SELinux context for each
+                                                  container.  May also be set in SecurityContext.  If set in
+                                                  both SecurityContext and PodSecurityContext, the value specified in SecurityContext
+                                                  takes precedence for that container.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                properties:
+                                                  level:
+                                                    description: Level is SELinux level label that applies to the container.
+                                                    type: string
+                                                  role:
+                                                    description: Role is a SELinux role label that applies to the container.
+                                                    type: string
+                                                  type:
+                                                    description: Type is a SELinux type label that applies to the container.
+                                                    type: string
+                                                  user:
+                                                    description: User is a SELinux user label that applies to the container.
+                                                    type: string
+                                                type: object
+                                              seccompProfile:
+                                                description: |-
+                                                  The seccomp options to use by the containers in this pod.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                properties:
+                                                  localhostProfile:
+                                                    description: |-
+                                                      localhostProfile indicates a profile defined in a file on the node should be used.
+                                                      The profile must be preconfigured on the node to work.
+                                                      Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                                                      Must be set if type is "Localhost". Must NOT be set for any other type.
+                                                    type: string
+                                                  type:
+                                                    description: |-
+                                                      type indicates which kind of seccomp profile will be applied.
+                                                      Valid options are:
+
+                                                      Localhost - a profile defined in a file on the node should be used.
+                                                      RuntimeDefault - the container runtime default profile should be used.
+                                                      Unconfined - no profile should be applied.
+                                                    type: string
+                                                required:
+                                                  - type
+                                                type: object
+                                              supplementalGroups:
+                                                description: |-
+                                                  A list of groups applied to the first process run in each container, in addition
+                                                  to the container's primary GID, the fsGroup (if specified), and group memberships
+                                                  defined in the container image for the uid of the container process. If unspecified,
+                                                  no additional groups are added to any container. Note that group memberships
+                                                  defined in the container image for the uid of the container process are still effective,
+                                                  even if they are not included in this list.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                items:
+                                                  format: int64
+                                                  type: integer
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              sysctls:
+                                                description: |-
+                                                  Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
+                                                  sysctls (by the container runtime) might fail to launch.
+                                                  Note that this field cannot be set when spec.os.name is windows.
+                                                items:
+                                                  description: Sysctl defines a kernel parameter to be set
+                                                  properties:
+                                                    name:
+                                                      description: Name of a property to set
+                                                      type: string
+                                                    value:
+                                                      description: Value of a property to set
+                                                      type: string
+                                                  required:
+                                                    - name
+                                                    - value
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            type: object
+                                          serviceAccountName:
+                                            description: If specified, the pod's service account
+                                            type: string
+                                          tolerations:
+                                            description: If specified, the pod's tolerations.
+                                            items:
+                                              description: |-
+                                                The pod this Toleration is attached to tolerates any taint that matches
+                                                the triple <key,value,effect> using the matching operator <operator>.
+                                              properties:
+                                                effect:
+                                                  description: |-
+                                                    Effect indicates the taint effect to match. Empty means match all taint effects.
+                                                    When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+                                                  type: string
+                                                key:
+                                                  description: |-
+                                                    Key is the taint key that the toleration applies to. Empty means match all taint keys.
+                                                    If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+                                                  type: string
+                                                operator:
+                                                  description: |-
+                                                    Operator represents a key's relationship to the value.
+                                                    Valid operators are Exists and Equal. Defaults to Equal.
+                                                    Exists is equivalent to wildcard for value, so that a pod can
+                                                    tolerate all taints of a particular category.
+                                                  type: string
+                                                tolerationSeconds:
+                                                  description: |-
+                                                    TolerationSeconds represents the period of time the toleration (which must be
+                                                    of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+                                                    it is not set, which means tolerate the taint forever (do not evict). Zero and
+                                                    negative values will be treated as 0 (evict immediately) by the system.
+                                                  format: int64
+                                                  type: integer
+                                                value:
+                                                  description: |-
+                                                    Value is the taint value the toleration matches to.
+                                                    If the operator is Exists, the value should be empty, otherwise just a regular string.
+                                                  type: string
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        type: object
+                                    type: object
+                                  serviceType:
+                                    description: |-
+                                      Optional service type for Kubernetes solver service. Supported values
+                                      are NodePort or ClusterIP. If unset, defaults to NodePort.
+                                    type: string
+                                type: object
+                            type: object
+                          selector:
+                            description: |-
+                              Selector selects a set of DNSNames on the Certificate resource that
+                              should be solved using this challenge solver.
+                              If not specified, the solver will be treated as the 'default' solver
+                              with the lowest priority, i.e. if any other solver has a more specific
+                              match, it will be used instead.
+                            properties:
+                              dnsNames:
+                                description: |-
+                                  List of DNSNames that this solver will be used to solve.
+                                  If specified and a match is found, a dnsNames selector will take
+                                  precedence over a dnsZones selector.
+                                  If multiple solvers match with the same dnsNames value, the solver
+                                  with the most matching labels in matchLabels will be selected.
+                                  If neither has more matches, the solver defined earlier in the list
+                                  will be selected.
+                                items:
+                                  type: string
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              dnsZones:
+                                description: |-
+                                  List of DNSZones that this solver will be used to solve.
+                                  The most specific DNS zone match specified here will take precedence
+                                  over other DNS zone matches, so a solver specifying sys.example.com
+                                  will be selected over one specifying example.com for the domain
+                                  www.sys.example.com.
+                                  If multiple solvers match with the same dnsZones value, the solver
+                                  with the most matching labels in matchLabels will be selected.
+                                  If neither has more matches, the solver defined earlier in the list
+                                  will be selected.
+                                items:
+                                  type: string
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              matchLabels:
+                                additionalProperties:
+                                  type: string
+                                description: |-
+                                  A label selector that is used to refine the set of certificate's that
+                                  this challenge solver will apply to.
+                                type: object
+                            type: object
+                        type: object
+                      type: array
+                      x-kubernetes-list-type: atomic
+                  required:
+                    - privateKeySecretRef
+                    - server
+                  type: object
+                ca:
+                  description: |-
+                    CA configures this issuer to sign certificates using a signing CA keypair
+                    stored in a Secret resource.
+                    This is used to build internal PKIs that are managed by cert-manager.
+                  properties:
+                    crlDistributionPoints:
+                      description: |-
+                        The CRL distribution points is an X.509 v3 certificate extension which identifies
+                        the location of the CRL from which the revocation of this certificate can be checked.
+                        If not set, certificates will be issued without distribution points set.
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    issuingCertificateURLs:
+                      description: |-
+                        IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates
+                        it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.
+                        As an example, such a URL might be "http://ca.domain.com/ca.crt".
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    ocspServers:
+                      description: |-
+                        The OCSP server list is an X.509 v3 extension that defines a list of
+                        URLs of OCSP responders. The OCSP responders can be queried for the
+                        revocation status of an issued certificate. If not set, the
+                        certificate will be issued with no OCSP servers set. For example, an
+                        OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    secretName:
+                      description: |-
+                        SecretName is the name of the secret used to sign Certificates issued
+                        by this Issuer.
+                      type: string
+                  required:
+                    - secretName
+                  type: object
+                selfSigned:
+                  description: |-
+                    SelfSigned configures this issuer to 'self sign' certificates using the
+                    private key used to create the CertificateRequest object.
+                  properties:
+                    crlDistributionPoints:
+                      description: |-
+                        The CRL distribution points is an X.509 v3 certificate extension which identifies
+                        the location of the CRL from which the revocation of this certificate can be checked.
+                        If not set certificate will be issued without CDP. Values are strings.
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                  type: object
+                vault:
+                  description: |-
+                    Vault configures this issuer to sign certificates using a HashiCorp Vault
+                    PKI backend.
+                  properties:
+                    auth:
+                      description: Auth configures how cert-manager authenticates with the Vault server.
+                      properties:
+                        appRole:
+                          description: |-
+                            AppRole authenticates with Vault using the App Role auth mechanism,
+                            with the role and secret stored in a Kubernetes Secret resource.
+                          properties:
+                            path:
+                              description: |-
+                                Path where the App Role authentication backend is mounted in Vault, e.g:
+                                "approle"
+                              type: string
+                            roleId:
+                              description: |-
+                                RoleID configured in the App Role authentication backend when setting
+                                up the authentication backend in Vault.
+                              type: string
+                            secretRef:
+                              description: |-
+                                Reference to a key in a Secret that contains the App Role secret used
+                                to authenticate with Vault.
+                                The `key` field must be specified and denotes which entry within the Secret
+                                resource is used as the app role secret.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used.
+                                    Some instances of this field may be defaulted, in others it may be
+                                    required.
+                                  type: string
+                                name:
+                                  description: |-
+                                    Name of the resource being referred to.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                          required:
+                            - path
+                            - roleId
+                            - secretRef
+                          type: object
+                        clientCertificate:
+                          description: |-
+                            ClientCertificate authenticates with Vault by presenting a client
+                            certificate during the request's TLS handshake.
+                            Works only when using HTTPS protocol.
+                          properties:
+                            mountPath:
+                              description: |-
+                                The Vault mountPath here is the mount path to use when authenticating with
+                                Vault. For example, setting a value to `/v1/auth/foo`, will use the path
+                                `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
+                                default value "/v1/auth/cert" will be used.
+                              type: string
+                            name:
+                              description: |-
+                                Name of the certificate role to authenticate against.
+                                If not set, matching any certificate role, if available.
+                              type: string
+                            secretName:
+                              description: |-
+                                Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing
+                                tls.crt and tls.key) used to authenticate to Vault using TLS client
+                                authentication.
+                              type: string
+                          type: object
+                        kubernetes:
+                          description: |-
+                            Kubernetes authenticates with Vault by passing the ServiceAccount
+                            token stored in the named Secret resource to the Vault server.
+                          properties:
+                            mountPath:
+                              description: |-
+                                The Vault mountPath here is the mount path to use when authenticating with
+                                Vault. For example, setting a value to `/v1/auth/foo`, will use the path
+                                `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
+                                default value "/v1/auth/kubernetes" will be used.
+                              type: string
+                            role:
+                              description: |-
+                                A required field containing the Vault Role to assume. A Role binds a
+                                Kubernetes ServiceAccount with a set of Vault policies.
+                              type: string
+                            secretRef:
+                              description: |-
+                                The required Secret field containing a Kubernetes ServiceAccount JWT used
+                                for authenticating with Vault. Use of 'ambient credentials' is not
+                                supported.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used.
+                                    Some instances of this field may be defaulted, in others it may be
+                                    required.
+                                  type: string
+                                name:
+                                  description: |-
+                                    Name of the resource being referred to.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                            serviceAccountRef:
+                              description: |-
+                                A reference to a service account that will be used to request a bound
+                                token (also known as "projected token"). Compared to using "secretRef",
+                                using this field means that you don't rely on statically bound tokens. To
+                                use this field, you must configure an RBAC rule to let cert-manager
+                                request a token.
+                              properties:
+                                audiences:
+                                  description: |-
+                                    TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token
+                                    consisting of the issuer's namespace and name is always included.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                name:
+                                  description: Name of the ServiceAccount used to request a token.
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                          required:
+                            - role
+                          type: object
+                        tokenSecretRef:
+                          description: TokenSecretRef authenticates with Vault by presenting a token.
+                          properties:
+                            key:
+                              description: |-
+                                The key of the entry in the Secret resource's `data` field to be used.
+                                Some instances of this field may be defaulted, in others it may be
+                                required.
+                              type: string
+                            name:
+                              description: |-
+                                Name of the resource being referred to.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                          required:
+                            - name
+                          type: object
+                      type: object
+                    caBundle:
+                      description: |-
+                        Base64-encoded bundle of PEM CAs which will be used to validate the certificate
+                        chain presented by Vault. Only used if using HTTPS to connect to Vault and
+                        ignored for HTTP connections.
+                        Mutually exclusive with CABundleSecretRef.
+                        If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
+                        the cert-manager controller container is used to validate the TLS connection.
+                      format: byte
+                      type: string
+                    caBundleSecretRef:
+                      description: |-
+                        Reference to a Secret containing a bundle of PEM-encoded CAs to use when
+                        verifying the certificate chain presented by Vault when using HTTPS.
+                        Mutually exclusive with CABundle.
+                        If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
+                        the cert-manager controller container is used to validate the TLS connection.
+                        If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
+                      properties:
+                        key:
+                          description: |-
+                            The key of the entry in the Secret resource's `data` field to be used.
+                            Some instances of this field may be defaulted, in others it may be
+                            required.
+                          type: string
+                        name:
+                          description: |-
+                            Name of the resource being referred to.
+                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          type: string
+                      required:
+                        - name
+                      type: object
+                    clientCertSecretRef:
+                      description: |-
+                        Reference to a Secret containing a PEM-encoded Client Certificate to use when the
+                        Vault server requires mTLS.
+                      properties:
+                        key:
+                          description: |-
+                            The key of the entry in the Secret resource's `data` field to be used.
+                            Some instances of this field may be defaulted, in others it may be
+                            required.
+                          type: string
+                        name:
+                          description: |-
+                            Name of the resource being referred to.
+                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          type: string
+                      required:
+                        - name
+                      type: object
+                    clientKeySecretRef:
+                      description: |-
+                        Reference to a Secret containing a PEM-encoded Client Private Key to use when the
+                        Vault server requires mTLS.
+                      properties:
+                        key:
+                          description: |-
+                            The key of the entry in the Secret resource's `data` field to be used.
+                            Some instances of this field may be defaulted, in others it may be
+                            required.
+                          type: string
+                        name:
+                          description: |-
+                            Name of the resource being referred to.
+                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          type: string
+                      required:
+                        - name
+                      type: object
+                    namespace:
+                      description: |-
+                        Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1"
+                        More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
+                      type: string
+                    path:
+                      description: |-
+                        Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
+                        "my_pki_mount/sign/my-role-name".
+                      type: string
+                    server:
+                      description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
+                      type: string
+                    serverName:
+                      description: |-
+                        ServerName is used to verify the hostname on the returned certificates
+                        by the Vault server.
+                      type: string
+                  required:
+                    - auth
+                    - path
+                    - server
+                  type: object
+                venafi:
+                  description: |-
+                    Venafi configures this issuer to sign certificates using a Venafi TPP
+                    or Venafi Cloud policy zone.
+                  properties:
+                    cloud:
+                      description: |-
+                        Cloud specifies the Venafi cloud configuration settings.
+                        Only one of TPP or Cloud may be specified.
+                      properties:
+                        apiTokenSecretRef:
+                          description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
+                          properties:
+                            key:
+                              description: |-
+                                The key of the entry in the Secret resource's `data` field to be used.
+                                Some instances of this field may be defaulted, in others it may be
+                                required.
+                              type: string
+                            name:
+                              description: |-
+                                Name of the resource being referred to.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                          required:
+                            - name
+                          type: object
+                        url:
+                          description: |-
+                            URL is the base URL for Venafi Cloud.
+                            Defaults to "https://api.venafi.cloud/".
+                          type: string
+                      required:
+                        - apiTokenSecretRef
+                      type: object
+                    tpp:
+                      description: |-
+                        TPP specifies Trust Protection Platform configuration settings.
+                        Only one of TPP or Cloud may be specified.
+                      properties:
+                        caBundle:
+                          description: |-
+                            Base64-encoded bundle of PEM CAs which will be used to validate the certificate
+                            chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
+                            If undefined, the certificate bundle in the cert-manager controller container
+                            is used to validate the chain.
+                          format: byte
+                          type: string
+                        caBundleSecretRef:
+                          description: |-
+                            Reference to a Secret containing a base64-encoded bundle of PEM CAs
+                            which will be used to validate the certificate chain presented by the TPP server.
+                            Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
+                            If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
+                            the cert-manager controller container is used to validate the TLS connection.
+                          properties:
+                            key:
+                              description: |-
+                                The key of the entry in the Secret resource's `data` field to be used.
+                                Some instances of this field may be defaulted, in others it may be
+                                required.
+                              type: string
+                            name:
+                              description: |-
+                                Name of the resource being referred to.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                          required:
+                            - name
+                          type: object
+                        credentialsRef:
+                          description: |-
+                            CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.
+                            The secret must contain the key 'access-token' for the Access Token Authentication,
+                            or two keys, 'username' and 'password' for the API Keys Authentication.
+                          properties:
+                            name:
+                              description: |-
+                                Name of the resource being referred to.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                          required:
+                            - name
+                          type: object
+                        url:
+                          description: |-
+                            URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
+                            for example: "https://tpp.example.com/vedsdk".
+                          type: string
+                      required:
+                        - credentialsRef
+                        - url
+                      type: object
+                    zone:
+                      description: |-
+                        Zone is the Venafi Policy Zone to use for this issuer.
+                        All requests made to the Venafi platform will be restricted by the named
+                        zone policy.
+                        This field is required.
+                      type: string
+                  required:
+                    - zone
+                  type: object
+              type: object
+            status:
+              description: Status of the Issuer. This is set and managed automatically.
+              properties:
+                acme:
+                  description: |-
+                    ACME specific status options.
+                    This field should only be set if the Issuer is configured to use an ACME
+                    server to issue certificates.
+                  properties:
+                    lastPrivateKeyHash:
+                      description: |-
+                        LastPrivateKeyHash is a hash of the private key associated with the latest
+                        registered ACME account, in order to track changes made to registered account
+                        associated with the Issuer
+                      type: string
+                    lastRegisteredEmail:
+                      description: |-
+                        LastRegisteredEmail is the email associated with the latest registered
+                        ACME account, in order to track changes made to registered account
+                        associated with the  Issuer
+                      type: string
+                    uri:
+                      description: |-
+                        URI is the unique account identifier, which can also be used to retrieve
+                        account details from the CA
+                      type: string
+                  type: object
+                conditions:
+                  description: |-
+                    List of status conditions to indicate the status of a CertificateRequest.
+                    Known condition types are `Ready`.
+                  items:
+                    description: IssuerCondition contains condition information for an Issuer.
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the timestamp corresponding to the last status
+                          change of this condition.
+                        format: date-time
+                        type: string
+                      message:
+                        description: |-
+                          Message is a human readable description of the details of the last
+                          transition, complementing reason.
+                        type: string
+                      observedGeneration:
+                        description: |-
+                          If set, this represents the .metadata.generation that the condition was
+                          set based upon.
+                          For instance, if .metadata.generation is currently 12, but the
+                          .status.condition[x].observedGeneration is 9, the condition is out of date
+                          with respect to the current state of the Issuer.
+                        format: int64
+                        type: integer
+                      reason:
+                        description: |-
+                          Reason is a brief machine readable explanation for the condition's last
+                          transition.
+                        type: string
+                      status:
+                        description: Status of the condition, one of (`True`, `False`, `Unknown`).
+                        enum:
+                          - "True"
+                          - "False"
+                          - Unknown
+                        type: string
+                      type:
+                        description: Type of the condition, known values are (`Ready`).
+                        type: string
+                    required:
+                      - status
+                      - type
+                    type: object
+                  type: array
+                  x-kubernetes-list-map-keys:
+                    - type
+                  x-kubernetes-list-type: map
+              type: object
+          required:
+            - spec
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+{{- end }}
diff --git a/packages/system/cert-manager-crds/values.yaml b/packages/system/cert-manager-crds/values.yaml
index 0b21fc93..15136853 100644
--- a/packages/system/cert-manager-crds/values.yaml
+++ b/packages/system/cert-manager-crds/values.yaml
@@ -1,2 +1,8 @@
-cert-manager:
-  installCRDs: true
+global:
+  commonLabels: {}
+
+creator: helm
+
+crds:
+  enabled: true
+  keep: true
diff --git a/packages/system/cert-manager/Makefile b/packages/system/cert-manager/Makefile
index 2d256086..bda6e1fe 100644
--- a/packages/system/cert-manager/Makefile
+++ b/packages/system/cert-manager/Makefile
@@ -8,3 +8,5 @@ update:
 	helm repo add jetstack https://charts.jetstack.io
 	helm repo update jetstack
 	helm pull jetstack/cert-manager --untar --untardir charts
+	mv charts/cert-manager/templates/crd-*.yaml ../cert-manager-crds/templates/
+	cp charts/cert-manager/templates/_helpers.tpl ../cert-manager-crds/templates/
diff --git a/packages/system/cert-manager/charts/cert-manager/Chart.yaml b/packages/system/cert-manager/charts/cert-manager/Chart.yaml
index 2a49d00c..2756247d 100644
--- a/packages/system/cert-manager/charts/cert-manager/Chart.yaml
+++ b/packages/system/cert-manager/charts/cert-manager/Chart.yaml
@@ -6,7 +6,7 @@ annotations:
     fingerprint: 1020CF3C033D4F35BAE1C19E1226061C665DF13E
     url: https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg
 apiVersion: v2
-appVersion: v1.17.2
+appVersion: v1.19.3
 description: A Helm chart for cert-manager
 home: https://cert-manager.io
 icon: https://raw.githubusercontent.com/cert-manager/community/4d35a69437d21b76322157e6284be4cd64e6d2b7/logo/logo-small.png
@@ -23,4 +23,4 @@ maintainers:
 name: cert-manager
 sources:
 - https://github.com/cert-manager/cert-manager
-version: v1.17.2
+version: v1.19.3
diff --git a/packages/system/cert-manager/charts/cert-manager/README.md b/packages/system/cert-manager/charts/cert-manager/README.md
index 1d502429..456e740d 100644
--- a/packages/system/cert-manager/charts/cert-manager/README.md
+++ b/packages/system/cert-manager/charts/cert-manager/README.md
@@ -1,10 +1,10 @@
 # cert-manager
 
-cert-manager is a Kubernetes addon to automate the management and issuance of
-TLS certificates from various issuing sources.
+cert-manager creates TLS certificates for workloads in your Kubernetes or OpenShift cluster and renews the certificates before they expire.
 
-It will ensure certificates are valid and up to date periodically, and attempt
-to renew certificates at an appropriate time before expiry.
+cert-manager can obtain certificates from a [variety of certificate authorities](https://cert-manager.io/docs/configuration/issuers/), including:
+[Let's Encrypt](https://cert-manager.io/docs/configuration/acme/), [HashiCorp Vault](https://cert-manager.io/docs/configuration/vault/),
+[Venafi](https://cert-manager.io/docs/configuration/venafi/) and [private PKI](https://cert-manager.io/docs/configuration/ca/).
 
 ## Prerequisites
 
@@ -13,23 +13,21 @@ to renew certificates at an appropriate time before expiry.
 ## Installing the Chart
 
 Full installation instructions, including details on how to configure extra
-functionality in cert-manager can be found in the [installation docs](https://cert-manager.io/docs/installation/kubernetes/).
-
-Before installing the chart, you must first install the cert-manager CustomResourceDefinition resources.
-This is performed in a separate step to allow you to easily uninstall and reinstall cert-manager without deleting your installed custom resources.
-
-```bash
-$ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.17.2/cert-manager.crds.yaml
-```
+functionality in cert-manager can be found in the [installation docs](https://cert-manager.io/docs/installation/helm/).
 
 To install the chart with the release name `cert-manager`:
 
 ```console
-## Add the Jetstack Helm repository
-$ helm repo add jetstack https://charts.jetstack.io --force-update
+# Add the Jetstack Helm repository
+helm repo add jetstack https://charts.jetstack.io --force-update
 
-## Install the cert-manager helm chart
-$ helm install cert-manager --namespace cert-manager --version v1.17.2 jetstack/cert-manager
+# Install the cert-manager helm chart
+helm install \
+  cert-manager jetstack/cert-manager \
+  --namespace cert-manager \
+  --create-namespace \
+  --version v1.19.3 \
+  --set crds.enabled=true
 ```
 
 In order to begin issuing certificates, you will need to set up a ClusterIssuer
@@ -56,17 +54,25 @@ are documented in our full [upgrading guide](https://cert-manager.io/docs/instal
 To uninstall/delete the `cert-manager` deployment:
 
 ```console
-$ helm delete cert-manager --namespace cert-manager
+helm delete cert-manager --namespace cert-manager
 ```
 
 The command removes all the Kubernetes components associated with the chart and deletes the release.
 
 If you want to completely uninstall cert-manager from your cluster, you will also need to
-delete the previously installed CustomResourceDefinition resources:
+delete the previously installed CustomResourceDefinition resources.
 
-```console
-$ kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.17.2/cert-manager.crds.yaml
-```
+> ☢️ This will remove all `Issuer`,`ClusterIssuer`,`Certificate`,`CertificateRequest`,`Order` and `Challenge` resources from the cluster:
+>
+> ```console
+> kubectl delete crd \
+>   issuers.cert-manager.io \
+>   clusterissuers.cert-manager.io \
+>   certificates.cert-manager.io \
+>   certificaterequests.cert-manager.io \
+>   orders.acme.cert-manager.io \
+>   challenges.acme.cert-manager.io
+> ```
 
 ## Configuration
 <!-- AUTO-GENERATED -->
@@ -87,6 +93,18 @@ For example:
 imagePullSecrets:
   - name: "image-pull-secret"
 ```
+#### **global.nodeSelector** ~ `object`
+> Default value:
+> ```yaml
+> {}
+> ```
+
+Global node selector  
+  
+The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).  
+  
+If a component-specific nodeSelector is also set, it will be merged and take precedence.
+
 #### **global.commonLabels** ~ `object`
 > Default value:
 > ```yaml
@@ -108,6 +126,18 @@ The number of old ReplicaSets to retain to allow rollback (if not set, the defau
 > ```
 
 The optional priority class to be used for the cert-manager pods.
+#### **global.hostUsers** ~ `bool`
+
+Set all pods to run in a user namespace without host access. Experimental: may be removed once the Kubernetes User Namespaces feature is GA.  
+  
+Requirements:  
+  - Kubernetes ≥ 1.33, or  
+  - Kubernetes 1.27–1.32 with UserNamespacesSupport feature gate enabled.  
+  
+Set to false to run pods in a user namespace without host access.  
+  
+See [limitations](https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/#limitations) for details.
+
 #### **global.rbac.create** ~ `bool`
 > Default value:
 > ```yaml
@@ -230,13 +260,13 @@ This prevents downtime during voluntary disruptions such as during a Node upgrad
 Pod is currently running.
 #### **podDisruptionBudget.minAvailable** ~ `unknown`
 
-This configures the minimum available pods for disruptions. It can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%).  
+This configures the minimum available pods for disruptions. It can either be set to an integer (e.g., 1) or a percentage value (e.g., 25%).  
 It cannot be used if `maxUnavailable` is set.
 
 
 #### **podDisruptionBudget.maxUnavailable** ~ `unknown`
 
-This configures the maximum unavailable pods for disruptions. It can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%). it cannot be used if `minAvailable` is set.
+This configures the maximum unavailable pods for disruptions. It can either be set to an integer (e.g., 1) or a percentage value (e.g., 25%). it cannot be used if `minAvailable` is set.
 
 
 #### **featureGates** ~ `string`
@@ -300,7 +330,7 @@ Override the "cert-manager.fullname" value. This value is used as part of most o
 
 #### **nameOverride** ~ `string`
 
-Override the "cert-manager.name" value, which is used to annotate some of the resources that are created by this Chart (using "app.kubernetes.io/name"). NOTE: There are some inconsistencies in the Helm chart when it comes to these annotations (some resources use eg. "cainjector.name" which resolves to the value "cainjector").
+Override the "cert-manager.name" value, which is used to annotate some of the resources that are created by this Chart (using "app.kubernetes.io/name"). NOTE: There are some inconsistencies in the Helm chart when it comes to these annotations (some resources use, e.g., "cainjector.name" which resolves to the value "cainjector").
 
 #### **serviceAccount.create** ~ `bool`
 > Default value:
@@ -371,10 +401,10 @@ config:
   kubernetesAPIBurst: 9000
   numberOfConcurrentWorkers: 200
   enableGatewayAPI: true
-  # Feature gates as of v1.17.0. Listed with their default values.
+  # Feature gates as of v1.18.1. Listed with their default values.
   # See https://cert-manager.io/docs/cli/controller/
   featureGates:
-    AdditionalCertificateOutputFormats: true # BETA - default=true
+    AdditionalCertificateOutputFormats: true # GA - default=true
     AllAlpha: false # ALPHA - default=false
     AllBeta: false # BETA - default=false
     ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false
@@ -386,8 +416,10 @@ config:
     ServerSideApply: false # ALPHA - default=false
     StableCertificateRequestName: true # BETA - default=true
     UseCertificateRequestBasicConstraints: false # ALPHA - default=false
-    UseDomainQualifiedFinalizer: true # BETA - default=false
+    UseDomainQualifiedFinalizer: true # GA - default=true
     ValidateCAA: false # ALPHA - default=false
+    DefaultPrivateKeyRotationPolicyAlways: true # BETA - default=true
+    ACMEHTTP01IngressPathTypeExact: true # BETA - default=true
   # Configure the metrics server for TLS
   # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
   metricsTLSConfig:
@@ -425,7 +457,7 @@ Option to disable cert-manager's build-in auto-approver. The auto-approver appro
 > - clusterissuers.cert-manager.io/*
 > ```
 
-List of signer names that cert-manager will approve by default. CertificateRequests referencing these signer names will be auto-approved by cert-manager. Defaults to just approving the cert-manager.io Issuer and ClusterIssuer issuers. When set to an empty array, ALL issuers will be auto-approved by cert-manager. To disable the auto-approval, because eg. you are using approver-policy, you can enable 'disableAutoApproval'.  
+List of signer names that cert-manager will approve by default. CertificateRequests referencing these signer names will be auto-approved by cert-manager. Defaults to just approving the cert-manager.io Issuer and ClusterIssuer issuers. When set to an empty array, ALL issuers will be auto-approved by cert-manager. To disable the auto-approval, because, e.g., you are using approver-policy, you can enable 'disableAutoApproval'.  
 ref: https://cert-manager.io/docs/concepts/certificaterequest/#approval
 
 #### **extraArgs** ~ `array`
@@ -684,7 +716,7 @@ enableServiceLinks indicates whether information about services should be inject
 
 Enable Prometheus monitoring for the cert-manager controller and webhook. If you use the Prometheus Operator, set prometheus.podmonitor.enabled or prometheus.servicemonitor.enabled, to create a PodMonitor or a  
 ServiceMonitor resource.  
-Otherwise, 'prometheus.io' annotations are added to the cert-manager and cert-manager-webhook Deployments. Note that you can not enable both PodMonitor and ServiceMonitor as they are mutually exclusive. Enabling both will result in an error.
+Otherwise, 'prometheus.io' annotations are added to the cert-manager and cert-manager-webhook Deployments. Note that you cannot enable both PodMonitor and ServiceMonitor as they are mutually exclusive. Enabling both will result in an error.
 #### **prometheus.servicemonitor.enabled** ~ `bool`
 > Default value:
 > ```yaml
@@ -703,13 +735,14 @@ The namespace that the service monitor should live in, defaults to the cert-mana
 > ```
 
 Specifies the `prometheus` label on the created ServiceMonitor. This is used when different Prometheus instances have label selectors matching different ServiceMonitors.
-#### **prometheus.servicemonitor.targetPort** ~ `number`
+#### **prometheus.servicemonitor.targetPort** ~ `string,integer`
 > Default value:
 > ```yaml
-> 9402
+> http-metrics
 > ```
 
 The target port to set on the ServiceMonitor. This must match the port that the cert-manager controller is listening on for metrics.
+
 #### **prometheus.servicemonitor.path** ~ `string`
 > Default value:
 > ```yaml
@@ -969,13 +1002,13 @@ This prevents downtime during voluntary disruptions such as during a Node upgrad
 Pod is currently running.
 #### **webhook.podDisruptionBudget.minAvailable** ~ `unknown`
 
-This property configures the minimum available pods for disruptions. Can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%).  
+This property configures the minimum available pods for disruptions. Can either be set to an integer (e.g., 1) or a percentage value (e.g., 25%).  
 It cannot be used if `maxUnavailable` is set.
 
 
 #### **webhook.podDisruptionBudget.maxUnavailable** ~ `unknown`
 
-This property configures the maximum unavailable pods for disruptions. Can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%).  
+This property configures the maximum unavailable pods for disruptions. Can either be set to an integer (e.g., 1) or a percentage value (e.g., 25%).  
 It cannot be used if `minAvailable` is set.
 
 
@@ -1293,6 +1326,8 @@ Create network policies for the webhooks.
 > - from:
 >     - ipBlock:
 >         cidr: 0.0.0.0/0
+>     - ipBlock:
+>         cidr: ::/0
 > ```
 
 Ingress rule for the webhook network policy. By default, it allows all inbound traffic.
@@ -1314,6 +1349,8 @@ Ingress rule for the webhook network policy. By default, it allows all inbound t
 >   to:
 >     - ipBlock:
 >         cidr: 0.0.0.0/0
+>     - ipBlock:
+>         cidr: ::/0
 > ```
 
 Egress rule for the webhook network policy. By default, it allows all outbound traffic to ports 80 and 443, as well as DNS ports.
@@ -1442,14 +1479,14 @@ Pod is currently running.
 #### **cainjector.podDisruptionBudget.minAvailable** ~ `unknown`
 
 `minAvailable` configures the minimum available pods for disruptions. It can either be set to  
-an integer (e.g. 1) or a percentage value (e.g. 25%).  
+an integer (e.g., 1) or a percentage value (e.g., 25%).  
 Cannot be used if `maxUnavailable` is set.
 
 
 #### **cainjector.podDisruptionBudget.maxUnavailable** ~ `unknown`
 
 `maxUnavailable` configures the maximum unavailable pods for disruptions. It can either be set to  
-an integer (e.g. 1) or a percentage value (e.g. 25%).  
+an integer (e.g., 1) or a percentage value (e.g., 25%).  
 Cannot be used if `minAvailable` is set.
 
 
diff --git a/packages/system/cert-manager/charts/cert-manager/templates/NOTES.txt b/packages/system/cert-manager/charts/cert-manager/templates/NOTES.txt
index 341d1012..4d0b4b60 100644
--- a/packages/system/cert-manager/charts/cert-manager/templates/NOTES.txt
+++ b/packages/system/cert-manager/charts/cert-manager/templates/NOTES.txt
@@ -1,6 +1,12 @@
 {{- if .Values.installCRDs }}
 ⚠️  WARNING: `installCRDs` is deprecated, use `crds.enabled` instead.
+
 {{- end }}
+⚠️  WARNING: New default private key rotation policy for Certificate resources.
+The default private key rotation policy for Certificate resources was
+changed to `Always` in cert-manager >= v1.18.0.
+Learn more in the [1.18 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.18).
+
 cert-manager {{ .Chart.AppVersion }} has been deployed successfully!
 
 In order to begin issuing certificates, you will need to set up a ClusterIssuer
diff --git a/packages/system/cert-manager/charts/cert-manager/templates/_helpers.tpl b/packages/system/cert-manager/charts/cert-manager/templates/_helpers.tpl
index e15fa191..f85373f3 100644
--- a/packages/system/cert-manager/charts/cert-manager/templates/_helpers.tpl
+++ b/packages/system/cert-manager/charts/cert-manager/templates/_helpers.tpl
@@ -187,6 +187,17 @@ See https://github.com/cert-manager/cert-manager/issues/6329 for a list of linke
 {{- end }}
 {{- end }}
 
+{{/*
+Labels for the CRD resources.
+*/}}
+{{- define "cert-manager.crd-labels" -}}
+app: "{{ template "cert-manager.name" . }}"
+app.kubernetes.io/name: "{{ template "cert-manager.name" . }}"
+app.kubernetes.io/instance: "{{ .Release.Name }}"
+app.kubernetes.io/component: "crds"
+{{ include "labels" . }}
+{{- end -}}
+
 {{/*
 Check that the user has not set both .installCRDs and .crds.enabled or
 set .installCRDs and disabled .crds.keep.
diff --git a/packages/system/cert-manager/charts/cert-manager/templates/cainjector-deployment.yaml b/packages/system/cert-manager/charts/cert-manager/templates/cainjector-deployment.yaml
index dc14ab02..b5434caa 100644
--- a/packages/system/cert-manager/charts/cert-manager/templates/cainjector-deployment.yaml
+++ b/packages/system/cert-manager/charts/cert-manager/templates/cainjector-deployment.yaml
@@ -67,6 +67,9 @@ spec:
       {{- with .Values.global.priorityClassName }}
       priorityClassName: {{ . | quote }}
       {{- end }}
+      {{- if (hasKey .Values.global "hostUsers") }}
+      hostUsers: {{ .Values.global.hostUsers }}       
+      {{- end }}
       {{- with .Values.cainjector.securityContext }}
       securityContext:
         {{- toYaml . | nindent 8 }}
@@ -136,9 +139,13 @@ spec:
             {{- toYaml . | nindent 12 }}
             {{- end }}
           {{- end }}
-      {{- with .Values.cainjector.nodeSelector }}
+      {{- $nodeSelector := .Values.global.nodeSelector | default dict }}
+      {{- $nodeSelector = merge $nodeSelector (.Values.cainjector.nodeSelector | default dict) }}
+      {{- with $nodeSelector }}
       nodeSelector:
-        {{- toYaml . | nindent 8 }}
+        {{- range $key, $value := . }}
+        {{ $key }}: {{ $value | quote }}
+        {{- end }}
       {{- end }}
       {{- with .Values.cainjector.affinity }}
       affinity:
diff --git a/packages/system/cert-manager/charts/cert-manager/templates/crds.yaml b/packages/system/cert-manager/charts/cert-manager/templates/crds.yaml
deleted file mode 100644
index f5f8ec43..00000000
--- a/packages/system/cert-manager/charts/cert-manager/templates/crds.yaml
+++ /dev/null
@@ -1,12036 +0,0 @@
-# {{- include "cert-manager.crd-check" . }}
-# START crd {{- if or .Values.crds.enabled .Values.installCRDs }}
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: certificaterequests.cert-manager.io
-  # START annotations {{- if .Values.crds.keep }}
-  annotations:
-    helm.sh/resource-policy: keep
-  # END annotations {{- end }}
-  labels:
-    app: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/instance: '{{ .Release.Name }}'
-    # Generated labels {{- include "labels" . | nindent 4 }}
-spec:
-  group: cert-manager.io
-  names:
-    kind: CertificateRequest
-    listKind: CertificateRequestList
-    plural: certificaterequests
-    shortNames:
-      - cr
-      - crs
-    singular: certificaterequest
-    categories:
-      - cert-manager
-  scope: Namespaced
-  versions:
-    - name: v1
-      subresources:
-        status: {}
-      additionalPrinterColumns:
-        - jsonPath: .status.conditions[?(@.type=="Approved")].status
-          name: Approved
-          type: string
-        - jsonPath: .status.conditions[?(@.type=="Denied")].status
-          name: Denied
-          type: string
-        - jsonPath: .status.conditions[?(@.type=="Ready")].status
-          name: Ready
-          type: string
-        - jsonPath: .spec.issuerRef.name
-          name: Issuer
-          type: string
-        - jsonPath: .spec.username
-          name: Requester
-          type: string
-        - jsonPath: .status.conditions[?(@.type=="Ready")].message
-          name: Status
-          priority: 1
-          type: string
-        - jsonPath: .metadata.creationTimestamp
-          description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
-          name: Age
-          type: date
-      schema:
-        openAPIV3Schema:
-          description: |-
-            A CertificateRequest is used to request a signed certificate from one of the
-            configured issuers.
-
-            All fields within the CertificateRequest's `spec` are immutable after creation.
-            A CertificateRequest will either succeed or fail, as denoted by its `Ready` status
-            condition and its `status.failureTime` field.
-
-            A CertificateRequest is a one-shot resource, meaning it represents a single
-            point in time request for a certificate and cannot be re-used.
-          type: object
-          properties:
-            apiVersion:
-              description: |-
-                APIVersion defines the versioned schema of this representation of an object.
-                Servers should convert recognized schemas to the latest internal value, and
-                may reject unrecognized values.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-              type: string
-            kind:
-              description: |-
-                Kind is a string value representing the REST resource this object represents.
-                Servers may infer this from the endpoint the client submits requests to.
-                Cannot be updated.
-                In CamelCase.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: |-
-                Specification of the desired state of the CertificateRequest resource.
-                https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-              type: object
-              required:
-                - issuerRef
-                - request
-              properties:
-                duration:
-                  description: |-
-                    Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
-                    issuer may choose to ignore the requested duration, just like any other
-                    requested attribute.
-                  type: string
-                extra:
-                  description: |-
-                    Extra contains extra attributes of the user that created the CertificateRequest.
-                    Populated by the cert-manager webhook on creation and immutable.
-                  type: object
-                  additionalProperties:
-                    type: array
-                    items:
-                      type: string
-                groups:
-                  description: |-
-                    Groups contains group membership of the user that created the CertificateRequest.
-                    Populated by the cert-manager webhook on creation and immutable.
-                  type: array
-                  items:
-                    type: string
-                  x-kubernetes-list-type: atomic
-                isCA:
-                  description: |-
-                    Requested basic constraints isCA value. Note that the issuer may choose
-                    to ignore the requested isCA value, just like any other requested attribute.
-
-                    NOTE: If the CSR in the `Request` field has a BasicConstraints extension,
-                    it must have the same isCA value as specified here.
-
-                    If true, this will automatically add the `cert sign` usage to the list
-                    of requested `usages`.
-                  type: boolean
-                issuerRef:
-                  description: |-
-                    Reference to the issuer responsible for issuing the certificate.
-                    If the issuer is namespace-scoped, it must be in the same namespace
-                    as the Certificate. If the issuer is cluster-scoped, it can be used
-                    from any namespace.
-
-                    The `name` field of the reference must always be specified.
-                  type: object
-                  required:
-                    - name
-                  properties:
-                    group:
-                      description: Group of the resource being referred to.
-                      type: string
-                    kind:
-                      description: Kind of the resource being referred to.
-                      type: string
-                    name:
-                      description: Name of the resource being referred to.
-                      type: string
-                request:
-                  description: |-
-                    The PEM-encoded X.509 certificate signing request to be submitted to the
-                    issuer for signing.
-
-                    If the CSR has a BasicConstraints extension, its isCA attribute must
-                    match the `isCA` value of this CertificateRequest.
-                    If the CSR has a KeyUsage extension, its key usages must match the
-                    key usages in the `usages` field of this CertificateRequest.
-                    If the CSR has a ExtKeyUsage extension, its extended key usages
-                    must match the extended key usages in the `usages` field of this
-                    CertificateRequest.
-                  type: string
-                  format: byte
-                uid:
-                  description: |-
-                    UID contains the uid of the user that created the CertificateRequest.
-                    Populated by the cert-manager webhook on creation and immutable.
-                  type: string
-                usages:
-                  description: |-
-                    Requested key usages and extended key usages.
-
-                    NOTE: If the CSR in the `Request` field has uses the KeyUsage or
-                    ExtKeyUsage extension, these extensions must have the same values
-                    as specified here without any additional values.
-
-                    If unset, defaults to `digital signature` and `key encipherment`.
-                  type: array
-                  items:
-                    description: |-
-                      KeyUsage specifies valid usage contexts for keys.
-                      See:
-                      https://tools.ietf.org/html/rfc5280#section-4.2.1.3
-                      https://tools.ietf.org/html/rfc5280#section-4.2.1.12
-
-                      Valid KeyUsage values are as follows:
-                      "signing",
-                      "digital signature",
-                      "content commitment",
-                      "key encipherment",
-                      "key agreement",
-                      "data encipherment",
-                      "cert sign",
-                      "crl sign",
-                      "encipher only",
-                      "decipher only",
-                      "any",
-                      "server auth",
-                      "client auth",
-                      "code signing",
-                      "email protection",
-                      "s/mime",
-                      "ipsec end system",
-                      "ipsec tunnel",
-                      "ipsec user",
-                      "timestamping",
-                      "ocsp signing",
-                      "microsoft sgc",
-                      "netscape sgc"
-                    type: string
-                    enum:
-                      - signing
-                      - digital signature
-                      - content commitment
-                      - key encipherment
-                      - key agreement
-                      - data encipherment
-                      - cert sign
-                      - crl sign
-                      - encipher only
-                      - decipher only
-                      - any
-                      - server auth
-                      - client auth
-                      - code signing
-                      - email protection
-                      - s/mime
-                      - ipsec end system
-                      - ipsec tunnel
-                      - ipsec user
-                      - timestamping
-                      - ocsp signing
-                      - microsoft sgc
-                      - netscape sgc
-                username:
-                  description: |-
-                    Username contains the name of the user that created the CertificateRequest.
-                    Populated by the cert-manager webhook on creation and immutable.
-                  type: string
-            status:
-              description: |-
-                Status of the CertificateRequest.
-                This is set and managed automatically.
-                Read-only.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-              type: object
-              properties:
-                ca:
-                  description: |-
-                    The PEM encoded X.509 certificate of the signer, also known as the CA
-                    (Certificate Authority).
-                    This is set on a best-effort basis by different issuers.
-                    If not set, the CA is assumed to be unknown/not available.
-                  type: string
-                  format: byte
-                certificate:
-                  description: |-
-                    The PEM encoded X.509 certificate resulting from the certificate
-                    signing request.
-                    If not set, the CertificateRequest has either not been completed or has
-                    failed. More information on failure can be found by checking the
-                    `conditions` field.
-                  type: string
-                  format: byte
-                conditions:
-                  description: |-
-                    List of status conditions to indicate the status of a CertificateRequest.
-                    Known condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`.
-                  type: array
-                  items:
-                    description: CertificateRequestCondition contains condition information for a CertificateRequest.
-                    type: object
-                    required:
-                      - status
-                      - type
-                    properties:
-                      lastTransitionTime:
-                        description: |-
-                          LastTransitionTime is the timestamp corresponding to the last status
-                          change of this condition.
-                        type: string
-                        format: date-time
-                      message:
-                        description: |-
-                          Message is a human readable description of the details of the last
-                          transition, complementing reason.
-                        type: string
-                      reason:
-                        description: |-
-                          Reason is a brief machine readable explanation for the condition's last
-                          transition.
-                        type: string
-                      status:
-                        description: Status of the condition, one of (`True`, `False`, `Unknown`).
-                        type: string
-                        enum:
-                          - "True"
-                          - "False"
-                          - Unknown
-                      type:
-                        description: |-
-                          Type of the condition, known values are (`Ready`, `InvalidRequest`,
-                          `Approved`, `Denied`).
-                        type: string
-                  x-kubernetes-list-map-keys:
-                    - type
-                  x-kubernetes-list-type: map
-                failureTime:
-                  description: |-
-                    FailureTime stores the time that this CertificateRequest failed. This is
-                    used to influence garbage collection and back-off.
-                  type: string
-                  format: date-time
-      served: true
-      storage: true
-
-# END crd {{- end }}
-
----
-# START crd {{- if or .Values.crds.enabled .Values.installCRDs }}
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: certificates.cert-manager.io
-  # START annotations {{- if .Values.crds.keep }}
-  annotations:
-    helm.sh/resource-policy: keep
-  # END annotations {{- end }}
-  labels:
-    app: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/instance: '{{ .Release.Name }}'
-    # Generated labels {{- include "labels" . | nindent 4 }}
-spec:
-  group: cert-manager.io
-  names:
-    kind: Certificate
-    listKind: CertificateList
-    plural: certificates
-    shortNames:
-      - cert
-      - certs
-    singular: certificate
-    categories:
-      - cert-manager
-  scope: Namespaced
-  versions:
-    - name: v1
-      subresources:
-        status: {}
-      additionalPrinterColumns:
-        - jsonPath: .status.conditions[?(@.type=="Ready")].status
-          name: Ready
-          type: string
-        - jsonPath: .spec.secretName
-          name: Secret
-          type: string
-        - jsonPath: .spec.issuerRef.name
-          name: Issuer
-          priority: 1
-          type: string
-        - jsonPath: .status.conditions[?(@.type=="Ready")].message
-          name: Status
-          priority: 1
-          type: string
-        - jsonPath: .metadata.creationTimestamp
-          description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
-          name: Age
-          type: date
-      schema:
-        openAPIV3Schema:
-          description: |-
-            A Certificate resource should be created to ensure an up to date and signed
-            X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.
-
-            The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).
-          type: object
-          properties:
-            apiVersion:
-              description: |-
-                APIVersion defines the versioned schema of this representation of an object.
-                Servers should convert recognized schemas to the latest internal value, and
-                may reject unrecognized values.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-              type: string
-            kind:
-              description: |-
-                Kind is a string value representing the REST resource this object represents.
-                Servers may infer this from the endpoint the client submits requests to.
-                Cannot be updated.
-                In CamelCase.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: |-
-                Specification of the desired state of the Certificate resource.
-                https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-              type: object
-              required:
-                - issuerRef
-                - secretName
-              properties:
-                additionalOutputFormats:
-                  description: |-
-                    Defines extra output formats of the private key and signed certificate chain
-                    to be written to this Certificate's target Secret.
-
-                    This is a Beta Feature enabled by default. It can be disabled with the
-                    `--feature-gates=AdditionalCertificateOutputFormats=false` option set on both
-                    the controller and webhook components.
-                  type: array
-                  items:
-                    description: |-
-                      CertificateAdditionalOutputFormat defines an additional output format of a
-                      Certificate resource. These contain supplementary data formats of the signed
-                      certificate chain and paired private key.
-                    type: object
-                    required:
-                      - type
-                    properties:
-                      type:
-                        description: |-
-                          Type is the name of the format type that should be written to the
-                          Certificate's target Secret.
-                        type: string
-                        enum:
-                          - DER
-                          - CombinedPEM
-                commonName:
-                  description: |-
-                    Requested common name X509 certificate subject attribute.
-                    More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
-                    NOTE: TLS clients will ignore this value when any subject alternative name is
-                    set (see https://tools.ietf.org/html/rfc6125#section-6.4.4).
-
-                    Should have a length of 64 characters or fewer to avoid generating invalid CSRs.
-                    Cannot be set if the `literalSubject` field is set.
-                  type: string
-                dnsNames:
-                  description: Requested DNS subject alternative names.
-                  type: array
-                  items:
-                    type: string
-                duration:
-                  description: |-
-                    Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
-                    issuer may choose to ignore the requested duration, just like any other
-                    requested attribute.
-
-                    If unset, this defaults to 90 days.
-                    Minimum accepted duration is 1 hour.
-                    Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
-                  type: string
-                emailAddresses:
-                  description: Requested email subject alternative names.
-                  type: array
-                  items:
-                    type: string
-                encodeUsagesInRequest:
-                  description: |-
-                    Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.
-
-                    This option defaults to true, and should only be disabled if the target
-                    issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.
-                  type: boolean
-                ipAddresses:
-                  description: Requested IP address subject alternative names.
-                  type: array
-                  items:
-                    type: string
-                isCA:
-                  description: |-
-                    Requested basic constraints isCA value.
-                    The isCA value is used to set the `isCA` field on the created CertificateRequest
-                    resources. Note that the issuer may choose to ignore the requested isCA value, just
-                    like any other requested attribute.
-
-                    If true, this will automatically add the `cert sign` usage to the list
-                    of requested `usages`.
-                  type: boolean
-                issuerRef:
-                  description: |-
-                    Reference to the issuer responsible for issuing the certificate.
-                    If the issuer is namespace-scoped, it must be in the same namespace
-                    as the Certificate. If the issuer is cluster-scoped, it can be used
-                    from any namespace.
-
-                    The `name` field of the reference must always be specified.
-                  type: object
-                  required:
-                    - name
-                  properties:
-                    group:
-                      description: Group of the resource being referred to.
-                      type: string
-                    kind:
-                      description: Kind of the resource being referred to.
-                      type: string
-                    name:
-                      description: Name of the resource being referred to.
-                      type: string
-                keystores:
-                  description: Additional keystore output formats to be stored in the Certificate's Secret.
-                  type: object
-                  properties:
-                    jks:
-                      description: |-
-                        JKS configures options for storing a JKS keystore in the
-                        `spec.secretName` Secret resource.
-                      type: object
-                      required:
-                        - create
-                      properties:
-                        alias:
-                          description: |-
-                            Alias specifies the alias of the key in the keystore, required by the JKS format.
-                            If not provided, the default alias `certificate` will be used.
-                          type: string
-                        create:
-                          description: |-
-                            Create enables JKS keystore creation for the Certificate.
-                            If true, a file named `keystore.jks` will be created in the target
-                            Secret resource, encrypted using the password stored in
-                            `passwordSecretRef` or `password`.
-                            The keystore file will be updated immediately.
-                            If the issuer provided a CA certificate, a file named `truststore.jks`
-                            will also be created in the target Secret resource, encrypted using the
-                            password stored in `passwordSecretRef`
-                            containing the issuing Certificate Authority
-                          type: boolean
-                        password:
-                          description: |-
-                            Password provides a literal password used to encrypt the JKS keystore.
-                            Mutually exclusive with passwordSecretRef.
-                            One of password or passwordSecretRef must provide a password with a non-zero length.
-                          type: string
-                        passwordSecretRef:
-                          description: |-
-                            PasswordSecretRef is a reference to a non-empty key in a Secret resource
-                            containing the password used to encrypt the JKS keystore.
-                            Mutually exclusive with password.
-                            One of password or passwordSecretRef must provide a password with a non-zero length.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                    pkcs12:
-                      description: |-
-                        PKCS12 configures options for storing a PKCS12 keystore in the
-                        `spec.secretName` Secret resource.
-                      type: object
-                      required:
-                        - create
-                      properties:
-                        create:
-                          description: |-
-                            Create enables PKCS12 keystore creation for the Certificate.
-                            If true, a file named `keystore.p12` will be created in the target
-                            Secret resource, encrypted using the password stored in
-                            `passwordSecretRef` or in `password`.
-                            The keystore file will be updated immediately.
-                            If the issuer provided a CA certificate, a file named `truststore.p12` will
-                            also be created in the target Secret resource, encrypted using the
-                            password stored in `passwordSecretRef` containing the issuing Certificate
-                            Authority
-                          type: boolean
-                        password:
-                          description: |-
-                            Password provides a literal password used to encrypt the PKCS#12 keystore.
-                            Mutually exclusive with passwordSecretRef.
-                            One of password or passwordSecretRef must provide a password with a non-zero length.
-                          type: string
-                        passwordSecretRef:
-                          description: |-
-                            PasswordSecretRef is a reference to a non-empty key in a Secret resource
-                            containing the password used to encrypt the PKCS#12 keystore.
-                            Mutually exclusive with password.
-                            One of password or passwordSecretRef must provide a password with a non-zero length.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                        profile:
-                          description: |-
-                            Profile specifies the key and certificate encryption algorithms and the HMAC algorithm
-                            used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.
-
-                            If provided, allowed values are:
-                            `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
-                            `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
-                            `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
-                            (eg. because of company policy). Please note that the security of the algorithm is not that important
-                            in reality, because the unencrypted certificate and private key are also stored in the Secret.
-                          type: string
-                          enum:
-                            - LegacyRC2
-                            - LegacyDES
-                            - Modern2023
-                literalSubject:
-                  description: |-
-                    Requested X.509 certificate subject, represented using the LDAP "String
-                    Representation of a Distinguished Name" [1].
-                    Important: the LDAP string format also specifies the order of the attributes
-                    in the subject, this is important when issuing certs for LDAP authentication.
-                    Example: `CN=foo,DC=corp,DC=example,DC=com`
-                    More info [1]: https://datatracker.ietf.org/doc/html/rfc4514
-                    More info: https://github.com/cert-manager/cert-manager/issues/3203
-                    More info: https://github.com/cert-manager/cert-manager/issues/4424
-
-                    Cannot be set if the `subject` or `commonName` field is set.
-                  type: string
-                nameConstraints:
-                  description: |-
-                    x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.
-                    More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10
-
-                    This is an Alpha Feature and is only enabled with the
-                    `--feature-gates=NameConstraints=true` option set on both
-                    the controller and webhook components.
-                  type: object
-                  properties:
-                    critical:
-                      description: if true then the name constraints are marked critical.
-                      type: boolean
-                    excluded:
-                      description: |-
-                        Excluded contains the constraints which must be disallowed. Any name matching a
-                        restriction in the excluded field is invalid regardless
-                        of information appearing in the permitted
-                      type: object
-                      properties:
-                        dnsDomains:
-                          description: DNSDomains is a list of DNS domains that are permitted or excluded.
-                          type: array
-                          items:
-                            type: string
-                        emailAddresses:
-                          description: EmailAddresses is a list of Email Addresses that are permitted or excluded.
-                          type: array
-                          items:
-                            type: string
-                        ipRanges:
-                          description: |-
-                            IPRanges is a list of IP Ranges that are permitted or excluded.
-                            This should be a valid CIDR notation.
-                          type: array
-                          items:
-                            type: string
-                        uriDomains:
-                          description: URIDomains is a list of URI domains that are permitted or excluded.
-                          type: array
-                          items:
-                            type: string
-                    permitted:
-                      description: Permitted contains the constraints in which the names must be located.
-                      type: object
-                      properties:
-                        dnsDomains:
-                          description: DNSDomains is a list of DNS domains that are permitted or excluded.
-                          type: array
-                          items:
-                            type: string
-                        emailAddresses:
-                          description: EmailAddresses is a list of Email Addresses that are permitted or excluded.
-                          type: array
-                          items:
-                            type: string
-                        ipRanges:
-                          description: |-
-                            IPRanges is a list of IP Ranges that are permitted or excluded.
-                            This should be a valid CIDR notation.
-                          type: array
-                          items:
-                            type: string
-                        uriDomains:
-                          description: URIDomains is a list of URI domains that are permitted or excluded.
-                          type: array
-                          items:
-                            type: string
-                otherNames:
-                  description: |-
-                    `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37
-                    Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.
-                    Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3
-                    You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.
-                  type: array
-                  items:
-                    type: object
-                    properties:
-                      oid:
-                        description: |-
-                          OID is the object identifier for the otherName SAN.
-                          The object identifier must be expressed as a dotted string, for
-                          example, "1.2.840.113556.1.4.221".
-                        type: string
-                      utf8Value:
-                        description: |-
-                          utf8Value is the string value of the otherName SAN.
-                          The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.
-                        type: string
-                privateKey:
-                  description: |-
-                    Private key options. These include the key algorithm and size, the used
-                    encoding and the rotation policy.
-                  type: object
-                  properties:
-                    algorithm:
-                      description: |-
-                        Algorithm is the private key algorithm of the corresponding private key
-                        for this certificate.
-
-                        If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.
-                        If `algorithm` is specified and `size` is not provided,
-                        key size of 2048 will be used for `RSA` key algorithm and
-                        key size of 256 will be used for `ECDSA` key algorithm.
-                        key size is ignored when using the `Ed25519` key algorithm.
-                      type: string
-                      enum:
-                        - RSA
-                        - ECDSA
-                        - Ed25519
-                    encoding:
-                      description: |-
-                        The private key cryptography standards (PKCS) encoding for this
-                        certificate's private key to be encoded in.
-
-                        If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1
-                        and PKCS#8, respectively.
-                        Defaults to `PKCS1` if not specified.
-                      type: string
-                      enum:
-                        - PKCS1
-                        - PKCS8
-                    rotationPolicy:
-                      description: |-
-                        RotationPolicy controls how private keys should be regenerated when a
-                        re-issuance is being processed.
-
-                        If set to `Never`, a private key will only be generated if one does not
-                        already exist in the target `spec.secretName`. If one does exist but it
-                        does not have the correct algorithm or size, a warning will be raised
-                        to await user intervention.
-                        If set to `Always`, a private key matching the specified requirements
-                        will be generated whenever a re-issuance occurs.
-                        Default is `Never` for backward compatibility.
-                      type: string
-                      enum:
-                        - Never
-                        - Always
-                    size:
-                      description: |-
-                        Size is the key bit size of the corresponding private key for this certificate.
-
-                        If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,
-                        and will default to `2048` if not specified.
-                        If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,
-                        and will default to `256` if not specified.
-                        If `algorithm` is set to `Ed25519`, Size is ignored.
-                        No other values are allowed.
-                      type: integer
-                renewBefore:
-                  description: |-
-                    How long before the currently issued certificate's expiry cert-manager should
-                    renew the certificate. For example, if a certificate is valid for 60 minutes,
-                    and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate
-                    50 minutes after it was issued (i.e. when there are 10 minutes remaining until
-                    the certificate is no longer valid).
-
-                    NOTE: The actual lifetime of the issued certificate is used to determine the
-                    renewal time. If an issuer returns a certificate with a different lifetime than
-                    the one requested, cert-manager will use the lifetime of the issued certificate.
-
-                    If unset, this defaults to 1/3 of the issued certificate's lifetime.
-                    Minimum accepted value is 5 minutes.
-                    Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
-                    Cannot be set if the `renewBeforePercentage` field is set.
-                  type: string
-                renewBeforePercentage:
-                  description: |-
-                    `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage
-                    rather than an absolute duration. For example, if a certificate is valid for 60
-                    minutes, and  `renewBeforePercentage=25`, cert-manager will begin to attempt to
-                    renew the certificate 45 minutes after it was issued (i.e. when there are 15
-                    minutes (25%) remaining until the certificate is no longer valid).
-
-                    NOTE: The actual lifetime of the issued certificate is used to determine the
-                    renewal time. If an issuer returns a certificate with a different lifetime than
-                    the one requested, cert-manager will use the lifetime of the issued certificate.
-
-                    Value must be an integer in the range (0,100). The minimum effective
-                    `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5
-                    minutes.
-                    Cannot be set if the `renewBefore` field is set.
-                  type: integer
-                  format: int32
-                revisionHistoryLimit:
-                  description: |-
-                    The maximum number of CertificateRequest revisions that are maintained in
-                    the Certificate's history. Each revision represents a single `CertificateRequest`
-                    created by this Certificate, either when it was created, renewed, or Spec
-                    was changed. Revisions will be removed by oldest first if the number of
-                    revisions exceeds this number.
-
-                    If set, revisionHistoryLimit must be a value of `1` or greater.
-                    If unset (`nil`), revisions will not be garbage collected.
-                    Default value is `nil`.
-                  type: integer
-                  format: int32
-                secretName:
-                  description: |-
-                    Name of the Secret resource that will be automatically created and
-                    managed by this Certificate resource. It will be populated with a
-                    private key and certificate, signed by the denoted issuer. The Secret
-                    resource lives in the same namespace as the Certificate resource.
-                  type: string
-                secretTemplate:
-                  description: |-
-                    Defines annotations and labels to be copied to the Certificate's Secret.
-                    Labels and annotations on the Secret will be changed as they appear on the
-                    SecretTemplate when added or removed. SecretTemplate annotations are added
-                    in conjunction with, and cannot overwrite, the base set of annotations
-                    cert-manager sets on the Certificate's Secret.
-                  type: object
-                  properties:
-                    annotations:
-                      description: Annotations is a key value map to be copied to the target Kubernetes Secret.
-                      type: object
-                      additionalProperties:
-                        type: string
-                    labels:
-                      description: Labels is a key value map to be copied to the target Kubernetes Secret.
-                      type: object
-                      additionalProperties:
-                        type: string
-                subject:
-                  description: |-
-                    Requested set of X509 certificate subject attributes.
-                    More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
-
-                    The common name attribute is specified separately in the `commonName` field.
-                    Cannot be set if the `literalSubject` field is set.
-                  type: object
-                  properties:
-                    countries:
-                      description: Countries to be used on the Certificate.
-                      type: array
-                      items:
-                        type: string
-                    localities:
-                      description: Cities to be used on the Certificate.
-                      type: array
-                      items:
-                        type: string
-                    organizationalUnits:
-                      description: Organizational Units to be used on the Certificate.
-                      type: array
-                      items:
-                        type: string
-                    organizations:
-                      description: Organizations to be used on the Certificate.
-                      type: array
-                      items:
-                        type: string
-                    postalCodes:
-                      description: Postal codes to be used on the Certificate.
-                      type: array
-                      items:
-                        type: string
-                    provinces:
-                      description: State/Provinces to be used on the Certificate.
-                      type: array
-                      items:
-                        type: string
-                    serialNumber:
-                      description: Serial number to be used on the Certificate.
-                      type: string
-                    streetAddresses:
-                      description: Street addresses to be used on the Certificate.
-                      type: array
-                      items:
-                        type: string
-                uris:
-                  description: Requested URI subject alternative names.
-                  type: array
-                  items:
-                    type: string
-                usages:
-                  description: |-
-                    Requested key usages and extended key usages.
-                    These usages are used to set the `usages` field on the created CertificateRequest
-                    resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages
-                    will additionally be encoded in the `request` field which contains the CSR blob.
-
-                    If unset, defaults to `digital signature` and `key encipherment`.
-                  type: array
-                  items:
-                    description: |-
-                      KeyUsage specifies valid usage contexts for keys.
-                      See:
-                      https://tools.ietf.org/html/rfc5280#section-4.2.1.3
-                      https://tools.ietf.org/html/rfc5280#section-4.2.1.12
-
-                      Valid KeyUsage values are as follows:
-                      "signing",
-                      "digital signature",
-                      "content commitment",
-                      "key encipherment",
-                      "key agreement",
-                      "data encipherment",
-                      "cert sign",
-                      "crl sign",
-                      "encipher only",
-                      "decipher only",
-                      "any",
-                      "server auth",
-                      "client auth",
-                      "code signing",
-                      "email protection",
-                      "s/mime",
-                      "ipsec end system",
-                      "ipsec tunnel",
-                      "ipsec user",
-                      "timestamping",
-                      "ocsp signing",
-                      "microsoft sgc",
-                      "netscape sgc"
-                    type: string
-                    enum:
-                      - signing
-                      - digital signature
-                      - content commitment
-                      - key encipherment
-                      - key agreement
-                      - data encipherment
-                      - cert sign
-                      - crl sign
-                      - encipher only
-                      - decipher only
-                      - any
-                      - server auth
-                      - client auth
-                      - code signing
-                      - email protection
-                      - s/mime
-                      - ipsec end system
-                      - ipsec tunnel
-                      - ipsec user
-                      - timestamping
-                      - ocsp signing
-                      - microsoft sgc
-                      - netscape sgc
-            status:
-              description: |-
-                Status of the Certificate.
-                This is set and managed automatically.
-                Read-only.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-              type: object
-              properties:
-                conditions:
-                  description: |-
-                    List of status conditions to indicate the status of certificates.
-                    Known condition types are `Ready` and `Issuing`.
-                  type: array
-                  items:
-                    description: CertificateCondition contains condition information for a Certificate.
-                    type: object
-                    required:
-                      - status
-                      - type
-                    properties:
-                      lastTransitionTime:
-                        description: |-
-                          LastTransitionTime is the timestamp corresponding to the last status
-                          change of this condition.
-                        type: string
-                        format: date-time
-                      message:
-                        description: |-
-                          Message is a human readable description of the details of the last
-                          transition, complementing reason.
-                        type: string
-                      observedGeneration:
-                        description: |-
-                          If set, this represents the .metadata.generation that the condition was
-                          set based upon.
-                          For instance, if .metadata.generation is currently 12, but the
-                          .status.condition[x].observedGeneration is 9, the condition is out of date
-                          with respect to the current state of the Certificate.
-                        type: integer
-                        format: int64
-                      reason:
-                        description: |-
-                          Reason is a brief machine readable explanation for the condition's last
-                          transition.
-                        type: string
-                      status:
-                        description: Status of the condition, one of (`True`, `False`, `Unknown`).
-                        type: string
-                        enum:
-                          - "True"
-                          - "False"
-                          - Unknown
-                      type:
-                        description: Type of the condition, known values are (`Ready`, `Issuing`).
-                        type: string
-                  x-kubernetes-list-map-keys:
-                    - type
-                  x-kubernetes-list-type: map
-                failedIssuanceAttempts:
-                  description: |-
-                    The number of continuous failed issuance attempts up till now. This
-                    field gets removed (if set) on a successful issuance and gets set to
-                    1 if unset and an issuance has failed. If an issuance has failed, the
-                    delay till the next issuance will be calculated using formula
-                    time.Hour * 2 ^ (failedIssuanceAttempts - 1).
-                  type: integer
-                lastFailureTime:
-                  description: |-
-                    LastFailureTime is set only if the latest issuance for this
-                    Certificate failed and contains the time of the failure. If an
-                    issuance has failed, the delay till the next issuance will be
-                    calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -
-                    1). If the latest issuance has succeeded this field will be unset.
-                  type: string
-                  format: date-time
-                nextPrivateKeySecretName:
-                  description: |-
-                    The name of the Secret resource containing the private key to be used
-                    for the next certificate iteration.
-                    The keymanager controller will automatically set this field if the
-                    `Issuing` condition is set to `True`.
-                    It will automatically unset this field when the Issuing condition is
-                    not set or False.
-                  type: string
-                notAfter:
-                  description: |-
-                    The expiration time of the certificate stored in the secret named
-                    by this resource in `spec.secretName`.
-                  type: string
-                  format: date-time
-                notBefore:
-                  description: |-
-                    The time after which the certificate stored in the secret named
-                    by this resource in `spec.secretName` is valid.
-                  type: string
-                  format: date-time
-                renewalTime:
-                  description: |-
-                    RenewalTime is the time at which the certificate will be next
-                    renewed.
-                    If not set, no upcoming renewal is scheduled.
-                  type: string
-                  format: date-time
-                revision:
-                  description: |-
-                    The current 'revision' of the certificate as issued.
-
-                    When a CertificateRequest resource is created, it will have the
-                    `cert-manager.io/certificate-revision` set to one greater than the
-                    current value of this field.
-
-                    Upon issuance, this field will be set to the value of the annotation
-                    on the CertificateRequest resource used to issue the certificate.
-
-                    Persisting the value on the CertificateRequest resource allows the
-                    certificates controller to know whether a request is part of an old
-                    issuance or if it is part of the ongoing revision's issuance by
-                    checking if the revision value in the annotation is greater than this
-                    field.
-                  type: integer
-      served: true
-      storage: true
-
-# END crd {{- end }}
-
----
-# START crd {{- if or .Values.crds.enabled .Values.installCRDs }}
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: challenges.acme.cert-manager.io
-  # START annotations {{- if .Values.crds.keep }}
-  annotations:
-    helm.sh/resource-policy: keep
-  # END annotations {{- end }}
-  labels:
-    app: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/instance: '{{ .Release.Name }}'
-    # Generated labels {{- include "labels" . | nindent 4 }}
-spec:
-  group: acme.cert-manager.io
-  names:
-    kind: Challenge
-    listKind: ChallengeList
-    plural: challenges
-    singular: challenge
-    categories:
-      - cert-manager
-      - cert-manager-acme
-  scope: Namespaced
-  versions:
-    - additionalPrinterColumns:
-        - jsonPath: .status.state
-          name: State
-          type: string
-        - jsonPath: .spec.dnsName
-          name: Domain
-          type: string
-        - jsonPath: .status.reason
-          name: Reason
-          priority: 1
-          type: string
-        - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
-          jsonPath: .metadata.creationTimestamp
-          name: Age
-          type: date
-      name: v1
-      schema:
-        openAPIV3Schema:
-          description: Challenge is a type to represent a Challenge request with an ACME server
-          type: object
-          required:
-            - metadata
-            - spec
-          properties:
-            apiVersion:
-              description: |-
-                APIVersion defines the versioned schema of this representation of an object.
-                Servers should convert recognized schemas to the latest internal value, and
-                may reject unrecognized values.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-              type: string
-            kind:
-              description: |-
-                Kind is a string value representing the REST resource this object represents.
-                Servers may infer this from the endpoint the client submits requests to.
-                Cannot be updated.
-                In CamelCase.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-              type: string
-            metadata:
-              type: object
-            spec:
-              type: object
-              required:
-                - authorizationURL
-                - dnsName
-                - issuerRef
-                - key
-                - solver
-                - token
-                - type
-                - url
-              properties:
-                authorizationURL:
-                  description: |-
-                    The URL to the ACME Authorization resource that this
-                    challenge is a part of.
-                  type: string
-                dnsName:
-                  description: |-
-                    dnsName is the identifier that this challenge is for, e.g. example.com.
-                    If the requested DNSName is a 'wildcard', this field MUST be set to the
-                    non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`.
-                  type: string
-                issuerRef:
-                  description: |-
-                    References a properly configured ACME-type Issuer which should
-                    be used to create this Challenge.
-                    If the Issuer does not exist, processing will be retried.
-                    If the Issuer is not an 'ACME' Issuer, an error will be returned and the
-                    Challenge will be marked as failed.
-                  type: object
-                  required:
-                    - name
-                  properties:
-                    group:
-                      description: Group of the resource being referred to.
-                      type: string
-                    kind:
-                      description: Kind of the resource being referred to.
-                      type: string
-                    name:
-                      description: Name of the resource being referred to.
-                      type: string
-                key:
-                  description: |-
-                    The ACME challenge key for this challenge
-                    For HTTP01 challenges, this is the value that must be responded with to
-                    complete the HTTP01 challenge in the format:
-                    `<private key JWK thumbprint>.<key from acme server for challenge>`.
-                    For DNS01 challenges, this is the base64 encoded SHA256 sum of the
-                    `<private key JWK thumbprint>.<key from acme server for challenge>`
-                    text that must be set as the TXT record content.
-                  type: string
-                solver:
-                  description: |-
-                    Contains the domain solving configuration that should be used to
-                    solve this challenge resource.
-                  type: object
-                  properties:
-                    dns01:
-                      description: |-
-                        Configures cert-manager to attempt to complete authorizations by
-                        performing the DNS01 challenge flow.
-                      type: object
-                      properties:
-                        acmeDNS:
-                          description: |-
-                            Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
-                            DNS01 challenge records.
-                          type: object
-                          required:
-                            - accountSecretRef
-                            - host
-                          properties:
-                            accountSecretRef:
-                              description: |-
-                                A reference to a specific 'key' within a Secret resource.
-                                In some instances, `key` is a required field.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            host:
-                              type: string
-                        akamai:
-                          description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
-                          type: object
-                          required:
-                            - accessTokenSecretRef
-                            - clientSecretSecretRef
-                            - clientTokenSecretRef
-                            - serviceConsumerDomain
-                          properties:
-                            accessTokenSecretRef:
-                              description: |-
-                                A reference to a specific 'key' within a Secret resource.
-                                In some instances, `key` is a required field.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            clientSecretSecretRef:
-                              description: |-
-                                A reference to a specific 'key' within a Secret resource.
-                                In some instances, `key` is a required field.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            clientTokenSecretRef:
-                              description: |-
-                                A reference to a specific 'key' within a Secret resource.
-                                In some instances, `key` is a required field.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            serviceConsumerDomain:
-                              type: string
-                        azureDNS:
-                          description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
-                          type: object
-                          required:
-                            - resourceGroupName
-                            - subscriptionID
-                          properties:
-                            clientID:
-                              description: |-
-                                Auth: Azure Service Principal:
-                                The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
-                                If set, ClientSecret and TenantID must also be set.
-                              type: string
-                            clientSecretSecretRef:
-                              description: |-
-                                Auth: Azure Service Principal:
-                                A reference to a Secret containing the password associated with the Service Principal.
-                                If set, ClientID and TenantID must also be set.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            environment:
-                              description: name of the Azure environment (default AzurePublicCloud)
-                              type: string
-                              enum:
-                                - AzurePublicCloud
-                                - AzureChinaCloud
-                                - AzureGermanCloud
-                                - AzureUSGovernmentCloud
-                            hostedZoneName:
-                              description: name of the DNS zone that should be used
-                              type: string
-                            managedIdentity:
-                              description: |-
-                                Auth: Azure Workload Identity or Azure Managed Service Identity:
-                                Settings to enable Azure Workload Identity or Azure Managed Service Identity
-                                If set, ClientID, ClientSecret and TenantID must not be set.
-                              type: object
-                              properties:
-                                clientID:
-                                  description: client ID of the managed identity, can not be used at the same time as resourceID
-                                  type: string
-                                resourceID:
-                                  description: |-
-                                    resource ID of the managed identity, can not be used at the same time as clientID
-                                    Cannot be used for Azure Managed Service Identity
-                                  type: string
-                                tenantID:
-                                  description: tenant ID of the managed identity, can not be used at the same time as resourceID
-                                  type: string
-                            resourceGroupName:
-                              description: resource group the DNS zone is located in
-                              type: string
-                            subscriptionID:
-                              description: ID of the Azure subscription
-                              type: string
-                            tenantID:
-                              description: |-
-                                Auth: Azure Service Principal:
-                                The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
-                                If set, ClientID and ClientSecret must also be set.
-                              type: string
-                        cloudDNS:
-                          description: Use the Google Cloud DNS API to manage DNS01 challenge records.
-                          type: object
-                          required:
-                            - project
-                          properties:
-                            hostedZoneName:
-                              description: |-
-                                HostedZoneName is an optional field that tells cert-manager in which
-                                Cloud DNS zone the challenge record has to be created.
-                                If left empty cert-manager will automatically choose a zone.
-                              type: string
-                            project:
-                              type: string
-                            serviceAccountSecretRef:
-                              description: |-
-                                A reference to a specific 'key' within a Secret resource.
-                                In some instances, `key` is a required field.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                        cloudflare:
-                          description: Use the Cloudflare API to manage DNS01 challenge records.
-                          type: object
-                          properties:
-                            apiKeySecretRef:
-                              description: |-
-                                API key to use to authenticate with Cloudflare.
-                                Note: using an API token to authenticate is now the recommended method
-                                as it allows greater control of permissions.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            apiTokenSecretRef:
-                              description: API token used to authenticate with Cloudflare.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            email:
-                              description: Email of the account, only required when using API key based authentication.
-                              type: string
-                        cnameStrategy:
-                          description: |-
-                            CNAMEStrategy configures how the DNS01 provider should handle CNAME
-                            records when found in DNS zones.
-                          type: string
-                          enum:
-                            - None
-                            - Follow
-                        digitalocean:
-                          description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
-                          type: object
-                          required:
-                            - tokenSecretRef
-                          properties:
-                            tokenSecretRef:
-                              description: |-
-                                A reference to a specific 'key' within a Secret resource.
-                                In some instances, `key` is a required field.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                        rfc2136:
-                          description: |-
-                            Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
-                            to manage DNS01 challenge records.
-                          type: object
-                          required:
-                            - nameserver
-                          properties:
-                            nameserver:
-                              description: |-
-                                The IP address or hostname of an authoritative DNS server supporting
-                                RFC2136 in the form host:port. If the host is an IPv6 address it must be
-                                enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
-                                This field is required.
-                              type: string
-                            tsigAlgorithm:
-                              description: |-
-                                The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
-                                when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
-                                Supported values are (case-insensitive): ``HMACMD5`` (default),
-                                ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
-                              type: string
-                            tsigKeyName:
-                              description: |-
-                                The TSIG Key name configured in the DNS.
-                                If ``tsigSecretSecretRef`` is defined, this field is required.
-                              type: string
-                            tsigSecretSecretRef:
-                              description: |-
-                                The name of the secret containing the TSIG value.
-                                If ``tsigKeyName`` is defined, this field is required.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                        route53:
-                          description: Use the AWS Route53 API to manage DNS01 challenge records.
-                          type: object
-                          properties:
-                            accessKeyID:
-                              description: |-
-                                The AccessKeyID is used for authentication.
-                                Cannot be set when SecretAccessKeyID is set.
-                                If neither the Access Key nor Key ID are set, we fall-back to using env
-                                vars, shared credentials file or AWS Instance metadata,
-                                see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
-                              type: string
-                            accessKeyIDSecretRef:
-                              description: |-
-                                The SecretAccessKey is used for authentication. If set, pull the AWS
-                                access key ID from a key within a Kubernetes Secret.
-                                Cannot be set when AccessKeyID is set.
-                                If neither the Access Key nor Key ID are set, we fall-back to using env
-                                vars, shared credentials file or AWS Instance metadata,
-                                see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            auth:
-                              description: Auth configures how cert-manager authenticates.
-                              type: object
-                              required:
-                                - kubernetes
-                              properties:
-                                kubernetes:
-                                  description: |-
-                                    Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
-                                    by passing a bound ServiceAccount token.
-                                  type: object
-                                  required:
-                                    - serviceAccountRef
-                                  properties:
-                                    serviceAccountRef:
-                                      description: |-
-                                        A reference to a service account that will be used to request a bound
-                                        token (also known as "projected token"). To use this field, you must
-                                        configure an RBAC rule to let cert-manager request a token.
-                                      type: object
-                                      required:
-                                        - name
-                                      properties:
-                                        audiences:
-                                          description: |-
-                                            TokenAudiences is an optional list of audiences to include in the
-                                            token passed to AWS. The default token consisting of the issuer's namespace
-                                            and name is always included.
-                                            If unset the audience defaults to `sts.amazonaws.com`.
-                                          type: array
-                                          items:
-                                            type: string
-                                        name:
-                                          description: Name of the ServiceAccount used to request a token.
-                                          type: string
-                            hostedZoneID:
-                              description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.
-                              type: string
-                            region:
-                              description: |-
-                                Override the AWS region.
-
-                                Route53 is a global service and does not have regional endpoints but the
-                                region specified here (or via environment variables) is used as a hint to
-                                help compute the correct AWS credential scope and partition when it
-                                connects to Route53. See:
-                                - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
-                                - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)
-
-                                If you omit this region field, cert-manager will use the region from
-                                AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
-                                in the cert-manager controller Pod.
-
-                                The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
-                                Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
-                                [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
-                                In this case this `region` field value is ignored.
-
-                                The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
-                                Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
-                                [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
-                                In this case this `region` field value is ignored.
-                              type: string
-                            role:
-                              description: |-
-                                Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
-                                or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
-                              type: string
-                            secretAccessKeySecretRef:
-                              description: |-
-                                The SecretAccessKey is used for authentication.
-                                If neither the Access Key nor Key ID are set, we fall-back to using env
-                                vars, shared credentials file or AWS Instance metadata,
-                                see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                        webhook:
-                          description: |-
-                            Configure an external webhook based DNS01 challenge solver to manage
-                            DNS01 challenge records.
-                          type: object
-                          required:
-                            - groupName
-                            - solverName
-                          properties:
-                            config:
-                              description: |-
-                                Additional configuration that should be passed to the webhook apiserver
-                                when challenges are processed.
-                                This can contain arbitrary JSON data.
-                                Secret values should not be specified in this stanza.
-                                If secret values are needed (e.g. credentials for a DNS service), you
-                                should use a SecretKeySelector to reference a Secret resource.
-                                For details on the schema of this field, consult the webhook provider
-                                implementation's documentation.
-                              x-kubernetes-preserve-unknown-fields: true
-                            groupName:
-                              description: |-
-                                The API group name that should be used when POSTing ChallengePayload
-                                resources to the webhook apiserver.
-                                This should be the same as the GroupName specified in the webhook
-                                provider implementation.
-                              type: string
-                            solverName:
-                              description: |-
-                                The name of the solver to use, as defined in the webhook provider
-                                implementation.
-                                This will typically be the name of the provider, e.g. 'cloudflare'.
-                              type: string
-                    http01:
-                      description: |-
-                        Configures cert-manager to attempt to complete authorizations by
-                        performing the HTTP01 challenge flow.
-                        It is not possible to obtain certificates for wildcard domain names
-                        (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
-                      type: object
-                      properties:
-                        gatewayHTTPRoute:
-                          description: |-
-                            The Gateway API is a sig-network community API that models service networking
-                            in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
-                            create HTTPRoutes with the specified labels in the same namespace as the challenge.
-                            This solver is experimental, and fields / behaviour may change in the future.
-                          type: object
-                          properties:
-                            labels:
-                              description: |-
-                                Custom labels that will be applied to HTTPRoutes created by cert-manager
-                                while solving HTTP-01 challenges.
-                              type: object
-                              additionalProperties:
-                                type: string
-                            parentRefs:
-                              description: |-
-                                When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
-                                cert-manager needs to know which parentRefs should be used when creating
-                                the HTTPRoute. Usually, the parentRef references a Gateway. See:
-                                https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
-                              type: array
-                              items:
-                                description: |-
-                                  ParentReference identifies an API object (usually a Gateway) that can be considered
-                                  a parent of this resource (usually a route). There are two kinds of parent resources
-                                  with "Core" support:
-
-                                  * Gateway (Gateway conformance profile)
-                                  * Service (Mesh conformance profile, ClusterIP Services only)
-
-                                  This API may be extended in the future to support additional kinds of parent
-                                  resources.
-
-                                  The API object must be valid in the cluster; the Group and Kind must
-                                  be registered in the cluster for this reference to be valid.
-                                type: object
-                                required:
-                                  - name
-                                properties:
-                                  group:
-                                    description: |-
-                                      Group is the group of the referent.
-                                      When unspecified, "gateway.networking.k8s.io" is inferred.
-                                      To set the core API group (such as for a "Service" kind referent),
-                                      Group must be explicitly set to "" (empty string).
-
-                                      Support: Core
-                                    type: string
-                                    default: gateway.networking.k8s.io
-                                    maxLength: 253
-                                    pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                  kind:
-                                    description: |-
-                                      Kind is kind of the referent.
-
-                                      There are two kinds of parent resources with "Core" support:
-
-                                      * Gateway (Gateway conformance profile)
-                                      * Service (Mesh conformance profile, ClusterIP Services only)
-
-                                      Support for other resources is Implementation-Specific.
-                                    type: string
-                                    default: Gateway
-                                    maxLength: 63
-                                    minLength: 1
-                                    pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                                  name:
-                                    description: |-
-                                      Name is the name of the referent.
-
-                                      Support: Core
-                                    type: string
-                                    maxLength: 253
-                                    minLength: 1
-                                  namespace:
-                                    description: |-
-                                      Namespace is the namespace of the referent. When unspecified, this refers
-                                      to the local namespace of the Route.
-
-                                      Note that there are specific rules for ParentRefs which cross namespace
-                                      boundaries. Cross-namespace references are only valid if they are explicitly
-                                      allowed by something in the namespace they are referring to. For example:
-                                      Gateway has the AllowedRoutes field, and ReferenceGrant provides a
-                                      generic way to enable any other kind of cross-namespace reference.
-
-                                      <gateway:experimental:description>
-                                      ParentRefs from a Route to a Service in the same namespace are "producer"
-                                      routes, which apply default routing rules to inbound connections from
-                                      any namespace to the Service.
-
-                                      ParentRefs from a Route to a Service in a different namespace are
-                                      "consumer" routes, and these routing rules are only applied to outbound
-                                      connections originating from the same namespace as the Route, for which
-                                      the intended destination of the connections are a Service targeted as a
-                                      ParentRef of the Route.
-                                      </gateway:experimental:description>
-
-                                      Support: Core
-                                    type: string
-                                    maxLength: 63
-                                    minLength: 1
-                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                                  port:
-                                    description: |-
-                                      Port is the network port this Route targets. It can be interpreted
-                                      differently based on the type of parent resource.
-
-                                      When the parent resource is a Gateway, this targets all listeners
-                                      listening on the specified port that also support this kind of Route(and
-                                      select this Route). It's not recommended to set `Port` unless the
-                                      networking behaviors specified in a Route must apply to a specific port
-                                      as opposed to a listener(s) whose port(s) may be changed. When both Port
-                                      and SectionName are specified, the name and port of the selected listener
-                                      must match both specified values.
-
-                                      <gateway:experimental:description>
-                                      When the parent resource is a Service, this targets a specific port in the
-                                      Service spec. When both Port (experimental) and SectionName are specified,
-                                      the name and port of the selected port must match both specified values.
-                                      </gateway:experimental:description>
-
-                                      Implementations MAY choose to support other parent resources.
-                                      Implementations supporting other types of parent resources MUST clearly
-                                      document how/if Port is interpreted.
-
-                                      For the purpose of status, an attachment is considered successful as
-                                      long as the parent resource accepts it partially. For example, Gateway
-                                      listeners can restrict which Routes can attach to them by Route kind,
-                                      namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
-                                      from the referencing Route, the Route MUST be considered successfully
-                                      attached. If no Gateway listeners accept attachment from this Route,
-                                      the Route MUST be considered detached from the Gateway.
-
-                                      Support: Extended
-                                    type: integer
-                                    format: int32
-                                    maximum: 65535
-                                    minimum: 1
-                                  sectionName:
-                                    description: |-
-                                      SectionName is the name of a section within the target resource. In the
-                                      following resources, SectionName is interpreted as the following:
-
-                                      * Gateway: Listener name. When both Port (experimental) and SectionName
-                                      are specified, the name and port of the selected listener must match
-                                      both specified values.
-                                      * Service: Port name. When both Port (experimental) and SectionName
-                                      are specified, the name and port of the selected listener must match
-                                      both specified values.
-
-                                      Implementations MAY choose to support attaching Routes to other resources.
-                                      If that is the case, they MUST clearly document how SectionName is
-                                      interpreted.
-
-                                      When unspecified (empty string), this will reference the entire resource.
-                                      For the purpose of status, an attachment is considered successful if at
-                                      least one section in the parent resource accepts it. For example, Gateway
-                                      listeners can restrict which Routes can attach to them by Route kind,
-                                      namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
-                                      the referencing Route, the Route MUST be considered successfully
-                                      attached. If no Gateway listeners accept attachment from this Route, the
-                                      Route MUST be considered detached from the Gateway.
-
-                                      Support: Core
-                                    type: string
-                                    maxLength: 253
-                                    minLength: 1
-                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                            podTemplate:
-                              description: |-
-                                Optional pod template used to configure the ACME challenge solver pods
-                                used for HTTP01 challenges.
-                              type: object
-                              properties:
-                                metadata:
-                                  description: |-
-                                    ObjectMeta overrides for the pod used to solve HTTP01 challenges.
-                                    Only the 'labels' and 'annotations' fields may be set.
-                                    If labels or annotations overlap with in-built values, the values here
-                                    will override the in-built values.
-                                  type: object
-                                  properties:
-                                    annotations:
-                                      description: Annotations that should be added to the created ACME HTTP01 solver pods.
-                                      type: object
-                                      additionalProperties:
-                                        type: string
-                                    labels:
-                                      description: Labels that should be added to the created ACME HTTP01 solver pods.
-                                      type: object
-                                      additionalProperties:
-                                        type: string
-                                spec:
-                                  description: |-
-                                    PodSpec defines overrides for the HTTP01 challenge solver pod.
-                                    Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
-                                    All other fields will be ignored.
-                                  type: object
-                                  properties:
-                                    affinity:
-                                      description: If specified, the pod's scheduling constraints
-                                      type: object
-                                      properties:
-                                        nodeAffinity:
-                                          description: Describes node affinity scheduling rules for the pod.
-                                          type: object
-                                          properties:
-                                            preferredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                The scheduler will prefer to schedule pods to nodes that satisfy
-                                                the affinity expressions specified by this field, but it may choose
-                                                a node that violates one or more of the expressions. The node that is
-                                                most preferred is the one with the greatest sum of weights, i.e.
-                                                for each node that meets all of the scheduling requirements (resource
-                                                request, requiredDuringScheduling affinity expressions, etc.),
-                                                compute a sum by iterating through the elements of this field and adding
-                                                "weight" to the sum if the node matches the corresponding matchExpressions; the
-                                                node(s) with the highest sum are the most preferred.
-                                              type: array
-                                              items:
-                                                description: |-
-                                                  An empty preferred scheduling term matches all objects with implicit weight 0
-                                                  (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
-                                                type: object
-                                                required:
-                                                  - preference
-                                                  - weight
-                                                properties:
-                                                  preference:
-                                                    description: A node selector term, associated with the corresponding weight.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: A list of node selector requirements by node's labels.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A node selector requirement is a selector that contains values, a key, and an operator
-                                                            that relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: The label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                Represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                An array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. If the operator is Gt or Lt, the values
-                                                                array must have a single element, which will be interpreted as an integer.
-                                                                This array is replaced during a strategic merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchFields:
-                                                        description: A list of node selector requirements by node's fields.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A node selector requirement is a selector that contains values, a key, and an operator
-                                                            that relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: The label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                Represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                An array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. If the operator is Gt or Lt, the values
-                                                                array must have a single element, which will be interpreted as an integer.
-                                                                This array is replaced during a strategic merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                    x-kubernetes-map-type: atomic
-                                                  weight:
-                                                    description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
-                                                    type: integer
-                                                    format: int32
-                                              x-kubernetes-list-type: atomic
-                                            requiredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                If the affinity requirements specified by this field are not met at
-                                                scheduling time, the pod will not be scheduled onto the node.
-                                                If the affinity requirements specified by this field cease to be met
-                                                at some point during pod execution (e.g. due to an update), the system
-                                                may or may not try to eventually evict the pod from its node.
-                                              type: object
-                                              required:
-                                                - nodeSelectorTerms
-                                              properties:
-                                                nodeSelectorTerms:
-                                                  description: Required. A list of node selector terms. The terms are ORed.
-                                                  type: array
-                                                  items:
-                                                    description: |-
-                                                      A null or empty node selector term matches no objects. The requirements of
-                                                      them are ANDed.
-                                                      The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: A list of node selector requirements by node's labels.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A node selector requirement is a selector that contains values, a key, and an operator
-                                                            that relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: The label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                Represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                An array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. If the operator is Gt or Lt, the values
-                                                                array must have a single element, which will be interpreted as an integer.
-                                                                This array is replaced during a strategic merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchFields:
-                                                        description: A list of node selector requirements by node's fields.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A node selector requirement is a selector that contains values, a key, and an operator
-                                                            that relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: The label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                Represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                An array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. If the operator is Gt or Lt, the values
-                                                                array must have a single element, which will be interpreted as an integer.
-                                                                This array is replaced during a strategic merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                    x-kubernetes-map-type: atomic
-                                                  x-kubernetes-list-type: atomic
-                                              x-kubernetes-map-type: atomic
-                                        podAffinity:
-                                          description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
-                                          type: object
-                                          properties:
-                                            preferredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                The scheduler will prefer to schedule pods to nodes that satisfy
-                                                the affinity expressions specified by this field, but it may choose
-                                                a node that violates one or more of the expressions. The node that is
-                                                most preferred is the one with the greatest sum of weights, i.e.
-                                                for each node that meets all of the scheduling requirements (resource
-                                                request, requiredDuringScheduling affinity expressions, etc.),
-                                                compute a sum by iterating through the elements of this field and adding
-                                                "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                node(s) with the highest sum are the most preferred.
-                                              type: array
-                                              items:
-                                                description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                type: object
-                                                required:
-                                                  - podAffinityTerm
-                                                  - weight
-                                                properties:
-                                                  podAffinityTerm:
-                                                    description: Required. A pod affinity term, associated with the corresponding weight.
-                                                    type: object
-                                                    required:
-                                                      - topologyKey
-                                                    properties:
-                                                      labelSelector:
-                                                        description: |-
-                                                          A label query over a set of resources, in this case pods.
-                                                          If it's null, this PodAffinityTerm matches with no Pods.
-                                                        type: object
-                                                        properties:
-                                                          matchExpressions:
-                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                            type: array
-                                                            items:
-                                                              description: |-
-                                                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                relates the key and values.
-                                                              type: object
-                                                              required:
-                                                                - key
-                                                                - operator
-                                                              properties:
-                                                                key:
-                                                                  description: key is the label key that the selector applies to.
-                                                                  type: string
-                                                                operator:
-                                                                  description: |-
-                                                                    operator represents a key's relationship to a set of values.
-                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                  type: string
-                                                                values:
-                                                                  description: |-
-                                                                    values is an array of string values. If the operator is In or NotIn,
-                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                    the values array must be empty. This array is replaced during a strategic
-                                                                    merge patch.
-                                                                  type: array
-                                                                  items:
-                                                                    type: string
-                                                                  x-kubernetes-list-type: atomic
-                                                            x-kubernetes-list-type: atomic
-                                                          matchLabels:
-                                                            description: |-
-                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                            type: object
-                                                            additionalProperties:
-                                                              type: string
-                                                        x-kubernetes-map-type: atomic
-                                                      matchLabelKeys:
-                                                        description: |-
-                                                          MatchLabelKeys is a set of pod label keys to select which pods will
-                                                          be taken into consideration. The keys are used to lookup values from the
-                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                          to select the group of existing pods which pods will be taken into consideration
-                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                          pod labels will be ignored. The default value is empty.
-                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      mismatchLabelKeys:
-                                                        description: |-
-                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                          be taken into consideration. The keys are used to lookup values from the
-                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                          to select the group of existing pods which pods will be taken into consideration
-                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                          pod labels will be ignored. The default value is empty.
-                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      namespaceSelector:
-                                                        description: |-
-                                                          A label query over the set of namespaces that the term applies to.
-                                                          The term is applied to the union of the namespaces selected by this field
-                                                          and the ones listed in the namespaces field.
-                                                          null selector and null or empty namespaces list means "this pod's namespace".
-                                                          An empty selector ({}) matches all namespaces.
-                                                        type: object
-                                                        properties:
-                                                          matchExpressions:
-                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                            type: array
-                                                            items:
-                                                              description: |-
-                                                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                relates the key and values.
-                                                              type: object
-                                                              required:
-                                                                - key
-                                                                - operator
-                                                              properties:
-                                                                key:
-                                                                  description: key is the label key that the selector applies to.
-                                                                  type: string
-                                                                operator:
-                                                                  description: |-
-                                                                    operator represents a key's relationship to a set of values.
-                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                  type: string
-                                                                values:
-                                                                  description: |-
-                                                                    values is an array of string values. If the operator is In or NotIn,
-                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                    the values array must be empty. This array is replaced during a strategic
-                                                                    merge patch.
-                                                                  type: array
-                                                                  items:
-                                                                    type: string
-                                                                  x-kubernetes-list-type: atomic
-                                                            x-kubernetes-list-type: atomic
-                                                          matchLabels:
-                                                            description: |-
-                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                            type: object
-                                                            additionalProperties:
-                                                              type: string
-                                                        x-kubernetes-map-type: atomic
-                                                      namespaces:
-                                                        description: |-
-                                                          namespaces specifies a static list of namespace names that the term applies to.
-                                                          The term is applied to the union of the namespaces listed in this field
-                                                          and the ones selected by namespaceSelector.
-                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      topologyKey:
-                                                        description: |-
-                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                          whose value of the label with key topologyKey matches that of any node on which any of the
-                                                          selected pods is running.
-                                                          Empty topologyKey is not allowed.
-                                                        type: string
-                                                  weight:
-                                                    description: |-
-                                                      weight associated with matching the corresponding podAffinityTerm,
-                                                      in the range 1-100.
-                                                    type: integer
-                                                    format: int32
-                                              x-kubernetes-list-type: atomic
-                                            requiredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                If the affinity requirements specified by this field are not met at
-                                                scheduling time, the pod will not be scheduled onto the node.
-                                                If the affinity requirements specified by this field cease to be met
-                                                at some point during pod execution (e.g. due to a pod label update), the
-                                                system may or may not try to eventually evict the pod from its node.
-                                                When there are multiple elements, the lists of nodes corresponding to each
-                                                podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                              type: array
-                                              items:
-                                                description: |-
-                                                  Defines a set of pods (namely those matching the labelSelector
-                                                  relative to the given namespace(s)) that this pod should be
-                                                  co-located (affinity) or not co-located (anti-affinity) with,
-                                                  where co-located is defined as running on a node whose value of
-                                                  the label with key <topologyKey> matches that of any node on which
-                                                  a pod of the set of pods is running
-                                                type: object
-                                                required:
-                                                  - topologyKey
-                                                properties:
-                                                  labelSelector:
-                                                    description: |-
-                                                      A label query over a set of resources, in this case pods.
-                                                      If it's null, this PodAffinityTerm matches with no Pods.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A label selector requirement is a selector that contains values, a key, and an operator that
-                                                            relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: key is the label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                operator represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                values is an array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. This array is replaced during a strategic
-                                                                merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchLabels:
-                                                        description: |-
-                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                        type: object
-                                                        additionalProperties:
-                                                          type: string
-                                                    x-kubernetes-map-type: atomic
-                                                  matchLabelKeys:
-                                                    description: |-
-                                                      MatchLabelKeys is a set of pod label keys to select which pods will
-                                                      be taken into consideration. The keys are used to lookup values from the
-                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                      to select the group of existing pods which pods will be taken into consideration
-                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                      pod labels will be ignored. The default value is empty.
-                                                      The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                      Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  mismatchLabelKeys:
-                                                    description: |-
-                                                      MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                      be taken into consideration. The keys are used to lookup values from the
-                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                      to select the group of existing pods which pods will be taken into consideration
-                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                      pod labels will be ignored. The default value is empty.
-                                                      The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                      Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  namespaceSelector:
-                                                    description: |-
-                                                      A label query over the set of namespaces that the term applies to.
-                                                      The term is applied to the union of the namespaces selected by this field
-                                                      and the ones listed in the namespaces field.
-                                                      null selector and null or empty namespaces list means "this pod's namespace".
-                                                      An empty selector ({}) matches all namespaces.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A label selector requirement is a selector that contains values, a key, and an operator that
-                                                            relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: key is the label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                operator represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                values is an array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. This array is replaced during a strategic
-                                                                merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchLabels:
-                                                        description: |-
-                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                        type: object
-                                                        additionalProperties:
-                                                          type: string
-                                                    x-kubernetes-map-type: atomic
-                                                  namespaces:
-                                                    description: |-
-                                                      namespaces specifies a static list of namespace names that the term applies to.
-                                                      The term is applied to the union of the namespaces listed in this field
-                                                      and the ones selected by namespaceSelector.
-                                                      null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  topologyKey:
-                                                    description: |-
-                                                      This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                      the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                      whose value of the label with key topologyKey matches that of any node on which any of the
-                                                      selected pods is running.
-                                                      Empty topologyKey is not allowed.
-                                                    type: string
-                                              x-kubernetes-list-type: atomic
-                                        podAntiAffinity:
-                                          description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
-                                          type: object
-                                          properties:
-                                            preferredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                The scheduler will prefer to schedule pods to nodes that satisfy
-                                                the anti-affinity expressions specified by this field, but it may choose
-                                                a node that violates one or more of the expressions. The node that is
-                                                most preferred is the one with the greatest sum of weights, i.e.
-                                                for each node that meets all of the scheduling requirements (resource
-                                                request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                                compute a sum by iterating through the elements of this field and adding
-                                                "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                node(s) with the highest sum are the most preferred.
-                                              type: array
-                                              items:
-                                                description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                type: object
-                                                required:
-                                                  - podAffinityTerm
-                                                  - weight
-                                                properties:
-                                                  podAffinityTerm:
-                                                    description: Required. A pod affinity term, associated with the corresponding weight.
-                                                    type: object
-                                                    required:
-                                                      - topologyKey
-                                                    properties:
-                                                      labelSelector:
-                                                        description: |-
-                                                          A label query over a set of resources, in this case pods.
-                                                          If it's null, this PodAffinityTerm matches with no Pods.
-                                                        type: object
-                                                        properties:
-                                                          matchExpressions:
-                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                            type: array
-                                                            items:
-                                                              description: |-
-                                                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                relates the key and values.
-                                                              type: object
-                                                              required:
-                                                                - key
-                                                                - operator
-                                                              properties:
-                                                                key:
-                                                                  description: key is the label key that the selector applies to.
-                                                                  type: string
-                                                                operator:
-                                                                  description: |-
-                                                                    operator represents a key's relationship to a set of values.
-                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                  type: string
-                                                                values:
-                                                                  description: |-
-                                                                    values is an array of string values. If the operator is In or NotIn,
-                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                    the values array must be empty. This array is replaced during a strategic
-                                                                    merge patch.
-                                                                  type: array
-                                                                  items:
-                                                                    type: string
-                                                                  x-kubernetes-list-type: atomic
-                                                            x-kubernetes-list-type: atomic
-                                                          matchLabels:
-                                                            description: |-
-                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                            type: object
-                                                            additionalProperties:
-                                                              type: string
-                                                        x-kubernetes-map-type: atomic
-                                                      matchLabelKeys:
-                                                        description: |-
-                                                          MatchLabelKeys is a set of pod label keys to select which pods will
-                                                          be taken into consideration. The keys are used to lookup values from the
-                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                          to select the group of existing pods which pods will be taken into consideration
-                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                          pod labels will be ignored. The default value is empty.
-                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      mismatchLabelKeys:
-                                                        description: |-
-                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                          be taken into consideration. The keys are used to lookup values from the
-                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                          to select the group of existing pods which pods will be taken into consideration
-                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                          pod labels will be ignored. The default value is empty.
-                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      namespaceSelector:
-                                                        description: |-
-                                                          A label query over the set of namespaces that the term applies to.
-                                                          The term is applied to the union of the namespaces selected by this field
-                                                          and the ones listed in the namespaces field.
-                                                          null selector and null or empty namespaces list means "this pod's namespace".
-                                                          An empty selector ({}) matches all namespaces.
-                                                        type: object
-                                                        properties:
-                                                          matchExpressions:
-                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                            type: array
-                                                            items:
-                                                              description: |-
-                                                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                relates the key and values.
-                                                              type: object
-                                                              required:
-                                                                - key
-                                                                - operator
-                                                              properties:
-                                                                key:
-                                                                  description: key is the label key that the selector applies to.
-                                                                  type: string
-                                                                operator:
-                                                                  description: |-
-                                                                    operator represents a key's relationship to a set of values.
-                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                  type: string
-                                                                values:
-                                                                  description: |-
-                                                                    values is an array of string values. If the operator is In or NotIn,
-                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                    the values array must be empty. This array is replaced during a strategic
-                                                                    merge patch.
-                                                                  type: array
-                                                                  items:
-                                                                    type: string
-                                                                  x-kubernetes-list-type: atomic
-                                                            x-kubernetes-list-type: atomic
-                                                          matchLabels:
-                                                            description: |-
-                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                            type: object
-                                                            additionalProperties:
-                                                              type: string
-                                                        x-kubernetes-map-type: atomic
-                                                      namespaces:
-                                                        description: |-
-                                                          namespaces specifies a static list of namespace names that the term applies to.
-                                                          The term is applied to the union of the namespaces listed in this field
-                                                          and the ones selected by namespaceSelector.
-                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      topologyKey:
-                                                        description: |-
-                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                          whose value of the label with key topologyKey matches that of any node on which any of the
-                                                          selected pods is running.
-                                                          Empty topologyKey is not allowed.
-                                                        type: string
-                                                  weight:
-                                                    description: |-
-                                                      weight associated with matching the corresponding podAffinityTerm,
-                                                      in the range 1-100.
-                                                    type: integer
-                                                    format: int32
-                                              x-kubernetes-list-type: atomic
-                                            requiredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                If the anti-affinity requirements specified by this field are not met at
-                                                scheduling time, the pod will not be scheduled onto the node.
-                                                If the anti-affinity requirements specified by this field cease to be met
-                                                at some point during pod execution (e.g. due to a pod label update), the
-                                                system may or may not try to eventually evict the pod from its node.
-                                                When there are multiple elements, the lists of nodes corresponding to each
-                                                podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                              type: array
-                                              items:
-                                                description: |-
-                                                  Defines a set of pods (namely those matching the labelSelector
-                                                  relative to the given namespace(s)) that this pod should be
-                                                  co-located (affinity) or not co-located (anti-affinity) with,
-                                                  where co-located is defined as running on a node whose value of
-                                                  the label with key <topologyKey> matches that of any node on which
-                                                  a pod of the set of pods is running
-                                                type: object
-                                                required:
-                                                  - topologyKey
-                                                properties:
-                                                  labelSelector:
-                                                    description: |-
-                                                      A label query over a set of resources, in this case pods.
-                                                      If it's null, this PodAffinityTerm matches with no Pods.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A label selector requirement is a selector that contains values, a key, and an operator that
-                                                            relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: key is the label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                operator represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                values is an array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. This array is replaced during a strategic
-                                                                merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchLabels:
-                                                        description: |-
-                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                        type: object
-                                                        additionalProperties:
-                                                          type: string
-                                                    x-kubernetes-map-type: atomic
-                                                  matchLabelKeys:
-                                                    description: |-
-                                                      MatchLabelKeys is a set of pod label keys to select which pods will
-                                                      be taken into consideration. The keys are used to lookup values from the
-                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                      to select the group of existing pods which pods will be taken into consideration
-                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                      pod labels will be ignored. The default value is empty.
-                                                      The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                      Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  mismatchLabelKeys:
-                                                    description: |-
-                                                      MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                      be taken into consideration. The keys are used to lookup values from the
-                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                      to select the group of existing pods which pods will be taken into consideration
-                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                      pod labels will be ignored. The default value is empty.
-                                                      The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                      Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  namespaceSelector:
-                                                    description: |-
-                                                      A label query over the set of namespaces that the term applies to.
-                                                      The term is applied to the union of the namespaces selected by this field
-                                                      and the ones listed in the namespaces field.
-                                                      null selector and null or empty namespaces list means "this pod's namespace".
-                                                      An empty selector ({}) matches all namespaces.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A label selector requirement is a selector that contains values, a key, and an operator that
-                                                            relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: key is the label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                operator represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                values is an array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. This array is replaced during a strategic
-                                                                merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchLabels:
-                                                        description: |-
-                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                        type: object
-                                                        additionalProperties:
-                                                          type: string
-                                                    x-kubernetes-map-type: atomic
-                                                  namespaces:
-                                                    description: |-
-                                                      namespaces specifies a static list of namespace names that the term applies to.
-                                                      The term is applied to the union of the namespaces listed in this field
-                                                      and the ones selected by namespaceSelector.
-                                                      null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  topologyKey:
-                                                    description: |-
-                                                      This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                      the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                      whose value of the label with key topologyKey matches that of any node on which any of the
-                                                      selected pods is running.
-                                                      Empty topologyKey is not allowed.
-                                                    type: string
-                                              x-kubernetes-list-type: atomic
-                                    imagePullSecrets:
-                                      description: If specified, the pod's imagePullSecrets
-                                      type: array
-                                      items:
-                                        description: |-
-                                          LocalObjectReference contains enough information to let you locate the
-                                          referenced object inside the same namespace.
-                                        type: object
-                                        properties:
-                                          name:
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                            default: ""
-                                        x-kubernetes-map-type: atomic
-                                    nodeSelector:
-                                      description: |-
-                                        NodeSelector is a selector which must be true for the pod to fit on a node.
-                                        Selector which must match a node's labels for the pod to be scheduled on that node.
-                                        More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
-                                      type: object
-                                      additionalProperties:
-                                        type: string
-                                    priorityClassName:
-                                      description: If specified, the pod's priorityClassName.
-                                      type: string
-                                    securityContext:
-                                      description: If specified, the pod's security context
-                                      type: object
-                                      properties:
-                                        fsGroup:
-                                          description: |-
-                                            A special supplemental group that applies to all containers in a pod.
-                                            Some volume types allow the Kubelet to change the ownership of that volume
-                                            to be owned by the pod:
-
-                                            1. The owning GID will be the FSGroup
-                                            2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
-                                            3. The permission bits are OR'd with rw-rw----
-
-                                            If unset, the Kubelet will not modify the ownership and permissions of any volume.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: integer
-                                          format: int64
-                                        fsGroupChangePolicy:
-                                          description: |-
-                                            fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
-                                            before being exposed inside Pod. This field will only apply to
-                                            volume types which support fsGroup based ownership(and permissions).
-                                            It will have no effect on ephemeral volume types such as: secret, configmaps
-                                            and emptydir.
-                                            Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: string
-                                        runAsGroup:
-                                          description: |-
-                                            The GID to run the entrypoint of the container process.
-                                            Uses runtime default if unset.
-                                            May also be set in SecurityContext.  If set in both SecurityContext and
-                                            PodSecurityContext, the value specified in SecurityContext takes precedence
-                                            for that container.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: integer
-                                          format: int64
-                                        runAsNonRoot:
-                                          description: |-
-                                            Indicates that the container must run as a non-root user.
-                                            If true, the Kubelet will validate the image at runtime to ensure that it
-                                            does not run as UID 0 (root) and fail to start the container if it does.
-                                            If unset or false, no such validation will be performed.
-                                            May also be set in SecurityContext.  If set in both SecurityContext and
-                                            PodSecurityContext, the value specified in SecurityContext takes precedence.
-                                          type: boolean
-                                        runAsUser:
-                                          description: |-
-                                            The UID to run the entrypoint of the container process.
-                                            Defaults to user specified in image metadata if unspecified.
-                                            May also be set in SecurityContext.  If set in both SecurityContext and
-                                            PodSecurityContext, the value specified in SecurityContext takes precedence
-                                            for that container.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: integer
-                                          format: int64
-                                        seLinuxOptions:
-                                          description: |-
-                                            The SELinux context to be applied to all containers.
-                                            If unspecified, the container runtime will allocate a random SELinux context for each
-                                            container.  May also be set in SecurityContext.  If set in
-                                            both SecurityContext and PodSecurityContext, the value specified in SecurityContext
-                                            takes precedence for that container.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: object
-                                          properties:
-                                            level:
-                                              description: Level is SELinux level label that applies to the container.
-                                              type: string
-                                            role:
-                                              description: Role is a SELinux role label that applies to the container.
-                                              type: string
-                                            type:
-                                              description: Type is a SELinux type label that applies to the container.
-                                              type: string
-                                            user:
-                                              description: User is a SELinux user label that applies to the container.
-                                              type: string
-                                        seccompProfile:
-                                          description: |-
-                                            The seccomp options to use by the containers in this pod.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: object
-                                          required:
-                                            - type
-                                          properties:
-                                            localhostProfile:
-                                              description: |-
-                                                localhostProfile indicates a profile defined in a file on the node should be used.
-                                                The profile must be preconfigured on the node to work.
-                                                Must be a descending path, relative to the kubelet's configured seccomp profile location.
-                                                Must be set if type is "Localhost". Must NOT be set for any other type.
-                                              type: string
-                                            type:
-                                              description: |-
-                                                type indicates which kind of seccomp profile will be applied.
-                                                Valid options are:
-
-                                                Localhost - a profile defined in a file on the node should be used.
-                                                RuntimeDefault - the container runtime default profile should be used.
-                                                Unconfined - no profile should be applied.
-                                              type: string
-                                        supplementalGroups:
-                                          description: |-
-                                            A list of groups applied to the first process run in each container, in addition
-                                            to the container's primary GID, the fsGroup (if specified), and group memberships
-                                            defined in the container image for the uid of the container process. If unspecified,
-                                            no additional groups are added to any container. Note that group memberships
-                                            defined in the container image for the uid of the container process are still effective,
-                                            even if they are not included in this list.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: array
-                                          items:
-                                            type: integer
-                                            format: int64
-                                        sysctls:
-                                          description: |-
-                                            Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
-                                            sysctls (by the container runtime) might fail to launch.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: array
-                                          items:
-                                            description: Sysctl defines a kernel parameter to be set
-                                            type: object
-                                            required:
-                                              - name
-                                              - value
-                                            properties:
-                                              name:
-                                                description: Name of a property to set
-                                                type: string
-                                              value:
-                                                description: Value of a property to set
-                                                type: string
-                                    serviceAccountName:
-                                      description: If specified, the pod's service account
-                                      type: string
-                                    tolerations:
-                                      description: If specified, the pod's tolerations.
-                                      type: array
-                                      items:
-                                        description: |-
-                                          The pod this Toleration is attached to tolerates any taint that matches
-                                          the triple <key,value,effect> using the matching operator <operator>.
-                                        type: object
-                                        properties:
-                                          effect:
-                                            description: |-
-                                              Effect indicates the taint effect to match. Empty means match all taint effects.
-                                              When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                                            type: string
-                                          key:
-                                            description: |-
-                                              Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                                              If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              Operator represents a key's relationship to the value.
-                                              Valid operators are Exists and Equal. Defaults to Equal.
-                                              Exists is equivalent to wildcard for value, so that a pod can
-                                              tolerate all taints of a particular category.
-                                            type: string
-                                          tolerationSeconds:
-                                            description: |-
-                                              TolerationSeconds represents the period of time the toleration (which must be
-                                              of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                                              it is not set, which means tolerate the taint forever (do not evict). Zero and
-                                              negative values will be treated as 0 (evict immediately) by the system.
-                                            type: integer
-                                            format: int64
-                                          value:
-                                            description: |-
-                                              Value is the taint value the toleration matches to.
-                                              If the operator is Exists, the value should be empty, otherwise just a regular string.
-                                            type: string
-                            serviceType:
-                              description: |-
-                                Optional service type for Kubernetes solver service. Supported values
-                                are NodePort or ClusterIP. If unset, defaults to NodePort.
-                              type: string
-                        ingress:
-                          description: |-
-                            The ingress based HTTP01 challenge solver will solve challenges by
-                            creating or modifying Ingress resources in order to route requests for
-                            '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
-                            provisioned by cert-manager for each Challenge to be completed.
-                          type: object
-                          properties:
-                            class:
-                              description: |-
-                                This field configures the annotation `kubernetes.io/ingress.class` when
-                                creating Ingress resources to solve ACME challenges that use this
-                                challenge solver. Only one of `class`, `name` or `ingressClassName` may
-                                be specified.
-                              type: string
-                            ingressClassName:
-                              description: |-
-                                This field configures the field `ingressClassName` on the created Ingress
-                                resources used to solve ACME challenges that use this challenge solver.
-                                This is the recommended way of configuring the ingress class. Only one of
-                                `class`, `name` or `ingressClassName` may be specified.
-                              type: string
-                            ingressTemplate:
-                              description: |-
-                                Optional ingress template used to configure the ACME challenge solver
-                                ingress used for HTTP01 challenges.
-                              type: object
-                              properties:
-                                metadata:
-                                  description: |-
-                                    ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
-                                    Only the 'labels' and 'annotations' fields may be set.
-                                    If labels or annotations overlap with in-built values, the values here
-                                    will override the in-built values.
-                                  type: object
-                                  properties:
-                                    annotations:
-                                      description: Annotations that should be added to the created ACME HTTP01 solver ingress.
-                                      type: object
-                                      additionalProperties:
-                                        type: string
-                                    labels:
-                                      description: Labels that should be added to the created ACME HTTP01 solver ingress.
-                                      type: object
-                                      additionalProperties:
-                                        type: string
-                            name:
-                              description: |-
-                                The name of the ingress resource that should have ACME challenge solving
-                                routes inserted into it in order to solve HTTP01 challenges.
-                                This is typically used in conjunction with ingress controllers like
-                                ingress-gce, which maintains a 1:1 mapping between external IPs and
-                                ingress resources. Only one of `class`, `name` or `ingressClassName` may
-                                be specified.
-                              type: string
-                            podTemplate:
-                              description: |-
-                                Optional pod template used to configure the ACME challenge solver pods
-                                used for HTTP01 challenges.
-                              type: object
-                              properties:
-                                metadata:
-                                  description: |-
-                                    ObjectMeta overrides for the pod used to solve HTTP01 challenges.
-                                    Only the 'labels' and 'annotations' fields may be set.
-                                    If labels or annotations overlap with in-built values, the values here
-                                    will override the in-built values.
-                                  type: object
-                                  properties:
-                                    annotations:
-                                      description: Annotations that should be added to the created ACME HTTP01 solver pods.
-                                      type: object
-                                      additionalProperties:
-                                        type: string
-                                    labels:
-                                      description: Labels that should be added to the created ACME HTTP01 solver pods.
-                                      type: object
-                                      additionalProperties:
-                                        type: string
-                                spec:
-                                  description: |-
-                                    PodSpec defines overrides for the HTTP01 challenge solver pod.
-                                    Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
-                                    All other fields will be ignored.
-                                  type: object
-                                  properties:
-                                    affinity:
-                                      description: If specified, the pod's scheduling constraints
-                                      type: object
-                                      properties:
-                                        nodeAffinity:
-                                          description: Describes node affinity scheduling rules for the pod.
-                                          type: object
-                                          properties:
-                                            preferredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                The scheduler will prefer to schedule pods to nodes that satisfy
-                                                the affinity expressions specified by this field, but it may choose
-                                                a node that violates one or more of the expressions. The node that is
-                                                most preferred is the one with the greatest sum of weights, i.e.
-                                                for each node that meets all of the scheduling requirements (resource
-                                                request, requiredDuringScheduling affinity expressions, etc.),
-                                                compute a sum by iterating through the elements of this field and adding
-                                                "weight" to the sum if the node matches the corresponding matchExpressions; the
-                                                node(s) with the highest sum are the most preferred.
-                                              type: array
-                                              items:
-                                                description: |-
-                                                  An empty preferred scheduling term matches all objects with implicit weight 0
-                                                  (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
-                                                type: object
-                                                required:
-                                                  - preference
-                                                  - weight
-                                                properties:
-                                                  preference:
-                                                    description: A node selector term, associated with the corresponding weight.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: A list of node selector requirements by node's labels.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A node selector requirement is a selector that contains values, a key, and an operator
-                                                            that relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: The label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                Represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                An array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. If the operator is Gt or Lt, the values
-                                                                array must have a single element, which will be interpreted as an integer.
-                                                                This array is replaced during a strategic merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchFields:
-                                                        description: A list of node selector requirements by node's fields.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A node selector requirement is a selector that contains values, a key, and an operator
-                                                            that relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: The label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                Represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                An array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. If the operator is Gt or Lt, the values
-                                                                array must have a single element, which will be interpreted as an integer.
-                                                                This array is replaced during a strategic merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                    x-kubernetes-map-type: atomic
-                                                  weight:
-                                                    description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
-                                                    type: integer
-                                                    format: int32
-                                              x-kubernetes-list-type: atomic
-                                            requiredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                If the affinity requirements specified by this field are not met at
-                                                scheduling time, the pod will not be scheduled onto the node.
-                                                If the affinity requirements specified by this field cease to be met
-                                                at some point during pod execution (e.g. due to an update), the system
-                                                may or may not try to eventually evict the pod from its node.
-                                              type: object
-                                              required:
-                                                - nodeSelectorTerms
-                                              properties:
-                                                nodeSelectorTerms:
-                                                  description: Required. A list of node selector terms. The terms are ORed.
-                                                  type: array
-                                                  items:
-                                                    description: |-
-                                                      A null or empty node selector term matches no objects. The requirements of
-                                                      them are ANDed.
-                                                      The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: A list of node selector requirements by node's labels.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A node selector requirement is a selector that contains values, a key, and an operator
-                                                            that relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: The label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                Represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                An array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. If the operator is Gt or Lt, the values
-                                                                array must have a single element, which will be interpreted as an integer.
-                                                                This array is replaced during a strategic merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchFields:
-                                                        description: A list of node selector requirements by node's fields.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A node selector requirement is a selector that contains values, a key, and an operator
-                                                            that relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: The label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                Represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                An array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. If the operator is Gt or Lt, the values
-                                                                array must have a single element, which will be interpreted as an integer.
-                                                                This array is replaced during a strategic merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                    x-kubernetes-map-type: atomic
-                                                  x-kubernetes-list-type: atomic
-                                              x-kubernetes-map-type: atomic
-                                        podAffinity:
-                                          description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
-                                          type: object
-                                          properties:
-                                            preferredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                The scheduler will prefer to schedule pods to nodes that satisfy
-                                                the affinity expressions specified by this field, but it may choose
-                                                a node that violates one or more of the expressions. The node that is
-                                                most preferred is the one with the greatest sum of weights, i.e.
-                                                for each node that meets all of the scheduling requirements (resource
-                                                request, requiredDuringScheduling affinity expressions, etc.),
-                                                compute a sum by iterating through the elements of this field and adding
-                                                "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                node(s) with the highest sum are the most preferred.
-                                              type: array
-                                              items:
-                                                description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                type: object
-                                                required:
-                                                  - podAffinityTerm
-                                                  - weight
-                                                properties:
-                                                  podAffinityTerm:
-                                                    description: Required. A pod affinity term, associated with the corresponding weight.
-                                                    type: object
-                                                    required:
-                                                      - topologyKey
-                                                    properties:
-                                                      labelSelector:
-                                                        description: |-
-                                                          A label query over a set of resources, in this case pods.
-                                                          If it's null, this PodAffinityTerm matches with no Pods.
-                                                        type: object
-                                                        properties:
-                                                          matchExpressions:
-                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                            type: array
-                                                            items:
-                                                              description: |-
-                                                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                relates the key and values.
-                                                              type: object
-                                                              required:
-                                                                - key
-                                                                - operator
-                                                              properties:
-                                                                key:
-                                                                  description: key is the label key that the selector applies to.
-                                                                  type: string
-                                                                operator:
-                                                                  description: |-
-                                                                    operator represents a key's relationship to a set of values.
-                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                  type: string
-                                                                values:
-                                                                  description: |-
-                                                                    values is an array of string values. If the operator is In or NotIn,
-                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                    the values array must be empty. This array is replaced during a strategic
-                                                                    merge patch.
-                                                                  type: array
-                                                                  items:
-                                                                    type: string
-                                                                  x-kubernetes-list-type: atomic
-                                                            x-kubernetes-list-type: atomic
-                                                          matchLabels:
-                                                            description: |-
-                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                            type: object
-                                                            additionalProperties:
-                                                              type: string
-                                                        x-kubernetes-map-type: atomic
-                                                      matchLabelKeys:
-                                                        description: |-
-                                                          MatchLabelKeys is a set of pod label keys to select which pods will
-                                                          be taken into consideration. The keys are used to lookup values from the
-                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                          to select the group of existing pods which pods will be taken into consideration
-                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                          pod labels will be ignored. The default value is empty.
-                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      mismatchLabelKeys:
-                                                        description: |-
-                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                          be taken into consideration. The keys are used to lookup values from the
-                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                          to select the group of existing pods which pods will be taken into consideration
-                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                          pod labels will be ignored. The default value is empty.
-                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      namespaceSelector:
-                                                        description: |-
-                                                          A label query over the set of namespaces that the term applies to.
-                                                          The term is applied to the union of the namespaces selected by this field
-                                                          and the ones listed in the namespaces field.
-                                                          null selector and null or empty namespaces list means "this pod's namespace".
-                                                          An empty selector ({}) matches all namespaces.
-                                                        type: object
-                                                        properties:
-                                                          matchExpressions:
-                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                            type: array
-                                                            items:
-                                                              description: |-
-                                                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                relates the key and values.
-                                                              type: object
-                                                              required:
-                                                                - key
-                                                                - operator
-                                                              properties:
-                                                                key:
-                                                                  description: key is the label key that the selector applies to.
-                                                                  type: string
-                                                                operator:
-                                                                  description: |-
-                                                                    operator represents a key's relationship to a set of values.
-                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                  type: string
-                                                                values:
-                                                                  description: |-
-                                                                    values is an array of string values. If the operator is In or NotIn,
-                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                    the values array must be empty. This array is replaced during a strategic
-                                                                    merge patch.
-                                                                  type: array
-                                                                  items:
-                                                                    type: string
-                                                                  x-kubernetes-list-type: atomic
-                                                            x-kubernetes-list-type: atomic
-                                                          matchLabels:
-                                                            description: |-
-                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                            type: object
-                                                            additionalProperties:
-                                                              type: string
-                                                        x-kubernetes-map-type: atomic
-                                                      namespaces:
-                                                        description: |-
-                                                          namespaces specifies a static list of namespace names that the term applies to.
-                                                          The term is applied to the union of the namespaces listed in this field
-                                                          and the ones selected by namespaceSelector.
-                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      topologyKey:
-                                                        description: |-
-                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                          whose value of the label with key topologyKey matches that of any node on which any of the
-                                                          selected pods is running.
-                                                          Empty topologyKey is not allowed.
-                                                        type: string
-                                                  weight:
-                                                    description: |-
-                                                      weight associated with matching the corresponding podAffinityTerm,
-                                                      in the range 1-100.
-                                                    type: integer
-                                                    format: int32
-                                              x-kubernetes-list-type: atomic
-                                            requiredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                If the affinity requirements specified by this field are not met at
-                                                scheduling time, the pod will not be scheduled onto the node.
-                                                If the affinity requirements specified by this field cease to be met
-                                                at some point during pod execution (e.g. due to a pod label update), the
-                                                system may or may not try to eventually evict the pod from its node.
-                                                When there are multiple elements, the lists of nodes corresponding to each
-                                                podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                              type: array
-                                              items:
-                                                description: |-
-                                                  Defines a set of pods (namely those matching the labelSelector
-                                                  relative to the given namespace(s)) that this pod should be
-                                                  co-located (affinity) or not co-located (anti-affinity) with,
-                                                  where co-located is defined as running on a node whose value of
-                                                  the label with key <topologyKey> matches that of any node on which
-                                                  a pod of the set of pods is running
-                                                type: object
-                                                required:
-                                                  - topologyKey
-                                                properties:
-                                                  labelSelector:
-                                                    description: |-
-                                                      A label query over a set of resources, in this case pods.
-                                                      If it's null, this PodAffinityTerm matches with no Pods.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A label selector requirement is a selector that contains values, a key, and an operator that
-                                                            relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: key is the label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                operator represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                values is an array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. This array is replaced during a strategic
-                                                                merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchLabels:
-                                                        description: |-
-                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                        type: object
-                                                        additionalProperties:
-                                                          type: string
-                                                    x-kubernetes-map-type: atomic
-                                                  matchLabelKeys:
-                                                    description: |-
-                                                      MatchLabelKeys is a set of pod label keys to select which pods will
-                                                      be taken into consideration. The keys are used to lookup values from the
-                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                      to select the group of existing pods which pods will be taken into consideration
-                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                      pod labels will be ignored. The default value is empty.
-                                                      The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                      Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  mismatchLabelKeys:
-                                                    description: |-
-                                                      MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                      be taken into consideration. The keys are used to lookup values from the
-                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                      to select the group of existing pods which pods will be taken into consideration
-                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                      pod labels will be ignored. The default value is empty.
-                                                      The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                      Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  namespaceSelector:
-                                                    description: |-
-                                                      A label query over the set of namespaces that the term applies to.
-                                                      The term is applied to the union of the namespaces selected by this field
-                                                      and the ones listed in the namespaces field.
-                                                      null selector and null or empty namespaces list means "this pod's namespace".
-                                                      An empty selector ({}) matches all namespaces.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A label selector requirement is a selector that contains values, a key, and an operator that
-                                                            relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: key is the label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                operator represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                values is an array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. This array is replaced during a strategic
-                                                                merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchLabels:
-                                                        description: |-
-                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                        type: object
-                                                        additionalProperties:
-                                                          type: string
-                                                    x-kubernetes-map-type: atomic
-                                                  namespaces:
-                                                    description: |-
-                                                      namespaces specifies a static list of namespace names that the term applies to.
-                                                      The term is applied to the union of the namespaces listed in this field
-                                                      and the ones selected by namespaceSelector.
-                                                      null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  topologyKey:
-                                                    description: |-
-                                                      This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                      the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                      whose value of the label with key topologyKey matches that of any node on which any of the
-                                                      selected pods is running.
-                                                      Empty topologyKey is not allowed.
-                                                    type: string
-                                              x-kubernetes-list-type: atomic
-                                        podAntiAffinity:
-                                          description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
-                                          type: object
-                                          properties:
-                                            preferredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                The scheduler will prefer to schedule pods to nodes that satisfy
-                                                the anti-affinity expressions specified by this field, but it may choose
-                                                a node that violates one or more of the expressions. The node that is
-                                                most preferred is the one with the greatest sum of weights, i.e.
-                                                for each node that meets all of the scheduling requirements (resource
-                                                request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                                compute a sum by iterating through the elements of this field and adding
-                                                "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                node(s) with the highest sum are the most preferred.
-                                              type: array
-                                              items:
-                                                description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                type: object
-                                                required:
-                                                  - podAffinityTerm
-                                                  - weight
-                                                properties:
-                                                  podAffinityTerm:
-                                                    description: Required. A pod affinity term, associated with the corresponding weight.
-                                                    type: object
-                                                    required:
-                                                      - topologyKey
-                                                    properties:
-                                                      labelSelector:
-                                                        description: |-
-                                                          A label query over a set of resources, in this case pods.
-                                                          If it's null, this PodAffinityTerm matches with no Pods.
-                                                        type: object
-                                                        properties:
-                                                          matchExpressions:
-                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                            type: array
-                                                            items:
-                                                              description: |-
-                                                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                relates the key and values.
-                                                              type: object
-                                                              required:
-                                                                - key
-                                                                - operator
-                                                              properties:
-                                                                key:
-                                                                  description: key is the label key that the selector applies to.
-                                                                  type: string
-                                                                operator:
-                                                                  description: |-
-                                                                    operator represents a key's relationship to a set of values.
-                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                  type: string
-                                                                values:
-                                                                  description: |-
-                                                                    values is an array of string values. If the operator is In or NotIn,
-                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                    the values array must be empty. This array is replaced during a strategic
-                                                                    merge patch.
-                                                                  type: array
-                                                                  items:
-                                                                    type: string
-                                                                  x-kubernetes-list-type: atomic
-                                                            x-kubernetes-list-type: atomic
-                                                          matchLabels:
-                                                            description: |-
-                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                            type: object
-                                                            additionalProperties:
-                                                              type: string
-                                                        x-kubernetes-map-type: atomic
-                                                      matchLabelKeys:
-                                                        description: |-
-                                                          MatchLabelKeys is a set of pod label keys to select which pods will
-                                                          be taken into consideration. The keys are used to lookup values from the
-                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                          to select the group of existing pods which pods will be taken into consideration
-                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                          pod labels will be ignored. The default value is empty.
-                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      mismatchLabelKeys:
-                                                        description: |-
-                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                          be taken into consideration. The keys are used to lookup values from the
-                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                          to select the group of existing pods which pods will be taken into consideration
-                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                          pod labels will be ignored. The default value is empty.
-                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      namespaceSelector:
-                                                        description: |-
-                                                          A label query over the set of namespaces that the term applies to.
-                                                          The term is applied to the union of the namespaces selected by this field
-                                                          and the ones listed in the namespaces field.
-                                                          null selector and null or empty namespaces list means "this pod's namespace".
-                                                          An empty selector ({}) matches all namespaces.
-                                                        type: object
-                                                        properties:
-                                                          matchExpressions:
-                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                            type: array
-                                                            items:
-                                                              description: |-
-                                                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                relates the key and values.
-                                                              type: object
-                                                              required:
-                                                                - key
-                                                                - operator
-                                                              properties:
-                                                                key:
-                                                                  description: key is the label key that the selector applies to.
-                                                                  type: string
-                                                                operator:
-                                                                  description: |-
-                                                                    operator represents a key's relationship to a set of values.
-                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                  type: string
-                                                                values:
-                                                                  description: |-
-                                                                    values is an array of string values. If the operator is In or NotIn,
-                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                    the values array must be empty. This array is replaced during a strategic
-                                                                    merge patch.
-                                                                  type: array
-                                                                  items:
-                                                                    type: string
-                                                                  x-kubernetes-list-type: atomic
-                                                            x-kubernetes-list-type: atomic
-                                                          matchLabels:
-                                                            description: |-
-                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                            type: object
-                                                            additionalProperties:
-                                                              type: string
-                                                        x-kubernetes-map-type: atomic
-                                                      namespaces:
-                                                        description: |-
-                                                          namespaces specifies a static list of namespace names that the term applies to.
-                                                          The term is applied to the union of the namespaces listed in this field
-                                                          and the ones selected by namespaceSelector.
-                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                        type: array
-                                                        items:
-                                                          type: string
-                                                        x-kubernetes-list-type: atomic
-                                                      topologyKey:
-                                                        description: |-
-                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                          whose value of the label with key topologyKey matches that of any node on which any of the
-                                                          selected pods is running.
-                                                          Empty topologyKey is not allowed.
-                                                        type: string
-                                                  weight:
-                                                    description: |-
-                                                      weight associated with matching the corresponding podAffinityTerm,
-                                                      in the range 1-100.
-                                                    type: integer
-                                                    format: int32
-                                              x-kubernetes-list-type: atomic
-                                            requiredDuringSchedulingIgnoredDuringExecution:
-                                              description: |-
-                                                If the anti-affinity requirements specified by this field are not met at
-                                                scheduling time, the pod will not be scheduled onto the node.
-                                                If the anti-affinity requirements specified by this field cease to be met
-                                                at some point during pod execution (e.g. due to a pod label update), the
-                                                system may or may not try to eventually evict the pod from its node.
-                                                When there are multiple elements, the lists of nodes corresponding to each
-                                                podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                              type: array
-                                              items:
-                                                description: |-
-                                                  Defines a set of pods (namely those matching the labelSelector
-                                                  relative to the given namespace(s)) that this pod should be
-                                                  co-located (affinity) or not co-located (anti-affinity) with,
-                                                  where co-located is defined as running on a node whose value of
-                                                  the label with key <topologyKey> matches that of any node on which
-                                                  a pod of the set of pods is running
-                                                type: object
-                                                required:
-                                                  - topologyKey
-                                                properties:
-                                                  labelSelector:
-                                                    description: |-
-                                                      A label query over a set of resources, in this case pods.
-                                                      If it's null, this PodAffinityTerm matches with no Pods.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A label selector requirement is a selector that contains values, a key, and an operator that
-                                                            relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: key is the label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                operator represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                values is an array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. This array is replaced during a strategic
-                                                                merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchLabels:
-                                                        description: |-
-                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                        type: object
-                                                        additionalProperties:
-                                                          type: string
-                                                    x-kubernetes-map-type: atomic
-                                                  matchLabelKeys:
-                                                    description: |-
-                                                      MatchLabelKeys is a set of pod label keys to select which pods will
-                                                      be taken into consideration. The keys are used to lookup values from the
-                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                      to select the group of existing pods which pods will be taken into consideration
-                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                      pod labels will be ignored. The default value is empty.
-                                                      The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                      Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  mismatchLabelKeys:
-                                                    description: |-
-                                                      MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                      be taken into consideration. The keys are used to lookup values from the
-                                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                      to select the group of existing pods which pods will be taken into consideration
-                                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                      pod labels will be ignored. The default value is empty.
-                                                      The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                      Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  namespaceSelector:
-                                                    description: |-
-                                                      A label query over the set of namespaces that the term applies to.
-                                                      The term is applied to the union of the namespaces selected by this field
-                                                      and the ones listed in the namespaces field.
-                                                      null selector and null or empty namespaces list means "this pod's namespace".
-                                                      An empty selector ({}) matches all namespaces.
-                                                    type: object
-                                                    properties:
-                                                      matchExpressions:
-                                                        description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A label selector requirement is a selector that contains values, a key, and an operator that
-                                                            relates the key and values.
-                                                          type: object
-                                                          required:
-                                                            - key
-                                                            - operator
-                                                          properties:
-                                                            key:
-                                                              description: key is the label key that the selector applies to.
-                                                              type: string
-                                                            operator:
-                                                              description: |-
-                                                                operator represents a key's relationship to a set of values.
-                                                                Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                              type: string
-                                                            values:
-                                                              description: |-
-                                                                values is an array of string values. If the operator is In or NotIn,
-                                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                the values array must be empty. This array is replaced during a strategic
-                                                                merge patch.
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                      matchLabels:
-                                                        description: |-
-                                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                        type: object
-                                                        additionalProperties:
-                                                          type: string
-                                                    x-kubernetes-map-type: atomic
-                                                  namespaces:
-                                                    description: |-
-                                                      namespaces specifies a static list of namespace names that the term applies to.
-                                                      The term is applied to the union of the namespaces listed in this field
-                                                      and the ones selected by namespaceSelector.
-                                                      null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                    type: array
-                                                    items:
-                                                      type: string
-                                                    x-kubernetes-list-type: atomic
-                                                  topologyKey:
-                                                    description: |-
-                                                      This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                      the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                      whose value of the label with key topologyKey matches that of any node on which any of the
-                                                      selected pods is running.
-                                                      Empty topologyKey is not allowed.
-                                                    type: string
-                                              x-kubernetes-list-type: atomic
-                                    imagePullSecrets:
-                                      description: If specified, the pod's imagePullSecrets
-                                      type: array
-                                      items:
-                                        description: |-
-                                          LocalObjectReference contains enough information to let you locate the
-                                          referenced object inside the same namespace.
-                                        type: object
-                                        properties:
-                                          name:
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                            default: ""
-                                        x-kubernetes-map-type: atomic
-                                    nodeSelector:
-                                      description: |-
-                                        NodeSelector is a selector which must be true for the pod to fit on a node.
-                                        Selector which must match a node's labels for the pod to be scheduled on that node.
-                                        More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
-                                      type: object
-                                      additionalProperties:
-                                        type: string
-                                    priorityClassName:
-                                      description: If specified, the pod's priorityClassName.
-                                      type: string
-                                    securityContext:
-                                      description: If specified, the pod's security context
-                                      type: object
-                                      properties:
-                                        fsGroup:
-                                          description: |-
-                                            A special supplemental group that applies to all containers in a pod.
-                                            Some volume types allow the Kubelet to change the ownership of that volume
-                                            to be owned by the pod:
-
-                                            1. The owning GID will be the FSGroup
-                                            2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
-                                            3. The permission bits are OR'd with rw-rw----
-
-                                            If unset, the Kubelet will not modify the ownership and permissions of any volume.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: integer
-                                          format: int64
-                                        fsGroupChangePolicy:
-                                          description: |-
-                                            fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
-                                            before being exposed inside Pod. This field will only apply to
-                                            volume types which support fsGroup based ownership(and permissions).
-                                            It will have no effect on ephemeral volume types such as: secret, configmaps
-                                            and emptydir.
-                                            Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: string
-                                        runAsGroup:
-                                          description: |-
-                                            The GID to run the entrypoint of the container process.
-                                            Uses runtime default if unset.
-                                            May also be set in SecurityContext.  If set in both SecurityContext and
-                                            PodSecurityContext, the value specified in SecurityContext takes precedence
-                                            for that container.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: integer
-                                          format: int64
-                                        runAsNonRoot:
-                                          description: |-
-                                            Indicates that the container must run as a non-root user.
-                                            If true, the Kubelet will validate the image at runtime to ensure that it
-                                            does not run as UID 0 (root) and fail to start the container if it does.
-                                            If unset or false, no such validation will be performed.
-                                            May also be set in SecurityContext.  If set in both SecurityContext and
-                                            PodSecurityContext, the value specified in SecurityContext takes precedence.
-                                          type: boolean
-                                        runAsUser:
-                                          description: |-
-                                            The UID to run the entrypoint of the container process.
-                                            Defaults to user specified in image metadata if unspecified.
-                                            May also be set in SecurityContext.  If set in both SecurityContext and
-                                            PodSecurityContext, the value specified in SecurityContext takes precedence
-                                            for that container.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: integer
-                                          format: int64
-                                        seLinuxOptions:
-                                          description: |-
-                                            The SELinux context to be applied to all containers.
-                                            If unspecified, the container runtime will allocate a random SELinux context for each
-                                            container.  May also be set in SecurityContext.  If set in
-                                            both SecurityContext and PodSecurityContext, the value specified in SecurityContext
-                                            takes precedence for that container.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: object
-                                          properties:
-                                            level:
-                                              description: Level is SELinux level label that applies to the container.
-                                              type: string
-                                            role:
-                                              description: Role is a SELinux role label that applies to the container.
-                                              type: string
-                                            type:
-                                              description: Type is a SELinux type label that applies to the container.
-                                              type: string
-                                            user:
-                                              description: User is a SELinux user label that applies to the container.
-                                              type: string
-                                        seccompProfile:
-                                          description: |-
-                                            The seccomp options to use by the containers in this pod.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: object
-                                          required:
-                                            - type
-                                          properties:
-                                            localhostProfile:
-                                              description: |-
-                                                localhostProfile indicates a profile defined in a file on the node should be used.
-                                                The profile must be preconfigured on the node to work.
-                                                Must be a descending path, relative to the kubelet's configured seccomp profile location.
-                                                Must be set if type is "Localhost". Must NOT be set for any other type.
-                                              type: string
-                                            type:
-                                              description: |-
-                                                type indicates which kind of seccomp profile will be applied.
-                                                Valid options are:
-
-                                                Localhost - a profile defined in a file on the node should be used.
-                                                RuntimeDefault - the container runtime default profile should be used.
-                                                Unconfined - no profile should be applied.
-                                              type: string
-                                        supplementalGroups:
-                                          description: |-
-                                            A list of groups applied to the first process run in each container, in addition
-                                            to the container's primary GID, the fsGroup (if specified), and group memberships
-                                            defined in the container image for the uid of the container process. If unspecified,
-                                            no additional groups are added to any container. Note that group memberships
-                                            defined in the container image for the uid of the container process are still effective,
-                                            even if they are not included in this list.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: array
-                                          items:
-                                            type: integer
-                                            format: int64
-                                        sysctls:
-                                          description: |-
-                                            Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
-                                            sysctls (by the container runtime) might fail to launch.
-                                            Note that this field cannot be set when spec.os.name is windows.
-                                          type: array
-                                          items:
-                                            description: Sysctl defines a kernel parameter to be set
-                                            type: object
-                                            required:
-                                              - name
-                                              - value
-                                            properties:
-                                              name:
-                                                description: Name of a property to set
-                                                type: string
-                                              value:
-                                                description: Value of a property to set
-                                                type: string
-                                    serviceAccountName:
-                                      description: If specified, the pod's service account
-                                      type: string
-                                    tolerations:
-                                      description: If specified, the pod's tolerations.
-                                      type: array
-                                      items:
-                                        description: |-
-                                          The pod this Toleration is attached to tolerates any taint that matches
-                                          the triple <key,value,effect> using the matching operator <operator>.
-                                        type: object
-                                        properties:
-                                          effect:
-                                            description: |-
-                                              Effect indicates the taint effect to match. Empty means match all taint effects.
-                                              When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                                            type: string
-                                          key:
-                                            description: |-
-                                              Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                                              If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              Operator represents a key's relationship to the value.
-                                              Valid operators are Exists and Equal. Defaults to Equal.
-                                              Exists is equivalent to wildcard for value, so that a pod can
-                                              tolerate all taints of a particular category.
-                                            type: string
-                                          tolerationSeconds:
-                                            description: |-
-                                              TolerationSeconds represents the period of time the toleration (which must be
-                                              of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                                              it is not set, which means tolerate the taint forever (do not evict). Zero and
-                                              negative values will be treated as 0 (evict immediately) by the system.
-                                            type: integer
-                                            format: int64
-                                          value:
-                                            description: |-
-                                              Value is the taint value the toleration matches to.
-                                              If the operator is Exists, the value should be empty, otherwise just a regular string.
-                                            type: string
-                            serviceType:
-                              description: |-
-                                Optional service type for Kubernetes solver service. Supported values
-                                are NodePort or ClusterIP. If unset, defaults to NodePort.
-                              type: string
-                    selector:
-                      description: |-
-                        Selector selects a set of DNSNames on the Certificate resource that
-                        should be solved using this challenge solver.
-                        If not specified, the solver will be treated as the 'default' solver
-                        with the lowest priority, i.e. if any other solver has a more specific
-                        match, it will be used instead.
-                      type: object
-                      properties:
-                        dnsNames:
-                          description: |-
-                            List of DNSNames that this solver will be used to solve.
-                            If specified and a match is found, a dnsNames selector will take
-                            precedence over a dnsZones selector.
-                            If multiple solvers match with the same dnsNames value, the solver
-                            with the most matching labels in matchLabels will be selected.
-                            If neither has more matches, the solver defined earlier in the list
-                            will be selected.
-                          type: array
-                          items:
-                            type: string
-                        dnsZones:
-                          description: |-
-                            List of DNSZones that this solver will be used to solve.
-                            The most specific DNS zone match specified here will take precedence
-                            over other DNS zone matches, so a solver specifying sys.example.com
-                            will be selected over one specifying example.com for the domain
-                            www.sys.example.com.
-                            If multiple solvers match with the same dnsZones value, the solver
-                            with the most matching labels in matchLabels will be selected.
-                            If neither has more matches, the solver defined earlier in the list
-                            will be selected.
-                          type: array
-                          items:
-                            type: string
-                        matchLabels:
-                          description: |-
-                            A label selector that is used to refine the set of certificate's that
-                            this challenge solver will apply to.
-                          type: object
-                          additionalProperties:
-                            type: string
-                token:
-                  description: |-
-                    The ACME challenge token for this challenge.
-                    This is the raw value returned from the ACME server.
-                  type: string
-                type:
-                  description: |-
-                    The type of ACME challenge this resource represents.
-                    One of "HTTP-01" or "DNS-01".
-                  type: string
-                  enum:
-                    - HTTP-01
-                    - DNS-01
-                url:
-                  description: |-
-                    The URL of the ACME Challenge resource for this challenge.
-                    This can be used to lookup details about the status of this challenge.
-                  type: string
-                wildcard:
-                  description: |-
-                    wildcard will be true if this challenge is for a wildcard identifier,
-                    for example '*.example.com'.
-                  type: boolean
-            status:
-              type: object
-              properties:
-                presented:
-                  description: |-
-                    presented will be set to true if the challenge values for this challenge
-                    are currently 'presented'.
-                    This *does not* imply the self check is passing. Only that the values
-                    have been 'submitted' for the appropriate challenge mechanism (i.e. the
-                    DNS01 TXT record has been presented, or the HTTP01 configuration has been
-                    configured).
-                  type: boolean
-                processing:
-                  description: |-
-                    Used to denote whether this challenge should be processed or not.
-                    This field will only be set to true by the 'scheduling' component.
-                    It will only be set to false by the 'challenges' controller, after the
-                    challenge has reached a final state or timed out.
-                    If this field is set to false, the challenge controller will not take
-                    any more action.
-                  type: boolean
-                reason:
-                  description: |-
-                    Contains human readable information on why the Challenge is in the
-                    current state.
-                  type: string
-                state:
-                  description: |-
-                    Contains the current 'state' of the challenge.
-                    If not set, the state of the challenge is unknown.
-                  type: string
-                  enum:
-                    - valid
-                    - ready
-                    - pending
-                    - processing
-                    - invalid
-                    - expired
-                    - errored
-      served: true
-      storage: true
-      subresources:
-        status: {}
-
-# END crd {{- end }}
-
----
-# START crd {{- if or .Values.crds.enabled .Values.installCRDs }}
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: clusterissuers.cert-manager.io
-  # START annotations {{- if .Values.crds.keep }}
-  annotations:
-    helm.sh/resource-policy: keep
-  # END annotations {{- end }}
-  labels:
-    app: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/instance: '{{ .Release.Name }}'
-    # Generated labels {{- include "labels" . | nindent 4 }}
-spec:
-  group: cert-manager.io
-  names:
-    kind: ClusterIssuer
-    listKind: ClusterIssuerList
-    plural: clusterissuers
-    singular: clusterissuer
-    categories:
-      - cert-manager
-  scope: Cluster
-  versions:
-    - name: v1
-      subresources:
-        status: {}
-      additionalPrinterColumns:
-        - jsonPath: .status.conditions[?(@.type=="Ready")].status
-          name: Ready
-          type: string
-        - jsonPath: .status.conditions[?(@.type=="Ready")].message
-          name: Status
-          priority: 1
-          type: string
-        - jsonPath: .metadata.creationTimestamp
-          description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
-          name: Age
-          type: date
-      schema:
-        openAPIV3Schema:
-          description: |-
-            A ClusterIssuer represents a certificate issuing authority which can be
-            referenced as part of `issuerRef` fields.
-            It is similar to an Issuer, however it is cluster-scoped and therefore can
-            be referenced by resources that exist in *any* namespace, not just the same
-            namespace as the referent.
-          type: object
-          required:
-            - spec
-          properties:
-            apiVersion:
-              description: |-
-                APIVersion defines the versioned schema of this representation of an object.
-                Servers should convert recognized schemas to the latest internal value, and
-                may reject unrecognized values.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-              type: string
-            kind:
-              description: |-
-                Kind is a string value representing the REST resource this object represents.
-                Servers may infer this from the endpoint the client submits requests to.
-                Cannot be updated.
-                In CamelCase.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: Desired state of the ClusterIssuer resource.
-              type: object
-              properties:
-                acme:
-                  description: |-
-                    ACME configures this issuer to communicate with a RFC8555 (ACME) server
-                    to obtain signed x509 certificates.
-                  type: object
-                  required:
-                    - privateKeySecretRef
-                    - server
-                  properties:
-                    caBundle:
-                      description: |-
-                        Base64-encoded bundle of PEM CAs which can be used to validate the certificate
-                        chain presented by the ACME server.
-                        Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various
-                        kinds of security vulnerabilities.
-                        If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
-                        the container is used to validate the TLS connection.
-                      type: string
-                      format: byte
-                    disableAccountKeyGeneration:
-                      description: |-
-                        Enables or disables generating a new ACME account key.
-                        If true, the Issuer resource will *not* request a new account but will expect
-                        the account key to be supplied via an existing secret.
-                        If false, the cert-manager system will generate a new ACME account key
-                        for the Issuer.
-                        Defaults to false.
-                      type: boolean
-                    email:
-                      description: |-
-                        Email is the email address to be associated with the ACME account.
-                        This field is optional, but it is strongly recommended to be set.
-                        It will be used to contact you in case of issues with your account or
-                        certificates, including expiry notification emails.
-                        This field may be updated after the account is initially registered.
-                      type: string
-                    enableDurationFeature:
-                      description: |-
-                        Enables requesting a Not After date on certificates that matches the
-                        duration of the certificate. This is not supported by all ACME servers
-                        like Let's Encrypt. If set to true when the ACME server does not support
-                        it, it will create an error on the Order.
-                        Defaults to false.
-                      type: boolean
-                    externalAccountBinding:
-                      description: |-
-                        ExternalAccountBinding is a reference to a CA external account of the ACME
-                        server.
-                        If set, upon registration cert-manager will attempt to associate the given
-                        external account credentials with the registered ACME account.
-                      type: object
-                      required:
-                        - keyID
-                        - keySecretRef
-                      properties:
-                        keyAlgorithm:
-                          description: |-
-                            Deprecated: keyAlgorithm field exists for historical compatibility
-                            reasons and should not be used. The algorithm is now hardcoded to HS256
-                            in golang/x/crypto/acme.
-                          type: string
-                          enum:
-                            - HS256
-                            - HS384
-                            - HS512
-                        keyID:
-                          description: keyID is the ID of the CA key that the External Account is bound to.
-                          type: string
-                        keySecretRef:
-                          description: |-
-                            keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes
-                            Secret which holds the symmetric MAC key of the External Account Binding.
-                            The `key` is the index string that is paired with the key data in the
-                            Secret and should not be confused with the key data itself, or indeed with
-                            the External Account Binding keyID above.
-                            The secret key stored in the Secret **must** be un-padded, base64 URL
-                            encoded data.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                    preferredChain:
-                      description: |-
-                        PreferredChain is the chain to use if the ACME server outputs multiple.
-                        PreferredChain is no guarantee that this one gets delivered by the ACME
-                        endpoint.
-                        For example, for Let's Encrypt's DST crosssign you would use:
-                        "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
-                        This value picks the first certificate bundle in the combined set of
-                        ACME default and alternative chains that has a root-most certificate with
-                        this value as its issuer's commonname.
-                      type: string
-                      maxLength: 64
-                    privateKeySecretRef:
-                      description: |-
-                        PrivateKey is the name of a Kubernetes Secret resource that will be used to
-                        store the automatically generated ACME account private key.
-                        Optionally, a `key` may be specified to select a specific entry within
-                        the named Secret resource.
-                        If `key` is not specified, a default of `tls.key` will be used.
-                      type: object
-                      required:
-                        - name
-                      properties:
-                        key:
-                          description: |-
-                            The key of the entry in the Secret resource's `data` field to be used.
-                            Some instances of this field may be defaulted, in others it may be
-                            required.
-                          type: string
-                        name:
-                          description: |-
-                            Name of the resource being referred to.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                    server:
-                      description: |-
-                        Server is the URL used to access the ACME server's 'directory' endpoint.
-                        For example, for Let's Encrypt's staging endpoint, you would use:
-                        "https://acme-staging-v02.api.letsencrypt.org/directory".
-                        Only ACME v2 endpoints (i.e. RFC 8555) are supported.
-                      type: string
-                    skipTLSVerify:
-                      description: |-
-                        INSECURE: Enables or disables validation of the ACME server TLS certificate.
-                        If true, requests to the ACME server will not have the TLS certificate chain
-                        validated.
-                        Mutually exclusive with CABundle; prefer using CABundle to prevent various
-                        kinds of security vulnerabilities.
-                        Only enable this option in development environments.
-                        If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
-                        the container is used to validate the TLS connection.
-                        Defaults to false.
-                      type: boolean
-                    solvers:
-                      description: |-
-                        Solvers is a list of challenge solvers that will be used to solve
-                        ACME challenges for the matching domains.
-                        Solver configurations must be provided in order to obtain certificates
-                        from an ACME server.
-                        For more information, see: https://cert-manager.io/docs/configuration/acme/
-                      type: array
-                      items:
-                        description: |-
-                          An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of.
-                          A selector may be provided to use different solving strategies for different DNS names.
-                          Only one of HTTP01 or DNS01 must be provided.
-                        type: object
-                        properties:
-                          dns01:
-                            description: |-
-                              Configures cert-manager to attempt to complete authorizations by
-                              performing the DNS01 challenge flow.
-                            type: object
-                            properties:
-                              acmeDNS:
-                                description: |-
-                                  Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
-                                  DNS01 challenge records.
-                                type: object
-                                required:
-                                  - accountSecretRef
-                                  - host
-                                properties:
-                                  accountSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  host:
-                                    type: string
-                              akamai:
-                                description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - accessTokenSecretRef
-                                  - clientSecretSecretRef
-                                  - clientTokenSecretRef
-                                  - serviceConsumerDomain
-                                properties:
-                                  accessTokenSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  clientSecretSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  clientTokenSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  serviceConsumerDomain:
-                                    type: string
-                              azureDNS:
-                                description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - resourceGroupName
-                                  - subscriptionID
-                                properties:
-                                  clientID:
-                                    description: |-
-                                      Auth: Azure Service Principal:
-                                      The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
-                                      If set, ClientSecret and TenantID must also be set.
-                                    type: string
-                                  clientSecretSecretRef:
-                                    description: |-
-                                      Auth: Azure Service Principal:
-                                      A reference to a Secret containing the password associated with the Service Principal.
-                                      If set, ClientID and TenantID must also be set.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  environment:
-                                    description: name of the Azure environment (default AzurePublicCloud)
-                                    type: string
-                                    enum:
-                                      - AzurePublicCloud
-                                      - AzureChinaCloud
-                                      - AzureGermanCloud
-                                      - AzureUSGovernmentCloud
-                                  hostedZoneName:
-                                    description: name of the DNS zone that should be used
-                                    type: string
-                                  managedIdentity:
-                                    description: |-
-                                      Auth: Azure Workload Identity or Azure Managed Service Identity:
-                                      Settings to enable Azure Workload Identity or Azure Managed Service Identity
-                                      If set, ClientID, ClientSecret and TenantID must not be set.
-                                    type: object
-                                    properties:
-                                      clientID:
-                                        description: client ID of the managed identity, can not be used at the same time as resourceID
-                                        type: string
-                                      resourceID:
-                                        description: |-
-                                          resource ID of the managed identity, can not be used at the same time as clientID
-                                          Cannot be used for Azure Managed Service Identity
-                                        type: string
-                                      tenantID:
-                                        description: tenant ID of the managed identity, can not be used at the same time as resourceID
-                                        type: string
-                                  resourceGroupName:
-                                    description: resource group the DNS zone is located in
-                                    type: string
-                                  subscriptionID:
-                                    description: ID of the Azure subscription
-                                    type: string
-                                  tenantID:
-                                    description: |-
-                                      Auth: Azure Service Principal:
-                                      The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
-                                      If set, ClientID and ClientSecret must also be set.
-                                    type: string
-                              cloudDNS:
-                                description: Use the Google Cloud DNS API to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - project
-                                properties:
-                                  hostedZoneName:
-                                    description: |-
-                                      HostedZoneName is an optional field that tells cert-manager in which
-                                      Cloud DNS zone the challenge record has to be created.
-                                      If left empty cert-manager will automatically choose a zone.
-                                    type: string
-                                  project:
-                                    type: string
-                                  serviceAccountSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                              cloudflare:
-                                description: Use the Cloudflare API to manage DNS01 challenge records.
-                                type: object
-                                properties:
-                                  apiKeySecretRef:
-                                    description: |-
-                                      API key to use to authenticate with Cloudflare.
-                                      Note: using an API token to authenticate is now the recommended method
-                                      as it allows greater control of permissions.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  apiTokenSecretRef:
-                                    description: API token used to authenticate with Cloudflare.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  email:
-                                    description: Email of the account, only required when using API key based authentication.
-                                    type: string
-                              cnameStrategy:
-                                description: |-
-                                  CNAMEStrategy configures how the DNS01 provider should handle CNAME
-                                  records when found in DNS zones.
-                                type: string
-                                enum:
-                                  - None
-                                  - Follow
-                              digitalocean:
-                                description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - tokenSecretRef
-                                properties:
-                                  tokenSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                              rfc2136:
-                                description: |-
-                                  Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
-                                  to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - nameserver
-                                properties:
-                                  nameserver:
-                                    description: |-
-                                      The IP address or hostname of an authoritative DNS server supporting
-                                      RFC2136 in the form host:port. If the host is an IPv6 address it must be
-                                      enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
-                                      This field is required.
-                                    type: string
-                                  tsigAlgorithm:
-                                    description: |-
-                                      The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
-                                      when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
-                                      Supported values are (case-insensitive): ``HMACMD5`` (default),
-                                      ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
-                                    type: string
-                                  tsigKeyName:
-                                    description: |-
-                                      The TSIG Key name configured in the DNS.
-                                      If ``tsigSecretSecretRef`` is defined, this field is required.
-                                    type: string
-                                  tsigSecretSecretRef:
-                                    description: |-
-                                      The name of the secret containing the TSIG value.
-                                      If ``tsigKeyName`` is defined, this field is required.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                              route53:
-                                description: Use the AWS Route53 API to manage DNS01 challenge records.
-                                type: object
-                                properties:
-                                  accessKeyID:
-                                    description: |-
-                                      The AccessKeyID is used for authentication.
-                                      Cannot be set when SecretAccessKeyID is set.
-                                      If neither the Access Key nor Key ID are set, we fall-back to using env
-                                      vars, shared credentials file or AWS Instance metadata,
-                                      see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
-                                    type: string
-                                  accessKeyIDSecretRef:
-                                    description: |-
-                                      The SecretAccessKey is used for authentication. If set, pull the AWS
-                                      access key ID from a key within a Kubernetes Secret.
-                                      Cannot be set when AccessKeyID is set.
-                                      If neither the Access Key nor Key ID are set, we fall-back to using env
-                                      vars, shared credentials file or AWS Instance metadata,
-                                      see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  auth:
-                                    description: Auth configures how cert-manager authenticates.
-                                    type: object
-                                    required:
-                                      - kubernetes
-                                    properties:
-                                      kubernetes:
-                                        description: |-
-                                          Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
-                                          by passing a bound ServiceAccount token.
-                                        type: object
-                                        required:
-                                          - serviceAccountRef
-                                        properties:
-                                          serviceAccountRef:
-                                            description: |-
-                                              A reference to a service account that will be used to request a bound
-                                              token (also known as "projected token"). To use this field, you must
-                                              configure an RBAC rule to let cert-manager request a token.
-                                            type: object
-                                            required:
-                                              - name
-                                            properties:
-                                              audiences:
-                                                description: |-
-                                                  TokenAudiences is an optional list of audiences to include in the
-                                                  token passed to AWS. The default token consisting of the issuer's namespace
-                                                  and name is always included.
-                                                  If unset the audience defaults to `sts.amazonaws.com`.
-                                                type: array
-                                                items:
-                                                  type: string
-                                              name:
-                                                description: Name of the ServiceAccount used to request a token.
-                                                type: string
-                                  hostedZoneID:
-                                    description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.
-                                    type: string
-                                  region:
-                                    description: |-
-                                      Override the AWS region.
-
-                                      Route53 is a global service and does not have regional endpoints but the
-                                      region specified here (or via environment variables) is used as a hint to
-                                      help compute the correct AWS credential scope and partition when it
-                                      connects to Route53. See:
-                                      - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
-                                      - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)
-
-                                      If you omit this region field, cert-manager will use the region from
-                                      AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
-                                      in the cert-manager controller Pod.
-
-                                      The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
-                                      Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
-                                      [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
-                                      In this case this `region` field value is ignored.
-
-                                      The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
-                                      Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
-                                      [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
-                                      In this case this `region` field value is ignored.
-                                    type: string
-                                  role:
-                                    description: |-
-                                      Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
-                                      or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
-                                    type: string
-                                  secretAccessKeySecretRef:
-                                    description: |-
-                                      The SecretAccessKey is used for authentication.
-                                      If neither the Access Key nor Key ID are set, we fall-back to using env
-                                      vars, shared credentials file or AWS Instance metadata,
-                                      see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                              webhook:
-                                description: |-
-                                  Configure an external webhook based DNS01 challenge solver to manage
-                                  DNS01 challenge records.
-                                type: object
-                                required:
-                                  - groupName
-                                  - solverName
-                                properties:
-                                  config:
-                                    description: |-
-                                      Additional configuration that should be passed to the webhook apiserver
-                                      when challenges are processed.
-                                      This can contain arbitrary JSON data.
-                                      Secret values should not be specified in this stanza.
-                                      If secret values are needed (e.g. credentials for a DNS service), you
-                                      should use a SecretKeySelector to reference a Secret resource.
-                                      For details on the schema of this field, consult the webhook provider
-                                      implementation's documentation.
-                                    x-kubernetes-preserve-unknown-fields: true
-                                  groupName:
-                                    description: |-
-                                      The API group name that should be used when POSTing ChallengePayload
-                                      resources to the webhook apiserver.
-                                      This should be the same as the GroupName specified in the webhook
-                                      provider implementation.
-                                    type: string
-                                  solverName:
-                                    description: |-
-                                      The name of the solver to use, as defined in the webhook provider
-                                      implementation.
-                                      This will typically be the name of the provider, e.g. 'cloudflare'.
-                                    type: string
-                          http01:
-                            description: |-
-                              Configures cert-manager to attempt to complete authorizations by
-                              performing the HTTP01 challenge flow.
-                              It is not possible to obtain certificates for wildcard domain names
-                              (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
-                            type: object
-                            properties:
-                              gatewayHTTPRoute:
-                                description: |-
-                                  The Gateway API is a sig-network community API that models service networking
-                                  in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
-                                  create HTTPRoutes with the specified labels in the same namespace as the challenge.
-                                  This solver is experimental, and fields / behaviour may change in the future.
-                                type: object
-                                properties:
-                                  labels:
-                                    description: |-
-                                      Custom labels that will be applied to HTTPRoutes created by cert-manager
-                                      while solving HTTP-01 challenges.
-                                    type: object
-                                    additionalProperties:
-                                      type: string
-                                  parentRefs:
-                                    description: |-
-                                      When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
-                                      cert-manager needs to know which parentRefs should be used when creating
-                                      the HTTPRoute. Usually, the parentRef references a Gateway. See:
-                                      https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
-                                    type: array
-                                    items:
-                                      description: |-
-                                        ParentReference identifies an API object (usually a Gateway) that can be considered
-                                        a parent of this resource (usually a route). There are two kinds of parent resources
-                                        with "Core" support:
-
-                                        * Gateway (Gateway conformance profile)
-                                        * Service (Mesh conformance profile, ClusterIP Services only)
-
-                                        This API may be extended in the future to support additional kinds of parent
-                                        resources.
-
-                                        The API object must be valid in the cluster; the Group and Kind must
-                                        be registered in the cluster for this reference to be valid.
-                                      type: object
-                                      required:
-                                        - name
-                                      properties:
-                                        group:
-                                          description: |-
-                                            Group is the group of the referent.
-                                            When unspecified, "gateway.networking.k8s.io" is inferred.
-                                            To set the core API group (such as for a "Service" kind referent),
-                                            Group must be explicitly set to "" (empty string).
-
-                                            Support: Core
-                                          type: string
-                                          default: gateway.networking.k8s.io
-                                          maxLength: 253
-                                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                        kind:
-                                          description: |-
-                                            Kind is kind of the referent.
-
-                                            There are two kinds of parent resources with "Core" support:
-
-                                            * Gateway (Gateway conformance profile)
-                                            * Service (Mesh conformance profile, ClusterIP Services only)
-
-                                            Support for other resources is Implementation-Specific.
-                                          type: string
-                                          default: Gateway
-                                          maxLength: 63
-                                          minLength: 1
-                                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                                        name:
-                                          description: |-
-                                            Name is the name of the referent.
-
-                                            Support: Core
-                                          type: string
-                                          maxLength: 253
-                                          minLength: 1
-                                        namespace:
-                                          description: |-
-                                            Namespace is the namespace of the referent. When unspecified, this refers
-                                            to the local namespace of the Route.
-
-                                            Note that there are specific rules for ParentRefs which cross namespace
-                                            boundaries. Cross-namespace references are only valid if they are explicitly
-                                            allowed by something in the namespace they are referring to. For example:
-                                            Gateway has the AllowedRoutes field, and ReferenceGrant provides a
-                                            generic way to enable any other kind of cross-namespace reference.
-
-                                            <gateway:experimental:description>
-                                            ParentRefs from a Route to a Service in the same namespace are "producer"
-                                            routes, which apply default routing rules to inbound connections from
-                                            any namespace to the Service.
-
-                                            ParentRefs from a Route to a Service in a different namespace are
-                                            "consumer" routes, and these routing rules are only applied to outbound
-                                            connections originating from the same namespace as the Route, for which
-                                            the intended destination of the connections are a Service targeted as a
-                                            ParentRef of the Route.
-                                            </gateway:experimental:description>
-
-                                            Support: Core
-                                          type: string
-                                          maxLength: 63
-                                          minLength: 1
-                                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                                        port:
-                                          description: |-
-                                            Port is the network port this Route targets. It can be interpreted
-                                            differently based on the type of parent resource.
-
-                                            When the parent resource is a Gateway, this targets all listeners
-                                            listening on the specified port that also support this kind of Route(and
-                                            select this Route). It's not recommended to set `Port` unless the
-                                            networking behaviors specified in a Route must apply to a specific port
-                                            as opposed to a listener(s) whose port(s) may be changed. When both Port
-                                            and SectionName are specified, the name and port of the selected listener
-                                            must match both specified values.
-
-                                            <gateway:experimental:description>
-                                            When the parent resource is a Service, this targets a specific port in the
-                                            Service spec. When both Port (experimental) and SectionName are specified,
-                                            the name and port of the selected port must match both specified values.
-                                            </gateway:experimental:description>
-
-                                            Implementations MAY choose to support other parent resources.
-                                            Implementations supporting other types of parent resources MUST clearly
-                                            document how/if Port is interpreted.
-
-                                            For the purpose of status, an attachment is considered successful as
-                                            long as the parent resource accepts it partially. For example, Gateway
-                                            listeners can restrict which Routes can attach to them by Route kind,
-                                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
-                                            from the referencing Route, the Route MUST be considered successfully
-                                            attached. If no Gateway listeners accept attachment from this Route,
-                                            the Route MUST be considered detached from the Gateway.
-
-                                            Support: Extended
-                                          type: integer
-                                          format: int32
-                                          maximum: 65535
-                                          minimum: 1
-                                        sectionName:
-                                          description: |-
-                                            SectionName is the name of a section within the target resource. In the
-                                            following resources, SectionName is interpreted as the following:
-
-                                            * Gateway: Listener name. When both Port (experimental) and SectionName
-                                            are specified, the name and port of the selected listener must match
-                                            both specified values.
-                                            * Service: Port name. When both Port (experimental) and SectionName
-                                            are specified, the name and port of the selected listener must match
-                                            both specified values.
-
-                                            Implementations MAY choose to support attaching Routes to other resources.
-                                            If that is the case, they MUST clearly document how SectionName is
-                                            interpreted.
-
-                                            When unspecified (empty string), this will reference the entire resource.
-                                            For the purpose of status, an attachment is considered successful if at
-                                            least one section in the parent resource accepts it. For example, Gateway
-                                            listeners can restrict which Routes can attach to them by Route kind,
-                                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
-                                            the referencing Route, the Route MUST be considered successfully
-                                            attached. If no Gateway listeners accept attachment from this Route, the
-                                            Route MUST be considered detached from the Gateway.
-
-                                            Support: Core
-                                          type: string
-                                          maxLength: 253
-                                          minLength: 1
-                                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                  podTemplate:
-                                    description: |-
-                                      Optional pod template used to configure the ACME challenge solver pods
-                                      used for HTTP01 challenges.
-                                    type: object
-                                    properties:
-                                      metadata:
-                                        description: |-
-                                          ObjectMeta overrides for the pod used to solve HTTP01 challenges.
-                                          Only the 'labels' and 'annotations' fields may be set.
-                                          If labels or annotations overlap with in-built values, the values here
-                                          will override the in-built values.
-                                        type: object
-                                        properties:
-                                          annotations:
-                                            description: Annotations that should be added to the created ACME HTTP01 solver pods.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          labels:
-                                            description: Labels that should be added to the created ACME HTTP01 solver pods.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                      spec:
-                                        description: |-
-                                          PodSpec defines overrides for the HTTP01 challenge solver pod.
-                                          Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
-                                          All other fields will be ignored.
-                                        type: object
-                                        properties:
-                                          affinity:
-                                            description: If specified, the pod's scheduling constraints
-                                            type: object
-                                            properties:
-                                              nodeAffinity:
-                                                description: Describes node affinity scheduling rules for the pod.
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node matches the corresponding matchExpressions; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        An empty preferred scheduling term matches all objects with implicit weight 0
-                                                        (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
-                                                      type: object
-                                                      required:
-                                                        - preference
-                                                        - weight
-                                                      properties:
-                                                        preference:
-                                                          description: A node selector term, associated with the corresponding weight.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: A list of node selector requirements by node's labels.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchFields:
-                                                              description: A list of node selector requirements by node's fields.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                          x-kubernetes-map-type: atomic
-                                                        weight:
-                                                          description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to an update), the system
-                                                      may or may not try to eventually evict the pod from its node.
-                                                    type: object
-                                                    required:
-                                                      - nodeSelectorTerms
-                                                    properties:
-                                                      nodeSelectorTerms:
-                                                        description: Required. A list of node selector terms. The terms are ORed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A null or empty node selector term matches no objects. The requirements of
-                                                            them are ANDed.
-                                                            The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: A list of node selector requirements by node's labels.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchFields:
-                                                              description: A list of node selector requirements by node's fields.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                          x-kubernetes-map-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                    x-kubernetes-map-type: atomic
-                                              podAffinity:
-                                                description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                      type: object
-                                                      required:
-                                                        - podAffinityTerm
-                                                        - weight
-                                                      properties:
-                                                        podAffinityTerm:
-                                                          description: Required. A pod affinity term, associated with the corresponding weight.
-                                                          type: object
-                                                          required:
-                                                            - topologyKey
-                                                          properties:
-                                                            labelSelector:
-                                                              description: |-
-                                                                A label query over a set of resources, in this case pods.
-                                                                If it's null, this PodAffinityTerm matches with no Pods.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            matchLabelKeys:
-                                                              description: |-
-                                                                MatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            mismatchLabelKeys:
-                                                              description: |-
-                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            namespaceSelector:
-                                                              description: |-
-                                                                A label query over the set of namespaces that the term applies to.
-                                                                The term is applied to the union of the namespaces selected by this field
-                                                                and the ones listed in the namespaces field.
-                                                                null selector and null or empty namespaces list means "this pod's namespace".
-                                                                An empty selector ({}) matches all namespaces.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            namespaces:
-                                                              description: |-
-                                                                namespaces specifies a static list of namespace names that the term applies to.
-                                                                The term is applied to the union of the namespaces listed in this field
-                                                                and the ones selected by namespaceSelector.
-                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            topologyKey:
-                                                              description: |-
-                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                                whose value of the label with key topologyKey matches that of any node on which any of the
-                                                                selected pods is running.
-                                                                Empty topologyKey is not allowed.
-                                                              type: string
-                                                        weight:
-                                                          description: |-
-                                                            weight associated with matching the corresponding podAffinityTerm,
-                                                            in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to a pod label update), the
-                                                      system may or may not try to eventually evict the pod from its node.
-                                                      When there are multiple elements, the lists of nodes corresponding to each
-                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        Defines a set of pods (namely those matching the labelSelector
-                                                        relative to the given namespace(s)) that this pod should be
-                                                        co-located (affinity) or not co-located (anti-affinity) with,
-                                                        where co-located is defined as running on a node whose value of
-                                                        the label with key <topologyKey> matches that of any node on which
-                                                        a pod of the set of pods is running
-                                                      type: object
-                                                      required:
-                                                        - topologyKey
-                                                      properties:
-                                                        labelSelector:
-                                                          description: |-
-                                                            A label query over a set of resources, in this case pods.
-                                                            If it's null, this PodAffinityTerm matches with no Pods.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        matchLabelKeys:
-                                                          description: |-
-                                                            MatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        mismatchLabelKeys:
-                                                          description: |-
-                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        namespaceSelector:
-                                                          description: |-
-                                                            A label query over the set of namespaces that the term applies to.
-                                                            The term is applied to the union of the namespaces selected by this field
-                                                            and the ones listed in the namespaces field.
-                                                            null selector and null or empty namespaces list means "this pod's namespace".
-                                                            An empty selector ({}) matches all namespaces.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        namespaces:
-                                                          description: |-
-                                                            namespaces specifies a static list of namespace names that the term applies to.
-                                                            The term is applied to the union of the namespaces listed in this field
-                                                            and the ones selected by namespaceSelector.
-                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        topologyKey:
-                                                          description: |-
-                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                            whose value of the label with key topologyKey matches that of any node on which any of the
-                                                            selected pods is running.
-                                                            Empty topologyKey is not allowed.
-                                                          type: string
-                                                    x-kubernetes-list-type: atomic
-                                              podAntiAffinity:
-                                                description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the anti-affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                      type: object
-                                                      required:
-                                                        - podAffinityTerm
-                                                        - weight
-                                                      properties:
-                                                        podAffinityTerm:
-                                                          description: Required. A pod affinity term, associated with the corresponding weight.
-                                                          type: object
-                                                          required:
-                                                            - topologyKey
-                                                          properties:
-                                                            labelSelector:
-                                                              description: |-
-                                                                A label query over a set of resources, in this case pods.
-                                                                If it's null, this PodAffinityTerm matches with no Pods.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            matchLabelKeys:
-                                                              description: |-
-                                                                MatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            mismatchLabelKeys:
-                                                              description: |-
-                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            namespaceSelector:
-                                                              description: |-
-                                                                A label query over the set of namespaces that the term applies to.
-                                                                The term is applied to the union of the namespaces selected by this field
-                                                                and the ones listed in the namespaces field.
-                                                                null selector and null or empty namespaces list means "this pod's namespace".
-                                                                An empty selector ({}) matches all namespaces.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            namespaces:
-                                                              description: |-
-                                                                namespaces specifies a static list of namespace names that the term applies to.
-                                                                The term is applied to the union of the namespaces listed in this field
-                                                                and the ones selected by namespaceSelector.
-                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            topologyKey:
-                                                              description: |-
-                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                                whose value of the label with key topologyKey matches that of any node on which any of the
-                                                                selected pods is running.
-                                                                Empty topologyKey is not allowed.
-                                                              type: string
-                                                        weight:
-                                                          description: |-
-                                                            weight associated with matching the corresponding podAffinityTerm,
-                                                            in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the anti-affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the anti-affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to a pod label update), the
-                                                      system may or may not try to eventually evict the pod from its node.
-                                                      When there are multiple elements, the lists of nodes corresponding to each
-                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        Defines a set of pods (namely those matching the labelSelector
-                                                        relative to the given namespace(s)) that this pod should be
-                                                        co-located (affinity) or not co-located (anti-affinity) with,
-                                                        where co-located is defined as running on a node whose value of
-                                                        the label with key <topologyKey> matches that of any node on which
-                                                        a pod of the set of pods is running
-                                                      type: object
-                                                      required:
-                                                        - topologyKey
-                                                      properties:
-                                                        labelSelector:
-                                                          description: |-
-                                                            A label query over a set of resources, in this case pods.
-                                                            If it's null, this PodAffinityTerm matches with no Pods.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        matchLabelKeys:
-                                                          description: |-
-                                                            MatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        mismatchLabelKeys:
-                                                          description: |-
-                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        namespaceSelector:
-                                                          description: |-
-                                                            A label query over the set of namespaces that the term applies to.
-                                                            The term is applied to the union of the namespaces selected by this field
-                                                            and the ones listed in the namespaces field.
-                                                            null selector and null or empty namespaces list means "this pod's namespace".
-                                                            An empty selector ({}) matches all namespaces.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        namespaces:
-                                                          description: |-
-                                                            namespaces specifies a static list of namespace names that the term applies to.
-                                                            The term is applied to the union of the namespaces listed in this field
-                                                            and the ones selected by namespaceSelector.
-                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        topologyKey:
-                                                          description: |-
-                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                            whose value of the label with key topologyKey matches that of any node on which any of the
-                                                            selected pods is running.
-                                                            Empty topologyKey is not allowed.
-                                                          type: string
-                                                    x-kubernetes-list-type: atomic
-                                          imagePullSecrets:
-                                            description: If specified, the pod's imagePullSecrets
-                                            type: array
-                                            items:
-                                              description: |-
-                                                LocalObjectReference contains enough information to let you locate the
-                                                referenced object inside the same namespace.
-                                              type: object
-                                              properties:
-                                                name:
-                                                  description: |-
-                                                    Name of the referent.
-                                                    This field is effectively required, but due to backwards compatibility is
-                                                    allowed to be empty. Instances of this type with an empty value here are
-                                                    almost certainly wrong.
-                                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                                  type: string
-                                                  default: ""
-                                              x-kubernetes-map-type: atomic
-                                          nodeSelector:
-                                            description: |-
-                                              NodeSelector is a selector which must be true for the pod to fit on a node.
-                                              Selector which must match a node's labels for the pod to be scheduled on that node.
-                                              More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          priorityClassName:
-                                            description: If specified, the pod's priorityClassName.
-                                            type: string
-                                          securityContext:
-                                            description: If specified, the pod's security context
-                                            type: object
-                                            properties:
-                                              fsGroup:
-                                                description: |-
-                                                  A special supplemental group that applies to all containers in a pod.
-                                                  Some volume types allow the Kubelet to change the ownership of that volume
-                                                  to be owned by the pod:
-
-                                                  1. The owning GID will be the FSGroup
-                                                  2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
-                                                  3. The permission bits are OR'd with rw-rw----
-
-                                                  If unset, the Kubelet will not modify the ownership and permissions of any volume.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              fsGroupChangePolicy:
-                                                description: |-
-                                                  fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
-                                                  before being exposed inside Pod. This field will only apply to
-                                                  volume types which support fsGroup based ownership(and permissions).
-                                                  It will have no effect on ephemeral volume types such as: secret, configmaps
-                                                  and emptydir.
-                                                  Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: string
-                                              runAsGroup:
-                                                description: |-
-                                                  The GID to run the entrypoint of the container process.
-                                                  Uses runtime default if unset.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
-                                                  for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              runAsNonRoot:
-                                                description: |-
-                                                  Indicates that the container must run as a non-root user.
-                                                  If true, the Kubelet will validate the image at runtime to ensure that it
-                                                  does not run as UID 0 (root) and fail to start the container if it does.
-                                                  If unset or false, no such validation will be performed.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
-                                                type: boolean
-                                              runAsUser:
-                                                description: |-
-                                                  The UID to run the entrypoint of the container process.
-                                                  Defaults to user specified in image metadata if unspecified.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
-                                                  for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              seLinuxOptions:
-                                                description: |-
-                                                  The SELinux context to be applied to all containers.
-                                                  If unspecified, the container runtime will allocate a random SELinux context for each
-                                                  container.  May also be set in SecurityContext.  If set in
-                                                  both SecurityContext and PodSecurityContext, the value specified in SecurityContext
-                                                  takes precedence for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: object
-                                                properties:
-                                                  level:
-                                                    description: Level is SELinux level label that applies to the container.
-                                                    type: string
-                                                  role:
-                                                    description: Role is a SELinux role label that applies to the container.
-                                                    type: string
-                                                  type:
-                                                    description: Type is a SELinux type label that applies to the container.
-                                                    type: string
-                                                  user:
-                                                    description: User is a SELinux user label that applies to the container.
-                                                    type: string
-                                              seccompProfile:
-                                                description: |-
-                                                  The seccomp options to use by the containers in this pod.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: object
-                                                required:
-                                                  - type
-                                                properties:
-                                                  localhostProfile:
-                                                    description: |-
-                                                      localhostProfile indicates a profile defined in a file on the node should be used.
-                                                      The profile must be preconfigured on the node to work.
-                                                      Must be a descending path, relative to the kubelet's configured seccomp profile location.
-                                                      Must be set if type is "Localhost". Must NOT be set for any other type.
-                                                    type: string
-                                                  type:
-                                                    description: |-
-                                                      type indicates which kind of seccomp profile will be applied.
-                                                      Valid options are:
-
-                                                      Localhost - a profile defined in a file on the node should be used.
-                                                      RuntimeDefault - the container runtime default profile should be used.
-                                                      Unconfined - no profile should be applied.
-                                                    type: string
-                                              supplementalGroups:
-                                                description: |-
-                                                  A list of groups applied to the first process run in each container, in addition
-                                                  to the container's primary GID, the fsGroup (if specified), and group memberships
-                                                  defined in the container image for the uid of the container process. If unspecified,
-                                                  no additional groups are added to any container. Note that group memberships
-                                                  defined in the container image for the uid of the container process are still effective,
-                                                  even if they are not included in this list.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: array
-                                                items:
-                                                  type: integer
-                                                  format: int64
-                                              sysctls:
-                                                description: |-
-                                                  Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
-                                                  sysctls (by the container runtime) might fail to launch.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: array
-                                                items:
-                                                  description: Sysctl defines a kernel parameter to be set
-                                                  type: object
-                                                  required:
-                                                    - name
-                                                    - value
-                                                  properties:
-                                                    name:
-                                                      description: Name of a property to set
-                                                      type: string
-                                                    value:
-                                                      description: Value of a property to set
-                                                      type: string
-                                          serviceAccountName:
-                                            description: If specified, the pod's service account
-                                            type: string
-                                          tolerations:
-                                            description: If specified, the pod's tolerations.
-                                            type: array
-                                            items:
-                                              description: |-
-                                                The pod this Toleration is attached to tolerates any taint that matches
-                                                the triple <key,value,effect> using the matching operator <operator>.
-                                              type: object
-                                              properties:
-                                                effect:
-                                                  description: |-
-                                                    Effect indicates the taint effect to match. Empty means match all taint effects.
-                                                    When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                                                  type: string
-                                                key:
-                                                  description: |-
-                                                    Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                                                    If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                                                  type: string
-                                                operator:
-                                                  description: |-
-                                                    Operator represents a key's relationship to the value.
-                                                    Valid operators are Exists and Equal. Defaults to Equal.
-                                                    Exists is equivalent to wildcard for value, so that a pod can
-                                                    tolerate all taints of a particular category.
-                                                  type: string
-                                                tolerationSeconds:
-                                                  description: |-
-                                                    TolerationSeconds represents the period of time the toleration (which must be
-                                                    of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                                                    it is not set, which means tolerate the taint forever (do not evict). Zero and
-                                                    negative values will be treated as 0 (evict immediately) by the system.
-                                                  type: integer
-                                                  format: int64
-                                                value:
-                                                  description: |-
-                                                    Value is the taint value the toleration matches to.
-                                                    If the operator is Exists, the value should be empty, otherwise just a regular string.
-                                                  type: string
-                                  serviceType:
-                                    description: |-
-                                      Optional service type for Kubernetes solver service. Supported values
-                                      are NodePort or ClusterIP. If unset, defaults to NodePort.
-                                    type: string
-                              ingress:
-                                description: |-
-                                  The ingress based HTTP01 challenge solver will solve challenges by
-                                  creating or modifying Ingress resources in order to route requests for
-                                  '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
-                                  provisioned by cert-manager for each Challenge to be completed.
-                                type: object
-                                properties:
-                                  class:
-                                    description: |-
-                                      This field configures the annotation `kubernetes.io/ingress.class` when
-                                      creating Ingress resources to solve ACME challenges that use this
-                                      challenge solver. Only one of `class`, `name` or `ingressClassName` may
-                                      be specified.
-                                    type: string
-                                  ingressClassName:
-                                    description: |-
-                                      This field configures the field `ingressClassName` on the created Ingress
-                                      resources used to solve ACME challenges that use this challenge solver.
-                                      This is the recommended way of configuring the ingress class. Only one of
-                                      `class`, `name` or `ingressClassName` may be specified.
-                                    type: string
-                                  ingressTemplate:
-                                    description: |-
-                                      Optional ingress template used to configure the ACME challenge solver
-                                      ingress used for HTTP01 challenges.
-                                    type: object
-                                    properties:
-                                      metadata:
-                                        description: |-
-                                          ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
-                                          Only the 'labels' and 'annotations' fields may be set.
-                                          If labels or annotations overlap with in-built values, the values here
-                                          will override the in-built values.
-                                        type: object
-                                        properties:
-                                          annotations:
-                                            description: Annotations that should be added to the created ACME HTTP01 solver ingress.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          labels:
-                                            description: Labels that should be added to the created ACME HTTP01 solver ingress.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                  name:
-                                    description: |-
-                                      The name of the ingress resource that should have ACME challenge solving
-                                      routes inserted into it in order to solve HTTP01 challenges.
-                                      This is typically used in conjunction with ingress controllers like
-                                      ingress-gce, which maintains a 1:1 mapping between external IPs and
-                                      ingress resources. Only one of `class`, `name` or `ingressClassName` may
-                                      be specified.
-                                    type: string
-                                  podTemplate:
-                                    description: |-
-                                      Optional pod template used to configure the ACME challenge solver pods
-                                      used for HTTP01 challenges.
-                                    type: object
-                                    properties:
-                                      metadata:
-                                        description: |-
-                                          ObjectMeta overrides for the pod used to solve HTTP01 challenges.
-                                          Only the 'labels' and 'annotations' fields may be set.
-                                          If labels or annotations overlap with in-built values, the values here
-                                          will override the in-built values.
-                                        type: object
-                                        properties:
-                                          annotations:
-                                            description: Annotations that should be added to the created ACME HTTP01 solver pods.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          labels:
-                                            description: Labels that should be added to the created ACME HTTP01 solver pods.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                      spec:
-                                        description: |-
-                                          PodSpec defines overrides for the HTTP01 challenge solver pod.
-                                          Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
-                                          All other fields will be ignored.
-                                        type: object
-                                        properties:
-                                          affinity:
-                                            description: If specified, the pod's scheduling constraints
-                                            type: object
-                                            properties:
-                                              nodeAffinity:
-                                                description: Describes node affinity scheduling rules for the pod.
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node matches the corresponding matchExpressions; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        An empty preferred scheduling term matches all objects with implicit weight 0
-                                                        (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
-                                                      type: object
-                                                      required:
-                                                        - preference
-                                                        - weight
-                                                      properties:
-                                                        preference:
-                                                          description: A node selector term, associated with the corresponding weight.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: A list of node selector requirements by node's labels.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchFields:
-                                                              description: A list of node selector requirements by node's fields.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                          x-kubernetes-map-type: atomic
-                                                        weight:
-                                                          description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to an update), the system
-                                                      may or may not try to eventually evict the pod from its node.
-                                                    type: object
-                                                    required:
-                                                      - nodeSelectorTerms
-                                                    properties:
-                                                      nodeSelectorTerms:
-                                                        description: Required. A list of node selector terms. The terms are ORed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A null or empty node selector term matches no objects. The requirements of
-                                                            them are ANDed.
-                                                            The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: A list of node selector requirements by node's labels.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchFields:
-                                                              description: A list of node selector requirements by node's fields.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                          x-kubernetes-map-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                    x-kubernetes-map-type: atomic
-                                              podAffinity:
-                                                description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                      type: object
-                                                      required:
-                                                        - podAffinityTerm
-                                                        - weight
-                                                      properties:
-                                                        podAffinityTerm:
-                                                          description: Required. A pod affinity term, associated with the corresponding weight.
-                                                          type: object
-                                                          required:
-                                                            - topologyKey
-                                                          properties:
-                                                            labelSelector:
-                                                              description: |-
-                                                                A label query over a set of resources, in this case pods.
-                                                                If it's null, this PodAffinityTerm matches with no Pods.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            matchLabelKeys:
-                                                              description: |-
-                                                                MatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            mismatchLabelKeys:
-                                                              description: |-
-                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            namespaceSelector:
-                                                              description: |-
-                                                                A label query over the set of namespaces that the term applies to.
-                                                                The term is applied to the union of the namespaces selected by this field
-                                                                and the ones listed in the namespaces field.
-                                                                null selector and null or empty namespaces list means "this pod's namespace".
-                                                                An empty selector ({}) matches all namespaces.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            namespaces:
-                                                              description: |-
-                                                                namespaces specifies a static list of namespace names that the term applies to.
-                                                                The term is applied to the union of the namespaces listed in this field
-                                                                and the ones selected by namespaceSelector.
-                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            topologyKey:
-                                                              description: |-
-                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                                whose value of the label with key topologyKey matches that of any node on which any of the
-                                                                selected pods is running.
-                                                                Empty topologyKey is not allowed.
-                                                              type: string
-                                                        weight:
-                                                          description: |-
-                                                            weight associated with matching the corresponding podAffinityTerm,
-                                                            in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to a pod label update), the
-                                                      system may or may not try to eventually evict the pod from its node.
-                                                      When there are multiple elements, the lists of nodes corresponding to each
-                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        Defines a set of pods (namely those matching the labelSelector
-                                                        relative to the given namespace(s)) that this pod should be
-                                                        co-located (affinity) or not co-located (anti-affinity) with,
-                                                        where co-located is defined as running on a node whose value of
-                                                        the label with key <topologyKey> matches that of any node on which
-                                                        a pod of the set of pods is running
-                                                      type: object
-                                                      required:
-                                                        - topologyKey
-                                                      properties:
-                                                        labelSelector:
-                                                          description: |-
-                                                            A label query over a set of resources, in this case pods.
-                                                            If it's null, this PodAffinityTerm matches with no Pods.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        matchLabelKeys:
-                                                          description: |-
-                                                            MatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        mismatchLabelKeys:
-                                                          description: |-
-                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        namespaceSelector:
-                                                          description: |-
-                                                            A label query over the set of namespaces that the term applies to.
-                                                            The term is applied to the union of the namespaces selected by this field
-                                                            and the ones listed in the namespaces field.
-                                                            null selector and null or empty namespaces list means "this pod's namespace".
-                                                            An empty selector ({}) matches all namespaces.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        namespaces:
-                                                          description: |-
-                                                            namespaces specifies a static list of namespace names that the term applies to.
-                                                            The term is applied to the union of the namespaces listed in this field
-                                                            and the ones selected by namespaceSelector.
-                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        topologyKey:
-                                                          description: |-
-                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                            whose value of the label with key topologyKey matches that of any node on which any of the
-                                                            selected pods is running.
-                                                            Empty topologyKey is not allowed.
-                                                          type: string
-                                                    x-kubernetes-list-type: atomic
-                                              podAntiAffinity:
-                                                description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the anti-affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                      type: object
-                                                      required:
-                                                        - podAffinityTerm
-                                                        - weight
-                                                      properties:
-                                                        podAffinityTerm:
-                                                          description: Required. A pod affinity term, associated with the corresponding weight.
-                                                          type: object
-                                                          required:
-                                                            - topologyKey
-                                                          properties:
-                                                            labelSelector:
-                                                              description: |-
-                                                                A label query over a set of resources, in this case pods.
-                                                                If it's null, this PodAffinityTerm matches with no Pods.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            matchLabelKeys:
-                                                              description: |-
-                                                                MatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            mismatchLabelKeys:
-                                                              description: |-
-                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            namespaceSelector:
-                                                              description: |-
-                                                                A label query over the set of namespaces that the term applies to.
-                                                                The term is applied to the union of the namespaces selected by this field
-                                                                and the ones listed in the namespaces field.
-                                                                null selector and null or empty namespaces list means "this pod's namespace".
-                                                                An empty selector ({}) matches all namespaces.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            namespaces:
-                                                              description: |-
-                                                                namespaces specifies a static list of namespace names that the term applies to.
-                                                                The term is applied to the union of the namespaces listed in this field
-                                                                and the ones selected by namespaceSelector.
-                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            topologyKey:
-                                                              description: |-
-                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                                whose value of the label with key topologyKey matches that of any node on which any of the
-                                                                selected pods is running.
-                                                                Empty topologyKey is not allowed.
-                                                              type: string
-                                                        weight:
-                                                          description: |-
-                                                            weight associated with matching the corresponding podAffinityTerm,
-                                                            in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the anti-affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the anti-affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to a pod label update), the
-                                                      system may or may not try to eventually evict the pod from its node.
-                                                      When there are multiple elements, the lists of nodes corresponding to each
-                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        Defines a set of pods (namely those matching the labelSelector
-                                                        relative to the given namespace(s)) that this pod should be
-                                                        co-located (affinity) or not co-located (anti-affinity) with,
-                                                        where co-located is defined as running on a node whose value of
-                                                        the label with key <topologyKey> matches that of any node on which
-                                                        a pod of the set of pods is running
-                                                      type: object
-                                                      required:
-                                                        - topologyKey
-                                                      properties:
-                                                        labelSelector:
-                                                          description: |-
-                                                            A label query over a set of resources, in this case pods.
-                                                            If it's null, this PodAffinityTerm matches with no Pods.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        matchLabelKeys:
-                                                          description: |-
-                                                            MatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        mismatchLabelKeys:
-                                                          description: |-
-                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        namespaceSelector:
-                                                          description: |-
-                                                            A label query over the set of namespaces that the term applies to.
-                                                            The term is applied to the union of the namespaces selected by this field
-                                                            and the ones listed in the namespaces field.
-                                                            null selector and null or empty namespaces list means "this pod's namespace".
-                                                            An empty selector ({}) matches all namespaces.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        namespaces:
-                                                          description: |-
-                                                            namespaces specifies a static list of namespace names that the term applies to.
-                                                            The term is applied to the union of the namespaces listed in this field
-                                                            and the ones selected by namespaceSelector.
-                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        topologyKey:
-                                                          description: |-
-                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                            whose value of the label with key topologyKey matches that of any node on which any of the
-                                                            selected pods is running.
-                                                            Empty topologyKey is not allowed.
-                                                          type: string
-                                                    x-kubernetes-list-type: atomic
-                                          imagePullSecrets:
-                                            description: If specified, the pod's imagePullSecrets
-                                            type: array
-                                            items:
-                                              description: |-
-                                                LocalObjectReference contains enough information to let you locate the
-                                                referenced object inside the same namespace.
-                                              type: object
-                                              properties:
-                                                name:
-                                                  description: |-
-                                                    Name of the referent.
-                                                    This field is effectively required, but due to backwards compatibility is
-                                                    allowed to be empty. Instances of this type with an empty value here are
-                                                    almost certainly wrong.
-                                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                                  type: string
-                                                  default: ""
-                                              x-kubernetes-map-type: atomic
-                                          nodeSelector:
-                                            description: |-
-                                              NodeSelector is a selector which must be true for the pod to fit on a node.
-                                              Selector which must match a node's labels for the pod to be scheduled on that node.
-                                              More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          priorityClassName:
-                                            description: If specified, the pod's priorityClassName.
-                                            type: string
-                                          securityContext:
-                                            description: If specified, the pod's security context
-                                            type: object
-                                            properties:
-                                              fsGroup:
-                                                description: |-
-                                                  A special supplemental group that applies to all containers in a pod.
-                                                  Some volume types allow the Kubelet to change the ownership of that volume
-                                                  to be owned by the pod:
-
-                                                  1. The owning GID will be the FSGroup
-                                                  2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
-                                                  3. The permission bits are OR'd with rw-rw----
-
-                                                  If unset, the Kubelet will not modify the ownership and permissions of any volume.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              fsGroupChangePolicy:
-                                                description: |-
-                                                  fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
-                                                  before being exposed inside Pod. This field will only apply to
-                                                  volume types which support fsGroup based ownership(and permissions).
-                                                  It will have no effect on ephemeral volume types such as: secret, configmaps
-                                                  and emptydir.
-                                                  Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: string
-                                              runAsGroup:
-                                                description: |-
-                                                  The GID to run the entrypoint of the container process.
-                                                  Uses runtime default if unset.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
-                                                  for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              runAsNonRoot:
-                                                description: |-
-                                                  Indicates that the container must run as a non-root user.
-                                                  If true, the Kubelet will validate the image at runtime to ensure that it
-                                                  does not run as UID 0 (root) and fail to start the container if it does.
-                                                  If unset or false, no such validation will be performed.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
-                                                type: boolean
-                                              runAsUser:
-                                                description: |-
-                                                  The UID to run the entrypoint of the container process.
-                                                  Defaults to user specified in image metadata if unspecified.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
-                                                  for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              seLinuxOptions:
-                                                description: |-
-                                                  The SELinux context to be applied to all containers.
-                                                  If unspecified, the container runtime will allocate a random SELinux context for each
-                                                  container.  May also be set in SecurityContext.  If set in
-                                                  both SecurityContext and PodSecurityContext, the value specified in SecurityContext
-                                                  takes precedence for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: object
-                                                properties:
-                                                  level:
-                                                    description: Level is SELinux level label that applies to the container.
-                                                    type: string
-                                                  role:
-                                                    description: Role is a SELinux role label that applies to the container.
-                                                    type: string
-                                                  type:
-                                                    description: Type is a SELinux type label that applies to the container.
-                                                    type: string
-                                                  user:
-                                                    description: User is a SELinux user label that applies to the container.
-                                                    type: string
-                                              seccompProfile:
-                                                description: |-
-                                                  The seccomp options to use by the containers in this pod.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: object
-                                                required:
-                                                  - type
-                                                properties:
-                                                  localhostProfile:
-                                                    description: |-
-                                                      localhostProfile indicates a profile defined in a file on the node should be used.
-                                                      The profile must be preconfigured on the node to work.
-                                                      Must be a descending path, relative to the kubelet's configured seccomp profile location.
-                                                      Must be set if type is "Localhost". Must NOT be set for any other type.
-                                                    type: string
-                                                  type:
-                                                    description: |-
-                                                      type indicates which kind of seccomp profile will be applied.
-                                                      Valid options are:
-
-                                                      Localhost - a profile defined in a file on the node should be used.
-                                                      RuntimeDefault - the container runtime default profile should be used.
-                                                      Unconfined - no profile should be applied.
-                                                    type: string
-                                              supplementalGroups:
-                                                description: |-
-                                                  A list of groups applied to the first process run in each container, in addition
-                                                  to the container's primary GID, the fsGroup (if specified), and group memberships
-                                                  defined in the container image for the uid of the container process. If unspecified,
-                                                  no additional groups are added to any container. Note that group memberships
-                                                  defined in the container image for the uid of the container process are still effective,
-                                                  even if they are not included in this list.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: array
-                                                items:
-                                                  type: integer
-                                                  format: int64
-                                              sysctls:
-                                                description: |-
-                                                  Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
-                                                  sysctls (by the container runtime) might fail to launch.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: array
-                                                items:
-                                                  description: Sysctl defines a kernel parameter to be set
-                                                  type: object
-                                                  required:
-                                                    - name
-                                                    - value
-                                                  properties:
-                                                    name:
-                                                      description: Name of a property to set
-                                                      type: string
-                                                    value:
-                                                      description: Value of a property to set
-                                                      type: string
-                                          serviceAccountName:
-                                            description: If specified, the pod's service account
-                                            type: string
-                                          tolerations:
-                                            description: If specified, the pod's tolerations.
-                                            type: array
-                                            items:
-                                              description: |-
-                                                The pod this Toleration is attached to tolerates any taint that matches
-                                                the triple <key,value,effect> using the matching operator <operator>.
-                                              type: object
-                                              properties:
-                                                effect:
-                                                  description: |-
-                                                    Effect indicates the taint effect to match. Empty means match all taint effects.
-                                                    When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                                                  type: string
-                                                key:
-                                                  description: |-
-                                                    Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                                                    If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                                                  type: string
-                                                operator:
-                                                  description: |-
-                                                    Operator represents a key's relationship to the value.
-                                                    Valid operators are Exists and Equal. Defaults to Equal.
-                                                    Exists is equivalent to wildcard for value, so that a pod can
-                                                    tolerate all taints of a particular category.
-                                                  type: string
-                                                tolerationSeconds:
-                                                  description: |-
-                                                    TolerationSeconds represents the period of time the toleration (which must be
-                                                    of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                                                    it is not set, which means tolerate the taint forever (do not evict). Zero and
-                                                    negative values will be treated as 0 (evict immediately) by the system.
-                                                  type: integer
-                                                  format: int64
-                                                value:
-                                                  description: |-
-                                                    Value is the taint value the toleration matches to.
-                                                    If the operator is Exists, the value should be empty, otherwise just a regular string.
-                                                  type: string
-                                  serviceType:
-                                    description: |-
-                                      Optional service type for Kubernetes solver service. Supported values
-                                      are NodePort or ClusterIP. If unset, defaults to NodePort.
-                                    type: string
-                          selector:
-                            description: |-
-                              Selector selects a set of DNSNames on the Certificate resource that
-                              should be solved using this challenge solver.
-                              If not specified, the solver will be treated as the 'default' solver
-                              with the lowest priority, i.e. if any other solver has a more specific
-                              match, it will be used instead.
-                            type: object
-                            properties:
-                              dnsNames:
-                                description: |-
-                                  List of DNSNames that this solver will be used to solve.
-                                  If specified and a match is found, a dnsNames selector will take
-                                  precedence over a dnsZones selector.
-                                  If multiple solvers match with the same dnsNames value, the solver
-                                  with the most matching labels in matchLabels will be selected.
-                                  If neither has more matches, the solver defined earlier in the list
-                                  will be selected.
-                                type: array
-                                items:
-                                  type: string
-                              dnsZones:
-                                description: |-
-                                  List of DNSZones that this solver will be used to solve.
-                                  The most specific DNS zone match specified here will take precedence
-                                  over other DNS zone matches, so a solver specifying sys.example.com
-                                  will be selected over one specifying example.com for the domain
-                                  www.sys.example.com.
-                                  If multiple solvers match with the same dnsZones value, the solver
-                                  with the most matching labels in matchLabels will be selected.
-                                  If neither has more matches, the solver defined earlier in the list
-                                  will be selected.
-                                type: array
-                                items:
-                                  type: string
-                              matchLabels:
-                                description: |-
-                                  A label selector that is used to refine the set of certificate's that
-                                  this challenge solver will apply to.
-                                type: object
-                                additionalProperties:
-                                  type: string
-                ca:
-                  description: |-
-                    CA configures this issuer to sign certificates using a signing CA keypair
-                    stored in a Secret resource.
-                    This is used to build internal PKIs that are managed by cert-manager.
-                  type: object
-                  required:
-                    - secretName
-                  properties:
-                    crlDistributionPoints:
-                      description: |-
-                        The CRL distribution points is an X.509 v3 certificate extension which identifies
-                        the location of the CRL from which the revocation of this certificate can be checked.
-                        If not set, certificates will be issued without distribution points set.
-                      type: array
-                      items:
-                        type: string
-                    issuingCertificateURLs:
-                      description: |-
-                        IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates
-                        it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.
-                        As an example, such a URL might be "http://ca.domain.com/ca.crt".
-                      type: array
-                      items:
-                        type: string
-                    ocspServers:
-                      description: |-
-                        The OCSP server list is an X.509 v3 extension that defines a list of
-                        URLs of OCSP responders. The OCSP responders can be queried for the
-                        revocation status of an issued certificate. If not set, the
-                        certificate will be issued with no OCSP servers set. For example, an
-                        OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
-                      type: array
-                      items:
-                        type: string
-                    secretName:
-                      description: |-
-                        SecretName is the name of the secret used to sign Certificates issued
-                        by this Issuer.
-                      type: string
-                selfSigned:
-                  description: |-
-                    SelfSigned configures this issuer to 'self sign' certificates using the
-                    private key used to create the CertificateRequest object.
-                  type: object
-                  properties:
-                    crlDistributionPoints:
-                      description: |-
-                        The CRL distribution points is an X.509 v3 certificate extension which identifies
-                        the location of the CRL from which the revocation of this certificate can be checked.
-                        If not set certificate will be issued without CDP. Values are strings.
-                      type: array
-                      items:
-                        type: string
-                vault:
-                  description: |-
-                    Vault configures this issuer to sign certificates using a HashiCorp Vault
-                    PKI backend.
-                  type: object
-                  required:
-                    - auth
-                    - path
-                    - server
-                  properties:
-                    auth:
-                      description: Auth configures how cert-manager authenticates with the Vault server.
-                      type: object
-                      properties:
-                        appRole:
-                          description: |-
-                            AppRole authenticates with Vault using the App Role auth mechanism,
-                            with the role and secret stored in a Kubernetes Secret resource.
-                          type: object
-                          required:
-                            - path
-                            - roleId
-                            - secretRef
-                          properties:
-                            path:
-                              description: |-
-                                Path where the App Role authentication backend is mounted in Vault, e.g:
-                                "approle"
-                              type: string
-                            roleId:
-                              description: |-
-                                RoleID configured in the App Role authentication backend when setting
-                                up the authentication backend in Vault.
-                              type: string
-                            secretRef:
-                              description: |-
-                                Reference to a key in a Secret that contains the App Role secret used
-                                to authenticate with Vault.
-                                The `key` field must be specified and denotes which entry within the Secret
-                                resource is used as the app role secret.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                        clientCertificate:
-                          description: |-
-                            ClientCertificate authenticates with Vault by presenting a client
-                            certificate during the request's TLS handshake.
-                            Works only when using HTTPS protocol.
-                          type: object
-                          properties:
-                            mountPath:
-                              description: |-
-                                The Vault mountPath here is the mount path to use when authenticating with
-                                Vault. For example, setting a value to `/v1/auth/foo`, will use the path
-                                `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
-                                default value "/v1/auth/cert" will be used.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the certificate role to authenticate against.
-                                If not set, matching any certificate role, if available.
-                              type: string
-                            secretName:
-                              description: |-
-                                Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing
-                                tls.crt and tls.key) used to authenticate to Vault using TLS client
-                                authentication.
-                              type: string
-                        kubernetes:
-                          description: |-
-                            Kubernetes authenticates with Vault by passing the ServiceAccount
-                            token stored in the named Secret resource to the Vault server.
-                          type: object
-                          required:
-                            - role
-                          properties:
-                            mountPath:
-                              description: |-
-                                The Vault mountPath here is the mount path to use when authenticating with
-                                Vault. For example, setting a value to `/v1/auth/foo`, will use the path
-                                `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
-                                default value "/v1/auth/kubernetes" will be used.
-                              type: string
-                            role:
-                              description: |-
-                                A required field containing the Vault Role to assume. A Role binds a
-                                Kubernetes ServiceAccount with a set of Vault policies.
-                              type: string
-                            secretRef:
-                              description: |-
-                                The required Secret field containing a Kubernetes ServiceAccount JWT used
-                                for authenticating with Vault. Use of 'ambient credentials' is not
-                                supported.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            serviceAccountRef:
-                              description: |-
-                                A reference to a service account that will be used to request a bound
-                                token (also known as "projected token"). Compared to using "secretRef",
-                                using this field means that you don't rely on statically bound tokens. To
-                                use this field, you must configure an RBAC rule to let cert-manager
-                                request a token.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                audiences:
-                                  description: |-
-                                    TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token
-                                    consisting of the issuer's namespace and name is always included.
-                                  type: array
-                                  items:
-                                    type: string
-                                name:
-                                  description: Name of the ServiceAccount used to request a token.
-                                  type: string
-                        tokenSecretRef:
-                          description: TokenSecretRef authenticates with Vault by presenting a token.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                    caBundle:
-                      description: |-
-                        Base64-encoded bundle of PEM CAs which will be used to validate the certificate
-                        chain presented by Vault. Only used if using HTTPS to connect to Vault and
-                        ignored for HTTP connections.
-                        Mutually exclusive with CABundleSecretRef.
-                        If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
-                        the cert-manager controller container is used to validate the TLS connection.
-                      type: string
-                      format: byte
-                    caBundleSecretRef:
-                      description: |-
-                        Reference to a Secret containing a bundle of PEM-encoded CAs to use when
-                        verifying the certificate chain presented by Vault when using HTTPS.
-                        Mutually exclusive with CABundle.
-                        If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
-                        the cert-manager controller container is used to validate the TLS connection.
-                        If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
-                      type: object
-                      required:
-                        - name
-                      properties:
-                        key:
-                          description: |-
-                            The key of the entry in the Secret resource's `data` field to be used.
-                            Some instances of this field may be defaulted, in others it may be
-                            required.
-                          type: string
-                        name:
-                          description: |-
-                            Name of the resource being referred to.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                    clientCertSecretRef:
-                      description: |-
-                        Reference to a Secret containing a PEM-encoded Client Certificate to use when the
-                        Vault server requires mTLS.
-                      type: object
-                      required:
-                        - name
-                      properties:
-                        key:
-                          description: |-
-                            The key of the entry in the Secret resource's `data` field to be used.
-                            Some instances of this field may be defaulted, in others it may be
-                            required.
-                          type: string
-                        name:
-                          description: |-
-                            Name of the resource being referred to.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                    clientKeySecretRef:
-                      description: |-
-                        Reference to a Secret containing a PEM-encoded Client Private Key to use when the
-                        Vault server requires mTLS.
-                      type: object
-                      required:
-                        - name
-                      properties:
-                        key:
-                          description: |-
-                            The key of the entry in the Secret resource's `data` field to be used.
-                            Some instances of this field may be defaulted, in others it may be
-                            required.
-                          type: string
-                        name:
-                          description: |-
-                            Name of the resource being referred to.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                    namespace:
-                      description: |-
-                        Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1"
-                        More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
-                      type: string
-                    path:
-                      description: |-
-                        Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
-                        "my_pki_mount/sign/my-role-name".
-                      type: string
-                    server:
-                      description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
-                      type: string
-                venafi:
-                  description: |-
-                    Venafi configures this issuer to sign certificates using a Venafi TPP
-                    or Venafi Cloud policy zone.
-                  type: object
-                  required:
-                    - zone
-                  properties:
-                    cloud:
-                      description: |-
-                        Cloud specifies the Venafi cloud configuration settings.
-                        Only one of TPP or Cloud may be specified.
-                      type: object
-                      required:
-                        - apiTokenSecretRef
-                      properties:
-                        apiTokenSecretRef:
-                          description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                        url:
-                          description: |-
-                            URL is the base URL for Venafi Cloud.
-                            Defaults to "https://api.venafi.cloud/v1".
-                          type: string
-                    tpp:
-                      description: |-
-                        TPP specifies Trust Protection Platform configuration settings.
-                        Only one of TPP or Cloud may be specified.
-                      type: object
-                      required:
-                        - credentialsRef
-                        - url
-                      properties:
-                        caBundle:
-                          description: |-
-                            Base64-encoded bundle of PEM CAs which will be used to validate the certificate
-                            chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
-                            If undefined, the certificate bundle in the cert-manager controller container
-                            is used to validate the chain.
-                          type: string
-                          format: byte
-                        caBundleSecretRef:
-                          description: |-
-                            Reference to a Secret containing a base64-encoded bundle of PEM CAs
-                            which will be used to validate the certificate chain presented by the TPP server.
-                            Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
-                            If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
-                            the cert-manager controller container is used to validate the TLS connection.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                        credentialsRef:
-                          description: |-
-                            CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.
-                            The secret must contain the key 'access-token' for the Access Token Authentication,
-                            or two keys, 'username' and 'password' for the API Keys Authentication.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                        url:
-                          description: |-
-                            URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
-                            for example: "https://tpp.example.com/vedsdk".
-                          type: string
-                    zone:
-                      description: |-
-                        Zone is the Venafi Policy Zone to use for this issuer.
-                        All requests made to the Venafi platform will be restricted by the named
-                        zone policy.
-                        This field is required.
-                      type: string
-            status:
-              description: Status of the ClusterIssuer. This is set and managed automatically.
-              type: object
-              properties:
-                acme:
-                  description: |-
-                    ACME specific status options.
-                    This field should only be set if the Issuer is configured to use an ACME
-                    server to issue certificates.
-                  type: object
-                  properties:
-                    lastPrivateKeyHash:
-                      description: |-
-                        LastPrivateKeyHash is a hash of the private key associated with the latest
-                        registered ACME account, in order to track changes made to registered account
-                        associated with the Issuer
-                      type: string
-                    lastRegisteredEmail:
-                      description: |-
-                        LastRegisteredEmail is the email associated with the latest registered
-                        ACME account, in order to track changes made to registered account
-                        associated with the  Issuer
-                      type: string
-                    uri:
-                      description: |-
-                        URI is the unique account identifier, which can also be used to retrieve
-                        account details from the CA
-                      type: string
-                conditions:
-                  description: |-
-                    List of status conditions to indicate the status of a CertificateRequest.
-                    Known condition types are `Ready`.
-                  type: array
-                  items:
-                    description: IssuerCondition contains condition information for an Issuer.
-                    type: object
-                    required:
-                      - status
-                      - type
-                    properties:
-                      lastTransitionTime:
-                        description: |-
-                          LastTransitionTime is the timestamp corresponding to the last status
-                          change of this condition.
-                        type: string
-                        format: date-time
-                      message:
-                        description: |-
-                          Message is a human readable description of the details of the last
-                          transition, complementing reason.
-                        type: string
-                      observedGeneration:
-                        description: |-
-                          If set, this represents the .metadata.generation that the condition was
-                          set based upon.
-                          For instance, if .metadata.generation is currently 12, but the
-                          .status.condition[x].observedGeneration is 9, the condition is out of date
-                          with respect to the current state of the Issuer.
-                        type: integer
-                        format: int64
-                      reason:
-                        description: |-
-                          Reason is a brief machine readable explanation for the condition's last
-                          transition.
-                        type: string
-                      status:
-                        description: Status of the condition, one of (`True`, `False`, `Unknown`).
-                        type: string
-                        enum:
-                          - "True"
-                          - "False"
-                          - Unknown
-                      type:
-                        description: Type of the condition, known values are (`Ready`).
-                        type: string
-                  x-kubernetes-list-map-keys:
-                    - type
-                  x-kubernetes-list-type: map
-      served: true
-      storage: true
-
-# END crd {{- end }}
-
----
-# START crd {{- if or .Values.crds.enabled .Values.installCRDs }}
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: issuers.cert-manager.io
-  # START annotations {{- if .Values.crds.keep }}
-  annotations:
-    helm.sh/resource-policy: keep
-  # END annotations {{- end }}
-  labels:
-    app: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/instance: '{{ .Release.Name }}'
-    app.kubernetes.io/component: "crds"
-    # Generated labels {{- include "labels" . | nindent 4 }}
-spec:
-  group: cert-manager.io
-  names:
-    kind: Issuer
-    listKind: IssuerList
-    plural: issuers
-    singular: issuer
-    categories:
-      - cert-manager
-  scope: Namespaced
-  versions:
-    - name: v1
-      subresources:
-        status: {}
-      additionalPrinterColumns:
-        - jsonPath: .status.conditions[?(@.type=="Ready")].status
-          name: Ready
-          type: string
-        - jsonPath: .status.conditions[?(@.type=="Ready")].message
-          name: Status
-          priority: 1
-          type: string
-        - jsonPath: .metadata.creationTimestamp
-          description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
-          name: Age
-          type: date
-      schema:
-        openAPIV3Schema:
-          description: |-
-            An Issuer represents a certificate issuing authority which can be
-            referenced as part of `issuerRef` fields.
-            It is scoped to a single namespace and can therefore only be referenced by
-            resources within the same namespace.
-          type: object
-          required:
-            - spec
-          properties:
-            apiVersion:
-              description: |-
-                APIVersion defines the versioned schema of this representation of an object.
-                Servers should convert recognized schemas to the latest internal value, and
-                may reject unrecognized values.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-              type: string
-            kind:
-              description: |-
-                Kind is a string value representing the REST resource this object represents.
-                Servers may infer this from the endpoint the client submits requests to.
-                Cannot be updated.
-                In CamelCase.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: Desired state of the Issuer resource.
-              type: object
-              properties:
-                acme:
-                  description: |-
-                    ACME configures this issuer to communicate with a RFC8555 (ACME) server
-                    to obtain signed x509 certificates.
-                  type: object
-                  required:
-                    - privateKeySecretRef
-                    - server
-                  properties:
-                    caBundle:
-                      description: |-
-                        Base64-encoded bundle of PEM CAs which can be used to validate the certificate
-                        chain presented by the ACME server.
-                        Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various
-                        kinds of security vulnerabilities.
-                        If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
-                        the container is used to validate the TLS connection.
-                      type: string
-                      format: byte
-                    disableAccountKeyGeneration:
-                      description: |-
-                        Enables or disables generating a new ACME account key.
-                        If true, the Issuer resource will *not* request a new account but will expect
-                        the account key to be supplied via an existing secret.
-                        If false, the cert-manager system will generate a new ACME account key
-                        for the Issuer.
-                        Defaults to false.
-                      type: boolean
-                    email:
-                      description: |-
-                        Email is the email address to be associated with the ACME account.
-                        This field is optional, but it is strongly recommended to be set.
-                        It will be used to contact you in case of issues with your account or
-                        certificates, including expiry notification emails.
-                        This field may be updated after the account is initially registered.
-                      type: string
-                    enableDurationFeature:
-                      description: |-
-                        Enables requesting a Not After date on certificates that matches the
-                        duration of the certificate. This is not supported by all ACME servers
-                        like Let's Encrypt. If set to true when the ACME server does not support
-                        it, it will create an error on the Order.
-                        Defaults to false.
-                      type: boolean
-                    externalAccountBinding:
-                      description: |-
-                        ExternalAccountBinding is a reference to a CA external account of the ACME
-                        server.
-                        If set, upon registration cert-manager will attempt to associate the given
-                        external account credentials with the registered ACME account.
-                      type: object
-                      required:
-                        - keyID
-                        - keySecretRef
-                      properties:
-                        keyAlgorithm:
-                          description: |-
-                            Deprecated: keyAlgorithm field exists for historical compatibility
-                            reasons and should not be used. The algorithm is now hardcoded to HS256
-                            in golang/x/crypto/acme.
-                          type: string
-                          enum:
-                            - HS256
-                            - HS384
-                            - HS512
-                        keyID:
-                          description: keyID is the ID of the CA key that the External Account is bound to.
-                          type: string
-                        keySecretRef:
-                          description: |-
-                            keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes
-                            Secret which holds the symmetric MAC key of the External Account Binding.
-                            The `key` is the index string that is paired with the key data in the
-                            Secret and should not be confused with the key data itself, or indeed with
-                            the External Account Binding keyID above.
-                            The secret key stored in the Secret **must** be un-padded, base64 URL
-                            encoded data.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                    preferredChain:
-                      description: |-
-                        PreferredChain is the chain to use if the ACME server outputs multiple.
-                        PreferredChain is no guarantee that this one gets delivered by the ACME
-                        endpoint.
-                        For example, for Let's Encrypt's DST crosssign you would use:
-                        "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
-                        This value picks the first certificate bundle in the combined set of
-                        ACME default and alternative chains that has a root-most certificate with
-                        this value as its issuer's commonname.
-                      type: string
-                      maxLength: 64
-                    privateKeySecretRef:
-                      description: |-
-                        PrivateKey is the name of a Kubernetes Secret resource that will be used to
-                        store the automatically generated ACME account private key.
-                        Optionally, a `key` may be specified to select a specific entry within
-                        the named Secret resource.
-                        If `key` is not specified, a default of `tls.key` will be used.
-                      type: object
-                      required:
-                        - name
-                      properties:
-                        key:
-                          description: |-
-                            The key of the entry in the Secret resource's `data` field to be used.
-                            Some instances of this field may be defaulted, in others it may be
-                            required.
-                          type: string
-                        name:
-                          description: |-
-                            Name of the resource being referred to.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                    server:
-                      description: |-
-                        Server is the URL used to access the ACME server's 'directory' endpoint.
-                        For example, for Let's Encrypt's staging endpoint, you would use:
-                        "https://acme-staging-v02.api.letsencrypt.org/directory".
-                        Only ACME v2 endpoints (i.e. RFC 8555) are supported.
-                      type: string
-                    skipTLSVerify:
-                      description: |-
-                        INSECURE: Enables or disables validation of the ACME server TLS certificate.
-                        If true, requests to the ACME server will not have the TLS certificate chain
-                        validated.
-                        Mutually exclusive with CABundle; prefer using CABundle to prevent various
-                        kinds of security vulnerabilities.
-                        Only enable this option in development environments.
-                        If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
-                        the container is used to validate the TLS connection.
-                        Defaults to false.
-                      type: boolean
-                    solvers:
-                      description: |-
-                        Solvers is a list of challenge solvers that will be used to solve
-                        ACME challenges for the matching domains.
-                        Solver configurations must be provided in order to obtain certificates
-                        from an ACME server.
-                        For more information, see: https://cert-manager.io/docs/configuration/acme/
-                      type: array
-                      items:
-                        description: |-
-                          An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of.
-                          A selector may be provided to use different solving strategies for different DNS names.
-                          Only one of HTTP01 or DNS01 must be provided.
-                        type: object
-                        properties:
-                          dns01:
-                            description: |-
-                              Configures cert-manager to attempt to complete authorizations by
-                              performing the DNS01 challenge flow.
-                            type: object
-                            properties:
-                              acmeDNS:
-                                description: |-
-                                  Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
-                                  DNS01 challenge records.
-                                type: object
-                                required:
-                                  - accountSecretRef
-                                  - host
-                                properties:
-                                  accountSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  host:
-                                    type: string
-                              akamai:
-                                description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - accessTokenSecretRef
-                                  - clientSecretSecretRef
-                                  - clientTokenSecretRef
-                                  - serviceConsumerDomain
-                                properties:
-                                  accessTokenSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  clientSecretSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  clientTokenSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  serviceConsumerDomain:
-                                    type: string
-                              azureDNS:
-                                description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - resourceGroupName
-                                  - subscriptionID
-                                properties:
-                                  clientID:
-                                    description: |-
-                                      Auth: Azure Service Principal:
-                                      The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
-                                      If set, ClientSecret and TenantID must also be set.
-                                    type: string
-                                  clientSecretSecretRef:
-                                    description: |-
-                                      Auth: Azure Service Principal:
-                                      A reference to a Secret containing the password associated with the Service Principal.
-                                      If set, ClientID and TenantID must also be set.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  environment:
-                                    description: name of the Azure environment (default AzurePublicCloud)
-                                    type: string
-                                    enum:
-                                      - AzurePublicCloud
-                                      - AzureChinaCloud
-                                      - AzureGermanCloud
-                                      - AzureUSGovernmentCloud
-                                  hostedZoneName:
-                                    description: name of the DNS zone that should be used
-                                    type: string
-                                  managedIdentity:
-                                    description: |-
-                                      Auth: Azure Workload Identity or Azure Managed Service Identity:
-                                      Settings to enable Azure Workload Identity or Azure Managed Service Identity
-                                      If set, ClientID, ClientSecret and TenantID must not be set.
-                                    type: object
-                                    properties:
-                                      clientID:
-                                        description: client ID of the managed identity, can not be used at the same time as resourceID
-                                        type: string
-                                      resourceID:
-                                        description: |-
-                                          resource ID of the managed identity, can not be used at the same time as clientID
-                                          Cannot be used for Azure Managed Service Identity
-                                        type: string
-                                      tenantID:
-                                        description: tenant ID of the managed identity, can not be used at the same time as resourceID
-                                        type: string
-                                  resourceGroupName:
-                                    description: resource group the DNS zone is located in
-                                    type: string
-                                  subscriptionID:
-                                    description: ID of the Azure subscription
-                                    type: string
-                                  tenantID:
-                                    description: |-
-                                      Auth: Azure Service Principal:
-                                      The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
-                                      If set, ClientID and ClientSecret must also be set.
-                                    type: string
-                              cloudDNS:
-                                description: Use the Google Cloud DNS API to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - project
-                                properties:
-                                  hostedZoneName:
-                                    description: |-
-                                      HostedZoneName is an optional field that tells cert-manager in which
-                                      Cloud DNS zone the challenge record has to be created.
-                                      If left empty cert-manager will automatically choose a zone.
-                                    type: string
-                                  project:
-                                    type: string
-                                  serviceAccountSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                              cloudflare:
-                                description: Use the Cloudflare API to manage DNS01 challenge records.
-                                type: object
-                                properties:
-                                  apiKeySecretRef:
-                                    description: |-
-                                      API key to use to authenticate with Cloudflare.
-                                      Note: using an API token to authenticate is now the recommended method
-                                      as it allows greater control of permissions.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  apiTokenSecretRef:
-                                    description: API token used to authenticate with Cloudflare.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  email:
-                                    description: Email of the account, only required when using API key based authentication.
-                                    type: string
-                              cnameStrategy:
-                                description: |-
-                                  CNAMEStrategy configures how the DNS01 provider should handle CNAME
-                                  records when found in DNS zones.
-                                type: string
-                                enum:
-                                  - None
-                                  - Follow
-                              digitalocean:
-                                description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - tokenSecretRef
-                                properties:
-                                  tokenSecretRef:
-                                    description: |-
-                                      A reference to a specific 'key' within a Secret resource.
-                                      In some instances, `key` is a required field.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                              rfc2136:
-                                description: |-
-                                  Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
-                                  to manage DNS01 challenge records.
-                                type: object
-                                required:
-                                  - nameserver
-                                properties:
-                                  nameserver:
-                                    description: |-
-                                      The IP address or hostname of an authoritative DNS server supporting
-                                      RFC2136 in the form host:port. If the host is an IPv6 address it must be
-                                      enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
-                                      This field is required.
-                                    type: string
-                                  tsigAlgorithm:
-                                    description: |-
-                                      The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
-                                      when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
-                                      Supported values are (case-insensitive): ``HMACMD5`` (default),
-                                      ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
-                                    type: string
-                                  tsigKeyName:
-                                    description: |-
-                                      The TSIG Key name configured in the DNS.
-                                      If ``tsigSecretSecretRef`` is defined, this field is required.
-                                    type: string
-                                  tsigSecretSecretRef:
-                                    description: |-
-                                      The name of the secret containing the TSIG value.
-                                      If ``tsigKeyName`` is defined, this field is required.
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                              route53:
-                                description: Use the AWS Route53 API to manage DNS01 challenge records.
-                                type: object
-                                properties:
-                                  accessKeyID:
-                                    description: |-
-                                      The AccessKeyID is used for authentication.
-                                      Cannot be set when SecretAccessKeyID is set.
-                                      If neither the Access Key nor Key ID are set, we fall-back to using env
-                                      vars, shared credentials file or AWS Instance metadata,
-                                      see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
-                                    type: string
-                                  accessKeyIDSecretRef:
-                                    description: |-
-                                      The SecretAccessKey is used for authentication. If set, pull the AWS
-                                      access key ID from a key within a Kubernetes Secret.
-                                      Cannot be set when AccessKeyID is set.
-                                      If neither the Access Key nor Key ID are set, we fall-back to using env
-                                      vars, shared credentials file or AWS Instance metadata,
-                                      see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                  auth:
-                                    description: Auth configures how cert-manager authenticates.
-                                    type: object
-                                    required:
-                                      - kubernetes
-                                    properties:
-                                      kubernetes:
-                                        description: |-
-                                          Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
-                                          by passing a bound ServiceAccount token.
-                                        type: object
-                                        required:
-                                          - serviceAccountRef
-                                        properties:
-                                          serviceAccountRef:
-                                            description: |-
-                                              A reference to a service account that will be used to request a bound
-                                              token (also known as "projected token"). To use this field, you must
-                                              configure an RBAC rule to let cert-manager request a token.
-                                            type: object
-                                            required:
-                                              - name
-                                            properties:
-                                              audiences:
-                                                description: |-
-                                                  TokenAudiences is an optional list of audiences to include in the
-                                                  token passed to AWS. The default token consisting of the issuer's namespace
-                                                  and name is always included.
-                                                  If unset the audience defaults to `sts.amazonaws.com`.
-                                                type: array
-                                                items:
-                                                  type: string
-                                              name:
-                                                description: Name of the ServiceAccount used to request a token.
-                                                type: string
-                                  hostedZoneID:
-                                    description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.
-                                    type: string
-                                  region:
-                                    description: |-
-                                      Override the AWS region.
-
-                                      Route53 is a global service and does not have regional endpoints but the
-                                      region specified here (or via environment variables) is used as a hint to
-                                      help compute the correct AWS credential scope and partition when it
-                                      connects to Route53. See:
-                                      - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
-                                      - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)
-
-                                      If you omit this region field, cert-manager will use the region from
-                                      AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
-                                      in the cert-manager controller Pod.
-
-                                      The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
-                                      Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
-                                      [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
-                                      In this case this `region` field value is ignored.
-
-                                      The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
-                                      Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
-                                      [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
-                                      In this case this `region` field value is ignored.
-                                    type: string
-                                  role:
-                                    description: |-
-                                      Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
-                                      or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
-                                    type: string
-                                  secretAccessKeySecretRef:
-                                    description: |-
-                                      The SecretAccessKey is used for authentication.
-                                      If neither the Access Key nor Key ID are set, we fall-back to using env
-                                      vars, shared credentials file or AWS Instance metadata,
-                                      see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
-                                    type: object
-                                    required:
-                                      - name
-                                    properties:
-                                      key:
-                                        description: |-
-                                          The key of the entry in the Secret resource's `data` field to be used.
-                                          Some instances of this field may be defaulted, in others it may be
-                                          required.
-                                        type: string
-                                      name:
-                                        description: |-
-                                          Name of the resource being referred to.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                              webhook:
-                                description: |-
-                                  Configure an external webhook based DNS01 challenge solver to manage
-                                  DNS01 challenge records.
-                                type: object
-                                required:
-                                  - groupName
-                                  - solverName
-                                properties:
-                                  config:
-                                    description: |-
-                                      Additional configuration that should be passed to the webhook apiserver
-                                      when challenges are processed.
-                                      This can contain arbitrary JSON data.
-                                      Secret values should not be specified in this stanza.
-                                      If secret values are needed (e.g. credentials for a DNS service), you
-                                      should use a SecretKeySelector to reference a Secret resource.
-                                      For details on the schema of this field, consult the webhook provider
-                                      implementation's documentation.
-                                    x-kubernetes-preserve-unknown-fields: true
-                                  groupName:
-                                    description: |-
-                                      The API group name that should be used when POSTing ChallengePayload
-                                      resources to the webhook apiserver.
-                                      This should be the same as the GroupName specified in the webhook
-                                      provider implementation.
-                                    type: string
-                                  solverName:
-                                    description: |-
-                                      The name of the solver to use, as defined in the webhook provider
-                                      implementation.
-                                      This will typically be the name of the provider, e.g. 'cloudflare'.
-                                    type: string
-                          http01:
-                            description: |-
-                              Configures cert-manager to attempt to complete authorizations by
-                              performing the HTTP01 challenge flow.
-                              It is not possible to obtain certificates for wildcard domain names
-                              (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
-                            type: object
-                            properties:
-                              gatewayHTTPRoute:
-                                description: |-
-                                  The Gateway API is a sig-network community API that models service networking
-                                  in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
-                                  create HTTPRoutes with the specified labels in the same namespace as the challenge.
-                                  This solver is experimental, and fields / behaviour may change in the future.
-                                type: object
-                                properties:
-                                  labels:
-                                    description: |-
-                                      Custom labels that will be applied to HTTPRoutes created by cert-manager
-                                      while solving HTTP-01 challenges.
-                                    type: object
-                                    additionalProperties:
-                                      type: string
-                                  parentRefs:
-                                    description: |-
-                                      When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
-                                      cert-manager needs to know which parentRefs should be used when creating
-                                      the HTTPRoute. Usually, the parentRef references a Gateway. See:
-                                      https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
-                                    type: array
-                                    items:
-                                      description: |-
-                                        ParentReference identifies an API object (usually a Gateway) that can be considered
-                                        a parent of this resource (usually a route). There are two kinds of parent resources
-                                        with "Core" support:
-
-                                        * Gateway (Gateway conformance profile)
-                                        * Service (Mesh conformance profile, ClusterIP Services only)
-
-                                        This API may be extended in the future to support additional kinds of parent
-                                        resources.
-
-                                        The API object must be valid in the cluster; the Group and Kind must
-                                        be registered in the cluster for this reference to be valid.
-                                      type: object
-                                      required:
-                                        - name
-                                      properties:
-                                        group:
-                                          description: |-
-                                            Group is the group of the referent.
-                                            When unspecified, "gateway.networking.k8s.io" is inferred.
-                                            To set the core API group (such as for a "Service" kind referent),
-                                            Group must be explicitly set to "" (empty string).
-
-                                            Support: Core
-                                          type: string
-                                          default: gateway.networking.k8s.io
-                                          maxLength: 253
-                                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                        kind:
-                                          description: |-
-                                            Kind is kind of the referent.
-
-                                            There are two kinds of parent resources with "Core" support:
-
-                                            * Gateway (Gateway conformance profile)
-                                            * Service (Mesh conformance profile, ClusterIP Services only)
-
-                                            Support for other resources is Implementation-Specific.
-                                          type: string
-                                          default: Gateway
-                                          maxLength: 63
-                                          minLength: 1
-                                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                                        name:
-                                          description: |-
-                                            Name is the name of the referent.
-
-                                            Support: Core
-                                          type: string
-                                          maxLength: 253
-                                          minLength: 1
-                                        namespace:
-                                          description: |-
-                                            Namespace is the namespace of the referent. When unspecified, this refers
-                                            to the local namespace of the Route.
-
-                                            Note that there are specific rules for ParentRefs which cross namespace
-                                            boundaries. Cross-namespace references are only valid if they are explicitly
-                                            allowed by something in the namespace they are referring to. For example:
-                                            Gateway has the AllowedRoutes field, and ReferenceGrant provides a
-                                            generic way to enable any other kind of cross-namespace reference.
-
-                                            <gateway:experimental:description>
-                                            ParentRefs from a Route to a Service in the same namespace are "producer"
-                                            routes, which apply default routing rules to inbound connections from
-                                            any namespace to the Service.
-
-                                            ParentRefs from a Route to a Service in a different namespace are
-                                            "consumer" routes, and these routing rules are only applied to outbound
-                                            connections originating from the same namespace as the Route, for which
-                                            the intended destination of the connections are a Service targeted as a
-                                            ParentRef of the Route.
-                                            </gateway:experimental:description>
-
-                                            Support: Core
-                                          type: string
-                                          maxLength: 63
-                                          minLength: 1
-                                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                                        port:
-                                          description: |-
-                                            Port is the network port this Route targets. It can be interpreted
-                                            differently based on the type of parent resource.
-
-                                            When the parent resource is a Gateway, this targets all listeners
-                                            listening on the specified port that also support this kind of Route(and
-                                            select this Route). It's not recommended to set `Port` unless the
-                                            networking behaviors specified in a Route must apply to a specific port
-                                            as opposed to a listener(s) whose port(s) may be changed. When both Port
-                                            and SectionName are specified, the name and port of the selected listener
-                                            must match both specified values.
-
-                                            <gateway:experimental:description>
-                                            When the parent resource is a Service, this targets a specific port in the
-                                            Service spec. When both Port (experimental) and SectionName are specified,
-                                            the name and port of the selected port must match both specified values.
-                                            </gateway:experimental:description>
-
-                                            Implementations MAY choose to support other parent resources.
-                                            Implementations supporting other types of parent resources MUST clearly
-                                            document how/if Port is interpreted.
-
-                                            For the purpose of status, an attachment is considered successful as
-                                            long as the parent resource accepts it partially. For example, Gateway
-                                            listeners can restrict which Routes can attach to them by Route kind,
-                                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
-                                            from the referencing Route, the Route MUST be considered successfully
-                                            attached. If no Gateway listeners accept attachment from this Route,
-                                            the Route MUST be considered detached from the Gateway.
-
-                                            Support: Extended
-                                          type: integer
-                                          format: int32
-                                          maximum: 65535
-                                          minimum: 1
-                                        sectionName:
-                                          description: |-
-                                            SectionName is the name of a section within the target resource. In the
-                                            following resources, SectionName is interpreted as the following:
-
-                                            * Gateway: Listener name. When both Port (experimental) and SectionName
-                                            are specified, the name and port of the selected listener must match
-                                            both specified values.
-                                            * Service: Port name. When both Port (experimental) and SectionName
-                                            are specified, the name and port of the selected listener must match
-                                            both specified values.
-
-                                            Implementations MAY choose to support attaching Routes to other resources.
-                                            If that is the case, they MUST clearly document how SectionName is
-                                            interpreted.
-
-                                            When unspecified (empty string), this will reference the entire resource.
-                                            For the purpose of status, an attachment is considered successful if at
-                                            least one section in the parent resource accepts it. For example, Gateway
-                                            listeners can restrict which Routes can attach to them by Route kind,
-                                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
-                                            the referencing Route, the Route MUST be considered successfully
-                                            attached. If no Gateway listeners accept attachment from this Route, the
-                                            Route MUST be considered detached from the Gateway.
-
-                                            Support: Core
-                                          type: string
-                                          maxLength: 253
-                                          minLength: 1
-                                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                  podTemplate:
-                                    description: |-
-                                      Optional pod template used to configure the ACME challenge solver pods
-                                      used for HTTP01 challenges.
-                                    type: object
-                                    properties:
-                                      metadata:
-                                        description: |-
-                                          ObjectMeta overrides for the pod used to solve HTTP01 challenges.
-                                          Only the 'labels' and 'annotations' fields may be set.
-                                          If labels or annotations overlap with in-built values, the values here
-                                          will override the in-built values.
-                                        type: object
-                                        properties:
-                                          annotations:
-                                            description: Annotations that should be added to the created ACME HTTP01 solver pods.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          labels:
-                                            description: Labels that should be added to the created ACME HTTP01 solver pods.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                      spec:
-                                        description: |-
-                                          PodSpec defines overrides for the HTTP01 challenge solver pod.
-                                          Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
-                                          All other fields will be ignored.
-                                        type: object
-                                        properties:
-                                          affinity:
-                                            description: If specified, the pod's scheduling constraints
-                                            type: object
-                                            properties:
-                                              nodeAffinity:
-                                                description: Describes node affinity scheduling rules for the pod.
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node matches the corresponding matchExpressions; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        An empty preferred scheduling term matches all objects with implicit weight 0
-                                                        (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
-                                                      type: object
-                                                      required:
-                                                        - preference
-                                                        - weight
-                                                      properties:
-                                                        preference:
-                                                          description: A node selector term, associated with the corresponding weight.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: A list of node selector requirements by node's labels.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchFields:
-                                                              description: A list of node selector requirements by node's fields.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                          x-kubernetes-map-type: atomic
-                                                        weight:
-                                                          description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to an update), the system
-                                                      may or may not try to eventually evict the pod from its node.
-                                                    type: object
-                                                    required:
-                                                      - nodeSelectorTerms
-                                                    properties:
-                                                      nodeSelectorTerms:
-                                                        description: Required. A list of node selector terms. The terms are ORed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A null or empty node selector term matches no objects. The requirements of
-                                                            them are ANDed.
-                                                            The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: A list of node selector requirements by node's labels.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchFields:
-                                                              description: A list of node selector requirements by node's fields.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                          x-kubernetes-map-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                    x-kubernetes-map-type: atomic
-                                              podAffinity:
-                                                description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                      type: object
-                                                      required:
-                                                        - podAffinityTerm
-                                                        - weight
-                                                      properties:
-                                                        podAffinityTerm:
-                                                          description: Required. A pod affinity term, associated with the corresponding weight.
-                                                          type: object
-                                                          required:
-                                                            - topologyKey
-                                                          properties:
-                                                            labelSelector:
-                                                              description: |-
-                                                                A label query over a set of resources, in this case pods.
-                                                                If it's null, this PodAffinityTerm matches with no Pods.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            matchLabelKeys:
-                                                              description: |-
-                                                                MatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            mismatchLabelKeys:
-                                                              description: |-
-                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            namespaceSelector:
-                                                              description: |-
-                                                                A label query over the set of namespaces that the term applies to.
-                                                                The term is applied to the union of the namespaces selected by this field
-                                                                and the ones listed in the namespaces field.
-                                                                null selector and null or empty namespaces list means "this pod's namespace".
-                                                                An empty selector ({}) matches all namespaces.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            namespaces:
-                                                              description: |-
-                                                                namespaces specifies a static list of namespace names that the term applies to.
-                                                                The term is applied to the union of the namespaces listed in this field
-                                                                and the ones selected by namespaceSelector.
-                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            topologyKey:
-                                                              description: |-
-                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                                whose value of the label with key topologyKey matches that of any node on which any of the
-                                                                selected pods is running.
-                                                                Empty topologyKey is not allowed.
-                                                              type: string
-                                                        weight:
-                                                          description: |-
-                                                            weight associated with matching the corresponding podAffinityTerm,
-                                                            in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to a pod label update), the
-                                                      system may or may not try to eventually evict the pod from its node.
-                                                      When there are multiple elements, the lists of nodes corresponding to each
-                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        Defines a set of pods (namely those matching the labelSelector
-                                                        relative to the given namespace(s)) that this pod should be
-                                                        co-located (affinity) or not co-located (anti-affinity) with,
-                                                        where co-located is defined as running on a node whose value of
-                                                        the label with key <topologyKey> matches that of any node on which
-                                                        a pod of the set of pods is running
-                                                      type: object
-                                                      required:
-                                                        - topologyKey
-                                                      properties:
-                                                        labelSelector:
-                                                          description: |-
-                                                            A label query over a set of resources, in this case pods.
-                                                            If it's null, this PodAffinityTerm matches with no Pods.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        matchLabelKeys:
-                                                          description: |-
-                                                            MatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        mismatchLabelKeys:
-                                                          description: |-
-                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        namespaceSelector:
-                                                          description: |-
-                                                            A label query over the set of namespaces that the term applies to.
-                                                            The term is applied to the union of the namespaces selected by this field
-                                                            and the ones listed in the namespaces field.
-                                                            null selector and null or empty namespaces list means "this pod's namespace".
-                                                            An empty selector ({}) matches all namespaces.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        namespaces:
-                                                          description: |-
-                                                            namespaces specifies a static list of namespace names that the term applies to.
-                                                            The term is applied to the union of the namespaces listed in this field
-                                                            and the ones selected by namespaceSelector.
-                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        topologyKey:
-                                                          description: |-
-                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                            whose value of the label with key topologyKey matches that of any node on which any of the
-                                                            selected pods is running.
-                                                            Empty topologyKey is not allowed.
-                                                          type: string
-                                                    x-kubernetes-list-type: atomic
-                                              podAntiAffinity:
-                                                description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the anti-affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                      type: object
-                                                      required:
-                                                        - podAffinityTerm
-                                                        - weight
-                                                      properties:
-                                                        podAffinityTerm:
-                                                          description: Required. A pod affinity term, associated with the corresponding weight.
-                                                          type: object
-                                                          required:
-                                                            - topologyKey
-                                                          properties:
-                                                            labelSelector:
-                                                              description: |-
-                                                                A label query over a set of resources, in this case pods.
-                                                                If it's null, this PodAffinityTerm matches with no Pods.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            matchLabelKeys:
-                                                              description: |-
-                                                                MatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            mismatchLabelKeys:
-                                                              description: |-
-                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            namespaceSelector:
-                                                              description: |-
-                                                                A label query over the set of namespaces that the term applies to.
-                                                                The term is applied to the union of the namespaces selected by this field
-                                                                and the ones listed in the namespaces field.
-                                                                null selector and null or empty namespaces list means "this pod's namespace".
-                                                                An empty selector ({}) matches all namespaces.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            namespaces:
-                                                              description: |-
-                                                                namespaces specifies a static list of namespace names that the term applies to.
-                                                                The term is applied to the union of the namespaces listed in this field
-                                                                and the ones selected by namespaceSelector.
-                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            topologyKey:
-                                                              description: |-
-                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                                whose value of the label with key topologyKey matches that of any node on which any of the
-                                                                selected pods is running.
-                                                                Empty topologyKey is not allowed.
-                                                              type: string
-                                                        weight:
-                                                          description: |-
-                                                            weight associated with matching the corresponding podAffinityTerm,
-                                                            in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the anti-affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the anti-affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to a pod label update), the
-                                                      system may or may not try to eventually evict the pod from its node.
-                                                      When there are multiple elements, the lists of nodes corresponding to each
-                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        Defines a set of pods (namely those matching the labelSelector
-                                                        relative to the given namespace(s)) that this pod should be
-                                                        co-located (affinity) or not co-located (anti-affinity) with,
-                                                        where co-located is defined as running on a node whose value of
-                                                        the label with key <topologyKey> matches that of any node on which
-                                                        a pod of the set of pods is running
-                                                      type: object
-                                                      required:
-                                                        - topologyKey
-                                                      properties:
-                                                        labelSelector:
-                                                          description: |-
-                                                            A label query over a set of resources, in this case pods.
-                                                            If it's null, this PodAffinityTerm matches with no Pods.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        matchLabelKeys:
-                                                          description: |-
-                                                            MatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        mismatchLabelKeys:
-                                                          description: |-
-                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        namespaceSelector:
-                                                          description: |-
-                                                            A label query over the set of namespaces that the term applies to.
-                                                            The term is applied to the union of the namespaces selected by this field
-                                                            and the ones listed in the namespaces field.
-                                                            null selector and null or empty namespaces list means "this pod's namespace".
-                                                            An empty selector ({}) matches all namespaces.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        namespaces:
-                                                          description: |-
-                                                            namespaces specifies a static list of namespace names that the term applies to.
-                                                            The term is applied to the union of the namespaces listed in this field
-                                                            and the ones selected by namespaceSelector.
-                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        topologyKey:
-                                                          description: |-
-                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                            whose value of the label with key topologyKey matches that of any node on which any of the
-                                                            selected pods is running.
-                                                            Empty topologyKey is not allowed.
-                                                          type: string
-                                                    x-kubernetes-list-type: atomic
-                                          imagePullSecrets:
-                                            description: If specified, the pod's imagePullSecrets
-                                            type: array
-                                            items:
-                                              description: |-
-                                                LocalObjectReference contains enough information to let you locate the
-                                                referenced object inside the same namespace.
-                                              type: object
-                                              properties:
-                                                name:
-                                                  description: |-
-                                                    Name of the referent.
-                                                    This field is effectively required, but due to backwards compatibility is
-                                                    allowed to be empty. Instances of this type with an empty value here are
-                                                    almost certainly wrong.
-                                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                                  type: string
-                                                  default: ""
-                                              x-kubernetes-map-type: atomic
-                                          nodeSelector:
-                                            description: |-
-                                              NodeSelector is a selector which must be true for the pod to fit on a node.
-                                              Selector which must match a node's labels for the pod to be scheduled on that node.
-                                              More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          priorityClassName:
-                                            description: If specified, the pod's priorityClassName.
-                                            type: string
-                                          securityContext:
-                                            description: If specified, the pod's security context
-                                            type: object
-                                            properties:
-                                              fsGroup:
-                                                description: |-
-                                                  A special supplemental group that applies to all containers in a pod.
-                                                  Some volume types allow the Kubelet to change the ownership of that volume
-                                                  to be owned by the pod:
-
-                                                  1. The owning GID will be the FSGroup
-                                                  2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
-                                                  3. The permission bits are OR'd with rw-rw----
-
-                                                  If unset, the Kubelet will not modify the ownership and permissions of any volume.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              fsGroupChangePolicy:
-                                                description: |-
-                                                  fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
-                                                  before being exposed inside Pod. This field will only apply to
-                                                  volume types which support fsGroup based ownership(and permissions).
-                                                  It will have no effect on ephemeral volume types such as: secret, configmaps
-                                                  and emptydir.
-                                                  Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: string
-                                              runAsGroup:
-                                                description: |-
-                                                  The GID to run the entrypoint of the container process.
-                                                  Uses runtime default if unset.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
-                                                  for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              runAsNonRoot:
-                                                description: |-
-                                                  Indicates that the container must run as a non-root user.
-                                                  If true, the Kubelet will validate the image at runtime to ensure that it
-                                                  does not run as UID 0 (root) and fail to start the container if it does.
-                                                  If unset or false, no such validation will be performed.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
-                                                type: boolean
-                                              runAsUser:
-                                                description: |-
-                                                  The UID to run the entrypoint of the container process.
-                                                  Defaults to user specified in image metadata if unspecified.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
-                                                  for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              seLinuxOptions:
-                                                description: |-
-                                                  The SELinux context to be applied to all containers.
-                                                  If unspecified, the container runtime will allocate a random SELinux context for each
-                                                  container.  May also be set in SecurityContext.  If set in
-                                                  both SecurityContext and PodSecurityContext, the value specified in SecurityContext
-                                                  takes precedence for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: object
-                                                properties:
-                                                  level:
-                                                    description: Level is SELinux level label that applies to the container.
-                                                    type: string
-                                                  role:
-                                                    description: Role is a SELinux role label that applies to the container.
-                                                    type: string
-                                                  type:
-                                                    description: Type is a SELinux type label that applies to the container.
-                                                    type: string
-                                                  user:
-                                                    description: User is a SELinux user label that applies to the container.
-                                                    type: string
-                                              seccompProfile:
-                                                description: |-
-                                                  The seccomp options to use by the containers in this pod.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: object
-                                                required:
-                                                  - type
-                                                properties:
-                                                  localhostProfile:
-                                                    description: |-
-                                                      localhostProfile indicates a profile defined in a file on the node should be used.
-                                                      The profile must be preconfigured on the node to work.
-                                                      Must be a descending path, relative to the kubelet's configured seccomp profile location.
-                                                      Must be set if type is "Localhost". Must NOT be set for any other type.
-                                                    type: string
-                                                  type:
-                                                    description: |-
-                                                      type indicates which kind of seccomp profile will be applied.
-                                                      Valid options are:
-
-                                                      Localhost - a profile defined in a file on the node should be used.
-                                                      RuntimeDefault - the container runtime default profile should be used.
-                                                      Unconfined - no profile should be applied.
-                                                    type: string
-                                              supplementalGroups:
-                                                description: |-
-                                                  A list of groups applied to the first process run in each container, in addition
-                                                  to the container's primary GID, the fsGroup (if specified), and group memberships
-                                                  defined in the container image for the uid of the container process. If unspecified,
-                                                  no additional groups are added to any container. Note that group memberships
-                                                  defined in the container image for the uid of the container process are still effective,
-                                                  even if they are not included in this list.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: array
-                                                items:
-                                                  type: integer
-                                                  format: int64
-                                              sysctls:
-                                                description: |-
-                                                  Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
-                                                  sysctls (by the container runtime) might fail to launch.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: array
-                                                items:
-                                                  description: Sysctl defines a kernel parameter to be set
-                                                  type: object
-                                                  required:
-                                                    - name
-                                                    - value
-                                                  properties:
-                                                    name:
-                                                      description: Name of a property to set
-                                                      type: string
-                                                    value:
-                                                      description: Value of a property to set
-                                                      type: string
-                                          serviceAccountName:
-                                            description: If specified, the pod's service account
-                                            type: string
-                                          tolerations:
-                                            description: If specified, the pod's tolerations.
-                                            type: array
-                                            items:
-                                              description: |-
-                                                The pod this Toleration is attached to tolerates any taint that matches
-                                                the triple <key,value,effect> using the matching operator <operator>.
-                                              type: object
-                                              properties:
-                                                effect:
-                                                  description: |-
-                                                    Effect indicates the taint effect to match. Empty means match all taint effects.
-                                                    When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                                                  type: string
-                                                key:
-                                                  description: |-
-                                                    Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                                                    If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                                                  type: string
-                                                operator:
-                                                  description: |-
-                                                    Operator represents a key's relationship to the value.
-                                                    Valid operators are Exists and Equal. Defaults to Equal.
-                                                    Exists is equivalent to wildcard for value, so that a pod can
-                                                    tolerate all taints of a particular category.
-                                                  type: string
-                                                tolerationSeconds:
-                                                  description: |-
-                                                    TolerationSeconds represents the period of time the toleration (which must be
-                                                    of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                                                    it is not set, which means tolerate the taint forever (do not evict). Zero and
-                                                    negative values will be treated as 0 (evict immediately) by the system.
-                                                  type: integer
-                                                  format: int64
-                                                value:
-                                                  description: |-
-                                                    Value is the taint value the toleration matches to.
-                                                    If the operator is Exists, the value should be empty, otherwise just a regular string.
-                                                  type: string
-                                  serviceType:
-                                    description: |-
-                                      Optional service type for Kubernetes solver service. Supported values
-                                      are NodePort or ClusterIP. If unset, defaults to NodePort.
-                                    type: string
-                              ingress:
-                                description: |-
-                                  The ingress based HTTP01 challenge solver will solve challenges by
-                                  creating or modifying Ingress resources in order to route requests for
-                                  '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
-                                  provisioned by cert-manager for each Challenge to be completed.
-                                type: object
-                                properties:
-                                  class:
-                                    description: |-
-                                      This field configures the annotation `kubernetes.io/ingress.class` when
-                                      creating Ingress resources to solve ACME challenges that use this
-                                      challenge solver. Only one of `class`, `name` or `ingressClassName` may
-                                      be specified.
-                                    type: string
-                                  ingressClassName:
-                                    description: |-
-                                      This field configures the field `ingressClassName` on the created Ingress
-                                      resources used to solve ACME challenges that use this challenge solver.
-                                      This is the recommended way of configuring the ingress class. Only one of
-                                      `class`, `name` or `ingressClassName` may be specified.
-                                    type: string
-                                  ingressTemplate:
-                                    description: |-
-                                      Optional ingress template used to configure the ACME challenge solver
-                                      ingress used for HTTP01 challenges.
-                                    type: object
-                                    properties:
-                                      metadata:
-                                        description: |-
-                                          ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
-                                          Only the 'labels' and 'annotations' fields may be set.
-                                          If labels or annotations overlap with in-built values, the values here
-                                          will override the in-built values.
-                                        type: object
-                                        properties:
-                                          annotations:
-                                            description: Annotations that should be added to the created ACME HTTP01 solver ingress.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          labels:
-                                            description: Labels that should be added to the created ACME HTTP01 solver ingress.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                  name:
-                                    description: |-
-                                      The name of the ingress resource that should have ACME challenge solving
-                                      routes inserted into it in order to solve HTTP01 challenges.
-                                      This is typically used in conjunction with ingress controllers like
-                                      ingress-gce, which maintains a 1:1 mapping between external IPs and
-                                      ingress resources. Only one of `class`, `name` or `ingressClassName` may
-                                      be specified.
-                                    type: string
-                                  podTemplate:
-                                    description: |-
-                                      Optional pod template used to configure the ACME challenge solver pods
-                                      used for HTTP01 challenges.
-                                    type: object
-                                    properties:
-                                      metadata:
-                                        description: |-
-                                          ObjectMeta overrides for the pod used to solve HTTP01 challenges.
-                                          Only the 'labels' and 'annotations' fields may be set.
-                                          If labels or annotations overlap with in-built values, the values here
-                                          will override the in-built values.
-                                        type: object
-                                        properties:
-                                          annotations:
-                                            description: Annotations that should be added to the created ACME HTTP01 solver pods.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          labels:
-                                            description: Labels that should be added to the created ACME HTTP01 solver pods.
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                      spec:
-                                        description: |-
-                                          PodSpec defines overrides for the HTTP01 challenge solver pod.
-                                          Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
-                                          All other fields will be ignored.
-                                        type: object
-                                        properties:
-                                          affinity:
-                                            description: If specified, the pod's scheduling constraints
-                                            type: object
-                                            properties:
-                                              nodeAffinity:
-                                                description: Describes node affinity scheduling rules for the pod.
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node matches the corresponding matchExpressions; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        An empty preferred scheduling term matches all objects with implicit weight 0
-                                                        (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
-                                                      type: object
-                                                      required:
-                                                        - preference
-                                                        - weight
-                                                      properties:
-                                                        preference:
-                                                          description: A node selector term, associated with the corresponding weight.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: A list of node selector requirements by node's labels.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchFields:
-                                                              description: A list of node selector requirements by node's fields.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                          x-kubernetes-map-type: atomic
-                                                        weight:
-                                                          description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to an update), the system
-                                                      may or may not try to eventually evict the pod from its node.
-                                                    type: object
-                                                    required:
-                                                      - nodeSelectorTerms
-                                                    properties:
-                                                      nodeSelectorTerms:
-                                                        description: Required. A list of node selector terms. The terms are ORed.
-                                                        type: array
-                                                        items:
-                                                          description: |-
-                                                            A null or empty node selector term matches no objects. The requirements of
-                                                            them are ANDed.
-                                                            The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: A list of node selector requirements by node's labels.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchFields:
-                                                              description: A list of node selector requirements by node's fields.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A node selector requirement is a selector that contains values, a key, and an operator
-                                                                  that relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: The label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      Represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      An array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. If the operator is Gt or Lt, the values
-                                                                      array must have a single element, which will be interpreted as an integer.
-                                                                      This array is replaced during a strategic merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                          x-kubernetes-map-type: atomic
-                                                        x-kubernetes-list-type: atomic
-                                                    x-kubernetes-map-type: atomic
-                                              podAffinity:
-                                                description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                      type: object
-                                                      required:
-                                                        - podAffinityTerm
-                                                        - weight
-                                                      properties:
-                                                        podAffinityTerm:
-                                                          description: Required. A pod affinity term, associated with the corresponding weight.
-                                                          type: object
-                                                          required:
-                                                            - topologyKey
-                                                          properties:
-                                                            labelSelector:
-                                                              description: |-
-                                                                A label query over a set of resources, in this case pods.
-                                                                If it's null, this PodAffinityTerm matches with no Pods.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            matchLabelKeys:
-                                                              description: |-
-                                                                MatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            mismatchLabelKeys:
-                                                              description: |-
-                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            namespaceSelector:
-                                                              description: |-
-                                                                A label query over the set of namespaces that the term applies to.
-                                                                The term is applied to the union of the namespaces selected by this field
-                                                                and the ones listed in the namespaces field.
-                                                                null selector and null or empty namespaces list means "this pod's namespace".
-                                                                An empty selector ({}) matches all namespaces.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            namespaces:
-                                                              description: |-
-                                                                namespaces specifies a static list of namespace names that the term applies to.
-                                                                The term is applied to the union of the namespaces listed in this field
-                                                                and the ones selected by namespaceSelector.
-                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            topologyKey:
-                                                              description: |-
-                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                                whose value of the label with key topologyKey matches that of any node on which any of the
-                                                                selected pods is running.
-                                                                Empty topologyKey is not allowed.
-                                                              type: string
-                                                        weight:
-                                                          description: |-
-                                                            weight associated with matching the corresponding podAffinityTerm,
-                                                            in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to a pod label update), the
-                                                      system may or may not try to eventually evict the pod from its node.
-                                                      When there are multiple elements, the lists of nodes corresponding to each
-                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        Defines a set of pods (namely those matching the labelSelector
-                                                        relative to the given namespace(s)) that this pod should be
-                                                        co-located (affinity) or not co-located (anti-affinity) with,
-                                                        where co-located is defined as running on a node whose value of
-                                                        the label with key <topologyKey> matches that of any node on which
-                                                        a pod of the set of pods is running
-                                                      type: object
-                                                      required:
-                                                        - topologyKey
-                                                      properties:
-                                                        labelSelector:
-                                                          description: |-
-                                                            A label query over a set of resources, in this case pods.
-                                                            If it's null, this PodAffinityTerm matches with no Pods.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        matchLabelKeys:
-                                                          description: |-
-                                                            MatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        mismatchLabelKeys:
-                                                          description: |-
-                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        namespaceSelector:
-                                                          description: |-
-                                                            A label query over the set of namespaces that the term applies to.
-                                                            The term is applied to the union of the namespaces selected by this field
-                                                            and the ones listed in the namespaces field.
-                                                            null selector and null or empty namespaces list means "this pod's namespace".
-                                                            An empty selector ({}) matches all namespaces.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        namespaces:
-                                                          description: |-
-                                                            namespaces specifies a static list of namespace names that the term applies to.
-                                                            The term is applied to the union of the namespaces listed in this field
-                                                            and the ones selected by namespaceSelector.
-                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        topologyKey:
-                                                          description: |-
-                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                            whose value of the label with key topologyKey matches that of any node on which any of the
-                                                            selected pods is running.
-                                                            Empty topologyKey is not allowed.
-                                                          type: string
-                                                    x-kubernetes-list-type: atomic
-                                              podAntiAffinity:
-                                                description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
-                                                type: object
-                                                properties:
-                                                  preferredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      The scheduler will prefer to schedule pods to nodes that satisfy
-                                                      the anti-affinity expressions specified by this field, but it may choose
-                                                      a node that violates one or more of the expressions. The node that is
-                                                      most preferred is the one with the greatest sum of weights, i.e.
-                                                      for each node that meets all of the scheduling requirements (resource
-                                                      request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                                      compute a sum by iterating through the elements of this field and adding
-                                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                                                      node(s) with the highest sum are the most preferred.
-                                                    type: array
-                                                    items:
-                                                      description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-                                                      type: object
-                                                      required:
-                                                        - podAffinityTerm
-                                                        - weight
-                                                      properties:
-                                                        podAffinityTerm:
-                                                          description: Required. A pod affinity term, associated with the corresponding weight.
-                                                          type: object
-                                                          required:
-                                                            - topologyKey
-                                                          properties:
-                                                            labelSelector:
-                                                              description: |-
-                                                                A label query over a set of resources, in this case pods.
-                                                                If it's null, this PodAffinityTerm matches with no Pods.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            matchLabelKeys:
-                                                              description: |-
-                                                                MatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            mismatchLabelKeys:
-                                                              description: |-
-                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                                be taken into consideration. The keys are used to lookup values from the
-                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                                to select the group of existing pods which pods will be taken into consideration
-                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                                pod labels will be ignored. The default value is empty.
-                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            namespaceSelector:
-                                                              description: |-
-                                                                A label query over the set of namespaces that the term applies to.
-                                                                The term is applied to the union of the namespaces selected by this field
-                                                                and the ones listed in the namespaces field.
-                                                                null selector and null or empty namespaces list means "this pod's namespace".
-                                                                An empty selector ({}) matches all namespaces.
-                                                              type: object
-                                                              properties:
-                                                                matchExpressions:
-                                                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                                  type: array
-                                                                  items:
-                                                                    description: |-
-                                                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                      relates the key and values.
-                                                                    type: object
-                                                                    required:
-                                                                      - key
-                                                                      - operator
-                                                                    properties:
-                                                                      key:
-                                                                        description: key is the label key that the selector applies to.
-                                                                        type: string
-                                                                      operator:
-                                                                        description: |-
-                                                                          operator represents a key's relationship to a set of values.
-                                                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                        type: string
-                                                                      values:
-                                                                        description: |-
-                                                                          values is an array of string values. If the operator is In or NotIn,
-                                                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                          the values array must be empty. This array is replaced during a strategic
-                                                                          merge patch.
-                                                                        type: array
-                                                                        items:
-                                                                          type: string
-                                                                        x-kubernetes-list-type: atomic
-                                                                  x-kubernetes-list-type: atomic
-                                                                matchLabels:
-                                                                  description: |-
-                                                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                                  type: object
-                                                                  additionalProperties:
-                                                                    type: string
-                                                              x-kubernetes-map-type: atomic
-                                                            namespaces:
-                                                              description: |-
-                                                                namespaces specifies a static list of namespace names that the term applies to.
-                                                                The term is applied to the union of the namespaces listed in this field
-                                                                and the ones selected by namespaceSelector.
-                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                              type: array
-                                                              items:
-                                                                type: string
-                                                              x-kubernetes-list-type: atomic
-                                                            topologyKey:
-                                                              description: |-
-                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                                whose value of the label with key topologyKey matches that of any node on which any of the
-                                                                selected pods is running.
-                                                                Empty topologyKey is not allowed.
-                                                              type: string
-                                                        weight:
-                                                          description: |-
-                                                            weight associated with matching the corresponding podAffinityTerm,
-                                                            in the range 1-100.
-                                                          type: integer
-                                                          format: int32
-                                                    x-kubernetes-list-type: atomic
-                                                  requiredDuringSchedulingIgnoredDuringExecution:
-                                                    description: |-
-                                                      If the anti-affinity requirements specified by this field are not met at
-                                                      scheduling time, the pod will not be scheduled onto the node.
-                                                      If the anti-affinity requirements specified by this field cease to be met
-                                                      at some point during pod execution (e.g. due to a pod label update), the
-                                                      system may or may not try to eventually evict the pod from its node.
-                                                      When there are multiple elements, the lists of nodes corresponding to each
-                                                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                                                    type: array
-                                                    items:
-                                                      description: |-
-                                                        Defines a set of pods (namely those matching the labelSelector
-                                                        relative to the given namespace(s)) that this pod should be
-                                                        co-located (affinity) or not co-located (anti-affinity) with,
-                                                        where co-located is defined as running on a node whose value of
-                                                        the label with key <topologyKey> matches that of any node on which
-                                                        a pod of the set of pods is running
-                                                      type: object
-                                                      required:
-                                                        - topologyKey
-                                                      properties:
-                                                        labelSelector:
-                                                          description: |-
-                                                            A label query over a set of resources, in this case pods.
-                                                            If it's null, this PodAffinityTerm matches with no Pods.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        matchLabelKeys:
-                                                          description: |-
-                                                            MatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        mismatchLabelKeys:
-                                                          description: |-
-                                                            MismatchLabelKeys is a set of pod label keys to select which pods will
-                                                            be taken into consideration. The keys are used to lookup values from the
-                                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                                            to select the group of existing pods which pods will be taken into consideration
-                                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                                            pod labels will be ignored. The default value is empty.
-                                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        namespaceSelector:
-                                                          description: |-
-                                                            A label query over the set of namespaces that the term applies to.
-                                                            The term is applied to the union of the namespaces selected by this field
-                                                            and the ones listed in the namespaces field.
-                                                            null selector and null or empty namespaces list means "this pod's namespace".
-                                                            An empty selector ({}) matches all namespaces.
-                                                          type: object
-                                                          properties:
-                                                            matchExpressions:
-                                                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                                              type: array
-                                                              items:
-                                                                description: |-
-                                                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                                                  relates the key and values.
-                                                                type: object
-                                                                required:
-                                                                  - key
-                                                                  - operator
-                                                                properties:
-                                                                  key:
-                                                                    description: key is the label key that the selector applies to.
-                                                                    type: string
-                                                                  operator:
-                                                                    description: |-
-                                                                      operator represents a key's relationship to a set of values.
-                                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                                    type: string
-                                                                  values:
-                                                                    description: |-
-                                                                      values is an array of string values. If the operator is In or NotIn,
-                                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                                      the values array must be empty. This array is replaced during a strategic
-                                                                      merge patch.
-                                                                    type: array
-                                                                    items:
-                                                                      type: string
-                                                                    x-kubernetes-list-type: atomic
-                                                              x-kubernetes-list-type: atomic
-                                                            matchLabels:
-                                                              description: |-
-                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                                              type: object
-                                                              additionalProperties:
-                                                                type: string
-                                                          x-kubernetes-map-type: atomic
-                                                        namespaces:
-                                                          description: |-
-                                                            namespaces specifies a static list of namespace names that the term applies to.
-                                                            The term is applied to the union of the namespaces listed in this field
-                                                            and the ones selected by namespaceSelector.
-                                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                                          type: array
-                                                          items:
-                                                            type: string
-                                                          x-kubernetes-list-type: atomic
-                                                        topologyKey:
-                                                          description: |-
-                                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                                            whose value of the label with key topologyKey matches that of any node on which any of the
-                                                            selected pods is running.
-                                                            Empty topologyKey is not allowed.
-                                                          type: string
-                                                    x-kubernetes-list-type: atomic
-                                          imagePullSecrets:
-                                            description: If specified, the pod's imagePullSecrets
-                                            type: array
-                                            items:
-                                              description: |-
-                                                LocalObjectReference contains enough information to let you locate the
-                                                referenced object inside the same namespace.
-                                              type: object
-                                              properties:
-                                                name:
-                                                  description: |-
-                                                    Name of the referent.
-                                                    This field is effectively required, but due to backwards compatibility is
-                                                    allowed to be empty. Instances of this type with an empty value here are
-                                                    almost certainly wrong.
-                                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                                  type: string
-                                                  default: ""
-                                              x-kubernetes-map-type: atomic
-                                          nodeSelector:
-                                            description: |-
-                                              NodeSelector is a selector which must be true for the pod to fit on a node.
-                                              Selector which must match a node's labels for the pod to be scheduled on that node.
-                                              More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
-                                            type: object
-                                            additionalProperties:
-                                              type: string
-                                          priorityClassName:
-                                            description: If specified, the pod's priorityClassName.
-                                            type: string
-                                          securityContext:
-                                            description: If specified, the pod's security context
-                                            type: object
-                                            properties:
-                                              fsGroup:
-                                                description: |-
-                                                  A special supplemental group that applies to all containers in a pod.
-                                                  Some volume types allow the Kubelet to change the ownership of that volume
-                                                  to be owned by the pod:
-
-                                                  1. The owning GID will be the FSGroup
-                                                  2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
-                                                  3. The permission bits are OR'd with rw-rw----
-
-                                                  If unset, the Kubelet will not modify the ownership and permissions of any volume.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              fsGroupChangePolicy:
-                                                description: |-
-                                                  fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
-                                                  before being exposed inside Pod. This field will only apply to
-                                                  volume types which support fsGroup based ownership(and permissions).
-                                                  It will have no effect on ephemeral volume types such as: secret, configmaps
-                                                  and emptydir.
-                                                  Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: string
-                                              runAsGroup:
-                                                description: |-
-                                                  The GID to run the entrypoint of the container process.
-                                                  Uses runtime default if unset.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
-                                                  for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              runAsNonRoot:
-                                                description: |-
-                                                  Indicates that the container must run as a non-root user.
-                                                  If true, the Kubelet will validate the image at runtime to ensure that it
-                                                  does not run as UID 0 (root) and fail to start the container if it does.
-                                                  If unset or false, no such validation will be performed.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
-                                                type: boolean
-                                              runAsUser:
-                                                description: |-
-                                                  The UID to run the entrypoint of the container process.
-                                                  Defaults to user specified in image metadata if unspecified.
-                                                  May also be set in SecurityContext.  If set in both SecurityContext and
-                                                  PodSecurityContext, the value specified in SecurityContext takes precedence
-                                                  for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: integer
-                                                format: int64
-                                              seLinuxOptions:
-                                                description: |-
-                                                  The SELinux context to be applied to all containers.
-                                                  If unspecified, the container runtime will allocate a random SELinux context for each
-                                                  container.  May also be set in SecurityContext.  If set in
-                                                  both SecurityContext and PodSecurityContext, the value specified in SecurityContext
-                                                  takes precedence for that container.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: object
-                                                properties:
-                                                  level:
-                                                    description: Level is SELinux level label that applies to the container.
-                                                    type: string
-                                                  role:
-                                                    description: Role is a SELinux role label that applies to the container.
-                                                    type: string
-                                                  type:
-                                                    description: Type is a SELinux type label that applies to the container.
-                                                    type: string
-                                                  user:
-                                                    description: User is a SELinux user label that applies to the container.
-                                                    type: string
-                                              seccompProfile:
-                                                description: |-
-                                                  The seccomp options to use by the containers in this pod.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: object
-                                                required:
-                                                  - type
-                                                properties:
-                                                  localhostProfile:
-                                                    description: |-
-                                                      localhostProfile indicates a profile defined in a file on the node should be used.
-                                                      The profile must be preconfigured on the node to work.
-                                                      Must be a descending path, relative to the kubelet's configured seccomp profile location.
-                                                      Must be set if type is "Localhost". Must NOT be set for any other type.
-                                                    type: string
-                                                  type:
-                                                    description: |-
-                                                      type indicates which kind of seccomp profile will be applied.
-                                                      Valid options are:
-
-                                                      Localhost - a profile defined in a file on the node should be used.
-                                                      RuntimeDefault - the container runtime default profile should be used.
-                                                      Unconfined - no profile should be applied.
-                                                    type: string
-                                              supplementalGroups:
-                                                description: |-
-                                                  A list of groups applied to the first process run in each container, in addition
-                                                  to the container's primary GID, the fsGroup (if specified), and group memberships
-                                                  defined in the container image for the uid of the container process. If unspecified,
-                                                  no additional groups are added to any container. Note that group memberships
-                                                  defined in the container image for the uid of the container process are still effective,
-                                                  even if they are not included in this list.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: array
-                                                items:
-                                                  type: integer
-                                                  format: int64
-                                              sysctls:
-                                                description: |-
-                                                  Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
-                                                  sysctls (by the container runtime) might fail to launch.
-                                                  Note that this field cannot be set when spec.os.name is windows.
-                                                type: array
-                                                items:
-                                                  description: Sysctl defines a kernel parameter to be set
-                                                  type: object
-                                                  required:
-                                                    - name
-                                                    - value
-                                                  properties:
-                                                    name:
-                                                      description: Name of a property to set
-                                                      type: string
-                                                    value:
-                                                      description: Value of a property to set
-                                                      type: string
-                                          serviceAccountName:
-                                            description: If specified, the pod's service account
-                                            type: string
-                                          tolerations:
-                                            description: If specified, the pod's tolerations.
-                                            type: array
-                                            items:
-                                              description: |-
-                                                The pod this Toleration is attached to tolerates any taint that matches
-                                                the triple <key,value,effect> using the matching operator <operator>.
-                                              type: object
-                                              properties:
-                                                effect:
-                                                  description: |-
-                                                    Effect indicates the taint effect to match. Empty means match all taint effects.
-                                                    When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                                                  type: string
-                                                key:
-                                                  description: |-
-                                                    Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                                                    If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                                                  type: string
-                                                operator:
-                                                  description: |-
-                                                    Operator represents a key's relationship to the value.
-                                                    Valid operators are Exists and Equal. Defaults to Equal.
-                                                    Exists is equivalent to wildcard for value, so that a pod can
-                                                    tolerate all taints of a particular category.
-                                                  type: string
-                                                tolerationSeconds:
-                                                  description: |-
-                                                    TolerationSeconds represents the period of time the toleration (which must be
-                                                    of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                                                    it is not set, which means tolerate the taint forever (do not evict). Zero and
-                                                    negative values will be treated as 0 (evict immediately) by the system.
-                                                  type: integer
-                                                  format: int64
-                                                value:
-                                                  description: |-
-                                                    Value is the taint value the toleration matches to.
-                                                    If the operator is Exists, the value should be empty, otherwise just a regular string.
-                                                  type: string
-                                  serviceType:
-                                    description: |-
-                                      Optional service type for Kubernetes solver service. Supported values
-                                      are NodePort or ClusterIP. If unset, defaults to NodePort.
-                                    type: string
-                          selector:
-                            description: |-
-                              Selector selects a set of DNSNames on the Certificate resource that
-                              should be solved using this challenge solver.
-                              If not specified, the solver will be treated as the 'default' solver
-                              with the lowest priority, i.e. if any other solver has a more specific
-                              match, it will be used instead.
-                            type: object
-                            properties:
-                              dnsNames:
-                                description: |-
-                                  List of DNSNames that this solver will be used to solve.
-                                  If specified and a match is found, a dnsNames selector will take
-                                  precedence over a dnsZones selector.
-                                  If multiple solvers match with the same dnsNames value, the solver
-                                  with the most matching labels in matchLabels will be selected.
-                                  If neither has more matches, the solver defined earlier in the list
-                                  will be selected.
-                                type: array
-                                items:
-                                  type: string
-                              dnsZones:
-                                description: |-
-                                  List of DNSZones that this solver will be used to solve.
-                                  The most specific DNS zone match specified here will take precedence
-                                  over other DNS zone matches, so a solver specifying sys.example.com
-                                  will be selected over one specifying example.com for the domain
-                                  www.sys.example.com.
-                                  If multiple solvers match with the same dnsZones value, the solver
-                                  with the most matching labels in matchLabels will be selected.
-                                  If neither has more matches, the solver defined earlier in the list
-                                  will be selected.
-                                type: array
-                                items:
-                                  type: string
-                              matchLabels:
-                                description: |-
-                                  A label selector that is used to refine the set of certificate's that
-                                  this challenge solver will apply to.
-                                type: object
-                                additionalProperties:
-                                  type: string
-                ca:
-                  description: |-
-                    CA configures this issuer to sign certificates using a signing CA keypair
-                    stored in a Secret resource.
-                    This is used to build internal PKIs that are managed by cert-manager.
-                  type: object
-                  required:
-                    - secretName
-                  properties:
-                    crlDistributionPoints:
-                      description: |-
-                        The CRL distribution points is an X.509 v3 certificate extension which identifies
-                        the location of the CRL from which the revocation of this certificate can be checked.
-                        If not set, certificates will be issued without distribution points set.
-                      type: array
-                      items:
-                        type: string
-                    issuingCertificateURLs:
-                      description: |-
-                        IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates
-                        it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.
-                        As an example, such a URL might be "http://ca.domain.com/ca.crt".
-                      type: array
-                      items:
-                        type: string
-                    ocspServers:
-                      description: |-
-                        The OCSP server list is an X.509 v3 extension that defines a list of
-                        URLs of OCSP responders. The OCSP responders can be queried for the
-                        revocation status of an issued certificate. If not set, the
-                        certificate will be issued with no OCSP servers set. For example, an
-                        OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
-                      type: array
-                      items:
-                        type: string
-                    secretName:
-                      description: |-
-                        SecretName is the name of the secret used to sign Certificates issued
-                        by this Issuer.
-                      type: string
-                selfSigned:
-                  description: |-
-                    SelfSigned configures this issuer to 'self sign' certificates using the
-                    private key used to create the CertificateRequest object.
-                  type: object
-                  properties:
-                    crlDistributionPoints:
-                      description: |-
-                        The CRL distribution points is an X.509 v3 certificate extension which identifies
-                        the location of the CRL from which the revocation of this certificate can be checked.
-                        If not set certificate will be issued without CDP. Values are strings.
-                      type: array
-                      items:
-                        type: string
-                vault:
-                  description: |-
-                    Vault configures this issuer to sign certificates using a HashiCorp Vault
-                    PKI backend.
-                  type: object
-                  required:
-                    - auth
-                    - path
-                    - server
-                  properties:
-                    auth:
-                      description: Auth configures how cert-manager authenticates with the Vault server.
-                      type: object
-                      properties:
-                        appRole:
-                          description: |-
-                            AppRole authenticates with Vault using the App Role auth mechanism,
-                            with the role and secret stored in a Kubernetes Secret resource.
-                          type: object
-                          required:
-                            - path
-                            - roleId
-                            - secretRef
-                          properties:
-                            path:
-                              description: |-
-                                Path where the App Role authentication backend is mounted in Vault, e.g:
-                                "approle"
-                              type: string
-                            roleId:
-                              description: |-
-                                RoleID configured in the App Role authentication backend when setting
-                                up the authentication backend in Vault.
-                              type: string
-                            secretRef:
-                              description: |-
-                                Reference to a key in a Secret that contains the App Role secret used
-                                to authenticate with Vault.
-                                The `key` field must be specified and denotes which entry within the Secret
-                                resource is used as the app role secret.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                        clientCertificate:
-                          description: |-
-                            ClientCertificate authenticates with Vault by presenting a client
-                            certificate during the request's TLS handshake.
-                            Works only when using HTTPS protocol.
-                          type: object
-                          properties:
-                            mountPath:
-                              description: |-
-                                The Vault mountPath here is the mount path to use when authenticating with
-                                Vault. For example, setting a value to `/v1/auth/foo`, will use the path
-                                `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
-                                default value "/v1/auth/cert" will be used.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the certificate role to authenticate against.
-                                If not set, matching any certificate role, if available.
-                              type: string
-                            secretName:
-                              description: |-
-                                Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing
-                                tls.crt and tls.key) used to authenticate to Vault using TLS client
-                                authentication.
-                              type: string
-                        kubernetes:
-                          description: |-
-                            Kubernetes authenticates with Vault by passing the ServiceAccount
-                            token stored in the named Secret resource to the Vault server.
-                          type: object
-                          required:
-                            - role
-                          properties:
-                            mountPath:
-                              description: |-
-                                The Vault mountPath here is the mount path to use when authenticating with
-                                Vault. For example, setting a value to `/v1/auth/foo`, will use the path
-                                `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
-                                default value "/v1/auth/kubernetes" will be used.
-                              type: string
-                            role:
-                              description: |-
-                                A required field containing the Vault Role to assume. A Role binds a
-                                Kubernetes ServiceAccount with a set of Vault policies.
-                              type: string
-                            secretRef:
-                              description: |-
-                                The required Secret field containing a Kubernetes ServiceAccount JWT used
-                                for authenticating with Vault. Use of 'ambient credentials' is not
-                                supported.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                key:
-                                  description: |-
-                                    The key of the entry in the Secret resource's `data` field to be used.
-                                    Some instances of this field may be defaulted, in others it may be
-                                    required.
-                                  type: string
-                                name:
-                                  description: |-
-                                    Name of the resource being referred to.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                            serviceAccountRef:
-                              description: |-
-                                A reference to a service account that will be used to request a bound
-                                token (also known as "projected token"). Compared to using "secretRef",
-                                using this field means that you don't rely on statically bound tokens. To
-                                use this field, you must configure an RBAC rule to let cert-manager
-                                request a token.
-                              type: object
-                              required:
-                                - name
-                              properties:
-                                audiences:
-                                  description: |-
-                                    TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token
-                                    consisting of the issuer's namespace and name is always included.
-                                  type: array
-                                  items:
-                                    type: string
-                                name:
-                                  description: Name of the ServiceAccount used to request a token.
-                                  type: string
-                        tokenSecretRef:
-                          description: TokenSecretRef authenticates with Vault by presenting a token.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                    caBundle:
-                      description: |-
-                        Base64-encoded bundle of PEM CAs which will be used to validate the certificate
-                        chain presented by Vault. Only used if using HTTPS to connect to Vault and
-                        ignored for HTTP connections.
-                        Mutually exclusive with CABundleSecretRef.
-                        If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
-                        the cert-manager controller container is used to validate the TLS connection.
-                      type: string
-                      format: byte
-                    caBundleSecretRef:
-                      description: |-
-                        Reference to a Secret containing a bundle of PEM-encoded CAs to use when
-                        verifying the certificate chain presented by Vault when using HTTPS.
-                        Mutually exclusive with CABundle.
-                        If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
-                        the cert-manager controller container is used to validate the TLS connection.
-                        If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
-                      type: object
-                      required:
-                        - name
-                      properties:
-                        key:
-                          description: |-
-                            The key of the entry in the Secret resource's `data` field to be used.
-                            Some instances of this field may be defaulted, in others it may be
-                            required.
-                          type: string
-                        name:
-                          description: |-
-                            Name of the resource being referred to.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                    clientCertSecretRef:
-                      description: |-
-                        Reference to a Secret containing a PEM-encoded Client Certificate to use when the
-                        Vault server requires mTLS.
-                      type: object
-                      required:
-                        - name
-                      properties:
-                        key:
-                          description: |-
-                            The key of the entry in the Secret resource's `data` field to be used.
-                            Some instances of this field may be defaulted, in others it may be
-                            required.
-                          type: string
-                        name:
-                          description: |-
-                            Name of the resource being referred to.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                    clientKeySecretRef:
-                      description: |-
-                        Reference to a Secret containing a PEM-encoded Client Private Key to use when the
-                        Vault server requires mTLS.
-                      type: object
-                      required:
-                        - name
-                      properties:
-                        key:
-                          description: |-
-                            The key of the entry in the Secret resource's `data` field to be used.
-                            Some instances of this field may be defaulted, in others it may be
-                            required.
-                          type: string
-                        name:
-                          description: |-
-                            Name of the resource being referred to.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                    namespace:
-                      description: |-
-                        Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1"
-                        More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
-                      type: string
-                    path:
-                      description: |-
-                        Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
-                        "my_pki_mount/sign/my-role-name".
-                      type: string
-                    server:
-                      description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
-                      type: string
-                venafi:
-                  description: |-
-                    Venafi configures this issuer to sign certificates using a Venafi TPP
-                    or Venafi Cloud policy zone.
-                  type: object
-                  required:
-                    - zone
-                  properties:
-                    cloud:
-                      description: |-
-                        Cloud specifies the Venafi cloud configuration settings.
-                        Only one of TPP or Cloud may be specified.
-                      type: object
-                      required:
-                        - apiTokenSecretRef
-                      properties:
-                        apiTokenSecretRef:
-                          description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                        url:
-                          description: |-
-                            URL is the base URL for Venafi Cloud.
-                            Defaults to "https://api.venafi.cloud/v1".
-                          type: string
-                    tpp:
-                      description: |-
-                        TPP specifies Trust Protection Platform configuration settings.
-                        Only one of TPP or Cloud may be specified.
-                      type: object
-                      required:
-                        - credentialsRef
-                        - url
-                      properties:
-                        caBundle:
-                          description: |-
-                            Base64-encoded bundle of PEM CAs which will be used to validate the certificate
-                            chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
-                            If undefined, the certificate bundle in the cert-manager controller container
-                            is used to validate the chain.
-                          type: string
-                          format: byte
-                        caBundleSecretRef:
-                          description: |-
-                            Reference to a Secret containing a base64-encoded bundle of PEM CAs
-                            which will be used to validate the certificate chain presented by the TPP server.
-                            Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
-                            If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
-                            the cert-manager controller container is used to validate the TLS connection.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                        credentialsRef:
-                          description: |-
-                            CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.
-                            The secret must contain the key 'access-token' for the Access Token Authentication,
-                            or two keys, 'username' and 'password' for the API Keys Authentication.
-                          type: object
-                          required:
-                            - name
-                          properties:
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                        url:
-                          description: |-
-                            URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
-                            for example: "https://tpp.example.com/vedsdk".
-                          type: string
-                    zone:
-                      description: |-
-                        Zone is the Venafi Policy Zone to use for this issuer.
-                        All requests made to the Venafi platform will be restricted by the named
-                        zone policy.
-                        This field is required.
-                      type: string
-            status:
-              description: Status of the Issuer. This is set and managed automatically.
-              type: object
-              properties:
-                acme:
-                  description: |-
-                    ACME specific status options.
-                    This field should only be set if the Issuer is configured to use an ACME
-                    server to issue certificates.
-                  type: object
-                  properties:
-                    lastPrivateKeyHash:
-                      description: |-
-                        LastPrivateKeyHash is a hash of the private key associated with the latest
-                        registered ACME account, in order to track changes made to registered account
-                        associated with the Issuer
-                      type: string
-                    lastRegisteredEmail:
-                      description: |-
-                        LastRegisteredEmail is the email associated with the latest registered
-                        ACME account, in order to track changes made to registered account
-                        associated with the  Issuer
-                      type: string
-                    uri:
-                      description: |-
-                        URI is the unique account identifier, which can also be used to retrieve
-                        account details from the CA
-                      type: string
-                conditions:
-                  description: |-
-                    List of status conditions to indicate the status of a CertificateRequest.
-                    Known condition types are `Ready`.
-                  type: array
-                  items:
-                    description: IssuerCondition contains condition information for an Issuer.
-                    type: object
-                    required:
-                      - status
-                      - type
-                    properties:
-                      lastTransitionTime:
-                        description: |-
-                          LastTransitionTime is the timestamp corresponding to the last status
-                          change of this condition.
-                        type: string
-                        format: date-time
-                      message:
-                        description: |-
-                          Message is a human readable description of the details of the last
-                          transition, complementing reason.
-                        type: string
-                      observedGeneration:
-                        description: |-
-                          If set, this represents the .metadata.generation that the condition was
-                          set based upon.
-                          For instance, if .metadata.generation is currently 12, but the
-                          .status.condition[x].observedGeneration is 9, the condition is out of date
-                          with respect to the current state of the Issuer.
-                        type: integer
-                        format: int64
-                      reason:
-                        description: |-
-                          Reason is a brief machine readable explanation for the condition's last
-                          transition.
-                        type: string
-                      status:
-                        description: Status of the condition, one of (`True`, `False`, `Unknown`).
-                        type: string
-                        enum:
-                          - "True"
-                          - "False"
-                          - Unknown
-                      type:
-                        description: Type of the condition, known values are (`Ready`).
-                        type: string
-                  x-kubernetes-list-map-keys:
-                    - type
-                  x-kubernetes-list-type: map
-      served: true
-      storage: true
-
-# END crd {{- end }}
-
----
-# START crd {{- if or .Values.crds.enabled .Values.installCRDs }}
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: orders.acme.cert-manager.io
-  # START annotations {{- if .Values.crds.keep }}
-  annotations:
-    helm.sh/resource-policy: keep
-  # END annotations {{- end }}
-  labels:
-    app: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/instance: '{{ .Release.Name }}'
-    app.kubernetes.io/component: "crds"
-    # Generated labels {{- include "labels" . | nindent 4 }}
-spec:
-  group: acme.cert-manager.io
-  names:
-    kind: Order
-    listKind: OrderList
-    plural: orders
-    singular: order
-    categories:
-      - cert-manager
-      - cert-manager-acme
-  scope: Namespaced
-  versions:
-    - name: v1
-      subresources:
-        status: {}
-      additionalPrinterColumns:
-        - jsonPath: .status.state
-          name: State
-          type: string
-        - jsonPath: .spec.issuerRef.name
-          name: Issuer
-          priority: 1
-          type: string
-        - jsonPath: .status.reason
-          name: Reason
-          priority: 1
-          type: string
-        - jsonPath: .metadata.creationTimestamp
-          description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
-          name: Age
-          type: date
-      schema:
-        openAPIV3Schema:
-          description: Order is a type to represent an Order with an ACME server
-          type: object
-          required:
-            - metadata
-            - spec
-          properties:
-            apiVersion:
-              description: |-
-                APIVersion defines the versioned schema of this representation of an object.
-                Servers should convert recognized schemas to the latest internal value, and
-                may reject unrecognized values.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-              type: string
-            kind:
-              description: |-
-                Kind is a string value representing the REST resource this object represents.
-                Servers may infer this from the endpoint the client submits requests to.
-                Cannot be updated.
-                In CamelCase.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-              type: string
-            metadata:
-              type: object
-            spec:
-              type: object
-              required:
-                - issuerRef
-                - request
-              properties:
-                commonName:
-                  description: |-
-                    CommonName is the common name as specified on the DER encoded CSR.
-                    If specified, this value must also be present in `dnsNames` or `ipAddresses`.
-                    This field must match the corresponding field on the DER encoded CSR.
-                  type: string
-                dnsNames:
-                  description: |-
-                    DNSNames is a list of DNS names that should be included as part of the Order
-                    validation process.
-                    This field must match the corresponding field on the DER encoded CSR.
-                  type: array
-                  items:
-                    type: string
-                duration:
-                  description: |-
-                    Duration is the duration for the not after date for the requested certificate.
-                    this is set on order creation as pe the ACME spec.
-                  type: string
-                ipAddresses:
-                  description: |-
-                    IPAddresses is a list of IP addresses that should be included as part of the Order
-                    validation process.
-                    This field must match the corresponding field on the DER encoded CSR.
-                  type: array
-                  items:
-                    type: string
-                issuerRef:
-                  description: |-
-                    IssuerRef references a properly configured ACME-type Issuer which should
-                    be used to create this Order.
-                    If the Issuer does not exist, processing will be retried.
-                    If the Issuer is not an 'ACME' Issuer, an error will be returned and the
-                    Order will be marked as failed.
-                  type: object
-                  required:
-                    - name
-                  properties:
-                    group:
-                      description: Group of the resource being referred to.
-                      type: string
-                    kind:
-                      description: Kind of the resource being referred to.
-                      type: string
-                    name:
-                      description: Name of the resource being referred to.
-                      type: string
-                request:
-                  description: |-
-                    Certificate signing request bytes in DER encoding.
-                    This will be used when finalizing the order.
-                    This field must be set on the order.
-                  type: string
-                  format: byte
-            status:
-              type: object
-              properties:
-                authorizations:
-                  description: |-
-                    Authorizations contains data returned from the ACME server on what
-                    authorizations must be completed in order to validate the DNS names
-                    specified on the Order.
-                  type: array
-                  items:
-                    description: |-
-                      ACMEAuthorization contains data returned from the ACME server on an
-                      authorization that must be completed in order validate a DNS name on an ACME
-                      Order resource.
-                    type: object
-                    required:
-                      - url
-                    properties:
-                      challenges:
-                        description: |-
-                          Challenges specifies the challenge types offered by the ACME server.
-                          One of these challenge types will be selected when validating the DNS
-                          name and an appropriate Challenge resource will be created to perform
-                          the ACME challenge process.
-                        type: array
-                        items:
-                          description: |-
-                            Challenge specifies a challenge offered by the ACME server for an Order.
-                            An appropriate Challenge resource can be created to perform the ACME
-                            challenge process.
-                          type: object
-                          required:
-                            - token
-                            - type
-                            - url
-                          properties:
-                            token:
-                              description: |-
-                                Token is the token that must be presented for this challenge.
-                                This is used to compute the 'key' that must also be presented.
-                              type: string
-                            type:
-                              description: |-
-                                Type is the type of challenge being offered, e.g. 'http-01', 'dns-01',
-                                'tls-sni-01', etc.
-                                This is the raw value retrieved from the ACME server.
-                                Only 'http-01' and 'dns-01' are supported by cert-manager, other values
-                                will be ignored.
-                              type: string
-                            url:
-                              description: |-
-                                URL is the URL of this challenge. It can be used to retrieve additional
-                                metadata about the Challenge from the ACME server.
-                              type: string
-                      identifier:
-                        description: Identifier is the DNS name to be validated as part of this authorization
-                        type: string
-                      initialState:
-                        description: |-
-                          InitialState is the initial state of the ACME authorization when first
-                          fetched from the ACME server.
-                          If an Authorization is already 'valid', the Order controller will not
-                          create a Challenge resource for the authorization. This will occur when
-                          working with an ACME server that enables 'authz reuse' (such as Let's
-                          Encrypt's production endpoint).
-                          If not set and 'identifier' is set, the state is assumed to be pending
-                          and a Challenge will be created.
-                        type: string
-                        enum:
-                          - valid
-                          - ready
-                          - pending
-                          - processing
-                          - invalid
-                          - expired
-                          - errored
-                      url:
-                        description: URL is the URL of the Authorization that must be completed
-                        type: string
-                      wildcard:
-                        description: |-
-                          Wildcard will be true if this authorization is for a wildcard DNS name.
-                          If this is true, the identifier will be the *non-wildcard* version of
-                          the DNS name.
-                          For example, if '*.example.com' is the DNS name being validated, this
-                          field will be 'true' and the 'identifier' field will be 'example.com'.
-                        type: boolean
-                certificate:
-                  description: |-
-                    Certificate is a copy of the PEM encoded certificate for this Order.
-                    This field will be populated after the order has been successfully
-                    finalized with the ACME server, and the order has transitioned to the
-                    'valid' state.
-                  type: string
-                  format: byte
-                failureTime:
-                  description: |-
-                    FailureTime stores the time that this order failed.
-                    This is used to influence garbage collection and back-off.
-                  type: string
-                  format: date-time
-                finalizeURL:
-                  description: |-
-                    FinalizeURL of the Order.
-                    This is used to obtain certificates for this order once it has been completed.
-                  type: string
-                reason:
-                  description: |-
-                    Reason optionally provides more information about a why the order is in
-                    the current state.
-                  type: string
-                state:
-                  description: |-
-                    State contains the current state of this Order resource.
-                    States 'success' and 'expired' are 'final'
-                  type: string
-                  enum:
-                    - valid
-                    - ready
-                    - pending
-                    - processing
-                    - invalid
-                    - expired
-                    - errored
-                url:
-                  description: |-
-                    URL of the Order.
-                    This will initially be empty when the resource is first created.
-                    The Order controller will populate this field when the Order is first processed.
-                    This field will be immutable after it is initially set.
-                  type: string
-      served: true
-      storage: true
-
-# END crd {{- end }}
diff --git a/packages/system/cert-manager/charts/cert-manager/templates/deployment.yaml b/packages/system/cert-manager/charts/cert-manager/templates/deployment.yaml
index 8a4a9734..453e8238 100644
--- a/packages/system/cert-manager/charts/cert-manager/templates/deployment.yaml
+++ b/packages/system/cert-manager/charts/cert-manager/templates/deployment.yaml
@@ -66,6 +66,9 @@ spec:
       {{- with .Values.global.priorityClassName }}
       priorityClassName: {{ . | quote }}
       {{- end }}
+      {{- if (hasKey .Values.global "hostUsers") }}
+      hostUsers: {{ .Values.global.hostUsers }}       
+      {{- end }}
       {{- with .Values.securityContext }}
       securityContext:
         {{- toYaml . | nindent 8 }}
@@ -209,9 +212,13 @@ spec:
             failureThreshold: {{ .failureThreshold }}
           {{- end }}
           {{- end }}
-      {{- with .Values.nodeSelector }}
+      {{- $nodeSelector := .Values.global.nodeSelector | default dict }}
+      {{- $nodeSelector = merge $nodeSelector (.Values.nodeSelector | default dict) }}
+      {{- with $nodeSelector }}
       nodeSelector:
-        {{- toYaml . | nindent 8 }}
+        {{- range $key, $value := . }}
+        {{ $key }}: {{ $value | quote }}
+        {{- end }}
       {{- end }}
       {{- with .Values.affinity }}
       affinity:
@@ -234,4 +241,4 @@ spec:
       {{- end }}
       {{- with .Values.hostAliases }}
       hostAliases: {{ toYaml . | nindent 8 }}
-      {{- end }}
\ No newline at end of file
+      {{- end }}
diff --git a/packages/system/cert-manager/charts/cert-manager/templates/rbac.yaml b/packages/system/cert-manager/charts/cert-manager/templates/rbac.yaml
index baae425f..7acd5711 100644
--- a/packages/system/cert-manager/charts/cert-manager/templates/rbac.yaml
+++ b/packages/system/cert-manager/charts/cert-manager/templates/rbac.yaml
@@ -49,7 +49,7 @@ subjects:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: {{ template "cert-manager.serviceAccountName" . }}-tokenrequest
+  name: {{ template "cert-manager.fullname" . }}-tokenrequest
   namespace: {{ include "cert-manager.namespace" . }}
   labels:
     app: {{ include "cert-manager.name" . }}
@@ -69,7 +69,7 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: {{ include "cert-manager.fullname" . }}-{{ template "cert-manager.serviceAccountName" .  }}-tokenrequest
+  name: {{ include "cert-manager.fullname" . }}-tokenrequest
   namespace: {{ include "cert-manager.namespace" . }}
   labels:
     app: {{ include "cert-manager.name" . }}
@@ -80,7 +80,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: {{ template "cert-manager.serviceAccountName" . }}-tokenrequest
+  name: {{ template "cert-manager.fullname" . }}-tokenrequest
 subjects:
   - kind: ServiceAccount
     name: {{ template "cert-manager.serviceAccountName" . }}
@@ -256,8 +256,8 @@ rules:
   - apiGroups: ["networking.k8s.io"]
     resources: ["ingresses"]
     verbs: ["get", "list", "watch", "create", "delete", "update"]
-  - apiGroups: [ "gateway.networking.k8s.io" ]
-    resources: [ "httproutes" ]
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources: ["httproutes"]
     verbs: ["get", "list", "watch", "create", "delete", "update"]
   # We require the ability to specify a custom hostname when we are creating
   # new ingress resources.
diff --git a/packages/system/cert-manager/charts/cert-manager/templates/serviceaccount.yaml b/packages/system/cert-manager/charts/cert-manager/templates/serviceaccount.yaml
index 698ddef8..fac93d0a 100644
--- a/packages/system/cert-manager/charts/cert-manager/templates/serviceaccount.yaml
+++ b/packages/system/cert-manager/charts/cert-manager/templates/serviceaccount.yaml
@@ -12,7 +12,8 @@ metadata:
   {{- with .Values.serviceAccount.annotations }}
   annotations:
     {{- range $k, $v := . }}
-      {{- printf "%s: %s" (tpl $k $) (tpl $v $) | nindent 4 }}
+      {{- $value := $v | quote }}
+      {{- printf "%s: %s" (tpl $k $) (tpl $value $) | nindent 4 }}
     {{- end }} 
   {{- end }}
   labels:
diff --git a/packages/system/cert-manager/charts/cert-manager/templates/servicemonitor.yaml b/packages/system/cert-manager/charts/cert-manager/templates/servicemonitor.yaml
index dd1beec8..a29f3c6a 100644
--- a/packages/system/cert-manager/charts/cert-manager/templates/servicemonitor.yaml
+++ b/packages/system/cert-manager/charts/cert-manager/templates/servicemonitor.yaml
@@ -16,7 +16,9 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: "controller"
     {{- include "labels" . | nindent 4 }}
+    {{- if .Values.prometheus.servicemonitor.prometheusInstance }}
     prometheus: {{ .Values.prometheus.servicemonitor.prometheusInstance }}
+    {{- end }}
     {{- with .Values.prometheus.servicemonitor.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
@@ -54,8 +56,12 @@ spec:
   endpoints:
   - targetPort: {{ .Values.prometheus.servicemonitor.targetPort }}
     path: {{ .Values.prometheus.servicemonitor.path }}
+    {{- if .Values.prometheus.servicemonitor.interval }}
     interval: {{ .Values.prometheus.servicemonitor.interval }}
+    {{- end }}
+    {{- if .Values.prometheus.servicemonitor.scrapeTimeout }}
     scrapeTimeout: {{ .Values.prometheus.servicemonitor.scrapeTimeout }}
+    {{- end }}
     honorLabels: {{ .Values.prometheus.servicemonitor.honorLabels }}
     {{- with .Values.prometheus.servicemonitor.endpointAdditionalProperties }}
     {{- toYaml . | nindent 4 }}
diff --git a/packages/system/cert-manager/charts/cert-manager/templates/startupapicheck-job.yaml b/packages/system/cert-manager/charts/cert-manager/templates/startupapicheck-job.yaml
index 183cff4e..f68d5409 100644
--- a/packages/system/cert-manager/charts/cert-manager/templates/startupapicheck-job.yaml
+++ b/packages/system/cert-manager/charts/cert-manager/templates/startupapicheck-job.yaml
@@ -41,6 +41,9 @@ spec:
       {{- with .Values.global.priorityClassName }}
       priorityClassName: {{ . | quote }}
       {{- end }}
+      {{- if (hasKey .Values.global "hostUsers") }}
+      hostUsers: {{ .Values.global.hostUsers }}       
+      {{- end }}
       {{- with .Values.startupapicheck.securityContext }}
       securityContext:
         {{- toYaml . | nindent 8 }}
@@ -76,9 +79,13 @@ spec:
           volumeMounts:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-      {{- with .Values.startupapicheck.nodeSelector }}
+      {{- $nodeSelector := .Values.global.nodeSelector | default dict }}
+      {{- $nodeSelector = merge $nodeSelector (.Values.startupapicheck.nodeSelector | default dict) }}
+      {{- with $nodeSelector }}
       nodeSelector:
-        {{- toYaml . | nindent 8 }}
+        {{- range $key, $value := . }}
+        {{ $key }}: {{ $value | quote }}
+        {{- end }}
       {{- end }}
       {{- with .Values.startupapicheck.affinity }}
       affinity:
diff --git a/packages/system/cert-manager/charts/cert-manager/templates/webhook-deployment.yaml b/packages/system/cert-manager/charts/cert-manager/templates/webhook-deployment.yaml
index 857cf353..d2b10ae8 100644
--- a/packages/system/cert-manager/charts/cert-manager/templates/webhook-deployment.yaml
+++ b/packages/system/cert-manager/charts/cert-manager/templates/webhook-deployment.yaml
@@ -66,6 +66,9 @@ spec:
       {{- with .Values.global.priorityClassName }}
       priorityClassName: {{ . | quote }}
       {{- end }}
+      {{- if (hasKey .Values.global "hostUsers") }}
+      hostUsers: {{ .Values.global.hostUsers }}       
+      {{- end }}
       {{- with .Values.webhook.securityContext }}
       securityContext:
         {{- toYaml . | nindent 8 }}
@@ -102,7 +105,7 @@ spec:
           - --dynamic-serving-dns-names={{ template "webhook.fullname" . }}
           - --dynamic-serving-dns-names={{ template "webhook.fullname" . }}.$(POD_NAMESPACE)
           - --dynamic-serving-dns-names={{ template "webhook.fullname" . }}.$(POD_NAMESPACE).svc
-          {{ if .Values.webhook.url.host }}
+          {{- if .Values.webhook.url.host }}
           - --dynamic-serving-dns-names={{ .Values.webhook.url.host }}
           {{- end }}
           {{- end }}
@@ -137,11 +140,7 @@ spec:
           livenessProbe:
             httpGet:
               path: /livez
-              {{- if $config.healthzPort }}
-              port: {{ $config.healthzPort }}
-              {{- else }}
-              port: 6080
-              {{- end }}
+              port: healthcheck
               scheme: HTTP
             initialDelaySeconds: {{ .Values.webhook.livenessProbe.initialDelaySeconds }}
             periodSeconds: {{ .Values.webhook.livenessProbe.periodSeconds }}
@@ -151,11 +150,7 @@ spec:
           readinessProbe:
             httpGet:
               path: /healthz
-              {{- if $config.healthzPort }}
-              port: {{ $config.healthzPort }}
-              {{- else }}
-              port: 6080
-              {{- end }}
+              port: healthcheck
               scheme: HTTP
             initialDelaySeconds: {{ .Values.webhook.readinessProbe.initialDelaySeconds }}
             periodSeconds: {{ .Values.webhook.readinessProbe.periodSeconds }}
@@ -188,9 +183,13 @@ spec:
             {{- toYaml . | nindent 12 }}
             {{- end }}
           {{- end }}
-      {{- with .Values.webhook.nodeSelector }}
+      {{- $nodeSelector := .Values.global.nodeSelector | default dict }}
+      {{- $nodeSelector = merge $nodeSelector (.Values.webhook.nodeSelector | default dict) }}
+      {{- with $nodeSelector }}
       nodeSelector:
-        {{- toYaml . | nindent 8 }}
+        {{- range $key, $value := . }}
+        {{ $key }}: {{ $value | quote }}
+        {{- end }}
       {{- end }}
       {{- with .Values.webhook.affinity }}
       affinity:
diff --git a/packages/system/cert-manager/charts/cert-manager/values.schema.json b/packages/system/cert-manager/charts/cert-manager/values.schema.json
index 36d1d0ca..7f90b6c3 100644
--- a/packages/system/cert-manager/charts/cert-manager/values.schema.json
+++ b/packages/system/cert-manager/charts/cert-manager/values.schema.json
@@ -236,7 +236,7 @@
         "issuers.cert-manager.io/*",
         "clusterissuers.cert-manager.io/*"
       ],
-      "description": "List of signer names that cert-manager will approve by default. CertificateRequests referencing these signer names will be auto-approved by cert-manager. Defaults to just approving the cert-manager.io Issuer and ClusterIssuer issuers. When set to an empty array, ALL issuers will be auto-approved by cert-manager. To disable the auto-approval, because eg. you are using approver-policy, you can enable 'disableAutoApproval'.\nref: https://cert-manager.io/docs/concepts/certificaterequest/#approval",
+      "description": "List of signer names that cert-manager will approve by default. CertificateRequests referencing these signer names will be auto-approved by cert-manager. Defaults to just approving the cert-manager.io Issuer and ClusterIssuer issuers. When set to an empty array, ALL issuers will be auto-approved by cert-manager. To disable the auto-approval, because, e.g., you are using approver-policy, you can enable 'disableAutoApproval'.\nref: https://cert-manager.io/docs/concepts/certificaterequest/#approval",
       "items": {},
       "type": "array"
     },
@@ -461,10 +461,10 @@
       "type": "boolean"
     },
     "helm-values.cainjector.podDisruptionBudget.maxUnavailable": {
-      "description": "`maxUnavailable` configures the maximum unavailable pods for disruptions. It can either be set to\nan integer (e.g. 1) or a percentage value (e.g. 25%).\nCannot be used if `minAvailable` is set."
+      "description": "`maxUnavailable` configures the maximum unavailable pods for disruptions. It can either be set to\nan integer (e.g., 1) or a percentage value (e.g., 25%).\nCannot be used if `minAvailable` is set."
     },
     "helm-values.cainjector.podDisruptionBudget.minAvailable": {
-      "description": "`minAvailable` configures the minimum available pods for disruptions. It can either be set to\nan integer (e.g. 1) or a percentage value (e.g. 25%).\nCannot be used if `maxUnavailable` is set."
+      "description": "`minAvailable` configures the minimum available pods for disruptions. It can either be set to\nan integer (e.g., 1) or a percentage value (e.g., 25%).\nCannot be used if `maxUnavailable` is set."
     },
     "helm-values.cainjector.podLabels": {
       "default": {},
@@ -579,7 +579,7 @@
     },
     "helm-values.config": {
       "default": {},
-      "description": "This property is used to configure options for the controller pod. This allows setting options that would usually be provided using flags.\n\nIf `apiVersion` and `kind` are unspecified they default to the current latest version (currently `controller.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.\n\nFor example:\nconfig:\n  apiVersion: controller.config.cert-manager.io/v1alpha1\n  kind: ControllerConfiguration\n  logging:\n    verbosity: 2\n    format: text\n  leaderElectionConfig:\n    namespace: kube-system\n  kubernetesAPIQPS: 9000\n  kubernetesAPIBurst: 9000\n  numberOfConcurrentWorkers: 200\n  enableGatewayAPI: true\n  # Feature gates as of v1.17.0. Listed with their default values.\n  # See https://cert-manager.io/docs/cli/controller/\n  featureGates:\n    AdditionalCertificateOutputFormats: true # BETA - default=true\n    AllAlpha: false # ALPHA - default=false\n    AllBeta: false # BETA - default=false\n    ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false\n    ExperimentalGatewayAPISupport: true # BETA - default=true\n    LiteralCertificateSubject: true # BETA - default=true\n    NameConstraints: true # BETA - default=true\n    OtherNames: false # ALPHA - default=false\n    SecretsFilteredCaching: true # BETA - default=true\n    ServerSideApply: false # ALPHA - default=false\n    StableCertificateRequestName: true # BETA - default=true\n    UseCertificateRequestBasicConstraints: false # ALPHA - default=false\n    UseDomainQualifiedFinalizer: true # BETA - default=false\n    ValidateCAA: false # ALPHA - default=false\n  # Configure the metrics server for TLS\n  # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls\n  metricsTLSConfig:\n    dynamic:\n      secretNamespace: \"cert-manager\"\n      secretName: \"cert-manager-metrics-ca\"\n      dnsNames:\n      - cert-manager-metrics",
+      "description": "This property is used to configure options for the controller pod. This allows setting options that would usually be provided using flags.\n\nIf `apiVersion` and `kind` are unspecified they default to the current latest version (currently `controller.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.\n\nFor example:\nconfig:\n  apiVersion: controller.config.cert-manager.io/v1alpha1\n  kind: ControllerConfiguration\n  logging:\n    verbosity: 2\n    format: text\n  leaderElectionConfig:\n    namespace: kube-system\n  kubernetesAPIQPS: 9000\n  kubernetesAPIBurst: 9000\n  numberOfConcurrentWorkers: 200\n  enableGatewayAPI: true\n  # Feature gates as of v1.18.1. Listed with their default values.\n  # See https://cert-manager.io/docs/cli/controller/\n  featureGates:\n    AdditionalCertificateOutputFormats: true # GA - default=true\n    AllAlpha: false # ALPHA - default=false\n    AllBeta: false # BETA - default=false\n    ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false\n    ExperimentalGatewayAPISupport: true # BETA - default=true\n    LiteralCertificateSubject: true # BETA - default=true\n    NameConstraints: true # BETA - default=true\n    OtherNames: false # ALPHA - default=false\n    SecretsFilteredCaching: true # BETA - default=true\n    ServerSideApply: false # ALPHA - default=false\n    StableCertificateRequestName: true # BETA - default=true\n    UseCertificateRequestBasicConstraints: false # ALPHA - default=false\n    UseDomainQualifiedFinalizer: true # GA - default=true\n    ValidateCAA: false # ALPHA - default=false\n    DefaultPrivateKeyRotationPolicyAlways: true # BETA - default=true\n    ACMEHTTP01IngressPathTypeExact: true # BETA - default=true\n  # Configure the metrics server for TLS\n  # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls\n  metricsTLSConfig:\n    dynamic:\n      secretNamespace: \"cert-manager\"\n      secretName: \"cert-manager-metrics-ca\"\n      dnsNames:\n      - cert-manager-metrics",
       "type": "object"
     },
     "helm-values.containerSecurityContext": {
@@ -689,6 +689,9 @@
         "commonLabels": {
           "$ref": "#/$defs/helm-values.global.commonLabels"
         },
+        "hostUsers": {
+          "$ref": "#/$defs/helm-values.global.hostUsers"
+        },
         "imagePullSecrets": {
           "$ref": "#/$defs/helm-values.global.imagePullSecrets"
         },
@@ -698,6 +701,9 @@
         "logLevel": {
           "$ref": "#/$defs/helm-values.global.logLevel"
         },
+        "nodeSelector": {
+          "$ref": "#/$defs/helm-values.global.nodeSelector"
+        },
         "podSecurityPolicy": {
           "$ref": "#/$defs/helm-values.global.podSecurityPolicy"
         },
@@ -718,6 +724,10 @@
       "description": "Labels to apply to all resources.\nPlease note that this does not add labels to the resources created dynamically by the controllers. For these resources, you have to add the labels in the template in the cert-manager custom resource: For example, podTemplate/ ingressTemplate in ACMEChallengeSolverHTTP01Ingress. For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#acme.cert-manager.io/v1.ACMEChallengeSolverHTTP01Ingress).\nFor example, secretTemplate in CertificateSpec\nFor more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec).",
       "type": "object"
     },
+    "helm-values.global.hostUsers": {
+      "description": "Set all pods to run in a user namespace without host access. Experimental: may be removed once the Kubernetes User Namespaces feature is GA.\n\nRequirements:\n  - Kubernetes ≥ 1.33, or\n  - Kubernetes 1.27–1.32 with UserNamespacesSupport feature gate enabled.\n\nSet to false to run pods in a user namespace without host access.\n\nSee [limitations](https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/#limitations) for details.",
+      "type": "boolean"
+    },
     "helm-values.global.imagePullSecrets": {
       "default": [],
       "description": "Reference to one or more secrets to be used when pulling images. For more information, see [Pull an Image from a Private Registry](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/).\n\nFor example:\nimagePullSecrets:\n  - name: \"image-pull-secret\"",
@@ -763,6 +773,11 @@
       "description": "Set the verbosity of cert-manager. A range of 0 - 6, with 6 being the most verbose.",
       "type": "number"
     },
+    "helm-values.global.nodeSelector": {
+      "default": {},
+      "description": "Global node selector\n\nThe nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).\n\nIf a component-specific nodeSelector is also set, it will be merged and take precedence.",
+      "type": "object"
+    },
     "helm-values.global.podSecurityPolicy": {
       "properties": {
         "enabled": {
@@ -921,7 +936,7 @@
       "type": "number"
     },
     "helm-values.nameOverride": {
-      "description": "Override the \"cert-manager.name\" value, which is used to annotate some of the resources that are created by this Chart (using \"app.kubernetes.io/name\"). NOTE: There are some inconsistencies in the Helm chart when it comes to these annotations (some resources use eg. \"cainjector.name\" which resolves to the value \"cainjector\").",
+      "description": "Override the \"cert-manager.name\" value, which is used to annotate some of the resources that are created by this Chart (using \"app.kubernetes.io/name\"). NOTE: There are some inconsistencies in the Helm chart when it comes to these annotations (some resources use, e.g., \"cainjector.name\" which resolves to the value \"cainjector\").",
       "type": "string"
     },
     "helm-values.namespace": {
@@ -965,10 +980,10 @@
       "type": "boolean"
     },
     "helm-values.podDisruptionBudget.maxUnavailable": {
-      "description": "This configures the maximum unavailable pods for disruptions. It can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%). it cannot be used if `minAvailable` is set."
+      "description": "This configures the maximum unavailable pods for disruptions. It can either be set to an integer (e.g., 1) or a percentage value (e.g., 25%). it cannot be used if `minAvailable` is set."
     },
     "helm-values.podDisruptionBudget.minAvailable": {
-      "description": "This configures the minimum available pods for disruptions. It can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%).\nIt cannot be used if `maxUnavailable` is set."
+      "description": "This configures the minimum available pods for disruptions. It can either be set to an integer (e.g., 1) or a percentage value (e.g., 25%).\nIt cannot be used if `maxUnavailable` is set."
     },
     "helm-values.podDnsConfig": {
       "description": "Pod DNS configuration. The podDnsConfig field is optional and can work with any podDnsPolicy settings. However, when a Pod's dnsPolicy is set to \"None\", the dnsConfig field has to be specified. For more information, see [Pod's DNS Config](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config).",
@@ -1000,7 +1015,7 @@
     },
     "helm-values.prometheus.enabled": {
       "default": true,
-      "description": "Enable Prometheus monitoring for the cert-manager controller and webhook. If you use the Prometheus Operator, set prometheus.podmonitor.enabled or prometheus.servicemonitor.enabled, to create a PodMonitor or a\nServiceMonitor resource.\nOtherwise, 'prometheus.io' annotations are added to the cert-manager and cert-manager-webhook Deployments. Note that you can not enable both PodMonitor and ServiceMonitor as they are mutually exclusive. Enabling both will result in an error.",
+      "description": "Enable Prometheus monitoring for the cert-manager controller and webhook. If you use the Prometheus Operator, set prometheus.podmonitor.enabled or prometheus.servicemonitor.enabled, to create a PodMonitor or a\nServiceMonitor resource.\nOtherwise, 'prometheus.io' annotations are added to the cert-manager and cert-manager-webhook Deployments. Note that you cannot enable both PodMonitor and ServiceMonitor as they are mutually exclusive. Enabling both will result in an error.",
       "type": "boolean"
     },
     "helm-values.prometheus.podmonitor": {
@@ -1177,9 +1192,8 @@
       "type": "string"
     },
     "helm-values.prometheus.servicemonitor.targetPort": {
-      "default": 9402,
-      "description": "The target port to set on the ServiceMonitor. This must match the port that the cert-manager controller is listening on for metrics.",
-      "type": "number"
+      "default": "http-metrics",
+      "description": "The target port to set on the ServiceMonitor. This must match the port that the cert-manager controller is listening on for metrics."
     },
     "helm-values.replicaCount": {
       "default": 1,
@@ -1887,6 +1901,11 @@
               "ipBlock": {
                 "cidr": "0.0.0.0/0"
               }
+            },
+            {
+              "ipBlock": {
+                "cidr": "::/0"
+              }
             }
           ]
         }
@@ -1908,6 +1927,11 @@
               "ipBlock": {
                 "cidr": "0.0.0.0/0"
               }
+            },
+            {
+              "ipBlock": {
+                "cidr": "::/0"
+              }
             }
           ]
         }
@@ -1948,10 +1972,10 @@
       "type": "boolean"
     },
     "helm-values.webhook.podDisruptionBudget.maxUnavailable": {
-      "description": "This property configures the maximum unavailable pods for disruptions. Can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%).\nIt cannot be used if `minAvailable` is set."
+      "description": "This property configures the maximum unavailable pods for disruptions. Can either be set to an integer (e.g., 1) or a percentage value (e.g., 25%).\nIt cannot be used if `minAvailable` is set."
     },
     "helm-values.webhook.podDisruptionBudget.minAvailable": {
-      "description": "This property configures the minimum available pods for disruptions. Can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%).\nIt cannot be used if `maxUnavailable` is set."
+      "description": "This property configures the minimum available pods for disruptions. Can either be set to an integer (e.g., 1) or a percentage value (e.g., 25%).\nIt cannot be used if `maxUnavailable` is set."
     },
     "helm-values.webhook.podLabels": {
       "default": {},
diff --git a/packages/system/cert-manager/charts/cert-manager/values.yaml b/packages/system/cert-manager/charts/cert-manager/values.yaml
index a8c94f8b..54257c79 100644
--- a/packages/system/cert-manager/charts/cert-manager/values.yaml
+++ b/packages/system/cert-manager/charts/cert-manager/values.yaml
@@ -12,6 +12,16 @@ global:
   #    - name: "image-pull-secret"
   imagePullSecrets: []
 
+  # Global node selector
+  #
+  # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
+  # matching labels.
+  # For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
+  #
+  # If a component-specific nodeSelector is also set, it will be merged and take precedence.
+  # +docs:property
+  nodeSelector: {}
+  
   # Labels to apply to all resources.
   # Please note that this does not add labels to the resources created dynamically by the controllers.
   # For these resources, you have to add the labels in the template in the cert-manager custom resource:
@@ -28,6 +38,19 @@ global:
   # The optional priority class to be used for the cert-manager pods.
   priorityClassName: ""
 
+  # Set all pods to run in a user namespace without host access.
+  # Experimental: may be removed once the Kubernetes User Namespaces feature is GA.
+  #
+  # Requirements:
+  #   - Kubernetes ≥ 1.33, or
+  #   - Kubernetes 1.27–1.32 with UserNamespacesSupport feature gate enabled.
+  #
+  # Set to false to run pods in a user namespace without host access.
+  #
+  # See [limitations](https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/#limitations) for details.
+  # +docs:property
+  # hostUsers: false
+
   rbac:
     # Create required ClusterRoles and ClusterRoleBindings for cert-manager.
     create: true
@@ -117,14 +140,14 @@ podDisruptionBudget:
   enabled: false
 
   # This configures the minimum available pods for disruptions. It can either be set to
-  # an integer (e.g. 1) or a percentage value (e.g. 25%).
+  # an integer (e.g., 1) or a percentage value (e.g., 25%).
   # It cannot be used if `maxUnavailable` is set.
   # +docs:property
   # +docs:type=unknown
   # minAvailable: 1
 
   # This configures the maximum unavailable pods for disruptions. It can either be set to
-  # an integer (e.g. 1) or a percentage value (e.g. 25%).
+  # an integer (e.g., 1) or a percentage value (e.g., 25%).
   # it cannot be used if `minAvailable` is set.
   # +docs:property
   # +docs:type=unknown
@@ -176,7 +199,7 @@ namespace: ""
 # Override the "cert-manager.name" value, which is used to annotate some of
 # the resources that are created by this Chart (using "app.kubernetes.io/name").
 # NOTE: There are some inconsistencies in the Helm chart when it comes to
-# these annotations (some resources use eg. "cainjector.name" which resolves
+# these annotations (some resources use, e.g., "cainjector.name" which resolves
 # to the value "cainjector").
 # +docs:property
 # nameOverride: "my-cert-manager"
@@ -231,10 +254,10 @@ enableCertificateOwnerRef: false
 #    kubernetesAPIBurst: 9000
 #    numberOfConcurrentWorkers: 200
 #    enableGatewayAPI: true
-#    # Feature gates as of v1.17.0. Listed with their default values.
+#    # Feature gates as of v1.18.1. Listed with their default values.
 #    # See https://cert-manager.io/docs/cli/controller/
 #    featureGates:
-#      AdditionalCertificateOutputFormats: true # BETA - default=true
+#      AdditionalCertificateOutputFormats: true # GA - default=true
 #      AllAlpha: false # ALPHA - default=false
 #      AllBeta: false # BETA - default=false
 #      ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false
@@ -246,8 +269,10 @@ enableCertificateOwnerRef: false
 #      ServerSideApply: false # ALPHA - default=false
 #      StableCertificateRequestName: true # BETA - default=true
 #      UseCertificateRequestBasicConstraints: false # ALPHA - default=false
-#      UseDomainQualifiedFinalizer: true # BETA - default=false
+#      UseDomainQualifiedFinalizer: true # GA - default=true
 #      ValidateCAA: false # ALPHA - default=false
+#      DefaultPrivateKeyRotationPolicyAlways: true # BETA - default=true
+#      ACMEHTTP01IngressPathTypeExact: true # BETA - default=true
 #    # Configure the metrics server for TLS
 #    # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
 #    metricsTLSConfig:
@@ -278,7 +303,7 @@ disableAutoApproval: false
 # referencing these signer names will be auto-approved by cert-manager. Defaults to just
 # approving the cert-manager.io Issuer and ClusterIssuer issuers. When set to an empty
 # array, ALL issuers will be auto-approved by cert-manager. To disable the auto-approval,
-# because eg. you are using approver-policy, you can enable 'disableAutoApproval'.
+# because, e.g., you are using approver-policy, you can enable 'disableAutoApproval'.
 # ref: https://cert-manager.io/docs/concepts/certificaterequest/#approval
 # +docs:property
 approveSignerNames:
@@ -434,7 +459,6 @@ ingressShim: {}
 # +docs:property
 # no_proxy: 127.0.0.1,localhost
 
-
 # A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
 #
 # For example:
@@ -502,7 +526,7 @@ prometheus:
   # ServiceMonitor resource.
   # Otherwise, 'prometheus.io' annotations are added to the cert-manager and
   # cert-manager-webhook Deployments.
-  # Note that you can not enable both PodMonitor and ServiceMonitor as they are
+  # Note that you cannot enable both PodMonitor and ServiceMonitor as they are
   # mutually exclusive. Enabling both will result in an error.
   enabled: true
 
@@ -522,7 +546,8 @@ prometheus:
 
     # The target port to set on the ServiceMonitor. This must match the port that the
     # cert-manager controller is listening on for metrics.
-    targetPort: 9402
+    # +docs:type=string,integer
+    targetPort: http-metrics
 
     # The path to scrape for metrics.
     path: /metrics
@@ -556,7 +581,7 @@ prometheus:
     # +docs:property
     endpointAdditionalProperties: {}
 
-  # Note that you can not enable both PodMonitor and ServiceMonitor as they are mutually exclusive. Enabling both will result in an error.
+  # Note that you cannot enable both PodMonitor and ServiceMonitor as they are mutually exclusive. Enabling both will result in an error.
   podmonitor:
     # Create a PodMonitor to add cert-manager to Prometheus.
     enabled: false
@@ -706,14 +731,14 @@ webhook:
     enabled: false
 
     # This property configures the minimum available pods for disruptions. Can either be set to
-    # an integer (e.g. 1) or a percentage value (e.g. 25%).
+    # an integer (e.g., 1) or a percentage value (e.g., 25%).
     # It cannot be used if `maxUnavailable` is set.
     # +docs:property
     # +docs:type=unknown
     # minAvailable: 1
 
     # This property configures the maximum unavailable pods for disruptions. Can either be set to
-    # an integer (e.g. 1) or a percentage value (e.g. 25%).
+    # an integer (e.g., 1) or a percentage value (e.g., 25%).
     # It cannot be used if `minAvailable` is set.
     # +docs:property
     # +docs:type=unknown
@@ -959,6 +984,8 @@ webhook:
     - from:
       - ipBlock:
           cidr: 0.0.0.0/0
+      - ipBlock:
+          cidr: "::/0"
 
     # Egress rule for the webhook network policy. By default, it allows all
     # outbound traffic to ports 80 and 443, as well as DNS ports.
@@ -980,6 +1007,8 @@ webhook:
       to:
       - ipBlock:
           cidr: 0.0.0.0/0
+      - ipBlock:
+          cidr: "::/0"
 
   # Additional volumes to add to the cert-manager controller pod.
   volumes: []
@@ -1073,14 +1102,14 @@ cainjector:
     enabled: false
 
     # `minAvailable` configures the minimum available pods for disruptions. It can either be set to
-    # an integer (e.g. 1) or a percentage value (e.g. 25%).
+    # an integer (e.g., 1) or a percentage value (e.g., 25%).
     # Cannot be used if `maxUnavailable` is set.
     # +docs:property
     # +docs:type=unknown
     # minAvailable: 1
 
     # `maxUnavailable` configures the maximum unavailable pods for disruptions. It can either be set to
-    # an integer (e.g. 1) or a percentage value (e.g. 25%).
+    # an integer (e.g., 1) or a percentage value (e.g., 25%).
     # Cannot be used if `minAvailable` is set.
     # +docs:property
     # +docs:type=unknown
diff --git a/packages/system/cert-manager/values.yaml b/packages/system/cert-manager/values.yaml
index 5accf95f..e69de29b 100644
--- a/packages/system/cert-manager/values.yaml
+++ b/packages/system/cert-manager/values.yaml
@@ -1,2 +0,0 @@
-cert-manager:
-  installCRDs: false

From 4734f65f90325ab0f2511cee437fedeb5c9acb17 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Thu, 26 Feb 2026 18:32:35 +0500
Subject: [PATCH 171/666] [cert-manager] Added cleanup before crds upgrade

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/system/cert-manager/Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/system/cert-manager/Makefile b/packages/system/cert-manager/Makefile
index bda6e1fe..c3ff574b 100644
--- a/packages/system/cert-manager/Makefile
+++ b/packages/system/cert-manager/Makefile
@@ -8,5 +8,6 @@ update:
 	helm repo add jetstack https://charts.jetstack.io
 	helm repo update jetstack
 	helm pull jetstack/cert-manager --untar --untardir charts
+	rm -rf ../cert-manager-crds/templates/*
 	mv charts/cert-manager/templates/crd-*.yaml ../cert-manager-crds/templates/
 	cp charts/cert-manager/templates/_helpers.tpl ../cert-manager-crds/templates/

From 66a61bd63eb8fd1b850126804351e2bff38c76e2 Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Thu, 26 Feb 2026 15:17:04 +0000
Subject: [PATCH 172/666] Prepare release v1.0.0

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 packages/apps/kubernetes/images/cluster-autoscaler.tag      | 2 +-
 packages/core/installer/values.yaml                         | 4 ++--
 packages/core/platform/values.yaml                          | 2 +-
 packages/core/testing/values.yaml                           | 2 +-
 packages/extra/bootbox/images/matchbox.tag                  | 2 +-
 packages/extra/seaweedfs/images/objectstorage-sidecar.tag   | 2 +-
 packages/system/backup-controller/values.yaml               | 2 +-
 packages/system/backupstrategy-controller/values.yaml       | 2 +-
 packages/system/cozystack-api/values.yaml                   | 2 +-
 packages/system/cozystack-controller/values.yaml            | 2 +-
 packages/system/dashboard/templates/configmap.yaml          | 2 +-
 packages/system/dashboard/values.yaml                       | 6 +++---
 .../system/grafana-operator/images/grafana-dashboards.tag   | 2 +-
 packages/system/kamaji/values.yaml                          | 4 ++--
 packages/system/kubeovn-plunger/values.yaml                 | 2 +-
 packages/system/kubeovn-webhook/values.yaml                 | 2 +-
 packages/system/lineage-controller-webhook/values.yaml      | 2 +-
 packages/system/linstor/values.yaml                         | 2 +-
 packages/system/objectstorage-controller/values.yaml        | 2 +-
 packages/system/seaweedfs/values.yaml                       | 2 +-
 20 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/packages/apps/kubernetes/images/cluster-autoscaler.tag b/packages/apps/kubernetes/images/cluster-autoscaler.tag
index c3d6ddef..22598190 100644
--- a/packages/apps/kubernetes/images/cluster-autoscaler.tag
+++ b/packages/apps/kubernetes/images/cluster-autoscaler.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/cluster-autoscaler:0.0.0@sha256:7deeee117e7eec599cb453836ca95eadd131dfc8c875dc457ef29dc1433395e0
+ghcr.io/cozystack/cozystack/cluster-autoscaler:0.0.0@sha256:3753b735b0315bee90de54cb25cfebc63bd2cc90ad11ca4fdc0e70439abd5096
diff --git a/packages/core/installer/values.yaml b/packages/core/installer/values.yaml
index 0e142387..97cf44a7 100644
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -1,9 +1,9 @@
 cozystackOperator:
   # Deployment variant: talos, generic, hosted
   variant: talos
-  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.0.0-rc.2@sha256:e3fc5fc87761c31ee522f36420aa69683815d4057146be5d0fd4b5104ede8eae
+  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.0.0@sha256:9e5229764b6077809a1c16566881a524c33e8986e36597e6833f8857a7e6a335
   platformSourceUrl: 'oci://ghcr.io/cozystack/cozystack/cozystack-packages'
-  platformSourceRef: 'digest=sha256:5a03183c490e0d932207b010b94c0e38350652d75e13ef5a582fa818077043bb'
+  platformSourceRef: 'digest=sha256:ef3e4ba7d21572a61794d8be594805f063aa04f4a8c3753351fc89c7804d337e'
 # Generic variant configuration (only used when cozystackOperator.variant=generic)
 cozystack:
   # Kubernetes API server host (IP only, no protocol/port)
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index 83c01ecb..155cc78a 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -5,7 +5,7 @@ sourceRef:
   path: /
 migrations:
   enabled: false
-  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0-rc.2@sha256:68dabdebc38ac439228ae07031cc70e0fa184a24bd4e5b3b22c17466b2a55201
+  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0@sha256:68dabdebc38ac439228ae07031cc70e0fa184a24bd4e5b3b22c17466b2a55201
   targetVersion: 34
 # Bundle deployment configuration
 bundles:
diff --git a/packages/core/testing/values.yaml b/packages/core/testing/values.yaml
index bfa830ac..0dafd67e 100644
--- a/packages/core/testing/values.yaml
+++ b/packages/core/testing/values.yaml
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.0.0-rc.2@sha256:0eae9f519669667d60b160ebb93c127843c470ad9ca3447fceaa54604503a7ba
+  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.0.0@sha256:0eae9f519669667d60b160ebb93c127843c470ad9ca3447fceaa54604503a7ba
diff --git a/packages/extra/bootbox/images/matchbox.tag b/packages/extra/bootbox/images/matchbox.tag
index aad6f3ec..2305d665 100644
--- a/packages/extra/bootbox/images/matchbox.tag
+++ b/packages/extra/bootbox/images/matchbox.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/matchbox:v1.0.0-rc.2@sha256:9f9cacb1e8e9c74c50f7e2d944e50ffb3efd0a7c6365f47c40a327d072e8c9cd
+ghcr.io/cozystack/cozystack/matchbox:v1.0.0@sha256:c48eb7b23f01a8ff58d409fdb51c88e771f819cb914eee03da89471e62302f33
diff --git a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
index 233de89e..5f97d6ba 100644
--- a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
+++ b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-rc.2@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0
+ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0@sha256:2a3595cd88b30af55b2000d3ca204899beecef0012b0e0402754c3914aad1f7f
diff --git a/packages/system/backup-controller/values.yaml b/packages/system/backup-controller/values.yaml
index 2b03c247..5b3d5d8f 100644
--- a/packages/system/backup-controller/values.yaml
+++ b/packages/system/backup-controller/values.yaml
@@ -1,5 +1,5 @@
 backupController:
-  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.0.0-rc.2@sha256:0959df20e3422cd90a4f995873c0bcef57355984542eb5344c4937dced170c61"
+  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.0.0@sha256:e1a6c8ac7ba64442812464b59c53e782e373a339c18b379c2692921b44c6edb5"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/backupstrategy-controller/values.yaml b/packages/system/backupstrategy-controller/values.yaml
index ee85be3d..4843a679 100644
--- a/packages/system/backupstrategy-controller/values.yaml
+++ b/packages/system/backupstrategy-controller/values.yaml
@@ -1,5 +1,5 @@
 backupStrategyController:
-  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.0.0-rc.2@sha256:6f2cc68e0146aec114afb0d20ee0f95d90d539d5a4d6cf8b54c878389fba3c8e"
+  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.0.0@sha256:29735d945c69c6bbaab21068bf4ea30f6b63f4c71a7a8d95590f370abcb4b328"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/cozystack-api/values.yaml b/packages/system/cozystack-api/values.yaml
index ba97e22a..394355c3 100644
--- a/packages/system/cozystack-api/values.yaml
+++ b/packages/system/cozystack-api/values.yaml
@@ -1,3 +1,3 @@
 cozystackAPI:
-  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.0.0-rc.2@sha256:5b05ca6621888da5309cbd743c30186d518c9d67161a432890777988ec9e6604
+  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.0.0@sha256:bd70ecb944bde9a0d6b88114aea89bdbbe2d07e33f03175cfd885de013e88294
   replicas: 2
diff --git a/packages/system/cozystack-controller/values.yaml b/packages/system/cozystack-controller/values.yaml
index af556329..54243320 100644
--- a/packages/system/cozystack-controller/values.yaml
+++ b/packages/system/cozystack-controller/values.yaml
@@ -1,4 +1,4 @@
 cozystackController:
-  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.0.0-rc.2@sha256:04511034749f7e3bfc30bef6492eae17890d09e57609a4ed8065d9081e87fa88
+  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.0.0@sha256:da01085026a4a01514ae435c7bfb48cca2cf00eb17feb2ed7ae88711f82693e0
   debug: false
   disableTelemetry: false
diff --git a/packages/system/dashboard/templates/configmap.yaml b/packages/system/dashboard/templates/configmap.yaml
index ade2c3a0..e89d6a5f 100644
--- a/packages/system/dashboard/templates/configmap.yaml
+++ b/packages/system/dashboard/templates/configmap.yaml
@@ -1,6 +1,6 @@
 {{- $brandingConfig := .Values._cluster.branding | default dict }}
 
-{{- $tenantText := "v1.0.0-rc.2" }}
+{{- $tenantText := "v1.0.0" }}
 {{- $footerText := "Cozystack" }}
 {{- $titleText := "Cozystack Dashboard" }}
 {{- $logoText := "" }}
diff --git a/packages/system/dashboard/values.yaml b/packages/system/dashboard/values.yaml
index 8f4b178e..244d0b31 100644
--- a/packages/system/dashboard/values.yaml
+++ b/packages/system/dashboard/values.yaml
@@ -1,6 +1,6 @@
 openapiUI:
-  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.0.0-rc.2@sha256:3138ad113fbf5a04b43629a4633987eeb298c921679c079595b11f450c43e9b6
+  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.0.0@sha256:73a8bd4283a46a99d22536eece9c2059fa2fb1c17b43ddefe6716e8960e4731e
 openapiUIK8sBff:
-  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.0.0-rc.2@sha256:325de4753a9a21ebef61637c1cf32cc98559d4bc506980ce5155c11513f7dcba
+  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.0.0@sha256:c938fee904acd948800d4dc5e121c4c5cd64cb4a3160fb8d2f9dbff0e5168740
 tokenProxy:
-  image: ghcr.io/cozystack/cozystack/token-proxy:v1.0.0-rc.2@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
+  image: ghcr.io/cozystack/cozystack/token-proxy:v1.0.0@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
diff --git a/packages/system/grafana-operator/images/grafana-dashboards.tag b/packages/system/grafana-operator/images/grafana-dashboards.tag
index ab4d20b9..b1eac607 100644
--- a/packages/system/grafana-operator/images/grafana-dashboards.tag
+++ b/packages/system/grafana-operator/images/grafana-dashboards.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/grafana-dashboards:v1.0.0-rc.2@sha256:7a3c9af59f8d74d5a23750bbc845c7de64610dbd4d4f84011e10be037b3ce2a0
+ghcr.io/cozystack/cozystack/grafana-dashboards:v1.0.0@sha256:7a3c9af59f8d74d5a23750bbc845c7de64610dbd4d4f84011e10be037b3ce2a0
diff --git a/packages/system/kamaji/values.yaml b/packages/system/kamaji/values.yaml
index bd0ff4e8..4a1d30b1 100644
--- a/packages/system/kamaji/values.yaml
+++ b/packages/system/kamaji/values.yaml
@@ -3,7 +3,7 @@ kamaji:
     deploy: false
   image:
     pullPolicy: IfNotPresent
-    tag: v1.0.0-rc.2@sha256:69e00bbed5dedbd57f6c0e9d02d1c32b96d5ca1379d6b3af9338a3a8e5e9f6ab
+    tag: v1.0.0@sha256:50db517ebe7698083dd32223a96c987b6ed0c88d3a093969beb571e4a96d18e4
     repository: ghcr.io/cozystack/cozystack/kamaji
   resources:
     limits:
@@ -13,4 +13,4 @@ kamaji:
       cpu: 100m
       memory: 100Mi
   extraArgs:
-    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.0.0-rc.2@sha256:69e00bbed5dedbd57f6c0e9d02d1c32b96d5ca1379d6b3af9338a3a8e5e9f6ab
+    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.0.0@sha256:50db517ebe7698083dd32223a96c987b6ed0c88d3a093969beb571e4a96d18e4
diff --git a/packages/system/kubeovn-plunger/values.yaml b/packages/system/kubeovn-plunger/values.yaml
index 47b66258..690e0421 100644
--- a/packages/system/kubeovn-plunger/values.yaml
+++ b/packages/system/kubeovn-plunger/values.yaml
@@ -1,4 +1,4 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.0.0-rc.2@sha256:64a668dd7f23de401514f41dd58a10e98b2bc3649eb4396e2e8332309e5b6454
+image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.0.0@sha256:b6045fdb4f324b9b1cb44a218c40422aafbbc600b085c819ff58809bb6e97220
 ovnCentralName: ovn-central
diff --git a/packages/system/kubeovn-webhook/values.yaml b/packages/system/kubeovn-webhook/values.yaml
index df760329..ac6dd5db 100644
--- a/packages/system/kubeovn-webhook/values.yaml
+++ b/packages/system/kubeovn-webhook/values.yaml
@@ -1,3 +1,3 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.0.0-rc.2@sha256:e18f9fd679e38f65362a8d0042f25468272f6d081136ad47027168d8e7e07a4a
+image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.0.0@sha256:e18f9fd679e38f65362a8d0042f25468272f6d081136ad47027168d8e7e07a4a
diff --git a/packages/system/lineage-controller-webhook/values.yaml b/packages/system/lineage-controller-webhook/values.yaml
index 805f8f94..46ccd4f4 100644
--- a/packages/system/lineage-controller-webhook/values.yaml
+++ b/packages/system/lineage-controller-webhook/values.yaml
@@ -1,5 +1,5 @@
 lineageControllerWebhook:
-  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.0.0-rc.2@sha256:f0e6e2d767301c80e6f05d505a5bb7864c3e370ef13e0ba22d46ff3f23c39d72
+  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.0.0@sha256:af765c2829db4f513084522a384710acc321bd4a332eaf7fe814fecacea1022f
   debug: false
   localK8sAPIEndpoint:
     enabled: true
diff --git a/packages/system/linstor/values.yaml b/packages/system/linstor/values.yaml
index 88511bd0..3e6b7af5 100644
--- a/packages/system/linstor/values.yaml
+++ b/packages/system/linstor/values.yaml
@@ -13,4 +13,4 @@ linstor:
 linstorCSI:
   image:
     repository: ghcr.io/cozystack/cozystack/linstor-csi
-    tag: v1.10.5@sha256:3eb68a89decdf8ea8a3944bec288c179719f84ed7237849b561cf043cb0482f5
+    tag: v1.10.5@sha256:c87b6f6dadaa6e3a3643d3279e81742830147f6c38f99e9232d9780abbcac897
diff --git a/packages/system/objectstorage-controller/values.yaml b/packages/system/objectstorage-controller/values.yaml
index e39580c9..f95a193d 100644
--- a/packages/system/objectstorage-controller/values.yaml
+++ b/packages/system/objectstorage-controller/values.yaml
@@ -1,3 +1,3 @@
 objectstorage:
   controller:
-    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.0.0-rc.2@sha256:b4c972769afda76c48b58e7acf0ac66a0abf16a622f245c60338f432872f640a"
+    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.0.0@sha256:e40e94f3014cfd04cce4230597315a1acfcca2daa8051b987614d0c05da6d928"
diff --git a/packages/system/seaweedfs/values.yaml b/packages/system/seaweedfs/values.yaml
index 5119bb23..708033d2 100644
--- a/packages/system/seaweedfs/values.yaml
+++ b/packages/system/seaweedfs/values.yaml
@@ -177,7 +177,7 @@ seaweedfs:
     bucketClassName: "seaweedfs"
     region: ""
     sidecar:
-      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0-rc.2@sha256:235b194a531b70e266a10ef78d2955d19f5b659513f23d8b3cfbbc0dff7fc1c0"
+      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0@sha256:2a3595cd88b30af55b2000d3ca204899beecef0012b0e0402754c3914aad1f7f"
   certificates:
     commonName: "SeaweedFS CA"
     ipAddresses: []

From 00f0c7bc41a711988d9d5d0f9d19031ac75037ba Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Thu, 26 Feb 2026 15:29:21 +0000
Subject: [PATCH 173/666] docs: add changelog for v1.0.0

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.0.0.md | 289 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 289 insertions(+)
 create mode 100644 docs/changelogs/v1.0.0.md

diff --git a/docs/changelogs/v1.0.0.md b/docs/changelogs/v1.0.0.md
new file mode 100644
index 00000000..469ea1db
--- /dev/null
+++ b/docs/changelogs/v1.0.0.md
@@ -0,0 +1,289 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.0.0
+-->
+
+# Cozystack v1.0.0 — "Stable"
+
+We are thrilled to announce **Cozystack v1.0.0**, the first stable major release of the Cozystack platform. This milestone represents a fundamental architectural evolution from the v0.x series, introducing a fully operator-driven package management system, a comprehensive backup and restore framework, a redesigned virtual machine architecture, and a rich set of new managed applications — all hardened through an extensive alpha, beta, and release-candidate cycle.
+
+## Feature Highlights
+
+### Package-Based Architecture with Cozystack Operator
+
+The most significant architectural change in v1.0.0 is the replacement of HelmRelease bundle deployments with a declarative **Package** and **PackageSource** model managed by the new `cozystack-operator`. Operators now define their platform configuration in a structured `values.yaml` and the operator reconciles the desired state by managing Package and PackageSource resources across the cluster.
+
+The operator also takes ownership of CRD lifecycle — installing and updating CRDs from embedded manifests at every startup — eliminating the stale-CRD problem that affected Helm-only installations. Flux sharding has been added to distribute tenant HelmRelease reconciliation across multiple Flux controllers, providing horizontal scalability in large multi-tenant environments.
+
+A migration script (`hack/migrate-to-version-1.0.sh`) is provided for upgrading existing v0.x clusters, along with 33 incremental migration steps that automate resource renaming, secret cleanup, and configuration conversion.
+
+### Comprehensive Backup and Restore System
+
+v1.0.0 ships a fully featured, production-ready backup and restore framework built on Velero integration. Users can define **BackupClass** resources to describe backup storage targets, create **BackupPlan** schedules, and trigger **RestoreJob** resources for end-to-end application recovery.
+
+Virtual machine backups are supported natively via the Velero KubeVirt plugin, which captures consistent VM disk snapshots alongside metadata. The backup controller and the backup strategy sub-controllers (including the VM-specific strategy) are installed by default, and a full dashboard UI allows users to monitor backup status, view backup job history, and initiate restore workflows.
+
+### Redesigned Virtual Machine Architecture
+
+The legacy `virtual-machine` application has been replaced with a two-resource architecture: **`vm-disk`** for managing persistent disks and **`vm-instance`** for managing VM lifecycle. This separation provides cleaner disk/instance management, allows disks to be reused across VM instances, and aligns with modern KubeVirt patterns.
+
+New capabilities include: a `cpuModel` field for direct CPU model specification without using an instanceType; the ability to switch between `instanceType`-based and custom resource-based configurations; migration from the deprecated `running` field to `runStrategy`; and native **RWX (NFS) filesystem support** in the KubeVirt CSI driver, enabling multiple pods to mount the same persistent volume simultaneously.
+
+### New Managed Applications
+
+v1.0.0 expands the application catalog significantly:
+
+- **MongoDB**: A fully managed MongoDB replica set with persistent storage, monitoring integration, and unified user/database configuration API.
+- **Qdrant**: A high-performance vector database for AI and machine learning workloads, supporting single-replica and clustered modes with API key authentication and optional external LoadBalancer access.
+- **Harbor**: A fully managed OCI container registry backed by CloudNativePG, Redis operator, and COSI BucketClaim (SeaweedFS). Includes Trivy vulnerability scanner, auto-generated admin credentials, and TLS via cert-manager.
+- **NATS**: Enhanced with full Grafana monitoring dashboards for JetStream and server metrics, Prometheus support with TLS-aware configuration, and updated image customization options.
+- **MariaDB**: The `mysql` application is renamed to `mariadb`, accurately reflecting the underlying engine. An automatic migration (migration 27) converts all existing MySQL resources to use the `mariadb` naming.
+
+FerretDB has been removed from the catalog as it is superseded by native MongoDB support.
+
+### Multi-Location Networking with Kilo and cilium-kilo
+
+Cozystack v1.0.0 introduces first-class support for multi-location clusters via the **Kilo** WireGuard mesh networking package. Kilo automatically establishes encrypted WireGuard tunnels between nodes in different network segments, enabling seamless cross-region communication.
+
+A new integrated **`cilium-kilo`** networking variant combines Cilium eBPF CNI with Kilo's WireGuard overlay in a single platform configuration selection. This variant enables `enable-ipip-termination` in Cilium and deploys Kilo with `--compatibility=cilium`, allowing Cilium network policies to function correctly over the WireGuard mesh — without any manual configuration of the two components.
+
+### Flux Sharding for Scalable Multi-Tenancy
+
+Tenant HelmRelease reconciliation is now distributed across multiple Flux controllers via sharding labels. Each tenant workload is assigned to a shard based on a deterministic hash, preventing a single Flux controller from becoming a bottleneck in large multi-tenant environments. The platform operator manages the shard assignment automatically, and new shards can be added by scaling the Flux deployment.
+
+## Major Features and Improvements
+
+### Cozystack Operator
+
+* **[cozystack-operator] Introduce Package and PackageSource APIs**: Added new CRDs for declarative package management, defining the full API for Package and PackageSource resources ([**@kvaps**](https://github.com/kvaps) in #1740, #1741, #1755, #1756, #1760, #1761).
+* **[platform] Migrate from HelmRelease bundles to Package-based deployment**: Replaced HelmRelease bundle system with Package resources managed by cozystack-operator, including restructured values.yaml with full configuration support for networking, publishing, authentication, scheduling, branding, and resources ([**@kvaps**](https://github.com/kvaps) in #1816).
+* **[cozystack-operator] Add automatic CRD installation at startup**: Added `--install-crds` flag to install embedded CRD manifests on every startup via server-side apply, ensuring CRDs and the PackageSource are always up to date ([**@lexfrei**](https://github.com/lexfrei) in #2060).
+* **[installer] Remove CRDs from Helm chart, delegate lifecycle to operator**: The `cozy-installer` Helm chart no longer ships CRDs; CRD lifecycle is fully managed by the Cozystack operator ([**@lexfrei**](https://github.com/lexfrei) in #2074).
+* **[cozystack-operator] Preserve existing suspend field in package reconciler**: Fixed package reconciler to properly preserve the suspend field state during reconciliation ([**@sircthulhu**](https://github.com/sircthulhu) in #2043).
+* **[cozystack-operator] Fix namespace privileged flag resolution and field ownership**: Fixed operator to correctly check all Packages in a namespace when determining privileged status, and resolved SSA field ownership conflicts ([**@kvaps**](https://github.com/kvaps) in #2046).
+* **[platform] Add flux-plunger controller**: Added flux-plunger controller to automatically fix stuck HelmRelease errors by cleaning up failed resources and retrying reconciliation ([**@kvaps**](https://github.com/kvaps) in #1843).
+* **[installer] Add variant-aware templates for generic Kubernetes support**: Extended the installer to support generic and hosted Kubernetes deployments via the `cozystackOperator.variant=generic` parameter ([**@lexfrei**](https://github.com/lexfrei) in #2010).
+* **[installer] Unify operator templates**: Merged separate operator templates into a single variant-based template supporting Talos and non-Talos deployments ([**@kvaps**](https://github.com/kvaps) in #2034).
+
+### API and Platform
+
+* **[api] Rename CozystackResourceDefinition to ApplicationDefinition**: Renamed CRD and all related types for clarity and consistency, with migration 24 handling the transition automatically ([**@kvaps**](https://github.com/kvaps) in #1864).
+* **[platform] Add DNS-1035 validation for Application names**: Added dynamic DNS-1035 label validation for Application names at creation time, preventing resources with invalid names that would fail downstream ([**@lexfrei**](https://github.com/lexfrei) in #1771).
+* **[platform] Make cluster issuer name and ACME solver configurable**: Added `publishing.certificates.solver` and `publishing.certificates.issuerName` parameters to allow pointing all ingress TLS annotations at any ClusterIssuer ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2077).
+* **[platform] Add cilium-kilo networking variant**: Added integrated `cilium-kilo` networking variant combining Cilium CNI with Kilo WireGuard mesh overlay ([**@kvaps**](https://github.com/kvaps) in #2064).
+* **[cozystack-api] Switch from DaemonSet to Deployment**: Migrated cozystack-api to a Deployment with PreferClose topology spread constraints, reducing resource consumption while maintaining high availability ([**@kvaps**](https://github.com/kvaps) in #2041, #2048).
+
+### Virtual Machines
+
+* **[vm-instance] Complete migration from virtual-machine to vm-disk and vm-instance**: Fully migrated from `virtual-machine` to the new `vm-disk` and `vm-instance` architecture, with automatic migration script (migration 28) for existing VMs ([**@kvaps**](https://github.com/kvaps) in #2040).
+* **[kubevirt-csi-driver] Add RWX Filesystem (NFS) support**: Added Read-Write-Many filesystem support to kubevirt-csi-driver via automatic NFS server deployment per PVC ([**@kvaps**](https://github.com/kvaps) in #2042).
+* **[vm] Add cpuModel field to specify CPU model without instanceType**: Added cpuModel field to VirtualMachine API for granular CPU control ([**@sircthulhu**](https://github.com/sircthulhu) in #2007).
+* **[vm] Allow switching between instancetype and custom resources**: Implemented atomic upgrade hook for switching between instanceType-based and custom resource VM configurations ([**@sircthulhu**](https://github.com/sircthulhu) in #2008).
+* **[vm] Migrate to runStrategy instead of running**: Migrated VirtualMachine API from deprecated `running` field to `runStrategy` ([**@sircthulhu**](https://github.com/sircthulhu) in #2004).
+* **[vm] Always expose VMs with a service**: Virtual machines are now always exposed with at least a ClusterIP service, ensuring in-cluster DNS names ([**@lllamnyp**](https://github.com/lllamnyp) in #1738, #1751).
+* **[dashboard] VMInstance dropdowns for disks and instanceType**: VM instance creation form now renders API-backed dropdowns for `instanceType` and disk `name` fields ([**@sircthulhu**](https://github.com/sircthulhu) in #2071).
+
+### Backup System
+
+* **[backups] Implement comprehensive backup and restore functionality**: Core backup Plan controller, Velero strategy controller, RestoreJob resource with end-to-end restore workflows, and enhanced backup plans UI ([**@lllamnyp**](https://github.com/lllamnyp) in #1640, #1685, #1687, #1719, #1720, #1737, #1967; [**@androndo**](https://github.com/androndo) in #1762, #1967, #1968, #1811).
+* **[backups] Add kubevirt plugin to velero**: Added KubeVirt plugin to Velero for consistent VM state and data snapshots ([**@lllamnyp**](https://github.com/lllamnyp) in #2017).
+* **[backups] Install backupstrategy controller by default**: Enabled backupstrategy controller by default for automatic backup scheduling ([**@lllamnyp**](https://github.com/lllamnyp) in #2020).
+* **[backups] Better selectors for VM strategy**: Improved VM backup strategy selectors for accurate and reliable backup targeting ([**@lllamnyp**](https://github.com/lllamnyp) in #2023).
+* **[backups] Create RBAC for backup resources**: Added comprehensive RBAC configuration for backup operations and restore jobs ([**@lllamnyp**](https://github.com/lllamnyp) in #2018).
+
+### Networking
+
+* **[kilo] Introduce Kilo WireGuard mesh networking**: Added Kilo as a system package providing secure WireGuard-based VPN mesh for connecting Kubernetes nodes across different networks and regions ([**@kvaps**](https://github.com/kvaps) in #1691).
+* **[kilo] Add Cilium compatibility variant**: Added `cilium` variant enabling Cilium-aware IPIP encapsulation for full network policy enforcement with Kilo mesh ([**@kvaps**](https://github.com/kvaps) in #2055).
+* **[kilo] Update to v0.8.0 with configurable MTU**: Updated Kilo to v0.8.0 with configurable MTU parameter and performance improvements ([**@kvaps**](https://github.com/kvaps) in #2003, #2049, #2053).
+* **[local-ccm] Add local-ccm package**: Added local cloud controller manager for managing load balancer services in bare-metal environments ([**@kvaps**](https://github.com/kvaps) in #1831).
+* **[local-ccm] Add node-lifecycle-controller component**: Added optional node-lifecycle-controller that automatically deletes unreachable NotReady nodes, solving the "zombie" node problem in autoscaled clusters ([**@IvanHunters**](https://github.com/IvanHunters) in #1992).
+* **[tenant] Allow egress to parent ingress pods**: Updated tenant network policies to allow egress traffic to parent cluster ingress pods ([**@lexfrei**](https://github.com/lexfrei) in #1765, #1776).
+
+### New Applications
+
+* **[mongodb] Add MongoDB managed application**: Added MongoDB as a fully managed database with replica sets, persistent storage, and unified user/database configuration ([**@lexfrei**](https://github.com/lexfrei) in #1822; [**@kvaps**](https://github.com/kvaps) in #1923).
+* **[qdrant] Add Qdrant vector database**: Added Qdrant as a high-performance vector database for AI/ML workloads with API key authentication and optional LoadBalancer access ([**@lexfrei**](https://github.com/lexfrei) in #1987).
+* **[harbor] Add managed Harbor container registry**: Added Harbor v2.14.2 as a managed tenant-level container registry with CloudNativePG, Redis operator, COSI BucketClaim storage, and Trivy scanner ([**@lexfrei**](https://github.com/lexfrei) in #2058).
+* **[nats] Add monitoring**: Added Grafana dashboards for NATS JetStream and server metrics, Prometheus monitoring with TLS support ([**@klinch0**](https://github.com/klinch0) in #1381).
+* **[mariadb] Rename mysql application to mariadb**: Renamed MySQL application to MariaDB with automatic migration (migration 27) for all existing resources ([**@kvaps**](https://github.com/kvaps) in #2026).
+* **[ferretdb] Remove FerretDB application**: Removed FerretDB, superseded by native MongoDB support ([**@kvaps**](https://github.com/kvaps) in #2028).
+
+### Kubernetes and System Components
+
+* **[kubernetes] Update supported Kubernetes versions to v1.30–v1.35**: Updated the tenant Kubernetes version matrix, with v1.35 as the new default. Kamaji updated to edge-26.2.4 and CAPI Kamaji provider to v0.16.0 ([**@lexfrei**](https://github.com/lexfrei) in #2073).
+* **[kubernetes] Auto-enable Gateway API support in cert-manager**: Added automatic Gateway API support in cert-manager for tenant clusters ([**@kvaps**](https://github.com/kvaps) in #1997).
+* **[kubernetes] Use ingress-nginx nodeport service**: Changed tenant Kubernetes clusters to use ingress-nginx NodePort service for improved compatibility ([**@sircthulhu**](https://github.com/sircthulhu) in #1948).
+* **[system] Add cluster-autoscaler for Hetzner and Azure**: Added cluster-autoscaler system package for automatically scaling management cluster nodes on Hetzner and Azure ([**@kvaps**](https://github.com/kvaps) in #1964).
+* **[cluster-autoscaler] Enable enforce-node-group-min-size by default**: Ensures node groups are always scaled up to their configured minimum size ([**@kvaps**](https://github.com/kvaps) in #2050).
+* **[system] Add clustersecret-operator package**: Added clustersecret-operator for managing secrets across multiple namespaces ([**@sircthulhu**](https://github.com/sircthulhu) in #2025).
+
+### Monitoring
+
+* **[monitoring] Enable monitoring for core components**: Enhanced monitoring capabilities with dashboards and metrics for core Cozystack components ([**@IvanHunters**](https://github.com/IvanHunters) in #1937).
+* **[monitoring] Add SLACK_SEVERITY_FILTER and VMAgent for tenant monitoring**: Added SLACK_SEVERITY_FILTER for Slack alert filtering and VMAgent for tenant namespace metrics scraping ([**@IvanHunters**](https://github.com/IvanHunters) in #1712).
+* **[monitoring-agents] Fix FQDN resolution for tenant workload clusters**: Fixed monitoring agents in tenant clusters to use full DNS names with cluster domain suffix ([**@IvanHunters**](https://github.com/IvanHunters) in #2075; [**@kvaps**](https://github.com/kvaps) in #2086).
+
+### Storage
+
+* **[linstor] Move CRDs to dedicated piraeus-operator-crds chart**: Moved LINSTOR CRDs to a dedicated chart, ensuring reliable installation of all CRDs including `linstorsatellites.io` ([**@kvaps**](https://github.com/kvaps) in #2036; [**@IvanHunters**](https://github.com/IvanHunters) in #1991).
+* **[seaweedfs] Increase certificate duration to 10 years**: Increased SeaweedFS certificate validity to 10 years to reduce rotation overhead ([**@IvanHunters**](https://github.com/IvanHunters) in #1986).
+
+## Improvements
+
+* **[dashboard] Upgrade dashboard to version 1.4.0**: Updated Cozystack dashboard to v1.4.0 with new features and improvements ([**@sircthulhu**](https://github.com/sircthulhu) in #2051).
+* **[dashboard] Hide Ingresses/Services/Secrets tabs when no selectors defined**: Tabs are now conditionally shown based on whether the ApplicationDefinition has resource selectors configured, reducing UI clutter ([**@kvaps**](https://github.com/kvaps) in #2087).
+* **[dashboard] Add startupProbe to prevent container restarts on slow hardware**: Added startup probe to dashboard pods to prevent unnecessary restarts ([**@kvaps**](https://github.com/kvaps) in #1996).
+* **[keycloak] Allow custom Ingress hostname via values**: Added `ingress.host` field to cozy-keycloak chart values for overriding the default `keycloak.<root-host>` hostname ([**@sircthulhu**](https://github.com/sircthulhu) in #2101).
+* **[branding] Separate values for Keycloak**: Separated Keycloak branding values for better customization capabilities ([**@nbykov0**](https://github.com/nbykov0) in #1947).
+* **[rbac] Use hierarchical naming scheme**: Refactored RBAC to use hierarchical naming for cluster roles and role bindings ([**@lllamnyp**](https://github.com/lllamnyp) in #2019).
+* **[tenant,rbac] Use shared clusterroles**: Refactored tenant RBAC to use shared ClusterRoles for improved consistency ([**@lllamnyp**](https://github.com/lllamnyp) in #1999).
+* **[kubernetes] Increase default apiServer resourcesPreset to large**: Increased kube-apiserver resource preset to `large` for more reliable operation under higher workloads ([**@kvaps**](https://github.com/kvaps) in #1875).
+* **[kubernetes] Increase kube-apiserver startup probe threshold**: Increased startup probe threshold to allow more time for API server readiness ([**@kvaps**](https://github.com/kvaps) in #1876).
+* **[etcd] Increase probe thresholds for better recovery**: Increased etcd probe thresholds to improve cluster resilience during temporary slowdowns ([**@kvaps**](https://github.com/kvaps) in #1874).
+* **[etcd-operator] Add vertical-pod-autoscaler dependency**: Added VPA as a dependency to etcd-operator for proper resource scaling ([**@sircthulhu**](https://github.com/sircthulhu) in #2047).
+* **[cilium] Change cilium-operator replicas to 1**: Reduced Cilium operator replicas to decrease resource consumption in smaller deployments ([**@IvanHunters**](https://github.com/IvanHunters) in #1784).
+* **[keycloak-configure,dashboard] Enable insecure TLS verification by default**: Made SSL certificate verification configurable with insecure mode enabled by default for local development ([**@IvanHunters**](https://github.com/IvanHunters) in #2005).
+* **[platform] Split telemetry between operator and controller**: Separated telemetry collection for better metrics isolation ([**@kvaps**](https://github.com/kvaps) in #1869).
+* **[system] Add resource requests and limits to etcd-defrag**: Added resource requests and limits to etcd-defrag job to prevent resource contention ([**@matthieu-robin**](https://github.com/matthieu-robin) in #1785, #1786).
+
+## Fixes
+
+* **[dashboard] Fix sidebar visibility on cluster-level pages**: Fixed broken URLs with double `//` on cluster-level pages by hiding namespace-scoped sidebar items when no tenant is selected ([**@sircthulhu**](https://github.com/sircthulhu) in #2106).
+* **[platform] Fix upgrade issues in migrations, etcd timeout, and migration script**: Fixed multiple upgrade failures discovered during v0.41.1 → v1.0 upgrade testing, including migration 26-29 fixes, RFC3339 format for annotations, and extended etcd HelmRelease timeout to 30m ([**@kvaps**](https://github.com/kvaps) in #2096).
+* **[platform] Fix orphaned -rd HelmReleases after application renames**: Migrations 28-29 updated to remove orphaned `-rd` HelmReleases in `cozy-system` after `ferretdb→mongodb`, `mysql→mariadb`, and `virtual-machine→vm-disk+vm-instance` renames, with migration 33 as a safety net ([**@kvaps**](https://github.com/kvaps) in #2102).
+* **[platform] Adopt tenant-root into cozystack-basics during migration**: Added migration 31 to adopt existing `tenant-root` Namespace and HelmRelease into `cozystack-basics` for a safe v0.41.x → v1.0 upgrade path ([**@kvaps**](https://github.com/kvaps) in #2065).
+* **[platform] Preserve tenant-root HelmRelease during migration**: Fixed data-loss risk during migration where `tenant-root` HelmRelease could be deleted ([**@sircthulhu**](https://github.com/sircthulhu) in #2063).
+* **[platform] Fix cozystack-values secret race condition**: Fixed race condition in cozystack-values secret creation that could cause initialization failures ([**@lllamnyp**](https://github.com/lllamnyp) in #2024).
+* **[cozystack-basics] Preserve existing HelmRelease values during reconciliations**: Fixed data-loss bug where changes to `tenant-root` HelmRelease were dropped on the next reconciliation ([**@sircthulhu**](https://github.com/sircthulhu) in #2068).
+* **[cozystack-basics] Deny resourcequotas deletion for tenant admin**: Fixed `cozy:tenant:admin:base` ClusterRole to explicitly deny deletion of ResourceQuota objects ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2076).
+* **[dashboard] Fix legacy templating and cluster identifier in sidebar links**: Standardized cluster identifier across dashboard menu links resolving broken link targets for Backups and External IPs ([**@androndo**](https://github.com/androndo) in #2093).
+* **[dashboard] Fix backupjobs creation form and sidebar backup category identifier**: Fixed backup job creation form fields and fixed sidebar backup category identifier ([**@androndo**](https://github.com/androndo) in #2103).
+* **[kubevirt] Update KubeVirt to v1.6.4 and CDI to v1.64.0, fix VM pod initialization**: Updated KubeVirt and CDI and disabled serial console logging globally to fix the `guest-console-log` init container blocking virt-launcher pods ([**@nbykov0**](https://github.com/nbykov0) in #1833; [**@kvaps**](https://github.com/kvaps)).
+* **[linstor] Fix DRBD+LUKS+STORAGE resource creation failure**: Applied upstream fix for all newly created encrypted volumes failing due to missing `setExists(true)` call in `LuksLayer` ([**@kvaps**](https://github.com/kvaps) in #2072).
+* **[platform] Clean up Helm secrets for removed releases**: Added cleanup logic to migration 23 to remove orphaned Helm secrets from removed `-rd` releases ([**@kvaps**](https://github.com/kvaps) in #2035).
+* **[monitoring] Fix YAML parse error in vmagent template**: Fixed YAML parsing error in monitoring-agents vmagent template ([**@kvaps**](https://github.com/kvaps) in #2037).
+* **[monitoring] Remove cozystack-controller dependency**: Fixed monitoring package to remove unnecessary cozystack-controller dependency ([**@IvanHunters**](https://github.com/IvanHunters) in #1990).
+* **[monitoring] Remove duplicate dashboards.list**: Fixed duplicate dashboards.list configuration in extra/monitoring package ([**@IvanHunters**](https://github.com/IvanHunters) in #2016).
+* **[linstor] Update piraeus-server patches with critical fixes**: Backported critical patches fixing edge cases in device management and DRBD resource handling ([**@kvaps**](https://github.com/kvaps) in #1850).
+* **[apiserver] Fix Watch resourceVersion and bookmark handling**: Fixed Watch API handling of resourceVersion and bookmarks for proper event streaming ([**@kvaps**](https://github.com/kvaps) in #1860).
+* **[bootbox] Auto-create bootbox-application as dependency**: Fixed bootbox package to automatically create required bootbox-application dependency ([**@kvaps**](https://github.com/kvaps) in #1974).
+* **[postgres-operator] Correct PromQL syntax in CNPGClusterOffline alert**: Fixed incorrect PromQL syntax in the CNPGClusterOffline Prometheus alert ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #1981).
+* **[coredns] Fix serviceaccount to match kubernetes bootstrap RBAC**: Fixed CoreDNS service account to correctly match Kubernetes bootstrap RBAC requirements ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #1958).
+* **[dashboard] Verify JWT token**: Added JWT token verification to dashboard for improved security ([**@lllamnyp**](https://github.com/lllamnyp) in #1980).
+* **[codegen] Fix missing gen_client in update-codegen.sh**: Fixed build error in `pkg/generated/applyconfiguration/utils.go` by including `gen_client` in the codegen script ([**@lexfrei**](https://github.com/lexfrei) in #2061).
+* **[kubevirt-operator] Fix typo in VMNotRunningFor10Minutes alert**: Fixed typo in VM alert name ensuring proper alert triggering ([**@lexfrei**](https://github.com/lexfrei) in #1770, #1775).
+
+## Security
+
+* **[dashboard] Verify JWT token**: Added JWT token verification to the dashboard for improved authentication security ([**@lllamnyp**](https://github.com/lllamnyp) in #1980).
+
+## Dependencies
+
+* **[cilium] Update to v1.18.6**: Updated Cilium CNI to v1.18.6 with security fixes and performance improvements ([**@sircthulhu**](https://github.com/sircthulhu) in #1868).
+* **[kube-ovn] Update to v1.15.3**: Updated Kube-OVN CNI to v1.15.3 with performance improvements and bug fixes ([**@kvaps**](https://github.com/kvaps) in #2022).
+* **[kilo] Update to v0.8.0**: Updated Kilo WireGuard mesh to v0.8.0 with performance improvements and new compatibility features ([**@kvaps**](https://github.com/kvaps) in #2053).
+* **Update Talos Linux to v1.12.1**: Updated Talos Linux to v1.12.1 with latest features and security patches ([**@kvaps**](https://github.com/kvaps) in #1877).
+
+## System Configuration
+
+* **[vpc] Migrate subnets definition from map to array format**: Migrated VPC subnets from `map[string]Subnet` to `[]Subnet` with explicit `name` field, with automatic migration via migration 30 ([**@kvaps**](https://github.com/kvaps) in #2052).
+* **[migrations] Add migrations 23-33 for v1.0 upgrade path**: Added 11 incremental migrations handling CRD ownership, resource renaming, secret cleanup, Helm adoption, and configuration conversion for the v0.41.x → v1.0.0 upgrade path ([**@kvaps**](https://github.com/kvaps) in #1975, #2035, #2036, #2040, #2026, #2065, #2052, #2102).
+* **[tenant] Run cleanup job from system namespace**: Moved tenant cleanup job to system namespace for improved security and resource isolation ([**@lllamnyp**](https://github.com/lllamnyp) in #1774, #1777).
+
+## Development, Testing, and CI/CD
+
+* **[ci] Use GitHub Copilot CLI for changelog generation**: Automated changelog generation using GitHub Copilot CLI ([**@androndo**](https://github.com/androndo) in #1753).
+* **[ci] Choose runner conditional on label**: Added conditional runner selection in CI based on PR labels ([**@lllamnyp**](https://github.com/lllamnyp) in #1998).
+* **[e2e] Use helm install instead of kubectl apply for cozystack installation**: Replaced static YAML apply flow with direct `helm upgrade --install` of the installer chart in E2E tests ([**@lexfrei**](https://github.com/lexfrei) in #2060).
+* **[e2e] Make kubernetes test retries effective by cleaning up stale resources**: Fixed E2E test retries by adding pre-creation cleanup and increasing deployment wait timeout to 300s ([**@lexfrei**](https://github.com/lexfrei) in #2062).
+* **[e2e] Increase HelmRelease readiness timeout for kubernetes test**: Increased HelmRelease readiness timeout to prevent false failures on slower hardware ([**@lexfrei**](https://github.com/lexfrei) in #2033).
+* **[ci] Improve cozyreport functionality**: Enhanced cozyreport tool with improved reporting for CI/CD pipelines ([**@lllamnyp**](https://github.com/lllamnyp) in #2032).
+* **feat(cozypkg): add cross-platform build targets with version injection**: Added cross-platform build targets for cozypkg/cozyhr tool for linux/amd64, linux/arm64, darwin/amd64, darwin/arm64 ([**@kvaps**](https://github.com/kvaps) in #1862).
+* **refactor: move scripts to hack directory**: Reorganized scripts to the standard `hack/` location ([**@kvaps**](https://github.com/kvaps) in #1863).
+* **Update CODEOWNERS**: Updated CODEOWNERS to include new maintainers ([**@lllamnyp**](https://github.com/lllamnyp) in #1972; [**@IvanHunters**](https://github.com/IvanHunters) in #2015).
+* **[talm] Skip config loading for completion subcommands**: Fixed talm CLI to skip config loading for shell completion commands ([**@kitsunoff**](https://github.com/kitsunoff) in cozystack/talm#109).
+* **[talm] Fix metadata.id type casting in physical_links_info**: Fixed Prometheus query to properly cast metadata.id to string for regexMatch operations ([**@kvaps**](https://github.com/kvaps) in cozystack/talm#110).
+
+## Documentation
+
+* **[website] Add documentation versioning**: Implemented comprehensive documentation versioning with separate v0 and v1 documentation trees and a version selector in the UI ([**@IvanStukov**](https://github.com/IvanStukov) in cozystack/website#415).
+* **[website] Describe upgrade to v1.0**: Added detailed upgrade instructions for migrating from v0.x to v1.0 ([**@nbykov0**](https://github.com/nbykov0) in cozystack/website@21bbe84).
+* **[website] Migrate ConfigMap references to Platform Package in v1 docs**: Updated entire v1 documentation to replace legacy ConfigMap-based configuration with the new Platform Package API ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#426).
+* **[website] Add generic Kubernetes deployment guide for v1**: Added installation guide for deploying Cozystack on any generic Kubernetes cluster ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#408).
+* **[website] Describe operator-based and HelmRelease-based package patterns**: Added development documentation explaining operator-based and HelmRelease-based package patterns ([**@kvaps**](https://github.com/kvaps) in cozystack/website#413).
+* **[website] Add Helm chart development principles guide**: Added developer guide documenting Cozystack's four core Helm chart principles ([**@kvaps**](https://github.com/kvaps) in cozystack/website#418).
+* **[website] Add network architecture overview**: Added comprehensive network architecture documentation covering the multi-layered networking stack with Mermaid diagrams ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#422).
+* **[website] Add LINSTOR disk preparation guide**: Added comprehensive documentation for preparing disks for LINSTOR storage ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#411).
+* **[website] Add Proxmox VM migration guide**: Added detailed guide for migrating virtual machines from Proxmox to Cozystack ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#410).
+* **[website] Add cluster autoscaler documentation**: Added documentation for Hetzner setup with Talos, vSwitch, and Kilo mesh integration ([**@kvaps**](https://github.com/kvaps) in #1964).
+* **[website] Improve Azure autoscaling troubleshooting guide**: Enhanced Azure autoscaling documentation with serial console instructions and `az vmss update --custom-data` guidance ([**@kvaps**](https://github.com/kvaps) in cozystack/website#424).
+* **[website] Update multi-location documentation for cilium-kilo variant**: Updated multi-location networking docs to reflect the integrated `cilium-kilo` variant selection ([**@kvaps**](https://github.com/kvaps) in cozystack/website@02d63f0).
+* **[website] Update documentation to use jsonpatch for service exposure**: Improved `kubectl patch` commands to use JSON Patch `add` operations ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#427).
+* **[website] Update certificates section in Platform Package documentation**: Updated certificate configuration docs to reflect new `solver` and `issuerName` fields ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#429).
+* **[website] Add tenant Kubernetes cluster log querying guide**: Added documentation for querying logs from tenant clusters in Grafana using VictoriaLogs labels ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#430).
+* **[website] Replace non-idempotent commands with idempotent alternatives**: Updated `helm install` to `helm upgrade --install` and `kubectl create` to `kubectl apply` across all installation guides ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#431).
+* **[website] Fix broken documentation links with .md suffix**: Fixed incorrect internal links across virtualization guides for v0 and v1 documentation ([**@cheese**](https://github.com/cheese) in cozystack/website#432).
+* **[website] Refactor resource planning documentation**: Improved resource planning guide with clearer structure and more comprehensive coverage ([**@IvanStukov**](https://github.com/IvanStukov) in cozystack/website#423).
+* **[website] Add ServiceAccount API access documentation and update FAQ**: Added documentation for ServiceAccount API access token configuration and updated FAQ ([**@IvanStukov**](https://github.com/IvanStukov) in cozystack/website#421).
+* **[website] Update networking-mesh allowed-location-ips example**: Replaced provider-specific CLI with standard `kubectl` commands in multi-location networking guide ([**@kvaps**](https://github.com/kvaps) in cozystack/website#425).
+* **[website] docs(storage): simplify NFS driver setup instructions**: Simplified NFS driver setup documentation ([**@kvaps**](https://github.com/kvaps) in cozystack/website#399).
+* **[website] Add Hetzner RobotLB documentation**: Added documentation for configuring public IP with Hetzner RobotLB ([**@kvaps**](https://github.com/kvaps) in cozystack/website#394).
+* **[website] Add documentation for creating and managing cloned VMs**: Added comprehensive guide for VM cloning operations ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#401).
+* **[website] Update Talos installation docs for Hetzner and Servers.com**: Updated installation documentation for Hetzner and Servers.com environments ([**@kvaps**](https://github.com/kvaps) in cozystack/website#395).
+* **[website] Add Hidora organization support details**: Added Hidora to the support page ([**@matthieu-robin**](https://github.com/matthieu-robin) in cozystack/website#397, cozystack/website#398).
+* **[website] Check quotas before an upgrade**: Added troubleshooting documentation for checking resource quotas before upgrades ([**@nbykov0**](https://github.com/nbykov0) in cozystack/website#405).
+* **[website] Update support documentation**: Updated support documentation with current contact information ([**@xrmtech-isk**](https://github.com/xrmtech-isk) in cozystack/website#420).
+* **[website] Correct typo in kubeconfig reference in Kubernetes installation guide**: Fixed documentation typo in kubeconfig reference ([**@shkarface**](https://github.com/shkarface) in cozystack/website#414).
+
+## Breaking Changes & Upgrade Notes
+
+* **[api] CozystackResourceDefinition renamed to ApplicationDefinition**: The `CozystackResourceDefinition` CRD has been renamed to `ApplicationDefinition`. Migration 24 handles the transition automatically during upgrade ([**@kvaps**](https://github.com/kvaps) in #1864).
+
+* **[platform] Certificate issuer configuration parameters renamed**: The `publishing.certificates.issuerType` field is renamed to `publishing.certificates.solver`, and the value `cloudflare` is renamed to `dns01`. A new `publishing.certificates.issuerName` field (default: `letsencrypt-prod`) is added. Migration 32 automatically converts existing configurations — no manual action required ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2077).
+
+* **[vpc] VPC subnets definition migrated from map to array format**: VPC subnets are now defined as `[]Subnet` with an explicit `name` field instead of `map[string]Subnet`. Migration 30 handles the conversion automatically ([**@kvaps**](https://github.com/kvaps) in #2052).
+
+* **[vm] virtual-machine application replaced by vm-disk and vm-instance**: The legacy `virtual-machine` application has been fully replaced. Migration 28 automatically converts existing VMs to the new architecture ([**@kvaps**](https://github.com/kvaps) in #2040).
+
+* **[mysql] mysql application renamed to mariadb**: Existing MySQL deployments are automatically renamed to MariaDB via migration 27 ([**@kvaps**](https://github.com/kvaps) in #2026).
+
+### Upgrade Guide
+
+To upgrade from v0.41.x to v1.0.0:
+1. **Backup your cluster** before upgrading.
+2. Run the provided migration script: `hack/migrate-to-version-1.0.sh`.
+3. The 33 incremental migration steps will automatically handle all resource renaming, configuration conversion, CRD adoption, and secret cleanup.
+4. Refer to the [upgrade documentation](https://cozystack.io/docs/v1/upgrade) for detailed instructions and troubleshooting.
+
+## Contributors
+
+We'd like to thank all contributors who made this release possible:
+
+* [**@androndo**](https://github.com/androndo)
+* [**@cheese**](https://github.com/cheese)
+* [**@IvanHunters**](https://github.com/IvanHunters)
+* [**@IvanStukov**](https://github.com/IvanStukov)
+* [**@kitsunoff**](https://github.com/kitsunoff)
+* [**@klinch0**](https://github.com/klinch0)
+* [**@kvaps**](https://github.com/kvaps)
+* [**@lexfrei**](https://github.com/lexfrei)
+* [**@lllamnyp**](https://github.com/lllamnyp)
+* [**@matthieu-robin**](https://github.com/matthieu-robin)
+* [**@mattia-eleuteri**](https://github.com/mattia-eleuteri)
+* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
+* [**@nbykov0**](https://github.com/nbykov0)
+* [**@shkarface**](https://github.com/shkarface)
+* [**@sircthulhu**](https://github.com/sircthulhu)
+* [**@xrmtech-isk**](https://github.com/xrmtech-isk)
+
+### New Contributors
+
+We're excited to welcome our first-time contributors:
+
+* [**@cheese**](https://github.com/cheese) - First contribution!
+* [**@IvanStukov**](https://github.com/IvanStukov) - First contribution!
+* [**@kitsunoff**](https://github.com/kitsunoff) - First contribution!
+* [**@shkarface**](https://github.com/shkarface) - First contribution!
+* [**@xrmtech-isk**](https://github.com/xrmtech-isk) - First contribution!
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v0.41.0...v1.0.0

From c05dd5e7b1d80f28aaad7d560dda70e2e0dfaf64 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Thu, 26 Feb 2026 23:11:36 +0500
Subject: [PATCH 174/666] [platform] Prevent version cm from deletion

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/core/platform/templates/cozystack-version.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/packages/core/platform/templates/cozystack-version.yaml b/packages/core/platform/templates/cozystack-version.yaml
index 8e3ff6c6..09b845c2 100644
--- a/packages/core/platform/templates/cozystack-version.yaml
+++ b/packages/core/platform/templates/cozystack-version.yaml
@@ -6,6 +6,8 @@ kind: ConfigMap
 metadata:
   name: cozystack-version
   namespace: {{ .Release.Namespace }}
+  annotations:
+    helm.sh/resource-policy: keep
 data:
   version: {{ .Values.migrations.targetVersion | quote }}
 {{- end }}

From 492b24dcad6d677f8903c529fe171b03031a6844 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Wed, 25 Feb 2026 11:46:43 +0500
Subject: [PATCH 175/666] feat(seaweedfs): add storage pools support for tiered
 storage
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add optional storagePools configuration that creates separate Volume
StatefulSets per disk type (SSD/HDD/NVMe), enabling tiered storage
within a single SeaweedFS tenant. Each pool gets its own BucketClass
and BucketAccessClass to prepare infrastructure for COSI driver
integration.

Supported in both Simple and MultiZone topologies:
- Simple: one StatefulSet per pool
- MultiZone: one StatefulSet per zone×pool combination

Also adds volume.diskType field for tagging default volume servers.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/extra/seaweedfs/README.md            | 96 ++++++++++--------
 .../templates/dashboard-resourcemap.yaml      | 15 +++
 .../extra/seaweedfs/templates/seaweedfs.yaml  | 97 +++++++++++++++++++
 .../storage-pool-bucket-classes.yaml          | 20 ++++
 packages/extra/seaweedfs/values.schema.json   | 89 +++++++++++++++++
 packages/extra/seaweedfs/values.yaml          | 30 ++++++
 .../seaweedfs-rd/cozyrds/seaweedfs.yaml       |  4 +-
 7 files changed, 306 insertions(+), 45 deletions(-)
 create mode 100644 packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml

diff --git a/packages/extra/seaweedfs/README.md b/packages/extra/seaweedfs/README.md
index a6ad408f..39c3c4ee 100644
--- a/packages/extra/seaweedfs/README.md
+++ b/packages/extra/seaweedfs/README.md
@@ -1,4 +1,4 @@
-# Managed NATS Service
+# Managed SeaweedFS Service
 
 ## Parameters
 
@@ -13,46 +13,56 @@
 
 ### SeaweedFS Components Configuration
 
-| Name                          | Description                                                                                              | Type                | Value   |
-| ----------------------------- | -------------------------------------------------------------------------------------------------------- | ------------------- | ------- |
-| `db`                          | Database configuration.                                                                                  | `object`            | `{}`    |
-| `db.replicas`                 | Number of database replicas.                                                                             | `int`               | `2`     |
-| `db.size`                     | Persistent Volume size.                                                                                  | `quantity`          | `10Gi`  |
-| `db.storageClass`             | StorageClass used to store the data.                                                                     | `string`            | `""`    |
-| `db.resources`                | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
-| `db.resources.cpu`            | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
-| `db.resources.memory`         | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
-| `db.resourcesPreset`          | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |
-| `master`                      | Master service configuration.                                                                            | `object`            | `{}`    |
-| `master.replicas`             | Number of master replicas.                                                                               | `int`               | `3`     |
-| `master.resources`            | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
-| `master.resources.cpu`        | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
-| `master.resources.memory`     | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
-| `master.resourcesPreset`      | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |
-| `filer`                       | Filer service configuration.                                                                             | `object`            | `{}`    |
-| `filer.replicas`              | Number of filer replicas.                                                                                | `int`               | `2`     |
-| `filer.resources`             | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
-| `filer.resources.cpu`         | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
-| `filer.resources.memory`      | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
-| `filer.resourcesPreset`       | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |
-| `filer.grpcHost`              | The hostname used to expose or access the filer service externally.                                      | `string`            | `""`    |
-| `filer.grpcPort`              | The port used to access the filer service externally.                                                    | `int`               | `443`   |
-| `filer.whitelist`             | A list of IP addresses or CIDR ranges that are allowed to access the filer service.                      | `[]string`          | `[]`    |
-| `volume`                      | Volume service configuration.                                                                            | `object`            | `{}`    |
-| `volume.replicas`             | Number of volume replicas.                                                                               | `int`               | `2`     |
-| `volume.size`                 | Persistent Volume size.                                                                                  | `quantity`          | `10Gi`  |
-| `volume.storageClass`         | StorageClass used to store the data.                                                                     | `string`            | `""`    |
-| `volume.resources`            | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
-| `volume.resources.cpu`        | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
-| `volume.resources.memory`     | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
-| `volume.resourcesPreset`      | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |
-| `volume.zones`                | A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.           | `map[string]object` | `{}`    |
-| `volume.zones[name].replicas` | Number of replicas in the zone.                                                                          | `int`               | `0`     |
-| `volume.zones[name].size`     | Zone storage size.                                                                                       | `quantity`          | `""`    |
-| `s3`                          | S3 service configuration.                                                                                | `object`            | `{}`    |
-| `s3.replicas`                 | Number of S3 replicas.                                                                                   | `int`               | `2`     |
-| `s3.resources`                | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
-| `s3.resources.cpu`            | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
-| `s3.resources.memory`         | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
-| `s3.resourcesPreset`          | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |
+| Name                                  | Description                                                                                              | Type                | Value   |
+| ------------------------------------- | -------------------------------------------------------------------------------------------------------- | ------------------- | ------- |
+| `db`                                  | Database configuration.                                                                                  | `object`            | `{}`    |
+| `db.replicas`                         | Number of database replicas.                                                                             | `int`               | `2`     |
+| `db.size`                             | Persistent Volume size.                                                                                  | `quantity`          | `10Gi`  |
+| `db.storageClass`                     | StorageClass used to store the data.                                                                     | `string`            | `""`    |
+| `db.resources`                        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
+| `db.resources.cpu`                    | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
+| `db.resources.memory`                 | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
+| `db.resourcesPreset`                  | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |
+| `master`                              | Master service configuration.                                                                            | `object`            | `{}`    |
+| `master.replicas`                     | Number of master replicas.                                                                               | `int`               | `3`     |
+| `master.resources`                    | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
+| `master.resources.cpu`                | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
+| `master.resources.memory`             | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
+| `master.resourcesPreset`              | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |
+| `filer`                               | Filer service configuration.                                                                             | `object`            | `{}`    |
+| `filer.replicas`                      | Number of filer replicas.                                                                                | `int`               | `2`     |
+| `filer.resources`                     | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
+| `filer.resources.cpu`                 | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
+| `filer.resources.memory`              | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
+| `filer.resourcesPreset`               | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |
+| `filer.grpcHost`                      | The hostname used to expose or access the filer service externally.                                      | `string`            | `""`    |
+| `filer.grpcPort`                      | The port used to access the filer service externally.                                                    | `int`               | `443`   |
+| `filer.whitelist`                     | A list of IP addresses or CIDR ranges that are allowed to access the filer service.                      | `[]string`          | `[]`    |
+| `volume`                              | Volume service configuration.                                                                            | `object`            | `{}`    |
+| `volume.replicas`                     | Number of volume replicas.                                                                               | `int`               | `2`     |
+| `volume.size`                         | Persistent Volume size.                                                                                  | `quantity`          | `10Gi`  |
+| `volume.storageClass`                 | StorageClass used to store the data.                                                                     | `string`            | `""`    |
+| `volume.diskType`                     | SeaweedFS disk type tag for the default volume servers (e.g., "hdd", "ssd").                             | `string`            | `""`    |
+| `volume.resources`                    | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
+| `volume.resources.cpu`                | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
+| `volume.resources.memory`             | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
+| `volume.resourcesPreset`              | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |
+| `volume.zones`                        | A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.           | `map[string]object` | `{}`    |
+| `volume.zones[name].replicas`         | Number of replicas in the zone.                                                                          | `int`               | `0`     |
+| `volume.zones[name].size`             | Zone storage size.                                                                                       | `quantity`          | `""`    |
+| `storagePools`                        | A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.          | `map[string]object` | `{}`    |
+| `storagePools[name].diskType`         | SeaweedFS disk type tag (e.g., "ssd", "hdd", "nvme").                                                    | `string`            | `""`    |
+| `storagePools[name].replicas`         | Number of volume replicas. Defaults to volume.replicas.                                                  | `int`               | `0`     |
+| `storagePools[name].size`             | Persistent Volume size. Defaults to volume.size.                                                         | `quantity`          | `""`    |
+| `storagePools[name].storageClass`     | Kubernetes StorageClass for the pool.                                                                    | `string`            | `""`    |
+| `storagePools[name].resources`        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
+| `storagePools[name].resources.cpu`    | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
+| `storagePools[name].resources.memory` | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
+| `storagePools[name].resourcesPreset`  | Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.              | `string`            | `{}`    |
+| `s3`                                  | S3 service configuration.                                                                                | `object`            | `{}`    |
+| `s3.replicas`                         | Number of S3 replicas.                                                                                   | `int`               | `2`     |
+| `s3.resources`                        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
+| `s3.resources.cpu`                    | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
+| `s3.resources.memory`                 | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
+| `s3.resourcesPreset`                  | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |
 
diff --git a/packages/extra/seaweedfs/templates/dashboard-resourcemap.yaml b/packages/extra/seaweedfs/templates/dashboard-resourcemap.yaml
index ec8860b7..7a6db271 100644
--- a/packages/extra/seaweedfs/templates/dashboard-resourcemap.yaml
+++ b/packages/extra/seaweedfs/templates/dashboard-resourcemap.yaml
@@ -27,6 +27,21 @@ rules:
   - {{ $.Release.Name }}-filer
   - {{ $.Release.Name }}-volume
   - {{ $.Release.Name }}-db
+  - {{ $.Release.Name }}-s3
+  {{- if eq .Values.topology "Simple" }}
+  {{- range $poolName, $pool := .Values.storagePools }}
+  - {{ $.Release.Name }}-volume-{{ $poolName }}
+  {{- end }}
+  {{- else if eq .Values.topology "MultiZone" }}
+  {{- range $zoneName, $zone := .Values.volume.zones }}
+  - {{ $.Release.Name }}-volume-{{ $zoneName }}
+  {{- end }}
+  {{- range $poolName, $pool := .Values.storagePools }}
+  {{- range $zoneName, $zone := $.Values.volume.zones }}
+  - {{ $.Release.Name }}-volume-{{ $zoneName }}-{{ $poolName }}
+  {{- end }}
+  {{- end }}
+  {{- end }}
   verbs: ["get", "list", "watch"]
 {{- end }}
 
diff --git a/packages/extra/seaweedfs/templates/seaweedfs.yaml b/packages/extra/seaweedfs/templates/seaweedfs.yaml
index 03f9c45b..e3967fa6 100644
--- a/packages/extra/seaweedfs/templates/seaweedfs.yaml
+++ b/packages/extra/seaweedfs/templates/seaweedfs.yaml
@@ -16,6 +16,26 @@
 {{-     fail "replicationFactor must be less than or equal to the number of zones defined in .Values.volume.zones." }}
 {{-   end }}
 {{- end }}
+{{- if and (eq .Values.topology "Client") (gt (len .Values.storagePools) 0) }}
+{{-   fail "storagePools is not supported with Client topology." }}
+{{- end }}
+{{- range $poolName, $pool := .Values.storagePools }}
+{{-   if not $pool.diskType }}
+{{-     fail (printf "storagePools.%s.diskType is required." $poolName) }}
+{{-   end }}
+{{-   if not (regexMatch "^[a-z0-9]+$" $pool.diskType) }}
+{{-     fail (printf "storagePools.%s.diskType must be lowercase alphanumeric (got: %s)." $poolName $pool.diskType) }}
+{{-   end }}
+{{-   if not $pool.storageClass }}
+{{-     fail (printf "storagePools.%s.storageClass is required." $poolName) }}
+{{-   end }}
+{{-   if not (regexMatch "^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$" $poolName) }}
+{{-     fail (printf "storagePools key '%s' must be a valid DNS label (lowercase alphanumeric and hyphens)." $poolName) }}
+{{-   end }}
+{{- end }}
+{{- if and .Values.volume.diskType (not (regexMatch "^[a-z0-9]+$" .Values.volume.diskType)) }}
+{{-   fail (printf "volume.diskType must be lowercase alphanumeric (got: %s)." .Values.volume.diskType) }}
+{{- end }}
 
 {{- $detectedTopology := "Unknown" }}
 {{- $configMap := lookup "v1" "ConfigMap" .Release.Namespace (printf "%s-deployed-topology" .Release.Name) }}
@@ -94,6 +114,10 @@ spec:
           storageClass: {{ . }}
           {{- end }}
           maxVolumes: 0
+        {{- if .Values.volume.diskType }}
+        extraArgs:
+        - "-disk={{ .Values.volume.diskType }}"
+        {{- end }}
       {{ if eq .Values.topology "MultiZone" }}
       volumes:
         {{- range $zoneName, $zone := .Values.volume.zones }}
@@ -101,6 +125,7 @@ spec:
           {{ with $zone.replicas }}
           replicas: {{ . }}
           {{- end }}
+          resources: {{- include "cozy-lib.resources.defaultingSanitize" (list $.Values.volume.resourcesPreset $.Values.volume.resources $) | nindent 12 }}
           dataDirs:
           - name: data1
             type: "persistentVolumeClaim"
@@ -118,6 +143,44 @@ spec:
           nodeSelector: |
             topology.kubernetes.io/zone: {{ $zoneName }}
           dataCenter: {{ $zone.dataCenter | default $zoneName }}
+          {{- if $.Values.volume.diskType }}
+          extraArgs:
+          - "-disk={{ $.Values.volume.diskType }}"
+          {{- end }}
+        {{- end }}
+        {{- range $poolName, $pool := $.Values.storagePools }}
+        {{- range $zoneName, $zone := $.Values.volume.zones }}
+        {{ $zoneName }}-{{ $poolName }}:
+          replicas: {{ $pool.replicas | default $zone.replicas | default $.Values.volume.replicas }}
+          resources: {{- include "cozy-lib.resources.defaultingSanitize" (list ($pool.resourcesPreset | default $.Values.volume.resourcesPreset) (default dict $pool.resources) $) | nindent 12 }}
+          dataDirs:
+          - name: data1
+            type: "persistentVolumeClaim"
+            size: "{{ $pool.size | default $zone.size | default $.Values.volume.size }}"
+            storageClass: "{{ $pool.storageClass }}"
+            maxVolumes: 0
+          nodeSelector: |
+            topology.kubernetes.io/zone: {{ $zoneName }}
+          dataCenter: {{ $zone.dataCenter | default $zoneName }}
+          extraArgs:
+          - "-disk={{ $pool.diskType }}"
+        {{- end }}
+        {{- end }}
+      {{- end }}
+      {{- if and (eq .Values.topology "Simple") (gt (len .Values.storagePools) 0) }}
+      volumes:
+        {{- range $poolName, $pool := .Values.storagePools }}
+        {{ $poolName }}:
+          replicas: {{ $pool.replicas | default $.Values.volume.replicas }}
+          resources: {{- include "cozy-lib.resources.defaultingSanitize" (list ($pool.resourcesPreset | default $.Values.volume.resourcesPreset) (default dict $pool.resources) $) | nindent 12 }}
+          dataDirs:
+          - name: data1
+            type: "persistentVolumeClaim"
+            size: "{{ $pool.size | default $.Values.volume.size }}"
+            storageClass: "{{ $pool.storageClass }}"
+            maxVolumes: 0
+          extraArgs:
+          - "-disk={{ $pool.diskType }}"
         {{- end }}
       {{- end }}
       filer:
@@ -199,6 +262,22 @@ spec:
     app.kubernetes.io/component: volume
     app.kubernetes.io/name: seaweedfs
   version: {{ $.Chart.Version }}
+{{- range $poolName, $pool := .Values.storagePools }}
+---
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ $.Release.Name }}-volume-{{ $poolName }}
+spec:
+  replicas: {{ default $.Values.volume.replicas $pool.replicas }}
+  minReplicas: 1
+  kind: seaweedfs
+  type: volume
+  selector:
+    app.kubernetes.io/component: volume-{{ $poolName }}
+    app.kubernetes.io/name: seaweedfs
+  version: {{ $.Chart.Version }}
+{{- end }}
 {{- else if eq .Values.topology "MultiZone" }}
 {{- range $zoneName, $zoneSpec := .Values.volume.zones }}
 ---
@@ -216,6 +295,24 @@ spec:
     app.kubernetes.io/name: seaweedfs
   version: {{ $.Chart.Version }}
 {{- end }}
+{{- range $poolName, $pool := .Values.storagePools }}
+{{- range $zoneName, $zone := $.Values.volume.zones }}
+---
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ $.Release.Name }}-volume-{{ $zoneName }}-{{ $poolName }}
+spec:
+  replicas: {{ $pool.replicas | default $zone.replicas | default $.Values.volume.replicas }}
+  minReplicas: 1
+  kind: seaweedfs
+  type: volume
+  selector:
+    app.kubernetes.io/component: volume-{{ $zoneName }}-{{ $poolName }}
+    app.kubernetes.io/name: seaweedfs
+  version: {{ $.Chart.Version }}
+{{- end }}
+{{- end }}
 {{- end }}
 ---
 apiVersion: cozystack.io/v1alpha1
diff --git a/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml b/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml
new file mode 100644
index 00000000..8bf9b4d5
--- /dev/null
+++ b/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml
@@ -0,0 +1,20 @@
+{{- if and (ne .Values.topology "Client") .Values.storagePools }}
+{{- range $poolName, $pool := .Values.storagePools }}
+---
+kind: BucketClass
+apiVersion: objectstorage.k8s.io/v1alpha1
+metadata:
+  name: {{ $.Release.Namespace }}-{{ $poolName }}
+driverName: {{ $.Release.Namespace }}.seaweedfs.objectstorage.k8s.io
+deletionPolicy: Delete
+parameters:
+  diskType: {{ $pool.diskType }}
+---
+kind: BucketAccessClass
+apiVersion: objectstorage.k8s.io/v1alpha1
+metadata:
+  name: {{ $.Release.Namespace }}-{{ $poolName }}
+driverName: {{ $.Release.Namespace }}.seaweedfs.objectstorage.k8s.io
+authenticationType: KEY
+{{- end }}
+{{- end }}
diff --git a/packages/extra/seaweedfs/values.schema.json b/packages/extra/seaweedfs/values.schema.json
index 4003df9e..9f53a40e 100644
--- a/packages/extra/seaweedfs/values.schema.json
+++ b/packages/extra/seaweedfs/values.schema.json
@@ -285,6 +285,90 @@
         }
       }
     },
+    "storagePools": {
+      "description": "A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.",
+      "type": "object",
+      "default": {},
+      "additionalProperties": {
+        "type": "object",
+        "required": [
+          "diskType",
+          "storageClass"
+        ],
+        "properties": {
+          "diskType": {
+            "description": "SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").",
+            "type": "string"
+          },
+          "replicas": {
+            "description": "Number of volume replicas. Defaults to volume.replicas.",
+            "type": "integer"
+          },
+          "resources": {
+            "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
+            "type": "object",
+            "properties": {
+              "cpu": {
+                "description": "Number of CPU cores allocated.",
+                "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                "anyOf": [
+                  {
+                    "type": "integer"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "x-kubernetes-int-or-string": true
+              },
+              "memory": {
+                "description": "Amount of memory allocated.",
+                "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                "anyOf": [
+                  {
+                    "type": "integer"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "x-kubernetes-int-or-string": true
+              }
+            }
+          },
+          "resourcesPreset": {
+            "description": "Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.",
+            "type": "string",
+            "enum": [
+              "nano",
+              "micro",
+              "small",
+              "medium",
+              "large",
+              "xlarge",
+              "2xlarge"
+            ]
+          },
+          "size": {
+            "description": "Persistent Volume size. Defaults to volume.size.",
+            "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "x-kubernetes-int-or-string": true
+          },
+          "storageClass": {
+            "description": "Kubernetes StorageClass for the pool.",
+            "type": "string"
+          }
+        }
+      }
+    },
     "topology": {
       "description": "The topology of the SeaweedFS cluster.",
       "type": "string",
@@ -300,6 +384,11 @@
       "type": "object",
       "default": {},
       "properties": {
+        "diskType": {
+          "description": "SeaweedFS disk type tag for the default volume servers (e.g., \"hdd\", \"ssd\").",
+          "type": "string",
+          "default": ""
+        },
         "replicas": {
           "description": "Number of volume replicas.",
           "type": "integer",
diff --git a/packages/extra/seaweedfs/values.yaml b/packages/extra/seaweedfs/values.yaml
index e2fc02fd..ca1199af 100644
--- a/packages/extra/seaweedfs/values.yaml
+++ b/packages/extra/seaweedfs/values.yaml
@@ -84,6 +84,7 @@ filer:
 ## @field {int} [replicas] - Number of volume replicas.
 ## @field {quantity} [size] - Persistent Volume size.
 ## @field {string} [storageClass] - StorageClass used to store the data.
+## @field {string} [diskType] - SeaweedFS disk type tag for the default volume servers (e.g., "hdd", "ssd").
 ## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
 ## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted.
 ## @field {map[string]Zone} [zones] - A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.
@@ -93,10 +94,39 @@ volume:
   replicas: 2
   size: 10Gi
   storageClass: ""
+  diskType: ""
   resources: {}
   resourcesPreset: "small"
   zones: {}
 
+## @typedef {struct} StoragePool - Storage pool configuration for separating buckets by disk type.
+## @field {string} diskType - SeaweedFS disk type tag (e.g., "ssd", "hdd", "nvme").
+## @field {int} [replicas] - Number of volume replicas. Defaults to volume.replicas.
+## @field {quantity} [size] - Persistent Volume size. Defaults to volume.size.
+## @field {string} storageClass - Kubernetes StorageClass for the pool.
+## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.
+
+## @param {map[string]StoragePool} [storagePools] - A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.
+## In Simple topology, one StatefulSet is created per pool. Pods from different pools may run on the same node.
+## In MultiZone topology, a StatefulSet is created for each zone×pool combination (e.g., zone1-fast, zone2-fast),
+## with each pinned to its zone via nodeSelector.
+## NOTE: Pool and zone names must be valid DNS labels (lowercase alphanumeric and hyphens).
+## In MultiZone, ensure that "{zoneName}-{poolName}" does not collide with any existing zone name.
+storagePools: {}
+#storagePools:
+#  fast:
+#    diskType: ssd
+#    replicas: 2
+#    size: 50Gi
+#    storageClass: "local-nvme"
+#    resourcesPreset: "small"
+#  archive:
+#    diskType: hdd
+#    replicas: 3
+#    size: 500Gi
+#    storageClass: "ceph-hdd"
+
 ## @typedef {struct} S3 - S3 service configuration.
 ## @field {int} [replicas] - Number of S3 replicas.
 ## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
diff --git a/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml b/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml
index 898e9f96..40f72072 100644
--- a/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml
+++ b/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml
@@ -8,7 +8,7 @@ spec:
     singular: seaweedfs
     plural: seaweedfses
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"db":{"description":"Database configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of database replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""}}},"filer":{"description":"Filer service configuration.","type":"object","default":{},"properties":{"grpcHost":{"description":"The hostname used to expose or access the filer service externally.","type":"string","default":""},"grpcPort":{"description":"The port used to access the filer service externally.","type":"integer","default":443},"replicas":{"description":"Number of filer replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"whitelist":{"description":"A list of IP addresses or CIDR ranges that are allowed to access the filer service.","type":"array","default":[],"items":{"type":"string"}}}},"host":{"description":"The hostname used to access SeaweedFS externally (defaults to 's3' subdomain for the tenant host).","type":"string","default":""},"master":{"description":"Master service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of master replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"replicationFactor":{"description":"Replication factor: number of replicas for each volume in the SeaweedFS cluster.","type":"integer","default":2},"s3":{"description":"S3 service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of S3 replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"topology":{"description":"The topology of the SeaweedFS cluster.","type":"string","default":"Simple","enum":["Simple","MultiZone","Client"]},"volume":{"description":"Volume service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of volume replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"zones":{"description":"A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"replicas":{"description":"Number of replicas in the zone.","type":"integer"},"size":{"description":"Zone storage size.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}}}}
+      {"title":"Chart Values","type":"object","properties":{"db":{"description":"Database configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of database replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""}}},"filer":{"description":"Filer service configuration.","type":"object","default":{},"properties":{"grpcHost":{"description":"The hostname used to expose or access the filer service externally.","type":"string","default":""},"grpcPort":{"description":"The port used to access the filer service externally.","type":"integer","default":443},"replicas":{"description":"Number of filer replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"whitelist":{"description":"A list of IP addresses or CIDR ranges that are allowed to access the filer service.","type":"array","default":[],"items":{"type":"string"}}}},"host":{"description":"The hostname used to access SeaweedFS externally (defaults to 's3' subdomain for the tenant host).","type":"string","default":""},"master":{"description":"Master service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of master replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"replicationFactor":{"description":"Replication factor: number of replicas for each volume in the SeaweedFS cluster.","type":"integer","default":2},"s3":{"description":"S3 service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of S3 replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"storagePools":{"description":"A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.","type":"object","default":{},"additionalProperties":{"type":"object","required":["diskType","storageClass"],"properties":{"diskType":{"description":"SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").","type":"string"},"replicas":{"description":"Number of volume replicas. Defaults to volume.replicas.","type":"integer"},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.","type":"string","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size. Defaults to volume.size.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"Kubernetes StorageClass for the pool.","type":"string"}}}},"topology":{"description":"The topology of the SeaweedFS cluster.","type":"string","default":"Simple","enum":["Simple","MultiZone","Client"]},"volume":{"description":"Volume service configuration.","type":"object","default":{},"properties":{"diskType":{"description":"SeaweedFS disk type tag for the default volume servers (e.g., \"hdd\", \"ssd\").","type":"string","default":""},"replicas":{"description":"Number of volume replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"zones":{"description":"A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"replicas":{"description":"Number of replicas in the zone.","type":"integer"},"size":{"description":"Zone storage size.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}}}}
   release:
     prefix: ""
     labels:
@@ -26,7 +26,7 @@ spec:
     description: Seaweedfs
     module: true
     icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl82NzlfMTkxMCkiLz4KPHBhdGggZD0iTTEzOC42ODUgMTIxLjA1N0MxMzguNjg1IDEyNi42NTIgMTM2LjQ2MiAxMzIuMDE3IDEzMi41MDQgMTM1Ljk3M0MxMjguNTQ3IDEzOS45MjkgMTIzLjE3OSAxNDIuMTUxIDExNy41ODIgMTQyLjE1MUMxMTEuOTg1IDE0Mi4xNTEgMTA2LjYxOCAxMzkuOTI5IDEwMi42NiAxMzUuOTczQzk4LjcwMjggMTMyLjAxNyA5Ni40Nzk1IDEyNi42NTIgOTYuNDc5NSAxMjEuMDU3Qzk2LjQ3OTUgMTE4LjI4NyA5Ny4wMjUzIDExNS41NDQgOTguMDg1OCAxMTIuOTg1Qzk5LjE0NjMgMTEwLjQyNSAxMDAuNzAxIDEwOC4xIDEwMi42NiAxMDYuMTQxQzEwNC42MiAxMDQuMTgyIDEwNi45NDYgMTAyLjYyOSAxMDkuNTA3IDEwMS41NjlDMTEyLjA2NyAxMDAuNTA5IDExNC44MTEgOTkuOTYyOSAxMTcuNTgyIDk5Ljk2MjlDMTIwLjM1MyA5OS45NjI5IDEyMy4wOTggMTAwLjUwOSAxMjUuNjU4IDEwMS41NjlDMTI4LjIxOCAxMDIuNjI5IDEzMC41NDQgMTA0LjE4MiAxMzIuNTA0IDEwNi4xNDFDMTM0LjQ2NCAxMDguMSAxMzYuMDE4IDExMC40MjUgMTM3LjA3OSAxMTIuOTg1QzEzOC4xMzkgMTE1LjU0NCAxMzguNjg1IDExOC4yODcgMTM4LjY4NSAxMjEuMDU3WiIgZmlsbD0idXJsKCNwYWludDFfcmFkaWFsXzY3OV8xOTEwKSIvPgo8cGF0aCBkPSJNMTEwLjMzNiAxMjYuMTQ3SDEyMy42OFYxMzYuODIzSDExMC4zMzZWMTI2LjE0N1oiIGZpbGw9IiMwRjVFOUMiLz4KPHBhdGggZD0iTTExOS4yNyAxMTIuMjk0QzExOS4yNyAxMTIuNzE0IDExOS4xNzggMTEzLjEzMSAxMTkgMTEzLjUxOUMxMTguODIxIDExMy45MDggMTE4LjU2IDExNC4yNjEgMTE4LjIzIDExNC41NThDMTE3LjkwMSAxMTQuODU1IDExNy41MDkgMTE1LjA5MSAxMTcuMDc5IDExNS4yNTJDMTE2LjY0OCAxMTUuNDEzIDExNi4xODYgMTE1LjQ5NiAxMTUuNzIgMTE1LjQ5NkMxMTQuNzc4IDExNS40OTYgMTEzLjg3NSAxMTUuMTU4IDExMy4yMSAxMTQuNTU4QzExMi41NDQgMTEzLjk1NyAxMTIuMTcgMTEzLjE0MyAxMTIuMTcgMTEyLjI5NEMxMTIuMTcgMTExLjQ0NSAxMTIuNTQ0IDExMC42MyAxMTMuMjEgMTEwLjAzQzExMy44NzUgMTA5LjQyOSAxMTQuNzc4IDEwOS4wOTIgMTE1LjcyIDEwOS4wOTJDMTE2LjE4NiAxMDkuMDkyIDExNi42NDggMTA5LjE3NSAxMTcuMDc5IDEwOS4zMzZDMTE3LjUwOSAxMDkuNDk2IDExNy45MDEgMTA5LjczMiAxMTguMjMgMTEwLjAzQzExOC41NiAxMTAuMzI3IDExOC44MjEgMTEwLjY4IDExOSAxMTEuMDY4QzExOS4xNzggMTExLjQ1NyAxMTkuMjcgMTExLjg3MyAxMTkuMjcgMTEyLjI5NFoiIGZpbGw9IiM1OTY4NkYiLz4KPHBhdGggZD0iTTEyOC4xMSAxMTQuMTAzQzEyOC4xMSAxMTQuOTUzIDEyNy43MzYgMTE1Ljc2NyAxMjcuMDcgMTE2LjM2OEMxMjYuNDA0IDExNi45NjggMTI1LjUwMSAxMTcuMzA1IDEyNC41NiAxMTcuMzA1QzEyNC4wOTQgMTE3LjMwNSAxMjMuNjMyIDExNy4yMjMgMTIzLjIwMSAxMTcuMDYyQzEyMi43NzEgMTE2LjkwMSAxMjIuMzc5IDExNi42NjUgMTIyLjA1IDExNi4zNjhDMTIxLjcyIDExNi4wNyAxMjEuNDU4IDExNS43MTcgMTIxLjI4IDExNS4zMjlDMTIxLjEwMiAxMTQuOTQgMTIxLjAxIDExNC41MjQgMTIxLjAxIDExNC4xMDNDMTIxLjAxIDExMy42ODMgMTIxLjEwMiAxMTMuMjY2IDEyMS4yOCAxMTIuODc4QzEyMS40NTggMTEyLjQ5IDEyMS43MiAxMTIuMTM3IDEyMi4wNSAxMTEuODM5QzEyMi4zNzkgMTExLjU0MiAxMjIuNzcxIDExMS4zMDYgMTIzLjIwMSAxMTEuMTQ1QzEyMy42MzIgMTEwLjk4NCAxMjQuMDk0IDExMC45MDEgMTI0LjU2IDExMC45MDFDMTI1LjUwMSAxMTAuOTAxIDEyNi40MDQgMTExLjIzOSAxMjcuMDcgMTExLjgzOUMxMjcuNzM2IDExMi40NCAxMjguMTEgMTEzLjI1NCAxMjguMTEgMTE0LjEwM1oiIGZpbGw9IiM1OTY4NkYiLz4KPHBhdGggZD0iTTEyMi4zMzMgMTE4Ljk3NkMxMjIuMzMzIDExOS44MjYgMTIxLjk1OCAxMjAuNjQgMTIxLjI5MyAxMjEuMjQxQzEyMC42MjcgMTIxLjg0MSAxMTkuNzI0IDEyMi4xNzggMTE4Ljc4MiAxMjIuMTc4QzExOC4zMTYgMTIyLjE3OCAxMTcuODU1IDEyMi4wOTYgMTE3LjQyNCAxMjEuOTM1QzExNi45OTMgMTIxLjc3NCAxMTYuNjAyIDEyMS41MzggMTE2LjI3MiAxMjEuMjQxQzExNS45NDMgMTIwLjk0MyAxMTUuNjgxIDEyMC41OSAxMTUuNTAzIDEyMC4yMDJDMTE1LjMyNCAxMTkuODEzIDExNS4yMzIgMTE5LjM5NyAxMTUuMjMyIDExOC45NzZDMTE1LjIzMiAxMTguNTU2IDExNS4zMjQgMTE4LjE0IDExNS41MDMgMTE3Ljc1MUMxMTUuNjgxIDExNy4zNjMgMTE1Ljk0MyAxMTcuMDEgMTE2LjI3MiAxMTYuNzEyQzExNi42MDIgMTE2LjQxNSAxMTYuOTkzIDExNi4xNzkgMTE3LjQyNCAxMTYuMDE4QzExNy44NTUgMTE1Ljg1NyAxMTguMzE2IDExNS43NzQgMTE4Ljc4MiAxMTUuNzc0QzExOS43MjQgMTE1Ljc3NCAxMjAuNjI3IDExNi4xMTIgMTIxLjI5MyAxMTYuNzEyQzEyMS45NTggMTE3LjMxMyAxMjIuMzMzIDExOC4xMjcgMTIyLjMzMyAxMTguOTc2WiIgZmlsbD0iIzU5Njg2RiIvPgo8cGF0aCBkPSJNMTE1LjMwOCAxMjEuOTA1QzExMy43MzUgMTIxLjQyNiAxMTUuNzA3IDEyMC42OCAxMTUuNDI5IDEyMC41NzNDMTE0LjY1MyAxMjAuMjc2IDExNS43MyAxMTkuMzMzIDExNi43NCAxMTguNTM5QzExNy42MjggMTE3Ljg0MSAxMTcuNjU5IDExNy44MzkgMTE3Ljg5MiAxMTguNDY4QzExOC4wMjQgMTE4LjgyMyAxMTguMzcxIDExOS4yMDYgMTE4LjY2NSAxMTkuMzE5QzExOS4yODkgMTE5LjU1OCAxMjAuOTUxIDExOS4yNjkgMTIwLjk1MSAxMTguODM1QzEyMC45NTEgMTE4LjIyMyAxMjEuNDE1IDExOC42OTkgMTIxLjc5NCAxMTkuNTMxQzEyMi40NTcgMTIwLjk4NyAxMjIuNDM3IDEyMi40NzIgMTIxLjQ1IDEyMi40NzJDMTIwLjg1OSAxMjIuNDcyIDEyMC4zMSAxMjIuNjkxIDEyMC4xOSAxMjMuMTQ3QzExNS4wNDYgMTI0LjYgMTE2LjQ3MSAxMjMuMjg0IDExNS4zMDggMTIxLjkwNVpNMTIzLjA5NCAxMTguMDU0QzEyMS42MDkgMTE3LjQ2NiAxMjAuNTQ3IDExNC44MzggMTIwLjU0NyAxMTMuMzA5QzEyMC41NDcgMTExLjMyMyAxMjIuNTQxIDEwOS4wOTUgMTI0LjMxNyAxMDkuMDk1QzEyOC4zMTUgMTA5LjA5NSAxMzAuNjg0IDExMi4yNjEgMTI4LjgzOCAxMTguNDA5QzEyOC4zODUgMTE5LjkxOSAxMjMuOTMzIDExOC4zODcgMTIzLjA5NCAxMTguMDU0Wk0xMjUuODY2IDExNS42NDlDMTI3LjU0NCAxMTQuNDc0IDEyNS44NTcgMTExLjc1NSAxMjMuOTgxIDExMi42MUMxMjIuNDc5IDExMy4yOTQgMTIzLjExOSAxMTYuMTE1IDEyNC43NyAxMTYuMTY0QzEyNC45NjEgMTE2LjE2OSAxMjUuNDU0IDExNS45MzggMTI1Ljg2NiAxMTUuNjQ5Wk0xMjQuMzM5IDExNC41NzlDMTIzLjc3MSAxMTQuMzgxIDEyMy44MDMgMTEzLjI1NiAxMjQuMzgzIDExMy4wMzRDMTI0LjkwMiAxMTIuODM1IDEyNS42MDQgMTEzLjM5OCAxMjUuNjA0IDExNC4wMTRDMTI1LjYwNCAxMTQuNDg5IDEyNC45MzYgMTE0Ljc4NyAxMjQuMzM5IDExNC41NzlaTTExMi4zMTkgMTE2Ljk4QzEwOS45NiAxMTUuNjcgMTEwLjI4NiAxMTEuMDA2IDExMi40MTcgMTA4Ljk2NUMxMTQuMzk2IDEwNy4wNjkgMTE4Ljc3OCAxMDcuMTAzIDExOS43NjQgMTA5LjQ2MkMxMjAuNDE1IDExMS4wMjEgMTIwLjIyOCAxMTIuNiAxMTkuMzk4IDExNC4wNzdDMTE4LjE5NCAxMTYuMjE5IDExNC4yNDIgMTE4LjA0OSAxMTIuMzE5IDExNi45OFpNMTE2LjU2IDExMy41OTNDMTE3LjMyNSAxMTIuOTAxIDExNy4yOTcgMTEyLjA2IDExNi41NzIgMTExLjI1OUMxMTUuNzc3IDExMC4zNzkgMTE0LjY5MiAxMTAuMzQ1IDExNC4wMzUgMTExLjM0N0MxMTMuNTI0IDExMi4xMjcgMTEzLjQzMSAxMTIuNTI4IDExMy45NDMgMTEzLjMwOUMxMTQuNTggMTE0LjI4IDExNS42NyAxMTQuMzk5IDExNi41NiAxMTMuNTkzWk0xMTQuMzc0IDExMi4zNEMxMTQuMTI4IDExMS42OTggMTE0Ljk4NSAxMTAuOTgxIDExNS42OCAxMTEuMjQ3QzExNS45NzQgMTExLjM2IDExNi4xNjQgMTExLjcxOCAxMTYuMTAyIDExMi4wNDRDMTE1Ljk2MSAxMTIuNzg1IDExNC42MzIgMTEzLjAxMiAxMTQuMzc0IDExMi4zNFoiIGZpbGw9IiNEM0Q2REEiLz4KPHBhdGggZD0iTTExOC40NjMgMTIxLjAwOEwxMTcuOTQ1IDEyMC43OEMxMTcuNTEgMTIwLjY4NSAxMTcuMjMxIDEyMS4xMDcgMTE3LjEzNiAxMjEuNTQzTDExNi44ODEgMTIyLjcwOUMxMTYuNzg2IDEyMy4xNDUgMTE3LjA2MSAxMjMuNTcxIDExNy40OTYgMTIzLjY2NkwxMTguNDQ3IDEyMy44NzRDMTE4Ljg4MiAxMjMuOTY5IDExOS4zMTEgMTIzLjY5NCAxMTkuNDA2IDEyMy4yNTlMMTE5LjY4NSAxMjEuNTU2QzExOS43OCAxMjEuMTIgMTE5LjQ3OSAxMjEuMjI4IDExOS4wNDMgMTIxLjEzM0wxMTguNjI4IDEyMS4wNDNDMTE4LjU3MyAxMjEuMzIxIDExOC41MTYgMTIxLjYxMyAxMTguNDcxIDEyMS44MzNDMTE4LjQzOCAxMjEuOTk4IDExOC40MDcgMTIyLjE0OCAxMTguMzc5IDEyMi4yODJDMTE4LjM1MSAxMjIuNDE1IDExOC4zMjcgMTIyLjUzMyAxMTguMzA1IDEyMi42MzVDMTE4LjI4MiAxMjIuNzM4IDExOC4yNjIgMTIyLjgyNSAxMTguMjQ1IDEyMi44OTdDMTE4LjIyOCAxMjIuOTY5IDExOC4yMTQgMTIzLjAyNSAxMTguMjAyIDEyMy4wNjhDMTE4LjE5NiAxMjMuMDg5IDExOC4xOTMgMTIzLjEwNyAxMTguMTg4IDEyMy4xMjFDMTE4LjE4MyAxMjMuMTM1IDExOC4xNzggMTIzLjE0NSAxMTguMTc1IDEyMy4xNTJDMTE4LjE3MyAxMjMuMTU1IDExOC4xNzIgMTIzLjE1NiAxMTguMTcxIDEyMy4xNThDMTE4LjE3IDEyMy4xNTkgMTE4LjE2OCAxMjMuMTYgMTE4LjE2NyAxMjMuMTZMMTE4LjE2NSAxMjMuMTU4QzExOC4xNjQgMTIzLjE1NiAxMTguMTYzIDEyMy4xNTIgMTE4LjE2MyAxMjMuMTQ4QzExOC4xNjIgMTIzLjE0IDExOC4xNjIgMTIzLjEyOSAxMTguMTYzIDEyMy4xMTVDMTE4LjE2MyAxMjMuMSAxMTguMTYzIDEyMy4wODMgMTE4LjE2NSAxMjMuMDYxQzExOC4xNjggMTIzLjAxOCAxMTguMTc1IDEyMi45NjEgMTE4LjE4MyAxMjIuODkxQzExOC4xOTIgMTIyLjgyIDExOC4yMDMgMTIyLjczNiAxMTguMjE2IDEyMi42NEMxMTguMjI5IDEyMi41NDMgMTE4LjI0NiAxMjIuNDMxIDExOC4yNjQgMTIyLjMwOEMxMTguMjgxIDEyMi4xODUgMTE4LjMwMSAxMjIuMDUxIDExOC4zMjMgMTIxLjkwM0MxMTguMzQ2IDEyMS43NTUgMTE4LjM3IDEyMS41OTIgMTE4LjM5NyAxMjEuNDE5QzExOC40MTYgMTIxLjI5OSAxMTguNDQyIDEyMS4xNCAxMTguNDYzIDEyMS4wMDhaIiBmaWxsPSIjOThDNkQ4Ii8+CjxwYXRoIGQ9Ik0xMDMuNTgxIDExNi4zNjdDMTAzLjQ3OSAxMTYuMTAzIDEwMy42MjIgMTE1LjY5OSAxMDMuODk4IDExNS40NjlDMTA0LjMwMyAxMTUuMTMzIDEwNC41MDQgMTE1LjE1NSAxMDQuOTMgMTE1LjU4MUMxMDUuMjIgMTE1Ljg3MSAxMDUuMzU1IDExNi4yNzYgMTA1LjIzIDExNi40NzlDMTA0LjkwMiAxMTcuMDA5IDEwMy43OTggMTE2LjkzNCAxMDMuNTgxIDExNi4zNjdaIiBmaWxsPSIjOThDNkQ4Ii8+CjxwYXRoIGQ9Ik0xMDYuMDM4IDExMi4yODFDMTA1LjY4IDExMS44NDkgMTA1LjcwMiAxMTEuNjYgMTA2LjE2NSAxMTEuMTk3QzEwNi42ODkgMTEwLjY3NCAxMDYuNzY0IDExMC42NzQgMTA3LjI4NyAxMTEuMTk3QzEwNy43NTEgMTExLjY2IDEwNy43NzMgMTExLjg0OSAxMDcuNDE1IDExMi4yODFDMTA3LjE3NiAxMTIuNTY4IDEwNi44NjYgMTEyLjgwMyAxMDYuNzI2IDExMi44MDNDMTA2LjU4NiAxMTIuODAzIDEwNi4yNzcgMTEyLjU2OCAxMDYuMDM4IDExMi4yODFaIiBmaWxsPSIjOThDNkQ4Ii8+CjxwYXRoIGQ9Ik0xMDYuMDM4IDEwNy4yMjRDMTA1LjY4MiAxMDYuNzk1IDEwNS42OTQgMTA2LjYxMiAxMDYuMTA2IDEwNi4yMDFDMTA2LjY1IDEwNS42NTcgMTA3LjczOCAxMDUuODggMTA3LjczOCAxMDYuNTM2QzEwNy43MzggMTA2Ljk3IDEwNy4wNzIgMTA3Ljc0NyAxMDYuNyAxMDcuNzQ3QzEwNi41NzUgMTA3Ljc0NyAxMDYuMjc3IDEwNy41MTIgMTA2LjAzOCAxMDcuMjI0WiIgZmlsbD0iIzk4QzZEOCIvPgo8cGF0aCBkPSJNMTE3Ljk1NSAxMzYuNTQxQzExNC41NzggMTM2LjExMSAxMTAuMDg3IDEzNC44ODEgMTA5LjQxIDEzNC4yNzRDMTA4LjEyMyAxMzMuMTE5IDEwOC45NDIgMTI3Ljg3OSAxMTAuNDY2IDEyNi41NEMxMTEuMzg3IDEyNS43MzEgMTE1LjAzOSAxMjQuNjYzIDExNy4xODIgMTI1LjE2OUMxMTkuNjQyIDEyNS43NDkgMTIzLjkzMiAxMjguNjQ4IDEyNC4yNSAxMjkuNTA4QzEyNC42MjUgMTMwLjUyMiAxMjQuMDQ4IDEzNC41NDEgMTIzLjMyMyAxMzUuNTM2QzEyMi42OTQgMTM2LjM5OSAxMjAuMzI1IDEzNi44NDMgMTE3Ljk1NSAxMzYuNTQxWk0xMjAuNTQgMTM0LjA4NEMxMjEuMjk3IDEzMy4zOTkgMTIxLjM0MiAxMzEuODQyIDEyMC42MjcgMTMxLjEyNkMxMTkuNDkgMTI5Ljk4OSAxMTcuMTEyIDEzMC44NjkgMTE3LjExMiAxMzIuNDI4QzExNy4xMTIgMTM0LjMwNCAxMTkuMTg5IDEzNS4zMDcgMTIwLjU0IDEzNC4wODRaTTExOC41ODIgMTMzLjEyNUMxMTguMzExIDEzMi40MTkgMTE4LjY4IDEzMS42MDggMTE5LjI3MiAxMzEuNjA4QzEyMCAxMzEuNjA4IDEyMC4yMjggMTMyLjE3MyAxMTkuODEyIDEzMi45NDlDMTE5LjM4MSAxMzMuNzU1IDExOC44NTMgMTMzLjgzIDExOC41ODIgMTMzLjEyNVpNMTE2LjQyMiAxMzMuMTQzQzExNy4wOTQgMTMyLjMzMyAxMTYuNzExIDEzMS4xNzYgMTE1LjY4MSAxMzAuOTAyQzExNC41ODEgMTMwLjYxIDExNC4wNTIgMTMxLjE4MyAxMTQuODY5IDEzMS43OEMxMTUuNjgzIDEzMi4zNzUgMTE1LjU1MSAxMzIuNjc5IDExNC41MzMgMTMyLjU1N0MxMTMuMzI3IDEzMi40MTMgMTEyLjgzMyAxMzEuNTY2IDExMy4yNTQgMTMwLjM2MkMxMTMuNjgxIDEyOS4xNDIgMTE1LjE5NyAxMjguODYzIDExNS43NTMgMTI5LjkwMkMxMTYuMTkzIDEzMC43MjUgMTE2LjYyNyAxMzAuNzkzIDExNi45IDEzMC4wODNDMTE3LjIyOSAxMjkuMjI0IDExNS45MTQgMTI4LjIzNyAxMTQuNDQgMTI4LjIzN0MxMTEuOTkzIDEyOC4yMzcgMTEwLjgxNiAxMzEuMDc0IDExMi41NDYgMTMyLjgwM0MxMTMuNSAxMzMuNzU4IDExNS43NDkgMTMzLjk1NSAxMTYuNDIyIDEzMy4xNDNaIiBmaWxsPSIjN0JBOUI5Ii8+CjxwYXRoIGQ9Ik0xMjAuMTE4IDEzOC41OTJDMTE4Ljc1MSAxMzcuMjk3IDEyMS45MTYgMTM2LjA5NiAxMjMuNjA2IDEzOC4yODNDMTI0LjQ2OSAxMzkuMzIyIDEyMi44NTMgMTM5Ljk3NiAxMjAuMTE4IDEzOC41OTJaTTEwNi4xMiAxMzUuNjU4QzEwNC43NTEgMTM0LjI4OSAxMDYuOTYzIDEzMy45MDQgMTA4LjU4MSAxMzUuMjNMMTA5Ljk0MSAxMzUuOTJMMTA4LjA1OSAxMzYuMDYxQzEwNy4yMTUgMTM2LjA2MiAxMDYuMzQzIDEzNS44ODEgMTA2LjEyIDEzNS42NThWMTM1LjY1OFpNMTI1LjM2MyAxMjcuODY2QzEyNS4wODIgMTI3LjQxIDEyOC4zMzMgMTI2LjI2NyAxMjguNjg4IDEyNi40ODZDMTI4Ljg0NiAxMjYuNTg0IDEyOC45NzUgMTI3LjMzNyAxMjguOTc1IDEyOC4xNjFDMTI4Ljk3NSAxMjkuMjM5IDEyOC44NCAxMjkuNjU4IDEyOC40OSAxMjkuNjU4QzEyOC4yMjIgMTI5LjY1OCAxMjUuNDc2IDEyOC4wNDcgMTI1LjM2MyAxMjcuODY2Wk0xMTguNjQxIDEyMS4wOTVDMTE0Ljg3MSAxMjAuNzUzIDExNS4zNzggMTE5LjMyNyAxMTYuMzYxIDExOC40OTlDMTE2LjkyOCAxMTguMDIxIDExNy4zNCAxMTcuNzc5IDExNy45MTMgMTE3LjY2N0MxMTcuOTEzIDExNy42NjcgMTE3Ljg3MiAxMTkuMDQ2IDExOC42NjYgMTE5LjMxOUMxMTkuMjk3IDExOS41MzYgMTIwLjI3OCAxMTkuMDY0IDEyMC40NzEgMTE4LjY3NUMxMjIuMTg4IDExNS4yMDEgMTIxLjQxNSAxMTguNjk5IDEyMS43OTQgMTE5LjUzMkMxMjMuMjM4IDEyNC4wMDcgMTIwLjE4OCAxMjEuNzMgMTE4LjY0MSAxMjEuMDk1Wk0xMDQuOTEyIDEyMS4yM0MxMDQuMjQyIDEyMC40ODcgMTAzLjY5MyAxMTkuNzI5IDEwMy42OTMgMTE5LjU0NEMxMDMuNjkzIDExOS4xMTYgMTA0Ljc0NiAxMTkuMTEyIDEwNS44NjMgMTE5LjUzN0MxMDYuNTkzIDExOS44MTQgMTEwLjM0NyAxMjAuMDA2IDExMC4zNDcgMTIxLjE1M0MxMTAuMzQ3IDEyMS44OTkgMTA4Ljg5IDEyMy43NjIgMTA4LjcyNiAxMjMuNzYyQzEwOC41NjMgMTIzLjc2MiAxMDUuNTgzIDEyMS45NzIgMTA0LjkxMiAxMjEuMjNaIiBmaWxsPSIjQTZCM0MyIi8+CjxwYXRoIGQ9Ik0xMTguNDYzIDEyMS4wMDhDMTE4LjQ0MiAxMjEuMTQgMTE4LjQxNiAxMjEuMjk5IDExOC4zOTcgMTIxLjQxOUMxMTguMzcgMTIxLjU5MiAxMTguMzQ1IDEyMS43NTUgMTE4LjMyMyAxMjEuOTAzQzExOC4zIDEyMi4wNTEgMTE4LjI4MSAxMjIuMTg1IDExOC4yNjMgMTIyLjMwOEMxMTguMjQ1IDEyMi40MzEgMTE4LjIyOSAxMjIuNTQyIDExOC4yMTYgMTIyLjYzOUMxMTguMjAzIDEyMi43MzYgMTE4LjE5MSAxMjIuODIgMTE4LjE4MyAxMjIuODlDMTE4LjE3NSAxMjIuOTYxIDExOC4xNjggMTIzLjAxOCAxMTguMTY1IDEyMy4wNjFDMTE4LjE2MyAxMjMuMDgzIDExOC4xNjQgMTIzLjEgMTE4LjE2MyAxMjMuMTE1QzExOC4xNjIgMTIzLjEyOSAxMTguMTYyIDEyMy4xNCAxMTguMTYzIDEyMy4xNDhDMTE4LjE2MyAxMjMuMTUyIDExOC4xNjQgMTIzLjE1NiAxMTguMTY1IDEyMy4xNThMMTE4LjE2NyAxMjMuMTZDMTE4LjE2OCAxMjMuMTYgMTE4LjE3IDEyMy4xNTkgMTE4LjE3MSAxMjMuMTU4QzExOC4xNzIgMTIzLjE1NyAxMTguMTczIDEyMy4xNTUgMTE4LjE3NSAxMjMuMTUyQzExOC4xNzggMTIzLjE0NSAxMTguMTgyIDEyMy4xMzUgMTE4LjE4NyAxMjMuMTIxQzExOC4xOTIgMTIzLjEwNyAxMTguMTk2IDEyMy4wODkgMTE4LjIwMiAxMjMuMDY3QzExOC4yMTMgMTIzLjAyNSAxMTguMjI4IDEyMi45NjkgMTE4LjI0NSAxMjIuODk3QzExOC4yNjIgMTIyLjgyNSAxMTguMjgyIDEyMi43MzggMTE4LjMwNSAxMjIuNjM1QzExOC4zMjcgMTIyLjUzMyAxMTguMzUxIDEyMi40MTUgMTE4LjM3OSAxMjIuMjgxQzExOC40MDYgMTIyLjE0OCAxMTguNDM4IDEyMS45OTggMTE4LjQ3MSAxMjEuODMzQzExOC41MTYgMTIxLjYxMyAxMTguNTczIDEyMS4zMjEgMTE4LjYyOCAxMjEuMDQzTDExOC40NjMgMTIxLjAwOFoiIGZpbGw9IiM0QzlDQkIiLz4KPHBhdGggZD0iTTMwLjk5ODYgMTQyLjY3M0MyNi40NDg5IDE0MC45MTYgMjEuNDY2NCAxMzYuODA1IDE4Ljc5MjEgMTMyLjYwM0MxNS40MDUzIDEyNy4yODEgMTQuNDA1MiAxMjMuNDE5IDE1LjA2MzYgMTE4LjIwM0MxNS42ODA2IDExMy4zMTUgMTcuMzU1OCAxMTAuNTU3IDIyLjIyMzIgMTA2LjQxM0MyOS4wNDE3IDEwMC42MDggMzQuNDg0NiA5Ny45Nzk5IDQwLjU5NDcgOTcuNTQxNUM0OS44MjEyIDk2Ljg3OTQgNTUuMDk3OCA5OS44MTA5IDU3LjY0NjUgMTA3LjAxNUM1OC41MDQzIDEwOS40MzkgNTguNjg1NiAxMTUuNTcgNTguMDU0NCAxMjAuODA5QzU3LjgzMTEgMTIyLjY2MyA1Ny40Nzg5IDEyNi4wNTUgNTcuMjcxOCAxMjguMzQ4QzU2LjU0NjcgMTM2LjM3NSA1NC40MTQ3IDE0MC40MTcgNDkuNjI1MyAxNDIuODQzQzQ4LjI5NzkgMTQzLjUxNiA0Ny43MTk5IDE0My41NjEgNDAuNjkyNCAxNDMuNTM5QzMzLjUxNTEgMTQzLjUxNiAzMy4wODEgMTQzLjQ3OCAzMC45OTg2IDE0Mi42NzNaTTAuMDc5NTc2NSAxMDQuOTY1QzAuMDgxNTcyMyAxMDMuODUzIDAuMTQ0NDAzIDEwMy40MzggMC4yMTk0MjcgMTA0LjA0NEMwLjI5NDQ1MSAxMDQuNjUgMC4yOTI4OTkgMTA1LjU2IDAuMjE1OTk2IDEwNi4wNjdDMC4xMzkwNzkgMTA2LjU3MyAwLjA3NzY4MzggMTA2LjA3OCAwLjA3OTU3NjUgMTA0Ljk2NVpNMC4wMDE3MzM1MSAxMDIuMjRDMC4wMTc4OTkyIDEwMS44NDggMC4wOTc3ODk3IDEwMS43NjggMC4yMDUzOTggMTAyLjAzN0MwLjMwMjc3MiAxMDIuMjggMC4yOTA3OTcgMTAyLjU3MSAwLjE3ODc4NyAxMDIuNjgzQzAuMDY2Nzc0OCAxMDIuNzk1IC0wLjAxMjkwMjEgMTAyLjU5NiAwLjAwMTczMzUxIDEwMi4yNFpNMC4wMjgzNDQ0IDc1LjEzMjZDMC4wMjgzNDQ0IDc0LjY2OTEgMC4xMDQ4NTcgNzQuNDc5NSAwLjE5ODM2OSA3NC43MTEyQzAuMjkxODg0IDc0Ljk0MyAwLjI5MTg4NCA3NS4zMjIyIDAuMTk4MzY5IDc1LjU1MzlDMC4xMDQ4NTcgNzUuNzg1NyAwLjAyODM0NDQgNzUuNTk2MSAwLjAyODM0NDQgNzUuMTMyNloiIGZpbGw9InVybCgjcGFpbnQyX3JhZGlhbF82NzlfMTkxMCkiLz4KPHBhdGggZD0iTTM1LjMxMzMgMTEyLjU0NEwzNy45IDExMS4wOTFMMzkuMzUxNyAxMjEuNDZMMzkuMjQ4IDEyOC45MjZMMzUuMzcwMyAxMzAuODUxTDMyLjkyMjkgMTI2LjQzN0wzNS4zMTMzIDExMi41NDRaIiBmaWxsPSIjMzA2MEFEIi8+CjxwYXRoIGQ9Ik0zOC43Mjk1IDExNi42OUwzOS4zNTE2IDEyNC41NzFMNDMuMjkxOSAxMjUuOTE5TDQzLjM5NTYgMTA5LjIyNUw0MC4xODEyIDExMC4wNTRMMzguNzI5NSAxMTYuNjlaIiBmaWxsPSIjNjA2MzY4Ii8+CjxwYXRoIGQ9Ik0zNS4zNjk5IDEzMC44NTFDMzMuMDMyNCAxMjkuNzMgMjkuNzMwMSAxMjYuNDA4IDI4LjY2MjEgMTI0LjEwM0MyOC4wMzMyIDEyMi43NDUgMjcuNjM5NyAxMjIuMzEgMjYuODkyMyAxMjIuMTQ2QzI1Ljc4NzkgMTIxLjkwMyAyNS44MDg0IDEyMS45NzEgMjYuMzIxOCAxMjAuMjU4QzI2LjU5MzYgMTE5LjM1IDI2LjkwMzIgMTE4Ljk1NCAyNy4zNDA2IDExOC45NTRDMjcuNjg2MiAxMTguOTU0IDI5LjE1OTcgMTE3Ljg0MSAzMC42MTQ5IDExNi40OEMzMi4wNzAyIDExNS4xMTkgMzMuNzIyNiAxMTMuNjc3IDM0LjI4NjkgMTEzLjI3NUwzNS4zMTI5IDExMi41NDRMMzUuNjc2NyAxMTQuMjQxQzM3LjA0NDMgMTIwLjYxOCAzNy4wMjcgMTI0LjI2NiAzNS42MTk4IDEyNi4yNDNDMzQuNTUyMSAxMjcuNzQ0IDM0Ljg0MTcgMTI4LjM5MyAzNi41NzkxIDEyOC4zOTNDMzcuMzk3IDEyOC4zOTMgMzcuODIyMiAxMjguMTg1IDM4LjEzMDUgMTI3LjYzNEMzOC42NzQ4IDEyNi42NjMgMzguNjMxNSAxMjAuOTY4IDM4LjA0NTQgMTE2LjQyNkMzNy4zNDQ2IDExMC45OTUgMzcuMzEyNyAxMTEuMTY3IDM5LjE1NzggMTEwLjM5OEM0MC4wMzYgMTEwLjAzMSA0MC44MTggMTA5Ljc5NyA0MC44OTU1IDEwOS44NzdDNDAuOTczMSAxMDkuOTU2IDQwLjgxOTEgMTExLjIzNSA0MC41NTM0IDExMi43MThDMzkuNjA2NyAxMTguMDAzIDM5LjkzMTUgMTIzLjIzOCA0MS4yNzUyIDEyNC4zNTNDNDEuNjg1MSAxMjQuNjkzIDQxLjcyMzMgMTIzLjk2OSA0MS41NDUyIDExOS4yMzJDNDEuMzE1NiAxMTMuMTIzIDQxLjUxNzQgMTEwLjkxOSA0Mi40MDc1IDEwOS44MkM0Mi45MTk4IDEwOS4xODggNDMuMjEzIDEwOS4xMTYgNDQuNDk1OSAxMDkuMzFDNDYuOTU2NiAxMDkuNjgyIDQ2Ljk1MDYgMTA5LjY2OCA0Ni4yMDk5IDExMy4yNTRDNDUuODQ5NiAxMTQuOTk5IDQ1LjQ0ODMgMTE3LjIyNCA0NS4zMTggMTE4LjJMNDUuMDgxMiAxMTkuOTczTDQ1Ljk0NDYgMTE5LjY0NUM0Ni40MTk1IDExOS40NjUgNDcuNDQxMyAxMTguOTk0IDQ4LjIxNTMgMTE4LjU5OUw0OS42MjI2IDExNy44ODFMNDkuMzg5MyAxMTguNjdDNDkuMjYxIDExOS4xMDUgNDkuMDY3MiAxMjAuNzAxIDQ4Ljk1ODcgMTIyLjIxOEw0OC43NjE0IDEyNC45NzZMNDcuMTA5NSAxMjQuMzI1QzQ2LjIwMSAxMjMuOTY3IDQ1LjMxMTYgMTIzLjY3NCA0NS4xMzMxIDEyMy42NzRDNDQuOTQxIDEyMy42NzQgNDQuODA4NSAxMjUuNTMyIDQ0LjgwODUgMTI4LjIyNEM0NC44MDg1IDEzMS44OTEgNDQuNzE3MSAxMzIuNzc1IDQ0LjMzODYgMTMyLjc3NUM0MS4wMTk4IDEzMi4yOTUgMzguNzg0MiAxMzIuNDU4IDM1LjM2OTkgMTMwLjg1MVoiIGZpbGw9IiNFRUMyM0IiLz4KPHBhdGggZD0iTTQxLjE2MzkgMTMyLjQxOEM0MS4xNjM5IDEzMi4yODMgNDEuMzQwOCAxMzAuNTE1IDQxLjY2OTIgMTI4LjE0NUM0MS45OTc3IDEyNS43NzUgNDIuMzU3NyAxMjIuOTYxIDQyLjQ2OTIgMTIxLjg5M0M0Mi41ODA4IDEyMC44MjQgNDIuNzk2OSAxMjAuMDI3IDQyLjk0OTUgMTIwLjEyMUM0My42NDQzIDEyMC41NTEgNDQuMjkzOCAxMjkuMzc1IDQ0LjA0NzQgMTMxLjQyQzQzLjg5MDkgMTMyLjcxOSA0My42NTk1IDEzMi43MzcgNDMuMzAxOSAxMzIuNjc3QzQyLjY2MDIgMTMyLjU3IDQxLjkxMDEgMTMyLjUxMyA0MS4xNjM5IDEzMi40MThaTTMyLjU5NjkgMTIyLjczNUMzMS42ODEzIDEyMi41ODMgMzAuODI0MiAxMjEuNDQyIDMwLjgyNDIgMTIwLjM3NEMzMC44MjQyIDExOS40MDcgMzIuMjM4MSAxMTcuOTM3IDMzLjE2ODUgMTE3LjkzN0MzNC42NjY2IDExNy45MzcgMzUuODM5MiAxMjAuNTEzIDM0Ljk0ODQgMTIxLjg0N0MzNC41NTE3IDEyMi40NDEgMzMuNDE0NyAxMjIuODcgMzIuNTk2OSAxMjIuNzM1WiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZD0iTTExNC4wMjEgMTM3LjQ5OEMxMDcuMzE4IDEzNS43NCAxMDYuMjczIDEzNC4xMDQgMTA2LjYwOSAxMjUuODkxQzEwNi43MTYgMTIzLjI4MSAxMDYuODg1IDEyMC41MzkgMTA2Ljk4NiAxMTkuNzk3QzEwNy41NDUgMTE1LjY2NCAxMDguMzQyIDExMi4xNzMgMTA5LjA4NiAxMTAuNTk5QzEwOS43NDQgMTA5LjIwNiAxMDkuODQyIDEwOC43MTIgMTA5LjUzNSAxMDguMzQyQzEwOC40NSAxMDcuMDM1IDExMC4zNzEgMTA0Ljk5NSAxMTEuOTEgMTA1LjgxOUMxMTIuNDU3IDEwNi4xMTEgMTEyLjkxOCAxMDYuMDc3IDExMy45NDUgMTA1LjY2NUMxMTcuMDYyIDEwNC40MTkgMTIzLjExNyAxMDUuNTcxIDEyNi44MTQgMTA4LjExNUMxMjguMTQ5IDEwOS4wMzMgMTI4LjQ4NSAxMDkuMTM2IDEyOS4wMzggMTA4Ljc5MUMxMzAuNTIzIDEwNy44NjMgMTMyLjQ1MSAxMTAuNTczIDEzMS4yNSAxMTEuOUMxMzAuNzg3IDExMi40MTIgMTMwLjc1NSAxMTIuNzA1IDEzMS4wNjUgMTEzLjU5NkMxMzEuODUgMTE1Ljg0NiAxMzEuNzk0IDExNi4xMDQgMTI4LjAwNiAxMjcuNzE5QzEyNS41OCAxMzUuMTYgMTI0LjU0MyAxMzcuMzY1IDEyMy4yNjQgMTM3LjgxMUMxMjEuNjUzIDEzOC4zNzMgMTE2LjcyMyAxMzguMjA2IDExNC4wMjEgMTM3LjQ5OFpNMTIyLjU0MSAxMzUuMjI5QzEyMy4wMDMgMTM0LjU0MSAxMjMuMzU5IDEzMy4zMTMgMTIzLjUxMyAxMzEuODc4QzEyMy43OTQgMTI5LjI1IDEyMy44MTkgMTI5LjI4MyAxMjAuMzE3IDEyNy42MDFDMTE3LjY4NSAxMjYuMzM4IDExMy44MzMgMTI1Ljk3MiAxMTEuODU1IDEyNi43OThDMTEwLjgyOSAxMjcuMjI3IDExMC41OTUgMTI3LjU1NiAxMTAuMDU5IDEyOS4zMjdDMTA5LjExNiAxMzIuNDQzIDEwOS43MDMgMTM0LjMwOCAxMTEuODMyIDEzNC45NThDMTEzLjEzOSAxMzUuMzU3IDEyMC4wOSAxMzYuNDMgMTIwLjk4IDEzNi4zN0MxMjEuNTA0IDEzNi4zMzUgMTIyLjA4MiAxMzUuOTEyIDEyMi41NDEgMTM1LjIyOVpNMTE5LjQ1MSAxMjIuNDJDMTE5LjYzIDEyMi4wODEgMTE5LjY4NSAxMjEuNTU2IDExOS42ODUgMTIxLjU1NkMxMjAuMTU2IDEyMS42NTQgMTIwLjQ4IDEyMS42ODMgMTIwLjcyNiAxMjEuNzE5QzEyMS4xMDUgMTIxLjc3NCAxMjEuNTY0IDEyMS41ODcgMTIxLjc0NSAxMjEuMzAzQzEyMi4xNDkgMTIwLjY3MSAxMjAuNDc0IDExNy43MDEgMTE5LjU0OCAxMTcuNDA4QzExOC42NjggMTE3LjEyOCAxMTUuOTM1IDExOC44MjcgMTE1LjkzNSAxMTkuNjUzQzExNS45MzUgMTIwLjAyMiAxMTYuNTUzIDEyMC40MTEgMTE2LjgzMSAxMjAuNTE4QzExNi45ODIgMTIwLjU3NiAxMTcuMjUyIDEyMC43MzggMTE3LjU3NiAxMjAuOTM4QzExNy4zOCAxMjEuMzUxIDExNy4zNDYgMTIxLjQ3OCAxMTcuMzEyIDEyMS43MjRDMTE3LjIwNCAxMjIuNDk4IDExNy40MzUgMTIyLjY4NiAxMTguNDE2IDEyMi45MTJDMTE5LjE1MSAxMjIuOTkxIDExOS4yNSAxMjIuODQ1IDExOS40NTEgMTIyLjQyWk0xMjcuMjY1IDExNi44MzZDMTMwLjkzMyAxMTMuNDc1IDEyNy4wNzQgMTA3LjQxIDEyMi43MDUgMTA5LjY3QzEyMS42MjYgMTEwLjIyOCAxMjAuNjU0IDExMi4wMTkgMTIwLjY1NCAxMTMuNDQ5QzEyMC42NTQgMTE1LjY2NCAxMjIuODMxIDExNy45MzcgMTI0Ljk1NyAxMTcuOTQxQzEyNS43MzMgMTE3Ljk0MyAxMjYuNDE0IDExNy42MTcgMTI3LjI2NSAxMTYuODM2Wk0xMTcuMTQxIDExNS42MjJDMTE5LjAzNSAxMTQuNDY4IDExOS44MDQgMTExLjc5NSAxMTguODAyIDEwOS44NTdDMTE4LjA4MiAxMDguNDY0IDExNy4wMDggMTA3LjgzIDExNS4zNjYgMTA3LjgzQzExMS41MDggMTA3LjgzIDEwOS40ODUgMTEzLjIzNCAxMTIuNDY1IDExNS41NzhDMTEzLjU3IDExNi40NDggMTE1Ljc1NCAxMTYuNDY4IDExNy4xNDEgMTE1LjYyMloiIGZpbGw9IiMwOTk2RDEiLz4KPHBhdGggb3BhY2l0eT0iMC45IiBkPSJNMzMuMTc1NyAyNkwzMi4zODEgMjcuMjE5QzMxLjk0NDkgMjcuODg5IDMxLjI4MzYgMjkuMzI0OCAzMC45MDkxIDMwLjQwODhDMzAuNTM0NyAzMS40OTI4IDI5Ljk5MjIgMzIuOTcwMSAyOS43MDQzIDMzLjY5MjhDMjkuNDE2MyAzNC40MTU0IDI5LjE3MzMgMzYuMTE1IDI5LjE2MzggMzcuNDdDMjkuMTQzNiA0MC4zNTMgMjguNzQ5NCA0MS44ODg4IDI3LjYzNjQgNDMuNDIyNUMyNi45MjEyIDQ0LjQwOCAyNi42NzUxIDQ0LjUyMjMgMjUuNDUzMiA0NC40NDFDMjMuODk5NSA0NC4zMzc3IDIyLjgxNTMgNDUuMDgxNSAyMS4yMTcgNDcuMzQ4MUMyMC43MTY1IDQ4LjA1OCAyMC4xMzY3IDQ4LjYzOTMgMTkuOTI4OSA0OC42MzkzQzE5LjcyMTEgNDguNjM5MyAxOS4xODA1IDQ4LjIzMTkgMTguNzI2MiA0Ny43MzUxQzE4LjI3MTkgNDcuMjM4MiAxNy45OTQ0IDQ3LjAxMTUgMTguMTExIDQ3LjIyOThDMTguNDkgNDcuOTM5NiAxNy41OTA0IDUzLjI2MTUgMTYuODM3OCA1NC43NjQyQzE1Ljk2NyA1Ni41MDI4IDE0LjM4NzIgNTcuNzIzMyAxMi41MzU0IDU4LjA4NDNDMTEuMDA1OSA1OC4zODI2IDExLjIyODMgNTguMDkgOC43MTc5NSA2My4wOTQ2QzYuNjYzMzQgNjcuMTkwNyA1Ljk2OTM1IDY3LjgyNjQgMi42NTUzMyA2OC42NTQyQzEuNDk3MTcgNjguOTQzNCAwLjQ1ODc1OSA2OS43MTQyIDAgNzAuNTI4N1Y3Mi44MjYzQzAuMzU2MTkzIDcyLjc0NzMgMC44Mjg3MjggNzIuNjIwMyAxLjYxNDk5IDcyLjM4NzNDMi45OTQ4NiA3MS45NzgyIDQuODIzNDggNzEuNDgwNiA1LjY3ODEgNzEuMjgwNkM3LjcyOTM0IDcwLjgwMDYgOS4zOTM1MSA2OS4yMTk1IDkuOTIyNzkgNjcuMjQ2N0MxMC4yNDI0IDY2LjA1NTQgMTAuNzAzMyA2NS40MjQxIDExLjk5OTIgNjQuNDA1OEMxMy4yODQgNjMuMzk2MiAxMy43NTY1IDYyLjc1NDYgMTQuMDY3MSA2MS41OTY5QzE0LjM3MzkgNjAuNDUzMiAxNC43MDExIDYwLjAwNCAxNS40NDA3IDU5LjcwNjNDMTcuMDE1MyA1OS4wNzI0IDIwLjY0NDQgNTUuODY1NSAyMS4yMzYzIDU0LjU4NThDMjEuNTM3MyA1My45MzQ5IDIyLjExOTggNTIuNTM5OSAyMi41Mjg3IDUxLjQ4NjJDMjMuMjYzNCA0OS41OTMyIDI1LjAxOTUgNDcuMzI2MSAyNS43NTAxIDQ3LjMyNjFDMjUuOTU3NCA0Ny4zMjYxIDI3LjEwOSA0Ni43MjQ4IDI4LjMwOTMgNDUuOTkwOEMzMS4yMzc2IDQ0LjIwMDMgMzEuNTk5MSA0My40MTM2IDMxLjU5OTEgMzguODYxNEMzMS41OTkxIDM1LjY4MTQgMzEuNjg3IDM1LjE1NTcgMzIuMzQ2OCAzNC4zNjg0QzMzLjAwMzcgMzMuNTg0NyAzMy4wOTk3IDMzLjAyNDkgMzMuMTM1MSAyOS43MzkxTDMzLjE3NTcgMjZaTTI0LjMzMzggNjMuNTk1OEMyNC4yMDM3IDYzLjYxMzUgMjQuMDczOCA2My42NjE4IDIzLjkyNTggNjMuNzM2MkMyMi45Mzk3IDY0LjIzMTUgMjIuNjEzNiA2NC45MTAyIDIxLjU5NzMgNjguNTg2QzIxLjAxNzkgNzAuNjgxNSAyMC40MjEyIDcyLjA4MTkgMTkuODc5OCA3Mi42MTc4QzE5LjQyMzUgNzMuMDY5NSAxOC45MzgzIDczLjg4MjMgMTguODAxIDc0LjQyNDJDMTguMTgxIDc2Ljg3MTUgMTYuNzQ1NCA3OC42MDczIDE0LjQ0OTUgNzkuNjg3MUMxMi40NTU1IDgwLjYyNDkgMTAuNjQwNyA4Mi4xMTc5IDkuMTExMDIgODQuMDc5OEM4LjMyMTA5IDg1LjA5MjkgNy40ODc1MiA4Ni4wMjkgNy4yNTY3OCA4Ni4xNjA5QzYuNzYxNjQgODYuNDQ0IDUuNzA4OTkgODguODk0MSA0LjYwNzg1IDkyLjMyOEMzLjcxMDkyIDk1LjEyNSAxLjcxMDY1IDk3LjQ2ODIgMC40Nzg1MTQgOTcuMTY1OEMwLjI1NDkzMSA5Ny4xMTA5IDAuMTA2OTExIDk3LjExMzcgMCA5Ny4yOTAxVjEwNC40OTJDMC41NTY0MTEgMTAzLjY2NCAxLjIzNDIgMTAyLjYyOSAyLjU2MzQ3IDEwMC41NEM0LjM0NTExIDk3LjczOTcgNi40NjM4NSA5NC40ODY3IDcuMjcxNzMgOTMuMzEyNEM4LjA3OTYgOTIuMTM4MSA5LjM1Njg3IDkwLjE0ODggMTAuMTA4NiA4OC44OTE2QzExLjIzNDIgODcuMDA5MiAxMi4xMDE2IDg2LjEyNDMgMTUuMDI4NCA4My44ODMzTDE4LjU4MzEgODEuMTYyN0wyMC40MDUzIDc1Ljk4ODFDMjMuMTg5NSA2OC4wODE3IDIzLjk1ODUgNjcuMTk5NyAyNy43NjI0IDY3LjU1MTVDMjkuNDYwNSA2Ny43MDg1IDMwLjYzMzQgNjcuNjE5NiAzMi4wNzM0IDY3LjIyNjdDMzQuMTgyNiA2Ni42NTEyIDM0LjQ3OTkgNjYuMTg3MiAzMy4zNTUxIDY1LjIzMThDMzIuNjU1NCA2NC42Mzc2IDMxLjMxNTMgNjQuNjQgMjguMjM4OCA2NS4yNDE4QzI3LjMzOTcgNjUuNDE3NyAyNi45MzQzIDY1LjI3NTcgMjUuODkzMiA2NC40MTc4QzI1LjEwNTEgNjMuNzY4NCAyNC43MjQxIDYzLjU0MjYgMjQuMzMzOCA2My41OTU4Wk0zMS43MTY2IDgzLjI1OThDMzEuNjYwNSA4My4yNzQ5IDMxLjU5MjEgODMuMzEyNiAzMS41MTE1IDgzLjM3MjFDMzEuMjcwOSA4My41NSAzMC42NTM2IDgzLjc5IDMwLjEzNzkgODMuOTA1NEMyOS4zODc2IDg0LjA3MzQgMjkuMDQ5OCA4NC40OTMyIDI4LjQ0ODIgODYuMDA0NUMyOC4wMzQ3IDg3LjA0MzIgMjcuNDkxNSA4OC4xMTUzIDI3LjI0MTIgODguMzg2M0MyNi45OTA5IDg4LjY1NzMgMjYuNDc1IDg5LjU1MSAyNi4wOTQxIDkwLjM3MzJDMjQuOTQyMiA5Mi44NTkyIDIzLjUyODIgOTQuMDYxOCAxOS45MDExIDk1LjY0MjFDMTYuNjEwNyA5Ny4wNzU2IDE2LjU2NyA5Ny4xMDg2IDE1LjY2NzEgOTguOTgwMkMxNS4xMDI3IDEwMC4xNTQgMTQuNjc5MiAxMDEuNzU3IDE0LjU0OTkgMTAzLjIwNUMxNC4yNzMxIDEwNi4zMDIgMTMuNTk2MiAxMDcuMDMxIDkuNTIxMTggMTA4LjYxNkM1LjkxNDk3IDExMC4wMTkgMy41NzcwMiAxMTEuNzQ1IDMuNDE1ODMgMTEzLjEyM0MzLjI0MDQxIDExNC42MjMgMi41OTgxMyAxMTUuMDg0IDAuOTI5MjYgMTE0LjkwN0MwLjUzOTUyOSAxMTQuODY2IDAuMjQ0MzMyIDExNC44NTEgMCAxMTQuODgxVjEyMUMxLjAyNjU4IDExOS42NTggMi43MTkyMiAxMTguMzYxIDYuMjI0OTcgMTE2LjIwNkMxMC4zNjA0IDExMy42NjUgMTIuNzA2NSAxMTEuNTc1IDEzLjU3NzkgMTA5LjY1NEMxMy45MjYgMTA4Ljg4NyAxNC42NTQ3IDEwNy4zOTMgMTUuMTk3MSAxMDYuMzM0QzE1LjczOTUgMTA1LjI3NSAxNi4yODQ1IDEwMy45MDEgMTYuNDA4NCAxMDMuMjgxQzE2LjczMjQgMTAxLjY2IDE4LjMwMzIgMTAwLjM0OSAyMC42NjU5IDk5LjcyNkMyNS4xNzcgOTguNTM3MiAyNS43NDYxIDk4LjAxNjMgMjYuMzUyNSA5NC41MzU0QzI2Ljg1NjEgOTEuNjQ1MiAyOC42MTIgODguMDY2MSAzMC41MjY3IDg2LjAyNDZDMzEuMzA5NSA4NS4xOSAzMS45NDk1IDg0LjE4IDMxLjk0OTUgODMuNzc5MUMzMS45NDk1IDgzLjM3NjYgMzEuODg0OSA4My4yMTQ2IDMxLjcxNjYgODMuMjU5OFoiIGZpbGw9IiMzNTkxMzYiLz4KPHBhdGggZD0iTTguMDgxNzcgNzQuNDA4M0M2LjAzNDE5IDczLjg3MDUgNS44OTQ0MyA3My43MzAyIDYuMDQyNzEgNzIuMzYxNUM2LjEzMDI1IDcxLjU1MzMgNi4yNDAxNyA3MC44NTc1IDYuMjg2OTYgNzAuODE1NEM2LjMzMzc2IDcwLjc3MzMgNy43MDQ0MyA3MS4wNjg3IDkuMzMyOTIgNzEuNDcxOUMxMS45NzY4IDcyLjEyNjQgMTIuNDg2NiA3Mi4xMjM4IDE0LjA5NDcgNzEuNDQ3NEMxNi40MDQxIDcwLjQ3NiAxNy4yMzgzIDY4Ljc3NTMgMTYuNDAyMiA2Ni43NDMxQzE1Ljk0MjQgNjUuNjI1NyAxNC45MjA0IDY0LjgyODEgMTIuMjM4NCA2My40OTRDNy42NDE3IDYxLjIwNzUgNi41MzA2MiA1OS45OTkgNi4yNzQ2NSA1Ny4wMDc2QzUuODkzMzcgNTIuNTUxOSA4Ljg0Njg5IDQ5Ljk4MzYgMTQuMzUyMiA0OS45ODM2QzE1Ljk3MzMgNDkuOTgzNiAxNy44NDg3IDUwLjE5MzcgMTguNTE5NiA1MC40NTA1QzE5LjYzNjggNTAuODc4MSAxOS42OTM3IDUxLjAzOTkgMTkuMTk0NSA1Mi4zNzEyQzE4LjcxODIgNTMuNjQxNiAxOC41MDI3IDUzLjc2ODggMTcuNDg2MSA1My4zNzk2QzE1LjUxOTkgNTIuNjI3IDEyLjE5NDggNTIuODU1NCAxMS4wMDU4IDUzLjgyNDdDOS43OTA1OCA1NC44MTUzIDkuNTU3MzYgNTYuOTI1MiAxMC41MzI0IDU4LjEwNzlDMTAuODcyNyA1OC41MjA3IDEyLjkwODcgNTkuNzc5IDE1LjA1NjkgNjAuOTA0MUMxOC40NjI4IDYyLjY4ODEgMTkuMDgyIDYzLjIyMTQgMTkuODk1MSA2NS4wNzE5QzIxLjExNTIgNjcuODQ4NyAyMC42Nzg4IDcwLjM0MzcgMTguNjA3OCA3Mi40MzIzQzE2LjE2MDcgNzQuOTAwMiAxMi41NDEzIDc1LjU3OTYgOC4wODE3NyA3NC40MDgzWk0yOC45MzI4IDc0LjM4MjNDMjUuMjM2NSA3Mi45OTU4IDIzLjcxMzggNzAuNTQwNSAyMy43MTM4IDY1Ljk2NjdDMjMuNzEzOCA2Mi41MDM0IDI0LjU1ODggNjAuNDY5NyAyNi44MzMzIDU4LjQ1OTNDMjguMzk2NCA1Ny4wNzc2IDI4Ljk4NjcgNTYuODY4NiAzMS4zMjY4IDU2Ljg2ODZDMzIuODE2OCA1Ni44Njg2IDM0LjY4MjEgNTcuMjEyOSAzNS41MDA1IDU3LjYzODlDMzcuMzE2OSA1OC41ODQ2IDM4LjgzMTkgNjEuNzQyNiAzOC44NDY2IDY0LjYxNDNMMzguODU3MyA2Ni43MDQ0SDMyLjk0MjNIMjcuMDI3M0wyNy4zNDIgNjguMDU2OUMyNy41MTUgNjguODAwNyAyOC4zMzU0IDcwLjAzOTEgMjkuMTY1IDcwLjgwOUMzMC41NzczIDcyLjExOTYgMzAuODk0OSA3Mi4xOTc5IDM0LjE1NDcgNzIuMDM4NUMzNy4zOTM4IDcxLjg4MDEgMzcuNjQ2MyA3MS45NDA5IDM3Ljc4NCA3Mi45MTIyQzM3Ljk2MjYgNzQuMTcyNSAzNy4xODgyIDc0LjUyMzYgMzMuNTI0MiA3NC44NDM0QzMxLjgwODUgNzQuOTkzMiAzMC4xMDU2IDc0LjgyMjIgMjguOTMyOCA3NC4zODIzWk0zNS4wODgxIDYyLjUyNDJDMzQuOTU1OCA2MC42NzMgMzMuMzY0NCA1OS4zMjc2IDMxLjMwNzIgNTkuMzI3NkMyOS43MDg2IDU5LjMyNzYgMjguNzI4MSA2MC4wOTA5IDI3LjY2MiA2Mi4xNjU1QzI2Ljc0NTcgNjMuOTQ4NiAyNy40MTIgNjQuMjk2NSAzMS40NDg4IDY0LjE0MjVMMzUuMTkzNiA2My45OTk2TDM1LjA4ODEgNjIuNTI0MlpNNDQuMzkxNCA3NC4zNzA4QzQyLjU3MTEgNzMuNTQ2OCA0MS43MDU5IDcyLjEyODYgNDEuNjQyMSA2OS44NjQ3QzQxLjU0MTYgNjYuMjk0NCA0NC4xMTEgNjQuMTQ2OCA0OS4yNTc2IDYzLjQ5OTRDNTEuODQxNCA2My4xNzQ0IDUyLjA0OTUgNjMuMDU3NyA1MS43NTkzIDYyLjA5NjlDNTAuOTY1IDU5LjQ2NjYgNDguMjQyMyA1OC41NjQ0IDQ0LjkyNzYgNTkuODMzMUM0My40MzAzIDYwLjQwNjMgNDMuNDg2OCA2MC40MzEzIDQzLjA1MTQgNTkuMDAzMkM0Mi43ODAxIDU4LjExMzUgNDIuOTk4MiA1Ny44NTExIDQ0LjM5NSA1Ny4zODdDNDYuOTM2NCA1Ni41NDI3IDUxLjM3NDUgNTYuNjM0MiA1Mi43Nzc5IDU3LjU2QzU0LjkzOTIgNTguOTg1NyA1NS4zNzUxIDYwLjYwMTkgNTUuNTQ4NyA2Ny44MzI4TDU1LjcxMDYgNzQuNTc0NUw1NC4xMjMgNzQuNTc0QzUzLjAzNzcgNzQuNTczMyA1Mi41MzUzIDc0LjMzOTYgNTIuNTM1MyA3My44MzU0QzUyLjUzNTMgNzIuOTA2NiA1Mi4wNTI4IDcyLjkwMjQgNTAuNzUyIDczLjgxOTZDNDkuMjAxMyA3NC45MTMgNDYuMTY5NyA3NS4xNzU3IDQ0LjM5MTQgNzQuMzcwOFpNNTAuOTQ3NyA3MC44MTc1QzUxLjcwOTkgNjkuOTczNSA1Mi4wNDY4IDY4Ljk4NiA1Mi4wNDY4IDY3LjU5NjZWNjUuNTkyOUw0OS44MTgyIDY1Ljg0NThDNDUuNzE5IDY2LjMxMSA0My44NzQ5IDY5LjUxMTggNDYuNTA1OCA3MS41OTUzQzQ4LjAzNzEgNzIuODA3OSA0OS4zNTk0IDcyLjU3NjMgNTAuOTQ3NyA3MC44MTc1Wk05Mi4wMDIgNzQuNTc4OEM4OC40MDI0IDczLjQ4NjQgODYuMjQxOSA3MC4yNDY2IDg2LjI0MTkgNjUuOTQxQzg2LjI0MTkgNjAuNDA0MiA4OS41MjExIDU2LjgzMjUgOTQuNjQxIDU2Ljc5MjVDOTguNjk4OSA1Ni43NjA5IDEwMS4yNjMgNTkuNDY3OSAxMDEuNTAzIDY0LjAzNjZMMTAxLjYzIDY2LjQ1ODVMOTYuMjU2MiA2Ni41ODg1QzkzLjMwMDcgNjYuNjYgOTAuNjE1OCA2Ni44MTYgOTAuMjg5NyA2Ni45MzUxQzg5LjM4MTggNjcuMjY2OCA5MC40Nzg4IDY5Ljk0NyA5Mi4wMzA2IDcxLjE4ODZDOTMuMTU5OSA3Mi4wOTIxIDkzLjc3MSA3Mi4xOTEyIDk2LjgxNzggNzEuOTY1QzEwMC4xOTMgNzEuNzE0NCAxMDAuMzE4IDcxLjc0NDkgMTAwLjUzMSA3Mi44Njg0QzEwMC43MyA3My45MTMzIDEwMC41MDkgNzQuMDgzNSA5OC4zNTc5IDc0LjU0OEM5NS42MTAzIDc1LjE0MTIgOTMuODgyOSA3NS4xNDk2IDkyLjAwMiA3NC41Nzg4Wk05Ny45NjU5IDYzLjA4MjNDOTcuOTY1OSA2MS4xMjMxIDk2LjE4NTggNTkuMzI3NiA5NC4yNDM0IDU5LjMyNzZDOTIuMjQ5NCA1OS4zMjc2IDkwLjE0OTkgNjEuMjU2MiA5MC4xNDk5IDYzLjA4NzhDOTAuMTQ5OSA2NC4yMDcgOTAuMjc5NyA2NC4yNDU1IDk0LjA1NzkgNjQuMjQ1NUM5Ny44NDE0IDY0LjI0NTUgOTcuOTY1OSA2NC4yMDg0IDk3Ljk2NTkgNjMuMDgyM1pNMTEwLjA0MiA3NC40N0MxMDYuMTQ5IDczLjQzIDEwMy45MyA2OS40MDI5IDEwNC41NCA2NC40ODYyQzEwNS4xNjYgNTkuNDQ0MiAxMDcuOTUxIDU2Ljg3MzYgMTEyLjc5MiA1Ni44NzA1QzExNS4zNzQgNTYuODY5IDExNS44MDUgNTcuMDI0OSAxMTcuMjYgNTguNDlDMTE4Ljg3OCA2MC4xMTg1IDExOS45NDEgNjIuODM0MyAxMTkuOTQ2IDY1LjM1MkwxMTkuOTQ5IDY2LjcwNDRIMTE0LjA4N0MxMDguNDg4IDY2LjcwNDQgMTA4LjIyNSA2Ni43NTAxIDEwOC4yMjUgNjcuNzIwM0MxMDguMjI1IDcwLjcxMjIgMTEwLjk1MiA3Mi4zNDQyIDExNS4zNTcgNzEuOTg4MkMxMTguMTM2IDcxLjc2MzcgMTE4LjQyMyA3MS44MzE1IDExOC42NjcgNzIuNzY3NEMxMTguOTk4IDc0LjA0NDMgMTE4Ljk2OCA3NC4wNzIgMTE2LjY5IDc0LjYwNDNDMTE0LjM2NyA3NS4xNDcgMTEyLjQzIDc1LjEwNzggMTEwLjA0MiA3NC40N1pNMTE2LjExOSA2Mi43NzAxQzExNS44NjQgNjAuODc4NyAxMTQuMTU5IDU5LjMyNzYgMTEyLjMzNSA1OS4zMjc2QzExMC41NjYgNTkuMzI3NiAxMDguMjI0IDYxLjYwMTQgMTA4LjIyNCA2My4zMTk1QzEwOC4yMjQgNjQuMjEyOCAxMDguNTI3IDY0LjI3NDYgMTEyLjI1NSA2NC4xNDI0QzExNi4yNDEgNjQuMDAxMSAxMTYuMjgzIDYzLjk4NjIgMTE2LjExOSA2Mi43NzAxWk0xMjYuODk0IDc0LjI0N0MxMjQuODI2IDczLjIyMDggMTIzLjUzMiA3MS4zNTg5IDEyMi44OTQgNjguNDg4OUMxMjEuOTc1IDY0LjM2MDUgMTIzLjA3NCA2MC40OTE0IDEyNS44MyA1OC4xNTY3QzEyNy44MjcgNTYuNDY1NyAxMzEuODM4IDU2LjMzMDUgMTMzLjgwNSA1Ny44ODc5TDEzNS4wOTIgNTguOTA3MlY1My45NTM2VjQ5SDEzNy4wNDZIMTM5VjYxLjc4NjVWNzQuNTczMUgxMzcuMjlDMTM1Ljc2MiA3NC41NzMxIDEzNS41OCA3NC40MzMxIDEzNS41OCA3My4yNTc5VjcxLjk0MjdMMTM0LjQ4MSA3Mi45NzkyQzEzMi4yMzMgNzUuMDk5OCAxMjkuNTI1IDc1LjU1MjMgMTI2Ljg5NCA3NC4yNDdaTTEzMy42NjQgNzAuNjc2NkMxMzQuOTc2IDY5LjM1NTcgMTM1LjA5MiA2OC45NTM3IDEzNS4wOTIgNjUuNzIwOUMxMzUuMDkyIDYyLjQ1NzIgMTM0Ljk4NSA2Mi4wOTQ1IDEzMy42MDcgNjAuNzA3NkMxMzIuMzY1IDU5LjQ1NzUgMTMxLjg2NSA1OS4yNjIyIDEzMC41NTQgNTkuNTE1NEMxMjYuMTQ0IDYwLjM2NzIgMTI0LjgzNSA2OC4xNDIzIDEyOC41OTggNzEuMTIyOUMxMzAuMzQ4IDcyLjUwODEgMTMxLjk4OCA3Mi4zNjM1IDEzMy42NjQgNzAuNjc2NlpNNjEuNDEwNyA2Ni4wNTg0QzYwLjAyMiA2MS4zNzU0IDU4Ljg4NTkgNTcuMzkxOSA1OC44ODU5IDU3LjIwNjJDNTguODg1OSA1Ny4wMjA2IDU5LjcyNzQgNTYuODY4NiA2MC43NTU5IDU2Ljg2ODZINjIuNjI1OUw2NC4yNTUxIDYzLjg3NjZDNjUuMTUxMiA2Ny43MzEgNjUuOTU2IDcwLjY2MzMgNjYuMDQzNyA3MC4zOTI5QzY2LjEzMTMgNzAuMTIyNCA2Ny4wNTU3IDY3LjAyNDEgNjguMDk3OCA2My41MDc4TDY5Ljk5MjYgNTcuMTE0NUg3MS41OTY5SDczLjIwMTJMNzQuODg2NSA2My4yNjE5Qzc1LjgxMzQgNjYuNjQzIDc2LjY4MzIgNjkuNzQxMiA3Ni44MTk0IDcwLjE0N0M3Ni45NTU3IDcwLjU1MjcgNzcuODQxOSA2Ny43MzEgNzguNzg5IDYzLjg3NjZMODAuNTEwOSA1Ni44Njg2SDgyLjQ1MTdDODMuOTUxNyA1Ni44Njg2IDg0LjMzMDMgNTcuMDMxNiA4NC4xMTkgNTcuNTg2QzgzLjk2ODYgNTcuOTgwNiA4Mi42OTU2IDYxLjk2NDEgODEuMjkwMiA2Ni40MzgyTDc4LjczNDkgNzQuNTczMUg3Ni45NjM1SDc1LjE5MjFMNzMuNTgxMiA2OC43OTQ1QzcyLjY5NTIgNjUuNjE2MyA3MS44NTg1IDYyLjY4NDEgNzEuNzIxNyA2Mi4yNzgzQzcxLjQ0NjUgNjEuNDYxNiA3MS41OTExIDYxLjA3MzMgNjkuMTExNCA2OS4yODYzTDY3LjUxNTIgNzQuNTczMUg2NS43MjU0SDYzLjkzNTZMNjEuNDEwNyA2Ni4wNTg0WiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZD0iTTE5Ljk3NDYgMTE5LjI3NEMxOS4wMTU4IDExOC4xMTkgMjAuMzM4MSAxMTYuMTY2IDIxLjU2MDQgMTE2LjkzMkMyMi43NjMyIDExNy42ODYgMjIuMzMwNSAxMTkuNzYxIDIwLjk3MDQgMTE5Ljc2MUMyMC42NDUgMTE5Ljc2MSAyMC4xOTY5IDExOS41NDIgMTkuOTc0NiAxMTkuMjc0WiIgZmlsbD0idXJsKCNwYWludDNfcmFkaWFsXzY3OV8xOTEwKSIvPgo8cGF0aCBkPSJNMjMuODM2IDExMi42M0MyMi4xMTUyIDExMS42ODkgMjEuODAyOSAxMDkuNzk3IDIzLjE0NjUgMTA4LjQ1M0MyNC4wODU3IDEwNy41MTQgMjUuMjEgMTA3LjM5NCAyNi4yNTA3IDEwOC4xMjNDMjcuODU3MSAxMDkuMjQ5IDI3LjQ2NTUgMTEyLjAxMyAyNS42MDc5IDExMi42NkMyNS42MDc5IDExMi42NiAyNC40NzQ1IDExMi45NzMgMjMuODM2IDExMi42M1oiIGZpbGw9InVybCgjcGFpbnQ0X3JhZGlhbF82NzlfMTkxMCkiLz4KPHBhdGggZD0iTTMzLjc4NTUgMTIwLjAzNkMzMy43ODU1IDEyMC4xODggMzMuNzU1NyAxMjAuMzM4IDMzLjY5NzYgMTIwLjQ3OUMzMy42Mzk1IDEyMC42MTkgMzMuNTU0NCAxMjAuNzQ2IDMzLjQ0NzEgMTIwLjg1M0MzMy4zMzk4IDEyMC45NjEgMzMuMjEyNCAxMjEuMDQ2IDMzLjA3MjMgMTIxLjEwNEMzMi45MzIxIDEyMS4xNjIgMzIuNzgxOCAxMjEuMTkyIDMyLjYzMDEgMTIxLjE5MkMzMi40NzgzIDEyMS4xOTIgMzIuMzI4MSAxMjEuMTYyIDMyLjE4NzkgMTIxLjEwNEMzMi4wNDc3IDEyMS4wNDYgMzEuOTIwMyAxMjAuOTYxIDMxLjgxMyAxMjAuODUzQzMxLjcwNTcgMTIwLjc0NiAzMS42MjA2IDEyMC42MTkgMzEuNTYyNiAxMjAuNDc5QzMxLjUwNDUgMTIwLjMzOCAzMS40NzQ2IDEyMC4xODggMzEuNDc0NiAxMjAuMDM2QzMxLjQ3NDYgMTE5LjczIDMxLjU5NjMgMTE5LjQzNiAzMS44MTMgMTE5LjIxOUMzMi4wMjk3IDExOS4wMDMgMzIuMzIzNiAxMTguODgxIDMyLjYzMDEgMTE4Ljg4MUMzMi45MzY1IDExOC44ODEgMzMuMjMwNCAxMTkuMDAzIDMzLjQ0NzEgMTE5LjIxOUMzMy42NjM4IDExOS40MzYgMzMuNzg1NSAxMTkuNzMgMzMuNzg1NSAxMjAuMDM2WiIgZmlsbD0iYmxhY2siLz4KPHBhdGggZD0iTTEyMC43MjEgMTE4LjI3NkMxMjAuNzIxIDExOC42MjMgMTIwLjU2NSAxMTguOTU2IDEyMC4yODcgMTE5LjIwMUMxMjAuMDA5IDExOS40NDYgMTE5LjYzMiAxMTkuNTg0IDExOS4yMzkgMTE5LjU4NEMxMTguODQ2IDExOS41ODQgMTE4LjQ2OSAxMTkuNDQ2IDExOC4xOTEgMTE5LjIwMUMxMTcuOTEzIDExOC45NTYgMTE3Ljc1NyAxMTguNjIzIDExNy43NTcgMTE4LjI3NkMxMTcuNzU3IDExOC4xMDUgMTE3Ljc5NSAxMTcuOTM1IDExNy44NyAxMTcuNzc2QzExNy45NDQgMTE3LjYxNyAxMTguMDUzIDExNy40NzMgMTE4LjE5MSAxMTcuMzUyQzExOC4zMjkgMTE3LjIzIDExOC40OTIgMTE3LjEzNCAxMTguNjcyIDExNy4wNjhDMTE4Ljg1MSAxMTcuMDAzIDExOS4wNDQgMTE2Ljk2OSAxMTkuMjM5IDExNi45NjlDMTE5LjQzMyAxMTYuOTY5IDExOS42MjYgMTE3LjAwMyAxMTkuODA2IDExNy4wNjhDMTE5Ljk4NiAxMTcuMTM0IDEyMC4xNDkgMTE3LjIzIDEyMC4yODcgMTE3LjM1MkMxMjAuNDI0IDExNy40NzMgMTIwLjUzMyAxMTcuNjE3IDEyMC42MDggMTE3Ljc3NkMxMjAuNjgyIDExNy45MzUgMTIwLjcyMSAxMTguMTA1IDEyMC43MjEgMTE4LjI3NloiIGZpbGw9IiM1OTY4NkYiLz4KPGRlZnM+CjxsaW5lYXJHcmFkaWVudCBpZD0icGFpbnQwX2xpbmVhcl82NzlfMTkxMCIgeDE9IjExIiB5MT0iLTQuNzc3NjhlLTA3IiB4Mj0iMTY0LjUiIHkyPSIxNTAuNSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPgo8c3RvcCBzdG9wLWNvbG9yPSIjNjRCN0ZGIi8+CjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iIzAwNURBRCIvPgo8L2xpbmVhckdyYWRpZW50Pgo8cmFkaWFsR3JhZGllbnQgaWQ9InBhaW50MV9yYWRpYWxfNjc5XzE5MTAiIGN4PSIwIiBjeT0iMCIgcj0iMSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiIGdyYWRpZW50VHJhbnNmb3JtPSJ0cmFuc2xhdGUoMTI0LjkwNCAxMjguNjM2KSByb3RhdGUoLTAuMDQ4NTUyKSBzY2FsZSgzNi4yODAyIDMxLjQwMzIpIj4KPHN0b3Agc3RvcC1jb2xvcj0iIzExNzdDRSIvPgo8c3RvcCBvZmZzZXQ9IjEiIHN0b3AtY29sb3I9IiM3RUM3RkYiIHN0b3Atb3BhY2l0eT0iMCIvPgo8L3JhZGlhbEdyYWRpZW50Pgo8cmFkaWFsR3JhZGllbnQgaWQ9InBhaW50Ml9yYWRpYWxfNjc5XzE5MTAiIGN4PSIwIiBjeT0iMCIgcj0iMSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiIGdyYWRpZW50VHJhbnNmb3JtPSJ0cmFuc2xhdGUoMzkuMzUxMiAxMjEuNDYpIHJvdGF0ZSgtMC4wNTczKSBzY2FsZSg1MC4yMjc2IDUxLjMwOTEpIj4KPHN0b3Agc3RvcC1jb2xvcj0iIzExNzdDRSIvPgo8c3RvcCBvZmZzZXQ9IjEiIHN0b3AtY29sb3I9IiM3RUM3RkYiIHN0b3Atb3BhY2l0eT0iMCIvPgo8L3JhZGlhbEdyYWRpZW50Pgo8cmFkaWFsR3JhZGllbnQgaWQ9InBhaW50M19yYWRpYWxfNjc5XzE5MTAiIGN4PSIwIiBjeT0iMCIgcj0iMSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiIGdyYWRpZW50VHJhbnNmb3JtPSJ0cmFuc2xhdGUoMjAuOTU0OCAxMTguMjYpIHNjYWxlKDEuMzA5MjkgMS41MDEyNykiPgo8c3RvcCBzdG9wLWNvbG9yPSIjODhBM0QwIi8+CjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iIzVEODNCRiIvPgo8L3JhZGlhbEdyYWRpZW50Pgo8cmFkaWFsR3JhZGllbnQgaWQ9InBhaW50NF9yYWRpYWxfNjc5XzE5MTAiIGN4PSIwIiBjeT0iMCIgcj0iMSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiIGdyYWRpZW50VHJhbnNmb3JtPSJ0cmFuc2xhdGUoMjQuNzg0MyAxMTAuMjIxKSBzY2FsZSgyLjQ3Mjc3IDIuNTY5NTQpIj4KPHN0b3Agc3RvcC1jb2xvcj0iIzg4QTNEMCIvPgo8c3RvcCBvZmZzZXQ9IjEiIHN0b3AtY29sb3I9IiM1RDgzQkYiLz4KPC9yYWRpYWxHcmFkaWVudD4KPC9kZWZzPgo8L3N2Zz4K
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "host"], ["spec", "topology"], ["spec", "replicationFactor"], ["spec", "db"], ["spec", "db", "replicas"], ["spec", "db", "size"], ["spec", "db", "storageClass"], ["spec", "db", "resources"], ["spec", "db", "resourcesPreset"], ["spec", "master"], ["spec", "master", "replicas"], ["spec", "master", "resources"], ["spec", "master", "resourcesPreset"], ["spec", "filer"], ["spec", "filer", "replicas"], ["spec", "filer", "resources"], ["spec", "filer", "resourcesPreset"], ["spec", "filer", "grpcHost"], ["spec", "filer", "grpcPort"], ["spec", "filer", "whitelist"], ["spec", "volume"], ["spec", "volume", "replicas"], ["spec", "volume", "size"], ["spec", "volume", "storageClass"], ["spec", "volume", "resources"], ["spec", "volume", "resourcesPreset"], ["spec", "volume", "zones"], ["spec", "s3"], ["spec", "s3", "replicas"], ["spec", "s3", "resources"], ["spec", "s3", "resourcesPreset"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "host"], ["spec", "topology"], ["spec", "replicationFactor"], ["spec", "db"], ["spec", "db", "replicas"], ["spec", "db", "size"], ["spec", "db", "storageClass"], ["spec", "db", "resources"], ["spec", "db", "resourcesPreset"], ["spec", "master"], ["spec", "master", "replicas"], ["spec", "master", "resources"], ["spec", "master", "resourcesPreset"], ["spec", "filer"], ["spec", "filer", "replicas"], ["spec", "filer", "resources"], ["spec", "filer", "resourcesPreset"], ["spec", "filer", "grpcHost"], ["spec", "filer", "grpcPort"], ["spec", "filer", "whitelist"], ["spec", "volume"], ["spec", "volume", "replicas"], ["spec", "volume", "size"], ["spec", "volume", "storageClass"], ["spec", "volume", "diskType"], ["spec", "volume", "resources"], ["spec", "volume", "resourcesPreset"], ["spec", "volume", "zones"], ["spec", "storagePools"], ["spec", "s3"], ["spec", "s3", "replicas"], ["spec", "s3", "resources"], ["spec", "s3", "resourcesPreset"]]
   secrets:
     exclude: []
     include: []

From 7684f41ef77091ddd16c3254d085f8bfadda371f Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Thu, 26 Feb 2026 16:52:16 +0500
Subject: [PATCH 176/666] feat(seaweedfs): add per-pool COSI resources and
 optional storageClass inheritance
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Make storageClass optional in storagePools — pools inherit from
volume.storageClass when not explicitly set. Add full COSI resource set
per storage pool: BucketClass, BucketClass-worm (Retain + object lock),
BucketAccessClass readwrite, and BucketAccessClass readonly.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/extra/seaweedfs/README.md            |  6 ++---
 .../extra/seaweedfs/templates/seaweedfs.yaml  |  7 ++----
 .../storage-pool-bucket-classes.yaml          | 23 +++++++++++++++++++
 packages/extra/seaweedfs/values.schema.json   |  4 ----
 packages/extra/seaweedfs/values.yaml          |  5 ++--
 .../seaweedfs-rd/cozyrds/seaweedfs.yaml       |  2 +-
 6 files changed, 32 insertions(+), 15 deletions(-)

diff --git a/packages/extra/seaweedfs/README.md b/packages/extra/seaweedfs/README.md
index 39c3c4ee..03a81421 100644
--- a/packages/extra/seaweedfs/README.md
+++ b/packages/extra/seaweedfs/README.md
@@ -50,11 +50,11 @@
 | `volume.zones`                        | A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.           | `map[string]object` | `{}`    |
 | `volume.zones[name].replicas`         | Number of replicas in the zone.                                                                          | `int`               | `0`     |
 | `volume.zones[name].size`             | Zone storage size.                                                                                       | `quantity`          | `""`    |
-| `storagePools`                        | A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.          | `map[string]object` | `{}`    |
-| `storagePools[name].diskType`         | SeaweedFS disk type tag (e.g., "ssd", "hdd", "nvme").                                                    | `string`            | `""`    |
+| `storagePools`                        | A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type. Unset fields inherit from volume.* settings. | `map[string]object` | `{}`    |
+| `storagePools[name].diskType`         | SeaweedFS disk type tag (e.g., "ssd", "hdd", "nvme"). Required.                                         | `string`            | `""`    |
 | `storagePools[name].replicas`         | Number of volume replicas. Defaults to volume.replicas.                                                  | `int`               | `0`     |
 | `storagePools[name].size`             | Persistent Volume size. Defaults to volume.size.                                                         | `quantity`          | `""`    |
-| `storagePools[name].storageClass`     | Kubernetes StorageClass for the pool.                                                                    | `string`            | `""`    |
+| `storagePools[name].storageClass`     | Kubernetes StorageClass for the pool. Defaults to volume.storageClass.                                   | `string`            | `""`    |
 | `storagePools[name].resources`        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
 | `storagePools[name].resources.cpu`    | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
 | `storagePools[name].resources.memory` | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
diff --git a/packages/extra/seaweedfs/templates/seaweedfs.yaml b/packages/extra/seaweedfs/templates/seaweedfs.yaml
index e3967fa6..6d4f482b 100644
--- a/packages/extra/seaweedfs/templates/seaweedfs.yaml
+++ b/packages/extra/seaweedfs/templates/seaweedfs.yaml
@@ -26,9 +26,6 @@
 {{-   if not (regexMatch "^[a-z0-9]+$" $pool.diskType) }}
 {{-     fail (printf "storagePools.%s.diskType must be lowercase alphanumeric (got: %s)." $poolName $pool.diskType) }}
 {{-   end }}
-{{-   if not $pool.storageClass }}
-{{-     fail (printf "storagePools.%s.storageClass is required." $poolName) }}
-{{-   end }}
 {{-   if not (regexMatch "^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$" $poolName) }}
 {{-     fail (printf "storagePools key '%s' must be a valid DNS label (lowercase alphanumeric and hyphens)." $poolName) }}
 {{-   end }}
@@ -157,7 +154,7 @@ spec:
           - name: data1
             type: "persistentVolumeClaim"
             size: "{{ $pool.size | default $zone.size | default $.Values.volume.size }}"
-            storageClass: "{{ $pool.storageClass }}"
+            storageClass: "{{ $pool.storageClass | default $.Values.volume.storageClass }}"
             maxVolumes: 0
           nodeSelector: |
             topology.kubernetes.io/zone: {{ $zoneName }}
@@ -177,7 +174,7 @@ spec:
           - name: data1
             type: "persistentVolumeClaim"
             size: "{{ $pool.size | default $.Values.volume.size }}"
-            storageClass: "{{ $pool.storageClass }}"
+            storageClass: "{{ $pool.storageClass | default $.Values.volume.storageClass }}"
             maxVolumes: 0
           extraArgs:
           - "-disk={{ $pool.diskType }}"
diff --git a/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml b/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml
index 8bf9b4d5..a38a7e8a 100644
--- a/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml
+++ b/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml
@@ -10,11 +10,34 @@ deletionPolicy: Delete
 parameters:
   diskType: {{ $pool.diskType }}
 ---
+kind: BucketClass
+apiVersion: objectstorage.k8s.io/v1alpha1
+metadata:
+  name: {{ $.Release.Namespace }}-{{ $poolName }}-worm
+driverName: {{ $.Release.Namespace }}.seaweedfs.objectstorage.k8s.io
+deletionPolicy: Retain
+parameters:
+  diskType: {{ $pool.diskType }}
+  objectLockEnabled: "true"
+  objectLockRetentionMode: COMPLIANCE
+  objectLockRetentionDays: "36500"
+---
 kind: BucketAccessClass
 apiVersion: objectstorage.k8s.io/v1alpha1
 metadata:
   name: {{ $.Release.Namespace }}-{{ $poolName }}
 driverName: {{ $.Release.Namespace }}.seaweedfs.objectstorage.k8s.io
 authenticationType: KEY
+parameters:
+  accessPolicy: readwrite
+---
+kind: BucketAccessClass
+apiVersion: objectstorage.k8s.io/v1alpha1
+metadata:
+  name: {{ $.Release.Namespace }}-{{ $poolName }}-readonly
+driverName: {{ $.Release.Namespace }}.seaweedfs.objectstorage.k8s.io
+authenticationType: KEY
+parameters:
+  accessPolicy: readonly
 {{- end }}
 {{- end }}
diff --git a/packages/extra/seaweedfs/values.schema.json b/packages/extra/seaweedfs/values.schema.json
index 9f53a40e..590a22ad 100644
--- a/packages/extra/seaweedfs/values.schema.json
+++ b/packages/extra/seaweedfs/values.schema.json
@@ -291,10 +291,6 @@
       "default": {},
       "additionalProperties": {
         "type": "object",
-        "required": [
-          "diskType",
-          "storageClass"
-        ],
         "properties": {
           "diskType": {
             "description": "SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").",
diff --git a/packages/extra/seaweedfs/values.yaml b/packages/extra/seaweedfs/values.yaml
index ca1199af..f9778a25 100644
--- a/packages/extra/seaweedfs/values.yaml
+++ b/packages/extra/seaweedfs/values.yaml
@@ -103,11 +103,12 @@ volume:
 ## @field {string} diskType - SeaweedFS disk type tag (e.g., "ssd", "hdd", "nvme").
 ## @field {int} [replicas] - Number of volume replicas. Defaults to volume.replicas.
 ## @field {quantity} [size] - Persistent Volume size. Defaults to volume.size.
-## @field {string} storageClass - Kubernetes StorageClass for the pool.
+## @field {string} [storageClass] - Kubernetes StorageClass for the pool. Defaults to volume.storageClass.
 ## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
 ## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.
 
-## @param {map[string]StoragePool} [storagePools] - A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.
+## @param {map[string]StoragePool} [storagePools] - A map of storage pools. Each pool creates a separate Volume StatefulSet
+## with its own disk type. Unset fields inherit from volume.* settings.
 ## In Simple topology, one StatefulSet is created per pool. Pods from different pools may run on the same node.
 ## In MultiZone topology, a StatefulSet is created for each zone×pool combination (e.g., zone1-fast, zone2-fast),
 ## with each pinned to its zone via nodeSelector.
diff --git a/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml b/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml
index 40f72072..1fcff7f8 100644
--- a/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml
+++ b/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml
@@ -8,7 +8,7 @@ spec:
     singular: seaweedfs
     plural: seaweedfses
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"db":{"description":"Database configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of database replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""}}},"filer":{"description":"Filer service configuration.","type":"object","default":{},"properties":{"grpcHost":{"description":"The hostname used to expose or access the filer service externally.","type":"string","default":""},"grpcPort":{"description":"The port used to access the filer service externally.","type":"integer","default":443},"replicas":{"description":"Number of filer replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"whitelist":{"description":"A list of IP addresses or CIDR ranges that are allowed to access the filer service.","type":"array","default":[],"items":{"type":"string"}}}},"host":{"description":"The hostname used to access SeaweedFS externally (defaults to 's3' subdomain for the tenant host).","type":"string","default":""},"master":{"description":"Master service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of master replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"replicationFactor":{"description":"Replication factor: number of replicas for each volume in the SeaweedFS cluster.","type":"integer","default":2},"s3":{"description":"S3 service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of S3 replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"storagePools":{"description":"A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.","type":"object","default":{},"additionalProperties":{"type":"object","required":["diskType","storageClass"],"properties":{"diskType":{"description":"SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").","type":"string"},"replicas":{"description":"Number of volume replicas. Defaults to volume.replicas.","type":"integer"},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.","type":"string","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size. Defaults to volume.size.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"Kubernetes StorageClass for the pool.","type":"string"}}}},"topology":{"description":"The topology of the SeaweedFS cluster.","type":"string","default":"Simple","enum":["Simple","MultiZone","Client"]},"volume":{"description":"Volume service configuration.","type":"object","default":{},"properties":{"diskType":{"description":"SeaweedFS disk type tag for the default volume servers (e.g., \"hdd\", \"ssd\").","type":"string","default":""},"replicas":{"description":"Number of volume replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"zones":{"description":"A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"replicas":{"description":"Number of replicas in the zone.","type":"integer"},"size":{"description":"Zone storage size.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}}}}
+      {"title":"Chart Values","type":"object","properties":{"db":{"description":"Database configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of database replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""}}},"filer":{"description":"Filer service configuration.","type":"object","default":{},"properties":{"grpcHost":{"description":"The hostname used to expose or access the filer service externally.","type":"string","default":""},"grpcPort":{"description":"The port used to access the filer service externally.","type":"integer","default":443},"replicas":{"description":"Number of filer replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"whitelist":{"description":"A list of IP addresses or CIDR ranges that are allowed to access the filer service.","type":"array","default":[],"items":{"type":"string"}}}},"host":{"description":"The hostname used to access SeaweedFS externally (defaults to 's3' subdomain for the tenant host).","type":"string","default":""},"master":{"description":"Master service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of master replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"replicationFactor":{"description":"Replication factor: number of replicas for each volume in the SeaweedFS cluster.","type":"integer","default":2},"s3":{"description":"S3 service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of S3 replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"storagePools":{"description":"A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"diskType":{"description":"SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").","type":"string"},"replicas":{"description":"Number of volume replicas. Defaults to volume.replicas.","type":"integer"},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.","type":"string","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size. Defaults to volume.size.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"Kubernetes StorageClass for the pool.","type":"string"}}}},"topology":{"description":"The topology of the SeaweedFS cluster.","type":"string","default":"Simple","enum":["Simple","MultiZone","Client"]},"volume":{"description":"Volume service configuration.","type":"object","default":{},"properties":{"diskType":{"description":"SeaweedFS disk type tag for the default volume servers (e.g., \"hdd\", \"ssd\").","type":"string","default":""},"replicas":{"description":"Number of volume replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"zones":{"description":"A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"replicas":{"description":"Number of replicas in the zone.","type":"integer"},"size":{"description":"Zone storage size.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}}}}
   release:
     prefix: ""
     labels:

From e244412871a71cb4229935a17cf573d587a518c4 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Thu, 26 Feb 2026 18:36:15 +0500
Subject: [PATCH 177/666] fix(seaweedfs): address review comments

- Document MultiZone fallback chain for pool replicas and size
- Move `-volume` WorkloadMonitor reference inside Simple topology block in dashboard-resourcemap.yaml (it is only created for Simple)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/extra/seaweedfs/README.md            | 104 +++++++++---------
 .../templates/dashboard-resourcemap.yaml      |   2 +-
 packages/extra/seaweedfs/values.schema.json   |  11 +-
 packages/extra/seaweedfs/values.yaml          |   4 +-
 .../seaweedfs-rd/cozyrds/seaweedfs.yaml       |   2 +-
 5 files changed, 63 insertions(+), 60 deletions(-)

diff --git a/packages/extra/seaweedfs/README.md b/packages/extra/seaweedfs/README.md
index 03a81421..cf202c13 100644
--- a/packages/extra/seaweedfs/README.md
+++ b/packages/extra/seaweedfs/README.md
@@ -13,56 +13,56 @@
 
 ### SeaweedFS Components Configuration
 
-| Name                                  | Description                                                                                              | Type                | Value   |
-| ------------------------------------- | -------------------------------------------------------------------------------------------------------- | ------------------- | ------- |
-| `db`                                  | Database configuration.                                                                                  | `object`            | `{}`    |
-| `db.replicas`                         | Number of database replicas.                                                                             | `int`               | `2`     |
-| `db.size`                             | Persistent Volume size.                                                                                  | `quantity`          | `10Gi`  |
-| `db.storageClass`                     | StorageClass used to store the data.                                                                     | `string`            | `""`    |
-| `db.resources`                        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
-| `db.resources.cpu`                    | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
-| `db.resources.memory`                 | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
-| `db.resourcesPreset`                  | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |
-| `master`                              | Master service configuration.                                                                            | `object`            | `{}`    |
-| `master.replicas`                     | Number of master replicas.                                                                               | `int`               | `3`     |
-| `master.resources`                    | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
-| `master.resources.cpu`                | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
-| `master.resources.memory`             | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
-| `master.resourcesPreset`              | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |
-| `filer`                               | Filer service configuration.                                                                             | `object`            | `{}`    |
-| `filer.replicas`                      | Number of filer replicas.                                                                                | `int`               | `2`     |
-| `filer.resources`                     | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
-| `filer.resources.cpu`                 | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
-| `filer.resources.memory`              | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
-| `filer.resourcesPreset`               | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |
-| `filer.grpcHost`                      | The hostname used to expose or access the filer service externally.                                      | `string`            | `""`    |
-| `filer.grpcPort`                      | The port used to access the filer service externally.                                                    | `int`               | `443`   |
-| `filer.whitelist`                     | A list of IP addresses or CIDR ranges that are allowed to access the filer service.                      | `[]string`          | `[]`    |
-| `volume`                              | Volume service configuration.                                                                            | `object`            | `{}`    |
-| `volume.replicas`                     | Number of volume replicas.                                                                               | `int`               | `2`     |
-| `volume.size`                         | Persistent Volume size.                                                                                  | `quantity`          | `10Gi`  |
-| `volume.storageClass`                 | StorageClass used to store the data.                                                                     | `string`            | `""`    |
-| `volume.diskType`                     | SeaweedFS disk type tag for the default volume servers (e.g., "hdd", "ssd").                             | `string`            | `""`    |
-| `volume.resources`                    | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
-| `volume.resources.cpu`                | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
-| `volume.resources.memory`             | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
-| `volume.resourcesPreset`              | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |
-| `volume.zones`                        | A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.           | `map[string]object` | `{}`    |
-| `volume.zones[name].replicas`         | Number of replicas in the zone.                                                                          | `int`               | `0`     |
-| `volume.zones[name].size`             | Zone storage size.                                                                                       | `quantity`          | `""`    |
-| `storagePools`                        | A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type. Unset fields inherit from volume.* settings. | `map[string]object` | `{}`    |
-| `storagePools[name].diskType`         | SeaweedFS disk type tag (e.g., "ssd", "hdd", "nvme"). Required.                                         | `string`            | `""`    |
-| `storagePools[name].replicas`         | Number of volume replicas. Defaults to volume.replicas.                                                  | `int`               | `0`     |
-| `storagePools[name].size`             | Persistent Volume size. Defaults to volume.size.                                                         | `quantity`          | `""`    |
-| `storagePools[name].storageClass`     | Kubernetes StorageClass for the pool. Defaults to volume.storageClass.                                   | `string`            | `""`    |
-| `storagePools[name].resources`        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
-| `storagePools[name].resources.cpu`    | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
-| `storagePools[name].resources.memory` | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
-| `storagePools[name].resourcesPreset`  | Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.              | `string`            | `{}`    |
-| `s3`                                  | S3 service configuration.                                                                                | `object`            | `{}`    |
-| `s3.replicas`                         | Number of S3 replicas.                                                                                   | `int`               | `2`     |
-| `s3.resources`                        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
-| `s3.resources.cpu`                    | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
-| `s3.resources.memory`                 | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
-| `s3.resourcesPreset`                  | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |
+| Name                                  | Description                                                                                                                                                   | Type                | Value   |
+| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- | ------- |
+| `db`                                  | Database configuration.                                                                                                                                       | `object`            | `{}`    |
+| `db.replicas`                         | Number of database replicas.                                                                                                                                  | `int`               | `2`     |
+| `db.size`                             | Persistent Volume size.                                                                                                                                       | `quantity`          | `10Gi`  |
+| `db.storageClass`                     | StorageClass used to store the data.                                                                                                                          | `string`            | `""`    |
+| `db.resources`                        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.                                                      | `object`            | `{}`    |
+| `db.resources.cpu`                    | Number of CPU cores allocated.                                                                                                                                | `quantity`          | `""`    |
+| `db.resources.memory`                 | Amount of memory allocated.                                                                                                                                   | `quantity`          | `""`    |
+| `db.resourcesPreset`                  | Default sizing preset used when `resources` is omitted.                                                                                                       | `string`            | `small` |
+| `master`                              | Master service configuration.                                                                                                                                 | `object`            | `{}`    |
+| `master.replicas`                     | Number of master replicas.                                                                                                                                    | `int`               | `3`     |
+| `master.resources`                    | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.                                                      | `object`            | `{}`    |
+| `master.resources.cpu`                | Number of CPU cores allocated.                                                                                                                                | `quantity`          | `""`    |
+| `master.resources.memory`             | Amount of memory allocated.                                                                                                                                   | `quantity`          | `""`    |
+| `master.resourcesPreset`              | Default sizing preset used when `resources` is omitted.                                                                                                       | `string`            | `small` |
+| `filer`                               | Filer service configuration.                                                                                                                                  | `object`            | `{}`    |
+| `filer.replicas`                      | Number of filer replicas.                                                                                                                                     | `int`               | `2`     |
+| `filer.resources`                     | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.                                                      | `object`            | `{}`    |
+| `filer.resources.cpu`                 | Number of CPU cores allocated.                                                                                                                                | `quantity`          | `""`    |
+| `filer.resources.memory`              | Amount of memory allocated.                                                                                                                                   | `quantity`          | `""`    |
+| `filer.resourcesPreset`               | Default sizing preset used when `resources` is omitted.                                                                                                       | `string`            | `small` |
+| `filer.grpcHost`                      | The hostname used to expose or access the filer service externally.                                                                                           | `string`            | `""`    |
+| `filer.grpcPort`                      | The port used to access the filer service externally.                                                                                                         | `int`               | `443`   |
+| `filer.whitelist`                     | A list of IP addresses or CIDR ranges that are allowed to access the filer service.                                                                           | `[]string`          | `[]`    |
+| `volume`                              | Volume service configuration.                                                                                                                                 | `object`            | `{}`    |
+| `volume.replicas`                     | Number of volume replicas.                                                                                                                                    | `int`               | `2`     |
+| `volume.size`                         | Persistent Volume size.                                                                                                                                       | `quantity`          | `10Gi`  |
+| `volume.storageClass`                 | StorageClass used to store the data.                                                                                                                          | `string`            | `""`    |
+| `volume.diskType`                     | SeaweedFS disk type tag for the default volume servers (e.g., "hdd", "ssd").                                                                                  | `string`            | `""`    |
+| `volume.resources`                    | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.                                                      | `object`            | `{}`    |
+| `volume.resources.cpu`                | Number of CPU cores allocated.                                                                                                                                | `quantity`          | `""`    |
+| `volume.resources.memory`             | Amount of memory allocated.                                                                                                                                   | `quantity`          | `""`    |
+| `volume.resourcesPreset`              | Default sizing preset used when `resources` is omitted.                                                                                                       | `string`            | `small` |
+| `volume.zones`                        | A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.                                                                | `map[string]object` | `{}`    |
+| `volume.zones[name].replicas`         | Number of replicas in the zone.                                                                                                                               | `int`               | `0`     |
+| `volume.zones[name].size`             | Zone storage size.                                                                                                                                            | `quantity`          | `""`    |
+| `storagePools`                        | A map of storage pools. Each pool creates a separate Volume StatefulSet                                                                                       | `map[string]object` | `{}`    |
+| `storagePools[name].diskType`         | SeaweedFS disk type tag (e.g., "ssd", "hdd", "nvme").                                                                                                         | `string`            | `""`    |
+| `storagePools[name].replicas`         | Number of volume replicas. In MultiZone, defaults to volume.zones.<zoneName>.replicas, then volume.replicas. In Simple topology, defaults to volume.replicas. | `int`               | `0`     |
+| `storagePools[name].size`             | Persistent Volume size. In MultiZone, defaults to volume.zones.<zoneName>.size, then volume.size. In Simple topology, defaults to volume.size.                | `quantity`          | `""`    |
+| `storagePools[name].storageClass`     | Kubernetes StorageClass for the pool. Defaults to volume.storageClass.                                                                                        | `string`            | `""`    |
+| `storagePools[name].resources`        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.                                                      | `object`            | `{}`    |
+| `storagePools[name].resources.cpu`    | Number of CPU cores allocated.                                                                                                                                | `quantity`          | `""`    |
+| `storagePools[name].resources.memory` | Amount of memory allocated.                                                                                                                                   | `quantity`          | `""`    |
+| `storagePools[name].resourcesPreset`  | Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.                                                                   | `string`            | `{}`    |
+| `s3`                                  | S3 service configuration.                                                                                                                                     | `object`            | `{}`    |
+| `s3.replicas`                         | Number of S3 replicas.                                                                                                                                        | `int`               | `2`     |
+| `s3.resources`                        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.                                                      | `object`            | `{}`    |
+| `s3.resources.cpu`                    | Number of CPU cores allocated.                                                                                                                                | `quantity`          | `""`    |
+| `s3.resources.memory`                 | Amount of memory allocated.                                                                                                                                   | `quantity`          | `""`    |
+| `s3.resourcesPreset`                  | Default sizing preset used when `resources` is omitted.                                                                                                       | `string`            | `small` |
 
diff --git a/packages/extra/seaweedfs/templates/dashboard-resourcemap.yaml b/packages/extra/seaweedfs/templates/dashboard-resourcemap.yaml
index 7a6db271..88b596e9 100644
--- a/packages/extra/seaweedfs/templates/dashboard-resourcemap.yaml
+++ b/packages/extra/seaweedfs/templates/dashboard-resourcemap.yaml
@@ -25,10 +25,10 @@ rules:
   resourceNames:
   - {{ $.Release.Name }}-master
   - {{ $.Release.Name }}-filer
-  - {{ $.Release.Name }}-volume
   - {{ $.Release.Name }}-db
   - {{ $.Release.Name }}-s3
   {{- if eq .Values.topology "Simple" }}
+  - {{ $.Release.Name }}-volume
   {{- range $poolName, $pool := .Values.storagePools }}
   - {{ $.Release.Name }}-volume-{{ $poolName }}
   {{- end }}
diff --git a/packages/extra/seaweedfs/values.schema.json b/packages/extra/seaweedfs/values.schema.json
index 590a22ad..1f6d40ee 100644
--- a/packages/extra/seaweedfs/values.schema.json
+++ b/packages/extra/seaweedfs/values.schema.json
@@ -286,18 +286,21 @@
       }
     },
     "storagePools": {
-      "description": "A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.",
+      "description": "A map of storage pools. Each pool creates a separate Volume StatefulSet",
       "type": "object",
       "default": {},
       "additionalProperties": {
         "type": "object",
+        "required": [
+          "diskType"
+        ],
         "properties": {
           "diskType": {
             "description": "SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").",
             "type": "string"
           },
           "replicas": {
-            "description": "Number of volume replicas. Defaults to volume.replicas.",
+            "description": "Number of volume replicas. In MultiZone, defaults to volume.zones.\u003czoneName\u003e.replicas, then volume.replicas. In Simple topology, defaults to volume.replicas.",
             "type": "integer"
           },
           "resources": {
@@ -346,7 +349,7 @@
             ]
           },
           "size": {
-            "description": "Persistent Volume size. Defaults to volume.size.",
+            "description": "Persistent Volume size. In MultiZone, defaults to volume.zones.\u003czoneName\u003e.size, then volume.size. In Simple topology, defaults to volume.size.",
             "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
             "anyOf": [
               {
@@ -359,7 +362,7 @@
             "x-kubernetes-int-or-string": true
           },
           "storageClass": {
-            "description": "Kubernetes StorageClass for the pool.",
+            "description": "Kubernetes StorageClass for the pool. Defaults to volume.storageClass.",
             "type": "string"
           }
         }
diff --git a/packages/extra/seaweedfs/values.yaml b/packages/extra/seaweedfs/values.yaml
index f9778a25..27fb5522 100644
--- a/packages/extra/seaweedfs/values.yaml
+++ b/packages/extra/seaweedfs/values.yaml
@@ -101,8 +101,8 @@ volume:
 
 ## @typedef {struct} StoragePool - Storage pool configuration for separating buckets by disk type.
 ## @field {string} diskType - SeaweedFS disk type tag (e.g., "ssd", "hdd", "nvme").
-## @field {int} [replicas] - Number of volume replicas. Defaults to volume.replicas.
-## @field {quantity} [size] - Persistent Volume size. Defaults to volume.size.
+## @field {int} [replicas] - Number of volume replicas. In MultiZone, defaults to volume.zones.<zoneName>.replicas, then volume.replicas. In Simple topology, defaults to volume.replicas.
+## @field {quantity} [size] - Persistent Volume size. In MultiZone, defaults to volume.zones.<zoneName>.size, then volume.size. In Simple topology, defaults to volume.size.
 ## @field {string} [storageClass] - Kubernetes StorageClass for the pool. Defaults to volume.storageClass.
 ## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
 ## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.
diff --git a/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml b/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml
index 1fcff7f8..a6a228f9 100644
--- a/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml
+++ b/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml
@@ -8,7 +8,7 @@ spec:
     singular: seaweedfs
     plural: seaweedfses
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"db":{"description":"Database configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of database replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""}}},"filer":{"description":"Filer service configuration.","type":"object","default":{},"properties":{"grpcHost":{"description":"The hostname used to expose or access the filer service externally.","type":"string","default":""},"grpcPort":{"description":"The port used to access the filer service externally.","type":"integer","default":443},"replicas":{"description":"Number of filer replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"whitelist":{"description":"A list of IP addresses or CIDR ranges that are allowed to access the filer service.","type":"array","default":[],"items":{"type":"string"}}}},"host":{"description":"The hostname used to access SeaweedFS externally (defaults to 's3' subdomain for the tenant host).","type":"string","default":""},"master":{"description":"Master service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of master replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"replicationFactor":{"description":"Replication factor: number of replicas for each volume in the SeaweedFS cluster.","type":"integer","default":2},"s3":{"description":"S3 service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of S3 replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"storagePools":{"description":"A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"diskType":{"description":"SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").","type":"string"},"replicas":{"description":"Number of volume replicas. Defaults to volume.replicas.","type":"integer"},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.","type":"string","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size. Defaults to volume.size.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"Kubernetes StorageClass for the pool.","type":"string"}}}},"topology":{"description":"The topology of the SeaweedFS cluster.","type":"string","default":"Simple","enum":["Simple","MultiZone","Client"]},"volume":{"description":"Volume service configuration.","type":"object","default":{},"properties":{"diskType":{"description":"SeaweedFS disk type tag for the default volume servers (e.g., \"hdd\", \"ssd\").","type":"string","default":""},"replicas":{"description":"Number of volume replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"zones":{"description":"A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"replicas":{"description":"Number of replicas in the zone.","type":"integer"},"size":{"description":"Zone storage size.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}}}}
+      {"title":"Chart Values","type":"object","properties":{"db":{"description":"Database configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of database replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""}}},"filer":{"description":"Filer service configuration.","type":"object","default":{},"properties":{"grpcHost":{"description":"The hostname used to expose or access the filer service externally.","type":"string","default":""},"grpcPort":{"description":"The port used to access the filer service externally.","type":"integer","default":443},"replicas":{"description":"Number of filer replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"whitelist":{"description":"A list of IP addresses or CIDR ranges that are allowed to access the filer service.","type":"array","default":[],"items":{"type":"string"}}}},"host":{"description":"The hostname used to access SeaweedFS externally (defaults to 's3' subdomain for the tenant host).","type":"string","default":""},"master":{"description":"Master service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of master replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"replicationFactor":{"description":"Replication factor: number of replicas for each volume in the SeaweedFS cluster.","type":"integer","default":2},"s3":{"description":"S3 service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of S3 replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"storagePools":{"description":"A map of storage pools. Each pool creates a separate Volume StatefulSet","type":"object","default":{},"additionalProperties":{"type":"object","required":["diskType"],"properties":{"diskType":{"description":"SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").","type":"string"},"replicas":{"description":"Number of volume replicas. In MultiZone, defaults to volume.zones.<zoneName>.replicas, then volume.replicas. In Simple topology, defaults to volume.replicas.","type":"integer"},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.","type":"string","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size. In MultiZone, defaults to volume.zones.<zoneName>.size, then volume.size. In Simple topology, defaults to volume.size.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"Kubernetes StorageClass for the pool. Defaults to volume.storageClass.","type":"string"}}}},"topology":{"description":"The topology of the SeaweedFS cluster.","type":"string","default":"Simple","enum":["Simple","MultiZone","Client"]},"volume":{"description":"Volume service configuration.","type":"object","default":{},"properties":{"diskType":{"description":"SeaweedFS disk type tag for the default volume servers (e.g., \"hdd\", \"ssd\").","type":"string","default":""},"replicas":{"description":"Number of volume replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"zones":{"description":"A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"replicas":{"description":"Number of replicas in the zone.","type":"integer"},"size":{"description":"Zone storage size.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}}}}
   release:
     prefix: ""
     labels:

From 275ab71feebc8bae745f1bbd4e83b2b778829390 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Fri, 27 Feb 2026 09:54:53 +0500
Subject: [PATCH 178/666] fix(seaweedfs): address review blocking issues
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Remove dots from pool name regex (K8s resources don't allow dots)
- Add zone×pool name collision validation for MultiZone topology
- Use conditional storageClass rendering to omit empty values
- Fix README resourcesPreset default value

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/extra/seaweedfs/README.md            |  2 +-
 .../extra/seaweedfs/templates/seaweedfs.yaml  | 20 ++++++++++++++++---
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/packages/extra/seaweedfs/README.md b/packages/extra/seaweedfs/README.md
index cf202c13..b5e90883 100644
--- a/packages/extra/seaweedfs/README.md
+++ b/packages/extra/seaweedfs/README.md
@@ -58,7 +58,7 @@
 | `storagePools[name].resources`        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.                                                      | `object`            | `{}`    |
 | `storagePools[name].resources.cpu`    | Number of CPU cores allocated.                                                                                                                                | `quantity`          | `""`    |
 | `storagePools[name].resources.memory` | Amount of memory allocated.                                                                                                                                   | `quantity`          | `""`    |
-| `storagePools[name].resourcesPreset`  | Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.                                                                   | `string`            | `{}`    |
+| `storagePools[name].resourcesPreset`  | Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.                                                                   | `string`            | `""`    |
 | `s3`                                  | S3 service configuration.                                                                                                                                     | `object`            | `{}`    |
 | `s3.replicas`                         | Number of S3 replicas.                                                                                                                                        | `int`               | `2`     |
 | `s3.resources`                        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.                                                      | `object`            | `{}`    |
diff --git a/packages/extra/seaweedfs/templates/seaweedfs.yaml b/packages/extra/seaweedfs/templates/seaweedfs.yaml
index 6d4f482b..85fe0ed8 100644
--- a/packages/extra/seaweedfs/templates/seaweedfs.yaml
+++ b/packages/extra/seaweedfs/templates/seaweedfs.yaml
@@ -26,13 +26,23 @@
 {{-   if not (regexMatch "^[a-z0-9]+$" $pool.diskType) }}
 {{-     fail (printf "storagePools.%s.diskType must be lowercase alphanumeric (got: %s)." $poolName $pool.diskType) }}
 {{-   end }}
-{{-   if not (regexMatch "^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$" $poolName) }}
+{{-   if not (regexMatch "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$" $poolName) }}
 {{-     fail (printf "storagePools key '%s' must be a valid DNS label (lowercase alphanumeric and hyphens)." $poolName) }}
 {{-   end }}
 {{- end }}
 {{- if and .Values.volume.diskType (not (regexMatch "^[a-z0-9]+$" .Values.volume.diskType)) }}
 {{-   fail (printf "volume.diskType must be lowercase alphanumeric (got: %s)." .Values.volume.diskType) }}
 {{- end }}
+{{- if eq .Values.topology "MultiZone" }}
+{{-   range $poolName, $pool := .Values.storagePools }}
+{{-     range $zoneName, $zone := $.Values.volume.zones }}
+{{-       $composedName := printf "%s-%s" $zoneName $poolName }}
+{{-       if hasKey $.Values.volume.zones $composedName }}
+{{-         fail (printf "storagePools: composed volume name '%s' (from zone '%s' and pool '%s') collides with an existing zone name." $composedName $zoneName $poolName) }}
+{{-       end }}
+{{-     end }}
+{{-   end }}
+{{- end }}
 
 {{- $detectedTopology := "Unknown" }}
 {{- $configMap := lookup "v1" "ConfigMap" .Release.Namespace (printf "%s-deployed-topology" .Release.Name) }}
@@ -154,7 +164,9 @@ spec:
           - name: data1
             type: "persistentVolumeClaim"
             size: "{{ $pool.size | default $zone.size | default $.Values.volume.size }}"
-            storageClass: "{{ $pool.storageClass | default $.Values.volume.storageClass }}"
+            {{- with ($pool.storageClass | default $.Values.volume.storageClass) }}
+            storageClass: "{{ . }}"
+            {{- end }}
             maxVolumes: 0
           nodeSelector: |
             topology.kubernetes.io/zone: {{ $zoneName }}
@@ -174,7 +186,9 @@ spec:
           - name: data1
             type: "persistentVolumeClaim"
             size: "{{ $pool.size | default $.Values.volume.size }}"
-            storageClass: "{{ $pool.storageClass | default $.Values.volume.storageClass }}"
+            {{- with ($pool.storageClass | default $.Values.volume.storageClass) }}
+            storageClass: "{{ . }}"
+            {{- end }}
             maxVolumes: 0
           extraArgs:
           - "-disk={{ $pool.diskType }}"

From b0b0dad305b377ed72111216e64937b812420414 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Fri, 27 Feb 2026 11:30:14 +0500
Subject: [PATCH 179/666] refactor(seaweedfs): move storage pools from
 top-level to volume.pools and zone.pools

Redesign storage pools architecture:
- Move storagePools map from top-level into volume.pools (Simple topology)
  and volume.zones[name].pools (MultiZone topology)
- Add nodeSelector, storageClass, dataCenter overrides for zones
- Add reserved suffix validation (-worm, -readonly) for pool names
- Block volume.pools usage in MultiZone (must use zone.pools instead)
- Use ternary/hasKey pattern for all optional replicas to handle 0 correctly
- Fix nodeSelector rendering for multiline values using indent
- Use disk: parameter (not diskType:) for COSI driver v0.3.0 BucketClass
- Bump seaweedfs-cosi-driver tag to v0.3.0
- Add minimum: 1 constraint for volume/zone/pool replicas in schema
- Regenerate README, CRD, and openAPISchema

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/extra/seaweedfs/README.md            | 116 ++++----
 .../images/seaweedfs-cosi-driver.tag          |   2 +-
 .../templates/dashboard-resourcemap.yaml      |   6 +-
 .../extra/seaweedfs/templates/seaweedfs.yaml  | 182 +++++++-----
 .../storage-pool-bucket-classes.yaml          |  20 +-
 packages/extra/seaweedfs/values.schema.json   | 260 ++++++++++++------
 packages/extra/seaweedfs/values.yaml          |  50 ++--
 .../seaweedfs-rd/cozyrds/seaweedfs.yaml       |   4 +-
 8 files changed, 389 insertions(+), 251 deletions(-)

diff --git a/packages/extra/seaweedfs/README.md b/packages/extra/seaweedfs/README.md
index b5e90883..62bb9bf2 100644
--- a/packages/extra/seaweedfs/README.md
+++ b/packages/extra/seaweedfs/README.md
@@ -13,56 +13,68 @@
 
 ### SeaweedFS Components Configuration
 
-| Name                                  | Description                                                                                                                                                   | Type                | Value   |
-| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- | ------- |
-| `db`                                  | Database configuration.                                                                                                                                       | `object`            | `{}`    |
-| `db.replicas`                         | Number of database replicas.                                                                                                                                  | `int`               | `2`     |
-| `db.size`                             | Persistent Volume size.                                                                                                                                       | `quantity`          | `10Gi`  |
-| `db.storageClass`                     | StorageClass used to store the data.                                                                                                                          | `string`            | `""`    |
-| `db.resources`                        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.                                                      | `object`            | `{}`    |
-| `db.resources.cpu`                    | Number of CPU cores allocated.                                                                                                                                | `quantity`          | `""`    |
-| `db.resources.memory`                 | Amount of memory allocated.                                                                                                                                   | `quantity`          | `""`    |
-| `db.resourcesPreset`                  | Default sizing preset used when `resources` is omitted.                                                                                                       | `string`            | `small` |
-| `master`                              | Master service configuration.                                                                                                                                 | `object`            | `{}`    |
-| `master.replicas`                     | Number of master replicas.                                                                                                                                    | `int`               | `3`     |
-| `master.resources`                    | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.                                                      | `object`            | `{}`    |
-| `master.resources.cpu`                | Number of CPU cores allocated.                                                                                                                                | `quantity`          | `""`    |
-| `master.resources.memory`             | Amount of memory allocated.                                                                                                                                   | `quantity`          | `""`    |
-| `master.resourcesPreset`              | Default sizing preset used when `resources` is omitted.                                                                                                       | `string`            | `small` |
-| `filer`                               | Filer service configuration.                                                                                                                                  | `object`            | `{}`    |
-| `filer.replicas`                      | Number of filer replicas.                                                                                                                                     | `int`               | `2`     |
-| `filer.resources`                     | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.                                                      | `object`            | `{}`    |
-| `filer.resources.cpu`                 | Number of CPU cores allocated.                                                                                                                                | `quantity`          | `""`    |
-| `filer.resources.memory`              | Amount of memory allocated.                                                                                                                                   | `quantity`          | `""`    |
-| `filer.resourcesPreset`               | Default sizing preset used when `resources` is omitted.                                                                                                       | `string`            | `small` |
-| `filer.grpcHost`                      | The hostname used to expose or access the filer service externally.                                                                                           | `string`            | `""`    |
-| `filer.grpcPort`                      | The port used to access the filer service externally.                                                                                                         | `int`               | `443`   |
-| `filer.whitelist`                     | A list of IP addresses or CIDR ranges that are allowed to access the filer service.                                                                           | `[]string`          | `[]`    |
-| `volume`                              | Volume service configuration.                                                                                                                                 | `object`            | `{}`    |
-| `volume.replicas`                     | Number of volume replicas.                                                                                                                                    | `int`               | `2`     |
-| `volume.size`                         | Persistent Volume size.                                                                                                                                       | `quantity`          | `10Gi`  |
-| `volume.storageClass`                 | StorageClass used to store the data.                                                                                                                          | `string`            | `""`    |
-| `volume.diskType`                     | SeaweedFS disk type tag for the default volume servers (e.g., "hdd", "ssd").                                                                                  | `string`            | `""`    |
-| `volume.resources`                    | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.                                                      | `object`            | `{}`    |
-| `volume.resources.cpu`                | Number of CPU cores allocated.                                                                                                                                | `quantity`          | `""`    |
-| `volume.resources.memory`             | Amount of memory allocated.                                                                                                                                   | `quantity`          | `""`    |
-| `volume.resourcesPreset`              | Default sizing preset used when `resources` is omitted.                                                                                                       | `string`            | `small` |
-| `volume.zones`                        | A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.                                                                | `map[string]object` | `{}`    |
-| `volume.zones[name].replicas`         | Number of replicas in the zone.                                                                                                                               | `int`               | `0`     |
-| `volume.zones[name].size`             | Zone storage size.                                                                                                                                            | `quantity`          | `""`    |
-| `storagePools`                        | A map of storage pools. Each pool creates a separate Volume StatefulSet                                                                                       | `map[string]object` | `{}`    |
-| `storagePools[name].diskType`         | SeaweedFS disk type tag (e.g., "ssd", "hdd", "nvme").                                                                                                         | `string`            | `""`    |
-| `storagePools[name].replicas`         | Number of volume replicas. In MultiZone, defaults to volume.zones.<zoneName>.replicas, then volume.replicas. In Simple topology, defaults to volume.replicas. | `int`               | `0`     |
-| `storagePools[name].size`             | Persistent Volume size. In MultiZone, defaults to volume.zones.<zoneName>.size, then volume.size. In Simple topology, defaults to volume.size.                | `quantity`          | `""`    |
-| `storagePools[name].storageClass`     | Kubernetes StorageClass for the pool. Defaults to volume.storageClass.                                                                                        | `string`            | `""`    |
-| `storagePools[name].resources`        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.                                                      | `object`            | `{}`    |
-| `storagePools[name].resources.cpu`    | Number of CPU cores allocated.                                                                                                                                | `quantity`          | `""`    |
-| `storagePools[name].resources.memory` | Amount of memory allocated.                                                                                                                                   | `quantity`          | `""`    |
-| `storagePools[name].resourcesPreset`  | Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.                                                                   | `string`            | `""`    |
-| `s3`                                  | S3 service configuration.                                                                                                                                     | `object`            | `{}`    |
-| `s3.replicas`                         | Number of S3 replicas.                                                                                                                                        | `int`               | `2`     |
-| `s3.resources`                        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.                                                      | `object`            | `{}`    |
-| `s3.resources.cpu`                    | Number of CPU cores allocated.                                                                                                                                | `quantity`          | `""`    |
-| `s3.resources.memory`                 | Amount of memory allocated.                                                                                                                                   | `quantity`          | `""`    |
-| `s3.resourcesPreset`                  | Default sizing preset used when `resources` is omitted.                                                                                                       | `string`            | `small` |
+| Name                                              | Description                                                                                                   | Type                | Value   |
+| ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ------------------- | ------- |
+| `db`                                              | Database configuration.                                                                                       | `object`            | `{}`    |
+| `db.replicas`                                     | Number of database replicas.                                                                                  | `int`               | `2`     |
+| `db.size`                                         | Persistent Volume size.                                                                                       | `quantity`          | `10Gi`  |
+| `db.storageClass`                                 | StorageClass used to store the data.                                                                          | `string`            | `""`    |
+| `db.resources`                                    | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.      | `object`            | `{}`    |
+| `db.resources.cpu`                                | Number of CPU cores allocated.                                                                                | `quantity`          | `""`    |
+| `db.resources.memory`                             | Amount of memory allocated.                                                                                   | `quantity`          | `""`    |
+| `db.resourcesPreset`                              | Default sizing preset used when `resources` is omitted.                                                       | `string`            | `small` |
+| `master`                                          | Master service configuration.                                                                                 | `object`            | `{}`    |
+| `master.replicas`                                 | Number of master replicas.                                                                                    | `int`               | `3`     |
+| `master.resources`                                | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.      | `object`            | `{}`    |
+| `master.resources.cpu`                            | Number of CPU cores allocated.                                                                                | `quantity`          | `""`    |
+| `master.resources.memory`                         | Amount of memory allocated.                                                                                   | `quantity`          | `""`    |
+| `master.resourcesPreset`                          | Default sizing preset used when `resources` is omitted.                                                       | `string`            | `small` |
+| `filer`                                           | Filer service configuration.                                                                                  | `object`            | `{}`    |
+| `filer.replicas`                                  | Number of filer replicas.                                                                                     | `int`               | `2`     |
+| `filer.resources`                                 | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.      | `object`            | `{}`    |
+| `filer.resources.cpu`                             | Number of CPU cores allocated.                                                                                | `quantity`          | `""`    |
+| `filer.resources.memory`                          | Amount of memory allocated.                                                                                   | `quantity`          | `""`    |
+| `filer.resourcesPreset`                           | Default sizing preset used when `resources` is omitted.                                                       | `string`            | `small` |
+| `filer.grpcHost`                                  | The hostname used to expose or access the filer service externally.                                           | `string`            | `""`    |
+| `filer.grpcPort`                                  | The port used to access the filer service externally.                                                         | `int`               | `443`   |
+| `filer.whitelist`                                 | A list of IP addresses or CIDR ranges that are allowed to access the filer service.                           | `[]string`          | `[]`    |
+| `volume`                                          | Volume service configuration.                                                                                 | `object`            | `{}`    |
+| `volume.replicas`                                 | Number of volume replicas.                                                                                    | `int`               | `2`     |
+| `volume.size`                                     | Persistent Volume size.                                                                                       | `quantity`          | `10Gi`  |
+| `volume.storageClass`                             | StorageClass used to store the data.                                                                          | `string`            | `""`    |
+| `volume.diskType`                                 | SeaweedFS disk type tag for the default volume servers (e.g., "hdd", "ssd").                                  | `string`            | `""`    |
+| `volume.resources`                                | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.      | `object`            | `{}`    |
+| `volume.resources.cpu`                            | Number of CPU cores allocated.                                                                                | `quantity`          | `""`    |
+| `volume.resources.memory`                         | Amount of memory allocated.                                                                                   | `quantity`          | `""`    |
+| `volume.resourcesPreset`                          | Default sizing preset used when `resources` is omitted.                                                       | `string`            | `small` |
+| `volume.zones`                                    | A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.                | `map[string]object` | `{}`    |
+| `volume.zones[name].replicas`                     | Number of replicas in the zone.                                                                               | `int`               | `0`     |
+| `volume.zones[name].size`                         | Zone storage size.                                                                                            | `quantity`          | `""`    |
+| `volume.zones[name].dataCenter`                   | SeaweedFS data center name for this zone. Defaults to the zone name.                                          | `string`            | `""`    |
+| `volume.zones[name].nodeSelector`                 | YAML nodeSelector for this zone (default: topology.kubernetes.io/zone: <zoneName>).                           | `string`            | `""`    |
+| `volume.zones[name].storageClass`                 | StorageClass used to store zone data. Defaults to volume.storageClass.                                        | `string`            | `""`    |
+| `volume.zones[name].pools`                        | A map of storage pools for this zone. Each pool creates a separate Volume StatefulSet per zone.               | `map[string]object` | `{}`    |
+| `volume.zones[name].pools[name].diskType`         | SeaweedFS disk type tag (e.g., "ssd", "hdd", "nvme").                                                         | `string`            | `""`    |
+| `volume.zones[name].pools[name].replicas`         | Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone). | `int`               | `0`     |
+| `volume.zones[name].pools[name].size`             | Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).                | `quantity`          | `""`    |
+| `volume.zones[name].pools[name].storageClass`     | Kubernetes StorageClass for the pool. Defaults to volume.storageClass.                                        | `string`            | `""`    |
+| `volume.zones[name].pools[name].resources`        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.      | `object`            | `{}`    |
+| `volume.zones[name].pools[name].resources.cpu`    | Number of CPU cores allocated.                                                                                | `quantity`          | `""`    |
+| `volume.zones[name].pools[name].resources.memory` | Amount of memory allocated.                                                                                   | `quantity`          | `""`    |
+| `volume.zones[name].pools[name].resourcesPreset`  | Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.                   | `string`            | `{}`    |
+| `volume.pools`                                    | A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.               | `map[string]object` | `{}`    |
+| `volume.pools[name].diskType`                     | SeaweedFS disk type tag (e.g., "ssd", "hdd", "nvme").                                                         | `string`            | `""`    |
+| `volume.pools[name].replicas`                     | Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone). | `int`               | `0`     |
+| `volume.pools[name].size`                         | Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).                | `quantity`          | `""`    |
+| `volume.pools[name].storageClass`                 | Kubernetes StorageClass for the pool. Defaults to volume.storageClass.                                        | `string`            | `""`    |
+| `volume.pools[name].resources`                    | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.      | `object`            | `{}`    |
+| `volume.pools[name].resources.cpu`                | Number of CPU cores allocated.                                                                                | `quantity`          | `""`    |
+| `volume.pools[name].resources.memory`             | Amount of memory allocated.                                                                                   | `quantity`          | `""`    |
+| `volume.pools[name].resourcesPreset`              | Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.                   | `string`            | `{}`    |
+| `s3`                                              | S3 service configuration.                                                                                     | `object`            | `{}`    |
+| `s3.replicas`                                     | Number of S3 replicas.                                                                                        | `int`               | `2`     |
+| `s3.resources`                                    | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.      | `object`            | `{}`    |
+| `s3.resources.cpu`                                | Number of CPU cores allocated.                                                                                | `quantity`          | `""`    |
+| `s3.resources.memory`                             | Amount of memory allocated.                                                                                   | `quantity`          | `""`    |
+| `s3.resourcesPreset`                              | Default sizing preset used when `resources` is omitted.                                                       | `string`            | `small` |
 
diff --git a/packages/extra/seaweedfs/images/seaweedfs-cosi-driver.tag b/packages/extra/seaweedfs/images/seaweedfs-cosi-driver.tag
index f07c125d..52494779 100644
--- a/packages/extra/seaweedfs/images/seaweedfs-cosi-driver.tag
+++ b/packages/extra/seaweedfs/images/seaweedfs-cosi-driver.tag
@@ -1 +1 @@
-ghcr.io/seaweedfs/seaweedfs-cosi-driver:v0.2.0
+ghcr.io/seaweedfs/seaweedfs-cosi-driver:v0.3.0
diff --git a/packages/extra/seaweedfs/templates/dashboard-resourcemap.yaml b/packages/extra/seaweedfs/templates/dashboard-resourcemap.yaml
index 88b596e9..dfd408da 100644
--- a/packages/extra/seaweedfs/templates/dashboard-resourcemap.yaml
+++ b/packages/extra/seaweedfs/templates/dashboard-resourcemap.yaml
@@ -29,15 +29,13 @@ rules:
   - {{ $.Release.Name }}-s3
   {{- if eq .Values.topology "Simple" }}
   - {{ $.Release.Name }}-volume
-  {{- range $poolName, $pool := .Values.storagePools }}
+  {{- range $poolName, $pool := .Values.volume.pools }}
   - {{ $.Release.Name }}-volume-{{ $poolName }}
   {{- end }}
   {{- else if eq .Values.topology "MultiZone" }}
   {{- range $zoneName, $zone := .Values.volume.zones }}
   - {{ $.Release.Name }}-volume-{{ $zoneName }}
-  {{- end }}
-  {{- range $poolName, $pool := .Values.storagePools }}
-  {{- range $zoneName, $zone := $.Values.volume.zones }}
+  {{- range $poolName, $pool := (dig "pools" dict $zone) }}
   - {{ $.Release.Name }}-volume-{{ $zoneName }}-{{ $poolName }}
   {{- end }}
   {{- end }}
diff --git a/packages/extra/seaweedfs/templates/seaweedfs.yaml b/packages/extra/seaweedfs/templates/seaweedfs.yaml
index 85fe0ed8..f345b00d 100644
--- a/packages/extra/seaweedfs/templates/seaweedfs.yaml
+++ b/packages/extra/seaweedfs/templates/seaweedfs.yaml
@@ -16,29 +16,61 @@
 {{-     fail "replicationFactor must be less than or equal to the number of zones defined in .Values.volume.zones." }}
 {{-   end }}
 {{- end }}
-{{- if and (eq .Values.topology "Client") (gt (len .Values.storagePools) 0) }}
-{{-   fail "storagePools is not supported with Client topology." }}
+{{- if and (eq .Values.topology "Client") (gt (len .Values.volume.pools) 0) }}
+{{-   fail "volume.pools is not supported with Client topology." }}
 {{- end }}
-{{- range $poolName, $pool := .Values.storagePools }}
-{{-   if not $pool.diskType }}
-{{-     fail (printf "storagePools.%s.diskType is required." $poolName) }}
-{{-   end }}
-{{-   if not (regexMatch "^[a-z0-9]+$" $pool.diskType) }}
-{{-     fail (printf "storagePools.%s.diskType must be lowercase alphanumeric (got: %s)." $poolName $pool.diskType) }}
-{{-   end }}
-{{-   if not (regexMatch "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$" $poolName) }}
-{{-     fail (printf "storagePools key '%s' must be a valid DNS label (lowercase alphanumeric and hyphens)." $poolName) }}
-{{-   end }}
+{{- if and (eq .Values.topology "MultiZone") (gt (len .Values.volume.pools) 0) }}
+{{-   fail "volume.pools is not supported with MultiZone topology. Use volume.zones[name].pools instead." }}
 {{- end }}
 {{- if and .Values.volume.diskType (not (regexMatch "^[a-z0-9]+$" .Values.volume.diskType)) }}
 {{-   fail (printf "volume.diskType must be lowercase alphanumeric (got: %s)." .Values.volume.diskType) }}
 {{- end }}
+
+{{- /* Collect and validate all pools from volume.pools and zones[].pools */ -}}
+{{- $allPools := dict }}
+{{- range $poolName, $pool := .Values.volume.pools }}
+{{-   if not (regexMatch "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$" $poolName) }}
+{{-     fail (printf "volume.pools key '%s' must be a valid DNS label (lowercase alphanumeric and hyphens, no dots)." $poolName) }}
+{{-   end }}
+{{-   if or (hasSuffix "-worm" $poolName) (hasSuffix "-readonly" $poolName) }}
+{{-     fail (printf "volume.pools key '%s' must not end with '-worm' or '-readonly' (reserved suffixes for COSI resources)." $poolName) }}
+{{-   end }}
+{{-   if not $pool.diskType }}
+{{-     fail (printf "volume.pools.%s.diskType is required." $poolName) }}
+{{-   end }}
+{{-   if not (regexMatch "^[a-z0-9]+$" $pool.diskType) }}
+{{-     fail (printf "volume.pools.%s.diskType must be lowercase alphanumeric (got: %s)." $poolName $pool.diskType) }}
+{{-   end }}
+{{-   if and $.Values.volume.diskType (eq $pool.diskType $.Values.volume.diskType) }}
+{{-     fail (printf "volume.pools.%s.diskType '%s' must differ from volume.diskType." $poolName $pool.diskType) }}
+{{-   end }}
+{{-   $_ := set $allPools $poolName $pool.diskType }}
+{{- end }}
 {{- if eq .Values.topology "MultiZone" }}
-{{-   range $poolName, $pool := .Values.storagePools }}
-{{-     range $zoneName, $zone := $.Values.volume.zones }}
+{{-   range $zoneName, $zone := .Values.volume.zones }}
+{{-     range $poolName, $pool := (dig "pools" dict $zone) }}
+{{-       if not (regexMatch "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$" $poolName) }}
+{{-         fail (printf "volume.zones.%s.pools key '%s' must be a valid DNS label." $zoneName $poolName) }}
+{{-       end }}
+{{-       if or (hasSuffix "-worm" $poolName) (hasSuffix "-readonly" $poolName) }}
+{{-         fail (printf "volume.zones.%s.pools key '%s' must not end with '-worm' or '-readonly' (reserved suffixes for COSI resources)." $zoneName $poolName) }}
+{{-       end }}
+{{-       if not $pool.diskType }}
+{{-         fail (printf "volume.zones.%s.pools.%s.diskType is required." $zoneName $poolName) }}
+{{-       end }}
+{{-       if not (regexMatch "^[a-z0-9]+$" $pool.diskType) }}
+{{-         fail (printf "volume.zones.%s.pools.%s.diskType must be lowercase alphanumeric (got: %s)." $zoneName $poolName $pool.diskType) }}
+{{-       end }}
+{{-       if and $.Values.volume.diskType (eq $pool.diskType $.Values.volume.diskType) }}
+{{-         fail (printf "volume.zones.%s.pools.%s.diskType '%s' must differ from volume.diskType." $zoneName $poolName $pool.diskType) }}
+{{-       end }}
+{{-       if and (hasKey $allPools $poolName) (ne (get $allPools $poolName) $pool.diskType) }}
+{{-         fail (printf "Pool '%s' has inconsistent diskType across zones (expected '%s', got '%s' in zone '%s')." $poolName (get $allPools $poolName) $pool.diskType $zoneName) }}
+{{-       end }}
+{{-       $_ := set $allPools $poolName $pool.diskType }}
 {{-       $composedName := printf "%s-%s" $zoneName $poolName }}
 {{-       if hasKey $.Values.volume.zones $composedName }}
-{{-         fail (printf "storagePools: composed volume name '%s' (from zone '%s' and pool '%s') collides with an existing zone name." $composedName $zoneName $poolName) }}
+{{-         fail (printf "Composed volume name '%s' (from zone '%s' and pool '%s') collides with an existing zone name." $composedName $zoneName $poolName) }}
 {{-       end }}
 {{-     end }}
 {{-   end }}
@@ -125,62 +157,12 @@ spec:
         extraArgs:
         - "-disk={{ .Values.volume.diskType }}"
         {{- end }}
-      {{ if eq .Values.topology "MultiZone" }}
+      {{- if or (and (eq .Values.topology "Simple") (gt (len .Values.volume.pools) 0)) (eq .Values.topology "MultiZone") }}
       volumes:
-        {{- range $zoneName, $zone := .Values.volume.zones }}
-        {{ $zoneName }}:
-          {{ with $zone.replicas }}
-          replicas: {{ . }}
-          {{- end }}
-          resources: {{- include "cozy-lib.resources.defaultingSanitize" (list $.Values.volume.resourcesPreset $.Values.volume.resources $) | nindent 12 }}
-          dataDirs:
-          - name: data1
-            type: "persistentVolumeClaim"
-            {{- if $zone.size }}
-            size: "{{ $zone.size }}"
-            {{- else }}
-            size: "{{ $.Values.volume.size }}"
-            {{- end }}
-            {{- if $zone.storageClass }}
-            storageClass: {{ $zone.storageClass }}
-            {{- else if $.Values.volume.storageClass }}
-            storageClass: {{ $.Values.volume.storageClass }}
-            {{- end }}
-            maxVolumes: 0
-          nodeSelector: |
-            topology.kubernetes.io/zone: {{ $zoneName }}
-          dataCenter: {{ $zone.dataCenter | default $zoneName }}
-          {{- if $.Values.volume.diskType }}
-          extraArgs:
-          - "-disk={{ $.Values.volume.diskType }}"
-          {{- end }}
-        {{- end }}
-        {{- range $poolName, $pool := $.Values.storagePools }}
-        {{- range $zoneName, $zone := $.Values.volume.zones }}
-        {{ $zoneName }}-{{ $poolName }}:
-          replicas: {{ $pool.replicas | default $zone.replicas | default $.Values.volume.replicas }}
-          resources: {{- include "cozy-lib.resources.defaultingSanitize" (list ($pool.resourcesPreset | default $.Values.volume.resourcesPreset) (default dict $pool.resources) $) | nindent 12 }}
-          dataDirs:
-          - name: data1
-            type: "persistentVolumeClaim"
-            size: "{{ $pool.size | default $zone.size | default $.Values.volume.size }}"
-            {{- with ($pool.storageClass | default $.Values.volume.storageClass) }}
-            storageClass: "{{ . }}"
-            {{- end }}
-            maxVolumes: 0
-          nodeSelector: |
-            topology.kubernetes.io/zone: {{ $zoneName }}
-          dataCenter: {{ $zone.dataCenter | default $zoneName }}
-          extraArgs:
-          - "-disk={{ $pool.diskType }}"
-        {{- end }}
-        {{- end }}
-      {{- end }}
-      {{- if and (eq .Values.topology "Simple") (gt (len .Values.storagePools) 0) }}
-      volumes:
-        {{- range $poolName, $pool := .Values.storagePools }}
+        {{- if eq .Values.topology "Simple" }}
+        {{- range $poolName, $pool := .Values.volume.pools }}
         {{ $poolName }}:
-          replicas: {{ $pool.replicas | default $.Values.volume.replicas }}
+          replicas: {{ ternary $pool.replicas $.Values.volume.replicas (hasKey $pool "replicas") }}
           resources: {{- include "cozy-lib.resources.defaultingSanitize" (list ($pool.resourcesPreset | default $.Values.volume.resourcesPreset) (default dict $pool.resources) $) | nindent 12 }}
           dataDirs:
           - name: data1
@@ -193,6 +175,56 @@ spec:
           extraArgs:
           - "-disk={{ $pool.diskType }}"
         {{- end }}
+        {{- else if eq .Values.topology "MultiZone" }}
+        {{- range $zoneName, $zone := .Values.volume.zones }}
+        {{ $zoneName }}:
+          replicas: {{ ternary $zone.replicas $.Values.volume.replicas (hasKey $zone "replicas") }}
+          resources: {{- include "cozy-lib.resources.defaultingSanitize" (list $.Values.volume.resourcesPreset $.Values.volume.resources $) | nindent 12 }}
+          dataDirs:
+          - name: data1
+            type: "persistentVolumeClaim"
+            size: "{{ $zone.size | default $.Values.volume.size }}"
+            {{- with ($zone.storageClass | default $.Values.volume.storageClass) }}
+            storageClass: "{{ . }}"
+            {{- end }}
+            maxVolumes: 0
+          nodeSelector: |
+            {{- with $zone.nodeSelector }}
+{{ . | indent 12 }}
+            {{- else }}
+            topology.kubernetes.io/zone: {{ $zoneName }}
+            {{- end }}
+          dataCenter: {{ $zone.dataCenter | default $zoneName }}
+          {{- if $.Values.volume.diskType }}
+          extraArgs:
+          - "-disk={{ $.Values.volume.diskType }}"
+          {{- end }}
+        {{- end }}
+        {{- range $zoneName, $zone := .Values.volume.zones }}
+        {{- range $poolName, $pool := (dig "pools" dict $zone) }}
+        {{ $zoneName }}-{{ $poolName }}:
+          replicas: {{ ternary $pool.replicas (ternary $zone.replicas $.Values.volume.replicas (hasKey $zone "replicas")) (hasKey $pool "replicas") }}
+          resources: {{- include "cozy-lib.resources.defaultingSanitize" (list ($pool.resourcesPreset | default $.Values.volume.resourcesPreset) (default dict $pool.resources) $) | nindent 12 }}
+          dataDirs:
+          - name: data1
+            type: "persistentVolumeClaim"
+            size: "{{ $pool.size | default $zone.size | default $.Values.volume.size }}"
+            {{- with ($pool.storageClass | default $zone.storageClass | default $.Values.volume.storageClass) }}
+            storageClass: "{{ . }}"
+            {{- end }}
+            maxVolumes: 0
+          nodeSelector: |
+            {{- with $zone.nodeSelector }}
+{{ . | indent 12 }}
+            {{- else }}
+            topology.kubernetes.io/zone: {{ $zoneName }}
+            {{- end }}
+          dataCenter: {{ $zone.dataCenter | default $zoneName }}
+          extraArgs:
+          - "-disk={{ $pool.diskType }}"
+        {{- end }}
+        {{- end }}
+        {{- end }}
       {{- end }}
       filer:
         {{ if eq .Values.topology "Simple" }}
@@ -273,14 +305,14 @@ spec:
     app.kubernetes.io/component: volume
     app.kubernetes.io/name: seaweedfs
   version: {{ $.Chart.Version }}
-{{- range $poolName, $pool := .Values.storagePools }}
+{{- range $poolName, $pool := .Values.volume.pools }}
 ---
 apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}-volume-{{ $poolName }}
 spec:
-  replicas: {{ default $.Values.volume.replicas $pool.replicas }}
+  replicas: {{ ternary $pool.replicas $.Values.volume.replicas (hasKey $pool "replicas") }}
   minReplicas: 1
   kind: seaweedfs
   type: volume
@@ -297,7 +329,7 @@ kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}-volume-{{ $zoneName }}
 spec:
-  replicas: {{ default $.Values.volume.replicas $zoneSpec.replicas }}
+  replicas: {{ ternary $zoneSpec.replicas $.Values.volume.replicas (hasKey $zoneSpec "replicas") }}
   minReplicas: 1
   kind: seaweedfs
   type: volume
@@ -305,16 +337,14 @@ spec:
     app.kubernetes.io/component: volume-{{ $zoneName }}
     app.kubernetes.io/name: seaweedfs
   version: {{ $.Chart.Version }}
-{{- end }}
-{{- range $poolName, $pool := .Values.storagePools }}
-{{- range $zoneName, $zone := $.Values.volume.zones }}
+{{- range $poolName, $pool := (dig "pools" dict $zoneSpec) }}
 ---
 apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}-volume-{{ $zoneName }}-{{ $poolName }}
 spec:
-  replicas: {{ $pool.replicas | default $zone.replicas | default $.Values.volume.replicas }}
+  replicas: {{ ternary $pool.replicas (ternary $zoneSpec.replicas $.Values.volume.replicas (hasKey $zoneSpec "replicas")) (hasKey $pool "replicas") }}
   minReplicas: 1
   kind: seaweedfs
   type: volume
diff --git a/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml b/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml
index a38a7e8a..a3966a68 100644
--- a/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml
+++ b/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml
@@ -1,5 +1,17 @@
-{{- if and (ne .Values.topology "Client") .Values.storagePools }}
-{{- range $poolName, $pool := .Values.storagePools }}
+{{- if ne .Values.topology "Client" }}
+{{- /* Collect unique pools from volume.pools and zones[].pools */ -}}
+{{- $uniquePools := dict }}
+{{- range $poolName, $pool := .Values.volume.pools }}
+{{-   $_ := set $uniquePools $poolName $pool.diskType }}
+{{- end }}
+{{- if eq .Values.topology "MultiZone" }}
+{{-   range $zoneName, $zone := .Values.volume.zones }}
+{{-     range $poolName, $pool := (dig "pools" dict $zone) }}
+{{-       $_ := set $uniquePools $poolName $pool.diskType }}
+{{-     end }}
+{{-   end }}
+{{- end }}
+{{- range $poolName, $diskType := $uniquePools }}
 ---
 kind: BucketClass
 apiVersion: objectstorage.k8s.io/v1alpha1
@@ -8,7 +20,7 @@ metadata:
 driverName: {{ $.Release.Namespace }}.seaweedfs.objectstorage.k8s.io
 deletionPolicy: Delete
 parameters:
-  diskType: {{ $pool.diskType }}
+  disk: {{ $diskType }}
 ---
 kind: BucketClass
 apiVersion: objectstorage.k8s.io/v1alpha1
@@ -17,7 +29,7 @@ metadata:
 driverName: {{ $.Release.Namespace }}.seaweedfs.objectstorage.k8s.io
 deletionPolicy: Retain
 parameters:
-  diskType: {{ $pool.diskType }}
+  disk: {{ $diskType }}
   objectLockEnabled: "true"
   objectLockRetentionMode: COMPLIANCE
   objectLockRetentionDays: "36500"
diff --git a/packages/extra/seaweedfs/values.schema.json b/packages/extra/seaweedfs/values.schema.json
index 1f6d40ee..b80a2b33 100644
--- a/packages/extra/seaweedfs/values.schema.json
+++ b/packages/extra/seaweedfs/values.schema.json
@@ -285,89 +285,6 @@
         }
       }
     },
-    "storagePools": {
-      "description": "A map of storage pools. Each pool creates a separate Volume StatefulSet",
-      "type": "object",
-      "default": {},
-      "additionalProperties": {
-        "type": "object",
-        "required": [
-          "diskType"
-        ],
-        "properties": {
-          "diskType": {
-            "description": "SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").",
-            "type": "string"
-          },
-          "replicas": {
-            "description": "Number of volume replicas. In MultiZone, defaults to volume.zones.\u003czoneName\u003e.replicas, then volume.replicas. In Simple topology, defaults to volume.replicas.",
-            "type": "integer"
-          },
-          "resources": {
-            "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
-            "type": "object",
-            "properties": {
-              "cpu": {
-                "description": "Number of CPU cores allocated.",
-                "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                "anyOf": [
-                  {
-                    "type": "integer"
-                  },
-                  {
-                    "type": "string"
-                  }
-                ],
-                "x-kubernetes-int-or-string": true
-              },
-              "memory": {
-                "description": "Amount of memory allocated.",
-                "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                "anyOf": [
-                  {
-                    "type": "integer"
-                  },
-                  {
-                    "type": "string"
-                  }
-                ],
-                "x-kubernetes-int-or-string": true
-              }
-            }
-          },
-          "resourcesPreset": {
-            "description": "Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.",
-            "type": "string",
-            "enum": [
-              "nano",
-              "micro",
-              "small",
-              "medium",
-              "large",
-              "xlarge",
-              "2xlarge"
-            ]
-          },
-          "size": {
-            "description": "Persistent Volume size. In MultiZone, defaults to volume.zones.\u003czoneName\u003e.size, then volume.size. In Simple topology, defaults to volume.size.",
-            "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-            "anyOf": [
-              {
-                "type": "integer"
-              },
-              {
-                "type": "string"
-              }
-            ],
-            "x-kubernetes-int-or-string": true
-          },
-          "storageClass": {
-            "description": "Kubernetes StorageClass for the pool. Defaults to volume.storageClass.",
-            "type": "string"
-          }
-        }
-      }
-    },
     "topology": {
       "description": "The topology of the SeaweedFS cluster.",
       "type": "string",
@@ -388,6 +305,89 @@
           "type": "string",
           "default": ""
         },
+        "pools": {
+          "description": "A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.",
+          "type": "object",
+          "default": {},
+          "additionalProperties": {
+            "type": "object",
+            "required": [
+              "diskType"
+            ],
+            "properties": {
+              "diskType": {
+                "description": "SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").",
+                "type": "string"
+              },
+              "replicas": {
+                "description": "Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone).",
+                "type": "integer"
+              },
+              "resources": {
+                "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
+                "type": "object",
+                "properties": {
+                  "cpu": {
+                    "description": "Number of CPU cores allocated.",
+                    "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                    "anyOf": [
+                      {
+                        "type": "integer"
+                      },
+                      {
+                        "type": "string"
+                      }
+                    ],
+                    "x-kubernetes-int-or-string": true
+                  },
+                  "memory": {
+                    "description": "Amount of memory allocated.",
+                    "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                    "anyOf": [
+                      {
+                        "type": "integer"
+                      },
+                      {
+                        "type": "string"
+                      }
+                    ],
+                    "x-kubernetes-int-or-string": true
+                  }
+                }
+              },
+              "resourcesPreset": {
+                "description": "Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.",
+                "type": "string",
+                "enum": [
+                  "nano",
+                  "micro",
+                  "small",
+                  "medium",
+                  "large",
+                  "xlarge",
+                  "2xlarge"
+                ]
+              },
+              "size": {
+                "description": "Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).",
+                "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                "anyOf": [
+                  {
+                    "type": "integer"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "x-kubernetes-int-or-string": true
+              },
+              "storageClass": {
+                "description": "Kubernetes StorageClass for the pool. Defaults to volume.storageClass.",
+                "type": "string"
+              }
+            }
+          }
+        },
         "replicas": {
           "description": "Number of volume replicas.",
           "type": "integer",
@@ -466,6 +466,96 @@
           "additionalProperties": {
             "type": "object",
             "properties": {
+              "dataCenter": {
+                "description": "SeaweedFS data center name for this zone. Defaults to the zone name.",
+                "type": "string"
+              },
+              "nodeSelector": {
+                "description": "YAML nodeSelector for this zone (default: topology.kubernetes.io/zone: \u003czoneName\u003e).",
+                "type": "string"
+              },
+              "pools": {
+                "description": "A map of storage pools for this zone. Each pool creates a separate Volume StatefulSet per zone.",
+                "type": "object",
+                "additionalProperties": {
+                  "type": "object",
+                  "required": [
+                    "diskType"
+                  ],
+                  "properties": {
+                    "diskType": {
+                      "description": "SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").",
+                      "type": "string"
+                    },
+                    "replicas": {
+                      "description": "Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone).",
+                      "type": "integer"
+                    },
+                    "resources": {
+                      "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
+                      "type": "object",
+                      "properties": {
+                        "cpu": {
+                          "description": "Number of CPU cores allocated.",
+                          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                          "anyOf": [
+                            {
+                              "type": "integer"
+                            },
+                            {
+                              "type": "string"
+                            }
+                          ],
+                          "x-kubernetes-int-or-string": true
+                        },
+                        "memory": {
+                          "description": "Amount of memory allocated.",
+                          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                          "anyOf": [
+                            {
+                              "type": "integer"
+                            },
+                            {
+                              "type": "string"
+                            }
+                          ],
+                          "x-kubernetes-int-or-string": true
+                        }
+                      }
+                    },
+                    "resourcesPreset": {
+                      "description": "Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.",
+                      "type": "string",
+                      "enum": [
+                        "nano",
+                        "micro",
+                        "small",
+                        "medium",
+                        "large",
+                        "xlarge",
+                        "2xlarge"
+                      ]
+                    },
+                    "size": {
+                      "description": "Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).",
+                      "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                      "anyOf": [
+                        {
+                          "type": "integer"
+                        },
+                        {
+                          "type": "string"
+                        }
+                      ],
+                      "x-kubernetes-int-or-string": true
+                    },
+                    "storageClass": {
+                      "description": "Kubernetes StorageClass for the pool. Defaults to volume.storageClass.",
+                      "type": "string"
+                    }
+                  }
+                }
+              },
               "replicas": {
                 "description": "Number of replicas in the zone.",
                 "type": "integer"
@@ -482,6 +572,10 @@
                   }
                 ],
                 "x-kubernetes-int-or-string": true
+              },
+              "storageClass": {
+                "description": "StorageClass used to store zone data. Defaults to volume.storageClass.",
+                "type": "string"
               }
             }
           }
diff --git a/packages/extra/seaweedfs/values.yaml b/packages/extra/seaweedfs/values.yaml
index 27fb5522..9965d5d0 100644
--- a/packages/extra/seaweedfs/values.yaml
+++ b/packages/extra/seaweedfs/values.yaml
@@ -76,9 +76,22 @@ filer:
   grpcPort: 443
   whitelist: []
 
+## @typedef {struct} StoragePool - Storage pool configuration for separating buckets by disk type.
+## @field {string} diskType - SeaweedFS disk type tag (e.g., "ssd", "hdd", "nvme").
+## @field {int} [replicas] - Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone).
+## @field {quantity} [size] - Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).
+## @field {string} [storageClass] - Kubernetes StorageClass for the pool. Defaults to volume.storageClass.
+## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.
+
 ## @typedef {struct} Zone - Zone configuration.
 ## @field {int} [replicas] - Number of replicas in the zone.
 ## @field {quantity} [size] - Zone storage size.
+## @field {string} [dataCenter] - SeaweedFS data center name for this zone. Defaults to the zone name.
+## @field {string} [nodeSelector] - YAML nodeSelector for this zone (default: topology.kubernetes.io/zone: <zoneName>).
+## @field {string} [storageClass] - StorageClass used to store zone data. Defaults to volume.storageClass.
+## @field {map[string]StoragePool} [pools] - A map of storage pools for this zone. Each pool creates a separate Volume StatefulSet per zone.
+## NOTE: Zone-level resources/resourcesPreset are inherited from volume.* settings. Pools within a zone can define their own resources.
 
 ## @typedef {struct} Volume - Volume service configuration.
 ## @field {int} [replicas] - Number of volume replicas.
@@ -88,6 +101,7 @@ filer:
 ## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
 ## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted.
 ## @field {map[string]Zone} [zones] - A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.
+## @field {map[string]StoragePool} [pools] - A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.
 
 ## @param {Volume} [volume] - Volume service configuration.
 volume:
@@ -98,35 +112,13 @@ volume:
   resources: {}
   resourcesPreset: "small"
   zones: {}
-
-## @typedef {struct} StoragePool - Storage pool configuration for separating buckets by disk type.
-## @field {string} diskType - SeaweedFS disk type tag (e.g., "ssd", "hdd", "nvme").
-## @field {int} [replicas] - Number of volume replicas. In MultiZone, defaults to volume.zones.<zoneName>.replicas, then volume.replicas. In Simple topology, defaults to volume.replicas.
-## @field {quantity} [size] - Persistent Volume size. In MultiZone, defaults to volume.zones.<zoneName>.size, then volume.size. In Simple topology, defaults to volume.size.
-## @field {string} [storageClass] - Kubernetes StorageClass for the pool. Defaults to volume.storageClass.
-## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
-## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.
-
-## @param {map[string]StoragePool} [storagePools] - A map of storage pools. Each pool creates a separate Volume StatefulSet
-## with its own disk type. Unset fields inherit from volume.* settings.
-## In Simple topology, one StatefulSet is created per pool. Pods from different pools may run on the same node.
-## In MultiZone topology, a StatefulSet is created for each zone×pool combination (e.g., zone1-fast, zone2-fast),
-## with each pinned to its zone via nodeSelector.
-## NOTE: Pool and zone names must be valid DNS labels (lowercase alphanumeric and hyphens).
-## In MultiZone, ensure that "{zoneName}-{poolName}" does not collide with any existing zone name.
-storagePools: {}
-#storagePools:
-#  fast:
-#    diskType: ssd
-#    replicas: 2
-#    size: 50Gi
-#    storageClass: "local-nvme"
-#    resourcesPreset: "small"
-#  archive:
-#    diskType: hdd
-#    replicas: 3
-#    size: 500Gi
-#    storageClass: "ceph-hdd"
+  pools: {}
+  #pools:
+  #  fast:
+  #    diskType: ssd
+  #    replicas: 2
+  #    size: 50Gi
+  #    storageClass: "local-nvme"
 
 ## @typedef {struct} S3 - S3 service configuration.
 ## @field {int} [replicas] - Number of S3 replicas.
diff --git a/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml b/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml
index a6a228f9..e31c3f3a 100644
--- a/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml
+++ b/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml
@@ -8,7 +8,7 @@ spec:
     singular: seaweedfs
     plural: seaweedfses
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"db":{"description":"Database configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of database replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""}}},"filer":{"description":"Filer service configuration.","type":"object","default":{},"properties":{"grpcHost":{"description":"The hostname used to expose or access the filer service externally.","type":"string","default":""},"grpcPort":{"description":"The port used to access the filer service externally.","type":"integer","default":443},"replicas":{"description":"Number of filer replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"whitelist":{"description":"A list of IP addresses or CIDR ranges that are allowed to access the filer service.","type":"array","default":[],"items":{"type":"string"}}}},"host":{"description":"The hostname used to access SeaweedFS externally (defaults to 's3' subdomain for the tenant host).","type":"string","default":""},"master":{"description":"Master service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of master replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"replicationFactor":{"description":"Replication factor: number of replicas for each volume in the SeaweedFS cluster.","type":"integer","default":2},"s3":{"description":"S3 service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of S3 replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"storagePools":{"description":"A map of storage pools. Each pool creates a separate Volume StatefulSet","type":"object","default":{},"additionalProperties":{"type":"object","required":["diskType"],"properties":{"diskType":{"description":"SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").","type":"string"},"replicas":{"description":"Number of volume replicas. In MultiZone, defaults to volume.zones.<zoneName>.replicas, then volume.replicas. In Simple topology, defaults to volume.replicas.","type":"integer"},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.","type":"string","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size. In MultiZone, defaults to volume.zones.<zoneName>.size, then volume.size. In Simple topology, defaults to volume.size.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"Kubernetes StorageClass for the pool. Defaults to volume.storageClass.","type":"string"}}}},"topology":{"description":"The topology of the SeaweedFS cluster.","type":"string","default":"Simple","enum":["Simple","MultiZone","Client"]},"volume":{"description":"Volume service configuration.","type":"object","default":{},"properties":{"diskType":{"description":"SeaweedFS disk type tag for the default volume servers (e.g., \"hdd\", \"ssd\").","type":"string","default":""},"replicas":{"description":"Number of volume replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"zones":{"description":"A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"replicas":{"description":"Number of replicas in the zone.","type":"integer"},"size":{"description":"Zone storage size.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}}}}
+      {"title":"Chart Values","type":"object","properties":{"db":{"description":"Database configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of database replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""}}},"filer":{"description":"Filer service configuration.","type":"object","default":{},"properties":{"grpcHost":{"description":"The hostname used to expose or access the filer service externally.","type":"string","default":""},"grpcPort":{"description":"The port used to access the filer service externally.","type":"integer","default":443},"replicas":{"description":"Number of filer replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"whitelist":{"description":"A list of IP addresses or CIDR ranges that are allowed to access the filer service.","type":"array","default":[],"items":{"type":"string"}}}},"host":{"description":"The hostname used to access SeaweedFS externally (defaults to 's3' subdomain for the tenant host).","type":"string","default":""},"master":{"description":"Master service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of master replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"replicationFactor":{"description":"Replication factor: number of replicas for each volume in the SeaweedFS cluster.","type":"integer","default":2},"s3":{"description":"S3 service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of S3 replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"topology":{"description":"The topology of the SeaweedFS cluster.","type":"string","default":"Simple","enum":["Simple","MultiZone","Client"]},"volume":{"description":"Volume service configuration.","type":"object","default":{},"properties":{"diskType":{"description":"SeaweedFS disk type tag for the default volume servers (e.g., \"hdd\", \"ssd\").","type":"string","default":""},"pools":{"description":"A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.","type":"object","default":{},"additionalProperties":{"type":"object","required":["diskType"],"properties":{"diskType":{"description":"SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").","type":"string"},"replicas":{"description":"Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone).","type":"integer"},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.","type":"string","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"Kubernetes StorageClass for the pool. Defaults to volume.storageClass.","type":"string"}}}},"replicas":{"description":"Number of volume replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"zones":{"description":"A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"dataCenter":{"description":"SeaweedFS data center name for this zone. Defaults to the zone name.","type":"string"},"nodeSelector":{"description":"YAML nodeSelector for this zone (default: topology.kubernetes.io/zone: <zoneName>).","type":"string"},"pools":{"description":"A map of storage pools for this zone. Each pool creates a separate Volume StatefulSet per zone.","type":"object","additionalProperties":{"type":"object","required":["diskType"],"properties":{"diskType":{"description":"SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").","type":"string"},"replicas":{"description":"Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone).","type":"integer"},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.","type":"string","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"Kubernetes StorageClass for the pool. Defaults to volume.storageClass.","type":"string"}}}},"replicas":{"description":"Number of replicas in the zone.","type":"integer"},"size":{"description":"Zone storage size.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store zone data. Defaults to volume.storageClass.","type":"string"}}}}}}}}
   release:
     prefix: ""
     labels:
@@ -26,7 +26,7 @@ spec:
     description: Seaweedfs
     module: true
     icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl82NzlfMTkxMCkiLz4KPHBhdGggZD0iTTEzOC42ODUgMTIxLjA1N0MxMzguNjg1IDEyNi42NTIgMTM2LjQ2MiAxMzIuMDE3IDEzMi41MDQgMTM1Ljk3M0MxMjguNTQ3IDEzOS45MjkgMTIzLjE3OSAxNDIuMTUxIDExNy41ODIgMTQyLjE1MUMxMTEuOTg1IDE0Mi4xNTEgMTA2LjYxOCAxMzkuOTI5IDEwMi42NiAxMzUuOTczQzk4LjcwMjggMTMyLjAxNyA5Ni40Nzk1IDEyNi42NTIgOTYuNDc5NSAxMjEuMDU3Qzk2LjQ3OTUgMTE4LjI4NyA5Ny4wMjUzIDExNS41NDQgOTguMDg1OCAxMTIuOTg1Qzk5LjE0NjMgMTEwLjQyNSAxMDAuNzAxIDEwOC4xIDEwMi42NiAxMDYuMTQxQzEwNC42MiAxMDQuMTgyIDEwNi45NDYgMTAyLjYyOSAxMDkuNTA3IDEwMS41NjlDMTEyLjA2NyAxMDAuNTA5IDExNC44MTEgOTkuOTYyOSAxMTcuNTgyIDk5Ljk2MjlDMTIwLjM1MyA5OS45NjI5IDEyMy4wOTggMTAwLjUwOSAxMjUuNjU4IDEwMS41NjlDMTI4LjIxOCAxMDIuNjI5IDEzMC41NDQgMTA0LjE4MiAxMzIuNTA0IDEwNi4xNDFDMTM0LjQ2NCAxMDguMSAxMzYuMDE4IDExMC40MjUgMTM3LjA3OSAxMTIuOTg1QzEzOC4xMzkgMTE1LjU0NCAxMzguNjg1IDExOC4yODcgMTM4LjY4NSAxMjEuMDU3WiIgZmlsbD0idXJsKCNwYWludDFfcmFkaWFsXzY3OV8xOTEwKSIvPgo8cGF0aCBkPSJNMTEwLjMzNiAxMjYuMTQ3SDEyMy42OFYxMzYuODIzSDExMC4zMzZWMTI2LjE0N1oiIGZpbGw9IiMwRjVFOUMiLz4KPHBhdGggZD0iTTExOS4yNyAxMTIuMjk0QzExOS4yNyAxMTIuNzE0IDExOS4xNzggMTEzLjEzMSAxMTkgMTEzLjUxOUMxMTguODIxIDExMy45MDggMTE4LjU2IDExNC4yNjEgMTE4LjIzIDExNC41NThDMTE3LjkwMSAxMTQuODU1IDExNy41MDkgMTE1LjA5MSAxMTcuMDc5IDExNS4yNTJDMTE2LjY0OCAxMTUuNDEzIDExNi4xODYgMTE1LjQ5NiAxMTUuNzIgMTE1LjQ5NkMxMTQuNzc4IDExNS40OTYgMTEzLjg3NSAxMTUuMTU4IDExMy4yMSAxMTQuNTU4QzExMi41NDQgMTEzLjk1NyAxMTIuMTcgMTEzLjE0MyAxMTIuMTcgMTEyLjI5NEMxMTIuMTcgMTExLjQ0NSAxMTIuNTQ0IDExMC42MyAxMTMuMjEgMTEwLjAzQzExMy44NzUgMTA5LjQyOSAxMTQuNzc4IDEwOS4wOTIgMTE1LjcyIDEwOS4wOTJDMTE2LjE4NiAxMDkuMDkyIDExNi42NDggMTA5LjE3NSAxMTcuMDc5IDEwOS4zMzZDMTE3LjUwOSAxMDkuNDk2IDExNy45MDEgMTA5LjczMiAxMTguMjMgMTEwLjAzQzExOC41NiAxMTAuMzI3IDExOC44MjEgMTEwLjY4IDExOSAxMTEuMDY4QzExOS4xNzggMTExLjQ1NyAxMTkuMjcgMTExLjg3MyAxMTkuMjcgMTEyLjI5NFoiIGZpbGw9IiM1OTY4NkYiLz4KPHBhdGggZD0iTTEyOC4xMSAxMTQuMTAzQzEyOC4xMSAxMTQuOTUzIDEyNy43MzYgMTE1Ljc2NyAxMjcuMDcgMTE2LjM2OEMxMjYuNDA0IDExNi45NjggMTI1LjUwMSAxMTcuMzA1IDEyNC41NiAxMTcuMzA1QzEyNC4wOTQgMTE3LjMwNSAxMjMuNjMyIDExNy4yMjMgMTIzLjIwMSAxMTcuMDYyQzEyMi43NzEgMTE2LjkwMSAxMjIuMzc5IDExNi42NjUgMTIyLjA1IDExNi4zNjhDMTIxLjcyIDExNi4wNyAxMjEuNDU4IDExNS43MTcgMTIxLjI4IDExNS4zMjlDMTIxLjEwMiAxMTQuOTQgMTIxLjAxIDExNC41MjQgMTIxLjAxIDExNC4xMDNDMTIxLjAxIDExMy42ODMgMTIxLjEwMiAxMTMuMjY2IDEyMS4yOCAxMTIuODc4QzEyMS40NTggMTEyLjQ5IDEyMS43MiAxMTIuMTM3IDEyMi4wNSAxMTEuODM5QzEyMi4zNzkgMTExLjU0MiAxMjIuNzcxIDExMS4zMDYgMTIzLjIwMSAxMTEuMTQ1QzEyMy42MzIgMTEwLjk4NCAxMjQuMDk0IDExMC45MDEgMTI0LjU2IDExMC45MDFDMTI1LjUwMSAxMTAuOTAxIDEyNi40MDQgMTExLjIzOSAxMjcuMDcgMTExLjgzOUMxMjcuNzM2IDExMi40NCAxMjguMTEgMTEzLjI1NCAxMjguMTEgMTE0LjEwM1oiIGZpbGw9IiM1OTY4NkYiLz4KPHBhdGggZD0iTTEyMi4zMzMgMTE4Ljk3NkMxMjIuMzMzIDExOS44MjYgMTIxLjk1OCAxMjAuNjQgMTIxLjI5MyAxMjEuMjQxQzEyMC42MjcgMTIxLjg0MSAxMTkuNzI0IDEyMi4xNzggMTE4Ljc4MiAxMjIuMTc4QzExOC4zMTYgMTIyLjE3OCAxMTcuODU1IDEyMi4wOTYgMTE3LjQyNCAxMjEuOTM1QzExNi45OTMgMTIxLjc3NCAxMTYuNjAyIDEyMS41MzggMTE2LjI3MiAxMjEuMjQxQzExNS45NDMgMTIwLjk0MyAxMTUuNjgxIDEyMC41OSAxMTUuNTAzIDEyMC4yMDJDMTE1LjMyNCAxMTkuODEzIDExNS4yMzIgMTE5LjM5NyAxMTUuMjMyIDExOC45NzZDMTE1LjIzMiAxMTguNTU2IDExNS4zMjQgMTE4LjE0IDExNS41MDMgMTE3Ljc1MUMxMTUuNjgxIDExNy4zNjMgMTE1Ljk0MyAxMTcuMDEgMTE2LjI3MiAxMTYuNzEyQzExNi42MDIgMTE2LjQxNSAxMTYuOTkzIDExNi4xNzkgMTE3LjQyNCAxMTYuMDE4QzExNy44NTUgMTE1Ljg1NyAxMTguMzE2IDExNS43NzQgMTE4Ljc4MiAxMTUuNzc0QzExOS43MjQgMTE1Ljc3NCAxMjAuNjI3IDExNi4xMTIgMTIxLjI5MyAxMTYuNzEyQzEyMS45NTggMTE3LjMxMyAxMjIuMzMzIDExOC4xMjcgMTIyLjMzMyAxMTguOTc2WiIgZmlsbD0iIzU5Njg2RiIvPgo8cGF0aCBkPSJNMTE1LjMwOCAxMjEuOTA1QzExMy43MzUgMTIxLjQyNiAxMTUuNzA3IDEyMC42OCAxMTUuNDI5IDEyMC41NzNDMTE0LjY1MyAxMjAuMjc2IDExNS43MyAxMTkuMzMzIDExNi43NCAxMTguNTM5QzExNy42MjggMTE3Ljg0MSAxMTcuNjU5IDExNy44MzkgMTE3Ljg5MiAxMTguNDY4QzExOC4wMjQgMTE4LjgyMyAxMTguMzcxIDExOS4yMDYgMTE4LjY2NSAxMTkuMzE5QzExOS4yODkgMTE5LjU1OCAxMjAuOTUxIDExOS4yNjkgMTIwLjk1MSAxMTguODM1QzEyMC45NTEgMTE4LjIyMyAxMjEuNDE1IDExOC42OTkgMTIxLjc5NCAxMTkuNTMxQzEyMi40NTcgMTIwLjk4NyAxMjIuNDM3IDEyMi40NzIgMTIxLjQ1IDEyMi40NzJDMTIwLjg1OSAxMjIuNDcyIDEyMC4zMSAxMjIuNjkxIDEyMC4xOSAxMjMuMTQ3QzExNS4wNDYgMTI0LjYgMTE2LjQ3MSAxMjMuMjg0IDExNS4zMDggMTIxLjkwNVpNMTIzLjA5NCAxMTguMDU0QzEyMS42MDkgMTE3LjQ2NiAxMjAuNTQ3IDExNC44MzggMTIwLjU0NyAxMTMuMzA5QzEyMC41NDcgMTExLjMyMyAxMjIuNTQxIDEwOS4wOTUgMTI0LjMxNyAxMDkuMDk1QzEyOC4zMTUgMTA5LjA5NSAxMzAuNjg0IDExMi4yNjEgMTI4LjgzOCAxMTguNDA5QzEyOC4zODUgMTE5LjkxOSAxMjMuOTMzIDExOC4zODcgMTIzLjA5NCAxMTguMDU0Wk0xMjUuODY2IDExNS42NDlDMTI3LjU0NCAxMTQuNDc0IDEyNS44NTcgMTExLjc1NSAxMjMuOTgxIDExMi42MUMxMjIuNDc5IDExMy4yOTQgMTIzLjExOSAxMTYuMTE1IDEyNC43NyAxMTYuMTY0QzEyNC45NjEgMTE2LjE2OSAxMjUuNDU0IDExNS45MzggMTI1Ljg2NiAxMTUuNjQ5Wk0xMjQuMzM5IDExNC41NzlDMTIzLjc3MSAxMTQuMzgxIDEyMy44MDMgMTEzLjI1NiAxMjQuMzgzIDExMy4wMzRDMTI0LjkwMiAxMTIuODM1IDEyNS42MDQgMTEzLjM5OCAxMjUuNjA0IDExNC4wMTRDMTI1LjYwNCAxMTQuNDg5IDEyNC45MzYgMTE0Ljc4NyAxMjQuMzM5IDExNC41NzlaTTExMi4zMTkgMTE2Ljk4QzEwOS45NiAxMTUuNjcgMTEwLjI4NiAxMTEuMDA2IDExMi40MTcgMTA4Ljk2NUMxMTQuMzk2IDEwNy4wNjkgMTE4Ljc3OCAxMDcuMTAzIDExOS43NjQgMTA5LjQ2MkMxMjAuNDE1IDExMS4wMjEgMTIwLjIyOCAxMTIuNiAxMTkuMzk4IDExNC4wNzdDMTE4LjE5NCAxMTYuMjE5IDExNC4yNDIgMTE4LjA0OSAxMTIuMzE5IDExNi45OFpNMTE2LjU2IDExMy41OTNDMTE3LjMyNSAxMTIuOTAxIDExNy4yOTcgMTEyLjA2IDExNi41NzIgMTExLjI1OUMxMTUuNzc3IDExMC4zNzkgMTE0LjY5MiAxMTAuMzQ1IDExNC4wMzUgMTExLjM0N0MxMTMuNTI0IDExMi4xMjcgMTEzLjQzMSAxMTIuNTI4IDExMy45NDMgMTEzLjMwOUMxMTQuNTggMTE0LjI4IDExNS42NyAxMTQuMzk5IDExNi41NiAxMTMuNTkzWk0xMTQuMzc0IDExMi4zNEMxMTQuMTI4IDExMS42OTggMTE0Ljk4NSAxMTAuOTgxIDExNS42OCAxMTEuMjQ3QzExNS45NzQgMTExLjM2IDExNi4xNjQgMTExLjcxOCAxMTYuMTAyIDExMi4wNDRDMTE1Ljk2MSAxMTIuNzg1IDExNC42MzIgMTEzLjAxMiAxMTQuMzc0IDExMi4zNFoiIGZpbGw9IiNEM0Q2REEiLz4KPHBhdGggZD0iTTExOC40NjMgMTIxLjAwOEwxMTcuOTQ1IDEyMC43OEMxMTcuNTEgMTIwLjY4NSAxMTcuMjMxIDEyMS4xMDcgMTE3LjEzNiAxMjEuNTQzTDExNi44ODEgMTIyLjcwOUMxMTYuNzg2IDEyMy4xNDUgMTE3LjA2MSAxMjMuNTcxIDExNy40OTYgMTIzLjY2NkwxMTguNDQ3IDEyMy44NzRDMTE4Ljg4MiAxMjMuOTY5IDExOS4zMTEgMTIzLjY5NCAxMTkuNDA2IDEyMy4yNTlMMTE5LjY4NSAxMjEuNTU2QzExOS43OCAxMjEuMTIgMTE5LjQ3OSAxMjEuMjI4IDExOS4wNDMgMTIxLjEzM0wxMTguNjI4IDEyMS4wNDNDMTE4LjU3MyAxMjEuMzIxIDExOC41MTYgMTIxLjYxMyAxMTguNDcxIDEyMS44MzNDMTE4LjQzOCAxMjEuOTk4IDExOC40MDcgMTIyLjE0OCAxMTguMzc5IDEyMi4yODJDMTE4LjM1MSAxMjIuNDE1IDExOC4zMjcgMTIyLjUzMyAxMTguMzA1IDEyMi42MzVDMTE4LjI4MiAxMjIuNzM4IDExOC4yNjIgMTIyLjgyNSAxMTguMjQ1IDEyMi44OTdDMTE4LjIyOCAxMjIuOTY5IDExOC4yMTQgMTIzLjAyNSAxMTguMjAyIDEyMy4wNjhDMTE4LjE5NiAxMjMuMDg5IDExOC4xOTMgMTIzLjEwNyAxMTguMTg4IDEyMy4xMjFDMTE4LjE4MyAxMjMuMTM1IDExOC4xNzggMTIzLjE0NSAxMTguMTc1IDEyMy4xNTJDMTE4LjE3MyAxMjMuMTU1IDExOC4xNzIgMTIzLjE1NiAxMTguMTcxIDEyMy4xNThDMTE4LjE3IDEyMy4xNTkgMTE4LjE2OCAxMjMuMTYgMTE4LjE2NyAxMjMuMTZMMTE4LjE2NSAxMjMuMTU4QzExOC4xNjQgMTIzLjE1NiAxMTguMTYzIDEyMy4xNTIgMTE4LjE2MyAxMjMuMTQ4QzExOC4xNjIgMTIzLjE0IDExOC4xNjIgMTIzLjEyOSAxMTguMTYzIDEyMy4xMTVDMTE4LjE2MyAxMjMuMSAxMTguMTYzIDEyMy4wODMgMTE4LjE2NSAxMjMuMDYxQzExOC4xNjggMTIzLjAxOCAxMTguMTc1IDEyMi45NjEgMTE4LjE4MyAxMjIuODkxQzExOC4xOTIgMTIyLjgyIDExOC4yMDMgMTIyLjczNiAxMTguMjE2IDEyMi42NEMxMTguMjI5IDEyMi41NDMgMTE4LjI0NiAxMjIuNDMxIDExOC4yNjQgMTIyLjMwOEMxMTguMjgxIDEyMi4xODUgMTE4LjMwMSAxMjIuMDUxIDExOC4zMjMgMTIxLjkwM0MxMTguMzQ2IDEyMS43NTUgMTE4LjM3IDEyMS41OTIgMTE4LjM5NyAxMjEuNDE5QzExOC40MTYgMTIxLjI5OSAxMTguNDQyIDEyMS4xNCAxMTguNDYzIDEyMS4wMDhaIiBmaWxsPSIjOThDNkQ4Ii8+CjxwYXRoIGQ9Ik0xMDMuNTgxIDExNi4zNjdDMTAzLjQ3OSAxMTYuMTAzIDEwMy42MjIgMTE1LjY5OSAxMDMuODk4IDExNS40NjlDMTA0LjMwMyAxMTUuMTMzIDEwNC41MDQgMTE1LjE1NSAxMDQuOTMgMTE1LjU4MUMxMDUuMjIgMTE1Ljg3MSAxMDUuMzU1IDExNi4yNzYgMTA1LjIzIDExNi40NzlDMTA0LjkwMiAxMTcuMDA5IDEwMy43OTggMTE2LjkzNCAxMDMuNTgxIDExNi4zNjdaIiBmaWxsPSIjOThDNkQ4Ii8+CjxwYXRoIGQ9Ik0xMDYuMDM4IDExMi4yODFDMTA1LjY4IDExMS44NDkgMTA1LjcwMiAxMTEuNjYgMTA2LjE2NSAxMTEuMTk3QzEwNi42ODkgMTEwLjY3NCAxMDYuNzY0IDExMC42NzQgMTA3LjI4NyAxMTEuMTk3QzEwNy43NTEgMTExLjY2IDEwNy43NzMgMTExLjg0OSAxMDcuNDE1IDExMi4yODFDMTA3LjE3NiAxMTIuNTY4IDEwNi44NjYgMTEyLjgwMyAxMDYuNzI2IDExMi44MDNDMTA2LjU4NiAxMTIuODAzIDEwNi4yNzcgMTEyLjU2OCAxMDYuMDM4IDExMi4yODFaIiBmaWxsPSIjOThDNkQ4Ii8+CjxwYXRoIGQ9Ik0xMDYuMDM4IDEwNy4yMjRDMTA1LjY4MiAxMDYuNzk1IDEwNS42OTQgMTA2LjYxMiAxMDYuMTA2IDEwNi4yMDFDMTA2LjY1IDEwNS42NTcgMTA3LjczOCAxMDUuODggMTA3LjczOCAxMDYuNTM2QzEwNy43MzggMTA2Ljk3IDEwNy4wNzIgMTA3Ljc0NyAxMDYuNyAxMDcuNzQ3QzEwNi41NzUgMTA3Ljc0NyAxMDYuMjc3IDEwNy41MTIgMTA2LjAzOCAxMDcuMjI0WiIgZmlsbD0iIzk4QzZEOCIvPgo8cGF0aCBkPSJNMTE3Ljk1NSAxMzYuNTQxQzExNC41NzggMTM2LjExMSAxMTAuMDg3IDEzNC44ODEgMTA5LjQxIDEzNC4yNzRDMTA4LjEyMyAxMzMuMTE5IDEwOC45NDIgMTI3Ljg3OSAxMTAuNDY2IDEyNi41NEMxMTEuMzg3IDEyNS43MzEgMTE1LjAzOSAxMjQuNjYzIDExNy4xODIgMTI1LjE2OUMxMTkuNjQyIDEyNS43NDkgMTIzLjkzMiAxMjguNjQ4IDEyNC4yNSAxMjkuNTA4QzEyNC42MjUgMTMwLjUyMiAxMjQuMDQ4IDEzNC41NDEgMTIzLjMyMyAxMzUuNTM2QzEyMi42OTQgMTM2LjM5OSAxMjAuMzI1IDEzNi44NDMgMTE3Ljk1NSAxMzYuNTQxWk0xMjAuNTQgMTM0LjA4NEMxMjEuMjk3IDEzMy4zOTkgMTIxLjM0MiAxMzEuODQyIDEyMC42MjcgMTMxLjEyNkMxMTkuNDkgMTI5Ljk4OSAxMTcuMTEyIDEzMC44NjkgMTE3LjExMiAxMzIuNDI4QzExNy4xMTIgMTM0LjMwNCAxMTkuMTg5IDEzNS4zMDcgMTIwLjU0IDEzNC4wODRaTTExOC41ODIgMTMzLjEyNUMxMTguMzExIDEzMi40MTkgMTE4LjY4IDEzMS42MDggMTE5LjI3MiAxMzEuNjA4QzEyMCAxMzEuNjA4IDEyMC4yMjggMTMyLjE3MyAxMTkuODEyIDEzMi45NDlDMTE5LjM4MSAxMzMuNzU1IDExOC44NTMgMTMzLjgzIDExOC41ODIgMTMzLjEyNVpNMTE2LjQyMiAxMzMuMTQzQzExNy4wOTQgMTMyLjMzMyAxMTYuNzExIDEzMS4xNzYgMTE1LjY4MSAxMzAuOTAyQzExNC41ODEgMTMwLjYxIDExNC4wNTIgMTMxLjE4MyAxMTQuODY5IDEzMS43OEMxMTUuNjgzIDEzMi4zNzUgMTE1LjU1MSAxMzIuNjc5IDExNC41MzMgMTMyLjU1N0MxMTMuMzI3IDEzMi40MTMgMTEyLjgzMyAxMzEuNTY2IDExMy4yNTQgMTMwLjM2MkMxMTMuNjgxIDEyOS4xNDIgMTE1LjE5NyAxMjguODYzIDExNS43NTMgMTI5LjkwMkMxMTYuMTkzIDEzMC43MjUgMTE2LjYyNyAxMzAuNzkzIDExNi45IDEzMC4wODNDMTE3LjIyOSAxMjkuMjI0IDExNS45MTQgMTI4LjIzNyAxMTQuNDQgMTI4LjIzN0MxMTEuOTkzIDEyOC4yMzcgMTEwLjgxNiAxMzEuMDc0IDExMi41NDYgMTMyLjgwM0MxMTMuNSAxMzMuNzU4IDExNS43NDkgMTMzLjk1NSAxMTYuNDIyIDEzMy4xNDNaIiBmaWxsPSIjN0JBOUI5Ii8+CjxwYXRoIGQ9Ik0xMjAuMTE4IDEzOC41OTJDMTE4Ljc1MSAxMzcuMjk3IDEyMS45MTYgMTM2LjA5NiAxMjMuNjA2IDEzOC4yODNDMTI0LjQ2OSAxMzkuMzIyIDEyMi44NTMgMTM5Ljk3NiAxMjAuMTE4IDEzOC41OTJaTTEwNi4xMiAxMzUuNjU4QzEwNC43NTEgMTM0LjI4OSAxMDYuOTYzIDEzMy45MDQgMTA4LjU4MSAxMzUuMjNMMTA5Ljk0MSAxMzUuOTJMMTA4LjA1OSAxMzYuMDYxQzEwNy4yMTUgMTM2LjA2MiAxMDYuMzQzIDEzNS44ODEgMTA2LjEyIDEzNS42NThWMTM1LjY1OFpNMTI1LjM2MyAxMjcuODY2QzEyNS4wODIgMTI3LjQxIDEyOC4zMzMgMTI2LjI2NyAxMjguNjg4IDEyNi40ODZDMTI4Ljg0NiAxMjYuNTg0IDEyOC45NzUgMTI3LjMzNyAxMjguOTc1IDEyOC4xNjFDMTI4Ljk3NSAxMjkuMjM5IDEyOC44NCAxMjkuNjU4IDEyOC40OSAxMjkuNjU4QzEyOC4yMjIgMTI5LjY1OCAxMjUuNDc2IDEyOC4wNDcgMTI1LjM2MyAxMjcuODY2Wk0xMTguNjQxIDEyMS4wOTVDMTE0Ljg3MSAxMjAuNzUzIDExNS4zNzggMTE5LjMyNyAxMTYuMzYxIDExOC40OTlDMTE2LjkyOCAxMTguMDIxIDExNy4zNCAxMTcuNzc5IDExNy45MTMgMTE3LjY2N0MxMTcuOTEzIDExNy42NjcgMTE3Ljg3MiAxMTkuMDQ2IDExOC42NjYgMTE5LjMxOUMxMTkuMjk3IDExOS41MzYgMTIwLjI3OCAxMTkuMDY0IDEyMC40NzEgMTE4LjY3NUMxMjIuMTg4IDExNS4yMDEgMTIxLjQxNSAxMTguNjk5IDEyMS43OTQgMTE5LjUzMkMxMjMuMjM4IDEyNC4wMDcgMTIwLjE4OCAxMjEuNzMgMTE4LjY0MSAxMjEuMDk1Wk0xMDQuOTEyIDEyMS4yM0MxMDQuMjQyIDEyMC40ODcgMTAzLjY5MyAxMTkuNzI5IDEwMy42OTMgMTE5LjU0NEMxMDMuNjkzIDExOS4xMTYgMTA0Ljc0NiAxMTkuMTEyIDEwNS44NjMgMTE5LjUzN0MxMDYuNTkzIDExOS44MTQgMTEwLjM0NyAxMjAuMDA2IDExMC4zNDcgMTIxLjE1M0MxMTAuMzQ3IDEyMS44OTkgMTA4Ljg5IDEyMy43NjIgMTA4LjcyNiAxMjMuNzYyQzEwOC41NjMgMTIzLjc2MiAxMDUuNTgzIDEyMS45NzIgMTA0LjkxMiAxMjEuMjNaIiBmaWxsPSIjQTZCM0MyIi8+CjxwYXRoIGQ9Ik0xMTguNDYzIDEyMS4wMDhDMTE4LjQ0MiAxMjEuMTQgMTE4LjQxNiAxMjEuMjk5IDExOC4zOTcgMTIxLjQxOUMxMTguMzcgMTIxLjU5MiAxMTguMzQ1IDEyMS43NTUgMTE4LjMyMyAxMjEuOTAzQzExOC4zIDEyMi4wNTEgMTE4LjI4MSAxMjIuMTg1IDExOC4yNjMgMTIyLjMwOEMxMTguMjQ1IDEyMi40MzEgMTE4LjIyOSAxMjIuNTQyIDExOC4yMTYgMTIyLjYzOUMxMTguMjAzIDEyMi43MzYgMTE4LjE5MSAxMjIuODIgMTE4LjE4MyAxMjIuODlDMTE4LjE3NSAxMjIuOTYxIDExOC4xNjggMTIzLjAxOCAxMTguMTY1IDEyMy4wNjFDMTE4LjE2MyAxMjMuMDgzIDExOC4xNjQgMTIzLjEgMTE4LjE2MyAxMjMuMTE1QzExOC4xNjIgMTIzLjEyOSAxMTguMTYyIDEyMy4xNCAxMTguMTYzIDEyMy4xNDhDMTE4LjE2MyAxMjMuMTUyIDExOC4xNjQgMTIzLjE1NiAxMTguMTY1IDEyMy4xNThMMTE4LjE2NyAxMjMuMTZDMTE4LjE2OCAxMjMuMTYgMTE4LjE3IDEyMy4xNTkgMTE4LjE3MSAxMjMuMTU4QzExOC4xNzIgMTIzLjE1NyAxMTguMTczIDEyMy4xNTUgMTE4LjE3NSAxMjMuMTUyQzExOC4xNzggMTIzLjE0NSAxMTguMTgyIDEyMy4xMzUgMTE4LjE4NyAxMjMuMTIxQzExOC4xOTIgMTIzLjEwNyAxMTguMTk2IDEyMy4wODkgMTE4LjIwMiAxMjMuMDY3QzExOC4yMTMgMTIzLjAyNSAxMTguMjI4IDEyMi45NjkgMTE4LjI0NSAxMjIuODk3QzExOC4yNjIgMTIyLjgyNSAxMTguMjgyIDEyMi43MzggMTE4LjMwNSAxMjIuNjM1QzExOC4zMjcgMTIyLjUzMyAxMTguMzUxIDEyMi40MTUgMTE4LjM3OSAxMjIuMjgxQzExOC40MDYgMTIyLjE0OCAxMTguNDM4IDEyMS45OTggMTE4LjQ3MSAxMjEuODMzQzExOC41MTYgMTIxLjYxMyAxMTguNTczIDEyMS4zMjEgMTE4LjYyOCAxMjEuMDQzTDExOC40NjMgMTIxLjAwOFoiIGZpbGw9IiM0QzlDQkIiLz4KPHBhdGggZD0iTTMwLjk5ODYgMTQyLjY3M0MyNi40NDg5IDE0MC45MTYgMjEuNDY2NCAxMzYuODA1IDE4Ljc5MjEgMTMyLjYwM0MxNS40MDUzIDEyNy4yODEgMTQuNDA1MiAxMjMuNDE5IDE1LjA2MzYgMTE4LjIwM0MxNS42ODA2IDExMy4zMTUgMTcuMzU1OCAxMTAuNTU3IDIyLjIyMzIgMTA2LjQxM0MyOS4wNDE3IDEwMC42MDggMzQuNDg0NiA5Ny45Nzk5IDQwLjU5NDcgOTcuNTQxNUM0OS44MjEyIDk2Ljg3OTQgNTUuMDk3OCA5OS44MTA5IDU3LjY0NjUgMTA3LjAxNUM1OC41MDQzIDEwOS40MzkgNTguNjg1NiAxMTUuNTcgNTguMDU0NCAxMjAuODA5QzU3LjgzMTEgMTIyLjY2MyA1Ny40Nzg5IDEyNi4wNTUgNTcuMjcxOCAxMjguMzQ4QzU2LjU0NjcgMTM2LjM3NSA1NC40MTQ3IDE0MC40MTcgNDkuNjI1MyAxNDIuODQzQzQ4LjI5NzkgMTQzLjUxNiA0Ny43MTk5IDE0My41NjEgNDAuNjkyNCAxNDMuNTM5QzMzLjUxNTEgMTQzLjUxNiAzMy4wODEgMTQzLjQ3OCAzMC45OTg2IDE0Mi42NzNaTTAuMDc5NTc2NSAxMDQuOTY1QzAuMDgxNTcyMyAxMDMuODUzIDAuMTQ0NDAzIDEwMy40MzggMC4yMTk0MjcgMTA0LjA0NEMwLjI5NDQ1MSAxMDQuNjUgMC4yOTI4OTkgMTA1LjU2IDAuMjE1OTk2IDEwNi4wNjdDMC4xMzkwNzkgMTA2LjU3MyAwLjA3NzY4MzggMTA2LjA3OCAwLjA3OTU3NjUgMTA0Ljk2NVpNMC4wMDE3MzM1MSAxMDIuMjRDMC4wMTc4OTkyIDEwMS44NDggMC4wOTc3ODk3IDEwMS43NjggMC4yMDUzOTggMTAyLjAzN0MwLjMwMjc3MiAxMDIuMjggMC4yOTA3OTcgMTAyLjU3MSAwLjE3ODc4NyAxMDIuNjgzQzAuMDY2Nzc0OCAxMDIuNzk1IC0wLjAxMjkwMjEgMTAyLjU5NiAwLjAwMTczMzUxIDEwMi4yNFpNMC4wMjgzNDQ0IDc1LjEzMjZDMC4wMjgzNDQ0IDc0LjY2OTEgMC4xMDQ4NTcgNzQuNDc5NSAwLjE5ODM2OSA3NC43MTEyQzAuMjkxODg0IDc0Ljk0MyAwLjI5MTg4NCA3NS4zMjIyIDAuMTk4MzY5IDc1LjU1MzlDMC4xMDQ4NTcgNzUuNzg1NyAwLjAyODM0NDQgNzUuNTk2MSAwLjAyODM0NDQgNzUuMTMyNloiIGZpbGw9InVybCgjcGFpbnQyX3JhZGlhbF82NzlfMTkxMCkiLz4KPHBhdGggZD0iTTM1LjMxMzMgMTEyLjU0NEwzNy45IDExMS4wOTFMMzkuMzUxNyAxMjEuNDZMMzkuMjQ4IDEyOC45MjZMMzUuMzcwMyAxMzAuODUxTDMyLjkyMjkgMTI2LjQzN0wzNS4zMTMzIDExMi41NDRaIiBmaWxsPSIjMzA2MEFEIi8+CjxwYXRoIGQ9Ik0zOC43Mjk1IDExNi42OUwzOS4zNTE2IDEyNC41NzFMNDMuMjkxOSAxMjUuOTE5TDQzLjM5NTYgMTA5LjIyNUw0MC4xODEyIDExMC4wNTRMMzguNzI5NSAxMTYuNjlaIiBmaWxsPSIjNjA2MzY4Ii8+CjxwYXRoIGQ9Ik0zNS4zNjk5IDEzMC44NTFDMzMuMDMyNCAxMjkuNzMgMjkuNzMwMSAxMjYuNDA4IDI4LjY2MjEgMTI0LjEwM0MyOC4wMzMyIDEyMi43NDUgMjcuNjM5NyAxMjIuMzEgMjYuODkyMyAxMjIuMTQ2QzI1Ljc4NzkgMTIxLjkwMyAyNS44MDg0IDEyMS45NzEgMjYuMzIxOCAxMjAuMjU4QzI2LjU5MzYgMTE5LjM1IDI2LjkwMzIgMTE4Ljk1NCAyNy4zNDA2IDExOC45NTRDMjcuNjg2MiAxMTguOTU0IDI5LjE1OTcgMTE3Ljg0MSAzMC42MTQ5IDExNi40OEMzMi4wNzAyIDExNS4xMTkgMzMuNzIyNiAxMTMuNjc3IDM0LjI4NjkgMTEzLjI3NUwzNS4zMTI5IDExMi41NDRMMzUuNjc2NyAxMTQuMjQxQzM3LjA0NDMgMTIwLjYxOCAzNy4wMjcgMTI0LjI2NiAzNS42MTk4IDEyNi4yNDNDMzQuNTUyMSAxMjcuNzQ0IDM0Ljg0MTcgMTI4LjM5MyAzNi41NzkxIDEyOC4zOTNDMzcuMzk3IDEyOC4zOTMgMzcuODIyMiAxMjguMTg1IDM4LjEzMDUgMTI3LjYzNEMzOC42NzQ4IDEyNi42NjMgMzguNjMxNSAxMjAuOTY4IDM4LjA0NTQgMTE2LjQyNkMzNy4zNDQ2IDExMC45OTUgMzcuMzEyNyAxMTEuMTY3IDM5LjE1NzggMTEwLjM5OEM0MC4wMzYgMTEwLjAzMSA0MC44MTggMTA5Ljc5NyA0MC44OTU1IDEwOS44NzdDNDAuOTczMSAxMDkuOTU2IDQwLjgxOTEgMTExLjIzNSA0MC41NTM0IDExMi43MThDMzkuNjA2NyAxMTguMDAzIDM5LjkzMTUgMTIzLjIzOCA0MS4yNzUyIDEyNC4zNTNDNDEuNjg1MSAxMjQuNjkzIDQxLjcyMzMgMTIzLjk2OSA0MS41NDUyIDExOS4yMzJDNDEuMzE1NiAxMTMuMTIzIDQxLjUxNzQgMTEwLjkxOSA0Mi40MDc1IDEwOS44MkM0Mi45MTk4IDEwOS4xODggNDMuMjEzIDEwOS4xMTYgNDQuNDk1OSAxMDkuMzFDNDYuOTU2NiAxMDkuNjgyIDQ2Ljk1MDYgMTA5LjY2OCA0Ni4yMDk5IDExMy4yNTRDNDUuODQ5NiAxMTQuOTk5IDQ1LjQ0ODMgMTE3LjIyNCA0NS4zMTggMTE4LjJMNDUuMDgxMiAxMTkuOTczTDQ1Ljk0NDYgMTE5LjY0NUM0Ni40MTk1IDExOS40NjUgNDcuNDQxMyAxMTguOTk0IDQ4LjIxNTMgMTE4LjU5OUw0OS42MjI2IDExNy44ODFMNDkuMzg5MyAxMTguNjdDNDkuMjYxIDExOS4xMDUgNDkuMDY3MiAxMjAuNzAxIDQ4Ljk1ODcgMTIyLjIxOEw0OC43NjE0IDEyNC45NzZMNDcuMTA5NSAxMjQuMzI1QzQ2LjIwMSAxMjMuOTY3IDQ1LjMxMTYgMTIzLjY3NCA0NS4xMzMxIDEyMy42NzRDNDQuOTQxIDEyMy42NzQgNDQuODA4NSAxMjUuNTMyIDQ0LjgwODUgMTI4LjIyNEM0NC44MDg1IDEzMS44OTEgNDQuNzE3MSAxMzIuNzc1IDQ0LjMzODYgMTMyLjc3NUM0MS4wMTk4IDEzMi4yOTUgMzguNzg0MiAxMzIuNDU4IDM1LjM2OTkgMTMwLjg1MVoiIGZpbGw9IiNFRUMyM0IiLz4KPHBhdGggZD0iTTQxLjE2MzkgMTMyLjQxOEM0MS4xNjM5IDEzMi4yODMgNDEuMzQwOCAxMzAuNTE1IDQxLjY2OTIgMTI4LjE0NUM0MS45OTc3IDEyNS43NzUgNDIuMzU3NyAxMjIuOTYxIDQyLjQ2OTIgMTIxLjg5M0M0Mi41ODA4IDEyMC44MjQgNDIuNzk2OSAxMjAuMDI3IDQyLjk0OTUgMTIwLjEyMUM0My42NDQzIDEyMC41NTEgNDQuMjkzOCAxMjkuMzc1IDQ0LjA0NzQgMTMxLjQyQzQzLjg5MDkgMTMyLjcxOSA0My42NTk1IDEzMi43MzcgNDMuMzAxOSAxMzIuNjc3QzQyLjY2MDIgMTMyLjU3IDQxLjkxMDEgMTMyLjUxMyA0MS4xNjM5IDEzMi40MThaTTMyLjU5NjkgMTIyLjczNUMzMS42ODEzIDEyMi41ODMgMzAuODI0MiAxMjEuNDQyIDMwLjgyNDIgMTIwLjM3NEMzMC44MjQyIDExOS40MDcgMzIuMjM4MSAxMTcuOTM3IDMzLjE2ODUgMTE3LjkzN0MzNC42NjY2IDExNy45MzcgMzUuODM5MiAxMjAuNTEzIDM0Ljk0ODQgMTIxLjg0N0MzNC41NTE3IDEyMi40NDEgMzMuNDE0NyAxMjIuODcgMzIuNTk2OSAxMjIuNzM1WiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZD0iTTExNC4wMjEgMTM3LjQ5OEMxMDcuMzE4IDEzNS43NCAxMDYuMjczIDEzNC4xMDQgMTA2LjYwOSAxMjUuODkxQzEwNi43MTYgMTIzLjI4MSAxMDYuODg1IDEyMC41MzkgMTA2Ljk4NiAxMTkuNzk3QzEwNy41NDUgMTE1LjY2NCAxMDguMzQyIDExMi4xNzMgMTA5LjA4NiAxMTAuNTk5QzEwOS43NDQgMTA5LjIwNiAxMDkuODQyIDEwOC43MTIgMTA5LjUzNSAxMDguMzQyQzEwOC40NSAxMDcuMDM1IDExMC4zNzEgMTA0Ljk5NSAxMTEuOTEgMTA1LjgxOUMxMTIuNDU3IDEwNi4xMTEgMTEyLjkxOCAxMDYuMDc3IDExMy45NDUgMTA1LjY2NUMxMTcuMDYyIDEwNC40MTkgMTIzLjExNyAxMDUuNTcxIDEyNi44MTQgMTA4LjExNUMxMjguMTQ5IDEwOS4wMzMgMTI4LjQ4NSAxMDkuMTM2IDEyOS4wMzggMTA4Ljc5MUMxMzAuNTIzIDEwNy44NjMgMTMyLjQ1MSAxMTAuNTczIDEzMS4yNSAxMTEuOUMxMzAuNzg3IDExMi40MTIgMTMwLjc1NSAxMTIuNzA1IDEzMS4wNjUgMTEzLjU5NkMxMzEuODUgMTE1Ljg0NiAxMzEuNzk0IDExNi4xMDQgMTI4LjAwNiAxMjcuNzE5QzEyNS41OCAxMzUuMTYgMTI0LjU0MyAxMzcuMzY1IDEyMy4yNjQgMTM3LjgxMUMxMjEuNjUzIDEzOC4zNzMgMTE2LjcyMyAxMzguMjA2IDExNC4wMjEgMTM3LjQ5OFpNMTIyLjU0MSAxMzUuMjI5QzEyMy4wMDMgMTM0LjU0MSAxMjMuMzU5IDEzMy4zMTMgMTIzLjUxMyAxMzEuODc4QzEyMy43OTQgMTI5LjI1IDEyMy44MTkgMTI5LjI4MyAxMjAuMzE3IDEyNy42MDFDMTE3LjY4NSAxMjYuMzM4IDExMy44MzMgMTI1Ljk3MiAxMTEuODU1IDEyNi43OThDMTEwLjgyOSAxMjcuMjI3IDExMC41OTUgMTI3LjU1NiAxMTAuMDU5IDEyOS4zMjdDMTA5LjExNiAxMzIuNDQzIDEwOS43MDMgMTM0LjMwOCAxMTEuODMyIDEzNC45NThDMTEzLjEzOSAxMzUuMzU3IDEyMC4wOSAxMzYuNDMgMTIwLjk4IDEzNi4zN0MxMjEuNTA0IDEzNi4zMzUgMTIyLjA4MiAxMzUuOTEyIDEyMi41NDEgMTM1LjIyOVpNMTE5LjQ1MSAxMjIuNDJDMTE5LjYzIDEyMi4wODEgMTE5LjY4NSAxMjEuNTU2IDExOS42ODUgMTIxLjU1NkMxMjAuMTU2IDEyMS42NTQgMTIwLjQ4IDEyMS42ODMgMTIwLjcyNiAxMjEuNzE5QzEyMS4xMDUgMTIxLjc3NCAxMjEuNTY0IDEyMS41ODcgMTIxLjc0NSAxMjEuMzAzQzEyMi4xNDkgMTIwLjY3MSAxMjAuNDc0IDExNy43MDEgMTE5LjU0OCAxMTcuNDA4QzExOC42NjggMTE3LjEyOCAxMTUuOTM1IDExOC44MjcgMTE1LjkzNSAxMTkuNjUzQzExNS45MzUgMTIwLjAyMiAxMTYuNTUzIDEyMC40MTEgMTE2LjgzMSAxMjAuNTE4QzExNi45ODIgMTIwLjU3NiAxMTcuMjUyIDEyMC43MzggMTE3LjU3NiAxMjAuOTM4QzExNy4zOCAxMjEuMzUxIDExNy4zNDYgMTIxLjQ3OCAxMTcuMzEyIDEyMS43MjRDMTE3LjIwNCAxMjIuNDk4IDExNy40MzUgMTIyLjY4NiAxMTguNDE2IDEyMi45MTJDMTE5LjE1MSAxMjIuOTkxIDExOS4yNSAxMjIuODQ1IDExOS40NTEgMTIyLjQyWk0xMjcuMjY1IDExNi44MzZDMTMwLjkzMyAxMTMuNDc1IDEyNy4wNzQgMTA3LjQxIDEyMi43MDUgMTA5LjY3QzEyMS42MjYgMTEwLjIyOCAxMjAuNjU0IDExMi4wMTkgMTIwLjY1NCAxMTMuNDQ5QzEyMC42NTQgMTE1LjY2NCAxMjIuODMxIDExNy45MzcgMTI0Ljk1NyAxMTcuOTQxQzEyNS43MzMgMTE3Ljk0MyAxMjYuNDE0IDExNy42MTcgMTI3LjI2NSAxMTYuODM2Wk0xMTcuMTQxIDExNS42MjJDMTE5LjAzNSAxMTQuNDY4IDExOS44MDQgMTExLjc5NSAxMTguODAyIDEwOS44NTdDMTE4LjA4MiAxMDguNDY0IDExNy4wMDggMTA3LjgzIDExNS4zNjYgMTA3LjgzQzExMS41MDggMTA3LjgzIDEwOS40ODUgMTEzLjIzNCAxMTIuNDY1IDExNS41NzhDMTEzLjU3IDExNi40NDggMTE1Ljc1NCAxMTYuNDY4IDExNy4xNDEgMTE1LjYyMloiIGZpbGw9IiMwOTk2RDEiLz4KPHBhdGggb3BhY2l0eT0iMC45IiBkPSJNMzMuMTc1NyAyNkwzMi4zODEgMjcuMjE5QzMxLjk0NDkgMjcuODg5IDMxLjI4MzYgMjkuMzI0OCAzMC45MDkxIDMwLjQwODhDMzAuNTM0NyAzMS40OTI4IDI5Ljk5MjIgMzIuOTcwMSAyOS43MDQzIDMzLjY5MjhDMjkuNDE2MyAzNC40MTU0IDI5LjE3MzMgMzYuMTE1IDI5LjE2MzggMzcuNDdDMjkuMTQzNiA0MC4zNTMgMjguNzQ5NCA0MS44ODg4IDI3LjYzNjQgNDMuNDIyNUMyNi45MjEyIDQ0LjQwOCAyNi42NzUxIDQ0LjUyMjMgMjUuNDUzMiA0NC40NDFDMjMuODk5NSA0NC4zMzc3IDIyLjgxNTMgNDUuMDgxNSAyMS4yMTcgNDcuMzQ4MUMyMC43MTY1IDQ4LjA1OCAyMC4xMzY3IDQ4LjYzOTMgMTkuOTI4OSA0OC42MzkzQzE5LjcyMTEgNDguNjM5MyAxOS4xODA1IDQ4LjIzMTkgMTguNzI2MiA0Ny43MzUxQzE4LjI3MTkgNDcuMjM4MiAxNy45OTQ0IDQ3LjAxMTUgMTguMTExIDQ3LjIyOThDMTguNDkgNDcuOTM5NiAxNy41OTA0IDUzLjI2MTUgMTYuODM3OCA1NC43NjQyQzE1Ljk2NyA1Ni41MDI4IDE0LjM4NzIgNTcuNzIzMyAxMi41MzU0IDU4LjA4NDNDMTEuMDA1OSA1OC4zODI2IDExLjIyODMgNTguMDkgOC43MTc5NSA2My4wOTQ2QzYuNjYzMzQgNjcuMTkwNyA1Ljk2OTM1IDY3LjgyNjQgMi42NTUzMyA2OC42NTQyQzEuNDk3MTcgNjguOTQzNCAwLjQ1ODc1OSA2OS43MTQyIDAgNzAuNTI4N1Y3Mi44MjYzQzAuMzU2MTkzIDcyLjc0NzMgMC44Mjg3MjggNzIuNjIwMyAxLjYxNDk5IDcyLjM4NzNDMi45OTQ4NiA3MS45NzgyIDQuODIzNDggNzEuNDgwNiA1LjY3ODEgNzEuMjgwNkM3LjcyOTM0IDcwLjgwMDYgOS4zOTM1MSA2OS4yMTk1IDkuOTIyNzkgNjcuMjQ2N0MxMC4yNDI0IDY2LjA1NTQgMTAuNzAzMyA2NS40MjQxIDExLjk5OTIgNjQuNDA1OEMxMy4yODQgNjMuMzk2MiAxMy43NTY1IDYyLjc1NDYgMTQuMDY3MSA2MS41OTY5QzE0LjM3MzkgNjAuNDUzMiAxNC43MDExIDYwLjAwNCAxNS40NDA3IDU5LjcwNjNDMTcuMDE1MyA1OS4wNzI0IDIwLjY0NDQgNTUuODY1NSAyMS4yMzYzIDU0LjU4NThDMjEuNTM3MyA1My45MzQ5IDIyLjExOTggNTIuNTM5OSAyMi41Mjg3IDUxLjQ4NjJDMjMuMjYzNCA0OS41OTMyIDI1LjAxOTUgNDcuMzI2MSAyNS43NTAxIDQ3LjMyNjFDMjUuOTU3NCA0Ny4zMjYxIDI3LjEwOSA0Ni43MjQ4IDI4LjMwOTMgNDUuOTkwOEMzMS4yMzc2IDQ0LjIwMDMgMzEuNTk5MSA0My40MTM2IDMxLjU5OTEgMzguODYxNEMzMS41OTkxIDM1LjY4MTQgMzEuNjg3IDM1LjE1NTcgMzIuMzQ2OCAzNC4zNjg0QzMzLjAwMzcgMzMuNTg0NyAzMy4wOTk3IDMzLjAyNDkgMzMuMTM1MSAyOS43MzkxTDMzLjE3NTcgMjZaTTI0LjMzMzggNjMuNTk1OEMyNC4yMDM3IDYzLjYxMzUgMjQuMDczOCA2My42NjE4IDIzLjkyNTggNjMuNzM2MkMyMi45Mzk3IDY0LjIzMTUgMjIuNjEzNiA2NC45MTAyIDIxLjU5NzMgNjguNTg2QzIxLjAxNzkgNzAuNjgxNSAyMC40MjEyIDcyLjA4MTkgMTkuODc5OCA3Mi42MTc4QzE5LjQyMzUgNzMuMDY5NSAxOC45MzgzIDczLjg4MjMgMTguODAxIDc0LjQyNDJDMTguMTgxIDc2Ljg3MTUgMTYuNzQ1NCA3OC42MDczIDE0LjQ0OTUgNzkuNjg3MUMxMi40NTU1IDgwLjYyNDkgMTAuNjQwNyA4Mi4xMTc5IDkuMTExMDIgODQuMDc5OEM4LjMyMTA5IDg1LjA5MjkgNy40ODc1MiA4Ni4wMjkgNy4yNTY3OCA4Ni4xNjA5QzYuNzYxNjQgODYuNDQ0IDUuNzA4OTkgODguODk0MSA0LjYwNzg1IDkyLjMyOEMzLjcxMDkyIDk1LjEyNSAxLjcxMDY1IDk3LjQ2ODIgMC40Nzg1MTQgOTcuMTY1OEMwLjI1NDkzMSA5Ny4xMTA5IDAuMTA2OTExIDk3LjExMzcgMCA5Ny4yOTAxVjEwNC40OTJDMC41NTY0MTEgMTAzLjY2NCAxLjIzNDIgMTAyLjYyOSAyLjU2MzQ3IDEwMC41NEM0LjM0NTExIDk3LjczOTcgNi40NjM4NSA5NC40ODY3IDcuMjcxNzMgOTMuMzEyNEM4LjA3OTYgOTIuMTM4MSA5LjM1Njg3IDkwLjE0ODggMTAuMTA4NiA4OC44OTE2QzExLjIzNDIgODcuMDA5MiAxMi4xMDE2IDg2LjEyNDMgMTUuMDI4NCA4My44ODMzTDE4LjU4MzEgODEuMTYyN0wyMC40MDUzIDc1Ljk4ODFDMjMuMTg5NSA2OC4wODE3IDIzLjk1ODUgNjcuMTk5NyAyNy43NjI0IDY3LjU1MTVDMjkuNDYwNSA2Ny43MDg1IDMwLjYzMzQgNjcuNjE5NiAzMi4wNzM0IDY3LjIyNjdDMzQuMTgyNiA2Ni42NTEyIDM0LjQ3OTkgNjYuMTg3MiAzMy4zNTUxIDY1LjIzMThDMzIuNjU1NCA2NC42Mzc2IDMxLjMxNTMgNjQuNjQgMjguMjM4OCA2NS4yNDE4QzI3LjMzOTcgNjUuNDE3NyAyNi45MzQzIDY1LjI3NTcgMjUuODkzMiA2NC40MTc4QzI1LjEwNTEgNjMuNzY4NCAyNC43MjQxIDYzLjU0MjYgMjQuMzMzOCA2My41OTU4Wk0zMS43MTY2IDgzLjI1OThDMzEuNjYwNSA4My4yNzQ5IDMxLjU5MjEgODMuMzEyNiAzMS41MTE1IDgzLjM3MjFDMzEuMjcwOSA4My41NSAzMC42NTM2IDgzLjc5IDMwLjEzNzkgODMuOTA1NEMyOS4zODc2IDg0LjA3MzQgMjkuMDQ5OCA4NC40OTMyIDI4LjQ0ODIgODYuMDA0NUMyOC4wMzQ3IDg3LjA0MzIgMjcuNDkxNSA4OC4xMTUzIDI3LjI0MTIgODguMzg2M0MyNi45OTA5IDg4LjY1NzMgMjYuNDc1IDg5LjU1MSAyNi4wOTQxIDkwLjM3MzJDMjQuOTQyMiA5Mi44NTkyIDIzLjUyODIgOTQuMDYxOCAxOS45MDExIDk1LjY0MjFDMTYuNjEwNyA5Ny4wNzU2IDE2LjU2NyA5Ny4xMDg2IDE1LjY2NzEgOTguOTgwMkMxNS4xMDI3IDEwMC4xNTQgMTQuNjc5MiAxMDEuNzU3IDE0LjU0OTkgMTAzLjIwNUMxNC4yNzMxIDEwNi4zMDIgMTMuNTk2MiAxMDcuMDMxIDkuNTIxMTggMTA4LjYxNkM1LjkxNDk3IDExMC4wMTkgMy41NzcwMiAxMTEuNzQ1IDMuNDE1ODMgMTEzLjEyM0MzLjI0MDQxIDExNC42MjMgMi41OTgxMyAxMTUuMDg0IDAuOTI5MjYgMTE0LjkwN0MwLjUzOTUyOSAxMTQuODY2IDAuMjQ0MzMyIDExNC44NTEgMCAxMTQuODgxVjEyMUMxLjAyNjU4IDExOS42NTggMi43MTkyMiAxMTguMzYxIDYuMjI0OTcgMTE2LjIwNkMxMC4zNjA0IDExMy42NjUgMTIuNzA2NSAxMTEuNTc1IDEzLjU3NzkgMTA5LjY1NEMxMy45MjYgMTA4Ljg4NyAxNC42NTQ3IDEwNy4zOTMgMTUuMTk3MSAxMDYuMzM0QzE1LjczOTUgMTA1LjI3NSAxNi4yODQ1IDEwMy45MDEgMTYuNDA4NCAxMDMuMjgxQzE2LjczMjQgMTAxLjY2IDE4LjMwMzIgMTAwLjM0OSAyMC42NjU5IDk5LjcyNkMyNS4xNzcgOTguNTM3MiAyNS43NDYxIDk4LjAxNjMgMjYuMzUyNSA5NC41MzU0QzI2Ljg1NjEgOTEuNjQ1MiAyOC42MTIgODguMDY2MSAzMC41MjY3IDg2LjAyNDZDMzEuMzA5NSA4NS4xOSAzMS45NDk1IDg0LjE4IDMxLjk0OTUgODMuNzc5MUMzMS45NDk1IDgzLjM3NjYgMzEuODg0OSA4My4yMTQ2IDMxLjcxNjYgODMuMjU5OFoiIGZpbGw9IiMzNTkxMzYiLz4KPHBhdGggZD0iTTguMDgxNzcgNzQuNDA4M0M2LjAzNDE5IDczLjg3MDUgNS44OTQ0MyA3My43MzAyIDYuMDQyNzEgNzIuMzYxNUM2LjEzMDI1IDcxLjU1MzMgNi4yNDAxNyA3MC44NTc1IDYuMjg2OTYgNzAuODE1NEM2LjMzMzc2IDcwLjc3MzMgNy43MDQ0MyA3MS4wNjg3IDkuMzMyOTIgNzEuNDcxOUMxMS45NzY4IDcyLjEyNjQgMTIuNDg2NiA3Mi4xMjM4IDE0LjA5NDcgNzEuNDQ3NEMxNi40MDQxIDcwLjQ3NiAxNy4yMzgzIDY4Ljc3NTMgMTYuNDAyMiA2Ni43NDMxQzE1Ljk0MjQgNjUuNjI1NyAxNC45MjA0IDY0LjgyODEgMTIuMjM4NCA2My40OTRDNy42NDE3IDYxLjIwNzUgNi41MzA2MiA1OS45OTkgNi4yNzQ2NSA1Ny4wMDc2QzUuODkzMzcgNTIuNTUxOSA4Ljg0Njg5IDQ5Ljk4MzYgMTQuMzUyMiA0OS45ODM2QzE1Ljk3MzMgNDkuOTgzNiAxNy44NDg3IDUwLjE5MzcgMTguNTE5NiA1MC40NTA1QzE5LjYzNjggNTAuODc4MSAxOS42OTM3IDUxLjAzOTkgMTkuMTk0NSA1Mi4zNzEyQzE4LjcxODIgNTMuNjQxNiAxOC41MDI3IDUzLjc2ODggMTcuNDg2MSA1My4zNzk2QzE1LjUxOTkgNTIuNjI3IDEyLjE5NDggNTIuODU1NCAxMS4wMDU4IDUzLjgyNDdDOS43OTA1OCA1NC44MTUzIDkuNTU3MzYgNTYuOTI1MiAxMC41MzI0IDU4LjEwNzlDMTAuODcyNyA1OC41MjA3IDEyLjkwODcgNTkuNzc5IDE1LjA1NjkgNjAuOTA0MUMxOC40NjI4IDYyLjY4ODEgMTkuMDgyIDYzLjIyMTQgMTkuODk1MSA2NS4wNzE5QzIxLjExNTIgNjcuODQ4NyAyMC42Nzg4IDcwLjM0MzcgMTguNjA3OCA3Mi40MzIzQzE2LjE2MDcgNzQuOTAwMiAxMi41NDEzIDc1LjU3OTYgOC4wODE3NyA3NC40MDgzWk0yOC45MzI4IDc0LjM4MjNDMjUuMjM2NSA3Mi45OTU4IDIzLjcxMzggNzAuNTQwNSAyMy43MTM4IDY1Ljk2NjdDMjMuNzEzOCA2Mi41MDM0IDI0LjU1ODggNjAuNDY5NyAyNi44MzMzIDU4LjQ1OTNDMjguMzk2NCA1Ny4wNzc2IDI4Ljk4NjcgNTYuODY4NiAzMS4zMjY4IDU2Ljg2ODZDMzIuODE2OCA1Ni44Njg2IDM0LjY4MjEgNTcuMjEyOSAzNS41MDA1IDU3LjYzODlDMzcuMzE2OSA1OC41ODQ2IDM4LjgzMTkgNjEuNzQyNiAzOC44NDY2IDY0LjYxNDNMMzguODU3MyA2Ni43MDQ0SDMyLjk0MjNIMjcuMDI3M0wyNy4zNDIgNjguMDU2OUMyNy41MTUgNjguODAwNyAyOC4zMzU0IDcwLjAzOTEgMjkuMTY1IDcwLjgwOUMzMC41NzczIDcyLjExOTYgMzAuODk0OSA3Mi4xOTc5IDM0LjE1NDcgNzIuMDM4NUMzNy4zOTM4IDcxLjg4MDEgMzcuNjQ2MyA3MS45NDA5IDM3Ljc4NCA3Mi45MTIyQzM3Ljk2MjYgNzQuMTcyNSAzNy4xODgyIDc0LjUyMzYgMzMuNTI0MiA3NC44NDM0QzMxLjgwODUgNzQuOTkzMiAzMC4xMDU2IDc0LjgyMjIgMjguOTMyOCA3NC4zODIzWk0zNS4wODgxIDYyLjUyNDJDMzQuOTU1OCA2MC42NzMgMzMuMzY0NCA1OS4zMjc2IDMxLjMwNzIgNTkuMzI3NkMyOS43MDg2IDU5LjMyNzYgMjguNzI4MSA2MC4wOTA5IDI3LjY2MiA2Mi4xNjU1QzI2Ljc0NTcgNjMuOTQ4NiAyNy40MTIgNjQuMjk2NSAzMS40NDg4IDY0LjE0MjVMMzUuMTkzNiA2My45OTk2TDM1LjA4ODEgNjIuNTI0MlpNNDQuMzkxNCA3NC4zNzA4QzQyLjU3MTEgNzMuNTQ2OCA0MS43MDU5IDcyLjEyODYgNDEuNjQyMSA2OS44NjQ3QzQxLjU0MTYgNjYuMjk0NCA0NC4xMTEgNjQuMTQ2OCA0OS4yNTc2IDYzLjQ5OTRDNTEuODQxNCA2My4xNzQ0IDUyLjA0OTUgNjMuMDU3NyA1MS43NTkzIDYyLjA5NjlDNTAuOTY1IDU5LjQ2NjYgNDguMjQyMyA1OC41NjQ0IDQ0LjkyNzYgNTkuODMzMUM0My40MzAzIDYwLjQwNjMgNDMuNDg2OCA2MC40MzEzIDQzLjA1MTQgNTkuMDAzMkM0Mi43ODAxIDU4LjExMzUgNDIuOTk4MiA1Ny44NTExIDQ0LjM5NSA1Ny4zODdDNDYuOTM2NCA1Ni41NDI3IDUxLjM3NDUgNTYuNjM0MiA1Mi43Nzc5IDU3LjU2QzU0LjkzOTIgNTguOTg1NyA1NS4zNzUxIDYwLjYwMTkgNTUuNTQ4NyA2Ny44MzI4TDU1LjcxMDYgNzQuNTc0NUw1NC4xMjMgNzQuNTc0QzUzLjAzNzcgNzQuNTczMyA1Mi41MzUzIDc0LjMzOTYgNTIuNTM1MyA3My44MzU0QzUyLjUzNTMgNzIuOTA2NiA1Mi4wNTI4IDcyLjkwMjQgNTAuNzUyIDczLjgxOTZDNDkuMjAxMyA3NC45MTMgNDYuMTY5NyA3NS4xNzU3IDQ0LjM5MTQgNzQuMzcwOFpNNTAuOTQ3NyA3MC44MTc1QzUxLjcwOTkgNjkuOTczNSA1Mi4wNDY4IDY4Ljk4NiA1Mi4wNDY4IDY3LjU5NjZWNjUuNTkyOUw0OS44MTgyIDY1Ljg0NThDNDUuNzE5IDY2LjMxMSA0My44NzQ5IDY5LjUxMTggNDYuNTA1OCA3MS41OTUzQzQ4LjAzNzEgNzIuODA3OSA0OS4zNTk0IDcyLjU3NjMgNTAuOTQ3NyA3MC44MTc1Wk05Mi4wMDIgNzQuNTc4OEM4OC40MDI0IDczLjQ4NjQgODYuMjQxOSA3MC4yNDY2IDg2LjI0MTkgNjUuOTQxQzg2LjI0MTkgNjAuNDA0MiA4OS41MjExIDU2LjgzMjUgOTQuNjQxIDU2Ljc5MjVDOTguNjk4OSA1Ni43NjA5IDEwMS4yNjMgNTkuNDY3OSAxMDEuNTAzIDY0LjAzNjZMMTAxLjYzIDY2LjQ1ODVMOTYuMjU2MiA2Ni41ODg1QzkzLjMwMDcgNjYuNjYgOTAuNjE1OCA2Ni44MTYgOTAuMjg5NyA2Ni45MzUxQzg5LjM4MTggNjcuMjY2OCA5MC40Nzg4IDY5Ljk0NyA5Mi4wMzA2IDcxLjE4ODZDOTMuMTU5OSA3Mi4wOTIxIDkzLjc3MSA3Mi4xOTEyIDk2LjgxNzggNzEuOTY1QzEwMC4xOTMgNzEuNzE0NCAxMDAuMzE4IDcxLjc0NDkgMTAwLjUzMSA3Mi44Njg0QzEwMC43MyA3My45MTMzIDEwMC41MDkgNzQuMDgzNSA5OC4zNTc5IDc0LjU0OEM5NS42MTAzIDc1LjE0MTIgOTMuODgyOSA3NS4xNDk2IDkyLjAwMiA3NC41Nzg4Wk05Ny45NjU5IDYzLjA4MjNDOTcuOTY1OSA2MS4xMjMxIDk2LjE4NTggNTkuMzI3NiA5NC4yNDM0IDU5LjMyNzZDOTIuMjQ5NCA1OS4zMjc2IDkwLjE0OTkgNjEuMjU2MiA5MC4xNDk5IDYzLjA4NzhDOTAuMTQ5OSA2NC4yMDcgOTAuMjc5NyA2NC4yNDU1IDk0LjA1NzkgNjQuMjQ1NUM5Ny44NDE0IDY0LjI0NTUgOTcuOTY1OSA2NC4yMDg0IDk3Ljk2NTkgNjMuMDgyM1pNMTEwLjA0MiA3NC40N0MxMDYuMTQ5IDczLjQzIDEwMy45MyA2OS40MDI5IDEwNC41NCA2NC40ODYyQzEwNS4xNjYgNTkuNDQ0MiAxMDcuOTUxIDU2Ljg3MzYgMTEyLjc5MiA1Ni44NzA1QzExNS4zNzQgNTYuODY5IDExNS44MDUgNTcuMDI0OSAxMTcuMjYgNTguNDlDMTE4Ljg3OCA2MC4xMTg1IDExOS45NDEgNjIuODM0MyAxMTkuOTQ2IDY1LjM1MkwxMTkuOTQ5IDY2LjcwNDRIMTE0LjA4N0MxMDguNDg4IDY2LjcwNDQgMTA4LjIyNSA2Ni43NTAxIDEwOC4yMjUgNjcuNzIwM0MxMDguMjI1IDcwLjcxMjIgMTEwLjk1MiA3Mi4zNDQyIDExNS4zNTcgNzEuOTg4MkMxMTguMTM2IDcxLjc2MzcgMTE4LjQyMyA3MS44MzE1IDExOC42NjcgNzIuNzY3NEMxMTguOTk4IDc0LjA0NDMgMTE4Ljk2OCA3NC4wNzIgMTE2LjY5IDc0LjYwNDNDMTE0LjM2NyA3NS4xNDcgMTEyLjQzIDc1LjEwNzggMTEwLjA0MiA3NC40N1pNMTE2LjExOSA2Mi43NzAxQzExNS44NjQgNjAuODc4NyAxMTQuMTU5IDU5LjMyNzYgMTEyLjMzNSA1OS4zMjc2QzExMC41NjYgNTkuMzI3NiAxMDguMjI0IDYxLjYwMTQgMTA4LjIyNCA2My4zMTk1QzEwOC4yMjQgNjQuMjEyOCAxMDguNTI3IDY0LjI3NDYgMTEyLjI1NSA2NC4xNDI0QzExNi4yNDEgNjQuMDAxMSAxMTYuMjgzIDYzLjk4NjIgMTE2LjExOSA2Mi43NzAxWk0xMjYuODk0IDc0LjI0N0MxMjQuODI2IDczLjIyMDggMTIzLjUzMiA3MS4zNTg5IDEyMi44OTQgNjguNDg4OUMxMjEuOTc1IDY0LjM2MDUgMTIzLjA3NCA2MC40OTE0IDEyNS44MyA1OC4xNTY3QzEyNy44MjcgNTYuNDY1NyAxMzEuODM4IDU2LjMzMDUgMTMzLjgwNSA1Ny44ODc5TDEzNS4wOTIgNTguOTA3MlY1My45NTM2VjQ5SDEzNy4wNDZIMTM5VjYxLjc4NjVWNzQuNTczMUgxMzcuMjlDMTM1Ljc2MiA3NC41NzMxIDEzNS41OCA3NC40MzMxIDEzNS41OCA3My4yNTc5VjcxLjk0MjdMMTM0LjQ4MSA3Mi45NzkyQzEzMi4yMzMgNzUuMDk5OCAxMjkuNTI1IDc1LjU1MjMgMTI2Ljg5NCA3NC4yNDdaTTEzMy42NjQgNzAuNjc2NkMxMzQuOTc2IDY5LjM1NTcgMTM1LjA5MiA2OC45NTM3IDEzNS4wOTIgNjUuNzIwOUMxMzUuMDkyIDYyLjQ1NzIgMTM0Ljk4NSA2Mi4wOTQ1IDEzMy42MDcgNjAuNzA3NkMxMzIuMzY1IDU5LjQ1NzUgMTMxLjg2NSA1OS4yNjIyIDEzMC41NTQgNTkuNTE1NEMxMjYuMTQ0IDYwLjM2NzIgMTI0LjgzNSA2OC4xNDIzIDEyOC41OTggNzEuMTIyOUMxMzAuMzQ4IDcyLjUwODEgMTMxLjk4OCA3Mi4zNjM1IDEzMy42NjQgNzAuNjc2NlpNNjEuNDEwNyA2Ni4wNTg0QzYwLjAyMiA2MS4zNzU0IDU4Ljg4NTkgNTcuMzkxOSA1OC44ODU5IDU3LjIwNjJDNTguODg1OSA1Ny4wMjA2IDU5LjcyNzQgNTYuODY4NiA2MC43NTU5IDU2Ljg2ODZINjIuNjI1OUw2NC4yNTUxIDYzLjg3NjZDNjUuMTUxMiA2Ny43MzEgNjUuOTU2IDcwLjY2MzMgNjYuMDQzNyA3MC4zOTI5QzY2LjEzMTMgNzAuMTIyNCA2Ny4wNTU3IDY3LjAyNDEgNjguMDk3OCA2My41MDc4TDY5Ljk5MjYgNTcuMTE0NUg3MS41OTY5SDczLjIwMTJMNzQuODg2NSA2My4yNjE5Qzc1LjgxMzQgNjYuNjQzIDc2LjY4MzIgNjkuNzQxMiA3Ni44MTk0IDcwLjE0N0M3Ni45NTU3IDcwLjU1MjcgNzcuODQxOSA2Ny43MzEgNzguNzg5IDYzLjg3NjZMODAuNTEwOSA1Ni44Njg2SDgyLjQ1MTdDODMuOTUxNyA1Ni44Njg2IDg0LjMzMDMgNTcuMDMxNiA4NC4xMTkgNTcuNTg2QzgzLjk2ODYgNTcuOTgwNiA4Mi42OTU2IDYxLjk2NDEgODEuMjkwMiA2Ni40MzgyTDc4LjczNDkgNzQuNTczMUg3Ni45NjM1SDc1LjE5MjFMNzMuNTgxMiA2OC43OTQ1QzcyLjY5NTIgNjUuNjE2MyA3MS44NTg1IDYyLjY4NDEgNzEuNzIxNyA2Mi4yNzgzQzcxLjQ0NjUgNjEuNDYxNiA3MS41OTExIDYxLjA3MzMgNjkuMTExNCA2OS4yODYzTDY3LjUxNTIgNzQuNTczMUg2NS43MjU0SDYzLjkzNTZMNjEuNDEwNyA2Ni4wNTg0WiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZD0iTTE5Ljk3NDYgMTE5LjI3NEMxOS4wMTU4IDExOC4xMTkgMjAuMzM4MSAxMTYuMTY2IDIxLjU2MDQgMTE2LjkzMkMyMi43NjMyIDExNy42ODYgMjIuMzMwNSAxMTkuNzYxIDIwLjk3MDQgMTE5Ljc2MUMyMC42NDUgMTE5Ljc2MSAyMC4xOTY5IDExOS41NDIgMTkuOTc0NiAxMTkuMjc0WiIgZmlsbD0idXJsKCNwYWludDNfcmFkaWFsXzY3OV8xOTEwKSIvPgo8cGF0aCBkPSJNMjMuODM2IDExMi42M0MyMi4xMTUyIDExMS42ODkgMjEuODAyOSAxMDkuNzk3IDIzLjE0NjUgMTA4LjQ1M0MyNC4wODU3IDEwNy41MTQgMjUuMjEgMTA3LjM5NCAyNi4yNTA3IDEwOC4xMjNDMjcuODU3MSAxMDkuMjQ5IDI3LjQ2NTUgMTEyLjAxMyAyNS42MDc5IDExMi42NkMyNS42MDc5IDExMi42NiAyNC40NzQ1IDExMi45NzMgMjMuODM2IDExMi42M1oiIGZpbGw9InVybCgjcGFpbnQ0X3JhZGlhbF82NzlfMTkxMCkiLz4KPHBhdGggZD0iTTMzLjc4NTUgMTIwLjAzNkMzMy43ODU1IDEyMC4xODggMzMuNzU1NyAxMjAuMzM4IDMzLjY5NzYgMTIwLjQ3OUMzMy42Mzk1IDEyMC42MTkgMzMuNTU0NCAxMjAuNzQ2IDMzLjQ0NzEgMTIwLjg1M0MzMy4zMzk4IDEyMC45NjEgMzMuMjEyNCAxMjEuMDQ2IDMzLjA3MjMgMTIxLjEwNEMzMi45MzIxIDEyMS4xNjIgMzIuNzgxOCAxMjEuMTkyIDMyLjYzMDEgMTIxLjE5MkMzMi40NzgzIDEyMS4xOTIgMzIuMzI4MSAxMjEuMTYyIDMyLjE4NzkgMTIxLjEwNEMzMi4wNDc3IDEyMS4wNDYgMzEuOTIwMyAxMjAuOTYxIDMxLjgxMyAxMjAuODUzQzMxLjcwNTcgMTIwLjc0NiAzMS42MjA2IDEyMC42MTkgMzEuNTYyNiAxMjAuNDc5QzMxLjUwNDUgMTIwLjMzOCAzMS40NzQ2IDEyMC4xODggMzEuNDc0NiAxMjAuMDM2QzMxLjQ3NDYgMTE5LjczIDMxLjU5NjMgMTE5LjQzNiAzMS44MTMgMTE5LjIxOUMzMi4wMjk3IDExOS4wMDMgMzIuMzIzNiAxMTguODgxIDMyLjYzMDEgMTE4Ljg4MUMzMi45MzY1IDExOC44ODEgMzMuMjMwNCAxMTkuMDAzIDMzLjQ0NzEgMTE5LjIxOUMzMy42NjM4IDExOS40MzYgMzMuNzg1NSAxMTkuNzMgMzMuNzg1NSAxMjAuMDM2WiIgZmlsbD0iYmxhY2siLz4KPHBhdGggZD0iTTEyMC43MjEgMTE4LjI3NkMxMjAuNzIxIDExOC42MjMgMTIwLjU2NSAxMTguOTU2IDEyMC4yODcgMTE5LjIwMUMxMjAuMDA5IDExOS40NDYgMTE5LjYzMiAxMTkuNTg0IDExOS4yMzkgMTE5LjU4NEMxMTguODQ2IDExOS41ODQgMTE4LjQ2OSAxMTkuNDQ2IDExOC4xOTEgMTE5LjIwMUMxMTcuOTEzIDExOC45NTYgMTE3Ljc1NyAxMTguNjIzIDExNy43NTcgMTE4LjI3NkMxMTcuNzU3IDExOC4xMDUgMTE3Ljc5NSAxMTcuOTM1IDExNy44NyAxMTcuNzc2QzExNy45NDQgMTE3LjYxNyAxMTguMDUzIDExNy40NzMgMTE4LjE5MSAxMTcuMzUyQzExOC4zMjkgMTE3LjIzIDExOC40OTIgMTE3LjEzNCAxMTguNjcyIDExNy4wNjhDMTE4Ljg1MSAxMTcuMDAzIDExOS4wNDQgMTE2Ljk2OSAxMTkuMjM5IDExNi45NjlDMTE5LjQzMyAxMTYuOTY5IDExOS42MjYgMTE3LjAwMyAxMTkuODA2IDExNy4wNjhDMTE5Ljk4NiAxMTcuMTM0IDEyMC4xNDkgMTE3LjIzIDEyMC4yODcgMTE3LjM1MkMxMjAuNDI0IDExNy40NzMgMTIwLjUzMyAxMTcuNjE3IDEyMC42MDggMTE3Ljc3NkMxMjAuNjgyIDExNy45MzUgMTIwLjcyMSAxMTguMTA1IDEyMC43MjEgMTE4LjI3NloiIGZpbGw9IiM1OTY4NkYiLz4KPGRlZnM+CjxsaW5lYXJHcmFkaWVudCBpZD0icGFpbnQwX2xpbmVhcl82NzlfMTkxMCIgeDE9IjExIiB5MT0iLTQuNzc3NjhlLTA3IiB4Mj0iMTY0LjUiIHkyPSIxNTAuNSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPgo8c3RvcCBzdG9wLWNvbG9yPSIjNjRCN0ZGIi8+CjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iIzAwNURBRCIvPgo8L2xpbmVhckdyYWRpZW50Pgo8cmFkaWFsR3JhZGllbnQgaWQ9InBhaW50MV9yYWRpYWxfNjc5XzE5MTAiIGN4PSIwIiBjeT0iMCIgcj0iMSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiIGdyYWRpZW50VHJhbnNmb3JtPSJ0cmFuc2xhdGUoMTI0LjkwNCAxMjguNjM2KSByb3RhdGUoLTAuMDQ4NTUyKSBzY2FsZSgzNi4yODAyIDMxLjQwMzIpIj4KPHN0b3Agc3RvcC1jb2xvcj0iIzExNzdDRSIvPgo8c3RvcCBvZmZzZXQ9IjEiIHN0b3AtY29sb3I9IiM3RUM3RkYiIHN0b3Atb3BhY2l0eT0iMCIvPgo8L3JhZGlhbEdyYWRpZW50Pgo8cmFkaWFsR3JhZGllbnQgaWQ9InBhaW50Ml9yYWRpYWxfNjc5XzE5MTAiIGN4PSIwIiBjeT0iMCIgcj0iMSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiIGdyYWRpZW50VHJhbnNmb3JtPSJ0cmFuc2xhdGUoMzkuMzUxMiAxMjEuNDYpIHJvdGF0ZSgtMC4wNTczKSBzY2FsZSg1MC4yMjc2IDUxLjMwOTEpIj4KPHN0b3Agc3RvcC1jb2xvcj0iIzExNzdDRSIvPgo8c3RvcCBvZmZzZXQ9IjEiIHN0b3AtY29sb3I9IiM3RUM3RkYiIHN0b3Atb3BhY2l0eT0iMCIvPgo8L3JhZGlhbEdyYWRpZW50Pgo8cmFkaWFsR3JhZGllbnQgaWQ9InBhaW50M19yYWRpYWxfNjc5XzE5MTAiIGN4PSIwIiBjeT0iMCIgcj0iMSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiIGdyYWRpZW50VHJhbnNmb3JtPSJ0cmFuc2xhdGUoMjAuOTU0OCAxMTguMjYpIHNjYWxlKDEuMzA5MjkgMS41MDEyNykiPgo8c3RvcCBzdG9wLWNvbG9yPSIjODhBM0QwIi8+CjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iIzVEODNCRiIvPgo8L3JhZGlhbEdyYWRpZW50Pgo8cmFkaWFsR3JhZGllbnQgaWQ9InBhaW50NF9yYWRpYWxfNjc5XzE5MTAiIGN4PSIwIiBjeT0iMCIgcj0iMSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiIGdyYWRpZW50VHJhbnNmb3JtPSJ0cmFuc2xhdGUoMjQuNzg0MyAxMTAuMjIxKSBzY2FsZSgyLjQ3Mjc3IDIuNTY5NTQpIj4KPHN0b3Agc3RvcC1jb2xvcj0iIzg4QTNEMCIvPgo8c3RvcCBvZmZzZXQ9IjEiIHN0b3AtY29sb3I9IiM1RDgzQkYiLz4KPC9yYWRpYWxHcmFkaWVudD4KPC9kZWZzPgo8L3N2Zz4K
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "host"], ["spec", "topology"], ["spec", "replicationFactor"], ["spec", "db"], ["spec", "db", "replicas"], ["spec", "db", "size"], ["spec", "db", "storageClass"], ["spec", "db", "resources"], ["spec", "db", "resourcesPreset"], ["spec", "master"], ["spec", "master", "replicas"], ["spec", "master", "resources"], ["spec", "master", "resourcesPreset"], ["spec", "filer"], ["spec", "filer", "replicas"], ["spec", "filer", "resources"], ["spec", "filer", "resourcesPreset"], ["spec", "filer", "grpcHost"], ["spec", "filer", "grpcPort"], ["spec", "filer", "whitelist"], ["spec", "volume"], ["spec", "volume", "replicas"], ["spec", "volume", "size"], ["spec", "volume", "storageClass"], ["spec", "volume", "diskType"], ["spec", "volume", "resources"], ["spec", "volume", "resourcesPreset"], ["spec", "volume", "zones"], ["spec", "storagePools"], ["spec", "s3"], ["spec", "s3", "replicas"], ["spec", "s3", "resources"], ["spec", "s3", "resourcesPreset"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "host"], ["spec", "topology"], ["spec", "replicationFactor"], ["spec", "db"], ["spec", "db", "replicas"], ["spec", "db", "size"], ["spec", "db", "storageClass"], ["spec", "db", "resources"], ["spec", "db", "resourcesPreset"], ["spec", "master"], ["spec", "master", "replicas"], ["spec", "master", "resources"], ["spec", "master", "resourcesPreset"], ["spec", "filer"], ["spec", "filer", "replicas"], ["spec", "filer", "resources"], ["spec", "filer", "resourcesPreset"], ["spec", "filer", "grpcHost"], ["spec", "filer", "grpcPort"], ["spec", "filer", "whitelist"], ["spec", "volume"], ["spec", "volume", "replicas"], ["spec", "volume", "size"], ["spec", "volume", "storageClass"], ["spec", "volume", "diskType"], ["spec", "volume", "resources"], ["spec", "volume", "resourcesPreset"], ["spec", "volume", "zones"], ["spec", "volume", "pools"], ["spec", "s3"], ["spec", "s3", "replicas"], ["spec", "s3", "resources"], ["spec", "s3", "resourcesPreset"]]
   secrets:
     exclude: []
     include: []

From f0e8e110429b9cb8e76be636e36b6f318f63414e Mon Sep 17 00:00:00 2001
From: Andrey Kolkov <androndo@gmail.com>
Date: Wed, 25 Feb 2026 21:21:41 +0400
Subject: [PATCH 180/666] fix(dashboard): added dropdown for backupClasses

Signed-off-by: Andrey Kolkov <androndo@gmail.com>
---
 .../controller/dashboard/static_refactored.go | 50 +++++++++++--------
 packages/system/dashboard/templates/rbac.yaml |  8 +++
 2 files changed, 38 insertions(+), 20 deletions(-)

diff --git a/internal/controller/dashboard/static_refactored.go b/internal/controller/dashboard/static_refactored.go
index 3974c105..b025509d 100644
--- a/internal/controller/dashboard/static_refactored.go
+++ b/internal/controller/dashboard/static_refactored.go
@@ -503,18 +503,12 @@ func CreateAllCustomFormsOverrides() []*dashboardv1alpha1.CustomFormsOverride {
 				createFormItem("metadata.namespace", "Namespace", "text"),
 				createFormItem("spec.applicationRef.kind", "Application Kind", "text"),
 				createFormItem("spec.applicationRef.name", "Application Name", "text"),
-				createFormItemWithAPI("spec.backupClassName", "Backup Class", "select", map[string]any{
-					"api": map[string]any{
-						"fetchUrl":       "/api/clusters/{cluster}/k8s/apis/backups.cozystack.io/v1alpha1/backupclasses",
-						"pathToItems":    []any{"items"},
-						"pathToValue":    []any{"metadata", "name"},
-						"pathToLabel":    []any{"metadata", "name"},
-						"clusterNameVar": "clusterName",
-					},
-				}),
 				createFormItem("spec.schedule.type", "Schedule Type", "text"),
 				createFormItem("spec.schedule.cron", "Schedule Cron", "text"),
 			},
+			"schema": createSchema(map[string]any{
+				"backupClassName": listInputScemaItemBackupClass(),
+			}),
 		}),
 
 		// BackupJobs form override - backups.cozystack.io/v1alpha1
@@ -526,16 +520,10 @@ func CreateAllCustomFormsOverrides() []*dashboardv1alpha1.CustomFormsOverride {
 				createFormItem("spec.applicationRef.apiGroup", "Application API Group", "text"),
 				createFormItem("spec.applicationRef.kind", "Application Kind", "text"),
 				createFormItem("spec.applicationRef.name", "Application Name", "text"),
-				createFormItemWithAPI("spec.backupClassName", "Backup Class", "select", map[string]any{
-					"api": map[string]any{
-						"fetchUrl":       "/api/clusters/{cluster}/k8s/apis/backups.cozystack.io/v1alpha1/backupclasses",
-						"pathToItems":    []any{"items"},
-						"pathToValue":    []any{"metadata", "name"},
-						"pathToLabel":    []any{"metadata", "name"},
-						"clusterNameVar": "clusterName",
-					},
-				}),
 			},
+			"schema": createSchema(map[string]any{
+				"backupClassName": listInputScemaItemBackupClass(),
+			}),
 		}),
 	}
 }
@@ -2063,9 +2051,9 @@ func createCustomFormsOverride(customizationId string, spec map[string]any) *das
 		"strategy":        "merge",
 	}
 
-	// Merge caller-provided fields (like formItems) into newSpec
+	// Merge into newSpec caller-provided fields without: customizationId, hidden, strategy
 	for key, value := range spec {
-		if key != "customizationId" && key != "hidden" && key != "schema" && key != "strategy" {
+		if key != "customizationId" && key != "hidden" && key != "strategy" {
 			newSpec[key] = value
 		}
 	}
@@ -2110,6 +2098,28 @@ func createNavigation(name string, spec map[string]any) *dashboardv1alpha1.Navig
 	}
 }
 
+func listInputScemaItemBackupClass() map[string]any {
+	return map[string]any{
+		"type": "listInput",
+		"customProps": map[string]any{
+			"valueUri":    "/api/clusters/{cluster}/k8s/apis/backups.cozystack.io/v1alpha1/backupclasses",
+			"keysToValue": []any{"metadata", "name"},
+			"keysToLabel": []any{"metadata", "name"},
+		},
+	}
+}
+
+// backupClassSchema returns the schema for spec.backupClassName as listInput (BackupJob/Plan).
+func createSchema(customProps map[string]any) map[string]any {
+	return map[string]any{
+		"properties": map[string]any{
+			"spec": map[string]any{
+				"properties": customProps,
+			},
+		},
+	}
+}
+
 // createFormItem creates a form item for CustomFormsOverride
 func createFormItem(path, label, fieldType string) map[string]any {
 	return map[string]any{
diff --git a/packages/system/dashboard/templates/rbac.yaml b/packages/system/dashboard/templates/rbac.yaml
index b738595c..6dcb5da5 100644
--- a/packages/system/dashboard/templates/rbac.yaml
+++ b/packages/system/dashboard/templates/rbac.yaml
@@ -12,6 +12,14 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - backups.cozystack.io
+  resources:
+  - backupclasses
+  verbs:
+  - get
+  - list
+  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

From fd6d0c36032838bd29e5533f47cd76f9b175df20 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Fri, 27 Feb 2026 12:41:40 +0500
Subject: [PATCH 181/666] (ci) Added extra debug commands for k8s startup

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 hack/e2e-apps/run-kubernetes.sh | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index f195f3ea..dbdebd5e 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -102,15 +102,19 @@ EOF
     done
   '
   # Verify the nodes are ready
-  kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait node --all --timeout=2m --for=condition=Ready
+  if ! kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait node --all --timeout=2m --for=condition=Ready; then
+    # Additional debug messages
+    kubectl --kubeconfig "tenantkubeconfig-${test_name}" describe nodes
+    kubectl -n tenant-test get hr
+  fi
   kubectl --kubeconfig "tenantkubeconfig-${test_name}" get nodes -o wide
 
   # Verify the kubelet version matches what we expect
   versions=$(kubectl --kubeconfig "tenantkubeconfig-${test_name}" \
     get nodes -o jsonpath='{.items[*].status.nodeInfo.kubeletVersion}')
-  
+
   node_ok=true
-  
+
   for v in $versions; do
     case "$v" in
       "${k8s_version}" | "${k8s_version}".* | "${k8s_version}"-*)
@@ -193,7 +197,7 @@ EOF
 
   # Wait for pods readiness
   kubectl wait deployment --kubeconfig "tenantkubeconfig-${test_name}" "${test_name}-backend" -n tenant-test --for=condition=Available --timeout=300s
-  
+
   # Wait for LoadBalancer to be provisioned (IP or hostname)
   timeout 90 sh -ec "
     until kubectl get svc ${test_name}-backend --kubeconfig tenantkubeconfig-${test_name} -n tenant-test \

From 3bf43312aa3b989332ac5275b1e77b11bd0f649a Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Fri, 27 Feb 2026 12:43:00 +0500
Subject: [PATCH 182/666] (ci) Removed cozytest output trimming in non-tty run

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 hack/cozytest.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hack/cozytest.sh b/hack/cozytest.sh
index ff476e08..363a4d9f 100755
--- a/hack/cozytest.sh
+++ b/hack/cozytest.sh
@@ -10,7 +10,11 @@ PATTERN=${2:-*}
 LINE='----------------------------------------------------------------'
 
 cols() { stty size 2>/dev/null | awk '{print $2}' || echo 80; }
-MAXW=$(( $(cols) - 12 )); [ "$MAXW" -lt 40 ] && MAXW=70
+if [ -t 1 ]; then
+  MAXW=$(( $(cols) - 12 )); [ "$MAXW" -lt 40 ] && MAXW=70
+else
+  MAXW=0  # no truncation when not a tty (e.g. CI)
+fi
 BEGIN=$(date +%s)
 timestamp() { s=$(( $(date +%s) - BEGIN )); printf '[%02d:%02d]' $((s/60)) $((s%60)); }
 
@@ -45,7 +49,7 @@ run_one() {
           *)       out=$line ;;
         esac
         now=$(( $(date +%s) - START ))
-        [ ${#out} -gt "$MAXW" ] && out="$(printf '%.*s…' "$MAXW" "$out")"
+        [ "$MAXW" -gt 0 ] && [ ${#out} -gt "$MAXW" ] && out="$(printf '%.*s…' "$MAXW" "$out")"
         printf '┊[%02d:%02d] %s\n' $((now/60)) $((now%60)) "$out"
   done
 

From 47d81f70d7f9fcf012741e46072bf2fb8796e60e Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Fri, 27 Feb 2026 14:02:42 +0500
Subject: [PATCH 183/666] Disabled private key rotation in CA certs

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/extra/etcd/templates/etcd-cluster.yaml                 | 2 ++
 packages/system/cozystack-api/templates/certmanager.yaml        | 2 ++
 .../templates/admission-webhooks/cert-manager.yaml              | 2 ++
 packages/system/kubeovn-webhook/templates/certmanager.yaml      | 2 ++
 .../lineage-controller-webhook/templates/certmanager.yaml       | 2 ++
 .../charts/linstor-scheduler/templates/certmanager.yaml         | 2 ++
 packages/system/linstor/templates/linstor-api-tls.yaml          | 2 ++
 packages/system/linstor/templates/linstor-internal-tls.yaml     | 2 ++
 .../seaweedfs/charts/seaweedfs/templates/cert/ca-cert.yaml      | 2 ++
 .../charts/victoria-metrics-operator/templates/webhook.yaml     | 2 ++
 10 files changed, 20 insertions(+)

diff --git a/packages/extra/etcd/templates/etcd-cluster.yaml b/packages/extra/etcd/templates/etcd-cluster.yaml
index 44851cc6..a604b448 100644
--- a/packages/extra/etcd/templates/etcd-cluster.yaml
+++ b/packages/extra/etcd/templates/etcd-cluster.yaml
@@ -104,6 +104,7 @@ spec:
       - {{ .Release.Name }}
   secretName: etcd-peer-ca-tls
   privateKey:
+    rotationPolicy: Never
     algorithm: RSA
     size: 4096
   issuerRef:
@@ -130,6 +131,7 @@ spec:
       - {{ .Release.Name }}
   secretName: etcd-ca-tls
   privateKey:
+    rotationPolicy: Never
     algorithm: RSA
     size: 4096
   issuerRef:
diff --git a/packages/system/cozystack-api/templates/certmanager.yaml b/packages/system/cozystack-api/templates/certmanager.yaml
index def27bd1..4f73768a 100644
--- a/packages/system/cozystack-api/templates/certmanager.yaml
+++ b/packages/system/cozystack-api/templates/certmanager.yaml
@@ -18,6 +18,8 @@ spec:
   issuerRef:
     name: cozystack-api-selfsigned
   isCA: true
+  privateKey:
+    rotationPolicy: Never
 ---
 apiVersion: cert-manager.io/v1
 kind: Issuer
diff --git a/packages/system/ingress-nginx/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml b/packages/system/ingress-nginx/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml
index db2946c3..fab1e02e 100644
--- a/packages/system/ingress-nginx/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml
+++ b/packages/system/ingress-nginx/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml
@@ -23,6 +23,8 @@ spec:
     name: {{ include "ingress-nginx.fullname" . }}-self-signed-issuer
   commonName: "ca.webhook.ingress-nginx"
   isCA: true
+  privateKey:
+    rotationPolicy: Never
   subject:
     organizations:
       - ingress-nginx
diff --git a/packages/system/kubeovn-webhook/templates/certmanager.yaml b/packages/system/kubeovn-webhook/templates/certmanager.yaml
index be0f5af1..f8eee740 100644
--- a/packages/system/kubeovn-webhook/templates/certmanager.yaml
+++ b/packages/system/kubeovn-webhook/templates/certmanager.yaml
@@ -18,6 +18,8 @@ spec:
   issuerRef:
     name: {{ include "namespace-annotation-webhook.fullname" . }}-selfsigned-issuer
   isCA: true
+  privateKey:
+    rotationPolicy: Never
 ---
 apiVersion: cert-manager.io/v1
 kind: Issuer
diff --git a/packages/system/lineage-controller-webhook/templates/certmanager.yaml b/packages/system/lineage-controller-webhook/templates/certmanager.yaml
index c2dc18d2..11b7f21a 100644
--- a/packages/system/lineage-controller-webhook/templates/certmanager.yaml
+++ b/packages/system/lineage-controller-webhook/templates/certmanager.yaml
@@ -18,6 +18,8 @@ spec:
   issuerRef:
     name: lineage-controller-webhook-selfsigned
   isCA: true
+  privateKey:
+    rotationPolicy: Never
 ---
 apiVersion: cert-manager.io/v1
 kind: Issuer
diff --git a/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/certmanager.yaml b/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/certmanager.yaml
index 3942555b..760a9d5d 100644
--- a/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/certmanager.yaml
+++ b/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/certmanager.yaml
@@ -24,6 +24,8 @@ spec:
   issuerRef:
     name: {{ include "linstor-scheduler.fullname" . }}-admission-selfsigned
   isCA: true
+  privateKey:
+    rotationPolicy: Never
 ---
 apiVersion: cert-manager.io/v1
 kind: Issuer
diff --git a/packages/system/linstor/templates/linstor-api-tls.yaml b/packages/system/linstor/templates/linstor-api-tls.yaml
index eeda9731..055e6d08 100644
--- a/packages/system/linstor/templates/linstor-api-tls.yaml
+++ b/packages/system/linstor/templates/linstor-api-tls.yaml
@@ -9,6 +9,8 @@ spec:
   secretName: linstor-api-ca
   duration: 87600h # 10 years
   isCA: true
+  privateKey:
+    rotationPolicy: Never
   usages:
     - signing
     - key encipherment
diff --git a/packages/system/linstor/templates/linstor-internal-tls.yaml b/packages/system/linstor/templates/linstor-internal-tls.yaml
index 5d536625..fe5ff4b1 100644
--- a/packages/system/linstor/templates/linstor-internal-tls.yaml
+++ b/packages/system/linstor/templates/linstor-internal-tls.yaml
@@ -9,6 +9,8 @@ spec:
   secretName: linstor-internal-ca
   duration: 87600h # 10 years
   isCA: true
+  privateKey:
+    rotationPolicy: Never
   usages:
     - signing
     - key encipherment
diff --git a/packages/system/seaweedfs/charts/seaweedfs/templates/cert/ca-cert.yaml b/packages/system/seaweedfs/charts/seaweedfs/templates/cert/ca-cert.yaml
index b01a8dcc..a38287de 100644
--- a/packages/system/seaweedfs/charts/seaweedfs/templates/cert/ca-cert.yaml
+++ b/packages/system/seaweedfs/charts/seaweedfs/templates/cert/ca-cert.yaml
@@ -13,6 +13,8 @@ spec:
   secretName: {{ template "seaweedfs.name" . }}-ca-cert
   commonName: "{{ template "seaweedfs.name" . }}-root-ca"
   isCA: true
+  privateKey:
+    rotationPolicy: Never
   {{- if .Values.certificates.ca.duration }}
   duration: {{ .Values.certificates.ca.duration }}
   {{- end }}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml
index 2e027ab4..1bead84d 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml
@@ -78,6 +78,8 @@ spec:
     name: {{ $fullname }}-root
   commonName: {{ $certManager.ca.commonName }}
   isCA: true
+  privateKey:
+    rotationPolicy: Never
 ---
 apiVersion: cert-manager.io/v1
 kind: Issuer

From 161b5be8c233e0198d196ecfb4a01ed0b8c4c2a2 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Sat, 28 Feb 2026 11:31:05 +0100
Subject: [PATCH 184/666] fix(dashboard): add FlowSchema to exempt BFF from API
 throttling

The dashboard BFF service account (incloud-web-web) falls under the
default "service-accounts" FlowSchema which maps to the "workload-low"
priority level. Under load, this causes API Priority and Fairness to
return 429 (Too Many Requests) responses to the BFF, resulting in 500
errors for dashboard users.

Add a FlowSchema that maps the BFF service account to the "exempt"
priority level to prevent APF throttling of dashboard API requests.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../dashboard/templates/flowschema.yaml       | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 packages/system/dashboard/templates/flowschema.yaml

diff --git a/packages/system/dashboard/templates/flowschema.yaml b/packages/system/dashboard/templates/flowschema.yaml
new file mode 100644
index 00000000..9304fb44
--- /dev/null
+++ b/packages/system/dashboard/templates/flowschema.yaml
@@ -0,0 +1,20 @@
+apiVersion: flowcontrol.apiserver.k8s.io/v1
+kind: FlowSchema
+metadata:
+  name: cozy-dashboard-exempt
+spec:
+  matchingPrecedence: 2
+  priorityLevelConfiguration:
+    name: exempt
+  rules:
+    - subjects:
+        - kind: ServiceAccount
+          serviceAccount:
+            name: incloud-web-web
+            namespace: {{ .Release.Namespace }}
+      resourceRules:
+        - verbs: ["*"]
+          apiGroups: ["*"]
+          resources: ["*"]
+          namespaces: ["*"]
+          clusterScope: true

From c83e41ea143dd8941ed0954f250511ae52448df7 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Sat, 28 Feb 2026 11:46:09 +0100
Subject: [PATCH 185/666] fix(installer): add keep annotation to Namespace and
 update migration script

Add helm.sh/resource-policy=keep annotation to the cozy-system Namespace
in the installer helm chart. This prevents Helm from deleting the
namespace when the HelmRelease is removed, which would otherwise destroy
all other HelmReleases within it.

Update the migration script to annotate the cozy-system namespace and
cozystack-version ConfigMap with helm.sh/resource-policy=keep before
generating the Package resource.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 hack/migrate-to-version-1.0.sh                | 24 +++++++++++++++++++
 .../templates/cozystack-operator.yaml         |  2 ++
 2 files changed, 26 insertions(+)

diff --git a/hack/migrate-to-version-1.0.sh b/hack/migrate-to-version-1.0.sh
index 7cc0cf73..bf648926 100755
--- a/hack/migrate-to-version-1.0.sh
+++ b/hack/migrate-to-version-1.0.sh
@@ -32,6 +32,30 @@ if ! kubectl get namespace "$NAMESPACE" &> /dev/null; then
     exit 1
 fi
 
+# Step 0: Annotate critical resources to prevent Helm from deleting them
+echo "Step 0: Protect critical resources from Helm deletion"
+echo ""
+echo "The following resources will be annotated with helm.sh/resource-policy=keep"
+echo "to prevent Helm from deleting them when the installer release is removed:"
+echo "  - Namespace: $NAMESPACE"
+echo "  - ConfigMap: $NAMESPACE/cozystack-version"
+echo ""
+read -p "Do you want to annotate these resources? (y/N) " -n 1 -r
+echo ""
+
+if [[ $REPLY =~ ^[Yy]$ ]]; then
+    echo "Annotating namespace $NAMESPACE..."
+    kubectl annotate namespace "$NAMESPACE" helm.sh/resource-policy=keep --overwrite
+    echo "Annotating ConfigMap cozystack-version..."
+    kubectl annotate configmap -n "$NAMESPACE" cozystack-version helm.sh/resource-policy=keep --overwrite 2>/dev/null || echo "  ConfigMap cozystack-version not found, skipping."
+    echo ""
+    echo "Resources annotated successfully."
+else
+    echo "WARNING: Skipping annotation. If you remove the Helm installer release,"
+    echo "the namespace and its contents may be deleted!"
+fi
+echo ""
+
 # Read ConfigMap cozystack
 echo "Reading ConfigMap cozystack..."
 COZYSTACK_CM=$(kubectl get configmap -n "$NAMESPACE" cozystack -o json 2>/dev/null || echo "{}")
diff --git a/packages/core/installer/templates/cozystack-operator.yaml b/packages/core/installer/templates/cozystack-operator.yaml
index fcd499a8..aded0995 100644
--- a/packages/core/installer/templates/cozystack-operator.yaml
+++ b/packages/core/installer/templates/cozystack-operator.yaml
@@ -10,6 +10,8 @@ metadata:
   labels:
     cozystack.io/system: "true"
     pod-security.kubernetes.io/enforce: privileged
+  annotations:
+    helm.sh/resource-policy: keep
 ---
 apiVersion: v1
 kind: ServiceAccount

From f3b61291bbb45ca791f57c3dae8c384c17b2f68d Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Sat, 28 Feb 2026 11:06:39 +0000
Subject: [PATCH 186/666] docs: add changelog for v1.0.1

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.0.1.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 docs/changelogs/v1.0.1.md

diff --git a/docs/changelogs/v1.0.1.md b/docs/changelogs/v1.0.1.md
new file mode 100644
index 00000000..2faf2755
--- /dev/null
+++ b/docs/changelogs/v1.0.1.md
@@ -0,0 +1,21 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.0.1
+-->
+
+## Fixes
+
+* **[platform] Prevent cozystack-version ConfigMap from deletion**: Added resource protection to prevent the `cozystack-version` ConfigMap from being accidentally deleted, improving platform stability and reliability ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2112, #2114).
+
+* **[installer] Add keep annotation to Namespace and update migration script**: Added `helm.sh/resource-policy: keep` annotation to the `cozy-system` Namespace in the installer Helm chart to prevent Helm from deleting the namespace (and all HelmReleases within it) when the installer release is removed. The v1.0 migration script is also updated to annotate the `cozy-system` namespace and `cozystack-version` ConfigMap with this policy before migration ([**@kvaps**](https://github.com/kvaps) in #2122, #2123).
+
+* **[dashboard] Add FlowSchema to exempt BFF from API throttling**: Added a `cozy-dashboard-exempt` FlowSchema to exempt the dashboard Back-End-for-Frontend (BFF) service account from Kubernetes API Priority and Fairness throttling. Previously, the BFF fell under the `workload-low` priority level, causing 429 (Too Many Requests) errors under load, resulting in dashboard unresponsiveness ([**@kvaps**](https://github.com/kvaps) in #2121, #2124).
+
+## Documentation
+
+* **[website] Replace bundles documentation with variants**: Renamed the "Bundles" documentation section to "Variants" to match current Cozystack terminology. Removed deprecated variants (`iaas-full`, `distro-full`, `distro-hosted`) and added new variants: `default` (PackageSources only, for manual package management via cozypkg) and `isp-full-generic` (full PaaS/IaaS on k3s, kubeadm, or RKE2). Updated all cross-references throughout the documentation ([**@kvaps**](https://github.com/kvaps) in cozystack/website#433).
+
+* **[website] Add step to protect namespace before upgrading**: Updated the cluster upgrade guide and v0.41→v1.0 migration guide with a required step to annotate the `cozy-system` namespace and `cozystack-version` ConfigMap with `helm.sh/resource-policy=keep` before running `helm upgrade`, preventing accidental namespace deletion ([**@kvaps**](https://github.com/kvaps) in cozystack/website#435).
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.0...v1.0.1

From 013b5b0873ae88e09f96750bc0a65372bd4769b5 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 2 Mar 2026 12:35:14 +0500
Subject: [PATCH 187/666] Replaced direct chart edits with patch files

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/system/ingress-nginx/Makefile              |  1 +
 .../patches/disable-ca-key-rotation.patch           | 13 +++++++++++++
 packages/system/linstor-scheduler/Makefile          |  1 +
 .../patches/disable-ca-key-rotation.patch           | 13 +++++++++++++
 packages/system/seaweedfs/Makefile                  |  1 +
 .../seaweedfs/patches/disable-ca-key-rotation.patch | 13 +++++++++++++
 packages/system/victoria-metrics-operator/Makefile  |  1 +
 .../patches/disable-ca-key-rotation.patch           | 13 +++++++++++++
 8 files changed, 56 insertions(+)
 create mode 100644 packages/system/ingress-nginx/patches/disable-ca-key-rotation.patch
 create mode 100644 packages/system/linstor-scheduler/patches/disable-ca-key-rotation.patch
 create mode 100644 packages/system/seaweedfs/patches/disable-ca-key-rotation.patch
 create mode 100644 packages/system/victoria-metrics-operator/patches/disable-ca-key-rotation.patch

diff --git a/packages/system/ingress-nginx/Makefile b/packages/system/ingress-nginx/Makefile
index 573c253b..81d78744 100644
--- a/packages/system/ingress-nginx/Makefile
+++ b/packages/system/ingress-nginx/Makefile
@@ -8,5 +8,6 @@ update:
 	helm repo update ingress-nginx
 	helm pull ingress-nginx/ingress-nginx --untar --untardir charts
 	patch --no-backup-if-mismatch -p 3 < patches/add-metrics2.patch
+	patch --no-backup-if-mismatch -p4 < patches/disable-ca-key-rotation.patch
 	rm -f charts/ingress-nginx/templates/controller-deployment.yaml.orig
 	rm -rf charts/ingress-nginx/changelog/
diff --git a/packages/system/ingress-nginx/patches/disable-ca-key-rotation.patch b/packages/system/ingress-nginx/patches/disable-ca-key-rotation.patch
new file mode 100644
index 00000000..721795e4
--- /dev/null
+++ b/packages/system/ingress-nginx/patches/disable-ca-key-rotation.patch
@@ -0,0 +1,13 @@
+diff --git a/packages/system/ingress-nginx/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml b/packages/system/ingress-nginx/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml
+index db2946c3..fab1e02e 100644
+--- a/packages/system/ingress-nginx/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml
++++ b/packages/system/ingress-nginx/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml
+@@ -23,6 +23,8 @@ spec:
+     name: {{ include "ingress-nginx.fullname" . }}-self-signed-issuer
+   commonName: "ca.webhook.ingress-nginx"
+   isCA: true
++  privateKey:
++    rotationPolicy: Never
+   subject:
+     organizations:
+       - ingress-nginx
diff --git a/packages/system/linstor-scheduler/Makefile b/packages/system/linstor-scheduler/Makefile
index 79b50c28..f9986c9a 100644
--- a/packages/system/linstor-scheduler/Makefile
+++ b/packages/system/linstor-scheduler/Makefile
@@ -8,3 +8,4 @@ update:
 	helm repo add piraeus-charts https://piraeus.io/helm-charts/
 	helm repo update piraeus-charts
 	helm pull piraeus-charts/linstor-scheduler --untar --untardir charts
+	patch --no-backup-if-mismatch -p4 < patches/disable-ca-key-rotation.patch
diff --git a/packages/system/linstor-scheduler/patches/disable-ca-key-rotation.patch b/packages/system/linstor-scheduler/patches/disable-ca-key-rotation.patch
new file mode 100644
index 00000000..45715d6b
--- /dev/null
+++ b/packages/system/linstor-scheduler/patches/disable-ca-key-rotation.patch
@@ -0,0 +1,13 @@
+diff --git a/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/certmanager.yaml b/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/certmanager.yaml
+index 3942555b..760a9d5d 100644
+--- a/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/certmanager.yaml
++++ b/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/certmanager.yaml
+@@ -24,6 +24,8 @@ spec:
+   issuerRef:
+     name: {{ include "linstor-scheduler.fullname" . }}-admission-selfsigned
+   isCA: true
++  privateKey:
++    rotationPolicy: Never
+ ---
+ apiVersion: cert-manager.io/v1
+ kind: Issuer
diff --git a/packages/system/seaweedfs/Makefile b/packages/system/seaweedfs/Makefile
index c3a2f777..cd938a4a 100644
--- a/packages/system/seaweedfs/Makefile
+++ b/packages/system/seaweedfs/Makefile
@@ -11,5 +11,6 @@ update:
 	tar xzvf - --strip 3 -C charts seaweedfs-$${version}/k8s/charts/seaweedfs
 	patch --no-backup-if-mismatch -p4 < patches/resize-api-server-annotation.diff
 	patch --no-backup-if-mismatch -p4 < patches/s3-traffic-distribution.patch
+	patch --no-backup-if-mismatch -p4 < patches/disable-ca-key-rotation.patch
 	#patch --no-backup-if-mismatch -p4 < patches/retention-policy-delete.yaml
 
diff --git a/packages/system/seaweedfs/patches/disable-ca-key-rotation.patch b/packages/system/seaweedfs/patches/disable-ca-key-rotation.patch
new file mode 100644
index 00000000..8e2fe0f3
--- /dev/null
+++ b/packages/system/seaweedfs/patches/disable-ca-key-rotation.patch
@@ -0,0 +1,13 @@
+diff --git a/packages/system/seaweedfs/charts/seaweedfs/templates/cert/ca-cert.yaml b/packages/system/seaweedfs/charts/seaweedfs/templates/cert/ca-cert.yaml
+index b01a8dcc..a38287de 100644
+--- a/packages/system/seaweedfs/charts/seaweedfs/templates/cert/ca-cert.yaml
++++ b/packages/system/seaweedfs/charts/seaweedfs/templates/cert/ca-cert.yaml
+@@ -13,6 +13,8 @@ spec:
+   secretName: {{ template "seaweedfs.name" . }}-ca-cert
+   commonName: "{{ template "seaweedfs.name" . }}-root-ca"
+   isCA: true
++  privateKey:
++    rotationPolicy: Never
+   {{- if .Values.certificates.ca.duration }}
+   duration: {{ .Values.certificates.ca.duration }}
+   {{- end }}
diff --git a/packages/system/victoria-metrics-operator/Makefile b/packages/system/victoria-metrics-operator/Makefile
index 981a1dbc..bb57f807 100644
--- a/packages/system/victoria-metrics-operator/Makefile
+++ b/packages/system/victoria-metrics-operator/Makefile
@@ -9,3 +9,4 @@ update:
 	helm repo add vm https://victoriametrics.github.io/helm-charts/
 	helm repo update vm
 	helm pull vm/victoria-metrics-operator --untar --untardir charts
+	patch --no-backup-if-mismatch -p4 < patches/disable-ca-key-rotation.patch
diff --git a/packages/system/victoria-metrics-operator/patches/disable-ca-key-rotation.patch b/packages/system/victoria-metrics-operator/patches/disable-ca-key-rotation.patch
new file mode 100644
index 00000000..c8a0bfbc
--- /dev/null
+++ b/packages/system/victoria-metrics-operator/patches/disable-ca-key-rotation.patch
@@ -0,0 +1,13 @@
+diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml
+index 2e027ab4..1bead84d 100644
+--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml
++++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml
+@@ -78,6 +78,8 @@ spec:
+     name: {{ $fullname }}-root
+   commonName: {{ $certManager.ca.commonName }}
+   isCA: true
++  privateKey:
++    rotationPolicy: Never
+ ---
+ apiVersion: cert-manager.io/v1
+ kind: Issuer

From 14228aa0d760ea54633a13dff777b22d6f8aec6d Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Mon, 2 Mar 2026 14:35:04 +0500
Subject: [PATCH 188/666] fix(keycloak): replace deprecated KC_PROXY with
 KC_PROXY_HEADERS

KC_PROXY=edge was deprecated and removed in Keycloak 26.x, causing
"Non-secure context detected" warnings and broken cookie handling
behind reverse proxy. Replace with KC_PROXY_HEADERS=xforwarded and
KC_HTTP_ENABLED=true.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/system/keycloak/templates/sts.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/packages/system/keycloak/templates/sts.yaml b/packages/system/keycloak/templates/sts.yaml
index 1cdbec62..c7506f8f 100644
--- a/packages/system/keycloak/templates/sts.yaml
+++ b/packages/system/keycloak/templates/sts.yaml
@@ -82,8 +82,10 @@ spec:
               value: "ispn"
             - name: KC_CACHE_STACK
               value: "kubernetes"
-            - name: KC_PROXY
-              value: "edge"
+            - name: KC_PROXY_HEADERS
+              value: "xforwarded"
+            - name: KC_HTTP_ENABLED
+              value: "true"
             - name: KEYCLOAK_ADMIN
               value: admin
             - name: KEYCLOAK_ADMIN_PASSWORD

From 79c57874bbd1cda73102cd364b2e5b34d676293d Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 2 Mar 2026 15:34:13 +0500
Subject: [PATCH 189/666] [platform] Fixed run-migrations script

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/core/platform/images/migrations/run-migrations.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/core/platform/images/migrations/run-migrations.sh b/packages/core/platform/images/migrations/run-migrations.sh
index c35ade21..a8224ef7 100755
--- a/packages/core/platform/images/migrations/run-migrations.sh
+++ b/packages/core/platform/images/migrations/run-migrations.sh
@@ -24,7 +24,7 @@ if [ "$CURRENT_VERSION" -ge "$TARGET_VERSION" ]; then
 fi
 
 # Run migrations sequentially from current version to target version
-for i in $(seq $((CURRENT_VERSION + 1)) $TARGET_VERSION); do
+for i in $(seq $CURRENT_VERSION $((TARGET_VERSION - 1))); do
   if [ -f "/migrations/$i" ]; then
     echo "Running migration $i"
     chmod +x /migrations/$i

From dc5c3dc9bc11e2f160094432dd709c8a912999d1 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 2 Mar 2026 15:36:20 +0500
Subject: [PATCH 190/666] [rabbitmq] Added app version selection

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/apps/rabbitmq/Chart.yaml             |   2 +-
 packages/apps/rabbitmq/Makefile               |   4 +
 packages/apps/rabbitmq/README.md              |   1 +
 packages/apps/rabbitmq/files/versions.yaml    |   4 +
 .../apps/rabbitmq/hack/update-versions.sh     | 129 ++++++++++++++++++
 .../apps/rabbitmq/templates/_versions.tpl     |   8 ++
 .../apps/rabbitmq/templates/rabbitmq.yaml     |   1 +
 packages/apps/rabbitmq/values.schema.json     |  11 ++
 packages/apps/rabbitmq/values.yaml            |   9 ++
 .../platform/images/migrations/migrations/34  |  37 +++++
 packages/core/platform/values.yaml            |   2 +-
 .../system/rabbitmq-rd/cozyrds/rabbitmq.yaml  |   4 +-
 12 files changed, 208 insertions(+), 4 deletions(-)
 create mode 100644 packages/apps/rabbitmq/files/versions.yaml
 create mode 100755 packages/apps/rabbitmq/hack/update-versions.sh
 create mode 100644 packages/apps/rabbitmq/templates/_versions.tpl
 create mode 100755 packages/core/platform/images/migrations/migrations/34

diff --git a/packages/apps/rabbitmq/Chart.yaml b/packages/apps/rabbitmq/Chart.yaml
index 13500669..e764e7dd 100644
--- a/packages/apps/rabbitmq/Chart.yaml
+++ b/packages/apps/rabbitmq/Chart.yaml
@@ -4,4 +4,4 @@ description: Managed RabbitMQ service
 icon: /logos/rabbitmq.svg
 type: application
 version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
-appVersion: "3.13.2"
+appVersion: "4.2.4"
diff --git a/packages/apps/rabbitmq/Makefile b/packages/apps/rabbitmq/Makefile
index d1cfda8e..aa9b0ccc 100644
--- a/packages/apps/rabbitmq/Makefile
+++ b/packages/apps/rabbitmq/Makefile
@@ -3,3 +3,7 @@ include ../../../hack/package.mk
 generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
 	../../../hack/update-crd.sh
+
+update:
+	hack/update-versions.sh
+	make generate
diff --git a/packages/apps/rabbitmq/README.md b/packages/apps/rabbitmq/README.md
index 4b19c7b3..b1f01f21 100644
--- a/packages/apps/rabbitmq/README.md
+++ b/packages/apps/rabbitmq/README.md
@@ -23,6 +23,7 @@ The service utilizes official RabbitMQ operator. This ensures the reliability an
 | `size`             | Persistent Volume Claim size available for application data.                                                                       | `quantity` | `10Gi`  |
 | `storageClass`     | StorageClass used to store the data.                                                                                               | `string`   | `""`    |
 | `external`         | Enable external access from outside the cluster.                                                                                   | `bool`     | `false` |
+| `version`          | RabbitMQ major.minor version to deploy                                                                                             | `string`   | `v4.2`  |
 
 
 ### Application-specific parameters
diff --git a/packages/apps/rabbitmq/files/versions.yaml b/packages/apps/rabbitmq/files/versions.yaml
new file mode 100644
index 00000000..0cf87dd0
--- /dev/null
+++ b/packages/apps/rabbitmq/files/versions.yaml
@@ -0,0 +1,4 @@
+"v4.2": "4.2.4"
+"v4.1": "4.1.8"
+"v4.0": "4.0.9"
+"v3.13": "3.13.7"
diff --git a/packages/apps/rabbitmq/hack/update-versions.sh b/packages/apps/rabbitmq/hack/update-versions.sh
new file mode 100755
index 00000000..7dec5a84
--- /dev/null
+++ b/packages/apps/rabbitmq/hack/update-versions.sh
@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+RABBITMQ_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+VALUES_FILE="${RABBITMQ_DIR}/values.yaml"
+VERSIONS_FILE="${RABBITMQ_DIR}/files/versions.yaml"
+GITHUB_API_URL="https://api.github.com/repos/rabbitmq/rabbitmq-server/releases"
+
+# Check if jq is installed
+if ! command -v jq &> /dev/null; then
+    echo "Error: jq is not installed. Please install jq and try again." >&2
+    exit 1
+fi
+
+# Fetch releases from GitHub API
+echo "Fetching releases from GitHub API..."
+RELEASES_JSON=$(curl -sSL "${GITHUB_API_URL}?per_page=100")
+
+if [ -z "$RELEASES_JSON" ]; then
+    echo "Error: Could not fetch releases from GitHub API" >&2
+    exit 1
+fi
+
+# Extract stable release tags (format: v3.13.7, v4.0.3, etc.)
+# Filter out pre-releases and draft releases
+RELEASE_TAGS=$(echo "$RELEASES_JSON" | jq -r '.[] | select(.prerelease == false) | select(.draft == false) | .tag_name' | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | sort -V)
+
+if [ -z "$RELEASE_TAGS" ]; then
+    echo "Error: Could not find any stable release tags" >&2
+    exit 1
+fi
+
+echo "Found release tags: $(echo "$RELEASE_TAGS" | tr '\n' ' ')"
+
+# Supported major.minor versions (newest first)
+# We support the last few minor releases of each active major
+SUPPORTED_MAJORS=("4.2" "4.1" "4.0" "3.13")
+
+# Build versions map: major.minor -> latest patch version
+declare -A VERSION_MAP
+MAJOR_VERSIONS=()
+
+for major_minor in "${SUPPORTED_MAJORS[@]}"; do
+    # Find the latest patch version for this major.minor
+    MATCHING=$(echo "$RELEASE_TAGS" | grep -E "^v${major_minor//./\\.}\.[0-9]+$" | tail -n1)
+
+    if [ -n "$MATCHING" ]; then
+        # Strip the 'v' prefix for the value (Docker tag format is e.g. 3.13.7)
+        TAG_VERSION="${MATCHING#v}"
+        VERSION_MAP["v${major_minor}"]="${TAG_VERSION}"
+        MAJOR_VERSIONS+=("v${major_minor}")
+        echo "Found version: v${major_minor} -> ${TAG_VERSION}"
+    else
+        echo "Warning: No stable releases found for ${major_minor}, skipping..." >&2
+    fi
+done
+
+if [ ${#MAJOR_VERSIONS[@]} -eq 0 ]; then
+    echo "Error: No matching versions found" >&2
+    exit 1
+fi
+
+echo "Major versions to add: ${MAJOR_VERSIONS[*]}"
+
+# Create/update versions.yaml file
+echo "Updating $VERSIONS_FILE..."
+{
+    for major_ver in "${MAJOR_VERSIONS[@]}"; do
+        echo "\"${major_ver}\": \"${VERSION_MAP[$major_ver]}\""
+    done
+} > "$VERSIONS_FILE"
+
+echo "Successfully updated $VERSIONS_FILE"
+
+# Update values.yaml - enum with major.minor versions only
+TEMP_FILE=$(mktemp)
+trap "rm -f $TEMP_FILE" EXIT
+
+# Build new version section
+NEW_VERSION_SECTION="## @enum {string} Version"
+for major_ver in "${MAJOR_VERSIONS[@]}"; do
+    NEW_VERSION_SECTION="${NEW_VERSION_SECTION}
+## @value $major_ver"
+done
+NEW_VERSION_SECTION="${NEW_VERSION_SECTION}
+
+## @param {Version} version - RabbitMQ major.minor version to deploy
+version: ${MAJOR_VERSIONS[0]}"
+
+# Check if version section already exists
+if grep -q "^## @enum {string} Version" "$VALUES_FILE"; then
+    # Version section exists, update it using awk
+    echo "Updating existing version section in $VALUES_FILE..."
+
+    awk -v new_section="$NEW_VERSION_SECTION" '
+        /^## @enum {string} Version/ {
+            in_section = 1
+            print new_section
+            next
+        }
+        in_section && /^version: / {
+            in_section = 0
+            next
+        }
+        in_section {
+            next
+        }
+        { print }
+    ' "$VALUES_FILE" > "$TEMP_FILE.tmp"
+    mv "$TEMP_FILE.tmp" "$VALUES_FILE"
+else
+    # Version section doesn't exist, insert it before Application-specific parameters section
+    echo "Inserting new version section in $VALUES_FILE..."
+
+    awk -v new_section="$NEW_VERSION_SECTION" '
+        /^## @section Application-specific parameters/ {
+            print new_section
+            print ""
+        }
+        { print }
+    ' "$VALUES_FILE" > "$TEMP_FILE.tmp"
+    mv "$TEMP_FILE.tmp" "$VALUES_FILE"
+fi
+
+echo "Successfully updated $VALUES_FILE with major.minor versions: ${MAJOR_VERSIONS[*]}"
diff --git a/packages/apps/rabbitmq/templates/_versions.tpl b/packages/apps/rabbitmq/templates/_versions.tpl
new file mode 100644
index 00000000..76955b33
--- /dev/null
+++ b/packages/apps/rabbitmq/templates/_versions.tpl
@@ -0,0 +1,8 @@
+{{- define "rabbitmq.versionMap" }}
+{{- $versionMap := .Files.Get "files/versions.yaml" | fromYaml }}
+{{- if not (hasKey $versionMap .Values.version) }}
+    {{- printf `RabbitMQ version %s is not supported, allowed versions are %s` $.Values.version (keys $versionMap) | fail }}
+{{- end }}
+{{- index $versionMap .Values.version }}
+{{- end }}
+
diff --git a/packages/apps/rabbitmq/templates/rabbitmq.yaml b/packages/apps/rabbitmq/templates/rabbitmq.yaml
index b111285e..bbf2efbe 100644
--- a/packages/apps/rabbitmq/templates/rabbitmq.yaml
+++ b/packages/apps/rabbitmq/templates/rabbitmq.yaml
@@ -7,6 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
 spec:
   replicas: {{ .Values.replicas }}
+  image: 'rabbitmq:{{ include "rabbitmq.versionMap" $ }}-management'
   {{- if .Values.external }}
   service:
     type: LoadBalancer
diff --git a/packages/apps/rabbitmq/values.schema.json b/packages/apps/rabbitmq/values.schema.json
index 04b8fa11..87b1a6da 100644
--- a/packages/apps/rabbitmq/values.schema.json
+++ b/packages/apps/rabbitmq/values.schema.json
@@ -92,6 +92,17 @@
         }
       }
     },
+    "version": {
+      "description": "RabbitMQ major.minor version to deploy",
+      "type": "string",
+      "default": "v4.2",
+      "enum": [
+        "v4.2",
+        "v4.1",
+        "v4.0",
+        "v3.13"
+      ]
+    },
     "vhosts": {
       "description": "Virtual hosts configuration map.",
       "type": "object",
diff --git a/packages/apps/rabbitmq/values.yaml b/packages/apps/rabbitmq/values.yaml
index 65d5de44..08b6f5e6 100644
--- a/packages/apps/rabbitmq/values.yaml
+++ b/packages/apps/rabbitmq/values.yaml
@@ -34,6 +34,15 @@ storageClass: ""
 external: false
 
 ##
+## @enum {string} Version
+## @value v4.2
+## @value v4.1
+## @value v4.0
+## @value v3.13
+
+## @param {Version} version - RabbitMQ major.minor version to deploy
+version: v4.2
+
 ## @section Application-specific parameters
 ##
 
diff --git a/packages/core/platform/images/migrations/migrations/34 b/packages/core/platform/images/migrations/migrations/34
new file mode 100755
index 00000000..57204ff0
--- /dev/null
+++ b/packages/core/platform/images/migrations/migrations/34
@@ -0,0 +1,37 @@
+#!/bin/sh
+# Migration 34 --> 35
+# Backfill spec.version on rabbitmq.apps.cozystack.io resources.
+#
+# Before this migration RabbitMQ had no user-selectable version; the
+# operator always used its built-in default image (v3.x).  A version field
+# was added in this release.  Without this migration every existing cluster
+# would be upgraded to the new default (v4.2) on the next reconcile.
+#
+# Set spec.version to "v3.13" for any rabbitmq app resource that does not
+# already have it set.
+
+set -euo pipefail
+
+DEFAULT_VERSION="v3.13"
+RABBITMQS=$(kubectl get rabbitmqs.apps.cozystack.io -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}')
+for resource in $RABBITMQS; do
+  NS="${resource%%/*}"
+  APP_NAME="${resource##*/}"
+
+  # Skip if spec.version is already set
+  CURRENT_VER=$(kubectl get rabbitmqs.apps.cozystack.io -n "$NS" "$APP_NAME" \
+    -o jsonpath='{.spec.version}')
+  if [ -n "$CURRENT_VER" ]; then
+    echo "SKIP $NS/$APP_NAME: spec.version already set to '$CURRENT_VER'"
+    continue
+  fi
+
+  echo "Patching rabbitmq/$APP_NAME in $NS: setting version=$DEFAULT_VERSION"
+
+  kubectl patch rabbitmqs.apps.cozystack.io -n "$NS" "$APP_NAME" --type=merge \
+    --patch "{\"spec\":{\"version\":\"${DEFAULT_VERSION}\"}}"
+done
+
+# Stamp version
+kubectl create configmap -n cozy-system cozystack-version \
+  --from-literal=version=35 --dry-run=client -o yaml | kubectl apply -f-
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index 155cc78a..80ebb936 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -6,7 +6,7 @@ sourceRef:
 migrations:
   enabled: false
   image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0@sha256:68dabdebc38ac439228ae07031cc70e0fa184a24bd4e5b3b22c17466b2a55201
-  targetVersion: 34
+  targetVersion: 35
 # Bundle deployment configuration
 bundles:
   system:
diff --git a/packages/system/rabbitmq-rd/cozyrds/rabbitmq.yaml b/packages/system/rabbitmq-rd/cozyrds/rabbitmq.yaml
index 1bbed02d..6ca2b79f 100644
--- a/packages/system/rabbitmq-rd/cozyrds/rabbitmq.yaml
+++ b/packages/system/rabbitmq-rd/cozyrds/rabbitmq.yaml
@@ -8,7 +8,7 @@ spec:
     plural: rabbitmqs
     singular: rabbitmq
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"replicas":{"description":"Number of RabbitMQ replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration for each RabbitMQ replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"}}}},"vhosts":{"description":"Virtual hosts configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","required":["roles"],"properties":{"roles":{"description":"Virtual host roles list.","type":"object","properties":{"admin":{"description":"List of admin users.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of readonly users.","type":"array","items":{"type":"string"}}}}}}}}}
+      {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"replicas":{"description":"Number of RabbitMQ replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration for each RabbitMQ replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"}}}},"version":{"description":"RabbitMQ major.minor version to deploy","type":"string","default":"v4.2","enum":["v4.2","v4.1","v4.0","v3.13"]},"vhosts":{"description":"Virtual hosts configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","required":["roles"],"properties":{"roles":{"description":"Virtual host roles list.","type":"object","properties":{"admin":{"description":"List of admin users.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of readonly users.","type":"array","items":{"type":"string"}}}}}}}}}
   release:
     prefix: rabbitmq-
     labels:
@@ -25,7 +25,7 @@ spec:
     tags:
       - messaging
     icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHg9Ii0wLjAwMTk1MzEyIiB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgcng9IjI0IiBmaWxsPSJ1cmwoI3BhaW50MF9saW5lYXJfNjgzXzI5NzIpIi8+CjxwYXRoIGQ9Ik0xMTEuNDExIDYyLjhIODIuNDkzOUM4MS43OTY5IDYyLjc5OTcgODEuMTI4NSA2Mi41MjI4IDgwLjYzNTYgNjIuMDMwMUM4MC4xNDI3IDYxLjUzNzMgNzkuODY1NiA2MC44NjkxIDc5Ljg2NTMgNjAuMTcyMlYzMC4wNDEyQzc5Ljg2NTMgMjcuODEgNzguMDU1NiAyNiA3NS44MjQ5IDI2SDY1LjUwMjFDNjMuMjcgMjYgNjEuNDYxNCAyNy44MSA2MS40NjE0IDMwLjA0MTJWNTkuOTg5OEM2MS40NjE0IDYxLjU0MzUgNjAuMjA1IDYyLjgwNjUgNTguNjUwOCA2Mi44MTMzTDQ5LjE3NDMgNjIuODU4NEM0Ny42MDY5IDYyLjg2NjkgNDYuMzMzNiA2MS41OTU1IDQ2LjMzNjYgNjAuMDI5OEw0Ni4zOTU0IDMwLjA0OEM0Ni40MDA1IDI3LjgxMzQgNDQuNTkwMiAyNiA0Mi4zNTUgMjZIMzIuMDQwN0MyOS44MDgzIDI2IDI4IDI3LjgxIDI4IDMwLjA0MTJWMTE0LjQxMkMyOCAxMTYuMzk0IDI5LjYwNjEgMTE4IDMxLjU4NzEgMTE4SDExMS40MTFDMTEzLjM5NCAxMTggMTE1IDExNi4zOTQgMTE1IDExNC40MTJWNjYuMzg4QzExNSA2NC40MDU4IDExMy4zOTQgNjIuOCAxMTEuNDExIDYyLjhaTTk3Ljg1MDggOTQuNDc3OUM5Ny44NTA4IDk3LjA3NTUgOTUuNzQ0NSA5OS4xODE3IDkzLjE0NjQgOTkuMTgxN0g4NC45ODg0QzgyLjM5IDk5LjE4MTcgODAuMjgzNiA5Ny4wNzU1IDgwLjI4MzYgOTQuNDc3OVY4Ni4zMjE3QzgwLjI4MzYgODMuNzIzOCA4Mi4zOSA4MS42MTc5IDg0Ljk4ODQgODEuNjE3OUg5My4xNDY0Qzk1Ljc0NDUgODEuNjE3OSA5Ny44NTA4IDgzLjcyMzggOTcuODUwOCA4Ni4zMjE3Vjk0LjQ3NzlaIiBmaWxsPSJ3aGl0ZSIvPgo8ZGVmcz4KPGxpbmVhckdyYWRpZW50IGlkPSJwYWludDBfbGluZWFyXzY4M18yOTcyIiB4MT0iNSIgeTE9Ii03LjUiIHgyPSIxNDEiIHkyPSIxMjQuNSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPgo8c3RvcCBzdG9wLWNvbG9yPSIjRkY4MjJGIi8+CjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iI0ZGNjYwMCIvPgo8L2xpbmVhckdyYWRpZW50Pgo8L2RlZnM+Cjwvc3ZnPgo=
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "replicas"], ["spec", "resources"], ["spec", "resourcesPreset"], ["spec", "size"], ["spec", "storageClass"], ["spec", "external"], ["spec", "users"], ["spec", "vhosts"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "replicas"], ["spec", "resources"], ["spec", "resourcesPreset"], ["spec", "size"], ["spec", "storageClass"], ["spec", "external"], ["spec", "version"], ["spec", "users"], ["spec", "vhosts"]]
   secrets:
     exclude: []
     include:

From 14a9017932871b781b4006a0b459c7a085b579f4 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Mon, 2 Mar 2026 12:56:44 +0100
Subject: [PATCH 191/666] fix(migration): suspend cozy-proxy if it conflicts
 with installer release

In v0.41.x, cozy-proxy HelmRelease was configured with
releaseName: cozystack, which collides with the installer helm release.
If not suspended before upgrade, the cozy-proxy HR reconciles and
overwrites the installer release, deleting cozystack-operator.

Add a check in the migration script that detects this conflict and
suspends the cozy-proxy HelmRelease before proceeding.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 hack/migrate-to-version-1.0.sh | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/hack/migrate-to-version-1.0.sh b/hack/migrate-to-version-1.0.sh
index bf648926..471a417d 100755
--- a/hack/migrate-to-version-1.0.sh
+++ b/hack/migrate-to-version-1.0.sh
@@ -56,6 +56,30 @@ else
 fi
 echo ""
 
+# Step 1: Check for cozy-proxy HelmRelease with conflicting releaseName
+# In v0.41.x, cozy-proxy was incorrectly configured with releaseName "cozystack",
+# which conflicts with the installer helm release name. If not suspended, cozy-proxy
+# HelmRelease will overwrite the installer release and delete cozystack-operator.
+COZY_PROXY_RELEASE_NAME=$(kubectl get hr -n "$NAMESPACE" cozy-proxy -o jsonpath='{.spec.releaseName}' 2>/dev/null || true)
+if [ "$COZY_PROXY_RELEASE_NAME" = "cozystack" ]; then
+    echo "WARNING: HelmRelease cozy-proxy has releaseName 'cozystack', which conflicts"
+    echo "with the installer release. It must be suspended before proceeding, otherwise"
+    echo "it will overwrite the installer and delete cozystack-operator."
+    echo ""
+    read -p "Suspend HelmRelease cozy-proxy? (y/N) " -n 1 -r
+    echo ""
+    if [[ $REPLY =~ ^[Yy]$ ]]; then
+        kubectl -n "$NAMESPACE" patch hr cozy-proxy --type=merge --field-manager=flux-client-side-apply -p '{"spec":{"suspend":true}}'
+        echo "HelmRelease cozy-proxy suspended."
+    else
+        echo "ERROR: Cannot proceed with conflicting cozy-proxy HelmRelease active."
+        echo "Please suspend it manually:"
+        echo "  kubectl -n $NAMESPACE patch hr cozy-proxy --type=merge -p '{\"spec\":{\"suspend\":true}}'"
+        exit 1
+    fi
+    echo ""
+fi
+
 # Read ConfigMap cozystack
 echo "Reading ConfigMap cozystack..."
 COZYSTACK_CM=$(kubectl get configmap -n "$NAMESPACE" cozystack -o json 2>/dev/null || echo "{}")

From c2bf8cf56fb6e33a5df5aff1ee22b228cbd3393f Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Mon, 2 Mar 2026 21:26:51 +0500
Subject: [PATCH 192/666] feat(dashboard): add storageClass dropdown for all
 stateful apps

Replace plain text input with an API-backed listInput dropdown for
storageClass fields across all applications that expose them.

The dropdown fetches available StorageClasses from the cluster via
/api/clusters/{cluster}/k8s/apis/storage.k8s.io/v1/storageclasses,
following the same pattern as the instanceType dropdown for VMInstance.

Top-level spec.storageClass: ClickHouse, Harbor, HTTPCache, Kubernetes,
MariaDB, MongoDB, NATS, OpenBAO, Postgres, Qdrant, RabbitMQ, Redis, VMDisk.

Nested paths: FoundationDB (spec.storage.storageClass),
Kafka (spec.kafka.storageClass and spec.zookeeper.storageClass).

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .../dashboard/customformsoverride.go          | 28 ++++++++
 .../dashboard/customformsoverride_test.go     | 66 +++++++++++++++++++
 2 files changed, 94 insertions(+)

diff --git a/internal/controller/dashboard/customformsoverride.go b/internal/controller/dashboard/customformsoverride.go
index 67b131cf..97912fea 100644
--- a/internal/controller/dashboard/customformsoverride.go
+++ b/internal/controller/dashboard/customformsoverride.go
@@ -214,6 +214,34 @@ func applyListInputOverrides(schema map[string]any, kind string, openAPIProps ma
 				"keysToLabel": []any{"metadata", "name"},
 			},
 		}
+
+	case "ClickHouse", "Harbor", "HTTPCache", "Kubernetes", "MariaDB", "MongoDB",
+		"NATS", "OpenBAO", "Postgres", "Qdrant", "RabbitMQ", "Redis", "VMDisk":
+		specProps := ensureSchemaPath(schema, "spec")
+		specProps["storageClass"] = storageClassListInput()
+
+	case "FoundationDB":
+		storageProps := ensureSchemaPath(schema, "spec", "storage")
+		storageProps["storageClass"] = storageClassListInput()
+
+	case "Kafka":
+		kafkaProps := ensureSchemaPath(schema, "spec", "kafka")
+		kafkaProps["storageClass"] = storageClassListInput()
+		zkProps := ensureSchemaPath(schema, "spec", "zookeeper")
+		zkProps["storageClass"] = storageClassListInput()
+	}
+}
+
+// storageClassListInput returns a listInput field config for a storageClass dropdown
+// backed by the cluster's available StorageClasses.
+func storageClassListInput() map[string]any {
+	return map[string]any{
+		"type": "listInput",
+		"customProps": map[string]any{
+			"valueUri":    "/api/clusters/{cluster}/k8s/apis/storage.k8s.io/v1/storageclasses",
+			"keysToValue": []any{"metadata", "name"},
+			"keysToLabel": []any{"metadata", "name"},
+		},
 	}
 }
 
diff --git a/internal/controller/dashboard/customformsoverride_test.go b/internal/controller/dashboard/customformsoverride_test.go
index 37da1244..2677cfa8 100644
--- a/internal/controller/dashboard/customformsoverride_test.go
+++ b/internal/controller/dashboard/customformsoverride_test.go
@@ -232,6 +232,72 @@ func TestApplyListInputOverrides_VMInstance(t *testing.T) {
 	}
 }
 
+func TestApplyListInputOverrides_StorageClassSimple(t *testing.T) {
+	for _, kind := range []string{
+		"ClickHouse", "Harbor", "HTTPCache", "Kubernetes", "MariaDB", "MongoDB",
+		"NATS", "OpenBAO", "Postgres", "Qdrant", "RabbitMQ", "Redis", "VMDisk",
+	} {
+		t.Run(kind, func(t *testing.T) {
+			schema := map[string]any{}
+			applyListInputOverrides(schema, kind, map[string]any{})
+
+			specProps := schema["properties"].(map[string]any)["spec"].(map[string]any)["properties"].(map[string]any)
+			sc, ok := specProps["storageClass"].(map[string]any)
+			if !ok {
+				t.Fatalf("storageClass not found in spec.properties for kind %s", kind)
+			}
+			assertStorageClassListInput(t, sc)
+		})
+	}
+}
+
+func TestApplyListInputOverrides_StorageClassFoundationDB(t *testing.T) {
+	schema := map[string]any{}
+	applyListInputOverrides(schema, "FoundationDB", map[string]any{})
+
+	storageProps := schema["properties"].(map[string]any)["spec"].(map[string]any)["properties"].(map[string]any)["storage"].(map[string]any)["properties"].(map[string]any)
+	sc, ok := storageProps["storageClass"].(map[string]any)
+	if !ok {
+		t.Fatal("storageClass not found in spec.storage.properties")
+	}
+	assertStorageClassListInput(t, sc)
+}
+
+func TestApplyListInputOverrides_StorageClassKafka(t *testing.T) {
+	schema := map[string]any{}
+	applyListInputOverrides(schema, "Kafka", map[string]any{})
+
+	specProps := schema["properties"].(map[string]any)["spec"].(map[string]any)["properties"].(map[string]any)
+
+	kafkaSC, ok := specProps["kafka"].(map[string]any)["properties"].(map[string]any)["storageClass"].(map[string]any)
+	if !ok {
+		t.Fatal("storageClass not found in spec.kafka.properties")
+	}
+	assertStorageClassListInput(t, kafkaSC)
+
+	zkSC, ok := specProps["zookeeper"].(map[string]any)["properties"].(map[string]any)["storageClass"].(map[string]any)
+	if !ok {
+		t.Fatal("storageClass not found in spec.zookeeper.properties")
+	}
+	assertStorageClassListInput(t, zkSC)
+}
+
+// assertStorageClassListInput verifies that a field is a correctly configured storageClass listInput.
+func assertStorageClassListInput(t *testing.T, field map[string]any) {
+	t.Helper()
+	if field["type"] != "listInput" {
+		t.Errorf("expected type listInput, got %v", field["type"])
+	}
+	customProps, ok := field["customProps"].(map[string]any)
+	if !ok {
+		t.Fatal("customProps not found")
+	}
+	expectedURI := "/api/clusters/{cluster}/k8s/apis/storage.k8s.io/v1/storageclasses"
+	if customProps["valueUri"] != expectedURI {
+		t.Errorf("expected valueUri %s, got %v", expectedURI, customProps["valueUri"])
+	}
+}
+
 func TestApplyListInputOverrides_UnknownKind(t *testing.T) {
 	schema := map[string]any{}
 	applyListInputOverrides(schema, "SomeOtherKind", map[string]any{})

From a3ccb4f87d9b89bbbf791183720f7507ee72e276 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Mon, 2 Mar 2026 22:18:53 +0500
Subject: [PATCH 193/666] feat(dashboard): allow clearing instanceType field in
 VMInstance form

Update openapi-k8s-toolkit to release/1.4.0 (d6b9e4ad). The previous
value-binding layout refactor is already included upstream, so drop the
formlistinput-value-binding.diff patch.

Add formlistinput-allow-empty.diff patch which introduces two props to
the listInput component:
- allowEmpty: when set, auto-persists the field so BFF sends an empty
  value instead of falling back to the schema default
- persistType: controls the type of empty value ('str' | 'number' | 'arr'
  | 'obj'), allowing the feature to work correctly for any field type

Set allowEmpty: true on the VMInstance instanceType field so users can
explicitly clear the selection and override the default instance type.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .../patches/formlistinput-allow-empty.diff    | 37 ++++++++++++++
 .../patches/formlistinput-value-binding.diff  | 49 -------------------
 2 files changed, 37 insertions(+), 49 deletions(-)
 create mode 100644 packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/formlistinput-allow-empty.diff
 delete mode 100644 packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/formlistinput-value-binding.diff

diff --git a/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/formlistinput-allow-empty.diff b/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/formlistinput-allow-empty.diff
new file mode 100644
index 00000000..1c83df7c
--- /dev/null
+++ b/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/formlistinput-allow-empty.diff
@@ -0,0 +1,37 @@
+diff --git a/src/localTypes/formExtensions.ts b/src/localTypes/formExtensions.ts
+--- a/src/localTypes/formExtensions.ts
++++ b/src/localTypes/formExtensions.ts
+@@ -59,2 +59,4 @@
+   relatedValuePath?: string
++  allowEmpty?: boolean
++  persistType?: 'str' | 'number' | 'arr' | 'obj'
+ }
+diff --git a/src/components/molecules/BlackholeForm/molecules/FormListInput/FormListInput.tsx b/src/components/molecules/BlackholeForm/molecules/FormListInput/FormListInput.tsx
+--- a/src/components/molecules/BlackholeForm/molecules/FormListInput/FormListInput.tsx
++++ b/src/components/molecules/BlackholeForm/molecules/FormListInput/FormListInput.tsx
+@@ -149,3 +149,10 @@
+   }, [relatedPath, form, arrName, fixedName, relatedFieldValue, onValuesChangeCallBack, isTouchedPeristed])
+
++  // When allowEmpty is set, auto-persist the field so the BFF preserves empty values
++  useEffect(() => {
++    if (customProps.allowEmpty) {
++      persistedControls.onPersistMark(persistName || name, customProps.persistType ?? 'str')
++    }
++  }, [customProps.allowEmpty, customProps.persistType, persistedControls, persistName, name])
++
+   const uri = prepareTemplate({
+@@ -267,5 +274,14 @@
+           validateTrigger="onBlur"
+           hasFeedback={designNewLayout ? { icons: feedbackIcons } : true}
+           style={{ flex: 1 }}
++          normalize={(value: unknown) => {
++            if (customProps.allowEmpty && (value === undefined || value === null)) {
++              if (customProps.persistType === 'number') return 0
++              if (customProps.persistType === 'arr') return []
++              if (customProps.persistType === 'obj') return {}
++              return ''
++            }
++            return value
++          }}
+         >
+           <Select
diff --git a/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/formlistinput-value-binding.diff b/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/formlistinput-value-binding.diff
deleted file mode 100644
index 0da12c00..00000000
--- a/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/formlistinput-value-binding.diff
+++ /dev/null
@@ -1,49 +0,0 @@
-diff --git a/src/components/molecules/BlackholeForm/molecules/FormListInput/FormListInput.tsx b/src/components/molecules/BlackholeForm/molecules/FormListInput/FormListInput.tsx
-index d5e5230..9038dbb 100644
---- a/src/components/molecules/BlackholeForm/molecules/FormListInput/FormListInput.tsx
-+++ b/src/components/molecules/BlackholeForm/molecules/FormListInput/FormListInput.tsx
-@@ -259,14 +259,15 @@ export const FormListInput: FC<TFormListInputProps> = ({
-           <PersistedCheckbox formName={persistName || name} persistedControls={persistedControls} type="arr" />
-         </Flex>
-       </Flex>
--      <ResetedFormItem
--        key={arrKey !== undefined ? arrKey : Array.isArray(name) ? name.slice(-1)[0] : name}
--        name={arrName || fixedName}
--        rules={[getRequiredRule(forceNonRequired === false && !!required?.includes(getStringByName(name)), name)]}
--        validateTrigger="onBlur"
--        hasFeedback={designNewLayout ? { icons: feedbackIcons } : true}
--      >
--        <Flex gap={8} align="center">
-+      <Flex gap={8} align="center">
-+        <ResetedFormItem
-+          key={arrKey !== undefined ? arrKey : Array.isArray(name) ? name.slice(-1)[0] : name}
-+          name={arrName || fixedName}
-+          rules={[getRequiredRule(forceNonRequired === false && !!required?.includes(getStringByName(name)), name)]}
-+          validateTrigger="onBlur"
-+          hasFeedback={designNewLayout ? { icons: feedbackIcons } : true}
-+          style={{ flex: 1 }}
-+        >
-           <Select
-             mode={customProps.mode}
-             placeholder="Select"
-@@ -277,13 +278,13 @@ export const FormListInput: FC<TFormListInputProps> = ({
-             showSearch
-             style={{ width: '100%' }}
-           />
--          {relatedValueTooltip && (
--            <Tooltip title={relatedValueTooltip}>
--              <QuestionCircleOutlined />
--            </Tooltip>
--          )}
--        </Flex>
--      </ResetedFormItem>
-+        </ResetedFormItem>
-+        {relatedValueTooltip && (
-+          <Tooltip title={relatedValueTooltip}>
-+            <QuestionCircleOutlined />
-+          </Tooltip>
-+        )}
-+      </Flex>
-     </HiddenContainer>
-   )
- }

From 6e8ce65e495fadd7dd260fa076acc4727672d0e1 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Mon, 2 Mar 2026 22:19:54 +0500
Subject: [PATCH 194/666] feat(dashboard): set allowEmpty on instanceType and
 update openapi-ui toolkit

Update openapi-k8s-toolkit commit to d6b9e4ad (release/1.4.0) which
includes the FormListInput layout refactor, making formlistinput-value-binding.diff
obsolete.

Set allowEmpty: true on the VMInstance instanceType field so users can
explicitly clear the selection and override the default instance type.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 internal/controller/dashboard/customformsoverride.go      | 1 +
 internal/controller/dashboard/customformsoverride_test.go | 4 ++++
 packages/system/dashboard/images/openapi-ui/Dockerfile    | 2 +-
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/internal/controller/dashboard/customformsoverride.go b/internal/controller/dashboard/customformsoverride.go
index 67b131cf..cfacb2fa 100644
--- a/internal/controller/dashboard/customformsoverride.go
+++ b/internal/controller/dashboard/customformsoverride.go
@@ -195,6 +195,7 @@ func applyListInputOverrides(schema map[string]any, kind string, openAPIProps ma
 				"valueUri":    "/api/clusters/{cluster}/k8s/apis/instancetype.kubevirt.io/v1beta1/virtualmachineclusterinstancetypes",
 				"keysToValue": []any{"metadata", "name"},
 				"keysToLabel": []any{"metadata", "name"},
+				"allowEmpty":  true,
 			},
 		}
 		if prop, _ := openAPIProps["instanceType"].(map[string]any); prop != nil {
diff --git a/internal/controller/dashboard/customformsoverride_test.go b/internal/controller/dashboard/customformsoverride_test.go
index 37da1244..76fc4f83 100644
--- a/internal/controller/dashboard/customformsoverride_test.go
+++ b/internal/controller/dashboard/customformsoverride_test.go
@@ -202,6 +202,10 @@ func TestApplyListInputOverrides_VMInstance(t *testing.T) {
 		t.Errorf("expected valueUri %s, got %v", expectedURI, customProps["valueUri"])
 	}
 
+	if customProps["allowEmpty"] != true {
+		t.Errorf("expected allowEmpty true, got %v", customProps["allowEmpty"])
+	}
+
 	// Check disks[].name is a listInput
 	disks, ok := specProps["disks"].(map[string]any)
 	if !ok {
diff --git a/packages/system/dashboard/images/openapi-ui/Dockerfile b/packages/system/dashboard/images/openapi-ui/Dockerfile
index 4b80c960..82cc6db0 100644
--- a/packages/system/dashboard/images/openapi-ui/Dockerfile
+++ b/packages/system/dashboard/images/openapi-ui/Dockerfile
@@ -6,7 +6,7 @@ FROM node:${NODE_VERSION}-alpine AS openapi-k8s-toolkit-builder
 RUN apk add git
 WORKDIR /src
 # release/1.4.0
-ARG COMMIT=c67029cc7b7495c65ee0406033576e773a73bb01
+ARG COMMIT=d6b9e4ad0d1eb9d3730f7f0c664792c8dda3214d
 RUN wget -O- https://github.com/PRO-Robotech/openapi-k8s-toolkit/archive/${COMMIT}.tar.gz | tar -xzvf- --strip-components=1
 
 COPY openapi-k8s-toolkit/patches /patches

From 99ee0e34bf71024e041d2f96e8bf0d0b6223508e Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Mon, 2 Mar 2026 22:36:01 +0500
Subject: [PATCH 195/666] fix(dashboard): preserve newlines when copying
 secrets with CMD+C

Add onCopy handler to SecretBase64Plain inputs to intercept native browser
copy events and explicitly write the full decoded text (including newlines)
to the clipboard. Without this, input[type=text] strips newlines on copy.

Upstream PR: https://github.com/PRO-Robotech/openapi-k8s-toolkit/pull/339

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .../secret-copy-preserve-newlines.diff        | 29 +++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/secret-copy-preserve-newlines.diff

diff --git a/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/secret-copy-preserve-newlines.diff b/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/secret-copy-preserve-newlines.diff
new file mode 100644
index 00000000..7bce6c25
--- /dev/null
+++ b/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/secret-copy-preserve-newlines.diff
@@ -0,0 +1,29 @@
+diff --git a/src/components/organisms/DynamicComponents/molecules/SecretBase64Plain/SecretBase64Plain.tsx b/src/components/organisms/DynamicComponents/molecules/SecretBase64Plain/SecretBase64Plain.tsx
+--- a/src/components/organisms/DynamicComponents/molecules/SecretBase64Plain/SecretBase64Plain.tsx
++++ b/src/components/organisms/DynamicComponents/molecules/SecretBase64Plain/SecretBase64Plain.tsx
+@@ -145,6 +145,12 @@
+               <Styled.DisabledInput
+                 $hidden={effectiveHidden}
+                 onClick={e => handleInputClick(e, effectiveHidden, value)}
++                onCopy={e => {
++                  if (!effectiveHidden) {
++                    e.preventDefault()
++                    e.clipboardData?.setData('text/plain', value)
++                  }
++                }}
+                 value={shownValue}
+                 readOnly
+               />
+@@ -161,6 +167,12 @@
+             <Styled.DisabledInput
+               $hidden={effectiveHidden}
+               onClick={e => handleInputClick(e, effectiveHidden, value)}
++              onCopy={e => {
++                if (!effectiveHidden) {
++                  e.preventDefault()
++                  e.clipboardData?.setData('text/plain', value)
++                }
++              }}
+               value={shownValue}
+               readOnly
+             />

From 45b61f812de45882dcfcb7966d79155f44c4936e Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Mon, 2 Mar 2026 23:13:48 +0500
Subject: [PATCH 196/666] fix(dashboard): restore stock-instance sidebars for
 namespace-level pages

PR #2106 removed stock-instance-* sidebar resources to fix broken URLs
on the main page before namespace selection. However, these sidebars are
required for rendering namespace-level pages (api-table, api-form, etc.)
such as the Backup Plans page.

Without stock-instance-api-table, the frontend cannot find the sidebar
for namespace-scoped api-table pages and renders an empty page instead.

The original bug (broken URLs with empty namespace placeholder) is already
fixed by CUSTOMIZATION_SIDEBAR_FALLBACK_ID="" in web.yaml, so re-adding
stock-instance-* sidebars does not reintroduce it.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 internal/controller/dashboard/manager.go | 4 ++++
 internal/controller/dashboard/sidebar.go | 5 +++++
 2 files changed, 9 insertions(+)

diff --git a/internal/controller/dashboard/manager.go b/internal/controller/dashboard/manager.go
index 339c9b9e..42c641ad 100644
--- a/internal/controller/dashboard/manager.go
+++ b/internal/controller/dashboard/manager.go
@@ -307,6 +307,10 @@ func (m *Manager) buildExpectedResourceSet(crds []cozyv1alpha1.ApplicationDefini
 			"stock-project-builtin-table",
 			"stock-project-crd-form",
 			"stock-project-crd-table",
+			"stock-instance-api-form",
+			"stock-instance-api-table",
+			"stock-instance-builtin-form",
+			"stock-instance-builtin-table",
 		}
 		for _, sidebarID := range stockSidebars {
 			expected["Sidebar"][sidebarID] = true
diff --git a/internal/controller/dashboard/sidebar.go b/internal/controller/dashboard/sidebar.go
index 0ea41f0d..1f1c1670 100644
--- a/internal/controller/dashboard/sidebar.go
+++ b/internal/controller/dashboard/sidebar.go
@@ -243,6 +243,11 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 		"stock-project-builtin-table",
 		"stock-project-crd-form",
 		"stock-project-crd-table",
+		// stock-instance sidebars (namespace-level pages after namespace is selected)
+		"stock-instance-api-form",
+		"stock-instance-api-table",
+		"stock-instance-builtin-form",
+		"stock-instance-builtin-table",
 	}
 
 	// Add details sidebars for all CRDs with dashboard config

From aed46a88192cad70f690138c675e1e7360a24951 Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Mon, 2 Mar 2026 18:45:19 +0000
Subject: [PATCH 197/666] docs: add changelog for v1.0.2

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.0.2.md | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 docs/changelogs/v1.0.2.md

diff --git a/docs/changelogs/v1.0.2.md b/docs/changelogs/v1.0.2.md
new file mode 100644
index 00000000..fad9275e
--- /dev/null
+++ b/docs/changelogs/v1.0.2.md
@@ -0,0 +1,19 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.0.2
+-->
+
+## Fixes
+
+* **[platform] Suspend cozy-proxy if it conflicts with installer release during migration**: Added a check in the v0.41→v1.0 migration script to detect and automatically suspend the `cozy-proxy` HelmRelease when its `releaseName` is set to `cozystack`, which conflicts with the installer release and would cause `cozystack-operator` deletion during the upgrade ([**@kvaps**](https://github.com/kvaps) in #2128, #2130).
+
+* **[platform] Fix off-by-one error in run-migrations script**: Fixed a bug in the migration runner where the first required migration was always skipped due to an off-by-one error in the migration range calculation, ensuring all upgrade steps execute correctly ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2126, #2132).
+
+* **[system] Fix Keycloak proxy configuration for v26.x**: Replaced the deprecated `KC_PROXY=edge` environment variable with `KC_PROXY_HEADERS=xforwarded` and `KC_HTTP_ENABLED=true` in the Keycloak StatefulSet template. `KC_PROXY` was removed in Keycloak 26.x, previously causing "Non-secure context detected" warnings and broken cookie handling when running behind a reverse proxy with TLS termination ([**@sircthulhu**](https://github.com/sircthulhu) in #2125, #2134).
+
+* **[dashboard] Allow clearing instanceType field and preserve newlines in secret copy**: Added `allowEmpty: true` to the `instanceType` field in the VMInstance form so users can explicitly clear it to use custom KubeVirt resources without a named instance type. Also fixed newline preservation when copying secrets with CMD+C ([**@sircthulhu**](https://github.com/sircthulhu) in #2135, #2137).
+
+* **[dashboard] Restore stock-instance sidebars for namespace-level pages**: Restored `stock-instance-api-form`, `stock-instance-api-table`, `stock-instance-builtin-form`, and `stock-instance-builtin-table` sidebar resources that were inadvertently removed in #2106. Without these sidebars, namespace-level pages such as Backup Plans rendered as empty pages with no interactive content ([**@sircthulhu**](https://github.com/sircthulhu) in #2136, #2138).
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.1...v1.0.2

From 780af33ee167b1bfad0a36496bee23202034c969 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Tue, 3 Mar 2026 19:10:39 +0500
Subject: [PATCH 198/666] Fixed packages name conversion in migration script

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 hack/migrate-to-version-1.0.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hack/migrate-to-version-1.0.sh b/hack/migrate-to-version-1.0.sh
index 471a417d..a7c3f9b4 100755
--- a/hack/migrate-to-version-1.0.sh
+++ b/hack/migrate-to-version-1.0.sh
@@ -155,13 +155,13 @@ fi
 if [ -z "$BUNDLE_DISABLE" ]; then
     DISABLED_PACKAGES="[]"
 else
-    DISABLED_PACKAGES=$(echo "$BUNDLE_DISABLE" | sed 's/,/\n/g' | awk 'BEGIN{print}{print "          - "$0}')
+    DISABLED_PACKAGES=$(echo "$BUNDLE_DISABLE" | sed 's/,/\n/g' | awk 'BEGIN{print}{print "          - cozystack."$0}')
 fi
 
 if [ -z "$BUNDLE_ENABLE" ]; then
     ENABLED_PACKAGES="[]"
 else
-    ENABLED_PACKAGES=$(echo "$BUNDLE_ENABLE" | sed 's/,/\n/g' | awk 'BEGIN{print}{print "          - "$0}')
+    ENABLED_PACKAGES=$(echo "$BUNDLE_ENABLE" | sed 's/,/\n/g' | awk 'BEGIN{print}{print "          - cozystack."$0}')
 fi
 
 if [ -z "$EXPOSE_SERVICES" ]; then
@@ -175,7 +175,7 @@ BUNDLE_NAME=$(echo "$BUNDLE_NAME" | sed 's/paas/isp/')
 
 # Extract branding if available
 BRANDING=$(echo "$BRANDING_CM" | jq -r '.data // {} | to_entries[] | "\(.key): \"\(.value)\""')
-if [ -z "$BRANDING" ]; then 
+if [ -z "$BRANDING" ]; then
     BRANDING="{}"
 else
     BRANDING=$(echo "$BRANDING" | awk 'BEGIN{print}{print "          " $0}')

From 9ac8b2d2919c2ee4399f609625d376a89573de3e Mon Sep 17 00:00:00 2001
From: Andrey Kolkov <androndo@gmail.com>
Date: Tue, 3 Mar 2026 18:16:28 +0400
Subject: [PATCH 199/666] fix(backups): rbac actualized

Signed-off-by: Andrey Kolkov <androndo@gmail.com>
---
 .../backup-controller/templates/rbac.yaml     | 24 +++---------------
 .../templates/rbac.yaml                       | 25 +++++++++++++++++++
 2 files changed, 29 insertions(+), 20 deletions(-)

diff --git a/packages/system/backup-controller/templates/rbac.yaml b/packages/system/backup-controller/templates/rbac.yaml
index 255398e8..37ab7243 100644
--- a/packages/system/backup-controller/templates/rbac.yaml
+++ b/packages/system/backup-controller/templates/rbac.yaml
@@ -3,30 +3,14 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: backups.cozystack.io:core-controller
 rules:
+# Plan: reconcile schedule and update status
 - apiGroups: ["backups.cozystack.io"]
   resources: ["plans"]
   verbs: ["get", "list", "watch"]
 - apiGroups: ["backups.cozystack.io"]
-  resources: ["backupjobs"]
-  verbs: ["create", "get", "list", "watch", "update", "patch"]
-- apiGroups: ["backups.cozystack.io"]
-  resources: ["backupjobs/status"]
+  resources: ["plans/status"]
   verbs: ["get", "update", "patch"]
+# BackupJob: create when schedule fires (status is updated by backupstrategy-controller)
 - apiGroups: ["backups.cozystack.io"]
-  resources: ["backups"]
+  resources: ["backupjobs"]
   verbs: ["create", "get", "list", "watch"]
-- apiGroups: ["apps.cozystack.io"]
-  resources: ["buckets", "bucketaccesses", "virtualmachines"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["objectstorage.k8s.io"]
-  resources: ["buckets", "bucketaccesses"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["create", "get", "list", "watch", "update", "patch"]
-- apiGroups: ["kubevirt.io"]
-  resources: ["virtualmachines"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["velero.io"]
-  resources: ["backups", "backupstoragelocations", "volumesnapshotlocations", "restores"]
-  verbs: ["create", "get", "list", "watch", "update", "patch"]
diff --git a/packages/system/backupstrategy-controller/templates/rbac.yaml b/packages/system/backupstrategy-controller/templates/rbac.yaml
index 85431a4b..b69a2744 100644
--- a/packages/system/backupstrategy-controller/templates/rbac.yaml
+++ b/packages/system/backupstrategy-controller/templates/rbac.yaml
@@ -3,9 +3,34 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: backups.cozystack.io:strategy-controller
 rules:
+# Strategy types (Velero, Job)
 - apiGroups: ["strategy.backups.cozystack.io"]
   resources: ["*"]
   verbs: ["get", "list", "watch"]
+# BackupClass: resolve strategy per application
+- apiGroups: ["backups.cozystack.io"]
+  resources: ["backupclasses"]
+  verbs: ["get", "list", "watch"]
+# BackupJob / RestoreJob: reconcile and update status
 - apiGroups: ["backups.cozystack.io"]
   resources: ["backupjobs", "restorejobs"]
   verbs: ["get", "list", "watch"]
+- apiGroups: ["backups.cozystack.io"]
+  resources: ["backupjobs/status", "restorejobs/status"]
+  verbs: ["get", "update", "patch"]
+# Backup: create after Velero backup completes
+- apiGroups: ["backups.cozystack.io"]
+  resources: ["backups"]
+  verbs: ["create", "get", "list", "watch"]
+# Application refs (e.g. VMInstance, VirtualMachine) for backup/restore scope
+- apiGroups: ["apps.cozystack.io"]
+  resources: ["*"]
+  verbs: ["get", "list", "watch"]
+# Velero Backup/Restore in cozy-velero namespace
+- apiGroups: ["velero.io"]
+  resources: ["backups", "restores"]
+  verbs: ["create", "get", "list", "watch", "update", "patch"]
+# Leader election (--leader-elect)
+- apiGroups: ["coordination.k8s.io"]
+  resources: ["leases"]
+  verbs: ["get", "list", "watch", "create", "update", "patch"]

From e822768fcfb56ea75aa7fdb9c2595be4645e1227 Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Fri, 27 Feb 2026 23:04:38 +0300
Subject: [PATCH 200/666] feat(seaweedfs): rename -worm to -lock BucketClass
 and update pool COSI parameters

Rename storage pool COSI resources to use consistent naming:
- BucketClass suffix: -worm -> -lock
- Parameter name: disk -> diskType
- Retention days: 36500 -> 365
- Validation suffix check updated accordingly

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 packages/extra/seaweedfs/templates/seaweedfs.yaml      |  8 ++++----
 .../templates/storage-pool-bucket-classes.yaml         | 10 +++++-----
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/packages/extra/seaweedfs/templates/seaweedfs.yaml b/packages/extra/seaweedfs/templates/seaweedfs.yaml
index f345b00d..42441b26 100644
--- a/packages/extra/seaweedfs/templates/seaweedfs.yaml
+++ b/packages/extra/seaweedfs/templates/seaweedfs.yaml
@@ -32,8 +32,8 @@
 {{-   if not (regexMatch "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$" $poolName) }}
 {{-     fail (printf "volume.pools key '%s' must be a valid DNS label (lowercase alphanumeric and hyphens, no dots)." $poolName) }}
 {{-   end }}
-{{-   if or (hasSuffix "-worm" $poolName) (hasSuffix "-readonly" $poolName) }}
-{{-     fail (printf "volume.pools key '%s' must not end with '-worm' or '-readonly' (reserved suffixes for COSI resources)." $poolName) }}
+{{-   if or (hasSuffix "-lock" $poolName) (hasSuffix "-readonly" $poolName) }}
+{{-     fail (printf "volume.pools key '%s' must not end with '-lock' or '-readonly' (reserved suffixes for COSI resources)." $poolName) }}
 {{-   end }}
 {{-   if not $pool.diskType }}
 {{-     fail (printf "volume.pools.%s.diskType is required." $poolName) }}
@@ -52,8 +52,8 @@
 {{-       if not (regexMatch "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$" $poolName) }}
 {{-         fail (printf "volume.zones.%s.pools key '%s' must be a valid DNS label." $zoneName $poolName) }}
 {{-       end }}
-{{-       if or (hasSuffix "-worm" $poolName) (hasSuffix "-readonly" $poolName) }}
-{{-         fail (printf "volume.zones.%s.pools key '%s' must not end with '-worm' or '-readonly' (reserved suffixes for COSI resources)." $zoneName $poolName) }}
+{{-       if or (hasSuffix "-lock" $poolName) (hasSuffix "-readonly" $poolName) }}
+{{-         fail (printf "volume.zones.%s.pools key '%s' must not end with '-lock' or '-readonly' (reserved suffixes for COSI resources)." $zoneName $poolName) }}
 {{-       end }}
 {{-       if not $pool.diskType }}
 {{-         fail (printf "volume.zones.%s.pools.%s.diskType is required." $zoneName $poolName) }}
diff --git a/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml b/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml
index a3966a68..ea490db6 100644
--- a/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml
+++ b/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml
@@ -20,19 +20,19 @@ metadata:
 driverName: {{ $.Release.Namespace }}.seaweedfs.objectstorage.k8s.io
 deletionPolicy: Delete
 parameters:
-  disk: {{ $diskType }}
+  diskType: {{ $diskType }}
 ---
 kind: BucketClass
 apiVersion: objectstorage.k8s.io/v1alpha1
 metadata:
-  name: {{ $.Release.Namespace }}-{{ $poolName }}-worm
+  name: {{ $.Release.Namespace }}-{{ $poolName }}-lock
 driverName: {{ $.Release.Namespace }}.seaweedfs.objectstorage.k8s.io
 deletionPolicy: Retain
 parameters:
-  disk: {{ $diskType }}
+  diskType: {{ $diskType }}
   objectLockEnabled: "true"
-  objectLockRetentionMode: COMPLIANCE
-  objectLockRetentionDays: "36500"
+  objectLockRetentionMode: "COMPLIANCE"
+  objectLockRetentionDays: "365"
 ---
 kind: BucketAccessClass
 apiVersion: objectstorage.k8s.io/v1alpha1

From 96e27cbcab5fe4c90293d000ea4996afdf4d831d Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Fri, 27 Feb 2026 23:18:56 +0300
Subject: [PATCH 201/666] feat(seaweedfs): add -lock BucketClass and -readonly
 BucketAccessClass

Add COSI resources for object locking and read-only access to both
client topology and system chart:
- BucketClass with -lock suffix (COMPLIANCE mode, 365 days retention)
- BucketAccessClass with -readonly suffix
- Explicit accessPolicy: readwrite on default BucketAccessClass

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 .../templates/client/cosi-bucket-class.yaml   | 22 +++++++++++++++++++
 .../templates/cosi/cosi-bucket-class.yaml     | 15 ++++++++++++-
 2 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/packages/extra/seaweedfs/templates/client/cosi-bucket-class.yaml b/packages/extra/seaweedfs/templates/client/cosi-bucket-class.yaml
index 76eda0dc..ce049b31 100644
--- a/packages/extra/seaweedfs/templates/client/cosi-bucket-class.yaml
+++ b/packages/extra/seaweedfs/templates/client/cosi-bucket-class.yaml
@@ -7,10 +7,32 @@ metadata:
 driverName: {{ .Release.Namespace }}.seaweedfs.objectstorage.k8s.io
 deletionPolicy: Delete
 ---
+kind: BucketClass
+apiVersion: objectstorage.k8s.io/v1alpha1
+metadata:
+  name: {{ .Release.Namespace }}-lock
+driverName: {{ .Release.Namespace }}.seaweedfs.objectstorage.k8s.io
+deletionPolicy: Retain
+parameters:
+  objectLockEnabled: "true"
+  objectLockRetentionMode: "COMPLIANCE"
+  objectLockRetentionDays: "365"
+---
 kind: BucketAccessClass
 apiVersion: objectstorage.k8s.io/v1alpha1
 metadata:
   name: {{ .Release.Namespace }}
 driverName: {{ .Release.Namespace }}.seaweedfs.objectstorage.k8s.io
 authenticationType: KEY
+parameters:
+  accessPolicy: readwrite
+---
+kind: BucketAccessClass
+apiVersion: objectstorage.k8s.io/v1alpha1
+metadata:
+  name: {{ .Release.Namespace }}-readonly
+driverName: {{ .Release.Namespace }}.seaweedfs.objectstorage.k8s.io
+authenticationType: KEY
+parameters:
+  accessPolicy: readonly
 {{- end }}
diff --git a/packages/system/seaweedfs/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml b/packages/system/seaweedfs/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml
index 5184a042..25e00252 100644
--- a/packages/system/seaweedfs/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml
+++ b/packages/system/seaweedfs/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml
@@ -7,12 +7,25 @@ metadata:
 driverName: {{ .Values.cosi.driverName }}
 deletionPolicy: Delete
 ---
+kind: BucketClass
+apiVersion: objectstorage.k8s.io/v1alpha1
+metadata:
+  name: {{ .Values.cosi.bucketClassName }}-lock
+driverName: {{ .Values.cosi.driverName }}
+deletionPolicy: Retain
+parameters:
+  objectLockEnabled: "true"
+  objectLockRetentionMode: "COMPLIANCE"
+  objectLockRetentionDays: "365"
+---
 kind: BucketAccessClass
 apiVersion: objectstorage.k8s.io/v1alpha1
 metadata:
   name: {{ .Values.cosi.bucketClassName }}
 driverName: {{ .Values.cosi.driverName }}
 authenticationType: KEY
+parameters:
+  accessPolicy: readwrite
 ---
 kind: BucketAccessClass
 apiVersion: objectstorage.k8s.io/v1alpha1
@@ -21,5 +34,5 @@ metadata:
 driverName: {{ .Values.cosi.driverName }}
 authenticationType: KEY
 parameters:
-  accessPolicy: "readonly"
+  accessPolicy: readonly
 {{- end }}

From 2dbc27075a1eb1a39debd06aa2a9d7eb336214d6 Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Fri, 27 Feb 2026 23:21:24 +0300
Subject: [PATCH 202/666] feat(bucket): add locking, storagePool, and users
 configuration

Replace hardcoded BucketAccess with user-driven model:
- locking: provisions from -lock BucketClass (object lock enabled)
- storagePool: selects pool-specific BucketClass
- users: map of named users, each creating a BucketAccess with
  optional readonly flag

Empty users map produces zero BucketAccess resources (breaking change).
Update ApplicationDefinition schema and dashboard RBAC accordingly.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 .../apps/bucket/templates/bucketclaim.yaml    | 23 ++++++---------
 .../templates/dashboard-resourcemap.yaml      |  5 ++--
 packages/apps/bucket/values.schema.json       | 28 ++++++++++++++++++-
 packages/apps/bucket/values.yaml              | 12 +++++++-
 packages/system/bucket-rd/cozyrds/bucket.yaml |  4 +--
 5 files changed, 50 insertions(+), 22 deletions(-)

diff --git a/packages/apps/bucket/templates/bucketclaim.yaml b/packages/apps/bucket/templates/bucketclaim.yaml
index e27dd0ed..2f57fd70 100644
--- a/packages/apps/bucket/templates/bucketclaim.yaml
+++ b/packages/apps/bucket/templates/bucketclaim.yaml
@@ -1,29 +1,22 @@
 {{- $seaweedfs := .Values._namespace.seaweedfs }}
+{{- $pool := .Values.storagePool }}
 apiVersion: objectstorage.k8s.io/v1alpha1
 kind: BucketClaim
 metadata:
   name: {{ .Release.Name }}
 spec:
-  bucketClassName: {{ $seaweedfs }}
+  bucketClassName: {{ $seaweedfs }}{{- if $pool }}-{{ $pool }}{{- end }}{{- if .Values.locking }}-lock{{- end }}
   protocols:
     - s3
+{{- range $name, $user := .Values.users }}
 ---
 apiVersion: objectstorage.k8s.io/v1alpha1
 kind: BucketAccess
 metadata:
-  name: {{ .Release.Name }}
+  name: {{ $.Release.Name }}-{{ $name }}
 spec:
-  bucketAccessClassName: {{ $seaweedfs }}
-  bucketClaimName: {{ .Release.Name }}
-  credentialsSecretName: {{ .Release.Name }}
-  protocol: s3
----
-apiVersion: objectstorage.k8s.io/v1alpha1
-kind: BucketAccess
-metadata:
-  name: {{ .Release.Name }}-readonly
-spec:
-  bucketAccessClassName: {{ $seaweedfs }}-readonly
-  bucketClaimName: {{ .Release.Name }}
-  credentialsSecretName: {{ .Release.Name }}-readonly
+  bucketAccessClassName: {{ $seaweedfs }}{{- if $pool }}-{{ $pool }}{{- end }}{{- if $user.readonly }}-readonly{{- end }}
+  bucketClaimName: {{ $.Release.Name }}
+  credentialsSecretName: {{ $.Release.Name }}-{{ $name }}
   protocol: s3
+{{- end }}
diff --git a/packages/apps/bucket/templates/dashboard-resourcemap.yaml b/packages/apps/bucket/templates/dashboard-resourcemap.yaml
index f10b5d32..ec2fb568 100644
--- a/packages/apps/bucket/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/bucket/templates/dashboard-resourcemap.yaml
@@ -8,9 +8,10 @@ rules:
   resources:
   - secrets
   resourceNames:
-  - {{ .Release.Name }}
   - {{ .Release.Name }}-credentials
-  - {{ .Release.Name }}-readonly
+  {{- range $name, $user := .Values.users }}
+  - {{ $.Release.Name }}-{{ $name }}
+  {{- end }}
   verbs: ["get", "list", "watch"]
 - apiGroups:
   - networking.k8s.io
diff --git a/packages/apps/bucket/values.schema.json b/packages/apps/bucket/values.schema.json
index 167bc53e..f661a852 100644
--- a/packages/apps/bucket/values.schema.json
+++ b/packages/apps/bucket/values.schema.json
@@ -1,5 +1,31 @@
 {
   "title": "Chart Values",
   "type": "object",
-  "properties": {}
+  "properties": {
+    "locking": {
+      "description": "Provisions bucket from the -lock BucketClass (with object lock enabled).",
+      "type": "boolean",
+      "default": false
+    },
+    "storagePool": {
+      "description": "Selects a specific BucketClass by storage pool name.",
+      "type": "string",
+      "default": ""
+    },
+    "users": {
+      "description": "Users configuration map. Each entry creates a BucketAccess.",
+      "type": "object",
+      "default": {},
+      "additionalProperties": {
+        "type": "object",
+        "properties": {
+          "readonly": {
+            "description": "Whether the user has read-only access.",
+            "type": "boolean",
+            "default": false
+          }
+        }
+      }
+    }
+  }
 }
diff --git a/packages/apps/bucket/values.yaml b/packages/apps/bucket/values.yaml
index 0967ef42..df284df7 100644
--- a/packages/apps/bucket/values.yaml
+++ b/packages/apps/bucket/values.yaml
@@ -1 +1,11 @@
-{}
+## @param {bool} locking=false - Provisions bucket from the `-lock` BucketClass (with object lock enabled).
+locking: false
+
+## @param {string} [storagePool] - Selects a specific BucketClass by storage pool name.
+storagePool: ""
+
+## @typedef {struct} User - Bucket user configuration.
+## @field {bool} [readonly] - Whether the user has read-only access.
+
+## @param {map[string]User} users - Users configuration map.
+users: {}
diff --git a/packages/system/bucket-rd/cozyrds/bucket.yaml b/packages/system/bucket-rd/cozyrds/bucket.yaml
index 5974b03d..b0194505 100644
--- a/packages/system/bucket-rd/cozyrds/bucket.yaml
+++ b/packages/system/bucket-rd/cozyrds/bucket.yaml
@@ -8,7 +8,7 @@ spec:
     plural: buckets
     singular: bucket
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{}}
+      {"title":"Chart Values","type":"object","properties":{"locking":{"description":"Provisions bucket from the -lock BucketClass (with object lock enabled).","type":"boolean","default":false},"storagePool":{"description":"Selects a specific BucketClass by storage pool name.","type":"string","default":""},"users":{"description":"Users configuration map. Each entry creates a BucketAccess.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"readonly":{"description":"Whether the user has read-only access.","type":"boolean","default":false}}}}}}
   release:
     prefix: bucket-
     labels:
@@ -31,9 +31,7 @@ spec:
     exclude: []
     include:
       - resourceNames:
-          - bucket-{{ .name }}
           - bucket-{{ .name }}-credentials
-          - bucket-{{ .name }}-readonly
   ingresses:
     exclude: []
     include:

From d4043bd71cf3fa2a621ae4a9a97b70a3ee54f44b Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Mon, 2 Mar 2026 20:09:02 +0300
Subject: [PATCH 203/666] fix(seaweedfs): use correct COSI driver parameter
 name 'disk'

The seaweedfs-cosi-driver v0.3.0 expects the parameter key 'disk',
not 'diskType'. Restore the correct key to match the driver's
paramDisk constant.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 .../seaweedfs/templates/storage-pool-bucket-classes.yaml      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml b/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml
index ea490db6..bf58340a 100644
--- a/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml
+++ b/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml
@@ -20,7 +20,7 @@ metadata:
 driverName: {{ $.Release.Namespace }}.seaweedfs.objectstorage.k8s.io
 deletionPolicy: Delete
 parameters:
-  diskType: {{ $diskType }}
+  disk: {{ $diskType }}
 ---
 kind: BucketClass
 apiVersion: objectstorage.k8s.io/v1alpha1
@@ -29,7 +29,7 @@ metadata:
 driverName: {{ $.Release.Namespace }}.seaweedfs.objectstorage.k8s.io
 deletionPolicy: Retain
 parameters:
-  diskType: {{ $diskType }}
+  disk: {{ $diskType }}
   objectLockEnabled: "true"
   objectLockRetentionMode: "COMPLIANCE"
   objectLockRetentionDays: "365"

From 70c6dfd704a926e062314746bc3f4460dfc3ba5d Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Mon, 2 Mar 2026 21:46:08 +0300
Subject: [PATCH 204/666] fix(bucket): include COSI user credential secrets in
 dashboard

Add a catch-all include selector so that COSI-created user credential
secrets (dynamically named per user) are visible in the dashboard.

The lineage webhook already verifies ownership via the graph walk
(Secret -> BucketAccess -> HelmRelease -> Bucket), so an empty selector
safely matches only secrets belonging to this application.

This is needed because COSI sidecar creates secrets without custom
labels, making the matchLabels pattern (used by rabbitmq) inapplicable.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 packages/system/bucket-rd/cozyrds/bucket.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/system/bucket-rd/cozyrds/bucket.yaml b/packages/system/bucket-rd/cozyrds/bucket.yaml
index b0194505..b2519075 100644
--- a/packages/system/bucket-rd/cozyrds/bucket.yaml
+++ b/packages/system/bucket-rd/cozyrds/bucket.yaml
@@ -32,6 +32,7 @@ spec:
     include:
       - resourceNames:
           - bucket-{{ .name }}-credentials
+      - {}
   ingresses:
     exclude: []
     include:

From 757f8b5699963b9feb62fdb56f351c7b9695ae4c Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Tue, 3 Mar 2026 18:48:35 +0300
Subject: [PATCH 205/666] Revert "fix(bucket): include COSI user credential
 secrets in dashboard"

This reverts commit 87b89d90e61283b60abe49cd004d49ce94e57cf5.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 packages/system/bucket-rd/cozyrds/bucket.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/packages/system/bucket-rd/cozyrds/bucket.yaml b/packages/system/bucket-rd/cozyrds/bucket.yaml
index b2519075..b0194505 100644
--- a/packages/system/bucket-rd/cozyrds/bucket.yaml
+++ b/packages/system/bucket-rd/cozyrds/bucket.yaml
@@ -32,7 +32,6 @@ spec:
     include:
       - resourceNames:
           - bucket-{{ .name }}-credentials
-      - {}
   ingresses:
     exclude: []
     include:

From b4f1e96b986605537eaf2a8d46f4ef71b92ebe87 Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Tue, 3 Mar 2026 19:12:27 +0300
Subject: [PATCH 206/666] feat(bucket): include COSI user credential secrets in
 dashboard

Create labeled secrets in the -system chart using lookup to copy
credentials from COSI-created secrets. The ApplicationDefinition
matchLabels selector exposes them in the dashboard.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 .../apps/bucket/templates/helmrelease.yaml    |  1 +
 packages/system/bucket-rd/cozyrds/bucket.yaml |  2 ++
 .../bucket/templates/user-credentials.yaml    | 20 +++++++++++++++++++
 packages/system/bucket/values.yaml            |  1 +
 4 files changed, 24 insertions(+)
 create mode 100644 packages/system/bucket/templates/user-credentials.yaml

diff --git a/packages/apps/bucket/templates/helmrelease.yaml b/packages/apps/bucket/templates/helmrelease.yaml
index 704470a8..d3290512 100644
--- a/packages/apps/bucket/templates/helmrelease.yaml
+++ b/packages/apps/bucket/templates/helmrelease.yaml
@@ -23,3 +23,4 @@ spec:
     name: cozystack-values
   values:
     bucketName: {{ .Release.Name }}
+    users: {{ .Values.users | toJson }}
diff --git a/packages/system/bucket-rd/cozyrds/bucket.yaml b/packages/system/bucket-rd/cozyrds/bucket.yaml
index b0194505..d546f689 100644
--- a/packages/system/bucket-rd/cozyrds/bucket.yaml
+++ b/packages/system/bucket-rd/cozyrds/bucket.yaml
@@ -32,6 +32,8 @@ spec:
     include:
       - resourceNames:
           - bucket-{{ .name }}-credentials
+      - matchLabels:
+          apps.cozystack.io/user-secret: "true"
   ingresses:
     exclude: []
     include:
diff --git a/packages/system/bucket/templates/user-credentials.yaml b/packages/system/bucket/templates/user-credentials.yaml
new file mode 100644
index 00000000..7ccdd731
--- /dev/null
+++ b/packages/system/bucket/templates/user-credentials.yaml
@@ -0,0 +1,20 @@
+{{- range $name, $user := .Values.users }}
+{{- $secretName := printf "%s-%s" $.Values.bucketName $name }}
+{{- $existingSecret := lookup "v1" "Secret" $.Release.Namespace $secretName }}
+{{- if $existingSecret }}
+{{- $bucketInfo := fromJson (b64dec (index $existingSecret.data "BucketInfo")) }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $secretName }}-credentials
+  labels:
+    apps.cozystack.io/user-secret: "true"
+type: Opaque
+stringData:
+  accessKey: {{ index $bucketInfo.spec.secretS3 "accessKeyID" | quote }}
+  secretKey: {{ index $bucketInfo.spec.secretS3 "accessSecretKey" | quote }}
+  endpoint: {{ trimPrefix "https://" (index $bucketInfo.spec.secretS3 "endpoint") }}
+  bucketName: {{ index $bucketInfo.spec "bucketName" | quote }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/bucket/values.yaml b/packages/system/bucket/values.yaml
index e1499c6e..739c4977 100644
--- a/packages/system/bucket/values.yaml
+++ b/packages/system/bucket/values.yaml
@@ -1 +1,2 @@
 bucketName: "cozystack"
+users: {}

From 1d41e270b99b95f9b3ccfe4504e32d184bd55ca4 Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Tue, 3 Mar 2026 19:17:51 +0300
Subject: [PATCH 207/666] fix(bucket): regenerate schema and docs from
 values.yaml annotations

Remove the yq strip of properties from Makefile that was clearing
the schema, and run make generate to sync all generated files.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 packages/apps/bucket/Makefile                 |  1 -
 packages/apps/bucket/README.md                | 10 ++++++++++
 packages/apps/bucket/values.schema.json       |  9 ++++-----
 packages/system/bucket-rd/cozyrds/bucket.yaml |  4 ++--
 4 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/packages/apps/bucket/Makefile b/packages/apps/bucket/Makefile
index 27cd199b..d1cfda8e 100644
--- a/packages/apps/bucket/Makefile
+++ b/packages/apps/bucket/Makefile
@@ -2,5 +2,4 @@ include ../../../hack/package.mk
 
 generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
-	yq -o json -i '.properties = {}' values.schema.json
 	../../../hack/update-crd.sh
diff --git a/packages/apps/bucket/README.md b/packages/apps/bucket/README.md
index 89749b1d..982225ce 100644
--- a/packages/apps/bucket/README.md
+++ b/packages/apps/bucket/README.md
@@ -1,3 +1,13 @@
 # S3 bucket
 
 ## Parameters
+
+### Parameters
+
+| Name                   | Description                                                                | Type                | Value   |
+| ---------------------- | -------------------------------------------------------------------------- | ------------------- | ------- |
+| `locking`              | Provisions bucket from the `-lock` BucketClass (with object lock enabled). | `bool`              | `false` |
+| `storagePool`          | Selects a specific BucketClass by storage pool name.                       | `string`            | `""`    |
+| `users`                | Users configuration map.                                                   | `map[string]object` | `{}`    |
+| `users[name].readonly` | Whether the user has read-only access.                                     | `bool`              | `false` |
+
diff --git a/packages/apps/bucket/values.schema.json b/packages/apps/bucket/values.schema.json
index f661a852..ef213a18 100644
--- a/packages/apps/bucket/values.schema.json
+++ b/packages/apps/bucket/values.schema.json
@@ -3,7 +3,7 @@
   "type": "object",
   "properties": {
     "locking": {
-      "description": "Provisions bucket from the -lock BucketClass (with object lock enabled).",
+      "description": "Provisions bucket from the `-lock` BucketClass (with object lock enabled).",
       "type": "boolean",
       "default": false
     },
@@ -13,7 +13,7 @@
       "default": ""
     },
     "users": {
-      "description": "Users configuration map. Each entry creates a BucketAccess.",
+      "description": "Users configuration map.",
       "type": "object",
       "default": {},
       "additionalProperties": {
@@ -21,11 +21,10 @@
         "properties": {
           "readonly": {
             "description": "Whether the user has read-only access.",
-            "type": "boolean",
-            "default": false
+            "type": "boolean"
           }
         }
       }
     }
   }
-}
+}
\ No newline at end of file
diff --git a/packages/system/bucket-rd/cozyrds/bucket.yaml b/packages/system/bucket-rd/cozyrds/bucket.yaml
index d546f689..7eab56b6 100644
--- a/packages/system/bucket-rd/cozyrds/bucket.yaml
+++ b/packages/system/bucket-rd/cozyrds/bucket.yaml
@@ -8,7 +8,7 @@ spec:
     plural: buckets
     singular: bucket
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"locking":{"description":"Provisions bucket from the -lock BucketClass (with object lock enabled).","type":"boolean","default":false},"storagePool":{"description":"Selects a specific BucketClass by storage pool name.","type":"string","default":""},"users":{"description":"Users configuration map. Each entry creates a BucketAccess.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"readonly":{"description":"Whether the user has read-only access.","type":"boolean","default":false}}}}}}
+      {"title":"Chart Values","type":"object","properties":{"locking":{"description":"Provisions bucket from the `-lock` BucketClass (with object lock enabled).","type":"boolean","default":false},"storagePool":{"description":"Selects a specific BucketClass by storage pool name.","type":"string","default":""},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"readonly":{"description":"Whether the user has read-only access.","type":"boolean"}}}}}}
   release:
     prefix: bucket-
     labels:
@@ -26,7 +26,7 @@ spec:
     tags:
       - storage
     icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl82ODNfMzA5MSkiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik03MiAzMC4xNjQxTDExNy45ODMgMzYuNzc4OVY0MC42NzM5QzExNy45ODMgNDYuNDY1MyA5Ny4zODYyIDUxLjEzMzIgNzEuOTgyNyA1MS4xMzMyQzQ2LjU3OTIgNTEuMTMzMiAyNiA0Ni40NjUzIDI2IDQwLjY3MzlWMzYuNDQzMUw3MiAzMC4xNjQxWk03MiA1OC4yNjc4QzkxLjIwODQgNTguMjY3OCAxMDcuNjU4IDU1LjU5ODYgMTE0LjU0NyA1MS44MDQ4TDExNi44MDMgNDguMTExTDExNy43MjMgNDQuNzUzVjQ4LjkxNzFMMTAyLjY3OSAxMTEuMDMzQzEwMi42NzkgMTE0Ljg5NSA4OC45NTMzIDExOCA3Mi4wMTcyIDExOEM1NS4wODEyIDExOCA0MS4zNzQzIDExNC44OTUgNDEuMzc0MyAxMTEuMDMzTDI2LjMzIDQ4LjkxNzFWNDQuODM2OUwyOS44MDA3IDUxLjkzODJDMzYuNzA2NSA1NS42NjUzIDUyLjk5OTcgNTguMjY3OCA3MiA1OC4yNjc4WiIgZmlsbD0iIzhDMzEyMyIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTcyLjAwMDMgMjZDOTcuNDAzOCAyNiAxMTggMzAuNjgzOSAxMTggMzYuNDQyQzExOCA0Mi4yIDk3LjM4NjYgNDYuODUwNyA3Mi4wMDAzIDQ2Ljg1MDdDNDYuNjE0MSA0Ni44NTA3IDI2LjAxNzYgNDIuMjM0NSAyNi4wMTc2IDM2LjQ0MkMyNi4wMTc2IDMwLjY0OTQgNDYuNTk2OCAyNiA3Mi4wMDAzIDI2Wk03Mi4wMDAzIDU0LjEwMzdDOTUuNjg1NyA1NC4xMDM3IDExNS4xNzIgNTAuMDU4IDExNy43MDYgNDQuODE5N0wxMDIuNjYyIDEwNi45MzdDMTAyLjY2MiAxMTAuNzk5IDg4LjkzNjQgMTEzLjkwNSA3Mi4wMDAzIDExMy45MDVDNTUuMDY0MyAxMTMuOTA1IDQxLjMzOSAxMTAuODE2IDQxLjMzOSAxMDYuOTU0TDI2LjI5NTkgNDQuODM3QzI4Ljg0NjYgNTAuMDU4IDQ4LjMzMzMgNTQuMTAzNyA3Mi4wMDAzIDU0LjEwMzdaIiBmaWxsPSIjRTA1MjQzIi8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNNjEuMTcyNSA2MC4wMjkzSDgxLjA5MjhWNzkuMTY3Nkg2MS4xNzI1VjYwLjAyOTNaTTQ1LjMzMDEgOTUuMzY4OEM0NS4zMzAxIDkwLjE0MiA0OS43MTA0IDg1LjkzNDIgNTUuMTUxMSA4NS45MzQyQzYwLjU5MTcgODUuOTM0MiA2NC45NzIxIDkwLjE0MiA2NC45NzIxIDk1LjM2ODhDNjQuOTcyMSAxMDAuNTk2IDYwLjU5MTcgMTA0LjgwMyA1NS4xNTExIDEwNC44MDNDNDkuNzEwNCAxMDQuODAzIDQ1LjMzMDEgMTAwLjU5NiA0NS4zMzAxIDk1LjM2ODhaTTk2LjQ0ODcgMTA0LjM2OEg3Ni43NzIyTDg2LjYxMDUgODYuNzczN0w5Ni40NDg3IDEwNC4zNjhaIiBmaWxsPSJ3aGl0ZSIvPgo8ZGVmcz4KPGxpbmVhckdyYWRpZW50IGlkPSJwYWludDBfbGluZWFyXzY4M18zMDkxIiB4MT0iMCIgeTE9IjAiIHgyPSIxNTEiIHkyPSIxODAiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj4KPHN0b3Agc3RvcC1jb2xvcj0iI0ZGRjBFRSIvPgo8c3RvcCBvZmZzZXQ9IjEiIHN0b3AtY29sb3I9IiNFQzg4N0QiLz4KPC9saW5lYXJHcmFkaWVudD4KPC9kZWZzPgo8L3N2Zz4K
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "locking"], ["spec", "storagePool"], ["spec", "users"]]
   secrets:
     exclude: []
     include:

From 79b2546e676012dcea691e19b1aabe4a78ec51ac Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Tue, 3 Mar 2026 21:34:37 +0300
Subject: [PATCH 208/666] fix(kubernetes): set explicit MTU for Cilium in
 tenant clusters

Cilium's MTU auto-detection does not account for VXLAN overhead when
running inside KubeVirt VMs. The VM interface inherits MTU 1400 from
the parent OVN/Geneve overlay, and Cilium sets all interfaces
(cilium_vxlan, lxc*, cilium_host/net) to 1400 without subtracting
the 50-byte VXLAN encapsulation overhead.

This causes intermittent packet drops for large packets (TLS
handshakes, HTTP responses with data), resulting in timeouts and
499 errors for services running in tenant clusters.

Set MTU to 1350 (1400 - 50 VXLAN overhead) explicitly in the default
Cilium values for tenant Kubernetes clusters.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 packages/apps/kubernetes/templates/helmreleases/cilium.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/apps/kubernetes/templates/helmreleases/cilium.yaml b/packages/apps/kubernetes/templates/helmreleases/cilium.yaml
index 64027e94..d032f5b6 100644
--- a/packages/apps/kubernetes/templates/helmreleases/cilium.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/cilium.yaml
@@ -3,6 +3,7 @@ cilium:
   k8sServiceHost: {{ .Release.Name }}.{{ .Release.Namespace }}.svc
   k8sServicePort: 6443
   routingMode: tunnel
+  MTU: 1350
   enableIPv4Masquerade: true
   ipv4NativeRoutingCIDR: ""
   {{- if $.Values.addons.gatewayAPI.enabled }}

From 9e6c240d6e9ae3bf4b77fa8ea5ba4384628b9562 Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Wed, 4 Mar 2026 00:34:33 +0300
Subject: [PATCH 209/666] fix(bucket): use per-user COSI secret for UI
 credentials

The default BucketAccess was removed in favor of per-user access.
Update secret.yaml to look up the first user's COSI secret instead
of the non-existent default one, with nil-check for race conditions.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 packages/system/bucket/templates/secret.yaml | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/packages/system/bucket/templates/secret.yaml b/packages/system/bucket/templates/secret.yaml
index 15474569..07450ec7 100644
--- a/packages/system/bucket/templates/secret.yaml
+++ b/packages/system/bucket/templates/secret.yaml
@@ -1,14 +1,18 @@
-{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace .Values.bucketName }}
+{{- $users := keys .Values.users | sortAlpha }}
+{{- if $users }}
+{{- $firstUser := index $users 0 }}
+{{- $secretName := printf "%s-%s" .Values.bucketName $firstUser }}
+{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace $secretName }}
+{{- if $existingSecret }}
 {{- $bucketInfo := fromJson (b64dec (index $existingSecret.data "BucketInfo")) }}
 {{- $accessKeyID := index $bucketInfo.spec.secretS3 "accessKeyID" }}
 {{- $accessSecretKey := index $bucketInfo.spec.secretS3 "accessSecretKey" }}
 {{- $endpoint := index $bucketInfo.spec.secretS3 "endpoint" }}
 {{- $bucketName := index $bucketInfo.spec "bucketName" }}
-
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ .Values.bucketName }}-credentials
+  name: {{ $.Values.bucketName }}-credentials
 type: Opaque
 stringData:
   accessKey: {{ $accessKeyID | quote }}
@@ -19,6 +23,8 @@ stringData:
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ .Values.bucketName }}-ui-auth
+  name: {{ $.Values.bucketName }}-ui-auth
 data:
   auth: {{ htpasswd $accessKeyID $accessSecretKey | b64enc | quote }}
+{{- end }}
+{{- end }}

From 69e0320e3adae2c1f5bba6b6e574374c0745fcbb Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Wed, 4 Mar 2026 17:02:36 +0300
Subject: [PATCH 210/666] fix(bucket): remove duplicate credentials from
 dashboard

Show only per-user credential secrets in the dashboard instead of
both the internal UI secret and per-user secrets.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 packages/apps/bucket/templates/dashboard-resourcemap.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/packages/apps/bucket/templates/dashboard-resourcemap.yaml b/packages/apps/bucket/templates/dashboard-resourcemap.yaml
index ec2fb568..82a51e16 100644
--- a/packages/apps/bucket/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/bucket/templates/dashboard-resourcemap.yaml
@@ -8,9 +8,8 @@ rules:
   resources:
   - secrets
   resourceNames:
-  - {{ .Release.Name }}-credentials
   {{- range $name, $user := .Values.users }}
-  - {{ $.Release.Name }}-{{ $name }}
+  - {{ $.Release.Name }}-{{ $name }}-credentials
   {{- end }}
   verbs: ["get", "list", "watch"]
 - apiGroups:

From f777f659d5a1393b07a3489abd215c7ad36caa30 Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Wed, 4 Mar 2026 18:30:40 +0300
Subject: [PATCH 211/666] feat(bucket): add login screen to s3manager for
 credentialless mode

When a bucket has no users configured, s3manager previously crashed
due to missing ACCESS_KEY_ID/SECRET_ACCESS_KEY env vars. This adds
a login mode where users enter their S3 credentials via a web form.

New Go code (via cozystack.patch):
- auth.go: session-based auth middleware, login/logout handlers,
  per-request S3 client from encrypted cookie session
- login.html.tmpl: Materialize CSS login form
- main.go: LoginMode toggle, conditional route setup
- Dependency: gorilla/sessions for AES-256 encrypted cookies

Dockerfile: add go mod tidy step for new dependency resolution.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 .../system/bucket/images/s3manager/Dockerfile |   1 +
 .../bucket/images/s3manager/cozystack.patch   | 473 ++++++++++++++++++
 2 files changed, 474 insertions(+)

diff --git a/packages/system/bucket/images/s3manager/Dockerfile b/packages/system/bucket/images/s3manager/Dockerfile
index 179acead..e97adf07 100644
--- a/packages/system/bucket/images/s3manager/Dockerfile
+++ b/packages/system/bucket/images/s3manager/Dockerfile
@@ -9,6 +9,7 @@ WORKDIR /usr/src/app
 RUN wget -O- https://github.com/cloudlena/s3manager/archive/9a7c8e446b422f8973b8c461990f39fdafee9c27.tar.gz | tar -xzf- --strip 1
 ADD cozystack.patch /
 RUN git apply /cozystack.patch
+RUN go mod tidy
 RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -ldflags="-s -w" -a -installsuffix cgo -o bin/s3manager
 
 FROM docker.io/library/alpine:latest
diff --git a/packages/system/bucket/images/s3manager/cozystack.patch b/packages/system/bucket/images/s3manager/cozystack.patch
index f631b144..9e98edde 100644
--- a/packages/system/bucket/images/s3manager/cozystack.patch
+++ b/packages/system/bucket/images/s3manager/cozystack.patch
@@ -1,3 +1,401 @@
+diff --git a/go.mod b/go.mod
+index b5d8540..6ede8e8 100644
+--- a/go.mod
++++ b/go.mod
+@@ -1,10 +1,11 @@
+ module github.com/cloudlena/s3manager
+ 
+-go 1.22.5
++go 1.23
+ 
+ require (
+ 	github.com/cloudlena/adapters v0.0.0-20240708203353-a39be02cc801
+ 	github.com/gorilla/mux v1.8.1
++	github.com/gorilla/sessions v1.4.0
+ 	github.com/matryer/is v1.4.1
+ 	github.com/minio/minio-go/v7 v7.0.74
+ 	github.com/spf13/viper v1.19.0
+@@ -16,6 +17,7 @@ require (
+ 	github.com/go-ini/ini v1.67.0 // indirect
+ 	github.com/goccy/go-json v0.10.3 // indirect
+ 	github.com/google/uuid v1.6.0 // indirect
++	github.com/gorilla/securecookie v1.1.2 // indirect
+ 	github.com/hashicorp/hcl v1.0.0 // indirect
+ 	github.com/klauspost/compress v1.17.9 // indirect
+ 	github.com/klauspost/cpuid/v2 v2.2.8 // indirect
+diff --git a/internal/app/s3manager/auth.go b/internal/app/s3manager/auth.go
+new file mode 100644
+index 0000000..a315cde
+--- /dev/null
++++ b/internal/app/s3manager/auth.go
+@@ -0,0 +1,173 @@
++package s3manager
++
++import (
++	"context"
++	"crypto/rand"
++	"crypto/tls"
++	"fmt"
++	"html/template"
++	"io/fs"
++	"net/http"
++
++	"github.com/gorilla/sessions"
++	"github.com/minio/minio-go/v7"
++	"github.com/minio/minio-go/v7/pkg/credentials"
++)
++
++type contextKey string
++
++const s3ContextKey contextKey = "s3client"
++
++// S3FromContext retrieves the S3 client from the request context.
++func S3FromContext(ctx context.Context) S3 {
++	s3, _ := ctx.Value(s3ContextKey).(S3)
++	return s3
++}
++
++func contextWithS3(ctx context.Context, s3 S3) context.Context {
++	return context.WithValue(ctx, s3ContextKey, s3)
++}
++
++// NewS3Client creates a new minio S3 client with the given credentials.
++func NewS3Client(endpoint, accessKey, secretKey string, useSSL, skipVerify bool) (*minio.Client, error) {
++	opts := &minio.Options{
++		Creds:  credentials.NewStaticV4(accessKey, secretKey, ""),
++		Secure: useSSL,
++	}
++	if useSSL && skipVerify {
++		opts.Transport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} //nolint:gosec
++	}
++	return minio.New(endpoint, opts)
++}
++
++// NewSessionStore creates a new encrypted cookie store with a random key.
++func NewSessionStore() *sessions.CookieStore {
++	key := make([]byte, 32)
++	if _, err := rand.Read(key); err != nil {
++		panic(fmt.Sprintf("failed to generate session key: %v", err))
++	}
++	store := sessions.NewCookieStore(key)
++	store.Options = &sessions.Options{
++		Path:     "/",
++		MaxAge:   86400, // 24 hours
++		HttpOnly: true,
++		Secure:   true,
++		SameSite: http.SameSiteLaxMode,
++	}
++	return store
++}
++
++// RequireAuth is middleware that checks for valid S3 credentials in the session.
++func RequireAuth(store *sessions.CookieStore, endpoint string, useSSL, skipVerify bool) func(http.Handler) http.Handler {
++	return func(next http.Handler) http.Handler {
++		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++			session, err := store.Get(r, "s3session")
++			if err != nil {
++				http.Redirect(w, r, "/login", http.StatusFound)
++				return
++			}
++
++			accessKey, ok1 := session.Values["accessKey"].(string)
++			secretKey, ok2 := session.Values["secretKey"].(string)
++			if !ok1 || !ok2 || accessKey == "" || secretKey == "" {
++				http.Redirect(w, r, "/login", http.StatusFound)
++				return
++			}
++
++			s3Client, err := NewS3Client(endpoint, accessKey, secretKey, useSSL, skipVerify)
++			if err != nil {
++				http.Redirect(w, r, "/login?error=invalid_credentials", http.StatusFound)
++				return
++			}
++
++			ctx := contextWithS3(r.Context(), s3Client)
++			next.ServeHTTP(w, r.WithContext(ctx))
++		})
++	}
++}
++
++// HandleLoginView renders the login page.
++func HandleLoginView(templates fs.FS) http.HandlerFunc {
++	return func(w http.ResponseWriter, r *http.Request) {
++		data := struct {
++			Error string
++		}{
++			Error: r.URL.Query().Get("error"),
++		}
++		t, err := template.ParseFS(templates, "layout.html.tmpl", "login.html.tmpl")
++		if err != nil {
++			handleHTTPError(w, fmt.Errorf("error parsing login template: %w", err))
++			return
++		}
++		err = t.ExecuteTemplate(w, "layout", data)
++		if err != nil {
++			handleHTTPError(w, fmt.Errorf("error executing login template: %w", err))
++			return
++		}
++	}
++}
++
++// HandleLogin processes login form submission.
++func HandleLogin(store *sessions.CookieStore, endpoint string, useSSL, skipVerify bool) http.HandlerFunc {
++	return func(w http.ResponseWriter, r *http.Request) {
++		accessKey := r.FormValue("accessKey")
++		secretKey := r.FormValue("secretKey")
++
++		if accessKey == "" || secretKey == "" {
++			http.Redirect(w, r, "/login?error=credentials_required", http.StatusFound)
++			return
++		}
++
++		// Validate credentials by attempting to list buckets
++		s3Client, err := NewS3Client(endpoint, accessKey, secretKey, useSSL, skipVerify)
++		if err != nil {
++			http.Redirect(w, r, "/login?error=invalid_credentials", http.StatusFound)
++			return
++		}
++
++		_, err = s3Client.ListBuckets(r.Context())
++		if err != nil {
++			http.Redirect(w, r, "/login?error=invalid_credentials", http.StatusFound)
++			return
++		}
++
++		session, err := store.Get(r, "s3session")
++		if err != nil {
++			http.Redirect(w, r, "/login?error=session_error", http.StatusFound)
++			return
++		}
++
++		session.Values["accessKey"] = accessKey
++		session.Values["secretKey"] = secretKey
++		if err := session.Save(r, w); err != nil {
++			http.Redirect(w, r, "/login?error=session_error", http.StatusFound)
++			return
++		}
++
++		http.Redirect(w, r, "/buckets", http.StatusFound)
++	}
++}
++
++// HandleLogout destroys the session and redirects to login.
++func HandleLogout(store *sessions.CookieStore) http.HandlerFunc {
++	return func(w http.ResponseWriter, r *http.Request) {
++		session, err := store.Get(r, "s3session")
++		if err == nil {
++			session.Options.MaxAge = -1
++			_ = session.Save(r, w)
++		}
++		http.Redirect(w, r, "/login", http.StatusFound)
++	}
++}
++
++// DynamicS3Handler wraps a handler factory that takes S3 as its only parameter.
++func DynamicS3Handler(factory func(S3) http.HandlerFunc) http.HandlerFunc {
++	return func(w http.ResponseWriter, r *http.Request) {
++		s3 := S3FromContext(r.Context())
++		if s3 == nil {
++			http.Redirect(w, r, "/login", http.StatusFound)
++			return
++		}
++		factory(s3).ServeHTTP(w, r)
++	}
++}
+diff --git a/main.go b/main.go
+index 2ffe8ab..5fdc4cd 100644
+--- a/main.go
++++ b/main.go
+@@ -41,10 +41,12 @@ type configuration struct {
+ 	Timeout             int32
+ 	SseType             string
+ 	SseKey              string
++	LoginMode           bool
+ }
+ 
+ func parseConfiguration() configuration {
+ 	var accessKeyID, secretAccessKey, iamEndpoint string
++	var loginMode bool
+ 
+ 	viper.AutomaticEnv()
+ 
+@@ -57,13 +59,11 @@ func parseConfiguration() configuration {
+ 		iamEndpoint = viper.GetString("IAM_ENDPOINT")
+ 	} else {
+ 		accessKeyID = viper.GetString("ACCESS_KEY_ID")
+-		if len(accessKeyID) == 0 {
+-			log.Fatal("please provide ACCESS_KEY_ID")
+-		}
+-
+ 		secretAccessKey = viper.GetString("SECRET_ACCESS_KEY")
+-		if len(secretAccessKey) == 0 {
+-			log.Fatal("please provide SECRET_ACCESS_KEY")
++
++		if len(accessKeyID) == 0 || len(secretAccessKey) == 0 {
++			log.Println("ACCESS_KEY_ID or SECRET_ACCESS_KEY not set, starting in login mode")
++			loginMode = true
+ 		}
+ 	}
+ 
+@@ -115,6 +115,7 @@ func parseConfiguration() configuration {
+ 		Timeout:             timeout,
+ 		SseType:             sseType,
+ 		SseKey:              sseKey,
++		LoginMode:           loginMode,
+ 	}
+ }
+ 
+@@ -135,57 +136,103 @@ func main() {
+ 		log.Fatal(err)
+ 	}
+ 
+-	// Set up S3 client
+-	opts := &minio.Options{
+-		Secure: configuration.UseSSL,
+-	}
+-	if configuration.UseIam {
+-		opts.Creds = credentials.NewIAM(configuration.IamEndpoint)
++	// Set up router
++	r := mux.NewRouter()
++	r.PathPrefix("/static/").Handler(http.StripPrefix("/static/", http.FileServer(http.FS(statics)))).Methods(http.MethodGet)
++
++	if configuration.LoginMode {
++		// Login mode: no pre-configured S3 client, use per-session credentials
++		store := s3manager.NewSessionStore()
++		authMiddleware := s3manager.RequireAuth(store, configuration.Endpoint, configuration.UseSSL, configuration.SkipSSLVerification)
++
++		// Public routes
++		r.Handle("/login", s3manager.HandleLoginView(templates)).Methods(http.MethodGet)
++		r.Handle("/login", s3manager.HandleLogin(store, configuration.Endpoint, configuration.UseSSL, configuration.SkipSSLVerification)).Methods(http.MethodPost)
++		r.Handle("/logout", s3manager.HandleLogout(store)).Methods(http.MethodPost)
++
++		// Protected routes - use dynamic S3 client from session
++		protected := r.PathPrefix("/").Subrouter()
++		protected.Use(authMiddleware)
++
++		protected.Handle("/", http.RedirectHandler("/buckets", http.StatusPermanentRedirect)).Methods(http.MethodGet)
++		protected.Handle("/buckets", s3manager.DynamicS3Handler(func(s3 s3manager.S3) http.HandlerFunc {
++			return s3manager.HandleBucketsView(s3, templates, configuration.AllowDelete)
++		})).Methods(http.MethodGet)
++		protected.PathPrefix("/buckets/").Handler(s3manager.DynamicS3Handler(func(s3 s3manager.S3) http.HandlerFunc {
++			return s3manager.HandleBucketView(s3, templates, configuration.AllowDelete, configuration.ListRecursive)
++		})).Methods(http.MethodGet)
++		protected.Handle("/api/buckets", s3manager.DynamicS3Handler(func(s3 s3manager.S3) http.HandlerFunc {
++			return s3manager.HandleCreateBucket(s3)
++		})).Methods(http.MethodPost)
++		if configuration.AllowDelete {
++			protected.Handle("/api/buckets/{bucketName}", s3manager.DynamicS3Handler(func(s3 s3manager.S3) http.HandlerFunc {
++				return s3manager.HandleDeleteBucket(s3)
++			})).Methods(http.MethodDelete)
++		}
++		protected.Handle("/api/buckets/{bucketName}/objects", s3manager.DynamicS3Handler(func(s3 s3manager.S3) http.HandlerFunc {
++			return s3manager.HandleCreateObject(s3, sseType)
++		})).Methods(http.MethodPost)
++		protected.Handle("/api/buckets/{bucketName}/objects/{objectName:.*}/url", s3manager.DynamicS3Handler(func(s3 s3manager.S3) http.HandlerFunc {
++			return s3manager.HandleGenerateUrl(s3)
++		})).Methods(http.MethodGet)
++		protected.Handle("/api/buckets/{bucketName}/objects/{objectName:.*}", s3manager.DynamicS3Handler(func(s3 s3manager.S3) http.HandlerFunc {
++			return s3manager.HandleGetObject(s3, configuration.ForceDownload)
++		})).Methods(http.MethodGet)
++		if configuration.AllowDelete {
++			protected.Handle("/api/buckets/{bucketName}/objects/{objectName:.*}", s3manager.DynamicS3Handler(func(s3 s3manager.S3) http.HandlerFunc {
++				return s3manager.HandleDeleteObject(s3)
++			})).Methods(http.MethodDelete)
++		}
+ 	} else {
+-		var signatureType credentials.SignatureType
+-
+-		switch configuration.SignatureType {
+-		case "V2":
+-			signatureType = credentials.SignatureV2
+-		case "V4":
+-			signatureType = credentials.SignatureV4
+-		case "V4Streaming":
+-			signatureType = credentials.SignatureV4Streaming
+-		case "Anonymous":
+-			signatureType = credentials.SignatureAnonymous
+-		default:
+-			log.Fatalf("Invalid SIGNATURE_TYPE: %s", configuration.SignatureType)
++		// Pre-configured mode: existing behavior with static S3 client
++		opts := &minio.Options{
++			Secure: configuration.UseSSL,
++		}
++		if configuration.UseIam {
++			opts.Creds = credentials.NewIAM(configuration.IamEndpoint)
++		} else {
++			var signatureType credentials.SignatureType
++
++			switch configuration.SignatureType {
++			case "V2":
++				signatureType = credentials.SignatureV2
++			case "V4":
++				signatureType = credentials.SignatureV4
++			case "V4Streaming":
++				signatureType = credentials.SignatureV4Streaming
++			case "Anonymous":
++				signatureType = credentials.SignatureAnonymous
++			default:
++				log.Fatalf("Invalid SIGNATURE_TYPE: %s", configuration.SignatureType)
++			}
++
++			opts.Creds = credentials.NewStatic(configuration.AccessKeyID, configuration.SecretAccessKey, "", signatureType)
+ 		}
+ 
+-		opts.Creds = credentials.NewStatic(configuration.AccessKeyID, configuration.SecretAccessKey, "", signatureType)
+-	}
+-
+-	if configuration.Region != "" {
+-		opts.Region = configuration.Region
+-	}
+-	if configuration.UseSSL && configuration.SkipSSLVerification {
+-		opts.Transport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} //nolint:gosec
+-	}
+-	s3, err := minio.New(configuration.Endpoint, opts)
+-	if err != nil {
+-		log.Fatalln(fmt.Errorf("error creating s3 client: %w", err))
+-	}
++		if configuration.Region != "" {
++			opts.Region = configuration.Region
++		}
++		if configuration.UseSSL && configuration.SkipSSLVerification {
++			opts.Transport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} //nolint:gosec
++		}
++		s3, err := minio.New(configuration.Endpoint, opts)
++		if err != nil {
++			log.Fatalln(fmt.Errorf("error creating s3 client: %w", err))
++		}
+ 
+-	// Set up router
+-	r := mux.NewRouter()
+-	r.Handle("/", http.RedirectHandler("/buckets", http.StatusPermanentRedirect)).Methods(http.MethodGet)
+-	r.PathPrefix("/static/").Handler(http.StripPrefix("/static/", http.FileServer(http.FS(statics)))).Methods(http.MethodGet)
+-	r.Handle("/buckets", s3manager.HandleBucketsView(s3, templates, configuration.AllowDelete)).Methods(http.MethodGet)
+-	r.PathPrefix("/buckets/").Handler(s3manager.HandleBucketView(s3, templates, configuration.AllowDelete, configuration.ListRecursive)).Methods(http.MethodGet)
+-	r.Handle("/api/buckets", s3manager.HandleCreateBucket(s3)).Methods(http.MethodPost)
+-	if configuration.AllowDelete {
+-		r.Handle("/api/buckets/{bucketName}", s3manager.HandleDeleteBucket(s3)).Methods(http.MethodDelete)
+-	}
+-	r.Handle("/api/buckets/{bucketName}/objects", s3manager.HandleCreateObject(s3, sseType)).Methods(http.MethodPost)
+-	r.Handle("/api/buckets/{bucketName}/objects/{objectName:.*}/url", s3manager.HandleGenerateUrl(s3)).Methods(http.MethodGet)
+-	r.Handle("/api/buckets/{bucketName}/objects/{objectName:.*}", s3manager.HandleGetObject(s3, configuration.ForceDownload)).Methods(http.MethodGet)
+-	if configuration.AllowDelete {
+-		r.Handle("/api/buckets/{bucketName}/objects/{objectName:.*}", s3manager.HandleDeleteObject(s3)).Methods(http.MethodDelete)
++		r.Handle("/", http.RedirectHandler("/buckets", http.StatusPermanentRedirect)).Methods(http.MethodGet)
++		r.Handle("/buckets", s3manager.HandleBucketsView(s3, templates, configuration.AllowDelete)).Methods(http.MethodGet)
++		r.PathPrefix("/buckets/").Handler(s3manager.HandleBucketView(s3, templates, configuration.AllowDelete, configuration.ListRecursive)).Methods(http.MethodGet)
++		r.Handle("/api/buckets", s3manager.HandleCreateBucket(s3)).Methods(http.MethodPost)
++		if configuration.AllowDelete {
++			r.Handle("/api/buckets/{bucketName}", s3manager.HandleDeleteBucket(s3)).Methods(http.MethodDelete)
++		}
++		r.Handle("/api/buckets/{bucketName}/objects", s3manager.HandleCreateObject(s3, sseType)).Methods(http.MethodPost)
++		r.Handle("/api/buckets/{bucketName}/objects/{objectName:.*}/url", s3manager.HandleGenerateUrl(s3)).Methods(http.MethodGet)
++		r.Handle("/api/buckets/{bucketName}/objects/{objectName:.*}", s3manager.HandleGetObject(s3, configuration.ForceDownload)).Methods(http.MethodGet)
++		if configuration.AllowDelete {
++			r.Handle("/api/buckets/{bucketName}/objects/{objectName:.*}", s3manager.HandleDeleteObject(s3)).Methods(http.MethodDelete)
++		}
+ 	}
+ 
+ 	lr := logging.Handler(os.Stdout)(r)
 diff --git a/web/template/bucket.html.tmpl b/web/template/bucket.html.tmpl
 index e2f8d28..87add13 100644
 --- a/web/template/bucket.html.tmpl
@@ -24,3 +422,78 @@ index c7ea184..fb1dce7 100644
      </div>
  </nav>
  
+diff --git a/web/template/login.html.tmpl b/web/template/login.html.tmpl
+new file mode 100644
+index 0000000..7a1730a
+--- /dev/null
++++ b/web/template/login.html.tmpl
+@@ -0,0 +1,69 @@
++{{ define "content" }}
++<nav>
++    <div class="nav-wrapper container">
++        <a href="/" class="brand-logo">Cozystack S3 Manager</a>
++    </div>
++</nav>
++
++<div class="container">
++    <div class="section">
++        <div class="row">
++            <div class="col l6 offset-l3 m8 offset-m2 s12">
++                <div class="card">
++                    <div class="card-content">
++                        <span class="card-title">Login</span>
++                        <p>Enter your S3 credentials to access buckets.</p>
++                        <br>
++
++                        {{ if eq .Error "invalid_credentials" }}
++                        <div class="card-panel red lighten-4 red-text text-darken-4">
++                            <i class="material-icons tiny">error</i>
++                            Invalid credentials. Please check your Access Key and Secret Key.
++                        </div>
++                        {{ end }}
++
++                        {{ if eq .Error "credentials_required" }}
++                        <div class="card-panel red lighten-4 red-text text-darken-4">
++                            <i class="material-icons tiny">error</i>
++                            Both Access Key ID and Secret Access Key are required.
++                        </div>
++                        {{ end }}
++
++                        {{ if eq .Error "session_error" }}
++                        <div class="card-panel red lighten-4 red-text text-darken-4">
++                            <i class="material-icons tiny">error</i>
++                            Session error. Please try again.
++                        </div>
++                        {{ end }}
++
++                        <form method="POST" action="/login">
++                            <div class="row">
++                                <div class="input-field col s12">
++                                    <i class="material-icons prefix">vpn_key</i>
++                                    <input id="accessKey" name="accessKey" type="text" required>
++                                    <label for="accessKey">Access Key ID</label>
++                                </div>
++                            </div>
++                            <div class="row">
++                                <div class="input-field col s12">
++                                    <i class="material-icons prefix">lock</i>
++                                    <input id="secretKey" name="secretKey" type="password" required>
++                                    <label for="secretKey">Secret Access Key</label>
++                                </div>
++                            </div>
++                            <div class="row">
++                                <div class="col s12">
++                                    <button type="submit" class="btn waves-effect waves-light" style="width:100%;">
++                                        Sign In
++                                        <i class="material-icons right">send</i>
++                                    </button>
++                                </div>
++                            </div>
++                        </form>
++                    </div>
++                </div>
++            </div>
++        </div>
++    </div>
++</div>
++{{ end }}

From 175b3badd2642a21d249fcac590f807b66a6fa2c Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Wed, 4 Mar 2026 18:30:49 +0300
Subject: [PATCH 212/666] feat(bucket): make credentials and basic auth
 conditional on users

deployment.yaml: use s3._namespace.host for ENDPOINT instead of
secret ref, inject ACCESS_KEY_ID/SECRET_ACCESS_KEY only when users
exist. Without users, s3manager starts in login mode.

ingress.yaml: nginx basic auth annotations only when users exist.
Without users, s3manager handles authentication via its login form.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 packages/system/bucket/templates/deployment.yaml | 8 ++++----
 packages/system/bucket/templates/ingress.yaml    | 3 +++
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/packages/system/bucket/templates/deployment.yaml b/packages/system/bucket/templates/deployment.yaml
index 7e115de0..086a6934 100644
--- a/packages/system/bucket/templates/deployment.yaml
+++ b/packages/system/bucket/templates/deployment.yaml
@@ -1,3 +1,4 @@
+{{- $users := keys .Values.users | sortAlpha }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -17,12 +18,10 @@ spec:
         image: "{{ $.Files.Get "images/s3manager.tag" | trim }}"
         env:
         - name: ENDPOINT
-          valueFrom:
-            secretKeyRef:
-              name: {{ .Values.bucketName }}-credentials
-              key: endpoint
+          value: "s3.{{ .Values._namespace.host }}"
         - name: SKIP_SSL_VERIFICATION
           value: "true"
+        {{- if $users }}
         - name: ACCESS_KEY_ID
           valueFrom:
             secretKeyRef:
@@ -33,3 +32,4 @@ spec:
             secretKeyRef:
               name: {{ .Values.bucketName }}-credentials
               key: secretKey
+        {{- end }}
diff --git a/packages/system/bucket/templates/ingress.yaml b/packages/system/bucket/templates/ingress.yaml
index 9ad9f46d..e54fede3 100644
--- a/packages/system/bucket/templates/ingress.yaml
+++ b/packages/system/bucket/templates/ingress.yaml
@@ -2,15 +2,18 @@
 {{- $ingress := .Values._namespace.ingress }}
 {{- $solver := (index .Values._cluster "solver") | default "http01" }}
 {{- $clusterIssuer := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }}
+{{- $users := keys .Values.users | sortAlpha }}
 
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: {{ .Values.bucketName }}-ui
   annotations:
+    {{- if $users }}
     nginx.ingress.kubernetes.io/auth-type: "basic"
     nginx.ingress.kubernetes.io/auth-secret: "{{ .Values.bucketName }}-ui-auth"
     nginx.ingress.kubernetes.io/auth-realm: "Authentication Required"
+    {{- end }}
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
     nginx.ingress.kubernetes.io/proxy-read-timeout: "99999"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "99999"

From 84da47a2ce5494cab5ddefe6c3922a53201635a1 Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Wed, 4 Mar 2026 18:47:51 +0300
Subject: [PATCH 213/666] refactor(bucket): replace basic auth with s3manager
 login page

Remove nginx basic auth and credential secret injection from the
bucket Helm chart. s3manager now always starts in login mode and
handles authentication via its own login page with encrypted
session cookies. This eliminates the dependency on the -credentials
and -ui-auth secrets for the UI layer.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 .../bucket/images/s3manager/cozystack.patch   | 648 ++++++++++--------
 .../system/bucket/templates/deployment.yaml   |  13 -
 packages/system/bucket/templates/ingress.yaml |   6 -
 packages/system/bucket/templates/secret.yaml  |  32 +-
 4 files changed, 353 insertions(+), 346 deletions(-)

diff --git a/packages/system/bucket/images/s3manager/cozystack.patch b/packages/system/bucket/images/s3manager/cozystack.patch
index 9e98edde..2f569042 100644
--- a/packages/system/bucket/images/s3manager/cozystack.patch
+++ b/packages/system/bucket/images/s3manager/cozystack.patch
@@ -23,187 +23,29 @@ index b5d8540..6ede8e8 100644
  	github.com/hashicorp/hcl v1.0.0 // indirect
  	github.com/klauspost/compress v1.17.9 // indirect
  	github.com/klauspost/cpuid/v2 v2.2.8 // indirect
-diff --git a/internal/app/s3manager/auth.go b/internal/app/s3manager/auth.go
-new file mode 100644
-index 0000000..a315cde
---- /dev/null
-+++ b/internal/app/s3manager/auth.go
-@@ -0,0 +1,173 @@
-+package s3manager
-+
-+import (
-+	"context"
-+	"crypto/rand"
-+	"crypto/tls"
-+	"fmt"
-+	"html/template"
-+	"io/fs"
-+	"net/http"
-+
-+	"github.com/gorilla/sessions"
-+	"github.com/minio/minio-go/v7"
-+	"github.com/minio/minio-go/v7/pkg/credentials"
-+)
-+
-+type contextKey string
-+
-+const s3ContextKey contextKey = "s3client"
-+
-+// S3FromContext retrieves the S3 client from the request context.
-+func S3FromContext(ctx context.Context) S3 {
-+	s3, _ := ctx.Value(s3ContextKey).(S3)
-+	return s3
-+}
-+
-+func contextWithS3(ctx context.Context, s3 S3) context.Context {
-+	return context.WithValue(ctx, s3ContextKey, s3)
-+}
-+
-+// NewS3Client creates a new minio S3 client with the given credentials.
-+func NewS3Client(endpoint, accessKey, secretKey string, useSSL, skipVerify bool) (*minio.Client, error) {
-+	opts := &minio.Options{
-+		Creds:  credentials.NewStaticV4(accessKey, secretKey, ""),
-+		Secure: useSSL,
-+	}
-+	if useSSL && skipVerify {
-+		opts.Transport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} //nolint:gosec
-+	}
-+	return minio.New(endpoint, opts)
-+}
-+
-+// NewSessionStore creates a new encrypted cookie store with a random key.
-+func NewSessionStore() *sessions.CookieStore {
-+	key := make([]byte, 32)
-+	if _, err := rand.Read(key); err != nil {
-+		panic(fmt.Sprintf("failed to generate session key: %v", err))
-+	}
-+	store := sessions.NewCookieStore(key)
-+	store.Options = &sessions.Options{
-+		Path:     "/",
-+		MaxAge:   86400, // 24 hours
-+		HttpOnly: true,
-+		Secure:   true,
-+		SameSite: http.SameSiteLaxMode,
-+	}
-+	return store
-+}
-+
-+// RequireAuth is middleware that checks for valid S3 credentials in the session.
-+func RequireAuth(store *sessions.CookieStore, endpoint string, useSSL, skipVerify bool) func(http.Handler) http.Handler {
-+	return func(next http.Handler) http.Handler {
-+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-+			session, err := store.Get(r, "s3session")
-+			if err != nil {
-+				http.Redirect(w, r, "/login", http.StatusFound)
-+				return
-+			}
-+
-+			accessKey, ok1 := session.Values["accessKey"].(string)
-+			secretKey, ok2 := session.Values["secretKey"].(string)
-+			if !ok1 || !ok2 || accessKey == "" || secretKey == "" {
-+				http.Redirect(w, r, "/login", http.StatusFound)
-+				return
-+			}
-+
-+			s3Client, err := NewS3Client(endpoint, accessKey, secretKey, useSSL, skipVerify)
-+			if err != nil {
-+				http.Redirect(w, r, "/login?error=invalid_credentials", http.StatusFound)
-+				return
-+			}
-+
-+			ctx := contextWithS3(r.Context(), s3Client)
-+			next.ServeHTTP(w, r.WithContext(ctx))
-+		})
-+	}
-+}
-+
-+// HandleLoginView renders the login page.
-+func HandleLoginView(templates fs.FS) http.HandlerFunc {
-+	return func(w http.ResponseWriter, r *http.Request) {
-+		data := struct {
-+			Error string
-+		}{
-+			Error: r.URL.Query().Get("error"),
-+		}
-+		t, err := template.ParseFS(templates, "layout.html.tmpl", "login.html.tmpl")
-+		if err != nil {
-+			handleHTTPError(w, fmt.Errorf("error parsing login template: %w", err))
-+			return
-+		}
-+		err = t.ExecuteTemplate(w, "layout", data)
-+		if err != nil {
-+			handleHTTPError(w, fmt.Errorf("error executing login template: %w", err))
-+			return
-+		}
-+	}
-+}
-+
-+// HandleLogin processes login form submission.
-+func HandleLogin(store *sessions.CookieStore, endpoint string, useSSL, skipVerify bool) http.HandlerFunc {
-+	return func(w http.ResponseWriter, r *http.Request) {
-+		accessKey := r.FormValue("accessKey")
-+		secretKey := r.FormValue("secretKey")
-+
-+		if accessKey == "" || secretKey == "" {
-+			http.Redirect(w, r, "/login?error=credentials_required", http.StatusFound)
-+			return
-+		}
-+
-+		// Validate credentials by attempting to list buckets
-+		s3Client, err := NewS3Client(endpoint, accessKey, secretKey, useSSL, skipVerify)
-+		if err != nil {
-+			http.Redirect(w, r, "/login?error=invalid_credentials", http.StatusFound)
-+			return
-+		}
-+
-+		_, err = s3Client.ListBuckets(r.Context())
-+		if err != nil {
-+			http.Redirect(w, r, "/login?error=invalid_credentials", http.StatusFound)
-+			return
-+		}
-+
-+		session, err := store.Get(r, "s3session")
-+		if err != nil {
-+			http.Redirect(w, r, "/login?error=session_error", http.StatusFound)
-+			return
-+		}
-+
-+		session.Values["accessKey"] = accessKey
-+		session.Values["secretKey"] = secretKey
-+		if err := session.Save(r, w); err != nil {
-+			http.Redirect(w, r, "/login?error=session_error", http.StatusFound)
-+			return
-+		}
-+
-+		http.Redirect(w, r, "/buckets", http.StatusFound)
-+	}
-+}
-+
-+// HandleLogout destroys the session and redirects to login.
-+func HandleLogout(store *sessions.CookieStore) http.HandlerFunc {
-+	return func(w http.ResponseWriter, r *http.Request) {
-+		session, err := store.Get(r, "s3session")
-+		if err == nil {
-+			session.Options.MaxAge = -1
-+			_ = session.Save(r, w)
-+		}
-+		http.Redirect(w, r, "/login", http.StatusFound)
-+	}
-+}
-+
-+// DynamicS3Handler wraps a handler factory that takes S3 as its only parameter.
-+func DynamicS3Handler(factory func(S3) http.HandlerFunc) http.HandlerFunc {
-+	return func(w http.ResponseWriter, r *http.Request) {
-+		s3 := S3FromContext(r.Context())
-+		if s3 == nil {
-+			http.Redirect(w, r, "/login", http.StatusFound)
-+			return
-+		}
-+		factory(s3).ServeHTTP(w, r)
-+	}
-+}
+diff --git a/go.sum b/go.sum
+index 1ea1b16..d7866ce 100644
+--- a/go.sum
++++ b/go.sum
+@@ -16,10 +16,16 @@ github.com/goccy/go-json v0.10.3 h1:KZ5WoDbxAIgm2HNbYckL0se1fHD6rz5j4ywS6ebzDqA=
+ github.com/goccy/go-json v0.10.3/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+ github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+ github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
++github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
++github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+ github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+ github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
+ github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
++github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
++github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
++github.com/gorilla/sessions v1.4.0 h1:kpIYOp/oi6MG/p5PgxApU8srsSw9tuFbt46Lt7auzqQ=
++github.com/gorilla/sessions v1.4.0/go.mod h1:FLWm50oby91+hl7p/wRxDth9bWSuk0qVL2emc7lT5ik=
+ github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
+ github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+ github.com/klauspost/compress v1.17.9 h1:6KIumPrER1LHsvBVuDa0r5xaG0Es51mhhB9BQB2qeMA=
 diff --git a/main.go b/main.go
-index 2ffe8ab..5fdc4cd 100644
+index 2ffe8ab..723a1b8 100644
 --- a/main.go
 +++ b/main.go
 @@ -41,10 +41,12 @@ type configuration struct {
@@ -219,7 +61,7 @@ index 2ffe8ab..5fdc4cd 100644
  
  	viper.AutomaticEnv()
  
-@@ -57,13 +59,11 @@ func parseConfiguration() configuration {
+@@ -57,13 +59,10 @@ func parseConfiguration() configuration {
  		iamEndpoint = viper.GetString("IAM_ENDPOINT")
  	} else {
  		accessKeyID = viper.GetString("ACCESS_KEY_ID")
@@ -230,14 +72,13 @@ index 2ffe8ab..5fdc4cd 100644
  		secretAccessKey = viper.GetString("SECRET_ACCESS_KEY")
 -		if len(secretAccessKey) == 0 {
 -			log.Fatal("please provide SECRET_ACCESS_KEY")
-+
 +		if len(accessKeyID) == 0 || len(secretAccessKey) == 0 {
 +			log.Println("ACCESS_KEY_ID or SECRET_ACCESS_KEY not set, starting in login mode")
 +			loginMode = true
  		}
  	}
  
-@@ -115,6 +115,7 @@ func parseConfiguration() configuration {
+@@ -115,6 +114,7 @@ func parseConfiguration() configuration {
  		Timeout:             timeout,
  		SseType:             sseType,
  		SseKey:              sseKey,
@@ -245,7 +86,7 @@ index 2ffe8ab..5fdc4cd 100644
  	}
  }
  
-@@ -135,57 +136,103 @@ func main() {
+@@ -135,57 +135,96 @@ func main() {
  		log.Fatal(err)
  	}
  
@@ -255,54 +96,7 @@ index 2ffe8ab..5fdc4cd 100644
 -	}
 -	if configuration.UseIam {
 -		opts.Creds = credentials.NewIAM(configuration.IamEndpoint)
-+	// Set up router
-+	r := mux.NewRouter()
-+	r.PathPrefix("/static/").Handler(http.StripPrefix("/static/", http.FileServer(http.FS(statics)))).Methods(http.MethodGet)
-+
-+	if configuration.LoginMode {
-+		// Login mode: no pre-configured S3 client, use per-session credentials
-+		store := s3manager.NewSessionStore()
-+		authMiddleware := s3manager.RequireAuth(store, configuration.Endpoint, configuration.UseSSL, configuration.SkipSSLVerification)
-+
-+		// Public routes
-+		r.Handle("/login", s3manager.HandleLoginView(templates)).Methods(http.MethodGet)
-+		r.Handle("/login", s3manager.HandleLogin(store, configuration.Endpoint, configuration.UseSSL, configuration.SkipSSLVerification)).Methods(http.MethodPost)
-+		r.Handle("/logout", s3manager.HandleLogout(store)).Methods(http.MethodPost)
-+
-+		// Protected routes - use dynamic S3 client from session
-+		protected := r.PathPrefix("/").Subrouter()
-+		protected.Use(authMiddleware)
-+
-+		protected.Handle("/", http.RedirectHandler("/buckets", http.StatusPermanentRedirect)).Methods(http.MethodGet)
-+		protected.Handle("/buckets", s3manager.DynamicS3Handler(func(s3 s3manager.S3) http.HandlerFunc {
-+			return s3manager.HandleBucketsView(s3, templates, configuration.AllowDelete)
-+		})).Methods(http.MethodGet)
-+		protected.PathPrefix("/buckets/").Handler(s3manager.DynamicS3Handler(func(s3 s3manager.S3) http.HandlerFunc {
-+			return s3manager.HandleBucketView(s3, templates, configuration.AllowDelete, configuration.ListRecursive)
-+		})).Methods(http.MethodGet)
-+		protected.Handle("/api/buckets", s3manager.DynamicS3Handler(func(s3 s3manager.S3) http.HandlerFunc {
-+			return s3manager.HandleCreateBucket(s3)
-+		})).Methods(http.MethodPost)
-+		if configuration.AllowDelete {
-+			protected.Handle("/api/buckets/{bucketName}", s3manager.DynamicS3Handler(func(s3 s3manager.S3) http.HandlerFunc {
-+				return s3manager.HandleDeleteBucket(s3)
-+			})).Methods(http.MethodDelete)
-+		}
-+		protected.Handle("/api/buckets/{bucketName}/objects", s3manager.DynamicS3Handler(func(s3 s3manager.S3) http.HandlerFunc {
-+			return s3manager.HandleCreateObject(s3, sseType)
-+		})).Methods(http.MethodPost)
-+		protected.Handle("/api/buckets/{bucketName}/objects/{objectName:.*}/url", s3manager.DynamicS3Handler(func(s3 s3manager.S3) http.HandlerFunc {
-+			return s3manager.HandleGenerateUrl(s3)
-+		})).Methods(http.MethodGet)
-+		protected.Handle("/api/buckets/{bucketName}/objects/{objectName:.*}", s3manager.DynamicS3Handler(func(s3 s3manager.S3) http.HandlerFunc {
-+			return s3manager.HandleGetObject(s3, configuration.ForceDownload)
-+		})).Methods(http.MethodGet)
-+		if configuration.AllowDelete {
-+			protected.Handle("/api/buckets/{bucketName}/objects/{objectName:.*}", s3manager.DynamicS3Handler(func(s3 s3manager.S3) http.HandlerFunc {
-+				return s3manager.HandleDeleteObject(s3)
-+			})).Methods(http.MethodDelete)
-+		}
- 	} else {
+-	} else {
 -		var signatureType credentials.SignatureType
 -
 -		switch configuration.SignatureType {
@@ -316,6 +110,59 @@ index 2ffe8ab..5fdc4cd 100644
 -			signatureType = credentials.SignatureAnonymous
 -		default:
 -			log.Fatalf("Invalid SIGNATURE_TYPE: %s", configuration.SignatureType)
++	// Set up router
++	r := mux.NewRouter()
++	r.PathPrefix("/static/").Handler(http.StripPrefix("/static/", http.FileServer(http.FS(statics)))).Methods(http.MethodGet)
++
++	if configuration.LoginMode {
++		// Login mode: no pre-configured S3 client, per-session credentials
++		sessionCfg := &s3manager.SessionConfig{
++			Store:         s3manager.NewSessionStore(),
++			Endpoint:      configuration.Endpoint,
++			UseSSL:        configuration.UseSSL,
++			SkipSSLVerify: configuration.SkipSSLVerification,
++			AllowDelete:   configuration.AllowDelete,
++			ForceDownload: configuration.ForceDownload,
++			ListRecursive: configuration.ListRecursive,
++			SseInfo:       sseType,
++			Templates:     templates,
+ 		}
+ 
+-		opts.Creds = credentials.NewStatic(configuration.AccessKeyID, configuration.SecretAccessKey, "", signatureType)
+-	}
++		// Public routes (no auth required)
++		r.Handle("/login", s3manager.HandleLoginView(templates)).Methods(http.MethodGet)
++		r.Handle("/login", s3manager.HandleLogin(sessionCfg)).Methods(http.MethodPost)
++		r.Handle("/logout", s3manager.HandleLogout(sessionCfg)).Methods(http.MethodPost)
++
++		// Protected routes (auth required via middleware)
++		protected := mux.NewRouter()
++		protected.Handle("/", http.RedirectHandler("/buckets", http.StatusPermanentRedirect)).Methods(http.MethodGet)
++		protected.Handle("/buckets", s3manager.HandleBucketsViewDynamic(templates, configuration.AllowDelete)).Methods(http.MethodGet)
++		protected.PathPrefix("/buckets/").Handler(s3manager.HandleBucketViewDynamic(templates, configuration.AllowDelete, configuration.ListRecursive)).Methods(http.MethodGet)
++		protected.Handle("/api/buckets", s3manager.HandleCreateBucketDynamic()).Methods(http.MethodPost)
++		if configuration.AllowDelete {
++			protected.Handle("/api/buckets/{bucketName}", s3manager.HandleDeleteBucketDynamic()).Methods(http.MethodDelete)
++		}
++		protected.Handle("/api/buckets/{bucketName}/objects", s3manager.HandleCreateObjectDynamic(sseType)).Methods(http.MethodPost)
++		protected.Handle("/api/buckets/{bucketName}/objects/{objectName:.*}/url", s3manager.HandleGenerateUrlDynamic()).Methods(http.MethodGet)
++		protected.Handle("/api/buckets/{bucketName}/objects/{objectName:.*}", s3manager.HandleGetObjectDynamic(configuration.ForceDownload)).Methods(http.MethodGet)
++		if configuration.AllowDelete {
++			protected.Handle("/api/buckets/{bucketName}/objects/{objectName:.*}", s3manager.HandleDeleteObjectDynamic()).Methods(http.MethodDelete)
++		}
+ 
+-	if configuration.Region != "" {
+-		opts.Region = configuration.Region
+-	}
+-	if configuration.UseSSL && configuration.SkipSSLVerification {
+-		opts.Transport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} //nolint:gosec
+-	}
+-	s3, err := minio.New(configuration.Endpoint, opts)
+-	if err != nil {
+-		log.Fatalln(fmt.Errorf("error creating s3 client: %w", err))
+-	}
++		r.PathPrefix("/").Handler(s3manager.RequireAuth(sessionCfg, protected))
++	} else {
 +		// Pre-configured mode: existing behavior with static S3 client
 +		opts := &minio.Options{
 +			Secure: configuration.UseSSL,
@@ -339,30 +186,6 @@ index 2ffe8ab..5fdc4cd 100644
 +			}
 +
 +			opts.Creds = credentials.NewStatic(configuration.AccessKeyID, configuration.SecretAccessKey, "", signatureType)
- 		}
- 
--		opts.Creds = credentials.NewStatic(configuration.AccessKeyID, configuration.SecretAccessKey, "", signatureType)
--	}
--
--	if configuration.Region != "" {
--		opts.Region = configuration.Region
--	}
--	if configuration.UseSSL && configuration.SkipSSLVerification {
--		opts.Transport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} //nolint:gosec
--	}
--	s3, err := minio.New(configuration.Endpoint, opts)
--	if err != nil {
--		log.Fatalln(fmt.Errorf("error creating s3 client: %w", err))
--	}
-+		if configuration.Region != "" {
-+			opts.Region = configuration.Region
-+		}
-+		if configuration.UseSSL && configuration.SkipSSLVerification {
-+			opts.Transport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} //nolint:gosec
-+		}
-+		s3, err := minio.New(configuration.Endpoint, opts)
-+		if err != nil {
-+			log.Fatalln(fmt.Errorf("error creating s3 client: %w", err))
 +		}
  
 -	// Set up router
@@ -380,6 +203,17 @@ index 2ffe8ab..5fdc4cd 100644
 -	r.Handle("/api/buckets/{bucketName}/objects/{objectName:.*}", s3manager.HandleGetObject(s3, configuration.ForceDownload)).Methods(http.MethodGet)
 -	if configuration.AllowDelete {
 -		r.Handle("/api/buckets/{bucketName}/objects/{objectName:.*}", s3manager.HandleDeleteObject(s3)).Methods(http.MethodDelete)
++		if configuration.Region != "" {
++			opts.Region = configuration.Region
++		}
++		if configuration.UseSSL && configuration.SkipSSLVerification {
++			opts.Transport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} //nolint:gosec
++		}
++		s3, err := minio.New(configuration.Endpoint, opts)
++		if err != nil {
++			log.Fatalln(fmt.Errorf("error creating s3 client: %w", err))
++		}
++
 +		r.Handle("/", http.RedirectHandler("/buckets", http.StatusPermanentRedirect)).Methods(http.MethodGet)
 +		r.Handle("/buckets", s3manager.HandleBucketsView(s3, templates, configuration.AllowDelete)).Methods(http.MethodGet)
 +		r.PathPrefix("/buckets/").Handler(s3manager.HandleBucketView(s3, templates, configuration.AllowDelete, configuration.ListRecursive)).Methods(http.MethodGet)
@@ -422,12 +256,255 @@ index c7ea184..fb1dce7 100644
      </div>
  </nav>
  
+diff --git a/internal/app/s3manager/auth.go b/internal/app/s3manager/auth.go
+new file mode 100644
+index 0000000..58589e2
+--- /dev/null
++++ b/internal/app/s3manager/auth.go
+@@ -0,0 +1,237 @@
++package s3manager
++
++import (
++	"context"
++	"crypto/rand"
++	"crypto/tls"
++	"fmt"
++	"html/template"
++	"io/fs"
++	"log"
++	"net/http"
++
++	"github.com/gorilla/sessions"
++	"github.com/minio/minio-go/v7"
++	"github.com/minio/minio-go/v7/pkg/credentials"
++)
++
++type contextKey string
++
++const s3ContextKey contextKey = "s3client"
++
++// SessionConfig holds session store and S3 connection settings for login mode.
++type SessionConfig struct {
++	Store           *sessions.CookieStore
++	Endpoint        string
++	UseSSL          bool
++	SkipSSLVerify   bool
++	AllowDelete     bool
++	ForceDownload   bool
++	ListRecursive   bool
++	SseInfo         SSEType
++	Templates       fs.FS
++}
++
++// NewSessionStore creates a CookieStore with a random encryption key.
++func NewSessionStore() *sessions.CookieStore {
++	key := make([]byte, 32)
++	if _, err := rand.Read(key); err != nil {
++		log.Fatal("failed to generate session key:", err)
++	}
++	store := sessions.NewCookieStore(key)
++	store.Options = &sessions.Options{
++		Path:     "/",
++		MaxAge:   86400,
++		HttpOnly: true,
++		Secure:   true,
++		SameSite: http.SameSiteLaxMode,
++	}
++	return store
++}
++
++// NewS3Client creates a minio client from user-provided credentials.
++func NewS3Client(endpoint, accessKey, secretKey string, useSSL, skipSSLVerify bool) (*minio.Client, error) {
++	opts := &minio.Options{
++		Creds:  credentials.NewStaticV4(accessKey, secretKey, ""),
++		Secure: useSSL,
++	}
++	if useSSL && skipSSLVerify {
++		opts.Transport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} //nolint:gosec
++	}
++	return minio.New(endpoint, opts)
++}
++
++// S3FromContext retrieves the S3 client stored in request context.
++func S3FromContext(ctx context.Context) S3 {
++	if s3, ok := ctx.Value(s3ContextKey).(S3); ok {
++		return s3
++	}
++	return nil
++}
++
++func contextWithS3(ctx context.Context, s3 S3) context.Context {
++	return context.WithValue(ctx, s3ContextKey, s3)
++}
++
++// RequireAuth is middleware that validates session credentials and injects
++// an S3 client into the request context. Redirects to /login if no session.
++func RequireAuth(cfg *SessionConfig, next http.Handler) http.Handler {
++	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++		session, _ := cfg.Store.Get(r, "s3session")
++		accessKey, ok1 := session.Values["accessKey"].(string)
++		secretKey, ok2 := session.Values["secretKey"].(string)
++		if !ok1 || !ok2 || accessKey == "" || secretKey == "" {
++			http.Redirect(w, r, "/login", http.StatusFound)
++			return
++		}
++
++		s3, err := NewS3Client(cfg.Endpoint, accessKey, secretKey, cfg.UseSSL, cfg.SkipSSLVerify)
++		if err != nil {
++			// Session has bad credentials — clear and redirect to login
++			session.Options.MaxAge = -1
++			_ = session.Save(r, w)
++			http.Redirect(w, r, "/login", http.StatusFound)
++			return
++		}
++
++		ctx := contextWithS3(r.Context(), s3)
++		next.ServeHTTP(w, r.WithContext(ctx))
++	})
++}
++
++// HandleLoginView renders the login page.
++func HandleLoginView(templates fs.FS) http.HandlerFunc {
++	return func(w http.ResponseWriter, r *http.Request) {
++		errorMsg := r.URL.Query().Get("error")
++
++		data := struct {
++			Error string
++		}{
++			Error: errorMsg,
++		}
++
++		t, err := template.ParseFS(templates, "layout.html.tmpl", "login.html.tmpl")
++		if err != nil {
++			handleHTTPError(w, fmt.Errorf("error parsing login template: %w", err))
++			return
++		}
++		err = t.ExecuteTemplate(w, "layout", data)
++		if err != nil {
++			handleHTTPError(w, fmt.Errorf("error executing login template: %w", err))
++			return
++		}
++	}
++}
++
++// HandleLogin processes the login form POST.
++func HandleLogin(cfg *SessionConfig) http.HandlerFunc {
++	return func(w http.ResponseWriter, r *http.Request) {
++		accessKey := r.FormValue("accessKey")
++		secretKey := r.FormValue("secretKey")
++
++		if accessKey == "" || secretKey == "" {
++			http.Redirect(w, r, "/login?error=credentials+required", http.StatusFound)
++			return
++		}
++
++		// Validate credentials by attempting ListBuckets
++		s3, err := NewS3Client(cfg.Endpoint, accessKey, secretKey, cfg.UseSSL, cfg.SkipSSLVerify)
++		if err != nil {
++			http.Redirect(w, r, "/login?error=connection+failed", http.StatusFound)
++			return
++		}
++		_, err = s3.ListBuckets(r.Context())
++		if err != nil {
++			http.Redirect(w, r, "/login?error=invalid+credentials", http.StatusFound)
++			return
++		}
++
++		// Save credentials to session
++		session, _ := cfg.Store.Get(r, "s3session")
++		session.Values["accessKey"] = accessKey
++		session.Values["secretKey"] = secretKey
++		err = session.Save(r, w)
++		if err != nil {
++			handleHTTPError(w, fmt.Errorf("error saving session: %w", err))
++			return
++		}
++
++		http.Redirect(w, r, "/buckets", http.StatusFound)
++	}
++}
++
++// HandleLogout destroys the session and redirects to login.
++func HandleLogout(cfg *SessionConfig) http.HandlerFunc {
++	return func(w http.ResponseWriter, r *http.Request) {
++		session, _ := cfg.Store.Get(r, "s3session")
++		session.Options.MaxAge = -1
++		_ = session.Save(r, w)
++		http.Redirect(w, r, "/login", http.StatusFound)
++	}
++}
++
++// Dynamic handler wrappers — extract S3 from context, delegate to original handlers.
++
++// HandleBucketsViewDynamic wraps HandleBucketsView for login mode.
++func HandleBucketsViewDynamic(templates fs.FS, allowDelete bool) http.HandlerFunc {
++	return func(w http.ResponseWriter, r *http.Request) {
++		s3 := S3FromContext(r.Context())
++		HandleBucketsView(s3, templates, allowDelete).ServeHTTP(w, r)
++	}
++}
++
++// HandleBucketViewDynamic wraps HandleBucketView for login mode.
++func HandleBucketViewDynamic(templates fs.FS, allowDelete bool, listRecursive bool) http.HandlerFunc {
++	return func(w http.ResponseWriter, r *http.Request) {
++		s3 := S3FromContext(r.Context())
++		HandleBucketView(s3, templates, allowDelete, listRecursive).ServeHTTP(w, r)
++	}
++}
++
++// HandleCreateBucketDynamic wraps HandleCreateBucket for login mode.
++func HandleCreateBucketDynamic() http.HandlerFunc {
++	return func(w http.ResponseWriter, r *http.Request) {
++		s3 := S3FromContext(r.Context())
++		HandleCreateBucket(s3).ServeHTTP(w, r)
++	}
++}
++
++// HandleDeleteBucketDynamic wraps HandleDeleteBucket for login mode.
++func HandleDeleteBucketDynamic() http.HandlerFunc {
++	return func(w http.ResponseWriter, r *http.Request) {
++		s3 := S3FromContext(r.Context())
++		HandleDeleteBucket(s3).ServeHTTP(w, r)
++	}
++}
++
++// HandleCreateObjectDynamic wraps HandleCreateObject for login mode.
++func HandleCreateObjectDynamic(sseInfo SSEType) http.HandlerFunc {
++	return func(w http.ResponseWriter, r *http.Request) {
++		s3 := S3FromContext(r.Context())
++		HandleCreateObject(s3, sseInfo).ServeHTTP(w, r)
++	}
++}
++
++// HandleGenerateUrlDynamic wraps HandleGenerateUrl for login mode.
++func HandleGenerateUrlDynamic() http.HandlerFunc {
++	return func(w http.ResponseWriter, r *http.Request) {
++		s3 := S3FromContext(r.Context())
++		HandleGenerateUrl(s3).ServeHTTP(w, r)
++	}
++}
++
++// HandleGetObjectDynamic wraps HandleGetObject for login mode.
++func HandleGetObjectDynamic(forceDownload bool) http.HandlerFunc {
++	return func(w http.ResponseWriter, r *http.Request) {
++		s3 := S3FromContext(r.Context())
++		HandleGetObject(s3, forceDownload).ServeHTTP(w, r)
++	}
++}
++
++// HandleDeleteObjectDynamic wraps HandleDeleteObject for login mode.
++func HandleDeleteObjectDynamic() http.HandlerFunc {
++	return func(w http.ResponseWriter, r *http.Request) {
++		s3 := S3FromContext(r.Context())
++		HandleDeleteObject(s3).ServeHTTP(w, r)
++	}
++}
 diff --git a/web/template/login.html.tmpl b/web/template/login.html.tmpl
 new file mode 100644
-index 0000000..7a1730a
+index 0000000..f153018
 --- /dev/null
 +++ b/web/template/login.html.tmpl
-@@ -0,0 +1,69 @@
+@@ -0,0 +1,46 @@
 +{{ define "content" }}
 +<nav>
 +    <div class="nav-wrapper container">
@@ -441,54 +518,31 @@ index 0000000..7a1730a
 +            <div class="col l6 offset-l3 m8 offset-m2 s12">
 +                <div class="card">
 +                    <div class="card-content">
-+                        <span class="card-title">Login</span>
-+                        <p>Enter your S3 credentials to access buckets.</p>
++                        <span class="card-title">Sign In</span>
++                        <p>Enter your S3 credentials to access the bucket manager.</p>
 +                        <br>
 +
-+                        {{ if eq .Error "invalid_credentials" }}
++                        {{ if .Error }}
 +                        <div class="card-panel red lighten-4 red-text text-darken-4">
-+                            <i class="material-icons tiny">error</i>
-+                            Invalid credentials. Please check your Access Key and Secret Key.
-+                        </div>
-+                        {{ end }}
-+
-+                        {{ if eq .Error "credentials_required" }}
-+                        <div class="card-panel red lighten-4 red-text text-darken-4">
-+                            <i class="material-icons tiny">error</i>
-+                            Both Access Key ID and Secret Access Key are required.
-+                        </div>
-+                        {{ end }}
-+
-+                        {{ if eq .Error "session_error" }}
-+                        <div class="card-panel red lighten-4 red-text text-darken-4">
-+                            <i class="material-icons tiny">error</i>
-+                            Session error. Please try again.
++                            <i class="material-icons tiny">error</i> {{ .Error }}
 +                        </div>
 +                        {{ end }}
 +
 +                        <form method="POST" action="/login">
-+                            <div class="row">
-+                                <div class="input-field col s12">
-+                                    <i class="material-icons prefix">vpn_key</i>
-+                                    <input id="accessKey" name="accessKey" type="text" required>
-+                                    <label for="accessKey">Access Key ID</label>
-+                                </div>
++                            <div class="input-field">
++                                <i class="material-icons prefix">vpn_key</i>
++                                <input id="accessKey" name="accessKey" type="text" required>
++                                <label for="accessKey">Access Key ID</label>
 +                            </div>
-+                            <div class="row">
-+                                <div class="input-field col s12">
-+                                    <i class="material-icons prefix">lock</i>
-+                                    <input id="secretKey" name="secretKey" type="password" required>
-+                                    <label for="secretKey">Secret Access Key</label>
-+                                </div>
-+                            </div>
-+                            <div class="row">
-+                                <div class="col s12">
-+                                    <button type="submit" class="btn waves-effect waves-light" style="width:100%;">
-+                                        Sign In
-+                                        <i class="material-icons right">send</i>
-+                                    </button>
-+                                </div>
++                            <div class="input-field">
++                                <i class="material-icons prefix">lock</i>
++                                <input id="secretKey" name="secretKey" type="password" required>
++                                <label for="secretKey">Secret Access Key</label>
 +                            </div>
++                            <br>
++                            <button type="submit" class="btn waves-effect waves-light" style="width:100%;">
++                                Sign In <i class="material-icons right">send</i>
++                            </button>
 +                        </form>
 +                    </div>
 +                </div>
diff --git a/packages/system/bucket/templates/deployment.yaml b/packages/system/bucket/templates/deployment.yaml
index 086a6934..4e055334 100644
--- a/packages/system/bucket/templates/deployment.yaml
+++ b/packages/system/bucket/templates/deployment.yaml
@@ -1,4 +1,3 @@
-{{- $users := keys .Values.users | sortAlpha }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -21,15 +20,3 @@ spec:
           value: "s3.{{ .Values._namespace.host }}"
         - name: SKIP_SSL_VERIFICATION
           value: "true"
-        {{- if $users }}
-        - name: ACCESS_KEY_ID
-          valueFrom:
-            secretKeyRef:
-              name: {{ .Values.bucketName }}-credentials
-              key: accessKey
-        - name: SECRET_ACCESS_KEY
-          valueFrom:
-            secretKeyRef:
-              name: {{ .Values.bucketName }}-credentials
-              key: secretKey
-        {{- end }}
diff --git a/packages/system/bucket/templates/ingress.yaml b/packages/system/bucket/templates/ingress.yaml
index e54fede3..6e5028fc 100644
--- a/packages/system/bucket/templates/ingress.yaml
+++ b/packages/system/bucket/templates/ingress.yaml
@@ -2,18 +2,12 @@
 {{- $ingress := .Values._namespace.ingress }}
 {{- $solver := (index .Values._cluster "solver") | default "http01" }}
 {{- $clusterIssuer := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }}
-{{- $users := keys .Values.users | sortAlpha }}
 
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: {{ .Values.bucketName }}-ui
   annotations:
-    {{- if $users }}
-    nginx.ingress.kubernetes.io/auth-type: "basic"
-    nginx.ingress.kubernetes.io/auth-secret: "{{ .Values.bucketName }}-ui-auth"
-    nginx.ingress.kubernetes.io/auth-realm: "Authentication Required"
-    {{- end }}
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
     nginx.ingress.kubernetes.io/proxy-read-timeout: "99999"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "99999"
diff --git a/packages/system/bucket/templates/secret.yaml b/packages/system/bucket/templates/secret.yaml
index 07450ec7..683a0972 100644
--- a/packages/system/bucket/templates/secret.yaml
+++ b/packages/system/bucket/templates/secret.yaml
@@ -1,30 +1,2 @@
-{{- $users := keys .Values.users | sortAlpha }}
-{{- if $users }}
-{{- $firstUser := index $users 0 }}
-{{- $secretName := printf "%s-%s" .Values.bucketName $firstUser }}
-{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace $secretName }}
-{{- if $existingSecret }}
-{{- $bucketInfo := fromJson (b64dec (index $existingSecret.data "BucketInfo")) }}
-{{- $accessKeyID := index $bucketInfo.spec.secretS3 "accessKeyID" }}
-{{- $accessSecretKey := index $bucketInfo.spec.secretS3 "accessSecretKey" }}
-{{- $endpoint := index $bucketInfo.spec.secretS3 "endpoint" }}
-{{- $bucketName := index $bucketInfo.spec "bucketName" }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ $.Values.bucketName }}-credentials
-type: Opaque
-stringData:
-  accessKey: {{ $accessKeyID | quote }}
-  secretKey: {{ $accessSecretKey | quote }}
-  endpoint: {{ trimPrefix "https://" $endpoint }}
-  bucketName: {{ $bucketName | quote }}
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ $.Values.bucketName }}-ui-auth
-data:
-  auth: {{ htpasswd $accessKeyID $accessSecretKey | b64enc | quote }}
-{{- end }}
-{{- end }}
+{{/* Secrets previously used for s3manager credential injection and nginx basic auth */}}
+{{/* are no longer needed — s3manager now handles authentication via its own login page */}}

From fdb015458cb0177bf179d8007b3bb46b269b1d45 Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Wed, 4 Mar 2026 19:01:27 +0300
Subject: [PATCH 214/666] build(bucket): rebuild s3manager image with login
 mode

Rebuild s3manager with auth.go login page support and push
to 999669/s3manager registry for testing.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 packages/system/bucket/images/s3manager.tag | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/system/bucket/images/s3manager.tag b/packages/system/bucket/images/s3manager.tag
index 4b03d92c..0419c8c9 100644
--- a/packages/system/bucket/images/s3manager.tag
+++ b/packages/system/bucket/images/s3manager.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:279008f87460d709e99ed25ee8a1e4568a290bb9afa0e3dd3a06d524163a132b
+999669/s3manager:latest@sha256:134bd78a5e9412df3102a58487f7200279a0ba3dac78f2dc5ac1dd4d299bcbd2

From 72a91c7780e756564ce1dc708c067feaad79df6c Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Wed, 4 Mar 2026 20:15:03 +0300
Subject: [PATCH 215/666] fix(seaweedfs): update COSI driver to v0.3.0

v0.1.2 ignores accessPolicy parameter from BucketAccessClass,
granting readwrite access to all users regardless of the
readonly flag. v0.3.0 includes support for readonly bucket
access, Object Lock, and improved error handling.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 packages/system/seaweedfs/charts/seaweedfs/values.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/system/seaweedfs/charts/seaweedfs/values.yaml b/packages/system/seaweedfs/charts/seaweedfs/values.yaml
index a2419805..c51b86e6 100644
--- a/packages/system/seaweedfs/charts/seaweedfs/values.yaml
+++ b/packages/system/seaweedfs/charts/seaweedfs/values.yaml
@@ -1546,7 +1546,7 @@ allInOne:
 # For more information, visit: https://container-object-storage-interface.github.io/docs/deployment-guide
 cosi:
   enabled: false
-  image: "ghcr.io/seaweedfs/seaweedfs-cosi-driver:v0.1.2"
+  image: "ghcr.io/seaweedfs/seaweedfs-cosi-driver:v0.3.0"
   driverName: "seaweedfs.objectstorage.k8s.io"
   bucketClassName: "seaweedfs"
   endpoint: ""

From 15ed534c259e6b4fa44e5ce1801162b4e72db4e8 Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Wed, 4 Mar 2026 21:13:22 +0300
Subject: [PATCH 216/666] test(bucket): update E2E test for user model and
 readonly access

Update bucket E2E test to match the new per-user access model:
- Create bucket with admin (readwrite) and viewer (readonly) users
- Test that readwrite user can upload, list, and download objects
- Test that readonly user can list and download but cannot upload
- Use per-user BucketAccess and credential secret names

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 hack/e2e-apps/bucket.bats | 59 ++++++++++++++++++++++++++++-----------
 1 file changed, 42 insertions(+), 17 deletions(-)

diff --git a/hack/e2e-apps/bucket.bats b/hack/e2e-apps/bucket.bats
index 2621812a..0ec4f75c 100644
--- a/hack/e2e-apps/bucket.bats
+++ b/hack/e2e-apps/bucket.bats
@@ -1,7 +1,7 @@
 #!/usr/bin/env bats
 
 @test "Create and Verify Seeweedfs Bucket" {
-  # Create the bucket resource
+  # Create the bucket resource with readwrite and readonly users
   name='test'
   kubectl apply -f - <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
@@ -9,21 +9,29 @@ kind: Bucket
 metadata:
   name: ${name}
   namespace: tenant-test
-spec: {}
+spec:
+  users:
+    admin: {}
+    viewer:
+      readonly: true
 EOF
 
   # Wait for the bucket to be ready
   kubectl -n tenant-test wait hr bucket-${name} --timeout=100s --for=condition=ready
   kubectl -n tenant-test wait bucketclaims.objectstorage.k8s.io bucket-${name} --timeout=300s --for=jsonpath='{.status.bucketReady}'
-  kubectl -n tenant-test wait bucketaccesses.objectstorage.k8s.io bucket-${name} --timeout=300s --for=jsonpath='{.status.accessGranted}'
+  kubectl -n tenant-test wait bucketaccesses.objectstorage.k8s.io bucket-${name}-admin --timeout=300s --for=jsonpath='{.status.accessGranted}'
+  kubectl -n tenant-test wait bucketaccesses.objectstorage.k8s.io bucket-${name}-viewer --timeout=300s --for=jsonpath='{.status.accessGranted}'
 
-  # Get and decode credentials
-  kubectl -n tenant-test get secret bucket-${name} -ojsonpath='{.data.BucketInfo}' | base64 -d > bucket-test-credentials.json
+  # Get admin (readwrite) credentials
+  kubectl -n tenant-test get secret bucket-${name}-admin -ojsonpath='{.data.BucketInfo}' | base64 -d > bucket-admin-credentials.json
+  ADMIN_ACCESS_KEY=$(jq -r '.spec.secretS3.accessKeyID' bucket-admin-credentials.json)
+  ADMIN_SECRET_KEY=$(jq -r '.spec.secretS3.accessSecretKey' bucket-admin-credentials.json)
+  BUCKET_NAME=$(jq -r '.spec.bucketName' bucket-admin-credentials.json)
 
-  # Get credentials from the secret
-  ACCESS_KEY=$(jq -r '.spec.secretS3.accessKeyID' bucket-test-credentials.json)
-  SECRET_KEY=$(jq -r '.spec.secretS3.accessSecretKey' bucket-test-credentials.json)
-  BUCKET_NAME=$(jq -r '.spec.bucketName' bucket-test-credentials.json)
+  # Get viewer (readonly) credentials
+  kubectl -n tenant-test get secret bucket-${name}-viewer -ojsonpath='{.data.BucketInfo}' | base64 -d > bucket-viewer-credentials.json
+  VIEWER_ACCESS_KEY=$(jq -r '.spec.secretS3.accessKeyID' bucket-viewer-credentials.json)
+  VIEWER_SECRET_KEY=$(jq -r '.spec.secretS3.accessSecretKey' bucket-viewer-credentials.json)
 
   # Start port-forwarding
   bash -c 'timeout 100s kubectl port-forward service/seaweedfs-s3 -n tenant-root 8333:8333 > /dev/null 2>&1 &'
@@ -31,17 +39,34 @@ EOF
   # Wait for port-forward to be ready
   timeout 30 sh -ec 'until nc -z localhost 8333; do sleep 1; done'
 
-  # Set up MinIO alias with error handling
-  mc alias set local https://localhost:8333 $ACCESS_KEY $SECRET_KEY --insecure
+  # --- Test readwrite user (admin) ---
+  mc alias set rw-user https://localhost:8333 $ADMIN_ACCESS_KEY $ADMIN_SECRET_KEY --insecure
 
-  # Upload file to bucket
-  mc cp bucket-test-credentials.json $BUCKET_NAME/bucket-test-credentials.json
+  # Admin can upload
+  echo "readwrite test" > /tmp/rw-test.txt
+  mc cp /tmp/rw-test.txt rw-user/$BUCKET_NAME/rw-test.txt
 
-  # Verify file was uploaded
-  mc ls $BUCKET_NAME/bucket-test-credentials.json
+  # Admin can list
+  mc ls rw-user/$BUCKET_NAME/rw-test.txt
 
-  # Clean up uploaded file
-  mc rm $BUCKET_NAME/bucket-test-credentials.json
+  # Admin can download
+  mc cp rw-user/$BUCKET_NAME/rw-test.txt /tmp/rw-test-download.txt
 
+  # --- Test readonly user (viewer) ---
+  mc alias set ro-user https://localhost:8333 $VIEWER_ACCESS_KEY $VIEWER_SECRET_KEY --insecure
+
+  # Viewer can list
+  mc ls ro-user/$BUCKET_NAME/rw-test.txt
+
+  # Viewer can download
+  mc cp ro-user/$BUCKET_NAME/rw-test.txt /tmp/ro-test-download.txt
+
+  # Viewer cannot upload (must fail)
+  echo "readonly test" > /tmp/ro-test.txt
+  run mc cp /tmp/ro-test.txt ro-user/$BUCKET_NAME/ro-test.txt
+  [ "$status" -ne 0 ]
+
+  # --- Cleanup ---
+  mc rm rw-user/$BUCKET_NAME/rw-test.txt
   kubectl -n tenant-test delete bucket.apps.cozystack.io ${name}
 }

From 4e8733091de12a4aa2926175eac0b9b80249f125 Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Wed, 4 Mar 2026 22:37:37 +0300
Subject: [PATCH 217/666] fix(test): add --insecure flag to all mc commands in
 bucket E2E test

The mc client requires --insecure on each command when connecting to
SeaweedFS S3 with self-signed certificates via port-forward.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 hack/e2e-apps/bucket.bats | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/hack/e2e-apps/bucket.bats b/hack/e2e-apps/bucket.bats
index 0ec4f75c..88667f72 100644
--- a/hack/e2e-apps/bucket.bats
+++ b/hack/e2e-apps/bucket.bats
@@ -44,29 +44,29 @@ EOF
 
   # Admin can upload
   echo "readwrite test" > /tmp/rw-test.txt
-  mc cp /tmp/rw-test.txt rw-user/$BUCKET_NAME/rw-test.txt
+  mc cp --insecure /tmp/rw-test.txt rw-user/$BUCKET_NAME/rw-test.txt
 
   # Admin can list
-  mc ls rw-user/$BUCKET_NAME/rw-test.txt
+  mc ls --insecure rw-user/$BUCKET_NAME/rw-test.txt
 
   # Admin can download
-  mc cp rw-user/$BUCKET_NAME/rw-test.txt /tmp/rw-test-download.txt
+  mc cp --insecure rw-user/$BUCKET_NAME/rw-test.txt /tmp/rw-test-download.txt
 
   # --- Test readonly user (viewer) ---
   mc alias set ro-user https://localhost:8333 $VIEWER_ACCESS_KEY $VIEWER_SECRET_KEY --insecure
 
   # Viewer can list
-  mc ls ro-user/$BUCKET_NAME/rw-test.txt
+  mc ls --insecure ro-user/$BUCKET_NAME/rw-test.txt
 
   # Viewer can download
-  mc cp ro-user/$BUCKET_NAME/rw-test.txt /tmp/ro-test-download.txt
+  mc cp --insecure ro-user/$BUCKET_NAME/rw-test.txt /tmp/ro-test-download.txt
 
   # Viewer cannot upload (must fail)
   echo "readonly test" > /tmp/ro-test.txt
-  run mc cp /tmp/ro-test.txt ro-user/$BUCKET_NAME/ro-test.txt
+  run mc cp --insecure /tmp/ro-test.txt ro-user/$BUCKET_NAME/ro-test.txt
   [ "$status" -ne 0 ]
 
   # --- Cleanup ---
-  mc rm rw-user/$BUCKET_NAME/rw-test.txt
+  mc rm --insecure rw-user/$BUCKET_NAME/rw-test.txt
   kubectl -n tenant-test delete bucket.apps.cozystack.io ${name}
 }

From e1b169d6a7ea5317b71529e5f3045622c162d255 Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Thu, 5 Mar 2026 08:45:57 +0300
Subject: [PATCH 218/666] fix(test): replace bats-specific run command with
 shell negation

cozytest.sh executes .bats files as plain shell functions where bats
builtins like `run` are not available. Use `!` negation to assert that
readonly user upload fails.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 hack/e2e-apps/bucket.bats | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hack/e2e-apps/bucket.bats b/hack/e2e-apps/bucket.bats
index 88667f72..9239d780 100644
--- a/hack/e2e-apps/bucket.bats
+++ b/hack/e2e-apps/bucket.bats
@@ -61,10 +61,9 @@ EOF
   # Viewer can download
   mc cp --insecure ro-user/$BUCKET_NAME/rw-test.txt /tmp/ro-test-download.txt
 
-  # Viewer cannot upload (must fail)
+  # Viewer cannot upload (must fail with Access Denied)
   echo "readonly test" > /tmp/ro-test.txt
-  run mc cp --insecure /tmp/ro-test.txt ro-user/$BUCKET_NAME/ro-test.txt
-  [ "$status" -ne 0 ]
+  ! mc cp --insecure /tmp/ro-test.txt ro-user/$BUCKET_NAME/ro-test.txt
 
   # --- Cleanup ---
   mc rm --insecure rw-user/$BUCKET_NAME/rw-test.txt

From 6408988115e8ed4cde8aef3868b6049e9ef0718c Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Thu, 5 Mar 2026 22:47:53 +0300
Subject: [PATCH 219/666] feat(monitoring): add MongoDB Grafana dashboards

Add two MongoDB dashboards adapted for cozystack monitoring:
- mongodb-overview: command operations, connections, cursors,
  document operations, queued operations, query efficiency,
  scanned objects, write time, asserts, page faults
- mongodb-inmemory: WiredTiger InMemory cache details including
  data size, capacity, transactions, sessions, pages, concurrency
  tickets, cache eviction, document changes

Dashboards use ds_prometheus variable for datasource selection and
job-based service filtering compatible with Percona MongoDB exporter
metrics.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 dashboards/mongodb/mongodb-inmemory.json | 1640 ++++++++++++++++++++++
 dashboards/mongodb/mongodb-overview.json | 1460 +++++++++++++++++++
 2 files changed, 3100 insertions(+)
 create mode 100644 dashboards/mongodb/mongodb-inmemory.json
 create mode 100644 dashboards/mongodb/mongodb-overview.json

diff --git a/dashboards/mongodb/mongodb-inmemory.json b/dashboards/mongodb/mongodb-inmemory.json
new file mode 100644
index 00000000..c774a314
--- /dev/null
+++ b/dashboards/mongodb/mongodb-inmemory.json
@@ -0,0 +1,1640 @@
+{
+    "annotations": {
+      "list": [
+        {
+          "builtIn": 1,
+          "datasource": {
+            "type": "datasource",
+            "uid": "grafana"
+          },
+          "enable": true,
+          "hide": true,
+          "iconColor": "rgba(0, 211, 255, 1)",
+          "name": "Annotations & Alerts",
+          "target": {
+            "limit": 100,
+            "matchAny": false,
+            "tags": [],
+            "type": "dashboard"
+          },
+          "type": "dashboard"
+        }
+      ]
+    },
+    "description": "MongoDB WiredTiger InMemory Details",
+    "editable": true,
+    "fiscalYearStartMonth": 0,
+    "graphTooltip": 1,
+    "links": [
+      {
+        "asDropdown": false,
+        "icon": "external link",
+        "includeVars": true,
+        "keepTime": true,
+        "tags": [
+          "mongodb"
+        ],
+        "targetBlank": false,
+        "title": "Related Dashboards",
+        "type": "dashboards"
+      }
+    ],
+    "panels": [
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Amount of data currently stored InMemory in its uncompressed format.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "fixedColor": "rgb(31, 120, 193)",
+              "mode": "fixed"
+            },
+            "decimals": 2,
+            "mappings": [
+              {
+                "options": {
+                  "match": "null",
+                  "result": {
+                    "text": "N/A"
+                  }
+                },
+                "type": "special"
+              }
+            ],
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "bytes"
+          },
+          "overrides": []
+        },
+        "gridPos": {
+          "h": 3,
+          "w": 6,
+          "x": 0,
+          "y": 0
+        },
+        "hideTimeOverride": true,
+        "id": 1,
+        "maxDataPoints": 100,
+        "options": {
+          "colorMode": "none",
+          "graphMode": "area",
+          "justifyMode": "auto",
+          "orientation": "horizontal",
+          "reduceOptions": {
+            "calcs": [
+              "lastNotNull"
+            ],
+            "fields": "",
+            "values": false
+          },
+          "showPercentChange": false,
+          "text": {
+            "valueSize": 20
+          },
+          "textMode": "auto",
+          "wideLayout": true
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "editorMode": "code",
+            "expr": "avg(mongodb_mongod_wiredtiger_cache_bytes{job=\"$job\", type=\"total\"})",
+            "interval": "5m",
+            "range": true,
+            "refId": "A"
+          }
+        ],
+        "timeFrom": "1m",
+        "title": "InMemory Data Size",
+        "type": "stat"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Maximum size the InMemory data can grow to. Configurable via storage.wiredTiger.inMemory.cacheSizeGB.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "fixedColor": "rgb(31, 120, 193)",
+              "mode": "fixed"
+            },
+            "decimals": 2,
+            "mappings": [
+              {
+                "options": {
+                  "match": "null",
+                  "result": {
+                    "text": "N/A"
+                  }
+                },
+                "type": "special"
+              }
+            ],
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "bytes"
+          },
+          "overrides": []
+        },
+        "gridPos": {
+          "h": 3,
+          "w": 6,
+          "x": 6,
+          "y": 0
+        },
+        "hideTimeOverride": true,
+        "id": 2,
+        "maxDataPoints": 100,
+        "options": {
+          "colorMode": "none",
+          "graphMode": "area",
+          "justifyMode": "auto",
+          "orientation": "horizontal",
+          "reduceOptions": {
+            "calcs": [
+              "lastNotNull"
+            ],
+            "fields": "",
+            "values": false
+          },
+          "showPercentChange": false,
+          "text": {
+            "valueSize": 20
+          },
+          "textMode": "auto",
+          "wideLayout": true
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "editorMode": "code",
+            "expr": "avg(mongodb_mongod_wiredtiger_cache_max_bytes{job=\"$job\"})",
+            "interval": "5m",
+            "range": true,
+            "refId": "A"
+          }
+        ],
+        "timeFrom": "1m",
+        "title": "InMemory Max Data Size",
+        "type": "stat"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Amount of memory left available for InMemory databases.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "thresholds"
+            },
+            "decimals": 0,
+            "mappings": [],
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "rgba(50, 172, 45, 0.97)",
+                  "value": null
+                },
+                {
+                  "color": "rgba(237, 129, 40, 0.89)",
+                  "value": 90
+                },
+                {
+                  "color": "rgba(245, 54, 54, 0.9)",
+                  "value": 95
+                }
+              ]
+            },
+            "unit": "percentunit"
+          },
+          "overrides": []
+        },
+        "gridPos": {
+          "h": 3,
+          "w": 6,
+          "x": 12,
+          "y": 0
+        },
+        "id": 3,
+        "interval": "$interval",
+        "maxDataPoints": 100,
+        "options": {
+          "colorMode": "none",
+          "graphMode": "area",
+          "justifyMode": "auto",
+          "orientation": "horizontal",
+          "reduceOptions": {
+            "calcs": [
+              "lastNotNull"
+            ],
+            "fields": "",
+            "values": false
+          },
+          "showPercentChange": false,
+          "text": {
+            "valueSize": 20
+          },
+          "textMode": "auto",
+          "wideLayout": true
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "1-(avg(mongodb_mongod_wiredtiger_cache_bytes{job=\"$job\", type=\"total\"})/avg(mongodb_mongod_wiredtiger_cache_max_bytes{job=\"$job\"}))",
+            "interval": "5m",
+            "legendFormat": "",
+            "refId": "A"
+          }
+        ],
+        "title": "InMemory Available",
+        "type": "stat"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Percentage of InMemory pages that have been changed and not yet had the modified data consolidated.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "thresholds"
+            },
+            "decimals": 0,
+            "mappings": [],
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "rgba(42, 150, 37, 0.97)",
+                  "value": null
+                },
+                {
+                  "color": "rgba(237, 129, 40, 0.89)",
+                  "value": 30
+                },
+                {
+                  "color": "rgba(245, 54, 54, 0.9)",
+                  "value": 50
+                }
+              ]
+            },
+            "unit": "percentunit"
+          },
+          "overrides": []
+        },
+        "gridPos": {
+          "h": 3,
+          "w": 6,
+          "x": 18,
+          "y": 0
+        },
+        "id": 4,
+        "interval": "$interval",
+        "maxDataPoints": 100,
+        "options": {
+          "colorMode": "none",
+          "graphMode": "area",
+          "justifyMode": "auto",
+          "orientation": "horizontal",
+          "reduceOptions": {
+            "calcs": [
+              "lastNotNull"
+            ],
+            "fields": "",
+            "values": false
+          },
+          "showPercentChange": false,
+          "text": {
+            "valueSize": 20
+          },
+          "textMode": "auto",
+          "wideLayout": true
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "avg(mongodb_mongod_wiredtiger_cache_pages{job=\"$job\",type=\"dirty\"})/avg(mongodb_mongod_wiredtiger_cache_pages{job=\"$job\",type=\"total\"})",
+            "interval": "5m",
+            "legendFormat": "",
+            "refId": "A"
+          }
+        ],
+        "title": "InMemory Dirty Pages",
+        "type": "stat"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "WiredTiger internal transactions",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "none"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "decimals": 2,
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "short"
+          },
+          "overrides": []
+        },
+        "gridPos": {
+          "h": 8,
+          "w": 12,
+          "x": 0,
+          "y": 3
+        },
+        "id": 5,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "avg by (type) (rate(mongodb_mongod_wiredtiger_transactions_total{job=\"$job\"}[$interval]) or irate(mongodb_mongod_wiredtiger_transactions_total{job=\"$job\"}[5m]))",
+            "interval": "$interval",
+            "legendFormat": "{{type}}",
+            "refId": "A"
+          }
+        ],
+        "title": "InMemory Transactions",
+        "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Configured max and current size of the WiredTiger cache.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "none"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "decimals": 2,
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "bytes"
+          },
+          "overrides": []
+        },
+        "gridPos": {
+          "h": 8,
+          "w": 12,
+          "x": 12,
+          "y": 3
+        },
+        "id": 6,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "avg(mongodb_mongod_wiredtiger_cache_max_bytes{job=\"$job\"})",
+            "interval": "$interval",
+            "legendFormat": "Maximum",
+            "refId": "A"
+          },
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "avg(mongodb_mongod_wiredtiger_cache_bytes{job=\"$job\", type=\"total\"})",
+            "interval": "$interval",
+            "legendFormat": "Used",
+            "refId": "B"
+          }
+        ],
+        "title": "InMemory Capacity",
+        "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Internal WiredTiger storage engine cursors and sessions currently open.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "none"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "decimals": 2,
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "short"
+          },
+          "overrides": []
+        },
+        "gridPos": {
+          "h": 8,
+          "w": 12,
+          "x": 0,
+          "y": 11
+        },
+        "id": 7,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "avg(mongodb_mongod_wiredtiger_session_open_cursors_total{job=\"$job\"})",
+            "interval": "$interval",
+            "legendFormat": "Cursors",
+            "refId": "A"
+          },
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "avg(mongodb_mongod_wiredtiger_session_open_sessions_total{job=\"$job\"})",
+            "interval": "$interval",
+            "legendFormat": "Sessions",
+            "refId": "B"
+          }
+        ],
+        "title": "InMemory Sessions",
+        "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Pages in the WiredTiger cache",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "none"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "decimals": 2,
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "short"
+          },
+          "overrides": []
+        },
+        "gridPos": {
+          "h": 8,
+          "w": 12,
+          "x": 12,
+          "y": 11
+        },
+        "id": 8,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "avg by (type) (mongodb_mongod_wiredtiger_cache_pages{job=\"$job\"})",
+            "interval": "$interval",
+            "legendFormat": "{{type}}",
+            "refId": "A"
+          }
+        ],
+        "title": "InMemory Pages",
+        "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "A WiredTiger 'ticket' is assigned for every operation running simultaneously in the storage engine.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "none"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "decimals": 2,
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "short"
+          },
+          "overrides": [
+            {
+              "matcher": {
+                "id": "byRegexp",
+                "options": "/^write_/"
+              },
+              "properties": [
+                {
+                  "id": "custom.transform",
+                  "value": "negative-Y"
+                }
+              ]
+            }
+          ]
+        },
+        "gridPos": {
+          "h": 8,
+          "w": 12,
+          "x": 0,
+          "y": 19
+        },
+        "id": 9,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "avg by (type) (mongodb_mongod_wiredtiger_concurrent_transactions_total_tickets{job=\"$job\"}-mongodb_mongod_wiredtiger_concurrent_transactions_out_tickets{job=\"$job\"})",
+            "interval": "$interval",
+            "legendFormat": "{{type}}",
+            "refId": "A"
+          }
+        ],
+        "title": "InMemory Concurrency Tickets",
+        "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Operations queued due to a lock",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "none"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "decimals": 2,
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "short"
+          },
+          "overrides": []
+        },
+        "gridPos": {
+          "h": 8,
+          "w": 12,
+          "x": 12,
+          "y": 19
+        },
+        "id": 10,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "avg by (type) (mongodb_mongod_global_lock_current_queue{job=\"$job\"})",
+            "interval": "$interval",
+            "legendFormat": "{{type}}",
+            "refId": "A"
+          }
+        ],
+        "title": "Queued Operations",
+        "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Documents per second inserted, updated, deleted or returned.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "normal"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "decimals": 2,
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "ops"
+          },
+          "overrides": [
+            {
+              "matcher": {
+                "id": "byValue",
+                "options": {
+                  "op": "gte",
+                  "reducer": "allIsZero",
+                  "value": 0
+                }
+              },
+              "properties": [
+                {
+                  "id": "custom.hideFrom",
+                  "value": {
+                    "legend": true,
+                    "tooltip": true,
+                    "viz": false
+                  }
+                }
+              ]
+            }
+          ]
+        },
+        "gridPos": {
+          "h": 8,
+          "w": 12,
+          "x": 0,
+          "y": 27
+        },
+        "id": 11,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "avg by (state) (rate(mongodb_mongod_metrics_document_total{job=\"$job\"}[$interval]) or irate(mongodb_mongod_metrics_document_total{job=\"$job\"}[5m]))",
+            "interval": "$interval",
+            "legendFormat": "{{state}}",
+            "refId": "A"
+          },
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "avg(rate(mongodb_mongod_op_counters_repl_total{job=\"$job\", type=\"delete\"}[$interval]) or irate(mongodb_mongod_op_counters_repl_total{job=\"$job\", type=\"delete\"}[5m]))",
+            "interval": "$interval",
+            "legendFormat": "repl_deleted",
+            "refId": "B"
+          },
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "avg(rate(mongodb_mongod_op_counters_repl_total{job=\"$job\", type=\"update\"}[$interval]) or irate(mongodb_mongod_op_counters_repl_total{job=\"$job\", type=\"update\"}[5m]))",
+            "interval": "$interval",
+            "legendFormat": "repl_updated",
+            "refId": "C"
+          },
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "avg(rate(mongodb_mongod_op_counters_repl_total{job=\"$job\", type=\"insert\"}[$interval]) or irate(mongodb_mongod_op_counters_repl_total{job=\"$job\", type=\"insert\"}[5m]))",
+            "interval": "$interval",
+            "legendFormat": "repl_inserted",
+            "refId": "D"
+          },
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "avg(rate(mongodb_mongod_metrics_ttl_deleted_documents_total{job=\"$job\"}[$interval]) or irate(mongodb_mongod_metrics_ttl_deleted_documents_total{job=\"$job\"}[5m]))",
+            "interval": "$interval",
+            "legendFormat": "ttl_deleted",
+            "refId": "E"
+          }
+        ],
+        "title": "Document Changes",
+        "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Number of pages evicted from the WiredTiger cache. The InMemory storage engine only evicts modified pages.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "Pages / sec",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 60,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "normal"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "decimals": 2,
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "short"
+          },
+          "overrides": []
+        },
+        "gridPos": {
+          "h": 8,
+          "w": 12,
+          "x": 12,
+          "y": 27
+        },
+        "id": 12,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "avg(rate(mongodb_mongod_wiredtiger_cache_evicted_total{job=\"$job\",type=\"modified\"}[$interval]) or irate(mongodb_mongod_wiredtiger_cache_evicted_total{job=\"$job\",type=\"modified\"}[5m]))",
+            "interval": "$interval",
+            "legendFormat": "Evicted",
+            "refId": "A"
+          }
+        ],
+        "title": "InMemory Cache Eviction",
+        "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Number of objects scanned (data and index) and documents moved to a new location.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "none"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "decimals": 2,
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "ops"
+          },
+          "overrides": [
+            {
+              "matcher": {
+                "id": "byValue",
+                "options": {
+                  "op": "gte",
+                  "reducer": "allIsZero",
+                  "value": 0
+                }
+              },
+              "properties": [
+                {
+                  "id": "custom.hideFrom",
+                  "value": {
+                    "legend": true,
+                    "tooltip": true,
+                    "viz": false
+                  }
+                }
+              ]
+            }
+          ]
+        },
+        "gridPos": {
+          "h": 8,
+          "w": 12,
+          "x": 0,
+          "y": 35
+        },
+        "id": 13,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "avg by (state) (rate(mongodb_mongod_metrics_query_executor_total{job=\"$job\"}[$interval]) or irate(mongodb_mongod_metrics_query_executor_total{job=\"$job\"}[5m]))",
+            "interval": "$interval",
+            "legendFormat": "{{state}}",
+            "refId": "A"
+          },
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "avg(rate(mongodb_mongod_metrics_record_moves_total{job=\"$job\"}[$interval]) or irate(mongodb_mongod_metrics_record_moves_total{job=\"$job\"}[5m]))",
+            "interval": "$interval",
+            "legendFormat": "moved",
+            "refId": "B"
+          }
+        ],
+        "title": "Scanned and Moved Objects",
+        "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Memory page faults. Not necessarily from MongoDB.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "none"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "decimals": 2,
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "short"
+          },
+          "overrides": []
+        },
+        "gridPos": {
+          "h": 8,
+          "w": 12,
+          "x": 12,
+          "y": 35
+        },
+        "id": 14,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "avg(rate(mongodb_mongod_extra_info_page_faults_total{job=\"$job\"}[$interval]) or irate(mongodb_mongod_extra_info_page_faults_total{job=\"$job\"}[5m]) or rate(mongodb_extra_info_page_faults_total{job=\"$job\"}[$interval]) or irate(mongodb_extra_info_page_faults_total{job=\"$job\"}[5m]))",
+            "interval": "$interval",
+            "legendFormat": "Faults",
+            "refId": "A"
+          }
+        ],
+        "title": "Page Faults",
+        "type": "timeseries"
+      }
+    ],
+    "preload": false,
+    "refresh": "30s",
+    "schemaVersion": 39,
+    "tags": [
+      "mongodb"
+    ],
+    "templating": {
+      "list": [
+        {
+          "current": {
+            "selected": false,
+            "text": "default",
+            "value": "default"
+          },
+          "hide": 0,
+          "includeAll": false,
+          "label": "Datasource",
+          "multi": false,
+          "name": "ds_prometheus",
+          "options": [],
+          "query": "prometheus",
+          "queryValue": "",
+          "refresh": 1,
+          "regex": "",
+          "skipUrlSync": false,
+          "type": "datasource"
+        },
+        {
+          "auto": true,
+          "auto_count": 200,
+          "auto_min": "1s",
+          "current": {
+            "selected": false,
+            "text": "auto",
+            "value": "$__auto_interval_interval"
+          },
+          "hide": 0,
+          "label": "Interval",
+          "name": "interval",
+          "options": [
+            {
+              "selected": true,
+              "text": "auto",
+              "value": "$__auto_interval_interval"
+            },
+            {
+              "selected": false,
+              "text": "1s",
+              "value": "1s"
+            },
+            {
+              "selected": false,
+              "text": "5s",
+              "value": "5s"
+            },
+            {
+              "selected": false,
+              "text": "1m",
+              "value": "1m"
+            },
+            {
+              "selected": false,
+              "text": "5m",
+              "value": "5m"
+            },
+            {
+              "selected": false,
+              "text": "1h",
+              "value": "1h"
+            },
+            {
+              "selected": false,
+              "text": "6h",
+              "value": "6h"
+            },
+            {
+              "selected": false,
+              "text": "1d",
+              "value": "1d"
+            }
+          ],
+          "query": "1s,5s,1m,5m,1h,6h,1d",
+          "refresh": 2,
+          "skipUrlSync": false,
+          "type": "interval"
+        },
+        {
+          "current": {
+            "selected": false,
+            "text": "",
+            "value": ""
+          },
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${ds_prometheus}"
+          },
+          "definition": "label_values(mongodb_up, job)",
+          "hide": 0,
+          "includeAll": false,
+          "label": "Service",
+          "multi": false,
+          "name": "job",
+          "options": [],
+          "query": {
+            "query": "label_values(mongodb_up, job)",
+            "refId": "PrometheusVariableQueryEditor-VariableQuery"
+          },
+          "refresh": 1,
+          "regex": "",
+          "skipUrlSync": false,
+          "sort": 1,
+          "type": "query"
+        }
+      ]
+    },
+    "time": {
+      "from": "now-6h",
+      "to": "now"
+    },
+    "timepicker": {},
+    "timezone": "",
+    "title": "MongoDB InMemory Details",
+    "uid": "mongodb-inmemory",
+    "version": 1,
+    "weekStart": ""
+}
\ No newline at end of file
diff --git a/dashboards/mongodb/mongodb-overview.json b/dashboards/mongodb/mongodb-overview.json
new file mode 100644
index 00000000..558c8490
--- /dev/null
+++ b/dashboards/mongodb/mongodb-overview.json
@@ -0,0 +1,1460 @@
+{
+    "annotations": {
+      "list": [
+        {
+          "builtIn": 1,
+          "datasource": {
+            "type": "datasource",
+            "uid": "grafana"
+          },
+          "enable": true,
+          "hide": true,
+          "iconColor": "rgba(0, 211, 255, 1)",
+          "name": "Annotations & Alerts",
+          "target": {
+            "limit": 100,
+            "matchAny": false,
+            "tags": [],
+            "type": "dashboard"
+          },
+          "type": "dashboard"
+        }
+      ]
+    },
+    "description": "MongoDB Overview Dashboard",
+    "editable": true,
+    "fiscalYearStartMonth": 0,
+    "graphTooltip": 1,
+    "links": [
+      {
+        "asDropdown": false,
+        "icon": "external link",
+        "includeVars": true,
+        "keepTime": true,
+        "tags": [
+          "mongodb"
+        ],
+        "targetBlank": false,
+        "title": "Related Dashboards",
+        "type": "dashboards"
+      }
+    ],
+    "panels": [
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Shows how many times a command is executed per second on average during the selected interval.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "none"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "ops"
+          },
+          "overrides": [
+            {
+              "matcher": {
+                "id": "byValue",
+                "options": {
+                  "op": "gte",
+                  "reducer": "allIsZero",
+                  "value": 0
+                }
+              },
+              "properties": [
+                {
+                  "id": "custom.hideFrom",
+                  "value": {
+                    "legend": true,
+                    "tooltip": true,
+                    "viz": false
+                  }
+                }
+              ]
+            }
+          ]
+        },
+        "gridPos": {
+          "h": 7,
+          "w": 24,
+          "x": 0,
+          "y": 0
+        },
+        "id": 1,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "right",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "editorMode": "code",
+            "expr": "rate(mongodb_mongod_op_counters_total{job=~\"$job\", type!=\"command\"}[$interval]) or \nirate(mongodb_mongod_op_counters_total{job=~\"$job\", type!=\"command\"}[5m]) or \nrate(mongodb_mongos_op_counters_total{job=~\"$job\", type!=\"command\"}[$interval]) or \nirate(mongodb_mongos_op_counters_total{job=~\"$job\", type!=\"command\"}[5m])",
+            "interval": "$interval",
+            "legendFormat": "{{type}}",
+            "range": true,
+            "refId": "A"
+          },
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "rate(mongodb_mongod_op_counters_repl_total{job=~\"$job\", type!~\"(command|query|getmore)\"}[$interval]) or \nirate(mongodb_mongod_op_counters_repl_total{job=~\"$job\", type!~\"(command|query|getmore)\"}[5m]) or\nrate(mongodb_mongos_op_counters_repl_total{job=~\"$job\", type!~\"(command|query|getmore)\"}[$interval]) or \nirate(mongodb_mongos_op_counters_repl_total{job=~\"$job\", type!~\"(command|query|getmore)\"}[5m])",
+            "interval": "$interval",
+            "legendFormat": "repl_{{type}}",
+            "refId": "B"
+          },
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "rate(mongodb_mongod_metrics_ttl_deleted_documents_total{job=~\"$job\"}[$interval]) or \nirate(mongodb_mongod_metrics_ttl_deleted_documents_total{job=~\"$job\"}[5m]) or\nrate(mongodb_mongos_metrics_ttl_deleted_documents_total{job=~\"$job\"}[$interval]) or \nirate(mongodb_mongos_metrics_ttl_deleted_documents_total{job=~\"$job\"}[5m])",
+            "interval": "$interval",
+            "legendFormat": "ttl_delete",
+            "refId": "C"
+          }
+        ],
+        "title": "Command Operations",
+        "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Keep in mind the hard limit on the maximum number of connections set by your distribution.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "none"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "short"
+          },
+          "overrides": []
+        },
+        "gridPos": {
+          "h": 7,
+          "w": 12,
+          "x": 0,
+          "y": 7
+        },
+        "id": 2,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "editorMode": "code",
+            "expr": "mongodb_connections{job=~\"$job\", state=\"current\"}",
+            "interval": "$interval",
+            "legendFormat": "{{pod}}",
+            "range": true,
+            "refId": "A"
+          }
+        ],
+        "title": "Connections",
+        "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Helps identify why connections are increasing. Shows active cursors compared to cursors being automatically killed after 10 minutes due to an application not closing the connection.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "none"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "short"
+          },
+          "overrides": [
+            {
+              "matcher": {
+                "id": "byValue",
+                "options": {
+                  "op": "gte",
+                  "reducer": "allIsZero",
+                  "value": 0
+                }
+              },
+              "properties": [
+                {
+                  "id": "custom.hideFrom",
+                  "value": {
+                    "legend": true,
+                    "tooltip": true,
+                    "viz": false
+                  }
+                }
+              ]
+            }
+          ]
+        },
+        "gridPos": {
+          "h": 7,
+          "w": 12,
+          "x": 12,
+          "y": 7
+        },
+        "id": 3,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "mongodb_mongod_metrics_cursor_open{job=~\"$job\"} or\nmongodb_mongod_cursors{job=~\"$job\"} or\nmongodb_mongos_metrics_cursor_open{job=~\"$job\"} or \nmongodb_mongos_cursors{job=~\"$job\"}",
+            "interval": "$interval",
+            "legendFormat": "{{state}}",
+            "refId": "A"
+          }
+        ],
+        "title": "Cursors",
+        "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "When used in combination with 'Command Operations', this graph can help identify write amplification.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "none"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "ops"
+          },
+          "overrides": [
+            {
+              "matcher": {
+                "id": "byValue",
+                "options": {
+                  "op": "gte",
+                  "reducer": "allIsZero",
+                  "value": 0
+                }
+              },
+              "properties": [
+                {
+                  "id": "custom.hideFrom",
+                  "value": {
+                    "legend": true,
+                    "tooltip": true,
+                    "viz": false
+                  }
+                }
+              ]
+            }
+          ]
+        },
+        "gridPos": {
+          "h": 7,
+          "w": 12,
+          "x": 0,
+          "y": 14
+        },
+        "id": 4,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "rate(mongodb_mongod_metrics_document_total{job=~\"$job\"}[$interval]) or \nirate(mongodb_mongod_metrics_document_total{job=~\"$job\"}[5m])",
+            "interval": "$interval",
+            "legendFormat": "{{state}}",
+            "refId": "A"
+          }
+        ],
+        "title": "Document Operations",
+        "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Any number of queued operations for long periods of time is an indication of possible issues. Find the cause and fix it before requests get stuck in the queue.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "none"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "ops"
+          },
+          "overrides": []
+        },
+        "gridPos": {
+          "h": 7,
+          "w": 12,
+          "x": 12,
+          "y": 14
+        },
+        "id": 5,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "mongodb_mongod_global_lock_current_queue{job=~\"$job\"}",
+            "interval": "$interval",
+            "legendFormat": "{{type}}",
+            "refId": "A"
+          }
+        ],
+        "title": "Queued Operations",
+        "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Ratio of scanned objects/indexes to returned documents. High values indicate inefficient queries.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "none"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "percentunit"
+          },
+          "overrides": []
+        },
+        "gridPos": {
+          "h": 7,
+          "w": 12,
+          "x": 0,
+          "y": 21
+        },
+        "id": 6,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "sum(increase(mongodb_mongod_metrics_query_executor_total{job=~\"$job\", state=\"scanned_objects\"}[5m]))/sum(increase(mongodb_mongod_metrics_document_total{job=~\"$job\", state=\"returned\"}[5m]))",
+            "interval": "$interval",
+            "legendFormat": "Document",
+            "refId": "A"
+          },
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "sum(increase(mongodb_mongod_metrics_query_executor_total{job=~\"$job\", state=\"scanned\"}[5m]))/sum(increase(mongodb_mongod_metrics_document_total{job=~\"$job\", state=\"returned\"}[5m]))",
+            "interval": "$interval",
+            "legendFormat": "Index",
+            "refId": "B"
+          }
+        ],
+        "title": "Query Efficiency",
+        "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Number of objects scanned during queries and number of documents moved.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "none"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "ops"
+          },
+          "overrides": [
+            {
+              "matcher": {
+                "id": "byValue",
+                "options": {
+                  "op": "gte",
+                  "reducer": "allIsZero",
+                  "value": 0
+                }
+              },
+              "properties": [
+                {
+                  "id": "custom.hideFrom",
+                  "value": {
+                    "legend": true,
+                    "tooltip": true,
+                    "viz": false
+                  }
+                }
+              ]
+            }
+          ]
+        },
+        "gridPos": {
+          "h": 7,
+          "w": 12,
+          "x": 12,
+          "y": 21
+        },
+        "id": 7,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "rate(mongodb_mongod_metrics_query_executor_total{job=~\"$job\"}[$interval]) or irate(mongodb_mongod_metrics_query_executor_total{job=~\"$job\"}[5m])",
+            "interval": "$interval",
+            "legendFormat": "{{state}}",
+            "refId": "A"
+          },
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "rate(mongodb_mongod_metrics_record_moves_total{job=~\"$job\"}[$interval]) or irate(mongodb_mongod_metrics_record_moves_total{job=~\"$job\"}[5m])",
+            "interval": "$interval",
+            "legendFormat": "moved",
+            "refId": "B"
+          }
+        ],
+        "title": "Scanned and Moved Objects",
+        "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Useful for write-heavy workloads to understand how long it takes to verify writes.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "none"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "ms"
+          },
+          "overrides": []
+        },
+        "gridPos": {
+          "h": 7,
+          "w": 12,
+          "x": 0,
+          "y": 28
+        },
+        "id": 8,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "rate(mongodb_mongod_metrics_get_last_error_wtime_total_milliseconds{job=~\"$job\"}[$interval]) or \nirate(mongodb_mongod_metrics_get_last_error_wtime_total_milliseconds{job=~\"$job\"}[5m]) or\nrate(mongodb_mongos_metrics_get_last_error_wtime_total_milliseconds{job=~\"$job\"}[$interval]) or \nirate(mongodb_mongos_metrics_get_last_error_wtime_total_milliseconds{job=~\"$job\"}[5m])",
+            "interval": "$interval",
+            "legendFormat": "Write Wait Time",
+            "refId": "A"
+          }
+        ],
+        "title": "getLastError Write Time",
+        "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Useful for write-heavy workloads to understand how many concurrent writes are occurring.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "none"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "ops"
+          },
+          "overrides": [
+            {
+              "matcher": {
+                "id": "byValue",
+                "options": {
+                  "op": "gte",
+                  "reducer": "allIsZero",
+                  "value": 0
+                }
+              },
+              "properties": [
+                {
+                  "id": "custom.hideFrom",
+                  "value": {
+                    "legend": true,
+                    "tooltip": true,
+                    "viz": false
+                  }
+                }
+              ]
+            }
+          ]
+        },
+        "gridPos": {
+          "h": 7,
+          "w": 12,
+          "x": 12,
+          "y": 28
+        },
+        "id": 9,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "rate(mongodb_mongod_metrics_get_last_error_wtime_num_total{job=~\"$job\"}[$interval]) or \nirate(mongodb_mongod_metrics_get_last_error_wtime_num_total{job=~\"$job\"}[5m]) or\nrate(mongodb_mongos_metrics_get_last_error_wtime_num_total{job=~\"$job\"}[$interval]) or \nirate(mongodb_mongos_metrics_get_last_error_wtime_num_total{job=~\"$job\"}[5m])",
+            "interval": "$interval",
+            "legendFormat": "Total",
+            "refId": "A"
+          },
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "rate(mongodb_mongod_metrics_get_last_error_wtimeouts_total{job=~\"$job\"}[$interval]) or\nirate(mongodb_mongod_metrics_get_last_error_wtimeouts_total{job=~\"$job\"}[5m]) or\nrate(mongodb_mongos_metrics_get_last_error_wtimeouts_total{job=~\"$job\"}[$interval]) or\nirate(mongodb_mongos_metrics_get_last_error_wtimeouts_total{job=~\"$job\"}[5m])",
+            "interval": "$interval",
+            "legendFormat": "Timeouts",
+            "refId": "B"
+          }
+        ],
+        "title": "getLastError Write Operations",
+        "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Asserts are not important by themselves, but you can correlate spikes with other graphs.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "none"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "short"
+          },
+          "overrides": [
+            {
+              "matcher": {
+                "id": "byValue",
+                "options": {
+                  "op": "gte",
+                  "reducer": "allIsZero",
+                  "value": 0
+                }
+              },
+              "properties": [
+                {
+                  "id": "custom.hideFrom",
+                  "value": {
+                    "legend": true,
+                    "tooltip": true,
+                    "viz": false
+                  }
+                }
+              ]
+            }
+          ]
+        },
+        "gridPos": {
+          "h": 7,
+          "w": 12,
+          "x": 0,
+          "y": 35
+        },
+        "id": 10,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "rate(mongodb_mongod_asserts_total{job=~\"$job\"}[$interval]) or \nirate(mongodb_mongod_asserts_total{job=~\"$job\"}[5m]) or\nrate(mongodb_mongos_asserts_total{job=~\"$job\"}[$interval]) or \nirate(mongodb_mongos_asserts_total{job=~\"$job\"}[5m])",
+            "interval": "$interval",
+            "legendFormat": "{{type}}",
+            "refId": "A"
+          }
+        ],
+        "title": "Assert Events",
+        "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${ds_prometheus}"
+        },
+        "description": "Page faults indicate that requests are processed from disk either because an index is missing or there is not enough memory for the data set.",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "palette-classic"
+            },
+            "custom": {
+              "axisBorderShow": false,
+              "axisCenteredZero": false,
+              "axisColorMode": "text",
+              "axisLabel": "",
+              "axisPlacement": "auto",
+              "barAlignment": 0,
+              "barWidthFactor": 0.6,
+              "drawStyle": "line",
+              "fillOpacity": 20,
+              "gradientMode": "none",
+              "hideFrom": {
+                "legend": false,
+                "tooltip": false,
+                "viz": false
+              },
+              "insertNulls": false,
+              "lineInterpolation": "linear",
+              "lineWidth": 2,
+              "pointSize": 5,
+              "scaleDistribution": {
+                "type": "linear"
+              },
+              "showPoints": "never",
+              "spanNulls": false,
+              "stacking": {
+                "group": "A",
+                "mode": "none"
+              },
+              "thresholdsStyle": {
+                "mode": "off"
+              }
+            },
+            "mappings": [],
+            "min": 0,
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": null
+                },
+                {
+                  "color": "red",
+                  "value": 80
+                }
+              ]
+            },
+            "unit": "short"
+          },
+          "overrides": []
+        },
+        "gridPos": {
+          "h": 7,
+          "w": 12,
+          "x": 12,
+          "y": 35
+        },
+        "id": 11,
+        "options": {
+          "legend": {
+            "calcs": [
+              "mean",
+              "max",
+              "min"
+            ],
+            "displayMode": "table",
+            "placement": "bottom",
+            "showLegend": true
+          },
+          "tooltip": {
+            "mode": "multi",
+            "sort": "none"
+          }
+        },
+        "targets": [
+          {
+            "datasource": {
+              "type": "prometheus",
+              "uid": "${ds_prometheus}"
+            },
+            "expr": "rate(mongodb_mongod_extra_info_page_faults_total{job=~\"$job\"}[$interval]) or \nirate(mongodb_mongod_extra_info_page_faults_total{job=~\"$job\"}[5m]) or\nrate(mongodb_mongos_extra_info_page_faults_total{job=~\"$job\"}[$interval]) or \nirate(mongodb_mongos_extra_info_page_faults_total{job=~\"$job\"}[5m])",
+            "interval": "$interval",
+            "legendFormat": "Faults",
+            "refId": "A"
+          }
+        ],
+        "title": "Page Faults",
+        "type": "timeseries"
+      }
+    ],
+    "preload": false,
+    "refresh": "30s",
+    "schemaVersion": 39,
+    "tags": [
+      "mongodb"
+    ],
+    "templating": {
+      "list": [
+        {
+          "current": {
+            "selected": false,
+            "text": "default",
+            "value": "default"
+          },
+          "hide": 0,
+          "includeAll": false,
+          "label": "Datasource",
+          "multi": false,
+          "name": "ds_prometheus",
+          "options": [],
+          "query": "prometheus",
+          "queryValue": "",
+          "refresh": 1,
+          "regex": "",
+          "skipUrlSync": false,
+          "type": "datasource"
+        },
+        {
+          "auto": true,
+          "auto_count": 200,
+          "auto_min": "1s",
+          "current": {
+            "selected": false,
+            "text": "auto",
+            "value": "$__auto_interval_interval"
+          },
+          "hide": 0,
+          "label": "Interval",
+          "name": "interval",
+          "options": [
+            {
+              "selected": true,
+              "text": "auto",
+              "value": "$__auto_interval_interval"
+            },
+            {
+              "selected": false,
+              "text": "1s",
+              "value": "1s"
+            },
+            {
+              "selected": false,
+              "text": "5s",
+              "value": "5s"
+            },
+            {
+              "selected": false,
+              "text": "1m",
+              "value": "1m"
+            },
+            {
+              "selected": false,
+              "text": "5m",
+              "value": "5m"
+            },
+            {
+              "selected": false,
+              "text": "1h",
+              "value": "1h"
+            },
+            {
+              "selected": false,
+              "text": "6h",
+              "value": "6h"
+            },
+            {
+              "selected": false,
+              "text": "1d",
+              "value": "1d"
+            }
+          ],
+          "query": "1s,5s,1m,5m,1h,6h,1d",
+          "refresh": 2,
+          "skipUrlSync": false,
+          "type": "interval"
+        },
+        {
+          "current": {
+            "selected": false,
+            "text": "",
+            "value": ""
+          },
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${ds_prometheus}"
+          },
+          "definition": "label_values(mongodb_up, job)",
+          "hide": 0,
+          "includeAll": true,
+          "label": "Service",
+          "multi": true,
+          "name": "job",
+          "options": [],
+          "query": {
+            "query": "label_values(mongodb_up, job)",
+            "refId": "PrometheusVariableQueryEditor-VariableQuery"
+          },
+          "refresh": 1,
+          "regex": "",
+          "skipUrlSync": false,
+          "sort": 1,
+          "type": "query"
+        }
+      ]
+    },
+    "time": {
+      "from": "now-6h",
+      "to": "now"
+    },
+    "timepicker": {},
+    "timezone": "",
+    "title": "MongoDB Overview",
+    "uid": "mongodb-overview",
+    "version": 1,
+    "weekStart": ""
+}
\ No newline at end of file

From c838358c263b81b21c3fbcc599d4f7bbd9eb1299 Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Thu, 5 Mar 2026 22:48:05 +0300
Subject: [PATCH 220/666] feat(monitoring): register MongoDB dashboards in
 dashboards.list

Add mongodb/mongodb-overview and mongodb/mongodb-inmemory entries
to the monitoring dashboards list so GrafanaDashboard CRDs are
generated and dashboards are served by the grafana-dashboards
HTTP service.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 packages/system/monitoring/dashboards.list | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/packages/system/monitoring/dashboards.list b/packages/system/monitoring/dashboards.list
index 6ad8630f..34aead18 100644
--- a/packages/system/monitoring/dashboards.list
+++ b/packages/system/monitoring/dashboards.list
@@ -45,3 +45,5 @@ hubble/l7-http-metrics
 hubble/network-overview
 nats/nats-jetstream
 nats/nats-server
+mongodb/mongodb-overview
+mongodb/mongodb-inmemory

From 133a071d6b781379fc6ae31b7aaf44fcdabc83c0 Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Fri, 6 Mar 2026 01:42:51 +0000
Subject: [PATCH 221/666] docs: add changelog for v1.0.3

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.0.3.md | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 docs/changelogs/v1.0.3.md

diff --git a/docs/changelogs/v1.0.3.md b/docs/changelogs/v1.0.3.md
new file mode 100644
index 00000000..27ae6720
--- /dev/null
+++ b/docs/changelogs/v1.0.3.md
@@ -0,0 +1,17 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.0.3
+-->
+
+## Fixes
+
+* **[platform] Fix package name conversion in migration script**: Fixed the `migrate-to-version-1.0.sh` script to correctly prepend the `cozystack.` prefix when converting `BUNDLE_DISABLE` and `BUNDLE_ENABLE` package name lists, ensuring packages are properly identified during the v0.41→v1.0 upgrade ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2144, #2148).
+
+## Documentation
+
+* **[website] Add white labeling guide**: Added a comprehensive guide for configuring white labeling (branding) in Cozystack v1, covering Dashboard fields (`titleText`, `footerText`, `tenantText`, `logoText`, `logoSvg`, `iconSvg`) and Keycloak fields (`brandName`, `brandHtmlName`). Includes SVG preparation workflow with theme-aware template variables, portable base64 encoding, and migration notes from the v0 ConfigMap approach ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#441).
+
+* **[website] Actualize backup and recovery documentation**: Reworked the backup and recovery docs to be user-focused, separating operator and tenant workflows. Added tenant-facing documentation for `BackupJob` and `Plan` resources and status inspection commands, and added a new Velero administration guide for operators covering storage credentials and backup storage configuration ([**@androndo**](https://github.com/androndo) in cozystack/website#434).
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.2...v1.0.3

From 612b4773bcc8af005692b86acc2fbc94f9f76654 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Fri, 6 Mar 2026 10:56:52 +0500
Subject: [PATCH 222/666] [docs] Fixed FoundationDB title

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/apps/foundationdb/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/apps/foundationdb/README.md b/packages/apps/foundationdb/README.md
index 4f7b6878..30f5714e 100644
--- a/packages/apps/foundationdb/README.md
+++ b/packages/apps/foundationdb/README.md
@@ -1,4 +1,4 @@
-# FoundationDB
+# Managed FoundationDB Service
 
 A managed FoundationDB service for Cozystack.
 

From fd436a7baa09f1a512a64277797b55c2211e9331 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Fri, 6 Mar 2026 13:08:30 +0500
Subject: [PATCH 223/666] Fixed typos in readme

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/apps/harbor/README.md  | 2 +-
 packages/apps/mariadb/README.md | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/packages/apps/harbor/README.md b/packages/apps/harbor/README.md
index df44ca8d..7789d9fe 100644
--- a/packages/apps/harbor/README.md
+++ b/packages/apps/harbor/README.md
@@ -1,6 +1,6 @@
 # Managed Harbor Container Registry
 
-Harbor is an open source trusted cloud native registry project that stores, signs, and scans content.
+Harbor is an open-source trusted cloud-native registry project that stores, signs, and scans content.
 
 ## Parameters
 
diff --git a/packages/apps/mariadb/README.md b/packages/apps/mariadb/README.md
index bb3ea8ac..9d97dc5f 100644
--- a/packages/apps/mariadb/README.md
+++ b/packages/apps/mariadb/README.md
@@ -15,7 +15,7 @@ This managed service is controlled by mariadb-operator, ensuring efficient manag
 ### How to switch master/slave replica
 
 ```bash
-kubectl edit mariadb <instnace>
+kubectl edit mariadb <instance>
 ```
 update:
 
@@ -54,11 +54,11 @@ more details:
 - **Replication can't be finished with various errors**
 - **Replication can't be finished in case if `binlog` purged**
 
-  Until `mariadbbackup` is not used to bootstrap a node by mariadb-operator (this feature is not inmplemented yet), follow these manual steps to fix it:
+  Until `mariadbbackup` is not used to bootstrap a node by mariadb-operator (this feature is not implemented yet), follow these manual steps to fix it:
   https://github.com/mariadb-operator/mariadb-operator/issues/141#issuecomment-1804760231
 
-- **Corrupted indicies**
-  Sometimes some indecies can be corrupted on master replica, you can recover them from slave:
+- **Corrupted indices**
+  Sometimes some indices can be corrupted on master replica, you can recover them from slave:
 
   ```bash
   mysqldump -h <slave> -P 3306 -u<user> -p<password> --column-statistics=0 <database> <table> ~/tmp/fix-table.sql

From 0873691913cfb02b855241bd9c1a9bfcddb5b7c6 Mon Sep 17 00:00:00 2001
From: mattia-eleuteri <mattia@hidora.io>
Date: Fri, 6 Mar 2026 10:19:52 +0100
Subject: [PATCH 224/666] fix(keycloak): use management port health endpoints
 for probes

Keycloak 26.x exposes dedicated health endpoints on the management
port (9000) via /health/live and /health/ready. The previous probes
used GET / on port 8080 which redirects to the configured KC_HOSTNAME
(HTTPS), causing kubelet to fail the probe with "Probe terminated
redirects" and eventually kill the pod in a crashloop.

Changes:
- Add KC_HEALTH_ENABLED=true to activate health endpoints
- Expose management port 9000 in container ports
- Switch liveness probe to /health/live on port 9000
- Switch readiness probe to /health/ready on port 9000
- Increase failure thresholds for more tolerance during startup

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: mattia-eleuteri <mattia@hidora.io>
---
 packages/system/keycloak/templates/sts.yaml | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/packages/system/keycloak/templates/sts.yaml b/packages/system/keycloak/templates/sts.yaml
index 1cdbec62..60cdb9d2 100644
--- a/packages/system/keycloak/templates/sts.yaml
+++ b/packages/system/keycloak/templates/sts.yaml
@@ -76,6 +76,8 @@ spec:
             {{- end }}
             - name: KC_METRICS_ENABLED
               value: "true"
+            - name: KC_HEALTH_ENABLED
+              value: "true"
             - name: KC_LOG_LEVEL
               value: "info"
             - name: KC_CACHE
@@ -128,16 +130,23 @@ spec:
             - name: http
               containerPort: 8080
               protocol: TCP
+            - name: management
+              containerPort: 9000
+              protocol: TCP
           livenessProbe:
             httpGet:
-              path: /
-              port: http
+              path: /health/live
+              port: management
             initialDelaySeconds: 120
+            periodSeconds: 15
             timeoutSeconds: 5
+            failureThreshold: 5
           readinessProbe:
             httpGet:
-              path: /realms/master
-              port: http
+              path: /health/ready
+              port: management
             initialDelaySeconds: 60
-            timeoutSeconds: 1
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
       terminationGracePeriodSeconds: 60

From d18ed7938276c1e2d162b41488ad68b5fb62a411 Mon Sep 17 00:00:00 2001
From: mattia-eleuteri <mattia@hidora.io>
Date: Fri, 6 Mar 2026 11:26:52 +0100
Subject: [PATCH 225/666] fix(keycloak): add startupProbe, remove
 initialDelaySeconds

Use a startupProbe to defer liveness/readiness checks until Keycloak
has fully started, instead of relying on initialDelaySeconds. This is
more robust for applications with variable startup times.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: mattia-eleuteri <mattia@hidora.io>
---
 packages/system/keycloak/templates/sts.yaml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/packages/system/keycloak/templates/sts.yaml b/packages/system/keycloak/templates/sts.yaml
index 60cdb9d2..a22609a0 100644
--- a/packages/system/keycloak/templates/sts.yaml
+++ b/packages/system/keycloak/templates/sts.yaml
@@ -133,11 +133,16 @@ spec:
             - name: management
               containerPort: 9000
               protocol: TCP
+          startupProbe:
+            httpGet:
+              path: /health/ready
+              port: management
+            failureThreshold: 30
+            periodSeconds: 10
           livenessProbe:
             httpGet:
               path: /health/live
               port: management
-            initialDelaySeconds: 120
             periodSeconds: 15
             timeoutSeconds: 5
             failureThreshold: 5
@@ -145,7 +150,6 @@ spec:
             httpGet:
               path: /health/ready
               port: management
-            initialDelaySeconds: 60
             periodSeconds: 10
             timeoutSeconds: 5
             failureThreshold: 3

From 3c971d0e1b4a2924e11f4533c7a5dfd0b2697da9 Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Fri, 6 Mar 2026 12:03:56 +0000
Subject: [PATCH 226/666] Prepare release v1.1.0

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 packages/apps/kubernetes/images/kubevirt-csi-driver.tag     | 2 +-
 packages/core/installer/values.yaml                         | 4 ++--
 packages/core/platform/values.yaml                          | 2 +-
 packages/core/testing/values.yaml                           | 2 +-
 packages/extra/bootbox/images/matchbox.tag                  | 2 +-
 packages/extra/seaweedfs/images/objectstorage-sidecar.tag   | 2 +-
 packages/system/backup-controller/values.yaml               | 2 +-
 packages/system/backupstrategy-controller/values.yaml       | 2 +-
 packages/system/bucket/images/s3manager.tag                 | 2 +-
 packages/system/cozystack-api/values.yaml                   | 2 +-
 packages/system/cozystack-controller/values.yaml            | 2 +-
 packages/system/dashboard/templates/configmap.yaml          | 2 +-
 packages/system/dashboard/values.yaml                       | 6 +++---
 .../system/grafana-operator/images/grafana-dashboards.tag   | 2 +-
 packages/system/kamaji/values.yaml                          | 4 ++--
 packages/system/kubeovn-plunger/values.yaml                 | 2 +-
 packages/system/kubeovn-webhook/values.yaml                 | 2 +-
 packages/system/kubevirt-csi-node/values.yaml               | 2 +-
 packages/system/lineage-controller-webhook/values.yaml      | 2 +-
 packages/system/linstor/values.yaml                         | 2 +-
 packages/system/objectstorage-controller/values.yaml        | 2 +-
 packages/system/seaweedfs/values.yaml                       | 2 +-
 22 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
index 42929b3d..925ee9bd 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:434aa3b8e2a3cbf6681426b174e1c4fde23bafd12a6cccd046b5cb1749092ec4
+ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:faaa6bcdb68196edb4baafe643679bd7d2ef35f910c639b71e06a4ecc034f232
diff --git a/packages/core/installer/values.yaml b/packages/core/installer/values.yaml
index 97cf44a7..c8b5edd7 100644
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -1,9 +1,9 @@
 cozystackOperator:
   # Deployment variant: talos, generic, hosted
   variant: talos
-  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.0.0@sha256:9e5229764b6077809a1c16566881a524c33e8986e36597e6833f8857a7e6a335
+  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.1.0@sha256:9367001a8d1d2dcf08ae74a42ac234eaa6af18f1af64ac28ce8a5946af9c5d3f
   platformSourceUrl: 'oci://ghcr.io/cozystack/cozystack/cozystack-packages'
-  platformSourceRef: 'digest=sha256:ef3e4ba7d21572a61794d8be594805f063aa04f4a8c3753351fc89c7804d337e'
+  platformSourceRef: 'digest=sha256:7c6da38e7b99ec80d35ba2cef721ea1579f8a0824989454544fa85318bb7bf15'
 # Generic variant configuration (only used when cozystackOperator.variant=generic)
 cozystack:
   # Kubernetes API server host (IP only, no protocol/port)
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index 80ebb936..c559af9e 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -5,7 +5,7 @@ sourceRef:
   path: /
 migrations:
   enabled: false
-  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0@sha256:68dabdebc38ac439228ae07031cc70e0fa184a24bd4e5b3b22c17466b2a55201
+  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.1.0@sha256:d7e8955c1ad8c8fbd4ce42b014c0f849d73d0c3faf0cedaac8e15d647fb2f663
   targetVersion: 35
 # Bundle deployment configuration
 bundles:
diff --git a/packages/core/testing/values.yaml b/packages/core/testing/values.yaml
index 0dafd67e..f80ea6c5 100644
--- a/packages/core/testing/values.yaml
+++ b/packages/core/testing/values.yaml
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.0.0@sha256:0eae9f519669667d60b160ebb93c127843c470ad9ca3447fceaa54604503a7ba
+  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.1.0@sha256:0eae9f519669667d60b160ebb93c127843c470ad9ca3447fceaa54604503a7ba
diff --git a/packages/extra/bootbox/images/matchbox.tag b/packages/extra/bootbox/images/matchbox.tag
index 2305d665..81f52edf 100644
--- a/packages/extra/bootbox/images/matchbox.tag
+++ b/packages/extra/bootbox/images/matchbox.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/matchbox:v1.0.0@sha256:c48eb7b23f01a8ff58d409fdb51c88e771f819cb914eee03da89471e62302f33
+ghcr.io/cozystack/cozystack/matchbox:v1.1.0@sha256:e4c872f6dadc2bbcb9200d04a1d9878f62502f74e979b4eae6c7203abc6d8fa6
diff --git a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
index 5f97d6ba..704e9bc7 100644
--- a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
+++ b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0@sha256:2a3595cd88b30af55b2000d3ca204899beecef0012b0e0402754c3914aad1f7f
+ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.1.0@sha256:2a3595cd88b30af55b2000d3ca204899beecef0012b0e0402754c3914aad1f7f
diff --git a/packages/system/backup-controller/values.yaml b/packages/system/backup-controller/values.yaml
index 5b3d5d8f..03a9ce6a 100644
--- a/packages/system/backup-controller/values.yaml
+++ b/packages/system/backup-controller/values.yaml
@@ -1,5 +1,5 @@
 backupController:
-  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.0.0@sha256:e1a6c8ac7ba64442812464b59c53e782e373a339c18b379c2692921b44c6edb5"
+  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.1.0@sha256:8e42e29f5d30ecbef1f05cb0601c32703c5f9572b89d2c9032c1dff186e9a526"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/backupstrategy-controller/values.yaml b/packages/system/backupstrategy-controller/values.yaml
index 4843a679..1cb94695 100644
--- a/packages/system/backupstrategy-controller/values.yaml
+++ b/packages/system/backupstrategy-controller/values.yaml
@@ -1,5 +1,5 @@
 backupStrategyController:
-  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.0.0@sha256:29735d945c69c6bbaab21068bf4ea30f6b63f4c71a7a8d95590f370abcb4b328"
+  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.1.0@sha256:508e3bd5a83a316732cfb84fe598064e3092482d941cfc53738ca21237642e6f"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/bucket/images/s3manager.tag b/packages/system/bucket/images/s3manager.tag
index 0419c8c9..b799967a 100644
--- a/packages/system/bucket/images/s3manager.tag
+++ b/packages/system/bucket/images/s3manager.tag
@@ -1 +1 @@
-999669/s3manager:latest@sha256:134bd78a5e9412df3102a58487f7200279a0ba3dac78f2dc5ac1dd4d299bcbd2
+ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:5a7cae722ff6b424bdfbc4aba9d072c11b6930e2ee0f5fa97c3a565bd1c8dc88
diff --git a/packages/system/cozystack-api/values.yaml b/packages/system/cozystack-api/values.yaml
index 394355c3..dcd174c4 100644
--- a/packages/system/cozystack-api/values.yaml
+++ b/packages/system/cozystack-api/values.yaml
@@ -1,3 +1,3 @@
 cozystackAPI:
-  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.0.0@sha256:bd70ecb944bde9a0d6b88114aea89bdbbe2d07e33f03175cfd885de013e88294
+  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.1.0@sha256:3a8e559b1a71cffb445bab14178d9abeba1b90509f9fec31df5ff5a9a38333d1
   replicas: 2
diff --git a/packages/system/cozystack-controller/values.yaml b/packages/system/cozystack-controller/values.yaml
index 54243320..e01aa8be 100644
--- a/packages/system/cozystack-controller/values.yaml
+++ b/packages/system/cozystack-controller/values.yaml
@@ -1,4 +1,4 @@
 cozystackController:
-  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.0.0@sha256:da01085026a4a01514ae435c7bfb48cca2cf00eb17feb2ed7ae88711f82693e0
+  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.1.0@sha256:f04fa839924a761571e1035d83f380f39f62d1708ea8d22f7a323f17bb59ff96
   debug: false
   disableTelemetry: false
diff --git a/packages/system/dashboard/templates/configmap.yaml b/packages/system/dashboard/templates/configmap.yaml
index e89d6a5f..9a63c182 100644
--- a/packages/system/dashboard/templates/configmap.yaml
+++ b/packages/system/dashboard/templates/configmap.yaml
@@ -1,6 +1,6 @@
 {{- $brandingConfig := .Values._cluster.branding | default dict }}
 
-{{- $tenantText := "v1.0.0" }}
+{{- $tenantText := "v1.1.0" }}
 {{- $footerText := "Cozystack" }}
 {{- $titleText := "Cozystack Dashboard" }}
 {{- $logoText := "" }}
diff --git a/packages/system/dashboard/values.yaml b/packages/system/dashboard/values.yaml
index 244d0b31..d8550368 100644
--- a/packages/system/dashboard/values.yaml
+++ b/packages/system/dashboard/values.yaml
@@ -1,6 +1,6 @@
 openapiUI:
-  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.0.0@sha256:73a8bd4283a46a99d22536eece9c2059fa2fb1c17b43ddefe6716e8960e4731e
+  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.1.0@sha256:bc530ae2e428727eed284d7f80b2eea4fdd98b7618d20cab262eef7199af5fa5
 openapiUIK8sBff:
-  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.0.0@sha256:c938fee904acd948800d4dc5e121c4c5cd64cb4a3160fb8d2f9dbff0e5168740
+  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.1.0@sha256:c938fee904acd948800d4dc5e121c4c5cd64cb4a3160fb8d2f9dbff0e5168740
 tokenProxy:
-  image: ghcr.io/cozystack/cozystack/token-proxy:v1.0.0@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
+  image: ghcr.io/cozystack/cozystack/token-proxy:v1.1.0@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
diff --git a/packages/system/grafana-operator/images/grafana-dashboards.tag b/packages/system/grafana-operator/images/grafana-dashboards.tag
index b1eac607..71332750 100644
--- a/packages/system/grafana-operator/images/grafana-dashboards.tag
+++ b/packages/system/grafana-operator/images/grafana-dashboards.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/grafana-dashboards:v1.0.0@sha256:7a3c9af59f8d74d5a23750bbc845c7de64610dbd4d4f84011e10be037b3ce2a0
+ghcr.io/cozystack/cozystack/grafana-dashboards:v1.1.0@sha256:2c9aa0b48e2bf6167db198f4d15882bfe51700108edf2e9f6d0942940a2c1204
diff --git a/packages/system/kamaji/values.yaml b/packages/system/kamaji/values.yaml
index 4a1d30b1..89227000 100644
--- a/packages/system/kamaji/values.yaml
+++ b/packages/system/kamaji/values.yaml
@@ -3,7 +3,7 @@ kamaji:
     deploy: false
   image:
     pullPolicy: IfNotPresent
-    tag: v1.0.0@sha256:50db517ebe7698083dd32223a96c987b6ed0c88d3a093969beb571e4a96d18e4
+    tag: v1.1.0@sha256:914d04f7442f0faecf18f8282c192dee9fe244a711494a8c892e2f9e2ad415f7
     repository: ghcr.io/cozystack/cozystack/kamaji
   resources:
     limits:
@@ -13,4 +13,4 @@ kamaji:
       cpu: 100m
       memory: 100Mi
   extraArgs:
-    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.0.0@sha256:50db517ebe7698083dd32223a96c987b6ed0c88d3a093969beb571e4a96d18e4
+    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.1.0@sha256:914d04f7442f0faecf18f8282c192dee9fe244a711494a8c892e2f9e2ad415f7
diff --git a/packages/system/kubeovn-plunger/values.yaml b/packages/system/kubeovn-plunger/values.yaml
index 690e0421..7f22578d 100644
--- a/packages/system/kubeovn-plunger/values.yaml
+++ b/packages/system/kubeovn-plunger/values.yaml
@@ -1,4 +1,4 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.0.0@sha256:b6045fdb4f324b9b1cb44a218c40422aafbbc600b085c819ff58809bb6e97220
+image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.1.0@sha256:b91bf0964a3204e50f703092f190b7d96c078a6ccee430215042ae1275ed5127
 ovnCentralName: ovn-central
diff --git a/packages/system/kubeovn-webhook/values.yaml b/packages/system/kubeovn-webhook/values.yaml
index ac6dd5db..c2fe2c6f 100644
--- a/packages/system/kubeovn-webhook/values.yaml
+++ b/packages/system/kubeovn-webhook/values.yaml
@@ -1,3 +1,3 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.0.0@sha256:e18f9fd679e38f65362a8d0042f25468272f6d081136ad47027168d8e7e07a4a
+image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.1.0@sha256:e18f9fd679e38f65362a8d0042f25468272f6d081136ad47027168d8e7e07a4a
diff --git a/packages/system/kubevirt-csi-node/values.yaml b/packages/system/kubevirt-csi-node/values.yaml
index eb9c5f00..439edef4 100644
--- a/packages/system/kubevirt-csi-node/values.yaml
+++ b/packages/system/kubevirt-csi-node/values.yaml
@@ -1,3 +1,3 @@
 storageClass: replicated
 csiDriver:
-  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:434aa3b8e2a3cbf6681426b174e1c4fde23bafd12a6cccd046b5cb1749092ec4
+  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:faaa6bcdb68196edb4baafe643679bd7d2ef35f910c639b71e06a4ecc034f232
diff --git a/packages/system/lineage-controller-webhook/values.yaml b/packages/system/lineage-controller-webhook/values.yaml
index 46ccd4f4..f4d62e1c 100644
--- a/packages/system/lineage-controller-webhook/values.yaml
+++ b/packages/system/lineage-controller-webhook/values.yaml
@@ -1,5 +1,5 @@
 lineageControllerWebhook:
-  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.0.0@sha256:af765c2829db4f513084522a384710acc321bd4a332eaf7fe814fecacea1022f
+  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.1.0@sha256:4d6a2bb76cae84e24cd48c7377b03ed6bdfefe611221d2c0a7f77a5457db8849
   debug: false
   localK8sAPIEndpoint:
     enabled: true
diff --git a/packages/system/linstor/values.yaml b/packages/system/linstor/values.yaml
index 3e6b7af5..bcf530b3 100644
--- a/packages/system/linstor/values.yaml
+++ b/packages/system/linstor/values.yaml
@@ -13,4 +13,4 @@ linstor:
 linstorCSI:
   image:
     repository: ghcr.io/cozystack/cozystack/linstor-csi
-    tag: v1.10.5@sha256:c87b6f6dadaa6e3a3643d3279e81742830147f6c38f99e9232d9780abbcac897
+    tag: v1.10.5@sha256:50ab1ab0210d4e7ebfca311f445bb764516db5ddb63fc6d28536b28622eee753
diff --git a/packages/system/objectstorage-controller/values.yaml b/packages/system/objectstorage-controller/values.yaml
index f95a193d..2145657c 100644
--- a/packages/system/objectstorage-controller/values.yaml
+++ b/packages/system/objectstorage-controller/values.yaml
@@ -1,3 +1,3 @@
 objectstorage:
   controller:
-    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.0.0@sha256:e40e94f3014cfd04cce4230597315a1acfcca2daa8051b987614d0c05da6d928"
+    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.1.0@sha256:e40e94f3014cfd04cce4230597315a1acfcca2daa8051b987614d0c05da6d928"
diff --git a/packages/system/seaweedfs/values.yaml b/packages/system/seaweedfs/values.yaml
index 708033d2..5fea4a0d 100644
--- a/packages/system/seaweedfs/values.yaml
+++ b/packages/system/seaweedfs/values.yaml
@@ -177,7 +177,7 @@ seaweedfs:
     bucketClassName: "seaweedfs"
     region: ""
     sidecar:
-      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.0@sha256:2a3595cd88b30af55b2000d3ca204899beecef0012b0e0402754c3914aad1f7f"
+      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.1.0@sha256:2a3595cd88b30af55b2000d3ca204899beecef0012b0e0402754c3914aad1f7f"
   certificates:
     commonName: "SeaweedFS CA"
     ipAddresses: []

From 20d1343bd69b49e72d71840deb2f059c95df5e1f Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Fri, 6 Mar 2026 12:13:09 +0000
Subject: [PATCH 227/666] docs: add changelog for v1.1.0

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.1.0.md | 126 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 126 insertions(+)
 create mode 100644 docs/changelogs/v1.1.0.md

diff --git a/docs/changelogs/v1.1.0.md b/docs/changelogs/v1.1.0.md
new file mode 100644
index 00000000..ad61c1a6
--- /dev/null
+++ b/docs/changelogs/v1.1.0.md
@@ -0,0 +1,126 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.1.0
+-->
+
+# Cozystack v1.1.0
+
+Cozystack v1.1.0 delivers a major expansion of the managed application catalog with **OpenBAO** (open-source HashiCorp Vault fork) for secrets management, comprehensive **tiered object storage** with SeaweedFS storage pools, a new bucket **user model** with per-user credentials and S3 login support, **RabbitMQ version selection**, and **MongoDB Grafana dashboards**. The dashboard gains storageClass dropdowns for all stateful apps. This release also incorporates all fixes from the v1.0.x patch series.
+
+## Feature Highlights
+
+### OpenBAO: Managed Secrets Management Service
+
+Cozystack now ships **OpenBAO** as a fully managed PaaS application — an open-source fork of HashiCorp Vault providing enterprise-grade secrets management. Users can deploy OpenBAO instances in standalone mode (single replica with file storage) or in high-availability Raft mode (multiple replicas with integrated Raft consensus), with the mode switching automatically based on the `replicas` field.
+
+Each OpenBAO instance gets TLS enabled by default via cert-manager self-signed certificates, with DNS SANs covering all service endpoints and pod addresses. The Vault injector and CSI provider are intentionally disabled (they are cluster-scoped components not safe for per-tenant use). OpenBAO requires manual initialization and unsealing by design — no auto-unseal is configured.
+
+A full end-to-end E2E test covers the complete lifecycle: deploy, wait for certificate and API readiness, init, unseal, verify, and cleanup. OpenBAO is available in the application catalog for tenant namespaces.
+
+### SeaweedFS Tiered Storage Pools
+
+SeaweedFS now supports **tiered storage pools** — operators can define separate storage pools per disk type (SSD, HDD, NVMe) in the `volume.pools` field (Simple topology) or `volume.zones[name].pools` (MultiZone topology). Each pool creates an additional Volume StatefulSet alongside the default one, with SeaweedFS distinguishing storage via the `-disk=<type>` flag on volume servers.
+
+Each pool automatically generates its own set of COSI resources: a standard `BucketClass`, a `-lock` BucketClass (COMPLIANCE mode, 365-day retention), a read-write `BucketAccessClass`, and a `-readonly` BucketAccessClass. This allows applications to place data on specific storage tiers and request appropriate access policies per pool.
+
+In MultiZone topology, pools are defined per zone and each zone × pool combination creates a dedicated StatefulSet (e.g., `us-east-ssd`, `us-west-hdd`), with nodes selected via `topology.kubernetes.io/zone` labels. Existing deployments with no pools defined produce output identical to previous versions — no migration is required.
+
+### Bucket User Model with S3 Login
+
+The bucket application introduces a new **user model** for access management. Instead of a single implicit BucketAccess resource, operators now define a `users` map where each entry creates a dedicated `BucketAccess` with its own credentials secret and an optional `readonly` flag. The S3 Manager UI has been updated with a login screen that uses per-session credentials from the user's own secret, replacing the previous basic-auth approach.
+
+Two new bucket parameters are available: `locking` provisions from the `-lock` BucketClass (COMPLIANCE mode, 365-day object lock retention) for write-once-read-many use cases, and `storagePool` selects a specific pool's BucketClass for tiered storage placement. The COSI driver has been updated to v0.3.0 to support the new `diskType` parameter.
+
+**⚠️ Breaking change**: The implicit default BucketAccess resource is no longer created. Existing buckets that relied on the single auto-generated BucketAccess will need to explicitly define users in the `users` map after upgrading.
+
+### RabbitMQ Version Selection
+
+RabbitMQ instances now support a configurable **version selector** (`version` field with values: `v4.2`, `v4.1`, `v4.0`, `v3.13`; default `v4.2`). The chart validates the selection at deploy time and uses it to pin the runtime image, giving operators control over the RabbitMQ release channel per instance. An automatic migration backfills the `version` field on all existing RabbitMQ resources to `v4.2`.
+
+## Major Features and Improvements
+
+* **[apps] Add OpenBAO as a managed secrets management service**: Deployed as a PaaS application with standalone (file storage) and HA Raft modes, TLS enabled by default via cert-manager, injector and CSI provider disabled for tenant safety, and a full E2E lifecycle test ([**@lexfrei**](https://github.com/lexfrei) in #2059).
+
+* **[seaweedfs] Add storage pools support for tiered storage**: Added `volume.pools` (Simple) and `volume.zones[name].pools` (MultiZone) for per-disk-type StatefulSets, zone overrides (`nodeSelector`, `storageClass`, `dataCenter`), per-pool COSI BucketClass and BucketAccessClass resources, and bumped seaweedfs-cosi-driver to v0.3.0 ([**@sircthulhu**](https://github.com/sircthulhu) in #2097).
+
+* **[apps][system] Add bucket user model with locking and storage pool selection**: Replaced implicit BucketAccess with per-user `users` map, added `locking` and `storagePool` parameters, renamed COSI BucketClass suffix from `-worm` to `-lock`, added `-readonly` BucketAccessClass for all topologies, and updated S3 Manager with login screen using per-user credentials ([**@IvanHunters**](https://github.com/IvanHunters) in #2119).
+
+* **[rabbitmq] Add version selection for RabbitMQ instances**: Added `version` field (`v4.2`, `v4.1`, `v4.0`, `v3.13`) with chart-level validation, default `v4.2`, and an automatic migration to backfill the field on existing instances ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2092).
+
+* **[system] Add MongoDB Overview and InMemory Details Grafana dashboards**: Added two comprehensive Grafana dashboards for MongoDB monitoring — Overview (command operations, connections, cursors, query efficiency, write time) and InMemory Details (WiredTiger cache, transactions, concurrency, eviction). Dashboards are registered in `dashboards.list` for automatic GrafanaDashboard CRD generation ([**@IvanHunters**](https://github.com/IvanHunters) in #2158).
+
+* **[dashboard] Add storageClass dropdown for all stateful apps**: Replaced the free-text `storageClass` input with an API-backed dropdown listing available StorageClasses from the cluster. Affects ClickHouse, Harbor, HTTPCache, Kubernetes, MariaDB, MongoDB, NATS, OpenBAO, Postgres, Qdrant, RabbitMQ, Redis, VMDisk (top-level `storageClass`), FoundationDB (`storage.storageClass`), and Kafka (`kafka.storageClass`, `zookeeper.storageClass`) ([**@sircthulhu**](https://github.com/sircthulhu) in #2131).
+
+* **[bucket] Add readonly S3 access credentials**: Added a readonly `BucketAccessClass` to the SeaweedFS COSI chart and updated the bucket application to automatically provision two sets of S3 credentials per bucket: read-write (for UI) and readonly ([**@IvanHunters**](https://github.com/IvanHunters) in #2105).
+
+* **[dashboard] Hide sidebar on cluster-level pages when no tenant selected**: Fixed broken URLs with double `//` on the main cluster page (before tenant selection) by clearing `CUSTOMIZATION_SIDEBAR_FALLBACK_ID` so no sidebar renders when no namespace is selected ([**@sircthulhu**](https://github.com/sircthulhu) in #2106).
+
+* **[cert-manager] Update cert-manager to v1.19.3**: Upgraded cert-manager with new CRDs moved into a dedicated CRD package, added global `nodeSelector` and `hostUsers` (pod user-namespace isolation), and renamed `ServiceMonitor` targetPort default to `http-metrics` ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2070).
+
+* **[dashboard] Add backupClasses dropdown to Plan/BackupJob forms**: Replaced free-text input for `backupClass` field with an API-backed dropdown populated with available BackupClass resources, making it easier to select the correct backup target ([**@androndo**](https://github.com/androndo) in #2104).
+
+## Fixes
+
+* **[platform] Fix package name conversion in migration script**: Fixed the `migrate-to-version-1.0.sh` script to correctly prepend the `cozystack.` prefix when converting `BUNDLE_DISABLE` and `BUNDLE_ENABLE` package name lists, ensuring packages are properly identified during the v0.41→v1.0 upgrade ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2144, #2148).
+
+* **[backups] Fix RBAC for backup controllers**: Updated RBAC permissions for the backup strategy controller to support enhanced backup and restore capabilities, including Velero integration and status management ([**@androndo**](https://github.com/androndo) in #2145).
+
+* **[kubernetes] Set explicit MTU for Cilium in tenant clusters**: Set explicit MTU 1350 for Cilium in KubeVirt-based tenant Kubernetes clusters to prevent packet drops caused by VXLAN encapsulation overhead. Cilium's auto-detection does not account for VXLAN overhead (50 bytes) when the VM interface inherits MTU 1400 from the parent OVN/Geneve overlay, causing intermittent connectivity issues and HTTP 499 errors under load ([**@IvanHunters**](https://github.com/IvanHunters) in #2147).
+
+* **[platform] Prevent cozystack-version ConfigMap from deletion**: Added resource protection annotations to prevent the `cozystack-version` ConfigMap from being accidentally deleted, improving platform stability ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2112, #2114).
+
+* **[installer] Add keep annotation to Namespace and update migration script**: Added `helm.sh/resource-policy: keep` annotation to the `cozy-system` Namespace in the installer Helm chart to prevent Helm from deleting the namespace and all HelmReleases within it when the installer release is removed. The v1.0 migration script is also updated to annotate the namespace and `cozystack-version` ConfigMap before migration ([**@kvaps**](https://github.com/kvaps) in #2122, #2123).
+
+* **[dashboard] Add FlowSchema to exempt BFF from API throttling**: Added a `cozy-dashboard-exempt` FlowSchema to exempt the dashboard Back-End-for-Frontend service account from Kubernetes API Priority and Fairness throttling, preventing 429 errors under load ([**@kvaps**](https://github.com/kvaps) in #2121, #2124).
+
+* **[platform] Suspend cozy-proxy if it conflicts with installer release during migration**: Added a check in the v0.41→v1.0 migration script to detect and suspend the `cozy-proxy` HelmRelease when its `releaseName` is set to `cozystack`, which conflicts with the installer release and would cause `cozystack-operator` deletion during the upgrade ([**@kvaps**](https://github.com/kvaps) in #2128, #2130).
+
+* **[platform] Fix off-by-one error in run-migrations script**: Fixed a bug in the migration runner where the first required migration was always skipped due to an off-by-one error in the migration range calculation ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2126, #2132).
+
+* **[system] Fix Keycloak proxy configuration for v26.x**: Replaced the deprecated `KC_PROXY=edge` environment variable with `KC_PROXY_HEADERS=xforwarded` and `KC_HTTP_ENABLED=true` in the Keycloak StatefulSet. `KC_PROXY` was removed in Keycloak 26.x, previously causing "Non-secure context detected" warnings and broken cookie handling behind a reverse proxy with TLS termination ([**@sircthulhu**](https://github.com/sircthulhu) in #2125, #2134).
+
+* **[dashboard] Allow clearing instanceType field and preserve newlines in secret copy**: Added `allowEmpty: true` to the `instanceType` field in the VMInstance form so users can explicitly clear it to use custom KubeVirt resources without a named instance type. Also fixed newline preservation when copying secrets with CMD+C ([**@sircthulhu**](https://github.com/sircthulhu) in #2135, #2137).
+
+* **[dashboard] Restore stock-instance sidebars for namespace-level pages**: Restored `stock-instance-api-form`, `stock-instance-api-table`, `stock-instance-builtin-form`, and `stock-instance-builtin-table` sidebar resources that were inadvertently removed in #2106. Without these sidebars, namespace-level pages such as Backup Plans rendered as empty pages ([**@sircthulhu**](https://github.com/sircthulhu) in #2136, #2138).
+
+## System Configuration
+
+* **[platform] Disable private key rotation in CA certs**: Set `rotationPolicy: Never` for all CA/root certificates used by system components (ingress-nginx, linstor, linstor-scheduler, seaweedfs, victoria-metrics-operator, kubeovn-webhook, lineage-controller-webhook, cozystack-api, etcd, linstor API/internal) to prevent trust chain problems when CA certificates are reissued ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2113).
+
+## Development, Testing, and CI/CD
+
+* **[ci] Add debug improvements for CI tests**: Added extra debug commands for Kubernetes startup diagnostics and improved error output in CI test runs ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2111).
+
+## Documentation
+
+* **[website] Add object storage guide (pools, buckets, users)**: Added a comprehensive guide covering SeaweedFS object storage configuration including storage pools for tiered storage, bucket creation with access classes, per-user credential management, and credential rotation procedures ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#438).
+
+* **[website] Add Build Your Own Platform (BYOP) guide**: Added a new "Build Your Own Platform" guide and split the installation documentation into platform installation and BYOP sub-pages, with cross-references throughout the documentation ([**@kvaps**](https://github.com/kvaps) in cozystack/website#437).
+
+* **[website] Add white labeling guide**: Added a comprehensive guide for configuring white labeling (branding) in Cozystack v1, covering Dashboard fields (`titleText`, `footerText`, `tenantText`, `logoText`, `logoSvg`, `iconSvg`) and Keycloak fields (`brandName`, `brandHtmlName`). Includes SVG preparation workflow with theme-aware template variables and portable base64 encoding ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#441).
+
+* **[website] Actualize backup and recovery documentation**: Reworked the backup and recovery docs to be user-focused, separating operator and tenant workflows. Added tenant-facing documentation for `BackupJob` and `Plan` resources and a new Velero administration guide for operators ([**@androndo**](https://github.com/androndo) in cozystack/website#434).
+
+* **[website] Add step to protect namespace before upgrading**: Updated the cluster upgrade guide and v0.41→v1.0 migration guide with a required step to annotate the `cozy-system` namespace and `cozystack-version` ConfigMap with `helm.sh/resource-policy=keep` before running `helm upgrade` ([**@kvaps**](https://github.com/kvaps) in cozystack/website#435).
+
+* **[website] Replace bundles documentation with variants**: Renamed the "Bundles" documentation section to "Variants" to match current Cozystack terminology. Removed deprecated variants and added new ones: `default` and `isp-full-generic` ([**@kvaps**](https://github.com/kvaps) in cozystack/website#433).
+
+* **[website] Fix component values override instructions**: Corrected the component values override documentation to reflect current configuration patterns ([**@kvaps**](https://github.com/kvaps) in cozystack/website#436).
+
+## Breaking Changes & Upgrade Notes
+
+* **[bucket] Bucket user model now requires explicit user definitions**: The implicit default `BucketAccess` resource is no longer created automatically. Existing buckets that relied on a single auto-generated credential secret will need to define users explicitly in the `users` map after upgrading. Each user entry creates its own `BucketAccess` resource and credential secret (optionally with `readonly: true`). The COSI BucketClass suffix has also been renamed from `-worm` to `-lock` ([**@IvanHunters**](https://github.com/IvanHunters) in #2119).
+
+## Contributors
+
+We'd like to thank all contributors who made this release possible:
+
+* [**@androndo**](https://github.com/androndo)
+* [**@IvanHunters**](https://github.com/IvanHunters)
+* [**@kvaps**](https://github.com/kvaps)
+* [**@lexfrei**](https://github.com/lexfrei)
+* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
+* [**@sircthulhu**](https://github.com/sircthulhu)
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.0...v1.1.0

From 21f293ace583ad3e4a49a119d072dc70d3971a6d Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Fri, 6 Mar 2026 19:22:21 +0300
Subject: [PATCH 228/666] fix(migrations): handle missing rabbitmq CRD in
 migration 34

Migration 34 fails when rabbitmqs.apps.cozystack.io CRD does not exist,
which happens when RabbitMQ was never installed on the cluster. Add a
check for CRD presence before attempting to list resources.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 packages/core/platform/images/migrations/migrations/34 | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/packages/core/platform/images/migrations/migrations/34 b/packages/core/platform/images/migrations/migrations/34
index 57204ff0..f031d590 100755
--- a/packages/core/platform/images/migrations/migrations/34
+++ b/packages/core/platform/images/migrations/migrations/34
@@ -13,6 +13,15 @@
 set -euo pipefail
 
 DEFAULT_VERSION="v3.13"
+
+# Skip if the CRD does not exist (rabbitmq was never installed)
+if ! kubectl api-resources --api-group=apps.cozystack.io -o name 2>/dev/null | grep -q '^rabbitmqs\.'; then
+  echo "CRD rabbitmqs.apps.cozystack.io not found, skipping migration"
+  kubectl create configmap -n cozy-system cozystack-version \
+    --from-literal=version=35 --dry-run=client -o yaml | kubectl apply -f-
+  exit 0
+fi
+
 RABBITMQS=$(kubectl get rabbitmqs.apps.cozystack.io -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}')
 for resource in $RABBITMQS; do
   NS="${resource%%/*}"

From a3825314e67a1b9bd1e00ca988d7172c02091b2e Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Thu, 5 Mar 2026 13:25:26 +0500
Subject: [PATCH 229/666] feat(monitoring): upgrade victoria-metrics-operator
 to v0.68.1

Upgrade from v0.55.0 to v0.68.1 to add VLCluster CRD support,
which is required for migrating VictoriaLogs from single-node
to cluster mode.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .../victoria-metrics-operator/.helmignore     |     7 +-
 .../victoria-metrics-operator/Chart.lock      |     6 +-
 .../victoria-metrics-operator/Chart.yaml      |    16 +-
 .../victoria-metrics-operator/README.md       |     3 +
 .../victoria-metrics-operator/RELEASE_NOTES   |     8 +-
 .../charts/crds/README.md                     |     9 +
 .../charts/crds/crds/crd.yaml                 | 38369 +++++++++-------
 .../charts/crds/files/crd.yaml.bz2            |   Bin 0 -> 27612 bytes
 .../charts/crds/templates/_helpers.yaml       |    13 +
 .../charts/crds/templates/cm.yaml             |    18 +
 .../charts/crds/templates/job.yaml            |   126 +
 .../charts/crds/templates/role.yaml           |    52 +
 .../charts/crds/templates/serviceaccount.yaml |    25 +
 .../charts/crds/values.yaml                   |    17 +
 .../victoria-metrics-common/.helmignore       |     4 +-
 .../charts/victoria-metrics-common/Chart.yaml |    12 +-
 .../charts/victoria-metrics-common/README.md  |     3 +
 .../victoria-metrics-common/RELEASE_NOTES     |     6 +-
 .../templates/_enterprise.tpl                 |     2 +-
 .../templates/_helpers.tpl                    |     4 +-
 .../templates/_image.tpl                      |     2 +-
 .../charts/victoria-metrics-operator/crd.yaml | 31007 +------------
 .../templates/_helpers.tpl                    |     2 +-
 .../templates/cleanup.yaml                    |    17 +-
 .../templates/crb.yaml                        |     2 +-
 .../templates/crd.yaml                        |     3 +-
 .../templates/role.yaml                       |    23 +-
 .../{deployment.yaml => server.yaml}          |    21 +-
 .../templates/service.yaml                    |     3 +
 ...rvice_account.yaml => serviceaccount.yaml} |     4 +-
 .../templates/webhook.yaml                    |    24 +-
 .../victoria-metrics-operator/values.yaml     |   141 +-
 32 files changed, 23956 insertions(+), 45993 deletions(-)
 create mode 100644 packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/README.md
 create mode 100644 packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/README.md
 create mode 100644 packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/files/crd.yaml.bz2
 create mode 100644 packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/_helpers.yaml
 create mode 100644 packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/cm.yaml
 create mode 100644 packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/job.yaml
 create mode 100644 packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/role.yaml
 create mode 100644 packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/serviceaccount.yaml
 create mode 100644 packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/README.md
 rename packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/{deployment.yaml => server.yaml} (90%)
 rename packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/{service_account.yaml => serviceaccount.yaml} (88%)

diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/.helmignore b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/.helmignore
index 2ccbd54f..a181e3c7 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/.helmignore
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/.helmignore
@@ -20,5 +20,10 @@
 .idea/
 *.tmproj
 .vscode/
-*.md
 *.md.gotmpl
+CHANGELOG.md
+_changelog.md
+_index.md
+e2e/
+lint/
+tests/
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.lock b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.lock
index 6c7b4c55..1b0e2a46 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.lock
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.lock
@@ -1,9 +1,9 @@
 dependencies:
 - name: victoria-metrics-common
   repository: https://victoriametrics.github.io/helm-charts
-  version: 0.0.42
+  version: 0.0.46
 - name: crds
   repository: ""
   version: 0.0.*
-digest: sha256:d186ad6f54d64a2f828cd80a136e06dcf1f30dbc8ae94964bb9b166ee32eb30e
-generated: "2025-03-19T09:59:22.84209872Z"
+digest: sha256:43d3d210a9d1a2234e6c56518f8c477125a5ad5e8ed08d46209528f19acd9c89
+generated: "2025-12-23T12:58:01.428960334Z"
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.yaml
index b6574d02..bb9253b1 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.yaml
@@ -1,7 +1,7 @@
 annotations:
   artifacthub.io/category: monitoring-logging
   artifacthub.io/changes: |
-    - updates operator to [v0.55.0](https://github.com/VictoriaMetrics/operator/releases/tag/v0.55.0) version
+    - updates operator to [v0.68.1](https://github.com/VictoriaMetrics/operator/releases/tag/v0.68.1) version
   artifacthub.io/license: Apache-2.0
   artifacthub.io/links: |
     - name: Sources
@@ -9,12 +9,16 @@ annotations:
     - name: Charts repo
       url: https://victoriametrics.github.io/helm-charts/
     - name: Docs
-      url: https://docs.victoriametrics.com/operator
+      url: https://docs.victoriametrics.com/operator/
     - name: Changelog
-      url: https://docs.victoriametrics.com/operator/changelog
+      url: https://docs.victoriametrics.com/operator/changelog/
   artifacthub.io/operator: "true"
+  artifacthub.io/readme: |
+    # VictoriaMetrics Operator Helm chart
+
+    Chart documentation is available [here](https://docs.victoriametrics.com/helm/victoria-metrics-operator/)
 apiVersion: v2
-appVersion: v0.55.0
+appVersion: v0.68.1
 dependencies:
 - name: victoria-metrics-common
   repository: https://victoriametrics.github.io/helm-charts
@@ -23,7 +27,7 @@ dependencies:
   name: crds
   repository: ""
   version: 0.0.*
-description: Victoria Metrics Operator
+description: VictoriaMetrics Operator
 home: https://github.com/VictoriaMetrics/operator
 icon: https://avatars.githubusercontent.com/u/43720803?s=200&v=4
 keywords:
@@ -42,4 +46,4 @@ sources:
 - https://github.com/VictoriaMetrics/helm-charts
 - https://github.com/VictoriaMetrics/operator
 type: application
-version: 0.44.0
+version: 0.59.1
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/README.md b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/README.md
new file mode 100644
index 00000000..49a06de2
--- /dev/null
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/README.md
@@ -0,0 +1,3 @@
+# VictoriaMetrics Operator Helm chart
+
+Chart documentation is available [here](https://docs.victoriametrics.com/helm/victoria-metrics-operator/)
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/RELEASE_NOTES b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/RELEASE_NOTES
index 55ceea77..bf22fd3f 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/RELEASE_NOTES
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/RELEASE_NOTES
@@ -1,7 +1,7 @@
-# Release notes for version 0.44.0
+# Release notes for version 0.59.1
 
-**Release date:** 02 Apr 2025
+**Release date:** 03 Mar 2026
 
-![Helm: v3](https://img.shields.io/badge/Helm-v3.14%2B-informational?color=informational&logo=helm&link=https%3A%2F%2Fgithub.com%2Fhelm%2Fhelm%2Freleases%2Ftag%2Fv3.14.0) ![AppVersion: v0.55.0](https://img.shields.io/badge/v0.55.0-success?logo=VictoriaMetrics&labelColor=gray&link=https%3A%2F%2Fdocs.victoriametrics.com%2Foperator%2Fchangelog%23v0550)
+![Helm: v3](https://img.shields.io/badge/Helm-v3.14%2B-informational?color=informational&logo=helm&link=https%3A%2F%2Fgithub.com%2Fhelm%2Fhelm%2Freleases%2Ftag%2Fv3.14.0) ![AppVersion: v0.68.1](https://img.shields.io/badge/v0.68.1-success?logo=VictoriaMetrics&labelColor=gray&link=https%3A%2F%2Fdocs.victoriametrics.com%2Foperator%2Fchangelog%2F%23v0681)
 
-- updates operator to [v0.55.0](https://github.com/VictoriaMetrics/operator/releases/tag/v0.55.0) version
+- updates operator to [v0.68.1](https://github.com/VictoriaMetrics/operator/releases/tag/v0.68.1) version
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/README.md b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/README.md
new file mode 100644
index 00000000..e2bc8e0b
--- /dev/null
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/README.md
@@ -0,0 +1,9 @@
+---
+build:
+  list: never
+  publishResources: false
+  render: never
+sitemap:
+  disable: true
+---
+# Subchart for VictoriaMetrics Operator CRDs
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/crds/crd.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/crds/crd.yaml
index 038cc276..c4138be8 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/crds/crd.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/crds/crd.yaml
@@ -2,7 +2,3185 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: vlagents.operator.victoriametrics.com
+spec:
+  group: operator.victoriametrics.com
+  names:
+    kind: VLAgent
+    listKind: VLAgentList
+    plural: vlagents
+    singular: vlagent
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: current number of replicas
+      jsonPath: .status.replicas
+      name: Replica Count
+      type: integer
+    - description: Current status of update rollout
+      jsonPath: .status.updateStatus
+      name: Status
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            type: string
+          kind:
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              affinity:
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              claimTemplates:
+                items:
+                  properties:
+                    apiVersion:
+                      type: string
+                    kind:
+                      type: string
+                    metadata:
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    spec:
+                      properties:
+                        accessModes:
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        dataSource:
+                          properties:
+                            apiGroup:
+                              type: string
+                            kind:
+                              type: string
+                            name:
+                              type: string
+                          required:
+                          - kind
+                          - name
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        dataSourceRef:
+                          properties:
+                            apiGroup:
+                              type: string
+                            kind:
+                              type: string
+                            name:
+                              type: string
+                            namespace:
+                              type: string
+                          required:
+                          - kind
+                          - name
+                          type: object
+                        resources:
+                          properties:
+                            limits:
+                              additionalProperties:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                x-kubernetes-int-or-string: true
+                              type: object
+                            requests:
+                              additionalProperties:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                x-kubernetes-int-or-string: true
+                              type: object
+                          type: object
+                        selector:
+                          properties:
+                            matchExpressions:
+                              items:
+                                properties:
+                                  key:
+                                    type: string
+                                  operator:
+                                    type: string
+                                  values:
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                type: string
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        storageClassName:
+                          type: string
+                        volumeAttributesClassName:
+                          type: string
+                        volumeMode:
+                          type: string
+                        volumeName:
+                          type: string
+                      type: object
+                    status:
+                      properties:
+                        accessModes:
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        allocatedResourceStatuses:
+                          additionalProperties:
+                            type: string
+                          type: object
+                          x-kubernetes-map-type: granular
+                        allocatedResources:
+                          additionalProperties:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                            x-kubernetes-int-or-string: true
+                          type: object
+                        capacity:
+                          additionalProperties:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                            x-kubernetes-int-or-string: true
+                          type: object
+                        conditions:
+                          items:
+                            properties:
+                              lastProbeTime:
+                                format: date-time
+                                type: string
+                              lastTransitionTime:
+                                format: date-time
+                                type: string
+                              message:
+                                type: string
+                              reason:
+                                type: string
+                              status:
+                                type: string
+                              type:
+                                type: string
+                            required:
+                            - status
+                            - type
+                            type: object
+                          type: array
+                          x-kubernetes-list-map-keys:
+                          - type
+                          x-kubernetes-list-type: map
+                        currentVolumeAttributesClassName:
+                          type: string
+                        modifyVolumeStatus:
+                          properties:
+                            status:
+                              type: string
+                            targetVolumeAttributesClassName:
+                              type: string
+                          required:
+                          - status
+                          type: object
+                        phase:
+                          type: string
+                      type: object
+                  type: object
+                type: array
+              configMaps:
+                items:
+                  type: string
+                type: array
+              containers:
+                items:
+                  required:
+                  - name
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                type: array
+              disableAutomountServiceAccountToken:
+                type: boolean
+              disableSelfServiceScrape:
+                type: boolean
+              dnsConfig:
+                items:
+                  x-kubernetes-preserve-unknown-fields: true
+                properties:
+                  nameservers:
+                    items:
+                      type: string
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  options:
+                    items:
+                      properties:
+                        name:
+                          type: string
+                        value:
+                          type: string
+                      type: object
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  searches:
+                    items:
+                      type: string
+                    type: array
+                    x-kubernetes-list-type: atomic
+                type: object
+              dnsPolicy:
+                type: string
+              extraArgs:
+                additionalProperties:
+                  type: string
+                type: object
+              extraEnvs:
+                items:
+                  properties:
+                    name:
+                      type: string
+                    value:
+                      type: string
+                  required:
+                  - name
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                type: array
+              extraEnvsFrom:
+                items:
+                  properties:
+                    configMapRef:
+                      properties:
+                        name:
+                          default: ""
+                          type: string
+                        optional:
+                          type: boolean
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    prefix:
+                      type: string
+                    secretRef:
+                      properties:
+                        name:
+                          default: ""
+                          type: string
+                        optional:
+                          type: boolean
+                      type: object
+                      x-kubernetes-map-type: atomic
+                  type: object
+                type: array
+              host_aliases:
+                items:
+                  properties:
+                    hostnames:
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    ip:
+                      type: string
+                  required:
+                  - ip
+                  type: object
+                type: array
+              hostAliases:
+                items:
+                  properties:
+                    hostnames:
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    ip:
+                      type: string
+                  required:
+                  - ip
+                  type: object
+                type: array
+              hostNetwork:
+                type: boolean
+              image:
+                properties:
+                  pullPolicy:
+                    type: string
+                  repository:
+                    type: string
+                  tag:
+                    type: string
+                type: object
+              imagePullSecrets:
+                items:
+                  properties:
+                    name:
+                      default: ""
+                      type: string
+                  type: object
+                  x-kubernetes-map-type: atomic
+                type: array
+              initContainers:
+                items:
+                  required:
+                  - name
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                type: array
+              k8sCollector:
+                properties:
+                  checkpointsPath:
+                    type: string
+                  decolorizeFields:
+                    items:
+                      type: string
+                    type: array
+                  enabled:
+                    type: boolean
+                  excludeFilter:
+                    type: string
+                  extraFields:
+                    type: string
+                  ignoreFields:
+                    items:
+                      type: string
+                    type: array
+                  includeNodeAnnotations:
+                    type: boolean
+                  includeNodeLabels:
+                    type: boolean
+                  includePodAnnotations:
+                    type: boolean
+                  includePodLabels:
+                    type: boolean
+                  logsPath:
+                    type: string
+                  msgFields:
+                    items:
+                      type: string
+                    type: array
+                  streamFields:
+                    items:
+                      type: string
+                    type: array
+                  tenantID:
+                    type: string
+                  timeFields:
+                    items:
+                      type: string
+                    type: array
+                type: object
+              license:
+                properties:
+                  forceOffline:
+                    type: boolean
+                  key:
+                    type: string
+                  keyRef:
+                    properties:
+                      key:
+                        type: string
+                      name:
+                        default: ""
+                        type: string
+                      optional:
+                        type: boolean
+                    required:
+                    - key
+                    type: object
+                    x-kubernetes-map-type: atomic
+                  reloadInterval:
+                    type: string
+                type: object
+              livenessProbe:
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              logFormat:
+                enum:
+                - default
+                - json
+                type: string
+              logLevel:
+                enum:
+                - INFO
+                - WARN
+                - ERROR
+                - FATAL
+                - PANIC
+                type: string
+              managedMetadata:
+                properties:
+                  annotations:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  labels:
+                    additionalProperties:
+                      type: string
+                    type: object
+                type: object
+              minReadySeconds:
+                format: int32
+                type: integer
+              nodeSelector:
+                additionalProperties:
+                  type: string
+                type: object
+              paused:
+                type: boolean
+              persistentVolumeClaimRetentionPolicy:
+                properties:
+                  whenDeleted:
+                    type: string
+                  whenScaled:
+                    type: string
+                type: object
+              podDisruptionBudget:
+                properties:
+                  maxUnavailable:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    x-kubernetes-int-or-string: true
+                  minAvailable:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    x-kubernetes-int-or-string: true
+                  selectorLabels:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  unhealthyPodEvictionPolicy:
+                    enum:
+                    - IfHealthyBudget
+                    - AlwaysAllow
+                    type: string
+                type: object
+              podMetadata:
+                properties:
+                  annotations:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  labels:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  name:
+                    type: string
+                type: object
+              port:
+                type: string
+              priorityClassName:
+                type: string
+              readinessGates:
+                items:
+                  properties:
+                    conditionType:
+                      type: string
+                  required:
+                  - conditionType
+                  type: object
+                type: array
+              readinessProbe:
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              remoteWrite:
+                items:
+                  properties:
+                    bearerTokenPath:
+                      type: string
+                    bearerTokenSecret:
+                      properties:
+                        key:
+                          type: string
+                        name:
+                          default: ""
+                          type: string
+                        optional:
+                          type: boolean
+                      required:
+                      - key
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    headers:
+                      items:
+                        type: string
+                      type: array
+                    maxDiskUsage:
+                      x-kubernetes-preserve-unknown-fields: true
+                    oauth2:
+                      properties:
+                        clientIDFile:
+                          type: string
+                        clientIDSecret:
+                          properties:
+                            key:
+                              type: string
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          required:
+                          - key
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        clientSecret:
+                          properties:
+                            key:
+                              type: string
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          required:
+                          - key
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        clientSecretFile:
+                          type: string
+                        endpointParams:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        scopes:
+                          items:
+                            type: string
+                          type: array
+                        tokenURL:
+                          minLength: 1
+                          type: string
+                      required:
+                      - tokenURL
+                      type: object
+                    proxyURL:
+                      type: string
+                    sendTimeout:
+                      pattern: '[0-9]+(ms|s|m|h)'
+                      type: string
+                    tlsConfig:
+                      properties:
+                        caFile:
+                          type: string
+                        caSecretKeyRef:
+                          properties:
+                            key:
+                              type: string
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          required:
+                          - key
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        certFile:
+                          type: string
+                        certSecretKeyRef:
+                          properties:
+                            key:
+                              type: string
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          required:
+                          - key
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        insecureSkipVerify:
+                          type: boolean
+                        keyFile:
+                          type: string
+                        keySecretKeyRef:
+                          properties:
+                            key:
+                              type: string
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          required:
+                          - key
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        serverName:
+                          type: string
+                      type: object
+                    url:
+                      type: string
+                  required:
+                  - url
+                  type: object
+                type: array
+              remoteWriteSettings:
+                properties:
+                  flushInterval:
+                    pattern: '[0-9]+(ms|s|m|h)'
+                    type: string
+                  maxBlockSize:
+                    x-kubernetes-preserve-unknown-fields: true
+                  maxDiskUsagePerURL:
+                    x-kubernetes-preserve-unknown-fields: true
+                  queues:
+                    format: int32
+                    type: integer
+                  showURL:
+                    type: boolean
+                  tmpDataPath:
+                    type: string
+                type: object
+              replicaCount:
+                format: int32
+                type: integer
+              resources:
+                properties:
+                  claims:
+                    items:
+                      properties:
+                        name:
+                          type: string
+                        request:
+                          type: string
+                      required:
+                      - name
+                      type: object
+                    type: array
+                    x-kubernetes-list-map-keys:
+                    - name
+                    x-kubernetes-list-type: map
+                  limits:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    type: object
+                  requests:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    type: object
+                type: object
+              revisionHistoryLimitCount:
+                format: int32
+                type: integer
+              rollingUpdateStrategy:
+                type: string
+              runtimeClassName:
+                type: string
+              schedulerName:
+                type: string
+              secrets:
+                items:
+                  type: string
+                type: array
+              securityContext:
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              serviceAccountName:
+                type: string
+              serviceScrapeSpec:
+                required:
+                - endpoints
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              serviceSpec:
+                properties:
+                  metadata:
+                    properties:
+                      annotations:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      labels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      name:
+                        type: string
+                    type: object
+                  spec:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  useAsDefault:
+                    type: boolean
+                required:
+                - spec
+                type: object
+              startupProbe:
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              storage:
+                properties:
+                  emptyDir:
+                    properties:
+                      medium:
+                        type: string
+                      sizeLimit:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                        x-kubernetes-int-or-string: true
+                    type: object
+                  volumeClaimTemplate:
+                    properties:
+                      apiVersion:
+                        type: string
+                      kind:
+                        type: string
+                      metadata:
+                        properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          name:
+                            type: string
+                        type: object
+                      spec:
+                        properties:
+                          accessModes:
+                            items:
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          dataSource:
+                            properties:
+                              apiGroup:
+                                type: string
+                              kind:
+                                type: string
+                              name:
+                                type: string
+                            required:
+                            - kind
+                            - name
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          dataSourceRef:
+                            properties:
+                              apiGroup:
+                                type: string
+                              kind:
+                                type: string
+                              name:
+                                type: string
+                              namespace:
+                                type: string
+                            required:
+                            - kind
+                            - name
+                            type: object
+                          resources:
+                            properties:
+                              limits:
+                                additionalProperties:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                type: object
+                              requests:
+                                additionalProperties:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                type: object
+                            type: object
+                          selector:
+                            properties:
+                              matchExpressions:
+                                items:
+                                  properties:
+                                    key:
+                                      type: string
+                                    operator:
+                                      type: string
+                                    values:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  required:
+                                  - key
+                                  - operator
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              matchLabels:
+                                additionalProperties:
+                                  type: string
+                                type: object
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          storageClassName:
+                            type: string
+                          volumeAttributesClassName:
+                            type: string
+                          volumeMode:
+                            type: string
+                          volumeName:
+                            type: string
+                        type: object
+                      status:
+                        properties:
+                          accessModes:
+                            items:
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          allocatedResourceStatuses:
+                            additionalProperties:
+                              type: string
+                            type: object
+                            x-kubernetes-map-type: granular
+                          allocatedResources:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            type: object
+                          capacity:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            type: object
+                          conditions:
+                            items:
+                              properties:
+                                lastProbeTime:
+                                  format: date-time
+                                  type: string
+                                lastTransitionTime:
+                                  format: date-time
+                                  type: string
+                                message:
+                                  type: string
+                                reason:
+                                  type: string
+                                status:
+                                  type: string
+                                type:
+                                  type: string
+                              required:
+                              - status
+                              - type
+                              type: object
+                            type: array
+                            x-kubernetes-list-map-keys:
+                            - type
+                            x-kubernetes-list-type: map
+                          currentVolumeAttributesClassName:
+                            type: string
+                          modifyVolumeStatus:
+                            properties:
+                              status:
+                                type: string
+                              targetVolumeAttributesClassName:
+                                type: string
+                            required:
+                            - status
+                            type: object
+                          phase:
+                            type: string
+                        type: object
+                    type: object
+                type: object
+              syslogSpec:
+                properties:
+                  tcpListeners:
+                    items:
+                      properties:
+                        compressMethod:
+                          pattern: ^(none|zstd|gzip|deflate)$
+                          type: string
+                        decolorizeFields:
+                          type: string
+                        ignoreFields:
+                          type: string
+                        listenPort:
+                          format: int32
+                          type: integer
+                        streamFields:
+                          type: string
+                        tenantID:
+                          type: string
+                        tlsConfig:
+                          properties:
+                            certFile:
+                              type: string
+                            certSecret:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            keyFile:
+                              type: string
+                            keySecret:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                          type: object
+                      required:
+                      - listenPort
+                      type: object
+                    type: array
+                  udpListeners:
+                    items:
+                      properties:
+                        compressMethod:
+                          pattern: ^(none|zstd|gzip|deflate)$
+                          type: string
+                        decolorizeFields:
+                          type: string
+                        ignoreFields:
+                          type: string
+                        listenPort:
+                          format: int32
+                          type: integer
+                        streamFields:
+                          type: string
+                        tenantID:
+                          type: string
+                      required:
+                      - listenPort
+                      type: object
+                    type: array
+                type: object
+              terminationGracePeriodSeconds:
+                format: int64
+                type: integer
+              tmpDataPath:
+                type: string
+              tolerations:
+                items:
+                  properties:
+                    effect:
+                      type: string
+                    key:
+                      type: string
+                    operator:
+                      type: string
+                    tolerationSeconds:
+                      format: int64
+                      type: integer
+                    value:
+                      type: string
+                  type: object
+                type: array
+              topologySpreadConstraints:
+                items:
+                  required:
+                  - maxSkew
+                  - topologyKey
+                  - whenUnsatisfiable
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                type: array
+              useDefaultResources:
+                type: boolean
+              useStrictSecurity:
+                type: boolean
+              volumeMounts:
+                items:
+                  properties:
+                    mountPath:
+                      type: string
+                    mountPropagation:
+                      type: string
+                    name:
+                      type: string
+                    readOnly:
+                      type: boolean
+                    recursiveReadOnly:
+                      type: string
+                    subPath:
+                      type: string
+                    subPathExpr:
+                      type: string
+                  required:
+                  - mountPath
+                  - name
+                  type: object
+                type: array
+              volumes:
+                items:
+                  required:
+                  - name
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                type: array
+            required:
+            - remoteWrite
+            type: object
+          status:
+            properties:
+              conditions:
+                items:
+                  properties:
+                    lastTransitionTime:
+                      format: date-time
+                      type: string
+                    lastUpdateTime:
+                      format: date-time
+                      type: string
+                    message:
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      maxLength: 1024
+                      minLength: 1
+                      type: string
+                    status:
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      maxLength: 316
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - lastUpdateTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              observedGeneration:
+                format: int64
+                type: integer
+              reason:
+                type: string
+              replicas:
+                format: int32
+                type: integer
+              selector:
+                type: string
+              updateStatus:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      scale:
+        labelSelectorPath: .status.selector
+        specReplicasPath: .spec.shardCount
+        statusReplicasPath: .status.shards
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: vlclusters.operator.victoriametrics.com
+spec:
+  group: operator.victoriametrics.com
+  names:
+    kind: VLCluster
+    listKind: VLClusterList
+    plural: vlclusters
+    singular: vlcluster
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: replicas of VLInsert
+      jsonPath: .spec.vlinsert.replicaCount
+      name: Insert Count
+      type: string
+    - description: replicas of VLStorage
+      jsonPath: .spec.vlstorage.replicaCount
+      name: Storage Count
+      type: string
+    - description: replicas of VLSelect
+      jsonPath: .spec.vlselect.replicaCount
+      name: Select Count
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: Current status of cluster
+      jsonPath: .status.updateStatus
+      name: Status
+      type: string
+    name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            type: string
+          kind:
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              clusterDomainName:
+                type: string
+              clusterVersion:
+                type: string
+              imagePullSecrets:
+                items:
+                  properties:
+                    name:
+                      default: ""
+                      type: string
+                  type: object
+                  x-kubernetes-map-type: atomic
+                type: array
+              license:
+                properties:
+                  forceOffline:
+                    type: boolean
+                  key:
+                    type: string
+                  keyRef:
+                    properties:
+                      key:
+                        type: string
+                      name:
+                        default: ""
+                        type: string
+                      optional:
+                        type: boolean
+                    required:
+                    - key
+                    type: object
+                    x-kubernetes-map-type: atomic
+                  reloadInterval:
+                    type: string
+                type: object
+              managedMetadata:
+                properties:
+                  annotations:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  labels:
+                    additionalProperties:
+                      type: string
+                    type: object
+                type: object
+              paused:
+                type: boolean
+              requestsLoadBalancer:
+                properties:
+                  disableInsertBalancing:
+                    type: boolean
+                  disableSelectBalancing:
+                    type: boolean
+                  enabled:
+                    type: boolean
+                  spec:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                type: object
+              serviceAccountName:
+                type: string
+              useStrictSecurity:
+                type: boolean
+              vlinsert:
+                properties:
+                  affinity:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  configMaps:
+                    items:
+                      type: string
+                    type: array
+                  containers:
+                    items:
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  disableAutomountServiceAccountToken:
+                    type: boolean
+                  disableSelfServiceScrape:
+                    type: boolean
+                  dnsConfig:
+                    items:
+                      x-kubernetes-preserve-unknown-fields: true
+                    properties:
+                      nameservers:
+                        items:
+                          type: string
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      options:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                            value:
+                              type: string
+                          type: object
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      searches:
+                        items:
+                          type: string
+                        type: array
+                        x-kubernetes-list-type: atomic
+                    type: object
+                  dnsPolicy:
+                    type: string
+                  extraArgs:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  extraEnvs:
+                    items:
+                      properties:
+                        name:
+                          type: string
+                        value:
+                          type: string
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  extraEnvsFrom:
+                    items:
+                      properties:
+                        configMapRef:
+                          properties:
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        prefix:
+                          type: string
+                        secretRef:
+                          properties:
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          type: object
+                          x-kubernetes-map-type: atomic
+                      type: object
+                    type: array
+                  host_aliases:
+                    items:
+                      properties:
+                        hostnames:
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        ip:
+                          type: string
+                      required:
+                      - ip
+                      type: object
+                    type: array
+                  hostAliases:
+                    items:
+                      properties:
+                        hostnames:
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        ip:
+                          type: string
+                      required:
+                      - ip
+                      type: object
+                    type: array
+                  hostNetwork:
+                    type: boolean
+                  hpa:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  image:
+                    properties:
+                      pullPolicy:
+                        type: string
+                      repository:
+                        type: string
+                      tag:
+                        type: string
+                    type: object
+                  imagePullSecrets:
+                    items:
+                      properties:
+                        name:
+                          default: ""
+                          type: string
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    type: array
+                  initContainers:
+                    items:
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  livenessProbe:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  logFormat:
+                    enum:
+                    - default
+                    - json
+                    type: string
+                  logLevel:
+                    enum:
+                    - INFO
+                    - WARN
+                    - ERROR
+                    - FATAL
+                    - PANIC
+                    type: string
+                  minReadySeconds:
+                    format: int32
+                    type: integer
+                  nodeSelector:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  paused:
+                    type: boolean
+                  podDisruptionBudget:
+                    properties:
+                      maxUnavailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                      minAvailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                      selectorLabels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      unhealthyPodEvictionPolicy:
+                        enum:
+                        - IfHealthyBudget
+                        - AlwaysAllow
+                        type: string
+                    type: object
+                  podMetadata:
+                    properties:
+                      annotations:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      labels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      name:
+                        type: string
+                    type: object
+                  port:
+                    type: string
+                  priorityClassName:
+                    type: string
+                  readinessGates:
+                    items:
+                      properties:
+                        conditionType:
+                          type: string
+                      required:
+                      - conditionType
+                      type: object
+                    type: array
+                  readinessProbe:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  replicaCount:
+                    format: int32
+                    type: integer
+                  resources:
+                    properties:
+                      claims:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                            request:
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                        x-kubernetes-list-map-keys:
+                        - name
+                        x-kubernetes-list-type: map
+                      limits:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        type: object
+                      requests:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        type: object
+                    type: object
+                  revisionHistoryLimitCount:
+                    format: int32
+                    type: integer
+                  rollingUpdate:
+                    properties:
+                      maxSurge:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                      maxUnavailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                    type: object
+                  runtimeClassName:
+                    type: string
+                  schedulerName:
+                    type: string
+                  secrets:
+                    items:
+                      type: string
+                    type: array
+                  securityContext:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  serviceScrapeSpec:
+                    required:
+                    - endpoints
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  serviceSpec:
+                    properties:
+                      metadata:
+                        properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          name:
+                            type: string
+                        type: object
+                      spec:
+                        type: object
+                        x-kubernetes-preserve-unknown-fields: true
+                      useAsDefault:
+                        type: boolean
+                    required:
+                    - spec
+                    type: object
+                  startupProbe:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  syslogSpec:
+                    properties:
+                      tcpListeners:
+                        items:
+                          properties:
+                            compressMethod:
+                              pattern: ^(none|zstd|gzip|deflate)$
+                              type: string
+                            decolorizeFields:
+                              type: string
+                            ignoreFields:
+                              type: string
+                            listenPort:
+                              format: int32
+                              type: integer
+                            streamFields:
+                              type: string
+                            tenantID:
+                              type: string
+                            tlsConfig:
+                              properties:
+                                certFile:
+                                  type: string
+                                certSecret:
+                                  properties:
+                                    key:
+                                      type: string
+                                    name:
+                                      default: ""
+                                      type: string
+                                    optional:
+                                      type: boolean
+                                  required:
+                                  - key
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                keyFile:
+                                  type: string
+                                keySecret:
+                                  properties:
+                                    key:
+                                      type: string
+                                    name:
+                                      default: ""
+                                      type: string
+                                    optional:
+                                      type: boolean
+                                  required:
+                                  - key
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                              type: object
+                          required:
+                          - listenPort
+                          type: object
+                        type: array
+                      udpListeners:
+                        items:
+                          properties:
+                            compressMethod:
+                              pattern: ^(none|zstd|gzip|deflate)$
+                              type: string
+                            decolorizeFields:
+                              type: string
+                            ignoreFields:
+                              type: string
+                            listenPort:
+                              format: int32
+                              type: integer
+                            streamFields:
+                              type: string
+                            tenantID:
+                              type: string
+                          required:
+                          - listenPort
+                          type: object
+                        type: array
+                    type: object
+                  terminationGracePeriodSeconds:
+                    format: int64
+                    type: integer
+                  tolerations:
+                    items:
+                      properties:
+                        effect:
+                          type: string
+                        key:
+                          type: string
+                        operator:
+                          type: string
+                        tolerationSeconds:
+                          format: int64
+                          type: integer
+                        value:
+                          type: string
+                      type: object
+                    type: array
+                  topologySpreadConstraints:
+                    items:
+                      required:
+                      - maxSkew
+                      - topologyKey
+                      - whenUnsatisfiable
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  updateStrategy:
+                    enum:
+                    - Recreate
+                    - RollingUpdate
+                    type: string
+                  useDefaultResources:
+                    type: boolean
+                  useStrictSecurity:
+                    type: boolean
+                  volumeMounts:
+                    items:
+                      properties:
+                        mountPath:
+                          type: string
+                        mountPropagation:
+                          type: string
+                        name:
+                          type: string
+                        readOnly:
+                          type: boolean
+                        recursiveReadOnly:
+                          type: string
+                        subPath:
+                          type: string
+                        subPathExpr:
+                          type: string
+                      required:
+                      - mountPath
+                      - name
+                      type: object
+                    type: array
+                  volumes:
+                    items:
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  vpa:
+                    properties:
+                      recommenders:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                      resourcePolicy:
+                        properties:
+                          containerPolicies:
+                            items:
+                              properties:
+                                containerName:
+                                  type: string
+                                controlledResources:
+                                  items:
+                                    type: string
+                                  type: array
+                                controlledValues:
+                                  enum:
+                                  - RequestsAndLimits
+                                  - RequestsOnly
+                                  type: string
+                                maxAllowed:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                minAllowed:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                mode:
+                                  enum:
+                                  - Auto
+                                  - "Off"
+                                  type: string
+                              type: object
+                            type: array
+                        type: object
+                      updatePolicy:
+                        properties:
+                          evictionRequirements:
+                            items:
+                              properties:
+                                changeRequirement:
+                                  enum:
+                                  - TargetHigherThanRequests
+                                  - TargetLowerThanRequests
+                                  type: string
+                                resources:
+                                  items:
+                                    type: string
+                                  type: array
+                              required:
+                              - changeRequirement
+                              - resources
+                              type: object
+                            type: array
+                          minReplicas:
+                            format: int32
+                            type: integer
+                          updateMode:
+                            enum:
+                            - "Off"
+                            - Initial
+                            - Recreate
+                            - InPlaceOrRecreate
+                            - Auto
+                            type: string
+                        type: object
+                    type: object
+                type: object
+              vlselect:
+                properties:
+                  affinity:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  configMaps:
+                    items:
+                      type: string
+                    type: array
+                  containers:
+                    items:
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  disableAutomountServiceAccountToken:
+                    type: boolean
+                  disableSelfServiceScrape:
+                    type: boolean
+                  dnsConfig:
+                    items:
+                      x-kubernetes-preserve-unknown-fields: true
+                    properties:
+                      nameservers:
+                        items:
+                          type: string
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      options:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                            value:
+                              type: string
+                          type: object
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      searches:
+                        items:
+                          type: string
+                        type: array
+                        x-kubernetes-list-type: atomic
+                    type: object
+                  dnsPolicy:
+                    type: string
+                  extraArgs:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  extraEnvs:
+                    items:
+                      properties:
+                        name:
+                          type: string
+                        value:
+                          type: string
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  extraEnvsFrom:
+                    items:
+                      properties:
+                        configMapRef:
+                          properties:
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        prefix:
+                          type: string
+                        secretRef:
+                          properties:
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          type: object
+                          x-kubernetes-map-type: atomic
+                      type: object
+                    type: array
+                  extraStorageNodes:
+                    items:
+                      properties:
+                        addr:
+                          type: string
+                      required:
+                      - addr
+                      type: object
+                    type: array
+                  host_aliases:
+                    items:
+                      properties:
+                        hostnames:
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        ip:
+                          type: string
+                      required:
+                      - ip
+                      type: object
+                    type: array
+                  hostAliases:
+                    items:
+                      properties:
+                        hostnames:
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        ip:
+                          type: string
+                      required:
+                      - ip
+                      type: object
+                    type: array
+                  hostNetwork:
+                    type: boolean
+                  hpa:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  image:
+                    properties:
+                      pullPolicy:
+                        type: string
+                      repository:
+                        type: string
+                      tag:
+                        type: string
+                    type: object
+                  imagePullSecrets:
+                    items:
+                      properties:
+                        name:
+                          default: ""
+                          type: string
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    type: array
+                  initContainers:
+                    items:
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  livenessProbe:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  logFormat:
+                    enum:
+                    - default
+                    - json
+                    type: string
+                  logLevel:
+                    enum:
+                    - INFO
+                    - WARN
+                    - ERROR
+                    - FATAL
+                    - PANIC
+                    type: string
+                  minReadySeconds:
+                    format: int32
+                    type: integer
+                  nodeSelector:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  paused:
+                    type: boolean
+                  podDisruptionBudget:
+                    properties:
+                      maxUnavailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                      minAvailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                      selectorLabels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      unhealthyPodEvictionPolicy:
+                        enum:
+                        - IfHealthyBudget
+                        - AlwaysAllow
+                        type: string
+                    type: object
+                  podMetadata:
+                    properties:
+                      annotations:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      labels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      name:
+                        type: string
+                    type: object
+                  port:
+                    type: string
+                  priorityClassName:
+                    type: string
+                  readinessGates:
+                    items:
+                      properties:
+                        conditionType:
+                          type: string
+                      required:
+                      - conditionType
+                      type: object
+                    type: array
+                  readinessProbe:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  replicaCount:
+                    format: int32
+                    type: integer
+                  resources:
+                    properties:
+                      claims:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                            request:
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                        x-kubernetes-list-map-keys:
+                        - name
+                        x-kubernetes-list-type: map
+                      limits:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        type: object
+                      requests:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        type: object
+                    type: object
+                  revisionHistoryLimitCount:
+                    format: int32
+                    type: integer
+                  rollingUpdate:
+                    properties:
+                      maxSurge:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                      maxUnavailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                    type: object
+                  runtimeClassName:
+                    type: string
+                  schedulerName:
+                    type: string
+                  secrets:
+                    items:
+                      type: string
+                    type: array
+                  securityContext:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  serviceScrapeSpec:
+                    required:
+                    - endpoints
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  serviceSpec:
+                    properties:
+                      metadata:
+                        properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          name:
+                            type: string
+                        type: object
+                      spec:
+                        type: object
+                        x-kubernetes-preserve-unknown-fields: true
+                      useAsDefault:
+                        type: boolean
+                    required:
+                    - spec
+                    type: object
+                  startupProbe:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  terminationGracePeriodSeconds:
+                    format: int64
+                    type: integer
+                  tolerations:
+                    items:
+                      properties:
+                        effect:
+                          type: string
+                        key:
+                          type: string
+                        operator:
+                          type: string
+                        tolerationSeconds:
+                          format: int64
+                          type: integer
+                        value:
+                          type: string
+                      type: object
+                    type: array
+                  topologySpreadConstraints:
+                    items:
+                      required:
+                      - maxSkew
+                      - topologyKey
+                      - whenUnsatisfiable
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  updateStrategy:
+                    enum:
+                    - Recreate
+                    - RollingUpdate
+                    type: string
+                  useDefaultResources:
+                    type: boolean
+                  useStrictSecurity:
+                    type: boolean
+                  volumeMounts:
+                    items:
+                      properties:
+                        mountPath:
+                          type: string
+                        mountPropagation:
+                          type: string
+                        name:
+                          type: string
+                        readOnly:
+                          type: boolean
+                        recursiveReadOnly:
+                          type: string
+                        subPath:
+                          type: string
+                        subPathExpr:
+                          type: string
+                      required:
+                      - mountPath
+                      - name
+                      type: object
+                    type: array
+                  volumes:
+                    items:
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  vpa:
+                    properties:
+                      recommenders:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                      resourcePolicy:
+                        properties:
+                          containerPolicies:
+                            items:
+                              properties:
+                                containerName:
+                                  type: string
+                                controlledResources:
+                                  items:
+                                    type: string
+                                  type: array
+                                controlledValues:
+                                  enum:
+                                  - RequestsAndLimits
+                                  - RequestsOnly
+                                  type: string
+                                maxAllowed:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                minAllowed:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                mode:
+                                  enum:
+                                  - Auto
+                                  - "Off"
+                                  type: string
+                              type: object
+                            type: array
+                        type: object
+                      updatePolicy:
+                        properties:
+                          evictionRequirements:
+                            items:
+                              properties:
+                                changeRequirement:
+                                  enum:
+                                  - TargetHigherThanRequests
+                                  - TargetLowerThanRequests
+                                  type: string
+                                resources:
+                                  items:
+                                    type: string
+                                  type: array
+                              required:
+                              - changeRequirement
+                              - resources
+                              type: object
+                            type: array
+                          minReplicas:
+                            format: int32
+                            type: integer
+                          updateMode:
+                            enum:
+                            - "Off"
+                            - Initial
+                            - Recreate
+                            - InPlaceOrRecreate
+                            - Auto
+                            type: string
+                        type: object
+                    type: object
+                type: object
+              vlstorage:
+                properties:
+                  affinity:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  claimTemplates:
+                    items:
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  configMaps:
+                    items:
+                      type: string
+                    type: array
+                  containers:
+                    items:
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  disableAutomountServiceAccountToken:
+                    type: boolean
+                  disableSelfServiceScrape:
+                    type: boolean
+                  dnsConfig:
+                    items:
+                      x-kubernetes-preserve-unknown-fields: true
+                    properties:
+                      nameservers:
+                        items:
+                          type: string
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      options:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                            value:
+                              type: string
+                          type: object
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      searches:
+                        items:
+                          type: string
+                        type: array
+                        x-kubernetes-list-type: atomic
+                    type: object
+                  dnsPolicy:
+                    type: string
+                  extraArgs:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  extraEnvs:
+                    items:
+                      properties:
+                        name:
+                          type: string
+                        value:
+                          type: string
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  extraEnvsFrom:
+                    items:
+                      properties:
+                        configMapRef:
+                          properties:
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        prefix:
+                          type: string
+                        secretRef:
+                          properties:
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          type: object
+                          x-kubernetes-map-type: atomic
+                      type: object
+                    type: array
+                  futureRetention:
+                    pattern: ^[0-9]+(h|d|w|y)?$
+                    type: string
+                  host_aliases:
+                    items:
+                      properties:
+                        hostnames:
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        ip:
+                          type: string
+                      required:
+                      - ip
+                      type: object
+                    type: array
+                  hostAliases:
+                    items:
+                      properties:
+                        hostnames:
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        ip:
+                          type: string
+                      required:
+                      - ip
+                      type: object
+                    type: array
+                  hostNetwork:
+                    type: boolean
+                  hpa:
+                    properties:
+                      behaviour:
+                        properties:
+                          scaleDown:
+                            properties:
+                              policies:
+                                items:
+                                  properties:
+                                    periodSeconds:
+                                      format: int32
+                                      type: integer
+                                    type:
+                                      type: string
+                                    value:
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - periodSeconds
+                                  - type
+                                  - value
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              selectPolicy:
+                                type: string
+                              stabilizationWindowSeconds:
+                                format: int32
+                                type: integer
+                              tolerance:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                x-kubernetes-int-or-string: true
+                            type: object
+                          scaleUp:
+                            properties:
+                              policies:
+                                items:
+                                  properties:
+                                    periodSeconds:
+                                      format: int32
+                                      type: integer
+                                    type:
+                                      type: string
+                                    value:
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - periodSeconds
+                                  - type
+                                  - value
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              selectPolicy:
+                                type: string
+                              stabilizationWindowSeconds:
+                                format: int32
+                                type: integer
+                              tolerance:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                x-kubernetes-int-or-string: true
+                            type: object
+                        type: object
+                      maxReplicas:
+                        format: int32
+                        type: integer
+                      metrics:
+                        items:
+                          properties:
+                            containerResource:
+                              properties:
+                                container:
+                                  type: string
+                                name:
+                                  type: string
+                                target:
+                                  properties:
+                                    averageUtilization:
+                                      format: int32
+                                      type: integer
+                                    averageValue:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                    type:
+                                      type: string
+                                    value:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - type
+                                  type: object
+                              required:
+                              - container
+                              - name
+                              - target
+                              type: object
+                            external:
+                              properties:
+                                metric:
+                                  properties:
+                                    name:
+                                      type: string
+                                    selector:
+                                      properties:
+                                        matchExpressions:
+                                          items:
+                                            properties:
+                                              key:
+                                                type: string
+                                              operator:
+                                                type: string
+                                              values:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                  required:
+                                  - name
+                                  type: object
+                                target:
+                                  properties:
+                                    averageUtilization:
+                                      format: int32
+                                      type: integer
+                                    averageValue:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                    type:
+                                      type: string
+                                    value:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - type
+                                  type: object
+                              required:
+                              - metric
+                              - target
+                              type: object
+                            object:
+                              properties:
+                                describedObject:
+                                  properties:
+                                    apiVersion:
+                                      type: string
+                                    kind:
+                                      type: string
+                                    name:
+                                      type: string
+                                  required:
+                                  - kind
+                                  - name
+                                  type: object
+                                metric:
+                                  properties:
+                                    name:
+                                      type: string
+                                    selector:
+                                      properties:
+                                        matchExpressions:
+                                          items:
+                                            properties:
+                                              key:
+                                                type: string
+                                              operator:
+                                                type: string
+                                              values:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                  required:
+                                  - name
+                                  type: object
+                                target:
+                                  properties:
+                                    averageUtilization:
+                                      format: int32
+                                      type: integer
+                                    averageValue:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                    type:
+                                      type: string
+                                    value:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - type
+                                  type: object
+                              required:
+                              - describedObject
+                              - metric
+                              - target
+                              type: object
+                            pods:
+                              properties:
+                                metric:
+                                  properties:
+                                    name:
+                                      type: string
+                                    selector:
+                                      properties:
+                                        matchExpressions:
+                                          items:
+                                            properties:
+                                              key:
+                                                type: string
+                                              operator:
+                                                type: string
+                                              values:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                  required:
+                                  - name
+                                  type: object
+                                target:
+                                  properties:
+                                    averageUtilization:
+                                      format: int32
+                                      type: integer
+                                    averageValue:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                    type:
+                                      type: string
+                                    value:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - type
+                                  type: object
+                              required:
+                              - metric
+                              - target
+                              type: object
+                            resource:
+                              properties:
+                                name:
+                                  type: string
+                                target:
+                                  properties:
+                                    averageUtilization:
+                                      format: int32
+                                      type: integer
+                                    averageValue:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                    type:
+                                      type: string
+                                    value:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - type
+                                  type: object
+                              required:
+                              - name
+                              - target
+                              type: object
+                            type:
+                              type: string
+                          required:
+                          - type
+                          type: object
+                        type: array
+                      minReplicas:
+                        format: int32
+                        type: integer
+                    type: object
+                  image:
+                    properties:
+                      pullPolicy:
+                        type: string
+                      repository:
+                        type: string
+                      tag:
+                        type: string
+                    type: object
+                  imagePullSecrets:
+                    items:
+                      properties:
+                        name:
+                          default: ""
+                          type: string
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    type: array
+                  initContainers:
+                    items:
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  livenessProbe:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  logFormat:
+                    enum:
+                    - default
+                    - json
+                    type: string
+                  logIngestedRows:
+                    type: boolean
+                  logLevel:
+                    enum:
+                    - INFO
+                    - WARN
+                    - ERROR
+                    - FATAL
+                    - PANIC
+                    type: string
+                  logNewStreams:
+                    type: boolean
+                  maintenanceInsertNodeIDs:
+                    items:
+                      format: int32
+                      type: integer
+                    type: array
+                  maintenanceSelectNodeIDs:
+                    items:
+                      format: int32
+                      type: integer
+                    type: array
+                  minReadySeconds:
+                    format: int32
+                    type: integer
+                  nodeSelector:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  paused:
+                    type: boolean
+                  persistentVolumeClaimRetentionPolicy:
+                    properties:
+                      whenDeleted:
+                        type: string
+                      whenScaled:
+                        type: string
+                    type: object
+                  podDisruptionBudget:
+                    properties:
+                      maxUnavailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                      minAvailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                      selectorLabels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      unhealthyPodEvictionPolicy:
+                        enum:
+                        - IfHealthyBudget
+                        - AlwaysAllow
+                        type: string
+                    type: object
+                  podMetadata:
+                    properties:
+                      annotations:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      labels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      name:
+                        type: string
+                    type: object
+                  port:
+                    type: string
+                  priorityClassName:
+                    type: string
+                  readinessGates:
+                    items:
+                      properties:
+                        conditionType:
+                          type: string
+                      required:
+                      - conditionType
+                      type: object
+                    type: array
+                  readinessProbe:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  replicaCount:
+                    format: int32
+                    type: integer
+                  resources:
+                    properties:
+                      claims:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                            request:
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                        x-kubernetes-list-map-keys:
+                        - name
+                        x-kubernetes-list-type: map
+                      limits:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        type: object
+                      requests:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        type: object
+                    type: object
+                  retentionMaxDiskSpaceUsageBytes:
+                    type: string
+                  retentionPeriod:
+                    pattern: ^[0-9]+(h|d|w|y)?$
+                    type: string
+                  revisionHistoryLimitCount:
+                    format: int32
+                    type: integer
+                  rollingUpdateStrategy:
+                    type: string
+                  rollingUpdateStrategyBehavior:
+                    properties:
+                      maxUnavailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                    type: object
+                  runtimeClassName:
+                    type: string
+                  schedulerName:
+                    type: string
+                  secrets:
+                    items:
+                      type: string
+                    type: array
+                  securityContext:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  serviceScrapeSpec:
+                    required:
+                    - endpoints
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  serviceSpec:
+                    properties:
+                      metadata:
+                        properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          name:
+                            type: string
+                        type: object
+                      spec:
+                        type: object
+                        x-kubernetes-preserve-unknown-fields: true
+                      useAsDefault:
+                        type: boolean
+                    required:
+                    - spec
+                    type: object
+                  startupProbe:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  storage:
+                    properties:
+                      emptyDir:
+                        properties:
+                          medium:
+                            type: string
+                          sizeLimit:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                            x-kubernetes-int-or-string: true
+                        type: object
+                      volumeClaimTemplate:
+                        type: object
+                        x-kubernetes-preserve-unknown-fields: true
+                    type: object
+                  storageDataPath:
+                    type: string
+                  terminationGracePeriodSeconds:
+                    format: int64
+                    type: integer
+                  tolerations:
+                    items:
+                      properties:
+                        effect:
+                          type: string
+                        key:
+                          type: string
+                        operator:
+                          type: string
+                        tolerationSeconds:
+                          format: int64
+                          type: integer
+                        value:
+                          type: string
+                      type: object
+                    type: array
+                  topologySpreadConstraints:
+                    items:
+                      required:
+                      - maxSkew
+                      - topologyKey
+                      - whenUnsatisfiable
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  useDefaultResources:
+                    type: boolean
+                  useStrictSecurity:
+                    type: boolean
+                  volumeMounts:
+                    items:
+                      properties:
+                        mountPath:
+                          type: string
+                        mountPropagation:
+                          type: string
+                        name:
+                          type: string
+                        readOnly:
+                          type: boolean
+                        recursiveReadOnly:
+                          type: string
+                        subPath:
+                          type: string
+                        subPathExpr:
+                          type: string
+                      required:
+                      - mountPath
+                      - name
+                      type: object
+                    type: array
+                  volumes:
+                    items:
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  vpa:
+                    properties:
+                      recommenders:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                      resourcePolicy:
+                        properties:
+                          containerPolicies:
+                            items:
+                              properties:
+                                containerName:
+                                  type: string
+                                controlledResources:
+                                  items:
+                                    type: string
+                                  type: array
+                                controlledValues:
+                                  enum:
+                                  - RequestsAndLimits
+                                  - RequestsOnly
+                                  type: string
+                                maxAllowed:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                minAllowed:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                mode:
+                                  enum:
+                                  - Auto
+                                  - "Off"
+                                  type: string
+                              type: object
+                            type: array
+                        type: object
+                      updatePolicy:
+                        properties:
+                          evictionRequirements:
+                            items:
+                              properties:
+                                changeRequirement:
+                                  enum:
+                                  - TargetHigherThanRequests
+                                  - TargetLowerThanRequests
+                                  type: string
+                                resources:
+                                  items:
+                                    type: string
+                                  type: array
+                              required:
+                              - changeRequirement
+                              - resources
+                              type: object
+                            type: array
+                          minReplicas:
+                            format: int32
+                            type: integer
+                          updateMode:
+                            enum:
+                            - "Off"
+                            - Initial
+                            - Recreate
+                            - InPlaceOrRecreate
+                            - Auto
+                            type: string
+                        type: object
+                    type: object
+                type: object
+            type: object
+          status:
+            properties:
+              conditions:
+                items:
+                  properties:
+                    lastTransitionTime:
+                      format: date-time
+                      type: string
+                    lastUpdateTime:
+                      format: date-time
+                      type: string
+                    message:
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      maxLength: 1024
+                      minLength: 1
+                      type: string
+                    status:
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      maxLength: 316
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - lastUpdateTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              observedGeneration:
+                format: int64
+                type: integer
+              reason:
+                type: string
+              updateStatus:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vlogs.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -24,146 +3202,164 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: |-
-          VLogs is fast, cost-effective and scalable logs database.
-          VLogs is the Schema for the vlogs API
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VLogsSpec defines the desired state of VLogs
+            required:
+            - retentionPeriod
+            type: object
+            x-kubernetes-preserve-unknown-fields: true
+          status:
+            properties:
+              conditions:
+                items:
+                  properties:
+                    lastTransitionTime:
+                      format: date-time
+                      type: string
+                    lastUpdateTime:
+                      format: date-time
+                      type: string
+                    message:
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      maxLength: 1024
+                      minLength: 1
+                      type: string
+                    status:
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      maxLength: 316
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - lastUpdateTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              observedGeneration:
+                format: int64
+                type: integer
+              reason:
+                type: string
+              updateStatus:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: vlsingles.operator.victoriametrics.com
+spec:
+  group: operator.victoriametrics.com
+  names:
+    kind: VLSingle
+    listKind: VLSingleList
+    plural: vlsingles
+    singular: vlsingle
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: Current status of logs instance update process
+      jsonPath: .status.status
+      name: Status
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            type: string
+          kind:
+            type: string
+          metadata:
+            type: object
+          spec:
             properties:
               affinity:
-                description: Affinity If specified, the pod's scheduling constraints.
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               configMaps:
-                description: |-
-                  ConfigMaps is a list of ConfigMaps in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/configs/CONFIGMAP_NAME folder
                 items:
                   type: string
                 type: array
               containers:
-                description: |-
-                  Containers property allows to inject additions sidecars or to patch existing containers.
-                  It can be useful for proxies, backup, etc.
                 items:
-                  description: A single application container that you want to run
-                    within a pod.
                   required:
                   - name
                   type: object
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               disableAutomountServiceAccountToken:
-                description: |-
-                  DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
-                  Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
-                  For example, vmagent and vm-config-reloader requires k8s API access.
-                  Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
-                  And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
                 type: boolean
               disableSelfServiceScrape:
-                description: |-
-                  DisableSelfServiceScrape controls creation of VMServiceScrape by operator
-                  for the application.
-                  Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable
                 type: boolean
               dnsConfig:
-                description: |-
-                  Specifies the DNS parameters of a pod.
-                  Parameters specified here will be merged to the generated DNS
-                  configuration based on DNSPolicy.
                 items:
                   x-kubernetes-preserve-unknown-fields: true
                 properties:
                   nameservers:
-                    description: |-
-                      A list of DNS name server IP addresses.
-                      This will be appended to the base nameservers generated from DNSPolicy.
-                      Duplicated nameservers will be removed.
                     items:
                       type: string
                     type: array
                     x-kubernetes-list-type: atomic
                   options:
-                    description: |-
-                      A list of DNS resolver options.
-                      This will be merged with the base options generated from DNSPolicy.
-                      Duplicated entries will be removed. Resolution options given in Options
-                      will override those that appear in the base DNSPolicy.
                     items:
-                      description: PodDNSConfigOption defines DNS resolver options
-                        of a pod.
                       properties:
                         name:
-                          description: |-
-                            Name is this DNS resolver option's name.
-                            Required.
                           type: string
                         value:
-                          description: Value is this DNS resolver option's value.
                           type: string
                       type: object
                     type: array
                     x-kubernetes-list-type: atomic
                   searches:
-                    description: |-
-                      A list of DNS search domains for host-name lookup.
-                      This will be appended to the base search paths generated from DNSPolicy.
-                      Duplicated search paths will be removed.
                     items:
                       type: string
                     type: array
                     x-kubernetes-list-type: atomic
                 type: object
               dnsPolicy:
-                description: DNSPolicy sets DNS policy for the pod
                 type: string
               extraArgs:
                 additionalProperties:
                   type: string
-                description: |-
-                  ExtraArgs that will be passed to the application container
-                  for example remoteWrite.tmpDataPath: /tmp
                 type: object
               extraEnvs:
-                description: ExtraEnvs that will be passed to the application container
                 items:
-                  description: EnvVar represents an environment variable present in
-                    a Container.
                   properties:
                     name:
-                      description: Name of the environment variable. Must be a C_IDENTIFIER.
                       type: string
                     value:
-                      description: |-
-                        Variable references $(VAR_NAME) are expanded
-                        using the previously defined environment variables in the container and
-                        any service environment variables. If a variable cannot be resolved,
-                        the reference in the input string will be unchanged. Double $$ are reduced
-                        to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                        "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                        Escaped references will never be expanded, regardless of whether the variable
-                        exists or not.
-                        Defaults to "".
                       type: string
                   required:
                   - name
@@ -171,175 +3367,121 @@ spec:
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               extraEnvsFrom:
-                description: |-
-                  ExtraEnvsFrom defines source of env variables for the application container
-                  could either be secret or configmap
                 items:
-                  description: EnvFromSource represents the source of a set of ConfigMaps
                   properties:
                     configMapRef:
-                      description: The ConfigMap to select from
                       properties:
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the ConfigMap must be defined
                           type: boolean
                       type: object
                       x-kubernetes-map-type: atomic
                     prefix:
-                      description: An optional identifier to prepend to each key in
-                        the ConfigMap. Must be a C_IDENTIFIER.
                       type: string
                     secretRef:
-                      description: The Secret to select from
                       properties:
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the Secret must be defined
                           type: boolean
                       type: object
                       x-kubernetes-map-type: atomic
                   type: object
                 type: array
               futureRetention:
-                description: |-
-                  FutureRetention for the stored logs
-                  Log entries with timestamps bigger than now+futureRetention are rejected during data ingestion; see https://docs.victoriametrics.com/victorialogs/#retention
+                pattern: ^[0-9]+(h|d|y)?$
                 type: string
               host_aliases:
-                description: |-
-                  HostAliasesUnderScore provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
-                  Has Priority over hostAliases field
                 items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
                   properties:
                     hostnames:
-                      description: Hostnames for the above IP address.
                       items:
                         type: string
                       type: array
                       x-kubernetes-list-type: atomic
                     ip:
-                      description: IP address of the host file entry.
                       type: string
                   required:
                   - ip
                   type: object
                 type: array
               hostAliases:
-                description: |-
-                  HostAliases provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
                 items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
                   properties:
                     hostnames:
-                      description: Hostnames for the above IP address.
                       items:
                         type: string
                       type: array
                       x-kubernetes-list-type: atomic
                     ip:
-                      description: IP address of the host file entry.
                       type: string
                   required:
                   - ip
                   type: object
                 type: array
               hostNetwork:
-                description: HostNetwork controls whether the pod may use the node
-                  network namespace
                 type: boolean
               image:
-                description: |-
-                  Image - docker image settings
-                  if no specified operator uses default version from operator config
                 properties:
                   pullPolicy:
-                    description: PullPolicy describes how to pull docker image
                     type: string
                   repository:
-                    description: Repository contains name of docker image + it's repository
-                      if needed
                     type: string
                   tag:
-                    description: Tag contains desired docker image version
                     type: string
                 type: object
               imagePullSecrets:
-                description: |-
-                  ImagePullSecrets An optional list of references to secrets in the same namespace
-                  to use for pulling images from registries
-                  see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
                 items:
-                  description: |-
-                    LocalObjectReference contains enough information to let you locate the
-                    referenced object inside the same namespace.
                   properties:
                     name:
                       default: ""
-                      description: |-
-                        Name of the referent.
-                        This field is effectively required, but due to backwards compatibility is
-                        allowed to be empty. Instances of this type with an empty value here are
-                        almost certainly wrong.
-                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                       type: string
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
               initContainers:
-                description: |-
-                  InitContainers allows adding initContainers to the pod definition.
-                  Any errors during the execution of an initContainer will lead to a restart of the Pod.
-                  More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
                 items:
-                  description: A single application container that you want to run
-                    within a pod.
                   required:
                   - name
                   type: object
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
+              license:
+                properties:
+                  forceOffline:
+                    type: boolean
+                  key:
+                    type: string
+                  keyRef:
+                    properties:
+                      key:
+                        type: string
+                      name:
+                        default: ""
+                        type: string
+                      optional:
+                        type: boolean
+                    required:
+                    - key
+                    type: object
+                    x-kubernetes-map-type: atomic
+                  reloadInterval:
+                    type: string
+                type: object
               livenessProbe:
-                description: LivenessProbe that will be added CRD pod
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               logFormat:
-                description: LogFormat for VLogs to be configured with.
                 enum:
                 - default
                 - json
                 type: string
               logIngestedRows:
-                description: Whether to log all the ingested log entries; this can
-                  be useful for debugging of data ingestion; see https://docs.victoriametrics.com/victorialogs/data-ingestion/
                 type: boolean
               logLevel:
-                description: LogLevel for VictoriaLogs to be configured with.
                 enum:
                 - INFO
                 - WARN
@@ -348,144 +3490,67 @@ spec:
                 - PANIC
                 type: string
               logNewStreams:
-                description: LogNewStreams Whether to log creation of new streams;
-                  this can be useful for debugging of high cardinality issues with
-                  log streams; see https://docs.victoriametrics.com/victorialogs/keyconcepts/#stream-fields
                 type: boolean
               managedMetadata:
-                description: |-
-                  ManagedMetadata defines metadata that will be added to the all objects
-                  created by operator for the given CustomResource
                 properties:
                   annotations:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                     type: object
                   labels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                     type: object
                 type: object
               minReadySeconds:
-                description: |-
-                  MinReadySeconds defines a minimum number of seconds to wait before starting update next pod
-                  if previous in healthy state
-                  Has no effect for VLogs and VMSingle
                 format: int32
                 type: integer
               nodeSelector:
                 additionalProperties:
                   type: string
-                description: NodeSelector Define which Nodes the Pods are scheduled
-                  on.
                 type: object
               paused:
-                description: |-
-                  Paused If set to true all actions on the underlying managed objects are not
-                  going to be performed, except for delete actions.
                 type: boolean
               podMetadata:
-                description: PodMetadata configures Labels and Annotations which are
-                  propagated to the VLogs pods.
                 properties:
                   annotations:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                     type: object
                   labels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects. May match selectors of replication controllers
-                      and services.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                     type: object
                   name:
-                    description: |-
-                      Name must be unique within a namespace. Is required when creating resources, although
-                      some resources may allow a client to request the generation of an appropriate name
-                      automatically. Name is primarily intended for creation idempotence and configuration
-                      definition.
-                      Cannot be updated.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                     type: string
                 type: object
               port:
-                description: Port listen address
                 type: string
               priorityClassName:
-                description: PriorityClassName class assigned to the Pods
                 type: string
               readinessGates:
-                description: ReadinessGates defines pod readiness gates
                 items:
-                  description: PodReadinessGate contains the reference to a pod condition
                   properties:
                     conditionType:
-                      description: ConditionType refers to a condition in the pod's
-                        condition list with matching type.
                       type: string
                   required:
                   - conditionType
                   type: object
                 type: array
               readinessProbe:
-                description: ReadinessProbe that will be added CRD pod
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
-              removePvcAfterDelete:
-                description: |-
-                  RemovePvcAfterDelete - if true, controller adds ownership to pvc
-                  and after VLogs object deletion - pvc will be garbage collected
-                  by controller manager
-                type: boolean
               replicaCount:
-                description: ReplicaCount is the expected size of the Application.
                 format: int32
                 type: integer
               resources:
-                description: |-
-                  Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
                 properties:
                   claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
                     items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
                       properties:
                         name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
                           type: string
                         request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
                           type: string
                       required:
                       - name
@@ -501,9 +3566,6 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                   requests:
                     additionalProperties:
@@ -512,145 +3574,74 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                 type: object
+              retentionMaxDiskSpaceUsageBytes:
+                type: string
               retentionPeriod:
-                description: RetentionPeriod for the stored logs
+                pattern: ^[0-9]+(h|d|w|y)?$
                 type: string
               revisionHistoryLimitCount:
-                description: |-
-                  The number of old ReplicaSets to retain to allow rollback in deployment or
-                  maximum number of revisions that will be maintained in the Deployment revision history.
-                  Has no effect at StatefulSets
-                  Defaults to 10.
                 format: int32
                 type: integer
               runtimeClassName:
-                description: |-
-                  RuntimeClassName - defines runtime class for kubernetes pod.
-                  https://kubernetes.io/docs/concepts/containers/runtime-class/
                 type: string
               schedulerName:
-                description: SchedulerName - defines kubernetes scheduler name
                 type: string
               secrets:
-                description: |-
-                  Secrets is a list of Secrets in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/secrets/SECRET_NAME folder
                 items:
                   type: string
                 type: array
               securityContext:
-                description: |-
-                  SecurityContext holds pod-level security attributes and common container settings.
-                  This defaults to the default PodSecurityContext.
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               serviceAccountName:
-                description: ServiceAccountName is the name of the ServiceAccount
-                  to use to run the pods
                 type: string
               serviceScrapeSpec:
-                description: ServiceScrapeSpec that will be added to vlogs VMServiceScrape
-                  spec
                 required:
                 - endpoints
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               serviceSpec:
-                description: ServiceSpec that will be added to vlogs service spec
                 properties:
                   metadata:
-                    description: EmbeddedObjectMetadata defines objectMeta for additional
-                      service.
                     properties:
                       annotations:
                         additionalProperties:
                           type: string
-                        description: |-
-                          Annotations is an unstructured key value map stored with a resource that may be
-                          set by external tools to store and retrieve arbitrary metadata. They are not
-                          queryable and should be preserved when modifying objects.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                         type: object
                       labels:
                         additionalProperties:
                           type: string
-                        description: |-
-                          Labels Map of string keys and values that can be used to organize and categorize
-                          (scope and select) objects. May match selectors of replication controllers
-                          and services.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                         type: object
                       name:
-                        description: |-
-                          Name must be unique within a namespace. Is required when creating resources, although
-                          some resources may allow a client to request the generation of an appropriate name
-                          automatically. Name is primarily intended for creation idempotence and configuration
-                          definition.
-                          Cannot be updated.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                         type: string
                     type: object
                   spec:
-                    description: |-
-                      ServiceSpec describes the attributes that a user creates on a service.
-                      More info: https://kubernetes.io/docs/concepts/services-networking/service/
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   useAsDefault:
-                    description: |-
-                      UseAsDefault applies changes from given service definition to the main object Service
-                      Changing from headless service to clusterIP or loadbalancer may break cross-component communication
                     type: boolean
                 required:
                 - spec
                 type: object
               startupProbe:
-                description: StartupProbe that will be added to CRD pod
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               storage:
-                description: |-
-                  Storage is the definition of how storage will be used by the VLogs
-                  by default it`s empty dir
                 properties:
                   accessModes:
-                    description: |-
-                      accessModes contains the desired access modes the volume should have.
-                      More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
                     items:
                       type: string
                     type: array
                     x-kubernetes-list-type: atomic
                   dataSource:
-                    description: |-
-                      dataSource field can be used to specify either:
-                      * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
-                      * An existing PVC (PersistentVolumeClaim)
-                      If the provisioner or an external controller can support the specified data source,
-                      it will create a new volume based on the contents of the specified data source.
-                      When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-                      and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
-                      If the namespace is specified, then dataSourceRef will not be copied to dataSource.
                     properties:
                       apiGroup:
-                        description: |-
-                          APIGroup is the group for the resource being referenced.
-                          If APIGroup is not specified, the specified Kind must be in the core API group.
-                          For any other third-party types, APIGroup is required.
                         type: string
                       kind:
-                        description: Kind is the type of resource being referenced
                         type: string
                       name:
-                        description: Name is the name of resource being referenced
                         type: string
                     required:
                     - kind
@@ -658,60 +3649,20 @@ spec:
                     type: object
                     x-kubernetes-map-type: atomic
                   dataSourceRef:
-                    description: |-
-                      dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
-                      volume is desired. This may be any object from a non-empty API group (non
-                      core object) or a PersistentVolumeClaim object.
-                      When this field is specified, volume binding will only succeed if the type of
-                      the specified object matches some installed volume populator or dynamic
-                      provisioner.
-                      This field will replace the functionality of the dataSource field and as such
-                      if both fields are non-empty, they must have the same value. For backwards
-                      compatibility, when namespace isn't specified in dataSourceRef,
-                      both fields (dataSource and dataSourceRef) will be set to the same
-                      value automatically if one of them is empty and the other is non-empty.
-                      When namespace is specified in dataSourceRef,
-                      dataSource isn't set to the same value and must be empty.
-                      There are three important differences between dataSource and dataSourceRef:
-                      * While dataSource only allows two specific types of objects, dataSourceRef
-                        allows any non-core object, as well as PersistentVolumeClaim objects.
-                      * While dataSource ignores disallowed values (dropping them), dataSourceRef
-                        preserves all values, and generates an error if a disallowed value is
-                        specified.
-                      * While dataSource only allows local objects, dataSourceRef allows objects
-                        in any namespaces.
-                      (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
-                      (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
                     properties:
                       apiGroup:
-                        description: |-
-                          APIGroup is the group for the resource being referenced.
-                          If APIGroup is not specified, the specified Kind must be in the core API group.
-                          For any other third-party types, APIGroup is required.
                         type: string
                       kind:
-                        description: Kind is the type of resource being referenced
                         type: string
                       name:
-                        description: Name is the name of resource being referenced
                         type: string
                       namespace:
-                        description: |-
-                          Namespace is the namespace of resource being referenced
-                          Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
-                          (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
                         type: string
                     required:
                     - kind
                     - name
                     type: object
                   resources:
-                    description: |-
-                      resources represents the minimum resources the volume should have.
-                      If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
-                      that are lower than previous value but must still be higher than capacity recorded in the
-                      status field of the claim.
-                      More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
                     properties:
                       limits:
                         additionalProperties:
@@ -720,9 +3671,6 @@ spec:
                           - type: string
                           pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                           x-kubernetes-int-or-string: true
-                        description: |-
-                          Limits describes the maximum amount of compute resources allowed.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                         type: object
                       requests:
                         additionalProperties:
@@ -731,40 +3679,18 @@ spec:
                           - type: string
                           pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                           x-kubernetes-int-or-string: true
-                        description: |-
-                          Requests describes the minimum amount of compute resources required.
-                          If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                          otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                         type: object
                     type: object
                   selector:
-                    description: selector is a label query over volumes to consider
-                      for binding.
                     properties:
                       matchExpressions:
-                        description: matchExpressions is a list of label selector
-                          requirements. The requirements are ANDed.
                         items:
-                          description: |-
-                            A label selector requirement is a selector that contains values, a key, and an operator that
-                            relates the key and values.
                           properties:
                             key:
-                              description: key is the label key that the selector
-                                applies to.
                               type: string
                             operator:
-                              description: |-
-                                operator represents a key's relationship to a set of values.
-                                Valid operators are In, NotIn, Exists and DoesNotExist.
                               type: string
                             values:
-                              description: |-
-                                values is an array of string values. If the operator is In or NotIn,
-                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                the values array must be empty. This array is replaced during a strategic
-                                merge patch.
                               items:
                                 type: string
                               type: array
@@ -778,133 +3704,132 @@ spec:
                       matchLabels:
                         additionalProperties:
                           type: string
-                        description: |-
-                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                          operator is "In", and the values array contains only "value". The requirements are ANDed.
                         type: object
                     type: object
                     x-kubernetes-map-type: atomic
                   storageClassName:
-                    description: |-
-                      storageClassName is the name of the StorageClass required by the claim.
-                      More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
                     type: string
                   volumeAttributesClassName:
-                    description: |-
-                      volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
-                      If specified, the CSI driver will create or update the volume with the attributes defined
-                      in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                      it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                      will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                      If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                      will be set by the persistentvolume controller if it exists.
-                      If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
-                      set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
-                      exists.
-                      More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                      (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                     type: string
                   volumeMode:
-                    description: |-
-                      volumeMode defines what type of volume is required by the claim.
-                      Value of Filesystem is implied when not included in claim spec.
                     type: string
                   volumeName:
-                    description: volumeName is the binding reference to the PersistentVolume
-                      backing this claim.
                     type: string
                 type: object
               storageDataPath:
-                description: |-
-                  StorageDataPath disables spec.storage option and overrides arg for victoria-logs binary --storageDataPath,
-                  its users responsibility to mount proper device into given path.
                 type: string
               storageMetadata:
-                description: StorageMeta defines annotations and labels attached to
-                  PVC for given vlogs CR
                 properties:
                   annotations:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                     type: object
                   labels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects. May match selectors of replication controllers
-                      and services.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                     type: object
                   name:
-                    description: |-
-                      Name must be unique within a namespace. Is required when creating resources, although
-                      some resources may allow a client to request the generation of an appropriate name
-                      automatically. Name is primarily intended for creation idempotence and configuration
-                      definition.
-                      Cannot be updated.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                     type: string
                 type: object
+              syslogSpec:
+                properties:
+                  tcpListeners:
+                    items:
+                      properties:
+                        compressMethod:
+                          pattern: ^(none|zstd|gzip|deflate)$
+                          type: string
+                        decolorizeFields:
+                          type: string
+                        ignoreFields:
+                          type: string
+                        listenPort:
+                          format: int32
+                          type: integer
+                        streamFields:
+                          type: string
+                        tenantID:
+                          type: string
+                        tlsConfig:
+                          properties:
+                            certFile:
+                              type: string
+                            certSecret:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            keyFile:
+                              type: string
+                            keySecret:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                          type: object
+                      required:
+                      - listenPort
+                      type: object
+                    type: array
+                  udpListeners:
+                    items:
+                      properties:
+                        compressMethod:
+                          pattern: ^(none|zstd|gzip|deflate)$
+                          type: string
+                        decolorizeFields:
+                          type: string
+                        ignoreFields:
+                          type: string
+                        listenPort:
+                          format: int32
+                          type: integer
+                        streamFields:
+                          type: string
+                        tenantID:
+                          type: string
+                      required:
+                      - listenPort
+                      type: object
+                    type: array
+                type: object
               terminationGracePeriodSeconds:
-                description: TerminationGracePeriodSeconds period for container graceful
-                  termination
                 format: int64
                 type: integer
               tolerations:
-                description: Tolerations If specified, the pod's tolerations.
                 items:
-                  description: |-
-                    The pod this Toleration is attached to tolerates any taint that matches
-                    the triple <key,value,effect> using the matching operator <operator>.
                   properties:
                     effect:
-                      description: |-
-                        Effect indicates the taint effect to match. Empty means match all taint effects.
-                        When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                       type: string
                     key:
-                      description: |-
-                        Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                        If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                       type: string
                     operator:
-                      description: |-
-                        Operator represents a key's relationship to the value.
-                        Valid operators are Exists and Equal. Defaults to Equal.
-                        Exists is equivalent to wildcard for value, so that a pod can
-                        tolerate all taints of a particular category.
                       type: string
                     tolerationSeconds:
-                      description: |-
-                        TolerationSeconds represents the period of time the toleration (which must be
-                        of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                        it is not set, which means tolerate the taint forever (do not evict). Zero and
-                        negative values will be treated as 0 (evict immediately) by the system.
                       format: int64
                       type: integer
                     value:
-                      description: |-
-                        Value is the taint value the toleration matches to.
-                        If the operator is Exists, the value should be empty, otherwise just a regular string.
                       type: string
                   type: object
                 type: array
               topologySpreadConstraints:
-                description: |-
-                  TopologySpreadConstraints embedded kubernetes pod configuration option,
-                  controls how pods are spread across your cluster among failure-domains
-                  such as regions, zones, nodes, and other user-defined topology domains
-                  https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
                 items:
-                  description: TopologySpreadConstraint specifies how to spread matching
-                    pods among the given topology.
                   required:
                   - maxSkew
                   - topologyKey
@@ -913,77 +3838,25 @@ spec:
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               useDefaultResources:
-                description: |-
-                  UseDefaultResources controls resource settings
-                  By default, operator sets built-in resource requirements
                 type: boolean
               useStrictSecurity:
-                description: |-
-                  UseStrictSecurity enables strict security mode for component
-                  it restricts disk writes access
-                  uses non-root user out of the box
-                  drops not needed security permissions
                 type: boolean
               volumeMounts:
-                description: |-
-                  VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
-                  VolumeMounts specified will be appended to other VolumeMounts in the Application container
                 items:
-                  description: VolumeMount describes a mounting of a Volume within
-                    a container.
                   properties:
                     mountPath:
-                      description: |-
-                        Path within the container at which the volume should be mounted.  Must
-                        not contain ':'.
                       type: string
                     mountPropagation:
-                      description: |-
-                        mountPropagation determines how mounts are propagated from the host
-                        to container and the other way around.
-                        When not set, MountPropagationNone is used.
-                        This field is beta in 1.10.
-                        When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                        (which defaults to None).
                       type: string
                     name:
-                      description: This must match the Name of a Volume.
                       type: string
                     readOnly:
-                      description: |-
-                        Mounted read-only if true, read-write otherwise (false or unspecified).
-                        Defaults to false.
                       type: boolean
                     recursiveReadOnly:
-                      description: |-
-                        RecursiveReadOnly specifies whether read-only mounts should be handled
-                        recursively.
-
-                        If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                        If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                        recursively read-only.  If this field is set to IfPossible, the mount is made
-                        recursively read-only, if it is supported by the container runtime.  If this
-                        field is set to Enabled, the mount is made recursively read-only if it is
-                        supported by the container runtime, otherwise the pod will not be started and
-                        an error will be generated to indicate the reason.
-
-                        If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                        None (or be unspecified, which defaults to None).
-
-                        If this field is not specified, it is treated as an equivalent of Disabled.
                       type: string
                     subPath:
-                      description: |-
-                        Path within the volume from which the container's volume should be mounted.
-                        Defaults to "" (volume's root).
                       type: string
                     subPathExpr:
-                      description: |-
-                        Expanded path within the volume from which the container's volume should be mounted.
-                        Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                        Defaults to "" (volume's root).
-                        SubPathExpr and SubPath are mutually exclusive.
                       type: string
                   required:
                   - mountPath
@@ -991,74 +3864,42 @@ spec:
                   type: object
                 type: array
               volumes:
-                description: |-
-                  Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
-                  Volumes specified will be appended to other volumes that are generated.
-                  / +optional
                 items:
-                  description: Volume represents a named volume in a pod that may
-                    be accessed by any container in the pod.
                   required:
                   - name
                   type: object
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
-            required:
-            - retentionPeriod
             type: object
           status:
-            description: VLogsStatus defines the observed state of VLogs
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -1073,16 +3914,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -1095,7 +3931,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmagents.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -1125,170 +3961,78 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: |-
-          VMAgent - is a tiny but brave agent, which helps you collect metrics from various sources and stores them in VictoriaMetrics
-          or any other Prometheus-compatible storage system that supports the remote_write protocol.
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMAgentSpec defines the desired state of VMAgent
             properties:
-              aPIServerConfig:
-                description: |-
-                  APIServerConfig allows specifying a host and auth methods to access apiserver.
-                  If left empty, VMAgent is assumed to run inside of the cluster
-                  and will discover API servers automatically and use the pod's CA certificate
-                  and bearer token file at /var/run/secrets/kubernetes.io/serviceaccount/.
-                  aPIServerConfig is deprecated use apiServerConfig instead
-                required:
-                - host
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
               additionalScrapeConfigs:
-                description: |-
-                  AdditionalScrapeConfigs As scrape configs are appended, the user is responsible to make sure it
-                  is valid. Note that using this feature may expose the possibility to
-                  break upgrades of VMAgent. It is advised to review VMAgent release
-                  notes to ensure that no incompatible scrape configs are going to break
-                  VMAgent after the upgrade.
                 properties:
                   key:
-                    description: The key of the secret to select from.  Must be a
-                      valid secret key.
                     type: string
                   name:
                     default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                     type: string
                   optional:
-                    description: Specify whether the Secret or its key must be defined
                     type: boolean
                 required:
                 - key
                 type: object
                 x-kubernetes-map-type: atomic
               affinity:
-                description: Affinity If specified, the pod's scheduling constraints.
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               apiServerConfig:
-                description: |-
-                  APIServerConfig allows specifying a host and auth methods to access apiserver.
-                  If left empty, VMAgent is assumed to run inside of the cluster
-                  and will discover API servers automatically and use the pod's CA certificate
-                  and bearer token file at /var/run/secrets/kubernetes.io/serviceaccount/.
                 properties:
                   authorization:
-                    description: Authorization configures generic authorization params
                     properties:
                       credentials:
-                        description: Reference to the secret with value for authorization
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       credentialsFile:
-                        description: File with value for authorization
                         type: string
                       type:
-                        description: Type of authorization, default to bearer
                         type: string
                     type: object
                   basicAuth:
-                    description: BasicAuth allow an endpoint to authenticate over
-                      basic authentication
                     properties:
                       password:
-                        description: |-
-                          Password defines reference for secret with password value
-                          The secret needs to be in the same namespace as scrape object
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       password_file:
-                        description: |-
-                          PasswordFile defines path to password file at disk
-                          must be pre-mounted
                         type: string
                       username:
-                        description: |-
-                          Username defines reference for secret with username value
-                          The secret needs to be in the same namespace as scrape object
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
@@ -1296,66 +4040,36 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                   bearerToken:
-                    description: Bearer token for accessing apiserver.
                     type: string
                   bearerTokenFile:
-                    description: File to read bearer token for accessing apiserver.
                     type: string
                   host:
-                    description: |-
-                      Host of apiserver.
-                      A valid string consisting of a hostname or IP followed by an optional port number
                     type: string
                   tlsConfig:
-                    description: TLSConfig Config to use for accessing apiserver.
                     properties:
                       ca:
-                        description: Struct containing the CA cert to use for the
-                          targets.
                         properties:
                           configMap:
-                            description: ConfigMap containing data to use for the
-                              targets.
                             properties:
                               key:
-                                description: The key to select.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the ConfigMap or its
-                                  key must be defined
                                 type: boolean
                             required:
                             - key
                             type: object
                             x-kubernetes-map-type: atomic
                           secret:
-                            description: Secret containing data to use for the targets.
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
@@ -1363,56 +4077,30 @@ spec:
                             x-kubernetes-map-type: atomic
                         type: object
                       caFile:
-                        description: Path to the CA cert in the container to use for
-                          the targets.
                         type: string
                       cert:
-                        description: Struct containing the client cert file for the
-                          targets.
                         properties:
                           configMap:
-                            description: ConfigMap containing data to use for the
-                              targets.
                             properties:
                               key:
-                                description: The key to select.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the ConfigMap or its
-                                  key must be defined
                                 type: boolean
                             required:
                             - key
                             type: object
                             x-kubernetes-map-type: atomic
                           secret:
-                            description: Secret containing data to use for the targets.
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
@@ -1420,120 +4108,59 @@ spec:
                             x-kubernetes-map-type: atomic
                         type: object
                       certFile:
-                        description: Path to the client cert file in the container
-                          for the targets.
                         type: string
                       insecureSkipVerify:
-                        description: Disable target certificate validation.
                         type: boolean
                       keyFile:
-                        description: Path to the client key file in the container
-                          for the targets.
                         type: string
                       keySecret:
-                        description: Secret containing the client key file for the
-                          targets.
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       serverName:
-                        description: Used to verify the hostname for the targets.
                         type: string
                     type: object
                 required:
                 - host
                 type: object
               arbitraryFSAccessThroughSMs:
-                description: |-
-                  ArbitraryFSAccessThroughSMs configures whether configuration
-                  based on EndpointAuth can access arbitrary files on the file system
-                  of the VMAgent container e.g. bearer token files, basic auth, tls certs
                 properties:
                   deny:
                     type: boolean
                 type: object
               claimTemplates:
-                description: ClaimTemplates allows adding additional VolumeClaimTemplates
-                  for VMAgent in StatefulMode
                 items:
-                  description: PersistentVolumeClaim is a user's request for and claim
-                    to a persistent volume
                   properties:
                     apiVersion:
-                      description: |-
-                        APIVersion defines the versioned schema of this representation of an object.
-                        Servers should convert recognized schemas to the latest internal value, and
-                        may reject unrecognized values.
-                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
                       type: string
                     kind:
-                      description: |-
-                        Kind is a string value representing the REST resource this object represents.
-                        Servers may infer this from the endpoint the client submits requests to.
-                        Cannot be updated.
-                        In CamelCase.
-                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
                       type: string
                     metadata:
-                      description: |-
-                        Standard object's metadata.
-                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
                       type: object
                       x-kubernetes-preserve-unknown-fields: true
                     spec:
-                      description: |-
-                        spec defines the desired characteristics of a volume requested by a pod author.
-                        More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
                       properties:
                         accessModes:
-                          description: |-
-                            accessModes contains the desired access modes the volume should have.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
                           items:
                             type: string
                           type: array
                           x-kubernetes-list-type: atomic
                         dataSource:
-                          description: |-
-                            dataSource field can be used to specify either:
-                            * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
-                            * An existing PVC (PersistentVolumeClaim)
-                            If the provisioner or an external controller can support the specified data source,
-                            it will create a new volume based on the contents of the specified data source.
-                            When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-                            and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
-                            If the namespace is specified, then dataSourceRef will not be copied to dataSource.
                           properties:
                             apiGroup:
-                              description: |-
-                                APIGroup is the group for the resource being referenced.
-                                If APIGroup is not specified, the specified Kind must be in the core API group.
-                                For any other third-party types, APIGroup is required.
                               type: string
                             kind:
-                              description: Kind is the type of resource being referenced
                               type: string
                             name:
-                              description: Name is the name of resource being referenced
                               type: string
                           required:
                           - kind
@@ -1541,60 +4168,20 @@ spec:
                           type: object
                           x-kubernetes-map-type: atomic
                         dataSourceRef:
-                          description: |-
-                            dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
-                            volume is desired. This may be any object from a non-empty API group (non
-                            core object) or a PersistentVolumeClaim object.
-                            When this field is specified, volume binding will only succeed if the type of
-                            the specified object matches some installed volume populator or dynamic
-                            provisioner.
-                            This field will replace the functionality of the dataSource field and as such
-                            if both fields are non-empty, they must have the same value. For backwards
-                            compatibility, when namespace isn't specified in dataSourceRef,
-                            both fields (dataSource and dataSourceRef) will be set to the same
-                            value automatically if one of them is empty and the other is non-empty.
-                            When namespace is specified in dataSourceRef,
-                            dataSource isn't set to the same value and must be empty.
-                            There are three important differences between dataSource and dataSourceRef:
-                            * While dataSource only allows two specific types of objects, dataSourceRef
-                              allows any non-core object, as well as PersistentVolumeClaim objects.
-                            * While dataSource ignores disallowed values (dropping them), dataSourceRef
-                              preserves all values, and generates an error if a disallowed value is
-                              specified.
-                            * While dataSource only allows local objects, dataSourceRef allows objects
-                              in any namespaces.
-                            (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
-                            (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
                           properties:
                             apiGroup:
-                              description: |-
-                                APIGroup is the group for the resource being referenced.
-                                If APIGroup is not specified, the specified Kind must be in the core API group.
-                                For any other third-party types, APIGroup is required.
                               type: string
                             kind:
-                              description: Kind is the type of resource being referenced
                               type: string
                             name:
-                              description: Name is the name of resource being referenced
                               type: string
                             namespace:
-                              description: |-
-                                Namespace is the namespace of resource being referenced
-                                Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
-                                (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
                               type: string
                           required:
                           - kind
                           - name
                           type: object
                         resources:
-                          description: |-
-                            resources represents the minimum resources the volume should have.
-                            If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
-                            that are lower than previous value but must still be higher than capacity recorded in the
-                            status field of the claim.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
                           properties:
                             limits:
                               additionalProperties:
@@ -1603,9 +4190,6 @@ spec:
                                 - type: string
                                 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                 x-kubernetes-int-or-string: true
-                              description: |-
-                                Limits describes the maximum amount of compute resources allowed.
-                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                               type: object
                             requests:
                               additionalProperties:
@@ -1614,40 +4198,18 @@ spec:
                                 - type: string
                                 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                 x-kubernetes-int-or-string: true
-                              description: |-
-                                Requests describes the minimum amount of compute resources required.
-                                If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                                otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                               type: object
                           type: object
                         selector:
-                          description: selector is a label query over volumes to consider
-                            for binding.
                           properties:
                             matchExpressions:
-                              description: matchExpressions is a list of label selector
-                                requirements. The requirements are ANDed.
                               items:
-                                description: |-
-                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                  relates the key and values.
                                 properties:
                                   key:
-                                    description: key is the label key that the selector
-                                      applies to.
                                     type: string
                                   operator:
-                                    description: |-
-                                      operator represents a key's relationship to a set of values.
-                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                     type: string
                                   values:
-                                    description: |-
-                                      values is an array of string values. If the operator is In or NotIn,
-                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                      the values array must be empty. This array is replaced during a strategic
-                                      merge patch.
                                     items:
                                       type: string
                                     type: array
@@ -1661,99 +4223,28 @@ spec:
                             matchLabels:
                               additionalProperties:
                                 type: string
-                              description: |-
-                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                               type: object
                           type: object
                           x-kubernetes-map-type: atomic
                         storageClassName:
-                          description: |-
-                            storageClassName is the name of the StorageClass required by the claim.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
                           type: string
                         volumeAttributesClassName:
-                          description: |-
-                            volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
-                            If specified, the CSI driver will create or update the volume with the attributes defined
-                            in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                            it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                            will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                            If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                            will be set by the persistentvolume controller if it exists.
-                            If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
-                            set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
-                            exists.
-                            More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                            (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                           type: string
                         volumeMode:
-                          description: |-
-                            volumeMode defines what type of volume is required by the claim.
-                            Value of Filesystem is implied when not included in claim spec.
                           type: string
                         volumeName:
-                          description: volumeName is the binding reference to the
-                            PersistentVolume backing this claim.
                           type: string
                       type: object
                     status:
-                      description: |-
-                        status represents the current information/status of a persistent volume claim.
-                        Read-only.
-                        More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
                       properties:
                         accessModes:
-                          description: |-
-                            accessModes contains the actual access modes the volume backing the PVC has.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
                           items:
                             type: string
                           type: array
                           x-kubernetes-list-type: atomic
                         allocatedResourceStatuses:
                           additionalProperties:
-                            description: |-
-                              When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource
-                              that it does not recognizes, then it should ignore that update and let other controllers
-                              handle it.
                             type: string
-                          description: "allocatedResourceStatuses stores status of
-                            resource being resized for the given PVC.\nKey names follow
-                            standard Kubernetes label syntax. Valid values are either:\n\t*
-                            Un-prefixed keys:\n\t\t- storage - the capacity of the
-                            volume.\n\t* Custom resources must use implementation-defined
-                            prefixed names such as \"example.com/my-custom-resource\"\nApart
-                            from above values - keys that are unprefixed or have kubernetes.io
-                            prefix are considered\nreserved and hence may not be used.\n\nClaimResourceStatus
-                            can be in any of following states:\n\t- ControllerResizeInProgress:\n\t\tState
-                            set when resize controller starts resizing the volume
-                            in control-plane.\n\t- ControllerResizeFailed:\n\t\tState
-                            set when resize has failed in resize controller with a
-                            terminal error.\n\t- NodeResizePending:\n\t\tState set
-                            when resize controller has finished resizing the volume
-                            but further resizing of\n\t\tvolume is needed on the node.\n\t-
-                            NodeResizeInProgress:\n\t\tState set when kubelet starts
-                            resizing the volume.\n\t- NodeResizeFailed:\n\t\tState
-                            set when resizing has failed in kubelet with a terminal
-                            error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor
-                            example: if expanding a PVC for more capacity - this field
-                            can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage']
-                            = \"ControllerResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                            = \"ControllerResizeFailed\"\n     - pvc.status.allocatedResourceStatus['storage']
-                            = \"NodeResizePending\"\n     - pvc.status.allocatedResourceStatus['storage']
-                            = \"NodeResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                            = \"NodeResizeFailed\"\nWhen this field is not set, it
-                            means that no resize operation is in progress for the
-                            given PVC.\n\nA controller that receives PVC update with
-                            previously unknown resourceName or ClaimResourceStatus\nshould
-                            ignore the update for the purpose it was designed. For
-                            example - a controller that\nonly is responsible for resizing
-                            capacity of the volume, should ignore PVC updates that
-                            change other valid\nresources associated with PVC.\n\nThis
-                            is an alpha field and requires enabling RecoverVolumeExpansionFailure
-                            feature."
                           type: object
                           x-kubernetes-map-type: granular
                         allocatedResources:
@@ -1763,30 +4254,6 @@ spec:
                             - type: string
                             pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                             x-kubernetes-int-or-string: true
-                          description: "allocatedResources tracks the resources allocated
-                            to a PVC including its capacity.\nKey names follow standard
-                            Kubernetes label syntax. Valid values are either:\n\t*
-                            Un-prefixed keys:\n\t\t- storage - the capacity of the
-                            volume.\n\t* Custom resources must use implementation-defined
-                            prefixed names such as \"example.com/my-custom-resource\"\nApart
-                            from above values - keys that are unprefixed or have kubernetes.io
-                            prefix are considered\nreserved and hence may not be used.\n\nCapacity
-                            reported here may be larger than the actual capacity when
-                            a volume expansion operation\nis requested.\nFor storage
-                            quota, the larger value from allocatedResources and PVC.spec.resources
-                            is used.\nIf allocatedResources is not set, PVC.spec.resources
-                            alone is used for quota calculation.\nIf a volume expansion
-                            capacity request is lowered, allocatedResources is only\nlowered
-                            if there are no expansion operations in progress and if
-                            the actual volume capacity\nis equal or lower than the
-                            requested capacity.\n\nA controller that receives PVC
-                            update with previously unknown resourceName\nshould ignore
-                            the update for the purpose it was designed. For example
-                            - a controller that\nonly is responsible for resizing
-                            capacity of the volume, should ignore PVC updates that
-                            change other valid\nresources associated with PVC.\n\nThis
-                            is an alpha field and requires enabling RecoverVolumeExpansionFailure
-                            feature."
                           type: object
                         capacity:
                           additionalProperties:
@@ -1795,47 +4262,23 @@ spec:
                             - type: string
                             pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                             x-kubernetes-int-or-string: true
-                          description: capacity represents the actual resources of
-                            the underlying volume.
                           type: object
                         conditions:
-                          description: |-
-                            conditions is the current Condition of persistent volume claim. If underlying persistent volume is being
-                            resized then the Condition will be set to 'Resizing'.
                           items:
-                            description: PersistentVolumeClaimCondition contains details
-                              about state of pvc
                             properties:
                               lastProbeTime:
-                                description: lastProbeTime is the time we probed the
-                                  condition.
                                 format: date-time
                                 type: string
                               lastTransitionTime:
-                                description: lastTransitionTime is the time the condition
-                                  transitioned from one status to another.
                                 format: date-time
                                 type: string
                               message:
-                                description: message is the human-readable message
-                                  indicating details about last transition.
                                 type: string
                               reason:
-                                description: |-
-                                  reason is a unique, this should be a short, machine understandable string that gives the reason
-                                  for condition's last transition. If it reports "Resizing" that means the underlying
-                                  persistent volume is being resized.
                                 type: string
                               status:
-                                description: |-
-                                  Status is the status of the condition.
-                                  Can be True, False, Unknown.
-                                  More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required
                                 type: string
                               type:
-                                description: |-
-                                  Type is the type of the condition.
-                                  More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about
                                 type: string
                             required:
                             - status
@@ -1846,92 +4289,54 @@ spec:
                           - type
                           x-kubernetes-list-type: map
                         currentVolumeAttributesClassName:
-                          description: |-
-                            currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
-                            When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                            This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                           type: string
                         modifyVolumeStatus:
-                          description: |-
-                            ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
-                            When this is unset, there is no ModifyVolume operation being attempted.
-                            This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                           properties:
                             status:
-                              description: "status is the status of the ControllerModifyVolume
-                                operation. It can be in any of following states:\n
-                                - Pending\n   Pending indicates that the PersistentVolumeClaim
-                                cannot be modified due to unmet requirements, such
-                                as\n   the specified VolumeAttributesClass not existing.\n
-                                - InProgress\n   InProgress indicates that the volume
-                                is being modified.\n - Infeasible\n  Infeasible indicates
-                                that the request has been rejected as invalid by the
-                                CSI driver. To\n\t  resolve the error, a valid VolumeAttributesClass
-                                needs to be specified.\nNote: New statuses can be
-                                added in the future. Consumers should check for unknown
-                                statuses and fail appropriately."
                               type: string
                             targetVolumeAttributesClassName:
-                              description: targetVolumeAttributesClassName is the
-                                name of the VolumeAttributesClass the PVC currently
-                                being reconciled
                               type: string
                           required:
                           - status
                           type: object
                         phase:
-                          description: phase represents the current phase of PersistentVolumeClaim.
                           type: string
                       type: object
                   type: object
                 type: array
               configMaps:
-                description: |-
-                  ConfigMaps is a list of ConfigMaps in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/configs/CONFIGMAP_NAME folder
                 items:
                   type: string
                 type: array
+              configReloadAuthKeySecret:
+                properties:
+                  key:
+                    type: string
+                  name:
+                    default: ""
+                    type: string
+                  optional:
+                    type: boolean
+                required:
+                - key
+                type: object
+                x-kubernetes-map-type: atomic
               configReloaderExtraArgs:
                 additionalProperties:
                   type: string
-                description: |-
-                  ConfigReloaderExtraArgs that will be passed to  VMAuths config-reloader container
-                  for example resyncInterval: "30s"
                 type: object
+              configReloaderImage:
+                type: string
               configReloaderImageTag:
-                description: ConfigReloaderImageTag defines image:tag for config-reloader
-                  container
                 type: string
               configReloaderResources:
-                description: |-
-                  ConfigReloaderResources config-reloader container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
                 properties:
                   claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
                     items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
                       properties:
                         name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
                           type: string
                         request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
                           type: string
                       required:
                       - name
@@ -1947,9 +4352,6 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                   requests:
                     additionalProperties:
@@ -1958,144 +4360,68 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                 type: object
               containers:
-                description: |-
-                  Containers property allows to inject additions sidecars or to patch existing containers.
-                  It can be useful for proxies, backup, etc.
                 items:
-                  description: A single application container that you want to run
-                    within a pod.
                   required:
                   - name
                   type: object
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               daemonSetMode:
-                description: |-
-                  DaemonSetMode enables DaemonSet deployment mode instead of Deployment.
-                  Supports only VMPodScrape
-                  (available from v0.55.0).
-                  Cannot be used with statefulMode
                 type: boolean
               disableAutomountServiceAccountToken:
-                description: |-
-                  DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
-                  Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
-                  For example, vmagent and vm-config-reloader requires k8s API access.
-                  Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
-                  And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
                 type: boolean
               disableSelfServiceScrape:
-                description: |-
-                  DisableSelfServiceScrape controls creation of VMServiceScrape by operator
-                  for the application.
-                  Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable
                 type: boolean
               dnsConfig:
-                description: |-
-                  Specifies the DNS parameters of a pod.
-                  Parameters specified here will be merged to the generated DNS
-                  configuration based on DNSPolicy.
                 items:
                   x-kubernetes-preserve-unknown-fields: true
                 properties:
                   nameservers:
-                    description: |-
-                      A list of DNS name server IP addresses.
-                      This will be appended to the base nameservers generated from DNSPolicy.
-                      Duplicated nameservers will be removed.
                     items:
                       type: string
                     type: array
                     x-kubernetes-list-type: atomic
                   options:
-                    description: |-
-                      A list of DNS resolver options.
-                      This will be merged with the base options generated from DNSPolicy.
-                      Duplicated entries will be removed. Resolution options given in Options
-                      will override those that appear in the base DNSPolicy.
                     items:
-                      description: PodDNSConfigOption defines DNS resolver options
-                        of a pod.
                       properties:
                         name:
-                          description: |-
-                            Name is this DNS resolver option's name.
-                            Required.
                           type: string
                         value:
-                          description: Value is this DNS resolver option's value.
                           type: string
                       type: object
                     type: array
                     x-kubernetes-list-type: atomic
                   searches:
-                    description: |-
-                      A list of DNS search domains for host-name lookup.
-                      This will be appended to the base search paths generated from DNSPolicy.
-                      Duplicated search paths will be removed.
                     items:
                       type: string
                     type: array
                     x-kubernetes-list-type: atomic
                 type: object
               dnsPolicy:
-                description: DNSPolicy sets DNS policy for the pod
                 type: string
               enableKubernetesAPISelectors:
-                description: |-
-                  EnableKubernetesAPISelectors instructs vmagent to use CRD scrape objects spec.selectors for
-                  Kubernetes API list and watch requests.
-                  https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#list-and-watch-filtering
-                  It could be useful to reduce Kubernetes API server resource usage for serving less than 100 CRD scrape objects in total.
                 type: boolean
               enforcedNamespaceLabel:
-                description: |-
-                  EnforcedNamespaceLabel enforces adding a namespace label of origin for each alert
-                  and metric that is user created. The label value will always be the namespace of the object that is
-                  being created.
+                type: string
+              externalLabelName:
                 type: string
               externalLabels:
                 additionalProperties:
                   type: string
-                description: |-
-                  ExternalLabels The labels to add to any time series scraped by vmagent.
-                  it doesn't affect metrics ingested directly by push API's
                 type: object
               extraArgs:
                 additionalProperties:
                   type: string
-                description: |-
-                  ExtraArgs that will be passed to the application container
-                  for example remoteWrite.tmpDataPath: /tmp
                 type: object
               extraEnvs:
-                description: ExtraEnvs that will be passed to the application container
                 items:
-                  description: EnvVar represents an environment variable present in
-                    a Container.
                   properties:
                     name:
-                      description: Name of the environment variable. Must be a C_IDENTIFIER.
                       type: string
                     value:
-                      description: |-
-                        Variable references $(VAR_NAME) are expanded
-                        using the previously defined environment variables in the container and
-                        any service environment variables. If a variable cannot be resolved,
-                        the reference in the input string will be unchanged. Double $$ are reduced
-                        to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                        "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                        Escaped references will never be expanded, regardless of whether the variable
-                        exists or not.
-                        Defaults to "".
                       type: string
                   required:
                   - name
@@ -2103,330 +4429,241 @@ spec:
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               extraEnvsFrom:
-                description: |-
-                  ExtraEnvsFrom defines source of env variables for the application container
-                  could either be secret or configmap
                 items:
-                  description: EnvFromSource represents the source of a set of ConfigMaps
                   properties:
                     configMapRef:
-                      description: The ConfigMap to select from
                       properties:
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the ConfigMap must be defined
                           type: boolean
                       type: object
                       x-kubernetes-map-type: atomic
                     prefix:
-                      description: An optional identifier to prepend to each key in
-                        the ConfigMap. Must be a C_IDENTIFIER.
                       type: string
                     secretRef:
-                      description: The Secret to select from
                       properties:
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the Secret must be defined
                           type: boolean
                       type: object
                       x-kubernetes-map-type: atomic
                   type: object
                 type: array
-              host_aliases:
-                description: |-
-                  HostAliasesUnderScore provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
-                  Has Priority over hostAliases field
+              globalScrapeMetricRelabelConfigs:
+                items:
+                  properties:
+                    action:
+                      type: string
+                    if:
+                      x-kubernetes-preserve-unknown-fields: true
+                    labels:
+                      additionalProperties:
+                        type: string
+                      type: object
+                    match:
+                      type: string
+                    modulus:
+                      format: int64
+                      type: integer
+                    regex:
+                      x-kubernetes-preserve-unknown-fields: true
+                    replacement:
+                      type: string
+                    separator:
+                      type: string
+                    source_labels:
+                      items:
+                        type: string
+                      type: array
+                    sourceLabels:
+                      items:
+                        type: string
+                      type: array
+                    target_label:
+                      type: string
+                    targetLabel:
+                      type: string
+                  type: object
+                type: array
+              globalScrapeRelabelConfigs:
+                items:
+                  properties:
+                    action:
+                      type: string
+                    if:
+                      x-kubernetes-preserve-unknown-fields: true
+                    labels:
+                      additionalProperties:
+                        type: string
+                      type: object
+                    match:
+                      type: string
+                    modulus:
+                      format: int64
+                      type: integer
+                    regex:
+                      x-kubernetes-preserve-unknown-fields: true
+                    replacement:
+                      type: string
+                    separator:
+                      type: string
+                    source_labels:
+                      items:
+                        type: string
+                      type: array
+                    sourceLabels:
+                      items:
+                        type: string
+                      type: array
+                    target_label:
+                      type: string
+                    targetLabel:
+                      type: string
+                  type: object
+                type: array
+              host_aliases:
                 items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
                   properties:
                     hostnames:
-                      description: Hostnames for the above IP address.
                       items:
                         type: string
                       type: array
                       x-kubernetes-list-type: atomic
                     ip:
-                      description: IP address of the host file entry.
                       type: string
                   required:
                   - ip
                   type: object
                 type: array
               hostAliases:
-                description: |-
-                  HostAliases provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
                 items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
                   properties:
                     hostnames:
-                      description: Hostnames for the above IP address.
                       items:
                         type: string
                       type: array
                       x-kubernetes-list-type: atomic
                     ip:
-                      description: IP address of the host file entry.
                       type: string
                   required:
                   - ip
                   type: object
                 type: array
               hostNetwork:
-                description: HostNetwork controls whether the pod may use the node
-                  network namespace
                 type: boolean
               ignoreNamespaceSelectors:
-                description: |-
-                  IgnoreNamespaceSelectors if set to true will ignore NamespaceSelector settings from
-                  scrape objects, and they will only discover endpoints
-                  within their current namespace.  Defaults to false.
                 type: boolean
               image:
-                description: |-
-                  Image - docker image settings
-                  if no specified operator uses default version from operator config
                 properties:
                   pullPolicy:
-                    description: PullPolicy describes how to pull docker image
                     type: string
                   repository:
-                    description: Repository contains name of docker image + it's repository
-                      if needed
                     type: string
                   tag:
-                    description: Tag contains desired docker image version
                     type: string
                 type: object
               imagePullSecrets:
-                description: |-
-                  ImagePullSecrets An optional list of references to secrets in the same namespace
-                  to use for pulling images from registries
-                  see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
                 items:
-                  description: |-
-                    LocalObjectReference contains enough information to let you locate the
-                    referenced object inside the same namespace.
                   properties:
                     name:
                       default: ""
-                      description: |-
-                        Name of the referent.
-                        This field is effectively required, but due to backwards compatibility is
-                        allowed to be empty. Instances of this type with an empty value here are
-                        almost certainly wrong.
-                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                       type: string
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
               ingestOnlyMode:
-                description: |-
-                  IngestOnlyMode switches vmagent into unmanaged mode
-                  it disables any config generation for scraping
-                  Currently it prevents vmagent from managing tls and auth options for remote write
                 type: boolean
               initContainers:
-                description: |-
-                  InitContainers allows adding initContainers to the pod definition.
-                  Any errors during the execution of an initContainer will lead to a restart of the Pod.
-                  More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
                 items:
-                  description: A single application container that you want to run
-                    within a pod.
                   required:
                   - name
                   type: object
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               inlineRelabelConfig:
-                description: InlineRelabelConfig - defines GlobalRelabelConfig for
-                  vmagent, can be defined directly at CRD.
                 items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
                   properties:
                     action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
                       type: string
                     if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
                       x-kubernetes-preserve-unknown-fields: true
                     labels:
                       additionalProperties:
                         type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
                       type: object
                     match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
                       type: string
                     modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
                       format: int64
                       type: integer
                     regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                       x-kubernetes-preserve-unknown-fields: true
                     replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
                       type: string
                     separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
                       type: string
                     source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       items:
                         type: string
                       type: array
                     sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
                       items:
                         type: string
                       type: array
                     target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       type: string
                     targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
                       type: string
                   type: object
                 type: array
               inlineScrapeConfig:
-                description: |-
-                  InlineScrapeConfig As scrape configs are appended, the user is responsible to make sure it
-                  is valid. Note that using this feature may expose the possibility to
-                  break upgrades of VMAgent. It is advised to review VMAgent release
-                  notes to ensure that no incompatible scrape configs are going to break
-                  VMAgent after the upgrade.
-                  it should be defined as single yaml file.
-                  inlineScrapeConfig: |
-                      - job_name: "prometheus"
-                        static_configs:
-                        - targets: ["localhost:9090"]
                 type: string
               insertPorts:
-                description: InsertPorts - additional listen ports for data ingestion.
                 properties:
                   graphitePort:
-                    description: GraphitePort listen port
                     type: string
                   influxPort:
-                    description: InfluxPort listen port
                     type: string
                   openTSDBHTTPPort:
-                    description: OpenTSDBHTTPPort for http connections.
                     type: string
                   openTSDBPort:
-                    description: OpenTSDBPort for tcp and udp listen
                     type: string
                 type: object
               license:
-                description: |-
-                  License allows to configure license key to be used for enterprise features.
-                  Using license key is supported starting from VictoriaMetrics v1.94.0.
-                  See [here](https://docs.victoriametrics.com/enterprise)
                 properties:
                   forceOffline:
-                    description: Enforce offline verification of the license key.
                     type: boolean
                   key:
-                    description: |-
-                      Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise).
-                      To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial)
                     type: string
                   keyRef:
-                    description: KeyRef is reference to secret with license key for
-                      enterprise features.
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   reloadInterval:
-                    description: Interval to be used for checking for license key
-                      changes. Note that this is only applicable when using KeyRef.
                     type: string
                 type: object
               livenessProbe:
-                description: LivenessProbe that will be added CRD pod
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               logFormat:
-                description: LogFormat for VMAgent to be configured with.
                 enum:
                 - default
                 - json
                 type: string
               logLevel:
-                description: |-
-                  LogLevel for VMAgent to be configured with.
-                  INFO, WARN, ERROR, FATAL, PANIC
                 enum:
                 - INFO
                 - WARN
@@ -2435,76 +4672,33 @@ spec:
                 - PANIC
                 type: string
               managedMetadata:
-                description: |-
-                  ManagedMetadata defines metadata that will be added to the all objects
-                  created by operator for the given CustomResource
                 properties:
                   annotations:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                     type: object
                   labels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                     type: object
                 type: object
               maxScrapeInterval:
-                description: |-
-                  MaxScrapeInterval allows limiting maximum scrape interval for VMServiceScrape, VMPodScrape and other scrapes
-                  If interval is higher than defined limit, `maxScrapeInterval` will be used.
                 type: string
               minReadySeconds:
-                description: |-
-                  MinReadySeconds defines a minimum number of seconds to wait before starting update next pod
-                  if previous in healthy state
-                  Has no effect for VLogs and VMSingle
                 format: int32
                 type: integer
               minScrapeInterval:
-                description: |-
-                  MinScrapeInterval allows limiting minimal scrape interval for VMServiceScrape, VMPodScrape and other scrapes
-                  If interval is lower than defined limit, `minScrapeInterval` will be used.
                 type: string
               nodeScrapeNamespaceSelector:
-                description: |-
-                  NodeScrapeNamespaceSelector defines Namespaces to be selected for VMNodeScrape discovery.
-                  Works in combination with Selector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -2518,122 +4712,55 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               nodeScrapeRelabelTemplate:
-                description: |-
-                  NodeScrapeRelabelTemplate defines relabel config, that will be added to each VMNodeScrape.
-                  it's useful for adding specific labels to all targets
                 items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
                   properties:
                     action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
                       type: string
                     if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
                       x-kubernetes-preserve-unknown-fields: true
                     labels:
                       additionalProperties:
                         type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
                       type: object
                     match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
                       type: string
                     modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
                       format: int64
                       type: integer
                     regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                       x-kubernetes-preserve-unknown-fields: true
                     replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
                       type: string
                     separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
                       type: string
                     source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       items:
                         type: string
                       type: array
                     sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
                       items:
                         type: string
                       type: array
                     target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       type: string
                     targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
                       type: string
                   type: object
                 type: array
               nodeScrapeSelector:
-                description: |-
-                  NodeScrapeSelector defines VMNodeScrape to be selected for scraping.
-                  Works in combination with NamespaceSelector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -2647,127 +4774,71 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               nodeSelector:
                 additionalProperties:
                   type: string
-                description: NodeSelector Define which Nodes the Pods are scheduled
-                  on.
                 type: object
               overrideHonorLabels:
-                description: |-
-                  OverrideHonorLabels if set to true overrides all user configured honor_labels.
-                  If HonorLabels is set in scrape objects  to true, this overrides honor_labels to false.
                 type: boolean
               overrideHonorTimestamps:
-                description: OverrideHonorTimestamps allows to globally enforce honoring
-                  timestamps in all scrape configs.
                 type: boolean
               paused:
-                description: |-
-                  Paused If set to true all actions on the underlying managed objects are not
-                  going to be performed, except for delete actions.
                 type: boolean
+              persistentVolumeClaimRetentionPolicy:
+                properties:
+                  whenDeleted:
+                    type: string
+                  whenScaled:
+                    type: string
+                type: object
               podDisruptionBudget:
-                description: PodDisruptionBudget created by operator
                 properties:
                   maxUnavailable:
                     anyOf:
                     - type: integer
                     - type: string
-                    description: |-
-                      An eviction is allowed if at most "maxUnavailable" pods selected by
-                      "selector" are unavailable after the eviction, i.e. even in absence of
-                      the evicted pod. For example, one can prevent all voluntary evictions
-                      by specifying 0. This is a mutually exclusive setting with "minAvailable".
                     x-kubernetes-int-or-string: true
                   minAvailable:
                     anyOf:
                     - type: integer
                     - type: string
-                    description: |-
-                      An eviction is allowed if at least "minAvailable" pods selected by
-                      "selector" will still be available after the eviction, i.e. even in the
-                      absence of the evicted pod.  So for example you can prevent all voluntary
-                      evictions by specifying "100%".
                     x-kubernetes-int-or-string: true
                   selectorLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      replaces default labels selector generated by operator
-                      it's useful when you need to create custom budget
                     type: object
+                  unhealthyPodEvictionPolicy:
+                    enum:
+                    - IfHealthyBudget
+                    - AlwaysAllow
+                    type: string
                 type: object
               podMetadata:
-                description: PodMetadata configures Labels and Annotations which are
-                  propagated to the vmagent pods.
                 properties:
                   annotations:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                     type: object
                   labels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects. May match selectors of replication controllers
-                      and services.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                     type: object
                   name:
-                    description: |-
-                      Name must be unique within a namespace. Is required when creating resources, although
-                      some resources may allow a client to request the generation of an appropriate name
-                      automatically. Name is primarily intended for creation idempotence and configuration
-                      definition.
-                      Cannot be updated.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                     type: string
                 type: object
               podScrapeNamespaceSelector:
-                description: |-
-                  PodScrapeNamespaceSelector defines Namespaces to be selected for VMPodScrape discovery.
-                  Works in combination with Selector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -2781,122 +4852,55 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               podScrapeRelabelTemplate:
-                description: |-
-                  PodScrapeRelabelTemplate defines relabel config, that will be added to each VMPodScrape.
-                  it's useful for adding specific labels to all targets
                 items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
                   properties:
                     action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
                       type: string
                     if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
                       x-kubernetes-preserve-unknown-fields: true
                     labels:
                       additionalProperties:
                         type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
                       type: object
                     match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
                       type: string
                     modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
                       format: int64
                       type: integer
                     regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                       x-kubernetes-preserve-unknown-fields: true
                     replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
                       type: string
                     separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
                       type: string
                     source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       items:
                         type: string
                       type: array
                     sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
                       items:
                         type: string
                       type: array
                     target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       type: string
                     targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
                       type: string
                   type: object
                 type: array
               podScrapeSelector:
-                description: |-
-                  PodScrapeSelector defines PodScrapes to be selected for target discovery.
-                  Works in combination with NamespaceSelector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -2910,50 +4914,23 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               port:
-                description: Port listen address
                 type: string
               priorityClassName:
-                description: PriorityClassName class assigned to the Pods
                 type: string
               probeNamespaceSelector:
-                description: |-
-                  ProbeNamespaceSelector defines Namespaces to be selected for VMProbe discovery.
-                  Works in combination with Selector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -2967,122 +4944,55 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               probeScrapeRelabelTemplate:
-                description: |-
-                  ProbeScrapeRelabelTemplate defines relabel config, that will be added to each VMProbeScrape.
-                  it's useful for adding specific labels to all targets
                 items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
                   properties:
                     action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
                       type: string
                     if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
                       x-kubernetes-preserve-unknown-fields: true
                     labels:
                       additionalProperties:
                         type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
                       type: object
                     match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
                       type: string
                     modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
                       format: int64
                       type: integer
                     regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                       x-kubernetes-preserve-unknown-fields: true
                     replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
                       type: string
                     separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
                       type: string
                     source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       items:
                         type: string
                       type: array
                     sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
                       items:
                         type: string
                       type: array
                     target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       type: string
                     targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
                       type: string
                   type: object
                 type: array
               probeSelector:
-                description: |-
-                  ProbeSelector defines VMProbe to be selected for target probing.
-                  Works in combination with NamespaceSelector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -3096,121 +5006,77 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               readinessGates:
-                description: ReadinessGates defines pod readiness gates
                 items:
-                  description: PodReadinessGate contains the reference to a pod condition
                   properties:
                     conditionType:
-                      description: ConditionType refers to a condition in the pod's
-                        condition list with matching type.
                       type: string
                   required:
                   - conditionType
                   type: object
                 type: array
               readinessProbe:
-                description: ReadinessProbe that will be added CRD pod
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               relabelConfig:
-                description: |-
-                  RelabelConfig ConfigMap with global relabel config -remoteWrite.relabelConfig
-                  This relabeling is applied to all the collected metrics before sending them to remote storage.
                 properties:
                   key:
-                    description: The key to select.
                     type: string
                   name:
                     default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                     type: string
                   optional:
-                    description: Specify whether the ConfigMap or its key must be
-                      defined
                     type: boolean
                 required:
                 - key
                 type: object
                 x-kubernetes-map-type: atomic
               remoteWrite:
-                description: |-
-                  RemoteWrite list of victoria metrics /some other remote write system
-                  for vm it must looks like: http://victoria-metrics-single:8429/api/v1/write
-                  or for cluster different url
-                  https://github.com/VictoriaMetrics/VictoriaMetrics/tree/master/app/vmagent#splitting-data-streams-among-multiple-systems
                 items:
-                  description: VMAgentRemoteWriteSpec defines the remote storage configuration
-                    for VmAgent
                   properties:
+                    aws:
+                      properties:
+                        ec2Endpoint:
+                          type: string
+                        region:
+                          type: string
+                        roleARN:
+                          type: string
+                        service:
+                          type: string
+                        stsEndpoint:
+                          type: string
+                        useSigv4:
+                          type: boolean
+                      type: object
                     basicAuth:
-                      description: BasicAuth allow an endpoint to authenticate over
-                        basic authentication
                       properties:
                         password:
-                          description: |-
-                            Password defines reference for secret with password value
-                            The secret needs to be in the same namespace as scrape object
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         password_file:
-                          description: |-
-                            PasswordFile defines path to password file at disk
-                            must be pre-mounted
                           type: string
                         username:
-                          description: |-
-                            Username defines reference for secret with username value
-                            The secret needs to be in the same namespace as scrape object
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
@@ -3218,175 +5084,87 @@ spec:
                           x-kubernetes-map-type: atomic
                       type: object
                     bearerTokenSecret:
-                      description: Optional bearer auth token to use for -remoteWrite.url
                       properties:
                         key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
                           type: string
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
                           type: boolean
                       required:
                       - key
                       type: object
                       x-kubernetes-map-type: atomic
                     forceVMProto:
-                      description: ForceVMProto forces using VictoriaMetrics protocol
-                        for sending data to -remoteWrite.url
                       type: boolean
                     headers:
-                      description: |-
-                        Headers allow configuring custom http headers
-                        Must be in form of semicolon separated header with value
-                        e.g.
-                        headerName: headerValue
-                        vmagent supports since 1.79.0 version
                       items:
                         type: string
                       type: array
                     inlineUrlRelabelConfig:
-                      description: InlineUrlRelabelConfig defines relabeling config
-                        for remoteWriteURL, it can be defined at crd spec.
                       items:
-                        description: |-
-                          RelabelConfig allows dynamic rewriting of the label set
-                          More info: https://docs.victoriametrics.com/#relabeling
                         properties:
                           action:
-                            description: Action to perform based on regex matching.
-                              Default is 'replace'
                             type: string
                           if:
-                            description: 'If represents metricsQL match expression
-                              (or list of expressions): ''{__name__=~"foo_.*"}'''
                             x-kubernetes-preserve-unknown-fields: true
                           labels:
                             additionalProperties:
                               type: string
-                            description: 'Labels is used together with Match for `action:
-                              graphite`'
                             type: object
                           match:
-                            description: 'Match is used together with Labels for `action:
-                              graphite`'
                             type: string
                           modulus:
-                            description: Modulus to take of the hash of the source
-                              label values.
                             format: int64
                             type: integer
                           regex:
-                            description: |-
-                              Regular expression against which the extracted value is matched. Default is '(.*)'
-                              victoriaMetrics supports multiline regex joined with |
-                              https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                             x-kubernetes-preserve-unknown-fields: true
                           replacement:
-                            description: |-
-                              Replacement value against which a regex replace is performed if the
-                              regular expression matches. Regex capture groups are available. Default is '$1'
                             type: string
                           separator:
-                            description: Separator placed between concatenated source
-                              label values. default is ';'.
                             type: string
                           source_labels:
-                            description: |-
-                              UnderScoreSourceLabels - additional form of source labels source_labels
-                              for compatibility with original relabel config.
-                              if set  both sourceLabels and source_labels, sourceLabels has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
                             items:
                               type: string
                             type: array
                           sourceLabels:
-                            description: |-
-                              The source labels select values from existing labels. Their content is concatenated
-                              using the configured separator and matched against the configured regular expression
-                              for the replace, keep, and drop actions.
                             items:
                               type: string
                             type: array
                           target_label:
-                            description: |-
-                              UnderScoreTargetLabel - additional form of target label - target_label
-                              for compatibility with original relabel config.
-                              if set  both targetLabel and target_label, targetLabel has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
                             type: string
                           targetLabel:
-                            description: |-
-                              Label to which the resulting value is written in a replace action.
-                              It is mandatory for replace actions. Regex capture groups are available.
                             type: string
                         type: object
                       type: array
                     maxDiskUsage:
-                      description: |-
-                        MaxDiskUsage defines the maximum file-based buffer size in bytes for the given remoteWrite
-                        It overrides global configuration defined at remoteWriteSettings.maxDiskUsagePerURL
                       x-kubernetes-preserve-unknown-fields: true
                     oauth2:
-                      description: OAuth2 defines auth configuration
                       properties:
                         client_id:
-                          description: The secret or configmap containing the OAuth2
-                            client id
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -3394,385 +5172,187 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         client_secret:
-                          description: The secret containing the OAuth2 client secret
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         client_secret_file:
-                          description: ClientSecretFile defines path for client secret
-                            file.
                           type: string
                         endpoint_params:
                           additionalProperties:
                             type: string
-                          description: Parameters to append to the token URL
                           type: object
                         proxy_url:
-                          description: |-
-                            The proxy URL for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
                           type: string
                         scopes:
-                          description: OAuth2 scopes used for the token request
                           items:
                             type: string
                           type: array
                         tls_config:
-                          description: |-
-                            TLSConfig for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
                           x-kubernetes-preserve-unknown-fields: true
                         token_url:
-                          description: The URL to fetch the token from
                           minLength: 1
                           type: string
                       required:
                       - client_id
                       - token_url
                       type: object
+                    proxyURL:
+                      type: string
                     sendTimeout:
-                      description: Timeout for sending a single block of data to -remoteWrite.url
-                        (default 1m0s)
                       pattern: '[0-9]+(ms|s|m|h)'
                       type: string
                     streamAggrConfig:
-                      description: StreamAggrConfig defines stream aggregation configuration
-                        for VMAgent for -remoteWrite.url
                       properties:
                         configmap:
-                          description: ConfigMap with stream aggregation rules
                           properties:
                             key:
-                              description: The key to select.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the ConfigMap or its key
-                                must be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         dedupInterval:
-                          description: Allows setting different de-duplication intervals
-                            per each configured remote storage
                           type: string
                         dropInput:
-                          description: Allow drop all the input samples after the
-                            aggregation
                           type: boolean
                         dropInputLabels:
-                          description: labels to drop from samples for aggregator
-                            before stream de-duplication and aggregation
                           items:
                             type: string
                           type: array
                         enableWindows:
-                          description: EnableWindows enables aggregating data in separate
-                            windows ( available from v0.54.0).
                           type: boolean
                         ignoreFirstIntervals:
-                          description: IgnoreFirstIntervals instructs to ignore first
-                            interval
                           type: integer
+                        ignoreFirstSampleInterval:
+                          type: string
                         ignoreOldSamples:
-                          description: IgnoreOldSamples instructs to ignore samples
-                            with old timestamps outside the current aggregation interval.
                           type: boolean
                         keepInput:
-                          description: Allows writing both raw and aggregate data
                           type: boolean
                         rules:
-                          description: Stream aggregation rules
                           items:
-                            description: StreamAggrRule defines the rule in stream
-                              aggregation config
                             properties:
                               by:
-                                description: |-
-                                  By is an optional list of labels for grouping input series.
-
-                                  See also Without.
-
-                                  If neither By nor Without are set, then the Outputs are calculated
-                                  individually per each input time series.
                                 items:
                                   type: string
                                 type: array
                               dedup_interval:
-                                description: DedupInterval is an optional interval
-                                  for deduplication.
                                 type: string
                               drop_input_labels:
-                                description: |-
-                                  DropInputLabels is an optional list with labels, which must be dropped before further processing of input samples.
-
-                                  Labels are dropped before de-duplication and aggregation.
                                 items:
                                   type: string
                                 type: array
                               enable_windows:
-                                description: EnableWindows enables aggregating data
-                                  in separate windows
                                 type: boolean
                               flush_on_shutdown:
-                                description: |-
-                                  FlushOnShutdown defines whether to flush the aggregation state on process termination
-                                  or config reload. Is `false` by default.
-                                  It is not recommended changing this setting, unless unfinished aggregations states
-                                  are preferred to missing data points.
                                 type: boolean
                               ignore_first_intervals:
                                 type: integer
                               ignore_old_samples:
-                                description: IgnoreOldSamples instructs to ignore
-                                  samples with old timestamps outside the current
-                                  aggregation interval.
                                 type: boolean
+                              ignoreFirstSampleInterval:
+                                type: string
                               input_relabel_configs:
-                                description: |-
-                                  InputRelabelConfigs is an optional relabeling rules, which are applied on the input
-                                  before aggregation.
                                 items:
-                                  description: |-
-                                    RelabelConfig allows dynamic rewriting of the label set
-                                    More info: https://docs.victoriametrics.com/#relabeling
                                   properties:
                                     action:
-                                      description: Action to perform based on regex
-                                        matching. Default is 'replace'
                                       type: string
                                     if:
-                                      description: 'If represents metricsQL match
-                                        expression (or list of expressions): ''{__name__=~"foo_.*"}'''
                                       x-kubernetes-preserve-unknown-fields: true
                                     labels:
                                       additionalProperties:
                                         type: string
-                                      description: 'Labels is used together with Match
-                                        for `action: graphite`'
                                       type: object
                                     match:
-                                      description: 'Match is used together with Labels
-                                        for `action: graphite`'
                                       type: string
                                     modulus:
-                                      description: Modulus to take of the hash of
-                                        the source label values.
                                       format: int64
                                       type: integer
                                     regex:
-                                      description: |-
-                                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                                        victoriaMetrics supports multiline regex joined with |
-                                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                                       x-kubernetes-preserve-unknown-fields: true
                                     replacement:
-                                      description: |-
-                                        Replacement value against which a regex replace is performed if the
-                                        regular expression matches. Regex capture groups are available. Default is '$1'
                                       type: string
                                     separator:
-                                      description: Separator placed between concatenated
-                                        source label values. default is ';'.
                                       type: string
                                     source_labels:
-                                      description: |-
-                                        UnderScoreSourceLabels - additional form of source labels source_labels
-                                        for compatibility with original relabel config.
-                                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                                        for details https://github.com/VictoriaMetrics/operator/issues/131
                                       items:
                                         type: string
                                       type: array
                                     sourceLabels:
-                                      description: |-
-                                        The source labels select values from existing labels. Their content is concatenated
-                                        using the configured separator and matched against the configured regular expression
-                                        for the replace, keep, and drop actions.
                                       items:
                                         type: string
                                       type: array
                                     target_label:
-                                      description: |-
-                                        UnderScoreTargetLabel - additional form of target label - target_label
-                                        for compatibility with original relabel config.
-                                        if set  both targetLabel and target_label, targetLabel has priority.
-                                        for details https://github.com/VictoriaMetrics/operator/issues/131
                                       type: string
                                     targetLabel:
-                                      description: |-
-                                        Label to which the resulting value is written in a replace action.
-                                        It is mandatory for replace actions. Regex capture groups are available.
                                       type: string
                                   type: object
                                 type: array
                               interval:
-                                description: Interval is the interval between aggregations.
                                 type: string
                               keep_metric_names:
-                                description: KeepMetricNames instructs to leave metric
-                                  names as is for the output time series without adding
-                                  any suffix.
                                 type: boolean
                               match:
-                                description: |-
-                                  Match is a label selector (or list of label selectors) for filtering time series for the given selector.
-
-                                  If the match isn't set, then all the input time series are processed.
                                 x-kubernetes-preserve-unknown-fields: true
                               no_align_flush_to_interval:
-                                description: |-
-                                  NoAlignFlushToInterval disables aligning of flushes to multiples of Interval.
-                                  By default flushes are aligned to Interval.
                                 type: boolean
                               output_relabel_configs:
-                                description: |-
-                                  OutputRelabelConfigs is an optional relabeling rules, which are applied
-                                  on the aggregated output before being sent to remote storage.
                                 items:
-                                  description: |-
-                                    RelabelConfig allows dynamic rewriting of the label set
-                                    More info: https://docs.victoriametrics.com/#relabeling
                                   properties:
                                     action:
-                                      description: Action to perform based on regex
-                                        matching. Default is 'replace'
                                       type: string
                                     if:
-                                      description: 'If represents metricsQL match
-                                        expression (or list of expressions): ''{__name__=~"foo_.*"}'''
                                       x-kubernetes-preserve-unknown-fields: true
                                     labels:
                                       additionalProperties:
                                         type: string
-                                      description: 'Labels is used together with Match
-                                        for `action: graphite`'
                                       type: object
                                     match:
-                                      description: 'Match is used together with Labels
-                                        for `action: graphite`'
                                       type: string
                                     modulus:
-                                      description: Modulus to take of the hash of
-                                        the source label values.
                                       format: int64
                                       type: integer
                                     regex:
-                                      description: |-
-                                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                                        victoriaMetrics supports multiline regex joined with |
-                                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                                       x-kubernetes-preserve-unknown-fields: true
                                     replacement:
-                                      description: |-
-                                        Replacement value against which a regex replace is performed if the
-                                        regular expression matches. Regex capture groups are available. Default is '$1'
                                       type: string
                                     separator:
-                                      description: Separator placed between concatenated
-                                        source label values. default is ';'.
                                       type: string
                                     source_labels:
-                                      description: |-
-                                        UnderScoreSourceLabels - additional form of source labels source_labels
-                                        for compatibility with original relabel config.
-                                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                                        for details https://github.com/VictoriaMetrics/operator/issues/131
                                       items:
                                         type: string
                                       type: array
                                     sourceLabels:
-                                      description: |-
-                                        The source labels select values from existing labels. Their content is concatenated
-                                        using the configured separator and matched against the configured regular expression
-                                        for the replace, keep, and drop actions.
                                       items:
                                         type: string
                                       type: array
                                     target_label:
-                                      description: |-
-                                        UnderScoreTargetLabel - additional form of target label - target_label
-                                        for compatibility with original relabel config.
-                                        if set  both targetLabel and target_label, targetLabel has priority.
-                                        for details https://github.com/VictoriaMetrics/operator/issues/131
                                       type: string
                                     targetLabel:
-                                      description: |-
-                                        Label to which the resulting value is written in a replace action.
-                                        It is mandatory for replace actions. Regex capture groups are available.
                                       type: string
                                   type: object
                                 type: array
                               outputs:
-                                description: |-
-                                  Outputs is a list of output aggregate functions to produce.
-
-                                  The following names are allowed:
-
-                                  - total - aggregates input counters
-                                  - increase - counts the increase over input counters
-                                  - count_series - counts the input series
-                                  - count_samples - counts the input samples
-                                  - sum_samples - sums the input samples
-                                  - last - the last biggest sample value
-                                  - min - the minimum sample value
-                                  - max - the maximum sample value
-                                  - avg - the average value across all the samples
-                                  - stddev - standard deviation across all the samples
-                                  - stdvar - standard variance across all the samples
-                                  - histogram_bucket - creates VictoriaMetrics histogram for input samples
-                                  - quantiles(phi1, ..., phiN) - quantiles' estimation for phi in the range [0..1]
-
-                                  The output time series will have the following names:
-
-                                    input_name:aggr_<interval>_<output>
                                 items:
                                   type: string
                                 type: array
                               staleness_interval:
-                                description: |-
-                                  Staleness interval is interval after which the series state will be reset if no samples have been sent during it.
-                                  The parameter is only relevant for outputs: total, total_prometheus, increase, increase_prometheus and histogram_bucket.
                                 type: string
                               without:
-                                description: |-
-                                  Without is an optional list of labels, which must be excluded when grouping input series.
-
-                                  See also By.
-
-                                  If neither By nor Without are set, then the Outputs are calculated
-                                  individually per each input time series.
                                 items:
                                   type: string
                                 type: array
@@ -3783,56 +5363,30 @@ spec:
                           type: array
                       type: object
                     tlsConfig:
-                      description: TLSConfig describes tls configuration for remote
-                        write target
                       properties:
                         ca:
-                          description: Struct containing the CA cert to use for the
-                            targets.
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -3840,56 +5394,30 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         caFile:
-                          description: Path to the CA cert in the container to use
-                            for the targets.
                           type: string
                         cert:
-                          description: Struct containing the client cert file for
-                            the targets.
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -3897,67 +5425,37 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         certFile:
-                          description: Path to the client cert file in the container
-                            for the targets.
                           type: string
                         insecureSkipVerify:
-                          description: Disable target certificate validation.
                           type: boolean
                         keyFile:
-                          description: Path to the client key file in the container
-                            for the targets.
                           type: string
                         keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         serverName:
-                          description: Used to verify the hostname for the targets.
                           type: string
                       type: object
                     url:
-                      description: URL of the endpoint to send samples to.
                       type: string
                     urlRelabelConfig:
-                      description: ConfigMap with relabeling config which is applied
-                        to metrics before sending them to the corresponding -remoteWrite.url
                       properties:
                         key:
-                          description: The key to select.
                           type: string
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the ConfigMap or its key must
-                            be defined
                           type: boolean
                       required:
                       - key
@@ -3968,81 +5466,40 @@ spec:
                   type: object
                 type: array
               remoteWriteSettings:
-                description: RemoteWriteSettings defines global settings for all remoteWrite
-                  urls.
                 properties:
                   flushInterval:
-                    description: Interval for flushing the data to remote storage.
-                      (default 1s)
                     pattern: '[0-9]+(ms|s|m|h)'
                     type: string
                   label:
                     additionalProperties:
                       type: string
-                    description: Labels in the form 'name=value' to add to all the
-                      metrics before sending them. This overrides the label if it
-                      already exists.
                     type: object
                   maxBlockSize:
-                    description: The maximum size in bytes of unpacked request to
-                      send to remote storage
                     format: int32
                     type: integer
                   maxDiskUsagePerURL:
-                    description: The maximum file-based buffer size in bytes at -remoteWrite.tmpDataPath
                     x-kubernetes-preserve-unknown-fields: true
                   queues:
-                    description: The number of concurrent queues
                     format: int32
                     type: integer
                   showURL:
-                    description: Whether to show -remoteWrite.url in the exported
-                      metrics. It is hidden by default, since it can contain sensitive
-                      auth info
                     type: boolean
                   tmpDataPath:
-                    description: Path to directory where temporary data for remote
-                      write component is stored (default vmagent-remotewrite-data)
                     type: string
                   useMultiTenantMode:
-                    description: |-
-                      Configures vmagent accepting data via the same multitenant endpoints as vminsert at VictoriaMetrics cluster does,
-                      see [here](https://docs.victoriametrics.com/vmagent/#multitenancy).
-                      it's global setting and affects all remote storage configurations
                     type: boolean
                 type: object
               replicaCount:
-                description: ReplicaCount is the expected size of the Application.
                 format: int32
                 type: integer
               resources:
-                description: |-
-                  Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
                 properties:
                   claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
                     items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
                       properties:
                         name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
                           type: string
                         request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
                           type: string
                       required:
                       - name
@@ -4058,9 +5515,6 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                   requests:
                     additionalProperties:
@@ -4069,97 +5523,350 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                 type: object
               revisionHistoryLimitCount:
-                description: |-
-                  The number of old ReplicaSets to retain to allow rollback in deployment or
-                  maximum number of revisions that will be maintained in the Deployment revision history.
-                  Has no effect at StatefulSets
-                  Defaults to 10.
                 format: int32
                 type: integer
               rollingUpdate:
-                description: RollingUpdate - overrides deployment update params.
                 properties:
                   maxSurge:
                     anyOf:
                     - type: integer
                     - type: string
-                    description: |-
-                      The maximum number of pods that can be scheduled above the desired number of
-                      pods.
-                      Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
-                      This can not be 0 if MaxUnavailable is 0.
-                      Absolute number is calculated from percentage by rounding up.
-                      Defaults to 25%.
-                      Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when
-                      the rolling update starts, such that the total number of old and new pods do not exceed
-                      130% of desired pods. Once old pods have been killed,
-                      new ReplicaSet can be scaled up further, ensuring that total number of pods running
-                      at any time during the update is at most 130% of desired pods.
                     x-kubernetes-int-or-string: true
                   maxUnavailable:
                     anyOf:
                     - type: integer
                     - type: string
-                    description: |-
-                      The maximum number of pods that can be unavailable during the update.
-                      Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
-                      Absolute number is calculated from percentage by rounding down.
-                      This can not be 0 if MaxSurge is 0.
-                      Defaults to 25%.
-                      Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods
-                      immediately when the rolling update starts. Once new pods are ready, old ReplicaSet
-                      can be scaled down further, followed by scaling up the new ReplicaSet, ensuring
-                      that the total number of pods available at all times during the update is at
-                      least 70% of desired pods.
                     x-kubernetes-int-or-string: true
                 type: object
               runtimeClassName:
-                description: |-
-                  RuntimeClassName - defines runtime class for kubernetes pod.
-                  https://kubernetes.io/docs/concepts/containers/runtime-class/
                 type: string
+              sampleLimit:
+                type: integer
               schedulerName:
-                description: SchedulerName - defines kubernetes scheduler name
                 type: string
-              scrapeConfigNamespaceSelector:
-                description: |-
-                  ScrapeConfigNamespaceSelector defines Namespaces to be selected for VMScrapeConfig discovery.
-                  Works in combination with Selector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
+              scrapeClasses:
+                items:
+                  properties:
+                    attachMetadata:
+                      properties:
+                        namespace:
+                          type: boolean
+                        node:
+                          type: boolean
+                      type: object
+                    authorization:
+                      properties:
+                        credentials:
+                          properties:
+                            key:
+                              type: string
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          required:
+                          - key
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        credentialsFile:
+                          type: string
+                        type:
+                          type: string
+                      type: object
+                    basicAuth:
+                      properties:
+                        password:
+                          properties:
+                            key:
+                              type: string
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          required:
+                          - key
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        password_file:
+                          type: string
+                        username:
+                          properties:
+                            key:
+                              type: string
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          required:
+                          - key
+                          type: object
+                          x-kubernetes-map-type: atomic
+                      type: object
+                    bearerTokenFile:
+                      type: string
+                    bearerTokenSecret:
+                      nullable: true
+                      properties:
+                        key:
+                          type: string
+                        name:
+                          default: ""
+                          type: string
+                        optional:
+                          type: boolean
+                      required:
+                      - key
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    default:
+                      type: boolean
+                    metricRelabelConfigs:
+                      items:
+                        properties:
+                          action:
+                            type: string
+                          if:
+                            x-kubernetes-preserve-unknown-fields: true
+                          labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          match:
+                            type: string
+                          modulus:
+                            format: int64
+                            type: integer
+                          regex:
+                            x-kubernetes-preserve-unknown-fields: true
+                          replacement:
+                            type: string
+                          separator:
+                            type: string
+                          source_labels:
+                            items:
+                              type: string
+                            type: array
+                          sourceLabels:
+                            items:
+                              type: string
+                            type: array
+                          target_label:
+                            type: string
+                          targetLabel:
+                            type: string
+                        type: object
+                      type: array
+                    name:
+                      minLength: 1
+                      type: string
+                    oauth2:
+                      properties:
+                        client_id:
+                          properties:
+                            configMap:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            secret:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                          type: object
+                        client_secret:
+                          properties:
+                            key:
+                              type: string
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          required:
+                          - key
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        client_secret_file:
+                          type: string
+                        endpoint_params:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        proxy_url:
+                          type: string
+                        scopes:
+                          items:
+                            type: string
+                          type: array
+                        tls_config:
+                          x-kubernetes-preserve-unknown-fields: true
+                        token_url:
+                          minLength: 1
+                          type: string
+                      required:
+                      - client_id
+                      - token_url
+                      type: object
+                    relabelConfigs:
+                      items:
+                        properties:
+                          action:
+                            type: string
+                          if:
+                            x-kubernetes-preserve-unknown-fields: true
+                          labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          match:
+                            type: string
+                          modulus:
+                            format: int64
+                            type: integer
+                          regex:
+                            x-kubernetes-preserve-unknown-fields: true
+                          replacement:
+                            type: string
+                          separator:
+                            type: string
+                          source_labels:
+                            items:
+                              type: string
+                            type: array
+                          sourceLabels:
+                            items:
+                              type: string
+                            type: array
+                          target_label:
+                            type: string
+                          targetLabel:
+                            type: string
+                        type: object
+                      type: array
+                    tlsConfig:
+                      properties:
+                        ca:
+                          properties:
+                            configMap:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            secret:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                          type: object
+                        caFile:
+                          type: string
+                        cert:
+                          properties:
+                            configMap:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            secret:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                          type: object
+                        certFile:
+                          type: string
+                        insecureSkipVerify:
+                          type: boolean
+                        keyFile:
+                          type: string
+                        keySecret:
+                          properties:
+                            key:
+                              type: string
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          required:
+                          - key
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        serverName:
+                          type: string
+                      type: object
+                  required:
+                  - name
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - name
+                x-kubernetes-list-type: map
+              scrapeConfigNamespaceSelector:
+                properties:
+                  matchExpressions:
+                    items:
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -4173,119 +5880,55 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               scrapeConfigRelabelTemplate:
-                description: |-
-                  ScrapeConfigRelabelTemplate defines relabel config, that will be added to each VMScrapeConfig.
-                  it's useful for adding specific labels to all targets
                 items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
                   properties:
                     action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
                       type: string
                     if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
                       x-kubernetes-preserve-unknown-fields: true
                     labels:
                       additionalProperties:
                         type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
                       type: object
                     match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
                       type: string
                     modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
                       format: int64
                       type: integer
                     regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                       x-kubernetes-preserve-unknown-fields: true
                     replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
                       type: string
                     separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
                       type: string
                     source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       items:
                         type: string
                       type: array
                     sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
                       items:
                         type: string
                       type: array
                     target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       type: string
                     targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
                       type: string
                   type: object
                 type: array
               scrapeConfigSelector:
-                description: |-
-                  ScrapeConfigSelector defines VMScrapeConfig to be selected for target discovery.
-                  Works in combination with NamespaceSelector.
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -4299,77 +5942,36 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               scrapeInterval:
-                description: ScrapeInterval defines how often scrape targets by default
                 pattern: '[0-9]+(ms|s|m|h)'
                 type: string
               scrapeTimeout:
-                description: ScrapeTimeout defines global timeout for targets scrape
                 pattern: '[0-9]+(ms|s|m|h)'
                 type: string
               secrets:
-                description: |-
-                  Secrets is a list of Secrets in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/secrets/SECRET_NAME folder
                 items:
                   type: string
                 type: array
               securityContext:
-                description: |-
-                  SecurityContext holds pod-level security attributes and common container settings.
-                  This defaults to the default PodSecurityContext.
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               selectAllByDefault:
-                description: |-
-                  SelectAllByDefault changes default behavior for empty CRD selectors, such ServiceScrapeSelector.
-                  with selectAllByDefault: true and empty serviceScrapeSelector and ServiceScrapeNamespaceSelector
-                  Operator selects all exist serviceScrapes
-                  with selectAllByDefault: false - selects nothing
                 type: boolean
               serviceAccountName:
-                description: ServiceAccountName is the name of the ServiceAccount
-                  to use to run the pods
                 type: string
               serviceScrapeNamespaceSelector:
-                description: |-
-                  ServiceScrapeNamespaceSelector Namespaces to be selected for VMServiceScrape discovery.
-                  Works in combination with Selector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -4383,122 +5985,55 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               serviceScrapeRelabelTemplate:
-                description: |-
-                  ServiceScrapeRelabelTemplate defines relabel config, that will be added to each VMServiceScrape.
-                  it's useful for adding specific labels to all targets
                 items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
                   properties:
                     action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
                       type: string
                     if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
                       x-kubernetes-preserve-unknown-fields: true
                     labels:
                       additionalProperties:
                         type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
                       type: object
                     match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
                       type: string
                     modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
                       format: int64
                       type: integer
                     regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                       x-kubernetes-preserve-unknown-fields: true
                     replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
                       type: string
                     separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
                       type: string
                     source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       items:
                         type: string
                       type: array
                     sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
                       items:
                         type: string
                       type: array
                     target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       type: string
                     targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
                       type: string
                   type: object
                 type: array
               serviceScrapeSelector:
-                description: |-
-                  ServiceScrapeSelector defines ServiceScrapes to be selected for target discovery.
-                  Works in combination with NamespaceSelector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -4512,209 +6047,92 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               serviceScrapeSpec:
-                description: ServiceScrapeSpec that will be added to vmagent VMServiceScrape
-                  spec
                 required:
                 - endpoints
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               serviceSpec:
-                description: ServiceSpec that will be added to vmagent service spec
                 properties:
                   metadata:
-                    description: EmbeddedObjectMetadata defines objectMeta for additional
-                      service.
                     properties:
                       annotations:
                         additionalProperties:
                           type: string
-                        description: |-
-                          Annotations is an unstructured key value map stored with a resource that may be
-                          set by external tools to store and retrieve arbitrary metadata. They are not
-                          queryable and should be preserved when modifying objects.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                         type: object
                       labels:
                         additionalProperties:
                           type: string
-                        description: |-
-                          Labels Map of string keys and values that can be used to organize and categorize
-                          (scope and select) objects. May match selectors of replication controllers
-                          and services.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                         type: object
                       name:
-                        description: |-
-                          Name must be unique within a namespace. Is required when creating resources, although
-                          some resources may allow a client to request the generation of an appropriate name
-                          automatically. Name is primarily intended for creation idempotence and configuration
-                          definition.
-                          Cannot be updated.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                         type: string
                     type: object
                   spec:
-                    description: |-
-                      ServiceSpec describes the attributes that a user creates on a service.
-                      More info: https://kubernetes.io/docs/concepts/services-networking/service/
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   useAsDefault:
-                    description: |-
-                      UseAsDefault applies changes from given service definition to the main object Service
-                      Changing from headless service to clusterIP or loadbalancer may break cross-component communication
                     type: boolean
                 required:
                 - spec
                 type: object
               shardCount:
-                description: |-
-                  ShardCount - numbers of shards of VMAgent
-                  in this case operator will use 1 deployment/sts per shard with
-                  replicas count according to spec.replicas,
-                  see [here](https://docs.victoriametrics.com/vmagent/#scraping-big-number-of-targets)
                 type: integer
               startupProbe:
-                description: StartupProbe that will be added to CRD pod
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               statefulMode:
-                description: |-
-                  StatefulMode enables StatefulSet for `VMAgent` instead of Deployment
-                  it allows using persistent storage for vmagent's persistentQueue
                 type: boolean
               statefulRollingUpdateStrategy:
-                description: |-
-                  StatefulRollingUpdateStrategy allows configuration for strategyType
-                  set it to RollingUpdate for disabling operator statefulSet rollingUpdate
                 type: string
               statefulStorage:
-                description: StatefulStorage configures storage for StatefulSet
                 properties:
-                  disableMountSubPath:
-                    description: |-
-                      Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary.
-                      DisableMountSubPath allows to remove any subPath usage in volume mounts.
-                    type: boolean
                   emptyDir:
-                    description: |-
-                      EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More
-                      info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir
                     properties:
                       medium:
-                        description: |-
-                          medium represents what type of storage medium should back this directory.
-                          The default is "" which means to use the node's default medium.
-                          Must be an empty string (default) or Memory.
-                          More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
                         type: string
                       sizeLimit:
                         anyOf:
                         - type: integer
                         - type: string
-                        description: |-
-                          sizeLimit is the total amount of local storage required for this EmptyDir volume.
-                          The size limit is also applicable for memory medium.
-                          The maximum usage on memory medium EmptyDir would be the minimum value between
-                          the SizeLimit specified here and the sum of memory limits of all containers in a pod.
-                          The default is nil which means that the limit is undefined.
-                          More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
                         pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                         x-kubernetes-int-or-string: true
                     type: object
                   volumeClaimTemplate:
-                    description: A PVC spec to be used by the VMAlertManager StatefulSets.
                     properties:
                       apiVersion:
-                        description: |-
-                          APIVersion defines the versioned schema of this representation of an object.
-                          Servers should convert recognized schemas to the latest internal value, and
-                          may reject unrecognized values.
-                          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
                         type: string
                       kind:
-                        description: |-
-                          Kind is a string value representing the REST resource this object represents.
-                          Servers may infer this from the endpoint the client submits requests to.
-                          Cannot be updated.
-                          In CamelCase.
-                          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
                         type: string
                       metadata:
-                        description: EmbeddedMetadata contains metadata relevant to
-                          an EmbeddedResource.
                         properties:
                           annotations:
                             additionalProperties:
                               type: string
-                            description: |-
-                              Annotations is an unstructured key value map stored with a resource that may be
-                              set by external tools to store and retrieve arbitrary metadata. They are not
-                              queryable and should be preserved when modifying objects.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                             type: object
                           labels:
                             additionalProperties:
                               type: string
-                            description: |-
-                              Labels Map of string keys and values that can be used to organize and categorize
-                              (scope and select) objects. May match selectors of replication controllers
-                              and services.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                             type: object
                           name:
-                            description: |-
-                              Name must be unique within a namespace. Is required when creating resources, although
-                              some resources may allow a client to request the generation of an appropriate name
-                              automatically. Name is primarily intended for creation idempotence and configuration
-                              definition.
-                              Cannot be updated.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                             type: string
                         type: object
                       spec:
-                        description: |-
-                          Spec defines the desired characteristics of a volume requested by a pod author.
-                          More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
                         properties:
                           accessModes:
-                            description: |-
-                              accessModes contains the desired access modes the volume should have.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
                             items:
                               type: string
                             type: array
                             x-kubernetes-list-type: atomic
                           dataSource:
-                            description: |-
-                              dataSource field can be used to specify either:
-                              * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
-                              * An existing PVC (PersistentVolumeClaim)
-                              If the provisioner or an external controller can support the specified data source,
-                              it will create a new volume based on the contents of the specified data source.
-                              When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-                              and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
-                              If the namespace is specified, then dataSourceRef will not be copied to dataSource.
                             properties:
                               apiGroup:
-                                description: |-
-                                  APIGroup is the group for the resource being referenced.
-                                  If APIGroup is not specified, the specified Kind must be in the core API group.
-                                  For any other third-party types, APIGroup is required.
                                 type: string
                               kind:
-                                description: Kind is the type of resource being referenced
                                 type: string
                               name:
-                                description: Name is the name of resource being referenced
                                 type: string
                             required:
                             - kind
@@ -4722,60 +6140,20 @@ spec:
                             type: object
                             x-kubernetes-map-type: atomic
                           dataSourceRef:
-                            description: |-
-                              dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
-                              volume is desired. This may be any object from a non-empty API group (non
-                              core object) or a PersistentVolumeClaim object.
-                              When this field is specified, volume binding will only succeed if the type of
-                              the specified object matches some installed volume populator or dynamic
-                              provisioner.
-                              This field will replace the functionality of the dataSource field and as such
-                              if both fields are non-empty, they must have the same value. For backwards
-                              compatibility, when namespace isn't specified in dataSourceRef,
-                              both fields (dataSource and dataSourceRef) will be set to the same
-                              value automatically if one of them is empty and the other is non-empty.
-                              When namespace is specified in dataSourceRef,
-                              dataSource isn't set to the same value and must be empty.
-                              There are three important differences between dataSource and dataSourceRef:
-                              * While dataSource only allows two specific types of objects, dataSourceRef
-                                allows any non-core object, as well as PersistentVolumeClaim objects.
-                              * While dataSource ignores disallowed values (dropping them), dataSourceRef
-                                preserves all values, and generates an error if a disallowed value is
-                                specified.
-                              * While dataSource only allows local objects, dataSourceRef allows objects
-                                in any namespaces.
-                              (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
-                              (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
                             properties:
                               apiGroup:
-                                description: |-
-                                  APIGroup is the group for the resource being referenced.
-                                  If APIGroup is not specified, the specified Kind must be in the core API group.
-                                  For any other third-party types, APIGroup is required.
                                 type: string
                               kind:
-                                description: Kind is the type of resource being referenced
                                 type: string
                               name:
-                                description: Name is the name of resource being referenced
                                 type: string
                               namespace:
-                                description: |-
-                                  Namespace is the namespace of resource being referenced
-                                  Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
-                                  (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
                                 type: string
                             required:
                             - kind
                             - name
                             type: object
                           resources:
-                            description: |-
-                              resources represents the minimum resources the volume should have.
-                              If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
-                              that are lower than previous value but must still be higher than capacity recorded in the
-                              status field of the claim.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
                             properties:
                               limits:
                                 additionalProperties:
@@ -4784,9 +6162,6 @@ spec:
                                   - type: string
                                   pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                   x-kubernetes-int-or-string: true
-                                description: |-
-                                  Limits describes the maximum amount of compute resources allowed.
-                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                 type: object
                               requests:
                                 additionalProperties:
@@ -4795,40 +6170,18 @@ spec:
                                   - type: string
                                   pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                   x-kubernetes-int-or-string: true
-                                description: |-
-                                  Requests describes the minimum amount of compute resources required.
-                                  If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                                  otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                 type: object
                             type: object
                           selector:
-                            description: selector is a label query over volumes to
-                              consider for binding.
                             properties:
                               matchExpressions:
-                                description: matchExpressions is a list of label selector
-                                  requirements. The requirements are ANDed.
                                 items:
-                                  description: |-
-                                    A label selector requirement is a selector that contains values, a key, and an operator that
-                                    relates the key and values.
                                   properties:
                                     key:
-                                      description: key is the label key that the selector
-                                        applies to.
                                       type: string
                                     operator:
-                                      description: |-
-                                        operator represents a key's relationship to a set of values.
-                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                       type: string
                                     values:
-                                      description: |-
-                                        values is an array of string values. If the operator is In or NotIn,
-                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                        the values array must be empty. This array is replaced during a strategic
-                                        merge patch.
                                       items:
                                         type: string
                                       type: array
@@ -4842,100 +6195,28 @@ spec:
                               matchLabels:
                                 additionalProperties:
                                   type: string
-                                description: |-
-                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                 type: object
                             type: object
                             x-kubernetes-map-type: atomic
                           storageClassName:
-                            description: |-
-                              storageClassName is the name of the StorageClass required by the claim.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
                             type: string
                           volumeAttributesClassName:
-                            description: |-
-                              volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
-                              If specified, the CSI driver will create or update the volume with the attributes defined
-                              in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                              it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                              will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                              If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                              will be set by the persistentvolume controller if it exists.
-                              If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
-                              set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
-                              exists.
-                              More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                              (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                             type: string
                           volumeMode:
-                            description: |-
-                              volumeMode defines what type of volume is required by the claim.
-                              Value of Filesystem is implied when not included in claim spec.
                             type: string
                           volumeName:
-                            description: volumeName is the binding reference to the
-                              PersistentVolume backing this claim.
                             type: string
                         type: object
                       status:
-                        description: |-
-                          Status represents the current information/status of a persistent volume claim.
-                          Read-only.
-                          More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
                         properties:
                           accessModes:
-                            description: |-
-                              accessModes contains the actual access modes the volume backing the PVC has.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
                             items:
                               type: string
                             type: array
                             x-kubernetes-list-type: atomic
                           allocatedResourceStatuses:
                             additionalProperties:
-                              description: |-
-                                When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource
-                                that it does not recognizes, then it should ignore that update and let other controllers
-                                handle it.
                               type: string
-                            description: "allocatedResourceStatuses stores status
-                              of resource being resized for the given PVC.\nKey names
-                              follow standard Kubernetes label syntax. Valid values
-                              are either:\n\t* Un-prefixed keys:\n\t\t- storage -
-                              the capacity of the volume.\n\t* Custom resources must
-                              use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart
-                              from above values - keys that are unprefixed or have
-                              kubernetes.io prefix are considered\nreserved and hence
-                              may not be used.\n\nClaimResourceStatus can be in any
-                              of following states:\n\t- ControllerResizeInProgress:\n\t\tState
-                              set when resize controller starts resizing the volume
-                              in control-plane.\n\t- ControllerResizeFailed:\n\t\tState
-                              set when resize has failed in resize controller with
-                              a terminal error.\n\t- NodeResizePending:\n\t\tState
-                              set when resize controller has finished resizing the
-                              volume but further resizing of\n\t\tvolume is needed
-                              on the node.\n\t- NodeResizeInProgress:\n\t\tState set
-                              when kubelet starts resizing the volume.\n\t- NodeResizeFailed:\n\t\tState
-                              set when resizing has failed in kubelet with a terminal
-                              error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor
-                              example: if expanding a PVC for more capacity - this
-                              field can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage']
-                              = \"ControllerResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                              = \"ControllerResizeFailed\"\n     - pvc.status.allocatedResourceStatus['storage']
-                              = \"NodeResizePending\"\n     - pvc.status.allocatedResourceStatus['storage']
-                              = \"NodeResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                              = \"NodeResizeFailed\"\nWhen this field is not set,
-                              it means that no resize operation is in progress for
-                              the given PVC.\n\nA controller that receives PVC update
-                              with previously unknown resourceName or ClaimResourceStatus\nshould
-                              ignore the update for the purpose it was designed. For
-                              example - a controller that\nonly is responsible for
-                              resizing capacity of the volume, should ignore PVC updates
-                              that change other valid\nresources associated with PVC.\n\nThis
-                              is an alpha field and requires enabling RecoverVolumeExpansionFailure
-                              feature."
                             type: object
                             x-kubernetes-map-type: granular
                           allocatedResources:
@@ -4945,31 +6226,6 @@ spec:
                               - type: string
                               pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                               x-kubernetes-int-or-string: true
-                            description: "allocatedResources tracks the resources
-                              allocated to a PVC including its capacity.\nKey names
-                              follow standard Kubernetes label syntax. Valid values
-                              are either:\n\t* Un-prefixed keys:\n\t\t- storage -
-                              the capacity of the volume.\n\t* Custom resources must
-                              use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart
-                              from above values - keys that are unprefixed or have
-                              kubernetes.io prefix are considered\nreserved and hence
-                              may not be used.\n\nCapacity reported here may be larger
-                              than the actual capacity when a volume expansion operation\nis
-                              requested.\nFor storage quota, the larger value from
-                              allocatedResources and PVC.spec.resources is used.\nIf
-                              allocatedResources is not set, PVC.spec.resources alone
-                              is used for quota calculation.\nIf a volume expansion
-                              capacity request is lowered, allocatedResources is only\nlowered
-                              if there are no expansion operations in progress and
-                              if the actual volume capacity\nis equal or lower than
-                              the requested capacity.\n\nA controller that receives
-                              PVC update with previously unknown resourceName\nshould
-                              ignore the update for the purpose it was designed. For
-                              example - a controller that\nonly is responsible for
-                              resizing capacity of the volume, should ignore PVC updates
-                              that change other valid\nresources associated with PVC.\n\nThis
-                              is an alpha field and requires enabling RecoverVolumeExpansionFailure
-                              feature."
                             type: object
                           capacity:
                             additionalProperties:
@@ -4978,47 +6234,23 @@ spec:
                               - type: string
                               pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                               x-kubernetes-int-or-string: true
-                            description: capacity represents the actual resources
-                              of the underlying volume.
                             type: object
                           conditions:
-                            description: |-
-                              conditions is the current Condition of persistent volume claim. If underlying persistent volume is being
-                              resized then the Condition will be set to 'Resizing'.
                             items:
-                              description: PersistentVolumeClaimCondition contains
-                                details about state of pvc
                               properties:
                                 lastProbeTime:
-                                  description: lastProbeTime is the time we probed
-                                    the condition.
                                   format: date-time
                                   type: string
                                 lastTransitionTime:
-                                  description: lastTransitionTime is the time the
-                                    condition transitioned from one status to another.
                                   format: date-time
                                   type: string
                                 message:
-                                  description: message is the human-readable message
-                                    indicating details about last transition.
                                   type: string
                                 reason:
-                                  description: |-
-                                    reason is a unique, this should be a short, machine understandable string that gives the reason
-                                    for condition's last transition. If it reports "Resizing" that means the underlying
-                                    persistent volume is being resized.
                                   type: string
                                 status:
-                                  description: |-
-                                    Status is the status of the condition.
-                                    Can be True, False, Unknown.
-                                    More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required
                                   type: string
                                 type:
-                                  description: |-
-                                    Type is the type of the condition.
-                                    More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about
                                   type: string
                               required:
                               - status
@@ -5029,76 +6261,31 @@ spec:
                             - type
                             x-kubernetes-list-type: map
                           currentVolumeAttributesClassName:
-                            description: |-
-                              currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
-                              When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                              This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                             type: string
                           modifyVolumeStatus:
-                            description: |-
-                              ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
-                              When this is unset, there is no ModifyVolume operation being attempted.
-                              This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                             properties:
                               status:
-                                description: "status is the status of the ControllerModifyVolume
-                                  operation. It can be in any of following states:\n
-                                  - Pending\n   Pending indicates that the PersistentVolumeClaim
-                                  cannot be modified due to unmet requirements, such
-                                  as\n   the specified VolumeAttributesClass not existing.\n
-                                  - InProgress\n   InProgress indicates that the volume
-                                  is being modified.\n - Infeasible\n  Infeasible
-                                  indicates that the request has been rejected as
-                                  invalid by the CSI driver. To\n\t  resolve the error,
-                                  a valid VolumeAttributesClass needs to be specified.\nNote:
-                                  New statuses can be added in the future. Consumers
-                                  should check for unknown statuses and fail appropriately."
                                 type: string
                               targetVolumeAttributesClassName:
-                                description: targetVolumeAttributesClassName is the
-                                  name of the VolumeAttributesClass the PVC currently
-                                  being reconciled
                                 type: string
                             required:
                             - status
                             type: object
                           phase:
-                            description: phase represents the current phase of PersistentVolumeClaim.
                             type: string
                         type: object
                     type: object
                 type: object
               staticScrapeNamespaceSelector:
-                description: |-
-                  StaticScrapeNamespaceSelector defines Namespaces to be selected for VMStaticScrape discovery.
-                  Works in combination with NamespaceSelector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -5112,122 +6299,55 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               staticScrapeRelabelTemplate:
-                description: |-
-                  StaticScrapeRelabelTemplate defines relabel config, that will be added to each VMStaticScrape.
-                  it's useful for adding specific labels to all targets
                 items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
                   properties:
                     action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
                       type: string
                     if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
                       x-kubernetes-preserve-unknown-fields: true
                     labels:
                       additionalProperties:
                         type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
                       type: object
                     match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
                       type: string
                     modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
                       format: int64
                       type: integer
                     regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                       x-kubernetes-preserve-unknown-fields: true
                     replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
                       type: string
                     separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
                       type: string
                     source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       items:
                         type: string
                       type: array
                     sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
                       items:
                         type: string
                       type: array
                     target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       type: string
                     targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
                       type: string
                   type: object
                 type: array
               staticScrapeSelector:
-                description: |-
-                  StaticScrapeSelector defines VMStaticScrape to be selected for target discovery.
-                  Works in combination with NamespaceSelector.
-                  If both nil - match everything.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -5241,325 +6361,152 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               streamAggrConfig:
-                description: StreamAggrConfig defines global stream aggregation configuration
-                  for VMAgent
                 properties:
                   configmap:
-                    description: ConfigMap with stream aggregation rules
                     properties:
                       key:
-                        description: The key to select.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the ConfigMap or its key must
-                          be defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   dedupInterval:
-                    description: Allows setting different de-duplication intervals
-                      per each configured remote storage
                     type: string
                   dropInput:
-                    description: Allow drop all the input samples after the aggregation
                     type: boolean
                   dropInputLabels:
-                    description: labels to drop from samples for aggregator before
-                      stream de-duplication and aggregation
                     items:
                       type: string
                     type: array
                   enableWindows:
-                    description: EnableWindows enables aggregating data in separate
-                      windows ( available from v0.54.0).
                     type: boolean
                   ignoreFirstIntervals:
-                    description: IgnoreFirstIntervals instructs to ignore first interval
                     type: integer
+                  ignoreFirstSampleInterval:
+                    type: string
                   ignoreOldSamples:
-                    description: IgnoreOldSamples instructs to ignore samples with
-                      old timestamps outside the current aggregation interval.
                     type: boolean
                   keepInput:
-                    description: Allows writing both raw and aggregate data
                     type: boolean
                   rules:
-                    description: Stream aggregation rules
                     items:
-                      description: StreamAggrRule defines the rule in stream aggregation
-                        config
                       properties:
                         by:
-                          description: |-
-                            By is an optional list of labels for grouping input series.
-
-                            See also Without.
-
-                            If neither By nor Without are set, then the Outputs are calculated
-                            individually per each input time series.
                           items:
                             type: string
                           type: array
                         dedup_interval:
-                          description: DedupInterval is an optional interval for deduplication.
                           type: string
                         drop_input_labels:
-                          description: |-
-                            DropInputLabels is an optional list with labels, which must be dropped before further processing of input samples.
-
-                            Labels are dropped before de-duplication and aggregation.
                           items:
                             type: string
                           type: array
                         enable_windows:
-                          description: EnableWindows enables aggregating data in separate
-                            windows
                           type: boolean
                         flush_on_shutdown:
-                          description: |-
-                            FlushOnShutdown defines whether to flush the aggregation state on process termination
-                            or config reload. Is `false` by default.
-                            It is not recommended changing this setting, unless unfinished aggregations states
-                            are preferred to missing data points.
                           type: boolean
                         ignore_first_intervals:
                           type: integer
                         ignore_old_samples:
-                          description: IgnoreOldSamples instructs to ignore samples
-                            with old timestamps outside the current aggregation interval.
                           type: boolean
+                        ignoreFirstSampleInterval:
+                          type: string
                         input_relabel_configs:
-                          description: |-
-                            InputRelabelConfigs is an optional relabeling rules, which are applied on the input
-                            before aggregation.
                           items:
-                            description: |-
-                              RelabelConfig allows dynamic rewriting of the label set
-                              More info: https://docs.victoriametrics.com/#relabeling
                             properties:
                               action:
-                                description: Action to perform based on regex matching.
-                                  Default is 'replace'
                                 type: string
                               if:
-                                description: 'If represents metricsQL match expression
-                                  (or list of expressions): ''{__name__=~"foo_.*"}'''
                                 x-kubernetes-preserve-unknown-fields: true
                               labels:
                                 additionalProperties:
                                   type: string
-                                description: 'Labels is used together with Match for
-                                  `action: graphite`'
                                 type: object
                               match:
-                                description: 'Match is used together with Labels for
-                                  `action: graphite`'
                                 type: string
                               modulus:
-                                description: Modulus to take of the hash of the source
-                                  label values.
                                 format: int64
                                 type: integer
                               regex:
-                                description: |-
-                                  Regular expression against which the extracted value is matched. Default is '(.*)'
-                                  victoriaMetrics supports multiline regex joined with |
-                                  https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                                 x-kubernetes-preserve-unknown-fields: true
                               replacement:
-                                description: |-
-                                  Replacement value against which a regex replace is performed if the
-                                  regular expression matches. Regex capture groups are available. Default is '$1'
                                 type: string
                               separator:
-                                description: Separator placed between concatenated
-                                  source label values. default is ';'.
                                 type: string
                               source_labels:
-                                description: |-
-                                  UnderScoreSourceLabels - additional form of source labels source_labels
-                                  for compatibility with original relabel config.
-                                  if set  both sourceLabels and source_labels, sourceLabels has priority.
-                                  for details https://github.com/VictoriaMetrics/operator/issues/131
                                 items:
                                   type: string
                                 type: array
                               sourceLabels:
-                                description: |-
-                                  The source labels select values from existing labels. Their content is concatenated
-                                  using the configured separator and matched against the configured regular expression
-                                  for the replace, keep, and drop actions.
                                 items:
                                   type: string
                                 type: array
                               target_label:
-                                description: |-
-                                  UnderScoreTargetLabel - additional form of target label - target_label
-                                  for compatibility with original relabel config.
-                                  if set  both targetLabel and target_label, targetLabel has priority.
-                                  for details https://github.com/VictoriaMetrics/operator/issues/131
                                 type: string
                               targetLabel:
-                                description: |-
-                                  Label to which the resulting value is written in a replace action.
-                                  It is mandatory for replace actions. Regex capture groups are available.
                                 type: string
                             type: object
                           type: array
                         interval:
-                          description: Interval is the interval between aggregations.
                           type: string
                         keep_metric_names:
-                          description: KeepMetricNames instructs to leave metric names
-                            as is for the output time series without adding any suffix.
                           type: boolean
                         match:
-                          description: |-
-                            Match is a label selector (or list of label selectors) for filtering time series for the given selector.
-
-                            If the match isn't set, then all the input time series are processed.
                           x-kubernetes-preserve-unknown-fields: true
                         no_align_flush_to_interval:
-                          description: |-
-                            NoAlignFlushToInterval disables aligning of flushes to multiples of Interval.
-                            By default flushes are aligned to Interval.
                           type: boolean
                         output_relabel_configs:
-                          description: |-
-                            OutputRelabelConfigs is an optional relabeling rules, which are applied
-                            on the aggregated output before being sent to remote storage.
                           items:
-                            description: |-
-                              RelabelConfig allows dynamic rewriting of the label set
-                              More info: https://docs.victoriametrics.com/#relabeling
                             properties:
                               action:
-                                description: Action to perform based on regex matching.
-                                  Default is 'replace'
                                 type: string
                               if:
-                                description: 'If represents metricsQL match expression
-                                  (or list of expressions): ''{__name__=~"foo_.*"}'''
                                 x-kubernetes-preserve-unknown-fields: true
                               labels:
                                 additionalProperties:
                                   type: string
-                                description: 'Labels is used together with Match for
-                                  `action: graphite`'
                                 type: object
                               match:
-                                description: 'Match is used together with Labels for
-                                  `action: graphite`'
                                 type: string
                               modulus:
-                                description: Modulus to take of the hash of the source
-                                  label values.
                                 format: int64
                                 type: integer
                               regex:
-                                description: |-
-                                  Regular expression against which the extracted value is matched. Default is '(.*)'
-                                  victoriaMetrics supports multiline regex joined with |
-                                  https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                                 x-kubernetes-preserve-unknown-fields: true
                               replacement:
-                                description: |-
-                                  Replacement value against which a regex replace is performed if the
-                                  regular expression matches. Regex capture groups are available. Default is '$1'
                                 type: string
                               separator:
-                                description: Separator placed between concatenated
-                                  source label values. default is ';'.
                                 type: string
                               source_labels:
-                                description: |-
-                                  UnderScoreSourceLabels - additional form of source labels source_labels
-                                  for compatibility with original relabel config.
-                                  if set  both sourceLabels and source_labels, sourceLabels has priority.
-                                  for details https://github.com/VictoriaMetrics/operator/issues/131
                                 items:
                                   type: string
                                 type: array
                               sourceLabels:
-                                description: |-
-                                  The source labels select values from existing labels. Their content is concatenated
-                                  using the configured separator and matched against the configured regular expression
-                                  for the replace, keep, and drop actions.
                                 items:
                                   type: string
                                 type: array
                               target_label:
-                                description: |-
-                                  UnderScoreTargetLabel - additional form of target label - target_label
-                                  for compatibility with original relabel config.
-                                  if set  both targetLabel and target_label, targetLabel has priority.
-                                  for details https://github.com/VictoriaMetrics/operator/issues/131
                                 type: string
                               targetLabel:
-                                description: |-
-                                  Label to which the resulting value is written in a replace action.
-                                  It is mandatory for replace actions. Regex capture groups are available.
                                 type: string
                             type: object
                           type: array
                         outputs:
-                          description: |-
-                            Outputs is a list of output aggregate functions to produce.
-
-                            The following names are allowed:
-
-                            - total - aggregates input counters
-                            - increase - counts the increase over input counters
-                            - count_series - counts the input series
-                            - count_samples - counts the input samples
-                            - sum_samples - sums the input samples
-                            - last - the last biggest sample value
-                            - min - the minimum sample value
-                            - max - the maximum sample value
-                            - avg - the average value across all the samples
-                            - stddev - standard deviation across all the samples
-                            - stdvar - standard variance across all the samples
-                            - histogram_bucket - creates VictoriaMetrics histogram for input samples
-                            - quantiles(phi1, ..., phiN) - quantiles' estimation for phi in the range [0..1]
-
-                            The output time series will have the following names:
-
-                              input_name:aggr_<interval>_<output>
                           items:
                             type: string
                           type: array
                         staleness_interval:
-                          description: |-
-                            Staleness interval is interval after which the series state will be reset if no samples have been sent during it.
-                            The parameter is only relevant for outputs: total, total_prometheus, increase, increase_prometheus and histogram_bucket.
                           type: string
                         without:
-                          description: |-
-                            Without is an optional list of labels, which must be excluded when grouping input series.
-
-                            See also By.
-
-                            If neither By nor Without are set, then the Outputs are calculated
-                            individually per each input time series.
                           items:
                             type: string
                           type: array
@@ -5570,58 +6517,26 @@ spec:
                     type: array
                 type: object
               terminationGracePeriodSeconds:
-                description: TerminationGracePeriodSeconds period for container graceful
-                  termination
                 format: int64
                 type: integer
               tolerations:
-                description: Tolerations If specified, the pod's tolerations.
                 items:
-                  description: |-
-                    The pod this Toleration is attached to tolerates any taint that matches
-                    the triple <key,value,effect> using the matching operator <operator>.
                   properties:
                     effect:
-                      description: |-
-                        Effect indicates the taint effect to match. Empty means match all taint effects.
-                        When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                       type: string
                     key:
-                      description: |-
-                        Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                        If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                       type: string
                     operator:
-                      description: |-
-                        Operator represents a key's relationship to the value.
-                        Valid operators are Exists and Equal. Defaults to Equal.
-                        Exists is equivalent to wildcard for value, so that a pod can
-                        tolerate all taints of a particular category.
                       type: string
                     tolerationSeconds:
-                      description: |-
-                        TolerationSeconds represents the period of time the toleration (which must be
-                        of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                        it is not set, which means tolerate the taint forever (do not evict). Zero and
-                        negative values will be treated as 0 (evict immediately) by the system.
                       format: int64
                       type: integer
                     value:
-                      description: |-
-                        Value is the taint value the toleration matches to.
-                        If the operator is Exists, the value should be empty, otherwise just a regular string.
                       type: string
                   type: object
                 type: array
               topologySpreadConstraints:
-                description: |-
-                  TopologySpreadConstraints embedded kubernetes pod configuration option,
-                  controls how pods are spread across your cluster among failure-domains
-                  such as regions, zones, nodes, and other user-defined topology domains
-                  https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
                 items:
-                  description: TopologySpreadConstraint specifies how to spread matching
-                    pods among the given topology.
                   required:
                   - maxSkew
                   - topologyKey
@@ -5630,97 +6545,34 @@ spec:
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               updateStrategy:
-                description: |-
-                  UpdateStrategy - overrides default update strategy.
-                  works only for deployments, statefulset always use OnDelete.
                 enum:
                 - Recreate
                 - RollingUpdate
                 type: string
               useDefaultResources:
-                description: |-
-                  UseDefaultResources controls resource settings
-                  By default, operator sets built-in resource requirements
                 type: boolean
               useStrictSecurity:
-                description: |-
-                  UseStrictSecurity enables strict security mode for component
-                  it restricts disk writes access
-                  uses non-root user out of the box
-                  drops not needed security permissions
                 type: boolean
               useVMConfigReloader:
-                description: |-
-                  UseVMConfigReloader replaces prometheus-like config-reloader
-                  with vm one. It uses secrets watch instead of file watch
-                  which greatly increases speed of config updates
                 type: boolean
               vmAgentExternalLabelName:
-                description: |-
-                  VMAgentExternalLabelName Name of vmAgent external label used to denote vmAgent instance
-                  name. Defaults to the value of `prometheus`. External label will
-                  _not_ be added when value is set to empty string (`""`).
                 type: string
               volumeMounts:
-                description: |-
-                  VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
-                  VolumeMounts specified will be appended to other VolumeMounts in the Application container
                 items:
-                  description: VolumeMount describes a mounting of a Volume within
-                    a container.
                   properties:
                     mountPath:
-                      description: |-
-                        Path within the container at which the volume should be mounted.  Must
-                        not contain ':'.
                       type: string
                     mountPropagation:
-                      description: |-
-                        mountPropagation determines how mounts are propagated from the host
-                        to container and the other way around.
-                        When not set, MountPropagationNone is used.
-                        This field is beta in 1.10.
-                        When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                        (which defaults to None).
                       type: string
                     name:
-                      description: This must match the Name of a Volume.
                       type: string
                     readOnly:
-                      description: |-
-                        Mounted read-only if true, read-write otherwise (false or unspecified).
-                        Defaults to false.
                       type: boolean
                     recursiveReadOnly:
-                      description: |-
-                        RecursiveReadOnly specifies whether read-only mounts should be handled
-                        recursively.
-
-                        If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                        If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                        recursively read-only.  If this field is set to IfPossible, the mount is made
-                        recursively read-only, if it is supported by the container runtime.  If this
-                        field is set to Enabled, the mount is made recursively read-only if it is
-                        supported by the container runtime, otherwise the pod will not be started and
-                        an error will be generated to indicate the reason.
-
-                        If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                        None (or be unspecified, which defaults to None).
-
-                        If this field is not specified, it is treated as an equivalent of Disabled.
                       type: string
                     subPath:
-                      description: |-
-                        Path within the volume from which the container's volume should be mounted.
-                        Defaults to "" (volume's root).
                       type: string
                     subPathExpr:
-                      description: |-
-                        Expanded path within the volume from which the container's volume should be mounted.
-                        Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                        Defaults to "" (volume's root).
-                        SubPathExpr and SubPath are mutually exclusive.
                       type: string
                   required:
                   - mountPath
@@ -5728,13 +6580,7 @@ spec:
                   type: object
                 type: array
               volumes:
-                description: |-
-                  Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
-                  Volumes specified will be appended to other volumes that are generated.
-                  / +optional
                 items:
-                  description: Volume represents a named volume in a pod that may
-                    be accessed by any container in the pod.
                   required:
                   - name
                   type: object
@@ -5744,58 +6590,34 @@ spec:
             - remoteWrite
             type: object
           status:
-            description: VMAgentStatus defines the observed state of VMAgent
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -5810,28 +6632,19 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               replicas:
-                description: ReplicaCount Total number of pods targeted by this VMAgent
                 format: int32
                 type: integer
               selector:
-                description: Selector string form of label value set for autoscaling
                 type: string
               shards:
-                description: Shards represents total number of vmagent deployments
-                  with uniq scrape targets
                 format: int32
                 type: integer
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -5848,7 +6661,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmalertmanagerconfigs.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -5872,180 +6685,90 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: VMAlertmanagerConfig is the Schema for the vmalertmanagerconfigs
-          API
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: |-
-              VMAlertmanagerConfigSpec defines configuration for VMAlertmanagerConfig
-              it must reference only locally defined objects
             properties:
               inhibit_rules:
-                description: |-
-                  InhibitRules will only apply for alerts matching
-                  the resource's namespace.
                 items:
-                  description: |-
-                    InhibitRule defines an inhibition rule that allows to mute alerts when other
-                    alerts are already firing.
-                    Note, it doesn't support deprecated alertmanager config options.
-                    See https://prometheus.io/docs/alerting/latest/configuration/#inhibit_rule
                   properties:
                     equal:
-                      description: |-
-                        Labels that must have an equal value in the source and target alert for
-                        the inhibition to take effect.
                       items:
                         type: string
                       type: array
                     source_matchers:
-                      description: |-
-                        SourceMatchers defines a list of matchers for which one or more alerts have
-                        to exist for the inhibition to take effect.
                       items:
                         type: string
                       type: array
                     target_matchers:
-                      description: |-
-                        TargetMatchers defines a list of matchers that have to be fulfilled by the target
-                        alerts to be muted.
                       items:
                         type: string
                       type: array
                   type: object
                 type: array
               receivers:
-                description: Receivers defines alert receivers
                 items:
-                  description: Receiver defines one or more notification integrations.
                   properties:
                     discord_configs:
                       items:
                         properties:
                           avatar_url:
-                            description: |-
-                              AvatarURL defines message avatar URL
-                              Available from operator v0.55.0 and alertmanager v0.28.0
                             type: string
                           content:
-                            description: |-
-                              Content defines message content template
-                              Available from operator v0.55.0 and alertmanager v0.28.0
                             maxLength: 2000
                             type: string
                           http_config:
-                            description: HTTP client configuration.
                             properties:
                               authorization:
-                                description: |-
-                                  Authorization header configuration for the client.
-                                  This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+.
                                 properties:
                                   credentials:
-                                    description: Reference to the secret with value
-                                      for authorization
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   credentialsFile:
-                                    description: File with value for authorization
                                     type: string
                                   type:
-                                    description: Type of authorization, default to
-                                      bearer
                                     type: string
                                 type: object
                               basic_auth:
-                                description: BasicAuth for the client.
                                 properties:
                                   password:
-                                    description: |-
-                                      Password defines reference for secret with password value
-                                      The secret needs to be in the same namespace as scrape object
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   password_file:
-                                    description: |-
-                                      PasswordFile defines path to password file at disk
-                                      must be pre-mounted
                                     type: string
                                   username:
-                                    description: |-
-                                      Username defines reference for secret with username value
-                                      The secret needs to be in the same namespace as scrape object
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
@@ -6053,88 +6776,45 @@ spec:
                                     x-kubernetes-map-type: atomic
                                 type: object
                               bearer_token_file:
-                                description: BearerTokenFile defines filename for
-                                  bearer token, it must be mounted to pod.
                                 type: string
                               bearer_token_secret:
-                                description: |-
-                                  The secret's key that contains the bearer token
-                                  It must be at them same namespace as CRD
                                 properties:
                                   key:
-                                    description: The key of the secret to select from.  Must
-                                      be a valid secret key.
                                     type: string
                                   name:
                                     default: ""
-                                    description: |-
-                                      Name of the referent.
-                                      This field is effectively required, but due to backwards compatibility is
-                                      allowed to be empty. Instances of this type with an empty value here are
-                                      almost certainly wrong.
-                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                     type: string
                                   optional:
-                                    description: Specify whether the Secret or its
-                                      key must be defined
                                     type: boolean
                                 required:
                                 - key
                                 type: object
                                 x-kubernetes-map-type: atomic
                               oauth2:
-                                description: OAuth2 client credentials used to fetch
-                                  a token for the targets.
                                 properties:
                                   client_id:
-                                    description: The secret or configmap containing
-                                      the OAuth2 client id
                                     properties:
                                       configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
                                         properties:
                                           key:
-                                            description: The key to select.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       secret:
-                                        description: Secret containing data to use
-                                          for the targets.
                                         properties:
                                           key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
@@ -6142,60 +6822,33 @@ spec:
                                         x-kubernetes-map-type: atomic
                                     type: object
                                   client_secret:
-                                    description: The secret containing the OAuth2
-                                      client secret
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   client_secret_file:
-                                    description: ClientSecretFile defines path for
-                                      client secret file.
                                     type: string
                                   endpoint_params:
                                     additionalProperties:
                                       type: string
-                                    description: Parameters to append to the token
-                                      URL
                                     type: object
                                   proxy_url:
-                                    description: |-
-                                      The proxy URL for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
                                     type: string
                                   scopes:
-                                    description: OAuth2 scopes used for the token
-                                      request
                                     items:
                                       type: string
                                     type: array
                                   tls_config:
-                                    description: |-
-                                      TLSConfig for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
                                     x-kubernetes-preserve-unknown-fields: true
                                   token_url:
-                                    description: The URL to fetch the token from
                                     minLength: 1
                                     type: string
                                 required:
@@ -6203,60 +6856,32 @@ spec:
                                 - token_url
                                 type: object
                               proxyURL:
-                                description: Optional proxy URL.
                                 type: string
                               tls_config:
-                                description: TLS configuration for the client.
                                 properties:
                                   ca:
-                                    description: Struct containing the CA cert to
-                                      use for the targets.
                                     properties:
                                       configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
                                         properties:
                                           key:
-                                            description: The key to select.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       secret:
-                                        description: Secret containing data to use
-                                          for the targets.
                                         properties:
                                           key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
@@ -6264,58 +6889,30 @@ spec:
                                         x-kubernetes-map-type: atomic
                                     type: object
                                   caFile:
-                                    description: Path to the CA cert in the container
-                                      to use for the targets.
                                     type: string
                                   cert:
-                                    description: Struct containing the client cert
-                                      file for the targets.
                                     properties:
                                       configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
                                         properties:
                                           key:
-                                            description: The key to select.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       secret:
-                                        description: Secret containing data to use
-                                          for the targets.
                                         properties:
                                           key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
@@ -6323,89 +6920,46 @@ spec:
                                         x-kubernetes-map-type: atomic
                                     type: object
                                   certFile:
-                                    description: Path to the client cert file in the
-                                      container for the targets.
                                     type: string
                                   insecureSkipVerify:
-                                    description: Disable target certificate validation.
                                     type: boolean
                                   keyFile:
-                                    description: Path to the client key file in the
-                                      container for the targets.
                                     type: string
                                   keySecret:
-                                    description: Secret containing the client key
-                                      file for the targets.
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   serverName:
-                                    description: Used to verify the hostname for the
-                                      targets.
                                     type: string
                                 type: object
                             type: object
                           message:
-                            description: The message body template
                             type: string
                           send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
                             type: boolean
                           title:
-                            description: The message title template
                             type: string
                           username:
-                            description: |-
-                              Username defines message username
-                              Available from operator v0.55.0 and alertmanager v0.28.0
                             type: string
                           webhook_url:
-                            description: |-
-                              The discord webhook URL
-                              one of `urlSecret` and `url` must be defined.
                             type: string
                           webhook_url_secret:
-                            description: |-
-                              URLSecret defines secret name and key at the CRD namespace.
-                              It must contain the webhook URL.
-                              one of `urlSecret` and `url` must be defined.
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
@@ -6414,153 +6968,81 @@ spec:
                         type: object
                       type: array
                     email_configs:
-                      description: EmailConfigs defines email notification configurations.
                       items:
-                        description: EmailConfig configures notifications via Email.
                         properties:
                           auth_identity:
-                            description: The identity to use for authentication.
                             type: string
                           auth_password:
-                            description: AuthPassword defines secret name and key
-                              at CRD namespace.
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
                             type: object
                             x-kubernetes-map-type: atomic
                           auth_secret:
-                            description: |-
-                              AuthSecret defines secrent name and key at CRD namespace.
-                              It must contain the CRAM-MD5 secret.
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
                             type: object
                             x-kubernetes-map-type: atomic
                           auth_username:
-                            description: The username to use for authentication.
                             type: string
                           from:
-                            description: |-
-                              The sender address.
-                              fallback to global setting if empty
                             type: string
                           headers:
                             additionalProperties:
                               type: string
-                            description: |-
-                              Further headers email header key/value pairs. Overrides any headers
-                              previously set by the notification implementation.
                             type: object
                           hello:
-                            description: The hostname to identify to the SMTP server.
                             type: string
                           html:
-                            description: The HTML body of the email notification.
                             type: string
                           require_tls:
-                            description: |-
-                              The SMTP TLS requirement.
-                              Note that Go does not support unencrypted connections to remote SMTP endpoints.
                             type: boolean
                           send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
                             type: boolean
                           smarthost:
-                            description: |-
-                              The SMTP host through which emails are sent.
-                              fallback to global setting if empty
                             type: string
                           text:
-                            description: The text body of the email notification.
                             type: string
                           tls_config:
-                            description: TLS configuration
                             properties:
                               ca:
-                                description: Struct containing the CA cert to use
-                                  for the targets.
                                 properties:
                                   configMap:
-                                    description: ConfigMap containing data to use
-                                      for the targets.
                                     properties:
                                       key:
-                                        description: The key to select.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the ConfigMap
-                                          or its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   secret:
-                                    description: Secret containing data to use for
-                                      the targets.
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
@@ -6568,57 +7050,30 @@ spec:
                                     x-kubernetes-map-type: atomic
                                 type: object
                               caFile:
-                                description: Path to the CA cert in the container
-                                  to use for the targets.
                                 type: string
                               cert:
-                                description: Struct containing the client cert file
-                                  for the targets.
                                 properties:
                                   configMap:
-                                    description: ConfigMap containing data to use
-                                      for the targets.
                                     properties:
                                       key:
-                                        description: The key to select.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the ConfigMap
-                                          or its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   secret:
-                                    description: Secret containing data to use for
-                                      the targets.
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
@@ -6626,121 +7081,94 @@ spec:
                                     x-kubernetes-map-type: atomic
                                 type: object
                               certFile:
-                                description: Path to the client cert file in the container
-                                  for the targets.
                                 type: string
                               insecureSkipVerify:
-                                description: Disable target certificate validation.
                                 type: boolean
                               keyFile:
-                                description: Path to the client key file in the container
-                                  for the targets.
                                 type: string
                               keySecret:
-                                description: Secret containing the client key file
-                                  for the targets.
                                 properties:
                                   key:
-                                    description: The key of the secret to select from.  Must
-                                      be a valid secret key.
                                     type: string
                                   name:
                                     default: ""
-                                    description: |-
-                                      Name of the referent.
-                                      This field is effectively required, but due to backwards compatibility is
-                                      allowed to be empty. Instances of this type with an empty value here are
-                                      almost certainly wrong.
-                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                     type: string
                                   optional:
-                                    description: Specify whether the Secret or its
-                                      key must be defined
                                     type: boolean
                                 required:
                                 - key
                                 type: object
                                 x-kubernetes-map-type: atomic
                               serverName:
-                                description: Used to verify the hostname for the targets.
                                 type: string
                             type: object
                           to:
-                            description: The email address to send notifications to.
+                            type: string
+                        type: object
+                      type: array
+                    incidentio_configs:
+                      items:
+                        properties:
+                          alert_source_token:
+                            properties:
+                              key:
+                                type: string
+                              name:
+                                default: ""
+                                type: string
+                              optional:
+                                type: boolean
+                            required:
+                            - key
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          http_config:
+                            x-kubernetes-preserve-unknown-fields: true
+                          max_alerts:
+                            type: integer
+                          send_resolved:
+                            type: boolean
+                          timeout:
+                            type: string
+                          url:
                             type: string
                         type: object
                       type: array
                     jira_configs:
                       items:
-                        description: |-
-                          JiraConfig represent alertmanager's jira_config entry
-                          https://prometheus.io/docs/alerting/latest/configuration/#jira_config
-                          available from v0.55.0 operator version
-                          and v0.28.0 alertmanager version
                         properties:
                           api_url:
-                            description: |-
-                              The URL to send API requests to. The full API path must be included.
-                              Example: https://company.atlassian.net/rest/api/2/
                             type: string
                           custom_fields:
                             additionalProperties:
                               x-kubernetes-preserve-unknown-fields: true
-                            description: |-
-                              Other issue and custom fields.
-                              Jira issue field can have multiple types.
-                              Depends on the field type, the values must be provided differently.
-                              See https://developer.atlassian.com/server/jira/platform/jira-rest-api-examples/#setting-custom-field-data-for-other-field-types for further examples.
                             type: object
                           description:
-                            description: Issue description template.
                             type: string
                           http_config:
-                            description: |-
-                              The HTTP client's configuration. You must use this configuration to supply the personal access token (PAT) as part of the HTTP `Authorization` header.
-                              For Jira Cloud, use basic_auth with the email address as the username and the PAT as the password.
-                              For Jira Data Center, use the 'authorization' field with 'credentials: <PAT value>'.
                             x-kubernetes-preserve-unknown-fields: true
                           issue_type:
-                            description: Type of the issue (e.g. Bug)
                             type: string
                           labels:
-                            description: Labels to be added to the issue
                             items:
                               type: string
                             type: array
                           priority:
-                            description: Priority of the issue
                             type: string
                           project:
-                            description: The project key where issues are created
                             type: string
                           reopen_duration:
-                            description: |-
-                              If reopen_transition is defined, reopen the issue when it is not older than this value (rounded down to the nearest minute).
-                              The resolutiondate field is used to determine the age of the issue.
                             pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$
                             type: string
                           reopen_transition:
-                            description: |-
-                              Name of the workflow transition to resolve an issue.
-                              The target status must have the category "done".
                             type: string
                           resolve_transition:
-                            description: |-
-                              Name of the workflow transition to reopen an issue.
-                              The target status should not have the category "done".
                             type: string
                           send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
                             type: boolean
                           summary:
-                            description: Issue summary template
                             type: string
                           wont_fix_resolution:
-                            description: If reopen_transition is defined, ignore issues
-                              with that resolution.
                             type: string
                         required:
                         - issue_type
@@ -6751,101 +7179,52 @@ spec:
                       items:
                         properties:
                           http_config:
-                            description: HTTP client configuration.
                             properties:
                               authorization:
-                                description: |-
-                                  Authorization header configuration for the client.
-                                  This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+.
                                 properties:
                                   credentials:
-                                    description: Reference to the secret with value
-                                      for authorization
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   credentialsFile:
-                                    description: File with value for authorization
                                     type: string
                                   type:
-                                    description: Type of authorization, default to
-                                      bearer
                                     type: string
                                 type: object
                               basic_auth:
-                                description: BasicAuth for the client.
                                 properties:
                                   password:
-                                    description: |-
-                                      Password defines reference for secret with password value
-                                      The secret needs to be in the same namespace as scrape object
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   password_file:
-                                    description: |-
-                                      PasswordFile defines path to password file at disk
-                                      must be pre-mounted
                                     type: string
                                   username:
-                                    description: |-
-                                      Username defines reference for secret with username value
-                                      The secret needs to be in the same namespace as scrape object
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
@@ -6853,88 +7232,45 @@ spec:
                                     x-kubernetes-map-type: atomic
                                 type: object
                               bearer_token_file:
-                                description: BearerTokenFile defines filename for
-                                  bearer token, it must be mounted to pod.
                                 type: string
                               bearer_token_secret:
-                                description: |-
-                                  The secret's key that contains the bearer token
-                                  It must be at them same namespace as CRD
                                 properties:
                                   key:
-                                    description: The key of the secret to select from.  Must
-                                      be a valid secret key.
                                     type: string
                                   name:
                                     default: ""
-                                    description: |-
-                                      Name of the referent.
-                                      This field is effectively required, but due to backwards compatibility is
-                                      allowed to be empty. Instances of this type with an empty value here are
-                                      almost certainly wrong.
-                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                     type: string
                                   optional:
-                                    description: Specify whether the Secret or its
-                                      key must be defined
                                     type: boolean
                                 required:
                                 - key
                                 type: object
                                 x-kubernetes-map-type: atomic
                               oauth2:
-                                description: OAuth2 client credentials used to fetch
-                                  a token for the targets.
                                 properties:
                                   client_id:
-                                    description: The secret or configmap containing
-                                      the OAuth2 client id
                                     properties:
                                       configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
                                         properties:
                                           key:
-                                            description: The key to select.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       secret:
-                                        description: Secret containing data to use
-                                          for the targets.
                                         properties:
                                           key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
@@ -6942,60 +7278,33 @@ spec:
                                         x-kubernetes-map-type: atomic
                                     type: object
                                   client_secret:
-                                    description: The secret containing the OAuth2
-                                      client secret
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   client_secret_file:
-                                    description: ClientSecretFile defines path for
-                                      client secret file.
                                     type: string
                                   endpoint_params:
                                     additionalProperties:
                                       type: string
-                                    description: Parameters to append to the token
-                                      URL
                                     type: object
                                   proxy_url:
-                                    description: |-
-                                      The proxy URL for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
                                     type: string
                                   scopes:
-                                    description: OAuth2 scopes used for the token
-                                      request
                                     items:
                                       type: string
                                     type: array
                                   tls_config:
-                                    description: |-
-                                      TLSConfig for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
                                     x-kubernetes-preserve-unknown-fields: true
                                   token_url:
-                                    description: The URL to fetch the token from
                                     minLength: 1
                                     type: string
                                 required:
@@ -7003,60 +7312,32 @@ spec:
                                 - token_url
                                 type: object
                               proxyURL:
-                                description: Optional proxy URL.
                                 type: string
                               tls_config:
-                                description: TLS configuration for the client.
                                 properties:
                                   ca:
-                                    description: Struct containing the CA cert to
-                                      use for the targets.
                                     properties:
                                       configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
                                         properties:
                                           key:
-                                            description: The key to select.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       secret:
-                                        description: Secret containing data to use
-                                          for the targets.
                                         properties:
                                           key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
@@ -7064,58 +7345,30 @@ spec:
                                         x-kubernetes-map-type: atomic
                                     type: object
                                   caFile:
-                                    description: Path to the CA cert in the container
-                                      to use for the targets.
                                     type: string
                                   cert:
-                                    description: Struct containing the client cert
-                                      file for the targets.
                                     properties:
                                       configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
                                         properties:
                                           key:
-                                            description: The key to select.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       secret:
-                                        description: Secret containing data to use
-                                          for the targets.
                                         properties:
                                           key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
@@ -7123,84 +7376,44 @@ spec:
                                         x-kubernetes-map-type: atomic
                                     type: object
                                   certFile:
-                                    description: Path to the client cert file in the
-                                      container for the targets.
                                     type: string
                                   insecureSkipVerify:
-                                    description: Disable target certificate validation.
                                     type: boolean
                                   keyFile:
-                                    description: Path to the client key file in the
-                                      container for the targets.
                                     type: string
                                   keySecret:
-                                    description: Secret containing the client key
-                                      file for the targets.
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   serverName:
-                                    description: Used to verify the hostname for the
-                                      targets.
                                     type: string
                                 type: object
                             type: object
                           send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
                             type: boolean
                           text:
-                            description: The text body of the teams notification.
                             type: string
                           title:
-                            description: The title of the teams notification.
                             type: string
                           webhook_url:
-                            description: |-
-                              The incoming webhook URL
-                              one of `urlSecret` and `url` must be defined.
                             type: string
                           webhook_url_secret:
-                            description: |-
-                              URLSecret defines secret name and key at the CRD namespace.
-                              It must contain the webhook URL.
-                              one of `urlSecret` and `url` must be defined.
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
@@ -7210,51 +7423,25 @@ spec:
                       type: array
                     msteamsv2_configs:
                       items:
-                        description: |-
-                          MSTeamsV2Config sends notifications using the new message format with adaptive cards as required by flows.
-                          https://support.microsoft.com/en-gb/office/create-incoming-webhooks-with-workflows-for-microsoft-teams-8ae491c7-0394-4861-ba59-055e33f75498
-                          available from v0.55.0 operator version
-                          and v0.28.0 alertmanager version
                         properties:
                           http_config:
                             x-kubernetes-preserve-unknown-fields: true
                           send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
                             type: boolean
                           text:
-                            description: Message body template.
                             type: string
                           title:
-                            description: Message title template.
                             type: string
                           webhook_url:
-                            description: |-
-                              The incoming webhook URL
-                              one of `urlSecret` and `url` must be defined.
                             type: string
                           webhook_url_secret:
-                            description: |-
-                              URLSecret defines secret name and key at the CRD namespace.
-                              It must contain the webhook URL.
-                              one of `webhook_url` or `webhook_url_secret` must be defined.
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
@@ -7263,165 +7450,95 @@ spec:
                         type: object
                       type: array
                     name:
-                      description: Name of the receiver. Must be unique across all
-                        items from the list.
                       minLength: 1
                       type: string
                     opsgenie_configs:
-                      description: OpsGenieConfigs defines ops genie notification
-                        configurations.
                       items:
-                        description: |-
-                          OpsGenieConfig configures notifications via OpsGenie.
-                          See https://prometheus.io/docs/alerting/latest/configuration/#opsgenie_config
                         properties:
                           actions:
-                            description: Comma separated list of actions that will
-                              be available for the alert.
                             type: string
                           api_key:
-                            description: |-
-                              The secret's key that contains the OpsGenie API key.
-                              It must be at them same namespace as CRD
-                              fallback to global setting if empty
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
                             type: object
                             x-kubernetes-map-type: atomic
                           apiURL:
-                            description: The URL to send OpsGenie API requests to.
                             type: string
                           description:
-                            description: Description of the incident.
                             type: string
                           details:
                             additionalProperties:
                               type: string
-                            description: A set of arbitrary key/value pairs that provide
-                              further detail about the incident.
                             type: object
                           entity:
-                            description: Optional field that can be used to specify
-                              which domain alert is related to.
                             type: string
                           http_config:
-                            description: HTTP client configuration.
                             type: object
                             x-kubernetes-preserve-unknown-fields: true
                           message:
-                            description: Alert text limited to 130 characters.
                             type: string
                           note:
-                            description: Additional alert note.
                             type: string
                           priority:
-                            description: Priority level of alert. Possible values
-                              are P1, P2, P3, P4, and P5.
                             type: string
                           responders:
-                            description: List of responders responsible for notifications.
                             items:
-                              description: |-
-                                OpsGenieConfigResponder defines a responder to an incident.
-                                One of `id`, `name` or `username` has to be defined.
                               properties:
                                 id:
-                                  description: ID of the responder.
                                   type: string
                                 name:
-                                  description: Name of the responder.
                                   type: string
                                 type:
-                                  description: Type of responder.
                                   minLength: 1
                                   type: string
                                 username:
-                                  description: Username of the responder.
                                   type: string
                               required:
                               - type
                               type: object
                             type: array
                           send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
                             type: boolean
                           source:
-                            description: Backlink to the sender of the notification.
                             type: string
                           tags:
-                            description: Comma separated list of tags attached to
-                              the notifications.
                             type: string
                           update_alerts:
-                            description: |-
-                              Whether to update message and description of the alert in OpsGenie if it already exists
-                              By default, the alert is never updated in OpsGenie, the new message only appears in activity log.
                             type: boolean
                         type: object
                       type: array
                     pagerduty_configs:
-                      description: PagerDutyConfigs defines pager duty notification
-                        configurations.
                       items:
-                        description: |-
-                          PagerDutyConfig configures notifications via PagerDuty.
-                          See https://prometheus.io/docs/alerting/latest/configuration/#pagerduty_config
                         properties:
                           class:
-                            description: The class/type of the event.
                             type: string
                           client:
-                            description: Client identification.
                             type: string
                           client_url:
-                            description: Backlink to the sender of notification.
                             type: string
                           component:
-                            description: The part or component of the affected system
-                              that is broken.
                             type: string
                           description:
-                            description: Description of the incident.
                             type: string
                           details:
                             additionalProperties:
                               type: string
-                            description: Arbitrary key/value pairs that provide further
-                              detail about the incident.
                             type: object
                           group:
-                            description: A cluster or grouping of sources.
                             type: string
                           http_config:
-                            description: HTTP client configuration.
                             type: object
                             x-kubernetes-preserve-unknown-fields: true
                           images:
-                            description: Images to attach to the incident.
                             items:
-                              description: |-
-                                ImageConfig is used to attach images to the incident.
-                                See https://developer.pagerduty.com/docs/ZG9jOjExMDI5NTgx-send-an-alert-event#the-images-property
-                                for more information.
                               properties:
                                 alt:
                                   type: string
@@ -7434,12 +7551,7 @@ spec:
                               type: object
                             type: array
                           links:
-                            description: Links to attach to the incident.
                             items:
-                              description: |-
-                                LinkConfig is used to attach text links to the incident.
-                                See https://developer.pagerduty.com/docs/ZG9jOjExMDI5NTgx-send-an-alert-event#the-links-property
-                                for more information.
                               properties:
                                 href:
                                   type: string
@@ -7450,170 +7562,86 @@ spec:
                               type: object
                             type: array
                           routing_key:
-                            description: |-
-                              The secret's key that contains the PagerDuty integration key (when using
-                              Events API v2). Either this field or `serviceKey` needs to be defined.
-                              It must be at them same namespace as CRD
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
                             type: object
                             x-kubernetes-map-type: atomic
                           send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
                             type: boolean
                           service_key:
-                            description: |-
-                              The secret's key that contains the PagerDuty service key (when using
-                              integration type "Prometheus"). Either this field or `routingKey` needs to
-                              be defined.
-                              It must be at them same namespace as CRD
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
                             type: object
                             x-kubernetes-map-type: atomic
                           severity:
-                            description: Severity of the incident.
                             type: string
                           url:
-                            description: The URL to send requests to.
                             type: string
                         type: object
                       type: array
                     pushover_configs:
-                      description: PushoverConfigs defines push over notification
-                        configurations.
                       items:
-                        description: |-
-                          PushoverConfig configures notifications via Pushover.
-                          See https://prometheus.io/docs/alerting/latest/configuration/#pushover_config
                         properties:
                           expire:
-                            description: |-
-                              How long your notification will continue to be retried for, unless the user
-                              acknowledges the notification.
                             type: string
                           html:
-                            description: Whether notification message is HTML or plain
-                              text.
                             type: boolean
                           http_config:
-                            description: HTTP client configuration.
                             type: object
                             x-kubernetes-preserve-unknown-fields: true
                           message:
-                            description: Notification message.
                             type: string
                           priority:
-                            description: Priority, see https://pushover.net/api#priority
                             type: string
                           retry:
-                            description: |-
-                              How often the Pushover servers will send the same notification to the user.
-                              Must be at least 30 seconds.
                             type: string
                           send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
                             type: boolean
                           sound:
-                            description: The name of one of the sounds supported by
-                              device clients to override the user's default sound
-                              choice
                             type: string
                           title:
-                            description: Notification title.
                             type: string
                           token:
-                            description: |-
-                              The secret's key that contains the registered application’s API token, see https://pushover.net/apps.
-                              It must be at them same namespace as CRD
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
                             type: object
                             x-kubernetes-map-type: atomic
                           url:
-                            description: A supplementary URL shown alongside the message.
                             type: string
                           url_title:
-                            description: A title for supplementary URL, otherwise
-                              just the URL is shown
                             type: string
                           user_key:
-                            description: |-
-                              The secret's key that contains the recipient user’s user key.
-                              It must be at them same namespace as CRD
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
@@ -7623,17 +7651,9 @@ spec:
                       type: array
                     rocketchat_configs:
                       items:
-                        description: |-
-                          RocketchatConfig configures notifications via Rocketchat.
-                          https://prometheus.io/docs/alerting/latest/configuration/#rocketchat_config
-                          available from v0.55.0 operator version
-                          and v0.28.0 alertmanager version
                         properties:
                           actions:
                             items:
-                              description: |-
-                                RocketchatAttachmentAction defines message attachements
-                                https://github.com/RocketChat/Rocket.Chat.Go.SDK/blob/master/models/message.go
                               properties:
                                 msg:
                                   type: string
@@ -7648,8 +7668,6 @@ spec:
                           api_url:
                             type: string
                           channel:
-                            description: 'RocketChat channel override, (like #other-channel
-                              or @username).'
                             type: string
                           color:
                             type: string
@@ -7657,9 +7675,6 @@ spec:
                             type: string
                           fields:
                             items:
-                              description: |-
-                                RocketchatAttachmentField defines API fields
-                                https://developer.rocket.chat/reference/api/rest-api/endpoints/messaging/chat-endpoints/postmessage#attachment-field-objects
                               properties:
                                 short:
                                   type: boolean
@@ -7678,8 +7693,6 @@ spec:
                           link_names:
                             type: boolean
                           send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
                             type: boolean
                           short_fields:
                             type: boolean
@@ -7692,50 +7705,26 @@ spec:
                           title_link:
                             type: string
                           token:
-                            description: SecretKeySelector selects a key of a Secret.
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
                             type: object
                             x-kubernetes-map-type: atomic
                           token_id:
-                            description: |-
-                              The sender token and token_id
-                              See https://docs.rocket.chat/use-rocket.chat/user-guides/user-panel/my-account#personal-access-tokens
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
@@ -7744,29 +7733,12 @@ spec:
                         type: object
                       type: array
                     slack_configs:
-                      description: SlackConfigs defines slack notification configurations.
                       items:
-                        description: |-
-                          SlackConfig configures notifications via Slack.
-                          See https://prometheus.io/docs/alerting/latest/configuration/#slack_config
                         properties:
                           actions:
-                            description: A list of Slack actions that are sent with
-                              each notification.
                             items:
-                              description: |-
-                                SlackAction configures a single Slack action that is sent with each
-                                notification.
-                                See https://api.slack.com/docs/message-attachments#action_fields and
-                                https://api.slack.com/docs/message-buttons for more information.
                               properties:
                                 confirm:
-                                  description: |-
-                                    SlackConfirmationField protect users from destructive actions or
-                                    particularly distinguished decisions by asking them to confirm their button
-                                    click one more time.
-                                    See https://api.slack.com/docs/interactive-message-field-guide#confirmation_fields
-                                    for more information.
                                   properties:
                                     dismiss_text:
                                       type: string
@@ -7800,27 +7772,13 @@ spec:
                               type: object
                             type: array
                           api_url:
-                            description: |-
-                              The secret's key that contains the Slack webhook URL.
-                              It must be at them same namespace as CRD
-                              fallback to global setting if empty
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
@@ -7829,20 +7787,13 @@ spec:
                           callback_id:
                             type: string
                           channel:
-                            description: The channel or user to send notifications
-                              to.
                             type: string
                           color:
                             type: string
                           fallback:
                             type: string
                           fields:
-                            description: A list of Slack fields that are sent with
-                              each notification.
                             items:
-                              description: |-
-                                SlackField configures a single Slack field that is sent with each notification.
-                                See https://api.slack.com/docs/message-attachments#fields for more information.
                               properties:
                                 short:
                                   type: boolean
@@ -7860,7 +7811,6 @@ spec:
                           footer:
                             type: string
                           http_config:
-                            description: HTTP client configuration.
                             type: object
                             x-kubernetes-preserve-unknown-fields: true
                           icon_emoji:
@@ -7878,8 +7828,6 @@ spec:
                           pretext:
                             type: string
                           send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
                             type: boolean
                           short_fields:
                             type: boolean
@@ -7899,109 +7847,58 @@ spec:
                       items:
                         properties:
                           api_url:
-                            description: The api URL
                             type: string
                           attributes:
                             additionalProperties:
                               type: string
-                            description: SNS message attributes
                             type: object
                           http_config:
-                            description: HTTP client configuration.
                             properties:
                               authorization:
-                                description: |-
-                                  Authorization header configuration for the client.
-                                  This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+.
                                 properties:
                                   credentials:
-                                    description: Reference to the secret with value
-                                      for authorization
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   credentialsFile:
-                                    description: File with value for authorization
                                     type: string
                                   type:
-                                    description: Type of authorization, default to
-                                      bearer
                                     type: string
                                 type: object
                               basic_auth:
-                                description: BasicAuth for the client.
                                 properties:
                                   password:
-                                    description: |-
-                                      Password defines reference for secret with password value
-                                      The secret needs to be in the same namespace as scrape object
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   password_file:
-                                    description: |-
-                                      PasswordFile defines path to password file at disk
-                                      must be pre-mounted
                                     type: string
                                   username:
-                                    description: |-
-                                      Username defines reference for secret with username value
-                                      The secret needs to be in the same namespace as scrape object
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
@@ -8009,88 +7906,45 @@ spec:
                                     x-kubernetes-map-type: atomic
                                 type: object
                               bearer_token_file:
-                                description: BearerTokenFile defines filename for
-                                  bearer token, it must be mounted to pod.
                                 type: string
                               bearer_token_secret:
-                                description: |-
-                                  The secret's key that contains the bearer token
-                                  It must be at them same namespace as CRD
                                 properties:
                                   key:
-                                    description: The key of the secret to select from.  Must
-                                      be a valid secret key.
                                     type: string
                                   name:
                                     default: ""
-                                    description: |-
-                                      Name of the referent.
-                                      This field is effectively required, but due to backwards compatibility is
-                                      allowed to be empty. Instances of this type with an empty value here are
-                                      almost certainly wrong.
-                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                     type: string
                                   optional:
-                                    description: Specify whether the Secret or its
-                                      key must be defined
                                     type: boolean
                                 required:
                                 - key
                                 type: object
                                 x-kubernetes-map-type: atomic
                               oauth2:
-                                description: OAuth2 client credentials used to fetch
-                                  a token for the targets.
                                 properties:
                                   client_id:
-                                    description: The secret or configmap containing
-                                      the OAuth2 client id
                                     properties:
                                       configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
                                         properties:
                                           key:
-                                            description: The key to select.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       secret:
-                                        description: Secret containing data to use
-                                          for the targets.
                                         properties:
                                           key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
@@ -8098,60 +7952,33 @@ spec:
                                         x-kubernetes-map-type: atomic
                                     type: object
                                   client_secret:
-                                    description: The secret containing the OAuth2
-                                      client secret
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   client_secret_file:
-                                    description: ClientSecretFile defines path for
-                                      client secret file.
                                     type: string
                                   endpoint_params:
                                     additionalProperties:
                                       type: string
-                                    description: Parameters to append to the token
-                                      URL
                                     type: object
                                   proxy_url:
-                                    description: |-
-                                      The proxy URL for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
                                     type: string
                                   scopes:
-                                    description: OAuth2 scopes used for the token
-                                      request
                                     items:
                                       type: string
                                     type: array
                                   tls_config:
-                                    description: |-
-                                      TLSConfig for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
                                     x-kubernetes-preserve-unknown-fields: true
                                   token_url:
-                                    description: The URL to fetch the token from
                                     minLength: 1
                                     type: string
                                 required:
@@ -8159,60 +7986,32 @@ spec:
                                 - token_url
                                 type: object
                               proxyURL:
-                                description: Optional proxy URL.
                                 type: string
                               tls_config:
-                                description: TLS configuration for the client.
                                 properties:
                                   ca:
-                                    description: Struct containing the CA cert to
-                                      use for the targets.
                                     properties:
                                       configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
                                         properties:
                                           key:
-                                            description: The key to select.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       secret:
-                                        description: Secret containing data to use
-                                          for the targets.
                                         properties:
                                           key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
@@ -8220,58 +8019,30 @@ spec:
                                         x-kubernetes-map-type: atomic
                                     type: object
                                   caFile:
-                                    description: Path to the CA cert in the container
-                                      to use for the targets.
                                     type: string
                                   cert:
-                                    description: Struct containing the client cert
-                                      file for the targets.
                                     properties:
                                       configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
                                         properties:
                                           key:
-                                            description: The key to select.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       secret:
-                                        description: Secret containing data to use
-                                          for the targets.
                                         properties:
                                           key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
@@ -8279,124 +8050,65 @@ spec:
                                         x-kubernetes-map-type: atomic
                                     type: object
                                   certFile:
-                                    description: Path to the client cert file in the
-                                      container for the targets.
                                     type: string
                                   insecureSkipVerify:
-                                    description: Disable target certificate validation.
                                     type: boolean
                                   keyFile:
-                                    description: Path to the client key file in the
-                                      container for the targets.
                                     type: string
                                   keySecret:
-                                    description: Secret containing the client key
-                                      file for the targets.
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   serverName:
-                                    description: Used to verify the hostname for the
-                                      targets.
                                     type: string
                                 type: object
                             type: object
                           message:
-                            description: The message content of the SNS notification.
                             type: string
                           phone_number:
-                            description: |-
-                              Phone number if message is delivered via SMS
-                              Specify this, topic_arn or target_arn
                             type: string
                           send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
                             type: boolean
                           sigv4:
-                            description: Configure the AWS Signature Verification
-                              4 signing process
                             properties:
                               access_key:
-                                description: |-
-                                  The AWS API keys. Both access_key and secret_key must be supplied or both must be blank.
-                                  If blank the environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are used.
                                 type: string
                               access_key_selector:
-                                description: secret key selector to get the keys from
-                                  a Kubernetes Secret
                                 properties:
                                   key:
-                                    description: The key of the secret to select from.  Must
-                                      be a valid secret key.
                                     type: string
                                   name:
                                     default: ""
-                                    description: |-
-                                      Name of the referent.
-                                      This field is effectively required, but due to backwards compatibility is
-                                      allowed to be empty. Instances of this type with an empty value here are
-                                      almost certainly wrong.
-                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                     type: string
                                   optional:
-                                    description: Specify whether the Secret or its
-                                      key must be defined
                                     type: boolean
                                 required:
                                 - key
                                 type: object
                                 x-kubernetes-map-type: atomic
                               profile:
-                                description: Named AWS profile used to authenticate
                                 type: string
                               region:
-                                description: AWS region, if blank the region from
-                                  the default credentials chain is used
                                 type: string
                               role_arn:
-                                description: AWS Role ARN, an alternative to using
-                                  AWS API keys
                                 type: string
                               secret_key_selector:
-                                description: secret key selector to get the keys from
-                                  a Kubernetes Secret
                                 properties:
                                   key:
-                                    description: The key of the secret to select from.  Must
-                                      be a valid secret key.
                                     type: string
                                   name:
                                     default: ""
-                                    description: |-
-                                      Name of the referent.
-                                      This field is effectively required, but due to backwards compatibility is
-                                      allowed to be empty. Instances of this type with an empty value here are
-                                      almost certainly wrong.
-                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                     type: string
                                   optional:
-                                    description: Specify whether the Secret or its
-                                      key must be defined
                                     type: boolean
                                 required:
                                 - key
@@ -8404,81 +8116,45 @@ spec:
                                 x-kubernetes-map-type: atomic
                             type: object
                           subject:
-                            description: The subject line if message is delivered
-                              to an email endpoint.
                             type: string
                           target_arn:
-                            description: |-
-                              Mobile platform endpoint ARN if message is delivered via mobile notifications
-                              Specify this, topic_arn or phone_number
                             type: string
                           topic_arn:
-                            description: SNS topic ARN, either specify this, phone_number
-                              or target_arn
                             type: string
                         type: object
                       type: array
                     telegram_configs:
                       items:
-                        description: |-
-                          TelegramConfig configures notification via telegram
-                          https://prometheus.io/docs/alerting/latest/configuration/#telegram_config
                         properties:
                           api_url:
-                            description: APIUrl the Telegram API URL i.e. https://api.telegram.org.
                             type: string
                           bot_token:
-                            description: |-
-                              BotToken token for the bot
-                              https://core.telegram.org/bots/api
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
                             type: object
                             x-kubernetes-map-type: atomic
                           chat_id:
-                            description: ChatID is ID of the chat where to send the
-                              messages.
                             type: integer
                           disable_notifications:
-                            description: DisableNotifications
                             type: boolean
                           http_config:
-                            description: HTTP client configuration.
                             type: object
                             x-kubernetes-preserve-unknown-fields: true
                           message:
-                            description: Message is templated message
                             type: string
                           message_thread_id:
-                            description: MessageThreadID defines ID of the message
-                              thread where to send the messages.
                             type: integer
                           parse_mode:
-                            description: |-
-                              ParseMode for telegram message,
-                              supported values are MarkdownV2, Markdown, Markdown and empty string for plain text.
                             type: string
                           send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
                             type: boolean
                         required:
                         - bot_token
@@ -8486,149 +8162,76 @@ spec:
                         type: object
                       type: array
                     victorops_configs:
-                      description: VictorOpsConfigs defines victor ops notification
-                        configurations.
                       items:
-                        description: |-
-                          VictorOpsConfig configures notifications via VictorOps.
-                          See https://prometheus.io/docs/alerting/latest/configuration/#victorops_config
                         properties:
                           api_key:
-                            description: |-
-                              The secret's key that contains the API key to use when talking to the VictorOps API.
-                              It must be at them same namespace as CRD
-                              fallback to global setting if empty
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
                             type: object
                             x-kubernetes-map-type: atomic
                           api_url:
-                            description: The VictorOps API URL.
                             type: string
                           custom_fields:
                             additionalProperties:
                               type: string
-                            description: |-
-                              Adds optional custom fields
-                              https://github.com/prometheus/alertmanager/blob/v0.24.0/config/notifiers.go#L537
                             type: object
                           entity_display_name:
-                            description: Contains summary of the alerted problem.
                             type: string
                           http_config:
-                            description: The HTTP client's configuration.
                             properties:
                               authorization:
-                                description: |-
-                                  Authorization header configuration for the client.
-                                  This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+.
                                 properties:
                                   credentials:
-                                    description: Reference to the secret with value
-                                      for authorization
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   credentialsFile:
-                                    description: File with value for authorization
                                     type: string
                                   type:
-                                    description: Type of authorization, default to
-                                      bearer
                                     type: string
                                 type: object
                               basic_auth:
-                                description: BasicAuth for the client.
                                 properties:
                                   password:
-                                    description: |-
-                                      Password defines reference for secret with password value
-                                      The secret needs to be in the same namespace as scrape object
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   password_file:
-                                    description: |-
-                                      PasswordFile defines path to password file at disk
-                                      must be pre-mounted
                                     type: string
                                   username:
-                                    description: |-
-                                      Username defines reference for secret with username value
-                                      The secret needs to be in the same namespace as scrape object
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
@@ -8636,88 +8239,45 @@ spec:
                                     x-kubernetes-map-type: atomic
                                 type: object
                               bearer_token_file:
-                                description: BearerTokenFile defines filename for
-                                  bearer token, it must be mounted to pod.
                                 type: string
                               bearer_token_secret:
-                                description: |-
-                                  The secret's key that contains the bearer token
-                                  It must be at them same namespace as CRD
                                 properties:
                                   key:
-                                    description: The key of the secret to select from.  Must
-                                      be a valid secret key.
                                     type: string
                                   name:
                                     default: ""
-                                    description: |-
-                                      Name of the referent.
-                                      This field is effectively required, but due to backwards compatibility is
-                                      allowed to be empty. Instances of this type with an empty value here are
-                                      almost certainly wrong.
-                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                     type: string
                                   optional:
-                                    description: Specify whether the Secret or its
-                                      key must be defined
                                     type: boolean
                                 required:
                                 - key
                                 type: object
                                 x-kubernetes-map-type: atomic
                               oauth2:
-                                description: OAuth2 client credentials used to fetch
-                                  a token for the targets.
                                 properties:
                                   client_id:
-                                    description: The secret or configmap containing
-                                      the OAuth2 client id
                                     properties:
                                       configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
                                         properties:
                                           key:
-                                            description: The key to select.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       secret:
-                                        description: Secret containing data to use
-                                          for the targets.
                                         properties:
                                           key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
@@ -8725,60 +8285,33 @@ spec:
                                         x-kubernetes-map-type: atomic
                                     type: object
                                   client_secret:
-                                    description: The secret containing the OAuth2
-                                      client secret
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   client_secret_file:
-                                    description: ClientSecretFile defines path for
-                                      client secret file.
                                     type: string
                                   endpoint_params:
                                     additionalProperties:
                                       type: string
-                                    description: Parameters to append to the token
-                                      URL
                                     type: object
                                   proxy_url:
-                                    description: |-
-                                      The proxy URL for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
                                     type: string
                                   scopes:
-                                    description: OAuth2 scopes used for the token
-                                      request
                                     items:
                                       type: string
                                     type: array
                                   tls_config:
-                                    description: |-
-                                      TLSConfig for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
                                     x-kubernetes-preserve-unknown-fields: true
                                   token_url:
-                                    description: The URL to fetch the token from
                                     minLength: 1
                                     type: string
                                 required:
@@ -8786,60 +8319,32 @@ spec:
                                 - token_url
                                 type: object
                               proxyURL:
-                                description: Optional proxy URL.
                                 type: string
                               tls_config:
-                                description: TLS configuration for the client.
                                 properties:
                                   ca:
-                                    description: Struct containing the CA cert to
-                                      use for the targets.
                                     properties:
                                       configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
                                         properties:
                                           key:
-                                            description: The key to select.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       secret:
-                                        description: Secret containing data to use
-                                          for the targets.
                                         properties:
                                           key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
@@ -8847,58 +8352,30 @@ spec:
                                         x-kubernetes-map-type: atomic
                                     type: object
                                   caFile:
-                                    description: Path to the CA cert in the container
-                                      to use for the targets.
                                     type: string
                                   cert:
-                                    description: Struct containing the client cert
-                                      file for the targets.
                                     properties:
                                       configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
                                         properties:
                                           key:
-                                            description: The key to select.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       secret:
-                                        description: Secret containing data to use
-                                          for the targets.
                                         properties:
                                           key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
@@ -8906,65 +8383,37 @@ spec:
                                         x-kubernetes-map-type: atomic
                                     type: object
                                   certFile:
-                                    description: Path to the client cert file in the
-                                      container for the targets.
                                     type: string
                                   insecureSkipVerify:
-                                    description: Disable target certificate validation.
                                     type: boolean
                                   keyFile:
-                                    description: Path to the client key file in the
-                                      container for the targets.
                                     type: string
                                   keySecret:
-                                    description: Secret containing the client key
-                                      file for the targets.
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   serverName:
-                                    description: Used to verify the hostname for the
-                                      targets.
                                     type: string
                                 type: object
                             type: object
                           message_type:
-                            description: Describes the behavior of the alert (CRITICAL,
-                              WARNING, INFO).
                             type: string
                           monitoring_tool:
-                            description: The monitoring tool the state message is
-                              from.
                             type: string
                           routing_key:
-                            description: A key used to map the alert to a team.
                             type: string
                           send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
                             type: boolean
                           state_message:
-                            description: Contains long explanation of the alerted
-                              problem.
                             type: string
                         required:
                         - routing_key
@@ -8974,106 +8423,54 @@ spec:
                       items:
                         properties:
                           api_url:
-                            description: The Webex Teams API URL, i.e. https://webexapis.com/v1/messages
                             type: string
                           http_config:
-                            description: HTTP client configuration. You must use this
-                              configuration to supply the bot token as part of the
-                              HTTP `Authorization` header.
                             properties:
                               authorization:
-                                description: |-
-                                  Authorization header configuration for the client.
-                                  This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+.
                                 properties:
                                   credentials:
-                                    description: Reference to the secret with value
-                                      for authorization
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   credentialsFile:
-                                    description: File with value for authorization
                                     type: string
                                   type:
-                                    description: Type of authorization, default to
-                                      bearer
                                     type: string
                                 type: object
                               basic_auth:
-                                description: BasicAuth for the client.
                                 properties:
                                   password:
-                                    description: |-
-                                      Password defines reference for secret with password value
-                                      The secret needs to be in the same namespace as scrape object
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   password_file:
-                                    description: |-
-                                      PasswordFile defines path to password file at disk
-                                      must be pre-mounted
                                     type: string
                                   username:
-                                    description: |-
-                                      Username defines reference for secret with username value
-                                      The secret needs to be in the same namespace as scrape object
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
@@ -9081,88 +8478,45 @@ spec:
                                     x-kubernetes-map-type: atomic
                                 type: object
                               bearer_token_file:
-                                description: BearerTokenFile defines filename for
-                                  bearer token, it must be mounted to pod.
                                 type: string
                               bearer_token_secret:
-                                description: |-
-                                  The secret's key that contains the bearer token
-                                  It must be at them same namespace as CRD
                                 properties:
                                   key:
-                                    description: The key of the secret to select from.  Must
-                                      be a valid secret key.
                                     type: string
                                   name:
                                     default: ""
-                                    description: |-
-                                      Name of the referent.
-                                      This field is effectively required, but due to backwards compatibility is
-                                      allowed to be empty. Instances of this type with an empty value here are
-                                      almost certainly wrong.
-                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                     type: string
                                   optional:
-                                    description: Specify whether the Secret or its
-                                      key must be defined
                                     type: boolean
                                 required:
                                 - key
                                 type: object
                                 x-kubernetes-map-type: atomic
                               oauth2:
-                                description: OAuth2 client credentials used to fetch
-                                  a token for the targets.
                                 properties:
                                   client_id:
-                                    description: The secret or configmap containing
-                                      the OAuth2 client id
                                     properties:
                                       configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
                                         properties:
                                           key:
-                                            description: The key to select.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       secret:
-                                        description: Secret containing data to use
-                                          for the targets.
                                         properties:
                                           key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
@@ -9170,60 +8524,33 @@ spec:
                                         x-kubernetes-map-type: atomic
                                     type: object
                                   client_secret:
-                                    description: The secret containing the OAuth2
-                                      client secret
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   client_secret_file:
-                                    description: ClientSecretFile defines path for
-                                      client secret file.
                                     type: string
                                   endpoint_params:
                                     additionalProperties:
                                       type: string
-                                    description: Parameters to append to the token
-                                      URL
                                     type: object
                                   proxy_url:
-                                    description: |-
-                                      The proxy URL for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
                                     type: string
                                   scopes:
-                                    description: OAuth2 scopes used for the token
-                                      request
                                     items:
                                       type: string
                                     type: array
                                   tls_config:
-                                    description: |-
-                                      TLSConfig for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
                                     x-kubernetes-preserve-unknown-fields: true
                                   token_url:
-                                    description: The URL to fetch the token from
                                     minLength: 1
                                     type: string
                                 required:
@@ -9231,60 +8558,32 @@ spec:
                                 - token_url
                                 type: object
                               proxyURL:
-                                description: Optional proxy URL.
                                 type: string
                               tls_config:
-                                description: TLS configuration for the client.
                                 properties:
                                   ca:
-                                    description: Struct containing the CA cert to
-                                      use for the targets.
                                     properties:
                                       configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
                                         properties:
                                           key:
-                                            description: The key to select.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       secret:
-                                        description: Secret containing data to use
-                                          for the targets.
                                         properties:
                                           key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
@@ -9292,58 +8591,30 @@ spec:
                                         x-kubernetes-map-type: atomic
                                     type: object
                                   caFile:
-                                    description: Path to the CA cert in the container
-                                      to use for the targets.
                                     type: string
                                   cert:
-                                    description: Struct containing the client cert
-                                      file for the targets.
                                     properties:
                                       configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
                                         properties:
                                           key:
-                                            description: The key to select.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       secret:
-                                        description: Secret containing data to use
-                                          for the targets.
                                         properties:
                                           key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
@@ -9351,110 +8622,63 @@ spec:
                                         x-kubernetes-map-type: atomic
                                     type: object
                                   certFile:
-                                    description: Path to the client cert file in the
-                                      container for the targets.
                                     type: string
                                   insecureSkipVerify:
-                                    description: Disable target certificate validation.
                                     type: boolean
                                   keyFile:
-                                    description: Path to the client key file in the
-                                      container for the targets.
                                     type: string
                                   keySecret:
-                                    description: Secret containing the client key
-                                      file for the targets.
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   serverName:
-                                    description: Used to verify the hostname for the
-                                      targets.
                                     type: string
                                 type: object
                             type: object
                           message:
-                            description: The message body template
                             type: string
                           room_id:
-                            description: The ID of the Webex Teams room where to send
-                              the messages
                             type: string
                           send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
                             type: boolean
                         required:
                         - room_id
                         type: object
                       type: array
                     webhook_configs:
-                      description: WebhookConfigs defines webhook notification configurations.
                       items:
-                        description: |-
-                          WebhookConfig configures notifications via a generic receiver supporting the webhook payload.
-                          See https://prometheus.io/docs/alerting/latest/configuration/#webhook_config
                         properties:
                           http_config:
-                            description: HTTP client configuration.
                             type: object
                             x-kubernetes-preserve-unknown-fields: true
                           max_alerts:
-                            description: Maximum number of alerts to be sent per webhook
-                              message. When 0, all alerts are included.
                             format: int32
                             minimum: 0
                             type: integer
                           send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
                             type: boolean
+                          timeout:
+                            pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$
+                            type: string
                           url:
-                            description: |-
-                              URL to send requests to,
-                              one of `urlSecret` and `url` must be defined.
                             type: string
                           url_secret:
-                            description: |-
-                              URLSecret defines secret name and key at the CRD namespace.
-                              It must contain the webhook URL.
-                              one of `urlSecret` and `url` must be defined.
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
@@ -9463,147 +8687,74 @@ spec:
                         type: object
                       type: array
                     wechat_configs:
-                      description: WeChatConfigs defines wechat notification configurations.
                       items:
-                        description: |-
-                          WeChatConfig configures notifications via WeChat.
-                          See https://prometheus.io/docs/alerting/latest/configuration/#wechat_config
                         properties:
                           agent_id:
                             type: string
                           api_secret:
-                            description: |-
-                              The secret's key that contains the WeChat API key.
-                              The secret needs to be in the same namespace as the AlertmanagerConfig
-                              fallback to global alertmanager setting if empty
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
                             type: object
                             x-kubernetes-map-type: atomic
                           api_url:
-                            description: |-
-                              The WeChat API URL.
-                              fallback to global alertmanager setting if empty
                             type: string
                           corp_id:
-                            description: |-
-                              The corp id for authentication.
-                              fallback to global alertmanager setting if empty
                             type: string
                           http_config:
-                            description: HTTP client configuration.
                             properties:
                               authorization:
-                                description: |-
-                                  Authorization header configuration for the client.
-                                  This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+.
                                 properties:
                                   credentials:
-                                    description: Reference to the secret with value
-                                      for authorization
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   credentialsFile:
-                                    description: File with value for authorization
                                     type: string
                                   type:
-                                    description: Type of authorization, default to
-                                      bearer
                                     type: string
                                 type: object
                               basic_auth:
-                                description: BasicAuth for the client.
                                 properties:
                                   password:
-                                    description: |-
-                                      Password defines reference for secret with password value
-                                      The secret needs to be in the same namespace as scrape object
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   password_file:
-                                    description: |-
-                                      PasswordFile defines path to password file at disk
-                                      must be pre-mounted
                                     type: string
                                   username:
-                                    description: |-
-                                      Username defines reference for secret with username value
-                                      The secret needs to be in the same namespace as scrape object
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
@@ -9611,88 +8762,45 @@ spec:
                                     x-kubernetes-map-type: atomic
                                 type: object
                               bearer_token_file:
-                                description: BearerTokenFile defines filename for
-                                  bearer token, it must be mounted to pod.
                                 type: string
                               bearer_token_secret:
-                                description: |-
-                                  The secret's key that contains the bearer token
-                                  It must be at them same namespace as CRD
                                 properties:
                                   key:
-                                    description: The key of the secret to select from.  Must
-                                      be a valid secret key.
                                     type: string
                                   name:
                                     default: ""
-                                    description: |-
-                                      Name of the referent.
-                                      This field is effectively required, but due to backwards compatibility is
-                                      allowed to be empty. Instances of this type with an empty value here are
-                                      almost certainly wrong.
-                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                     type: string
                                   optional:
-                                    description: Specify whether the Secret or its
-                                      key must be defined
                                     type: boolean
                                 required:
                                 - key
                                 type: object
                                 x-kubernetes-map-type: atomic
                               oauth2:
-                                description: OAuth2 client credentials used to fetch
-                                  a token for the targets.
                                 properties:
                                   client_id:
-                                    description: The secret or configmap containing
-                                      the OAuth2 client id
                                     properties:
                                       configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
                                         properties:
                                           key:
-                                            description: The key to select.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       secret:
-                                        description: Secret containing data to use
-                                          for the targets.
                                         properties:
                                           key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
@@ -9700,60 +8808,33 @@ spec:
                                         x-kubernetes-map-type: atomic
                                     type: object
                                   client_secret:
-                                    description: The secret containing the OAuth2
-                                      client secret
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   client_secret_file:
-                                    description: ClientSecretFile defines path for
-                                      client secret file.
                                     type: string
                                   endpoint_params:
                                     additionalProperties:
                                       type: string
-                                    description: Parameters to append to the token
-                                      URL
                                     type: object
                                   proxy_url:
-                                    description: |-
-                                      The proxy URL for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
                                     type: string
                                   scopes:
-                                    description: OAuth2 scopes used for the token
-                                      request
                                     items:
                                       type: string
                                     type: array
                                   tls_config:
-                                    description: |-
-                                      TLSConfig for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
                                     x-kubernetes-preserve-unknown-fields: true
                                   token_url:
-                                    description: The URL to fetch the token from
                                     minLength: 1
                                     type: string
                                 required:
@@ -9761,60 +8842,32 @@ spec:
                                 - token_url
                                 type: object
                               proxyURL:
-                                description: Optional proxy URL.
                                 type: string
                               tls_config:
-                                description: TLS configuration for the client.
                                 properties:
                                   ca:
-                                    description: Struct containing the CA cert to
-                                      use for the targets.
                                     properties:
                                       configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
                                         properties:
                                           key:
-                                            description: The key to select.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       secret:
-                                        description: Secret containing data to use
-                                          for the targets.
                                         properties:
                                           key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
@@ -9822,58 +8875,30 @@ spec:
                                         x-kubernetes-map-type: atomic
                                     type: object
                                   caFile:
-                                    description: Path to the CA cert in the container
-                                      to use for the targets.
                                     type: string
                                   cert:
-                                    description: Struct containing the client cert
-                                      file for the targets.
                                     properties:
                                       configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
                                         properties:
                                           key:
-                                            description: The key to select.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       secret:
-                                        description: Secret containing data to use
-                                          for the targets.
                                         properties:
                                           key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
                                             type: string
                                           name:
                                             default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                             type: string
                                           optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
                                             type: boolean
                                         required:
                                         - key
@@ -9881,56 +8906,33 @@ spec:
                                         x-kubernetes-map-type: atomic
                                     type: object
                                   certFile:
-                                    description: Path to the client cert file in the
-                                      container for the targets.
                                     type: string
                                   insecureSkipVerify:
-                                    description: Disable target certificate validation.
                                     type: boolean
                                   keyFile:
-                                    description: Path to the client key file in the
-                                      container for the targets.
                                     type: string
                                   keySecret:
-                                    description: Secret containing the client key
-                                      file for the targets.
                                     properties:
                                       key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
                                         type: string
                                       name:
                                         default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                         type: string
                                       optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
                                         type: boolean
                                     required:
                                     - key
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   serverName:
-                                    description: Used to verify the hostname for the
-                                      targets.
                                     type: string
                                 type: object
                             type: object
                           message:
-                            description: API request data as defined by the WeChat
-                              API.
                             type: string
                           message_type:
                             type: string
                           send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
                             type: boolean
                           to_party:
                             type: string
@@ -9945,59 +8947,37 @@ spec:
                   type: object
                 type: array
               route:
-                description: Route definition for alertmanager, may include nested
-                  routes.
                 properties:
                   active_time_intervals:
-                    description: |-
-                      ActiveTimeIntervals Times when the route should be active
-                      These must match the name at time_intervals
                     items:
                       type: string
                     type: array
                   continue:
-                    description: |-
-                      Continue indicating whether an alert should continue matching subsequent
-                      sibling nodes. It will always be true for the first-level route if disableRouteContinueEnforce for vmalertmanager not set.
                     type: boolean
                   group_by:
-                    description: List of labels to group by.
                     items:
                       type: string
                     type: array
                   group_interval:
-                    description: How long to wait before sending an updated notification.
                     pattern: '[0-9]+(ms|s|m|h)'
                     type: string
                   group_wait:
-                    description: How long to wait before sending the initial notification.
                     pattern: '[0-9]+(ms|s|m|h)'
                     type: string
                   matchers:
-                    description: |-
-                      List of matchers that the alert’s labels should match. For the first
-                      level route, the operator adds a namespace: "CRD_NS" matcher.
-                      https://prometheus.io/docs/alerting/latest/configuration/#matcher
                     items:
                       type: string
                     type: array
                   mute_time_intervals:
-                    description: MuteTimeIntervals is a list of interval names that
-                      will mute matched alert
                     items:
                       type: string
                     type: array
                   receiver:
-                    description: Name of the receiver for this route.
                     type: string
                   repeat_interval:
-                    description: How long to wait before repeating the last notification.
                     pattern: '[0-9]+(ms|s|m|h)'
                     type: string
                   routes:
-                    description: |-
-                      Child routes.
-                      https://prometheus.io/docs/alerting/latest/configuration/#route
                     items:
                       x-kubernetes-preserve-unknown-fields: true
                     type: array
@@ -10005,49 +8985,29 @@ spec:
                 - receiver
                 type: object
               time_intervals:
-                description: |-
-                  TimeIntervals defines named interval for active/mute notifications interval
-                  See https://prometheus.io/docs/alerting/latest/configuration/#time_interval
                 items:
-                  description: TimeIntervals for alerts
                   properties:
                     name:
-                      description: Name of interval
                       type: string
                     time_intervals:
-                      description: TimeIntervals interval configuration
                       items:
-                        description: TimeInterval defines intervals of time
                         properties:
                           days_of_month:
-                            description: |-
-                              DayOfMonth defines list of numerical days in the month. Days begin at 1. Negative values are also accepted.
-                              for example, ['1:5', '-3:-1']
                             items:
                               type: string
                             type: array
                           location:
-                            description: Location in golang time location form, e.g.
-                              UTC
                             type: string
                           months:
-                            description: |-
-                              Months  defines list of calendar months identified by a case-insensitive name (e.g. ‘January’) or numeric 1.
-                              For example, ['1:3', 'may:august', 'december']
                             items:
                               type: string
                             type: array
                           times:
-                            description: Times defines time range for mute
                             items:
-                              description: TimeRange  ranges inclusive of the starting
-                                time and exclusive of the end time
                               properties:
                                 end_time:
-                                  description: EndTime for example HH:MM
                                   type: string
                                 start_time:
-                                  description: StartTime for example  HH:MM
                                   type: string
                               required:
                               - end_time
@@ -10055,15 +9015,10 @@ spec:
                               type: object
                             type: array
                           weekdays:
-                            description: Weekdays defines list of days of the week,
-                              where the week begins on Sunday and ends on Saturday.
                             items:
                               type: string
                             type: array
                           years:
-                            description: |-
-                              Years defines numerical list of years, ranges are accepted.
-                              For example, ['2020:2022', '2030']
                             items:
                               type: string
                             type: array
@@ -10074,64 +9029,36 @@ spec:
                   - time_intervals
                   type: object
                 type: array
-            required:
-            - receivers
-            - route
             type: object
           status:
-            description: VMAlertmanagerConfigStatus defines the observed state of
-              VMAlertmanagerConfig
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -10148,16 +9075,11 @@ spec:
               lastErrorParentAlertmanagerName:
                 type: string
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -10170,7 +9092,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmalertmanagers.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -10198,103 +9120,46 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: VMAlertmanager represents Victoria-Metrics deployment for Alertmanager.
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: |-
-              Specification of the desired behavior of the VMAlertmanager cluster. More info:
-              https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
             properties:
               additionalPeers:
-                description: AdditionalPeers allows injecting a set of additional
-                  Alertmanagers to peer with to form a highly available cluster.
                 items:
                   type: string
                 type: array
               affinity:
-                description: Affinity If specified, the pod's scheduling constraints.
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               claimTemplates:
-                description: ClaimTemplates allows adding additional VolumeClaimTemplates
-                  for StatefulSet
                 items:
-                  description: PersistentVolumeClaim is a user's request for and claim
-                    to a persistent volume
                   properties:
                     apiVersion:
-                      description: |-
-                        APIVersion defines the versioned schema of this representation of an object.
-                        Servers should convert recognized schemas to the latest internal value, and
-                        may reject unrecognized values.
-                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
                       type: string
                     kind:
-                      description: |-
-                        Kind is a string value representing the REST resource this object represents.
-                        Servers may infer this from the endpoint the client submits requests to.
-                        Cannot be updated.
-                        In CamelCase.
-                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
                       type: string
                     metadata:
-                      description: |-
-                        Standard object's metadata.
-                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
                       type: object
                       x-kubernetes-preserve-unknown-fields: true
                     spec:
-                      description: |-
-                        spec defines the desired characteristics of a volume requested by a pod author.
-                        More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
                       properties:
                         accessModes:
-                          description: |-
-                            accessModes contains the desired access modes the volume should have.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
                           items:
                             type: string
                           type: array
                           x-kubernetes-list-type: atomic
                         dataSource:
-                          description: |-
-                            dataSource field can be used to specify either:
-                            * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
-                            * An existing PVC (PersistentVolumeClaim)
-                            If the provisioner or an external controller can support the specified data source,
-                            it will create a new volume based on the contents of the specified data source.
-                            When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-                            and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
-                            If the namespace is specified, then dataSourceRef will not be copied to dataSource.
                           properties:
                             apiGroup:
-                              description: |-
-                                APIGroup is the group for the resource being referenced.
-                                If APIGroup is not specified, the specified Kind must be in the core API group.
-                                For any other third-party types, APIGroup is required.
                               type: string
                             kind:
-                              description: Kind is the type of resource being referenced
                               type: string
                             name:
-                              description: Name is the name of resource being referenced
                               type: string
                           required:
                           - kind
@@ -10302,60 +9167,20 @@ spec:
                           type: object
                           x-kubernetes-map-type: atomic
                         dataSourceRef:
-                          description: |-
-                            dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
-                            volume is desired. This may be any object from a non-empty API group (non
-                            core object) or a PersistentVolumeClaim object.
-                            When this field is specified, volume binding will only succeed if the type of
-                            the specified object matches some installed volume populator or dynamic
-                            provisioner.
-                            This field will replace the functionality of the dataSource field and as such
-                            if both fields are non-empty, they must have the same value. For backwards
-                            compatibility, when namespace isn't specified in dataSourceRef,
-                            both fields (dataSource and dataSourceRef) will be set to the same
-                            value automatically if one of them is empty and the other is non-empty.
-                            When namespace is specified in dataSourceRef,
-                            dataSource isn't set to the same value and must be empty.
-                            There are three important differences between dataSource and dataSourceRef:
-                            * While dataSource only allows two specific types of objects, dataSourceRef
-                              allows any non-core object, as well as PersistentVolumeClaim objects.
-                            * While dataSource ignores disallowed values (dropping them), dataSourceRef
-                              preserves all values, and generates an error if a disallowed value is
-                              specified.
-                            * While dataSource only allows local objects, dataSourceRef allows objects
-                              in any namespaces.
-                            (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
-                            (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
                           properties:
                             apiGroup:
-                              description: |-
-                                APIGroup is the group for the resource being referenced.
-                                If APIGroup is not specified, the specified Kind must be in the core API group.
-                                For any other third-party types, APIGroup is required.
                               type: string
                             kind:
-                              description: Kind is the type of resource being referenced
                               type: string
                             name:
-                              description: Name is the name of resource being referenced
                               type: string
                             namespace:
-                              description: |-
-                                Namespace is the namespace of resource being referenced
-                                Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
-                                (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
                               type: string
                           required:
                           - kind
                           - name
                           type: object
                         resources:
-                          description: |-
-                            resources represents the minimum resources the volume should have.
-                            If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
-                            that are lower than previous value but must still be higher than capacity recorded in the
-                            status field of the claim.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
                           properties:
                             limits:
                               additionalProperties:
@@ -10364,9 +9189,6 @@ spec:
                                 - type: string
                                 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                 x-kubernetes-int-or-string: true
-                              description: |-
-                                Limits describes the maximum amount of compute resources allowed.
-                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                               type: object
                             requests:
                               additionalProperties:
@@ -10375,40 +9197,18 @@ spec:
                                 - type: string
                                 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                 x-kubernetes-int-or-string: true
-                              description: |-
-                                Requests describes the minimum amount of compute resources required.
-                                If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                                otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                               type: object
                           type: object
                         selector:
-                          description: selector is a label query over volumes to consider
-                            for binding.
                           properties:
                             matchExpressions:
-                              description: matchExpressions is a list of label selector
-                                requirements. The requirements are ANDed.
                               items:
-                                description: |-
-                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                  relates the key and values.
                                 properties:
                                   key:
-                                    description: key is the label key that the selector
-                                      applies to.
                                     type: string
                                   operator:
-                                    description: |-
-                                      operator represents a key's relationship to a set of values.
-                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                     type: string
                                   values:
-                                    description: |-
-                                      values is an array of string values. If the operator is In or NotIn,
-                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                      the values array must be empty. This array is replaced during a strategic
-                                      merge patch.
                                     items:
                                       type: string
                                     type: array
@@ -10422,99 +9222,28 @@ spec:
                             matchLabels:
                               additionalProperties:
                                 type: string
-                              description: |-
-                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                               type: object
                           type: object
                           x-kubernetes-map-type: atomic
                         storageClassName:
-                          description: |-
-                            storageClassName is the name of the StorageClass required by the claim.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
                           type: string
                         volumeAttributesClassName:
-                          description: |-
-                            volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
-                            If specified, the CSI driver will create or update the volume with the attributes defined
-                            in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                            it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                            will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                            If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                            will be set by the persistentvolume controller if it exists.
-                            If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
-                            set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
-                            exists.
-                            More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                            (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                           type: string
                         volumeMode:
-                          description: |-
-                            volumeMode defines what type of volume is required by the claim.
-                            Value of Filesystem is implied when not included in claim spec.
                           type: string
                         volumeName:
-                          description: volumeName is the binding reference to the
-                            PersistentVolume backing this claim.
                           type: string
                       type: object
                     status:
-                      description: |-
-                        status represents the current information/status of a persistent volume claim.
-                        Read-only.
-                        More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
                       properties:
                         accessModes:
-                          description: |-
-                            accessModes contains the actual access modes the volume backing the PVC has.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
                           items:
                             type: string
                           type: array
                           x-kubernetes-list-type: atomic
                         allocatedResourceStatuses:
                           additionalProperties:
-                            description: |-
-                              When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource
-                              that it does not recognizes, then it should ignore that update and let other controllers
-                              handle it.
                             type: string
-                          description: "allocatedResourceStatuses stores status of
-                            resource being resized for the given PVC.\nKey names follow
-                            standard Kubernetes label syntax. Valid values are either:\n\t*
-                            Un-prefixed keys:\n\t\t- storage - the capacity of the
-                            volume.\n\t* Custom resources must use implementation-defined
-                            prefixed names such as \"example.com/my-custom-resource\"\nApart
-                            from above values - keys that are unprefixed or have kubernetes.io
-                            prefix are considered\nreserved and hence may not be used.\n\nClaimResourceStatus
-                            can be in any of following states:\n\t- ControllerResizeInProgress:\n\t\tState
-                            set when resize controller starts resizing the volume
-                            in control-plane.\n\t- ControllerResizeFailed:\n\t\tState
-                            set when resize has failed in resize controller with a
-                            terminal error.\n\t- NodeResizePending:\n\t\tState set
-                            when resize controller has finished resizing the volume
-                            but further resizing of\n\t\tvolume is needed on the node.\n\t-
-                            NodeResizeInProgress:\n\t\tState set when kubelet starts
-                            resizing the volume.\n\t- NodeResizeFailed:\n\t\tState
-                            set when resizing has failed in kubelet with a terminal
-                            error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor
-                            example: if expanding a PVC for more capacity - this field
-                            can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage']
-                            = \"ControllerResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                            = \"ControllerResizeFailed\"\n     - pvc.status.allocatedResourceStatus['storage']
-                            = \"NodeResizePending\"\n     - pvc.status.allocatedResourceStatus['storage']
-                            = \"NodeResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                            = \"NodeResizeFailed\"\nWhen this field is not set, it
-                            means that no resize operation is in progress for the
-                            given PVC.\n\nA controller that receives PVC update with
-                            previously unknown resourceName or ClaimResourceStatus\nshould
-                            ignore the update for the purpose it was designed. For
-                            example - a controller that\nonly is responsible for resizing
-                            capacity of the volume, should ignore PVC updates that
-                            change other valid\nresources associated with PVC.\n\nThis
-                            is an alpha field and requires enabling RecoverVolumeExpansionFailure
-                            feature."
                           type: object
                           x-kubernetes-map-type: granular
                         allocatedResources:
@@ -10524,30 +9253,6 @@ spec:
                             - type: string
                             pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                             x-kubernetes-int-or-string: true
-                          description: "allocatedResources tracks the resources allocated
-                            to a PVC including its capacity.\nKey names follow standard
-                            Kubernetes label syntax. Valid values are either:\n\t*
-                            Un-prefixed keys:\n\t\t- storage - the capacity of the
-                            volume.\n\t* Custom resources must use implementation-defined
-                            prefixed names such as \"example.com/my-custom-resource\"\nApart
-                            from above values - keys that are unprefixed or have kubernetes.io
-                            prefix are considered\nreserved and hence may not be used.\n\nCapacity
-                            reported here may be larger than the actual capacity when
-                            a volume expansion operation\nis requested.\nFor storage
-                            quota, the larger value from allocatedResources and PVC.spec.resources
-                            is used.\nIf allocatedResources is not set, PVC.spec.resources
-                            alone is used for quota calculation.\nIf a volume expansion
-                            capacity request is lowered, allocatedResources is only\nlowered
-                            if there are no expansion operations in progress and if
-                            the actual volume capacity\nis equal or lower than the
-                            requested capacity.\n\nA controller that receives PVC
-                            update with previously unknown resourceName\nshould ignore
-                            the update for the purpose it was designed. For example
-                            - a controller that\nonly is responsible for resizing
-                            capacity of the volume, should ignore PVC updates that
-                            change other valid\nresources associated with PVC.\n\nThis
-                            is an alpha field and requires enabling RecoverVolumeExpansionFailure
-                            feature."
                           type: object
                         capacity:
                           additionalProperties:
@@ -10556,47 +9261,23 @@ spec:
                             - type: string
                             pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                             x-kubernetes-int-or-string: true
-                          description: capacity represents the actual resources of
-                            the underlying volume.
                           type: object
                         conditions:
-                          description: |-
-                            conditions is the current Condition of persistent volume claim. If underlying persistent volume is being
-                            resized then the Condition will be set to 'Resizing'.
                           items:
-                            description: PersistentVolumeClaimCondition contains details
-                              about state of pvc
                             properties:
                               lastProbeTime:
-                                description: lastProbeTime is the time we probed the
-                                  condition.
                                 format: date-time
                                 type: string
                               lastTransitionTime:
-                                description: lastTransitionTime is the time the condition
-                                  transitioned from one status to another.
                                 format: date-time
                                 type: string
                               message:
-                                description: message is the human-readable message
-                                  indicating details about last transition.
                                 type: string
                               reason:
-                                description: |-
-                                  reason is a unique, this should be a short, machine understandable string that gives the reason
-                                  for condition's last transition. If it reports "Resizing" that means the underlying
-                                  persistent volume is being resized.
                                 type: string
                               status:
-                                description: |-
-                                  Status is the status of the condition.
-                                  Can be True, False, Unknown.
-                                  More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required
                                 type: string
                               type:
-                                description: |-
-                                  Type is the type of the condition.
-                                  More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about
                                 type: string
                             required:
                             - status
@@ -10607,96 +9288,39 @@ spec:
                           - type
                           x-kubernetes-list-type: map
                         currentVolumeAttributesClassName:
-                          description: |-
-                            currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
-                            When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                            This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                           type: string
                         modifyVolumeStatus:
-                          description: |-
-                            ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
-                            When this is unset, there is no ModifyVolume operation being attempted.
-                            This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                           properties:
                             status:
-                              description: "status is the status of the ControllerModifyVolume
-                                operation. It can be in any of following states:\n
-                                - Pending\n   Pending indicates that the PersistentVolumeClaim
-                                cannot be modified due to unmet requirements, such
-                                as\n   the specified VolumeAttributesClass not existing.\n
-                                - InProgress\n   InProgress indicates that the volume
-                                is being modified.\n - Infeasible\n  Infeasible indicates
-                                that the request has been rejected as invalid by the
-                                CSI driver. To\n\t  resolve the error, a valid VolumeAttributesClass
-                                needs to be specified.\nNote: New statuses can be
-                                added in the future. Consumers should check for unknown
-                                statuses and fail appropriately."
                               type: string
                             targetVolumeAttributesClassName:
-                              description: targetVolumeAttributesClassName is the
-                                name of the VolumeAttributesClass the PVC currently
-                                being reconciled
                               type: string
                           required:
                           - status
                           type: object
                         phase:
-                          description: phase represents the current phase of PersistentVolumeClaim.
                           type: string
                       type: object
                   type: object
                 type: array
               clusterAdvertiseAddress:
-                description: |-
-                  ClusterAdvertiseAddress is the explicit address to advertise in cluster.
-                  Needs to be provided for non RFC1918 [1] (public) addresses.
-                  [1] RFC1918: https://tools.ietf.org/html/rfc1918
                 type: string
               clusterDomainName:
-                description: |-
-                  ClusterDomainName defines domain name suffix for in-cluster dns addresses
-                  aka .cluster.local
-                  used to build pod peer addresses for in-cluster communication
                 type: string
               configMaps:
-                description: |-
-                  ConfigMaps is a list of ConfigMaps in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/configs/CONFIGMAP_NAME folder
                 items:
                   type: string
                 type: array
               configNamespaceSelector:
-                description: |2-
-                   ConfigNamespaceSelector defines namespace selector for VMAlertmanagerConfig.
-                  Works in combination with Selector.
-                  NamespaceSelector nil - only objects at VMAlertmanager namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -10710,58 +9334,40 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               configRawYaml:
-                description: |-
-                  ConfigRawYaml - raw configuration for alertmanager,
-                  it helps it to start without secret.
-                  priority -> hardcoded ConfigRaw -> ConfigRaw, provided by user -> ConfigSecret.
                 type: string
+              configReloadAuthKeySecret:
+                properties:
+                  key:
+                    type: string
+                  name:
+                    default: ""
+                    type: string
+                  optional:
+                    type: boolean
+                required:
+                - key
+                type: object
+                x-kubernetes-map-type: atomic
               configReloaderExtraArgs:
                 additionalProperties:
                   type: string
-                description: |-
-                  ConfigReloaderExtraArgs that will be passed to  VMAuths config-reloader container
-                  for example resyncInterval: "30s"
                 type: object
+              configReloaderImage:
+                type: string
               configReloaderImageTag:
-                description: ConfigReloaderImageTag defines image:tag for config-reloader
-                  container
                 type: string
               configReloaderResources:
-                description: |-
-                  ConfigReloaderResources config-reloader container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
                 properties:
                   claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
                     items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
                       properties:
                         name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
                           type: string
                         request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
                           type: string
                       required:
                       - name
@@ -10777,9 +9383,6 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                   requests:
                     additionalProperties:
@@ -10788,53 +9391,20 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                 type: object
               configSecret:
-                description: |-
-                  ConfigSecret is the name of a Kubernetes Secret in the same namespace as the
-                  VMAlertmanager object, which contains configuration for this VMAlertmanager,
-                  configuration must be inside secret key: alertmanager.yaml.
-                  It must be created by user.
-                  instance. Defaults to 'vmalertmanager-<alertmanager-name>'
-                  The secret is mounted into /etc/alertmanager/config.
                 type: string
               configSelector:
-                description: |-
-                  ConfigSelector defines selector for VMAlertmanagerConfig, result config will be merged with with Raw or Secret config.
-                  Works in combination with NamespaceSelector.
-                  NamespaceSelector nil - only objects at VMAlertmanager namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -10848,141 +9418,69 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               containers:
-                description: |-
-                  Containers property allows to inject additions sidecars or to patch existing containers.
-                  It can be useful for proxies, backup, etc.
                 items:
-                  description: A single application container that you want to run
-                    within a pod.
                   required:
                   - name
                   type: object
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               disableAutomountServiceAccountToken:
-                description: |-
-                  DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
-                  Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
-                  For example, vmagent and vm-config-reloader requires k8s API access.
-                  Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
-                  And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
                 type: boolean
               disableNamespaceMatcher:
-                description: |-
-                  DisableNamespaceMatcher disables top route namespace label matcher for VMAlertmanagerConfig
-                  It may be useful if alert doesn't have namespace label for some reason
                 type: boolean
               disableRouteContinueEnforce:
-                description: DisableRouteContinueEnforce cancel the behavior for VMAlertmanagerConfig
-                  that always enforce first-level route continue to true
                 type: boolean
               disableSelfServiceScrape:
-                description: |-
-                  DisableSelfServiceScrape controls creation of VMServiceScrape by operator
-                  for the application.
-                  Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable
                 type: boolean
               dnsConfig:
-                description: |-
-                  Specifies the DNS parameters of a pod.
-                  Parameters specified here will be merged to the generated DNS
-                  configuration based on DNSPolicy.
                 items:
                   x-kubernetes-preserve-unknown-fields: true
                 properties:
                   nameservers:
-                    description: |-
-                      A list of DNS name server IP addresses.
-                      This will be appended to the base nameservers generated from DNSPolicy.
-                      Duplicated nameservers will be removed.
                     items:
                       type: string
                     type: array
                     x-kubernetes-list-type: atomic
                   options:
-                    description: |-
-                      A list of DNS resolver options.
-                      This will be merged with the base options generated from DNSPolicy.
-                      Duplicated entries will be removed. Resolution options given in Options
-                      will override those that appear in the base DNSPolicy.
                     items:
-                      description: PodDNSConfigOption defines DNS resolver options
-                        of a pod.
                       properties:
                         name:
-                          description: |-
-                            Name is this DNS resolver option's name.
-                            Required.
                           type: string
                         value:
-                          description: Value is this DNS resolver option's value.
                           type: string
                       type: object
                     type: array
                     x-kubernetes-list-type: atomic
                   searches:
-                    description: |-
-                      A list of DNS search domains for host-name lookup.
-                      This will be appended to the base search paths generated from DNSPolicy.
-                      Duplicated search paths will be removed.
                     items:
                       type: string
                     type: array
                     x-kubernetes-list-type: atomic
                 type: object
               dnsPolicy:
-                description: DNSPolicy sets DNS policy for the pod
+                type: string
+              enforcedNamespaceLabel:
                 type: string
               enforcedTopRouteMatchers:
-                description: |-
-                  EnforcedTopRouteMatchers defines label matchers to be added for the top route
-                  of VMAlertmanagerConfig
-                  It allows to make some set of labels required for alerts.
-                  https://prometheus.io/docs/alerting/latest/configuration/#matcher
                 items:
                   type: string
                 type: array
               externalURL:
-                description: |-
-                  ExternalURL the VMAlertmanager instances will be available under. This is
-                  necessary to generate correct URLs. This is necessary if VMAlertmanager is not
-                  served from root of a DNS name.
                 type: string
               extraArgs:
                 additionalProperties:
                   type: string
-                description: |-
-                  ExtraArgs that will be passed to the application container
-                  for example remoteWrite.tmpDataPath: /tmp
                 type: object
               extraEnvs:
-                description: ExtraEnvs that will be passed to the application container
                 items:
-                  description: EnvVar represents an environment variable present in
-                    a Container.
                   properties:
                     name:
-                      description: Name of the environment variable. Must be a C_IDENTIFIER.
                       type: string
                     value:
-                      description: |-
-                        Variable references $(VAR_NAME) are expanded
-                        using the previously defined environment variables in the container and
-                        any service environment variables. If a variable cannot be resolved,
-                        the reference in the input string will be unchanged. Double $$ are reduced
-                        to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                        "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                        Escaped references will never be expanded, regardless of whether the variable
-                        exists or not.
-                        Defaults to "".
                       type: string
                   required:
                   - name
@@ -10990,286 +9488,145 @@ spec:
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               extraEnvsFrom:
-                description: |-
-                  ExtraEnvsFrom defines source of env variables for the application container
-                  could either be secret or configmap
                 items:
-                  description: EnvFromSource represents the source of a set of ConfigMaps
                   properties:
                     configMapRef:
-                      description: The ConfigMap to select from
                       properties:
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the ConfigMap must be defined
                           type: boolean
                       type: object
                       x-kubernetes-map-type: atomic
                     prefix:
-                      description: An optional identifier to prepend to each key in
-                        the ConfigMap. Must be a C_IDENTIFIER.
                       type: string
                     secretRef:
-                      description: The Secret to select from
                       properties:
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the Secret must be defined
                           type: boolean
                       type: object
                       x-kubernetes-map-type: atomic
                   type: object
                 type: array
               gossipConfig:
-                description: GossipConfig defines gossip TLS configuration for Alertmanager
-                  cluster
                 properties:
                   tls_client_config:
-                    description: TLSClientConfig defines client TLS configuration
-                      for alertmanager
                     properties:
                       ca_file:
-                        description: |-
-                          CAFile defines path to the pre-mounted file with CA
-                          mutually exclusive with CASecretRef
                         type: string
                       ca_secret_ref:
-                        description: |-
-                          CA defines reference for secret with CA content under given key
-                          mutually exclusive with CAFile
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       cert_file:
-                        description: |-
-                          CertFile defines path to the pre-mounted file with certificate
-                          mutually exclusive with CertSecretRef
                         type: string
                       cert_secret_ref:
-                        description: |-
-                          CertSecretRef defines reference for secret with certificate content under given key
-                          mutually exclusive with CertFile
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       insecure_skip_verify:
-                        description: |-
-                          Cert defines reference for secret with CA content under given key
-                          mutually exclusive with CertFile
                         type: boolean
                       key_file:
-                        description: |-
-                          KeyFile defines path to the pre-mounted file with certificate key
-                          mutually exclusive with KeySecretRef
                         type: string
                       key_secret_ref:
-                        description: |-
-                          Key defines reference for secret with certificate key content under given key
-                          mutually exclusive with KeyFile
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       server_name:
-                        description: ServerName indicates a name of a server
                         type: string
                     type: object
                   tls_server_config:
-                    description: TLSServerConfig defines server TLS configuration
-                      for alertmanager
                     properties:
                       cert_file:
-                        description: |-
-                          CertFile defines path to the pre-mounted file with certificate
-                          mutually exclusive with CertSecretRef
                         type: string
                       cert_secret_ref:
-                        description: |-
-                          CertSecretRef defines reference for secret with certificate content under given key
-                          mutually exclusive with CertFile
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       cipher_suites:
-                        description: |-
-                          CipherSuites defines list of supported cipher suites for TLS versions up to TLS 1.2
-                          https://golang.org/pkg/crypto/tls/#pkg-constants
                         items:
                           type: string
                         type: array
                       client_auth_type:
-                        description: |-
-                          Cert defines reference for secret with CA content under given key
-                          mutually exclusive with CertFile
-                          ClientAuthType defines server policy for client authentication
-                          If you want to enable client authentication (aka mTLS), you need to use RequireAndVerifyClientCert
-                          Note, mTLS is supported only at enterprise version of VictoriaMetrics components
                         enum:
                         - NoClientCert
                         - RequireAndVerifyClientCert
                         type: string
                       client_ca_file:
-                        description: |-
-                          ClientCAFile defines path to the pre-mounted file with CA
-                          mutually exclusive with ClientCASecretRef
                         type: string
                       client_ca_secret_ref:
-                        description: |-
-                          ClientCASecretRef defines reference for secret with CA content under given key
-                          mutually exclusive with ClientCAFile
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       curve_preferences:
-                        description: |-
-                          CurvePreferences defines elliptic curves that will be used in an ECDHE handshake, in preference order.
-                          https://golang.org/pkg/crypto/tls/#CurveID
                         items:
                           type: string
                         type: array
                       key_file:
-                        description: |-
-                          KeyFile defines path to the pre-mounted file with certificate key
-                          mutually exclusive with KeySecretRef
                         type: string
                       key_secret_ref:
-                        description: |-
-                          Key defines reference for secret with certificate key content under given key
-                          mutually exclusive with KeyFile
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       max_version:
-                        description: MaxVersion maximum TLS version that is acceptable.
                         enum:
                         - TLS10
                         - TLS11
@@ -11277,7 +9634,6 @@ spec:
                         - TLS13
                         type: string
                       min_version:
-                        description: MinVersion minimum TLS version that is acceptable.
                         enum:
                         - TLS10
                         - TLS11
@@ -11285,132 +9641,75 @@ spec:
                         - TLS13
                         type: string
                       prefer_server_cipher_suites:
-                        description: |-
-                          PreferServerCipherSuites controls whether the server selects the
-                          client's most preferred ciphersuite
                         type: boolean
                     type: object
                 type: object
               host_aliases:
-                description: |-
-                  HostAliasesUnderScore provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
-                  Has Priority over hostAliases field
                 items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
                   properties:
                     hostnames:
-                      description: Hostnames for the above IP address.
                       items:
                         type: string
                       type: array
                       x-kubernetes-list-type: atomic
                     ip:
-                      description: IP address of the host file entry.
                       type: string
                   required:
                   - ip
                   type: object
                 type: array
               hostAliases:
-                description: |-
-                  HostAliases provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
                 items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
                   properties:
                     hostnames:
-                      description: Hostnames for the above IP address.
                       items:
                         type: string
                       type: array
                       x-kubernetes-list-type: atomic
                     ip:
-                      description: IP address of the host file entry.
                       type: string
                   required:
                   - ip
                   type: object
                 type: array
               hostNetwork:
-                description: HostNetwork controls whether the pod may use the node
-                  network namespace
                 type: boolean
               image:
-                description: |-
-                  Image - docker image settings
-                  if no specified operator uses default version from operator config
                 properties:
                   pullPolicy:
-                    description: PullPolicy describes how to pull docker image
                     type: string
                   repository:
-                    description: Repository contains name of docker image + it's repository
-                      if needed
                     type: string
                   tag:
-                    description: Tag contains desired docker image version
                     type: string
                 type: object
               imagePullSecrets:
-                description: |-
-                  ImagePullSecrets An optional list of references to secrets in the same namespace
-                  to use for pulling images from registries
-                  see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
                 items:
-                  description: |-
-                    LocalObjectReference contains enough information to let you locate the
-                    referenced object inside the same namespace.
                   properties:
                     name:
                       default: ""
-                      description: |-
-                        Name of the referent.
-                        This field is effectively required, but due to backwards compatibility is
-                        allowed to be empty. Instances of this type with an empty value here are
-                        almost certainly wrong.
-                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                       type: string
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
               initContainers:
-                description: |-
-                  InitContainers allows adding initContainers to the pod definition.
-                  Any errors during the execution of an initContainer will lead to a restart of the Pod.
-                  More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
                 items:
-                  description: A single application container that you want to run
-                    within a pod.
                   required:
                   - name
                   type: object
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               listenLocal:
-                description: |-
-                  ListenLocal makes the VMAlertmanager server listen on loopback, so that it
-                  does not bind against the Pod IP. Note this is only for the VMAlertmanager
-                  UI, not the gossip communication.
                 type: boolean
               livenessProbe:
-                description: LivenessProbe that will be added CRD pod
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               logFormat:
-                description: LogFormat for VMAlertmanager to be configured with.
                 enum:
                 - logfmt
                 - json
                 type: string
               logLevel:
-                description: Log level for VMAlertmanager to be configured with.
                 enum:
                 - debug
                 - info
@@ -11422,169 +9721,96 @@ spec:
                 - ERROR
                 type: string
               managedMetadata:
-                description: |-
-                  ManagedMetadata defines metadata that will be added to the all objects
-                  created by operator for the given CustomResource
                 properties:
                   annotations:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                     type: object
                   labels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                     type: object
                 type: object
               minReadySeconds:
-                description: |-
-                  MinReadySeconds defines a minimum number of seconds to wait before starting update next pod
-                  if previous in healthy state
-                  Has no effect for VLogs and VMSingle
                 format: int32
                 type: integer
               nodeSelector:
                 additionalProperties:
                   type: string
-                description: NodeSelector Define which Nodes the Pods are scheduled
-                  on.
                 type: object
               paused:
-                description: |-
-                  Paused If set to true all actions on the underlying managed objects are not
-                  going to be performed, except for delete actions.
                 type: boolean
+              persistentVolumeClaimRetentionPolicy:
+                properties:
+                  whenDeleted:
+                    type: string
+                  whenScaled:
+                    type: string
+                type: object
               podDisruptionBudget:
-                description: PodDisruptionBudget created by operator
                 properties:
                   maxUnavailable:
                     anyOf:
                     - type: integer
                     - type: string
-                    description: |-
-                      An eviction is allowed if at most "maxUnavailable" pods selected by
-                      "selector" are unavailable after the eviction, i.e. even in absence of
-                      the evicted pod. For example, one can prevent all voluntary evictions
-                      by specifying 0. This is a mutually exclusive setting with "minAvailable".
                     x-kubernetes-int-or-string: true
                   minAvailable:
                     anyOf:
                     - type: integer
                     - type: string
-                    description: |-
-                      An eviction is allowed if at least "minAvailable" pods selected by
-                      "selector" will still be available after the eviction, i.e. even in the
-                      absence of the evicted pod.  So for example you can prevent all voluntary
-                      evictions by specifying "100%".
                     x-kubernetes-int-or-string: true
                   selectorLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      replaces default labels selector generated by operator
-                      it's useful when you need to create custom budget
                     type: object
+                  unhealthyPodEvictionPolicy:
+                    enum:
+                    - IfHealthyBudget
+                    - AlwaysAllow
+                    type: string
                 type: object
               podMetadata:
-                description: PodMetadata configures Labels and Annotations which are
-                  propagated to the alertmanager pods.
                 properties:
                   annotations:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                     type: object
                   labels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects. May match selectors of replication controllers
-                      and services.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                     type: object
                   name:
-                    description: |-
-                      Name must be unique within a namespace. Is required when creating resources, although
-                      some resources may allow a client to request the generation of an appropriate name
-                      automatically. Name is primarily intended for creation idempotence and configuration
-                      definition.
-                      Cannot be updated.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                     type: string
                 type: object
               port:
-                description: Port listen address
                 type: string
               portName:
-                description: |-
-                  PortName used for the pods and governing service.
-                  This defaults to web
                 type: string
               priorityClassName:
-                description: PriorityClassName class assigned to the Pods
                 type: string
               readinessGates:
-                description: ReadinessGates defines pod readiness gates
                 items:
-                  description: PodReadinessGate contains the reference to a pod condition
                   properties:
                     conditionType:
-                      description: ConditionType refers to a condition in the pod's
-                        condition list with matching type.
                       type: string
                   required:
                   - conditionType
                   type: object
                 type: array
               readinessProbe:
-                description: ReadinessProbe that will be added CRD pod
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               replicaCount:
-                description: ReplicaCount is the expected size of the Application.
                 format: int32
                 type: integer
               resources:
-                description: |-
-                  Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
                 properties:
                   claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
                     items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
                       properties:
                         name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
                           type: string
                         request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
                           type: string
                       required:
                       - name
@@ -11600,9 +9826,6 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                   requests:
                     additionalProperties:
@@ -11611,255 +9834,110 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                 type: object
               retention:
-                description: |-
-                  Retention Time duration VMAlertmanager shall retain data for. Default is '120h',
-                  and must match the regular expression `[0-9]+(ms|s|m|h)` (milliseconds seconds minutes hours).
                 pattern: '[0-9]+(ms|s|m|h)'
                 type: string
               revisionHistoryLimitCount:
-                description: |-
-                  The number of old ReplicaSets to retain to allow rollback in deployment or
-                  maximum number of revisions that will be maintained in the Deployment revision history.
-                  Has no effect at StatefulSets
-                  Defaults to 10.
                 format: int32
                 type: integer
               rollingUpdateStrategy:
-                description: |-
-                  RollingUpdateStrategy defines strategy for application updates
-                  Default is OnDelete, in this case operator handles update process
-                  Can be changed for RollingUpdate
                 type: string
               routePrefix:
-                description: |-
-                  RoutePrefix VMAlertmanager registers HTTP handlers for. This is useful,
-                  if using ExternalURL and a proxy is rewriting HTTP routes of a request,
-                  and the actual ExternalURL is still true, but the server serves requests
-                  under a different route prefix. For example for use with `kubectl proxy`.
                 type: string
               runtimeClassName:
-                description: |-
-                  RuntimeClassName - defines runtime class for kubernetes pod.
-                  https://kubernetes.io/docs/concepts/containers/runtime-class/
                 type: string
               schedulerName:
-                description: SchedulerName - defines kubernetes scheduler name
                 type: string
               secrets:
-                description: |-
-                  Secrets is a list of Secrets in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/secrets/SECRET_NAME folder
                 items:
                   type: string
                 type: array
               securityContext:
-                description: |-
-                  SecurityContext holds pod-level security attributes and common container settings.
-                  This defaults to the default PodSecurityContext.
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               selectAllByDefault:
-                description: |-
-                  SelectAllByDefault changes default behavior for empty CRD selectors, such ConfigSelector.
-                  with selectAllByDefault: true and undefined ConfigSelector and ConfigNamespaceSelector
-                  Operator selects all exist alertManagerConfigs
-                  with selectAllByDefault: false - selects nothing
                 type: boolean
               serviceAccountName:
-                description: ServiceAccountName is the name of the ServiceAccount
-                  to use to run the pods
                 type: string
               serviceScrapeSpec:
-                description: ServiceScrapeSpec that will be added to vmalertmanager
-                  VMServiceScrape spec
                 required:
                 - endpoints
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               serviceSpec:
-                description: ServiceSpec that will be added to vmalertmanager service
-                  spec
                 properties:
                   metadata:
-                    description: EmbeddedObjectMetadata defines objectMeta for additional
-                      service.
                     properties:
                       annotations:
                         additionalProperties:
                           type: string
-                        description: |-
-                          Annotations is an unstructured key value map stored with a resource that may be
-                          set by external tools to store and retrieve arbitrary metadata. They are not
-                          queryable and should be preserved when modifying objects.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                         type: object
                       labels:
                         additionalProperties:
                           type: string
-                        description: |-
-                          Labels Map of string keys and values that can be used to organize and categorize
-                          (scope and select) objects. May match selectors of replication controllers
-                          and services.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                         type: object
                       name:
-                        description: |-
-                          Name must be unique within a namespace. Is required when creating resources, although
-                          some resources may allow a client to request the generation of an appropriate name
-                          automatically. Name is primarily intended for creation idempotence and configuration
-                          definition.
-                          Cannot be updated.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                         type: string
                     type: object
                   spec:
-                    description: |-
-                      ServiceSpec describes the attributes that a user creates on a service.
-                      More info: https://kubernetes.io/docs/concepts/services-networking/service/
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   useAsDefault:
-                    description: |-
-                      UseAsDefault applies changes from given service definition to the main object Service
-                      Changing from headless service to clusterIP or loadbalancer may break cross-component communication
                     type: boolean
                 required:
                 - spec
                 type: object
               startupProbe:
-                description: StartupProbe that will be added to CRD pod
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               storage:
-                description: |-
-                  Storage is the definition of how storage will be used by the VMAlertmanager
-                  instances.
                 properties:
-                  disableMountSubPath:
-                    description: |-
-                      Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary.
-                      DisableMountSubPath allows to remove any subPath usage in volume mounts.
-                    type: boolean
                   emptyDir:
-                    description: |-
-                      EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More
-                      info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir
                     properties:
                       medium:
-                        description: |-
-                          medium represents what type of storage medium should back this directory.
-                          The default is "" which means to use the node's default medium.
-                          Must be an empty string (default) or Memory.
-                          More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
                         type: string
                       sizeLimit:
                         anyOf:
                         - type: integer
                         - type: string
-                        description: |-
-                          sizeLimit is the total amount of local storage required for this EmptyDir volume.
-                          The size limit is also applicable for memory medium.
-                          The maximum usage on memory medium EmptyDir would be the minimum value between
-                          the SizeLimit specified here and the sum of memory limits of all containers in a pod.
-                          The default is nil which means that the limit is undefined.
-                          More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
                         pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                         x-kubernetes-int-or-string: true
                     type: object
                   volumeClaimTemplate:
-                    description: A PVC spec to be used by the VMAlertManager StatefulSets.
                     properties:
                       apiVersion:
-                        description: |-
-                          APIVersion defines the versioned schema of this representation of an object.
-                          Servers should convert recognized schemas to the latest internal value, and
-                          may reject unrecognized values.
-                          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
                         type: string
                       kind:
-                        description: |-
-                          Kind is a string value representing the REST resource this object represents.
-                          Servers may infer this from the endpoint the client submits requests to.
-                          Cannot be updated.
-                          In CamelCase.
-                          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
                         type: string
                       metadata:
-                        description: EmbeddedMetadata contains metadata relevant to
-                          an EmbeddedResource.
                         properties:
                           annotations:
                             additionalProperties:
                               type: string
-                            description: |-
-                              Annotations is an unstructured key value map stored with a resource that may be
-                              set by external tools to store and retrieve arbitrary metadata. They are not
-                              queryable and should be preserved when modifying objects.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                             type: object
                           labels:
                             additionalProperties:
                               type: string
-                            description: |-
-                              Labels Map of string keys and values that can be used to organize and categorize
-                              (scope and select) objects. May match selectors of replication controllers
-                              and services.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                             type: object
                           name:
-                            description: |-
-                              Name must be unique within a namespace. Is required when creating resources, although
-                              some resources may allow a client to request the generation of an appropriate name
-                              automatically. Name is primarily intended for creation idempotence and configuration
-                              definition.
-                              Cannot be updated.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                             type: string
                         type: object
                       spec:
-                        description: |-
-                          Spec defines the desired characteristics of a volume requested by a pod author.
-                          More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
                         properties:
                           accessModes:
-                            description: |-
-                              accessModes contains the desired access modes the volume should have.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
                             items:
                               type: string
                             type: array
                             x-kubernetes-list-type: atomic
                           dataSource:
-                            description: |-
-                              dataSource field can be used to specify either:
-                              * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
-                              * An existing PVC (PersistentVolumeClaim)
-                              If the provisioner or an external controller can support the specified data source,
-                              it will create a new volume based on the contents of the specified data source.
-                              When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-                              and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
-                              If the namespace is specified, then dataSourceRef will not be copied to dataSource.
                             properties:
                               apiGroup:
-                                description: |-
-                                  APIGroup is the group for the resource being referenced.
-                                  If APIGroup is not specified, the specified Kind must be in the core API group.
-                                  For any other third-party types, APIGroup is required.
                                 type: string
                               kind:
-                                description: Kind is the type of resource being referenced
                                 type: string
                               name:
-                                description: Name is the name of resource being referenced
                                 type: string
                             required:
                             - kind
@@ -11867,60 +9945,20 @@ spec:
                             type: object
                             x-kubernetes-map-type: atomic
                           dataSourceRef:
-                            description: |-
-                              dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
-                              volume is desired. This may be any object from a non-empty API group (non
-                              core object) or a PersistentVolumeClaim object.
-                              When this field is specified, volume binding will only succeed if the type of
-                              the specified object matches some installed volume populator or dynamic
-                              provisioner.
-                              This field will replace the functionality of the dataSource field and as such
-                              if both fields are non-empty, they must have the same value. For backwards
-                              compatibility, when namespace isn't specified in dataSourceRef,
-                              both fields (dataSource and dataSourceRef) will be set to the same
-                              value automatically if one of them is empty and the other is non-empty.
-                              When namespace is specified in dataSourceRef,
-                              dataSource isn't set to the same value and must be empty.
-                              There are three important differences between dataSource and dataSourceRef:
-                              * While dataSource only allows two specific types of objects, dataSourceRef
-                                allows any non-core object, as well as PersistentVolumeClaim objects.
-                              * While dataSource ignores disallowed values (dropping them), dataSourceRef
-                                preserves all values, and generates an error if a disallowed value is
-                                specified.
-                              * While dataSource only allows local objects, dataSourceRef allows objects
-                                in any namespaces.
-                              (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
-                              (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
                             properties:
                               apiGroup:
-                                description: |-
-                                  APIGroup is the group for the resource being referenced.
-                                  If APIGroup is not specified, the specified Kind must be in the core API group.
-                                  For any other third-party types, APIGroup is required.
                                 type: string
                               kind:
-                                description: Kind is the type of resource being referenced
                                 type: string
                               name:
-                                description: Name is the name of resource being referenced
                                 type: string
                               namespace:
-                                description: |-
-                                  Namespace is the namespace of resource being referenced
-                                  Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
-                                  (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
                                 type: string
                             required:
                             - kind
                             - name
                             type: object
                           resources:
-                            description: |-
-                              resources represents the minimum resources the volume should have.
-                              If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
-                              that are lower than previous value but must still be higher than capacity recorded in the
-                              status field of the claim.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
                             properties:
                               limits:
                                 additionalProperties:
@@ -11929,9 +9967,6 @@ spec:
                                   - type: string
                                   pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                   x-kubernetes-int-or-string: true
-                                description: |-
-                                  Limits describes the maximum amount of compute resources allowed.
-                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                 type: object
                               requests:
                                 additionalProperties:
@@ -11940,40 +9975,18 @@ spec:
                                   - type: string
                                   pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                   x-kubernetes-int-or-string: true
-                                description: |-
-                                  Requests describes the minimum amount of compute resources required.
-                                  If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                                  otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                 type: object
                             type: object
                           selector:
-                            description: selector is a label query over volumes to
-                              consider for binding.
                             properties:
                               matchExpressions:
-                                description: matchExpressions is a list of label selector
-                                  requirements. The requirements are ANDed.
                                 items:
-                                  description: |-
-                                    A label selector requirement is a selector that contains values, a key, and an operator that
-                                    relates the key and values.
                                   properties:
                                     key:
-                                      description: key is the label key that the selector
-                                        applies to.
                                       type: string
                                     operator:
-                                      description: |-
-                                        operator represents a key's relationship to a set of values.
-                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                       type: string
                                     values:
-                                      description: |-
-                                        values is an array of string values. If the operator is In or NotIn,
-                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                        the values array must be empty. This array is replaced during a strategic
-                                        merge patch.
                                       items:
                                         type: string
                                       type: array
@@ -11987,100 +10000,28 @@ spec:
                               matchLabels:
                                 additionalProperties:
                                   type: string
-                                description: |-
-                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                 type: object
                             type: object
                             x-kubernetes-map-type: atomic
                           storageClassName:
-                            description: |-
-                              storageClassName is the name of the StorageClass required by the claim.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
                             type: string
                           volumeAttributesClassName:
-                            description: |-
-                              volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
-                              If specified, the CSI driver will create or update the volume with the attributes defined
-                              in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                              it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                              will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                              If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                              will be set by the persistentvolume controller if it exists.
-                              If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
-                              set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
-                              exists.
-                              More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                              (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                             type: string
                           volumeMode:
-                            description: |-
-                              volumeMode defines what type of volume is required by the claim.
-                              Value of Filesystem is implied when not included in claim spec.
                             type: string
                           volumeName:
-                            description: volumeName is the binding reference to the
-                              PersistentVolume backing this claim.
                             type: string
                         type: object
                       status:
-                        description: |-
-                          Status represents the current information/status of a persistent volume claim.
-                          Read-only.
-                          More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
                         properties:
                           accessModes:
-                            description: |-
-                              accessModes contains the actual access modes the volume backing the PVC has.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
                             items:
                               type: string
                             type: array
                             x-kubernetes-list-type: atomic
                           allocatedResourceStatuses:
                             additionalProperties:
-                              description: |-
-                                When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource
-                                that it does not recognizes, then it should ignore that update and let other controllers
-                                handle it.
                               type: string
-                            description: "allocatedResourceStatuses stores status
-                              of resource being resized for the given PVC.\nKey names
-                              follow standard Kubernetes label syntax. Valid values
-                              are either:\n\t* Un-prefixed keys:\n\t\t- storage -
-                              the capacity of the volume.\n\t* Custom resources must
-                              use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart
-                              from above values - keys that are unprefixed or have
-                              kubernetes.io prefix are considered\nreserved and hence
-                              may not be used.\n\nClaimResourceStatus can be in any
-                              of following states:\n\t- ControllerResizeInProgress:\n\t\tState
-                              set when resize controller starts resizing the volume
-                              in control-plane.\n\t- ControllerResizeFailed:\n\t\tState
-                              set when resize has failed in resize controller with
-                              a terminal error.\n\t- NodeResizePending:\n\t\tState
-                              set when resize controller has finished resizing the
-                              volume but further resizing of\n\t\tvolume is needed
-                              on the node.\n\t- NodeResizeInProgress:\n\t\tState set
-                              when kubelet starts resizing the volume.\n\t- NodeResizeFailed:\n\t\tState
-                              set when resizing has failed in kubelet with a terminal
-                              error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor
-                              example: if expanding a PVC for more capacity - this
-                              field can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage']
-                              = \"ControllerResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                              = \"ControllerResizeFailed\"\n     - pvc.status.allocatedResourceStatus['storage']
-                              = \"NodeResizePending\"\n     - pvc.status.allocatedResourceStatus['storage']
-                              = \"NodeResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                              = \"NodeResizeFailed\"\nWhen this field is not set,
-                              it means that no resize operation is in progress for
-                              the given PVC.\n\nA controller that receives PVC update
-                              with previously unknown resourceName or ClaimResourceStatus\nshould
-                              ignore the update for the purpose it was designed. For
-                              example - a controller that\nonly is responsible for
-                              resizing capacity of the volume, should ignore PVC updates
-                              that change other valid\nresources associated with PVC.\n\nThis
-                              is an alpha field and requires enabling RecoverVolumeExpansionFailure
-                              feature."
                             type: object
                             x-kubernetes-map-type: granular
                           allocatedResources:
@@ -12090,31 +10031,6 @@ spec:
                               - type: string
                               pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                               x-kubernetes-int-or-string: true
-                            description: "allocatedResources tracks the resources
-                              allocated to a PVC including its capacity.\nKey names
-                              follow standard Kubernetes label syntax. Valid values
-                              are either:\n\t* Un-prefixed keys:\n\t\t- storage -
-                              the capacity of the volume.\n\t* Custom resources must
-                              use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart
-                              from above values - keys that are unprefixed or have
-                              kubernetes.io prefix are considered\nreserved and hence
-                              may not be used.\n\nCapacity reported here may be larger
-                              than the actual capacity when a volume expansion operation\nis
-                              requested.\nFor storage quota, the larger value from
-                              allocatedResources and PVC.spec.resources is used.\nIf
-                              allocatedResources is not set, PVC.spec.resources alone
-                              is used for quota calculation.\nIf a volume expansion
-                              capacity request is lowered, allocatedResources is only\nlowered
-                              if there are no expansion operations in progress and
-                              if the actual volume capacity\nis equal or lower than
-                              the requested capacity.\n\nA controller that receives
-                              PVC update with previously unknown resourceName\nshould
-                              ignore the update for the purpose it was designed. For
-                              example - a controller that\nonly is responsible for
-                              resizing capacity of the volume, should ignore PVC updates
-                              that change other valid\nresources associated with PVC.\n\nThis
-                              is an alpha field and requires enabling RecoverVolumeExpansionFailure
-                              feature."
                             type: object
                           capacity:
                             additionalProperties:
@@ -12123,47 +10039,23 @@ spec:
                               - type: string
                               pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                               x-kubernetes-int-or-string: true
-                            description: capacity represents the actual resources
-                              of the underlying volume.
                             type: object
                           conditions:
-                            description: |-
-                              conditions is the current Condition of persistent volume claim. If underlying persistent volume is being
-                              resized then the Condition will be set to 'Resizing'.
                             items:
-                              description: PersistentVolumeClaimCondition contains
-                                details about state of pvc
                               properties:
                                 lastProbeTime:
-                                  description: lastProbeTime is the time we probed
-                                    the condition.
                                   format: date-time
                                   type: string
                                 lastTransitionTime:
-                                  description: lastTransitionTime is the time the
-                                    condition transitioned from one status to another.
                                   format: date-time
                                   type: string
                                 message:
-                                  description: message is the human-readable message
-                                    indicating details about last transition.
                                   type: string
                                 reason:
-                                  description: |-
-                                    reason is a unique, this should be a short, machine understandable string that gives the reason
-                                    for condition's last transition. If it reports "Resizing" that means the underlying
-                                    persistent volume is being resized.
                                   type: string
                                 status:
-                                  description: |-
-                                    Status is the status of the condition.
-                                    Can be True, False, Unknown.
-                                    More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required
                                   type: string
                                 type:
-                                  description: |-
-                                    Type is the type of the condition.
-                                    More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about
                                   type: string
                               required:
                               - status
@@ -12174,64 +10066,28 @@ spec:
                             - type
                             x-kubernetes-list-type: map
                           currentVolumeAttributesClassName:
-                            description: |-
-                              currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
-                              When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                              This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                             type: string
                           modifyVolumeStatus:
-                            description: |-
-                              ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
-                              When this is unset, there is no ModifyVolume operation being attempted.
-                              This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                             properties:
                               status:
-                                description: "status is the status of the ControllerModifyVolume
-                                  operation. It can be in any of following states:\n
-                                  - Pending\n   Pending indicates that the PersistentVolumeClaim
-                                  cannot be modified due to unmet requirements, such
-                                  as\n   the specified VolumeAttributesClass not existing.\n
-                                  - InProgress\n   InProgress indicates that the volume
-                                  is being modified.\n - Infeasible\n  Infeasible
-                                  indicates that the request has been rejected as
-                                  invalid by the CSI driver. To\n\t  resolve the error,
-                                  a valid VolumeAttributesClass needs to be specified.\nNote:
-                                  New statuses can be added in the future. Consumers
-                                  should check for unknown statuses and fail appropriately."
                                 type: string
                               targetVolumeAttributesClassName:
-                                description: targetVolumeAttributesClassName is the
-                                  name of the VolumeAttributesClass the PVC currently
-                                  being reconciled
                                 type: string
                             required:
                             - status
                             type: object
                           phase:
-                            description: phase represents the current phase of PersistentVolumeClaim.
                             type: string
                         type: object
                     type: object
                 type: object
               templates:
-                description: |-
-                  Templates is a list of ConfigMap key references for ConfigMaps in the same namespace as the VMAlertmanager
-                  object, which shall be mounted into the VMAlertmanager Pods.
-                  The Templates are mounted into /etc/vm/templates/<configmap-name>/<configmap-key>.
                 items:
-                  description: ConfigMapKeyReference refers to a key in a ConfigMap.
                   properties:
                     key:
-                      description: The ConfigMap key to refer to.
                       type: string
                     name:
                       default: ""
-                      description: |-
-                        Name of the referent.
-                        This field is effectively required, but due to backwards compatibility is
-                        allowed to be empty. Instances of this type with an empty value here are
-                        almost certainly wrong.
-                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                       type: string
                   required:
                   - key
@@ -12239,58 +10095,26 @@ spec:
                   x-kubernetes-map-type: atomic
                 type: array
               terminationGracePeriodSeconds:
-                description: TerminationGracePeriodSeconds period for container graceful
-                  termination
                 format: int64
                 type: integer
               tolerations:
-                description: Tolerations If specified, the pod's tolerations.
                 items:
-                  description: |-
-                    The pod this Toleration is attached to tolerates any taint that matches
-                    the triple <key,value,effect> using the matching operator <operator>.
                   properties:
                     effect:
-                      description: |-
-                        Effect indicates the taint effect to match. Empty means match all taint effects.
-                        When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                       type: string
                     key:
-                      description: |-
-                        Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                        If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                       type: string
                     operator:
-                      description: |-
-                        Operator represents a key's relationship to the value.
-                        Valid operators are Exists and Equal. Defaults to Equal.
-                        Exists is equivalent to wildcard for value, so that a pod can
-                        tolerate all taints of a particular category.
                       type: string
                     tolerationSeconds:
-                      description: |-
-                        TolerationSeconds represents the period of time the toleration (which must be
-                        of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                        it is not set, which means tolerate the taint forever (do not evict). Zero and
-                        negative values will be treated as 0 (evict immediately) by the system.
                       format: int64
                       type: integer
                     value:
-                      description: |-
-                        Value is the taint value the toleration matches to.
-                        If the operator is Exists, the value should be empty, otherwise just a regular string.
                       type: string
                   type: object
                 type: array
               topologySpreadConstraints:
-                description: |-
-                  TopologySpreadConstraints embedded kubernetes pod configuration option,
-                  controls how pods are spread across your cluster among failure-domains
-                  such as regions, zones, nodes, and other user-defined topology domains
-                  https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
                 items:
-                  description: TopologySpreadConstraint specifies how to spread matching
-                    pods among the given topology.
                   required:
                   - maxSkew
                   - topologyKey
@@ -12298,84 +10122,104 @@ spec:
                   type: object
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
+              tracingConfig:
+                properties:
+                  client_type:
+                    enum:
+                    - http
+                    - grpc
+                    type: string
+                  compression:
+                    type: string
+                  endpoint:
+                    type: string
+                  http_headers:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  insecure:
+                    type: boolean
+                  sampling_fraction:
+                    type: string
+                  timeout:
+                    type: string
+                  tls_config:
+                    properties:
+                      ca_file:
+                        type: string
+                      ca_secret_ref:
+                        properties:
+                          key:
+                            type: string
+                          name:
+                            default: ""
+                            type: string
+                          optional:
+                            type: boolean
+                        required:
+                        - key
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      cert_file:
+                        type: string
+                      cert_secret_ref:
+                        properties:
+                          key:
+                            type: string
+                          name:
+                            default: ""
+                            type: string
+                          optional:
+                            type: boolean
+                        required:
+                        - key
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      insecure_skip_verify:
+                        type: boolean
+                      key_file:
+                        type: string
+                      key_secret_ref:
+                        properties:
+                          key:
+                            type: string
+                          name:
+                            default: ""
+                            type: string
+                          optional:
+                            type: boolean
+                        required:
+                        - key
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      server_name:
+                        type: string
+                    type: object
+                required:
+                - endpoint
+                type: object
               useDefaultResources:
-                description: |-
-                  UseDefaultResources controls resource settings
-                  By default, operator sets built-in resource requirements
                 type: boolean
               useStrictSecurity:
-                description: |-
-                  UseStrictSecurity enables strict security mode for component
-                  it restricts disk writes access
-                  uses non-root user out of the box
-                  drops not needed security permissions
                 type: boolean
               useVMConfigReloader:
-                description: |-
-                  UseVMConfigReloader replaces prometheus-like config-reloader
-                  with vm one. It uses secrets watch instead of file watch
-                  which greatly increases speed of config updates
                 type: boolean
               volumeMounts:
-                description: |-
-                  VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
-                  VolumeMounts specified will be appended to other VolumeMounts in the Application container
                 items:
-                  description: VolumeMount describes a mounting of a Volume within
-                    a container.
                   properties:
                     mountPath:
-                      description: |-
-                        Path within the container at which the volume should be mounted.  Must
-                        not contain ':'.
                       type: string
                     mountPropagation:
-                      description: |-
-                        mountPropagation determines how mounts are propagated from the host
-                        to container and the other way around.
-                        When not set, MountPropagationNone is used.
-                        This field is beta in 1.10.
-                        When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                        (which defaults to None).
                       type: string
                     name:
-                      description: This must match the Name of a Volume.
                       type: string
                     readOnly:
-                      description: |-
-                        Mounted read-only if true, read-write otherwise (false or unspecified).
-                        Defaults to false.
                       type: boolean
                     recursiveReadOnly:
-                      description: |-
-                        RecursiveReadOnly specifies whether read-only mounts should be handled
-                        recursively.
-
-                        If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                        If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                        recursively read-only.  If this field is set to IfPossible, the mount is made
-                        recursively read-only, if it is supported by the container runtime.  If this
-                        field is set to Enabled, the mount is made recursively read-only if it is
-                        supported by the container runtime, otherwise the pod will not be started and
-                        an error will be generated to indicate the reason.
-
-                        If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                        None (or be unspecified, which defaults to None).
-
-                        If this field is not specified, it is treated as an equivalent of Disabled.
                       type: string
                     subPath:
-                      description: |-
-                        Path within the volume from which the container's volume should be mounted.
-                        Defaults to "" (volume's root).
                       type: string
                     subPathExpr:
-                      description: |-
-                        Expanded path within the volume from which the container's volume should be mounted.
-                        Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                        Defaults to "" (volume's root).
-                        SubPathExpr and SubPath are mutually exclusive.
                       type: string
                   required:
                   - mountPath
@@ -12383,170 +10227,88 @@ spec:
                   type: object
                 type: array
               volumes:
-                description: |-
-                  Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
-                  Volumes specified will be appended to other volumes that are generated.
-                  / +optional
                 items:
-                  description: Volume represents a named volume in a pod that may
-                    be accessed by any container in the pod.
                   required:
                   - name
                   type: object
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               webConfig:
-                description: |-
-                  WebConfig defines configuration for webserver
-                  https://github.com/prometheus/alertmanager/blob/main/docs/https.md
                 properties:
                   basic_auth_users:
                     additionalProperties:
                       type: string
-                    description: |-
-                      BasicAuthUsers Usernames and hashed passwords that have full access to the web server
-                      Passwords must be hashed with bcrypt
                     type: object
                   http_server_config:
-                    description: HTTPServerConfig defines http server configuration
-                      for alertmanager web server
                     properties:
                       headers:
                         additionalProperties:
                           type: string
-                        description: Headers defines list of headers that can be added
-                          to HTTP responses.
                         type: object
                       http2:
-                        description: |-
-                          HTTP2 enables HTTP/2 support. Note that HTTP/2 is only supported with TLS.
-                          This can not be changed on the fly.
                         type: boolean
                     type: object
                   tls_server_config:
-                    description: TLSServerConfig defines server TLS configuration
-                      for alertmanager
                     properties:
                       cert_file:
-                        description: |-
-                          CertFile defines path to the pre-mounted file with certificate
-                          mutually exclusive with CertSecretRef
                         type: string
                       cert_secret_ref:
-                        description: |-
-                          CertSecretRef defines reference for secret with certificate content under given key
-                          mutually exclusive with CertFile
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       cipher_suites:
-                        description: |-
-                          CipherSuites defines list of supported cipher suites for TLS versions up to TLS 1.2
-                          https://golang.org/pkg/crypto/tls/#pkg-constants
                         items:
                           type: string
                         type: array
                       client_auth_type:
-                        description: |-
-                          Cert defines reference for secret with CA content under given key
-                          mutually exclusive with CertFile
-                          ClientAuthType defines server policy for client authentication
-                          If you want to enable client authentication (aka mTLS), you need to use RequireAndVerifyClientCert
-                          Note, mTLS is supported only at enterprise version of VictoriaMetrics components
                         enum:
                         - NoClientCert
                         - RequireAndVerifyClientCert
                         type: string
                       client_ca_file:
-                        description: |-
-                          ClientCAFile defines path to the pre-mounted file with CA
-                          mutually exclusive with ClientCASecretRef
                         type: string
                       client_ca_secret_ref:
-                        description: |-
-                          ClientCASecretRef defines reference for secret with CA content under given key
-                          mutually exclusive with ClientCAFile
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       curve_preferences:
-                        description: |-
-                          CurvePreferences defines elliptic curves that will be used in an ECDHE handshake, in preference order.
-                          https://golang.org/pkg/crypto/tls/#CurveID
                         items:
                           type: string
                         type: array
                       key_file:
-                        description: |-
-                          KeyFile defines path to the pre-mounted file with certificate key
-                          mutually exclusive with KeySecretRef
                         type: string
                       key_secret_ref:
-                        description: |-
-                          Key defines reference for secret with certificate key content under given key
-                          mutually exclusive with KeyFile
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       max_version:
-                        description: MaxVersion maximum TLS version that is acceptable.
                         enum:
                         - TLS10
                         - TLS11
@@ -12554,7 +10316,6 @@ spec:
                         - TLS13
                         type: string
                       min_version:
-                        description: MinVersion minimum TLS version that is acceptable.
                         enum:
                         - TLS10
                         - TLS11
@@ -12562,69 +10323,39 @@ spec:
                         - TLS13
                         type: string
                       prefer_server_cipher_suites:
-                        description: |-
-                          PreferServerCipherSuites controls whether the server selects the
-                          client's most preferred ciphersuite
                         type: boolean
                     type: object
                 type: object
             type: object
           status:
-            description: |-
-              Most recent observed status of the VMAlertmanager cluster.
-              Operator API itself. More info:
-              https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -12639,16 +10370,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         required:
@@ -12663,7 +10389,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmalerts.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -12679,7 +10405,7 @@ spec:
       jsonPath: .status.updateStatus
       name: Status
       type: string
-    - description: The desired replicas number of Alertmanagers
+    - description: The desired replicas number of VMAlerts
       jsonPath: .spec.replicaCount
       name: ReplicaCount
       type: integer
@@ -12689,80 +10415,51 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: VMAlert  executes a list of given alerting or recording rules
-          against configured address.
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMAlertSpec defines the desired state of VMAlert
             properties:
               affinity:
-                description: Affinity If specified, the pod's scheduling constraints.
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               configMaps:
-                description: |-
-                  ConfigMaps is a list of ConfigMaps in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/configs/CONFIGMAP_NAME folder
                 items:
                   type: string
                 type: array
+              configReloadAuthKeySecret:
+                properties:
+                  key:
+                    type: string
+                  name:
+                    default: ""
+                    type: string
+                  optional:
+                    type: boolean
+                required:
+                - key
+                type: object
+                x-kubernetes-map-type: atomic
               configReloaderExtraArgs:
                 additionalProperties:
                   type: string
-                description: |-
-                  ConfigReloaderExtraArgs that will be passed to  VMAuths config-reloader container
-                  for example resyncInterval: "30s"
                 type: object
+              configReloaderImage:
+                type: string
               configReloaderImageTag:
-                description: ConfigReloaderImageTag defines image:tag for config-reloader
-                  container
                 type: string
               configReloaderResources:
-                description: |-
-                  ConfigReloaderResources config-reloader container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
                 properties:
                   claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
                     items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
                       properties:
                         name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
                           type: string
                         request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
                           type: string
                       required:
                       - name
@@ -12778,9 +10475,6 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                   requests:
                     additionalProperties:
@@ -12789,85 +10483,42 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                 type: object
               containers:
-                description: |-
-                  Containers property allows to inject additions sidecars or to patch existing containers.
-                  It can be useful for proxies, backup, etc.
                 items:
-                  description: A single application container that you want to run
-                    within a pod.
                   required:
                   - name
                   type: object
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               datasource:
-                description: Datasource Victoria Metrics or VMSelect url. Required
-                  parameter. e.g. http://127.0.0.1:8428
                 properties:
                   basicAuth:
-                    description: BasicAuth allow an endpoint to authenticate over
-                      basic authentication
                     properties:
                       password:
-                        description: |-
-                          Password defines reference for secret with password value
-                          The secret needs to be in the same namespace as scrape object
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       password_file:
-                        description: |-
-                          PasswordFile defines path to password file at disk
-                          must be pre-mounted
                         type: string
                       username:
-                        description: |-
-                          Username defines reference for secret with username value
-                          The secret needs to be in the same namespace as scrape object
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
@@ -12875,169 +10526,88 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                   bearerTokenFile:
-                    description: Path to bearer token file
                     type: string
                   bearerTokenSecret:
-                    description: Optional bearer auth token to use for -remoteWrite.url
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   headers:
-                    description: |-
-                      Headers allow configuring custom http headers
-                      Must be in form of semicolon separated header with value
-                      e.g.
-                      headerName:headerValue
-                      vmalert supports it since 1.79.0 version
                     items:
                       type: string
                     type: array
                   oauth2:
-                    description: OAuth2 defines OAuth2 configuration
                     required:
                     - client_id
                     - token_url
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   tlsConfig:
-                    description: TLSConfig specifies TLSConfig configuration parameters.
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   url:
-                    description: Victoria Metrics or VMSelect url. Required parameter.
-                      E.g. http://127.0.0.1:8428
                     type: string
                 required:
                 - url
                 type: object
               disableAutomountServiceAccountToken:
-                description: |-
-                  DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
-                  Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
-                  For example, vmagent and vm-config-reloader requires k8s API access.
-                  Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
-                  And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
                 type: boolean
               disableSelfServiceScrape:
-                description: |-
-                  DisableSelfServiceScrape controls creation of VMServiceScrape by operator
-                  for the application.
-                  Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable
                 type: boolean
               dnsConfig:
-                description: |-
-                  Specifies the DNS parameters of a pod.
-                  Parameters specified here will be merged to the generated DNS
-                  configuration based on DNSPolicy.
                 items:
                   x-kubernetes-preserve-unknown-fields: true
                 properties:
                   nameservers:
-                    description: |-
-                      A list of DNS name server IP addresses.
-                      This will be appended to the base nameservers generated from DNSPolicy.
-                      Duplicated nameservers will be removed.
                     items:
                       type: string
                     type: array
                     x-kubernetes-list-type: atomic
                   options:
-                    description: |-
-                      A list of DNS resolver options.
-                      This will be merged with the base options generated from DNSPolicy.
-                      Duplicated entries will be removed. Resolution options given in Options
-                      will override those that appear in the base DNSPolicy.
                     items:
-                      description: PodDNSConfigOption defines DNS resolver options
-                        of a pod.
                       properties:
                         name:
-                          description: |-
-                            Name is this DNS resolver option's name.
-                            Required.
                           type: string
                         value:
-                          description: Value is this DNS resolver option's value.
                           type: string
                       type: object
                     type: array
                     x-kubernetes-list-type: atomic
                   searches:
-                    description: |-
-                      A list of DNS search domains for host-name lookup.
-                      This will be appended to the base search paths generated from DNSPolicy.
-                      Duplicated search paths will be removed.
                     items:
                       type: string
                     type: array
                     x-kubernetes-list-type: atomic
                 type: object
               dnsPolicy:
-                description: DNSPolicy sets DNS policy for the pod
                 type: string
               enforcedNamespaceLabel:
-                description: |-
-                  EnforcedNamespaceLabel enforces adding a namespace label of origin for each alert
-                  and metric that is user created. The label value will always be the namespace of the object that is
-                  being created.
                 type: string
               evaluationInterval:
-                description: EvaluationInterval defines how often to evaluate rules
-                  by default
                 pattern: '[0-9]+(ms|s|m|h)'
                 type: string
               externalLabels:
                 additionalProperties:
                   type: string
-                description: 'ExternalLabels in the form ''name: value'' to add to
-                  all generated recording rules and alerts.'
                 type: object
               extraArgs:
                 additionalProperties:
                   type: string
-                description: |-
-                  ExtraArgs that will be passed to the application container
-                  for example remoteWrite.tmpDataPath: /tmp
                 type: object
               extraEnvs:
-                description: ExtraEnvs that will be passed to the application container
                 items:
-                  description: EnvVar represents an environment variable present in
-                    a Container.
                   properties:
                     name:
-                      description: Name of the environment variable. Must be a C_IDENTIFIER.
                       type: string
                     value:
-                      description: |-
-                        Variable references $(VAR_NAME) are expanded
-                        using the previously defined environment variables in the container and
-                        any service environment variables. If a variable cannot be resolved,
-                        the reference in the input string will be unchanged. Double $$ are reduced
-                        to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                        "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                        Escaped references will never be expanded, regardless of whether the variable
-                        exists or not.
-                        Defaults to "".
                       type: string
                   required:
                   - name
@@ -13045,212 +10615,116 @@ spec:
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               extraEnvsFrom:
-                description: |-
-                  ExtraEnvsFrom defines source of env variables for the application container
-                  could either be secret or configmap
                 items:
-                  description: EnvFromSource represents the source of a set of ConfigMaps
                   properties:
                     configMapRef:
-                      description: The ConfigMap to select from
                       properties:
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the ConfigMap must be defined
                           type: boolean
                       type: object
                       x-kubernetes-map-type: atomic
                     prefix:
-                      description: An optional identifier to prepend to each key in
-                        the ConfigMap. Must be a C_IDENTIFIER.
                       type: string
                     secretRef:
-                      description: The Secret to select from
                       properties:
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the Secret must be defined
                           type: boolean
                       type: object
                       x-kubernetes-map-type: atomic
                   type: object
                 type: array
               host_aliases:
-                description: |-
-                  HostAliasesUnderScore provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
-                  Has Priority over hostAliases field
                 items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
                   properties:
                     hostnames:
-                      description: Hostnames for the above IP address.
                       items:
                         type: string
                       type: array
                       x-kubernetes-list-type: atomic
                     ip:
-                      description: IP address of the host file entry.
                       type: string
                   required:
                   - ip
                   type: object
                 type: array
               hostAliases:
-                description: |-
-                  HostAliases provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
                 items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
                   properties:
                     hostnames:
-                      description: Hostnames for the above IP address.
                       items:
                         type: string
                       type: array
                       x-kubernetes-list-type: atomic
                     ip:
-                      description: IP address of the host file entry.
                       type: string
                   required:
                   - ip
                   type: object
                 type: array
               hostNetwork:
-                description: HostNetwork controls whether the pod may use the node
-                  network namespace
                 type: boolean
               image:
-                description: |-
-                  Image - docker image settings
-                  if no specified operator uses default version from operator config
                 properties:
                   pullPolicy:
-                    description: PullPolicy describes how to pull docker image
                     type: string
                   repository:
-                    description: Repository contains name of docker image + it's repository
-                      if needed
                     type: string
                   tag:
-                    description: Tag contains desired docker image version
                     type: string
                 type: object
               imagePullSecrets:
-                description: |-
-                  ImagePullSecrets An optional list of references to secrets in the same namespace
-                  to use for pulling images from registries
-                  see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
                 items:
-                  description: |-
-                    LocalObjectReference contains enough information to let you locate the
-                    referenced object inside the same namespace.
                   properties:
                     name:
                       default: ""
-                      description: |-
-                        Name of the referent.
-                        This field is effectively required, but due to backwards compatibility is
-                        allowed to be empty. Instances of this type with an empty value here are
-                        almost certainly wrong.
-                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                       type: string
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
               initContainers:
-                description: |-
-                  InitContainers allows adding initContainers to the pod definition.
-                  Any errors during the execution of an initContainer will lead to a restart of the Pod.
-                  More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
                 items:
-                  description: A single application container that you want to run
-                    within a pod.
                   required:
                   - name
                   type: object
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               license:
-                description: |-
-                  License allows to configure license key to be used for enterprise features.
-                  Using license key is supported starting from VictoriaMetrics v1.94.0.
-                  See [here](https://docs.victoriametrics.com/enterprise)
                 properties:
                   forceOffline:
-                    description: Enforce offline verification of the license key.
                     type: boolean
                   key:
-                    description: |-
-                      Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise).
-                      To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial)
                     type: string
                   keyRef:
-                    description: KeyRef is reference to secret with license key for
-                      enterprise features.
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   reloadInterval:
-                    description: Interval to be used for checking for license key
-                      changes. Note that this is only applicable when using KeyRef.
                     type: string
                 type: object
               livenessProbe:
-                description: LivenessProbe that will be added CRD pod
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               logFormat:
-                description: |-
-                  LogFormat for VMAlert to be configured with.
-                  default or json
                 enum:
                 - default
                 - json
                 type: string
               logLevel:
-                description: LogLevel for VMAlert to be configured with.
                 enum:
                 - INFO
                 - WARN
@@ -13259,103 +10733,50 @@ spec:
                 - PANIC
                 type: string
               managedMetadata:
-                description: |-
-                  ManagedMetadata defines metadata that will be added to the all objects
-                  created by operator for the given CustomResource
                 properties:
                   annotations:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                     type: object
                   labels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                     type: object
                 type: object
               minReadySeconds:
-                description: |-
-                  MinReadySeconds defines a minimum number of seconds to wait before starting update next pod
-                  if previous in healthy state
-                  Has no effect for VLogs and VMSingle
                 format: int32
                 type: integer
               nodeSelector:
                 additionalProperties:
                   type: string
-                description: NodeSelector Define which Nodes the Pods are scheduled
-                  on.
                 type: object
               notifier:
-                description: |-
-                  Notifier prometheus alertmanager endpoint spec. Required at least one of notifier or notifiers when there are alerting rules. e.g. http://127.0.0.1:9093
-                  If specified both notifier and notifiers, notifier will be added as last element to notifiers.
-                  only one of notifier options could be chosen: notifierConfigRef or notifiers +  notifier
                 properties:
                   basicAuth:
-                    description: BasicAuth allow an endpoint to authenticate over
-                      basic authentication
                     properties:
                       password:
-                        description: |-
-                          Password defines reference for secret with password value
-                          The secret needs to be in the same namespace as scrape object
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       password_file:
-                        description: |-
-                          PasswordFile defines path to password file at disk
-                          must be pre-mounted
                         type: string
                       username:
-                        description: |-
-                          Username defines reference for secret with username value
-                          The secret needs to be in the same namespace as scrape object
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
@@ -13363,84 +10784,42 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                   bearerTokenFile:
-                    description: Path to bearer token file
                     type: string
                   bearerTokenSecret:
-                    description: Optional bearer auth token to use for -remoteWrite.url
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   headers:
-                    description: |-
-                      Headers allow configuring custom http headers
-                      Must be in form of semicolon separated header with value
-                      e.g.
-                      headerName:headerValue
-                      vmalert supports it since 1.79.0 version
                     items:
                       type: string
                     type: array
                   oauth2:
-                    description: OAuth2 defines OAuth2 configuration
                     required:
                     - client_id
                     - token_url
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   selector:
-                    description: |-
-                      Selector allows service discovery for alertmanager
-                      in this case all matched vmalertmanager replicas will be added into vmalert notifier.url
-                      as statefulset pod.fqdn
                     properties:
                       labelSelector:
-                        description: |-
-                          A label selector is a label query over a set of resources. The result of matchLabels and
-                          matchExpressions are ANDed. An empty label selector matches all objects. A null
-                          label selector matches no objects.
                         properties:
                           matchExpressions:
-                            description: matchExpressions is a list of label selector
-                              requirements. The requirements are ANDed.
                             items:
-                              description: |-
-                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                relates the key and values.
                               properties:
                                 key:
-                                  description: key is the label key that the selector
-                                    applies to.
                                   type: string
                                 operator:
-                                  description: |-
-                                    operator represents a key's relationship to a set of values.
-                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                   type: string
                                 values:
-                                  description: |-
-                                    values is an array of string values. If the operator is In or NotIn,
-                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                    the values array must be empty. This array is replaced during a strategic
-                                    merge patch.
                                   items:
                                     type: string
                                   type: array
@@ -13454,128 +10833,66 @@ spec:
                           matchLabels:
                             additionalProperties:
                               type: string
-                            description: |-
-                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                             type: object
                         type: object
                         x-kubernetes-map-type: atomic
                       namespaceSelector:
-                        description: |-
-                          NamespaceSelector is a selector for selecting either all namespaces or a
-                          list of namespaces.
                         properties:
                           any:
-                            description: |-
-                              Boolean describing whether all namespaces are selected in contrast to a
-                              list restricting them.
                             type: boolean
                           matchNames:
-                            description: List of namespace names.
                             items:
                               type: string
                             type: array
                         type: object
                     type: object
                   tlsConfig:
-                    description: TLSConfig specifies TLSConfig configuration parameters.
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   url:
-                    description: AlertManager url.  E.g. http://127.0.0.1:9093
                     type: string
                 type: object
               notifierConfigRef:
-                description: |-
-                  NotifierConfigRef reference for secret with notifier configuration for vmalert
-                  only one of notifier options could be chosen: notifierConfigRef or notifiers +  notifier
                 properties:
                   key:
-                    description: The key of the secret to select from.  Must be a
-                      valid secret key.
                     type: string
                   name:
                     default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                     type: string
                   optional:
-                    description: Specify whether the Secret or its key must be defined
                     type: boolean
                 required:
                 - key
                 type: object
                 x-kubernetes-map-type: atomic
               notifiers:
-                description: |-
-                  Notifiers prometheus alertmanager endpoints. Required at least one of notifier or notifiers when there are alerting rules. e.g. http://127.0.0.1:9093
-                  If specified both notifier and notifiers, notifier will be added as last element to notifiers.
-                  only one of notifier options could be chosen: notifierConfigRef or notifiers +  notifier
                 items:
-                  description: VMAlertNotifierSpec defines the notifier url for sending
-                    information about alerts
                   properties:
                     basicAuth:
-                      description: BasicAuth allow an endpoint to authenticate over
-                        basic authentication
                       properties:
                         password:
-                          description: |-
-                            Password defines reference for secret with password value
-                            The secret needs to be in the same namespace as scrape object
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         password_file:
-                          description: |-
-                            PasswordFile defines path to password file at disk
-                            must be pre-mounted
                           type: string
                         username:
-                          description: |-
-                            Username defines reference for secret with username value
-                            The secret needs to be in the same namespace as scrape object
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
@@ -13583,84 +10900,42 @@ spec:
                           x-kubernetes-map-type: atomic
                       type: object
                     bearerTokenFile:
-                      description: Path to bearer token file
                       type: string
                     bearerTokenSecret:
-                      description: Optional bearer auth token to use for -remoteWrite.url
                       properties:
                         key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
                           type: string
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
                           type: boolean
                       required:
                       - key
                       type: object
                       x-kubernetes-map-type: atomic
                     headers:
-                      description: |-
-                        Headers allow configuring custom http headers
-                        Must be in form of semicolon separated header with value
-                        e.g.
-                        headerName:headerValue
-                        vmalert supports it since 1.79.0 version
                       items:
                         type: string
                       type: array
                     oauth2:
-                      description: OAuth2 defines OAuth2 configuration
                       required:
                       - client_id
                       - token_url
                       type: object
                       x-kubernetes-preserve-unknown-fields: true
                     selector:
-                      description: |-
-                        Selector allows service discovery for alertmanager
-                        in this case all matched vmalertmanager replicas will be added into vmalert notifier.url
-                        as statefulset pod.fqdn
                       properties:
                         labelSelector:
-                          description: |-
-                            A label selector is a label query over a set of resources. The result of matchLabels and
-                            matchExpressions are ANDed. An empty label selector matches all objects. A null
-                            label selector matches no objects.
                           properties:
                             matchExpressions:
-                              description: matchExpressions is a list of label selector
-                                requirements. The requirements are ANDed.
                               items:
-                                description: |-
-                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                  relates the key and values.
                                 properties:
                                   key:
-                                    description: key is the label key that the selector
-                                      applies to.
                                     type: string
                                   operator:
-                                    description: |-
-                                      operator represents a key's relationship to a set of values.
-                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                     type: string
                                   values:
-                                    description: |-
-                                      values is an array of string values. If the operator is In or NotIn,
-                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                      the values array must be empty. This array is replaced during a strategic
-                                      merge patch.
                                     items:
                                       type: string
                                     type: array
@@ -13674,194 +10949,106 @@ spec:
                             matchLabels:
                               additionalProperties:
                                 type: string
-                              description: |-
-                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                               type: object
                           type: object
                           x-kubernetes-map-type: atomic
                         namespaceSelector:
-                          description: |-
-                            NamespaceSelector is a selector for selecting either all namespaces or a
-                            list of namespaces.
                           properties:
                             any:
-                              description: |-
-                                Boolean describing whether all namespaces are selected in contrast to a
-                                list restricting them.
                               type: boolean
                             matchNames:
-                              description: List of namespace names.
                               items:
                                 type: string
                               type: array
                           type: object
                       type: object
                     tlsConfig:
-                      description: TLSConfig specifies TLSConfig configuration parameters.
                       type: object
                       x-kubernetes-preserve-unknown-fields: true
                     url:
-                      description: AlertManager url.  E.g. http://127.0.0.1:9093
                       type: string
                   type: object
                 type: array
               paused:
-                description: |-
-                  Paused If set to true all actions on the underlying managed objects are not
-                  going to be performed, except for delete actions.
                 type: boolean
               podDisruptionBudget:
-                description: PodDisruptionBudget created by operator
                 properties:
                   maxUnavailable:
                     anyOf:
                     - type: integer
                     - type: string
-                    description: |-
-                      An eviction is allowed if at most "maxUnavailable" pods selected by
-                      "selector" are unavailable after the eviction, i.e. even in absence of
-                      the evicted pod. For example, one can prevent all voluntary evictions
-                      by specifying 0. This is a mutually exclusive setting with "minAvailable".
                     x-kubernetes-int-or-string: true
                   minAvailable:
                     anyOf:
                     - type: integer
                     - type: string
-                    description: |-
-                      An eviction is allowed if at least "minAvailable" pods selected by
-                      "selector" will still be available after the eviction, i.e. even in the
-                      absence of the evicted pod.  So for example you can prevent all voluntary
-                      evictions by specifying "100%".
                     x-kubernetes-int-or-string: true
                   selectorLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      replaces default labels selector generated by operator
-                      it's useful when you need to create custom budget
                     type: object
+                  unhealthyPodEvictionPolicy:
+                    enum:
+                    - IfHealthyBudget
+                    - AlwaysAllow
+                    type: string
                 type: object
               podMetadata:
-                description: PodMetadata configures Labels and Annotations which are
-                  propagated to the VMAlert pods.
                 properties:
                   annotations:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                     type: object
                   labels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects. May match selectors of replication controllers
-                      and services.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                     type: object
                   name:
-                    description: |-
-                      Name must be unique within a namespace. Is required when creating resources, although
-                      some resources may allow a client to request the generation of an appropriate name
-                      automatically. Name is primarily intended for creation idempotence and configuration
-                      definition.
-                      Cannot be updated.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                     type: string
                 type: object
               port:
-                description: Port listen address
                 type: string
               priorityClassName:
-                description: PriorityClassName class assigned to the Pods
                 type: string
               readinessGates:
-                description: ReadinessGates defines pod readiness gates
                 items:
-                  description: PodReadinessGate contains the reference to a pod condition
                   properties:
                     conditionType:
-                      description: ConditionType refers to a condition in the pod's
-                        condition list with matching type.
                       type: string
                   required:
                   - conditionType
                   type: object
                 type: array
               readinessProbe:
-                description: ReadinessProbe that will be added CRD pod
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               remoteRead:
-                description: |-
-                  RemoteRead Optional URL to read vmalert state (persisted via RemoteWrite)
-                  This configuration only makes sense if alerts state has been successfully
-                  persisted (via RemoteWrite) before.
-                  see -remoteRead.url docs in vmalerts for details.
-                  E.g. http://127.0.0.1:8428
                 properties:
                   basicAuth:
-                    description: BasicAuth allow an endpoint to authenticate over
-                      basic authentication
                     properties:
                       password:
-                        description: |-
-                          Password defines reference for secret with password value
-                          The secret needs to be in the same namespace as scrape object
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       password_file:
-                        description: |-
-                          PasswordFile defines path to password file at disk
-                          must be pre-mounted
                         type: string
                       username:
-                        description: |-
-                          Username defines reference for secret with username value
-                          The secret needs to be in the same namespace as scrape object
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
@@ -13869,129 +11056,67 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                   bearerTokenFile:
-                    description: Path to bearer token file
                     type: string
                   bearerTokenSecret:
-                    description: Optional bearer auth token to use for -remoteWrite.url
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   headers:
-                    description: |-
-                      Headers allow configuring custom http headers
-                      Must be in form of semicolon separated header with value
-                      e.g.
-                      headerName:headerValue
-                      vmalert supports it since 1.79.0 version
                     items:
                       type: string
                     type: array
                   lookback:
-                    description: |-
-                      Lookback defines how far to look into past for alerts timeseries. For example, if lookback=1h then range from now() to now()-1h will be scanned. (default 1h0m0s)
-                      Applied only to RemoteReadSpec
                     type: string
                   oauth2:
-                    description: OAuth2 defines OAuth2 configuration
                     required:
                     - client_id
                     - token_url
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   tlsConfig:
-                    description: TLSConfig specifies TLSConfig configuration parameters.
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   url:
-                    description: URL of the endpoint to send samples to.
                     type: string
                 required:
                 - url
                 type: object
               remoteWrite:
-                description: |-
-                  RemoteWrite Optional URL to remote-write compatible storage to persist
-                  vmalert state and rule results to.
-                  Rule results will be persisted according to each rule.
-                  Alerts state will be persisted in the form of time series named ALERTS and ALERTS_FOR_STATE
-                  see -remoteWrite.url docs in vmalerts for details.
-                  E.g. http://127.0.0.1:8428
                 properties:
                   basicAuth:
-                    description: BasicAuth allow an endpoint to authenticate over
-                      basic authentication
                     properties:
                       password:
-                        description: |-
-                          Password defines reference for secret with password value
-                          The secret needs to be in the same namespace as scrape object
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       password_file:
-                        description: |-
-                          PasswordFile defines path to password file at disk
-                          must be pre-mounted
                         type: string
                       username:
-                        description: |-
-                          Username defines reference for secret with username value
-                          The secret needs to be in the same namespace as scrape object
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
@@ -13999,111 +11124,61 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                   bearerTokenFile:
-                    description: Path to bearer token file
                     type: string
                   bearerTokenSecret:
-                    description: Optional bearer auth token to use for -remoteWrite.url
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   concurrency:
-                    description: Defines number of readers that concurrently write
-                      into remote storage (default 1)
                     format: int32
                     type: integer
                   flushInterval:
-                    description: Defines interval of flushes to remote write endpoint
-                      (default 5s)
                     pattern: '[0-9]+(ms|s|m|h)'
                     type: string
                   headers:
-                    description: |-
-                      Headers allow configuring custom http headers
-                      Must be in form of semicolon separated header with value
-                      e.g.
-                      headerName:headerValue
-                      vmalert supports it since 1.79.0 version
                     items:
                       type: string
                     type: array
                   maxBatchSize:
-                    description: Defines defines max number of timeseries to be flushed
-                      at once (default 1000)
                     format: int32
                     type: integer
                   maxQueueSize:
-                    description: Defines the max number of pending datapoints to remote
-                      write endpoint (default 100000)
                     format: int32
                     type: integer
                   oauth2:
-                    description: OAuth2 defines OAuth2 configuration
                     required:
                     - client_id
                     - token_url
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   tlsConfig:
-                    description: TLSConfig specifies TLSConfig configuration parameters.
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   url:
-                    description: URL of the endpoint to send samples to.
                     type: string
                 required:
                 - url
                 type: object
               replicaCount:
-                description: ReplicaCount is the expected size of the Application.
                 format: int32
                 type: integer
               resources:
-                description: |-
-                  Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
                 properties:
                   claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
                     items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
                       properties:
                         name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
                           type: string
                         request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
                           type: string
                       required:
                       - name
@@ -14119,9 +11194,6 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                   requests:
                     additionalProperties:
@@ -14130,88 +11202,34 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                 type: object
               revisionHistoryLimitCount:
-                description: |-
-                  The number of old ReplicaSets to retain to allow rollback in deployment or
-                  maximum number of revisions that will be maintained in the Deployment revision history.
-                  Has no effect at StatefulSets
-                  Defaults to 10.
                 format: int32
                 type: integer
               rollingUpdate:
-                description: RollingUpdate - overrides deployment update params.
                 properties:
                   maxSurge:
                     anyOf:
                     - type: integer
                     - type: string
-                    description: |-
-                      The maximum number of pods that can be scheduled above the desired number of
-                      pods.
-                      Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
-                      This can not be 0 if MaxUnavailable is 0.
-                      Absolute number is calculated from percentage by rounding up.
-                      Defaults to 25%.
-                      Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when
-                      the rolling update starts, such that the total number of old and new pods do not exceed
-                      130% of desired pods. Once old pods have been killed,
-                      new ReplicaSet can be scaled up further, ensuring that total number of pods running
-                      at any time during the update is at most 130% of desired pods.
                     x-kubernetes-int-or-string: true
                   maxUnavailable:
                     anyOf:
                     - type: integer
                     - type: string
-                    description: |-
-                      The maximum number of pods that can be unavailable during the update.
-                      Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
-                      Absolute number is calculated from percentage by rounding down.
-                      This can not be 0 if MaxSurge is 0.
-                      Defaults to 25%.
-                      Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods
-                      immediately when the rolling update starts. Once new pods are ready, old ReplicaSet
-                      can be scaled down further, followed by scaling up the new ReplicaSet, ensuring
-                      that the total number of pods available at all times during the update is at
-                      least 70% of desired pods.
                     x-kubernetes-int-or-string: true
                 type: object
               ruleNamespaceSelector:
-                description: |-
-                  RuleNamespaceSelector to be selected for VMRules discovery.
-                  Works in combination with Selector.
-                  If both nil - behaviour controlled by selectAllByDefault
-                  NamespaceSelector nil - only objects at VMAlert namespace.
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -14225,56 +11243,23 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               rulePath:
-                description: |-
-                  RulePath to the file with alert rules.
-                  Supports patterns. Flag can be specified multiple times.
-                  Examples:
-                  -rule /path/to/file. Path to a single file with alerting rules
-                  -rule dir/*.yaml -rule /*.yaml. Relative path to all .yaml files in folder,
-                  absolute path to all .yaml files in root.
-                  by default operator adds /etc/vmalert/configs/base/vmalert.yaml
                 items:
                   type: string
                 type: array
               ruleSelector:
-                description: |-
-                  RuleSelector selector to select which VMRules to mount for loading alerting
-                  rules from.
-                  Works in combination with NamespaceSelector.
-                  If both nil - behaviour controlled by selectAllByDefault
-                  NamespaceSelector nil - only objects at VMAlert namespace.
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -14288,159 +11273,76 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               runtimeClassName:
-                description: |-
-                  RuntimeClassName - defines runtime class for kubernetes pod.
-                  https://kubernetes.io/docs/concepts/containers/runtime-class/
                 type: string
               schedulerName:
-                description: SchedulerName - defines kubernetes scheduler name
                 type: string
               secrets:
-                description: |-
-                  Secrets is a list of Secrets in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/secrets/SECRET_NAME folder
                 items:
                   type: string
                 type: array
               securityContext:
-                description: |-
-                  SecurityContext holds pod-level security attributes and common container settings.
-                  This defaults to the default PodSecurityContext.
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               selectAllByDefault:
-                description: |-
-                  SelectAllByDefault changes default behavior for empty CRD selectors, such RuleSelector.
-                  with selectAllByDefault: true and empty serviceScrapeSelector and RuleNamespaceSelector
-                  Operator selects all exist serviceScrapes
-                  with selectAllByDefault: false - selects nothing
                 type: boolean
               serviceAccountName:
-                description: ServiceAccountName is the name of the ServiceAccount
-                  to use to run the pods
                 type: string
               serviceScrapeSpec:
-                description: ServiceScrapeSpec that will be added to vmalert VMServiceScrape
-                  spec
                 required:
                 - endpoints
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               serviceSpec:
-                description: ServiceSpec that will be added to vmalert service spec
                 properties:
                   metadata:
-                    description: EmbeddedObjectMetadata defines objectMeta for additional
-                      service.
                     properties:
                       annotations:
                         additionalProperties:
                           type: string
-                        description: |-
-                          Annotations is an unstructured key value map stored with a resource that may be
-                          set by external tools to store and retrieve arbitrary metadata. They are not
-                          queryable and should be preserved when modifying objects.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                         type: object
                       labels:
                         additionalProperties:
                           type: string
-                        description: |-
-                          Labels Map of string keys and values that can be used to organize and categorize
-                          (scope and select) objects. May match selectors of replication controllers
-                          and services.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                         type: object
                       name:
-                        description: |-
-                          Name must be unique within a namespace. Is required when creating resources, although
-                          some resources may allow a client to request the generation of an appropriate name
-                          automatically. Name is primarily intended for creation idempotence and configuration
-                          definition.
-                          Cannot be updated.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                         type: string
                     type: object
                   spec:
-                    description: |-
-                      ServiceSpec describes the attributes that a user creates on a service.
-                      More info: https://kubernetes.io/docs/concepts/services-networking/service/
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   useAsDefault:
-                    description: |-
-                      UseAsDefault applies changes from given service definition to the main object Service
-                      Changing from headless service to clusterIP or loadbalancer may break cross-component communication
                     type: boolean
                 required:
                 - spec
                 type: object
               startupProbe:
-                description: StartupProbe that will be added to CRD pod
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               terminationGracePeriodSeconds:
-                description: TerminationGracePeriodSeconds period for container graceful
-                  termination
                 format: int64
                 type: integer
               tolerations:
-                description: Tolerations If specified, the pod's tolerations.
                 items:
-                  description: |-
-                    The pod this Toleration is attached to tolerates any taint that matches
-                    the triple <key,value,effect> using the matching operator <operator>.
                   properties:
                     effect:
-                      description: |-
-                        Effect indicates the taint effect to match. Empty means match all taint effects.
-                        When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                       type: string
                     key:
-                      description: |-
-                        Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                        If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                       type: string
                     operator:
-                      description: |-
-                        Operator represents a key's relationship to the value.
-                        Valid operators are Exists and Equal. Defaults to Equal.
-                        Exists is equivalent to wildcard for value, so that a pod can
-                        tolerate all taints of a particular category.
                       type: string
                     tolerationSeconds:
-                      description: |-
-                        TolerationSeconds represents the period of time the toleration (which must be
-                        of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                        it is not set, which means tolerate the taint forever (do not evict). Zero and
-                        negative values will be treated as 0 (evict immediately) by the system.
                       format: int64
                       type: integer
                     value:
-                      description: |-
-                        Value is the taint value the toleration matches to.
-                        If the operator is Exists, the value should be empty, otherwise just a regular string.
                       type: string
                   type: object
                 type: array
               topologySpreadConstraints:
-                description: |-
-                  TopologySpreadConstraints embedded kubernetes pod configuration option,
-                  controls how pods are spread across your cluster among failure-domains
-                  such as regions, zones, nodes, and other user-defined topology domains
-                  https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
                 items:
-                  description: TopologySpreadConstraint specifies how to spread matching
-                    pods among the given topology.
                   required:
                   - maxSkew
                   - topologyKey
@@ -14449,89 +11351,32 @@ spec:
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               updateStrategy:
-                description: UpdateStrategy - overrides default update strategy.
                 enum:
                 - Recreate
                 - RollingUpdate
                 type: string
               useDefaultResources:
-                description: |-
-                  UseDefaultResources controls resource settings
-                  By default, operator sets built-in resource requirements
                 type: boolean
               useStrictSecurity:
-                description: |-
-                  UseStrictSecurity enables strict security mode for component
-                  it restricts disk writes access
-                  uses non-root user out of the box
-                  drops not needed security permissions
                 type: boolean
               useVMConfigReloader:
-                description: |-
-                  UseVMConfigReloader replaces prometheus-like config-reloader
-                  with vm one. It uses secrets watch instead of file watch
-                  which greatly increases speed of config updates
                 type: boolean
               volumeMounts:
-                description: |-
-                  VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
-                  VolumeMounts specified will be appended to other VolumeMounts in the Application container
                 items:
-                  description: VolumeMount describes a mounting of a Volume within
-                    a container.
                   properties:
                     mountPath:
-                      description: |-
-                        Path within the container at which the volume should be mounted.  Must
-                        not contain ':'.
                       type: string
                     mountPropagation:
-                      description: |-
-                        mountPropagation determines how mounts are propagated from the host
-                        to container and the other way around.
-                        When not set, MountPropagationNone is used.
-                        This field is beta in 1.10.
-                        When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                        (which defaults to None).
                       type: string
                     name:
-                      description: This must match the Name of a Volume.
                       type: string
                     readOnly:
-                      description: |-
-                        Mounted read-only if true, read-write otherwise (false or unspecified).
-                        Defaults to false.
                       type: boolean
                     recursiveReadOnly:
-                      description: |-
-                        RecursiveReadOnly specifies whether read-only mounts should be handled
-                        recursively.
-
-                        If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                        If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                        recursively read-only.  If this field is set to IfPossible, the mount is made
-                        recursively read-only, if it is supported by the container runtime.  If this
-                        field is set to Enabled, the mount is made recursively read-only if it is
-                        supported by the container runtime, otherwise the pod will not be started and
-                        an error will be generated to indicate the reason.
-
-                        If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                        None (or be unspecified, which defaults to None).
-
-                        If this field is not specified, it is treated as an equivalent of Disabled.
                       type: string
                     subPath:
-                      description: |-
-                        Path within the volume from which the container's volume should be mounted.
-                        Defaults to "" (volume's root).
                       type: string
                     subPathExpr:
-                      description: |-
-                        Expanded path within the volume from which the container's volume should be mounted.
-                        Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                        Defaults to "" (volume's root).
-                        SubPathExpr and SubPath are mutually exclusive.
                       type: string
                   required:
                   - mountPath
@@ -14539,13 +11384,7 @@ spec:
                   type: object
                 type: array
               volumes:
-                description: |-
-                  Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
-                  Volumes specified will be appended to other volumes that are generated.
-                  / +optional
                 items:
-                  description: Volume represents a named volume in a pod that may
-                    be accessed by any container in the pod.
                   required:
                   - name
                   type: object
@@ -14555,58 +11394,34 @@ spec:
             - datasource
             type: object
           status:
-            description: VMAlertStatus defines the observed state of VMAlert
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -14621,16 +11436,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -14643,7 +11453,1365 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: vmanomalies.operator.victoriametrics.com
+spec:
+  group: operator.victoriametrics.com
+  names:
+    kind: VMAnomaly
+    listKind: VMAnomalyList
+    plural: vmanomalies
+    singular: vmanomaly
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: current number of shards
+      jsonPath: .status.shards
+      name: Shards Count
+      type: integer
+    - description: Current status of update rollout
+      jsonPath: .status.updateStatus
+      name: Status
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            type: string
+          kind:
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              affinity:
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              claimTemplates:
+                items:
+                  properties:
+                    apiVersion:
+                      type: string
+                    kind:
+                      type: string
+                    metadata:
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    spec:
+                      properties:
+                        accessModes:
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        dataSource:
+                          properties:
+                            apiGroup:
+                              type: string
+                            kind:
+                              type: string
+                            name:
+                              type: string
+                          required:
+                          - kind
+                          - name
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        dataSourceRef:
+                          properties:
+                            apiGroup:
+                              type: string
+                            kind:
+                              type: string
+                            name:
+                              type: string
+                            namespace:
+                              type: string
+                          required:
+                          - kind
+                          - name
+                          type: object
+                        resources:
+                          properties:
+                            limits:
+                              additionalProperties:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                x-kubernetes-int-or-string: true
+                              type: object
+                            requests:
+                              additionalProperties:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                x-kubernetes-int-or-string: true
+                              type: object
+                          type: object
+                        selector:
+                          properties:
+                            matchExpressions:
+                              items:
+                                properties:
+                                  key:
+                                    type: string
+                                  operator:
+                                    type: string
+                                  values:
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                type: string
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        storageClassName:
+                          type: string
+                        volumeAttributesClassName:
+                          type: string
+                        volumeMode:
+                          type: string
+                        volumeName:
+                          type: string
+                      type: object
+                    status:
+                      properties:
+                        accessModes:
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        allocatedResourceStatuses:
+                          additionalProperties:
+                            type: string
+                          type: object
+                          x-kubernetes-map-type: granular
+                        allocatedResources:
+                          additionalProperties:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                            x-kubernetes-int-or-string: true
+                          type: object
+                        capacity:
+                          additionalProperties:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                            x-kubernetes-int-or-string: true
+                          type: object
+                        conditions:
+                          items:
+                            properties:
+                              lastProbeTime:
+                                format: date-time
+                                type: string
+                              lastTransitionTime:
+                                format: date-time
+                                type: string
+                              message:
+                                type: string
+                              reason:
+                                type: string
+                              status:
+                                type: string
+                              type:
+                                type: string
+                            required:
+                            - status
+                            - type
+                            type: object
+                          type: array
+                          x-kubernetes-list-map-keys:
+                          - type
+                          x-kubernetes-list-type: map
+                        currentVolumeAttributesClassName:
+                          type: string
+                        modifyVolumeStatus:
+                          properties:
+                            status:
+                              type: string
+                            targetVolumeAttributesClassName:
+                              type: string
+                          required:
+                          - status
+                          type: object
+                        phase:
+                          type: string
+                      type: object
+                  type: object
+                type: array
+              configMaps:
+                items:
+                  type: string
+                type: array
+              configRawYaml:
+                type: string
+              configSecret:
+                properties:
+                  key:
+                    type: string
+                  name:
+                    default: ""
+                    type: string
+                  optional:
+                    type: boolean
+                required:
+                - key
+                type: object
+                x-kubernetes-map-type: atomic
+              containers:
+                items:
+                  required:
+                  - name
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                type: array
+              disableAutomountServiceAccountToken:
+                type: boolean
+              disableSelfServiceScrape:
+                type: boolean
+              dnsConfig:
+                items:
+                  x-kubernetes-preserve-unknown-fields: true
+                properties:
+                  nameservers:
+                    items:
+                      type: string
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  options:
+                    items:
+                      properties:
+                        name:
+                          type: string
+                        value:
+                          type: string
+                      type: object
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  searches:
+                    items:
+                      type: string
+                    type: array
+                    x-kubernetes-list-type: atomic
+                type: object
+              dnsPolicy:
+                type: string
+              extraArgs:
+                additionalProperties:
+                  type: string
+                type: object
+              extraEnvs:
+                items:
+                  properties:
+                    name:
+                      type: string
+                    value:
+                      type: string
+                  required:
+                  - name
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                type: array
+              extraEnvsFrom:
+                items:
+                  properties:
+                    configMapRef:
+                      properties:
+                        name:
+                          default: ""
+                          type: string
+                        optional:
+                          type: boolean
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    prefix:
+                      type: string
+                    secretRef:
+                      properties:
+                        name:
+                          default: ""
+                          type: string
+                        optional:
+                          type: boolean
+                      type: object
+                      x-kubernetes-map-type: atomic
+                  type: object
+                type: array
+              host_aliases:
+                items:
+                  properties:
+                    hostnames:
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    ip:
+                      type: string
+                  required:
+                  - ip
+                  type: object
+                type: array
+              hostAliases:
+                items:
+                  properties:
+                    hostnames:
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    ip:
+                      type: string
+                  required:
+                  - ip
+                  type: object
+                type: array
+              hostNetwork:
+                type: boolean
+              image:
+                properties:
+                  pullPolicy:
+                    type: string
+                  repository:
+                    type: string
+                  tag:
+                    type: string
+                type: object
+              imagePullSecrets:
+                items:
+                  properties:
+                    name:
+                      default: ""
+                      type: string
+                  type: object
+                  x-kubernetes-map-type: atomic
+                type: array
+              initContainers:
+                items:
+                  required:
+                  - name
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                type: array
+              license:
+                properties:
+                  forceOffline:
+                    type: boolean
+                  key:
+                    type: string
+                  keyRef:
+                    properties:
+                      key:
+                        type: string
+                      name:
+                        default: ""
+                        type: string
+                      optional:
+                        type: boolean
+                    required:
+                    - key
+                    type: object
+                    x-kubernetes-map-type: atomic
+                  reloadInterval:
+                    type: string
+                type: object
+              livenessProbe:
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              logLevel:
+                enum:
+                - INFO
+                - WARN
+                - ERROR
+                - FATAL
+                - PANIC
+                type: string
+              managedMetadata:
+                properties:
+                  annotations:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  labels:
+                    additionalProperties:
+                      type: string
+                    type: object
+                type: object
+              minReadySeconds:
+                format: int32
+                type: integer
+              monitoring:
+                properties:
+                  pull:
+                    properties:
+                      port:
+                        type: string
+                    required:
+                    - port
+                    type: object
+                  push:
+                    properties:
+                      basicAuth:
+                        properties:
+                          password:
+                            properties:
+                              key:
+                                type: string
+                              name:
+                                default: ""
+                                type: string
+                              optional:
+                                type: boolean
+                            required:
+                            - key
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          password_file:
+                            type: string
+                          username:
+                            properties:
+                              key:
+                                type: string
+                              name:
+                                default: ""
+                                type: string
+                              optional:
+                                type: boolean
+                            required:
+                            - key
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        type: object
+                      bearer:
+                        properties:
+                          bearerTokenFile:
+                            type: string
+                          bearerTokenSecret:
+                            properties:
+                              key:
+                                type: string
+                              name:
+                                default: ""
+                                type: string
+                              optional:
+                                type: boolean
+                            required:
+                            - key
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        type: object
+                      extraLabels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      healthPath:
+                        type: string
+                      pushFrequency:
+                        type: string
+                      tenantID:
+                        type: string
+                      timeout:
+                        type: string
+                      tlsConfig:
+                        properties:
+                          ca:
+                            properties:
+                              configMap:
+                                properties:
+                                  key:
+                                    type: string
+                                  name:
+                                    default: ""
+                                    type: string
+                                  optional:
+                                    type: boolean
+                                required:
+                                - key
+                                type: object
+                                x-kubernetes-map-type: atomic
+                              secret:
+                                properties:
+                                  key:
+                                    type: string
+                                  name:
+                                    default: ""
+                                    type: string
+                                  optional:
+                                    type: boolean
+                                required:
+                                - key
+                                type: object
+                                x-kubernetes-map-type: atomic
+                            type: object
+                          caFile:
+                            type: string
+                          cert:
+                            properties:
+                              configMap:
+                                properties:
+                                  key:
+                                    type: string
+                                  name:
+                                    default: ""
+                                    type: string
+                                  optional:
+                                    type: boolean
+                                required:
+                                - key
+                                type: object
+                                x-kubernetes-map-type: atomic
+                              secret:
+                                properties:
+                                  key:
+                                    type: string
+                                  name:
+                                    default: ""
+                                    type: string
+                                  optional:
+                                    type: boolean
+                                required:
+                                - key
+                                type: object
+                                x-kubernetes-map-type: atomic
+                            type: object
+                          certFile:
+                            type: string
+                          insecureSkipVerify:
+                            type: boolean
+                          keyFile:
+                            type: string
+                          keySecret:
+                            properties:
+                              key:
+                                type: string
+                              name:
+                                default: ""
+                                type: string
+                              optional:
+                                type: boolean
+                            required:
+                            - key
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          serverName:
+                            type: string
+                        type: object
+                      url:
+                        type: string
+                    required:
+                    - url
+                    type: object
+                type: object
+              nodeSelector:
+                additionalProperties:
+                  type: string
+                type: object
+              paused:
+                type: boolean
+              persistentVolumeClaimRetentionPolicy:
+                properties:
+                  whenDeleted:
+                    type: string
+                  whenScaled:
+                    type: string
+                type: object
+              podDisruptionBudget:
+                properties:
+                  maxUnavailable:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    x-kubernetes-int-or-string: true
+                  minAvailable:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    x-kubernetes-int-or-string: true
+                  selectorLabels:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  unhealthyPodEvictionPolicy:
+                    enum:
+                    - IfHealthyBudget
+                    - AlwaysAllow
+                    type: string
+                type: object
+              podMetadata:
+                properties:
+                  annotations:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  labels:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  name:
+                    type: string
+                type: object
+              port:
+                type: string
+              priorityClassName:
+                type: string
+              reader:
+                properties:
+                  basicAuth:
+                    properties:
+                      password:
+                        properties:
+                          key:
+                            type: string
+                          name:
+                            default: ""
+                            type: string
+                          optional:
+                            type: boolean
+                        required:
+                        - key
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      password_file:
+                        type: string
+                      username:
+                        properties:
+                          key:
+                            type: string
+                          name:
+                            default: ""
+                            type: string
+                          optional:
+                            type: boolean
+                        required:
+                        - key
+                        type: object
+                        x-kubernetes-map-type: atomic
+                    type: object
+                  bearer:
+                    properties:
+                      bearerTokenFile:
+                        type: string
+                      bearerTokenSecret:
+                        properties:
+                          key:
+                            type: string
+                          name:
+                            default: ""
+                            type: string
+                          optional:
+                            type: boolean
+                        required:
+                        - key
+                        type: object
+                        x-kubernetes-map-type: atomic
+                    type: object
+                  dataRange:
+                    items:
+                      type: string
+                    type: array
+                  datasourceURL:
+                    type: string
+                  extraFilters:
+                    items:
+                      type: string
+                    type: array
+                  healthPath:
+                    type: string
+                  latencyOffset:
+                    type: string
+                  maxPointsPerQuery:
+                    type: integer
+                  queryFromLastSeenTimestamp:
+                    type: boolean
+                  queryRangePath:
+                    type: string
+                  samplingPeriod:
+                    type: string
+                  tenantID:
+                    type: string
+                  timeout:
+                    type: string
+                  tlsConfig:
+                    properties:
+                      ca:
+                        properties:
+                          configMap:
+                            properties:
+                              key:
+                                type: string
+                              name:
+                                default: ""
+                                type: string
+                              optional:
+                                type: boolean
+                            required:
+                            - key
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          secret:
+                            properties:
+                              key:
+                                type: string
+                              name:
+                                default: ""
+                                type: string
+                              optional:
+                                type: boolean
+                            required:
+                            - key
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        type: object
+                      caFile:
+                        type: string
+                      cert:
+                        properties:
+                          configMap:
+                            properties:
+                              key:
+                                type: string
+                              name:
+                                default: ""
+                                type: string
+                              optional:
+                                type: boolean
+                            required:
+                            - key
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          secret:
+                            properties:
+                              key:
+                                type: string
+                              name:
+                                default: ""
+                                type: string
+                              optional:
+                                type: boolean
+                            required:
+                            - key
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        type: object
+                      certFile:
+                        type: string
+                      insecureSkipVerify:
+                        type: boolean
+                      keyFile:
+                        type: string
+                      keySecret:
+                        properties:
+                          key:
+                            type: string
+                          name:
+                            default: ""
+                            type: string
+                          optional:
+                            type: boolean
+                        required:
+                        - key
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      serverName:
+                        type: string
+                    type: object
+                  tz:
+                    type: string
+                required:
+                - datasourceURL
+                - samplingPeriod
+                type: object
+              readinessGates:
+                items:
+                  properties:
+                    conditionType:
+                      type: string
+                  required:
+                  - conditionType
+                  type: object
+                type: array
+              readinessProbe:
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              replicaCount:
+                format: int32
+                type: integer
+              resources:
+                properties:
+                  claims:
+                    items:
+                      properties:
+                        name:
+                          type: string
+                        request:
+                          type: string
+                      required:
+                      - name
+                      type: object
+                    type: array
+                    x-kubernetes-list-map-keys:
+                    - name
+                    x-kubernetes-list-type: map
+                  limits:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    type: object
+                  requests:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    type: object
+                type: object
+              revisionHistoryLimitCount:
+                format: int32
+                type: integer
+              rollingUpdateStrategy:
+                type: string
+              runtimeClassName:
+                type: string
+              schedulerName:
+                type: string
+              secrets:
+                items:
+                  type: string
+                type: array
+              securityContext:
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              server:
+                properties:
+                  addr:
+                    type: string
+                  maxConcurrentTasks:
+                    maximum: 20
+                    minimum: 1
+                    type: integer
+                  pathPrefix:
+                    type: string
+                  port:
+                    type: string
+                  uiDefaultState:
+                    type: string
+                type: object
+              serviceAccountName:
+                type: string
+              serviceScrapeSpec:
+                required:
+                - endpoints
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              shardCount:
+                type: integer
+              startupProbe:
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              storage:
+                properties:
+                  emptyDir:
+                    properties:
+                      medium:
+                        type: string
+                      sizeLimit:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                        x-kubernetes-int-or-string: true
+                    type: object
+                  volumeClaimTemplate:
+                    properties:
+                      apiVersion:
+                        type: string
+                      kind:
+                        type: string
+                      metadata:
+                        properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          name:
+                            type: string
+                        type: object
+                      spec:
+                        properties:
+                          accessModes:
+                            items:
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          dataSource:
+                            properties:
+                              apiGroup:
+                                type: string
+                              kind:
+                                type: string
+                              name:
+                                type: string
+                            required:
+                            - kind
+                            - name
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          dataSourceRef:
+                            properties:
+                              apiGroup:
+                                type: string
+                              kind:
+                                type: string
+                              name:
+                                type: string
+                              namespace:
+                                type: string
+                            required:
+                            - kind
+                            - name
+                            type: object
+                          resources:
+                            properties:
+                              limits:
+                                additionalProperties:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                type: object
+                              requests:
+                                additionalProperties:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                type: object
+                            type: object
+                          selector:
+                            properties:
+                              matchExpressions:
+                                items:
+                                  properties:
+                                    key:
+                                      type: string
+                                    operator:
+                                      type: string
+                                    values:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  required:
+                                  - key
+                                  - operator
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              matchLabels:
+                                additionalProperties:
+                                  type: string
+                                type: object
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          storageClassName:
+                            type: string
+                          volumeAttributesClassName:
+                            type: string
+                          volumeMode:
+                            type: string
+                          volumeName:
+                            type: string
+                        type: object
+                      status:
+                        properties:
+                          accessModes:
+                            items:
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          allocatedResourceStatuses:
+                            additionalProperties:
+                              type: string
+                            type: object
+                            x-kubernetes-map-type: granular
+                          allocatedResources:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            type: object
+                          capacity:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            type: object
+                          conditions:
+                            items:
+                              properties:
+                                lastProbeTime:
+                                  format: date-time
+                                  type: string
+                                lastTransitionTime:
+                                  format: date-time
+                                  type: string
+                                message:
+                                  type: string
+                                reason:
+                                  type: string
+                                status:
+                                  type: string
+                                type:
+                                  type: string
+                              required:
+                              - status
+                              - type
+                              type: object
+                            type: array
+                            x-kubernetes-list-map-keys:
+                            - type
+                            x-kubernetes-list-type: map
+                          currentVolumeAttributesClassName:
+                            type: string
+                          modifyVolumeStatus:
+                            properties:
+                              status:
+                                type: string
+                              targetVolumeAttributesClassName:
+                                type: string
+                            required:
+                            - status
+                            type: object
+                          phase:
+                            type: string
+                        type: object
+                    type: object
+                type: object
+              terminationGracePeriodSeconds:
+                format: int64
+                type: integer
+              tolerations:
+                items:
+                  properties:
+                    effect:
+                      type: string
+                    key:
+                      type: string
+                    operator:
+                      type: string
+                    tolerationSeconds:
+                      format: int64
+                      type: integer
+                    value:
+                      type: string
+                  type: object
+                type: array
+              topologySpreadConstraints:
+                items:
+                  required:
+                  - maxSkew
+                  - topologyKey
+                  - whenUnsatisfiable
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                type: array
+              useDefaultResources:
+                type: boolean
+              useStrictSecurity:
+                type: boolean
+              volumeMounts:
+                items:
+                  properties:
+                    mountPath:
+                      type: string
+                    mountPropagation:
+                      type: string
+                    name:
+                      type: string
+                    readOnly:
+                      type: boolean
+                    recursiveReadOnly:
+                      type: string
+                    subPath:
+                      type: string
+                    subPathExpr:
+                      type: string
+                  required:
+                  - mountPath
+                  - name
+                  type: object
+                type: array
+              volumes:
+                items:
+                  required:
+                  - name
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                type: array
+              writer:
+                properties:
+                  basicAuth:
+                    properties:
+                      password:
+                        properties:
+                          key:
+                            type: string
+                          name:
+                            default: ""
+                            type: string
+                          optional:
+                            type: boolean
+                        required:
+                        - key
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      password_file:
+                        type: string
+                      username:
+                        properties:
+                          key:
+                            type: string
+                          name:
+                            default: ""
+                            type: string
+                          optional:
+                            type: boolean
+                        required:
+                        - key
+                        type: object
+                        x-kubernetes-map-type: atomic
+                    type: object
+                  bearer:
+                    properties:
+                      bearerTokenFile:
+                        type: string
+                      bearerTokenSecret:
+                        properties:
+                          key:
+                            type: string
+                          name:
+                            default: ""
+                            type: string
+                          optional:
+                            type: boolean
+                        required:
+                        - key
+                        type: object
+                        x-kubernetes-map-type: atomic
+                    type: object
+                  datasourceURL:
+                    type: string
+                  healthPath:
+                    type: string
+                  metricFormat:
+                    properties:
+                      __name__:
+                        type: string
+                      extraLabels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      for:
+                        type: string
+                    required:
+                    - __name__
+                    - for
+                    type: object
+                  tenantID:
+                    type: string
+                  timeout:
+                    type: string
+                  tlsConfig:
+                    properties:
+                      ca:
+                        properties:
+                          configMap:
+                            properties:
+                              key:
+                                type: string
+                              name:
+                                default: ""
+                                type: string
+                              optional:
+                                type: boolean
+                            required:
+                            - key
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          secret:
+                            properties:
+                              key:
+                                type: string
+                              name:
+                                default: ""
+                                type: string
+                              optional:
+                                type: boolean
+                            required:
+                            - key
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        type: object
+                      caFile:
+                        type: string
+                      cert:
+                        properties:
+                          configMap:
+                            properties:
+                              key:
+                                type: string
+                              name:
+                                default: ""
+                                type: string
+                              optional:
+                                type: boolean
+                            required:
+                            - key
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          secret:
+                            properties:
+                              key:
+                                type: string
+                              name:
+                                default: ""
+                                type: string
+                              optional:
+                                type: boolean
+                            required:
+                            - key
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        type: object
+                      certFile:
+                        type: string
+                      insecureSkipVerify:
+                        type: boolean
+                      keyFile:
+                        type: string
+                      keySecret:
+                        properties:
+                          key:
+                            type: string
+                          name:
+                            default: ""
+                            type: string
+                          optional:
+                            type: boolean
+                        required:
+                        - key
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      serverName:
+                        type: string
+                    type: object
+                required:
+                - datasourceURL
+                type: object
+            required:
+            - reader
+            - writer
+            type: object
+          status:
+            properties:
+              conditions:
+                items:
+                  properties:
+                    lastTransitionTime:
+                      format: date-time
+                      type: string
+                    lastUpdateTime:
+                      format: date-time
+                      type: string
+                    message:
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      maxLength: 1024
+                      minLength: 1
+                      type: string
+                    status:
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      maxLength: 316
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - lastUpdateTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              observedGeneration:
+                format: int64
+                type: integer
+              reason:
+                type: string
+              shards:
+                format: int32
+                type: integer
+              updateStatus:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      scale:
+        labelSelectorPath: .status.selector
+        specReplicasPath: .spec.shardCount
+        statusReplicasPath: .status.shards
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmauths.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -14662,86 +12830,58 @@ spec:
     - jsonPath: .metadata.creationTimestamp
       name: Age
       type: date
-    - description: The desired replicas number of Alertmanagers
+    - description: The desired replicas number of VMAuth
       jsonPath: .spec.replicaCount
       name: ReplicaCount
       type: integer
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: VMAuth is the Schema for the vmauths API
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMAuthSpec defines the desired state of VMAuth
             properties:
               affinity:
-                description: Affinity If specified, the pod's scheduling constraints.
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               configMaps:
-                description: |-
-                  ConfigMaps is a list of ConfigMaps in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/configs/CONFIGMAP_NAME folder
                 items:
                   type: string
                 type: array
+              configReloadAuthKeySecret:
+                properties:
+                  key:
+                    type: string
+                  name:
+                    default: ""
+                    type: string
+                  optional:
+                    type: boolean
+                required:
+                - key
+                type: object
+                x-kubernetes-map-type: atomic
               configReloaderExtraArgs:
                 additionalProperties:
                   type: string
-                description: |-
-                  ConfigReloaderExtraArgs that will be passed to  VMAuths config-reloader container
-                  for example resyncInterval: "30s"
                 type: object
+              configReloaderImage:
+                type: string
               configReloaderImageTag:
-                description: ConfigReloaderImageTag defines image:tag for config-reloader
-                  container
                 type: string
               configReloaderResources:
-                description: |-
-                  ConfigReloaderResources config-reloader container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
                 properties:
                   claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
                     items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
                       properties:
                         name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
                           type: string
                         request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
                           type: string
                       required:
                       - name
@@ -14757,9 +12897,6 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                   requests:
                     additionalProperties:
@@ -14768,129 +12905,60 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                 type: object
               configSecret:
-                description: |-
-                  ConfigSecret is the name of a Kubernetes Secret in the same namespace as the
-                  VMAuth object, which contains auth configuration for vmauth,
-                  configuration must be inside secret key: config.yaml.
-                  It must be created and managed manually.
-                  If it's defined, configuration for vmauth becomes unmanaged and operator'll not create any related secrets/config-reloaders
-                  Deprecated, use externalConfig.secretRef instead
                 type: string
               containers:
-                description: |-
-                  Containers property allows to inject additions sidecars or to patch existing containers.
-                  It can be useful for proxies, backup, etc.
                 items:
-                  description: A single application container that you want to run
-                    within a pod.
                   required:
                   - name
                   type: object
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               disableAutomountServiceAccountToken:
-                description: |-
-                  DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
-                  Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
-                  For example, vmagent and vm-config-reloader requires k8s API access.
-                  Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
-                  And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
                 type: boolean
               disableSelfServiceScrape:
-                description: |-
-                  DisableSelfServiceScrape controls creation of VMServiceScrape by operator
-                  for the application.
-                  Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable
                 type: boolean
               dnsConfig:
-                description: |-
-                  Specifies the DNS parameters of a pod.
-                  Parameters specified here will be merged to the generated DNS
-                  configuration based on DNSPolicy.
                 items:
                   x-kubernetes-preserve-unknown-fields: true
                 properties:
                   nameservers:
-                    description: |-
-                      A list of DNS name server IP addresses.
-                      This will be appended to the base nameservers generated from DNSPolicy.
-                      Duplicated nameservers will be removed.
                     items:
                       type: string
                     type: array
                     x-kubernetes-list-type: atomic
                   options:
-                    description: |-
-                      A list of DNS resolver options.
-                      This will be merged with the base options generated from DNSPolicy.
-                      Duplicated entries will be removed. Resolution options given in Options
-                      will override those that appear in the base DNSPolicy.
                     items:
-                      description: PodDNSConfigOption defines DNS resolver options
-                        of a pod.
                       properties:
                         name:
-                          description: |-
-                            Name is this DNS resolver option's name.
-                            Required.
                           type: string
                         value:
-                          description: Value is this DNS resolver option's value.
                           type: string
                       type: object
                     type: array
                     x-kubernetes-list-type: atomic
                   searches:
-                    description: |-
-                      A list of DNS search domains for host-name lookup.
-                      This will be appended to the base search paths generated from DNSPolicy.
-                      Duplicated search paths will be removed.
                     items:
                       type: string
                     type: array
                     x-kubernetes-list-type: atomic
                 type: object
               dnsPolicy:
-                description: DNSPolicy sets DNS policy for the pod
                 type: string
               externalConfig:
-                description: |-
-                  ExternalConfig defines a source of external VMAuth configuration.
-                  If it's defined, configuration for vmauth becomes unmanaged and operator'll not create any related secrets/config-reloaders
                 properties:
                   localPath:
-                    description: |-
-                      LocalPath contains static path to a config, which is managed externally for cases
-                      when using secrets is not applicable, e.g.: Vault sidecar.
                     type: string
                   secretRef:
-                    description: SecretRef defines selector for externally managed
-                      secret which contains configuration
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
@@ -14900,30 +12968,13 @@ spec:
               extraArgs:
                 additionalProperties:
                   type: string
-                description: |-
-                  ExtraArgs that will be passed to the application container
-                  for example remoteWrite.tmpDataPath: /tmp
                 type: object
               extraEnvs:
-                description: ExtraEnvs that will be passed to the application container
                 items:
-                  description: EnvVar represents an environment variable present in
-                    a Container.
                   properties:
                     name:
-                      description: Name of the environment variable. Must be a C_IDENTIFIER.
                       type: string
                     value:
-                      description: |-
-                        Variable references $(VAR_NAME) are expanded
-                        using the previously defined environment variables in the container and
-                        any service environment variables. If a variable cannot be resolved,
-                        the reference in the input string will be unchanged. Double $$ are reduced
-                        to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                        "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                        Escaped references will never be expanded, regardless of whether the variable
-                        exists or not.
-                        Defaults to "".
                       type: string
                   required:
                   - name
@@ -14931,234 +12982,512 @@ spec:
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               extraEnvsFrom:
-                description: |-
-                  ExtraEnvsFrom defines source of env variables for the application container
-                  could either be secret or configmap
                 items:
-                  description: EnvFromSource represents the source of a set of ConfigMaps
                   properties:
                     configMapRef:
-                      description: The ConfigMap to select from
                       properties:
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the ConfigMap must be defined
                           type: boolean
                       type: object
                       x-kubernetes-map-type: atomic
                     prefix:
-                      description: An optional identifier to prepend to each key in
-                        the ConfigMap. Must be a C_IDENTIFIER.
                       type: string
                     secretRef:
-                      description: The Secret to select from
                       properties:
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the Secret must be defined
                           type: boolean
                       type: object
                       x-kubernetes-map-type: atomic
                   type: object
                 type: array
               host_aliases:
-                description: |-
-                  HostAliasesUnderScore provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
-                  Has Priority over hostAliases field
                 items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
                   properties:
                     hostnames:
-                      description: Hostnames for the above IP address.
                       items:
                         type: string
                       type: array
                       x-kubernetes-list-type: atomic
                     ip:
-                      description: IP address of the host file entry.
                       type: string
                   required:
                   - ip
                   type: object
                 type: array
               hostAliases:
-                description: |-
-                  HostAliases provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
                 items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
                   properties:
                     hostnames:
-                      description: Hostnames for the above IP address.
                       items:
                         type: string
                       type: array
                       x-kubernetes-list-type: atomic
                     ip:
-                      description: IP address of the host file entry.
                       type: string
                   required:
                   - ip
                   type: object
                 type: array
               hostNetwork:
-                description: HostNetwork controls whether the pod may use the node
-                  network namespace
                 type: boolean
+              hpa:
+                properties:
+                  behaviour:
+                    properties:
+                      scaleDown:
+                        properties:
+                          policies:
+                            items:
+                              properties:
+                                periodSeconds:
+                                  format: int32
+                                  type: integer
+                                type:
+                                  type: string
+                                value:
+                                  format: int32
+                                  type: integer
+                              required:
+                              - periodSeconds
+                              - type
+                              - value
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          selectPolicy:
+                            type: string
+                          stabilizationWindowSeconds:
+                            format: int32
+                            type: integer
+                          tolerance:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                            x-kubernetes-int-or-string: true
+                        type: object
+                      scaleUp:
+                        properties:
+                          policies:
+                            items:
+                              properties:
+                                periodSeconds:
+                                  format: int32
+                                  type: integer
+                                type:
+                                  type: string
+                                value:
+                                  format: int32
+                                  type: integer
+                              required:
+                              - periodSeconds
+                              - type
+                              - value
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          selectPolicy:
+                            type: string
+                          stabilizationWindowSeconds:
+                            format: int32
+                            type: integer
+                          tolerance:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                            x-kubernetes-int-or-string: true
+                        type: object
+                    type: object
+                  maxReplicas:
+                    format: int32
+                    type: integer
+                  metrics:
+                    items:
+                      properties:
+                        containerResource:
+                          properties:
+                            container:
+                              type: string
+                            name:
+                              type: string
+                            target:
+                              properties:
+                                averageUtilization:
+                                  format: int32
+                                  type: integer
+                                averageValue:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                type:
+                                  type: string
+                                value:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                              required:
+                              - type
+                              type: object
+                          required:
+                          - container
+                          - name
+                          - target
+                          type: object
+                        external:
+                          properties:
+                            metric:
+                              properties:
+                                name:
+                                  type: string
+                                selector:
+                                  properties:
+                                    matchExpressions:
+                                      items:
+                                        properties:
+                                          key:
+                                            type: string
+                                          operator:
+                                            type: string
+                                          values:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchLabels:
+                                      additionalProperties:
+                                        type: string
+                                      type: object
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                              required:
+                              - name
+                              type: object
+                            target:
+                              properties:
+                                averageUtilization:
+                                  format: int32
+                                  type: integer
+                                averageValue:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                type:
+                                  type: string
+                                value:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                              required:
+                              - type
+                              type: object
+                          required:
+                          - metric
+                          - target
+                          type: object
+                        object:
+                          properties:
+                            describedObject:
+                              properties:
+                                apiVersion:
+                                  type: string
+                                kind:
+                                  type: string
+                                name:
+                                  type: string
+                              required:
+                              - kind
+                              - name
+                              type: object
+                            metric:
+                              properties:
+                                name:
+                                  type: string
+                                selector:
+                                  properties:
+                                    matchExpressions:
+                                      items:
+                                        properties:
+                                          key:
+                                            type: string
+                                          operator:
+                                            type: string
+                                          values:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchLabels:
+                                      additionalProperties:
+                                        type: string
+                                      type: object
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                              required:
+                              - name
+                              type: object
+                            target:
+                              properties:
+                                averageUtilization:
+                                  format: int32
+                                  type: integer
+                                averageValue:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                type:
+                                  type: string
+                                value:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                              required:
+                              - type
+                              type: object
+                          required:
+                          - describedObject
+                          - metric
+                          - target
+                          type: object
+                        pods:
+                          properties:
+                            metric:
+                              properties:
+                                name:
+                                  type: string
+                                selector:
+                                  properties:
+                                    matchExpressions:
+                                      items:
+                                        properties:
+                                          key:
+                                            type: string
+                                          operator:
+                                            type: string
+                                          values:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchLabels:
+                                      additionalProperties:
+                                        type: string
+                                      type: object
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                              required:
+                              - name
+                              type: object
+                            target:
+                              properties:
+                                averageUtilization:
+                                  format: int32
+                                  type: integer
+                                averageValue:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                type:
+                                  type: string
+                                value:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                              required:
+                              - type
+                              type: object
+                          required:
+                          - metric
+                          - target
+                          type: object
+                        resource:
+                          properties:
+                            name:
+                              type: string
+                            target:
+                              properties:
+                                averageUtilization:
+                                  format: int32
+                                  type: integer
+                                averageValue:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                type:
+                                  type: string
+                                value:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                              required:
+                              - type
+                              type: object
+                          required:
+                          - name
+                          - target
+                          type: object
+                        type:
+                          type: string
+                      required:
+                      - type
+                      type: object
+                    type: array
+                  minReplicas:
+                    format: int32
+                    type: integer
+                type: object
+              httpRoute:
+                properties:
+                  annotations:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  extraRules:
+                    items:
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                    x-kubernetes-preserve-unknown-fields: true
+                  hostnames:
+                    items:
+                      maxLength: 253
+                      minLength: 1
+                      pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
+                    type: array
+                  labels:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  name:
+                    type: string
+                  parentRefs:
+                    items:
+                      properties:
+                        group:
+                          default: gateway.networking.k8s.io
+                          maxLength: 253
+                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                          type: string
+                        kind:
+                          default: Gateway
+                          maxLength: 63
+                          minLength: 1
+                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                          type: string
+                        name:
+                          maxLength: 253
+                          minLength: 1
+                          type: string
+                        namespace:
+                          maxLength: 63
+                          minLength: 1
+                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                          type: string
+                        port:
+                          format: int32
+                          maximum: 65535
+                          minimum: 1
+                          type: integer
+                        sectionName:
+                          maxLength: 253
+                          minLength: 1
+                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                          type: string
+                      required:
+                      - name
+                      type: object
+                    type: array
+                type: object
               image:
-                description: |-
-                  Image - docker image settings
-                  if no specified operator uses default version from operator config
                 properties:
                   pullPolicy:
-                    description: PullPolicy describes how to pull docker image
                     type: string
                   repository:
-                    description: Repository contains name of docker image + it's repository
-                      if needed
                     type: string
                   tag:
-                    description: Tag contains desired docker image version
                     type: string
                 type: object
               imagePullSecrets:
-                description: |-
-                  ImagePullSecrets An optional list of references to secrets in the same namespace
-                  to use for pulling images from registries
-                  see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
                 items:
-                  description: |-
-                    LocalObjectReference contains enough information to let you locate the
-                    referenced object inside the same namespace.
                   properties:
                     name:
                       default: ""
-                      description: |-
-                        Name of the referent.
-                        This field is effectively required, but due to backwards compatibility is
-                        allowed to be empty. Instances of this type with an empty value here are
-                        almost certainly wrong.
-                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                       type: string
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
               ingress:
-                description: Ingress enables ingress configuration for VMAuth.
                 properties:
                   annotations:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                     type: object
                   class_name:
-                    description: ClassName defines ingress class name for VMAuth
                     type: string
                   extraRules:
-                    description: |-
-                      ExtraRules - additional rules for ingress,
-                      must be checked for correctness by user.
                     items:
-                      description: |-
-                        IngressRule represents the rules mapping the paths under a specified host to
-                        the related backend services. Incoming requests are first evaluated for a host
-                        match, then routed to the backend associated with the matching IngressRuleValue.
                       properties:
                         host:
-                          description: "host is the fully qualified domain name of
-                            a network host, as defined by RFC 3986.\nNote the following
-                            deviations from the \"host\" part of the\nURI as defined
-                            in RFC 3986:\n1. IPs are not allowed. Currently an IngressRuleValue
-                            can only apply to\n   the IP in the Spec of the parent
-                            Ingress.\n2. The `:` delimiter is not respected because
-                            ports are not allowed.\n\t  Currently the port of an Ingress
-                            is implicitly :80 for http and\n\t  :443 for https.\nBoth
-                            these may change in the future.\nIncoming requests are
-                            matched against the host before the\nIngressRuleValue.
-                            If the host is unspecified, the Ingress routes all\ntraffic
-                            based on the specified IngressRuleValue.\n\nhost can be
-                            \"precise\" which is a domain name without the terminating
-                            dot of\na network host (e.g. \"foo.bar.com\") or \"wildcard\",
-                            which is a domain name\nprefixed with a single wildcard
-                            label (e.g. \"*.foo.com\").\nThe wildcard character '*'
-                            must appear by itself as the first DNS label and\nmatches
-                            only a single label. You cannot have a wildcard label
-                            by itself (e.g. Host == \"*\").\nRequests will be matched
-                            against the Host field in the following way:\n1. If host
-                            is precise, the request matches this rule if the http
-                            host header is equal to Host.\n2. If host is a wildcard,
-                            then the request matches this rule if the http host header\nis
-                            to equal to the suffix (removing the first label) of the
-                            wildcard rule."
                           type: string
                         http:
-                          description: |-
-                            HTTPIngressRuleValue is a list of http selectors pointing to backends.
-                            In the example: http://<host>/<path>?<searchpart> -> backend where
-                            where parts of the url correspond to RFC 3986, this resource will be used
-                            to match against everything after the last '/' and before the first '?'
-                            or '#'.
                           properties:
                             paths:
-                              description: paths is a collection of paths that map
-                                requests to backends.
                               items:
-                                description: |-
-                                  HTTPIngressPath associates a path with a backend. Incoming urls matching the
-                                  path are forwarded to the backend.
                                 properties:
                                   backend:
-                                    description: |-
-                                      backend defines the referenced service endpoint to which the traffic
-                                      will be forwarded to.
                                     properties:
                                       resource:
-                                        description: |-
-                                          resource is an ObjectRef to another Kubernetes resource in the namespace
-                                          of the Ingress object. If resource is specified, a service.Name and
-                                          service.Port must not be specified.
-                                          This is a mutually exclusive setting with "Service".
                                         properties:
                                           apiGroup:
-                                            description: |-
-                                              APIGroup is the group for the resource being referenced.
-                                              If APIGroup is not specified, the specified Kind must be in the core API group.
-                                              For any other third-party types, APIGroup is required.
                                             type: string
                                           kind:
-                                            description: Kind is the type of resource
-                                              being referenced
                                             type: string
                                           name:
-                                            description: Name is the name of resource
-                                              being referenced
                                             type: string
                                         required:
                                         - kind
@@ -15166,29 +13495,14 @@ spec:
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       service:
-                                        description: |-
-                                          service references a service as a backend.
-                                          This is a mutually exclusive setting with "Resource".
                                         properties:
                                           name:
-                                            description: |-
-                                              name is the referenced service. The service must exist in
-                                              the same namespace as the Ingress object.
                                             type: string
                                           port:
-                                            description: |-
-                                              port of the referenced service. A port name or port number
-                                              is required for a IngressServiceBackend.
                                             properties:
                                               name:
-                                                description: |-
-                                                  name is the name of the port on the Service.
-                                                  This is a mutually exclusive setting with "Number".
                                                 type: string
                                               number:
-                                                description: |-
-                                                  number is the numerical port number (e.g. 80) on the Service.
-                                                  This is a mutually exclusive setting with "Name".
                                                 format: int32
                                                 type: integer
                                             type: object
@@ -15198,28 +13512,8 @@ spec:
                                         type: object
                                     type: object
                                   path:
-                                    description: |-
-                                      path is matched against the path of an incoming request. Currently it can
-                                      contain characters disallowed from the conventional "path" part of a URL
-                                      as defined by RFC 3986. Paths must begin with a '/' and must be present
-                                      when using PathType with value "Exact" or "Prefix".
                                     type: string
                                   pathType:
-                                    description: |-
-                                      pathType determines the interpretation of the path matching. PathType can
-                                      be one of the following values:
-                                      * Exact: Matches the URL path exactly.
-                                      * Prefix: Matches based on a URL path prefix split by '/'. Matching is
-                                        done on a path element by element basis. A path element refers is the
-                                        list of labels in the path split by the '/' separator. A request is a
-                                        match for path p if every p is an element-wise prefix of p of the
-                                        request path. Note that if the last element of the path is a substring
-                                        of the last element in request path, it is not a match (e.g. /foo/bar
-                                        matches /foo/bar/baz, but does not match /foo/barbaz).
-                                      * ImplementationSpecific: Interpretation of the Path matching is up to
-                                        the IngressClass. Implementations can treat this as a separate PathType
-                                        or treat it identically to Prefix or Exact path types.
-                                      Implementations are required to support all path types.
                                     type: string
                                 required:
                                 - backend
@@ -15233,138 +13527,76 @@ spec:
                       type: object
                     type: array
                   extraTls:
-                    description: |-
-                      ExtraTLS - additional TLS configuration for ingress
-                      must be checked for correctness by user.
                     items:
-                      description: IngressTLS describes the transport layer security
-                        associated with an ingress.
                       properties:
                         hosts:
-                          description: |-
-                            hosts is a list of hosts included in the TLS certificate. The values in
-                            this list must match the name/s used in the tlsSecret. Defaults to the
-                            wildcard host setting for the loadbalancer controller fulfilling this
-                            Ingress, if left unspecified.
                           items:
                             type: string
                           type: array
                           x-kubernetes-list-type: atomic
                         secretName:
-                          description: |-
-                            secretName is the name of the secret used to terminate TLS traffic on
-                            port 443. Field is left optional to allow TLS routing based on SNI
-                            hostname alone. If the SNI host in a listener conflicts with the "Host"
-                            header field used by an IngressRule, the SNI host is used for termination
-                            and value of the "Host" header is used for routing.
                           type: string
                       type: object
                     type: array
                   host:
-                    description: |-
-                      Host defines ingress host parameter for default rule
-                      It will be used, only if TlsHosts is empty
                     type: string
                   labels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects. May match selectors of replication controllers
-                      and services.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                     type: object
                   name:
-                    description: |-
-                      Name must be unique within a namespace. Is required when creating resources, although
-                      some resources may allow a client to request the generation of an appropriate name
-                      automatically. Name is primarily intended for creation idempotence and configuration
-                      definition.
-                      Cannot be updated.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                     type: string
+                  paths:
+                    items:
+                      type: string
+                    type: array
                   tlsHosts:
-                    description: TlsHosts configures TLS access for ingress, tlsSecretName
-                      must be defined for it.
                     items:
                       type: string
                     type: array
                   tlsSecretName:
-                    description: |-
-                      TlsSecretName defines secretname at the VMAuth namespace with cert and key
-                      https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
                     type: string
                 type: object
               initContainers:
-                description: |-
-                  InitContainers allows adding initContainers to the pod definition.
-                  Any errors during the execution of an initContainer will lead to a restart of the Pod.
-                  More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
                 items:
-                  description: A single application container that you want to run
-                    within a pod.
                   required:
                   - name
                   type: object
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
+              internalListenPort:
+                type: string
               license:
-                description: |-
-                  License allows to configure license key to be used for enterprise features.
-                  Using license key is supported starting from VictoriaMetrics v1.94.0.
-                  See [here](https://docs.victoriametrics.com/enterprise)
                 properties:
                   forceOffline:
-                    description: Enforce offline verification of the license key.
                     type: boolean
                   key:
-                    description: |-
-                      Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise).
-                      To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial)
                     type: string
                   keyRef:
-                    description: KeyRef is reference to secret with license key for
-                      enterprise features.
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   reloadInterval:
-                    description: Interval to be used for checking for license key
-                      changes. Note that this is only applicable when using KeyRef.
                     type: string
                 type: object
               livenessProbe:
-                description: LivenessProbe that will be added CRD pod
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               logFormat:
-                description: LogFormat for VMAuth to be configured with.
                 enum:
                 - default
                 - json
                 type: string
               logLevel:
-                description: LogLevel for victoria metrics single to be configured
-                  with.
                 enum:
                 - INFO
                 - WARN
@@ -15373,164 +13605,87 @@ spec:
                 - PANIC
                 type: string
               managedMetadata:
-                description: |-
-                  ManagedMetadata defines metadata that will be added to the all objects
-                  created by operator for the given CustomResource
                 properties:
                   annotations:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                     type: object
                   labels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                     type: object
                 type: object
               minReadySeconds:
-                description: |-
-                  MinReadySeconds defines a minimum number of seconds to wait before starting update next pod
-                  if previous in healthy state
-                  Has no effect for VLogs and VMSingle
                 format: int32
                 type: integer
               nodeSelector:
                 additionalProperties:
                   type: string
-                description: NodeSelector Define which Nodes the Pods are scheduled
-                  on.
                 type: object
               paused:
-                description: |-
-                  Paused If set to true all actions on the underlying managed objects are not
-                  going to be performed, except for delete actions.
                 type: boolean
               podDisruptionBudget:
-                description: PodDisruptionBudget created by operator
                 properties:
                   maxUnavailable:
                     anyOf:
                     - type: integer
                     - type: string
-                    description: |-
-                      An eviction is allowed if at most "maxUnavailable" pods selected by
-                      "selector" are unavailable after the eviction, i.e. even in absence of
-                      the evicted pod. For example, one can prevent all voluntary evictions
-                      by specifying 0. This is a mutually exclusive setting with "minAvailable".
                     x-kubernetes-int-or-string: true
                   minAvailable:
                     anyOf:
                     - type: integer
                     - type: string
-                    description: |-
-                      An eviction is allowed if at least "minAvailable" pods selected by
-                      "selector" will still be available after the eviction, i.e. even in the
-                      absence of the evicted pod.  So for example you can prevent all voluntary
-                      evictions by specifying "100%".
                     x-kubernetes-int-or-string: true
                   selectorLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      replaces default labels selector generated by operator
-                      it's useful when you need to create custom budget
                     type: object
+                  unhealthyPodEvictionPolicy:
+                    enum:
+                    - IfHealthyBudget
+                    - AlwaysAllow
+                    type: string
                 type: object
               podMetadata:
-                description: PodMetadata configures Labels and Annotations which are
-                  propagated to the VMAuth pods.
                 properties:
                   annotations:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                     type: object
                   labels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects. May match selectors of replication controllers
-                      and services.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                     type: object
                   name:
-                    description: |-
-                      Name must be unique within a namespace. Is required when creating resources, although
-                      some resources may allow a client to request the generation of an appropriate name
-                      automatically. Name is primarily intended for creation idempotence and configuration
-                      definition.
-                      Cannot be updated.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                     type: string
                 type: object
               port:
-                description: Port listen address
                 type: string
               priorityClassName:
-                description: PriorityClassName class assigned to the Pods
                 type: string
               readinessGates:
-                description: ReadinessGates defines pod readiness gates
                 items:
-                  description: PodReadinessGate contains the reference to a pod condition
                   properties:
                     conditionType:
-                      description: ConditionType refers to a condition in the pod's
-                        condition list with matching type.
                       type: string
                   required:
                   - conditionType
                   type: object
                 type: array
               readinessProbe:
-                description: ReadinessProbe that will be added CRD pod
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               replicaCount:
-                description: ReplicaCount is the expected size of the Application.
                 format: int32
                 type: integer
               resources:
-                description: |-
-                  Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
                 properties:
                   claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
                     items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
                       properties:
                         name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
                           type: string
                         request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
                           type: string
                       required:
                       - name
@@ -15546,9 +13701,6 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                   requests:
                     additionalProperties:
@@ -15557,167 +13709,91 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                 type: object
               revisionHistoryLimitCount:
-                description: |-
-                  The number of old ReplicaSets to retain to allow rollback in deployment or
-                  maximum number of revisions that will be maintained in the Deployment revision history.
-                  Has no effect at StatefulSets
-                  Defaults to 10.
                 format: int32
                 type: integer
+              rollingUpdate:
+                properties:
+                  maxSurge:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    x-kubernetes-int-or-string: true
+                  maxUnavailable:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    x-kubernetes-int-or-string: true
+                type: object
               runtimeClassName:
-                description: |-
-                  RuntimeClassName - defines runtime class for kubernetes pod.
-                  https://kubernetes.io/docs/concepts/containers/runtime-class/
                 type: string
               schedulerName:
-                description: SchedulerName - defines kubernetes scheduler name
                 type: string
               secrets:
-                description: |-
-                  Secrets is a list of Secrets in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/secrets/SECRET_NAME folder
                 items:
                   type: string
                 type: array
               securityContext:
-                description: |-
-                  SecurityContext holds pod-level security attributes and common container settings.
-                  This defaults to the default PodSecurityContext.
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               selectAllByDefault:
-                description: |-
-                  SelectAllByDefault changes default behavior for empty CRD selectors, such userSelector.
-                  with selectAllByDefault: true and empty userSelector and userNamespaceSelector
-                  Operator selects all exist users
-                  with selectAllByDefault: false - selects nothing
                 type: boolean
               serviceAccountName:
-                description: ServiceAccountName is the name of the ServiceAccount
-                  to use to run the pods
                 type: string
               serviceScrapeSpec:
-                description: ServiceScrapeSpec that will be added to vmauth VMServiceScrape
-                  spec
                 required:
                 - endpoints
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               serviceSpec:
-                description: ServiceSpec that will be added to vmsingle service spec
                 properties:
                   metadata:
-                    description: EmbeddedObjectMetadata defines objectMeta for additional
-                      service.
                     properties:
                       annotations:
                         additionalProperties:
                           type: string
-                        description: |-
-                          Annotations is an unstructured key value map stored with a resource that may be
-                          set by external tools to store and retrieve arbitrary metadata. They are not
-                          queryable and should be preserved when modifying objects.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                         type: object
                       labels:
                         additionalProperties:
                           type: string
-                        description: |-
-                          Labels Map of string keys and values that can be used to organize and categorize
-                          (scope and select) objects. May match selectors of replication controllers
-                          and services.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                         type: object
                       name:
-                        description: |-
-                          Name must be unique within a namespace. Is required when creating resources, although
-                          some resources may allow a client to request the generation of an appropriate name
-                          automatically. Name is primarily intended for creation idempotence and configuration
-                          definition.
-                          Cannot be updated.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                         type: string
                     type: object
                   spec:
-                    description: |-
-                      ServiceSpec describes the attributes that a user creates on a service.
-                      More info: https://kubernetes.io/docs/concepts/services-networking/service/
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   useAsDefault:
-                    description: |-
-                      UseAsDefault applies changes from given service definition to the main object Service
-                      Changing from headless service to clusterIP or loadbalancer may break cross-component communication
                     type: boolean
                 required:
                 - spec
                 type: object
               startupProbe:
-                description: StartupProbe that will be added to CRD pod
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               terminationGracePeriodSeconds:
-                description: TerminationGracePeriodSeconds period for container graceful
-                  termination
                 format: int64
                 type: integer
               tolerations:
-                description: Tolerations If specified, the pod's tolerations.
                 items:
-                  description: |-
-                    The pod this Toleration is attached to tolerates any taint that matches
-                    the triple <key,value,effect> using the matching operator <operator>.
                   properties:
                     effect:
-                      description: |-
-                        Effect indicates the taint effect to match. Empty means match all taint effects.
-                        When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                       type: string
                     key:
-                      description: |-
-                        Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                        If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                       type: string
                     operator:
-                      description: |-
-                        Operator represents a key's relationship to the value.
-                        Valid operators are Exists and Equal. Defaults to Equal.
-                        Exists is equivalent to wildcard for value, so that a pod can
-                        tolerate all taints of a particular category.
                       type: string
                     tolerationSeconds:
-                      description: |-
-                        TolerationSeconds represents the period of time the toleration (which must be
-                        of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                        it is not set, which means tolerate the taint forever (do not evict). Zero and
-                        negative values will be treated as 0 (evict immediately) by the system.
                       format: int64
                       type: integer
                     value:
-                      description: |-
-                        Value is the taint value the toleration matches to.
-                        If the operator is Exists, the value should be empty, otherwise just a regular string.
                       type: string
                   type: object
                 type: array
               topologySpreadConstraints:
-                description: |-
-                  TopologySpreadConstraints embedded kubernetes pod configuration option,
-                  controls how pods are spread across your cluster among failure-domains
-                  such as regions, zones, nodes, and other user-defined topology domains
-                  https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
                 items:
-                  description: TopologySpreadConstraint specifies how to spread matching
-                    pods among the given topology.
                   required:
                   - maxSkew
                   - topologyKey
@@ -15726,54 +13802,24 @@ spec:
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               unauthorizedAccessConfig:
-                description: |-
-                  UnauthorizedAccessConfig configures access for un authorized users
-
-                  Deprecated, use unauthorizedUserAccessSpec instead
-                  will be removed at v1.0 release
                 x-kubernetes-preserve-unknown-fields: true
               unauthorizedUserAccessSpec:
-                description: UnauthorizedUserAccessSpec defines unauthorized_user
-                  config section of vmauth config
                 properties:
                   default_url:
-                    description: |-
-                      DefaultURLs backend url for non-matching paths filter
-                      usually used for default backend with error message
                     items:
                       type: string
                     type: array
                   discover_backend_ips:
-                    description: DiscoverBackendIPs instructs discovering URLPrefix
-                      backend IPs via DNS.
                     type: boolean
                   drop_src_path_prefix_parts:
-                    description: |-
-                      DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend.
-                      See [here](https://docs.victoriametrics.com/vmauth#dropping-request-path-prefix) for more details.
                     type: integer
                   dump_request_on_errors:
-                    description: |-
-                      DumpRequestOnErrors instructs vmauth to return detailed request params to the client
-                      if routing rules don't allow to forward request to the backends.
-                      Useful for debugging `src_hosts` and `src_headers` based routing rules
-
-                      available since v1.107.0 vmauth version
                     type: boolean
                   headers:
-                    description: |-
-                      Headers represent additional http headers, that vmauth uses
-                      in form of ["header_key: header_value"]
-                      multiple values for header key:
-                      ["header_key: value1,value2"]
-                      it's available since 1.68.0 version of vmauth
                     items:
                       type: string
                     type: array
                   ip_filters:
-                    description: |-
-                      IPFilters defines per target src ip filters
-                      supported only with enterprise version of [vmauth](https://docs.victoriametrics.com/vmauth/#ip-filters)
                     properties:
                       allow_list:
                         items:
@@ -15785,93 +13831,180 @@ spec:
                         type: array
                     type: object
                   load_balancing_policy:
-                    description: |-
-                      LoadBalancingPolicy defines load balancing policy to use for backend urls.
-                      Supported policies: least_loaded, first_available.
-                      See [here](https://docs.victoriametrics.com/vmauth#load-balancing) for more details (default "least_loaded")
                     enum:
                     - least_loaded
                     - first_available
                     type: string
                   max_concurrent_requests:
-                    description: |-
-                      MaxConcurrentRequests defines max concurrent requests per user
-                      300 is default value for vmauth
                     type: integer
                   metric_labels:
                     additionalProperties:
                       type: string
-                    description: MetricLabels - additional labels for metrics exported
-                      by vmauth for given user.
                     type: object
                   response_headers:
-                    description: |-
-                      ResponseHeaders represent additional http headers, that vmauth adds for request response
-                      in form of ["header_key: header_value"]
-                      multiple values for header key:
-                      ["header_key: value1,value2"]
-                      it's available since 1.93.0 version of vmauth
                     items:
                       type: string
                     type: array
                   retry_status_codes:
-                    description: |-
-                      RetryStatusCodes defines http status codes in numeric format for request retries
-                      e.g. [429,503]
                     items:
                       type: integer
                     type: array
+                  targetRefs:
+                    items:
+                      properties:
+                        crd:
+                          properties:
+                            kind:
+                              enum:
+                              - VMAgent
+                              - VMAlert
+                              - VMSingle
+                              - VLogs
+                              - VMAlertManager
+                              - VMAlertmanager
+                              - VMCluster/vmselect
+                              - VMCluster/vmstorage
+                              - VMCluster/vminsert
+                              - VLSingle
+                              - VLCluster/vlinsert
+                              - VLCluster/vlselect
+                              - VLCluster/vlstorage
+                              - VLAgent
+                              - VTCluster/vtinsert
+                              - VTCluster/vtselect
+                              - VTCluster/vtstorage
+                              - VTSingle
+                              type: string
+                            name:
+                              type: string
+                            namespace:
+                              type: string
+                          required:
+                          - kind
+                          - name
+                          - namespace
+                          type: object
+                        discover_backend_ips:
+                          type: boolean
+                        drop_src_path_prefix_parts:
+                          type: integer
+                        headers:
+                          items:
+                            type: string
+                          type: array
+                        hosts:
+                          items:
+                            type: string
+                          type: array
+                        load_balancing_policy:
+                          enum:
+                          - least_loaded
+                          - first_available
+                          type: string
+                        paths:
+                          items:
+                            type: string
+                          type: array
+                        query_args:
+                          items:
+                            properties:
+                              name:
+                                type: string
+                              values:
+                                items:
+                                  type: string
+                                type: array
+                            required:
+                            - name
+                            - values
+                            type: object
+                          type: array
+                        response_headers:
+                          items:
+                            type: string
+                          type: array
+                        retry_status_codes:
+                          items:
+                            type: integer
+                          type: array
+                        src_headers:
+                          items:
+                            type: string
+                          type: array
+                        src_query_args:
+                          items:
+                            type: string
+                          type: array
+                        static:
+                          properties:
+                            url:
+                              type: string
+                            urls:
+                              items:
+                                type: string
+                              type: array
+                          type: object
+                        target_path_suffix:
+                          type: string
+                        targetRefBasicAuth:
+                          properties:
+                            password:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            username:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                          required:
+                          - password
+                          - username
+                          type: object
+                      type: object
+                    type: array
                   tlsConfig:
-                    description: TLSConfig defines tls configuration for the backend
-                      connection
                     properties:
                       ca:
-                        description: Struct containing the CA cert to use for the
-                          targets.
                         properties:
                           configMap:
-                            description: ConfigMap containing data to use for the
-                              targets.
                             properties:
                               key:
-                                description: The key to select.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the ConfigMap or its
-                                  key must be defined
                                 type: boolean
                             required:
                             - key
                             type: object
                             x-kubernetes-map-type: atomic
                           secret:
-                            description: Secret containing data to use for the targets.
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
@@ -15879,56 +14012,30 @@ spec:
                             x-kubernetes-map-type: atomic
                         type: object
                       caFile:
-                        description: Path to the CA cert in the container to use for
-                          the targets.
                         type: string
                       cert:
-                        description: Struct containing the client cert file for the
-                          targets.
                         properties:
                           configMap:
-                            description: ConfigMap containing data to use for the
-                              targets.
                             properties:
                               key:
-                                description: The key to select.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the ConfigMap or its
-                                  key must be defined
                                 type: boolean
                             required:
                             - key
                             type: object
                             x-kubernetes-map-type: atomic
                           secret:
-                            description: Secret containing data to use for the targets.
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
@@ -15936,181 +14043,97 @@ spec:
                             x-kubernetes-map-type: atomic
                         type: object
                       certFile:
-                        description: Path to the client cert file in the container
-                          for the targets.
                         type: string
                       insecureSkipVerify:
-                        description: Disable target certificate validation.
                         type: boolean
                       keyFile:
-                        description: Path to the client key file in the container
-                          for the targets.
                         type: string
                       keySecret:
-                        description: Secret containing the client key file for the
-                          targets.
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       serverName:
-                        description: Used to verify the hostname for the targets.
                         type: string
                     type: object
                   url_map:
                     items:
-                      description: |-
-                        UnauthorizedAccessConfigURLMap defines element of url_map routing configuration
-                        For UnauthorizedAccessConfig and VMAuthUnauthorizedUserAccessSpec.URLMap
                       properties:
                         discover_backend_ips:
-                          description: DiscoverBackendIPs instructs discovering URLPrefix
-                            backend IPs via DNS.
                           type: boolean
                         drop_src_path_prefix_parts:
-                          description: |-
-                            DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend.
-                            See [here](https://docs.victoriametrics.com/vmauth#dropping-request-path-prefix) for more details.
                           type: integer
                         headers:
-                          description: |-
-                            RequestHeaders represent additional http headers, that vmauth uses
-                            in form of ["header_key: header_value"]
-                            multiple values for header key:
-                            ["header_key: value1,value2"]
-                            it's available since 1.68.0 version of vmauth
                           items:
                             type: string
                           type: array
                         load_balancing_policy:
-                          description: |-
-                            LoadBalancingPolicy defines load balancing policy to use for backend urls.
-                            Supported policies: least_loaded, first_available.
-                            See [here](https://docs.victoriametrics.com/vmauth#load-balancing) for more details (default "least_loaded")
                           enum:
                           - least_loaded
                           - first_available
                           type: string
                         response_headers:
-                          description: |-
-                            ResponseHeaders represent additional http headers, that vmauth adds for request response
-                            in form of ["header_key: header_value"]
-                            multiple values for header key:
-                            ["header_key: value1,value2"]
-                            it's available since 1.93.0 version of vmauth
                           items:
                             type: string
                           type: array
                         retry_status_codes:
-                          description: |-
-                            RetryStatusCodes defines http status codes in numeric format for request retries
-                            Can be defined per target or at VMUser.spec level
-                            e.g. [429,503]
                           items:
                             type: integer
                           type: array
                         src_headers:
-                          description: SrcHeaders is an optional list of headers,
-                            which must match request headers.
                           items:
                             type: string
                           type: array
                         src_hosts:
-                          description: SrcHosts is an optional list of regular expressions,
-                            which must match the request hostname.
                           items:
                             type: string
                           type: array
                         src_paths:
-                          description: SrcPaths is an optional list of regular expressions,
-                            which must match the request path.
                           items:
                             type: string
                           type: array
                         src_query_args:
-                          description: SrcQueryArgs is an optional list of query args,
-                            which must match request URL query args.
                           items:
                             type: string
                           type: array
                         url_prefix:
-                          description: |-
-                            UrlPrefix contains backend url prefixes for the proxied request url.
-                            URLPrefix defines prefix prefix for destination
                           x-kubernetes-preserve-unknown-fields: true
                       type: object
                     type: array
                   url_prefix:
-                    description: URLPrefix defines prefix prefix for destination
                     x-kubernetes-preserve-unknown-fields: true
                 type: object
+              updateStrategy:
+                enum:
+                - Recreate
+                - RollingUpdate
+                type: string
               useDefaultResources:
-                description: |-
-                  UseDefaultResources controls resource settings
-                  By default, operator sets built-in resource requirements
+                type: boolean
+              useProxyProtocol:
                 type: boolean
               useStrictSecurity:
-                description: |-
-                  UseStrictSecurity enables strict security mode for component
-                  it restricts disk writes access
-                  uses non-root user out of the box
-                  drops not needed security permissions
                 type: boolean
               useVMConfigReloader:
-                description: |-
-                  UseVMConfigReloader replaces prometheus-like config-reloader
-                  with vm one. It uses secrets watch instead of file watch
-                  which greatly increases speed of config updates
                 type: boolean
               userNamespaceSelector:
-                description: |-
-                  UserNamespaceSelector Namespaces to be selected for  VMAuth discovery.
-                  Works in combination with Selector.
-                  NamespaceSelector nil - only objects at VMAuth namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -16124,43 +14147,19 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               userSelector:
-                description: |-
-                  UserSelector defines VMUser to be selected for config file generation.
-                  Works in combination with NamespaceSelector.
-                  NamespaceSelector nil - only objects at VMAuth namespace.
-                  If both nil - behaviour controlled by selectAllByDefault
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -16174,73 +14173,25 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               volumeMounts:
-                description: |-
-                  VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
-                  VolumeMounts specified will be appended to other VolumeMounts in the Application container
                 items:
-                  description: VolumeMount describes a mounting of a Volume within
-                    a container.
                   properties:
                     mountPath:
-                      description: |-
-                        Path within the container at which the volume should be mounted.  Must
-                        not contain ':'.
                       type: string
                     mountPropagation:
-                      description: |-
-                        mountPropagation determines how mounts are propagated from the host
-                        to container and the other way around.
-                        When not set, MountPropagationNone is used.
-                        This field is beta in 1.10.
-                        When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                        (which defaults to None).
                       type: string
                     name:
-                      description: This must match the Name of a Volume.
                       type: string
                     readOnly:
-                      description: |-
-                        Mounted read-only if true, read-write otherwise (false or unspecified).
-                        Defaults to false.
                       type: boolean
                     recursiveReadOnly:
-                      description: |-
-                        RecursiveReadOnly specifies whether read-only mounts should be handled
-                        recursively.
-
-                        If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                        If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                        recursively read-only.  If this field is set to IfPossible, the mount is made
-                        recursively read-only, if it is supported by the container runtime.  If this
-                        field is set to Enabled, the mount is made recursively read-only if it is
-                        supported by the container runtime, otherwise the pod will not be started and
-                        an error will be generated to indicate the reason.
-
-                        If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                        None (or be unspecified, which defaults to None).
-
-                        If this field is not specified, it is treated as an equivalent of Disabled.
                       type: string
                     subPath:
-                      description: |-
-                        Path within the volume from which the container's volume should be mounted.
-                        Defaults to "" (volume's root).
                       type: string
                     subPathExpr:
-                      description: |-
-                        Expanded path within the volume from which the container's volume should be mounted.
-                        Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                        Defaults to "" (volume's root).
-                        SubPathExpr and SubPath are mutually exclusive.
                       type: string
                   required:
                   - mountPath
@@ -16248,73 +14199,126 @@ spec:
                   type: object
                 type: array
               volumes:
-                description: |-
-                  Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
-                  Volumes specified will be appended to other volumes that are generated.
-                  / +optional
                 items:
-                  description: Volume represents a named volume in a pod that may
-                    be accessed by any container in the pod.
                   required:
                   - name
                   type: object
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
+              vpa:
+                properties:
+                  recommenders:
+                    items:
+                      properties:
+                        name:
+                          type: string
+                      required:
+                      - name
+                      type: object
+                    type: array
+                  resourcePolicy:
+                    properties:
+                      containerPolicies:
+                        items:
+                          properties:
+                            containerName:
+                              type: string
+                            controlledResources:
+                              items:
+                                type: string
+                              type: array
+                            controlledValues:
+                              enum:
+                              - RequestsAndLimits
+                              - RequestsOnly
+                              type: string
+                            maxAllowed:
+                              additionalProperties:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                x-kubernetes-int-or-string: true
+                              type: object
+                            minAllowed:
+                              additionalProperties:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                x-kubernetes-int-or-string: true
+                              type: object
+                            mode:
+                              enum:
+                              - Auto
+                              - "Off"
+                              type: string
+                          type: object
+                        type: array
+                    type: object
+                  updatePolicy:
+                    properties:
+                      evictionRequirements:
+                        items:
+                          properties:
+                            changeRequirement:
+                              enum:
+                              - TargetHigherThanRequests
+                              - TargetLowerThanRequests
+                              type: string
+                            resources:
+                              items:
+                                type: string
+                              type: array
+                          required:
+                          - changeRequirement
+                          - resources
+                          type: object
+                        type: array
+                      minReplicas:
+                        format: int32
+                        type: integer
+                      updateMode:
+                        enum:
+                        - "Off"
+                        - Initial
+                        - Recreate
+                        - InPlaceOrRecreate
+                        - Auto
+                        type: string
+                    type: object
+                type: object
             type: object
             x-kubernetes-preserve-unknown-fields: true
           status:
-            description: VMAuthStatus defines the observed state of VMAuth
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -16329,16 +14333,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -16351,7 +14350,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmclusters.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -16385,146 +14384,67 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: |-
-          VMCluster is fast, cost-effective and scalable time-series database.
-          Cluster version with
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMClusterSpec defines the desired state of VMCluster
             properties:
               clusterDomainName:
-                description: |-
-                  ClusterDomainName defines domain name suffix for in-cluster dns addresses
-                  aka .cluster.local
-                  used by vminsert and vmselect to build vmstorage address
                 type: string
               clusterVersion:
-                description: |-
-                  ClusterVersion defines default images tag for all components.
-                  it can be overwritten with component specific image.tag value.
                 type: string
               imagePullSecrets:
-                description: |-
-                  ImagePullSecrets An optional list of references to secrets in the same namespace
-                  to use for pulling images from registries
-                  see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
                 items:
-                  description: |-
-                    LocalObjectReference contains enough information to let you locate the
-                    referenced object inside the same namespace.
                   properties:
                     name:
                       default: ""
-                      description: |-
-                        Name of the referent.
-                        This field is effectively required, but due to backwards compatibility is
-                        allowed to be empty. Instances of this type with an empty value here are
-                        almost certainly wrong.
-                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                       type: string
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
               license:
-                description: |-
-                  License allows to configure license key to be used for enterprise features.
-                  Using license key is supported starting from VictoriaMetrics v1.94.0.
-                  See [here](https://docs.victoriametrics.com/enterprise)
                 properties:
                   forceOffline:
-                    description: Enforce offline verification of the license key.
                     type: boolean
                   key:
-                    description: |-
-                      Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise).
-                      To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial)
                     type: string
                   keyRef:
-                    description: KeyRef is reference to secret with license key for
-                      enterprise features.
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   reloadInterval:
-                    description: Interval to be used for checking for license key
-                      changes. Note that this is only applicable when using KeyRef.
                     type: string
                 type: object
               managedMetadata:
-                description: |-
-                  ManagedMetadata defines metadata that will be added to the all objects
-                  created by operator for the given CustomResource
                 properties:
                   annotations:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                     type: object
                   labels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                     type: object
                 type: object
               paused:
-                description: |-
-                  Paused If set to true all actions on the underlying managed objects are not
-                  going to be performed, except for delete actions.
                 type: boolean
               replicationFactor:
-                description: |-
-                  ReplicationFactor defines how many copies of data make among
-                  distinct storage nodes
                 format: int32
                 type: integer
               requestsLoadBalancer:
-                description: |-
-                  RequestsLoadBalancer configures load-balancing for vminsert and vmselect requests
-                  it helps to evenly spread load across pods
-                  usually it's not possible with kubernetes TCP based service
                 properties:
                   disableInsertBalancing:
                     type: boolean
@@ -16533,157 +14453,75 @@ spec:
                   enabled:
                     type: boolean
                   spec:
-                    description: |-
-                      VMAuthLoadBalancerSpec defines configuration spec for VMAuth used as load-balancer
-                      for VMCluster component
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                 type: object
               retentionPeriod:
-                description: |-
-                  RetentionPeriod for the stored metrics
-                  Note VictoriaMetrics has data/ and indexdb/ folders
-                  metrics from data/ removed eventually as soon as partition leaves retention period
-                  reverse index data at indexdb rotates once at the half of configured
-                  [retention period](https://docs.victoriametrics.com/Single-server-VictoriaMetrics/#retention)
+                pattern: ^[0-9]+(h|d|w|y)?$
                 type: string
               serviceAccountName:
-                description: |-
-                  ServiceAccountName is the name of the ServiceAccount to use to run the
-                  VMSelect, VMStorage and VMInsert Pods.
                 type: string
               useStrictSecurity:
-                description: |-
-                  UseStrictSecurity enables strict security mode for component
-                  it restricts disk writes access
-                  uses non-root user out of the box
-                  drops not needed security permissions
                 type: boolean
               vminsert:
                 properties:
                   affinity:
-                    description: Affinity If specified, the pod's scheduling constraints.
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   clusterNativeListenPort:
-                    description: |-
-                      ClusterNativePort for multi-level cluster setup.
-                      More [details](https://docs.victoriametrics.com/Cluster-VictoriaMetrics#multi-level-cluster-setup)
                     type: string
                   configMaps:
-                    description: |-
-                      ConfigMaps is a list of ConfigMaps in the same namespace as the Application
-                      object, which shall be mounted into the Application container
-                      at /etc/vm/configs/CONFIGMAP_NAME folder
                     items:
                       type: string
                     type: array
                   containers:
-                    description: |-
-                      Containers property allows to inject additions sidecars or to patch existing containers.
-                      It can be useful for proxies, backup, etc.
                     items:
-                      description: A single application container that you want to
-                        run within a pod.
                       required:
                       - name
                       type: object
                       x-kubernetes-preserve-unknown-fields: true
                     type: array
                   disableAutomountServiceAccountToken:
-                    description: |-
-                      DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
-                      Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
-                      For example, vmagent and vm-config-reloader requires k8s API access.
-                      Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
-                      And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
                     type: boolean
                   disableSelfServiceScrape:
-                    description: |-
-                      DisableSelfServiceScrape controls creation of VMServiceScrape by operator
-                      for the application.
-                      Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable
                     type: boolean
                   dnsConfig:
-                    description: |-
-                      Specifies the DNS parameters of a pod.
-                      Parameters specified here will be merged to the generated DNS
-                      configuration based on DNSPolicy.
                     items:
                       x-kubernetes-preserve-unknown-fields: true
                     properties:
                       nameservers:
-                        description: |-
-                          A list of DNS name server IP addresses.
-                          This will be appended to the base nameservers generated from DNSPolicy.
-                          Duplicated nameservers will be removed.
                         items:
                           type: string
                         type: array
                         x-kubernetes-list-type: atomic
                       options:
-                        description: |-
-                          A list of DNS resolver options.
-                          This will be merged with the base options generated from DNSPolicy.
-                          Duplicated entries will be removed. Resolution options given in Options
-                          will override those that appear in the base DNSPolicy.
                         items:
-                          description: PodDNSConfigOption defines DNS resolver options
-                            of a pod.
                           properties:
                             name:
-                              description: |-
-                                Name is this DNS resolver option's name.
-                                Required.
                               type: string
                             value:
-                              description: Value is this DNS resolver option's value.
                               type: string
                           type: object
                         type: array
                         x-kubernetes-list-type: atomic
                       searches:
-                        description: |-
-                          A list of DNS search domains for host-name lookup.
-                          This will be appended to the base search paths generated from DNSPolicy.
-                          Duplicated search paths will be removed.
                         items:
                           type: string
                         type: array
                         x-kubernetes-list-type: atomic
                     type: object
                   dnsPolicy:
-                    description: DNSPolicy sets DNS policy for the pod
                     type: string
                   extraArgs:
                     additionalProperties:
                       type: string
-                    description: |-
-                      ExtraArgs that will be passed to the application container
-                      for example remoteWrite.tmpDataPath: /tmp
                     type: object
                   extraEnvs:
-                    description: ExtraEnvs that will be passed to the application
-                      container
                     items:
-                      description: EnvVar represents an environment variable present
-                        in a Container.
                       properties:
                         name:
-                          description: Name of the environment variable. Must be a
-                            C_IDENTIFIER.
                           type: string
                         value:
-                          description: |-
-                            Variable references $(VAR_NAME) are expanded
-                            using the previously defined environment variables in the container and
-                            any service environment variables. If a variable cannot be resolved,
-                            the reference in the input string will be unchanged. Double $$ are reduced
-                            to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                            "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                            Escaped references will never be expanded, regardless of whether the variable
-                            exists or not.
-                            Defaults to "".
                           type: string
                       required:
                       - name
@@ -16691,190 +14529,108 @@ spec:
                       x-kubernetes-preserve-unknown-fields: true
                     type: array
                   extraEnvsFrom:
-                    description: |-
-                      ExtraEnvsFrom defines source of env variables for the application container
-                      could either be secret or configmap
                     items:
-                      description: EnvFromSource represents the source of a set of
-                        ConfigMaps
                       properties:
                         configMapRef:
-                          description: The ConfigMap to select from
                           properties:
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the ConfigMap must be defined
                               type: boolean
                           type: object
                           x-kubernetes-map-type: atomic
                         prefix:
-                          description: An optional identifier to prepend to each key
-                            in the ConfigMap. Must be a C_IDENTIFIER.
                           type: string
                         secretRef:
-                          description: The Secret to select from
                           properties:
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret must be defined
                               type: boolean
                           type: object
                           x-kubernetes-map-type: atomic
                       type: object
                     type: array
                   host_aliases:
-                    description: |-
-                      HostAliasesUnderScore provides mapping for ip and hostname,
-                      that would be propagated to pod,
-                      cannot be used with HostNetwork.
-                      Has Priority over hostAliases field
                     items:
-                      description: |-
-                        HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                        pod's hosts file.
                       properties:
                         hostnames:
-                          description: Hostnames for the above IP address.
                           items:
                             type: string
                           type: array
                           x-kubernetes-list-type: atomic
                         ip:
-                          description: IP address of the host file entry.
                           type: string
                       required:
                       - ip
                       type: object
                     type: array
                   hostAliases:
-                    description: |-
-                      HostAliases provides mapping for ip and hostname,
-                      that would be propagated to pod,
-                      cannot be used with HostNetwork.
                     items:
-                      description: |-
-                        HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                        pod's hosts file.
                       properties:
                         hostnames:
-                          description: Hostnames for the above IP address.
                           items:
                             type: string
                           type: array
                           x-kubernetes-list-type: atomic
                         ip:
-                          description: IP address of the host file entry.
                           type: string
                       required:
                       - ip
                       type: object
                     type: array
                   hostNetwork:
-                    description: HostNetwork controls whether the pod may use the
-                      node network namespace
                     type: boolean
                   hpa:
-                    description: HPA defines kubernetes PodAutoScaling configuration
-                      version 2.
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   image:
-                    description: |-
-                      Image - docker image settings
-                      if no specified operator uses default version from operator config
                     properties:
                       pullPolicy:
-                        description: PullPolicy describes how to pull docker image
                         type: string
                       repository:
-                        description: Repository contains name of docker image + it's
-                          repository if needed
                         type: string
                       tag:
-                        description: Tag contains desired docker image version
                         type: string
                     type: object
                   imagePullSecrets:
-                    description: |-
-                      ImagePullSecrets An optional list of references to secrets in the same namespace
-                      to use for pulling images from registries
-                      see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
                     items:
-                      description: |-
-                        LocalObjectReference contains enough information to let you locate the
-                        referenced object inside the same namespace.
                       properties:
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                       type: object
                       x-kubernetes-map-type: atomic
                     type: array
                   initContainers:
-                    description: |-
-                      InitContainers allows adding initContainers to the pod definition.
-                      Any errors during the execution of an initContainer will lead to a restart of the Pod.
-                      More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
                     items:
-                      description: A single application container that you want to
-                        run within a pod.
                       required:
                       - name
                       type: object
                       x-kubernetes-preserve-unknown-fields: true
                     type: array
                   insertPorts:
-                    description: InsertPorts - additional listen ports for data ingestion.
                     properties:
                       graphitePort:
-                        description: GraphitePort listen port
                         type: string
                       influxPort:
-                        description: InfluxPort listen port
                         type: string
                       openTSDBHTTPPort:
-                        description: OpenTSDBHTTPPort for http connections.
                         type: string
                       openTSDBPort:
-                        description: OpenTSDBPort for tcp and udp listen
                         type: string
                     type: object
                   livenessProbe:
-                    description: LivenessProbe that will be added CRD pod
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   logFormat:
-                    description: |-
-                      LogFormat for VMInsert to be configured with.
-                      default or json
                     enum:
                     - default
                     - json
                     type: string
                   logLevel:
-                    description: LogLevel for VMInsert to be configured with.
                     enum:
                     - INFO
                     - WARN
@@ -16883,142 +14639,76 @@ spec:
                     - PANIC
                     type: string
                   minReadySeconds:
-                    description: |-
-                      MinReadySeconds defines a minimum number of seconds to wait before starting update next pod
-                      if previous in healthy state
-                      Has no effect for VLogs and VMSingle
                     format: int32
                     type: integer
                   nodeSelector:
                     additionalProperties:
                       type: string
-                    description: NodeSelector Define which Nodes the Pods are scheduled
-                      on.
                     type: object
                   paused:
-                    description: |-
-                      Paused If set to true all actions on the underlying managed objects are not
-                      going to be performed, except for delete actions.
                     type: boolean
                   podDisruptionBudget:
-                    description: PodDisruptionBudget created by operator
                     properties:
                       maxUnavailable:
                         anyOf:
                         - type: integer
                         - type: string
-                        description: |-
-                          An eviction is allowed if at most "maxUnavailable" pods selected by
-                          "selector" are unavailable after the eviction, i.e. even in absence of
-                          the evicted pod. For example, one can prevent all voluntary evictions
-                          by specifying 0. This is a mutually exclusive setting with "minAvailable".
                         x-kubernetes-int-or-string: true
                       minAvailable:
                         anyOf:
                         - type: integer
                         - type: string
-                        description: |-
-                          An eviction is allowed if at least "minAvailable" pods selected by
-                          "selector" will still be available after the eviction, i.e. even in the
-                          absence of the evicted pod.  So for example you can prevent all voluntary
-                          evictions by specifying "100%".
                         x-kubernetes-int-or-string: true
                       selectorLabels:
                         additionalProperties:
                           type: string
-                        description: |-
-                          replaces default labels selector generated by operator
-                          it's useful when you need to create custom budget
                         type: object
+                      unhealthyPodEvictionPolicy:
+                        enum:
+                        - IfHealthyBudget
+                        - AlwaysAllow
+                        type: string
                     type: object
                   podMetadata:
-                    description: PodMetadata configures Labels and Annotations which
-                      are propagated to the VMInsert pods.
                     properties:
                       annotations:
                         additionalProperties:
                           type: string
-                        description: |-
-                          Annotations is an unstructured key value map stored with a resource that may be
-                          set by external tools to store and retrieve arbitrary metadata. They are not
-                          queryable and should be preserved when modifying objects.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                         type: object
                       labels:
                         additionalProperties:
                           type: string
-                        description: |-
-                          Labels Map of string keys and values that can be used to organize and categorize
-                          (scope and select) objects. May match selectors of replication controllers
-                          and services.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                         type: object
                       name:
-                        description: |-
-                          Name must be unique within a namespace. Is required when creating resources, although
-                          some resources may allow a client to request the generation of an appropriate name
-                          automatically. Name is primarily intended for creation idempotence and configuration
-                          definition.
-                          Cannot be updated.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                         type: string
                     type: object
                   port:
-                    description: Port listen address
                     type: string
                   priorityClassName:
-                    description: PriorityClassName class assigned to the Pods
                     type: string
                   readinessGates:
-                    description: ReadinessGates defines pod readiness gates
                     items:
-                      description: PodReadinessGate contains the reference to a pod
-                        condition
                       properties:
                         conditionType:
-                          description: ConditionType refers to a condition in the
-                            pod's condition list with matching type.
                           type: string
                       required:
                       - conditionType
                       type: object
                     type: array
                   readinessProbe:
-                    description: ReadinessProbe that will be added CRD pod
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   replicaCount:
-                    description: ReplicaCount is the expected size of the Application.
                     format: int32
                     type: integer
                   resources:
-                    description: |-
-                      Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                      if not defined default resources from operator config will be used
                     properties:
                       claims:
-                        description: |-
-                          Claims lists the names of resources, defined in spec.resourceClaims,
-                          that are used by this container.
-
-                          This is an alpha field and requires enabling the
-                          DynamicResourceAllocation feature gate.
-
-                          This field is immutable. It can only be set for containers.
                         items:
-                          description: ResourceClaim references one entry in PodSpec.ResourceClaims.
                           properties:
                             name:
-                              description: |-
-                                Name must match the name of one entry in pod.spec.resourceClaims of
-                                the Pod where this field is used. It makes that resource available
-                                inside a container.
                               type: string
                             request:
-                              description: |-
-                                Request is the name chosen for a request in the referenced claim.
-                                If empty, everything from the claim is made available, otherwise
-                                only the result of this request.
                               type: string
                           required:
                           - name
@@ -17034,9 +14724,6 @@ spec:
                           - type: string
                           pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                           x-kubernetes-int-or-string: true
-                        description: |-
-                          Limits describes the maximum amount of compute resources allowed.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                         type: object
                       requests:
                         additionalProperties:
@@ -17045,194 +14732,87 @@ spec:
                           - type: string
                           pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                           x-kubernetes-int-or-string: true
-                        description: |-
-                          Requests describes the minimum amount of compute resources required.
-                          If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                          otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                         type: object
                     type: object
                   revisionHistoryLimitCount:
-                    description: |-
-                      The number of old ReplicaSets to retain to allow rollback in deployment or
-                      maximum number of revisions that will be maintained in the Deployment revision history.
-                      Has no effect at StatefulSets
-                      Defaults to 10.
                     format: int32
                     type: integer
                   rollingUpdate:
-                    description: RollingUpdate - overrides deployment update params.
                     properties:
                       maxSurge:
                         anyOf:
                         - type: integer
                         - type: string
-                        description: |-
-                          The maximum number of pods that can be scheduled above the desired number of
-                          pods.
-                          Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
-                          This can not be 0 if MaxUnavailable is 0.
-                          Absolute number is calculated from percentage by rounding up.
-                          Defaults to 25%.
-                          Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when
-                          the rolling update starts, such that the total number of old and new pods do not exceed
-                          130% of desired pods. Once old pods have been killed,
-                          new ReplicaSet can be scaled up further, ensuring that total number of pods running
-                          at any time during the update is at most 130% of desired pods.
                         x-kubernetes-int-or-string: true
                       maxUnavailable:
                         anyOf:
                         - type: integer
                         - type: string
-                        description: |-
-                          The maximum number of pods that can be unavailable during the update.
-                          Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
-                          Absolute number is calculated from percentage by rounding down.
-                          This can not be 0 if MaxSurge is 0.
-                          Defaults to 25%.
-                          Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods
-                          immediately when the rolling update starts. Once new pods are ready, old ReplicaSet
-                          can be scaled down further, followed by scaling up the new ReplicaSet, ensuring
-                          that the total number of pods available at all times during the update is at
-                          least 70% of desired pods.
                         x-kubernetes-int-or-string: true
                     type: object
                   runtimeClassName:
-                    description: |-
-                      RuntimeClassName - defines runtime class for kubernetes pod.
-                      https://kubernetes.io/docs/concepts/containers/runtime-class/
                     type: string
                   schedulerName:
-                    description: SchedulerName - defines kubernetes scheduler name
                     type: string
                   secrets:
-                    description: |-
-                      Secrets is a list of Secrets in the same namespace as the Application
-                      object, which shall be mounted into the Application container
-                      at /etc/vm/secrets/SECRET_NAME folder
                     items:
                       type: string
                     type: array
                   securityContext:
-                    description: |-
-                      SecurityContext holds pod-level security attributes and common container settings.
-                      This defaults to the default PodSecurityContext.
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   serviceScrapeSpec:
-                    description: ServiceScrapeSpec that will be added to vminsert
-                      VMServiceScrape spec
                     required:
                     - endpoints
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   serviceSpec:
-                    description: ServiceSpec that will be added to vminsert service
-                      spec
                     properties:
                       metadata:
-                        description: EmbeddedObjectMetadata defines objectMeta for
-                          additional service.
                         properties:
                           annotations:
                             additionalProperties:
                               type: string
-                            description: |-
-                              Annotations is an unstructured key value map stored with a resource that may be
-                              set by external tools to store and retrieve arbitrary metadata. They are not
-                              queryable and should be preserved when modifying objects.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                             type: object
                           labels:
                             additionalProperties:
                               type: string
-                            description: |-
-                              Labels Map of string keys and values that can be used to organize and categorize
-                              (scope and select) objects. May match selectors of replication controllers
-                              and services.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                             type: object
                           name:
-                            description: |-
-                              Name must be unique within a namespace. Is required when creating resources, although
-                              some resources may allow a client to request the generation of an appropriate name
-                              automatically. Name is primarily intended for creation idempotence and configuration
-                              definition.
-                              Cannot be updated.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                             type: string
                         type: object
                       spec:
-                        description: |-
-                          ServiceSpec describes the attributes that a user creates on a service.
-                          More info: https://kubernetes.io/docs/concepts/services-networking/service/
                         type: object
                         x-kubernetes-preserve-unknown-fields: true
                       useAsDefault:
-                        description: |-
-                          UseAsDefault applies changes from given service definition to the main object Service
-                          Changing from headless service to clusterIP or loadbalancer may break cross-component communication
                         type: boolean
                     required:
                     - spec
                     type: object
                   startupProbe:
-                    description: StartupProbe that will be added to CRD pod
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   terminationGracePeriodSeconds:
-                    description: TerminationGracePeriodSeconds period for container
-                      graceful termination
                     format: int64
                     type: integer
                   tolerations:
-                    description: Tolerations If specified, the pod's tolerations.
                     items:
-                      description: |-
-                        The pod this Toleration is attached to tolerates any taint that matches
-                        the triple <key,value,effect> using the matching operator <operator>.
                       properties:
                         effect:
-                          description: |-
-                            Effect indicates the taint effect to match. Empty means match all taint effects.
-                            When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                           type: string
                         key:
-                          description: |-
-                            Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                            If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                           type: string
                         operator:
-                          description: |-
-                            Operator represents a key's relationship to the value.
-                            Valid operators are Exists and Equal. Defaults to Equal.
-                            Exists is equivalent to wildcard for value, so that a pod can
-                            tolerate all taints of a particular category.
                           type: string
                         tolerationSeconds:
-                          description: |-
-                            TolerationSeconds represents the period of time the toleration (which must be
-                            of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                            it is not set, which means tolerate the taint forever (do not evict). Zero and
-                            negative values will be treated as 0 (evict immediately) by the system.
                           format: int64
                           type: integer
                         value:
-                          description: |-
-                            Value is the taint value the toleration matches to.
-                            If the operator is Exists, the value should be empty, otherwise just a regular string.
                           type: string
                       type: object
                     type: array
                   topologySpreadConstraints:
-                    description: |-
-                      TopologySpreadConstraints embedded kubernetes pod configuration option,
-                      controls how pods are spread across your cluster among failure-domains
-                      such as regions, zones, nodes, and other user-defined topology domains
-                      https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
                     items:
-                      description: TopologySpreadConstraint specifies how to spread
-                        matching pods among the given topology.
                       required:
                       - maxSkew
                       - topologyKey
@@ -17241,83 +14821,30 @@ spec:
                       x-kubernetes-preserve-unknown-fields: true
                     type: array
                   updateStrategy:
-                    description: UpdateStrategy - overrides default update strategy.
                     enum:
                     - Recreate
                     - RollingUpdate
                     type: string
                   useDefaultResources:
-                    description: |-
-                      UseDefaultResources controls resource settings
-                      By default, operator sets built-in resource requirements
                     type: boolean
                   useStrictSecurity:
-                    description: |-
-                      UseStrictSecurity enables strict security mode for component
-                      it restricts disk writes access
-                      uses non-root user out of the box
-                      drops not needed security permissions
                     type: boolean
                   volumeMounts:
-                    description: |-
-                      VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
-                      VolumeMounts specified will be appended to other VolumeMounts in the Application container
                     items:
-                      description: VolumeMount describes a mounting of a Volume within
-                        a container.
                       properties:
                         mountPath:
-                          description: |-
-                            Path within the container at which the volume should be mounted.  Must
-                            not contain ':'.
                           type: string
                         mountPropagation:
-                          description: |-
-                            mountPropagation determines how mounts are propagated from the host
-                            to container and the other way around.
-                            When not set, MountPropagationNone is used.
-                            This field is beta in 1.10.
-                            When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                            (which defaults to None).
                           type: string
                         name:
-                          description: This must match the Name of a Volume.
                           type: string
                         readOnly:
-                          description: |-
-                            Mounted read-only if true, read-write otherwise (false or unspecified).
-                            Defaults to false.
                           type: boolean
                         recursiveReadOnly:
-                          description: |-
-                            RecursiveReadOnly specifies whether read-only mounts should be handled
-                            recursively.
-
-                            If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                            If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                            recursively read-only.  If this field is set to IfPossible, the mount is made
-                            recursively read-only, if it is supported by the container runtime.  If this
-                            field is set to Enabled, the mount is made recursively read-only if it is
-                            supported by the container runtime, otherwise the pod will not be started and
-                            an error will be generated to indicate the reason.
-
-                            If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                            None (or be unspecified, which defaults to None).
-
-                            If this field is not specified, it is treated as an equivalent of Disabled.
                           type: string
                         subPath:
-                          description: |-
-                            Path within the volume from which the container's volume should be mounted.
-                            Defaults to "" (volume's root).
                           type: string
                         subPathExpr:
-                          description: |-
-                            Expanded path within the volume from which the container's volume should be mounted.
-                            Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                            Defaults to "" (volume's root).
-                            SubPathExpr and SubPath are mutually exclusive.
                           type: string
                       required:
                       - mountPath
@@ -17325,575 +14852,161 @@ spec:
                       type: object
                     type: array
                   volumes:
-                    description: |-
-                      Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
-                      Volumes specified will be appended to other volumes that are generated.
-                      / +optional
                     items:
-                      description: Volume represents a named volume in a pod that
-                        may be accessed by any container in the pod.
                       required:
                       - name
                       type: object
                       x-kubernetes-preserve-unknown-fields: true
                     type: array
+                  vpa:
+                    properties:
+                      recommenders:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                      resourcePolicy:
+                        properties:
+                          containerPolicies:
+                            items:
+                              properties:
+                                containerName:
+                                  type: string
+                                controlledResources:
+                                  items:
+                                    type: string
+                                  type: array
+                                controlledValues:
+                                  enum:
+                                  - RequestsAndLimits
+                                  - RequestsOnly
+                                  type: string
+                                maxAllowed:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                minAllowed:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                mode:
+                                  enum:
+                                  - Auto
+                                  - "Off"
+                                  type: string
+                              type: object
+                            type: array
+                        type: object
+                      updatePolicy:
+                        properties:
+                          evictionRequirements:
+                            items:
+                              properties:
+                                changeRequirement:
+                                  enum:
+                                  - TargetHigherThanRequests
+                                  - TargetLowerThanRequests
+                                  type: string
+                                resources:
+                                  items:
+                                    type: string
+                                  type: array
+                              required:
+                              - changeRequirement
+                              - resources
+                              type: object
+                            type: array
+                          minReplicas:
+                            format: int32
+                            type: integer
+                          updateMode:
+                            enum:
+                            - "Off"
+                            - Initial
+                            - Recreate
+                            - InPlaceOrRecreate
+                            - Auto
+                            type: string
+                        type: object
+                    type: object
                 type: object
               vmselect:
-                description: VMSelect defines configuration section for vmselect components
-                  of the victoria-metrics cluster
                 properties:
                   affinity:
-                    description: Affinity If specified, the pod's scheduling constraints.
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   cacheMountPath:
-                    description: |-
-                      CacheMountPath allows to add cache persistent for VMSelect,
-                      will use "/cache" as default if not specified.
                     type: string
                   claimTemplates:
-                    description: ClaimTemplates allows adding additional VolumeClaimTemplates
-                      for StatefulSet
                     items:
-                      description: PersistentVolumeClaim is a user's request for and
-                        claim to a persistent volume
-                      properties:
-                        apiVersion:
-                          description: |-
-                            APIVersion defines the versioned schema of this representation of an object.
-                            Servers should convert recognized schemas to the latest internal value, and
-                            may reject unrecognized values.
-                            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-                          type: string
-                        kind:
-                          description: |-
-                            Kind is a string value representing the REST resource this object represents.
-                            Servers may infer this from the endpoint the client submits requests to.
-                            Cannot be updated.
-                            In CamelCase.
-                            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-                          type: string
-                        metadata:
-                          description: |-
-                            Standard object's metadata.
-                            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-                          type: object
-                          x-kubernetes-preserve-unknown-fields: true
-                        spec:
-                          description: |-
-                            spec defines the desired characteristics of a volume requested by a pod author.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
-                          properties:
-                            accessModes:
-                              description: |-
-                                accessModes contains the desired access modes the volume should have.
-                                More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                              items:
-                                type: string
-                              type: array
-                              x-kubernetes-list-type: atomic
-                            dataSource:
-                              description: |-
-                                dataSource field can be used to specify either:
-                                * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
-                                * An existing PVC (PersistentVolumeClaim)
-                                If the provisioner or an external controller can support the specified data source,
-                                it will create a new volume based on the contents of the specified data source.
-                                When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-                                and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
-                                If the namespace is specified, then dataSourceRef will not be copied to dataSource.
-                              properties:
-                                apiGroup:
-                                  description: |-
-                                    APIGroup is the group for the resource being referenced.
-                                    If APIGroup is not specified, the specified Kind must be in the core API group.
-                                    For any other third-party types, APIGroup is required.
-                                  type: string
-                                kind:
-                                  description: Kind is the type of resource being
-                                    referenced
-                                  type: string
-                                name:
-                                  description: Name is the name of resource being
-                                    referenced
-                                  type: string
-                              required:
-                              - kind
-                              - name
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            dataSourceRef:
-                              description: |-
-                                dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
-                                volume is desired. This may be any object from a non-empty API group (non
-                                core object) or a PersistentVolumeClaim object.
-                                When this field is specified, volume binding will only succeed if the type of
-                                the specified object matches some installed volume populator or dynamic
-                                provisioner.
-                                This field will replace the functionality of the dataSource field and as such
-                                if both fields are non-empty, they must have the same value. For backwards
-                                compatibility, when namespace isn't specified in dataSourceRef,
-                                both fields (dataSource and dataSourceRef) will be set to the same
-                                value automatically if one of them is empty and the other is non-empty.
-                                When namespace is specified in dataSourceRef,
-                                dataSource isn't set to the same value and must be empty.
-                                There are three important differences between dataSource and dataSourceRef:
-                                * While dataSource only allows two specific types of objects, dataSourceRef
-                                  allows any non-core object, as well as PersistentVolumeClaim objects.
-                                * While dataSource ignores disallowed values (dropping them), dataSourceRef
-                                  preserves all values, and generates an error if a disallowed value is
-                                  specified.
-                                * While dataSource only allows local objects, dataSourceRef allows objects
-                                  in any namespaces.
-                                (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
-                                (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                              properties:
-                                apiGroup:
-                                  description: |-
-                                    APIGroup is the group for the resource being referenced.
-                                    If APIGroup is not specified, the specified Kind must be in the core API group.
-                                    For any other third-party types, APIGroup is required.
-                                  type: string
-                                kind:
-                                  description: Kind is the type of resource being
-                                    referenced
-                                  type: string
-                                name:
-                                  description: Name is the name of resource being
-                                    referenced
-                                  type: string
-                                namespace:
-                                  description: |-
-                                    Namespace is the namespace of resource being referenced
-                                    Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
-                                    (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                                  type: string
-                              required:
-                              - kind
-                              - name
-                              type: object
-                            resources:
-                              description: |-
-                                resources represents the minimum resources the volume should have.
-                                If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
-                                that are lower than previous value but must still be higher than capacity recorded in the
-                                status field of the claim.
-                                More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
-                              properties:
-                                limits:
-                                  additionalProperties:
-                                    anyOf:
-                                    - type: integer
-                                    - type: string
-                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                    x-kubernetes-int-or-string: true
-                                  description: |-
-                                    Limits describes the maximum amount of compute resources allowed.
-                                    More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                                  type: object
-                                requests:
-                                  additionalProperties:
-                                    anyOf:
-                                    - type: integer
-                                    - type: string
-                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                    x-kubernetes-int-or-string: true
-                                  description: |-
-                                    Requests describes the minimum amount of compute resources required.
-                                    If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                                    otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                                    More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                                  type: object
-                              type: object
-                            selector:
-                              description: selector is a label query over volumes
-                                to consider for binding.
-                              properties:
-                                matchExpressions:
-                                  description: matchExpressions is a list of label
-                                    selector requirements. The requirements are ANDed.
-                                  items:
-                                    description: |-
-                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                      relates the key and values.
-                                    properties:
-                                      key:
-                                        description: key is the label key that the
-                                          selector applies to.
-                                        type: string
-                                      operator:
-                                        description: |-
-                                          operator represents a key's relationship to a set of values.
-                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                        type: string
-                                      values:
-                                        description: |-
-                                          values is an array of string values. If the operator is In or NotIn,
-                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                          the values array must be empty. This array is replaced during a strategic
-                                          merge patch.
-                                        items:
-                                          type: string
-                                        type: array
-                                        x-kubernetes-list-type: atomic
-                                    required:
-                                    - key
-                                    - operator
-                                    type: object
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                matchLabels:
-                                  additionalProperties:
-                                    type: string
-                                  description: |-
-                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                  type: object
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            storageClassName:
-                              description: |-
-                                storageClassName is the name of the StorageClass required by the claim.
-                                More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
-                              type: string
-                            volumeAttributesClassName:
-                              description: |-
-                                volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
-                                If specified, the CSI driver will create or update the volume with the attributes defined
-                                in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                will be set by the persistentvolume controller if it exists.
-                                If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
-                                set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
-                                exists.
-                                More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
-                              type: string
-                            volumeMode:
-                              description: |-
-                                volumeMode defines what type of volume is required by the claim.
-                                Value of Filesystem is implied when not included in claim spec.
-                              type: string
-                            volumeName:
-                              description: volumeName is the binding reference to
-                                the PersistentVolume backing this claim.
-                              type: string
-                          type: object
-                        status:
-                          description: |-
-                            status represents the current information/status of a persistent volume claim.
-                            Read-only.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
-                          properties:
-                            accessModes:
-                              description: |-
-                                accessModes contains the actual access modes the volume backing the PVC has.
-                                More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                              items:
-                                type: string
-                              type: array
-                              x-kubernetes-list-type: atomic
-                            allocatedResourceStatuses:
-                              additionalProperties:
-                                description: |-
-                                  When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource
-                                  that it does not recognizes, then it should ignore that update and let other controllers
-                                  handle it.
-                                type: string
-                              description: "allocatedResourceStatuses stores status
-                                of resource being resized for the given PVC.\nKey
-                                names follow standard Kubernetes label syntax. Valid
-                                values are either:\n\t* Un-prefixed keys:\n\t\t- storage
-                                - the capacity of the volume.\n\t* Custom resources
-                                must use implementation-defined prefixed names such
-                                as \"example.com/my-custom-resource\"\nApart from
-                                above values - keys that are unprefixed or have kubernetes.io
-                                prefix are considered\nreserved and hence may not
-                                be used.\n\nClaimResourceStatus can be in any of following
-                                states:\n\t- ControllerResizeInProgress:\n\t\tState
-                                set when resize controller starts resizing the volume
-                                in control-plane.\n\t- ControllerResizeFailed:\n\t\tState
-                                set when resize has failed in resize controller with
-                                a terminal error.\n\t- NodeResizePending:\n\t\tState
-                                set when resize controller has finished resizing the
-                                volume but further resizing of\n\t\tvolume is needed
-                                on the node.\n\t- NodeResizeInProgress:\n\t\tState
-                                set when kubelet starts resizing the volume.\n\t-
-                                NodeResizeFailed:\n\t\tState set when resizing has
-                                failed in kubelet with a terminal error. Transient
-                                errors don't set\n\t\tNodeResizeFailed.\nFor example:
-                                if expanding a PVC for more capacity - this field
-                                can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage']
-                                = \"ControllerResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                = \"ControllerResizeFailed\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                = \"NodeResizePending\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                = \"NodeResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                = \"NodeResizeFailed\"\nWhen this field is not set,
-                                it means that no resize operation is in progress for
-                                the given PVC.\n\nA controller that receives PVC update
-                                with previously unknown resourceName or ClaimResourceStatus\nshould
-                                ignore the update for the purpose it was designed.
-                                For example - a controller that\nonly is responsible
-                                for resizing capacity of the volume, should ignore
-                                PVC updates that change other valid\nresources associated
-                                with PVC.\n\nThis is an alpha field and requires enabling
-                                RecoverVolumeExpansionFailure feature."
-                              type: object
-                              x-kubernetes-map-type: granular
-                            allocatedResources:
-                              additionalProperties:
-                                anyOf:
-                                - type: integer
-                                - type: string
-                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                x-kubernetes-int-or-string: true
-                              description: "allocatedResources tracks the resources
-                                allocated to a PVC including its capacity.\nKey names
-                                follow standard Kubernetes label syntax. Valid values
-                                are either:\n\t* Un-prefixed keys:\n\t\t- storage
-                                - the capacity of the volume.\n\t* Custom resources
-                                must use implementation-defined prefixed names such
-                                as \"example.com/my-custom-resource\"\nApart from
-                                above values - keys that are unprefixed or have kubernetes.io
-                                prefix are considered\nreserved and hence may not
-                                be used.\n\nCapacity reported here may be larger than
-                                the actual capacity when a volume expansion operation\nis
-                                requested.\nFor storage quota, the larger value from
-                                allocatedResources and PVC.spec.resources is used.\nIf
-                                allocatedResources is not set, PVC.spec.resources
-                                alone is used for quota calculation.\nIf a volume
-                                expansion capacity request is lowered, allocatedResources
-                                is only\nlowered if there are no expansion operations
-                                in progress and if the actual volume capacity\nis
-                                equal or lower than the requested capacity.\n\nA controller
-                                that receives PVC update with previously unknown resourceName\nshould
-                                ignore the update for the purpose it was designed.
-                                For example - a controller that\nonly is responsible
-                                for resizing capacity of the volume, should ignore
-                                PVC updates that change other valid\nresources associated
-                                with PVC.\n\nThis is an alpha field and requires enabling
-                                RecoverVolumeExpansionFailure feature."
-                              type: object
-                            capacity:
-                              additionalProperties:
-                                anyOf:
-                                - type: integer
-                                - type: string
-                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                x-kubernetes-int-or-string: true
-                              description: capacity represents the actual resources
-                                of the underlying volume.
-                              type: object
-                            conditions:
-                              description: |-
-                                conditions is the current Condition of persistent volume claim. If underlying persistent volume is being
-                                resized then the Condition will be set to 'Resizing'.
-                              items:
-                                description: PersistentVolumeClaimCondition contains
-                                  details about state of pvc
-                                properties:
-                                  lastProbeTime:
-                                    description: lastProbeTime is the time we probed
-                                      the condition.
-                                    format: date-time
-                                    type: string
-                                  lastTransitionTime:
-                                    description: lastTransitionTime is the time the
-                                      condition transitioned from one status to another.
-                                    format: date-time
-                                    type: string
-                                  message:
-                                    description: message is the human-readable message
-                                      indicating details about last transition.
-                                    type: string
-                                  reason:
-                                    description: |-
-                                      reason is a unique, this should be a short, machine understandable string that gives the reason
-                                      for condition's last transition. If it reports "Resizing" that means the underlying
-                                      persistent volume is being resized.
-                                    type: string
-                                  status:
-                                    description: |-
-                                      Status is the status of the condition.
-                                      Can be True, False, Unknown.
-                                      More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required
-                                    type: string
-                                  type:
-                                    description: |-
-                                      Type is the type of the condition.
-                                      More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about
-                                    type: string
-                                required:
-                                - status
-                                - type
-                                type: object
-                              type: array
-                              x-kubernetes-list-map-keys:
-                              - type
-                              x-kubernetes-list-type: map
-                            currentVolumeAttributesClassName:
-                              description: |-
-                                currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
-                                When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                                This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
-                              type: string
-                            modifyVolumeStatus:
-                              description: |-
-                                ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
-                                When this is unset, there is no ModifyVolume operation being attempted.
-                                This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
-                              properties:
-                                status:
-                                  description: "status is the status of the ControllerModifyVolume
-                                    operation. It can be in any of following states:\n
-                                    - Pending\n   Pending indicates that the PersistentVolumeClaim
-                                    cannot be modified due to unmet requirements,
-                                    such as\n   the specified VolumeAttributesClass
-                                    not existing.\n - InProgress\n   InProgress indicates
-                                    that the volume is being modified.\n - Infeasible\n
-                                    \ Infeasible indicates that the request has been
-                                    rejected as invalid by the CSI driver. To\n\t
-                                    \ resolve the error, a valid VolumeAttributesClass
-                                    needs to be specified.\nNote: New statuses can
-                                    be added in the future. Consumers should check
-                                    for unknown statuses and fail appropriately."
-                                  type: string
-                                targetVolumeAttributesClassName:
-                                  description: targetVolumeAttributesClassName is
-                                    the name of the VolumeAttributesClass the PVC
-                                    currently being reconciled
-                                  type: string
-                              required:
-                              - status
-                              type: object
-                            phase:
-                              description: phase represents the current phase of PersistentVolumeClaim.
-                              type: string
-                          type: object
                       type: object
                     type: array
                   clusterNativeListenPort:
-                    description: |-
-                      ClusterNativePort for multi-level cluster setup.
-                      More [details](https://docs.victoriametrics.com/Cluster-VictoriaMetrics#multi-level-cluster-setup)
                     type: string
                   configMaps:
-                    description: |-
-                      ConfigMaps is a list of ConfigMaps in the same namespace as the Application
-                      object, which shall be mounted into the Application container
-                      at /etc/vm/configs/CONFIGMAP_NAME folder
                     items:
                       type: string
                     type: array
                   containers:
-                    description: |-
-                      Containers property allows to inject additions sidecars or to patch existing containers.
-                      It can be useful for proxies, backup, etc.
                     items:
-                      description: A single application container that you want to
-                        run within a pod.
                       required:
                       - name
                       type: object
                       x-kubernetes-preserve-unknown-fields: true
                     type: array
                   disableAutomountServiceAccountToken:
-                    description: |-
-                      DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
-                      Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
-                      For example, vmagent and vm-config-reloader requires k8s API access.
-                      Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
-                      And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
                     type: boolean
                   disableSelfServiceScrape:
-                    description: |-
-                      DisableSelfServiceScrape controls creation of VMServiceScrape by operator
-                      for the application.
-                      Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable
                     type: boolean
                   dnsConfig:
-                    description: |-
-                      Specifies the DNS parameters of a pod.
-                      Parameters specified here will be merged to the generated DNS
-                      configuration based on DNSPolicy.
                     items:
                       x-kubernetes-preserve-unknown-fields: true
                     properties:
                       nameservers:
-                        description: |-
-                          A list of DNS name server IP addresses.
-                          This will be appended to the base nameservers generated from DNSPolicy.
-                          Duplicated nameservers will be removed.
                         items:
                           type: string
                         type: array
                         x-kubernetes-list-type: atomic
                       options:
-                        description: |-
-                          A list of DNS resolver options.
-                          This will be merged with the base options generated from DNSPolicy.
-                          Duplicated entries will be removed. Resolution options given in Options
-                          will override those that appear in the base DNSPolicy.
                         items:
-                          description: PodDNSConfigOption defines DNS resolver options
-                            of a pod.
                           properties:
                             name:
-                              description: |-
-                                Name is this DNS resolver option's name.
-                                Required.
                               type: string
                             value:
-                              description: Value is this DNS resolver option's value.
                               type: string
                           type: object
                         type: array
                         x-kubernetes-list-type: atomic
                       searches:
-                        description: |-
-                          A list of DNS search domains for host-name lookup.
-                          This will be appended to the base search paths generated from DNSPolicy.
-                          Duplicated search paths will be removed.
                         items:
                           type: string
                         type: array
                         x-kubernetes-list-type: atomic
                     type: object
                   dnsPolicy:
-                    description: DNSPolicy sets DNS policy for the pod
                     type: string
                   extraArgs:
                     additionalProperties:
                       type: string
-                    description: |-
-                      ExtraArgs that will be passed to the application container
-                      for example remoteWrite.tmpDataPath: /tmp
                     type: object
                   extraEnvs:
-                    description: ExtraEnvs that will be passed to the application
-                      container
                     items:
-                      description: EnvVar represents an environment variable present
-                        in a Container.
                       properties:
                         name:
-                          description: Name of the environment variable. Must be a
-                            C_IDENTIFIER.
                           type: string
                         value:
-                          description: |-
-                            Variable references $(VAR_NAME) are expanded
-                            using the previously defined environment variables in the container and
-                            any service environment variables. If a variable cannot be resolved,
-                            the reference in the input string will be unchanged. Double $$ are reduced
-                            to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                            "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                            Escaped references will never be expanded, regardless of whether the variable
-                            exists or not.
-                            Defaults to "".
                           type: string
                       required:
                       - name
@@ -17901,175 +15014,97 @@ spec:
                       x-kubernetes-preserve-unknown-fields: true
                     type: array
                   extraEnvsFrom:
-                    description: |-
-                      ExtraEnvsFrom defines source of env variables for the application container
-                      could either be secret or configmap
                     items:
-                      description: EnvFromSource represents the source of a set of
-                        ConfigMaps
                       properties:
                         configMapRef:
-                          description: The ConfigMap to select from
                           properties:
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the ConfigMap must be defined
                               type: boolean
                           type: object
                           x-kubernetes-map-type: atomic
                         prefix:
-                          description: An optional identifier to prepend to each key
-                            in the ConfigMap. Must be a C_IDENTIFIER.
                           type: string
                         secretRef:
-                          description: The Secret to select from
                           properties:
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret must be defined
                               type: boolean
                           type: object
                           x-kubernetes-map-type: atomic
                       type: object
                     type: array
                   host_aliases:
-                    description: |-
-                      HostAliasesUnderScore provides mapping for ip and hostname,
-                      that would be propagated to pod,
-                      cannot be used with HostNetwork.
-                      Has Priority over hostAliases field
                     items:
-                      description: |-
-                        HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                        pod's hosts file.
                       properties:
                         hostnames:
-                          description: Hostnames for the above IP address.
                           items:
                             type: string
                           type: array
                           x-kubernetes-list-type: atomic
                         ip:
-                          description: IP address of the host file entry.
                           type: string
                       required:
                       - ip
                       type: object
                     type: array
                   hostAliases:
-                    description: |-
-                      HostAliases provides mapping for ip and hostname,
-                      that would be propagated to pod,
-                      cannot be used with HostNetwork.
                     items:
-                      description: |-
-                        HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                        pod's hosts file.
                       properties:
                         hostnames:
-                          description: Hostnames for the above IP address.
                           items:
                             type: string
                           type: array
                           x-kubernetes-list-type: atomic
                         ip:
-                          description: IP address of the host file entry.
                           type: string
                       required:
                       - ip
                       type: object
                     type: array
                   hostNetwork:
-                    description: HostNetwork controls whether the pod may use the
-                      node network namespace
                     type: boolean
                   hpa:
-                    description: |-
-                      Configures horizontal pod autoscaling.
-                      Note, enabling this option disables vmselect to vmselect communication. In most cases it's not an issue.
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   image:
-                    description: |-
-                      Image - docker image settings
-                      if no specified operator uses default version from operator config
                     properties:
                       pullPolicy:
-                        description: PullPolicy describes how to pull docker image
                         type: string
                       repository:
-                        description: Repository contains name of docker image + it's
-                          repository if needed
                         type: string
                       tag:
-                        description: Tag contains desired docker image version
                         type: string
                     type: object
                   imagePullSecrets:
-                    description: |-
-                      ImagePullSecrets An optional list of references to secrets in the same namespace
-                      to use for pulling images from registries
-                      see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
                     items:
-                      description: |-
-                        LocalObjectReference contains enough information to let you locate the
-                        referenced object inside the same namespace.
                       properties:
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                       type: object
                       x-kubernetes-map-type: atomic
                     type: array
                   initContainers:
-                    description: |-
-                      InitContainers allows adding initContainers to the pod definition.
-                      Any errors during the execution of an initContainer will lead to a restart of the Pod.
-                      More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
                     items:
-                      description: A single application container that you want to
-                        run within a pod.
                       required:
                       - name
                       type: object
                       x-kubernetes-preserve-unknown-fields: true
                     type: array
                   livenessProbe:
-                    description: LivenessProbe that will be added CRD pod
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   logFormat:
-                    description: |-
-                      LogFormat for VMSelect to be configured with.
-                      default or json
                     enum:
                     - default
                     - json
                     type: string
                   logLevel:
-                    description: LogLevel for VMSelect to be configured with.
                     enum:
                     - INFO
                     - WARN
@@ -18078,184 +15113,83 @@ spec:
                     - PANIC
                     type: string
                   minReadySeconds:
-                    description: |-
-                      MinReadySeconds defines a minimum number of seconds to wait before starting update next pod
-                      if previous in healthy state
-                      Has no effect for VLogs and VMSingle
                     format: int32
                     type: integer
                   nodeSelector:
                     additionalProperties:
                       type: string
-                    description: NodeSelector Define which Nodes the Pods are scheduled
-                      on.
                     type: object
                   paused:
-                    description: |-
-                      Paused If set to true all actions on the underlying managed objects are not
-                      going to be performed, except for delete actions.
                     type: boolean
-                  persistentVolume:
-                    description: |-
-                      Storage - add persistent volume for cacheMountPath
-                      its useful for persistent cache
-                      use storage instead of persistentVolume.
+                  persistentVolumeClaimRetentionPolicy:
                     properties:
-                      disableMountSubPath:
-                        description: |-
-                          Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary.
-                          DisableMountSubPath allows to remove any subPath usage in volume mounts.
-                        type: boolean
-                      emptyDir:
-                        description: |-
-                          EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More
-                          info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir
-                        properties:
-                          medium:
-                            description: |-
-                              medium represents what type of storage medium should back this directory.
-                              The default is "" which means to use the node's default medium.
-                              Must be an empty string (default) or Memory.
-                              More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
-                            type: string
-                          sizeLimit:
-                            anyOf:
-                            - type: integer
-                            - type: string
-                            description: |-
-                              sizeLimit is the total amount of local storage required for this EmptyDir volume.
-                              The size limit is also applicable for memory medium.
-                              The maximum usage on memory medium EmptyDir would be the minimum value between
-                              the SizeLimit specified here and the sum of memory limits of all containers in a pod.
-                              The default is nil which means that the limit is undefined.
-                              More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
-                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                            x-kubernetes-int-or-string: true
-                        type: object
-                      volumeClaimTemplate:
-                        description: A PVC spec to be used by the VMAlertManager StatefulSets.
-                        type: object
-                        x-kubernetes-preserve-unknown-fields: true
+                      whenDeleted:
+                        type: string
+                      whenScaled:
+                        type: string
                     type: object
                   podDisruptionBudget:
-                    description: PodDisruptionBudget created by operator
                     properties:
                       maxUnavailable:
                         anyOf:
                         - type: integer
                         - type: string
-                        description: |-
-                          An eviction is allowed if at most "maxUnavailable" pods selected by
-                          "selector" are unavailable after the eviction, i.e. even in absence of
-                          the evicted pod. For example, one can prevent all voluntary evictions
-                          by specifying 0. This is a mutually exclusive setting with "minAvailable".
                         x-kubernetes-int-or-string: true
                       minAvailable:
                         anyOf:
                         - type: integer
                         - type: string
-                        description: |-
-                          An eviction is allowed if at least "minAvailable" pods selected by
-                          "selector" will still be available after the eviction, i.e. even in the
-                          absence of the evicted pod.  So for example you can prevent all voluntary
-                          evictions by specifying "100%".
                         x-kubernetes-int-or-string: true
                       selectorLabels:
                         additionalProperties:
                           type: string
-                        description: |-
-                          replaces default labels selector generated by operator
-                          it's useful when you need to create custom budget
                         type: object
+                      unhealthyPodEvictionPolicy:
+                        enum:
+                        - IfHealthyBudget
+                        - AlwaysAllow
+                        type: string
                     type: object
                   podMetadata:
-                    description: PodMetadata configures Labels and Annotations which
-                      are propagated to the VMSelect pods.
                     properties:
                       annotations:
                         additionalProperties:
                           type: string
-                        description: |-
-                          Annotations is an unstructured key value map stored with a resource that may be
-                          set by external tools to store and retrieve arbitrary metadata. They are not
-                          queryable and should be preserved when modifying objects.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                         type: object
                       labels:
                         additionalProperties:
                           type: string
-                        description: |-
-                          Labels Map of string keys and values that can be used to organize and categorize
-                          (scope and select) objects. May match selectors of replication controllers
-                          and services.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                         type: object
                       name:
-                        description: |-
-                          Name must be unique within a namespace. Is required when creating resources, although
-                          some resources may allow a client to request the generation of an appropriate name
-                          automatically. Name is primarily intended for creation idempotence and configuration
-                          definition.
-                          Cannot be updated.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                         type: string
                     type: object
                   port:
-                    description: Port listen address
                     type: string
                   priorityClassName:
-                    description: PriorityClassName class assigned to the Pods
                     type: string
                   readinessGates:
-                    description: ReadinessGates defines pod readiness gates
                     items:
-                      description: PodReadinessGate contains the reference to a pod
-                        condition
                       properties:
                         conditionType:
-                          description: ConditionType refers to a condition in the
-                            pod's condition list with matching type.
                           type: string
                       required:
                       - conditionType
                       type: object
                     type: array
                   readinessProbe:
-                    description: ReadinessProbe that will be added CRD pod
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   replicaCount:
-                    description: ReplicaCount is the expected size of the Application.
                     format: int32
                     type: integer
                   resources:
-                    description: |-
-                      Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                      if not defined default resources from operator config will be used
                     properties:
                       claims:
-                        description: |-
-                          Claims lists the names of resources, defined in spec.resourceClaims,
-                          that are used by this container.
-
-                          This is an alpha field and requires enabling the
-                          DynamicResourceAllocation feature gate.
-
-                          This field is immutable. It can only be set for containers.
                         items:
-                          description: ResourceClaim references one entry in PodSpec.ResourceClaims.
                           properties:
                             name:
-                              description: |-
-                                Name must match the name of one entry in pod.spec.resourceClaims of
-                                the Pod where this field is used. It makes that resource available
-                                inside a container.
                               type: string
                             request:
-                              description: |-
-                                Request is the name chosen for a request in the referenced claim.
-                                If empty, everything from the claim is made available, otherwise
-                                only the result of this request.
                               type: string
                           required:
                           - name
@@ -18271,9 +15205,6 @@ spec:
                           - type: string
                           pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                           x-kubernetes-int-or-string: true
-                        description: |-
-                          Limits describes the maximum amount of compute resources allowed.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                         type: object
                       requests:
                         additionalProperties:
@@ -18282,233 +15213,109 @@ spec:
                           - type: string
                           pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                           x-kubernetes-int-or-string: true
-                        description: |-
-                          Requests describes the minimum amount of compute resources required.
-                          If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                          otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                         type: object
                     type: object
                   revisionHistoryLimitCount:
-                    description: |-
-                      The number of old ReplicaSets to retain to allow rollback in deployment or
-                      maximum number of revisions that will be maintained in the Deployment revision history.
-                      Has no effect at StatefulSets
-                      Defaults to 10.
                     format: int32
                     type: integer
                   rollingUpdateStrategy:
-                    description: |-
-                      RollingUpdateStrategy defines strategy for application updates
-                      Default is OnDelete, in this case operator handles update process
-                      Can be changed for RollingUpdate
                     type: string
+                  rollingUpdateStrategyBehavior:
+                    properties:
+                      maxUnavailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                    type: object
                   runtimeClassName:
-                    description: |-
-                      RuntimeClassName - defines runtime class for kubernetes pod.
-                      https://kubernetes.io/docs/concepts/containers/runtime-class/
                     type: string
                   schedulerName:
-                    description: SchedulerName - defines kubernetes scheduler name
                     type: string
                   secrets:
-                    description: |-
-                      Secrets is a list of Secrets in the same namespace as the Application
-                      object, which shall be mounted into the Application container
-                      at /etc/vm/secrets/SECRET_NAME folder
                     items:
                       type: string
                     type: array
                   securityContext:
-                    description: |-
-                      SecurityContext holds pod-level security attributes and common container settings.
-                      This defaults to the default PodSecurityContext.
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   serviceScrapeSpec:
-                    description: ServiceScrapeSpec that will be added to vmselect
-                      VMServiceScrape spec
                     required:
                     - endpoints
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   serviceSpec:
-                    description: ServiceSpec that will be added to vmselect service
-                      spec
                     properties:
                       metadata:
-                        description: EmbeddedObjectMetadata defines objectMeta for
-                          additional service.
                         properties:
                           annotations:
                             additionalProperties:
                               type: string
-                            description: |-
-                              Annotations is an unstructured key value map stored with a resource that may be
-                              set by external tools to store and retrieve arbitrary metadata. They are not
-                              queryable and should be preserved when modifying objects.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                             type: object
                           labels:
                             additionalProperties:
                               type: string
-                            description: |-
-                              Labels Map of string keys and values that can be used to organize and categorize
-                              (scope and select) objects. May match selectors of replication controllers
-                              and services.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                             type: object
                           name:
-                            description: |-
-                              Name must be unique within a namespace. Is required when creating resources, although
-                              some resources may allow a client to request the generation of an appropriate name
-                              automatically. Name is primarily intended for creation idempotence and configuration
-                              definition.
-                              Cannot be updated.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                             type: string
                         type: object
                       spec:
-                        description: |-
-                          ServiceSpec describes the attributes that a user creates on a service.
-                          More info: https://kubernetes.io/docs/concepts/services-networking/service/
                         type: object
                         x-kubernetes-preserve-unknown-fields: true
                       useAsDefault:
-                        description: |-
-                          UseAsDefault applies changes from given service definition to the main object Service
-                          Changing from headless service to clusterIP or loadbalancer may break cross-component communication
                         type: boolean
                     required:
                     - spec
                     type: object
                   startupProbe:
-                    description: StartupProbe that will be added to CRD pod
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   storage:
-                    description: |-
-                      StorageSpec - add persistent volume claim for cacheMountPath
-                      its needed for persistent cache
                     properties:
-                      disableMountSubPath:
-                        description: |-
-                          Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary.
-                          DisableMountSubPath allows to remove any subPath usage in volume mounts.
-                        type: boolean
                       emptyDir:
-                        description: |-
-                          EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More
-                          info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir
                         properties:
                           medium:
-                            description: |-
-                              medium represents what type of storage medium should back this directory.
-                              The default is "" which means to use the node's default medium.
-                              Must be an empty string (default) or Memory.
-                              More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
                             type: string
                           sizeLimit:
                             anyOf:
                             - type: integer
                             - type: string
-                            description: |-
-                              sizeLimit is the total amount of local storage required for this EmptyDir volume.
-                              The size limit is also applicable for memory medium.
-                              The maximum usage on memory medium EmptyDir would be the minimum value between
-                              the SizeLimit specified here and the sum of memory limits of all containers in a pod.
-                              The default is nil which means that the limit is undefined.
-                              More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
                             pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                             x-kubernetes-int-or-string: true
                         type: object
                       volumeClaimTemplate:
-                        description: A PVC spec to be used by the VMAlertManager StatefulSets.
                         properties:
                           apiVersion:
-                            description: |-
-                              APIVersion defines the versioned schema of this representation of an object.
-                              Servers should convert recognized schemas to the latest internal value, and
-                              may reject unrecognized values.
-                              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
                             type: string
                           kind:
-                            description: |-
-                              Kind is a string value representing the REST resource this object represents.
-                              Servers may infer this from the endpoint the client submits requests to.
-                              Cannot be updated.
-                              In CamelCase.
-                              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
                             type: string
                           metadata:
-                            description: EmbeddedMetadata contains metadata relevant
-                              to an EmbeddedResource.
                             properties:
                               annotations:
                                 additionalProperties:
                                   type: string
-                                description: |-
-                                  Annotations is an unstructured key value map stored with a resource that may be
-                                  set by external tools to store and retrieve arbitrary metadata. They are not
-                                  queryable and should be preserved when modifying objects.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                                 type: object
                               labels:
                                 additionalProperties:
                                   type: string
-                                description: |-
-                                  Labels Map of string keys and values that can be used to organize and categorize
-                                  (scope and select) objects. May match selectors of replication controllers
-                                  and services.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                                 type: object
                               name:
-                                description: |-
-                                  Name must be unique within a namespace. Is required when creating resources, although
-                                  some resources may allow a client to request the generation of an appropriate name
-                                  automatically. Name is primarily intended for creation idempotence and configuration
-                                  definition.
-                                  Cannot be updated.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                                 type: string
                             type: object
                           spec:
-                            description: |-
-                              Spec defines the desired characteristics of a volume requested by a pod author.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
                             properties:
                               accessModes:
-                                description: |-
-                                  accessModes contains the desired access modes the volume should have.
-                                  More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
                                 items:
                                   type: string
                                 type: array
                                 x-kubernetes-list-type: atomic
                               dataSource:
-                                description: |-
-                                  dataSource field can be used to specify either:
-                                  * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
-                                  * An existing PVC (PersistentVolumeClaim)
-                                  If the provisioner or an external controller can support the specified data source,
-                                  it will create a new volume based on the contents of the specified data source.
-                                  When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-                                  and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
-                                  If the namespace is specified, then dataSourceRef will not be copied to dataSource.
                                 properties:
                                   apiGroup:
-                                    description: |-
-                                      APIGroup is the group for the resource being referenced.
-                                      If APIGroup is not specified, the specified Kind must be in the core API group.
-                                      For any other third-party types, APIGroup is required.
                                     type: string
                                   kind:
-                                    description: Kind is the type of resource being
-                                      referenced
                                     type: string
                                   name:
-                                    description: Name is the name of resource being
-                                      referenced
                                     type: string
                                 required:
                                 - kind
@@ -18516,62 +15323,20 @@ spec:
                                 type: object
                                 x-kubernetes-map-type: atomic
                               dataSourceRef:
-                                description: |-
-                                  dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
-                                  volume is desired. This may be any object from a non-empty API group (non
-                                  core object) or a PersistentVolumeClaim object.
-                                  When this field is specified, volume binding will only succeed if the type of
-                                  the specified object matches some installed volume populator or dynamic
-                                  provisioner.
-                                  This field will replace the functionality of the dataSource field and as such
-                                  if both fields are non-empty, they must have the same value. For backwards
-                                  compatibility, when namespace isn't specified in dataSourceRef,
-                                  both fields (dataSource and dataSourceRef) will be set to the same
-                                  value automatically if one of them is empty and the other is non-empty.
-                                  When namespace is specified in dataSourceRef,
-                                  dataSource isn't set to the same value and must be empty.
-                                  There are three important differences between dataSource and dataSourceRef:
-                                  * While dataSource only allows two specific types of objects, dataSourceRef
-                                    allows any non-core object, as well as PersistentVolumeClaim objects.
-                                  * While dataSource ignores disallowed values (dropping them), dataSourceRef
-                                    preserves all values, and generates an error if a disallowed value is
-                                    specified.
-                                  * While dataSource only allows local objects, dataSourceRef allows objects
-                                    in any namespaces.
-                                  (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
-                                  (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
                                 properties:
                                   apiGroup:
-                                    description: |-
-                                      APIGroup is the group for the resource being referenced.
-                                      If APIGroup is not specified, the specified Kind must be in the core API group.
-                                      For any other third-party types, APIGroup is required.
                                     type: string
                                   kind:
-                                    description: Kind is the type of resource being
-                                      referenced
                                     type: string
                                   name:
-                                    description: Name is the name of resource being
-                                      referenced
                                     type: string
                                   namespace:
-                                    description: |-
-                                      Namespace is the namespace of resource being referenced
-                                      Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
-                                      (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
                                     type: string
                                 required:
                                 - kind
                                 - name
                                 type: object
                               resources:
-                                description: |-
-                                  resources represents the minimum resources the volume should have.
-                                  If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
-                                  that are lower than previous value but must still be higher than capacity recorded in the
-                                  status field of the claim.
-                                  More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
                                 properties:
                                   limits:
                                     additionalProperties:
@@ -18580,9 +15345,6 @@ spec:
                                       - type: string
                                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                       x-kubernetes-int-or-string: true
-                                    description: |-
-                                      Limits describes the maximum amount of compute resources allowed.
-                                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                     type: object
                                   requests:
                                     additionalProperties:
@@ -18591,41 +15353,18 @@ spec:
                                       - type: string
                                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                       x-kubernetes-int-or-string: true
-                                    description: |-
-                                      Requests describes the minimum amount of compute resources required.
-                                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                     type: object
                                 type: object
                               selector:
-                                description: selector is a label query over volumes
-                                  to consider for binding.
                                 properties:
                                   matchExpressions:
-                                    description: matchExpressions is a list of label
-                                      selector requirements. The requirements are
-                                      ANDed.
                                     items:
-                                      description: |-
-                                        A label selector requirement is a selector that contains values, a key, and an operator that
-                                        relates the key and values.
                                       properties:
                                         key:
-                                          description: key is the label key that the
-                                            selector applies to.
                                           type: string
                                         operator:
-                                          description: |-
-                                            operator represents a key's relationship to a set of values.
-                                            Valid operators are In, NotIn, Exists and DoesNotExist.
                                           type: string
                                         values:
-                                          description: |-
-                                            values is an array of string values. If the operator is In or NotIn,
-                                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                            the values array must be empty. This array is replaced during a strategic
-                                            merge patch.
                                           items:
                                             type: string
                                           type: array
@@ -18639,103 +15378,28 @@ spec:
                                   matchLabels:
                                     additionalProperties:
                                       type: string
-                                    description: |-
-                                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                                     type: object
                                 type: object
                                 x-kubernetes-map-type: atomic
                               storageClassName:
-                                description: |-
-                                  storageClassName is the name of the StorageClass required by the claim.
-                                  More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
                                 type: string
                               volumeAttributesClassName:
-                                description: |-
-                                  volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
-                                  If specified, the CSI driver will create or update the volume with the attributes defined
-                                  in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                  it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                  will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                  If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                  will be set by the persistentvolume controller if it exists.
-                                  If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
-                                  set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
-                                  exists.
-                                  More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                  (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                 type: string
                               volumeMode:
-                                description: |-
-                                  volumeMode defines what type of volume is required by the claim.
-                                  Value of Filesystem is implied when not included in claim spec.
                                 type: string
                               volumeName:
-                                description: volumeName is the binding reference to
-                                  the PersistentVolume backing this claim.
                                 type: string
                             type: object
                           status:
-                            description: |-
-                              Status represents the current information/status of a persistent volume claim.
-                              Read-only.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
                             properties:
                               accessModes:
-                                description: |-
-                                  accessModes contains the actual access modes the volume backing the PVC has.
-                                  More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
                                 items:
                                   type: string
                                 type: array
                                 x-kubernetes-list-type: atomic
                               allocatedResourceStatuses:
                                 additionalProperties:
-                                  description: |-
-                                    When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource
-                                    that it does not recognizes, then it should ignore that update and let other controllers
-                                    handle it.
                                   type: string
-                                description: "allocatedResourceStatuses stores status
-                                  of resource being resized for the given PVC.\nKey
-                                  names follow standard Kubernetes label syntax. Valid
-                                  values are either:\n\t* Un-prefixed keys:\n\t\t-
-                                  storage - the capacity of the volume.\n\t* Custom
-                                  resources must use implementation-defined prefixed
-                                  names such as \"example.com/my-custom-resource\"\nApart
-                                  from above values - keys that are unprefixed or
-                                  have kubernetes.io prefix are considered\nreserved
-                                  and hence may not be used.\n\nClaimResourceStatus
-                                  can be in any of following states:\n\t- ControllerResizeInProgress:\n\t\tState
-                                  set when resize controller starts resizing the volume
-                                  in control-plane.\n\t- ControllerResizeFailed:\n\t\tState
-                                  set when resize has failed in resize controller
-                                  with a terminal error.\n\t- NodeResizePending:\n\t\tState
-                                  set when resize controller has finished resizing
-                                  the volume but further resizing of\n\t\tvolume is
-                                  needed on the node.\n\t- NodeResizeInProgress:\n\t\tState
-                                  set when kubelet starts resizing the volume.\n\t-
-                                  NodeResizeFailed:\n\t\tState set when resizing has
-                                  failed in kubelet with a terminal error. Transient
-                                  errors don't set\n\t\tNodeResizeFailed.\nFor example:
-                                  if expanding a PVC for more capacity - this field
-                                  can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage']
-                                  = \"ControllerResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                  = \"ControllerResizeFailed\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                  = \"NodeResizePending\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                  = \"NodeResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                  = \"NodeResizeFailed\"\nWhen this field is not set,
-                                  it means that no resize operation is in progress
-                                  for the given PVC.\n\nA controller that receives
-                                  PVC update with previously unknown resourceName
-                                  or ClaimResourceStatus\nshould ignore the update
-                                  for the purpose it was designed. For example - a
-                                  controller that\nonly is responsible for resizing
-                                  capacity of the volume, should ignore PVC updates
-                                  that change other valid\nresources associated with
-                                  PVC.\n\nThis is an alpha field and requires enabling
-                                  RecoverVolumeExpansionFailure feature."
                                 type: object
                                 x-kubernetes-map-type: granular
                               allocatedResources:
@@ -18745,33 +15409,6 @@ spec:
                                   - type: string
                                   pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                   x-kubernetes-int-or-string: true
-                                description: "allocatedResources tracks the resources
-                                  allocated to a PVC including its capacity.\nKey
-                                  names follow standard Kubernetes label syntax. Valid
-                                  values are either:\n\t* Un-prefixed keys:\n\t\t-
-                                  storage - the capacity of the volume.\n\t* Custom
-                                  resources must use implementation-defined prefixed
-                                  names such as \"example.com/my-custom-resource\"\nApart
-                                  from above values - keys that are unprefixed or
-                                  have kubernetes.io prefix are considered\nreserved
-                                  and hence may not be used.\n\nCapacity reported
-                                  here may be larger than the actual capacity when
-                                  a volume expansion operation\nis requested.\nFor
-                                  storage quota, the larger value from allocatedResources
-                                  and PVC.spec.resources is used.\nIf allocatedResources
-                                  is not set, PVC.spec.resources alone is used for
-                                  quota calculation.\nIf a volume expansion capacity
-                                  request is lowered, allocatedResources is only\nlowered
-                                  if there are no expansion operations in progress
-                                  and if the actual volume capacity\nis equal or lower
-                                  than the requested capacity.\n\nA controller that
-                                  receives PVC update with previously unknown resourceName\nshould
-                                  ignore the update for the purpose it was designed.
-                                  For example - a controller that\nonly is responsible
-                                  for resizing capacity of the volume, should ignore
-                                  PVC updates that change other valid\nresources associated
-                                  with PVC.\n\nThis is an alpha field and requires
-                                  enabling RecoverVolumeExpansionFailure feature."
                                 type: object
                               capacity:
                                 additionalProperties:
@@ -18780,48 +15417,23 @@ spec:
                                   - type: string
                                   pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                   x-kubernetes-int-or-string: true
-                                description: capacity represents the actual resources
-                                  of the underlying volume.
                                 type: object
                               conditions:
-                                description: |-
-                                  conditions is the current Condition of persistent volume claim. If underlying persistent volume is being
-                                  resized then the Condition will be set to 'Resizing'.
                                 items:
-                                  description: PersistentVolumeClaimCondition contains
-                                    details about state of pvc
                                   properties:
                                     lastProbeTime:
-                                      description: lastProbeTime is the time we probed
-                                        the condition.
                                       format: date-time
                                       type: string
                                     lastTransitionTime:
-                                      description: lastTransitionTime is the time
-                                        the condition transitioned from one status
-                                        to another.
                                       format: date-time
                                       type: string
                                     message:
-                                      description: message is the human-readable message
-                                        indicating details about last transition.
                                       type: string
                                     reason:
-                                      description: |-
-                                        reason is a unique, this should be a short, machine understandable string that gives the reason
-                                        for condition's last transition. If it reports "Resizing" that means the underlying
-                                        persistent volume is being resized.
                                       type: string
                                     status:
-                                      description: |-
-                                        Status is the status of the condition.
-                                        Can be True, False, Unknown.
-                                        More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required
                                       type: string
                                     type:
-                                      description: |-
-                                        Type is the type of the condition.
-                                        More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about
                                       type: string
                                   required:
                                   - status
@@ -18832,100 +15444,42 @@ spec:
                                 - type
                                 x-kubernetes-list-type: map
                               currentVolumeAttributesClassName:
-                                description: |-
-                                  currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
-                                  When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                                  This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                                 type: string
                               modifyVolumeStatus:
-                                description: |-
-                                  ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
-                                  When this is unset, there is no ModifyVolume operation being attempted.
-                                  This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                                 properties:
                                   status:
-                                    description: "status is the status of the ControllerModifyVolume
-                                      operation. It can be in any of following states:\n
-                                      - Pending\n   Pending indicates that the PersistentVolumeClaim
-                                      cannot be modified due to unmet requirements,
-                                      such as\n   the specified VolumeAttributesClass
-                                      not existing.\n - InProgress\n   InProgress
-                                      indicates that the volume is being modified.\n
-                                      - Infeasible\n  Infeasible indicates that the
-                                      request has been rejected as invalid by the
-                                      CSI driver. To\n\t  resolve the error, a valid
-                                      VolumeAttributesClass needs to be specified.\nNote:
-                                      New statuses can be added in the future. Consumers
-                                      should check for unknown statuses and fail appropriately."
                                     type: string
                                   targetVolumeAttributesClassName:
-                                    description: targetVolumeAttributesClassName is
-                                      the name of the VolumeAttributesClass the PVC
-                                      currently being reconciled
                                     type: string
                                 required:
                                 - status
                                 type: object
                               phase:
-                                description: phase represents the current phase of
-                                  PersistentVolumeClaim.
                                 type: string
                             type: object
                         type: object
                     type: object
                   terminationGracePeriodSeconds:
-                    description: TerminationGracePeriodSeconds period for container
-                      graceful termination
                     format: int64
                     type: integer
                   tolerations:
-                    description: Tolerations If specified, the pod's tolerations.
                     items:
-                      description: |-
-                        The pod this Toleration is attached to tolerates any taint that matches
-                        the triple <key,value,effect> using the matching operator <operator>.
                       properties:
                         effect:
-                          description: |-
-                            Effect indicates the taint effect to match. Empty means match all taint effects.
-                            When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                           type: string
                         key:
-                          description: |-
-                            Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                            If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                           type: string
                         operator:
-                          description: |-
-                            Operator represents a key's relationship to the value.
-                            Valid operators are Exists and Equal. Defaults to Equal.
-                            Exists is equivalent to wildcard for value, so that a pod can
-                            tolerate all taints of a particular category.
                           type: string
                         tolerationSeconds:
-                          description: |-
-                            TolerationSeconds represents the period of time the toleration (which must be
-                            of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                            it is not set, which means tolerate the taint forever (do not evict). Zero and
-                            negative values will be treated as 0 (evict immediately) by the system.
                           format: int64
                           type: integer
                         value:
-                          description: |-
-                            Value is the taint value the toleration matches to.
-                            If the operator is Exists, the value should be empty, otherwise just a regular string.
                           type: string
                       type: object
                     type: array
                   topologySpreadConstraints:
-                    description: |-
-                      TopologySpreadConstraints embedded kubernetes pod configuration option,
-                      controls how pods are spread across your cluster among failure-domains
-                      such as regions, zones, nodes, and other user-defined topology domains
-                      https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
                     items:
-                      description: TopologySpreadConstraint specifies how to spread
-                        matching pods among the given topology.
                       required:
                       - maxSkew
                       - topologyKey
@@ -18934,77 +15488,25 @@ spec:
                       x-kubernetes-preserve-unknown-fields: true
                     type: array
                   useDefaultResources:
-                    description: |-
-                      UseDefaultResources controls resource settings
-                      By default, operator sets built-in resource requirements
                     type: boolean
                   useStrictSecurity:
-                    description: |-
-                      UseStrictSecurity enables strict security mode for component
-                      it restricts disk writes access
-                      uses non-root user out of the box
-                      drops not needed security permissions
                     type: boolean
                   volumeMounts:
-                    description: |-
-                      VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
-                      VolumeMounts specified will be appended to other VolumeMounts in the Application container
                     items:
-                      description: VolumeMount describes a mounting of a Volume within
-                        a container.
                       properties:
                         mountPath:
-                          description: |-
-                            Path within the container at which the volume should be mounted.  Must
-                            not contain ':'.
                           type: string
                         mountPropagation:
-                          description: |-
-                            mountPropagation determines how mounts are propagated from the host
-                            to container and the other way around.
-                            When not set, MountPropagationNone is used.
-                            This field is beta in 1.10.
-                            When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                            (which defaults to None).
                           type: string
                         name:
-                          description: This must match the Name of a Volume.
                           type: string
                         readOnly:
-                          description: |-
-                            Mounted read-only if true, read-write otherwise (false or unspecified).
-                            Defaults to false.
                           type: boolean
                         recursiveReadOnly:
-                          description: |-
-                            RecursiveReadOnly specifies whether read-only mounts should be handled
-                            recursively.
-
-                            If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                            If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                            recursively read-only.  If this field is set to IfPossible, the mount is made
-                            recursively read-only, if it is supported by the container runtime.  If this
-                            field is set to Enabled, the mount is made recursively read-only if it is
-                            supported by the container runtime, otherwise the pod will not be started and
-                            an error will be generated to indicate the reason.
-
-                            If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                            None (or be unspecified, which defaults to None).
-
-                            If this field is not specified, it is treated as an equivalent of Disabled.
                           type: string
                         subPath:
-                          description: |-
-                            Path within the volume from which the container's volume should be mounted.
-                            Defaults to "" (volume's root).
                           type: string
                         subPathExpr:
-                          description: |-
-                            Expanded path within the volume from which the container's volume should be mounted.
-                            Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                            Defaults to "" (volume's root).
-                            SubPathExpr and SubPath are mutually exclusive.
                           type: string
                       required:
                       - mountPath
@@ -19012,563 +15514,158 @@ spec:
                       type: object
                     type: array
                   volumes:
-                    description: |-
-                      Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
-                      Volumes specified will be appended to other volumes that are generated.
-                      / +optional
                     items:
-                      description: Volume represents a named volume in a pod that
-                        may be accessed by any container in the pod.
                       required:
                       - name
                       type: object
                       x-kubernetes-preserve-unknown-fields: true
                     type: array
+                  vpa:
+                    properties:
+                      recommenders:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                      resourcePolicy:
+                        properties:
+                          containerPolicies:
+                            items:
+                              properties:
+                                containerName:
+                                  type: string
+                                controlledResources:
+                                  items:
+                                    type: string
+                                  type: array
+                                controlledValues:
+                                  enum:
+                                  - RequestsAndLimits
+                                  - RequestsOnly
+                                  type: string
+                                maxAllowed:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                minAllowed:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                mode:
+                                  enum:
+                                  - Auto
+                                  - "Off"
+                                  type: string
+                              type: object
+                            type: array
+                        type: object
+                      updatePolicy:
+                        properties:
+                          evictionRequirements:
+                            items:
+                              properties:
+                                changeRequirement:
+                                  enum:
+                                  - TargetHigherThanRequests
+                                  - TargetLowerThanRequests
+                                  type: string
+                                resources:
+                                  items:
+                                    type: string
+                                  type: array
+                              required:
+                              - changeRequirement
+                              - resources
+                              type: object
+                            type: array
+                          minReplicas:
+                            format: int32
+                            type: integer
+                          updateMode:
+                            enum:
+                            - "Off"
+                            - Initial
+                            - Recreate
+                            - InPlaceOrRecreate
+                            - Auto
+                            type: string
+                        type: object
+                    type: object
                 type: object
               vmstorage:
                 properties:
                   affinity:
-                    description: Affinity If specified, the pod's scheduling constraints.
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   claimTemplates:
-                    description: ClaimTemplates allows adding additional VolumeClaimTemplates
-                      for StatefulSet
                     items:
-                      description: PersistentVolumeClaim is a user's request for and
-                        claim to a persistent volume
-                      properties:
-                        apiVersion:
-                          description: |-
-                            APIVersion defines the versioned schema of this representation of an object.
-                            Servers should convert recognized schemas to the latest internal value, and
-                            may reject unrecognized values.
-                            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-                          type: string
-                        kind:
-                          description: |-
-                            Kind is a string value representing the REST resource this object represents.
-                            Servers may infer this from the endpoint the client submits requests to.
-                            Cannot be updated.
-                            In CamelCase.
-                            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-                          type: string
-                        metadata:
-                          description: |-
-                            Standard object's metadata.
-                            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-                          type: object
-                          x-kubernetes-preserve-unknown-fields: true
-                        spec:
-                          description: |-
-                            spec defines the desired characteristics of a volume requested by a pod author.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
-                          properties:
-                            accessModes:
-                              description: |-
-                                accessModes contains the desired access modes the volume should have.
-                                More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                              items:
-                                type: string
-                              type: array
-                              x-kubernetes-list-type: atomic
-                            dataSource:
-                              description: |-
-                                dataSource field can be used to specify either:
-                                * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
-                                * An existing PVC (PersistentVolumeClaim)
-                                If the provisioner or an external controller can support the specified data source,
-                                it will create a new volume based on the contents of the specified data source.
-                                When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-                                and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
-                                If the namespace is specified, then dataSourceRef will not be copied to dataSource.
-                              properties:
-                                apiGroup:
-                                  description: |-
-                                    APIGroup is the group for the resource being referenced.
-                                    If APIGroup is not specified, the specified Kind must be in the core API group.
-                                    For any other third-party types, APIGroup is required.
-                                  type: string
-                                kind:
-                                  description: Kind is the type of resource being
-                                    referenced
-                                  type: string
-                                name:
-                                  description: Name is the name of resource being
-                                    referenced
-                                  type: string
-                              required:
-                              - kind
-                              - name
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            dataSourceRef:
-                              description: |-
-                                dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
-                                volume is desired. This may be any object from a non-empty API group (non
-                                core object) or a PersistentVolumeClaim object.
-                                When this field is specified, volume binding will only succeed if the type of
-                                the specified object matches some installed volume populator or dynamic
-                                provisioner.
-                                This field will replace the functionality of the dataSource field and as such
-                                if both fields are non-empty, they must have the same value. For backwards
-                                compatibility, when namespace isn't specified in dataSourceRef,
-                                both fields (dataSource and dataSourceRef) will be set to the same
-                                value automatically if one of them is empty and the other is non-empty.
-                                When namespace is specified in dataSourceRef,
-                                dataSource isn't set to the same value and must be empty.
-                                There are three important differences between dataSource and dataSourceRef:
-                                * While dataSource only allows two specific types of objects, dataSourceRef
-                                  allows any non-core object, as well as PersistentVolumeClaim objects.
-                                * While dataSource ignores disallowed values (dropping them), dataSourceRef
-                                  preserves all values, and generates an error if a disallowed value is
-                                  specified.
-                                * While dataSource only allows local objects, dataSourceRef allows objects
-                                  in any namespaces.
-                                (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
-                                (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                              properties:
-                                apiGroup:
-                                  description: |-
-                                    APIGroup is the group for the resource being referenced.
-                                    If APIGroup is not specified, the specified Kind must be in the core API group.
-                                    For any other third-party types, APIGroup is required.
-                                  type: string
-                                kind:
-                                  description: Kind is the type of resource being
-                                    referenced
-                                  type: string
-                                name:
-                                  description: Name is the name of resource being
-                                    referenced
-                                  type: string
-                                namespace:
-                                  description: |-
-                                    Namespace is the namespace of resource being referenced
-                                    Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
-                                    (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                                  type: string
-                              required:
-                              - kind
-                              - name
-                              type: object
-                            resources:
-                              description: |-
-                                resources represents the minimum resources the volume should have.
-                                If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
-                                that are lower than previous value but must still be higher than capacity recorded in the
-                                status field of the claim.
-                                More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
-                              properties:
-                                limits:
-                                  additionalProperties:
-                                    anyOf:
-                                    - type: integer
-                                    - type: string
-                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                    x-kubernetes-int-or-string: true
-                                  description: |-
-                                    Limits describes the maximum amount of compute resources allowed.
-                                    More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                                  type: object
-                                requests:
-                                  additionalProperties:
-                                    anyOf:
-                                    - type: integer
-                                    - type: string
-                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                    x-kubernetes-int-or-string: true
-                                  description: |-
-                                    Requests describes the minimum amount of compute resources required.
-                                    If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                                    otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                                    More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                                  type: object
-                              type: object
-                            selector:
-                              description: selector is a label query over volumes
-                                to consider for binding.
-                              properties:
-                                matchExpressions:
-                                  description: matchExpressions is a list of label
-                                    selector requirements. The requirements are ANDed.
-                                  items:
-                                    description: |-
-                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                      relates the key and values.
-                                    properties:
-                                      key:
-                                        description: key is the label key that the
-                                          selector applies to.
-                                        type: string
-                                      operator:
-                                        description: |-
-                                          operator represents a key's relationship to a set of values.
-                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                        type: string
-                                      values:
-                                        description: |-
-                                          values is an array of string values. If the operator is In or NotIn,
-                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                          the values array must be empty. This array is replaced during a strategic
-                                          merge patch.
-                                        items:
-                                          type: string
-                                        type: array
-                                        x-kubernetes-list-type: atomic
-                                    required:
-                                    - key
-                                    - operator
-                                    type: object
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                matchLabels:
-                                  additionalProperties:
-                                    type: string
-                                  description: |-
-                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                  type: object
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            storageClassName:
-                              description: |-
-                                storageClassName is the name of the StorageClass required by the claim.
-                                More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
-                              type: string
-                            volumeAttributesClassName:
-                              description: |-
-                                volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
-                                If specified, the CSI driver will create or update the volume with the attributes defined
-                                in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                will be set by the persistentvolume controller if it exists.
-                                If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
-                                set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
-                                exists.
-                                More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
-                              type: string
-                            volumeMode:
-                              description: |-
-                                volumeMode defines what type of volume is required by the claim.
-                                Value of Filesystem is implied when not included in claim spec.
-                              type: string
-                            volumeName:
-                              description: volumeName is the binding reference to
-                                the PersistentVolume backing this claim.
-                              type: string
-                          type: object
-                        status:
-                          description: |-
-                            status represents the current information/status of a persistent volume claim.
-                            Read-only.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
-                          properties:
-                            accessModes:
-                              description: |-
-                                accessModes contains the actual access modes the volume backing the PVC has.
-                                More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                              items:
-                                type: string
-                              type: array
-                              x-kubernetes-list-type: atomic
-                            allocatedResourceStatuses:
-                              additionalProperties:
-                                description: |-
-                                  When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource
-                                  that it does not recognizes, then it should ignore that update and let other controllers
-                                  handle it.
-                                type: string
-                              description: "allocatedResourceStatuses stores status
-                                of resource being resized for the given PVC.\nKey
-                                names follow standard Kubernetes label syntax. Valid
-                                values are either:\n\t* Un-prefixed keys:\n\t\t- storage
-                                - the capacity of the volume.\n\t* Custom resources
-                                must use implementation-defined prefixed names such
-                                as \"example.com/my-custom-resource\"\nApart from
-                                above values - keys that are unprefixed or have kubernetes.io
-                                prefix are considered\nreserved and hence may not
-                                be used.\n\nClaimResourceStatus can be in any of following
-                                states:\n\t- ControllerResizeInProgress:\n\t\tState
-                                set when resize controller starts resizing the volume
-                                in control-plane.\n\t- ControllerResizeFailed:\n\t\tState
-                                set when resize has failed in resize controller with
-                                a terminal error.\n\t- NodeResizePending:\n\t\tState
-                                set when resize controller has finished resizing the
-                                volume but further resizing of\n\t\tvolume is needed
-                                on the node.\n\t- NodeResizeInProgress:\n\t\tState
-                                set when kubelet starts resizing the volume.\n\t-
-                                NodeResizeFailed:\n\t\tState set when resizing has
-                                failed in kubelet with a terminal error. Transient
-                                errors don't set\n\t\tNodeResizeFailed.\nFor example:
-                                if expanding a PVC for more capacity - this field
-                                can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage']
-                                = \"ControllerResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                = \"ControllerResizeFailed\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                = \"NodeResizePending\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                = \"NodeResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                = \"NodeResizeFailed\"\nWhen this field is not set,
-                                it means that no resize operation is in progress for
-                                the given PVC.\n\nA controller that receives PVC update
-                                with previously unknown resourceName or ClaimResourceStatus\nshould
-                                ignore the update for the purpose it was designed.
-                                For example - a controller that\nonly is responsible
-                                for resizing capacity of the volume, should ignore
-                                PVC updates that change other valid\nresources associated
-                                with PVC.\n\nThis is an alpha field and requires enabling
-                                RecoverVolumeExpansionFailure feature."
-                              type: object
-                              x-kubernetes-map-type: granular
-                            allocatedResources:
-                              additionalProperties:
-                                anyOf:
-                                - type: integer
-                                - type: string
-                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                x-kubernetes-int-or-string: true
-                              description: "allocatedResources tracks the resources
-                                allocated to a PVC including its capacity.\nKey names
-                                follow standard Kubernetes label syntax. Valid values
-                                are either:\n\t* Un-prefixed keys:\n\t\t- storage
-                                - the capacity of the volume.\n\t* Custom resources
-                                must use implementation-defined prefixed names such
-                                as \"example.com/my-custom-resource\"\nApart from
-                                above values - keys that are unprefixed or have kubernetes.io
-                                prefix are considered\nreserved and hence may not
-                                be used.\n\nCapacity reported here may be larger than
-                                the actual capacity when a volume expansion operation\nis
-                                requested.\nFor storage quota, the larger value from
-                                allocatedResources and PVC.spec.resources is used.\nIf
-                                allocatedResources is not set, PVC.spec.resources
-                                alone is used for quota calculation.\nIf a volume
-                                expansion capacity request is lowered, allocatedResources
-                                is only\nlowered if there are no expansion operations
-                                in progress and if the actual volume capacity\nis
-                                equal or lower than the requested capacity.\n\nA controller
-                                that receives PVC update with previously unknown resourceName\nshould
-                                ignore the update for the purpose it was designed.
-                                For example - a controller that\nonly is responsible
-                                for resizing capacity of the volume, should ignore
-                                PVC updates that change other valid\nresources associated
-                                with PVC.\n\nThis is an alpha field and requires enabling
-                                RecoverVolumeExpansionFailure feature."
-                              type: object
-                            capacity:
-                              additionalProperties:
-                                anyOf:
-                                - type: integer
-                                - type: string
-                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                x-kubernetes-int-or-string: true
-                              description: capacity represents the actual resources
-                                of the underlying volume.
-                              type: object
-                            conditions:
-                              description: |-
-                                conditions is the current Condition of persistent volume claim. If underlying persistent volume is being
-                                resized then the Condition will be set to 'Resizing'.
-                              items:
-                                description: PersistentVolumeClaimCondition contains
-                                  details about state of pvc
-                                properties:
-                                  lastProbeTime:
-                                    description: lastProbeTime is the time we probed
-                                      the condition.
-                                    format: date-time
-                                    type: string
-                                  lastTransitionTime:
-                                    description: lastTransitionTime is the time the
-                                      condition transitioned from one status to another.
-                                    format: date-time
-                                    type: string
-                                  message:
-                                    description: message is the human-readable message
-                                      indicating details about last transition.
-                                    type: string
-                                  reason:
-                                    description: |-
-                                      reason is a unique, this should be a short, machine understandable string that gives the reason
-                                      for condition's last transition. If it reports "Resizing" that means the underlying
-                                      persistent volume is being resized.
-                                    type: string
-                                  status:
-                                    description: |-
-                                      Status is the status of the condition.
-                                      Can be True, False, Unknown.
-                                      More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required
-                                    type: string
-                                  type:
-                                    description: |-
-                                      Type is the type of the condition.
-                                      More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about
-                                    type: string
-                                required:
-                                - status
-                                - type
-                                type: object
-                              type: array
-                              x-kubernetes-list-map-keys:
-                              - type
-                              x-kubernetes-list-type: map
-                            currentVolumeAttributesClassName:
-                              description: |-
-                                currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
-                                When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                                This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
-                              type: string
-                            modifyVolumeStatus:
-                              description: |-
-                                ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
-                                When this is unset, there is no ModifyVolume operation being attempted.
-                                This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
-                              properties:
-                                status:
-                                  description: "status is the status of the ControllerModifyVolume
-                                    operation. It can be in any of following states:\n
-                                    - Pending\n   Pending indicates that the PersistentVolumeClaim
-                                    cannot be modified due to unmet requirements,
-                                    such as\n   the specified VolumeAttributesClass
-                                    not existing.\n - InProgress\n   InProgress indicates
-                                    that the volume is being modified.\n - Infeasible\n
-                                    \ Infeasible indicates that the request has been
-                                    rejected as invalid by the CSI driver. To\n\t
-                                    \ resolve the error, a valid VolumeAttributesClass
-                                    needs to be specified.\nNote: New statuses can
-                                    be added in the future. Consumers should check
-                                    for unknown statuses and fail appropriately."
-                                  type: string
-                                targetVolumeAttributesClassName:
-                                  description: targetVolumeAttributesClassName is
-                                    the name of the VolumeAttributesClass the PVC
-                                    currently being reconciled
-                                  type: string
-                              required:
-                              - status
-                              type: object
-                            phase:
-                              description: phase represents the current phase of PersistentVolumeClaim.
-                              type: string
-                          type: object
                       type: object
+                      x-kubernetes-preserve-unknown-fields: true
                     type: array
                   configMaps:
-                    description: |-
-                      ConfigMaps is a list of ConfigMaps in the same namespace as the Application
-                      object, which shall be mounted into the Application container
-                      at /etc/vm/configs/CONFIGMAP_NAME folder
                     items:
                       type: string
                     type: array
                   containers:
-                    description: |-
-                      Containers property allows to inject additions sidecars or to patch existing containers.
-                      It can be useful for proxies, backup, etc.
                     items:
-                      description: A single application container that you want to
-                        run within a pod.
                       required:
                       - name
                       type: object
                       x-kubernetes-preserve-unknown-fields: true
                     type: array
                   disableAutomountServiceAccountToken:
-                    description: |-
-                      DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
-                      Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
-                      For example, vmagent and vm-config-reloader requires k8s API access.
-                      Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
-                      And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
                     type: boolean
                   disableSelfServiceScrape:
-                    description: |-
-                      DisableSelfServiceScrape controls creation of VMServiceScrape by operator
-                      for the application.
-                      Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable
                     type: boolean
                   dnsConfig:
-                    description: |-
-                      Specifies the DNS parameters of a pod.
-                      Parameters specified here will be merged to the generated DNS
-                      configuration based on DNSPolicy.
                     items:
                       x-kubernetes-preserve-unknown-fields: true
                     properties:
                       nameservers:
-                        description: |-
-                          A list of DNS name server IP addresses.
-                          This will be appended to the base nameservers generated from DNSPolicy.
-                          Duplicated nameservers will be removed.
                         items:
                           type: string
                         type: array
                         x-kubernetes-list-type: atomic
                       options:
-                        description: |-
-                          A list of DNS resolver options.
-                          This will be merged with the base options generated from DNSPolicy.
-                          Duplicated entries will be removed. Resolution options given in Options
-                          will override those that appear in the base DNSPolicy.
                         items:
-                          description: PodDNSConfigOption defines DNS resolver options
-                            of a pod.
                           properties:
                             name:
-                              description: |-
-                                Name is this DNS resolver option's name.
-                                Required.
                               type: string
                             value:
-                              description: Value is this DNS resolver option's value.
                               type: string
                           type: object
                         type: array
                         x-kubernetes-list-type: atomic
                       searches:
-                        description: |-
-                          A list of DNS search domains for host-name lookup.
-                          This will be appended to the base search paths generated from DNSPolicy.
-                          Duplicated search paths will be removed.
                         items:
                           type: string
                         type: array
                         x-kubernetes-list-type: atomic
                     type: object
                   dnsPolicy:
-                    description: DNSPolicy sets DNS policy for the pod
                     type: string
                   extraArgs:
                     additionalProperties:
                       type: string
-                    description: |-
-                      ExtraArgs that will be passed to the application container
-                      for example remoteWrite.tmpDataPath: /tmp
                     type: object
                   extraEnvs:
-                    description: ExtraEnvs that will be passed to the application
-                      container
                     items:
-                      description: EnvVar represents an environment variable present
-                        in a Container.
                       properties:
                         name:
-                          description: Name of the environment variable. Must be a
-                            C_IDENTIFIER.
                           type: string
                         value:
-                          description: |-
-                            Variable references $(VAR_NAME) are expanded
-                            using the previously defined environment variables in the container and
-                            any service environment variables. If a variable cannot be resolved,
-                            the reference in the input string will be unchanged. Double $$ are reduced
-                            to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                            "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                            Escaped references will never be expanded, regardless of whether the variable
-                            exists or not.
-                            Defaults to "".
                           type: string
                       required:
                       - name
@@ -19576,169 +15673,438 @@ spec:
                       x-kubernetes-preserve-unknown-fields: true
                     type: array
                   extraEnvsFrom:
-                    description: |-
-                      ExtraEnvsFrom defines source of env variables for the application container
-                      could either be secret or configmap
                     items:
-                      description: EnvFromSource represents the source of a set of
-                        ConfigMaps
                       properties:
                         configMapRef:
-                          description: The ConfigMap to select from
                           properties:
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the ConfigMap must be defined
                               type: boolean
                           type: object
                           x-kubernetes-map-type: atomic
                         prefix:
-                          description: An optional identifier to prepend to each key
-                            in the ConfigMap. Must be a C_IDENTIFIER.
                           type: string
                         secretRef:
-                          description: The Secret to select from
                           properties:
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret must be defined
                               type: boolean
                           type: object
                           x-kubernetes-map-type: atomic
                       type: object
                     type: array
                   host_aliases:
-                    description: |-
-                      HostAliasesUnderScore provides mapping for ip and hostname,
-                      that would be propagated to pod,
-                      cannot be used with HostNetwork.
-                      Has Priority over hostAliases field
                     items:
-                      description: |-
-                        HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                        pod's hosts file.
                       properties:
                         hostnames:
-                          description: Hostnames for the above IP address.
                           items:
                             type: string
                           type: array
                           x-kubernetes-list-type: atomic
                         ip:
-                          description: IP address of the host file entry.
                           type: string
                       required:
                       - ip
                       type: object
                     type: array
                   hostAliases:
-                    description: |-
-                      HostAliases provides mapping for ip and hostname,
-                      that would be propagated to pod,
-                      cannot be used with HostNetwork.
                     items:
-                      description: |-
-                        HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                        pod's hosts file.
                       properties:
                         hostnames:
-                          description: Hostnames for the above IP address.
                           items:
                             type: string
                           type: array
                           x-kubernetes-list-type: atomic
                         ip:
-                          description: IP address of the host file entry.
                           type: string
                       required:
                       - ip
                       type: object
                     type: array
                   hostNetwork:
-                    description: HostNetwork controls whether the pod may use the
-                      node network namespace
                     type: boolean
+                  hpa:
+                    properties:
+                      behaviour:
+                        properties:
+                          scaleDown:
+                            properties:
+                              policies:
+                                items:
+                                  properties:
+                                    periodSeconds:
+                                      format: int32
+                                      type: integer
+                                    type:
+                                      type: string
+                                    value:
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - periodSeconds
+                                  - type
+                                  - value
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              selectPolicy:
+                                type: string
+                              stabilizationWindowSeconds:
+                                format: int32
+                                type: integer
+                              tolerance:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                x-kubernetes-int-or-string: true
+                            type: object
+                          scaleUp:
+                            properties:
+                              policies:
+                                items:
+                                  properties:
+                                    periodSeconds:
+                                      format: int32
+                                      type: integer
+                                    type:
+                                      type: string
+                                    value:
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - periodSeconds
+                                  - type
+                                  - value
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              selectPolicy:
+                                type: string
+                              stabilizationWindowSeconds:
+                                format: int32
+                                type: integer
+                              tolerance:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                x-kubernetes-int-or-string: true
+                            type: object
+                        type: object
+                      maxReplicas:
+                        format: int32
+                        type: integer
+                      metrics:
+                        items:
+                          properties:
+                            containerResource:
+                              properties:
+                                container:
+                                  type: string
+                                name:
+                                  type: string
+                                target:
+                                  properties:
+                                    averageUtilization:
+                                      format: int32
+                                      type: integer
+                                    averageValue:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                    type:
+                                      type: string
+                                    value:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - type
+                                  type: object
+                              required:
+                              - container
+                              - name
+                              - target
+                              type: object
+                            external:
+                              properties:
+                                metric:
+                                  properties:
+                                    name:
+                                      type: string
+                                    selector:
+                                      properties:
+                                        matchExpressions:
+                                          items:
+                                            properties:
+                                              key:
+                                                type: string
+                                              operator:
+                                                type: string
+                                              values:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                  required:
+                                  - name
+                                  type: object
+                                target:
+                                  properties:
+                                    averageUtilization:
+                                      format: int32
+                                      type: integer
+                                    averageValue:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                    type:
+                                      type: string
+                                    value:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - type
+                                  type: object
+                              required:
+                              - metric
+                              - target
+                              type: object
+                            object:
+                              properties:
+                                describedObject:
+                                  properties:
+                                    apiVersion:
+                                      type: string
+                                    kind:
+                                      type: string
+                                    name:
+                                      type: string
+                                  required:
+                                  - kind
+                                  - name
+                                  type: object
+                                metric:
+                                  properties:
+                                    name:
+                                      type: string
+                                    selector:
+                                      properties:
+                                        matchExpressions:
+                                          items:
+                                            properties:
+                                              key:
+                                                type: string
+                                              operator:
+                                                type: string
+                                              values:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                  required:
+                                  - name
+                                  type: object
+                                target:
+                                  properties:
+                                    averageUtilization:
+                                      format: int32
+                                      type: integer
+                                    averageValue:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                    type:
+                                      type: string
+                                    value:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - type
+                                  type: object
+                              required:
+                              - describedObject
+                              - metric
+                              - target
+                              type: object
+                            pods:
+                              properties:
+                                metric:
+                                  properties:
+                                    name:
+                                      type: string
+                                    selector:
+                                      properties:
+                                        matchExpressions:
+                                          items:
+                                            properties:
+                                              key:
+                                                type: string
+                                              operator:
+                                                type: string
+                                              values:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                  required:
+                                  - name
+                                  type: object
+                                target:
+                                  properties:
+                                    averageUtilization:
+                                      format: int32
+                                      type: integer
+                                    averageValue:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                    type:
+                                      type: string
+                                    value:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - type
+                                  type: object
+                              required:
+                              - metric
+                              - target
+                              type: object
+                            resource:
+                              properties:
+                                name:
+                                  type: string
+                                target:
+                                  properties:
+                                    averageUtilization:
+                                      format: int32
+                                      type: integer
+                                    averageValue:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                    type:
+                                      type: string
+                                    value:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - type
+                                  type: object
+                              required:
+                              - name
+                              - target
+                              type: object
+                            type:
+                              type: string
+                          required:
+                          - type
+                          type: object
+                        type: array
+                      minReplicas:
+                        format: int32
+                        type: integer
+                    type: object
                   image:
-                    description: |-
-                      Image - docker image settings
-                      if no specified operator uses default version from operator config
                     properties:
                       pullPolicy:
-                        description: PullPolicy describes how to pull docker image
                         type: string
                       repository:
-                        description: Repository contains name of docker image + it's
-                          repository if needed
                         type: string
                       tag:
-                        description: Tag contains desired docker image version
                         type: string
                     type: object
                   imagePullSecrets:
-                    description: |-
-                      ImagePullSecrets An optional list of references to secrets in the same namespace
-                      to use for pulling images from registries
-                      see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
                     items:
-                      description: |-
-                        LocalObjectReference contains enough information to let you locate the
-                        referenced object inside the same namespace.
                       properties:
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                       type: object
                       x-kubernetes-map-type: atomic
                     type: array
                   initContainers:
-                    description: |-
-                      InitContainers allows adding initContainers to the pod definition.
-                      Any errors during the execution of an initContainer will lead to a restart of the Pod.
-                      More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
                     items:
-                      description: A single application container that you want to
-                        run within a pod.
                       required:
                       - name
                       type: object
                       x-kubernetes-preserve-unknown-fields: true
                     type: array
                   livenessProbe:
-                    description: LivenessProbe that will be added CRD pod
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   logFormat:
-                    description: |-
-                      LogFormat for VMStorage to be configured with.
-                      default or json
                     enum:
                     - default
                     - json
                     type: string
                   logLevel:
-                    description: LogLevel for VMStorage to be configured with.
                     enum:
                     - INFO
                     - WARN
@@ -19747,159 +16113,93 @@ spec:
                     - PANIC
                     type: string
                   maintenanceInsertNodeIDs:
-                    description: |-
-                      MaintenanceInsertNodeIDs - excludes given node ids from insert requests routing, must contain pod suffixes - for pod-0, id will be 0 and etc.
-                      lets say, you have pod-0, pod-1, pod-2, pod-3. to exclude pod-0 and pod-3 from insert routing, define nodeIDs: [0,3].
-                      Useful at storage expanding, when you want to rebalance some data at cluster.
                     items:
                       format: int32
                       type: integer
                     type: array
                   maintenanceSelectNodeIDs:
-                    description: MaintenanceInsertNodeIDs - excludes given node ids
-                      from select requests routing, must contain pod suffixes - for
-                      pod-0, id will be 0 and etc.
                     items:
                       format: int32
                       type: integer
                     type: array
                   minReadySeconds:
-                    description: |-
-                      MinReadySeconds defines a minimum number of seconds to wait before starting update next pod
-                      if previous in healthy state
-                      Has no effect for VLogs and VMSingle
                     format: int32
                     type: integer
                   nodeSelector:
                     additionalProperties:
                       type: string
-                    description: NodeSelector Define which Nodes the Pods are scheduled
-                      on.
                     type: object
                   paused:
-                    description: |-
-                      Paused If set to true all actions on the underlying managed objects are not
-                      going to be performed, except for delete actions.
                     type: boolean
+                  persistentVolumeClaimRetentionPolicy:
+                    properties:
+                      whenDeleted:
+                        type: string
+                      whenScaled:
+                        type: string
+                    type: object
                   podDisruptionBudget:
-                    description: PodDisruptionBudget created by operator
                     properties:
                       maxUnavailable:
                         anyOf:
                         - type: integer
                         - type: string
-                        description: |-
-                          An eviction is allowed if at most "maxUnavailable" pods selected by
-                          "selector" are unavailable after the eviction, i.e. even in absence of
-                          the evicted pod. For example, one can prevent all voluntary evictions
-                          by specifying 0. This is a mutually exclusive setting with "minAvailable".
                         x-kubernetes-int-or-string: true
                       minAvailable:
                         anyOf:
                         - type: integer
                         - type: string
-                        description: |-
-                          An eviction is allowed if at least "minAvailable" pods selected by
-                          "selector" will still be available after the eviction, i.e. even in the
-                          absence of the evicted pod.  So for example you can prevent all voluntary
-                          evictions by specifying "100%".
                         x-kubernetes-int-or-string: true
                       selectorLabels:
                         additionalProperties:
                           type: string
-                        description: |-
-                          replaces default labels selector generated by operator
-                          it's useful when you need to create custom budget
                         type: object
+                      unhealthyPodEvictionPolicy:
+                        enum:
+                        - IfHealthyBudget
+                        - AlwaysAllow
+                        type: string
                     type: object
                   podMetadata:
-                    description: PodMetadata configures Labels and Annotations which
-                      are propagated to the VMStorage pods.
                     properties:
                       annotations:
                         additionalProperties:
                           type: string
-                        description: |-
-                          Annotations is an unstructured key value map stored with a resource that may be
-                          set by external tools to store and retrieve arbitrary metadata. They are not
-                          queryable and should be preserved when modifying objects.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                         type: object
                       labels:
                         additionalProperties:
                           type: string
-                        description: |-
-                          Labels Map of string keys and values that can be used to organize and categorize
-                          (scope and select) objects. May match selectors of replication controllers
-                          and services.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                         type: object
                       name:
-                        description: |-
-                          Name must be unique within a namespace. Is required when creating resources, although
-                          some resources may allow a client to request the generation of an appropriate name
-                          automatically. Name is primarily intended for creation idempotence and configuration
-                          definition.
-                          Cannot be updated.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                         type: string
                     type: object
                   port:
-                    description: Port listen address
                     type: string
                   priorityClassName:
-                    description: PriorityClassName class assigned to the Pods
                     type: string
                   readinessGates:
-                    description: ReadinessGates defines pod readiness gates
                     items:
-                      description: PodReadinessGate contains the reference to a pod
-                        condition
                       properties:
                         conditionType:
-                          description: ConditionType refers to a condition in the
-                            pod's condition list with matching type.
                           type: string
                       required:
                       - conditionType
                       type: object
                     type: array
                   readinessProbe:
-                    description: ReadinessProbe that will be added CRD pod
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   replicaCount:
-                    description: ReplicaCount is the expected size of the Application.
                     format: int32
                     type: integer
                   resources:
-                    description: |-
-                      Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                      if not defined default resources from operator config will be used
                     properties:
                       claims:
-                        description: |-
-                          Claims lists the names of resources, defined in spec.resourceClaims,
-                          that are used by this container.
-
-                          This is an alpha field and requires enabling the
-                          DynamicResourceAllocation feature gate.
-
-                          This field is immutable. It can only be set for containers.
                         items:
-                          description: ResourceClaim references one entry in PodSpec.ResourceClaims.
                           properties:
                             name:
-                              description: |-
-                                Name must match the name of one entry in pod.spec.resourceClaims of
-                                the Pod where this field is used. It makes that resource available
-                                inside a container.
                               type: string
                             request:
-                              description: |-
-                                Request is the name chosen for a request in the referenced claim.
-                                If empty, everything from the claim is made available, otherwise
-                                only the result of this request.
                               type: string
                           required:
                           - name
@@ -19915,9 +16215,6 @@ spec:
                           - type: string
                           pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                           x-kubernetes-int-or-string: true
-                        description: |-
-                          Limits describes the maximum amount of compute resources allowed.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                         type: object
                       requests:
                         additionalProperties:
@@ -19926,207 +16223,103 @@ spec:
                           - type: string
                           pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                           x-kubernetes-int-or-string: true
-                        description: |-
-                          Requests describes the minimum amount of compute resources required.
-                          If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                          otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                         type: object
                     type: object
                   revisionHistoryLimitCount:
-                    description: |-
-                      The number of old ReplicaSets to retain to allow rollback in deployment or
-                      maximum number of revisions that will be maintained in the Deployment revision history.
-                      Has no effect at StatefulSets
-                      Defaults to 10.
                     format: int32
                     type: integer
                   rollingUpdateStrategy:
-                    description: |-
-                      RollingUpdateStrategy defines strategy for application updates
-                      Default is OnDelete, in this case operator handles update process
-                      Can be changed for RollingUpdate
                     type: string
+                  rollingUpdateStrategyBehavior:
+                    properties:
+                      maxUnavailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                    type: object
                   runtimeClassName:
-                    description: |-
-                      RuntimeClassName - defines runtime class for kubernetes pod.
-                      https://kubernetes.io/docs/concepts/containers/runtime-class/
                     type: string
                   schedulerName:
-                    description: SchedulerName - defines kubernetes scheduler name
                     type: string
                   secrets:
-                    description: |-
-                      Secrets is a list of Secrets in the same namespace as the Application
-                      object, which shall be mounted into the Application container
-                      at /etc/vm/secrets/SECRET_NAME folder
                     items:
                       type: string
                     type: array
                   securityContext:
-                    description: |-
-                      SecurityContext holds pod-level security attributes and common container settings.
-                      This defaults to the default PodSecurityContext.
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   serviceScrapeSpec:
-                    description: ServiceScrapeSpec that will be added to vmstorage
-                      VMServiceScrape spec
                     required:
                     - endpoints
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   serviceSpec:
-                    description: ServiceSpec that will be create additional service
-                      for vmstorage
                     properties:
                       metadata:
-                        description: EmbeddedObjectMetadata defines objectMeta for
-                          additional service.
                         properties:
                           annotations:
                             additionalProperties:
                               type: string
-                            description: |-
-                              Annotations is an unstructured key value map stored with a resource that may be
-                              set by external tools to store and retrieve arbitrary metadata. They are not
-                              queryable and should be preserved when modifying objects.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                             type: object
                           labels:
                             additionalProperties:
                               type: string
-                            description: |-
-                              Labels Map of string keys and values that can be used to organize and categorize
-                              (scope and select) objects. May match selectors of replication controllers
-                              and services.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                             type: object
                           name:
-                            description: |-
-                              Name must be unique within a namespace. Is required when creating resources, although
-                              some resources may allow a client to request the generation of an appropriate name
-                              automatically. Name is primarily intended for creation idempotence and configuration
-                              definition.
-                              Cannot be updated.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                             type: string
                         type: object
                       spec:
-                        description: |-
-                          ServiceSpec describes the attributes that a user creates on a service.
-                          More info: https://kubernetes.io/docs/concepts/services-networking/service/
                         type: object
                         x-kubernetes-preserve-unknown-fields: true
                       useAsDefault:
-                        description: |-
-                          UseAsDefault applies changes from given service definition to the main object Service
-                          Changing from headless service to clusterIP or loadbalancer may break cross-component communication
                         type: boolean
                     required:
                     - spec
                     type: object
                   startupProbe:
-                    description: StartupProbe that will be added to CRD pod
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   storage:
-                    description: |-
-                      Storage - add persistent volume for StorageDataPath
-                      its useful for persistent cache
                     properties:
-                      disableMountSubPath:
-                        description: |-
-                          Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary.
-                          DisableMountSubPath allows to remove any subPath usage in volume mounts.
-                        type: boolean
                       emptyDir:
-                        description: |-
-                          EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More
-                          info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir
                         properties:
                           medium:
-                            description: |-
-                              medium represents what type of storage medium should back this directory.
-                              The default is "" which means to use the node's default medium.
-                              Must be an empty string (default) or Memory.
-                              More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
                             type: string
                           sizeLimit:
                             anyOf:
                             - type: integer
                             - type: string
-                            description: |-
-                              sizeLimit is the total amount of local storage required for this EmptyDir volume.
-                              The size limit is also applicable for memory medium.
-                              The maximum usage on memory medium EmptyDir would be the minimum value between
-                              the SizeLimit specified here and the sum of memory limits of all containers in a pod.
-                              The default is nil which means that the limit is undefined.
-                              More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
                             pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                             x-kubernetes-int-or-string: true
                         type: object
                       volumeClaimTemplate:
-                        description: A PVC spec to be used by the VMAlertManager StatefulSets.
                         type: object
                         x-kubernetes-preserve-unknown-fields: true
                     type: object
                   storageDataPath:
-                    description: StorageDataPath - path to storage data
                     type: string
                   terminationGracePeriodSeconds:
-                    description: TerminationGracePeriodSeconds period for container
-                      graceful termination
                     format: int64
                     type: integer
                   tolerations:
-                    description: Tolerations If specified, the pod's tolerations.
                     items:
-                      description: |-
-                        The pod this Toleration is attached to tolerates any taint that matches
-                        the triple <key,value,effect> using the matching operator <operator>.
                       properties:
                         effect:
-                          description: |-
-                            Effect indicates the taint effect to match. Empty means match all taint effects.
-                            When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                           type: string
                         key:
-                          description: |-
-                            Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                            If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                           type: string
                         operator:
-                          description: |-
-                            Operator represents a key's relationship to the value.
-                            Valid operators are Exists and Equal. Defaults to Equal.
-                            Exists is equivalent to wildcard for value, so that a pod can
-                            tolerate all taints of a particular category.
                           type: string
                         tolerationSeconds:
-                          description: |-
-                            TolerationSeconds represents the period of time the toleration (which must be
-                            of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                            it is not set, which means tolerate the taint forever (do not evict). Zero and
-                            negative values will be treated as 0 (evict immediately) by the system.
                           format: int64
                           type: integer
                         value:
-                          description: |-
-                            Value is the taint value the toleration matches to.
-                            If the operator is Exists, the value should be empty, otherwise just a regular string.
                           type: string
                       type: object
                     type: array
                   topologySpreadConstraints:
-                    description: |-
-                      TopologySpreadConstraints embedded kubernetes pod configuration option,
-                      controls how pods are spread across your cluster among failure-domains
-                      such as regions, zones, nodes, and other user-defined topology domains
-                      https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
                     items:
-                      description: TopologySpreadConstraint specifies how to spread
-                        matching pods among the given topology.
                       required:
                       - maxSkew
                       - topologyKey
@@ -20135,197 +16328,120 @@ spec:
                       x-kubernetes-preserve-unknown-fields: true
                     type: array
                   useDefaultResources:
-                    description: |-
-                      UseDefaultResources controls resource settings
-                      By default, operator sets built-in resource requirements
                     type: boolean
                   useStrictSecurity:
-                    description: |-
-                      UseStrictSecurity enables strict security mode for component
-                      it restricts disk writes access
-                      uses non-root user out of the box
-                      drops not needed security permissions
                     type: boolean
                   vmBackup:
-                    description: VMBackup configuration for backup
                     properties:
                       acceptEULA:
-                        description: |-
-                          AcceptEULA accepts enterprise feature usage, must be set to true.
-                          otherwise backupmanager cannot be added to single/cluster version.
-                          https://victoriametrics.com/legal/esa/
                         type: boolean
                       concurrency:
-                        description: Defines number of concurrent workers. Higher
-                          concurrency may reduce backup duration (default 10)
                         format: int32
                         type: integer
                       credentialsSecret:
-                        description: |-
-                          CredentialsSecret is secret in the same namespace for access to remote storage
-                          The secret is mounted into /etc/vm/creds.
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       customS3Endpoint:
-                        description: Custom S3 endpoint for use with S3-compatible
-                          storages (e.g. MinIO). S3 is used if not set
                         type: string
                       destination:
-                        description: Defines destination for backup
                         type: string
                       destinationDisableSuffixAdd:
-                        description: |-
-                          DestinationDisableSuffixAdd - disables suffix adding for cluster version backups
-                          each vmstorage backup must have unique backup folder
-                          so operator adds POD_NAME as suffix for backup destination folder.
                         type: boolean
                       disableDaily:
-                        description: Defines if daily backups disabled (default false)
                         type: boolean
                       disableHourly:
-                        description: Defines if hourly backups disabled (default false)
                         type: boolean
                       disableMonthly:
-                        description: Defines if monthly backups disabled (default
-                          false)
                         type: boolean
                       disableWeekly:
-                        description: Defines if weekly backups disabled (default false)
                         type: boolean
                       extraArgs:
                         additionalProperties:
                           type: string
-                        description: extra args like maxBytesPerSecond default 0
                         type: object
                       extraEnvs:
                         items:
-                          description: EnvVar represents an environment variable present
-                            in a Container.
                           properties:
                             name:
-                              description: Name of the environment variable. Must
-                                be a C_IDENTIFIER.
                               type: string
                             value:
-                              description: |-
-                                Variable references $(VAR_NAME) are expanded
-                                using the previously defined environment variables in the container and
-                                any service environment variables. If a variable cannot be resolved,
-                                the reference in the input string will be unchanged. Double $$ are reduced
-                                to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                                "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                                Escaped references will never be expanded, regardless of whether the variable
-                                exists or not.
-                                Defaults to "".
                               type: string
                             valueFrom:
-                              description: Source for the environment variable's value.
-                                Cannot be used if value is not empty.
                               properties:
                                 configMapKeyRef:
-                                  description: Selects a key of a ConfigMap.
                                   properties:
                                     key:
-                                      description: The key to select.
                                       type: string
                                     name:
                                       default: ""
-                                      description: |-
-                                        Name of the referent.
-                                        This field is effectively required, but due to backwards compatibility is
-                                        allowed to be empty. Instances of this type with an empty value here are
-                                        almost certainly wrong.
-                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                       type: string
                                     optional:
-                                      description: Specify whether the ConfigMap or
-                                        its key must be defined
                                       type: boolean
                                   required:
                                   - key
                                   type: object
                                   x-kubernetes-map-type: atomic
                                 fieldRef:
-                                  description: |-
-                                    Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
-                                    spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
                                   properties:
                                     apiVersion:
-                                      description: Version of the schema the FieldPath
-                                        is written in terms of, defaults to "v1".
                                       type: string
                                     fieldPath:
-                                      description: Path of the field to select in
-                                        the specified API version.
                                       type: string
                                   required:
                                   - fieldPath
                                   type: object
                                   x-kubernetes-map-type: atomic
+                                fileKeyRef:
+                                  properties:
+                                    key:
+                                      type: string
+                                    optional:
+                                      default: false
+                                      type: boolean
+                                    path:
+                                      type: string
+                                    volumeName:
+                                      type: string
+                                  required:
+                                  - key
+                                  - path
+                                  - volumeName
+                                  type: object
+                                  x-kubernetes-map-type: atomic
                                 resourceFieldRef:
-                                  description: |-
-                                    Selects a resource of the container: only resources limits and requests
-                                    (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
                                   properties:
                                     containerName:
-                                      description: 'Container name: required for volumes,
-                                        optional for env vars'
                                       type: string
                                     divisor:
                                       anyOf:
                                       - type: integer
                                       - type: string
-                                      description: Specifies the output format of
-                                        the exposed resources, defaults to "1"
                                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                       x-kubernetes-int-or-string: true
                                     resource:
-                                      description: 'Required: resource to select'
                                       type: string
                                   required:
                                   - resource
                                   type: object
                                   x-kubernetes-map-type: atomic
                                 secretKeyRef:
-                                  description: Selects a key of a secret in the pod's
-                                    namespace
                                   properties:
                                     key:
-                                      description: The key of the secret to select
-                                        from.  Must be a valid secret key.
                                       type: string
                                     name:
                                       default: ""
-                                      description: |-
-                                        Name of the referent.
-                                        This field is effectively required, but due to backwards compatibility is
-                                        allowed to be empty. Instances of this type with an empty value here are
-                                        almost certainly wrong.
-                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                       type: string
                                     optional:
-                                      description: Specify whether the Secret or its
-                                        key must be defined
                                       type: boolean
                                   required:
                                   - key
@@ -20337,79 +16453,45 @@ spec:
                           type: object
                         type: array
                       extraEnvsFrom:
-                        description: |-
-                          ExtraEnvsFrom defines source of env variables for the application container
-                          could either be secret or configmap
                         items:
-                          description: EnvFromSource represents the source of a set
-                            of ConfigMaps
                           properties:
                             configMapRef:
-                              description: The ConfigMap to select from
                               properties:
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap must
-                                    be defined
                                   type: boolean
                               type: object
                               x-kubernetes-map-type: atomic
                             prefix:
-                              description: An optional identifier to prepend to each
-                                key in the ConfigMap. Must be a C_IDENTIFIER.
                               type: string
                             secretRef:
-                              description: The Secret to select from
                               properties:
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret must be
-                                    defined
                                   type: boolean
                               type: object
                               x-kubernetes-map-type: atomic
                           type: object
                         type: array
                       image:
-                        description: Image - docker image settings for VMBackuper
                         properties:
                           pullPolicy:
-                            description: PullPolicy describes how to pull docker image
                             type: string
                           repository:
-                            description: Repository contains name of docker image
-                              + it's repository if needed
                             type: string
                           tag:
-                            description: Tag contains desired docker image version
                             type: string
                         type: object
                       logFormat:
-                        description: |-
-                          LogFormat for VMBackup to be configured with.
-                          default or json
                         enum:
                         - default
                         - json
                         type: string
                       logLevel:
-                        description: LogLevel for VMBackup to be configured with.
                         enum:
                         - INFO
                         - WARN
@@ -20418,36 +16500,15 @@ spec:
                         - PANIC
                         type: string
                       port:
-                        description: Port for health check connections
                         type: string
                       resources:
-                        description: |-
-                          Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                          if not defined default resources from operator config will be used
                         properties:
                           claims:
-                            description: |-
-                              Claims lists the names of resources, defined in spec.resourceClaims,
-                              that are used by this container.
-
-                              This is an alpha field and requires enabling the
-                              DynamicResourceAllocation feature gate.
-
-                              This field is immutable. It can only be set for containers.
                             items:
-                              description: ResourceClaim references one entry in PodSpec.ResourceClaims.
                               properties:
                                 name:
-                                  description: |-
-                                    Name must match the name of one entry in pod.spec.resourceClaims of
-                                    the Pod where this field is used. It makes that resource available
-                                    inside a container.
                                   type: string
                                 request:
-                                  description: |-
-                                    Request is the name chosen for a request in the referenced claim.
-                                    If empty, everything from the claim is made available, otherwise
-                                    only the result of this request.
                                   type: string
                               required:
                               - name
@@ -20463,9 +16524,6 @@ spec:
                               - type: string
                               pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                               x-kubernetes-int-or-string: true
-                            description: |-
-                              Limits describes the maximum amount of compute resources allowed.
-                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                             type: object
                           requests:
                             additionalProperties:
@@ -20474,96 +16532,36 @@ spec:
                               - type: string
                               pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                               x-kubernetes-int-or-string: true
-                            description: |-
-                              Requests describes the minimum amount of compute resources required.
-                              If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                              otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                             type: object
                         type: object
                       restore:
-                        description: |-
-                          Restore Allows to enable restore options for pod
-                          Read [more](https://docs.victoriametrics.com/vmbackupmanager#restore-commands)
                         properties:
                           onStart:
-                            description: OnStart defines configuration for restore
-                              on pod start
                             properties:
                               enabled:
-                                description: Enabled defines if restore on start enabled
                                 type: boolean
                             type: object
                         type: object
                       snapshotCreateURL:
-                        description: SnapshotCreateURL overwrites url for snapshot
-                          create
                         type: string
                       snapshotDeleteURL:
-                        description: SnapShotDeleteURL overwrites url for snapshot
-                          delete
                         type: string
                       volumeMounts:
-                        description: |-
-                          VolumeMounts allows configuration of additional VolumeMounts on the output Deployment definition.
-                          VolumeMounts specified will be appended to other VolumeMounts in the vmbackupmanager container,
-                          that are generated as a result of StorageSpec objects.
                         items:
-                          description: VolumeMount describes a mounting of a Volume
-                            within a container.
                           properties:
                             mountPath:
-                              description: |-
-                                Path within the container at which the volume should be mounted.  Must
-                                not contain ':'.
                               type: string
                             mountPropagation:
-                              description: |-
-                                mountPropagation determines how mounts are propagated from the host
-                                to container and the other way around.
-                                When not set, MountPropagationNone is used.
-                                This field is beta in 1.10.
-                                When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                                (which defaults to None).
                               type: string
                             name:
-                              description: This must match the Name of a Volume.
                               type: string
                             readOnly:
-                              description: |-
-                                Mounted read-only if true, read-write otherwise (false or unspecified).
-                                Defaults to false.
                               type: boolean
                             recursiveReadOnly:
-                              description: |-
-                                RecursiveReadOnly specifies whether read-only mounts should be handled
-                                recursively.
-
-                                If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                                If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                                recursively read-only.  If this field is set to IfPossible, the mount is made
-                                recursively read-only, if it is supported by the container runtime.  If this
-                                field is set to Enabled, the mount is made recursively read-only if it is
-                                supported by the container runtime, otherwise the pod will not be started and
-                                an error will be generated to indicate the reason.
-
-                                If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                                None (or be unspecified, which defaults to None).
-
-                                If this field is not specified, it is treated as an equivalent of Disabled.
                               type: string
                             subPath:
-                              description: |-
-                                Path within the volume from which the container's volume should be mounted.
-                                Defaults to "" (volume's root).
                               type: string
                             subPathExpr:
-                              description: |-
-                                Expanded path within the volume from which the container's volume should be mounted.
-                                Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                                Defaults to "" (volume's root).
-                                SubPathExpr and SubPath are mutually exclusive.
                               type: string
                           required:
                           - mountPath
@@ -20572,71 +16570,25 @@ spec:
                         type: array
                     type: object
                   vmInsertPort:
-                    description: VMInsertPort for VMInsert connections
                     type: string
                   vmSelectPort:
-                    description: VMSelectPort for VMSelect connections
                     type: string
                   volumeMounts:
-                    description: |-
-                      VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
-                      VolumeMounts specified will be appended to other VolumeMounts in the Application container
                     items:
-                      description: VolumeMount describes a mounting of a Volume within
-                        a container.
                       properties:
                         mountPath:
-                          description: |-
-                            Path within the container at which the volume should be mounted.  Must
-                            not contain ':'.
                           type: string
                         mountPropagation:
-                          description: |-
-                            mountPropagation determines how mounts are propagated from the host
-                            to container and the other way around.
-                            When not set, MountPropagationNone is used.
-                            This field is beta in 1.10.
-                            When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                            (which defaults to None).
                           type: string
                         name:
-                          description: This must match the Name of a Volume.
                           type: string
                         readOnly:
-                          description: |-
-                            Mounted read-only if true, read-write otherwise (false or unspecified).
-                            Defaults to false.
                           type: boolean
                         recursiveReadOnly:
-                          description: |-
-                            RecursiveReadOnly specifies whether read-only mounts should be handled
-                            recursively.
-
-                            If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                            If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                            recursively read-only.  If this field is set to IfPossible, the mount is made
-                            recursively read-only, if it is supported by the container runtime.  If this
-                            field is set to Enabled, the mount is made recursively read-only if it is
-                            supported by the container runtime, otherwise the pod will not be started and
-                            an error will be generated to indicate the reason.
-
-                            If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                            None (or be unspecified, which defaults to None).
-
-                            If this field is not specified, it is treated as an equivalent of Disabled.
                           type: string
                         subPath:
-                          description: |-
-                            Path within the volume from which the container's volume should be mounted.
-                            Defaults to "" (volume's root).
                           type: string
                         subPathExpr:
-                          description: |-
-                            Expanded path within the volume from which the container's volume should be mounted.
-                            Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                            Defaults to "" (volume's root).
-                            SubPathExpr and SubPath are mutually exclusive.
                           type: string
                       required:
                       - mountPath
@@ -20644,79 +16596,126 @@ spec:
                       type: object
                     type: array
                   volumes:
-                    description: |-
-                      Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
-                      Volumes specified will be appended to other volumes that are generated.
-                      / +optional
                     items:
-                      description: Volume represents a named volume in a pod that
-                        may be accessed by any container in the pod.
                       required:
                       - name
                       type: object
                       x-kubernetes-preserve-unknown-fields: true
                     type: array
+                  vpa:
+                    properties:
+                      recommenders:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                      resourcePolicy:
+                        properties:
+                          containerPolicies:
+                            items:
+                              properties:
+                                containerName:
+                                  type: string
+                                controlledResources:
+                                  items:
+                                    type: string
+                                  type: array
+                                controlledValues:
+                                  enum:
+                                  - RequestsAndLimits
+                                  - RequestsOnly
+                                  type: string
+                                maxAllowed:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                minAllowed:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                mode:
+                                  enum:
+                                  - Auto
+                                  - "Off"
+                                  type: string
+                              type: object
+                            type: array
+                        type: object
+                      updatePolicy:
+                        properties:
+                          evictionRequirements:
+                            items:
+                              properties:
+                                changeRequirement:
+                                  enum:
+                                  - TargetHigherThanRequests
+                                  - TargetLowerThanRequests
+                                  type: string
+                                resources:
+                                  items:
+                                    type: string
+                                  type: array
+                              required:
+                              - changeRequirement
+                              - resources
+                              type: object
+                            type: array
+                          minReplicas:
+                            format: int32
+                            type: integer
+                          updateMode:
+                            enum:
+                            - "Off"
+                            - Initial
+                            - Recreate
+                            - InPlaceOrRecreate
+                            - Auto
+                            type: string
+                        type: object
+                    type: object
                 type: object
-            required:
-            - retentionPeriod
             type: object
           status:
-            description: VMClusterStatus defines the observed state of VMCluster
             properties:
-              clusterStatus:
-                description: LegacyStatus is deprecated and will be removed at v0.52.0
-                  version
-                type: string
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -20731,16 +16730,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         required:
@@ -20755,7 +16749,13055 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: vmdistributed.operator.victoriametrics.com
+spec:
+  group: operator.victoriametrics.com
+  names:
+    kind: VMDistributed
+    listKind: VMDistributedList
+    plural: vmdistributed
+    singular: vmdistributed
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: current status of update rollout
+      jsonPath: .status.updateStatus
+      name: Status
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            type: string
+          kind:
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              license:
+                properties:
+                  forceOffline:
+                    type: boolean
+                  key:
+                    type: string
+                  keyRef:
+                    properties:
+                      key:
+                        type: string
+                      name:
+                        default: ""
+                        type: string
+                      optional:
+                        type: boolean
+                    required:
+                    - key
+                    type: object
+                    x-kubernetes-map-type: atomic
+                  reloadInterval:
+                    type: string
+                type: object
+              paused:
+                type: boolean
+              retain:
+                type: boolean
+              vmauth:
+                properties:
+                  name:
+                    type: string
+                  spec:
+                    properties:
+                      affinity:
+                        properties:
+                          nodeAffinity:
+                            properties:
+                              preferredDuringSchedulingIgnoredDuringExecution:
+                                items:
+                                  properties:
+                                    preference:
+                                      properties:
+                                        matchExpressions:
+                                          items:
+                                            properties:
+                                              key:
+                                                type: string
+                                              operator:
+                                                type: string
+                                              values:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchFields:
+                                          items:
+                                            properties:
+                                              key:
+                                                type: string
+                                              operator:
+                                                type: string
+                                              values:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    weight:
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - preference
+                                  - weight
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              requiredDuringSchedulingIgnoredDuringExecution:
+                                properties:
+                                  nodeSelectorTerms:
+                                    items:
+                                      properties:
+                                        matchExpressions:
+                                          items:
+                                            properties:
+                                              key:
+                                                type: string
+                                              operator:
+                                                type: string
+                                              values:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchFields:
+                                          items:
+                                            properties:
+                                              key:
+                                                type: string
+                                              operator:
+                                                type: string
+                                              values:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - nodeSelectorTerms
+                                type: object
+                                x-kubernetes-map-type: atomic
+                            type: object
+                          podAffinity:
+                            properties:
+                              preferredDuringSchedulingIgnoredDuringExecution:
+                                items:
+                                  properties:
+                                    podAffinityTerm:
+                                      properties:
+                                        labelSelector:
+                                          properties:
+                                            matchExpressions:
+                                              items:
+                                                properties:
+                                                  key:
+                                                    type: string
+                                                  operator:
+                                                    type: string
+                                                  values:
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        matchLabelKeys:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        mismatchLabelKeys:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        namespaceSelector:
+                                          properties:
+                                            matchExpressions:
+                                              items:
+                                                properties:
+                                                  key:
+                                                    type: string
+                                                  operator:
+                                                    type: string
+                                                  values:
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        namespaces:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        topologyKey:
+                                          type: string
+                                      required:
+                                      - topologyKey
+                                      type: object
+                                    weight:
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - podAffinityTerm
+                                  - weight
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              requiredDuringSchedulingIgnoredDuringExecution:
+                                items:
+                                  properties:
+                                    labelSelector:
+                                      properties:
+                                        matchExpressions:
+                                          items:
+                                            properties:
+                                              key:
+                                                type: string
+                                              operator:
+                                                type: string
+                                              values:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    matchLabelKeys:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mismatchLabelKeys:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    namespaceSelector:
+                                      properties:
+                                        matchExpressions:
+                                          items:
+                                            properties:
+                                              key:
+                                                type: string
+                                              operator:
+                                                type: string
+                                              values:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    namespaces:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    topologyKey:
+                                      type: string
+                                  required:
+                                  - topologyKey
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                            type: object
+                          podAntiAffinity:
+                            properties:
+                              preferredDuringSchedulingIgnoredDuringExecution:
+                                items:
+                                  properties:
+                                    podAffinityTerm:
+                                      properties:
+                                        labelSelector:
+                                          properties:
+                                            matchExpressions:
+                                              items:
+                                                properties:
+                                                  key:
+                                                    type: string
+                                                  operator:
+                                                    type: string
+                                                  values:
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        matchLabelKeys:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        mismatchLabelKeys:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        namespaceSelector:
+                                          properties:
+                                            matchExpressions:
+                                              items:
+                                                properties:
+                                                  key:
+                                                    type: string
+                                                  operator:
+                                                    type: string
+                                                  values:
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        namespaces:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        topologyKey:
+                                          type: string
+                                      required:
+                                      - topologyKey
+                                      type: object
+                                    weight:
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - podAffinityTerm
+                                  - weight
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              requiredDuringSchedulingIgnoredDuringExecution:
+                                items:
+                                  properties:
+                                    labelSelector:
+                                      properties:
+                                        matchExpressions:
+                                          items:
+                                            properties:
+                                              key:
+                                                type: string
+                                              operator:
+                                                type: string
+                                              values:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    matchLabelKeys:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mismatchLabelKeys:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    namespaceSelector:
+                                      properties:
+                                        matchExpressions:
+                                          items:
+                                            properties:
+                                              key:
+                                                type: string
+                                              operator:
+                                                type: string
+                                              values:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    namespaces:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    topologyKey:
+                                      type: string
+                                  required:
+                                  - topologyKey
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                            type: object
+                        type: object
+                      configMaps:
+                        items:
+                          type: string
+                        type: array
+                      configReloadAuthKeySecret:
+                        properties:
+                          key:
+                            type: string
+                          name:
+                            default: ""
+                            type: string
+                          optional:
+                            type: boolean
+                        required:
+                        - key
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      configReloaderExtraArgs:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      configReloaderImage:
+                        type: string
+                      configReloaderImageTag:
+                        type: string
+                      configReloaderResources:
+                        properties:
+                          claims:
+                            items:
+                              properties:
+                                name:
+                                  type: string
+                                request:
+                                  type: string
+                              required:
+                              - name
+                              type: object
+                            type: array
+                            x-kubernetes-list-map-keys:
+                            - name
+                            x-kubernetes-list-type: map
+                          limits:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            type: object
+                          requests:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            type: object
+                        type: object
+                      configSecret:
+                        type: string
+                      containers:
+                        items:
+                          properties:
+                            args:
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            command:
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            env:
+                              items:
+                                properties:
+                                  name:
+                                    type: string
+                                  value:
+                                    type: string
+                                  valueFrom:
+                                    properties:
+                                      configMapKeyRef:
+                                        properties:
+                                          key:
+                                            type: string
+                                          name:
+                                            default: ""
+                                            type: string
+                                          optional:
+                                            type: boolean
+                                        required:
+                                        - key
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      fieldRef:
+                                        properties:
+                                          apiVersion:
+                                            type: string
+                                          fieldPath:
+                                            type: string
+                                        required:
+                                        - fieldPath
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        properties:
+                                          key:
+                                            type: string
+                                          optional:
+                                            default: false
+                                            type: boolean
+                                          path:
+                                            type: string
+                                          volumeName:
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      resourceFieldRef:
+                                        properties:
+                                          containerName:
+                                            type: string
+                                          divisor:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                            x-kubernetes-int-or-string: true
+                                          resource:
+                                            type: string
+                                        required:
+                                        - resource
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      secretKeyRef:
+                                        properties:
+                                          key:
+                                            type: string
+                                          name:
+                                            default: ""
+                                            type: string
+                                          optional:
+                                            type: boolean
+                                        required:
+                                        - key
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                    type: object
+                                required:
+                                - name
+                                type: object
+                              type: array
+                              x-kubernetes-list-map-keys:
+                              - name
+                              x-kubernetes-list-type: map
+                            envFrom:
+                              items:
+                                properties:
+                                  configMapRef:
+                                    properties:
+                                      name:
+                                        default: ""
+                                        type: string
+                                      optional:
+                                        type: boolean
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                  prefix:
+                                    type: string
+                                  secretRef:
+                                    properties:
+                                      name:
+                                        default: ""
+                                        type: string
+                                      optional:
+                                        type: boolean
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            image:
+                              type: string
+                            imagePullPolicy:
+                              type: string
+                            lifecycle:
+                              properties:
+                                postStart:
+                                  properties:
+                                    exec:
+                                      properties:
+                                        command:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                    httpGet:
+                                      properties:
+                                        host:
+                                          type: string
+                                        httpHeaders:
+                                          items:
+                                            properties:
+                                              name:
+                                                type: string
+                                              value:
+                                                type: string
+                                            required:
+                                            - name
+                                            - value
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        path:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                        scheme:
+                                          type: string
+                                      required:
+                                      - port
+                                      type: object
+                                    sleep:
+                                      properties:
+                                        seconds:
+                                          format: int64
+                                          type: integer
+                                      required:
+                                      - seconds
+                                      type: object
+                                    tcpSocket:
+                                      properties:
+                                        host:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                      required:
+                                      - port
+                                      type: object
+                                  type: object
+                                preStop:
+                                  properties:
+                                    exec:
+                                      properties:
+                                        command:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                    httpGet:
+                                      properties:
+                                        host:
+                                          type: string
+                                        httpHeaders:
+                                          items:
+                                            properties:
+                                              name:
+                                                type: string
+                                              value:
+                                                type: string
+                                            required:
+                                            - name
+                                            - value
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        path:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                        scheme:
+                                          type: string
+                                      required:
+                                      - port
+                                      type: object
+                                    sleep:
+                                      properties:
+                                        seconds:
+                                          format: int64
+                                          type: integer
+                                      required:
+                                      - seconds
+                                      type: object
+                                    tcpSocket:
+                                      properties:
+                                        host:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                      required:
+                                      - port
+                                      type: object
+                                  type: object
+                                stopSignal:
+                                  type: string
+                              type: object
+                            livenessProbe:
+                              properties:
+                                exec:
+                                  properties:
+                                    command:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                failureThreshold:
+                                  format: int32
+                                  type: integer
+                                grpc:
+                                  properties:
+                                    port:
+                                      format: int32
+                                      type: integer
+                                    service:
+                                      default: ""
+                                      type: string
+                                  required:
+                                  - port
+                                  type: object
+                                httpGet:
+                                  properties:
+                                    host:
+                                      type: string
+                                    httpHeaders:
+                                      items:
+                                        properties:
+                                          name:
+                                            type: string
+                                          value:
+                                            type: string
+                                        required:
+                                        - name
+                                        - value
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    path:
+                                      type: string
+                                    port:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      x-kubernetes-int-or-string: true
+                                    scheme:
+                                      type: string
+                                  required:
+                                  - port
+                                  type: object
+                                initialDelaySeconds:
+                                  format: int32
+                                  type: integer
+                                periodSeconds:
+                                  format: int32
+                                  type: integer
+                                successThreshold:
+                                  format: int32
+                                  type: integer
+                                tcpSocket:
+                                  properties:
+                                    host:
+                                      type: string
+                                    port:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - port
+                                  type: object
+                                terminationGracePeriodSeconds:
+                                  format: int64
+                                  type: integer
+                                timeoutSeconds:
+                                  format: int32
+                                  type: integer
+                              type: object
+                            name:
+                              type: string
+                            ports:
+                              items:
+                                properties:
+                                  containerPort:
+                                    format: int32
+                                    type: integer
+                                  hostIP:
+                                    type: string
+                                  hostPort:
+                                    format: int32
+                                    type: integer
+                                  name:
+                                    type: string
+                                  protocol:
+                                    default: TCP
+                                    type: string
+                                required:
+                                - containerPort
+                                type: object
+                              type: array
+                              x-kubernetes-list-map-keys:
+                              - containerPort
+                              - protocol
+                              x-kubernetes-list-type: map
+                            readinessProbe:
+                              properties:
+                                exec:
+                                  properties:
+                                    command:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                failureThreshold:
+                                  format: int32
+                                  type: integer
+                                grpc:
+                                  properties:
+                                    port:
+                                      format: int32
+                                      type: integer
+                                    service:
+                                      default: ""
+                                      type: string
+                                  required:
+                                  - port
+                                  type: object
+                                httpGet:
+                                  properties:
+                                    host:
+                                      type: string
+                                    httpHeaders:
+                                      items:
+                                        properties:
+                                          name:
+                                            type: string
+                                          value:
+                                            type: string
+                                        required:
+                                        - name
+                                        - value
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    path:
+                                      type: string
+                                    port:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      x-kubernetes-int-or-string: true
+                                    scheme:
+                                      type: string
+                                  required:
+                                  - port
+                                  type: object
+                                initialDelaySeconds:
+                                  format: int32
+                                  type: integer
+                                periodSeconds:
+                                  format: int32
+                                  type: integer
+                                successThreshold:
+                                  format: int32
+                                  type: integer
+                                tcpSocket:
+                                  properties:
+                                    host:
+                                      type: string
+                                    port:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - port
+                                  type: object
+                                terminationGracePeriodSeconds:
+                                  format: int64
+                                  type: integer
+                                timeoutSeconds:
+                                  format: int32
+                                  type: integer
+                              type: object
+                            resizePolicy:
+                              items:
+                                properties:
+                                  resourceName:
+                                    type: string
+                                  restartPolicy:
+                                    type: string
+                                required:
+                                - resourceName
+                                - restartPolicy
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            resources:
+                              properties:
+                                claims:
+                                  items:
+                                    properties:
+                                      name:
+                                        type: string
+                                      request:
+                                        type: string
+                                    required:
+                                    - name
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-map-keys:
+                                  - name
+                                  x-kubernetes-list-type: map
+                                limits:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                requests:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                              type: object
+                            restartPolicy:
+                              type: string
+                            restartPolicyRules:
+                              items:
+                                properties:
+                                  action:
+                                    type: string
+                                  exitCodes:
+                                    properties:
+                                      operator:
+                                        type: string
+                                      values:
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            securityContext:
+                              properties:
+                                allowPrivilegeEscalation:
+                                  type: boolean
+                                appArmorProfile:
+                                  properties:
+                                    localhostProfile:
+                                      type: string
+                                    type:
+                                      type: string
+                                  required:
+                                  - type
+                                  type: object
+                                capabilities:
+                                  properties:
+                                    add:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    drop:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                privileged:
+                                  type: boolean
+                                procMount:
+                                  type: string
+                                readOnlyRootFilesystem:
+                                  type: boolean
+                                runAsGroup:
+                                  format: int64
+                                  type: integer
+                                runAsNonRoot:
+                                  type: boolean
+                                runAsUser:
+                                  format: int64
+                                  type: integer
+                                seLinuxOptions:
+                                  properties:
+                                    level:
+                                      type: string
+                                    role:
+                                      type: string
+                                    type:
+                                      type: string
+                                    user:
+                                      type: string
+                                  type: object
+                                seccompProfile:
+                                  properties:
+                                    localhostProfile:
+                                      type: string
+                                    type:
+                                      type: string
+                                  required:
+                                  - type
+                                  type: object
+                                windowsOptions:
+                                  properties:
+                                    gmsaCredentialSpec:
+                                      type: string
+                                    gmsaCredentialSpecName:
+                                      type: string
+                                    hostProcess:
+                                      type: boolean
+                                    runAsUserName:
+                                      type: string
+                                  type: object
+                              type: object
+                            startupProbe:
+                              properties:
+                                exec:
+                                  properties:
+                                    command:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                failureThreshold:
+                                  format: int32
+                                  type: integer
+                                grpc:
+                                  properties:
+                                    port:
+                                      format: int32
+                                      type: integer
+                                    service:
+                                      default: ""
+                                      type: string
+                                  required:
+                                  - port
+                                  type: object
+                                httpGet:
+                                  properties:
+                                    host:
+                                      type: string
+                                    httpHeaders:
+                                      items:
+                                        properties:
+                                          name:
+                                            type: string
+                                          value:
+                                            type: string
+                                        required:
+                                        - name
+                                        - value
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    path:
+                                      type: string
+                                    port:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      x-kubernetes-int-or-string: true
+                                    scheme:
+                                      type: string
+                                  required:
+                                  - port
+                                  type: object
+                                initialDelaySeconds:
+                                  format: int32
+                                  type: integer
+                                periodSeconds:
+                                  format: int32
+                                  type: integer
+                                successThreshold:
+                                  format: int32
+                                  type: integer
+                                tcpSocket:
+                                  properties:
+                                    host:
+                                      type: string
+                                    port:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - port
+                                  type: object
+                                terminationGracePeriodSeconds:
+                                  format: int64
+                                  type: integer
+                                timeoutSeconds:
+                                  format: int32
+                                  type: integer
+                              type: object
+                            stdin:
+                              type: boolean
+                            stdinOnce:
+                              type: boolean
+                            terminationMessagePath:
+                              type: string
+                            terminationMessagePolicy:
+                              type: string
+                            tty:
+                              type: boolean
+                            volumeDevices:
+                              items:
+                                properties:
+                                  devicePath:
+                                    type: string
+                                  name:
+                                    type: string
+                                required:
+                                - devicePath
+                                - name
+                                type: object
+                              type: array
+                              x-kubernetes-list-map-keys:
+                              - devicePath
+                              x-kubernetes-list-type: map
+                            volumeMounts:
+                              items:
+                                properties:
+                                  mountPath:
+                                    type: string
+                                  mountPropagation:
+                                    type: string
+                                  name:
+                                    type: string
+                                  readOnly:
+                                    type: boolean
+                                  recursiveReadOnly:
+                                    type: string
+                                  subPath:
+                                    type: string
+                                  subPathExpr:
+                                    type: string
+                                required:
+                                - mountPath
+                                - name
+                                type: object
+                              type: array
+                              x-kubernetes-list-map-keys:
+                              - mountPath
+                              x-kubernetes-list-type: map
+                            workingDir:
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                      disableAutomountServiceAccountToken:
+                        type: boolean
+                      disableSelfServiceScrape:
+                        type: boolean
+                      dnsConfig:
+                        properties:
+                          nameservers:
+                            items:
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          options:
+                            items:
+                              properties:
+                                name:
+                                  type: string
+                                value:
+                                  type: string
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          searches:
+                            items:
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: atomic
+                        type: object
+                      dnsPolicy:
+                        type: string
+                      externalConfig:
+                        properties:
+                          localPath:
+                            type: string
+                          secretRef:
+                            properties:
+                              key:
+                                type: string
+                              name:
+                                default: ""
+                                type: string
+                              optional:
+                                type: boolean
+                            required:
+                            - key
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        type: object
+                      extraArgs:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      extraEnvs:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                            value:
+                              type: string
+                            valueFrom:
+                              properties:
+                                configMapKeyRef:
+                                  properties:
+                                    key:
+                                      type: string
+                                    name:
+                                      default: ""
+                                      type: string
+                                    optional:
+                                      type: boolean
+                                  required:
+                                  - key
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                fieldRef:
+                                  properties:
+                                    apiVersion:
+                                      type: string
+                                    fieldPath:
+                                      type: string
+                                  required:
+                                  - fieldPath
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                fileKeyRef:
+                                  properties:
+                                    key:
+                                      type: string
+                                    optional:
+                                      default: false
+                                      type: boolean
+                                    path:
+                                      type: string
+                                    volumeName:
+                                      type: string
+                                  required:
+                                  - key
+                                  - path
+                                  - volumeName
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                resourceFieldRef:
+                                  properties:
+                                    containerName:
+                                      type: string
+                                    divisor:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                    resource:
+                                      type: string
+                                  required:
+                                  - resource
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                secretKeyRef:
+                                  properties:
+                                    key:
+                                      type: string
+                                    name:
+                                      default: ""
+                                      type: string
+                                    optional:
+                                      type: boolean
+                                  required:
+                                  - key
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                              type: object
+                          required:
+                          - name
+                          type: object
+                        type: array
+                      extraEnvsFrom:
+                        items:
+                          properties:
+                            configMapRef:
+                              properties:
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            prefix:
+                              type: string
+                            secretRef:
+                              properties:
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              type: object
+                              x-kubernetes-map-type: atomic
+                          type: object
+                        type: array
+                      host_aliases:
+                        items:
+                          properties:
+                            hostnames:
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            ip:
+                              type: string
+                          required:
+                          - ip
+                          type: object
+                        type: array
+                      hostAliases:
+                        items:
+                          properties:
+                            hostnames:
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            ip:
+                              type: string
+                          required:
+                          - ip
+                          type: object
+                        type: array
+                      hostNetwork:
+                        type: boolean
+                      hpa:
+                        properties:
+                          behaviour:
+                            properties:
+                              scaleDown:
+                                properties:
+                                  policies:
+                                    items:
+                                      properties:
+                                        periodSeconds:
+                                          format: int32
+                                          type: integer
+                                        type:
+                                          type: string
+                                        value:
+                                          format: int32
+                                          type: integer
+                                      required:
+                                      - periodSeconds
+                                      - type
+                                      - value
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  selectPolicy:
+                                    type: string
+                                  stabilizationWindowSeconds:
+                                    format: int32
+                                    type: integer
+                                  tolerance:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                type: object
+                              scaleUp:
+                                properties:
+                                  policies:
+                                    items:
+                                      properties:
+                                        periodSeconds:
+                                          format: int32
+                                          type: integer
+                                        type:
+                                          type: string
+                                        value:
+                                          format: int32
+                                          type: integer
+                                      required:
+                                      - periodSeconds
+                                      - type
+                                      - value
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  selectPolicy:
+                                    type: string
+                                  stabilizationWindowSeconds:
+                                    format: int32
+                                    type: integer
+                                  tolerance:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                type: object
+                            type: object
+                          maxReplicas:
+                            format: int32
+                            type: integer
+                          metrics:
+                            items:
+                              properties:
+                                containerResource:
+                                  properties:
+                                    container:
+                                      type: string
+                                    name:
+                                      type: string
+                                    target:
+                                      properties:
+                                        averageUtilization:
+                                          format: int32
+                                          type: integer
+                                        averageValue:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          x-kubernetes-int-or-string: true
+                                        type:
+                                          type: string
+                                        value:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          x-kubernetes-int-or-string: true
+                                      required:
+                                      - type
+                                      type: object
+                                  required:
+                                  - container
+                                  - name
+                                  - target
+                                  type: object
+                                external:
+                                  properties:
+                                    metric:
+                                      properties:
+                                        name:
+                                          type: string
+                                        selector:
+                                          properties:
+                                            matchExpressions:
+                                              items:
+                                                properties:
+                                                  key:
+                                                    type: string
+                                                  operator:
+                                                    type: string
+                                                  values:
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                      required:
+                                      - name
+                                      type: object
+                                    target:
+                                      properties:
+                                        averageUtilization:
+                                          format: int32
+                                          type: integer
+                                        averageValue:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          x-kubernetes-int-or-string: true
+                                        type:
+                                          type: string
+                                        value:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          x-kubernetes-int-or-string: true
+                                      required:
+                                      - type
+                                      type: object
+                                  required:
+                                  - metric
+                                  - target
+                                  type: object
+                                object:
+                                  properties:
+                                    describedObject:
+                                      properties:
+                                        apiVersion:
+                                          type: string
+                                        kind:
+                                          type: string
+                                        name:
+                                          type: string
+                                      required:
+                                      - kind
+                                      - name
+                                      type: object
+                                    metric:
+                                      properties:
+                                        name:
+                                          type: string
+                                        selector:
+                                          properties:
+                                            matchExpressions:
+                                              items:
+                                                properties:
+                                                  key:
+                                                    type: string
+                                                  operator:
+                                                    type: string
+                                                  values:
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                      required:
+                                      - name
+                                      type: object
+                                    target:
+                                      properties:
+                                        averageUtilization:
+                                          format: int32
+                                          type: integer
+                                        averageValue:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          x-kubernetes-int-or-string: true
+                                        type:
+                                          type: string
+                                        value:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          x-kubernetes-int-or-string: true
+                                      required:
+                                      - type
+                                      type: object
+                                  required:
+                                  - describedObject
+                                  - metric
+                                  - target
+                                  type: object
+                                pods:
+                                  properties:
+                                    metric:
+                                      properties:
+                                        name:
+                                          type: string
+                                        selector:
+                                          properties:
+                                            matchExpressions:
+                                              items:
+                                                properties:
+                                                  key:
+                                                    type: string
+                                                  operator:
+                                                    type: string
+                                                  values:
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                      required:
+                                      - name
+                                      type: object
+                                    target:
+                                      properties:
+                                        averageUtilization:
+                                          format: int32
+                                          type: integer
+                                        averageValue:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          x-kubernetes-int-or-string: true
+                                        type:
+                                          type: string
+                                        value:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          x-kubernetes-int-or-string: true
+                                      required:
+                                      - type
+                                      type: object
+                                  required:
+                                  - metric
+                                  - target
+                                  type: object
+                                resource:
+                                  properties:
+                                    name:
+                                      type: string
+                                    target:
+                                      properties:
+                                        averageUtilization:
+                                          format: int32
+                                          type: integer
+                                        averageValue:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          x-kubernetes-int-or-string: true
+                                        type:
+                                          type: string
+                                        value:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          x-kubernetes-int-or-string: true
+                                      required:
+                                      - type
+                                      type: object
+                                  required:
+                                  - name
+                                  - target
+                                  type: object
+                                type:
+                                  type: string
+                              required:
+                              - type
+                              type: object
+                            type: array
+                          minReplicas:
+                            format: int32
+                            type: integer
+                        type: object
+                      httpRoute:
+                        properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          extraRules:
+                            items:
+                              type: object
+                              x-kubernetes-preserve-unknown-fields: true
+                            type: array
+                            x-kubernetes-preserve-unknown-fields: true
+                          hostnames:
+                            items:
+                              maxLength: 253
+                              minLength: 1
+                              pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            type: array
+                          labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          name:
+                            type: string
+                          parentRefs:
+                            items:
+                              properties:
+                                group:
+                                  default: gateway.networking.k8s.io
+                                  maxLength: 253
+                                  pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                  type: string
+                                kind:
+                                  default: Gateway
+                                  maxLength: 63
+                                  minLength: 1
+                                  pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                  type: string
+                                name:
+                                  maxLength: 253
+                                  minLength: 1
+                                  type: string
+                                namespace:
+                                  maxLength: 63
+                                  minLength: 1
+                                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                  type: string
+                                port:
+                                  format: int32
+                                  maximum: 65535
+                                  minimum: 1
+                                  type: integer
+                                sectionName:
+                                  maxLength: 253
+                                  minLength: 1
+                                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                  type: string
+                              required:
+                              - name
+                              type: object
+                            type: array
+                        type: object
+                      image:
+                        properties:
+                          pullPolicy:
+                            type: string
+                          repository:
+                            type: string
+                          tag:
+                            type: string
+                        type: object
+                      imagePullSecrets:
+                        items:
+                          properties:
+                            name:
+                              default: ""
+                              type: string
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        type: array
+                      ingress:
+                        properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          class_name:
+                            type: string
+                          extraRules:
+                            items:
+                              properties:
+                                host:
+                                  type: string
+                                http:
+                                  properties:
+                                    paths:
+                                      items:
+                                        properties:
+                                          backend:
+                                            properties:
+                                              resource:
+                                                properties:
+                                                  apiGroup:
+                                                    type: string
+                                                  kind:
+                                                    type: string
+                                                  name:
+                                                    type: string
+                                                required:
+                                                - kind
+                                                - name
+                                                type: object
+                                                x-kubernetes-map-type: atomic
+                                              service:
+                                                properties:
+                                                  name:
+                                                    type: string
+                                                  port:
+                                                    properties:
+                                                      name:
+                                                        type: string
+                                                      number:
+                                                        format: int32
+                                                        type: integer
+                                                    type: object
+                                                    x-kubernetes-map-type: atomic
+                                                required:
+                                                - name
+                                                type: object
+                                            type: object
+                                          path:
+                                            type: string
+                                          pathType:
+                                            type: string
+                                        required:
+                                        - backend
+                                        - pathType
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  required:
+                                  - paths
+                                  type: object
+                              type: object
+                            type: array
+                          extraTls:
+                            items:
+                              properties:
+                                hosts:
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                secretName:
+                                  type: string
+                              type: object
+                            type: array
+                          host:
+                            type: string
+                          labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          name:
+                            type: string
+                          paths:
+                            items:
+                              type: string
+                            type: array
+                          tlsHosts:
+                            items:
+                              type: string
+                            type: array
+                          tlsSecretName:
+                            type: string
+                        type: object
+                      initContainers:
+                        items:
+                          properties:
+                            args:
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            command:
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            env:
+                              items:
+                                properties:
+                                  name:
+                                    type: string
+                                  value:
+                                    type: string
+                                  valueFrom:
+                                    properties:
+                                      configMapKeyRef:
+                                        properties:
+                                          key:
+                                            type: string
+                                          name:
+                                            default: ""
+                                            type: string
+                                          optional:
+                                            type: boolean
+                                        required:
+                                        - key
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      fieldRef:
+                                        properties:
+                                          apiVersion:
+                                            type: string
+                                          fieldPath:
+                                            type: string
+                                        required:
+                                        - fieldPath
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        properties:
+                                          key:
+                                            type: string
+                                          optional:
+                                            default: false
+                                            type: boolean
+                                          path:
+                                            type: string
+                                          volumeName:
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      resourceFieldRef:
+                                        properties:
+                                          containerName:
+                                            type: string
+                                          divisor:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                            x-kubernetes-int-or-string: true
+                                          resource:
+                                            type: string
+                                        required:
+                                        - resource
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      secretKeyRef:
+                                        properties:
+                                          key:
+                                            type: string
+                                          name:
+                                            default: ""
+                                            type: string
+                                          optional:
+                                            type: boolean
+                                        required:
+                                        - key
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                    type: object
+                                required:
+                                - name
+                                type: object
+                              type: array
+                              x-kubernetes-list-map-keys:
+                              - name
+                              x-kubernetes-list-type: map
+                            envFrom:
+                              items:
+                                properties:
+                                  configMapRef:
+                                    properties:
+                                      name:
+                                        default: ""
+                                        type: string
+                                      optional:
+                                        type: boolean
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                  prefix:
+                                    type: string
+                                  secretRef:
+                                    properties:
+                                      name:
+                                        default: ""
+                                        type: string
+                                      optional:
+                                        type: boolean
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            image:
+                              type: string
+                            imagePullPolicy:
+                              type: string
+                            lifecycle:
+                              properties:
+                                postStart:
+                                  properties:
+                                    exec:
+                                      properties:
+                                        command:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                    httpGet:
+                                      properties:
+                                        host:
+                                          type: string
+                                        httpHeaders:
+                                          items:
+                                            properties:
+                                              name:
+                                                type: string
+                                              value:
+                                                type: string
+                                            required:
+                                            - name
+                                            - value
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        path:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                        scheme:
+                                          type: string
+                                      required:
+                                      - port
+                                      type: object
+                                    sleep:
+                                      properties:
+                                        seconds:
+                                          format: int64
+                                          type: integer
+                                      required:
+                                      - seconds
+                                      type: object
+                                    tcpSocket:
+                                      properties:
+                                        host:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                      required:
+                                      - port
+                                      type: object
+                                  type: object
+                                preStop:
+                                  properties:
+                                    exec:
+                                      properties:
+                                        command:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                    httpGet:
+                                      properties:
+                                        host:
+                                          type: string
+                                        httpHeaders:
+                                          items:
+                                            properties:
+                                              name:
+                                                type: string
+                                              value:
+                                                type: string
+                                            required:
+                                            - name
+                                            - value
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        path:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                        scheme:
+                                          type: string
+                                      required:
+                                      - port
+                                      type: object
+                                    sleep:
+                                      properties:
+                                        seconds:
+                                          format: int64
+                                          type: integer
+                                      required:
+                                      - seconds
+                                      type: object
+                                    tcpSocket:
+                                      properties:
+                                        host:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                      required:
+                                      - port
+                                      type: object
+                                  type: object
+                                stopSignal:
+                                  type: string
+                              type: object
+                            livenessProbe:
+                              properties:
+                                exec:
+                                  properties:
+                                    command:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                failureThreshold:
+                                  format: int32
+                                  type: integer
+                                grpc:
+                                  properties:
+                                    port:
+                                      format: int32
+                                      type: integer
+                                    service:
+                                      default: ""
+                                      type: string
+                                  required:
+                                  - port
+                                  type: object
+                                httpGet:
+                                  properties:
+                                    host:
+                                      type: string
+                                    httpHeaders:
+                                      items:
+                                        properties:
+                                          name:
+                                            type: string
+                                          value:
+                                            type: string
+                                        required:
+                                        - name
+                                        - value
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    path:
+                                      type: string
+                                    port:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      x-kubernetes-int-or-string: true
+                                    scheme:
+                                      type: string
+                                  required:
+                                  - port
+                                  type: object
+                                initialDelaySeconds:
+                                  format: int32
+                                  type: integer
+                                periodSeconds:
+                                  format: int32
+                                  type: integer
+                                successThreshold:
+                                  format: int32
+                                  type: integer
+                                tcpSocket:
+                                  properties:
+                                    host:
+                                      type: string
+                                    port:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - port
+                                  type: object
+                                terminationGracePeriodSeconds:
+                                  format: int64
+                                  type: integer
+                                timeoutSeconds:
+                                  format: int32
+                                  type: integer
+                              type: object
+                            name:
+                              type: string
+                            ports:
+                              items:
+                                properties:
+                                  containerPort:
+                                    format: int32
+                                    type: integer
+                                  hostIP:
+                                    type: string
+                                  hostPort:
+                                    format: int32
+                                    type: integer
+                                  name:
+                                    type: string
+                                  protocol:
+                                    default: TCP
+                                    type: string
+                                required:
+                                - containerPort
+                                type: object
+                              type: array
+                              x-kubernetes-list-map-keys:
+                              - containerPort
+                              - protocol
+                              x-kubernetes-list-type: map
+                            readinessProbe:
+                              properties:
+                                exec:
+                                  properties:
+                                    command:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                failureThreshold:
+                                  format: int32
+                                  type: integer
+                                grpc:
+                                  properties:
+                                    port:
+                                      format: int32
+                                      type: integer
+                                    service:
+                                      default: ""
+                                      type: string
+                                  required:
+                                  - port
+                                  type: object
+                                httpGet:
+                                  properties:
+                                    host:
+                                      type: string
+                                    httpHeaders:
+                                      items:
+                                        properties:
+                                          name:
+                                            type: string
+                                          value:
+                                            type: string
+                                        required:
+                                        - name
+                                        - value
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    path:
+                                      type: string
+                                    port:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      x-kubernetes-int-or-string: true
+                                    scheme:
+                                      type: string
+                                  required:
+                                  - port
+                                  type: object
+                                initialDelaySeconds:
+                                  format: int32
+                                  type: integer
+                                periodSeconds:
+                                  format: int32
+                                  type: integer
+                                successThreshold:
+                                  format: int32
+                                  type: integer
+                                tcpSocket:
+                                  properties:
+                                    host:
+                                      type: string
+                                    port:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - port
+                                  type: object
+                                terminationGracePeriodSeconds:
+                                  format: int64
+                                  type: integer
+                                timeoutSeconds:
+                                  format: int32
+                                  type: integer
+                              type: object
+                            resizePolicy:
+                              items:
+                                properties:
+                                  resourceName:
+                                    type: string
+                                  restartPolicy:
+                                    type: string
+                                required:
+                                - resourceName
+                                - restartPolicy
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            resources:
+                              properties:
+                                claims:
+                                  items:
+                                    properties:
+                                      name:
+                                        type: string
+                                      request:
+                                        type: string
+                                    required:
+                                    - name
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-map-keys:
+                                  - name
+                                  x-kubernetes-list-type: map
+                                limits:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                requests:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                              type: object
+                            restartPolicy:
+                              type: string
+                            restartPolicyRules:
+                              items:
+                                properties:
+                                  action:
+                                    type: string
+                                  exitCodes:
+                                    properties:
+                                      operator:
+                                        type: string
+                                      values:
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            securityContext:
+                              properties:
+                                allowPrivilegeEscalation:
+                                  type: boolean
+                                appArmorProfile:
+                                  properties:
+                                    localhostProfile:
+                                      type: string
+                                    type:
+                                      type: string
+                                  required:
+                                  - type
+                                  type: object
+                                capabilities:
+                                  properties:
+                                    add:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    drop:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                privileged:
+                                  type: boolean
+                                procMount:
+                                  type: string
+                                readOnlyRootFilesystem:
+                                  type: boolean
+                                runAsGroup:
+                                  format: int64
+                                  type: integer
+                                runAsNonRoot:
+                                  type: boolean
+                                runAsUser:
+                                  format: int64
+                                  type: integer
+                                seLinuxOptions:
+                                  properties:
+                                    level:
+                                      type: string
+                                    role:
+                                      type: string
+                                    type:
+                                      type: string
+                                    user:
+                                      type: string
+                                  type: object
+                                seccompProfile:
+                                  properties:
+                                    localhostProfile:
+                                      type: string
+                                    type:
+                                      type: string
+                                  required:
+                                  - type
+                                  type: object
+                                windowsOptions:
+                                  properties:
+                                    gmsaCredentialSpec:
+                                      type: string
+                                    gmsaCredentialSpecName:
+                                      type: string
+                                    hostProcess:
+                                      type: boolean
+                                    runAsUserName:
+                                      type: string
+                                  type: object
+                              type: object
+                            startupProbe:
+                              properties:
+                                exec:
+                                  properties:
+                                    command:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                failureThreshold:
+                                  format: int32
+                                  type: integer
+                                grpc:
+                                  properties:
+                                    port:
+                                      format: int32
+                                      type: integer
+                                    service:
+                                      default: ""
+                                      type: string
+                                  required:
+                                  - port
+                                  type: object
+                                httpGet:
+                                  properties:
+                                    host:
+                                      type: string
+                                    httpHeaders:
+                                      items:
+                                        properties:
+                                          name:
+                                            type: string
+                                          value:
+                                            type: string
+                                        required:
+                                        - name
+                                        - value
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    path:
+                                      type: string
+                                    port:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      x-kubernetes-int-or-string: true
+                                    scheme:
+                                      type: string
+                                  required:
+                                  - port
+                                  type: object
+                                initialDelaySeconds:
+                                  format: int32
+                                  type: integer
+                                periodSeconds:
+                                  format: int32
+                                  type: integer
+                                successThreshold:
+                                  format: int32
+                                  type: integer
+                                tcpSocket:
+                                  properties:
+                                    host:
+                                      type: string
+                                    port:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - port
+                                  type: object
+                                terminationGracePeriodSeconds:
+                                  format: int64
+                                  type: integer
+                                timeoutSeconds:
+                                  format: int32
+                                  type: integer
+                              type: object
+                            stdin:
+                              type: boolean
+                            stdinOnce:
+                              type: boolean
+                            terminationMessagePath:
+                              type: string
+                            terminationMessagePolicy:
+                              type: string
+                            tty:
+                              type: boolean
+                            volumeDevices:
+                              items:
+                                properties:
+                                  devicePath:
+                                    type: string
+                                  name:
+                                    type: string
+                                required:
+                                - devicePath
+                                - name
+                                type: object
+                              type: array
+                              x-kubernetes-list-map-keys:
+                              - devicePath
+                              x-kubernetes-list-type: map
+                            volumeMounts:
+                              items:
+                                properties:
+                                  mountPath:
+                                    type: string
+                                  mountPropagation:
+                                    type: string
+                                  name:
+                                    type: string
+                                  readOnly:
+                                    type: boolean
+                                  recursiveReadOnly:
+                                    type: string
+                                  subPath:
+                                    type: string
+                                  subPathExpr:
+                                    type: string
+                                required:
+                                - mountPath
+                                - name
+                                type: object
+                              type: array
+                              x-kubernetes-list-map-keys:
+                              - mountPath
+                              x-kubernetes-list-type: map
+                            workingDir:
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                      internalListenPort:
+                        type: string
+                      license:
+                        properties:
+                          forceOffline:
+                            type: boolean
+                          key:
+                            type: string
+                          keyRef:
+                            properties:
+                              key:
+                                type: string
+                              name:
+                                default: ""
+                                type: string
+                              optional:
+                                type: boolean
+                            required:
+                            - key
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          reloadInterval:
+                            type: string
+                        type: object
+                      livenessProbe:
+                        properties:
+                          exec:
+                            properties:
+                              command:
+                                items:
+                                  type: string
+                                type: array
+                                x-kubernetes-list-type: atomic
+                            type: object
+                          failureThreshold:
+                            format: int32
+                            type: integer
+                          grpc:
+                            properties:
+                              port:
+                                format: int32
+                                type: integer
+                              service:
+                                default: ""
+                                type: string
+                            required:
+                            - port
+                            type: object
+                          httpGet:
+                            properties:
+                              host:
+                                type: string
+                              httpHeaders:
+                                items:
+                                  properties:
+                                    name:
+                                      type: string
+                                    value:
+                                      type: string
+                                  required:
+                                  - name
+                                  - value
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              path:
+                                type: string
+                              port:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                x-kubernetes-int-or-string: true
+                              scheme:
+                                type: string
+                            required:
+                            - port
+                            type: object
+                          initialDelaySeconds:
+                            format: int32
+                            type: integer
+                          periodSeconds:
+                            format: int32
+                            type: integer
+                          successThreshold:
+                            format: int32
+                            type: integer
+                          tcpSocket:
+                            properties:
+                              host:
+                                type: string
+                              port:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                x-kubernetes-int-or-string: true
+                            required:
+                            - port
+                            type: object
+                          terminationGracePeriodSeconds:
+                            format: int64
+                            type: integer
+                          timeoutSeconds:
+                            format: int32
+                            type: integer
+                        type: object
+                      logFormat:
+                        enum:
+                        - default
+                        - json
+                        type: string
+                      logLevel:
+                        enum:
+                        - INFO
+                        - WARN
+                        - ERROR
+                        - FATAL
+                        - PANIC
+                        type: string
+                      managedMetadata:
+                        properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                        type: object
+                      minReadySeconds:
+                        format: int32
+                        type: integer
+                      nodeSelector:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      paused:
+                        type: boolean
+                      podDisruptionBudget:
+                        properties:
+                          maxUnavailable:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            x-kubernetes-int-or-string: true
+                          minAvailable:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            x-kubernetes-int-or-string: true
+                          selectorLabels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          unhealthyPodEvictionPolicy:
+                            enum:
+                            - IfHealthyBudget
+                            - AlwaysAllow
+                            type: string
+                        type: object
+                      podMetadata:
+                        properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          name:
+                            type: string
+                        type: object
+                      port:
+                        type: string
+                      priorityClassName:
+                        type: string
+                      readinessGates:
+                        items:
+                          properties:
+                            conditionType:
+                              type: string
+                          required:
+                          - conditionType
+                          type: object
+                        type: array
+                      readinessProbe:
+                        properties:
+                          exec:
+                            properties:
+                              command:
+                                items:
+                                  type: string
+                                type: array
+                                x-kubernetes-list-type: atomic
+                            type: object
+                          failureThreshold:
+                            format: int32
+                            type: integer
+                          grpc:
+                            properties:
+                              port:
+                                format: int32
+                                type: integer
+                              service:
+                                default: ""
+                                type: string
+                            required:
+                            - port
+                            type: object
+                          httpGet:
+                            properties:
+                              host:
+                                type: string
+                              httpHeaders:
+                                items:
+                                  properties:
+                                    name:
+                                      type: string
+                                    value:
+                                      type: string
+                                  required:
+                                  - name
+                                  - value
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              path:
+                                type: string
+                              port:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                x-kubernetes-int-or-string: true
+                              scheme:
+                                type: string
+                            required:
+                            - port
+                            type: object
+                          initialDelaySeconds:
+                            format: int32
+                            type: integer
+                          periodSeconds:
+                            format: int32
+                            type: integer
+                          successThreshold:
+                            format: int32
+                            type: integer
+                          tcpSocket:
+                            properties:
+                              host:
+                                type: string
+                              port:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                x-kubernetes-int-or-string: true
+                            required:
+                            - port
+                            type: object
+                          terminationGracePeriodSeconds:
+                            format: int64
+                            type: integer
+                          timeoutSeconds:
+                            format: int32
+                            type: integer
+                        type: object
+                      replicaCount:
+                        format: int32
+                        type: integer
+                      resources:
+                        properties:
+                          claims:
+                            items:
+                              properties:
+                                name:
+                                  type: string
+                                request:
+                                  type: string
+                              required:
+                              - name
+                              type: object
+                            type: array
+                            x-kubernetes-list-map-keys:
+                            - name
+                            x-kubernetes-list-type: map
+                          limits:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            type: object
+                          requests:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            type: object
+                        type: object
+                      revisionHistoryLimitCount:
+                        format: int32
+                        type: integer
+                      rollingUpdate:
+                        properties:
+                          maxSurge:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            x-kubernetes-int-or-string: true
+                          maxUnavailable:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            x-kubernetes-int-or-string: true
+                        type: object
+                      runtimeClassName:
+                        type: string
+                      schedulerName:
+                        type: string
+                      secrets:
+                        items:
+                          type: string
+                        type: array
+                      securityContext:
+                        properties:
+                          allowPrivilegeEscalation:
+                            type: boolean
+                          appArmorProfile:
+                            properties:
+                              localhostProfile:
+                                type: string
+                              type:
+                                type: string
+                            required:
+                            - type
+                            type: object
+                          capabilities:
+                            properties:
+                              add:
+                                items:
+                                  type: string
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              drop:
+                                items:
+                                  type: string
+                                type: array
+                                x-kubernetes-list-type: atomic
+                            type: object
+                          fsGroup:
+                            format: int64
+                            type: integer
+                          fsGroupChangePolicy:
+                            type: string
+                          privileged:
+                            type: boolean
+                          procMount:
+                            type: string
+                          readOnlyRootFilesystem:
+                            type: boolean
+                          runAsGroup:
+                            format: int64
+                            type: integer
+                          runAsNonRoot:
+                            type: boolean
+                          runAsUser:
+                            format: int64
+                            type: integer
+                          seLinuxChangePolicy:
+                            type: string
+                          seLinuxOptions:
+                            properties:
+                              level:
+                                type: string
+                              role:
+                                type: string
+                              type:
+                                type: string
+                              user:
+                                type: string
+                            type: object
+                          seccompProfile:
+                            properties:
+                              localhostProfile:
+                                type: string
+                              type:
+                                type: string
+                            required:
+                            - type
+                            type: object
+                          supplementalGroups:
+                            items:
+                              format: int64
+                              type: integer
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          supplementalGroupsPolicy:
+                            type: string
+                          sysctls:
+                            items:
+                              properties:
+                                name:
+                                  type: string
+                                value:
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          windowsOptions:
+                            properties:
+                              gmsaCredentialSpec:
+                                type: string
+                              gmsaCredentialSpecName:
+                                type: string
+                              hostProcess:
+                                type: boolean
+                              runAsUserName:
+                                type: string
+                            type: object
+                        type: object
+                      selectAllByDefault:
+                        type: boolean
+                      serviceAccountName:
+                        type: string
+                      serviceScrapeSpec:
+                        properties:
+                          attach_metadata:
+                            properties:
+                              namespace:
+                                type: boolean
+                              node:
+                                type: boolean
+                            type: object
+                          discoveryRole:
+                            enum:
+                            - endpoints
+                            - service
+                            - endpointslices
+                            - endpointslice
+                            type: string
+                          endpoints:
+                            items:
+                              properties:
+                                attach_metadata:
+                                  properties:
+                                    namespace:
+                                      type: boolean
+                                    node:
+                                      type: boolean
+                                  type: object
+                                authorization:
+                                  properties:
+                                    credentials:
+                                      properties:
+                                        key:
+                                          type: string
+                                        name:
+                                          default: ""
+                                          type: string
+                                        optional:
+                                          type: boolean
+                                      required:
+                                      - key
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    credentialsFile:
+                                      type: string
+                                    type:
+                                      type: string
+                                  type: object
+                                basicAuth:
+                                  properties:
+                                    password:
+                                      properties:
+                                        key:
+                                          type: string
+                                        name:
+                                          default: ""
+                                          type: string
+                                        optional:
+                                          type: boolean
+                                      required:
+                                      - key
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    password_file:
+                                      type: string
+                                    username:
+                                      properties:
+                                        key:
+                                          type: string
+                                        name:
+                                          default: ""
+                                          type: string
+                                        optional:
+                                          type: boolean
+                                      required:
+                                      - key
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                  type: object
+                                bearerTokenFile:
+                                  type: string
+                                bearerTokenSecret:
+                                  nullable: true
+                                  properties:
+                                    key:
+                                      type: string
+                                    name:
+                                      default: ""
+                                      type: string
+                                    optional:
+                                      type: boolean
+                                  required:
+                                  - key
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                follow_redirects:
+                                  type: boolean
+                                honorLabels:
+                                  type: boolean
+                                honorTimestamps:
+                                  type: boolean
+                                interval:
+                                  type: string
+                                max_scrape_size:
+                                  type: string
+                                metricRelabelConfigs:
+                                  items:
+                                    properties:
+                                      action:
+                                        type: string
+                                      if:
+                                        x-kubernetes-preserve-unknown-fields: true
+                                      labels:
+                                        additionalProperties:
+                                          type: string
+                                        type: object
+                                      match:
+                                        type: string
+                                      modulus:
+                                        format: int64
+                                        type: integer
+                                      regex:
+                                        x-kubernetes-preserve-unknown-fields: true
+                                      replacement:
+                                        type: string
+                                      separator:
+                                        type: string
+                                      source_labels:
+                                        items:
+                                          type: string
+                                        type: array
+                                      sourceLabels:
+                                        items:
+                                          type: string
+                                        type: array
+                                      target_label:
+                                        type: string
+                                      targetLabel:
+                                        type: string
+                                    type: object
+                                  type: array
+                                oauth2:
+                                  properties:
+                                    client_id:
+                                      properties:
+                                        configMap:
+                                          properties:
+                                            key:
+                                              type: string
+                                            name:
+                                              default: ""
+                                              type: string
+                                            optional:
+                                              type: boolean
+                                          required:
+                                          - key
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        secret:
+                                          properties:
+                                            key:
+                                              type: string
+                                            name:
+                                              default: ""
+                                              type: string
+                                            optional:
+                                              type: boolean
+                                          required:
+                                          - key
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                      type: object
+                                    client_secret:
+                                      properties:
+                                        key:
+                                          type: string
+                                        name:
+                                          default: ""
+                                          type: string
+                                        optional:
+                                          type: boolean
+                                      required:
+                                      - key
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    client_secret_file:
+                                      type: string
+                                    endpoint_params:
+                                      additionalProperties:
+                                        type: string
+                                      type: object
+                                    proxy_url:
+                                      type: string
+                                    scopes:
+                                      items:
+                                        type: string
+                                      type: array
+                                    tls_config:
+                                      x-kubernetes-preserve-unknown-fields: true
+                                    token_url:
+                                      minLength: 1
+                                      type: string
+                                  required:
+                                  - client_id
+                                  - token_url
+                                  type: object
+                                params:
+                                  additionalProperties:
+                                    items:
+                                      type: string
+                                    type: array
+                                  type: object
+                                path:
+                                  type: string
+                                port:
+                                  type: string
+                                proxyURL:
+                                  type: string
+                                relabelConfigs:
+                                  items:
+                                    properties:
+                                      action:
+                                        type: string
+                                      if:
+                                        x-kubernetes-preserve-unknown-fields: true
+                                      labels:
+                                        additionalProperties:
+                                          type: string
+                                        type: object
+                                      match:
+                                        type: string
+                                      modulus:
+                                        format: int64
+                                        type: integer
+                                      regex:
+                                        x-kubernetes-preserve-unknown-fields: true
+                                      replacement:
+                                        type: string
+                                      separator:
+                                        type: string
+                                      source_labels:
+                                        items:
+                                          type: string
+                                        type: array
+                                      sourceLabels:
+                                        items:
+                                          type: string
+                                        type: array
+                                      target_label:
+                                        type: string
+                                      targetLabel:
+                                        type: string
+                                    type: object
+                                  type: array
+                                sampleLimit:
+                                  type: integer
+                                scheme:
+                                  enum:
+                                  - http
+                                  - https
+                                  - HTTPS
+                                  - HTTP
+                                  type: string
+                                scrape_interval:
+                                  type: string
+                                scrapeTimeout:
+                                  type: string
+                                seriesLimit:
+                                  type: integer
+                                targetPort:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  x-kubernetes-int-or-string: true
+                                tlsConfig:
+                                  properties:
+                                    ca:
+                                      properties:
+                                        configMap:
+                                          properties:
+                                            key:
+                                              type: string
+                                            name:
+                                              default: ""
+                                              type: string
+                                            optional:
+                                              type: boolean
+                                          required:
+                                          - key
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        secret:
+                                          properties:
+                                            key:
+                                              type: string
+                                            name:
+                                              default: ""
+                                              type: string
+                                            optional:
+                                              type: boolean
+                                          required:
+                                          - key
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                      type: object
+                                    caFile:
+                                      type: string
+                                    cert:
+                                      properties:
+                                        configMap:
+                                          properties:
+                                            key:
+                                              type: string
+                                            name:
+                                              default: ""
+                                              type: string
+                                            optional:
+                                              type: boolean
+                                          required:
+                                          - key
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        secret:
+                                          properties:
+                                            key:
+                                              type: string
+                                            name:
+                                              default: ""
+                                              type: string
+                                            optional:
+                                              type: boolean
+                                          required:
+                                          - key
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                      type: object
+                                    certFile:
+                                      type: string
+                                    insecureSkipVerify:
+                                      type: boolean
+                                    keyFile:
+                                      type: string
+                                    keySecret:
+                                      properties:
+                                        key:
+                                          type: string
+                                        name:
+                                          default: ""
+                                          type: string
+                                        optional:
+                                          type: boolean
+                                      required:
+                                      - key
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    serverName:
+                                      type: string
+                                  type: object
+                                vm_scrape_params:
+                                  properties:
+                                    disable_compression:
+                                      type: boolean
+                                    disable_keep_alive:
+                                      type: boolean
+                                    headers:
+                                      items:
+                                        type: string
+                                      type: array
+                                    no_stale_markers:
+                                      type: boolean
+                                    proxy_client_config:
+                                      properties:
+                                        basic_auth:
+                                          properties:
+                                            password:
+                                              properties:
+                                                key:
+                                                  type: string
+                                                name:
+                                                  default: ""
+                                                  type: string
+                                                optional:
+                                                  type: boolean
+                                              required:
+                                              - key
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            password_file:
+                                              type: string
+                                            username:
+                                              properties:
+                                                key:
+                                                  type: string
+                                                name:
+                                                  default: ""
+                                                  type: string
+                                                optional:
+                                                  type: boolean
+                                              required:
+                                              - key
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                          type: object
+                                        bearer_token:
+                                          properties:
+                                            key:
+                                              type: string
+                                            name:
+                                              default: ""
+                                              type: string
+                                            optional:
+                                              type: boolean
+                                          required:
+                                          - key
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        bearer_token_file:
+                                          type: string
+                                        tls_config:
+                                          x-kubernetes-preserve-unknown-fields: true
+                                      type: object
+                                    scrape_align_interval:
+                                      type: string
+                                    scrape_offset:
+                                      type: string
+                                    stream_parse:
+                                      type: boolean
+                                  type: object
+                              type: object
+                            type: array
+                          jobLabel:
+                            type: string
+                          namespaceSelector:
+                            properties:
+                              any:
+                                type: boolean
+                              matchNames:
+                                items:
+                                  type: string
+                                type: array
+                            type: object
+                          podTargetLabels:
+                            items:
+                              type: string
+                            type: array
+                          sampleLimit:
+                            type: integer
+                          scrapeClass:
+                            type: string
+                          selector:
+                            properties:
+                              matchExpressions:
+                                items:
+                                  properties:
+                                    key:
+                                      type: string
+                                    operator:
+                                      type: string
+                                    values:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  required:
+                                  - key
+                                  - operator
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              matchLabels:
+                                additionalProperties:
+                                  type: string
+                                type: object
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          seriesLimit:
+                            type: integer
+                          targetLabels:
+                            items:
+                              type: string
+                            type: array
+                        required:
+                        - endpoints
+                        type: object
+                      serviceSpec:
+                        properties:
+                          metadata:
+                            properties:
+                              annotations:
+                                additionalProperties:
+                                  type: string
+                                type: object
+                              labels:
+                                additionalProperties:
+                                  type: string
+                                type: object
+                              name:
+                                type: string
+                            type: object
+                          spec:
+                            properties:
+                              allocateLoadBalancerNodePorts:
+                                type: boolean
+                              clusterIP:
+                                type: string
+                              clusterIPs:
+                                items:
+                                  type: string
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              externalIPs:
+                                items:
+                                  type: string
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              externalName:
+                                type: string
+                              externalTrafficPolicy:
+                                type: string
+                              healthCheckNodePort:
+                                format: int32
+                                type: integer
+                              internalTrafficPolicy:
+                                type: string
+                              ipFamilies:
+                                items:
+                                  type: string
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              ipFamilyPolicy:
+                                type: string
+                              loadBalancerClass:
+                                type: string
+                              loadBalancerIP:
+                                type: string
+                              loadBalancerSourceRanges:
+                                items:
+                                  type: string
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              ports:
+                                items:
+                                  properties:
+                                    appProtocol:
+                                      type: string
+                                    name:
+                                      type: string
+                                    nodePort:
+                                      format: int32
+                                      type: integer
+                                    port:
+                                      format: int32
+                                      type: integer
+                                    protocol:
+                                      default: TCP
+                                      type: string
+                                    targetPort:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - port
+                                  type: object
+                                type: array
+                                x-kubernetes-list-map-keys:
+                                - port
+                                - protocol
+                                x-kubernetes-list-type: map
+                              publishNotReadyAddresses:
+                                type: boolean
+                              selector:
+                                additionalProperties:
+                                  type: string
+                                type: object
+                                x-kubernetes-map-type: atomic
+                              sessionAffinity:
+                                type: string
+                              sessionAffinityConfig:
+                                properties:
+                                  clientIP:
+                                    properties:
+                                      timeoutSeconds:
+                                        format: int32
+                                        type: integer
+                                    type: object
+                                type: object
+                              trafficDistribution:
+                                type: string
+                              type:
+                                type: string
+                            type: object
+                          useAsDefault:
+                            type: boolean
+                        required:
+                        - spec
+                        type: object
+                      startupProbe:
+                        properties:
+                          exec:
+                            properties:
+                              command:
+                                items:
+                                  type: string
+                                type: array
+                                x-kubernetes-list-type: atomic
+                            type: object
+                          failureThreshold:
+                            format: int32
+                            type: integer
+                          grpc:
+                            properties:
+                              port:
+                                format: int32
+                                type: integer
+                              service:
+                                default: ""
+                                type: string
+                            required:
+                            - port
+                            type: object
+                          httpGet:
+                            properties:
+                              host:
+                                type: string
+                              httpHeaders:
+                                items:
+                                  properties:
+                                    name:
+                                      type: string
+                                    value:
+                                      type: string
+                                  required:
+                                  - name
+                                  - value
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              path:
+                                type: string
+                              port:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                x-kubernetes-int-or-string: true
+                              scheme:
+                                type: string
+                            required:
+                            - port
+                            type: object
+                          initialDelaySeconds:
+                            format: int32
+                            type: integer
+                          periodSeconds:
+                            format: int32
+                            type: integer
+                          successThreshold:
+                            format: int32
+                            type: integer
+                          tcpSocket:
+                            properties:
+                              host:
+                                type: string
+                              port:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                x-kubernetes-int-or-string: true
+                            required:
+                            - port
+                            type: object
+                          terminationGracePeriodSeconds:
+                            format: int64
+                            type: integer
+                          timeoutSeconds:
+                            format: int32
+                            type: integer
+                        type: object
+                      terminationGracePeriodSeconds:
+                        format: int64
+                        type: integer
+                      tolerations:
+                        items:
+                          properties:
+                            effect:
+                              type: string
+                            key:
+                              type: string
+                            operator:
+                              type: string
+                            tolerationSeconds:
+                              format: int64
+                              type: integer
+                            value:
+                              type: string
+                          type: object
+                        type: array
+                      topologySpreadConstraints:
+                        items:
+                          properties:
+                            labelSelector:
+                              properties:
+                                matchExpressions:
+                                  items:
+                                    properties:
+                                      key:
+                                        type: string
+                                      operator:
+                                        type: string
+                                      values:
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    required:
+                                    - key
+                                    - operator
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                matchLabels:
+                                  additionalProperties:
+                                    type: string
+                                  type: object
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            matchLabelKeys:
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            maxSkew:
+                              format: int32
+                              type: integer
+                            minDomains:
+                              format: int32
+                              type: integer
+                            nodeAffinityPolicy:
+                              type: string
+                            nodeTaintsPolicy:
+                              type: string
+                            topologyKey:
+                              type: string
+                            whenUnsatisfiable:
+                              type: string
+                          required:
+                          - maxSkew
+                          - topologyKey
+                          - whenUnsatisfiable
+                          type: object
+                        type: array
+                      unauthorizedAccessConfig:
+                        x-kubernetes-preserve-unknown-fields: true
+                      unauthorizedUserAccessSpec:
+                        properties:
+                          default_url:
+                            items:
+                              type: string
+                            type: array
+                          discover_backend_ips:
+                            type: boolean
+                          drop_src_path_prefix_parts:
+                            type: integer
+                          dump_request_on_errors:
+                            type: boolean
+                          headers:
+                            items:
+                              type: string
+                            type: array
+                          ip_filters:
+                            properties:
+                              allow_list:
+                                items:
+                                  type: string
+                                type: array
+                              deny_list:
+                                items:
+                                  type: string
+                                type: array
+                            type: object
+                          load_balancing_policy:
+                            enum:
+                            - least_loaded
+                            - first_available
+                            type: string
+                          max_concurrent_requests:
+                            type: integer
+                          metric_labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          response_headers:
+                            items:
+                              type: string
+                            type: array
+                          retry_status_codes:
+                            items:
+                              type: integer
+                            type: array
+                          targetRefs:
+                            items:
+                              properties:
+                                crd:
+                                  properties:
+                                    kind:
+                                      enum:
+                                      - VMAgent
+                                      - VMAlert
+                                      - VMSingle
+                                      - VLogs
+                                      - VMAlertManager
+                                      - VMAlertmanager
+                                      - VMCluster/vmselect
+                                      - VMCluster/vmstorage
+                                      - VMCluster/vminsert
+                                      - VLSingle
+                                      - VLCluster/vlinsert
+                                      - VLCluster/vlselect
+                                      - VLCluster/vlstorage
+                                      - VLAgent
+                                      - VTCluster/vtinsert
+                                      - VTCluster/vtselect
+                                      - VTCluster/vtstorage
+                                      - VTSingle
+                                      type: string
+                                    name:
+                                      type: string
+                                    namespace:
+                                      type: string
+                                  required:
+                                  - kind
+                                  - name
+                                  - namespace
+                                  type: object
+                                discover_backend_ips:
+                                  type: boolean
+                                drop_src_path_prefix_parts:
+                                  type: integer
+                                headers:
+                                  items:
+                                    type: string
+                                  type: array
+                                hosts:
+                                  items:
+                                    type: string
+                                  type: array
+                                load_balancing_policy:
+                                  enum:
+                                  - least_loaded
+                                  - first_available
+                                  type: string
+                                paths:
+                                  items:
+                                    type: string
+                                  type: array
+                                query_args:
+                                  items:
+                                    properties:
+                                      name:
+                                        type: string
+                                      values:
+                                        items:
+                                          type: string
+                                        type: array
+                                    required:
+                                    - name
+                                    - values
+                                    type: object
+                                  type: array
+                                response_headers:
+                                  items:
+                                    type: string
+                                  type: array
+                                retry_status_codes:
+                                  items:
+                                    type: integer
+                                  type: array
+                                src_headers:
+                                  items:
+                                    type: string
+                                  type: array
+                                src_query_args:
+                                  items:
+                                    type: string
+                                  type: array
+                                static:
+                                  properties:
+                                    url:
+                                      type: string
+                                    urls:
+                                      items:
+                                        type: string
+                                      type: array
+                                  type: object
+                                target_path_suffix:
+                                  type: string
+                                targetRefBasicAuth:
+                                  properties:
+                                    password:
+                                      properties:
+                                        key:
+                                          type: string
+                                        name:
+                                          default: ""
+                                          type: string
+                                        optional:
+                                          type: boolean
+                                      required:
+                                      - key
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    username:
+                                      properties:
+                                        key:
+                                          type: string
+                                        name:
+                                          default: ""
+                                          type: string
+                                        optional:
+                                          type: boolean
+                                      required:
+                                      - key
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                  required:
+                                  - password
+                                  - username
+                                  type: object
+                              type: object
+                            type: array
+                          tlsConfig:
+                            properties:
+                              ca:
+                                properties:
+                                  configMap:
+                                    properties:
+                                      key:
+                                        type: string
+                                      name:
+                                        default: ""
+                                        type: string
+                                      optional:
+                                        type: boolean
+                                    required:
+                                    - key
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                  secret:
+                                    properties:
+                                      key:
+                                        type: string
+                                      name:
+                                        default: ""
+                                        type: string
+                                      optional:
+                                        type: boolean
+                                    required:
+                                    - key
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                type: object
+                              caFile:
+                                type: string
+                              cert:
+                                properties:
+                                  configMap:
+                                    properties:
+                                      key:
+                                        type: string
+                                      name:
+                                        default: ""
+                                        type: string
+                                      optional:
+                                        type: boolean
+                                    required:
+                                    - key
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                  secret:
+                                    properties:
+                                      key:
+                                        type: string
+                                      name:
+                                        default: ""
+                                        type: string
+                                      optional:
+                                        type: boolean
+                                    required:
+                                    - key
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                type: object
+                              certFile:
+                                type: string
+                              insecureSkipVerify:
+                                type: boolean
+                              keyFile:
+                                type: string
+                              keySecret:
+                                properties:
+                                  key:
+                                    type: string
+                                  name:
+                                    default: ""
+                                    type: string
+                                  optional:
+                                    type: boolean
+                                required:
+                                - key
+                                type: object
+                                x-kubernetes-map-type: atomic
+                              serverName:
+                                type: string
+                            type: object
+                          url_map:
+                            items:
+                              properties:
+                                discover_backend_ips:
+                                  type: boolean
+                                drop_src_path_prefix_parts:
+                                  type: integer
+                                headers:
+                                  items:
+                                    type: string
+                                  type: array
+                                load_balancing_policy:
+                                  enum:
+                                  - least_loaded
+                                  - first_available
+                                  type: string
+                                response_headers:
+                                  items:
+                                    type: string
+                                  type: array
+                                retry_status_codes:
+                                  items:
+                                    type: integer
+                                  type: array
+                                src_headers:
+                                  items:
+                                    type: string
+                                  type: array
+                                src_hosts:
+                                  items:
+                                    type: string
+                                  type: array
+                                src_paths:
+                                  items:
+                                    type: string
+                                  type: array
+                                src_query_args:
+                                  items:
+                                    type: string
+                                  type: array
+                                url_prefix:
+                                  x-kubernetes-preserve-unknown-fields: true
+                              type: object
+                            type: array
+                          url_prefix:
+                            x-kubernetes-preserve-unknown-fields: true
+                        type: object
+                      updateStrategy:
+                        enum:
+                        - Recreate
+                        - RollingUpdate
+                        type: string
+                      useDefaultResources:
+                        type: boolean
+                      useProxyProtocol:
+                        type: boolean
+                      useStrictSecurity:
+                        type: boolean
+                      useVMConfigReloader:
+                        type: boolean
+                      userNamespaceSelector:
+                        properties:
+                          matchExpressions:
+                            items:
+                              properties:
+                                key:
+                                  type: string
+                                operator:
+                                  type: string
+                                values:
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      userSelector:
+                        properties:
+                          matchExpressions:
+                            items:
+                              properties:
+                                key:
+                                  type: string
+                                operator:
+                                  type: string
+                                values:
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      volumeMounts:
+                        items:
+                          properties:
+                            mountPath:
+                              type: string
+                            mountPropagation:
+                              type: string
+                            name:
+                              type: string
+                            readOnly:
+                              type: boolean
+                            recursiveReadOnly:
+                              type: string
+                            subPath:
+                              type: string
+                            subPathExpr:
+                              type: string
+                          required:
+                          - mountPath
+                          - name
+                          type: object
+                        type: array
+                      volumes:
+                        items:
+                          properties:
+                            awsElasticBlockStore:
+                              properties:
+                                fsType:
+                                  type: string
+                                partition:
+                                  format: int32
+                                  type: integer
+                                readOnly:
+                                  type: boolean
+                                volumeID:
+                                  type: string
+                              required:
+                              - volumeID
+                              type: object
+                            azureDisk:
+                              properties:
+                                cachingMode:
+                                  type: string
+                                diskName:
+                                  type: string
+                                diskURI:
+                                  type: string
+                                fsType:
+                                  default: ext4
+                                  type: string
+                                kind:
+                                  type: string
+                                readOnly:
+                                  default: false
+                                  type: boolean
+                              required:
+                              - diskName
+                              - diskURI
+                              type: object
+                            azureFile:
+                              properties:
+                                readOnly:
+                                  type: boolean
+                                secretName:
+                                  type: string
+                                shareName:
+                                  type: string
+                              required:
+                              - secretName
+                              - shareName
+                              type: object
+                            cephfs:
+                              properties:
+                                monitors:
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                path:
+                                  type: string
+                                readOnly:
+                                  type: boolean
+                                secretFile:
+                                  type: string
+                                secretRef:
+                                  properties:
+                                    name:
+                                      default: ""
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                user:
+                                  type: string
+                              required:
+                              - monitors
+                              type: object
+                            cinder:
+                              properties:
+                                fsType:
+                                  type: string
+                                readOnly:
+                                  type: boolean
+                                secretRef:
+                                  properties:
+                                    name:
+                                      default: ""
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                volumeID:
+                                  type: string
+                              required:
+                              - volumeID
+                              type: object
+                            configMap:
+                              properties:
+                                defaultMode:
+                                  format: int32
+                                  type: integer
+                                items:
+                                  items:
+                                    properties:
+                                      key:
+                                        type: string
+                                      mode:
+                                        format: int32
+                                        type: integer
+                                      path:
+                                        type: string
+                                    required:
+                                    - key
+                                    - path
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            csi:
+                              properties:
+                                driver:
+                                  type: string
+                                fsType:
+                                  type: string
+                                nodePublishSecretRef:
+                                  properties:
+                                    name:
+                                      default: ""
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                readOnly:
+                                  type: boolean
+                                volumeAttributes:
+                                  additionalProperties:
+                                    type: string
+                                  type: object
+                              required:
+                              - driver
+                              type: object
+                            downwardAPI:
+                              properties:
+                                defaultMode:
+                                  format: int32
+                                  type: integer
+                                items:
+                                  items:
+                                    properties:
+                                      fieldRef:
+                                        properties:
+                                          apiVersion:
+                                            type: string
+                                          fieldPath:
+                                            type: string
+                                        required:
+                                        - fieldPath
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      mode:
+                                        format: int32
+                                        type: integer
+                                      path:
+                                        type: string
+                                      resourceFieldRef:
+                                        properties:
+                                          containerName:
+                                            type: string
+                                          divisor:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                            x-kubernetes-int-or-string: true
+                                          resource:
+                                            type: string
+                                        required:
+                                        - resource
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                    required:
+                                    - path
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              type: object
+                            emptyDir:
+                              properties:
+                                medium:
+                                  type: string
+                                sizeLimit:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                              type: object
+                            ephemeral:
+                              properties:
+                                volumeClaimTemplate:
+                                  properties:
+                                    metadata:
+                                      type: object
+                                    spec:
+                                      properties:
+                                        accessModes:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        dataSource:
+                                          properties:
+                                            apiGroup:
+                                              type: string
+                                            kind:
+                                              type: string
+                                            name:
+                                              type: string
+                                          required:
+                                          - kind
+                                          - name
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        dataSourceRef:
+                                          properties:
+                                            apiGroup:
+                                              type: string
+                                            kind:
+                                              type: string
+                                            name:
+                                              type: string
+                                            namespace:
+                                              type: string
+                                          required:
+                                          - kind
+                                          - name
+                                          type: object
+                                        resources:
+                                          properties:
+                                            limits:
+                                              additionalProperties:
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                x-kubernetes-int-or-string: true
+                                              type: object
+                                            requests:
+                                              additionalProperties:
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                x-kubernetes-int-or-string: true
+                                              type: object
+                                          type: object
+                                        selector:
+                                          properties:
+                                            matchExpressions:
+                                              items:
+                                                properties:
+                                                  key:
+                                                    type: string
+                                                  operator:
+                                                    type: string
+                                                  values:
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        storageClassName:
+                                          type: string
+                                        volumeAttributesClassName:
+                                          type: string
+                                        volumeMode:
+                                          type: string
+                                        volumeName:
+                                          type: string
+                                      type: object
+                                  required:
+                                  - spec
+                                  type: object
+                              type: object
+                            fc:
+                              properties:
+                                fsType:
+                                  type: string
+                                lun:
+                                  format: int32
+                                  type: integer
+                                readOnly:
+                                  type: boolean
+                                targetWWNs:
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                wwids:
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              type: object
+                            flexVolume:
+                              properties:
+                                driver:
+                                  type: string
+                                fsType:
+                                  type: string
+                                options:
+                                  additionalProperties:
+                                    type: string
+                                  type: object
+                                readOnly:
+                                  type: boolean
+                                secretRef:
+                                  properties:
+                                    name:
+                                      default: ""
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                              required:
+                              - driver
+                              type: object
+                            flocker:
+                              properties:
+                                datasetName:
+                                  type: string
+                                datasetUUID:
+                                  type: string
+                              type: object
+                            gcePersistentDisk:
+                              properties:
+                                fsType:
+                                  type: string
+                                partition:
+                                  format: int32
+                                  type: integer
+                                pdName:
+                                  type: string
+                                readOnly:
+                                  type: boolean
+                              required:
+                              - pdName
+                              type: object
+                            gitRepo:
+                              properties:
+                                directory:
+                                  type: string
+                                repository:
+                                  type: string
+                                revision:
+                                  type: string
+                              required:
+                              - repository
+                              type: object
+                            glusterfs:
+                              properties:
+                                endpoints:
+                                  type: string
+                                path:
+                                  type: string
+                                readOnly:
+                                  type: boolean
+                              required:
+                              - endpoints
+                              - path
+                              type: object
+                            hostPath:
+                              properties:
+                                path:
+                                  type: string
+                                type:
+                                  type: string
+                              required:
+                              - path
+                              type: object
+                            image:
+                              properties:
+                                pullPolicy:
+                                  type: string
+                                reference:
+                                  type: string
+                              type: object
+                            iscsi:
+                              properties:
+                                chapAuthDiscovery:
+                                  type: boolean
+                                chapAuthSession:
+                                  type: boolean
+                                fsType:
+                                  type: string
+                                initiatorName:
+                                  type: string
+                                iqn:
+                                  type: string
+                                iscsiInterface:
+                                  default: default
+                                  type: string
+                                lun:
+                                  format: int32
+                                  type: integer
+                                portals:
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                readOnly:
+                                  type: boolean
+                                secretRef:
+                                  properties:
+                                    name:
+                                      default: ""
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                targetPortal:
+                                  type: string
+                              required:
+                              - iqn
+                              - lun
+                              - targetPortal
+                              type: object
+                            name:
+                              type: string
+                            nfs:
+                              properties:
+                                path:
+                                  type: string
+                                readOnly:
+                                  type: boolean
+                                server:
+                                  type: string
+                              required:
+                              - path
+                              - server
+                              type: object
+                            persistentVolumeClaim:
+                              properties:
+                                claimName:
+                                  type: string
+                                readOnly:
+                                  type: boolean
+                              required:
+                              - claimName
+                              type: object
+                            photonPersistentDisk:
+                              properties:
+                                fsType:
+                                  type: string
+                                pdID:
+                                  type: string
+                              required:
+                              - pdID
+                              type: object
+                            portworxVolume:
+                              properties:
+                                fsType:
+                                  type: string
+                                readOnly:
+                                  type: boolean
+                                volumeID:
+                                  type: string
+                              required:
+                              - volumeID
+                              type: object
+                            projected:
+                              properties:
+                                defaultMode:
+                                  format: int32
+                                  type: integer
+                                sources:
+                                  items:
+                                    properties:
+                                      clusterTrustBundle:
+                                        properties:
+                                          labelSelector:
+                                            properties:
+                                              matchExpressions:
+                                                items:
+                                                  properties:
+                                                    key:
+                                                      type: string
+                                                    operator:
+                                                      type: string
+                                                    values:
+                                                      items:
+                                                        type: string
+                                                      type: array
+                                                      x-kubernetes-list-type: atomic
+                                                  required:
+                                                  - key
+                                                  - operator
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              matchLabels:
+                                                additionalProperties:
+                                                  type: string
+                                                type: object
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          name:
+                                            type: string
+                                          optional:
+                                            type: boolean
+                                          path:
+                                            type: string
+                                          signerName:
+                                            type: string
+                                        required:
+                                        - path
+                                        type: object
+                                      configMap:
+                                        properties:
+                                          items:
+                                            items:
+                                              properties:
+                                                key:
+                                                  type: string
+                                                mode:
+                                                  format: int32
+                                                  type: integer
+                                                path:
+                                                  type: string
+                                              required:
+                                              - key
+                                              - path
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          name:
+                                            default: ""
+                                            type: string
+                                          optional:
+                                            type: boolean
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      downwardAPI:
+                                        properties:
+                                          items:
+                                            items:
+                                              properties:
+                                                fieldRef:
+                                                  properties:
+                                                    apiVersion:
+                                                      type: string
+                                                    fieldPath:
+                                                      type: string
+                                                  required:
+                                                  - fieldPath
+                                                  type: object
+                                                  x-kubernetes-map-type: atomic
+                                                mode:
+                                                  format: int32
+                                                  type: integer
+                                                path:
+                                                  type: string
+                                                resourceFieldRef:
+                                                  properties:
+                                                    containerName:
+                                                      type: string
+                                                    divisor:
+                                                      anyOf:
+                                                      - type: integer
+                                                      - type: string
+                                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                      x-kubernetes-int-or-string: true
+                                                    resource:
+                                                      type: string
+                                                  required:
+                                                  - resource
+                                                  type: object
+                                                  x-kubernetes-map-type: atomic
+                                              required:
+                                              - path
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        type: object
+                                      podCertificate:
+                                        properties:
+                                          certificateChainPath:
+                                            type: string
+                                          credentialBundlePath:
+                                            type: string
+                                          keyPath:
+                                            type: string
+                                          keyType:
+                                            type: string
+                                          maxExpirationSeconds:
+                                            format: int32
+                                            type: integer
+                                          signerName:
+                                            type: string
+                                        required:
+                                        - keyType
+                                        - signerName
+                                        type: object
+                                      secret:
+                                        properties:
+                                          items:
+                                            items:
+                                              properties:
+                                                key:
+                                                  type: string
+                                                mode:
+                                                  format: int32
+                                                  type: integer
+                                                path:
+                                                  type: string
+                                              required:
+                                              - key
+                                              - path
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          name:
+                                            default: ""
+                                            type: string
+                                          optional:
+                                            type: boolean
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      serviceAccountToken:
+                                        properties:
+                                          audience:
+                                            type: string
+                                          expirationSeconds:
+                                            format: int64
+                                            type: integer
+                                          path:
+                                            type: string
+                                        required:
+                                        - path
+                                        type: object
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              type: object
+                            quobyte:
+                              properties:
+                                group:
+                                  type: string
+                                readOnly:
+                                  type: boolean
+                                registry:
+                                  type: string
+                                tenant:
+                                  type: string
+                                user:
+                                  type: string
+                                volume:
+                                  type: string
+                              required:
+                              - registry
+                              - volume
+                              type: object
+                            rbd:
+                              properties:
+                                fsType:
+                                  type: string
+                                image:
+                                  type: string
+                                keyring:
+                                  default: /etc/ceph/keyring
+                                  type: string
+                                monitors:
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                pool:
+                                  default: rbd
+                                  type: string
+                                readOnly:
+                                  type: boolean
+                                secretRef:
+                                  properties:
+                                    name:
+                                      default: ""
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                user:
+                                  default: admin
+                                  type: string
+                              required:
+                              - image
+                              - monitors
+                              type: object
+                            scaleIO:
+                              properties:
+                                fsType:
+                                  default: xfs
+                                  type: string
+                                gateway:
+                                  type: string
+                                protectionDomain:
+                                  type: string
+                                readOnly:
+                                  type: boolean
+                                secretRef:
+                                  properties:
+                                    name:
+                                      default: ""
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                sslEnabled:
+                                  type: boolean
+                                storageMode:
+                                  default: ThinProvisioned
+                                  type: string
+                                storagePool:
+                                  type: string
+                                system:
+                                  type: string
+                                volumeName:
+                                  type: string
+                              required:
+                              - gateway
+                              - secretRef
+                              - system
+                              type: object
+                            secret:
+                              properties:
+                                defaultMode:
+                                  format: int32
+                                  type: integer
+                                items:
+                                  items:
+                                    properties:
+                                      key:
+                                        type: string
+                                      mode:
+                                        format: int32
+                                        type: integer
+                                      path:
+                                        type: string
+                                    required:
+                                    - key
+                                    - path
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                optional:
+                                  type: boolean
+                                secretName:
+                                  type: string
+                              type: object
+                            storageos:
+                              properties:
+                                fsType:
+                                  type: string
+                                readOnly:
+                                  type: boolean
+                                secretRef:
+                                  properties:
+                                    name:
+                                      default: ""
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                volumeName:
+                                  type: string
+                                volumeNamespace:
+                                  type: string
+                              type: object
+                            vsphereVolume:
+                              properties:
+                                fsType:
+                                  type: string
+                                storagePolicyID:
+                                  type: string
+                                storagePolicyName:
+                                  type: string
+                                volumePath:
+                                  type: string
+                              required:
+                              - volumePath
+                              type: object
+                          required:
+                          - name
+                          type: object
+                        type: array
+                      vpa:
+                        properties:
+                          recommenders:
+                            items:
+                              properties:
+                                name:
+                                  type: string
+                              required:
+                              - name
+                              type: object
+                            type: array
+                          resourcePolicy:
+                            properties:
+                              containerPolicies:
+                                items:
+                                  properties:
+                                    containerName:
+                                      type: string
+                                    controlledResources:
+                                      items:
+                                        type: string
+                                      type: array
+                                    controlledValues:
+                                      enum:
+                                      - RequestsAndLimits
+                                      - RequestsOnly
+                                      type: string
+                                    maxAllowed:
+                                      additionalProperties:
+                                        anyOf:
+                                        - type: integer
+                                        - type: string
+                                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                        x-kubernetes-int-or-string: true
+                                      type: object
+                                    minAllowed:
+                                      additionalProperties:
+                                        anyOf:
+                                        - type: integer
+                                        - type: string
+                                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                        x-kubernetes-int-or-string: true
+                                      type: object
+                                    mode:
+                                      enum:
+                                      - Auto
+                                      - "Off"
+                                      type: string
+                                  type: object
+                                type: array
+                            type: object
+                          updatePolicy:
+                            properties:
+                              evictionRequirements:
+                                items:
+                                  properties:
+                                    changeRequirement:
+                                      enum:
+                                      - TargetHigherThanRequests
+                                      - TargetLowerThanRequests
+                                      type: string
+                                    resources:
+                                      items:
+                                        type: string
+                                      type: array
+                                  required:
+                                  - changeRequirement
+                                  - resources
+                                  type: object
+                                type: array
+                              minReplicas:
+                                format: int32
+                                type: integer
+                              updateMode:
+                                enum:
+                                - "Off"
+                                - Initial
+                                - Recreate
+                                - InPlaceOrRecreate
+                                - Auto
+                                type: string
+                            type: object
+                        type: object
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                type: object
+              zoneCommon:
+                properties:
+                  readyTimeout:
+                    type: string
+                  remoteWrite:
+                    x-kubernetes-preserve-unknown-fields: true
+                  updatePause:
+                    type: string
+                  vmagent:
+                    properties:
+                      name:
+                        type: string
+                      spec:
+                        properties:
+                          affinity:
+                            properties:
+                              nodeAffinity:
+                                properties:
+                                  preferredDuringSchedulingIgnoredDuringExecution:
+                                    items:
+                                      properties:
+                                        preference:
+                                          properties:
+                                            matchExpressions:
+                                              items:
+                                                properties:
+                                                  key:
+                                                    type: string
+                                                  operator:
+                                                    type: string
+                                                  values:
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchFields:
+                                              items:
+                                                properties:
+                                                  key:
+                                                    type: string
+                                                  operator:
+                                                    type: string
+                                                  values:
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        weight:
+                                          format: int32
+                                          type: integer
+                                      required:
+                                      - preference
+                                      - weight
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  requiredDuringSchedulingIgnoredDuringExecution:
+                                    properties:
+                                      nodeSelectorTerms:
+                                        items:
+                                          properties:
+                                            matchExpressions:
+                                              items:
+                                                properties:
+                                                  key:
+                                                    type: string
+                                                  operator:
+                                                    type: string
+                                                  values:
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchFields:
+                                              items:
+                                                properties:
+                                                  key:
+                                                    type: string
+                                                  operator:
+                                                    type: string
+                                                  values:
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    required:
+                                    - nodeSelectorTerms
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                type: object
+                              podAffinity:
+                                properties:
+                                  preferredDuringSchedulingIgnoredDuringExecution:
+                                    items:
+                                      properties:
+                                        podAffinityTerm:
+                                          properties:
+                                            labelSelector:
+                                              properties:
+                                                matchExpressions:
+                                                  items:
+                                                    properties:
+                                                      key:
+                                                        type: string
+                                                      operator:
+                                                        type: string
+                                                      values:
+                                                        items:
+                                                          type: string
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                    required:
+                                                    - key
+                                                    - operator
+                                                    type: object
+                                                  type: array
+                                                  x-kubernetes-list-type: atomic
+                                                matchLabels:
+                                                  additionalProperties:
+                                                    type: string
+                                                  type: object
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            matchLabelKeys:
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            mismatchLabelKeys:
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            namespaceSelector:
+                                              properties:
+                                                matchExpressions:
+                                                  items:
+                                                    properties:
+                                                      key:
+                                                        type: string
+                                                      operator:
+                                                        type: string
+                                                      values:
+                                                        items:
+                                                          type: string
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                    required:
+                                                    - key
+                                                    - operator
+                                                    type: object
+                                                  type: array
+                                                  x-kubernetes-list-type: atomic
+                                                matchLabels:
+                                                  additionalProperties:
+                                                    type: string
+                                                  type: object
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            namespaces:
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            topologyKey:
+                                              type: string
+                                          required:
+                                          - topologyKey
+                                          type: object
+                                        weight:
+                                          format: int32
+                                          type: integer
+                                      required:
+                                      - podAffinityTerm
+                                      - weight
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  requiredDuringSchedulingIgnoredDuringExecution:
+                                    items:
+                                      properties:
+                                        labelSelector:
+                                          properties:
+                                            matchExpressions:
+                                              items:
+                                                properties:
+                                                  key:
+                                                    type: string
+                                                  operator:
+                                                    type: string
+                                                  values:
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        matchLabelKeys:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        mismatchLabelKeys:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        namespaceSelector:
+                                          properties:
+                                            matchExpressions:
+                                              items:
+                                                properties:
+                                                  key:
+                                                    type: string
+                                                  operator:
+                                                    type: string
+                                                  values:
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        namespaces:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        topologyKey:
+                                          type: string
+                                      required:
+                                      - topologyKey
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                type: object
+                              podAntiAffinity:
+                                properties:
+                                  preferredDuringSchedulingIgnoredDuringExecution:
+                                    items:
+                                      properties:
+                                        podAffinityTerm:
+                                          properties:
+                                            labelSelector:
+                                              properties:
+                                                matchExpressions:
+                                                  items:
+                                                    properties:
+                                                      key:
+                                                        type: string
+                                                      operator:
+                                                        type: string
+                                                      values:
+                                                        items:
+                                                          type: string
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                    required:
+                                                    - key
+                                                    - operator
+                                                    type: object
+                                                  type: array
+                                                  x-kubernetes-list-type: atomic
+                                                matchLabels:
+                                                  additionalProperties:
+                                                    type: string
+                                                  type: object
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            matchLabelKeys:
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            mismatchLabelKeys:
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            namespaceSelector:
+                                              properties:
+                                                matchExpressions:
+                                                  items:
+                                                    properties:
+                                                      key:
+                                                        type: string
+                                                      operator:
+                                                        type: string
+                                                      values:
+                                                        items:
+                                                          type: string
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                    required:
+                                                    - key
+                                                    - operator
+                                                    type: object
+                                                  type: array
+                                                  x-kubernetes-list-type: atomic
+                                                matchLabels:
+                                                  additionalProperties:
+                                                    type: string
+                                                  type: object
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            namespaces:
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            topologyKey:
+                                              type: string
+                                          required:
+                                          - topologyKey
+                                          type: object
+                                        weight:
+                                          format: int32
+                                          type: integer
+                                      required:
+                                      - podAffinityTerm
+                                      - weight
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  requiredDuringSchedulingIgnoredDuringExecution:
+                                    items:
+                                      properties:
+                                        labelSelector:
+                                          properties:
+                                            matchExpressions:
+                                              items:
+                                                properties:
+                                                  key:
+                                                    type: string
+                                                  operator:
+                                                    type: string
+                                                  values:
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        matchLabelKeys:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        mismatchLabelKeys:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        namespaceSelector:
+                                          properties:
+                                            matchExpressions:
+                                              items:
+                                                properties:
+                                                  key:
+                                                    type: string
+                                                  operator:
+                                                    type: string
+                                                  values:
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        namespaces:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        topologyKey:
+                                          type: string
+                                      required:
+                                      - topologyKey
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                type: object
+                            type: object
+                          claimTemplates:
+                            items:
+                              properties:
+                                apiVersion:
+                                  type: string
+                                kind:
+                                  type: string
+                                metadata:
+                                  type: object
+                                spec:
+                                  properties:
+                                    accessModes:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    dataSource:
+                                      properties:
+                                        apiGroup:
+                                          type: string
+                                        kind:
+                                          type: string
+                                        name:
+                                          type: string
+                                      required:
+                                      - kind
+                                      - name
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    dataSourceRef:
+                                      properties:
+                                        apiGroup:
+                                          type: string
+                                        kind:
+                                          type: string
+                                        name:
+                                          type: string
+                                        namespace:
+                                          type: string
+                                      required:
+                                      - kind
+                                      - name
+                                      type: object
+                                    resources:
+                                      properties:
+                                        limits:
+                                          additionalProperties:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                            x-kubernetes-int-or-string: true
+                                          type: object
+                                        requests:
+                                          additionalProperties:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                            x-kubernetes-int-or-string: true
+                                          type: object
+                                      type: object
+                                    selector:
+                                      properties:
+                                        matchExpressions:
+                                          items:
+                                            properties:
+                                              key:
+                                                type: string
+                                              operator:
+                                                type: string
+                                              values:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    storageClassName:
+                                      type: string
+                                    volumeAttributesClassName:
+                                      type: string
+                                    volumeMode:
+                                      type: string
+                                    volumeName:
+                                      type: string
+                                  type: object
+                                status:
+                                  properties:
+                                    accessModes:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    allocatedResourceStatuses:
+                                      additionalProperties:
+                                        type: string
+                                      type: object
+                                      x-kubernetes-map-type: granular
+                                    allocatedResources:
+                                      additionalProperties:
+                                        anyOf:
+                                        - type: integer
+                                        - type: string
+                                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                        x-kubernetes-int-or-string: true
+                                      type: object
+                                    capacity:
+                                      additionalProperties:
+                                        anyOf:
+                                        - type: integer
+                                        - type: string
+                                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                        x-kubernetes-int-or-string: true
+                                      type: object
+                                    conditions:
+                                      items:
+                                        properties:
+                                          lastProbeTime:
+                                            format: date-time
+                                            type: string
+                                          lastTransitionTime:
+                                            format: date-time
+                                            type: string
+                                          message:
+                                            type: string
+                                          reason:
+                                            type: string
+                                          status:
+                                            type: string
+                                          type:
+                                            type: string
+                                        required:
+                                        - status
+                                        - type
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-map-keys:
+                                      - type
+                                      x-kubernetes-list-type: map
+                                    currentVolumeAttributesClassName:
+                                      type: string
+                                    modifyVolumeStatus:
+                                      properties:
+                                        status:
+                                          type: string
+                                        targetVolumeAttributesClassName:
+                                          type: string
+                                      required:
+                                      - status
+                                      type: object
+                                    phase:
+                                      type: string
+                                  type: object
+                              type: object
+                            type: array
+                          configMaps:
+                            items:
+                              type: string
+                            type: array
+                          containers:
+                            items:
+                              properties:
+                                args:
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                command:
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                env:
+                                  items:
+                                    properties:
+                                      name:
+                                        type: string
+                                      value:
+                                        type: string
+                                      valueFrom:
+                                        properties:
+                                          configMapKeyRef:
+                                            properties:
+                                              key:
+                                                type: string
+                                              name:
+                                                default: ""
+                                                type: string
+                                              optional:
+                                                type: boolean
+                                            required:
+                                            - key
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          fieldRef:
+                                            properties:
+                                              apiVersion:
+                                                type: string
+                                              fieldPath:
+                                                type: string
+                                            required:
+                                            - fieldPath
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          fileKeyRef:
+                                            properties:
+                                              key:
+                                                type: string
+                                              optional:
+                                                default: false
+                                                type: boolean
+                                              path:
+                                                type: string
+                                              volumeName:
+                                                type: string
+                                            required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          resourceFieldRef:
+                                            properties:
+                                              containerName:
+                                                type: string
+                                              divisor:
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                x-kubernetes-int-or-string: true
+                                              resource:
+                                                type: string
+                                            required:
+                                            - resource
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          secretKeyRef:
+                                            properties:
+                                              key:
+                                                type: string
+                                              name:
+                                                default: ""
+                                                type: string
+                                              optional:
+                                                type: boolean
+                                            required:
+                                            - key
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                        type: object
+                                    required:
+                                    - name
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-map-keys:
+                                  - name
+                                  x-kubernetes-list-type: map
+                                envFrom:
+                                  items:
+                                    properties:
+                                      configMapRef:
+                                        properties:
+                                          name:
+                                            default: ""
+                                            type: string
+                                          optional:
+                                            type: boolean
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      prefix:
+                                        type: string
+                                      secretRef:
+                                        properties:
+                                          name:
+                                            default: ""
+                                            type: string
+                                          optional:
+                                            type: boolean
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                image:
+                                  type: string
+                                imagePullPolicy:
+                                  type: string
+                                lifecycle:
+                                  properties:
+                                    postStart:
+                                      properties:
+                                        exec:
+                                          properties:
+                                            command:
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                          type: object
+                                        httpGet:
+                                          properties:
+                                            host:
+                                              type: string
+                                            httpHeaders:
+                                              items:
+                                                properties:
+                                                  name:
+                                                    type: string
+                                                  value:
+                                                    type: string
+                                                required:
+                                                - name
+                                                - value
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            path:
+                                              type: string
+                                            port:
+                                              anyOf:
+                                              - type: integer
+                                              - type: string
+                                              x-kubernetes-int-or-string: true
+                                            scheme:
+                                              type: string
+                                          required:
+                                          - port
+                                          type: object
+                                        sleep:
+                                          properties:
+                                            seconds:
+                                              format: int64
+                                              type: integer
+                                          required:
+                                          - seconds
+                                          type: object
+                                        tcpSocket:
+                                          properties:
+                                            host:
+                                              type: string
+                                            port:
+                                              anyOf:
+                                              - type: integer
+                                              - type: string
+                                              x-kubernetes-int-or-string: true
+                                          required:
+                                          - port
+                                          type: object
+                                      type: object
+                                    preStop:
+                                      properties:
+                                        exec:
+                                          properties:
+                                            command:
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                          type: object
+                                        httpGet:
+                                          properties:
+                                            host:
+                                              type: string
+                                            httpHeaders:
+                                              items:
+                                                properties:
+                                                  name:
+                                                    type: string
+                                                  value:
+                                                    type: string
+                                                required:
+                                                - name
+                                                - value
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            path:
+                                              type: string
+                                            port:
+                                              anyOf:
+                                              - type: integer
+                                              - type: string
+                                              x-kubernetes-int-or-string: true
+                                            scheme:
+                                              type: string
+                                          required:
+                                          - port
+                                          type: object
+                                        sleep:
+                                          properties:
+                                            seconds:
+                                              format: int64
+                                              type: integer
+                                          required:
+                                          - seconds
+                                          type: object
+                                        tcpSocket:
+                                          properties:
+                                            host:
+                                              type: string
+                                            port:
+                                              anyOf:
+                                              - type: integer
+                                              - type: string
+                                              x-kubernetes-int-or-string: true
+                                          required:
+                                          - port
+                                          type: object
+                                      type: object
+                                    stopSignal:
+                                      type: string
+                                  type: object
+                                livenessProbe:
+                                  properties:
+                                    exec:
+                                      properties:
+                                        command:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                    failureThreshold:
+                                      format: int32
+                                      type: integer
+                                    grpc:
+                                      properties:
+                                        port:
+                                          format: int32
+                                          type: integer
+                                        service:
+                                          default: ""
+                                          type: string
+                                      required:
+                                      - port
+                                      type: object
+                                    httpGet:
+                                      properties:
+                                        host:
+                                          type: string
+                                        httpHeaders:
+                                          items:
+                                            properties:
+                                              name:
+                                                type: string
+                                              value:
+                                                type: string
+                                            required:
+                                            - name
+                                            - value
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        path:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                        scheme:
+                                          type: string
+                                      required:
+                                      - port
+                                      type: object
+                                    initialDelaySeconds:
+                                      format: int32
+                                      type: integer
+                                    periodSeconds:
+                                      format: int32
+                                      type: integer
+                                    successThreshold:
+                                      format: int32
+                                      type: integer
+                                    tcpSocket:
+                                      properties:
+                                        host:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                      required:
+                                      - port
+                                      type: object
+                                    terminationGracePeriodSeconds:
+                                      format: int64
+                                      type: integer
+                                    timeoutSeconds:
+                                      format: int32
+                                      type: integer
+                                  type: object
+                                name:
+                                  type: string
+                                ports:
+                                  items:
+                                    properties:
+                                      containerPort:
+                                        format: int32
+                                        type: integer
+                                      hostIP:
+                                        type: string
+                                      hostPort:
+                                        format: int32
+                                        type: integer
+                                      name:
+                                        type: string
+                                      protocol:
+                                        default: TCP
+                                        type: string
+                                    required:
+                                    - containerPort
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-map-keys:
+                                  - containerPort
+                                  - protocol
+                                  x-kubernetes-list-type: map
+                                readinessProbe:
+                                  properties:
+                                    exec:
+                                      properties:
+                                        command:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                    failureThreshold:
+                                      format: int32
+                                      type: integer
+                                    grpc:
+                                      properties:
+                                        port:
+                                          format: int32
+                                          type: integer
+                                        service:
+                                          default: ""
+                                          type: string
+                                      required:
+                                      - port
+                                      type: object
+                                    httpGet:
+                                      properties:
+                                        host:
+                                          type: string
+                                        httpHeaders:
+                                          items:
+                                            properties:
+                                              name:
+                                                type: string
+                                              value:
+                                                type: string
+                                            required:
+                                            - name
+                                            - value
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        path:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                        scheme:
+                                          type: string
+                                      required:
+                                      - port
+                                      type: object
+                                    initialDelaySeconds:
+                                      format: int32
+                                      type: integer
+                                    periodSeconds:
+                                      format: int32
+                                      type: integer
+                                    successThreshold:
+                                      format: int32
+                                      type: integer
+                                    tcpSocket:
+                                      properties:
+                                        host:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                      required:
+                                      - port
+                                      type: object
+                                    terminationGracePeriodSeconds:
+                                      format: int64
+                                      type: integer
+                                    timeoutSeconds:
+                                      format: int32
+                                      type: integer
+                                  type: object
+                                resizePolicy:
+                                  items:
+                                    properties:
+                                      resourceName:
+                                        type: string
+                                      restartPolicy:
+                                        type: string
+                                    required:
+                                    - resourceName
+                                    - restartPolicy
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                resources:
+                                  properties:
+                                    claims:
+                                      items:
+                                        properties:
+                                          name:
+                                            type: string
+                                          request:
+                                            type: string
+                                        required:
+                                        - name
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-map-keys:
+                                      - name
+                                      x-kubernetes-list-type: map
+                                    limits:
+                                      additionalProperties:
+                                        anyOf:
+                                        - type: integer
+                                        - type: string
+                                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                        x-kubernetes-int-or-string: true
+                                      type: object
+                                    requests:
+                                      additionalProperties:
+                                        anyOf:
+                                        - type: integer
+                                        - type: string
+                                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                        x-kubernetes-int-or-string: true
+                                      type: object
+                                  type: object
+                                restartPolicy:
+                                  type: string
+                                restartPolicyRules:
+                                  items:
+                                    properties:
+                                      action:
+                                        type: string
+                                      exitCodes:
+                                        properties:
+                                          operator:
+                                            type: string
+                                          values:
+                                            items:
+                                              format: int32
+                                              type: integer
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        required:
+                                        - operator
+                                        type: object
+                                    required:
+                                    - action
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                securityContext:
+                                  properties:
+                                    allowPrivilegeEscalation:
+                                      type: boolean
+                                    appArmorProfile:
+                                      properties:
+                                        localhostProfile:
+                                          type: string
+                                        type:
+                                          type: string
+                                      required:
+                                      - type
+                                      type: object
+                                    capabilities:
+                                      properties:
+                                        add:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        drop:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                    privileged:
+                                      type: boolean
+                                    procMount:
+                                      type: string
+                                    readOnlyRootFilesystem:
+                                      type: boolean
+                                    runAsGroup:
+                                      format: int64
+                                      type: integer
+                                    runAsNonRoot:
+                                      type: boolean
+                                    runAsUser:
+                                      format: int64
+                                      type: integer
+                                    seLinuxOptions:
+                                      properties:
+                                        level:
+                                          type: string
+                                        role:
+                                          type: string
+                                        type:
+                                          type: string
+                                        user:
+                                          type: string
+                                      type: object
+                                    seccompProfile:
+                                      properties:
+                                        localhostProfile:
+                                          type: string
+                                        type:
+                                          type: string
+                                      required:
+                                      - type
+                                      type: object
+                                    windowsOptions:
+                                      properties:
+                                        gmsaCredentialSpec:
+                                          type: string
+                                        gmsaCredentialSpecName:
+                                          type: string
+                                        hostProcess:
+                                          type: boolean
+                                        runAsUserName:
+                                          type: string
+                                      type: object
+                                  type: object
+                                startupProbe:
+                                  properties:
+                                    exec:
+                                      properties:
+                                        command:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                    failureThreshold:
+                                      format: int32
+                                      type: integer
+                                    grpc:
+                                      properties:
+                                        port:
+                                          format: int32
+                                          type: integer
+                                        service:
+                                          default: ""
+                                          type: string
+                                      required:
+                                      - port
+                                      type: object
+                                    httpGet:
+                                      properties:
+                                        host:
+                                          type: string
+                                        httpHeaders:
+                                          items:
+                                            properties:
+                                              name:
+                                                type: string
+                                              value:
+                                                type: string
+                                            required:
+                                            - name
+                                            - value
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        path:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                        scheme:
+                                          type: string
+                                      required:
+                                      - port
+                                      type: object
+                                    initialDelaySeconds:
+                                      format: int32
+                                      type: integer
+                                    periodSeconds:
+                                      format: int32
+                                      type: integer
+                                    successThreshold:
+                                      format: int32
+                                      type: integer
+                                    tcpSocket:
+                                      properties:
+                                        host:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                      required:
+                                      - port
+                                      type: object
+                                    terminationGracePeriodSeconds:
+                                      format: int64
+                                      type: integer
+                                    timeoutSeconds:
+                                      format: int32
+                                      type: integer
+                                  type: object
+                                stdin:
+                                  type: boolean
+                                stdinOnce:
+                                  type: boolean
+                                terminationMessagePath:
+                                  type: string
+                                terminationMessagePolicy:
+                                  type: string
+                                tty:
+                                  type: boolean
+                                volumeDevices:
+                                  items:
+                                    properties:
+                                      devicePath:
+                                        type: string
+                                      name:
+                                        type: string
+                                    required:
+                                    - devicePath
+                                    - name
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-map-keys:
+                                  - devicePath
+                                  x-kubernetes-list-type: map
+                                volumeMounts:
+                                  items:
+                                    properties:
+                                      mountPath:
+                                        type: string
+                                      mountPropagation:
+                                        type: string
+                                      name:
+                                        type: string
+                                      readOnly:
+                                        type: boolean
+                                      recursiveReadOnly:
+                                        type: string
+                                      subPath:
+                                        type: string
+                                      subPathExpr:
+                                        type: string
+                                    required:
+                                    - mountPath
+                                    - name
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-map-keys:
+                                  - mountPath
+                                  x-kubernetes-list-type: map
+                                workingDir:
+                                  type: string
+                              required:
+                              - name
+                              type: object
+                            type: array
+                          disableAutomountServiceAccountToken:
+                            type: boolean
+                          disableSelfServiceScrape:
+                            type: boolean
+                          dnsConfig:
+                            properties:
+                              nameservers:
+                                items:
+                                  type: string
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              options:
+                                items:
+                                  properties:
+                                    name:
+                                      type: string
+                                    value:
+                                      type: string
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              searches:
+                                items:
+                                  type: string
+                                type: array
+                                x-kubernetes-list-type: atomic
+                            type: object
+                          dnsPolicy:
+                            type: string
+                          extraArgs:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          extraEnvs:
+                            items:
+                              properties:
+                                name:
+                                  type: string
+                                value:
+                                  type: string
+                                valueFrom:
+                                  properties:
+                                    configMapKeyRef:
+                                      properties:
+                                        key:
+                                          type: string
+                                        name:
+                                          default: ""
+                                          type: string
+                                        optional:
+                                          type: boolean
+                                      required:
+                                      - key
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    fieldRef:
+                                      properties:
+                                        apiVersion:
+                                          type: string
+                                        fieldPath:
+                                          type: string
+                                      required:
+                                      - fieldPath
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    fileKeyRef:
+                                      properties:
+                                        key:
+                                          type: string
+                                        optional:
+                                          default: false
+                                          type: boolean
+                                        path:
+                                          type: string
+                                        volumeName:
+                                          type: string
+                                      required:
+                                      - key
+                                      - path
+                                      - volumeName
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    resourceFieldRef:
+                                      properties:
+                                        containerName:
+                                          type: string
+                                        divisor:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          x-kubernetes-int-or-string: true
+                                        resource:
+                                          type: string
+                                      required:
+                                      - resource
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    secretKeyRef:
+                                      properties:
+                                        key:
+                                          type: string
+                                        name:
+                                          default: ""
+                                          type: string
+                                        optional:
+                                          type: boolean
+                                      required:
+                                      - key
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                  type: object
+                              required:
+                              - name
+                              type: object
+                            type: array
+                          extraEnvsFrom:
+                            items:
+                              properties:
+                                configMapRef:
+                                  properties:
+                                    name:
+                                      default: ""
+                                      type: string
+                                    optional:
+                                      type: boolean
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                prefix:
+                                  type: string
+                                secretRef:
+                                  properties:
+                                    name:
+                                      default: ""
+                                      type: string
+                                    optional:
+                                      type: boolean
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                              type: object
+                            type: array
+                          host_aliases:
+                            items:
+                              properties:
+                                hostnames:
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                ip:
+                                  type: string
+                              required:
+                              - ip
+                              type: object
+                            type: array
+                          hostAliases:
+                            items:
+                              properties:
+                                hostnames:
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                ip:
+                                  type: string
+                              required:
+                              - ip
+                              type: object
+                            type: array
+                          hostNetwork:
+                            type: boolean
+                          image:
+                            properties:
+                              pullPolicy:
+                                type: string
+                              repository:
+                                type: string
+                              tag:
+                                type: string
+                            type: object
+                          imagePullSecrets:
+                            items:
+                              properties:
+                                name:
+                                  default: ""
+                                  type: string
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            type: array
+                          initContainers:
+                            items:
+                              properties:
+                                args:
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                command:
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                env:
+                                  items:
+                                    properties:
+                                      name:
+                                        type: string
+                                      value:
+                                        type: string
+                                      valueFrom:
+                                        properties:
+                                          configMapKeyRef:
+                                            properties:
+                                              key:
+                                                type: string
+                                              name:
+                                                default: ""
+                                                type: string
+                                              optional:
+                                                type: boolean
+                                            required:
+                                            - key
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          fieldRef:
+                                            properties:
+                                              apiVersion:
+                                                type: string
+                                              fieldPath:
+                                                type: string
+                                            required:
+                                            - fieldPath
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          fileKeyRef:
+                                            properties:
+                                              key:
+                                                type: string
+                                              optional:
+                                                default: false
+                                                type: boolean
+                                              path:
+                                                type: string
+                                              volumeName:
+                                                type: string
+                                            required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          resourceFieldRef:
+                                            properties:
+                                              containerName:
+                                                type: string
+                                              divisor:
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                x-kubernetes-int-or-string: true
+                                              resource:
+                                                type: string
+                                            required:
+                                            - resource
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          secretKeyRef:
+                                            properties:
+                                              key:
+                                                type: string
+                                              name:
+                                                default: ""
+                                                type: string
+                                              optional:
+                                                type: boolean
+                                            required:
+                                            - key
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                        type: object
+                                    required:
+                                    - name
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-map-keys:
+                                  - name
+                                  x-kubernetes-list-type: map
+                                envFrom:
+                                  items:
+                                    properties:
+                                      configMapRef:
+                                        properties:
+                                          name:
+                                            default: ""
+                                            type: string
+                                          optional:
+                                            type: boolean
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      prefix:
+                                        type: string
+                                      secretRef:
+                                        properties:
+                                          name:
+                                            default: ""
+                                            type: string
+                                          optional:
+                                            type: boolean
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                image:
+                                  type: string
+                                imagePullPolicy:
+                                  type: string
+                                lifecycle:
+                                  properties:
+                                    postStart:
+                                      properties:
+                                        exec:
+                                          properties:
+                                            command:
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                          type: object
+                                        httpGet:
+                                          properties:
+                                            host:
+                                              type: string
+                                            httpHeaders:
+                                              items:
+                                                properties:
+                                                  name:
+                                                    type: string
+                                                  value:
+                                                    type: string
+                                                required:
+                                                - name
+                                                - value
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            path:
+                                              type: string
+                                            port:
+                                              anyOf:
+                                              - type: integer
+                                              - type: string
+                                              x-kubernetes-int-or-string: true
+                                            scheme:
+                                              type: string
+                                          required:
+                                          - port
+                                          type: object
+                                        sleep:
+                                          properties:
+                                            seconds:
+                                              format: int64
+                                              type: integer
+                                          required:
+                                          - seconds
+                                          type: object
+                                        tcpSocket:
+                                          properties:
+                                            host:
+                                              type: string
+                                            port:
+                                              anyOf:
+                                              - type: integer
+                                              - type: string
+                                              x-kubernetes-int-or-string: true
+                                          required:
+                                          - port
+                                          type: object
+                                      type: object
+                                    preStop:
+                                      properties:
+                                        exec:
+                                          properties:
+                                            command:
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                          type: object
+                                        httpGet:
+                                          properties:
+                                            host:
+                                              type: string
+                                            httpHeaders:
+                                              items:
+                                                properties:
+                                                  name:
+                                                    type: string
+                                                  value:
+                                                    type: string
+                                                required:
+                                                - name
+                                                - value
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            path:
+                                              type: string
+                                            port:
+                                              anyOf:
+                                              - type: integer
+                                              - type: string
+                                              x-kubernetes-int-or-string: true
+                                            scheme:
+                                              type: string
+                                          required:
+                                          - port
+                                          type: object
+                                        sleep:
+                                          properties:
+                                            seconds:
+                                              format: int64
+                                              type: integer
+                                          required:
+                                          - seconds
+                                          type: object
+                                        tcpSocket:
+                                          properties:
+                                            host:
+                                              type: string
+                                            port:
+                                              anyOf:
+                                              - type: integer
+                                              - type: string
+                                              x-kubernetes-int-or-string: true
+                                          required:
+                                          - port
+                                          type: object
+                                      type: object
+                                    stopSignal:
+                                      type: string
+                                  type: object
+                                livenessProbe:
+                                  properties:
+                                    exec:
+                                      properties:
+                                        command:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                    failureThreshold:
+                                      format: int32
+                                      type: integer
+                                    grpc:
+                                      properties:
+                                        port:
+                                          format: int32
+                                          type: integer
+                                        service:
+                                          default: ""
+                                          type: string
+                                      required:
+                                      - port
+                                      type: object
+                                    httpGet:
+                                      properties:
+                                        host:
+                                          type: string
+                                        httpHeaders:
+                                          items:
+                                            properties:
+                                              name:
+                                                type: string
+                                              value:
+                                                type: string
+                                            required:
+                                            - name
+                                            - value
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        path:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                        scheme:
+                                          type: string
+                                      required:
+                                      - port
+                                      type: object
+                                    initialDelaySeconds:
+                                      format: int32
+                                      type: integer
+                                    periodSeconds:
+                                      format: int32
+                                      type: integer
+                                    successThreshold:
+                                      format: int32
+                                      type: integer
+                                    tcpSocket:
+                                      properties:
+                                        host:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                      required:
+                                      - port
+                                      type: object
+                                    terminationGracePeriodSeconds:
+                                      format: int64
+                                      type: integer
+                                    timeoutSeconds:
+                                      format: int32
+                                      type: integer
+                                  type: object
+                                name:
+                                  type: string
+                                ports:
+                                  items:
+                                    properties:
+                                      containerPort:
+                                        format: int32
+                                        type: integer
+                                      hostIP:
+                                        type: string
+                                      hostPort:
+                                        format: int32
+                                        type: integer
+                                      name:
+                                        type: string
+                                      protocol:
+                                        default: TCP
+                                        type: string
+                                    required:
+                                    - containerPort
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-map-keys:
+                                  - containerPort
+                                  - protocol
+                                  x-kubernetes-list-type: map
+                                readinessProbe:
+                                  properties:
+                                    exec:
+                                      properties:
+                                        command:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                    failureThreshold:
+                                      format: int32
+                                      type: integer
+                                    grpc:
+                                      properties:
+                                        port:
+                                          format: int32
+                                          type: integer
+                                        service:
+                                          default: ""
+                                          type: string
+                                      required:
+                                      - port
+                                      type: object
+                                    httpGet:
+                                      properties:
+                                        host:
+                                          type: string
+                                        httpHeaders:
+                                          items:
+                                            properties:
+                                              name:
+                                                type: string
+                                              value:
+                                                type: string
+                                            required:
+                                            - name
+                                            - value
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        path:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                        scheme:
+                                          type: string
+                                      required:
+                                      - port
+                                      type: object
+                                    initialDelaySeconds:
+                                      format: int32
+                                      type: integer
+                                    periodSeconds:
+                                      format: int32
+                                      type: integer
+                                    successThreshold:
+                                      format: int32
+                                      type: integer
+                                    tcpSocket:
+                                      properties:
+                                        host:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                      required:
+                                      - port
+                                      type: object
+                                    terminationGracePeriodSeconds:
+                                      format: int64
+                                      type: integer
+                                    timeoutSeconds:
+                                      format: int32
+                                      type: integer
+                                  type: object
+                                resizePolicy:
+                                  items:
+                                    properties:
+                                      resourceName:
+                                        type: string
+                                      restartPolicy:
+                                        type: string
+                                    required:
+                                    - resourceName
+                                    - restartPolicy
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                resources:
+                                  properties:
+                                    claims:
+                                      items:
+                                        properties:
+                                          name:
+                                            type: string
+                                          request:
+                                            type: string
+                                        required:
+                                        - name
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-map-keys:
+                                      - name
+                                      x-kubernetes-list-type: map
+                                    limits:
+                                      additionalProperties:
+                                        anyOf:
+                                        - type: integer
+                                        - type: string
+                                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                        x-kubernetes-int-or-string: true
+                                      type: object
+                                    requests:
+                                      additionalProperties:
+                                        anyOf:
+                                        - type: integer
+                                        - type: string
+                                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                        x-kubernetes-int-or-string: true
+                                      type: object
+                                  type: object
+                                restartPolicy:
+                                  type: string
+                                restartPolicyRules:
+                                  items:
+                                    properties:
+                                      action:
+                                        type: string
+                                      exitCodes:
+                                        properties:
+                                          operator:
+                                            type: string
+                                          values:
+                                            items:
+                                              format: int32
+                                              type: integer
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        required:
+                                        - operator
+                                        type: object
+                                    required:
+                                    - action
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                securityContext:
+                                  properties:
+                                    allowPrivilegeEscalation:
+                                      type: boolean
+                                    appArmorProfile:
+                                      properties:
+                                        localhostProfile:
+                                          type: string
+                                        type:
+                                          type: string
+                                      required:
+                                      - type
+                                      type: object
+                                    capabilities:
+                                      properties:
+                                        add:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        drop:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                    privileged:
+                                      type: boolean
+                                    procMount:
+                                      type: string
+                                    readOnlyRootFilesystem:
+                                      type: boolean
+                                    runAsGroup:
+                                      format: int64
+                                      type: integer
+                                    runAsNonRoot:
+                                      type: boolean
+                                    runAsUser:
+                                      format: int64
+                                      type: integer
+                                    seLinuxOptions:
+                                      properties:
+                                        level:
+                                          type: string
+                                        role:
+                                          type: string
+                                        type:
+                                          type: string
+                                        user:
+                                          type: string
+                                      type: object
+                                    seccompProfile:
+                                      properties:
+                                        localhostProfile:
+                                          type: string
+                                        type:
+                                          type: string
+                                      required:
+                                      - type
+                                      type: object
+                                    windowsOptions:
+                                      properties:
+                                        gmsaCredentialSpec:
+                                          type: string
+                                        gmsaCredentialSpecName:
+                                          type: string
+                                        hostProcess:
+                                          type: boolean
+                                        runAsUserName:
+                                          type: string
+                                      type: object
+                                  type: object
+                                startupProbe:
+                                  properties:
+                                    exec:
+                                      properties:
+                                        command:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                    failureThreshold:
+                                      format: int32
+                                      type: integer
+                                    grpc:
+                                      properties:
+                                        port:
+                                          format: int32
+                                          type: integer
+                                        service:
+                                          default: ""
+                                          type: string
+                                      required:
+                                      - port
+                                      type: object
+                                    httpGet:
+                                      properties:
+                                        host:
+                                          type: string
+                                        httpHeaders:
+                                          items:
+                                            properties:
+                                              name:
+                                                type: string
+                                              value:
+                                                type: string
+                                            required:
+                                            - name
+                                            - value
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        path:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                        scheme:
+                                          type: string
+                                      required:
+                                      - port
+                                      type: object
+                                    initialDelaySeconds:
+                                      format: int32
+                                      type: integer
+                                    periodSeconds:
+                                      format: int32
+                                      type: integer
+                                    successThreshold:
+                                      format: int32
+                                      type: integer
+                                    tcpSocket:
+                                      properties:
+                                        host:
+                                          type: string
+                                        port:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          x-kubernetes-int-or-string: true
+                                      required:
+                                      - port
+                                      type: object
+                                    terminationGracePeriodSeconds:
+                                      format: int64
+                                      type: integer
+                                    timeoutSeconds:
+                                      format: int32
+                                      type: integer
+                                  type: object
+                                stdin:
+                                  type: boolean
+                                stdinOnce:
+                                  type: boolean
+                                terminationMessagePath:
+                                  type: string
+                                terminationMessagePolicy:
+                                  type: string
+                                tty:
+                                  type: boolean
+                                volumeDevices:
+                                  items:
+                                    properties:
+                                      devicePath:
+                                        type: string
+                                      name:
+                                        type: string
+                                    required:
+                                    - devicePath
+                                    - name
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-map-keys:
+                                  - devicePath
+                                  x-kubernetes-list-type: map
+                                volumeMounts:
+                                  items:
+                                    properties:
+                                      mountPath:
+                                        type: string
+                                      mountPropagation:
+                                        type: string
+                                      name:
+                                        type: string
+                                      readOnly:
+                                        type: boolean
+                                      recursiveReadOnly:
+                                        type: string
+                                      subPath:
+                                        type: string
+                                      subPathExpr:
+                                        type: string
+                                    required:
+                                    - mountPath
+                                    - name
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-map-keys:
+                                  - mountPath
+                                  x-kubernetes-list-type: map
+                                workingDir:
+                                  type: string
+                              required:
+                              - name
+                              type: object
+                            type: array
+                          license:
+                            properties:
+                              forceOffline:
+                                type: boolean
+                              key:
+                                type: string
+                              keyRef:
+                                properties:
+                                  key:
+                                    type: string
+                                  name:
+                                    default: ""
+                                    type: string
+                                  optional:
+                                    type: boolean
+                                required:
+                                - key
+                                type: object
+                                x-kubernetes-map-type: atomic
+                              reloadInterval:
+                                type: string
+                            type: object
+                          livenessProbe:
+                            properties:
+                              exec:
+                                properties:
+                                  command:
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                type: object
+                              failureThreshold:
+                                format: int32
+                                type: integer
+                              grpc:
+                                properties:
+                                  port:
+                                    format: int32
+                                    type: integer
+                                  service:
+                                    default: ""
+                                    type: string
+                                required:
+                                - port
+                                type: object
+                              httpGet:
+                                properties:
+                                  host:
+                                    type: string
+                                  httpHeaders:
+                                    items:
+                                      properties:
+                                        name:
+                                          type: string
+                                        value:
+                                          type: string
+                                      required:
+                                      - name
+                                      - value
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  path:
+                                    type: string
+                                  port:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    x-kubernetes-int-or-string: true
+                                  scheme:
+                                    type: string
+                                required:
+                                - port
+                                type: object
+                              initialDelaySeconds:
+                                format: int32
+                                type: integer
+                              periodSeconds:
+                                format: int32
+                                type: integer
+                              successThreshold:
+                                format: int32
+                                type: integer
+                              tcpSocket:
+                                properties:
+                                  host:
+                                    type: string
+                                  port:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    x-kubernetes-int-or-string: true
+                                required:
+                                - port
+                                type: object
+                              terminationGracePeriodSeconds:
+                                format: int64
+                                type: integer
+                              timeoutSeconds:
+                                format: int32
+                                type: integer
+                            type: object
+                          logFormat:
+                            enum:
+                            - default
+                            - json
+                            type: string
+                          logLevel:
+                            enum:
+                            - INFO
+                            - WARN
+                            - ERROR
+                            - FATAL
+                            - PANIC
+                            type: string
+                          managedMetadata:
+                            properties:
+                              annotations:
+                                additionalProperties:
+                                  type: string
+                                type: object
+                              labels:
+                                additionalProperties:
+                                  type: string
+                                type: object
+                            type: object
+                          minReadySeconds:
+                            format: int32
+                            type: integer
+                          nodeSelector:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          paused:
+                            type: boolean
+                          persistentVolumeClaimRetentionPolicy:
+                            properties:
+                              whenDeleted:
+                                type: string
+                              whenScaled:
+                                type: string
+                            type: object
+                          podDisruptionBudget:
+                            properties:
+                              maxUnavailable:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                x-kubernetes-int-or-string: true
+                              minAvailable:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                x-kubernetes-int-or-string: true
+                              selectorLabels:
+                                additionalProperties:
+                                  type: string
+                                type: object
+                              unhealthyPodEvictionPolicy:
+                                enum:
+                                - IfHealthyBudget
+                                - AlwaysAllow
+                                type: string
+                            type: object
+                          podMetadata:
+                            properties:
+                              annotations:
+                                additionalProperties:
+                                  type: string
+                                type: object
+                              labels:
+                                additionalProperties:
+                                  type: string
+                                type: object
+                              name:
+                                type: string
+                            type: object
+                          port:
+                            type: string
+                          priorityClassName:
+                            type: string
+                          readinessGates:
+                            items:
+                              properties:
+                                conditionType:
+                                  type: string
+                              required:
+                              - conditionType
+                              type: object
+                            type: array
+                          readinessProbe:
+                            properties:
+                              exec:
+                                properties:
+                                  command:
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                type: object
+                              failureThreshold:
+                                format: int32
+                                type: integer
+                              grpc:
+                                properties:
+                                  port:
+                                    format: int32
+                                    type: integer
+                                  service:
+                                    default: ""
+                                    type: string
+                                required:
+                                - port
+                                type: object
+                              httpGet:
+                                properties:
+                                  host:
+                                    type: string
+                                  httpHeaders:
+                                    items:
+                                      properties:
+                                        name:
+                                          type: string
+                                        value:
+                                          type: string
+                                      required:
+                                      - name
+                                      - value
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  path:
+                                    type: string
+                                  port:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    x-kubernetes-int-or-string: true
+                                  scheme:
+                                    type: string
+                                required:
+                                - port
+                                type: object
+                              initialDelaySeconds:
+                                format: int32
+                                type: integer
+                              periodSeconds:
+                                format: int32
+                                type: integer
+                              successThreshold:
+                                format: int32
+                                type: integer
+                              tcpSocket:
+                                properties:
+                                  host:
+                                    type: string
+                                  port:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    x-kubernetes-int-or-string: true
+                                required:
+                                - port
+                                type: object
+                              terminationGracePeriodSeconds:
+                                format: int64
+                                type: integer
+                              timeoutSeconds:
+                                format: int32
+                                type: integer
+                            type: object
+                          remoteWriteSettings:
+                            properties:
+                              flushInterval:
+                                pattern: '[0-9]+(ms|s|m|h)'
+                                type: string
+                              label:
+                                additionalProperties:
+                                  type: string
+                                type: object
+                              maxBlockSize:
+                                format: int32
+                                type: integer
+                              maxDiskUsagePerURL:
+                                x-kubernetes-preserve-unknown-fields: true
+                              queues:
+                                format: int32
+                                type: integer
+                              showURL:
+                                type: boolean
+                              tmpDataPath:
+                                type: string
+                              useMultiTenantMode:
+                                type: boolean
+                            type: object
+                          replicaCount:
+                            format: int32
+                            type: integer
+                          resources:
+                            properties:
+                              claims:
+                                items:
+                                  properties:
+                                    name:
+                                      type: string
+                                    request:
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
+                                type: array
+                                x-kubernetes-list-map-keys:
+                                - name
+                                x-kubernetes-list-type: map
+                              limits:
+                                additionalProperties:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                type: object
+                              requests:
+                                additionalProperties:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                type: object
+                            type: object
+                          revisionHistoryLimitCount:
+                            format: int32
+                            type: integer
+                          rollingUpdate:
+                            properties:
+                              maxSurge:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                x-kubernetes-int-or-string: true
+                              maxUnavailable:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                x-kubernetes-int-or-string: true
+                            type: object
+                          runtimeClassName:
+                            type: string
+                          schedulerName:
+                            type: string
+                          secrets:
+                            items:
+                              type: string
+                            type: array
+                          securityContext:
+                            properties:
+                              allowPrivilegeEscalation:
+                                type: boolean
+                              appArmorProfile:
+                                properties:
+                                  localhostProfile:
+                                    type: string
+                                  type:
+                                    type: string
+                                required:
+                                - type
+                                type: object
+                              capabilities:
+                                properties:
+                                  add:
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  drop:
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                type: object
+                              fsGroup:
+                                format: int64
+                                type: integer
+                              fsGroupChangePolicy:
+                                type: string
+                              privileged:
+                                type: boolean
+                              procMount:
+                                type: string
+                              readOnlyRootFilesystem:
+                                type: boolean
+                              runAsGroup:
+                                format: int64
+                                type: integer
+                              runAsNonRoot:
+                                type: boolean
+                              runAsUser:
+                                format: int64
+                                type: integer
+                              seLinuxChangePolicy:
+                                type: string
+                              seLinuxOptions:
+                                properties:
+                                  level:
+                                    type: string
+                                  role:
+                                    type: string
+                                  type:
+                                    type: string
+                                  user:
+                                    type: string
+                                type: object
+                              seccompProfile:
+                                properties:
+                                  localhostProfile:
+                                    type: string
+                                  type:
+                                    type: string
+                                required:
+                                - type
+                                type: object
+                              supplementalGroups:
+                                items:
+                                  format: int64
+                                  type: integer
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              supplementalGroupsPolicy:
+                                type: string
+                              sysctls:
+                                items:
+                                  properties:
+                                    name:
+                                      type: string
+                                    value:
+                                      type: string
+                                  required:
+                                  - name
+                                  - value
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              windowsOptions:
+                                properties:
+                                  gmsaCredentialSpec:
+                                    type: string
+                                  gmsaCredentialSpecName:
+                                    type: string
+                                  hostProcess:
+                                    type: boolean
+                                  runAsUserName:
+                                    type: string
+                                type: object
+                            type: object
+                          serviceAccountName:
+                            type: string
+                          startupProbe:
+                            properties:
+                              exec:
+                                properties:
+                                  command:
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                type: object
+                              failureThreshold:
+                                format: int32
+                                type: integer
+                              grpc:
+                                properties:
+                                  port:
+                                    format: int32
+                                    type: integer
+                                  service:
+                                    default: ""
+                                    type: string
+                                required:
+                                - port
+                                type: object
+                              httpGet:
+                                properties:
+                                  host:
+                                    type: string
+                                  httpHeaders:
+                                    items:
+                                      properties:
+                                        name:
+                                          type: string
+                                        value:
+                                          type: string
+                                      required:
+                                      - name
+                                      - value
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  path:
+                                    type: string
+                                  port:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    x-kubernetes-int-or-string: true
+                                  scheme:
+                                    type: string
+                                required:
+                                - port
+                                type: object
+                              initialDelaySeconds:
+                                format: int32
+                                type: integer
+                              periodSeconds:
+                                format: int32
+                                type: integer
+                              successThreshold:
+                                format: int32
+                                type: integer
+                              tcpSocket:
+                                properties:
+                                  host:
+                                    type: string
+                                  port:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    x-kubernetes-int-or-string: true
+                                required:
+                                - port
+                                type: object
+                              terminationGracePeriodSeconds:
+                                format: int64
+                                type: integer
+                              timeoutSeconds:
+                                format: int32
+                                type: integer
+                            type: object
+                          statefulMode:
+                            type: boolean
+                          statefulRollingUpdateStrategy:
+                            type: string
+                          statefulStorage:
+                            properties:
+                              emptyDir:
+                                properties:
+                                  medium:
+                                    type: string
+                                  sizeLimit:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                type: object
+                              volumeClaimTemplate:
+                                properties:
+                                  apiVersion:
+                                    type: string
+                                  kind:
+                                    type: string
+                                  metadata:
+                                    properties:
+                                      annotations:
+                                        additionalProperties:
+                                          type: string
+                                        type: object
+                                      labels:
+                                        additionalProperties:
+                                          type: string
+                                        type: object
+                                      name:
+                                        type: string
+                                    type: object
+                                  spec:
+                                    properties:
+                                      accessModes:
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      dataSource:
+                                        properties:
+                                          apiGroup:
+                                            type: string
+                                          kind:
+                                            type: string
+                                          name:
+                                            type: string
+                                        required:
+                                        - kind
+                                        - name
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      dataSourceRef:
+                                        properties:
+                                          apiGroup:
+                                            type: string
+                                          kind:
+                                            type: string
+                                          name:
+                                            type: string
+                                          namespace:
+                                            type: string
+                                        required:
+                                        - kind
+                                        - name
+                                        type: object
+                                      resources:
+                                        properties:
+                                          limits:
+                                            additionalProperties:
+                                              anyOf:
+                                              - type: integer
+                                              - type: string
+                                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                              x-kubernetes-int-or-string: true
+                                            type: object
+                                          requests:
+                                            additionalProperties:
+                                              anyOf:
+                                              - type: integer
+                                              - type: string
+                                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                              x-kubernetes-int-or-string: true
+                                            type: object
+                                        type: object
+                                      selector:
+                                        properties:
+                                          matchExpressions:
+                                            items:
+                                              properties:
+                                                key:
+                                                  type: string
+                                                operator:
+                                                  type: string
+                                                values:
+                                                  items:
+                                                    type: string
+                                                  type: array
+                                                  x-kubernetes-list-type: atomic
+                                              required:
+                                              - key
+                                              - operator
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          matchLabels:
+                                            additionalProperties:
+                                              type: string
+                                            type: object
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      storageClassName:
+                                        type: string
+                                      volumeAttributesClassName:
+                                        type: string
+                                      volumeMode:
+                                        type: string
+                                      volumeName:
+                                        type: string
+                                    type: object
+                                  status:
+                                    properties:
+                                      accessModes:
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      allocatedResourceStatuses:
+                                        additionalProperties:
+                                          type: string
+                                        type: object
+                                        x-kubernetes-map-type: granular
+                                      allocatedResources:
+                                        additionalProperties:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          x-kubernetes-int-or-string: true
+                                        type: object
+                                      capacity:
+                                        additionalProperties:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          x-kubernetes-int-or-string: true
+                                        type: object
+                                      conditions:
+                                        items:
+                                          properties:
+                                            lastProbeTime:
+                                              format: date-time
+                                              type: string
+                                            lastTransitionTime:
+                                              format: date-time
+                                              type: string
+                                            message:
+                                              type: string
+                                            reason:
+                                              type: string
+                                            status:
+                                              type: string
+                                            type:
+                                              type: string
+                                          required:
+                                          - status
+                                          - type
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-map-keys:
+                                        - type
+                                        x-kubernetes-list-type: map
+                                      currentVolumeAttributesClassName:
+                                        type: string
+                                      modifyVolumeStatus:
+                                        properties:
+                                          status:
+                                            type: string
+                                          targetVolumeAttributesClassName:
+                                            type: string
+                                        required:
+                                        - status
+                                        type: object
+                                      phase:
+                                        type: string
+                                    type: object
+                                type: object
+                            type: object
+                          terminationGracePeriodSeconds:
+                            format: int64
+                            type: integer
+                          tolerations:
+                            items:
+                              properties:
+                                effect:
+                                  type: string
+                                key:
+                                  type: string
+                                operator:
+                                  type: string
+                                tolerationSeconds:
+                                  format: int64
+                                  type: integer
+                                value:
+                                  type: string
+                              type: object
+                            type: array
+                          topologySpreadConstraints:
+                            items:
+                              properties:
+                                labelSelector:
+                                  properties:
+                                    matchExpressions:
+                                      items:
+                                        properties:
+                                          key:
+                                            type: string
+                                          operator:
+                                            type: string
+                                          values:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchLabels:
+                                      additionalProperties:
+                                        type: string
+                                      type: object
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                matchLabelKeys:
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                maxSkew:
+                                  format: int32
+                                  type: integer
+                                minDomains:
+                                  format: int32
+                                  type: integer
+                                nodeAffinityPolicy:
+                                  type: string
+                                nodeTaintsPolicy:
+                                  type: string
+                                topologyKey:
+                                  type: string
+                                whenUnsatisfiable:
+                                  type: string
+                              required:
+                              - maxSkew
+                              - topologyKey
+                              - whenUnsatisfiable
+                              type: object
+                            type: array
+                          updateStrategy:
+                            enum:
+                            - Recreate
+                            - RollingUpdate
+                            type: string
+                          useDefaultResources:
+                            type: boolean
+                          useStrictSecurity:
+                            type: boolean
+                          volumeMounts:
+                            items:
+                              properties:
+                                mountPath:
+                                  type: string
+                                mountPropagation:
+                                  type: string
+                                name:
+                                  type: string
+                                readOnly:
+                                  type: boolean
+                                recursiveReadOnly:
+                                  type: string
+                                subPath:
+                                  type: string
+                                subPathExpr:
+                                  type: string
+                              required:
+                              - mountPath
+                              - name
+                              type: object
+                            type: array
+                          volumes:
+                            items:
+                              properties:
+                                awsElasticBlockStore:
+                                  properties:
+                                    fsType:
+                                      type: string
+                                    partition:
+                                      format: int32
+                                      type: integer
+                                    readOnly:
+                                      type: boolean
+                                    volumeID:
+                                      type: string
+                                  required:
+                                  - volumeID
+                                  type: object
+                                azureDisk:
+                                  properties:
+                                    cachingMode:
+                                      type: string
+                                    diskName:
+                                      type: string
+                                    diskURI:
+                                      type: string
+                                    fsType:
+                                      default: ext4
+                                      type: string
+                                    kind:
+                                      type: string
+                                    readOnly:
+                                      default: false
+                                      type: boolean
+                                  required:
+                                  - diskName
+                                  - diskURI
+                                  type: object
+                                azureFile:
+                                  properties:
+                                    readOnly:
+                                      type: boolean
+                                    secretName:
+                                      type: string
+                                    shareName:
+                                      type: string
+                                  required:
+                                  - secretName
+                                  - shareName
+                                  type: object
+                                cephfs:
+                                  properties:
+                                    monitors:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    path:
+                                      type: string
+                                    readOnly:
+                                      type: boolean
+                                    secretFile:
+                                      type: string
+                                    secretRef:
+                                      properties:
+                                        name:
+                                          default: ""
+                                          type: string
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    user:
+                                      type: string
+                                  required:
+                                  - monitors
+                                  type: object
+                                cinder:
+                                  properties:
+                                    fsType:
+                                      type: string
+                                    readOnly:
+                                      type: boolean
+                                    secretRef:
+                                      properties:
+                                        name:
+                                          default: ""
+                                          type: string
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    volumeID:
+                                      type: string
+                                  required:
+                                  - volumeID
+                                  type: object
+                                configMap:
+                                  properties:
+                                    defaultMode:
+                                      format: int32
+                                      type: integer
+                                    items:
+                                      items:
+                                        properties:
+                                          key:
+                                            type: string
+                                          mode:
+                                            format: int32
+                                            type: integer
+                                          path:
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    name:
+                                      default: ""
+                                      type: string
+                                    optional:
+                                      type: boolean
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                csi:
+                                  properties:
+                                    driver:
+                                      type: string
+                                    fsType:
+                                      type: string
+                                    nodePublishSecretRef:
+                                      properties:
+                                        name:
+                                          default: ""
+                                          type: string
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    readOnly:
+                                      type: boolean
+                                    volumeAttributes:
+                                      additionalProperties:
+                                        type: string
+                                      type: object
+                                  required:
+                                  - driver
+                                  type: object
+                                downwardAPI:
+                                  properties:
+                                    defaultMode:
+                                      format: int32
+                                      type: integer
+                                    items:
+                                      items:
+                                        properties:
+                                          fieldRef:
+                                            properties:
+                                              apiVersion:
+                                                type: string
+                                              fieldPath:
+                                                type: string
+                                            required:
+                                            - fieldPath
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          mode:
+                                            format: int32
+                                            type: integer
+                                          path:
+                                            type: string
+                                          resourceFieldRef:
+                                            properties:
+                                              containerName:
+                                                type: string
+                                              divisor:
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                x-kubernetes-int-or-string: true
+                                              resource:
+                                                type: string
+                                            required:
+                                            - resource
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                        required:
+                                        - path
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                emptyDir:
+                                  properties:
+                                    medium:
+                                      type: string
+                                    sizeLimit:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                  type: object
+                                ephemeral:
+                                  properties:
+                                    volumeClaimTemplate:
+                                      properties:
+                                        metadata:
+                                          type: object
+                                        spec:
+                                          properties:
+                                            accessModes:
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            dataSource:
+                                              properties:
+                                                apiGroup:
+                                                  type: string
+                                                kind:
+                                                  type: string
+                                                name:
+                                                  type: string
+                                              required:
+                                              - kind
+                                              - name
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            dataSourceRef:
+                                              properties:
+                                                apiGroup:
+                                                  type: string
+                                                kind:
+                                                  type: string
+                                                name:
+                                                  type: string
+                                                namespace:
+                                                  type: string
+                                              required:
+                                              - kind
+                                              - name
+                                              type: object
+                                            resources:
+                                              properties:
+                                                limits:
+                                                  additionalProperties:
+                                                    anyOf:
+                                                    - type: integer
+                                                    - type: string
+                                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                    x-kubernetes-int-or-string: true
+                                                  type: object
+                                                requests:
+                                                  additionalProperties:
+                                                    anyOf:
+                                                    - type: integer
+                                                    - type: string
+                                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                    x-kubernetes-int-or-string: true
+                                                  type: object
+                                              type: object
+                                            selector:
+                                              properties:
+                                                matchExpressions:
+                                                  items:
+                                                    properties:
+                                                      key:
+                                                        type: string
+                                                      operator:
+                                                        type: string
+                                                      values:
+                                                        items:
+                                                          type: string
+                                                        type: array
+                                                        x-kubernetes-list-type: atomic
+                                                    required:
+                                                    - key
+                                                    - operator
+                                                    type: object
+                                                  type: array
+                                                  x-kubernetes-list-type: atomic
+                                                matchLabels:
+                                                  additionalProperties:
+                                                    type: string
+                                                  type: object
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            storageClassName:
+                                              type: string
+                                            volumeAttributesClassName:
+                                              type: string
+                                            volumeMode:
+                                              type: string
+                                            volumeName:
+                                              type: string
+                                          type: object
+                                      required:
+                                      - spec
+                                      type: object
+                                  type: object
+                                fc:
+                                  properties:
+                                    fsType:
+                                      type: string
+                                    lun:
+                                      format: int32
+                                      type: integer
+                                    readOnly:
+                                      type: boolean
+                                    targetWWNs:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    wwids:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                flexVolume:
+                                  properties:
+                                    driver:
+                                      type: string
+                                    fsType:
+                                      type: string
+                                    options:
+                                      additionalProperties:
+                                        type: string
+                                      type: object
+                                    readOnly:
+                                      type: boolean
+                                    secretRef:
+                                      properties:
+                                        name:
+                                          default: ""
+                                          type: string
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                  required:
+                                  - driver
+                                  type: object
+                                flocker:
+                                  properties:
+                                    datasetName:
+                                      type: string
+                                    datasetUUID:
+                                      type: string
+                                  type: object
+                                gcePersistentDisk:
+                                  properties:
+                                    fsType:
+                                      type: string
+                                    partition:
+                                      format: int32
+                                      type: integer
+                                    pdName:
+                                      type: string
+                                    readOnly:
+                                      type: boolean
+                                  required:
+                                  - pdName
+                                  type: object
+                                gitRepo:
+                                  properties:
+                                    directory:
+                                      type: string
+                                    repository:
+                                      type: string
+                                    revision:
+                                      type: string
+                                  required:
+                                  - repository
+                                  type: object
+                                glusterfs:
+                                  properties:
+                                    endpoints:
+                                      type: string
+                                    path:
+                                      type: string
+                                    readOnly:
+                                      type: boolean
+                                  required:
+                                  - endpoints
+                                  - path
+                                  type: object
+                                hostPath:
+                                  properties:
+                                    path:
+                                      type: string
+                                    type:
+                                      type: string
+                                  required:
+                                  - path
+                                  type: object
+                                image:
+                                  properties:
+                                    pullPolicy:
+                                      type: string
+                                    reference:
+                                      type: string
+                                  type: object
+                                iscsi:
+                                  properties:
+                                    chapAuthDiscovery:
+                                      type: boolean
+                                    chapAuthSession:
+                                      type: boolean
+                                    fsType:
+                                      type: string
+                                    initiatorName:
+                                      type: string
+                                    iqn:
+                                      type: string
+                                    iscsiInterface:
+                                      default: default
+                                      type: string
+                                    lun:
+                                      format: int32
+                                      type: integer
+                                    portals:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    readOnly:
+                                      type: boolean
+                                    secretRef:
+                                      properties:
+                                        name:
+                                          default: ""
+                                          type: string
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    targetPortal:
+                                      type: string
+                                  required:
+                                  - iqn
+                                  - lun
+                                  - targetPortal
+                                  type: object
+                                name:
+                                  type: string
+                                nfs:
+                                  properties:
+                                    path:
+                                      type: string
+                                    readOnly:
+                                      type: boolean
+                                    server:
+                                      type: string
+                                  required:
+                                  - path
+                                  - server
+                                  type: object
+                                persistentVolumeClaim:
+                                  properties:
+                                    claimName:
+                                      type: string
+                                    readOnly:
+                                      type: boolean
+                                  required:
+                                  - claimName
+                                  type: object
+                                photonPersistentDisk:
+                                  properties:
+                                    fsType:
+                                      type: string
+                                    pdID:
+                                      type: string
+                                  required:
+                                  - pdID
+                                  type: object
+                                portworxVolume:
+                                  properties:
+                                    fsType:
+                                      type: string
+                                    readOnly:
+                                      type: boolean
+                                    volumeID:
+                                      type: string
+                                  required:
+                                  - volumeID
+                                  type: object
+                                projected:
+                                  properties:
+                                    defaultMode:
+                                      format: int32
+                                      type: integer
+                                    sources:
+                                      items:
+                                        properties:
+                                          clusterTrustBundle:
+                                            properties:
+                                              labelSelector:
+                                                properties:
+                                                  matchExpressions:
+                                                    items:
+                                                      properties:
+                                                        key:
+                                                          type: string
+                                                        operator:
+                                                          type: string
+                                                        values:
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                      required:
+                                                      - key
+                                                      - operator
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  matchLabels:
+                                                    additionalProperties:
+                                                      type: string
+                                                    type: object
+                                                type: object
+                                                x-kubernetes-map-type: atomic
+                                              name:
+                                                type: string
+                                              optional:
+                                                type: boolean
+                                              path:
+                                                type: string
+                                              signerName:
+                                                type: string
+                                            required:
+                                            - path
+                                            type: object
+                                          configMap:
+                                            properties:
+                                              items:
+                                                items:
+                                                  properties:
+                                                    key:
+                                                      type: string
+                                                    mode:
+                                                      format: int32
+                                                      type: integer
+                                                    path:
+                                                      type: string
+                                                  required:
+                                                  - key
+                                                  - path
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              name:
+                                                default: ""
+                                                type: string
+                                              optional:
+                                                type: boolean
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          downwardAPI:
+                                            properties:
+                                              items:
+                                                items:
+                                                  properties:
+                                                    fieldRef:
+                                                      properties:
+                                                        apiVersion:
+                                                          type: string
+                                                        fieldPath:
+                                                          type: string
+                                                      required:
+                                                      - fieldPath
+                                                      type: object
+                                                      x-kubernetes-map-type: atomic
+                                                    mode:
+                                                      format: int32
+                                                      type: integer
+                                                    path:
+                                                      type: string
+                                                    resourceFieldRef:
+                                                      properties:
+                                                        containerName:
+                                                          type: string
+                                                        divisor:
+                                                          anyOf:
+                                                          - type: integer
+                                                          - type: string
+                                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                          x-kubernetes-int-or-string: true
+                                                        resource:
+                                                          type: string
+                                                      required:
+                                                      - resource
+                                                      type: object
+                                                      x-kubernetes-map-type: atomic
+                                                  required:
+                                                  - path
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            type: object
+                                          podCertificate:
+                                            properties:
+                                              certificateChainPath:
+                                                type: string
+                                              credentialBundlePath:
+                                                type: string
+                                              keyPath:
+                                                type: string
+                                              keyType:
+                                                type: string
+                                              maxExpirationSeconds:
+                                                format: int32
+                                                type: integer
+                                              signerName:
+                                                type: string
+                                            required:
+                                            - keyType
+                                            - signerName
+                                            type: object
+                                          secret:
+                                            properties:
+                                              items:
+                                                items:
+                                                  properties:
+                                                    key:
+                                                      type: string
+                                                    mode:
+                                                      format: int32
+                                                      type: integer
+                                                    path:
+                                                      type: string
+                                                  required:
+                                                  - key
+                                                  - path
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              name:
+                                                default: ""
+                                                type: string
+                                              optional:
+                                                type: boolean
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          serviceAccountToken:
+                                            properties:
+                                              audience:
+                                                type: string
+                                              expirationSeconds:
+                                                format: int64
+                                                type: integer
+                                              path:
+                                                type: string
+                                            required:
+                                            - path
+                                            type: object
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                quobyte:
+                                  properties:
+                                    group:
+                                      type: string
+                                    readOnly:
+                                      type: boolean
+                                    registry:
+                                      type: string
+                                    tenant:
+                                      type: string
+                                    user:
+                                      type: string
+                                    volume:
+                                      type: string
+                                  required:
+                                  - registry
+                                  - volume
+                                  type: object
+                                rbd:
+                                  properties:
+                                    fsType:
+                                      type: string
+                                    image:
+                                      type: string
+                                    keyring:
+                                      default: /etc/ceph/keyring
+                                      type: string
+                                    monitors:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    pool:
+                                      default: rbd
+                                      type: string
+                                    readOnly:
+                                      type: boolean
+                                    secretRef:
+                                      properties:
+                                        name:
+                                          default: ""
+                                          type: string
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    user:
+                                      default: admin
+                                      type: string
+                                  required:
+                                  - image
+                                  - monitors
+                                  type: object
+                                scaleIO:
+                                  properties:
+                                    fsType:
+                                      default: xfs
+                                      type: string
+                                    gateway:
+                                      type: string
+                                    protectionDomain:
+                                      type: string
+                                    readOnly:
+                                      type: boolean
+                                    secretRef:
+                                      properties:
+                                        name:
+                                          default: ""
+                                          type: string
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    sslEnabled:
+                                      type: boolean
+                                    storageMode:
+                                      default: ThinProvisioned
+                                      type: string
+                                    storagePool:
+                                      type: string
+                                    system:
+                                      type: string
+                                    volumeName:
+                                      type: string
+                                  required:
+                                  - gateway
+                                  - secretRef
+                                  - system
+                                  type: object
+                                secret:
+                                  properties:
+                                    defaultMode:
+                                      format: int32
+                                      type: integer
+                                    items:
+                                      items:
+                                        properties:
+                                          key:
+                                            type: string
+                                          mode:
+                                            format: int32
+                                            type: integer
+                                          path:
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    optional:
+                                      type: boolean
+                                    secretName:
+                                      type: string
+                                  type: object
+                                storageos:
+                                  properties:
+                                    fsType:
+                                      type: string
+                                    readOnly:
+                                      type: boolean
+                                    secretRef:
+                                      properties:
+                                        name:
+                                          default: ""
+                                          type: string
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    volumeName:
+                                      type: string
+                                    volumeNamespace:
+                                      type: string
+                                  type: object
+                                vsphereVolume:
+                                  properties:
+                                    fsType:
+                                      type: string
+                                    storagePolicyID:
+                                      type: string
+                                    storagePolicyName:
+                                      type: string
+                                    volumePath:
+                                      type: string
+                                  required:
+                                  - volumePath
+                                  type: object
+                              required:
+                              - name
+                              type: object
+                            type: array
+                        type: object
+                    type: object
+                  vmcluster:
+                    properties:
+                      name:
+                        type: string
+                      spec:
+                        x-kubernetes-preserve-unknown-fields: true
+                    type: object
+                type: object
+              zones:
+                items:
+                  properties:
+                    name:
+                      type: string
+                    remoteWrite:
+                      x-kubernetes-preserve-unknown-fields: true
+                    vmagent:
+                      properties:
+                        name:
+                          type: string
+                        spec:
+                          properties:
+                            affinity:
+                              properties:
+                                nodeAffinity:
+                                  properties:
+                                    preferredDuringSchedulingIgnoredDuringExecution:
+                                      items:
+                                        properties:
+                                          preference:
+                                            properties:
+                                              matchExpressions:
+                                                items:
+                                                  properties:
+                                                    key:
+                                                      type: string
+                                                    operator:
+                                                      type: string
+                                                    values:
+                                                      items:
+                                                        type: string
+                                                      type: array
+                                                      x-kubernetes-list-type: atomic
+                                                  required:
+                                                  - key
+                                                  - operator
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              matchFields:
+                                                items:
+                                                  properties:
+                                                    key:
+                                                      type: string
+                                                    operator:
+                                                      type: string
+                                                    values:
+                                                      items:
+                                                        type: string
+                                                      type: array
+                                                      x-kubernetes-list-type: atomic
+                                                  required:
+                                                  - key
+                                                  - operator
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          weight:
+                                            format: int32
+                                            type: integer
+                                        required:
+                                        - preference
+                                        - weight
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    requiredDuringSchedulingIgnoredDuringExecution:
+                                      properties:
+                                        nodeSelectorTerms:
+                                          items:
+                                            properties:
+                                              matchExpressions:
+                                                items:
+                                                  properties:
+                                                    key:
+                                                      type: string
+                                                    operator:
+                                                      type: string
+                                                    values:
+                                                      items:
+                                                        type: string
+                                                      type: array
+                                                      x-kubernetes-list-type: atomic
+                                                  required:
+                                                  - key
+                                                  - operator
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              matchFields:
+                                                items:
+                                                  properties:
+                                                    key:
+                                                      type: string
+                                                    operator:
+                                                      type: string
+                                                    values:
+                                                      items:
+                                                        type: string
+                                                      type: array
+                                                      x-kubernetes-list-type: atomic
+                                                  required:
+                                                  - key
+                                                  - operator
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      required:
+                                      - nodeSelectorTerms
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                  type: object
+                                podAffinity:
+                                  properties:
+                                    preferredDuringSchedulingIgnoredDuringExecution:
+                                      items:
+                                        properties:
+                                          podAffinityTerm:
+                                            properties:
+                                              labelSelector:
+                                                properties:
+                                                  matchExpressions:
+                                                    items:
+                                                      properties:
+                                                        key:
+                                                          type: string
+                                                        operator:
+                                                          type: string
+                                                        values:
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                      required:
+                                                      - key
+                                                      - operator
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  matchLabels:
+                                                    additionalProperties:
+                                                      type: string
+                                                    type: object
+                                                type: object
+                                                x-kubernetes-map-type: atomic
+                                              matchLabelKeys:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              mismatchLabelKeys:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              namespaceSelector:
+                                                properties:
+                                                  matchExpressions:
+                                                    items:
+                                                      properties:
+                                                        key:
+                                                          type: string
+                                                        operator:
+                                                          type: string
+                                                        values:
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                      required:
+                                                      - key
+                                                      - operator
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  matchLabels:
+                                                    additionalProperties:
+                                                      type: string
+                                                    type: object
+                                                type: object
+                                                x-kubernetes-map-type: atomic
+                                              namespaces:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              topologyKey:
+                                                type: string
+                                            required:
+                                            - topologyKey
+                                            type: object
+                                          weight:
+                                            format: int32
+                                            type: integer
+                                        required:
+                                        - podAffinityTerm
+                                        - weight
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    requiredDuringSchedulingIgnoredDuringExecution:
+                                      items:
+                                        properties:
+                                          labelSelector:
+                                            properties:
+                                              matchExpressions:
+                                                items:
+                                                  properties:
+                                                    key:
+                                                      type: string
+                                                    operator:
+                                                      type: string
+                                                    values:
+                                                      items:
+                                                        type: string
+                                                      type: array
+                                                      x-kubernetes-list-type: atomic
+                                                  required:
+                                                  - key
+                                                  - operator
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              matchLabels:
+                                                additionalProperties:
+                                                  type: string
+                                                type: object
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          matchLabelKeys:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          mismatchLabelKeys:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          namespaceSelector:
+                                            properties:
+                                              matchExpressions:
+                                                items:
+                                                  properties:
+                                                    key:
+                                                      type: string
+                                                    operator:
+                                                      type: string
+                                                    values:
+                                                      items:
+                                                        type: string
+                                                      type: array
+                                                      x-kubernetes-list-type: atomic
+                                                  required:
+                                                  - key
+                                                  - operator
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              matchLabels:
+                                                additionalProperties:
+                                                  type: string
+                                                type: object
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          namespaces:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          topologyKey:
+                                            type: string
+                                        required:
+                                        - topologyKey
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                podAntiAffinity:
+                                  properties:
+                                    preferredDuringSchedulingIgnoredDuringExecution:
+                                      items:
+                                        properties:
+                                          podAffinityTerm:
+                                            properties:
+                                              labelSelector:
+                                                properties:
+                                                  matchExpressions:
+                                                    items:
+                                                      properties:
+                                                        key:
+                                                          type: string
+                                                        operator:
+                                                          type: string
+                                                        values:
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                      required:
+                                                      - key
+                                                      - operator
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  matchLabels:
+                                                    additionalProperties:
+                                                      type: string
+                                                    type: object
+                                                type: object
+                                                x-kubernetes-map-type: atomic
+                                              matchLabelKeys:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              mismatchLabelKeys:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              namespaceSelector:
+                                                properties:
+                                                  matchExpressions:
+                                                    items:
+                                                      properties:
+                                                        key:
+                                                          type: string
+                                                        operator:
+                                                          type: string
+                                                        values:
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                      required:
+                                                      - key
+                                                      - operator
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  matchLabels:
+                                                    additionalProperties:
+                                                      type: string
+                                                    type: object
+                                                type: object
+                                                x-kubernetes-map-type: atomic
+                                              namespaces:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              topologyKey:
+                                                type: string
+                                            required:
+                                            - topologyKey
+                                            type: object
+                                          weight:
+                                            format: int32
+                                            type: integer
+                                        required:
+                                        - podAffinityTerm
+                                        - weight
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    requiredDuringSchedulingIgnoredDuringExecution:
+                                      items:
+                                        properties:
+                                          labelSelector:
+                                            properties:
+                                              matchExpressions:
+                                                items:
+                                                  properties:
+                                                    key:
+                                                      type: string
+                                                    operator:
+                                                      type: string
+                                                    values:
+                                                      items:
+                                                        type: string
+                                                      type: array
+                                                      x-kubernetes-list-type: atomic
+                                                  required:
+                                                  - key
+                                                  - operator
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              matchLabels:
+                                                additionalProperties:
+                                                  type: string
+                                                type: object
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          matchLabelKeys:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          mismatchLabelKeys:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          namespaceSelector:
+                                            properties:
+                                              matchExpressions:
+                                                items:
+                                                  properties:
+                                                    key:
+                                                      type: string
+                                                    operator:
+                                                      type: string
+                                                    values:
+                                                      items:
+                                                        type: string
+                                                      type: array
+                                                      x-kubernetes-list-type: atomic
+                                                  required:
+                                                  - key
+                                                  - operator
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              matchLabels:
+                                                additionalProperties:
+                                                  type: string
+                                                type: object
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          namespaces:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          topologyKey:
+                                            type: string
+                                        required:
+                                        - topologyKey
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                              type: object
+                            claimTemplates:
+                              items:
+                                properties:
+                                  apiVersion:
+                                    type: string
+                                  kind:
+                                    type: string
+                                  metadata:
+                                    type: object
+                                  spec:
+                                    properties:
+                                      accessModes:
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      dataSource:
+                                        properties:
+                                          apiGroup:
+                                            type: string
+                                          kind:
+                                            type: string
+                                          name:
+                                            type: string
+                                        required:
+                                        - kind
+                                        - name
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      dataSourceRef:
+                                        properties:
+                                          apiGroup:
+                                            type: string
+                                          kind:
+                                            type: string
+                                          name:
+                                            type: string
+                                          namespace:
+                                            type: string
+                                        required:
+                                        - kind
+                                        - name
+                                        type: object
+                                      resources:
+                                        properties:
+                                          limits:
+                                            additionalProperties:
+                                              anyOf:
+                                              - type: integer
+                                              - type: string
+                                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                              x-kubernetes-int-or-string: true
+                                            type: object
+                                          requests:
+                                            additionalProperties:
+                                              anyOf:
+                                              - type: integer
+                                              - type: string
+                                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                              x-kubernetes-int-or-string: true
+                                            type: object
+                                        type: object
+                                      selector:
+                                        properties:
+                                          matchExpressions:
+                                            items:
+                                              properties:
+                                                key:
+                                                  type: string
+                                                operator:
+                                                  type: string
+                                                values:
+                                                  items:
+                                                    type: string
+                                                  type: array
+                                                  x-kubernetes-list-type: atomic
+                                              required:
+                                              - key
+                                              - operator
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          matchLabels:
+                                            additionalProperties:
+                                              type: string
+                                            type: object
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      storageClassName:
+                                        type: string
+                                      volumeAttributesClassName:
+                                        type: string
+                                      volumeMode:
+                                        type: string
+                                      volumeName:
+                                        type: string
+                                    type: object
+                                  status:
+                                    properties:
+                                      accessModes:
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      allocatedResourceStatuses:
+                                        additionalProperties:
+                                          type: string
+                                        type: object
+                                        x-kubernetes-map-type: granular
+                                      allocatedResources:
+                                        additionalProperties:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          x-kubernetes-int-or-string: true
+                                        type: object
+                                      capacity:
+                                        additionalProperties:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          x-kubernetes-int-or-string: true
+                                        type: object
+                                      conditions:
+                                        items:
+                                          properties:
+                                            lastProbeTime:
+                                              format: date-time
+                                              type: string
+                                            lastTransitionTime:
+                                              format: date-time
+                                              type: string
+                                            message:
+                                              type: string
+                                            reason:
+                                              type: string
+                                            status:
+                                              type: string
+                                            type:
+                                              type: string
+                                          required:
+                                          - status
+                                          - type
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-map-keys:
+                                        - type
+                                        x-kubernetes-list-type: map
+                                      currentVolumeAttributesClassName:
+                                        type: string
+                                      modifyVolumeStatus:
+                                        properties:
+                                          status:
+                                            type: string
+                                          targetVolumeAttributesClassName:
+                                            type: string
+                                        required:
+                                        - status
+                                        type: object
+                                      phase:
+                                        type: string
+                                    type: object
+                                type: object
+                              type: array
+                            configMaps:
+                              items:
+                                type: string
+                              type: array
+                            containers:
+                              items:
+                                properties:
+                                  args:
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  command:
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  env:
+                                    items:
+                                      properties:
+                                        name:
+                                          type: string
+                                        value:
+                                          type: string
+                                        valueFrom:
+                                          properties:
+                                            configMapKeyRef:
+                                              properties:
+                                                key:
+                                                  type: string
+                                                name:
+                                                  default: ""
+                                                  type: string
+                                                optional:
+                                                  type: boolean
+                                              required:
+                                              - key
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            fieldRef:
+                                              properties:
+                                                apiVersion:
+                                                  type: string
+                                                fieldPath:
+                                                  type: string
+                                              required:
+                                              - fieldPath
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            fileKeyRef:
+                                              properties:
+                                                key:
+                                                  type: string
+                                                optional:
+                                                  default: false
+                                                  type: boolean
+                                                path:
+                                                  type: string
+                                                volumeName:
+                                                  type: string
+                                              required:
+                                              - key
+                                              - path
+                                              - volumeName
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            resourceFieldRef:
+                                              properties:
+                                                containerName:
+                                                  type: string
+                                                divisor:
+                                                  anyOf:
+                                                  - type: integer
+                                                  - type: string
+                                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                  x-kubernetes-int-or-string: true
+                                                resource:
+                                                  type: string
+                                              required:
+                                              - resource
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            secretKeyRef:
+                                              properties:
+                                                key:
+                                                  type: string
+                                                name:
+                                                  default: ""
+                                                  type: string
+                                                optional:
+                                                  type: boolean
+                                              required:
+                                              - key
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                          type: object
+                                      required:
+                                      - name
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-map-keys:
+                                    - name
+                                    x-kubernetes-list-type: map
+                                  envFrom:
+                                    items:
+                                      properties:
+                                        configMapRef:
+                                          properties:
+                                            name:
+                                              default: ""
+                                              type: string
+                                            optional:
+                                              type: boolean
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        prefix:
+                                          type: string
+                                        secretRef:
+                                          properties:
+                                            name:
+                                              default: ""
+                                              type: string
+                                            optional:
+                                              type: boolean
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  image:
+                                    type: string
+                                  imagePullPolicy:
+                                    type: string
+                                  lifecycle:
+                                    properties:
+                                      postStart:
+                                        properties:
+                                          exec:
+                                            properties:
+                                              command:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            type: object
+                                          httpGet:
+                                            properties:
+                                              host:
+                                                type: string
+                                              httpHeaders:
+                                                items:
+                                                  properties:
+                                                    name:
+                                                      type: string
+                                                    value:
+                                                      type: string
+                                                  required:
+                                                  - name
+                                                  - value
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              path:
+                                                type: string
+                                              port:
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                x-kubernetes-int-or-string: true
+                                              scheme:
+                                                type: string
+                                            required:
+                                            - port
+                                            type: object
+                                          sleep:
+                                            properties:
+                                              seconds:
+                                                format: int64
+                                                type: integer
+                                            required:
+                                            - seconds
+                                            type: object
+                                          tcpSocket:
+                                            properties:
+                                              host:
+                                                type: string
+                                              port:
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                x-kubernetes-int-or-string: true
+                                            required:
+                                            - port
+                                            type: object
+                                        type: object
+                                      preStop:
+                                        properties:
+                                          exec:
+                                            properties:
+                                              command:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            type: object
+                                          httpGet:
+                                            properties:
+                                              host:
+                                                type: string
+                                              httpHeaders:
+                                                items:
+                                                  properties:
+                                                    name:
+                                                      type: string
+                                                    value:
+                                                      type: string
+                                                  required:
+                                                  - name
+                                                  - value
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              path:
+                                                type: string
+                                              port:
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                x-kubernetes-int-or-string: true
+                                              scheme:
+                                                type: string
+                                            required:
+                                            - port
+                                            type: object
+                                          sleep:
+                                            properties:
+                                              seconds:
+                                                format: int64
+                                                type: integer
+                                            required:
+                                            - seconds
+                                            type: object
+                                          tcpSocket:
+                                            properties:
+                                              host:
+                                                type: string
+                                              port:
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                x-kubernetes-int-or-string: true
+                                            required:
+                                            - port
+                                            type: object
+                                        type: object
+                                      stopSignal:
+                                        type: string
+                                    type: object
+                                  livenessProbe:
+                                    properties:
+                                      exec:
+                                        properties:
+                                          command:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        type: object
+                                      failureThreshold:
+                                        format: int32
+                                        type: integer
+                                      grpc:
+                                        properties:
+                                          port:
+                                            format: int32
+                                            type: integer
+                                          service:
+                                            default: ""
+                                            type: string
+                                        required:
+                                        - port
+                                        type: object
+                                      httpGet:
+                                        properties:
+                                          host:
+                                            type: string
+                                          httpHeaders:
+                                            items:
+                                              properties:
+                                                name:
+                                                  type: string
+                                                value:
+                                                  type: string
+                                              required:
+                                              - name
+                                              - value
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          path:
+                                            type: string
+                                          port:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            x-kubernetes-int-or-string: true
+                                          scheme:
+                                            type: string
+                                        required:
+                                        - port
+                                        type: object
+                                      initialDelaySeconds:
+                                        format: int32
+                                        type: integer
+                                      periodSeconds:
+                                        format: int32
+                                        type: integer
+                                      successThreshold:
+                                        format: int32
+                                        type: integer
+                                      tcpSocket:
+                                        properties:
+                                          host:
+                                            type: string
+                                          port:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            x-kubernetes-int-or-string: true
+                                        required:
+                                        - port
+                                        type: object
+                                      terminationGracePeriodSeconds:
+                                        format: int64
+                                        type: integer
+                                      timeoutSeconds:
+                                        format: int32
+                                        type: integer
+                                    type: object
+                                  name:
+                                    type: string
+                                  ports:
+                                    items:
+                                      properties:
+                                        containerPort:
+                                          format: int32
+                                          type: integer
+                                        hostIP:
+                                          type: string
+                                        hostPort:
+                                          format: int32
+                                          type: integer
+                                        name:
+                                          type: string
+                                        protocol:
+                                          default: TCP
+                                          type: string
+                                      required:
+                                      - containerPort
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-map-keys:
+                                    - containerPort
+                                    - protocol
+                                    x-kubernetes-list-type: map
+                                  readinessProbe:
+                                    properties:
+                                      exec:
+                                        properties:
+                                          command:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        type: object
+                                      failureThreshold:
+                                        format: int32
+                                        type: integer
+                                      grpc:
+                                        properties:
+                                          port:
+                                            format: int32
+                                            type: integer
+                                          service:
+                                            default: ""
+                                            type: string
+                                        required:
+                                        - port
+                                        type: object
+                                      httpGet:
+                                        properties:
+                                          host:
+                                            type: string
+                                          httpHeaders:
+                                            items:
+                                              properties:
+                                                name:
+                                                  type: string
+                                                value:
+                                                  type: string
+                                              required:
+                                              - name
+                                              - value
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          path:
+                                            type: string
+                                          port:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            x-kubernetes-int-or-string: true
+                                          scheme:
+                                            type: string
+                                        required:
+                                        - port
+                                        type: object
+                                      initialDelaySeconds:
+                                        format: int32
+                                        type: integer
+                                      periodSeconds:
+                                        format: int32
+                                        type: integer
+                                      successThreshold:
+                                        format: int32
+                                        type: integer
+                                      tcpSocket:
+                                        properties:
+                                          host:
+                                            type: string
+                                          port:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            x-kubernetes-int-or-string: true
+                                        required:
+                                        - port
+                                        type: object
+                                      terminationGracePeriodSeconds:
+                                        format: int64
+                                        type: integer
+                                      timeoutSeconds:
+                                        format: int32
+                                        type: integer
+                                    type: object
+                                  resizePolicy:
+                                    items:
+                                      properties:
+                                        resourceName:
+                                          type: string
+                                        restartPolicy:
+                                          type: string
+                                      required:
+                                      - resourceName
+                                      - restartPolicy
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  resources:
+                                    properties:
+                                      claims:
+                                        items:
+                                          properties:
+                                            name:
+                                              type: string
+                                            request:
+                                              type: string
+                                          required:
+                                          - name
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-map-keys:
+                                        - name
+                                        x-kubernetes-list-type: map
+                                      limits:
+                                        additionalProperties:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          x-kubernetes-int-or-string: true
+                                        type: object
+                                      requests:
+                                        additionalProperties:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          x-kubernetes-int-or-string: true
+                                        type: object
+                                    type: object
+                                  restartPolicy:
+                                    type: string
+                                  restartPolicyRules:
+                                    items:
+                                      properties:
+                                        action:
+                                          type: string
+                                        exitCodes:
+                                          properties:
+                                            operator:
+                                              type: string
+                                            values:
+                                              items:
+                                                format: int32
+                                                type: integer
+                                              type: array
+                                              x-kubernetes-list-type: set
+                                          required:
+                                          - operator
+                                          type: object
+                                      required:
+                                      - action
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  securityContext:
+                                    properties:
+                                      allowPrivilegeEscalation:
+                                        type: boolean
+                                      appArmorProfile:
+                                        properties:
+                                          localhostProfile:
+                                            type: string
+                                          type:
+                                            type: string
+                                        required:
+                                        - type
+                                        type: object
+                                      capabilities:
+                                        properties:
+                                          add:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          drop:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        type: object
+                                      privileged:
+                                        type: boolean
+                                      procMount:
+                                        type: string
+                                      readOnlyRootFilesystem:
+                                        type: boolean
+                                      runAsGroup:
+                                        format: int64
+                                        type: integer
+                                      runAsNonRoot:
+                                        type: boolean
+                                      runAsUser:
+                                        format: int64
+                                        type: integer
+                                      seLinuxOptions:
+                                        properties:
+                                          level:
+                                            type: string
+                                          role:
+                                            type: string
+                                          type:
+                                            type: string
+                                          user:
+                                            type: string
+                                        type: object
+                                      seccompProfile:
+                                        properties:
+                                          localhostProfile:
+                                            type: string
+                                          type:
+                                            type: string
+                                        required:
+                                        - type
+                                        type: object
+                                      windowsOptions:
+                                        properties:
+                                          gmsaCredentialSpec:
+                                            type: string
+                                          gmsaCredentialSpecName:
+                                            type: string
+                                          hostProcess:
+                                            type: boolean
+                                          runAsUserName:
+                                            type: string
+                                        type: object
+                                    type: object
+                                  startupProbe:
+                                    properties:
+                                      exec:
+                                        properties:
+                                          command:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        type: object
+                                      failureThreshold:
+                                        format: int32
+                                        type: integer
+                                      grpc:
+                                        properties:
+                                          port:
+                                            format: int32
+                                            type: integer
+                                          service:
+                                            default: ""
+                                            type: string
+                                        required:
+                                        - port
+                                        type: object
+                                      httpGet:
+                                        properties:
+                                          host:
+                                            type: string
+                                          httpHeaders:
+                                            items:
+                                              properties:
+                                                name:
+                                                  type: string
+                                                value:
+                                                  type: string
+                                              required:
+                                              - name
+                                              - value
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          path:
+                                            type: string
+                                          port:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            x-kubernetes-int-or-string: true
+                                          scheme:
+                                            type: string
+                                        required:
+                                        - port
+                                        type: object
+                                      initialDelaySeconds:
+                                        format: int32
+                                        type: integer
+                                      periodSeconds:
+                                        format: int32
+                                        type: integer
+                                      successThreshold:
+                                        format: int32
+                                        type: integer
+                                      tcpSocket:
+                                        properties:
+                                          host:
+                                            type: string
+                                          port:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            x-kubernetes-int-or-string: true
+                                        required:
+                                        - port
+                                        type: object
+                                      terminationGracePeriodSeconds:
+                                        format: int64
+                                        type: integer
+                                      timeoutSeconds:
+                                        format: int32
+                                        type: integer
+                                    type: object
+                                  stdin:
+                                    type: boolean
+                                  stdinOnce:
+                                    type: boolean
+                                  terminationMessagePath:
+                                    type: string
+                                  terminationMessagePolicy:
+                                    type: string
+                                  tty:
+                                    type: boolean
+                                  volumeDevices:
+                                    items:
+                                      properties:
+                                        devicePath:
+                                          type: string
+                                        name:
+                                          type: string
+                                      required:
+                                      - devicePath
+                                      - name
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-map-keys:
+                                    - devicePath
+                                    x-kubernetes-list-type: map
+                                  volumeMounts:
+                                    items:
+                                      properties:
+                                        mountPath:
+                                          type: string
+                                        mountPropagation:
+                                          type: string
+                                        name:
+                                          type: string
+                                        readOnly:
+                                          type: boolean
+                                        recursiveReadOnly:
+                                          type: string
+                                        subPath:
+                                          type: string
+                                        subPathExpr:
+                                          type: string
+                                      required:
+                                      - mountPath
+                                      - name
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-map-keys:
+                                    - mountPath
+                                    x-kubernetes-list-type: map
+                                  workingDir:
+                                    type: string
+                                required:
+                                - name
+                                type: object
+                              type: array
+                            disableAutomountServiceAccountToken:
+                              type: boolean
+                            disableSelfServiceScrape:
+                              type: boolean
+                            dnsConfig:
+                              properties:
+                                nameservers:
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                options:
+                                  items:
+                                    properties:
+                                      name:
+                                        type: string
+                                      value:
+                                        type: string
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                searches:
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              type: object
+                            dnsPolicy:
+                              type: string
+                            extraArgs:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            extraEnvs:
+                              items:
+                                properties:
+                                  name:
+                                    type: string
+                                  value:
+                                    type: string
+                                  valueFrom:
+                                    properties:
+                                      configMapKeyRef:
+                                        properties:
+                                          key:
+                                            type: string
+                                          name:
+                                            default: ""
+                                            type: string
+                                          optional:
+                                            type: boolean
+                                        required:
+                                        - key
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      fieldRef:
+                                        properties:
+                                          apiVersion:
+                                            type: string
+                                          fieldPath:
+                                            type: string
+                                        required:
+                                        - fieldPath
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        properties:
+                                          key:
+                                            type: string
+                                          optional:
+                                            default: false
+                                            type: boolean
+                                          path:
+                                            type: string
+                                          volumeName:
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      resourceFieldRef:
+                                        properties:
+                                          containerName:
+                                            type: string
+                                          divisor:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                            x-kubernetes-int-or-string: true
+                                          resource:
+                                            type: string
+                                        required:
+                                        - resource
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      secretKeyRef:
+                                        properties:
+                                          key:
+                                            type: string
+                                          name:
+                                            default: ""
+                                            type: string
+                                          optional:
+                                            type: boolean
+                                        required:
+                                        - key
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                    type: object
+                                required:
+                                - name
+                                type: object
+                              type: array
+                            extraEnvsFrom:
+                              items:
+                                properties:
+                                  configMapRef:
+                                    properties:
+                                      name:
+                                        default: ""
+                                        type: string
+                                      optional:
+                                        type: boolean
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                  prefix:
+                                    type: string
+                                  secretRef:
+                                    properties:
+                                      name:
+                                        default: ""
+                                        type: string
+                                      optional:
+                                        type: boolean
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                type: object
+                              type: array
+                            host_aliases:
+                              items:
+                                properties:
+                                  hostnames:
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  ip:
+                                    type: string
+                                required:
+                                - ip
+                                type: object
+                              type: array
+                            hostAliases:
+                              items:
+                                properties:
+                                  hostnames:
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  ip:
+                                    type: string
+                                required:
+                                - ip
+                                type: object
+                              type: array
+                            hostNetwork:
+                              type: boolean
+                            image:
+                              properties:
+                                pullPolicy:
+                                  type: string
+                                repository:
+                                  type: string
+                                tag:
+                                  type: string
+                              type: object
+                            imagePullSecrets:
+                              items:
+                                properties:
+                                  name:
+                                    default: ""
+                                    type: string
+                                type: object
+                                x-kubernetes-map-type: atomic
+                              type: array
+                            initContainers:
+                              items:
+                                properties:
+                                  args:
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  command:
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  env:
+                                    items:
+                                      properties:
+                                        name:
+                                          type: string
+                                        value:
+                                          type: string
+                                        valueFrom:
+                                          properties:
+                                            configMapKeyRef:
+                                              properties:
+                                                key:
+                                                  type: string
+                                                name:
+                                                  default: ""
+                                                  type: string
+                                                optional:
+                                                  type: boolean
+                                              required:
+                                              - key
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            fieldRef:
+                                              properties:
+                                                apiVersion:
+                                                  type: string
+                                                fieldPath:
+                                                  type: string
+                                              required:
+                                              - fieldPath
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            fileKeyRef:
+                                              properties:
+                                                key:
+                                                  type: string
+                                                optional:
+                                                  default: false
+                                                  type: boolean
+                                                path:
+                                                  type: string
+                                                volumeName:
+                                                  type: string
+                                              required:
+                                              - key
+                                              - path
+                                              - volumeName
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            resourceFieldRef:
+                                              properties:
+                                                containerName:
+                                                  type: string
+                                                divisor:
+                                                  anyOf:
+                                                  - type: integer
+                                                  - type: string
+                                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                  x-kubernetes-int-or-string: true
+                                                resource:
+                                                  type: string
+                                              required:
+                                              - resource
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            secretKeyRef:
+                                              properties:
+                                                key:
+                                                  type: string
+                                                name:
+                                                  default: ""
+                                                  type: string
+                                                optional:
+                                                  type: boolean
+                                              required:
+                                              - key
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                          type: object
+                                      required:
+                                      - name
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-map-keys:
+                                    - name
+                                    x-kubernetes-list-type: map
+                                  envFrom:
+                                    items:
+                                      properties:
+                                        configMapRef:
+                                          properties:
+                                            name:
+                                              default: ""
+                                              type: string
+                                            optional:
+                                              type: boolean
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        prefix:
+                                          type: string
+                                        secretRef:
+                                          properties:
+                                            name:
+                                              default: ""
+                                              type: string
+                                            optional:
+                                              type: boolean
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  image:
+                                    type: string
+                                  imagePullPolicy:
+                                    type: string
+                                  lifecycle:
+                                    properties:
+                                      postStart:
+                                        properties:
+                                          exec:
+                                            properties:
+                                              command:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            type: object
+                                          httpGet:
+                                            properties:
+                                              host:
+                                                type: string
+                                              httpHeaders:
+                                                items:
+                                                  properties:
+                                                    name:
+                                                      type: string
+                                                    value:
+                                                      type: string
+                                                  required:
+                                                  - name
+                                                  - value
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              path:
+                                                type: string
+                                              port:
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                x-kubernetes-int-or-string: true
+                                              scheme:
+                                                type: string
+                                            required:
+                                            - port
+                                            type: object
+                                          sleep:
+                                            properties:
+                                              seconds:
+                                                format: int64
+                                                type: integer
+                                            required:
+                                            - seconds
+                                            type: object
+                                          tcpSocket:
+                                            properties:
+                                              host:
+                                                type: string
+                                              port:
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                x-kubernetes-int-or-string: true
+                                            required:
+                                            - port
+                                            type: object
+                                        type: object
+                                      preStop:
+                                        properties:
+                                          exec:
+                                            properties:
+                                              command:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            type: object
+                                          httpGet:
+                                            properties:
+                                              host:
+                                                type: string
+                                              httpHeaders:
+                                                items:
+                                                  properties:
+                                                    name:
+                                                      type: string
+                                                    value:
+                                                      type: string
+                                                  required:
+                                                  - name
+                                                  - value
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              path:
+                                                type: string
+                                              port:
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                x-kubernetes-int-or-string: true
+                                              scheme:
+                                                type: string
+                                            required:
+                                            - port
+                                            type: object
+                                          sleep:
+                                            properties:
+                                              seconds:
+                                                format: int64
+                                                type: integer
+                                            required:
+                                            - seconds
+                                            type: object
+                                          tcpSocket:
+                                            properties:
+                                              host:
+                                                type: string
+                                              port:
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                x-kubernetes-int-or-string: true
+                                            required:
+                                            - port
+                                            type: object
+                                        type: object
+                                      stopSignal:
+                                        type: string
+                                    type: object
+                                  livenessProbe:
+                                    properties:
+                                      exec:
+                                        properties:
+                                          command:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        type: object
+                                      failureThreshold:
+                                        format: int32
+                                        type: integer
+                                      grpc:
+                                        properties:
+                                          port:
+                                            format: int32
+                                            type: integer
+                                          service:
+                                            default: ""
+                                            type: string
+                                        required:
+                                        - port
+                                        type: object
+                                      httpGet:
+                                        properties:
+                                          host:
+                                            type: string
+                                          httpHeaders:
+                                            items:
+                                              properties:
+                                                name:
+                                                  type: string
+                                                value:
+                                                  type: string
+                                              required:
+                                              - name
+                                              - value
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          path:
+                                            type: string
+                                          port:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            x-kubernetes-int-or-string: true
+                                          scheme:
+                                            type: string
+                                        required:
+                                        - port
+                                        type: object
+                                      initialDelaySeconds:
+                                        format: int32
+                                        type: integer
+                                      periodSeconds:
+                                        format: int32
+                                        type: integer
+                                      successThreshold:
+                                        format: int32
+                                        type: integer
+                                      tcpSocket:
+                                        properties:
+                                          host:
+                                            type: string
+                                          port:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            x-kubernetes-int-or-string: true
+                                        required:
+                                        - port
+                                        type: object
+                                      terminationGracePeriodSeconds:
+                                        format: int64
+                                        type: integer
+                                      timeoutSeconds:
+                                        format: int32
+                                        type: integer
+                                    type: object
+                                  name:
+                                    type: string
+                                  ports:
+                                    items:
+                                      properties:
+                                        containerPort:
+                                          format: int32
+                                          type: integer
+                                        hostIP:
+                                          type: string
+                                        hostPort:
+                                          format: int32
+                                          type: integer
+                                        name:
+                                          type: string
+                                        protocol:
+                                          default: TCP
+                                          type: string
+                                      required:
+                                      - containerPort
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-map-keys:
+                                    - containerPort
+                                    - protocol
+                                    x-kubernetes-list-type: map
+                                  readinessProbe:
+                                    properties:
+                                      exec:
+                                        properties:
+                                          command:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        type: object
+                                      failureThreshold:
+                                        format: int32
+                                        type: integer
+                                      grpc:
+                                        properties:
+                                          port:
+                                            format: int32
+                                            type: integer
+                                          service:
+                                            default: ""
+                                            type: string
+                                        required:
+                                        - port
+                                        type: object
+                                      httpGet:
+                                        properties:
+                                          host:
+                                            type: string
+                                          httpHeaders:
+                                            items:
+                                              properties:
+                                                name:
+                                                  type: string
+                                                value:
+                                                  type: string
+                                              required:
+                                              - name
+                                              - value
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          path:
+                                            type: string
+                                          port:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            x-kubernetes-int-or-string: true
+                                          scheme:
+                                            type: string
+                                        required:
+                                        - port
+                                        type: object
+                                      initialDelaySeconds:
+                                        format: int32
+                                        type: integer
+                                      periodSeconds:
+                                        format: int32
+                                        type: integer
+                                      successThreshold:
+                                        format: int32
+                                        type: integer
+                                      tcpSocket:
+                                        properties:
+                                          host:
+                                            type: string
+                                          port:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            x-kubernetes-int-or-string: true
+                                        required:
+                                        - port
+                                        type: object
+                                      terminationGracePeriodSeconds:
+                                        format: int64
+                                        type: integer
+                                      timeoutSeconds:
+                                        format: int32
+                                        type: integer
+                                    type: object
+                                  resizePolicy:
+                                    items:
+                                      properties:
+                                        resourceName:
+                                          type: string
+                                        restartPolicy:
+                                          type: string
+                                      required:
+                                      - resourceName
+                                      - restartPolicy
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  resources:
+                                    properties:
+                                      claims:
+                                        items:
+                                          properties:
+                                            name:
+                                              type: string
+                                            request:
+                                              type: string
+                                          required:
+                                          - name
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-map-keys:
+                                        - name
+                                        x-kubernetes-list-type: map
+                                      limits:
+                                        additionalProperties:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          x-kubernetes-int-or-string: true
+                                        type: object
+                                      requests:
+                                        additionalProperties:
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          x-kubernetes-int-or-string: true
+                                        type: object
+                                    type: object
+                                  restartPolicy:
+                                    type: string
+                                  restartPolicyRules:
+                                    items:
+                                      properties:
+                                        action:
+                                          type: string
+                                        exitCodes:
+                                          properties:
+                                            operator:
+                                              type: string
+                                            values:
+                                              items:
+                                                format: int32
+                                                type: integer
+                                              type: array
+                                              x-kubernetes-list-type: set
+                                          required:
+                                          - operator
+                                          type: object
+                                      required:
+                                      - action
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  securityContext:
+                                    properties:
+                                      allowPrivilegeEscalation:
+                                        type: boolean
+                                      appArmorProfile:
+                                        properties:
+                                          localhostProfile:
+                                            type: string
+                                          type:
+                                            type: string
+                                        required:
+                                        - type
+                                        type: object
+                                      capabilities:
+                                        properties:
+                                          add:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          drop:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        type: object
+                                      privileged:
+                                        type: boolean
+                                      procMount:
+                                        type: string
+                                      readOnlyRootFilesystem:
+                                        type: boolean
+                                      runAsGroup:
+                                        format: int64
+                                        type: integer
+                                      runAsNonRoot:
+                                        type: boolean
+                                      runAsUser:
+                                        format: int64
+                                        type: integer
+                                      seLinuxOptions:
+                                        properties:
+                                          level:
+                                            type: string
+                                          role:
+                                            type: string
+                                          type:
+                                            type: string
+                                          user:
+                                            type: string
+                                        type: object
+                                      seccompProfile:
+                                        properties:
+                                          localhostProfile:
+                                            type: string
+                                          type:
+                                            type: string
+                                        required:
+                                        - type
+                                        type: object
+                                      windowsOptions:
+                                        properties:
+                                          gmsaCredentialSpec:
+                                            type: string
+                                          gmsaCredentialSpecName:
+                                            type: string
+                                          hostProcess:
+                                            type: boolean
+                                          runAsUserName:
+                                            type: string
+                                        type: object
+                                    type: object
+                                  startupProbe:
+                                    properties:
+                                      exec:
+                                        properties:
+                                          command:
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        type: object
+                                      failureThreshold:
+                                        format: int32
+                                        type: integer
+                                      grpc:
+                                        properties:
+                                          port:
+                                            format: int32
+                                            type: integer
+                                          service:
+                                            default: ""
+                                            type: string
+                                        required:
+                                        - port
+                                        type: object
+                                      httpGet:
+                                        properties:
+                                          host:
+                                            type: string
+                                          httpHeaders:
+                                            items:
+                                              properties:
+                                                name:
+                                                  type: string
+                                                value:
+                                                  type: string
+                                              required:
+                                              - name
+                                              - value
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          path:
+                                            type: string
+                                          port:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            x-kubernetes-int-or-string: true
+                                          scheme:
+                                            type: string
+                                        required:
+                                        - port
+                                        type: object
+                                      initialDelaySeconds:
+                                        format: int32
+                                        type: integer
+                                      periodSeconds:
+                                        format: int32
+                                        type: integer
+                                      successThreshold:
+                                        format: int32
+                                        type: integer
+                                      tcpSocket:
+                                        properties:
+                                          host:
+                                            type: string
+                                          port:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            x-kubernetes-int-or-string: true
+                                        required:
+                                        - port
+                                        type: object
+                                      terminationGracePeriodSeconds:
+                                        format: int64
+                                        type: integer
+                                      timeoutSeconds:
+                                        format: int32
+                                        type: integer
+                                    type: object
+                                  stdin:
+                                    type: boolean
+                                  stdinOnce:
+                                    type: boolean
+                                  terminationMessagePath:
+                                    type: string
+                                  terminationMessagePolicy:
+                                    type: string
+                                  tty:
+                                    type: boolean
+                                  volumeDevices:
+                                    items:
+                                      properties:
+                                        devicePath:
+                                          type: string
+                                        name:
+                                          type: string
+                                      required:
+                                      - devicePath
+                                      - name
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-map-keys:
+                                    - devicePath
+                                    x-kubernetes-list-type: map
+                                  volumeMounts:
+                                    items:
+                                      properties:
+                                        mountPath:
+                                          type: string
+                                        mountPropagation:
+                                          type: string
+                                        name:
+                                          type: string
+                                        readOnly:
+                                          type: boolean
+                                        recursiveReadOnly:
+                                          type: string
+                                        subPath:
+                                          type: string
+                                        subPathExpr:
+                                          type: string
+                                      required:
+                                      - mountPath
+                                      - name
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-map-keys:
+                                    - mountPath
+                                    x-kubernetes-list-type: map
+                                  workingDir:
+                                    type: string
+                                required:
+                                - name
+                                type: object
+                              type: array
+                            license:
+                              properties:
+                                forceOffline:
+                                  type: boolean
+                                key:
+                                  type: string
+                                keyRef:
+                                  properties:
+                                    key:
+                                      type: string
+                                    name:
+                                      default: ""
+                                      type: string
+                                    optional:
+                                      type: boolean
+                                  required:
+                                  - key
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                reloadInterval:
+                                  type: string
+                              type: object
+                            livenessProbe:
+                              properties:
+                                exec:
+                                  properties:
+                                    command:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                failureThreshold:
+                                  format: int32
+                                  type: integer
+                                grpc:
+                                  properties:
+                                    port:
+                                      format: int32
+                                      type: integer
+                                    service:
+                                      default: ""
+                                      type: string
+                                  required:
+                                  - port
+                                  type: object
+                                httpGet:
+                                  properties:
+                                    host:
+                                      type: string
+                                    httpHeaders:
+                                      items:
+                                        properties:
+                                          name:
+                                            type: string
+                                          value:
+                                            type: string
+                                        required:
+                                        - name
+                                        - value
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    path:
+                                      type: string
+                                    port:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      x-kubernetes-int-or-string: true
+                                    scheme:
+                                      type: string
+                                  required:
+                                  - port
+                                  type: object
+                                initialDelaySeconds:
+                                  format: int32
+                                  type: integer
+                                periodSeconds:
+                                  format: int32
+                                  type: integer
+                                successThreshold:
+                                  format: int32
+                                  type: integer
+                                tcpSocket:
+                                  properties:
+                                    host:
+                                      type: string
+                                    port:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - port
+                                  type: object
+                                terminationGracePeriodSeconds:
+                                  format: int64
+                                  type: integer
+                                timeoutSeconds:
+                                  format: int32
+                                  type: integer
+                              type: object
+                            logFormat:
+                              enum:
+                              - default
+                              - json
+                              type: string
+                            logLevel:
+                              enum:
+                              - INFO
+                              - WARN
+                              - ERROR
+                              - FATAL
+                              - PANIC
+                              type: string
+                            managedMetadata:
+                              properties:
+                                annotations:
+                                  additionalProperties:
+                                    type: string
+                                  type: object
+                                labels:
+                                  additionalProperties:
+                                    type: string
+                                  type: object
+                              type: object
+                            minReadySeconds:
+                              format: int32
+                              type: integer
+                            nodeSelector:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            paused:
+                              type: boolean
+                            persistentVolumeClaimRetentionPolicy:
+                              properties:
+                                whenDeleted:
+                                  type: string
+                                whenScaled:
+                                  type: string
+                              type: object
+                            podDisruptionBudget:
+                              properties:
+                                maxUnavailable:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  x-kubernetes-int-or-string: true
+                                minAvailable:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  x-kubernetes-int-or-string: true
+                                selectorLabels:
+                                  additionalProperties:
+                                    type: string
+                                  type: object
+                                unhealthyPodEvictionPolicy:
+                                  enum:
+                                  - IfHealthyBudget
+                                  - AlwaysAllow
+                                  type: string
+                              type: object
+                            podMetadata:
+                              properties:
+                                annotations:
+                                  additionalProperties:
+                                    type: string
+                                  type: object
+                                labels:
+                                  additionalProperties:
+                                    type: string
+                                  type: object
+                                name:
+                                  type: string
+                              type: object
+                            port:
+                              type: string
+                            priorityClassName:
+                              type: string
+                            readinessGates:
+                              items:
+                                properties:
+                                  conditionType:
+                                    type: string
+                                required:
+                                - conditionType
+                                type: object
+                              type: array
+                            readinessProbe:
+                              properties:
+                                exec:
+                                  properties:
+                                    command:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                failureThreshold:
+                                  format: int32
+                                  type: integer
+                                grpc:
+                                  properties:
+                                    port:
+                                      format: int32
+                                      type: integer
+                                    service:
+                                      default: ""
+                                      type: string
+                                  required:
+                                  - port
+                                  type: object
+                                httpGet:
+                                  properties:
+                                    host:
+                                      type: string
+                                    httpHeaders:
+                                      items:
+                                        properties:
+                                          name:
+                                            type: string
+                                          value:
+                                            type: string
+                                        required:
+                                        - name
+                                        - value
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    path:
+                                      type: string
+                                    port:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      x-kubernetes-int-or-string: true
+                                    scheme:
+                                      type: string
+                                  required:
+                                  - port
+                                  type: object
+                                initialDelaySeconds:
+                                  format: int32
+                                  type: integer
+                                periodSeconds:
+                                  format: int32
+                                  type: integer
+                                successThreshold:
+                                  format: int32
+                                  type: integer
+                                tcpSocket:
+                                  properties:
+                                    host:
+                                      type: string
+                                    port:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - port
+                                  type: object
+                                terminationGracePeriodSeconds:
+                                  format: int64
+                                  type: integer
+                                timeoutSeconds:
+                                  format: int32
+                                  type: integer
+                              type: object
+                            remoteWriteSettings:
+                              properties:
+                                flushInterval:
+                                  pattern: '[0-9]+(ms|s|m|h)'
+                                  type: string
+                                label:
+                                  additionalProperties:
+                                    type: string
+                                  type: object
+                                maxBlockSize:
+                                  format: int32
+                                  type: integer
+                                maxDiskUsagePerURL:
+                                  x-kubernetes-preserve-unknown-fields: true
+                                queues:
+                                  format: int32
+                                  type: integer
+                                showURL:
+                                  type: boolean
+                                tmpDataPath:
+                                  type: string
+                                useMultiTenantMode:
+                                  type: boolean
+                              type: object
+                            replicaCount:
+                              format: int32
+                              type: integer
+                            resources:
+                              properties:
+                                claims:
+                                  items:
+                                    properties:
+                                      name:
+                                        type: string
+                                      request:
+                                        type: string
+                                    required:
+                                    - name
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-map-keys:
+                                  - name
+                                  x-kubernetes-list-type: map
+                                limits:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                requests:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                              type: object
+                            revisionHistoryLimitCount:
+                              format: int32
+                              type: integer
+                            rollingUpdate:
+                              properties:
+                                maxSurge:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  x-kubernetes-int-or-string: true
+                                maxUnavailable:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  x-kubernetes-int-or-string: true
+                              type: object
+                            runtimeClassName:
+                              type: string
+                            schedulerName:
+                              type: string
+                            secrets:
+                              items:
+                                type: string
+                              type: array
+                            securityContext:
+                              properties:
+                                allowPrivilegeEscalation:
+                                  type: boolean
+                                appArmorProfile:
+                                  properties:
+                                    localhostProfile:
+                                      type: string
+                                    type:
+                                      type: string
+                                  required:
+                                  - type
+                                  type: object
+                                capabilities:
+                                  properties:
+                                    add:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    drop:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                fsGroup:
+                                  format: int64
+                                  type: integer
+                                fsGroupChangePolicy:
+                                  type: string
+                                privileged:
+                                  type: boolean
+                                procMount:
+                                  type: string
+                                readOnlyRootFilesystem:
+                                  type: boolean
+                                runAsGroup:
+                                  format: int64
+                                  type: integer
+                                runAsNonRoot:
+                                  type: boolean
+                                runAsUser:
+                                  format: int64
+                                  type: integer
+                                seLinuxChangePolicy:
+                                  type: string
+                                seLinuxOptions:
+                                  properties:
+                                    level:
+                                      type: string
+                                    role:
+                                      type: string
+                                    type:
+                                      type: string
+                                    user:
+                                      type: string
+                                  type: object
+                                seccompProfile:
+                                  properties:
+                                    localhostProfile:
+                                      type: string
+                                    type:
+                                      type: string
+                                  required:
+                                  - type
+                                  type: object
+                                supplementalGroups:
+                                  items:
+                                    format: int64
+                                    type: integer
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                supplementalGroupsPolicy:
+                                  type: string
+                                sysctls:
+                                  items:
+                                    properties:
+                                      name:
+                                        type: string
+                                      value:
+                                        type: string
+                                    required:
+                                    - name
+                                    - value
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                windowsOptions:
+                                  properties:
+                                    gmsaCredentialSpec:
+                                      type: string
+                                    gmsaCredentialSpecName:
+                                      type: string
+                                    hostProcess:
+                                      type: boolean
+                                    runAsUserName:
+                                      type: string
+                                  type: object
+                              type: object
+                            serviceAccountName:
+                              type: string
+                            startupProbe:
+                              properties:
+                                exec:
+                                  properties:
+                                    command:
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  type: object
+                                failureThreshold:
+                                  format: int32
+                                  type: integer
+                                grpc:
+                                  properties:
+                                    port:
+                                      format: int32
+                                      type: integer
+                                    service:
+                                      default: ""
+                                      type: string
+                                  required:
+                                  - port
+                                  type: object
+                                httpGet:
+                                  properties:
+                                    host:
+                                      type: string
+                                    httpHeaders:
+                                      items:
+                                        properties:
+                                          name:
+                                            type: string
+                                          value:
+                                            type: string
+                                        required:
+                                        - name
+                                        - value
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    path:
+                                      type: string
+                                    port:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      x-kubernetes-int-or-string: true
+                                    scheme:
+                                      type: string
+                                  required:
+                                  - port
+                                  type: object
+                                initialDelaySeconds:
+                                  format: int32
+                                  type: integer
+                                periodSeconds:
+                                  format: int32
+                                  type: integer
+                                successThreshold:
+                                  format: int32
+                                  type: integer
+                                tcpSocket:
+                                  properties:
+                                    host:
+                                      type: string
+                                    port:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - port
+                                  type: object
+                                terminationGracePeriodSeconds:
+                                  format: int64
+                                  type: integer
+                                timeoutSeconds:
+                                  format: int32
+                                  type: integer
+                              type: object
+                            statefulMode:
+                              type: boolean
+                            statefulRollingUpdateStrategy:
+                              type: string
+                            statefulStorage:
+                              properties:
+                                emptyDir:
+                                  properties:
+                                    medium:
+                                      type: string
+                                    sizeLimit:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                  type: object
+                                volumeClaimTemplate:
+                                  properties:
+                                    apiVersion:
+                                      type: string
+                                    kind:
+                                      type: string
+                                    metadata:
+                                      properties:
+                                        annotations:
+                                          additionalProperties:
+                                            type: string
+                                          type: object
+                                        labels:
+                                          additionalProperties:
+                                            type: string
+                                          type: object
+                                        name:
+                                          type: string
+                                      type: object
+                                    spec:
+                                      properties:
+                                        accessModes:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        dataSource:
+                                          properties:
+                                            apiGroup:
+                                              type: string
+                                            kind:
+                                              type: string
+                                            name:
+                                              type: string
+                                          required:
+                                          - kind
+                                          - name
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        dataSourceRef:
+                                          properties:
+                                            apiGroup:
+                                              type: string
+                                            kind:
+                                              type: string
+                                            name:
+                                              type: string
+                                            namespace:
+                                              type: string
+                                          required:
+                                          - kind
+                                          - name
+                                          type: object
+                                        resources:
+                                          properties:
+                                            limits:
+                                              additionalProperties:
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                x-kubernetes-int-or-string: true
+                                              type: object
+                                            requests:
+                                              additionalProperties:
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                x-kubernetes-int-or-string: true
+                                              type: object
+                                          type: object
+                                        selector:
+                                          properties:
+                                            matchExpressions:
+                                              items:
+                                                properties:
+                                                  key:
+                                                    type: string
+                                                  operator:
+                                                    type: string
+                                                  values:
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        storageClassName:
+                                          type: string
+                                        volumeAttributesClassName:
+                                          type: string
+                                        volumeMode:
+                                          type: string
+                                        volumeName:
+                                          type: string
+                                      type: object
+                                    status:
+                                      properties:
+                                        accessModes:
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        allocatedResourceStatuses:
+                                          additionalProperties:
+                                            type: string
+                                          type: object
+                                          x-kubernetes-map-type: granular
+                                        allocatedResources:
+                                          additionalProperties:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                            x-kubernetes-int-or-string: true
+                                          type: object
+                                        capacity:
+                                          additionalProperties:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                            x-kubernetes-int-or-string: true
+                                          type: object
+                                        conditions:
+                                          items:
+                                            properties:
+                                              lastProbeTime:
+                                                format: date-time
+                                                type: string
+                                              lastTransitionTime:
+                                                format: date-time
+                                                type: string
+                                              message:
+                                                type: string
+                                              reason:
+                                                type: string
+                                              status:
+                                                type: string
+                                              type:
+                                                type: string
+                                            required:
+                                            - status
+                                            - type
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-map-keys:
+                                          - type
+                                          x-kubernetes-list-type: map
+                                        currentVolumeAttributesClassName:
+                                          type: string
+                                        modifyVolumeStatus:
+                                          properties:
+                                            status:
+                                              type: string
+                                            targetVolumeAttributesClassName:
+                                              type: string
+                                          required:
+                                          - status
+                                          type: object
+                                        phase:
+                                          type: string
+                                      type: object
+                                  type: object
+                              type: object
+                            terminationGracePeriodSeconds:
+                              format: int64
+                              type: integer
+                            tolerations:
+                              items:
+                                properties:
+                                  effect:
+                                    type: string
+                                  key:
+                                    type: string
+                                  operator:
+                                    type: string
+                                  tolerationSeconds:
+                                    format: int64
+                                    type: integer
+                                  value:
+                                    type: string
+                                type: object
+                              type: array
+                            topologySpreadConstraints:
+                              items:
+                                properties:
+                                  labelSelector:
+                                    properties:
+                                      matchExpressions:
+                                        items:
+                                          properties:
+                                            key:
+                                              type: string
+                                            operator:
+                                              type: string
+                                            values:
+                                              items:
+                                                type: string
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                          required:
+                                          - key
+                                          - operator
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      matchLabels:
+                                        additionalProperties:
+                                          type: string
+                                        type: object
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                  matchLabelKeys:
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  maxSkew:
+                                    format: int32
+                                    type: integer
+                                  minDomains:
+                                    format: int32
+                                    type: integer
+                                  nodeAffinityPolicy:
+                                    type: string
+                                  nodeTaintsPolicy:
+                                    type: string
+                                  topologyKey:
+                                    type: string
+                                  whenUnsatisfiable:
+                                    type: string
+                                required:
+                                - maxSkew
+                                - topologyKey
+                                - whenUnsatisfiable
+                                type: object
+                              type: array
+                            updateStrategy:
+                              enum:
+                              - Recreate
+                              - RollingUpdate
+                              type: string
+                            useDefaultResources:
+                              type: boolean
+                            useStrictSecurity:
+                              type: boolean
+                            volumeMounts:
+                              items:
+                                properties:
+                                  mountPath:
+                                    type: string
+                                  mountPropagation:
+                                    type: string
+                                  name:
+                                    type: string
+                                  readOnly:
+                                    type: boolean
+                                  recursiveReadOnly:
+                                    type: string
+                                  subPath:
+                                    type: string
+                                  subPathExpr:
+                                    type: string
+                                required:
+                                - mountPath
+                                - name
+                                type: object
+                              type: array
+                            volumes:
+                              items:
+                                properties:
+                                  awsElasticBlockStore:
+                                    properties:
+                                      fsType:
+                                        type: string
+                                      partition:
+                                        format: int32
+                                        type: integer
+                                      readOnly:
+                                        type: boolean
+                                      volumeID:
+                                        type: string
+                                    required:
+                                    - volumeID
+                                    type: object
+                                  azureDisk:
+                                    properties:
+                                      cachingMode:
+                                        type: string
+                                      diskName:
+                                        type: string
+                                      diskURI:
+                                        type: string
+                                      fsType:
+                                        default: ext4
+                                        type: string
+                                      kind:
+                                        type: string
+                                      readOnly:
+                                        default: false
+                                        type: boolean
+                                    required:
+                                    - diskName
+                                    - diskURI
+                                    type: object
+                                  azureFile:
+                                    properties:
+                                      readOnly:
+                                        type: boolean
+                                      secretName:
+                                        type: string
+                                      shareName:
+                                        type: string
+                                    required:
+                                    - secretName
+                                    - shareName
+                                    type: object
+                                  cephfs:
+                                    properties:
+                                      monitors:
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      path:
+                                        type: string
+                                      readOnly:
+                                        type: boolean
+                                      secretFile:
+                                        type: string
+                                      secretRef:
+                                        properties:
+                                          name:
+                                            default: ""
+                                            type: string
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      user:
+                                        type: string
+                                    required:
+                                    - monitors
+                                    type: object
+                                  cinder:
+                                    properties:
+                                      fsType:
+                                        type: string
+                                      readOnly:
+                                        type: boolean
+                                      secretRef:
+                                        properties:
+                                          name:
+                                            default: ""
+                                            type: string
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      volumeID:
+                                        type: string
+                                    required:
+                                    - volumeID
+                                    type: object
+                                  configMap:
+                                    properties:
+                                      defaultMode:
+                                        format: int32
+                                        type: integer
+                                      items:
+                                        items:
+                                          properties:
+                                            key:
+                                              type: string
+                                            mode:
+                                              format: int32
+                                              type: integer
+                                            path:
+                                              type: string
+                                          required:
+                                          - key
+                                          - path
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      name:
+                                        default: ""
+                                        type: string
+                                      optional:
+                                        type: boolean
+                                    type: object
+                                    x-kubernetes-map-type: atomic
+                                  csi:
+                                    properties:
+                                      driver:
+                                        type: string
+                                      fsType:
+                                        type: string
+                                      nodePublishSecretRef:
+                                        properties:
+                                          name:
+                                            default: ""
+                                            type: string
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      readOnly:
+                                        type: boolean
+                                      volumeAttributes:
+                                        additionalProperties:
+                                          type: string
+                                        type: object
+                                    required:
+                                    - driver
+                                    type: object
+                                  downwardAPI:
+                                    properties:
+                                      defaultMode:
+                                        format: int32
+                                        type: integer
+                                      items:
+                                        items:
+                                          properties:
+                                            fieldRef:
+                                              properties:
+                                                apiVersion:
+                                                  type: string
+                                                fieldPath:
+                                                  type: string
+                                              required:
+                                              - fieldPath
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            mode:
+                                              format: int32
+                                              type: integer
+                                            path:
+                                              type: string
+                                            resourceFieldRef:
+                                              properties:
+                                                containerName:
+                                                  type: string
+                                                divisor:
+                                                  anyOf:
+                                                  - type: integer
+                                                  - type: string
+                                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                  x-kubernetes-int-or-string: true
+                                                resource:
+                                                  type: string
+                                              required:
+                                              - resource
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                          required:
+                                          - path
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    type: object
+                                  emptyDir:
+                                    properties:
+                                      medium:
+                                        type: string
+                                      sizeLimit:
+                                        anyOf:
+                                        - type: integer
+                                        - type: string
+                                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                        x-kubernetes-int-or-string: true
+                                    type: object
+                                  ephemeral:
+                                    properties:
+                                      volumeClaimTemplate:
+                                        properties:
+                                          metadata:
+                                            type: object
+                                          spec:
+                                            properties:
+                                              accessModes:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              dataSource:
+                                                properties:
+                                                  apiGroup:
+                                                    type: string
+                                                  kind:
+                                                    type: string
+                                                  name:
+                                                    type: string
+                                                required:
+                                                - kind
+                                                - name
+                                                type: object
+                                                x-kubernetes-map-type: atomic
+                                              dataSourceRef:
+                                                properties:
+                                                  apiGroup:
+                                                    type: string
+                                                  kind:
+                                                    type: string
+                                                  name:
+                                                    type: string
+                                                  namespace:
+                                                    type: string
+                                                required:
+                                                - kind
+                                                - name
+                                                type: object
+                                              resources:
+                                                properties:
+                                                  limits:
+                                                    additionalProperties:
+                                                      anyOf:
+                                                      - type: integer
+                                                      - type: string
+                                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                      x-kubernetes-int-or-string: true
+                                                    type: object
+                                                  requests:
+                                                    additionalProperties:
+                                                      anyOf:
+                                                      - type: integer
+                                                      - type: string
+                                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                      x-kubernetes-int-or-string: true
+                                                    type: object
+                                                type: object
+                                              selector:
+                                                properties:
+                                                  matchExpressions:
+                                                    items:
+                                                      properties:
+                                                        key:
+                                                          type: string
+                                                        operator:
+                                                          type: string
+                                                        values:
+                                                          items:
+                                                            type: string
+                                                          type: array
+                                                          x-kubernetes-list-type: atomic
+                                                      required:
+                                                      - key
+                                                      - operator
+                                                      type: object
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                  matchLabels:
+                                                    additionalProperties:
+                                                      type: string
+                                                    type: object
+                                                type: object
+                                                x-kubernetes-map-type: atomic
+                                              storageClassName:
+                                                type: string
+                                              volumeAttributesClassName:
+                                                type: string
+                                              volumeMode:
+                                                type: string
+                                              volumeName:
+                                                type: string
+                                            type: object
+                                        required:
+                                        - spec
+                                        type: object
+                                    type: object
+                                  fc:
+                                    properties:
+                                      fsType:
+                                        type: string
+                                      lun:
+                                        format: int32
+                                        type: integer
+                                      readOnly:
+                                        type: boolean
+                                      targetWWNs:
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      wwids:
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    type: object
+                                  flexVolume:
+                                    properties:
+                                      driver:
+                                        type: string
+                                      fsType:
+                                        type: string
+                                      options:
+                                        additionalProperties:
+                                          type: string
+                                        type: object
+                                      readOnly:
+                                        type: boolean
+                                      secretRef:
+                                        properties:
+                                          name:
+                                            default: ""
+                                            type: string
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                    required:
+                                    - driver
+                                    type: object
+                                  flocker:
+                                    properties:
+                                      datasetName:
+                                        type: string
+                                      datasetUUID:
+                                        type: string
+                                    type: object
+                                  gcePersistentDisk:
+                                    properties:
+                                      fsType:
+                                        type: string
+                                      partition:
+                                        format: int32
+                                        type: integer
+                                      pdName:
+                                        type: string
+                                      readOnly:
+                                        type: boolean
+                                    required:
+                                    - pdName
+                                    type: object
+                                  gitRepo:
+                                    properties:
+                                      directory:
+                                        type: string
+                                      repository:
+                                        type: string
+                                      revision:
+                                        type: string
+                                    required:
+                                    - repository
+                                    type: object
+                                  glusterfs:
+                                    properties:
+                                      endpoints:
+                                        type: string
+                                      path:
+                                        type: string
+                                      readOnly:
+                                        type: boolean
+                                    required:
+                                    - endpoints
+                                    - path
+                                    type: object
+                                  hostPath:
+                                    properties:
+                                      path:
+                                        type: string
+                                      type:
+                                        type: string
+                                    required:
+                                    - path
+                                    type: object
+                                  image:
+                                    properties:
+                                      pullPolicy:
+                                        type: string
+                                      reference:
+                                        type: string
+                                    type: object
+                                  iscsi:
+                                    properties:
+                                      chapAuthDiscovery:
+                                        type: boolean
+                                      chapAuthSession:
+                                        type: boolean
+                                      fsType:
+                                        type: string
+                                      initiatorName:
+                                        type: string
+                                      iqn:
+                                        type: string
+                                      iscsiInterface:
+                                        default: default
+                                        type: string
+                                      lun:
+                                        format: int32
+                                        type: integer
+                                      portals:
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      readOnly:
+                                        type: boolean
+                                      secretRef:
+                                        properties:
+                                          name:
+                                            default: ""
+                                            type: string
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      targetPortal:
+                                        type: string
+                                    required:
+                                    - iqn
+                                    - lun
+                                    - targetPortal
+                                    type: object
+                                  name:
+                                    type: string
+                                  nfs:
+                                    properties:
+                                      path:
+                                        type: string
+                                      readOnly:
+                                        type: boolean
+                                      server:
+                                        type: string
+                                    required:
+                                    - path
+                                    - server
+                                    type: object
+                                  persistentVolumeClaim:
+                                    properties:
+                                      claimName:
+                                        type: string
+                                      readOnly:
+                                        type: boolean
+                                    required:
+                                    - claimName
+                                    type: object
+                                  photonPersistentDisk:
+                                    properties:
+                                      fsType:
+                                        type: string
+                                      pdID:
+                                        type: string
+                                    required:
+                                    - pdID
+                                    type: object
+                                  portworxVolume:
+                                    properties:
+                                      fsType:
+                                        type: string
+                                      readOnly:
+                                        type: boolean
+                                      volumeID:
+                                        type: string
+                                    required:
+                                    - volumeID
+                                    type: object
+                                  projected:
+                                    properties:
+                                      defaultMode:
+                                        format: int32
+                                        type: integer
+                                      sources:
+                                        items:
+                                          properties:
+                                            clusterTrustBundle:
+                                              properties:
+                                                labelSelector:
+                                                  properties:
+                                                    matchExpressions:
+                                                      items:
+                                                        properties:
+                                                          key:
+                                                            type: string
+                                                          operator:
+                                                            type: string
+                                                          values:
+                                                            items:
+                                                              type: string
+                                                            type: array
+                                                            x-kubernetes-list-type: atomic
+                                                        required:
+                                                        - key
+                                                        - operator
+                                                        type: object
+                                                      type: array
+                                                      x-kubernetes-list-type: atomic
+                                                    matchLabels:
+                                                      additionalProperties:
+                                                        type: string
+                                                      type: object
+                                                  type: object
+                                                  x-kubernetes-map-type: atomic
+                                                name:
+                                                  type: string
+                                                optional:
+                                                  type: boolean
+                                                path:
+                                                  type: string
+                                                signerName:
+                                                  type: string
+                                              required:
+                                              - path
+                                              type: object
+                                            configMap:
+                                              properties:
+                                                items:
+                                                  items:
+                                                    properties:
+                                                      key:
+                                                        type: string
+                                                      mode:
+                                                        format: int32
+                                                        type: integer
+                                                      path:
+                                                        type: string
+                                                    required:
+                                                    - key
+                                                    - path
+                                                    type: object
+                                                  type: array
+                                                  x-kubernetes-list-type: atomic
+                                                name:
+                                                  default: ""
+                                                  type: string
+                                                optional:
+                                                  type: boolean
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            downwardAPI:
+                                              properties:
+                                                items:
+                                                  items:
+                                                    properties:
+                                                      fieldRef:
+                                                        properties:
+                                                          apiVersion:
+                                                            type: string
+                                                          fieldPath:
+                                                            type: string
+                                                        required:
+                                                        - fieldPath
+                                                        type: object
+                                                        x-kubernetes-map-type: atomic
+                                                      mode:
+                                                        format: int32
+                                                        type: integer
+                                                      path:
+                                                        type: string
+                                                      resourceFieldRef:
+                                                        properties:
+                                                          containerName:
+                                                            type: string
+                                                          divisor:
+                                                            anyOf:
+                                                            - type: integer
+                                                            - type: string
+                                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                            x-kubernetes-int-or-string: true
+                                                          resource:
+                                                            type: string
+                                                        required:
+                                                        - resource
+                                                        type: object
+                                                        x-kubernetes-map-type: atomic
+                                                    required:
+                                                    - path
+                                                    type: object
+                                                  type: array
+                                                  x-kubernetes-list-type: atomic
+                                              type: object
+                                            podCertificate:
+                                              properties:
+                                                certificateChainPath:
+                                                  type: string
+                                                credentialBundlePath:
+                                                  type: string
+                                                keyPath:
+                                                  type: string
+                                                keyType:
+                                                  type: string
+                                                maxExpirationSeconds:
+                                                  format: int32
+                                                  type: integer
+                                                signerName:
+                                                  type: string
+                                              required:
+                                              - keyType
+                                              - signerName
+                                              type: object
+                                            secret:
+                                              properties:
+                                                items:
+                                                  items:
+                                                    properties:
+                                                      key:
+                                                        type: string
+                                                      mode:
+                                                        format: int32
+                                                        type: integer
+                                                      path:
+                                                        type: string
+                                                    required:
+                                                    - key
+                                                    - path
+                                                    type: object
+                                                  type: array
+                                                  x-kubernetes-list-type: atomic
+                                                name:
+                                                  default: ""
+                                                  type: string
+                                                optional:
+                                                  type: boolean
+                                              type: object
+                                              x-kubernetes-map-type: atomic
+                                            serviceAccountToken:
+                                              properties:
+                                                audience:
+                                                  type: string
+                                                expirationSeconds:
+                                                  format: int64
+                                                  type: integer
+                                                path:
+                                                  type: string
+                                              required:
+                                              - path
+                                              type: object
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    type: object
+                                  quobyte:
+                                    properties:
+                                      group:
+                                        type: string
+                                      readOnly:
+                                        type: boolean
+                                      registry:
+                                        type: string
+                                      tenant:
+                                        type: string
+                                      user:
+                                        type: string
+                                      volume:
+                                        type: string
+                                    required:
+                                    - registry
+                                    - volume
+                                    type: object
+                                  rbd:
+                                    properties:
+                                      fsType:
+                                        type: string
+                                      image:
+                                        type: string
+                                      keyring:
+                                        default: /etc/ceph/keyring
+                                        type: string
+                                      monitors:
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      pool:
+                                        default: rbd
+                                        type: string
+                                      readOnly:
+                                        type: boolean
+                                      secretRef:
+                                        properties:
+                                          name:
+                                            default: ""
+                                            type: string
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      user:
+                                        default: admin
+                                        type: string
+                                    required:
+                                    - image
+                                    - monitors
+                                    type: object
+                                  scaleIO:
+                                    properties:
+                                      fsType:
+                                        default: xfs
+                                        type: string
+                                      gateway:
+                                        type: string
+                                      protectionDomain:
+                                        type: string
+                                      readOnly:
+                                        type: boolean
+                                      secretRef:
+                                        properties:
+                                          name:
+                                            default: ""
+                                            type: string
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      sslEnabled:
+                                        type: boolean
+                                      storageMode:
+                                        default: ThinProvisioned
+                                        type: string
+                                      storagePool:
+                                        type: string
+                                      system:
+                                        type: string
+                                      volumeName:
+                                        type: string
+                                    required:
+                                    - gateway
+                                    - secretRef
+                                    - system
+                                    type: object
+                                  secret:
+                                    properties:
+                                      defaultMode:
+                                        format: int32
+                                        type: integer
+                                      items:
+                                        items:
+                                          properties:
+                                            key:
+                                              type: string
+                                            mode:
+                                              format: int32
+                                              type: integer
+                                            path:
+                                              type: string
+                                          required:
+                                          - key
+                                          - path
+                                          type: object
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      optional:
+                                        type: boolean
+                                      secretName:
+                                        type: string
+                                    type: object
+                                  storageos:
+                                    properties:
+                                      fsType:
+                                        type: string
+                                      readOnly:
+                                        type: boolean
+                                      secretRef:
+                                        properties:
+                                          name:
+                                            default: ""
+                                            type: string
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      volumeName:
+                                        type: string
+                                      volumeNamespace:
+                                        type: string
+                                    type: object
+                                  vsphereVolume:
+                                    properties:
+                                      fsType:
+                                        type: string
+                                      storagePolicyID:
+                                        type: string
+                                      storagePolicyName:
+                                        type: string
+                                      volumePath:
+                                        type: string
+                                    required:
+                                    - volumePath
+                                    type: object
+                                required:
+                                - name
+                                type: object
+                              type: array
+                          type: object
+                      type: object
+                    vmcluster:
+                      properties:
+                        name:
+                          type: string
+                        spec:
+                          x-kubernetes-preserve-unknown-fields: true
+                      type: object
+                  required:
+                  - name
+                  type: object
+                type: array
+            type: object
+          status:
+            properties:
+              conditions:
+                items:
+                  properties:
+                    lastTransitionTime:
+                      format: date-time
+                      type: string
+                    lastUpdateTime:
+                      format: date-time
+                      type: string
+                    message:
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      maxLength: 1024
+                      minLength: 1
+                      type: string
+                    status:
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      maxLength: 316
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - lastUpdateTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              observedGeneration:
+                format: int64
+                type: integer
+              reason:
+                type: string
+              updateStatus:
+                type: string
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmnodescrapes.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -20779,121 +29821,60 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: |-
-          VMNodeScrape defines discovery for targets placed on kubernetes nodes,
-          usually its node-exporters and other host services.
-          InternalIP is used as __address__ for scraping.
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMNodeScrapeSpec defines specification for VMNodeScrape.
             properties:
               authorization:
-                description: Authorization with http header Authorization
                 properties:
                   credentials:
-                    description: Reference to the secret with value for authorization
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   credentialsFile:
-                    description: File with value for authorization
                     type: string
                   type:
-                    description: Type of authorization, default to bearer
                     type: string
                 type: object
               basicAuth:
-                description: BasicAuth allow an endpoint to authenticate over basic
-                  authentication
                 properties:
                   password:
-                    description: |-
-                      Password defines reference for secret with password value
-                      The secret needs to be in the same namespace as scrape object
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   password_file:
-                    description: |-
-                      PasswordFile defines path to password file at disk
-                      must be pre-mounted
                     type: string
                   username:
-                    description: |-
-                      Username defines reference for secret with username value
-                      The secret needs to be in the same namespace as scrape object
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
@@ -20901,181 +29882,94 @@ spec:
                     x-kubernetes-map-type: atomic
                 type: object
               bearerTokenFile:
-                description: File to read bearer token for scraping targets.
                 type: string
               bearerTokenSecret:
-                description: |-
-                  Secret to mount to read bearer token for scraping targets. The secret
-                  needs to be in the same namespace as the scrape object and accessible by
-                  the victoria-metrics operator.
                 nullable: true
                 properties:
                   key:
-                    description: The key of the secret to select from.  Must be a
-                      valid secret key.
                     type: string
                   name:
                     default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                     type: string
                   optional:
-                    description: Specify whether the Secret or its key must be defined
                     type: boolean
                 required:
                 - key
                 type: object
                 x-kubernetes-map-type: atomic
               follow_redirects:
-                description: FollowRedirects controls redirects for scraping.
                 type: boolean
               honorLabels:
-                description: HonorLabels chooses the metric's labels on collisions
-                  with target labels.
                 type: boolean
               honorTimestamps:
-                description: HonorTimestamps controls whether vmagent respects the
-                  timestamps present in scraped data.
                 type: boolean
               interval:
-                description: Interval at which metrics should be scraped
                 type: string
               jobLabel:
-                description: The label to use to retrieve the job name from.
                 type: string
               max_scrape_size:
-                description: MaxScrapeSize defines a maximum size of scraped data
-                  for a job
                 type: string
               metricRelabelConfigs:
-                description: MetricRelabelConfigs to apply to samples after scrapping.
                 items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
                   properties:
                     action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
                       type: string
                     if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
                       x-kubernetes-preserve-unknown-fields: true
                     labels:
                       additionalProperties:
                         type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
                       type: object
                     match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
                       type: string
                     modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
                       format: int64
                       type: integer
                     regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                       x-kubernetes-preserve-unknown-fields: true
                     replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
                       type: string
                     separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
                       type: string
                     source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       items:
                         type: string
                       type: array
                     sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
                       items:
                         type: string
                       type: array
                     target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       type: string
                     targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
                       type: string
                   type: object
                 type: array
               oauth2:
-                description: OAuth2 defines auth configuration
                 properties:
                   client_id:
-                    description: The secret or configmap containing the OAuth2 client
-                      id
                     properties:
                       configMap:
-                        description: ConfigMap containing data to use for the targets.
                         properties:
                           key:
-                            description: The key to select.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       secret:
-                        description: Secret containing data to use for the targets.
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
@@ -21083,56 +29977,33 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                   client_secret:
-                    description: The secret containing the OAuth2 client secret
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   client_secret_file:
-                    description: ClientSecretFile defines path for client secret file.
                     type: string
                   endpoint_params:
                     additionalProperties:
                       type: string
-                    description: Parameters to append to the token URL
                     type: object
                   proxy_url:
-                    description: |-
-                      The proxy URL for token_url connection
-                      ( available from v0.55.0).
-                      Is only supported by Scrape objects family
                     type: string
                   scopes:
-                    description: OAuth2 scopes used for the token request
                     items:
                       type: string
                     type: array
                   tls_config:
-                    description: |-
-                      TLSConfig for token_url connection
-                      ( available from v0.55.0).
-                      Is only supported by Scrape objects family
                     x-kubernetes-preserve-unknown-fields: true
                   token_url:
-                    description: The URL to fetch the token from
                     minLength: 1
                     type: string
                 required:
@@ -21144,101 +30015,52 @@ spec:
                   items:
                     type: string
                   type: array
-                description: Optional HTTP URL parameters
                 type: object
               path:
-                description: HTTP path to scrape for metrics.
                 type: string
               port:
-                description: Name of the port exposed at Node.
                 type: string
               proxyURL:
-                description: ProxyURL eg http://proxyserver:2195 Directs scrapes to
-                  proxy through this endpoint.
                 type: string
               relabelConfigs:
-                description: RelabelConfigs to apply to samples during service discovery.
                 items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
                   properties:
                     action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
                       type: string
                     if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
                       x-kubernetes-preserve-unknown-fields: true
                     labels:
                       additionalProperties:
                         type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
                       type: object
                     match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
                       type: string
                     modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
                       format: int64
                       type: integer
                     regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                       x-kubernetes-preserve-unknown-fields: true
                     replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
                       type: string
                     separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
                       type: string
                     source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       items:
                         type: string
                       type: array
                     sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
                       items:
                         type: string
                       type: array
                     target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       type: string
                     targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
                       type: string
                   type: object
                 type: array
               sampleLimit:
-                description: SampleLimit defines per-scrape limit on number of scraped
-                  samples that will be accepted.
-                format: int64
                 type: integer
               scheme:
-                description: HTTP scheme to use for scraping.
                 enum:
                 - http
                 - https
@@ -21246,39 +30068,21 @@ spec:
                 - HTTP
                 type: string
               scrape_interval:
-                description: |-
-                  ScrapeInterval is the same as Interval and has priority over it.
-                  one of scrape_interval or interval can be used
+                type: string
+              scrapeClass:
                 type: string
               scrapeTimeout:
-                description: Timeout after which the scrape is ended
                 type: string
               selector:
-                description: Selector to select kubernetes Nodes.
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -21292,73 +30096,40 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               seriesLimit:
-                description: |-
-                  SeriesLimit defines per-scrape limit on number of unique time series
-                  a single target can expose during all the scrapes on the time window of 24h.
-                format: int64
                 type: integer
               targetLabels:
-                description: TargetLabels transfers labels on the Kubernetes Node
-                  onto the target.
                 items:
                   type: string
                 type: array
               tlsConfig:
-                description: TLSConfig configuration to use when scraping the endpoint
                 properties:
                   ca:
-                    description: Struct containing the CA cert to use for the targets.
                     properties:
                       configMap:
-                        description: ConfigMap containing data to use for the targets.
                         properties:
                           key:
-                            description: The key to select.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       secret:
-                        description: Secret containing data to use for the targets.
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
@@ -21366,54 +30137,30 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                   caFile:
-                    description: Path to the CA cert in the container to use for the
-                      targets.
                     type: string
                   cert:
-                    description: Struct containing the client cert file for the targets.
                     properties:
                       configMap:
-                        description: ConfigMap containing data to use for the targets.
                         properties:
                           key:
-                            description: The key to select.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       secret:
-                        description: Secret containing data to use for the targets.
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
@@ -21421,131 +30168,66 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                   certFile:
-                    description: Path to the client cert file in the container for
-                      the targets.
                     type: string
                   insecureSkipVerify:
-                    description: Disable target certificate validation.
                     type: boolean
                   keyFile:
-                    description: Path to the client key file in the container for
-                      the targets.
                     type: string
                   keySecret:
-                    description: Secret containing the client key file for the targets.
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   serverName:
-                    description: Used to verify the hostname for the targets.
                     type: string
                 type: object
               vm_scrape_params:
-                description: VMScrapeParams defines VictoriaMetrics specific scrape
-                  parameters
                 properties:
                   disable_compression:
-                    description: DisableCompression
                     type: boolean
                   disable_keep_alive:
-                    description: |-
-                      disable_keepalive allows disabling HTTP keep-alive when scraping targets.
-                      By default, HTTP keep-alive is enabled, so TCP connections to scrape targets
-                      could be reused.
-                      See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements
                     type: boolean
                   headers:
-                    description: |-
-                      Headers allows sending custom headers to scrape targets
-                      must be in of semicolon separated header with it's value
-                      eg:
-                      headerName: headerValue
-                      vmagent supports since 1.79.0 version
                     items:
                       type: string
                     type: array
                   no_stale_markers:
                     type: boolean
                   proxy_client_config:
-                    description: |-
-                      ProxyClientConfig configures proxy auth settings for scraping
-                      See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy
                     properties:
                       basic_auth:
-                        description: BasicAuth allow an endpoint to authenticate over
-                          basic authentication
                         properties:
                           password:
-                            description: |-
-                              Password defines reference for secret with password value
-                              The secret needs to be in the same namespace as scrape object
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
                             type: object
                             x-kubernetes-map-type: atomic
                           password_file:
-                            description: |-
-                              PasswordFile defines path to password file at disk
-                              must be pre-mounted
                             type: string
                           username:
-                            description: |-
-                              Username defines reference for secret with username value
-                              The secret needs to be in the same namespace as scrape object
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
@@ -21553,24 +30235,13 @@ spec:
                             x-kubernetes-map-type: atomic
                         type: object
                       bearer_token:
-                        description: SecretKeySelector selects a key of a Secret.
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
@@ -21590,58 +30261,34 @@ spec:
                 type: object
             type: object
           status:
-            description: ScrapeObjectStatus defines the observed state of ScrapeObjects
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -21656,16 +30303,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -21678,7 +30320,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmpodscrapes.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -21702,165 +30344,88 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: |-
-          VMPodScrape is scrape configuration for pods,
-          it generates vmagent's config for scraping pod targets
-          based on selectors.
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMPodScrapeSpec defines the desired state of VMPodScrape
             properties:
               attach_metadata:
-                description: AttachMetadata configures metadata attaching from service
-                  discovery
                 properties:
+                  namespace:
+                    type: boolean
                   node:
-                    description: |-
-                      Node instructs vmagent to add node specific metadata from service discovery
-                      Valid for roles: pod, endpoints, endpointslice.
                     type: boolean
                 type: object
               jobLabel:
-                description: The label to use to retrieve the job name from.
                 type: string
               namespaceSelector:
-                description: Selector to select which namespaces the Endpoints objects
-                  are discovered from.
                 properties:
                   any:
-                    description: |-
-                      Boolean describing whether all namespaces are selected in contrast to a
-                      list restricting them.
                     type: boolean
                   matchNames:
-                    description: List of namespace names.
                     items:
                       type: string
                     type: array
                 type: object
               podMetricsEndpoints:
-                description: A list of endpoints allowed as part of this PodMonitor.
                 items:
-                  description: PodMetricsEndpoint defines a scrapeable endpoint of
-                    a Kubernetes Pod serving metrics.
                   properties:
                     attach_metadata:
-                      description: AttachMetadata configures metadata attaching from
-                        service discovery
                       properties:
+                        namespace:
+                          type: boolean
                         node:
-                          description: |-
-                            Node instructs vmagent to add node specific metadata from service discovery
-                            Valid for roles: pod, endpoints, endpointslice.
                           type: boolean
                       type: object
                     authorization:
-                      description: Authorization with http header Authorization
                       properties:
                         credentials:
-                          description: Reference to the secret with value for authorization
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         credentialsFile:
-                          description: File with value for authorization
                           type: string
                         type:
-                          description: Type of authorization, default to bearer
                           type: string
                       type: object
                     basicAuth:
-                      description: BasicAuth allow an endpoint to authenticate over
-                        basic authentication
                       properties:
                         password:
-                          description: |-
-                            Password defines reference for secret with password value
-                            The secret needs to be in the same namespace as scrape object
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         password_file:
-                          description: |-
-                            PasswordFile defines path to password file at disk
-                            must be pre-mounted
                           type: string
                         username:
-                          description: |-
-                            Username defines reference for secret with username value
-                            The secret needs to be in the same namespace as scrape object
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
@@ -21868,187 +30433,94 @@ spec:
                           x-kubernetes-map-type: atomic
                       type: object
                     bearerTokenFile:
-                      description: File to read bearer token for scraping targets.
                       type: string
                     bearerTokenSecret:
-                      description: |-
-                        Secret to mount to read bearer token for scraping targets. The secret
-                        needs to be in the same namespace as the scrape object and accessible by
-                        the victoria-metrics operator.
                       nullable: true
                       properties:
                         key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
                           type: string
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
                           type: boolean
                       required:
                       - key
                       type: object
                       x-kubernetes-map-type: atomic
                     filterRunning:
-                      description: |-
-                        FilterRunning applies filter with pod status == running
-                        it prevents from scrapping metrics at failed or succeed state pods.
-                        enabled by default
                       type: boolean
                     follow_redirects:
-                      description: FollowRedirects controls redirects for scraping.
                       type: boolean
                     honorLabels:
-                      description: HonorLabels chooses the metric's labels on collisions
-                        with target labels.
                       type: boolean
                     honorTimestamps:
-                      description: HonorTimestamps controls whether vmagent respects
-                        the timestamps present in scraped data.
                       type: boolean
                     interval:
-                      description: Interval at which metrics should be scraped
                       type: string
                     max_scrape_size:
-                      description: MaxScrapeSize defines a maximum size of scraped
-                        data for a job
                       type: string
                     metricRelabelConfigs:
-                      description: MetricRelabelConfigs to apply to samples after
-                        scrapping.
                       items:
-                        description: |-
-                          RelabelConfig allows dynamic rewriting of the label set
-                          More info: https://docs.victoriametrics.com/#relabeling
                         properties:
                           action:
-                            description: Action to perform based on regex matching.
-                              Default is 'replace'
                             type: string
                           if:
-                            description: 'If represents metricsQL match expression
-                              (or list of expressions): ''{__name__=~"foo_.*"}'''
                             x-kubernetes-preserve-unknown-fields: true
                           labels:
                             additionalProperties:
                               type: string
-                            description: 'Labels is used together with Match for `action:
-                              graphite`'
                             type: object
                           match:
-                            description: 'Match is used together with Labels for `action:
-                              graphite`'
                             type: string
                           modulus:
-                            description: Modulus to take of the hash of the source
-                              label values.
                             format: int64
                             type: integer
                           regex:
-                            description: |-
-                              Regular expression against which the extracted value is matched. Default is '(.*)'
-                              victoriaMetrics supports multiline regex joined with |
-                              https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                             x-kubernetes-preserve-unknown-fields: true
                           replacement:
-                            description: |-
-                              Replacement value against which a regex replace is performed if the
-                              regular expression matches. Regex capture groups are available. Default is '$1'
                             type: string
                           separator:
-                            description: Separator placed between concatenated source
-                              label values. default is ';'.
                             type: string
                           source_labels:
-                            description: |-
-                              UnderScoreSourceLabels - additional form of source labels source_labels
-                              for compatibility with original relabel config.
-                              if set  both sourceLabels and source_labels, sourceLabels has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
                             items:
                               type: string
                             type: array
                           sourceLabels:
-                            description: |-
-                              The source labels select values from existing labels. Their content is concatenated
-                              using the configured separator and matched against the configured regular expression
-                              for the replace, keep, and drop actions.
                             items:
                               type: string
                             type: array
                           target_label:
-                            description: |-
-                              UnderScoreTargetLabel - additional form of target label - target_label
-                              for compatibility with original relabel config.
-                              if set  both targetLabel and target_label, targetLabel has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
                             type: string
                           targetLabel:
-                            description: |-
-                              Label to which the resulting value is written in a replace action.
-                              It is mandatory for replace actions. Regex capture groups are available.
                             type: string
                         type: object
                       type: array
                     oauth2:
-                      description: OAuth2 defines auth configuration
                       properties:
                         client_id:
-                          description: The secret or configmap containing the OAuth2
-                            client id
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -22056,57 +30528,33 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         client_secret:
-                          description: The secret containing the OAuth2 client secret
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         client_secret_file:
-                          description: ClientSecretFile defines path for client secret
-                            file.
                           type: string
                         endpoint_params:
                           additionalProperties:
                             type: string
-                          description: Parameters to append to the token URL
                           type: object
                         proxy_url:
-                          description: |-
-                            The proxy URL for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
                           type: string
                         scopes:
-                          description: OAuth2 scopes used for the token request
                           items:
                             type: string
                           type: array
                         tls_config:
-                          description: |-
-                            TLSConfig for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
                           x-kubernetes-preserve-unknown-fields: true
                         token_url:
-                          description: The URL to fetch the token from
                           minLength: 1
                           type: string
                       required:
@@ -22118,109 +30566,57 @@ spec:
                         items:
                           type: string
                         type: array
-                      description: Optional HTTP URL parameters
                       type: object
                     path:
-                      description: HTTP path to scrape for metrics.
                       type: string
                     port:
-                      description: Name of the port exposed at Pod.
                       type: string
                     portNumber:
-                      description: PortNumber defines the `Pod` port number which
-                        exposes the endpoint.
                       format: int32
                       maximum: 65535
                       minimum: 1
                       type: integer
                     proxyURL:
-                      description: ProxyURL eg http://proxyserver:2195 Directs scrapes
-                        to proxy through this endpoint.
                       type: string
                     relabelConfigs:
-                      description: RelabelConfigs to apply to samples during service
-                        discovery.
                       items:
-                        description: |-
-                          RelabelConfig allows dynamic rewriting of the label set
-                          More info: https://docs.victoriametrics.com/#relabeling
                         properties:
                           action:
-                            description: Action to perform based on regex matching.
-                              Default is 'replace'
                             type: string
                           if:
-                            description: 'If represents metricsQL match expression
-                              (or list of expressions): ''{__name__=~"foo_.*"}'''
                             x-kubernetes-preserve-unknown-fields: true
                           labels:
                             additionalProperties:
                               type: string
-                            description: 'Labels is used together with Match for `action:
-                              graphite`'
                             type: object
                           match:
-                            description: 'Match is used together with Labels for `action:
-                              graphite`'
                             type: string
                           modulus:
-                            description: Modulus to take of the hash of the source
-                              label values.
                             format: int64
                             type: integer
                           regex:
-                            description: |-
-                              Regular expression against which the extracted value is matched. Default is '(.*)'
-                              victoriaMetrics supports multiline regex joined with |
-                              https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                             x-kubernetes-preserve-unknown-fields: true
                           replacement:
-                            description: |-
-                              Replacement value against which a regex replace is performed if the
-                              regular expression matches. Regex capture groups are available. Default is '$1'
                             type: string
                           separator:
-                            description: Separator placed between concatenated source
-                              label values. default is ';'.
                             type: string
                           source_labels:
-                            description: |-
-                              UnderScoreSourceLabels - additional form of source labels source_labels
-                              for compatibility with original relabel config.
-                              if set  both sourceLabels and source_labels, sourceLabels has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
                             items:
                               type: string
                             type: array
                           sourceLabels:
-                            description: |-
-                              The source labels select values from existing labels. Their content is concatenated
-                              using the configured separator and matched against the configured regular expression
-                              for the replace, keep, and drop actions.
                             items:
                               type: string
                             type: array
                           target_label:
-                            description: |-
-                              UnderScoreTargetLabel - additional form of target label - target_label
-                              for compatibility with original relabel config.
-                              if set  both targetLabel and target_label, targetLabel has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
                             type: string
                           targetLabel:
-                            description: |-
-                              Label to which the resulting value is written in a replace action.
-                              It is mandatory for replace actions. Regex capture groups are available.
                             type: string
                         type: object
                       type: array
                     sampleLimit:
-                      description: SampleLimit defines per-scrape limit on number
-                        of scraped samples that will be accepted.
-                      format: int64
                       type: integer
                     scheme:
-                      description: HTTP scheme to use for scraping.
                       enum:
                       - http
                       - https
@@ -22228,78 +30624,41 @@ spec:
                       - HTTP
                       type: string
                     scrape_interval:
-                      description: |-
-                        ScrapeInterval is the same as Interval and has priority over it.
-                        one of scrape_interval or interval can be used
                       type: string
                     scrapeTimeout:
-                      description: Timeout after which the scrape is ended
                       type: string
                     seriesLimit:
-                      description: |-
-                        SeriesLimit defines per-scrape limit on number of unique time series
-                        a single target can expose during all the scrapes on the time window of 24h.
-                      format: int64
                       type: integer
                     targetPort:
                       anyOf:
                       - type: integer
                       - type: string
-                      description: |-
-                        TargetPort defines name or number of the pod port this endpoint refers to.
-                        Mutually exclusive with Port and PortNumber.
                       x-kubernetes-int-or-string: true
                     tlsConfig:
-                      description: TLSConfig configuration to use when scraping the
-                        endpoint
                       properties:
                         ca:
-                          description: Struct containing the CA cert to use for the
-                            targets.
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -22307,56 +30666,30 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         caFile:
-                          description: Path to the CA cert in the container to use
-                            for the targets.
                           type: string
                         cert:
-                          description: Struct containing the client cert file for
-                            the targets.
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -22364,132 +30697,66 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         certFile:
-                          description: Path to the client cert file in the container
-                            for the targets.
                           type: string
                         insecureSkipVerify:
-                          description: Disable target certificate validation.
                           type: boolean
                         keyFile:
-                          description: Path to the client key file in the container
-                            for the targets.
                           type: string
                         keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         serverName:
-                          description: Used to verify the hostname for the targets.
                           type: string
                       type: object
                     vm_scrape_params:
-                      description: VMScrapeParams defines VictoriaMetrics specific
-                        scrape parameters
                       properties:
                         disable_compression:
-                          description: DisableCompression
                           type: boolean
                         disable_keep_alive:
-                          description: |-
-                            disable_keepalive allows disabling HTTP keep-alive when scraping targets.
-                            By default, HTTP keep-alive is enabled, so TCP connections to scrape targets
-                            could be reused.
-                            See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements
                           type: boolean
                         headers:
-                          description: |-
-                            Headers allows sending custom headers to scrape targets
-                            must be in of semicolon separated header with it's value
-                            eg:
-                            headerName: headerValue
-                            vmagent supports since 1.79.0 version
                           items:
                             type: string
                           type: array
                         no_stale_markers:
                           type: boolean
                         proxy_client_config:
-                          description: |-
-                            ProxyClientConfig configures proxy auth settings for scraping
-                            See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy
                           properties:
                             basic_auth:
-                              description: BasicAuth allow an endpoint to authenticate
-                                over basic authentication
                               properties:
                                 password:
-                                  description: |-
-                                    Password defines reference for secret with password value
-                                    The secret needs to be in the same namespace as scrape object
                                   properties:
                                     key:
-                                      description: The key of the secret to select
-                                        from.  Must be a valid secret key.
                                       type: string
                                     name:
                                       default: ""
-                                      description: |-
-                                        Name of the referent.
-                                        This field is effectively required, but due to backwards compatibility is
-                                        allowed to be empty. Instances of this type with an empty value here are
-                                        almost certainly wrong.
-                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                       type: string
                                     optional:
-                                      description: Specify whether the Secret or its
-                                        key must be defined
                                       type: boolean
                                   required:
                                   - key
                                   type: object
                                   x-kubernetes-map-type: atomic
                                 password_file:
-                                  description: |-
-                                    PasswordFile defines path to password file at disk
-                                    must be pre-mounted
                                   type: string
                                 username:
-                                  description: |-
-                                    Username defines reference for secret with username value
-                                    The secret needs to be in the same namespace as scrape object
                                   properties:
                                     key:
-                                      description: The key of the secret to select
-                                        from.  Must be a valid secret key.
                                       type: string
                                     name:
                                       default: ""
-                                      description: |-
-                                        Name of the referent.
-                                        This field is effectively required, but due to backwards compatibility is
-                                        allowed to be empty. Instances of this type with an empty value here are
-                                        almost certainly wrong.
-                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                       type: string
                                     optional:
-                                      description: Specify whether the Secret or its
-                                        key must be defined
                                       type: boolean
                                   required:
                                   - key
@@ -22497,24 +30764,13 @@ spec:
                                   x-kubernetes-map-type: atomic
                               type: object
                             bearer_token:
-                              description: SecretKeySelector selects a key of a Secret.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -22535,42 +30791,23 @@ spec:
                   type: object
                 type: array
               podTargetLabels:
-                description: PodTargetLabels transfers labels on the Kubernetes Pod
-                  onto the target.
                 items:
                   type: string
                 type: array
               sampleLimit:
-                description: SampleLimit defines per-scrape limit on number of scraped
-                  samples that will be accepted.
-                format: int64
                 type: integer
+              scrapeClass:
+                type: string
               selector:
-                description: Selector to select Pod objects.
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -22584,75 +30821,43 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               seriesLimit:
-                description: |-
-                  SeriesLimit defines per-scrape limit on number of unique time series
-                  a single target can expose during all the scrapes on the time window of 24h.
-                format: int64
                 type: integer
             required:
             - podMetricsEndpoints
             type: object
           status:
-            description: ScrapeObjectStatus defines the observed state of ScrapeObjects
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -22667,16 +30872,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -22689,7 +30889,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmprobes.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -22713,121 +30913,60 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: |-
-          VMProbe defines a probe for targets, that will be executed with prober,
-          like blackbox exporter.
-          It helps to monitor reachability of target with various checks.
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMProbeSpec contains specification parameters for a Probe.
             properties:
               authorization:
-                description: Authorization with http header Authorization
                 properties:
                   credentials:
-                    description: Reference to the secret with value for authorization
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   credentialsFile:
-                    description: File with value for authorization
                     type: string
                   type:
-                    description: Type of authorization, default to bearer
                     type: string
                 type: object
               basicAuth:
-                description: BasicAuth allow an endpoint to authenticate over basic
-                  authentication
                 properties:
                   password:
-                    description: |-
-                      Password defines reference for secret with password value
-                      The secret needs to be in the same namespace as scrape object
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   password_file:
-                    description: |-
-                      PasswordFile defines path to password file at disk
-                      must be pre-mounted
                     type: string
                   username:
-                    description: |-
-                      Username defines reference for secret with username value
-                      The secret needs to be in the same namespace as scrape object
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
@@ -22835,187 +30974,96 @@ spec:
                     x-kubernetes-map-type: atomic
                 type: object
               bearerTokenFile:
-                description: File to read bearer token for scraping targets.
                 type: string
               bearerTokenSecret:
-                description: |-
-                  Secret to mount to read bearer token for scraping targets. The secret
-                  needs to be in the same namespace as the scrape object and accessible by
-                  the victoria-metrics operator.
                 nullable: true
                 properties:
                   key:
-                    description: The key of the secret to select from.  Must be a
-                      valid secret key.
                     type: string
                   name:
                     default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                     type: string
                   optional:
-                    description: Specify whether the Secret or its key must be defined
                     type: boolean
                 required:
                 - key
                 type: object
                 x-kubernetes-map-type: atomic
               follow_redirects:
-                description: FollowRedirects controls redirects for scraping.
                 type: boolean
               honorLabels:
-                description: HonorLabels chooses the metric's labels on collisions
-                  with target labels.
                 type: boolean
               honorTimestamps:
-                description: HonorTimestamps controls whether vmagent respects the
-                  timestamps present in scraped data.
                 type: boolean
               interval:
-                description: Interval at which metrics should be scraped
                 type: string
               jobName:
-                description: The job name assigned to scraped metrics by default.
                 type: string
               max_scrape_size:
-                description: MaxScrapeSize defines a maximum size of scraped data
-                  for a job
                 type: string
               metricRelabelConfigs:
-                description: MetricRelabelConfigs to apply to samples after scrapping.
                 items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
                   properties:
                     action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
                       type: string
                     if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
                       x-kubernetes-preserve-unknown-fields: true
                     labels:
                       additionalProperties:
                         type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
                       type: object
                     match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
                       type: string
                     modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
                       format: int64
                       type: integer
                     regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                       x-kubernetes-preserve-unknown-fields: true
                     replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
                       type: string
                     separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
                       type: string
                     source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       items:
                         type: string
                       type: array
                     sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
                       items:
                         type: string
                       type: array
                     target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       type: string
                     targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
                       type: string
                   type: object
                 type: array
               module:
-                description: |-
-                  The module to use for probing specifying how to probe the target.
-                  Example module configuring in the blackbox exporter:
-                  https://github.com/prometheus/blackbox_exporter/blob/master/example.yml
                 type: string
               oauth2:
-                description: OAuth2 defines auth configuration
                 properties:
                   client_id:
-                    description: The secret or configmap containing the OAuth2 client
-                      id
                     properties:
                       configMap:
-                        description: ConfigMap containing data to use for the targets.
                         properties:
                           key:
-                            description: The key to select.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       secret:
-                        description: Secret containing data to use for the targets.
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
@@ -23023,56 +31071,33 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                   client_secret:
-                    description: The secret containing the OAuth2 client secret
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   client_secret_file:
-                    description: ClientSecretFile defines path for client secret file.
                     type: string
                   endpoint_params:
                     additionalProperties:
                       type: string
-                    description: Parameters to append to the token URL
                     type: object
                   proxy_url:
-                    description: |-
-                      The proxy URL for token_url connection
-                      ( available from v0.55.0).
-                      Is only supported by Scrape objects family
                     type: string
                   scopes:
-                    description: OAuth2 scopes used for the token request
                     items:
                       type: string
                     type: array
                   tls_config:
-                    description: |-
-                      TLSConfig for token_url connection
-                      ( available from v0.55.0).
-                      Is only supported by Scrape objects family
                     x-kubernetes-preserve-unknown-fields: true
                   token_url:
-                    description: The URL to fetch the token from
                     minLength: 1
                     type: string
                 required:
@@ -23084,22 +31109,14 @@ spec:
                   items:
                     type: string
                   type: array
-                description: Optional HTTP URL parameters
                 type: object
               path:
-                description: HTTP path to scrape for metrics.
                 type: string
               proxyURL:
-                description: ProxyURL eg http://proxyserver:2195 Directs scrapes to
-                  proxy through this endpoint.
                 type: string
               sampleLimit:
-                description: SampleLimit defines per-scrape limit on number of scraped
-                  samples that will be accepted.
-                format: int64
                 type: integer
               scheme:
-                description: HTTP scheme to use for scraping.
                 enum:
                 - http
                 - https
@@ -23107,144 +31124,79 @@ spec:
                 - HTTP
                 type: string
               scrape_interval:
-                description: |-
-                  ScrapeInterval is the same as Interval and has priority over it.
-                  one of scrape_interval or interval can be used
+                type: string
+              scrapeClass:
                 type: string
               scrapeTimeout:
-                description: Timeout after which the scrape is ended
                 type: string
               seriesLimit:
-                description: |-
-                  SeriesLimit defines per-scrape limit on number of unique time series
-                  a single target can expose during all the scrapes on the time window of 24h.
-                format: int64
                 type: integer
               targets:
-                description: Targets defines a set of static and/or dynamically discovered
-                  targets to be probed using the prober.
                 properties:
                   ingress:
-                    description: Ingress defines the set of dynamically discovered
-                      ingress objects which hosts are considered for probing.
                     properties:
                       namespaceSelector:
-                        description: Select Ingress objects by namespace.
                         properties:
                           any:
-                            description: |-
-                              Boolean describing whether all namespaces are selected in contrast to a
-                              list restricting them.
                             type: boolean
                           matchNames:
-                            description: List of namespace names.
                             items:
                               type: string
                             type: array
                         type: object
                       relabelingConfigs:
-                        description: RelabelConfigs to apply to samples during service
-                          discovery.
                         items:
-                          description: |-
-                            RelabelConfig allows dynamic rewriting of the label set
-                            More info: https://docs.victoriametrics.com/#relabeling
                           properties:
                             action:
-                              description: Action to perform based on regex matching.
-                                Default is 'replace'
                               type: string
                             if:
-                              description: 'If represents metricsQL match expression
-                                (or list of expressions): ''{__name__=~"foo_.*"}'''
                               x-kubernetes-preserve-unknown-fields: true
                             labels:
                               additionalProperties:
                                 type: string
-                              description: 'Labels is used together with Match for
-                                `action: graphite`'
                               type: object
                             match:
-                              description: 'Match is used together with Labels for
-                                `action: graphite`'
                               type: string
                             modulus:
-                              description: Modulus to take of the hash of the source
-                                label values.
                               format: int64
                               type: integer
                             regex:
-                              description: |-
-                                Regular expression against which the extracted value is matched. Default is '(.*)'
-                                victoriaMetrics supports multiline regex joined with |
-                                https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                               x-kubernetes-preserve-unknown-fields: true
                             replacement:
-                              description: |-
-                                Replacement value against which a regex replace is performed if the
-                                regular expression matches. Regex capture groups are available. Default is '$1'
                               type: string
                             separator:
-                              description: Separator placed between concatenated source
-                                label values. default is ';'.
                               type: string
                             source_labels:
-                              description: |-
-                                UnderScoreSourceLabels - additional form of source labels source_labels
-                                for compatibility with original relabel config.
-                                if set  both sourceLabels and source_labels, sourceLabels has priority.
-                                for details https://github.com/VictoriaMetrics/operator/issues/131
                               items:
                                 type: string
                               type: array
                             sourceLabels:
-                              description: |-
-                                The source labels select values from existing labels. Their content is concatenated
-                                using the configured separator and matched against the configured regular expression
-                                for the replace, keep, and drop actions.
                               items:
                                 type: string
                               type: array
                             target_label:
-                              description: |-
-                                UnderScoreTargetLabel - additional form of target label - target_label
-                                for compatibility with original relabel config.
-                                if set  both targetLabel and target_label, targetLabel has priority.
-                                for details https://github.com/VictoriaMetrics/operator/issues/131
                               type: string
                             targetLabel:
-                              description: |-
-                                Label to which the resulting value is written in a replace action.
-                                It is mandatory for replace actions. Regex capture groups are available.
                               type: string
                           type: object
                         type: array
+                      role:
+                        enum:
+                        - service
+                        - ingress
+                        - pod
+                        - node
+                        type: string
                       selector:
-                        description: Select Ingress objects by labels.
                         properties:
                           matchExpressions:
-                            description: matchExpressions is a list of label selector
-                              requirements. The requirements are ANDed.
                             items:
-                              description: |-
-                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                relates the key and values.
                               properties:
                                 key:
-                                  description: key is the label key that the selector
-                                    applies to.
                                   type: string
                                 operator:
-                                  description: |-
-                                    operator represents a key's relationship to a set of values.
-                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                   type: string
                                 values:
-                                  description: |-
-                                    values is an array of string values. If the operator is In or NotIn,
-                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                    the values array must be empty. This array is replaced during a strategic
-                                    merge patch.
                                   items:
                                     type: string
                                   type: array
@@ -23258,104 +31210,185 @@ spec:
                           matchLabels:
                             additionalProperties:
                               type: string
-                            description: |-
-                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                             type: object
                         type: object
                         x-kubernetes-map-type: atomic
                     type: object
-                  staticConfig:
-                    description: StaticConfig defines static targets which are considers
-                      for probing.
+                  kubernetes:
+                    items:
+                      properties:
+                        namespaceSelector:
+                          properties:
+                            any:
+                              type: boolean
+                            matchNames:
+                              items:
+                                type: string
+                              type: array
+                          type: object
+                        relabelingConfigs:
+                          items:
+                            properties:
+                              action:
+                                type: string
+                              if:
+                                x-kubernetes-preserve-unknown-fields: true
+                              labels:
+                                additionalProperties:
+                                  type: string
+                                type: object
+                              match:
+                                type: string
+                              modulus:
+                                format: int64
+                                type: integer
+                              regex:
+                                x-kubernetes-preserve-unknown-fields: true
+                              replacement:
+                                type: string
+                              separator:
+                                type: string
+                              source_labels:
+                                items:
+                                  type: string
+                                type: array
+                              sourceLabels:
+                                items:
+                                  type: string
+                                type: array
+                              target_label:
+                                type: string
+                              targetLabel:
+                                type: string
+                            type: object
+                          type: array
+                        role:
+                          enum:
+                          - service
+                          - ingress
+                          - pod
+                          - node
+                          type: string
+                        selector:
+                          properties:
+                            matchExpressions:
+                              items:
+                                properties:
+                                  key:
+                                    type: string
+                                  operator:
+                                    type: string
+                                  values:
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                type: string
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                      type: object
+                    type: array
+                  static:
+                    properties:
+                      labels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      relabelingConfigs:
+                        items:
+                          properties:
+                            action:
+                              type: string
+                            if:
+                              x-kubernetes-preserve-unknown-fields: true
+                            labels:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            match:
+                              type: string
+                            modulus:
+                              format: int64
+                              type: integer
+                            regex:
+                              x-kubernetes-preserve-unknown-fields: true
+                            replacement:
+                              type: string
+                            separator:
+                              type: string
+                            source_labels:
+                              items:
+                                type: string
+                              type: array
+                            sourceLabels:
+                              items:
+                                type: string
+                              type: array
+                            target_label:
+                              type: string
+                            targetLabel:
+                              type: string
+                          type: object
+                        type: array
+                      targets:
+                        items:
+                          type: string
+                        type: array
+                    required:
+                    - targets
+                    type: object
+                  staticConfig:
                     properties:
                       labels:
                         additionalProperties:
                           type: string
-                        description: Labels assigned to all metrics scraped from the
-                          targets.
                         type: object
                       relabelingConfigs:
-                        description: RelabelConfigs to apply to samples during service
-                          discovery.
                         items:
-                          description: |-
-                            RelabelConfig allows dynamic rewriting of the label set
-                            More info: https://docs.victoriametrics.com/#relabeling
                           properties:
                             action:
-                              description: Action to perform based on regex matching.
-                                Default is 'replace'
                               type: string
                             if:
-                              description: 'If represents metricsQL match expression
-                                (or list of expressions): ''{__name__=~"foo_.*"}'''
                               x-kubernetes-preserve-unknown-fields: true
                             labels:
                               additionalProperties:
                                 type: string
-                              description: 'Labels is used together with Match for
-                                `action: graphite`'
                               type: object
                             match:
-                              description: 'Match is used together with Labels for
-                                `action: graphite`'
                               type: string
                             modulus:
-                              description: Modulus to take of the hash of the source
-                                label values.
                               format: int64
                               type: integer
                             regex:
-                              description: |-
-                                Regular expression against which the extracted value is matched. Default is '(.*)'
-                                victoriaMetrics supports multiline regex joined with |
-                                https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                               x-kubernetes-preserve-unknown-fields: true
                             replacement:
-                              description: |-
-                                Replacement value against which a regex replace is performed if the
-                                regular expression matches. Regex capture groups are available. Default is '$1'
                               type: string
                             separator:
-                              description: Separator placed between concatenated source
-                                label values. default is ';'.
                               type: string
                             source_labels:
-                              description: |-
-                                UnderScoreSourceLabels - additional form of source labels source_labels
-                                for compatibility with original relabel config.
-                                if set  both sourceLabels and source_labels, sourceLabels has priority.
-                                for details https://github.com/VictoriaMetrics/operator/issues/131
                               items:
                                 type: string
                               type: array
                             sourceLabels:
-                              description: |-
-                                The source labels select values from existing labels. Their content is concatenated
-                                using the configured separator and matched against the configured regular expression
-                                for the replace, keep, and drop actions.
                               items:
                                 type: string
                               type: array
                             target_label:
-                              description: |-
-                                UnderScoreTargetLabel - additional form of target label - target_label
-                                for compatibility with original relabel config.
-                                if set  both targetLabel and target_label, targetLabel has priority.
-                                for details https://github.com/VictoriaMetrics/operator/issues/131
                               type: string
                             targetLabel:
-                              description: |-
-                                Label to which the resulting value is written in a replace action.
-                                It is mandatory for replace actions. Regex capture groups are available.
                               type: string
                           type: object
                         type: array
                       targets:
-                        description: Targets is a list of URLs to probe using the
-                          configured prober.
                         items:
                           type: string
                         type: array
@@ -23364,53 +31397,30 @@ spec:
                     type: object
                 type: object
               tlsConfig:
-                description: TLSConfig configuration to use when scraping the endpoint
                 properties:
                   ca:
-                    description: Struct containing the CA cert to use for the targets.
                     properties:
                       configMap:
-                        description: ConfigMap containing data to use for the targets.
                         properties:
                           key:
-                            description: The key to select.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       secret:
-                        description: Secret containing data to use for the targets.
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
@@ -23418,54 +31428,30 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                   caFile:
-                    description: Path to the CA cert in the container to use for the
-                      targets.
                     type: string
                   cert:
-                    description: Struct containing the client cert file for the targets.
                     properties:
                       configMap:
-                        description: ConfigMap containing data to use for the targets.
                         properties:
                           key:
-                            description: The key to select.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       secret:
-                        description: Secret containing data to use for the targets.
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
@@ -23473,131 +31459,66 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                   certFile:
-                    description: Path to the client cert file in the container for
-                      the targets.
                     type: string
                   insecureSkipVerify:
-                    description: Disable target certificate validation.
                     type: boolean
                   keyFile:
-                    description: Path to the client key file in the container for
-                      the targets.
                     type: string
                   keySecret:
-                    description: Secret containing the client key file for the targets.
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   serverName:
-                    description: Used to verify the hostname for the targets.
                     type: string
                 type: object
               vm_scrape_params:
-                description: VMScrapeParams defines VictoriaMetrics specific scrape
-                  parameters
                 properties:
                   disable_compression:
-                    description: DisableCompression
                     type: boolean
                   disable_keep_alive:
-                    description: |-
-                      disable_keepalive allows disabling HTTP keep-alive when scraping targets.
-                      By default, HTTP keep-alive is enabled, so TCP connections to scrape targets
-                      could be reused.
-                      See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements
                     type: boolean
                   headers:
-                    description: |-
-                      Headers allows sending custom headers to scrape targets
-                      must be in of semicolon separated header with it's value
-                      eg:
-                      headerName: headerValue
-                      vmagent supports since 1.79.0 version
                     items:
                       type: string
                     type: array
                   no_stale_markers:
                     type: boolean
                   proxy_client_config:
-                    description: |-
-                      ProxyClientConfig configures proxy auth settings for scraping
-                      See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy
                     properties:
                       basic_auth:
-                        description: BasicAuth allow an endpoint to authenticate over
-                          basic authentication
                         properties:
                           password:
-                            description: |-
-                              Password defines reference for secret with password value
-                              The secret needs to be in the same namespace as scrape object
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
                             type: object
                             x-kubernetes-map-type: atomic
                           password_file:
-                            description: |-
-                              PasswordFile defines path to password file at disk
-                              must be pre-mounted
                             type: string
                           username:
-                            description: |-
-                              Username defines reference for secret with username value
-                              The secret needs to be in the same namespace as scrape object
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
@@ -23605,24 +31526,13 @@ spec:
                             x-kubernetes-map-type: atomic
                         type: object
                       bearer_token:
-                        description: SecretKeySelector selects a key of a Secret.
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
@@ -23641,25 +31551,15 @@ spec:
                     type: boolean
                 type: object
               vmProberSpec:
-                description: |-
-                  Specification for the prober to use for probing targets.
-                  The prober.URL parameter is required. Targets cannot be probed if left empty.
                 properties:
                   path:
-                    description: |-
-                      Path to collect metrics from.
-                      Defaults to `/probe`.
                     type: string
                   scheme:
-                    description: |-
-                      HTTP scheme to use for scraping.
-                      Defaults to `http`.
                     enum:
                     - http
                     - https
                     type: string
                   url:
-                    description: Mandatory URL of the prober.
                     type: string
                 required:
                 - url
@@ -23668,58 +31568,34 @@ spec:
             - vmProberSpec
             type: object
           status:
-            description: ScrapeObjectStatus defines the observed state of ScrapeObjects
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -23734,16 +31610,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         required:
@@ -23758,7 +31629,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmrules.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -23782,103 +31653,41 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: VMRule defines rule records for vmalert application
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMRuleSpec defines the desired state of VMRule
             properties:
               groups:
-                description: Groups list of group rules
                 items:
-                  description: RuleGroup is a list of sequentially evaluated recording
-                    and alerting rules.
                   properties:
                     concurrency:
-                      description: Concurrency defines how many rules execute at once.
                       type: integer
                     eval_alignment:
-                      description: |-
-                        Optional
-                        The evaluation timestamp will be aligned with group's interval,
-                        instead of using the actual timestamp that evaluation happens at.
-                        It is enabled by default to get more predictable results
-                        and to visually align with graphs plotted via Grafana or vmui.
                       type: boolean
                     eval_delay:
-                      description: |-
-                        Optional
-                        Adjust the `time` parameter of group evaluation requests to compensate intentional query delay from the datasource.
                       type: string
                     eval_offset:
-                      description: |-
-                        Optional
-                        Group will be evaluated at the exact offset in the range of [0...interval].
                       type: string
-                    extra_filter_labels:
-                      additionalProperties:
-                        type: string
-                      description: |-
-                        ExtraFilterLabels optional list of label filters applied to every rule's
-                        request within a group. Is compatible only with VM datasource.
-                        See more details [here](https://docs.victoriametrics.com/#prometheus-querying-api-enhancements)
-                        Deprecated, use params instead
-                      type: object
                     headers:
-                      description: |-
-                        Headers contains optional HTTP headers added to each rule request
-                        Must be in form `header-name: value`
-                        For example:
-                         headers:
-                           - "CustomHeader: foo"
-                           - "CustomHeader2: bar"
                       items:
                         type: string
                       type: array
                     interval:
-                      description: evaluation interval for group
                       type: string
                     labels:
                       additionalProperties:
                         type: string
-                      description: |-
-                        Labels optional list of labels added to every rule within a group.
-                        It has priority over the external labels.
-                        Labels are commonly used for adding environment
-                        or tenant-specific tag.
                       type: object
                     limit:
-                      description: |-
-                        Limit the number of alerts an alerting rule and series a recording
-                        rule can produce
                       type: integer
                     name:
-                      description: Name of group
                       type: string
                     notifier_headers:
-                      description: |-
-                        NotifierHeaders contains optional HTTP headers added to each alert request which will send to notifier
-                        Must be in form `header-name: value`
-                        For example:
-                         headers:
-                           - "CustomHeader: foo"
-                           - "CustomHeader2: bar"
                       items:
                         type: string
                       type: array
@@ -23887,67 +31696,37 @@ spec:
                         items:
                           type: string
                         type: array
-                      description: Params optional HTTP URL parameters added to each
-                        rule request
                       type: object
                     rules:
-                      description: Rules list of alert rules
                       items:
-                        description: Rule describes an alerting or recording rule.
                         properties:
                           alert:
-                            description: Alert is a name for alert
                             type: string
                           annotations:
                             additionalProperties:
                               type: string
-                            description: Annotations will be added to rule configuration
                             type: object
                           debug:
-                            description: |-
-                              Debug enables logging for rule
-                              it useful for tracking
                             type: boolean
                           expr:
-                            description: Expr is query, that will be evaluated at
-                              dataSource
                             type: string
                           for:
-                            description: |-
-                              For evaluation interval in time.Duration format
-                              30s, 1m, 1h  or nanoseconds
                             type: string
                           keep_firing_for:
-                            description: |-
-                              KeepFiringFor will make alert continue firing for this long
-                              even when the alerting expression no longer has results.
-                              Use time.Duration format, 30s, 1m, 1h  or nanoseconds
                             type: string
                           labels:
                             additionalProperties:
                               type: string
-                            description: Labels will be added to rule configuration
                             type: object
                           record:
-                            description: Record represents a query, that will be recorded
-                              to dataSource
                             type: string
                           update_entries_limit:
-                            description: |-
-                              UpdateEntriesLimit defines max number of rule's state updates stored in memory.
-                              Overrides `-rule.updateEntriesLimit` in vmalert.
                             type: integer
                         type: object
                       type: array
                     tenant:
-                      description: |-
-                        Tenant id for group, can be used only with enterprise version of vmalert.
-                        See more details [here](https://docs.victoriametrics.com/vmalert#multitenancy).
                       type: string
                     type:
-                      description: |-
-                        Type defines datasource type for enterprise version of vmalert
-                        possible values - prometheus,graphite,vlogs
                       type: string
                   required:
                   - name
@@ -23958,58 +31737,34 @@ spec:
             - groups
             type: object
           status:
-            description: VMRuleStatus defines the observed state of VMRule
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -24024,16 +31779,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         required:
@@ -24048,7 +31798,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmscrapeconfigs.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -24072,188 +31822,98 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: VMScrapeConfig specifies a set of targets and parameters describing
-          how to scrape them.
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMScrapeConfigSpec defines the desired state of VMScrapeConfig
             properties:
               authorization:
-                description: Authorization with http header Authorization
                 properties:
                   credentials:
-                    description: Reference to the secret with value for authorization
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   credentialsFile:
-                    description: File with value for authorization
                     type: string
                   type:
-                    description: Type of authorization, default to bearer
                     type: string
                 type: object
               azureSDConfigs:
-                description: AzureSDConfigs defines a list of Azure service discovery
-                  configurations.
                 items:
-                  description: |-
-                    AzureSDConfig allow retrieving scrape targets from Azure VMs.
-                    See [here](https://docs.victoriametrics.com/sd_configs#azure_sd_configs)
                   properties:
                     authenticationMethod:
-                      description: |-
-                        # The authentication method, either OAuth or ManagedIdentity.
-                        See https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview
                       enum:
                       - OAuth
                       - ManagedIdentity
                       type: string
                     clientID:
-                      description: Optional client ID. Only required with the OAuth
-                        authentication method.
                       type: string
                     clientSecret:
-                      description: Optional client secret. Only required with the
-                        OAuth authentication method.
                       properties:
                         key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
                           type: string
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
                           type: boolean
                       required:
                       - key
                       type: object
                       x-kubernetes-map-type: atomic
                     environment:
-                      description: The Azure environment.
                       type: string
                     port:
-                      description: |-
-                        The port to scrape metrics from. If using the public IP address, this must
-                        instead be specified in the relabeling rule.
                       type: integer
                     resourceGroup:
-                      description: Optional resource group name. Limits discovery
-                        to this resource group.
                       type: string
                     subscriptionID:
-                      description: The subscription ID. Always required.
                       minLength: 1
                       type: string
                     tenantID:
-                      description: Optional tenant ID. Only required with the OAuth
-                        authentication method.
                       type: string
                   required:
                   - subscriptionID
                   type: object
                 type: array
               basicAuth:
-                description: BasicAuth allow an endpoint to authenticate over basic
-                  authentication
                 properties:
                   password:
-                    description: |-
-                      Password defines reference for secret with password value
-                      The secret needs to be in the same namespace as scrape object
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   password_file:
-                    description: |-
-                      PasswordFile defines path to password file at disk
-                      must be pre-mounted
                     type: string
                   username:
-                    description: |-
-                      Username defines reference for secret with username value
-                      The secret needs to be in the same namespace as scrape object
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
@@ -24261,137 +31921,71 @@ spec:
                     x-kubernetes-map-type: atomic
                 type: object
               bearerTokenFile:
-                description: File to read bearer token for scraping targets.
                 type: string
               bearerTokenSecret:
-                description: |-
-                  Secret to mount to read bearer token for scraping targets. The secret
-                  needs to be in the same namespace as the scrape object and accessible by
-                  the victoria-metrics operator.
                 nullable: true
                 properties:
                   key:
-                    description: The key of the secret to select from.  Must be a
-                      valid secret key.
                     type: string
                   name:
                     default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                     type: string
                   optional:
-                    description: Specify whether the Secret or its key must be defined
                     type: boolean
                 required:
                 - key
                 type: object
                 x-kubernetes-map-type: atomic
               consulSDConfigs:
-                description: ConsulSDConfigs defines a list of Consul service discovery
-                  configurations.
                 items:
-                  description: |-
-                    ConsulSDConfig defines a Consul service discovery configuration.
-                    See [here](https://docs.victoriametrics.com/sd_configs/#consul_sd_configs)
                   properties:
                     allowStale:
-                      description: |-
-                        Allow stale Consul results (see https://developer.hashicorp.com/consul/api-docs/features/consistency). Will reduce load on Consul.
-                        If unset, use its default value.
                       type: boolean
                     authorization:
-                      description: Authorization header to use on every scrape request.
                       properties:
                         credentials:
-                          description: Reference to the secret with value for authorization
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         credentialsFile:
-                          description: File with value for authorization
                           type: string
                         type:
-                          description: Type of authorization, default to bearer
                           type: string
                       type: object
                     basicAuth:
-                      description: BasicAuth information to use on every scrape request.
                       properties:
                         password:
-                          description: |-
-                            Password defines reference for secret with password value
-                            The secret needs to be in the same namespace as scrape object
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         password_file:
-                          description: |-
-                            PasswordFile defines path to password file at disk
-                            must be pre-mounted
                           type: string
                         username:
-                          description: |-
-                            Username defines reference for secret with username value
-                            The secret needs to be in the same namespace as scrape object
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
@@ -24399,79 +31993,43 @@ spec:
                           x-kubernetes-map-type: atomic
                       type: object
                     datacenter:
-                      description: Consul Datacenter name, if not provided it will
-                        use the local Consul Agent Datacenter.
                       type: string
                     filter:
-                      description: |-
-                        Filter defines filter for /v1/catalog/services requests
-                        See https://developer.hashicorp.com/consul/api-docs/features/filtering
                       type: string
                     followRedirects:
-                      description: |-
-                        Configure whether HTTP requests follow HTTP 3xx redirects.
-                        If unset, use its default value.
                       type: boolean
                     namespace:
-                      description: Namespaces are only supported in Consul Enterprise.
                       type: string
                     nodeMeta:
                       additionalProperties:
                         type: string
-                      description: Node metadata key/value pairs to filter nodes for
-                        a given service.
                       type: object
                       x-kubernetes-map-type: atomic
                     oauth2:
-                      description: OAuth2 defines auth configuration
                       properties:
                         client_id:
-                          description: The secret or configmap containing the OAuth2
-                            client id
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -24479,57 +32037,33 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         client_secret:
-                          description: The secret containing the OAuth2 client secret
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         client_secret_file:
-                          description: ClientSecretFile defines path for client secret
-                            file.
                           type: string
                         endpoint_params:
                           additionalProperties:
                             type: string
-                          description: Parameters to append to the token URL
                           type: object
                         proxy_url:
-                          description: |-
-                            The proxy URL for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
                           type: string
                         scopes:
-                          description: OAuth2 scopes used for the token request
                           items:
                             type: string
                           type: array
                         tls_config:
-                          description: |-
-                            TLSConfig for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
                           x-kubernetes-preserve-unknown-fields: true
                         token_url:
-                          description: The URL to fetch the token from
                           minLength: 1
                           type: string
                       required:
@@ -24537,69 +32071,34 @@ spec:
                       - token_url
                       type: object
                     partition:
-                      description: Admin Partitions are only supported in Consul Enterprise.
                       type: string
                     proxy_client_config:
-                      description: |-
-                        ProxyClientConfig configures proxy auth settings for scraping
-                        See [feature description](https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy)
                       properties:
                         basic_auth:
-                          description: BasicAuth allow an endpoint to authenticate
-                            over basic authentication
                           properties:
                             password:
-                              description: |-
-                                Password defines reference for secret with password value
-                                The secret needs to be in the same namespace as scrape object
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             password_file:
-                              description: |-
-                                PasswordFile defines path to password file at disk
-                                must be pre-mounted
                               type: string
                             username:
-                              description: |-
-                                Username defines reference for secret with username value
-                                The secret needs to be in the same namespace as scrape object
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -24607,24 +32106,13 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         bearer_token:
-                          description: SecretKeySelector selects a key of a Secret.
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
@@ -24636,89 +32124,52 @@ spec:
                           x-kubernetes-preserve-unknown-fields: true
                       type: object
                     proxyURL:
-                      description: ProxyURL eg http://proxyserver:2195 Directs scrapes
-                        to proxy through this endpoint.
                       type: string
                     scheme:
-                      description: HTTP Scheme default "http"
                       enum:
                       - HTTP
                       - HTTPS
                       type: string
                     server:
-                      description: A valid string consisting of a hostname or IP followed
-                        by an optional port number.
                       minLength: 1
                       type: string
                     services:
-                      description: A list of services for which targets are retrieved.
-                        If omitted, all services are scraped.
                       items:
                         type: string
                       type: array
                       x-kubernetes-list-type: atomic
                     tagSeparator:
-                      description: |-
-                        The string by which Consul tags are joined into the tag label.
-                        If unset, use its default value.
                       type: string
                     tags:
-                      description: An optional list of tags used to filter nodes for
-                        a given service. Services must contain all tags in the list.
                       items:
                         type: string
                       type: array
                       x-kubernetes-list-type: atomic
                     tlsConfig:
-                      description: TLS configuration to use on every scrape request
                       properties:
                         ca:
-                          description: Struct containing the CA cert to use for the
-                            targets.
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -24726,56 +32177,30 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         caFile:
-                          description: Path to the CA cert in the container to use
-                            for the targets.
                           type: string
                         cert:
-                          description: Struct containing the client cert file for
-                            the targets.
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -24783,65 +32208,35 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         certFile:
-                          description: Path to the client cert file in the container
-                            for the targets.
                           type: string
                         insecureSkipVerify:
-                          description: Disable target certificate validation.
                           type: boolean
                         keyFile:
-                          description: Path to the client key file in the container
-                            for the targets.
                           type: string
                         keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         serverName:
-                          description: Used to verify the hostname for the targets.
                           type: string
                       type: object
                     tokenRef:
-                      description: Consul ACL TokenRef, if not provided it will use
-                        the ACL from the local Consul Agent.
                       properties:
                         key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
                           type: string
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
                           type: boolean
                       required:
                       - key
@@ -24852,102 +32247,55 @@ spec:
                   type: object
                 type: array
               digitalOceanSDConfigs:
-                description: DigitalOceanSDConfigs defines a list of DigitalOcean
-                  service discovery configurations.
                 items:
-                  description: |-
-                    DigitalOceanSDConfig allow retrieving scrape targets from DigitalOcean's Droplets API.
-                    This service discovery uses the public IPv4 address by default, by that can be changed with relabeling.
-                    See [here](https://docs.victoriametrics.com/sd_configs#digitalocean_sd_configs)
                   properties:
                     authorization:
-                      description: Authorization header to use on every scrape request.
                       properties:
                         credentials:
-                          description: Reference to the secret with value for authorization
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         credentialsFile:
-                          description: File with value for authorization
                           type: string
                         type:
-                          description: Type of authorization, default to bearer
                           type: string
                       type: object
                     followRedirects:
-                      description: Configure whether HTTP requests follow HTTP 3xx
-                        redirects.
                       type: boolean
                     oauth2:
-                      description: OAuth2 defines auth configuration
                       properties:
                         client_id:
-                          description: The secret or configmap containing the OAuth2
-                            client id
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -24955,57 +32303,33 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         client_secret:
-                          description: The secret containing the OAuth2 client secret
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         client_secret_file:
-                          description: ClientSecretFile defines path for client secret
-                            file.
                           type: string
                         endpoint_params:
                           additionalProperties:
                             type: string
-                          description: Parameters to append to the token URL
                           type: object
                         proxy_url:
-                          description: |-
-                            The proxy URL for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
                           type: string
                         scopes:
-                          description: OAuth2 scopes used for the token request
                           items:
                             type: string
                           type: array
                         tls_config:
-                          description: |-
-                            TLSConfig for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
                           x-kubernetes-preserve-unknown-fields: true
                         token_url:
-                          description: The URL to fetch the token from
                           minLength: 1
                           type: string
                       required:
@@ -25013,69 +32337,34 @@ spec:
                       - token_url
                       type: object
                     port:
-                      description: The port to scrape metrics from.
                       type: integer
                     proxy_client_config:
-                      description: |-
-                        ProxyClientConfig configures proxy auth settings for scraping
-                        See [feature description](https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy)
                       properties:
                         basic_auth:
-                          description: BasicAuth allow an endpoint to authenticate
-                            over basic authentication
                           properties:
                             password:
-                              description: |-
-                                Password defines reference for secret with password value
-                                The secret needs to be in the same namespace as scrape object
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             password_file:
-                              description: |-
-                                PasswordFile defines path to password file at disk
-                                must be pre-mounted
                               type: string
                             username:
-                              description: |-
-                                Username defines reference for secret with username value
-                                The secret needs to be in the same namespace as scrape object
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -25083,24 +32372,13 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         bearer_token:
-                          description: SecretKeySelector selects a key of a Secret.
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
@@ -25112,59 +32390,32 @@ spec:
                           x-kubernetes-preserve-unknown-fields: true
                       type: object
                     proxyURL:
-                      description: ProxyURL eg http://proxyserver:2195 Directs scrapes
-                        to proxy through this endpoint.
                       type: string
                     tlsConfig:
-                      description: TLS configuration to use on every scrape request
                       properties:
                         ca:
-                          description: Struct containing the CA cert to use for the
-                            targets.
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -25172,56 +32423,30 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         caFile:
-                          description: Path to the CA cert in the container to use
-                            for the targets.
                           type: string
                         cert:
-                          description: Struct containing the client cert file for
-                            the targets.
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -25229,66 +32454,38 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         certFile:
-                          description: Path to the client cert file in the container
-                            for the targets.
                           type: string
                         insecureSkipVerify:
-                          description: Disable target certificate validation.
                           type: boolean
                         keyFile:
-                          description: Path to the client key file in the container
-                            for the targets.
                           type: string
                         keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         serverName:
-                          description: Used to verify the hostname for the targets.
                           type: string
                       type: object
                   type: object
                 type: array
               dnsSDConfigs:
-                description: DNSSDConfigs defines a list of DNS service discovery
-                  configurations.
                 items:
-                  description: |-
-                    DNSSDConfig allows specifying a set of DNS domain names which are periodically queried to discover a list of targets.
-                    The DNS servers to be contacted are read from /etc/resolv.conf.
-                    See [here](https://docs.victoriametrics.com/sd_configs#dns_sd_configs)
                   properties:
                     names:
-                      description: A list of DNS domain names to be queried.
                       items:
                         type: string
                       minItems: 1
                       type: array
                     port:
-                      description: |-
-                        The port number used if the query type is not SRV
-                        Ignored for SRV records
                       type: integer
                     type:
                       enum:
@@ -25302,48 +32499,23 @@ spec:
                   type: object
                 type: array
               ec2SDConfigs:
-                description: EC2SDConfigs defines a list of EC2 service discovery
-                  configurations.
                 items:
-                  description: |-
-                    EC2SDConfig allow retrieving scrape targets from AWS EC2 instances.
-                    The private IP address is used by default, but may be changed to the public IP address with relabeling.
-                    The IAM credentials used must have the ec2:DescribeInstances permission to discover scrape targets.
-                    See [here](https://docs.victoriametrics.com/sd_configs#ec2_sd_configs)
                   properties:
                     accessKey:
-                      description: AccessKey is the AWS API key.
                       properties:
                         key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
                           type: string
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
                           type: boolean
                       required:
                       - key
                       type: object
                       x-kubernetes-map-type: atomic
                     filters:
-                      description: |-
-                        Filters can be used optionally to filter the instance list by other criteria.
-                        Available filter criteria can be found here:
-                        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html
-                        Filter API documentation: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_Filter.html
                       items:
-                        description: EC2Filter is the configuration for filtering
-                          EC2 instances.
                         properties:
                           name:
                             type: string
@@ -25357,35 +32529,19 @@ spec:
                         type: object
                       type: array
                     port:
-                      description: |-
-                        The port to scrape metrics from. If using the public IP address, this must
-                        instead be specified in the relabeling rule.
                       type: integer
                     region:
-                      description: The AWS region
                       type: string
                     roleARN:
-                      description: AWS Role ARN, an alternative to using AWS API keys.
                       type: string
                     secretKey:
-                      description: SecretKey is the AWS API secret.
                       properties:
                         key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
                           type: string
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
                           type: boolean
                       required:
                       - key
@@ -25394,15 +32550,9 @@ spec:
                   type: object
                 type: array
               fileSDConfigs:
-                description: FileSDConfigs defines a list of file service discovery
-                  configurations.
                 items:
-                  description: |-
-                    FileSDConfig defines a file service discovery configuration.
-                    See [here](https://docs.victoriametrics.com/sd_configs#file_sd_configs)
                   properties:
                     files:
-                      description: List of files to be used for file discovery.
                       items:
                         type: string
                       minItems: 1
@@ -25412,44 +32562,20 @@ spec:
                   type: object
                 type: array
               follow_redirects:
-                description: FollowRedirects controls redirects for scraping.
                 type: boolean
               gceSDConfigs:
-                description: GCESDConfigs defines a list of GCE service discovery
-                  configurations.
                 items:
-                  description: |-
-                    GCESDConfig configures scrape targets from GCP GCE instances.
-                    The private IP address is used by default, but may be changed to
-                    the public IP address with relabeling.
-                    See [here](https://docs.victoriametrics.com/sd_configs#gce_sd_configs)
-
-                    The GCE service discovery will load the Google Cloud credentials
-                    from the file specified by the GOOGLE_APPLICATION_CREDENTIALS environment variable.
-                    See https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform
                   properties:
                     filter:
-                      description: |-
-                        Filter can be used optionally to filter the instance list by other criteria
-                        Syntax of this filter is described in the filter query parameter section:
-                        https://cloud.google.com/compute/docs/reference/latest/instances/list
                       type: string
                     port:
-                      description: |-
-                        The port to scrape metrics from. If using the public IP address, this must
-                        instead be specified in the relabeling rule.
                       type: integer
                     project:
-                      description: The Google Cloud Project ID
                       minLength: 1
                       type: string
                     tagSeparator:
-                      description: The tag separator is used to separate the tags
-                        on concatenation
                       type: string
                     zone:
-                      description: The zone of the scrape targets. If you need multiple
-                        zones use multiple GCESDConfigs.
                       x-kubernetes-preserve-unknown-fields: true
                   required:
                   - project
@@ -25457,110 +32583,57 @@ spec:
                   type: object
                 type: array
               honorLabels:
-                description: HonorLabels chooses the metric's labels on collisions
-                  with target labels.
                 type: boolean
               honorTimestamps:
-                description: HonorTimestamps controls whether vmagent respects the
-                  timestamps present in scraped data.
                 type: boolean
               httpSDConfigs:
-                description: HTTPSDConfigs defines a list of HTTP service discovery
-                  configurations.
                 items:
-                  description: |-
-                    HTTPSDConfig defines a HTTP service discovery configuration.
-                    See [here](https://docs.victoriametrics.com/sd_configs#http_sd_configs)
                   properties:
                     authorization:
-                      description: Authorization header to use on every scrape request.
                       properties:
                         credentials:
-                          description: Reference to the secret with value for authorization
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         credentialsFile:
-                          description: File with value for authorization
                           type: string
                         type:
-                          description: Type of authorization, default to bearer
                           type: string
                       type: object
                     basicAuth:
-                      description: BasicAuth information to use on every scrape request.
                       properties:
                         password:
-                          description: |-
-                            Password defines reference for secret with password value
-                            The secret needs to be in the same namespace as scrape object
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         password_file:
-                          description: |-
-                            PasswordFile defines path to password file at disk
-                            must be pre-mounted
                           type: string
                         username:
-                          description: |-
-                            Username defines reference for secret with username value
-                            The secret needs to be in the same namespace as scrape object
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
@@ -25568,66 +32641,32 @@ spec:
                           x-kubernetes-map-type: atomic
                       type: object
                     proxy_client_config:
-                      description: |-
-                        ProxyClientConfig configures proxy auth settings for scraping
-                        See [feature description](https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy)
                       properties:
                         basic_auth:
-                          description: BasicAuth allow an endpoint to authenticate
-                            over basic authentication
                           properties:
                             password:
-                              description: |-
-                                Password defines reference for secret with password value
-                                The secret needs to be in the same namespace as scrape object
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             password_file:
-                              description: |-
-                                PasswordFile defines path to password file at disk
-                                must be pre-mounted
                               type: string
                             username:
-                              description: |-
-                                Username defines reference for secret with username value
-                                The secret needs to be in the same namespace as scrape object
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -25635,24 +32674,13 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         bearer_token:
-                          description: SecretKeySelector selects a key of a Secret.
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
@@ -25664,59 +32692,32 @@ spec:
                           x-kubernetes-preserve-unknown-fields: true
                       type: object
                     proxyURL:
-                      description: ProxyURL eg http://proxyserver:2195 Directs scrapes
-                        to proxy through this endpoint.
                       type: string
                     tlsConfig:
-                      description: TLS configuration to use on every scrape request
                       properties:
                         ca:
-                          description: Struct containing the CA cert to use for the
-                            targets.
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -25724,56 +32725,30 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         caFile:
-                          description: Path to the CA cert in the container to use
-                            for the targets.
                           type: string
                         cert:
-                          description: Struct containing the client cert file for
-                            the targets.
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -25781,47 +32756,28 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         certFile:
-                          description: Path to the client cert file in the container
-                            for the targets.
                           type: string
                         insecureSkipVerify:
-                          description: Disable target certificate validation.
                           type: boolean
                         keyFile:
-                          description: Path to the client key file in the container
-                            for the targets.
                           type: string
                         keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         serverName:
-                          description: Used to verify the hostname for the targets.
                           type: string
                       type: object
                     url:
-                      description: URL from which the targets are fetched.
                       minLength: 1
                       pattern: ^http(s)?://.+$
                       type: string
@@ -25830,123 +32786,64 @@ spec:
                   type: object
                 type: array
               interval:
-                description: Interval at which metrics should be scraped
                 type: string
               kubernetesSDConfigs:
-                description: KubernetesSDConfigs defines a list of Kubernetes service
-                  discovery configurations.
                 items:
-                  description: |-
-                    KubernetesSDConfig allows retrieving scrape targets from Kubernetes' REST API.
-                    See [here](https://docs.victoriametrics.com/sd_configs#kubernetes_sd_configs)
                   properties:
                     apiServer:
-                      description: |-
-                        The API server address consisting of a hostname or IP address followed
-                        by an optional port number.
-                        If left empty, assuming process is running inside
-                        of the cluster. It will discover API servers automatically and use the pod's
-                        CA certificate and bearer token file at /var/run/secrets/kubernetes.io/serviceaccount/.
                       type: string
                     attach_metadata:
-                      description: AttachMetadata configures metadata attaching from
-                        service discovery
                       properties:
+                        namespace:
+                          type: boolean
                         node:
-                          description: |-
-                            Node instructs vmagent to add node specific metadata from service discovery
-                            Valid for roles: pod, endpoints, endpointslice.
                           type: boolean
                       type: object
                     authorization:
-                      description: Authorization header to use on every scrape request.
                       properties:
                         credentials:
-                          description: Reference to the secret with value for authorization
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         credentialsFile:
-                          description: File with value for authorization
                           type: string
                         type:
-                          description: Type of authorization, default to bearer
                           type: string
                       type: object
                     basicAuth:
-                      description: BasicAuth information to use on every scrape request.
                       properties:
                         password:
-                          description: |-
-                            Password defines reference for secret with password value
-                            The secret needs to be in the same namespace as scrape object
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         password_file:
-                          description: |-
-                            PasswordFile defines path to password file at disk
-                            must be pre-mounted
                           type: string
                         username:
-                          description: |-
-                            Username defines reference for secret with username value
-                            The secret needs to be in the same namespace as scrape object
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
@@ -25954,75 +32851,41 @@ spec:
                           x-kubernetes-map-type: atomic
                       type: object
                     followRedirects:
-                      description: Configure whether HTTP requests follow HTTP 3xx
-                        redirects.
                       type: boolean
                     namespaces:
-                      description: Optional namespace discovery. If omitted, discover
-                        targets across all namespaces.
                       properties:
                         names:
-                          description: |-
-                            List of namespaces where to watch for resources.
-                            If empty and `ownNamespace` isn't true, watch for resources in all namespaces.
                           items:
                             type: string
                           type: array
                         ownNamespace:
-                          description: Includes the namespace in which the pod exists
-                            to the list of watched namespaces.
                           type: boolean
                       type: object
                     oauth2:
-                      description: OAuth2 defines auth configuration
                       properties:
                         client_id:
-                          description: The secret or configmap containing the OAuth2
-                            client id
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -26030,57 +32893,33 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         client_secret:
-                          description: The secret containing the OAuth2 client secret
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         client_secret_file:
-                          description: ClientSecretFile defines path for client secret
-                            file.
                           type: string
                         endpoint_params:
                           additionalProperties:
                             type: string
-                          description: Parameters to append to the token URL
                           type: object
                         proxy_url:
-                          description: |-
-                            The proxy URL for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
                           type: string
                         scopes:
-                          description: OAuth2 scopes used for the token request
                           items:
                             type: string
                           type: array
                         tls_config:
-                          description: |-
-                            TLSConfig for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
                           x-kubernetes-preserve-unknown-fields: true
                         token_url:
-                          description: The URL to fetch the token from
                           minLength: 1
                           type: string
                       required:
@@ -26088,66 +32927,32 @@ spec:
                       - token_url
                       type: object
                     proxy_client_config:
-                      description: |-
-                        ProxyClientConfig configures proxy auth settings for scraping
-                        See [feature description](https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy)
                       properties:
                         basic_auth:
-                          description: BasicAuth allow an endpoint to authenticate
-                            over basic authentication
                           properties:
                             password:
-                              description: |-
-                                Password defines reference for secret with password value
-                                The secret needs to be in the same namespace as scrape object
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             password_file:
-                              description: |-
-                                PasswordFile defines path to password file at disk
-                                must be pre-mounted
                               type: string
                             username:
-                              description: |-
-                                Username defines reference for secret with username value
-                                The secret needs to be in the same namespace as scrape object
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -26155,24 +32960,13 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         bearer_token:
-                          description: SecretKeySelector selects a key of a Secret.
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
@@ -26184,23 +32978,31 @@ spec:
                           x-kubernetes-preserve-unknown-fields: true
                       type: object
                     proxyURL:
-                      description: ProxyURL eg http://proxyserver:2195 Directs scrapes
-                        to proxy through this endpoint.
                       type: string
                     role:
-                      description: Role of the Kubernetes entities that should be
-                        discovered.
+                      enum:
+                      - node
+                      - pod
+                      - service
+                      - endpoints
+                      - endpointslice
+                      - ingress
                       type: string
                     selectors:
-                      description: Selector to select objects.
                       items:
-                        description: K8SSelectorConfig is Kubernetes Selector Config
                         properties:
                           field:
                             type: string
                           label:
                             type: string
                           role:
+                            enum:
+                            - node
+                            - pod
+                            - service
+                            - endpoints
+                            - endpointslice
+                            - ingress
                             type: string
                         required:
                         - role
@@ -26210,55 +33012,30 @@ spec:
                       - role
                       x-kubernetes-list-type: map
                     tlsConfig:
-                      description: TLS configuration to use on every scrape request
                       properties:
                         ca:
-                          description: Struct containing the CA cert to use for the
-                            targets.
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -26266,56 +33043,30 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         caFile:
-                          description: Path to the CA cert in the container to use
-                            for the targets.
                           type: string
                         cert:
-                          description: Struct containing the client cert file for
-                            the targets.
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -26323,43 +33074,25 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         certFile:
-                          description: Path to the client cert file in the container
-                            for the targets.
                           type: string
                         insecureSkipVerify:
-                          description: Disable target certificate validation.
                           type: boolean
                         keyFile:
-                          description: Path to the client key file in the container
-                            for the targets.
                           type: string
                         keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         serverName:
-                          description: Used to verify the hostname for the targets.
                           type: string
                       type: object
                   required:
@@ -26367,134 +33100,341 @@ spec:
                   type: object
                 type: array
               max_scrape_size:
-                description: MaxScrapeSize defines a maximum size of scraped data
-                  for a job
                 type: string
               metricRelabelConfigs:
-                description: MetricRelabelConfigs to apply to samples after scrapping.
                 items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
                   properties:
                     action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
                       type: string
                     if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
                       x-kubernetes-preserve-unknown-fields: true
                     labels:
                       additionalProperties:
                         type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
                       type: object
                     match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
                       type: string
                     modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
                       format: int64
                       type: integer
                     regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                       x-kubernetes-preserve-unknown-fields: true
                     replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
                       type: string
                     separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
                       type: string
                     source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       items:
                         type: string
                       type: array
                     sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
                       items:
                         type: string
                       type: array
                     target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       type: string
                     targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
                       type: string
                   type: object
                 type: array
+              nomadSDConfigs:
+                items:
+                  properties:
+                    allowStale:
+                      type: boolean
+                    authorization:
+                      properties:
+                        credentials:
+                          properties:
+                            key:
+                              type: string
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          required:
+                          - key
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        credentialsFile:
+                          type: string
+                        type:
+                          type: string
+                      type: object
+                    basicAuth:
+                      properties:
+                        password:
+                          properties:
+                            key:
+                              type: string
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          required:
+                          - key
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        password_file:
+                          type: string
+                        username:
+                          properties:
+                            key:
+                              type: string
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          required:
+                          - key
+                          type: object
+                          x-kubernetes-map-type: atomic
+                      type: object
+                    followRedirects:
+                      type: boolean
+                    namespace:
+                      type: string
+                    oauth2:
+                      properties:
+                        client_id:
+                          properties:
+                            configMap:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            secret:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                          type: object
+                        client_secret:
+                          properties:
+                            key:
+                              type: string
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          required:
+                          - key
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        client_secret_file:
+                          type: string
+                        endpoint_params:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        proxy_url:
+                          type: string
+                        scopes:
+                          items:
+                            type: string
+                          type: array
+                        tls_config:
+                          x-kubernetes-preserve-unknown-fields: true
+                        token_url:
+                          minLength: 1
+                          type: string
+                      required:
+                      - client_id
+                      - token_url
+                      type: object
+                    proxy_client_config:
+                      properties:
+                        basic_auth:
+                          properties:
+                            password:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            password_file:
+                              type: string
+                            username:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                          type: object
+                        bearer_token:
+                          properties:
+                            key:
+                              type: string
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          required:
+                          - key
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        bearer_token_file:
+                          type: string
+                        tls_config:
+                          x-kubernetes-preserve-unknown-fields: true
+                      type: object
+                    proxyURL:
+                      type: string
+                    region:
+                      type: string
+                    server:
+                      minLength: 1
+                      type: string
+                    tagSeparator:
+                      type: string
+                    tlsConfig:
+                      properties:
+                        ca:
+                          properties:
+                            configMap:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            secret:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                          type: object
+                        caFile:
+                          type: string
+                        cert:
+                          properties:
+                            configMap:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            secret:
+                              properties:
+                                key:
+                                  type: string
+                                name:
+                                  default: ""
+                                  type: string
+                                optional:
+                                  type: boolean
+                              required:
+                              - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                          type: object
+                        certFile:
+                          type: string
+                        insecureSkipVerify:
+                          type: boolean
+                        keyFile:
+                          type: string
+                        keySecret:
+                          properties:
+                            key:
+                              type: string
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          required:
+                          - key
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        serverName:
+                          type: string
+                      type: object
+                  required:
+                  - server
+                  type: object
+                type: array
               oauth2:
-                description: OAuth2 defines auth configuration
                 properties:
                   client_id:
-                    description: The secret or configmap containing the OAuth2 client
-                      id
                     properties:
                       configMap:
-                        description: ConfigMap containing data to use for the targets.
                         properties:
                           key:
-                            description: The key to select.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       secret:
-                        description: Secret containing data to use for the targets.
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
@@ -26502,56 +33442,33 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                   client_secret:
-                    description: The secret containing the OAuth2 client secret
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   client_secret_file:
-                    description: ClientSecretFile defines path for client secret file.
                     type: string
                   endpoint_params:
                     additionalProperties:
                       type: string
-                    description: Parameters to append to the token URL
                     type: object
                   proxy_url:
-                    description: |-
-                      The proxy URL for token_url connection
-                      ( available from v0.55.0).
-                      Is only supported by Scrape objects family
                     type: string
                   scopes:
-                    description: OAuth2 scopes used for the token request
                     items:
                       type: string
                     type: array
                   tls_config:
-                    description: |-
-                      TLSConfig for token_url connection
-                      ( available from v0.55.0).
-                      Is only supported by Scrape objects family
                     x-kubernetes-preserve-unknown-fields: true
                   token_url:
-                    description: The URL to fetch the token from
                     minLength: 1
                     type: string
                 required:
@@ -26559,56 +33476,28 @@ spec:
                 - token_url
                 type: object
               openstackSDConfigs:
-                description: OpenStackSDConfigs defines a list of OpenStack service
-                  discovery configurations.
                 items:
-                  description: |-
-                    OpenStackSDConfig allow retrieving scrape targets from OpenStack Nova instances.
-                    See [here](https://docs.victoriametrics.com/sd_configs#openstack_sd_configs)
                   properties:
                     allTenants:
-                      description: |-
-                        Whether the service discovery should list all instances for all projects.
-                        It is only relevant for the 'instance' role and usually requires admin permissions.
                       type: boolean
                     applicationCredentialId:
-                      description: ApplicationCredentialID
                       type: string
                     applicationCredentialName:
-                      description: |-
-                        The ApplicationCredentialID or ApplicationCredentialName fields are
-                        required if using an application credential to authenticate. Some providers
-                        allow you to create an application credential to authenticate rather than a
-                        password.
                       type: string
                     applicationCredentialSecret:
-                      description: |-
-                        The applicationCredentialSecret field is required if using an application
-                        credential to authenticate.
                       properties:
                         key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
                           type: string
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
                           type: boolean
                       required:
                       - key
                       type: object
                       x-kubernetes-map-type: atomic
                     availability:
-                      description: Availability of the endpoint to connect to.
                       enum:
                       - Public
                       - public
@@ -26618,65 +33507,34 @@ spec:
                       - internal
                       type: string
                     domainID:
-                      description: DomainID
                       type: string
                     domainName:
-                      description: |-
-                        At most one of domainId and domainName must be provided if using username
-                        with Identity V3. Otherwise, either are optional.
                       type: string
                     identityEndpoint:
-                      description: |-
-                        IdentityEndpoint specifies the HTTP endpoint that is required to work with
-                        the Identity API of the appropriate version.
                       type: string
                     password:
-                      description: |-
-                        Password for the Identity V2 and V3 APIs. Consult with your provider's
-                        control panel to discover your account's preferred method of authentication.
                       properties:
                         key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
                           type: string
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
                           type: boolean
                       required:
                       - key
                       type: object
                       x-kubernetes-map-type: atomic
                     port:
-                      description: |-
-                        The port to scrape metrics from. If using the public IP address, this must
-                        instead be specified in the relabeling rule.
                       type: integer
                     projectID:
-                      description: ' ProjectID'
                       type: string
                     projectName:
-                      description: |-
-                        The ProjectId and ProjectName fields are optional for the Identity V2 API.
-                        Some providers allow you to specify a ProjectName instead of the ProjectId.
-                        Some require both. Your provider's authentication policies will determine
-                        how these fields influence authentication.
                       type: string
                     region:
-                      description: The OpenStack Region.
                       minLength: 1
                       type: string
                     role:
-                      description: The OpenStack role of entities that should be discovered.
                       enum:
                       - Instance
                       - instance
@@ -26684,55 +33542,30 @@ spec:
                       - hypervisor
                       type: string
                     tlsConfig:
-                      description: TLS configuration to use on every scrape request
                       properties:
                         ca:
-                          description: Struct containing the CA cert to use for the
-                            targets.
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -26740,56 +33573,30 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         caFile:
-                          description: Path to the CA cert in the container to use
-                            for the targets.
                           type: string
                         cert:
-                          description: Struct containing the client cert file for
-                            the targets.
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -26797,54 +33604,30 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         certFile:
-                          description: Path to the client cert file in the container
-                            for the targets.
                           type: string
                         insecureSkipVerify:
-                          description: Disable target certificate validation.
                           type: boolean
                         keyFile:
-                          description: Path to the client key file in the container
-                            for the targets.
                           type: string
                         keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         serverName:
-                          description: Used to verify the hostname for the targets.
                           type: string
                       type: object
                     userid:
-                      description: UserID
                       type: string
                     username:
-                      description: |-
-                        Username is required if using Identity V2 API. Consult with your provider's
-                        control panel to discover your account's username.
-                        In Identity V3, either userid or a combination of username
-                        and domainId or domainName are needed
                       type: string
                   required:
                   - region
@@ -26856,98 +33639,50 @@ spec:
                   items:
                     type: string
                   type: array
-                description: Optional HTTP URL parameters
                 type: object
               path:
-                description: HTTP path to scrape for metrics.
                 type: string
               proxyURL:
-                description: ProxyURL eg http://proxyserver:2195 Directs scrapes to
-                  proxy through this endpoint.
                 type: string
               relabelConfigs:
-                description: RelabelConfigs to apply to samples during service discovery.
                 items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
                   properties:
                     action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
                       type: string
                     if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
                       x-kubernetes-preserve-unknown-fields: true
                     labels:
                       additionalProperties:
                         type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
                       type: object
                     match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
                       type: string
                     modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
                       format: int64
                       type: integer
                     regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                       x-kubernetes-preserve-unknown-fields: true
                     replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
                       type: string
                     separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
                       type: string
                     source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       items:
                         type: string
                       type: array
                     sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
                       items:
                         type: string
                       type: array
                     target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
                       type: string
                     targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
                       type: string
                   type: object
                 type: array
               sampleLimit:
-                description: SampleLimit defines per-scrape limit on number of scraped
-                  samples that will be accepted.
-                format: int64
                 type: integer
               scheme:
-                description: HTTP scheme to use for scraping.
                 enum:
                 - http
                 - https
@@ -26955,89 +33690,52 @@ spec:
                 - HTTP
                 type: string
               scrape_interval:
-                description: |-
-                  ScrapeInterval is the same as Interval and has priority over it.
-                  one of scrape_interval or interval can be used
+                type: string
+              scrapeClass:
                 type: string
               scrapeTimeout:
-                description: Timeout after which the scrape is ended
                 type: string
               seriesLimit:
-                description: |-
-                  SeriesLimit defines per-scrape limit on number of unique time series
-                  a single target can expose during all the scrapes on the time window of 24h.
-                format: int64
                 type: integer
               staticConfigs:
-                description: StaticConfigs defines a list of static targets with a
-                  common label set.
                 items:
-                  description: |-
-                    StaticConfig defines a static configuration.
-                    See [here](https://docs.victoriametrics.com/sd_configs#static_configs)
                   properties:
                     labels:
                       additionalProperties:
                         type: string
-                      description: Labels assigned to all metrics scraped from the
-                        targets.
                       type: object
                       x-kubernetes-map-type: atomic
                     targets:
-                      description: List of targets for this static configuration.
                       items:
                         type: string
                       type: array
                   type: object
                 type: array
               tlsConfig:
-                description: TLSConfig configuration to use when scraping the endpoint
                 properties:
                   ca:
-                    description: Struct containing the CA cert to use for the targets.
                     properties:
                       configMap:
-                        description: ConfigMap containing data to use for the targets.
                         properties:
                           key:
-                            description: The key to select.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       secret:
-                        description: Secret containing data to use for the targets.
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
@@ -27045,54 +33743,30 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                   caFile:
-                    description: Path to the CA cert in the container to use for the
-                      targets.
                     type: string
                   cert:
-                    description: Struct containing the client cert file for the targets.
                     properties:
                       configMap:
-                        description: ConfigMap containing data to use for the targets.
                         properties:
                           key:
-                            description: The key to select.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       secret:
-                        description: Secret containing data to use for the targets.
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
@@ -27100,131 +33774,66 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                   certFile:
-                    description: Path to the client cert file in the container for
-                      the targets.
                     type: string
                   insecureSkipVerify:
-                    description: Disable target certificate validation.
                     type: boolean
                   keyFile:
-                    description: Path to the client key file in the container for
-                      the targets.
                     type: string
                   keySecret:
-                    description: Secret containing the client key file for the targets.
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   serverName:
-                    description: Used to verify the hostname for the targets.
                     type: string
                 type: object
               vm_scrape_params:
-                description: VMScrapeParams defines VictoriaMetrics specific scrape
-                  parameters
                 properties:
                   disable_compression:
-                    description: DisableCompression
                     type: boolean
                   disable_keep_alive:
-                    description: |-
-                      disable_keepalive allows disabling HTTP keep-alive when scraping targets.
-                      By default, HTTP keep-alive is enabled, so TCP connections to scrape targets
-                      could be reused.
-                      See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements
                     type: boolean
                   headers:
-                    description: |-
-                      Headers allows sending custom headers to scrape targets
-                      must be in of semicolon separated header with it's value
-                      eg:
-                      headerName: headerValue
-                      vmagent supports since 1.79.0 version
                     items:
                       type: string
                     type: array
                   no_stale_markers:
                     type: boolean
                   proxy_client_config:
-                    description: |-
-                      ProxyClientConfig configures proxy auth settings for scraping
-                      See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy
                     properties:
                       basic_auth:
-                        description: BasicAuth allow an endpoint to authenticate over
-                          basic authentication
                         properties:
                           password:
-                            description: |-
-                              Password defines reference for secret with password value
-                              The secret needs to be in the same namespace as scrape object
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
                             type: object
                             x-kubernetes-map-type: atomic
                           password_file:
-                            description: |-
-                              PasswordFile defines path to password file at disk
-                              must be pre-mounted
                             type: string
                           username:
-                            description: |-
-                              Username defines reference for secret with username value
-                              The secret needs to be in the same namespace as scrape object
                             properties:
                               key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
                                 type: string
                               name:
                                 default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                 type: string
                               optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
                                 type: boolean
                             required:
                             - key
@@ -27232,24 +33841,13 @@ spec:
                             x-kubernetes-map-type: atomic
                         type: object
                       bearer_token:
-                        description: SecretKeySelector selects a key of a Secret.
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
@@ -27269,58 +33867,34 @@ spec:
                 type: object
             type: object
           status:
-            description: ScrapeObjectStatus defines the observed state of ScrapeObjects
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -27335,16 +33909,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -27357,7 +33926,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmservicescrapes.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -27381,159 +33950,84 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: |-
-          VMServiceScrape is scrape configuration for endpoints associated with
-          kubernetes service,
-          it generates scrape configuration for vmagent based on selectors.
-          result config will scrape service endpoints
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMServiceScrapeSpec defines the desired state of VMServiceScrape
             properties:
               attach_metadata:
-                description: AttachMetadata configures metadata attaching from service
-                  discovery
                 properties:
+                  namespace:
+                    type: boolean
                   node:
-                    description: |-
-                      Node instructs vmagent to add node specific metadata from service discovery
-                      Valid for roles: pod, endpoints, endpointslice.
                     type: boolean
                 type: object
               discoveryRole:
-                description: |-
-                  DiscoveryRole - defines kubernetes_sd role for objects discovery.
-                  by default, its endpoints.
-                  can be changed to service or endpointslices.
-                  note, that with service setting, you have to use port: "name"
-                  and cannot use targetPort for endpoints.
                 enum:
                 - endpoints
                 - service
                 - endpointslices
+                - endpointslice
                 type: string
               endpoints:
-                description: A list of endpoints allowed as part of this ServiceScrape.
                 items:
-                  description: Endpoint defines a scrapeable endpoint serving metrics.
                   properties:
                     attach_metadata:
-                      description: AttachMetadata configures metadata attaching from
-                        service discovery
                       properties:
+                        namespace:
+                          type: boolean
                         node:
-                          description: |-
-                            Node instructs vmagent to add node specific metadata from service discovery
-                            Valid for roles: pod, endpoints, endpointslice.
                           type: boolean
                       type: object
                     authorization:
-                      description: Authorization with http header Authorization
                       properties:
                         credentials:
-                          description: Reference to the secret with value for authorization
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         credentialsFile:
-                          description: File with value for authorization
                           type: string
                         type:
-                          description: Type of authorization, default to bearer
                           type: string
                       type: object
                     basicAuth:
-                      description: BasicAuth allow an endpoint to authenticate over
-                        basic authentication
                       properties:
                         password:
-                          description: |-
-                            Password defines reference for secret with password value
-                            The secret needs to be in the same namespace as scrape object
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         password_file:
-                          description: |-
-                            PasswordFile defines path to password file at disk
-                            must be pre-mounted
                           type: string
                         username:
-                          description: |-
-                            Username defines reference for secret with username value
-                            The secret needs to be in the same namespace as scrape object
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
@@ -27541,181 +34035,92 @@ spec:
                           x-kubernetes-map-type: atomic
                       type: object
                     bearerTokenFile:
-                      description: File to read bearer token for scraping targets.
                       type: string
                     bearerTokenSecret:
-                      description: |-
-                        Secret to mount to read bearer token for scraping targets. The secret
-                        needs to be in the same namespace as the scrape object and accessible by
-                        the victoria-metrics operator.
                       nullable: true
                       properties:
                         key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
                           type: string
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
                           type: boolean
                       required:
                       - key
                       type: object
                       x-kubernetes-map-type: atomic
                     follow_redirects:
-                      description: FollowRedirects controls redirects for scraping.
                       type: boolean
                     honorLabels:
-                      description: HonorLabels chooses the metric's labels on collisions
-                        with target labels.
                       type: boolean
                     honorTimestamps:
-                      description: HonorTimestamps controls whether vmagent respects
-                        the timestamps present in scraped data.
                       type: boolean
                     interval:
-                      description: Interval at which metrics should be scraped
                       type: string
                     max_scrape_size:
-                      description: MaxScrapeSize defines a maximum size of scraped
-                        data for a job
                       type: string
                     metricRelabelConfigs:
-                      description: MetricRelabelConfigs to apply to samples after
-                        scrapping.
                       items:
-                        description: |-
-                          RelabelConfig allows dynamic rewriting of the label set
-                          More info: https://docs.victoriametrics.com/#relabeling
                         properties:
                           action:
-                            description: Action to perform based on regex matching.
-                              Default is 'replace'
                             type: string
                           if:
-                            description: 'If represents metricsQL match expression
-                              (or list of expressions): ''{__name__=~"foo_.*"}'''
                             x-kubernetes-preserve-unknown-fields: true
                           labels:
                             additionalProperties:
                               type: string
-                            description: 'Labels is used together with Match for `action:
-                              graphite`'
                             type: object
                           match:
-                            description: 'Match is used together with Labels for `action:
-                              graphite`'
                             type: string
                           modulus:
-                            description: Modulus to take of the hash of the source
-                              label values.
                             format: int64
                             type: integer
                           regex:
-                            description: |-
-                              Regular expression against which the extracted value is matched. Default is '(.*)'
-                              victoriaMetrics supports multiline regex joined with |
-                              https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                             x-kubernetes-preserve-unknown-fields: true
                           replacement:
-                            description: |-
-                              Replacement value against which a regex replace is performed if the
-                              regular expression matches. Regex capture groups are available. Default is '$1'
                             type: string
                           separator:
-                            description: Separator placed between concatenated source
-                              label values. default is ';'.
                             type: string
                           source_labels:
-                            description: |-
-                              UnderScoreSourceLabels - additional form of source labels source_labels
-                              for compatibility with original relabel config.
-                              if set  both sourceLabels and source_labels, sourceLabels has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
                             items:
                               type: string
                             type: array
                           sourceLabels:
-                            description: |-
-                              The source labels select values from existing labels. Their content is concatenated
-                              using the configured separator and matched against the configured regular expression
-                              for the replace, keep, and drop actions.
                             items:
                               type: string
                             type: array
                           target_label:
-                            description: |-
-                              UnderScoreTargetLabel - additional form of target label - target_label
-                              for compatibility with original relabel config.
-                              if set  both targetLabel and target_label, targetLabel has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
                             type: string
                           targetLabel:
-                            description: |-
-                              Label to which the resulting value is written in a replace action.
-                              It is mandatory for replace actions. Regex capture groups are available.
                             type: string
                         type: object
                       type: array
                     oauth2:
-                      description: OAuth2 defines auth configuration
                       properties:
                         client_id:
-                          description: The secret or configmap containing the OAuth2
-                            client id
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -27723,57 +34128,33 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         client_secret:
-                          description: The secret containing the OAuth2 client secret
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         client_secret_file:
-                          description: ClientSecretFile defines path for client secret
-                            file.
                           type: string
                         endpoint_params:
                           additionalProperties:
                             type: string
-                          description: Parameters to append to the token URL
                           type: object
                         proxy_url:
-                          description: |-
-                            The proxy URL for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
                           type: string
                         scopes:
-                          description: OAuth2 scopes used for the token request
                           items:
                             type: string
                           type: array
                         tls_config:
-                          description: |-
-                            TLSConfig for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
                           x-kubernetes-preserve-unknown-fields: true
                         token_url:
-                          description: The URL to fetch the token from
                           minLength: 1
                           type: string
                       required:
@@ -27785,102 +34166,52 @@ spec:
                         items:
                           type: string
                         type: array
-                      description: Optional HTTP URL parameters
                       type: object
                     path:
-                      description: HTTP path to scrape for metrics.
                       type: string
                     port:
-                      description: Name of the port exposed at Service.
                       type: string
                     proxyURL:
-                      description: ProxyURL eg http://proxyserver:2195 Directs scrapes
-                        to proxy through this endpoint.
                       type: string
                     relabelConfigs:
-                      description: RelabelConfigs to apply to samples during service
-                        discovery.
                       items:
-                        description: |-
-                          RelabelConfig allows dynamic rewriting of the label set
-                          More info: https://docs.victoriametrics.com/#relabeling
                         properties:
                           action:
-                            description: Action to perform based on regex matching.
-                              Default is 'replace'
                             type: string
                           if:
-                            description: 'If represents metricsQL match expression
-                              (or list of expressions): ''{__name__=~"foo_.*"}'''
                             x-kubernetes-preserve-unknown-fields: true
                           labels:
                             additionalProperties:
                               type: string
-                            description: 'Labels is used together with Match for `action:
-                              graphite`'
                             type: object
                           match:
-                            description: 'Match is used together with Labels for `action:
-                              graphite`'
                             type: string
                           modulus:
-                            description: Modulus to take of the hash of the source
-                              label values.
                             format: int64
                             type: integer
                           regex:
-                            description: |-
-                              Regular expression against which the extracted value is matched. Default is '(.*)'
-                              victoriaMetrics supports multiline regex joined with |
-                              https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                             x-kubernetes-preserve-unknown-fields: true
                           replacement:
-                            description: |-
-                              Replacement value against which a regex replace is performed if the
-                              regular expression matches. Regex capture groups are available. Default is '$1'
                             type: string
                           separator:
-                            description: Separator placed between concatenated source
-                              label values. default is ';'.
                             type: string
                           source_labels:
-                            description: |-
-                              UnderScoreSourceLabels - additional form of source labels source_labels
-                              for compatibility with original relabel config.
-                              if set  both sourceLabels and source_labels, sourceLabels has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
                             items:
                               type: string
                             type: array
                           sourceLabels:
-                            description: |-
-                              The source labels select values from existing labels. Their content is concatenated
-                              using the configured separator and matched against the configured regular expression
-                              for the replace, keep, and drop actions.
                             items:
                               type: string
                             type: array
                           target_label:
-                            description: |-
-                              UnderScoreTargetLabel - additional form of target label - target_label
-                              for compatibility with original relabel config.
-                              if set  both targetLabel and target_label, targetLabel has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
                             type: string
                           targetLabel:
-                            description: |-
-                              Label to which the resulting value is written in a replace action.
-                              It is mandatory for replace actions. Regex capture groups are available.
                             type: string
                         type: object
                       type: array
                     sampleLimit:
-                      description: SampleLimit defines per-scrape limit on number
-                        of scraped samples that will be accepted.
-                      format: int64
                       type: integer
                     scheme:
-                      description: HTTP scheme to use for scraping.
                       enum:
                       - http
                       - https
@@ -27888,78 +34219,41 @@ spec:
                       - HTTP
                       type: string
                     scrape_interval:
-                      description: |-
-                        ScrapeInterval is the same as Interval and has priority over it.
-                        one of scrape_interval or interval can be used
                       type: string
                     scrapeTimeout:
-                      description: Timeout after which the scrape is ended
                       type: string
                     seriesLimit:
-                      description: |-
-                        SeriesLimit defines per-scrape limit on number of unique time series
-                        a single target can expose during all the scrapes on the time window of 24h.
-                      format: int64
                       type: integer
                     targetPort:
                       anyOf:
                       - type: integer
                       - type: string
-                      description: |-
-                        TargetPort
-                        Name or number of the pod port this endpoint refers to. Mutually exclusive with port.
                       x-kubernetes-int-or-string: true
                     tlsConfig:
-                      description: TLSConfig configuration to use when scraping the
-                        endpoint
                       properties:
                         ca:
-                          description: Struct containing the CA cert to use for the
-                            targets.
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -27967,56 +34261,30 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         caFile:
-                          description: Path to the CA cert in the container to use
-                            for the targets.
                           type: string
                         cert:
-                          description: Struct containing the client cert file for
-                            the targets.
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -28024,132 +34292,66 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         certFile:
-                          description: Path to the client cert file in the container
-                            for the targets.
                           type: string
                         insecureSkipVerify:
-                          description: Disable target certificate validation.
                           type: boolean
                         keyFile:
-                          description: Path to the client key file in the container
-                            for the targets.
                           type: string
                         keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         serverName:
-                          description: Used to verify the hostname for the targets.
                           type: string
                       type: object
                     vm_scrape_params:
-                      description: VMScrapeParams defines VictoriaMetrics specific
-                        scrape parameters
                       properties:
                         disable_compression:
-                          description: DisableCompression
                           type: boolean
                         disable_keep_alive:
-                          description: |-
-                            disable_keepalive allows disabling HTTP keep-alive when scraping targets.
-                            By default, HTTP keep-alive is enabled, so TCP connections to scrape targets
-                            could be reused.
-                            See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements
                           type: boolean
                         headers:
-                          description: |-
-                            Headers allows sending custom headers to scrape targets
-                            must be in of semicolon separated header with it's value
-                            eg:
-                            headerName: headerValue
-                            vmagent supports since 1.79.0 version
                           items:
                             type: string
                           type: array
                         no_stale_markers:
                           type: boolean
                         proxy_client_config:
-                          description: |-
-                            ProxyClientConfig configures proxy auth settings for scraping
-                            See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy
                           properties:
                             basic_auth:
-                              description: BasicAuth allow an endpoint to authenticate
-                                over basic authentication
                               properties:
                                 password:
-                                  description: |-
-                                    Password defines reference for secret with password value
-                                    The secret needs to be in the same namespace as scrape object
                                   properties:
                                     key:
-                                      description: The key of the secret to select
-                                        from.  Must be a valid secret key.
                                       type: string
                                     name:
                                       default: ""
-                                      description: |-
-                                        Name of the referent.
-                                        This field is effectively required, but due to backwards compatibility is
-                                        allowed to be empty. Instances of this type with an empty value here are
-                                        almost certainly wrong.
-                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                       type: string
                                     optional:
-                                      description: Specify whether the Secret or its
-                                        key must be defined
                                       type: boolean
                                   required:
                                   - key
                                   type: object
                                   x-kubernetes-map-type: atomic
                                 password_file:
-                                  description: |-
-                                    PasswordFile defines path to password file at disk
-                                    must be pre-mounted
                                   type: string
                                 username:
-                                  description: |-
-                                    Username defines reference for secret with username value
-                                    The secret needs to be in the same namespace as scrape object
                                   properties:
                                     key:
-                                      description: The key of the secret to select
-                                        from.  Must be a valid secret key.
                                       type: string
                                     name:
                                       default: ""
-                                      description: |-
-                                        Name of the referent.
-                                        This field is effectively required, but due to backwards compatibility is
-                                        allowed to be empty. Instances of this type with an empty value here are
-                                        almost certainly wrong.
-                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                       type: string
                                     optional:
-                                      description: Specify whether the Secret or its
-                                        key must be defined
                                       type: boolean
                                   required:
                                   - key
@@ -28157,24 +34359,13 @@ spec:
                                   x-kubernetes-map-type: atomic
                               type: object
                             bearer_token:
-                              description: SecretKeySelector selects a key of a Secret.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -28195,61 +34386,34 @@ spec:
                   type: object
                 type: array
               jobLabel:
-                description: The label to use to retrieve the job name from.
                 type: string
               namespaceSelector:
-                description: Selector to select which namespaces the Endpoints objects
-                  are discovered from.
                 properties:
                   any:
-                    description: |-
-                      Boolean describing whether all namespaces are selected in contrast to a
-                      list restricting them.
                     type: boolean
                   matchNames:
-                    description: List of namespace names.
                     items:
                       type: string
                     type: array
                 type: object
               podTargetLabels:
-                description: PodTargetLabels transfers labels on the Kubernetes Pod
-                  onto the target.
                 items:
                   type: string
                 type: array
               sampleLimit:
-                description: SampleLimit defines per-scrape limit on number of scraped
-                  samples that will be accepted.
-                format: int64
                 type: integer
+              scrapeClass:
+                type: string
               selector:
-                description: Selector to select Endpoints objects by corresponding
-                  Service labels.
                 properties:
                   matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
                     items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
                       properties:
                         key:
-                          description: key is the label key that the selector applies
-                            to.
                           type: string
                         operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
                           type: string
                         values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
                           items:
                             type: string
                           type: array
@@ -28263,22 +34427,12 @@ spec:
                   matchLabels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
               seriesLimit:
-                description: |-
-                  SeriesLimit defines per-scrape limit on number of unique time series
-                  a single target can expose during all the scrapes on the time window of 24h.
-                format: int64
                 type: integer
               targetLabels:
-                description: TargetLabels transfers labels on the Kubernetes Service
-                  onto the target.
                 items:
                   type: string
                 type: array
@@ -28286,58 +34440,34 @@ spec:
             - endpoints
             type: object
           status:
-            description: ScrapeObjectStatus defines the observed state of ScrapeObjects
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -28352,16 +34482,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         required:
@@ -28376,7 +34501,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmsingles.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -28398,144 +34523,70 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: VMSingle  is fast, cost-effective and scalable time-series database.
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMSingleSpec defines the desired state of VMSingle
             properties:
               affinity:
-                description: Affinity If specified, the pod's scheduling constraints.
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               configMaps:
-                description: |-
-                  ConfigMaps is a list of ConfigMaps in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/configs/CONFIGMAP_NAME folder
                 items:
                   type: string
                 type: array
               containers:
-                description: |-
-                  Containers property allows to inject additions sidecars or to patch existing containers.
-                  It can be useful for proxies, backup, etc.
                 items:
-                  description: A single application container that you want to run
-                    within a pod.
                   required:
                   - name
                   type: object
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               disableAutomountServiceAccountToken:
-                description: |-
-                  DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
-                  Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
-                  For example, vmagent and vm-config-reloader requires k8s API access.
-                  Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
-                  And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
                 type: boolean
               disableSelfServiceScrape:
-                description: |-
-                  DisableSelfServiceScrape controls creation of VMServiceScrape by operator
-                  for the application.
-                  Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable
                 type: boolean
               dnsConfig:
-                description: |-
-                  Specifies the DNS parameters of a pod.
-                  Parameters specified here will be merged to the generated DNS
-                  configuration based on DNSPolicy.
                 items:
                   x-kubernetes-preserve-unknown-fields: true
                 properties:
                   nameservers:
-                    description: |-
-                      A list of DNS name server IP addresses.
-                      This will be appended to the base nameservers generated from DNSPolicy.
-                      Duplicated nameservers will be removed.
                     items:
                       type: string
                     type: array
                     x-kubernetes-list-type: atomic
                   options:
-                    description: |-
-                      A list of DNS resolver options.
-                      This will be merged with the base options generated from DNSPolicy.
-                      Duplicated entries will be removed. Resolution options given in Options
-                      will override those that appear in the base DNSPolicy.
                     items:
-                      description: PodDNSConfigOption defines DNS resolver options
-                        of a pod.
                       properties:
                         name:
-                          description: |-
-                            Name is this DNS resolver option's name.
-                            Required.
                           type: string
                         value:
-                          description: Value is this DNS resolver option's value.
                           type: string
                       type: object
                     type: array
                     x-kubernetes-list-type: atomic
                   searches:
-                    description: |-
-                      A list of DNS search domains for host-name lookup.
-                      This will be appended to the base search paths generated from DNSPolicy.
-                      Duplicated search paths will be removed.
                     items:
                       type: string
                     type: array
                     x-kubernetes-list-type: atomic
                 type: object
               dnsPolicy:
-                description: DNSPolicy sets DNS policy for the pod
                 type: string
               extraArgs:
                 additionalProperties:
                   type: string
-                description: |-
-                  ExtraArgs that will be passed to the application container
-                  for example remoteWrite.tmpDataPath: /tmp
                 type: object
               extraEnvs:
-                description: ExtraEnvs that will be passed to the application container
                 items:
-                  description: EnvVar represents an environment variable present in
-                    a Container.
                   properties:
                     name:
-                      description: Name of the environment variable. Must be a C_IDENTIFIER.
                       type: string
                     value:
-                      description: |-
-                        Variable references $(VAR_NAME) are expanded
-                        using the previously defined environment variables in the container and
-                        any service environment variables. If a variable cannot be resolved,
-                        the reference in the input string will be unchanged. Double $$ are reduced
-                        to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                        "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                        Escaped references will never be expanded, regardless of whether the variable
-                        exists or not.
-                        Defaults to "".
                       type: string
                   required:
                   - name
@@ -28543,227 +34594,127 @@ spec:
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               extraEnvsFrom:
-                description: |-
-                  ExtraEnvsFrom defines source of env variables for the application container
-                  could either be secret or configmap
                 items:
-                  description: EnvFromSource represents the source of a set of ConfigMaps
                   properties:
                     configMapRef:
-                      description: The ConfigMap to select from
                       properties:
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the ConfigMap must be defined
                           type: boolean
                       type: object
                       x-kubernetes-map-type: atomic
                     prefix:
-                      description: An optional identifier to prepend to each key in
-                        the ConfigMap. Must be a C_IDENTIFIER.
                       type: string
                     secretRef:
-                      description: The Secret to select from
                       properties:
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the Secret must be defined
                           type: boolean
                       type: object
                       x-kubernetes-map-type: atomic
                   type: object
                 type: array
               host_aliases:
-                description: |-
-                  HostAliasesUnderScore provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
-                  Has Priority over hostAliases field
                 items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
                   properties:
                     hostnames:
-                      description: Hostnames for the above IP address.
                       items:
                         type: string
                       type: array
                       x-kubernetes-list-type: atomic
                     ip:
-                      description: IP address of the host file entry.
                       type: string
                   required:
                   - ip
                   type: object
                 type: array
               hostAliases:
-                description: |-
-                  HostAliases provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
                 items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
                   properties:
                     hostnames:
-                      description: Hostnames for the above IP address.
                       items:
                         type: string
                       type: array
                       x-kubernetes-list-type: atomic
                     ip:
-                      description: IP address of the host file entry.
                       type: string
                   required:
                   - ip
                   type: object
                 type: array
               hostNetwork:
-                description: HostNetwork controls whether the pod may use the node
-                  network namespace
                 type: boolean
               image:
-                description: |-
-                  Image - docker image settings
-                  if no specified operator uses default version from operator config
                 properties:
                   pullPolicy:
-                    description: PullPolicy describes how to pull docker image
                     type: string
                   repository:
-                    description: Repository contains name of docker image + it's repository
-                      if needed
                     type: string
                   tag:
-                    description: Tag contains desired docker image version
                     type: string
                 type: object
               imagePullSecrets:
-                description: |-
-                  ImagePullSecrets An optional list of references to secrets in the same namespace
-                  to use for pulling images from registries
-                  see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
                 items:
-                  description: |-
-                    LocalObjectReference contains enough information to let you locate the
-                    referenced object inside the same namespace.
                   properties:
                     name:
                       default: ""
-                      description: |-
-                        Name of the referent.
-                        This field is effectively required, but due to backwards compatibility is
-                        allowed to be empty. Instances of this type with an empty value here are
-                        almost certainly wrong.
-                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                       type: string
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
               initContainers:
-                description: |-
-                  InitContainers allows adding initContainers to the pod definition.
-                  Any errors during the execution of an initContainer will lead to a restart of the Pod.
-                  More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
                 items:
-                  description: A single application container that you want to run
-                    within a pod.
                   required:
                   - name
                   type: object
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               insertPorts:
-                description: InsertPorts - additional listen ports for data ingestion.
                 properties:
                   graphitePort:
-                    description: GraphitePort listen port
                     type: string
                   influxPort:
-                    description: InfluxPort listen port
                     type: string
                   openTSDBHTTPPort:
-                    description: OpenTSDBHTTPPort for http connections.
                     type: string
                   openTSDBPort:
-                    description: OpenTSDBPort for tcp and udp listen
                     type: string
                 type: object
               license:
-                description: |-
-                  License allows to configure license key to be used for enterprise features.
-                  Using license key is supported starting from VictoriaMetrics v1.94.0.
-                  See [here](https://docs.victoriametrics.com/enterprise)
                 properties:
                   forceOffline:
-                    description: Enforce offline verification of the license key.
                     type: boolean
                   key:
-                    description: |-
-                      Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise).
-                      To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial)
                     type: string
                   keyRef:
-                    description: KeyRef is reference to secret with license key for
-                      enterprise features.
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   reloadInterval:
-                    description: Interval to be used for checking for license key
-                      changes. Note that this is only applicable when using KeyRef.
                     type: string
                 type: object
               livenessProbe:
-                description: LivenessProbe that will be added CRD pod
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               logFormat:
-                description: LogFormat for VMSingle to be configured with.
                 enum:
                 - default
                 - json
                 type: string
               logLevel:
-                description: LogLevel for victoria metrics single to be configured
-                  with.
                 enum:
                 - INFO
                 - WARN
@@ -28772,139 +34723,67 @@ spec:
                 - PANIC
                 type: string
               managedMetadata:
-                description: |-
-                  ManagedMetadata defines metadata that will be added to the all objects
-                  created by operator for the given CustomResource
                 properties:
                   annotations:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                     type: object
                   labels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                     type: object
                 type: object
               minReadySeconds:
-                description: |-
-                  MinReadySeconds defines a minimum number of seconds to wait before starting update next pod
-                  if previous in healthy state
-                  Has no effect for VLogs and VMSingle
                 format: int32
                 type: integer
               nodeSelector:
                 additionalProperties:
                   type: string
-                description: NodeSelector Define which Nodes the Pods are scheduled
-                  on.
                 type: object
               paused:
-                description: |-
-                  Paused If set to true all actions on the underlying managed objects are not
-                  going to be performed, except for delete actions.
                 type: boolean
               podMetadata:
-                description: PodMetadata configures Labels and Annotations which are
-                  propagated to the VMSingle pods.
                 properties:
                   annotations:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                     type: object
                   labels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects. May match selectors of replication controllers
-                      and services.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                     type: object
                   name:
-                    description: |-
-                      Name must be unique within a namespace. Is required when creating resources, although
-                      some resources may allow a client to request the generation of an appropriate name
-                      automatically. Name is primarily intended for creation idempotence and configuration
-                      definition.
-                      Cannot be updated.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                     type: string
                 type: object
               port:
-                description: Port listen address
                 type: string
               priorityClassName:
-                description: PriorityClassName class assigned to the Pods
                 type: string
               readinessGates:
-                description: ReadinessGates defines pod readiness gates
                 items:
-                  description: PodReadinessGate contains the reference to a pod condition
                   properties:
                     conditionType:
-                      description: ConditionType refers to a condition in the pod's
-                        condition list with matching type.
                       type: string
                   required:
                   - conditionType
                   type: object
                 type: array
               readinessProbe:
-                description: ReadinessProbe that will be added CRD pod
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               removePvcAfterDelete:
-                description: |-
-                  RemovePvcAfterDelete - if true, controller adds ownership to pvc
-                  and after VMSingle object deletion - pvc will be garbage collected
-                  by controller manager
                 type: boolean
               replicaCount:
-                description: ReplicaCount is the expected size of the Application.
                 format: int32
                 type: integer
               resources:
-                description: |-
-                  Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
                 properties:
                   claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
                     items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
                       properties:
                         name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
                           type: string
                         request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
                           type: string
                       required:
                       - name
@@ -28920,9 +34799,6 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                   requests:
                     additionalProperties:
@@ -28931,150 +34807,72 @@ spec:
                       - type: string
                       pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                       x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                 type: object
               retentionPeriod:
-                description: |-
-                  RetentionPeriod for the stored metrics
-                  Note VictoriaMetrics has data/ and indexdb/ folders
-                  metrics from data/ removed eventually as soon as partition leaves retention period
-                  reverse index data at indexdb rotates once at the half of configured [retention period](https://docs.victoriametrics.com/Single-server-VictoriaMetrics/#retention)
+                pattern: ^[0-9]+(h|d|w|y)?$
                 type: string
               revisionHistoryLimitCount:
-                description: |-
-                  The number of old ReplicaSets to retain to allow rollback in deployment or
-                  maximum number of revisions that will be maintained in the Deployment revision history.
-                  Has no effect at StatefulSets
-                  Defaults to 10.
                 format: int32
                 type: integer
               runtimeClassName:
-                description: |-
-                  RuntimeClassName - defines runtime class for kubernetes pod.
-                  https://kubernetes.io/docs/concepts/containers/runtime-class/
                 type: string
               schedulerName:
-                description: SchedulerName - defines kubernetes scheduler name
                 type: string
               secrets:
-                description: |-
-                  Secrets is a list of Secrets in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/secrets/SECRET_NAME folder
                 items:
                   type: string
                 type: array
               securityContext:
-                description: |-
-                  SecurityContext holds pod-level security attributes and common container settings.
-                  This defaults to the default PodSecurityContext.
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               serviceAccountName:
-                description: ServiceAccountName is the name of the ServiceAccount
-                  to use to run the pods
                 type: string
               serviceScrapeSpec:
-                description: ServiceScrapeSpec that will be added to vmsingle VMServiceScrape
-                  spec
                 required:
                 - endpoints
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               serviceSpec:
-                description: ServiceSpec that will be added to vmsingle service spec
                 properties:
                   metadata:
-                    description: EmbeddedObjectMetadata defines objectMeta for additional
-                      service.
                     properties:
                       annotations:
                         additionalProperties:
                           type: string
-                        description: |-
-                          Annotations is an unstructured key value map stored with a resource that may be
-                          set by external tools to store and retrieve arbitrary metadata. They are not
-                          queryable and should be preserved when modifying objects.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                         type: object
                       labels:
                         additionalProperties:
                           type: string
-                        description: |-
-                          Labels Map of string keys and values that can be used to organize and categorize
-                          (scope and select) objects. May match selectors of replication controllers
-                          and services.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                         type: object
                       name:
-                        description: |-
-                          Name must be unique within a namespace. Is required when creating resources, although
-                          some resources may allow a client to request the generation of an appropriate name
-                          automatically. Name is primarily intended for creation idempotence and configuration
-                          definition.
-                          Cannot be updated.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                         type: string
                     type: object
                   spec:
-                    description: |-
-                      ServiceSpec describes the attributes that a user creates on a service.
-                      More info: https://kubernetes.io/docs/concepts/services-networking/service/
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   useAsDefault:
-                    description: |-
-                      UseAsDefault applies changes from given service definition to the main object Service
-                      Changing from headless service to clusterIP or loadbalancer may break cross-component communication
                     type: boolean
                 required:
                 - spec
                 type: object
               startupProbe:
-                description: StartupProbe that will be added to CRD pod
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               storage:
-                description: |-
-                  Storage is the definition of how storage will be used by the VMSingle
-                  by default it`s empty dir
-                  this option is ignored if storageDataPath is set
                 properties:
                   accessModes:
-                    description: |-
-                      accessModes contains the desired access modes the volume should have.
-                      More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
                     items:
                       type: string
                     type: array
                     x-kubernetes-list-type: atomic
                   dataSource:
-                    description: |-
-                      dataSource field can be used to specify either:
-                      * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
-                      * An existing PVC (PersistentVolumeClaim)
-                      If the provisioner or an external controller can support the specified data source,
-                      it will create a new volume based on the contents of the specified data source.
-                      When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-                      and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
-                      If the namespace is specified, then dataSourceRef will not be copied to dataSource.
                     properties:
                       apiGroup:
-                        description: |-
-                          APIGroup is the group for the resource being referenced.
-                          If APIGroup is not specified, the specified Kind must be in the core API group.
-                          For any other third-party types, APIGroup is required.
                         type: string
                       kind:
-                        description: Kind is the type of resource being referenced
                         type: string
                       name:
-                        description: Name is the name of resource being referenced
                         type: string
                     required:
                     - kind
@@ -29082,60 +34880,20 @@ spec:
                     type: object
                     x-kubernetes-map-type: atomic
                   dataSourceRef:
-                    description: |-
-                      dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
-                      volume is desired. This may be any object from a non-empty API group (non
-                      core object) or a PersistentVolumeClaim object.
-                      When this field is specified, volume binding will only succeed if the type of
-                      the specified object matches some installed volume populator or dynamic
-                      provisioner.
-                      This field will replace the functionality of the dataSource field and as such
-                      if both fields are non-empty, they must have the same value. For backwards
-                      compatibility, when namespace isn't specified in dataSourceRef,
-                      both fields (dataSource and dataSourceRef) will be set to the same
-                      value automatically if one of them is empty and the other is non-empty.
-                      When namespace is specified in dataSourceRef,
-                      dataSource isn't set to the same value and must be empty.
-                      There are three important differences between dataSource and dataSourceRef:
-                      * While dataSource only allows two specific types of objects, dataSourceRef
-                        allows any non-core object, as well as PersistentVolumeClaim objects.
-                      * While dataSource ignores disallowed values (dropping them), dataSourceRef
-                        preserves all values, and generates an error if a disallowed value is
-                        specified.
-                      * While dataSource only allows local objects, dataSourceRef allows objects
-                        in any namespaces.
-                      (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
-                      (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
                     properties:
                       apiGroup:
-                        description: |-
-                          APIGroup is the group for the resource being referenced.
-                          If APIGroup is not specified, the specified Kind must be in the core API group.
-                          For any other third-party types, APIGroup is required.
                         type: string
                       kind:
-                        description: Kind is the type of resource being referenced
                         type: string
                       name:
-                        description: Name is the name of resource being referenced
                         type: string
                       namespace:
-                        description: |-
-                          Namespace is the namespace of resource being referenced
-                          Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
-                          (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
                         type: string
                     required:
                     - kind
                     - name
                     type: object
                   resources:
-                    description: |-
-                      resources represents the minimum resources the volume should have.
-                      If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
-                      that are lower than previous value but must still be higher than capacity recorded in the
-                      status field of the claim.
-                      More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
                     properties:
                       limits:
                         additionalProperties:
@@ -29144,9 +34902,6 @@ spec:
                           - type: string
                           pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                           x-kubernetes-int-or-string: true
-                        description: |-
-                          Limits describes the maximum amount of compute resources allowed.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                         type: object
                       requests:
                         additionalProperties:
@@ -29155,40 +34910,18 @@ spec:
                           - type: string
                           pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                           x-kubernetes-int-or-string: true
-                        description: |-
-                          Requests describes the minimum amount of compute resources required.
-                          If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                          otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                         type: object
                     type: object
                   selector:
-                    description: selector is a label query over volumes to consider
-                      for binding.
                     properties:
                       matchExpressions:
-                        description: matchExpressions is a list of label selector
-                          requirements. The requirements are ANDed.
                         items:
-                          description: |-
-                            A label selector requirement is a selector that contains values, a key, and an operator that
-                            relates the key and values.
                           properties:
                             key:
-                              description: key is the label key that the selector
-                                applies to.
                               type: string
                             operator:
-                              description: |-
-                                operator represents a key's relationship to a set of values.
-                                Valid operators are In, NotIn, Exists and DoesNotExist.
                               type: string
                             values:
-                              description: |-
-                                values is an array of string values. If the operator is In or NotIn,
-                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                the values array must be empty. This array is replaced during a strategic
-                                merge patch.
                               items:
                                 type: string
                               type: array
@@ -29202,393 +34935,176 @@ spec:
                       matchLabels:
                         additionalProperties:
                           type: string
-                        description: |-
-                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                          operator is "In", and the values array contains only "value". The requirements are ANDed.
                         type: object
                     type: object
                     x-kubernetes-map-type: atomic
                   storageClassName:
-                    description: |-
-                      storageClassName is the name of the StorageClass required by the claim.
-                      More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
                     type: string
                   volumeAttributesClassName:
-                    description: |-
-                      volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
-                      If specified, the CSI driver will create or update the volume with the attributes defined
-                      in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                      it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                      will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                      If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                      will be set by the persistentvolume controller if it exists.
-                      If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
-                      set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
-                      exists.
-                      More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                      (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                     type: string
                   volumeMode:
-                    description: |-
-                      volumeMode defines what type of volume is required by the claim.
-                      Value of Filesystem is implied when not included in claim spec.
                     type: string
                   volumeName:
-                    description: volumeName is the binding reference to the PersistentVolume
-                      backing this claim.
                     type: string
                 type: object
               storageDataPath:
-                description: |-
-                  StorageDataPath disables spec.storage option and overrides arg for victoria-metrics binary --storageDataPath,
-                  its users responsibility to mount proper device into given path.
-                  It requires to provide spec.volumes and spec.volumeMounts with at least 1 value
                 type: string
               storageMetadata:
-                description: StorageMeta defines annotations and labels attached to
-                  PVC for given vmsingle CR
                 properties:
                   annotations:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
                     type: object
                   labels:
                     additionalProperties:
                       type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects. May match selectors of replication controllers
-                      and services.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                     type: object
                   name:
-                    description: |-
-                      Name must be unique within a namespace. Is required when creating resources, although
-                      some resources may allow a client to request the generation of an appropriate name
-                      automatically. Name is primarily intended for creation idempotence and configuration
-                      definition.
-                      Cannot be updated.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
                     type: string
                 type: object
               streamAggrConfig:
-                description: StreamAggrConfig defines stream aggregation configuration
-                  for VMSingle
                 properties:
                   configmap:
-                    description: ConfigMap with stream aggregation rules
                     properties:
                       key:
-                        description: The key to select.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the ConfigMap or its key must
-                          be defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   dedupInterval:
-                    description: Allows setting different de-duplication intervals
-                      per each configured remote storage
                     type: string
                   dropInput:
-                    description: Allow drop all the input samples after the aggregation
                     type: boolean
                   dropInputLabels:
-                    description: labels to drop from samples for aggregator before
-                      stream de-duplication and aggregation
                     items:
                       type: string
                     type: array
                   enableWindows:
-                    description: EnableWindows enables aggregating data in separate
-                      windows ( available from v0.54.0).
                     type: boolean
                   ignoreFirstIntervals:
-                    description: IgnoreFirstIntervals instructs to ignore first interval
                     type: integer
+                  ignoreFirstSampleInterval:
+                    type: string
                   ignoreOldSamples:
-                    description: IgnoreOldSamples instructs to ignore samples with
-                      old timestamps outside the current aggregation interval.
                     type: boolean
                   keepInput:
-                    description: Allows writing both raw and aggregate data
                     type: boolean
                   rules:
-                    description: Stream aggregation rules
                     items:
-                      description: StreamAggrRule defines the rule in stream aggregation
-                        config
                       properties:
                         by:
-                          description: |-
-                            By is an optional list of labels for grouping input series.
-
-                            See also Without.
-
-                            If neither By nor Without are set, then the Outputs are calculated
-                            individually per each input time series.
                           items:
                             type: string
                           type: array
                         dedup_interval:
-                          description: DedupInterval is an optional interval for deduplication.
                           type: string
                         drop_input_labels:
-                          description: |-
-                            DropInputLabels is an optional list with labels, which must be dropped before further processing of input samples.
-
-                            Labels are dropped before de-duplication and aggregation.
                           items:
                             type: string
                           type: array
                         enable_windows:
-                          description: EnableWindows enables aggregating data in separate
-                            windows
                           type: boolean
                         flush_on_shutdown:
-                          description: |-
-                            FlushOnShutdown defines whether to flush the aggregation state on process termination
-                            or config reload. Is `false` by default.
-                            It is not recommended changing this setting, unless unfinished aggregations states
-                            are preferred to missing data points.
                           type: boolean
                         ignore_first_intervals:
                           type: integer
                         ignore_old_samples:
-                          description: IgnoreOldSamples instructs to ignore samples
-                            with old timestamps outside the current aggregation interval.
                           type: boolean
+                        ignoreFirstSampleInterval:
+                          type: string
                         input_relabel_configs:
-                          description: |-
-                            InputRelabelConfigs is an optional relabeling rules, which are applied on the input
-                            before aggregation.
                           items:
-                            description: |-
-                              RelabelConfig allows dynamic rewriting of the label set
-                              More info: https://docs.victoriametrics.com/#relabeling
                             properties:
                               action:
-                                description: Action to perform based on regex matching.
-                                  Default is 'replace'
                                 type: string
                               if:
-                                description: 'If represents metricsQL match expression
-                                  (or list of expressions): ''{__name__=~"foo_.*"}'''
                                 x-kubernetes-preserve-unknown-fields: true
                               labels:
                                 additionalProperties:
                                   type: string
-                                description: 'Labels is used together with Match for
-                                  `action: graphite`'
                                 type: object
                               match:
-                                description: 'Match is used together with Labels for
-                                  `action: graphite`'
                                 type: string
                               modulus:
-                                description: Modulus to take of the hash of the source
-                                  label values.
                                 format: int64
                                 type: integer
                               regex:
-                                description: |-
-                                  Regular expression against which the extracted value is matched. Default is '(.*)'
-                                  victoriaMetrics supports multiline regex joined with |
-                                  https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                                 x-kubernetes-preserve-unknown-fields: true
                               replacement:
-                                description: |-
-                                  Replacement value against which a regex replace is performed if the
-                                  regular expression matches. Regex capture groups are available. Default is '$1'
                                 type: string
                               separator:
-                                description: Separator placed between concatenated
-                                  source label values. default is ';'.
                                 type: string
                               source_labels:
-                                description: |-
-                                  UnderScoreSourceLabels - additional form of source labels source_labels
-                                  for compatibility with original relabel config.
-                                  if set  both sourceLabels and source_labels, sourceLabels has priority.
-                                  for details https://github.com/VictoriaMetrics/operator/issues/131
                                 items:
                                   type: string
                                 type: array
                               sourceLabels:
-                                description: |-
-                                  The source labels select values from existing labels. Their content is concatenated
-                                  using the configured separator and matched against the configured regular expression
-                                  for the replace, keep, and drop actions.
                                 items:
                                   type: string
                                 type: array
                               target_label:
-                                description: |-
-                                  UnderScoreTargetLabel - additional form of target label - target_label
-                                  for compatibility with original relabel config.
-                                  if set  both targetLabel and target_label, targetLabel has priority.
-                                  for details https://github.com/VictoriaMetrics/operator/issues/131
                                 type: string
                               targetLabel:
-                                description: |-
-                                  Label to which the resulting value is written in a replace action.
-                                  It is mandatory for replace actions. Regex capture groups are available.
                                 type: string
                             type: object
                           type: array
                         interval:
-                          description: Interval is the interval between aggregations.
                           type: string
                         keep_metric_names:
-                          description: KeepMetricNames instructs to leave metric names
-                            as is for the output time series without adding any suffix.
                           type: boolean
                         match:
-                          description: |-
-                            Match is a label selector (or list of label selectors) for filtering time series for the given selector.
-
-                            If the match isn't set, then all the input time series are processed.
                           x-kubernetes-preserve-unknown-fields: true
                         no_align_flush_to_interval:
-                          description: |-
-                            NoAlignFlushToInterval disables aligning of flushes to multiples of Interval.
-                            By default flushes are aligned to Interval.
                           type: boolean
                         output_relabel_configs:
-                          description: |-
-                            OutputRelabelConfigs is an optional relabeling rules, which are applied
-                            on the aggregated output before being sent to remote storage.
                           items:
-                            description: |-
-                              RelabelConfig allows dynamic rewriting of the label set
-                              More info: https://docs.victoriametrics.com/#relabeling
                             properties:
                               action:
-                                description: Action to perform based on regex matching.
-                                  Default is 'replace'
                                 type: string
                               if:
-                                description: 'If represents metricsQL match expression
-                                  (or list of expressions): ''{__name__=~"foo_.*"}'''
                                 x-kubernetes-preserve-unknown-fields: true
                               labels:
                                 additionalProperties:
                                   type: string
-                                description: 'Labels is used together with Match for
-                                  `action: graphite`'
                                 type: object
                               match:
-                                description: 'Match is used together with Labels for
-                                  `action: graphite`'
                                 type: string
                               modulus:
-                                description: Modulus to take of the hash of the source
-                                  label values.
                                 format: int64
                                 type: integer
                               regex:
-                                description: |-
-                                  Regular expression against which the extracted value is matched. Default is '(.*)'
-                                  victoriaMetrics supports multiline regex joined with |
-                                  https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                                 x-kubernetes-preserve-unknown-fields: true
                               replacement:
-                                description: |-
-                                  Replacement value against which a regex replace is performed if the
-                                  regular expression matches. Regex capture groups are available. Default is '$1'
                                 type: string
                               separator:
-                                description: Separator placed between concatenated
-                                  source label values. default is ';'.
                                 type: string
                               source_labels:
-                                description: |-
-                                  UnderScoreSourceLabels - additional form of source labels source_labels
-                                  for compatibility with original relabel config.
-                                  if set  both sourceLabels and source_labels, sourceLabels has priority.
-                                  for details https://github.com/VictoriaMetrics/operator/issues/131
                                 items:
                                   type: string
                                 type: array
                               sourceLabels:
-                                description: |-
-                                  The source labels select values from existing labels. Their content is concatenated
-                                  using the configured separator and matched against the configured regular expression
-                                  for the replace, keep, and drop actions.
                                 items:
                                   type: string
                                 type: array
                               target_label:
-                                description: |-
-                                  UnderScoreTargetLabel - additional form of target label - target_label
-                                  for compatibility with original relabel config.
-                                  if set  both targetLabel and target_label, targetLabel has priority.
-                                  for details https://github.com/VictoriaMetrics/operator/issues/131
                                 type: string
                               targetLabel:
-                                description: |-
-                                  Label to which the resulting value is written in a replace action.
-                                  It is mandatory for replace actions. Regex capture groups are available.
                                 type: string
                             type: object
                           type: array
                         outputs:
-                          description: |-
-                            Outputs is a list of output aggregate functions to produce.
-
-                            The following names are allowed:
-
-                            - total - aggregates input counters
-                            - increase - counts the increase over input counters
-                            - count_series - counts the input series
-                            - count_samples - counts the input samples
-                            - sum_samples - sums the input samples
-                            - last - the last biggest sample value
-                            - min - the minimum sample value
-                            - max - the maximum sample value
-                            - avg - the average value across all the samples
-                            - stddev - standard deviation across all the samples
-                            - stdvar - standard variance across all the samples
-                            - histogram_bucket - creates VictoriaMetrics histogram for input samples
-                            - quantiles(phi1, ..., phiN) - quantiles' estimation for phi in the range [0..1]
-
-                            The output time series will have the following names:
-
-                              input_name:aggr_<interval>_<output>
                           items:
                             type: string
                           type: array
                         staleness_interval:
-                          description: |-
-                            Staleness interval is interval after which the series state will be reset if no samples have been sent during it.
-                            The parameter is only relevant for outputs: total, total_prometheus, increase, increase_prometheus and histogram_bucket.
                           type: string
                         without:
-                          description: |-
-                            Without is an optional list of labels, which must be excluded when grouping input series.
-
-                            See also By.
-
-                            If neither By nor Without are set, then the Outputs are calculated
-                            individually per each input time series.
                           items:
                             type: string
                           type: array
@@ -29599,58 +35115,26 @@ spec:
                     type: array
                 type: object
               terminationGracePeriodSeconds:
-                description: TerminationGracePeriodSeconds period for container graceful
-                  termination
                 format: int64
                 type: integer
               tolerations:
-                description: Tolerations If specified, the pod's tolerations.
                 items:
-                  description: |-
-                    The pod this Toleration is attached to tolerates any taint that matches
-                    the triple <key,value,effect> using the matching operator <operator>.
                   properties:
                     effect:
-                      description: |-
-                        Effect indicates the taint effect to match. Empty means match all taint effects.
-                        When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                       type: string
                     key:
-                      description: |-
-                        Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                        If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                       type: string
                     operator:
-                      description: |-
-                        Operator represents a key's relationship to the value.
-                        Valid operators are Exists and Equal. Defaults to Equal.
-                        Exists is equivalent to wildcard for value, so that a pod can
-                        tolerate all taints of a particular category.
                       type: string
                     tolerationSeconds:
-                      description: |-
-                        TolerationSeconds represents the period of time the toleration (which must be
-                        of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                        it is not set, which means tolerate the taint forever (do not evict). Zero and
-                        negative values will be treated as 0 (evict immediately) by the system.
                       format: int64
                       type: integer
                     value:
-                      description: |-
-                        Value is the taint value the toleration matches to.
-                        If the operator is Exists, the value should be empty, otherwise just a regular string.
                       type: string
                   type: object
                 type: array
               topologySpreadConstraints:
-                description: |-
-                  TopologySpreadConstraints embedded kubernetes pod configuration option,
-                  controls how pods are spread across your cluster among failure-domains
-                  such as regions, zones, nodes, and other user-defined topology domains
-                  https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
                 items:
-                  description: TopologySpreadConstraint specifies how to spread matching
-                    pods among the given topology.
                   required:
                   - maxSkew
                   - topologyKey
@@ -29659,196 +35143,120 @@ spec:
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
               useDefaultResources:
-                description: |-
-                  UseDefaultResources controls resource settings
-                  By default, operator sets built-in resource requirements
                 type: boolean
               useStrictSecurity:
-                description: |-
-                  UseStrictSecurity enables strict security mode for component
-                  it restricts disk writes access
-                  uses non-root user out of the box
-                  drops not needed security permissions
                 type: boolean
               vmBackup:
-                description: VMBackup configuration for backup
                 properties:
                   acceptEULA:
-                    description: |-
-                      AcceptEULA accepts enterprise feature usage, must be set to true.
-                      otherwise backupmanager cannot be added to single/cluster version.
-                      https://victoriametrics.com/legal/esa/
                     type: boolean
                   concurrency:
-                    description: Defines number of concurrent workers. Higher concurrency
-                      may reduce backup duration (default 10)
                     format: int32
                     type: integer
                   credentialsSecret:
-                    description: |-
-                      CredentialsSecret is secret in the same namespace for access to remote storage
-                      The secret is mounted into /etc/vm/creds.
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   customS3Endpoint:
-                    description: Custom S3 endpoint for use with S3-compatible storages
-                      (e.g. MinIO). S3 is used if not set
                     type: string
                   destination:
-                    description: Defines destination for backup
                     type: string
                   destinationDisableSuffixAdd:
-                    description: |-
-                      DestinationDisableSuffixAdd - disables suffix adding for cluster version backups
-                      each vmstorage backup must have unique backup folder
-                      so operator adds POD_NAME as suffix for backup destination folder.
                     type: boolean
                   disableDaily:
-                    description: Defines if daily backups disabled (default false)
                     type: boolean
                   disableHourly:
-                    description: Defines if hourly backups disabled (default false)
                     type: boolean
                   disableMonthly:
-                    description: Defines if monthly backups disabled (default false)
                     type: boolean
                   disableWeekly:
-                    description: Defines if weekly backups disabled (default false)
                     type: boolean
                   extraArgs:
                     additionalProperties:
                       type: string
-                    description: extra args like maxBytesPerSecond default 0
                     type: object
                   extraEnvs:
                     items:
-                      description: EnvVar represents an environment variable present
-                        in a Container.
                       properties:
                         name:
-                          description: Name of the environment variable. Must be a
-                            C_IDENTIFIER.
                           type: string
                         value:
-                          description: |-
-                            Variable references $(VAR_NAME) are expanded
-                            using the previously defined environment variables in the container and
-                            any service environment variables. If a variable cannot be resolved,
-                            the reference in the input string will be unchanged. Double $$ are reduced
-                            to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                            "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                            Escaped references will never be expanded, regardless of whether the variable
-                            exists or not.
-                            Defaults to "".
                           type: string
                         valueFrom:
-                          description: Source for the environment variable's value.
-                            Cannot be used if value is not empty.
                           properties:
                             configMapKeyRef:
-                              description: Selects a key of a ConfigMap.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             fieldRef:
-                              description: |-
-                                Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
-                                spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
                               properties:
                                 apiVersion:
-                                  description: Version of the schema the FieldPath
-                                    is written in terms of, defaults to "v1".
                                   type: string
                                 fieldPath:
-                                  description: Path of the field to select in the
-                                    specified API version.
                                   type: string
                               required:
                               - fieldPath
                               type: object
                               x-kubernetes-map-type: atomic
+                            fileKeyRef:
+                              properties:
+                                key:
+                                  type: string
+                                optional:
+                                  default: false
+                                  type: boolean
+                                path:
+                                  type: string
+                                volumeName:
+                                  type: string
+                              required:
+                              - key
+                              - path
+                              - volumeName
+                              type: object
+                              x-kubernetes-map-type: atomic
                             resourceFieldRef:
-                              description: |-
-                                Selects a resource of the container: only resources limits and requests
-                                (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
                               properties:
                                 containerName:
-                                  description: 'Container name: required for volumes,
-                                    optional for env vars'
                                   type: string
                                 divisor:
                                   anyOf:
                                   - type: integer
                                   - type: string
-                                  description: Specifies the output format of the
-                                    exposed resources, defaults to "1"
                                   pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                   x-kubernetes-int-or-string: true
                                 resource:
-                                  description: 'Required: resource to select'
                                   type: string
                               required:
                               - resource
                               type: object
                               x-kubernetes-map-type: atomic
                             secretKeyRef:
-                              description: Selects a key of a secret in the pod's
-                                namespace
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -29860,77 +35268,45 @@ spec:
                       type: object
                     type: array
                   extraEnvsFrom:
-                    description: |-
-                      ExtraEnvsFrom defines source of env variables for the application container
-                      could either be secret or configmap
                     items:
-                      description: EnvFromSource represents the source of a set of
-                        ConfigMaps
                       properties:
                         configMapRef:
-                          description: The ConfigMap to select from
                           properties:
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the ConfigMap must be defined
                               type: boolean
                           type: object
                           x-kubernetes-map-type: atomic
                         prefix:
-                          description: An optional identifier to prepend to each key
-                            in the ConfigMap. Must be a C_IDENTIFIER.
                           type: string
                         secretRef:
-                          description: The Secret to select from
                           properties:
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret must be defined
                               type: boolean
                           type: object
                           x-kubernetes-map-type: atomic
                       type: object
                     type: array
                   image:
-                    description: Image - docker image settings for VMBackuper
                     properties:
                       pullPolicy:
-                        description: PullPolicy describes how to pull docker image
                         type: string
                       repository:
-                        description: Repository contains name of docker image + it's
-                          repository if needed
                         type: string
                       tag:
-                        description: Tag contains desired docker image version
                         type: string
                     type: object
                   logFormat:
-                    description: |-
-                      LogFormat for VMBackup to be configured with.
-                      default or json
                     enum:
                     - default
                     - json
                     type: string
                   logLevel:
-                    description: LogLevel for VMBackup to be configured with.
                     enum:
                     - INFO
                     - WARN
@@ -29939,36 +35315,15 @@ spec:
                     - PANIC
                     type: string
                   port:
-                    description: Port for health check connections
                     type: string
                   resources:
-                    description: |-
-                      Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                      if not defined default resources from operator config will be used
                     properties:
                       claims:
-                        description: |-
-                          Claims lists the names of resources, defined in spec.resourceClaims,
-                          that are used by this container.
-
-                          This is an alpha field and requires enabling the
-                          DynamicResourceAllocation feature gate.
-
-                          This field is immutable. It can only be set for containers.
                         items:
-                          description: ResourceClaim references one entry in PodSpec.ResourceClaims.
                           properties:
                             name:
-                              description: |-
-                                Name must match the name of one entry in pod.spec.resourceClaims of
-                                the Pod where this field is used. It makes that resource available
-                                inside a container.
                               type: string
                             request:
-                              description: |-
-                                Request is the name chosen for a request in the referenced claim.
-                                If empty, everything from the claim is made available, otherwise
-                                only the result of this request.
                               type: string
                           required:
                           - name
@@ -29984,9 +35339,6 @@ spec:
                           - type: string
                           pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                           x-kubernetes-int-or-string: true
-                        description: |-
-                          Limits describes the maximum amount of compute resources allowed.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                         type: object
                       requests:
                         additionalProperties:
@@ -29995,94 +35347,36 @@ spec:
                           - type: string
                           pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                           x-kubernetes-int-or-string: true
-                        description: |-
-                          Requests describes the minimum amount of compute resources required.
-                          If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                          otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                         type: object
                     type: object
                   restore:
-                    description: |-
-                      Restore Allows to enable restore options for pod
-                      Read [more](https://docs.victoriametrics.com/vmbackupmanager#restore-commands)
                     properties:
                       onStart:
-                        description: OnStart defines configuration for restore on
-                          pod start
                         properties:
                           enabled:
-                            description: Enabled defines if restore on start enabled
                             type: boolean
                         type: object
                     type: object
                   snapshotCreateURL:
-                    description: SnapshotCreateURL overwrites url for snapshot create
                     type: string
                   snapshotDeleteURL:
-                    description: SnapShotDeleteURL overwrites url for snapshot delete
                     type: string
                   volumeMounts:
-                    description: |-
-                      VolumeMounts allows configuration of additional VolumeMounts on the output Deployment definition.
-                      VolumeMounts specified will be appended to other VolumeMounts in the vmbackupmanager container,
-                      that are generated as a result of StorageSpec objects.
                     items:
-                      description: VolumeMount describes a mounting of a Volume within
-                        a container.
                       properties:
                         mountPath:
-                          description: |-
-                            Path within the container at which the volume should be mounted.  Must
-                            not contain ':'.
                           type: string
                         mountPropagation:
-                          description: |-
-                            mountPropagation determines how mounts are propagated from the host
-                            to container and the other way around.
-                            When not set, MountPropagationNone is used.
-                            This field is beta in 1.10.
-                            When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                            (which defaults to None).
                           type: string
                         name:
-                          description: This must match the Name of a Volume.
                           type: string
                         readOnly:
-                          description: |-
-                            Mounted read-only if true, read-write otherwise (false or unspecified).
-                            Defaults to false.
                           type: boolean
                         recursiveReadOnly:
-                          description: |-
-                            RecursiveReadOnly specifies whether read-only mounts should be handled
-                            recursively.
-
-                            If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                            If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                            recursively read-only.  If this field is set to IfPossible, the mount is made
-                            recursively read-only, if it is supported by the container runtime.  If this
-                            field is set to Enabled, the mount is made recursively read-only if it is
-                            supported by the container runtime, otherwise the pod will not be started and
-                            an error will be generated to indicate the reason.
-
-                            If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                            None (or be unspecified, which defaults to None).
-
-                            If this field is not specified, it is treated as an equivalent of Disabled.
                           type: string
                         subPath:
-                          description: |-
-                            Path within the volume from which the container's volume should be mounted.
-                            Defaults to "" (volume's root).
                           type: string
                         subPathExpr:
-                          description: |-
-                            Expanded path within the volume from which the container's volume should be mounted.
-                            Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                            Defaults to "" (volume's root).
-                            SubPathExpr and SubPath are mutually exclusive.
                           type: string
                       required:
                       - mountPath
@@ -30091,65 +35385,21 @@ spec:
                     type: array
                 type: object
               volumeMounts:
-                description: |-
-                  VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
-                  VolumeMounts specified will be appended to other VolumeMounts in the Application container
                 items:
-                  description: VolumeMount describes a mounting of a Volume within
-                    a container.
                   properties:
                     mountPath:
-                      description: |-
-                        Path within the container at which the volume should be mounted.  Must
-                        not contain ':'.
                       type: string
                     mountPropagation:
-                      description: |-
-                        mountPropagation determines how mounts are propagated from the host
-                        to container and the other way around.
-                        When not set, MountPropagationNone is used.
-                        This field is beta in 1.10.
-                        When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                        (which defaults to None).
                       type: string
                     name:
-                      description: This must match the Name of a Volume.
                       type: string
                     readOnly:
-                      description: |-
-                        Mounted read-only if true, read-write otherwise (false or unspecified).
-                        Defaults to false.
                       type: boolean
                     recursiveReadOnly:
-                      description: |-
-                        RecursiveReadOnly specifies whether read-only mounts should be handled
-                        recursively.
-
-                        If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                        If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                        recursively read-only.  If this field is set to IfPossible, the mount is made
-                        recursively read-only, if it is supported by the container runtime.  If this
-                        field is set to Enabled, the mount is made recursively read-only if it is
-                        supported by the container runtime, otherwise the pod will not be started and
-                        an error will be generated to indicate the reason.
-
-                        If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                        None (or be unspecified, which defaults to None).
-
-                        If this field is not specified, it is treated as an equivalent of Disabled.
                       type: string
                     subPath:
-                      description: |-
-                        Path within the volume from which the container's volume should be mounted.
-                        Defaults to "" (volume's root).
                       type: string
                     subPathExpr:
-                      description: |-
-                        Expanded path within the volume from which the container's volume should be mounted.
-                        Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                        Defaults to "" (volume's root).
-                        SubPathExpr and SubPath are mutually exclusive.
                       type: string
                   required:
                   - mountPath
@@ -30157,74 +35407,42 @@ spec:
                   type: object
                 type: array
               volumes:
-                description: |-
-                  Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
-                  Volumes specified will be appended to other volumes that are generated.
-                  / +optional
                 items:
-                  description: Volume represents a named volume in a pod that may
-                    be accessed by any container in the pod.
                   required:
                   - name
                   type: object
                   x-kubernetes-preserve-unknown-fields: true
                 type: array
-            required:
-            - retentionPeriod
             type: object
           status:
-            description: VMSingleStatus defines the observed state of VMSingle
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -30239,20 +35457,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
-                type: string
-              singleStatus:
-                description: LegacyStatus is deprecated and will be removed at v0.52.0
-                  version
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -30265,7 +35474,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmstaticscrapes.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -30289,137 +35498,71 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: VMStaticScrape  defines static targets configuration for scraping.
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMStaticScrapeSpec defines the desired state of VMStaticScrape.
             properties:
               jobName:
-                description: JobName name of job.
                 type: string
               sampleLimit:
-                description: SampleLimit defines per-scrape limit on number of scraped
-                  samples that will be accepted.
-                format: int64
                 type: integer
+              scrapeClass:
+                type: string
               seriesLimit:
-                description: |-
-                  SeriesLimit defines per-scrape limit on number of unique time series
-                  a single target can expose during all the scrapes on the time window of 24h.
-                format: int64
                 type: integer
               targetEndpoints:
-                description: A list of target endpoints to scrape metrics from.
                 items:
-                  description: TargetEndpoint defines single static target endpoint.
                   properties:
                     authorization:
-                      description: Authorization with http header Authorization
                       properties:
                         credentials:
-                          description: Reference to the secret with value for authorization
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         credentialsFile:
-                          description: File with value for authorization
                           type: string
                         type:
-                          description: Type of authorization, default to bearer
                           type: string
                       type: object
                     basicAuth:
-                      description: BasicAuth allow an endpoint to authenticate over
-                        basic authentication
                       properties:
                         password:
-                          description: |-
-                            Password defines reference for secret with password value
-                            The secret needs to be in the same namespace as scrape object
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         password_file:
-                          description: |-
-                            PasswordFile defines path to password file at disk
-                            must be pre-mounted
                           type: string
                         username:
-                          description: |-
-                            Username defines reference for secret with username value
-                            The secret needs to be in the same namespace as scrape object
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
@@ -30427,186 +35570,96 @@ spec:
                           x-kubernetes-map-type: atomic
                       type: object
                     bearerTokenFile:
-                      description: File to read bearer token for scraping targets.
                       type: string
                     bearerTokenSecret:
-                      description: |-
-                        Secret to mount to read bearer token for scraping targets. The secret
-                        needs to be in the same namespace as the scrape object and accessible by
-                        the victoria-metrics operator.
                       nullable: true
                       properties:
                         key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
                           type: string
                         name:
                           default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                           type: string
                         optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
                           type: boolean
                       required:
                       - key
                       type: object
                       x-kubernetes-map-type: atomic
                     follow_redirects:
-                      description: FollowRedirects controls redirects for scraping.
                       type: boolean
                     honorLabels:
-                      description: HonorLabels chooses the metric's labels on collisions
-                        with target labels.
                       type: boolean
                     honorTimestamps:
-                      description: HonorTimestamps controls whether vmagent respects
-                        the timestamps present in scraped data.
                       type: boolean
                     interval:
-                      description: Interval at which metrics should be scraped
                       type: string
                     labels:
                       additionalProperties:
                         type: string
-                      description: Labels static labels for targets.
                       type: object
                     max_scrape_size:
-                      description: MaxScrapeSize defines a maximum size of scraped
-                        data for a job
                       type: string
                     metricRelabelConfigs:
-                      description: MetricRelabelConfigs to apply to samples after
-                        scrapping.
                       items:
-                        description: |-
-                          RelabelConfig allows dynamic rewriting of the label set
-                          More info: https://docs.victoriametrics.com/#relabeling
                         properties:
                           action:
-                            description: Action to perform based on regex matching.
-                              Default is 'replace'
                             type: string
                           if:
-                            description: 'If represents metricsQL match expression
-                              (or list of expressions): ''{__name__=~"foo_.*"}'''
                             x-kubernetes-preserve-unknown-fields: true
                           labels:
                             additionalProperties:
                               type: string
-                            description: 'Labels is used together with Match for `action:
-                              graphite`'
                             type: object
                           match:
-                            description: 'Match is used together with Labels for `action:
-                              graphite`'
                             type: string
                           modulus:
-                            description: Modulus to take of the hash of the source
-                              label values.
                             format: int64
                             type: integer
                           regex:
-                            description: |-
-                              Regular expression against which the extracted value is matched. Default is '(.*)'
-                              victoriaMetrics supports multiline regex joined with |
-                              https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                             x-kubernetes-preserve-unknown-fields: true
                           replacement:
-                            description: |-
-                              Replacement value against which a regex replace is performed if the
-                              regular expression matches. Regex capture groups are available. Default is '$1'
                             type: string
                           separator:
-                            description: Separator placed between concatenated source
-                              label values. default is ';'.
                             type: string
                           source_labels:
-                            description: |-
-                              UnderScoreSourceLabels - additional form of source labels source_labels
-                              for compatibility with original relabel config.
-                              if set  both sourceLabels and source_labels, sourceLabels has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
                             items:
                               type: string
                             type: array
                           sourceLabels:
-                            description: |-
-                              The source labels select values from existing labels. Their content is concatenated
-                              using the configured separator and matched against the configured regular expression
-                              for the replace, keep, and drop actions.
                             items:
                               type: string
                             type: array
                           target_label:
-                            description: |-
-                              UnderScoreTargetLabel - additional form of target label - target_label
-                              for compatibility with original relabel config.
-                              if set  both targetLabel and target_label, targetLabel has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
                             type: string
                           targetLabel:
-                            description: |-
-                              Label to which the resulting value is written in a replace action.
-                              It is mandatory for replace actions. Regex capture groups are available.
                             type: string
                         type: object
                       type: array
                     oauth2:
-                      description: OAuth2 defines auth configuration
                       properties:
                         client_id:
-                          description: The secret or configmap containing the OAuth2
-                            client id
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -30614,57 +35667,33 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         client_secret:
-                          description: The secret containing the OAuth2 client secret
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         client_secret_file:
-                          description: ClientSecretFile defines path for client secret
-                            file.
                           type: string
                         endpoint_params:
                           additionalProperties:
                             type: string
-                          description: Parameters to append to the token URL
                           type: object
                         proxy_url:
-                          description: |-
-                            The proxy URL for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
                           type: string
                         scopes:
-                          description: OAuth2 scopes used for the token request
                           items:
                             type: string
                           type: array
                         tls_config:
-                          description: |-
-                            TLSConfig for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
                           x-kubernetes-preserve-unknown-fields: true
                         token_url:
-                          description: The URL to fetch the token from
                           minLength: 1
                           type: string
                       required:
@@ -30676,99 +35705,50 @@ spec:
                         items:
                           type: string
                         type: array
-                      description: Optional HTTP URL parameters
                       type: object
                     path:
-                      description: HTTP path to scrape for metrics.
                       type: string
                     proxyURL:
-                      description: ProxyURL eg http://proxyserver:2195 Directs scrapes
-                        to proxy through this endpoint.
                       type: string
                     relabelConfigs:
-                      description: RelabelConfigs to apply to samples during service
-                        discovery.
                       items:
-                        description: |-
-                          RelabelConfig allows dynamic rewriting of the label set
-                          More info: https://docs.victoriametrics.com/#relabeling
                         properties:
                           action:
-                            description: Action to perform based on regex matching.
-                              Default is 'replace'
                             type: string
                           if:
-                            description: 'If represents metricsQL match expression
-                              (or list of expressions): ''{__name__=~"foo_.*"}'''
                             x-kubernetes-preserve-unknown-fields: true
                           labels:
                             additionalProperties:
                               type: string
-                            description: 'Labels is used together with Match for `action:
-                              graphite`'
                             type: object
                           match:
-                            description: 'Match is used together with Labels for `action:
-                              graphite`'
                             type: string
                           modulus:
-                            description: Modulus to take of the hash of the source
-                              label values.
                             format: int64
                             type: integer
                           regex:
-                            description: |-
-                              Regular expression against which the extracted value is matched. Default is '(.*)'
-                              victoriaMetrics supports multiline regex joined with |
-                              https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
                             x-kubernetes-preserve-unknown-fields: true
                           replacement:
-                            description: |-
-                              Replacement value against which a regex replace is performed if the
-                              regular expression matches. Regex capture groups are available. Default is '$1'
                             type: string
                           separator:
-                            description: Separator placed between concatenated source
-                              label values. default is ';'.
                             type: string
                           source_labels:
-                            description: |-
-                              UnderScoreSourceLabels - additional form of source labels source_labels
-                              for compatibility with original relabel config.
-                              if set  both sourceLabels and source_labels, sourceLabels has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
                             items:
                               type: string
                             type: array
                           sourceLabels:
-                            description: |-
-                              The source labels select values from existing labels. Their content is concatenated
-                              using the configured separator and matched against the configured regular expression
-                              for the replace, keep, and drop actions.
                             items:
                               type: string
                             type: array
                           target_label:
-                            description: |-
-                              UnderScoreTargetLabel - additional form of target label - target_label
-                              for compatibility with original relabel config.
-                              if set  both targetLabel and target_label, targetLabel has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
                             type: string
                           targetLabel:
-                            description: |-
-                              Label to which the resulting value is written in a replace action.
-                              It is mandatory for replace actions. Regex capture groups are available.
                             type: string
                         type: object
                       type: array
                     sampleLimit:
-                      description: SampleLimit defines per-scrape limit on number
-                        of scraped samples that will be accepted.
-                      format: int64
                       type: integer
                     scheme:
-                      description: HTTP scheme to use for scraping.
                       enum:
                       - http
                       - https
@@ -30776,76 +35756,41 @@ spec:
                       - HTTP
                       type: string
                     scrape_interval:
-                      description: |-
-                        ScrapeInterval is the same as Interval and has priority over it.
-                        one of scrape_interval or interval can be used
                       type: string
                     scrapeTimeout:
-                      description: Timeout after which the scrape is ended
                       type: string
                     seriesLimit:
-                      description: |-
-                        SeriesLimit defines per-scrape limit on number of unique time series
-                        a single target can expose during all the scrapes on the time window of 24h.
-                      format: int64
                       type: integer
                     targets:
-                      description: Targets static targets addresses in form of ["192.122.55.55:9100","some-name:9100"].
                       items:
                         type: string
                       minItems: 1
                       type: array
                     tlsConfig:
-                      description: TLSConfig configuration to use when scraping the
-                        endpoint
                       properties:
                         ca:
-                          description: Struct containing the CA cert to use for the
-                            targets.
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -30853,56 +35798,30 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         caFile:
-                          description: Path to the CA cert in the container to use
-                            for the targets.
                           type: string
                         cert:
-                          description: Struct containing the client cert file for
-                            the targets.
                           properties:
                             configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
                               properties:
                                 key:
-                                  description: The key to select.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
                                   type: boolean
                               required:
                               - key
                               type: object
                               x-kubernetes-map-type: atomic
                             secret:
-                              description: Secret containing data to use for the targets.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -30910,132 +35829,66 @@ spec:
                               x-kubernetes-map-type: atomic
                           type: object
                         certFile:
-                          description: Path to the client cert file in the container
-                            for the targets.
                           type: string
                         insecureSkipVerify:
-                          description: Disable target certificate validation.
                           type: boolean
                         keyFile:
-                          description: Path to the client key file in the container
-                            for the targets.
                           type: string
                         keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         serverName:
-                          description: Used to verify the hostname for the targets.
                           type: string
                       type: object
                     vm_scrape_params:
-                      description: VMScrapeParams defines VictoriaMetrics specific
-                        scrape parameters
                       properties:
                         disable_compression:
-                          description: DisableCompression
                           type: boolean
                         disable_keep_alive:
-                          description: |-
-                            disable_keepalive allows disabling HTTP keep-alive when scraping targets.
-                            By default, HTTP keep-alive is enabled, so TCP connections to scrape targets
-                            could be reused.
-                            See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements
                           type: boolean
                         headers:
-                          description: |-
-                            Headers allows sending custom headers to scrape targets
-                            must be in of semicolon separated header with it's value
-                            eg:
-                            headerName: headerValue
-                            vmagent supports since 1.79.0 version
                           items:
                             type: string
                           type: array
                         no_stale_markers:
                           type: boolean
                         proxy_client_config:
-                          description: |-
-                            ProxyClientConfig configures proxy auth settings for scraping
-                            See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy
                           properties:
                             basic_auth:
-                              description: BasicAuth allow an endpoint to authenticate
-                                over basic authentication
                               properties:
                                 password:
-                                  description: |-
-                                    Password defines reference for secret with password value
-                                    The secret needs to be in the same namespace as scrape object
                                   properties:
                                     key:
-                                      description: The key of the secret to select
-                                        from.  Must be a valid secret key.
                                       type: string
                                     name:
                                       default: ""
-                                      description: |-
-                                        Name of the referent.
-                                        This field is effectively required, but due to backwards compatibility is
-                                        allowed to be empty. Instances of this type with an empty value here are
-                                        almost certainly wrong.
-                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                       type: string
                                     optional:
-                                      description: Specify whether the Secret or its
-                                        key must be defined
                                       type: boolean
                                   required:
                                   - key
                                   type: object
                                   x-kubernetes-map-type: atomic
                                 password_file:
-                                  description: |-
-                                    PasswordFile defines path to password file at disk
-                                    must be pre-mounted
                                   type: string
                                 username:
-                                  description: |-
-                                    Username defines reference for secret with username value
-                                    The secret needs to be in the same namespace as scrape object
                                   properties:
                                     key:
-                                      description: The key of the secret to select
-                                        from.  Must be a valid secret key.
                                       type: string
                                     name:
                                       default: ""
-                                      description: |-
-                                        Name of the referent.
-                                        This field is effectively required, but due to backwards compatibility is
-                                        allowed to be empty. Instances of this type with an empty value here are
-                                        almost certainly wrong.
-                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                       type: string
                                     optional:
-                                      description: Specify whether the Secret or its
-                                        key must be defined
                                       type: boolean
                                   required:
                                   - key
@@ -31043,24 +35896,13 @@ spec:
                                   x-kubernetes-map-type: atomic
                               type: object
                             bearer_token:
-                              description: SecretKeySelector selects a key of a Secret.
                               properties:
                                 key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
                                   type: string
                                 name:
                                   default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                   type: string
                                 optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
                                   type: boolean
                               required:
                               - key
@@ -31086,58 +35928,34 @@ spec:
             - targetEndpoints
             type: object
           status:
-            description: ScrapeObjectStatus defines the observed state of ScrapeObjects
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -31152,16 +35970,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -31174,7 +35987,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmusers.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -31198,79 +36011,36 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: VMUser is the Schema for the vmusers API
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMUserSpec defines the desired state of VMUser
             properties:
               bearerToken:
-                description: BearerToken Authorization header value for accessing
-                  protected endpoint.
                 type: string
               default_url:
-                description: |-
-                  DefaultURLs backend url for non-matching paths filter
-                  usually used for default backend with error message
                 items:
                   type: string
                 type: array
               disable_secret_creation:
-                description: DisableSecretCreation skips related secret creation for
-                  vmuser
                 type: boolean
               discover_backend_ips:
-                description: DiscoverBackendIPs instructs discovering URLPrefix backend
-                  IPs via DNS.
                 type: boolean
               drop_src_path_prefix_parts:
-                description: |-
-                  DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend.
-                  See [here](https://docs.victoriametrics.com/vmauth#dropping-request-path-prefix) for more details.
                 type: integer
               dump_request_on_errors:
-                description: |-
-                  DumpRequestOnErrors instructs vmauth to return detailed request params to the client
-                  if routing rules don't allow to forward request to the backends.
-                  Useful for debugging `src_hosts` and `src_headers` based routing rules
-
-                  available since v1.107.0 vmauth version
                 type: boolean
               generatePassword:
-                description: |-
-                  GeneratePassword instructs operator to generate password for user
-                  if spec.password if empty.
                 type: boolean
               headers:
-                description: |-
-                  Headers represent additional http headers, that vmauth uses
-                  in form of ["header_key: header_value"]
-                  multiple values for header key:
-                  ["header_key: value1,value2"]
-                  it's available since 1.68.0 version of vmauth
                 items:
                   type: string
                 type: array
               ip_filters:
-                description: |-
-                  IPFilters defines per target src ip filters
-                  supported only with enterprise version of [vmauth](https://docs.victoriametrics.com/vmauth/#ip-filters)
                 properties:
                   allow_list:
                     items:
@@ -31282,91 +36052,58 @@ spec:
                     type: array
                 type: object
               load_balancing_policy:
-                description: |-
-                  LoadBalancingPolicy defines load balancing policy to use for backend urls.
-                  Supported policies: least_loaded, first_available.
-                  See [here](https://docs.victoriametrics.com/vmauth#load-balancing) for more details (default "least_loaded")
                 enum:
                 - least_loaded
                 - first_available
                 type: string
+              managedMetadata:
+                properties:
+                  annotations:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  labels:
+                    additionalProperties:
+                      type: string
+                    type: object
+                type: object
               max_concurrent_requests:
-                description: |-
-                  MaxConcurrentRequests defines max concurrent requests per user
-                  300 is default value for vmauth
                 type: integer
               metric_labels:
                 additionalProperties:
                   type: string
-                description: MetricLabels - additional labels for metrics exported
-                  by vmauth for given user.
                 type: object
               name:
-                description: Name of the VMUser object.
                 type: string
               password:
-                description: Password basic auth password for accessing protected
-                  endpoint.
                 type: string
               passwordRef:
-                description: PasswordRef allows fetching password from user-create
-                  secret by its name and key.
                 properties:
                   key:
-                    description: The key of the secret to select from.  Must be a
-                      valid secret key.
                     type: string
                   name:
                     default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                     type: string
                   optional:
-                    description: Specify whether the Secret or its key must be defined
                     type: boolean
                 required:
                 - key
                 type: object
                 x-kubernetes-map-type: atomic
               response_headers:
-                description: |-
-                  ResponseHeaders represent additional http headers, that vmauth adds for request response
-                  in form of ["header_key: header_value"]
-                  multiple values for header key:
-                  ["header_key: value1,value2"]
-                  it's available since 1.93.0 version of vmauth
                 items:
                   type: string
                 type: array
               retry_status_codes:
-                description: |-
-                  RetryStatusCodes defines http status codes in numeric format for request retries
-                  e.g. [429,503]
                 items:
                   type: integer
                 type: array
               targetRefs:
-                description: TargetRefs - reference to endpoints, which user may access.
                 items:
-                  description: |-
-                    TargetRef describes target for user traffic forwarding.
-                    one of target types can be chosen:
-                    crd or static per targetRef.
-                    user can define multiple targetRefs with different ref Types.
                   properties:
                     crd:
-                      description: |-
-                        CRD describes exist operator's CRD object,
-                        operator generates access url based on CRD params.
                       properties:
                         kind:
-                          description: |-
-                            Kind one of:
-                            VMAgent,VMAlert, VMSingle, VMCluster/vmselect, VMCluster/vmstorage,VMCluster/vminsert  or VMAlertManager
                           enum:
                           - VMAgent
                           - VMAlert
@@ -31377,12 +36114,19 @@ spec:
                           - VMCluster/vmselect
                           - VMCluster/vmstorage
                           - VMCluster/vminsert
+                          - VLSingle
+                          - VLCluster/vlinsert
+                          - VLCluster/vlselect
+                          - VLCluster/vlstorage
+                          - VLAgent
+                          - VTCluster/vtinsert
+                          - VTCluster/vtselect
+                          - VTCluster/vtstorage
+                          - VTSingle
                           type: string
                         name:
-                          description: Name target CRD object name
                           type: string
                         namespace:
-                          description: Namespace target CRD object namespace.
                           type: string
                       required:
                       - kind
@@ -31390,21 +36134,10 @@ spec:
                       - namespace
                       type: object
                     discover_backend_ips:
-                      description: DiscoverBackendIPs instructs discovering URLPrefix
-                        backend IPs via DNS.
                       type: boolean
                     drop_src_path_prefix_parts:
-                      description: |-
-                        DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend.
-                        See [here](https://docs.victoriametrics.com/vmauth#dropping-request-path-prefix) for more details.
                       type: integer
                     headers:
-                      description: |-
-                        RequestHeaders represent additional http headers, that vmauth uses
-                        in form of ["header_key: header_value"]
-                        multiple values for header key:
-                        ["header_key: value1,value2"]
-                        it's available since 1.68.0 version of vmauth
                       items:
                         type: string
                       type: array
@@ -31413,123 +36146,78 @@ spec:
                         type: string
                       type: array
                     load_balancing_policy:
-                      description: |-
-                        LoadBalancingPolicy defines load balancing policy to use for backend urls.
-                        Supported policies: least_loaded, first_available.
-                        See [here](https://docs.victoriametrics.com/vmauth#load-balancing) for more details (default "least_loaded")
                       enum:
                       - least_loaded
                       - first_available
                       type: string
                     paths:
-                      description: Paths - matched path to route.
                       items:
                         type: string
                       type: array
+                    query_args:
+                      items:
+                        properties:
+                          name:
+                            type: string
+                          values:
+                            items:
+                              type: string
+                            type: array
+                        required:
+                        - name
+                        - values
+                        type: object
+                      type: array
                     response_headers:
-                      description: |-
-                        ResponseHeaders represent additional http headers, that vmauth adds for request response
-                        in form of ["header_key: header_value"]
-                        multiple values for header key:
-                        ["header_key: value1,value2"]
-                        it's available since 1.93.0 version of vmauth
                       items:
                         type: string
                       type: array
                     retry_status_codes:
-                      description: |-
-                        RetryStatusCodes defines http status codes in numeric format for request retries
-                        Can be defined per target or at VMUser.spec level
-                        e.g. [429,503]
                       items:
                         type: integer
                       type: array
                     src_headers:
-                      description: SrcHeaders is an optional list of headers, which
-                        must match request headers.
                       items:
                         type: string
                       type: array
                     src_query_args:
-                      description: SrcQueryArgs is an optional list of query args,
-                        which must match request URL query args.
                       items:
                         type: string
                       type: array
                     static:
-                      description: |-
-                        Static - user defined url for traffic forward,
-                        for instance http://vmsingle:8429
                       properties:
                         url:
-                          description: URL http url for given staticRef.
                           type: string
                         urls:
-                          description: URLs allows setting multiple urls for load-balancing
-                            at vmauth-side.
                           items:
                             type: string
                           type: array
                       type: object
                     target_path_suffix:
-                      description: |-
-                        TargetPathSuffix allows to add some suffix to the target path
-                        It allows to hide tenant configuration from user with crd as ref.
-                        it also may contain any url encoded params.
                       type: string
                     targetRefBasicAuth:
-                      description: TargetRefBasicAuth allow an target endpoint to
-                        authenticate over basic authentication
                       properties:
                         password:
-                          description: |-
-                            The secret in the service scrape namespace that contains the password
-                            for authentication.
-                            It must be at them same namespace as CRD
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
                           type: object
                           x-kubernetes-map-type: atomic
                         username:
-                          description: |-
-                            The secret in the service scrape namespace that contains the username
-                            for authentication.
-                            It must be at them same namespace as CRD
                           properties:
                             key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
                               type: string
                             name:
                               default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                               type: string
                             optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
                               type: boolean
                           required:
                           - key
@@ -31542,53 +36230,30 @@ spec:
                   type: object
                 type: array
               tlsConfig:
-                description: TLSConfig defines tls configuration for the backend connection
                 properties:
                   ca:
-                    description: Struct containing the CA cert to use for the targets.
                     properties:
                       configMap:
-                        description: ConfigMap containing data to use for the targets.
                         properties:
                           key:
-                            description: The key to select.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       secret:
-                        description: Secret containing data to use for the targets.
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
@@ -31596,54 +36261,30 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                   caFile:
-                    description: Path to the CA cert in the container to use for the
-                      targets.
                     type: string
                   cert:
-                    description: Struct containing the client cert file for the targets.
                     properties:
                       configMap:
-                        description: ConfigMap containing data to use for the targets.
                         properties:
                           key:
-                            description: The key to select.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
                             type: boolean
                         required:
                         - key
                         type: object
                         x-kubernetes-map-type: atomic
                       secret:
-                        description: Secret containing data to use for the targets.
                         properties:
                           key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
                             type: string
                           name:
                             default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                             type: string
                           optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
                             type: boolean
                         required:
                         - key
@@ -31651,129 +36292,74 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                   certFile:
-                    description: Path to the client cert file in the container for
-                      the targets.
                     type: string
                   insecureSkipVerify:
-                    description: Disable target certificate validation.
                     type: boolean
                   keyFile:
-                    description: Path to the client key file in the container for
-                      the targets.
                     type: string
                   keySecret:
-                    description: Secret containing the client key file for the targets.
                     properties:
                       key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
                         type: string
                       name:
                         default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                         type: string
                       optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
                         type: boolean
                     required:
                     - key
                     type: object
                     x-kubernetes-map-type: atomic
                   serverName:
-                    description: Used to verify the hostname for the targets.
                     type: string
                 type: object
               tokenRef:
-                description: TokenRef allows fetching token from user-created secrets
-                  by its name and key.
                 properties:
                   key:
-                    description: The key of the secret to select from.  Must be a
-                      valid secret key.
                     type: string
                   name:
                     default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                     type: string
                   optional:
-                    description: Specify whether the Secret or its key must be defined
                     type: boolean
                 required:
                 - key
                 type: object
                 x-kubernetes-map-type: atomic
               username:
-                description: |-
-                  UserName basic auth user name for accessing protected endpoint,
-                  will be replaced with metadata.name of VMUser if omitted.
                 type: string
             required:
             - targetRefs
             type: object
           status:
-            description: VMUserStatus defines the observed state of VMUser
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -31788,16 +36374,2507 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: vtclusters.operator.victoriametrics.com
+spec:
+  group: operator.victoriametrics.com
+  names:
+    kind: VTCluster
+    listKind: VTClusterList
+    plural: vtclusters
+    singular: vtcluster
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: replicas of VTInsert
+      jsonPath: .spec.insert.replicaCount
+      name: Insert Count
+      type: string
+    - description: replicas of VTStorage
+      jsonPath: .spec.storage.replicaCount
+      name: Storage Count
+      type: string
+    - description: replicas of VTSelect
+      jsonPath: .spec.select.replicaCount
+      name: Select Count
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: Current status of cluster
+      jsonPath: .status.updateStatus
+      name: Status
+      type: string
+    name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            type: string
+          kind:
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              clusterDomainName:
+                type: string
+              clusterVersion:
+                type: string
+              imagePullSecrets:
+                items:
+                  properties:
+                    name:
+                      default: ""
+                      type: string
+                  type: object
+                  x-kubernetes-map-type: atomic
+                type: array
+              insert:
+                properties:
+                  affinity:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  configMaps:
+                    items:
+                      type: string
+                    type: array
+                  containers:
+                    items:
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  disableAutomountServiceAccountToken:
+                    type: boolean
+                  disableSelfServiceScrape:
+                    type: boolean
+                  dnsConfig:
+                    items:
+                      x-kubernetes-preserve-unknown-fields: true
+                    properties:
+                      nameservers:
+                        items:
+                          type: string
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      options:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                            value:
+                              type: string
+                          type: object
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      searches:
+                        items:
+                          type: string
+                        type: array
+                        x-kubernetes-list-type: atomic
+                    type: object
+                  dnsPolicy:
+                    type: string
+                  extraArgs:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  extraEnvs:
+                    items:
+                      properties:
+                        name:
+                          type: string
+                        value:
+                          type: string
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  extraEnvsFrom:
+                    items:
+                      properties:
+                        configMapRef:
+                          properties:
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        prefix:
+                          type: string
+                        secretRef:
+                          properties:
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          type: object
+                          x-kubernetes-map-type: atomic
+                      type: object
+                    type: array
+                  host_aliases:
+                    items:
+                      properties:
+                        hostnames:
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        ip:
+                          type: string
+                      required:
+                      - ip
+                      type: object
+                    type: array
+                  hostAliases:
+                    items:
+                      properties:
+                        hostnames:
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        ip:
+                          type: string
+                      required:
+                      - ip
+                      type: object
+                    type: array
+                  hostNetwork:
+                    type: boolean
+                  hpa:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  image:
+                    properties:
+                      pullPolicy:
+                        type: string
+                      repository:
+                        type: string
+                      tag:
+                        type: string
+                    type: object
+                  imagePullSecrets:
+                    items:
+                      properties:
+                        name:
+                          default: ""
+                          type: string
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    type: array
+                  initContainers:
+                    items:
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  livenessProbe:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  logFormat:
+                    enum:
+                    - default
+                    - json
+                    type: string
+                  logLevel:
+                    enum:
+                    - INFO
+                    - WARN
+                    - ERROR
+                    - FATAL
+                    - PANIC
+                    type: string
+                  minReadySeconds:
+                    format: int32
+                    type: integer
+                  nodeSelector:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  paused:
+                    type: boolean
+                  podDisruptionBudget:
+                    properties:
+                      maxUnavailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                      minAvailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                      selectorLabels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      unhealthyPodEvictionPolicy:
+                        enum:
+                        - IfHealthyBudget
+                        - AlwaysAllow
+                        type: string
+                    type: object
+                  podMetadata:
+                    properties:
+                      annotations:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      labels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      name:
+                        type: string
+                    type: object
+                  port:
+                    type: string
+                  priorityClassName:
+                    type: string
+                  readinessGates:
+                    items:
+                      properties:
+                        conditionType:
+                          type: string
+                      required:
+                      - conditionType
+                      type: object
+                    type: array
+                  readinessProbe:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  replicaCount:
+                    format: int32
+                    type: integer
+                  resources:
+                    properties:
+                      claims:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                            request:
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                        x-kubernetes-list-map-keys:
+                        - name
+                        x-kubernetes-list-type: map
+                      limits:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        type: object
+                      requests:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        type: object
+                    type: object
+                  revisionHistoryLimitCount:
+                    format: int32
+                    type: integer
+                  rollingUpdate:
+                    properties:
+                      maxSurge:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                      maxUnavailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                    type: object
+                  runtimeClassName:
+                    type: string
+                  schedulerName:
+                    type: string
+                  secrets:
+                    items:
+                      type: string
+                    type: array
+                  securityContext:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  serviceScrapeSpec:
+                    required:
+                    - endpoints
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  serviceSpec:
+                    properties:
+                      metadata:
+                        properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          name:
+                            type: string
+                        type: object
+                      spec:
+                        type: object
+                        x-kubernetes-preserve-unknown-fields: true
+                      useAsDefault:
+                        type: boolean
+                    required:
+                    - spec
+                    type: object
+                  startupProbe:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  terminationGracePeriodSeconds:
+                    format: int64
+                    type: integer
+                  tolerations:
+                    items:
+                      properties:
+                        effect:
+                          type: string
+                        key:
+                          type: string
+                        operator:
+                          type: string
+                        tolerationSeconds:
+                          format: int64
+                          type: integer
+                        value:
+                          type: string
+                      type: object
+                    type: array
+                  topologySpreadConstraints:
+                    items:
+                      required:
+                      - maxSkew
+                      - topologyKey
+                      - whenUnsatisfiable
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  updateStrategy:
+                    enum:
+                    - Recreate
+                    - RollingUpdate
+                    type: string
+                  useDefaultResources:
+                    type: boolean
+                  useStrictSecurity:
+                    type: boolean
+                  volumeMounts:
+                    items:
+                      properties:
+                        mountPath:
+                          type: string
+                        mountPropagation:
+                          type: string
+                        name:
+                          type: string
+                        readOnly:
+                          type: boolean
+                        recursiveReadOnly:
+                          type: string
+                        subPath:
+                          type: string
+                        subPathExpr:
+                          type: string
+                      required:
+                      - mountPath
+                      - name
+                      type: object
+                    type: array
+                  volumes:
+                    items:
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  vpa:
+                    properties:
+                      recommenders:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                      resourcePolicy:
+                        properties:
+                          containerPolicies:
+                            items:
+                              properties:
+                                containerName:
+                                  type: string
+                                controlledResources:
+                                  items:
+                                    type: string
+                                  type: array
+                                controlledValues:
+                                  enum:
+                                  - RequestsAndLimits
+                                  - RequestsOnly
+                                  type: string
+                                maxAllowed:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                minAllowed:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                mode:
+                                  enum:
+                                  - Auto
+                                  - "Off"
+                                  type: string
+                              type: object
+                            type: array
+                        type: object
+                      updatePolicy:
+                        properties:
+                          evictionRequirements:
+                            items:
+                              properties:
+                                changeRequirement:
+                                  enum:
+                                  - TargetHigherThanRequests
+                                  - TargetLowerThanRequests
+                                  type: string
+                                resources:
+                                  items:
+                                    type: string
+                                  type: array
+                              required:
+                              - changeRequirement
+                              - resources
+                              type: object
+                            type: array
+                          minReplicas:
+                            format: int32
+                            type: integer
+                          updateMode:
+                            enum:
+                            - "Off"
+                            - Initial
+                            - Recreate
+                            - InPlaceOrRecreate
+                            - Auto
+                            type: string
+                        type: object
+                    type: object
+                type: object
+              managedMetadata:
+                properties:
+                  annotations:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  labels:
+                    additionalProperties:
+                      type: string
+                    type: object
+                type: object
+              paused:
+                type: boolean
+              requestsLoadBalancer:
+                properties:
+                  disableInsertBalancing:
+                    type: boolean
+                  disableSelectBalancing:
+                    type: boolean
+                  enabled:
+                    type: boolean
+                  spec:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                type: object
+              select:
+                properties:
+                  affinity:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  configMaps:
+                    items:
+                      type: string
+                    type: array
+                  containers:
+                    items:
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  disableAutomountServiceAccountToken:
+                    type: boolean
+                  disableSelfServiceScrape:
+                    type: boolean
+                  dnsConfig:
+                    items:
+                      x-kubernetes-preserve-unknown-fields: true
+                    properties:
+                      nameservers:
+                        items:
+                          type: string
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      options:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                            value:
+                              type: string
+                          type: object
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      searches:
+                        items:
+                          type: string
+                        type: array
+                        x-kubernetes-list-type: atomic
+                    type: object
+                  dnsPolicy:
+                    type: string
+                  extraArgs:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  extraEnvs:
+                    items:
+                      properties:
+                        name:
+                          type: string
+                        value:
+                          type: string
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  extraEnvsFrom:
+                    items:
+                      properties:
+                        configMapRef:
+                          properties:
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        prefix:
+                          type: string
+                        secretRef:
+                          properties:
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          type: object
+                          x-kubernetes-map-type: atomic
+                      type: object
+                    type: array
+                  extraStorageNodes:
+                    items:
+                      properties:
+                        addr:
+                          type: string
+                      required:
+                      - addr
+                      type: object
+                    type: array
+                  host_aliases:
+                    items:
+                      properties:
+                        hostnames:
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        ip:
+                          type: string
+                      required:
+                      - ip
+                      type: object
+                    type: array
+                  hostAliases:
+                    items:
+                      properties:
+                        hostnames:
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        ip:
+                          type: string
+                      required:
+                      - ip
+                      type: object
+                    type: array
+                  hostNetwork:
+                    type: boolean
+                  hpa:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  image:
+                    properties:
+                      pullPolicy:
+                        type: string
+                      repository:
+                        type: string
+                      tag:
+                        type: string
+                    type: object
+                  imagePullSecrets:
+                    items:
+                      properties:
+                        name:
+                          default: ""
+                          type: string
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    type: array
+                  initContainers:
+                    items:
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  livenessProbe:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  logFormat:
+                    enum:
+                    - default
+                    - json
+                    type: string
+                  logLevel:
+                    enum:
+                    - INFO
+                    - WARN
+                    - ERROR
+                    - FATAL
+                    - PANIC
+                    type: string
+                  minReadySeconds:
+                    format: int32
+                    type: integer
+                  nodeSelector:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  paused:
+                    type: boolean
+                  podDisruptionBudget:
+                    properties:
+                      maxUnavailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                      minAvailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                      selectorLabels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      unhealthyPodEvictionPolicy:
+                        enum:
+                        - IfHealthyBudget
+                        - AlwaysAllow
+                        type: string
+                    type: object
+                  podMetadata:
+                    properties:
+                      annotations:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      labels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      name:
+                        type: string
+                    type: object
+                  port:
+                    type: string
+                  priorityClassName:
+                    type: string
+                  readinessGates:
+                    items:
+                      properties:
+                        conditionType:
+                          type: string
+                      required:
+                      - conditionType
+                      type: object
+                    type: array
+                  readinessProbe:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  replicaCount:
+                    format: int32
+                    type: integer
+                  resources:
+                    properties:
+                      claims:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                            request:
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                        x-kubernetes-list-map-keys:
+                        - name
+                        x-kubernetes-list-type: map
+                      limits:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        type: object
+                      requests:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        type: object
+                    type: object
+                  revisionHistoryLimitCount:
+                    format: int32
+                    type: integer
+                  rollingUpdate:
+                    properties:
+                      maxSurge:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                      maxUnavailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                    type: object
+                  runtimeClassName:
+                    type: string
+                  schedulerName:
+                    type: string
+                  secrets:
+                    items:
+                      type: string
+                    type: array
+                  securityContext:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  serviceScrapeSpec:
+                    required:
+                    - endpoints
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  serviceSpec:
+                    properties:
+                      metadata:
+                        properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          name:
+                            type: string
+                        type: object
+                      spec:
+                        type: object
+                        x-kubernetes-preserve-unknown-fields: true
+                      useAsDefault:
+                        type: boolean
+                    required:
+                    - spec
+                    type: object
+                  startupProbe:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  terminationGracePeriodSeconds:
+                    format: int64
+                    type: integer
+                  tolerations:
+                    items:
+                      properties:
+                        effect:
+                          type: string
+                        key:
+                          type: string
+                        operator:
+                          type: string
+                        tolerationSeconds:
+                          format: int64
+                          type: integer
+                        value:
+                          type: string
+                      type: object
+                    type: array
+                  topologySpreadConstraints:
+                    items:
+                      required:
+                      - maxSkew
+                      - topologyKey
+                      - whenUnsatisfiable
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  updateStrategy:
+                    enum:
+                    - Recreate
+                    - RollingUpdate
+                    type: string
+                  useDefaultResources:
+                    type: boolean
+                  useStrictSecurity:
+                    type: boolean
+                  volumeMounts:
+                    items:
+                      properties:
+                        mountPath:
+                          type: string
+                        mountPropagation:
+                          type: string
+                        name:
+                          type: string
+                        readOnly:
+                          type: boolean
+                        recursiveReadOnly:
+                          type: string
+                        subPath:
+                          type: string
+                        subPathExpr:
+                          type: string
+                      required:
+                      - mountPath
+                      - name
+                      type: object
+                    type: array
+                  volumes:
+                    items:
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  vpa:
+                    properties:
+                      recommenders:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                      resourcePolicy:
+                        properties:
+                          containerPolicies:
+                            items:
+                              properties:
+                                containerName:
+                                  type: string
+                                controlledResources:
+                                  items:
+                                    type: string
+                                  type: array
+                                controlledValues:
+                                  enum:
+                                  - RequestsAndLimits
+                                  - RequestsOnly
+                                  type: string
+                                maxAllowed:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                minAllowed:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                mode:
+                                  enum:
+                                  - Auto
+                                  - "Off"
+                                  type: string
+                              type: object
+                            type: array
+                        type: object
+                      updatePolicy:
+                        properties:
+                          evictionRequirements:
+                            items:
+                              properties:
+                                changeRequirement:
+                                  enum:
+                                  - TargetHigherThanRequests
+                                  - TargetLowerThanRequests
+                                  type: string
+                                resources:
+                                  items:
+                                    type: string
+                                  type: array
+                              required:
+                              - changeRequirement
+                              - resources
+                              type: object
+                            type: array
+                          minReplicas:
+                            format: int32
+                            type: integer
+                          updateMode:
+                            enum:
+                            - "Off"
+                            - Initial
+                            - Recreate
+                            - InPlaceOrRecreate
+                            - Auto
+                            type: string
+                        type: object
+                    type: object
+                type: object
+              serviceAccountName:
+                type: string
+              storage:
+                properties:
+                  affinity:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  claimTemplates:
+                    items:
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  configMaps:
+                    items:
+                      type: string
+                    type: array
+                  containers:
+                    items:
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  disableAutomountServiceAccountToken:
+                    type: boolean
+                  disableSelfServiceScrape:
+                    type: boolean
+                  dnsConfig:
+                    items:
+                      x-kubernetes-preserve-unknown-fields: true
+                    properties:
+                      nameservers:
+                        items:
+                          type: string
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      options:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                            value:
+                              type: string
+                          type: object
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      searches:
+                        items:
+                          type: string
+                        type: array
+                        x-kubernetes-list-type: atomic
+                    type: object
+                  dnsPolicy:
+                    type: string
+                  extraArgs:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  extraEnvs:
+                    items:
+                      properties:
+                        name:
+                          type: string
+                        value:
+                          type: string
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  extraEnvsFrom:
+                    items:
+                      properties:
+                        configMapRef:
+                          properties:
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        prefix:
+                          type: string
+                        secretRef:
+                          properties:
+                            name:
+                              default: ""
+                              type: string
+                            optional:
+                              type: boolean
+                          type: object
+                          x-kubernetes-map-type: atomic
+                      type: object
+                    type: array
+                  futureRetention:
+                    pattern: ^[0-9]+(h|d|w|y)?$
+                    type: string
+                  host_aliases:
+                    items:
+                      properties:
+                        hostnames:
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        ip:
+                          type: string
+                      required:
+                      - ip
+                      type: object
+                    type: array
+                  hostAliases:
+                    items:
+                      properties:
+                        hostnames:
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        ip:
+                          type: string
+                      required:
+                      - ip
+                      type: object
+                    type: array
+                  hostNetwork:
+                    type: boolean
+                  hpa:
+                    properties:
+                      behaviour:
+                        properties:
+                          scaleDown:
+                            properties:
+                              policies:
+                                items:
+                                  properties:
+                                    periodSeconds:
+                                      format: int32
+                                      type: integer
+                                    type:
+                                      type: string
+                                    value:
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - periodSeconds
+                                  - type
+                                  - value
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              selectPolicy:
+                                type: string
+                              stabilizationWindowSeconds:
+                                format: int32
+                                type: integer
+                              tolerance:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                x-kubernetes-int-or-string: true
+                            type: object
+                          scaleUp:
+                            properties:
+                              policies:
+                                items:
+                                  properties:
+                                    periodSeconds:
+                                      format: int32
+                                      type: integer
+                                    type:
+                                      type: string
+                                    value:
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - periodSeconds
+                                  - type
+                                  - value
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              selectPolicy:
+                                type: string
+                              stabilizationWindowSeconds:
+                                format: int32
+                                type: integer
+                              tolerance:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                x-kubernetes-int-or-string: true
+                            type: object
+                        type: object
+                      maxReplicas:
+                        format: int32
+                        type: integer
+                      metrics:
+                        items:
+                          properties:
+                            containerResource:
+                              properties:
+                                container:
+                                  type: string
+                                name:
+                                  type: string
+                                target:
+                                  properties:
+                                    averageUtilization:
+                                      format: int32
+                                      type: integer
+                                    averageValue:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                    type:
+                                      type: string
+                                    value:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - type
+                                  type: object
+                              required:
+                              - container
+                              - name
+                              - target
+                              type: object
+                            external:
+                              properties:
+                                metric:
+                                  properties:
+                                    name:
+                                      type: string
+                                    selector:
+                                      properties:
+                                        matchExpressions:
+                                          items:
+                                            properties:
+                                              key:
+                                                type: string
+                                              operator:
+                                                type: string
+                                              values:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                  required:
+                                  - name
+                                  type: object
+                                target:
+                                  properties:
+                                    averageUtilization:
+                                      format: int32
+                                      type: integer
+                                    averageValue:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                    type:
+                                      type: string
+                                    value:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - type
+                                  type: object
+                              required:
+                              - metric
+                              - target
+                              type: object
+                            object:
+                              properties:
+                                describedObject:
+                                  properties:
+                                    apiVersion:
+                                      type: string
+                                    kind:
+                                      type: string
+                                    name:
+                                      type: string
+                                  required:
+                                  - kind
+                                  - name
+                                  type: object
+                                metric:
+                                  properties:
+                                    name:
+                                      type: string
+                                    selector:
+                                      properties:
+                                        matchExpressions:
+                                          items:
+                                            properties:
+                                              key:
+                                                type: string
+                                              operator:
+                                                type: string
+                                              values:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                  required:
+                                  - name
+                                  type: object
+                                target:
+                                  properties:
+                                    averageUtilization:
+                                      format: int32
+                                      type: integer
+                                    averageValue:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                    type:
+                                      type: string
+                                    value:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - type
+                                  type: object
+                              required:
+                              - describedObject
+                              - metric
+                              - target
+                              type: object
+                            pods:
+                              properties:
+                                metric:
+                                  properties:
+                                    name:
+                                      type: string
+                                    selector:
+                                      properties:
+                                        matchExpressions:
+                                          items:
+                                            properties:
+                                              key:
+                                                type: string
+                                              operator:
+                                                type: string
+                                              values:
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                  required:
+                                  - name
+                                  type: object
+                                target:
+                                  properties:
+                                    averageUtilization:
+                                      format: int32
+                                      type: integer
+                                    averageValue:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                    type:
+                                      type: string
+                                    value:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - type
+                                  type: object
+                              required:
+                              - metric
+                              - target
+                              type: object
+                            resource:
+                              properties:
+                                name:
+                                  type: string
+                                target:
+                                  properties:
+                                    averageUtilization:
+                                      format: int32
+                                      type: integer
+                                    averageValue:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                    type:
+                                      type: string
+                                    value:
+                                      anyOf:
+                                      - type: integer
+                                      - type: string
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      x-kubernetes-int-or-string: true
+                                  required:
+                                  - type
+                                  type: object
+                              required:
+                              - name
+                              - target
+                              type: object
+                            type:
+                              type: string
+                          required:
+                          - type
+                          type: object
+                        type: array
+                      minReplicas:
+                        format: int32
+                        type: integer
+                    type: object
+                  image:
+                    properties:
+                      pullPolicy:
+                        type: string
+                      repository:
+                        type: string
+                      tag:
+                        type: string
+                    type: object
+                  imagePullSecrets:
+                    items:
+                      properties:
+                        name:
+                          default: ""
+                          type: string
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    type: array
+                  initContainers:
+                    items:
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  livenessProbe:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  logFormat:
+                    enum:
+                    - default
+                    - json
+                    type: string
+                  logIngestedRows:
+                    type: boolean
+                  logLevel:
+                    enum:
+                    - INFO
+                    - WARN
+                    - ERROR
+                    - FATAL
+                    - PANIC
+                    type: string
+                  logNewStreams:
+                    type: boolean
+                  maintenanceInsertNodeIDs:
+                    items:
+                      format: int32
+                      type: integer
+                    type: array
+                  maintenanceSelectNodeIDs:
+                    items:
+                      format: int32
+                      type: integer
+                    type: array
+                  minReadySeconds:
+                    format: int32
+                    type: integer
+                  nodeSelector:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  paused:
+                    type: boolean
+                  persistentVolumeClaimRetentionPolicy:
+                    properties:
+                      whenDeleted:
+                        type: string
+                      whenScaled:
+                        type: string
+                    type: object
+                  podDisruptionBudget:
+                    properties:
+                      maxUnavailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                      minAvailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                      selectorLabels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      unhealthyPodEvictionPolicy:
+                        enum:
+                        - IfHealthyBudget
+                        - AlwaysAllow
+                        type: string
+                    type: object
+                  podMetadata:
+                    properties:
+                      annotations:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      labels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      name:
+                        type: string
+                    type: object
+                  port:
+                    type: string
+                  priorityClassName:
+                    type: string
+                  readinessGates:
+                    items:
+                      properties:
+                        conditionType:
+                          type: string
+                      required:
+                      - conditionType
+                      type: object
+                    type: array
+                  readinessProbe:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  replicaCount:
+                    format: int32
+                    type: integer
+                  resources:
+                    properties:
+                      claims:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                            request:
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                        x-kubernetes-list-map-keys:
+                        - name
+                        x-kubernetes-list-type: map
+                      limits:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        type: object
+                      requests:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        type: object
+                    type: object
+                  retentionMaxDiskSpaceUsageBytes:
+                    type: string
+                  retentionPeriod:
+                    pattern: ^[0-9]+(h|d|w|y)?$
+                    type: string
+                  revisionHistoryLimitCount:
+                    format: int32
+                    type: integer
+                  rollingUpdateStrategy:
+                    type: string
+                  rollingUpdateStrategyBehavior:
+                    properties:
+                      maxUnavailable:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                    type: object
+                  runtimeClassName:
+                    type: string
+                  schedulerName:
+                    type: string
+                  secrets:
+                    items:
+                      type: string
+                    type: array
+                  securityContext:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  serviceScrapeSpec:
+                    required:
+                    - endpoints
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  serviceSpec:
+                    properties:
+                      metadata:
+                        properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          labels:
+                            additionalProperties:
+                              type: string
+                            type: object
+                          name:
+                            type: string
+                        type: object
+                      spec:
+                        type: object
+                        x-kubernetes-preserve-unknown-fields: true
+                      useAsDefault:
+                        type: boolean
+                    required:
+                    - spec
+                    type: object
+                  startupProbe:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  storage:
+                    properties:
+                      emptyDir:
+                        properties:
+                          medium:
+                            type: string
+                          sizeLimit:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                            x-kubernetes-int-or-string: true
+                        type: object
+                      volumeClaimTemplate:
+                        type: object
+                        x-kubernetes-preserve-unknown-fields: true
+                    type: object
+                  storageDataPath:
+                    type: string
+                  terminationGracePeriodSeconds:
+                    format: int64
+                    type: integer
+                  tolerations:
+                    items:
+                      properties:
+                        effect:
+                          type: string
+                        key:
+                          type: string
+                        operator:
+                          type: string
+                        tolerationSeconds:
+                          format: int64
+                          type: integer
+                        value:
+                          type: string
+                      type: object
+                    type: array
+                  topologySpreadConstraints:
+                    items:
+                      required:
+                      - maxSkew
+                      - topologyKey
+                      - whenUnsatisfiable
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  useDefaultResources:
+                    type: boolean
+                  useStrictSecurity:
+                    type: boolean
+                  volumeMounts:
+                    items:
+                      properties:
+                        mountPath:
+                          type: string
+                        mountPropagation:
+                          type: string
+                        name:
+                          type: string
+                        readOnly:
+                          type: boolean
+                        recursiveReadOnly:
+                          type: string
+                        subPath:
+                          type: string
+                        subPathExpr:
+                          type: string
+                      required:
+                      - mountPath
+                      - name
+                      type: object
+                    type: array
+                  volumes:
+                    items:
+                      required:
+                      - name
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    type: array
+                  vpa:
+                    properties:
+                      recommenders:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                      resourcePolicy:
+                        properties:
+                          containerPolicies:
+                            items:
+                              properties:
+                                containerName:
+                                  type: string
+                                controlledResources:
+                                  items:
+                                    type: string
+                                  type: array
+                                controlledValues:
+                                  enum:
+                                  - RequestsAndLimits
+                                  - RequestsOnly
+                                  type: string
+                                maxAllowed:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                minAllowed:
+                                  additionalProperties:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    x-kubernetes-int-or-string: true
+                                  type: object
+                                mode:
+                                  enum:
+                                  - Auto
+                                  - "Off"
+                                  type: string
+                              type: object
+                            type: array
+                        type: object
+                      updatePolicy:
+                        properties:
+                          evictionRequirements:
+                            items:
+                              properties:
+                                changeRequirement:
+                                  enum:
+                                  - TargetHigherThanRequests
+                                  - TargetLowerThanRequests
+                                  type: string
+                                resources:
+                                  items:
+                                    type: string
+                                  type: array
+                              required:
+                              - changeRequirement
+                              - resources
+                              type: object
+                            type: array
+                          minReplicas:
+                            format: int32
+                            type: integer
+                          updateMode:
+                            enum:
+                            - "Off"
+                            - Initial
+                            - Recreate
+                            - InPlaceOrRecreate
+                            - Auto
+                            type: string
+                        type: object
+                    type: object
+                type: object
+              useStrictSecurity:
+                type: boolean
+            type: object
+          status:
+            properties:
+              conditions:
+                items:
+                  properties:
+                    lastTransitionTime:
+                      format: date-time
+                      type: string
+                    lastUpdateTime:
+                      format: date-time
+                      type: string
+                    message:
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      maxLength: 1024
+                      minLength: 1
+                      type: string
+                    status:
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      maxLength: 316
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - lastUpdateTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              observedGeneration:
+                format: int64
+                type: integer
+              reason:
+                type: string
+              updateStatus:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: vtsingles.operator.victoriametrics.com
+spec:
+  group: operator.victoriametrics.com
+  names:
+    kind: VTSingle
+    listKind: VTSingleList
+    plural: vtsingles
+    singular: vtsingle
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: Current status of traces instance update process
+      jsonPath: .status.status
+      name: Status
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            type: string
+          kind:
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              affinity:
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              configMaps:
+                items:
+                  type: string
+                type: array
+              containers:
+                items:
+                  required:
+                  - name
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                type: array
+              disableAutomountServiceAccountToken:
+                type: boolean
+              disableSelfServiceScrape:
+                type: boolean
+              dnsConfig:
+                items:
+                  x-kubernetes-preserve-unknown-fields: true
+                properties:
+                  nameservers:
+                    items:
+                      type: string
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  options:
+                    items:
+                      properties:
+                        name:
+                          type: string
+                        value:
+                          type: string
+                      type: object
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  searches:
+                    items:
+                      type: string
+                    type: array
+                    x-kubernetes-list-type: atomic
+                type: object
+              dnsPolicy:
+                type: string
+              extraArgs:
+                additionalProperties:
+                  type: string
+                type: object
+              extraEnvs:
+                items:
+                  properties:
+                    name:
+                      type: string
+                    value:
+                      type: string
+                  required:
+                  - name
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                type: array
+              extraEnvsFrom:
+                items:
+                  properties:
+                    configMapRef:
+                      properties:
+                        name:
+                          default: ""
+                          type: string
+                        optional:
+                          type: boolean
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    prefix:
+                      type: string
+                    secretRef:
+                      properties:
+                        name:
+                          default: ""
+                          type: string
+                        optional:
+                          type: boolean
+                      type: object
+                      x-kubernetes-map-type: atomic
+                  type: object
+                type: array
+              futureRetention:
+                pattern: ^[0-9]+(h|d|y)?$
+                type: string
+              host_aliases:
+                items:
+                  properties:
+                    hostnames:
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    ip:
+                      type: string
+                  required:
+                  - ip
+                  type: object
+                type: array
+              hostAliases:
+                items:
+                  properties:
+                    hostnames:
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    ip:
+                      type: string
+                  required:
+                  - ip
+                  type: object
+                type: array
+              hostNetwork:
+                type: boolean
+              image:
+                properties:
+                  pullPolicy:
+                    type: string
+                  repository:
+                    type: string
+                  tag:
+                    type: string
+                type: object
+              imagePullSecrets:
+                items:
+                  properties:
+                    name:
+                      default: ""
+                      type: string
+                  type: object
+                  x-kubernetes-map-type: atomic
+                type: array
+              initContainers:
+                items:
+                  required:
+                  - name
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                type: array
+              livenessProbe:
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              logFormat:
+                enum:
+                - default
+                - json
+                type: string
+              logIngestedRows:
+                type: boolean
+              logLevel:
+                enum:
+                - INFO
+                - WARN
+                - ERROR
+                - FATAL
+                - PANIC
+                type: string
+              logNewStreams:
+                type: boolean
+              managedMetadata:
+                properties:
+                  annotations:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  labels:
+                    additionalProperties:
+                      type: string
+                    type: object
+                type: object
+              minReadySeconds:
+                format: int32
+                type: integer
+              nodeSelector:
+                additionalProperties:
+                  type: string
+                type: object
+              paused:
+                type: boolean
+              podMetadata:
+                properties:
+                  annotations:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  labels:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  name:
+                    type: string
+                type: object
+              port:
+                type: string
+              priorityClassName:
+                type: string
+              readinessGates:
+                items:
+                  properties:
+                    conditionType:
+                      type: string
+                  required:
+                  - conditionType
+                  type: object
+                type: array
+              readinessProbe:
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              replicaCount:
+                format: int32
+                type: integer
+              resources:
+                properties:
+                  claims:
+                    items:
+                      properties:
+                        name:
+                          type: string
+                        request:
+                          type: string
+                      required:
+                      - name
+                      type: object
+                    type: array
+                    x-kubernetes-list-map-keys:
+                    - name
+                    x-kubernetes-list-type: map
+                  limits:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    type: object
+                  requests:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    type: object
+                type: object
+              retentionMaxDiskSpaceUsageBytes:
+                type: string
+              retentionPeriod:
+                pattern: ^[0-9]+(h|d|w|y)?$
+                type: string
+              revisionHistoryLimitCount:
+                format: int32
+                type: integer
+              runtimeClassName:
+                type: string
+              schedulerName:
+                type: string
+              secrets:
+                items:
+                  type: string
+                type: array
+              securityContext:
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              serviceAccountName:
+                type: string
+              serviceScrapeSpec:
+                required:
+                - endpoints
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              serviceSpec:
+                properties:
+                  metadata:
+                    properties:
+                      annotations:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      labels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      name:
+                        type: string
+                    type: object
+                  spec:
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  useAsDefault:
+                    type: boolean
+                required:
+                - spec
+                type: object
+              startupProbe:
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              storage:
+                properties:
+                  accessModes:
+                    items:
+                      type: string
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  dataSource:
+                    properties:
+                      apiGroup:
+                        type: string
+                      kind:
+                        type: string
+                      name:
+                        type: string
+                    required:
+                    - kind
+                    - name
+                    type: object
+                    x-kubernetes-map-type: atomic
+                  dataSourceRef:
+                    properties:
+                      apiGroup:
+                        type: string
+                      kind:
+                        type: string
+                      name:
+                        type: string
+                      namespace:
+                        type: string
+                    required:
+                    - kind
+                    - name
+                    type: object
+                  resources:
+                    properties:
+                      limits:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        type: object
+                      requests:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        type: object
+                    type: object
+                  selector:
+                    properties:
+                      matchExpressions:
+                        items:
+                          properties:
+                            key:
+                              type: string
+                            operator:
+                              type: string
+                            values:
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                          required:
+                          - key
+                          - operator
+                          type: object
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      matchLabels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                    type: object
+                    x-kubernetes-map-type: atomic
+                  storageClassName:
+                    type: string
+                  volumeAttributesClassName:
+                    type: string
+                  volumeMode:
+                    type: string
+                  volumeName:
+                    type: string
+                type: object
+              storageDataPath:
+                type: string
+              storageMetadata:
+                properties:
+                  annotations:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  labels:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  name:
+                    type: string
+                type: object
+              terminationGracePeriodSeconds:
+                format: int64
+                type: integer
+              tolerations:
+                items:
+                  properties:
+                    effect:
+                      type: string
+                    key:
+                      type: string
+                    operator:
+                      type: string
+                    tolerationSeconds:
+                      format: int64
+                      type: integer
+                    value:
+                      type: string
+                  type: object
+                type: array
+              topologySpreadConstraints:
+                items:
+                  required:
+                  - maxSkew
+                  - topologyKey
+                  - whenUnsatisfiable
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                type: array
+              useDefaultResources:
+                type: boolean
+              useStrictSecurity:
+                type: boolean
+              volumeMounts:
+                items:
+                  properties:
+                    mountPath:
+                      type: string
+                    mountPropagation:
+                      type: string
+                    name:
+                      type: string
+                    readOnly:
+                      type: boolean
+                    recursiveReadOnly:
+                      type: string
+                    subPath:
+                      type: string
+                    subPathExpr:
+                      type: string
+                  required:
+                  - mountPath
+                  - name
+                  type: object
+                type: array
+              volumes:
+                items:
+                  required:
+                  - name
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                type: array
+            type: object
+          status:
+            properties:
+              conditions:
+                items:
+                  properties:
+                    lastTransitionTime:
+                      format: date-time
+                      type: string
+                    lastUpdateTime:
+                      format: date-time
+                      type: string
+                    message:
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      maxLength: 1024
+                      minLength: 1
+                      type: string
+                    status:
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      maxLength: 316
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - lastUpdateTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              observedGeneration:
+                format: int64
+                type: integer
+              reason:
+                type: string
+              updateStatus:
                 type: string
             type: object
         type: object
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/files/crd.yaml.bz2 b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/files/crd.yaml.bz2
new file mode 100644
index 0000000000000000000000000000000000000000..7f518a91e11a4af367dd2ff450bc953ddc650964
GIT binary patch
literal 27612
zcmV)9K*hg8T4*^jL0KkKSzvNV*8;Kh|A19hRaI60|M0)>|Np=L|NdaJ-O%RJnz!4#
zT6Y}+hjX|M&8Yg`W7lHYXja{6$7w0sTaHlEv6r?$71oTREYDQcDniwUxipt;)iQR>
zO&Pnc(bbu=dv{<s8n~gRhgiF9sb6^dHQBv^pg8yd^4Yb7@TTS}zP)s!ZS>-bb_cHG
z1p?aM_k+&beE?_@P^A>LK0bHdwcTxf=J#i}z2|*y_Yb$<ci%g1-#OlQ9QVC^_UY2y
zUn||5^d9$Y?al6L04v+pZ7v71*O=N?Uit3#wkT__y}kF3U7Ga!?(5N&_cxA}_kd^x
zNnVw&S2J&I3tfG6;dK)3JU#B*+uYKMtAw@Jc=rzW_Pdxj*WSy_%Y6*q_gvOJa*g(K
zuJ*KRvo0HluX?L}dwJh{40m_Ed)^)QkEh=sLwBX_+TxwD>nM!wIyJL28MOxP&TW=y
zx6hvU)O>9~_V<0Xd^+`g?RUT(0(7;VlUX@^@$a#S^{%uD00^C{cgG>=rkmS)&B||W
z=np&sO<P_$t7~_APkZa@bLr#Dp6|Y4pH$Y`0=1^14UJAa?{RwfH$C@`m#z1APVP=R
z$J%L(UhqXk001Bnks4?OYBXV`Ge@dz4N-~cfEoh`kc2@9K!H&8F{C`82dE7LO*W%X
zQ$PS{&=NHg6o99s(LA8@QUCx4r~m^%01XC!AxMybnFdJ6O+6{6lPQHgO+7Ua)YRHN
zDWlZeQ%xWMXcJVDOh$w<PbEJ|p`#({N2uBgPid-br>ClEkbbCW&<Ci~$^|JA1QQ_{
zGz7_}L`>19gwV()o(c^#3=n8OuMiOP1XfT`e{=N@{T$EVnW!{TNY(`-WHJUxA@?^v
z<{aO<{qOg79J31qt0M%tDt#)Fr$zhV=PAIcygFv0i%WxaZ~H1~!WagB>V|fR(@hJ>
zQ){US6Ohxe14E1_@ra12G^yGuV1ddg4JpKmcR8#sYT~7;UX5tI@VnJqx;n2p(5VP>
zDS4EV;Zg0vrelE>C0v0GON|DDAX2GZ28}z^jD@X%U@xPgsB$+^QW&QMY@T_NLYzk#
ztea%88HVe&2Ga^Sy1u7v%FV5?<vat16|zLgJ44HWIb5D@w`?&rhWZ0SY~^m*I-NjZ
zO;Swpp&KTIaR$km1F0c<((>~}I>9dt>XrvihL@`vS;AwS$1Xc5rKM;QjAt_?fKnRZ
zTeDO`Um!<KnYe+#Hm6w&OzU@f*He~kX0wx(9yY?6awel{Wv!50!kVPrK)E6tCWwL}
z)McpHIynBMKHxuV-1dR}Kd=mZ@Ak%p&iuW2J#SxN+&lKr>18kZ<siMtKvE$PcpNDS
z+CNYX4NRg-78U|FMJoXSJ`fd0Di~80HBl6Vc<(g{v?L}0<|sesL;95>g)Ab{6np>M
zPl6piw?Sc-h;D@6UuJ~j$O_#FQOb=tx@9uj2e(dV1KD9gUjT3|y@L5(A=XSd-en~*
zK@c_C2zQ|>JD2i9{KN-9KU>6kPQ*@JoKVUCYnU#fL#3C1v@Zco$!ex4@{Fj}Bs^6V
zsS5uh9+fTP9H0h7i|r{WH(^0_Z6k4y%U7*+tTDok79?@`oP(9SG-Z(v7Qtg0h-nNd
z-h)#ng|IIOVGN5oz==*gdRUp3(FjH6A$*i@qcMr9LTSU6hFDQ<0}+8@<cK*(=#2qp
zwuNZf1e%3Yq)w4A%+(v}rSZlNKqeMCE<}<<bS{CnX3(Qm5IBU>OuO0}2t<ICrV4>=
zv?R;nq&SA;;Fe+$4kHlM5j2Dnu1i+Xp)TCzZEr7dHbllm$QB)$0c;v$q#&9@c)`Ge
z8!txMK-|!6ru5`OxJ<k%6x3U`=**_gns|mGq2F%5=IA*yxgJgU5UYVc`_;Ua3zUbA
z6=|7BS^)v7MLZ%oW>Dm`yA5jqjTF~n6K@J&lK`Cva2RndMp1o9?@fo!nLAICXkQQg
zy*AG2sGKZ|3`emURGxlKS)47xr@o<S3!u<K4kV5nkUi9ZYHu}iVOwh<h^DVtP~e8~
zSlfaa0s(Uc@+_bjsmy}Hin>wUY5#(Sq#_z614mYcgQkvY>n}Q*hy<oejM$TRmm_F!
ztq7sCB7wWfKuWEag{pA~El3$QEZRB{DPkKdbkn+O*a5hyU=UeB8dSi5oQN7GE0>mG
zJW+E~HdT>2V7I*(wP><1$kNj(XED7H7TR}%AyAc;NhzeDkdTqUWJw7O=m>|zR7ENC
zW&(c%Hu>RP3%e8X975CbiB>7)Sp~xJu{DW#W1I^)4QVu3XmJMd-u89CE=$l*F@lu&
zWI#KJbeS5kysV+{SykheK1_U=En~?(t8KiqYbgF{V_64A9N|}wNvS-V&t_tJN2cyG
zR|vp2Ez)y|whc0+m6YAkErt2}I`;LsK0aH#zTcB)B4doBp1)4-mF?y6;3qlX85s+V
z_er9!;<q55q7;kJE%6IPPsBe3JZ(^>5d^~mi48D4xgpKt!s~Op7*1(=Ct64v<ut_D
zK$j-5x~Oo@NI5t*(@Nhk#=MhO?b^Cnp}Ql(WNq@%$&udXH-BFf>8Y1*6PFb~vr;&Q
zT+=TNcgeCh8my@IXh!3@-LS+3?5ZVI!><t7Xjv?#vNptZlcKe9<~2=XwFra|$~1)Q
zMb&C%fhMlFh7T_wN(w@f6N8p&PJ7OqFsdkks>>=FUC0>fOa$RT)$dg77ZC0n5bWgj
z$r%O(2V&|m170E8+&9gI8=0_&s?~l(uM>sCUttPQl4(h;Aq~{xO@{kkF^Rm?X*@gE
zSxl4c{c4z@_s7d1>=_QLoS<`5iBeHLU$IjV%TNwO?qNJ-4}G{<XWgnaz|1|n)Oys&
zyzxZxcza>Ur6Km<ed%x|Y~Wb*BWRr3iJ+M?5o04?i}7(y`?UBy`s(LL$n`!);^WsY
znbm?m&!3IN_mQTlPkFOZI!(<hRQKVO-l?tT+KtAeQqhWPK9dIqd)!Fyx@(=|8cr(`
zg)<6Ag*2h5q`ZYfibr}Njzu})rDSB9ElW%|ZKG*~kcEUQQcx%@=R=2p=g3vU-6^p#
zG?Ik16*S@+(3T{)i;5CNTXGHs%L4+=QXSk32+kovfoM4t!8nB>a2UXgsYF(oA!H^(
zLz;kgiSEqWJca7z(T#KrsYMb!<pNZ|fR_u}I6`@tj^Jx`amuM4Zl%*9x$BcU#4!q}
zG)~wVg2#ZrEDyRc8)P0Y$5r|nDeyykY&+shGF|*0IY*pjOXOuv1n8b1bu!G2GR;2z
z_T(K8c%%qrnW`UYgtkErUgjL-CcHD|&<@0U>cvfl1s)(Na-_t#C%)~tBW?7{476Me
zkf4Ff0^#+-oCA46Lk67dw{qOxT^I)DacVV?xk}5_jcW8BFt$kU6IC@_&D@A<bYAVc
zy&w%<tQC|R(hyx+I%sg|aIi2t4#fCgxcO<{$$^_~rrKwy&!)th;GfOKd_Y$KHq`2>
z0={L~SYJ>^!}NEzlp2Ymc35P<6k&CmL#A+bp_om|!Z!02a7|Ga5R^j-2KAwq;^oWC
zyS>J9h3hB@#Be!9@`*JKYh|gkH&L*T(4;Vp)Tcu7YnutYYzAm>Hd7|#$_%@Ral@QX
z5X6xbS};Qb0C}JfPQmlXYqz(@TMZaYo!lATIoAgA(Y$YGqoYSmP7ZZ18*$d2NzRhw
z#<4b-S~%7oPbk4X`BPa7=ZGzYRAc}rR3=4S052>CqNIul^Ry>jC!4z}c!&}O!I@nM
z*)GROF38?Sw;xy4!*SyuSJfPG^wm$Izgd1D3t&LrQWvTc1QhxZ$^c!FkIN|eB^Faq
zK=_F=WfqFx(W2x4(f2GjH!y~P7}+Hlm%SEVtgR}Ek+O<_PCBx}8VE**OS5{`@VZ{R
zhh$Kz0zn}rF@jJqaF)SDvC>9`vvFvcRbr?Rr=6QP>$Yr28_=m>R2*QKom4u*3emU#
zGl<N{gF1W+FufZFP&i{YV(#2+f+7Z}4q22?krfn%;W8wpkb<1K^Fbb<pI$i>;t^%;
z%{1wY3`3dIkYrtOU8L&lB+RgZ3}F}n<HaFs5IqKpH4Sfze4wfrWZqz3AW3042%~{3
zxPmktOU3O7B!l9FUT{6t9KAcXs$O~+UHFk^TV))xmBXt;;s9IrH}jTvQ6m7s9@k1Q
zcU2&jFrD|Go_WWore+-5S+4EcO!MJWB{d+Yd>Fy0;e*OU-6wEYRwpuKEpL|~f9X%%
z2>8SF?4<4#5MLtfJX_*ae()E@=@-Nv!O+t|L@Mr^kK<=8K_zPL17+#G!E2S2${B0}
z47S?cZ)h!Ug-B34?IVF<I)O|rHA%Fq>kdtYe-7*g+XGAua{3$<CGMZ$g6Qq(p|Osm
zT)RM52gP@^;!WCC)3iFf8k)O{K`B8YV+hM?i2%KnrqT|bQLRInw>7+lLEY;U4Kk~V
zN=^j^W4g68nByBBP~C|kArpwjl$r>LXgMek#Qba)M^VaQ?t_E<-}<!Y*NtbHta&dl
zJ@#5;aNPb_Ta}5D_<6kdAe|BQf4)tga$r$`YL>rP@yvLHKPh=ia4MPX1n@>raNJ8Z
zO1Bx{ihJZ~_mZbClZ`3|I75(vKpvn2$cQ-wJM-Ww7d_33+OH3>>^enGkdT>E&aFiK
zplu;g;MEDpaF#!{BKi^CA_vPJM8uRHs)AG@xQDc@AZ!kxJ95C2YZT#I4L$~B3n9$}
z#(+n?!>X1`u{J|TA<3yN3Y#sYCakNOwkW!a32`)l@Su~qhh`hWfxYJXuPuinMS+}P
zZre*BLY$&p1tP{;6uO;iNg>Nr<jI)f<~9M*1mroU(=?`C8fF5Gkl!%H%B{fVN)Ct}
zNirsq3qxwq+>#eV#wE37p$XO$Q8e+5<>4eXVX7pFkeOvWnL0H@-(>G_%7r>9SlP%A
zFpLW`9o>P78Zk769PKH)NwWh}GLT6_B{U{n)C0-#oRbz3W$DkD$s3AT7D7O=w0_on
zj+Zr1B!{C^WH5_of%JMet2>nezC+L-Oc(h;`GA+`>}taR<x>(}db?+n1IsIn^496p
z_Gq|kR9%==zlKH(6QM)F^TbZY?2T$Z|6L|VMn)%0p7uPlSDfTE4SZ5l6~8G&I;0b1
z2`}>1pQU{>#&-_JC`hZ}7W5~0_D|HxK@TKZd`4VYdj}Y@R~8f;%*_re+3d_Ch^ZM+
zd>3tztrP?*#Zuwz91{q%PRR6Kn)Yjv)7<KV=bf~n+oGFcRZ<E;;N))iKtILNg^XcT
z>8b=@a8)p{BkcCys>>>Jttlab!J?qj6&0?qFhii3iNqRK38v19EV4VTHZ_4v6Kz=t
z8-~kEgmWHa$k2hsMTQP3B~V0EK{REYw+am?9iSf+h7yJ~A2y}LEeJygQ4g;z+a9Oi
z)?I%O<9yI>RqrdRLQ9*^j~hZnFmV!oyfCfaxNE3UQu!Skd&lzm!t_yF6T1@5Ou2@V
zn{t*CLQ{k6hoTo7%Fs~snGpS=hm4Q9J~Sbv4%i+e)9&jH9k*&0f_Y&lTwXaI0+@50
zV!l|97~@CbAZ}FWBD9pWfzf;*eFvG{tUC)<V<F~K#(eK_)`x<)%BOtRE(8;E;uJ$<
z4HET#!<s-nAQ*1JKRl!pL;$5{Qa+^_0<}m~Ox<U=RzO|RP=&QhY-qC4sAQrnjAsVu
zLfr`gg994@46>p_qEvW6qmhBkb%a`q9T}%o1TCu)5|&VP%Tc)DLR6y3V7)C4;j9qL
zfoY`*a9|KOb9YHslsMKD=Y|{%LcDS`Ndkv@Gf^A112|V;VX`KWyqHm%gOG?^D)9?&
zHc@tDxK^w%VT=sT7#bZ=${BmvVB)(RUI2%Afk_ciJk@=wN37ZFk2=afU)w{dKQME3
zo@)7?yDj?B$-a#bR$-&R+kWt)L^Ukh9xJ1Ec{lQMtWL3@ZkRa2b$W*O5I#()N}($P
z0n@aCkPddUR+A&4kz?#;0qO-i4+Ge7RP29*J|x+Uy1$&3m4ZL19t0{~*oO>Gtbx|0
zxzpO$33<6`7reT{$T5(7jsraqBN>R{vD2xDsc_VyESmz23}D8aMH)C~3=?~^27_rp
zg^h`w34mKEBr-NiyOxMj<CTS$LxqBYra&dTLycz&k7fq~!<S%C8HM0*Gy)A%11T*a
zZfT<nc5H+#(1pehLKZ@-qsa|kh-()HH+nF0L%SUbrb(2dk_e&_W_8X*h)2mm@)%MW
zbZ%p-k)uWsYfMmVU_r9qc43ADEjdLN=qL&v&7Iqh9t$XkF$;MNp71MJRb1*93ZIvS
z-vi$mlQLk*cwt_C9vkr9j`;>i^FWn+Av!`i53V~Q6zw_#+ZR_YDjrIqKP3o+K=h*e
zbf|F@JP?cwSi-3XARb~rC|Vyc+^h@7ol%oJ?=+c%-Lp|%T4>dUSi*AA$%(ZYVXUda
zGY#pC87=1wY-a;nrjyT6w>Z%<uz)B~VU(B=EJTXbEQM&Gcr`(h3)y9c%o77{CXI|t
z!xF;4hlJq7*jvn?m^5+3q8^k3(lHn~YmVAH${Mlg91lg=3(!JXkUlprfo36WH8hFj
zqEn!wF~JBIdLsRgPC!${L(b`U1y8yu5I&(S#7&EbpSC=S<YR=6i0Z~Myv9Spf_o}5
z6P#V~EIZm5m}Ek@K*oX`5LsZMG#DtA0U-)BtSS)@L<u%-lD!53Xw?HlB7jDXQHuu4
z>?}4G2wW+{3C%c5d64L08ZtGZ7EBBnm~J`4(s`LjS65E1xX`y`3Olz4s|ydD<sM68
z<eDrCEu*`?qrkluD#4PO87gd?xzc(pOqWuw{L1N3vSc@xmJ`UEPbSFej_iS!V+GvG
zOfVuq#0(-Sa3F}l!vV9A25fPIibfh`!ZGAzx|v-JHgT}z8KSdhQ3I$VA|Z|qpgLjg
zJ|G&|q8-^f3z*Pzz+YkzPbF0zVbQ`z13EfI_Aycc6mm!+=q#alOU%WGcsnV;y&E-S
zF1TJLrQ+I7-VIY#l3|LhU{c~3L=luE7z@S+W1x1ZL1YUUrAGGm0)n%8DT8E+z<~=f
zPk{JN9qk#_hgZ=HUkvd@nj|X@H{h1c4?1O2yiYT&4vKLnQ)OBm1C44NGORMCWnsx_
zkYNc!Lg095Yyj&>7PD<`Ds82Rh$DsB+#S^B(&Lf_CM9xY)@DWIvZ2bntT6GE=r|1_
zAp?&Bl^wBs4K$EaC~mC?GBgFDhi8aZl6&b0QciIJ@&r{jiRJPpoLWf;bU<`KL(LL`
zkhT<sr4zak*wqa0X$i1b5$Netn6xl7#2p<~4Y8mlj8k43(D&a2Tu$D^=)$9fRt#rz
zkvk6Wy@=>|ofo*_78`>|lf8}V7(jC>D)~j&E*@OD`Z_hoJi9rrS!*?$3;IRwrhZXr
z3cH1ndBv3?>J~vNB>Rd~Qm~@P5rBZK78O#kSg9~s5Xe}OFj*xQ3jtnOQnHZWO0ozm
zQH4rOsf02sAX!Tyt01u~mO)ty6j)%ZO$*`GQ`h#h%hNM3=tm;?;}p{ZWrj*X43HrR
z?gYU?8B!)BE@h3DF)=jLIW%Gukd)&&IE96cn5l>e7eW~&Nf~O=45^k7q{UilDGb0R
zCJBINOok#vkU+ttlN?n@QgH_og?7N>G{Fp!N;I&VVTHsD2uVh8#gTw;mXRSP2?&}<
z4B**HlS-Rekun0XSj?bhB}!G27;Xu}NCP8?l1ji3!~&@b1u9IiagMHTrywbM?#5FL
z9P+7gQ$%rzm=u+Q1)69{7)YoTWCCD01{ffOvsz$G0jYwB=6W5Ww`eIKOo0;6PXmr2
zN`wqdOra!0A)(Q2#;9r}QH;od^o@z7L{J@I%^=B4)Xaeu4H6BIW1Y$+vJKH$L1kG2
z%29<zLd43cg2W6^xj0<xa5Bd#nv&93V7LwvgE$fpN<%gd35<!BVJg#DF67?}6Mho0
zSw)#d%!QGXR$(d3M5p(Y`v0#5Z_pM3;R_jpu?QisKqvj|5=(SsZAd?*wIQ`A;r}51
z)Rj3UTT-o(uEIvuA;NE>t)-Az7%pjor{9GU*p+!582Z(*D(XtGm0>F3eQDr&iC5<L
zyFO>h)zxie^HhevzU3UML;qBVRN+z{l?)I0v=KV(N~>a3vVfQhe-%%s@<a3ff6)$e
zi2pI63MZaP5TaR7=lue3P8{X|f?=7DLCR<<QX3Oy_hV>ZT)RT*kgf%jfNV=O&1uqT
z(3;%h9aSM(IPoi+>cA_Aa;XZ%Pq(<Ls;a80s;a80s;aeBRni>^!>wOulY~_5zv%17
zNO`)hd3*<Ab~^sFEe`tCQ>a--LFE3w0(cY2@4pf6{!v;ymU#~*UDZ_-QC>X3JfZ8?
zqkVPF=!_vW#aD-m#n<Zk^sfuFFSwTY;gqz^1|=-=GDyh@W4&kFzU(J~3J|lS?oRvb
zusjJzjs6f#E61W9G&+@d!0f5mQ^rpj79g4_qJ#ZJ)CW+1L=BYvOSpGaMH!BHA&?nl
zWEi!kAz6!{sjb&sU11<dO?G}dLuhYb6w(`E4Vyz^Xw$c5!{F<wPJ+3?=chtfDsmSn
z<fkO$0|g8R5itW0H4JdR$l)dz-+btkI0VB=PS1eg;30v61_)}Jj<^`Z8}SGx1BL)#
z;216K?lak4kg_q1NR5TLPkhA1ChcZI!6yZrMsW;4#0h1WTP`V_yuRucHiZ+<F(i^k
zC3S_4ZhGr^SxKdcSurs&ZN?a}#$d=X3oNcNjRcZOMO9mwMHFXVbAM5=4N$VIDx&pE
zgV+`yZgY>*@!vP|;VoNFwN_ren$_3a<<L-<4D+EP6;U+B!EteMVx?-8*0+gZwl)IT
z4U1!Cq7{PR2v{Rvg@V{4VlD^;s*R{xs9Fh-JC)hoZhyb&poW0D0vZVDA)vYl=!>EO
zqNAc3DjEW44vOgLXz8ZGv$ophpg>IXOwh<ohaku{Hm7$RZI&!pv59T1rKHnOlv)}b
zki`sX-*n#45nf`SAx<Em1N@i#!}rk_?y32ZU&jUi<WP+%3;Ce1rA#2Qh`1oXkVh!E
zjEt~itg9m_VF^m4SqWL031mt_0U(56h7ge{7LbBiB$7#@0w5_wrYMLeSO|a!sFI>7
z2xOQh2!;w+DWXUsNs5VLVrrovsbUzGS|OMugoX$us2WJAf<h_=BA8+nm<c2*2&!oS
zfrx@Ah#-X^goq`AWFjGgiXvEI2x=IKS|${R5{QtZA(#p&0+p&rmPSfwr9S$n(SCjc
zx}j|n8cujz!qEP$l;{@H{4Is5T|&f9%xO>2DWDQVx#-VxqiP$*WW{pCn!=+*$vdiT
zXgvR?cJJSRo)+?ct-|~(J3K|Aznp*XGZWEL85*?^I1BlUhPaD_QR8>p?4nwv&<U`F
z4Jv)XijY6psib8igDOeHo>eowOdF}_gWWHQ(}7ez?x6h{O;M#!Xn>5Vr%nFhb18X6
zgq!j+DVR6c8wy=6YPh+a;^v$XSpNZJrtxzNOZ=q4?4qiAVy@9(y;IcKTMJ_IO3<-v
zFN|A-xfk#(ND73R7|cRcf>8IN_W|>_g7t>8ggC(r4vLUJhUF0xD^w?FK@d8R?E%sp
zbCSFTpS!T}s$z6kq#Qei^;LNS^pD-Qx8pR&fe0iH)BF5{(k7f8f$zZ@-jMHDXUI|$
zTIy5+A>chk`^h5RA24wXf#@po0nl`-rITE?LgE~RF$hg6O$R7E1!2v$Nvc1^9CxRC
zsKAeY@NP0uKy+~I@A=`aL_21f1Ue+7JoU@$EOHC8mnjY+Ct_MzELK@k%_gPljM6K|
z71}agQIs-Rn@<XOrwwppO(ty`lI)oGWf5>3t=qUD_(CY#5D4Tvo(t>ie`F62wg<<T
z;L|{CN)E%r@7G~l<-Rx=&qR7~N)H_M#@><!kb#I*W_n+AC$#6Uk?u7eCERs$hv(<F
zmFXJGnCSE7-u03EAxlD7QbLSE->w;t+|nCD8RcYpE{N+H9tR`z`wlK6Ic}Z-Xnmre
z5DL*H=$QCJ?e65?z7$w&NDrN<u%7%5A1eWYdgKSe4*3H3N}=4_q&(^W3+q9*wzX|V
z>Z#y)tUa~)g7Aqj3rZnfBiIXqo|shXAqQy17;D`GmjzFnA8L^Y#8G}=P1Md+GOK!T
zmv2smqXsg2h;)#E{$f(4Lx@EK-TC1o>qwKuC~QItmq4DveU$S`9%7;Fob&z5M)2}X
z)Un*do{{sT#x+k*P}F?Pf$=nX!_IvRNI>X140=@NkhYNDCW+Lo>`%B!Q@8s+BrM_v
zyBES8q3Zh=uNT=6@8CgA``Q}7ufVXRIu=*uM@(QFOtqYmxkpTwW1ut!A&Sn=DAPR7
zTjt{pvJUJjWYUTruz{y8Ju3AXq~bNdPJ;ts(igk5IN>7}(e3gTlvEE(@}-1@b_FuT
zE2Nsa@d~Vvwx;m{#49!5g{5$=AEX@XuJgt5`9kP-x(}2tbQYjho;&{?=o}A`z6Y0r
z1rFSPs|31!;rUUDewwk`6Dyv^{XEY61jZqmTpu!6F9Q&}MB~eCaN~7&Op6(|1a8Xo
zj~z!tCy%S4;Bk3OK5BT=v_0X-85&dRI>j*$i{O|w60wmy51x)mly=H`uG&2DbXPV0
ztkOJh9!@N_&r-(DTDF|(c)5<~&ueL}Wr8}`n&@ubF}Tre!^Jx*xh{oZnuy-P{RI7R
z(>5mr*FoUYc#MtIo%?N95@BuU?wz}}9@TqlS)LZPMvrPSJj{ym%6Pnu4GBeoSdi`D
z-m=<rWZ5{%ct~8J9^f|+PN$!$KwhG&RbL-!8oK+3k3sMsBdAV0=g%ss)Rr_54nWVE
zsVcqtEH&^3_cU~eN2Hp+UU}2g>9?->3xVg*D?H2S<#~qxJn7CKUD;r2Q3h)+$yFiH
z_q3_qP=}A(1ie*roo9NfFEwlV*ADvXy?=hM-1Y0t>*v26#5QkwtmmC($Yc+~6MO}A
zgzpN}%|~r``>%cZ(dP|;><&QTv@d9AA<8V7^YNYdP#$xg8%{wAZ-19(;WJU5OTk>V
zt4vg}fs7X_!x4yH*i`CJNV>YU*~-EFv4J9WGKawAV22_B2!Y|fhh}PIyZf;Z9=r&S
z=0lu!|G(AO+djTseOW|>e|IlF{oS0jR5P>HB`W@H(b9TVn+%E0ZoelNK?B3KpRd2@
z+=e7Mlr$iov)+$Tydk?`UdV^;p28vUBwq|iojn$69RZ^cDMGJ+ICsIshfx|Q>PvB~
zcv0c(Z1axx=@fT@80LF^Uk(08v<9St%n^r_3DpNldWI9V#%w@j23F$~pd-gF+F)B3
z;w0Sw9|T4^sX0`R-O*444x;tkr1ZbYe$D=ef|Jm|p@cobo%$@qJQ^u?_8r%6!=OEi
zpB<aVR*RLbeEHe?rqw>V%l87(9l$@ub?Ym`={06lqu3SatoTe7Jb_``j#Z^~-AqdI
zkZd7|*n1cpH7G#plfB{cn&+iF0eOcaiE>ei!d6H`IU?buh{)@gY31dqvcq~4QBPi)
z)IIa&Ul@i`9U*o=Di(*rbcKiS%*e|(k;G%M-qK!7tLbNh1n9vIZFSB8koHJ=WYOMn
zj-`A2we9W0%c%(|mZKawWp)tdO?O!&24aJiH(@+2ra}xUP`rx)?mG%8G@K>)VZs;4
z8pG%LhWijX14VvK7uGmZf=s0Qw}nSMxP3m_<O7DQW{=v_qR(1AOZ0fR;E<Tre);MN
zPbcYoebG=8f1gKYCRe*GqPNQNiV1q-S}|kpZWeW`$a=1<sip@0AxwNq{n6C=``2MU
zr#w#Ok9CFf>*r2u<UK@2?&(h8Z9Qtwp58vq-V8C6Sjxsr$_zA)j~xpZDr%1wq}%0<
zWr{pmJs7@BMYM`FIYf&AQlWs0sQ{?gZT8H{GYun-2jlefz3BbB`&=3OYu~+3JGKye
z5{F~pHn+<!dcp0>;n?lB)9%wM_r|)qHrwB`(H|)t5CWn*K07bl0FZFu!^!ETVMaPI
z4BHz*&rABhm8PGFd$)*SixX+K*P?H(LA8-H$|e^!)`tT5Iw@N%LI4yXb>_7WTUruL
z@|M81htjw>)s9qzLhNv09?psp*#V3f5SYT4i1U<#@<96U(V_LRHGOd03p*&FPO??r
zu3f{~9R!|*lwcjSo}f_2u#4>WEa6Veh1BqB{2ohhkPSff@O7v@;B{5|pq^rMLAR8Z
zIBlYcrq9z4haS+;K_LQpot_1^zO?g8PpN2e4CY+;uI#C@Y?HL1ET0F1m+xD$9KO8h
zNC0Y_iaiWF*-rjXvF-LGaKSOeWjt737)M!7o-KI8cUniG;cO%C1~o&24}+qGS04kr
zx$-{-gR`Se1NC)gG$9)hu%;Y|1F~2$)#zZJk3xit<f-VV(d4Z_G6zlko?F{h^*iBK
z?uwisLMD%nA9BoOIw8<dp$jhK>Qp?<N9MO>Pe#ga6+Xrl@#L?KoIV<_K#yA<5)e9p
z^muuZ*L4_o#B)02(Ckc$RXi<CH+f7=itL_kT4XENqrttNO>hWDuA9OqJR{Ipd)QOu
z4@Dn-jlk%F=#U^3N5km)EcPaOFQcR(@aW7sCn>e$^lIh9&vk;p^22!dcqMuQZFUem
z0~FY+;i@f+8d2E#Aws9ePrg`Nz&`y|hXf(^Ib`yhu{>}oJfJZ9bKoNguL_}lNIjQH
z@E-*m96TlP6!Mf(%+SH0o=Ml21}d_i3yZR^GUZOg3!*Y721siIl}-G4<(O(5vWu?L
zDdA5B2ME4NLD*Uyh82OJu%1qkZ?-%^@UBiQI*d+NgIaN^PKE<+nnw!gG`%*Ah;~YW
z+t^un5&}yL3YoDR6M_)Jb|KrP(;Ne`G=gCP$QXv*5Qs<;2O2yV;10^5nCga?X55bM
zO1wH(Ynxr6oYoznU>tJej1aO9O^<w1@lyk6ak8zYI87TeC0LqGN<#E=V~L^Mt@L#1
z!si9&Q_iP~qB<+EO<u@pZ)-}d!I+hpMmfdIoQ1yHhF0vgwN1hsvZm!itXM5UVqhg<
zDy4LbO_j0{Q*f|c6k`PPG8m~CVHAi#k)cRnh+GK_1(9eWX(<YTkeU{jNR~vRgmMMJ
zgkY4R2rQ7c0S%HFBt3rRTD4VT+ij?-)vBths;a80s=dynhui!=y+72e7@>>^$x5%o
zf2DoRxBo#-BAAVMDu1e_=lw+{GCne@9SCx^Zq!YgoqE=_I1k6kQ^Wq{Rq@%3ub%S+
zd;~oFGBPtcM(N>rb!GLH^+yQmMgV3!E<u^0C5up`=#&U{ANyWXw~uEJd54{(cSkqc
zJWst(rno#VFHa22&%ba3?>%rB76l3RBB4Tnus~K8X^0|9tKew!_IBbJh9Q}qqtBwJ
zo~8F}4Ev~l78-lH;U~#MXih0;9^0HQc})0ptd6<8j^;hGdCB2RpOJkAQXDvk2w{j~
z6;%5i5ZEE?6+WnIPP5gPUC&r%ZcnQ!c~bWIJd+2Ad=Z3&pR1ZABtIcOgg*!4kARO8
z0h|!iB}&PG74HER$;JBehptkHLXE<uNJ%0V2xuXjqN>f3P$}(HyFaB*i^!foZ?j`Y
z81h|fgFKGsrMlqI(A){1EeWAE2RXaqCJ33imo$jj=x**@6EY##hv@^oqGUhOD1?Sr
zZ~neQRm`5(%&F^9><hQjx-eq~7{dcEp>-ehuyv^W(e9^sPNSh5zvTPMsy(8dxI3nr
z=;|m9Y5DrQZtmN>EPGUs?k#7}fEm`rKOqeX6(SH*1Uq<ZD`4`D%rTYT+9hO!AjU{V
zee;v`!V*t}0MD?=5c9-DRg7XLnrWwL?WM&{{;}|4W*H;re?&dumCg9wYGxODUCkc@
za$?h;Tur$DB9PUEQHWT^CDK(9D3F4;pRlU=B`-j`cbKt^R%Mx8sd6O)<HoM{mA@Cw
zhT~-Q3HTn{^YWflfUo{ZSM4QQi{j$(2<qw?<fd5z+ex0HZXJ8QuD}`=w6O6(L==;N
z5IZ3OUsN6FKBZ0~nAJ7AMV460EJ<OLGM~ya5+5P)`sY3bxCNnL<lA9_5ePZGU|}lg
zG!o+AHDPu#=o*Bo3b<?I9qHM$CyG1qn)>T&-VHNUPN>FfuD548foELN&TQTVa#YzT
zMcD#2VGfMcMv8F50OQ4a_VjNUDCAz1NR%Q<5)#NTwr+%lXjkrN_bO=Ds-?nqd8t(S
z;^|Fe%{q&HQOgyt49sH~#yO|fKjB_+=BC7}=v9>O@9UzMTw@Vo7(`4&V7c-pyFEp}
z4g=lP51t2U1cw-%9cP&8ZUSVcl){!>mRVuT`nK-vySr=`wg`A(OjOz~`^pUcV9G#h
zNdcV*Ptg1Jr;*v(F?3<5?;4Gxdrj?|*4e{)Yp0wuhdyJO)##mdhMZG_!h&I_ZkuF<
z3>fHm4F2H@J3q8+HJa9_Z(Ac&VG@{lbX5H4cXkMV1R)6sqK1?yLXU8tfLI=zYB7k2
zkr9Ln5EKcoC9$yHZ-{|b9|cblQ;H8oPlBh1JL}>=S3D6f0{9R@3PKwMto-Mp&V;%{
z?uG_7C5d5IqBLQbffo?S$1ukLvcR+~OfaI192}vc%pIYgv*XAK=@744b$X^^gyHjg
zJ5!N$Q&jVx8lE!I(HWW<nU!*Io=&v#yGG;9(>k9Qsmk&B56CS$caOW#g}LE|F(mKL
zL7|*Y!XEWXWrpY?ZiGF4y=Lb1S1#(|a-~HI6ZAqM5Qu3CszbwJZ|p#+nA>g)Z3{wy
zGYNx(f)ungEulf>uZY+{?{t@tIQux#oK6vzOMF&xJRX2MLG}6gdS5{K!1u^fd{8}B
zMof_e6A=>-MEKG}XXGBZL(}r13+<l{!`OVpecgN2RaMu^w>rLoX;)g0nvZT#$*+GS
zUacY!5=dqtswVRjHNcz`B}ghb<t(jD?`7660}}P8Nc{?BezL&vAMzA1y5{5g6~?XQ
z>0x<#=YYRMU9|3_eB$^R#w!(*CQLd-p<tyLAcCqQpyRB-&<`LzM`9U9V!}D@-7EG~
z;^`;LzGGB)GX_Y+7BW75r^w(pl-onVlq@6?B-u?U%^1e_=!4x;sJl<9o5;CT--`@B
zpKN>D)NvQ(_f+nKb0aW}i={r)W#t!JBz4@`W?9lJ$ecy>Hg3GJiuQY7(7&udtV*y-
zzu=$pR>Z4l4Zq8b#@G9UP6=1`lB`HJvLrv0epjlH)B$Bkd67UTgdqOo0zcujkkJ$7
z$i2C*06wYah=fW5+y}f4S`8eZnnDAb^}IT`am1N`vy31l6^stio)$`Z`PFr{+eM!#
z#>h|9x(%es*7leY$T)VpLlXs=A)FX%FM#8i|7^UT=hPt>8xZjnIXa&D)vxz=k4(#L
z`xsmFUDjkxJ%LN>*Y=9J&B&m8HZB=}<c6ca=c?EqCf6gqdz}2eJ4>teJfCuK)O^MA
z`Dvyx2^a3am>-RF2AK67U5-Z+*199s%fGrB%f`1`F2g#s8CJ+BYCwSlG0@1mhJ+`O
z43>Z@dJF6C*Ux05-09AMmq5RNR%VK92FUqh5eoPT$_zArQRT7V$xpt|gXq~^KX1YM
zfqsEvBhV;yTndl_&M5+U1g-$s6s83+FvSS^0dNrYO3+${Hl|j!6{V`Z^S2`+5)xpN
z7>Jc5Sx|}sMnsi_m0?Lj5@3{Kq$OdRND3J$mI;yopaYT_z?Y>8LZ&5Bh9EhD_do=|
z5I^qse~v%I54;b&{0HX`?|+x+;P6rSPGy*0l=*_xR;YWoxoCXG_b;_9(MR<c4EYO!
zAL!bj=1yc86S{sq{eglc8Hyhcs@IrG<;#<z|E>NT3;byErB~Fa)d}jSx>4gN{-}8&
z-aY8K0_0AE(F6WT`q%pb^=VnhBX}FgAi-5-2r7H|v>`$pw{HEx$wCkVvMnfdV4))f
zC(wgAU>Sjd1Q1jiQw)OxBUCXKtv?uk8oTRRoXx|2HsNRb=xX+p`z|zA+{*E4QKfUG
z()aXqS>r8m)>^!AHzq3ncxa%Nfm(V(36QA`Ss<qx!Y-5xg~3vys#>PnB8`ny87ren
z5&RA))zbb6a5*lFmR2TSKGqNBxJF5)Bldf^{hw*n*V*~MK2A<~<l}q#o(>M9<oP*&
z4@i31goDQhs8i4{*sII%6Qq^?$%SQDOqi(5G9f7xJ#K{d%k2aQ_Y%cO(Gayu6GB9g
zM9M_13qdl3%TXgO2#^IKGX%;sFa$zUqf{Xi1fo(hB#J;l0Ybr31VIoIpvehBOsdH+
z$r1`sL{Td-Eh!QVgoHw~G6X~=EE1^{1Voc0GKCOQNe~b~EE6dr#1RYx3_wi;0Z9-F
z&<sc<L`5PL0ZdB-NJT4x$#^Pvf7RqK@L!~{jKf2^?#dw<MG!v#rT)&;3aST$;7-B(
zD3YR|LXcQM;;FqydIup60l4MPw&_=$87}V6$=~ZoiC<wHrOG)@nLX(1RdtEhuXwM0
zFMU1Z-uK_jf4}}e7*f8vV+4Gb3HsFeDjyNp4S>|l%`*&)o*ynB`&5uE2{^VKM$*vW
z+VKBQ7phpLN|4IdLy-&}$eqE|5bgTfes~v8%$M0dD7m?<$gT9BX=N)I!pKkLpKC8y
z();Vji`!Bu-@tb&-=U&rzE4^%wEZ$$=f0QOnVE%odI+~p*p5!j64ZX&Qgc;~sZ^dO
z|DvRSMKDj@g~>tZ@@m|tCS;OnLa2f0FbG31N!yt*2ZatP;|i|?aj_W<pzxo$3PK8~
z{bdh;r-4Ky(FsyOR0I;tvoy@gQnLyZBokCHKu8in6p)cYGbl|m%*+%rsLDKr<f;F2
z;(r@dq&S7aFTWOOZVYHCS_*1ocPzlas|#Hzb*a%iRNQ4OjH59b#%O-we?#Rd6Nw4M
z?bw6p?UJelYgJJ8dp)0W0x7zL9zTLv`cdIyGt18X`j6PXK7+H4qi}ZSd+F|4S{h$6
zzWa~Wzv|?x=B!Y^L=k;i1!gE^i8B!vUoJ9_W~4%zX^dm1hQs0_*nayA%6qo~NdPN&
zE@FLm!TqU=$aqn(*a$Hwt}tMgq=y?MnV2H86HOMxv93l$k+5Ze=&9f(bTxkg5nYtM
z)Tl;3&>s=WJNtQpOa0jjF^Lm0LYy_GGdYA?PU#dpH5V$KqU}=oy{}GgYm%%PNisg|
zN|vw^%%L+COvsbtR)?{HZIZ0QvnJ=uvu4aKw;PPxc`aL7j9DZ6n+I6jX-F_Z#b7X2
z2BD~0rWYK?Dgg=tfS?*EC>kZ0#DM~i6MU|HXg`3F5VW?2f`i25=Z+swvWu};zAyY)
z20n^er@l0(dbmBYafJqrYYeFwlK_StXvqp>DKchBOetDqqQJR`iZe43VVL1F3<jk#
z%*HD+NEQS#Y|&O?m|IH9r@63Z$hS8`Na7kZStIG)O&x7e;#vO-?e~2j#I1LS5ZtEi
z#RIx<oF@i)$_nWkWh9<}JbnLXho*$_lmj!+Xj4RlK#>lKVT>~wtK%<i2k4MF!IkW%
zv)LNRjCn>epJ^teUWlCpAgKjN05m1&lQ>|Bb=yiaKn+gfMR0~|0brs=CM___(isMK
zMH>W>;Y&$LEb#vEhnFKL#H?{fpc-x?qTcPs*7t5Ux4ysa_Z(lJ=kdq7dtKhW-;B*P
zQy9kpH=tf`U&K`2Uhgzakn$4|#5)CQbwb_YX@j%_qZ5}YThSy!geb=y>XL<lojeUO
zK^MB^K)p&pxB#fS<gG%tU1*%Tc4A``FcN}_nhK0i$qVnMRn!y|6cpCZuMZmWRPE*9
zomz7+Ol-t8dp|#)&m555SUQ@Pnqc9I8lh#ALP*SqMzpPeh`wT925|5dr1eRAD^-bP
z5MaU(0U#*yzPeBjJ<6Q9a>>r5Hx6>Sh+yVtfmBaur}6=3<vu4-(4s847GH>2H7iE#
zma!4Kra}*hR*<kZ4pQ<tPSA^agefEttwv%9G=(D4B2eHTg2yvMpv=~U`IOUOX66Bu
zG?*ao?QX?LtP3GO@gRjNK@(x~yGBG+EaPwb_<@mC31|5D8`2<R?vn(Fs||*b&^V$W
z&Npdbl$WZRh@w-XykOP_0nuvfyF(I;+A*$qH8$&-P)P0;H?0mOswCJk4ZG2&5(qB<
z&On4G1mKGf5a6sEjYWnd7&6LahE&qWT053mCgzc{F&L@)R&g!!O_qctl1B!S#1-Iy
zxFA{ybn{VkaIA1SiJFU>ABO5jq4O99y6S3rxzf@Ug*4JqQ%_z~&ltuQz_5a*YM3Jw
zkKN_`Z$U`M%#!`T7KV(8+oykV_PdR@d-@C2UtG9Dv`)ltDS4GXB^MIAC0_zBkX_Jy
znGcCR&>nZ+vpo&d(A>pURT$@_@bL4piX#}-6$F99DnFq5JH!KrgbB^G-`=SK?_jer
z85o$rzM3yd^m}c3SqF!PX2}82%+ThjR*t?v+yL8EIw?9AA$8Z?$pT?aLLpg~asCff
z(^}v0nyne&)oqd$!Hgpf-seFR#6%E)A$l}UY1|#}bME(hs~z4jb3<e|Yra$^LRn>(
zc}ScYbLYc98Wrfl5I8RJq=7--RF49)Bcup3<0dkhSa~hwF_Da=_beyfrD!nAR+gf_
zM)d}=EXB4gV#YFvwtck_P%N^kN3~qNJk>c5phydEk?M?L2uO!9SMnu|KZjK<TGR~V
zcQrpKT-2HB;My8eRFDipc8>`tt}=w(rIwDuf0<ylbd>B#Q32W!QIsUxt!U5*sGHsi
z)`)W5fD!>zHDu~!bAgv#ooMNAo`KF5j2I!kb)m8EN@burJxK->8%k2b!J~S?ySWSo
zJH25_XhW7ps9j`nfYYlYOV-E-<eMaBvhE>B5jw#vQZUg0$cL1i02MTaM+z|E&PW|h
zf>N78+XBH8Y1SpMGf56&X-L5s6x@ZCDTJE_28f7E156pL6M7;w4wQ(P%1{}iAwWc#
zWw!EidY8H9)isNQqlmf1x)t^mrxyz3-B!%TTxd2Ww1-*Y3d!Y1oiI2M|9!dzBWwnd
z<i|RC3JhsJ_9uhGIz!i|;7<o$)OPt3%oEy@Aq8Ogq4N9Hi>=d8RHaX9lv!eXLgEtA
zZSzthdg0d4q=FbAciDP8zIM0kqn7w|Hvu{qP#Quh5J?Oeq~q9Ewg(WJ_Jz~1l!O})
zi^Wn3>VRoN;2aDys9-CIQGuRbwi-NZzg^!0i4MwpDtE&HQu$j>-OpE05*!MaKuWf?
z;ST%5xHE4@3Ey~BO@>5m@+FtDiV=WCEYRLUoE0|!_kC#5>l16(K!=)I*c3pC*ic=(
z@Fr>)f|<>fg`u*a63u3f_|1ABRAh8Dsyt5pVc!E@D&|Q+a_%<P7AE1Y60+~kQbdh~
zITGU3s$$hckm5uSBj%4Vc6By%VN&2(77tbp=%8sxhC!zg4IxNAD@9p@L6&GMp0)2b
z$nZQ!VP7d3+qiPPPV8*px6?9MQpT<caG@!Y5|<*WHDxV5=_P6A)5B2J?(n`TVM%3&
zm7&pL!if%uz!8XA%0appx<KkofWw6in;H>m>v_Ee5!w-GE{G6n6$7YfY@i-G<?6~E
z5H>?0xCWT;Nd|O+r&K2>7FoB1tg`U|rUe{mF4EajMI2O!q(Kl7bgQ7+rZ}kW(RedR
z<Su0BceaP6f)>aU1b|n#xuXYYovLtqbf4h_SI-dI2L3q$1R{EfZB1Fx(HdG?ylo>^
z@`jVB%*;FsT)rx#p9j89y*u#a2!shNk`E7>MezHs#Sx-NH7snjN)(|v;p<bLqtNXe
zVxBsnkR%RixLFD)EzAp0c3O~-tsSHh1WIGJ>oL%;Z!R$wls<fpg*=CeHPjT{RFl<I
z1jaOk9O~V;)msuupkcI$)E#~OLfnqAk%^qrdCOAaZZ3lA@ty8za;f1i<FT`>@!8rg
z^ID6wq}rYd(%2uq^z;UoX|?DOh)wGI+VP9*%3C~VFRS)wIRCw|ScDP@2uc*pC`3dL
zf&u&(U}y&bwx(>_F&dM*n4~-TN$Dkh+sL`9>d_y9yDj3}OXT>pl>6o+B!rk~CJ7Mh
zL!;BU>Rl=O(~`g}F@|B6OMb9zII$9vk`j;<H4>~qO%jmQ13@sgLIo*HN+b+~goRaq
z^;5ZlKt^E&S&$V;kN^n_^&v<@K^6fKS$l39f^}A)=q#nFUP$V?T@`mV*e&g091{>+
z`c@lO)k@yYn<0D~<LBL6QcqV-b_Y(G#i{|J3dah;1d$Oi!z@8)s!E+Ie3~OloOHnL
ze95^w=0qU{l7dAj0SrPM5z$b*ZT`k|gWfOqSK*2<vIa1z*k9``%3y_LSlTb8UJCmB
ze_sJ_CBku?s_B)9AmXX5MgFtrp45Ez>%NHMu`m{7J~C4vXlR&VkrS`3Sb_?M6SK8P
z;0mkkeaK9tFqF!Z3`j{dl>|u=#DoyQM1>_n5|@6_(kDRn^(RtU7Qme<;Zx_pxu>$G
zV8noAF;Yj_?Dfiz(Nd@nxIb8O`13i?Dx#ln;ZqWRRXr0><1jI##BF_gNCPBLVFeS;
z)3anlIMj)NVuv;Z?Uu0UKnNgwv+`0l-3AC~G6La+5`L%-zr<9yd{lY02hkA;`;nbf
ze1VJz2>{eX8V){x$6)7Y3!NC-Rx5JVOL<$cP8VOr2h*KW$GbD`?scd5#rL4>fN&I`
zI{<ZFCna7%DIp;eBuZ`!?x#{Ol22577?(Gl%a<*iioKRo7$GRrBH`PDhJ_#&Qe<Tj
zRFDqA_19IC-I)j{z7S#+Q`-V8z>X72qmUznQi8-J5D>Rt+h63V#Y|D%SMT)x{0~Nr
z^$L-^?7e?BdeGh19BVR@BMhXbCWvpisq0hCr%5#^Nt1J?{UOjqAV`e4t1L(~5}G3j
zfejqAU-Tk$nWJ70KhGm0GuWf0+{?jUef0hpW2qZK-rgnZqy$c?s2GI}Dp)mx`T<!0
z_aV?pLS&hgkb#C6X8$tiRf{O2p)XRQ9ix}({2yF7DoIoAzmX5)^ZA?QXe1E2at_eH
z(V2irponP*hM8mw)t1~D5y%7LE1-oKRPi4aeLZjZgk;lHhnY2zt02*;(QAQJE-l?S
zlai&rsvfLnB4Sv<VlEfcy$C=z^@rzmB<_B*Ws(UegcJlXn>lqP;11O^2pbOK8lejM
z+8;a=!>keD#B<BDn9j)85yp--?|WmHToHRmghI;!8_C5DVyZ}ht!la`!o!F`Ri?>G
zgbWG+9rbnWo#fcsIihtjbhgq~&fSHGhJG@op<B^sFQZ3{14y8DkT9wN4McWzsiUG<
zHqo#IwhVv)GL%yy49>bUxB>?vcfPCxxTyA-9J*bYjt>2uB)DX#=+jRHn;jIOIB=v&
z>$_Dq1Tp2N%P|p|COUL(2QD$mx`x_njd7|+F~GDzg%k)_*-D8-W!YlP$hM8`xU&On
zsK{WlFak*kYk^Y~t!%1MJ*o&j5g|tyMEL2N1eGKbMi3y7kdcImAc9J!AtWHGh@jG_
z$ZQ}bJCQ6H0i`TemNrxV(#wJE%y_hg;)kYOgJRj>X~jkCjww1W29zv@1|dorDr5A%
zPJlKrA!)YMwPm4bQiY|7Vp*0pHlaa*js^xBAe5DX9;^e1qO>+h!%S7AuvSyDtCuKP
zrV<bou_F@_uVKIIdb<(Vpd})D6$saA?Nylr8jlMk%tQ!4f?6M%B<2a#_WM;WLo7r-
z1MT)9?7Rm+8^eg1C>A@t^#P(QUDP!`v^^qwNAM58J;a2BpO@uPc}oRD#Z&6~n|W@+
zEC>mRk`>P?5{ZUpA%bC<WstHn^GE+AAPW$Jp-2lzDMFDTutE_cktoD~ks_l)AW)>j
ztP+tZF$oYV%`_A%1qv+-KvM*eC(1uyeW<^bQy<z!D+<az6{0j)mQuuG(zO~^nv+(R
zk)dL%CJB<^h+?i7s9?a5FfuZ<#1a7l570xBB>l~fE=X!TMp%nd0xPqd!>um4%@<r)
zm)<Yn%onw8k0c&|8d_HCkS&4V-W~6I^!j}@sH<S9`ZZPheZ}TK@S-nM?UXH&`IuP6
zk&%dCp`f5H{`0@R?>o<i{=n#0xl_qh&fWmWVD1u<fQSr-v$NmAI@Z1q%da9dwZ6Do
z7cgkn|5RzB!6dGVW(oyK0JIFuj$y?7Knj5hS0yb>zzdepTT}xTE>#ZUQ*aIl;Ft&I
z9NzHE0L=`=O!Gr9497Jy5X{UR!OSzvGfeiokMLlgUv~(`F^p!*D8?${E+X_p%CtHi
z4yw-*v4V%{#S*EeGEC3N!4gnlSs>74C;^m=pcfbM5@s_p32X3ENXlD8YQ~K;fdnAq
zZHPXT-1nqk;h)3SKMIiq{5@ExVofVSLV@T)15l9=RG6j}YBC?Dr%z{5!IlnIVhM~z
zV<eLqN*OMT_SMlTSdu`Jg#_Ax-^uXsMc6&}-z{i26HPSEk;(2miDi|Pl$a6r2vy|U
zLOYKO*Ta?s{9vg=3gI)0IuZ=ysd)u~vM{5?noNry9JDar^=oFUhRRL7k#0l#SMgC;
zukL@E+>fsT{$*fBDG4S9NGL#vLL@;*1aNUNQD_Xn_G6BummEfL<NX)<RK?1!OZr$j
zmd_aJYv=t>h=;Wx^5l^YL^zNRJgF$&A(fydP!&uc$cwjcIc_wjIC+~kb1SwcyB&`<
znrrVffX<m>X@uF0J%)h}z@35jf$swZEkk|2iq8_VgeXFaC@rO=q`FI)3y;<zY8Ihw
zw#lG|LK4beT1_`NOBiSyI<ZS^LfLVk-l)hg5ex~C{?uJe&a6<JO^0CECUj<w6NT|U
zC%4NyL)z>;Uh4?gWdGome`}S^`u+lL#_W|p$SnzeYM)sxH7|Av{bG&QN{up+VzERB
z#6bfZ21kfAo47<NIf@z{N(sQh#(!3-2$c|(gpqn&$#Y=1DB?<elDC2K%G2-H&G3F5
zfQR1^P(d>@RZ0-R%9Q<%iAJj~l_GQGA%%)V4QM3Ql9Y5)$S#QMSF!P*L-afsdUr$0
zUQ&tv6#Z!4?uq*sa<%IAS6!=FW3S`d*|u554m^Ka9-(&!3=GQ<Ljf%;tc0l~gbWZ#
z07D@p%M1)d2~!Ov3VVbj5cmB;dXQl`o8T#mEYJ})Z$j}rP5B3SdYU-ON=i}<D0Jz{
zexXy)A`q((l8loi(l!JAGWg=NB4n4EA8}vIdd>bHQLJNN%uvatm+7`AfrVeA(EhXm
zKH93Ph^nfps;a80%=~ZeFUgpmf#Qnt3$y0=ex#)f#hwe@s)E;Zg|ulNwls_*GuGs9
z<M)@|WsAVymzQIjoO{a1<~jN}!SQ+_SoaKL9`QiMD>(9f1za1_@RS>-K9YNQdj7Y_
zs;l)^-93GW>3u-}BP5W3kzz<ai{n#WJbd?V^&ZnJ+REoXY)=4qQJBe=FIV1P(6#0z
z{JNF&Dnhd}P!39%5SU<Ou$e26jzHo_L<=NA1W3eEz{;4cizyi<Ad?c5QbdtvKp>Qc
z2_>bhGP5fKGL`up3n!vaVm*lY7n_Q4JB4%Ggoi-b3=|LOI5xwl@KE@C7u@?J%+V^R
zuJ8JlqUNaMVKJ9?Pj+>A{G$8M8eQYM!xk^VwYoEC-(QE?E)o>V$&<=gxh@=8d{do0
zc&FMvXpuyf_rsF<*ayr79?zr%1I$8uYA)4N!BOo|;15Vwq9>$P_LJ=g*sA+tzZ$3M
zm+u$vm+xP~f4{!*uetFleCok{KRuHO_S90*ZCjQ1{s3{@xr~gCxv$zZYlc>{Z5dii
zSWUDuigOycqcl(3yl7}cgb%F&#SNtj@_(ErEiO@qilje&P=hd(R%T*lexKid82e>E
z>RA}9j6P9svOT!ZYm;o9l!i^yD;Z4XoYt!IZ~5<U+;!^q@DjPl11epWJf$u<L^;Lg
zr{;%&PG^j(KQtNTRQ%GPnw6q?pq^@Zs6JwOfcb;T1I<r0^B+BfP}CiDG&In3%N%SH
zs%elc3ly5da(f2J;MrxBfvNemQMcNFF#vzbQ-D$>rZ}O96^0>D*}=&;21f_MQ~Xss
zfaojWc02@=<l9_D=uuL>9*y@n`q?Z`md#FPVUgB`wCmt)(@_Mb!xQmH;7C$T5v8TY
zg~-7JjR}e*gwd=p72?e$1jHq)avED=i4ItR$uQNZ0CgFW4ghNjm{o)@%QG_!W<Vwl
zD3D4Jl#pH%42nRMdsqxnhwE^`*bEUJ92zz*Drp<Ex3m45T9||ov%p@E2b>d}0)$Tf
z{`tH6&fxBQj~BoFTSL#*mVNNWdQp#UEX<EfFKlA<Fd}#`G1wK{2m6%!)DB;B{9dC4
zNCKTC`v}_J6tSP9)b%}nuc`HJr^cs4ph-OB@+wZL{%_PcsB(gsA<Py!nZ5%o0KkF$
zu0Cp-R8jptQTg~FNW&?I`!!L6lgq9-rD#UXDJ@3n5Rp(Z!v~N-KGQb?G6wP9hh?Zf
z`!`2u0m?&YMqksU5kVI~!pNLRMn40JRRiP1Eu)QUHx)LKIg0GvYHleHc=C$$#774s
z8JUf#^%rz=<hoqc@RPYO@Hk;XK?M{Y+l!`TNzAol1qLC}JU)J>$9it|^tltISgclN
zW@nb^62v=%^!j}=nh1lxz#xh?8cui`5~<hG)f<tyq&KBaThB?uf#^M6?r8hof!ra?
z>Ig$qH`1Nq?-W2~ABv}K2izPE;X9UOIw8{O-e)qE13wgi3tRw!;2@htMk6SMP>4Yw
zu@u@=?_iDh^~A#SKqx`<6ircyp!E)+dW`?%z0M$3Ch~3al8{0IY~J>4`X0}D7QB%H
zknB_sGt$zl_ht}8NE84U<i`P%+(5hjTtuWekup<=Gcbl7L4*Y=npMFuj46^k%j*kS
z1f63-X`ed9Lg<vMrQv1s-zd0~iC4f+HnD<?5Q6|ZFdF4xA=pCSN|38BpVLAanV2e?
znuvZjLI*;p^`8hdgb*PmMj$8x-HJ~r!&0sqwT??NHke^VvK1(>umkba2(vaiYNnGK
z)lKZm*yyRg3;awh$}CxKS-W*T6LPe?6V>YVcn`G~2Y><fqJlnLSOMC71yoNle9KU^
z^BWGvXqdBv<2rbG(iHiCd7kxtOYl#C{u7fE7TINnr2zo2fk^_A1}K=gg@cM)ZJ~|A
z++2;xiefn6US3}&#{icUFqxi6>Ohi9{rmf>cRf7&wklaiZMXaVB6H6;@j2G94IpWz
ziRTu3CiFLZ_`-XD`28f1uz(n;fM!#8n#nL^HHD#y)=JX~V=0CVVfR=DWJVfP(30Jh
zmWCU#Qq2uC&Owr{NVv#pfE^GRhOtIwRJ55S+Xj{qqb(S%FwvDsw2jG&GN98_snqY=
zuJ81hL439YofbM2<gCSFS&<<mLNFBq<xQ<zg5bAq2I<=X4ho;OQnPRnZ4FVNkhfCf
zmHX8sSA#kcY?ZJjjFr~rDoJZEf+&JYeQ9M#SxC}_I_q=iPqqLX7kGz5`;UY?A<lTa
z3lptb)D?oH^~QSnrG{adyxw>4QC=X5?0B2eNgxf3RXAn63-`CTz3*4>d;?(RRYu&n
zi#ivyB?Sjl!W7Xk;y|3rUWiZ($_0pAC8b>2%gNB3Ny+DDCpRKhzz2dzhkJB46VTi-
zs<uxi&m-G&Rn1W`;Vf#y2+IhqCLw7sQ&b?0Ah`xIWGKUK6%3sbOL}QTSrBjZqoqBc
zc9*%6pQ&H7z#Lsa#a_tkLh{123?X84V2k#uLEQo_$OTFd^6|w{)Plk#-69)>-6)0-
z6oya>A|;`3DNW+iOjd5zk&4D*5_MupI7({JY0SC676#2AZlL5-WE>&L)DjU=$N_LJ
z7EQozHzuK^pm-JlkPskO8e??ij7Fr|WYwC6R5h5PtwU2CG`E)FKV>kjhQ*8y%50gm
z-sx!>V#G|uNJbKZ5b$nTxH@D)CD|kTZj?K@s%8~3$PCD*Mo`8oV<k-{Bt~CNLo!jA
zMVKj{4_axI_;K1c#J#eu7~LRJe1ayFg->WJfeUW1GvrY*VyE1d@=9*TVxMSfWnNKf
zihZSDZ4c6s_EVf+sUM6#Sp7%p{>q2*)bgqBV81VhBj?0$%wsS&p}h_Jw^YnjPSiWn
zgrj{X?Z(Es@GUJcsP1=nd>)*+IdbLpMf%UU55WJ7ALWm{<jMMoV=%)2#AB8V2hIkE
z6lfYidD|c+LMBaOVi3YiTGY{o7?Jy_wlbEiPIDC;j*xZqP)Lyo)d{o_bR{&w`AY=;
zMpht+hy>cH2tfiw8j&#x2?+|Rn23q`0-+y6f<?jClkEEbzGzgJomPHk5z<J?o@mWs
zUU?@J$u9+E7q+KLBGKz0^yj;rMe52Ek>Aye$YMk!lcaLa8T6h=db)#J9c!v~syfS5
zzXrR^Ar7OM27sppRKL+loIXM#Jdol!#ndbU)(bMM#Z&eY_53wHM0N)V2R1@smUOA&
zirJ~yrjL5Au@IC6Tof}1rFhY%G|-VWEbB0g!wi9fmPy5RDw~-mV6sz;DY`O~NSJT|
zKr=B@fR-j8nid9$mMWqpik&L@U8n~LnlS*8NZKq;kdTCs<*d<S7E`RXmJO5myer_}
zD7+5Oo5%iChebE1;T1l?&eaeZ{NIn12~epYtNI__e6Jh^s~penv6)i)FUb3;`LD<P
z7f1O7z96D~UrT>Lxy9;mS5G}tNs|5|wbrZ4c2*y_(EmnM!mwFmU|8*6dlEql^ub0>
zAuR?&j4;H850Dj85&`z%ZI}uYKcvBov5qcf&|x1uuf9CwdPREXSWuvH01oJOhco#)
zOX2##CXl8m5+MjsJJ8cLL`R6D+Vl_af|20`5IF)pf_4-HG@(E=C`CeqN~ebirzIh1
zA`|3Ogh1;<?SH^&fPx4hkfMmJv6dzxtV~OQy~S>Y!b_l>uHW`QW>#ZMawRSG9CVhd
zaSx*;WGBsrs$epvB(TH~NDU~=(1<diOSV)!sg$_>ALZJEugtNjQW$s3+lo;B=gWtB
z?jA=XKqd(!nn*%vi4q|qLL?$ULWq({29^boCJG|!7ssRj31~Wn5jue8iO=eg6A+M)
zs;W`x@)orsoY&vu)8nfBs3?KldxSmN$btw@ehyT+1^fl$cjcc|?e(Qs;xC<EF!8Sx
z`7G)9KZo}Z&HaKOxU~cFL+ww{e@);jfqY5yC~M#Gm&Fg9AHY@cME-?N`4@QarQZv_
zUG$yh-mdcNS6aHddTw02s`E49_iUD8i~Ffmz+N?i2IN!dFvT7u2!Uu=B?*9L1fgha
z>j-8Bo^$k}4uOg;X#N0wIYwZcoD{&jlj)_<Wpg9*7ZFKs<A+9OW=|g(ArO#2utG5i
z6eJ|15)w=lOHFhoz=5PFNFrHSOIentn8snnxhJ)<KaTYiOCWz18JF`$86V61PiQZ3
zdED-49W3|%97pZO4{cqjYbuQkQFs6!VsZriD-cUTL{TJ2s|kWHH^F;V;>KjIzsO|#
z-)GlpuV=7!{x+vu!mIbDIWQm7PkKpzKP*|xCsmeMoKkWZ?y2cwdF5)>GE5MZiAa_p
z$O4f;8}(%yqzuUq-eh^C3^E4A05C{=_-;ZtbB5-_3=D_L3{8*}W(F8$211|#{7|8%
zT_iXv95_iGJ5#~;B()xp??}BIkanncE86v-3vRsa(Z$~9fzi*q`m)H%&j|V{A0r6V
zxFhTDeiK!c`ZBJ#udBynIk~S@<8v!cJQ@9~$w}%Dkk<T$v+A<OwX8~lq^YQCssLQ>
zeovLcaINF0_m{kM9{RoK-uvBL_eUKRke2-A&pc$K_XPu~HI%}VT_7V^Od}|=i#P<}
zH7Mu^Xocz;0ibBVYpJXIf8U5;Y8r$IF@zxvccZ-s%eSBxXLL6~j3ed`&ZMM>5J?17
zpvTA`*s6q$Au1FJO)7!%sz@RNE+`Mn^AF&ZSrU{WNrk3~qcXu_v9p*8=a*B?=`E?#
zJ}b$)x3n}0rmO`}91B2*CJ)1~P#9r>g%6}MY01Z{&F0)Hy6|6_z^mwoK1%VKHc&{g
zi}|WWz%9nv0KoDlnrx-=-aF9gPO_mY63Z=<44b8E!S^b^$^$ug?>%5}L=Duy3a-uo
zqj;F9;08`t<$@KMAy_V=I;d&~tPeads+?^tl(dpD-is1)bC{im4?$UpiH^vck_LJ4
zFK%XJ!3~6oiEL+WD<lKvpo7F*1P6F(hXgW`*kf~vaa~L|y}LF*xP59JZ|DBCPx2z4
z&Y%y#s9YkaT@l(s=!rT4u9ZWPOU8+LLOjYI@kh*q>ZBai4{!m|L)?eB58T^jkXuMZ
zwBYC_1n=dU53fAP!1N}4ADjjHV175>g8>+(En06^>2Q7yVBr|yL_fWl#w@}R3DKte
zMCd0%Oi8q!e7?bPAqBV`3CX=0LF0}}9K5*NpkHpjZPo59qGkwYMr4o4r8OhxGD{38
zt17KxEf^(>Dy*1>u%k#yL2!XwkjPU86lO()BnW{d36PRWWswLF22_PfMiPmpM3Pb<
zJ3~E}5N`UAgAr&r4jpL@4g|$rL#kqykfr7n%mUb{DJUa|lM-yx8qyOB0W1+{oJtoA
zH7v1KVvNY%EhF(_n@Ng-g^3mk7DDq<0KtVIA|~%NONadGn!kpBWx%PzQyV3xBAz=?
zEKD|{;y=`)1aBe?6*rQ2EQLCTMq;ciGGSvTSStGjqVRThc5nAZ&r7c)s}lmuk%l5S
zCwp<{h|H@pG^8R*Yd3aGV~a8y7%@QfjH5Fk#F|u22yhb8)eBpMIf8XNxX#Q>e%SUC
zq8(|nR3$=LWoaxX-ihf#rAn1BRJbV#eSWjo#Q^+B0L^W1#SBft+=jwtUz@41Kp?7c
z5P{Ky1`HTr;)wwh(7YfF4k=_bvMByU5KKkM3|<LAK?$7Yk*X7H&Jx->wCp97&yoRE
zgc<9JMX~6nf}P9|CMcj-p+jO+U~>k<DMJcrpqzj+uxCPXCn>y|ui=U|2{Sa$L!qEr
zj4ejiH3g|#&cef;rKh_ro4zCQQ{p0KB76l`X%**6xF~j#yGbtEfYDG51QSF=&_Q$r
zG!c6W>Vv3<#1Duc7UtI1nkaXuAodh;GAB9d1PV|!ot%)@T|+?8&o8>V%IgZ9nyS}*
z1CdF2!-5)4r|(qmLS$w&3DY3snwFK8mYHo;*I{ujhp|2|ISgPTHx4Am0fB)jDJgDV
zND3GPg;5BV-6WV`OIb=O3T~weRnfzz=AI?-Qm6NeEMqKJj4r8tQj34lVQVE>0xJEv
zD3)XunH5W&S|Ga-`#Amzodmvc=PLh+epeB2Z`P8+cvFhFt92*c)@rTcKO9xYbmZLv
zSwqUKu7*$~@81zJ%CfAFrww2rhX9b<mhRmrdygWTC*F#5dL@>0m6Qty;;Z*!K7IB1
zCGM5(3T2c`iz+5bh?Wv!qbnd}tVNPwRf1&7uqly}vM~z^wG1SJEToV!2*Q$JvW1x<
z$jM_Q8Ce)GgA*7rNXX1G2177HAq=QUzyz{{vJk*i<?@S;rHP>W|3dsCgeWK|pez<K
zWb3;5a=5M~Iylk#1fu;4_bL(ns8ojo3d|}~N)F)4Sjl5Cg3!pLiC(19#KDxq0>c$p
znM^VaIMlQpuvm;B3>a3!0wDmv5+=YL0|^W<3l&uXmJq`zB0>=ukRYQ58zO=~Vy9df
zUk{EaK6&%?G@hbaWo0ELmR3?yPSQP&#mHEPYWsbH89M?B`I0IJlkBRpP{{JNI?OXL
z&1)eGA%J}ULtMdrjYBL;ccbY&LFtAJQZZBcY5r<@u`yDs{u(Jv2=q%lU!DePN&;3<
zso9|NZ4AHV-KcDHz8v$hEWWJoqo^6pV^P46H3_-s97p>OkLcPIBlaqPWM9=&%g>)3
zx2^j(qj_nbDL0E)EK0O2Mf$38Z?4M~o<)3-O9yG>sSh7)L+yT$y%9oErqM6I_|VoN
zgRux2u8@rwgs;Yt|DW5@#&ye(>AQ#eX3V~j+4QO6$T2}piiQ>umP*N49<tS3rPU8V
z6wek#wRN((QF^^&OpHhS7EY!|&F=3Rx;t)98ajAO-5f@A<~c!1_=nORH<BS!NLl!;
ztB64#`62;OOWRM|t$q(Xn=HRZoI|W9n>79Cpwa~>58+Z+(7Hm;z%n7J)MU4-lTUrX
zw-_#Pp{Yda0zCr|4!KZnMF<E(uTklylMzD|MhWDa8%vwDj{Z>5T!i<pJk3ec=&n&m
z-Rg+oVjcvvKE@h7LZUlD3Oeh6^5L@%thB<b3hS(?sbCTIgngv+6-L9q5HISRl}4~h
z6-{LmwH+f39kmCEwdD1+JTA`HV0r*FsQOsxfgLBJZ_VFZwQLrHPy{#iY=}fXAwh?z
z^lqXPsE60y?xW-H%?BV!E8*6C_<13aH|AWOK@YKCTSHJ3505EVRrTt^SXP3Ao;kcc
zc`I*5zU2ZY3*vbKA+S0ejjBBB%Q~1Rf_j~h<RH>}x4(6kH2ERw3cg^3t1O47A4bE@
z<4KrvSlR3`s;0o}cbduFc^MljbXk$^?KN#4y&V_O`1yQZ0Yj*i|3NhXK-nO>h)Se9
zQgia7?>nslwM<9hNbqj9bV(=xJ)v<5fSD-|aQ03R)4M6<>p-5jKJlqoVs}LzH1*H$
zXhHSlrVxkQ@9nT7>nvnLPr=`cr?Aqlg*^cm4dB`;ciD2p4G_$;(~A2c)KDJHg%Nzu
zQ1UY1m{k;f(YS!xoM0Xa3Bk`c0{Q{r29)`lbddIi@>K;6;n-o8e8m9og%El*O&3b#
z4*b4zNIC<si-aLM>N1f}3LGHP4;*7!36MK4#i|CKkqA*rLOdyYu@Z#t7bgYWwL`OH
z3P6S+Ut(d@WJ`67vD+REZmp+tyFuNF#ogU(?qW_AWbW^6R?*z=Ee74qOC9R&ZQQ`Q
znTscDL{Y?w^2n6aM;C#L90;SN2?LNCN28>tqaKpgX%va0LrH@W4T&bFQU;YJ2uMjO
zaZ@g6i=|FFqpdY5^mUHMhNDVZj#c?YJug2qV4g~x(L8z8EbP}>p8nRtI!3A9GmnDT
zi9USRnChkJch`WyUm_=w3)m4*>wj)1Q2N<eA^kK~h4t8$R!po{%zmfK`hCwIqU)*p
z!TG+*Ux&88gwr!zg=kAHA4N%-uL>HfZbRZH#C_rR1ge!kAt)I)3(M6HEC)Cti-nDi
zb2Bqc%+0)BO?E=aMiGLE`wNG;?nF6>>w88w;%f}eVbh9_f6LviYW05SG&_#|`1>Qj
ze)`s~?(8q9`cI_zUFnhBV*3H$h}X>`wkTHgvU_IdT%@wIlaf5<VoX88lqM4DiU75t
zX+px#OP~)#Ekg?|w%pJP5TObvp`5tU2X{{>#xab3a!6Si1$CGWMGVPkX+{Z3Q;7@R
z1klkn-Duc_byaI31O<@wyH3Nf_<Jgef+2`tVelT0PN`KL%Du`6J(WAfOA@MzWU~Ok
zH3sYr!$!$DdL)BH?CgkDu<{+S2D^5meba^M9dtDs>+Shpr|nVn3^Q1JUaRtsRXspy
zJgHd%1Ki$JMIuGx4EPE%9PBF!voN2N;)WoluH%9CmiE`ei6oLSjw+raJOTjCdE#N1
zIhcy!fIm8>2o9AmV-*PzUy3YIa$bROY1;#hV`{A?w>{JcVB8sxrM|RzV+d7pg{Xf}
zAgKXhqh&*-9e3r-HI3wZa+TFvkHY%rQ|@dK=r}JB<HX^^Uw(l{xT&a`f{PU%%KwU{
z0MZyM=`JhWRBgA4r{w%^pVmD5o-EIB*0-jdqm=p9F`0@PB*hk5(HhF5)4QwBzTQQG
z=D-vNBa%46VS|jcAuuFB#E5(y;QQVcF%yXmqbTfi28m>vriSlx;=S*)(!Gv41Brt3
zzce=?y3Q=cq?5u}#xaa%(%K}PI<@j(D!@eKsY;EZWr2VeCCx`JPpR~KRXd%)SXS_9
zrk~)w&w=_X`qF)nKC6T5DY{h|o#&>%7{)P-V;+4OAtWB)^r}JX9RsD79S(f!YGC0-
z5sYIP#xdb14Nb_MktsUYh*U+3Wdj97P#?Gu2M4GS_SB5cBQmC-zPm!i?7vU5=-L|-
zX7=pa_xvh*sz*kYB^n3F?p-J-qA`x?)KXbx)Yi8omIg;>?-#6I!|3f)`c*Qj`3GRQ
zGXkfi-=H_)R_v&!Jm!|FQ-(<ph>1mXh8i@8h7c%Kyv(r3Q4NF^j8Pok3L&9|m;@@`
zW?8AjNPgWSFAPXaG9cT<1tF#)1<MWK2<p&=^k|{d8Gk#V<pLTY2V^4QA~kZ%%LNhu
zm?8s*1>yvFB~612HrU*Vn<YbG5K62R6G5D^)ueTT!V4s%-MeT@t&*ww1|y~6&rD-<
z?0rL{Bcw3WoO%;t9h|)e(KXN<4v^4c4!20^Q&$U4@GOa=o$VmZ+8Qi^?V1kCIy>5Q
z3D}fYsCtPAr+6u61++Dc>^rA@^lekW;nSQvRe0)<thDbuLuNbhF@T2ztkVSM6lepx
z9S?e>CtHV2081znjT<$`#OAtt-E$GL4`>{D9T=g%Eh)|MErOm7gw#WUmtAaeS7zNN
z0(8MNrUFnl;@oD{gIY}t8Q=;$L}Hm$BNt92@SNFd+1xJXm+-r}z9De}MTU@yT5<`b
zEm)})4@@lGDH%s$AQat$TdE-hy`oOrHUiO9xH=*jVp7|(f*WWA#9m+kRGqv;(DVz3
z89D*pks;#{aYg3BrU8Id)X8P3GffPKgMArcfwXTZ%n6Nx9B2xTC{ngG^#u*DWpvJ}
zbqt`)s$G*l@vYR4e12)X;lqCrmWIIvykIzgGSMYqh+oAAy)0HE&e3f`X5^UWPE9#P
z!3a$!S!JI(Dhh+IUs>p`yQ;WYAzNBZOiW!wt<sx}z{wHF7~lj$@hYW(6F`KjvZSj8
z1QdZ&2$DWd(LgCb8|yjvUYDGCr=s_s^US`h7nM(o3K-io_rhVU9}mTiP#UNQZf^rh
z3&m-gxai%Zf%ax*Ym~V%K9rDTTF9=|D5$6SG9XSfV~#qq>%2G@Rz3=rVuy%~J@Bo3
z*6{UfN}rPy+&X8{h3H+xF5>8hgP_VtcM&2)?5crjm@qM!=Dm|}p6H<-^?aEc!|2;z
zIdl=oib@mU*d_fXKH&&w`Ns|+AfUoD63Zhg3PD2xZpJcYWr$`KFS#Xh*|IWetuP?~
zk%@<EKtIjp>h?$*iR9=Iwl|iTOa?bsQw_1is4du3GX+*MMKZ!GETBCL-lx_oSU^Sv
z2%IqEDbiP#3CYz8N0Q5sX?+LZdoQ_s)joQgu*Nrl#bj?K*Wt~9nlUyMmatf1V3P!a
zh7oPHnliDD0?Df(X`GoYwMbxui5yYdiz-4SCe#o#ks1b6!ZjF7jT%N&9GKW<M6enS
zN(=T-C6n3fpCy-)M5!k#r5I5IK+Fvh)2Uy5)5!=yCT12%ork<|@ubOLBIyb(-U@6f
z&g|GRK#Gwdb@uo5f*ONhK3qfOZ%3iCh-nY6d0G`Al~dlMswjeBiGzovW*RX-DZ1$m
z1JZdO!z408D=gmT3WNk02*Fqi%OMiMBob1>%MwV^LnOlpPzeZ3hoST#G8C~2F$*{<
zdrBFVXsXgDyej#l@ltzy{*ID-?%ok@7-a7YKMEGb_3o63WT$yVwQ-gPk9i}ECuuiM
zHDVGOA!ZnH1Hdr|g%jIYE|JihLLm^mB@*<xXz3gc1)C;_>8%5!ERqHV7#eIg8@zUG
zO)_<cX5oeyD2mdQ#%5+EsrIZ{dQ?Ya>=kSGh3<N9O~{>9yb9tiohW8rTNRavJyC!J
z@V^yPI3grCJy2qC>LgrU;A8=k6(AkDqt$wyf0Ck?h71-UFlk<vD#j|xo{W^k4M5R9
zLlKNOCZXwNOjc}7A?b>+!(_8m^kB;xrKRZ^P1R{FDE4|*Y^FUjY^IG;u}?%iimxG8
z*o)mS$X}GdwSR2<d{HTP6+5Xbx*gDWMqx6tQ@E=_9zv`s0z?OpsU*Q8+$D<z+%g!h
z=~%I4k=-FEOEMlvN)zNFL?@EO9!Pf=-Y&$$u~PJQl<Ae*L$!+48kSPKW!kY?lSwjH
zYId_xs=e%!BQ%zk8AIO~F=8yDyG;p{cB=)YX<e+AgkXAtTm;9|5nwP%`jSsK&l!(o
z7xUEq+7E!nNl%{m3b6*1SdzPzD9W&HBT^S}Rt<`@De$r@3>MI|LGTTfVvFG!QHh4&
zwIqBb&A`yFf-xpljjEaw^H@VBEy<-Xg<?!rZicBo6A56$bxl-!CPd0Hx{XueiezJH
z8VleU+^r+vwx(40Evb<DYhxqhyB5AWW8!)gyWw}CJF4%a7%?ofD#EGpq-2H>g<^&A
zj8QN`1tTE{!~+UJ2@NaUjM76%V0>j5RLEdpWs1brp%zvt-pNKLD;W%8F^mRAWd?z&
zC5dFdB{3w*uuP;{RtLle0Z6GDR)l6DD1mS?35vyhQeaG2VK86;fD(Zq5~@i=kjTVP
zfeL}<BEl&JF%uy|NHPe@FrnrPD1=Z$0ScJ4O0bNJ;*$trg9{YZ8dAu?d{nYVF=Ap^
zkkuF;7-3Aw8YZeRVSGx&vm-^QSY&);$ySD>WqfN&ni>{a@fcQ1Pm5AAtvoGNWnLB*
zHp4%ccl<uTjz{rSP(Q-YqxMsPj|uz%561N$FVvtYaZG}cl7T?7Lb4F7B&0J0K?43v
z08*6t`W@fp39#8H(3B~nhVbJ4SNfmN<Eosh1<CzOG3!VA6+eG>?96cz93le*Jwl$M
zh?v229_UJcb<GW;zj1`a1jZSEU_Yh0{@lKLRbeXh)lRk{a3S;I2yMi742XPw9}lrX
z2X!K%)`<jOFL@M1z5A46MTd%(+J(0gAt$U85gAfhez+P9KwcpP(Nfr=0Q~=m;2EfM
z6EBp%x|O1yYxgo_o<)!9uPq3FR6dBTBli8p3)ec_<!@~l&U~H#{>3PO9{^N+0>H>g
zFi9Xp#1T&$K)nk#LPR8z$v5FV_rw{Hl8Pk>DM9Uxb-!*y_P=TNmRSg0wG6m2Ot`5!
zT?|IxxNAP#N;5~;YNR?bKn?1f!+?_n0f7LR7DMqkJzrvEfc>wzMihXgF_>6}?){fI
zT+(qJm+>E?^_Oeg7x=139}mcI4{(QI!V(ch7l@^OY%JiD;g#v5!k!V~T+({$*H2hJ
z@jmhOhu#)gSz}pQU`~nRQ2MC~Ms%bpxP1-c7nh)3hu)uf{rkUW<pdwG4+tXRe4-eL
z9}oecTq24hf+(XZxEV7Y5q`HkIp$6ex~I)k^mLrkI-?+B%lpx)da8Y%2=R}*kRG0m
zAb1}yf75NZcH4IUNtIFZ{~R*uX4#m-sn;?|lQSS>%))hk`CjM5J|Xn;hk4!INPEJH
z%4zT<JPA;X23Cg9v?-cm(%WuAp)M-9w79WJ+k$Yqc4W9Nd>ik43MirsVH^;(3@yT0
zP?vbAEjZNXFktUPc)<uJW-<OPT8j)mOi!=Db>%+9dp=K9l!``hcRQI>%rg!7$PxsS
zP>G~;{T!QUnV{I>OKO6Td<KtFihNZrD=s8#(vjZ)%Oj^Af80KFdy4fV%h;Afwd<Bk
z2fZLDXRUysW32`nM1g&mvaJuXXkTHaeTIfp?Y}4Gey{8P!F<x!Q8f)$P&IW^P&IW8
zY*1_ju@b~stS2btSg@`_<ycu+m0XEoh+e^vflk6np*sL6Q1zH(Up6sU%#37TGZ;Q<
zpE7>Au<fu8$nCJ32FtJ;J1MXmI|k4;Ha&=a()5GTm61IqJu(?4F+<Rqko3r8OvGM>
zWO^A{Q^^@vFCk>II_xl6F+7ZfkVyInVwChlG$G_ZQ664Lk?0Hp`)w`#=E{!3j>0C;
zRUj&xEDIJQK}!X8QqXob8`AK<)Q_N8BLpBoLlF>rz&~RE423d?Yw4=Q&7p{33H1nd
zIt>o0qEMh!g&C6!qcK(YNq$^NTb2tW5{$ttLnJX)B*lIjh}K3GWK1zb6<G;^VlihO
zYE5XRyI|3Ze#=8jGP8^sjRz5;nzMK_hSY2+5JnQ4(u;_UDFXtqjDSGO1c4%wkdn%f
z!caN*MEZ>%%<@i%k{A%lKbjw}png!JXnBZf4=RxkgAmKZh*x$cp>fkF=VxWD@`fi=
z&6w`wx+g%S6G5&=62i6FWz0otp$XN|xn>gVxub=)>{XB<tSP*%sp#gkNd-yVy*c7(
z$5J>(_DTsubzDtuQ5=T{9hMlZivrly*lScSDsOsrXet0%q!U$!6I5BHXov`ZrQrR@
z=_hs-{&|Y;)(r1;3sQG(@gTFCx;pcZ_PX;697jdsPb)B7sPL1qakbc<QtmWdxIAv!
zTmiy|Q2Y7*lqFBxgaaW3DpJIPQ%h6}Aq0etDG@^h0TK}*0|3PXBS}da5)!}P>D~v1
zK*~RoPj&7;u@aaM5dqM6`hG_dv1L^EAMpfNm<X@=REAO>yYQW|^-tX%dNnWeRoy?J
Pzy2=dig2MIz~qsxrm1(z

literal 0
HcmV?d00001

diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/_helpers.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/_helpers.yaml
new file mode 100644
index 00000000..65e96fc6
--- /dev/null
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/_helpers.yaml
@@ -0,0 +1,13 @@
+{{- define "crds.upgrade.name" -}}
+{{- print (include "vm.plain.fullname" .) "-upgrade-crds" }}
+{{- end -}}
+
+{{- define "crds.upgrade.serviceAccountName" -}}
+{{- $Values := (.helm).Values | default .Values }}
+{{- $upgrade := $Values.upgrade }}
+{{- if $upgrade.serviceAccount.create -}}
+    {{ default (include "crds.upgrade.name" .) $upgrade.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" $upgrade.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/cm.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/cm.yaml
new file mode 100644
index 00000000..40cd8ed5
--- /dev/null
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/cm.yaml
@@ -0,0 +1,18 @@
+{{- if .Values.upgrade.enabled }}
+{{- $ctx := dict "helm" . }}
+{{- $upgrade := .Values.upgrade }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "crds.upgrade.serviceAccountName" $ctx }}
+  namespace: {{ template "vm.namespace" $ctx }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade,pre-rollback
+    "helm.sh/hook-weight": "-2"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+  {{- $_ := set $ctx "extraLabels" (dict "app.kubernetes.io/component" "upgrade-crds") }}
+  labels: {{ include "vm.labels" $ctx | nindent 4 }}
+  {{- $_ := unset $ctx "extraLabels" }}
+binaryData:
+  crd.yaml.bz2: {{ .Files.Get "files/crd.yaml.bz2" | b64enc }}
+{{- end }}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/job.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/job.yaml
new file mode 100644
index 00000000..2884157f
--- /dev/null
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/job.yaml
@@ -0,0 +1,126 @@
+{{- if .Values.upgrade.enabled }}
+{{- $app := .Values.upgrade }}
+{{- if empty (($app.kubectl).image).tag }}
+  {{- $tag := regexSplit "[+-]" .Capabilities.KubeVersion.Version -1 | first -}}
+  {{- $_ := set $app.kubectl.image "tag" $tag }}
+{{- else if not (kindIs "string" (($app.kubectl).image).tag) }}
+  {{- fail "`crd.upgrade.kubectl.image.tag` is not string, most probably you need to enquote provided value" -}}
+{{- end }}
+{{- $ctx := dict "helm" . "noEnterprise" true }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ template "crds.upgrade.name" $ctx }}
+  namespace: {{ template "vm.namespace" $ctx }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade,pre-rollback
+    "helm.sh/hook-weight": "5"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+    {{- with $app.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- $extraLabels := $app.labels | default dict }}
+  {{- $_ := set $ctx "extraLabels" $app.labels }}
+  {{- $_ := set $extraLabels "app.kubernetes.io/component" "upgrade-crds" }}
+  {{- $_ := set $ctx "extraLabels" $extraLabels }}
+  labels: {{ include "vm.labels" $ctx | nindent 4 }}
+  {{- $_ := unset $ctx "extraLabels" }}
+spec:
+  backoffLimit: 3
+  template:
+    metadata:
+      {{- with $app.podLabels }}
+      labels: {{ toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $app.podAnnotations }}
+      annotations: {{ toYaml . | nindent 8 }}
+      {{- end }}
+    spec:
+      {{- with (.Values.imagePullSecrets | default (.Values.global).imagePullSecrets) }}
+      imagePullSecrets: {{ toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "crds.upgrade.serviceAccountName" . }}
+      {{- if ($app.podSecurityContext).enabled }}
+      securityContext: {{ include "vm.securityContext" (dict "securityContext" $app.podSecurityContext "helm" .) | nindent 8 }}
+      {{- end }}
+      initContainers:
+        - name: busybox
+          {{- $_ := set $ctx "appKey" (list "upgrade" "busybox") }}
+          image: {{ include "vm.image" $ctx }}
+          imagePullPolicy: {{ $app.busybox.image.pullPolicy }}
+          workingDir: /tmp/
+          command:
+            - sh
+          args:
+            - -c
+            - bzcat /crds/crd.yaml.bz2 > /tmp/crd.yaml
+          {{- with $app.resources }}
+          resources: {{ toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with $app.securityContext }}
+          securityContext: {{ toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - mountPath: /crds/
+              name: crds
+            - mountPath: /tmp/
+              name: tmp
+            {{- with $app.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          {{- with $app.env }}
+          env: {{ toYaml . | nindent 12 }}
+          {{- end }}
+      containers:
+        - name: kubectl
+          {{- $_ := set $ctx "appKey" (list "upgrade" "kubectl") }}
+          image: {{ include "vm.image" $ctx }}
+          imagePullPolicy: {{ $app.kubectl.image.pullPolicy }}
+          command:
+            - kubectl
+          args:
+            - apply
+            - --server-side
+            {{- if $app.forceConflicts }}
+            - --force-conflicts
+            {{- end }}
+            - --filename
+            - /tmp/crd.yaml
+          {{- with $app.resources }}
+          resources: {{ toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with $app.securityContext }}
+          securityContext: {{ toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - mountPath: /tmp/
+              name: tmp
+            {{- with $app.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          {{- with $app.env }}
+          env: {{ toYaml . | nindent 12 }}
+          {{- end }}
+      volumes:
+        - name: tmp
+          emptyDir: {}
+        - name: crds
+          configMap:
+            name: {{ template "crds.upgrade.name" . }}
+        {{- with $app.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      restartPolicy: OnFailure
+      {{- with $app.nodeSelector }}
+      nodeSelector: {{ toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $app.tolerations }}
+      tolerations: {{ toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $app.affinity }}
+      affinity: {{ toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $app.topologySpreadConstraints }}
+      topologySpreadConstraints: {{ toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/role.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/role.yaml
new file mode 100644
index 00000000..7cb71a2d
--- /dev/null
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/role.yaml
@@ -0,0 +1,52 @@
+{{- if .Values.upgrade.enabled }}
+{{- $ctx := dict "helm" . }}
+{{- $_ := set $ctx "extraLabels" (dict "app.kubernetes.io/component" "upgrade-crds") }}
+{{- $labels := include "vm.labels" $ctx }}
+{{- $_ := unset $ctx "extraLabels" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "crds.upgrade.name" . }}
+  namespace: {{ template "vm.namespace" . }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade,pre-rollback
+    "helm.sh/hook-weight": "-5"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+  labels: {{ $labels | nindent 4 }}
+  {{- $crds := .Files.Get "crds/crd.yaml" | splitList "---" }}
+rules:
+  - apiGroups:
+      - "apiextensions.k8s.io"
+    resources:
+      - "customresourcedefinitions"
+    verbs:
+      - create
+      - patch
+      - update
+      - get
+      - list
+    resourceNames:
+      {{- range $crds }}
+        {{- $crd := fromYaml . }}
+      - {{ $crd.metadata.name }}
+      {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "crds.upgrade.name" . }}
+  namespace: {{ template "vm.namespace" . }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade,pre-rollback
+    "helm.sh/hook-weight": "-3"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+  labels: {{ $labels | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    namespace: {{ template "vm.namespace" . }}
+    name: {{ template "crds.upgrade.serviceAccountName" . }}
+roleRef:
+  kind: ClusterRole
+  name: {{ template "crds.upgrade.name" . }}
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/serviceaccount.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/serviceaccount.yaml
new file mode 100644
index 00000000..2fa0dc40
--- /dev/null
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/serviceaccount.yaml
@@ -0,0 +1,25 @@
+{{- $upgrade := .Values.upgrade }}
+{{- if and $upgrade.enabled $upgrade.serviceAccount.create }}
+{{- $ctx := dict "helm" . }}
+{{- $fullname := include "vm.plain.fullname" $ctx }}
+{{- $ns := include "vm.namespace" $ctx }}
+{{- $sa := $upgrade.serviceAccount }}
+apiVersion: v1
+kind: ServiceAccount
+automountServiceAccountToken: {{ $sa.automountServiceAccountToken }}
+metadata:
+  name: {{ include "crds.upgrade.name" . }}
+  namespace: {{ $ns }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade,pre-rollback
+    "helm.sh/hook-weight": "-4"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+    {{- with $sa.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- $extraLabels := $sa.labels | default dict }}
+  {{- $_ := set $extraLabels "app.kubernetes.io/component" "upgrade-crds" }}
+  {{- $_ := set $ctx "extraLabels" $extraLabels }}
+  labels: {{ include "vm.labels" $ctx | nindent 4 }}
+  {{- $_ := unset $ctx "extraLabels" }}
+{{- end }}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/values.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/values.yaml
index e69de29b..89715f32 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/values.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/values.yaml
@@ -0,0 +1,17 @@
+upgrade:
+  enabled: false
+  serviceAccount:
+    labels: {}
+    create: true
+  forceConflicts: false
+  busybox:
+    image:
+      repository: busybox
+      tag: latest
+      pullPolicy: IfNotPresent
+  kubectl:
+    image:
+      repository: rancher/kubectl
+      # use image tag that matches k8s API version by default
+      tag: ""
+      pullPolicy: IfNotPresent
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/.helmignore b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/.helmignore
index 2ccbd54f..e7746f26 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/.helmignore
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/.helmignore
@@ -20,5 +20,7 @@
 .idea/
 *.tmproj
 .vscode/
-*.md
 *.md.gotmpl
+CHANGELOG.md
+_changelog.md
+_index.md
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/Chart.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/Chart.yaml
index a90e9d6e..04aba91f 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/Chart.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/Chart.yaml
@@ -1,16 +1,20 @@
 annotations:
   artifacthub.io/category: monitoring-logging
   artifacthub.io/changes: |
-    - Support custom case for list empty argument.
+    - allow setting global labels for each resource using `.Values.global.extraLabels`. See [#2607](https://github.com/VictoriaMetrics/helm-charts/issues/2607).
   artifacthub.io/license: Apache-2.0
   artifacthub.io/links: |
     - name: Sources
       url: https://github.com/VictoriaMetrics/helm-charts/tree/master/charts/victoria-metrics-common
     - name: Charts repo
       url: https://victoriametrics.github.io/helm-charts/
+  artifacthub.io/readme: |
+    # VictoriaMetrics Common Helm chart
+
+    Chart documentation is available [here](https://docs.victoriametrics.com/helm/victoria-metrics-common/)
 apiVersion: v2
-description: Victoria Metrics Common - contains shared templates for all Victoria
-  Metrics helm charts
+description: VictoriaMetrics Common - contains shared templates for all Victoria Metrics
+  helm charts
 keywords:
 - victoriametrics
 - monitoring
@@ -25,4 +29,4 @@ name: victoria-metrics-common
 sources:
 - https://github.com/VictoriaMetrics/helm-charts
 type: library
-version: 0.0.42
+version: 0.0.46
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/README.md b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/README.md
new file mode 100644
index 00000000..9ba0b4f5
--- /dev/null
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/README.md
@@ -0,0 +1,3 @@
+# VictoriaMetrics Common Helm chart
+
+Chart documentation is available [here](https://docs.victoriametrics.com/helm/victoria-metrics-common/)
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/RELEASE_NOTES b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/RELEASE_NOTES
index 6de533d6..055cd4c5 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/RELEASE_NOTES
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/RELEASE_NOTES
@@ -1,7 +1,7 @@
-# Release notes for version 0.0.42
+# Release notes for version 0.0.46
 
-**Release date:** 19 Mar 2025
+**Release date:** 23 Dec 2025
 
 ![Helm: v3](https://img.shields.io/badge/Helm-v3.14%2B-informational?color=informational&logo=helm&link=https%3A%2F%2Fgithub.com%2Fhelm%2Fhelm%2Freleases%2Ftag%2Fv3.14.0)
 
-- Support custom case for list empty argument.
+- allow setting global labels for each resource using `.Values.global.extraLabels`. See [#2607](https://github.com/VictoriaMetrics/helm-charts/issues/2607).
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_enterprise.tpl b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_enterprise.tpl
index 1890e499..ffdc750d 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_enterprise.tpl
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_enterprise.tpl
@@ -36,7 +36,7 @@
   {{- if eq (include "vm.enterprise.disabled" .) "true" }}
     {{ fail `Pass valid license at .Values.license or .Values.global.license if you have an enterprise license for running this software.
        See https://victoriametrics.com/legal/esa/ for details.
-       Documentation - https://docs.victoriametrics.com/enterprise
+       Documentation - https://docs.victoriametrics.com/victoriametrics/enterprise/
        for more information, visit https://victoriametrics.com/products/enterprise/
        To request a trial license, go to https://victoriametrics.com/products/enterprise/trial/` }}
   {{- end -}}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_helpers.tpl b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_helpers.tpl
index 7983440f..99ac30d5 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_helpers.tpl
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_helpers.tpl
@@ -195,8 +195,10 @@ If release name contains chart name it will be used as a full name.
 {{- /* Common labels */ -}}
 {{- define "vm.labels" -}}
   {{- include "vm.validate.args" . -}}
+  {{- $Values := (.helm).Values | default .Values -}}
+  {{- $globalLabels := deepCopy (($Values.global).extraLabels | default dict) -}}
   {{- $labels := fromYaml (include "vm.selectorLabels" .) -}}
-  {{- $labels = mergeOverwrite $labels (fromYaml (include "vm.metaLabels" .)) -}}
+  {{- $labels = mergeOverwrite $globalLabels $labels (fromYaml (include "vm.metaLabels" .)) -}}
   {{- with (include "vm.image.tag" .) }}
     {{- $_ := set $labels "app.kubernetes.io/version" (regexReplaceAll "(.*)(@sha.*)" . "${1}") -}}
   {{- end -}}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_image.tpl b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_image.tpl
index cae561dd..6d30bd03 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_image.tpl
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_image.tpl
@@ -49,7 +49,7 @@ Victoria Metrics Image
       {{- end -}}
     {{- end -}}
   {{- end -}}
-  {{- $image := ternary $ctx.image $values.image (hasKey $ctx "image") -}}
+  {{- $image := ternary (deepCopy ($ctx.image | default dict)) (deepCopy ($values.image | default dict)) (hasKey $ctx "image") -}}
   {{- if not $image.registry }}
     {{- if (($Values.global).image).registry -}}
       {{- $_ := set $image "registry" (($Values.global).image).registry -}}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/crd.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/crd.yaml
index 038cc276..d54c82eb 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/crd.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/crd.yaml
@@ -2,7 +2,218 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: vlagents.operator.victoriametrics.com
+spec:
+  group: operator.victoriametrics.com
+  names:
+    kind: VLAgent
+    listKind: VLAgentList
+    plural: vlagents
+    singular: vlagent
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: current number of replicas
+      jsonPath: .status.replicas
+      name: Replica Count
+      type: integer
+    - description: Current status of update rollout
+      jsonPath: .status.updateStatus
+      name: Status
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            type: string
+          kind:
+            type: string
+          metadata:
+            type: object
+          spec:
+            required:
+            - remoteWrite
+            type: object
+            x-kubernetes-preserve-unknown-fields: true
+          status:
+            properties:
+              conditions:
+                items:
+                  properties:
+                    lastTransitionTime:
+                      format: date-time
+                      type: string
+                    lastUpdateTime:
+                      format: date-time
+                      type: string
+                    message:
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      maxLength: 1024
+                      minLength: 1
+                      type: string
+                    status:
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      maxLength: 316
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - lastUpdateTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              observedGeneration:
+                format: int64
+                type: integer
+              reason:
+                type: string
+              replicas:
+                format: int32
+                type: integer
+              selector:
+                type: string
+              updateStatus:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      scale:
+        labelSelectorPath: .status.selector
+        specReplicasPath: .spec.shardCount
+        statusReplicasPath: .status.shards
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: vlclusters.operator.victoriametrics.com
+spec:
+  group: operator.victoriametrics.com
+  names:
+    kind: VLCluster
+    listKind: VLClusterList
+    plural: vlclusters
+    singular: vlcluster
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: replicas of VLInsert
+      jsonPath: .spec.vlinsert.replicaCount
+      name: Insert Count
+      type: string
+    - description: replicas of VLStorage
+      jsonPath: .spec.vlstorage.replicaCount
+      name: Storage Count
+      type: string
+    - description: replicas of VLSelect
+      jsonPath: .spec.vlselect.replicaCount
+      name: Select Count
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: Current status of cluster
+      jsonPath: .status.updateStatus
+      name: Status
+      type: string
+    name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            type: string
+          kind:
+            type: string
+          metadata:
+            type: object
+          spec:
+            type: object
+            x-kubernetes-preserve-unknown-fields: true
+          status:
+            properties:
+              conditions:
+                items:
+                  properties:
+                    lastTransitionTime:
+                      format: date-time
+                      type: string
+                    lastUpdateTime:
+                      format: date-time
+                      type: string
+                    message:
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      maxLength: 1024
+                      minLength: 1
+                      type: string
+                    status:
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      maxLength: 316
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - lastUpdateTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              observedGeneration:
+                format: int64
+                type: integer
+              reason:
+                type: string
+              updateStatus:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vlogs.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -24,1041 +235,47 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: |-
-          VLogs is fast, cost-effective and scalable logs database.
-          VLogs is the Schema for the vlogs API
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VLogsSpec defines the desired state of VLogs
-            properties:
-              affinity:
-                description: Affinity If specified, the pod's scheduling constraints.
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              configMaps:
-                description: |-
-                  ConfigMaps is a list of ConfigMaps in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/configs/CONFIGMAP_NAME folder
-                items:
-                  type: string
-                type: array
-              containers:
-                description: |-
-                  Containers property allows to inject additions sidecars or to patch existing containers.
-                  It can be useful for proxies, backup, etc.
-                items:
-                  description: A single application container that you want to run
-                    within a pod.
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              disableAutomountServiceAccountToken:
-                description: |-
-                  DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
-                  Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
-                  For example, vmagent and vm-config-reloader requires k8s API access.
-                  Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
-                  And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
-                type: boolean
-              disableSelfServiceScrape:
-                description: |-
-                  DisableSelfServiceScrape controls creation of VMServiceScrape by operator
-                  for the application.
-                  Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable
-                type: boolean
-              dnsConfig:
-                description: |-
-                  Specifies the DNS parameters of a pod.
-                  Parameters specified here will be merged to the generated DNS
-                  configuration based on DNSPolicy.
-                items:
-                  x-kubernetes-preserve-unknown-fields: true
-                properties:
-                  nameservers:
-                    description: |-
-                      A list of DNS name server IP addresses.
-                      This will be appended to the base nameservers generated from DNSPolicy.
-                      Duplicated nameservers will be removed.
-                    items:
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  options:
-                    description: |-
-                      A list of DNS resolver options.
-                      This will be merged with the base options generated from DNSPolicy.
-                      Duplicated entries will be removed. Resolution options given in Options
-                      will override those that appear in the base DNSPolicy.
-                    items:
-                      description: PodDNSConfigOption defines DNS resolver options
-                        of a pod.
-                      properties:
-                        name:
-                          description: |-
-                            Name is this DNS resolver option's name.
-                            Required.
-                          type: string
-                        value:
-                          description: Value is this DNS resolver option's value.
-                          type: string
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  searches:
-                    description: |-
-                      A list of DNS search domains for host-name lookup.
-                      This will be appended to the base search paths generated from DNSPolicy.
-                      Duplicated search paths will be removed.
-                    items:
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: atomic
-                type: object
-              dnsPolicy:
-                description: DNSPolicy sets DNS policy for the pod
-                type: string
-              extraArgs:
-                additionalProperties:
-                  type: string
-                description: |-
-                  ExtraArgs that will be passed to the application container
-                  for example remoteWrite.tmpDataPath: /tmp
-                type: object
-              extraEnvs:
-                description: ExtraEnvs that will be passed to the application container
-                items:
-                  description: EnvVar represents an environment variable present in
-                    a Container.
-                  properties:
-                    name:
-                      description: Name of the environment variable. Must be a C_IDENTIFIER.
-                      type: string
-                    value:
-                      description: |-
-                        Variable references $(VAR_NAME) are expanded
-                        using the previously defined environment variables in the container and
-                        any service environment variables. If a variable cannot be resolved,
-                        the reference in the input string will be unchanged. Double $$ are reduced
-                        to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                        "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                        Escaped references will never be expanded, regardless of whether the variable
-                        exists or not.
-                        Defaults to "".
-                      type: string
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              extraEnvsFrom:
-                description: |-
-                  ExtraEnvsFrom defines source of env variables for the application container
-                  could either be secret or configmap
-                items:
-                  description: EnvFromSource represents the source of a set of ConfigMaps
-                  properties:
-                    configMapRef:
-                      description: The ConfigMap to select from
-                      properties:
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the ConfigMap must be defined
-                          type: boolean
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    prefix:
-                      description: An optional identifier to prepend to each key in
-                        the ConfigMap. Must be a C_IDENTIFIER.
-                      type: string
-                    secretRef:
-                      description: The Secret to select from
-                      properties:
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the Secret must be defined
-                          type: boolean
-                      type: object
-                      x-kubernetes-map-type: atomic
-                  type: object
-                type: array
-              futureRetention:
-                description: |-
-                  FutureRetention for the stored logs
-                  Log entries with timestamps bigger than now+futureRetention are rejected during data ingestion; see https://docs.victoriametrics.com/victorialogs/#retention
-                type: string
-              host_aliases:
-                description: |-
-                  HostAliasesUnderScore provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
-                  Has Priority over hostAliases field
-                items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
-                  properties:
-                    hostnames:
-                      description: Hostnames for the above IP address.
-                      items:
-                        type: string
-                      type: array
-                      x-kubernetes-list-type: atomic
-                    ip:
-                      description: IP address of the host file entry.
-                      type: string
-                  required:
-                  - ip
-                  type: object
-                type: array
-              hostAliases:
-                description: |-
-                  HostAliases provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
-                items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
-                  properties:
-                    hostnames:
-                      description: Hostnames for the above IP address.
-                      items:
-                        type: string
-                      type: array
-                      x-kubernetes-list-type: atomic
-                    ip:
-                      description: IP address of the host file entry.
-                      type: string
-                  required:
-                  - ip
-                  type: object
-                type: array
-              hostNetwork:
-                description: HostNetwork controls whether the pod may use the node
-                  network namespace
-                type: boolean
-              image:
-                description: |-
-                  Image - docker image settings
-                  if no specified operator uses default version from operator config
-                properties:
-                  pullPolicy:
-                    description: PullPolicy describes how to pull docker image
-                    type: string
-                  repository:
-                    description: Repository contains name of docker image + it's repository
-                      if needed
-                    type: string
-                  tag:
-                    description: Tag contains desired docker image version
-                    type: string
-                type: object
-              imagePullSecrets:
-                description: |-
-                  ImagePullSecrets An optional list of references to secrets in the same namespace
-                  to use for pulling images from registries
-                  see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
-                items:
-                  description: |-
-                    LocalObjectReference contains enough information to let you locate the
-                    referenced object inside the same namespace.
-                  properties:
-                    name:
-                      default: ""
-                      description: |-
-                        Name of the referent.
-                        This field is effectively required, but due to backwards compatibility is
-                        allowed to be empty. Instances of this type with an empty value here are
-                        almost certainly wrong.
-                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                      type: string
-                  type: object
-                  x-kubernetes-map-type: atomic
-                type: array
-              initContainers:
-                description: |-
-                  InitContainers allows adding initContainers to the pod definition.
-                  Any errors during the execution of an initContainer will lead to a restart of the Pod.
-                  More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
-                items:
-                  description: A single application container that you want to run
-                    within a pod.
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              livenessProbe:
-                description: LivenessProbe that will be added CRD pod
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              logFormat:
-                description: LogFormat for VLogs to be configured with.
-                enum:
-                - default
-                - json
-                type: string
-              logIngestedRows:
-                description: Whether to log all the ingested log entries; this can
-                  be useful for debugging of data ingestion; see https://docs.victoriametrics.com/victorialogs/data-ingestion/
-                type: boolean
-              logLevel:
-                description: LogLevel for VictoriaLogs to be configured with.
-                enum:
-                - INFO
-                - WARN
-                - ERROR
-                - FATAL
-                - PANIC
-                type: string
-              logNewStreams:
-                description: LogNewStreams Whether to log creation of new streams;
-                  this can be useful for debugging of high cardinality issues with
-                  log streams; see https://docs.victoriametrics.com/victorialogs/keyconcepts/#stream-fields
-                type: boolean
-              managedMetadata:
-                description: |-
-                  ManagedMetadata defines metadata that will be added to the all objects
-                  created by operator for the given CustomResource
-                properties:
-                  annotations:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                    type: object
-                  labels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                    type: object
-                type: object
-              minReadySeconds:
-                description: |-
-                  MinReadySeconds defines a minimum number of seconds to wait before starting update next pod
-                  if previous in healthy state
-                  Has no effect for VLogs and VMSingle
-                format: int32
-                type: integer
-              nodeSelector:
-                additionalProperties:
-                  type: string
-                description: NodeSelector Define which Nodes the Pods are scheduled
-                  on.
-                type: object
-              paused:
-                description: |-
-                  Paused If set to true all actions on the underlying managed objects are not
-                  going to be performed, except for delete actions.
-                type: boolean
-              podMetadata:
-                description: PodMetadata configures Labels and Annotations which are
-                  propagated to the VLogs pods.
-                properties:
-                  annotations:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                    type: object
-                  labels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects. May match selectors of replication controllers
-                      and services.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                    type: object
-                  name:
-                    description: |-
-                      Name must be unique within a namespace. Is required when creating resources, although
-                      some resources may allow a client to request the generation of an appropriate name
-                      automatically. Name is primarily intended for creation idempotence and configuration
-                      definition.
-                      Cannot be updated.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                    type: string
-                type: object
-              port:
-                description: Port listen address
-                type: string
-              priorityClassName:
-                description: PriorityClassName class assigned to the Pods
-                type: string
-              readinessGates:
-                description: ReadinessGates defines pod readiness gates
-                items:
-                  description: PodReadinessGate contains the reference to a pod condition
-                  properties:
-                    conditionType:
-                      description: ConditionType refers to a condition in the pod's
-                        condition list with matching type.
-                      type: string
-                  required:
-                  - conditionType
-                  type: object
-                type: array
-              readinessProbe:
-                description: ReadinessProbe that will be added CRD pod
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              removePvcAfterDelete:
-                description: |-
-                  RemovePvcAfterDelete - if true, controller adds ownership to pvc
-                  and after VLogs object deletion - pvc will be garbage collected
-                  by controller manager
-                type: boolean
-              replicaCount:
-                description: ReplicaCount is the expected size of the Application.
-                format: int32
-                type: integer
-              resources:
-                description: |-
-                  Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
-                properties:
-                  claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
-                    items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
-                      properties:
-                        name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
-                          type: string
-                        request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
-                          type: string
-                      required:
-                      - name
-                      type: object
-                    type: array
-                    x-kubernetes-list-map-keys:
-                    - name
-                    x-kubernetes-list-type: map
-                  limits:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                  requests:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                type: object
-              retentionPeriod:
-                description: RetentionPeriod for the stored logs
-                type: string
-              revisionHistoryLimitCount:
-                description: |-
-                  The number of old ReplicaSets to retain to allow rollback in deployment or
-                  maximum number of revisions that will be maintained in the Deployment revision history.
-                  Has no effect at StatefulSets
-                  Defaults to 10.
-                format: int32
-                type: integer
-              runtimeClassName:
-                description: |-
-                  RuntimeClassName - defines runtime class for kubernetes pod.
-                  https://kubernetes.io/docs/concepts/containers/runtime-class/
-                type: string
-              schedulerName:
-                description: SchedulerName - defines kubernetes scheduler name
-                type: string
-              secrets:
-                description: |-
-                  Secrets is a list of Secrets in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/secrets/SECRET_NAME folder
-                items:
-                  type: string
-                type: array
-              securityContext:
-                description: |-
-                  SecurityContext holds pod-level security attributes and common container settings.
-                  This defaults to the default PodSecurityContext.
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              serviceAccountName:
-                description: ServiceAccountName is the name of the ServiceAccount
-                  to use to run the pods
-                type: string
-              serviceScrapeSpec:
-                description: ServiceScrapeSpec that will be added to vlogs VMServiceScrape
-                  spec
-                required:
-                - endpoints
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              serviceSpec:
-                description: ServiceSpec that will be added to vlogs service spec
-                properties:
-                  metadata:
-                    description: EmbeddedObjectMetadata defines objectMeta for additional
-                      service.
-                    properties:
-                      annotations:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Annotations is an unstructured key value map stored with a resource that may be
-                          set by external tools to store and retrieve arbitrary metadata. They are not
-                          queryable and should be preserved when modifying objects.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                        type: object
-                      labels:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Labels Map of string keys and values that can be used to organize and categorize
-                          (scope and select) objects. May match selectors of replication controllers
-                          and services.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                        type: object
-                      name:
-                        description: |-
-                          Name must be unique within a namespace. Is required when creating resources, although
-                          some resources may allow a client to request the generation of an appropriate name
-                          automatically. Name is primarily intended for creation idempotence and configuration
-                          definition.
-                          Cannot be updated.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                        type: string
-                    type: object
-                  spec:
-                    description: |-
-                      ServiceSpec describes the attributes that a user creates on a service.
-                      More info: https://kubernetes.io/docs/concepts/services-networking/service/
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  useAsDefault:
-                    description: |-
-                      UseAsDefault applies changes from given service definition to the main object Service
-                      Changing from headless service to clusterIP or loadbalancer may break cross-component communication
-                    type: boolean
-                required:
-                - spec
-                type: object
-              startupProbe:
-                description: StartupProbe that will be added to CRD pod
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              storage:
-                description: |-
-                  Storage is the definition of how storage will be used by the VLogs
-                  by default it`s empty dir
-                properties:
-                  accessModes:
-                    description: |-
-                      accessModes contains the desired access modes the volume should have.
-                      More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                    items:
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  dataSource:
-                    description: |-
-                      dataSource field can be used to specify either:
-                      * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
-                      * An existing PVC (PersistentVolumeClaim)
-                      If the provisioner or an external controller can support the specified data source,
-                      it will create a new volume based on the contents of the specified data source.
-                      When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-                      and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
-                      If the namespace is specified, then dataSourceRef will not be copied to dataSource.
-                    properties:
-                      apiGroup:
-                        description: |-
-                          APIGroup is the group for the resource being referenced.
-                          If APIGroup is not specified, the specified Kind must be in the core API group.
-                          For any other third-party types, APIGroup is required.
-                        type: string
-                      kind:
-                        description: Kind is the type of resource being referenced
-                        type: string
-                      name:
-                        description: Name is the name of resource being referenced
-                        type: string
-                    required:
-                    - kind
-                    - name
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  dataSourceRef:
-                    description: |-
-                      dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
-                      volume is desired. This may be any object from a non-empty API group (non
-                      core object) or a PersistentVolumeClaim object.
-                      When this field is specified, volume binding will only succeed if the type of
-                      the specified object matches some installed volume populator or dynamic
-                      provisioner.
-                      This field will replace the functionality of the dataSource field and as such
-                      if both fields are non-empty, they must have the same value. For backwards
-                      compatibility, when namespace isn't specified in dataSourceRef,
-                      both fields (dataSource and dataSourceRef) will be set to the same
-                      value automatically if one of them is empty and the other is non-empty.
-                      When namespace is specified in dataSourceRef,
-                      dataSource isn't set to the same value and must be empty.
-                      There are three important differences between dataSource and dataSourceRef:
-                      * While dataSource only allows two specific types of objects, dataSourceRef
-                        allows any non-core object, as well as PersistentVolumeClaim objects.
-                      * While dataSource ignores disallowed values (dropping them), dataSourceRef
-                        preserves all values, and generates an error if a disallowed value is
-                        specified.
-                      * While dataSource only allows local objects, dataSourceRef allows objects
-                        in any namespaces.
-                      (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
-                      (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                    properties:
-                      apiGroup:
-                        description: |-
-                          APIGroup is the group for the resource being referenced.
-                          If APIGroup is not specified, the specified Kind must be in the core API group.
-                          For any other third-party types, APIGroup is required.
-                        type: string
-                      kind:
-                        description: Kind is the type of resource being referenced
-                        type: string
-                      name:
-                        description: Name is the name of resource being referenced
-                        type: string
-                      namespace:
-                        description: |-
-                          Namespace is the namespace of resource being referenced
-                          Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
-                          (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                        type: string
-                    required:
-                    - kind
-                    - name
-                    type: object
-                  resources:
-                    description: |-
-                      resources represents the minimum resources the volume should have.
-                      If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
-                      that are lower than previous value but must still be higher than capacity recorded in the
-                      status field of the claim.
-                      More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
-                    properties:
-                      limits:
-                        additionalProperties:
-                          anyOf:
-                          - type: integer
-                          - type: string
-                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                          x-kubernetes-int-or-string: true
-                        description: |-
-                          Limits describes the maximum amount of compute resources allowed.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                        type: object
-                      requests:
-                        additionalProperties:
-                          anyOf:
-                          - type: integer
-                          - type: string
-                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                          x-kubernetes-int-or-string: true
-                        description: |-
-                          Requests describes the minimum amount of compute resources required.
-                          If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                          otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                        type: object
-                    type: object
-                  selector:
-                    description: selector is a label query over volumes to consider
-                      for binding.
-                    properties:
-                      matchExpressions:
-                        description: matchExpressions is a list of label selector
-                          requirements. The requirements are ANDed.
-                        items:
-                          description: |-
-                            A label selector requirement is a selector that contains values, a key, and an operator that
-                            relates the key and values.
-                          properties:
-                            key:
-                              description: key is the label key that the selector
-                                applies to.
-                              type: string
-                            operator:
-                              description: |-
-                                operator represents a key's relationship to a set of values.
-                                Valid operators are In, NotIn, Exists and DoesNotExist.
-                              type: string
-                            values:
-                              description: |-
-                                values is an array of string values. If the operator is In or NotIn,
-                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                the values array must be empty. This array is replaced during a strategic
-                                merge patch.
-                              items:
-                                type: string
-                              type: array
-                              x-kubernetes-list-type: atomic
-                          required:
-                          - key
-                          - operator
-                          type: object
-                        type: array
-                        x-kubernetes-list-type: atomic
-                      matchLabels:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                          operator is "In", and the values array contains only "value". The requirements are ANDed.
-                        type: object
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  storageClassName:
-                    description: |-
-                      storageClassName is the name of the StorageClass required by the claim.
-                      More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
-                    type: string
-                  volumeAttributesClassName:
-                    description: |-
-                      volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
-                      If specified, the CSI driver will create or update the volume with the attributes defined
-                      in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                      it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                      will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                      If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                      will be set by the persistentvolume controller if it exists.
-                      If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
-                      set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
-                      exists.
-                      More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                      (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
-                    type: string
-                  volumeMode:
-                    description: |-
-                      volumeMode defines what type of volume is required by the claim.
-                      Value of Filesystem is implied when not included in claim spec.
-                    type: string
-                  volumeName:
-                    description: volumeName is the binding reference to the PersistentVolume
-                      backing this claim.
-                    type: string
-                type: object
-              storageDataPath:
-                description: |-
-                  StorageDataPath disables spec.storage option and overrides arg for victoria-logs binary --storageDataPath,
-                  its users responsibility to mount proper device into given path.
-                type: string
-              storageMetadata:
-                description: StorageMeta defines annotations and labels attached to
-                  PVC for given vlogs CR
-                properties:
-                  annotations:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                    type: object
-                  labels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects. May match selectors of replication controllers
-                      and services.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                    type: object
-                  name:
-                    description: |-
-                      Name must be unique within a namespace. Is required when creating resources, although
-                      some resources may allow a client to request the generation of an appropriate name
-                      automatically. Name is primarily intended for creation idempotence and configuration
-                      definition.
-                      Cannot be updated.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                    type: string
-                type: object
-              terminationGracePeriodSeconds:
-                description: TerminationGracePeriodSeconds period for container graceful
-                  termination
-                format: int64
-                type: integer
-              tolerations:
-                description: Tolerations If specified, the pod's tolerations.
-                items:
-                  description: |-
-                    The pod this Toleration is attached to tolerates any taint that matches
-                    the triple <key,value,effect> using the matching operator <operator>.
-                  properties:
-                    effect:
-                      description: |-
-                        Effect indicates the taint effect to match. Empty means match all taint effects.
-                        When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                      type: string
-                    key:
-                      description: |-
-                        Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                        If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                      type: string
-                    operator:
-                      description: |-
-                        Operator represents a key's relationship to the value.
-                        Valid operators are Exists and Equal. Defaults to Equal.
-                        Exists is equivalent to wildcard for value, so that a pod can
-                        tolerate all taints of a particular category.
-                      type: string
-                    tolerationSeconds:
-                      description: |-
-                        TolerationSeconds represents the period of time the toleration (which must be
-                        of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                        it is not set, which means tolerate the taint forever (do not evict). Zero and
-                        negative values will be treated as 0 (evict immediately) by the system.
-                      format: int64
-                      type: integer
-                    value:
-                      description: |-
-                        Value is the taint value the toleration matches to.
-                        If the operator is Exists, the value should be empty, otherwise just a regular string.
-                      type: string
-                  type: object
-                type: array
-              topologySpreadConstraints:
-                description: |-
-                  TopologySpreadConstraints embedded kubernetes pod configuration option,
-                  controls how pods are spread across your cluster among failure-domains
-                  such as regions, zones, nodes, and other user-defined topology domains
-                  https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
-                items:
-                  description: TopologySpreadConstraint specifies how to spread matching
-                    pods among the given topology.
-                  required:
-                  - maxSkew
-                  - topologyKey
-                  - whenUnsatisfiable
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              useDefaultResources:
-                description: |-
-                  UseDefaultResources controls resource settings
-                  By default, operator sets built-in resource requirements
-                type: boolean
-              useStrictSecurity:
-                description: |-
-                  UseStrictSecurity enables strict security mode for component
-                  it restricts disk writes access
-                  uses non-root user out of the box
-                  drops not needed security permissions
-                type: boolean
-              volumeMounts:
-                description: |-
-                  VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
-                  VolumeMounts specified will be appended to other VolumeMounts in the Application container
-                items:
-                  description: VolumeMount describes a mounting of a Volume within
-                    a container.
-                  properties:
-                    mountPath:
-                      description: |-
-                        Path within the container at which the volume should be mounted.  Must
-                        not contain ':'.
-                      type: string
-                    mountPropagation:
-                      description: |-
-                        mountPropagation determines how mounts are propagated from the host
-                        to container and the other way around.
-                        When not set, MountPropagationNone is used.
-                        This field is beta in 1.10.
-                        When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                        (which defaults to None).
-                      type: string
-                    name:
-                      description: This must match the Name of a Volume.
-                      type: string
-                    readOnly:
-                      description: |-
-                        Mounted read-only if true, read-write otherwise (false or unspecified).
-                        Defaults to false.
-                      type: boolean
-                    recursiveReadOnly:
-                      description: |-
-                        RecursiveReadOnly specifies whether read-only mounts should be handled
-                        recursively.
-
-                        If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                        If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                        recursively read-only.  If this field is set to IfPossible, the mount is made
-                        recursively read-only, if it is supported by the container runtime.  If this
-                        field is set to Enabled, the mount is made recursively read-only if it is
-                        supported by the container runtime, otherwise the pod will not be started and
-                        an error will be generated to indicate the reason.
-
-                        If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                        None (or be unspecified, which defaults to None).
-
-                        If this field is not specified, it is treated as an equivalent of Disabled.
-                      type: string
-                    subPath:
-                      description: |-
-                        Path within the volume from which the container's volume should be mounted.
-                        Defaults to "" (volume's root).
-                      type: string
-                    subPathExpr:
-                      description: |-
-                        Expanded path within the volume from which the container's volume should be mounted.
-                        Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                        Defaults to "" (volume's root).
-                        SubPathExpr and SubPath are mutually exclusive.
-                      type: string
-                  required:
-                  - mountPath
-                  - name
-                  type: object
-                type: array
-              volumes:
-                description: |-
-                  Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
-                  Volumes specified will be appended to other volumes that are generated.
-                  / +optional
-                items:
-                  description: Volume represents a named volume in a pod that may
-                    be accessed by any container in the pod.
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
             required:
             - retentionPeriod
             type: object
+            x-kubernetes-preserve-unknown-fields: true
           status:
-            description: VLogsStatus defines the observed state of VLogs
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -1073,16 +290,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -1095,7 +307,99 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: vlsingles.operator.victoriametrics.com
+spec:
+  group: operator.victoriametrics.com
+  names:
+    kind: VLSingle
+    listKind: VLSingleList
+    plural: vlsingles
+    singular: vlsingle
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: Current status of logs instance update process
+      jsonPath: .status.status
+      name: Status
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            type: string
+          kind:
+            type: string
+          metadata:
+            type: object
+          spec:
+            type: object
+            x-kubernetes-preserve-unknown-fields: true
+          status:
+            properties:
+              conditions:
+                items:
+                  properties:
+                    lastTransitionTime:
+                      format: date-time
+                      type: string
+                    lastUpdateTime:
+                      format: date-time
+                      type: string
+                    message:
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      maxLength: 1024
+                      minLength: 1
+                      type: string
+                    status:
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      maxLength: 316
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - lastUpdateTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              observedGeneration:
+                format: int64
+                type: integer
+              reason:
+                type: string
+              updateStatus:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmagents.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -1125,4677 +429,47 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: |-
-          VMAgent - is a tiny but brave agent, which helps you collect metrics from various sources and stores them in VictoriaMetrics
-          or any other Prometheus-compatible storage system that supports the remote_write protocol.
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMAgentSpec defines the desired state of VMAgent
-            properties:
-              aPIServerConfig:
-                description: |-
-                  APIServerConfig allows specifying a host and auth methods to access apiserver.
-                  If left empty, VMAgent is assumed to run inside of the cluster
-                  and will discover API servers automatically and use the pod's CA certificate
-                  and bearer token file at /var/run/secrets/kubernetes.io/serviceaccount/.
-                  aPIServerConfig is deprecated use apiServerConfig instead
-                required:
-                - host
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              additionalScrapeConfigs:
-                description: |-
-                  AdditionalScrapeConfigs As scrape configs are appended, the user is responsible to make sure it
-                  is valid. Note that using this feature may expose the possibility to
-                  break upgrades of VMAgent. It is advised to review VMAgent release
-                  notes to ensure that no incompatible scrape configs are going to break
-                  VMAgent after the upgrade.
-                properties:
-                  key:
-                    description: The key of the secret to select from.  Must be a
-                      valid secret key.
-                    type: string
-                  name:
-                    default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                    type: string
-                  optional:
-                    description: Specify whether the Secret or its key must be defined
-                    type: boolean
-                required:
-                - key
-                type: object
-                x-kubernetes-map-type: atomic
-              affinity:
-                description: Affinity If specified, the pod's scheduling constraints.
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              apiServerConfig:
-                description: |-
-                  APIServerConfig allows specifying a host and auth methods to access apiserver.
-                  If left empty, VMAgent is assumed to run inside of the cluster
-                  and will discover API servers automatically and use the pod's CA certificate
-                  and bearer token file at /var/run/secrets/kubernetes.io/serviceaccount/.
-                properties:
-                  authorization:
-                    description: Authorization configures generic authorization params
-                    properties:
-                      credentials:
-                        description: Reference to the secret with value for authorization
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      credentialsFile:
-                        description: File with value for authorization
-                        type: string
-                      type:
-                        description: Type of authorization, default to bearer
-                        type: string
-                    type: object
-                  basicAuth:
-                    description: BasicAuth allow an endpoint to authenticate over
-                      basic authentication
-                    properties:
-                      password:
-                        description: |-
-                          Password defines reference for secret with password value
-                          The secret needs to be in the same namespace as scrape object
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      password_file:
-                        description: |-
-                          PasswordFile defines path to password file at disk
-                          must be pre-mounted
-                        type: string
-                      username:
-                        description: |-
-                          Username defines reference for secret with username value
-                          The secret needs to be in the same namespace as scrape object
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  bearerToken:
-                    description: Bearer token for accessing apiserver.
-                    type: string
-                  bearerTokenFile:
-                    description: File to read bearer token for accessing apiserver.
-                    type: string
-                  host:
-                    description: |-
-                      Host of apiserver.
-                      A valid string consisting of a hostname or IP followed by an optional port number
-                    type: string
-                  tlsConfig:
-                    description: TLSConfig Config to use for accessing apiserver.
-                    properties:
-                      ca:
-                        description: Struct containing the CA cert to use for the
-                          targets.
-                        properties:
-                          configMap:
-                            description: ConfigMap containing data to use for the
-                              targets.
-                            properties:
-                              key:
-                                description: The key to select.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the ConfigMap or its
-                                  key must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          secret:
-                            description: Secret containing data to use for the targets.
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                        type: object
-                      caFile:
-                        description: Path to the CA cert in the container to use for
-                          the targets.
-                        type: string
-                      cert:
-                        description: Struct containing the client cert file for the
-                          targets.
-                        properties:
-                          configMap:
-                            description: ConfigMap containing data to use for the
-                              targets.
-                            properties:
-                              key:
-                                description: The key to select.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the ConfigMap or its
-                                  key must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          secret:
-                            description: Secret containing data to use for the targets.
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                        type: object
-                      certFile:
-                        description: Path to the client cert file in the container
-                          for the targets.
-                        type: string
-                      insecureSkipVerify:
-                        description: Disable target certificate validation.
-                        type: boolean
-                      keyFile:
-                        description: Path to the client key file in the container
-                          for the targets.
-                        type: string
-                      keySecret:
-                        description: Secret containing the client key file for the
-                          targets.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      serverName:
-                        description: Used to verify the hostname for the targets.
-                        type: string
-                    type: object
-                required:
-                - host
-                type: object
-              arbitraryFSAccessThroughSMs:
-                description: |-
-                  ArbitraryFSAccessThroughSMs configures whether configuration
-                  based on EndpointAuth can access arbitrary files on the file system
-                  of the VMAgent container e.g. bearer token files, basic auth, tls certs
-                properties:
-                  deny:
-                    type: boolean
-                type: object
-              claimTemplates:
-                description: ClaimTemplates allows adding additional VolumeClaimTemplates
-                  for VMAgent in StatefulMode
-                items:
-                  description: PersistentVolumeClaim is a user's request for and claim
-                    to a persistent volume
-                  properties:
-                    apiVersion:
-                      description: |-
-                        APIVersion defines the versioned schema of this representation of an object.
-                        Servers should convert recognized schemas to the latest internal value, and
-                        may reject unrecognized values.
-                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-                      type: string
-                    kind:
-                      description: |-
-                        Kind is a string value representing the REST resource this object represents.
-                        Servers may infer this from the endpoint the client submits requests to.
-                        Cannot be updated.
-                        In CamelCase.
-                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-                      type: string
-                    metadata:
-                      description: |-
-                        Standard object's metadata.
-                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    spec:
-                      description: |-
-                        spec defines the desired characteristics of a volume requested by a pod author.
-                        More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
-                      properties:
-                        accessModes:
-                          description: |-
-                            accessModes contains the desired access modes the volume should have.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                        dataSource:
-                          description: |-
-                            dataSource field can be used to specify either:
-                            * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
-                            * An existing PVC (PersistentVolumeClaim)
-                            If the provisioner or an external controller can support the specified data source,
-                            it will create a new volume based on the contents of the specified data source.
-                            When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-                            and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
-                            If the namespace is specified, then dataSourceRef will not be copied to dataSource.
-                          properties:
-                            apiGroup:
-                              description: |-
-                                APIGroup is the group for the resource being referenced.
-                                If APIGroup is not specified, the specified Kind must be in the core API group.
-                                For any other third-party types, APIGroup is required.
-                              type: string
-                            kind:
-                              description: Kind is the type of resource being referenced
-                              type: string
-                            name:
-                              description: Name is the name of resource being referenced
-                              type: string
-                          required:
-                          - kind
-                          - name
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        dataSourceRef:
-                          description: |-
-                            dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
-                            volume is desired. This may be any object from a non-empty API group (non
-                            core object) or a PersistentVolumeClaim object.
-                            When this field is specified, volume binding will only succeed if the type of
-                            the specified object matches some installed volume populator or dynamic
-                            provisioner.
-                            This field will replace the functionality of the dataSource field and as such
-                            if both fields are non-empty, they must have the same value. For backwards
-                            compatibility, when namespace isn't specified in dataSourceRef,
-                            both fields (dataSource and dataSourceRef) will be set to the same
-                            value automatically if one of them is empty and the other is non-empty.
-                            When namespace is specified in dataSourceRef,
-                            dataSource isn't set to the same value and must be empty.
-                            There are three important differences between dataSource and dataSourceRef:
-                            * While dataSource only allows two specific types of objects, dataSourceRef
-                              allows any non-core object, as well as PersistentVolumeClaim objects.
-                            * While dataSource ignores disallowed values (dropping them), dataSourceRef
-                              preserves all values, and generates an error if a disallowed value is
-                              specified.
-                            * While dataSource only allows local objects, dataSourceRef allows objects
-                              in any namespaces.
-                            (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
-                            (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                          properties:
-                            apiGroup:
-                              description: |-
-                                APIGroup is the group for the resource being referenced.
-                                If APIGroup is not specified, the specified Kind must be in the core API group.
-                                For any other third-party types, APIGroup is required.
-                              type: string
-                            kind:
-                              description: Kind is the type of resource being referenced
-                              type: string
-                            name:
-                              description: Name is the name of resource being referenced
-                              type: string
-                            namespace:
-                              description: |-
-                                Namespace is the namespace of resource being referenced
-                                Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
-                                (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                              type: string
-                          required:
-                          - kind
-                          - name
-                          type: object
-                        resources:
-                          description: |-
-                            resources represents the minimum resources the volume should have.
-                            If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
-                            that are lower than previous value but must still be higher than capacity recorded in the
-                            status field of the claim.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
-                          properties:
-                            limits:
-                              additionalProperties:
-                                anyOf:
-                                - type: integer
-                                - type: string
-                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                x-kubernetes-int-or-string: true
-                              description: |-
-                                Limits describes the maximum amount of compute resources allowed.
-                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                              type: object
-                            requests:
-                              additionalProperties:
-                                anyOf:
-                                - type: integer
-                                - type: string
-                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                x-kubernetes-int-or-string: true
-                              description: |-
-                                Requests describes the minimum amount of compute resources required.
-                                If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                                otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                              type: object
-                          type: object
-                        selector:
-                          description: selector is a label query over volumes to consider
-                            for binding.
-                          properties:
-                            matchExpressions:
-                              description: matchExpressions is a list of label selector
-                                requirements. The requirements are ANDed.
-                              items:
-                                description: |-
-                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                  relates the key and values.
-                                properties:
-                                  key:
-                                    description: key is the label key that the selector
-                                      applies to.
-                                    type: string
-                                  operator:
-                                    description: |-
-                                      operator represents a key's relationship to a set of values.
-                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                    type: string
-                                  values:
-                                    description: |-
-                                      values is an array of string values. If the operator is In or NotIn,
-                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                      the values array must be empty. This array is replaced during a strategic
-                                      merge patch.
-                                    items:
-                                      type: string
-                                    type: array
-                                    x-kubernetes-list-type: atomic
-                                required:
-                                - key
-                                - operator
-                                type: object
-                              type: array
-                              x-kubernetes-list-type: atomic
-                            matchLabels:
-                              additionalProperties:
-                                type: string
-                              description: |-
-                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                              type: object
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        storageClassName:
-                          description: |-
-                            storageClassName is the name of the StorageClass required by the claim.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
-                          type: string
-                        volumeAttributesClassName:
-                          description: |-
-                            volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
-                            If specified, the CSI driver will create or update the volume with the attributes defined
-                            in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                            it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                            will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                            If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                            will be set by the persistentvolume controller if it exists.
-                            If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
-                            set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
-                            exists.
-                            More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                            (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
-                          type: string
-                        volumeMode:
-                          description: |-
-                            volumeMode defines what type of volume is required by the claim.
-                            Value of Filesystem is implied when not included in claim spec.
-                          type: string
-                        volumeName:
-                          description: volumeName is the binding reference to the
-                            PersistentVolume backing this claim.
-                          type: string
-                      type: object
-                    status:
-                      description: |-
-                        status represents the current information/status of a persistent volume claim.
-                        Read-only.
-                        More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
-                      properties:
-                        accessModes:
-                          description: |-
-                            accessModes contains the actual access modes the volume backing the PVC has.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                        allocatedResourceStatuses:
-                          additionalProperties:
-                            description: |-
-                              When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource
-                              that it does not recognizes, then it should ignore that update and let other controllers
-                              handle it.
-                            type: string
-                          description: "allocatedResourceStatuses stores status of
-                            resource being resized for the given PVC.\nKey names follow
-                            standard Kubernetes label syntax. Valid values are either:\n\t*
-                            Un-prefixed keys:\n\t\t- storage - the capacity of the
-                            volume.\n\t* Custom resources must use implementation-defined
-                            prefixed names such as \"example.com/my-custom-resource\"\nApart
-                            from above values - keys that are unprefixed or have kubernetes.io
-                            prefix are considered\nreserved and hence may not be used.\n\nClaimResourceStatus
-                            can be in any of following states:\n\t- ControllerResizeInProgress:\n\t\tState
-                            set when resize controller starts resizing the volume
-                            in control-plane.\n\t- ControllerResizeFailed:\n\t\tState
-                            set when resize has failed in resize controller with a
-                            terminal error.\n\t- NodeResizePending:\n\t\tState set
-                            when resize controller has finished resizing the volume
-                            but further resizing of\n\t\tvolume is needed on the node.\n\t-
-                            NodeResizeInProgress:\n\t\tState set when kubelet starts
-                            resizing the volume.\n\t- NodeResizeFailed:\n\t\tState
-                            set when resizing has failed in kubelet with a terminal
-                            error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor
-                            example: if expanding a PVC for more capacity - this field
-                            can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage']
-                            = \"ControllerResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                            = \"ControllerResizeFailed\"\n     - pvc.status.allocatedResourceStatus['storage']
-                            = \"NodeResizePending\"\n     - pvc.status.allocatedResourceStatus['storage']
-                            = \"NodeResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                            = \"NodeResizeFailed\"\nWhen this field is not set, it
-                            means that no resize operation is in progress for the
-                            given PVC.\n\nA controller that receives PVC update with
-                            previously unknown resourceName or ClaimResourceStatus\nshould
-                            ignore the update for the purpose it was designed. For
-                            example - a controller that\nonly is responsible for resizing
-                            capacity of the volume, should ignore PVC updates that
-                            change other valid\nresources associated with PVC.\n\nThis
-                            is an alpha field and requires enabling RecoverVolumeExpansionFailure
-                            feature."
-                          type: object
-                          x-kubernetes-map-type: granular
-                        allocatedResources:
-                          additionalProperties:
-                            anyOf:
-                            - type: integer
-                            - type: string
-                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                            x-kubernetes-int-or-string: true
-                          description: "allocatedResources tracks the resources allocated
-                            to a PVC including its capacity.\nKey names follow standard
-                            Kubernetes label syntax. Valid values are either:\n\t*
-                            Un-prefixed keys:\n\t\t- storage - the capacity of the
-                            volume.\n\t* Custom resources must use implementation-defined
-                            prefixed names such as \"example.com/my-custom-resource\"\nApart
-                            from above values - keys that are unprefixed or have kubernetes.io
-                            prefix are considered\nreserved and hence may not be used.\n\nCapacity
-                            reported here may be larger than the actual capacity when
-                            a volume expansion operation\nis requested.\nFor storage
-                            quota, the larger value from allocatedResources and PVC.spec.resources
-                            is used.\nIf allocatedResources is not set, PVC.spec.resources
-                            alone is used for quota calculation.\nIf a volume expansion
-                            capacity request is lowered, allocatedResources is only\nlowered
-                            if there are no expansion operations in progress and if
-                            the actual volume capacity\nis equal or lower than the
-                            requested capacity.\n\nA controller that receives PVC
-                            update with previously unknown resourceName\nshould ignore
-                            the update for the purpose it was designed. For example
-                            - a controller that\nonly is responsible for resizing
-                            capacity of the volume, should ignore PVC updates that
-                            change other valid\nresources associated with PVC.\n\nThis
-                            is an alpha field and requires enabling RecoverVolumeExpansionFailure
-                            feature."
-                          type: object
-                        capacity:
-                          additionalProperties:
-                            anyOf:
-                            - type: integer
-                            - type: string
-                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                            x-kubernetes-int-or-string: true
-                          description: capacity represents the actual resources of
-                            the underlying volume.
-                          type: object
-                        conditions:
-                          description: |-
-                            conditions is the current Condition of persistent volume claim. If underlying persistent volume is being
-                            resized then the Condition will be set to 'Resizing'.
-                          items:
-                            description: PersistentVolumeClaimCondition contains details
-                              about state of pvc
-                            properties:
-                              lastProbeTime:
-                                description: lastProbeTime is the time we probed the
-                                  condition.
-                                format: date-time
-                                type: string
-                              lastTransitionTime:
-                                description: lastTransitionTime is the time the condition
-                                  transitioned from one status to another.
-                                format: date-time
-                                type: string
-                              message:
-                                description: message is the human-readable message
-                                  indicating details about last transition.
-                                type: string
-                              reason:
-                                description: |-
-                                  reason is a unique, this should be a short, machine understandable string that gives the reason
-                                  for condition's last transition. If it reports "Resizing" that means the underlying
-                                  persistent volume is being resized.
-                                type: string
-                              status:
-                                description: |-
-                                  Status is the status of the condition.
-                                  Can be True, False, Unknown.
-                                  More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required
-                                type: string
-                              type:
-                                description: |-
-                                  Type is the type of the condition.
-                                  More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about
-                                type: string
-                            required:
-                            - status
-                            - type
-                            type: object
-                          type: array
-                          x-kubernetes-list-map-keys:
-                          - type
-                          x-kubernetes-list-type: map
-                        currentVolumeAttributesClassName:
-                          description: |-
-                            currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
-                            When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                            This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
-                          type: string
-                        modifyVolumeStatus:
-                          description: |-
-                            ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
-                            When this is unset, there is no ModifyVolume operation being attempted.
-                            This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
-                          properties:
-                            status:
-                              description: "status is the status of the ControllerModifyVolume
-                                operation. It can be in any of following states:\n
-                                - Pending\n   Pending indicates that the PersistentVolumeClaim
-                                cannot be modified due to unmet requirements, such
-                                as\n   the specified VolumeAttributesClass not existing.\n
-                                - InProgress\n   InProgress indicates that the volume
-                                is being modified.\n - Infeasible\n  Infeasible indicates
-                                that the request has been rejected as invalid by the
-                                CSI driver. To\n\t  resolve the error, a valid VolumeAttributesClass
-                                needs to be specified.\nNote: New statuses can be
-                                added in the future. Consumers should check for unknown
-                                statuses and fail appropriately."
-                              type: string
-                            targetVolumeAttributesClassName:
-                              description: targetVolumeAttributesClassName is the
-                                name of the VolumeAttributesClass the PVC currently
-                                being reconciled
-                              type: string
-                          required:
-                          - status
-                          type: object
-                        phase:
-                          description: phase represents the current phase of PersistentVolumeClaim.
-                          type: string
-                      type: object
-                  type: object
-                type: array
-              configMaps:
-                description: |-
-                  ConfigMaps is a list of ConfigMaps in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/configs/CONFIGMAP_NAME folder
-                items:
-                  type: string
-                type: array
-              configReloaderExtraArgs:
-                additionalProperties:
-                  type: string
-                description: |-
-                  ConfigReloaderExtraArgs that will be passed to  VMAuths config-reloader container
-                  for example resyncInterval: "30s"
-                type: object
-              configReloaderImageTag:
-                description: ConfigReloaderImageTag defines image:tag for config-reloader
-                  container
-                type: string
-              configReloaderResources:
-                description: |-
-                  ConfigReloaderResources config-reloader container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
-                properties:
-                  claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
-                    items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
-                      properties:
-                        name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
-                          type: string
-                        request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
-                          type: string
-                      required:
-                      - name
-                      type: object
-                    type: array
-                    x-kubernetes-list-map-keys:
-                    - name
-                    x-kubernetes-list-type: map
-                  limits:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                  requests:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                type: object
-              containers:
-                description: |-
-                  Containers property allows to inject additions sidecars or to patch existing containers.
-                  It can be useful for proxies, backup, etc.
-                items:
-                  description: A single application container that you want to run
-                    within a pod.
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              daemonSetMode:
-                description: |-
-                  DaemonSetMode enables DaemonSet deployment mode instead of Deployment.
-                  Supports only VMPodScrape
-                  (available from v0.55.0).
-                  Cannot be used with statefulMode
-                type: boolean
-              disableAutomountServiceAccountToken:
-                description: |-
-                  DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
-                  Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
-                  For example, vmagent and vm-config-reloader requires k8s API access.
-                  Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
-                  And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
-                type: boolean
-              disableSelfServiceScrape:
-                description: |-
-                  DisableSelfServiceScrape controls creation of VMServiceScrape by operator
-                  for the application.
-                  Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable
-                type: boolean
-              dnsConfig:
-                description: |-
-                  Specifies the DNS parameters of a pod.
-                  Parameters specified here will be merged to the generated DNS
-                  configuration based on DNSPolicy.
-                items:
-                  x-kubernetes-preserve-unknown-fields: true
-                properties:
-                  nameservers:
-                    description: |-
-                      A list of DNS name server IP addresses.
-                      This will be appended to the base nameservers generated from DNSPolicy.
-                      Duplicated nameservers will be removed.
-                    items:
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  options:
-                    description: |-
-                      A list of DNS resolver options.
-                      This will be merged with the base options generated from DNSPolicy.
-                      Duplicated entries will be removed. Resolution options given in Options
-                      will override those that appear in the base DNSPolicy.
-                    items:
-                      description: PodDNSConfigOption defines DNS resolver options
-                        of a pod.
-                      properties:
-                        name:
-                          description: |-
-                            Name is this DNS resolver option's name.
-                            Required.
-                          type: string
-                        value:
-                          description: Value is this DNS resolver option's value.
-                          type: string
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  searches:
-                    description: |-
-                      A list of DNS search domains for host-name lookup.
-                      This will be appended to the base search paths generated from DNSPolicy.
-                      Duplicated search paths will be removed.
-                    items:
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: atomic
-                type: object
-              dnsPolicy:
-                description: DNSPolicy sets DNS policy for the pod
-                type: string
-              enableKubernetesAPISelectors:
-                description: |-
-                  EnableKubernetesAPISelectors instructs vmagent to use CRD scrape objects spec.selectors for
-                  Kubernetes API list and watch requests.
-                  https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#list-and-watch-filtering
-                  It could be useful to reduce Kubernetes API server resource usage for serving less than 100 CRD scrape objects in total.
-                type: boolean
-              enforcedNamespaceLabel:
-                description: |-
-                  EnforcedNamespaceLabel enforces adding a namespace label of origin for each alert
-                  and metric that is user created. The label value will always be the namespace of the object that is
-                  being created.
-                type: string
-              externalLabels:
-                additionalProperties:
-                  type: string
-                description: |-
-                  ExternalLabels The labels to add to any time series scraped by vmagent.
-                  it doesn't affect metrics ingested directly by push API's
-                type: object
-              extraArgs:
-                additionalProperties:
-                  type: string
-                description: |-
-                  ExtraArgs that will be passed to the application container
-                  for example remoteWrite.tmpDataPath: /tmp
-                type: object
-              extraEnvs:
-                description: ExtraEnvs that will be passed to the application container
-                items:
-                  description: EnvVar represents an environment variable present in
-                    a Container.
-                  properties:
-                    name:
-                      description: Name of the environment variable. Must be a C_IDENTIFIER.
-                      type: string
-                    value:
-                      description: |-
-                        Variable references $(VAR_NAME) are expanded
-                        using the previously defined environment variables in the container and
-                        any service environment variables. If a variable cannot be resolved,
-                        the reference in the input string will be unchanged. Double $$ are reduced
-                        to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                        "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                        Escaped references will never be expanded, regardless of whether the variable
-                        exists or not.
-                        Defaults to "".
-                      type: string
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              extraEnvsFrom:
-                description: |-
-                  ExtraEnvsFrom defines source of env variables for the application container
-                  could either be secret or configmap
-                items:
-                  description: EnvFromSource represents the source of a set of ConfigMaps
-                  properties:
-                    configMapRef:
-                      description: The ConfigMap to select from
-                      properties:
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the ConfigMap must be defined
-                          type: boolean
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    prefix:
-                      description: An optional identifier to prepend to each key in
-                        the ConfigMap. Must be a C_IDENTIFIER.
-                      type: string
-                    secretRef:
-                      description: The Secret to select from
-                      properties:
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the Secret must be defined
-                          type: boolean
-                      type: object
-                      x-kubernetes-map-type: atomic
-                  type: object
-                type: array
-              host_aliases:
-                description: |-
-                  HostAliasesUnderScore provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
-                  Has Priority over hostAliases field
-                items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
-                  properties:
-                    hostnames:
-                      description: Hostnames for the above IP address.
-                      items:
-                        type: string
-                      type: array
-                      x-kubernetes-list-type: atomic
-                    ip:
-                      description: IP address of the host file entry.
-                      type: string
-                  required:
-                  - ip
-                  type: object
-                type: array
-              hostAliases:
-                description: |-
-                  HostAliases provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
-                items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
-                  properties:
-                    hostnames:
-                      description: Hostnames for the above IP address.
-                      items:
-                        type: string
-                      type: array
-                      x-kubernetes-list-type: atomic
-                    ip:
-                      description: IP address of the host file entry.
-                      type: string
-                  required:
-                  - ip
-                  type: object
-                type: array
-              hostNetwork:
-                description: HostNetwork controls whether the pod may use the node
-                  network namespace
-                type: boolean
-              ignoreNamespaceSelectors:
-                description: |-
-                  IgnoreNamespaceSelectors if set to true will ignore NamespaceSelector settings from
-                  scrape objects, and they will only discover endpoints
-                  within their current namespace.  Defaults to false.
-                type: boolean
-              image:
-                description: |-
-                  Image - docker image settings
-                  if no specified operator uses default version from operator config
-                properties:
-                  pullPolicy:
-                    description: PullPolicy describes how to pull docker image
-                    type: string
-                  repository:
-                    description: Repository contains name of docker image + it's repository
-                      if needed
-                    type: string
-                  tag:
-                    description: Tag contains desired docker image version
-                    type: string
-                type: object
-              imagePullSecrets:
-                description: |-
-                  ImagePullSecrets An optional list of references to secrets in the same namespace
-                  to use for pulling images from registries
-                  see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
-                items:
-                  description: |-
-                    LocalObjectReference contains enough information to let you locate the
-                    referenced object inside the same namespace.
-                  properties:
-                    name:
-                      default: ""
-                      description: |-
-                        Name of the referent.
-                        This field is effectively required, but due to backwards compatibility is
-                        allowed to be empty. Instances of this type with an empty value here are
-                        almost certainly wrong.
-                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                      type: string
-                  type: object
-                  x-kubernetes-map-type: atomic
-                type: array
-              ingestOnlyMode:
-                description: |-
-                  IngestOnlyMode switches vmagent into unmanaged mode
-                  it disables any config generation for scraping
-                  Currently it prevents vmagent from managing tls and auth options for remote write
-                type: boolean
-              initContainers:
-                description: |-
-                  InitContainers allows adding initContainers to the pod definition.
-                  Any errors during the execution of an initContainer will lead to a restart of the Pod.
-                  More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
-                items:
-                  description: A single application container that you want to run
-                    within a pod.
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              inlineRelabelConfig:
-                description: InlineRelabelConfig - defines GlobalRelabelConfig for
-                  vmagent, can be defined directly at CRD.
-                items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
-                  properties:
-                    action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
-                      type: string
-                    if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
-                      x-kubernetes-preserve-unknown-fields: true
-                    labels:
-                      additionalProperties:
-                        type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
-                      type: object
-                    match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
-                      type: string
-                    modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
-                      format: int64
-                      type: integer
-                    regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                      x-kubernetes-preserve-unknown-fields: true
-                    replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
-                      type: string
-                    separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
-                      type: string
-                    source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      items:
-                        type: string
-                      type: array
-                    sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
-                      items:
-                        type: string
-                      type: array
-                    target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      type: string
-                    targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
-                      type: string
-                  type: object
-                type: array
-              inlineScrapeConfig:
-                description: |-
-                  InlineScrapeConfig As scrape configs are appended, the user is responsible to make sure it
-                  is valid. Note that using this feature may expose the possibility to
-                  break upgrades of VMAgent. It is advised to review VMAgent release
-                  notes to ensure that no incompatible scrape configs are going to break
-                  VMAgent after the upgrade.
-                  it should be defined as single yaml file.
-                  inlineScrapeConfig: |
-                      - job_name: "prometheus"
-                        static_configs:
-                        - targets: ["localhost:9090"]
-                type: string
-              insertPorts:
-                description: InsertPorts - additional listen ports for data ingestion.
-                properties:
-                  graphitePort:
-                    description: GraphitePort listen port
-                    type: string
-                  influxPort:
-                    description: InfluxPort listen port
-                    type: string
-                  openTSDBHTTPPort:
-                    description: OpenTSDBHTTPPort for http connections.
-                    type: string
-                  openTSDBPort:
-                    description: OpenTSDBPort for tcp and udp listen
-                    type: string
-                type: object
-              license:
-                description: |-
-                  License allows to configure license key to be used for enterprise features.
-                  Using license key is supported starting from VictoriaMetrics v1.94.0.
-                  See [here](https://docs.victoriametrics.com/enterprise)
-                properties:
-                  forceOffline:
-                    description: Enforce offline verification of the license key.
-                    type: boolean
-                  key:
-                    description: |-
-                      Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise).
-                      To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial)
-                    type: string
-                  keyRef:
-                    description: KeyRef is reference to secret with license key for
-                      enterprise features.
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  reloadInterval:
-                    description: Interval to be used for checking for license key
-                      changes. Note that this is only applicable when using KeyRef.
-                    type: string
-                type: object
-              livenessProbe:
-                description: LivenessProbe that will be added CRD pod
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              logFormat:
-                description: LogFormat for VMAgent to be configured with.
-                enum:
-                - default
-                - json
-                type: string
-              logLevel:
-                description: |-
-                  LogLevel for VMAgent to be configured with.
-                  INFO, WARN, ERROR, FATAL, PANIC
-                enum:
-                - INFO
-                - WARN
-                - ERROR
-                - FATAL
-                - PANIC
-                type: string
-              managedMetadata:
-                description: |-
-                  ManagedMetadata defines metadata that will be added to the all objects
-                  created by operator for the given CustomResource
-                properties:
-                  annotations:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                    type: object
-                  labels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                    type: object
-                type: object
-              maxScrapeInterval:
-                description: |-
-                  MaxScrapeInterval allows limiting maximum scrape interval for VMServiceScrape, VMPodScrape and other scrapes
-                  If interval is higher than defined limit, `maxScrapeInterval` will be used.
-                type: string
-              minReadySeconds:
-                description: |-
-                  MinReadySeconds defines a minimum number of seconds to wait before starting update next pod
-                  if previous in healthy state
-                  Has no effect for VLogs and VMSingle
-                format: int32
-                type: integer
-              minScrapeInterval:
-                description: |-
-                  MinScrapeInterval allows limiting minimal scrape interval for VMServiceScrape, VMPodScrape and other scrapes
-                  If interval is lower than defined limit, `minScrapeInterval` will be used.
-                type: string
-              nodeScrapeNamespaceSelector:
-                description: |-
-                  NodeScrapeNamespaceSelector defines Namespaces to be selected for VMNodeScrape discovery.
-                  Works in combination with Selector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              nodeScrapeRelabelTemplate:
-                description: |-
-                  NodeScrapeRelabelTemplate defines relabel config, that will be added to each VMNodeScrape.
-                  it's useful for adding specific labels to all targets
-                items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
-                  properties:
-                    action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
-                      type: string
-                    if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
-                      x-kubernetes-preserve-unknown-fields: true
-                    labels:
-                      additionalProperties:
-                        type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
-                      type: object
-                    match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
-                      type: string
-                    modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
-                      format: int64
-                      type: integer
-                    regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                      x-kubernetes-preserve-unknown-fields: true
-                    replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
-                      type: string
-                    separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
-                      type: string
-                    source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      items:
-                        type: string
-                      type: array
-                    sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
-                      items:
-                        type: string
-                      type: array
-                    target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      type: string
-                    targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
-                      type: string
-                  type: object
-                type: array
-              nodeScrapeSelector:
-                description: |-
-                  NodeScrapeSelector defines VMNodeScrape to be selected for scraping.
-                  Works in combination with NamespaceSelector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              nodeSelector:
-                additionalProperties:
-                  type: string
-                description: NodeSelector Define which Nodes the Pods are scheduled
-                  on.
-                type: object
-              overrideHonorLabels:
-                description: |-
-                  OverrideHonorLabels if set to true overrides all user configured honor_labels.
-                  If HonorLabels is set in scrape objects  to true, this overrides honor_labels to false.
-                type: boolean
-              overrideHonorTimestamps:
-                description: OverrideHonorTimestamps allows to globally enforce honoring
-                  timestamps in all scrape configs.
-                type: boolean
-              paused:
-                description: |-
-                  Paused If set to true all actions on the underlying managed objects are not
-                  going to be performed, except for delete actions.
-                type: boolean
-              podDisruptionBudget:
-                description: PodDisruptionBudget created by operator
-                properties:
-                  maxUnavailable:
-                    anyOf:
-                    - type: integer
-                    - type: string
-                    description: |-
-                      An eviction is allowed if at most "maxUnavailable" pods selected by
-                      "selector" are unavailable after the eviction, i.e. even in absence of
-                      the evicted pod. For example, one can prevent all voluntary evictions
-                      by specifying 0. This is a mutually exclusive setting with "minAvailable".
-                    x-kubernetes-int-or-string: true
-                  minAvailable:
-                    anyOf:
-                    - type: integer
-                    - type: string
-                    description: |-
-                      An eviction is allowed if at least "minAvailable" pods selected by
-                      "selector" will still be available after the eviction, i.e. even in the
-                      absence of the evicted pod.  So for example you can prevent all voluntary
-                      evictions by specifying "100%".
-                    x-kubernetes-int-or-string: true
-                  selectorLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      replaces default labels selector generated by operator
-                      it's useful when you need to create custom budget
-                    type: object
-                type: object
-              podMetadata:
-                description: PodMetadata configures Labels and Annotations which are
-                  propagated to the vmagent pods.
-                properties:
-                  annotations:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                    type: object
-                  labels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects. May match selectors of replication controllers
-                      and services.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                    type: object
-                  name:
-                    description: |-
-                      Name must be unique within a namespace. Is required when creating resources, although
-                      some resources may allow a client to request the generation of an appropriate name
-                      automatically. Name is primarily intended for creation idempotence and configuration
-                      definition.
-                      Cannot be updated.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                    type: string
-                type: object
-              podScrapeNamespaceSelector:
-                description: |-
-                  PodScrapeNamespaceSelector defines Namespaces to be selected for VMPodScrape discovery.
-                  Works in combination with Selector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              podScrapeRelabelTemplate:
-                description: |-
-                  PodScrapeRelabelTemplate defines relabel config, that will be added to each VMPodScrape.
-                  it's useful for adding specific labels to all targets
-                items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
-                  properties:
-                    action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
-                      type: string
-                    if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
-                      x-kubernetes-preserve-unknown-fields: true
-                    labels:
-                      additionalProperties:
-                        type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
-                      type: object
-                    match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
-                      type: string
-                    modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
-                      format: int64
-                      type: integer
-                    regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                      x-kubernetes-preserve-unknown-fields: true
-                    replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
-                      type: string
-                    separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
-                      type: string
-                    source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      items:
-                        type: string
-                      type: array
-                    sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
-                      items:
-                        type: string
-                      type: array
-                    target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      type: string
-                    targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
-                      type: string
-                  type: object
-                type: array
-              podScrapeSelector:
-                description: |-
-                  PodScrapeSelector defines PodScrapes to be selected for target discovery.
-                  Works in combination with NamespaceSelector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              port:
-                description: Port listen address
-                type: string
-              priorityClassName:
-                description: PriorityClassName class assigned to the Pods
-                type: string
-              probeNamespaceSelector:
-                description: |-
-                  ProbeNamespaceSelector defines Namespaces to be selected for VMProbe discovery.
-                  Works in combination with Selector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              probeScrapeRelabelTemplate:
-                description: |-
-                  ProbeScrapeRelabelTemplate defines relabel config, that will be added to each VMProbeScrape.
-                  it's useful for adding specific labels to all targets
-                items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
-                  properties:
-                    action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
-                      type: string
-                    if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
-                      x-kubernetes-preserve-unknown-fields: true
-                    labels:
-                      additionalProperties:
-                        type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
-                      type: object
-                    match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
-                      type: string
-                    modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
-                      format: int64
-                      type: integer
-                    regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                      x-kubernetes-preserve-unknown-fields: true
-                    replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
-                      type: string
-                    separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
-                      type: string
-                    source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      items:
-                        type: string
-                      type: array
-                    sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
-                      items:
-                        type: string
-                      type: array
-                    target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      type: string
-                    targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
-                      type: string
-                  type: object
-                type: array
-              probeSelector:
-                description: |-
-                  ProbeSelector defines VMProbe to be selected for target probing.
-                  Works in combination with NamespaceSelector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              readinessGates:
-                description: ReadinessGates defines pod readiness gates
-                items:
-                  description: PodReadinessGate contains the reference to a pod condition
-                  properties:
-                    conditionType:
-                      description: ConditionType refers to a condition in the pod's
-                        condition list with matching type.
-                      type: string
-                  required:
-                  - conditionType
-                  type: object
-                type: array
-              readinessProbe:
-                description: ReadinessProbe that will be added CRD pod
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              relabelConfig:
-                description: |-
-                  RelabelConfig ConfigMap with global relabel config -remoteWrite.relabelConfig
-                  This relabeling is applied to all the collected metrics before sending them to remote storage.
-                properties:
-                  key:
-                    description: The key to select.
-                    type: string
-                  name:
-                    default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                    type: string
-                  optional:
-                    description: Specify whether the ConfigMap or its key must be
-                      defined
-                    type: boolean
-                required:
-                - key
-                type: object
-                x-kubernetes-map-type: atomic
-              remoteWrite:
-                description: |-
-                  RemoteWrite list of victoria metrics /some other remote write system
-                  for vm it must looks like: http://victoria-metrics-single:8429/api/v1/write
-                  or for cluster different url
-                  https://github.com/VictoriaMetrics/VictoriaMetrics/tree/master/app/vmagent#splitting-data-streams-among-multiple-systems
-                items:
-                  description: VMAgentRemoteWriteSpec defines the remote storage configuration
-                    for VmAgent
-                  properties:
-                    basicAuth:
-                      description: BasicAuth allow an endpoint to authenticate over
-                        basic authentication
-                      properties:
-                        password:
-                          description: |-
-                            Password defines reference for secret with password value
-                            The secret needs to be in the same namespace as scrape object
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        password_file:
-                          description: |-
-                            PasswordFile defines path to password file at disk
-                            must be pre-mounted
-                          type: string
-                        username:
-                          description: |-
-                            Username defines reference for secret with username value
-                            The secret needs to be in the same namespace as scrape object
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                      type: object
-                    bearerTokenSecret:
-                      description: Optional bearer auth token to use for -remoteWrite.url
-                      properties:
-                        key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
-                          type: string
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
-                          type: boolean
-                      required:
-                      - key
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    forceVMProto:
-                      description: ForceVMProto forces using VictoriaMetrics protocol
-                        for sending data to -remoteWrite.url
-                      type: boolean
-                    headers:
-                      description: |-
-                        Headers allow configuring custom http headers
-                        Must be in form of semicolon separated header with value
-                        e.g.
-                        headerName: headerValue
-                        vmagent supports since 1.79.0 version
-                      items:
-                        type: string
-                      type: array
-                    inlineUrlRelabelConfig:
-                      description: InlineUrlRelabelConfig defines relabeling config
-                        for remoteWriteURL, it can be defined at crd spec.
-                      items:
-                        description: |-
-                          RelabelConfig allows dynamic rewriting of the label set
-                          More info: https://docs.victoriametrics.com/#relabeling
-                        properties:
-                          action:
-                            description: Action to perform based on regex matching.
-                              Default is 'replace'
-                            type: string
-                          if:
-                            description: 'If represents metricsQL match expression
-                              (or list of expressions): ''{__name__=~"foo_.*"}'''
-                            x-kubernetes-preserve-unknown-fields: true
-                          labels:
-                            additionalProperties:
-                              type: string
-                            description: 'Labels is used together with Match for `action:
-                              graphite`'
-                            type: object
-                          match:
-                            description: 'Match is used together with Labels for `action:
-                              graphite`'
-                            type: string
-                          modulus:
-                            description: Modulus to take of the hash of the source
-                              label values.
-                            format: int64
-                            type: integer
-                          regex:
-                            description: |-
-                              Regular expression against which the extracted value is matched. Default is '(.*)'
-                              victoriaMetrics supports multiline regex joined with |
-                              https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                            x-kubernetes-preserve-unknown-fields: true
-                          replacement:
-                            description: |-
-                              Replacement value against which a regex replace is performed if the
-                              regular expression matches. Regex capture groups are available. Default is '$1'
-                            type: string
-                          separator:
-                            description: Separator placed between concatenated source
-                              label values. default is ';'.
-                            type: string
-                          source_labels:
-                            description: |-
-                              UnderScoreSourceLabels - additional form of source labels source_labels
-                              for compatibility with original relabel config.
-                              if set  both sourceLabels and source_labels, sourceLabels has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
-                            items:
-                              type: string
-                            type: array
-                          sourceLabels:
-                            description: |-
-                              The source labels select values from existing labels. Their content is concatenated
-                              using the configured separator and matched against the configured regular expression
-                              for the replace, keep, and drop actions.
-                            items:
-                              type: string
-                            type: array
-                          target_label:
-                            description: |-
-                              UnderScoreTargetLabel - additional form of target label - target_label
-                              for compatibility with original relabel config.
-                              if set  both targetLabel and target_label, targetLabel has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
-                            type: string
-                          targetLabel:
-                            description: |-
-                              Label to which the resulting value is written in a replace action.
-                              It is mandatory for replace actions. Regex capture groups are available.
-                            type: string
-                        type: object
-                      type: array
-                    maxDiskUsage:
-                      description: |-
-                        MaxDiskUsage defines the maximum file-based buffer size in bytes for the given remoteWrite
-                        It overrides global configuration defined at remoteWriteSettings.maxDiskUsagePerURL
-                      x-kubernetes-preserve-unknown-fields: true
-                    oauth2:
-                      description: OAuth2 defines auth configuration
-                      properties:
-                        client_id:
-                          description: The secret or configmap containing the OAuth2
-                            client id
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        client_secret:
-                          description: The secret containing the OAuth2 client secret
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        client_secret_file:
-                          description: ClientSecretFile defines path for client secret
-                            file.
-                          type: string
-                        endpoint_params:
-                          additionalProperties:
-                            type: string
-                          description: Parameters to append to the token URL
-                          type: object
-                        proxy_url:
-                          description: |-
-                            The proxy URL for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
-                          type: string
-                        scopes:
-                          description: OAuth2 scopes used for the token request
-                          items:
-                            type: string
-                          type: array
-                        tls_config:
-                          description: |-
-                            TLSConfig for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
-                          x-kubernetes-preserve-unknown-fields: true
-                        token_url:
-                          description: The URL to fetch the token from
-                          minLength: 1
-                          type: string
-                      required:
-                      - client_id
-                      - token_url
-                      type: object
-                    sendTimeout:
-                      description: Timeout for sending a single block of data to -remoteWrite.url
-                        (default 1m0s)
-                      pattern: '[0-9]+(ms|s|m|h)'
-                      type: string
-                    streamAggrConfig:
-                      description: StreamAggrConfig defines stream aggregation configuration
-                        for VMAgent for -remoteWrite.url
-                      properties:
-                        configmap:
-                          description: ConfigMap with stream aggregation rules
-                          properties:
-                            key:
-                              description: The key to select.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the ConfigMap or its key
-                                must be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        dedupInterval:
-                          description: Allows setting different de-duplication intervals
-                            per each configured remote storage
-                          type: string
-                        dropInput:
-                          description: Allow drop all the input samples after the
-                            aggregation
-                          type: boolean
-                        dropInputLabels:
-                          description: labels to drop from samples for aggregator
-                            before stream de-duplication and aggregation
-                          items:
-                            type: string
-                          type: array
-                        enableWindows:
-                          description: EnableWindows enables aggregating data in separate
-                            windows ( available from v0.54.0).
-                          type: boolean
-                        ignoreFirstIntervals:
-                          description: IgnoreFirstIntervals instructs to ignore first
-                            interval
-                          type: integer
-                        ignoreOldSamples:
-                          description: IgnoreOldSamples instructs to ignore samples
-                            with old timestamps outside the current aggregation interval.
-                          type: boolean
-                        keepInput:
-                          description: Allows writing both raw and aggregate data
-                          type: boolean
-                        rules:
-                          description: Stream aggregation rules
-                          items:
-                            description: StreamAggrRule defines the rule in stream
-                              aggregation config
-                            properties:
-                              by:
-                                description: |-
-                                  By is an optional list of labels for grouping input series.
-
-                                  See also Without.
-
-                                  If neither By nor Without are set, then the Outputs are calculated
-                                  individually per each input time series.
-                                items:
-                                  type: string
-                                type: array
-                              dedup_interval:
-                                description: DedupInterval is an optional interval
-                                  for deduplication.
-                                type: string
-                              drop_input_labels:
-                                description: |-
-                                  DropInputLabels is an optional list with labels, which must be dropped before further processing of input samples.
-
-                                  Labels are dropped before de-duplication and aggregation.
-                                items:
-                                  type: string
-                                type: array
-                              enable_windows:
-                                description: EnableWindows enables aggregating data
-                                  in separate windows
-                                type: boolean
-                              flush_on_shutdown:
-                                description: |-
-                                  FlushOnShutdown defines whether to flush the aggregation state on process termination
-                                  or config reload. Is `false` by default.
-                                  It is not recommended changing this setting, unless unfinished aggregations states
-                                  are preferred to missing data points.
-                                type: boolean
-                              ignore_first_intervals:
-                                type: integer
-                              ignore_old_samples:
-                                description: IgnoreOldSamples instructs to ignore
-                                  samples with old timestamps outside the current
-                                  aggregation interval.
-                                type: boolean
-                              input_relabel_configs:
-                                description: |-
-                                  InputRelabelConfigs is an optional relabeling rules, which are applied on the input
-                                  before aggregation.
-                                items:
-                                  description: |-
-                                    RelabelConfig allows dynamic rewriting of the label set
-                                    More info: https://docs.victoriametrics.com/#relabeling
-                                  properties:
-                                    action:
-                                      description: Action to perform based on regex
-                                        matching. Default is 'replace'
-                                      type: string
-                                    if:
-                                      description: 'If represents metricsQL match
-                                        expression (or list of expressions): ''{__name__=~"foo_.*"}'''
-                                      x-kubernetes-preserve-unknown-fields: true
-                                    labels:
-                                      additionalProperties:
-                                        type: string
-                                      description: 'Labels is used together with Match
-                                        for `action: graphite`'
-                                      type: object
-                                    match:
-                                      description: 'Match is used together with Labels
-                                        for `action: graphite`'
-                                      type: string
-                                    modulus:
-                                      description: Modulus to take of the hash of
-                                        the source label values.
-                                      format: int64
-                                      type: integer
-                                    regex:
-                                      description: |-
-                                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                                        victoriaMetrics supports multiline regex joined with |
-                                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                                      x-kubernetes-preserve-unknown-fields: true
-                                    replacement:
-                                      description: |-
-                                        Replacement value against which a regex replace is performed if the
-                                        regular expression matches. Regex capture groups are available. Default is '$1'
-                                      type: string
-                                    separator:
-                                      description: Separator placed between concatenated
-                                        source label values. default is ';'.
-                                      type: string
-                                    source_labels:
-                                      description: |-
-                                        UnderScoreSourceLabels - additional form of source labels source_labels
-                                        for compatibility with original relabel config.
-                                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                                      items:
-                                        type: string
-                                      type: array
-                                    sourceLabels:
-                                      description: |-
-                                        The source labels select values from existing labels. Their content is concatenated
-                                        using the configured separator and matched against the configured regular expression
-                                        for the replace, keep, and drop actions.
-                                      items:
-                                        type: string
-                                      type: array
-                                    target_label:
-                                      description: |-
-                                        UnderScoreTargetLabel - additional form of target label - target_label
-                                        for compatibility with original relabel config.
-                                        if set  both targetLabel and target_label, targetLabel has priority.
-                                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                                      type: string
-                                    targetLabel:
-                                      description: |-
-                                        Label to which the resulting value is written in a replace action.
-                                        It is mandatory for replace actions. Regex capture groups are available.
-                                      type: string
-                                  type: object
-                                type: array
-                              interval:
-                                description: Interval is the interval between aggregations.
-                                type: string
-                              keep_metric_names:
-                                description: KeepMetricNames instructs to leave metric
-                                  names as is for the output time series without adding
-                                  any suffix.
-                                type: boolean
-                              match:
-                                description: |-
-                                  Match is a label selector (or list of label selectors) for filtering time series for the given selector.
-
-                                  If the match isn't set, then all the input time series are processed.
-                                x-kubernetes-preserve-unknown-fields: true
-                              no_align_flush_to_interval:
-                                description: |-
-                                  NoAlignFlushToInterval disables aligning of flushes to multiples of Interval.
-                                  By default flushes are aligned to Interval.
-                                type: boolean
-                              output_relabel_configs:
-                                description: |-
-                                  OutputRelabelConfigs is an optional relabeling rules, which are applied
-                                  on the aggregated output before being sent to remote storage.
-                                items:
-                                  description: |-
-                                    RelabelConfig allows dynamic rewriting of the label set
-                                    More info: https://docs.victoriametrics.com/#relabeling
-                                  properties:
-                                    action:
-                                      description: Action to perform based on regex
-                                        matching. Default is 'replace'
-                                      type: string
-                                    if:
-                                      description: 'If represents metricsQL match
-                                        expression (or list of expressions): ''{__name__=~"foo_.*"}'''
-                                      x-kubernetes-preserve-unknown-fields: true
-                                    labels:
-                                      additionalProperties:
-                                        type: string
-                                      description: 'Labels is used together with Match
-                                        for `action: graphite`'
-                                      type: object
-                                    match:
-                                      description: 'Match is used together with Labels
-                                        for `action: graphite`'
-                                      type: string
-                                    modulus:
-                                      description: Modulus to take of the hash of
-                                        the source label values.
-                                      format: int64
-                                      type: integer
-                                    regex:
-                                      description: |-
-                                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                                        victoriaMetrics supports multiline regex joined with |
-                                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                                      x-kubernetes-preserve-unknown-fields: true
-                                    replacement:
-                                      description: |-
-                                        Replacement value against which a regex replace is performed if the
-                                        regular expression matches. Regex capture groups are available. Default is '$1'
-                                      type: string
-                                    separator:
-                                      description: Separator placed between concatenated
-                                        source label values. default is ';'.
-                                      type: string
-                                    source_labels:
-                                      description: |-
-                                        UnderScoreSourceLabels - additional form of source labels source_labels
-                                        for compatibility with original relabel config.
-                                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                                      items:
-                                        type: string
-                                      type: array
-                                    sourceLabels:
-                                      description: |-
-                                        The source labels select values from existing labels. Their content is concatenated
-                                        using the configured separator and matched against the configured regular expression
-                                        for the replace, keep, and drop actions.
-                                      items:
-                                        type: string
-                                      type: array
-                                    target_label:
-                                      description: |-
-                                        UnderScoreTargetLabel - additional form of target label - target_label
-                                        for compatibility with original relabel config.
-                                        if set  both targetLabel and target_label, targetLabel has priority.
-                                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                                      type: string
-                                    targetLabel:
-                                      description: |-
-                                        Label to which the resulting value is written in a replace action.
-                                        It is mandatory for replace actions. Regex capture groups are available.
-                                      type: string
-                                  type: object
-                                type: array
-                              outputs:
-                                description: |-
-                                  Outputs is a list of output aggregate functions to produce.
-
-                                  The following names are allowed:
-
-                                  - total - aggregates input counters
-                                  - increase - counts the increase over input counters
-                                  - count_series - counts the input series
-                                  - count_samples - counts the input samples
-                                  - sum_samples - sums the input samples
-                                  - last - the last biggest sample value
-                                  - min - the minimum sample value
-                                  - max - the maximum sample value
-                                  - avg - the average value across all the samples
-                                  - stddev - standard deviation across all the samples
-                                  - stdvar - standard variance across all the samples
-                                  - histogram_bucket - creates VictoriaMetrics histogram for input samples
-                                  - quantiles(phi1, ..., phiN) - quantiles' estimation for phi in the range [0..1]
-
-                                  The output time series will have the following names:
-
-                                    input_name:aggr_<interval>_<output>
-                                items:
-                                  type: string
-                                type: array
-                              staleness_interval:
-                                description: |-
-                                  Staleness interval is interval after which the series state will be reset if no samples have been sent during it.
-                                  The parameter is only relevant for outputs: total, total_prometheus, increase, increase_prometheus and histogram_bucket.
-                                type: string
-                              without:
-                                description: |-
-                                  Without is an optional list of labels, which must be excluded when grouping input series.
-
-                                  See also By.
-
-                                  If neither By nor Without are set, then the Outputs are calculated
-                                  individually per each input time series.
-                                items:
-                                  type: string
-                                type: array
-                            required:
-                            - interval
-                            - outputs
-                            type: object
-                          type: array
-                      type: object
-                    tlsConfig:
-                      description: TLSConfig describes tls configuration for remote
-                        write target
-                      properties:
-                        ca:
-                          description: Struct containing the CA cert to use for the
-                            targets.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        caFile:
-                          description: Path to the CA cert in the container to use
-                            for the targets.
-                          type: string
-                        cert:
-                          description: Struct containing the client cert file for
-                            the targets.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        certFile:
-                          description: Path to the client cert file in the container
-                            for the targets.
-                          type: string
-                        insecureSkipVerify:
-                          description: Disable target certificate validation.
-                          type: boolean
-                        keyFile:
-                          description: Path to the client key file in the container
-                            for the targets.
-                          type: string
-                        keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        serverName:
-                          description: Used to verify the hostname for the targets.
-                          type: string
-                      type: object
-                    url:
-                      description: URL of the endpoint to send samples to.
-                      type: string
-                    urlRelabelConfig:
-                      description: ConfigMap with relabeling config which is applied
-                        to metrics before sending them to the corresponding -remoteWrite.url
-                      properties:
-                        key:
-                          description: The key to select.
-                          type: string
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the ConfigMap or its key must
-                            be defined
-                          type: boolean
-                      required:
-                      - key
-                      type: object
-                      x-kubernetes-map-type: atomic
-                  required:
-                  - url
-                  type: object
-                type: array
-              remoteWriteSettings:
-                description: RemoteWriteSettings defines global settings for all remoteWrite
-                  urls.
-                properties:
-                  flushInterval:
-                    description: Interval for flushing the data to remote storage.
-                      (default 1s)
-                    pattern: '[0-9]+(ms|s|m|h)'
-                    type: string
-                  label:
-                    additionalProperties:
-                      type: string
-                    description: Labels in the form 'name=value' to add to all the
-                      metrics before sending them. This overrides the label if it
-                      already exists.
-                    type: object
-                  maxBlockSize:
-                    description: The maximum size in bytes of unpacked request to
-                      send to remote storage
-                    format: int32
-                    type: integer
-                  maxDiskUsagePerURL:
-                    description: The maximum file-based buffer size in bytes at -remoteWrite.tmpDataPath
-                    x-kubernetes-preserve-unknown-fields: true
-                  queues:
-                    description: The number of concurrent queues
-                    format: int32
-                    type: integer
-                  showURL:
-                    description: Whether to show -remoteWrite.url in the exported
-                      metrics. It is hidden by default, since it can contain sensitive
-                      auth info
-                    type: boolean
-                  tmpDataPath:
-                    description: Path to directory where temporary data for remote
-                      write component is stored (default vmagent-remotewrite-data)
-                    type: string
-                  useMultiTenantMode:
-                    description: |-
-                      Configures vmagent accepting data via the same multitenant endpoints as vminsert at VictoriaMetrics cluster does,
-                      see [here](https://docs.victoriametrics.com/vmagent/#multitenancy).
-                      it's global setting and affects all remote storage configurations
-                    type: boolean
-                type: object
-              replicaCount:
-                description: ReplicaCount is the expected size of the Application.
-                format: int32
-                type: integer
-              resources:
-                description: |-
-                  Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
-                properties:
-                  claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
-                    items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
-                      properties:
-                        name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
-                          type: string
-                        request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
-                          type: string
-                      required:
-                      - name
-                      type: object
-                    type: array
-                    x-kubernetes-list-map-keys:
-                    - name
-                    x-kubernetes-list-type: map
-                  limits:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                  requests:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                type: object
-              revisionHistoryLimitCount:
-                description: |-
-                  The number of old ReplicaSets to retain to allow rollback in deployment or
-                  maximum number of revisions that will be maintained in the Deployment revision history.
-                  Has no effect at StatefulSets
-                  Defaults to 10.
-                format: int32
-                type: integer
-              rollingUpdate:
-                description: RollingUpdate - overrides deployment update params.
-                properties:
-                  maxSurge:
-                    anyOf:
-                    - type: integer
-                    - type: string
-                    description: |-
-                      The maximum number of pods that can be scheduled above the desired number of
-                      pods.
-                      Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
-                      This can not be 0 if MaxUnavailable is 0.
-                      Absolute number is calculated from percentage by rounding up.
-                      Defaults to 25%.
-                      Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when
-                      the rolling update starts, such that the total number of old and new pods do not exceed
-                      130% of desired pods. Once old pods have been killed,
-                      new ReplicaSet can be scaled up further, ensuring that total number of pods running
-                      at any time during the update is at most 130% of desired pods.
-                    x-kubernetes-int-or-string: true
-                  maxUnavailable:
-                    anyOf:
-                    - type: integer
-                    - type: string
-                    description: |-
-                      The maximum number of pods that can be unavailable during the update.
-                      Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
-                      Absolute number is calculated from percentage by rounding down.
-                      This can not be 0 if MaxSurge is 0.
-                      Defaults to 25%.
-                      Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods
-                      immediately when the rolling update starts. Once new pods are ready, old ReplicaSet
-                      can be scaled down further, followed by scaling up the new ReplicaSet, ensuring
-                      that the total number of pods available at all times during the update is at
-                      least 70% of desired pods.
-                    x-kubernetes-int-or-string: true
-                type: object
-              runtimeClassName:
-                description: |-
-                  RuntimeClassName - defines runtime class for kubernetes pod.
-                  https://kubernetes.io/docs/concepts/containers/runtime-class/
-                type: string
-              schedulerName:
-                description: SchedulerName - defines kubernetes scheduler name
-                type: string
-              scrapeConfigNamespaceSelector:
-                description: |-
-                  ScrapeConfigNamespaceSelector defines Namespaces to be selected for VMScrapeConfig discovery.
-                  Works in combination with Selector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              scrapeConfigRelabelTemplate:
-                description: |-
-                  ScrapeConfigRelabelTemplate defines relabel config, that will be added to each VMScrapeConfig.
-                  it's useful for adding specific labels to all targets
-                items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
-                  properties:
-                    action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
-                      type: string
-                    if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
-                      x-kubernetes-preserve-unknown-fields: true
-                    labels:
-                      additionalProperties:
-                        type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
-                      type: object
-                    match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
-                      type: string
-                    modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
-                      format: int64
-                      type: integer
-                    regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                      x-kubernetes-preserve-unknown-fields: true
-                    replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
-                      type: string
-                    separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
-                      type: string
-                    source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      items:
-                        type: string
-                      type: array
-                    sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
-                      items:
-                        type: string
-                      type: array
-                    target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      type: string
-                    targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
-                      type: string
-                  type: object
-                type: array
-              scrapeConfigSelector:
-                description: |-
-                  ScrapeConfigSelector defines VMScrapeConfig to be selected for target discovery.
-                  Works in combination with NamespaceSelector.
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              scrapeInterval:
-                description: ScrapeInterval defines how often scrape targets by default
-                pattern: '[0-9]+(ms|s|m|h)'
-                type: string
-              scrapeTimeout:
-                description: ScrapeTimeout defines global timeout for targets scrape
-                pattern: '[0-9]+(ms|s|m|h)'
-                type: string
-              secrets:
-                description: |-
-                  Secrets is a list of Secrets in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/secrets/SECRET_NAME folder
-                items:
-                  type: string
-                type: array
-              securityContext:
-                description: |-
-                  SecurityContext holds pod-level security attributes and common container settings.
-                  This defaults to the default PodSecurityContext.
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              selectAllByDefault:
-                description: |-
-                  SelectAllByDefault changes default behavior for empty CRD selectors, such ServiceScrapeSelector.
-                  with selectAllByDefault: true and empty serviceScrapeSelector and ServiceScrapeNamespaceSelector
-                  Operator selects all exist serviceScrapes
-                  with selectAllByDefault: false - selects nothing
-                type: boolean
-              serviceAccountName:
-                description: ServiceAccountName is the name of the ServiceAccount
-                  to use to run the pods
-                type: string
-              serviceScrapeNamespaceSelector:
-                description: |-
-                  ServiceScrapeNamespaceSelector Namespaces to be selected for VMServiceScrape discovery.
-                  Works in combination with Selector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              serviceScrapeRelabelTemplate:
-                description: |-
-                  ServiceScrapeRelabelTemplate defines relabel config, that will be added to each VMServiceScrape.
-                  it's useful for adding specific labels to all targets
-                items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
-                  properties:
-                    action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
-                      type: string
-                    if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
-                      x-kubernetes-preserve-unknown-fields: true
-                    labels:
-                      additionalProperties:
-                        type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
-                      type: object
-                    match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
-                      type: string
-                    modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
-                      format: int64
-                      type: integer
-                    regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                      x-kubernetes-preserve-unknown-fields: true
-                    replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
-                      type: string
-                    separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
-                      type: string
-                    source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      items:
-                        type: string
-                      type: array
-                    sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
-                      items:
-                        type: string
-                      type: array
-                    target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      type: string
-                    targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
-                      type: string
-                  type: object
-                type: array
-              serviceScrapeSelector:
-                description: |-
-                  ServiceScrapeSelector defines ServiceScrapes to be selected for target discovery.
-                  Works in combination with NamespaceSelector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              serviceScrapeSpec:
-                description: ServiceScrapeSpec that will be added to vmagent VMServiceScrape
-                  spec
-                required:
-                - endpoints
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              serviceSpec:
-                description: ServiceSpec that will be added to vmagent service spec
-                properties:
-                  metadata:
-                    description: EmbeddedObjectMetadata defines objectMeta for additional
-                      service.
-                    properties:
-                      annotations:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Annotations is an unstructured key value map stored with a resource that may be
-                          set by external tools to store and retrieve arbitrary metadata. They are not
-                          queryable and should be preserved when modifying objects.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                        type: object
-                      labels:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Labels Map of string keys and values that can be used to organize and categorize
-                          (scope and select) objects. May match selectors of replication controllers
-                          and services.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                        type: object
-                      name:
-                        description: |-
-                          Name must be unique within a namespace. Is required when creating resources, although
-                          some resources may allow a client to request the generation of an appropriate name
-                          automatically. Name is primarily intended for creation idempotence and configuration
-                          definition.
-                          Cannot be updated.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                        type: string
-                    type: object
-                  spec:
-                    description: |-
-                      ServiceSpec describes the attributes that a user creates on a service.
-                      More info: https://kubernetes.io/docs/concepts/services-networking/service/
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  useAsDefault:
-                    description: |-
-                      UseAsDefault applies changes from given service definition to the main object Service
-                      Changing from headless service to clusterIP or loadbalancer may break cross-component communication
-                    type: boolean
-                required:
-                - spec
-                type: object
-              shardCount:
-                description: |-
-                  ShardCount - numbers of shards of VMAgent
-                  in this case operator will use 1 deployment/sts per shard with
-                  replicas count according to spec.replicas,
-                  see [here](https://docs.victoriametrics.com/vmagent/#scraping-big-number-of-targets)
-                type: integer
-              startupProbe:
-                description: StartupProbe that will be added to CRD pod
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              statefulMode:
-                description: |-
-                  StatefulMode enables StatefulSet for `VMAgent` instead of Deployment
-                  it allows using persistent storage for vmagent's persistentQueue
-                type: boolean
-              statefulRollingUpdateStrategy:
-                description: |-
-                  StatefulRollingUpdateStrategy allows configuration for strategyType
-                  set it to RollingUpdate for disabling operator statefulSet rollingUpdate
-                type: string
-              statefulStorage:
-                description: StatefulStorage configures storage for StatefulSet
-                properties:
-                  disableMountSubPath:
-                    description: |-
-                      Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary.
-                      DisableMountSubPath allows to remove any subPath usage in volume mounts.
-                    type: boolean
-                  emptyDir:
-                    description: |-
-                      EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More
-                      info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir
-                    properties:
-                      medium:
-                        description: |-
-                          medium represents what type of storage medium should back this directory.
-                          The default is "" which means to use the node's default medium.
-                          Must be an empty string (default) or Memory.
-                          More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
-                        type: string
-                      sizeLimit:
-                        anyOf:
-                        - type: integer
-                        - type: string
-                        description: |-
-                          sizeLimit is the total amount of local storage required for this EmptyDir volume.
-                          The size limit is also applicable for memory medium.
-                          The maximum usage on memory medium EmptyDir would be the minimum value between
-                          the SizeLimit specified here and the sum of memory limits of all containers in a pod.
-                          The default is nil which means that the limit is undefined.
-                          More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
-                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                        x-kubernetes-int-or-string: true
-                    type: object
-                  volumeClaimTemplate:
-                    description: A PVC spec to be used by the VMAlertManager StatefulSets.
-                    properties:
-                      apiVersion:
-                        description: |-
-                          APIVersion defines the versioned schema of this representation of an object.
-                          Servers should convert recognized schemas to the latest internal value, and
-                          may reject unrecognized values.
-                          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-                        type: string
-                      kind:
-                        description: |-
-                          Kind is a string value representing the REST resource this object represents.
-                          Servers may infer this from the endpoint the client submits requests to.
-                          Cannot be updated.
-                          In CamelCase.
-                          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-                        type: string
-                      metadata:
-                        description: EmbeddedMetadata contains metadata relevant to
-                          an EmbeddedResource.
-                        properties:
-                          annotations:
-                            additionalProperties:
-                              type: string
-                            description: |-
-                              Annotations is an unstructured key value map stored with a resource that may be
-                              set by external tools to store and retrieve arbitrary metadata. They are not
-                              queryable and should be preserved when modifying objects.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                            type: object
-                          labels:
-                            additionalProperties:
-                              type: string
-                            description: |-
-                              Labels Map of string keys and values that can be used to organize and categorize
-                              (scope and select) objects. May match selectors of replication controllers
-                              and services.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                            type: object
-                          name:
-                            description: |-
-                              Name must be unique within a namespace. Is required when creating resources, although
-                              some resources may allow a client to request the generation of an appropriate name
-                              automatically. Name is primarily intended for creation idempotence and configuration
-                              definition.
-                              Cannot be updated.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                            type: string
-                        type: object
-                      spec:
-                        description: |-
-                          Spec defines the desired characteristics of a volume requested by a pod author.
-                          More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
-                        properties:
-                          accessModes:
-                            description: |-
-                              accessModes contains the desired access modes the volume should have.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                            items:
-                              type: string
-                            type: array
-                            x-kubernetes-list-type: atomic
-                          dataSource:
-                            description: |-
-                              dataSource field can be used to specify either:
-                              * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
-                              * An existing PVC (PersistentVolumeClaim)
-                              If the provisioner or an external controller can support the specified data source,
-                              it will create a new volume based on the contents of the specified data source.
-                              When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-                              and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
-                              If the namespace is specified, then dataSourceRef will not be copied to dataSource.
-                            properties:
-                              apiGroup:
-                                description: |-
-                                  APIGroup is the group for the resource being referenced.
-                                  If APIGroup is not specified, the specified Kind must be in the core API group.
-                                  For any other third-party types, APIGroup is required.
-                                type: string
-                              kind:
-                                description: Kind is the type of resource being referenced
-                                type: string
-                              name:
-                                description: Name is the name of resource being referenced
-                                type: string
-                            required:
-                            - kind
-                            - name
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          dataSourceRef:
-                            description: |-
-                              dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
-                              volume is desired. This may be any object from a non-empty API group (non
-                              core object) or a PersistentVolumeClaim object.
-                              When this field is specified, volume binding will only succeed if the type of
-                              the specified object matches some installed volume populator or dynamic
-                              provisioner.
-                              This field will replace the functionality of the dataSource field and as such
-                              if both fields are non-empty, they must have the same value. For backwards
-                              compatibility, when namespace isn't specified in dataSourceRef,
-                              both fields (dataSource and dataSourceRef) will be set to the same
-                              value automatically if one of them is empty and the other is non-empty.
-                              When namespace is specified in dataSourceRef,
-                              dataSource isn't set to the same value and must be empty.
-                              There are three important differences between dataSource and dataSourceRef:
-                              * While dataSource only allows two specific types of objects, dataSourceRef
-                                allows any non-core object, as well as PersistentVolumeClaim objects.
-                              * While dataSource ignores disallowed values (dropping them), dataSourceRef
-                                preserves all values, and generates an error if a disallowed value is
-                                specified.
-                              * While dataSource only allows local objects, dataSourceRef allows objects
-                                in any namespaces.
-                              (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
-                              (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                            properties:
-                              apiGroup:
-                                description: |-
-                                  APIGroup is the group for the resource being referenced.
-                                  If APIGroup is not specified, the specified Kind must be in the core API group.
-                                  For any other third-party types, APIGroup is required.
-                                type: string
-                              kind:
-                                description: Kind is the type of resource being referenced
-                                type: string
-                              name:
-                                description: Name is the name of resource being referenced
-                                type: string
-                              namespace:
-                                description: |-
-                                  Namespace is the namespace of resource being referenced
-                                  Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
-                                  (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                                type: string
-                            required:
-                            - kind
-                            - name
-                            type: object
-                          resources:
-                            description: |-
-                              resources represents the minimum resources the volume should have.
-                              If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
-                              that are lower than previous value but must still be higher than capacity recorded in the
-                              status field of the claim.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
-                            properties:
-                              limits:
-                                additionalProperties:
-                                  anyOf:
-                                  - type: integer
-                                  - type: string
-                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                  x-kubernetes-int-or-string: true
-                                description: |-
-                                  Limits describes the maximum amount of compute resources allowed.
-                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                                type: object
-                              requests:
-                                additionalProperties:
-                                  anyOf:
-                                  - type: integer
-                                  - type: string
-                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                  x-kubernetes-int-or-string: true
-                                description: |-
-                                  Requests describes the minimum amount of compute resources required.
-                                  If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                                  otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                                type: object
-                            type: object
-                          selector:
-                            description: selector is a label query over volumes to
-                              consider for binding.
-                            properties:
-                              matchExpressions:
-                                description: matchExpressions is a list of label selector
-                                  requirements. The requirements are ANDed.
-                                items:
-                                  description: |-
-                                    A label selector requirement is a selector that contains values, a key, and an operator that
-                                    relates the key and values.
-                                  properties:
-                                    key:
-                                      description: key is the label key that the selector
-                                        applies to.
-                                      type: string
-                                    operator:
-                                      description: |-
-                                        operator represents a key's relationship to a set of values.
-                                        Valid operators are In, NotIn, Exists and DoesNotExist.
-                                      type: string
-                                    values:
-                                      description: |-
-                                        values is an array of string values. If the operator is In or NotIn,
-                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                        the values array must be empty. This array is replaced during a strategic
-                                        merge patch.
-                                      items:
-                                        type: string
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                  required:
-                                  - key
-                                  - operator
-                                  type: object
-                                type: array
-                                x-kubernetes-list-type: atomic
-                              matchLabels:
-                                additionalProperties:
-                                  type: string
-                                description: |-
-                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                type: object
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          storageClassName:
-                            description: |-
-                              storageClassName is the name of the StorageClass required by the claim.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
-                            type: string
-                          volumeAttributesClassName:
-                            description: |-
-                              volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
-                              If specified, the CSI driver will create or update the volume with the attributes defined
-                              in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                              it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                              will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                              If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                              will be set by the persistentvolume controller if it exists.
-                              If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
-                              set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
-                              exists.
-                              More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                              (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
-                            type: string
-                          volumeMode:
-                            description: |-
-                              volumeMode defines what type of volume is required by the claim.
-                              Value of Filesystem is implied when not included in claim spec.
-                            type: string
-                          volumeName:
-                            description: volumeName is the binding reference to the
-                              PersistentVolume backing this claim.
-                            type: string
-                        type: object
-                      status:
-                        description: |-
-                          Status represents the current information/status of a persistent volume claim.
-                          Read-only.
-                          More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
-                        properties:
-                          accessModes:
-                            description: |-
-                              accessModes contains the actual access modes the volume backing the PVC has.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                            items:
-                              type: string
-                            type: array
-                            x-kubernetes-list-type: atomic
-                          allocatedResourceStatuses:
-                            additionalProperties:
-                              description: |-
-                                When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource
-                                that it does not recognizes, then it should ignore that update and let other controllers
-                                handle it.
-                              type: string
-                            description: "allocatedResourceStatuses stores status
-                              of resource being resized for the given PVC.\nKey names
-                              follow standard Kubernetes label syntax. Valid values
-                              are either:\n\t* Un-prefixed keys:\n\t\t- storage -
-                              the capacity of the volume.\n\t* Custom resources must
-                              use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart
-                              from above values - keys that are unprefixed or have
-                              kubernetes.io prefix are considered\nreserved and hence
-                              may not be used.\n\nClaimResourceStatus can be in any
-                              of following states:\n\t- ControllerResizeInProgress:\n\t\tState
-                              set when resize controller starts resizing the volume
-                              in control-plane.\n\t- ControllerResizeFailed:\n\t\tState
-                              set when resize has failed in resize controller with
-                              a terminal error.\n\t- NodeResizePending:\n\t\tState
-                              set when resize controller has finished resizing the
-                              volume but further resizing of\n\t\tvolume is needed
-                              on the node.\n\t- NodeResizeInProgress:\n\t\tState set
-                              when kubelet starts resizing the volume.\n\t- NodeResizeFailed:\n\t\tState
-                              set when resizing has failed in kubelet with a terminal
-                              error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor
-                              example: if expanding a PVC for more capacity - this
-                              field can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage']
-                              = \"ControllerResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                              = \"ControllerResizeFailed\"\n     - pvc.status.allocatedResourceStatus['storage']
-                              = \"NodeResizePending\"\n     - pvc.status.allocatedResourceStatus['storage']
-                              = \"NodeResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                              = \"NodeResizeFailed\"\nWhen this field is not set,
-                              it means that no resize operation is in progress for
-                              the given PVC.\n\nA controller that receives PVC update
-                              with previously unknown resourceName or ClaimResourceStatus\nshould
-                              ignore the update for the purpose it was designed. For
-                              example - a controller that\nonly is responsible for
-                              resizing capacity of the volume, should ignore PVC updates
-                              that change other valid\nresources associated with PVC.\n\nThis
-                              is an alpha field and requires enabling RecoverVolumeExpansionFailure
-                              feature."
-                            type: object
-                            x-kubernetes-map-type: granular
-                          allocatedResources:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: "allocatedResources tracks the resources
-                              allocated to a PVC including its capacity.\nKey names
-                              follow standard Kubernetes label syntax. Valid values
-                              are either:\n\t* Un-prefixed keys:\n\t\t- storage -
-                              the capacity of the volume.\n\t* Custom resources must
-                              use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart
-                              from above values - keys that are unprefixed or have
-                              kubernetes.io prefix are considered\nreserved and hence
-                              may not be used.\n\nCapacity reported here may be larger
-                              than the actual capacity when a volume expansion operation\nis
-                              requested.\nFor storage quota, the larger value from
-                              allocatedResources and PVC.spec.resources is used.\nIf
-                              allocatedResources is not set, PVC.spec.resources alone
-                              is used for quota calculation.\nIf a volume expansion
-                              capacity request is lowered, allocatedResources is only\nlowered
-                              if there are no expansion operations in progress and
-                              if the actual volume capacity\nis equal or lower than
-                              the requested capacity.\n\nA controller that receives
-                              PVC update with previously unknown resourceName\nshould
-                              ignore the update for the purpose it was designed. For
-                              example - a controller that\nonly is responsible for
-                              resizing capacity of the volume, should ignore PVC updates
-                              that change other valid\nresources associated with PVC.\n\nThis
-                              is an alpha field and requires enabling RecoverVolumeExpansionFailure
-                              feature."
-                            type: object
-                          capacity:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: capacity represents the actual resources
-                              of the underlying volume.
-                            type: object
-                          conditions:
-                            description: |-
-                              conditions is the current Condition of persistent volume claim. If underlying persistent volume is being
-                              resized then the Condition will be set to 'Resizing'.
-                            items:
-                              description: PersistentVolumeClaimCondition contains
-                                details about state of pvc
-                              properties:
-                                lastProbeTime:
-                                  description: lastProbeTime is the time we probed
-                                    the condition.
-                                  format: date-time
-                                  type: string
-                                lastTransitionTime:
-                                  description: lastTransitionTime is the time the
-                                    condition transitioned from one status to another.
-                                  format: date-time
-                                  type: string
-                                message:
-                                  description: message is the human-readable message
-                                    indicating details about last transition.
-                                  type: string
-                                reason:
-                                  description: |-
-                                    reason is a unique, this should be a short, machine understandable string that gives the reason
-                                    for condition's last transition. If it reports "Resizing" that means the underlying
-                                    persistent volume is being resized.
-                                  type: string
-                                status:
-                                  description: |-
-                                    Status is the status of the condition.
-                                    Can be True, False, Unknown.
-                                    More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required
-                                  type: string
-                                type:
-                                  description: |-
-                                    Type is the type of the condition.
-                                    More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about
-                                  type: string
-                              required:
-                              - status
-                              - type
-                              type: object
-                            type: array
-                            x-kubernetes-list-map-keys:
-                            - type
-                            x-kubernetes-list-type: map
-                          currentVolumeAttributesClassName:
-                            description: |-
-                              currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
-                              When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                              This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
-                            type: string
-                          modifyVolumeStatus:
-                            description: |-
-                              ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
-                              When this is unset, there is no ModifyVolume operation being attempted.
-                              This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
-                            properties:
-                              status:
-                                description: "status is the status of the ControllerModifyVolume
-                                  operation. It can be in any of following states:\n
-                                  - Pending\n   Pending indicates that the PersistentVolumeClaim
-                                  cannot be modified due to unmet requirements, such
-                                  as\n   the specified VolumeAttributesClass not existing.\n
-                                  - InProgress\n   InProgress indicates that the volume
-                                  is being modified.\n - Infeasible\n  Infeasible
-                                  indicates that the request has been rejected as
-                                  invalid by the CSI driver. To\n\t  resolve the error,
-                                  a valid VolumeAttributesClass needs to be specified.\nNote:
-                                  New statuses can be added in the future. Consumers
-                                  should check for unknown statuses and fail appropriately."
-                                type: string
-                              targetVolumeAttributesClassName:
-                                description: targetVolumeAttributesClassName is the
-                                  name of the VolumeAttributesClass the PVC currently
-                                  being reconciled
-                                type: string
-                            required:
-                            - status
-                            type: object
-                          phase:
-                            description: phase represents the current phase of PersistentVolumeClaim.
-                            type: string
-                        type: object
-                    type: object
-                type: object
-              staticScrapeNamespaceSelector:
-                description: |-
-                  StaticScrapeNamespaceSelector defines Namespaces to be selected for VMStaticScrape discovery.
-                  Works in combination with NamespaceSelector.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              staticScrapeRelabelTemplate:
-                description: |-
-                  StaticScrapeRelabelTemplate defines relabel config, that will be added to each VMStaticScrape.
-                  it's useful for adding specific labels to all targets
-                items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
-                  properties:
-                    action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
-                      type: string
-                    if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
-                      x-kubernetes-preserve-unknown-fields: true
-                    labels:
-                      additionalProperties:
-                        type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
-                      type: object
-                    match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
-                      type: string
-                    modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
-                      format: int64
-                      type: integer
-                    regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                      x-kubernetes-preserve-unknown-fields: true
-                    replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
-                      type: string
-                    separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
-                      type: string
-                    source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      items:
-                        type: string
-                      type: array
-                    sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
-                      items:
-                        type: string
-                      type: array
-                    target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      type: string
-                    targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
-                      type: string
-                  type: object
-                type: array
-              staticScrapeSelector:
-                description: |-
-                  StaticScrapeSelector defines VMStaticScrape to be selected for target discovery.
-                  Works in combination with NamespaceSelector.
-                  If both nil - match everything.
-                  NamespaceSelector nil - only objects at VMAgent namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              streamAggrConfig:
-                description: StreamAggrConfig defines global stream aggregation configuration
-                  for VMAgent
-                properties:
-                  configmap:
-                    description: ConfigMap with stream aggregation rules
-                    properties:
-                      key:
-                        description: The key to select.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the ConfigMap or its key must
-                          be defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  dedupInterval:
-                    description: Allows setting different de-duplication intervals
-                      per each configured remote storage
-                    type: string
-                  dropInput:
-                    description: Allow drop all the input samples after the aggregation
-                    type: boolean
-                  dropInputLabels:
-                    description: labels to drop from samples for aggregator before
-                      stream de-duplication and aggregation
-                    items:
-                      type: string
-                    type: array
-                  enableWindows:
-                    description: EnableWindows enables aggregating data in separate
-                      windows ( available from v0.54.0).
-                    type: boolean
-                  ignoreFirstIntervals:
-                    description: IgnoreFirstIntervals instructs to ignore first interval
-                    type: integer
-                  ignoreOldSamples:
-                    description: IgnoreOldSamples instructs to ignore samples with
-                      old timestamps outside the current aggregation interval.
-                    type: boolean
-                  keepInput:
-                    description: Allows writing both raw and aggregate data
-                    type: boolean
-                  rules:
-                    description: Stream aggregation rules
-                    items:
-                      description: StreamAggrRule defines the rule in stream aggregation
-                        config
-                      properties:
-                        by:
-                          description: |-
-                            By is an optional list of labels for grouping input series.
-
-                            See also Without.
-
-                            If neither By nor Without are set, then the Outputs are calculated
-                            individually per each input time series.
-                          items:
-                            type: string
-                          type: array
-                        dedup_interval:
-                          description: DedupInterval is an optional interval for deduplication.
-                          type: string
-                        drop_input_labels:
-                          description: |-
-                            DropInputLabels is an optional list with labels, which must be dropped before further processing of input samples.
-
-                            Labels are dropped before de-duplication and aggregation.
-                          items:
-                            type: string
-                          type: array
-                        enable_windows:
-                          description: EnableWindows enables aggregating data in separate
-                            windows
-                          type: boolean
-                        flush_on_shutdown:
-                          description: |-
-                            FlushOnShutdown defines whether to flush the aggregation state on process termination
-                            or config reload. Is `false` by default.
-                            It is not recommended changing this setting, unless unfinished aggregations states
-                            are preferred to missing data points.
-                          type: boolean
-                        ignore_first_intervals:
-                          type: integer
-                        ignore_old_samples:
-                          description: IgnoreOldSamples instructs to ignore samples
-                            with old timestamps outside the current aggregation interval.
-                          type: boolean
-                        input_relabel_configs:
-                          description: |-
-                            InputRelabelConfigs is an optional relabeling rules, which are applied on the input
-                            before aggregation.
-                          items:
-                            description: |-
-                              RelabelConfig allows dynamic rewriting of the label set
-                              More info: https://docs.victoriametrics.com/#relabeling
-                            properties:
-                              action:
-                                description: Action to perform based on regex matching.
-                                  Default is 'replace'
-                                type: string
-                              if:
-                                description: 'If represents metricsQL match expression
-                                  (or list of expressions): ''{__name__=~"foo_.*"}'''
-                                x-kubernetes-preserve-unknown-fields: true
-                              labels:
-                                additionalProperties:
-                                  type: string
-                                description: 'Labels is used together with Match for
-                                  `action: graphite`'
-                                type: object
-                              match:
-                                description: 'Match is used together with Labels for
-                                  `action: graphite`'
-                                type: string
-                              modulus:
-                                description: Modulus to take of the hash of the source
-                                  label values.
-                                format: int64
-                                type: integer
-                              regex:
-                                description: |-
-                                  Regular expression against which the extracted value is matched. Default is '(.*)'
-                                  victoriaMetrics supports multiline regex joined with |
-                                  https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                                x-kubernetes-preserve-unknown-fields: true
-                              replacement:
-                                description: |-
-                                  Replacement value against which a regex replace is performed if the
-                                  regular expression matches. Regex capture groups are available. Default is '$1'
-                                type: string
-                              separator:
-                                description: Separator placed between concatenated
-                                  source label values. default is ';'.
-                                type: string
-                              source_labels:
-                                description: |-
-                                  UnderScoreSourceLabels - additional form of source labels source_labels
-                                  for compatibility with original relabel config.
-                                  if set  both sourceLabels and source_labels, sourceLabels has priority.
-                                  for details https://github.com/VictoriaMetrics/operator/issues/131
-                                items:
-                                  type: string
-                                type: array
-                              sourceLabels:
-                                description: |-
-                                  The source labels select values from existing labels. Their content is concatenated
-                                  using the configured separator and matched against the configured regular expression
-                                  for the replace, keep, and drop actions.
-                                items:
-                                  type: string
-                                type: array
-                              target_label:
-                                description: |-
-                                  UnderScoreTargetLabel - additional form of target label - target_label
-                                  for compatibility with original relabel config.
-                                  if set  both targetLabel and target_label, targetLabel has priority.
-                                  for details https://github.com/VictoriaMetrics/operator/issues/131
-                                type: string
-                              targetLabel:
-                                description: |-
-                                  Label to which the resulting value is written in a replace action.
-                                  It is mandatory for replace actions. Regex capture groups are available.
-                                type: string
-                            type: object
-                          type: array
-                        interval:
-                          description: Interval is the interval between aggregations.
-                          type: string
-                        keep_metric_names:
-                          description: KeepMetricNames instructs to leave metric names
-                            as is for the output time series without adding any suffix.
-                          type: boolean
-                        match:
-                          description: |-
-                            Match is a label selector (or list of label selectors) for filtering time series for the given selector.
-
-                            If the match isn't set, then all the input time series are processed.
-                          x-kubernetes-preserve-unknown-fields: true
-                        no_align_flush_to_interval:
-                          description: |-
-                            NoAlignFlushToInterval disables aligning of flushes to multiples of Interval.
-                            By default flushes are aligned to Interval.
-                          type: boolean
-                        output_relabel_configs:
-                          description: |-
-                            OutputRelabelConfigs is an optional relabeling rules, which are applied
-                            on the aggregated output before being sent to remote storage.
-                          items:
-                            description: |-
-                              RelabelConfig allows dynamic rewriting of the label set
-                              More info: https://docs.victoriametrics.com/#relabeling
-                            properties:
-                              action:
-                                description: Action to perform based on regex matching.
-                                  Default is 'replace'
-                                type: string
-                              if:
-                                description: 'If represents metricsQL match expression
-                                  (or list of expressions): ''{__name__=~"foo_.*"}'''
-                                x-kubernetes-preserve-unknown-fields: true
-                              labels:
-                                additionalProperties:
-                                  type: string
-                                description: 'Labels is used together with Match for
-                                  `action: graphite`'
-                                type: object
-                              match:
-                                description: 'Match is used together with Labels for
-                                  `action: graphite`'
-                                type: string
-                              modulus:
-                                description: Modulus to take of the hash of the source
-                                  label values.
-                                format: int64
-                                type: integer
-                              regex:
-                                description: |-
-                                  Regular expression against which the extracted value is matched. Default is '(.*)'
-                                  victoriaMetrics supports multiline regex joined with |
-                                  https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                                x-kubernetes-preserve-unknown-fields: true
-                              replacement:
-                                description: |-
-                                  Replacement value against which a regex replace is performed if the
-                                  regular expression matches. Regex capture groups are available. Default is '$1'
-                                type: string
-                              separator:
-                                description: Separator placed between concatenated
-                                  source label values. default is ';'.
-                                type: string
-                              source_labels:
-                                description: |-
-                                  UnderScoreSourceLabels - additional form of source labels source_labels
-                                  for compatibility with original relabel config.
-                                  if set  both sourceLabels and source_labels, sourceLabels has priority.
-                                  for details https://github.com/VictoriaMetrics/operator/issues/131
-                                items:
-                                  type: string
-                                type: array
-                              sourceLabels:
-                                description: |-
-                                  The source labels select values from existing labels. Their content is concatenated
-                                  using the configured separator and matched against the configured regular expression
-                                  for the replace, keep, and drop actions.
-                                items:
-                                  type: string
-                                type: array
-                              target_label:
-                                description: |-
-                                  UnderScoreTargetLabel - additional form of target label - target_label
-                                  for compatibility with original relabel config.
-                                  if set  both targetLabel and target_label, targetLabel has priority.
-                                  for details https://github.com/VictoriaMetrics/operator/issues/131
-                                type: string
-                              targetLabel:
-                                description: |-
-                                  Label to which the resulting value is written in a replace action.
-                                  It is mandatory for replace actions. Regex capture groups are available.
-                                type: string
-                            type: object
-                          type: array
-                        outputs:
-                          description: |-
-                            Outputs is a list of output aggregate functions to produce.
-
-                            The following names are allowed:
-
-                            - total - aggregates input counters
-                            - increase - counts the increase over input counters
-                            - count_series - counts the input series
-                            - count_samples - counts the input samples
-                            - sum_samples - sums the input samples
-                            - last - the last biggest sample value
-                            - min - the minimum sample value
-                            - max - the maximum sample value
-                            - avg - the average value across all the samples
-                            - stddev - standard deviation across all the samples
-                            - stdvar - standard variance across all the samples
-                            - histogram_bucket - creates VictoriaMetrics histogram for input samples
-                            - quantiles(phi1, ..., phiN) - quantiles' estimation for phi in the range [0..1]
-
-                            The output time series will have the following names:
-
-                              input_name:aggr_<interval>_<output>
-                          items:
-                            type: string
-                          type: array
-                        staleness_interval:
-                          description: |-
-                            Staleness interval is interval after which the series state will be reset if no samples have been sent during it.
-                            The parameter is only relevant for outputs: total, total_prometheus, increase, increase_prometheus and histogram_bucket.
-                          type: string
-                        without:
-                          description: |-
-                            Without is an optional list of labels, which must be excluded when grouping input series.
-
-                            See also By.
-
-                            If neither By nor Without are set, then the Outputs are calculated
-                            individually per each input time series.
-                          items:
-                            type: string
-                          type: array
-                      required:
-                      - interval
-                      - outputs
-                      type: object
-                    type: array
-                type: object
-              terminationGracePeriodSeconds:
-                description: TerminationGracePeriodSeconds period for container graceful
-                  termination
-                format: int64
-                type: integer
-              tolerations:
-                description: Tolerations If specified, the pod's tolerations.
-                items:
-                  description: |-
-                    The pod this Toleration is attached to tolerates any taint that matches
-                    the triple <key,value,effect> using the matching operator <operator>.
-                  properties:
-                    effect:
-                      description: |-
-                        Effect indicates the taint effect to match. Empty means match all taint effects.
-                        When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                      type: string
-                    key:
-                      description: |-
-                        Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                        If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                      type: string
-                    operator:
-                      description: |-
-                        Operator represents a key's relationship to the value.
-                        Valid operators are Exists and Equal. Defaults to Equal.
-                        Exists is equivalent to wildcard for value, so that a pod can
-                        tolerate all taints of a particular category.
-                      type: string
-                    tolerationSeconds:
-                      description: |-
-                        TolerationSeconds represents the period of time the toleration (which must be
-                        of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                        it is not set, which means tolerate the taint forever (do not evict). Zero and
-                        negative values will be treated as 0 (evict immediately) by the system.
-                      format: int64
-                      type: integer
-                    value:
-                      description: |-
-                        Value is the taint value the toleration matches to.
-                        If the operator is Exists, the value should be empty, otherwise just a regular string.
-                      type: string
-                  type: object
-                type: array
-              topologySpreadConstraints:
-                description: |-
-                  TopologySpreadConstraints embedded kubernetes pod configuration option,
-                  controls how pods are spread across your cluster among failure-domains
-                  such as regions, zones, nodes, and other user-defined topology domains
-                  https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
-                items:
-                  description: TopologySpreadConstraint specifies how to spread matching
-                    pods among the given topology.
-                  required:
-                  - maxSkew
-                  - topologyKey
-                  - whenUnsatisfiable
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              updateStrategy:
-                description: |-
-                  UpdateStrategy - overrides default update strategy.
-                  works only for deployments, statefulset always use OnDelete.
-                enum:
-                - Recreate
-                - RollingUpdate
-                type: string
-              useDefaultResources:
-                description: |-
-                  UseDefaultResources controls resource settings
-                  By default, operator sets built-in resource requirements
-                type: boolean
-              useStrictSecurity:
-                description: |-
-                  UseStrictSecurity enables strict security mode for component
-                  it restricts disk writes access
-                  uses non-root user out of the box
-                  drops not needed security permissions
-                type: boolean
-              useVMConfigReloader:
-                description: |-
-                  UseVMConfigReloader replaces prometheus-like config-reloader
-                  with vm one. It uses secrets watch instead of file watch
-                  which greatly increases speed of config updates
-                type: boolean
-              vmAgentExternalLabelName:
-                description: |-
-                  VMAgentExternalLabelName Name of vmAgent external label used to denote vmAgent instance
-                  name. Defaults to the value of `prometheus`. External label will
-                  _not_ be added when value is set to empty string (`""`).
-                type: string
-              volumeMounts:
-                description: |-
-                  VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
-                  VolumeMounts specified will be appended to other VolumeMounts in the Application container
-                items:
-                  description: VolumeMount describes a mounting of a Volume within
-                    a container.
-                  properties:
-                    mountPath:
-                      description: |-
-                        Path within the container at which the volume should be mounted.  Must
-                        not contain ':'.
-                      type: string
-                    mountPropagation:
-                      description: |-
-                        mountPropagation determines how mounts are propagated from the host
-                        to container and the other way around.
-                        When not set, MountPropagationNone is used.
-                        This field is beta in 1.10.
-                        When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                        (which defaults to None).
-                      type: string
-                    name:
-                      description: This must match the Name of a Volume.
-                      type: string
-                    readOnly:
-                      description: |-
-                        Mounted read-only if true, read-write otherwise (false or unspecified).
-                        Defaults to false.
-                      type: boolean
-                    recursiveReadOnly:
-                      description: |-
-                        RecursiveReadOnly specifies whether read-only mounts should be handled
-                        recursively.
-
-                        If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                        If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                        recursively read-only.  If this field is set to IfPossible, the mount is made
-                        recursively read-only, if it is supported by the container runtime.  If this
-                        field is set to Enabled, the mount is made recursively read-only if it is
-                        supported by the container runtime, otherwise the pod will not be started and
-                        an error will be generated to indicate the reason.
-
-                        If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                        None (or be unspecified, which defaults to None).
-
-                        If this field is not specified, it is treated as an equivalent of Disabled.
-                      type: string
-                    subPath:
-                      description: |-
-                        Path within the volume from which the container's volume should be mounted.
-                        Defaults to "" (volume's root).
-                      type: string
-                    subPathExpr:
-                      description: |-
-                        Expanded path within the volume from which the container's volume should be mounted.
-                        Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                        Defaults to "" (volume's root).
-                        SubPathExpr and SubPath are mutually exclusive.
-                      type: string
-                  required:
-                  - mountPath
-                  - name
-                  type: object
-                type: array
-              volumes:
-                description: |-
-                  Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
-                  Volumes specified will be appended to other volumes that are generated.
-                  / +optional
-                items:
-                  description: Volume represents a named volume in a pod that may
-                    be accessed by any container in the pod.
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
             required:
             - remoteWrite
             type: object
+            x-kubernetes-preserve-unknown-fields: true
           status:
-            description: VMAgentStatus defines the observed state of VMAgent
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -5810,28 +484,19 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               replicas:
-                description: ReplicaCount Total number of pods targeted by this VMAgent
                 format: int32
                 type: integer
               selector:
-                description: Selector string form of label value set for autoscaling
                 type: string
               shards:
-                description: Shards represents total number of vmagent deployments
-                  with uniq scrape targets
                 format: int32
                 type: integer
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -5848,7 +513,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmalertmanagerconfigs.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -5872,4266 +537,45 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: VMAlertmanagerConfig is the Schema for the vmalertmanagerconfigs
-          API
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: |-
-              VMAlertmanagerConfigSpec defines configuration for VMAlertmanagerConfig
-              it must reference only locally defined objects
-            properties:
-              inhibit_rules:
-                description: |-
-                  InhibitRules will only apply for alerts matching
-                  the resource's namespace.
-                items:
-                  description: |-
-                    InhibitRule defines an inhibition rule that allows to mute alerts when other
-                    alerts are already firing.
-                    Note, it doesn't support deprecated alertmanager config options.
-                    See https://prometheus.io/docs/alerting/latest/configuration/#inhibit_rule
-                  properties:
-                    equal:
-                      description: |-
-                        Labels that must have an equal value in the source and target alert for
-                        the inhibition to take effect.
-                      items:
-                        type: string
-                      type: array
-                    source_matchers:
-                      description: |-
-                        SourceMatchers defines a list of matchers for which one or more alerts have
-                        to exist for the inhibition to take effect.
-                      items:
-                        type: string
-                      type: array
-                    target_matchers:
-                      description: |-
-                        TargetMatchers defines a list of matchers that have to be fulfilled by the target
-                        alerts to be muted.
-                      items:
-                        type: string
-                      type: array
-                  type: object
-                type: array
-              receivers:
-                description: Receivers defines alert receivers
-                items:
-                  description: Receiver defines one or more notification integrations.
-                  properties:
-                    discord_configs:
-                      items:
-                        properties:
-                          avatar_url:
-                            description: |-
-                              AvatarURL defines message avatar URL
-                              Available from operator v0.55.0 and alertmanager v0.28.0
-                            type: string
-                          content:
-                            description: |-
-                              Content defines message content template
-                              Available from operator v0.55.0 and alertmanager v0.28.0
-                            maxLength: 2000
-                            type: string
-                          http_config:
-                            description: HTTP client configuration.
-                            properties:
-                              authorization:
-                                description: |-
-                                  Authorization header configuration for the client.
-                                  This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+.
-                                properties:
-                                  credentials:
-                                    description: Reference to the secret with value
-                                      for authorization
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  credentialsFile:
-                                    description: File with value for authorization
-                                    type: string
-                                  type:
-                                    description: Type of authorization, default to
-                                      bearer
-                                    type: string
-                                type: object
-                              basic_auth:
-                                description: BasicAuth for the client.
-                                properties:
-                                  password:
-                                    description: |-
-                                      Password defines reference for secret with password value
-                                      The secret needs to be in the same namespace as scrape object
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  password_file:
-                                    description: |-
-                                      PasswordFile defines path to password file at disk
-                                      must be pre-mounted
-                                    type: string
-                                  username:
-                                    description: |-
-                                      Username defines reference for secret with username value
-                                      The secret needs to be in the same namespace as scrape object
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                type: object
-                              bearer_token_file:
-                                description: BearerTokenFile defines filename for
-                                  bearer token, it must be mounted to pod.
-                                type: string
-                              bearer_token_secret:
-                                description: |-
-                                  The secret's key that contains the bearer token
-                                  It must be at them same namespace as CRD
-                                properties:
-                                  key:
-                                    description: The key of the secret to select from.  Must
-                                      be a valid secret key.
-                                    type: string
-                                  name:
-                                    default: ""
-                                    description: |-
-                                      Name of the referent.
-                                      This field is effectively required, but due to backwards compatibility is
-                                      allowed to be empty. Instances of this type with an empty value here are
-                                      almost certainly wrong.
-                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    type: string
-                                  optional:
-                                    description: Specify whether the Secret or its
-                                      key must be defined
-                                    type: boolean
-                                required:
-                                - key
-                                type: object
-                                x-kubernetes-map-type: atomic
-                              oauth2:
-                                description: OAuth2 client credentials used to fetch
-                                  a token for the targets.
-                                properties:
-                                  client_id:
-                                    description: The secret or configmap containing
-                                      the OAuth2 client id
-                                    properties:
-                                      configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
-                                        properties:
-                                          key:
-                                            description: The key to select.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      secret:
-                                        description: Secret containing data to use
-                                          for the targets.
-                                        properties:
-                                          key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  client_secret:
-                                    description: The secret containing the OAuth2
-                                      client secret
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  client_secret_file:
-                                    description: ClientSecretFile defines path for
-                                      client secret file.
-                                    type: string
-                                  endpoint_params:
-                                    additionalProperties:
-                                      type: string
-                                    description: Parameters to append to the token
-                                      URL
-                                    type: object
-                                  proxy_url:
-                                    description: |-
-                                      The proxy URL for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
-                                    type: string
-                                  scopes:
-                                    description: OAuth2 scopes used for the token
-                                      request
-                                    items:
-                                      type: string
-                                    type: array
-                                  tls_config:
-                                    description: |-
-                                      TLSConfig for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
-                                    x-kubernetes-preserve-unknown-fields: true
-                                  token_url:
-                                    description: The URL to fetch the token from
-                                    minLength: 1
-                                    type: string
-                                required:
-                                - client_id
-                                - token_url
-                                type: object
-                              proxyURL:
-                                description: Optional proxy URL.
-                                type: string
-                              tls_config:
-                                description: TLS configuration for the client.
-                                properties:
-                                  ca:
-                                    description: Struct containing the CA cert to
-                                      use for the targets.
-                                    properties:
-                                      configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
-                                        properties:
-                                          key:
-                                            description: The key to select.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      secret:
-                                        description: Secret containing data to use
-                                          for the targets.
-                                        properties:
-                                          key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  caFile:
-                                    description: Path to the CA cert in the container
-                                      to use for the targets.
-                                    type: string
-                                  cert:
-                                    description: Struct containing the client cert
-                                      file for the targets.
-                                    properties:
-                                      configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
-                                        properties:
-                                          key:
-                                            description: The key to select.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      secret:
-                                        description: Secret containing data to use
-                                          for the targets.
-                                        properties:
-                                          key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  certFile:
-                                    description: Path to the client cert file in the
-                                      container for the targets.
-                                    type: string
-                                  insecureSkipVerify:
-                                    description: Disable target certificate validation.
-                                    type: boolean
-                                  keyFile:
-                                    description: Path to the client key file in the
-                                      container for the targets.
-                                    type: string
-                                  keySecret:
-                                    description: Secret containing the client key
-                                      file for the targets.
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  serverName:
-                                    description: Used to verify the hostname for the
-                                      targets.
-                                    type: string
-                                type: object
-                            type: object
-                          message:
-                            description: The message body template
-                            type: string
-                          send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
-                            type: boolean
-                          title:
-                            description: The message title template
-                            type: string
-                          username:
-                            description: |-
-                              Username defines message username
-                              Available from operator v0.55.0 and alertmanager v0.28.0
-                            type: string
-                          webhook_url:
-                            description: |-
-                              The discord webhook URL
-                              one of `urlSecret` and `url` must be defined.
-                            type: string
-                          webhook_url_secret:
-                            description: |-
-                              URLSecret defines secret name and key at the CRD namespace.
-                              It must contain the webhook URL.
-                              one of `urlSecret` and `url` must be defined.
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                        type: object
-                      type: array
-                    email_configs:
-                      description: EmailConfigs defines email notification configurations.
-                      items:
-                        description: EmailConfig configures notifications via Email.
-                        properties:
-                          auth_identity:
-                            description: The identity to use for authentication.
-                            type: string
-                          auth_password:
-                            description: AuthPassword defines secret name and key
-                              at CRD namespace.
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          auth_secret:
-                            description: |-
-                              AuthSecret defines secrent name and key at CRD namespace.
-                              It must contain the CRAM-MD5 secret.
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          auth_username:
-                            description: The username to use for authentication.
-                            type: string
-                          from:
-                            description: |-
-                              The sender address.
-                              fallback to global setting if empty
-                            type: string
-                          headers:
-                            additionalProperties:
-                              type: string
-                            description: |-
-                              Further headers email header key/value pairs. Overrides any headers
-                              previously set by the notification implementation.
-                            type: object
-                          hello:
-                            description: The hostname to identify to the SMTP server.
-                            type: string
-                          html:
-                            description: The HTML body of the email notification.
-                            type: string
-                          require_tls:
-                            description: |-
-                              The SMTP TLS requirement.
-                              Note that Go does not support unencrypted connections to remote SMTP endpoints.
-                            type: boolean
-                          send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
-                            type: boolean
-                          smarthost:
-                            description: |-
-                              The SMTP host through which emails are sent.
-                              fallback to global setting if empty
-                            type: string
-                          text:
-                            description: The text body of the email notification.
-                            type: string
-                          tls_config:
-                            description: TLS configuration
-                            properties:
-                              ca:
-                                description: Struct containing the CA cert to use
-                                  for the targets.
-                                properties:
-                                  configMap:
-                                    description: ConfigMap containing data to use
-                                      for the targets.
-                                    properties:
-                                      key:
-                                        description: The key to select.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the ConfigMap
-                                          or its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  secret:
-                                    description: Secret containing data to use for
-                                      the targets.
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                type: object
-                              caFile:
-                                description: Path to the CA cert in the container
-                                  to use for the targets.
-                                type: string
-                              cert:
-                                description: Struct containing the client cert file
-                                  for the targets.
-                                properties:
-                                  configMap:
-                                    description: ConfigMap containing data to use
-                                      for the targets.
-                                    properties:
-                                      key:
-                                        description: The key to select.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the ConfigMap
-                                          or its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  secret:
-                                    description: Secret containing data to use for
-                                      the targets.
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                type: object
-                              certFile:
-                                description: Path to the client cert file in the container
-                                  for the targets.
-                                type: string
-                              insecureSkipVerify:
-                                description: Disable target certificate validation.
-                                type: boolean
-                              keyFile:
-                                description: Path to the client key file in the container
-                                  for the targets.
-                                type: string
-                              keySecret:
-                                description: Secret containing the client key file
-                                  for the targets.
-                                properties:
-                                  key:
-                                    description: The key of the secret to select from.  Must
-                                      be a valid secret key.
-                                    type: string
-                                  name:
-                                    default: ""
-                                    description: |-
-                                      Name of the referent.
-                                      This field is effectively required, but due to backwards compatibility is
-                                      allowed to be empty. Instances of this type with an empty value here are
-                                      almost certainly wrong.
-                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    type: string
-                                  optional:
-                                    description: Specify whether the Secret or its
-                                      key must be defined
-                                    type: boolean
-                                required:
-                                - key
-                                type: object
-                                x-kubernetes-map-type: atomic
-                              serverName:
-                                description: Used to verify the hostname for the targets.
-                                type: string
-                            type: object
-                          to:
-                            description: The email address to send notifications to.
-                            type: string
-                        type: object
-                      type: array
-                    jira_configs:
-                      items:
-                        description: |-
-                          JiraConfig represent alertmanager's jira_config entry
-                          https://prometheus.io/docs/alerting/latest/configuration/#jira_config
-                          available from v0.55.0 operator version
-                          and v0.28.0 alertmanager version
-                        properties:
-                          api_url:
-                            description: |-
-                              The URL to send API requests to. The full API path must be included.
-                              Example: https://company.atlassian.net/rest/api/2/
-                            type: string
-                          custom_fields:
-                            additionalProperties:
-                              x-kubernetes-preserve-unknown-fields: true
-                            description: |-
-                              Other issue and custom fields.
-                              Jira issue field can have multiple types.
-                              Depends on the field type, the values must be provided differently.
-                              See https://developer.atlassian.com/server/jira/platform/jira-rest-api-examples/#setting-custom-field-data-for-other-field-types for further examples.
-                            type: object
-                          description:
-                            description: Issue description template.
-                            type: string
-                          http_config:
-                            description: |-
-                              The HTTP client's configuration. You must use this configuration to supply the personal access token (PAT) as part of the HTTP `Authorization` header.
-                              For Jira Cloud, use basic_auth with the email address as the username and the PAT as the password.
-                              For Jira Data Center, use the 'authorization' field with 'credentials: <PAT value>'.
-                            x-kubernetes-preserve-unknown-fields: true
-                          issue_type:
-                            description: Type of the issue (e.g. Bug)
-                            type: string
-                          labels:
-                            description: Labels to be added to the issue
-                            items:
-                              type: string
-                            type: array
-                          priority:
-                            description: Priority of the issue
-                            type: string
-                          project:
-                            description: The project key where issues are created
-                            type: string
-                          reopen_duration:
-                            description: |-
-                              If reopen_transition is defined, reopen the issue when it is not older than this value (rounded down to the nearest minute).
-                              The resolutiondate field is used to determine the age of the issue.
-                            pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$
-                            type: string
-                          reopen_transition:
-                            description: |-
-                              Name of the workflow transition to resolve an issue.
-                              The target status must have the category "done".
-                            type: string
-                          resolve_transition:
-                            description: |-
-                              Name of the workflow transition to reopen an issue.
-                              The target status should not have the category "done".
-                            type: string
-                          send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
-                            type: boolean
-                          summary:
-                            description: Issue summary template
-                            type: string
-                          wont_fix_resolution:
-                            description: If reopen_transition is defined, ignore issues
-                              with that resolution.
-                            type: string
-                        required:
-                        - issue_type
-                        - project
-                        type: object
-                      type: array
-                    msteams_configs:
-                      items:
-                        properties:
-                          http_config:
-                            description: HTTP client configuration.
-                            properties:
-                              authorization:
-                                description: |-
-                                  Authorization header configuration for the client.
-                                  This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+.
-                                properties:
-                                  credentials:
-                                    description: Reference to the secret with value
-                                      for authorization
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  credentialsFile:
-                                    description: File with value for authorization
-                                    type: string
-                                  type:
-                                    description: Type of authorization, default to
-                                      bearer
-                                    type: string
-                                type: object
-                              basic_auth:
-                                description: BasicAuth for the client.
-                                properties:
-                                  password:
-                                    description: |-
-                                      Password defines reference for secret with password value
-                                      The secret needs to be in the same namespace as scrape object
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  password_file:
-                                    description: |-
-                                      PasswordFile defines path to password file at disk
-                                      must be pre-mounted
-                                    type: string
-                                  username:
-                                    description: |-
-                                      Username defines reference for secret with username value
-                                      The secret needs to be in the same namespace as scrape object
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                type: object
-                              bearer_token_file:
-                                description: BearerTokenFile defines filename for
-                                  bearer token, it must be mounted to pod.
-                                type: string
-                              bearer_token_secret:
-                                description: |-
-                                  The secret's key that contains the bearer token
-                                  It must be at them same namespace as CRD
-                                properties:
-                                  key:
-                                    description: The key of the secret to select from.  Must
-                                      be a valid secret key.
-                                    type: string
-                                  name:
-                                    default: ""
-                                    description: |-
-                                      Name of the referent.
-                                      This field is effectively required, but due to backwards compatibility is
-                                      allowed to be empty. Instances of this type with an empty value here are
-                                      almost certainly wrong.
-                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    type: string
-                                  optional:
-                                    description: Specify whether the Secret or its
-                                      key must be defined
-                                    type: boolean
-                                required:
-                                - key
-                                type: object
-                                x-kubernetes-map-type: atomic
-                              oauth2:
-                                description: OAuth2 client credentials used to fetch
-                                  a token for the targets.
-                                properties:
-                                  client_id:
-                                    description: The secret or configmap containing
-                                      the OAuth2 client id
-                                    properties:
-                                      configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
-                                        properties:
-                                          key:
-                                            description: The key to select.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      secret:
-                                        description: Secret containing data to use
-                                          for the targets.
-                                        properties:
-                                          key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  client_secret:
-                                    description: The secret containing the OAuth2
-                                      client secret
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  client_secret_file:
-                                    description: ClientSecretFile defines path for
-                                      client secret file.
-                                    type: string
-                                  endpoint_params:
-                                    additionalProperties:
-                                      type: string
-                                    description: Parameters to append to the token
-                                      URL
-                                    type: object
-                                  proxy_url:
-                                    description: |-
-                                      The proxy URL for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
-                                    type: string
-                                  scopes:
-                                    description: OAuth2 scopes used for the token
-                                      request
-                                    items:
-                                      type: string
-                                    type: array
-                                  tls_config:
-                                    description: |-
-                                      TLSConfig for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
-                                    x-kubernetes-preserve-unknown-fields: true
-                                  token_url:
-                                    description: The URL to fetch the token from
-                                    minLength: 1
-                                    type: string
-                                required:
-                                - client_id
-                                - token_url
-                                type: object
-                              proxyURL:
-                                description: Optional proxy URL.
-                                type: string
-                              tls_config:
-                                description: TLS configuration for the client.
-                                properties:
-                                  ca:
-                                    description: Struct containing the CA cert to
-                                      use for the targets.
-                                    properties:
-                                      configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
-                                        properties:
-                                          key:
-                                            description: The key to select.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      secret:
-                                        description: Secret containing data to use
-                                          for the targets.
-                                        properties:
-                                          key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  caFile:
-                                    description: Path to the CA cert in the container
-                                      to use for the targets.
-                                    type: string
-                                  cert:
-                                    description: Struct containing the client cert
-                                      file for the targets.
-                                    properties:
-                                      configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
-                                        properties:
-                                          key:
-                                            description: The key to select.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      secret:
-                                        description: Secret containing data to use
-                                          for the targets.
-                                        properties:
-                                          key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  certFile:
-                                    description: Path to the client cert file in the
-                                      container for the targets.
-                                    type: string
-                                  insecureSkipVerify:
-                                    description: Disable target certificate validation.
-                                    type: boolean
-                                  keyFile:
-                                    description: Path to the client key file in the
-                                      container for the targets.
-                                    type: string
-                                  keySecret:
-                                    description: Secret containing the client key
-                                      file for the targets.
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  serverName:
-                                    description: Used to verify the hostname for the
-                                      targets.
-                                    type: string
-                                type: object
-                            type: object
-                          send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
-                            type: boolean
-                          text:
-                            description: The text body of the teams notification.
-                            type: string
-                          title:
-                            description: The title of the teams notification.
-                            type: string
-                          webhook_url:
-                            description: |-
-                              The incoming webhook URL
-                              one of `urlSecret` and `url` must be defined.
-                            type: string
-                          webhook_url_secret:
-                            description: |-
-                              URLSecret defines secret name and key at the CRD namespace.
-                              It must contain the webhook URL.
-                              one of `urlSecret` and `url` must be defined.
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                        type: object
-                      type: array
-                    msteamsv2_configs:
-                      items:
-                        description: |-
-                          MSTeamsV2Config sends notifications using the new message format with adaptive cards as required by flows.
-                          https://support.microsoft.com/en-gb/office/create-incoming-webhooks-with-workflows-for-microsoft-teams-8ae491c7-0394-4861-ba59-055e33f75498
-                          available from v0.55.0 operator version
-                          and v0.28.0 alertmanager version
-                        properties:
-                          http_config:
-                            x-kubernetes-preserve-unknown-fields: true
-                          send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
-                            type: boolean
-                          text:
-                            description: Message body template.
-                            type: string
-                          title:
-                            description: Message title template.
-                            type: string
-                          webhook_url:
-                            description: |-
-                              The incoming webhook URL
-                              one of `urlSecret` and `url` must be defined.
-                            type: string
-                          webhook_url_secret:
-                            description: |-
-                              URLSecret defines secret name and key at the CRD namespace.
-                              It must contain the webhook URL.
-                              one of `webhook_url` or `webhook_url_secret` must be defined.
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                        type: object
-                      type: array
-                    name:
-                      description: Name of the receiver. Must be unique across all
-                        items from the list.
-                      minLength: 1
-                      type: string
-                    opsgenie_configs:
-                      description: OpsGenieConfigs defines ops genie notification
-                        configurations.
-                      items:
-                        description: |-
-                          OpsGenieConfig configures notifications via OpsGenie.
-                          See https://prometheus.io/docs/alerting/latest/configuration/#opsgenie_config
-                        properties:
-                          actions:
-                            description: Comma separated list of actions that will
-                              be available for the alert.
-                            type: string
-                          api_key:
-                            description: |-
-                              The secret's key that contains the OpsGenie API key.
-                              It must be at them same namespace as CRD
-                              fallback to global setting if empty
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          apiURL:
-                            description: The URL to send OpsGenie API requests to.
-                            type: string
-                          description:
-                            description: Description of the incident.
-                            type: string
-                          details:
-                            additionalProperties:
-                              type: string
-                            description: A set of arbitrary key/value pairs that provide
-                              further detail about the incident.
-                            type: object
-                          entity:
-                            description: Optional field that can be used to specify
-                              which domain alert is related to.
-                            type: string
-                          http_config:
-                            description: HTTP client configuration.
-                            type: object
-                            x-kubernetes-preserve-unknown-fields: true
-                          message:
-                            description: Alert text limited to 130 characters.
-                            type: string
-                          note:
-                            description: Additional alert note.
-                            type: string
-                          priority:
-                            description: Priority level of alert. Possible values
-                              are P1, P2, P3, P4, and P5.
-                            type: string
-                          responders:
-                            description: List of responders responsible for notifications.
-                            items:
-                              description: |-
-                                OpsGenieConfigResponder defines a responder to an incident.
-                                One of `id`, `name` or `username` has to be defined.
-                              properties:
-                                id:
-                                  description: ID of the responder.
-                                  type: string
-                                name:
-                                  description: Name of the responder.
-                                  type: string
-                                type:
-                                  description: Type of responder.
-                                  minLength: 1
-                                  type: string
-                                username:
-                                  description: Username of the responder.
-                                  type: string
-                              required:
-                              - type
-                              type: object
-                            type: array
-                          send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
-                            type: boolean
-                          source:
-                            description: Backlink to the sender of the notification.
-                            type: string
-                          tags:
-                            description: Comma separated list of tags attached to
-                              the notifications.
-                            type: string
-                          update_alerts:
-                            description: |-
-                              Whether to update message and description of the alert in OpsGenie if it already exists
-                              By default, the alert is never updated in OpsGenie, the new message only appears in activity log.
-                            type: boolean
-                        type: object
-                      type: array
-                    pagerduty_configs:
-                      description: PagerDutyConfigs defines pager duty notification
-                        configurations.
-                      items:
-                        description: |-
-                          PagerDutyConfig configures notifications via PagerDuty.
-                          See https://prometheus.io/docs/alerting/latest/configuration/#pagerduty_config
-                        properties:
-                          class:
-                            description: The class/type of the event.
-                            type: string
-                          client:
-                            description: Client identification.
-                            type: string
-                          client_url:
-                            description: Backlink to the sender of notification.
-                            type: string
-                          component:
-                            description: The part or component of the affected system
-                              that is broken.
-                            type: string
-                          description:
-                            description: Description of the incident.
-                            type: string
-                          details:
-                            additionalProperties:
-                              type: string
-                            description: Arbitrary key/value pairs that provide further
-                              detail about the incident.
-                            type: object
-                          group:
-                            description: A cluster or grouping of sources.
-                            type: string
-                          http_config:
-                            description: HTTP client configuration.
-                            type: object
-                            x-kubernetes-preserve-unknown-fields: true
-                          images:
-                            description: Images to attach to the incident.
-                            items:
-                              description: |-
-                                ImageConfig is used to attach images to the incident.
-                                See https://developer.pagerduty.com/docs/ZG9jOjExMDI5NTgx-send-an-alert-event#the-images-property
-                                for more information.
-                              properties:
-                                alt:
-                                  type: string
-                                href:
-                                  type: string
-                                source:
-                                  type: string
-                              required:
-                              - source
-                              type: object
-                            type: array
-                          links:
-                            description: Links to attach to the incident.
-                            items:
-                              description: |-
-                                LinkConfig is used to attach text links to the incident.
-                                See https://developer.pagerduty.com/docs/ZG9jOjExMDI5NTgx-send-an-alert-event#the-links-property
-                                for more information.
-                              properties:
-                                href:
-                                  type: string
-                                text:
-                                  type: string
-                              required:
-                              - href
-                              type: object
-                            type: array
-                          routing_key:
-                            description: |-
-                              The secret's key that contains the PagerDuty integration key (when using
-                              Events API v2). Either this field or `serviceKey` needs to be defined.
-                              It must be at them same namespace as CRD
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
-                            type: boolean
-                          service_key:
-                            description: |-
-                              The secret's key that contains the PagerDuty service key (when using
-                              integration type "Prometheus"). Either this field or `routingKey` needs to
-                              be defined.
-                              It must be at them same namespace as CRD
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          severity:
-                            description: Severity of the incident.
-                            type: string
-                          url:
-                            description: The URL to send requests to.
-                            type: string
-                        type: object
-                      type: array
-                    pushover_configs:
-                      description: PushoverConfigs defines push over notification
-                        configurations.
-                      items:
-                        description: |-
-                          PushoverConfig configures notifications via Pushover.
-                          See https://prometheus.io/docs/alerting/latest/configuration/#pushover_config
-                        properties:
-                          expire:
-                            description: |-
-                              How long your notification will continue to be retried for, unless the user
-                              acknowledges the notification.
-                            type: string
-                          html:
-                            description: Whether notification message is HTML or plain
-                              text.
-                            type: boolean
-                          http_config:
-                            description: HTTP client configuration.
-                            type: object
-                            x-kubernetes-preserve-unknown-fields: true
-                          message:
-                            description: Notification message.
-                            type: string
-                          priority:
-                            description: Priority, see https://pushover.net/api#priority
-                            type: string
-                          retry:
-                            description: |-
-                              How often the Pushover servers will send the same notification to the user.
-                              Must be at least 30 seconds.
-                            type: string
-                          send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
-                            type: boolean
-                          sound:
-                            description: The name of one of the sounds supported by
-                              device clients to override the user's default sound
-                              choice
-                            type: string
-                          title:
-                            description: Notification title.
-                            type: string
-                          token:
-                            description: |-
-                              The secret's key that contains the registered application’s API token, see https://pushover.net/apps.
-                              It must be at them same namespace as CRD
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          url:
-                            description: A supplementary URL shown alongside the message.
-                            type: string
-                          url_title:
-                            description: A title for supplementary URL, otherwise
-                              just the URL is shown
-                            type: string
-                          user_key:
-                            description: |-
-                              The secret's key that contains the recipient user’s user key.
-                              It must be at them same namespace as CRD
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                        type: object
-                      type: array
-                    rocketchat_configs:
-                      items:
-                        description: |-
-                          RocketchatConfig configures notifications via Rocketchat.
-                          https://prometheus.io/docs/alerting/latest/configuration/#rocketchat_config
-                          available from v0.55.0 operator version
-                          and v0.28.0 alertmanager version
-                        properties:
-                          actions:
-                            items:
-                              description: |-
-                                RocketchatAttachmentAction defines message attachements
-                                https://github.com/RocketChat/Rocket.Chat.Go.SDK/blob/master/models/message.go
-                              properties:
-                                msg:
-                                  type: string
-                                text:
-                                  type: string
-                                type:
-                                  type: string
-                                url:
-                                  type: string
-                              type: object
-                            type: array
-                          api_url:
-                            type: string
-                          channel:
-                            description: 'RocketChat channel override, (like #other-channel
-                              or @username).'
-                            type: string
-                          color:
-                            type: string
-                          emoji:
-                            type: string
-                          fields:
-                            items:
-                              description: |-
-                                RocketchatAttachmentField defines API fields
-                                https://developer.rocket.chat/reference/api/rest-api/endpoints/messaging/chat-endpoints/postmessage#attachment-field-objects
-                              properties:
-                                short:
-                                  type: boolean
-                                title:
-                                  type: string
-                                value:
-                                  type: string
-                              type: object
-                            type: array
-                          http_config:
-                            x-kubernetes-preserve-unknown-fields: true
-                          icon_url:
-                            type: string
-                          image_url:
-                            type: string
-                          link_names:
-                            type: boolean
-                          send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
-                            type: boolean
-                          short_fields:
-                            type: boolean
-                          text:
-                            type: string
-                          thumb_url:
-                            type: string
-                          title:
-                            type: string
-                          title_link:
-                            type: string
-                          token:
-                            description: SecretKeySelector selects a key of a Secret.
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          token_id:
-                            description: |-
-                              The sender token and token_id
-                              See https://docs.rocket.chat/use-rocket.chat/user-guides/user-panel/my-account#personal-access-tokens
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                        type: object
-                      type: array
-                    slack_configs:
-                      description: SlackConfigs defines slack notification configurations.
-                      items:
-                        description: |-
-                          SlackConfig configures notifications via Slack.
-                          See https://prometheus.io/docs/alerting/latest/configuration/#slack_config
-                        properties:
-                          actions:
-                            description: A list of Slack actions that are sent with
-                              each notification.
-                            items:
-                              description: |-
-                                SlackAction configures a single Slack action that is sent with each
-                                notification.
-                                See https://api.slack.com/docs/message-attachments#action_fields and
-                                https://api.slack.com/docs/message-buttons for more information.
-                              properties:
-                                confirm:
-                                  description: |-
-                                    SlackConfirmationField protect users from destructive actions or
-                                    particularly distinguished decisions by asking them to confirm their button
-                                    click one more time.
-                                    See https://api.slack.com/docs/interactive-message-field-guide#confirmation_fields
-                                    for more information.
-                                  properties:
-                                    dismiss_text:
-                                      type: string
-                                    ok_text:
-                                      type: string
-                                    text:
-                                      minLength: 1
-                                      type: string
-                                    title:
-                                      type: string
-                                  required:
-                                  - text
-                                  type: object
-                                name:
-                                  type: string
-                                style:
-                                  type: string
-                                text:
-                                  minLength: 1
-                                  type: string
-                                type:
-                                  minLength: 1
-                                  type: string
-                                url:
-                                  type: string
-                                value:
-                                  type: string
-                              required:
-                              - text
-                              - type
-                              type: object
-                            type: array
-                          api_url:
-                            description: |-
-                              The secret's key that contains the Slack webhook URL.
-                              It must be at them same namespace as CRD
-                              fallback to global setting if empty
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          callback_id:
-                            type: string
-                          channel:
-                            description: The channel or user to send notifications
-                              to.
-                            type: string
-                          color:
-                            type: string
-                          fallback:
-                            type: string
-                          fields:
-                            description: A list of Slack fields that are sent with
-                              each notification.
-                            items:
-                              description: |-
-                                SlackField configures a single Slack field that is sent with each notification.
-                                See https://api.slack.com/docs/message-attachments#fields for more information.
-                              properties:
-                                short:
-                                  type: boolean
-                                title:
-                                  minLength: 1
-                                  type: string
-                                value:
-                                  minLength: 1
-                                  type: string
-                              required:
-                              - title
-                              - value
-                              type: object
-                            type: array
-                          footer:
-                            type: string
-                          http_config:
-                            description: HTTP client configuration.
-                            type: object
-                            x-kubernetes-preserve-unknown-fields: true
-                          icon_emoji:
-                            type: string
-                          icon_url:
-                            type: string
-                          image_url:
-                            type: string
-                          link_names:
-                            type: boolean
-                          mrkdwn_in:
-                            items:
-                              type: string
-                            type: array
-                          pretext:
-                            type: string
-                          send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
-                            type: boolean
-                          short_fields:
-                            type: boolean
-                          text:
-                            type: string
-                          thumb_url:
-                            type: string
-                          title:
-                            type: string
-                          title_link:
-                            type: string
-                          username:
-                            type: string
-                        type: object
-                      type: array
-                    sns_configs:
-                      items:
-                        properties:
-                          api_url:
-                            description: The api URL
-                            type: string
-                          attributes:
-                            additionalProperties:
-                              type: string
-                            description: SNS message attributes
-                            type: object
-                          http_config:
-                            description: HTTP client configuration.
-                            properties:
-                              authorization:
-                                description: |-
-                                  Authorization header configuration for the client.
-                                  This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+.
-                                properties:
-                                  credentials:
-                                    description: Reference to the secret with value
-                                      for authorization
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  credentialsFile:
-                                    description: File with value for authorization
-                                    type: string
-                                  type:
-                                    description: Type of authorization, default to
-                                      bearer
-                                    type: string
-                                type: object
-                              basic_auth:
-                                description: BasicAuth for the client.
-                                properties:
-                                  password:
-                                    description: |-
-                                      Password defines reference for secret with password value
-                                      The secret needs to be in the same namespace as scrape object
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  password_file:
-                                    description: |-
-                                      PasswordFile defines path to password file at disk
-                                      must be pre-mounted
-                                    type: string
-                                  username:
-                                    description: |-
-                                      Username defines reference for secret with username value
-                                      The secret needs to be in the same namespace as scrape object
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                type: object
-                              bearer_token_file:
-                                description: BearerTokenFile defines filename for
-                                  bearer token, it must be mounted to pod.
-                                type: string
-                              bearer_token_secret:
-                                description: |-
-                                  The secret's key that contains the bearer token
-                                  It must be at them same namespace as CRD
-                                properties:
-                                  key:
-                                    description: The key of the secret to select from.  Must
-                                      be a valid secret key.
-                                    type: string
-                                  name:
-                                    default: ""
-                                    description: |-
-                                      Name of the referent.
-                                      This field is effectively required, but due to backwards compatibility is
-                                      allowed to be empty. Instances of this type with an empty value here are
-                                      almost certainly wrong.
-                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    type: string
-                                  optional:
-                                    description: Specify whether the Secret or its
-                                      key must be defined
-                                    type: boolean
-                                required:
-                                - key
-                                type: object
-                                x-kubernetes-map-type: atomic
-                              oauth2:
-                                description: OAuth2 client credentials used to fetch
-                                  a token for the targets.
-                                properties:
-                                  client_id:
-                                    description: The secret or configmap containing
-                                      the OAuth2 client id
-                                    properties:
-                                      configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
-                                        properties:
-                                          key:
-                                            description: The key to select.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      secret:
-                                        description: Secret containing data to use
-                                          for the targets.
-                                        properties:
-                                          key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  client_secret:
-                                    description: The secret containing the OAuth2
-                                      client secret
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  client_secret_file:
-                                    description: ClientSecretFile defines path for
-                                      client secret file.
-                                    type: string
-                                  endpoint_params:
-                                    additionalProperties:
-                                      type: string
-                                    description: Parameters to append to the token
-                                      URL
-                                    type: object
-                                  proxy_url:
-                                    description: |-
-                                      The proxy URL for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
-                                    type: string
-                                  scopes:
-                                    description: OAuth2 scopes used for the token
-                                      request
-                                    items:
-                                      type: string
-                                    type: array
-                                  tls_config:
-                                    description: |-
-                                      TLSConfig for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
-                                    x-kubernetes-preserve-unknown-fields: true
-                                  token_url:
-                                    description: The URL to fetch the token from
-                                    minLength: 1
-                                    type: string
-                                required:
-                                - client_id
-                                - token_url
-                                type: object
-                              proxyURL:
-                                description: Optional proxy URL.
-                                type: string
-                              tls_config:
-                                description: TLS configuration for the client.
-                                properties:
-                                  ca:
-                                    description: Struct containing the CA cert to
-                                      use for the targets.
-                                    properties:
-                                      configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
-                                        properties:
-                                          key:
-                                            description: The key to select.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      secret:
-                                        description: Secret containing data to use
-                                          for the targets.
-                                        properties:
-                                          key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  caFile:
-                                    description: Path to the CA cert in the container
-                                      to use for the targets.
-                                    type: string
-                                  cert:
-                                    description: Struct containing the client cert
-                                      file for the targets.
-                                    properties:
-                                      configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
-                                        properties:
-                                          key:
-                                            description: The key to select.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      secret:
-                                        description: Secret containing data to use
-                                          for the targets.
-                                        properties:
-                                          key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  certFile:
-                                    description: Path to the client cert file in the
-                                      container for the targets.
-                                    type: string
-                                  insecureSkipVerify:
-                                    description: Disable target certificate validation.
-                                    type: boolean
-                                  keyFile:
-                                    description: Path to the client key file in the
-                                      container for the targets.
-                                    type: string
-                                  keySecret:
-                                    description: Secret containing the client key
-                                      file for the targets.
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  serverName:
-                                    description: Used to verify the hostname for the
-                                      targets.
-                                    type: string
-                                type: object
-                            type: object
-                          message:
-                            description: The message content of the SNS notification.
-                            type: string
-                          phone_number:
-                            description: |-
-                              Phone number if message is delivered via SMS
-                              Specify this, topic_arn or target_arn
-                            type: string
-                          send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
-                            type: boolean
-                          sigv4:
-                            description: Configure the AWS Signature Verification
-                              4 signing process
-                            properties:
-                              access_key:
-                                description: |-
-                                  The AWS API keys. Both access_key and secret_key must be supplied or both must be blank.
-                                  If blank the environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are used.
-                                type: string
-                              access_key_selector:
-                                description: secret key selector to get the keys from
-                                  a Kubernetes Secret
-                                properties:
-                                  key:
-                                    description: The key of the secret to select from.  Must
-                                      be a valid secret key.
-                                    type: string
-                                  name:
-                                    default: ""
-                                    description: |-
-                                      Name of the referent.
-                                      This field is effectively required, but due to backwards compatibility is
-                                      allowed to be empty. Instances of this type with an empty value here are
-                                      almost certainly wrong.
-                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    type: string
-                                  optional:
-                                    description: Specify whether the Secret or its
-                                      key must be defined
-                                    type: boolean
-                                required:
-                                - key
-                                type: object
-                                x-kubernetes-map-type: atomic
-                              profile:
-                                description: Named AWS profile used to authenticate
-                                type: string
-                              region:
-                                description: AWS region, if blank the region from
-                                  the default credentials chain is used
-                                type: string
-                              role_arn:
-                                description: AWS Role ARN, an alternative to using
-                                  AWS API keys
-                                type: string
-                              secret_key_selector:
-                                description: secret key selector to get the keys from
-                                  a Kubernetes Secret
-                                properties:
-                                  key:
-                                    description: The key of the secret to select from.  Must
-                                      be a valid secret key.
-                                    type: string
-                                  name:
-                                    default: ""
-                                    description: |-
-                                      Name of the referent.
-                                      This field is effectively required, but due to backwards compatibility is
-                                      allowed to be empty. Instances of this type with an empty value here are
-                                      almost certainly wrong.
-                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    type: string
-                                  optional:
-                                    description: Specify whether the Secret or its
-                                      key must be defined
-                                    type: boolean
-                                required:
-                                - key
-                                type: object
-                                x-kubernetes-map-type: atomic
-                            type: object
-                          subject:
-                            description: The subject line if message is delivered
-                              to an email endpoint.
-                            type: string
-                          target_arn:
-                            description: |-
-                              Mobile platform endpoint ARN if message is delivered via mobile notifications
-                              Specify this, topic_arn or phone_number
-                            type: string
-                          topic_arn:
-                            description: SNS topic ARN, either specify this, phone_number
-                              or target_arn
-                            type: string
-                        type: object
-                      type: array
-                    telegram_configs:
-                      items:
-                        description: |-
-                          TelegramConfig configures notification via telegram
-                          https://prometheus.io/docs/alerting/latest/configuration/#telegram_config
-                        properties:
-                          api_url:
-                            description: APIUrl the Telegram API URL i.e. https://api.telegram.org.
-                            type: string
-                          bot_token:
-                            description: |-
-                              BotToken token for the bot
-                              https://core.telegram.org/bots/api
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          chat_id:
-                            description: ChatID is ID of the chat where to send the
-                              messages.
-                            type: integer
-                          disable_notifications:
-                            description: DisableNotifications
-                            type: boolean
-                          http_config:
-                            description: HTTP client configuration.
-                            type: object
-                            x-kubernetes-preserve-unknown-fields: true
-                          message:
-                            description: Message is templated message
-                            type: string
-                          message_thread_id:
-                            description: MessageThreadID defines ID of the message
-                              thread where to send the messages.
-                            type: integer
-                          parse_mode:
-                            description: |-
-                              ParseMode for telegram message,
-                              supported values are MarkdownV2, Markdown, Markdown and empty string for plain text.
-                            type: string
-                          send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
-                            type: boolean
-                        required:
-                        - bot_token
-                        - chat_id
-                        type: object
-                      type: array
-                    victorops_configs:
-                      description: VictorOpsConfigs defines victor ops notification
-                        configurations.
-                      items:
-                        description: |-
-                          VictorOpsConfig configures notifications via VictorOps.
-                          See https://prometheus.io/docs/alerting/latest/configuration/#victorops_config
-                        properties:
-                          api_key:
-                            description: |-
-                              The secret's key that contains the API key to use when talking to the VictorOps API.
-                              It must be at them same namespace as CRD
-                              fallback to global setting if empty
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          api_url:
-                            description: The VictorOps API URL.
-                            type: string
-                          custom_fields:
-                            additionalProperties:
-                              type: string
-                            description: |-
-                              Adds optional custom fields
-                              https://github.com/prometheus/alertmanager/blob/v0.24.0/config/notifiers.go#L537
-                            type: object
-                          entity_display_name:
-                            description: Contains summary of the alerted problem.
-                            type: string
-                          http_config:
-                            description: The HTTP client's configuration.
-                            properties:
-                              authorization:
-                                description: |-
-                                  Authorization header configuration for the client.
-                                  This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+.
-                                properties:
-                                  credentials:
-                                    description: Reference to the secret with value
-                                      for authorization
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  credentialsFile:
-                                    description: File with value for authorization
-                                    type: string
-                                  type:
-                                    description: Type of authorization, default to
-                                      bearer
-                                    type: string
-                                type: object
-                              basic_auth:
-                                description: BasicAuth for the client.
-                                properties:
-                                  password:
-                                    description: |-
-                                      Password defines reference for secret with password value
-                                      The secret needs to be in the same namespace as scrape object
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  password_file:
-                                    description: |-
-                                      PasswordFile defines path to password file at disk
-                                      must be pre-mounted
-                                    type: string
-                                  username:
-                                    description: |-
-                                      Username defines reference for secret with username value
-                                      The secret needs to be in the same namespace as scrape object
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                type: object
-                              bearer_token_file:
-                                description: BearerTokenFile defines filename for
-                                  bearer token, it must be mounted to pod.
-                                type: string
-                              bearer_token_secret:
-                                description: |-
-                                  The secret's key that contains the bearer token
-                                  It must be at them same namespace as CRD
-                                properties:
-                                  key:
-                                    description: The key of the secret to select from.  Must
-                                      be a valid secret key.
-                                    type: string
-                                  name:
-                                    default: ""
-                                    description: |-
-                                      Name of the referent.
-                                      This field is effectively required, but due to backwards compatibility is
-                                      allowed to be empty. Instances of this type with an empty value here are
-                                      almost certainly wrong.
-                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    type: string
-                                  optional:
-                                    description: Specify whether the Secret or its
-                                      key must be defined
-                                    type: boolean
-                                required:
-                                - key
-                                type: object
-                                x-kubernetes-map-type: atomic
-                              oauth2:
-                                description: OAuth2 client credentials used to fetch
-                                  a token for the targets.
-                                properties:
-                                  client_id:
-                                    description: The secret or configmap containing
-                                      the OAuth2 client id
-                                    properties:
-                                      configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
-                                        properties:
-                                          key:
-                                            description: The key to select.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      secret:
-                                        description: Secret containing data to use
-                                          for the targets.
-                                        properties:
-                                          key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  client_secret:
-                                    description: The secret containing the OAuth2
-                                      client secret
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  client_secret_file:
-                                    description: ClientSecretFile defines path for
-                                      client secret file.
-                                    type: string
-                                  endpoint_params:
-                                    additionalProperties:
-                                      type: string
-                                    description: Parameters to append to the token
-                                      URL
-                                    type: object
-                                  proxy_url:
-                                    description: |-
-                                      The proxy URL for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
-                                    type: string
-                                  scopes:
-                                    description: OAuth2 scopes used for the token
-                                      request
-                                    items:
-                                      type: string
-                                    type: array
-                                  tls_config:
-                                    description: |-
-                                      TLSConfig for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
-                                    x-kubernetes-preserve-unknown-fields: true
-                                  token_url:
-                                    description: The URL to fetch the token from
-                                    minLength: 1
-                                    type: string
-                                required:
-                                - client_id
-                                - token_url
-                                type: object
-                              proxyURL:
-                                description: Optional proxy URL.
-                                type: string
-                              tls_config:
-                                description: TLS configuration for the client.
-                                properties:
-                                  ca:
-                                    description: Struct containing the CA cert to
-                                      use for the targets.
-                                    properties:
-                                      configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
-                                        properties:
-                                          key:
-                                            description: The key to select.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      secret:
-                                        description: Secret containing data to use
-                                          for the targets.
-                                        properties:
-                                          key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  caFile:
-                                    description: Path to the CA cert in the container
-                                      to use for the targets.
-                                    type: string
-                                  cert:
-                                    description: Struct containing the client cert
-                                      file for the targets.
-                                    properties:
-                                      configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
-                                        properties:
-                                          key:
-                                            description: The key to select.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      secret:
-                                        description: Secret containing data to use
-                                          for the targets.
-                                        properties:
-                                          key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  certFile:
-                                    description: Path to the client cert file in the
-                                      container for the targets.
-                                    type: string
-                                  insecureSkipVerify:
-                                    description: Disable target certificate validation.
-                                    type: boolean
-                                  keyFile:
-                                    description: Path to the client key file in the
-                                      container for the targets.
-                                    type: string
-                                  keySecret:
-                                    description: Secret containing the client key
-                                      file for the targets.
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  serverName:
-                                    description: Used to verify the hostname for the
-                                      targets.
-                                    type: string
-                                type: object
-                            type: object
-                          message_type:
-                            description: Describes the behavior of the alert (CRITICAL,
-                              WARNING, INFO).
-                            type: string
-                          monitoring_tool:
-                            description: The monitoring tool the state message is
-                              from.
-                            type: string
-                          routing_key:
-                            description: A key used to map the alert to a team.
-                            type: string
-                          send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
-                            type: boolean
-                          state_message:
-                            description: Contains long explanation of the alerted
-                              problem.
-                            type: string
-                        required:
-                        - routing_key
-                        type: object
-                      type: array
-                    webex_configs:
-                      items:
-                        properties:
-                          api_url:
-                            description: The Webex Teams API URL, i.e. https://webexapis.com/v1/messages
-                            type: string
-                          http_config:
-                            description: HTTP client configuration. You must use this
-                              configuration to supply the bot token as part of the
-                              HTTP `Authorization` header.
-                            properties:
-                              authorization:
-                                description: |-
-                                  Authorization header configuration for the client.
-                                  This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+.
-                                properties:
-                                  credentials:
-                                    description: Reference to the secret with value
-                                      for authorization
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  credentialsFile:
-                                    description: File with value for authorization
-                                    type: string
-                                  type:
-                                    description: Type of authorization, default to
-                                      bearer
-                                    type: string
-                                type: object
-                              basic_auth:
-                                description: BasicAuth for the client.
-                                properties:
-                                  password:
-                                    description: |-
-                                      Password defines reference for secret with password value
-                                      The secret needs to be in the same namespace as scrape object
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  password_file:
-                                    description: |-
-                                      PasswordFile defines path to password file at disk
-                                      must be pre-mounted
-                                    type: string
-                                  username:
-                                    description: |-
-                                      Username defines reference for secret with username value
-                                      The secret needs to be in the same namespace as scrape object
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                type: object
-                              bearer_token_file:
-                                description: BearerTokenFile defines filename for
-                                  bearer token, it must be mounted to pod.
-                                type: string
-                              bearer_token_secret:
-                                description: |-
-                                  The secret's key that contains the bearer token
-                                  It must be at them same namespace as CRD
-                                properties:
-                                  key:
-                                    description: The key of the secret to select from.  Must
-                                      be a valid secret key.
-                                    type: string
-                                  name:
-                                    default: ""
-                                    description: |-
-                                      Name of the referent.
-                                      This field is effectively required, but due to backwards compatibility is
-                                      allowed to be empty. Instances of this type with an empty value here are
-                                      almost certainly wrong.
-                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    type: string
-                                  optional:
-                                    description: Specify whether the Secret or its
-                                      key must be defined
-                                    type: boolean
-                                required:
-                                - key
-                                type: object
-                                x-kubernetes-map-type: atomic
-                              oauth2:
-                                description: OAuth2 client credentials used to fetch
-                                  a token for the targets.
-                                properties:
-                                  client_id:
-                                    description: The secret or configmap containing
-                                      the OAuth2 client id
-                                    properties:
-                                      configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
-                                        properties:
-                                          key:
-                                            description: The key to select.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      secret:
-                                        description: Secret containing data to use
-                                          for the targets.
-                                        properties:
-                                          key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  client_secret:
-                                    description: The secret containing the OAuth2
-                                      client secret
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  client_secret_file:
-                                    description: ClientSecretFile defines path for
-                                      client secret file.
-                                    type: string
-                                  endpoint_params:
-                                    additionalProperties:
-                                      type: string
-                                    description: Parameters to append to the token
-                                      URL
-                                    type: object
-                                  proxy_url:
-                                    description: |-
-                                      The proxy URL for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
-                                    type: string
-                                  scopes:
-                                    description: OAuth2 scopes used for the token
-                                      request
-                                    items:
-                                      type: string
-                                    type: array
-                                  tls_config:
-                                    description: |-
-                                      TLSConfig for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
-                                    x-kubernetes-preserve-unknown-fields: true
-                                  token_url:
-                                    description: The URL to fetch the token from
-                                    minLength: 1
-                                    type: string
-                                required:
-                                - client_id
-                                - token_url
-                                type: object
-                              proxyURL:
-                                description: Optional proxy URL.
-                                type: string
-                              tls_config:
-                                description: TLS configuration for the client.
-                                properties:
-                                  ca:
-                                    description: Struct containing the CA cert to
-                                      use for the targets.
-                                    properties:
-                                      configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
-                                        properties:
-                                          key:
-                                            description: The key to select.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      secret:
-                                        description: Secret containing data to use
-                                          for the targets.
-                                        properties:
-                                          key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  caFile:
-                                    description: Path to the CA cert in the container
-                                      to use for the targets.
-                                    type: string
-                                  cert:
-                                    description: Struct containing the client cert
-                                      file for the targets.
-                                    properties:
-                                      configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
-                                        properties:
-                                          key:
-                                            description: The key to select.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      secret:
-                                        description: Secret containing data to use
-                                          for the targets.
-                                        properties:
-                                          key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  certFile:
-                                    description: Path to the client cert file in the
-                                      container for the targets.
-                                    type: string
-                                  insecureSkipVerify:
-                                    description: Disable target certificate validation.
-                                    type: boolean
-                                  keyFile:
-                                    description: Path to the client key file in the
-                                      container for the targets.
-                                    type: string
-                                  keySecret:
-                                    description: Secret containing the client key
-                                      file for the targets.
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  serverName:
-                                    description: Used to verify the hostname for the
-                                      targets.
-                                    type: string
-                                type: object
-                            type: object
-                          message:
-                            description: The message body template
-                            type: string
-                          room_id:
-                            description: The ID of the Webex Teams room where to send
-                              the messages
-                            type: string
-                          send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
-                            type: boolean
-                        required:
-                        - room_id
-                        type: object
-                      type: array
-                    webhook_configs:
-                      description: WebhookConfigs defines webhook notification configurations.
-                      items:
-                        description: |-
-                          WebhookConfig configures notifications via a generic receiver supporting the webhook payload.
-                          See https://prometheus.io/docs/alerting/latest/configuration/#webhook_config
-                        properties:
-                          http_config:
-                            description: HTTP client configuration.
-                            type: object
-                            x-kubernetes-preserve-unknown-fields: true
-                          max_alerts:
-                            description: Maximum number of alerts to be sent per webhook
-                              message. When 0, all alerts are included.
-                            format: int32
-                            minimum: 0
-                            type: integer
-                          send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
-                            type: boolean
-                          url:
-                            description: |-
-                              URL to send requests to,
-                              one of `urlSecret` and `url` must be defined.
-                            type: string
-                          url_secret:
-                            description: |-
-                              URLSecret defines secret name and key at the CRD namespace.
-                              It must contain the webhook URL.
-                              one of `urlSecret` and `url` must be defined.
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                        type: object
-                      type: array
-                    wechat_configs:
-                      description: WeChatConfigs defines wechat notification configurations.
-                      items:
-                        description: |-
-                          WeChatConfig configures notifications via WeChat.
-                          See https://prometheus.io/docs/alerting/latest/configuration/#wechat_config
-                        properties:
-                          agent_id:
-                            type: string
-                          api_secret:
-                            description: |-
-                              The secret's key that contains the WeChat API key.
-                              The secret needs to be in the same namespace as the AlertmanagerConfig
-                              fallback to global alertmanager setting if empty
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          api_url:
-                            description: |-
-                              The WeChat API URL.
-                              fallback to global alertmanager setting if empty
-                            type: string
-                          corp_id:
-                            description: |-
-                              The corp id for authentication.
-                              fallback to global alertmanager setting if empty
-                            type: string
-                          http_config:
-                            description: HTTP client configuration.
-                            properties:
-                              authorization:
-                                description: |-
-                                  Authorization header configuration for the client.
-                                  This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+.
-                                properties:
-                                  credentials:
-                                    description: Reference to the secret with value
-                                      for authorization
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  credentialsFile:
-                                    description: File with value for authorization
-                                    type: string
-                                  type:
-                                    description: Type of authorization, default to
-                                      bearer
-                                    type: string
-                                type: object
-                              basic_auth:
-                                description: BasicAuth for the client.
-                                properties:
-                                  password:
-                                    description: |-
-                                      Password defines reference for secret with password value
-                                      The secret needs to be in the same namespace as scrape object
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  password_file:
-                                    description: |-
-                                      PasswordFile defines path to password file at disk
-                                      must be pre-mounted
-                                    type: string
-                                  username:
-                                    description: |-
-                                      Username defines reference for secret with username value
-                                      The secret needs to be in the same namespace as scrape object
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                type: object
-                              bearer_token_file:
-                                description: BearerTokenFile defines filename for
-                                  bearer token, it must be mounted to pod.
-                                type: string
-                              bearer_token_secret:
-                                description: |-
-                                  The secret's key that contains the bearer token
-                                  It must be at them same namespace as CRD
-                                properties:
-                                  key:
-                                    description: The key of the secret to select from.  Must
-                                      be a valid secret key.
-                                    type: string
-                                  name:
-                                    default: ""
-                                    description: |-
-                                      Name of the referent.
-                                      This field is effectively required, but due to backwards compatibility is
-                                      allowed to be empty. Instances of this type with an empty value here are
-                                      almost certainly wrong.
-                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    type: string
-                                  optional:
-                                    description: Specify whether the Secret or its
-                                      key must be defined
-                                    type: boolean
-                                required:
-                                - key
-                                type: object
-                                x-kubernetes-map-type: atomic
-                              oauth2:
-                                description: OAuth2 client credentials used to fetch
-                                  a token for the targets.
-                                properties:
-                                  client_id:
-                                    description: The secret or configmap containing
-                                      the OAuth2 client id
-                                    properties:
-                                      configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
-                                        properties:
-                                          key:
-                                            description: The key to select.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      secret:
-                                        description: Secret containing data to use
-                                          for the targets.
-                                        properties:
-                                          key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  client_secret:
-                                    description: The secret containing the OAuth2
-                                      client secret
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  client_secret_file:
-                                    description: ClientSecretFile defines path for
-                                      client secret file.
-                                    type: string
-                                  endpoint_params:
-                                    additionalProperties:
-                                      type: string
-                                    description: Parameters to append to the token
-                                      URL
-                                    type: object
-                                  proxy_url:
-                                    description: |-
-                                      The proxy URL for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
-                                    type: string
-                                  scopes:
-                                    description: OAuth2 scopes used for the token
-                                      request
-                                    items:
-                                      type: string
-                                    type: array
-                                  tls_config:
-                                    description: |-
-                                      TLSConfig for token_url connection
-                                      ( available from v0.55.0).
-                                      Is only supported by Scrape objects family
-                                    x-kubernetes-preserve-unknown-fields: true
-                                  token_url:
-                                    description: The URL to fetch the token from
-                                    minLength: 1
-                                    type: string
-                                required:
-                                - client_id
-                                - token_url
-                                type: object
-                              proxyURL:
-                                description: Optional proxy URL.
-                                type: string
-                              tls_config:
-                                description: TLS configuration for the client.
-                                properties:
-                                  ca:
-                                    description: Struct containing the CA cert to
-                                      use for the targets.
-                                    properties:
-                                      configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
-                                        properties:
-                                          key:
-                                            description: The key to select.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      secret:
-                                        description: Secret containing data to use
-                                          for the targets.
-                                        properties:
-                                          key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  caFile:
-                                    description: Path to the CA cert in the container
-                                      to use for the targets.
-                                    type: string
-                                  cert:
-                                    description: Struct containing the client cert
-                                      file for the targets.
-                                    properties:
-                                      configMap:
-                                        description: ConfigMap containing data to
-                                          use for the targets.
-                                        properties:
-                                          key:
-                                            description: The key to select.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the ConfigMap
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      secret:
-                                        description: Secret containing data to use
-                                          for the targets.
-                                        properties:
-                                          key:
-                                            description: The key of the secret to
-                                              select from.  Must be a valid secret
-                                              key.
-                                            type: string
-                                          name:
-                                            default: ""
-                                            description: |-
-                                              Name of the referent.
-                                              This field is effectively required, but due to backwards compatibility is
-                                              allowed to be empty. Instances of this type with an empty value here are
-                                              almost certainly wrong.
-                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                            type: string
-                                          optional:
-                                            description: Specify whether the Secret
-                                              or its key must be defined
-                                            type: boolean
-                                        required:
-                                        - key
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  certFile:
-                                    description: Path to the client cert file in the
-                                      container for the targets.
-                                    type: string
-                                  insecureSkipVerify:
-                                    description: Disable target certificate validation.
-                                    type: boolean
-                                  keyFile:
-                                    description: Path to the client key file in the
-                                      container for the targets.
-                                    type: string
-                                  keySecret:
-                                    description: Secret containing the client key
-                                      file for the targets.
-                                    properties:
-                                      key:
-                                        description: The key of the secret to select
-                                          from.  Must be a valid secret key.
-                                        type: string
-                                      name:
-                                        default: ""
-                                        description: |-
-                                          Name of the referent.
-                                          This field is effectively required, but due to backwards compatibility is
-                                          allowed to be empty. Instances of this type with an empty value here are
-                                          almost certainly wrong.
-                                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                        type: string
-                                      optional:
-                                        description: Specify whether the Secret or
-                                          its key must be defined
-                                        type: boolean
-                                    required:
-                                    - key
-                                    type: object
-                                    x-kubernetes-map-type: atomic
-                                  serverName:
-                                    description: Used to verify the hostname for the
-                                      targets.
-                                    type: string
-                                type: object
-                            type: object
-                          message:
-                            description: API request data as defined by the WeChat
-                              API.
-                            type: string
-                          message_type:
-                            type: string
-                          send_resolved:
-                            description: SendResolved controls notify about resolved
-                              alerts.
-                            type: boolean
-                          to_party:
-                            type: string
-                          to_tag:
-                            type: string
-                          to_user:
-                            type: string
-                        type: object
-                      type: array
-                  required:
-                  - name
-                  type: object
-                type: array
-              route:
-                description: Route definition for alertmanager, may include nested
-                  routes.
-                properties:
-                  active_time_intervals:
-                    description: |-
-                      ActiveTimeIntervals Times when the route should be active
-                      These must match the name at time_intervals
-                    items:
-                      type: string
-                    type: array
-                  continue:
-                    description: |-
-                      Continue indicating whether an alert should continue matching subsequent
-                      sibling nodes. It will always be true for the first-level route if disableRouteContinueEnforce for vmalertmanager not set.
-                    type: boolean
-                  group_by:
-                    description: List of labels to group by.
-                    items:
-                      type: string
-                    type: array
-                  group_interval:
-                    description: How long to wait before sending an updated notification.
-                    pattern: '[0-9]+(ms|s|m|h)'
-                    type: string
-                  group_wait:
-                    description: How long to wait before sending the initial notification.
-                    pattern: '[0-9]+(ms|s|m|h)'
-                    type: string
-                  matchers:
-                    description: |-
-                      List of matchers that the alert’s labels should match. For the first
-                      level route, the operator adds a namespace: "CRD_NS" matcher.
-                      https://prometheus.io/docs/alerting/latest/configuration/#matcher
-                    items:
-                      type: string
-                    type: array
-                  mute_time_intervals:
-                    description: MuteTimeIntervals is a list of interval names that
-                      will mute matched alert
-                    items:
-                      type: string
-                    type: array
-                  receiver:
-                    description: Name of the receiver for this route.
-                    type: string
-                  repeat_interval:
-                    description: How long to wait before repeating the last notification.
-                    pattern: '[0-9]+(ms|s|m|h)'
-                    type: string
-                  routes:
-                    description: |-
-                      Child routes.
-                      https://prometheus.io/docs/alerting/latest/configuration/#route
-                    items:
-                      x-kubernetes-preserve-unknown-fields: true
-                    type: array
-                required:
-                - receiver
-                type: object
-              time_intervals:
-                description: |-
-                  TimeIntervals defines named interval for active/mute notifications interval
-                  See https://prometheus.io/docs/alerting/latest/configuration/#time_interval
-                items:
-                  description: TimeIntervals for alerts
-                  properties:
-                    name:
-                      description: Name of interval
-                      type: string
-                    time_intervals:
-                      description: TimeIntervals interval configuration
-                      items:
-                        description: TimeInterval defines intervals of time
-                        properties:
-                          days_of_month:
-                            description: |-
-                              DayOfMonth defines list of numerical days in the month. Days begin at 1. Negative values are also accepted.
-                              for example, ['1:5', '-3:-1']
-                            items:
-                              type: string
-                            type: array
-                          location:
-                            description: Location in golang time location form, e.g.
-                              UTC
-                            type: string
-                          months:
-                            description: |-
-                              Months  defines list of calendar months identified by a case-insensitive name (e.g. ‘January’) or numeric 1.
-                              For example, ['1:3', 'may:august', 'december']
-                            items:
-                              type: string
-                            type: array
-                          times:
-                            description: Times defines time range for mute
-                            items:
-                              description: TimeRange  ranges inclusive of the starting
-                                time and exclusive of the end time
-                              properties:
-                                end_time:
-                                  description: EndTime for example HH:MM
-                                  type: string
-                                start_time:
-                                  description: StartTime for example  HH:MM
-                                  type: string
-                              required:
-                              - end_time
-                              - start_time
-                              type: object
-                            type: array
-                          weekdays:
-                            description: Weekdays defines list of days of the week,
-                              where the week begins on Sunday and ends on Saturday.
-                            items:
-                              type: string
-                            type: array
-                          years:
-                            description: |-
-                              Years defines numerical list of years, ranges are accepted.
-                              For example, ['2020:2022', '2030']
-                            items:
-                              type: string
-                            type: array
-                        type: object
-                      type: array
-                  required:
-                  - name
-                  - time_intervals
-                  type: object
-                type: array
-            required:
-            - receivers
-            - route
             type: object
+            x-kubernetes-preserve-unknown-fields: true
           status:
-            description: VMAlertmanagerConfigStatus defines the observed state of
-              VMAlertmanagerConfig
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -10148,16 +592,11 @@ spec:
               lastErrorParentAlertmanagerName:
                 type: string
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -10170,7 +609,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmalertmanagers.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -10198,2433 +637,45 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: VMAlertmanager represents Victoria-Metrics deployment for Alertmanager.
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: |-
-              Specification of the desired behavior of the VMAlertmanager cluster. More info:
-              https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-            properties:
-              additionalPeers:
-                description: AdditionalPeers allows injecting a set of additional
-                  Alertmanagers to peer with to form a highly available cluster.
-                items:
-                  type: string
-                type: array
-              affinity:
-                description: Affinity If specified, the pod's scheduling constraints.
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              claimTemplates:
-                description: ClaimTemplates allows adding additional VolumeClaimTemplates
-                  for StatefulSet
-                items:
-                  description: PersistentVolumeClaim is a user's request for and claim
-                    to a persistent volume
-                  properties:
-                    apiVersion:
-                      description: |-
-                        APIVersion defines the versioned schema of this representation of an object.
-                        Servers should convert recognized schemas to the latest internal value, and
-                        may reject unrecognized values.
-                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-                      type: string
-                    kind:
-                      description: |-
-                        Kind is a string value representing the REST resource this object represents.
-                        Servers may infer this from the endpoint the client submits requests to.
-                        Cannot be updated.
-                        In CamelCase.
-                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-                      type: string
-                    metadata:
-                      description: |-
-                        Standard object's metadata.
-                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    spec:
-                      description: |-
-                        spec defines the desired characteristics of a volume requested by a pod author.
-                        More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
-                      properties:
-                        accessModes:
-                          description: |-
-                            accessModes contains the desired access modes the volume should have.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                        dataSource:
-                          description: |-
-                            dataSource field can be used to specify either:
-                            * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
-                            * An existing PVC (PersistentVolumeClaim)
-                            If the provisioner or an external controller can support the specified data source,
-                            it will create a new volume based on the contents of the specified data source.
-                            When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-                            and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
-                            If the namespace is specified, then dataSourceRef will not be copied to dataSource.
-                          properties:
-                            apiGroup:
-                              description: |-
-                                APIGroup is the group for the resource being referenced.
-                                If APIGroup is not specified, the specified Kind must be in the core API group.
-                                For any other third-party types, APIGroup is required.
-                              type: string
-                            kind:
-                              description: Kind is the type of resource being referenced
-                              type: string
-                            name:
-                              description: Name is the name of resource being referenced
-                              type: string
-                          required:
-                          - kind
-                          - name
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        dataSourceRef:
-                          description: |-
-                            dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
-                            volume is desired. This may be any object from a non-empty API group (non
-                            core object) or a PersistentVolumeClaim object.
-                            When this field is specified, volume binding will only succeed if the type of
-                            the specified object matches some installed volume populator or dynamic
-                            provisioner.
-                            This field will replace the functionality of the dataSource field and as such
-                            if both fields are non-empty, they must have the same value. For backwards
-                            compatibility, when namespace isn't specified in dataSourceRef,
-                            both fields (dataSource and dataSourceRef) will be set to the same
-                            value automatically if one of them is empty and the other is non-empty.
-                            When namespace is specified in dataSourceRef,
-                            dataSource isn't set to the same value and must be empty.
-                            There are three important differences between dataSource and dataSourceRef:
-                            * While dataSource only allows two specific types of objects, dataSourceRef
-                              allows any non-core object, as well as PersistentVolumeClaim objects.
-                            * While dataSource ignores disallowed values (dropping them), dataSourceRef
-                              preserves all values, and generates an error if a disallowed value is
-                              specified.
-                            * While dataSource only allows local objects, dataSourceRef allows objects
-                              in any namespaces.
-                            (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
-                            (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                          properties:
-                            apiGroup:
-                              description: |-
-                                APIGroup is the group for the resource being referenced.
-                                If APIGroup is not specified, the specified Kind must be in the core API group.
-                                For any other third-party types, APIGroup is required.
-                              type: string
-                            kind:
-                              description: Kind is the type of resource being referenced
-                              type: string
-                            name:
-                              description: Name is the name of resource being referenced
-                              type: string
-                            namespace:
-                              description: |-
-                                Namespace is the namespace of resource being referenced
-                                Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
-                                (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                              type: string
-                          required:
-                          - kind
-                          - name
-                          type: object
-                        resources:
-                          description: |-
-                            resources represents the minimum resources the volume should have.
-                            If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
-                            that are lower than previous value but must still be higher than capacity recorded in the
-                            status field of the claim.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
-                          properties:
-                            limits:
-                              additionalProperties:
-                                anyOf:
-                                - type: integer
-                                - type: string
-                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                x-kubernetes-int-or-string: true
-                              description: |-
-                                Limits describes the maximum amount of compute resources allowed.
-                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                              type: object
-                            requests:
-                              additionalProperties:
-                                anyOf:
-                                - type: integer
-                                - type: string
-                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                x-kubernetes-int-or-string: true
-                              description: |-
-                                Requests describes the minimum amount of compute resources required.
-                                If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                                otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                              type: object
-                          type: object
-                        selector:
-                          description: selector is a label query over volumes to consider
-                            for binding.
-                          properties:
-                            matchExpressions:
-                              description: matchExpressions is a list of label selector
-                                requirements. The requirements are ANDed.
-                              items:
-                                description: |-
-                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                  relates the key and values.
-                                properties:
-                                  key:
-                                    description: key is the label key that the selector
-                                      applies to.
-                                    type: string
-                                  operator:
-                                    description: |-
-                                      operator represents a key's relationship to a set of values.
-                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                    type: string
-                                  values:
-                                    description: |-
-                                      values is an array of string values. If the operator is In or NotIn,
-                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                      the values array must be empty. This array is replaced during a strategic
-                                      merge patch.
-                                    items:
-                                      type: string
-                                    type: array
-                                    x-kubernetes-list-type: atomic
-                                required:
-                                - key
-                                - operator
-                                type: object
-                              type: array
-                              x-kubernetes-list-type: atomic
-                            matchLabels:
-                              additionalProperties:
-                                type: string
-                              description: |-
-                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                              type: object
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        storageClassName:
-                          description: |-
-                            storageClassName is the name of the StorageClass required by the claim.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
-                          type: string
-                        volumeAttributesClassName:
-                          description: |-
-                            volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
-                            If specified, the CSI driver will create or update the volume with the attributes defined
-                            in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                            it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                            will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                            If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                            will be set by the persistentvolume controller if it exists.
-                            If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
-                            set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
-                            exists.
-                            More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                            (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
-                          type: string
-                        volumeMode:
-                          description: |-
-                            volumeMode defines what type of volume is required by the claim.
-                            Value of Filesystem is implied when not included in claim spec.
-                          type: string
-                        volumeName:
-                          description: volumeName is the binding reference to the
-                            PersistentVolume backing this claim.
-                          type: string
-                      type: object
-                    status:
-                      description: |-
-                        status represents the current information/status of a persistent volume claim.
-                        Read-only.
-                        More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
-                      properties:
-                        accessModes:
-                          description: |-
-                            accessModes contains the actual access modes the volume backing the PVC has.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                        allocatedResourceStatuses:
-                          additionalProperties:
-                            description: |-
-                              When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource
-                              that it does not recognizes, then it should ignore that update and let other controllers
-                              handle it.
-                            type: string
-                          description: "allocatedResourceStatuses stores status of
-                            resource being resized for the given PVC.\nKey names follow
-                            standard Kubernetes label syntax. Valid values are either:\n\t*
-                            Un-prefixed keys:\n\t\t- storage - the capacity of the
-                            volume.\n\t* Custom resources must use implementation-defined
-                            prefixed names such as \"example.com/my-custom-resource\"\nApart
-                            from above values - keys that are unprefixed or have kubernetes.io
-                            prefix are considered\nreserved and hence may not be used.\n\nClaimResourceStatus
-                            can be in any of following states:\n\t- ControllerResizeInProgress:\n\t\tState
-                            set when resize controller starts resizing the volume
-                            in control-plane.\n\t- ControllerResizeFailed:\n\t\tState
-                            set when resize has failed in resize controller with a
-                            terminal error.\n\t- NodeResizePending:\n\t\tState set
-                            when resize controller has finished resizing the volume
-                            but further resizing of\n\t\tvolume is needed on the node.\n\t-
-                            NodeResizeInProgress:\n\t\tState set when kubelet starts
-                            resizing the volume.\n\t- NodeResizeFailed:\n\t\tState
-                            set when resizing has failed in kubelet with a terminal
-                            error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor
-                            example: if expanding a PVC for more capacity - this field
-                            can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage']
-                            = \"ControllerResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                            = \"ControllerResizeFailed\"\n     - pvc.status.allocatedResourceStatus['storage']
-                            = \"NodeResizePending\"\n     - pvc.status.allocatedResourceStatus['storage']
-                            = \"NodeResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                            = \"NodeResizeFailed\"\nWhen this field is not set, it
-                            means that no resize operation is in progress for the
-                            given PVC.\n\nA controller that receives PVC update with
-                            previously unknown resourceName or ClaimResourceStatus\nshould
-                            ignore the update for the purpose it was designed. For
-                            example - a controller that\nonly is responsible for resizing
-                            capacity of the volume, should ignore PVC updates that
-                            change other valid\nresources associated with PVC.\n\nThis
-                            is an alpha field and requires enabling RecoverVolumeExpansionFailure
-                            feature."
-                          type: object
-                          x-kubernetes-map-type: granular
-                        allocatedResources:
-                          additionalProperties:
-                            anyOf:
-                            - type: integer
-                            - type: string
-                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                            x-kubernetes-int-or-string: true
-                          description: "allocatedResources tracks the resources allocated
-                            to a PVC including its capacity.\nKey names follow standard
-                            Kubernetes label syntax. Valid values are either:\n\t*
-                            Un-prefixed keys:\n\t\t- storage - the capacity of the
-                            volume.\n\t* Custom resources must use implementation-defined
-                            prefixed names such as \"example.com/my-custom-resource\"\nApart
-                            from above values - keys that are unprefixed or have kubernetes.io
-                            prefix are considered\nreserved and hence may not be used.\n\nCapacity
-                            reported here may be larger than the actual capacity when
-                            a volume expansion operation\nis requested.\nFor storage
-                            quota, the larger value from allocatedResources and PVC.spec.resources
-                            is used.\nIf allocatedResources is not set, PVC.spec.resources
-                            alone is used for quota calculation.\nIf a volume expansion
-                            capacity request is lowered, allocatedResources is only\nlowered
-                            if there are no expansion operations in progress and if
-                            the actual volume capacity\nis equal or lower than the
-                            requested capacity.\n\nA controller that receives PVC
-                            update with previously unknown resourceName\nshould ignore
-                            the update for the purpose it was designed. For example
-                            - a controller that\nonly is responsible for resizing
-                            capacity of the volume, should ignore PVC updates that
-                            change other valid\nresources associated with PVC.\n\nThis
-                            is an alpha field and requires enabling RecoverVolumeExpansionFailure
-                            feature."
-                          type: object
-                        capacity:
-                          additionalProperties:
-                            anyOf:
-                            - type: integer
-                            - type: string
-                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                            x-kubernetes-int-or-string: true
-                          description: capacity represents the actual resources of
-                            the underlying volume.
-                          type: object
-                        conditions:
-                          description: |-
-                            conditions is the current Condition of persistent volume claim. If underlying persistent volume is being
-                            resized then the Condition will be set to 'Resizing'.
-                          items:
-                            description: PersistentVolumeClaimCondition contains details
-                              about state of pvc
-                            properties:
-                              lastProbeTime:
-                                description: lastProbeTime is the time we probed the
-                                  condition.
-                                format: date-time
-                                type: string
-                              lastTransitionTime:
-                                description: lastTransitionTime is the time the condition
-                                  transitioned from one status to another.
-                                format: date-time
-                                type: string
-                              message:
-                                description: message is the human-readable message
-                                  indicating details about last transition.
-                                type: string
-                              reason:
-                                description: |-
-                                  reason is a unique, this should be a short, machine understandable string that gives the reason
-                                  for condition's last transition. If it reports "Resizing" that means the underlying
-                                  persistent volume is being resized.
-                                type: string
-                              status:
-                                description: |-
-                                  Status is the status of the condition.
-                                  Can be True, False, Unknown.
-                                  More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required
-                                type: string
-                              type:
-                                description: |-
-                                  Type is the type of the condition.
-                                  More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about
-                                type: string
-                            required:
-                            - status
-                            - type
-                            type: object
-                          type: array
-                          x-kubernetes-list-map-keys:
-                          - type
-                          x-kubernetes-list-type: map
-                        currentVolumeAttributesClassName:
-                          description: |-
-                            currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
-                            When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                            This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
-                          type: string
-                        modifyVolumeStatus:
-                          description: |-
-                            ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
-                            When this is unset, there is no ModifyVolume operation being attempted.
-                            This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
-                          properties:
-                            status:
-                              description: "status is the status of the ControllerModifyVolume
-                                operation. It can be in any of following states:\n
-                                - Pending\n   Pending indicates that the PersistentVolumeClaim
-                                cannot be modified due to unmet requirements, such
-                                as\n   the specified VolumeAttributesClass not existing.\n
-                                - InProgress\n   InProgress indicates that the volume
-                                is being modified.\n - Infeasible\n  Infeasible indicates
-                                that the request has been rejected as invalid by the
-                                CSI driver. To\n\t  resolve the error, a valid VolumeAttributesClass
-                                needs to be specified.\nNote: New statuses can be
-                                added in the future. Consumers should check for unknown
-                                statuses and fail appropriately."
-                              type: string
-                            targetVolumeAttributesClassName:
-                              description: targetVolumeAttributesClassName is the
-                                name of the VolumeAttributesClass the PVC currently
-                                being reconciled
-                              type: string
-                          required:
-                          - status
-                          type: object
-                        phase:
-                          description: phase represents the current phase of PersistentVolumeClaim.
-                          type: string
-                      type: object
-                  type: object
-                type: array
-              clusterAdvertiseAddress:
-                description: |-
-                  ClusterAdvertiseAddress is the explicit address to advertise in cluster.
-                  Needs to be provided for non RFC1918 [1] (public) addresses.
-                  [1] RFC1918: https://tools.ietf.org/html/rfc1918
-                type: string
-              clusterDomainName:
-                description: |-
-                  ClusterDomainName defines domain name suffix for in-cluster dns addresses
-                  aka .cluster.local
-                  used to build pod peer addresses for in-cluster communication
-                type: string
-              configMaps:
-                description: |-
-                  ConfigMaps is a list of ConfigMaps in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/configs/CONFIGMAP_NAME folder
-                items:
-                  type: string
-                type: array
-              configNamespaceSelector:
-                description: |2-
-                   ConfigNamespaceSelector defines namespace selector for VMAlertmanagerConfig.
-                  Works in combination with Selector.
-                  NamespaceSelector nil - only objects at VMAlertmanager namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              configRawYaml:
-                description: |-
-                  ConfigRawYaml - raw configuration for alertmanager,
-                  it helps it to start without secret.
-                  priority -> hardcoded ConfigRaw -> ConfigRaw, provided by user -> ConfigSecret.
-                type: string
-              configReloaderExtraArgs:
-                additionalProperties:
-                  type: string
-                description: |-
-                  ConfigReloaderExtraArgs that will be passed to  VMAuths config-reloader container
-                  for example resyncInterval: "30s"
-                type: object
-              configReloaderImageTag:
-                description: ConfigReloaderImageTag defines image:tag for config-reloader
-                  container
-                type: string
-              configReloaderResources:
-                description: |-
-                  ConfigReloaderResources config-reloader container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
-                properties:
-                  claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
-                    items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
-                      properties:
-                        name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
-                          type: string
-                        request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
-                          type: string
-                      required:
-                      - name
-                      type: object
-                    type: array
-                    x-kubernetes-list-map-keys:
-                    - name
-                    x-kubernetes-list-type: map
-                  limits:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                  requests:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                type: object
-              configSecret:
-                description: |-
-                  ConfigSecret is the name of a Kubernetes Secret in the same namespace as the
-                  VMAlertmanager object, which contains configuration for this VMAlertmanager,
-                  configuration must be inside secret key: alertmanager.yaml.
-                  It must be created by user.
-                  instance. Defaults to 'vmalertmanager-<alertmanager-name>'
-                  The secret is mounted into /etc/alertmanager/config.
-                type: string
-              configSelector:
-                description: |-
-                  ConfigSelector defines selector for VMAlertmanagerConfig, result config will be merged with with Raw or Secret config.
-                  Works in combination with NamespaceSelector.
-                  NamespaceSelector nil - only objects at VMAlertmanager namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              containers:
-                description: |-
-                  Containers property allows to inject additions sidecars or to patch existing containers.
-                  It can be useful for proxies, backup, etc.
-                items:
-                  description: A single application container that you want to run
-                    within a pod.
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              disableAutomountServiceAccountToken:
-                description: |-
-                  DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
-                  Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
-                  For example, vmagent and vm-config-reloader requires k8s API access.
-                  Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
-                  And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
-                type: boolean
-              disableNamespaceMatcher:
-                description: |-
-                  DisableNamespaceMatcher disables top route namespace label matcher for VMAlertmanagerConfig
-                  It may be useful if alert doesn't have namespace label for some reason
-                type: boolean
-              disableRouteContinueEnforce:
-                description: DisableRouteContinueEnforce cancel the behavior for VMAlertmanagerConfig
-                  that always enforce first-level route continue to true
-                type: boolean
-              disableSelfServiceScrape:
-                description: |-
-                  DisableSelfServiceScrape controls creation of VMServiceScrape by operator
-                  for the application.
-                  Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable
-                type: boolean
-              dnsConfig:
-                description: |-
-                  Specifies the DNS parameters of a pod.
-                  Parameters specified here will be merged to the generated DNS
-                  configuration based on DNSPolicy.
-                items:
-                  x-kubernetes-preserve-unknown-fields: true
-                properties:
-                  nameservers:
-                    description: |-
-                      A list of DNS name server IP addresses.
-                      This will be appended to the base nameservers generated from DNSPolicy.
-                      Duplicated nameservers will be removed.
-                    items:
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  options:
-                    description: |-
-                      A list of DNS resolver options.
-                      This will be merged with the base options generated from DNSPolicy.
-                      Duplicated entries will be removed. Resolution options given in Options
-                      will override those that appear in the base DNSPolicy.
-                    items:
-                      description: PodDNSConfigOption defines DNS resolver options
-                        of a pod.
-                      properties:
-                        name:
-                          description: |-
-                            Name is this DNS resolver option's name.
-                            Required.
-                          type: string
-                        value:
-                          description: Value is this DNS resolver option's value.
-                          type: string
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  searches:
-                    description: |-
-                      A list of DNS search domains for host-name lookup.
-                      This will be appended to the base search paths generated from DNSPolicy.
-                      Duplicated search paths will be removed.
-                    items:
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: atomic
-                type: object
-              dnsPolicy:
-                description: DNSPolicy sets DNS policy for the pod
-                type: string
-              enforcedTopRouteMatchers:
-                description: |-
-                  EnforcedTopRouteMatchers defines label matchers to be added for the top route
-                  of VMAlertmanagerConfig
-                  It allows to make some set of labels required for alerts.
-                  https://prometheus.io/docs/alerting/latest/configuration/#matcher
-                items:
-                  type: string
-                type: array
-              externalURL:
-                description: |-
-                  ExternalURL the VMAlertmanager instances will be available under. This is
-                  necessary to generate correct URLs. This is necessary if VMAlertmanager is not
-                  served from root of a DNS name.
-                type: string
-              extraArgs:
-                additionalProperties:
-                  type: string
-                description: |-
-                  ExtraArgs that will be passed to the application container
-                  for example remoteWrite.tmpDataPath: /tmp
-                type: object
-              extraEnvs:
-                description: ExtraEnvs that will be passed to the application container
-                items:
-                  description: EnvVar represents an environment variable present in
-                    a Container.
-                  properties:
-                    name:
-                      description: Name of the environment variable. Must be a C_IDENTIFIER.
-                      type: string
-                    value:
-                      description: |-
-                        Variable references $(VAR_NAME) are expanded
-                        using the previously defined environment variables in the container and
-                        any service environment variables. If a variable cannot be resolved,
-                        the reference in the input string will be unchanged. Double $$ are reduced
-                        to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                        "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                        Escaped references will never be expanded, regardless of whether the variable
-                        exists or not.
-                        Defaults to "".
-                      type: string
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              extraEnvsFrom:
-                description: |-
-                  ExtraEnvsFrom defines source of env variables for the application container
-                  could either be secret or configmap
-                items:
-                  description: EnvFromSource represents the source of a set of ConfigMaps
-                  properties:
-                    configMapRef:
-                      description: The ConfigMap to select from
-                      properties:
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the ConfigMap must be defined
-                          type: boolean
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    prefix:
-                      description: An optional identifier to prepend to each key in
-                        the ConfigMap. Must be a C_IDENTIFIER.
-                      type: string
-                    secretRef:
-                      description: The Secret to select from
-                      properties:
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the Secret must be defined
-                          type: boolean
-                      type: object
-                      x-kubernetes-map-type: atomic
-                  type: object
-                type: array
-              gossipConfig:
-                description: GossipConfig defines gossip TLS configuration for Alertmanager
-                  cluster
-                properties:
-                  tls_client_config:
-                    description: TLSClientConfig defines client TLS configuration
-                      for alertmanager
-                    properties:
-                      ca_file:
-                        description: |-
-                          CAFile defines path to the pre-mounted file with CA
-                          mutually exclusive with CASecretRef
-                        type: string
-                      ca_secret_ref:
-                        description: |-
-                          CA defines reference for secret with CA content under given key
-                          mutually exclusive with CAFile
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      cert_file:
-                        description: |-
-                          CertFile defines path to the pre-mounted file with certificate
-                          mutually exclusive with CertSecretRef
-                        type: string
-                      cert_secret_ref:
-                        description: |-
-                          CertSecretRef defines reference for secret with certificate content under given key
-                          mutually exclusive with CertFile
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      insecure_skip_verify:
-                        description: |-
-                          Cert defines reference for secret with CA content under given key
-                          mutually exclusive with CertFile
-                        type: boolean
-                      key_file:
-                        description: |-
-                          KeyFile defines path to the pre-mounted file with certificate key
-                          mutually exclusive with KeySecretRef
-                        type: string
-                      key_secret_ref:
-                        description: |-
-                          Key defines reference for secret with certificate key content under given key
-                          mutually exclusive with KeyFile
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      server_name:
-                        description: ServerName indicates a name of a server
-                        type: string
-                    type: object
-                  tls_server_config:
-                    description: TLSServerConfig defines server TLS configuration
-                      for alertmanager
-                    properties:
-                      cert_file:
-                        description: |-
-                          CertFile defines path to the pre-mounted file with certificate
-                          mutually exclusive with CertSecretRef
-                        type: string
-                      cert_secret_ref:
-                        description: |-
-                          CertSecretRef defines reference for secret with certificate content under given key
-                          mutually exclusive with CertFile
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      cipher_suites:
-                        description: |-
-                          CipherSuites defines list of supported cipher suites for TLS versions up to TLS 1.2
-                          https://golang.org/pkg/crypto/tls/#pkg-constants
-                        items:
-                          type: string
-                        type: array
-                      client_auth_type:
-                        description: |-
-                          Cert defines reference for secret with CA content under given key
-                          mutually exclusive with CertFile
-                          ClientAuthType defines server policy for client authentication
-                          If you want to enable client authentication (aka mTLS), you need to use RequireAndVerifyClientCert
-                          Note, mTLS is supported only at enterprise version of VictoriaMetrics components
-                        enum:
-                        - NoClientCert
-                        - RequireAndVerifyClientCert
-                        type: string
-                      client_ca_file:
-                        description: |-
-                          ClientCAFile defines path to the pre-mounted file with CA
-                          mutually exclusive with ClientCASecretRef
-                        type: string
-                      client_ca_secret_ref:
-                        description: |-
-                          ClientCASecretRef defines reference for secret with CA content under given key
-                          mutually exclusive with ClientCAFile
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      curve_preferences:
-                        description: |-
-                          CurvePreferences defines elliptic curves that will be used in an ECDHE handshake, in preference order.
-                          https://golang.org/pkg/crypto/tls/#CurveID
-                        items:
-                          type: string
-                        type: array
-                      key_file:
-                        description: |-
-                          KeyFile defines path to the pre-mounted file with certificate key
-                          mutually exclusive with KeySecretRef
-                        type: string
-                      key_secret_ref:
-                        description: |-
-                          Key defines reference for secret with certificate key content under given key
-                          mutually exclusive with KeyFile
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      max_version:
-                        description: MaxVersion maximum TLS version that is acceptable.
-                        enum:
-                        - TLS10
-                        - TLS11
-                        - TLS12
-                        - TLS13
-                        type: string
-                      min_version:
-                        description: MinVersion minimum TLS version that is acceptable.
-                        enum:
-                        - TLS10
-                        - TLS11
-                        - TLS12
-                        - TLS13
-                        type: string
-                      prefer_server_cipher_suites:
-                        description: |-
-                          PreferServerCipherSuites controls whether the server selects the
-                          client's most preferred ciphersuite
-                        type: boolean
-                    type: object
-                type: object
-              host_aliases:
-                description: |-
-                  HostAliasesUnderScore provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
-                  Has Priority over hostAliases field
-                items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
-                  properties:
-                    hostnames:
-                      description: Hostnames for the above IP address.
-                      items:
-                        type: string
-                      type: array
-                      x-kubernetes-list-type: atomic
-                    ip:
-                      description: IP address of the host file entry.
-                      type: string
-                  required:
-                  - ip
-                  type: object
-                type: array
-              hostAliases:
-                description: |-
-                  HostAliases provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
-                items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
-                  properties:
-                    hostnames:
-                      description: Hostnames for the above IP address.
-                      items:
-                        type: string
-                      type: array
-                      x-kubernetes-list-type: atomic
-                    ip:
-                      description: IP address of the host file entry.
-                      type: string
-                  required:
-                  - ip
-                  type: object
-                type: array
-              hostNetwork:
-                description: HostNetwork controls whether the pod may use the node
-                  network namespace
-                type: boolean
-              image:
-                description: |-
-                  Image - docker image settings
-                  if no specified operator uses default version from operator config
-                properties:
-                  pullPolicy:
-                    description: PullPolicy describes how to pull docker image
-                    type: string
-                  repository:
-                    description: Repository contains name of docker image + it's repository
-                      if needed
-                    type: string
-                  tag:
-                    description: Tag contains desired docker image version
-                    type: string
-                type: object
-              imagePullSecrets:
-                description: |-
-                  ImagePullSecrets An optional list of references to secrets in the same namespace
-                  to use for pulling images from registries
-                  see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
-                items:
-                  description: |-
-                    LocalObjectReference contains enough information to let you locate the
-                    referenced object inside the same namespace.
-                  properties:
-                    name:
-                      default: ""
-                      description: |-
-                        Name of the referent.
-                        This field is effectively required, but due to backwards compatibility is
-                        allowed to be empty. Instances of this type with an empty value here are
-                        almost certainly wrong.
-                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                      type: string
-                  type: object
-                  x-kubernetes-map-type: atomic
-                type: array
-              initContainers:
-                description: |-
-                  InitContainers allows adding initContainers to the pod definition.
-                  Any errors during the execution of an initContainer will lead to a restart of the Pod.
-                  More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
-                items:
-                  description: A single application container that you want to run
-                    within a pod.
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              listenLocal:
-                description: |-
-                  ListenLocal makes the VMAlertmanager server listen on loopback, so that it
-                  does not bind against the Pod IP. Note this is only for the VMAlertmanager
-                  UI, not the gossip communication.
-                type: boolean
-              livenessProbe:
-                description: LivenessProbe that will be added CRD pod
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              logFormat:
-                description: LogFormat for VMAlertmanager to be configured with.
-                enum:
-                - logfmt
-                - json
-                type: string
-              logLevel:
-                description: Log level for VMAlertmanager to be configured with.
-                enum:
-                - debug
-                - info
-                - warn
-                - error
-                - DEBUG
-                - INFO
-                - WARN
-                - ERROR
-                type: string
-              managedMetadata:
-                description: |-
-                  ManagedMetadata defines metadata that will be added to the all objects
-                  created by operator for the given CustomResource
-                properties:
-                  annotations:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                    type: object
-                  labels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                    type: object
-                type: object
-              minReadySeconds:
-                description: |-
-                  MinReadySeconds defines a minimum number of seconds to wait before starting update next pod
-                  if previous in healthy state
-                  Has no effect for VLogs and VMSingle
-                format: int32
-                type: integer
-              nodeSelector:
-                additionalProperties:
-                  type: string
-                description: NodeSelector Define which Nodes the Pods are scheduled
-                  on.
-                type: object
-              paused:
-                description: |-
-                  Paused If set to true all actions on the underlying managed objects are not
-                  going to be performed, except for delete actions.
-                type: boolean
-              podDisruptionBudget:
-                description: PodDisruptionBudget created by operator
-                properties:
-                  maxUnavailable:
-                    anyOf:
-                    - type: integer
-                    - type: string
-                    description: |-
-                      An eviction is allowed if at most "maxUnavailable" pods selected by
-                      "selector" are unavailable after the eviction, i.e. even in absence of
-                      the evicted pod. For example, one can prevent all voluntary evictions
-                      by specifying 0. This is a mutually exclusive setting with "minAvailable".
-                    x-kubernetes-int-or-string: true
-                  minAvailable:
-                    anyOf:
-                    - type: integer
-                    - type: string
-                    description: |-
-                      An eviction is allowed if at least "minAvailable" pods selected by
-                      "selector" will still be available after the eviction, i.e. even in the
-                      absence of the evicted pod.  So for example you can prevent all voluntary
-                      evictions by specifying "100%".
-                    x-kubernetes-int-or-string: true
-                  selectorLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      replaces default labels selector generated by operator
-                      it's useful when you need to create custom budget
-                    type: object
-                type: object
-              podMetadata:
-                description: PodMetadata configures Labels and Annotations which are
-                  propagated to the alertmanager pods.
-                properties:
-                  annotations:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                    type: object
-                  labels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects. May match selectors of replication controllers
-                      and services.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                    type: object
-                  name:
-                    description: |-
-                      Name must be unique within a namespace. Is required when creating resources, although
-                      some resources may allow a client to request the generation of an appropriate name
-                      automatically. Name is primarily intended for creation idempotence and configuration
-                      definition.
-                      Cannot be updated.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                    type: string
-                type: object
-              port:
-                description: Port listen address
-                type: string
-              portName:
-                description: |-
-                  PortName used for the pods and governing service.
-                  This defaults to web
-                type: string
-              priorityClassName:
-                description: PriorityClassName class assigned to the Pods
-                type: string
-              readinessGates:
-                description: ReadinessGates defines pod readiness gates
-                items:
-                  description: PodReadinessGate contains the reference to a pod condition
-                  properties:
-                    conditionType:
-                      description: ConditionType refers to a condition in the pod's
-                        condition list with matching type.
-                      type: string
-                  required:
-                  - conditionType
-                  type: object
-                type: array
-              readinessProbe:
-                description: ReadinessProbe that will be added CRD pod
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              replicaCount:
-                description: ReplicaCount is the expected size of the Application.
-                format: int32
-                type: integer
-              resources:
-                description: |-
-                  Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
-                properties:
-                  claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
-                    items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
-                      properties:
-                        name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
-                          type: string
-                        request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
-                          type: string
-                      required:
-                      - name
-                      type: object
-                    type: array
-                    x-kubernetes-list-map-keys:
-                    - name
-                    x-kubernetes-list-type: map
-                  limits:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                  requests:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                type: object
-              retention:
-                description: |-
-                  Retention Time duration VMAlertmanager shall retain data for. Default is '120h',
-                  and must match the regular expression `[0-9]+(ms|s|m|h)` (milliseconds seconds minutes hours).
-                pattern: '[0-9]+(ms|s|m|h)'
-                type: string
-              revisionHistoryLimitCount:
-                description: |-
-                  The number of old ReplicaSets to retain to allow rollback in deployment or
-                  maximum number of revisions that will be maintained in the Deployment revision history.
-                  Has no effect at StatefulSets
-                  Defaults to 10.
-                format: int32
-                type: integer
-              rollingUpdateStrategy:
-                description: |-
-                  RollingUpdateStrategy defines strategy for application updates
-                  Default is OnDelete, in this case operator handles update process
-                  Can be changed for RollingUpdate
-                type: string
-              routePrefix:
-                description: |-
-                  RoutePrefix VMAlertmanager registers HTTP handlers for. This is useful,
-                  if using ExternalURL and a proxy is rewriting HTTP routes of a request,
-                  and the actual ExternalURL is still true, but the server serves requests
-                  under a different route prefix. For example for use with `kubectl proxy`.
-                type: string
-              runtimeClassName:
-                description: |-
-                  RuntimeClassName - defines runtime class for kubernetes pod.
-                  https://kubernetes.io/docs/concepts/containers/runtime-class/
-                type: string
-              schedulerName:
-                description: SchedulerName - defines kubernetes scheduler name
-                type: string
-              secrets:
-                description: |-
-                  Secrets is a list of Secrets in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/secrets/SECRET_NAME folder
-                items:
-                  type: string
-                type: array
-              securityContext:
-                description: |-
-                  SecurityContext holds pod-level security attributes and common container settings.
-                  This defaults to the default PodSecurityContext.
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              selectAllByDefault:
-                description: |-
-                  SelectAllByDefault changes default behavior for empty CRD selectors, such ConfigSelector.
-                  with selectAllByDefault: true and undefined ConfigSelector and ConfigNamespaceSelector
-                  Operator selects all exist alertManagerConfigs
-                  with selectAllByDefault: false - selects nothing
-                type: boolean
-              serviceAccountName:
-                description: ServiceAccountName is the name of the ServiceAccount
-                  to use to run the pods
-                type: string
-              serviceScrapeSpec:
-                description: ServiceScrapeSpec that will be added to vmalertmanager
-                  VMServiceScrape spec
-                required:
-                - endpoints
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              serviceSpec:
-                description: ServiceSpec that will be added to vmalertmanager service
-                  spec
-                properties:
-                  metadata:
-                    description: EmbeddedObjectMetadata defines objectMeta for additional
-                      service.
-                    properties:
-                      annotations:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Annotations is an unstructured key value map stored with a resource that may be
-                          set by external tools to store and retrieve arbitrary metadata. They are not
-                          queryable and should be preserved when modifying objects.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                        type: object
-                      labels:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Labels Map of string keys and values that can be used to organize and categorize
-                          (scope and select) objects. May match selectors of replication controllers
-                          and services.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                        type: object
-                      name:
-                        description: |-
-                          Name must be unique within a namespace. Is required when creating resources, although
-                          some resources may allow a client to request the generation of an appropriate name
-                          automatically. Name is primarily intended for creation idempotence and configuration
-                          definition.
-                          Cannot be updated.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                        type: string
-                    type: object
-                  spec:
-                    description: |-
-                      ServiceSpec describes the attributes that a user creates on a service.
-                      More info: https://kubernetes.io/docs/concepts/services-networking/service/
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  useAsDefault:
-                    description: |-
-                      UseAsDefault applies changes from given service definition to the main object Service
-                      Changing from headless service to clusterIP or loadbalancer may break cross-component communication
-                    type: boolean
-                required:
-                - spec
-                type: object
-              startupProbe:
-                description: StartupProbe that will be added to CRD pod
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              storage:
-                description: |-
-                  Storage is the definition of how storage will be used by the VMAlertmanager
-                  instances.
-                properties:
-                  disableMountSubPath:
-                    description: |-
-                      Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary.
-                      DisableMountSubPath allows to remove any subPath usage in volume mounts.
-                    type: boolean
-                  emptyDir:
-                    description: |-
-                      EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More
-                      info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir
-                    properties:
-                      medium:
-                        description: |-
-                          medium represents what type of storage medium should back this directory.
-                          The default is "" which means to use the node's default medium.
-                          Must be an empty string (default) or Memory.
-                          More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
-                        type: string
-                      sizeLimit:
-                        anyOf:
-                        - type: integer
-                        - type: string
-                        description: |-
-                          sizeLimit is the total amount of local storage required for this EmptyDir volume.
-                          The size limit is also applicable for memory medium.
-                          The maximum usage on memory medium EmptyDir would be the minimum value between
-                          the SizeLimit specified here and the sum of memory limits of all containers in a pod.
-                          The default is nil which means that the limit is undefined.
-                          More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
-                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                        x-kubernetes-int-or-string: true
-                    type: object
-                  volumeClaimTemplate:
-                    description: A PVC spec to be used by the VMAlertManager StatefulSets.
-                    properties:
-                      apiVersion:
-                        description: |-
-                          APIVersion defines the versioned schema of this representation of an object.
-                          Servers should convert recognized schemas to the latest internal value, and
-                          may reject unrecognized values.
-                          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-                        type: string
-                      kind:
-                        description: |-
-                          Kind is a string value representing the REST resource this object represents.
-                          Servers may infer this from the endpoint the client submits requests to.
-                          Cannot be updated.
-                          In CamelCase.
-                          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-                        type: string
-                      metadata:
-                        description: EmbeddedMetadata contains metadata relevant to
-                          an EmbeddedResource.
-                        properties:
-                          annotations:
-                            additionalProperties:
-                              type: string
-                            description: |-
-                              Annotations is an unstructured key value map stored with a resource that may be
-                              set by external tools to store and retrieve arbitrary metadata. They are not
-                              queryable and should be preserved when modifying objects.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                            type: object
-                          labels:
-                            additionalProperties:
-                              type: string
-                            description: |-
-                              Labels Map of string keys and values that can be used to organize and categorize
-                              (scope and select) objects. May match selectors of replication controllers
-                              and services.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                            type: object
-                          name:
-                            description: |-
-                              Name must be unique within a namespace. Is required when creating resources, although
-                              some resources may allow a client to request the generation of an appropriate name
-                              automatically. Name is primarily intended for creation idempotence and configuration
-                              definition.
-                              Cannot be updated.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                            type: string
-                        type: object
-                      spec:
-                        description: |-
-                          Spec defines the desired characteristics of a volume requested by a pod author.
-                          More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
-                        properties:
-                          accessModes:
-                            description: |-
-                              accessModes contains the desired access modes the volume should have.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                            items:
-                              type: string
-                            type: array
-                            x-kubernetes-list-type: atomic
-                          dataSource:
-                            description: |-
-                              dataSource field can be used to specify either:
-                              * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
-                              * An existing PVC (PersistentVolumeClaim)
-                              If the provisioner or an external controller can support the specified data source,
-                              it will create a new volume based on the contents of the specified data source.
-                              When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-                              and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
-                              If the namespace is specified, then dataSourceRef will not be copied to dataSource.
-                            properties:
-                              apiGroup:
-                                description: |-
-                                  APIGroup is the group for the resource being referenced.
-                                  If APIGroup is not specified, the specified Kind must be in the core API group.
-                                  For any other third-party types, APIGroup is required.
-                                type: string
-                              kind:
-                                description: Kind is the type of resource being referenced
-                                type: string
-                              name:
-                                description: Name is the name of resource being referenced
-                                type: string
-                            required:
-                            - kind
-                            - name
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          dataSourceRef:
-                            description: |-
-                              dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
-                              volume is desired. This may be any object from a non-empty API group (non
-                              core object) or a PersistentVolumeClaim object.
-                              When this field is specified, volume binding will only succeed if the type of
-                              the specified object matches some installed volume populator or dynamic
-                              provisioner.
-                              This field will replace the functionality of the dataSource field and as such
-                              if both fields are non-empty, they must have the same value. For backwards
-                              compatibility, when namespace isn't specified in dataSourceRef,
-                              both fields (dataSource and dataSourceRef) will be set to the same
-                              value automatically if one of them is empty and the other is non-empty.
-                              When namespace is specified in dataSourceRef,
-                              dataSource isn't set to the same value and must be empty.
-                              There are three important differences between dataSource and dataSourceRef:
-                              * While dataSource only allows two specific types of objects, dataSourceRef
-                                allows any non-core object, as well as PersistentVolumeClaim objects.
-                              * While dataSource ignores disallowed values (dropping them), dataSourceRef
-                                preserves all values, and generates an error if a disallowed value is
-                                specified.
-                              * While dataSource only allows local objects, dataSourceRef allows objects
-                                in any namespaces.
-                              (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
-                              (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                            properties:
-                              apiGroup:
-                                description: |-
-                                  APIGroup is the group for the resource being referenced.
-                                  If APIGroup is not specified, the specified Kind must be in the core API group.
-                                  For any other third-party types, APIGroup is required.
-                                type: string
-                              kind:
-                                description: Kind is the type of resource being referenced
-                                type: string
-                              name:
-                                description: Name is the name of resource being referenced
-                                type: string
-                              namespace:
-                                description: |-
-                                  Namespace is the namespace of resource being referenced
-                                  Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
-                                  (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                                type: string
-                            required:
-                            - kind
-                            - name
-                            type: object
-                          resources:
-                            description: |-
-                              resources represents the minimum resources the volume should have.
-                              If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
-                              that are lower than previous value but must still be higher than capacity recorded in the
-                              status field of the claim.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
-                            properties:
-                              limits:
-                                additionalProperties:
-                                  anyOf:
-                                  - type: integer
-                                  - type: string
-                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                  x-kubernetes-int-or-string: true
-                                description: |-
-                                  Limits describes the maximum amount of compute resources allowed.
-                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                                type: object
-                              requests:
-                                additionalProperties:
-                                  anyOf:
-                                  - type: integer
-                                  - type: string
-                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                  x-kubernetes-int-or-string: true
-                                description: |-
-                                  Requests describes the minimum amount of compute resources required.
-                                  If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                                  otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                                type: object
-                            type: object
-                          selector:
-                            description: selector is a label query over volumes to
-                              consider for binding.
-                            properties:
-                              matchExpressions:
-                                description: matchExpressions is a list of label selector
-                                  requirements. The requirements are ANDed.
-                                items:
-                                  description: |-
-                                    A label selector requirement is a selector that contains values, a key, and an operator that
-                                    relates the key and values.
-                                  properties:
-                                    key:
-                                      description: key is the label key that the selector
-                                        applies to.
-                                      type: string
-                                    operator:
-                                      description: |-
-                                        operator represents a key's relationship to a set of values.
-                                        Valid operators are In, NotIn, Exists and DoesNotExist.
-                                      type: string
-                                    values:
-                                      description: |-
-                                        values is an array of string values. If the operator is In or NotIn,
-                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                        the values array must be empty. This array is replaced during a strategic
-                                        merge patch.
-                                      items:
-                                        type: string
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                  required:
-                                  - key
-                                  - operator
-                                  type: object
-                                type: array
-                                x-kubernetes-list-type: atomic
-                              matchLabels:
-                                additionalProperties:
-                                  type: string
-                                description: |-
-                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                type: object
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          storageClassName:
-                            description: |-
-                              storageClassName is the name of the StorageClass required by the claim.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
-                            type: string
-                          volumeAttributesClassName:
-                            description: |-
-                              volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
-                              If specified, the CSI driver will create or update the volume with the attributes defined
-                              in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                              it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                              will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                              If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                              will be set by the persistentvolume controller if it exists.
-                              If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
-                              set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
-                              exists.
-                              More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                              (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
-                            type: string
-                          volumeMode:
-                            description: |-
-                              volumeMode defines what type of volume is required by the claim.
-                              Value of Filesystem is implied when not included in claim spec.
-                            type: string
-                          volumeName:
-                            description: volumeName is the binding reference to the
-                              PersistentVolume backing this claim.
-                            type: string
-                        type: object
-                      status:
-                        description: |-
-                          Status represents the current information/status of a persistent volume claim.
-                          Read-only.
-                          More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
-                        properties:
-                          accessModes:
-                            description: |-
-                              accessModes contains the actual access modes the volume backing the PVC has.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                            items:
-                              type: string
-                            type: array
-                            x-kubernetes-list-type: atomic
-                          allocatedResourceStatuses:
-                            additionalProperties:
-                              description: |-
-                                When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource
-                                that it does not recognizes, then it should ignore that update and let other controllers
-                                handle it.
-                              type: string
-                            description: "allocatedResourceStatuses stores status
-                              of resource being resized for the given PVC.\nKey names
-                              follow standard Kubernetes label syntax. Valid values
-                              are either:\n\t* Un-prefixed keys:\n\t\t- storage -
-                              the capacity of the volume.\n\t* Custom resources must
-                              use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart
-                              from above values - keys that are unprefixed or have
-                              kubernetes.io prefix are considered\nreserved and hence
-                              may not be used.\n\nClaimResourceStatus can be in any
-                              of following states:\n\t- ControllerResizeInProgress:\n\t\tState
-                              set when resize controller starts resizing the volume
-                              in control-plane.\n\t- ControllerResizeFailed:\n\t\tState
-                              set when resize has failed in resize controller with
-                              a terminal error.\n\t- NodeResizePending:\n\t\tState
-                              set when resize controller has finished resizing the
-                              volume but further resizing of\n\t\tvolume is needed
-                              on the node.\n\t- NodeResizeInProgress:\n\t\tState set
-                              when kubelet starts resizing the volume.\n\t- NodeResizeFailed:\n\t\tState
-                              set when resizing has failed in kubelet with a terminal
-                              error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor
-                              example: if expanding a PVC for more capacity - this
-                              field can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage']
-                              = \"ControllerResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                              = \"ControllerResizeFailed\"\n     - pvc.status.allocatedResourceStatus['storage']
-                              = \"NodeResizePending\"\n     - pvc.status.allocatedResourceStatus['storage']
-                              = \"NodeResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                              = \"NodeResizeFailed\"\nWhen this field is not set,
-                              it means that no resize operation is in progress for
-                              the given PVC.\n\nA controller that receives PVC update
-                              with previously unknown resourceName or ClaimResourceStatus\nshould
-                              ignore the update for the purpose it was designed. For
-                              example - a controller that\nonly is responsible for
-                              resizing capacity of the volume, should ignore PVC updates
-                              that change other valid\nresources associated with PVC.\n\nThis
-                              is an alpha field and requires enabling RecoverVolumeExpansionFailure
-                              feature."
-                            type: object
-                            x-kubernetes-map-type: granular
-                          allocatedResources:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: "allocatedResources tracks the resources
-                              allocated to a PVC including its capacity.\nKey names
-                              follow standard Kubernetes label syntax. Valid values
-                              are either:\n\t* Un-prefixed keys:\n\t\t- storage -
-                              the capacity of the volume.\n\t* Custom resources must
-                              use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart
-                              from above values - keys that are unprefixed or have
-                              kubernetes.io prefix are considered\nreserved and hence
-                              may not be used.\n\nCapacity reported here may be larger
-                              than the actual capacity when a volume expansion operation\nis
-                              requested.\nFor storage quota, the larger value from
-                              allocatedResources and PVC.spec.resources is used.\nIf
-                              allocatedResources is not set, PVC.spec.resources alone
-                              is used for quota calculation.\nIf a volume expansion
-                              capacity request is lowered, allocatedResources is only\nlowered
-                              if there are no expansion operations in progress and
-                              if the actual volume capacity\nis equal or lower than
-                              the requested capacity.\n\nA controller that receives
-                              PVC update with previously unknown resourceName\nshould
-                              ignore the update for the purpose it was designed. For
-                              example - a controller that\nonly is responsible for
-                              resizing capacity of the volume, should ignore PVC updates
-                              that change other valid\nresources associated with PVC.\n\nThis
-                              is an alpha field and requires enabling RecoverVolumeExpansionFailure
-                              feature."
-                            type: object
-                          capacity:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: capacity represents the actual resources
-                              of the underlying volume.
-                            type: object
-                          conditions:
-                            description: |-
-                              conditions is the current Condition of persistent volume claim. If underlying persistent volume is being
-                              resized then the Condition will be set to 'Resizing'.
-                            items:
-                              description: PersistentVolumeClaimCondition contains
-                                details about state of pvc
-                              properties:
-                                lastProbeTime:
-                                  description: lastProbeTime is the time we probed
-                                    the condition.
-                                  format: date-time
-                                  type: string
-                                lastTransitionTime:
-                                  description: lastTransitionTime is the time the
-                                    condition transitioned from one status to another.
-                                  format: date-time
-                                  type: string
-                                message:
-                                  description: message is the human-readable message
-                                    indicating details about last transition.
-                                  type: string
-                                reason:
-                                  description: |-
-                                    reason is a unique, this should be a short, machine understandable string that gives the reason
-                                    for condition's last transition. If it reports "Resizing" that means the underlying
-                                    persistent volume is being resized.
-                                  type: string
-                                status:
-                                  description: |-
-                                    Status is the status of the condition.
-                                    Can be True, False, Unknown.
-                                    More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required
-                                  type: string
-                                type:
-                                  description: |-
-                                    Type is the type of the condition.
-                                    More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about
-                                  type: string
-                              required:
-                              - status
-                              - type
-                              type: object
-                            type: array
-                            x-kubernetes-list-map-keys:
-                            - type
-                            x-kubernetes-list-type: map
-                          currentVolumeAttributesClassName:
-                            description: |-
-                              currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
-                              When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                              This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
-                            type: string
-                          modifyVolumeStatus:
-                            description: |-
-                              ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
-                              When this is unset, there is no ModifyVolume operation being attempted.
-                              This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
-                            properties:
-                              status:
-                                description: "status is the status of the ControllerModifyVolume
-                                  operation. It can be in any of following states:\n
-                                  - Pending\n   Pending indicates that the PersistentVolumeClaim
-                                  cannot be modified due to unmet requirements, such
-                                  as\n   the specified VolumeAttributesClass not existing.\n
-                                  - InProgress\n   InProgress indicates that the volume
-                                  is being modified.\n - Infeasible\n  Infeasible
-                                  indicates that the request has been rejected as
-                                  invalid by the CSI driver. To\n\t  resolve the error,
-                                  a valid VolumeAttributesClass needs to be specified.\nNote:
-                                  New statuses can be added in the future. Consumers
-                                  should check for unknown statuses and fail appropriately."
-                                type: string
-                              targetVolumeAttributesClassName:
-                                description: targetVolumeAttributesClassName is the
-                                  name of the VolumeAttributesClass the PVC currently
-                                  being reconciled
-                                type: string
-                            required:
-                            - status
-                            type: object
-                          phase:
-                            description: phase represents the current phase of PersistentVolumeClaim.
-                            type: string
-                        type: object
-                    type: object
-                type: object
-              templates:
-                description: |-
-                  Templates is a list of ConfigMap key references for ConfigMaps in the same namespace as the VMAlertmanager
-                  object, which shall be mounted into the VMAlertmanager Pods.
-                  The Templates are mounted into /etc/vm/templates/<configmap-name>/<configmap-key>.
-                items:
-                  description: ConfigMapKeyReference refers to a key in a ConfigMap.
-                  properties:
-                    key:
-                      description: The ConfigMap key to refer to.
-                      type: string
-                    name:
-                      default: ""
-                      description: |-
-                        Name of the referent.
-                        This field is effectively required, but due to backwards compatibility is
-                        allowed to be empty. Instances of this type with an empty value here are
-                        almost certainly wrong.
-                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                      type: string
-                  required:
-                  - key
-                  type: object
-                  x-kubernetes-map-type: atomic
-                type: array
-              terminationGracePeriodSeconds:
-                description: TerminationGracePeriodSeconds period for container graceful
-                  termination
-                format: int64
-                type: integer
-              tolerations:
-                description: Tolerations If specified, the pod's tolerations.
-                items:
-                  description: |-
-                    The pod this Toleration is attached to tolerates any taint that matches
-                    the triple <key,value,effect> using the matching operator <operator>.
-                  properties:
-                    effect:
-                      description: |-
-                        Effect indicates the taint effect to match. Empty means match all taint effects.
-                        When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                      type: string
-                    key:
-                      description: |-
-                        Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                        If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                      type: string
-                    operator:
-                      description: |-
-                        Operator represents a key's relationship to the value.
-                        Valid operators are Exists and Equal. Defaults to Equal.
-                        Exists is equivalent to wildcard for value, so that a pod can
-                        tolerate all taints of a particular category.
-                      type: string
-                    tolerationSeconds:
-                      description: |-
-                        TolerationSeconds represents the period of time the toleration (which must be
-                        of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                        it is not set, which means tolerate the taint forever (do not evict). Zero and
-                        negative values will be treated as 0 (evict immediately) by the system.
-                      format: int64
-                      type: integer
-                    value:
-                      description: |-
-                        Value is the taint value the toleration matches to.
-                        If the operator is Exists, the value should be empty, otherwise just a regular string.
-                      type: string
-                  type: object
-                type: array
-              topologySpreadConstraints:
-                description: |-
-                  TopologySpreadConstraints embedded kubernetes pod configuration option,
-                  controls how pods are spread across your cluster among failure-domains
-                  such as regions, zones, nodes, and other user-defined topology domains
-                  https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
-                items:
-                  description: TopologySpreadConstraint specifies how to spread matching
-                    pods among the given topology.
-                  required:
-                  - maxSkew
-                  - topologyKey
-                  - whenUnsatisfiable
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              useDefaultResources:
-                description: |-
-                  UseDefaultResources controls resource settings
-                  By default, operator sets built-in resource requirements
-                type: boolean
-              useStrictSecurity:
-                description: |-
-                  UseStrictSecurity enables strict security mode for component
-                  it restricts disk writes access
-                  uses non-root user out of the box
-                  drops not needed security permissions
-                type: boolean
-              useVMConfigReloader:
-                description: |-
-                  UseVMConfigReloader replaces prometheus-like config-reloader
-                  with vm one. It uses secrets watch instead of file watch
-                  which greatly increases speed of config updates
-                type: boolean
-              volumeMounts:
-                description: |-
-                  VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
-                  VolumeMounts specified will be appended to other VolumeMounts in the Application container
-                items:
-                  description: VolumeMount describes a mounting of a Volume within
-                    a container.
-                  properties:
-                    mountPath:
-                      description: |-
-                        Path within the container at which the volume should be mounted.  Must
-                        not contain ':'.
-                      type: string
-                    mountPropagation:
-                      description: |-
-                        mountPropagation determines how mounts are propagated from the host
-                        to container and the other way around.
-                        When not set, MountPropagationNone is used.
-                        This field is beta in 1.10.
-                        When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                        (which defaults to None).
-                      type: string
-                    name:
-                      description: This must match the Name of a Volume.
-                      type: string
-                    readOnly:
-                      description: |-
-                        Mounted read-only if true, read-write otherwise (false or unspecified).
-                        Defaults to false.
-                      type: boolean
-                    recursiveReadOnly:
-                      description: |-
-                        RecursiveReadOnly specifies whether read-only mounts should be handled
-                        recursively.
-
-                        If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                        If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                        recursively read-only.  If this field is set to IfPossible, the mount is made
-                        recursively read-only, if it is supported by the container runtime.  If this
-                        field is set to Enabled, the mount is made recursively read-only if it is
-                        supported by the container runtime, otherwise the pod will not be started and
-                        an error will be generated to indicate the reason.
-
-                        If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                        None (or be unspecified, which defaults to None).
-
-                        If this field is not specified, it is treated as an equivalent of Disabled.
-                      type: string
-                    subPath:
-                      description: |-
-                        Path within the volume from which the container's volume should be mounted.
-                        Defaults to "" (volume's root).
-                      type: string
-                    subPathExpr:
-                      description: |-
-                        Expanded path within the volume from which the container's volume should be mounted.
-                        Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                        Defaults to "" (volume's root).
-                        SubPathExpr and SubPath are mutually exclusive.
-                      type: string
-                  required:
-                  - mountPath
-                  - name
-                  type: object
-                type: array
-              volumes:
-                description: |-
-                  Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
-                  Volumes specified will be appended to other volumes that are generated.
-                  / +optional
-                items:
-                  description: Volume represents a named volume in a pod that may
-                    be accessed by any container in the pod.
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              webConfig:
-                description: |-
-                  WebConfig defines configuration for webserver
-                  https://github.com/prometheus/alertmanager/blob/main/docs/https.md
-                properties:
-                  basic_auth_users:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      BasicAuthUsers Usernames and hashed passwords that have full access to the web server
-                      Passwords must be hashed with bcrypt
-                    type: object
-                  http_server_config:
-                    description: HTTPServerConfig defines http server configuration
-                      for alertmanager web server
-                    properties:
-                      headers:
-                        additionalProperties:
-                          type: string
-                        description: Headers defines list of headers that can be added
-                          to HTTP responses.
-                        type: object
-                      http2:
-                        description: |-
-                          HTTP2 enables HTTP/2 support. Note that HTTP/2 is only supported with TLS.
-                          This can not be changed on the fly.
-                        type: boolean
-                    type: object
-                  tls_server_config:
-                    description: TLSServerConfig defines server TLS configuration
-                      for alertmanager
-                    properties:
-                      cert_file:
-                        description: |-
-                          CertFile defines path to the pre-mounted file with certificate
-                          mutually exclusive with CertSecretRef
-                        type: string
-                      cert_secret_ref:
-                        description: |-
-                          CertSecretRef defines reference for secret with certificate content under given key
-                          mutually exclusive with CertFile
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      cipher_suites:
-                        description: |-
-                          CipherSuites defines list of supported cipher suites for TLS versions up to TLS 1.2
-                          https://golang.org/pkg/crypto/tls/#pkg-constants
-                        items:
-                          type: string
-                        type: array
-                      client_auth_type:
-                        description: |-
-                          Cert defines reference for secret with CA content under given key
-                          mutually exclusive with CertFile
-                          ClientAuthType defines server policy for client authentication
-                          If you want to enable client authentication (aka mTLS), you need to use RequireAndVerifyClientCert
-                          Note, mTLS is supported only at enterprise version of VictoriaMetrics components
-                        enum:
-                        - NoClientCert
-                        - RequireAndVerifyClientCert
-                        type: string
-                      client_ca_file:
-                        description: |-
-                          ClientCAFile defines path to the pre-mounted file with CA
-                          mutually exclusive with ClientCASecretRef
-                        type: string
-                      client_ca_secret_ref:
-                        description: |-
-                          ClientCASecretRef defines reference for secret with CA content under given key
-                          mutually exclusive with ClientCAFile
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      curve_preferences:
-                        description: |-
-                          CurvePreferences defines elliptic curves that will be used in an ECDHE handshake, in preference order.
-                          https://golang.org/pkg/crypto/tls/#CurveID
-                        items:
-                          type: string
-                        type: array
-                      key_file:
-                        description: |-
-                          KeyFile defines path to the pre-mounted file with certificate key
-                          mutually exclusive with KeySecretRef
-                        type: string
-                      key_secret_ref:
-                        description: |-
-                          Key defines reference for secret with certificate key content under given key
-                          mutually exclusive with KeyFile
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      max_version:
-                        description: MaxVersion maximum TLS version that is acceptable.
-                        enum:
-                        - TLS10
-                        - TLS11
-                        - TLS12
-                        - TLS13
-                        type: string
-                      min_version:
-                        description: MinVersion minimum TLS version that is acceptable.
-                        enum:
-                        - TLS10
-                        - TLS11
-                        - TLS12
-                        - TLS13
-                        type: string
-                      prefer_server_cipher_suites:
-                        description: |-
-                          PreferServerCipherSuites controls whether the server selects the
-                          client's most preferred ciphersuite
-                        type: boolean
-                    type: object
-                type: object
             type: object
+            x-kubernetes-preserve-unknown-fields: true
           status:
-            description: |-
-              Most recent observed status of the VMAlertmanager cluster.
-              Operator API itself. More info:
-              https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -12639,16 +690,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         required:
@@ -12663,7 +709,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmalerts.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -12679,7 +725,7 @@ spec:
       jsonPath: .status.updateStatus
       name: Status
       type: string
-    - description: The desired replicas number of Alertmanagers
+    - description: The desired replicas number of VMAlerts
       jsonPath: .spec.replicaCount
       name: ReplicaCount
       type: integer
@@ -12689,1924 +735,47 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: VMAlert  executes a list of given alerting or recording rules
-          against configured address.
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMAlertSpec defines the desired state of VMAlert
-            properties:
-              affinity:
-                description: Affinity If specified, the pod's scheduling constraints.
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              configMaps:
-                description: |-
-                  ConfigMaps is a list of ConfigMaps in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/configs/CONFIGMAP_NAME folder
-                items:
-                  type: string
-                type: array
-              configReloaderExtraArgs:
-                additionalProperties:
-                  type: string
-                description: |-
-                  ConfigReloaderExtraArgs that will be passed to  VMAuths config-reloader container
-                  for example resyncInterval: "30s"
-                type: object
-              configReloaderImageTag:
-                description: ConfigReloaderImageTag defines image:tag for config-reloader
-                  container
-                type: string
-              configReloaderResources:
-                description: |-
-                  ConfigReloaderResources config-reloader container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
-                properties:
-                  claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
-                    items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
-                      properties:
-                        name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
-                          type: string
-                        request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
-                          type: string
-                      required:
-                      - name
-                      type: object
-                    type: array
-                    x-kubernetes-list-map-keys:
-                    - name
-                    x-kubernetes-list-type: map
-                  limits:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                  requests:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                type: object
-              containers:
-                description: |-
-                  Containers property allows to inject additions sidecars or to patch existing containers.
-                  It can be useful for proxies, backup, etc.
-                items:
-                  description: A single application container that you want to run
-                    within a pod.
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              datasource:
-                description: Datasource Victoria Metrics or VMSelect url. Required
-                  parameter. e.g. http://127.0.0.1:8428
-                properties:
-                  basicAuth:
-                    description: BasicAuth allow an endpoint to authenticate over
-                      basic authentication
-                    properties:
-                      password:
-                        description: |-
-                          Password defines reference for secret with password value
-                          The secret needs to be in the same namespace as scrape object
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      password_file:
-                        description: |-
-                          PasswordFile defines path to password file at disk
-                          must be pre-mounted
-                        type: string
-                      username:
-                        description: |-
-                          Username defines reference for secret with username value
-                          The secret needs to be in the same namespace as scrape object
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  bearerTokenFile:
-                    description: Path to bearer token file
-                    type: string
-                  bearerTokenSecret:
-                    description: Optional bearer auth token to use for -remoteWrite.url
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  headers:
-                    description: |-
-                      Headers allow configuring custom http headers
-                      Must be in form of semicolon separated header with value
-                      e.g.
-                      headerName:headerValue
-                      vmalert supports it since 1.79.0 version
-                    items:
-                      type: string
-                    type: array
-                  oauth2:
-                    description: OAuth2 defines OAuth2 configuration
-                    required:
-                    - client_id
-                    - token_url
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  tlsConfig:
-                    description: TLSConfig specifies TLSConfig configuration parameters.
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  url:
-                    description: Victoria Metrics or VMSelect url. Required parameter.
-                      E.g. http://127.0.0.1:8428
-                    type: string
-                required:
-                - url
-                type: object
-              disableAutomountServiceAccountToken:
-                description: |-
-                  DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
-                  Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
-                  For example, vmagent and vm-config-reloader requires k8s API access.
-                  Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
-                  And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
-                type: boolean
-              disableSelfServiceScrape:
-                description: |-
-                  DisableSelfServiceScrape controls creation of VMServiceScrape by operator
-                  for the application.
-                  Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable
-                type: boolean
-              dnsConfig:
-                description: |-
-                  Specifies the DNS parameters of a pod.
-                  Parameters specified here will be merged to the generated DNS
-                  configuration based on DNSPolicy.
-                items:
-                  x-kubernetes-preserve-unknown-fields: true
-                properties:
-                  nameservers:
-                    description: |-
-                      A list of DNS name server IP addresses.
-                      This will be appended to the base nameservers generated from DNSPolicy.
-                      Duplicated nameservers will be removed.
-                    items:
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  options:
-                    description: |-
-                      A list of DNS resolver options.
-                      This will be merged with the base options generated from DNSPolicy.
-                      Duplicated entries will be removed. Resolution options given in Options
-                      will override those that appear in the base DNSPolicy.
-                    items:
-                      description: PodDNSConfigOption defines DNS resolver options
-                        of a pod.
-                      properties:
-                        name:
-                          description: |-
-                            Name is this DNS resolver option's name.
-                            Required.
-                          type: string
-                        value:
-                          description: Value is this DNS resolver option's value.
-                          type: string
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  searches:
-                    description: |-
-                      A list of DNS search domains for host-name lookup.
-                      This will be appended to the base search paths generated from DNSPolicy.
-                      Duplicated search paths will be removed.
-                    items:
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: atomic
-                type: object
-              dnsPolicy:
-                description: DNSPolicy sets DNS policy for the pod
-                type: string
-              enforcedNamespaceLabel:
-                description: |-
-                  EnforcedNamespaceLabel enforces adding a namespace label of origin for each alert
-                  and metric that is user created. The label value will always be the namespace of the object that is
-                  being created.
-                type: string
-              evaluationInterval:
-                description: EvaluationInterval defines how often to evaluate rules
-                  by default
-                pattern: '[0-9]+(ms|s|m|h)'
-                type: string
-              externalLabels:
-                additionalProperties:
-                  type: string
-                description: 'ExternalLabels in the form ''name: value'' to add to
-                  all generated recording rules and alerts.'
-                type: object
-              extraArgs:
-                additionalProperties:
-                  type: string
-                description: |-
-                  ExtraArgs that will be passed to the application container
-                  for example remoteWrite.tmpDataPath: /tmp
-                type: object
-              extraEnvs:
-                description: ExtraEnvs that will be passed to the application container
-                items:
-                  description: EnvVar represents an environment variable present in
-                    a Container.
-                  properties:
-                    name:
-                      description: Name of the environment variable. Must be a C_IDENTIFIER.
-                      type: string
-                    value:
-                      description: |-
-                        Variable references $(VAR_NAME) are expanded
-                        using the previously defined environment variables in the container and
-                        any service environment variables. If a variable cannot be resolved,
-                        the reference in the input string will be unchanged. Double $$ are reduced
-                        to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                        "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                        Escaped references will never be expanded, regardless of whether the variable
-                        exists or not.
-                        Defaults to "".
-                      type: string
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              extraEnvsFrom:
-                description: |-
-                  ExtraEnvsFrom defines source of env variables for the application container
-                  could either be secret or configmap
-                items:
-                  description: EnvFromSource represents the source of a set of ConfigMaps
-                  properties:
-                    configMapRef:
-                      description: The ConfigMap to select from
-                      properties:
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the ConfigMap must be defined
-                          type: boolean
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    prefix:
-                      description: An optional identifier to prepend to each key in
-                        the ConfigMap. Must be a C_IDENTIFIER.
-                      type: string
-                    secretRef:
-                      description: The Secret to select from
-                      properties:
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the Secret must be defined
-                          type: boolean
-                      type: object
-                      x-kubernetes-map-type: atomic
-                  type: object
-                type: array
-              host_aliases:
-                description: |-
-                  HostAliasesUnderScore provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
-                  Has Priority over hostAliases field
-                items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
-                  properties:
-                    hostnames:
-                      description: Hostnames for the above IP address.
-                      items:
-                        type: string
-                      type: array
-                      x-kubernetes-list-type: atomic
-                    ip:
-                      description: IP address of the host file entry.
-                      type: string
-                  required:
-                  - ip
-                  type: object
-                type: array
-              hostAliases:
-                description: |-
-                  HostAliases provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
-                items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
-                  properties:
-                    hostnames:
-                      description: Hostnames for the above IP address.
-                      items:
-                        type: string
-                      type: array
-                      x-kubernetes-list-type: atomic
-                    ip:
-                      description: IP address of the host file entry.
-                      type: string
-                  required:
-                  - ip
-                  type: object
-                type: array
-              hostNetwork:
-                description: HostNetwork controls whether the pod may use the node
-                  network namespace
-                type: boolean
-              image:
-                description: |-
-                  Image - docker image settings
-                  if no specified operator uses default version from operator config
-                properties:
-                  pullPolicy:
-                    description: PullPolicy describes how to pull docker image
-                    type: string
-                  repository:
-                    description: Repository contains name of docker image + it's repository
-                      if needed
-                    type: string
-                  tag:
-                    description: Tag contains desired docker image version
-                    type: string
-                type: object
-              imagePullSecrets:
-                description: |-
-                  ImagePullSecrets An optional list of references to secrets in the same namespace
-                  to use for pulling images from registries
-                  see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
-                items:
-                  description: |-
-                    LocalObjectReference contains enough information to let you locate the
-                    referenced object inside the same namespace.
-                  properties:
-                    name:
-                      default: ""
-                      description: |-
-                        Name of the referent.
-                        This field is effectively required, but due to backwards compatibility is
-                        allowed to be empty. Instances of this type with an empty value here are
-                        almost certainly wrong.
-                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                      type: string
-                  type: object
-                  x-kubernetes-map-type: atomic
-                type: array
-              initContainers:
-                description: |-
-                  InitContainers allows adding initContainers to the pod definition.
-                  Any errors during the execution of an initContainer will lead to a restart of the Pod.
-                  More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
-                items:
-                  description: A single application container that you want to run
-                    within a pod.
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              license:
-                description: |-
-                  License allows to configure license key to be used for enterprise features.
-                  Using license key is supported starting from VictoriaMetrics v1.94.0.
-                  See [here](https://docs.victoriametrics.com/enterprise)
-                properties:
-                  forceOffline:
-                    description: Enforce offline verification of the license key.
-                    type: boolean
-                  key:
-                    description: |-
-                      Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise).
-                      To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial)
-                    type: string
-                  keyRef:
-                    description: KeyRef is reference to secret with license key for
-                      enterprise features.
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  reloadInterval:
-                    description: Interval to be used for checking for license key
-                      changes. Note that this is only applicable when using KeyRef.
-                    type: string
-                type: object
-              livenessProbe:
-                description: LivenessProbe that will be added CRD pod
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              logFormat:
-                description: |-
-                  LogFormat for VMAlert to be configured with.
-                  default or json
-                enum:
-                - default
-                - json
-                type: string
-              logLevel:
-                description: LogLevel for VMAlert to be configured with.
-                enum:
-                - INFO
-                - WARN
-                - ERROR
-                - FATAL
-                - PANIC
-                type: string
-              managedMetadata:
-                description: |-
-                  ManagedMetadata defines metadata that will be added to the all objects
-                  created by operator for the given CustomResource
-                properties:
-                  annotations:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                    type: object
-                  labels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                    type: object
-                type: object
-              minReadySeconds:
-                description: |-
-                  MinReadySeconds defines a minimum number of seconds to wait before starting update next pod
-                  if previous in healthy state
-                  Has no effect for VLogs and VMSingle
-                format: int32
-                type: integer
-              nodeSelector:
-                additionalProperties:
-                  type: string
-                description: NodeSelector Define which Nodes the Pods are scheduled
-                  on.
-                type: object
-              notifier:
-                description: |-
-                  Notifier prometheus alertmanager endpoint spec. Required at least one of notifier or notifiers when there are alerting rules. e.g. http://127.0.0.1:9093
-                  If specified both notifier and notifiers, notifier will be added as last element to notifiers.
-                  only one of notifier options could be chosen: notifierConfigRef or notifiers +  notifier
-                properties:
-                  basicAuth:
-                    description: BasicAuth allow an endpoint to authenticate over
-                      basic authentication
-                    properties:
-                      password:
-                        description: |-
-                          Password defines reference for secret with password value
-                          The secret needs to be in the same namespace as scrape object
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      password_file:
-                        description: |-
-                          PasswordFile defines path to password file at disk
-                          must be pre-mounted
-                        type: string
-                      username:
-                        description: |-
-                          Username defines reference for secret with username value
-                          The secret needs to be in the same namespace as scrape object
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  bearerTokenFile:
-                    description: Path to bearer token file
-                    type: string
-                  bearerTokenSecret:
-                    description: Optional bearer auth token to use for -remoteWrite.url
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  headers:
-                    description: |-
-                      Headers allow configuring custom http headers
-                      Must be in form of semicolon separated header with value
-                      e.g.
-                      headerName:headerValue
-                      vmalert supports it since 1.79.0 version
-                    items:
-                      type: string
-                    type: array
-                  oauth2:
-                    description: OAuth2 defines OAuth2 configuration
-                    required:
-                    - client_id
-                    - token_url
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  selector:
-                    description: |-
-                      Selector allows service discovery for alertmanager
-                      in this case all matched vmalertmanager replicas will be added into vmalert notifier.url
-                      as statefulset pod.fqdn
-                    properties:
-                      labelSelector:
-                        description: |-
-                          A label selector is a label query over a set of resources. The result of matchLabels and
-                          matchExpressions are ANDed. An empty label selector matches all objects. A null
-                          label selector matches no objects.
-                        properties:
-                          matchExpressions:
-                            description: matchExpressions is a list of label selector
-                              requirements. The requirements are ANDed.
-                            items:
-                              description: |-
-                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                relates the key and values.
-                              properties:
-                                key:
-                                  description: key is the label key that the selector
-                                    applies to.
-                                  type: string
-                                operator:
-                                  description: |-
-                                    operator represents a key's relationship to a set of values.
-                                    Valid operators are In, NotIn, Exists and DoesNotExist.
-                                  type: string
-                                values:
-                                  description: |-
-                                    values is an array of string values. If the operator is In or NotIn,
-                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                    the values array must be empty. This array is replaced during a strategic
-                                    merge patch.
-                                  items:
-                                    type: string
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                              required:
-                              - key
-                              - operator
-                              type: object
-                            type: array
-                            x-kubernetes-list-type: atomic
-                          matchLabels:
-                            additionalProperties:
-                              type: string
-                            description: |-
-                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                              operator is "In", and the values array contains only "value". The requirements are ANDed.
-                            type: object
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      namespaceSelector:
-                        description: |-
-                          NamespaceSelector is a selector for selecting either all namespaces or a
-                          list of namespaces.
-                        properties:
-                          any:
-                            description: |-
-                              Boolean describing whether all namespaces are selected in contrast to a
-                              list restricting them.
-                            type: boolean
-                          matchNames:
-                            description: List of namespace names.
-                            items:
-                              type: string
-                            type: array
-                        type: object
-                    type: object
-                  tlsConfig:
-                    description: TLSConfig specifies TLSConfig configuration parameters.
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  url:
-                    description: AlertManager url.  E.g. http://127.0.0.1:9093
-                    type: string
-                type: object
-              notifierConfigRef:
-                description: |-
-                  NotifierConfigRef reference for secret with notifier configuration for vmalert
-                  only one of notifier options could be chosen: notifierConfigRef or notifiers +  notifier
-                properties:
-                  key:
-                    description: The key of the secret to select from.  Must be a
-                      valid secret key.
-                    type: string
-                  name:
-                    default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                    type: string
-                  optional:
-                    description: Specify whether the Secret or its key must be defined
-                    type: boolean
-                required:
-                - key
-                type: object
-                x-kubernetes-map-type: atomic
-              notifiers:
-                description: |-
-                  Notifiers prometheus alertmanager endpoints. Required at least one of notifier or notifiers when there are alerting rules. e.g. http://127.0.0.1:9093
-                  If specified both notifier and notifiers, notifier will be added as last element to notifiers.
-                  only one of notifier options could be chosen: notifierConfigRef or notifiers +  notifier
-                items:
-                  description: VMAlertNotifierSpec defines the notifier url for sending
-                    information about alerts
-                  properties:
-                    basicAuth:
-                      description: BasicAuth allow an endpoint to authenticate over
-                        basic authentication
-                      properties:
-                        password:
-                          description: |-
-                            Password defines reference for secret with password value
-                            The secret needs to be in the same namespace as scrape object
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        password_file:
-                          description: |-
-                            PasswordFile defines path to password file at disk
-                            must be pre-mounted
-                          type: string
-                        username:
-                          description: |-
-                            Username defines reference for secret with username value
-                            The secret needs to be in the same namespace as scrape object
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                      type: object
-                    bearerTokenFile:
-                      description: Path to bearer token file
-                      type: string
-                    bearerTokenSecret:
-                      description: Optional bearer auth token to use for -remoteWrite.url
-                      properties:
-                        key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
-                          type: string
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
-                          type: boolean
-                      required:
-                      - key
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    headers:
-                      description: |-
-                        Headers allow configuring custom http headers
-                        Must be in form of semicolon separated header with value
-                        e.g.
-                        headerName:headerValue
-                        vmalert supports it since 1.79.0 version
-                      items:
-                        type: string
-                      type: array
-                    oauth2:
-                      description: OAuth2 defines OAuth2 configuration
-                      required:
-                      - client_id
-                      - token_url
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    selector:
-                      description: |-
-                        Selector allows service discovery for alertmanager
-                        in this case all matched vmalertmanager replicas will be added into vmalert notifier.url
-                        as statefulset pod.fqdn
-                      properties:
-                        labelSelector:
-                          description: |-
-                            A label selector is a label query over a set of resources. The result of matchLabels and
-                            matchExpressions are ANDed. An empty label selector matches all objects. A null
-                            label selector matches no objects.
-                          properties:
-                            matchExpressions:
-                              description: matchExpressions is a list of label selector
-                                requirements. The requirements are ANDed.
-                              items:
-                                description: |-
-                                  A label selector requirement is a selector that contains values, a key, and an operator that
-                                  relates the key and values.
-                                properties:
-                                  key:
-                                    description: key is the label key that the selector
-                                      applies to.
-                                    type: string
-                                  operator:
-                                    description: |-
-                                      operator represents a key's relationship to a set of values.
-                                      Valid operators are In, NotIn, Exists and DoesNotExist.
-                                    type: string
-                                  values:
-                                    description: |-
-                                      values is an array of string values. If the operator is In or NotIn,
-                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                      the values array must be empty. This array is replaced during a strategic
-                                      merge patch.
-                                    items:
-                                      type: string
-                                    type: array
-                                    x-kubernetes-list-type: atomic
-                                required:
-                                - key
-                                - operator
-                                type: object
-                              type: array
-                              x-kubernetes-list-type: atomic
-                            matchLabels:
-                              additionalProperties:
-                                type: string
-                              description: |-
-                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                operator is "In", and the values array contains only "value". The requirements are ANDed.
-                              type: object
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        namespaceSelector:
-                          description: |-
-                            NamespaceSelector is a selector for selecting either all namespaces or a
-                            list of namespaces.
-                          properties:
-                            any:
-                              description: |-
-                                Boolean describing whether all namespaces are selected in contrast to a
-                                list restricting them.
-                              type: boolean
-                            matchNames:
-                              description: List of namespace names.
-                              items:
-                                type: string
-                              type: array
-                          type: object
-                      type: object
-                    tlsConfig:
-                      description: TLSConfig specifies TLSConfig configuration parameters.
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    url:
-                      description: AlertManager url.  E.g. http://127.0.0.1:9093
-                      type: string
-                  type: object
-                type: array
-              paused:
-                description: |-
-                  Paused If set to true all actions on the underlying managed objects are not
-                  going to be performed, except for delete actions.
-                type: boolean
-              podDisruptionBudget:
-                description: PodDisruptionBudget created by operator
-                properties:
-                  maxUnavailable:
-                    anyOf:
-                    - type: integer
-                    - type: string
-                    description: |-
-                      An eviction is allowed if at most "maxUnavailable" pods selected by
-                      "selector" are unavailable after the eviction, i.e. even in absence of
-                      the evicted pod. For example, one can prevent all voluntary evictions
-                      by specifying 0. This is a mutually exclusive setting with "minAvailable".
-                    x-kubernetes-int-or-string: true
-                  minAvailable:
-                    anyOf:
-                    - type: integer
-                    - type: string
-                    description: |-
-                      An eviction is allowed if at least "minAvailable" pods selected by
-                      "selector" will still be available after the eviction, i.e. even in the
-                      absence of the evicted pod.  So for example you can prevent all voluntary
-                      evictions by specifying "100%".
-                    x-kubernetes-int-or-string: true
-                  selectorLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      replaces default labels selector generated by operator
-                      it's useful when you need to create custom budget
-                    type: object
-                type: object
-              podMetadata:
-                description: PodMetadata configures Labels and Annotations which are
-                  propagated to the VMAlert pods.
-                properties:
-                  annotations:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                    type: object
-                  labels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects. May match selectors of replication controllers
-                      and services.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                    type: object
-                  name:
-                    description: |-
-                      Name must be unique within a namespace. Is required when creating resources, although
-                      some resources may allow a client to request the generation of an appropriate name
-                      automatically. Name is primarily intended for creation idempotence and configuration
-                      definition.
-                      Cannot be updated.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                    type: string
-                type: object
-              port:
-                description: Port listen address
-                type: string
-              priorityClassName:
-                description: PriorityClassName class assigned to the Pods
-                type: string
-              readinessGates:
-                description: ReadinessGates defines pod readiness gates
-                items:
-                  description: PodReadinessGate contains the reference to a pod condition
-                  properties:
-                    conditionType:
-                      description: ConditionType refers to a condition in the pod's
-                        condition list with matching type.
-                      type: string
-                  required:
-                  - conditionType
-                  type: object
-                type: array
-              readinessProbe:
-                description: ReadinessProbe that will be added CRD pod
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              remoteRead:
-                description: |-
-                  RemoteRead Optional URL to read vmalert state (persisted via RemoteWrite)
-                  This configuration only makes sense if alerts state has been successfully
-                  persisted (via RemoteWrite) before.
-                  see -remoteRead.url docs in vmalerts for details.
-                  E.g. http://127.0.0.1:8428
-                properties:
-                  basicAuth:
-                    description: BasicAuth allow an endpoint to authenticate over
-                      basic authentication
-                    properties:
-                      password:
-                        description: |-
-                          Password defines reference for secret with password value
-                          The secret needs to be in the same namespace as scrape object
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      password_file:
-                        description: |-
-                          PasswordFile defines path to password file at disk
-                          must be pre-mounted
-                        type: string
-                      username:
-                        description: |-
-                          Username defines reference for secret with username value
-                          The secret needs to be in the same namespace as scrape object
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  bearerTokenFile:
-                    description: Path to bearer token file
-                    type: string
-                  bearerTokenSecret:
-                    description: Optional bearer auth token to use for -remoteWrite.url
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  headers:
-                    description: |-
-                      Headers allow configuring custom http headers
-                      Must be in form of semicolon separated header with value
-                      e.g.
-                      headerName:headerValue
-                      vmalert supports it since 1.79.0 version
-                    items:
-                      type: string
-                    type: array
-                  lookback:
-                    description: |-
-                      Lookback defines how far to look into past for alerts timeseries. For example, if lookback=1h then range from now() to now()-1h will be scanned. (default 1h0m0s)
-                      Applied only to RemoteReadSpec
-                    type: string
-                  oauth2:
-                    description: OAuth2 defines OAuth2 configuration
-                    required:
-                    - client_id
-                    - token_url
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  tlsConfig:
-                    description: TLSConfig specifies TLSConfig configuration parameters.
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  url:
-                    description: URL of the endpoint to send samples to.
-                    type: string
-                required:
-                - url
-                type: object
-              remoteWrite:
-                description: |-
-                  RemoteWrite Optional URL to remote-write compatible storage to persist
-                  vmalert state and rule results to.
-                  Rule results will be persisted according to each rule.
-                  Alerts state will be persisted in the form of time series named ALERTS and ALERTS_FOR_STATE
-                  see -remoteWrite.url docs in vmalerts for details.
-                  E.g. http://127.0.0.1:8428
-                properties:
-                  basicAuth:
-                    description: BasicAuth allow an endpoint to authenticate over
-                      basic authentication
-                    properties:
-                      password:
-                        description: |-
-                          Password defines reference for secret with password value
-                          The secret needs to be in the same namespace as scrape object
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      password_file:
-                        description: |-
-                          PasswordFile defines path to password file at disk
-                          must be pre-mounted
-                        type: string
-                      username:
-                        description: |-
-                          Username defines reference for secret with username value
-                          The secret needs to be in the same namespace as scrape object
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  bearerTokenFile:
-                    description: Path to bearer token file
-                    type: string
-                  bearerTokenSecret:
-                    description: Optional bearer auth token to use for -remoteWrite.url
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  concurrency:
-                    description: Defines number of readers that concurrently write
-                      into remote storage (default 1)
-                    format: int32
-                    type: integer
-                  flushInterval:
-                    description: Defines interval of flushes to remote write endpoint
-                      (default 5s)
-                    pattern: '[0-9]+(ms|s|m|h)'
-                    type: string
-                  headers:
-                    description: |-
-                      Headers allow configuring custom http headers
-                      Must be in form of semicolon separated header with value
-                      e.g.
-                      headerName:headerValue
-                      vmalert supports it since 1.79.0 version
-                    items:
-                      type: string
-                    type: array
-                  maxBatchSize:
-                    description: Defines defines max number of timeseries to be flushed
-                      at once (default 1000)
-                    format: int32
-                    type: integer
-                  maxQueueSize:
-                    description: Defines the max number of pending datapoints to remote
-                      write endpoint (default 100000)
-                    format: int32
-                    type: integer
-                  oauth2:
-                    description: OAuth2 defines OAuth2 configuration
-                    required:
-                    - client_id
-                    - token_url
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  tlsConfig:
-                    description: TLSConfig specifies TLSConfig configuration parameters.
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  url:
-                    description: URL of the endpoint to send samples to.
-                    type: string
-                required:
-                - url
-                type: object
-              replicaCount:
-                description: ReplicaCount is the expected size of the Application.
-                format: int32
-                type: integer
-              resources:
-                description: |-
-                  Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
-                properties:
-                  claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
-                    items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
-                      properties:
-                        name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
-                          type: string
-                        request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
-                          type: string
-                      required:
-                      - name
-                      type: object
-                    type: array
-                    x-kubernetes-list-map-keys:
-                    - name
-                    x-kubernetes-list-type: map
-                  limits:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                  requests:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                type: object
-              revisionHistoryLimitCount:
-                description: |-
-                  The number of old ReplicaSets to retain to allow rollback in deployment or
-                  maximum number of revisions that will be maintained in the Deployment revision history.
-                  Has no effect at StatefulSets
-                  Defaults to 10.
-                format: int32
-                type: integer
-              rollingUpdate:
-                description: RollingUpdate - overrides deployment update params.
-                properties:
-                  maxSurge:
-                    anyOf:
-                    - type: integer
-                    - type: string
-                    description: |-
-                      The maximum number of pods that can be scheduled above the desired number of
-                      pods.
-                      Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
-                      This can not be 0 if MaxUnavailable is 0.
-                      Absolute number is calculated from percentage by rounding up.
-                      Defaults to 25%.
-                      Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when
-                      the rolling update starts, such that the total number of old and new pods do not exceed
-                      130% of desired pods. Once old pods have been killed,
-                      new ReplicaSet can be scaled up further, ensuring that total number of pods running
-                      at any time during the update is at most 130% of desired pods.
-                    x-kubernetes-int-or-string: true
-                  maxUnavailable:
-                    anyOf:
-                    - type: integer
-                    - type: string
-                    description: |-
-                      The maximum number of pods that can be unavailable during the update.
-                      Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
-                      Absolute number is calculated from percentage by rounding down.
-                      This can not be 0 if MaxSurge is 0.
-                      Defaults to 25%.
-                      Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods
-                      immediately when the rolling update starts. Once new pods are ready, old ReplicaSet
-                      can be scaled down further, followed by scaling up the new ReplicaSet, ensuring
-                      that the total number of pods available at all times during the update is at
-                      least 70% of desired pods.
-                    x-kubernetes-int-or-string: true
-                type: object
-              ruleNamespaceSelector:
-                description: |-
-                  RuleNamespaceSelector to be selected for VMRules discovery.
-                  Works in combination with Selector.
-                  If both nil - behaviour controlled by selectAllByDefault
-                  NamespaceSelector nil - only objects at VMAlert namespace.
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              rulePath:
-                description: |-
-                  RulePath to the file with alert rules.
-                  Supports patterns. Flag can be specified multiple times.
-                  Examples:
-                  -rule /path/to/file. Path to a single file with alerting rules
-                  -rule dir/*.yaml -rule /*.yaml. Relative path to all .yaml files in folder,
-                  absolute path to all .yaml files in root.
-                  by default operator adds /etc/vmalert/configs/base/vmalert.yaml
-                items:
-                  type: string
-                type: array
-              ruleSelector:
-                description: |-
-                  RuleSelector selector to select which VMRules to mount for loading alerting
-                  rules from.
-                  Works in combination with NamespaceSelector.
-                  If both nil - behaviour controlled by selectAllByDefault
-                  NamespaceSelector nil - only objects at VMAlert namespace.
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              runtimeClassName:
-                description: |-
-                  RuntimeClassName - defines runtime class for kubernetes pod.
-                  https://kubernetes.io/docs/concepts/containers/runtime-class/
-                type: string
-              schedulerName:
-                description: SchedulerName - defines kubernetes scheduler name
-                type: string
-              secrets:
-                description: |-
-                  Secrets is a list of Secrets in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/secrets/SECRET_NAME folder
-                items:
-                  type: string
-                type: array
-              securityContext:
-                description: |-
-                  SecurityContext holds pod-level security attributes and common container settings.
-                  This defaults to the default PodSecurityContext.
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              selectAllByDefault:
-                description: |-
-                  SelectAllByDefault changes default behavior for empty CRD selectors, such RuleSelector.
-                  with selectAllByDefault: true and empty serviceScrapeSelector and RuleNamespaceSelector
-                  Operator selects all exist serviceScrapes
-                  with selectAllByDefault: false - selects nothing
-                type: boolean
-              serviceAccountName:
-                description: ServiceAccountName is the name of the ServiceAccount
-                  to use to run the pods
-                type: string
-              serviceScrapeSpec:
-                description: ServiceScrapeSpec that will be added to vmalert VMServiceScrape
-                  spec
-                required:
-                - endpoints
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              serviceSpec:
-                description: ServiceSpec that will be added to vmalert service spec
-                properties:
-                  metadata:
-                    description: EmbeddedObjectMetadata defines objectMeta for additional
-                      service.
-                    properties:
-                      annotations:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Annotations is an unstructured key value map stored with a resource that may be
-                          set by external tools to store and retrieve arbitrary metadata. They are not
-                          queryable and should be preserved when modifying objects.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                        type: object
-                      labels:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Labels Map of string keys and values that can be used to organize and categorize
-                          (scope and select) objects. May match selectors of replication controllers
-                          and services.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                        type: object
-                      name:
-                        description: |-
-                          Name must be unique within a namespace. Is required when creating resources, although
-                          some resources may allow a client to request the generation of an appropriate name
-                          automatically. Name is primarily intended for creation idempotence and configuration
-                          definition.
-                          Cannot be updated.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                        type: string
-                    type: object
-                  spec:
-                    description: |-
-                      ServiceSpec describes the attributes that a user creates on a service.
-                      More info: https://kubernetes.io/docs/concepts/services-networking/service/
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  useAsDefault:
-                    description: |-
-                      UseAsDefault applies changes from given service definition to the main object Service
-                      Changing from headless service to clusterIP or loadbalancer may break cross-component communication
-                    type: boolean
-                required:
-                - spec
-                type: object
-              startupProbe:
-                description: StartupProbe that will be added to CRD pod
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              terminationGracePeriodSeconds:
-                description: TerminationGracePeriodSeconds period for container graceful
-                  termination
-                format: int64
-                type: integer
-              tolerations:
-                description: Tolerations If specified, the pod's tolerations.
-                items:
-                  description: |-
-                    The pod this Toleration is attached to tolerates any taint that matches
-                    the triple <key,value,effect> using the matching operator <operator>.
-                  properties:
-                    effect:
-                      description: |-
-                        Effect indicates the taint effect to match. Empty means match all taint effects.
-                        When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                      type: string
-                    key:
-                      description: |-
-                        Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                        If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                      type: string
-                    operator:
-                      description: |-
-                        Operator represents a key's relationship to the value.
-                        Valid operators are Exists and Equal. Defaults to Equal.
-                        Exists is equivalent to wildcard for value, so that a pod can
-                        tolerate all taints of a particular category.
-                      type: string
-                    tolerationSeconds:
-                      description: |-
-                        TolerationSeconds represents the period of time the toleration (which must be
-                        of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                        it is not set, which means tolerate the taint forever (do not evict). Zero and
-                        negative values will be treated as 0 (evict immediately) by the system.
-                      format: int64
-                      type: integer
-                    value:
-                      description: |-
-                        Value is the taint value the toleration matches to.
-                        If the operator is Exists, the value should be empty, otherwise just a regular string.
-                      type: string
-                  type: object
-                type: array
-              topologySpreadConstraints:
-                description: |-
-                  TopologySpreadConstraints embedded kubernetes pod configuration option,
-                  controls how pods are spread across your cluster among failure-domains
-                  such as regions, zones, nodes, and other user-defined topology domains
-                  https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
-                items:
-                  description: TopologySpreadConstraint specifies how to spread matching
-                    pods among the given topology.
-                  required:
-                  - maxSkew
-                  - topologyKey
-                  - whenUnsatisfiable
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              updateStrategy:
-                description: UpdateStrategy - overrides default update strategy.
-                enum:
-                - Recreate
-                - RollingUpdate
-                type: string
-              useDefaultResources:
-                description: |-
-                  UseDefaultResources controls resource settings
-                  By default, operator sets built-in resource requirements
-                type: boolean
-              useStrictSecurity:
-                description: |-
-                  UseStrictSecurity enables strict security mode for component
-                  it restricts disk writes access
-                  uses non-root user out of the box
-                  drops not needed security permissions
-                type: boolean
-              useVMConfigReloader:
-                description: |-
-                  UseVMConfigReloader replaces prometheus-like config-reloader
-                  with vm one. It uses secrets watch instead of file watch
-                  which greatly increases speed of config updates
-                type: boolean
-              volumeMounts:
-                description: |-
-                  VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
-                  VolumeMounts specified will be appended to other VolumeMounts in the Application container
-                items:
-                  description: VolumeMount describes a mounting of a Volume within
-                    a container.
-                  properties:
-                    mountPath:
-                      description: |-
-                        Path within the container at which the volume should be mounted.  Must
-                        not contain ':'.
-                      type: string
-                    mountPropagation:
-                      description: |-
-                        mountPropagation determines how mounts are propagated from the host
-                        to container and the other way around.
-                        When not set, MountPropagationNone is used.
-                        This field is beta in 1.10.
-                        When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                        (which defaults to None).
-                      type: string
-                    name:
-                      description: This must match the Name of a Volume.
-                      type: string
-                    readOnly:
-                      description: |-
-                        Mounted read-only if true, read-write otherwise (false or unspecified).
-                        Defaults to false.
-                      type: boolean
-                    recursiveReadOnly:
-                      description: |-
-                        RecursiveReadOnly specifies whether read-only mounts should be handled
-                        recursively.
-
-                        If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                        If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                        recursively read-only.  If this field is set to IfPossible, the mount is made
-                        recursively read-only, if it is supported by the container runtime.  If this
-                        field is set to Enabled, the mount is made recursively read-only if it is
-                        supported by the container runtime, otherwise the pod will not be started and
-                        an error will be generated to indicate the reason.
-
-                        If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                        None (or be unspecified, which defaults to None).
-
-                        If this field is not specified, it is treated as an equivalent of Disabled.
-                      type: string
-                    subPath:
-                      description: |-
-                        Path within the volume from which the container's volume should be mounted.
-                        Defaults to "" (volume's root).
-                      type: string
-                    subPathExpr:
-                      description: |-
-                        Expanded path within the volume from which the container's volume should be mounted.
-                        Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                        Defaults to "" (volume's root).
-                        SubPathExpr and SubPath are mutually exclusive.
-                      type: string
-                  required:
-                  - mountPath
-                  - name
-                  type: object
-                type: array
-              volumes:
-                description: |-
-                  Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
-                  Volumes specified will be appended to other volumes that are generated.
-                  / +optional
-                items:
-                  description: Volume represents a named volume in a pod that may
-                    be accessed by any container in the pod.
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
             required:
             - datasource
             type: object
+            x-kubernetes-preserve-unknown-fields: true
           status:
-            description: VMAlertStatus defines the observed state of VMAlert
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -14621,16 +790,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -14643,7 +807,113 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: vmanomalies.operator.victoriametrics.com
+spec:
+  group: operator.victoriametrics.com
+  names:
+    kind: VMAnomaly
+    listKind: VMAnomalyList
+    plural: vmanomalies
+    singular: vmanomaly
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: current number of shards
+      jsonPath: .status.shards
+      name: Shards Count
+      type: integer
+    - description: Current status of update rollout
+      jsonPath: .status.updateStatus
+      name: Status
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            type: string
+          kind:
+            type: string
+          metadata:
+            type: object
+          spec:
+            required:
+            - reader
+            - writer
+            type: object
+            x-kubernetes-preserve-unknown-fields: true
+          status:
+            properties:
+              conditions:
+                items:
+                  properties:
+                    lastTransitionTime:
+                      format: date-time
+                      type: string
+                    lastUpdateTime:
+                      format: date-time
+                      type: string
+                    message:
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      maxLength: 1024
+                      minLength: 1
+                      type: string
+                    status:
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      maxLength: 316
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - lastUpdateTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              observedGeneration:
+                format: int64
+                type: integer
+              reason:
+                type: string
+              shards:
+                format: int32
+                type: integer
+              updateStatus:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      scale:
+        labelSelectorPath: .status.selector
+        specReplicasPath: .spec.shardCount
+        statusReplicasPath: .status.shards
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmauths.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -14662,1659 +932,52 @@ spec:
     - jsonPath: .metadata.creationTimestamp
       name: Age
       type: date
-    - description: The desired replicas number of Alertmanagers
+    - description: The desired replicas number of VMAuth
       jsonPath: .spec.replicaCount
       name: ReplicaCount
       type: integer
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: VMAuth is the Schema for the vmauths API
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMAuthSpec defines the desired state of VMAuth
-            properties:
-              affinity:
-                description: Affinity If specified, the pod's scheduling constraints.
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              configMaps:
-                description: |-
-                  ConfigMaps is a list of ConfigMaps in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/configs/CONFIGMAP_NAME folder
-                items:
-                  type: string
-                type: array
-              configReloaderExtraArgs:
-                additionalProperties:
-                  type: string
-                description: |-
-                  ConfigReloaderExtraArgs that will be passed to  VMAuths config-reloader container
-                  for example resyncInterval: "30s"
-                type: object
-              configReloaderImageTag:
-                description: ConfigReloaderImageTag defines image:tag for config-reloader
-                  container
-                type: string
-              configReloaderResources:
-                description: |-
-                  ConfigReloaderResources config-reloader container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
-                properties:
-                  claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
-                    items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
-                      properties:
-                        name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
-                          type: string
-                        request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
-                          type: string
-                      required:
-                      - name
-                      type: object
-                    type: array
-                    x-kubernetes-list-map-keys:
-                    - name
-                    x-kubernetes-list-type: map
-                  limits:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                  requests:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                type: object
-              configSecret:
-                description: |-
-                  ConfigSecret is the name of a Kubernetes Secret in the same namespace as the
-                  VMAuth object, which contains auth configuration for vmauth,
-                  configuration must be inside secret key: config.yaml.
-                  It must be created and managed manually.
-                  If it's defined, configuration for vmauth becomes unmanaged and operator'll not create any related secrets/config-reloaders
-                  Deprecated, use externalConfig.secretRef instead
-                type: string
-              containers:
-                description: |-
-                  Containers property allows to inject additions sidecars or to patch existing containers.
-                  It can be useful for proxies, backup, etc.
-                items:
-                  description: A single application container that you want to run
-                    within a pod.
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              disableAutomountServiceAccountToken:
-                description: |-
-                  DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
-                  Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
-                  For example, vmagent and vm-config-reloader requires k8s API access.
-                  Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
-                  And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
-                type: boolean
-              disableSelfServiceScrape:
-                description: |-
-                  DisableSelfServiceScrape controls creation of VMServiceScrape by operator
-                  for the application.
-                  Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable
-                type: boolean
-              dnsConfig:
-                description: |-
-                  Specifies the DNS parameters of a pod.
-                  Parameters specified here will be merged to the generated DNS
-                  configuration based on DNSPolicy.
-                items:
-                  x-kubernetes-preserve-unknown-fields: true
-                properties:
-                  nameservers:
-                    description: |-
-                      A list of DNS name server IP addresses.
-                      This will be appended to the base nameservers generated from DNSPolicy.
-                      Duplicated nameservers will be removed.
-                    items:
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  options:
-                    description: |-
-                      A list of DNS resolver options.
-                      This will be merged with the base options generated from DNSPolicy.
-                      Duplicated entries will be removed. Resolution options given in Options
-                      will override those that appear in the base DNSPolicy.
-                    items:
-                      description: PodDNSConfigOption defines DNS resolver options
-                        of a pod.
-                      properties:
-                        name:
-                          description: |-
-                            Name is this DNS resolver option's name.
-                            Required.
-                          type: string
-                        value:
-                          description: Value is this DNS resolver option's value.
-                          type: string
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  searches:
-                    description: |-
-                      A list of DNS search domains for host-name lookup.
-                      This will be appended to the base search paths generated from DNSPolicy.
-                      Duplicated search paths will be removed.
-                    items:
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: atomic
-                type: object
-              dnsPolicy:
-                description: DNSPolicy sets DNS policy for the pod
-                type: string
-              externalConfig:
-                description: |-
-                  ExternalConfig defines a source of external VMAuth configuration.
-                  If it's defined, configuration for vmauth becomes unmanaged and operator'll not create any related secrets/config-reloaders
-                properties:
-                  localPath:
-                    description: |-
-                      LocalPath contains static path to a config, which is managed externally for cases
-                      when using secrets is not applicable, e.g.: Vault sidecar.
-                    type: string
-                  secretRef:
-                    description: SecretRef defines selector for externally managed
-                      secret which contains configuration
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                type: object
-              extraArgs:
-                additionalProperties:
-                  type: string
-                description: |-
-                  ExtraArgs that will be passed to the application container
-                  for example remoteWrite.tmpDataPath: /tmp
-                type: object
-              extraEnvs:
-                description: ExtraEnvs that will be passed to the application container
-                items:
-                  description: EnvVar represents an environment variable present in
-                    a Container.
-                  properties:
-                    name:
-                      description: Name of the environment variable. Must be a C_IDENTIFIER.
-                      type: string
-                    value:
-                      description: |-
-                        Variable references $(VAR_NAME) are expanded
-                        using the previously defined environment variables in the container and
-                        any service environment variables. If a variable cannot be resolved,
-                        the reference in the input string will be unchanged. Double $$ are reduced
-                        to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                        "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                        Escaped references will never be expanded, regardless of whether the variable
-                        exists or not.
-                        Defaults to "".
-                      type: string
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              extraEnvsFrom:
-                description: |-
-                  ExtraEnvsFrom defines source of env variables for the application container
-                  could either be secret or configmap
-                items:
-                  description: EnvFromSource represents the source of a set of ConfigMaps
-                  properties:
-                    configMapRef:
-                      description: The ConfigMap to select from
-                      properties:
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the ConfigMap must be defined
-                          type: boolean
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    prefix:
-                      description: An optional identifier to prepend to each key in
-                        the ConfigMap. Must be a C_IDENTIFIER.
-                      type: string
-                    secretRef:
-                      description: The Secret to select from
-                      properties:
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the Secret must be defined
-                          type: boolean
-                      type: object
-                      x-kubernetes-map-type: atomic
-                  type: object
-                type: array
-              host_aliases:
-                description: |-
-                  HostAliasesUnderScore provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
-                  Has Priority over hostAliases field
-                items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
-                  properties:
-                    hostnames:
-                      description: Hostnames for the above IP address.
-                      items:
-                        type: string
-                      type: array
-                      x-kubernetes-list-type: atomic
-                    ip:
-                      description: IP address of the host file entry.
-                      type: string
-                  required:
-                  - ip
-                  type: object
-                type: array
-              hostAliases:
-                description: |-
-                  HostAliases provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
-                items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
-                  properties:
-                    hostnames:
-                      description: Hostnames for the above IP address.
-                      items:
-                        type: string
-                      type: array
-                      x-kubernetes-list-type: atomic
-                    ip:
-                      description: IP address of the host file entry.
-                      type: string
-                  required:
-                  - ip
-                  type: object
-                type: array
-              hostNetwork:
-                description: HostNetwork controls whether the pod may use the node
-                  network namespace
-                type: boolean
-              image:
-                description: |-
-                  Image - docker image settings
-                  if no specified operator uses default version from operator config
-                properties:
-                  pullPolicy:
-                    description: PullPolicy describes how to pull docker image
-                    type: string
-                  repository:
-                    description: Repository contains name of docker image + it's repository
-                      if needed
-                    type: string
-                  tag:
-                    description: Tag contains desired docker image version
-                    type: string
-                type: object
-              imagePullSecrets:
-                description: |-
-                  ImagePullSecrets An optional list of references to secrets in the same namespace
-                  to use for pulling images from registries
-                  see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
-                items:
-                  description: |-
-                    LocalObjectReference contains enough information to let you locate the
-                    referenced object inside the same namespace.
-                  properties:
-                    name:
-                      default: ""
-                      description: |-
-                        Name of the referent.
-                        This field is effectively required, but due to backwards compatibility is
-                        allowed to be empty. Instances of this type with an empty value here are
-                        almost certainly wrong.
-                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                      type: string
-                  type: object
-                  x-kubernetes-map-type: atomic
-                type: array
-              ingress:
-                description: Ingress enables ingress configuration for VMAuth.
-                properties:
-                  annotations:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                    type: object
-                  class_name:
-                    description: ClassName defines ingress class name for VMAuth
-                    type: string
-                  extraRules:
-                    description: |-
-                      ExtraRules - additional rules for ingress,
-                      must be checked for correctness by user.
-                    items:
-                      description: |-
-                        IngressRule represents the rules mapping the paths under a specified host to
-                        the related backend services. Incoming requests are first evaluated for a host
-                        match, then routed to the backend associated with the matching IngressRuleValue.
-                      properties:
-                        host:
-                          description: "host is the fully qualified domain name of
-                            a network host, as defined by RFC 3986.\nNote the following
-                            deviations from the \"host\" part of the\nURI as defined
-                            in RFC 3986:\n1. IPs are not allowed. Currently an IngressRuleValue
-                            can only apply to\n   the IP in the Spec of the parent
-                            Ingress.\n2. The `:` delimiter is not respected because
-                            ports are not allowed.\n\t  Currently the port of an Ingress
-                            is implicitly :80 for http and\n\t  :443 for https.\nBoth
-                            these may change in the future.\nIncoming requests are
-                            matched against the host before the\nIngressRuleValue.
-                            If the host is unspecified, the Ingress routes all\ntraffic
-                            based on the specified IngressRuleValue.\n\nhost can be
-                            \"precise\" which is a domain name without the terminating
-                            dot of\na network host (e.g. \"foo.bar.com\") or \"wildcard\",
-                            which is a domain name\nprefixed with a single wildcard
-                            label (e.g. \"*.foo.com\").\nThe wildcard character '*'
-                            must appear by itself as the first DNS label and\nmatches
-                            only a single label. You cannot have a wildcard label
-                            by itself (e.g. Host == \"*\").\nRequests will be matched
-                            against the Host field in the following way:\n1. If host
-                            is precise, the request matches this rule if the http
-                            host header is equal to Host.\n2. If host is a wildcard,
-                            then the request matches this rule if the http host header\nis
-                            to equal to the suffix (removing the first label) of the
-                            wildcard rule."
-                          type: string
-                        http:
-                          description: |-
-                            HTTPIngressRuleValue is a list of http selectors pointing to backends.
-                            In the example: http://<host>/<path>?<searchpart> -> backend where
-                            where parts of the url correspond to RFC 3986, this resource will be used
-                            to match against everything after the last '/' and before the first '?'
-                            or '#'.
-                          properties:
-                            paths:
-                              description: paths is a collection of paths that map
-                                requests to backends.
-                              items:
-                                description: |-
-                                  HTTPIngressPath associates a path with a backend. Incoming urls matching the
-                                  path are forwarded to the backend.
-                                properties:
-                                  backend:
-                                    description: |-
-                                      backend defines the referenced service endpoint to which the traffic
-                                      will be forwarded to.
-                                    properties:
-                                      resource:
-                                        description: |-
-                                          resource is an ObjectRef to another Kubernetes resource in the namespace
-                                          of the Ingress object. If resource is specified, a service.Name and
-                                          service.Port must not be specified.
-                                          This is a mutually exclusive setting with "Service".
-                                        properties:
-                                          apiGroup:
-                                            description: |-
-                                              APIGroup is the group for the resource being referenced.
-                                              If APIGroup is not specified, the specified Kind must be in the core API group.
-                                              For any other third-party types, APIGroup is required.
-                                            type: string
-                                          kind:
-                                            description: Kind is the type of resource
-                                              being referenced
-                                            type: string
-                                          name:
-                                            description: Name is the name of resource
-                                              being referenced
-                                            type: string
-                                        required:
-                                        - kind
-                                        - name
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      service:
-                                        description: |-
-                                          service references a service as a backend.
-                                          This is a mutually exclusive setting with "Resource".
-                                        properties:
-                                          name:
-                                            description: |-
-                                              name is the referenced service. The service must exist in
-                                              the same namespace as the Ingress object.
-                                            type: string
-                                          port:
-                                            description: |-
-                                              port of the referenced service. A port name or port number
-                                              is required for a IngressServiceBackend.
-                                            properties:
-                                              name:
-                                                description: |-
-                                                  name is the name of the port on the Service.
-                                                  This is a mutually exclusive setting with "Number".
-                                                type: string
-                                              number:
-                                                description: |-
-                                                  number is the numerical port number (e.g. 80) on the Service.
-                                                  This is a mutually exclusive setting with "Name".
-                                                format: int32
-                                                type: integer
-                                            type: object
-                                            x-kubernetes-map-type: atomic
-                                        required:
-                                        - name
-                                        type: object
-                                    type: object
-                                  path:
-                                    description: |-
-                                      path is matched against the path of an incoming request. Currently it can
-                                      contain characters disallowed from the conventional "path" part of a URL
-                                      as defined by RFC 3986. Paths must begin with a '/' and must be present
-                                      when using PathType with value "Exact" or "Prefix".
-                                    type: string
-                                  pathType:
-                                    description: |-
-                                      pathType determines the interpretation of the path matching. PathType can
-                                      be one of the following values:
-                                      * Exact: Matches the URL path exactly.
-                                      * Prefix: Matches based on a URL path prefix split by '/'. Matching is
-                                        done on a path element by element basis. A path element refers is the
-                                        list of labels in the path split by the '/' separator. A request is a
-                                        match for path p if every p is an element-wise prefix of p of the
-                                        request path. Note that if the last element of the path is a substring
-                                        of the last element in request path, it is not a match (e.g. /foo/bar
-                                        matches /foo/bar/baz, but does not match /foo/barbaz).
-                                      * ImplementationSpecific: Interpretation of the Path matching is up to
-                                        the IngressClass. Implementations can treat this as a separate PathType
-                                        or treat it identically to Prefix or Exact path types.
-                                      Implementations are required to support all path types.
-                                    type: string
-                                required:
-                                - backend
-                                - pathType
-                                type: object
-                              type: array
-                              x-kubernetes-list-type: atomic
-                          required:
-                          - paths
-                          type: object
-                      type: object
-                    type: array
-                  extraTls:
-                    description: |-
-                      ExtraTLS - additional TLS configuration for ingress
-                      must be checked for correctness by user.
-                    items:
-                      description: IngressTLS describes the transport layer security
-                        associated with an ingress.
-                      properties:
-                        hosts:
-                          description: |-
-                            hosts is a list of hosts included in the TLS certificate. The values in
-                            this list must match the name/s used in the tlsSecret. Defaults to the
-                            wildcard host setting for the loadbalancer controller fulfilling this
-                            Ingress, if left unspecified.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                        secretName:
-                          description: |-
-                            secretName is the name of the secret used to terminate TLS traffic on
-                            port 443. Field is left optional to allow TLS routing based on SNI
-                            hostname alone. If the SNI host in a listener conflicts with the "Host"
-                            header field used by an IngressRule, the SNI host is used for termination
-                            and value of the "Host" header is used for routing.
-                          type: string
-                      type: object
-                    type: array
-                  host:
-                    description: |-
-                      Host defines ingress host parameter for default rule
-                      It will be used, only if TlsHosts is empty
-                    type: string
-                  labels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects. May match selectors of replication controllers
-                      and services.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                    type: object
-                  name:
-                    description: |-
-                      Name must be unique within a namespace. Is required when creating resources, although
-                      some resources may allow a client to request the generation of an appropriate name
-                      automatically. Name is primarily intended for creation idempotence and configuration
-                      definition.
-                      Cannot be updated.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                    type: string
-                  tlsHosts:
-                    description: TlsHosts configures TLS access for ingress, tlsSecretName
-                      must be defined for it.
-                    items:
-                      type: string
-                    type: array
-                  tlsSecretName:
-                    description: |-
-                      TlsSecretName defines secretname at the VMAuth namespace with cert and key
-                      https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
-                    type: string
-                type: object
-              initContainers:
-                description: |-
-                  InitContainers allows adding initContainers to the pod definition.
-                  Any errors during the execution of an initContainer will lead to a restart of the Pod.
-                  More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
-                items:
-                  description: A single application container that you want to run
-                    within a pod.
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              license:
-                description: |-
-                  License allows to configure license key to be used for enterprise features.
-                  Using license key is supported starting from VictoriaMetrics v1.94.0.
-                  See [here](https://docs.victoriametrics.com/enterprise)
-                properties:
-                  forceOffline:
-                    description: Enforce offline verification of the license key.
-                    type: boolean
-                  key:
-                    description: |-
-                      Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise).
-                      To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial)
-                    type: string
-                  keyRef:
-                    description: KeyRef is reference to secret with license key for
-                      enterprise features.
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  reloadInterval:
-                    description: Interval to be used for checking for license key
-                      changes. Note that this is only applicable when using KeyRef.
-                    type: string
-                type: object
-              livenessProbe:
-                description: LivenessProbe that will be added CRD pod
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              logFormat:
-                description: LogFormat for VMAuth to be configured with.
-                enum:
-                - default
-                - json
-                type: string
-              logLevel:
-                description: LogLevel for victoria metrics single to be configured
-                  with.
-                enum:
-                - INFO
-                - WARN
-                - ERROR
-                - FATAL
-                - PANIC
-                type: string
-              managedMetadata:
-                description: |-
-                  ManagedMetadata defines metadata that will be added to the all objects
-                  created by operator for the given CustomResource
-                properties:
-                  annotations:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                    type: object
-                  labels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                    type: object
-                type: object
-              minReadySeconds:
-                description: |-
-                  MinReadySeconds defines a minimum number of seconds to wait before starting update next pod
-                  if previous in healthy state
-                  Has no effect for VLogs and VMSingle
-                format: int32
-                type: integer
-              nodeSelector:
-                additionalProperties:
-                  type: string
-                description: NodeSelector Define which Nodes the Pods are scheduled
-                  on.
-                type: object
-              paused:
-                description: |-
-                  Paused If set to true all actions on the underlying managed objects are not
-                  going to be performed, except for delete actions.
-                type: boolean
-              podDisruptionBudget:
-                description: PodDisruptionBudget created by operator
-                properties:
-                  maxUnavailable:
-                    anyOf:
-                    - type: integer
-                    - type: string
-                    description: |-
-                      An eviction is allowed if at most "maxUnavailable" pods selected by
-                      "selector" are unavailable after the eviction, i.e. even in absence of
-                      the evicted pod. For example, one can prevent all voluntary evictions
-                      by specifying 0. This is a mutually exclusive setting with "minAvailable".
-                    x-kubernetes-int-or-string: true
-                  minAvailable:
-                    anyOf:
-                    - type: integer
-                    - type: string
-                    description: |-
-                      An eviction is allowed if at least "minAvailable" pods selected by
-                      "selector" will still be available after the eviction, i.e. even in the
-                      absence of the evicted pod.  So for example you can prevent all voluntary
-                      evictions by specifying "100%".
-                    x-kubernetes-int-or-string: true
-                  selectorLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      replaces default labels selector generated by operator
-                      it's useful when you need to create custom budget
-                    type: object
-                type: object
-              podMetadata:
-                description: PodMetadata configures Labels and Annotations which are
-                  propagated to the VMAuth pods.
-                properties:
-                  annotations:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                    type: object
-                  labels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects. May match selectors of replication controllers
-                      and services.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                    type: object
-                  name:
-                    description: |-
-                      Name must be unique within a namespace. Is required when creating resources, although
-                      some resources may allow a client to request the generation of an appropriate name
-                      automatically. Name is primarily intended for creation idempotence and configuration
-                      definition.
-                      Cannot be updated.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                    type: string
-                type: object
-              port:
-                description: Port listen address
-                type: string
-              priorityClassName:
-                description: PriorityClassName class assigned to the Pods
-                type: string
-              readinessGates:
-                description: ReadinessGates defines pod readiness gates
-                items:
-                  description: PodReadinessGate contains the reference to a pod condition
-                  properties:
-                    conditionType:
-                      description: ConditionType refers to a condition in the pod's
-                        condition list with matching type.
-                      type: string
-                  required:
-                  - conditionType
-                  type: object
-                type: array
-              readinessProbe:
-                description: ReadinessProbe that will be added CRD pod
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              replicaCount:
-                description: ReplicaCount is the expected size of the Application.
-                format: int32
-                type: integer
-              resources:
-                description: |-
-                  Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
-                properties:
-                  claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
-                    items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
-                      properties:
-                        name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
-                          type: string
-                        request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
-                          type: string
-                      required:
-                      - name
-                      type: object
-                    type: array
-                    x-kubernetes-list-map-keys:
-                    - name
-                    x-kubernetes-list-type: map
-                  limits:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                  requests:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                type: object
-              revisionHistoryLimitCount:
-                description: |-
-                  The number of old ReplicaSets to retain to allow rollback in deployment or
-                  maximum number of revisions that will be maintained in the Deployment revision history.
-                  Has no effect at StatefulSets
-                  Defaults to 10.
-                format: int32
-                type: integer
-              runtimeClassName:
-                description: |-
-                  RuntimeClassName - defines runtime class for kubernetes pod.
-                  https://kubernetes.io/docs/concepts/containers/runtime-class/
-                type: string
-              schedulerName:
-                description: SchedulerName - defines kubernetes scheduler name
-                type: string
-              secrets:
-                description: |-
-                  Secrets is a list of Secrets in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/secrets/SECRET_NAME folder
-                items:
-                  type: string
-                type: array
-              securityContext:
-                description: |-
-                  SecurityContext holds pod-level security attributes and common container settings.
-                  This defaults to the default PodSecurityContext.
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              selectAllByDefault:
-                description: |-
-                  SelectAllByDefault changes default behavior for empty CRD selectors, such userSelector.
-                  with selectAllByDefault: true and empty userSelector and userNamespaceSelector
-                  Operator selects all exist users
-                  with selectAllByDefault: false - selects nothing
-                type: boolean
-              serviceAccountName:
-                description: ServiceAccountName is the name of the ServiceAccount
-                  to use to run the pods
-                type: string
-              serviceScrapeSpec:
-                description: ServiceScrapeSpec that will be added to vmauth VMServiceScrape
-                  spec
-                required:
-                - endpoints
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              serviceSpec:
-                description: ServiceSpec that will be added to vmsingle service spec
-                properties:
-                  metadata:
-                    description: EmbeddedObjectMetadata defines objectMeta for additional
-                      service.
-                    properties:
-                      annotations:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Annotations is an unstructured key value map stored with a resource that may be
-                          set by external tools to store and retrieve arbitrary metadata. They are not
-                          queryable and should be preserved when modifying objects.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                        type: object
-                      labels:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Labels Map of string keys and values that can be used to organize and categorize
-                          (scope and select) objects. May match selectors of replication controllers
-                          and services.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                        type: object
-                      name:
-                        description: |-
-                          Name must be unique within a namespace. Is required when creating resources, although
-                          some resources may allow a client to request the generation of an appropriate name
-                          automatically. Name is primarily intended for creation idempotence and configuration
-                          definition.
-                          Cannot be updated.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                        type: string
-                    type: object
-                  spec:
-                    description: |-
-                      ServiceSpec describes the attributes that a user creates on a service.
-                      More info: https://kubernetes.io/docs/concepts/services-networking/service/
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  useAsDefault:
-                    description: |-
-                      UseAsDefault applies changes from given service definition to the main object Service
-                      Changing from headless service to clusterIP or loadbalancer may break cross-component communication
-                    type: boolean
-                required:
-                - spec
-                type: object
-              startupProbe:
-                description: StartupProbe that will be added to CRD pod
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              terminationGracePeriodSeconds:
-                description: TerminationGracePeriodSeconds period for container graceful
-                  termination
-                format: int64
-                type: integer
-              tolerations:
-                description: Tolerations If specified, the pod's tolerations.
-                items:
-                  description: |-
-                    The pod this Toleration is attached to tolerates any taint that matches
-                    the triple <key,value,effect> using the matching operator <operator>.
-                  properties:
-                    effect:
-                      description: |-
-                        Effect indicates the taint effect to match. Empty means match all taint effects.
-                        When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                      type: string
-                    key:
-                      description: |-
-                        Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                        If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                      type: string
-                    operator:
-                      description: |-
-                        Operator represents a key's relationship to the value.
-                        Valid operators are Exists and Equal. Defaults to Equal.
-                        Exists is equivalent to wildcard for value, so that a pod can
-                        tolerate all taints of a particular category.
-                      type: string
-                    tolerationSeconds:
-                      description: |-
-                        TolerationSeconds represents the period of time the toleration (which must be
-                        of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                        it is not set, which means tolerate the taint forever (do not evict). Zero and
-                        negative values will be treated as 0 (evict immediately) by the system.
-                      format: int64
-                      type: integer
-                    value:
-                      description: |-
-                        Value is the taint value the toleration matches to.
-                        If the operator is Exists, the value should be empty, otherwise just a regular string.
-                      type: string
-                  type: object
-                type: array
-              topologySpreadConstraints:
-                description: |-
-                  TopologySpreadConstraints embedded kubernetes pod configuration option,
-                  controls how pods are spread across your cluster among failure-domains
-                  such as regions, zones, nodes, and other user-defined topology domains
-                  https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
-                items:
-                  description: TopologySpreadConstraint specifies how to spread matching
-                    pods among the given topology.
-                  required:
-                  - maxSkew
-                  - topologyKey
-                  - whenUnsatisfiable
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              unauthorizedAccessConfig:
-                description: |-
-                  UnauthorizedAccessConfig configures access for un authorized users
-
-                  Deprecated, use unauthorizedUserAccessSpec instead
-                  will be removed at v1.0 release
-                x-kubernetes-preserve-unknown-fields: true
-              unauthorizedUserAccessSpec:
-                description: UnauthorizedUserAccessSpec defines unauthorized_user
-                  config section of vmauth config
-                properties:
-                  default_url:
-                    description: |-
-                      DefaultURLs backend url for non-matching paths filter
-                      usually used for default backend with error message
-                    items:
-                      type: string
-                    type: array
-                  discover_backend_ips:
-                    description: DiscoverBackendIPs instructs discovering URLPrefix
-                      backend IPs via DNS.
-                    type: boolean
-                  drop_src_path_prefix_parts:
-                    description: |-
-                      DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend.
-                      See [here](https://docs.victoriametrics.com/vmauth#dropping-request-path-prefix) for more details.
-                    type: integer
-                  dump_request_on_errors:
-                    description: |-
-                      DumpRequestOnErrors instructs vmauth to return detailed request params to the client
-                      if routing rules don't allow to forward request to the backends.
-                      Useful for debugging `src_hosts` and `src_headers` based routing rules
-
-                      available since v1.107.0 vmauth version
-                    type: boolean
-                  headers:
-                    description: |-
-                      Headers represent additional http headers, that vmauth uses
-                      in form of ["header_key: header_value"]
-                      multiple values for header key:
-                      ["header_key: value1,value2"]
-                      it's available since 1.68.0 version of vmauth
-                    items:
-                      type: string
-                    type: array
-                  ip_filters:
-                    description: |-
-                      IPFilters defines per target src ip filters
-                      supported only with enterprise version of [vmauth](https://docs.victoriametrics.com/vmauth/#ip-filters)
-                    properties:
-                      allow_list:
-                        items:
-                          type: string
-                        type: array
-                      deny_list:
-                        items:
-                          type: string
-                        type: array
-                    type: object
-                  load_balancing_policy:
-                    description: |-
-                      LoadBalancingPolicy defines load balancing policy to use for backend urls.
-                      Supported policies: least_loaded, first_available.
-                      See [here](https://docs.victoriametrics.com/vmauth#load-balancing) for more details (default "least_loaded")
-                    enum:
-                    - least_loaded
-                    - first_available
-                    type: string
-                  max_concurrent_requests:
-                    description: |-
-                      MaxConcurrentRequests defines max concurrent requests per user
-                      300 is default value for vmauth
-                    type: integer
-                  metric_labels:
-                    additionalProperties:
-                      type: string
-                    description: MetricLabels - additional labels for metrics exported
-                      by vmauth for given user.
-                    type: object
-                  response_headers:
-                    description: |-
-                      ResponseHeaders represent additional http headers, that vmauth adds for request response
-                      in form of ["header_key: header_value"]
-                      multiple values for header key:
-                      ["header_key: value1,value2"]
-                      it's available since 1.93.0 version of vmauth
-                    items:
-                      type: string
-                    type: array
-                  retry_status_codes:
-                    description: |-
-                      RetryStatusCodes defines http status codes in numeric format for request retries
-                      e.g. [429,503]
-                    items:
-                      type: integer
-                    type: array
-                  tlsConfig:
-                    description: TLSConfig defines tls configuration for the backend
-                      connection
-                    properties:
-                      ca:
-                        description: Struct containing the CA cert to use for the
-                          targets.
-                        properties:
-                          configMap:
-                            description: ConfigMap containing data to use for the
-                              targets.
-                            properties:
-                              key:
-                                description: The key to select.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the ConfigMap or its
-                                  key must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          secret:
-                            description: Secret containing data to use for the targets.
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                        type: object
-                      caFile:
-                        description: Path to the CA cert in the container to use for
-                          the targets.
-                        type: string
-                      cert:
-                        description: Struct containing the client cert file for the
-                          targets.
-                        properties:
-                          configMap:
-                            description: ConfigMap containing data to use for the
-                              targets.
-                            properties:
-                              key:
-                                description: The key to select.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the ConfigMap or its
-                                  key must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          secret:
-                            description: Secret containing data to use for the targets.
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                        type: object
-                      certFile:
-                        description: Path to the client cert file in the container
-                          for the targets.
-                        type: string
-                      insecureSkipVerify:
-                        description: Disable target certificate validation.
-                        type: boolean
-                      keyFile:
-                        description: Path to the client key file in the container
-                          for the targets.
-                        type: string
-                      keySecret:
-                        description: Secret containing the client key file for the
-                          targets.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      serverName:
-                        description: Used to verify the hostname for the targets.
-                        type: string
-                    type: object
-                  url_map:
-                    items:
-                      description: |-
-                        UnauthorizedAccessConfigURLMap defines element of url_map routing configuration
-                        For UnauthorizedAccessConfig and VMAuthUnauthorizedUserAccessSpec.URLMap
-                      properties:
-                        discover_backend_ips:
-                          description: DiscoverBackendIPs instructs discovering URLPrefix
-                            backend IPs via DNS.
-                          type: boolean
-                        drop_src_path_prefix_parts:
-                          description: |-
-                            DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend.
-                            See [here](https://docs.victoriametrics.com/vmauth#dropping-request-path-prefix) for more details.
-                          type: integer
-                        headers:
-                          description: |-
-                            RequestHeaders represent additional http headers, that vmauth uses
-                            in form of ["header_key: header_value"]
-                            multiple values for header key:
-                            ["header_key: value1,value2"]
-                            it's available since 1.68.0 version of vmauth
-                          items:
-                            type: string
-                          type: array
-                        load_balancing_policy:
-                          description: |-
-                            LoadBalancingPolicy defines load balancing policy to use for backend urls.
-                            Supported policies: least_loaded, first_available.
-                            See [here](https://docs.victoriametrics.com/vmauth#load-balancing) for more details (default "least_loaded")
-                          enum:
-                          - least_loaded
-                          - first_available
-                          type: string
-                        response_headers:
-                          description: |-
-                            ResponseHeaders represent additional http headers, that vmauth adds for request response
-                            in form of ["header_key: header_value"]
-                            multiple values for header key:
-                            ["header_key: value1,value2"]
-                            it's available since 1.93.0 version of vmauth
-                          items:
-                            type: string
-                          type: array
-                        retry_status_codes:
-                          description: |-
-                            RetryStatusCodes defines http status codes in numeric format for request retries
-                            Can be defined per target or at VMUser.spec level
-                            e.g. [429,503]
-                          items:
-                            type: integer
-                          type: array
-                        src_headers:
-                          description: SrcHeaders is an optional list of headers,
-                            which must match request headers.
-                          items:
-                            type: string
-                          type: array
-                        src_hosts:
-                          description: SrcHosts is an optional list of regular expressions,
-                            which must match the request hostname.
-                          items:
-                            type: string
-                          type: array
-                        src_paths:
-                          description: SrcPaths is an optional list of regular expressions,
-                            which must match the request path.
-                          items:
-                            type: string
-                          type: array
-                        src_query_args:
-                          description: SrcQueryArgs is an optional list of query args,
-                            which must match request URL query args.
-                          items:
-                            type: string
-                          type: array
-                        url_prefix:
-                          description: |-
-                            UrlPrefix contains backend url prefixes for the proxied request url.
-                            URLPrefix defines prefix prefix for destination
-                          x-kubernetes-preserve-unknown-fields: true
-                      type: object
-                    type: array
-                  url_prefix:
-                    description: URLPrefix defines prefix prefix for destination
-                    x-kubernetes-preserve-unknown-fields: true
-                type: object
-              useDefaultResources:
-                description: |-
-                  UseDefaultResources controls resource settings
-                  By default, operator sets built-in resource requirements
-                type: boolean
-              useStrictSecurity:
-                description: |-
-                  UseStrictSecurity enables strict security mode for component
-                  it restricts disk writes access
-                  uses non-root user out of the box
-                  drops not needed security permissions
-                type: boolean
-              useVMConfigReloader:
-                description: |-
-                  UseVMConfigReloader replaces prometheus-like config-reloader
-                  with vm one. It uses secrets watch instead of file watch
-                  which greatly increases speed of config updates
-                type: boolean
-              userNamespaceSelector:
-                description: |-
-                  UserNamespaceSelector Namespaces to be selected for  VMAuth discovery.
-                  Works in combination with Selector.
-                  NamespaceSelector nil - only objects at VMAuth namespace.
-                  Selector nil - only objects at NamespaceSelector namespaces.
-                  If both nil - behaviour controlled by selectAllByDefault
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              userSelector:
-                description: |-
-                  UserSelector defines VMUser to be selected for config file generation.
-                  Works in combination with NamespaceSelector.
-                  NamespaceSelector nil - only objects at VMAuth namespace.
-                  If both nil - behaviour controlled by selectAllByDefault
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              volumeMounts:
-                description: |-
-                  VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
-                  VolumeMounts specified will be appended to other VolumeMounts in the Application container
-                items:
-                  description: VolumeMount describes a mounting of a Volume within
-                    a container.
-                  properties:
-                    mountPath:
-                      description: |-
-                        Path within the container at which the volume should be mounted.  Must
-                        not contain ':'.
-                      type: string
-                    mountPropagation:
-                      description: |-
-                        mountPropagation determines how mounts are propagated from the host
-                        to container and the other way around.
-                        When not set, MountPropagationNone is used.
-                        This field is beta in 1.10.
-                        When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                        (which defaults to None).
-                      type: string
-                    name:
-                      description: This must match the Name of a Volume.
-                      type: string
-                    readOnly:
-                      description: |-
-                        Mounted read-only if true, read-write otherwise (false or unspecified).
-                        Defaults to false.
-                      type: boolean
-                    recursiveReadOnly:
-                      description: |-
-                        RecursiveReadOnly specifies whether read-only mounts should be handled
-                        recursively.
-
-                        If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                        If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                        recursively read-only.  If this field is set to IfPossible, the mount is made
-                        recursively read-only, if it is supported by the container runtime.  If this
-                        field is set to Enabled, the mount is made recursively read-only if it is
-                        supported by the container runtime, otherwise the pod will not be started and
-                        an error will be generated to indicate the reason.
-
-                        If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                        None (or be unspecified, which defaults to None).
-
-                        If this field is not specified, it is treated as an equivalent of Disabled.
-                      type: string
-                    subPath:
-                      description: |-
-                        Path within the volume from which the container's volume should be mounted.
-                        Defaults to "" (volume's root).
-                      type: string
-                    subPathExpr:
-                      description: |-
-                        Expanded path within the volume from which the container's volume should be mounted.
-                        Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                        Defaults to "" (volume's root).
-                        SubPathExpr and SubPath are mutually exclusive.
-                      type: string
-                  required:
-                  - mountPath
-                  - name
-                  type: object
-                type: array
-              volumes:
-                description: |-
-                  Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
-                  Volumes specified will be appended to other volumes that are generated.
-                  / +optional
-                items:
-                  description: Volume represents a named volume in a pod that may
-                    be accessed by any container in the pod.
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
             type: object
             x-kubernetes-preserve-unknown-fields: true
           status:
-            description: VMAuthStatus defines the observed state of VMAuth
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -16329,16 +992,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -16351,7 +1009,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmclusters.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -16385,4338 +1043,45 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: |-
-          VMCluster is fast, cost-effective and scalable time-series database.
-          Cluster version with
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMClusterSpec defines the desired state of VMCluster
-            properties:
-              clusterDomainName:
-                description: |-
-                  ClusterDomainName defines domain name suffix for in-cluster dns addresses
-                  aka .cluster.local
-                  used by vminsert and vmselect to build vmstorage address
-                type: string
-              clusterVersion:
-                description: |-
-                  ClusterVersion defines default images tag for all components.
-                  it can be overwritten with component specific image.tag value.
-                type: string
-              imagePullSecrets:
-                description: |-
-                  ImagePullSecrets An optional list of references to secrets in the same namespace
-                  to use for pulling images from registries
-                  see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
-                items:
-                  description: |-
-                    LocalObjectReference contains enough information to let you locate the
-                    referenced object inside the same namespace.
-                  properties:
-                    name:
-                      default: ""
-                      description: |-
-                        Name of the referent.
-                        This field is effectively required, but due to backwards compatibility is
-                        allowed to be empty. Instances of this type with an empty value here are
-                        almost certainly wrong.
-                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                      type: string
-                  type: object
-                  x-kubernetes-map-type: atomic
-                type: array
-              license:
-                description: |-
-                  License allows to configure license key to be used for enterprise features.
-                  Using license key is supported starting from VictoriaMetrics v1.94.0.
-                  See [here](https://docs.victoriametrics.com/enterprise)
-                properties:
-                  forceOffline:
-                    description: Enforce offline verification of the license key.
-                    type: boolean
-                  key:
-                    description: |-
-                      Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise).
-                      To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial)
-                    type: string
-                  keyRef:
-                    description: KeyRef is reference to secret with license key for
-                      enterprise features.
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  reloadInterval:
-                    description: Interval to be used for checking for license key
-                      changes. Note that this is only applicable when using KeyRef.
-                    type: string
-                type: object
-              managedMetadata:
-                description: |-
-                  ManagedMetadata defines metadata that will be added to the all objects
-                  created by operator for the given CustomResource
-                properties:
-                  annotations:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                    type: object
-                  labels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                    type: object
-                type: object
-              paused:
-                description: |-
-                  Paused If set to true all actions on the underlying managed objects are not
-                  going to be performed, except for delete actions.
-                type: boolean
-              replicationFactor:
-                description: |-
-                  ReplicationFactor defines how many copies of data make among
-                  distinct storage nodes
-                format: int32
-                type: integer
-              requestsLoadBalancer:
-                description: |-
-                  RequestsLoadBalancer configures load-balancing for vminsert and vmselect requests
-                  it helps to evenly spread load across pods
-                  usually it's not possible with kubernetes TCP based service
-                properties:
-                  disableInsertBalancing:
-                    type: boolean
-                  disableSelectBalancing:
-                    type: boolean
-                  enabled:
-                    type: boolean
-                  spec:
-                    description: |-
-                      VMAuthLoadBalancerSpec defines configuration spec for VMAuth used as load-balancer
-                      for VMCluster component
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                type: object
-              retentionPeriod:
-                description: |-
-                  RetentionPeriod for the stored metrics
-                  Note VictoriaMetrics has data/ and indexdb/ folders
-                  metrics from data/ removed eventually as soon as partition leaves retention period
-                  reverse index data at indexdb rotates once at the half of configured
-                  [retention period](https://docs.victoriametrics.com/Single-server-VictoriaMetrics/#retention)
-                type: string
-              serviceAccountName:
-                description: |-
-                  ServiceAccountName is the name of the ServiceAccount to use to run the
-                  VMSelect, VMStorage and VMInsert Pods.
-                type: string
-              useStrictSecurity:
-                description: |-
-                  UseStrictSecurity enables strict security mode for component
-                  it restricts disk writes access
-                  uses non-root user out of the box
-                  drops not needed security permissions
-                type: boolean
-              vminsert:
-                properties:
-                  affinity:
-                    description: Affinity If specified, the pod's scheduling constraints.
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  clusterNativeListenPort:
-                    description: |-
-                      ClusterNativePort for multi-level cluster setup.
-                      More [details](https://docs.victoriametrics.com/Cluster-VictoriaMetrics#multi-level-cluster-setup)
-                    type: string
-                  configMaps:
-                    description: |-
-                      ConfigMaps is a list of ConfigMaps in the same namespace as the Application
-                      object, which shall be mounted into the Application container
-                      at /etc/vm/configs/CONFIGMAP_NAME folder
-                    items:
-                      type: string
-                    type: array
-                  containers:
-                    description: |-
-                      Containers property allows to inject additions sidecars or to patch existing containers.
-                      It can be useful for proxies, backup, etc.
-                    items:
-                      description: A single application container that you want to
-                        run within a pod.
-                      required:
-                      - name
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    type: array
-                  disableAutomountServiceAccountToken:
-                    description: |-
-                      DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
-                      Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
-                      For example, vmagent and vm-config-reloader requires k8s API access.
-                      Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
-                      And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
-                    type: boolean
-                  disableSelfServiceScrape:
-                    description: |-
-                      DisableSelfServiceScrape controls creation of VMServiceScrape by operator
-                      for the application.
-                      Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable
-                    type: boolean
-                  dnsConfig:
-                    description: |-
-                      Specifies the DNS parameters of a pod.
-                      Parameters specified here will be merged to the generated DNS
-                      configuration based on DNSPolicy.
-                    items:
-                      x-kubernetes-preserve-unknown-fields: true
-                    properties:
-                      nameservers:
-                        description: |-
-                          A list of DNS name server IP addresses.
-                          This will be appended to the base nameservers generated from DNSPolicy.
-                          Duplicated nameservers will be removed.
-                        items:
-                          type: string
-                        type: array
-                        x-kubernetes-list-type: atomic
-                      options:
-                        description: |-
-                          A list of DNS resolver options.
-                          This will be merged with the base options generated from DNSPolicy.
-                          Duplicated entries will be removed. Resolution options given in Options
-                          will override those that appear in the base DNSPolicy.
-                        items:
-                          description: PodDNSConfigOption defines DNS resolver options
-                            of a pod.
-                          properties:
-                            name:
-                              description: |-
-                                Name is this DNS resolver option's name.
-                                Required.
-                              type: string
-                            value:
-                              description: Value is this DNS resolver option's value.
-                              type: string
-                          type: object
-                        type: array
-                        x-kubernetes-list-type: atomic
-                      searches:
-                        description: |-
-                          A list of DNS search domains for host-name lookup.
-                          This will be appended to the base search paths generated from DNSPolicy.
-                          Duplicated search paths will be removed.
-                        items:
-                          type: string
-                        type: array
-                        x-kubernetes-list-type: atomic
-                    type: object
-                  dnsPolicy:
-                    description: DNSPolicy sets DNS policy for the pod
-                    type: string
-                  extraArgs:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      ExtraArgs that will be passed to the application container
-                      for example remoteWrite.tmpDataPath: /tmp
-                    type: object
-                  extraEnvs:
-                    description: ExtraEnvs that will be passed to the application
-                      container
-                    items:
-                      description: EnvVar represents an environment variable present
-                        in a Container.
-                      properties:
-                        name:
-                          description: Name of the environment variable. Must be a
-                            C_IDENTIFIER.
-                          type: string
-                        value:
-                          description: |-
-                            Variable references $(VAR_NAME) are expanded
-                            using the previously defined environment variables in the container and
-                            any service environment variables. If a variable cannot be resolved,
-                            the reference in the input string will be unchanged. Double $$ are reduced
-                            to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                            "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                            Escaped references will never be expanded, regardless of whether the variable
-                            exists or not.
-                            Defaults to "".
-                          type: string
-                      required:
-                      - name
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    type: array
-                  extraEnvsFrom:
-                    description: |-
-                      ExtraEnvsFrom defines source of env variables for the application container
-                      could either be secret or configmap
-                    items:
-                      description: EnvFromSource represents the source of a set of
-                        ConfigMaps
-                      properties:
-                        configMapRef:
-                          description: The ConfigMap to select from
-                          properties:
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the ConfigMap must be defined
-                              type: boolean
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        prefix:
-                          description: An optional identifier to prepend to each key
-                            in the ConfigMap. Must be a C_IDENTIFIER.
-                          type: string
-                        secretRef:
-                          description: The Secret to select from
-                          properties:
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret must be defined
-                              type: boolean
-                          type: object
-                          x-kubernetes-map-type: atomic
-                      type: object
-                    type: array
-                  host_aliases:
-                    description: |-
-                      HostAliasesUnderScore provides mapping for ip and hostname,
-                      that would be propagated to pod,
-                      cannot be used with HostNetwork.
-                      Has Priority over hostAliases field
-                    items:
-                      description: |-
-                        HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                        pod's hosts file.
-                      properties:
-                        hostnames:
-                          description: Hostnames for the above IP address.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                        ip:
-                          description: IP address of the host file entry.
-                          type: string
-                      required:
-                      - ip
-                      type: object
-                    type: array
-                  hostAliases:
-                    description: |-
-                      HostAliases provides mapping for ip and hostname,
-                      that would be propagated to pod,
-                      cannot be used with HostNetwork.
-                    items:
-                      description: |-
-                        HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                        pod's hosts file.
-                      properties:
-                        hostnames:
-                          description: Hostnames for the above IP address.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                        ip:
-                          description: IP address of the host file entry.
-                          type: string
-                      required:
-                      - ip
-                      type: object
-                    type: array
-                  hostNetwork:
-                    description: HostNetwork controls whether the pod may use the
-                      node network namespace
-                    type: boolean
-                  hpa:
-                    description: HPA defines kubernetes PodAutoScaling configuration
-                      version 2.
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  image:
-                    description: |-
-                      Image - docker image settings
-                      if no specified operator uses default version from operator config
-                    properties:
-                      pullPolicy:
-                        description: PullPolicy describes how to pull docker image
-                        type: string
-                      repository:
-                        description: Repository contains name of docker image + it's
-                          repository if needed
-                        type: string
-                      tag:
-                        description: Tag contains desired docker image version
-                        type: string
-                    type: object
-                  imagePullSecrets:
-                    description: |-
-                      ImagePullSecrets An optional list of references to secrets in the same namespace
-                      to use for pulling images from registries
-                      see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
-                    items:
-                      description: |-
-                        LocalObjectReference contains enough information to let you locate the
-                        referenced object inside the same namespace.
-                      properties:
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    type: array
-                  initContainers:
-                    description: |-
-                      InitContainers allows adding initContainers to the pod definition.
-                      Any errors during the execution of an initContainer will lead to a restart of the Pod.
-                      More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
-                    items:
-                      description: A single application container that you want to
-                        run within a pod.
-                      required:
-                      - name
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    type: array
-                  insertPorts:
-                    description: InsertPorts - additional listen ports for data ingestion.
-                    properties:
-                      graphitePort:
-                        description: GraphitePort listen port
-                        type: string
-                      influxPort:
-                        description: InfluxPort listen port
-                        type: string
-                      openTSDBHTTPPort:
-                        description: OpenTSDBHTTPPort for http connections.
-                        type: string
-                      openTSDBPort:
-                        description: OpenTSDBPort for tcp and udp listen
-                        type: string
-                    type: object
-                  livenessProbe:
-                    description: LivenessProbe that will be added CRD pod
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  logFormat:
-                    description: |-
-                      LogFormat for VMInsert to be configured with.
-                      default or json
-                    enum:
-                    - default
-                    - json
-                    type: string
-                  logLevel:
-                    description: LogLevel for VMInsert to be configured with.
-                    enum:
-                    - INFO
-                    - WARN
-                    - ERROR
-                    - FATAL
-                    - PANIC
-                    type: string
-                  minReadySeconds:
-                    description: |-
-                      MinReadySeconds defines a minimum number of seconds to wait before starting update next pod
-                      if previous in healthy state
-                      Has no effect for VLogs and VMSingle
-                    format: int32
-                    type: integer
-                  nodeSelector:
-                    additionalProperties:
-                      type: string
-                    description: NodeSelector Define which Nodes the Pods are scheduled
-                      on.
-                    type: object
-                  paused:
-                    description: |-
-                      Paused If set to true all actions on the underlying managed objects are not
-                      going to be performed, except for delete actions.
-                    type: boolean
-                  podDisruptionBudget:
-                    description: PodDisruptionBudget created by operator
-                    properties:
-                      maxUnavailable:
-                        anyOf:
-                        - type: integer
-                        - type: string
-                        description: |-
-                          An eviction is allowed if at most "maxUnavailable" pods selected by
-                          "selector" are unavailable after the eviction, i.e. even in absence of
-                          the evicted pod. For example, one can prevent all voluntary evictions
-                          by specifying 0. This is a mutually exclusive setting with "minAvailable".
-                        x-kubernetes-int-or-string: true
-                      minAvailable:
-                        anyOf:
-                        - type: integer
-                        - type: string
-                        description: |-
-                          An eviction is allowed if at least "minAvailable" pods selected by
-                          "selector" will still be available after the eviction, i.e. even in the
-                          absence of the evicted pod.  So for example you can prevent all voluntary
-                          evictions by specifying "100%".
-                        x-kubernetes-int-or-string: true
-                      selectorLabels:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          replaces default labels selector generated by operator
-                          it's useful when you need to create custom budget
-                        type: object
-                    type: object
-                  podMetadata:
-                    description: PodMetadata configures Labels and Annotations which
-                      are propagated to the VMInsert pods.
-                    properties:
-                      annotations:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Annotations is an unstructured key value map stored with a resource that may be
-                          set by external tools to store and retrieve arbitrary metadata. They are not
-                          queryable and should be preserved when modifying objects.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                        type: object
-                      labels:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Labels Map of string keys and values that can be used to organize and categorize
-                          (scope and select) objects. May match selectors of replication controllers
-                          and services.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                        type: object
-                      name:
-                        description: |-
-                          Name must be unique within a namespace. Is required when creating resources, although
-                          some resources may allow a client to request the generation of an appropriate name
-                          automatically. Name is primarily intended for creation idempotence and configuration
-                          definition.
-                          Cannot be updated.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                        type: string
-                    type: object
-                  port:
-                    description: Port listen address
-                    type: string
-                  priorityClassName:
-                    description: PriorityClassName class assigned to the Pods
-                    type: string
-                  readinessGates:
-                    description: ReadinessGates defines pod readiness gates
-                    items:
-                      description: PodReadinessGate contains the reference to a pod
-                        condition
-                      properties:
-                        conditionType:
-                          description: ConditionType refers to a condition in the
-                            pod's condition list with matching type.
-                          type: string
-                      required:
-                      - conditionType
-                      type: object
-                    type: array
-                  readinessProbe:
-                    description: ReadinessProbe that will be added CRD pod
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  replicaCount:
-                    description: ReplicaCount is the expected size of the Application.
-                    format: int32
-                    type: integer
-                  resources:
-                    description: |-
-                      Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                      if not defined default resources from operator config will be used
-                    properties:
-                      claims:
-                        description: |-
-                          Claims lists the names of resources, defined in spec.resourceClaims,
-                          that are used by this container.
-
-                          This is an alpha field and requires enabling the
-                          DynamicResourceAllocation feature gate.
-
-                          This field is immutable. It can only be set for containers.
-                        items:
-                          description: ResourceClaim references one entry in PodSpec.ResourceClaims.
-                          properties:
-                            name:
-                              description: |-
-                                Name must match the name of one entry in pod.spec.resourceClaims of
-                                the Pod where this field is used. It makes that resource available
-                                inside a container.
-                              type: string
-                            request:
-                              description: |-
-                                Request is the name chosen for a request in the referenced claim.
-                                If empty, everything from the claim is made available, otherwise
-                                only the result of this request.
-                              type: string
-                          required:
-                          - name
-                          type: object
-                        type: array
-                        x-kubernetes-list-map-keys:
-                        - name
-                        x-kubernetes-list-type: map
-                      limits:
-                        additionalProperties:
-                          anyOf:
-                          - type: integer
-                          - type: string
-                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                          x-kubernetes-int-or-string: true
-                        description: |-
-                          Limits describes the maximum amount of compute resources allowed.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                        type: object
-                      requests:
-                        additionalProperties:
-                          anyOf:
-                          - type: integer
-                          - type: string
-                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                          x-kubernetes-int-or-string: true
-                        description: |-
-                          Requests describes the minimum amount of compute resources required.
-                          If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                          otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                        type: object
-                    type: object
-                  revisionHistoryLimitCount:
-                    description: |-
-                      The number of old ReplicaSets to retain to allow rollback in deployment or
-                      maximum number of revisions that will be maintained in the Deployment revision history.
-                      Has no effect at StatefulSets
-                      Defaults to 10.
-                    format: int32
-                    type: integer
-                  rollingUpdate:
-                    description: RollingUpdate - overrides deployment update params.
-                    properties:
-                      maxSurge:
-                        anyOf:
-                        - type: integer
-                        - type: string
-                        description: |-
-                          The maximum number of pods that can be scheduled above the desired number of
-                          pods.
-                          Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
-                          This can not be 0 if MaxUnavailable is 0.
-                          Absolute number is calculated from percentage by rounding up.
-                          Defaults to 25%.
-                          Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when
-                          the rolling update starts, such that the total number of old and new pods do not exceed
-                          130% of desired pods. Once old pods have been killed,
-                          new ReplicaSet can be scaled up further, ensuring that total number of pods running
-                          at any time during the update is at most 130% of desired pods.
-                        x-kubernetes-int-or-string: true
-                      maxUnavailable:
-                        anyOf:
-                        - type: integer
-                        - type: string
-                        description: |-
-                          The maximum number of pods that can be unavailable during the update.
-                          Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
-                          Absolute number is calculated from percentage by rounding down.
-                          This can not be 0 if MaxSurge is 0.
-                          Defaults to 25%.
-                          Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods
-                          immediately when the rolling update starts. Once new pods are ready, old ReplicaSet
-                          can be scaled down further, followed by scaling up the new ReplicaSet, ensuring
-                          that the total number of pods available at all times during the update is at
-                          least 70% of desired pods.
-                        x-kubernetes-int-or-string: true
-                    type: object
-                  runtimeClassName:
-                    description: |-
-                      RuntimeClassName - defines runtime class for kubernetes pod.
-                      https://kubernetes.io/docs/concepts/containers/runtime-class/
-                    type: string
-                  schedulerName:
-                    description: SchedulerName - defines kubernetes scheduler name
-                    type: string
-                  secrets:
-                    description: |-
-                      Secrets is a list of Secrets in the same namespace as the Application
-                      object, which shall be mounted into the Application container
-                      at /etc/vm/secrets/SECRET_NAME folder
-                    items:
-                      type: string
-                    type: array
-                  securityContext:
-                    description: |-
-                      SecurityContext holds pod-level security attributes and common container settings.
-                      This defaults to the default PodSecurityContext.
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  serviceScrapeSpec:
-                    description: ServiceScrapeSpec that will be added to vminsert
-                      VMServiceScrape spec
-                    required:
-                    - endpoints
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  serviceSpec:
-                    description: ServiceSpec that will be added to vminsert service
-                      spec
-                    properties:
-                      metadata:
-                        description: EmbeddedObjectMetadata defines objectMeta for
-                          additional service.
-                        properties:
-                          annotations:
-                            additionalProperties:
-                              type: string
-                            description: |-
-                              Annotations is an unstructured key value map stored with a resource that may be
-                              set by external tools to store and retrieve arbitrary metadata. They are not
-                              queryable and should be preserved when modifying objects.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                            type: object
-                          labels:
-                            additionalProperties:
-                              type: string
-                            description: |-
-                              Labels Map of string keys and values that can be used to organize and categorize
-                              (scope and select) objects. May match selectors of replication controllers
-                              and services.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                            type: object
-                          name:
-                            description: |-
-                              Name must be unique within a namespace. Is required when creating resources, although
-                              some resources may allow a client to request the generation of an appropriate name
-                              automatically. Name is primarily intended for creation idempotence and configuration
-                              definition.
-                              Cannot be updated.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                            type: string
-                        type: object
-                      spec:
-                        description: |-
-                          ServiceSpec describes the attributes that a user creates on a service.
-                          More info: https://kubernetes.io/docs/concepts/services-networking/service/
-                        type: object
-                        x-kubernetes-preserve-unknown-fields: true
-                      useAsDefault:
-                        description: |-
-                          UseAsDefault applies changes from given service definition to the main object Service
-                          Changing from headless service to clusterIP or loadbalancer may break cross-component communication
-                        type: boolean
-                    required:
-                    - spec
-                    type: object
-                  startupProbe:
-                    description: StartupProbe that will be added to CRD pod
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  terminationGracePeriodSeconds:
-                    description: TerminationGracePeriodSeconds period for container
-                      graceful termination
-                    format: int64
-                    type: integer
-                  tolerations:
-                    description: Tolerations If specified, the pod's tolerations.
-                    items:
-                      description: |-
-                        The pod this Toleration is attached to tolerates any taint that matches
-                        the triple <key,value,effect> using the matching operator <operator>.
-                      properties:
-                        effect:
-                          description: |-
-                            Effect indicates the taint effect to match. Empty means match all taint effects.
-                            When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                          type: string
-                        key:
-                          description: |-
-                            Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                            If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                          type: string
-                        operator:
-                          description: |-
-                            Operator represents a key's relationship to the value.
-                            Valid operators are Exists and Equal. Defaults to Equal.
-                            Exists is equivalent to wildcard for value, so that a pod can
-                            tolerate all taints of a particular category.
-                          type: string
-                        tolerationSeconds:
-                          description: |-
-                            TolerationSeconds represents the period of time the toleration (which must be
-                            of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                            it is not set, which means tolerate the taint forever (do not evict). Zero and
-                            negative values will be treated as 0 (evict immediately) by the system.
-                          format: int64
-                          type: integer
-                        value:
-                          description: |-
-                            Value is the taint value the toleration matches to.
-                            If the operator is Exists, the value should be empty, otherwise just a regular string.
-                          type: string
-                      type: object
-                    type: array
-                  topologySpreadConstraints:
-                    description: |-
-                      TopologySpreadConstraints embedded kubernetes pod configuration option,
-                      controls how pods are spread across your cluster among failure-domains
-                      such as regions, zones, nodes, and other user-defined topology domains
-                      https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
-                    items:
-                      description: TopologySpreadConstraint specifies how to spread
-                        matching pods among the given topology.
-                      required:
-                      - maxSkew
-                      - topologyKey
-                      - whenUnsatisfiable
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    type: array
-                  updateStrategy:
-                    description: UpdateStrategy - overrides default update strategy.
-                    enum:
-                    - Recreate
-                    - RollingUpdate
-                    type: string
-                  useDefaultResources:
-                    description: |-
-                      UseDefaultResources controls resource settings
-                      By default, operator sets built-in resource requirements
-                    type: boolean
-                  useStrictSecurity:
-                    description: |-
-                      UseStrictSecurity enables strict security mode for component
-                      it restricts disk writes access
-                      uses non-root user out of the box
-                      drops not needed security permissions
-                    type: boolean
-                  volumeMounts:
-                    description: |-
-                      VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
-                      VolumeMounts specified will be appended to other VolumeMounts in the Application container
-                    items:
-                      description: VolumeMount describes a mounting of a Volume within
-                        a container.
-                      properties:
-                        mountPath:
-                          description: |-
-                            Path within the container at which the volume should be mounted.  Must
-                            not contain ':'.
-                          type: string
-                        mountPropagation:
-                          description: |-
-                            mountPropagation determines how mounts are propagated from the host
-                            to container and the other way around.
-                            When not set, MountPropagationNone is used.
-                            This field is beta in 1.10.
-                            When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                            (which defaults to None).
-                          type: string
-                        name:
-                          description: This must match the Name of a Volume.
-                          type: string
-                        readOnly:
-                          description: |-
-                            Mounted read-only if true, read-write otherwise (false or unspecified).
-                            Defaults to false.
-                          type: boolean
-                        recursiveReadOnly:
-                          description: |-
-                            RecursiveReadOnly specifies whether read-only mounts should be handled
-                            recursively.
-
-                            If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                            If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                            recursively read-only.  If this field is set to IfPossible, the mount is made
-                            recursively read-only, if it is supported by the container runtime.  If this
-                            field is set to Enabled, the mount is made recursively read-only if it is
-                            supported by the container runtime, otherwise the pod will not be started and
-                            an error will be generated to indicate the reason.
-
-                            If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                            None (or be unspecified, which defaults to None).
-
-                            If this field is not specified, it is treated as an equivalent of Disabled.
-                          type: string
-                        subPath:
-                          description: |-
-                            Path within the volume from which the container's volume should be mounted.
-                            Defaults to "" (volume's root).
-                          type: string
-                        subPathExpr:
-                          description: |-
-                            Expanded path within the volume from which the container's volume should be mounted.
-                            Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                            Defaults to "" (volume's root).
-                            SubPathExpr and SubPath are mutually exclusive.
-                          type: string
-                      required:
-                      - mountPath
-                      - name
-                      type: object
-                    type: array
-                  volumes:
-                    description: |-
-                      Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
-                      Volumes specified will be appended to other volumes that are generated.
-                      / +optional
-                    items:
-                      description: Volume represents a named volume in a pod that
-                        may be accessed by any container in the pod.
-                      required:
-                      - name
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    type: array
-                type: object
-              vmselect:
-                description: VMSelect defines configuration section for vmselect components
-                  of the victoria-metrics cluster
-                properties:
-                  affinity:
-                    description: Affinity If specified, the pod's scheduling constraints.
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  cacheMountPath:
-                    description: |-
-                      CacheMountPath allows to add cache persistent for VMSelect,
-                      will use "/cache" as default if not specified.
-                    type: string
-                  claimTemplates:
-                    description: ClaimTemplates allows adding additional VolumeClaimTemplates
-                      for StatefulSet
-                    items:
-                      description: PersistentVolumeClaim is a user's request for and
-                        claim to a persistent volume
-                      properties:
-                        apiVersion:
-                          description: |-
-                            APIVersion defines the versioned schema of this representation of an object.
-                            Servers should convert recognized schemas to the latest internal value, and
-                            may reject unrecognized values.
-                            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-                          type: string
-                        kind:
-                          description: |-
-                            Kind is a string value representing the REST resource this object represents.
-                            Servers may infer this from the endpoint the client submits requests to.
-                            Cannot be updated.
-                            In CamelCase.
-                            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-                          type: string
-                        metadata:
-                          description: |-
-                            Standard object's metadata.
-                            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-                          type: object
-                          x-kubernetes-preserve-unknown-fields: true
-                        spec:
-                          description: |-
-                            spec defines the desired characteristics of a volume requested by a pod author.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
-                          properties:
-                            accessModes:
-                              description: |-
-                                accessModes contains the desired access modes the volume should have.
-                                More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                              items:
-                                type: string
-                              type: array
-                              x-kubernetes-list-type: atomic
-                            dataSource:
-                              description: |-
-                                dataSource field can be used to specify either:
-                                * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
-                                * An existing PVC (PersistentVolumeClaim)
-                                If the provisioner or an external controller can support the specified data source,
-                                it will create a new volume based on the contents of the specified data source.
-                                When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-                                and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
-                                If the namespace is specified, then dataSourceRef will not be copied to dataSource.
-                              properties:
-                                apiGroup:
-                                  description: |-
-                                    APIGroup is the group for the resource being referenced.
-                                    If APIGroup is not specified, the specified Kind must be in the core API group.
-                                    For any other third-party types, APIGroup is required.
-                                  type: string
-                                kind:
-                                  description: Kind is the type of resource being
-                                    referenced
-                                  type: string
-                                name:
-                                  description: Name is the name of resource being
-                                    referenced
-                                  type: string
-                              required:
-                              - kind
-                              - name
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            dataSourceRef:
-                              description: |-
-                                dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
-                                volume is desired. This may be any object from a non-empty API group (non
-                                core object) or a PersistentVolumeClaim object.
-                                When this field is specified, volume binding will only succeed if the type of
-                                the specified object matches some installed volume populator or dynamic
-                                provisioner.
-                                This field will replace the functionality of the dataSource field and as such
-                                if both fields are non-empty, they must have the same value. For backwards
-                                compatibility, when namespace isn't specified in dataSourceRef,
-                                both fields (dataSource and dataSourceRef) will be set to the same
-                                value automatically if one of them is empty and the other is non-empty.
-                                When namespace is specified in dataSourceRef,
-                                dataSource isn't set to the same value and must be empty.
-                                There are three important differences between dataSource and dataSourceRef:
-                                * While dataSource only allows two specific types of objects, dataSourceRef
-                                  allows any non-core object, as well as PersistentVolumeClaim objects.
-                                * While dataSource ignores disallowed values (dropping them), dataSourceRef
-                                  preserves all values, and generates an error if a disallowed value is
-                                  specified.
-                                * While dataSource only allows local objects, dataSourceRef allows objects
-                                  in any namespaces.
-                                (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
-                                (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                              properties:
-                                apiGroup:
-                                  description: |-
-                                    APIGroup is the group for the resource being referenced.
-                                    If APIGroup is not specified, the specified Kind must be in the core API group.
-                                    For any other third-party types, APIGroup is required.
-                                  type: string
-                                kind:
-                                  description: Kind is the type of resource being
-                                    referenced
-                                  type: string
-                                name:
-                                  description: Name is the name of resource being
-                                    referenced
-                                  type: string
-                                namespace:
-                                  description: |-
-                                    Namespace is the namespace of resource being referenced
-                                    Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
-                                    (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                                  type: string
-                              required:
-                              - kind
-                              - name
-                              type: object
-                            resources:
-                              description: |-
-                                resources represents the minimum resources the volume should have.
-                                If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
-                                that are lower than previous value but must still be higher than capacity recorded in the
-                                status field of the claim.
-                                More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
-                              properties:
-                                limits:
-                                  additionalProperties:
-                                    anyOf:
-                                    - type: integer
-                                    - type: string
-                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                    x-kubernetes-int-or-string: true
-                                  description: |-
-                                    Limits describes the maximum amount of compute resources allowed.
-                                    More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                                  type: object
-                                requests:
-                                  additionalProperties:
-                                    anyOf:
-                                    - type: integer
-                                    - type: string
-                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                    x-kubernetes-int-or-string: true
-                                  description: |-
-                                    Requests describes the minimum amount of compute resources required.
-                                    If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                                    otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                                    More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                                  type: object
-                              type: object
-                            selector:
-                              description: selector is a label query over volumes
-                                to consider for binding.
-                              properties:
-                                matchExpressions:
-                                  description: matchExpressions is a list of label
-                                    selector requirements. The requirements are ANDed.
-                                  items:
-                                    description: |-
-                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                      relates the key and values.
-                                    properties:
-                                      key:
-                                        description: key is the label key that the
-                                          selector applies to.
-                                        type: string
-                                      operator:
-                                        description: |-
-                                          operator represents a key's relationship to a set of values.
-                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                        type: string
-                                      values:
-                                        description: |-
-                                          values is an array of string values. If the operator is In or NotIn,
-                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                          the values array must be empty. This array is replaced during a strategic
-                                          merge patch.
-                                        items:
-                                          type: string
-                                        type: array
-                                        x-kubernetes-list-type: atomic
-                                    required:
-                                    - key
-                                    - operator
-                                    type: object
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                matchLabels:
-                                  additionalProperties:
-                                    type: string
-                                  description: |-
-                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                  type: object
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            storageClassName:
-                              description: |-
-                                storageClassName is the name of the StorageClass required by the claim.
-                                More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
-                              type: string
-                            volumeAttributesClassName:
-                              description: |-
-                                volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
-                                If specified, the CSI driver will create or update the volume with the attributes defined
-                                in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                will be set by the persistentvolume controller if it exists.
-                                If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
-                                set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
-                                exists.
-                                More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
-                              type: string
-                            volumeMode:
-                              description: |-
-                                volumeMode defines what type of volume is required by the claim.
-                                Value of Filesystem is implied when not included in claim spec.
-                              type: string
-                            volumeName:
-                              description: volumeName is the binding reference to
-                                the PersistentVolume backing this claim.
-                              type: string
-                          type: object
-                        status:
-                          description: |-
-                            status represents the current information/status of a persistent volume claim.
-                            Read-only.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
-                          properties:
-                            accessModes:
-                              description: |-
-                                accessModes contains the actual access modes the volume backing the PVC has.
-                                More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                              items:
-                                type: string
-                              type: array
-                              x-kubernetes-list-type: atomic
-                            allocatedResourceStatuses:
-                              additionalProperties:
-                                description: |-
-                                  When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource
-                                  that it does not recognizes, then it should ignore that update and let other controllers
-                                  handle it.
-                                type: string
-                              description: "allocatedResourceStatuses stores status
-                                of resource being resized for the given PVC.\nKey
-                                names follow standard Kubernetes label syntax. Valid
-                                values are either:\n\t* Un-prefixed keys:\n\t\t- storage
-                                - the capacity of the volume.\n\t* Custom resources
-                                must use implementation-defined prefixed names such
-                                as \"example.com/my-custom-resource\"\nApart from
-                                above values - keys that are unprefixed or have kubernetes.io
-                                prefix are considered\nreserved and hence may not
-                                be used.\n\nClaimResourceStatus can be in any of following
-                                states:\n\t- ControllerResizeInProgress:\n\t\tState
-                                set when resize controller starts resizing the volume
-                                in control-plane.\n\t- ControllerResizeFailed:\n\t\tState
-                                set when resize has failed in resize controller with
-                                a terminal error.\n\t- NodeResizePending:\n\t\tState
-                                set when resize controller has finished resizing the
-                                volume but further resizing of\n\t\tvolume is needed
-                                on the node.\n\t- NodeResizeInProgress:\n\t\tState
-                                set when kubelet starts resizing the volume.\n\t-
-                                NodeResizeFailed:\n\t\tState set when resizing has
-                                failed in kubelet with a terminal error. Transient
-                                errors don't set\n\t\tNodeResizeFailed.\nFor example:
-                                if expanding a PVC for more capacity - this field
-                                can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage']
-                                = \"ControllerResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                = \"ControllerResizeFailed\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                = \"NodeResizePending\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                = \"NodeResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                = \"NodeResizeFailed\"\nWhen this field is not set,
-                                it means that no resize operation is in progress for
-                                the given PVC.\n\nA controller that receives PVC update
-                                with previously unknown resourceName or ClaimResourceStatus\nshould
-                                ignore the update for the purpose it was designed.
-                                For example - a controller that\nonly is responsible
-                                for resizing capacity of the volume, should ignore
-                                PVC updates that change other valid\nresources associated
-                                with PVC.\n\nThis is an alpha field and requires enabling
-                                RecoverVolumeExpansionFailure feature."
-                              type: object
-                              x-kubernetes-map-type: granular
-                            allocatedResources:
-                              additionalProperties:
-                                anyOf:
-                                - type: integer
-                                - type: string
-                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                x-kubernetes-int-or-string: true
-                              description: "allocatedResources tracks the resources
-                                allocated to a PVC including its capacity.\nKey names
-                                follow standard Kubernetes label syntax. Valid values
-                                are either:\n\t* Un-prefixed keys:\n\t\t- storage
-                                - the capacity of the volume.\n\t* Custom resources
-                                must use implementation-defined prefixed names such
-                                as \"example.com/my-custom-resource\"\nApart from
-                                above values - keys that are unprefixed or have kubernetes.io
-                                prefix are considered\nreserved and hence may not
-                                be used.\n\nCapacity reported here may be larger than
-                                the actual capacity when a volume expansion operation\nis
-                                requested.\nFor storage quota, the larger value from
-                                allocatedResources and PVC.spec.resources is used.\nIf
-                                allocatedResources is not set, PVC.spec.resources
-                                alone is used for quota calculation.\nIf a volume
-                                expansion capacity request is lowered, allocatedResources
-                                is only\nlowered if there are no expansion operations
-                                in progress and if the actual volume capacity\nis
-                                equal or lower than the requested capacity.\n\nA controller
-                                that receives PVC update with previously unknown resourceName\nshould
-                                ignore the update for the purpose it was designed.
-                                For example - a controller that\nonly is responsible
-                                for resizing capacity of the volume, should ignore
-                                PVC updates that change other valid\nresources associated
-                                with PVC.\n\nThis is an alpha field and requires enabling
-                                RecoverVolumeExpansionFailure feature."
-                              type: object
-                            capacity:
-                              additionalProperties:
-                                anyOf:
-                                - type: integer
-                                - type: string
-                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                x-kubernetes-int-or-string: true
-                              description: capacity represents the actual resources
-                                of the underlying volume.
-                              type: object
-                            conditions:
-                              description: |-
-                                conditions is the current Condition of persistent volume claim. If underlying persistent volume is being
-                                resized then the Condition will be set to 'Resizing'.
-                              items:
-                                description: PersistentVolumeClaimCondition contains
-                                  details about state of pvc
-                                properties:
-                                  lastProbeTime:
-                                    description: lastProbeTime is the time we probed
-                                      the condition.
-                                    format: date-time
-                                    type: string
-                                  lastTransitionTime:
-                                    description: lastTransitionTime is the time the
-                                      condition transitioned from one status to another.
-                                    format: date-time
-                                    type: string
-                                  message:
-                                    description: message is the human-readable message
-                                      indicating details about last transition.
-                                    type: string
-                                  reason:
-                                    description: |-
-                                      reason is a unique, this should be a short, machine understandable string that gives the reason
-                                      for condition's last transition. If it reports "Resizing" that means the underlying
-                                      persistent volume is being resized.
-                                    type: string
-                                  status:
-                                    description: |-
-                                      Status is the status of the condition.
-                                      Can be True, False, Unknown.
-                                      More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required
-                                    type: string
-                                  type:
-                                    description: |-
-                                      Type is the type of the condition.
-                                      More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about
-                                    type: string
-                                required:
-                                - status
-                                - type
-                                type: object
-                              type: array
-                              x-kubernetes-list-map-keys:
-                              - type
-                              x-kubernetes-list-type: map
-                            currentVolumeAttributesClassName:
-                              description: |-
-                                currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
-                                When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                                This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
-                              type: string
-                            modifyVolumeStatus:
-                              description: |-
-                                ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
-                                When this is unset, there is no ModifyVolume operation being attempted.
-                                This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
-                              properties:
-                                status:
-                                  description: "status is the status of the ControllerModifyVolume
-                                    operation. It can be in any of following states:\n
-                                    - Pending\n   Pending indicates that the PersistentVolumeClaim
-                                    cannot be modified due to unmet requirements,
-                                    such as\n   the specified VolumeAttributesClass
-                                    not existing.\n - InProgress\n   InProgress indicates
-                                    that the volume is being modified.\n - Infeasible\n
-                                    \ Infeasible indicates that the request has been
-                                    rejected as invalid by the CSI driver. To\n\t
-                                    \ resolve the error, a valid VolumeAttributesClass
-                                    needs to be specified.\nNote: New statuses can
-                                    be added in the future. Consumers should check
-                                    for unknown statuses and fail appropriately."
-                                  type: string
-                                targetVolumeAttributesClassName:
-                                  description: targetVolumeAttributesClassName is
-                                    the name of the VolumeAttributesClass the PVC
-                                    currently being reconciled
-                                  type: string
-                              required:
-                              - status
-                              type: object
-                            phase:
-                              description: phase represents the current phase of PersistentVolumeClaim.
-                              type: string
-                          type: object
-                      type: object
-                    type: array
-                  clusterNativeListenPort:
-                    description: |-
-                      ClusterNativePort for multi-level cluster setup.
-                      More [details](https://docs.victoriametrics.com/Cluster-VictoriaMetrics#multi-level-cluster-setup)
-                    type: string
-                  configMaps:
-                    description: |-
-                      ConfigMaps is a list of ConfigMaps in the same namespace as the Application
-                      object, which shall be mounted into the Application container
-                      at /etc/vm/configs/CONFIGMAP_NAME folder
-                    items:
-                      type: string
-                    type: array
-                  containers:
-                    description: |-
-                      Containers property allows to inject additions sidecars or to patch existing containers.
-                      It can be useful for proxies, backup, etc.
-                    items:
-                      description: A single application container that you want to
-                        run within a pod.
-                      required:
-                      - name
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    type: array
-                  disableAutomountServiceAccountToken:
-                    description: |-
-                      DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
-                      Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
-                      For example, vmagent and vm-config-reloader requires k8s API access.
-                      Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
-                      And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
-                    type: boolean
-                  disableSelfServiceScrape:
-                    description: |-
-                      DisableSelfServiceScrape controls creation of VMServiceScrape by operator
-                      for the application.
-                      Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable
-                    type: boolean
-                  dnsConfig:
-                    description: |-
-                      Specifies the DNS parameters of a pod.
-                      Parameters specified here will be merged to the generated DNS
-                      configuration based on DNSPolicy.
-                    items:
-                      x-kubernetes-preserve-unknown-fields: true
-                    properties:
-                      nameservers:
-                        description: |-
-                          A list of DNS name server IP addresses.
-                          This will be appended to the base nameservers generated from DNSPolicy.
-                          Duplicated nameservers will be removed.
-                        items:
-                          type: string
-                        type: array
-                        x-kubernetes-list-type: atomic
-                      options:
-                        description: |-
-                          A list of DNS resolver options.
-                          This will be merged with the base options generated from DNSPolicy.
-                          Duplicated entries will be removed. Resolution options given in Options
-                          will override those that appear in the base DNSPolicy.
-                        items:
-                          description: PodDNSConfigOption defines DNS resolver options
-                            of a pod.
-                          properties:
-                            name:
-                              description: |-
-                                Name is this DNS resolver option's name.
-                                Required.
-                              type: string
-                            value:
-                              description: Value is this DNS resolver option's value.
-                              type: string
-                          type: object
-                        type: array
-                        x-kubernetes-list-type: atomic
-                      searches:
-                        description: |-
-                          A list of DNS search domains for host-name lookup.
-                          This will be appended to the base search paths generated from DNSPolicy.
-                          Duplicated search paths will be removed.
-                        items:
-                          type: string
-                        type: array
-                        x-kubernetes-list-type: atomic
-                    type: object
-                  dnsPolicy:
-                    description: DNSPolicy sets DNS policy for the pod
-                    type: string
-                  extraArgs:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      ExtraArgs that will be passed to the application container
-                      for example remoteWrite.tmpDataPath: /tmp
-                    type: object
-                  extraEnvs:
-                    description: ExtraEnvs that will be passed to the application
-                      container
-                    items:
-                      description: EnvVar represents an environment variable present
-                        in a Container.
-                      properties:
-                        name:
-                          description: Name of the environment variable. Must be a
-                            C_IDENTIFIER.
-                          type: string
-                        value:
-                          description: |-
-                            Variable references $(VAR_NAME) are expanded
-                            using the previously defined environment variables in the container and
-                            any service environment variables. If a variable cannot be resolved,
-                            the reference in the input string will be unchanged. Double $$ are reduced
-                            to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                            "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                            Escaped references will never be expanded, regardless of whether the variable
-                            exists or not.
-                            Defaults to "".
-                          type: string
-                      required:
-                      - name
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    type: array
-                  extraEnvsFrom:
-                    description: |-
-                      ExtraEnvsFrom defines source of env variables for the application container
-                      could either be secret or configmap
-                    items:
-                      description: EnvFromSource represents the source of a set of
-                        ConfigMaps
-                      properties:
-                        configMapRef:
-                          description: The ConfigMap to select from
-                          properties:
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the ConfigMap must be defined
-                              type: boolean
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        prefix:
-                          description: An optional identifier to prepend to each key
-                            in the ConfigMap. Must be a C_IDENTIFIER.
-                          type: string
-                        secretRef:
-                          description: The Secret to select from
-                          properties:
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret must be defined
-                              type: boolean
-                          type: object
-                          x-kubernetes-map-type: atomic
-                      type: object
-                    type: array
-                  host_aliases:
-                    description: |-
-                      HostAliasesUnderScore provides mapping for ip and hostname,
-                      that would be propagated to pod,
-                      cannot be used with HostNetwork.
-                      Has Priority over hostAliases field
-                    items:
-                      description: |-
-                        HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                        pod's hosts file.
-                      properties:
-                        hostnames:
-                          description: Hostnames for the above IP address.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                        ip:
-                          description: IP address of the host file entry.
-                          type: string
-                      required:
-                      - ip
-                      type: object
-                    type: array
-                  hostAliases:
-                    description: |-
-                      HostAliases provides mapping for ip and hostname,
-                      that would be propagated to pod,
-                      cannot be used with HostNetwork.
-                    items:
-                      description: |-
-                        HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                        pod's hosts file.
-                      properties:
-                        hostnames:
-                          description: Hostnames for the above IP address.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                        ip:
-                          description: IP address of the host file entry.
-                          type: string
-                      required:
-                      - ip
-                      type: object
-                    type: array
-                  hostNetwork:
-                    description: HostNetwork controls whether the pod may use the
-                      node network namespace
-                    type: boolean
-                  hpa:
-                    description: |-
-                      Configures horizontal pod autoscaling.
-                      Note, enabling this option disables vmselect to vmselect communication. In most cases it's not an issue.
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  image:
-                    description: |-
-                      Image - docker image settings
-                      if no specified operator uses default version from operator config
-                    properties:
-                      pullPolicy:
-                        description: PullPolicy describes how to pull docker image
-                        type: string
-                      repository:
-                        description: Repository contains name of docker image + it's
-                          repository if needed
-                        type: string
-                      tag:
-                        description: Tag contains desired docker image version
-                        type: string
-                    type: object
-                  imagePullSecrets:
-                    description: |-
-                      ImagePullSecrets An optional list of references to secrets in the same namespace
-                      to use for pulling images from registries
-                      see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
-                    items:
-                      description: |-
-                        LocalObjectReference contains enough information to let you locate the
-                        referenced object inside the same namespace.
-                      properties:
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    type: array
-                  initContainers:
-                    description: |-
-                      InitContainers allows adding initContainers to the pod definition.
-                      Any errors during the execution of an initContainer will lead to a restart of the Pod.
-                      More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
-                    items:
-                      description: A single application container that you want to
-                        run within a pod.
-                      required:
-                      - name
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    type: array
-                  livenessProbe:
-                    description: LivenessProbe that will be added CRD pod
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  logFormat:
-                    description: |-
-                      LogFormat for VMSelect to be configured with.
-                      default or json
-                    enum:
-                    - default
-                    - json
-                    type: string
-                  logLevel:
-                    description: LogLevel for VMSelect to be configured with.
-                    enum:
-                    - INFO
-                    - WARN
-                    - ERROR
-                    - FATAL
-                    - PANIC
-                    type: string
-                  minReadySeconds:
-                    description: |-
-                      MinReadySeconds defines a minimum number of seconds to wait before starting update next pod
-                      if previous in healthy state
-                      Has no effect for VLogs and VMSingle
-                    format: int32
-                    type: integer
-                  nodeSelector:
-                    additionalProperties:
-                      type: string
-                    description: NodeSelector Define which Nodes the Pods are scheduled
-                      on.
-                    type: object
-                  paused:
-                    description: |-
-                      Paused If set to true all actions on the underlying managed objects are not
-                      going to be performed, except for delete actions.
-                    type: boolean
-                  persistentVolume:
-                    description: |-
-                      Storage - add persistent volume for cacheMountPath
-                      its useful for persistent cache
-                      use storage instead of persistentVolume.
-                    properties:
-                      disableMountSubPath:
-                        description: |-
-                          Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary.
-                          DisableMountSubPath allows to remove any subPath usage in volume mounts.
-                        type: boolean
-                      emptyDir:
-                        description: |-
-                          EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More
-                          info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir
-                        properties:
-                          medium:
-                            description: |-
-                              medium represents what type of storage medium should back this directory.
-                              The default is "" which means to use the node's default medium.
-                              Must be an empty string (default) or Memory.
-                              More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
-                            type: string
-                          sizeLimit:
-                            anyOf:
-                            - type: integer
-                            - type: string
-                            description: |-
-                              sizeLimit is the total amount of local storage required for this EmptyDir volume.
-                              The size limit is also applicable for memory medium.
-                              The maximum usage on memory medium EmptyDir would be the minimum value between
-                              the SizeLimit specified here and the sum of memory limits of all containers in a pod.
-                              The default is nil which means that the limit is undefined.
-                              More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
-                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                            x-kubernetes-int-or-string: true
-                        type: object
-                      volumeClaimTemplate:
-                        description: A PVC spec to be used by the VMAlertManager StatefulSets.
-                        type: object
-                        x-kubernetes-preserve-unknown-fields: true
-                    type: object
-                  podDisruptionBudget:
-                    description: PodDisruptionBudget created by operator
-                    properties:
-                      maxUnavailable:
-                        anyOf:
-                        - type: integer
-                        - type: string
-                        description: |-
-                          An eviction is allowed if at most "maxUnavailable" pods selected by
-                          "selector" are unavailable after the eviction, i.e. even in absence of
-                          the evicted pod. For example, one can prevent all voluntary evictions
-                          by specifying 0. This is a mutually exclusive setting with "minAvailable".
-                        x-kubernetes-int-or-string: true
-                      minAvailable:
-                        anyOf:
-                        - type: integer
-                        - type: string
-                        description: |-
-                          An eviction is allowed if at least "minAvailable" pods selected by
-                          "selector" will still be available after the eviction, i.e. even in the
-                          absence of the evicted pod.  So for example you can prevent all voluntary
-                          evictions by specifying "100%".
-                        x-kubernetes-int-or-string: true
-                      selectorLabels:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          replaces default labels selector generated by operator
-                          it's useful when you need to create custom budget
-                        type: object
-                    type: object
-                  podMetadata:
-                    description: PodMetadata configures Labels and Annotations which
-                      are propagated to the VMSelect pods.
-                    properties:
-                      annotations:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Annotations is an unstructured key value map stored with a resource that may be
-                          set by external tools to store and retrieve arbitrary metadata. They are not
-                          queryable and should be preserved when modifying objects.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                        type: object
-                      labels:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Labels Map of string keys and values that can be used to organize and categorize
-                          (scope and select) objects. May match selectors of replication controllers
-                          and services.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                        type: object
-                      name:
-                        description: |-
-                          Name must be unique within a namespace. Is required when creating resources, although
-                          some resources may allow a client to request the generation of an appropriate name
-                          automatically. Name is primarily intended for creation idempotence and configuration
-                          definition.
-                          Cannot be updated.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                        type: string
-                    type: object
-                  port:
-                    description: Port listen address
-                    type: string
-                  priorityClassName:
-                    description: PriorityClassName class assigned to the Pods
-                    type: string
-                  readinessGates:
-                    description: ReadinessGates defines pod readiness gates
-                    items:
-                      description: PodReadinessGate contains the reference to a pod
-                        condition
-                      properties:
-                        conditionType:
-                          description: ConditionType refers to a condition in the
-                            pod's condition list with matching type.
-                          type: string
-                      required:
-                      - conditionType
-                      type: object
-                    type: array
-                  readinessProbe:
-                    description: ReadinessProbe that will be added CRD pod
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  replicaCount:
-                    description: ReplicaCount is the expected size of the Application.
-                    format: int32
-                    type: integer
-                  resources:
-                    description: |-
-                      Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                      if not defined default resources from operator config will be used
-                    properties:
-                      claims:
-                        description: |-
-                          Claims lists the names of resources, defined in spec.resourceClaims,
-                          that are used by this container.
-
-                          This is an alpha field and requires enabling the
-                          DynamicResourceAllocation feature gate.
-
-                          This field is immutable. It can only be set for containers.
-                        items:
-                          description: ResourceClaim references one entry in PodSpec.ResourceClaims.
-                          properties:
-                            name:
-                              description: |-
-                                Name must match the name of one entry in pod.spec.resourceClaims of
-                                the Pod where this field is used. It makes that resource available
-                                inside a container.
-                              type: string
-                            request:
-                              description: |-
-                                Request is the name chosen for a request in the referenced claim.
-                                If empty, everything from the claim is made available, otherwise
-                                only the result of this request.
-                              type: string
-                          required:
-                          - name
-                          type: object
-                        type: array
-                        x-kubernetes-list-map-keys:
-                        - name
-                        x-kubernetes-list-type: map
-                      limits:
-                        additionalProperties:
-                          anyOf:
-                          - type: integer
-                          - type: string
-                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                          x-kubernetes-int-or-string: true
-                        description: |-
-                          Limits describes the maximum amount of compute resources allowed.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                        type: object
-                      requests:
-                        additionalProperties:
-                          anyOf:
-                          - type: integer
-                          - type: string
-                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                          x-kubernetes-int-or-string: true
-                        description: |-
-                          Requests describes the minimum amount of compute resources required.
-                          If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                          otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                        type: object
-                    type: object
-                  revisionHistoryLimitCount:
-                    description: |-
-                      The number of old ReplicaSets to retain to allow rollback in deployment or
-                      maximum number of revisions that will be maintained in the Deployment revision history.
-                      Has no effect at StatefulSets
-                      Defaults to 10.
-                    format: int32
-                    type: integer
-                  rollingUpdateStrategy:
-                    description: |-
-                      RollingUpdateStrategy defines strategy for application updates
-                      Default is OnDelete, in this case operator handles update process
-                      Can be changed for RollingUpdate
-                    type: string
-                  runtimeClassName:
-                    description: |-
-                      RuntimeClassName - defines runtime class for kubernetes pod.
-                      https://kubernetes.io/docs/concepts/containers/runtime-class/
-                    type: string
-                  schedulerName:
-                    description: SchedulerName - defines kubernetes scheduler name
-                    type: string
-                  secrets:
-                    description: |-
-                      Secrets is a list of Secrets in the same namespace as the Application
-                      object, which shall be mounted into the Application container
-                      at /etc/vm/secrets/SECRET_NAME folder
-                    items:
-                      type: string
-                    type: array
-                  securityContext:
-                    description: |-
-                      SecurityContext holds pod-level security attributes and common container settings.
-                      This defaults to the default PodSecurityContext.
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  serviceScrapeSpec:
-                    description: ServiceScrapeSpec that will be added to vmselect
-                      VMServiceScrape spec
-                    required:
-                    - endpoints
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  serviceSpec:
-                    description: ServiceSpec that will be added to vmselect service
-                      spec
-                    properties:
-                      metadata:
-                        description: EmbeddedObjectMetadata defines objectMeta for
-                          additional service.
-                        properties:
-                          annotations:
-                            additionalProperties:
-                              type: string
-                            description: |-
-                              Annotations is an unstructured key value map stored with a resource that may be
-                              set by external tools to store and retrieve arbitrary metadata. They are not
-                              queryable and should be preserved when modifying objects.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                            type: object
-                          labels:
-                            additionalProperties:
-                              type: string
-                            description: |-
-                              Labels Map of string keys and values that can be used to organize and categorize
-                              (scope and select) objects. May match selectors of replication controllers
-                              and services.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                            type: object
-                          name:
-                            description: |-
-                              Name must be unique within a namespace. Is required when creating resources, although
-                              some resources may allow a client to request the generation of an appropriate name
-                              automatically. Name is primarily intended for creation idempotence and configuration
-                              definition.
-                              Cannot be updated.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                            type: string
-                        type: object
-                      spec:
-                        description: |-
-                          ServiceSpec describes the attributes that a user creates on a service.
-                          More info: https://kubernetes.io/docs/concepts/services-networking/service/
-                        type: object
-                        x-kubernetes-preserve-unknown-fields: true
-                      useAsDefault:
-                        description: |-
-                          UseAsDefault applies changes from given service definition to the main object Service
-                          Changing from headless service to clusterIP or loadbalancer may break cross-component communication
-                        type: boolean
-                    required:
-                    - spec
-                    type: object
-                  startupProbe:
-                    description: StartupProbe that will be added to CRD pod
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  storage:
-                    description: |-
-                      StorageSpec - add persistent volume claim for cacheMountPath
-                      its needed for persistent cache
-                    properties:
-                      disableMountSubPath:
-                        description: |-
-                          Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary.
-                          DisableMountSubPath allows to remove any subPath usage in volume mounts.
-                        type: boolean
-                      emptyDir:
-                        description: |-
-                          EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More
-                          info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir
-                        properties:
-                          medium:
-                            description: |-
-                              medium represents what type of storage medium should back this directory.
-                              The default is "" which means to use the node's default medium.
-                              Must be an empty string (default) or Memory.
-                              More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
-                            type: string
-                          sizeLimit:
-                            anyOf:
-                            - type: integer
-                            - type: string
-                            description: |-
-                              sizeLimit is the total amount of local storage required for this EmptyDir volume.
-                              The size limit is also applicable for memory medium.
-                              The maximum usage on memory medium EmptyDir would be the minimum value between
-                              the SizeLimit specified here and the sum of memory limits of all containers in a pod.
-                              The default is nil which means that the limit is undefined.
-                              More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
-                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                            x-kubernetes-int-or-string: true
-                        type: object
-                      volumeClaimTemplate:
-                        description: A PVC spec to be used by the VMAlertManager StatefulSets.
-                        properties:
-                          apiVersion:
-                            description: |-
-                              APIVersion defines the versioned schema of this representation of an object.
-                              Servers should convert recognized schemas to the latest internal value, and
-                              may reject unrecognized values.
-                              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-                            type: string
-                          kind:
-                            description: |-
-                              Kind is a string value representing the REST resource this object represents.
-                              Servers may infer this from the endpoint the client submits requests to.
-                              Cannot be updated.
-                              In CamelCase.
-                              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-                            type: string
-                          metadata:
-                            description: EmbeddedMetadata contains metadata relevant
-                              to an EmbeddedResource.
-                            properties:
-                              annotations:
-                                additionalProperties:
-                                  type: string
-                                description: |-
-                                  Annotations is an unstructured key value map stored with a resource that may be
-                                  set by external tools to store and retrieve arbitrary metadata. They are not
-                                  queryable and should be preserved when modifying objects.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                                type: object
-                              labels:
-                                additionalProperties:
-                                  type: string
-                                description: |-
-                                  Labels Map of string keys and values that can be used to organize and categorize
-                                  (scope and select) objects. May match selectors of replication controllers
-                                  and services.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                                type: object
-                              name:
-                                description: |-
-                                  Name must be unique within a namespace. Is required when creating resources, although
-                                  some resources may allow a client to request the generation of an appropriate name
-                                  automatically. Name is primarily intended for creation idempotence and configuration
-                                  definition.
-                                  Cannot be updated.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                                type: string
-                            type: object
-                          spec:
-                            description: |-
-                              Spec defines the desired characteristics of a volume requested by a pod author.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
-                            properties:
-                              accessModes:
-                                description: |-
-                                  accessModes contains the desired access modes the volume should have.
-                                  More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                                items:
-                                  type: string
-                                type: array
-                                x-kubernetes-list-type: atomic
-                              dataSource:
-                                description: |-
-                                  dataSource field can be used to specify either:
-                                  * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
-                                  * An existing PVC (PersistentVolumeClaim)
-                                  If the provisioner or an external controller can support the specified data source,
-                                  it will create a new volume based on the contents of the specified data source.
-                                  When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-                                  and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
-                                  If the namespace is specified, then dataSourceRef will not be copied to dataSource.
-                                properties:
-                                  apiGroup:
-                                    description: |-
-                                      APIGroup is the group for the resource being referenced.
-                                      If APIGroup is not specified, the specified Kind must be in the core API group.
-                                      For any other third-party types, APIGroup is required.
-                                    type: string
-                                  kind:
-                                    description: Kind is the type of resource being
-                                      referenced
-                                    type: string
-                                  name:
-                                    description: Name is the name of resource being
-                                      referenced
-                                    type: string
-                                required:
-                                - kind
-                                - name
-                                type: object
-                                x-kubernetes-map-type: atomic
-                              dataSourceRef:
-                                description: |-
-                                  dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
-                                  volume is desired. This may be any object from a non-empty API group (non
-                                  core object) or a PersistentVolumeClaim object.
-                                  When this field is specified, volume binding will only succeed if the type of
-                                  the specified object matches some installed volume populator or dynamic
-                                  provisioner.
-                                  This field will replace the functionality of the dataSource field and as such
-                                  if both fields are non-empty, they must have the same value. For backwards
-                                  compatibility, when namespace isn't specified in dataSourceRef,
-                                  both fields (dataSource and dataSourceRef) will be set to the same
-                                  value automatically if one of them is empty and the other is non-empty.
-                                  When namespace is specified in dataSourceRef,
-                                  dataSource isn't set to the same value and must be empty.
-                                  There are three important differences between dataSource and dataSourceRef:
-                                  * While dataSource only allows two specific types of objects, dataSourceRef
-                                    allows any non-core object, as well as PersistentVolumeClaim objects.
-                                  * While dataSource ignores disallowed values (dropping them), dataSourceRef
-                                    preserves all values, and generates an error if a disallowed value is
-                                    specified.
-                                  * While dataSource only allows local objects, dataSourceRef allows objects
-                                    in any namespaces.
-                                  (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
-                                  (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                                properties:
-                                  apiGroup:
-                                    description: |-
-                                      APIGroup is the group for the resource being referenced.
-                                      If APIGroup is not specified, the specified Kind must be in the core API group.
-                                      For any other third-party types, APIGroup is required.
-                                    type: string
-                                  kind:
-                                    description: Kind is the type of resource being
-                                      referenced
-                                    type: string
-                                  name:
-                                    description: Name is the name of resource being
-                                      referenced
-                                    type: string
-                                  namespace:
-                                    description: |-
-                                      Namespace is the namespace of resource being referenced
-                                      Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
-                                      (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                                    type: string
-                                required:
-                                - kind
-                                - name
-                                type: object
-                              resources:
-                                description: |-
-                                  resources represents the minimum resources the volume should have.
-                                  If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
-                                  that are lower than previous value but must still be higher than capacity recorded in the
-                                  status field of the claim.
-                                  More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
-                                properties:
-                                  limits:
-                                    additionalProperties:
-                                      anyOf:
-                                      - type: integer
-                                      - type: string
-                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                      x-kubernetes-int-or-string: true
-                                    description: |-
-                                      Limits describes the maximum amount of compute resources allowed.
-                                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                                    type: object
-                                  requests:
-                                    additionalProperties:
-                                      anyOf:
-                                      - type: integer
-                                      - type: string
-                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                      x-kubernetes-int-or-string: true
-                                    description: |-
-                                      Requests describes the minimum amount of compute resources required.
-                                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                                    type: object
-                                type: object
-                              selector:
-                                description: selector is a label query over volumes
-                                  to consider for binding.
-                                properties:
-                                  matchExpressions:
-                                    description: matchExpressions is a list of label
-                                      selector requirements. The requirements are
-                                      ANDed.
-                                    items:
-                                      description: |-
-                                        A label selector requirement is a selector that contains values, a key, and an operator that
-                                        relates the key and values.
-                                      properties:
-                                        key:
-                                          description: key is the label key that the
-                                            selector applies to.
-                                          type: string
-                                        operator:
-                                          description: |-
-                                            operator represents a key's relationship to a set of values.
-                                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                                          type: string
-                                        values:
-                                          description: |-
-                                            values is an array of string values. If the operator is In or NotIn,
-                                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                            the values array must be empty. This array is replaced during a strategic
-                                            merge patch.
-                                          items:
-                                            type: string
-                                          type: array
-                                          x-kubernetes-list-type: atomic
-                                      required:
-                                      - key
-                                      - operator
-                                      type: object
-                                    type: array
-                                    x-kubernetes-list-type: atomic
-                                  matchLabels:
-                                    additionalProperties:
-                                      type: string
-                                    description: |-
-                                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                    type: object
-                                type: object
-                                x-kubernetes-map-type: atomic
-                              storageClassName:
-                                description: |-
-                                  storageClassName is the name of the StorageClass required by the claim.
-                                  More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
-                                type: string
-                              volumeAttributesClassName:
-                                description: |-
-                                  volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
-                                  If specified, the CSI driver will create or update the volume with the attributes defined
-                                  in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                  it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                  will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                  If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                  will be set by the persistentvolume controller if it exists.
-                                  If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
-                                  set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
-                                  exists.
-                                  More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                  (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
-                                type: string
-                              volumeMode:
-                                description: |-
-                                  volumeMode defines what type of volume is required by the claim.
-                                  Value of Filesystem is implied when not included in claim spec.
-                                type: string
-                              volumeName:
-                                description: volumeName is the binding reference to
-                                  the PersistentVolume backing this claim.
-                                type: string
-                            type: object
-                          status:
-                            description: |-
-                              Status represents the current information/status of a persistent volume claim.
-                              Read-only.
-                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
-                            properties:
-                              accessModes:
-                                description: |-
-                                  accessModes contains the actual access modes the volume backing the PVC has.
-                                  More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                                items:
-                                  type: string
-                                type: array
-                                x-kubernetes-list-type: atomic
-                              allocatedResourceStatuses:
-                                additionalProperties:
-                                  description: |-
-                                    When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource
-                                    that it does not recognizes, then it should ignore that update and let other controllers
-                                    handle it.
-                                  type: string
-                                description: "allocatedResourceStatuses stores status
-                                  of resource being resized for the given PVC.\nKey
-                                  names follow standard Kubernetes label syntax. Valid
-                                  values are either:\n\t* Un-prefixed keys:\n\t\t-
-                                  storage - the capacity of the volume.\n\t* Custom
-                                  resources must use implementation-defined prefixed
-                                  names such as \"example.com/my-custom-resource\"\nApart
-                                  from above values - keys that are unprefixed or
-                                  have kubernetes.io prefix are considered\nreserved
-                                  and hence may not be used.\n\nClaimResourceStatus
-                                  can be in any of following states:\n\t- ControllerResizeInProgress:\n\t\tState
-                                  set when resize controller starts resizing the volume
-                                  in control-plane.\n\t- ControllerResizeFailed:\n\t\tState
-                                  set when resize has failed in resize controller
-                                  with a terminal error.\n\t- NodeResizePending:\n\t\tState
-                                  set when resize controller has finished resizing
-                                  the volume but further resizing of\n\t\tvolume is
-                                  needed on the node.\n\t- NodeResizeInProgress:\n\t\tState
-                                  set when kubelet starts resizing the volume.\n\t-
-                                  NodeResizeFailed:\n\t\tState set when resizing has
-                                  failed in kubelet with a terminal error. Transient
-                                  errors don't set\n\t\tNodeResizeFailed.\nFor example:
-                                  if expanding a PVC for more capacity - this field
-                                  can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage']
-                                  = \"ControllerResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                  = \"ControllerResizeFailed\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                  = \"NodeResizePending\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                  = \"NodeResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                  = \"NodeResizeFailed\"\nWhen this field is not set,
-                                  it means that no resize operation is in progress
-                                  for the given PVC.\n\nA controller that receives
-                                  PVC update with previously unknown resourceName
-                                  or ClaimResourceStatus\nshould ignore the update
-                                  for the purpose it was designed. For example - a
-                                  controller that\nonly is responsible for resizing
-                                  capacity of the volume, should ignore PVC updates
-                                  that change other valid\nresources associated with
-                                  PVC.\n\nThis is an alpha field and requires enabling
-                                  RecoverVolumeExpansionFailure feature."
-                                type: object
-                                x-kubernetes-map-type: granular
-                              allocatedResources:
-                                additionalProperties:
-                                  anyOf:
-                                  - type: integer
-                                  - type: string
-                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                  x-kubernetes-int-or-string: true
-                                description: "allocatedResources tracks the resources
-                                  allocated to a PVC including its capacity.\nKey
-                                  names follow standard Kubernetes label syntax. Valid
-                                  values are either:\n\t* Un-prefixed keys:\n\t\t-
-                                  storage - the capacity of the volume.\n\t* Custom
-                                  resources must use implementation-defined prefixed
-                                  names such as \"example.com/my-custom-resource\"\nApart
-                                  from above values - keys that are unprefixed or
-                                  have kubernetes.io prefix are considered\nreserved
-                                  and hence may not be used.\n\nCapacity reported
-                                  here may be larger than the actual capacity when
-                                  a volume expansion operation\nis requested.\nFor
-                                  storage quota, the larger value from allocatedResources
-                                  and PVC.spec.resources is used.\nIf allocatedResources
-                                  is not set, PVC.spec.resources alone is used for
-                                  quota calculation.\nIf a volume expansion capacity
-                                  request is lowered, allocatedResources is only\nlowered
-                                  if there are no expansion operations in progress
-                                  and if the actual volume capacity\nis equal or lower
-                                  than the requested capacity.\n\nA controller that
-                                  receives PVC update with previously unknown resourceName\nshould
-                                  ignore the update for the purpose it was designed.
-                                  For example - a controller that\nonly is responsible
-                                  for resizing capacity of the volume, should ignore
-                                  PVC updates that change other valid\nresources associated
-                                  with PVC.\n\nThis is an alpha field and requires
-                                  enabling RecoverVolumeExpansionFailure feature."
-                                type: object
-                              capacity:
-                                additionalProperties:
-                                  anyOf:
-                                  - type: integer
-                                  - type: string
-                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                  x-kubernetes-int-or-string: true
-                                description: capacity represents the actual resources
-                                  of the underlying volume.
-                                type: object
-                              conditions:
-                                description: |-
-                                  conditions is the current Condition of persistent volume claim. If underlying persistent volume is being
-                                  resized then the Condition will be set to 'Resizing'.
-                                items:
-                                  description: PersistentVolumeClaimCondition contains
-                                    details about state of pvc
-                                  properties:
-                                    lastProbeTime:
-                                      description: lastProbeTime is the time we probed
-                                        the condition.
-                                      format: date-time
-                                      type: string
-                                    lastTransitionTime:
-                                      description: lastTransitionTime is the time
-                                        the condition transitioned from one status
-                                        to another.
-                                      format: date-time
-                                      type: string
-                                    message:
-                                      description: message is the human-readable message
-                                        indicating details about last transition.
-                                      type: string
-                                    reason:
-                                      description: |-
-                                        reason is a unique, this should be a short, machine understandable string that gives the reason
-                                        for condition's last transition. If it reports "Resizing" that means the underlying
-                                        persistent volume is being resized.
-                                      type: string
-                                    status:
-                                      description: |-
-                                        Status is the status of the condition.
-                                        Can be True, False, Unknown.
-                                        More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required
-                                      type: string
-                                    type:
-                                      description: |-
-                                        Type is the type of the condition.
-                                        More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about
-                                      type: string
-                                  required:
-                                  - status
-                                  - type
-                                  type: object
-                                type: array
-                                x-kubernetes-list-map-keys:
-                                - type
-                                x-kubernetes-list-type: map
-                              currentVolumeAttributesClassName:
-                                description: |-
-                                  currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
-                                  When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                                  This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
-                                type: string
-                              modifyVolumeStatus:
-                                description: |-
-                                  ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
-                                  When this is unset, there is no ModifyVolume operation being attempted.
-                                  This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
-                                properties:
-                                  status:
-                                    description: "status is the status of the ControllerModifyVolume
-                                      operation. It can be in any of following states:\n
-                                      - Pending\n   Pending indicates that the PersistentVolumeClaim
-                                      cannot be modified due to unmet requirements,
-                                      such as\n   the specified VolumeAttributesClass
-                                      not existing.\n - InProgress\n   InProgress
-                                      indicates that the volume is being modified.\n
-                                      - Infeasible\n  Infeasible indicates that the
-                                      request has been rejected as invalid by the
-                                      CSI driver. To\n\t  resolve the error, a valid
-                                      VolumeAttributesClass needs to be specified.\nNote:
-                                      New statuses can be added in the future. Consumers
-                                      should check for unknown statuses and fail appropriately."
-                                    type: string
-                                  targetVolumeAttributesClassName:
-                                    description: targetVolumeAttributesClassName is
-                                      the name of the VolumeAttributesClass the PVC
-                                      currently being reconciled
-                                    type: string
-                                required:
-                                - status
-                                type: object
-                              phase:
-                                description: phase represents the current phase of
-                                  PersistentVolumeClaim.
-                                type: string
-                            type: object
-                        type: object
-                    type: object
-                  terminationGracePeriodSeconds:
-                    description: TerminationGracePeriodSeconds period for container
-                      graceful termination
-                    format: int64
-                    type: integer
-                  tolerations:
-                    description: Tolerations If specified, the pod's tolerations.
-                    items:
-                      description: |-
-                        The pod this Toleration is attached to tolerates any taint that matches
-                        the triple <key,value,effect> using the matching operator <operator>.
-                      properties:
-                        effect:
-                          description: |-
-                            Effect indicates the taint effect to match. Empty means match all taint effects.
-                            When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                          type: string
-                        key:
-                          description: |-
-                            Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                            If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                          type: string
-                        operator:
-                          description: |-
-                            Operator represents a key's relationship to the value.
-                            Valid operators are Exists and Equal. Defaults to Equal.
-                            Exists is equivalent to wildcard for value, so that a pod can
-                            tolerate all taints of a particular category.
-                          type: string
-                        tolerationSeconds:
-                          description: |-
-                            TolerationSeconds represents the period of time the toleration (which must be
-                            of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                            it is not set, which means tolerate the taint forever (do not evict). Zero and
-                            negative values will be treated as 0 (evict immediately) by the system.
-                          format: int64
-                          type: integer
-                        value:
-                          description: |-
-                            Value is the taint value the toleration matches to.
-                            If the operator is Exists, the value should be empty, otherwise just a regular string.
-                          type: string
-                      type: object
-                    type: array
-                  topologySpreadConstraints:
-                    description: |-
-                      TopologySpreadConstraints embedded kubernetes pod configuration option,
-                      controls how pods are spread across your cluster among failure-domains
-                      such as regions, zones, nodes, and other user-defined topology domains
-                      https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
-                    items:
-                      description: TopologySpreadConstraint specifies how to spread
-                        matching pods among the given topology.
-                      required:
-                      - maxSkew
-                      - topologyKey
-                      - whenUnsatisfiable
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    type: array
-                  useDefaultResources:
-                    description: |-
-                      UseDefaultResources controls resource settings
-                      By default, operator sets built-in resource requirements
-                    type: boolean
-                  useStrictSecurity:
-                    description: |-
-                      UseStrictSecurity enables strict security mode for component
-                      it restricts disk writes access
-                      uses non-root user out of the box
-                      drops not needed security permissions
-                    type: boolean
-                  volumeMounts:
-                    description: |-
-                      VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
-                      VolumeMounts specified will be appended to other VolumeMounts in the Application container
-                    items:
-                      description: VolumeMount describes a mounting of a Volume within
-                        a container.
-                      properties:
-                        mountPath:
-                          description: |-
-                            Path within the container at which the volume should be mounted.  Must
-                            not contain ':'.
-                          type: string
-                        mountPropagation:
-                          description: |-
-                            mountPropagation determines how mounts are propagated from the host
-                            to container and the other way around.
-                            When not set, MountPropagationNone is used.
-                            This field is beta in 1.10.
-                            When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                            (which defaults to None).
-                          type: string
-                        name:
-                          description: This must match the Name of a Volume.
-                          type: string
-                        readOnly:
-                          description: |-
-                            Mounted read-only if true, read-write otherwise (false or unspecified).
-                            Defaults to false.
-                          type: boolean
-                        recursiveReadOnly:
-                          description: |-
-                            RecursiveReadOnly specifies whether read-only mounts should be handled
-                            recursively.
-
-                            If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                            If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                            recursively read-only.  If this field is set to IfPossible, the mount is made
-                            recursively read-only, if it is supported by the container runtime.  If this
-                            field is set to Enabled, the mount is made recursively read-only if it is
-                            supported by the container runtime, otherwise the pod will not be started and
-                            an error will be generated to indicate the reason.
-
-                            If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                            None (or be unspecified, which defaults to None).
-
-                            If this field is not specified, it is treated as an equivalent of Disabled.
-                          type: string
-                        subPath:
-                          description: |-
-                            Path within the volume from which the container's volume should be mounted.
-                            Defaults to "" (volume's root).
-                          type: string
-                        subPathExpr:
-                          description: |-
-                            Expanded path within the volume from which the container's volume should be mounted.
-                            Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                            Defaults to "" (volume's root).
-                            SubPathExpr and SubPath are mutually exclusive.
-                          type: string
-                      required:
-                      - mountPath
-                      - name
-                      type: object
-                    type: array
-                  volumes:
-                    description: |-
-                      Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
-                      Volumes specified will be appended to other volumes that are generated.
-                      / +optional
-                    items:
-                      description: Volume represents a named volume in a pod that
-                        may be accessed by any container in the pod.
-                      required:
-                      - name
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    type: array
-                type: object
-              vmstorage:
-                properties:
-                  affinity:
-                    description: Affinity If specified, the pod's scheduling constraints.
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  claimTemplates:
-                    description: ClaimTemplates allows adding additional VolumeClaimTemplates
-                      for StatefulSet
-                    items:
-                      description: PersistentVolumeClaim is a user's request for and
-                        claim to a persistent volume
-                      properties:
-                        apiVersion:
-                          description: |-
-                            APIVersion defines the versioned schema of this representation of an object.
-                            Servers should convert recognized schemas to the latest internal value, and
-                            may reject unrecognized values.
-                            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-                          type: string
-                        kind:
-                          description: |-
-                            Kind is a string value representing the REST resource this object represents.
-                            Servers may infer this from the endpoint the client submits requests to.
-                            Cannot be updated.
-                            In CamelCase.
-                            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-                          type: string
-                        metadata:
-                          description: |-
-                            Standard object's metadata.
-                            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-                          type: object
-                          x-kubernetes-preserve-unknown-fields: true
-                        spec:
-                          description: |-
-                            spec defines the desired characteristics of a volume requested by a pod author.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
-                          properties:
-                            accessModes:
-                              description: |-
-                                accessModes contains the desired access modes the volume should have.
-                                More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                              items:
-                                type: string
-                              type: array
-                              x-kubernetes-list-type: atomic
-                            dataSource:
-                              description: |-
-                                dataSource field can be used to specify either:
-                                * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
-                                * An existing PVC (PersistentVolumeClaim)
-                                If the provisioner or an external controller can support the specified data source,
-                                it will create a new volume based on the contents of the specified data source.
-                                When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-                                and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
-                                If the namespace is specified, then dataSourceRef will not be copied to dataSource.
-                              properties:
-                                apiGroup:
-                                  description: |-
-                                    APIGroup is the group for the resource being referenced.
-                                    If APIGroup is not specified, the specified Kind must be in the core API group.
-                                    For any other third-party types, APIGroup is required.
-                                  type: string
-                                kind:
-                                  description: Kind is the type of resource being
-                                    referenced
-                                  type: string
-                                name:
-                                  description: Name is the name of resource being
-                                    referenced
-                                  type: string
-                              required:
-                              - kind
-                              - name
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            dataSourceRef:
-                              description: |-
-                                dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
-                                volume is desired. This may be any object from a non-empty API group (non
-                                core object) or a PersistentVolumeClaim object.
-                                When this field is specified, volume binding will only succeed if the type of
-                                the specified object matches some installed volume populator or dynamic
-                                provisioner.
-                                This field will replace the functionality of the dataSource field and as such
-                                if both fields are non-empty, they must have the same value. For backwards
-                                compatibility, when namespace isn't specified in dataSourceRef,
-                                both fields (dataSource and dataSourceRef) will be set to the same
-                                value automatically if one of them is empty and the other is non-empty.
-                                When namespace is specified in dataSourceRef,
-                                dataSource isn't set to the same value and must be empty.
-                                There are three important differences between dataSource and dataSourceRef:
-                                * While dataSource only allows two specific types of objects, dataSourceRef
-                                  allows any non-core object, as well as PersistentVolumeClaim objects.
-                                * While dataSource ignores disallowed values (dropping them), dataSourceRef
-                                  preserves all values, and generates an error if a disallowed value is
-                                  specified.
-                                * While dataSource only allows local objects, dataSourceRef allows objects
-                                  in any namespaces.
-                                (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
-                                (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                              properties:
-                                apiGroup:
-                                  description: |-
-                                    APIGroup is the group for the resource being referenced.
-                                    If APIGroup is not specified, the specified Kind must be in the core API group.
-                                    For any other third-party types, APIGroup is required.
-                                  type: string
-                                kind:
-                                  description: Kind is the type of resource being
-                                    referenced
-                                  type: string
-                                name:
-                                  description: Name is the name of resource being
-                                    referenced
-                                  type: string
-                                namespace:
-                                  description: |-
-                                    Namespace is the namespace of resource being referenced
-                                    Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
-                                    (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                                  type: string
-                              required:
-                              - kind
-                              - name
-                              type: object
-                            resources:
-                              description: |-
-                                resources represents the minimum resources the volume should have.
-                                If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
-                                that are lower than previous value but must still be higher than capacity recorded in the
-                                status field of the claim.
-                                More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
-                              properties:
-                                limits:
-                                  additionalProperties:
-                                    anyOf:
-                                    - type: integer
-                                    - type: string
-                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                    x-kubernetes-int-or-string: true
-                                  description: |-
-                                    Limits describes the maximum amount of compute resources allowed.
-                                    More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                                  type: object
-                                requests:
-                                  additionalProperties:
-                                    anyOf:
-                                    - type: integer
-                                    - type: string
-                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                    x-kubernetes-int-or-string: true
-                                  description: |-
-                                    Requests describes the minimum amount of compute resources required.
-                                    If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                                    otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                                    More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                                  type: object
-                              type: object
-                            selector:
-                              description: selector is a label query over volumes
-                                to consider for binding.
-                              properties:
-                                matchExpressions:
-                                  description: matchExpressions is a list of label
-                                    selector requirements. The requirements are ANDed.
-                                  items:
-                                    description: |-
-                                      A label selector requirement is a selector that contains values, a key, and an operator that
-                                      relates the key and values.
-                                    properties:
-                                      key:
-                                        description: key is the label key that the
-                                          selector applies to.
-                                        type: string
-                                      operator:
-                                        description: |-
-                                          operator represents a key's relationship to a set of values.
-                                          Valid operators are In, NotIn, Exists and DoesNotExist.
-                                        type: string
-                                      values:
-                                        description: |-
-                                          values is an array of string values. If the operator is In or NotIn,
-                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                          the values array must be empty. This array is replaced during a strategic
-                                          merge patch.
-                                        items:
-                                          type: string
-                                        type: array
-                                        x-kubernetes-list-type: atomic
-                                    required:
-                                    - key
-                                    - operator
-                                    type: object
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                matchLabels:
-                                  additionalProperties:
-                                    type: string
-                                  description: |-
-                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                  type: object
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            storageClassName:
-                              description: |-
-                                storageClassName is the name of the StorageClass required by the claim.
-                                More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
-                              type: string
-                            volumeAttributesClassName:
-                              description: |-
-                                volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
-                                If specified, the CSI driver will create or update the volume with the attributes defined
-                                in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                will be set by the persistentvolume controller if it exists.
-                                If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
-                                set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
-                                exists.
-                                More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
-                              type: string
-                            volumeMode:
-                              description: |-
-                                volumeMode defines what type of volume is required by the claim.
-                                Value of Filesystem is implied when not included in claim spec.
-                              type: string
-                            volumeName:
-                              description: volumeName is the binding reference to
-                                the PersistentVolume backing this claim.
-                              type: string
-                          type: object
-                        status:
-                          description: |-
-                            status represents the current information/status of a persistent volume claim.
-                            Read-only.
-                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
-                          properties:
-                            accessModes:
-                              description: |-
-                                accessModes contains the actual access modes the volume backing the PVC has.
-                                More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                              items:
-                                type: string
-                              type: array
-                              x-kubernetes-list-type: atomic
-                            allocatedResourceStatuses:
-                              additionalProperties:
-                                description: |-
-                                  When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource
-                                  that it does not recognizes, then it should ignore that update and let other controllers
-                                  handle it.
-                                type: string
-                              description: "allocatedResourceStatuses stores status
-                                of resource being resized for the given PVC.\nKey
-                                names follow standard Kubernetes label syntax. Valid
-                                values are either:\n\t* Un-prefixed keys:\n\t\t- storage
-                                - the capacity of the volume.\n\t* Custom resources
-                                must use implementation-defined prefixed names such
-                                as \"example.com/my-custom-resource\"\nApart from
-                                above values - keys that are unprefixed or have kubernetes.io
-                                prefix are considered\nreserved and hence may not
-                                be used.\n\nClaimResourceStatus can be in any of following
-                                states:\n\t- ControllerResizeInProgress:\n\t\tState
-                                set when resize controller starts resizing the volume
-                                in control-plane.\n\t- ControllerResizeFailed:\n\t\tState
-                                set when resize has failed in resize controller with
-                                a terminal error.\n\t- NodeResizePending:\n\t\tState
-                                set when resize controller has finished resizing the
-                                volume but further resizing of\n\t\tvolume is needed
-                                on the node.\n\t- NodeResizeInProgress:\n\t\tState
-                                set when kubelet starts resizing the volume.\n\t-
-                                NodeResizeFailed:\n\t\tState set when resizing has
-                                failed in kubelet with a terminal error. Transient
-                                errors don't set\n\t\tNodeResizeFailed.\nFor example:
-                                if expanding a PVC for more capacity - this field
-                                can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage']
-                                = \"ControllerResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                = \"ControllerResizeFailed\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                = \"NodeResizePending\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                = \"NodeResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage']
-                                = \"NodeResizeFailed\"\nWhen this field is not set,
-                                it means that no resize operation is in progress for
-                                the given PVC.\n\nA controller that receives PVC update
-                                with previously unknown resourceName or ClaimResourceStatus\nshould
-                                ignore the update for the purpose it was designed.
-                                For example - a controller that\nonly is responsible
-                                for resizing capacity of the volume, should ignore
-                                PVC updates that change other valid\nresources associated
-                                with PVC.\n\nThis is an alpha field and requires enabling
-                                RecoverVolumeExpansionFailure feature."
-                              type: object
-                              x-kubernetes-map-type: granular
-                            allocatedResources:
-                              additionalProperties:
-                                anyOf:
-                                - type: integer
-                                - type: string
-                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                x-kubernetes-int-or-string: true
-                              description: "allocatedResources tracks the resources
-                                allocated to a PVC including its capacity.\nKey names
-                                follow standard Kubernetes label syntax. Valid values
-                                are either:\n\t* Un-prefixed keys:\n\t\t- storage
-                                - the capacity of the volume.\n\t* Custom resources
-                                must use implementation-defined prefixed names such
-                                as \"example.com/my-custom-resource\"\nApart from
-                                above values - keys that are unprefixed or have kubernetes.io
-                                prefix are considered\nreserved and hence may not
-                                be used.\n\nCapacity reported here may be larger than
-                                the actual capacity when a volume expansion operation\nis
-                                requested.\nFor storage quota, the larger value from
-                                allocatedResources and PVC.spec.resources is used.\nIf
-                                allocatedResources is not set, PVC.spec.resources
-                                alone is used for quota calculation.\nIf a volume
-                                expansion capacity request is lowered, allocatedResources
-                                is only\nlowered if there are no expansion operations
-                                in progress and if the actual volume capacity\nis
-                                equal or lower than the requested capacity.\n\nA controller
-                                that receives PVC update with previously unknown resourceName\nshould
-                                ignore the update for the purpose it was designed.
-                                For example - a controller that\nonly is responsible
-                                for resizing capacity of the volume, should ignore
-                                PVC updates that change other valid\nresources associated
-                                with PVC.\n\nThis is an alpha field and requires enabling
-                                RecoverVolumeExpansionFailure feature."
-                              type: object
-                            capacity:
-                              additionalProperties:
-                                anyOf:
-                                - type: integer
-                                - type: string
-                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                x-kubernetes-int-or-string: true
-                              description: capacity represents the actual resources
-                                of the underlying volume.
-                              type: object
-                            conditions:
-                              description: |-
-                                conditions is the current Condition of persistent volume claim. If underlying persistent volume is being
-                                resized then the Condition will be set to 'Resizing'.
-                              items:
-                                description: PersistentVolumeClaimCondition contains
-                                  details about state of pvc
-                                properties:
-                                  lastProbeTime:
-                                    description: lastProbeTime is the time we probed
-                                      the condition.
-                                    format: date-time
-                                    type: string
-                                  lastTransitionTime:
-                                    description: lastTransitionTime is the time the
-                                      condition transitioned from one status to another.
-                                    format: date-time
-                                    type: string
-                                  message:
-                                    description: message is the human-readable message
-                                      indicating details about last transition.
-                                    type: string
-                                  reason:
-                                    description: |-
-                                      reason is a unique, this should be a short, machine understandable string that gives the reason
-                                      for condition's last transition. If it reports "Resizing" that means the underlying
-                                      persistent volume is being resized.
-                                    type: string
-                                  status:
-                                    description: |-
-                                      Status is the status of the condition.
-                                      Can be True, False, Unknown.
-                                      More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required
-                                    type: string
-                                  type:
-                                    description: |-
-                                      Type is the type of the condition.
-                                      More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about
-                                    type: string
-                                required:
-                                - status
-                                - type
-                                type: object
-                              type: array
-                              x-kubernetes-list-map-keys:
-                              - type
-                              x-kubernetes-list-type: map
-                            currentVolumeAttributesClassName:
-                              description: |-
-                                currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
-                                When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                                This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
-                              type: string
-                            modifyVolumeStatus:
-                              description: |-
-                                ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
-                                When this is unset, there is no ModifyVolume operation being attempted.
-                                This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
-                              properties:
-                                status:
-                                  description: "status is the status of the ControllerModifyVolume
-                                    operation. It can be in any of following states:\n
-                                    - Pending\n   Pending indicates that the PersistentVolumeClaim
-                                    cannot be modified due to unmet requirements,
-                                    such as\n   the specified VolumeAttributesClass
-                                    not existing.\n - InProgress\n   InProgress indicates
-                                    that the volume is being modified.\n - Infeasible\n
-                                    \ Infeasible indicates that the request has been
-                                    rejected as invalid by the CSI driver. To\n\t
-                                    \ resolve the error, a valid VolumeAttributesClass
-                                    needs to be specified.\nNote: New statuses can
-                                    be added in the future. Consumers should check
-                                    for unknown statuses and fail appropriately."
-                                  type: string
-                                targetVolumeAttributesClassName:
-                                  description: targetVolumeAttributesClassName is
-                                    the name of the VolumeAttributesClass the PVC
-                                    currently being reconciled
-                                  type: string
-                              required:
-                              - status
-                              type: object
-                            phase:
-                              description: phase represents the current phase of PersistentVolumeClaim.
-                              type: string
-                          type: object
-                      type: object
-                    type: array
-                  configMaps:
-                    description: |-
-                      ConfigMaps is a list of ConfigMaps in the same namespace as the Application
-                      object, which shall be mounted into the Application container
-                      at /etc/vm/configs/CONFIGMAP_NAME folder
-                    items:
-                      type: string
-                    type: array
-                  containers:
-                    description: |-
-                      Containers property allows to inject additions sidecars or to patch existing containers.
-                      It can be useful for proxies, backup, etc.
-                    items:
-                      description: A single application container that you want to
-                        run within a pod.
-                      required:
-                      - name
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    type: array
-                  disableAutomountServiceAccountToken:
-                    description: |-
-                      DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
-                      Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
-                      For example, vmagent and vm-config-reloader requires k8s API access.
-                      Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
-                      And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
-                    type: boolean
-                  disableSelfServiceScrape:
-                    description: |-
-                      DisableSelfServiceScrape controls creation of VMServiceScrape by operator
-                      for the application.
-                      Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable
-                    type: boolean
-                  dnsConfig:
-                    description: |-
-                      Specifies the DNS parameters of a pod.
-                      Parameters specified here will be merged to the generated DNS
-                      configuration based on DNSPolicy.
-                    items:
-                      x-kubernetes-preserve-unknown-fields: true
-                    properties:
-                      nameservers:
-                        description: |-
-                          A list of DNS name server IP addresses.
-                          This will be appended to the base nameservers generated from DNSPolicy.
-                          Duplicated nameservers will be removed.
-                        items:
-                          type: string
-                        type: array
-                        x-kubernetes-list-type: atomic
-                      options:
-                        description: |-
-                          A list of DNS resolver options.
-                          This will be merged with the base options generated from DNSPolicy.
-                          Duplicated entries will be removed. Resolution options given in Options
-                          will override those that appear in the base DNSPolicy.
-                        items:
-                          description: PodDNSConfigOption defines DNS resolver options
-                            of a pod.
-                          properties:
-                            name:
-                              description: |-
-                                Name is this DNS resolver option's name.
-                                Required.
-                              type: string
-                            value:
-                              description: Value is this DNS resolver option's value.
-                              type: string
-                          type: object
-                        type: array
-                        x-kubernetes-list-type: atomic
-                      searches:
-                        description: |-
-                          A list of DNS search domains for host-name lookup.
-                          This will be appended to the base search paths generated from DNSPolicy.
-                          Duplicated search paths will be removed.
-                        items:
-                          type: string
-                        type: array
-                        x-kubernetes-list-type: atomic
-                    type: object
-                  dnsPolicy:
-                    description: DNSPolicy sets DNS policy for the pod
-                    type: string
-                  extraArgs:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      ExtraArgs that will be passed to the application container
-                      for example remoteWrite.tmpDataPath: /tmp
-                    type: object
-                  extraEnvs:
-                    description: ExtraEnvs that will be passed to the application
-                      container
-                    items:
-                      description: EnvVar represents an environment variable present
-                        in a Container.
-                      properties:
-                        name:
-                          description: Name of the environment variable. Must be a
-                            C_IDENTIFIER.
-                          type: string
-                        value:
-                          description: |-
-                            Variable references $(VAR_NAME) are expanded
-                            using the previously defined environment variables in the container and
-                            any service environment variables. If a variable cannot be resolved,
-                            the reference in the input string will be unchanged. Double $$ are reduced
-                            to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                            "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                            Escaped references will never be expanded, regardless of whether the variable
-                            exists or not.
-                            Defaults to "".
-                          type: string
-                      required:
-                      - name
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    type: array
-                  extraEnvsFrom:
-                    description: |-
-                      ExtraEnvsFrom defines source of env variables for the application container
-                      could either be secret or configmap
-                    items:
-                      description: EnvFromSource represents the source of a set of
-                        ConfigMaps
-                      properties:
-                        configMapRef:
-                          description: The ConfigMap to select from
-                          properties:
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the ConfigMap must be defined
-                              type: boolean
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        prefix:
-                          description: An optional identifier to prepend to each key
-                            in the ConfigMap. Must be a C_IDENTIFIER.
-                          type: string
-                        secretRef:
-                          description: The Secret to select from
-                          properties:
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret must be defined
-                              type: boolean
-                          type: object
-                          x-kubernetes-map-type: atomic
-                      type: object
-                    type: array
-                  host_aliases:
-                    description: |-
-                      HostAliasesUnderScore provides mapping for ip and hostname,
-                      that would be propagated to pod,
-                      cannot be used with HostNetwork.
-                      Has Priority over hostAliases field
-                    items:
-                      description: |-
-                        HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                        pod's hosts file.
-                      properties:
-                        hostnames:
-                          description: Hostnames for the above IP address.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                        ip:
-                          description: IP address of the host file entry.
-                          type: string
-                      required:
-                      - ip
-                      type: object
-                    type: array
-                  hostAliases:
-                    description: |-
-                      HostAliases provides mapping for ip and hostname,
-                      that would be propagated to pod,
-                      cannot be used with HostNetwork.
-                    items:
-                      description: |-
-                        HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                        pod's hosts file.
-                      properties:
-                        hostnames:
-                          description: Hostnames for the above IP address.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                        ip:
-                          description: IP address of the host file entry.
-                          type: string
-                      required:
-                      - ip
-                      type: object
-                    type: array
-                  hostNetwork:
-                    description: HostNetwork controls whether the pod may use the
-                      node network namespace
-                    type: boolean
-                  image:
-                    description: |-
-                      Image - docker image settings
-                      if no specified operator uses default version from operator config
-                    properties:
-                      pullPolicy:
-                        description: PullPolicy describes how to pull docker image
-                        type: string
-                      repository:
-                        description: Repository contains name of docker image + it's
-                          repository if needed
-                        type: string
-                      tag:
-                        description: Tag contains desired docker image version
-                        type: string
-                    type: object
-                  imagePullSecrets:
-                    description: |-
-                      ImagePullSecrets An optional list of references to secrets in the same namespace
-                      to use for pulling images from registries
-                      see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
-                    items:
-                      description: |-
-                        LocalObjectReference contains enough information to let you locate the
-                        referenced object inside the same namespace.
-                      properties:
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    type: array
-                  initContainers:
-                    description: |-
-                      InitContainers allows adding initContainers to the pod definition.
-                      Any errors during the execution of an initContainer will lead to a restart of the Pod.
-                      More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
-                    items:
-                      description: A single application container that you want to
-                        run within a pod.
-                      required:
-                      - name
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    type: array
-                  livenessProbe:
-                    description: LivenessProbe that will be added CRD pod
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  logFormat:
-                    description: |-
-                      LogFormat for VMStorage to be configured with.
-                      default or json
-                    enum:
-                    - default
-                    - json
-                    type: string
-                  logLevel:
-                    description: LogLevel for VMStorage to be configured with.
-                    enum:
-                    - INFO
-                    - WARN
-                    - ERROR
-                    - FATAL
-                    - PANIC
-                    type: string
-                  maintenanceInsertNodeIDs:
-                    description: |-
-                      MaintenanceInsertNodeIDs - excludes given node ids from insert requests routing, must contain pod suffixes - for pod-0, id will be 0 and etc.
-                      lets say, you have pod-0, pod-1, pod-2, pod-3. to exclude pod-0 and pod-3 from insert routing, define nodeIDs: [0,3].
-                      Useful at storage expanding, when you want to rebalance some data at cluster.
-                    items:
-                      format: int32
-                      type: integer
-                    type: array
-                  maintenanceSelectNodeIDs:
-                    description: MaintenanceInsertNodeIDs - excludes given node ids
-                      from select requests routing, must contain pod suffixes - for
-                      pod-0, id will be 0 and etc.
-                    items:
-                      format: int32
-                      type: integer
-                    type: array
-                  minReadySeconds:
-                    description: |-
-                      MinReadySeconds defines a minimum number of seconds to wait before starting update next pod
-                      if previous in healthy state
-                      Has no effect for VLogs and VMSingle
-                    format: int32
-                    type: integer
-                  nodeSelector:
-                    additionalProperties:
-                      type: string
-                    description: NodeSelector Define which Nodes the Pods are scheduled
-                      on.
-                    type: object
-                  paused:
-                    description: |-
-                      Paused If set to true all actions on the underlying managed objects are not
-                      going to be performed, except for delete actions.
-                    type: boolean
-                  podDisruptionBudget:
-                    description: PodDisruptionBudget created by operator
-                    properties:
-                      maxUnavailable:
-                        anyOf:
-                        - type: integer
-                        - type: string
-                        description: |-
-                          An eviction is allowed if at most "maxUnavailable" pods selected by
-                          "selector" are unavailable after the eviction, i.e. even in absence of
-                          the evicted pod. For example, one can prevent all voluntary evictions
-                          by specifying 0. This is a mutually exclusive setting with "minAvailable".
-                        x-kubernetes-int-or-string: true
-                      minAvailable:
-                        anyOf:
-                        - type: integer
-                        - type: string
-                        description: |-
-                          An eviction is allowed if at least "minAvailable" pods selected by
-                          "selector" will still be available after the eviction, i.e. even in the
-                          absence of the evicted pod.  So for example you can prevent all voluntary
-                          evictions by specifying "100%".
-                        x-kubernetes-int-or-string: true
-                      selectorLabels:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          replaces default labels selector generated by operator
-                          it's useful when you need to create custom budget
-                        type: object
-                    type: object
-                  podMetadata:
-                    description: PodMetadata configures Labels and Annotations which
-                      are propagated to the VMStorage pods.
-                    properties:
-                      annotations:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Annotations is an unstructured key value map stored with a resource that may be
-                          set by external tools to store and retrieve arbitrary metadata. They are not
-                          queryable and should be preserved when modifying objects.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                        type: object
-                      labels:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Labels Map of string keys and values that can be used to organize and categorize
-                          (scope and select) objects. May match selectors of replication controllers
-                          and services.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                        type: object
-                      name:
-                        description: |-
-                          Name must be unique within a namespace. Is required when creating resources, although
-                          some resources may allow a client to request the generation of an appropriate name
-                          automatically. Name is primarily intended for creation idempotence and configuration
-                          definition.
-                          Cannot be updated.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                        type: string
-                    type: object
-                  port:
-                    description: Port listen address
-                    type: string
-                  priorityClassName:
-                    description: PriorityClassName class assigned to the Pods
-                    type: string
-                  readinessGates:
-                    description: ReadinessGates defines pod readiness gates
-                    items:
-                      description: PodReadinessGate contains the reference to a pod
-                        condition
-                      properties:
-                        conditionType:
-                          description: ConditionType refers to a condition in the
-                            pod's condition list with matching type.
-                          type: string
-                      required:
-                      - conditionType
-                      type: object
-                    type: array
-                  readinessProbe:
-                    description: ReadinessProbe that will be added CRD pod
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  replicaCount:
-                    description: ReplicaCount is the expected size of the Application.
-                    format: int32
-                    type: integer
-                  resources:
-                    description: |-
-                      Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                      if not defined default resources from operator config will be used
-                    properties:
-                      claims:
-                        description: |-
-                          Claims lists the names of resources, defined in spec.resourceClaims,
-                          that are used by this container.
-
-                          This is an alpha field and requires enabling the
-                          DynamicResourceAllocation feature gate.
-
-                          This field is immutable. It can only be set for containers.
-                        items:
-                          description: ResourceClaim references one entry in PodSpec.ResourceClaims.
-                          properties:
-                            name:
-                              description: |-
-                                Name must match the name of one entry in pod.spec.resourceClaims of
-                                the Pod where this field is used. It makes that resource available
-                                inside a container.
-                              type: string
-                            request:
-                              description: |-
-                                Request is the name chosen for a request in the referenced claim.
-                                If empty, everything from the claim is made available, otherwise
-                                only the result of this request.
-                              type: string
-                          required:
-                          - name
-                          type: object
-                        type: array
-                        x-kubernetes-list-map-keys:
-                        - name
-                        x-kubernetes-list-type: map
-                      limits:
-                        additionalProperties:
-                          anyOf:
-                          - type: integer
-                          - type: string
-                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                          x-kubernetes-int-or-string: true
-                        description: |-
-                          Limits describes the maximum amount of compute resources allowed.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                        type: object
-                      requests:
-                        additionalProperties:
-                          anyOf:
-                          - type: integer
-                          - type: string
-                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                          x-kubernetes-int-or-string: true
-                        description: |-
-                          Requests describes the minimum amount of compute resources required.
-                          If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                          otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                        type: object
-                    type: object
-                  revisionHistoryLimitCount:
-                    description: |-
-                      The number of old ReplicaSets to retain to allow rollback in deployment or
-                      maximum number of revisions that will be maintained in the Deployment revision history.
-                      Has no effect at StatefulSets
-                      Defaults to 10.
-                    format: int32
-                    type: integer
-                  rollingUpdateStrategy:
-                    description: |-
-                      RollingUpdateStrategy defines strategy for application updates
-                      Default is OnDelete, in this case operator handles update process
-                      Can be changed for RollingUpdate
-                    type: string
-                  runtimeClassName:
-                    description: |-
-                      RuntimeClassName - defines runtime class for kubernetes pod.
-                      https://kubernetes.io/docs/concepts/containers/runtime-class/
-                    type: string
-                  schedulerName:
-                    description: SchedulerName - defines kubernetes scheduler name
-                    type: string
-                  secrets:
-                    description: |-
-                      Secrets is a list of Secrets in the same namespace as the Application
-                      object, which shall be mounted into the Application container
-                      at /etc/vm/secrets/SECRET_NAME folder
-                    items:
-                      type: string
-                    type: array
-                  securityContext:
-                    description: |-
-                      SecurityContext holds pod-level security attributes and common container settings.
-                      This defaults to the default PodSecurityContext.
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  serviceScrapeSpec:
-                    description: ServiceScrapeSpec that will be added to vmstorage
-                      VMServiceScrape spec
-                    required:
-                    - endpoints
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  serviceSpec:
-                    description: ServiceSpec that will be create additional service
-                      for vmstorage
-                    properties:
-                      metadata:
-                        description: EmbeddedObjectMetadata defines objectMeta for
-                          additional service.
-                        properties:
-                          annotations:
-                            additionalProperties:
-                              type: string
-                            description: |-
-                              Annotations is an unstructured key value map stored with a resource that may be
-                              set by external tools to store and retrieve arbitrary metadata. They are not
-                              queryable and should be preserved when modifying objects.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                            type: object
-                          labels:
-                            additionalProperties:
-                              type: string
-                            description: |-
-                              Labels Map of string keys and values that can be used to organize and categorize
-                              (scope and select) objects. May match selectors of replication controllers
-                              and services.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                            type: object
-                          name:
-                            description: |-
-                              Name must be unique within a namespace. Is required when creating resources, although
-                              some resources may allow a client to request the generation of an appropriate name
-                              automatically. Name is primarily intended for creation idempotence and configuration
-                              definition.
-                              Cannot be updated.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                            type: string
-                        type: object
-                      spec:
-                        description: |-
-                          ServiceSpec describes the attributes that a user creates on a service.
-                          More info: https://kubernetes.io/docs/concepts/services-networking/service/
-                        type: object
-                        x-kubernetes-preserve-unknown-fields: true
-                      useAsDefault:
-                        description: |-
-                          UseAsDefault applies changes from given service definition to the main object Service
-                          Changing from headless service to clusterIP or loadbalancer may break cross-component communication
-                        type: boolean
-                    required:
-                    - spec
-                    type: object
-                  startupProbe:
-                    description: StartupProbe that will be added to CRD pod
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  storage:
-                    description: |-
-                      Storage - add persistent volume for StorageDataPath
-                      its useful for persistent cache
-                    properties:
-                      disableMountSubPath:
-                        description: |-
-                          Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary.
-                          DisableMountSubPath allows to remove any subPath usage in volume mounts.
-                        type: boolean
-                      emptyDir:
-                        description: |-
-                          EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More
-                          info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir
-                        properties:
-                          medium:
-                            description: |-
-                              medium represents what type of storage medium should back this directory.
-                              The default is "" which means to use the node's default medium.
-                              Must be an empty string (default) or Memory.
-                              More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
-                            type: string
-                          sizeLimit:
-                            anyOf:
-                            - type: integer
-                            - type: string
-                            description: |-
-                              sizeLimit is the total amount of local storage required for this EmptyDir volume.
-                              The size limit is also applicable for memory medium.
-                              The maximum usage on memory medium EmptyDir would be the minimum value between
-                              the SizeLimit specified here and the sum of memory limits of all containers in a pod.
-                              The default is nil which means that the limit is undefined.
-                              More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
-                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                            x-kubernetes-int-or-string: true
-                        type: object
-                      volumeClaimTemplate:
-                        description: A PVC spec to be used by the VMAlertManager StatefulSets.
-                        type: object
-                        x-kubernetes-preserve-unknown-fields: true
-                    type: object
-                  storageDataPath:
-                    description: StorageDataPath - path to storage data
-                    type: string
-                  terminationGracePeriodSeconds:
-                    description: TerminationGracePeriodSeconds period for container
-                      graceful termination
-                    format: int64
-                    type: integer
-                  tolerations:
-                    description: Tolerations If specified, the pod's tolerations.
-                    items:
-                      description: |-
-                        The pod this Toleration is attached to tolerates any taint that matches
-                        the triple <key,value,effect> using the matching operator <operator>.
-                      properties:
-                        effect:
-                          description: |-
-                            Effect indicates the taint effect to match. Empty means match all taint effects.
-                            When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                          type: string
-                        key:
-                          description: |-
-                            Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                            If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                          type: string
-                        operator:
-                          description: |-
-                            Operator represents a key's relationship to the value.
-                            Valid operators are Exists and Equal. Defaults to Equal.
-                            Exists is equivalent to wildcard for value, so that a pod can
-                            tolerate all taints of a particular category.
-                          type: string
-                        tolerationSeconds:
-                          description: |-
-                            TolerationSeconds represents the period of time the toleration (which must be
-                            of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                            it is not set, which means tolerate the taint forever (do not evict). Zero and
-                            negative values will be treated as 0 (evict immediately) by the system.
-                          format: int64
-                          type: integer
-                        value:
-                          description: |-
-                            Value is the taint value the toleration matches to.
-                            If the operator is Exists, the value should be empty, otherwise just a regular string.
-                          type: string
-                      type: object
-                    type: array
-                  topologySpreadConstraints:
-                    description: |-
-                      TopologySpreadConstraints embedded kubernetes pod configuration option,
-                      controls how pods are spread across your cluster among failure-domains
-                      such as regions, zones, nodes, and other user-defined topology domains
-                      https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
-                    items:
-                      description: TopologySpreadConstraint specifies how to spread
-                        matching pods among the given topology.
-                      required:
-                      - maxSkew
-                      - topologyKey
-                      - whenUnsatisfiable
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    type: array
-                  useDefaultResources:
-                    description: |-
-                      UseDefaultResources controls resource settings
-                      By default, operator sets built-in resource requirements
-                    type: boolean
-                  useStrictSecurity:
-                    description: |-
-                      UseStrictSecurity enables strict security mode for component
-                      it restricts disk writes access
-                      uses non-root user out of the box
-                      drops not needed security permissions
-                    type: boolean
-                  vmBackup:
-                    description: VMBackup configuration for backup
-                    properties:
-                      acceptEULA:
-                        description: |-
-                          AcceptEULA accepts enterprise feature usage, must be set to true.
-                          otherwise backupmanager cannot be added to single/cluster version.
-                          https://victoriametrics.com/legal/esa/
-                        type: boolean
-                      concurrency:
-                        description: Defines number of concurrent workers. Higher
-                          concurrency may reduce backup duration (default 10)
-                        format: int32
-                        type: integer
-                      credentialsSecret:
-                        description: |-
-                          CredentialsSecret is secret in the same namespace for access to remote storage
-                          The secret is mounted into /etc/vm/creds.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      customS3Endpoint:
-                        description: Custom S3 endpoint for use with S3-compatible
-                          storages (e.g. MinIO). S3 is used if not set
-                        type: string
-                      destination:
-                        description: Defines destination for backup
-                        type: string
-                      destinationDisableSuffixAdd:
-                        description: |-
-                          DestinationDisableSuffixAdd - disables suffix adding for cluster version backups
-                          each vmstorage backup must have unique backup folder
-                          so operator adds POD_NAME as suffix for backup destination folder.
-                        type: boolean
-                      disableDaily:
-                        description: Defines if daily backups disabled (default false)
-                        type: boolean
-                      disableHourly:
-                        description: Defines if hourly backups disabled (default false)
-                        type: boolean
-                      disableMonthly:
-                        description: Defines if monthly backups disabled (default
-                          false)
-                        type: boolean
-                      disableWeekly:
-                        description: Defines if weekly backups disabled (default false)
-                        type: boolean
-                      extraArgs:
-                        additionalProperties:
-                          type: string
-                        description: extra args like maxBytesPerSecond default 0
-                        type: object
-                      extraEnvs:
-                        items:
-                          description: EnvVar represents an environment variable present
-                            in a Container.
-                          properties:
-                            name:
-                              description: Name of the environment variable. Must
-                                be a C_IDENTIFIER.
-                              type: string
-                            value:
-                              description: |-
-                                Variable references $(VAR_NAME) are expanded
-                                using the previously defined environment variables in the container and
-                                any service environment variables. If a variable cannot be resolved,
-                                the reference in the input string will be unchanged. Double $$ are reduced
-                                to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                                "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                                Escaped references will never be expanded, regardless of whether the variable
-                                exists or not.
-                                Defaults to "".
-                              type: string
-                            valueFrom:
-                              description: Source for the environment variable's value.
-                                Cannot be used if value is not empty.
-                              properties:
-                                configMapKeyRef:
-                                  description: Selects a key of a ConfigMap.
-                                  properties:
-                                    key:
-                                      description: The key to select.
-                                      type: string
-                                    name:
-                                      default: ""
-                                      description: |-
-                                        Name of the referent.
-                                        This field is effectively required, but due to backwards compatibility is
-                                        allowed to be empty. Instances of this type with an empty value here are
-                                        almost certainly wrong.
-                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                      type: string
-                                    optional:
-                                      description: Specify whether the ConfigMap or
-                                        its key must be defined
-                                      type: boolean
-                                  required:
-                                  - key
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                fieldRef:
-                                  description: |-
-                                    Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
-                                    spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
-                                  properties:
-                                    apiVersion:
-                                      description: Version of the schema the FieldPath
-                                        is written in terms of, defaults to "v1".
-                                      type: string
-                                    fieldPath:
-                                      description: Path of the field to select in
-                                        the specified API version.
-                                      type: string
-                                  required:
-                                  - fieldPath
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                resourceFieldRef:
-                                  description: |-
-                                    Selects a resource of the container: only resources limits and requests
-                                    (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
-                                  properties:
-                                    containerName:
-                                      description: 'Container name: required for volumes,
-                                        optional for env vars'
-                                      type: string
-                                    divisor:
-                                      anyOf:
-                                      - type: integer
-                                      - type: string
-                                      description: Specifies the output format of
-                                        the exposed resources, defaults to "1"
-                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                      x-kubernetes-int-or-string: true
-                                    resource:
-                                      description: 'Required: resource to select'
-                                      type: string
-                                  required:
-                                  - resource
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                secretKeyRef:
-                                  description: Selects a key of a secret in the pod's
-                                    namespace
-                                  properties:
-                                    key:
-                                      description: The key of the secret to select
-                                        from.  Must be a valid secret key.
-                                      type: string
-                                    name:
-                                      default: ""
-                                      description: |-
-                                        Name of the referent.
-                                        This field is effectively required, but due to backwards compatibility is
-                                        allowed to be empty. Instances of this type with an empty value here are
-                                        almost certainly wrong.
-                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                      type: string
-                                    optional:
-                                      description: Specify whether the Secret or its
-                                        key must be defined
-                                      type: boolean
-                                  required:
-                                  - key
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                              type: object
-                          required:
-                          - name
-                          type: object
-                        type: array
-                      extraEnvsFrom:
-                        description: |-
-                          ExtraEnvsFrom defines source of env variables for the application container
-                          could either be secret or configmap
-                        items:
-                          description: EnvFromSource represents the source of a set
-                            of ConfigMaps
-                          properties:
-                            configMapRef:
-                              description: The ConfigMap to select from
-                              properties:
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap must
-                                    be defined
-                                  type: boolean
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            prefix:
-                              description: An optional identifier to prepend to each
-                                key in the ConfigMap. Must be a C_IDENTIFIER.
-                              type: string
-                            secretRef:
-                              description: The Secret to select from
-                              properties:
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret must be
-                                    defined
-                                  type: boolean
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        type: array
-                      image:
-                        description: Image - docker image settings for VMBackuper
-                        properties:
-                          pullPolicy:
-                            description: PullPolicy describes how to pull docker image
-                            type: string
-                          repository:
-                            description: Repository contains name of docker image
-                              + it's repository if needed
-                            type: string
-                          tag:
-                            description: Tag contains desired docker image version
-                            type: string
-                        type: object
-                      logFormat:
-                        description: |-
-                          LogFormat for VMBackup to be configured with.
-                          default or json
-                        enum:
-                        - default
-                        - json
-                        type: string
-                      logLevel:
-                        description: LogLevel for VMBackup to be configured with.
-                        enum:
-                        - INFO
-                        - WARN
-                        - ERROR
-                        - FATAL
-                        - PANIC
-                        type: string
-                      port:
-                        description: Port for health check connections
-                        type: string
-                      resources:
-                        description: |-
-                          Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                          if not defined default resources from operator config will be used
-                        properties:
-                          claims:
-                            description: |-
-                              Claims lists the names of resources, defined in spec.resourceClaims,
-                              that are used by this container.
-
-                              This is an alpha field and requires enabling the
-                              DynamicResourceAllocation feature gate.
-
-                              This field is immutable. It can only be set for containers.
-                            items:
-                              description: ResourceClaim references one entry in PodSpec.ResourceClaims.
-                              properties:
-                                name:
-                                  description: |-
-                                    Name must match the name of one entry in pod.spec.resourceClaims of
-                                    the Pod where this field is used. It makes that resource available
-                                    inside a container.
-                                  type: string
-                                request:
-                                  description: |-
-                                    Request is the name chosen for a request in the referenced claim.
-                                    If empty, everything from the claim is made available, otherwise
-                                    only the result of this request.
-                                  type: string
-                              required:
-                              - name
-                              type: object
-                            type: array
-                            x-kubernetes-list-map-keys:
-                            - name
-                            x-kubernetes-list-type: map
-                          limits:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: |-
-                              Limits describes the maximum amount of compute resources allowed.
-                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                            type: object
-                          requests:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: |-
-                              Requests describes the minimum amount of compute resources required.
-                              If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                              otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                            type: object
-                        type: object
-                      restore:
-                        description: |-
-                          Restore Allows to enable restore options for pod
-                          Read [more](https://docs.victoriametrics.com/vmbackupmanager#restore-commands)
-                        properties:
-                          onStart:
-                            description: OnStart defines configuration for restore
-                              on pod start
-                            properties:
-                              enabled:
-                                description: Enabled defines if restore on start enabled
-                                type: boolean
-                            type: object
-                        type: object
-                      snapshotCreateURL:
-                        description: SnapshotCreateURL overwrites url for snapshot
-                          create
-                        type: string
-                      snapshotDeleteURL:
-                        description: SnapShotDeleteURL overwrites url for snapshot
-                          delete
-                        type: string
-                      volumeMounts:
-                        description: |-
-                          VolumeMounts allows configuration of additional VolumeMounts on the output Deployment definition.
-                          VolumeMounts specified will be appended to other VolumeMounts in the vmbackupmanager container,
-                          that are generated as a result of StorageSpec objects.
-                        items:
-                          description: VolumeMount describes a mounting of a Volume
-                            within a container.
-                          properties:
-                            mountPath:
-                              description: |-
-                                Path within the container at which the volume should be mounted.  Must
-                                not contain ':'.
-                              type: string
-                            mountPropagation:
-                              description: |-
-                                mountPropagation determines how mounts are propagated from the host
-                                to container and the other way around.
-                                When not set, MountPropagationNone is used.
-                                This field is beta in 1.10.
-                                When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                                (which defaults to None).
-                              type: string
-                            name:
-                              description: This must match the Name of a Volume.
-                              type: string
-                            readOnly:
-                              description: |-
-                                Mounted read-only if true, read-write otherwise (false or unspecified).
-                                Defaults to false.
-                              type: boolean
-                            recursiveReadOnly:
-                              description: |-
-                                RecursiveReadOnly specifies whether read-only mounts should be handled
-                                recursively.
-
-                                If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                                If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                                recursively read-only.  If this field is set to IfPossible, the mount is made
-                                recursively read-only, if it is supported by the container runtime.  If this
-                                field is set to Enabled, the mount is made recursively read-only if it is
-                                supported by the container runtime, otherwise the pod will not be started and
-                                an error will be generated to indicate the reason.
-
-                                If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                                None (or be unspecified, which defaults to None).
-
-                                If this field is not specified, it is treated as an equivalent of Disabled.
-                              type: string
-                            subPath:
-                              description: |-
-                                Path within the volume from which the container's volume should be mounted.
-                                Defaults to "" (volume's root).
-                              type: string
-                            subPathExpr:
-                              description: |-
-                                Expanded path within the volume from which the container's volume should be mounted.
-                                Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                                Defaults to "" (volume's root).
-                                SubPathExpr and SubPath are mutually exclusive.
-                              type: string
-                          required:
-                          - mountPath
-                          - name
-                          type: object
-                        type: array
-                    type: object
-                  vmInsertPort:
-                    description: VMInsertPort for VMInsert connections
-                    type: string
-                  vmSelectPort:
-                    description: VMSelectPort for VMSelect connections
-                    type: string
-                  volumeMounts:
-                    description: |-
-                      VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
-                      VolumeMounts specified will be appended to other VolumeMounts in the Application container
-                    items:
-                      description: VolumeMount describes a mounting of a Volume within
-                        a container.
-                      properties:
-                        mountPath:
-                          description: |-
-                            Path within the container at which the volume should be mounted.  Must
-                            not contain ':'.
-                          type: string
-                        mountPropagation:
-                          description: |-
-                            mountPropagation determines how mounts are propagated from the host
-                            to container and the other way around.
-                            When not set, MountPropagationNone is used.
-                            This field is beta in 1.10.
-                            When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                            (which defaults to None).
-                          type: string
-                        name:
-                          description: This must match the Name of a Volume.
-                          type: string
-                        readOnly:
-                          description: |-
-                            Mounted read-only if true, read-write otherwise (false or unspecified).
-                            Defaults to false.
-                          type: boolean
-                        recursiveReadOnly:
-                          description: |-
-                            RecursiveReadOnly specifies whether read-only mounts should be handled
-                            recursively.
-
-                            If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                            If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                            recursively read-only.  If this field is set to IfPossible, the mount is made
-                            recursively read-only, if it is supported by the container runtime.  If this
-                            field is set to Enabled, the mount is made recursively read-only if it is
-                            supported by the container runtime, otherwise the pod will not be started and
-                            an error will be generated to indicate the reason.
-
-                            If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                            None (or be unspecified, which defaults to None).
-
-                            If this field is not specified, it is treated as an equivalent of Disabled.
-                          type: string
-                        subPath:
-                          description: |-
-                            Path within the volume from which the container's volume should be mounted.
-                            Defaults to "" (volume's root).
-                          type: string
-                        subPathExpr:
-                          description: |-
-                            Expanded path within the volume from which the container's volume should be mounted.
-                            Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                            Defaults to "" (volume's root).
-                            SubPathExpr and SubPath are mutually exclusive.
-                          type: string
-                      required:
-                      - mountPath
-                      - name
-                      type: object
-                    type: array
-                  volumes:
-                    description: |-
-                      Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
-                      Volumes specified will be appended to other volumes that are generated.
-                      / +optional
-                    items:
-                      description: Volume represents a named volume in a pod that
-                        may be accessed by any container in the pod.
-                      required:
-                      - name
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    type: array
-                type: object
-            required:
-            - retentionPeriod
             type: object
+            x-kubernetes-preserve-unknown-fields: true
           status:
-            description: VMClusterStatus defines the observed state of VMCluster
             properties:
-              clusterStatus:
-                description: LegacyStatus is deprecated and will be removed at v0.52.0
-                  version
-                type: string
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -20731,16 +1096,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         required:
@@ -20755,7 +1115,101 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: vmdistributed.operator.victoriametrics.com
+spec:
+  group: operator.victoriametrics.com
+  names:
+    kind: VMDistributed
+    listKind: VMDistributedList
+    plural: vmdistributed
+    singular: vmdistributed
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: current status of update rollout
+      jsonPath: .status.updateStatus
+      name: Status
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            type: string
+          kind:
+            type: string
+          metadata:
+            type: object
+          spec:
+            type: object
+            x-kubernetes-preserve-unknown-fields: true
+          status:
+            properties:
+              conditions:
+                items:
+                  properties:
+                    lastTransitionTime:
+                      format: date-time
+                      type: string
+                    lastUpdateTime:
+                      format: date-time
+                      type: string
+                    message:
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      maxLength: 1024
+                      minLength: 1
+                      type: string
+                    status:
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      maxLength: 316
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - lastUpdateTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              observedGeneration:
+                format: int64
+                type: integer
+              reason:
+                type: string
+              updateStatus:
+                type: string
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmnodescrapes.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -20779,869 +1233,45 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: |-
-          VMNodeScrape defines discovery for targets placed on kubernetes nodes,
-          usually its node-exporters and other host services.
-          InternalIP is used as __address__ for scraping.
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMNodeScrapeSpec defines specification for VMNodeScrape.
-            properties:
-              authorization:
-                description: Authorization with http header Authorization
-                properties:
-                  credentials:
-                    description: Reference to the secret with value for authorization
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  credentialsFile:
-                    description: File with value for authorization
-                    type: string
-                  type:
-                    description: Type of authorization, default to bearer
-                    type: string
-                type: object
-              basicAuth:
-                description: BasicAuth allow an endpoint to authenticate over basic
-                  authentication
-                properties:
-                  password:
-                    description: |-
-                      Password defines reference for secret with password value
-                      The secret needs to be in the same namespace as scrape object
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  password_file:
-                    description: |-
-                      PasswordFile defines path to password file at disk
-                      must be pre-mounted
-                    type: string
-                  username:
-                    description: |-
-                      Username defines reference for secret with username value
-                      The secret needs to be in the same namespace as scrape object
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                type: object
-              bearerTokenFile:
-                description: File to read bearer token for scraping targets.
-                type: string
-              bearerTokenSecret:
-                description: |-
-                  Secret to mount to read bearer token for scraping targets. The secret
-                  needs to be in the same namespace as the scrape object and accessible by
-                  the victoria-metrics operator.
-                nullable: true
-                properties:
-                  key:
-                    description: The key of the secret to select from.  Must be a
-                      valid secret key.
-                    type: string
-                  name:
-                    default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                    type: string
-                  optional:
-                    description: Specify whether the Secret or its key must be defined
-                    type: boolean
-                required:
-                - key
-                type: object
-                x-kubernetes-map-type: atomic
-              follow_redirects:
-                description: FollowRedirects controls redirects for scraping.
-                type: boolean
-              honorLabels:
-                description: HonorLabels chooses the metric's labels on collisions
-                  with target labels.
-                type: boolean
-              honorTimestamps:
-                description: HonorTimestamps controls whether vmagent respects the
-                  timestamps present in scraped data.
-                type: boolean
-              interval:
-                description: Interval at which metrics should be scraped
-                type: string
-              jobLabel:
-                description: The label to use to retrieve the job name from.
-                type: string
-              max_scrape_size:
-                description: MaxScrapeSize defines a maximum size of scraped data
-                  for a job
-                type: string
-              metricRelabelConfigs:
-                description: MetricRelabelConfigs to apply to samples after scrapping.
-                items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
-                  properties:
-                    action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
-                      type: string
-                    if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
-                      x-kubernetes-preserve-unknown-fields: true
-                    labels:
-                      additionalProperties:
-                        type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
-                      type: object
-                    match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
-                      type: string
-                    modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
-                      format: int64
-                      type: integer
-                    regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                      x-kubernetes-preserve-unknown-fields: true
-                    replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
-                      type: string
-                    separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
-                      type: string
-                    source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      items:
-                        type: string
-                      type: array
-                    sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
-                      items:
-                        type: string
-                      type: array
-                    target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      type: string
-                    targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
-                      type: string
-                  type: object
-                type: array
-              oauth2:
-                description: OAuth2 defines auth configuration
-                properties:
-                  client_id:
-                    description: The secret or configmap containing the OAuth2 client
-                      id
-                    properties:
-                      configMap:
-                        description: ConfigMap containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key to select.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      secret:
-                        description: Secret containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  client_secret:
-                    description: The secret containing the OAuth2 client secret
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  client_secret_file:
-                    description: ClientSecretFile defines path for client secret file.
-                    type: string
-                  endpoint_params:
-                    additionalProperties:
-                      type: string
-                    description: Parameters to append to the token URL
-                    type: object
-                  proxy_url:
-                    description: |-
-                      The proxy URL for token_url connection
-                      ( available from v0.55.0).
-                      Is only supported by Scrape objects family
-                    type: string
-                  scopes:
-                    description: OAuth2 scopes used for the token request
-                    items:
-                      type: string
-                    type: array
-                  tls_config:
-                    description: |-
-                      TLSConfig for token_url connection
-                      ( available from v0.55.0).
-                      Is only supported by Scrape objects family
-                    x-kubernetes-preserve-unknown-fields: true
-                  token_url:
-                    description: The URL to fetch the token from
-                    minLength: 1
-                    type: string
-                required:
-                - client_id
-                - token_url
-                type: object
-              params:
-                additionalProperties:
-                  items:
-                    type: string
-                  type: array
-                description: Optional HTTP URL parameters
-                type: object
-              path:
-                description: HTTP path to scrape for metrics.
-                type: string
-              port:
-                description: Name of the port exposed at Node.
-                type: string
-              proxyURL:
-                description: ProxyURL eg http://proxyserver:2195 Directs scrapes to
-                  proxy through this endpoint.
-                type: string
-              relabelConfigs:
-                description: RelabelConfigs to apply to samples during service discovery.
-                items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
-                  properties:
-                    action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
-                      type: string
-                    if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
-                      x-kubernetes-preserve-unknown-fields: true
-                    labels:
-                      additionalProperties:
-                        type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
-                      type: object
-                    match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
-                      type: string
-                    modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
-                      format: int64
-                      type: integer
-                    regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                      x-kubernetes-preserve-unknown-fields: true
-                    replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
-                      type: string
-                    separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
-                      type: string
-                    source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      items:
-                        type: string
-                      type: array
-                    sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
-                      items:
-                        type: string
-                      type: array
-                    target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      type: string
-                    targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
-                      type: string
-                  type: object
-                type: array
-              sampleLimit:
-                description: SampleLimit defines per-scrape limit on number of scraped
-                  samples that will be accepted.
-                format: int64
-                type: integer
-              scheme:
-                description: HTTP scheme to use for scraping.
-                enum:
-                - http
-                - https
-                - HTTPS
-                - HTTP
-                type: string
-              scrape_interval:
-                description: |-
-                  ScrapeInterval is the same as Interval and has priority over it.
-                  one of scrape_interval or interval can be used
-                type: string
-              scrapeTimeout:
-                description: Timeout after which the scrape is ended
-                type: string
-              selector:
-                description: Selector to select kubernetes Nodes.
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              seriesLimit:
-                description: |-
-                  SeriesLimit defines per-scrape limit on number of unique time series
-                  a single target can expose during all the scrapes on the time window of 24h.
-                format: int64
-                type: integer
-              targetLabels:
-                description: TargetLabels transfers labels on the Kubernetes Node
-                  onto the target.
-                items:
-                  type: string
-                type: array
-              tlsConfig:
-                description: TLSConfig configuration to use when scraping the endpoint
-                properties:
-                  ca:
-                    description: Struct containing the CA cert to use for the targets.
-                    properties:
-                      configMap:
-                        description: ConfigMap containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key to select.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      secret:
-                        description: Secret containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  caFile:
-                    description: Path to the CA cert in the container to use for the
-                      targets.
-                    type: string
-                  cert:
-                    description: Struct containing the client cert file for the targets.
-                    properties:
-                      configMap:
-                        description: ConfigMap containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key to select.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      secret:
-                        description: Secret containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  certFile:
-                    description: Path to the client cert file in the container for
-                      the targets.
-                    type: string
-                  insecureSkipVerify:
-                    description: Disable target certificate validation.
-                    type: boolean
-                  keyFile:
-                    description: Path to the client key file in the container for
-                      the targets.
-                    type: string
-                  keySecret:
-                    description: Secret containing the client key file for the targets.
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  serverName:
-                    description: Used to verify the hostname for the targets.
-                    type: string
-                type: object
-              vm_scrape_params:
-                description: VMScrapeParams defines VictoriaMetrics specific scrape
-                  parameters
-                properties:
-                  disable_compression:
-                    description: DisableCompression
-                    type: boolean
-                  disable_keep_alive:
-                    description: |-
-                      disable_keepalive allows disabling HTTP keep-alive when scraping targets.
-                      By default, HTTP keep-alive is enabled, so TCP connections to scrape targets
-                      could be reused.
-                      See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements
-                    type: boolean
-                  headers:
-                    description: |-
-                      Headers allows sending custom headers to scrape targets
-                      must be in of semicolon separated header with it's value
-                      eg:
-                      headerName: headerValue
-                      vmagent supports since 1.79.0 version
-                    items:
-                      type: string
-                    type: array
-                  no_stale_markers:
-                    type: boolean
-                  proxy_client_config:
-                    description: |-
-                      ProxyClientConfig configures proxy auth settings for scraping
-                      See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy
-                    properties:
-                      basic_auth:
-                        description: BasicAuth allow an endpoint to authenticate over
-                          basic authentication
-                        properties:
-                          password:
-                            description: |-
-                              Password defines reference for secret with password value
-                              The secret needs to be in the same namespace as scrape object
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          password_file:
-                            description: |-
-                              PasswordFile defines path to password file at disk
-                              must be pre-mounted
-                            type: string
-                          username:
-                            description: |-
-                              Username defines reference for secret with username value
-                              The secret needs to be in the same namespace as scrape object
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                        type: object
-                      bearer_token:
-                        description: SecretKeySelector selects a key of a Secret.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      bearer_token_file:
-                        type: string
-                      tls_config:
-                        x-kubernetes-preserve-unknown-fields: true
-                    type: object
-                  scrape_align_interval:
-                    type: string
-                  scrape_offset:
-                    type: string
-                  stream_parse:
-                    type: boolean
-                type: object
             type: object
+            x-kubernetes-preserve-unknown-fields: true
           status:
-            description: ScrapeObjectStatus defines the observed state of ScrapeObjects
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -21656,16 +1286,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -21678,7 +1303,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmpodscrapes.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -21702,957 +1327,47 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: |-
-          VMPodScrape is scrape configuration for pods,
-          it generates vmagent's config for scraping pod targets
-          based on selectors.
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMPodScrapeSpec defines the desired state of VMPodScrape
-            properties:
-              attach_metadata:
-                description: AttachMetadata configures metadata attaching from service
-                  discovery
-                properties:
-                  node:
-                    description: |-
-                      Node instructs vmagent to add node specific metadata from service discovery
-                      Valid for roles: pod, endpoints, endpointslice.
-                    type: boolean
-                type: object
-              jobLabel:
-                description: The label to use to retrieve the job name from.
-                type: string
-              namespaceSelector:
-                description: Selector to select which namespaces the Endpoints objects
-                  are discovered from.
-                properties:
-                  any:
-                    description: |-
-                      Boolean describing whether all namespaces are selected in contrast to a
-                      list restricting them.
-                    type: boolean
-                  matchNames:
-                    description: List of namespace names.
-                    items:
-                      type: string
-                    type: array
-                type: object
-              podMetricsEndpoints:
-                description: A list of endpoints allowed as part of this PodMonitor.
-                items:
-                  description: PodMetricsEndpoint defines a scrapeable endpoint of
-                    a Kubernetes Pod serving metrics.
-                  properties:
-                    attach_metadata:
-                      description: AttachMetadata configures metadata attaching from
-                        service discovery
-                      properties:
-                        node:
-                          description: |-
-                            Node instructs vmagent to add node specific metadata from service discovery
-                            Valid for roles: pod, endpoints, endpointslice.
-                          type: boolean
-                      type: object
-                    authorization:
-                      description: Authorization with http header Authorization
-                      properties:
-                        credentials:
-                          description: Reference to the secret with value for authorization
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        credentialsFile:
-                          description: File with value for authorization
-                          type: string
-                        type:
-                          description: Type of authorization, default to bearer
-                          type: string
-                      type: object
-                    basicAuth:
-                      description: BasicAuth allow an endpoint to authenticate over
-                        basic authentication
-                      properties:
-                        password:
-                          description: |-
-                            Password defines reference for secret with password value
-                            The secret needs to be in the same namespace as scrape object
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        password_file:
-                          description: |-
-                            PasswordFile defines path to password file at disk
-                            must be pre-mounted
-                          type: string
-                        username:
-                          description: |-
-                            Username defines reference for secret with username value
-                            The secret needs to be in the same namespace as scrape object
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                      type: object
-                    bearerTokenFile:
-                      description: File to read bearer token for scraping targets.
-                      type: string
-                    bearerTokenSecret:
-                      description: |-
-                        Secret to mount to read bearer token for scraping targets. The secret
-                        needs to be in the same namespace as the scrape object and accessible by
-                        the victoria-metrics operator.
-                      nullable: true
-                      properties:
-                        key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
-                          type: string
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
-                          type: boolean
-                      required:
-                      - key
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    filterRunning:
-                      description: |-
-                        FilterRunning applies filter with pod status == running
-                        it prevents from scrapping metrics at failed or succeed state pods.
-                        enabled by default
-                      type: boolean
-                    follow_redirects:
-                      description: FollowRedirects controls redirects for scraping.
-                      type: boolean
-                    honorLabels:
-                      description: HonorLabels chooses the metric's labels on collisions
-                        with target labels.
-                      type: boolean
-                    honorTimestamps:
-                      description: HonorTimestamps controls whether vmagent respects
-                        the timestamps present in scraped data.
-                      type: boolean
-                    interval:
-                      description: Interval at which metrics should be scraped
-                      type: string
-                    max_scrape_size:
-                      description: MaxScrapeSize defines a maximum size of scraped
-                        data for a job
-                      type: string
-                    metricRelabelConfigs:
-                      description: MetricRelabelConfigs to apply to samples after
-                        scrapping.
-                      items:
-                        description: |-
-                          RelabelConfig allows dynamic rewriting of the label set
-                          More info: https://docs.victoriametrics.com/#relabeling
-                        properties:
-                          action:
-                            description: Action to perform based on regex matching.
-                              Default is 'replace'
-                            type: string
-                          if:
-                            description: 'If represents metricsQL match expression
-                              (or list of expressions): ''{__name__=~"foo_.*"}'''
-                            x-kubernetes-preserve-unknown-fields: true
-                          labels:
-                            additionalProperties:
-                              type: string
-                            description: 'Labels is used together with Match for `action:
-                              graphite`'
-                            type: object
-                          match:
-                            description: 'Match is used together with Labels for `action:
-                              graphite`'
-                            type: string
-                          modulus:
-                            description: Modulus to take of the hash of the source
-                              label values.
-                            format: int64
-                            type: integer
-                          regex:
-                            description: |-
-                              Regular expression against which the extracted value is matched. Default is '(.*)'
-                              victoriaMetrics supports multiline regex joined with |
-                              https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                            x-kubernetes-preserve-unknown-fields: true
-                          replacement:
-                            description: |-
-                              Replacement value against which a regex replace is performed if the
-                              regular expression matches. Regex capture groups are available. Default is '$1'
-                            type: string
-                          separator:
-                            description: Separator placed between concatenated source
-                              label values. default is ';'.
-                            type: string
-                          source_labels:
-                            description: |-
-                              UnderScoreSourceLabels - additional form of source labels source_labels
-                              for compatibility with original relabel config.
-                              if set  both sourceLabels and source_labels, sourceLabels has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
-                            items:
-                              type: string
-                            type: array
-                          sourceLabels:
-                            description: |-
-                              The source labels select values from existing labels. Their content is concatenated
-                              using the configured separator and matched against the configured regular expression
-                              for the replace, keep, and drop actions.
-                            items:
-                              type: string
-                            type: array
-                          target_label:
-                            description: |-
-                              UnderScoreTargetLabel - additional form of target label - target_label
-                              for compatibility with original relabel config.
-                              if set  both targetLabel and target_label, targetLabel has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
-                            type: string
-                          targetLabel:
-                            description: |-
-                              Label to which the resulting value is written in a replace action.
-                              It is mandatory for replace actions. Regex capture groups are available.
-                            type: string
-                        type: object
-                      type: array
-                    oauth2:
-                      description: OAuth2 defines auth configuration
-                      properties:
-                        client_id:
-                          description: The secret or configmap containing the OAuth2
-                            client id
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        client_secret:
-                          description: The secret containing the OAuth2 client secret
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        client_secret_file:
-                          description: ClientSecretFile defines path for client secret
-                            file.
-                          type: string
-                        endpoint_params:
-                          additionalProperties:
-                            type: string
-                          description: Parameters to append to the token URL
-                          type: object
-                        proxy_url:
-                          description: |-
-                            The proxy URL for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
-                          type: string
-                        scopes:
-                          description: OAuth2 scopes used for the token request
-                          items:
-                            type: string
-                          type: array
-                        tls_config:
-                          description: |-
-                            TLSConfig for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
-                          x-kubernetes-preserve-unknown-fields: true
-                        token_url:
-                          description: The URL to fetch the token from
-                          minLength: 1
-                          type: string
-                      required:
-                      - client_id
-                      - token_url
-                      type: object
-                    params:
-                      additionalProperties:
-                        items:
-                          type: string
-                        type: array
-                      description: Optional HTTP URL parameters
-                      type: object
-                    path:
-                      description: HTTP path to scrape for metrics.
-                      type: string
-                    port:
-                      description: Name of the port exposed at Pod.
-                      type: string
-                    portNumber:
-                      description: PortNumber defines the `Pod` port number which
-                        exposes the endpoint.
-                      format: int32
-                      maximum: 65535
-                      minimum: 1
-                      type: integer
-                    proxyURL:
-                      description: ProxyURL eg http://proxyserver:2195 Directs scrapes
-                        to proxy through this endpoint.
-                      type: string
-                    relabelConfigs:
-                      description: RelabelConfigs to apply to samples during service
-                        discovery.
-                      items:
-                        description: |-
-                          RelabelConfig allows dynamic rewriting of the label set
-                          More info: https://docs.victoriametrics.com/#relabeling
-                        properties:
-                          action:
-                            description: Action to perform based on regex matching.
-                              Default is 'replace'
-                            type: string
-                          if:
-                            description: 'If represents metricsQL match expression
-                              (or list of expressions): ''{__name__=~"foo_.*"}'''
-                            x-kubernetes-preserve-unknown-fields: true
-                          labels:
-                            additionalProperties:
-                              type: string
-                            description: 'Labels is used together with Match for `action:
-                              graphite`'
-                            type: object
-                          match:
-                            description: 'Match is used together with Labels for `action:
-                              graphite`'
-                            type: string
-                          modulus:
-                            description: Modulus to take of the hash of the source
-                              label values.
-                            format: int64
-                            type: integer
-                          regex:
-                            description: |-
-                              Regular expression against which the extracted value is matched. Default is '(.*)'
-                              victoriaMetrics supports multiline regex joined with |
-                              https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                            x-kubernetes-preserve-unknown-fields: true
-                          replacement:
-                            description: |-
-                              Replacement value against which a regex replace is performed if the
-                              regular expression matches. Regex capture groups are available. Default is '$1'
-                            type: string
-                          separator:
-                            description: Separator placed between concatenated source
-                              label values. default is ';'.
-                            type: string
-                          source_labels:
-                            description: |-
-                              UnderScoreSourceLabels - additional form of source labels source_labels
-                              for compatibility with original relabel config.
-                              if set  both sourceLabels and source_labels, sourceLabels has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
-                            items:
-                              type: string
-                            type: array
-                          sourceLabels:
-                            description: |-
-                              The source labels select values from existing labels. Their content is concatenated
-                              using the configured separator and matched against the configured regular expression
-                              for the replace, keep, and drop actions.
-                            items:
-                              type: string
-                            type: array
-                          target_label:
-                            description: |-
-                              UnderScoreTargetLabel - additional form of target label - target_label
-                              for compatibility with original relabel config.
-                              if set  both targetLabel and target_label, targetLabel has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
-                            type: string
-                          targetLabel:
-                            description: |-
-                              Label to which the resulting value is written in a replace action.
-                              It is mandatory for replace actions. Regex capture groups are available.
-                            type: string
-                        type: object
-                      type: array
-                    sampleLimit:
-                      description: SampleLimit defines per-scrape limit on number
-                        of scraped samples that will be accepted.
-                      format: int64
-                      type: integer
-                    scheme:
-                      description: HTTP scheme to use for scraping.
-                      enum:
-                      - http
-                      - https
-                      - HTTPS
-                      - HTTP
-                      type: string
-                    scrape_interval:
-                      description: |-
-                        ScrapeInterval is the same as Interval and has priority over it.
-                        one of scrape_interval or interval can be used
-                      type: string
-                    scrapeTimeout:
-                      description: Timeout after which the scrape is ended
-                      type: string
-                    seriesLimit:
-                      description: |-
-                        SeriesLimit defines per-scrape limit on number of unique time series
-                        a single target can expose during all the scrapes on the time window of 24h.
-                      format: int64
-                      type: integer
-                    targetPort:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      description: |-
-                        TargetPort defines name or number of the pod port this endpoint refers to.
-                        Mutually exclusive with Port and PortNumber.
-                      x-kubernetes-int-or-string: true
-                    tlsConfig:
-                      description: TLSConfig configuration to use when scraping the
-                        endpoint
-                      properties:
-                        ca:
-                          description: Struct containing the CA cert to use for the
-                            targets.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        caFile:
-                          description: Path to the CA cert in the container to use
-                            for the targets.
-                          type: string
-                        cert:
-                          description: Struct containing the client cert file for
-                            the targets.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        certFile:
-                          description: Path to the client cert file in the container
-                            for the targets.
-                          type: string
-                        insecureSkipVerify:
-                          description: Disable target certificate validation.
-                          type: boolean
-                        keyFile:
-                          description: Path to the client key file in the container
-                            for the targets.
-                          type: string
-                        keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        serverName:
-                          description: Used to verify the hostname for the targets.
-                          type: string
-                      type: object
-                    vm_scrape_params:
-                      description: VMScrapeParams defines VictoriaMetrics specific
-                        scrape parameters
-                      properties:
-                        disable_compression:
-                          description: DisableCompression
-                          type: boolean
-                        disable_keep_alive:
-                          description: |-
-                            disable_keepalive allows disabling HTTP keep-alive when scraping targets.
-                            By default, HTTP keep-alive is enabled, so TCP connections to scrape targets
-                            could be reused.
-                            See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements
-                          type: boolean
-                        headers:
-                          description: |-
-                            Headers allows sending custom headers to scrape targets
-                            must be in of semicolon separated header with it's value
-                            eg:
-                            headerName: headerValue
-                            vmagent supports since 1.79.0 version
-                          items:
-                            type: string
-                          type: array
-                        no_stale_markers:
-                          type: boolean
-                        proxy_client_config:
-                          description: |-
-                            ProxyClientConfig configures proxy auth settings for scraping
-                            See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy
-                          properties:
-                            basic_auth:
-                              description: BasicAuth allow an endpoint to authenticate
-                                over basic authentication
-                              properties:
-                                password:
-                                  description: |-
-                                    Password defines reference for secret with password value
-                                    The secret needs to be in the same namespace as scrape object
-                                  properties:
-                                    key:
-                                      description: The key of the secret to select
-                                        from.  Must be a valid secret key.
-                                      type: string
-                                    name:
-                                      default: ""
-                                      description: |-
-                                        Name of the referent.
-                                        This field is effectively required, but due to backwards compatibility is
-                                        allowed to be empty. Instances of this type with an empty value here are
-                                        almost certainly wrong.
-                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                      type: string
-                                    optional:
-                                      description: Specify whether the Secret or its
-                                        key must be defined
-                                      type: boolean
-                                  required:
-                                  - key
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                password_file:
-                                  description: |-
-                                    PasswordFile defines path to password file at disk
-                                    must be pre-mounted
-                                  type: string
-                                username:
-                                  description: |-
-                                    Username defines reference for secret with username value
-                                    The secret needs to be in the same namespace as scrape object
-                                  properties:
-                                    key:
-                                      description: The key of the secret to select
-                                        from.  Must be a valid secret key.
-                                      type: string
-                                    name:
-                                      default: ""
-                                      description: |-
-                                        Name of the referent.
-                                        This field is effectively required, but due to backwards compatibility is
-                                        allowed to be empty. Instances of this type with an empty value here are
-                                        almost certainly wrong.
-                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                      type: string
-                                    optional:
-                                      description: Specify whether the Secret or its
-                                        key must be defined
-                                      type: boolean
-                                  required:
-                                  - key
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                              type: object
-                            bearer_token:
-                              description: SecretKeySelector selects a key of a Secret.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            bearer_token_file:
-                              type: string
-                            tls_config:
-                              x-kubernetes-preserve-unknown-fields: true
-                          type: object
-                        scrape_align_interval:
-                          type: string
-                        scrape_offset:
-                          type: string
-                        stream_parse:
-                          type: boolean
-                      type: object
-                  type: object
-                type: array
-              podTargetLabels:
-                description: PodTargetLabels transfers labels on the Kubernetes Pod
-                  onto the target.
-                items:
-                  type: string
-                type: array
-              sampleLimit:
-                description: SampleLimit defines per-scrape limit on number of scraped
-                  samples that will be accepted.
-                format: int64
-                type: integer
-              selector:
-                description: Selector to select Pod objects.
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              seriesLimit:
-                description: |-
-                  SeriesLimit defines per-scrape limit on number of unique time series
-                  a single target can expose during all the scrapes on the time window of 24h.
-                format: int64
-                type: integer
             required:
             - podMetricsEndpoints
             type: object
+            x-kubernetes-preserve-unknown-fields: true
           status:
-            description: ScrapeObjectStatus defines the observed state of ScrapeObjects
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -22667,16 +1382,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -22689,7 +1399,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmprobes.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -22713,1013 +1423,47 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: |-
-          VMProbe defines a probe for targets, that will be executed with prober,
-          like blackbox exporter.
-          It helps to monitor reachability of target with various checks.
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMProbeSpec contains specification parameters for a Probe.
-            properties:
-              authorization:
-                description: Authorization with http header Authorization
-                properties:
-                  credentials:
-                    description: Reference to the secret with value for authorization
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  credentialsFile:
-                    description: File with value for authorization
-                    type: string
-                  type:
-                    description: Type of authorization, default to bearer
-                    type: string
-                type: object
-              basicAuth:
-                description: BasicAuth allow an endpoint to authenticate over basic
-                  authentication
-                properties:
-                  password:
-                    description: |-
-                      Password defines reference for secret with password value
-                      The secret needs to be in the same namespace as scrape object
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  password_file:
-                    description: |-
-                      PasswordFile defines path to password file at disk
-                      must be pre-mounted
-                    type: string
-                  username:
-                    description: |-
-                      Username defines reference for secret with username value
-                      The secret needs to be in the same namespace as scrape object
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                type: object
-              bearerTokenFile:
-                description: File to read bearer token for scraping targets.
-                type: string
-              bearerTokenSecret:
-                description: |-
-                  Secret to mount to read bearer token for scraping targets. The secret
-                  needs to be in the same namespace as the scrape object and accessible by
-                  the victoria-metrics operator.
-                nullable: true
-                properties:
-                  key:
-                    description: The key of the secret to select from.  Must be a
-                      valid secret key.
-                    type: string
-                  name:
-                    default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                    type: string
-                  optional:
-                    description: Specify whether the Secret or its key must be defined
-                    type: boolean
-                required:
-                - key
-                type: object
-                x-kubernetes-map-type: atomic
-              follow_redirects:
-                description: FollowRedirects controls redirects for scraping.
-                type: boolean
-              honorLabels:
-                description: HonorLabels chooses the metric's labels on collisions
-                  with target labels.
-                type: boolean
-              honorTimestamps:
-                description: HonorTimestamps controls whether vmagent respects the
-                  timestamps present in scraped data.
-                type: boolean
-              interval:
-                description: Interval at which metrics should be scraped
-                type: string
-              jobName:
-                description: The job name assigned to scraped metrics by default.
-                type: string
-              max_scrape_size:
-                description: MaxScrapeSize defines a maximum size of scraped data
-                  for a job
-                type: string
-              metricRelabelConfigs:
-                description: MetricRelabelConfigs to apply to samples after scrapping.
-                items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
-                  properties:
-                    action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
-                      type: string
-                    if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
-                      x-kubernetes-preserve-unknown-fields: true
-                    labels:
-                      additionalProperties:
-                        type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
-                      type: object
-                    match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
-                      type: string
-                    modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
-                      format: int64
-                      type: integer
-                    regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                      x-kubernetes-preserve-unknown-fields: true
-                    replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
-                      type: string
-                    separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
-                      type: string
-                    source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      items:
-                        type: string
-                      type: array
-                    sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
-                      items:
-                        type: string
-                      type: array
-                    target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      type: string
-                    targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
-                      type: string
-                  type: object
-                type: array
-              module:
-                description: |-
-                  The module to use for probing specifying how to probe the target.
-                  Example module configuring in the blackbox exporter:
-                  https://github.com/prometheus/blackbox_exporter/blob/master/example.yml
-                type: string
-              oauth2:
-                description: OAuth2 defines auth configuration
-                properties:
-                  client_id:
-                    description: The secret or configmap containing the OAuth2 client
-                      id
-                    properties:
-                      configMap:
-                        description: ConfigMap containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key to select.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      secret:
-                        description: Secret containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  client_secret:
-                    description: The secret containing the OAuth2 client secret
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  client_secret_file:
-                    description: ClientSecretFile defines path for client secret file.
-                    type: string
-                  endpoint_params:
-                    additionalProperties:
-                      type: string
-                    description: Parameters to append to the token URL
-                    type: object
-                  proxy_url:
-                    description: |-
-                      The proxy URL for token_url connection
-                      ( available from v0.55.0).
-                      Is only supported by Scrape objects family
-                    type: string
-                  scopes:
-                    description: OAuth2 scopes used for the token request
-                    items:
-                      type: string
-                    type: array
-                  tls_config:
-                    description: |-
-                      TLSConfig for token_url connection
-                      ( available from v0.55.0).
-                      Is only supported by Scrape objects family
-                    x-kubernetes-preserve-unknown-fields: true
-                  token_url:
-                    description: The URL to fetch the token from
-                    minLength: 1
-                    type: string
-                required:
-                - client_id
-                - token_url
-                type: object
-              params:
-                additionalProperties:
-                  items:
-                    type: string
-                  type: array
-                description: Optional HTTP URL parameters
-                type: object
-              path:
-                description: HTTP path to scrape for metrics.
-                type: string
-              proxyURL:
-                description: ProxyURL eg http://proxyserver:2195 Directs scrapes to
-                  proxy through this endpoint.
-                type: string
-              sampleLimit:
-                description: SampleLimit defines per-scrape limit on number of scraped
-                  samples that will be accepted.
-                format: int64
-                type: integer
-              scheme:
-                description: HTTP scheme to use for scraping.
-                enum:
-                - http
-                - https
-                - HTTPS
-                - HTTP
-                type: string
-              scrape_interval:
-                description: |-
-                  ScrapeInterval is the same as Interval and has priority over it.
-                  one of scrape_interval or interval can be used
-                type: string
-              scrapeTimeout:
-                description: Timeout after which the scrape is ended
-                type: string
-              seriesLimit:
-                description: |-
-                  SeriesLimit defines per-scrape limit on number of unique time series
-                  a single target can expose during all the scrapes on the time window of 24h.
-                format: int64
-                type: integer
-              targets:
-                description: Targets defines a set of static and/or dynamically discovered
-                  targets to be probed using the prober.
-                properties:
-                  ingress:
-                    description: Ingress defines the set of dynamically discovered
-                      ingress objects which hosts are considered for probing.
-                    properties:
-                      namespaceSelector:
-                        description: Select Ingress objects by namespace.
-                        properties:
-                          any:
-                            description: |-
-                              Boolean describing whether all namespaces are selected in contrast to a
-                              list restricting them.
-                            type: boolean
-                          matchNames:
-                            description: List of namespace names.
-                            items:
-                              type: string
-                            type: array
-                        type: object
-                      relabelingConfigs:
-                        description: RelabelConfigs to apply to samples during service
-                          discovery.
-                        items:
-                          description: |-
-                            RelabelConfig allows dynamic rewriting of the label set
-                            More info: https://docs.victoriametrics.com/#relabeling
-                          properties:
-                            action:
-                              description: Action to perform based on regex matching.
-                                Default is 'replace'
-                              type: string
-                            if:
-                              description: 'If represents metricsQL match expression
-                                (or list of expressions): ''{__name__=~"foo_.*"}'''
-                              x-kubernetes-preserve-unknown-fields: true
-                            labels:
-                              additionalProperties:
-                                type: string
-                              description: 'Labels is used together with Match for
-                                `action: graphite`'
-                              type: object
-                            match:
-                              description: 'Match is used together with Labels for
-                                `action: graphite`'
-                              type: string
-                            modulus:
-                              description: Modulus to take of the hash of the source
-                                label values.
-                              format: int64
-                              type: integer
-                            regex:
-                              description: |-
-                                Regular expression against which the extracted value is matched. Default is '(.*)'
-                                victoriaMetrics supports multiline regex joined with |
-                                https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                              x-kubernetes-preserve-unknown-fields: true
-                            replacement:
-                              description: |-
-                                Replacement value against which a regex replace is performed if the
-                                regular expression matches. Regex capture groups are available. Default is '$1'
-                              type: string
-                            separator:
-                              description: Separator placed between concatenated source
-                                label values. default is ';'.
-                              type: string
-                            source_labels:
-                              description: |-
-                                UnderScoreSourceLabels - additional form of source labels source_labels
-                                for compatibility with original relabel config.
-                                if set  both sourceLabels and source_labels, sourceLabels has priority.
-                                for details https://github.com/VictoriaMetrics/operator/issues/131
-                              items:
-                                type: string
-                              type: array
-                            sourceLabels:
-                              description: |-
-                                The source labels select values from existing labels. Their content is concatenated
-                                using the configured separator and matched against the configured regular expression
-                                for the replace, keep, and drop actions.
-                              items:
-                                type: string
-                              type: array
-                            target_label:
-                              description: |-
-                                UnderScoreTargetLabel - additional form of target label - target_label
-                                for compatibility with original relabel config.
-                                if set  both targetLabel and target_label, targetLabel has priority.
-                                for details https://github.com/VictoriaMetrics/operator/issues/131
-                              type: string
-                            targetLabel:
-                              description: |-
-                                Label to which the resulting value is written in a replace action.
-                                It is mandatory for replace actions. Regex capture groups are available.
-                              type: string
-                          type: object
-                        type: array
-                      selector:
-                        description: Select Ingress objects by labels.
-                        properties:
-                          matchExpressions:
-                            description: matchExpressions is a list of label selector
-                              requirements. The requirements are ANDed.
-                            items:
-                              description: |-
-                                A label selector requirement is a selector that contains values, a key, and an operator that
-                                relates the key and values.
-                              properties:
-                                key:
-                                  description: key is the label key that the selector
-                                    applies to.
-                                  type: string
-                                operator:
-                                  description: |-
-                                    operator represents a key's relationship to a set of values.
-                                    Valid operators are In, NotIn, Exists and DoesNotExist.
-                                  type: string
-                                values:
-                                  description: |-
-                                    values is an array of string values. If the operator is In or NotIn,
-                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                    the values array must be empty. This array is replaced during a strategic
-                                    merge patch.
-                                  items:
-                                    type: string
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                              required:
-                              - key
-                              - operator
-                              type: object
-                            type: array
-                            x-kubernetes-list-type: atomic
-                          matchLabels:
-                            additionalProperties:
-                              type: string
-                            description: |-
-                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                              map is equivalent to an element of matchExpressions, whose key field is "key", the
-                              operator is "In", and the values array contains only "value". The requirements are ANDed.
-                            type: object
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  staticConfig:
-                    description: StaticConfig defines static targets which are considers
-                      for probing.
-                    properties:
-                      labels:
-                        additionalProperties:
-                          type: string
-                        description: Labels assigned to all metrics scraped from the
-                          targets.
-                        type: object
-                      relabelingConfigs:
-                        description: RelabelConfigs to apply to samples during service
-                          discovery.
-                        items:
-                          description: |-
-                            RelabelConfig allows dynamic rewriting of the label set
-                            More info: https://docs.victoriametrics.com/#relabeling
-                          properties:
-                            action:
-                              description: Action to perform based on regex matching.
-                                Default is 'replace'
-                              type: string
-                            if:
-                              description: 'If represents metricsQL match expression
-                                (or list of expressions): ''{__name__=~"foo_.*"}'''
-                              x-kubernetes-preserve-unknown-fields: true
-                            labels:
-                              additionalProperties:
-                                type: string
-                              description: 'Labels is used together with Match for
-                                `action: graphite`'
-                              type: object
-                            match:
-                              description: 'Match is used together with Labels for
-                                `action: graphite`'
-                              type: string
-                            modulus:
-                              description: Modulus to take of the hash of the source
-                                label values.
-                              format: int64
-                              type: integer
-                            regex:
-                              description: |-
-                                Regular expression against which the extracted value is matched. Default is '(.*)'
-                                victoriaMetrics supports multiline regex joined with |
-                                https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                              x-kubernetes-preserve-unknown-fields: true
-                            replacement:
-                              description: |-
-                                Replacement value against which a regex replace is performed if the
-                                regular expression matches. Regex capture groups are available. Default is '$1'
-                              type: string
-                            separator:
-                              description: Separator placed between concatenated source
-                                label values. default is ';'.
-                              type: string
-                            source_labels:
-                              description: |-
-                                UnderScoreSourceLabels - additional form of source labels source_labels
-                                for compatibility with original relabel config.
-                                if set  both sourceLabels and source_labels, sourceLabels has priority.
-                                for details https://github.com/VictoriaMetrics/operator/issues/131
-                              items:
-                                type: string
-                              type: array
-                            sourceLabels:
-                              description: |-
-                                The source labels select values from existing labels. Their content is concatenated
-                                using the configured separator and matched against the configured regular expression
-                                for the replace, keep, and drop actions.
-                              items:
-                                type: string
-                              type: array
-                            target_label:
-                              description: |-
-                                UnderScoreTargetLabel - additional form of target label - target_label
-                                for compatibility with original relabel config.
-                                if set  both targetLabel and target_label, targetLabel has priority.
-                                for details https://github.com/VictoriaMetrics/operator/issues/131
-                              type: string
-                            targetLabel:
-                              description: |-
-                                Label to which the resulting value is written in a replace action.
-                                It is mandatory for replace actions. Regex capture groups are available.
-                              type: string
-                          type: object
-                        type: array
-                      targets:
-                        description: Targets is a list of URLs to probe using the
-                          configured prober.
-                        items:
-                          type: string
-                        type: array
-                    required:
-                    - targets
-                    type: object
-                type: object
-              tlsConfig:
-                description: TLSConfig configuration to use when scraping the endpoint
-                properties:
-                  ca:
-                    description: Struct containing the CA cert to use for the targets.
-                    properties:
-                      configMap:
-                        description: ConfigMap containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key to select.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      secret:
-                        description: Secret containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  caFile:
-                    description: Path to the CA cert in the container to use for the
-                      targets.
-                    type: string
-                  cert:
-                    description: Struct containing the client cert file for the targets.
-                    properties:
-                      configMap:
-                        description: ConfigMap containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key to select.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      secret:
-                        description: Secret containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  certFile:
-                    description: Path to the client cert file in the container for
-                      the targets.
-                    type: string
-                  insecureSkipVerify:
-                    description: Disable target certificate validation.
-                    type: boolean
-                  keyFile:
-                    description: Path to the client key file in the container for
-                      the targets.
-                    type: string
-                  keySecret:
-                    description: Secret containing the client key file for the targets.
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  serverName:
-                    description: Used to verify the hostname for the targets.
-                    type: string
-                type: object
-              vm_scrape_params:
-                description: VMScrapeParams defines VictoriaMetrics specific scrape
-                  parameters
-                properties:
-                  disable_compression:
-                    description: DisableCompression
-                    type: boolean
-                  disable_keep_alive:
-                    description: |-
-                      disable_keepalive allows disabling HTTP keep-alive when scraping targets.
-                      By default, HTTP keep-alive is enabled, so TCP connections to scrape targets
-                      could be reused.
-                      See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements
-                    type: boolean
-                  headers:
-                    description: |-
-                      Headers allows sending custom headers to scrape targets
-                      must be in of semicolon separated header with it's value
-                      eg:
-                      headerName: headerValue
-                      vmagent supports since 1.79.0 version
-                    items:
-                      type: string
-                    type: array
-                  no_stale_markers:
-                    type: boolean
-                  proxy_client_config:
-                    description: |-
-                      ProxyClientConfig configures proxy auth settings for scraping
-                      See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy
-                    properties:
-                      basic_auth:
-                        description: BasicAuth allow an endpoint to authenticate over
-                          basic authentication
-                        properties:
-                          password:
-                            description: |-
-                              Password defines reference for secret with password value
-                              The secret needs to be in the same namespace as scrape object
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          password_file:
-                            description: |-
-                              PasswordFile defines path to password file at disk
-                              must be pre-mounted
-                            type: string
-                          username:
-                            description: |-
-                              Username defines reference for secret with username value
-                              The secret needs to be in the same namespace as scrape object
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                        type: object
-                      bearer_token:
-                        description: SecretKeySelector selects a key of a Secret.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      bearer_token_file:
-                        type: string
-                      tls_config:
-                        x-kubernetes-preserve-unknown-fields: true
-                    type: object
-                  scrape_align_interval:
-                    type: string
-                  scrape_offset:
-                    type: string
-                  stream_parse:
-                    type: boolean
-                type: object
-              vmProberSpec:
-                description: |-
-                  Specification for the prober to use for probing targets.
-                  The prober.URL parameter is required. Targets cannot be probed if left empty.
-                properties:
-                  path:
-                    description: |-
-                      Path to collect metrics from.
-                      Defaults to `/probe`.
-                    type: string
-                  scheme:
-                    description: |-
-                      HTTP scheme to use for scraping.
-                      Defaults to `http`.
-                    enum:
-                    - http
-                    - https
-                    type: string
-                  url:
-                    description: Mandatory URL of the prober.
-                    type: string
-                required:
-                - url
-                type: object
             required:
             - vmProberSpec
             type: object
+            x-kubernetes-preserve-unknown-fields: true
           status:
-            description: ScrapeObjectStatus defines the observed state of ScrapeObjects
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -23734,16 +1478,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         required:
@@ -23758,7 +1497,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmrules.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -23782,234 +1521,47 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: VMRule defines rule records for vmalert application
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMRuleSpec defines the desired state of VMRule
-            properties:
-              groups:
-                description: Groups list of group rules
-                items:
-                  description: RuleGroup is a list of sequentially evaluated recording
-                    and alerting rules.
-                  properties:
-                    concurrency:
-                      description: Concurrency defines how many rules execute at once.
-                      type: integer
-                    eval_alignment:
-                      description: |-
-                        Optional
-                        The evaluation timestamp will be aligned with group's interval,
-                        instead of using the actual timestamp that evaluation happens at.
-                        It is enabled by default to get more predictable results
-                        and to visually align with graphs plotted via Grafana or vmui.
-                      type: boolean
-                    eval_delay:
-                      description: |-
-                        Optional
-                        Adjust the `time` parameter of group evaluation requests to compensate intentional query delay from the datasource.
-                      type: string
-                    eval_offset:
-                      description: |-
-                        Optional
-                        Group will be evaluated at the exact offset in the range of [0...interval].
-                      type: string
-                    extra_filter_labels:
-                      additionalProperties:
-                        type: string
-                      description: |-
-                        ExtraFilterLabels optional list of label filters applied to every rule's
-                        request within a group. Is compatible only with VM datasource.
-                        See more details [here](https://docs.victoriametrics.com/#prometheus-querying-api-enhancements)
-                        Deprecated, use params instead
-                      type: object
-                    headers:
-                      description: |-
-                        Headers contains optional HTTP headers added to each rule request
-                        Must be in form `header-name: value`
-                        For example:
-                         headers:
-                           - "CustomHeader: foo"
-                           - "CustomHeader2: bar"
-                      items:
-                        type: string
-                      type: array
-                    interval:
-                      description: evaluation interval for group
-                      type: string
-                    labels:
-                      additionalProperties:
-                        type: string
-                      description: |-
-                        Labels optional list of labels added to every rule within a group.
-                        It has priority over the external labels.
-                        Labels are commonly used for adding environment
-                        or tenant-specific tag.
-                      type: object
-                    limit:
-                      description: |-
-                        Limit the number of alerts an alerting rule and series a recording
-                        rule can produce
-                      type: integer
-                    name:
-                      description: Name of group
-                      type: string
-                    notifier_headers:
-                      description: |-
-                        NotifierHeaders contains optional HTTP headers added to each alert request which will send to notifier
-                        Must be in form `header-name: value`
-                        For example:
-                         headers:
-                           - "CustomHeader: foo"
-                           - "CustomHeader2: bar"
-                      items:
-                        type: string
-                      type: array
-                    params:
-                      additionalProperties:
-                        items:
-                          type: string
-                        type: array
-                      description: Params optional HTTP URL parameters added to each
-                        rule request
-                      type: object
-                    rules:
-                      description: Rules list of alert rules
-                      items:
-                        description: Rule describes an alerting or recording rule.
-                        properties:
-                          alert:
-                            description: Alert is a name for alert
-                            type: string
-                          annotations:
-                            additionalProperties:
-                              type: string
-                            description: Annotations will be added to rule configuration
-                            type: object
-                          debug:
-                            description: |-
-                              Debug enables logging for rule
-                              it useful for tracking
-                            type: boolean
-                          expr:
-                            description: Expr is query, that will be evaluated at
-                              dataSource
-                            type: string
-                          for:
-                            description: |-
-                              For evaluation interval in time.Duration format
-                              30s, 1m, 1h  or nanoseconds
-                            type: string
-                          keep_firing_for:
-                            description: |-
-                              KeepFiringFor will make alert continue firing for this long
-                              even when the alerting expression no longer has results.
-                              Use time.Duration format, 30s, 1m, 1h  or nanoseconds
-                            type: string
-                          labels:
-                            additionalProperties:
-                              type: string
-                            description: Labels will be added to rule configuration
-                            type: object
-                          record:
-                            description: Record represents a query, that will be recorded
-                              to dataSource
-                            type: string
-                          update_entries_limit:
-                            description: |-
-                              UpdateEntriesLimit defines max number of rule's state updates stored in memory.
-                              Overrides `-rule.updateEntriesLimit` in vmalert.
-                            type: integer
-                        type: object
-                      type: array
-                    tenant:
-                      description: |-
-                        Tenant id for group, can be used only with enterprise version of vmalert.
-                        See more details [here](https://docs.victoriametrics.com/vmalert#multitenancy).
-                      type: string
-                    type:
-                      description: |-
-                        Type defines datasource type for enterprise version of vmalert
-                        possible values - prometheus,graphite,vlogs
-                      type: string
-                  required:
-                  - name
-                  - rules
-                  type: object
-                type: array
             required:
             - groups
             type: object
+            x-kubernetes-preserve-unknown-fields: true
           status:
-            description: VMRuleStatus defines the observed state of VMRule
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -24024,16 +1576,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         required:
@@ -24048,7 +1595,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmscrapeconfigs.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -24072,3255 +1619,45 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: VMScrapeConfig specifies a set of targets and parameters describing
-          how to scrape them.
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMScrapeConfigSpec defines the desired state of VMScrapeConfig
-            properties:
-              authorization:
-                description: Authorization with http header Authorization
-                properties:
-                  credentials:
-                    description: Reference to the secret with value for authorization
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  credentialsFile:
-                    description: File with value for authorization
-                    type: string
-                  type:
-                    description: Type of authorization, default to bearer
-                    type: string
-                type: object
-              azureSDConfigs:
-                description: AzureSDConfigs defines a list of Azure service discovery
-                  configurations.
-                items:
-                  description: |-
-                    AzureSDConfig allow retrieving scrape targets from Azure VMs.
-                    See [here](https://docs.victoriametrics.com/sd_configs#azure_sd_configs)
-                  properties:
-                    authenticationMethod:
-                      description: |-
-                        # The authentication method, either OAuth or ManagedIdentity.
-                        See https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview
-                      enum:
-                      - OAuth
-                      - ManagedIdentity
-                      type: string
-                    clientID:
-                      description: Optional client ID. Only required with the OAuth
-                        authentication method.
-                      type: string
-                    clientSecret:
-                      description: Optional client secret. Only required with the
-                        OAuth authentication method.
-                      properties:
-                        key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
-                          type: string
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
-                          type: boolean
-                      required:
-                      - key
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    environment:
-                      description: The Azure environment.
-                      type: string
-                    port:
-                      description: |-
-                        The port to scrape metrics from. If using the public IP address, this must
-                        instead be specified in the relabeling rule.
-                      type: integer
-                    resourceGroup:
-                      description: Optional resource group name. Limits discovery
-                        to this resource group.
-                      type: string
-                    subscriptionID:
-                      description: The subscription ID. Always required.
-                      minLength: 1
-                      type: string
-                    tenantID:
-                      description: Optional tenant ID. Only required with the OAuth
-                        authentication method.
-                      type: string
-                  required:
-                  - subscriptionID
-                  type: object
-                type: array
-              basicAuth:
-                description: BasicAuth allow an endpoint to authenticate over basic
-                  authentication
-                properties:
-                  password:
-                    description: |-
-                      Password defines reference for secret with password value
-                      The secret needs to be in the same namespace as scrape object
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  password_file:
-                    description: |-
-                      PasswordFile defines path to password file at disk
-                      must be pre-mounted
-                    type: string
-                  username:
-                    description: |-
-                      Username defines reference for secret with username value
-                      The secret needs to be in the same namespace as scrape object
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                type: object
-              bearerTokenFile:
-                description: File to read bearer token for scraping targets.
-                type: string
-              bearerTokenSecret:
-                description: |-
-                  Secret to mount to read bearer token for scraping targets. The secret
-                  needs to be in the same namespace as the scrape object and accessible by
-                  the victoria-metrics operator.
-                nullable: true
-                properties:
-                  key:
-                    description: The key of the secret to select from.  Must be a
-                      valid secret key.
-                    type: string
-                  name:
-                    default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                    type: string
-                  optional:
-                    description: Specify whether the Secret or its key must be defined
-                    type: boolean
-                required:
-                - key
-                type: object
-                x-kubernetes-map-type: atomic
-              consulSDConfigs:
-                description: ConsulSDConfigs defines a list of Consul service discovery
-                  configurations.
-                items:
-                  description: |-
-                    ConsulSDConfig defines a Consul service discovery configuration.
-                    See [here](https://docs.victoriametrics.com/sd_configs/#consul_sd_configs)
-                  properties:
-                    allowStale:
-                      description: |-
-                        Allow stale Consul results (see https://developer.hashicorp.com/consul/api-docs/features/consistency). Will reduce load on Consul.
-                        If unset, use its default value.
-                      type: boolean
-                    authorization:
-                      description: Authorization header to use on every scrape request.
-                      properties:
-                        credentials:
-                          description: Reference to the secret with value for authorization
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        credentialsFile:
-                          description: File with value for authorization
-                          type: string
-                        type:
-                          description: Type of authorization, default to bearer
-                          type: string
-                      type: object
-                    basicAuth:
-                      description: BasicAuth information to use on every scrape request.
-                      properties:
-                        password:
-                          description: |-
-                            Password defines reference for secret with password value
-                            The secret needs to be in the same namespace as scrape object
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        password_file:
-                          description: |-
-                            PasswordFile defines path to password file at disk
-                            must be pre-mounted
-                          type: string
-                        username:
-                          description: |-
-                            Username defines reference for secret with username value
-                            The secret needs to be in the same namespace as scrape object
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                      type: object
-                    datacenter:
-                      description: Consul Datacenter name, if not provided it will
-                        use the local Consul Agent Datacenter.
-                      type: string
-                    filter:
-                      description: |-
-                        Filter defines filter for /v1/catalog/services requests
-                        See https://developer.hashicorp.com/consul/api-docs/features/filtering
-                      type: string
-                    followRedirects:
-                      description: |-
-                        Configure whether HTTP requests follow HTTP 3xx redirects.
-                        If unset, use its default value.
-                      type: boolean
-                    namespace:
-                      description: Namespaces are only supported in Consul Enterprise.
-                      type: string
-                    nodeMeta:
-                      additionalProperties:
-                        type: string
-                      description: Node metadata key/value pairs to filter nodes for
-                        a given service.
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    oauth2:
-                      description: OAuth2 defines auth configuration
-                      properties:
-                        client_id:
-                          description: The secret or configmap containing the OAuth2
-                            client id
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        client_secret:
-                          description: The secret containing the OAuth2 client secret
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        client_secret_file:
-                          description: ClientSecretFile defines path for client secret
-                            file.
-                          type: string
-                        endpoint_params:
-                          additionalProperties:
-                            type: string
-                          description: Parameters to append to the token URL
-                          type: object
-                        proxy_url:
-                          description: |-
-                            The proxy URL for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
-                          type: string
-                        scopes:
-                          description: OAuth2 scopes used for the token request
-                          items:
-                            type: string
-                          type: array
-                        tls_config:
-                          description: |-
-                            TLSConfig for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
-                          x-kubernetes-preserve-unknown-fields: true
-                        token_url:
-                          description: The URL to fetch the token from
-                          minLength: 1
-                          type: string
-                      required:
-                      - client_id
-                      - token_url
-                      type: object
-                    partition:
-                      description: Admin Partitions are only supported in Consul Enterprise.
-                      type: string
-                    proxy_client_config:
-                      description: |-
-                        ProxyClientConfig configures proxy auth settings for scraping
-                        See [feature description](https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy)
-                      properties:
-                        basic_auth:
-                          description: BasicAuth allow an endpoint to authenticate
-                            over basic authentication
-                          properties:
-                            password:
-                              description: |-
-                                Password defines reference for secret with password value
-                                The secret needs to be in the same namespace as scrape object
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            password_file:
-                              description: |-
-                                PasswordFile defines path to password file at disk
-                                must be pre-mounted
-                              type: string
-                            username:
-                              description: |-
-                                Username defines reference for secret with username value
-                                The secret needs to be in the same namespace as scrape object
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        bearer_token:
-                          description: SecretKeySelector selects a key of a Secret.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        bearer_token_file:
-                          type: string
-                        tls_config:
-                          x-kubernetes-preserve-unknown-fields: true
-                      type: object
-                    proxyURL:
-                      description: ProxyURL eg http://proxyserver:2195 Directs scrapes
-                        to proxy through this endpoint.
-                      type: string
-                    scheme:
-                      description: HTTP Scheme default "http"
-                      enum:
-                      - HTTP
-                      - HTTPS
-                      type: string
-                    server:
-                      description: A valid string consisting of a hostname or IP followed
-                        by an optional port number.
-                      minLength: 1
-                      type: string
-                    services:
-                      description: A list of services for which targets are retrieved.
-                        If omitted, all services are scraped.
-                      items:
-                        type: string
-                      type: array
-                      x-kubernetes-list-type: atomic
-                    tagSeparator:
-                      description: |-
-                        The string by which Consul tags are joined into the tag label.
-                        If unset, use its default value.
-                      type: string
-                    tags:
-                      description: An optional list of tags used to filter nodes for
-                        a given service. Services must contain all tags in the list.
-                      items:
-                        type: string
-                      type: array
-                      x-kubernetes-list-type: atomic
-                    tlsConfig:
-                      description: TLS configuration to use on every scrape request
-                      properties:
-                        ca:
-                          description: Struct containing the CA cert to use for the
-                            targets.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        caFile:
-                          description: Path to the CA cert in the container to use
-                            for the targets.
-                          type: string
-                        cert:
-                          description: Struct containing the client cert file for
-                            the targets.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        certFile:
-                          description: Path to the client cert file in the container
-                            for the targets.
-                          type: string
-                        insecureSkipVerify:
-                          description: Disable target certificate validation.
-                          type: boolean
-                        keyFile:
-                          description: Path to the client key file in the container
-                            for the targets.
-                          type: string
-                        keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        serverName:
-                          description: Used to verify the hostname for the targets.
-                          type: string
-                      type: object
-                    tokenRef:
-                      description: Consul ACL TokenRef, if not provided it will use
-                        the ACL from the local Consul Agent.
-                      properties:
-                        key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
-                          type: string
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
-                          type: boolean
-                      required:
-                      - key
-                      type: object
-                      x-kubernetes-map-type: atomic
-                  required:
-                  - server
-                  type: object
-                type: array
-              digitalOceanSDConfigs:
-                description: DigitalOceanSDConfigs defines a list of DigitalOcean
-                  service discovery configurations.
-                items:
-                  description: |-
-                    DigitalOceanSDConfig allow retrieving scrape targets from DigitalOcean's Droplets API.
-                    This service discovery uses the public IPv4 address by default, by that can be changed with relabeling.
-                    See [here](https://docs.victoriametrics.com/sd_configs#digitalocean_sd_configs)
-                  properties:
-                    authorization:
-                      description: Authorization header to use on every scrape request.
-                      properties:
-                        credentials:
-                          description: Reference to the secret with value for authorization
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        credentialsFile:
-                          description: File with value for authorization
-                          type: string
-                        type:
-                          description: Type of authorization, default to bearer
-                          type: string
-                      type: object
-                    followRedirects:
-                      description: Configure whether HTTP requests follow HTTP 3xx
-                        redirects.
-                      type: boolean
-                    oauth2:
-                      description: OAuth2 defines auth configuration
-                      properties:
-                        client_id:
-                          description: The secret or configmap containing the OAuth2
-                            client id
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        client_secret:
-                          description: The secret containing the OAuth2 client secret
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        client_secret_file:
-                          description: ClientSecretFile defines path for client secret
-                            file.
-                          type: string
-                        endpoint_params:
-                          additionalProperties:
-                            type: string
-                          description: Parameters to append to the token URL
-                          type: object
-                        proxy_url:
-                          description: |-
-                            The proxy URL for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
-                          type: string
-                        scopes:
-                          description: OAuth2 scopes used for the token request
-                          items:
-                            type: string
-                          type: array
-                        tls_config:
-                          description: |-
-                            TLSConfig for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
-                          x-kubernetes-preserve-unknown-fields: true
-                        token_url:
-                          description: The URL to fetch the token from
-                          minLength: 1
-                          type: string
-                      required:
-                      - client_id
-                      - token_url
-                      type: object
-                    port:
-                      description: The port to scrape metrics from.
-                      type: integer
-                    proxy_client_config:
-                      description: |-
-                        ProxyClientConfig configures proxy auth settings for scraping
-                        See [feature description](https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy)
-                      properties:
-                        basic_auth:
-                          description: BasicAuth allow an endpoint to authenticate
-                            over basic authentication
-                          properties:
-                            password:
-                              description: |-
-                                Password defines reference for secret with password value
-                                The secret needs to be in the same namespace as scrape object
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            password_file:
-                              description: |-
-                                PasswordFile defines path to password file at disk
-                                must be pre-mounted
-                              type: string
-                            username:
-                              description: |-
-                                Username defines reference for secret with username value
-                                The secret needs to be in the same namespace as scrape object
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        bearer_token:
-                          description: SecretKeySelector selects a key of a Secret.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        bearer_token_file:
-                          type: string
-                        tls_config:
-                          x-kubernetes-preserve-unknown-fields: true
-                      type: object
-                    proxyURL:
-                      description: ProxyURL eg http://proxyserver:2195 Directs scrapes
-                        to proxy through this endpoint.
-                      type: string
-                    tlsConfig:
-                      description: TLS configuration to use on every scrape request
-                      properties:
-                        ca:
-                          description: Struct containing the CA cert to use for the
-                            targets.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        caFile:
-                          description: Path to the CA cert in the container to use
-                            for the targets.
-                          type: string
-                        cert:
-                          description: Struct containing the client cert file for
-                            the targets.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        certFile:
-                          description: Path to the client cert file in the container
-                            for the targets.
-                          type: string
-                        insecureSkipVerify:
-                          description: Disable target certificate validation.
-                          type: boolean
-                        keyFile:
-                          description: Path to the client key file in the container
-                            for the targets.
-                          type: string
-                        keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        serverName:
-                          description: Used to verify the hostname for the targets.
-                          type: string
-                      type: object
-                  type: object
-                type: array
-              dnsSDConfigs:
-                description: DNSSDConfigs defines a list of DNS service discovery
-                  configurations.
-                items:
-                  description: |-
-                    DNSSDConfig allows specifying a set of DNS domain names which are periodically queried to discover a list of targets.
-                    The DNS servers to be contacted are read from /etc/resolv.conf.
-                    See [here](https://docs.victoriametrics.com/sd_configs#dns_sd_configs)
-                  properties:
-                    names:
-                      description: A list of DNS domain names to be queried.
-                      items:
-                        type: string
-                      minItems: 1
-                      type: array
-                    port:
-                      description: |-
-                        The port number used if the query type is not SRV
-                        Ignored for SRV records
-                      type: integer
-                    type:
-                      enum:
-                      - SRV
-                      - A
-                      - AAAA
-                      - MX
-                      type: string
-                  required:
-                  - names
-                  type: object
-                type: array
-              ec2SDConfigs:
-                description: EC2SDConfigs defines a list of EC2 service discovery
-                  configurations.
-                items:
-                  description: |-
-                    EC2SDConfig allow retrieving scrape targets from AWS EC2 instances.
-                    The private IP address is used by default, but may be changed to the public IP address with relabeling.
-                    The IAM credentials used must have the ec2:DescribeInstances permission to discover scrape targets.
-                    See [here](https://docs.victoriametrics.com/sd_configs#ec2_sd_configs)
-                  properties:
-                    accessKey:
-                      description: AccessKey is the AWS API key.
-                      properties:
-                        key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
-                          type: string
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
-                          type: boolean
-                      required:
-                      - key
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    filters:
-                      description: |-
-                        Filters can be used optionally to filter the instance list by other criteria.
-                        Available filter criteria can be found here:
-                        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html
-                        Filter API documentation: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_Filter.html
-                      items:
-                        description: EC2Filter is the configuration for filtering
-                          EC2 instances.
-                        properties:
-                          name:
-                            type: string
-                          values:
-                            items:
-                              type: string
-                            type: array
-                        required:
-                        - name
-                        - values
-                        type: object
-                      type: array
-                    port:
-                      description: |-
-                        The port to scrape metrics from. If using the public IP address, this must
-                        instead be specified in the relabeling rule.
-                      type: integer
-                    region:
-                      description: The AWS region
-                      type: string
-                    roleARN:
-                      description: AWS Role ARN, an alternative to using AWS API keys.
-                      type: string
-                    secretKey:
-                      description: SecretKey is the AWS API secret.
-                      properties:
-                        key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
-                          type: string
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
-                          type: boolean
-                      required:
-                      - key
-                      type: object
-                      x-kubernetes-map-type: atomic
-                  type: object
-                type: array
-              fileSDConfigs:
-                description: FileSDConfigs defines a list of file service discovery
-                  configurations.
-                items:
-                  description: |-
-                    FileSDConfig defines a file service discovery configuration.
-                    See [here](https://docs.victoriametrics.com/sd_configs#file_sd_configs)
-                  properties:
-                    files:
-                      description: List of files to be used for file discovery.
-                      items:
-                        type: string
-                      minItems: 1
-                      type: array
-                  required:
-                  - files
-                  type: object
-                type: array
-              follow_redirects:
-                description: FollowRedirects controls redirects for scraping.
-                type: boolean
-              gceSDConfigs:
-                description: GCESDConfigs defines a list of GCE service discovery
-                  configurations.
-                items:
-                  description: |-
-                    GCESDConfig configures scrape targets from GCP GCE instances.
-                    The private IP address is used by default, but may be changed to
-                    the public IP address with relabeling.
-                    See [here](https://docs.victoriametrics.com/sd_configs#gce_sd_configs)
-
-                    The GCE service discovery will load the Google Cloud credentials
-                    from the file specified by the GOOGLE_APPLICATION_CREDENTIALS environment variable.
-                    See https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform
-                  properties:
-                    filter:
-                      description: |-
-                        Filter can be used optionally to filter the instance list by other criteria
-                        Syntax of this filter is described in the filter query parameter section:
-                        https://cloud.google.com/compute/docs/reference/latest/instances/list
-                      type: string
-                    port:
-                      description: |-
-                        The port to scrape metrics from. If using the public IP address, this must
-                        instead be specified in the relabeling rule.
-                      type: integer
-                    project:
-                      description: The Google Cloud Project ID
-                      minLength: 1
-                      type: string
-                    tagSeparator:
-                      description: The tag separator is used to separate the tags
-                        on concatenation
-                      type: string
-                    zone:
-                      description: The zone of the scrape targets. If you need multiple
-                        zones use multiple GCESDConfigs.
-                      x-kubernetes-preserve-unknown-fields: true
-                  required:
-                  - project
-                  - zone
-                  type: object
-                type: array
-              honorLabels:
-                description: HonorLabels chooses the metric's labels on collisions
-                  with target labels.
-                type: boolean
-              honorTimestamps:
-                description: HonorTimestamps controls whether vmagent respects the
-                  timestamps present in scraped data.
-                type: boolean
-              httpSDConfigs:
-                description: HTTPSDConfigs defines a list of HTTP service discovery
-                  configurations.
-                items:
-                  description: |-
-                    HTTPSDConfig defines a HTTP service discovery configuration.
-                    See [here](https://docs.victoriametrics.com/sd_configs#http_sd_configs)
-                  properties:
-                    authorization:
-                      description: Authorization header to use on every scrape request.
-                      properties:
-                        credentials:
-                          description: Reference to the secret with value for authorization
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        credentialsFile:
-                          description: File with value for authorization
-                          type: string
-                        type:
-                          description: Type of authorization, default to bearer
-                          type: string
-                      type: object
-                    basicAuth:
-                      description: BasicAuth information to use on every scrape request.
-                      properties:
-                        password:
-                          description: |-
-                            Password defines reference for secret with password value
-                            The secret needs to be in the same namespace as scrape object
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        password_file:
-                          description: |-
-                            PasswordFile defines path to password file at disk
-                            must be pre-mounted
-                          type: string
-                        username:
-                          description: |-
-                            Username defines reference for secret with username value
-                            The secret needs to be in the same namespace as scrape object
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                      type: object
-                    proxy_client_config:
-                      description: |-
-                        ProxyClientConfig configures proxy auth settings for scraping
-                        See [feature description](https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy)
-                      properties:
-                        basic_auth:
-                          description: BasicAuth allow an endpoint to authenticate
-                            over basic authentication
-                          properties:
-                            password:
-                              description: |-
-                                Password defines reference for secret with password value
-                                The secret needs to be in the same namespace as scrape object
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            password_file:
-                              description: |-
-                                PasswordFile defines path to password file at disk
-                                must be pre-mounted
-                              type: string
-                            username:
-                              description: |-
-                                Username defines reference for secret with username value
-                                The secret needs to be in the same namespace as scrape object
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        bearer_token:
-                          description: SecretKeySelector selects a key of a Secret.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        bearer_token_file:
-                          type: string
-                        tls_config:
-                          x-kubernetes-preserve-unknown-fields: true
-                      type: object
-                    proxyURL:
-                      description: ProxyURL eg http://proxyserver:2195 Directs scrapes
-                        to proxy through this endpoint.
-                      type: string
-                    tlsConfig:
-                      description: TLS configuration to use on every scrape request
-                      properties:
-                        ca:
-                          description: Struct containing the CA cert to use for the
-                            targets.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        caFile:
-                          description: Path to the CA cert in the container to use
-                            for the targets.
-                          type: string
-                        cert:
-                          description: Struct containing the client cert file for
-                            the targets.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        certFile:
-                          description: Path to the client cert file in the container
-                            for the targets.
-                          type: string
-                        insecureSkipVerify:
-                          description: Disable target certificate validation.
-                          type: boolean
-                        keyFile:
-                          description: Path to the client key file in the container
-                            for the targets.
-                          type: string
-                        keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        serverName:
-                          description: Used to verify the hostname for the targets.
-                          type: string
-                      type: object
-                    url:
-                      description: URL from which the targets are fetched.
-                      minLength: 1
-                      pattern: ^http(s)?://.+$
-                      type: string
-                  required:
-                  - url
-                  type: object
-                type: array
-              interval:
-                description: Interval at which metrics should be scraped
-                type: string
-              kubernetesSDConfigs:
-                description: KubernetesSDConfigs defines a list of Kubernetes service
-                  discovery configurations.
-                items:
-                  description: |-
-                    KubernetesSDConfig allows retrieving scrape targets from Kubernetes' REST API.
-                    See [here](https://docs.victoriametrics.com/sd_configs#kubernetes_sd_configs)
-                  properties:
-                    apiServer:
-                      description: |-
-                        The API server address consisting of a hostname or IP address followed
-                        by an optional port number.
-                        If left empty, assuming process is running inside
-                        of the cluster. It will discover API servers automatically and use the pod's
-                        CA certificate and bearer token file at /var/run/secrets/kubernetes.io/serviceaccount/.
-                      type: string
-                    attach_metadata:
-                      description: AttachMetadata configures metadata attaching from
-                        service discovery
-                      properties:
-                        node:
-                          description: |-
-                            Node instructs vmagent to add node specific metadata from service discovery
-                            Valid for roles: pod, endpoints, endpointslice.
-                          type: boolean
-                      type: object
-                    authorization:
-                      description: Authorization header to use on every scrape request.
-                      properties:
-                        credentials:
-                          description: Reference to the secret with value for authorization
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        credentialsFile:
-                          description: File with value for authorization
-                          type: string
-                        type:
-                          description: Type of authorization, default to bearer
-                          type: string
-                      type: object
-                    basicAuth:
-                      description: BasicAuth information to use on every scrape request.
-                      properties:
-                        password:
-                          description: |-
-                            Password defines reference for secret with password value
-                            The secret needs to be in the same namespace as scrape object
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        password_file:
-                          description: |-
-                            PasswordFile defines path to password file at disk
-                            must be pre-mounted
-                          type: string
-                        username:
-                          description: |-
-                            Username defines reference for secret with username value
-                            The secret needs to be in the same namespace as scrape object
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                      type: object
-                    followRedirects:
-                      description: Configure whether HTTP requests follow HTTP 3xx
-                        redirects.
-                      type: boolean
-                    namespaces:
-                      description: Optional namespace discovery. If omitted, discover
-                        targets across all namespaces.
-                      properties:
-                        names:
-                          description: |-
-                            List of namespaces where to watch for resources.
-                            If empty and `ownNamespace` isn't true, watch for resources in all namespaces.
-                          items:
-                            type: string
-                          type: array
-                        ownNamespace:
-                          description: Includes the namespace in which the pod exists
-                            to the list of watched namespaces.
-                          type: boolean
-                      type: object
-                    oauth2:
-                      description: OAuth2 defines auth configuration
-                      properties:
-                        client_id:
-                          description: The secret or configmap containing the OAuth2
-                            client id
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        client_secret:
-                          description: The secret containing the OAuth2 client secret
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        client_secret_file:
-                          description: ClientSecretFile defines path for client secret
-                            file.
-                          type: string
-                        endpoint_params:
-                          additionalProperties:
-                            type: string
-                          description: Parameters to append to the token URL
-                          type: object
-                        proxy_url:
-                          description: |-
-                            The proxy URL for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
-                          type: string
-                        scopes:
-                          description: OAuth2 scopes used for the token request
-                          items:
-                            type: string
-                          type: array
-                        tls_config:
-                          description: |-
-                            TLSConfig for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
-                          x-kubernetes-preserve-unknown-fields: true
-                        token_url:
-                          description: The URL to fetch the token from
-                          minLength: 1
-                          type: string
-                      required:
-                      - client_id
-                      - token_url
-                      type: object
-                    proxy_client_config:
-                      description: |-
-                        ProxyClientConfig configures proxy auth settings for scraping
-                        See [feature description](https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy)
-                      properties:
-                        basic_auth:
-                          description: BasicAuth allow an endpoint to authenticate
-                            over basic authentication
-                          properties:
-                            password:
-                              description: |-
-                                Password defines reference for secret with password value
-                                The secret needs to be in the same namespace as scrape object
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            password_file:
-                              description: |-
-                                PasswordFile defines path to password file at disk
-                                must be pre-mounted
-                              type: string
-                            username:
-                              description: |-
-                                Username defines reference for secret with username value
-                                The secret needs to be in the same namespace as scrape object
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        bearer_token:
-                          description: SecretKeySelector selects a key of a Secret.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        bearer_token_file:
-                          type: string
-                        tls_config:
-                          x-kubernetes-preserve-unknown-fields: true
-                      type: object
-                    proxyURL:
-                      description: ProxyURL eg http://proxyserver:2195 Directs scrapes
-                        to proxy through this endpoint.
-                      type: string
-                    role:
-                      description: Role of the Kubernetes entities that should be
-                        discovered.
-                      type: string
-                    selectors:
-                      description: Selector to select objects.
-                      items:
-                        description: K8SSelectorConfig is Kubernetes Selector Config
-                        properties:
-                          field:
-                            type: string
-                          label:
-                            type: string
-                          role:
-                            type: string
-                        required:
-                        - role
-                        type: object
-                      type: array
-                      x-kubernetes-list-map-keys:
-                      - role
-                      x-kubernetes-list-type: map
-                    tlsConfig:
-                      description: TLS configuration to use on every scrape request
-                      properties:
-                        ca:
-                          description: Struct containing the CA cert to use for the
-                            targets.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        caFile:
-                          description: Path to the CA cert in the container to use
-                            for the targets.
-                          type: string
-                        cert:
-                          description: Struct containing the client cert file for
-                            the targets.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        certFile:
-                          description: Path to the client cert file in the container
-                            for the targets.
-                          type: string
-                        insecureSkipVerify:
-                          description: Disable target certificate validation.
-                          type: boolean
-                        keyFile:
-                          description: Path to the client key file in the container
-                            for the targets.
-                          type: string
-                        keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        serverName:
-                          description: Used to verify the hostname for the targets.
-                          type: string
-                      type: object
-                  required:
-                  - role
-                  type: object
-                type: array
-              max_scrape_size:
-                description: MaxScrapeSize defines a maximum size of scraped data
-                  for a job
-                type: string
-              metricRelabelConfigs:
-                description: MetricRelabelConfigs to apply to samples after scrapping.
-                items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
-                  properties:
-                    action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
-                      type: string
-                    if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
-                      x-kubernetes-preserve-unknown-fields: true
-                    labels:
-                      additionalProperties:
-                        type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
-                      type: object
-                    match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
-                      type: string
-                    modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
-                      format: int64
-                      type: integer
-                    regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                      x-kubernetes-preserve-unknown-fields: true
-                    replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
-                      type: string
-                    separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
-                      type: string
-                    source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      items:
-                        type: string
-                      type: array
-                    sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
-                      items:
-                        type: string
-                      type: array
-                    target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      type: string
-                    targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
-                      type: string
-                  type: object
-                type: array
-              oauth2:
-                description: OAuth2 defines auth configuration
-                properties:
-                  client_id:
-                    description: The secret or configmap containing the OAuth2 client
-                      id
-                    properties:
-                      configMap:
-                        description: ConfigMap containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key to select.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      secret:
-                        description: Secret containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  client_secret:
-                    description: The secret containing the OAuth2 client secret
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  client_secret_file:
-                    description: ClientSecretFile defines path for client secret file.
-                    type: string
-                  endpoint_params:
-                    additionalProperties:
-                      type: string
-                    description: Parameters to append to the token URL
-                    type: object
-                  proxy_url:
-                    description: |-
-                      The proxy URL for token_url connection
-                      ( available from v0.55.0).
-                      Is only supported by Scrape objects family
-                    type: string
-                  scopes:
-                    description: OAuth2 scopes used for the token request
-                    items:
-                      type: string
-                    type: array
-                  tls_config:
-                    description: |-
-                      TLSConfig for token_url connection
-                      ( available from v0.55.0).
-                      Is only supported by Scrape objects family
-                    x-kubernetes-preserve-unknown-fields: true
-                  token_url:
-                    description: The URL to fetch the token from
-                    minLength: 1
-                    type: string
-                required:
-                - client_id
-                - token_url
-                type: object
-              openstackSDConfigs:
-                description: OpenStackSDConfigs defines a list of OpenStack service
-                  discovery configurations.
-                items:
-                  description: |-
-                    OpenStackSDConfig allow retrieving scrape targets from OpenStack Nova instances.
-                    See [here](https://docs.victoriametrics.com/sd_configs#openstack_sd_configs)
-                  properties:
-                    allTenants:
-                      description: |-
-                        Whether the service discovery should list all instances for all projects.
-                        It is only relevant for the 'instance' role and usually requires admin permissions.
-                      type: boolean
-                    applicationCredentialId:
-                      description: ApplicationCredentialID
-                      type: string
-                    applicationCredentialName:
-                      description: |-
-                        The ApplicationCredentialID or ApplicationCredentialName fields are
-                        required if using an application credential to authenticate. Some providers
-                        allow you to create an application credential to authenticate rather than a
-                        password.
-                      type: string
-                    applicationCredentialSecret:
-                      description: |-
-                        The applicationCredentialSecret field is required if using an application
-                        credential to authenticate.
-                      properties:
-                        key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
-                          type: string
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
-                          type: boolean
-                      required:
-                      - key
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    availability:
-                      description: Availability of the endpoint to connect to.
-                      enum:
-                      - Public
-                      - public
-                      - Admin
-                      - admin
-                      - Internal
-                      - internal
-                      type: string
-                    domainID:
-                      description: DomainID
-                      type: string
-                    domainName:
-                      description: |-
-                        At most one of domainId and domainName must be provided if using username
-                        with Identity V3. Otherwise, either are optional.
-                      type: string
-                    identityEndpoint:
-                      description: |-
-                        IdentityEndpoint specifies the HTTP endpoint that is required to work with
-                        the Identity API of the appropriate version.
-                      type: string
-                    password:
-                      description: |-
-                        Password for the Identity V2 and V3 APIs. Consult with your provider's
-                        control panel to discover your account's preferred method of authentication.
-                      properties:
-                        key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
-                          type: string
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
-                          type: boolean
-                      required:
-                      - key
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    port:
-                      description: |-
-                        The port to scrape metrics from. If using the public IP address, this must
-                        instead be specified in the relabeling rule.
-                      type: integer
-                    projectID:
-                      description: ' ProjectID'
-                      type: string
-                    projectName:
-                      description: |-
-                        The ProjectId and ProjectName fields are optional for the Identity V2 API.
-                        Some providers allow you to specify a ProjectName instead of the ProjectId.
-                        Some require both. Your provider's authentication policies will determine
-                        how these fields influence authentication.
-                      type: string
-                    region:
-                      description: The OpenStack Region.
-                      minLength: 1
-                      type: string
-                    role:
-                      description: The OpenStack role of entities that should be discovered.
-                      enum:
-                      - Instance
-                      - instance
-                      - Hypervisor
-                      - hypervisor
-                      type: string
-                    tlsConfig:
-                      description: TLS configuration to use on every scrape request
-                      properties:
-                        ca:
-                          description: Struct containing the CA cert to use for the
-                            targets.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        caFile:
-                          description: Path to the CA cert in the container to use
-                            for the targets.
-                          type: string
-                        cert:
-                          description: Struct containing the client cert file for
-                            the targets.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        certFile:
-                          description: Path to the client cert file in the container
-                            for the targets.
-                          type: string
-                        insecureSkipVerify:
-                          description: Disable target certificate validation.
-                          type: boolean
-                        keyFile:
-                          description: Path to the client key file in the container
-                            for the targets.
-                          type: string
-                        keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        serverName:
-                          description: Used to verify the hostname for the targets.
-                          type: string
-                      type: object
-                    userid:
-                      description: UserID
-                      type: string
-                    username:
-                      description: |-
-                        Username is required if using Identity V2 API. Consult with your provider's
-                        control panel to discover your account's username.
-                        In Identity V3, either userid or a combination of username
-                        and domainId or domainName are needed
-                      type: string
-                  required:
-                  - region
-                  - role
-                  type: object
-                type: array
-              params:
-                additionalProperties:
-                  items:
-                    type: string
-                  type: array
-                description: Optional HTTP URL parameters
-                type: object
-              path:
-                description: HTTP path to scrape for metrics.
-                type: string
-              proxyURL:
-                description: ProxyURL eg http://proxyserver:2195 Directs scrapes to
-                  proxy through this endpoint.
-                type: string
-              relabelConfigs:
-                description: RelabelConfigs to apply to samples during service discovery.
-                items:
-                  description: |-
-                    RelabelConfig allows dynamic rewriting of the label set
-                    More info: https://docs.victoriametrics.com/#relabeling
-                  properties:
-                    action:
-                      description: Action to perform based on regex matching. Default
-                        is 'replace'
-                      type: string
-                    if:
-                      description: 'If represents metricsQL match expression (or list
-                        of expressions): ''{__name__=~"foo_.*"}'''
-                      x-kubernetes-preserve-unknown-fields: true
-                    labels:
-                      additionalProperties:
-                        type: string
-                      description: 'Labels is used together with Match for `action:
-                        graphite`'
-                      type: object
-                    match:
-                      description: 'Match is used together with Labels for `action:
-                        graphite`'
-                      type: string
-                    modulus:
-                      description: Modulus to take of the hash of the source label
-                        values.
-                      format: int64
-                      type: integer
-                    regex:
-                      description: |-
-                        Regular expression against which the extracted value is matched. Default is '(.*)'
-                        victoriaMetrics supports multiline regex joined with |
-                        https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                      x-kubernetes-preserve-unknown-fields: true
-                    replacement:
-                      description: |-
-                        Replacement value against which a regex replace is performed if the
-                        regular expression matches. Regex capture groups are available. Default is '$1'
-                      type: string
-                    separator:
-                      description: Separator placed between concatenated source label
-                        values. default is ';'.
-                      type: string
-                    source_labels:
-                      description: |-
-                        UnderScoreSourceLabels - additional form of source labels source_labels
-                        for compatibility with original relabel config.
-                        if set  both sourceLabels and source_labels, sourceLabels has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      items:
-                        type: string
-                      type: array
-                    sourceLabels:
-                      description: |-
-                        The source labels select values from existing labels. Their content is concatenated
-                        using the configured separator and matched against the configured regular expression
-                        for the replace, keep, and drop actions.
-                      items:
-                        type: string
-                      type: array
-                    target_label:
-                      description: |-
-                        UnderScoreTargetLabel - additional form of target label - target_label
-                        for compatibility with original relabel config.
-                        if set  both targetLabel and target_label, targetLabel has priority.
-                        for details https://github.com/VictoriaMetrics/operator/issues/131
-                      type: string
-                    targetLabel:
-                      description: |-
-                        Label to which the resulting value is written in a replace action.
-                        It is mandatory for replace actions. Regex capture groups are available.
-                      type: string
-                  type: object
-                type: array
-              sampleLimit:
-                description: SampleLimit defines per-scrape limit on number of scraped
-                  samples that will be accepted.
-                format: int64
-                type: integer
-              scheme:
-                description: HTTP scheme to use for scraping.
-                enum:
-                - http
-                - https
-                - HTTPS
-                - HTTP
-                type: string
-              scrape_interval:
-                description: |-
-                  ScrapeInterval is the same as Interval and has priority over it.
-                  one of scrape_interval or interval can be used
-                type: string
-              scrapeTimeout:
-                description: Timeout after which the scrape is ended
-                type: string
-              seriesLimit:
-                description: |-
-                  SeriesLimit defines per-scrape limit on number of unique time series
-                  a single target can expose during all the scrapes on the time window of 24h.
-                format: int64
-                type: integer
-              staticConfigs:
-                description: StaticConfigs defines a list of static targets with a
-                  common label set.
-                items:
-                  description: |-
-                    StaticConfig defines a static configuration.
-                    See [here](https://docs.victoriametrics.com/sd_configs#static_configs)
-                  properties:
-                    labels:
-                      additionalProperties:
-                        type: string
-                      description: Labels assigned to all metrics scraped from the
-                        targets.
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    targets:
-                      description: List of targets for this static configuration.
-                      items:
-                        type: string
-                      type: array
-                  type: object
-                type: array
-              tlsConfig:
-                description: TLSConfig configuration to use when scraping the endpoint
-                properties:
-                  ca:
-                    description: Struct containing the CA cert to use for the targets.
-                    properties:
-                      configMap:
-                        description: ConfigMap containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key to select.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      secret:
-                        description: Secret containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  caFile:
-                    description: Path to the CA cert in the container to use for the
-                      targets.
-                    type: string
-                  cert:
-                    description: Struct containing the client cert file for the targets.
-                    properties:
-                      configMap:
-                        description: ConfigMap containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key to select.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      secret:
-                        description: Secret containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  certFile:
-                    description: Path to the client cert file in the container for
-                      the targets.
-                    type: string
-                  insecureSkipVerify:
-                    description: Disable target certificate validation.
-                    type: boolean
-                  keyFile:
-                    description: Path to the client key file in the container for
-                      the targets.
-                    type: string
-                  keySecret:
-                    description: Secret containing the client key file for the targets.
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  serverName:
-                    description: Used to verify the hostname for the targets.
-                    type: string
-                type: object
-              vm_scrape_params:
-                description: VMScrapeParams defines VictoriaMetrics specific scrape
-                  parameters
-                properties:
-                  disable_compression:
-                    description: DisableCompression
-                    type: boolean
-                  disable_keep_alive:
-                    description: |-
-                      disable_keepalive allows disabling HTTP keep-alive when scraping targets.
-                      By default, HTTP keep-alive is enabled, so TCP connections to scrape targets
-                      could be reused.
-                      See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements
-                    type: boolean
-                  headers:
-                    description: |-
-                      Headers allows sending custom headers to scrape targets
-                      must be in of semicolon separated header with it's value
-                      eg:
-                      headerName: headerValue
-                      vmagent supports since 1.79.0 version
-                    items:
-                      type: string
-                    type: array
-                  no_stale_markers:
-                    type: boolean
-                  proxy_client_config:
-                    description: |-
-                      ProxyClientConfig configures proxy auth settings for scraping
-                      See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy
-                    properties:
-                      basic_auth:
-                        description: BasicAuth allow an endpoint to authenticate over
-                          basic authentication
-                        properties:
-                          password:
-                            description: |-
-                              Password defines reference for secret with password value
-                              The secret needs to be in the same namespace as scrape object
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          password_file:
-                            description: |-
-                              PasswordFile defines path to password file at disk
-                              must be pre-mounted
-                            type: string
-                          username:
-                            description: |-
-                              Username defines reference for secret with username value
-                              The secret needs to be in the same namespace as scrape object
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must
-                                  be a valid secret key.
-                                type: string
-                              name:
-                                default: ""
-                                description: |-
-                                  Name of the referent.
-                                  This field is effectively required, but due to backwards compatibility is
-                                  allowed to be empty. Instances of this type with an empty value here are
-                                  almost certainly wrong.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key
-                                  must be defined
-                                type: boolean
-                            required:
-                            - key
-                            type: object
-                            x-kubernetes-map-type: atomic
-                        type: object
-                      bearer_token:
-                        description: SecretKeySelector selects a key of a Secret.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      bearer_token_file:
-                        type: string
-                      tls_config:
-                        x-kubernetes-preserve-unknown-fields: true
-                    type: object
-                  scrape_align_interval:
-                    type: string
-                  scrape_offset:
-                    type: string
-                  stream_parse:
-                    type: boolean
-                type: object
             type: object
+            x-kubernetes-preserve-unknown-fields: true
           status:
-            description: ScrapeObjectStatus defines the observed state of ScrapeObjects
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -27335,16 +1672,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -27357,7 +1689,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmservicescrapes.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -27381,963 +1713,47 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: |-
-          VMServiceScrape is scrape configuration for endpoints associated with
-          kubernetes service,
-          it generates scrape configuration for vmagent based on selectors.
-          result config will scrape service endpoints
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMServiceScrapeSpec defines the desired state of VMServiceScrape
-            properties:
-              attach_metadata:
-                description: AttachMetadata configures metadata attaching from service
-                  discovery
-                properties:
-                  node:
-                    description: |-
-                      Node instructs vmagent to add node specific metadata from service discovery
-                      Valid for roles: pod, endpoints, endpointslice.
-                    type: boolean
-                type: object
-              discoveryRole:
-                description: |-
-                  DiscoveryRole - defines kubernetes_sd role for objects discovery.
-                  by default, its endpoints.
-                  can be changed to service or endpointslices.
-                  note, that with service setting, you have to use port: "name"
-                  and cannot use targetPort for endpoints.
-                enum:
-                - endpoints
-                - service
-                - endpointslices
-                type: string
-              endpoints:
-                description: A list of endpoints allowed as part of this ServiceScrape.
-                items:
-                  description: Endpoint defines a scrapeable endpoint serving metrics.
-                  properties:
-                    attach_metadata:
-                      description: AttachMetadata configures metadata attaching from
-                        service discovery
-                      properties:
-                        node:
-                          description: |-
-                            Node instructs vmagent to add node specific metadata from service discovery
-                            Valid for roles: pod, endpoints, endpointslice.
-                          type: boolean
-                      type: object
-                    authorization:
-                      description: Authorization with http header Authorization
-                      properties:
-                        credentials:
-                          description: Reference to the secret with value for authorization
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        credentialsFile:
-                          description: File with value for authorization
-                          type: string
-                        type:
-                          description: Type of authorization, default to bearer
-                          type: string
-                      type: object
-                    basicAuth:
-                      description: BasicAuth allow an endpoint to authenticate over
-                        basic authentication
-                      properties:
-                        password:
-                          description: |-
-                            Password defines reference for secret with password value
-                            The secret needs to be in the same namespace as scrape object
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        password_file:
-                          description: |-
-                            PasswordFile defines path to password file at disk
-                            must be pre-mounted
-                          type: string
-                        username:
-                          description: |-
-                            Username defines reference for secret with username value
-                            The secret needs to be in the same namespace as scrape object
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                      type: object
-                    bearerTokenFile:
-                      description: File to read bearer token for scraping targets.
-                      type: string
-                    bearerTokenSecret:
-                      description: |-
-                        Secret to mount to read bearer token for scraping targets. The secret
-                        needs to be in the same namespace as the scrape object and accessible by
-                        the victoria-metrics operator.
-                      nullable: true
-                      properties:
-                        key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
-                          type: string
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
-                          type: boolean
-                      required:
-                      - key
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    follow_redirects:
-                      description: FollowRedirects controls redirects for scraping.
-                      type: boolean
-                    honorLabels:
-                      description: HonorLabels chooses the metric's labels on collisions
-                        with target labels.
-                      type: boolean
-                    honorTimestamps:
-                      description: HonorTimestamps controls whether vmagent respects
-                        the timestamps present in scraped data.
-                      type: boolean
-                    interval:
-                      description: Interval at which metrics should be scraped
-                      type: string
-                    max_scrape_size:
-                      description: MaxScrapeSize defines a maximum size of scraped
-                        data for a job
-                      type: string
-                    metricRelabelConfigs:
-                      description: MetricRelabelConfigs to apply to samples after
-                        scrapping.
-                      items:
-                        description: |-
-                          RelabelConfig allows dynamic rewriting of the label set
-                          More info: https://docs.victoriametrics.com/#relabeling
-                        properties:
-                          action:
-                            description: Action to perform based on regex matching.
-                              Default is 'replace'
-                            type: string
-                          if:
-                            description: 'If represents metricsQL match expression
-                              (or list of expressions): ''{__name__=~"foo_.*"}'''
-                            x-kubernetes-preserve-unknown-fields: true
-                          labels:
-                            additionalProperties:
-                              type: string
-                            description: 'Labels is used together with Match for `action:
-                              graphite`'
-                            type: object
-                          match:
-                            description: 'Match is used together with Labels for `action:
-                              graphite`'
-                            type: string
-                          modulus:
-                            description: Modulus to take of the hash of the source
-                              label values.
-                            format: int64
-                            type: integer
-                          regex:
-                            description: |-
-                              Regular expression against which the extracted value is matched. Default is '(.*)'
-                              victoriaMetrics supports multiline regex joined with |
-                              https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                            x-kubernetes-preserve-unknown-fields: true
-                          replacement:
-                            description: |-
-                              Replacement value against which a regex replace is performed if the
-                              regular expression matches. Regex capture groups are available. Default is '$1'
-                            type: string
-                          separator:
-                            description: Separator placed between concatenated source
-                              label values. default is ';'.
-                            type: string
-                          source_labels:
-                            description: |-
-                              UnderScoreSourceLabels - additional form of source labels source_labels
-                              for compatibility with original relabel config.
-                              if set  both sourceLabels and source_labels, sourceLabels has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
-                            items:
-                              type: string
-                            type: array
-                          sourceLabels:
-                            description: |-
-                              The source labels select values from existing labels. Their content is concatenated
-                              using the configured separator and matched against the configured regular expression
-                              for the replace, keep, and drop actions.
-                            items:
-                              type: string
-                            type: array
-                          target_label:
-                            description: |-
-                              UnderScoreTargetLabel - additional form of target label - target_label
-                              for compatibility with original relabel config.
-                              if set  both targetLabel and target_label, targetLabel has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
-                            type: string
-                          targetLabel:
-                            description: |-
-                              Label to which the resulting value is written in a replace action.
-                              It is mandatory for replace actions. Regex capture groups are available.
-                            type: string
-                        type: object
-                      type: array
-                    oauth2:
-                      description: OAuth2 defines auth configuration
-                      properties:
-                        client_id:
-                          description: The secret or configmap containing the OAuth2
-                            client id
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        client_secret:
-                          description: The secret containing the OAuth2 client secret
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        client_secret_file:
-                          description: ClientSecretFile defines path for client secret
-                            file.
-                          type: string
-                        endpoint_params:
-                          additionalProperties:
-                            type: string
-                          description: Parameters to append to the token URL
-                          type: object
-                        proxy_url:
-                          description: |-
-                            The proxy URL for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
-                          type: string
-                        scopes:
-                          description: OAuth2 scopes used for the token request
-                          items:
-                            type: string
-                          type: array
-                        tls_config:
-                          description: |-
-                            TLSConfig for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
-                          x-kubernetes-preserve-unknown-fields: true
-                        token_url:
-                          description: The URL to fetch the token from
-                          minLength: 1
-                          type: string
-                      required:
-                      - client_id
-                      - token_url
-                      type: object
-                    params:
-                      additionalProperties:
-                        items:
-                          type: string
-                        type: array
-                      description: Optional HTTP URL parameters
-                      type: object
-                    path:
-                      description: HTTP path to scrape for metrics.
-                      type: string
-                    port:
-                      description: Name of the port exposed at Service.
-                      type: string
-                    proxyURL:
-                      description: ProxyURL eg http://proxyserver:2195 Directs scrapes
-                        to proxy through this endpoint.
-                      type: string
-                    relabelConfigs:
-                      description: RelabelConfigs to apply to samples during service
-                        discovery.
-                      items:
-                        description: |-
-                          RelabelConfig allows dynamic rewriting of the label set
-                          More info: https://docs.victoriametrics.com/#relabeling
-                        properties:
-                          action:
-                            description: Action to perform based on regex matching.
-                              Default is 'replace'
-                            type: string
-                          if:
-                            description: 'If represents metricsQL match expression
-                              (or list of expressions): ''{__name__=~"foo_.*"}'''
-                            x-kubernetes-preserve-unknown-fields: true
-                          labels:
-                            additionalProperties:
-                              type: string
-                            description: 'Labels is used together with Match for `action:
-                              graphite`'
-                            type: object
-                          match:
-                            description: 'Match is used together with Labels for `action:
-                              graphite`'
-                            type: string
-                          modulus:
-                            description: Modulus to take of the hash of the source
-                              label values.
-                            format: int64
-                            type: integer
-                          regex:
-                            description: |-
-                              Regular expression against which the extracted value is matched. Default is '(.*)'
-                              victoriaMetrics supports multiline regex joined with |
-                              https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                            x-kubernetes-preserve-unknown-fields: true
-                          replacement:
-                            description: |-
-                              Replacement value against which a regex replace is performed if the
-                              regular expression matches. Regex capture groups are available. Default is '$1'
-                            type: string
-                          separator:
-                            description: Separator placed between concatenated source
-                              label values. default is ';'.
-                            type: string
-                          source_labels:
-                            description: |-
-                              UnderScoreSourceLabels - additional form of source labels source_labels
-                              for compatibility with original relabel config.
-                              if set  both sourceLabels and source_labels, sourceLabels has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
-                            items:
-                              type: string
-                            type: array
-                          sourceLabels:
-                            description: |-
-                              The source labels select values from existing labels. Their content is concatenated
-                              using the configured separator and matched against the configured regular expression
-                              for the replace, keep, and drop actions.
-                            items:
-                              type: string
-                            type: array
-                          target_label:
-                            description: |-
-                              UnderScoreTargetLabel - additional form of target label - target_label
-                              for compatibility with original relabel config.
-                              if set  both targetLabel and target_label, targetLabel has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
-                            type: string
-                          targetLabel:
-                            description: |-
-                              Label to which the resulting value is written in a replace action.
-                              It is mandatory for replace actions. Regex capture groups are available.
-                            type: string
-                        type: object
-                      type: array
-                    sampleLimit:
-                      description: SampleLimit defines per-scrape limit on number
-                        of scraped samples that will be accepted.
-                      format: int64
-                      type: integer
-                    scheme:
-                      description: HTTP scheme to use for scraping.
-                      enum:
-                      - http
-                      - https
-                      - HTTPS
-                      - HTTP
-                      type: string
-                    scrape_interval:
-                      description: |-
-                        ScrapeInterval is the same as Interval and has priority over it.
-                        one of scrape_interval or interval can be used
-                      type: string
-                    scrapeTimeout:
-                      description: Timeout after which the scrape is ended
-                      type: string
-                    seriesLimit:
-                      description: |-
-                        SeriesLimit defines per-scrape limit on number of unique time series
-                        a single target can expose during all the scrapes on the time window of 24h.
-                      format: int64
-                      type: integer
-                    targetPort:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      description: |-
-                        TargetPort
-                        Name or number of the pod port this endpoint refers to. Mutually exclusive with port.
-                      x-kubernetes-int-or-string: true
-                    tlsConfig:
-                      description: TLSConfig configuration to use when scraping the
-                        endpoint
-                      properties:
-                        ca:
-                          description: Struct containing the CA cert to use for the
-                            targets.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        caFile:
-                          description: Path to the CA cert in the container to use
-                            for the targets.
-                          type: string
-                        cert:
-                          description: Struct containing the client cert file for
-                            the targets.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        certFile:
-                          description: Path to the client cert file in the container
-                            for the targets.
-                          type: string
-                        insecureSkipVerify:
-                          description: Disable target certificate validation.
-                          type: boolean
-                        keyFile:
-                          description: Path to the client key file in the container
-                            for the targets.
-                          type: string
-                        keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        serverName:
-                          description: Used to verify the hostname for the targets.
-                          type: string
-                      type: object
-                    vm_scrape_params:
-                      description: VMScrapeParams defines VictoriaMetrics specific
-                        scrape parameters
-                      properties:
-                        disable_compression:
-                          description: DisableCompression
-                          type: boolean
-                        disable_keep_alive:
-                          description: |-
-                            disable_keepalive allows disabling HTTP keep-alive when scraping targets.
-                            By default, HTTP keep-alive is enabled, so TCP connections to scrape targets
-                            could be reused.
-                            See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements
-                          type: boolean
-                        headers:
-                          description: |-
-                            Headers allows sending custom headers to scrape targets
-                            must be in of semicolon separated header with it's value
-                            eg:
-                            headerName: headerValue
-                            vmagent supports since 1.79.0 version
-                          items:
-                            type: string
-                          type: array
-                        no_stale_markers:
-                          type: boolean
-                        proxy_client_config:
-                          description: |-
-                            ProxyClientConfig configures proxy auth settings for scraping
-                            See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy
-                          properties:
-                            basic_auth:
-                              description: BasicAuth allow an endpoint to authenticate
-                                over basic authentication
-                              properties:
-                                password:
-                                  description: |-
-                                    Password defines reference for secret with password value
-                                    The secret needs to be in the same namespace as scrape object
-                                  properties:
-                                    key:
-                                      description: The key of the secret to select
-                                        from.  Must be a valid secret key.
-                                      type: string
-                                    name:
-                                      default: ""
-                                      description: |-
-                                        Name of the referent.
-                                        This field is effectively required, but due to backwards compatibility is
-                                        allowed to be empty. Instances of this type with an empty value here are
-                                        almost certainly wrong.
-                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                      type: string
-                                    optional:
-                                      description: Specify whether the Secret or its
-                                        key must be defined
-                                      type: boolean
-                                  required:
-                                  - key
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                password_file:
-                                  description: |-
-                                    PasswordFile defines path to password file at disk
-                                    must be pre-mounted
-                                  type: string
-                                username:
-                                  description: |-
-                                    Username defines reference for secret with username value
-                                    The secret needs to be in the same namespace as scrape object
-                                  properties:
-                                    key:
-                                      description: The key of the secret to select
-                                        from.  Must be a valid secret key.
-                                      type: string
-                                    name:
-                                      default: ""
-                                      description: |-
-                                        Name of the referent.
-                                        This field is effectively required, but due to backwards compatibility is
-                                        allowed to be empty. Instances of this type with an empty value here are
-                                        almost certainly wrong.
-                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                      type: string
-                                    optional:
-                                      description: Specify whether the Secret or its
-                                        key must be defined
-                                      type: boolean
-                                  required:
-                                  - key
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                              type: object
-                            bearer_token:
-                              description: SecretKeySelector selects a key of a Secret.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            bearer_token_file:
-                              type: string
-                            tls_config:
-                              x-kubernetes-preserve-unknown-fields: true
-                          type: object
-                        scrape_align_interval:
-                          type: string
-                        scrape_offset:
-                          type: string
-                        stream_parse:
-                          type: boolean
-                      type: object
-                  type: object
-                type: array
-              jobLabel:
-                description: The label to use to retrieve the job name from.
-                type: string
-              namespaceSelector:
-                description: Selector to select which namespaces the Endpoints objects
-                  are discovered from.
-                properties:
-                  any:
-                    description: |-
-                      Boolean describing whether all namespaces are selected in contrast to a
-                      list restricting them.
-                    type: boolean
-                  matchNames:
-                    description: List of namespace names.
-                    items:
-                      type: string
-                    type: array
-                type: object
-              podTargetLabels:
-                description: PodTargetLabels transfers labels on the Kubernetes Pod
-                  onto the target.
-                items:
-                  type: string
-                type: array
-              sampleLimit:
-                description: SampleLimit defines per-scrape limit on number of scraped
-                  samples that will be accepted.
-                format: int64
-                type: integer
-              selector:
-                description: Selector to select Endpoints objects by corresponding
-                  Service labels.
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: |-
-                        A label selector requirement is a selector that contains values, a key, and an operator that
-                        relates the key and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: |-
-                            operator represents a key's relationship to a set of values.
-                            Valid operators are In, NotIn, Exists and DoesNotExist.
-                          type: string
-                        values:
-                          description: |-
-                            values is an array of string values. If the operator is In or NotIn,
-                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                            the values array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                          x-kubernetes-list-type: atomic
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                      map is equivalent to an element of matchExpressions, whose key field is "key", the
-                      operator is "In", and the values array contains only "value". The requirements are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              seriesLimit:
-                description: |-
-                  SeriesLimit defines per-scrape limit on number of unique time series
-                  a single target can expose during all the scrapes on the time window of 24h.
-                format: int64
-                type: integer
-              targetLabels:
-                description: TargetLabels transfers labels on the Kubernetes Service
-                  onto the target.
-                items:
-                  type: string
-                type: array
             required:
             - endpoints
             type: object
+            x-kubernetes-preserve-unknown-fields: true
           status:
-            description: ScrapeObjectStatus defines the observed state of ScrapeObjects
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -28352,16 +1768,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         required:
@@ -28376,7 +1787,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmsingles.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -28398,1833 +1809,45 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: VMSingle  is fast, cost-effective and scalable time-series database.
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMSingleSpec defines the desired state of VMSingle
-            properties:
-              affinity:
-                description: Affinity If specified, the pod's scheduling constraints.
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              configMaps:
-                description: |-
-                  ConfigMaps is a list of ConfigMaps in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/configs/CONFIGMAP_NAME folder
-                items:
-                  type: string
-                type: array
-              containers:
-                description: |-
-                  Containers property allows to inject additions sidecars or to patch existing containers.
-                  It can be useful for proxies, backup, etc.
-                items:
-                  description: A single application container that you want to run
-                    within a pod.
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              disableAutomountServiceAccountToken:
-                description: |-
-                  DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
-                  Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
-                  For example, vmagent and vm-config-reloader requires k8s API access.
-                  Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
-                  And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
-                type: boolean
-              disableSelfServiceScrape:
-                description: |-
-                  DisableSelfServiceScrape controls creation of VMServiceScrape by operator
-                  for the application.
-                  Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable
-                type: boolean
-              dnsConfig:
-                description: |-
-                  Specifies the DNS parameters of a pod.
-                  Parameters specified here will be merged to the generated DNS
-                  configuration based on DNSPolicy.
-                items:
-                  x-kubernetes-preserve-unknown-fields: true
-                properties:
-                  nameservers:
-                    description: |-
-                      A list of DNS name server IP addresses.
-                      This will be appended to the base nameservers generated from DNSPolicy.
-                      Duplicated nameservers will be removed.
-                    items:
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  options:
-                    description: |-
-                      A list of DNS resolver options.
-                      This will be merged with the base options generated from DNSPolicy.
-                      Duplicated entries will be removed. Resolution options given in Options
-                      will override those that appear in the base DNSPolicy.
-                    items:
-                      description: PodDNSConfigOption defines DNS resolver options
-                        of a pod.
-                      properties:
-                        name:
-                          description: |-
-                            Name is this DNS resolver option's name.
-                            Required.
-                          type: string
-                        value:
-                          description: Value is this DNS resolver option's value.
-                          type: string
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  searches:
-                    description: |-
-                      A list of DNS search domains for host-name lookup.
-                      This will be appended to the base search paths generated from DNSPolicy.
-                      Duplicated search paths will be removed.
-                    items:
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: atomic
-                type: object
-              dnsPolicy:
-                description: DNSPolicy sets DNS policy for the pod
-                type: string
-              extraArgs:
-                additionalProperties:
-                  type: string
-                description: |-
-                  ExtraArgs that will be passed to the application container
-                  for example remoteWrite.tmpDataPath: /tmp
-                type: object
-              extraEnvs:
-                description: ExtraEnvs that will be passed to the application container
-                items:
-                  description: EnvVar represents an environment variable present in
-                    a Container.
-                  properties:
-                    name:
-                      description: Name of the environment variable. Must be a C_IDENTIFIER.
-                      type: string
-                    value:
-                      description: |-
-                        Variable references $(VAR_NAME) are expanded
-                        using the previously defined environment variables in the container and
-                        any service environment variables. If a variable cannot be resolved,
-                        the reference in the input string will be unchanged. Double $$ are reduced
-                        to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                        "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                        Escaped references will never be expanded, regardless of whether the variable
-                        exists or not.
-                        Defaults to "".
-                      type: string
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              extraEnvsFrom:
-                description: |-
-                  ExtraEnvsFrom defines source of env variables for the application container
-                  could either be secret or configmap
-                items:
-                  description: EnvFromSource represents the source of a set of ConfigMaps
-                  properties:
-                    configMapRef:
-                      description: The ConfigMap to select from
-                      properties:
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the ConfigMap must be defined
-                          type: boolean
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    prefix:
-                      description: An optional identifier to prepend to each key in
-                        the ConfigMap. Must be a C_IDENTIFIER.
-                      type: string
-                    secretRef:
-                      description: The Secret to select from
-                      properties:
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the Secret must be defined
-                          type: boolean
-                      type: object
-                      x-kubernetes-map-type: atomic
-                  type: object
-                type: array
-              host_aliases:
-                description: |-
-                  HostAliasesUnderScore provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
-                  Has Priority over hostAliases field
-                items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
-                  properties:
-                    hostnames:
-                      description: Hostnames for the above IP address.
-                      items:
-                        type: string
-                      type: array
-                      x-kubernetes-list-type: atomic
-                    ip:
-                      description: IP address of the host file entry.
-                      type: string
-                  required:
-                  - ip
-                  type: object
-                type: array
-              hostAliases:
-                description: |-
-                  HostAliases provides mapping for ip and hostname,
-                  that would be propagated to pod,
-                  cannot be used with HostNetwork.
-                items:
-                  description: |-
-                    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
-                    pod's hosts file.
-                  properties:
-                    hostnames:
-                      description: Hostnames for the above IP address.
-                      items:
-                        type: string
-                      type: array
-                      x-kubernetes-list-type: atomic
-                    ip:
-                      description: IP address of the host file entry.
-                      type: string
-                  required:
-                  - ip
-                  type: object
-                type: array
-              hostNetwork:
-                description: HostNetwork controls whether the pod may use the node
-                  network namespace
-                type: boolean
-              image:
-                description: |-
-                  Image - docker image settings
-                  if no specified operator uses default version from operator config
-                properties:
-                  pullPolicy:
-                    description: PullPolicy describes how to pull docker image
-                    type: string
-                  repository:
-                    description: Repository contains name of docker image + it's repository
-                      if needed
-                    type: string
-                  tag:
-                    description: Tag contains desired docker image version
-                    type: string
-                type: object
-              imagePullSecrets:
-                description: |-
-                  ImagePullSecrets An optional list of references to secrets in the same namespace
-                  to use for pulling images from registries
-                  see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
-                items:
-                  description: |-
-                    LocalObjectReference contains enough information to let you locate the
-                    referenced object inside the same namespace.
-                  properties:
-                    name:
-                      default: ""
-                      description: |-
-                        Name of the referent.
-                        This field is effectively required, but due to backwards compatibility is
-                        allowed to be empty. Instances of this type with an empty value here are
-                        almost certainly wrong.
-                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                      type: string
-                  type: object
-                  x-kubernetes-map-type: atomic
-                type: array
-              initContainers:
-                description: |-
-                  InitContainers allows adding initContainers to the pod definition.
-                  Any errors during the execution of an initContainer will lead to a restart of the Pod.
-                  More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
-                items:
-                  description: A single application container that you want to run
-                    within a pod.
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              insertPorts:
-                description: InsertPorts - additional listen ports for data ingestion.
-                properties:
-                  graphitePort:
-                    description: GraphitePort listen port
-                    type: string
-                  influxPort:
-                    description: InfluxPort listen port
-                    type: string
-                  openTSDBHTTPPort:
-                    description: OpenTSDBHTTPPort for http connections.
-                    type: string
-                  openTSDBPort:
-                    description: OpenTSDBPort for tcp and udp listen
-                    type: string
-                type: object
-              license:
-                description: |-
-                  License allows to configure license key to be used for enterprise features.
-                  Using license key is supported starting from VictoriaMetrics v1.94.0.
-                  See [here](https://docs.victoriametrics.com/enterprise)
-                properties:
-                  forceOffline:
-                    description: Enforce offline verification of the license key.
-                    type: boolean
-                  key:
-                    description: |-
-                      Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise).
-                      To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial)
-                    type: string
-                  keyRef:
-                    description: KeyRef is reference to secret with license key for
-                      enterprise features.
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  reloadInterval:
-                    description: Interval to be used for checking for license key
-                      changes. Note that this is only applicable when using KeyRef.
-                    type: string
-                type: object
-              livenessProbe:
-                description: LivenessProbe that will be added CRD pod
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              logFormat:
-                description: LogFormat for VMSingle to be configured with.
-                enum:
-                - default
-                - json
-                type: string
-              logLevel:
-                description: LogLevel for victoria metrics single to be configured
-                  with.
-                enum:
-                - INFO
-                - WARN
-                - ERROR
-                - FATAL
-                - PANIC
-                type: string
-              managedMetadata:
-                description: |-
-                  ManagedMetadata defines metadata that will be added to the all objects
-                  created by operator for the given CustomResource
-                properties:
-                  annotations:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                    type: object
-                  labels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                    type: object
-                type: object
-              minReadySeconds:
-                description: |-
-                  MinReadySeconds defines a minimum number of seconds to wait before starting update next pod
-                  if previous in healthy state
-                  Has no effect for VLogs and VMSingle
-                format: int32
-                type: integer
-              nodeSelector:
-                additionalProperties:
-                  type: string
-                description: NodeSelector Define which Nodes the Pods are scheduled
-                  on.
-                type: object
-              paused:
-                description: |-
-                  Paused If set to true all actions on the underlying managed objects are not
-                  going to be performed, except for delete actions.
-                type: boolean
-              podMetadata:
-                description: PodMetadata configures Labels and Annotations which are
-                  propagated to the VMSingle pods.
-                properties:
-                  annotations:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                    type: object
-                  labels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects. May match selectors of replication controllers
-                      and services.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                    type: object
-                  name:
-                    description: |-
-                      Name must be unique within a namespace. Is required when creating resources, although
-                      some resources may allow a client to request the generation of an appropriate name
-                      automatically. Name is primarily intended for creation idempotence and configuration
-                      definition.
-                      Cannot be updated.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                    type: string
-                type: object
-              port:
-                description: Port listen address
-                type: string
-              priorityClassName:
-                description: PriorityClassName class assigned to the Pods
-                type: string
-              readinessGates:
-                description: ReadinessGates defines pod readiness gates
-                items:
-                  description: PodReadinessGate contains the reference to a pod condition
-                  properties:
-                    conditionType:
-                      description: ConditionType refers to a condition in the pod's
-                        condition list with matching type.
-                      type: string
-                  required:
-                  - conditionType
-                  type: object
-                type: array
-              readinessProbe:
-                description: ReadinessProbe that will be added CRD pod
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              removePvcAfterDelete:
-                description: |-
-                  RemovePvcAfterDelete - if true, controller adds ownership to pvc
-                  and after VMSingle object deletion - pvc will be garbage collected
-                  by controller manager
-                type: boolean
-              replicaCount:
-                description: ReplicaCount is the expected size of the Application.
-                format: int32
-                type: integer
-              resources:
-                description: |-
-                  Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                  if not defined default resources from operator config will be used
-                properties:
-                  claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This is an alpha field and requires enabling the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
-                    items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
-                      properties:
-                        name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
-                          type: string
-                        request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
-                          type: string
-                      required:
-                      - name
-                      type: object
-                    type: array
-                    x-kubernetes-list-map-keys:
-                    - name
-                    x-kubernetes-list-type: map
-                  limits:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                  requests:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                type: object
-              retentionPeriod:
-                description: |-
-                  RetentionPeriod for the stored metrics
-                  Note VictoriaMetrics has data/ and indexdb/ folders
-                  metrics from data/ removed eventually as soon as partition leaves retention period
-                  reverse index data at indexdb rotates once at the half of configured [retention period](https://docs.victoriametrics.com/Single-server-VictoriaMetrics/#retention)
-                type: string
-              revisionHistoryLimitCount:
-                description: |-
-                  The number of old ReplicaSets to retain to allow rollback in deployment or
-                  maximum number of revisions that will be maintained in the Deployment revision history.
-                  Has no effect at StatefulSets
-                  Defaults to 10.
-                format: int32
-                type: integer
-              runtimeClassName:
-                description: |-
-                  RuntimeClassName - defines runtime class for kubernetes pod.
-                  https://kubernetes.io/docs/concepts/containers/runtime-class/
-                type: string
-              schedulerName:
-                description: SchedulerName - defines kubernetes scheduler name
-                type: string
-              secrets:
-                description: |-
-                  Secrets is a list of Secrets in the same namespace as the Application
-                  object, which shall be mounted into the Application container
-                  at /etc/vm/secrets/SECRET_NAME folder
-                items:
-                  type: string
-                type: array
-              securityContext:
-                description: |-
-                  SecurityContext holds pod-level security attributes and common container settings.
-                  This defaults to the default PodSecurityContext.
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              serviceAccountName:
-                description: ServiceAccountName is the name of the ServiceAccount
-                  to use to run the pods
-                type: string
-              serviceScrapeSpec:
-                description: ServiceScrapeSpec that will be added to vmsingle VMServiceScrape
-                  spec
-                required:
-                - endpoints
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              serviceSpec:
-                description: ServiceSpec that will be added to vmsingle service spec
-                properties:
-                  metadata:
-                    description: EmbeddedObjectMetadata defines objectMeta for additional
-                      service.
-                    properties:
-                      annotations:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Annotations is an unstructured key value map stored with a resource that may be
-                          set by external tools to store and retrieve arbitrary metadata. They are not
-                          queryable and should be preserved when modifying objects.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                        type: object
-                      labels:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Labels Map of string keys and values that can be used to organize and categorize
-                          (scope and select) objects. May match selectors of replication controllers
-                          and services.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                        type: object
-                      name:
-                        description: |-
-                          Name must be unique within a namespace. Is required when creating resources, although
-                          some resources may allow a client to request the generation of an appropriate name
-                          automatically. Name is primarily intended for creation idempotence and configuration
-                          definition.
-                          Cannot be updated.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                        type: string
-                    type: object
-                  spec:
-                    description: |-
-                      ServiceSpec describes the attributes that a user creates on a service.
-                      More info: https://kubernetes.io/docs/concepts/services-networking/service/
-                    type: object
-                    x-kubernetes-preserve-unknown-fields: true
-                  useAsDefault:
-                    description: |-
-                      UseAsDefault applies changes from given service definition to the main object Service
-                      Changing from headless service to clusterIP or loadbalancer may break cross-component communication
-                    type: boolean
-                required:
-                - spec
-                type: object
-              startupProbe:
-                description: StartupProbe that will be added to CRD pod
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
-              storage:
-                description: |-
-                  Storage is the definition of how storage will be used by the VMSingle
-                  by default it`s empty dir
-                  this option is ignored if storageDataPath is set
-                properties:
-                  accessModes:
-                    description: |-
-                      accessModes contains the desired access modes the volume should have.
-                      More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
-                    items:
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  dataSource:
-                    description: |-
-                      dataSource field can be used to specify either:
-                      * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
-                      * An existing PVC (PersistentVolumeClaim)
-                      If the provisioner or an external controller can support the specified data source,
-                      it will create a new volume based on the contents of the specified data source.
-                      When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-                      and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
-                      If the namespace is specified, then dataSourceRef will not be copied to dataSource.
-                    properties:
-                      apiGroup:
-                        description: |-
-                          APIGroup is the group for the resource being referenced.
-                          If APIGroup is not specified, the specified Kind must be in the core API group.
-                          For any other third-party types, APIGroup is required.
-                        type: string
-                      kind:
-                        description: Kind is the type of resource being referenced
-                        type: string
-                      name:
-                        description: Name is the name of resource being referenced
-                        type: string
-                    required:
-                    - kind
-                    - name
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  dataSourceRef:
-                    description: |-
-                      dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
-                      volume is desired. This may be any object from a non-empty API group (non
-                      core object) or a PersistentVolumeClaim object.
-                      When this field is specified, volume binding will only succeed if the type of
-                      the specified object matches some installed volume populator or dynamic
-                      provisioner.
-                      This field will replace the functionality of the dataSource field and as such
-                      if both fields are non-empty, they must have the same value. For backwards
-                      compatibility, when namespace isn't specified in dataSourceRef,
-                      both fields (dataSource and dataSourceRef) will be set to the same
-                      value automatically if one of them is empty and the other is non-empty.
-                      When namespace is specified in dataSourceRef,
-                      dataSource isn't set to the same value and must be empty.
-                      There are three important differences between dataSource and dataSourceRef:
-                      * While dataSource only allows two specific types of objects, dataSourceRef
-                        allows any non-core object, as well as PersistentVolumeClaim objects.
-                      * While dataSource ignores disallowed values (dropping them), dataSourceRef
-                        preserves all values, and generates an error if a disallowed value is
-                        specified.
-                      * While dataSource only allows local objects, dataSourceRef allows objects
-                        in any namespaces.
-                      (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
-                      (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                    properties:
-                      apiGroup:
-                        description: |-
-                          APIGroup is the group for the resource being referenced.
-                          If APIGroup is not specified, the specified Kind must be in the core API group.
-                          For any other third-party types, APIGroup is required.
-                        type: string
-                      kind:
-                        description: Kind is the type of resource being referenced
-                        type: string
-                      name:
-                        description: Name is the name of resource being referenced
-                        type: string
-                      namespace:
-                        description: |-
-                          Namespace is the namespace of resource being referenced
-                          Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
-                          (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
-                        type: string
-                    required:
-                    - kind
-                    - name
-                    type: object
-                  resources:
-                    description: |-
-                      resources represents the minimum resources the volume should have.
-                      If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
-                      that are lower than previous value but must still be higher than capacity recorded in the
-                      status field of the claim.
-                      More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
-                    properties:
-                      limits:
-                        additionalProperties:
-                          anyOf:
-                          - type: integer
-                          - type: string
-                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                          x-kubernetes-int-or-string: true
-                        description: |-
-                          Limits describes the maximum amount of compute resources allowed.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                        type: object
-                      requests:
-                        additionalProperties:
-                          anyOf:
-                          - type: integer
-                          - type: string
-                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                          x-kubernetes-int-or-string: true
-                        description: |-
-                          Requests describes the minimum amount of compute resources required.
-                          If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                          otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                        type: object
-                    type: object
-                  selector:
-                    description: selector is a label query over volumes to consider
-                      for binding.
-                    properties:
-                      matchExpressions:
-                        description: matchExpressions is a list of label selector
-                          requirements. The requirements are ANDed.
-                        items:
-                          description: |-
-                            A label selector requirement is a selector that contains values, a key, and an operator that
-                            relates the key and values.
-                          properties:
-                            key:
-                              description: key is the label key that the selector
-                                applies to.
-                              type: string
-                            operator:
-                              description: |-
-                                operator represents a key's relationship to a set of values.
-                                Valid operators are In, NotIn, Exists and DoesNotExist.
-                              type: string
-                            values:
-                              description: |-
-                                values is an array of string values. If the operator is In or NotIn,
-                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                the values array must be empty. This array is replaced during a strategic
-                                merge patch.
-                              items:
-                                type: string
-                              type: array
-                              x-kubernetes-list-type: atomic
-                          required:
-                          - key
-                          - operator
-                          type: object
-                        type: array
-                        x-kubernetes-list-type: atomic
-                      matchLabels:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                          operator is "In", and the values array contains only "value". The requirements are ANDed.
-                        type: object
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  storageClassName:
-                    description: |-
-                      storageClassName is the name of the StorageClass required by the claim.
-                      More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
-                    type: string
-                  volumeAttributesClassName:
-                    description: |-
-                      volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
-                      If specified, the CSI driver will create or update the volume with the attributes defined
-                      in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                      it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                      will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                      If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                      will be set by the persistentvolume controller if it exists.
-                      If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
-                      set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
-                      exists.
-                      More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                      (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
-                    type: string
-                  volumeMode:
-                    description: |-
-                      volumeMode defines what type of volume is required by the claim.
-                      Value of Filesystem is implied when not included in claim spec.
-                    type: string
-                  volumeName:
-                    description: volumeName is the binding reference to the PersistentVolume
-                      backing this claim.
-                    type: string
-                type: object
-              storageDataPath:
-                description: |-
-                  StorageDataPath disables spec.storage option and overrides arg for victoria-metrics binary --storageDataPath,
-                  its users responsibility to mount proper device into given path.
-                  It requires to provide spec.volumes and spec.volumeMounts with at least 1 value
-                type: string
-              storageMetadata:
-                description: StorageMeta defines annotations and labels attached to
-                  PVC for given vmsingle CR
-                properties:
-                  annotations:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Annotations is an unstructured key value map stored with a resource that may be
-                      set by external tools to store and retrieve arbitrary metadata. They are not
-                      queryable and should be preserved when modifying objects.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
-                    type: object
-                  labels:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Labels Map of string keys and values that can be used to organize and categorize
-                      (scope and select) objects. May match selectors of replication controllers
-                      and services.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-                    type: object
-                  name:
-                    description: |-
-                      Name must be unique within a namespace. Is required when creating resources, although
-                      some resources may allow a client to request the generation of an appropriate name
-                      automatically. Name is primarily intended for creation idempotence and configuration
-                      definition.
-                      Cannot be updated.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
-                    type: string
-                type: object
-              streamAggrConfig:
-                description: StreamAggrConfig defines stream aggregation configuration
-                  for VMSingle
-                properties:
-                  configmap:
-                    description: ConfigMap with stream aggregation rules
-                    properties:
-                      key:
-                        description: The key to select.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the ConfigMap or its key must
-                          be defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  dedupInterval:
-                    description: Allows setting different de-duplication intervals
-                      per each configured remote storage
-                    type: string
-                  dropInput:
-                    description: Allow drop all the input samples after the aggregation
-                    type: boolean
-                  dropInputLabels:
-                    description: labels to drop from samples for aggregator before
-                      stream de-duplication and aggregation
-                    items:
-                      type: string
-                    type: array
-                  enableWindows:
-                    description: EnableWindows enables aggregating data in separate
-                      windows ( available from v0.54.0).
-                    type: boolean
-                  ignoreFirstIntervals:
-                    description: IgnoreFirstIntervals instructs to ignore first interval
-                    type: integer
-                  ignoreOldSamples:
-                    description: IgnoreOldSamples instructs to ignore samples with
-                      old timestamps outside the current aggregation interval.
-                    type: boolean
-                  keepInput:
-                    description: Allows writing both raw and aggregate data
-                    type: boolean
-                  rules:
-                    description: Stream aggregation rules
-                    items:
-                      description: StreamAggrRule defines the rule in stream aggregation
-                        config
-                      properties:
-                        by:
-                          description: |-
-                            By is an optional list of labels for grouping input series.
-
-                            See also Without.
-
-                            If neither By nor Without are set, then the Outputs are calculated
-                            individually per each input time series.
-                          items:
-                            type: string
-                          type: array
-                        dedup_interval:
-                          description: DedupInterval is an optional interval for deduplication.
-                          type: string
-                        drop_input_labels:
-                          description: |-
-                            DropInputLabels is an optional list with labels, which must be dropped before further processing of input samples.
-
-                            Labels are dropped before de-duplication and aggregation.
-                          items:
-                            type: string
-                          type: array
-                        enable_windows:
-                          description: EnableWindows enables aggregating data in separate
-                            windows
-                          type: boolean
-                        flush_on_shutdown:
-                          description: |-
-                            FlushOnShutdown defines whether to flush the aggregation state on process termination
-                            or config reload. Is `false` by default.
-                            It is not recommended changing this setting, unless unfinished aggregations states
-                            are preferred to missing data points.
-                          type: boolean
-                        ignore_first_intervals:
-                          type: integer
-                        ignore_old_samples:
-                          description: IgnoreOldSamples instructs to ignore samples
-                            with old timestamps outside the current aggregation interval.
-                          type: boolean
-                        input_relabel_configs:
-                          description: |-
-                            InputRelabelConfigs is an optional relabeling rules, which are applied on the input
-                            before aggregation.
-                          items:
-                            description: |-
-                              RelabelConfig allows dynamic rewriting of the label set
-                              More info: https://docs.victoriametrics.com/#relabeling
-                            properties:
-                              action:
-                                description: Action to perform based on regex matching.
-                                  Default is 'replace'
-                                type: string
-                              if:
-                                description: 'If represents metricsQL match expression
-                                  (or list of expressions): ''{__name__=~"foo_.*"}'''
-                                x-kubernetes-preserve-unknown-fields: true
-                              labels:
-                                additionalProperties:
-                                  type: string
-                                description: 'Labels is used together with Match for
-                                  `action: graphite`'
-                                type: object
-                              match:
-                                description: 'Match is used together with Labels for
-                                  `action: graphite`'
-                                type: string
-                              modulus:
-                                description: Modulus to take of the hash of the source
-                                  label values.
-                                format: int64
-                                type: integer
-                              regex:
-                                description: |-
-                                  Regular expression against which the extracted value is matched. Default is '(.*)'
-                                  victoriaMetrics supports multiline regex joined with |
-                                  https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                                x-kubernetes-preserve-unknown-fields: true
-                              replacement:
-                                description: |-
-                                  Replacement value against which a regex replace is performed if the
-                                  regular expression matches. Regex capture groups are available. Default is '$1'
-                                type: string
-                              separator:
-                                description: Separator placed between concatenated
-                                  source label values. default is ';'.
-                                type: string
-                              source_labels:
-                                description: |-
-                                  UnderScoreSourceLabels - additional form of source labels source_labels
-                                  for compatibility with original relabel config.
-                                  if set  both sourceLabels and source_labels, sourceLabels has priority.
-                                  for details https://github.com/VictoriaMetrics/operator/issues/131
-                                items:
-                                  type: string
-                                type: array
-                              sourceLabels:
-                                description: |-
-                                  The source labels select values from existing labels. Their content is concatenated
-                                  using the configured separator and matched against the configured regular expression
-                                  for the replace, keep, and drop actions.
-                                items:
-                                  type: string
-                                type: array
-                              target_label:
-                                description: |-
-                                  UnderScoreTargetLabel - additional form of target label - target_label
-                                  for compatibility with original relabel config.
-                                  if set  both targetLabel and target_label, targetLabel has priority.
-                                  for details https://github.com/VictoriaMetrics/operator/issues/131
-                                type: string
-                              targetLabel:
-                                description: |-
-                                  Label to which the resulting value is written in a replace action.
-                                  It is mandatory for replace actions. Regex capture groups are available.
-                                type: string
-                            type: object
-                          type: array
-                        interval:
-                          description: Interval is the interval between aggregations.
-                          type: string
-                        keep_metric_names:
-                          description: KeepMetricNames instructs to leave metric names
-                            as is for the output time series without adding any suffix.
-                          type: boolean
-                        match:
-                          description: |-
-                            Match is a label selector (or list of label selectors) for filtering time series for the given selector.
-
-                            If the match isn't set, then all the input time series are processed.
-                          x-kubernetes-preserve-unknown-fields: true
-                        no_align_flush_to_interval:
-                          description: |-
-                            NoAlignFlushToInterval disables aligning of flushes to multiples of Interval.
-                            By default flushes are aligned to Interval.
-                          type: boolean
-                        output_relabel_configs:
-                          description: |-
-                            OutputRelabelConfigs is an optional relabeling rules, which are applied
-                            on the aggregated output before being sent to remote storage.
-                          items:
-                            description: |-
-                              RelabelConfig allows dynamic rewriting of the label set
-                              More info: https://docs.victoriametrics.com/#relabeling
-                            properties:
-                              action:
-                                description: Action to perform based on regex matching.
-                                  Default is 'replace'
-                                type: string
-                              if:
-                                description: 'If represents metricsQL match expression
-                                  (or list of expressions): ''{__name__=~"foo_.*"}'''
-                                x-kubernetes-preserve-unknown-fields: true
-                              labels:
-                                additionalProperties:
-                                  type: string
-                                description: 'Labels is used together with Match for
-                                  `action: graphite`'
-                                type: object
-                              match:
-                                description: 'Match is used together with Labels for
-                                  `action: graphite`'
-                                type: string
-                              modulus:
-                                description: Modulus to take of the hash of the source
-                                  label values.
-                                format: int64
-                                type: integer
-                              regex:
-                                description: |-
-                                  Regular expression against which the extracted value is matched. Default is '(.*)'
-                                  victoriaMetrics supports multiline regex joined with |
-                                  https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                                x-kubernetes-preserve-unknown-fields: true
-                              replacement:
-                                description: |-
-                                  Replacement value against which a regex replace is performed if the
-                                  regular expression matches. Regex capture groups are available. Default is '$1'
-                                type: string
-                              separator:
-                                description: Separator placed between concatenated
-                                  source label values. default is ';'.
-                                type: string
-                              source_labels:
-                                description: |-
-                                  UnderScoreSourceLabels - additional form of source labels source_labels
-                                  for compatibility with original relabel config.
-                                  if set  both sourceLabels and source_labels, sourceLabels has priority.
-                                  for details https://github.com/VictoriaMetrics/operator/issues/131
-                                items:
-                                  type: string
-                                type: array
-                              sourceLabels:
-                                description: |-
-                                  The source labels select values from existing labels. Their content is concatenated
-                                  using the configured separator and matched against the configured regular expression
-                                  for the replace, keep, and drop actions.
-                                items:
-                                  type: string
-                                type: array
-                              target_label:
-                                description: |-
-                                  UnderScoreTargetLabel - additional form of target label - target_label
-                                  for compatibility with original relabel config.
-                                  if set  both targetLabel and target_label, targetLabel has priority.
-                                  for details https://github.com/VictoriaMetrics/operator/issues/131
-                                type: string
-                              targetLabel:
-                                description: |-
-                                  Label to which the resulting value is written in a replace action.
-                                  It is mandatory for replace actions. Regex capture groups are available.
-                                type: string
-                            type: object
-                          type: array
-                        outputs:
-                          description: |-
-                            Outputs is a list of output aggregate functions to produce.
-
-                            The following names are allowed:
-
-                            - total - aggregates input counters
-                            - increase - counts the increase over input counters
-                            - count_series - counts the input series
-                            - count_samples - counts the input samples
-                            - sum_samples - sums the input samples
-                            - last - the last biggest sample value
-                            - min - the minimum sample value
-                            - max - the maximum sample value
-                            - avg - the average value across all the samples
-                            - stddev - standard deviation across all the samples
-                            - stdvar - standard variance across all the samples
-                            - histogram_bucket - creates VictoriaMetrics histogram for input samples
-                            - quantiles(phi1, ..., phiN) - quantiles' estimation for phi in the range [0..1]
-
-                            The output time series will have the following names:
-
-                              input_name:aggr_<interval>_<output>
-                          items:
-                            type: string
-                          type: array
-                        staleness_interval:
-                          description: |-
-                            Staleness interval is interval after which the series state will be reset if no samples have been sent during it.
-                            The parameter is only relevant for outputs: total, total_prometheus, increase, increase_prometheus and histogram_bucket.
-                          type: string
-                        without:
-                          description: |-
-                            Without is an optional list of labels, which must be excluded when grouping input series.
-
-                            See also By.
-
-                            If neither By nor Without are set, then the Outputs are calculated
-                            individually per each input time series.
-                          items:
-                            type: string
-                          type: array
-                      required:
-                      - interval
-                      - outputs
-                      type: object
-                    type: array
-                type: object
-              terminationGracePeriodSeconds:
-                description: TerminationGracePeriodSeconds period for container graceful
-                  termination
-                format: int64
-                type: integer
-              tolerations:
-                description: Tolerations If specified, the pod's tolerations.
-                items:
-                  description: |-
-                    The pod this Toleration is attached to tolerates any taint that matches
-                    the triple <key,value,effect> using the matching operator <operator>.
-                  properties:
-                    effect:
-                      description: |-
-                        Effect indicates the taint effect to match. Empty means match all taint effects.
-                        When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                      type: string
-                    key:
-                      description: |-
-                        Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                        If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                      type: string
-                    operator:
-                      description: |-
-                        Operator represents a key's relationship to the value.
-                        Valid operators are Exists and Equal. Defaults to Equal.
-                        Exists is equivalent to wildcard for value, so that a pod can
-                        tolerate all taints of a particular category.
-                      type: string
-                    tolerationSeconds:
-                      description: |-
-                        TolerationSeconds represents the period of time the toleration (which must be
-                        of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                        it is not set, which means tolerate the taint forever (do not evict). Zero and
-                        negative values will be treated as 0 (evict immediately) by the system.
-                      format: int64
-                      type: integer
-                    value:
-                      description: |-
-                        Value is the taint value the toleration matches to.
-                        If the operator is Exists, the value should be empty, otherwise just a regular string.
-                      type: string
-                  type: object
-                type: array
-              topologySpreadConstraints:
-                description: |-
-                  TopologySpreadConstraints embedded kubernetes pod configuration option,
-                  controls how pods are spread across your cluster among failure-domains
-                  such as regions, zones, nodes, and other user-defined topology domains
-                  https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
-                items:
-                  description: TopologySpreadConstraint specifies how to spread matching
-                    pods among the given topology.
-                  required:
-                  - maxSkew
-                  - topologyKey
-                  - whenUnsatisfiable
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-              useDefaultResources:
-                description: |-
-                  UseDefaultResources controls resource settings
-                  By default, operator sets built-in resource requirements
-                type: boolean
-              useStrictSecurity:
-                description: |-
-                  UseStrictSecurity enables strict security mode for component
-                  it restricts disk writes access
-                  uses non-root user out of the box
-                  drops not needed security permissions
-                type: boolean
-              vmBackup:
-                description: VMBackup configuration for backup
-                properties:
-                  acceptEULA:
-                    description: |-
-                      AcceptEULA accepts enterprise feature usage, must be set to true.
-                      otherwise backupmanager cannot be added to single/cluster version.
-                      https://victoriametrics.com/legal/esa/
-                    type: boolean
-                  concurrency:
-                    description: Defines number of concurrent workers. Higher concurrency
-                      may reduce backup duration (default 10)
-                    format: int32
-                    type: integer
-                  credentialsSecret:
-                    description: |-
-                      CredentialsSecret is secret in the same namespace for access to remote storage
-                      The secret is mounted into /etc/vm/creds.
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  customS3Endpoint:
-                    description: Custom S3 endpoint for use with S3-compatible storages
-                      (e.g. MinIO). S3 is used if not set
-                    type: string
-                  destination:
-                    description: Defines destination for backup
-                    type: string
-                  destinationDisableSuffixAdd:
-                    description: |-
-                      DestinationDisableSuffixAdd - disables suffix adding for cluster version backups
-                      each vmstorage backup must have unique backup folder
-                      so operator adds POD_NAME as suffix for backup destination folder.
-                    type: boolean
-                  disableDaily:
-                    description: Defines if daily backups disabled (default false)
-                    type: boolean
-                  disableHourly:
-                    description: Defines if hourly backups disabled (default false)
-                    type: boolean
-                  disableMonthly:
-                    description: Defines if monthly backups disabled (default false)
-                    type: boolean
-                  disableWeekly:
-                    description: Defines if weekly backups disabled (default false)
-                    type: boolean
-                  extraArgs:
-                    additionalProperties:
-                      type: string
-                    description: extra args like maxBytesPerSecond default 0
-                    type: object
-                  extraEnvs:
-                    items:
-                      description: EnvVar represents an environment variable present
-                        in a Container.
-                      properties:
-                        name:
-                          description: Name of the environment variable. Must be a
-                            C_IDENTIFIER.
-                          type: string
-                        value:
-                          description: |-
-                            Variable references $(VAR_NAME) are expanded
-                            using the previously defined environment variables in the container and
-                            any service environment variables. If a variable cannot be resolved,
-                            the reference in the input string will be unchanged. Double $$ are reduced
-                            to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                            "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                            Escaped references will never be expanded, regardless of whether the variable
-                            exists or not.
-                            Defaults to "".
-                          type: string
-                        valueFrom:
-                          description: Source for the environment variable's value.
-                            Cannot be used if value is not empty.
-                          properties:
-                            configMapKeyRef:
-                              description: Selects a key of a ConfigMap.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            fieldRef:
-                              description: |-
-                                Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
-                                spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
-                              properties:
-                                apiVersion:
-                                  description: Version of the schema the FieldPath
-                                    is written in terms of, defaults to "v1".
-                                  type: string
-                                fieldPath:
-                                  description: Path of the field to select in the
-                                    specified API version.
-                                  type: string
-                              required:
-                              - fieldPath
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            resourceFieldRef:
-                              description: |-
-                                Selects a resource of the container: only resources limits and requests
-                                (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
-                              properties:
-                                containerName:
-                                  description: 'Container name: required for volumes,
-                                    optional for env vars'
-                                  type: string
-                                divisor:
-                                  anyOf:
-                                  - type: integer
-                                  - type: string
-                                  description: Specifies the output format of the
-                                    exposed resources, defaults to "1"
-                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                  x-kubernetes-int-or-string: true
-                                resource:
-                                  description: 'Required: resource to select'
-                                  type: string
-                              required:
-                              - resource
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secretKeyRef:
-                              description: Selects a key of a secret in the pod's
-                                namespace
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                      required:
-                      - name
-                      type: object
-                    type: array
-                  extraEnvsFrom:
-                    description: |-
-                      ExtraEnvsFrom defines source of env variables for the application container
-                      could either be secret or configmap
-                    items:
-                      description: EnvFromSource represents the source of a set of
-                        ConfigMaps
-                      properties:
-                        configMapRef:
-                          description: The ConfigMap to select from
-                          properties:
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the ConfigMap must be defined
-                              type: boolean
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        prefix:
-                          description: An optional identifier to prepend to each key
-                            in the ConfigMap. Must be a C_IDENTIFIER.
-                          type: string
-                        secretRef:
-                          description: The Secret to select from
-                          properties:
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret must be defined
-                              type: boolean
-                          type: object
-                          x-kubernetes-map-type: atomic
-                      type: object
-                    type: array
-                  image:
-                    description: Image - docker image settings for VMBackuper
-                    properties:
-                      pullPolicy:
-                        description: PullPolicy describes how to pull docker image
-                        type: string
-                      repository:
-                        description: Repository contains name of docker image + it's
-                          repository if needed
-                        type: string
-                      tag:
-                        description: Tag contains desired docker image version
-                        type: string
-                    type: object
-                  logFormat:
-                    description: |-
-                      LogFormat for VMBackup to be configured with.
-                      default or json
-                    enum:
-                    - default
-                    - json
-                    type: string
-                  logLevel:
-                    description: LogLevel for VMBackup to be configured with.
-                    enum:
-                    - INFO
-                    - WARN
-                    - ERROR
-                    - FATAL
-                    - PANIC
-                    type: string
-                  port:
-                    description: Port for health check connections
-                    type: string
-                  resources:
-                    description: |-
-                      Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                      if not defined default resources from operator config will be used
-                    properties:
-                      claims:
-                        description: |-
-                          Claims lists the names of resources, defined in spec.resourceClaims,
-                          that are used by this container.
-
-                          This is an alpha field and requires enabling the
-                          DynamicResourceAllocation feature gate.
-
-                          This field is immutable. It can only be set for containers.
-                        items:
-                          description: ResourceClaim references one entry in PodSpec.ResourceClaims.
-                          properties:
-                            name:
-                              description: |-
-                                Name must match the name of one entry in pod.spec.resourceClaims of
-                                the Pod where this field is used. It makes that resource available
-                                inside a container.
-                              type: string
-                            request:
-                              description: |-
-                                Request is the name chosen for a request in the referenced claim.
-                                If empty, everything from the claim is made available, otherwise
-                                only the result of this request.
-                              type: string
-                          required:
-                          - name
-                          type: object
-                        type: array
-                        x-kubernetes-list-map-keys:
-                        - name
-                        x-kubernetes-list-type: map
-                      limits:
-                        additionalProperties:
-                          anyOf:
-                          - type: integer
-                          - type: string
-                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                          x-kubernetes-int-or-string: true
-                        description: |-
-                          Limits describes the maximum amount of compute resources allowed.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                        type: object
-                      requests:
-                        additionalProperties:
-                          anyOf:
-                          - type: integer
-                          - type: string
-                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                          x-kubernetes-int-or-string: true
-                        description: |-
-                          Requests describes the minimum amount of compute resources required.
-                          If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                          otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                        type: object
-                    type: object
-                  restore:
-                    description: |-
-                      Restore Allows to enable restore options for pod
-                      Read [more](https://docs.victoriametrics.com/vmbackupmanager#restore-commands)
-                    properties:
-                      onStart:
-                        description: OnStart defines configuration for restore on
-                          pod start
-                        properties:
-                          enabled:
-                            description: Enabled defines if restore on start enabled
-                            type: boolean
-                        type: object
-                    type: object
-                  snapshotCreateURL:
-                    description: SnapshotCreateURL overwrites url for snapshot create
-                    type: string
-                  snapshotDeleteURL:
-                    description: SnapShotDeleteURL overwrites url for snapshot delete
-                    type: string
-                  volumeMounts:
-                    description: |-
-                      VolumeMounts allows configuration of additional VolumeMounts on the output Deployment definition.
-                      VolumeMounts specified will be appended to other VolumeMounts in the vmbackupmanager container,
-                      that are generated as a result of StorageSpec objects.
-                    items:
-                      description: VolumeMount describes a mounting of a Volume within
-                        a container.
-                      properties:
-                        mountPath:
-                          description: |-
-                            Path within the container at which the volume should be mounted.  Must
-                            not contain ':'.
-                          type: string
-                        mountPropagation:
-                          description: |-
-                            mountPropagation determines how mounts are propagated from the host
-                            to container and the other way around.
-                            When not set, MountPropagationNone is used.
-                            This field is beta in 1.10.
-                            When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                            (which defaults to None).
-                          type: string
-                        name:
-                          description: This must match the Name of a Volume.
-                          type: string
-                        readOnly:
-                          description: |-
-                            Mounted read-only if true, read-write otherwise (false or unspecified).
-                            Defaults to false.
-                          type: boolean
-                        recursiveReadOnly:
-                          description: |-
-                            RecursiveReadOnly specifies whether read-only mounts should be handled
-                            recursively.
-
-                            If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                            If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                            recursively read-only.  If this field is set to IfPossible, the mount is made
-                            recursively read-only, if it is supported by the container runtime.  If this
-                            field is set to Enabled, the mount is made recursively read-only if it is
-                            supported by the container runtime, otherwise the pod will not be started and
-                            an error will be generated to indicate the reason.
-
-                            If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                            None (or be unspecified, which defaults to None).
-
-                            If this field is not specified, it is treated as an equivalent of Disabled.
-                          type: string
-                        subPath:
-                          description: |-
-                            Path within the volume from which the container's volume should be mounted.
-                            Defaults to "" (volume's root).
-                          type: string
-                        subPathExpr:
-                          description: |-
-                            Expanded path within the volume from which the container's volume should be mounted.
-                            Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                            Defaults to "" (volume's root).
-                            SubPathExpr and SubPath are mutually exclusive.
-                          type: string
-                      required:
-                      - mountPath
-                      - name
-                      type: object
-                    type: array
-                type: object
-              volumeMounts:
-                description: |-
-                  VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
-                  VolumeMounts specified will be appended to other VolumeMounts in the Application container
-                items:
-                  description: VolumeMount describes a mounting of a Volume within
-                    a container.
-                  properties:
-                    mountPath:
-                      description: |-
-                        Path within the container at which the volume should be mounted.  Must
-                        not contain ':'.
-                      type: string
-                    mountPropagation:
-                      description: |-
-                        mountPropagation determines how mounts are propagated from the host
-                        to container and the other way around.
-                        When not set, MountPropagationNone is used.
-                        This field is beta in 1.10.
-                        When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
-                        (which defaults to None).
-                      type: string
-                    name:
-                      description: This must match the Name of a Volume.
-                      type: string
-                    readOnly:
-                      description: |-
-                        Mounted read-only if true, read-write otherwise (false or unspecified).
-                        Defaults to false.
-                      type: boolean
-                    recursiveReadOnly:
-                      description: |-
-                        RecursiveReadOnly specifies whether read-only mounts should be handled
-                        recursively.
-
-                        If ReadOnly is false, this field has no meaning and must be unspecified.
-
-                        If ReadOnly is true, and this field is set to Disabled, the mount is not made
-                        recursively read-only.  If this field is set to IfPossible, the mount is made
-                        recursively read-only, if it is supported by the container runtime.  If this
-                        field is set to Enabled, the mount is made recursively read-only if it is
-                        supported by the container runtime, otherwise the pod will not be started and
-                        an error will be generated to indicate the reason.
-
-                        If this field is set to IfPossible or Enabled, MountPropagation must be set to
-                        None (or be unspecified, which defaults to None).
-
-                        If this field is not specified, it is treated as an equivalent of Disabled.
-                      type: string
-                    subPath:
-                      description: |-
-                        Path within the volume from which the container's volume should be mounted.
-                        Defaults to "" (volume's root).
-                      type: string
-                    subPathExpr:
-                      description: |-
-                        Expanded path within the volume from which the container's volume should be mounted.
-                        Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
-                        Defaults to "" (volume's root).
-                        SubPathExpr and SubPath are mutually exclusive.
-                      type: string
-                  required:
-                  - mountPath
-                  - name
-                  type: object
-                type: array
-              volumes:
-                description: |-
-                  Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
-                  Volumes specified will be appended to other volumes that are generated.
-                  / +optional
-                items:
-                  description: Volume represents a named volume in a pod that may
-                    be accessed by any container in the pod.
-                  required:
-                  - name
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-                type: array
-            required:
-            - retentionPeriod
             type: object
+            x-kubernetes-preserve-unknown-fields: true
           status:
-            description: VMSingleStatus defines the observed state of VMSingle
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -30239,20 +1862,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
-                type: string
-              singleStatus:
-                description: LegacyStatus is deprecated and will be removed at v0.52.0
-                  version
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -30265,7 +1879,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmstaticscrapes.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -30289,855 +1903,47 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: VMStaticScrape  defines static targets configuration for scraping.
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMStaticScrapeSpec defines the desired state of VMStaticScrape.
-            properties:
-              jobName:
-                description: JobName name of job.
-                type: string
-              sampleLimit:
-                description: SampleLimit defines per-scrape limit on number of scraped
-                  samples that will be accepted.
-                format: int64
-                type: integer
-              seriesLimit:
-                description: |-
-                  SeriesLimit defines per-scrape limit on number of unique time series
-                  a single target can expose during all the scrapes on the time window of 24h.
-                format: int64
-                type: integer
-              targetEndpoints:
-                description: A list of target endpoints to scrape metrics from.
-                items:
-                  description: TargetEndpoint defines single static target endpoint.
-                  properties:
-                    authorization:
-                      description: Authorization with http header Authorization
-                      properties:
-                        credentials:
-                          description: Reference to the secret with value for authorization
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        credentialsFile:
-                          description: File with value for authorization
-                          type: string
-                        type:
-                          description: Type of authorization, default to bearer
-                          type: string
-                      type: object
-                    basicAuth:
-                      description: BasicAuth allow an endpoint to authenticate over
-                        basic authentication
-                      properties:
-                        password:
-                          description: |-
-                            Password defines reference for secret with password value
-                            The secret needs to be in the same namespace as scrape object
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        password_file:
-                          description: |-
-                            PasswordFile defines path to password file at disk
-                            must be pre-mounted
-                          type: string
-                        username:
-                          description: |-
-                            Username defines reference for secret with username value
-                            The secret needs to be in the same namespace as scrape object
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                      type: object
-                    bearerTokenFile:
-                      description: File to read bearer token for scraping targets.
-                      type: string
-                    bearerTokenSecret:
-                      description: |-
-                        Secret to mount to read bearer token for scraping targets. The secret
-                        needs to be in the same namespace as the scrape object and accessible by
-                        the victoria-metrics operator.
-                      nullable: true
-                      properties:
-                        key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
-                          type: string
-                        name:
-                          default: ""
-                          description: |-
-                            Name of the referent.
-                            This field is effectively required, but due to backwards compatibility is
-                            allowed to be empty. Instances of this type with an empty value here are
-                            almost certainly wrong.
-                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          type: string
-                        optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
-                          type: boolean
-                      required:
-                      - key
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    follow_redirects:
-                      description: FollowRedirects controls redirects for scraping.
-                      type: boolean
-                    honorLabels:
-                      description: HonorLabels chooses the metric's labels on collisions
-                        with target labels.
-                      type: boolean
-                    honorTimestamps:
-                      description: HonorTimestamps controls whether vmagent respects
-                        the timestamps present in scraped data.
-                      type: boolean
-                    interval:
-                      description: Interval at which metrics should be scraped
-                      type: string
-                    labels:
-                      additionalProperties:
-                        type: string
-                      description: Labels static labels for targets.
-                      type: object
-                    max_scrape_size:
-                      description: MaxScrapeSize defines a maximum size of scraped
-                        data for a job
-                      type: string
-                    metricRelabelConfigs:
-                      description: MetricRelabelConfigs to apply to samples after
-                        scrapping.
-                      items:
-                        description: |-
-                          RelabelConfig allows dynamic rewriting of the label set
-                          More info: https://docs.victoriametrics.com/#relabeling
-                        properties:
-                          action:
-                            description: Action to perform based on regex matching.
-                              Default is 'replace'
-                            type: string
-                          if:
-                            description: 'If represents metricsQL match expression
-                              (or list of expressions): ''{__name__=~"foo_.*"}'''
-                            x-kubernetes-preserve-unknown-fields: true
-                          labels:
-                            additionalProperties:
-                              type: string
-                            description: 'Labels is used together with Match for `action:
-                              graphite`'
-                            type: object
-                          match:
-                            description: 'Match is used together with Labels for `action:
-                              graphite`'
-                            type: string
-                          modulus:
-                            description: Modulus to take of the hash of the source
-                              label values.
-                            format: int64
-                            type: integer
-                          regex:
-                            description: |-
-                              Regular expression against which the extracted value is matched. Default is '(.*)'
-                              victoriaMetrics supports multiline regex joined with |
-                              https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                            x-kubernetes-preserve-unknown-fields: true
-                          replacement:
-                            description: |-
-                              Replacement value against which a regex replace is performed if the
-                              regular expression matches. Regex capture groups are available. Default is '$1'
-                            type: string
-                          separator:
-                            description: Separator placed between concatenated source
-                              label values. default is ';'.
-                            type: string
-                          source_labels:
-                            description: |-
-                              UnderScoreSourceLabels - additional form of source labels source_labels
-                              for compatibility with original relabel config.
-                              if set  both sourceLabels and source_labels, sourceLabels has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
-                            items:
-                              type: string
-                            type: array
-                          sourceLabels:
-                            description: |-
-                              The source labels select values from existing labels. Their content is concatenated
-                              using the configured separator and matched against the configured regular expression
-                              for the replace, keep, and drop actions.
-                            items:
-                              type: string
-                            type: array
-                          target_label:
-                            description: |-
-                              UnderScoreTargetLabel - additional form of target label - target_label
-                              for compatibility with original relabel config.
-                              if set  both targetLabel and target_label, targetLabel has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
-                            type: string
-                          targetLabel:
-                            description: |-
-                              Label to which the resulting value is written in a replace action.
-                              It is mandatory for replace actions. Regex capture groups are available.
-                            type: string
-                        type: object
-                      type: array
-                    oauth2:
-                      description: OAuth2 defines auth configuration
-                      properties:
-                        client_id:
-                          description: The secret or configmap containing the OAuth2
-                            client id
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        client_secret:
-                          description: The secret containing the OAuth2 client secret
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        client_secret_file:
-                          description: ClientSecretFile defines path for client secret
-                            file.
-                          type: string
-                        endpoint_params:
-                          additionalProperties:
-                            type: string
-                          description: Parameters to append to the token URL
-                          type: object
-                        proxy_url:
-                          description: |-
-                            The proxy URL for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
-                          type: string
-                        scopes:
-                          description: OAuth2 scopes used for the token request
-                          items:
-                            type: string
-                          type: array
-                        tls_config:
-                          description: |-
-                            TLSConfig for token_url connection
-                            ( available from v0.55.0).
-                            Is only supported by Scrape objects family
-                          x-kubernetes-preserve-unknown-fields: true
-                        token_url:
-                          description: The URL to fetch the token from
-                          minLength: 1
-                          type: string
-                      required:
-                      - client_id
-                      - token_url
-                      type: object
-                    params:
-                      additionalProperties:
-                        items:
-                          type: string
-                        type: array
-                      description: Optional HTTP URL parameters
-                      type: object
-                    path:
-                      description: HTTP path to scrape for metrics.
-                      type: string
-                    proxyURL:
-                      description: ProxyURL eg http://proxyserver:2195 Directs scrapes
-                        to proxy through this endpoint.
-                      type: string
-                    relabelConfigs:
-                      description: RelabelConfigs to apply to samples during service
-                        discovery.
-                      items:
-                        description: |-
-                          RelabelConfig allows dynamic rewriting of the label set
-                          More info: https://docs.victoriametrics.com/#relabeling
-                        properties:
-                          action:
-                            description: Action to perform based on regex matching.
-                              Default is 'replace'
-                            type: string
-                          if:
-                            description: 'If represents metricsQL match expression
-                              (or list of expressions): ''{__name__=~"foo_.*"}'''
-                            x-kubernetes-preserve-unknown-fields: true
-                          labels:
-                            additionalProperties:
-                              type: string
-                            description: 'Labels is used together with Match for `action:
-                              graphite`'
-                            type: object
-                          match:
-                            description: 'Match is used together with Labels for `action:
-                              graphite`'
-                            type: string
-                          modulus:
-                            description: Modulus to take of the hash of the source
-                              label values.
-                            format: int64
-                            type: integer
-                          regex:
-                            description: |-
-                              Regular expression against which the extracted value is matched. Default is '(.*)'
-                              victoriaMetrics supports multiline regex joined with |
-                              https://docs.victoriametrics.com/vmagent/#relabeling-enhancements
-                            x-kubernetes-preserve-unknown-fields: true
-                          replacement:
-                            description: |-
-                              Replacement value against which a regex replace is performed if the
-                              regular expression matches. Regex capture groups are available. Default is '$1'
-                            type: string
-                          separator:
-                            description: Separator placed between concatenated source
-                              label values. default is ';'.
-                            type: string
-                          source_labels:
-                            description: |-
-                              UnderScoreSourceLabels - additional form of source labels source_labels
-                              for compatibility with original relabel config.
-                              if set  both sourceLabels and source_labels, sourceLabels has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
-                            items:
-                              type: string
-                            type: array
-                          sourceLabels:
-                            description: |-
-                              The source labels select values from existing labels. Their content is concatenated
-                              using the configured separator and matched against the configured regular expression
-                              for the replace, keep, and drop actions.
-                            items:
-                              type: string
-                            type: array
-                          target_label:
-                            description: |-
-                              UnderScoreTargetLabel - additional form of target label - target_label
-                              for compatibility with original relabel config.
-                              if set  both targetLabel and target_label, targetLabel has priority.
-                              for details https://github.com/VictoriaMetrics/operator/issues/131
-                            type: string
-                          targetLabel:
-                            description: |-
-                              Label to which the resulting value is written in a replace action.
-                              It is mandatory for replace actions. Regex capture groups are available.
-                            type: string
-                        type: object
-                      type: array
-                    sampleLimit:
-                      description: SampleLimit defines per-scrape limit on number
-                        of scraped samples that will be accepted.
-                      format: int64
-                      type: integer
-                    scheme:
-                      description: HTTP scheme to use for scraping.
-                      enum:
-                      - http
-                      - https
-                      - HTTPS
-                      - HTTP
-                      type: string
-                    scrape_interval:
-                      description: |-
-                        ScrapeInterval is the same as Interval and has priority over it.
-                        one of scrape_interval or interval can be used
-                      type: string
-                    scrapeTimeout:
-                      description: Timeout after which the scrape is ended
-                      type: string
-                    seriesLimit:
-                      description: |-
-                        SeriesLimit defines per-scrape limit on number of unique time series
-                        a single target can expose during all the scrapes on the time window of 24h.
-                      format: int64
-                      type: integer
-                    targets:
-                      description: Targets static targets addresses in form of ["192.122.55.55:9100","some-name:9100"].
-                      items:
-                        type: string
-                      minItems: 1
-                      type: array
-                    tlsConfig:
-                      description: TLSConfig configuration to use when scraping the
-                        endpoint
-                      properties:
-                        ca:
-                          description: Struct containing the CA cert to use for the
-                            targets.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        caFile:
-                          description: Path to the CA cert in the container to use
-                            for the targets.
-                          type: string
-                        cert:
-                          description: Struct containing the client cert file for
-                            the targets.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        certFile:
-                          description: Path to the client cert file in the container
-                            for the targets.
-                          type: string
-                        insecureSkipVerify:
-                          description: Disable target certificate validation.
-                          type: boolean
-                        keyFile:
-                          description: Path to the client key file in the container
-                            for the targets.
-                          type: string
-                        keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        serverName:
-                          description: Used to verify the hostname for the targets.
-                          type: string
-                      type: object
-                    vm_scrape_params:
-                      description: VMScrapeParams defines VictoriaMetrics specific
-                        scrape parameters
-                      properties:
-                        disable_compression:
-                          description: DisableCompression
-                          type: boolean
-                        disable_keep_alive:
-                          description: |-
-                            disable_keepalive allows disabling HTTP keep-alive when scraping targets.
-                            By default, HTTP keep-alive is enabled, so TCP connections to scrape targets
-                            could be reused.
-                            See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements
-                          type: boolean
-                        headers:
-                          description: |-
-                            Headers allows sending custom headers to scrape targets
-                            must be in of semicolon separated header with it's value
-                            eg:
-                            headerName: headerValue
-                            vmagent supports since 1.79.0 version
-                          items:
-                            type: string
-                          type: array
-                        no_stale_markers:
-                          type: boolean
-                        proxy_client_config:
-                          description: |-
-                            ProxyClientConfig configures proxy auth settings for scraping
-                            See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy
-                          properties:
-                            basic_auth:
-                              description: BasicAuth allow an endpoint to authenticate
-                                over basic authentication
-                              properties:
-                                password:
-                                  description: |-
-                                    Password defines reference for secret with password value
-                                    The secret needs to be in the same namespace as scrape object
-                                  properties:
-                                    key:
-                                      description: The key of the secret to select
-                                        from.  Must be a valid secret key.
-                                      type: string
-                                    name:
-                                      default: ""
-                                      description: |-
-                                        Name of the referent.
-                                        This field is effectively required, but due to backwards compatibility is
-                                        allowed to be empty. Instances of this type with an empty value here are
-                                        almost certainly wrong.
-                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                      type: string
-                                    optional:
-                                      description: Specify whether the Secret or its
-                                        key must be defined
-                                      type: boolean
-                                  required:
-                                  - key
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                password_file:
-                                  description: |-
-                                    PasswordFile defines path to password file at disk
-                                    must be pre-mounted
-                                  type: string
-                                username:
-                                  description: |-
-                                    Username defines reference for secret with username value
-                                    The secret needs to be in the same namespace as scrape object
-                                  properties:
-                                    key:
-                                      description: The key of the secret to select
-                                        from.  Must be a valid secret key.
-                                      type: string
-                                    name:
-                                      default: ""
-                                      description: |-
-                                        Name of the referent.
-                                        This field is effectively required, but due to backwards compatibility is
-                                        allowed to be empty. Instances of this type with an empty value here are
-                                        almost certainly wrong.
-                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                      type: string
-                                    optional:
-                                      description: Specify whether the Secret or its
-                                        key must be defined
-                                      type: boolean
-                                  required:
-                                  - key
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                              type: object
-                            bearer_token:
-                              description: SecretKeySelector selects a key of a Secret.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  default: ""
-                                  description: |-
-                                    Name of the referent.
-                                    This field is effectively required, but due to backwards compatibility is
-                                    allowed to be empty. Instances of this type with an empty value here are
-                                    almost certainly wrong.
-                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            bearer_token_file:
-                              type: string
-                            tls_config:
-                              x-kubernetes-preserve-unknown-fields: true
-                          type: object
-                        scrape_align_interval:
-                          type: string
-                        scrape_offset:
-                          type: string
-                        stream_parse:
-                          type: boolean
-                      type: object
-                  required:
-                  - targets
-                  type: object
-                type: array
             required:
             - targetEndpoints
             type: object
+            x-kubernetes-preserve-unknown-fields: true
           status:
-            description: ScrapeObjectStatus defines the observed state of ScrapeObjects
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -31152,16 +1958,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
@@ -31174,7 +1975,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: vmusers.operator.victoriametrics.com
 spec:
   group: operator.victoriametrics.com
@@ -31198,582 +1999,243 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
-        description: VMUser is the Schema for the vmusers API
         properties:
           apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
-            description: VMUserSpec defines the desired state of VMUser
-            properties:
-              bearerToken:
-                description: BearerToken Authorization header value for accessing
-                  protected endpoint.
-                type: string
-              default_url:
-                description: |-
-                  DefaultURLs backend url for non-matching paths filter
-                  usually used for default backend with error message
-                items:
-                  type: string
-                type: array
-              disable_secret_creation:
-                description: DisableSecretCreation skips related secret creation for
-                  vmuser
-                type: boolean
-              discover_backend_ips:
-                description: DiscoverBackendIPs instructs discovering URLPrefix backend
-                  IPs via DNS.
-                type: boolean
-              drop_src_path_prefix_parts:
-                description: |-
-                  DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend.
-                  See [here](https://docs.victoriametrics.com/vmauth#dropping-request-path-prefix) for more details.
-                type: integer
-              dump_request_on_errors:
-                description: |-
-                  DumpRequestOnErrors instructs vmauth to return detailed request params to the client
-                  if routing rules don't allow to forward request to the backends.
-                  Useful for debugging `src_hosts` and `src_headers` based routing rules
-
-                  available since v1.107.0 vmauth version
-                type: boolean
-              generatePassword:
-                description: |-
-                  GeneratePassword instructs operator to generate password for user
-                  if spec.password if empty.
-                type: boolean
-              headers:
-                description: |-
-                  Headers represent additional http headers, that vmauth uses
-                  in form of ["header_key: header_value"]
-                  multiple values for header key:
-                  ["header_key: value1,value2"]
-                  it's available since 1.68.0 version of vmauth
-                items:
-                  type: string
-                type: array
-              ip_filters:
-                description: |-
-                  IPFilters defines per target src ip filters
-                  supported only with enterprise version of [vmauth](https://docs.victoriametrics.com/vmauth/#ip-filters)
-                properties:
-                  allow_list:
-                    items:
-                      type: string
-                    type: array
-                  deny_list:
-                    items:
-                      type: string
-                    type: array
-                type: object
-              load_balancing_policy:
-                description: |-
-                  LoadBalancingPolicy defines load balancing policy to use for backend urls.
-                  Supported policies: least_loaded, first_available.
-                  See [here](https://docs.victoriametrics.com/vmauth#load-balancing) for more details (default "least_loaded")
-                enum:
-                - least_loaded
-                - first_available
-                type: string
-              max_concurrent_requests:
-                description: |-
-                  MaxConcurrentRequests defines max concurrent requests per user
-                  300 is default value for vmauth
-                type: integer
-              metric_labels:
-                additionalProperties:
-                  type: string
-                description: MetricLabels - additional labels for metrics exported
-                  by vmauth for given user.
-                type: object
-              name:
-                description: Name of the VMUser object.
-                type: string
-              password:
-                description: Password basic auth password for accessing protected
-                  endpoint.
-                type: string
-              passwordRef:
-                description: PasswordRef allows fetching password from user-create
-                  secret by its name and key.
-                properties:
-                  key:
-                    description: The key of the secret to select from.  Must be a
-                      valid secret key.
-                    type: string
-                  name:
-                    default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                    type: string
-                  optional:
-                    description: Specify whether the Secret or its key must be defined
-                    type: boolean
-                required:
-                - key
-                type: object
-                x-kubernetes-map-type: atomic
-              response_headers:
-                description: |-
-                  ResponseHeaders represent additional http headers, that vmauth adds for request response
-                  in form of ["header_key: header_value"]
-                  multiple values for header key:
-                  ["header_key: value1,value2"]
-                  it's available since 1.93.0 version of vmauth
-                items:
-                  type: string
-                type: array
-              retry_status_codes:
-                description: |-
-                  RetryStatusCodes defines http status codes in numeric format for request retries
-                  e.g. [429,503]
-                items:
-                  type: integer
-                type: array
-              targetRefs:
-                description: TargetRefs - reference to endpoints, which user may access.
-                items:
-                  description: |-
-                    TargetRef describes target for user traffic forwarding.
-                    one of target types can be chosen:
-                    crd or static per targetRef.
-                    user can define multiple targetRefs with different ref Types.
-                  properties:
-                    crd:
-                      description: |-
-                        CRD describes exist operator's CRD object,
-                        operator generates access url based on CRD params.
-                      properties:
-                        kind:
-                          description: |-
-                            Kind one of:
-                            VMAgent,VMAlert, VMSingle, VMCluster/vmselect, VMCluster/vmstorage,VMCluster/vminsert  or VMAlertManager
-                          enum:
-                          - VMAgent
-                          - VMAlert
-                          - VMSingle
-                          - VLogs
-                          - VMAlertManager
-                          - VMAlertmanager
-                          - VMCluster/vmselect
-                          - VMCluster/vmstorage
-                          - VMCluster/vminsert
-                          type: string
-                        name:
-                          description: Name target CRD object name
-                          type: string
-                        namespace:
-                          description: Namespace target CRD object namespace.
-                          type: string
-                      required:
-                      - kind
-                      - name
-                      - namespace
-                      type: object
-                    discover_backend_ips:
-                      description: DiscoverBackendIPs instructs discovering URLPrefix
-                        backend IPs via DNS.
-                      type: boolean
-                    drop_src_path_prefix_parts:
-                      description: |-
-                        DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend.
-                        See [here](https://docs.victoriametrics.com/vmauth#dropping-request-path-prefix) for more details.
-                      type: integer
-                    headers:
-                      description: |-
-                        RequestHeaders represent additional http headers, that vmauth uses
-                        in form of ["header_key: header_value"]
-                        multiple values for header key:
-                        ["header_key: value1,value2"]
-                        it's available since 1.68.0 version of vmauth
-                      items:
-                        type: string
-                      type: array
-                    hosts:
-                      items:
-                        type: string
-                      type: array
-                    load_balancing_policy:
-                      description: |-
-                        LoadBalancingPolicy defines load balancing policy to use for backend urls.
-                        Supported policies: least_loaded, first_available.
-                        See [here](https://docs.victoriametrics.com/vmauth#load-balancing) for more details (default "least_loaded")
-                      enum:
-                      - least_loaded
-                      - first_available
-                      type: string
-                    paths:
-                      description: Paths - matched path to route.
-                      items:
-                        type: string
-                      type: array
-                    response_headers:
-                      description: |-
-                        ResponseHeaders represent additional http headers, that vmauth adds for request response
-                        in form of ["header_key: header_value"]
-                        multiple values for header key:
-                        ["header_key: value1,value2"]
-                        it's available since 1.93.0 version of vmauth
-                      items:
-                        type: string
-                      type: array
-                    retry_status_codes:
-                      description: |-
-                        RetryStatusCodes defines http status codes in numeric format for request retries
-                        Can be defined per target or at VMUser.spec level
-                        e.g. [429,503]
-                      items:
-                        type: integer
-                      type: array
-                    src_headers:
-                      description: SrcHeaders is an optional list of headers, which
-                        must match request headers.
-                      items:
-                        type: string
-                      type: array
-                    src_query_args:
-                      description: SrcQueryArgs is an optional list of query args,
-                        which must match request URL query args.
-                      items:
-                        type: string
-                      type: array
-                    static:
-                      description: |-
-                        Static - user defined url for traffic forward,
-                        for instance http://vmsingle:8429
-                      properties:
-                        url:
-                          description: URL http url for given staticRef.
-                          type: string
-                        urls:
-                          description: URLs allows setting multiple urls for load-balancing
-                            at vmauth-side.
-                          items:
-                            type: string
-                          type: array
-                      type: object
-                    target_path_suffix:
-                      description: |-
-                        TargetPathSuffix allows to add some suffix to the target path
-                        It allows to hide tenant configuration from user with crd as ref.
-                        it also may contain any url encoded params.
-                      type: string
-                    targetRefBasicAuth:
-                      description: TargetRefBasicAuth allow an target endpoint to
-                        authenticate over basic authentication
-                      properties:
-                        password:
-                          description: |-
-                            The secret in the service scrape namespace that contains the password
-                            for authentication.
-                            It must be at them same namespace as CRD
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        username:
-                          description: |-
-                            The secret in the service scrape namespace that contains the username
-                            for authentication.
-                            It must be at them same namespace as CRD
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                      required:
-                      - password
-                      - username
-                      type: object
-                  type: object
-                type: array
-              tlsConfig:
-                description: TLSConfig defines tls configuration for the backend connection
-                properties:
-                  ca:
-                    description: Struct containing the CA cert to use for the targets.
-                    properties:
-                      configMap:
-                        description: ConfigMap containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key to select.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      secret:
-                        description: Secret containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  caFile:
-                    description: Path to the CA cert in the container to use for the
-                      targets.
-                    type: string
-                  cert:
-                    description: Struct containing the client cert file for the targets.
-                    properties:
-                      configMap:
-                        description: ConfigMap containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key to select.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      secret:
-                        description: Secret containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  certFile:
-                    description: Path to the client cert file in the container for
-                      the targets.
-                    type: string
-                  insecureSkipVerify:
-                    description: Disable target certificate validation.
-                    type: boolean
-                  keyFile:
-                    description: Path to the client key file in the container for
-                      the targets.
-                    type: string
-                  keySecret:
-                    description: Secret containing the client key file for the targets.
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  serverName:
-                    description: Used to verify the hostname for the targets.
-                    type: string
-                type: object
-              tokenRef:
-                description: TokenRef allows fetching token from user-created secrets
-                  by its name and key.
-                properties:
-                  key:
-                    description: The key of the secret to select from.  Must be a
-                      valid secret key.
-                    type: string
-                  name:
-                    default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                    type: string
-                  optional:
-                    description: Specify whether the Secret or its key must be defined
-                    type: boolean
-                required:
-                - key
-                type: object
-                x-kubernetes-map-type: atomic
-              username:
-                description: |-
-                  UserName basic auth user name for accessing protected endpoint,
-                  will be replaced with metadata.name of VMUser if omitted.
-                type: string
             required:
             - targetRefs
             type: object
+            x-kubernetes-preserve-unknown-fields: true
+          status:
+            properties:
+              conditions:
+                items:
+                  properties:
+                    lastTransitionTime:
+                      format: date-time
+                      type: string
+                    lastUpdateTime:
+                      format: date-time
+                      type: string
+                    message:
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      maxLength: 1024
+                      minLength: 1
+                      type: string
+                    status:
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      maxLength: 316
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - lastUpdateTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              observedGeneration:
+                format: int64
+                type: integer
+              reason:
+                type: string
+              updateStatus:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: vtclusters.operator.victoriametrics.com
+spec:
+  group: operator.victoriametrics.com
+  names:
+    kind: VTCluster
+    listKind: VTClusterList
+    plural: vtclusters
+    singular: vtcluster
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: replicas of VTInsert
+      jsonPath: .spec.insert.replicaCount
+      name: Insert Count
+      type: string
+    - description: replicas of VTStorage
+      jsonPath: .spec.storage.replicaCount
+      name: Storage Count
+      type: string
+    - description: replicas of VTSelect
+      jsonPath: .spec.select.replicaCount
+      name: Select Count
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: Current status of cluster
+      jsonPath: .status.updateStatus
+      name: Status
+      type: string
+    name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            type: string
+          kind:
+            type: string
+          metadata:
+            type: object
+          spec:
+            type: object
+            x-kubernetes-preserve-unknown-fields: true
+          status:
+            properties:
+              conditions:
+                items:
+                  properties:
+                    lastTransitionTime:
+                      format: date-time
+                      type: string
+                    lastUpdateTime:
+                      format: date-time
+                      type: string
+                    message:
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      maxLength: 1024
+                      minLength: 1
+                      type: string
+                    status:
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      maxLength: 316
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - lastUpdateTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              observedGeneration:
+                format: int64
+                type: integer
+              reason:
+                type: string
+              updateStatus:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: vtsingles.operator.victoriametrics.com
+spec:
+  group: operator.victoriametrics.com
+  names:
+    kind: VTSingle
+    listKind: VTSingleList
+    plural: vtsingles
+    singular: vtsingle
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: Current status of traces instance update process
+      jsonPath: .status.status
+      name: Status
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            type: string
+          kind:
+            type: string
+          metadata:
+            type: object
+          spec:
+            type: object
+            x-kubernetes-preserve-unknown-fields: true
           status:
-            description: VMUserStatus defines the observed state of VMUser
             properties:
               conditions:
-                description: 'Known .status.conditions.type are: "Available", "Progressing",
-                  and "Degraded"'
                 items:
-                  description: Condition defines status condition of the resource
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another.
                       format: date-time
                       type: string
                     lastUpdateTime:
-                      description: |-
-                        LastUpdateTime is the last time of given type update.
-                        This value is used for status TTL update and removal
                       format: date-time
                       type: string
                     message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       type: string
                     status:
-                      description: status of the condition, one of True, False, Unknown.
                       enum:
                       - "True"
                       - "False"
                       - Unknown
                       type: string
                     type:
-                      description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase.
                       maxLength: 316
                       type: string
                   required:
@@ -31788,16 +2250,11 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               observedGeneration:
-                description: |-
-                  ObservedGeneration defines current generation picked by operator for the
-                  reconcile
                 format: int64
                 type: integer
               reason:
-                description: Reason defines human readable error reason
                 type: string
               updateStatus:
-                description: UpdateStatus defines a status for update rollout
                 type: string
             type: object
         type: object
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/_helpers.tpl b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/_helpers.tpl
index d1215342..8abc83f6 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/_helpers.tpl
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/_helpers.tpl
@@ -34,7 +34,7 @@ caCert: {{ index $secret.data "ca.crt" }}
 clientCert: {{ index $secret.data "tls.crt" }}
 clientKey: {{ index $secret.data "tls.key" }}
 {{- else -}}
-{{- $altNames := default list -}}
+{{- $altNames := list -}}
 {{- $namePrefix := (printf "%s.%s" $fullname (include "vm.namespace" .)) -}}
 {{- $altNames = append $altNames $namePrefix -}}
 {{- $altNames = append $altNames (printf "%s.svc" $namePrefix) -}}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/cleanup.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/cleanup.yaml
index d6f4c58f..4776ee99 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/cleanup.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/cleanup.yaml
@@ -1,7 +1,7 @@
-{{- if and .Values.crds.enabled .Values.crds.cleanup.enabled }}
+{{- if .Values.crds.cleanup.enabled }}
 {{- $app := .Values.crds.cleanup }}
 {{- if empty ($app.image).tag }}
-  {{- $tag := (printf "%s.%s" .Capabilities.KubeVersion.Major .Capabilities.KubeVersion.Minor) | replace "+" "" -}}
+  {{- $tag := regexSplit "[+-]" .Capabilities.KubeVersion.Version -1 | first -}}
   {{- $_ := set $app.image "tag" $tag }}
 {{- else if not (kindIs "string" ($app.image).tag) }}
   {{- fail "`crd.cleanup.image.tag` is not string, most probably you need to enquote provided value" -}}
@@ -33,9 +33,20 @@ spec:
           image: {{ include "vm.image" $ctx }}
           imagePullPolicy: {{ $app.image.pullPolicy }}
           resources: {{ toYaml $app.resources | nindent 12 }}
+          {{- if .Values.securityContext.enabled }}
+          securityContext: {{ include "vm.securityContext" (dict "securityContext" .Values.securityContext "helm" .) | nindent 12 }}
+          {{- end }}
+          {{- $names := list }}
+          {{- $crds := .Files.Get "crd.yaml" | splitList "---" }}
+          {{- range $crds }}
+            {{- $crd := . | fromYaml }}
+            {{- $names = append $names $crd.spec.names.singular }}
+          {{- end }}
+          command:
+            - kubectl
           args:
             - delete
-            - {{ (keys .Values.admissionWebhooks.enabledCRDValidation) | sortAlpha | join "," }}
+            - {{ $names | sortAlpha | join "," }}
             - --all
             - --ignore-not-found=true
       restartPolicy: OnFailure
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/crb.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/crb.yaml
index 78327074..9bf378ab 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/crb.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/crb.yaml
@@ -21,7 +21,7 @@ roleRef:
   name: {{ $fullname }}
   apiGroup: rbac.authorization.k8s.io
 {{- end -}}
-{{- if and .Values.crds.enabled .Values.crds.cleanup.enabled }}
+{{- if .Values.crds.cleanup.enabled }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/crd.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/crd.yaml
index d5bf4b77..d5cb31b6 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/crd.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/crd.yaml
@@ -8,9 +8,8 @@
 {{- if and (not .Values.crds.plain) .Values.crds.enabled }}
   {{- $files := .Files }}
   {{- $crds := $files.Get "crd.yaml" | splitList "---" }}
-  {{- $labels := (include "vm.labels" $ctx) | fromYaml -}}
   {{- $annotations := mergeOverwrite ((include "vm-operator.crds.annotations" .) | fromYaml) .Values.crds.annotations -}}
-  {{- $extra := dict "metadata" (dict "annotations" $annotations "labels" $labels) -}}
+  {{- $extra := dict "metadata" (dict "annotations" $annotations) -}}
   {{- range $crds }}
     {{- $crd := merge (fromYaml .) $extra }}
     {{- range $attrKey, $attrValue := $crd }}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/role.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/role.yaml
index cb658970..703c54e8 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/role.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/role.yaml
@@ -1,10 +1,10 @@
-{{- $rules := default dict }}
-{{- $fileContentsList := .Files.Get "crd.yaml" | splitList "---" }}
+{{- $rules := dict }}
+{{- $crds := .Files.Get "crd.yaml" | splitList "---" }}
 {{- $groups := dict }}
-{{- range $fileContentsList }}
-  {{- $fileContents := . | fromYaml }}
-  {{- $group := $fileContents.spec.group }}
-  {{- $plural:= $fileContents.spec.names.plural }}
+{{- range $crds }}
+  {{- $crd := . | fromYaml }}
+  {{- $group := $crd.spec.group }}
+  {{- $plural:= $crd.spec.names.plural }}
   {{- $resources := get $groups $group | default (list) }}
   {{- $resources = concat $resources (list $plural (printf "%s/finalizers" $plural) (printf "%s/status" $plural)) }}
   {{- $groups = set $groups $group $resources }}
@@ -74,6 +74,7 @@ rules:
   - persistentvolumeclaims
   - persistentvolumeclaims/finalizers
   - pods
+  - pods/eviction
   - secrets
   - secrets/finalizers
   - services
@@ -87,7 +88,6 @@ rules:
   resources:
   - configmaps/status
   - nodes
-  - nodes/proxy
   - nodes/metrics
   - namespaces
   verbs:
@@ -160,6 +160,13 @@ rules:
   - ingresses/finalizers
   verbs:
   - "*"
+- apiGroups:
+    - gateway.networking.k8s.io
+  resources:
+    - httproutes
+    - httproutes/finalizers
+  verbs:
+    - '*'
 - apiGroups:
   - apiextensions.k8s.io
   resources:
@@ -179,7 +186,7 @@ rules:
 {{ toYaml . }}
 {{- end }}
 {{- end }}
-{{- if and .Values.crds.enabled .Values.crds.cleanup.enabled }}
+{{- if .Values.crds.cleanup.enabled }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/deployment.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/server.yaml
similarity index 90%
rename from packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/deployment.yaml
rename to packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/server.yaml
index b247f393..e224c074 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/deployment.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/server.yaml
@@ -1,6 +1,10 @@
 {{- $ctx := dict "helm" . "noEnterprise" true }}
 {{- $fullname := include "vm.plain.fullname" $ctx }}
 {{- $ns := include "vm.namespace" $ctx }}
+{{- $env := dict -}}
+{{- range .Values.env | default list -}}
+  {{- $_ := set $env .name .value -}}
+{{- end -}}
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -33,6 +37,9 @@ spec:
       {{- if .Values.hostNetwork }}
       hostNetwork: true
       {{- end }}
+      {{- if .Values.shareProcessNamespace }}
+      shareProcessNamespace: true
+      {{- end }}
       {{- if or (.Values.serviceAccount).name (.Values.serviceAccount).create }}
       serviceAccountName: {{ (.Values.serviceAccount).name | default $fullname }}
       {{- end }}
@@ -61,9 +68,15 @@ spec:
                   fieldPath: metadata.name
             - name: OPERATOR_NAME
               value: {{ .Chart.Name }}
-            {{- if .Values.operator.useCustomConfigReloader }}
-            - name: VM_USECUSTOMCONFIGRELOADER
-              value: "true"
+            {{- with (((.Values).global).image).registry }}
+            - name: VM_CONTAINERREGISTRY
+              value: {{ quote . }}
+            {{- end -}}
+            {{- if not (empty (.Values.configReloader).image) }}
+            - name: VM_CONFIG_RELOADER_IMAGE
+              {{- $_ := set $ctx "appKey" (list "configReloader") }}
+              value: {{ include "vm.image" $ctx }}
+              {{- $_ := unset $ctx "appKey" }}
             {{- end }}
             {{- if .Values.operator.disable_prometheus_converter }}
             - name: VM_ENABLEDPROMETHEUSCONVERTER_PODMONITOR
@@ -81,7 +94,7 @@ spec:
               value: "true"
             {{- end }}
             - name: VM_ENABLEDPROMETHEUSCONVERTEROWNERREFERENCES
-              value: {{.Values.operator.enable_converter_ownership | quote}}
+              value: {{ .Values.operator.enable_converter_ownership | quote}}
           args:
             - --zap-log-level={{ .Values.logLevel }}
             - --leader-elect
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/service.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/service.yaml
index 842d444f..6efc329a 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/service.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/service.yaml
@@ -14,6 +14,9 @@ metadata:
   {{- $_ := unset $ctx "extraLabels" }}
   name: {{ $fullname }}
 spec:
+  {{- with $service.trafficDistribution }}
+  trafficDistribution: {{ . }}
+  {{- end }}
   {{- with $service.clusterIP }}
   clusterIP: {{ . }}
   {{- end }}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/service_account.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/serviceaccount.yaml
similarity index 88%
rename from packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/service_account.yaml
rename to packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/serviceaccount.yaml
index 59d26fba..73daf270 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/service_account.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/serviceaccount.yaml
@@ -6,7 +6,7 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ $sa.name | default $fullname }}
+  name: {{ tpl ($sa.name | default $fullname) $ctx }}
   namespace: {{ $ns }}
   {{- $_ := set $ctx "extraLabels" .Values.extraLabels }}
   labels: {{ include "vm.labels" $ctx | nindent 4 }}
@@ -15,7 +15,7 @@ metadata:
   {{- end }}
 automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
 {{- end }}
-{{- if and .Values.crds.enabled .Values.crds.cleanup.enabled }}
+{{- if .Values.crds.cleanup.enabled }}
 ---
 apiVersion: v1
 kind: ServiceAccount
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml
index 1bead84d..51039cae 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml
@@ -5,6 +5,9 @@
 {{- $domain := ((.Values.global).cluster).dnsDomain }}
 {{- $ns := include "vm.namespace" $ctx }}
 {{- $certManager := .Values.admissionWebhooks.certManager }}
+{{- $files := .Files }}
+{{- $crds := $files.Get "crd.yaml" | splitList "---" }}
+{{- $disabledFor := .Values.admissionWebhooks.disabledFor | default list }}
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
@@ -17,20 +20,24 @@ metadata:
   {{- end }}
   labels: {{ include "vm.labels" $ctx | nindent 4 }}
 webhooks:
-{{- range $name, $enabled := .Values.admissionWebhooks.enabledCRDValidation }}
-{{- if $enabled }}
+{{- range $crds }}
+{{- $crd := fromYaml . }}
+{{- $name := $crd.spec.names.singular }}
+{{- if not (has $name $disabledFor) }}
+{{- range $version := $crd.spec.versions }}
   - clientConfig:
       service:
         namespace: {{ $ns }}
         name: {{ $fullname }}
-        path: /validate-operator-victoriametrics-com-v1beta1-{{ $name }}
+        path: /validate-operator-victoriametrics-com-{{ $version.name }}-{{ $crd.spec.names.singular }}
         port: {{ $.Values.service.webhookPort }}
       {{- if not $certManager.enabled }}
       caBundle: {{ $tls.caCert }}
       {{- end }}
     failurePolicy: {{ $.Values.admissionWebhooks.policy }}
-    name: {{ $name }}.victoriametrics.com
-    admissionReviewVersions: ["v1", "v1beta1"]
+    name: '{{ $crd.metadata.name }}'
+    admissionReviewVersions:
+      - v1
     sideEffects: None
     objectSelector:
       matchExpressions:
@@ -39,14 +46,15 @@ webhooks:
           values: [{{ include "vm.name" $ }}]
     rules:
       - apiGroups:
-          - operator.victoriametrics.com
+          - {{ $crd.spec.group }}
         apiVersions:
-          - v1beta1
+          - {{ $version.name }}
         operations:
           - CREATE
           - UPDATE
         resources:
-          - {{ $name }}{{ ternary "" "s" (hasSuffix "s" $name) }}
+          - {{ $crd.spec.names.plural }}
+{{- end }}
 {{- end }}
 {{- end }}
 {{- if $certManager.enabled }}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/values.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/values.yaml
index 64eddbf2..279ceee9 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/values.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/values.yaml
@@ -29,6 +29,12 @@ image:
   # -- Image pull policy
   pullPolicy: IfNotPresent
 
+configReloader:
+  image: {}
+  # registry: ""
+  # repository: ""
+  # tag: ""
+
 crds:
   # -- manages CRD creation. Disables CRD creation only in combination with `crds.plain: false` due to helm dependency conditions limitation
   enabled: true
@@ -43,7 +49,7 @@ crds:
     enabled: false
     # -- Image configuration for CRD cleanup Job
     image:
-      repository: bitnami/kubectl
+      repository: rancher/kubectl
       # use image tag that matches k8s API version by default
       tag: ""
       pullPolicy: IfNotPresent
@@ -55,6 +61,109 @@ crds:
       requests:
         cpu: "100m"
         memory: "56Mi"
+  upgrade:
+    # -- Enables CRD upgrade job
+    enabled: false
+    # -- Adds `--force-conflics` argument to kubectl
+    forceConflicts: false
+    busybox:
+      image:
+        repository: busybox
+        tag: latest
+        pullPolicy: IfNotPresent
+    kubectl:
+      image:
+        repository: rancher/kubectl
+        # use image tag that matches k8s API version by default
+        tag: ""
+        pullPolicy: IfNotPresent
+
+    # -- Extra settings for CRD upgrade job
+    env: []
+
+    # -- Upgrade job resources.
+    resources: {}
+    # limits:
+    #   cpu: 120m
+    #   memory: 320Mi
+    # requests:
+    #   cpu: 80m
+    #   memory: 120Mi
+
+    # -- Additional upgrade job volumes
+    extraVolumes: []
+
+    # -- Additional upgrade job volume mounts
+    extraVolumeMounts: []
+
+    # -- Pod's node selector. Details are [here](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector)
+    nodeSelector: {}
+
+    # -- Upgrade job pod affinity
+    affinity: {}
+    # nodeAffinity:
+    #   requiredDuringSchedulingIgnoredDuringExecution:
+    #     nodeSelectorTerms:
+    #     - matchExpressions:
+    #       - key: kubernetes.io/e2e-az-name
+    #         operator: In
+    #         values:
+    #         - e2e-az1
+    #         - e2e-az2
+
+    # -- Array of upgrade job tolerations object. Spec is [here](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/)
+    tolerations: []
+    # - key: "key"
+    #   operator: "Equal"
+    #   value: "value"
+    #   effect: "NoSchedule"
+
+    # -- Upgrade job Pod Topology Spread Constraints. Spec is [here](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/)
+    topologySpreadConstraints: []
+    # - maxSkew: 1
+    #   topologyKey: topology.kubernetes.io/zone
+    #   whenUnsatisfiable: DoNotSchedule
+    #   labelSelector:
+    #     matchLabels:
+    #       app: alertmanager
+
+    # -- Labels to add to the upgrade job
+    labels: {}
+
+    # -- Annotations to add to the upgrade job
+    annotations: {}
+
+    # -- Labels to add to the upgrade job pod
+    podLabels: {}
+
+    # -- Annotations to add to the upgrade job pod
+    podAnnotations: {}
+
+    # -- Service account for upgrade CRD job to use.
+    serviceAccount:
+      create: true
+      name: ""
+      annotations: {}
+      labels: {}
+      automountServiceAccountToken: true
+
+    # -- Container-specific security context configuration. Details are [here](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
+    securityContext:
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+      capabilities:
+        drop:
+          - ALL
+
+    # -- Pod's security context. Details are [here](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
+    podSecurityContext:
+      enabled: true
+      fsGroup: 65534
+      runAsGroup: 65534
+      runAsNonRoot: true
+      runAsUser: 65534
+      seccompProfile:
+        type: RuntimeDefault
 
 # -- Number of operator replicas
 replicaCount: 1
@@ -119,9 +228,6 @@ operator:
   # -- Enables ownership reference for converted prometheus-operator objects,
   # it will remove corresponding victoria-metrics objects in case of deletion prometheus one.
   enable_converter_ownership: false
-  # -- Enables custom config-reloader, bundled with operator.
-  # It should reduce  vmagent and vmauth config sync-time and make it predictable.
-  useCustomConfigReloader: false
 
 # -- By default, the operator will watch all the namespaces
 # If you want to override this behavior, specify the namespace.
@@ -138,13 +244,15 @@ serviceAccount:
   automountServiceAccountToken: true
 
 service:
+  # -- Service traffic distribution. Details are [here](https://kubernetes.io/docs/concepts/services-networking/service/#traffic-distribution)
+  trafficDistribution: ""
   # -- Service annotations
   annotations: {}
   # -- Service labels
   labels: {}
   # -- Service ClusterIP
   clusterIP: ""
-  # -- Service external IPs. Check [here](https://kubernetes.io/docs/user-guide/services/#external-ips) for details
+  # -- Service external IPs. Check [here](https://kubernetes.io/docs/concepts/services-networking/service/#external-ips) for details
   externalIPs: ""
   # -- Service load balancer IP
   loadBalancerIP: ""
@@ -188,7 +296,7 @@ resources:
   #   cpu: 80m
   #   memory: 120Mi
 
-# -- Pod's node selector. Details are [here](https://kubernetes.io/docs/user-guide/node-selection/)
+# -- Pod's node selector. Details are [here](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector)
 nodeSelector: {}
 
 # -- Name of Priority Class
@@ -206,7 +314,7 @@ topologySpreadConstraints: []
 # -- Operator container additional commandline arguments
 extraArgs: {}
 
-# -- Extra settings for the operator deployment. Full list [here](https://docs.victoriametrics.com/operator/vars)
+# -- Extra settings for the operator deployment. Full list [here](https://docs.victoriametrics.com/operator/configuration/#environment-variables)
 env:
   []
   # - name: VM_VMSINGLEDEFAULT_VERSION
@@ -249,21 +357,18 @@ extraContainers:
 # -- Enable hostNetwork on operator deployment
 hostNetwork: false
 
+# -- Enable sharing process Namespace between Containers in a Pod. This only makes sense with extraContainers
+shareProcessNamespace: false
+
 # -- Configures resource validation
 admissionWebhooks:
   # -- Enables validation webhook.
   enabled: true
-  enabledCRDValidation:
-    vmagent: true
-    vmalert: true
-    vmsingle: true
-    vmauth: true
-    vmrule: true
-    vmalertmanagerconfig: true
-    vmalertmanager: true
-    vmcluster: true
-    vmuser: true
-    vlogs: true
+  # -- List of CRD names to disable validation for
+  disabledFor: []
+  # - vmagent
+  # - vmsingle
+
   # -- What to do in case, when operator not available to validate request.
   policy: Fail
   # -- Enables custom ca bundle, if you are not using cert-manager. In case of custom ca, you have to create secret - {chart-name}-validation with keys: tls.key, tls.crt, ca.crt

From 62d36ec4ee3b977274e845c4063566d02760052c Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Thu, 5 Mar 2026 13:25:53 +0500
Subject: [PATCH 230/666] feat(monitoring): migrate VictoriaLogs from VLogs to
 VLCluster

Replace deprecated single-node VLogs CR with VLCluster (cluster mode)
for reliability and horizontal scalability.

Changes:
- Replace VLogs (v1beta1) with VLCluster (v1) using vlinsert/vlselect/vlstorage
- Update fluent-bit outputs to vlinsert-generic:9481
- Update Grafana datasource to vlselect:9471
- Update ExternalName service from vlogs-generic to vlinsert-generic
- Add VPA for all VLCluster components
- Update WorkloadMonitors for three-component architecture
- Add migration 35 to preserve old VLogs resources with keep annotation

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .../helmreleases/monitoring-agents.yaml       |  4 +-
 .../platform/images/migrations/migrations/35  | 21 +++++
 packages/core/platform/values.yaml            |  2 +-
 .../templates/dashboard-resourcemap.yaml      |  4 +-
 .../templates/workloadmonitors.yaml           | 38 +++++++-
 .../monitoring-external-services.yaml         |  4 +-
 packages/system/monitoring-agents/values.yaml | 12 +--
 .../templates/vlogs/grafana-datasource.yaml   |  2 +-
 .../monitoring/templates/vlogs/vlogs.yaml     | 34 ++++---
 packages/system/monitoring/templates/vpa.yaml | 89 +++++++++++++++++++
 packages/system/monitoring/values.yaml        |  2 +-
 11 files changed, 182 insertions(+), 30 deletions(-)
 create mode 100755 packages/core/platform/images/migrations/migrations/35

diff --git a/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml b/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml
index 602f7efb..ea84dec0 100644
--- a/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml
@@ -73,8 +73,8 @@ spec:
           [OUTPUT]
               Name http
               Match kube.*
-              Host vlogs-generic.{{ $targetTenant }}.svc.{{ $clusterDomain }}
-              port 9428
+              Host vlinsert-generic.{{ $targetTenant }}.svc.{{ $clusterDomain }}
+              port 9481
               compress gzip
               uri /insert/jsonline?_stream_fields=stream,kubernetes_pod_name,kubernetes_container_name,kubernetes_namespace_name&_msg_field=log&_time_field=date
               format json_lines
diff --git a/packages/core/platform/images/migrations/migrations/35 b/packages/core/platform/images/migrations/migrations/35
new file mode 100755
index 00000000..a7471180
--- /dev/null
+++ b/packages/core/platform/images/migrations/migrations/35
@@ -0,0 +1,21 @@
+#!/bin/sh
+# Migration 35 --> 36
+# Add helm.sh/resource-policy=keep annotation to existing VLogs resources
+# so they are preserved when the monitoring helm release upgrades to VLCluster.
+# Users will need to manually verify the new cluster is working, then optionally
+# migrate historical data and delete old VLogs resources.
+
+set -euo pipefail
+
+VLOGS=$(kubectl get vlogs.operator.victoriametrics.com --all-namespaces --output jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}' 2>/dev/null || true)
+for resource in $VLOGS; do
+  NS="${resource%%/*}"
+  NAME="${resource##*/}"
+  echo "Adding keep annotation to VLogs/$NAME in $NS"
+  kubectl annotate vlogs.operator.victoriametrics.com --namespace "$NS" "$NAME" \
+    helm.sh/resource-policy=keep \
+    --overwrite
+done
+
+kubectl create configmap --namespace cozy-system cozystack-version \
+  --from-literal=version=36 --dry-run=client --output yaml | kubectl apply --filename -
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index c559af9e..0d33c752 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -6,7 +6,7 @@ sourceRef:
 migrations:
   enabled: false
   image: ghcr.io/cozystack/cozystack/platform-migrations:v1.1.0@sha256:d7e8955c1ad8c8fbd4ce42b014c0f849d73d0c3faf0cedaac8e15d647fb2f663
-  targetVersion: 35
+  targetVersion: 36
 # Bundle deployment configuration
 bundles:
   system:
diff --git a/packages/extra/monitoring/templates/dashboard-resourcemap.yaml b/packages/extra/monitoring/templates/dashboard-resourcemap.yaml
index 894a11d4..5a5a3def 100644
--- a/packages/extra/monitoring/templates/dashboard-resourcemap.yaml
+++ b/packages/extra/monitoring/templates/dashboard-resourcemap.yaml
@@ -42,7 +42,9 @@ rules:
   - {{ .name }}-vminsert
   {{- end }}
   {{- range .Values.logsStorages }}
-  - {{ $.Release.Name }}-vlogs-{{ .name }}
+  - {{ .name }}-vlstorage
+  - {{ .name }}-vlselect
+  - {{ .name }}-vlinsert
   {{- end }}
   {{- range .Values.metricsStorages }}
   - vmalert-{{ .name }}
diff --git a/packages/extra/monitoring/templates/workloadmonitors.yaml b/packages/extra/monitoring/templates/workloadmonitors.yaml
index 6dbfa8c1..5d803351 100644
--- a/packages/extra/monitoring/templates/workloadmonitors.yaml
+++ b/packages/extra/monitoring/templates/workloadmonitors.yaml
@@ -67,16 +67,46 @@ spec:
 apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
-  name: vlogs-{{ .name }}
+  name: {{ .name }}-vlstorage
 spec:
-  replicas: 1
+  replicas: 2
   minReplicas: 1
   kind: monitoring
-  type: vlogs
+  type: vlstorage
   selector:
     app.kubernetes.io/component: monitoring
     app.kubernetes.io/instance: {{ .name }}
-    app.kubernetes.io/name: vlogs
+    app.kubernetes.io/name: vlstorage
+  version: {{ $.Chart.Version }}
+---
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ .name }}-vlselect
+spec:
+  replicas: 2
+  minReplicas: 1
+  kind: monitoring
+  type: vlselect
+  selector:
+    app.kubernetes.io/component: monitoring
+    app.kubernetes.io/instance: {{ .name }}
+    app.kubernetes.io/name: vlselect
+  version: {{ $.Chart.Version }}
+---
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ .name }}-vlinsert
+spec:
+  replicas: 2
+  minReplicas: 1
+  kind: monitoring
+  type: vlinsert
+  selector:
+    app.kubernetes.io/component: monitoring
+    app.kubernetes.io/instance: {{ .name }}
+    app.kubernetes.io/name: vlinsert
   version: {{ $.Chart.Version }}
 {{- end }}
 ---
diff --git a/packages/system/cozystack-basics/templates/monitoring-external-services.yaml b/packages/system/cozystack-basics/templates/monitoring-external-services.yaml
index 0f8b4d5c..e36540c4 100644
--- a/packages/system/cozystack-basics/templates/monitoring-external-services.yaml
+++ b/packages/system/cozystack-basics/templates/monitoring-external-services.yaml
@@ -2,11 +2,11 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: vlogs-generic
+  name: vlinsert-generic
   namespace: cozy-monitoring
 spec:
   type: ExternalName
-  externalName: vlogs-generic.tenant-root.svc.cluster.local
+  externalName: vlinsert-generic.tenant-root.svc.cluster.local
 ---
 apiVersion: v1
 kind: Service
diff --git a/packages/system/monitoring-agents/values.yaml b/packages/system/monitoring-agents/values.yaml
index a4d4b025..bcdee0e0 100644
--- a/packages/system/monitoring-agents/values.yaml
+++ b/packages/system/monitoring-agents/values.yaml
@@ -344,8 +344,8 @@ fluent-bit:
       [OUTPUT]
           Name http
           Match kube.*
-          Host vlogs-generic.{{ .Values.global.target }}.svc
-          port 9428
+          Host vlinsert-generic.{{ .Values.global.target }}.svc
+          port 9481
           compress gzip
           uri /insert/jsonline?_stream_fields=log_source,stream,kubernetes_pod_name,kubernetes_container_name,kubernetes_namespace_name&_msg_field=log&_time_field=date
           format json_lines
@@ -355,8 +355,8 @@ fluent-bit:
       [OUTPUT]
           Name http
           Match events.*
-          Host vlogs-generic.{{ .Values.global.target }}.svc
-          port 9428
+          Host vlinsert-generic.{{ .Values.global.target }}.svc
+          port 9481
           compress gzip
           uri /insert/jsonline?_stream_fields=log_source,reason,meatdata_namespace,metadata_name&_msg_field=message&_time_field=date
           format json_lines
@@ -366,8 +366,8 @@ fluent-bit:
       [OUTPUT]
           Name http
           Match audit.*
-          Host vlogs-generic.{{ .Values.global.target }}.svc
-          port 9428
+          Host vlinsert-generic.{{ .Values.global.target }}.svc
+          port 9481
           compress gzip
           uri /insert/jsonline?_stream_fields=log_source,stage,user_username,verb,requestUri&_msg_field=requestURI&_time_field=date
           format json_lines
diff --git a/packages/system/monitoring/templates/vlogs/grafana-datasource.yaml b/packages/system/monitoring/templates/vlogs/grafana-datasource.yaml
index 0fa41288..72755c6f 100644
--- a/packages/system/monitoring/templates/vlogs/grafana-datasource.yaml
+++ b/packages/system/monitoring/templates/vlogs/grafana-datasource.yaml
@@ -8,7 +8,7 @@ spec:
     access: proxy
     type: victoriametrics-logs-datasource
     name: vlogs-{{ .name }}
-    url: http://vlogs-{{ .name }}.{{ $.Release.Namespace }}.svc:9428
+    url: http://vlselect-{{ .name }}.{{ $.Release.Namespace }}.svc:9471
   instanceSelector:
     matchLabels:
       dashboards: grafana
diff --git a/packages/system/monitoring/templates/vlogs/vlogs.yaml b/packages/system/monitoring/templates/vlogs/vlogs.yaml
index adedb1e8..106d3aaf 100644
--- a/packages/system/monitoring/templates/vlogs/vlogs.yaml
+++ b/packages/system/monitoring/templates/vlogs/vlogs.yaml
@@ -1,6 +1,7 @@
 {{- range .Values.logsStorages }}
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VLogs
+---
+apiVersion: operator.victoriametrics.com/v1
+kind: VLCluster
 metadata:
   name: {{ .name }}
 spec:
@@ -9,14 +10,23 @@ spec:
       apps.cozystack.io/application.group: apps.cozystack.io
       apps.cozystack.io/application.kind: Monitoring
       apps.cozystack.io/application.name: {{ $.Release.Name }}
-  image:
-    tag: v1.17.0-victorialogs
-  storage:
-    resources:
-      requests:
-        storage: {{ .storage }}
-    storageClassName: {{ .storageClassName }}
-    accessModes: [ReadWriteOnce]
-  retentionPeriod: "{{ .retentionPeriod }}"
-  removePvcAfterDelete: true
+  vlinsert:
+    replicaCount: 2
+    resources: {}
+  vlselect:
+    replicaCount: 2
+    resources: {}
+  vlstorage:
+    retentionPeriod: {{ .retentionPeriod | quote }}
+    replicaCount: 2
+    resources: {}
+    storage:
+      volumeClaimTemplate:
+        spec:
+          {{- with .storageClassName }}
+          storageClassName: {{ . }}
+          {{- end }}
+          resources:
+            requests:
+              storage: {{ .storage }}
 {{- end }}
diff --git a/packages/system/monitoring/templates/vpa.yaml b/packages/system/monitoring/templates/vpa.yaml
index 8b90c0ba..551f8310 100644
--- a/packages/system/monitoring/templates/vpa.yaml
+++ b/packages/system/monitoring/templates/vpa.yaml
@@ -87,3 +87,92 @@ spec:
           memory: 8Gi
           {{- end }}
 {{- end }}
+{{- range .Values.logsStorages }}
+---
+apiVersion: autoscaling.k8s.io/v1
+kind: VerticalPodAutoscaler
+metadata:
+  name: vpa-vlinsert-{{ .name }}
+spec:
+  targetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: vlinsert-{{ .name }}
+  updatePolicy:
+    updateMode: Auto
+  resourcePolicy:
+    containerPolicies:
+      - containerName: vlinsert
+        minAllowed:
+          {{- if and .vlinsert .vlinsert.minAllowed }}
+          {{- toYaml .vlinsert.minAllowed | nindent 10 }}
+          {{- else }}
+          cpu: 25m
+          memory: 64Mi
+          {{- end }}
+        maxAllowed:
+          {{- if and .vlinsert .vlinsert.maxAllowed }}
+          {{- toYaml .vlinsert.maxAllowed | nindent 10 }}
+          {{- else }}
+          cpu: 2000m
+          memory: 4Gi
+          {{- end }}
+---
+apiVersion: autoscaling.k8s.io/v1
+kind: VerticalPodAutoscaler
+metadata:
+  name: vpa-vlselect-{{ .name }}
+spec:
+  targetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: vlselect-{{ .name }}
+  updatePolicy:
+    updateMode: Auto
+  resourcePolicy:
+    containerPolicies:
+      - containerName: vlselect
+        minAllowed:
+          {{- if and .vlselect .vlselect.minAllowed }}
+          {{- toYaml .vlselect.minAllowed | nindent 10 }}
+          {{- else }}
+          cpu: 25m
+          memory: 64Mi
+          {{- end }}
+        maxAllowed:
+          {{- if and .vlselect .vlselect.maxAllowed }}
+          {{- toYaml .vlselect.maxAllowed | nindent 10 }}
+          {{- else }}
+          cpu: 4000m
+          memory: 8Gi
+          {{- end }}
+---
+apiVersion: autoscaling.k8s.io/v1
+kind: VerticalPodAutoscaler
+metadata:
+  name: vpa-vlstorage-{{ .name }}
+spec:
+  targetRef:
+    apiVersion: apps/v1
+    kind: StatefulSet
+    name: vlstorage-{{ .name }}
+  updatePolicy:
+    updateMode: Auto
+  resourcePolicy:
+    containerPolicies:
+      - containerName: vlstorage
+        minAllowed:
+          {{- if and .vlstorage .vlstorage.minAllowed }}
+          {{- toYaml .vlstorage.minAllowed | nindent 10 }}
+          {{- else }}
+          cpu: 25m
+          memory: 64Mi
+          {{- end }}
+        maxAllowed:
+          {{- if and .vlstorage .vlstorage.maxAllowed }}
+          {{- toYaml .vlstorage.maxAllowed | nindent 10 }}
+          {{- else }}
+          cpu: 4000m
+          memory: 8Gi
+          {{- end }}
+{{- end }}
diff --git a/packages/system/monitoring/values.yaml b/packages/system/monitoring/values.yaml
index 564c654d..68732496 100644
--- a/packages/system/monitoring/values.yaml
+++ b/packages/system/monitoring/values.yaml
@@ -44,7 +44,7 @@ logsStorages:
 - name: generic
   retentionPeriod: "1"
   storage: 10Gi
-  storageClassName: replicated
+  storageClassName: ""
 alerta:
   storage: 10Gi
   storageClassName: ""

From 4946383cf1a6fad903409dcd4dcfc049791f71c9 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 10 Mar 2026 08:30:43 +0100
Subject: [PATCH 231/666] fix(etcd-operator): replace deprecated
 kube-rbac-proxy image

The gcr.io/kubebuilder/kube-rbac-proxy image is no longer available
since GCR was deprecated. Replace it with quay.io/brancz/kube-rbac-proxy
from the original upstream author.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/system/etcd-operator/charts/etcd-operator/README.md  | 4 ++--
 .../system/etcd-operator/charts/etcd-operator/values.yaml     | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/system/etcd-operator/charts/etcd-operator/README.md b/packages/system/etcd-operator/charts/etcd-operator/README.md
index 144c2ef0..ff2e019a 100644
--- a/packages/system/etcd-operator/charts/etcd-operator/README.md
+++ b/packages/system/etcd-operator/charts/etcd-operator/README.md
@@ -38,8 +38,8 @@
 | kubeRbacProxy.args[2] | string | `"--logtostderr=true"` |  |
 | kubeRbacProxy.args[3] | string | `"--v=0"` |  |
 | kubeRbacProxy.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
-| kubeRbacProxy.image.repository | string | `"gcr.io/kubebuilder/kube-rbac-proxy"` | Image repository |
-| kubeRbacProxy.image.tag | string | `"v0.16.0"` | Version of image |
+| kubeRbacProxy.image.repository | string | `"quay.io/brancz/kube-rbac-proxy"` | Image repository |
+| kubeRbacProxy.image.tag | string | `"v0.18.1"` | Version of image |
 | kubeRbacProxy.livenessProbe | object | `{}` | https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ |
 | kubeRbacProxy.readinessProbe | object | `{}` | https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ |
 | kubeRbacProxy.resources | object | `{"limits":{"cpu":"250m","memory":"128Mi"},"requests":{"cpu":"100m","memory":"64Mi"}}` | ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
diff --git a/packages/system/etcd-operator/charts/etcd-operator/values.yaml b/packages/system/etcd-operator/charts/etcd-operator/values.yaml
index 9687a10c..b2b5cd4e 100644
--- a/packages/system/etcd-operator/charts/etcd-operator/values.yaml
+++ b/packages/system/etcd-operator/charts/etcd-operator/values.yaml
@@ -98,13 +98,13 @@ kubeRbacProxy:
   image:
 
     # -- Image repository
-    repository: gcr.io/kubebuilder/kube-rbac-proxy
+    repository: quay.io/brancz/kube-rbac-proxy
 
     # -- Image pull policy
     pullPolicy: IfNotPresent
 
     # -- Version of image
-    tag: v0.16.0
+    tag: v0.18.1
 
   args:
     - --secure-listen-address=0.0.0.0:8443

From 318079bf665f359bbc41aca520d38f6a7e19c9de Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Mon, 9 Mar 2026 14:05:09 +0300
Subject: [PATCH 232/666] fix(dashboard): exclude hidden MarketplacePanel
 resources from sidebar menu

The sidebar was generated independently from MarketplacePanels, always
showing all resources regardless of their hidden state. Fetch
MarketplacePanels during sidebar reconciliation and skip resources
where hidden=true, so hiding a resource from the marketplace also
removes it from the sidebar navigation.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 internal/controller/dashboard/sidebar.go | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/internal/controller/dashboard/sidebar.go b/internal/controller/dashboard/sidebar.go
index 1f1c1670..90721b3d 100644
--- a/internal/controller/dashboard/sidebar.go
+++ b/internal/controller/dashboard/sidebar.go
@@ -38,6 +38,23 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 	}
 	all = crdList.Items
 
+	// 1b) Fetch all MarketplacePanels to determine which resources are hidden
+	hiddenResources := map[string]bool{}
+	var mpList dashv1alpha1.MarketplacePanelList
+	if err := m.List(ctx, &mpList, &client.ListOptions{}); err == nil {
+		for i := range mpList.Items {
+			mp := &mpList.Items[i]
+			if mp.Spec.Raw != nil {
+				var spec map[string]any
+				if err := json.Unmarshal(mp.Spec.Raw, &spec); err == nil {
+					if hidden, ok := spec["hidden"].(bool); ok && hidden {
+						hiddenResources[mp.Name] = true
+					}
+				}
+			}
+		}
+	}
+
 	// 2) Build category -> []item map (only for CRDs with spec.dashboard != nil)
 	type item struct {
 		Key    string
@@ -63,6 +80,11 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 		plural := pickPlural(kind, def)
 		lowerKind := strings.ToLower(kind)
 
+		// Skip resources hidden via MarketplacePanel
+		if hiddenResources[def.Name] {
+			continue
+		}
+
 		// Check if this resource is a module
 		if def.Spec.Dashboard.Module {
 			// Special case: info should have its own keysAndTags, not be in modules

From e69efd80c468bf94cd58cf647eb9f970170e120e Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Mon, 9 Mar 2026 13:56:06 +0300
Subject: [PATCH 233/666] fix(dashboard): preserve disabled/hidden state on
 MarketplacePanel reconciliation

The controller was hardcoding disabled=false and hidden=false on every
reconciliation, overwriting any user changes made through the dashboard
UI. Move spec building inside the CreateOrUpdate mutate function to read
and preserve current disabled/hidden values from the existing resource.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 .../controller/dashboard/marketplacepanel.go  | 53 ++++++++++++-------
 1 file changed, 34 insertions(+), 19 deletions(-)

diff --git a/internal/controller/dashboard/marketplacepanel.go b/internal/controller/dashboard/marketplacepanel.go
index fcfff799..14684afc 100644
--- a/internal/controller/dashboard/marketplacepanel.go
+++ b/internal/controller/dashboard/marketplacepanel.go
@@ -68,31 +68,46 @@ func (m *Manager) ensureMarketplacePanel(ctx context.Context, crd *cozyv1alpha1.
 		tags[i] = t
 	}
 
-	specMap := map[string]any{
-		"description": d.Description,
-		"name":        displayName,
-		"type":        "nonCrd",
-		"apiGroup":    "apps.cozystack.io",
-		"apiVersion":  "v1alpha1",
-		"plural":      app.Plural, // e.g., "buckets"
-		"disabled":    false,
-		"hidden":      false,
-		"tags":        tags,
-		"icon":        d.Icon,
-	}
-
-	specBytes, err := json.Marshal(specMap)
-	if err != nil {
-		return reconcile.Result{}, err
-	}
-
-	_, err = controllerutil.CreateOrUpdate(ctx, m.Client, mp, func() error {
+	_, err := controllerutil.CreateOrUpdate(ctx, m.Client, mp, func() error {
 		if err := controllerutil.SetOwnerReference(crd, mp, m.Scheme); err != nil {
 			return err
 		}
 		// Add dashboard labels to dynamic resources
 		m.addDashboardLabels(mp, crd, ResourceTypeDynamic)
 
+		// Preserve user-set disabled/hidden values from existing resource
+		disabled := false
+		hidden := false
+		if mp.Spec.Raw != nil {
+			var existing map[string]any
+			if err := json.Unmarshal(mp.Spec.Raw, &existing); err == nil {
+				if v, ok := existing["disabled"].(bool); ok {
+					disabled = v
+				}
+				if v, ok := existing["hidden"].(bool); ok {
+					hidden = v
+				}
+			}
+		}
+
+		specMap := map[string]any{
+			"description": d.Description,
+			"name":        displayName,
+			"type":        "nonCrd",
+			"apiGroup":    "apps.cozystack.io",
+			"apiVersion":  "v1alpha1",
+			"plural":      app.Plural, // e.g., "buckets"
+			"disabled":    disabled,
+			"hidden":      hidden,
+			"tags":        tags,
+			"icon":        d.Icon,
+		}
+
+		specBytes, err := json.Marshal(specMap)
+		if err != nil {
+			return err
+		}
+
 		// Only update spec if it's different to avoid unnecessary updates
 		newSpec := dashv1alpha1.ArbitrarySpec{
 			JSON: apiextv1.JSON{Raw: specBytes},

From 49601b166d44f4def641d2d6dadfa2e1503ca563 Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Mon, 9 Mar 2026 13:48:41 +0300
Subject: [PATCH 234/666] fix(dashboard): fix External IPs factory
 EnrichedTable rendering

The external-ips factory used incorrect EnrichedTable properties causing
empty rows in the dashboard. Replace `clusterNamePartOfUrl` with
`cluster` and change `pathToItems` from array to dot-path string format
to match the convention used by all other working EnrichedTable instances.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 internal/controller/dashboard/static_refactored.go | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/internal/controller/dashboard/static_refactored.go b/internal/controller/dashboard/static_refactored.go
index b025509d..e48552af 100644
--- a/internal/controller/dashboard/static_refactored.go
+++ b/internal/controller/dashboard/static_refactored.go
@@ -1924,12 +1924,12 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 				map[string]any{
 					"type": "EnrichedTable",
 					"data": map[string]any{
-						"id":                   "external-ips-table",
-						"fetchUrl":             "/api/clusters/{2}/k8s/api/v1/namespaces/{3}/services",
-						"clusterNamePartOfUrl": "{2}",
-						"baseprefix":           "/openapi-ui",
-						"customizationId":      "factory-details-v1.services",
-						"pathToItems":          []any{"items"},
+						"id":              "external-ips-table",
+						"fetchUrl":        "/api/clusters/{2}/k8s/api/v1/namespaces/{3}/services",
+						"cluster":         "{2}",
+						"baseprefix":      "/openapi-ui",
+						"customizationId": "factory-details-v1.services",
+						"pathToItems":     ".items",
 						"fieldSelector": map[string]any{
 							"spec.type": "LoadBalancer",
 						},

From 4b166e788a1e4f930e34e9b2e2ec2e208c502347 Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Sat, 7 Mar 2026 13:53:55 +0300
Subject: [PATCH 235/666] fix(ci): unblock docs-only PRs by moving path
 filtering to job level

The pull-requests workflow used paths-ignore at the trigger level, which
prevented the entire workflow from running on docs-only PRs. This meant
the required "E2E Tests" check was never created, blocking merge for
non-admin users.

Replace trigger-level paths-ignore with a detect-changes job using
dorny/paths-filter. The workflow now always triggers (so checks are
always reported), but build and downstream jobs are skipped when only
docs files change.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 .github/workflows/pull-requests.yaml | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/pull-requests.yaml b/.github/workflows/pull-requests.yaml
index b9b7b0ac..1f0f733a 100644
--- a/.github/workflows/pull-requests.yaml
+++ b/.github/workflows/pull-requests.yaml
@@ -6,8 +6,6 @@ env:
 on:
   pull_request:
     types: [opened, synchronize, reopened]
-    paths-ignore:
-      - 'docs/**/*'
 
 # Cancel in‑flight runs for the same PR when a new push arrives.
 concurrency:
@@ -15,6 +13,19 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  detect-changes:
+    name: Detect changes
+    runs-on: ubuntu-latest
+    outputs:
+      code: ${{ steps.filter.outputs.code }}
+    steps:
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            code:
+              - '!docs/**'
+
   build:
     name: Build
     runs-on: [self-hosted]
@@ -22,9 +33,11 @@ jobs:
       contents: read
       packages: write
 
-    # Never run when the PR carries the "release" label.
+    needs: ["detect-changes"]
+    # Never run when the PR carries the "release" label or only docs changed.
     if: |
-      !contains(github.event.pull_request.labels.*.name, 'release')
+      needs.detect-changes.outputs.code == 'true'
+      && !contains(github.event.pull_request.labels.*.name, 'release')
 
     steps:
       - name: Checkout code

From 9a4f49238ce13dc4e64577f1a783d5c7d1d809f5 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Sat, 7 Mar 2026 10:24:58 +0500
Subject: [PATCH 236/666] fix(migration): preserve VM MAC address during
 virtual-machine to vm-instance migration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Kube-OVN reads MAC address exclusively from the pod annotation
ovn.kubernetes.io/mac_address, not from the IP resource spec.macAddress.
Without pod-level annotations, migrated VMs receive a new random MAC,
breaking OS-level network config that matches by MAC (e.g. netplan).

Add a Helm lookup for the Kube-OVN IP resource in the vm-instance chart
template. When the IP resource exists, its macAddress and ipAddress are
automatically injected as pod annotations. This removes the need for
fragile Flux postRenderers on the HelmRelease — the chart itself handles
MAC/IP preservation based on actual cluster state.

Remove the postRenderers approach from migration 29 since the chart now
handles this natively.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/apps/vm-instance/templates/vm.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/packages/apps/vm-instance/templates/vm.yaml b/packages/apps/vm-instance/templates/vm.yaml
index 226e5aa7..0a7eb7c5 100644
--- a/packages/apps/vm-instance/templates/vm.yaml
+++ b/packages/apps/vm-instance/templates/vm.yaml
@@ -34,6 +34,12 @@ spec:
     metadata:
       annotations:
         kubevirt.io/allow-pod-bridge-network-live-migration: "true"
+        {{- $ovnIPName := printf "%s.%s" (include "virtual-machine.fullname" .) .Release.Namespace }}
+        {{- $ovnIP := lookup "kubeovn.io/v1" "IP" "" $ovnIPName }}
+        {{- if $ovnIP }}
+        ovn.kubernetes.io/mac_address: {{ $ovnIP.spec.macAddress | quote }}
+        ovn.kubernetes.io/ip_address: {{ $ovnIP.spec.ipAddress | quote }}
+        {{- end }}
       labels:
         {{- include "virtual-machine.labels" . | nindent 8 }}
     spec:

From 748f8145231e1eb6e999bb5eccfe6533682bdac2 Mon Sep 17 00:00:00 2001
From: Artem Bortnikov <brongineer747@gmail.com>
Date: Mon, 9 Mar 2026 06:30:47 +0000
Subject: [PATCH 237/666] chore: update cilium to 1.19.1

Signed-off-by: Artem Bortnikov <brongineer747@gmail.com>
---
 packages/system/cilium/Makefile               |   2 +-
 .../system/cilium/charts/cilium/Chart.yaml    |  11 +-
 .../system/cilium/charts/cilium/README.md     | 197 +++++--
 .../configmap/bootstrap-config.yaml           |   2 +-
 .../charts/cilium/files/nodeinit/startup.bash |   8 +
 .../charts/cilium/templates/_extensions.tpl   | 102 ++++
 .../charts/cilium/templates/_helpers.tpl      |  14 +-
 .../templates/cilium-agent/clusterrole.yaml   |   1 -
 .../templates/cilium-agent/daemonset.yaml     |  64 ++-
 .../cilium/templates/cilium-agent/role.yaml   |   2 +-
 .../templates/cilium-agent/rolebinding.yaml   |   2 +-
 .../cilium/templates/cilium-ca-secret.yaml    |   7 +-
 .../cilium/templates/cilium-configmap.yaml    | 185 +++++--
 .../templates/cilium-envoy/daemonset.yaml     |  29 +-
 .../templates/cilium-envoy/service.yaml       |   2 +-
 .../templates/cilium-ingress-service.yaml     |  13 +-
 .../templates/cilium-nodeinit/daemonset.yaml  |   2 +
 .../cilium-operator/clusterrole.yaml          |  49 +-
 .../templates/cilium-operator/deployment.yaml |  57 +-
 .../templates/cilium-operator/role.yaml       |  32 ++
 .../cilium-operator/rolebinding.yaml          |  26 +
 .../templates/cilium-operator/secret.yaml     |   2 +
 .../cilium-preflight/clusterrole.yaml         |   1 -
 .../templates/cilium-secrets-namespace.yaml   |   3 +
 .../clustermesh-apiserver/clusterrole.yaml    |   2 +-
 .../clustermesh-apiserver/deployment.yaml     |   8 +-
 .../clustermesh-apiserver/service.yaml        |   2 +-
 .../tls-cronjob/_job-spec.tpl                 |  17 +-
 .../tls-cronjob/cronjob.yaml                  |   2 +
 .../tls-cronjob/job.yaml                      |  18 +-
 .../tls-cronjob/role.yaml                     |   1 -
 .../tls-helm/admin-secret.yaml                |   8 +-
 .../tls-helm/local-secret.yaml                |   8 +-
 .../tls-helm/remote-secret.yaml               |   8 +-
 .../tls-helm/server-secret.yaml               |   8 +-
 .../users-configmap.yaml                      |   4 +-
 .../templates/clustermesh-config/_helpers.tpl |  23 +
 .../clustermesh-secret.yaml                   |   2 +-
 .../kvstoremesh-secret.yaml                   |   2 +-
 .../clusterrole.yaml                          |  29 +
 .../clusterrolebinding.yaml                   |  28 +
 .../job-clusterrole.yaml                      |  22 +
 .../job-clusterrolebinding.yaml               |  22 +
 .../clustermesh-coredns-mcsapi/job-role.yaml  |  36 ++
 .../job-rolebinding.yaml                      |  23 +
 .../job-serviceaccount.yaml                   |  20 +
 .../clustermesh-coredns-mcsapi/job.yaml       |  82 +++
 .../templates/hubble-relay/configmap.yaml     |   8 +
 .../templates/hubble-ui/clusterrole.yaml      |  16 -
 .../templates/hubble-ui/deployment.yaml       |  12 +-
 .../hubble/tls-cronjob/_job-spec.tpl          |   7 +-
 .../templates/hubble/tls-cronjob/cronjob.yaml |   2 +
 .../templates/hubble/tls-cronjob/job.yaml     |  20 +-
 .../tls-helm/metrics-server-secret.yaml       |   8 +-
 .../hubble/tls-helm/relay-client-secret.yaml  |   8 +-
 .../hubble/tls-helm/relay-server-secret.yaml  |   8 +-
 .../hubble/tls-helm/server-secret.yaml        |   8 +-
 .../hubble/tls-helm/ui-client-certs.yaml      |   8 +-
 .../standalone-dns-proxy/configmap.yaml       |  28 +
 .../standalone-dns-proxy/daemonset.yaml       |  80 +++
 .../charts/cilium/templates/validate.yaml     |  19 +
 .../cilium/charts/cilium/values.schema.json   | 509 +++++++++++++++++-
 .../system/cilium/charts/cilium/values.yaml   | 503 ++++++++++++++---
 .../cilium/charts/cilium/values.yaml.tmpl     | 461 +++++++++++++---
 .../system/cilium/images/cilium/Dockerfile    |   2 +-
 packages/system/cilium/values.yaml            |   4 +-
 66 files changed, 2482 insertions(+), 417 deletions(-)
 create mode 100644 packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/clusterrole.yaml
 create mode 100644 packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/clusterrolebinding.yaml
 create mode 100644 packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-clusterrole.yaml
 create mode 100644 packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-clusterrolebinding.yaml
 create mode 100644 packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-role.yaml
 create mode 100644 packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-rolebinding.yaml
 create mode 100644 packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-serviceaccount.yaml
 create mode 100644 packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job.yaml
 create mode 100644 packages/system/cilium/charts/cilium/templates/standalone-dns-proxy/configmap.yaml
 create mode 100644 packages/system/cilium/charts/cilium/templates/standalone-dns-proxy/daemonset.yaml

diff --git a/packages/system/cilium/Makefile b/packages/system/cilium/Makefile
index 267c75cc..07d4ca97 100644
--- a/packages/system/cilium/Makefile
+++ b/packages/system/cilium/Makefile
@@ -10,7 +10,7 @@ update:
 	rm -rf charts
 	helm repo add cilium https://helm.cilium.io/
 	helm repo update cilium
-	helm pull cilium/cilium --untar --untardir charts --version 1.18
+	helm pull cilium/cilium --untar --untardir charts --version 1.19
 	$(SED_INPLACE) -e '/Used in iptables/d' -e '/SYS_MODULE/d' charts/cilium/values.yaml
 	version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \
 	$(SED_INPLACE) "s/ARG VERSION=.*/ARG VERSION=v$${version}/" images/cilium/Dockerfile
diff --git a/packages/system/cilium/charts/cilium/Chart.yaml b/packages/system/cilium/charts/cilium/Chart.yaml
index 0de0d9c7..0bb34451 100644
--- a/packages/system/cilium/charts/cilium/Chart.yaml
+++ b/packages/system/cilium/charts/cilium/Chart.yaml
@@ -41,11 +41,8 @@ annotations:
     namespace context.\n- kind: CiliumNodeConfig\n  version: v2\n  name: ciliumnodeconfigs.cilium.io\n
     \ displayName: Cilium Node Configuration\n  description: |\n    CiliumNodeConfig
     is a list of configuration key-value pairs. It is applied to\n    nodes indicated
-    by a label selector.\n- kind: CiliumBGPPeeringPolicy\n  version: v2alpha1\n  name:
-    ciliumbgppeeringpolicies.cilium.io\n  displayName: Cilium BGP Peering Policy\n
-    \ description: |\n    Cilium BGP Peering Policy instructs Cilium to create specific
-    BGP peering\n    configurations.\n- kind: CiliumBGPClusterConfig\n  version: v2alpha1\n
-    \ name: ciliumbgpclusterconfigs.cilium.io\n  displayName: Cilium BGP Cluster Config\n
+    by a label selector.\n- kind: CiliumBGPClusterConfig\n  version: v2alpha1\n  name:
+    ciliumbgpclusterconfigs.cilium.io\n  displayName: Cilium BGP Cluster Config\n
     \ description: |\n    Cilium BGP Cluster Config instructs Cilium operator to create
     specific BGP cluster\n    configurations.\n- kind: CiliumBGPPeerConfig\n  version:
     v2alpha1\n  name: ciliumbgppeerconfigs.cilium.io\n  displayName: Cilium BGP Peer
@@ -79,7 +76,7 @@ annotations:
     Cilium Gateway Class Config\n  description: |\n    CiliumGatewayClassConfig defines
     a configuration for Gateway API GatewayClass.\n"
 apiVersion: v2
-appVersion: 1.18.6
+appVersion: 1.19.1
 description: eBPF-based Networking, Security, and Observability
 home: https://cilium.io/
 icon: https://cdn.jsdelivr.net/gh/cilium/cilium@main/Documentation/images/logo-solo.svg
@@ -95,4 +92,4 @@ kubeVersion: '>= 1.21.0-0'
 name: cilium
 sources:
 - https://github.com/cilium/cilium
-version: 1.18.6
+version: 1.19.1
diff --git a/packages/system/cilium/charts/cilium/README.md b/packages/system/cilium/charts/cilium/README.md
index 840d0126..fe8aea3f 100644
--- a/packages/system/cilium/charts/cilium/README.md
+++ b/packages/system/cilium/charts/cilium/README.md
@@ -1,6 +1,6 @@
 # cilium
 
-![Version: 1.18.6](https://img.shields.io/badge/Version-1.18.6-informational?style=flat-square) ![AppVersion: 1.18.6](https://img.shields.io/badge/AppVersion-1.18.6-informational?style=flat-square)
+![Version: 1.19.1](https://img.shields.io/badge/Version-1.19.1-informational?style=flat-square) ![AppVersion: 1.19.1](https://img.shields.io/badge/AppVersion-1.19.1-informational?style=flat-square)
 
 Cilium is open source software for providing and transparently securing
 network connectivity and loadbalancing between application workloads such as
@@ -59,10 +59,14 @@ contributors across the globe, there is almost always someone available to help.
 | agentNotReadyTaintKey | string | `"node.cilium.io/agent-not-ready"` | Configure the key of the taint indicating that Cilium is not ready on the node. When set to a value starting with `ignore-taint.cluster-autoscaler.kubernetes.io/`, the Cluster Autoscaler will ignore the taint on its decisions, allowing the cluster to scale up. |
 | aksbyocni.enabled | bool | `false` | Enable AKS BYOCNI integration. Note that this is incompatible with AKS clusters not created in BYOCNI mode: use Azure integration (`azure.enabled`) instead. |
 | alibabacloud.enabled | bool | `false` | Enable AlibabaCloud ENI integration |
+| alibabacloud.nodeSpec.securityGroupTags | list | `[]` |  |
+| alibabacloud.nodeSpec.securityGroups | list | `[]` |  |
+| alibabacloud.nodeSpec.vSwitchTags | list | `[]` |  |
+| alibabacloud.nodeSpec.vSwitches | list | `[]` |  |
 | annotateK8sNode | bool | `false` | Annotate k8s node upon initialization with Cilium's metadata. |
 | annotations | object | `{}` | Annotations to be added to all top-level cilium-agent objects (resources under templates/cilium-agent) |
 | apiRateLimit | string | `nil` | The api-rate-limit option can be used to overwrite individual settings of the default configuration for rate limiting calls to the Cilium Agent API |
-| authentication.enabled | bool | `true` | Enable authentication processing and garbage collection. Note that if disabled, policy enforcement will still block requests that require authentication. But the resulting authentication requests for these requests will not be processed, therefore the requests not be allowed. |
+| authentication.enabled | bool | `false` | Enable authentication processing and garbage collection. Note that if disabled, policy enforcement will still block requests that require authentication. But the resulting authentication requests for these requests will not be processed, therefore the requests not be allowed. |
 | authentication.gcInterval | string | `"5m0s"` | Interval for garbage collection of auth map entries. |
 | authentication.mutual.connectTimeout | string | `"5s"` | Timeout for connecting to the remote node TCP socket |
 | authentication.mutual.port | int | `4250` | Port on the agent where mutual authentication handshakes between agents will be performed |
@@ -73,7 +77,7 @@ contributors across the globe, there is almost always someone available to help.
 | authentication.mutual.spire.enabled | bool | `false` | Enable SPIRE integration (beta) |
 | authentication.mutual.spire.install.agent.affinity | object | `{}` | SPIRE agent affinity configuration |
 | authentication.mutual.spire.install.agent.annotations | object | `{}` | SPIRE agent annotations |
-| authentication.mutual.spire.install.agent.image | object | `{"digest":"sha256:163970884fba18860cac93655dc32b6af85a5dcf2ebb7e3e119a10888eff8fcd","override":null,"pullPolicy":"IfNotPresent","repository":"ghcr.io/spiffe/spire-agent","tag":"1.12.4","useDigest":true}` | SPIRE agent image |
+| authentication.mutual.spire.install.agent.image | object | `{"digest":"sha256:5106ac601272a88684db14daf7f54b9a45f31f77bb16a906bd5e87756ee7b97c","override":null,"pullPolicy":"IfNotPresent","repository":"ghcr.io/spiffe/spire-agent","tag":"1.9.6","useDigest":true}` | SPIRE agent image |
 | authentication.mutual.spire.install.agent.labels | object | `{}` | SPIRE agent labels |
 | authentication.mutual.spire.install.agent.nodeSelector | object | `{}` | SPIRE agent nodeSelector configuration ref: ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | authentication.mutual.spire.install.agent.podSecurityContext | object | `{}` | Security context to be added to spire agent pods. SecurityContext holds pod-level security attributes and common container settings. ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod |
@@ -85,7 +89,7 @@ contributors across the globe, there is almost always someone available to help.
 | authentication.mutual.spire.install.agent.tolerations | list | `[{"effect":"NoSchedule","key":"node.kubernetes.io/not-ready"},{"effect":"NoSchedule","key":"node-role.kubernetes.io/master"},{"effect":"NoSchedule","key":"node-role.kubernetes.io/control-plane"},{"effect":"NoSchedule","key":"node.cloudprovider.kubernetes.io/uninitialized","value":"true"},{"key":"CriticalAddonsOnly","operator":"Exists"}]` | SPIRE agent tolerations configuration By default it follows the same tolerations as the agent itself to allow the Cilium agent on this node to connect to SPIRE. ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
 | authentication.mutual.spire.install.enabled | bool | `true` | Enable SPIRE installation. This will only take effect only if authentication.mutual.spire.enabled is true |
 | authentication.mutual.spire.install.existingNamespace | bool | `false` | SPIRE namespace already exists. Set to true if Helm should not create, manage, and import the SPIRE namespace. |
-| authentication.mutual.spire.install.initImage | object | `{"digest":"sha256:2383baad1860bbe9d8a7a843775048fd07d8afe292b94bd876df64a69aae7cb1","override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/library/busybox","tag":"1.37.0","useDigest":true}` | init container image of SPIRE agent and server |
+| authentication.mutual.spire.install.initImage | object | `{"digest":"sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f","override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/library/busybox","tag":"1.37.0","useDigest":true}` | init container image of SPIRE agent and server |
 | authentication.mutual.spire.install.namespace | string | `"cilium-spire"` | SPIRE namespace to install into |
 | authentication.mutual.spire.install.server.affinity | object | `{}` | SPIRE server affinity configuration |
 | authentication.mutual.spire.install.server.annotations | object | `{}` | SPIRE server annotations |
@@ -95,7 +99,7 @@ contributors across the globe, there is almost always someone available to help.
 | authentication.mutual.spire.install.server.dataStorage.enabled | bool | `true` | Enable SPIRE server data storage |
 | authentication.mutual.spire.install.server.dataStorage.size | string | `"1Gi"` | Size of the SPIRE server data storage |
 | authentication.mutual.spire.install.server.dataStorage.storageClass | string | `nil` | StorageClass of the SPIRE server data storage |
-| authentication.mutual.spire.install.server.image | object | `{"digest":"sha256:34147f27066ab2be5cc10ca1d4bfd361144196467155d46c45f3519f41596e49","override":null,"pullPolicy":"IfNotPresent","repository":"ghcr.io/spiffe/spire-server","tag":"1.12.4","useDigest":true}` | SPIRE server image |
+| authentication.mutual.spire.install.server.image | object | `{"digest":"sha256:59a0b92b39773515e25e68a46c40d3b931b9c1860bc445a79ceb45a805cab8b4","override":null,"pullPolicy":"IfNotPresent","repository":"ghcr.io/spiffe/spire-server","tag":"1.9.6","useDigest":true}` | SPIRE server image |
 | authentication.mutual.spire.install.server.initContainers | list | `[]` | SPIRE server init containers |
 | authentication.mutual.spire.install.server.labels | object | `{}` | SPIRE server labels |
 | authentication.mutual.spire.install.server.nodeSelector | object | `{}` | SPIRE server nodeSelector configuration ref: ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
@@ -114,13 +118,14 @@ contributors across the globe, there is almost always someone available to help.
 | authentication.rotatedIdentitiesQueueSize | int | `1024` | Buffer size of the channel Cilium uses to receive certificate expiration events from auth handlers. |
 | autoDirectNodeRoutes | bool | `false` | Enable installation of PodCIDR routes between worker nodes if worker nodes share a common L2 network segment. |
 | azure.enabled | bool | `false` | Enable Azure integration. Note that this is incompatible with AKS clusters created in BYOCNI mode: use AKS BYOCNI integration (`aksbyocni.enabled`) instead. |
+| azure.nodeSpec.azureInterfaceName | string | `""` |  |
 | bandwidthManager | object | `{"bbr":false,"bbrHostNamespaceOnly":false,"enabled":false}` | Enable bandwidth manager to optimize TCP and UDP workloads and allow for rate-limiting traffic from individual Pods with EDT (Earliest Departure Time) through the "kubernetes.io/egress-bandwidth" Pod annotation. |
 | bandwidthManager.bbr | bool | `false` | Activate BBR TCP congestion control for Pods |
 | bandwidthManager.bbrHostNamespaceOnly | bool | `false` | Activate BBR TCP congestion control for Pods in the host namespace only. |
 | bandwidthManager.enabled | bool | `false` | Enable bandwidth manager infrastructure (also prerequirement for BBR) |
-| bgpControlPlane | object | `{"enabled":false,"legacyOriginAttribute":{"enabled":false},"routerIDAllocation":{"ipPool":"","mode":"default"},"secretsNamespace":{"create":false,"name":"kube-system"},"statusReport":{"enabled":true}}` | This feature set enables virtual BGP routers to be created via CiliumBGPPeeringPolicy CRDs. |
+| bgpControlPlane | object | `{"enabled":false,"legacyOriginAttribute":{"enabled":false},"routerIDAllocation":{"ipPool":"","mode":"default"},"secretsNamespace":{"create":false,"name":"kube-system"},"statusReport":{"enabled":true}}` | This feature set enables virtual BGP routers to be created via BGP CRDs. |
 | bgpControlPlane.enabled | bool | `false` | Enables the BGP control plane. |
-| bgpControlPlane.legacyOriginAttribute | object | `{"enabled":false}` | Legacy BGP ORIGIN attribute settings (BGPv2 only) |
+| bgpControlPlane.legacyOriginAttribute | object | `{"enabled":false}` | Legacy BGP ORIGIN attribute settings |
 | bgpControlPlane.legacyOriginAttribute.enabled | bool | `false` | Enable/Disable advertising LoadBalancerIP routes with the legacy BGP ORIGIN attribute value INCOMPLETE (2) instead of the default IGP (0). Enable for compatibility with the legacy behavior of MetalLB integration. |
 | bgpControlPlane.routerIDAllocation | object | `{"ipPool":"","mode":"default"}` | BGP router-id allocation mode |
 | bgpControlPlane.routerIDAllocation.ipPool | string | `""` | IP pool to allocate the BGP router-id from when the mode is ip-pool. |
@@ -128,20 +133,20 @@ contributors across the globe, there is almost always someone available to help.
 | bgpControlPlane.secretsNamespace | object | `{"create":false,"name":"kube-system"}` | SecretsNamespace is the namespace which BGP support will retrieve secrets from. |
 | bgpControlPlane.secretsNamespace.create | bool | `false` | Create secrets namespace for BGP secrets. |
 | bgpControlPlane.secretsNamespace.name | string | `"kube-system"` | The name of the secret namespace to which Cilium agents are given read access |
-| bgpControlPlane.statusReport | object | `{"enabled":true}` | Status reporting settings (BGPv2 only) |
-| bgpControlPlane.statusReport.enabled | bool | `true` | Enable/Disable BGPv2 status reporting It is recommended to enable status reporting in general, but if you have any issue such as high API server load, you can disable it by setting this to false. |
+| bgpControlPlane.statusReport | object | `{"enabled":true}` | Status reporting settings |
+| bgpControlPlane.statusReport.enabled | bool | `true` | Enable/Disable BGP status reporting It is recommended to enable status reporting in general, but if you have any issue such as high API server load, you can disable it by setting this to false. |
 | bpf.authMapMax | int | `524288` | Configure the maximum number of entries in auth map. |
 | bpf.autoMount.enabled | bool | `true` | Enable automatic mount of BPF filesystem When `autoMount` is enabled, the BPF filesystem is mounted at `bpf.root` path on the underlying host and inside the cilium agent pod. If users disable `autoMount`, it's expected that users have mounted bpffs filesystem at the specified `bpf.root` volume, and then the volume will be mounted inside the cilium agent pod at the same path. |
 | bpf.ctAccounting | bool | `false` | Enable CT accounting for packets and bytes |
 | bpf.ctAnyMax | int | `262144` | Configure the maximum number of entries for the non-TCP connection tracking table. |
 | bpf.ctTcpMax | int | `524288` | Configure the maximum number of entries in the TCP connection tracking table. |
-| bpf.datapathMode | string | `veth` | Mode for Pod devices for the core datapath (veth, netkit, netkit-l2) |
+| bpf.datapathMode | string | `veth` | Mode for Pod devices for the core datapath (veth, netkit, netkit-l2). Note netkit is incompatible with TPROXY (`bpf.tproxy`). |
 | bpf.disableExternalIPMitigation | bool | `false` | Disable ExternalIP mitigation (CVE-2020-8554) |
 | bpf.distributedLRU | object | `{"enabled":false}` | Control to use a distributed per-CPU backend memory for the core BPF LRU maps which Cilium uses. This improves performance significantly, but it is also recommended to increase BPF map sizing along with that. |
 | bpf.distributedLRU.enabled | bool | `false` | Enable distributed LRU backend memory. For compatibility with existing installations it is off by default. |
 | bpf.enableTCX | bool | `true` | Attach endpoint programs using tcx instead of legacy tc hooks on supported kernels. |
 | bpf.events | object | `{"default":{"burstLimit":null,"rateLimit":null},"drop":{"enabled":true},"policyVerdict":{"enabled":true},"trace":{"enabled":true}}` | Control events generated by the Cilium datapath exposed to Cilium monitor and Hubble. Helm configuration for BPF events map rate limiting is experimental and might change in upcoming releases. |
-| bpf.events.default | object | `{"burstLimit":null,"rateLimit":null}` | Default settings for all types of events except dbg and pcap. |
+| bpf.events.default | object | `{"burstLimit":null,"rateLimit":null}` | Default settings for all types of events except dbg. |
 | bpf.events.default.burstLimit | int | `0` | Configure the maximum number of messages that can be written to BPF events map in 1 second. If burstLimit is greater than 0, non-zero value for rateLimit must also be provided lest the configuration is considered invalid. Setting both burstLimit and rateLimit to 0 disables BPF events rate limiting. |
 | bpf.events.default.rateLimit | int | `0` | Configure the limit of messages per second that can be written to BPF events map. The number of messages is averaged, meaning that if no messages were written to the map over 5 seconds, it's possible to write more events in the 6th second. If rateLimit is greater than 0, non-zero value for burstLimit must also be provided lest the configuration is considered invalid. Setting both burstLimit and rateLimit to 0 disables BPF events rate limiting. |
 | bpf.events.drop.enabled | bool | `true` | Enable drop events. |
@@ -158,19 +163,23 @@ contributors across the globe, there is almost always someone available to help.
 | bpf.monitorAggregation | string | `"medium"` | Configure the level of aggregation for monitor notifications. Valid options are none, low, medium, maximum. |
 | bpf.monitorFlags | string | `"all"` | Configure which TCP flags trigger notifications when seen for the first time in a connection. |
 | bpf.monitorInterval | string | `"5s"` | Configure the typical time between monitor notifications for active connections. |
+| bpf.monitorTraceIPOption | int | `0` | Configure the IP tracing option type. This option is used to specify the IP option type to use for tracing. The value must be an integer between 0 and 255. @schema type: [null, integer] minimum: 0 maximum: 255 @schema |
 | bpf.natMax | int | `524288` | Configure the maximum number of entries for the NAT table. |
 | bpf.neighMax | int | `524288` | Configure the maximum number of entries for the neighbor table. |
 | bpf.nodeMapMax | int | `nil` | Configures the maximum number of entries for the node table. |
 | bpf.policyMapMax | int | `16384` | Configure the maximum number of entries in endpoint policy map (per endpoint). @schema type: [null, integer] @schema |
+| bpf.policyMapPressureMetricsThreshold | float64 | `0.1` | Configure threshold for emitting pressure metrics of policy maps. @schema type: [null, number] @schema |
 | bpf.policyStatsMapMax | int | `65536` | Configure the maximum number of entries in global policy stats map. @schema type: [null, integer] @schema |
 | bpf.preallocateMaps | bool | `false` | Enables pre-allocation of eBPF map values. This increases memory usage but can reduce latency. |
 | bpf.root | string | `"/sys/fs/bpf"` | Configure the mount point for the BPF filesystem |
-| bpf.tproxy | bool | `false` | Configure the eBPF-based TPROXY (beta) to reduce reliance on iptables rules for implementing Layer 7 policy. |
+| bpf.tproxy | bool | `false` | Configure the eBPF-based TPROXY (beta) to reduce reliance on iptables rules for implementing Layer 7 policy. Note this is incompatible with netkit (`bpf.datapathMode=netkit`, `bpf.datapathMode=netkit-l2`). |
 | bpf.vlanBypass | list | `[]` | Configure explicitly allowed VLAN id's for bpf logic bypass. [0] will allow all VLAN id's without any filtering. |
 | bpfClockProbe | bool | `false` | Enable BPF clock source probing for more efficient tick retrieval. |
-| certgen | object | `{"affinity":{},"annotations":{"cronJob":{},"job":{}},"extraVolumeMounts":[],"extraVolumes":[],"generateCA":true,"image":{"digest":"sha256:2825dbfa6f89cbed882fd1d81e46a56c087e35885825139923aa29eb8aec47a9","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/certgen","tag":"v0.3.1","useDigest":true},"nodeSelector":{},"podLabels":{},"priorityClassName":"","resources":{},"tolerations":[],"ttlSecondsAfterFinished":1800}` | Configure certificate generation for Hubble integration. If hubble.tls.auto.method=cronJob, these values are used for the Kubernetes CronJob which will be scheduled regularly to (re)generate any certificates not provided manually. |
+| certgen | object | `{"affinity":{},"annotations":{"cronJob":{},"job":{}},"cronJob":{"failedJobsHistoryLimit":1,"successfulJobsHistoryLimit":3},"extraVolumeMounts":[],"extraVolumes":[],"generateCA":true,"image":{"digest":"sha256:19921f48ee7e2295ea4dca955878a6cd8d70e6d4219d08f688e866ece9d95d4d","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/certgen","tag":"v0.3.2","useDigest":true},"nodeSelector":{},"podLabels":{},"priorityClassName":"","resources":{},"tolerations":[],"ttlSecondsAfterFinished":null}` | Configure certificate generation for Hubble integration. If hubble.tls.auto.method=cronJob, these values are used for the Kubernetes CronJob which will be scheduled regularly to (re)generate any certificates not provided manually. |
 | certgen.affinity | object | `{}` | Affinity for certgen |
 | certgen.annotations | object | `{"cronJob":{},"job":{}}` | Annotations to be added to the hubble-certgen initial Job and CronJob |
+| certgen.cronJob.failedJobsHistoryLimit | int | `1` | The number of failed finished jobs to keep |
+| certgen.cronJob.successfulJobsHistoryLimit | int | `3` | The number of successful finished jobs to keep |
 | certgen.extraVolumeMounts | list | `[]` | Additional certgen volumeMounts. |
 | certgen.extraVolumes | list | `[]` | Additional certgen volumes. |
 | certgen.generateCA | bool | `true` | When set to true the certificate authority secret is created. |
@@ -179,7 +188,7 @@ contributors across the globe, there is almost always someone available to help.
 | certgen.priorityClassName | string | `""` | Priority class for certgen ref: https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass |
 | certgen.resources | object | `{}` | Resource limits for certgen ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers |
 | certgen.tolerations | list | `[]` | Node tolerations for pod assignment on nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
-| certgen.ttlSecondsAfterFinished | int | `1800` | Seconds after which the completed job pod will be deleted |
+| certgen.ttlSecondsAfterFinished | string | `nil` | Seconds after which the completed job pod will be deleted |
 | cgroup | object | `{"autoMount":{"enabled":true,"resources":{}},"hostRoot":"/run/cilium/cgroupv2"}` | Configure cgroup related configuration |
 | cgroup.autoMount.enabled | bool | `true` | Enable auto mount of cgroup2 filesystem. When `autoMount` is enabled, cgroup2 filesystem is mounted at `cgroup.hostRoot` path on the underlying host and inside the cilium agent pod. If users disable `autoMount`, it's expected that users have mounted cgroup2 filesystem at the specified `cgroup.hostRoot` volume, and then the volume will be mounted inside the cilium agent pod at the same path. |
 | cgroup.autoMount.resources | object | `{}` | Init Container Cgroup Automount resource limits & requests |
@@ -205,7 +214,7 @@ contributors across the globe, there is almost always someone available to help.
 | clustermesh.apiserver.extraVolumeMounts | list | `[]` | Additional clustermesh-apiserver volumeMounts. |
 | clustermesh.apiserver.extraVolumes | list | `[]` | Additional clustermesh-apiserver volumes. |
 | clustermesh.apiserver.healthPort | int | `9880` | TCP port for the clustermesh-apiserver health API. |
-| clustermesh.apiserver.image | object | `{"digest":"sha256:8ee142912a0e261850c0802d9256ddbe3729e1cd35c6bea2d93077f334c3cf3b","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.18.6","useDigest":true}` | Clustermesh API server image. |
+| clustermesh.apiserver.image | object | `{"digest":"sha256:56d6c3dc13b50126b80ecb571707a0ea97f6db694182b9d61efd386d04e5bb28","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.19.1","useDigest":true}` | Clustermesh API server image. |
 | clustermesh.apiserver.kvstoremesh.enabled | bool | `true` | Enable KVStoreMesh. KVStoreMesh caches the information retrieved from the remote clusters in the local etcd instance (deprecated - KVStoreMesh will always be enabled once the option is removed). |
 | clustermesh.apiserver.kvstoremesh.extraArgs | list | `[]` | Additional KVStoreMesh arguments. |
 | clustermesh.apiserver.kvstoremesh.extraEnv | list | `[]` | Additional KVStoreMesh environment variables. |
@@ -255,38 +264,65 @@ contributors across the globe, there is almost always someone available to help.
 | clustermesh.apiserver.service.annotations | object | `{}` | Annotations for the clustermesh-apiserver service. Example annotations to configure an internal load balancer on different cloud providers: * AKS: service.beta.kubernetes.io/azure-load-balancer-internal: "true" * EKS: service.beta.kubernetes.io/aws-load-balancer-scheme: "internal" * GKE: networking.gke.io/load-balancer-type: "Internal" |
 | clustermesh.apiserver.service.enableSessionAffinity | string | `"HAOnly"` | Defines when to enable session affinity. Each replica in a clustermesh-apiserver deployment runs its own discrete etcd cluster. Remote clients connect to one of the replicas through a shared Kubernetes Service. A client reconnecting to a different backend will require a full resync to ensure data integrity. Session affinity can reduce the likelihood of this happening, but may not be supported by all cloud providers. Possible values:  - "HAOnly" (default) Only enable session affinity for deployments with more than 1 replica.  - "Always" Always enable session affinity.  - "Never" Never enable session affinity. Useful in environments where            session affinity is not supported, but may lead to slightly            degraded performance due to more frequent reconnections. |
 | clustermesh.apiserver.service.externalTrafficPolicy | string | `"Cluster"` | The externalTrafficPolicy of service used for apiserver access. |
+| clustermesh.apiserver.service.externallyCreated | bool | `false` | Set externallyCreated to true to create the clustermesh-apiserver service outside this helm chart. For example after external load balancer controllers are created. |
 | clustermesh.apiserver.service.internalTrafficPolicy | string | `"Cluster"` | The internalTrafficPolicy of service used for apiserver access. |
 | clustermesh.apiserver.service.labels | object | `{}` | Labels for the clustermesh-apiserver service. |
 | clustermesh.apiserver.service.loadBalancerClass | string | `nil` | Configure a loadBalancerClass. Allows to configure the loadBalancerClass on the clustermesh-apiserver LB service in case the Service type is set to LoadBalancer (requires Kubernetes 1.24+). |
 | clustermesh.apiserver.service.loadBalancerIP | string | `nil` | Configure a specific loadBalancerIP. Allows to configure a specific loadBalancerIP on the clustermesh-apiserver LB service in case the Service type is set to LoadBalancer. |
 | clustermesh.apiserver.service.loadBalancerSourceRanges | list | `[]` | Configure loadBalancerSourceRanges. Allows to configure the source IP ranges allowed to access the clustermesh-apiserver LB service in case the Service type is set to LoadBalancer. |
-| clustermesh.apiserver.service.nodePort | int | `32379` | Optional port to use as the node port for apiserver access.  WARNING: make sure to configure a different NodePort in each cluster if kube-proxy replacement is enabled, as Cilium is currently affected by a known bug (#24692) when NodePorts are handled by the KPR implementation. If a service with the same NodePort exists both in the local and the remote cluster, all traffic originating from inside the cluster and targeting the corresponding NodePort will be redirected to a local backend, regardless of whether the destination node belongs to the local or the remote cluster. |
+| clustermesh.apiserver.service.nodePort | int | `32379` | Optional port to use as the node port for apiserver access. |
 | clustermesh.apiserver.service.type | string | `"NodePort"` | The type of service used for apiserver access. |
 | clustermesh.apiserver.terminationGracePeriodSeconds | int | `30` | terminationGracePeriodSeconds for the clustermesh-apiserver deployment |
 | clustermesh.apiserver.tls.admin | object | `{"cert":"","key":""}` | base64 encoded PEM values for the clustermesh-apiserver admin certificate and private key. Used if 'auto' is not enabled. |
-| clustermesh.apiserver.tls.authMode | string | `"legacy"` | Configure the clustermesh authentication mode. Supported values: - legacy:     All clusters access remote clustermesh instances with the same               username (i.e., remote). The "remote" certificate must be               generated with CN=remote if provided manually. - migration:  Intermediate mode required to upgrade from legacy to cluster               (and vice versa) with no disruption. Specifically, it enables               the creation of the per-cluster usernames, while still using               the common one for authentication. The "remote" certificate must               be generated with CN=remote if provided manually (same as legacy). - cluster:    Each cluster accesses remote etcd instances with a username               depending on the local cluster name (i.e., remote-<cluster-name>).               The "remote" certificate must be generated with CN=remote-<cluster-name>               if provided manually. Cluster mode is meaningful only when the same               CA is shared across all clusters part of the mesh. |
+| clustermesh.apiserver.tls.admin.cert | string | `""` | Deprecated, as secrets will always need to be created externally if `auto` is disabled. |
+| clustermesh.apiserver.tls.admin.key | string | `""` | Deprecated, as secrets will always need to be created externally if `auto` is disabled. |
+| clustermesh.apiserver.tls.authMode | string | `"migration"` | Configure the clustermesh authentication mode. Supported values: - legacy:     All clusters access remote clustermesh instances with the same               username (i.e., remote). The "remote" certificate must be               generated with CN=remote if provided manually. - migration:  Intermediate mode required to upgrade from legacy to cluster               (and vice versa) with no disruption. Specifically, it enables               the creation of the per-cluster usernames, while still using               the common one for authentication. The "remote" certificate must               be generated with CN=remote if provided manually (same as legacy). - cluster:    Each cluster accesses remote etcd instances with a username               depending on the local cluster name (i.e., remote-<cluster-name>).               The "remote" certificate must be generated with CN=remote-<cluster-name>               if provided manually. Cluster mode is meaningful only when the same               CA is shared across all clusters part of the mesh. |
 | clustermesh.apiserver.tls.auto | object | `{"certManagerIssuerRef":{},"certValidityDuration":1095,"enabled":true,"method":"helm"}` | Configure automatic TLS certificates generation. A Kubernetes CronJob is used the generate any certificates not provided by the user at installation time. |
 | clustermesh.apiserver.tls.auto.certManagerIssuerRef | object | `{}` | certmanager issuer used when clustermesh.apiserver.tls.auto.method=certmanager. |
 | clustermesh.apiserver.tls.auto.certValidityDuration | int | `1095` | Generated certificates validity duration in days. |
-| clustermesh.apiserver.tls.auto.enabled | bool | `true` | When set to true, automatically generate a CA and certificates to enable mTLS between clustermesh-apiserver and external workload instances. If set to false, the certs to be provided by setting appropriate values below. |
-| clustermesh.apiserver.tls.client | object | `{"cert":"","key":""}` | base64 encoded PEM values for the clustermesh-apiserver client certificate and private key. Used if 'auto' is not enabled. |
-| clustermesh.apiserver.tls.enableSecrets | bool | `true` | Allow users to provide their own certificates Users may need to provide their certificates using a mechanism that requires they provide their own secrets. This setting does not apply to any of the auto-generated mechanisms below, it only restricts the creation of secrets via the `tls-provided` templates. |
+| clustermesh.apiserver.tls.auto.enabled | bool | `true` | When set to true, automatically generate a CA and certificates to enable mTLS between clustermesh-apiserver and external workload instances.  When set to false you need to pre-create the following secrets: - clustermesh-apiserver-server-cert - clustermesh-apiserver-admin-cert - clustermesh-apiserver-remote-cert - clustermesh-apiserver-local-cert The above secret should at least contains the keys `tls.crt` and `tls.key` and optionally `ca.crt` if a CA bundle is not configured. |
+| clustermesh.apiserver.tls.enableSecrets | deprecated | `true` | Allow users to provide their own certificates Users may need to provide their certificates using a mechanism that requires they provide their own secrets. This setting does not apply to any of the auto-generated mechanisms below, it only restricts the creation of secrets via the `tls-provided` templates. This option is deprecated as secrets are expected to be created externally when 'auto' is not enabled. |
 | clustermesh.apiserver.tls.remote | object | `{"cert":"","key":""}` | base64 encoded PEM values for the clustermesh-apiserver remote cluster certificate and private key. Used if 'auto' is not enabled. |
+| clustermesh.apiserver.tls.remote.cert | string | `""` | Deprecated, as secrets will always need to be created externally if `auto` is disabled. |
+| clustermesh.apiserver.tls.remote.key | string | `""` | Deprecated, as secrets will always need to be created externally if `auto` is disabled. |
 | clustermesh.apiserver.tls.server | object | `{"cert":"","extraDnsNames":[],"extraIpAddresses":[],"key":""}` | base64 encoded PEM values for the clustermesh-apiserver server certificate and private key. Used if 'auto' is not enabled. |
+| clustermesh.apiserver.tls.server.cert | string | `""` | Deprecated, as secrets will always need to be created externally if `auto` is disabled. |
 | clustermesh.apiserver.tls.server.extraDnsNames | list | `[]` | Extra DNS names added to certificate when it's auto generated |
 | clustermesh.apiserver.tls.server.extraIpAddresses | list | `[]` | Extra IP addresses added to certificate when it's auto generated |
+| clustermesh.apiserver.tls.server.key | string | `""` | Deprecated, as secrets will always need to be created externally if `auto` is disabled. |
 | clustermesh.apiserver.tolerations | list | `[]` | Node tolerations for pod assignment on nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
 | clustermesh.apiserver.topologySpreadConstraints | list | `[]` | Pod topology spread constraints for clustermesh-apiserver |
 | clustermesh.apiserver.updateStrategy | object | `{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0},"type":"RollingUpdate"}` | clustermesh-apiserver update strategy |
+| clustermesh.cacheTTL | string | `"0s"` | The time to live for the cache of a remote cluster after connectivity is lost. If the connection is not re-established within this duration, the cached data is revoked to prevent stale state. If not specified or set to 0s, the cache is never revoked (default). |
 | clustermesh.config | object | `{"clusters":[],"domain":"mesh.cilium.io","enabled":false}` | Clustermesh explicit configuration. |
-| clustermesh.config.clusters | list | `[]` | List of clusters to be peered in the mesh. |
+| clustermesh.config.clusters | list | `[]` | Clusters to be peered in the mesh. @schema type: [object, array] @schema |
 | clustermesh.config.domain | string | `"mesh.cilium.io"` | Default dns domain for the Clustermesh API servers This is used in the case cluster addresses are not provided and IPs are used. |
-| clustermesh.config.enabled | bool | `false` | Enable the Clustermesh explicit configuration. |
+| clustermesh.config.enabled | bool | `false` | Enable the Clustermesh explicit configuration. If set to false, you need to provide the following resources yourself: - (Secret) cilium-clustermesh (used by cilium-agent/cilium-operator to connect to   the local etcd instance if KVStoreMesh is enabled or the remote clusters   if KVStoreMesh is disabled) - (Secret) cilium-kvstoremesh (used by KVStoreMesh to connect to the remote clusters) - (ConfigMap) clustermesh-remote-users (used to create one etcd user per remote cluster   if clustermesh-apiserver is used and `clustermesh.apiserver.tls.authMode` is not   set to `legacy`) |
 | clustermesh.enableEndpointSliceSynchronization | bool | `false` | Enable the synchronization of Kubernetes EndpointSlices corresponding to the remote endpoints of appropriately-annotated global services through ClusterMesh |
-| clustermesh.enableMCSAPISupport | bool | `false` | Enable Multi-Cluster Services API support |
+| clustermesh.enableMCSAPISupport | bool | `false` | Enable Multi-Cluster Services API support (deprecated; use clustermesh.mcsapi.enabled) |
 | clustermesh.maxConnectedClusters | int | `255` | The maximum number of clusters to support in a ClusterMesh. This value cannot be changed on running clusters, and all clusters in a ClusterMesh must be configured with the same value. Values > 255 will decrease the maximum allocatable cluster-local identities. Supported values are 255 and 511. |
-| clustermesh.policyDefaultLocalCluster | bool | `false` | Control whether policy rules assume by default the local cluster if not explicitly selected |
-| clustermesh.useAPIServer | bool | `false` | Deploy clustermesh-apiserver for clustermesh |
+| clustermesh.mcsapi.corednsAutoConfigure.affinity | object | `{}` | Affinity for coredns-mcsapi-autoconfig |
+| clustermesh.mcsapi.corednsAutoConfigure.annotations | object | `{}` | Annotations to be added to the coredns-mcsapi-autoconfig Job |
+| clustermesh.mcsapi.corednsAutoConfigure.coredns.clusterDomain | string | `"cluster.local"` | The cluster domain for the cluster CoreDNS service |
+| clustermesh.mcsapi.corednsAutoConfigure.coredns.clustersetDomain | string | `"clusterset.local"` | The clusterset domain for the cluster CoreDNS service |
+| clustermesh.mcsapi.corednsAutoConfigure.coredns.configMapName | string | `"coredns"` | The ConfigMap name for the cluster CoreDNS service |
+| clustermesh.mcsapi.corednsAutoConfigure.coredns.deploymentName | string | `"coredns"` | The Deployment for the cluster CoreDNS service |
+| clustermesh.mcsapi.corednsAutoConfigure.coredns.namespace | string | `"kube-system"` | The namespace for the cluster CoreDNS service |
+| clustermesh.mcsapi.corednsAutoConfigure.coredns.serviceAccountName | string | `"coredns"` | The Service Account name for the cluster CoreDNS service |
+| clustermesh.mcsapi.corednsAutoConfigure.enabled | bool | `false` | Enable auto-configuration of CoreDNS for Multi-Cluster Services API.    CoreDNS MUST be at least in version v1.12.2 to run this. |
+| clustermesh.mcsapi.corednsAutoConfigure.extraArgs | list | `[]` | Additional arguments to `clustermesh-apiserver coredns-mcsapi-auto-configure`. |
+| clustermesh.mcsapi.corednsAutoConfigure.extraVolumeMounts | list | `[]` | Additional coredns-mcsapi-autoconfig volumeMounts. |
+| clustermesh.mcsapi.corednsAutoConfigure.extraVolumes | list | `[]` | Additional coredns-mcsapi-autoconfig volumes. |
+| clustermesh.mcsapi.corednsAutoConfigure.nodeSelector | object | `{}` | Node selector for coredns-mcsapi-autoconfig ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
+| clustermesh.mcsapi.corednsAutoConfigure.podLabels | object | `{}` | Labels to be added to coredns-mcsapi-autoconfig pods |
+| clustermesh.mcsapi.corednsAutoConfigure.priorityClassName | string | `""` | Priority class for coredns-mcsapi-autoconfig ref: https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass |
+| clustermesh.mcsapi.corednsAutoConfigure.resources | object | `{}` | Resource limits for coredns-mcsapi-autoconfig ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers |
+| clustermesh.mcsapi.corednsAutoConfigure.tolerations | list | `[]` | Node tolerations for pod assignment on nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
+| clustermesh.mcsapi.corednsAutoConfigure.ttlSecondsAfterFinished | int | `1800` | Seconds after which the completed job pod will be deleted |
+| clustermesh.mcsapi.enabled | bool | `false` | Enable Multi-Cluster Services API support |
+| clustermesh.mcsapi.installCRDs | bool | `true` | Enabled MCS-API CRDs auto-installation |
+| clustermesh.policyDefaultLocalCluster | bool | `true` | Control whether policy rules assume by default the local cluster if not explicitly selected |
+| clustermesh.useAPIServer | bool | `false` | Deploy clustermesh-apiserver for clustermesh. This option is typically used with ``clustermesh.config.enabled=true``. Refer to the ``clustermesh.config.enabled=true``documentation for more information. |
 | cni.binPath | string | `"/opt/cni/bin"` | Configure the path to the CNI binary directory on the host. |
 | cni.chainingMode | string | `nil` | Configure chaining on top of other CNI plugins. Possible values:  - none  - aws-cni  - flannel  - generic-veth  - portmap |
 | cni.chainingTarget | string | `nil` | A CNI network name in to which the Cilium plugin should be added as a chained plugin. This will cause the agent to watch for a CNI network with this network name. When it is found, this will be used as the basis for Cilium's CNI configuration file. If this is set, it assumes a chaining mode of generic-veth. As a special case, a chaining mode of aws-cni implies a chainingTarget of aws-cni. |
@@ -301,15 +337,13 @@ contributors across the globe, there is almost always someone available to help.
 | cni.install | bool | `true` | Install the CNI configuration and binary files into the filesystem. |
 | cni.iptablesRemoveAWSRules | bool | `true` | Enable the removal of iptables rules created by the AWS CNI VPC plugin. |
 | cni.logFile | string | `"/var/run/cilium/cilium-cni.log"` | Configure the log file for CNI logging with retention policy of 7 days. Disable CNI file logging by setting this field to empty explicitly. |
-| cni.resources | object | `{"requests":{"cpu":"100m","memory":"10Mi"}}` | Specifies the resources for the cni initContainer |
+| cni.resources | object | `{"limits":{"cpu":1,"memory":"1Gi"},"requests":{"cpu":"100m","memory":"10Mi"}}` | Specifies the resources for the cni initContainer |
 | cni.uninstall | bool | `false` | Remove the CNI configuration and binary files on agent shutdown. Enable this if you're removing Cilium from the cluster. Disable this to prevent the CNI configuration file from being removed during agent upgrade, which can cause nodes to go unmanageable. |
 | commonLabels | object | `{}` | commonLabels allows users to add common labels for all Cilium resources. |
 | connectivityProbeFrequencyRatio | float64 | `0.5` | Ratio of the connectivity probe frequency vs resource usage, a float in [0, 1]. 0 will give more frequent probing, 1 will give less frequent probing. Probing frequency is dynamically adjusted based on the cluster size. |
 | conntrackGCInterval | string | `"0s"` | Configure how frequently garbage collection should occur for the datapath connection tracking table. |
 | conntrackGCMaxInterval | string | `""` | Configure the maximum frequency for the garbage collection of the connection tracking table. Only affects the automatic computation for the frequency and has no effect when 'conntrackGCInterval' is set. This can be set to more frequently clean up unused identities created from ToFQDN policies. |
 | crdWaitTimeout | string | `"5m"` | Configure timeout in which Cilium will exit if CRDs are not available |
-| customCalls | object | `{"enabled":false}` | Tail call hooks for custom eBPF programs. |
-| customCalls.enabled | bool | `false` | Enable tail call hooks for custom eBPF programs. |
 | daemon.allowedConfigOverrides | string | `nil` | allowedConfigOverrides is a list of config-map keys that can be overridden. That is to say, if this value is set, config sources (excepting the first one) can only override keys in this list.  This takes precedence over blockedConfigOverrides.  By default, all keys may be overridden. To disable overrides, set this to "none" or change the configSources variable. |
 | daemon.blockedConfigOverrides | string | `nil` | blockedConfigOverrides is a list of config-map keys that may not be overridden. In other words, if any of these keys appear in a configuration source excepting the first one, they will be ignored  This is ignored if allowedConfigOverrides is set.  By default, all keys may be overridden. |
 | daemon.configSources | string | `nil` | Configure a custom list of possible configuration override sources The default is "config-map:cilium-config,cilium-node-config". For supported values, see the help text for the build-config subcommand. Note that this value should be a comma-separated string. |
@@ -318,8 +352,8 @@ contributors across the globe, there is almost always someone available to help.
 | dashboards | object | `{"annotations":{},"enabled":false,"label":"grafana_dashboard","labelValue":"1","namespace":null}` | Grafana dashboards for cilium-agent grafana can import dashboards based on the label and value ref: https://github.com/grafana/helm-charts/tree/main/charts/grafana#sidecar-for-dashboards |
 | debug.enabled | bool | `false` | Enable debug logging |
 | debug.metricsSamplingInterval | string | `"5m"` | Set the agent-internal metrics sampling frequency. This sets the frequency of the internal sampling of the agent metrics. These are available via the "cilium-dbg shell -- metrics -s" command and are part of the metrics HTML page included in the sysdump. @schema type: [null, string] @schema |
-| debug.verbose | string | `nil` | Configure verbosity levels for debug logging This option is used to enable debug messages for operations related to such sub-system such as (e.g. kvstore, envoy, datapath or policy), and flow is for enabling debug messages emitted per request, message and connection. Multiple values can be set via a space-separated string (e.g. "datapath envoy").  Applicable values: - flow - kvstore - envoy - datapath - policy |
-| defaultLBServiceIPAM | string | `"lbipam"` | defaultLBServiceIPAM indicates the default LoadBalancer Service IPAM when no LoadBalancer class is set. Applicable values: lbipam, nodeipam, none @schema type: [string] @schema |
+| debug.verbose | string | `nil` | Configure verbosity levels for debug logging This option is used to enable debug messages for operations related to such sub-system such as (e.g. kvstore, envoy, datapath, policy, or tagged), and flow is for enabling debug messages emitted per request, message and connection. Multiple values can be set via a space-separated string (e.g. "datapath envoy").  Applicable values: - flow - kvstore - envoy - datapath - policy - tagged |
+| defaultLBServiceIPAM | string | `"lbipam"` | defaultLBServiceIPAM indicates the default LoadBalancer Service IPAM when no LoadBalancer class is set. Applicable values: lbipam, nodeipam, none |
 | directRoutingSkipUnreachable | bool | `false` | Enable skipping of PodCIDR routes between worker nodes if the worker nodes are in a different L2 network segment. |
 | disableEndpointCRD | bool | `false` | Disable the usage of CiliumEndpoint CRD. |
 | dnsPolicy | string | `""` | DNS policy for Cilium agent pods. Ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy |
@@ -338,13 +372,15 @@ contributors across the globe, there is almost always someone available to help.
 | egressGateway.reconciliationTriggerInterval | string | `"1s"` | Time between triggers of egress gateway state reconciliations |
 | enableCriticalPriorityClass | bool | `true` | Explicitly enable or disable priority class. .Capabilities.KubeVersion is unsettable in `helm template` calls, it depends on k8s libraries version that Helm was compiled against. This option allows to explicitly disable setting the priority class, which is useful for rendering charts for gke clusters in advance. |
 | enableIPv4BIGTCP | bool | `false` | Enables IPv4 BIG TCP support which increases maximum IPv4 GSO/GRO limits for nodes and pods |
-| enableIPv4Masquerade | bool | `true` unless ipam eni mode is active  | Enables masquerading of IPv4 traffic leaving the node from endpoints. |
+| enableIPv4Masquerade | bool | `true` unless ipam eni mode is active | Enables masquerading of IPv4 traffic leaving the node from endpoints. |
 | enableIPv6BIGTCP | bool | `false` | Enables IPv6 BIG TCP support which increases maximum IPv6 GSO/GRO limits for nodes and pods |
 | enableIPv6Masquerade | bool | `true` | Enables masquerading of IPv6 traffic leaving the node from endpoints. |
 | enableInternalTrafficPolicy | bool | `true` | Enable Internal Traffic Policy |
 | enableLBIPAM | bool | `true` | Enable LoadBalancer IP Address Management |
 | enableMasqueradeRouteSource | bool | `false` | Enables masquerading to the source of the route for traffic leaving the node from endpoints. |
+| enableNoServiceEndpointsRoutable | bool | `true` | Enable routing to a service that has zero endpoints |
 | enableNonDefaultDenyPolicies | bool | `true` | Enable Non-Default-Deny policies |
+| enableTunnelBIGTCP | bool | `false` | Enable BIG TCP in tunneling mode and increase maximum GRO/GSO limits for VXLAN/GENEVE tunnels |
 | enableXTSocketFallback | bool | `true` | Enables the fallback compatibility solution for when the xt_socket kernel module is missing and it is needed for the datapath L7 redirection to work properly. See documentation for details on when this can be disabled: https://docs.cilium.io/en/stable/operations/system_requirements/#linux-kernel. |
 | encryption.enabled | bool | `false` | Enable transparent network encryption. |
 | encryption.ipsec.encryptedOverlay | bool | `false` | Enable IPsec encrypted overlay |
@@ -355,11 +391,15 @@ contributors across the globe, there is almost always someone available to help.
 | encryption.ipsec.mountPath | string | `"/etc/ipsec"` | Path to mount the secret inside the Cilium pod. |
 | encryption.ipsec.secretName | string | `"cilium-ipsec-keys"` | Name of the Kubernetes secret containing the encryption keys. |
 | encryption.nodeEncryption | bool | `false` | Enable encryption for pure node to node traffic. This option is only effective when encryption.type is set to "wireguard". |
-| encryption.strictMode | object | `{"allowRemoteNodeIdentities":false,"cidr":"","enabled":false}` | Configure the WireGuard Pod2Pod strict mode. |
-| encryption.strictMode.allowRemoteNodeIdentities | bool | `false` | Allow dynamic lookup of remote node identities. This is required when tunneling is used or direct routing is used and the node CIDR and pod CIDR overlap. |
-| encryption.strictMode.cidr | string | `""` | CIDR for the WireGuard Pod2Pod strict mode. |
-| encryption.strictMode.enabled | bool | `false` | Enable WireGuard Pod2Pod strict mode. |
-| encryption.type | string | `"ipsec"` | Encryption method. Can be either ipsec or wireguard. |
+| encryption.strictMode | object | `{"allowRemoteNodeIdentities":false,"cidr":"","egress":{"allowRemoteNodeIdentities":false,"cidr":"","enabled":false},"enabled":false,"ingress":{"enabled":false}}` | Configure the Encryption Pod2Pod strict mode. |
+| encryption.strictMode.allowRemoteNodeIdentities | bool | `false` | Allow dynamic lookup of remote node identities. (deprecated: please use encryption.strictMode.egress.allowRemoteNodeIdentities) This is required when tunneling is used or direct routing is used and the node CIDR and pod CIDR overlap. |
+| encryption.strictMode.cidr | string | `""` | CIDR for the Encryption Pod2Pod strict mode. (deprecated: please use encryption.strictMode.egress.cidr) |
+| encryption.strictMode.egress.allowRemoteNodeIdentities | bool | `false` | Allow dynamic lookup of remote node identities. This is required when tunneling is used or direct routing is used and the node CIDR and pod CIDR overlap. |
+| encryption.strictMode.egress.cidr | string | `""` | CIDR for the Encryption Pod2Pod strict egress mode. |
+| encryption.strictMode.egress.enabled | bool | `false` | Enable strict egress encryption. |
+| encryption.strictMode.enabled | bool | `false` | Enable Encryption Pod2Pod strict mode. (deprecated: please use encryption.strictMode.egress.enabled) |
+| encryption.strictMode.ingress.enabled | bool | `false` | Enable strict ingress encryption. When enabled, all unencrypted overlay ingress traffic will be dropped. This option is only applicable when WireGuard and tunneling are enabled. |
+| encryption.type | string | `"ipsec"` | Encryption method. Can be one of ipsec, wireguard or ztunnel. |
 | encryption.wireguard.persistentKeepalive | string | `"0s"` | Controls WireGuard PersistentKeepalive option. Set 0s to disable. |
 | endpointHealthChecking.enabled | bool | `true` | Enable connectivity health checking between virtual endpoints. |
 | endpointLockdownOnMapOverflow | bool | `false` | Enable endpoint lockdown on policy map overflow. |
@@ -373,12 +413,24 @@ contributors across the globe, there is almost always someone available to help.
 | eni.gcTags | object | `{"io.cilium/cilium-managed":"true,"io.cilium/cluster-name":"<auto-detected>"}` | Additional tags attached to ENIs created by Cilium. Dangling ENIs with this tag will be garbage collected |
 | eni.iamRole | string | `""` | If using IAM role for Service Accounts will not try to inject identity values from cilium-aws kubernetes secret. Adds annotation to service account if managed by Helm. See https://github.com/aws/amazon-eks-pod-identity-webhook |
 | eni.instanceTagsFilter | list | `[]` | Filter via AWS EC2 Instance tags (k=v) which will dictate which AWS EC2 Instances are going to be used to create new ENIs |
+| eni.nodeSpec | object | `{"deleteOnTermination":null,"disablePrefixDelegation":false,"excludeInterfaceTags":[],"firstInterfaceIndex":null,"securityGroupTags":[],"securityGroups":[],"subnetIDs":[],"subnetTags":[],"usePrimaryAddress":false}` | NodeSpec configuration for the ENI |
+| eni.nodeSpec.deleteOnTermination | string | `nil` | Delete ENI on termination @schema type: [null, boolean] @schema |
+| eni.nodeSpec.disablePrefixDelegation | bool | `false` | Disable prefix delegation for IP allocation |
+| eni.nodeSpec.excludeInterfaceTags | list | `[]` | Exclude interface tags to use for IP allocation |
+| eni.nodeSpec.firstInterfaceIndex | string | `nil` | First interface index to use for IP allocation @schema type: [null, integer] @schema |
+| eni.nodeSpec.securityGroupTags | list | `[]` | Security group tags to use for IP allocation |
+| eni.nodeSpec.securityGroups | list | `[]` | Security groups to use for IP allocation |
+| eni.nodeSpec.subnetIDs | list | `[]` | Subnet IDs to use for IP allocation |
+| eni.nodeSpec.subnetTags | list | `[]` | Subnet tags to use for IP allocation |
+| eni.nodeSpec.usePrimaryAddress | bool | `false` | Use primary address for IP allocation |
 | eni.subnetIDsFilter | list | `[]` | Filter via subnet IDs which will dictate which subnets are going to be used to create new ENIs Important note: This requires that each instance has an ENI with a matching subnet attached when Cilium is deployed. If you only want to control subnets for ENIs attached by Cilium, use the CNI configuration file settings (cni.customConf) instead. |
 | eni.subnetTagsFilter | list | `[]` | Filter via tags (k=v) which will dictate which subnets are going to be used to create new ENIs Important note: This requires that each instance has an ENI with a matching subnet attached when Cilium is deployed. If you only want to control subnets for ENIs attached by Cilium, use the CNI configuration file settings (cni.customConf) instead. |
 | envoy.affinity | object | `{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchExpressions":[{"key":"cilium.io/no-schedule","operator":"NotIn","values":["true"]}]}]}},"podAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"k8s-app":"cilium"}},"topologyKey":"kubernetes.io/hostname"}]},"podAntiAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"k8s-app":"cilium-envoy"}},"topologyKey":"kubernetes.io/hostname"}]}}` | Affinity for cilium-envoy. |
 | envoy.annotations | object | `{}` | Annotations to be added to all top-level cilium-envoy objects (resources under templates/cilium-envoy) |
 | envoy.baseID | int | `0` |  Set Envoy'--base-id' to use when allocating shared memory regions. Only needs to be changed if multiple Envoy instances will run on the same node and may have conflicts. Supported values: 0 - 4294967295. Defaults to '0' |
 | envoy.bootstrapConfigMap | string | `nil` | ADVANCED OPTION: Bring your own custom Envoy bootstrap ConfigMap. Provide the name of a ConfigMap with a `bootstrap-config.json` key. When specified, Envoy will use this ConfigMap instead of the default provided by the chart. WARNING: Use of this setting has the potential to prevent cilium-envoy from starting up, and can cause unexpected behavior (e.g. due to syntax error or semantically incorrect configuration). Before submitting an issue, please ensure you have disabled this feature, as support cannot be provided for custom Envoy bootstrap configs. @schema type: [null, string] @schema |
+| envoy.clusterMaxConnections | int | `1024` | Maximum number of connections on Envoy clusters |
+| envoy.clusterMaxRequests | int | `1024` | Maximum number of requests on Envoy clusters |
 | envoy.connectTimeoutSeconds | int | `2` | Time in seconds after which a TCP connection attempt times out |
 | envoy.debug.admin.enabled | bool | `false` | Enable admin interface for cilium-envoy. This is useful for debugging and should not be enabled in production. |
 | envoy.debug.admin.port | int | `9901` | Port number (bound to loopback interface). kubectl port-forward can be used to access the admin interface. |
@@ -394,7 +446,8 @@ contributors across the globe, there is almost always someone available to help.
 | envoy.httpRetryCount | int | `3` | Maximum number of retries for each HTTP request |
 | envoy.httpUpstreamLingerTimeout | string | `nil` | Time in seconds to block Envoy worker thread while an upstream HTTP connection is closing. If set to 0, the connection is closed immediately (with TCP RST). If set to -1, the connection is closed asynchronously in the background. |
 | envoy.idleTimeoutDurationSeconds | int | `60` | Set Envoy upstream HTTP idle connection timeout seconds. Does not apply to connections with pending requests. Default 60s |
-| envoy.image | object | `{"digest":"sha256:81398e449f2d3d0a6a70527e4f641aaa685d3156bea0bb30712fae3fd8822b86","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9","useDigest":true}` | Envoy container image. |
+| envoy.image | object | `{"digest":"sha256:8188114a2768b5f49d6ce58e168b20d765e0fbc64eee0d83241aa2b150ccd788","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.35.9-1770979049-232ed4a26881e4ab4f766f251f258ed424fff663","useDigest":true}` | Envoy container image. |
+| envoy.initContainers | list | `[]` | Init containers added to the cilium Envoy DaemonSet. |
 | envoy.initialFetchTimeoutSeconds | int | `30` | Time in seconds after which the initial fetch on an xDS stream is considered timed out |
 | envoy.livenessProbe.enabled | bool | `true` | Enable liveness probe for cilium-envoy |
 | envoy.livenessProbe.failureThreshold | int | `10` | failure threshold of liveness probe |
@@ -406,6 +459,7 @@ contributors across the globe, there is almost always someone available to help.
 | envoy.log.path | string | `""` | Path to a separate Envoy log file, if any. Defaults to /dev/stdout. |
 | envoy.maxConcurrentRetries | int | `128` | Maximum number of concurrent retries on Envoy clusters |
 | envoy.maxConnectionDurationSeconds | int | `0` | Set Envoy HTTP option max_connection_duration seconds. Default 0 (disable) |
+| envoy.maxGlobalDownstreamConnections | int | `50000` | Maximum number of global downstream connections |
 | envoy.maxRequestsPerConnection | int | `0` | ProxyMaxRequestsPerConnection specifies the max_requests_per_connection setting for Envoy |
 | envoy.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node selector for cilium-envoy. |
 | envoy.podAnnotations | object | `{}` | Annotations to be added to envoy pods |
@@ -439,6 +493,7 @@ contributors across the globe, there is almost always someone available to help.
 | envoy.terminationGracePeriodSeconds | int | `1` | Configure termination grace period for cilium-envoy DaemonSet. |
 | envoy.tolerations | list | `[{"operator":"Exists"}]` | Node tolerations for envoy scheduling to nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
 | envoy.updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":2},"type":"RollingUpdate"}` | cilium-envoy update strategy ref: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/#updating-a-daemonset |
+| envoy.useOriginalSourceAddress | bool | `true` | For cases when CiliumEnvoyConfig is not used directly (Ingress, Gateway), configures Cilium BPF Metadata listener filter to use the original source address when extracting the metadata for a request. |
 | envoy.xffNumTrustedHopsL7PolicyEgress | int | `0` | Number of trusted hops regarding the x-forwarded-for and related HTTP headers for the egress L7 policy enforcement Envoy listeners. |
 | envoy.xffNumTrustedHopsL7PolicyIngress | int | `0` | Number of trusted hops regarding the x-forwarded-for and related HTTP headers for the ingress L7 policy enforcement Envoy listeners. |
 | envoyConfig.enabled | bool | `false` | Enable CiliumEnvoyConfig CRD CiliumEnvoyConfig CRD can also be implicitly enabled by other options. |
@@ -482,12 +537,13 @@ contributors across the globe, there is almost always someone available to help.
 | hubble.dropEventEmitter.interval | string | `"2m"` | - Minimum time between emitting same events. |
 | hubble.dropEventEmitter.reasons | list | `["auth_required","policy_denied"]` | - Drop reasons to emit events for. ref: https://docs.cilium.io/en/stable/_api/v1/flow/README/#dropreason |
 | hubble.enabled | bool | `true` | Enable Hubble (true by default). |
-| hubble.export | object | `{"dynamic":{"config":{"configMapName":"cilium-flowlog-config","content":[{"excludeFilters":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}],"createConfigMap":true},"enabled":false},"static":{"allowList":[],"denyList":[],"enabled":false,"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log"}}` | Hubble flows export. |
-| hubble.export.dynamic | object | `{"config":{"configMapName":"cilium-flowlog-config","content":[{"excludeFilters":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}],"createConfigMap":true},"enabled":false}` | - Dynamic exporters configuration. Dynamic exporters may be reconfigured without a need of agent restarts. |
+| hubble.export | object | `{"dynamic":{"config":{"configMapName":"cilium-flowlog-config","content":[{"aggregationInterval":"0s","excludeFilters":[],"fieldAggregate":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}],"createConfigMap":true},"enabled":false},"static":{"aggregationInterval":"0s","allowList":[],"denyList":[],"enabled":false,"fieldAggregate":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log"}}` | Hubble flows export. |
+| hubble.export.dynamic | object | `{"config":{"configMapName":"cilium-flowlog-config","content":[{"aggregationInterval":"0s","excludeFilters":[],"fieldAggregate":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}],"createConfigMap":true},"enabled":false}` | - Dynamic exporters configuration. Dynamic exporters may be reconfigured without a need of agent restarts. |
 | hubble.export.dynamic.config.configMapName | string | `"cilium-flowlog-config"` | -- Name of configmap with configuration that may be altered to reconfigure exporters within a running agents. |
-| hubble.export.dynamic.config.content | list | `[{"excludeFilters":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}]` | -- Exporters configuration in YAML format. |
+| hubble.export.dynamic.config.content | list | `[{"aggregationInterval":"0s","excludeFilters":[],"fieldAggregate":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}]` | -- Exporters configuration in YAML format. |
 | hubble.export.dynamic.config.createConfigMap | bool | `true` | -- True if helm installer should create config map. Switch to false if you want to self maintain the file content. |
-| hubble.export.static | object | `{"allowList":[],"denyList":[],"enabled":false,"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log"}` | - Static exporter configuration. Static exporter is bound to agent lifecycle. |
+| hubble.export.static | object | `{"aggregationInterval":"0s","allowList":[],"denyList":[],"enabled":false,"fieldAggregate":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log"}` | - Static exporter configuration. Static exporter is bound to agent lifecycle. |
+| hubble.export.static.aggregationInterval | string | `"0s"` | - Defines the interval at which to aggregate before exporting Hubble flows.     Aggregation feature is only enabled when fieldAggregate is specified and aggregationInterval > 0s. |
 | hubble.export.static.fileCompress | bool | `false` | - Enable compression of rotated files. |
 | hubble.export.static.fileMaxBackups | int | `5` | - Defines max number of backup/rotated files. |
 | hubble.export.static.fileMaxSizeMb | int | `10` | - Defines max file size of output file before it gets rotated. |
@@ -535,9 +591,12 @@ contributors across the globe, there is almost always someone available to help.
 | hubble.relay.extraVolumes | list | `[]` | Additional hubble-relay volumes. |
 | hubble.relay.gops.enabled | bool | `true` | Enable gops for hubble-relay |
 | hubble.relay.gops.port | int | `9893` | Configure gops listen port for hubble-relay |
-| hubble.relay.image | object | `{"digest":"sha256:fb6135e34c31e5f175cb5e75f86cea52ef2ff12b49bcefb7088ed93f5009eb8e","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.18.6","useDigest":true}` | Hubble-relay container image. |
+| hubble.relay.image | object | `{"digest":"sha256:d8c4e13bc36a56179292bb52bc6255379cb94cb873700d316ea3139b1bdb8165","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.19.1","useDigest":true}` | Hubble-relay container image. |
 | hubble.relay.listenHost | string | `""` | Host to listen to. Specify an empty string to bind to all the interfaces. |
 | hubble.relay.listenPort | string | `"4245"` | Port to listen to. |
+| hubble.relay.logOptions | object | `{"format":null,"level":null}` | Logging configuration for hubble-relay. |
+| hubble.relay.logOptions.format | string | text-ts | Log format for hubble-relay. Valid values are: text, text-ts, json, json-ts. |
+| hubble.relay.logOptions.level | string | info | Log level for hubble-relay. Valid values are: debug, info, warn, error. |
 | hubble.relay.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | hubble.relay.podAnnotations | object | `{}` | Annotations to be added to hubble-relay pods |
 | hubble.relay.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
@@ -547,7 +606,9 @@ contributors across the globe, there is almost always someone available to help.
 | hubble.relay.podLabels | object | `{}` | Labels to be added to hubble-relay pods |
 | hubble.relay.podSecurityContext | object | `{"fsGroup":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | hubble-relay pod security context |
 | hubble.relay.pprof.address | string | `"localhost"` | Configure pprof listen address for hubble-relay |
+| hubble.relay.pprof.blockProfileRate | int | `0` | Enable goroutine blocking profiling for hubble-relay and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead]) |
 | hubble.relay.pprof.enabled | bool | `false` | Enable pprof for hubble-relay |
+| hubble.relay.pprof.mutexProfileFraction | int | `0` | Enable mutex contention profiling for hubble-relay and set the fraction of sampled events (set to 1 to sample all events) |
 | hubble.relay.pprof.port | int | `6062` | Configure pprof listen port for hubble-relay |
 | hubble.relay.priorityClassName | string | `""` | The priority class to use for hubble-relay |
 | hubble.relay.prometheus | object | `{"enabled":false,"port":9966,"serviceMonitor":{"annotations":{},"enabled":false,"interval":"10s","labels":{},"metricRelabelings":null,"relabelings":null,"scrapeTimeout":null}}` | Enable prometheus metrics for hubble-relay on the configured port at /metrics |
@@ -641,13 +702,14 @@ contributors across the globe, there is almost always someone available to help.
 | hubble.ui.tls.client.cert | string | `""` | base64 encoded PEM values for the Hubble UI client certificate (deprecated). Use existingSecret instead. |
 | hubble.ui.tls.client.existingSecret | string | `""` | Name of the Secret containing the client certificate and key for Hubble UI If specified, cert and key are ignored. |
 | hubble.ui.tls.client.key | string | `""` | base64 encoded PEM values for the Hubble UI client key (deprecated). Use existingSecret instead. |
+| hubble.ui.tmpVolume | object | `{}` | Configure temporary volume for hubble-ui |
 | hubble.ui.tolerations | list | `[]` | Node tolerations for pod assignment on nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
 | hubble.ui.topologySpreadConstraints | list | `[]` | Pod topology spread constraints for hubble-ui |
 | hubble.ui.updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":1},"type":"RollingUpdate"}` | hubble-ui update strategy. |
 | identityAllocationMode | string | `"crd"` | Method to use for identity allocation (`crd`, `kvstore` or `doublewrite-readkvstore` / `doublewrite-readcrd` for migrating between identity backends). |
 | identityChangeGracePeriod | string | `"5s"` | Time to wait before using new identity on endpoint identity change. |
 | identityManagementMode | string | `"agent"` | Control whether CiliumIdentities are created by the agent ("agent"), the operator ("operator") or both ("both"). "Both" should be used only to migrate between "agent" and "operator". Operator-managed identities is a beta feature. |
-| image | object | `{"digest":"sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.18.6","useDigest":true}` | Agent container image. |
+| image | object | `{"digest":"sha256:41f1f74a0000de8656f1de4088ea00c8f2d49d6edea579034c73c5fd5fe01792","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.19.1","useDigest":true}` | Agent container image. |
 | imagePullSecrets | list | `[]` | Configure image pull secrets for pulling container images |
 | ingressController.default | bool | `false` | Set cilium ingress controller to be the default ingress controller This will let cilium ingress controller route entries without ingress class set |
 | ingressController.defaultSecretName | string | `nil` | Default secret name for ingresses without .spec.tls[].secretName set. |
@@ -682,6 +744,11 @@ contributors across the globe, there is almost always someone available to help.
 | ipam.installUplinkRoutesForDelegatedIPAM | bool | `false` | Install ingress/egress routes through uplink on host for Pods when working with delegated IPAM plugin. |
 | ipam.mode | string | `"cluster-pool"` | Configure IP Address Management mode. ref: https://docs.cilium.io/en/stable/network/concepts/ipam/ |
 | ipam.multiPoolPreAllocation | string | `""` | Pre-allocation settings for IPAM in Multi-Pool mode |
+| ipam.nodeSpec | object | `{"ipamMaxAllocate":null,"ipamMinAllocate":null,"ipamPreAllocate":null,"ipamStaticIPTags":[]}` | NodeSpec configuration for the IPAM |
+| ipam.nodeSpec.ipamMaxAllocate | string | `nil` | IPAM max allocate @schema type: [null, integer] @schema |
+| ipam.nodeSpec.ipamMinAllocate | string | `nil` | IPAM min allocate @schema type: [null, integer] @schema |
+| ipam.nodeSpec.ipamPreAllocate | string | `nil` | IPAM pre allocate @schema type: [null, integer] @schema |
+| ipam.nodeSpec.ipamStaticIPTags | list | `[]` | IPAM static IP tags (currently only works with AWS and Azure) |
 | ipam.operator.autoCreateCiliumPodIPPools | object | `{}` | IP pools to auto-create in multi-pool IPAM mode. |
 | ipam.operator.clusterPoolIPv4MaskSize | int | `24` | IPv4 CIDR mask size to delegate to individual nodes for IPAM. |
 | ipam.operator.clusterPoolIPv4PodCIDRList | list | `["10.0.0.0/8"]` | IPv4 CIDR list range to delegate to individual nodes for IPAM. |
@@ -744,19 +811,18 @@ contributors across the globe, there is almost always someone available to help.
 | monitor | object | `{"enabled":false}` | cilium-monitor sidecar. |
 | monitor.enabled | bool | `false` | Enable the cilium-monitor sidecar. |
 | name | string | `"cilium"` | Agent daemonset name. |
-| namespaceOverride | string | `""` | namespaceOverride allows to override the destination namespace for Cilium resources. This property allows to use Cilium as part of an Umbrella Chart with different targets. |
+| namespaceOverride | string | `""` | namespaceOverride allows to override the destination namespace for Cilium resources. |
 | nat.mapStatsEntries | int | `32` | Number of the top-k SNAT map connections to track in Cilium statedb. |
 | nat.mapStatsInterval | string | `"30s"` | Interval between how often SNAT map is counted for stats. |
 | nat46x64Gateway | object | `{"enabled":false}` | Configure standalone NAT46/NAT64 gateway |
 | nat46x64Gateway.enabled | bool | `false` | Enable RFC6052-prefixed translation |
 | nodeIPAM.enabled | bool | `false` | Configure Node IPAM ref: https://docs.cilium.io/en/stable/network/node-ipam/ |
-| nodePort | object | `{"addresses":null,"autoProtectPortRange":true,"bindProtection":true,"enableHealthCheck":true,"enableHealthCheckLoadBalancerIP":false,"enabled":false}` | Configure N-S k8s service loadbalancing |
+| nodePort | object | `{"addresses":null,"autoProtectPortRange":true,"bindProtection":true,"enableHealthCheck":true,"enableHealthCheckLoadBalancerIP":false}` | Configure N-S k8s service loadbalancing |
 | nodePort.addresses | string | `nil` | List of CIDRs for choosing which IP addresses assigned to native devices are used for NodePort load-balancing. By default this is empty and the first suitable, preferably private, IPv4 and IPv6 address assigned to each device is used.  Example:    addresses: ["192.168.1.0/24", "2001::/64"]  |
 | nodePort.autoProtectPortRange | bool | `true` | Append NodePort range to ip_local_reserved_ports if clash with ephemeral ports is detected. |
 | nodePort.bindProtection | bool | `true` | Set to true to prevent applications binding to service ports. |
 | nodePort.enableHealthCheck | bool | `true` | Enable healthcheck nodePort server for NodePort services |
 | nodePort.enableHealthCheckLoadBalancerIP | bool | `false` | Enable access of the healthcheck nodePort on the LoadBalancerIP. Needs EnableHealthCheck to be enabled |
-| nodePort.enabled | bool | `false` | Enable the Cilium NodePort service implementation. |
 | nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node selector for cilium-agent. |
 | nodeSelectorLabels | bool | `false` | Enable/Disable use of node label based identity |
 | nodeinit.affinity | object | `{}` | Affinity for cilium-nodeinit |
@@ -766,7 +832,7 @@ contributors across the globe, there is almost always someone available to help.
 | nodeinit.extraEnv | list | `[]` | Additional nodeinit environment variables. |
 | nodeinit.extraVolumeMounts | list | `[]` | Additional nodeinit volumeMounts. |
 | nodeinit.extraVolumes | list | `[]` | Additional nodeinit volumes. |
-| nodeinit.image | object | `{"digest":"sha256:5bdca3c2dec2c79f58d45a7a560bf1098c2126350c901379fe850b7f78d3d757","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/startup-script","tag":"1755531540-60ee83e","useDigest":true}` | node-init image. |
+| nodeinit.image | object | `{"digest":"sha256:50b9cf9c280096b59b80d2fc8ee6638facef79ac18998a22f0cbc40d5d28c16f","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/startup-script","tag":"1763560095-8f36c34","useDigest":true}` | node-init image. |
 | nodeinit.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for nodeinit pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | nodeinit.podAnnotations | object | `{}` | Annotations to be added to node-init pods. |
 | nodeinit.podLabels | object | `{}` | Labels to be added to node-init pods. |
@@ -779,6 +845,7 @@ contributors across the globe, there is almost always someone available to help.
 | nodeinit.startup | object | `{"postScript":"","preScript":""}` | startup offers way to customize startup nodeinit script (pre and post position) |
 | nodeinit.tolerations | list | `[{"operator":"Exists"}]` | Node tolerations for nodeinit scheduling to nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
 | nodeinit.updateStrategy | object | `{"type":"RollingUpdate"}` | node-init update strategy |
+| nodeinit.waitForCloudInit | bool | `false` | wait for Cloud init to finish on the host and assume the node has cloud init installed |
 | operator.affinity | object | `{"podAntiAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"io.cilium/app":"operator"}},"topologyKey":"kubernetes.io/hostname"}]}}` | Affinity for cilium-operator |
 | operator.annotations | object | `{}` | Annotations to be added to all top-level cilium-operator objects (resources under templates/cilium-operator) |
 | operator.dashboards | object | `{"annotations":{},"enabled":false,"label":"grafana_dashboard","labelValue":"1","namespace":null}` | Grafana dashboards for cilium-operator grafana can import dashboards based on the label and value ref: https://github.com/grafana/helm-charts/tree/main/charts/grafana#sidecar-for-dashboards |
@@ -793,7 +860,7 @@ contributors across the globe, there is almost always someone available to help.
 | operator.hostNetwork | bool | `true` | HostNetwork setting |
 | operator.identityGCInterval | string | `"15m0s"` | Interval for identity garbage collection. |
 | operator.identityHeartbeatTimeout | string | `"30m0s"` | Timeout for identity heartbeats. |
-| operator.image | object | `{"alibabacloudDigest":"sha256:212c4cbe27da3772bcb952b8f8cbaa0b0eef72488b52edf90ad2b32072a3ca4c","awsDigest":"sha256:47dbc1a5bd483fec170dab7fb0bf2cca3585a4893675b0324d41d97bac8be5eb","azureDigest":"sha256:a57aff47aeb32eccfedaa2a49d1af984d996d6d6de79609c232e0c4cf9ce97a1","genericDigest":"sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.18.6","useDigest":true}` | cilium-operator image. |
+| operator.image | object | `{"alibabacloudDigest":"sha256:837b12f4239e88ea5b4b5708ab982c319a94ee05edaecaafe5fd0e5b1962f554","awsDigest":"sha256:18913d05a6c4d205f0b7126c4723bb9ccbd4dc24403da46ed0f9f4bf2a142804","azureDigest":"sha256:82bce78603056e709d4c4e9f9ebb25c222c36d8a07f8c05381c2372d9078eca8","genericDigest":"sha256:e7278d763e448bf6c184b0682cf98cdca078d58a27e1b2f3c906792670aa211a","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.19.1","useDigest":true}` | cilium-operator image. |
 | operator.nodeGCInterval | string | `"5m0s"` | Interval for cilium node garbage collection. |
 | operator.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for cilium-operator pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | operator.podAnnotations | object | `{}` | Annotations to be added to cilium-operator pods |
@@ -804,10 +871,12 @@ contributors across the globe, there is almost always someone available to help.
 | operator.podLabels | object | `{}` | Labels to be added to cilium-operator pods |
 | operator.podSecurityContext | object | `{"seccompProfile":{"type":"RuntimeDefault"}}` | Security context to be added to cilium-operator pods |
 | operator.pprof.address | string | `"localhost"` | Configure pprof listen address for cilium-operator |
+| operator.pprof.blockProfileRate | int | `0` | Enable goroutine blocking profiling for cilium-operator and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead]) |
 | operator.pprof.enabled | bool | `false` | Enable pprof for cilium-operator |
+| operator.pprof.mutexProfileFraction | int | `0` | Enable mutex contention profiling for cilium-operator and set the fraction of sampled events (set to 1 to sample all events) |
 | operator.pprof.port | int | `6061` | Configure pprof listen port for cilium-operator |
 | operator.priorityClassName | string | `""` | The priority class to use for cilium-operator |
-| operator.prometheus | object | `{"enabled":true,"metricsService":false,"port":9963,"serviceMonitor":{"annotations":{},"enabled":false,"interval":"10s","jobLabel":"","labels":{},"metricRelabelings":null,"relabelings":null,"scrapeTimeout":null}}` | Enable prometheus metrics for cilium-operator on the configured port at /metrics |
+| operator.prometheus | object | `{"enabled":true,"metricsService":false,"port":9963,"serviceMonitor":{"annotations":{},"enabled":false,"interval":"10s","jobLabel":"","labels":{},"metricRelabelings":null,"relabelings":null,"scrapeTimeout":null},"tls":{"enabled":false,"server":{"existingSecret":"","mtls":{"enabled":false}}}}` | Enable prometheus metrics for cilium-operator on the configured port at /metrics |
 | operator.prometheus.serviceMonitor.annotations | object | `{}` | Annotations to add to ServiceMonitor cilium-operator |
 | operator.prometheus.serviceMonitor.enabled | bool | `false` | Enable service monitors. This requires the prometheus CRDs to be available (see https://github.com/prometheus-operator/prometheus-operator/blob/main/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml) |
 | operator.prometheus.serviceMonitor.interval | string | `"10s"` | Interval for scrape metrics. |
@@ -816,6 +885,8 @@ contributors across the globe, there is almost always someone available to help.
 | operator.prometheus.serviceMonitor.metricRelabelings | string | `nil` | Metrics relabeling configs for the ServiceMonitor cilium-operator |
 | operator.prometheus.serviceMonitor.relabelings | string | `nil` | Relabeling configs for the ServiceMonitor cilium-operator |
 | operator.prometheus.serviceMonitor.scrapeTimeout | string | `nil` | Timeout after which scrape is considered to be failed. |
+| operator.prometheus.tls | object | `{"enabled":false,"server":{"existingSecret":"","mtls":{"enabled":false}}}` | TLS configuration for Prometheus |
+| operator.prometheus.tls.server.existingSecret | string | `""` | Name of the Secret containing the certificate, key and CA files for the Prometheus server. |
 | operator.removeNodeTaints | bool | `true` | Remove Cilium node taint from Kubernetes nodes that have a healthy Cilium pod running. |
 | operator.replicas | int | `2` | Number of replicas to run for the cilium-operator deployment |
 | operator.resources | object | `{}` | cilium-operator resource limits & requests ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
@@ -828,25 +899,30 @@ contributors across the globe, there is almost always someone available to help.
 | operator.topologySpreadConstraints | list | `[]` | Pod topology spread constraints for cilium-operator |
 | operator.unmanagedPodWatcher.intervalSeconds | int | `15` | Interval, in seconds, to check if there are any pods that are not managed by Cilium. |
 | operator.unmanagedPodWatcher.restart | bool | `true` | Restart any pod that are not managed by Cilium. |
+| operator.unmanagedPodWatcher.selector | string | `nil` | Selector for pods that should be restarted when not managed by Cilium. If not set, defaults to built-in selector "k8s-app=kube-dns". Set to empty string to select all pods. @schema type: [null, string] @schema |
 | operator.updateStrategy | object | `{"rollingUpdate":{"maxSurge":"25%","maxUnavailable":"50%"},"type":"RollingUpdate"}` | cilium-operator update strategy |
 | pmtuDiscovery.enabled | bool | `false` | Enable path MTU discovery to send ICMP fragmentation-needed replies to the client. |
+| pmtuDiscovery.packetizationLayerPMTUDMode | string | `"blackhole"` | Enable kernel probing path MTU discovery for Pods which uses different message sizes to search for correct MTU value. Valid values are: always, blackhole, disabled and unset (or empty). If value is 'unset' or left empty then will not try to override setting. |
 | podAnnotations | object | `{}` | Annotations to be added to agent pods |
 | podLabels | object | `{}` | Labels to be added to agent pods |
 | podSecurityContext | object | `{"appArmorProfile":{"type":"Unconfined"},"seccompProfile":{"type":"Unconfined"}}` | Security Context for cilium-agent pods. |
 | podSecurityContext.appArmorProfile | object | `{"type":"Unconfined"}` | AppArmorProfile options for the `cilium-agent` and init containers |
 | policyCIDRMatchMode | string | `nil` | policyCIDRMatchMode is a list of entities that may be selected by CIDR selector. The possible value is "nodes". |
+| policyDenyResponse | string | `"none"` | Configure what the response should be to pod egress traffic denied by network policy. Possible values:  - none (default)  - icmp |
 | policyEnforcementMode | string | `"default"` | The agent can be put into one of the three policy enforcement modes: default, always and never. ref: https://docs.cilium.io/en/stable/security/policy/intro/#policy-enforcement-modes |
 | pprof.address | string | `"localhost"` | Configure pprof listen address for cilium-agent |
+| pprof.blockProfileRate | int | `0` | Enable goroutine blocking profiling for cilium-agent and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead]) |
 | pprof.enabled | bool | `false` | Enable pprof for cilium-agent |
+| pprof.mutexProfileFraction | int | `0` | Enable mutex contention profiling for cilium-agent and set the fraction of sampled events (set to 1 to sample all events) |
 | pprof.port | int | `6060` | Configure pprof listen port for cilium-agent |
 | preflight.affinity | object | `{"podAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"k8s-app":"cilium"}},"topologyKey":"kubernetes.io/hostname"}]}}` | Affinity for cilium-preflight |
 | preflight.annotations | object | `{}` | Annotations to be added to all top-level preflight objects (resources under templates/cilium-preflight) |
 | preflight.enabled | bool | `false` | Enable Cilium pre-flight resources (required for upgrade) |
-| preflight.envoy.image | object | `{"digest":"sha256:81398e449f2d3d0a6a70527e4f641aaa685d3156bea0bb30712fae3fd8822b86","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9","useDigest":true}` | Envoy pre-flight image. |
+| preflight.envoy.image | object | `{"digest":"sha256:8188114a2768b5f49d6ce58e168b20d765e0fbc64eee0d83241aa2b150ccd788","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.35.9-1770979049-232ed4a26881e4ab4f766f251f258ed424fff663","useDigest":true}` | Envoy pre-flight image. |
 | preflight.extraEnv | list | `[]` | Additional preflight environment variables. |
 | preflight.extraVolumeMounts | list | `[]` | Additional preflight volumeMounts. |
 | preflight.extraVolumes | list | `[]` | Additional preflight volumes. |
-| preflight.image | object | `{"digest":"sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.18.6","useDigest":true}` | Cilium pre-flight image. |
+| preflight.image | object | `{"digest":"sha256:41f1f74a0000de8656f1de4088ea00c8f2d49d6edea579034c73c5fd5fe01792","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.19.1","useDigest":true}` | Cilium pre-flight image. |
 | preflight.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for preflight pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | preflight.podAnnotations | object | `{}` | Annotations to be added to preflight pods |
 | preflight.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
@@ -890,24 +966,36 @@ contributors across the globe, there is almost always someone available to help.
 | sctp | object | `{"enabled":false}` | SCTP Configuration Values |
 | sctp.enabled | bool | `false` | Enable SCTP support. NOTE: Currently, SCTP support does not support rewriting ports or multihoming. |
 | secretsNamespaceAnnotations | object | `{}` | Annotations to be added to all cilium-secret namespaces (resources under templates/cilium-secrets-namespace) |
+| secretsNamespaceLabels | object | `{}` | Labels to be added to all cilium-secret namespaces (resources under templates/cilium-secrets-namespace) |
 | securityContext.allowPrivilegeEscalation | bool | `false` | disable privilege escalation |
 | securityContext.capabilities.applySysctlOverwrites | list | `["SYS_ADMIN","SYS_CHROOT","SYS_PTRACE"]` | capabilities for the `apply-sysctl-overwrites` init container |
-| securityContext.capabilities.ciliumAgent | list | `["CHOWN","KILL","NET_ADMIN","NET_RAW","IPC_LOCK","SYS_MODULE","SYS_ADMIN","SYS_RESOURCE","DAC_OVERRIDE","FOWNER","SETGID","SETUID"]` | Capabilities for the `cilium-agent` container |
+| securityContext.capabilities.ciliumAgent | list | `["CHOWN","KILL","NET_ADMIN","NET_RAW","IPC_LOCK","SYS_MODULE","SYS_ADMIN","SYS_RESOURCE","DAC_OVERRIDE","FOWNER","SETGID","SETUID","SYSLOG"]` | Capabilities for the `cilium-agent` container |
 | securityContext.capabilities.cleanCiliumState | list | `["NET_ADMIN","SYS_MODULE","SYS_ADMIN","SYS_RESOURCE"]` | Capabilities for the `clean-cilium-state` init container |
 | securityContext.capabilities.mountCgroup | list | `["SYS_ADMIN","SYS_CHROOT","SYS_PTRACE"]` | Capabilities for the `mount-cgroup` init container |
 | securityContext.privileged | bool | `false` | Run the pod with elevated privileges |
 | securityContext.seLinuxOptions | object | `{"level":"s0","type":"spc_t"}` | SELinux options for the `cilium-agent` and init containers |
 | serviceAccounts | object | Component's fully qualified name. | Define serviceAccount names for components. |
 | serviceAccounts.clustermeshcertgen | object | `{"annotations":{},"automount":true,"create":true,"name":"clustermesh-apiserver-generate-certs"}` | Clustermeshcertgen is used if clustermesh.apiserver.tls.auto.method=cronJob |
+| serviceAccounts.corednsMCSAPI | object | `{"annotations":{},"automount":true,"create":true,"name":"cilium-coredns-mcsapi-autoconfig"}` | CorednsMCSAPI is used if clustermesh.mcsapi.corednsAutoConfigure.enabled=true |
 | serviceAccounts.hubblecertgen | object | `{"annotations":{},"automount":true,"create":true,"name":"hubble-generate-certs"}` | Hubblecertgen is used if hubble.tls.auto.method=cronJob |
 | serviceAccounts.nodeinit.enabled | bool | `false` | Enabled is temporary until https://github.com/cilium/cilium-cli/issues/1396 is implemented. Cilium CLI doesn't create the SAs for node-init, thus the workaround. Helm is not affected by this issue. Name and automount can be configured, if enabled is set to true. Otherwise, they are ignored. Enabled can be removed once the issue is fixed. Cilium-nodeinit DS must also be fixed. |
 | serviceNoBackendResponse | string | `"reject"` | Configure what the response should be to traffic for a service without backends. Possible values:  - reject (default)  - drop |
 | sleepAfterInit | bool | `false` | Do not run Cilium agent when running with clean mode. Useful to completely uninstall Cilium as it will stop Cilium from starting and create artifacts in the node. |
 | socketLB | object | `{"enabled":false}` | Configure socket LB |
 | socketLB.enabled | bool | `false` | Enable socket LB |
+| standaloneDnsProxy | object | `{"annotations":{},"automountServiceAccountToken":false,"debug":false,"enabled":false,"image":{"digest":"","override":null,"pullPolicy":"IfNotPresent","repository":"","tag":"","useDigest":true},"nodeSelector":{"kubernetes.io/os":"linux"},"rollOutPods":false,"serverPort":10095,"tolerations":[],"updateStrategy":{"rollingUpdate":{"maxSurge":2,"maxUnavailable":0},"type":"RollingUpdate"}}` | Standalone DNS Proxy Configuration Note: The standalone DNS proxy uses the agent's dnsProxy.* configuration for DNS settings (proxyPort, enableDnsCompression) to ensure consistency. |
+| standaloneDnsProxy.annotations | object | `{}` | Standalone DNS proxy annotations |
+| standaloneDnsProxy.automountServiceAccountToken | bool | `false` | Standalone DNS proxy auto mount service account token |
+| standaloneDnsProxy.debug | bool | `false` | Standalone DNS proxy debug mode |
+| standaloneDnsProxy.enabled | bool | `false` | Enable standalone DNS proxy (alpha feature) |
+| standaloneDnsProxy.image | object | `{"digest":"","override":null,"pullPolicy":"IfNotPresent","repository":"","tag":"","useDigest":true}` | Standalone DNS proxy image |
+| standaloneDnsProxy.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Standalone DNS proxy Node Selector |
+| standaloneDnsProxy.rollOutPods | bool | `false` | Roll out Standalone DNS proxy automatically when configmap is updated. |
+| standaloneDnsProxy.serverPort | int | `10095` | Standalone DNS proxy server port |
+| standaloneDnsProxy.tolerations | list | `[]` | Standalone DNS proxy tolerations |
+| standaloneDnsProxy.updateStrategy | object | `{"rollingUpdate":{"maxSurge":2,"maxUnavailable":0},"type":"RollingUpdate"}` | Standalone DNS proxy update strategy |
 | startupProbe.failureThreshold | int | `300` | failure threshold of startup probe. Allow Cilium to take up to 600s to start up (300 attempts with 2s between attempts). |
 | startupProbe.periodSeconds | int | `2` | interval between checks of the startup probe |
-| svcSourceRangeCheck | bool | `true` | Enable check of service source ranges (currently, only for LoadBalancer). |
 | synchronizeK8sNodes | bool | `true` | Synchronize Kubernetes nodes to kvstore and perform CNP GC. |
 | sysctlfix | object | `{"enabled":true}` | Configure sysctl override described in #20072. |
 | sysctlfix.enabled | bool | `true` | Enable the sysctl override. When enabled, the init container will mount the /proc of the host so that the `sysctlfix` utility can execute. |
@@ -929,11 +1017,12 @@ contributors across the globe, there is almost always someone available to help.
 | tls.secretsNamespace | object | `{"create":true,"name":"cilium-secrets"}` | Configures where secrets used in CiliumNetworkPolicies will be looked for |
 | tls.secretsNamespace.create | bool | `true` | Create secrets namespace for TLS Interception secrets. |
 | tls.secretsNamespace.name | string | `"cilium-secrets"` | Name of TLS Interception secret namespace. |
+| tmpVolume | object | `{}` | Configure temporary volume for cilium-agent |
 | tolerations | list | `[{"operator":"Exists"}]` | Node tolerations for agent scheduling to nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
 | tunnelPort | int | Port 8472 for VXLAN, Port 6081 for Geneve | Configure VXLAN and Geneve tunnel port. |
 | tunnelProtocol | string | `"vxlan"` | Tunneling protocol to use in tunneling mode and for ad-hoc tunnels. Possible values:   - ""   - vxlan   - geneve |
 | tunnelSourcePortRange | string | 0-0 to let the kernel driver decide the range | Configure VXLAN and Geneve tunnel source port range hint. |
-| underlayProtocol | string | `"ipv4"` | IP family for the underlay. |
+| underlayProtocol | string | `"ipv4"` | IP family for the underlay. Possible values:   - "ipv4"   - "ipv6" |
 | updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":2},"type":"RollingUpdate"}` | Cilium agent update strategy |
 | upgradeCompatibility | string | `nil` | upgradeCompatibility helps users upgrading to ensure that the configMap for Cilium will not change critical values to ensure continued operation This flag is not required for new installations. For example: '1.7', '1.8', '1.9' |
 | vtep.cidr | string | `""` | A space separated list of VTEP device CIDRs, for example "1.1.1.0/24 1.1.2.0/24" |
diff --git a/packages/system/cilium/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.yaml b/packages/system/cilium/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.yaml
index 52439049..ea1d3bda 100644
--- a/packages/system/cilium/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.yaml
+++ b/packages/system/cilium/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.yaml
@@ -292,7 +292,7 @@ overloadManager:
   - name: "envoy.resource_monitors.global_downstream_max_connections"
     typedConfig:
       "@type": "type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig"
-      max_active_downstream_connections: "50000"
+      max_active_downstream_connections: "{{ .Values.envoy.maxGlobalDownstreamConnections }}"
 applicationLogConfig:
   logFormat:
     {{- if .Values.envoy.log.format_json }}
diff --git a/packages/system/cilium/charts/cilium/files/nodeinit/startup.bash b/packages/system/cilium/charts/cilium/files/nodeinit/startup.bash
index aa63cac8..68e6b50b 100644
--- a/packages/system/cilium/charts/cilium/files/nodeinit/startup.bash
+++ b/packages/system/cilium/charts/cilium/files/nodeinit/startup.bash
@@ -156,6 +156,14 @@ fi
 iptables -w -t nat -D POSTROUTING -m comment --comment "ip-masq: ensure nat POSTROUTING directs all non-LOCAL destination traffic to our custom IP-MASQ chain" -m addrtype ! --dst-type LOCAL -j IP-MASQ || true
 {{- end }}
 
+{{- if .Values.nodeinit.waitForCloudInit }}
+echo "Waiting for cloud-init..."
+if command -v cloud-init >/dev/null 2>&1; then
+  cloud-init status --wait
+  echo "cloud-init completed!"
+fi
+{{- end }}
+
 {{- if not (eq .Values.nodeinit.bootstrapFile "") }}
 mkdir -p {{ .Values.nodeinit.bootstrapFile | dir | quote }}
 date > {{ .Values.nodeinit.bootstrapFile | quote }}
diff --git a/packages/system/cilium/charts/cilium/templates/_extensions.tpl b/packages/system/cilium/charts/cilium/templates/_extensions.tpl
index bd8ba80b..8c0e5c20 100644
--- a/packages/system/cilium/charts/cilium/templates/_extensions.tpl
+++ b/packages/system/cilium/charts/cilium/templates/_extensions.tpl
@@ -21,6 +21,24 @@ dnsPolicy: {{ .Values.dnsPolicy }}
 {{- end }}
 {{- end }}
 
+{{/*
+Allow packagers to add extra volumes to cilium-operator.
+*/}}
+{{- define "cilium-operator.volumes.extra" }}
+{{- end }}
+
+{{- define "cilium-operator.volumeMounts.extra" }}
+{{- end }}
+
+{{/*
+Allow packagers to set securityContext for cilium-operator.
+*/}}
+{{- define "cilium.operator.securityContext" }}
+{{- with .Values.operator.securityContext }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
 {{/*
 Intentionally empty to allow downstream chart packagers to add extra
 containers to hubble-relay without having to modify the deployment manifest
@@ -72,3 +90,87 @@ Allow packagers to add extra configuration to certgen.
 */}}
 {{- define "certgen.config.extra" -}}
 {{- end }}
+
+{{/*
+Allow packagers to add extra arguments to the clustermesh-apiserver apiserver container.
+*/}}
+{{- define "clustermesh.apiserver.args.extra" -}}
+{{- end }}
+
+{{/*
+Allow packagers to add extra arguments to the clustermesh-apiserver kvstoremesh container.
+*/}}
+{{- define "clustermesh.kvstoremesh.args.extra" -}}
+{{- end }}
+
+{{/*
+Allow packagers to add init containers to the cilium-envoy pods.
+*/}}
+{{- define "envoy.initContainers" -}}
+{{- end }}
+
+{{/*
+Allow packagers to add extra args to the cilium-envoy container.
+*/}}
+{{- define "envoy.args.extra" -}}
+{{- end }}
+
+{{/*
+Allow packagers to add extra env vars to the cilium-envoy container.
+*/}}
+{{- define "envoy.env.extra" -}}
+{{- end }}
+
+{{/*
+Allow packagers to add extra volume mounts to the cilium-envoy container.
+*/}}
+{{- define "envoy.volumeMounts.extra" -}}
+{{- end }}
+
+{{/*
+Allow packagers to add extra host path mounts to the cilium-envoy container.
+*/}}
+{{- define "envoy.hostPathMounts.extra" -}}
+{{- end }}
+
+
+{{/*
+Allow packagers to define set of ports for cilium-envoy container.
+The template needs to allow overriding ports spec not just adding.
+*/}}
+{{- define "envoy.ports" -}}
+        {{- if .Values.envoy.prometheus.enabled }}
+        ports:
+        - name: envoy-metrics
+          containerPort: {{ .Values.envoy.prometheus.port }}
+          hostPort: {{ .Values.envoy.prometheus.port }}
+          protocol: TCP
+        {{- if and .Values.envoy.debug.admin.enabled .Values.envoy.debug.admin.port }}
+        - name: envoy-admin
+          containerPort: {{ .Values.envoy.debug.admin.port }}
+          hostPort: {{ .Values.envoy.debug.admin.port }}
+          protocol: TCP
+        {{- end }}
+        {{- end }}
+{{- end }}
+
+{{/*
+Allow packagers to define update strategy for cilium-envoy pods.
+*/}}
+{{- define "envoy.updateStrategy" -}}
+{{- with .Values.envoy.updateStrategy }}
+updateStrategy:
+  {{- toYaml . | trim | nindent 2 }}
+  {{- end }}
+{{- end }}
+
+{{/*
+Allow packagers to define affinity for cilium-envoy pods.
+*/}}
+{{- define "envoy.affinity" -}}
+{{- with .Values.envoy.affinity }}
+affinity:
+  {{- toYaml . | nindent 2 }}     
+{{- end }}
+{{- end }}
+
diff --git a/packages/system/cilium/charts/cilium/templates/_helpers.tpl b/packages/system/cilium/charts/cilium/templates/_helpers.tpl
index ba91c353..e90aa482 100644
--- a/packages/system/cilium/charts/cilium/templates/_helpers.tpl
+++ b/packages/system/cilium/charts/cilium/templates/_helpers.tpl
@@ -131,12 +131,16 @@ To override the namespace and configMap when using `auto`:
 {{- define "k8sServiceHost" }}
   {{- $configmapName := default "cluster-info" .Values.k8sServiceLookupConfigMapName }}
   {{- $configmapNamespace := default "kube-public" .Values.k8sServiceLookupNamespace }}
-  {{- if and (eq .Values.k8sServiceHost "auto") (lookup "v1" "ConfigMap" $configmapNamespace $configmapName) }}
+  {{- if eq .Values.k8sServiceHost "auto" }}
     {{- $configmap := (lookup "v1" "ConfigMap" $configmapNamespace $configmapName) }}
-    {{- $kubeconfig := get $configmap.data "kubeconfig" }}
-    {{- $k8sServer := get ($kubeconfig | fromYaml) "clusters" | mustFirst | dig "cluster" "server" "" }}
-    {{- $uri := (split "https://" $k8sServer)._1 | trim }}
-    {{- (split ":" $uri)._0 | quote }}
+    {{- if $configmap }}
+      {{- $kubeconfig := get $configmap.data "kubeconfig" }}
+      {{- $k8sServer := get ($kubeconfig | fromYaml) "clusters" | mustFirst | dig "cluster" "server" "" }}
+      {{- $uri := (split "https://" $k8sServer)._1 | trim }}
+      {{- (split ":" $uri)._0 | quote }}
+    {{- else }}
+      {{- fail (printf "ConfigMap %s/%s not found, please create it or set k8sServiceHost to a valid value" $configmapNamespace $configmapName) }}
+    {{- end }}
   {{- else }}
     {{- .Values.k8sServiceHost | quote }}
   {{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-agent/clusterrole.yaml b/packages/system/cilium/charts/cilium/templates/cilium-agent/clusterrole.yaml
index eaca204e..57b13447 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-agent/clusterrole.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-agent/clusterrole.yaml
@@ -94,7 +94,6 @@ rules:
   - cilium.io
   resources:
   - ciliumloadbalancerippools
-  - ciliumbgppeeringpolicies
   - ciliumbgpnodeconfigs
   - ciliumbgpadvertisements
   - ciliumbgppeerconfigs
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml b/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
index c706da51..f9a4cec7 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
@@ -10,6 +10,7 @@
 
 {{- $kubeProxyReplacement := (coalesce .Values.kubeProxyReplacement "false") -}}
 {{- $envoyDS := eq (include "envoyDaemonSetEnabled" .) "true" -}}
+{{- $buildDaemonConfig := or (kindIs "invalid" .Values.daemon.configSources) (not (regexMatch "^config-map:[^,]+$" .Values.daemon.configSources)) -}}
 
 ---
 apiVersion: apps/v1
@@ -134,7 +135,7 @@ spec:
           httpGet:
             host: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }}
             path: /healthz
-            port: {{ .Values.healthPort }}
+            port: health
             scheme: HTTP
             httpHeaders:
             - name: "brief"
@@ -154,7 +155,7 @@ spec:
           httpGet:
             host: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }}
             path: /healthz
-            port: {{ .Values.healthPort }}
+            port: health
             scheme: HTTP
             httpHeaders:
             - name: "brief"
@@ -177,7 +178,7 @@ spec:
           httpGet:
             host: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }}
             path: /healthz
-            port: {{ .Values.healthPort }}
+            port: health
             scheme: HTTP
             httpHeaders:
             - name: "brief"
@@ -250,12 +251,17 @@ spec:
         resources:
           {{- toYaml . | trim | nindent 10 }}
         {{- end }}
-        {{- if or .Values.prometheus.enabled (or .Values.hubble.metrics.enabled .Values.hubble.metrics.dynamic.enabled) }}
         ports:
+        - name: health
+          containerPort: {{ .Values.healthPort }}
+          hostPort: {{ .Values.healthPort }}
+          protocol: TCP
+        {{- if .Values.hubble.enabled }}
         - name: peer-service
           containerPort: {{ .Values.hubble.peerService.targetPort }}
           hostPort: {{ .Values.hubble.peerService.targetPort }}
           protocol: TCP
+        {{- end }}
         {{- if .Values.prometheus.enabled }}
         - name: prometheus
           containerPort: {{ .Values.prometheus.port }}
@@ -280,7 +286,6 @@ spec:
           hostPort: {{ .Values.hubble.metrics.port }}
           protocol: TCP
         {{- end }}
-        {{- end }}
         securityContext:
           {{- if .Values.securityContext.privileged }}
           privileged: true
@@ -375,6 +380,10 @@ spec:
         - name: cilium-ipsec-secrets
           mountPath: {{ .Values.encryption.ipsec.mountPath }}
         {{- end }}
+        {{- if and .Values.encryption.enabled (eq .Values.encryption.type "ztunnel") }}
+        - name: cilium-ztunnel-secrets
+          mountPath: /etc/ztunnel
+        {{- end }}
         {{- if .Values.kubeConfigPath }}
         - name: kube-config
           mountPath: {{ .Values.kubeConfigPath }}
@@ -390,8 +399,14 @@ spec:
           mountPath: /var/lib/cilium/tls/hubble
           readOnly: true
         {{- end }}
+        {{- if $buildDaemonConfig }}
         - name: tmp
           mountPath: /tmp
+        {{- else }}
+        - name: cilium-config-path
+          mountPath: /tmp/cilium/config-map
+          readOnly: true
+        {{- end }}
         {{- range .Values.extraHostPathMounts }}
         - name: {{ .name }}
           mountPath: {{ .mountPath }}
@@ -447,6 +462,7 @@ spec:
       {{- toYaml .Values.extraContainers | nindent 6 }}
       {{- end }}
       initContainers:
+      {{- if $buildDaemonConfig }}
       - name: config
         image: {{ include "cilium.image" .Values.image | quote }}
         imagePullPolicy: {{ .Values.image.pullPolicy }}
@@ -513,6 +529,17 @@ spec:
         {{- toYaml . | nindent 8 }}
         {{- end }}
         terminationMessagePolicy: FallbackToLogsOnError
+        securityContext:
+          {{- if .Values.securityContext.privileged }}
+          privileged: true
+          {{- else }}
+          capabilities:
+            add:
+              - NET_ADMIN
+            drop:
+              - ALL
+          {{- end}}
+      {{- end }}
       {{- if .Values.cgroup.autoMount.enabled }}
       # Required to mount cgroup2 filesystem on the underlying Kubernetes node.
       # We use nsenter command with host's cgroup and mount namespaces enabled.
@@ -524,9 +551,12 @@ spec:
           value: {{ .Values.cgroup.hostRoot }}
         - name: BIN_PATH
           value: {{ .Values.cni.binPath }}
-        {{- with .Values.cgroup.autoMount.resources }}
+        {{- if .Values.cgroup.autoMount.resources }}
         resources:
-          {{- toYaml . | trim | nindent 10 }}
+          {{- toYaml .Values.cgroup.autoMount.resources | trim | nindent 10 }}
+        {{- else if .Values.initResources }}
+        resources:
+          {{- toYaml .Values.initResources | trim | nindent 10 }}
         {{- end }}
         command:
         - sh
@@ -821,7 +851,7 @@ spec:
       {{- end }}
       {{- if and .Values.clustermesh.config.enabled (not (and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.kvstoremesh.enabled )) }}
       hostAliases:
-      {{- range $cluster := .Values.clustermesh.config.clusters }}
+      {{- range $_, $cluster := (include "clustermesh-clusters" . | fromJson) }}
       {{- range $ip := $cluster.ips }}
       - ip: {{ $ip }}
         hostnames: [ "{{ $cluster.name }}.{{ $.Values.clustermesh.config.domain }}" ]
@@ -829,9 +859,20 @@ spec:
       {{- end }}
       {{- end }}
       volumes:
-        # For sharing configuration between the "config" initContainer and the agent
+      {{- if $buildDaemonConfig }}
+      # For sharing configuration between the "config" initContainer and the agent
       - name: tmp
+        {{- if .Values.tmpVolume }}
+          {{- toYaml .Values.tmpVolume | nindent 8 }}
+        {{- else }}
         emptyDir: {}
+        {{- end }}
+      {{- else }}
+      # To read the configuration from the config map
+      - name: cilium-config-path
+        configMap:
+          name: {{ trimPrefix "config-map:" .Values.daemon.configSources }}
+      {{- end }}
         # To keep state between restarts / upgrades
       - name: cilium-run
         hostPath:
@@ -992,6 +1033,11 @@ spec:
         secret:
           secretName: {{ .Values.encryption.ipsec.secretName }}
       {{- end }}
+      {{- if and .Values.encryption.enabled (eq .Values.encryption.type "ztunnel") }}
+      - name: cilium-ztunnel-secrets
+        secret:
+          secretName: cilium-ztunnel-secrets
+      {{- end }}
       {{- if .Values.cni.configMap }}
       - name: cni-configuration
         configMap:
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-agent/role.yaml b/packages/system/cilium/charts/cilium/templates/cilium-agent/role.yaml
index 89266e0d..df60d89b 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-agent/role.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-agent/role.yaml
@@ -120,7 +120,7 @@ rules:
   - watch
 {{- end}}
 
-{{- if and .Values.operator.enabled .Values.serviceAccounts.operator.create $readSecretsOnlyFromSecretsNamespace .Values.tls.secretsNamespace.name }}
+{{- if and .Values.agent (not .Values.preflight.enabled) .Values.serviceAccounts.cilium.create $readSecretsOnlyFromSecretsNamespace .Values.tls.secretsNamespace.name }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-agent/rolebinding.yaml b/packages/system/cilium/charts/cilium/templates/cilium-agent/rolebinding.yaml
index c76350b3..5caf2f15 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-agent/rolebinding.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-agent/rolebinding.yaml
@@ -126,7 +126,7 @@ subjects:
   namespace: {{ include "cilium.namespace" . }}
 {{- end}}
 
-{{- if and (not .Values.preflight.enabled) $readSecretsOnlyFromSecretsNamespace .Values.tls.secretsNamespace.name }}
+{{- if and .Values.agent (not .Values.preflight.enabled) .Values.serviceAccounts.cilium.create $readSecretsOnlyFromSecretsNamespace .Values.tls.secretsNamespace.name }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-ca-secret.yaml b/packages/system/cilium/charts/cilium/templates/cilium-ca-secret.yaml
index 7dd15d02..91569863 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-ca-secret.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-ca-secret.yaml
@@ -11,8 +11,13 @@ kind: Secret
 metadata:
   name: {{ .commonCASecretName }}
   namespace: {{ include "cilium.namespace" . }}
-  {{- with .Values.commonLabels }}
   labels:
+  {{- with .Values.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+    cilium.io/helm-template-non-idempotent: "true"
+  {{- with .Values.nonIdempotentAnnotations }}
+  annotations:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 data:
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-configmap.yaml b/packages/system/cilium/charts/cilium/templates/cilium-configmap.yaml
index a9bb1cd9..a3a38c09 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-configmap.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-configmap.yaml
@@ -33,12 +33,6 @@
   {{- end }}
   {{- $defaultBpfCtTcpMax = 0 -}}
   {{- $defaultBpfCtAnyMax = 0 -}}
-  {{- $defaultKubeProxyReplacement = "probe" -}}
-{{- end -}}
-
-{{- /* Default values when 1.9 was initially deployed */ -}}
-{{- if semverCompare ">=1.9" (default "1.9" .Values.upgradeCompatibility) -}}
-  {{- $defaultKubeProxyReplacement = "probe" -}}
 {{- end -}}
 
 {{- /* Default values when 1.10 was initially deployed */ -}}
@@ -52,7 +46,6 @@
   {{- if .Values.azure.enabled }}
       {{- $azureUsePrimaryAddress = "false" -}}
   {{- end }}
-  {{- $defaultKubeProxyReplacement = "disabled" -}}
   {{- $defaultDNSProxyEnableTransparentMode = "true" -}}
 {{- end -}}
 
@@ -71,6 +64,10 @@
   {{- end }}
 {{- end -}}
 {{- $ipam := (coalesce .Values.ipam.mode $defaultIPAM) -}}
+{{- if .Values.eni.enabled }}
+  {{- $ipam = "eni" -}}
+{{- end }}
+
 {{- $bpfCtTcpMax := (coalesce .Values.bpf.ctTcpMax $defaultBpfCtTcpMax) -}}
 {{- $bpfCtAnyMax := (coalesce .Values.bpf.ctAnyMax $defaultBpfCtAnyMax) -}}
 {{- $stringValueKPR := (toString .Values.kubeProxyReplacement) -}}
@@ -258,6 +255,14 @@ data:
   operator-prometheus-serve-addr: ":{{ .Values.operator.prometheus.port }}"
   enable-metrics: "true"
 {{- end }}
+{{- if and .Values.operator.prometheus.enabled .Values.operator.prometheus.tls.enabled }}
+  operator-prometheus-enable-tls: "true"
+  operator-prometheus-tls-cert-file: /var/lib/cilium/tls/prometheus/server.crt
+  operator-prometheus-tls-key-file: /var/lib/cilium/tls/prometheus/server.key
+  {{- if .Values.operator.prometheus.tls.server.mtls.enabled }}
+  operator-prometheus-tls-client-ca-files: /var/lib/cilium/tls/prometheus/client-ca.crt
+  {{- end }}
+{{- end }}
 
 {{- if .Values.operator.skipCRDCreation }}
   skip-crd-creation: "true"
@@ -456,6 +461,9 @@ data:
   # policy map (per endpoint)
   bpf-policy-map-max: "{{ .Values.bpf.policyMapMax | int }}"
 {{- end }}
+{{- if has (kindOf .Values.bpf.policyMapPressureMetricsThreshold) (list "int64" "float64") }}
+  bpf-policy-map-pressure-metrics-threshold: {{ .Values.bpf.policyMapPressureMetricsThreshold | quote }}
+{{- end }}
 {{- if hasKey .Values.bpf "policyStatsMapMax" }}
   # bpf-policy-stats-map-max specifies the maximum number of entries in global
   # policy stats map
@@ -505,7 +513,7 @@ data:
   cluster-name: {{ .Values.cluster.name | quote }}
 
 {{- if hasKey .Values.cluster "id" }}
-  # Unique ID of the cluster. Must be unique across all conneted clusters and
+  # Unique ID of the cluster. Must be unique across all connected clusters and
   # in the range of 1 and 255. Only relevant when building a mesh of clusters.
   cluster-id: "{{ .Values.cluster.id }}"
 {{- end }}
@@ -526,7 +534,7 @@ data:
   {{- end }}
 {{- end }}
 
-  routing-mode: {{ .Values.routingMode | default (ternary "native" "tunnel" .Values.gke.enabled) | quote }}
+  routing-mode: {{ .Values.routingMode | default (ternary "native" "tunnel" (or .Values.eni.enabled .Values.gke.enabled)) | quote }}
   tunnel-protocol: {{ .Values.tunnelProtocol | default "vxlan" | quote }}
 
 {{- if eq .Values.routingMode "native" }}
@@ -558,6 +566,10 @@ data:
   service-no-backend-response: "{{ .Values.serviceNoBackendResponse }}"
 {{- end}}
 
+{{- if .Values.policyDenyResponse }}
+  policy-deny-response: "{{ .Values.policyDenyResponse }}"
+{{- end}}
+
 {{- if .Values.MTU }}
   mtu: {{ .Values.MTU | quote }}
 {{- end }}
@@ -575,6 +587,35 @@ data:
 {{- end }}
   ec2-api-endpoint: {{ .Values.eni.ec2APIEndpoint | quote }}
   eni-tags: {{ .Values.eni.eniTags | toRawJson | quote }}
+{{- if .Values.eni.nodeSpec }}
+  {{- if ne .Values.eni.nodeSpec.firstInterfaceIndex nil }}
+  eni-first-interface-index: {{ .Values.eni.nodeSpec.firstInterfaceIndex | quote }}
+  {{- end }}
+  {{- if .Values.eni.nodeSpec.subnetIDs }}
+  eni-subnet-ids: {{ .Values.eni.nodeSpec.subnetIDs | join "," | quote }}
+  {{- end }}
+  {{- if .Values.eni.nodeSpec.subnetTags }}
+  eni-subnet-tags: {{ .Values.eni.nodeSpec.subnetTags | join "," | quote }}
+  {{- end }}
+  {{- if .Values.eni.nodeSpec.securityGroups }}
+  eni-security-groups: {{ .Values.eni.nodeSpec.securityGroups | join "," | quote }}
+  {{- end }}
+  {{- if .Values.eni.nodeSpec.securityGroupTags }}
+  eni-security-group-tags: {{ .Values.eni.nodeSpec.securityGroupTags | join "," | quote }}
+  {{- end }}
+  {{- if .Values.eni.nodeSpec.excludeInterfaceTags }}
+  eni-exclude-interface-tags: {{ .Values.eni.nodeSpec.excludeInterfaceTags | join "," | quote }}
+  {{- end }}
+  {{- if .Values.eni.nodeSpec.usePrimaryAddress }}
+  eni-use-primary-address: "true"
+  {{- end }}
+  {{- if .Values.eni.nodeSpec.disablePrefixDelegation }}
+  eni-disable-prefix-delegation: "true"
+  {{- end }}
+  {{- if ne .Values.eni.nodeSpec.deleteOnTermination nil }}
+  eni-delete-on-termination: {{ .Values.eni.nodeSpec.deleteOnTermination | quote }}
+  {{- end }}
+{{- end }}
 {{- if .Values.eni.subnetIDsFilter }}
   subnet-ids-filter: {{ .Values.eni.subnetIDsFilter | join " " | quote }}
 {{- end }}
@@ -600,17 +641,39 @@ data:
 {{- end }}
   azure-use-primary-address: {{ $azureUsePrimaryAddress | quote }}
 {{- end }}
+{{- if .Values.azure.nodeSpec.azureInterfaceName }}
+  azure-interface-name: {{ .Values.azure.nodeSpec.azureInterfaceName | quote }}
+{{- end }}
 
 {{- if .Values.alibabacloud.enabled }}
   enable-endpoint-routes: "true"
   auto-create-cilium-node-resource: "true"
 {{- end }}
+{{- if .Values.alibabacloud.nodeSpec.vSwitches }}
+  alibabacloud-vswitches: {{ .Values.alibabacloud.nodeSpec.vSwitches | join "," | quote }}
+{{- end }}
+{{- if .Values.alibabacloud.nodeSpec.vSwitchTags }}
+  alibabacloud-vswitch-tags: {{ .Values.alibabacloud.nodeSpec.vSwitchTags | join "," | quote }}
+{{- end }}
+{{- if .Values.alibabacloud.nodeSpec.securityGroups }}
+  alibabacloud-security-groups: {{ .Values.alibabacloud.nodeSpec.securityGroups | join "," | quote }}
+{{- end }}
+{{- if .Values.alibabacloud.nodeSpec.securityGroupTags }}
+  alibabacloud-security-group-tags: {{ .Values.alibabacloud.nodeSpec.securityGroupTags | join "," | quote }}
+{{- end }}
 
 {{- if hasKey .Values "l7Proxy" }}
   # Enables L7 proxy for L7 policy enforcement and visibility
   enable-l7-proxy: {{ .Values.l7Proxy | quote }}
 {{- end }}
 
+{{- if hasKey .Values "standaloneDnsProxy" }}
+  {{- if .Values.standaloneDnsProxy.enabled }}
+  enable-standalone-dns-proxy: {{ .Values.standaloneDnsProxy.enabled | quote }}
+  standalone-dns-proxy-server-port: {{ .Values.standaloneDnsProxy.serverPort | quote }}
+  {{- end }}
+{{- end }}
+
 {{- if ne $cniChainingMode "none" }}
   # Enable chaining with another CNI plugin
   #
@@ -643,6 +706,7 @@ data:
   enable-ipv4-big-tcp: {{ .Values.enableIPv4BIGTCP | quote }}
   enable-ipv6-big-tcp: {{ .Values.enableIPv6BIGTCP | quote }}
   enable-ipv6-masquerade: {{ .Values.enableIPv6Masquerade | quote }}
+  enable-tunnel-big-tcp: {{ .Values.enableTunnelBIGTCP | quote }}
 
 {{- if hasKey .Values.bpf "enableTCX" }}
   enable-tcx: {{ .Values.bpf.enableTCX | quote }}
@@ -687,6 +751,8 @@ data:
     {{- if .Values.encryption.wireguard.persistentKeepalive }}
   wireguard-persistent-keepalive: {{ .Values.encryption.wireguard.persistentKeepalive | quote }}
     {{- end }}
+  {{- else if eq .Values.encryption.type "ztunnel" }}
+  enable-ztunnel: {{ .Values.encryption.enabled | quote }}
   {{- end }}
   {{- if .Values.encryption.nodeEncryption }}
   encrypt-node: {{ .Values.encryption.nodeEncryption | quote }}
@@ -694,11 +760,20 @@ data:
 {{- end }}
 
 {{- if .Values.encryption.strictMode.enabled }}
-  enable-encryption-strict-mode: {{ .Values.encryption.strictMode.enabled | quote }}
+  # --- DEPRECATED: Please use encryption.strictMode.egress.enabled instead
+  enable-encryption-strict-mode-egress: {{ .Values.encryption.strictMode.enabled | quote }}
+  encryption-strict-egress-cidr: {{ .Values.encryption.strictMode.cidr | quote }}
+  encryption-strict-egress-allow-remote-node-identities: {{ .Values.encryption.strictMode.allowRemoteNodeIdentities | quote }}
+{{- end }}
 
-  encryption-strict-mode-cidr: {{ .Values.encryption.strictMode.cidr | quote }}
+{{- if .Values.encryption.strictMode.ingress.enabled }}
+  enable-encryption-strict-mode-ingress: {{ .Values.encryption.strictMode.ingress.enabled | quote }}
+{{- end }}
 
-  encryption-strict-mode-allow-remote-node-identities: {{ .Values.encryption.strictMode.allowRemoteNodeIdentities | quote }}
+{{- if .Values.encryption.strictMode.egress.enabled }}
+  enable-encryption-strict-mode-egress: {{ .Values.encryption.strictMode.egress.enabled | quote }}
+  encryption-strict-egress-cidr: {{ .Values.encryption.strictMode.egress.cidr | quote }}
+  encryption-strict-egress-allow-remote-node-identities: {{ .Values.encryption.strictMode.egress.allowRemoteNodeIdentities | quote }}
 {{- end }}
 
   enable-xt-socket-fallback: {{ .Values.enableXTSocketFallback | quote }}
@@ -773,6 +848,10 @@ data:
   kube-proxy-replacement-healthz-bind-address: {{ default "" .Values.kubeProxyReplacementHealthzBindAddr | quote}}
 {{- end }}
 
+{{- if hasKey .Values "enableNoServiceEndpointsRoutable" }}
+  enable-no-service-endpoints-routable: {{ .Values.enableNoServiceEndpointsRoutable | quote }}
+{{- end }}
+
 {{- if $socketLB }}
 {{- if hasKey $socketLB "enabled" }}
   bpf-lb-sock: {{ $socketLB.enabled | quote }}
@@ -789,9 +868,6 @@ data:
 {{- end }}
 
 {{- if hasKey .Values "nodePort" }}
-{{- if eq $kubeProxyReplacement "false" }}
-  enable-node-port: {{ .Values.nodePort.enabled | quote }}
-{{- end }}
 {{- if hasKey .Values.nodePort "range" }}
   node-port-range: {{ get .Values.nodePort "range" | quote }}
 {{- end }}
@@ -832,10 +908,6 @@ data:
   enable-service-topology: {{ .Values.loadBalancer.serviceTopology | quote }}
 # {{- end }}
 
-{{- if hasKey .Values.loadBalancer "protocolDifferentiation" }}
-  bpf-lb-proto-diff: {{ .Values.loadBalancer.protocolDifferentiation.enabled | quote }}
-{{- end }}
-
 {{- end }}
 {{- if hasKey .Values.maglev "tableSize" }}
   bpf-lb-maglev-table-size: {{ .Values.maglev.tableSize | quote}}
@@ -843,11 +915,9 @@ data:
 {{- if hasKey .Values.maglev "hashSeed" }}
   bpf-lb-maglev-hash-seed: {{ .Values.maglev.hashSeed | quote}}
 {{- end }}
-{{- if .Values.sessionAffinity }}
-  enable-session-affinity: {{ .Values.sessionAffinity | quote }}
-{{- end }}
-{{- if .Values.svcSourceRangeCheck }}
-  enable-svc-source-range-check: {{ .Values.svcSourceRangeCheck | quote }}
+
+{{- if .Values.bpf.monitorTraceIPOption }}
+  ip-tracing-option-type: {{ .Values.bpf.monitorTraceIPOption | quote }}
 {{- end }}
 
 {{- if hasKey .Values "l2NeighDiscovery" }}
@@ -860,12 +930,16 @@ data:
   pprof: {{ .Values.pprof.enabled | quote }}
   pprof-address: {{ .Values.pprof.address | quote }}
   pprof-port: {{ .Values.pprof.port | quote }}
+  pprof-mutex-profile-fraction: {{ .Values.pprof.mutexProfileFraction | quote }}
+  pprof-block-profile-rate: {{ .Values.pprof.blockProfileRate | quote }}
 {{- end }}
 
 {{- if .Values.operator.pprof.enabled }}
   operator-pprof: {{ .Values.operator.pprof.enabled | quote }}
   operator-pprof-address: {{ .Values.operator.pprof.address | quote }}
   operator-pprof-port: {{ .Values.operator.pprof.port | quote }}
+  operator-pprof-mutex-profile-fraction: {{ .Values.operator.pprof.mutexProfileFraction | quote }}
+  operator-pprof-block-profile-rate: {{ .Values.operator.pprof.blockProfileRate | quote }}
 {{- end }}
 
 {{- if .Values.logSystemLoad }}
@@ -973,6 +1047,10 @@ data:
   # Capacity of the buffer to store recent events.
   hubble-event-buffer-capacity: {{ .Values.hubble.eventBufferCapacity | quote }}
 {{- end }}
+{{- if hasKey .Values.hubble "lostEventSendInterval" }}
+  # Interval to send lost events from Observer server.
+  hubble-lost-event-send-interval: {{ include "validateDuration" .Values.hubble.lostEventSendInterval | quote }}
+{{- end }}
 {{- if or .Values.hubble.metrics.enabled .Values.hubble.metrics.dynamic.enabled}}
   # Address to expose Hubble metrics (e.g. ":7070"). Metrics server will be disabled if this
   # field is not set.
@@ -1040,8 +1118,10 @@ data:
   hubble-export-file-max-size-mb: {{ .Values.hubble.export.fileMaxSizeMb | default .Values.hubble.export.static.fileMaxSizeMb | quote }}
   hubble-export-file-max-backups: {{ .Values.hubble.export.fileMaxBackups | default .Values.hubble.export.static.fileMaxBackups | quote }}
   hubble-export-file-compress: {{ .Values.hubble.export.fileCompress | default .Values.hubble.export.static.fileCompress | quote }}
+  hubble-export-aggregation-interval: {{ include "validateDuration" .Values.hubble.export.aggregationInterval | default .Values.hubble.export.static.aggregationInterval | quote }}
   hubble-export-file-path: {{ .Values.hubble.export.static.filePath | quote }}
   hubble-export-fieldmask: {{ .Values.hubble.export.static.fieldMask | join " " | quote }}
+  hubble-export-fieldaggregate: {{ .Values.hubble.export.static.fieldAggregate | join " " | quote }}
   hubble-export-allowlist: {{ .Values.hubble.export.static.allowList | join " " | quote }}
   hubble-export-denylist: {{ .Values.hubble.export.static.denyList | join " " | quote }}
 {{- end }}
@@ -1078,10 +1158,28 @@ data:
   disable-iptables-feeder-rules: {{ .Values.disableIptablesFeederRules | join " " | quote }}
 {{- end }}
 {{- if .Values.aksbyocni.enabled }}
+  {{- if or (not .Values.ipam.mode) (eq .Values.ipam.mode "cluster-pool") }}
   ipam: "cluster-pool"
+  {{- else if eq .Values.ipam.mode "multi-pool" }}
+  ipam: "multi-pool"
+  {{- end }}
 {{- else }}
   ipam: {{ $ipam | quote }}
 {{- end }}
+{{- if .Values.ipam.nodeSpec }}
+  {{- if ne .Values.ipam.nodeSpec.ipamMinAllocate nil }}
+  ipam-min-allocate: {{ .Values.ipam.nodeSpec.ipamMinAllocate | quote }}
+  {{- end }}
+  {{- if ne .Values.ipam.nodeSpec.ipamPreAllocate nil }}
+  ipam-pre-allocate: {{ .Values.ipam.nodeSpec.ipamPreAllocate | quote }}
+  {{- end }}
+  {{- if ne .Values.ipam.nodeSpec.ipamMaxAllocate nil }}
+  ipam-max-allocate: {{ .Values.ipam.nodeSpec.ipamMaxAllocate | quote }}
+  {{- end }}
+  {{- if .Values.ipam.nodeSpec.ipamStaticIPTags }}
+  ipam-static-ip-tags: {{ .Values.ipam.nodeSpec.ipamStaticIPTags | join "," | quote }}
+  {{- end }}
+{{- end }}
 {{- if .Values.ipam.multiPoolPreAllocation }}
   ipam-multi-pool-pre-allocation: {{ .Values.ipam.multiPoolPreAllocation | quote }}
 {{- end }}
@@ -1092,18 +1190,10 @@ data:
 
 {{- if (eq $ipam "cluster-pool") }}
 {{- if .Values.ipv4.enabled }}
-  {{- if hasKey .Values.ipam.operator "clusterPoolIPv4PodCIDR" }}
-    {{- /* ipam.operator.clusterPoolIPv4PodCIDR removed in v1.14, remove this failsafe around v1.17 */ -}}
-    {{- fail "Value ipam.operator.clusterPoolIPv4PodCIDR removed, use ipam.operator.clusterPoolIPv4PodCIDRList instead" }}
-  {{- end }}
   cluster-pool-ipv4-cidr: {{ .Values.ipam.operator.clusterPoolIPv4PodCIDRList | join " " | quote }}
   cluster-pool-ipv4-mask-size: {{ .Values.ipam.operator.clusterPoolIPv4MaskSize | quote }}
 {{- end }}
 {{- if .Values.ipv6.enabled }}
-  {{- if hasKey .Values.ipam.operator "clusterPoolIPv6PodCIDR" }}
-    {{- /* ipam.operator.clusterPoolIPv6PodCIDR removed in v1.14, remove this failsafe around v1.17 */ -}}
-    {{- fail "Value ipam.operator.clusterPoolIPv6PodCIDR removed, use ipam.operator.clusterPoolIPv6PodCIDRList instead" }}
-  {{- end }}
   cluster-pool-ipv6-cidr: {{ .Values.ipam.operator.clusterPoolIPv6PodCIDRList | join " " | quote }}
   cluster-pool-ipv6-mask-size: {{ .Values.ipam.operator.clusterPoolIPv6MaskSize | quote }}
 {{- end }}
@@ -1172,20 +1262,11 @@ data:
   crd-wait-timeout: {{ include "validateDuration" .Values.crdWaitTimeout | quote }}
 {{- end }}
 
-{{- if .Values.enableK8sEndpointSlice }}
-  enable-k8s-endpoint-slice: {{ .Values.enableK8sEndpointSlice | quote }}
-{{- end }}
-
 {{- if hasKey .Values.k8s "serviceProxyName" }}
   # Configure service proxy name for Cilium.
   k8s-service-proxy-name: {{ .Values.k8s.serviceProxyName | quote }}
 {{- end }}
 
-{{- if and .Values.customCalls .Values.customCalls.enabled }}
-  # Enable tail call hooks for custom eBPF programs.
-  enable-custom-calls: {{ .Values.customCalls.enabled | quote }}
-{{- end }}
-
 {{- if .Values.l2announcements.enabled }}
   # Enable L2 announcements
   enable-l2-announcements: {{ .Values.l2announcements.enabled | quote }}
@@ -1222,6 +1303,8 @@ data:
   enable-pmtu-discovery: "true"
 {{- end }}
 
+  packetization-layer-pmtud-mode: {{ .Values.pmtuDiscovery.packetizationLayerPMTUDMode | quote }}
+
 {{- if not .Values.securityContext.privileged }}
   procfs: "/host/proc"
 {{- end }}
@@ -1296,11 +1379,20 @@ data:
 {{- end }}
 
 {{- if .Values.operator.unmanagedPodWatcher.restart }}
-  unmanaged-pod-watcher-interval: {{ .Values.operator.unmanagedPodWatcher.intervalSeconds | quote }}
+  {{- $interval := .Values.operator.unmanagedPodWatcher.intervalSeconds }}
+  {{- if kindIs "float64" $interval }}
+  unmanaged-pod-watcher-interval: {{ printf "%ds" (int $interval) | quote }}
+  {{- else }}
+  unmanaged-pod-watcher-interval: {{ $interval | quote }}
+  {{- end }}
 {{- else }}
   unmanaged-pod-watcher-interval: "0"
 {{- end }}
 
+{{- if ne .Values.operator.unmanagedPodWatcher.selector nil }}
+  pod-restart-selector: {{ .Values.operator.unmanagedPodWatcher.selector }}
+{{- end }}
+
 {{- if .Values.dnsProxy }}
   {{- if hasKey .Values.dnsProxy "enableTransparentMode" }}
   # explicit setting gets precedence
@@ -1370,10 +1462,14 @@ data:
   proxy-xff-num-trusted-hops-egress: {{ .Values.envoy.xffNumTrustedHopsL7PolicyEgress | quote }}
   proxy-connect-timeout: {{ .Values.envoy.connectTimeoutSeconds | quote }}
   proxy-initial-fetch-timeout: {{ .Values.envoy.initialFetchTimeoutSeconds | quote }}
+  proxy-max-active-downstream-connections: {{ .Values.envoy.maxGlobalDownstreamConnections | quote }}
   proxy-max-requests-per-connection: {{ .Values.envoy.maxRequestsPerConnection | quote }}
   proxy-max-connection-duration-seconds: {{ .Values.envoy.maxConnectionDurationSeconds | quote }}
   proxy-idle-timeout-seconds: {{ .Values.envoy.idleTimeoutDurationSeconds | quote }}
   proxy-max-concurrent-retries: {{ .Values.envoy.maxConcurrentRetries | quote }}
+  proxy-use-original-source-address: {{ .Values.envoy.useOriginalSourceAddress | quote }}
+  proxy-cluster-max-connections: {{ .Values.envoy.clusterMaxConnections | quote }}
+  proxy-cluster-max-requests: {{ .Values.envoy.clusterMaxRequests | quote }}
   http-retry-count: {{ .Values.envoy.httpRetryCount | quote }}
   http-stream-idle-timeout: {{ .Values.envoy.streamIdleTimeoutDurationSeconds | quote }}
 
@@ -1402,13 +1498,14 @@ data:
 {{- if hasKey .Values.clustermesh "maxConnectedClusters" }}
   max-connected-clusters: {{ .Values.clustermesh.maxConnectedClusters | quote }}
 {{- end }}
+  clustermesh-cache-ttl: {{ .Values.clustermesh.cacheTTL | quote }}
   clustermesh-enable-endpoint-sync: {{ .Values.clustermesh.enableEndpointSliceSynchronization | quote }}
-  clustermesh-enable-mcs-api: {{ .Values.clustermesh.enableMCSAPISupport | quote }}
+  clustermesh-enable-mcs-api: {{ (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) | quote }}
+  clustermesh-mcs-api-install-crds: {{ .Values.clustermesh.mcsapi.installCRDs | quote }}
   policy-default-local-cluster: {{ .Values.clustermesh.policyDefaultLocalCluster | quote }}
 
   nat-map-stats-entries: {{ .Values.nat.mapStatsEntries | quote }}
   nat-map-stats-interval: {{ .Values.nat.mapStatsInterval | quote }}
-  enable-internal-traffic-policy: {{ .Values.enableInternalTrafficPolicy | quote }}
   enable-lb-ipam: {{ .Values.enableLBIPAM | quote }}
   enable-non-default-deny-policies: {{ .Values.enableNonDefaultDenyPolicies | quote }}
 
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-envoy/daemonset.yaml b/packages/system/cilium/charts/cilium/templates/cilium-envoy/daemonset.yaml
index a5decd02..2afc2e97 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-envoy/daemonset.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-envoy/daemonset.yaml
@@ -22,10 +22,7 @@ spec:
   selector:
     matchLabels:
       k8s-app: cilium-envoy
-  {{- with .Values.envoy.updateStrategy }}
-  updateStrategy:
-    {{- toYaml . | trim | nindent 4 }}
-  {{- end }}
+  {{- include "envoy.updateStrategy" . | nindent 2 }}
   template:
     metadata:
       annotations:
@@ -69,6 +66,7 @@ spec:
       securityContext:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- include "envoy.initContainers" . | nindent 6 }}
       containers:
       - name: cilium-envoy
         image: {{ include "cilium.image" .Values.envoy.image | quote }}
@@ -94,6 +92,7 @@ spec:
         {{- if .Values.envoy.log.path }}
         - '--log-path {{ .Values.envoy.log.path }}'
         {{- end }}
+        {{- include "envoy.args.extra" . | nindent 8 }}
         {{- with .Values.envoy.extraArgs }}
         {{- toYaml . | trim | nindent 8 }}
         {{- end }}
@@ -157,6 +156,7 @@ spec:
         - name: KUBERNETES_SERVICE_PORT
           value: {{ include "k8sServicePort" . }}
         {{- end }}
+        {{- include "envoy.env.extra" . | nindent 8 }}
         {{- with .Values.envoy.extraEnv }}
         {{- toYaml . | trim | nindent 8 }}
         {{- end }}
@@ -164,19 +164,7 @@ spec:
         resources:
           {{- toYaml . | trim | nindent 10 }}
         {{- end }}
-        {{- if .Values.envoy.prometheus.enabled }}
-        ports:
-        - name: envoy-metrics
-          containerPort: {{ .Values.envoy.prometheus.port }}
-          hostPort: {{ .Values.envoy.prometheus.port }}
-          protocol: TCP
-        {{- if and .Values.envoy.debug.admin.enabled .Values.envoy.debug.admin.port }}
-        - name: envoy-admin
-          containerPort: {{ .Values.envoy.debug.admin.port }}
-          hostPort: {{ .Values.envoy.debug.admin.port }}
-          protocol: TCP
-        {{- end }}
-        {{- end }}
+        {{- include "envoy.ports" . }}
         securityContext:
           {{- if .Values.envoy.securityContext.privileged }}
           privileged: true
@@ -209,6 +197,7 @@ spec:
           mountPath: /sys/fs/bpf
           mountPropagation: HostToContainer
         {{- end }}
+        {{- include "envoy.volumeMounts.extra" . | nindent 8 }}
         {{- range .Values.envoy.extraHostPathMounts }}
         - name: {{ .name }}
           mountPath: {{ .mountPath }}
@@ -232,10 +221,7 @@ spec:
       {{- if .Values.envoy.dnsPolicy }}
       dnsPolicy: {{ .Values.envoy.dnsPolicy }}
       {{- end }}
-      {{- with .Values.envoy.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+      {{- include "envoy.affinity" . | nindent 6  }}
       {{- with .Values.envoy.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
@@ -269,6 +255,7 @@ spec:
           path: /sys/fs/bpf
           type: DirectoryOrCreate
       {{- end }}
+      {{- include "envoy.hostPathMounts.extra" . | nindent 4 }}
       {{- range .Values.envoy.extraHostPathMounts }}
       - name: {{ .name }}
         hostPath:
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-envoy/service.yaml b/packages/system/cilium/charts/cilium/templates/cilium-envoy/service.yaml
index 6b982c28..8da47943 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-envoy/service.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-envoy/service.yaml
@@ -32,5 +32,5 @@ spec:
   - name: envoy-metrics
     port: {{ .Values.envoy.prometheus.port }}
     protocol: TCP
-    targetPort: envoy-metrics
+    targetPort: {{ .Values.envoy.prometheus.port }}
 {{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-ingress-service.yaml b/packages/system/cilium/charts/cilium/templates/cilium-ingress-service.yaml
index 5d16d7ca..f25afeee 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-ingress-service.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-ingress-service.yaml
@@ -49,8 +49,8 @@ spec:
   externalTrafficPolicy: {{ .Values.ingressController.service.externalTrafficPolicy }}
   {{- end }}
 ---
-apiVersion: v1
-kind: Endpoints
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
 metadata:
   name: {{ .Values.ingressController.service.name }}
   namespace: {{ include "cilium.namespace" . }}
@@ -65,9 +65,10 @@ metadata:
   annotations:
     {{- toYaml .Values.ingressController.service.annotations | nindent 4 }}
   {{- end }}
-subsets:
+addressType: IPv4
+endpoints:
 - addresses:
-  - ip: "192.192.192.192"
-  ports:
-  - port: 9999
+  - "192.192.192.192"
+ports:
+- port: 9999
 {{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-nodeinit/daemonset.yaml b/packages/system/cilium/charts/cilium/templates/cilium-nodeinit/daemonset.yaml
index add6ae5a..4edbeada 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-nodeinit/daemonset.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-nodeinit/daemonset.yaml
@@ -122,6 +122,8 @@ spec:
       {{- if .Values.serviceAccounts.nodeinit.enabled }}
       serviceAccountName: {{ .Values.serviceAccounts.nodeinit.name | quote }}
       automountServiceAccountToken: {{ .Values.serviceAccounts.nodeinit.automount }}
+      {{- else }}
+      automountServiceAccountToken: false
       {{- end }}
       {{- with .Values.nodeinit.extraVolumes }}
       volumes:
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-operator/clusterrole.yaml b/packages/system/cilium/charts/cilium/templates/cilium-operator/clusterrole.yaml
index 4fcb5985..96f72c7f 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-operator/clusterrole.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-operator/clusterrole.yaml
@@ -69,7 +69,7 @@ rules:
   resources:
   - endpointslices
   verbs:
-{{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.enableMCSAPISupport }}
+{{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }}
   - create
   - update
   - delete
@@ -78,6 +78,17 @@ rules:
   - get
   - list
   - watch
+{{- if .Values.clustermesh.enableEndpointSliceSynchronization }}
+- apiGroups:
+  - ""
+  resources:
+  # The controller needs to be able to set a service's finalizers to be able to create an EndpointSlice
+  # resource that is owned by the service and sets blockOwnerDeletion=true in its ownerRef.
+  # This is required when the admission plugin OwnerReferencesPermissionEnforcement is activated.
+  - services/finalizers
+  verbs:
+  - update
+{{- end }}
 - apiGroups:
   - ""
   resources:
@@ -114,6 +125,20 @@ rules:
   - delete
   - patch
 {{- end }}
+{{- if or .Values.ingressController.enabled .Values.gatewayAPI.enabled }}
+- apiGroups:
+  - "discovery.k8s.io"
+  resources:
+  - endpointslices
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - delete
+  - patch
+{{- end }}
 {{- if .Values.clustermesh.enableEndpointSliceSynchronization }}
 - apiGroups:
   - ""
@@ -227,7 +252,6 @@ rules:
   - update
   resourceNames:
   - ciliumloadbalancerippools.cilium.io
-  - ciliumbgppeeringpolicies.cilium.io
   - ciliumbgpclusterconfigs.cilium.io
   - ciliumbgppeerconfigs.cilium.io
   - ciliumbgpadvertisements.cilium.io
@@ -248,12 +272,15 @@ rules:
   - ciliuml2announcementpolicies.cilium.io
   - ciliumpodippools.cilium.io
   - ciliumgatewayclassconfigs.cilium.io
+{{- if and (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.mcsapi.installCRDs }}
+  - serviceimports.multicluster.x-k8s.io
+  - serviceexports.multicluster.x-k8s.io
+{{- end }}
 - apiGroups:
   - cilium.io
   resources:
   - ciliumloadbalancerippools
   - ciliumpodippools
-  - ciliumbgppeeringpolicies
   - ciliumbgpclusterconfigs
   - ciliumbgpnodeconfigoverrides
   - ciliumbgppeerconfigs
@@ -301,6 +328,10 @@ rules:
   - networking.k8s.io
   resources:
   - ingresses/status # To update ingress status with load balancer IP.
+  # The controller needs to be able to set ingress finalizers to be able to create a CiliumEnvoyConfig
+  # resource that is owned by the ingress, and set blockOwnerDeletion=true in its ownerRef.
+  # This is required when the admission plugin OwnerReferencesPermissionEnforcement is activated.
+  - ingresses/finalizers
   verbs:
   - update
 {{- end }}
@@ -352,7 +383,7 @@ rules:
   - update
   - patch
 {{- end }}
-{{- if or .Values.gatewayAPI.enabled .Values.clustermesh.enableMCSAPISupport }}
+{{- if or .Values.gatewayAPI.enabled .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }}
 - apiGroups:
   - multicluster.x-k8s.io
   resources:
@@ -361,14 +392,14 @@ rules:
   - get
   - list
   - watch
-{{- if .Values.clustermesh.enableMCSAPISupport }}
+{{- if or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }}
   - create
   - update
   - patch
   - delete
 {{- end }}
 {{- end }}
-{{- if .Values.clustermesh.enableMCSAPISupport }}
+{{- if or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }}
 - apiGroups:
   - multicluster.x-k8s.io
   resources:
@@ -401,4 +432,10 @@ rules:
   - patch
   - delete
 {{- end }}
+- apiGroups:
+  - cilium.io
+  resources:
+  - ciliumendpointslices
+  verbs:
+  - deletecollection
 {{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-operator/deployment.yaml b/packages/system/cilium/charts/cilium/templates/cilium-operator/deployment.yaml
index 606807f3..f4cddff8 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-operator/deployment.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-operator/deployment.yaml
@@ -98,7 +98,7 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.namespace
-        {{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.enableMCSAPISupport }}
+        {{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }}
         - name: CILIUM_CLUSTERMESH_CONFIG
           value: /var/lib/cilium/clustermesh/
         {{- end }}
@@ -170,6 +170,7 @@ spec:
         - name: AZURE_RESOURCE_GROUP
           value: {{ .Values.azure.resourceGroup }}
         {{- end }}
+        {{- if .Values.azure.clientID }}
         - name: AZURE_CLIENT_ID
           valueFrom:
             secretKeyRef:
@@ -181,11 +182,15 @@ spec:
               name: cilium-azure
               key: AZURE_CLIENT_SECRET
         {{- end }}
+        {{- end }}
         {{- with .Values.operator.extraEnv }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
-        {{- if .Values.operator.prometheus.enabled }}
         ports:
+        - name: health
+          containerPort: 9234
+          hostPort: 9234
+        {{- if .Values.operator.prometheus.enabled }}
         - name: prometheus
           containerPort: {{ .Values.operator.prometheus.port }}
         {{- if .Values.operator.hostNetwork }}
@@ -199,7 +204,7 @@ spec:
             host: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }}
         {{- end }}
             path: /healthz
-            port: 9234
+            port: health
             scheme: HTTP
           initialDelaySeconds: 60
           periodSeconds: 10
@@ -210,7 +215,7 @@ spec:
             host: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }}
         {{- end }}
             path: /healthz
-            port: 9234
+            port: health
             scheme: HTTP
           initialDelaySeconds: 0
           periodSeconds: 5
@@ -230,7 +235,7 @@ spec:
           readOnly: true
         {{- end }}
         {{- end }}
-        {{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.enableMCSAPISupport }}
+        {{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }}
         - name: clustermesh-secrets
           mountPath: /var/lib/cilium/clustermesh
           readOnly: true
@@ -245,6 +250,11 @@ spec:
           mountPath: {{ dir .Values.authentication.mutual.spire.agentSocketPath }}
           readOnly: true
         {{- end }}
+        {{- if and .Values.operator.prometheus.enabled .Values.operator.prometheus.tls.enabled }}
+        - name: prometheus-tls
+          mountPath: /var/lib/cilium/tls/prometheus
+          readOnly: true
+        {{- end }}
         {{- range .Values.operator.extraHostPathMounts }}
         - name: {{ .name }}
           mountPath: {{ .mountPath }}
@@ -256,13 +266,15 @@ spec:
         {{- with .Values.operator.extraVolumeMounts }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
+        {{- include "cilium-operator.volumeMounts.extra" . | nindent 8 }}
         {{- with .Values.operator.resources }}
         resources:
           {{- toYaml . | trim | nindent 10 }}
         {{- end }}
-        {{- with .Values.operator.securityContext }}
+        {{- $sc := include "cilium.operator.securityContext" . | trim }}
+        {{- if $sc }}
         securityContext:
-          {{- toYaml . | trim | nindent 10 }}
+          {{- $sc | nindent 10 }}
         {{- end }}
         terminationMessagePolicy: FallbackToLogsOnError
       hostNetwork: {{ .Values.operator.hostNetwork }}
@@ -295,23 +307,25 @@ spec:
       nodeSelector:
         {{- toYaml . | trim | nindent 8 }}
       {{- end }}
-      {{- if and (or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.config.enabled (not (and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.kvstoremesh.enabled )) }}
+      {{- if and (or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.config.enabled (not (and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.kvstoremesh.enabled )) }}
       hostAliases:
-      {{- range $cluster := .Values.clustermesh.config.clusters }}
+      {{- range $_, $cluster := (include "clustermesh-clusters" . | fromJson) }}
       {{- range $ip := $cluster.ips }}
       - ip: {{ $ip }}
         hostnames: [ "{{ $cluster.name }}.{{ $.Values.clustermesh.config.domain }}" ]
       {{- end }}
       {{- end }}
       {{- end }}
-      {{- with .Values.operator.tolerations }}
+      {{- if or (.Values.operator.tolerations) (hasKey .Values "agentNotReadyTaintKey") }}
       tolerations:
+      {{- with .Values.operator.tolerations }}
         {{- toYaml . | trim | nindent 8 }}
       {{- end }}
       {{- if hasKey .Values "agentNotReadyTaintKey" }}
         - key: {{ .Values.agentNotReadyTaintKey }}
           operator: Exists
       {{ end}}
+      {{- end}}
       volumes:
         # To read the configuration from the config map
       - name: cilium-config-path
@@ -360,7 +374,7 @@ spec:
       {{- with .Values.operator.extraVolumes }}
       {{- toYaml . | nindent 6 }}
       {{- end }}
-      {{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.enableMCSAPISupport }}
+      {{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }}
         # To read the clustermesh configuration
       - name: clustermesh-secrets
         projected:
@@ -417,4 +431,25 @@ spec:
                 path: local-etcd-client-ca.crt
           {{- end }}
       {{- end }}
+      {{- if and .Values.operator.prometheus.enabled .Values.operator.prometheus.tls.enabled }}
+      # To read the prometheus configuration
+      - name: prometheus-tls
+        projected:
+          # note: the leading zero means this number is in octal representation: do not remove it
+          defaultMode: 0400
+          sources:
+          - secret:
+              name: {{ .Values.operator.prometheus.tls.server.existingSecret }}
+              optional: true
+              items:
+                - key: tls.crt
+                  path: server.crt
+                - key: tls.key
+                  path: server.key
+                {{- if .Values.operator.prometheus.tls.server.mtls.enabled }}
+                - key: ca.crt
+                  path: client-ca.crt
+                {{- end }}
+      {{- end }}
+      {{- include "cilium-operator.volumes.extra" . | nindent 6 }}
 {{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-operator/role.yaml b/packages/system/cilium/charts/cilium/templates/cilium-operator/role.yaml
index 8f7acd9f..11515ced 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-operator/role.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-operator/role.yaml
@@ -83,3 +83,35 @@ rules:
   - update
   - patch
 {{- end }}
+
+{{- if and .Values.operator.enabled .Values.serviceAccounts.operator.create }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cilium-operator-ztunnel
+  namespace: {{ include "cilium.namespace" . }}
+  {{- with .Values.operator.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    app.kubernetes.io/part-of: cilium
+    {{- with .Values.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+rules:
+# ZTunnel DaemonSet management permissions
+# Note: These permissions must always be granted (not conditional on encryption.type)
+# because the controller needs to clean up stale DaemonSets when ztunnel is disabled.
+- apiGroups:
+  - apps
+  resources:
+  - daemonsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+{{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-operator/rolebinding.yaml b/packages/system/cilium/charts/cilium/templates/cilium-operator/rolebinding.yaml
index 56b89209..22ac17bc 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-operator/rolebinding.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-operator/rolebinding.yaml
@@ -77,3 +77,29 @@ subjects:
   name: {{ .Values.serviceAccounts.operator.name | quote }}
   namespace: {{ include "cilium.namespace" . }}
 {{- end }}
+
+{{- if and .Values.operator.enabled .Values.serviceAccounts.operator.create }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cilium-operator-ztunnel
+  namespace: {{ include "cilium.namespace" . }}
+  labels:
+    app.kubernetes.io/part-of: cilium
+    {{- with .Values.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.operator.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cilium-operator-ztunnel
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.serviceAccounts.operator.name | quote }}
+  namespace: {{ include "cilium.namespace" . }}
+{{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-operator/secret.yaml b/packages/system/cilium/charts/cilium/templates/cilium-operator/secret.yaml
index 4ac55d7a..6346e136 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-operator/secret.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-operator/secret.yaml
@@ -1,5 +1,6 @@
 {{- if .Values.operator.enabled }}
 {{- if .Values.azure.enabled }}
+{{- if .Values.azure.clientID }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -19,3 +20,4 @@ data:
   AZURE_CLIENT_SECRET: {{ default "" .Values.azure.clientSecret | b64enc | quote }}
 {{- end }}
 {{- end }}
+{{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-preflight/clusterrole.yaml b/packages/system/cilium/charts/cilium/templates/cilium-preflight/clusterrole.yaml
index bf0f07da..fbf511cd 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-preflight/clusterrole.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-preflight/clusterrole.yaml
@@ -94,7 +94,6 @@ rules:
   - cilium.io
   resources:
   - ciliumloadbalancerippools
-  - ciliumbgppeeringpolicies
   - ciliumbgpnodeconfigs
   - ciliumbgpadvertisements
   - ciliumbgppeerconfigs
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-secrets-namespace.yaml b/packages/system/cilium/charts/cilium/templates/cilium-secrets-namespace.yaml
index 944b0629..600ccfeb 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-secrets-namespace.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-secrets-namespace.yaml
@@ -20,6 +20,9 @@ metadata:
     {{- with $.Values.commonLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with $.Values.secretsNamespaceLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
   annotations:
     {{- with $.Values.secretsNamespaceAnnotations }}
     {{- toYaml . | nindent 4 }}
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/clusterrole.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/clusterrole.yaml
index 8565f585..88288eb8 100644
--- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/clusterrole.yaml
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/clusterrole.yaml
@@ -50,7 +50,7 @@ rules:
   - get
   - list
   - watch
-{{- if .Values.clustermesh.enableMCSAPISupport }}
+{{- if or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }}
 - apiGroups:
   - multicluster.x-k8s.io
   resources:
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/deployment.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/deployment.yaml
index b0366e3b..1146209a 100644
--- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/deployment.yaml
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/deployment.yaml
@@ -137,6 +137,7 @@ spec:
         - --advertise-client-urls=https://localhost:2379
         - --initial-cluster-token=$(INITIAL_CLUSTER_TOKEN)
         - --auto-compaction-retention=1
+        - --enable-grpc-gateway=false
         {{- if .Values.clustermesh.apiserver.metrics.etcd.enabled }}
         - --listen-metrics-urls=http://0.0.0.0:{{ .Values.clustermesh.apiserver.metrics.etcd.port }}
         - --metrics={{ .Values.clustermesh.apiserver.metrics.etcd.mode }}
@@ -208,12 +209,13 @@ spec:
         - --prometheus-serve-addr=:{{ .Values.clustermesh.apiserver.metrics.port }}
         - --controller-group-metrics=all
         {{- end }}
-        {{- if .Values.clustermesh.enableMCSAPISupport }}
+        {{- if or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }}
         - --clustermesh-enable-mcs-api
         {{- end }}
         {{- if .Values.ciliumEndpointSlice.enabled }}
         - --enable-cilium-endpoint-slice
         {{- end }}
+        {{- include "clustermesh.apiserver.args.extra" . | nindent 8 }}
         {{- with .Values.clustermesh.apiserver.extraArgs }}
         {{- toYaml . | trim | nindent 8 }}
         {{- end }}
@@ -303,12 +305,14 @@ spec:
         {{- if hasKey .Values.clustermesh "maxConnectedClusters" }}
         - --max-connected-clusters={{ .Values.clustermesh.maxConnectedClusters }}
         {{- end }}
+        - --clustermesh-cache-ttl={{ .Values.clustermesh.cacheTTL }}
         - --health-port={{ .Values.clustermesh.apiserver.kvstoremesh.healthPort }}
         {{- if .Values.clustermesh.apiserver.metrics.kvstoremesh.enabled }}
         - --prometheus-serve-addr=:{{ .Values.clustermesh.apiserver.metrics.kvstoremesh.port }}
         - --controller-group-metrics=all
         {{- end }}
         - --enable-heartbeat={{ eq "true" (include "identityAllocationCRD" .) | ternary "false" "true" }}
+        {{- include "clustermesh.kvstoremesh.args.extra" . | nindent 8 }}
         {{- with .Values.clustermesh.apiserver.kvstoremesh.extraArgs }}
         {{- toYaml . | trim | nindent 8 }}
         {{- end }}
@@ -505,7 +509,7 @@ spec:
       {{- end }}
       {{- if and .Values.clustermesh.config.enabled .Values.clustermesh.apiserver.kvstoremesh.enabled }}
       hostAliases:
-      {{- range $cluster := .Values.clustermesh.config.clusters }}
+      {{- range $_, $cluster := (include "clustermesh-clusters" . | fromJson) }}
       {{- range $ip := $cluster.ips }}
       - ip: {{ $ip }}
         hostnames: [ "{{ $cluster.name }}.{{ $.Values.clustermesh.config.domain }}" ]
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/service.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/service.yaml
index 6ef3f63f..5e20234b 100644
--- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/service.yaml
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/service.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") }}
+{{- if and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") (not .Values.clustermesh.apiserver.service.externallyCreated) }}
 apiVersion: v1
 kind: Service
 metadata:
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/_job-spec.tpl b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/_job-spec.tpl
index 7ba8cb12..2fdccf47 100644
--- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/_job-spec.tpl
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/_job-spec.tpl
@@ -9,10 +9,18 @@ spec:
         {{- toYaml . | nindent 8 }}
         {{- end }}
     spec:
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - name: certgen
           image: {{ include "cilium.image" .Values.certgen.image | quote }}
           imagePullPolicy: {{ .Values.certgen.image.pullPolicy }}
+          securityContext:
+            capabilities:
+              drop:
+              - ALL
+            allowPrivilegeEscalation: false
           {{- with .Values.certgen.resources }}
           resources:
           {{- toYaml . | nindent 12 }}
@@ -84,7 +92,7 @@ spec:
           volumeMounts:
           {{- toYaml . | nindent 10 }}
           {{- end }}
-      hostNetwork: true
+      hostNetwork: false
       {{- with .Values.certgen.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
@@ -96,7 +104,6 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      serviceAccount: {{ .Values.serviceAccounts.clustermeshcertgen.name | quote }}
       serviceAccountName: {{ .Values.serviceAccounts.clustermeshcertgen.name | quote }}
       automountServiceAccountToken: {{ .Values.serviceAccounts.clustermeshcertgen.automount }}
       {{- with .Values.imagePullSecrets }}
@@ -108,9 +115,11 @@ spec:
       volumes:
       {{- toYaml . | nindent 6 }}
       {{- end }}
-      affinity:
       {{- with .Values.certgen.affinity }}
+      affinity:
       {{- toYaml . | nindent 8 }}
       {{- end }}
-  ttlSecondsAfterFinished: {{ .Values.certgen.ttlSecondsAfterFinished }}
+  {{- with .Values.certgen.ttlSecondsAfterFinished }}
+  ttlSecondsAfterFinished: {{ . }}
+  {{- end }}
 {{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/cronjob.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/cronjob.yaml
index ebda21bd..4b88d92c 100644
--- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/cronjob.yaml
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/cronjob.yaml
@@ -16,6 +16,8 @@ metadata:
     {{- end }}
 spec:
   schedule: {{ .Values.clustermesh.apiserver.tls.auto.schedule | quote }}
+  successfulJobsHistoryLimit: {{ .Values.certgen.cronJob.successfulJobsHistoryLimit }}
+  failedJobsHistoryLimit: {{ .Values.certgen.cronJob.failedJobsHistoryLimit }}
   concurrencyPolicy: Forbid
   jobTemplate:
 {{- include "clustermesh-apiserver-generate-certs.job.spec" . | nindent 4 }}
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/job.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/job.yaml
index 72f8dc60..574aee13 100644
--- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/job.yaml
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/job.yaml
@@ -1,9 +1,18 @@
 {{- if and (and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal")) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "cronJob") }}
+{{/*
+Because Kubernetes job specs are immutable, Helm will fail patch this job if
+the spec changes between releases. To avoid breaking the upgrade path, we
+generate a name for the job here which is based on the checksum of the spec.
+This will cause the name of the job to change if its content changes,
+and in turn cause Helm to do delete the old job and replace it with a new one.
+*/}}
+{{- $jobSpec := include "clustermesh-apiserver-generate-certs.job.spec" . -}}
+{{- $checkSum := $jobSpec | sha256sum | trunc 10 -}}
 ---
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: clustermesh-apiserver-generate-certs
+  name: clustermesh-apiserver-generate-certs-{{$checkSum}}
   namespace: {{ include "cilium.namespace" . }}
   labels:
     k8s-app: clustermesh-apiserver-generate-certs
@@ -11,13 +20,14 @@ metadata:
     {{- toYaml . | nindent 4 }}
     {{- end }}
     app.kubernetes.io/part-of: cilium
+  {{- if or .Values.certgen.annotations.job .Values.clustermesh.annotations }}
   annotations:
-    "helm.sh/hook": post-install,post-upgrade
     {{- with .Values.certgen.annotations.job }}
-    {{- toYaml . | nindent 4 }}
+      {{- toYaml . | nindent 4 }}
     {{- end }}
     {{- with .Values.clustermesh.annotations }}
       {{- toYaml . | nindent 4 }}
     {{- end }}
-{{ include "clustermesh-apiserver-generate-certs.job.spec" . }}
+  {{- end }}
+{{ $jobSpec }}
 {{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/role.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/role.yaml
index 6e822701..1f6dc153 100644
--- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/role.yaml
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/role.yaml
@@ -38,7 +38,6 @@ rules:
       - clustermesh-apiserver-admin-cert
       - clustermesh-apiserver-remote-cert
       - clustermesh-apiserver-local-cert
-      - clustermesh-apiserver-client-cert
     verbs:
       - update
 {{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/admin-secret.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/admin-secret.yaml
index fa49c9ce..49325d14 100644
--- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/admin-secret.yaml
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/admin-secret.yaml
@@ -8,12 +8,16 @@ kind: Secret
 metadata:
   name: clustermesh-apiserver-admin-cert
   namespace: {{ include "cilium.namespace" . }}
-  {{- with .Values.commonLabels }}
   labels:
+  {{- with .Values.commonLabels }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
-  {{- with .Values.clustermesh.annotations }}
+    cilium.io/helm-template-non-idempotent: "true"
   annotations:
+  {{- with .Values.clustermesh.annotations }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.nonIdempotentAnnotations }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
 type: kubernetes.io/tls
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/local-secret.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/local-secret.yaml
index 0589a9e7..3d34bd68 100644
--- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/local-secret.yaml
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/local-secret.yaml
@@ -8,12 +8,16 @@ kind: Secret
 metadata:
   name: clustermesh-apiserver-local-cert
   namespace: {{ include "cilium.namespace" . }}
-  {{- with .Values.commonLabels }}
   labels:
+  {{- with .Values.commonLabels }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
-  {{- with .Values.clustermesh.annotations }}
+    cilium.io/helm-template-non-idempotent: "true"
   annotations:
+  {{- with .Values.clustermesh.annotations }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.nonIdempotentAnnotations }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
 type: kubernetes.io/tls
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/remote-secret.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/remote-secret.yaml
index 42afe0fe..11bfc51d 100644
--- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/remote-secret.yaml
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/remote-secret.yaml
@@ -8,12 +8,16 @@ kind: Secret
 metadata:
   name: clustermesh-apiserver-remote-cert
   namespace: {{ include "cilium.namespace" . }}
-  {{- with .Values.commonLabels }}
   labels:
+  {{- with .Values.commonLabels }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
-  {{- with .Values.clustermesh.annotations }}
+    cilium.io/helm-template-non-idempotent: "true"
   annotations:
+  {{- with .Values.clustermesh.annotations }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.nonIdempotentAnnotations }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
 type: kubernetes.io/tls
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/server-secret.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/server-secret.yaml
index e49478cb..0df9a20d 100644
--- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/server-secret.yaml
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/server-secret.yaml
@@ -10,12 +10,16 @@ kind: Secret
 metadata:
   name: clustermesh-apiserver-server-cert
   namespace: {{ include "cilium.namespace" . }}
-  {{- with .Values.commonLabels }}
   labels:
+  {{- with .Values.commonLabels }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
-  {{- with .Values.clustermesh.annotations }}
+    cilium.io/helm-template-non-idempotent: "true"
   annotations:
+  {{- with .Values.clustermesh.annotations }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.nonIdempotentAnnotations }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
 type: kubernetes.io/tls
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/users-configmap.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/users-configmap.yaml
index c736eb1e..d742e4e7 100644
--- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/users-configmap.yaml
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/users-configmap.yaml
@@ -1,5 +1,5 @@
 {{- if and
-  (and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") (eq "true" (include "identityAllocationCRD" .)))
+  (and .Values.clustermesh.useAPIServer .Values.clustermesh.config.enabled (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") (eq "true" (include "identityAllocationCRD" .)))
   (ne .Values.clustermesh.apiserver.tls.authMode "legacy")
 }}
 ---
@@ -21,7 +21,7 @@ metadata:
 data:
   users.yaml: |
     users:
-    {{- range .Values.clustermesh.config.clusters }}
+    {{- range (include "clustermesh-clusters" . | fromJson) }}
     - name: remote-{{ .name }}
       role: remote
     {{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-config/_helpers.tpl b/packages/system/cilium/charts/cilium/templates/clustermesh-config/_helpers.tpl
index 47c3393c..abe9bdb8 100644
--- a/packages/system/cilium/charts/cilium/templates/clustermesh-config/_helpers.tpl
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-config/_helpers.tpl
@@ -43,3 +43,26 @@ key-file: /var/lib/cilium/clustermesh/{{ $prefix }}etcd-client.key
 cert-file: /var/lib/cilium/clustermesh/{{ $prefix }}etcd-client.crt
 {{- end }}
 {{- end }}
+
+{{- define "clustermesh-clusters" }}
+{{- $clusters := dict }}
+{{- if kindIs "map" .Values.clustermesh.config.clusters }}
+  {{- range $name, $cluster := deepCopy .Values.clustermesh.config.clusters }}
+    {{- if ne $cluster.enabled false }}
+      {{- $_ := unset $cluster "enabled" }}
+      {{- $_ = set $cluster "name" $name }}
+      {{- $_ = set $clusters $name $cluster }}
+    {{- end }}
+  {{- end }}
+{{- else if kindIs "slice" .Values.clustermesh.config.clusters }}
+  {{- range $cluster := deepCopy .Values.clustermesh.config.clusters }}
+    {{- if ne $cluster.enabled false }}
+      {{- $_ := unset $cluster "enabled" }}
+      {{- $_ := set $clusters $cluster.name $cluster }}
+    {{- end }}
+  {{- end }}
+{{- else }}
+  {{- fail (printf "unknown type %s for clustermesh.config.clusters" (kindOf .Values.clustermesh.config.clusters)) }}
+{{- end }}
+{{- toJson $clusters }}
+{{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-config/clustermesh-secret.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-config/clustermesh-secret.yaml
index 5a3a7aa8..d60d6f1c 100644
--- a/packages/system/cilium/charts/cilium/templates/clustermesh-config/clustermesh-secret.yaml
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-config/clustermesh-secret.yaml
@@ -18,7 +18,7 @@ data:
   {{- $kvstoremesh := and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.kvstoremesh.enabled }}
   {{- $override := ternary (printf "https://clustermesh-apiserver.%s.svc:2379" (include "cilium.namespace" .)) "" $kvstoremesh }}
   {{- $local_etcd := and $kvstoremesh (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "external") }}
-  {{- range .Values.clustermesh.config.clusters }}
+  {{- range (include "clustermesh-clusters" . | fromJson) }}
   {{ .name }}: {{ include "clustermesh-config-generate-etcd-cfg" (list . $.Values.clustermesh.config.domain $override $local_etcd $.Values.etcd ) | b64enc }}
   {{- /* The parenthesis around .tls are required, since it can be null: https://stackoverflow.com/a/68807258 */}}
   {{- if and (eq $override "") (.tls).cert (.tls).key }}
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-config/kvstoremesh-secret.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-config/kvstoremesh-secret.yaml
index 3cdc7828..2828cfd2 100644
--- a/packages/system/cilium/charts/cilium/templates/clustermesh-config/kvstoremesh-secret.yaml
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-config/kvstoremesh-secret.yaml
@@ -15,7 +15,7 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 data:
-  {{- range .Values.clustermesh.config.clusters }}
+  {{- range (include "clustermesh-clusters" . | fromJson) }}
   {{ .name }}: {{ include "clustermesh-config-generate-etcd-cfg" (list . $.Values.clustermesh.config.domain "" false $.Values.etcd ) | b64enc }}
   {{- /* The parenthesis around .tls are required, since it can be null: https://stackoverflow.com/a/68807258 */}}
   {{- if and (.tls).cert (.tls).key }}
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/clusterrole.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/clusterrole.yaml
new file mode 100644
index 00000000..08fcea1b
--- /dev/null
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/clusterrole.yaml
@@ -0,0 +1,29 @@
+{{- if and (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.mcsapi.corednsAutoConfigure.enabled }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: coredns-mcsapi
+  labels:
+    app.kubernetes.io/part-of: cilium
+    {{- with .Values.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  annotations:
+    {{/*
+      We have to leave CoreDNS RBAC to be able to read MCS-API resources
+      as we would leave a broken CoreDNS installation otherwise
+    */}}
+    helm.sh/resource-policy: keep
+    {{- with .Values.clustermesh.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+rules:
+- apiGroups:
+  - multicluster.x-k8s.io
+  resources:
+  - serviceimports
+  verbs:
+  - list
+  - watch
+{{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/clusterrolebinding.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/clusterrolebinding.yaml
new file mode 100644
index 00000000..7a1867f5
--- /dev/null
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/clusterrolebinding.yaml
@@ -0,0 +1,28 @@
+{{- if and (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.mcsapi.corednsAutoConfigure.enabled }}
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: coredns-mcsapi
+  labels:
+    app.kubernetes.io/part-of: cilium
+    {{- with .Values.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  annotations:
+    {{/*
+      We have to leave CoreDNS RBAC to be able to read MCS-API resources
+      as we would leave a broken CoreDNS installation otherwise
+    */}}
+    helm.sh/resource-policy: keep
+    {{- with .Values.clustermesh.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: coredns-mcsapi
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.serviceAccountName | quote }}
+  namespace: {{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.namespace | quote }}
+{{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-clusterrole.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-clusterrole.yaml
new file mode 100644
index 00000000..ac339f9f
--- /dev/null
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-clusterrole.yaml
@@ -0,0 +1,22 @@
+{{- if and (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.mcsapi.corednsAutoConfigure.enabled }}
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: cilium-coredns-mcsapi-autoconfig
+  {{- with .Values.commonLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.clustermesh.annotations }}
+  annotations:
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+rules:
+# note: namespaces permission are needed to initialize and verify that the kubernetes client works.
+- apiGroups:
+  - ""
+  resources:
+  - "namespaces"
+  verbs:
+  - "get"
+{{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-clusterrolebinding.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-clusterrolebinding.yaml
new file mode 100644
index 00000000..4b70ccf4
--- /dev/null
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-clusterrolebinding.yaml
@@ -0,0 +1,22 @@
+{{- if and (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.mcsapi.corednsAutoConfigure.enabled }}
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: cilium-coredns-mcsapi-autoconfig
+  {{- with .Values.commonLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.clustermesh.annotations }}
+  annotations:
+      {{- toYaml . | nindent 4 }}
+  {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cilium-coredns-mcsapi-autoconfig
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.serviceAccounts.corednsMCSAPI.name | quote }}
+  namespace: {{ include "cilium.namespace" . }}
+{{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-role.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-role.yaml
new file mode 100644
index 00000000..52f42fae
--- /dev/null
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-role.yaml
@@ -0,0 +1,36 @@
+{{- if and (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.mcsapi.corednsAutoConfigure.enabled }}
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: cilium-coredns-mcsapi-autoconfig
+  namespace: {{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.namespace }}
+  {{- with .Values.commonLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.clustermesh.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - "configmaps"
+  verbs:
+  - "update"
+  - "patch"
+  - "get"
+  resourceNames:
+  - "{{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.configMapName }}"
+- apiGroups:
+  - "apps"
+  resources:
+  - "deployments"
+  verbs:
+  - "patch"
+  - "update"
+  - "get"
+  resourceNames:
+  - "{{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.deploymentName }}"
+{{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-rolebinding.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-rolebinding.yaml
new file mode 100644
index 00000000..f5caf1a1
--- /dev/null
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-rolebinding.yaml
@@ -0,0 +1,23 @@
+{{- if and (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.mcsapi.corednsAutoConfigure.enabled }}
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: cilium-coredns-mcsapi-autoconfig
+  namespace: {{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.namespace }}
+  {{- with .Values.commonLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.clustermesh.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cilium-coredns-mcsapi-autoconfig
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.serviceAccounts.corednsMCSAPI.name | quote }}
+  namespace: {{ include "cilium.namespace" . }}
+{{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-serviceaccount.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-serviceaccount.yaml
new file mode 100644
index 00000000..4e572a13
--- /dev/null
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-serviceaccount.yaml
@@ -0,0 +1,20 @@
+{{- if and (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.mcsapi.corednsAutoConfigure.enabled .Values.serviceAccounts.corednsMCSAPI.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.serviceAccounts.corednsMCSAPI.name | quote }}
+  namespace: {{ include "cilium.namespace" . }}
+  {{- with .Values.commonLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- if or .Values.serviceAccounts.corednsMCSAPI.annotations .Values.clustermesh.annotations }}
+  annotations:
+    {{- with .Values.clustermesh.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.serviceAccounts.corednsMCSAPI.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job.yaml
new file mode 100644
index 00000000..9f9c3ccd
--- /dev/null
+++ b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job.yaml
@@ -0,0 +1,82 @@
+{{- if and (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.mcsapi.corednsAutoConfigure.enabled }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: cilium-coredns-mcsapi-autoconfig
+  namespace: {{ include "cilium.namespace" . }}
+  labels:
+    k8s-app: cilium-coredns-mcsapi-autoconfig
+    {{- with .Values.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    app.kubernetes.io/part-of: cilium
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    {{- with .Values.clustermesh.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.clustermesh.mcsapi.corednsAutoConfigure.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  template:
+    metadata:
+      labels:
+        k8s-app: cilium-coredns-mcsapi-autoconfig
+        {{- with .Values.clustermesh.mcsapi.corednsAutoConfigure.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      containers:
+        - name: autoconfig
+          image: {{ include "cilium.image" .Values.clustermesh.apiserver.image | quote }}
+          imagePullPolicy: {{ .Values.clustermesh.apiserver.image.pullPolicy }}
+          {{- with .Values.clustermesh.mcsapi.corednsAutoConfigure.resources }}
+          resources:
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+          command:
+            - /usr/bin/clustermesh-apiserver
+          args:
+            - mcsapi-coredns-cfg
+            - --coredns-deployment-name={{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.deploymentName }}
+            - --coredns-configmap-name={{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.configMapName }}
+            - --coredns-namespace={{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.namespace }}
+            - --coredns-cluster-domain={{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.clusterDomain }}
+            - --coredns-clusterset-domain={{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.clustersetDomain }}
+            {{- with .Values.clustermesh.mcsapi.corednsAutoConfigure.extraArgs }}
+            {{- toYaml . | trim | nindent 12 }}
+            {{- end }}
+          {{- with .Values.clustermesh.mcsapi.corednsAutoConfigure.extraVolumeMounts }}
+          volumeMounts:
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+      {{- with .Values.clustermesh.mcsapi.corednsAutoConfigure.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.clustermesh.mcsapi.corednsAutoConfigure.priorityClassName }}
+      priorityClassName: {{ .Values.clustermesh.mcsapi.corednsAutoConfigure.priorityClassName }}
+      {{- end }}
+      {{- with .Values.clustermesh.mcsapi.corednsAutoConfigure.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ .Values.serviceAccounts.corednsMCSAPI.name | quote }}
+      automountServiceAccountToken: true
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      restartPolicy: OnFailure
+      {{- with .Values.clustermesh.mcsapi.corednsAutoConfigure.extraVolumes }}
+      volumes:
+      {{- toYaml . | nindent 6 }}
+      {{- end }}
+      {{- with .Values.clustermesh.mcsapi.corednsAutoConfigure.affinity }}
+      affinity:
+      {{- toYaml . | nindent 8 }}
+      {{- end }}
+  ttlSecondsAfterFinished: {{ .Values.clustermesh.mcsapi.corednsAutoConfigure.ttlSecondsAfterFinished }}
+{{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/hubble-relay/configmap.yaml b/packages/system/cilium/charts/cilium/templates/hubble-relay/configmap.yaml
index 26b6219a..9df77bae 100644
--- a/packages/system/cilium/charts/cilium/templates/hubble-relay/configmap.yaml
+++ b/packages/system/cilium/charts/cilium/templates/hubble-relay/configmap.yaml
@@ -29,6 +29,8 @@ data:
     pprof: {{ .Values.hubble.relay.pprof.enabled | quote }}
     pprof-address: {{ .Values.hubble.relay.pprof.address | quote }}
     pprof-port: {{ .Values.hubble.relay.pprof.port | quote }}
+    pprof-mutex-profile-fraction: {{ .Values.hubble.relay.pprof.mutexProfileFraction | quote }}
+    pprof-block-profile-rate: {{ .Values.hubble.relay.pprof.blockProfileRate | quote }}
     {{- end }}
     {{- if .Values.hubble.relay.prometheus.enabled }}
     metrics-listen-address: ":{{ .Values.hubble.relay.prometheus.port }}"
@@ -44,4 +46,10 @@ data:
     disable-client-tls: true
     {{- end }}
     {{- include "hubble-relay.config.tls" . | nindent 4 }}
+    {{- if .Values.hubble.relay.logOptions.format }}
+    log-format: {{ .Values.hubble.relay.logOptions.format }}
+    {{- end }}
+    {{- if .Values.hubble.relay.logOptions.level }}
+    log-level: {{ .Values.hubble.relay.logOptions.level }}
+    {{- end }}
 {{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/hubble-ui/clusterrole.yaml b/packages/system/cilium/charts/cilium/templates/hubble-ui/clusterrole.yaml
index b8607bd9..ebb8cbd6 100644
--- a/packages/system/cilium/charts/cilium/templates/hubble-ui/clusterrole.yaml
+++ b/packages/system/cilium/charts/cilium/templates/hubble-ui/clusterrole.yaml
@@ -14,14 +14,6 @@ metadata:
     {{- end }}
 
 rules:
-- apiGroups:
-  - networking.k8s.io
-  resources:
-  - networkpolicies
-  verbs:
-  - get
-  - list
-  - watch
 - apiGroups:
   - ""
   resources:
@@ -43,12 +35,4 @@ rules:
   - get
   - list
   - watch
-- apiGroups:
-  - cilium.io
-  resources:
-  - "*"
-  verbs:
-  - get
-  - list
-  - watch
 {{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/hubble-ui/deployment.yaml b/packages/system/cilium/charts/cilium/templates/hubble-ui/deployment.yaml
index c3b3dc5a..07a94dce 100644
--- a/packages/system/cilium/charts/cilium/templates/hubble-ui/deployment.yaml
+++ b/packages/system/cilium/charts/cilium/templates/hubble-ui/deployment.yaml
@@ -74,11 +74,11 @@ spec:
         livenessProbe:
           httpGet:
             path: /healthz
-            port: 8081
+            port: http
         readinessProbe:
           httpGet:
             path: /
-            port: 8081
+            port: http
         {{- with .Values.hubble.ui.frontend.resources }}
         resources:
           {{- toYaml . | trim | nindent 10 }}
@@ -184,8 +184,12 @@ spec:
           defaultMode: 420
           name: hubble-ui-nginx
         name: hubble-ui-nginx-conf
-      - emptyDir: {}
-        name: tmp-dir
+      - name: tmp-dir
+        {{- if .Values.hubble.ui.tmpVolume }}
+          {{- toYaml .Values.hubble.ui.tmpVolume | nindent 8 }}
+        {{- else }}
+        emptyDir: {}
+        {{- end }}
       {{- if .Values.hubble.relay.tls.server.enabled }}
       - name: hubble-ui-client-certs
       {{- if .Values.hubble.ui.standalone.enabled }}
diff --git a/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/_job-spec.tpl b/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/_job-spec.tpl
index 72a1f3d8..06fb3347 100644
--- a/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/_job-spec.tpl
+++ b/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/_job-spec.tpl
@@ -137,7 +137,6 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      serviceAccount: {{ .Values.serviceAccounts.hubblecertgen.name | quote }}
       serviceAccountName: {{ .Values.serviceAccounts.hubblecertgen.name | quote }}
       automountServiceAccountToken: {{ .Values.serviceAccounts.hubblecertgen.automount }}
       {{- with .Values.imagePullSecrets }}
@@ -149,9 +148,11 @@ spec:
       volumes:
       {{- toYaml . | nindent 6 }}
       {{- end }}
-      affinity:
       {{- with .Values.certgen.affinity }}
+      affinity:
       {{- toYaml . | nindent 8 }}
       {{- end }}
-  ttlSecondsAfterFinished: {{ .Values.certgen.ttlSecondsAfterFinished }}
+  {{- with .Values.certgen.ttlSecondsAfterFinished }}
+  ttlSecondsAfterFinished: {{ . }}
+  {{- end }}
 {{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/cronjob.yaml b/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/cronjob.yaml
index 697806c6..b49c00a6 100644
--- a/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/cronjob.yaml
+++ b/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/cronjob.yaml
@@ -23,6 +23,8 @@ metadata:
   {{- end }}
 spec:
   schedule: {{ .Values.hubble.tls.auto.schedule | quote }}
+  successfulJobsHistoryLimit: {{ .Values.certgen.cronJob.successfulJobsHistoryLimit }}
+  failedJobsHistoryLimit: {{ .Values.certgen.cronJob.failedJobsHistoryLimit }}
   concurrencyPolicy: Forbid
   jobTemplate:
     {{- include "hubble-generate-certs.job.spec" . | nindent 4 }}
diff --git a/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/job.yaml b/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/job.yaml
index 5e4e67ff..96371916 100644
--- a/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/job.yaml
+++ b/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/job.yaml
@@ -1,9 +1,18 @@
 {{- if and .Values.hubble.enabled .Values.hubble.tls.enabled .Values.hubble.tls.auto.enabled (eq .Values.hubble.tls.auto.method "cronJob") }}
+{{/*
+Because Kubernetes job specs are immutable, Helm will fail patch this job if
+the spec changes between releases. To avoid breaking the upgrade path, we
+generate a name for the job here which is based on the checksum of the spec.
+This will cause the name of the job to change if its content changes,
+and in turn cause Helm to do delete the old job and replace it with a new one.
+*/}}
+{{- $jobSpec := include "hubble-generate-certs.job.spec" . -}}
+{{- $checkSum := $jobSpec | sha256sum | trunc 10 -}}
 ---
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: hubble-generate-certs
+  name: hubble-generate-certs-{{$checkSum}}
   namespace: {{ include "cilium.namespace" . }}
   labels:
     k8s-app: hubble-generate-certs
@@ -12,13 +21,14 @@ metadata:
     {{- with .Values.commonLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+  {{- if or .Values.certgen.annotations.job .Values.hubble.annotations }}
   annotations:
-    "helm.sh/hook": post-install,post-upgrade
     {{- with .Values.certgen.annotations.job }}
-    {{- toYaml . | nindent 4 }}
+      {{- toYaml . | nindent 4 }}
     {{- end }}
     {{- with .Values.hubble.annotations }}
-    {{- toYaml . | nindent 4 }}
+      {{- toYaml . | nindent 4 }}
     {{- end }}
-{{ include "hubble-generate-certs.job.spec" . }}
+  {{- end }}
+{{ $jobSpec }}
 {{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/metrics-server-secret.yaml b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/metrics-server-secret.yaml
index 0cc13efa..d334b986 100644
--- a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/metrics-server-secret.yaml
+++ b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/metrics-server-secret.yaml
@@ -10,13 +10,17 @@ kind: Secret
 metadata:
   name: hubble-metrics-server-certs
   namespace: {{ include "cilium.namespace" . }}
-  {{- with .Values.commonLabels }}
   labels:
+  {{- with .Values.commonLabels }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
+    cilium.io/helm-template-non-idempotent: "true"
 
-  {{- with .Values.hubble.annotations }}
   annotations:
+  {{- with .Values.hubble.annotations }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.nonIdempotentAnnotations }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
 type: kubernetes.io/tls
diff --git a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/relay-client-secret.yaml b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/relay-client-secret.yaml
index fa0c908e..6f001dc9 100644
--- a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/relay-client-secret.yaml
+++ b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/relay-client-secret.yaml
@@ -17,13 +17,17 @@ kind: Secret
 metadata:
   name: hubble-relay-client-certs
   namespace: {{ include "cilium.namespace" . }}
-  {{- with .Values.commonLabels }}
   labels:
+  {{- with .Values.commonLabels }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
+    cilium.io/helm-template-non-idempotent: "true"
 
-  {{- with .Values.hubble.annotations }}
   annotations:
+  {{- with .Values.hubble.annotations }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.nonIdempotentAnnotations }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
 type: kubernetes.io/tls
diff --git a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/relay-server-secret.yaml b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/relay-server-secret.yaml
index 986b3cac..229148a0 100644
--- a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/relay-server-secret.yaml
+++ b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/relay-server-secret.yaml
@@ -10,13 +10,17 @@ kind: Secret
 metadata:
   name: hubble-relay-server-certs
   namespace: {{ include "cilium.namespace" . }}
-  {{- with .Values.commonLabels }}
   labels:
+  {{- with .Values.commonLabels }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
+    cilium.io/helm-template-non-idempotent: "true"
 
-  {{- with .Values.hubble.annotations }}
   annotations:
+  {{- with .Values.hubble.annotations }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.nonIdempotentAnnotations }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
 type: kubernetes.io/tls
diff --git a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/server-secret.yaml b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/server-secret.yaml
index b7bedb89..4d214a56 100644
--- a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/server-secret.yaml
+++ b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/server-secret.yaml
@@ -18,13 +18,17 @@ kind: Secret
 metadata:
   name: hubble-server-certs
   namespace: {{ include "cilium.namespace" . }}
-  {{- with .Values.commonLabels }}
   labels:
+  {{- with .Values.commonLabels }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
+    cilium.io/helm-template-non-idempotent: "true"
 
-  {{- with .Values.hubble.annotations }}
   annotations:
+  {{- with .Values.hubble.annotations }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.nonIdempotentAnnotations }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
 type: kubernetes.io/tls
diff --git a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/ui-client-certs.yaml b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/ui-client-certs.yaml
index e1f62ead..8c1b40aa 100644
--- a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/ui-client-certs.yaml
+++ b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/ui-client-certs.yaml
@@ -10,13 +10,17 @@ metadata:
   name: hubble-ui-client-certs
   namespace: {{ include "cilium.namespace" . }}
 
-  {{- with .Values.commonLabels }}
   labels:
+  {{- with .Values.commonLabels }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
+    cilium.io/helm-template-non-idempotent: "true"
 
-  {{- with .Values.hubble.annotations }}
   annotations:
+  {{- with .Values.hubble.annotations }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.nonIdempotentAnnotations }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
 type: kubernetes.io/tls
diff --git a/packages/system/cilium/charts/cilium/templates/standalone-dns-proxy/configmap.yaml b/packages/system/cilium/charts/cilium/templates/standalone-dns-proxy/configmap.yaml
new file mode 100644
index 00000000..9d65c1a8
--- /dev/null
+++ b/packages/system/cilium/charts/cilium/templates/standalone-dns-proxy/configmap.yaml
@@ -0,0 +1,28 @@
+{{- if .Values.standaloneDnsProxy.enabled }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: standalone-dns-proxy-config
+  namespace: {{ include "cilium.namespace" . }}
+  {{- with .Values.commonLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+
+  {{- with .Values.standaloneDnsProxy.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+data:
+  # Use the same L7 proxy and DNS settings as the agent for consistency
+  enable-l7-proxy: {{ .Values.l7Proxy | quote }}
+  debug: {{ .Values.standaloneDnsProxy.debug | quote }}
+  enable-standalone-dns-proxy: {{ .Values.standaloneDnsProxy.enabled | quote }}
+  enable-ipv4: {{ .Values.ipv4.enabled | quote }}
+  enable-ipv6: {{ .Values.ipv6.enabled | quote }}
+  standalone-dns-proxy-server-port: {{ .Values.standaloneDnsProxy.serverPort | quote }}
+  # DNS proxy configuration inherited from agent settings
+  tofqdns-proxy-port: {{ .Values.dnsProxy.proxyPort | quote }}
+  tofqdns-enable-dns-compression: {{ .Values.dnsProxy.enableDnsCompression | quote }}
+{{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/standalone-dns-proxy/daemonset.yaml b/packages/system/cilium/charts/cilium/templates/standalone-dns-proxy/daemonset.yaml
new file mode 100644
index 00000000..7ea150a4
--- /dev/null
+++ b/packages/system/cilium/charts/cilium/templates/standalone-dns-proxy/daemonset.yaml
@@ -0,0 +1,80 @@
+{{- if .Values.standaloneDnsProxy.enabled }}
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: standalone-dns-proxy
+  namespace: {{ include "cilium.namespace" . }}
+  {{- with .Values.standaloneDnsProxy.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    k8s-app: standalone-dns-proxy
+    app.kubernetes.io/part-of: cilium
+    app.kubernetes.io/name: standalone-dns-proxy
+    name: standalone-dns-proxy
+    {{- with .Values.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  minReadySeconds: 5
+  {{- with .Values.standaloneDnsProxy.updateStrategy }}
+  updateStrategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  selector:
+    matchLabels:
+      k8s-app: standalone-dns-proxy
+  template:
+    metadata:
+      annotations:
+        {{- if .Values.standaloneDnsProxy.rollOutPods }}
+        # ensure pods roll when configmap updates
+        cilium.io/standalone-dns-proxy-configmap-checksum: {{ include (print $.Template.BasePath "/standalone-dns-proxy/configmap.yaml") . | sha256sum | quote }}
+        {{- end }}
+        container.apparmor.security.beta.kubernetes.io/standalone-dns-proxy: "unconfined"
+      labels:
+        k8s-app: standalone-dns-proxy
+        name: standalone-dns-proxy
+        app.kubernetes.io/name: standalone-dns-proxy
+        app.kubernetes.io/part-of: cilium
+        {{- with .Values.commonLabels }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      hostNetwork: true
+      automountServiceAccountToken: {{ .Values.standaloneDnsProxy.automountServiceAccountToken }}
+      {{- with .Values.standaloneDnsProxy.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      tolerations:
+      - operator: Exists
+      {{- with .Values.standaloneDnsProxy.tolerations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: standalone-dns-proxy
+          image: {{ include "cilium.image" .Values.standaloneDnsProxy.image | quote }}
+          args:
+          - --config-dir=/tmp/standalone-dns-proxy/config-map
+          imagePullPolicy: {{ .Values.standaloneDnsProxy.image.pullPolicy }}
+          volumeMounts:
+          - mountPath: /tmp/standalone-dns-proxy/config-map
+            name: standalone-dns-proxy-config-path
+            readOnly: true
+          - mountPath: /var/run/standalone-dns-proxy
+            name: runtime-dir
+          securityContext:
+            capabilities:
+              add: ["NET_ADMIN", "NET_RAW"]
+              drop: ["ALL"]
+      volumes:
+      - configMap:
+          defaultMode: 420
+          name: standalone-dns-proxy-config
+        name: standalone-dns-proxy-config-path
+      - emptyDir: {}
+        name: runtime-dir
+{{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/validate.yaml b/packages/system/cilium/charts/cilium/templates/validate.yaml
index 4fff21a3..ac3164b6 100644
--- a/packages/system/cilium/charts/cilium/templates/validate.yaml
+++ b/packages/system/cilium/charts/cilium/templates/validate.yaml
@@ -220,3 +220,22 @@
     {{- end }}
   {{- end }}
 {{- end }}
+
+{{/* validate Standalone DNS Proxy */}}
+{{- if .Values.standaloneDnsProxy.enabled }}
+  {{- if not .Values.dnsProxy.proxyPort }}
+    {{ fail "standaloneDnsProxy requires dnsProxy.proxyPort to be explicitly set (e.g., 10094)" }}
+  {{- end }}
+  {{- if eq (int .Values.dnsProxy.proxyPort) 0 }}
+    {{ fail "standaloneDnsProxy requires dnsProxy.proxyPort to be set to a non-zero value (e.g., 10094). The standalone DNS proxy uses the same DNS configuration as the agent." }}
+  {{- end }}
+{{- end }}
+
+{{/* validate we don't run tproxy with netkit - see GH issue 39892 */}}
+{{- if hasKey .Values "bpf" }}
+  {{- if and (hasKey .Values.bpf "tproxy") (hasKey .Values.bpf "datapathMode") }}
+    {{- if and (.Values.bpf.tproxy) (list "netkit" "netkit-l2" | has .Values.bpf.datapathMode) }}
+      {{ fail ".Values.bpf.tproxy cannot be enabled with .Values.bpf.datapathMode=netkit or .Values.bpf.datapathMode=netkit-l2" }}
+    {{- end }}
+  {{- end }}
+{{- end }}
diff --git a/packages/system/cilium/charts/cilium/values.schema.json b/packages/system/cilium/charts/cilium/values.schema.json
index fb1ea4c3..d18566d7 100644
--- a/packages/system/cilium/charts/cilium/values.schema.json
+++ b/packages/system/cilium/charts/cilium/values.schema.json
@@ -58,6 +58,27 @@
       "properties": {
         "enabled": {
           "type": "boolean"
+        },
+        "nodeSpec": {
+          "properties": {
+            "securityGroupTags": {
+              "items": {},
+              "type": "array"
+            },
+            "securityGroups": {
+              "items": {},
+              "type": "array"
+            },
+            "vSwitchTags": {
+              "items": {},
+              "type": "array"
+            },
+            "vSwitches": {
+              "items": {},
+              "type": "array"
+            }
+          },
+          "type": "object"
         }
       },
       "type": "object"
@@ -440,6 +461,14 @@
       "properties": {
         "enabled": {
           "type": "boolean"
+        },
+        "nodeSpec": {
+          "properties": {
+            "azureInterfaceName": {
+              "type": "string"
+            }
+          },
+          "type": "object"
         }
       },
       "type": "object"
@@ -644,6 +673,14 @@
         "monitorInterval": {
           "type": "string"
         },
+        "monitorTraceIPOption": {
+          "minimum": 0,
+          "maximum": 255,
+          "type": [
+            "null",
+            "integer"
+          ]
+        },
         "natMax": {
           "type": [
             "null",
@@ -668,6 +705,12 @@
             "integer"
           ]
         },
+        "policyMapPressureMetricsThreshold": {
+          "type": [
+            "null",
+            "number"
+          ]
+        },
         "policyStatsMapMax": {
           "type": [
             "null",
@@ -714,6 +757,17 @@
           },
           "type": "object"
         },
+        "cronJob": {
+          "properties": {
+            "failedJobsHistoryLimit": {
+              "type": "integer"
+            },
+            "successfulJobsHistoryLimit": {
+              "type": "integer"
+            }
+          },
+          "type": "object"
+        },
         "extraVolumeMounts": {
           "items": {},
           "type": "array"
@@ -768,7 +822,10 @@
           "type": "array"
         },
         "ttlSecondsAfterFinished": {
-          "type": "integer"
+          "type": [
+            "null",
+            "integer"
+          ]
         }
       },
       "type": "object"
@@ -1299,6 +1356,9 @@
                     "Cluster"
                   ]
                 },
+                "externallyCreated": {
+                  "type": "boolean"
+                },
                 "internalTrafficPolicy": {
                   "enum": [
                     "Local",
@@ -1369,17 +1429,6 @@
                   },
                   "type": "object"
                 },
-                "client": {
-                  "properties": {
-                    "cert": {
-                      "type": "string"
-                    },
-                    "key": {
-                      "type": "string"
-                    }
-                  },
-                  "type": "object"
-                },
                 "enableSecrets": {
                   "type": "boolean"
                 },
@@ -1452,11 +1501,17 @@
           },
           "type": "object"
         },
+        "cacheTTL": {
+          "type": "string"
+        },
         "config": {
           "properties": {
             "clusters": {
               "items": {},
-              "type": "array"
+              "type": [
+                "object",
+                "array"
+              ]
             },
             "domain": {
               "type": "string"
@@ -1476,6 +1531,85 @@
         "maxConnectedClusters": {
           "type": "integer"
         },
+        "mcsapi": {
+          "properties": {
+            "corednsAutoConfigure": {
+              "properties": {
+                "affinity": {
+                  "type": "object"
+                },
+                "annotations": {
+                  "type": "object"
+                },
+                "coredns": {
+                  "properties": {
+                    "clusterDomain": {
+                      "type": "string"
+                    },
+                    "clustersetDomain": {
+                      "type": "string"
+                    },
+                    "configMapName": {
+                      "type": "string"
+                    },
+                    "deploymentName": {
+                      "type": "string"
+                    },
+                    "namespace": {
+                      "type": "string"
+                    },
+                    "serviceAccountName": {
+                      "type": "string"
+                    }
+                  },
+                  "type": "object"
+                },
+                "enabled": {
+                  "type": "boolean"
+                },
+                "extraArgs": {
+                  "items": {},
+                  "type": "array"
+                },
+                "extraVolumeMounts": {
+                  "items": {},
+                  "type": "array"
+                },
+                "extraVolumes": {
+                  "items": {},
+                  "type": "array"
+                },
+                "nodeSelector": {
+                  "type": "object"
+                },
+                "podLabels": {
+                  "type": "object"
+                },
+                "priorityClassName": {
+                  "type": "string"
+                },
+                "resources": {
+                  "type": "object"
+                },
+                "tolerations": {
+                  "items": {},
+                  "type": "array"
+                },
+                "ttlSecondsAfterFinished": {
+                  "type": "integer"
+                }
+              },
+              "type": "object"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "installCRDs": {
+              "type": "boolean"
+            }
+          },
+          "type": "object"
+        },
         "policyDefaultLocalCluster": {
           "type": "boolean"
         },
@@ -1537,10 +1671,27 @@
         },
         "resources": {
           "properties": {
+            "limits": {
+              "properties": {
+                "cpu": {
+                  "type": [
+                    "integer",
+                    "string"
+                  ]
+                },
+                "memory": {
+                  "type": "string"
+                }
+              },
+              "type": "object"
+            },
             "requests": {
               "properties": {
                 "cpu": {
-                  "type": "string"
+                  "type": [
+                    "integer",
+                    "string"
+                  ]
                 },
                 "memory": {
                   "type": "string"
@@ -1578,14 +1729,6 @@
     "crdWaitTimeout": {
       "type": "string"
     },
-    "customCalls": {
-      "properties": {
-        "enabled": {
-          "type": "boolean"
-        }
-      },
-      "type": "object"
-    },
     "daemon": {
       "properties": {
         "allowedConfigOverrides": {
@@ -1749,9 +1892,15 @@
     "enableMasqueradeRouteSource": {
       "type": "boolean"
     },
+    "enableNoServiceEndpointsRoutable": {
+      "type": "boolean"
+    },
     "enableNonDefaultDenyPolicies": {
       "type": "boolean"
     },
+    "enableTunnelBIGTCP": {
+      "type": "boolean"
+    },
     "enableXTSocketFallback": {
       "type": "boolean"
     },
@@ -1797,8 +1946,30 @@
             "cidr": {
               "type": "string"
             },
+            "egress": {
+              "properties": {
+                "allowRemoteNodeIdentities": {
+                  "type": "boolean"
+                },
+                "cidr": {
+                  "type": "string"
+                },
+                "enabled": {
+                  "type": "boolean"
+                }
+              },
+              "type": "object"
+            },
             "enabled": {
               "type": "boolean"
+            },
+            "ingress": {
+              "properties": {
+                "enabled": {
+                  "type": "boolean"
+                }
+              },
+              "type": "object"
             }
           },
           "type": "object"
@@ -1869,6 +2040,49 @@
           "items": {},
           "type": "array"
         },
+        "nodeSpec": {
+          "properties": {
+            "deleteOnTermination": {
+              "type": [
+                "null",
+                "boolean"
+              ]
+            },
+            "disablePrefixDelegation": {
+              "type": "boolean"
+            },
+            "excludeInterfaceTags": {
+              "items": {},
+              "type": "array"
+            },
+            "firstInterfaceIndex": {
+              "type": [
+                "null",
+                "integer"
+              ]
+            },
+            "securityGroupTags": {
+              "items": {},
+              "type": "array"
+            },
+            "securityGroups": {
+              "items": {},
+              "type": "array"
+            },
+            "subnetIDs": {
+              "items": {},
+              "type": "array"
+            },
+            "subnetTags": {
+              "items": {},
+              "type": "array"
+            },
+            "usePrimaryAddress": {
+              "type": "boolean"
+            }
+          },
+          "type": "object"
+        },
         "subnetIDsFilter": {
           "items": {},
           "type": "array"
@@ -2011,6 +2225,12 @@
             "string"
           ]
         },
+        "clusterMaxConnections": {
+          "type": "integer"
+        },
+        "clusterMaxRequests": {
+          "type": "integer"
+        },
         "connectTimeoutSeconds": {
           "type": "integer"
         },
@@ -2104,6 +2324,10 @@
           },
           "type": "object"
         },
+        "initContainers": {
+          "items": {},
+          "type": "array"
+        },
         "initialFetchTimeoutSeconds": {
           "type": "integer"
         },
@@ -2171,6 +2395,9 @@
         "maxConnectionDurationSeconds": {
           "type": "integer"
         },
+        "maxGlobalDownstreamConnections": {
+          "type": "integer"
+        },
         "maxRequestsPerConnection": {
           "type": "integer"
         },
@@ -2393,6 +2620,9 @@
           },
           "type": "object"
         },
+        "useOriginalSourceAddress": {
+          "type": "boolean"
+        },
         "xffNumTrustedHopsL7PolicyEgress": {
           "type": "integer"
         },
@@ -2614,10 +2844,17 @@
                         "anyOf": [
                           {
                             "properties": {
+                              "aggregationInterval": {
+                                "type": "string"
+                              },
                               "excludeFilters": {
                                 "items": {},
                                 "type": "array"
                               },
+                              "fieldAggregate": {
+                                "items": {},
+                                "type": "array"
+                              },
                               "fieldMask": {
                                 "items": {},
                                 "type": "array"
@@ -2661,6 +2898,9 @@
             },
             "static": {
               "properties": {
+                "aggregationInterval": {
+                  "type": "string"
+                },
                 "allowList": {
                   "items": {},
                   "type": "array"
@@ -2672,6 +2912,10 @@
                 "enabled": {
                   "type": "boolean"
                 },
+                "fieldAggregate": {
+                  "items": {},
+                  "type": "array"
+                },
                 "fieldMask": {
                   "items": {},
                   "type": "array"
@@ -3037,6 +3281,23 @@
             "listenPort": {
               "type": "string"
             },
+            "logOptions": {
+              "properties": {
+                "format": {
+                  "type": [
+                    "null",
+                    "string"
+                  ]
+                },
+                "level": {
+                  "type": [
+                    "null",
+                    "string"
+                  ]
+                }
+              },
+              "type": "object"
+            },
             "nodeSelector": {
               "properties": {
                 "kubernetes.io/os": {
@@ -3100,9 +3361,15 @@
                 "address": {
                   "type": "string"
                 },
+                "blockProfileRate": {
+                  "type": "integer"
+                },
                 "enabled": {
                   "type": "boolean"
                 },
+                "mutexProfileFraction": {
+                  "type": "integer"
+                },
                 "port": {
                   "type": "integer"
                 }
@@ -3680,6 +3947,9 @@
               },
               "type": "object"
             },
+            "tmpVolume": {
+              "type": "object"
+            },
             "tolerations": {
               "items": {},
               "type": "array"
@@ -3921,6 +4191,33 @@
         "multiPoolPreAllocation": {
           "type": "string"
         },
+        "nodeSpec": {
+          "properties": {
+            "ipamMaxAllocate": {
+              "type": [
+                "null",
+                "integer"
+              ]
+            },
+            "ipamMinAllocate": {
+              "type": [
+                "null",
+                "integer"
+              ]
+            },
+            "ipamPreAllocate": {
+              "type": [
+                "null",
+                "integer"
+              ]
+            },
+            "ipamStaticIPTags": {
+              "items": {},
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
         "operator": {
           "properties": {
             "autoCreateCiliumPodIPPools": {
@@ -4278,9 +4575,6 @@
         },
         "enableHealthCheckLoadBalancerIP": {
           "type": "boolean"
-        },
-        "enabled": {
-          "type": "boolean"
         }
       },
       "type": "object"
@@ -4394,7 +4688,10 @@
             "requests": {
               "properties": {
                 "cpu": {
-                  "type": "string"
+                  "type": [
+                    "integer",
+                    "string"
+                  ]
                 },
                 "memory": {
                   "type": "string"
@@ -4486,6 +4783,9 @@
             }
           },
           "type": "object"
+        },
+        "waitForCloudInit": {
+          "type": "boolean"
         }
       },
       "type": "object"
@@ -4694,9 +4994,15 @@
             "address": {
               "type": "string"
             },
+            "blockProfileRate": {
+              "type": "integer"
+            },
             "enabled": {
               "type": "boolean"
             },
+            "mutexProfileFraction": {
+              "type": "integer"
+            },
             "port": {
               "type": "integer"
             }
@@ -4754,6 +5060,30 @@
                 }
               },
               "type": "object"
+            },
+            "tls": {
+              "properties": {
+                "enabled": {
+                  "type": "boolean"
+                },
+                "server": {
+                  "properties": {
+                    "existingSecret": {
+                      "type": "string"
+                    },
+                    "mtls": {
+                      "properties": {
+                        "enabled": {
+                          "type": "boolean"
+                        }
+                      },
+                      "type": "object"
+                    }
+                  },
+                  "type": "object"
+                }
+              },
+              "type": "object"
             }
           },
           "type": "object"
@@ -4866,6 +5196,12 @@
             },
             "restart": {
               "type": "boolean"
+            },
+            "selector": {
+              "type": [
+                "null",
+                "string"
+              ]
             }
           },
           "type": "object"
@@ -4902,6 +5238,9 @@
       "properties": {
         "enabled": {
           "type": "boolean"
+        },
+        "packetizationLayerPMTUDMode": {
+          "type": "string"
         }
       },
       "type": "object"
@@ -4940,6 +5279,9 @@
         "array"
       ]
     },
+    "policyDenyResponse": {
+      "type": "string"
+    },
     "policyEnforcementMode": {
       "type": "string"
     },
@@ -4948,9 +5290,15 @@
         "address": {
           "type": "string"
         },
+        "blockProfileRate": {
+          "type": "integer"
+        },
         "enabled": {
           "type": "boolean"
         },
+        "mutexProfileFraction": {
+          "type": "integer"
+        },
         "port": {
           "type": "integer"
         }
@@ -5363,6 +5711,9 @@
     "secretsNamespaceAnnotations": {
       "type": "object"
     },
+    "secretsNamespaceLabels": {
+      "type": "object"
+    },
     "securityContext": {
       "properties": {
         "allowPrivilegeEscalation": {
@@ -5422,6 +5773,9 @@
                   {
                     "type": "string"
                   },
+                  {
+                    "type": "string"
+                  },
                   {
                     "type": "string"
                   }
@@ -5537,6 +5891,23 @@
           },
           "type": "object"
         },
+        "corednsMCSAPI": {
+          "properties": {
+            "annotations": {
+              "type": "object"
+            },
+            "automount": {
+              "type": "boolean"
+            },
+            "create": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
         "envoy": {
           "properties": {
             "annotations": {
@@ -5676,6 +6047,86 @@
       },
       "type": "object"
     },
+    "standaloneDnsProxy": {
+      "properties": {
+        "annotations": {
+          "type": "object"
+        },
+        "automountServiceAccountToken": {
+          "type": "boolean"
+        },
+        "debug": {
+          "type": "boolean"
+        },
+        "enabled": {
+          "type": "boolean"
+        },
+        "image": {
+          "properties": {
+            "digest": {
+              "type": "string"
+            },
+            "override": {
+              "type": [
+                "null",
+                "string"
+              ]
+            },
+            "pullPolicy": {
+              "type": "string"
+            },
+            "repository": {
+              "type": "string"
+            },
+            "tag": {
+              "type": "string"
+            },
+            "useDigest": {
+              "type": "boolean"
+            }
+          },
+          "type": "object"
+        },
+        "nodeSelector": {
+          "properties": {
+            "kubernetes.io/os": {
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "rollOutPods": {
+          "type": "boolean"
+        },
+        "serverPort": {
+          "type": "integer"
+        },
+        "tolerations": {
+          "items": {},
+          "type": "array"
+        },
+        "updateStrategy": {
+          "properties": {
+            "rollingUpdate": {
+              "properties": {
+                "maxSurge": {
+                  "type": "integer"
+                },
+                "maxUnavailable": {
+                  "type": "integer"
+                }
+              },
+              "type": "object"
+            },
+            "type": {
+              "type": "string"
+            }
+          },
+          "type": "object"
+        }
+      },
+      "type": "object"
+    },
     "startupProbe": {
       "properties": {
         "failureThreshold": {
@@ -5687,9 +6138,6 @@
       },
       "type": "object"
     },
-    "svcSourceRangeCheck": {
-      "type": "boolean"
-    },
     "synchronizeK8sNodes": {
       "type": "boolean"
     },
@@ -5774,6 +6222,9 @@
       },
       "type": "object"
     },
+    "tmpVolume": {
+      "type": "object"
+    },
     "tolerations": {
       "items": {
         "anyOf": [
diff --git a/packages/system/cilium/charts/cilium/values.yaml b/packages/system/cilium/charts/cilium/values.yaml
index eff7f902..b9b30830 100644
--- a/packages/system/cilium/charts/cilium/values.yaml
+++ b/packages/system/cilium/charts/cilium/values.yaml
@@ -6,7 +6,6 @@
 # type: [null, string]
 # @schema
 # -- namespaceOverride allows to override the destination namespace for Cilium resources.
-# This property allows to use Cilium as part of an Umbrella Chart with different targets.
 namespaceOverride: ""
 # @schema
 # type: [null, object]
@@ -29,7 +28,7 @@ debug:
   # @schema
   # -- Configure verbosity levels for debug logging
   # This option is used to enable debug messages for operations related to such
-  # sub-system such as (e.g. kvstore, envoy, datapath or policy), and flow is
+  # sub-system such as (e.g. kvstore, envoy, datapath, policy, or tagged), and flow is
   # for enabling debug messages emitted per request, message and connection.
   # Multiple values can be set via a space-separated string (e.g. "datapath envoy").
   #
@@ -39,6 +38,7 @@ debug:
   # - envoy
   # - datapath
   # - policy
+  # - tagged
   verbose: ~
   # -- Set the agent-internal metrics sampling frequency. This sets the
   # frequency of the internal sampling of the agent metrics. These are
@@ -204,6 +204,12 @@ serviceAccounts:
     name: hubble-generate-certs
     automount: true
     annotations: {}
+  # -- CorednsMCSAPI is used if clustermesh.mcsapi.corednsAutoConfigure.enabled=true
+  corednsMCSAPI:
+    create: true
+    name: cilium-coredns-mcsapi-autoconfig
+    automount: true
+    annotations: {}
 # -- Configure termination grace period for cilium-agent DaemonSet.
 terminationGracePeriodSeconds: 1
 # -- Install the cilium agent resources.
@@ -219,10 +225,10 @@ image:
   # @schema
   override: ~
   repository: "quay.io/cilium/cilium"
-  tag: "v1.18.6"
+  tag: "v1.19.1"
   pullPolicy: "IfNotPresent"
   # cilium-digest
-  digest: sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4
+  digest: sha256:41f1f74a0000de8656f1de4088ea00c8f2d49d6edea579034c73c5fd5fe01792
   useDigest: true
 # -- Scheduling configurations for cilium pods
 scheduling:
@@ -363,6 +369,8 @@ securityContext:
       - SETGID
       # Allow to execute program that changes UID (e.g. required for package installation)
       - SETUID
+      # Allow to read dmesg and get kernel pointers when kptr_restrict=1
+      - SYSLOG
     # -- Capabilities for the `mount-cgroup` init container
     mountCgroup:
       # Only used for 'mount' cgroup
@@ -433,9 +441,16 @@ azure:
   # clientID: 00000000-0000-0000-0000-000000000000
   # clientSecret: 00000000-0000-0000-0000-000000000000
   # userAssignedIdentityID: 00000000-0000-0000-0000-000000000000
+  nodeSpec:
+    azureInterfaceName: ""
 alibabacloud:
   # -- Enable AlibabaCloud ENI integration
   enabled: false
+  nodeSpec:
+    vSwitches: []
+    vSwitchTags: []
+    securityGroups: []
+    securityGroupTags: []
 # -- Enable bandwidth manager to optimize TCP and UDP workloads and allow
 # for rate-limiting traffic from individual Pods with EDT (Earliest Departure
 # Time) through the "kubernetes.io/egress-bandwidth" Pod annotation.
@@ -468,8 +483,7 @@ l2podAnnouncements:
   interface: "eth0"
   # -- A regular expression matching interfaces used for sending Gratuitous ARP pod announcements
   # interfacePattern: ""
-# -- This feature set enables virtual BGP routers to be created via
-# CiliumBGPPeeringPolicy CRDs.
+# -- This feature set enables virtual BGP routers to be created via BGP CRDs.
 bgpControlPlane:
   # -- Enables the BGP control plane.
   enabled: false
@@ -479,9 +493,9 @@ bgpControlPlane:
     create: false
     # -- The name of the secret namespace to which Cilium agents are given read access
     name: kube-system
-  # -- Status reporting settings (BGPv2 only)
+  # -- Status reporting settings
   statusReport:
-    # -- Enable/Disable BGPv2 status reporting
+    # -- Enable/Disable BGP status reporting
     # It is recommended to enable status reporting in general, but if you have any issue
     # such as high API server load, you can disable it by setting this to false.
     enabled: true
@@ -491,7 +505,7 @@ bgpControlPlane:
     mode: "default"
     # -- IP pool to allocate the BGP router-id from when the mode is ip-pool.
     ipPool: ""
-  # -- Legacy BGP ORIGIN attribute settings (BGPv2 only)
+  # -- Legacy BGP ORIGIN attribute settings
   legacyOriginAttribute:
     # -- Enable/Disable advertising LoadBalancerIP routes with the legacy
     # BGP ORIGIN attribute value INCOMPLETE (2) instead of the default IGP (0).
@@ -501,6 +515,11 @@ pmtuDiscovery:
   # -- Enable path MTU discovery to send ICMP fragmentation-needed replies to
   # the client.
   enabled: false
+  # -- Enable kernel probing path MTU discovery for Pods which uses different message
+  # sizes to search for correct MTU value.
+  # Valid values are: always, blackhole, disabled and unset (or empty). If value
+  # is 'unset' or left empty then will not try to override setting.
+  packetizationLayerPMTUDMode: "blackhole"
 bpf:
   autoMount:
     # -- Enable automatic mount of BPF filesystem
@@ -548,7 +567,7 @@ bpf:
   # Helm configuration for BPF events map rate limiting is experimental and might change
   # in upcoming releases.
   events:
-    # -- Default settings for all types of events except dbg and pcap.
+    # -- Default settings for all types of events except dbg.
     default:
       # @schema
       # type: [null, integer]
@@ -608,6 +627,12 @@ bpf:
   # type: [null, integer]
   # @schema
   policyMapMax: 16384
+  # -- (float64) Configure threshold for emitting pressure metrics of policy maps.
+  # @schema
+  # type: [null, number]
+  # @schema
+  # @default -- `0.1`
+  policyMapPressureMetricsThreshold: ~
   # -- Configure the maximum number of entries in global policy stats map.
   # @schema
   # type: [null, integer]
@@ -665,7 +690,8 @@ bpf:
   # type: [null, boolean]
   # @schema
   # -- (bool) Configure the eBPF-based TPROXY (beta) to reduce reliance on iptables rules
-  # for implementing Layer 7 policy.
+  # for implementing Layer 7 policy. Note this is incompatible with netkit (`bpf.datapathMode=netkit`,
+  # `bpf.datapathMode=netkit-l2`).
   # @default -- `false`
   tproxy: ~
   # @schema
@@ -675,6 +701,15 @@ bpf:
   # [0] will allow all VLAN id's without any filtering.
   # @default -- `[]`
   vlanBypass: ~
+  # -- Configure the IP tracing option type.
+  # This option is used to specify the IP option type to use for tracing.
+  # The value must be an integer between 0 and 255.
+  # @schema
+  # type: [null, integer]
+  # minimum: 0
+  # maximum: 255
+  # @schema
+  monitorTraceIPOption: 0
   # -- (bool) Disable ExternalIP mitigation (CVE-2020-8554)
   # @default -- `false`
   disableExternalIPMitigation: false
@@ -682,7 +717,8 @@ bpf:
   # supported kernels.
   # @default -- `true`
   enableTCX: true
-  # -- (string) Mode for Pod devices for the core datapath (veth, netkit, netkit-l2)
+  # -- (string) Mode for Pod devices for the core datapath (veth, netkit, netkit-l2).
+  # Note netkit is incompatible with TPROXY (`bpf.tproxy`).
   # @default -- `veth`
   datapathMode: veth
 # -- Enable BPF clock source probing for more efficient tick retrieval.
@@ -770,8 +806,17 @@ cni:
   # -- Specifies the resources for the cni initContainer
   resources:
     requests:
+      # @schema
+      # type: [integer, string]
+      # @schema
       cpu: 100m
       memory: 10Mi
+    limits:
+      # @schema
+      # type: [integer, string]
+      # @schema
+      cpu: 1
+      memory: 1Gi
   # -- Enable route MTU for pod netns when CNI chaining is used
   enableRouteMTUForCNIChaining: false
   # -- Enable the removal of iptables rules created by the AWS CNI VPC plugin.
@@ -796,10 +841,6 @@ conntrackGCMaxInterval: ""
 # -- (string) Configure timeout in which Cilium will exit if CRDs are not available
 # @default -- `"5m"`
 crdWaitTimeout: ""
-# -- Tail call hooks for custom eBPF programs.
-customCalls:
-  # -- Enable tail call hooks for custom eBPF programs.
-  enabled: false
 daemon:
   # -- Configure where Cilium runtime state should be stored.
   runPath: "/var/run/cilium"
@@ -842,6 +883,12 @@ daemon:
   #
   # By default, this functionality is enabled
   enableSourceIPVerification: true
+# -- Configure temporary volume for cilium-agent
+tmpVolume: {}
+# emptyDir:
+#   sizeLimit: "100Mi"
+#   medium: "Memory"
+
 # -- Specify which network interfaces can run the eBPF datapath. This means
 # that a packet sent from a pod to a destination outside the cluster will be
 # masqueraded (to an output device IPv4 address), if the output device runs the
@@ -860,9 +907,6 @@ forceDeviceDetection: false
 # -- Enable setting identity mark for local traffic.
 # enableIdentityMark: true
 
-# -- Enable Kubernetes EndpointSlice feature in Cilium if the cluster supports it.
-# enableK8sEndpointSlice: true
-
 # -- CiliumEndpointSlice configuration options.
 ciliumEndpointSlice:
   # -- Enable Cilium EndpointSlice feature.
@@ -1042,20 +1086,33 @@ enableXTSocketFallback: true
 encryption:
   # -- Enable transparent network encryption.
   enabled: false
-  # -- Encryption method. Can be either ipsec or wireguard.
+  # -- Encryption method. Can be one of ipsec, wireguard or ztunnel.
   type: ipsec
   # -- Enable encryption for pure node to node traffic.
   # This option is only effective when encryption.type is set to "wireguard".
   nodeEncryption: false
-  # -- Configure the WireGuard Pod2Pod strict mode.
+  # -- Configure the Encryption Pod2Pod strict mode.
   strictMode:
-    # -- Enable WireGuard Pod2Pod strict mode.
+    # -- Enable Encryption Pod2Pod strict mode. (deprecated: please use encryption.strictMode.egress.enabled)
     enabled: false
-    # -- CIDR for the WireGuard Pod2Pod strict mode.
+    # -- CIDR for the Encryption Pod2Pod strict mode. (deprecated: please use encryption.strictMode.egress.cidr)
     cidr: ""
-    # -- Allow dynamic lookup of remote node identities.
+    # -- Allow dynamic lookup of remote node identities. (deprecated: please use encryption.strictMode.egress.allowRemoteNodeIdentities)
     # This is required when tunneling is used or direct routing is used and the node CIDR and pod CIDR overlap.
     allowRemoteNodeIdentities: false
+    egress:
+      # -- Enable strict egress encryption.
+      enabled: false
+      # -- CIDR for the Encryption Pod2Pod strict egress mode.
+      cidr: ""
+      # -- Allow dynamic lookup of remote node identities.
+      # This is required when tunneling is used or direct routing is used and the node CIDR and pod CIDR overlap.
+      allowRemoteNodeIdentities: false
+    ingress:
+      # -- Enable strict ingress encryption.
+      # When enabled, all unencrypted overlay ingress traffic will be dropped.
+      # This option is only applicable when WireGuard and tunneling are enabled.
+      enabled: false
   ipsec:
     # -- Name of the key file inside the Kubernetes secret configured via secretName.
     keyFile: keys
@@ -1127,6 +1184,32 @@ eni:
   # -- Filter via AWS EC2 Instance tags (k=v) which will dictate which AWS EC2 Instances
   # are going to be used to create new ENIs
   instanceTagsFilter: []
+  # -- NodeSpec configuration for the ENI
+  nodeSpec:
+    # -- First interface index to use for IP allocation
+    # @schema
+    # type: [null, integer]
+    # @schema
+    firstInterfaceIndex: ~
+    # -- Subnet IDs to use for IP allocation
+    subnetIDs: []
+    # -- Subnet tags to use for IP allocation
+    subnetTags: []
+    # -- Security groups to use for IP allocation
+    securityGroups: []
+    # -- Security group tags to use for IP allocation
+    securityGroupTags: []
+    # -- Exclude interface tags to use for IP allocation
+    excludeInterfaceTags: []
+    # -- Use primary address for IP allocation
+    usePrimaryAddress: false
+    # -- Disable prefix delegation for IP allocation
+    disablePrefixDelegation: false
+    # -- Delete ENI on termination
+    # @schema
+    # type: [null, boolean]
+    # @schema
+    deleteOnTermination: ~
 # fragmentTracking enables IPv4 fragment tracking support in the datapath.
 # fragmentTracking: true
 gke:
@@ -1142,6 +1225,8 @@ healthCheckICMPFailureThreshold: 3
 hostFirewall:
   # -- Enables the enforcement of host policies in the eBPF datapath.
   enabled: false
+# -- Enable routing to a service that has zero endpoints
+enableNoServiceEndpointsRoutable: true
 # -- Configure socket LB
 socketLB:
   # -- Enable socket LB
@@ -1165,12 +1250,15 @@ certgen:
     # @schema
     override: ~
     repository: "quay.io/cilium/certgen"
-    tag: "v0.3.1"
-    digest: "sha256:2825dbfa6f89cbed882fd1d81e46a56c087e35885825139923aa29eb8aec47a9"
+    tag: "v0.3.2"
+    digest: "sha256:19921f48ee7e2295ea4dca955878a6cd8d70e6d4219d08f688e866ece9d95d4d"
     useDigest: true
     pullPolicy: "IfNotPresent"
+  # @schema
+  # type: [null, integer]
+  # @schema
   # -- Seconds after which the completed job pod will be deleted
-  ttlSecondsAfterFinished: 1800
+  ttlSecondsAfterFinished: null
   # -- Labels to be added to hubble-certgen pods
   podLabels: {}
   # -- Annotations to be added to the hubble-certgen initial Job and CronJob
@@ -1195,6 +1283,11 @@ certgen:
   extraVolumeMounts: []
   # -- Affinity for certgen
   affinity: {}
+  cronJob:
+    # -- The number of successful finished jobs to keep
+    successfulJobsHistoryLimit: 3
+    # -- The number of failed finished jobs to keep
+    failedJobsHistoryLimit: 1
 hubble:
   # -- Enable Hubble (true by default).
   enabled: true
@@ -1210,6 +1303,9 @@ hubble:
   #   2047, 4095, 8191, 16383, 32767, 65535
   # eventBufferCapacity: "4095"
 
+  # -- The interval at which Hubble will send out lost events from the Observer server, if any.
+  # lostEventSendInterval: 1s
+
   # -- Hubble metrics configuration.
   # See https://docs.cilium.io/en/stable/observability/metrics/#hubble-metrics
   # for more comprehensive documentation about Hubble metrics.
@@ -1503,9 +1599,9 @@ hubble:
       # @schema
       override: ~
       repository: "quay.io/cilium/hubble-relay"
-      tag: "v1.18.6"
+      tag: "v1.19.1"
       # hubble-relay-digest
-      digest: sha256:fb6135e34c31e5f175cb5e75f86cea52ef2ff12b49bcefb7088ed93f5009eb8e
+      digest: sha256:d8c4e13bc36a56179292bb52bc6255379cb94cb873700d316ea3139b1bdb8165
       useDigest: true
       pullPolicy: "IfNotPresent"
     # -- Specifies the resources for the hubble-relay pods
@@ -1716,6 +1812,24 @@ hubble:
       address: localhost
       # -- Configure pprof listen port for hubble-relay
       port: 6062
+      # -- Enable mutex contention profiling for hubble-relay and set the fraction of sampled events (set to 1 to sample all events)
+      mutexProfileFraction: 0
+      # -- Enable goroutine blocking profiling for hubble-relay and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead])
+      blockProfileRate: 0
+    # -- Logging configuration for hubble-relay.
+    logOptions:
+      # @schema
+      # type: [null, string]
+      # @schema
+      # -- Log format for hubble-relay. Valid values are: text, text-ts, json, json-ts.
+      # @default -- text-ts
+      format: ~
+      # @schema
+      # type: [null, string]
+      # @schema
+      # -- Log level for hubble-relay. Valid values are: debug, info, warn, error.
+      # @default -- info
+      level: ~
   ui:
     # -- Whether to enable the Hubble UI.
     enabled: false
@@ -1911,6 +2025,11 @@ hubble:
       #  - secretName: chart-example-tls
       #    hosts:
       #      - chart-example.local
+    # -- Configure temporary volume for hubble-ui
+    tmpVolume: {}
+    # emptyDir:
+    #   # sizeLimit: "100Mi"
+    #   # medium: "Memory"
   # -- Hubble flows export.
   export:
     # --- Static exporter configuration.
@@ -1923,6 +2042,14 @@ hubble:
       # - source
       # - destination
       # - verdict
+      fieldAggregate: []
+      # - time
+      # - source
+      # - destination
+      # - verdict
+      # --- Defines the interval at which to aggregate before exporting Hubble flows.
+      #     Aggregation feature is only enabled when fieldAggregate is specified and aggregationInterval > 0s.
+      aggregationInterval: "0s"
       allowList: []
       # - '{"verdict":["DROPPED","ERROR"]}'
       denyList: []
@@ -1948,6 +2075,8 @@ hubble:
         content:
           - name: all
             fieldMask: []
+            fieldAggregate: []
+            aggregationInterval: "0s"
             includeFilters: []
             excludeFilters: []
             filePath: "/var/run/cilium/hubble/events.log"
@@ -2040,11 +2169,30 @@ ipam:
     # refill the bucket up to the burst size capacity.
     # @default -- `4.0`
     externalAPILimitQPS: ~
-# -- defaultLBServiceIPAM indicates the default LoadBalancer Service IPAM when
-# no LoadBalancer class is set. Applicable values: lbipam, nodeipam, none
+  # -- NodeSpec configuration for the IPAM
+  nodeSpec:
+    # -- IPAM min allocate
+    # @schema
+    # type: [null, integer]
+    # @schema
+    ipamMinAllocate: ~
+    # -- IPAM pre allocate
+    # @schema
+    # type: [null, integer]
+    # @schema
+    ipamPreAllocate: ~
+    # -- IPAM max allocate
+    # @schema
+    # type: [null, integer]
+    # @schema
+    ipamMaxAllocate: ~
+    # -- IPAM static IP tags (currently only works with AWS and Azure)
+    ipamStaticIPTags: []
 # @schema
 # type: [string]
 # @schema
+# -- defaultLBServiceIPAM indicates the default LoadBalancer Service IPAM when
+# no LoadBalancer class is set. Applicable values: lbipam, nodeipam, none
 defaultLBServiceIPAM: lbipam
 nodeIPAM:
   # -- Configure Node IPAM
@@ -2155,7 +2303,7 @@ maglev: {}
 # type: [null, boolean]
 # @schema
 # -- (bool) Enables masquerading of IPv4 traffic leaving the node from endpoints.
-# @default -- `true` unless ipam eni mode is active 
+# @default -- `true` unless ipam eni mode is active
 enableIPv4Masquerade: ~
 # -- Enables masquerading of IPv6 traffic leaving the node from endpoints.
 enableIPv6Masquerade: true
@@ -2165,6 +2313,8 @@ enableMasqueradeRouteSource: false
 enableIPv4BIGTCP: false
 # -- Enables IPv6 BIG TCP support which increases maximum IPv6 GSO/GRO limits for nodes and pods
 enableIPv6BIGTCP: false
+# -- Enable BIG TCP in tunneling mode and increase maximum GRO/GSO limits for VXLAN/GENEVE tunnels
+enableTunnelBIGTCP: false
 nat:
   # -- Number of the top-k SNAT map connections to track in Cilium statedb.
   mapStatsEntries: 32
@@ -2266,8 +2416,6 @@ loadBalancer:
     algorithm: round_robin
 # -- Configure N-S k8s service loadbalancing
 nodePort:
-  # -- Enable the Cilium NodePort service implementation.
-  enabled: false
   # -- Port range to use for NodePort services.
   # range: "30000,32767"
 
@@ -2311,6 +2459,10 @@ pprof:
   address: localhost
   # -- Configure pprof listen port for cilium-agent
   port: 6060
+  # -- Enable mutex contention profiling for cilium-agent and set the fraction of sampled events (set to 1 to sample all events)
+  mutexProfileFraction: 0
+  # -- Enable goroutine blocking profiling for cilium-agent and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead])
+  blockProfileRate: 0
 # -- Configure prometheus metrics on the configured port at /metrics
 prometheus:
   metricsService: false
@@ -2435,6 +2587,12 @@ envoy:
   initialFetchTimeoutSeconds: 30
   # -- Maximum number of concurrent retries on Envoy clusters
   maxConcurrentRetries: 128
+  # -- Maximum number of connections on Envoy clusters
+  clusterMaxConnections: 1024
+  # -- Maximum number of requests on Envoy clusters
+  clusterMaxRequests: 1024
+  # -- Maximum number of global downstream connections
+  maxGlobalDownstreamConnections: 50000
   # -- Maximum number of retries for each HTTP request
   httpRetryCount: 3
   # -- ProxyMaxRequestsPerConnection specifies the max_requests_per_connection setting for Envoy
@@ -2451,6 +2609,9 @@ envoy:
   xffNumTrustedHopsL7PolicyIngress: 0
   # -- Number of trusted hops regarding the x-forwarded-for and related HTTP headers for the egress L7 policy enforcement Envoy listeners.
   xffNumTrustedHopsL7PolicyEgress: 0
+  # -- For cases when CiliumEnvoyConfig is not used directly (Ingress, Gateway), configures Cilium BPF Metadata listener filter
+  # to use the original source address when extracting the metadata for a request.
+  useOriginalSourceAddress: true
   # @schema
   # type: [null, string]
   # @schema
@@ -2465,10 +2626,12 @@ envoy:
     # @schema
     override: ~
     repository: "quay.io/cilium/cilium-envoy"
-    tag: "v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9"
+    tag: "v1.35.9-1770979049-232ed4a26881e4ab4f766f251f258ed424fff663"
     pullPolicy: "IfNotPresent"
-    digest: "sha256:81398e449f2d3d0a6a70527e4f641aaa685d3156bea0bb30712fae3fd8822b86"
+    digest: "sha256:8188114a2768b5f49d6ce58e168b20d765e0fbc64eee0d83241aa2b150ccd788"
     useDigest: true
+  # -- Init containers added to the cilium Envoy DaemonSet.
+  initContainers: []
   # -- Additional containers added to the cilium Envoy DaemonSet.
   extraContainers: []
   # -- Additional envoy container arguments.
@@ -2699,16 +2862,15 @@ resourceQuotas:
       pods: "15"
 # Need to document default
 ##################
-#sessionAffinity: false
 
 # -- Annotations to be added to all cilium-secret namespaces (resources under templates/cilium-secrets-namespace)
 secretsNamespaceAnnotations: {}
+# -- Labels to be added to all cilium-secret namespaces (resources under templates/cilium-secrets-namespace)
+secretsNamespaceLabels: {}
 # -- Do not run Cilium agent when running with clean mode. Useful to completely
 # uninstall Cilium as it will stop Cilium from starting and create artifacts
 # in the node.
 sleepAfterInit: false
-# -- Enable check of service source ranges (currently, only for LoadBalancer).
-svcSourceRangeCheck: true
 # -- Synchronize Kubernetes nodes to kvstore and perform CNP GC.
 synchronizeK8sNodes: true
 # -- Configure TLS configuration in the agent.
@@ -2791,6 +2953,9 @@ tls:
 # @default -- `"vxlan"`
 tunnelProtocol: ""
 # -- IP family for the underlay.
+# Possible values:
+#   - "ipv4"
+#   - "ipv6"
 # @default -- `"ipv4"`
 underlayProtocol: ""
 # -- Enable native-routing mode or tunneling mode.
@@ -2811,6 +2976,11 @@ tunnelSourcePortRange: 0-0
 #  - reject (default)
 #  - drop
 serviceNoBackendResponse: reject
+# -- Configure what the response should be to pod egress traffic denied by network policy.
+# Possible values:
+#  - none (default)
+#  - icmp
+policyDenyResponse: none
 # -- Configure the underlying network MTU to overwrite auto-detected MTU.
 # This value doesn't change the host network interface MTU i.e. eth0 or ens0.
 # It changes the MTU for cilium_net@cilium_host, cilium_host@cilium_net,
@@ -2841,15 +3011,15 @@ operator:
     # @schema
     override: ~
     repository: "quay.io/cilium/operator"
-    tag: "v1.18.6"
+    tag: "v1.19.1"
     # operator-generic-digest
-    genericDigest: sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af
+    genericDigest: sha256:e7278d763e448bf6c184b0682cf98cdca078d58a27e1b2f3c906792670aa211a
     # operator-azure-digest
-    azureDigest: sha256:a57aff47aeb32eccfedaa2a49d1af984d996d6d6de79609c232e0c4cf9ce97a1
+    azureDigest: sha256:82bce78603056e709d4c4e9f9ebb25c222c36d8a07f8c05381c2372d9078eca8
     # operator-aws-digest
-    awsDigest: sha256:47dbc1a5bd483fec170dab7fb0bf2cca3585a4893675b0324d41d97bac8be5eb
+    awsDigest: sha256:18913d05a6c4d205f0b7126c4723bb9ccbd4dc24403da46ed0f9f4bf2a142804
     # operator-alibabacloud-digest
-    alibabacloudDigest: sha256:212c4cbe27da3772bcb952b8f8cbaa0b0eef72488b52edf90ad2b32072a3ca4c
+    alibabacloudDigest: sha256:837b12f4239e88ea5b4b5708ab982c319a94ee05edaecaafe5fd0e5b1962f554
     useDigest: true
     pullPolicy: "IfNotPresent"
     suffix: ""
@@ -2988,6 +3158,10 @@ operator:
     address: localhost
     # -- Configure pprof listen port for cilium-operator
     port: 6061
+    # -- Enable mutex contention profiling for cilium-operator and set the fraction of sampled events (set to 1 to sample all events)
+    mutexProfileFraction: 0
+    # -- Enable goroutine blocking profiling for cilium-operator and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead])
+    blockProfileRate: 0
   # -- Enable prometheus metrics for cilium-operator on the configured port at
   # /metrics
   prometheus:
@@ -3021,6 +3195,17 @@ operator:
       # @schema
       # -- Metrics relabeling configs for the ServiceMonitor cilium-operator
       metricRelabelings: ~
+    # -- TLS configuration for Prometheus
+    tls:
+      enabled: false
+      server:
+        # -- Name of the Secret containing the certificate, key and CA files for the Prometheus server.
+        existingSecret: ""
+        mtls:
+          # When set to true enforces mutual TLS between Operator Prometheus server and its clients.
+          # False allow non-mutual TLS connections.
+          # This option has no effect when TLS is disabled.
+          enabled: false
   # -- Grafana dashboards for cilium-operator
   # grafana can import dashboards based on the label and value
   # ref: https://github.com/grafana/helm-charts/tree/main/charts/grafana#sidecar-for-dashboards
@@ -3054,6 +3239,12 @@ operator:
     # -- Interval, in seconds, to check if there are any pods that are not
     # managed by Cilium.
     intervalSeconds: 15
+    # -- Selector for pods that should be restarted when not managed by Cilium.
+    # If not set, defaults to built-in selector "k8s-app=kube-dns". Set to empty string to select all pods.
+    # @schema
+    # type: [null, string]
+    # @schema
+    selector: ~
 nodeinit:
   # -- Enable the node initialization DaemonSet
   enabled: false
@@ -3064,8 +3255,8 @@ nodeinit:
     # @schema
     override: ~
     repository: "quay.io/cilium/startup-script"
-    tag: "1755531540-60ee83e"
-    digest: "sha256:5bdca3c2dec2c79f58d45a7a560bf1098c2126350c901379fe850b7f78d3d757"
+    tag: "1763560095-8f36c34"
+    digest: "sha256:50b9cf9c280096b59b80d2fc8ee6638facef79ac18998a22f0cbc40d5d28c16f"
     useDigest: true
     pullPolicy: "IfNotPresent"
   # -- The priority class to use for the nodeinit pod.
@@ -3108,6 +3299,9 @@ nodeinit:
   # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
   resources:
     requests:
+      # @schema
+      # type: [integer, string]
+      # @schema
       cpu: 100m
       memory: 100Mi
   # -- Security context to be added to nodeinit pods.
@@ -3130,6 +3324,8 @@ nodeinit:
   # -- bootstrapFile is the location of the file where the bootstrap timestamp is
   # written by the node-init DaemonSet
   bootstrapFile: "/tmp/cilium-bootstrap.d/cilium-bootstrap-time"
+  # -- wait for Cloud init to finish on the host and assume the node has cloud init installed
+  waitForCloudInit: false
   # -- startup offers way to customize startup nodeinit script (pre and post position)
   startup:
     preScript: ""
@@ -3148,9 +3344,9 @@ preflight:
     # @schema
     override: ~
     repository: "quay.io/cilium/cilium"
-    tag: "v1.18.6"
+    tag: "v1.19.1"
     # cilium-digest
-    digest: sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4
+    digest: sha256:41f1f74a0000de8656f1de4088ea00c8f2d49d6edea579034c73c5fd5fe01792
     useDigest: true
     pullPolicy: "IfNotPresent"
   envoy:
@@ -3161,9 +3357,9 @@ preflight:
       # @schema
       override: ~
       repository: "quay.io/cilium/cilium-envoy"
-      tag: "v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9"
+      tag: "v1.35.9-1770979049-232ed4a26881e4ab4f766f251f258ed424fff663"
       pullPolicy: "IfNotPresent"
-      digest: "sha256:81398e449f2d3d0a6a70527e4f641aaa685d3156bea0bb30712fae3fd8822b86"
+      digest: "sha256:8188114a2768b5f49d6ce58e168b20d765e0fbc64eee0d83241aa2b150ccd788"
       useDigest: true
   # -- The priority class to use for the preflight pod.
   priorityClassName: ""
@@ -3263,7 +3459,9 @@ enableCriticalPriorityClass: true
 # on AArch64 as the images do not currently ship a version of Envoy.
 #disableEnvoyVersionCheck: false
 clustermesh:
-  # -- Deploy clustermesh-apiserver for clustermesh
+  # -- Deploy clustermesh-apiserver for clustermesh. This option is typically
+  # used with ``clustermesh.config.enabled=true``. Refer to the
+  # ``clustermesh.config.enabled=true``documentation for more information.
   useAPIServer: false
   # -- The maximum number of clusters to support in a ClusterMesh. This value
   # cannot be changed on running clusters, and all clusters in a ClusterMesh
@@ -3271,44 +3469,132 @@ clustermesh:
   # maximum allocatable cluster-local identities.
   # Supported values are 255 and 511.
   maxConnectedClusters: 255
+  # -- The time to live for the cache of a remote cluster after connectivity is
+  # lost. If the connection is not re-established within this duration, the
+  # cached data is revoked to prevent stale state. If not specified or set to
+  # 0s, the cache is never revoked (default).
+  cacheTTL: "0s"
   # -- Enable the synchronization of Kubernetes EndpointSlices corresponding to
   # the remote endpoints of appropriately-annotated global services through ClusterMesh
   enableEndpointSliceSynchronization: false
-  # -- Enable Multi-Cluster Services API support
+  # -- Enable Multi-Cluster Services API support (deprecated; use clustermesh.mcsapi.enabled)
   enableMCSAPISupport: false
   # -- Control whether policy rules assume by default the local cluster if not explicitly selected
-  policyDefaultLocalCluster: false
+  policyDefaultLocalCluster: true
   # -- Annotations to be added to all top-level clustermesh objects (resources under templates/clustermesh-apiserver and templates/clustermesh-config)
   annotations: {}
   # -- Clustermesh explicit configuration.
   config:
     # -- Enable the Clustermesh explicit configuration.
+    # If set to false, you need to provide the following resources yourself:
+    # - (Secret) cilium-clustermesh (used by cilium-agent/cilium-operator to connect to
+    #   the local etcd instance if KVStoreMesh is enabled or the remote clusters
+    #   if KVStoreMesh is disabled)
+    # - (Secret) cilium-kvstoremesh (used by KVStoreMesh to connect to the remote clusters)
+    # - (ConfigMap) clustermesh-remote-users (used to create one etcd user per remote cluster
+    #   if clustermesh-apiserver is used and `clustermesh.apiserver.tls.authMode` is not
+    #   set to `legacy`)
     enabled: false
     # -- Default dns domain for the Clustermesh API servers
     # This is used in the case cluster addresses are not provided
     # and IPs are used.
     domain: mesh.cilium.io
-    # -- List of clusters to be peered in the mesh.
+    # -- Clusters to be peered in the mesh.
+    # @schema
+    # type: [object, array]
+    # @schema
     clusters: []
+    # You can use a dict of clusters (recommended):
     # clusters:
-    # # -- Name of the cluster
+    #   # -- Name of the cluster
+    #   cluster1:
+    #     # -- Whether to enable this cluster in the mesh. Optional, defaults to true.
+    #     enabled: true
+    #     # -- Address of the cluster, use this if you created DNS records for
+    #     # the cluster Clustermesh API server.
+    #     address: cluster1.mesh.cilium.io
+    #     # -- Port of the cluster Clustermesh API server.
+    #     port: 2379
+    #     # -- IPs of the cluster Clustermesh API server, use multiple ones when
+    #     # you have multiple IPs to access the Clustermesh API server.
+    #     ips:
+    #     - 172.18.255.201
+    #     # -- (deprecated) base64 encoded PEM values for the cluster client certificate, private key and certificate authority.
+    #     # These fields can (and should) be omitted in case the CA is shared across clusters. In that case, the
+    #     # "remote" private key and certificate available in the local cluster are automatically used instead.
+    #     tls:
+    #       cert: ""
+    #       key: ""
+    #       caCert: ""
+    #
+    # Or alternatively you can use a list of clusters:
+    # clusters:
+    #   # -- Name of the cluster
     # - name: cluster1
-    # # -- Address of the cluster, use this if you created DNS records for
-    # # the cluster Clustermesh API server.
+    #   # -- Address of the cluster, use this if you created DNS records for
+    #   # the cluster Clustermesh API server.
     #   address: cluster1.mesh.cilium.io
-    # # -- Port of the cluster Clustermesh API server.
+    #   # -- Port of the cluster Clustermesh API server.
     #   port: 2379
-    # # -- IPs of the cluster Clustermesh API server, use multiple ones when
-    # # you have multiple IPs to access the Clustermesh API server.
+    #   # -- IPs of the cluster Clustermesh API server, use multiple ones when
+    #   # you have multiple IPs to access the Clustermesh API server.
     #   ips:
     #   - 172.18.255.201
-    # # -- base64 encoded PEM values for the cluster client certificate, private key and certificate authority.
-    # # These fields can (and should) be omitted in case the CA is shared across clusters. In that case, the
-    # # "remote" private key and certificate available in the local cluster are automatically used instead.
+    #   # -- (deprecated) base64 encoded PEM values for the cluster client certificate, private key and certificate authority.
+    #   # These fields can (and should) be omitted in case the CA is shared across clusters. In that case, the
+    #   # "remote" private key and certificate available in the local cluster are automatically used instead.
     #   tls:
     #     cert: ""
     #     key: ""
     #     caCert: ""
+  mcsapi:
+    # -- Enable Multi-Cluster Services API support
+    enabled: false
+    # -- Enabled MCS-API CRDs auto-installation
+    installCRDs: true
+    corednsAutoConfigure:
+      # -- Enable auto-configuration of CoreDNS for Multi-Cluster Services API.
+      #    CoreDNS MUST be at least in version v1.12.2 to run this.
+      enabled: false
+      coredns:
+        # -- The Deployment for the cluster CoreDNS service
+        deploymentName: coredns
+        # -- The Service Account name for the cluster CoreDNS service
+        serviceAccountName: coredns
+        # -- The ConfigMap name for the cluster CoreDNS service
+        configMapName: coredns
+        # -- The namespace for the cluster CoreDNS service
+        namespace: kube-system
+        # -- The cluster domain for the cluster CoreDNS service
+        clusterDomain: cluster.local
+        # -- The clusterset domain for the cluster CoreDNS service
+        clustersetDomain: clusterset.local
+      # -- Additional arguments to `clustermesh-apiserver coredns-mcsapi-auto-configure`.
+      extraArgs: []
+      # -- Seconds after which the completed job pod will be deleted
+      ttlSecondsAfterFinished: 1800
+      # -- Labels to be added to coredns-mcsapi-autoconfig pods
+      podLabels: {}
+      # -- Annotations to be added to the coredns-mcsapi-autoconfig Job
+      annotations: {}
+      # -- Node selector for coredns-mcsapi-autoconfig
+      # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector
+      nodeSelector: {}
+      # -- Priority class for coredns-mcsapi-autoconfig
+      # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass
+      priorityClassName: ""
+      # -- Node tolerations for pod assignment on nodes with taints
+      # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
+      tolerations: []
+      # -- Resource limits for coredns-mcsapi-autoconfig
+      # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers
+      resources: {}
+      # -- Additional coredns-mcsapi-autoconfig volumes.
+      extraVolumes: []
+      # -- Additional coredns-mcsapi-autoconfig volumeMounts.
+      extraVolumeMounts: []
+      # -- Affinity for coredns-mcsapi-autoconfig
+      affinity: {}
   apiserver:
     # -- Clustermesh API server image.
     image:
@@ -3317,9 +3603,9 @@ clustermesh:
       # @schema
       override: ~
       repository: "quay.io/cilium/clustermesh-apiserver"
-      tag: "v1.18.6"
+      tag: "v1.19.1"
       # clustermesh-apiserver-digest
-      digest: sha256:8ee142912a0e261850c0802d9256ddbe3729e1cd35c6bea2d93077f334c3cf3b
+      digest: sha256:56d6c3dc13b50126b80ecb571707a0ea97f6db694182b9d61efd386d04e5bb28
       useDigest: true
       pullPolicy: "IfNotPresent"
     # -- TCP port for the clustermesh-apiserver health API.
@@ -3408,17 +3694,12 @@ clustermesh:
       # - "external": ``clustermesh-apiserver`` will sync remote cluster information to the etcd used as kvstore. This can't be enabled with crd identity allocation mode.
       kvstoreMode: "internal"
     service:
+      # -- (bool) Set externallyCreated to true to create the clustermesh-apiserver service outside this helm chart.
+      # For example after external load balancer controllers are created.
+      externallyCreated: false
       # -- The type of service used for apiserver access.
       type: NodePort
       # -- Optional port to use as the node port for apiserver access.
-      #
-      # WARNING: make sure to configure a different NodePort in each cluster if
-      # kube-proxy replacement is enabled, as Cilium is currently affected by a known
-      # bug (#24692) when NodePorts are handled by the KPR implementation. If a service
-      # with the same NodePort exists both in the local and the remote cluster, all
-      # traffic originating from inside the cluster and targeting the corresponding
-      # NodePort will be redirected to a local backend, regardless of whether the
-      # destination node belongs to the local or the remote cluster.
       nodePort: 32379
       # -- Annotations for the clustermesh-apiserver service.
       # Example annotations to configure an internal load balancer on different cloud providers:
@@ -3587,13 +3868,15 @@ clustermesh:
       #               The "remote" certificate must be generated with CN=remote-<cluster-name>
       #               if provided manually. Cluster mode is meaningful only when the same
       #               CA is shared across all clusters part of the mesh.
-      authMode: legacy
-      # -- Allow users to provide their own certificates
+      authMode: migration
+      # -- (deprecated) Allow users to provide their own certificates
       # Users may need to provide their certificates using
       # a mechanism that requires they provide their own secrets.
       # This setting does not apply to any of the auto-generated
       # mechanisms below, it only restricts the creation of secrets
       # via the `tls-provided` templates.
+      # This option is deprecated as secrets are expected to be created
+      # externally when 'auto' is not enabled.
       enableSecrets: true
       # -- Configure automatic TLS certificates generation.
       # A Kubernetes CronJob is used the generate any
@@ -3602,7 +3885,14 @@ clustermesh:
       auto:
         # -- When set to true, automatically generate a CA and certificates to
         # enable mTLS between clustermesh-apiserver and external workload instances.
-        # If set to false, the certs to be provided by setting appropriate values below.
+        #
+        # When set to false you need to pre-create the following secrets:
+        # - clustermesh-apiserver-server-cert
+        # - clustermesh-apiserver-admin-cert
+        # - clustermesh-apiserver-remote-cert
+        # - clustermesh-apiserver-local-cert
+        # The above secret should at least contains the keys `tls.crt` and `tls.key`
+        # and optionally `ca.crt` if a CA bundle is not configured.
         enabled: true
         # Sets the method to auto-generate certificates. Supported values:
         # - helm:         This method uses Helm to generate all certificates.
@@ -3637,7 +3927,9 @@ clustermesh:
       # -- base64 encoded PEM values for the clustermesh-apiserver server certificate and private key.
       # Used if 'auto' is not enabled.
       server:
+        # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled.
         cert: ""
+        # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled.
         key: ""
         # -- Extra DNS names added to certificate when it's auto generated
         extraDnsNames: []
@@ -3646,17 +3938,16 @@ clustermesh:
       # -- base64 encoded PEM values for the clustermesh-apiserver admin certificate and private key.
       # Used if 'auto' is not enabled.
       admin:
+        # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled.
         cert: ""
-        key: ""
-      # -- base64 encoded PEM values for the clustermesh-apiserver client certificate and private key.
-      # Used if 'auto' is not enabled.
-      client:
-        cert: ""
+        # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled.
         key: ""
       # -- base64 encoded PEM values for the clustermesh-apiserver remote cluster certificate and private key.
       # Used if 'auto' is not enabled.
       remote:
+        # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled.
         cert: ""
+        # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled.
         key: ""
     # clustermesh-apiserver Prometheus metrics configuration
     metrics:
@@ -3811,7 +4102,7 @@ authentication:
   # -- Enable authentication processing and garbage collection.
   # Note that if disabled, policy enforcement will still block requests that require authentication.
   # But the resulting authentication requests for these requests will not be processed, therefore the requests not be allowed.
-  enabled: true
+  enabled: false
   # -- Buffer size of the channel Cilium uses to receive authentication events from the signal map.
   queueSize: 1024
   # -- Buffer size of the channel Cilium uses to receive certificate expiration events from auth handlers.
@@ -3849,7 +4140,7 @@ authentication:
           override: ~
           repository: "docker.io/library/busybox"
           tag: "1.37.0"
-          digest: "sha256:2383baad1860bbe9d8a7a843775048fd07d8afe292b94bd876df64a69aae7cb1"
+          digest: "sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f"
           useDigest: true
           pullPolicy: "IfNotPresent"
         # SPIRE agent configuration
@@ -3863,8 +4154,8 @@ authentication:
             # @schema
             override: ~
             repository: "ghcr.io/spiffe/spire-agent"
-            tag: "1.12.4"
-            digest: "sha256:163970884fba18860cac93655dc32b6af85a5dcf2ebb7e3e119a10888eff8fcd"
+            tag: "1.9.6"
+            digest: "sha256:5106ac601272a88684db14daf7f54b9a45f31f77bb16a906bd5e87756ee7b97c"
             useDigest: true
             pullPolicy: "IfNotPresent"
           # -- SPIRE agent service account
@@ -3918,8 +4209,8 @@ authentication:
             # @schema
             override: ~
             repository: "ghcr.io/spiffe/spire-server"
-            tag: "1.12.4"
-            digest: "sha256:34147f27066ab2be5cc10ca1d4bfd361144196467155d46c45f3519f41596e49"
+            tag: "1.9.6"
+            digest: "sha256:59a0b92b39773515e25e68a46c40d3b931b9c1860bc445a79ceb45a805cab8b4"
             useDigest: true
             pullPolicy: "IfNotPresent"
           # -- SPIRE server service account
@@ -4004,3 +4295,41 @@ authentication:
 enableInternalTrafficPolicy: true
 # -- Enable LoadBalancer IP Address Management
 enableLBIPAM: true
+# -- Standalone DNS Proxy Configuration
+# Note: The standalone DNS proxy uses the agent's dnsProxy.* configuration
+# for DNS settings (proxyPort, enableDnsCompression) to ensure consistency.
+standaloneDnsProxy:
+  # -- Enable standalone DNS proxy (alpha feature)
+  enabled: false
+  # -- Roll out Standalone DNS proxy automatically when configmap is updated.
+  rollOutPods: false
+  # -- Standalone DNS proxy annotations
+  annotations: {}
+  # -- Standalone DNS proxy debug mode
+  debug: false
+  # -- Standalone DNS proxy server port
+  serverPort: 10095
+  # -- Standalone DNS proxy Node Selector
+  nodeSelector:
+    kubernetes.io/os: linux
+  # -- Standalone DNS proxy tolerations
+  tolerations: []
+  # -- Standalone DNS proxy auto mount service account token
+  automountServiceAccountToken: false
+  # -- Standalone DNS proxy update strategy
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 2
+      maxUnavailable: 0
+  # -- Standalone DNS proxy image
+  image:
+    # @schema
+    # type: [null, string]
+    # @schema
+    override: ~
+    repository: ""
+    tag: ""
+    digest: ""
+    useDigest: true
+    pullPolicy: "IfNotPresent"
diff --git a/packages/system/cilium/charts/cilium/values.yaml.tmpl b/packages/system/cilium/charts/cilium/values.yaml.tmpl
index 83b87cfd..c21f1c26 100644
--- a/packages/system/cilium/charts/cilium/values.yaml.tmpl
+++ b/packages/system/cilium/charts/cilium/values.yaml.tmpl
@@ -3,7 +3,6 @@
 # type: [null, string]
 # @schema
 # -- namespaceOverride allows to override the destination namespace for Cilium resources.
-# This property allows to use Cilium as part of an Umbrella Chart with different targets.
 namespaceOverride: ""
 # @schema
 # type: [null, object]
@@ -27,7 +26,7 @@ debug:
   # @schema
   # -- Configure verbosity levels for debug logging
   # This option is used to enable debug messages for operations related to such
-  # sub-system such as (e.g. kvstore, envoy, datapath or policy), and flow is
+  # sub-system such as (e.g. kvstore, envoy, datapath, policy, or tagged), and flow is
   # for enabling debug messages emitted per request, message and connection.
   # Multiple values can be set via a space-separated string (e.g. "datapath envoy").
   #
@@ -37,6 +36,7 @@ debug:
   # - envoy
   # - datapath
   # - policy
+  # - tagged
   verbose: ~
 
   # -- Set the agent-internal metrics sampling frequency. This sets the
@@ -207,6 +207,12 @@ serviceAccounts:
     name: hubble-generate-certs
     automount: true
     annotations: {}
+  # -- CorednsMCSAPI is used if clustermesh.mcsapi.corednsAutoConfigure.enabled=true
+  corednsMCSAPI:
+    create: true
+    name: cilium-coredns-mcsapi-autoconfig
+    automount: true
+    annotations: {}
 # -- Configure termination grace period for cilium-agent DaemonSet.
 terminationGracePeriodSeconds: 1
 # -- Install the cilium agent resources.
@@ -368,6 +374,8 @@ securityContext:
       - SETGID
       # Allow to execute program that changes UID (e.g. required for package installation)
       - SETUID
+      # Allow to read dmesg and get kernel pointers when kptr_restrict=1
+      - SYSLOG
     # -- Capabilities for the `mount-cgroup` init container
     mountCgroup:
       # Only used for 'mount' cgroup
@@ -440,9 +448,16 @@ azure:
   # clientID: 00000000-0000-0000-0000-000000000000
   # clientSecret: 00000000-0000-0000-0000-000000000000
   # userAssignedIdentityID: 00000000-0000-0000-0000-000000000000
+  nodeSpec:
+    azureInterfaceName: ""
 alibabacloud:
   # -- Enable AlibabaCloud ENI integration
   enabled: false
+  nodeSpec:
+    vSwitches: []
+    vSwitchTags: []
+    securityGroups: []
+    securityGroupTags: []
 # -- Enable bandwidth manager to optimize TCP and UDP workloads and allow
 # for rate-limiting traffic from individual Pods with EDT (Earliest Departure
 # Time) through the "kubernetes.io/egress-bandwidth" Pod annotation.
@@ -475,8 +490,7 @@ l2podAnnouncements:
   interface: "eth0"
   # -- A regular expression matching interfaces used for sending Gratuitous ARP pod announcements
   # interfacePattern: ""
-# -- This feature set enables virtual BGP routers to be created via
-# CiliumBGPPeeringPolicy CRDs.
+# -- This feature set enables virtual BGP routers to be created via BGP CRDs.
 bgpControlPlane:
   # -- Enables the BGP control plane.
   enabled: false
@@ -486,9 +500,9 @@ bgpControlPlane:
     create: false
     # -- The name of the secret namespace to which Cilium agents are given read access
     name: kube-system
-  # -- Status reporting settings (BGPv2 only)
+  # -- Status reporting settings
   statusReport:
-    # -- Enable/Disable BGPv2 status reporting
+    # -- Enable/Disable BGP status reporting
     # It is recommended to enable status reporting in general, but if you have any issue
     # such as high API server load, you can disable it by setting this to false.
     enabled: true
@@ -498,7 +512,7 @@ bgpControlPlane:
     mode: "default"
     # -- IP pool to allocate the BGP router-id from when the mode is ip-pool.
     ipPool: ""
-  # -- Legacy BGP ORIGIN attribute settings (BGPv2 only)
+  # -- Legacy BGP ORIGIN attribute settings
   legacyOriginAttribute:
     # -- Enable/Disable advertising LoadBalancerIP routes with the legacy
     # BGP ORIGIN attribute value INCOMPLETE (2) instead of the default IGP (0).
@@ -508,6 +522,11 @@ pmtuDiscovery:
   # -- Enable path MTU discovery to send ICMP fragmentation-needed replies to
   # the client.
   enabled: false
+  # -- Enable kernel probing path MTU discovery for Pods which uses different message
+  # sizes to search for correct MTU value.
+  # Valid values are: always, blackhole, disabled and unset (or empty). If value
+  # is 'unset' or left empty then will not try to override setting.
+  packetizationLayerPMTUDMode: "blackhole"
 bpf:
   autoMount:
     # -- Enable automatic mount of BPF filesystem
@@ -555,7 +574,7 @@ bpf:
   # Helm configuration for BPF events map rate limiting is experimental and might change
   # in upcoming releases.
   events:
-    # -- Default settings for all types of events except dbg and pcap.
+    # -- Default settings for all types of events except dbg.
     default:
       # @schema
       # type: [null, integer]
@@ -615,6 +634,12 @@ bpf:
   # type: [null, integer]
   # @schema
   policyMapMax: 16384
+  # -- (float64) Configure threshold for emitting pressure metrics of policy maps.
+  # @schema
+  # type: [null, number]
+  # @schema
+  # @default -- `0.1`
+  policyMapPressureMetricsThreshold: ~
   # -- Configure the maximum number of entries in global policy stats map.
   # @schema
   # type: [null, integer]
@@ -672,7 +697,8 @@ bpf:
   # type: [null, boolean]
   # @schema
   # -- (bool) Configure the eBPF-based TPROXY (beta) to reduce reliance on iptables rules
-  # for implementing Layer 7 policy.
+  # for implementing Layer 7 policy. Note this is incompatible with netkit (`bpf.datapathMode=netkit`,
+  # `bpf.datapathMode=netkit-l2`).
   # @default -- `false`
   tproxy: ~
   # @schema
@@ -682,6 +708,15 @@ bpf:
   # [0] will allow all VLAN id's without any filtering.
   # @default -- `[]`
   vlanBypass: ~
+  # -- Configure the IP tracing option type.
+  # This option is used to specify the IP option type to use for tracing.
+  # The value must be an integer between 0 and 255.
+  # @schema
+  # type: [null, integer]
+  # minimum: 0
+  # maximum: 255
+  # @schema
+  monitorTraceIPOption: 0
   # -- (bool) Disable ExternalIP mitigation (CVE-2020-8554)
   # @default -- `false`
   disableExternalIPMitigation: false
@@ -689,7 +724,8 @@ bpf:
   # supported kernels.
   # @default -- `true`
   enableTCX: true
-  # -- (string) Mode for Pod devices for the core datapath (veth, netkit, netkit-l2)
+  # -- (string) Mode for Pod devices for the core datapath (veth, netkit, netkit-l2).
+  # Note netkit is incompatible with TPROXY (`bpf.tproxy`).
   # @default -- `veth`
   datapathMode: veth
 # -- Enable BPF clock source probing for more efficient tick retrieval.
@@ -778,8 +814,17 @@ cni:
   # -- Specifies the resources for the cni initContainer
   resources:
     requests:
+      # @schema
+      # type: [integer, string]
+      # @schema
       cpu: 100m
       memory: 10Mi
+    limits:
+      # @schema
+      # type: [integer, string]
+      # @schema
+      cpu: 1
+      memory: 1Gi
   # -- Enable route MTU for pod netns when CNI chaining is used
   enableRouteMTUForCNIChaining: false
   # -- Enable the removal of iptables rules created by the AWS CNI VPC plugin.
@@ -804,10 +849,6 @@ conntrackGCMaxInterval: ""
 # -- (string) Configure timeout in which Cilium will exit if CRDs are not available
 # @default -- `"5m"`
 crdWaitTimeout: ""
-# -- Tail call hooks for custom eBPF programs.
-customCalls:
-  # -- Enable tail call hooks for custom eBPF programs.
-  enabled: false
 daemon:
   # -- Configure where Cilium runtime state should be stored.
   runPath: "/var/run/cilium"
@@ -850,6 +891,13 @@ daemon:
   #
   # By default, this functionality is enabled
   enableSourceIPVerification: true
+
+# -- Configure temporary volume for cilium-agent
+tmpVolume: {}
+  # emptyDir:
+  #   sizeLimit: "100Mi"
+  #   medium: "Memory"
+
 # -- Specify which network interfaces can run the eBPF datapath. This means
 # that a packet sent from a pod to a destination outside the cluster will be
 # masqueraded (to an output device IPv4 address), if the output device runs the
@@ -869,9 +917,6 @@ forceDeviceDetection: false
 # -- Enable setting identity mark for local traffic.
 # enableIdentityMark: true
 
-# -- Enable Kubernetes EndpointSlice feature in Cilium if the cluster supports it.
-# enableK8sEndpointSlice: true
-
 # -- CiliumEndpointSlice configuration options.
 ciliumEndpointSlice:
   # -- Enable Cilium EndpointSlice feature.
@@ -1056,20 +1101,33 @@ enableXTSocketFallback: true
 encryption:
   # -- Enable transparent network encryption.
   enabled: false
-  # -- Encryption method. Can be either ipsec or wireguard.
+  # -- Encryption method. Can be one of ipsec, wireguard or ztunnel.
   type: ipsec
   # -- Enable encryption for pure node to node traffic.
   # This option is only effective when encryption.type is set to "wireguard".
   nodeEncryption: false
-  # -- Configure the WireGuard Pod2Pod strict mode.
+  # -- Configure the Encryption Pod2Pod strict mode.
   strictMode:
-    # -- Enable WireGuard Pod2Pod strict mode.
+    # -- Enable Encryption Pod2Pod strict mode. (deprecated: please use encryption.strictMode.egress.enabled)
     enabled: false
-    # -- CIDR for the WireGuard Pod2Pod strict mode.
+    # -- CIDR for the Encryption Pod2Pod strict mode. (deprecated: please use encryption.strictMode.egress.cidr)
     cidr: ""
-    # -- Allow dynamic lookup of remote node identities.
+    # -- Allow dynamic lookup of remote node identities. (deprecated: please use encryption.strictMode.egress.allowRemoteNodeIdentities)
     # This is required when tunneling is used or direct routing is used and the node CIDR and pod CIDR overlap.
     allowRemoteNodeIdentities: false
+    egress:
+      # -- Enable strict egress encryption.
+      enabled: false
+      # -- CIDR for the Encryption Pod2Pod strict egress mode.
+      cidr: ""
+      # -- Allow dynamic lookup of remote node identities.
+      # This is required when tunneling is used or direct routing is used and the node CIDR and pod CIDR overlap.
+      allowRemoteNodeIdentities: false
+    ingress:
+      # -- Enable strict ingress encryption.
+      # When enabled, all unencrypted overlay ingress traffic will be dropped.
+      # This option is only applicable when WireGuard and tunneling are enabled.
+      enabled: false
   ipsec:
     # -- Name of the key file inside the Kubernetes secret configured via secretName.
     keyFile: keys
@@ -1141,6 +1199,33 @@ eni:
   # -- Filter via AWS EC2 Instance tags (k=v) which will dictate which AWS EC2 Instances
   # are going to be used to create new ENIs
   instanceTagsFilter: []
+  # -- NodeSpec configuration for the ENI
+  nodeSpec:
+    # -- First interface index to use for IP allocation
+    # @schema
+    # type: [null, integer]
+    # @schema
+    firstInterfaceIndex: ~
+    # -- Subnet IDs to use for IP allocation
+    subnetIDs: []
+    # -- Subnet tags to use for IP allocation
+    subnetTags: []
+    # -- Security groups to use for IP allocation
+    securityGroups: []
+    # -- Security group tags to use for IP allocation
+    securityGroupTags: []
+    # -- Exclude interface tags to use for IP allocation
+    excludeInterfaceTags: []
+    # -- Use primary address for IP allocation
+    usePrimaryAddress: false
+    # -- Disable prefix delegation for IP allocation
+    disablePrefixDelegation: false
+    # -- Delete ENI on termination
+    # @schema
+    # type: [null, boolean]
+    # @schema
+    deleteOnTermination: ~
+
 # fragmentTracking enables IPv4 fragment tracking support in the datapath.
 # fragmentTracking: true
 gke:
@@ -1156,6 +1241,8 @@ healthCheckICMPFailureThreshold: 3
 hostFirewall:
   # -- Enables the enforcement of host policies in the eBPF datapath.
   enabled: false
+# -- Enable routing to a service that has zero endpoints
+enableNoServiceEndpointsRoutable: true
 # -- Configure socket LB
 socketLB:
   # -- Enable socket LB
@@ -1183,8 +1270,11 @@ certgen:
     digest: "${CERTGEN_DIGEST}"
     useDigest: true
     pullPolicy: "${PULL_POLICY}"
+  # @schema
+  # type: [null, integer]
+  # @schema
   # -- Seconds after which the completed job pod will be deleted
-  ttlSecondsAfterFinished: 1800
+  ttlSecondsAfterFinished: null
   # -- Labels to be added to hubble-certgen pods
   podLabels: {}
   # -- Annotations to be added to the hubble-certgen initial Job and CronJob
@@ -1209,6 +1299,11 @@ certgen:
   extraVolumeMounts: []
   # -- Affinity for certgen
   affinity: {}
+  cronJob:
+    # -- The number of successful finished jobs to keep
+    successfulJobsHistoryLimit: 3
+    # -- The number of failed finished jobs to keep
+    failedJobsHistoryLimit: 1
 hubble:
   # -- Enable Hubble (true by default).
   enabled: true
@@ -1224,6 +1319,9 @@ hubble:
   #   2047, 4095, 8191, 16383, 32767, 65535
   # eventBufferCapacity: "4095"
 
+  # -- The interval at which Hubble will send out lost events from the Observer server, if any.
+  # lostEventSendInterval: 1s
+
   # -- Hubble metrics configuration.
   # See https://docs.cilium.io/en/stable/observability/metrics/#hubble-metrics
   # for more comprehensive documentation about Hubble metrics.
@@ -1730,6 +1828,24 @@ hubble:
       address: localhost
       # -- Configure pprof listen port for hubble-relay
       port: 6062
+      # -- Enable mutex contention profiling for hubble-relay and set the fraction of sampled events (set to 1 to sample all events)
+      mutexProfileFraction: 0
+      # -- Enable goroutine blocking profiling for hubble-relay and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead])
+      blockProfileRate: 0
+    # -- Logging configuration for hubble-relay.
+    logOptions:
+      # @schema
+      # type: [null, string]
+      # @schema
+      # -- Log format for hubble-relay. Valid values are: text, text-ts, json, json-ts.
+      # @default -- text-ts
+      format: ~
+      # @schema
+      # type: [null, string]
+      # @schema
+      # -- Log level for hubble-relay. Valid values are: debug, info, warn, error.
+      # @default -- info
+      level: ~
   ui:
     # -- Whether to enable the Hubble UI.
     enabled: false
@@ -1925,6 +2041,13 @@ hubble:
       #  - secretName: chart-example-tls
       #    hosts:
       #      - chart-example.local
+
+    # -- Configure temporary volume for hubble-ui
+    tmpVolume: {}
+      # emptyDir:
+      #   # sizeLimit: "100Mi"
+      #   # medium: "Memory"
+
   # -- Hubble flows export.
   export:
     # --- Static exporter configuration.
@@ -1937,6 +2060,14 @@ hubble:
       # - source
       # - destination
       # - verdict
+      fieldAggregate: []
+      # - time
+      # - source
+      # - destination
+      # - verdict
+      # --- Defines the interval at which to aggregate before exporting Hubble flows.
+      #     Aggregation feature is only enabled when fieldAggregate is specified and aggregationInterval > 0s.
+      aggregationInterval: "0s"
       allowList: []
       # - '{"verdict":["DROPPED","ERROR"]}'
       denyList: []
@@ -1962,6 +2093,8 @@ hubble:
         content:
           - name: all
             fieldMask: []
+            fieldAggregate: []
+            aggregationInterval: "0s"
             includeFilters: []
             excludeFilters: []
             filePath: "/var/run/cilium/hubble/events.log"
@@ -2056,11 +2189,30 @@ ipam:
     # refill the bucket up to the burst size capacity.
     # @default -- `4.0`
     externalAPILimitQPS: ~
-# -- defaultLBServiceIPAM indicates the default LoadBalancer Service IPAM when
-# no LoadBalancer class is set. Applicable values: lbipam, nodeipam, none
+  # -- NodeSpec configuration for the IPAM
+  nodeSpec:
+    # -- IPAM min allocate
+    # @schema
+    # type: [null, integer]
+    # @schema
+    ipamMinAllocate: ~
+    # -- IPAM pre allocate
+    # @schema
+    # type: [null, integer]
+    # @schema
+    ipamPreAllocate: ~
+    # -- IPAM max allocate
+    # @schema
+    # type: [null, integer]
+    # @schema
+    ipamMaxAllocate: ~
+    # -- IPAM static IP tags (currently only works with AWS and Azure)
+    ipamStaticIPTags: []
 # @schema
 # type: [string]
 # @schema
+# -- defaultLBServiceIPAM indicates the default LoadBalancer Service IPAM when
+# no LoadBalancer class is set. Applicable values: lbipam, nodeipam, none
 defaultLBServiceIPAM: lbipam
 nodeIPAM:
   # -- Configure Node IPAM
@@ -2147,7 +2299,7 @@ localRedirectPolicy: false
 localRedirectPolicies:
   # -- Enable local redirect policies.
   enabled: false
-  
+
   # -- Limit the allowed addresses in Address Matcher rule of
   # Local Redirect Policies to the given CIDRs.
   # @schema@
@@ -2177,7 +2329,7 @@ maglev: {}
 # type: [null, boolean]
 # @schema
 # -- (bool) Enables masquerading of IPv4 traffic leaving the node from endpoints.
-# @default -- `true` unless ipam eni mode is active 
+# @default -- `true` unless ipam eni mode is active
 enableIPv4Masquerade: ~
 # -- Enables masquerading of IPv6 traffic leaving the node from endpoints.
 enableIPv6Masquerade: true
@@ -2187,6 +2339,8 @@ enableMasqueradeRouteSource: false
 enableIPv4BIGTCP: false
 # -- Enables IPv6 BIG TCP support which increases maximum IPv6 GSO/GRO limits for nodes and pods
 enableIPv6BIGTCP: false
+# -- Enable BIG TCP in tunneling mode and increase maximum GRO/GSO limits for VXLAN/GENEVE tunnels
+enableTunnelBIGTCP: false
 
 nat:
   # -- Number of the top-k SNAT map connections to track in Cilium statedb.
@@ -2290,8 +2444,6 @@ loadBalancer:
     algorithm: round_robin
 # -- Configure N-S k8s service loadbalancing
 nodePort:
-  # -- Enable the Cilium NodePort service implementation.
-  enabled: false
   # -- Port range to use for NodePort services.
   # range: "30000,32767"
 
@@ -2336,6 +2488,10 @@ pprof:
   address: localhost
   # -- Configure pprof listen port for cilium-agent
   port: 6060
+  # -- Enable mutex contention profiling for cilium-agent and set the fraction of sampled events (set to 1 to sample all events)
+  mutexProfileFraction: 0
+  # -- Enable goroutine blocking profiling for cilium-agent and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead])
+  blockProfileRate: 0
 # -- Configure prometheus metrics on the configured port at /metrics
 prometheus:
   metricsService: false
@@ -2460,6 +2616,12 @@ envoy:
   initialFetchTimeoutSeconds: 30
   # -- Maximum number of concurrent retries on Envoy clusters
   maxConcurrentRetries: 128
+  # -- Maximum number of connections on Envoy clusters
+  clusterMaxConnections: 1024
+  # -- Maximum number of requests on Envoy clusters
+  clusterMaxRequests: 1024
+  # -- Maximum number of global downstream connections
+  maxGlobalDownstreamConnections: 50000
   # -- Maximum number of retries for each HTTP request
   httpRetryCount: 3
   # -- ProxyMaxRequestsPerConnection specifies the max_requests_per_connection setting for Envoy
@@ -2476,6 +2638,9 @@ envoy:
   xffNumTrustedHopsL7PolicyIngress: 0
   # -- Number of trusted hops regarding the x-forwarded-for and related HTTP headers for the egress L7 policy enforcement Envoy listeners.
   xffNumTrustedHopsL7PolicyEgress: 0
+  # -- For cases when CiliumEnvoyConfig is not used directly (Ingress, Gateway), configures Cilium BPF Metadata listener filter
+  # to use the original source address when extracting the metadata for a request.
+  useOriginalSourceAddress: true
   # @schema
   # type: [null, string]
   # @schema
@@ -2494,6 +2659,8 @@ envoy:
     pullPolicy: "${PULL_POLICY}"
     digest: "${CILIUM_ENVOY_DIGEST}"
     useDigest: true
+  # -- Init containers added to the cilium Envoy DaemonSet.
+  initContainers: []
   # -- Additional containers added to the cilium Envoy DaemonSet.
   extraContainers: []
   # -- Additional envoy container arguments.
@@ -2726,17 +2893,16 @@ resourceQuotas:
       pods: "15"
 # Need to document default
 ##################
-#sessionAffinity: false
 
 # -- Annotations to be added to all cilium-secret namespaces (resources under templates/cilium-secrets-namespace)
 secretsNamespaceAnnotations: {}
+# -- Labels to be added to all cilium-secret namespaces (resources under templates/cilium-secrets-namespace)
+secretsNamespaceLabels: {}
 
 # -- Do not run Cilium agent when running with clean mode. Useful to completely
 # uninstall Cilium as it will stop Cilium from starting and create artifacts
 # in the node.
 sleepAfterInit: false
-# -- Enable check of service source ranges (currently, only for LoadBalancer).
-svcSourceRangeCheck: true
 # -- Synchronize Kubernetes nodes to kvstore and perform CNP GC.
 synchronizeK8sNodes: true
 # -- Configure TLS configuration in the agent.
@@ -2819,6 +2985,9 @@ tls:
 # @default -- `"vxlan"`
 tunnelProtocol: ""
 # -- IP family for the underlay.
+# Possible values:
+#   - "ipv4"
+#   - "ipv6"
 # @default -- `"ipv4"`
 underlayProtocol: ""
 # -- Enable native-routing mode or tunneling mode.
@@ -2839,6 +3008,11 @@ tunnelSourcePortRange: 0-0
 #  - reject (default)
 #  - drop
 serviceNoBackendResponse: reject
+# -- Configure what the response should be to pod egress traffic denied by network policy.
+# Possible values:
+#  - none (default)
+#  - icmp
+policyDenyResponse: none
 # -- Configure the underlying network MTU to overwrite auto-detected MTU.
 # This value doesn't change the host network interface MTU i.e. eth0 or ens0.
 # It changes the MTU for cilium_net@cilium_host, cilium_host@cilium_net,
@@ -2924,7 +3098,7 @@ operator:
   # @schema
   # type: [null, array]
   # @schema
-  tolerations: 
+  tolerations:
     - key: "node-role.kubernetes.io/control-plane"
       operator: Exists
     - key: "node-role.kubernetes.io/master" #deprecated
@@ -3016,6 +3190,10 @@ operator:
     address: localhost
     # -- Configure pprof listen port for cilium-operator
     port: 6061
+    # -- Enable mutex contention profiling for cilium-operator and set the fraction of sampled events (set to 1 to sample all events)
+    mutexProfileFraction: 0
+    # -- Enable goroutine blocking profiling for cilium-operator and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead])
+    blockProfileRate: 0
   # -- Enable prometheus metrics for cilium-operator on the configured port at
   # /metrics
   prometheus:
@@ -3049,6 +3227,17 @@ operator:
       # @schema
       # -- Metrics relabeling configs for the ServiceMonitor cilium-operator
       metricRelabelings: ~
+    # -- TLS configuration for Prometheus
+    tls:
+      enabled: false
+      server:
+        # -- Name of the Secret containing the certificate, key and CA files for the Prometheus server.
+        existingSecret: ""
+        mtls:
+          # When set to true enforces mutual TLS between Operator Prometheus server and its clients.
+          # False allow non-mutual TLS connections.
+          # This option has no effect when TLS is disabled.
+          enabled: false
   # -- Grafana dashboards for cilium-operator
   # grafana can import dashboards based on the label and value
   # ref: https://github.com/grafana/helm-charts/tree/main/charts/grafana#sidecar-for-dashboards
@@ -3082,6 +3271,12 @@ operator:
     # -- Interval, in seconds, to check if there are any pods that are not
     # managed by Cilium.
     intervalSeconds: 15
+    # -- Selector for pods that should be restarted when not managed by Cilium.
+    # If not set, defaults to built-in selector "k8s-app=kube-dns". Set to empty string to select all pods.
+    # @schema
+    # type: [null, string]
+    # @schema
+    selector: ~
 nodeinit:
   # -- Enable the node initialization DaemonSet
   enabled: false
@@ -3136,6 +3331,9 @@ nodeinit:
   # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
   resources:
     requests:
+      # @schema
+      # type: [integer, string]
+      # @schema
       cpu: 100m
       memory: 100Mi
   # -- Security context to be added to nodeinit pods.
@@ -3160,6 +3358,8 @@ nodeinit:
   # -- bootstrapFile is the location of the file where the bootstrap timestamp is
   # written by the node-init DaemonSet
   bootstrapFile: "/tmp/cilium-bootstrap.d/cilium-bootstrap-time"
+  # -- wait for Cloud init to finish on the host and assume the node has cloud init installed
+  waitForCloudInit: false
   # -- startup offers way to customize startup nodeinit script (pre and post position)
   startup:
     preScript: ""
@@ -3293,7 +3493,9 @@ enableCriticalPriorityClass: true
 # on AArch64 as the images do not currently ship a version of Envoy.
 #disableEnvoyVersionCheck: false
 clustermesh:
-  # -- Deploy clustermesh-apiserver for clustermesh
+  # -- Deploy clustermesh-apiserver for clustermesh. This option is typically
+  # used with ``clustermesh.config.enabled=true``. Refer to the
+  # ``clustermesh.config.enabled=true``documentation for more information.
   useAPIServer: false
   # -- The maximum number of clusters to support in a ClusterMesh. This value
   # cannot be changed on running clusters, and all clusters in a ClusterMesh
@@ -3301,45 +3503,133 @@ clustermesh:
   # maximum allocatable cluster-local identities.
   # Supported values are 255 and 511.
   maxConnectedClusters: 255
+  # -- The time to live for the cache of a remote cluster after connectivity is
+  # lost. If the connection is not re-established within this duration, the
+  # cached data is revoked to prevent stale state. If not specified or set to
+  # 0s, the cache is never revoked (default).
+  cacheTTL: "0s"
   # -- Enable the synchronization of Kubernetes EndpointSlices corresponding to
   # the remote endpoints of appropriately-annotated global services through ClusterMesh
   enableEndpointSliceSynchronization: false
-  # -- Enable Multi-Cluster Services API support
+  # -- Enable Multi-Cluster Services API support (deprecated; use clustermesh.mcsapi.enabled)
   enableMCSAPISupport: false
   # -- Control whether policy rules assume by default the local cluster if not explicitly selected
-  policyDefaultLocalCluster: false
+  policyDefaultLocalCluster: true
 
   # -- Annotations to be added to all top-level clustermesh objects (resources under templates/clustermesh-apiserver and templates/clustermesh-config)
   annotations: {}
   # -- Clustermesh explicit configuration.
   config:
     # -- Enable the Clustermesh explicit configuration.
+    # If set to false, you need to provide the following resources yourself:
+    # - (Secret) cilium-clustermesh (used by cilium-agent/cilium-operator to connect to
+    #   the local etcd instance if KVStoreMesh is enabled or the remote clusters
+    #   if KVStoreMesh is disabled)
+    # - (Secret) cilium-kvstoremesh (used by KVStoreMesh to connect to the remote clusters)
+    # - (ConfigMap) clustermesh-remote-users (used to create one etcd user per remote cluster
+    #   if clustermesh-apiserver is used and `clustermesh.apiserver.tls.authMode` is not
+    #   set to `legacy`)
     enabled: false
     # -- Default dns domain for the Clustermesh API servers
     # This is used in the case cluster addresses are not provided
     # and IPs are used.
     domain: mesh.cilium.io
-    # -- List of clusters to be peered in the mesh.
+    # -- Clusters to be peered in the mesh.
+    # @schema
+    # type: [object, array]
+    # @schema
     clusters: []
+    # You can use a dict of clusters (recommended):
     # clusters:
-    # # -- Name of the cluster
+    #   # -- Name of the cluster
+    #   cluster1:
+    #     # -- Whether to enable this cluster in the mesh. Optional, defaults to true.
+    #     enabled: true
+    #     # -- Address of the cluster, use this if you created DNS records for
+    #     # the cluster Clustermesh API server.
+    #     address: cluster1.mesh.cilium.io
+    #     # -- Port of the cluster Clustermesh API server.
+    #     port: 2379
+    #     # -- IPs of the cluster Clustermesh API server, use multiple ones when
+    #     # you have multiple IPs to access the Clustermesh API server.
+    #     ips:
+    #     - 172.18.255.201
+    #     # -- (deprecated) base64 encoded PEM values for the cluster client certificate, private key and certificate authority.
+    #     # These fields can (and should) be omitted in case the CA is shared across clusters. In that case, the
+    #     # "remote" private key and certificate available in the local cluster are automatically used instead.
+    #     tls:
+    #       cert: ""
+    #       key: ""
+    #       caCert: ""
+    #
+    # Or alternatively you can use a list of clusters:
+    # clusters:
+    #   # -- Name of the cluster
     # - name: cluster1
-    # # -- Address of the cluster, use this if you created DNS records for
-    # # the cluster Clustermesh API server.
+    #   # -- Address of the cluster, use this if you created DNS records for
+    #   # the cluster Clustermesh API server.
     #   address: cluster1.mesh.cilium.io
-    # # -- Port of the cluster Clustermesh API server.
+    #   # -- Port of the cluster Clustermesh API server.
     #   port: 2379
-    # # -- IPs of the cluster Clustermesh API server, use multiple ones when
-    # # you have multiple IPs to access the Clustermesh API server.
+    #   # -- IPs of the cluster Clustermesh API server, use multiple ones when
+    #   # you have multiple IPs to access the Clustermesh API server.
     #   ips:
     #   - 172.18.255.201
-    # # -- base64 encoded PEM values for the cluster client certificate, private key and certificate authority.
-    # # These fields can (and should) be omitted in case the CA is shared across clusters. In that case, the
-    # # "remote" private key and certificate available in the local cluster are automatically used instead.
+    #   # -- (deprecated) base64 encoded PEM values for the cluster client certificate, private key and certificate authority.
+    #   # These fields can (and should) be omitted in case the CA is shared across clusters. In that case, the
+    #   # "remote" private key and certificate available in the local cluster are automatically used instead.
     #   tls:
     #     cert: ""
     #     key: ""
     #     caCert: ""
+  mcsapi:
+    # -- Enable Multi-Cluster Services API support
+    enabled: false
+    # -- Enabled MCS-API CRDs auto-installation
+    installCRDs: true
+    corednsAutoConfigure:
+      # -- Enable auto-configuration of CoreDNS for Multi-Cluster Services API.
+      #    CoreDNS MUST be at least in version v1.12.2 to run this.
+      enabled: false
+      coredns:
+        # -- The Deployment for the cluster CoreDNS service
+        deploymentName: coredns
+        # -- The Service Account name for the cluster CoreDNS service
+        serviceAccountName: coredns
+        # -- The ConfigMap name for the cluster CoreDNS service
+        configMapName: coredns
+        # -- The namespace for the cluster CoreDNS service
+        namespace: kube-system
+        # -- The cluster domain for the cluster CoreDNS service
+        clusterDomain: cluster.local
+        # -- The clusterset domain for the cluster CoreDNS service
+        clustersetDomain: clusterset.local
+      # -- Additional arguments to `clustermesh-apiserver coredns-mcsapi-auto-configure`.
+      extraArgs: []
+      # -- Seconds after which the completed job pod will be deleted
+      ttlSecondsAfterFinished: 1800
+      # -- Labels to be added to coredns-mcsapi-autoconfig pods
+      podLabels: {}
+      # -- Annotations to be added to the coredns-mcsapi-autoconfig Job
+      annotations: {}
+      # -- Node selector for coredns-mcsapi-autoconfig
+      # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector
+      nodeSelector: {}
+      # -- Priority class for coredns-mcsapi-autoconfig
+      # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass
+      priorityClassName: ""
+      # -- Node tolerations for pod assignment on nodes with taints
+      # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
+      tolerations: []
+      # -- Resource limits for coredns-mcsapi-autoconfig
+      # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers
+      resources: {}
+      # -- Additional coredns-mcsapi-autoconfig volumes.
+      extraVolumes: []
+      # -- Additional coredns-mcsapi-autoconfig volumeMounts.
+      extraVolumeMounts: []
+      # -- Affinity for coredns-mcsapi-autoconfig
+      affinity: {}
   apiserver:
     # -- Clustermesh API server image.
     image:
@@ -3445,17 +3735,12 @@ clustermesh:
       # - "external": ``clustermesh-apiserver`` will sync remote cluster information to the etcd used as kvstore. This can't be enabled with crd identity allocation mode.
       kvstoreMode: "internal"
     service:
+      # -- (bool) Set externallyCreated to true to create the clustermesh-apiserver service outside this helm chart.
+      # For example after external load balancer controllers are created.
+      externallyCreated: false
       # -- The type of service used for apiserver access.
       type: NodePort
       # -- Optional port to use as the node port for apiserver access.
-      #
-      # WARNING: make sure to configure a different NodePort in each cluster if
-      # kube-proxy replacement is enabled, as Cilium is currently affected by a known
-      # bug (#24692) when NodePorts are handled by the KPR implementation. If a service
-      # with the same NodePort exists both in the local and the remote cluster, all
-      # traffic originating from inside the cluster and targeting the corresponding
-      # NodePort will be redirected to a local backend, regardless of whether the
-      # destination node belongs to the local or the remote cluster.
       nodePort: 32379
       # -- Annotations for the clustermesh-apiserver service.
       # Example annotations to configure an internal load balancer on different cloud providers:
@@ -3624,13 +3909,15 @@ clustermesh:
       #               The "remote" certificate must be generated with CN=remote-<cluster-name>
       #               if provided manually. Cluster mode is meaningful only when the same
       #               CA is shared across all clusters part of the mesh.
-      authMode: legacy
-      # -- Allow users to provide their own certificates
+      authMode: migration
+      # -- (deprecated) Allow users to provide their own certificates
       # Users may need to provide their certificates using
       # a mechanism that requires they provide their own secrets.
       # This setting does not apply to any of the auto-generated
       # mechanisms below, it only restricts the creation of secrets
       # via the `tls-provided` templates.
+      # This option is deprecated as secrets are expected to be created
+      # externally when 'auto' is not enabled.
       enableSecrets: true
       # -- Configure automatic TLS certificates generation.
       # A Kubernetes CronJob is used the generate any
@@ -3639,7 +3926,14 @@ clustermesh:
       auto:
         # -- When set to true, automatically generate a CA and certificates to
         # enable mTLS between clustermesh-apiserver and external workload instances.
-        # If set to false, the certs to be provided by setting appropriate values below.
+        #
+        # When set to false you need to pre-create the following secrets:
+        # - clustermesh-apiserver-server-cert
+        # - clustermesh-apiserver-admin-cert
+        # - clustermesh-apiserver-remote-cert
+        # - clustermesh-apiserver-local-cert
+        # The above secret should at least contains the keys `tls.crt` and `tls.key`
+        # and optionally `ca.crt` if a CA bundle is not configured.
         enabled: true
         # Sets the method to auto-generate certificates. Supported values:
         # - helm:         This method uses Helm to generate all certificates.
@@ -3671,10 +3965,13 @@ clustermesh:
         #   name: ca-issuer
         # -- certmanager issuer used when clustermesh.apiserver.tls.auto.method=certmanager.
         certManagerIssuerRef: {}
+
       # -- base64 encoded PEM values for the clustermesh-apiserver server certificate and private key.
       # Used if 'auto' is not enabled.
       server:
+        # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled.
         cert: ""
+        # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled.
         key: ""
         # -- Extra DNS names added to certificate when it's auto generated
         extraDnsNames: []
@@ -3683,17 +3980,16 @@ clustermesh:
       # -- base64 encoded PEM values for the clustermesh-apiserver admin certificate and private key.
       # Used if 'auto' is not enabled.
       admin:
+        # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled.
         cert: ""
-        key: ""
-      # -- base64 encoded PEM values for the clustermesh-apiserver client certificate and private key.
-      # Used if 'auto' is not enabled.
-      client:
-        cert: ""
+        # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled.
         key: ""
       # -- base64 encoded PEM values for the clustermesh-apiserver remote cluster certificate and private key.
       # Used if 'auto' is not enabled.
       remote:
+        # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled.
         cert: ""
+        # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled.
         key: ""
     # clustermesh-apiserver Prometheus metrics configuration
     metrics:
@@ -3848,7 +4144,7 @@ authentication:
   # -- Enable authentication processing and garbage collection.
   # Note that if disabled, policy enforcement will still block requests that require authentication.
   # But the resulting authentication requests for these requests will not be processed, therefore the requests not be allowed.
-  enabled: true
+  enabled: false
   # -- Buffer size of the channel Cilium uses to receive authentication events from the signal map.
   queueSize: 1024
   # -- Buffer size of the channel Cilium uses to receive certificate expiration events from auth handlers.
@@ -4041,4 +4337,41 @@ authentication:
 enableInternalTrafficPolicy: true
 # -- Enable LoadBalancer IP Address Management
 enableLBIPAM: true
-
+# -- Standalone DNS Proxy Configuration
+# Note: The standalone DNS proxy uses the agent's dnsProxy.* configuration
+# for DNS settings (proxyPort, enableDnsCompression) to ensure consistency.
+standaloneDnsProxy:
+  # -- Enable standalone DNS proxy (alpha feature)
+  enabled: false
+  # -- Roll out Standalone DNS proxy automatically when configmap is updated.
+  rollOutPods: false
+  # -- Standalone DNS proxy annotations
+  annotations: {}
+  # -- Standalone DNS proxy debug mode
+  debug: false
+  # -- Standalone DNS proxy server port
+  serverPort: 10095
+  # -- Standalone DNS proxy Node Selector
+  nodeSelector:
+    kubernetes.io/os: linux
+  # -- Standalone DNS proxy tolerations
+  tolerations: []
+  # -- Standalone DNS proxy auto mount service account token
+  automountServiceAccountToken: false
+  # -- Standalone DNS proxy update strategy
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 2
+      maxUnavailable: 0
+  # -- Standalone DNS proxy image
+  image:
+    # @schema
+    # type: [null, string]
+    # @schema
+    override: ~
+    repository: "${STANDALONE_DNS_PROXY_REPO}"
+    tag: "${STANDALONE_DNS_PROXY_VERSION}"
+    digest: "${STANDALONE_DNS_PROXY_DIGEST}"
+    useDigest: ${USE_DIGESTS}
+    pullPolicy: "${PULL_POLICY}"
diff --git a/packages/system/cilium/images/cilium/Dockerfile b/packages/system/cilium/images/cilium/Dockerfile
index ebe65c83..b62f9b46 100644
--- a/packages/system/cilium/images/cilium/Dockerfile
+++ b/packages/system/cilium/images/cilium/Dockerfile
@@ -1,2 +1,2 @@
-ARG VERSION=v1.18.6
+ARG VERSION=v1.19.1
 FROM quay.io/cilium/cilium:${VERSION}
diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml
index 1d94b1cf..cfb2cd6b 100644
--- a/packages/system/cilium/values.yaml
+++ b/packages/system/cilium/values.yaml
@@ -15,8 +15,8 @@ cilium:
     mode: "kubernetes"
   image:
     repository: ghcr.io/cozystack/cozystack/cilium
-    tag: 1.18.6
-    digest: "sha256:4f4585f8adc3b8becd15d3999f3900a4d3d650f2ab7f85ca8c661f3807113d01"
+    tag: 1.19.1
+    digest: "sha256:ab3acf270821df4614a8456348a4e0d3098aed72a4b2016a0edfa30d91428c3d"
   envoy:
     enabled: false
   rollOutCiliumPods: true

From 4dcba2fe5a57c3ea8cb7f91a0aef095babcf7446 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Mon, 2 Mar 2026 18:00:50 +0100
Subject: [PATCH 238/666] feat(linstor): update linstor-csi patches

Remove merged RWX validation patch and add new patch that includes:
- Randomized node selection for snapshot restore
- Relocate replicas to optimal nodes after clone and snapshot restore

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../001-relocate-after-clone-restore.diff     | 355 +++++++++
 .../patches/001-rwx-validation.diff           | 718 ------------------
 2 files changed, 355 insertions(+), 718 deletions(-)
 create mode 100644 packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
 delete mode 100644 packages/system/linstor/images/linstor-csi/patches/001-rwx-validation.diff

diff --git a/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff b/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
new file mode 100644
index 00000000..b9730ade
--- /dev/null
+++ b/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
@@ -0,0 +1,355 @@
+diff --git a/pkg/client/linstor.go b/pkg/client/linstor.go
+index f544493..ebaa3d7 100644
+--- a/pkg/client/linstor.go
++++ b/pkg/client/linstor.go
+@@ -181,7 +181,7 @@ func LogLevel(s string) func(*Linstor) error {
+ func (s *Linstor) ListAllWithStatus(ctx context.Context) ([]volume.VolumeStatus, error) {
+ 	var vols []volume.VolumeStatus
+ 
+-	resourcesByName := make(map[string][]lapi.Resource)
++	resourcesByName := make(map[string][]lapi.ResourceWithVolumes)
+ 
+ 	resDefs, err := s.client.ResourceDefinitions.GetAll(ctx, lapi.RDGetAllRequest{WithVolumeDefinitions: true})
+ 	if err != nil {
+@@ -194,7 +194,7 @@ func (s *Linstor) ListAllWithStatus(ctx context.Context) ([]volume.VolumeStatus,
+ 	}
+ 
+ 	for i := range allResources {
+-		resourcesByName[allResources[i].Name] = append(resourcesByName[allResources[i].Name], allResources[i].Resource)
++		resourcesByName[allResources[i].Name] = append(resourcesByName[allResources[i].Name], allResources[i])
+ 	}
+ 
+ 	for _, rd := range resDefs {
+@@ -462,6 +462,14 @@ func (s *Linstor) Clone(ctx context.Context, vol, src *volume.Info, params *volu
+ 		return err
+ 	}
+ 
++	if params.RelocateAfterClone {
++		logger.Debug("relocate resources to optimal nodes")
++
++		if err := s.relocateResources(ctx, vol.ID, rGroup.Name); err != nil {
++			logger.WithError(err).Warn("resource relocation failed, volume is still usable")
++		}
++	}
++
+ 	logger.Debug("reconcile extra properties")
+ 
+ 	err = s.client.ResourceDefinitions.Modify(ctx, vol.ID, lapi.GenericPropsModify{OverrideProps: vol.Properties})
+@@ -1280,6 +1288,14 @@ func (s *Linstor) VolFromSnap(ctx context.Context, snap *volume.Snapshot, vol *v
+ 		return err
+ 	}
+ 
++	if params.RelocateAfterSnapshotRestore {
++		logger.Debug("relocate resources to optimal nodes")
++
++		if err := s.relocateResources(ctx, vol.ID, rGroup.Name); err != nil {
++			logger.WithError(err).Warn("resource relocation failed, volume is still usable")
++		}
++	}
++
+ 	logger.Debug("reconcile extra properties")
+ 
+ 	err = s.client.ResourceDefinitions.Modify(ctx, vol.ID, lapi.GenericPropsModify{OverrideProps: vol.Properties})
+@@ -1470,9 +1486,8 @@ func (s *Linstor) reconcileSnapshotResources(ctx context.Context, snapshot *volu
+ 		return fmt.Errorf("snapshot '%s' not deployed on any node", snap.Name)
+ 	}
+ 
+-	// Optimize the node we use to restore. It should be one of the preferred nodes, or just the first with a snapshot
+-	// if no preferred nodes match.
+-	var selectedNode string
++	// Collect available snapshot nodes, preferring those matching the topology hints.
++	var preferred, available []string
+ 	for _, snapNode := range snap.Nodes {
+ 		if err := s.NodeAvailable(ctx, snapNode); err != nil {
+ 			logger.WithField("selected node candidate", snapNode).WithError(err).Debug("node is not available")
+@@ -1480,13 +1495,23 @@ func (s *Linstor) reconcileSnapshotResources(ctx context.Context, snapshot *volu
+ 		}
+ 
+ 		if slices.Contains(preferredNodes, snapNode) {
+-			// We found a perfect candidate.
+-			selectedNode = snapNode
+-			break
+-		} else if selectedNode == "" {
+-			// Set a fallback if we have no candidate yet.
+-			selectedNode = snapNode
++			preferred = append(preferred, snapNode)
+ 		}
++
++		available = append(available, snapNode)
++	}
++
++	// Pick a random node from preferred candidates, falling back to any available node.
++	// Randomization distributes restore load across snapshot nodes, preventing all
++	// clones of the same source from concentrating on a single node.
++	candidates := preferred
++	if len(candidates) == 0 {
++		candidates = available
++	}
++
++	var selectedNode string
++	if len(candidates) > 0 {
++		selectedNode = candidates[rand.Intn(len(candidates))]
+ 	}
+ 
+ 	if selectedNode == "" {
+@@ -1679,6 +1704,114 @@ func (s *Linstor) reconcileResourcePlacement(ctx context.Context, vol *volume.In
+ 	return nil
+ }
+ 
++const propertyRelocationTriggered = "Aux/csi-relocation-triggered"
++
++// relocateResources migrates replicas from their current nodes to the nodes that
++// LINSTOR's autoplacer considers optimal. This is a best-effort, fire-and-forget
++// operation: migrate-disk API is asynchronous and the volume remains usable on its
++// current nodes even if relocation fails.
++func (s *Linstor) relocateResources(ctx context.Context, volID, rgName string) error {
++	logger := s.log.WithFields(logrus.Fields{
++		"volume":        volID,
++		"resourceGroup": rgName,
++	})
++
++	// Check if relocation was already triggered (idempotency guard).
++	rd, err := s.client.ResourceDefinitions.Get(ctx, volID)
++	if err != nil {
++		return fmt.Errorf("failed to get resource definition: %w", err)
++	}
++
++	if rd.Props[propertyRelocationTriggered] != "" {
++		logger.Debug("relocation already triggered, skipping")
++		return nil
++	}
++
++	// Get current diskful nodes.
++	resources, err := s.client.Resources.GetAll(ctx, volID)
++	if err != nil {
++		return fmt.Errorf("failed to list resources: %w", err)
++	}
++
++	currentNodes := util.DeployedDiskfullyNodes(resources)
++
++	// Query optimal placement from LINSTOR autoplacer.
++	sizeInfo, err := s.client.ResourceGroups.QuerySizeInfo(ctx, rgName, lapi.QuerySizeInfoRequest{})
++	if err != nil {
++		return fmt.Errorf("failed to query size info: %w", err)
++	}
++
++	if sizeInfo.SpaceInfo == nil || len(sizeInfo.SpaceInfo.NextSpawnResult) == 0 {
++		logger.Debug("no spawn result from query-size-info, skipping relocation")
++		return nil
++	}
++
++	// Build a map of optimal node -> storage pool.
++	optimalPools := make(map[string]string, len(sizeInfo.SpaceInfo.NextSpawnResult))
++	for _, r := range sizeInfo.SpaceInfo.NextSpawnResult {
++		optimalPools[r.NodeName] = r.StorPoolName
++	}
++
++	// Compute nodes to remove (current but not optimal) and nodes to add (optimal but not current).
++	var nodesToRemove, nodesToAdd []string
++
++	for _, node := range currentNodes {
++		if _, ok := optimalPools[node]; !ok {
++			nodesToRemove = append(nodesToRemove, node)
++		}
++	}
++
++	for _, r := range sizeInfo.SpaceInfo.NextSpawnResult {
++		if !slices.Contains(currentNodes, r.NodeName) {
++			nodesToAdd = append(nodesToAdd, r.NodeName)
++		}
++	}
++
++	// Only migrate min(remove, add) pairs.
++	pairs := min(len(nodesToRemove), len(nodesToAdd))
++	if pairs == 0 {
++		logger.Info("no relocation needed, placement is already optimal")
++		return nil
++	}
++
++	logger.Infof("relocating %d replica(s): %v -> %v", pairs, nodesToRemove[:pairs], nodesToAdd[:pairs])
++
++	// Mark relocation as triggered before starting migrations.
++	err = s.client.ResourceDefinitions.Modify(ctx, volID, lapi.GenericPropsModify{
++		OverrideProps: map[string]string{propertyRelocationTriggered: "true"},
++	})
++	if err != nil {
++		return fmt.Errorf("failed to set relocation property: %w", err)
++	}
++
++	// Migrate each pair sequentially (LINSTOR serializes at the RD level anyway).
++	for i := range pairs {
++		fromNode := nodesToRemove[i]
++		toNode := nodesToAdd[i]
++		storPool := optimalPools[toNode]
++
++		logger := logger.WithFields(logrus.Fields{"from": fromNode, "to": toNode, "storagePool": storPool})
++
++		logger.Info("creating diskless resource on target node")
++
++		err := s.client.Resources.MakeAvailable(ctx, volID, toNode, lapi.ResourceMakeAvailable{})
++		if err != nil {
++			logger.WithError(err).Warn("failed to create diskless on target, skipping this pair")
++			continue
++		}
++
++		logger.Info("initiating migrate-disk")
++
++		err = s.client.Resources.Migrate(ctx, volID, fromNode, toNode, storPool)
++		if err != nil {
++			logger.WithError(err).Warn("migrate-disk failed, skipping this pair")
++			continue
++		}
++	}
++
++	return nil
++}
++
+ // FindSnapsByID searches the snapshot in the backend
+ func (s *Linstor) FindSnapsByID(ctx context.Context, id string) ([]*volume.Snapshot, error) {
+ 	snapshotId, err := volume.ParseSnapshotId(id)
+@@ -2173,7 +2306,7 @@ func (s *Linstor) Status(ctx context.Context, volId string) ([]string, *csi.Volu
+ 		"volume": volId,
+ 	}).Debug("getting assignments")
+ 
+-	ress, err := s.client.Resources.GetAll(ctx, volId)
++	ress, err := s.client.Resources.GetResourceView(ctx, &lapi.ListOpts{Resource: []string{volId}})
+ 	if err != nil {
+ 		return nil, nil, fmt.Errorf("failed to list resources for '%s': %w", volId, err)
+ 	}
+@@ -2261,13 +2394,20 @@ func GetSnapshotRemoteAndReadiness(snap *lapi.Snapshot) (string, bool, error) {
+ 	return "", slices.Contains(snap.Flags, lapiconsts.FlagSuccessful), nil
+ }
+ 
+-func NodesAndConditionFromResources(ress []lapi.Resource) ([]string, *csi.VolumeCondition) {
++func NodesAndConditionFromResources(ress []lapi.ResourceWithVolumes) ([]string, *csi.VolumeCondition) {
+ 	var allNodes, abnormalNodes []string
+ 
+ 	for i := range ress {
+ 		res := &ress[i]
+ 
+-		allNodes = append(allNodes, res.NodeName)
++		// A resource is a CSI publish target if any of its volumes were created
++		// by ControllerPublishVolume, identified by the temporary-diskless-attach property.
++		if slices.ContainsFunc(res.Volumes, func(v lapi.Volume) bool {
++			createdFor, ok := v.Props[linstor.PropertyCreatedFor]
++			return ok && createdFor == linstor.CreatedForTemporaryDisklessAttach
++		}) {
++			allNodes = append(allNodes, res.NodeName)
++		}
+ 
+ 		if res.State == nil {
+ 			abnormalNodes = append(abnormalNodes, res.NodeName)
+diff --git a/pkg/volume/parameter.go b/pkg/volume/parameter.go
+index 39acd95..110c597 100644
+--- a/pkg/volume/parameter.go
++++ b/pkg/volume/parameter.go
+@@ -50,6 +50,8 @@ const (
+ 	nfsservicename
+ 	nfssquash
+ 	nfsrecoveryvolumesize
++	relocateafterclone
++	relocateaftersnapshotrestore
+ )
+ 
+ // Parameters configuration for linstor volumes.
+@@ -118,6 +120,10 @@ type Parameters struct {
+ 	// NfsRecoveryVolumeSize sets the volume size (in bytes) of the recovery volume used by the NFS server.
+ 	// Defaults to 300MiB.
+ 	NfsRecoveryVolumeBytes int64
++	// RelocateAfterClone triggers asynchronous relocation of replicas to optimal nodes after cloning.
++	RelocateAfterClone bool
++	// RelocateAfterSnapshotRestore triggers asynchronous relocation of replicas to optimal nodes after snapshot restore.
++	RelocateAfterSnapshotRestore bool
+ }
+ 
+ const DefaultDisklessStoragePoolName = "DfltDisklessStorPool"
+@@ -136,10 +142,12 @@ func NewParameters(params map[string]string, topologyPrefix string) (Parameters,
+ 		Encryption:             false,
+ 		PlacementPolicy:        topology.AutoPlaceTopology,
+ 		Properties:             make(map[string]string),
+-		NfsConfigTemplatePath:  "/etc/nfs-helper/default-config.tmpl",
+-		NfsServiceName:         "linstor-csi-nfs",
+-		NfsSquash:              "no_root_squash",
+-		NfsRecoveryVolumeBytes: 300 * 1024 * 1024,
++		NfsConfigTemplatePath:        "/etc/nfs-helper/default-config.tmpl",
++		NfsServiceName:               "linstor-csi-nfs",
++		NfsSquash:                    "no_root_squash",
++		NfsRecoveryVolumeBytes:       300 * 1024 * 1024,
++		RelocateAfterClone:           true,
++		RelocateAfterSnapshotRestore: true,
+ 	}
+ 
+ 	for k, v := range params {
+@@ -287,6 +295,20 @@ func NewParameters(params map[string]string, topologyPrefix string) (Parameters,
+ 			}
+ 
+ 			p.NfsRecoveryVolumeBytes = s.Value()
++		case relocateafterclone:
++			val, err := strconv.ParseBool(v)
++			if err != nil {
++				return p, err
++			}
++
++			p.RelocateAfterClone = val
++		case relocateaftersnapshotrestore:
++			val, err := strconv.ParseBool(v)
++			if err != nil {
++				return p, err
++			}
++
++			p.RelocateAfterSnapshotRestore = val
+ 		}
+ 	}
+ 
+diff --git a/pkg/volume/paramkey_enumer.go b/pkg/volume/paramkey_enumer.go
+index 5474963..1c2fc87 100644
+--- a/pkg/volume/paramkey_enumer.go
++++ b/pkg/volume/paramkey_enumer.go
+@@ -7,11 +7,11 @@ import (
+ 	"strings"
+ )
+ 
+-const _paramKeyName = "allowremotevolumeaccessautoplaceclientlistdisklessonremainingdisklessstoragepooldonotplacewithregexencryptionfsoptslayerlistmountoptsnodelistplacementcountplacementpolicyreplicasondifferentreplicasonsamesizekibstoragepoolpostmountxfsoptsresourcegroupusepvcnameoverprovisionxreplicasondifferentnfsconfigtemplatenfsservicenamenfssquashnfsrecoveryvolumesize"
++const _paramKeyName = "allowremotevolumeaccessautoplaceclientlistdisklessonremainingdisklessstoragepooldonotplacewithregexencryptionfsoptslayerlistmountoptsnodelistplacementcountplacementpolicyreplicasondifferentreplicasonsamesizekibstoragepoolpostmountxfsoptsresourcegroupusepvcnameoverprovisionxreplicasondifferentnfsconfigtemplatenfsservicenamenfssquashnfsrecoveryvolumesizerelocateafterclonerelocateaftersnapshotrestore"
+ 
+-var _paramKeyIndex = [...]uint16{0, 23, 32, 42, 61, 80, 99, 109, 115, 124, 133, 141, 155, 170, 189, 203, 210, 221, 237, 250, 260, 273, 293, 310, 324, 333, 354}
++var _paramKeyIndex = [...]uint16{0, 23, 32, 42, 61, 80, 99, 109, 115, 124, 133, 141, 155, 170, 189, 203, 210, 221, 237, 250, 260, 273, 293, 310, 324, 333, 354, 372, 400}
+ 
+-const _paramKeyLowerName = "allowremotevolumeaccessautoplaceclientlistdisklessonremainingdisklessstoragepooldonotplacewithregexencryptionfsoptslayerlistmountoptsnodelistplacementcountplacementpolicyreplicasondifferentreplicasonsamesizekibstoragepoolpostmountxfsoptsresourcegroupusepvcnameoverprovisionxreplicasondifferentnfsconfigtemplatenfsservicenamenfssquashnfsrecoveryvolumesize"
++const _paramKeyLowerName = "allowremotevolumeaccessautoplaceclientlistdisklessonremainingdisklessstoragepooldonotplacewithregexencryptionfsoptslayerlistmountoptsnodelistplacementcountplacementpolicyreplicasondifferentreplicasonsamesizekibstoragepoolpostmountxfsoptsresourcegroupusepvcnameoverprovisionxreplicasondifferentnfsconfigtemplatenfsservicenamenfssquashnfsrecoveryvolumesizerelocateafterclonerelocateaftersnapshotrestore"
+ 
+ func (i paramKey) String() string {
+ 	if i < 0 || i >= paramKey(len(_paramKeyIndex)-1) {
+@@ -50,9 +50,11 @@ func _paramKeyNoOp() {
+ 	_ = x[nfsservicename-(23)]
+ 	_ = x[nfssquash-(24)]
+ 	_ = x[nfsrecoveryvolumesize-(25)]
++	_ = x[relocateafterclone-(26)]
++	_ = x[relocateaftersnapshotrestore-(27)]
+ }
+ 
+-var _paramKeyValues = []paramKey{allowremotevolumeaccess, autoplace, clientlist, disklessonremaining, disklessstoragepool, donotplacewithregex, encryption, fsopts, layerlist, mountopts, nodelist, placementcount, placementpolicy, replicasondifferent, replicasonsame, sizekib, storagepool, postmountxfsopts, resourcegroup, usepvcname, overprovision, xreplicasondifferent, nfsconfigtemplate, nfsservicename, nfssquash, nfsrecoveryvolumesize}
++var _paramKeyValues = []paramKey{allowremotevolumeaccess, autoplace, clientlist, disklessonremaining, disklessstoragepool, donotplacewithregex, encryption, fsopts, layerlist, mountopts, nodelist, placementcount, placementpolicy, replicasondifferent, replicasonsame, sizekib, storagepool, postmountxfsopts, resourcegroup, usepvcname, overprovision, xreplicasondifferent, nfsconfigtemplate, nfsservicename, nfssquash, nfsrecoveryvolumesize, relocateafterclone, relocateaftersnapshotrestore}
+ 
+ var _paramKeyNameToValueMap = map[string]paramKey{
+ 	_paramKeyName[0:23]:         allowremotevolumeaccess,
+@@ -107,6 +109,10 @@ var _paramKeyNameToValueMap = map[string]paramKey{
+ 	_paramKeyLowerName[324:333]: nfssquash,
+ 	_paramKeyName[333:354]:      nfsrecoveryvolumesize,
+ 	_paramKeyLowerName[333:354]: nfsrecoveryvolumesize,
++	_paramKeyName[354:372]:      relocateafterclone,
++	_paramKeyLowerName[354:372]: relocateafterclone,
++	_paramKeyName[372:400]:      relocateaftersnapshotrestore,
++	_paramKeyLowerName[372:400]: relocateaftersnapshotrestore,
+ }
+ 
+ var _paramKeyNames = []string{
+@@ -136,6 +142,8 @@ var _paramKeyNames = []string{
+ 	_paramKeyName[310:324],
+ 	_paramKeyName[324:333],
+ 	_paramKeyName[333:354],
++	_paramKeyName[354:372],
++	_paramKeyName[372:400],
+ }
+ 
+ // paramKeyString retrieves an enum value from the enum constants string name.
diff --git a/packages/system/linstor/images/linstor-csi/patches/001-rwx-validation.diff b/packages/system/linstor/images/linstor-csi/patches/001-rwx-validation.diff
deleted file mode 100644
index 7da0f137..00000000
--- a/packages/system/linstor/images/linstor-csi/patches/001-rwx-validation.diff
+++ /dev/null
@@ -1,718 +0,0 @@
-diff --git a/cmd/linstor-csi/linstor-csi.go b/cmd/linstor-csi/linstor-csi.go
-index 143f6cee..bd28e06e 100644
---- a/cmd/linstor-csi/linstor-csi.go
-+++ b/cmd/linstor-csi/linstor-csi.go
-@@ -41,22 +41,23 @@ import (
- 
- func main() {
- 	var (
--		lsEndpoint            = flag.String("linstor-endpoint", "", "Controller API endpoint for LINSTOR")
--		lsSkipTLSVerification = flag.Bool("linstor-skip-tls-verification", false, "If true, do not verify tls")
--		csiEndpoint           = flag.String("csi-endpoint", "unix:///var/lib/kubelet/plugins/linstor.csi.linbit.com/csi.sock", "CSI endpoint")
--		node                  = flag.String("node", "", "Node ID to pass to node service")
--		logLevel              = flag.String("log-level", "info", "Enable debug log output. Choose from: panic, fatal, error, warn, info, debug")
--		rps                   = flag.Float64("linstor-api-requests-per-second", 0, "Maximum allowed number of LINSTOR API requests per second. Default: Unlimited")
--		burst                 = flag.Int("linstor-api-burst", 1, "Maximum number of API requests allowed before being limited by requests-per-second. Default: 1 (no bursting)")
--		bearerTokenFile       = flag.String("bearer-token", "", "Read the bearer token from the given file and use it for authentication.")
--		propNs                = flag.String("property-namespace", linstor.NamespcAuxiliary, "Limit the reported topology keys to properties from the given namespace.")
--		labelBySP             = flag.Bool("label-by-storage-pool", true, "Set to false to disable labeling of nodes based on their configured storage pools.")
--		nodeCacheTimeout      = flag.Duration("node-cache-timeout", 1*time.Minute, "Duration for which the results of node and storage pool related API responses should be cached.")
--		resourceCacheTimeout  = flag.Duration("resource-cache-timeout", 30*time.Second, "Duration for which the results of resource related API responses should be cached.")
--		resyncAfter           = flag.Duration("resync-after", 5*time.Minute, "Duration after which reconciliations (such as for VolumeSnapshotClasses) should be rerun. Set to 0 to disable.")
--		enableRWX             = flag.Bool("enable-rwx", false, "Enable RWX support via NFS (requires running in Kubernetes).")
--		namespace             = flag.String("nfs-service-namespace", "", "The namespace the NFS service is running in.")
--		reactorConfigMapName  = flag.String("nfs-reactor-config-map-name", "linstor-csi-nfs-reactor-config", "Name of the config map used to store promoter configuration")
-+		lsEndpoint                = flag.String("linstor-endpoint", "", "Controller API endpoint for LINSTOR")
-+		lsSkipTLSVerification     = flag.Bool("linstor-skip-tls-verification", false, "If true, do not verify tls")
-+		csiEndpoint               = flag.String("csi-endpoint", "unix:///var/lib/kubelet/plugins/linstor.csi.linbit.com/csi.sock", "CSI endpoint")
-+		node                      = flag.String("node", "", "Node ID to pass to node service")
-+		logLevel                  = flag.String("log-level", "info", "Enable debug log output. Choose from: panic, fatal, error, warn, info, debug")
-+		rps                       = flag.Float64("linstor-api-requests-per-second", 0, "Maximum allowed number of LINSTOR API requests per second. Default: Unlimited")
-+		burst                     = flag.Int("linstor-api-burst", 1, "Maximum number of API requests allowed before being limited by requests-per-second. Default: 1 (no bursting)")
-+		bearerTokenFile           = flag.String("bearer-token", "", "Read the bearer token from the given file and use it for authentication.")
-+		propNs                    = flag.String("property-namespace", linstor.NamespcAuxiliary, "Limit the reported topology keys to properties from the given namespace.")
-+		labelBySP                 = flag.Bool("label-by-storage-pool", true, "Set to false to disable labeling of nodes based on their configured storage pools.")
-+		nodeCacheTimeout          = flag.Duration("node-cache-timeout", 1*time.Minute, "Duration for which the results of node and storage pool related API responses should be cached.")
-+		resourceCacheTimeout      = flag.Duration("resource-cache-timeout", 30*time.Second, "Duration for which the results of resource related API responses should be cached.")
-+		resyncAfter               = flag.Duration("resync-after", 5*time.Minute, "Duration after which reconciliations (such as for VolumeSnapshotClasses) should be rerun. Set to 0 to disable.")
-+		enableRWX                 = flag.Bool("enable-rwx", false, "Enable RWX support via NFS (requires running in Kubernetes).")
-+		namespace                 = flag.String("nfs-service-namespace", "", "The namespace the NFS service is running in.")
-+		reactorConfigMapName      = flag.String("nfs-reactor-config-map-name", "linstor-csi-nfs-reactor-config", "Name of the config map used to store promoter configuration")
-+		disableRWXBlockValidation = flag.Bool("disable-rwx-block-validation", false, "Disable KubeVirt VM ownership validation for RWX block volumes.")
- 	)
- 
- 	flag.Var(&volume.DefaultRemoteAccessPolicy, "default-remote-access-policy", "")
-@@ -169,6 +170,10 @@ func main() {
- 		opts = append(opts, driver.ConfigureRWX(*namespace, *reactorConfigMapName))
- 	}
- 
-+	if *disableRWXBlockValidation {
-+		opts = append(opts, driver.DisableRWXBlockValidation())
-+	}
-+
- 	drv, err := driver.NewDriver(opts...)
- 	if err != nil {
- 		log.Fatal(err)
-diff --git a/pkg/driver/driver.go b/pkg/driver/driver.go
-index bea69a8b..a39674b6 100644
---- a/pkg/driver/driver.go
-+++ b/pkg/driver/driver.go
-@@ -83,6 +83,8 @@ type Driver struct {
- 	topologyPrefix string
- 	// resyncAfter is the interval after which reconciliations should be retried
- 	resyncAfter time.Duration
-+	// disableRWXBlockValidation disables KubeVirt VM ownership validation for RWX block volumes
-+	disableRWXBlockValidation bool
- 
- 	// Embed for forward compatibility.
- 	csi.UnimplementedIdentityServer
-@@ -300,6 +302,17 @@ func ResyncAfter(resyncAfter time.Duration) func(*Driver) error {
- 	}
- }
- 
-+// DisableRWXBlockValidation disables the KubeVirt VM ownership validation for RWX block volumes.
-+// When disabled, the driver will not check if multiple pods using the same RWX block volume
-+// belong to the same VM. This may be needed in environments where the validation causes issues
-+// or when using RWX block volumes outside of KubeVirt.
-+func DisableRWXBlockValidation() func(*Driver) error {
-+	return func(d *Driver) error {
-+		d.disableRWXBlockValidation = true
-+		return nil
-+	}
-+}
-+
- // GetPluginInfo https://github.com/container-storage-interface/spec/blob/v1.9.0/spec.md#getplugininfo
- func (d Driver) GetPluginInfo(ctx context.Context, req *csi.GetPluginInfoRequest) (*csi.GetPluginInfoResponse, error) {
- 	return &csi.GetPluginInfoResponse{
-@@ -751,6 +764,14 @@ func (d Driver) ControllerPublishVolume(ctx context.Context, req *csi.Controller
- 	// ReadWriteMany block volume
- 	rwxBlock := req.VolumeCapability.AccessMode.GetMode() == csi.VolumeCapability_AccessMode_MULTI_NODE_MULTI_WRITER && req.VolumeCapability.GetBlock() != nil
- 
-+	// Validate RWX block attachment to prevent misuse of allow-two-primaries
-+	if rwxBlock && !d.disableRWXBlockValidation {
-+		if _, err := utils.ValidateRWXBlockAttachment(ctx, d.kubeClient, d.log, req.GetVolumeId()); err != nil {
-+			return nil, status.Errorf(codes.FailedPrecondition,
-+				"ControllerPublishVolume failed for %s: %v", req.GetVolumeId(), err)
-+		}
-+	}
-+
- 	devPath, err := d.Assignments.Attach(ctx, req.GetVolumeId(), req.GetNodeId(), rwxBlock)
- 	if err != nil {
- 		return nil, status.Errorf(codes.Internal,
-diff --git a/pkg/utils/rwx_validation.go b/pkg/utils/rwx_validation.go
-new file mode 100644
-index 00000000..9fe82768
---- /dev/null
-+++ b/pkg/utils/rwx_validation.go
-@@ -0,0 +1,263 @@
-+/*
-+CSI Driver for Linstor
-+Copyright © 2018 LINBIT USA, LLC
-+
-+This program is free software; you can redistribute it and/or modify
-+it under the terms of the GNU General Public License as published by
-+the Free Software Foundation; either version 2 of the License, or
-+(at your option) any later version.
-+
-+This program is distributed in the hope that it will be useful,
-+but WITHOUT ANY WARRANTY; without even the implied warranty of
-+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-+GNU General Public License for more details.
-+
-+You should have received a copy of the GNU General Public License
-+along with this program; if not, see <http://www.gnu.org/licenses/>.
-+*/
-+
-+package utils
-+
-+import (
-+	"context"
-+	"fmt"
-+
-+	"github.com/sirupsen/logrus"
-+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-+	"k8s.io/apimachinery/pkg/runtime/schema"
-+	"k8s.io/client-go/dynamic"
-+)
-+
-+// KubeVirtVMLabel is the label that KubeVirt adds to pods to identify the VM they belong to.
-+const KubeVirtVMLabel = "vm.kubevirt.io/name"
-+
-+// KubeVirtHotplugDiskLabel is the label that KubeVirt adds to hotplug disk pods.
-+const KubeVirtHotplugDiskLabel = "kubevirt.io"
-+
-+// PodGVR is the GroupVersionResource for pods.
-+var PodGVR = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "pods"}
-+
-+// PVGVR is the GroupVersionResource for persistent volumes.
-+var PVGVR = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "persistentvolumes"}
-+
-+// ValidateRWXBlockAttachment checks that RWX block volumes are only used by pods belonging to the same VM.
-+// This prevents misuse of allow-two-primaries while still permitting live migration.
-+// Returns the VM name if validation passes, or an error if:
-+// - Multiple pods from different VMs are trying to use the same volume
-+// - A pod without the KubeVirt VM label is trying to use a volume already attached elsewhere (strict mode)
-+// Returns empty string for VM name when no pods are using the volume or validation is skipped.
-+func ValidateRWXBlockAttachment(ctx context.Context, kubeClient dynamic.Interface, log *logrus.Entry, volumeID string) (string, error) {
-+	log.WithField("volumeID", volumeID).Info("validateRWXBlockAttachment called")
-+
-+	if kubeClient == nil {
-+		// Not running in Kubernetes, skip validation
-+		log.Warn("validateRWXBlockAttachment: kubeClient is nil, skipping validation")
-+		return "", nil
-+	}
-+
-+	// Get PV to find PVC reference
-+	pv, err := kubeClient.Resource(PVGVR).Get(ctx, volumeID, metav1.GetOptions{})
-+	if err != nil {
-+		log.WithError(err).Warn("cannot validate RWX attachment: failed to get PV")
-+		return "", nil
-+	}
-+
-+	// Verify that PV's volumeHandle matches the volumeID
-+	volumeHandle, found, err := unstructured.NestedString(pv.Object, "spec", "csi", "volumeHandle")
-+	if err != nil {
-+		log.WithError(err).Warnf("cannot validate RWX attachment: failed to read volumeHandle for PV %s", volumeID)
-+
-+		return "", nil
-+	}
-+
-+	if !found {
-+		log.Warnf("cannot validate RWX attachment: volumeHandle not found for PV %s", volumeID)
-+
-+		return "", nil
-+	}
-+
-+	if volumeHandle != volumeID {
-+		log.WithFields(logrus.Fields{
-+			"volumeID":     volumeID,
-+			"volumeHandle": volumeHandle,
-+		}).Warn("cannot validate RWX attachment: PV volumeHandle does not match volumeID")
-+
-+		return "", nil
-+	}
-+
-+	// Extract claimRef from PV
-+	claimRef, found, _ := unstructured.NestedMap(pv.Object, "spec", "claimRef")
-+	if !found {
-+		log.Warn("cannot validate RWX attachment: PV has no claimRef")
-+		return "", nil
-+	}
-+
-+	pvcName, _, _ := unstructured.NestedString(claimRef, "name")
-+	pvcNamespace, _, _ := unstructured.NestedString(claimRef, "namespace")
-+
-+	if pvcNamespace == "" || pvcName == "" {
-+		log.Warn("cannot validate RWX attachment: PVC name or namespace is empty in claimRef")
-+		return "", nil
-+	}
-+
-+	// List all pods in the namespace
-+	podList, err := kubeClient.Resource(PodGVR).Namespace(pvcNamespace).List(ctx, metav1.ListOptions{})
-+	if err != nil {
-+		return "", fmt.Errorf("failed to list pods in namespace %s: %w", pvcNamespace, err)
-+	}
-+
-+	// Filter pods that use this PVC and are in a running/pending state
-+	type podInfo struct {
-+		name   string
-+		vmName string
-+	}
-+
-+	var podsUsingPVC []podInfo
-+
-+	for _, item := range podList.Items {
-+		// Get pod phase from status
-+		phase, _, _ := unstructured.NestedString(item.Object, "status", "phase")
-+		if phase == "Succeeded" || phase == "Failed" {
-+			continue
-+		}
-+
-+		// Check if pod uses the PVC
-+		volumes, found, _ := unstructured.NestedSlice(item.Object, "spec", "volumes")
-+		if !found {
-+			continue
-+		}
-+
-+		for _, vol := range volumes {
-+			volMap, ok := vol.(map[string]interface{})
-+			if !ok {
-+				continue
-+			}
-+
-+			claimName, found, _ := unstructured.NestedString(volMap, "persistentVolumeClaim", "claimName")
-+			if !found || claimName != pvcName {
-+				continue
-+			}
-+
-+			// Extract VM name, handling both regular and hotplug disk pods
-+			vmName, err := GetVMNameFromPod(ctx, kubeClient, log, &item)
-+			if err != nil {
-+				log.WithError(err).WithField("pod", item.GetName()).Warn("failed to get VM name from pod")
-+				// Continue with empty vmName - will be caught by strict mode check
-+				vmName = ""
-+			}
-+
-+			podsUsingPVC = append(podsUsingPVC, podInfo{
-+				name:   item.GetName(),
-+				vmName: vmName,
-+			})
-+
-+			break
-+		}
-+	}
-+
-+	// If 0 or 1 pod uses the PVC, no conflict possible
-+	if len(podsUsingPVC) <= 1 {
-+		// Return VM name if there's exactly one pod
-+		if len(podsUsingPVC) == 1 {
-+			log.WithFields(logrus.Fields{
-+				"volumeID":     volumeID,
-+				"vmName":       podsUsingPVC[0].vmName,
-+				"podCount":     1,
-+				"pvcNamespace": pvcNamespace,
-+				"pvcName":      pvcName,
-+			}).Info("validateRWXBlockAttachment: single pod found, returning VM name")
-+
-+			return podsUsingPVC[0].vmName, nil
-+		}
-+
-+		log.WithFields(logrus.Fields{
-+			"volumeID":     volumeID,
-+			"pvcNamespace": pvcNamespace,
-+			"pvcName":      pvcName,
-+		}).Info("validateRWXBlockAttachment: no pods found using PVC")
-+
-+		return "", nil
-+	}
-+
-+	// Check that all pods belong to the same VM
-+	var vmName string
-+	for _, pod := range podsUsingPVC {
-+		if pod.vmName == "" {
-+			// Strict mode: if any pod doesn't have the KubeVirt label and there are multiple pods,
-+			// deny the attachment
-+			return "", fmt.Errorf("RWX block volume %s/%s is used by multiple pods but pod %s does not have the %s label; "+
-+				"RWX block volumes with allow-two-primaries are only supported for KubeVirt live migration",
-+				pvcNamespace, pvcName, pod.name, KubeVirtVMLabel)
-+		}
-+
-+		if vmName == "" {
-+			vmName = pod.vmName
-+		} else if vmName != pod.vmName {
-+			// Different VMs are trying to use the same volume
-+			return "", fmt.Errorf("RWX block volume %s/%s is being used by pods from different VMs (%s and %s); "+
-+				"this is not supported - RWX block volumes with allow-two-primaries are only for live migration of a single VM",
-+				pvcNamespace, pvcName, vmName, pod.vmName)
-+		}
-+	}
-+
-+	log.WithFields(logrus.Fields{
-+		"pvcNamespace": pvcNamespace,
-+		"pvcName":      pvcName,
-+		"vmName":       vmName,
-+		"podCount":     len(podsUsingPVC),
-+	}).Debug("RWX block attachment validated: all pods belong to the same VM (likely live migration)")
-+
-+	return vmName, nil
-+}
-+
-+// GetVMNameFromPod extracts the VM name from a pod, handling both regular virt-launcher pods
-+// and hotplug disk pods (which reference the virt-launcher pod via ownerReferences).
-+func GetVMNameFromPod(ctx context.Context, kubeClient dynamic.Interface, log *logrus.Entry, pod *unstructured.Unstructured) (string, error) {
-+	labels := pod.GetLabels()
-+	if labels == nil {
-+		return "", nil
-+	}
-+
-+	// Direct case: pod has vm.kubevirt.io/name label (virt-launcher pod)
-+	if vmName, ok := labels[KubeVirtVMLabel]; ok && vmName != "" {
-+		return vmName, nil
-+	}
-+
-+	// Hotplug disk case: pod has kubevirt.io: hotplug-disk label
-+	// Follow ownerReferences to find the virt-launcher pod
-+	if hotplugValue, ok := labels[KubeVirtHotplugDiskLabel]; ok && hotplugValue == "hotplug-disk" {
-+		ownerRefs := pod.GetOwnerReferences()
-+		for _, owner := range ownerRefs {
-+			if owner.Kind != "Pod" || owner.Controller == nil || !*owner.Controller {
-+				continue
-+			}
-+
-+			// Get the owner pod (virt-launcher)
-+			ownerPod, err := kubeClient.Resource(PodGVR).Namespace(pod.GetNamespace()).Get(ctx, owner.Name, metav1.GetOptions{})
-+			if err != nil {
-+				return "", fmt.Errorf("failed to get owner pod %s: %w", owner.Name, err)
-+			}
-+
-+			// Extract VM name from owner pod
-+			ownerLabels := ownerPod.GetLabels()
-+			if ownerLabels != nil {
-+				if vmName, ok := ownerLabels[KubeVirtVMLabel]; ok && vmName != "" {
-+					log.WithFields(logrus.Fields{
-+						"hotplugPod":   pod.GetName(),
-+						"virtLauncher": owner.Name,
-+						"vmName":       vmName,
-+					}).Debug("resolved VM name from hotplug disk pod via owner reference")
-+
-+					return vmName, nil
-+				}
-+			}
-+
-+			return "", fmt.Errorf("owner pod %s does not have %s label", owner.Name, KubeVirtVMLabel)
-+		}
-+
-+		return "", fmt.Errorf("hotplug disk pod %s has no controller owner reference", pod.GetName())
-+	}
-+
-+	return "", nil
-+}
-diff --git a/pkg/utils/rwx_validation_test.go b/pkg/utils/rwx_validation_test.go
-new file mode 100644
-index 00000000..d75690f9
---- /dev/null
-+++ b/pkg/utils/rwx_validation_test.go
-@@ -0,0 +1,342 @@
-+/*
-+CSI Driver for Linstor
-+Copyright © 2018 LINBIT USA, LLC
-+
-+This program is free software; you can redistribute it and/or modify
-+it under the terms of the GNU General Public License as published by
-+the Free Software Foundation; either version 2 of the License, or
-+(at your option) any later version.
-+
-+This program is distributed in the hope that it will be useful,
-+but WITHOUT ANY WARRANTY; without even the implied warranty of
-+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-+GNU General Public License for more details.
-+
-+You should have received a copy of the GNU General Public License
-+along with this program; if not, see <http://www.gnu.org/licenses/>.
-+*/
-+
-+package utils
-+
-+import (
-+	"context"
-+	"testing"
-+
-+	"github.com/sirupsen/logrus"
-+	"github.com/stretchr/testify/assert"
-+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-+	"k8s.io/apimachinery/pkg/runtime"
-+	"k8s.io/apimachinery/pkg/runtime/schema"
-+	dynamicfake "k8s.io/client-go/dynamic/fake"
-+)
-+
-+func TestValidateRWXBlockAttachment(t *testing.T) {
-+	testCases := []struct {
-+		name        string
-+		pods        []*unstructured.Unstructured
-+		pvcName     string
-+		namespace   string
-+		expectError bool
-+		errorMsg    string
-+	}{
-+		{
-+			name:        "no pods using PVC",
-+			pods:        []*unstructured.Unstructured{},
-+			pvcName:     "test-pvc",
-+			namespace:   "default",
-+			expectError: false,
-+		},
-+		{
-+			name: "single pod using PVC",
-+			pods: []*unstructured.Unstructured{
-+				createUnstructuredPod("pod1", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"),
-+			},
-+			pvcName:     "test-pvc",
-+			namespace:   "default",
-+			expectError: false,
-+		},
-+		{
-+			name: "two pods same VM (live migration)",
-+			pods: []*unstructured.Unstructured{
-+				createUnstructuredPod("virt-launcher-vm1-abc", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"),
-+				createUnstructuredPod("virt-launcher-vm1-xyz", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"),
-+			},
-+			pvcName:     "test-pvc",
-+			namespace:   "default",
-+			expectError: false,
-+		},
-+		{
-+			name: "two pods different VMs (should fail)",
-+			pods: []*unstructured.Unstructured{
-+				createUnstructuredPod("virt-launcher-vm1-abc", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"),
-+				createUnstructuredPod("virt-launcher-vm2-xyz", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm2"}, "Running"),
-+			},
-+			pvcName:     "test-pvc",
-+			namespace:   "default",
-+			expectError: true,
-+			errorMsg:    "different VMs",
-+		},
-+		{
-+			name: "pod without KubeVirt label when multiple pods exist (strict mode)",
-+			pods: []*unstructured.Unstructured{
-+				createUnstructuredPod("pod1", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"),
-+				createUnstructuredPod("pod2", "default", "test-pvc", map[string]string{}, "Running"),
-+			},
-+			pvcName:     "test-pvc",
-+			namespace:   "default",
-+			expectError: true,
-+			errorMsg:    "does not have the vm.kubevirt.io/name label",
-+		},
-+		{
-+			name: "completed pods should be ignored",
-+			pods: []*unstructured.Unstructured{
-+				createUnstructuredPod("pod1", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"),
-+				createUnstructuredPod("pod2", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm2"}, "Succeeded"),
-+			},
-+			pvcName:     "test-pvc",
-+			namespace:   "default",
-+			expectError: false,
-+		},
-+		{
-+			name: "failed pods should be ignored",
-+			pods: []*unstructured.Unstructured{
-+				createUnstructuredPod("pod1", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"),
-+				createUnstructuredPod("pod2", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm2"}, "Failed"),
-+			},
-+			pvcName:     "test-pvc",
-+			namespace:   "default",
-+			expectError: false,
-+		},
-+		{
-+			name: "pods in different namespace should not conflict",
-+			pods: []*unstructured.Unstructured{
-+				createUnstructuredPod("pod1", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"),
-+				createUnstructuredPod("pod2", "other", "test-pvc", map[string]string{KubeVirtVMLabel: "vm2"}, "Running"),
-+			},
-+			pvcName:     "test-pvc",
-+			namespace:   "default",
-+			expectError: false,
-+		},
-+		{
-+			name: "pods using different PVCs should not conflict",
-+			pods: []*unstructured.Unstructured{
-+				createUnstructuredPod("pod1", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"),
-+				createUnstructuredPod("pod2", "default", "other-pvc", map[string]string{KubeVirtVMLabel: "vm2"}, "Running"),
-+			},
-+			pvcName:     "test-pvc",
-+			namespace:   "default",
-+			expectError: false,
-+		},
-+		{
-+			name: "three pods from same VM (multi-node live migration scenario)",
-+			pods: []*unstructured.Unstructured{
-+				createUnstructuredPod("virt-launcher-vm1-a", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"),
-+				createUnstructuredPod("virt-launcher-vm1-b", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"),
-+				createUnstructuredPod("virt-launcher-vm1-c", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Pending"),
-+			},
-+			pvcName:     "test-pvc",
-+			namespace:   "default",
-+			expectError: false,
-+		},
-+		{
-+			name: "hotplug disk pod with virt-launcher (should succeed)",
-+			pods: []*unstructured.Unstructured{
-+				createUnstructuredPod("virt-launcher-vm1-abc", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"),
-+				createHotplugDiskPod("hp-volume-xyz", "default", "test-pvc", "virt-launcher-vm1-abc", "Running"),
-+			},
-+			pvcName:     "test-pvc",
-+			namespace:   "default",
-+			expectError: false,
-+		},
-+		{
-+			name: "hotplug disks from different VMs (should fail)",
-+			pods: []*unstructured.Unstructured{
-+				createUnstructuredPod("virt-launcher-vm1-abc", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"),
-+				createHotplugDiskPod("hp-volume-vm1", "default", "test-pvc", "virt-launcher-vm1-abc", "Running"),
-+				createUnstructuredPod("virt-launcher-vm2-xyz", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm2"}, "Running"),
-+				createHotplugDiskPod("hp-volume-vm2", "default", "test-pvc", "virt-launcher-vm2-xyz", "Running"),
-+			},
-+			pvcName:     "test-pvc",
-+			namespace:   "default",
-+			expectError: true,
-+			errorMsg:    "different VMs",
-+		},
-+	}
-+
-+	for _, tc := range testCases {
-+		t.Run(tc.name, func(t *testing.T) {
-+			// Create fake dynamic client with test pods and PV
-+			scheme := runtime.NewScheme()
-+
-+			// Create PV object that references the PVC
-+			pv := createUnstructuredPV("test-volume-id", tc.namespace, tc.pvcName)
-+
-+			objects := make([]runtime.Object, 0, len(tc.pods)+1)
-+			objects = append(objects, pv)
-+
-+			for _, pod := range tc.pods {
-+				objects = append(objects, pod)
-+			}
-+
-+			gvrToListKind := map[schema.GroupVersionResource]string{
-+				PodGVR: "PodList",
-+				PVGVR:  "PersistentVolumeList",
-+			}
-+			client := dynamicfake.NewSimpleDynamicClientWithCustomListKinds(scheme, gvrToListKind, objects...)
-+
-+			// Create logger
-+			logger := logrus.NewEntry(logrus.New())
-+			logger.Logger.SetLevel(logrus.DebugLevel)
-+
-+			// Run validation
-+			vmName, err := ValidateRWXBlockAttachment(context.Background(), client, logger, "test-volume-id")
-+
-+			if tc.expectError {
-+				assert.Error(t, err)
-+
-+				if tc.errorMsg != "" {
-+					assert.Contains(t, err.Error(), tc.errorMsg)
-+				}
-+			} else {
-+				assert.NoError(t, err)
-+				// VM name is returned when there are pods using the volume
-+				if len(tc.pods) > 0 {
-+					assert.NotEmpty(t, vmName)
-+				}
-+			}
-+		})
-+	}
-+}
-+
-+func TestValidateRWXBlockAttachmentNoKubeClient(t *testing.T) {
-+	// When not running in Kubernetes (no client), validation should be skipped
-+	logger := logrus.NewEntry(logrus.New())
-+
-+	vmName, err := ValidateRWXBlockAttachment(context.Background(), nil, logger, "test-volume-id")
-+	assert.NoError(t, err)
-+	assert.Empty(t, vmName)
-+}
-+
-+func TestValidateRWXBlockAttachmentPVNotFound(t *testing.T) {
-+	// When PV is not found, validation should be skipped with warning
-+	scheme := runtime.NewScheme()
-+
-+	gvrToListKind := map[schema.GroupVersionResource]string{
-+		PodGVR: "PodList",
-+		PVGVR:  "PersistentVolumeList",
-+	}
-+	client := dynamicfake.NewSimpleDynamicClientWithCustomListKinds(scheme, gvrToListKind)
-+
-+	logger := logrus.NewEntry(logrus.New())
-+	logger.Logger.SetLevel(logrus.DebugLevel)
-+
-+	vmName, err := ValidateRWXBlockAttachment(context.Background(), client, logger, "non-existent-pv")
-+	assert.NoError(t, err)
-+	assert.Empty(t, vmName)
-+}
-+
-+// createUnstructuredPod creates an unstructured pod object for testing.
-+func createUnstructuredPod(name, namespace, pvcName string, labels map[string]string, phase string) *unstructured.Unstructured {
-+	pod := &unstructured.Unstructured{
-+		Object: map[string]interface{}{
-+			"apiVersion": "v1",
-+			"kind":       "Pod",
-+			"metadata": map[string]interface{}{
-+				"name":      name,
-+				"namespace": namespace,
-+				"labels":    toStringInterfaceMap(labels),
-+			},
-+			"spec": map[string]interface{}{
-+				"volumes": []interface{}{
-+					map[string]interface{}{
-+						"name": "data",
-+						"persistentVolumeClaim": map[string]interface{}{
-+							"claimName": pvcName,
-+						},
-+					},
-+				},
-+			},
-+			"status": map[string]interface{}{
-+				"phase": phase,
-+			},
-+		},
-+	}
-+
-+	return pod
-+}
-+
-+// createUnstructuredPV creates an unstructured PersistentVolume object for testing.
-+func createUnstructuredPV(name, pvcNamespace, pvcName string) *unstructured.Unstructured {
-+	pv := &unstructured.Unstructured{
-+		Object: map[string]interface{}{
-+			"apiVersion": "v1",
-+			"kind":       "PersistentVolume",
-+			"metadata": map[string]interface{}{
-+				"name": name,
-+			},
-+			"spec": map[string]interface{}{
-+				"claimRef": map[string]interface{}{
-+					"name":      pvcName,
-+					"namespace": pvcNamespace,
-+				},
-+				"csi": map[string]interface{}{
-+					"volumeHandle": name,
-+				},
-+			},
-+		},
-+	}
-+
-+	return pv
-+}
-+
-+// toStringInterfaceMap converts map[string]string to map[string]interface{}.
-+func toStringInterfaceMap(m map[string]string) map[string]interface{} {
-+	result := make(map[string]interface{})
-+
-+	for k, v := range m {
-+		result[k] = v
-+	}
-+
-+	return result
-+}
-+
-+// createHotplugDiskPod creates a hotplug disk pod that references a virt-launcher pod via ownerReferences.
-+func createHotplugDiskPod(name, namespace, pvcName, ownerPodName, phase string) *unstructured.Unstructured {
-+	pod := &unstructured.Unstructured{
-+		Object: map[string]interface{}{
-+			"apiVersion": "v1",
-+			"kind":       "Pod",
-+			"metadata": map[string]interface{}{
-+				"name":      name,
-+				"namespace": namespace,
-+				"labels": map[string]interface{}{
-+					"kubevirt.io": "hotplug-disk",
-+				},
-+				"ownerReferences": []interface{}{
-+					map[string]interface{}{
-+						"apiVersion":         "v1",
-+						"kind":               "Pod",
-+						"name":               ownerPodName,
-+						"controller":         true,
-+						"blockOwnerDeletion": true,
-+					},
-+				},
-+			},
-+			"spec": map[string]interface{}{
-+				"volumes": []interface{}{
-+					map[string]interface{}{
-+						"name": "data",
-+						"persistentVolumeClaim": map[string]interface{}{
-+							"claimName": pvcName,
-+						},
-+					},
-+				},
-+			},
-+			"status": map[string]interface{}{
-+				"phase": phase,
-+			},
-+		},
-+	}
-+
-+	return pod
-+}

From 374e12e1c440753fad7879e271071eb49aff2b61 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Mon, 2 Mar 2026 18:35:28 +0100
Subject: [PATCH 239/666] refactor(linstor): move relocate-after-restore to
 VolumeSnapshotClass

Move snapshot restore relocation parameter from StorageClass to
VolumeSnapshotClass to avoid unwanted relocation during Velero
data mover backup. Change relocateAfterClone default to false.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../001-relocate-after-clone-restore.diff     | 75 +++++++++++--------
 1 file changed, 43 insertions(+), 32 deletions(-)

diff --git a/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff b/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
index b9730ade..e11dbcda 100644
--- a/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
+++ b/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
@@ -1,5 +1,5 @@
 diff --git a/pkg/client/linstor.go b/pkg/client/linstor.go
-index f544493..ebaa3d7 100644
+index f544493..98e7fde 100644
 --- a/pkg/client/linstor.go
 +++ b/pkg/client/linstor.go
 @@ -181,7 +181,7 @@ func LogLevel(s string) func(*Linstor) error {
@@ -39,7 +39,7 @@ index f544493..ebaa3d7 100644
  		return err
  	}
  
-+	if params.RelocateAfterSnapshotRestore {
++	if snapParams != nil && snapParams.RelocateAfterRestore {
 +		logger.Debug("relocate resources to optimal nodes")
 +
 +		if err := s.relocateResources(ctx, vol.ID, rGroup.Name); err != nil {
@@ -162,7 +162,7 @@ index f544493..ebaa3d7 100644
 +	// Only migrate min(remove, add) pairs.
 +	pairs := min(len(nodesToRemove), len(nodesToAdd))
 +	if pairs == 0 {
-+		logger.Info("no relocation needed, placement is already optimal")
++		logger.Debug("no relocation needed, placement is already optimal")
 +		return nil
 +	}
 +
@@ -240,30 +240,27 @@ index f544493..ebaa3d7 100644
  		if res.State == nil {
  			abnormalNodes = append(abnormalNodes, res.NodeName)
 diff --git a/pkg/volume/parameter.go b/pkg/volume/parameter.go
-index 39acd95..110c597 100644
+index 39acd95..ec21572 100644
 --- a/pkg/volume/parameter.go
 +++ b/pkg/volume/parameter.go
-@@ -50,6 +50,8 @@ const (
+@@ -50,6 +50,7 @@ const (
  	nfsservicename
  	nfssquash
  	nfsrecoveryvolumesize
 +	relocateafterclone
-+	relocateaftersnapshotrestore
  )
  
  // Parameters configuration for linstor volumes.
-@@ -118,6 +120,10 @@ type Parameters struct {
+@@ -118,6 +119,8 @@ type Parameters struct {
  	// NfsRecoveryVolumeSize sets the volume size (in bytes) of the recovery volume used by the NFS server.
  	// Defaults to 300MiB.
  	NfsRecoveryVolumeBytes int64
 +	// RelocateAfterClone triggers asynchronous relocation of replicas to optimal nodes after cloning.
 +	RelocateAfterClone bool
-+	// RelocateAfterSnapshotRestore triggers asynchronous relocation of replicas to optimal nodes after snapshot restore.
-+	RelocateAfterSnapshotRestore bool
  }
  
  const DefaultDisklessStoragePoolName = "DfltDisklessStorPool"
-@@ -136,10 +142,12 @@ func NewParameters(params map[string]string, topologyPrefix string) (Parameters,
+@@ -136,10 +139,11 @@ func NewParameters(params map[string]string, topologyPrefix string) (Parameters,
  		Encryption:             false,
  		PlacementPolicy:        topology.AutoPlaceTopology,
  		Properties:             make(map[string]string),
@@ -275,12 +272,11 @@ index 39acd95..110c597 100644
 +		NfsServiceName:               "linstor-csi-nfs",
 +		NfsSquash:                    "no_root_squash",
 +		NfsRecoveryVolumeBytes:       300 * 1024 * 1024,
-+		RelocateAfterClone:           true,
-+		RelocateAfterSnapshotRestore: true,
++		RelocateAfterClone: false,
  	}
  
  	for k, v := range params {
-@@ -287,6 +295,20 @@ func NewParameters(params map[string]string, topologyPrefix string) (Parameters,
+@@ -287,6 +291,13 @@ func NewParameters(params map[string]string, topologyPrefix string) (Parameters,
  			}
  
  			p.NfsRecoveryVolumeBytes = s.Value()
@@ -291,18 +287,11 @@ index 39acd95..110c597 100644
 +			}
 +
 +			p.RelocateAfterClone = val
-+		case relocateaftersnapshotrestore:
-+			val, err := strconv.ParseBool(v)
-+			if err != nil {
-+				return p, err
-+			}
-+
-+			p.RelocateAfterSnapshotRestore = val
  		}
  	}
  
 diff --git a/pkg/volume/paramkey_enumer.go b/pkg/volume/paramkey_enumer.go
-index 5474963..1c2fc87 100644
+index 5474963..2eb8a7c 100644
 --- a/pkg/volume/paramkey_enumer.go
 +++ b/pkg/volume/paramkey_enumer.go
 @@ -7,11 +7,11 @@ import (
@@ -310,46 +299,68 @@ index 5474963..1c2fc87 100644
  )
  
 -const _paramKeyName = "allowremotevolumeaccessautoplaceclientlistdisklessonremainingdisklessstoragepooldonotplacewithregexencryptionfsoptslayerlistmountoptsnodelistplacementcountplacementpolicyreplicasondifferentreplicasonsamesizekibstoragepoolpostmountxfsoptsresourcegroupusepvcnameoverprovisionxreplicasondifferentnfsconfigtemplatenfsservicenamenfssquashnfsrecoveryvolumesize"
-+const _paramKeyName = "allowremotevolumeaccessautoplaceclientlistdisklessonremainingdisklessstoragepooldonotplacewithregexencryptionfsoptslayerlistmountoptsnodelistplacementcountplacementpolicyreplicasondifferentreplicasonsamesizekibstoragepoolpostmountxfsoptsresourcegroupusepvcnameoverprovisionxreplicasondifferentnfsconfigtemplatenfsservicenamenfssquashnfsrecoveryvolumesizerelocateafterclonerelocateaftersnapshotrestore"
++const _paramKeyName = "allowremotevolumeaccessautoplaceclientlistdisklessonremainingdisklessstoragepooldonotplacewithregexencryptionfsoptslayerlistmountoptsnodelistplacementcountplacementpolicyreplicasondifferentreplicasonsamesizekibstoragepoolpostmountxfsoptsresourcegroupusepvcnameoverprovisionxreplicasondifferentnfsconfigtemplatenfsservicenamenfssquashnfsrecoveryvolumesizerelocateafterclone"
  
 -var _paramKeyIndex = [...]uint16{0, 23, 32, 42, 61, 80, 99, 109, 115, 124, 133, 141, 155, 170, 189, 203, 210, 221, 237, 250, 260, 273, 293, 310, 324, 333, 354}
-+var _paramKeyIndex = [...]uint16{0, 23, 32, 42, 61, 80, 99, 109, 115, 124, 133, 141, 155, 170, 189, 203, 210, 221, 237, 250, 260, 273, 293, 310, 324, 333, 354, 372, 400}
++var _paramKeyIndex = [...]uint16{0, 23, 32, 42, 61, 80, 99, 109, 115, 124, 133, 141, 155, 170, 189, 203, 210, 221, 237, 250, 260, 273, 293, 310, 324, 333, 354, 372}
  
 -const _paramKeyLowerName = "allowremotevolumeaccessautoplaceclientlistdisklessonremainingdisklessstoragepooldonotplacewithregexencryptionfsoptslayerlistmountoptsnodelistplacementcountplacementpolicyreplicasondifferentreplicasonsamesizekibstoragepoolpostmountxfsoptsresourcegroupusepvcnameoverprovisionxreplicasondifferentnfsconfigtemplatenfsservicenamenfssquashnfsrecoveryvolumesize"
-+const _paramKeyLowerName = "allowremotevolumeaccessautoplaceclientlistdisklessonremainingdisklessstoragepooldonotplacewithregexencryptionfsoptslayerlistmountoptsnodelistplacementcountplacementpolicyreplicasondifferentreplicasonsamesizekibstoragepoolpostmountxfsoptsresourcegroupusepvcnameoverprovisionxreplicasondifferentnfsconfigtemplatenfsservicenamenfssquashnfsrecoveryvolumesizerelocateafterclonerelocateaftersnapshotrestore"
++const _paramKeyLowerName = "allowremotevolumeaccessautoplaceclientlistdisklessonremainingdisklessstoragepooldonotplacewithregexencryptionfsoptslayerlistmountoptsnodelistplacementcountplacementpolicyreplicasondifferentreplicasonsamesizekibstoragepoolpostmountxfsoptsresourcegroupusepvcnameoverprovisionxreplicasondifferentnfsconfigtemplatenfsservicenamenfssquashnfsrecoveryvolumesizerelocateafterclone"
  
  func (i paramKey) String() string {
  	if i < 0 || i >= paramKey(len(_paramKeyIndex)-1) {
-@@ -50,9 +50,11 @@ func _paramKeyNoOp() {
+@@ -50,9 +50,10 @@ func _paramKeyNoOp() {
  	_ = x[nfsservicename-(23)]
  	_ = x[nfssquash-(24)]
  	_ = x[nfsrecoveryvolumesize-(25)]
 +	_ = x[relocateafterclone-(26)]
-+	_ = x[relocateaftersnapshotrestore-(27)]
  }
  
 -var _paramKeyValues = []paramKey{allowremotevolumeaccess, autoplace, clientlist, disklessonremaining, disklessstoragepool, donotplacewithregex, encryption, fsopts, layerlist, mountopts, nodelist, placementcount, placementpolicy, replicasondifferent, replicasonsame, sizekib, storagepool, postmountxfsopts, resourcegroup, usepvcname, overprovision, xreplicasondifferent, nfsconfigtemplate, nfsservicename, nfssquash, nfsrecoveryvolumesize}
-+var _paramKeyValues = []paramKey{allowremotevolumeaccess, autoplace, clientlist, disklessonremaining, disklessstoragepool, donotplacewithregex, encryption, fsopts, layerlist, mountopts, nodelist, placementcount, placementpolicy, replicasondifferent, replicasonsame, sizekib, storagepool, postmountxfsopts, resourcegroup, usepvcname, overprovision, xreplicasondifferent, nfsconfigtemplate, nfsservicename, nfssquash, nfsrecoveryvolumesize, relocateafterclone, relocateaftersnapshotrestore}
++var _paramKeyValues = []paramKey{allowremotevolumeaccess, autoplace, clientlist, disklessonremaining, disklessstoragepool, donotplacewithregex, encryption, fsopts, layerlist, mountopts, nodelist, placementcount, placementpolicy, replicasondifferent, replicasonsame, sizekib, storagepool, postmountxfsopts, resourcegroup, usepvcname, overprovision, xreplicasondifferent, nfsconfigtemplate, nfsservicename, nfssquash, nfsrecoveryvolumesize, relocateafterclone}
  
  var _paramKeyNameToValueMap = map[string]paramKey{
  	_paramKeyName[0:23]:         allowremotevolumeaccess,
-@@ -107,6 +109,10 @@ var _paramKeyNameToValueMap = map[string]paramKey{
+@@ -107,6 +108,8 @@ var _paramKeyNameToValueMap = map[string]paramKey{
  	_paramKeyLowerName[324:333]: nfssquash,
  	_paramKeyName[333:354]:      nfsrecoveryvolumesize,
  	_paramKeyLowerName[333:354]: nfsrecoveryvolumesize,
 +	_paramKeyName[354:372]:      relocateafterclone,
 +	_paramKeyLowerName[354:372]: relocateafterclone,
-+	_paramKeyName[372:400]:      relocateaftersnapshotrestore,
-+	_paramKeyLowerName[372:400]: relocateaftersnapshotrestore,
  }
  
  var _paramKeyNames = []string{
-@@ -136,6 +142,8 @@ var _paramKeyNames = []string{
+@@ -136,6 +139,7 @@ var _paramKeyNames = []string{
  	_paramKeyName[310:324],
  	_paramKeyName[324:333],
  	_paramKeyName[333:354],
 +	_paramKeyName[354:372],
-+	_paramKeyName[372:400],
  }
  
  // paramKeyString retrieves an enum value from the enum constants string name.
+diff --git a/pkg/volume/snapshot_params.go b/pkg/volume/snapshot_params.go
+index d167cb8..c7a6505 100644
+--- a/pkg/volume/snapshot_params.go
++++ b/pkg/volume/snapshot_params.go
+@@ -35,6 +35,7 @@ type SnapshotParameters struct {
+ 	LinstorTargetUrl         string       `json:"linstor-target-url,omitempty"`
+ 	LinstorTargetClusterID   string       `json:"linstor-target-cluster-id,omitempty"`
+ 	LinstorTargetStoragePool string       `json:"linstor-target-storage-pool,omitempty"`
++	RelocateAfterRestore     bool         `json:"relocate-after-restore,omitempty"`
+ }
+ 
+ func NewSnapshotParameters(params, secrets map[string]string) (*SnapshotParameters, error) {
+@@ -91,6 +92,13 @@ func NewSnapshotParameters(params, secrets map[string]string) (*SnapshotParamete
+ 			p.LinstorTargetClusterID = v
+ 		case "/linstor-target-storage-pool":
+ 			p.LinstorTargetStoragePool = v
++		case "/relocate-after-restore":
++			b, err := strconv.ParseBool(v)
++			if err != nil {
++				return nil, err
++			}
++
++			p.RelocateAfterRestore = b
+ 		default:
+ 			log.WithField("key", k).Warn("ignoring unknown snapshot parameter key")
+ 		}

From 42778cf4b126dbb77a52ea9efe16c6c1756b5d52 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Mon, 2 Mar 2026 18:38:26 +0100
Subject: [PATCH 240/666] feat(cdi): switch clone strategy to csi-clone

Use CSI clone instead of host-assisted copy for CDI DataVolume
cloning. This leverages LINSTOR's native rd-clone mechanism which
is significantly faster than pod-based data copying, and works
together with the new relocateAfterClone parameter.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/system/kubevirt-cdi/templates/cdi-cr.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/system/kubevirt-cdi/templates/cdi-cr.yaml b/packages/system/kubevirt-cdi/templates/cdi-cr.yaml
index 8f57ec43..7dc15ee0 100644
--- a/packages/system/kubevirt-cdi/templates/cdi-cr.yaml
+++ b/packages/system/kubevirt-cdi/templates/cdi-cr.yaml
@@ -3,7 +3,7 @@ kind: CDI
 metadata:
   name: cdi
 spec:
-  cloneStrategyOverride: copy
+  cloneStrategyOverride: csi-clone
   config:
     {{- with .Values.uploadProxyURL }}
     uploadProxyURLOverride: {{ quote . }}

From d4abb86092cd84cc956ed66e27283eb590b14fb6 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Mon, 2 Mar 2026 18:41:23 +0100
Subject: [PATCH 241/666] feat(linstor): configure VolumeSnapshotClasses for
 relocation and Velero

Enable relocate-after-restore on the default linstor-snapshots class
so that PVCs restored from snapshots get replicas relocated to optimal
nodes.

Add a separate linstor-snapshots-velero class with the Velero
annotation and without relocation, so Velero's temporary data mover
PVCs are not relocated unnecessarily.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../system/linstor/templates/volumesnapshotclass.yaml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/packages/system/linstor/templates/volumesnapshotclass.yaml b/packages/system/linstor/templates/volumesnapshotclass.yaml
index 4e950f3f..dd61b45a 100644
--- a/packages/system/linstor/templates/volumesnapshotclass.yaml
+++ b/packages/system/linstor/templates/volumesnapshotclass.yaml
@@ -6,3 +6,14 @@ metadata:
  name: linstor-snapshots
 driver: linstor.csi.linbit.com
 deletionPolicy: Delete
+parameters:
+  snap.linstor.csi.linbit.com/relocate-after-restore: "true"
+---
+apiVersion: snapshot.storage.k8s.io/v1
+kind: VolumeSnapshotClass
+metadata:
+ annotations:
+   velero.io/csi-volumesnapshot-class: "true"
+ name: linstor-snapshots-ephemeral
+driver: linstor.csi.linbit.com
+deletionPolicy: Delete

From 1c2c9f723aa141f16dfdde023dc9f3b3cd7b5e41 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Mon, 2 Mar 2026 18:47:25 +0100
Subject: [PATCH 242/666] fix(linstor): use camelCase for relocateAfterRestore
 parameter

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../linstor-csi/patches/001-relocate-after-clone-restore.diff | 4 ++--
 packages/system/linstor/templates/volumesnapshotclass.yaml    | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff b/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
index e11dbcda..5eeb98f5 100644
--- a/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
+++ b/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
@@ -339,7 +339,7 @@ index 5474963..2eb8a7c 100644
  
  // paramKeyString retrieves an enum value from the enum constants string name.
 diff --git a/pkg/volume/snapshot_params.go b/pkg/volume/snapshot_params.go
-index d167cb8..c7a6505 100644
+index d167cb8..50b70fb 100644
 --- a/pkg/volume/snapshot_params.go
 +++ b/pkg/volume/snapshot_params.go
 @@ -35,6 +35,7 @@ type SnapshotParameters struct {
@@ -354,7 +354,7 @@ index d167cb8..c7a6505 100644
  			p.LinstorTargetClusterID = v
  		case "/linstor-target-storage-pool":
  			p.LinstorTargetStoragePool = v
-+		case "/relocate-after-restore":
++		case "/relocateAfterRestore":
 +			b, err := strconv.ParseBool(v)
 +			if err != nil {
 +				return nil, err
diff --git a/packages/system/linstor/templates/volumesnapshotclass.yaml b/packages/system/linstor/templates/volumesnapshotclass.yaml
index dd61b45a..17350a1b 100644
--- a/packages/system/linstor/templates/volumesnapshotclass.yaml
+++ b/packages/system/linstor/templates/volumesnapshotclass.yaml
@@ -7,7 +7,7 @@ metadata:
 driver: linstor.csi.linbit.com
 deletionPolicy: Delete
 parameters:
-  snap.linstor.csi.linbit.com/relocate-after-restore: "true"
+  snap.linstor.csi.linbit.com/relocateAfterRestore: "true"
 ---
 apiVersion: snapshot.storage.k8s.io/v1
 kind: VolumeSnapshotClass

From 37a68164925d08f968f720496002eb3e91381226 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 3 Mar 2026 14:47:57 +0100
Subject: [PATCH 243/666] style(linstor): regenerate patch with gofmt fix

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../001-relocate-after-clone-restore.diff     | 20 ++++++-------------
 1 file changed, 6 insertions(+), 14 deletions(-)

diff --git a/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff b/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
index 5eeb98f5..bef36969 100644
--- a/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
+++ b/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
@@ -240,7 +240,7 @@ index f544493..98e7fde 100644
  		if res.State == nil {
  			abnormalNodes = append(abnormalNodes, res.NodeName)
 diff --git a/pkg/volume/parameter.go b/pkg/volume/parameter.go
-index 39acd95..ec21572 100644
+index 39acd95..aed18ab 100644
 --- a/pkg/volume/parameter.go
 +++ b/pkg/volume/parameter.go
 @@ -50,6 +50,7 @@ const (
@@ -260,19 +260,11 @@ index 39acd95..ec21572 100644
  }
  
  const DefaultDisklessStoragePoolName = "DfltDisklessStorPool"
-@@ -136,10 +139,11 @@ func NewParameters(params map[string]string, topologyPrefix string) (Parameters,
- 		Encryption:             false,
- 		PlacementPolicy:        topology.AutoPlaceTopology,
- 		Properties:             make(map[string]string),
--		NfsConfigTemplatePath:  "/etc/nfs-helper/default-config.tmpl",
--		NfsServiceName:         "linstor-csi-nfs",
--		NfsSquash:              "no_root_squash",
--		NfsRecoveryVolumeBytes: 300 * 1024 * 1024,
-+		NfsConfigTemplatePath:        "/etc/nfs-helper/default-config.tmpl",
-+		NfsServiceName:               "linstor-csi-nfs",
-+		NfsSquash:                    "no_root_squash",
-+		NfsRecoveryVolumeBytes:       300 * 1024 * 1024,
-+		RelocateAfterClone: false,
+@@ -140,6 +143,7 @@ func NewParameters(params map[string]string, topologyPrefix string) (Parameters,
+ 		NfsServiceName:         "linstor-csi-nfs",
+ 		NfsSquash:              "no_root_squash",
+ 		NfsRecoveryVolumeBytes: 300 * 1024 * 1024,
++		RelocateAfterClone:     false,
  	}
  
  	for k, v := range params {

From 2c0a9fb2ccd481ef2a45ff1972690e67419391f2 Mon Sep 17 00:00:00 2001
From: Mattia Eleuteri <mattia.eleuteri@hidora.io>
Date: Thu, 5 Mar 2026 11:22:34 +0100
Subject: [PATCH 244/666] [vpc] Add VPC peering support for multi-tenant
 environments

Implement bilateral VPC peering using Kube-OVN's native vpcPeerings
mechanism. Each VPC can declare peers by specifying the remote VPC name
and tenant namespace. Peering is only activated by Kube-OVN when both
sides declare each other, ensuring mutual consent.

Key features:
- Deterministic remote VPC ID resolution via sha256 hash
- Auto-allocated link-local peering IPs (169.254.0.0/16) derived from
  sorted pair hash, eliminating manual IP coordination
- Static routes support for fine-grained inter-VPC routing
- ConfigMap enrichment with peer discovery info
- Schema validation enforcing tenant- namespace prefix pattern

Signed-off-by: Mattia Eleuteri <mattia.eleuteri@hidora.io>
Signed-off-by: mattia-eleuteri <mattia@hidora.io>
---
 packages/apps/vpc/templates/vpc.yaml          | 39 ++++++++++++++++
 packages/apps/vpc/values.schema.json          | 44 +++++++++++++++++++
 packages/apps/vpc/values.yaml                 | 22 ++++++++++
 .../cozyrds/virtualprivatecloud.yaml          |  4 +-
 4 files changed, 107 insertions(+), 2 deletions(-)

diff --git a/packages/apps/vpc/templates/vpc.yaml b/packages/apps/vpc/templates/vpc.yaml
index 6c0d2249..cb860279 100644
--- a/packages/apps/vpc/templates/vpc.yaml
+++ b/packages/apps/vpc/templates/vpc.yaml
@@ -15,6 +15,39 @@ spec:
   enableExternal: false
   namespaces:
     - {{ .Release.Namespace }}
+{{- if .Values.peers }}
+{{- $hexLookup := dict "0" 0 "1" 1 "2" 2 "3" 3 "4" 4 "5" 5 "6" 6 "7" 7 "8" 8 "9" 9 "a" 10 "b" 11 "c" 12 "d" 13 "e" 14 "f" 15 }}
+  vpcPeerings:
+{{- range .Values.peers }}
+{{- $remoteRelease := printf "virtualprivatecloud-%s" .vpcName }}
+{{- $remoteVpcId := printf "vpc-%s" (printf "%s/%s" .tenantNamespace $remoteRelease | sha256sum | trunc 6) }}
+{{- $sorted := list $vpcId $remoteVpcId | sortAlpha }}
+{{- $pairKey := join "/" $sorted }}
+{{- $pairHash := sha256sum $pairKey }}
+{{- $h0 := int (get $hexLookup (substr 0 1 $pairHash)) }}
+{{- $h1 := int (get $hexLookup (substr 1 2 $pairHash)) }}
+{{- $h2 := int (get $hexLookup (substr 2 3 $pairHash)) }}
+{{- $h3 := int (get $hexLookup (substr 3 4 $pairHash)) }}
+{{- $byte0 := add (mul $h0 16) $h1 }}
+{{- $byte1 := add (mul $h2 16) $h3 }}
+{{- $oct3 := int (add (mod $byte0 254) 1) }}
+{{- $base4 := int (mul (mod $byte1 64) 4) }}
+{{- if eq $vpcId (index $sorted 0) }}
+    - remoteVpc: {{ $remoteVpcId }}
+      localConnectIP: {{ printf "169.254.%d.%d" $oct3 (int (add $base4 1)) }}
+{{- else }}
+    - remoteVpc: {{ $remoteVpcId }}
+      localConnectIP: {{ printf "169.254.%d.%d" $oct3 (int (add $base4 2)) }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- if .Values.routes }}
+  staticRoutes:
+{{- range .Values.routes }}
+    - cidr: {{ .cidr | quote }}
+      nextHopIP: {{ .nextHopIP | quote }}
+{{- end }}
+{{- end }}
 
 {{- range .Values.subnets }}
 {{- $subnetId := print "subnet-" (print $.Release.Namespace "/" $vpcId "/" .name | sha256sum | trunc 8) }}
@@ -70,6 +103,12 @@ data:
   {{ .name }}.ID: {{ print "subnet-" (print $.Release.Namespace "/" $vpcId "/" .name | sha256sum | trunc 8) }}
   {{ .name }}.CIDR: {{ .cidr }}
   {{- end }}
+  {{- range .Values.peers }}
+  {{- $remoteRelease := printf "virtualprivatecloud-%s" .vpcName }}
+  {{- $remoteVpcId := printf "vpc-%s" (printf "%s/%s" .tenantNamespace $remoteRelease | sha256sum | trunc 6) }}
+  peer.{{ .tenantNamespace }}.{{ .vpcName }}.vpcId: {{ $remoteVpcId | quote }}
+  peer.{{ .tenantNamespace }}.{{ .vpcName }}.tenantNamespace: {{ .tenantNamespace | quote }}
+  {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
diff --git a/packages/apps/vpc/values.schema.json b/packages/apps/vpc/values.schema.json
index a975d2d7..c3d5d65a 100644
--- a/packages/apps/vpc/values.schema.json
+++ b/packages/apps/vpc/values.schema.json
@@ -2,6 +2,50 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
+    "peers": {
+      "description": "VPC peering connections (bidirectional declaration required)",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "object",
+        "required": [
+          "tenantNamespace",
+          "vpcName"
+        ],
+        "properties": {
+          "tenantNamespace": {
+            "description": "Namespace of the remote tenant",
+            "type": "string"
+          },
+          "vpcName": {
+            "description": "Logical name of the remote VPC (without \"virtualprivatecloud-\" prefix)",
+            "type": "string"
+          }
+        }
+      }
+    },
+    "routes": {
+      "description": "Static routes for the VPC",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "object",
+        "required": [
+          "cidr",
+          "nextHopIP"
+        ],
+        "properties": {
+          "cidr": {
+            "description": "Destination CIDR",
+            "type": "string"
+          },
+          "nextHopIP": {
+            "description": "Next hop IP address",
+            "type": "string"
+          }
+        }
+      }
+    },
     "subnets": {
       "description": "Subnets of a VPC",
       "type": "array",
diff --git a/packages/apps/vpc/values.yaml b/packages/apps/vpc/values.yaml
index 3af8b26b..8bd27589 100644
--- a/packages/apps/vpc/values.yaml
+++ b/packages/apps/vpc/values.yaml
@@ -14,3 +14,25 @@ subnets: []
 ##     cidr: "172.16.0.0/24"
 ##   - name: mysubnet1
 ##     cidr: "172.16.1.0/24"
+
+## @typedef {struct} Peer - VPC peering target
+## @field {string} vpcName - Logical name of the remote VPC (without "virtualprivatecloud-" prefix)
+## @field {string} tenantNamespace - Namespace of the remote tenant
+
+## @param {[]Peer} peers - VPC peering connections (bidirectional declaration required)
+peers: []
+## Example:
+## peers:
+##   - vpcName: "other-vpc"
+##     tenantNamespace: "tenant-other"
+
+## @typedef {struct} Route - Static route entry
+## @field {string} cidr - Destination CIDR
+## @field {string} nextHopIP - Next hop IP address
+
+## @param {[]Route} routes - Static routes for the VPC
+routes: []
+## Example:
+## routes:
+##   - cidr: "172.16.1.0/24"
+##     nextHopIP: "10.0.0.1"
diff --git a/packages/system/virtualprivatecloud-rd/cozyrds/virtualprivatecloud.yaml b/packages/system/virtualprivatecloud-rd/cozyrds/virtualprivatecloud.yaml
index d5694a2c..ad3b26e4 100644
--- a/packages/system/virtualprivatecloud-rd/cozyrds/virtualprivatecloud.yaml
+++ b/packages/system/virtualprivatecloud-rd/cozyrds/virtualprivatecloud.yaml
@@ -8,7 +8,7 @@ spec:
     plural: virtualprivateclouds
     singular: virtualprivatecloud
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"subnets":{"description":"Subnets of a VPC","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"cidr":{"description":"IP address range","type":"string"},"name":{"description":"Subnet name","type":"string"}}}}}}
+      {"title":"Chart Values","type":"object","properties":{"peers":{"description":"VPC peering connections (bidirectional declaration required)","type":"array","default":[],"items":{"type":"object","required":["tenantNamespace","vpcName"],"properties":{"tenantNamespace":{"description":"Namespace of the remote tenant","type":"string"},"vpcName":{"description":"Logical name of the remote VPC (without \"virtualprivatecloud-\" prefix)","type":"string"}}}},"routes":{"description":"Static routes for the VPC","type":"array","default":[],"items":{"type":"object","required":["cidr","nextHopIP"],"properties":{"cidr":{"description":"Destination CIDR","type":"string"},"nextHopIP":{"description":"Next hop IP address","type":"string"}}}},"subnets":{"description":"Subnets of a VPC","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"cidr":{"description":"IP address range","type":"string"},"name":{"description":"Subnet name","type":"string"}}}}}}
   release:
     prefix: "virtualprivatecloud-"
     labels:
@@ -23,7 +23,7 @@ spec:
     plural: VPCs
     description: "Isolated networks"
     icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl8xMDI1XzMpIi8+CjxwYXRoIGQ9Ik0xMDkuNiA4Ni4xSDExNC4zQzExNi44ODUgODYuMSAxMTkgODguMjE1IDExOSA5MC44NDdWMTA0Ljg1M0MxMTkgMTA3LjQ4NSAxMTYuODg1IDEwOS42IDExNC4zIDEwOS42SDk1LjVDOTIuOTE1IDEwOS42IDkwLjggMTA3LjQ4NSA5MC44IDEwNC44NTNWOTAuODQ3QzkwLjggODguMjE1IDkyLjkxNSA4Ni4xIDk1LjUgODYuMUgxMDAuMlY3Ni43SDc2LjdWODYuMUg4MS40QzgzLjk4NSA4Ni4xIDg2LjEgODguMjE1IDg2LjEgOTAuODQ3VjEwNC44NTNDODYuMSAxMDcuNDg1IDgzLjk4NSAxMDkuNiA4MS40IDEwOS42SDYyLjZDNjAuMDE1IDEwOS42IDU3LjkgMTA3LjQ4NSA1Ny45IDEwNC44NTNWOTAuODQ3QzU3LjkgODguMjE1IDYwLjAxNSA4Ni4xIDYyLjYgODYuMUg2Ny4zVjc2LjdINDMuOFY4Ni4xSDQ4LjVDNTEuMDg1IDg2LjEgNTMuMiA4OC4yMTUgNTMuMiA5MC44NDdWMTA0Ljg1M0M1My4yIDEwNy40ODUgNTEuMDg1IDEwOS42IDQ4LjUgMTA5LjZIMjkuN0MyNy4xMTUgMTA5LjYgMjUgMTA3LjQ4NSAyNSAxMDQuODUzVjkwLjg0N0MyNSA4OC4yMTUgMjcuMTE1IDg2LjEgMjkuNyA4Ni4xSDM0LjRWNzYuN0MzNC40IDcxLjUzIDM4LjYzIDY3LjMgNDMuOCA2Ny4zSDY3LjNWNTcuOUg2Mi42QzYwLjAxNSA1Ny45IDU3LjkgNTUuNzg1IDU3LjkgNTMuMTUzVjM5LjE0N0M1Ny45IDM2LjUxNSA2MC4wMTUgMzQuNCA2Mi42IDM0LjRIODEuNEM4My45ODUgMzQuNCA4Ni4xIDM2LjUxNSA4Ni4xIDM5LjE0N1Y1My4xNTNDODYuMSA1NS43ODUgODMuOTg1IDU3LjkgODEuNCA1Ny45SDc2LjdWNjcuM0gxMDAuMkMxMDUuMzcgNjcuMyAxMDkuNiA3MS41MyAxMDkuNiA3Ni43Vjg2LjFaIiBmaWxsPSJ3aGl0ZSIvPgo8ZGVmcz4KPGxpbmVhckdyYWRpZW50IGlkPSJwYWludDBfbGluZWFyXzEwMjVfMyIgeDE9IjE0Mi41IiB5MT0iMTQzIiB4Mj0iMy45OTk5OSIgeTI9IjkuNDk5OTkiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj4KPHN0b3Agc3RvcC1jb2xvcj0iIzAwMDgyRSIvPgo8c3RvcCBvZmZzZXQ9IjEiIHN0b3AtY29sb3I9IiMyRTMwNjciLz4KPC9saW5lYXJHcmFkaWVudD4KPC9kZWZzPgo8L3N2Zz4K
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "subnets"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "subnets"], ["spec", "peers"], ["spec", "routes"]]
   secrets:
     exclude: []
     include: []

From f201fe4dac16a40e5337cf2dd0c68caefd7d7ee7 Mon Sep 17 00:00:00 2001
From: mattia-eleuteri <mattia@hidora.io>
Date: Thu, 19 Feb 2026 15:05:41 +0100
Subject: [PATCH 245/666] feat(extra): add external-dns as standalone extra
 package

Signed-off-by: mattia-eleuteri <mattia@hidora.io>
---
 hack/e2e-apps/external-dns.bats               |  50 +
 hack/e2e-install-cozystack.bats               |   3 +
 .../sources/external-dns-application.yaml     |  29 +
 .../platform/templates/bundles/system.yaml    |   1 +
 packages/extra/external-dns/Chart.yaml        |   6 +
 packages/extra/external-dns/Makefile          |   7 +
 packages/extra/external-dns/README.md         |  88 ++
 packages/extra/external-dns/charts/cozy-lib   |   1 +
 packages/extra/external-dns/config.json       |  23 +
 .../extra/external-dns/logos/external-dns.svg |  20 +
 .../templates/dashboard-resourcemap.yaml      |  23 +
 .../external-dns/templates/external-dns.yaml  | 169 ++++
 .../extra/external-dns/values.schema.json     | 193 ++++
 packages/extra/external-dns/values.yaml       | 149 +++
 packages/system/external-dns-rd/Chart.yaml    |   3 +
 packages/system/external-dns-rd/Makefile      |   4 +
 .../external-dns-rd/cozyrds/external-dns.yaml |  24 +
 .../external-dns-rd/templates/cozyrd.yaml     |   4 +
 packages/system/external-dns-rd/values.yaml   |   1 +
 .../charts/external-dns/.helmignore           |   4 +
 .../charts/external-dns/CHANGELOG.md          | 128 ++-
 .../charts/external-dns/Chart.yaml            |  22 +-
 .../charts/external-dns/README.md             |  50 +-
 .../charts/external-dns/README.md.gotmpl      |  19 +-
 .../charts/external-dns/RELEASE.md            |  13 +-
 .../charts/external-dns/ci/ci-values.yaml     |   2 -
 ...l => dnsendpoints.externaldns.k8s.io.yaml} |  22 +-
 .../charts/external-dns/templates/NOTES.txt   |  11 +
 .../external-dns/templates/_helpers.tpl       |  19 +
 .../external-dns/templates/clusterrole.yaml   |  50 +-
 .../templates/clusterrolebinding.yaml         |  35 +
 .../external-dns/templates/deployment.yaml    | 109 ++-
 .../templates/serviceaccount.yaml             |   4 +-
 .../charts/external-dns/values.schema.json    | 869 +++++++++++++++++-
 .../charts/external-dns/values.yaml           | 155 ++--
 35 files changed, 2130 insertions(+), 180 deletions(-)
 create mode 100644 hack/e2e-apps/external-dns.bats
 create mode 100644 packages/core/platform/sources/external-dns-application.yaml
 create mode 100644 packages/extra/external-dns/Chart.yaml
 create mode 100644 packages/extra/external-dns/Makefile
 create mode 100644 packages/extra/external-dns/README.md
 create mode 120000 packages/extra/external-dns/charts/cozy-lib
 create mode 100644 packages/extra/external-dns/config.json
 create mode 100644 packages/extra/external-dns/logos/external-dns.svg
 create mode 100644 packages/extra/external-dns/templates/dashboard-resourcemap.yaml
 create mode 100644 packages/extra/external-dns/templates/external-dns.yaml
 create mode 100644 packages/extra/external-dns/values.schema.json
 create mode 100644 packages/extra/external-dns/values.yaml
 create mode 100644 packages/system/external-dns-rd/Chart.yaml
 create mode 100644 packages/system/external-dns-rd/Makefile
 create mode 100644 packages/system/external-dns-rd/cozyrds/external-dns.yaml
 create mode 100644 packages/system/external-dns-rd/templates/cozyrd.yaml
 create mode 100644 packages/system/external-dns-rd/values.yaml
 delete mode 100644 packages/system/external-dns/charts/external-dns/ci/ci-values.yaml
 rename packages/system/external-dns/charts/external-dns/crds/{dnsendpoint.yaml => dnsendpoints.externaldns.k8s.io.yaml} (82%)

diff --git a/hack/e2e-apps/external-dns.bats b/hack/e2e-apps/external-dns.bats
new file mode 100644
index 00000000..ca114af8
--- /dev/null
+++ b/hack/e2e-apps/external-dns.bats
@@ -0,0 +1,50 @@
+#!/usr/bin/env bats
+
+teardown() {
+  kubectl -n tenant-test delete externaldns.apps.cozystack.io --all --ignore-not-found 2>/dev/null || true
+}
+
+@test "Create and Verify ExternalDNS with inmemory provider" {
+  name='test'
+  kubectl apply -f - <<EOF
+apiVersion: apps.cozystack.io/v1alpha1
+kind: ExternalDNS
+metadata:
+  name: ${name}
+  namespace: tenant-test
+spec:
+  provider: inmemory
+  domainFilters:
+    - example.com
+EOF
+
+  sleep 5
+  kubectl -n tenant-test wait hr ${name} --timeout=120s --for=condition=ready
+  kubectl -n tenant-test wait hr ${name}-system --timeout=120s --for=condition=ready
+  timeout 60 sh -ec "until kubectl -n tenant-test get deploy -l app.kubernetes.io/instance=${name}-system -o jsonpath='{.items[0].status.readyReplicas}' | grep -q '1'; do sleep 5; done"
+
+  kubectl -n tenant-test delete externaldns.apps.cozystack.io ${name}
+}
+
+@test "Create and Verify ExternalDNS with custom annotationPrefix" {
+  name='test-prefix'
+  kubectl apply -f - <<EOF
+apiVersion: apps.cozystack.io/v1alpha1
+kind: ExternalDNS
+metadata:
+  name: ${name}
+  namespace: tenant-test
+spec:
+  provider: inmemory
+  annotationPrefix: custom-dns/
+  domainFilters:
+    - example.org
+EOF
+
+  sleep 5
+  kubectl -n tenant-test wait hr ${name} --timeout=120s --for=condition=ready
+  kubectl -n tenant-test wait hr ${name}-system --timeout=120s --for=condition=ready
+  timeout 60 sh -ec "until kubectl -n tenant-test get deploy -l app.kubernetes.io/instance=${name}-system -o jsonpath='{.items[0].status.readyReplicas}' | grep -q '1'; do sleep 5; done"
+
+  kubectl -n tenant-test delete externaldns.apps.cozystack.io ${name}
+}
diff --git a/hack/e2e-install-cozystack.bats b/hack/e2e-install-cozystack.bats
index 43b8ab8f..9d7f91ba 100644
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -46,6 +46,9 @@ spec:
         publishing:
           host: "example.org"
           apiServerEndpoint: "https://192.168.123.10:6443"
+        bundles:
+          enabledPackages:
+            - cozystack.external-dns-application
 EOF
 
   # Wait until HelmReleases appear & reconcile them
diff --git a/packages/core/platform/sources/external-dns-application.yaml b/packages/core/platform/sources/external-dns-application.yaml
new file mode 100644
index 00000000..0a37dc52
--- /dev/null
+++ b/packages/core/platform/sources/external-dns-application.yaml
@@ -0,0 +1,29 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.external-dns-application
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+    path: /
+  variants:
+    - name: default
+      dependsOn:
+        - cozystack.networking
+      libraries:
+        - name: cozy-lib
+          path: library/cozy-lib
+      components:
+        - name: external-dns-system
+          path: system/external-dns
+        - name: external-dns
+          path: extra/external-dns
+          libraries: ["cozy-lib"]
+        - name: external-dns-rd
+          path: system/external-dns-rd
+          install:
+            namespace: cozy-system
+            releaseName: external-dns-rd
diff --git a/packages/core/platform/templates/bundles/system.yaml b/packages/core/platform/templates/bundles/system.yaml
index c24726ef..320aecf0 100644
--- a/packages/core/platform/templates/bundles/system.yaml
+++ b/packages/core/platform/templates/bundles/system.yaml
@@ -149,6 +149,7 @@
 {{include "cozystack.platform.package.optional.default" (list "cozystack.nfs-driver" $) }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.telepresence" $) }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.external-dns" $) }}
+{{include "cozystack.platform.package.optional.default" (list "cozystack.external-dns-application" $) }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.external-secrets-operator" $) }}
 {{- if has "cozystack.bootbox" (default (list) .Values.bundles.enabledPackages) }}
 {{include "cozystack.platform.package.default" (list "cozystack.bootbox-application" $) }}
diff --git a/packages/extra/external-dns/Chart.yaml b/packages/extra/external-dns/Chart.yaml
new file mode 100644
index 00000000..d9788a41
--- /dev/null
+++ b/packages/extra/external-dns/Chart.yaml
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: external-dns
+description: External DNS for automatic DNS record management
+icon: /logos/external-dns.svg
+type: application
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
diff --git a/packages/extra/external-dns/Makefile b/packages/extra/external-dns/Makefile
new file mode 100644
index 00000000..8b8fbc2f
--- /dev/null
+++ b/packages/extra/external-dns/Makefile
@@ -0,0 +1,7 @@
+NAME=external-dns
+
+include ../../../hack/package.mk
+
+generate:
+	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	../../../hack/update-crd.sh
diff --git a/packages/extra/external-dns/README.md b/packages/extra/external-dns/README.md
new file mode 100644
index 00000000..027182c1
--- /dev/null
+++ b/packages/extra/external-dns/README.md
@@ -0,0 +1,88 @@
+# External DNS
+
+## Parameters
+
+### Common parameters
+
+| Name               | Description                                                                        | Type       | Value         |
+| ------------------ | ---------------------------------------------------------------------------------- | ---------- | ------------- |
+| `provider`         | DNS provider name.                                                                 | `string`   | `{}`          |
+| `domainFilters`    | List of domains this external-dns instance can manage.                             | `[]string` | `[]`          |
+| `policy`           | How DNS records are synchronized.                                                  | `string`   | `upsert-only` |
+| `extraArgs`        | Extra arguments for external-dns.                                                  | `[]string` | `[]`          |
+| `gatewayAPI`       | Enable Gateway API HTTPRoute as a source for DNS records.                          | `bool`     | `false`       |
+| `annotationPrefix` | Custom annotation prefix for external-dns (useful for running multiple instances). | `string`   | `""`          |
+
+
+### Cloudflare
+
+| Name         | Description                      | Type     | Value                                                       |
+| ------------ | -------------------------------- | -------- | ----------------------------------------------------------- |
+| `cloudflare` | Cloudflare provider credentials. | `object` | `{"apiEmail":"","apiKey":"","apiToken":"","proxied":false}` |
+
+
+### AWS
+
+| Name  | Description                       | Type     | Value                                                               |
+| ----- | --------------------------------- | -------- | ------------------------------------------------------------------- |
+| `aws` | AWS Route53 provider credentials. | `object` | `{"accessKeyId":"","region":"","secretAccessKey":"","zoneType":""}` |
+
+
+### Azure
+
+| Name    | Description                     | Type     | Value                                                                                          |
+| ------- | ------------------------------- | -------- | ---------------------------------------------------------------------------------------------- |
+| `azure` | Azure DNS provider credentials. | `object` | `{"aadClientId":"","aadClientSecret":"","resourceGroup":"","subscriptionId":"","tenantId":""}` |
+
+
+### Google
+
+| Name     | Description                            | Type     | Value                                   |
+| -------- | -------------------------------------- | -------- | --------------------------------------- |
+| `google` | Google Cloud DNS provider credentials. | `object` | `{"project":"","serviceAccountKey":""}` |
+
+
+### DigitalOcean
+
+| Name           | Description                            | Type     | Value          |
+| -------------- | -------------------------------------- | -------- | -------------- |
+| `digitalocean` | DigitalOcean DNS provider credentials. | `object` | `{"token":""}` |
+
+
+### Linode
+
+| Name     | Description                      | Type     | Value          |
+| -------- | -------------------------------- | -------- | -------------- |
+| `linode` | Linode DNS provider credentials. | `object` | `{"token":""}` |
+
+
+### OVH
+
+| Name  | Description                   | Type     | Value                                                                         |
+| ----- | ----------------------------- | -------- | ----------------------------------------------------------------------------- |
+| `ovh` | OVH DNS provider credentials. | `object` | `{"applicationKey":"","applicationSecret":"","consumerKey":"","endpoint":""}` |
+
+
+### Exoscale
+
+| Name       | Description                        | Type     | Value                          |
+| ---------- | ---------------------------------- | -------- | ------------------------------ |
+| `exoscale` | Exoscale DNS provider credentials. | `object` | `{"apiKey":"","apiSecret":""}` |
+
+
+### GoDaddy
+
+| Name      | Description                       | Type     | Value                          |
+| --------- | --------------------------------- | -------- | ------------------------------ |
+| `godaddy` | GoDaddy DNS provider credentials. | `object` | `{"apiKey":"","apiSecret":""}` |
+
+
+### Resources
+
+| Name               | Description                                                                                              | Type       | Value  |
+| ------------------ | -------------------------------------------------------------------------------------------------------- | ---------- | ------ |
+| `resources`        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`   | `{}`   |
+| `resources.cpu`    | CPU available to each replica.                                                                           | `quantity` | `""`   |
+| `resources.memory` | Memory (RAM) available to each replica.                                                                  | `quantity` | `""`   |
+| `resourcesPreset`  | Default sizing preset used when `resources` is omitted.                                                  | `string`   | `nano` |
+
diff --git a/packages/extra/external-dns/charts/cozy-lib b/packages/extra/external-dns/charts/cozy-lib
new file mode 120000
index 00000000..e1813509
--- /dev/null
+++ b/packages/extra/external-dns/charts/cozy-lib
@@ -0,0 +1 @@
+../../../library/cozy-lib
\ No newline at end of file
diff --git a/packages/extra/external-dns/config.json b/packages/extra/external-dns/config.json
new file mode 100644
index 00000000..b2f956f3
--- /dev/null
+++ b/packages/extra/external-dns/config.json
@@ -0,0 +1,23 @@
+{
+  "comments": {
+    "format": "##"
+  },
+  "tags": {
+    "param": "@param",
+    "section": "@section",
+    "descriptionStart": "@descriptionStart",
+    "descriptionEnd": "@descriptionEnd",
+    "skip": "@skip",
+    "extra": "@extra"
+  },
+  "modifiers": {
+    "array": "array",
+    "object": "object",
+    "string": "string",
+    "nullable": "nullable",
+    "default": "default"
+  },
+  "regexp": {
+    "paramsSectionTitle": "Parameters"
+  }
+}
diff --git a/packages/extra/external-dns/logos/external-dns.svg b/packages/extra/external-dns/logos/external-dns.svg
new file mode 100644
index 00000000..b22ad8c4
--- /dev/null
+++ b/packages/extra/external-dns/logos/external-dns.svg
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 144 144" width="144" height="144">
+  <defs>
+    <linearGradient id="bg" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" style="stop-color:#3B82F6"/>
+      <stop offset="100%" style="stop-color:#1D4ED8"/>
+    </linearGradient>
+  </defs>
+  <rect width="144" height="144" rx="28" fill="url(#bg)"/>
+  <g transform="translate(72,72)" fill="none" stroke="#fff" stroke-width="4" stroke-linecap="round" stroke-linejoin="round">
+    <!-- Globe -->
+    <circle cx="0" cy="-4" r="32"/>
+    <ellipse cx="0" cy="-4" rx="14" ry="32"/>
+    <line x1="-32" y1="-4" x2="32" y2="-4"/>
+    <path d="M-28,12 Q0,18 28,12"/>
+    <path d="M-28,-20 Q0,-14 28,-20"/>
+    <!-- Arrow pointing out -->
+    <line x1="18" y1="18" x2="36" y2="36"/>
+    <polyline points="28,36 36,36 36,28"/>
+  </g>
+</svg>
diff --git a/packages/extra/external-dns/templates/dashboard-resourcemap.yaml b/packages/extra/external-dns/templates/dashboard-resourcemap.yaml
new file mode 100644
index 00000000..edd96b74
--- /dev/null
+++ b/packages/extra/external-dns/templates/dashboard-resourcemap.yaml
@@ -0,0 +1,23 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+rules:
+- apiGroups:
+  - helm.toolkit.fluxcd.io
+  resources:
+  - helmreleases
+  resourceNames:
+  - {{ .Release.Name }}
+  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "admin" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
diff --git a/packages/extra/external-dns/templates/external-dns.yaml b/packages/extra/external-dns/templates/external-dns.yaml
new file mode 100644
index 00000000..cdfb8901
--- /dev/null
+++ b/packages/extra/external-dns/templates/external-dns.yaml
@@ -0,0 +1,169 @@
+{{- if not .Values.provider }}
+{{- fail "provider is required: set it to one of cloudflare, aws, azure, google, digitalocean, linode, ovh, exoscale, godaddy, inmemory" }}
+{{- end }}
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: {{ .Release.Name }}-system
+  labels:
+    app.kubernetes.io/instance: {{ .Release.Name }}-system
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+spec:
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-external-dns-application-default-external-dns-system
+    namespace: cozy-system
+  interval: 5m
+  timeout: 10m
+  install:
+    remediation:
+      retries: -1
+  upgrade:
+    force: true
+    remediation:
+      retries: -1
+  values:
+    external-dns:
+      namespaced: true
+      txtOwnerId: {{ .Release.Namespace | quote }}
+      policy: {{ .Values.policy | quote }}
+      {{- if .Values.annotationPrefix }}
+      annotationPrefix: {{ .Values.annotationPrefix | quote }}
+      {{- end }}
+      provider:
+        name: {{ .Values.provider | quote }}
+      sources:
+        - ingress
+        - service
+        {{- if .Values.gatewayAPI }}
+        - gateway-httproute
+        {{- end }}
+      {{- with .Values.domainFilters }}
+      domainFilters:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+
+      {{- /* Provider-specific credentials and config */}}
+
+      {{- if eq .Values.provider "cloudflare" }}
+      {{- if or .Values.cloudflare.apiToken (and .Values.cloudflare.apiKey .Values.cloudflare.apiEmail) }}
+      env:
+        {{- if .Values.cloudflare.apiToken }}
+        - name: CF_API_TOKEN
+          value: {{ .Values.cloudflare.apiToken | quote }}
+        {{- else }}
+        - name: CF_API_KEY
+          value: {{ .Values.cloudflare.apiKey | quote }}
+        - name: CF_API_EMAIL
+          value: {{ .Values.cloudflare.apiEmail | quote }}
+        {{- end }}
+      {{- end }}
+      {{- if .Values.cloudflare.proxied }}
+      cloudflare:
+        proxied: true
+      {{- end }}
+      {{- end }}
+
+      {{- if eq .Values.provider "aws" }}
+      {{- if or .Values.aws.accessKeyId .Values.aws.secretAccessKey .Values.aws.region }}
+      env:
+        {{- if .Values.aws.accessKeyId }}
+        - name: AWS_ACCESS_KEY_ID
+          value: {{ .Values.aws.accessKeyId | quote }}
+        {{- end }}
+        {{- if .Values.aws.secretAccessKey }}
+        - name: AWS_SECRET_ACCESS_KEY
+          value: {{ .Values.aws.secretAccessKey | quote }}
+        {{- end }}
+        {{- if .Values.aws.region }}
+        - name: AWS_DEFAULT_REGION
+          value: {{ .Values.aws.region | quote }}
+        {{- end }}
+      {{- end }}
+      {{- if .Values.aws.zoneType }}
+      aws:
+        zoneType: {{ .Values.aws.zoneType | quote }}
+      {{- end }}
+      {{- end }}
+
+      {{- if eq .Values.provider "azure" }}
+      {{- if or .Values.azure.tenantId .Values.azure.subscriptionId .Values.azure.resourceGroup .Values.azure.aadClientId .Values.azure.aadClientSecret }}
+      azure:
+        tenantId: {{ .Values.azure.tenantId | quote }}
+        subscriptionId: {{ .Values.azure.subscriptionId | quote }}
+        resourceGroup: {{ .Values.azure.resourceGroup | quote }}
+        aadClientId: {{ .Values.azure.aadClientId | quote }}
+        aadClientSecret: {{ .Values.azure.aadClientSecret | quote }}
+      {{- end }}
+      {{- end }}
+
+      {{- if eq .Values.provider "digitalocean" }}
+      {{- if .Values.digitalocean.token }}
+      env:
+        - name: DO_TOKEN
+          value: {{ .Values.digitalocean.token | quote }}
+      {{- end }}
+      {{- end }}
+
+      {{- if eq .Values.provider "google" }}
+      {{- if or .Values.google.project .Values.google.serviceAccountKey }}
+      google:
+        project: {{ .Values.google.project | quote }}
+        {{- if .Values.google.serviceAccountKey }}
+        serviceAccountKey: {{ .Values.google.serviceAccountKey | quote }}
+        {{- end }}
+      {{- end }}
+      {{- end }}
+
+      {{- if eq .Values.provider "linode" }}
+      {{- if .Values.linode.token }}
+      env:
+        - name: LINODE_TOKEN
+          value: {{ .Values.linode.token | quote }}
+      {{- end }}
+      {{- end }}
+
+      {{- if eq .Values.provider "ovh" }}
+      {{- if or .Values.ovh.endpoint .Values.ovh.applicationKey .Values.ovh.applicationSecret .Values.ovh.consumerKey }}
+      env:
+        - name: OVH_ENDPOINT
+          value: {{ .Values.ovh.endpoint | quote }}
+        - name: OVH_APPLICATION_KEY
+          value: {{ .Values.ovh.applicationKey | quote }}
+        - name: OVH_APPLICATION_SECRET
+          value: {{ .Values.ovh.applicationSecret | quote }}
+        - name: OVH_CONSUMER_KEY
+          value: {{ .Values.ovh.consumerKey | quote }}
+      {{- end }}
+      {{- end }}
+
+      {{- if eq .Values.provider "exoscale" }}
+      {{- if or .Values.exoscale.apiKey .Values.exoscale.apiSecret }}
+      env:
+        - name: EXOSCALE_API_KEY
+          value: {{ .Values.exoscale.apiKey | quote }}
+        - name: EXOSCALE_API_SECRET
+          value: {{ .Values.exoscale.apiSecret | quote }}
+      {{- end }}
+      {{- end }}
+
+      {{- /* extraArgs: merge user-supplied args with provider-specific args (godaddy) */}}
+      {{- $godaddyArgs := list }}
+      {{- if eq .Values.provider "godaddy" }}
+        {{- if .Values.godaddy.apiKey }}
+          {{- $godaddyArgs = append $godaddyArgs (printf "--godaddy-api-key=%s" .Values.godaddy.apiKey) }}
+        {{- end }}
+        {{- if .Values.godaddy.apiSecret }}
+          {{- $godaddyArgs = append $godaddyArgs (printf "--godaddy-api-secret=%s" .Values.godaddy.apiSecret) }}
+        {{- end }}
+      {{- end }}
+      {{- $allArgs := concat (.Values.extraArgs | default list) $godaddyArgs }}
+      {{- with $allArgs }}
+      extraArgs:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+
+      {{- with (include "cozy-lib.resources.defaultingSanitize" (list .Values.resourcesPreset .Values.resources $)) }}
+      resources:
+        {{- . | nindent 8 }}
+      {{- end }}
diff --git a/packages/extra/external-dns/values.schema.json b/packages/extra/external-dns/values.schema.json
new file mode 100644
index 00000000..0ba69c9d
--- /dev/null
+++ b/packages/extra/external-dns/values.schema.json
@@ -0,0 +1,193 @@
+{
+  "title": "Chart Values",
+  "type": "object",
+  "properties": {
+    "annotationPrefix": {
+      "description": "Custom annotation prefix for external-dns (useful for running multiple instances).",
+      "type": "string",
+      "default": ""
+    },
+    "aws": {
+      "description": "AWS Route53 provider credentials.",
+      "type": "object",
+      "default": {
+        "accessKeyId": "",
+        "region": "",
+        "secretAccessKey": "",
+        "zoneType": ""
+      },
+      "x-kubernetes-preserve-unknown-fields": true
+    },
+    "azure": {
+      "description": "Azure DNS provider credentials.",
+      "type": "object",
+      "default": {
+        "aadClientId": "",
+        "aadClientSecret": "",
+        "resourceGroup": "",
+        "subscriptionId": "",
+        "tenantId": ""
+      },
+      "x-kubernetes-preserve-unknown-fields": true
+    },
+    "cloudflare": {
+      "description": "Cloudflare provider credentials.",
+      "type": "object",
+      "default": {
+        "apiEmail": "",
+        "apiKey": "",
+        "apiToken": "",
+        "proxied": false
+      },
+      "x-kubernetes-preserve-unknown-fields": true
+    },
+    "digitalocean": {
+      "description": "DigitalOcean DNS provider credentials.",
+      "type": "object",
+      "default": {
+        "token": ""
+      },
+      "x-kubernetes-preserve-unknown-fields": true
+    },
+    "domainFilters": {
+      "description": "List of domains this external-dns instance can manage.",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "string"
+      }
+    },
+    "exoscale": {
+      "description": "Exoscale DNS provider credentials.",
+      "type": "object",
+      "default": {
+        "apiKey": "",
+        "apiSecret": ""
+      },
+      "x-kubernetes-preserve-unknown-fields": true
+    },
+    "extraArgs": {
+      "description": "Extra arguments for external-dns.",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "string"
+      }
+    },
+    "gatewayAPI": {
+      "description": "Enable Gateway API HTTPRoute as a source for DNS records.",
+      "type": "boolean",
+      "default": false
+    },
+    "godaddy": {
+      "description": "GoDaddy DNS provider credentials.",
+      "type": "object",
+      "default": {
+        "apiKey": "",
+        "apiSecret": ""
+      },
+      "x-kubernetes-preserve-unknown-fields": true
+    },
+    "google": {
+      "description": "Google Cloud DNS provider credentials.",
+      "type": "object",
+      "default": {
+        "project": "",
+        "serviceAccountKey": ""
+      },
+      "x-kubernetes-preserve-unknown-fields": true
+    },
+    "linode": {
+      "description": "Linode DNS provider credentials.",
+      "type": "object",
+      "default": {
+        "token": ""
+      },
+      "x-kubernetes-preserve-unknown-fields": true
+    },
+    "ovh": {
+      "description": "OVH DNS provider credentials.",
+      "type": "object",
+      "default": {
+        "applicationKey": "",
+        "applicationSecret": "",
+        "consumerKey": "",
+        "endpoint": ""
+      },
+      "x-kubernetes-preserve-unknown-fields": true
+    },
+    "policy": {
+      "description": "How DNS records are synchronized.",
+      "type": "string",
+      "default": "upsert-only",
+      "enum": [
+        "create-only",
+        "sync",
+        "upsert-only"
+      ]
+    },
+    "provider": {
+      "description": "DNS provider name.",
+      "type": "string",
+      "enum": [
+        "cloudflare",
+        "aws",
+        "azure",
+        "google",
+        "digitalocean",
+        "linode",
+        "ovh",
+        "exoscale",
+        "godaddy",
+        "inmemory"
+      ]
+    },
+    "resources": {
+      "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
+      "type": "object",
+      "default": {},
+      "properties": {
+        "cpu": {
+          "description": "CPU available to each replica.",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        },
+        "memory": {
+          "description": "Memory (RAM) available to each replica.",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        }
+      }
+    },
+    "resourcesPreset": {
+      "description": "Default sizing preset used when `resources` is omitted.",
+      "type": "string",
+      "default": "nano",
+      "enum": [
+        "nano",
+        "micro",
+        "small",
+        "medium",
+        "large",
+        "xlarge",
+        "2xlarge"
+      ]
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/extra/external-dns/values.yaml b/packages/extra/external-dns/values.yaml
new file mode 100644
index 00000000..c40d2dff
--- /dev/null
+++ b/packages/extra/external-dns/values.yaml
@@ -0,0 +1,149 @@
+##
+## @section Common parameters
+##
+
+## @enum {string} Provider - DNS provider.
+## @value cloudflare
+## @value aws
+## @value azure
+## @value google
+## @value digitalocean
+## @value linode
+## @value ovh
+## @value exoscale
+## @value godaddy
+## @value inmemory
+
+## @param {Provider} provider - DNS provider name.
+# provider:
+
+## @param {[]string} domainFilters - List of domains this external-dns instance can manage.
+domainFilters: []
+
+## @enum {string} Policy - How DNS records are synchronized.
+## @value create-only
+## @value sync
+## @value upsert-only
+
+## @param {Policy} policy="upsert-only" - How DNS records are synchronized.
+policy: "upsert-only"
+
+## @param {[]string} extraArgs - Extra arguments for external-dns.
+extraArgs: []
+
+## @param {bool} gatewayAPI=false - Enable Gateway API HTTPRoute as a source for DNS records.
+gatewayAPI: false
+
+## @param {string} [annotationPrefix] - Custom annotation prefix for external-dns (useful for running multiple instances).
+annotationPrefix: ""
+
+##
+## @section Cloudflare
+##
+
+## @param {object} cloudflare - Cloudflare provider credentials.
+cloudflare:
+  apiToken: ""
+  apiKey: ""
+  apiEmail: ""
+  proxied: false
+
+##
+## @section AWS
+##
+
+## @param {object} aws - AWS Route53 provider credentials.
+aws:
+  accessKeyId: ""
+  secretAccessKey: ""
+  region: ""
+  zoneType: ""
+
+##
+## @section Azure
+##
+
+## @param {object} azure - Azure DNS provider credentials.
+azure:
+  tenantId: ""
+  subscriptionId: ""
+  resourceGroup: ""
+  aadClientId: ""
+  aadClientSecret: ""
+
+##
+## @section Google
+##
+
+## @param {object} google - Google Cloud DNS provider credentials.
+google:
+  project: ""
+  serviceAccountKey: ""
+
+##
+## @section DigitalOcean
+##
+
+## @param {object} digitalocean - DigitalOcean DNS provider credentials.
+digitalocean:
+  token: ""
+
+##
+## @section Linode
+##
+
+## @param {object} linode - Linode DNS provider credentials.
+linode:
+  token: ""
+
+##
+## @section OVH
+##
+
+## @param {object} ovh - OVH DNS provider credentials.
+ovh:
+  endpoint: ""
+  applicationKey: ""
+  applicationSecret: ""
+  consumerKey: ""
+
+##
+## @section Exoscale
+##
+
+## @param {object} exoscale - Exoscale DNS provider credentials.
+exoscale:
+  apiKey: ""
+  apiSecret: ""
+
+##
+## @section GoDaddy
+##
+
+## @param {object} godaddy - GoDaddy DNS provider credentials.
+godaddy:
+  apiKey: ""
+  apiSecret: ""
+
+##
+## @section Resources
+##
+
+## @typedef {struct} Resources - Explicit CPU and memory configuration.
+## @field {quantity} [cpu] - CPU available to each replica.
+## @field {quantity} [memory] - Memory (RAM) available to each replica.
+
+## @enum {string} ResourcesPreset - Default sizing preset.
+## @value nano
+## @value micro
+## @value small
+## @value medium
+## @value large
+## @value xlarge
+## @value 2xlarge
+
+## @param {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+resources: {}
+
+## @param {ResourcesPreset} resourcesPreset="nano" - Default sizing preset used when `resources` is omitted.
+resourcesPreset: "nano"
diff --git a/packages/system/external-dns-rd/Chart.yaml b/packages/system/external-dns-rd/Chart.yaml
new file mode 100644
index 00000000..b9575cd8
--- /dev/null
+++ b/packages/system/external-dns-rd/Chart.yaml
@@ -0,0 +1,3 @@
+apiVersion: v2
+name: external-dns-rd
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
diff --git a/packages/system/external-dns-rd/Makefile b/packages/system/external-dns-rd/Makefile
new file mode 100644
index 00000000..4abb36a6
--- /dev/null
+++ b/packages/system/external-dns-rd/Makefile
@@ -0,0 +1,4 @@
+export NAME=external-dns-rd
+export NAMESPACE=cozy-system
+
+include ../../../hack/package.mk
diff --git a/packages/system/external-dns-rd/cozyrds/external-dns.yaml b/packages/system/external-dns-rd/cozyrds/external-dns.yaml
new file mode 100644
index 00000000..8792ca88
--- /dev/null
+++ b/packages/system/external-dns-rd/cozyrds/external-dns.yaml
@@ -0,0 +1,24 @@
+apiVersion: cozystack.io/v1alpha1
+kind: ApplicationDefinition
+metadata:
+  name: external-dns
+spec:
+  application:
+    kind: ExternalDNS
+    plural: externaldns
+    singular: externaldns
+    openAPISchema: |-
+      {"title":"Chart Values","type":"object","properties":{"annotationPrefix":{"description":"Custom annotation prefix for external-dns (useful for running multiple instances).","type":"string","default":""},"aws":{"description":"AWS Route53 provider credentials.","type":"object","default":{"accessKeyId":"","region":"","secretAccessKey":"","zoneType":""},"x-kubernetes-preserve-unknown-fields":true},"azure":{"description":"Azure DNS provider credentials.","type":"object","default":{"aadClientId":"","aadClientSecret":"","resourceGroup":"","subscriptionId":"","tenantId":""},"x-kubernetes-preserve-unknown-fields":true},"cloudflare":{"description":"Cloudflare provider credentials.","type":"object","default":{"apiEmail":"","apiKey":"","apiToken":"","proxied":false},"x-kubernetes-preserve-unknown-fields":true},"digitalocean":{"description":"DigitalOcean DNS provider credentials.","type":"object","default":{"token":""},"x-kubernetes-preserve-unknown-fields":true},"domainFilters":{"description":"List of domains this external-dns instance can manage.","type":"array","default":[],"items":{"type":"string"}},"exoscale":{"description":"Exoscale DNS provider credentials.","type":"object","default":{"apiKey":"","apiSecret":""},"x-kubernetes-preserve-unknown-fields":true},"extraArgs":{"description":"Extra arguments for external-dns.","type":"array","default":[],"items":{"type":"string"}},"gatewayAPI":{"description":"Enable Gateway API HTTPRoute as a source for DNS records.","type":"boolean","default":false},"godaddy":{"description":"GoDaddy DNS provider credentials.","type":"object","default":{"apiKey":"","apiSecret":""},"x-kubernetes-preserve-unknown-fields":true},"google":{"description":"Google Cloud DNS provider credentials.","type":"object","default":{"project":"","serviceAccountKey":""},"x-kubernetes-preserve-unknown-fields":true},"linode":{"description":"Linode DNS provider credentials.","type":"object","default":{"token":""},"x-kubernetes-preserve-unknown-fields":true},"ovh":{"description":"OVH DNS provider credentials.","type":"object","default":{"applicationKey":"","applicationSecret":"","consumerKey":"","endpoint":""},"x-kubernetes-preserve-unknown-fields":true},"policy":{"description":"How DNS records are synchronized.","type":"string","default":"upsert-only","enum":["create-only","sync","upsert-only"]},"provider":{"description":"DNS provider name.","type":"string","enum":["cloudflare","aws","azure","google","digitalocean","linode","ovh","exoscale","godaddy","inmemory"]},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}
+  release:
+    prefix: ""
+    chartRef:
+      kind: ExternalArtifact
+      name: cozystack-external-dns-application-default-external-dns
+      namespace: cozy-system
+  dashboard:
+    category: Networking
+    singular: External DNS
+    plural: External DNS
+    description: External DNS for automatic DNS record management
+    icon: PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAxNDQgMTQ0IiB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCI+CiAgPGRlZnM+CiAgICA8bGluZWFyR3JhZGllbnQgaWQ9ImJnIiB4MT0iMCUiIHkxPSIwJSIgeDI9IjEwMCUiIHkyPSIxMDAlIj4KICAgICAgPHN0b3Agb2Zmc2V0PSIwJSIgc3R5bGU9InN0b3AtY29sb3I6IzNCODJGNiIvPgogICAgICA8c3RvcCBvZmZzZXQ9IjEwMCUiIHN0eWxlPSJzdG9wLWNvbG9yOiMxRDRFRDgiLz4KICAgIDwvbGluZWFyR3JhZGllbnQ+CiAgPC9kZWZzPgogIDxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjgiIGZpbGw9InVybCgjYmcpIi8+CiAgPGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoNzIsNzIpIiBmaWxsPSJub25lIiBzdHJva2U9IiNmZmYiIHN0cm9rZS13aWR0aD0iNCIgc3Ryb2tlLWxpbmVjYXA9InJvdW5kIiBzdHJva2UtbGluZWpvaW49InJvdW5kIj4KICAgIDwhLS0gR2xvYmUgLS0+CiAgICA8Y2lyY2xlIGN4PSIwIiBjeT0iLTQiIHI9IjMyIi8+CiAgICA8ZWxsaXBzZSBjeD0iMCIgY3k9Ii00IiByeD0iMTQiIHJ5PSIzMiIvPgogICAgPGxpbmUgeDE9Ii0zMiIgeTE9Ii00IiB4Mj0iMzIiIHkyPSItNCIvPgogICAgPHBhdGggZD0iTS0yOCwxMiBRMCwxOCAyOCwxMiIvPgogICAgPHBhdGggZD0iTS0yOCwtMjAgUTAsLTE0IDI4LC0yMCIvPgogICAgPCEtLSBBcnJvdyBwb2ludGluZyBvdXQgLS0+CiAgICA8bGluZSB4MT0iMTgiIHkxPSIxOCIgeDI9IjM2IiB5Mj0iMzYiLz4KICAgIDxwb2x5bGluZSBwb2ludHM9IjI4LDM2IDM2LDM2IDM2LDI4Ii8+CiAgPC9nPgo8L3N2Zz4K
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "domainFilters"], ["spec", "policy"], ["spec", "extraArgs"], ["spec", "gatewayAPI"], ["spec", "annotationPrefix"], ["spec", "cloudflare"], ["spec", "cloudflare", "apiToken"], ["spec", "cloudflare", "apiKey"], ["spec", "cloudflare", "apiEmail"], ["spec", "cloudflare", "proxied"], ["spec", "aws"], ["spec", "aws", "accessKeyId"], ["spec", "aws", "secretAccessKey"], ["spec", "aws", "region"], ["spec", "aws", "zoneType"], ["spec", "azure"], ["spec", "azure", "tenantId"], ["spec", "azure", "subscriptionId"], ["spec", "azure", "resourceGroup"], ["spec", "azure", "aadClientId"], ["spec", "azure", "aadClientSecret"], ["spec", "google"], ["spec", "google", "project"], ["spec", "google", "serviceAccountKey"], ["spec", "digitalocean"], ["spec", "digitalocean", "token"], ["spec", "linode"], ["spec", "linode", "token"], ["spec", "ovh"], ["spec", "ovh", "endpoint"], ["spec", "ovh", "applicationKey"], ["spec", "ovh", "applicationSecret"], ["spec", "ovh", "consumerKey"], ["spec", "exoscale"], ["spec", "exoscale", "apiKey"], ["spec", "exoscale", "apiSecret"], ["spec", "godaddy"], ["spec", "godaddy", "apiKey"], ["spec", "godaddy", "apiSecret"], ["spec", "resources"], ["spec", "resourcesPreset"]]
diff --git a/packages/system/external-dns-rd/templates/cozyrd.yaml b/packages/system/external-dns-rd/templates/cozyrd.yaml
new file mode 100644
index 00000000..e079ddcf
--- /dev/null
+++ b/packages/system/external-dns-rd/templates/cozyrd.yaml
@@ -0,0 +1,4 @@
+{{- range $path, $_ := .Files.Glob "cozyrds/*" }}
+---
+{{ $.Files.Get $path }}
+{{- end }}
diff --git a/packages/system/external-dns-rd/values.yaml b/packages/system/external-dns-rd/values.yaml
new file mode 100644
index 00000000..0967ef42
--- /dev/null
+++ b/packages/system/external-dns-rd/values.yaml
@@ -0,0 +1 @@
+{}
diff --git a/packages/system/external-dns/charts/external-dns/.helmignore b/packages/system/external-dns/charts/external-dns/.helmignore
index 0e8a0eb3..e951b6fb 100644
--- a/packages/system/external-dns/charts/external-dns/.helmignore
+++ b/packages/system/external-dns/charts/external-dns/.helmignore
@@ -21,3 +21,7 @@
 .idea/
 *.tmproj
 .vscode/
+ci/
+schema/
+.schema.yaml
+tests/
diff --git a/packages/system/external-dns/charts/external-dns/CHANGELOG.md b/packages/system/external-dns/charts/external-dns/CHANGELOG.md
index 02b467e1..6b2401c2 100644
--- a/packages/system/external-dns/charts/external-dns/CHANGELOG.md
+++ b/packages/system/external-dns/charts/external-dns/CHANGELOG.md
@@ -18,11 +18,117 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [UNRELEASED]
 
-## [v1.15.0] - 2023-09-10
+## [v1.20.0]
+
+### Added
+
+- Add option to set `annotationPrefix` ([#5889](https://github.com/kubernetes-sigs/external-dns/pull/5889)) _@lexfrei_
 
 ### Changed
 
-- Updated _ExternalDNS_ OCI image version to [v0.15.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.15.0). ([#xxxx](https://github.com/kubernetes-sigs/external-dns/pull/xxxx)) _@stevehipwell_
+- Grant `networking.k8s.io/ingresses` and `gateway.solo.io/gateways` permissions when using `gloo-proxy` source. ([#5909](https://github.com/kubernetes-sigs/external-dns/pull/5909)) _@cucxabong_
+- Update _ExternalDNS_ OCI image version to [v0.20.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.20.0). ([#6005](https://github.com/kubernetes-sigs/external-dns/pull/6005)) _@vflaux_
+
+### Fixed
+
+- Fixed the missing schema for `.provider.webhook.serviceMonitor` configs ([#5932](https://github.com/kubernetes-sigs/external-dns/pull/5932)) _@chrisbsmith_
+- Fixed incorrect indentation of selector labels under `spec.template.spec.topologySpreadConstraints` when `topologySpreadConstraints` is set. ([#6054](https://github.com/kubernetes-sigs/external-dns/pull/6054)) _@andylim0221_
+
+## [v1.19.0] - 2025-09-08
+
+### Added
+
+- Add option to configure `annotationFilter` via dedicated chart value. ([#5737](https://github.com/kubernetes-sigs/external-dns/pull/5737)) _@dshatokhin_
+
+### Changed
+
+- Grant `discovery.k8s.io/endpointslices` permission only when using `service` source. ([#5746](https://github.com/kubernetes-sigs/external-dns/pull/5746)) _@vflaux_
+- Update _ExternalDNS_ OCI image version to [v0.19.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.19.0). ([#5819](https://github.com/kubernetes-sigs/external-dns/pull/5819)) _@stevehipwell_
+
+## [v1.18.0] - 2025-07-14
+
+### Changed
+
+- Update RBAC for `Service` source to support `EndpointSlices`. ([#5493](https://github.com/kubernetes-sigs/external-dns/pull/5493)) _@vflaux_
+- Update _ExternalDNS_ OCI image version to [v0.18.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.18.0). ([#5633](https://github.com/kubernetes-sigs/external-dns/pull/5633)) _@elafarge_
+
+### Fixed
+
+- Fixed the lack of schema support for `create-only` dns policy in helm values ([#5627](https://github.com/kubernetes-sigs/external-dns/pull/5627)) _@coltonhughes_
+- Fixed the type of `.extraContainers` from `object` to `list` (array). ([#5564](https://github.com/kubernetes-sigs/external-dns/pull/5564)) _@svengreb_
+
+## [v1.17.0] - 2025-06-04
+
+### Changed
+
+- Allow extraArgs to also be a map enabling overrides of individual values. ([#5293](https://github.com/kubernetes-sigs/external-dns/pull/5293)) _@frittentheke_
+- Update CRD. ([#5287](https://github.com/kubernetes-sigs/external-dns/pull/5287)) _@mloiseleur_
+- Update CRD. ([#5446](https://github.com/kubernetes-sigs/external-dns/pull/5446)) _@mloiseleur_
+- Update _ExternalDNS_ OCI image version to [v0.17.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.17.0). ([#5479](https://github.com/kubernetes-sigs/external-dns/pull/5479)) _@stevehipwell_
+
+### Fixed
+
+- Fix wrong type definitions for webhook probes. ([#5297](https://github.com/kubernetes-sigs/external-dns/pull/5297)) _@semnell_
+- Update schema with latest plugin release. ([#5510](https://github.com/kubernetes-sigs/external-dns/pull/5510)) _@mloiseleur
+
+## [v1.16.1] - 2025-04-10
+
+### Changed
+
+- Set defaults for `automountServiceAccountToken` and `serviceAccount.automountServiceAccountToken` to `true` in Helm chart values. ([#5207](https://github.com/kubernetes-sigs/external-dns/pull/5207)) _@t3mi_
+
+### Fixed
+
+- Correctly handle `txtPrefix` and `txtSuffix` arguments when both are provided. ([#5250](https://github.com/kubernetes-sigs/external-dns/pull/5250)) _@ivankatliarchuk_
+- Add missing types in the schema for empty values. ([#5228](https://github.com/kubernetes-sigs/external-dns/pull/5228)) _@ivankatliarchuk_
+- Add missing types in the schema for empty values. ([#5207](https://github.com/kubernetes-sigs/external-dns/pull/5207)) _@t3mi_
+
+## [v1.16.0] - 2025-03-20
+
+### Added
+
+- Add helm testing framework `helm plugin unittest`. ([#5137](https://github.com/kubernetes-sigs/external-dns/pull/5137)) _@ivankatliarchuk_
+- Add ability to generate schema with `helm plugin schema`. ([#5075](https://github.com/kubernetes-sigs/external-dns/pull/5075)) _@ivankatliarchuk_
+- Add `docs/contributing/dev-guide.md#helm-values` guide. ([#5075](https://github.com/kubernetes-sigs/external-dns/pull/5075)) _@ivankatliarchuk_
+
+### Changed
+
+- Regenerate JSON schema with `helm-values-schema-json' plugin. ([#5075](https://github.com/kubernetes-sigs/external-dns/pull/5075)) _@ivankatliarchuk_
+- Update _ExternalDNS_ OCI image version to [v0.16.1](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.16.1). ([#5201](https://github.com/kubernetes-sigs/external-dns/pull/5201)) _@stevehipwell_
+
+## [v1.15.2] - 2025-02-14
+
+### Changed
+
+- Added `transportservers` resource to ClusterRole when specifying `f5-transportserver` or `f5-virtualserver` as a source. ([#5066](https://github.com/kubernetes-sigs/external-dns/pull/5066)) _@visokoo_
+
+### Fixed
+
+- Fixed handling of non-string types in `serviceAccount.metadata.annotations` field. ([#5067](https://github.com/kubernetes-sigs/external-dns/pull/5067)) _@hjoshi123_
+- Fixed regression where `affinity.nodeAffinity` was being ignored. ([#5046](https://github.com/kubernetes-sigs/external-dns/pull/5046)) _@mkhpalm_
+
+## [v1.15.1] - 2025-01-27
+
+### Added
+
+- Added ability to configure `imagePullSecrets` via helm `global` value. ([#4667](https://github.com/kubernetes-sigs/external-dns/pull/4667)) _@jkroepke_
+- Added options to configure `labelFilter` and `managedRecordTypes` via dedicated helm values. ([#4849](https://github.com/kubernetes-sigs/external-dns/pull/4849)) _@abaguas_
+
+### Changed
+
+- Allow templating `serviceaccount.annotations` keys and values, by rendering them using the `tpl` built-in function. ([#4958](https://github.com/kubernetes-sigs/external-dns/pull/4958)) _@fcrespofastly_
+- Updated _ExternalDNS_ OCI image version to [v0.15.1](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.15.1). ([#5028](https://github.com/kubernetes-sigs/external-dns/pull/5028)) _@stevehipwell_
+
+### Fixed
+
+- Fixed automatic addition of pod selector labels to `affinity` and `topologySpreadConstraints` if not defined. ([#4666](https://github.com/kubernetes-sigs/external-dns/pull/4666)) _@pvickery-ParamountCommerce_
+- Fixed missing Ingress permissions when using Istio sources. ([#4845](https://github.com/kubernetes-sigs/external-dns/pull/4845)) _@joekhoobyar_
+
+## [v1.15.0] - 2024-09-11
+
+### Changed
+
+- Updated _ExternalDNS_ OCI image version to [v0.15.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.15.0). ([#4735](https://github.com/kubernetes-sigs/external-dns/pull/4735)) _@stevehipwell_
 
 ### Fixed
 
@@ -31,7 +137,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Fixed to add correct webhook metric port to `Service` and `ServiceMonitor`. ([#4643](https://github.com/kubernetes-sigs/external-dns/pull/4643)) _@kimsondrup_
 - Fixed to no longer require the unauthenticated webhook provider port to be exposed for health probes. ([#4691](https://github.com/kubernetes-sigs/external-dns/pull/4691)) _@kimsondrup_ & _@hatrx_
 
-## [v1.14.5] - 2023-06-10
+## [v1.14.5] - 2024-06-10
 
 ### Added
 
@@ -48,7 +154,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Fixed the `ServiceMonitor` job name to correctly use the instance label. ([#4541](https://github.com/kubernetes-sigs/external-dns/pull/4541)) _@stevehipwell_
 
-## [v1.14.4] - 2023-04-03
+## [v1.14.4] - 2024-04-05
 
 ### Added
 
@@ -59,7 +165,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Updated _ExternalDNS_ OCI image version to [v0.14.1](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.14.1). ([#4357](https://github.com/kubernetes-sigs/external-dns/pull/4357)) _@stevehipwell_
 
-## [v1.14.3] - 2023-01-26
+## [v1.14.3] - 2024-01-26
 
 ### Fixed
 
@@ -73,7 +179,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Restore template support in `.Values.provider` and `.Values.provider.name`
 
-## [v1.14.1] - 2024-01-11
+## [v1.14.1] - 2024-01-12
 
 ### Fixed
 
@@ -97,7 +203,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - The `secretConfiguration` value has been deprecated in favour of creating secrets external to the Helm chart and configuring their use via the `extraVolumes` & `extraVolumeMounts` values. ([#4161](https://github.com/kubernetes-sigs/external-dns/pull/4161)) [@stevehipwell](https://github.com/stevehipwell)
 
-## [v1.13.1] - 2023-09-07
+## [v1.13.1] - 2023-09-08
 
 ### Added
 
@@ -200,6 +306,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 RELEASE LINKS
 -->
 [UNRELEASED]: https://github.com/kubernetes-sigs/external-dns/tree/master/charts/external-dns
+[v1.20.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.20.0
+[v1.19.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.19.0
+[v1.18.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.18.0
+[v1.17.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.17.0
+[v1.16.1]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.16.1
+[v1.16.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.16.0
+[v1.15.2]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.15.2
+[v1.15.1]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.15.1
 [v1.15.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.15.0
 [v1.14.5]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.14.5
 [v1.14.4]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.14.4
diff --git a/packages/system/external-dns/charts/external-dns/Chart.yaml b/packages/system/external-dns/charts/external-dns/Chart.yaml
index c7245bd1..a03ace4e 100644
--- a/packages/system/external-dns/charts/external-dns/Chart.yaml
+++ b/packages/system/external-dns/charts/external-dns/Chart.yaml
@@ -1,28 +1,30 @@
 annotations:
-  artifacthub.io/changes: |
+  artifacthub.io/changes: |-
+    - kind: added
+      description: "Add option to set annotationPrefix (#5889) @lexfrei."
     - kind: changed
-      description: "Updated _ExternalDNS_ OCI image version to [v0.15.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.15.0)."
+      description: "Grant networking.k8s.io/ingresses and gateway.solo.io/gateways permissions when using gloo-proxy source."
+    - kind: changed
+      description: "Update ExternalDNS OCI image version to v0.20.0."
     - kind: fixed
-      description: "Fixed `provider.webhook.resources` behavior to correctly leverage resource limits."
+      description: "Fixed the missing schema for .provider.webhook."
     - kind: fixed
-      description: "Fixed `provider.webhook.imagePullPolicy` behavior to correctly leverage pull policy."
-    - kind: fixed
-      description: "Fixed to add correct webhook metric port to `Service` and `ServiceMonitor`."
-    - kind: fixed
-      description: "Fixed to no longer require the unauthenticated webhook provider port to be exposed for health probes."
+      description: "Fixed incorrect indentation of selector labels under spec.template.spec.topologySpreadConstraints when topologySpreadConstraints is set."
 apiVersion: v2
-appVersion: 0.15.0
+appVersion: 0.20.0
 description: ExternalDNS synchronizes exposed Kubernetes Services and Ingresses with
   DNS providers.
 home: https://github.com/kubernetes-sigs/external-dns/
 icon: https://github.com/kubernetes-sigs/external-dns/raw/master/docs/img/external-dns.png
 keywords:
 - kubernetes
+- k8s
 - externaldns
 - external-dns
 - dns
 - service
 - ingress
+- gateway
 maintainers:
 - email: steve.hipwell@gmail.com
   name: stevehipwell
@@ -30,4 +32,4 @@ name: external-dns
 sources:
 - https://github.com/kubernetes-sigs/external-dns/
 type: application
-version: 1.15.0
+version: 1.20.0
diff --git a/packages/system/external-dns/charts/external-dns/README.md b/packages/system/external-dns/charts/external-dns/README.md
index 9b21ecde..0bbae925 100644
--- a/packages/system/external-dns/charts/external-dns/README.md
+++ b/packages/system/external-dns/charts/external-dns/README.md
@@ -1,6 +1,6 @@
 # external-dns
 
-![Version: 1.15.0](https://img.shields.io/badge/Version-1.15.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.15.0](https://img.shields.io/badge/AppVersion-0.15.0-informational?style=flat-square)
+![Version: 1.20.0](https://img.shields.io/badge/Version-1.20.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.20.0](https://img.shields.io/badge/AppVersion-0.20.0-informational?style=flat-square)
 
 ExternalDNS synchronizes exposed Kubernetes Services and Ingresses with DNS providers.
 
@@ -27,12 +27,15 @@ helm repo add external-dns https://kubernetes-sigs.github.io/external-dns/
 After you've installed the repo you can install the chart.
 
 ```shell
-helm upgrade --install external-dns external-dns/external-dns --version 1.15.0
+helm upgrade --install external-dns external-dns/external-dns --version 1.20.0
 ```
 
 ## Providers
 
-Configuring the _ExternalDNS_ provider should be done via the `provider.name` value with provider specific configuration being set via the `provider.<name>.<key>` values, where supported, and the `extraArgs` value. For legacy support `provider` can be set to the name of the provider with all additional configuration being set via the `extraArgs` value.
+> Legacy support of setting `provider: <name>` is deprecated.
+
+Configuring the _ExternalDNS_ provider should be done via the `provider.name` value with provider specific configuration being set via the `provider.<name>.<key>` values, where supported, and the `extraArgs` value.
+
 See [documentation](https://kubernetes-sigs.github.io/external-dns/#new-providers) for more info on available providers and tutorials.
 
 ### Providers with Specific Configuration Support
@@ -45,13 +48,13 @@ See [documentation](https://kubernetes-sigs.github.io/external-dns/#new-provider
 
 For set up for a specific provider using the Helm chart, see the following links:
 
-- [AWS](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/aws.md#using-helm-with-oidc)
-- [akamai-edgedns](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/akamai-edgedns.md#using-helm)
-- [cloudflare](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/cloudflare.md#using-helm)
-- [digitalocean](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/digitalocean.md#using-helm)
-- [godaddy](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/godaddy.md#using-helm)
-- [ns1](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/ns1.md#using-helm)
-- [plural](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/plural.md#using-helm)
+* [AWS](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/aws.md#using-helm-with-oidc)
+* [akamai-edgedns](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/akamai-edgedns.md#using-helm)
+* [cloudflare](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/cloudflare.md#using-helm)
+* [digitalocean](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/digitalocean.md#using-helm)
+* [godaddy](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/godaddy.md#using-helm)
+* [ns1](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/ns1.md#using-helm)
+* [plural](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/plural.md#using-helm)
 
 ## Namespaced Scoped Installation
 
@@ -91,36 +94,43 @@ If `namespaced` is set to `true`, please ensure that `sources` my only contains
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
 | affinity | object | `{}` | Affinity settings for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). If an explicit label selector is not provided for pod affinity or pod anti-affinity one will be created from the pod selector labels. |
-| automountServiceAccountToken | bool | `nil` | Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `Pod`. |
+| annotationFilter | string | `nil` | Filter resources queried for endpoints by annotation selector. |
+| annotationPrefix | string | `nil` | Annotation prefix for external-dns annotations (useful for split horizon DNS with multiple instances). |
+| automountServiceAccountToken | bool | `true` | Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `Pod`. |
 | commonLabels | object | `{}` | Labels to add to all chart resources. |
 | deploymentAnnotations | object | `{}` | Annotations to add to the `Deployment`. |
 | deploymentStrategy | object | `{"type":"Recreate"}` | [Deployment Strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy). |
 | dnsConfig | object | `nil` | [DNS config](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config) for the pod, if not set the default will be used. |
 | dnsPolicy | string | `nil` | [DNS policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy) for the pod, if not set the default will be used. |
-| domainFilters | list | `[]` |  |
+| domainFilters | list | `[]` | Limit possible target zones by domain suffixes. |
+| enabled | bool | `nil` | No effect - reserved for use in sub-charting. |
 | env | list | `[]` | [Environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) for the `external-dns` container. |
-| excludeDomains | list | `[]` |  |
-| extraArgs | list | `[]` | Extra arguments to provide to _ExternalDNS_. |
-| extraContainers | object | `{}` | Extra containers to add to the `Deployment`. |
+| excludeDomains | list | `[]` | Intentionally exclude domains from being managed. |
+| extraArgs | object | `{}` | Extra arguments to provide to _ExternalDNS_. An array or map can be used, with maps allowing for value overrides; maps also support slice values to use the same arg multiple times. |
+| extraContainers | list | `[]` | Extra containers to add to the `Deployment`. |
 | extraVolumeMounts | list | `[]` | Extra [volume mounts](https://kubernetes.io/docs/concepts/storage/volumes/) for the `external-dns` container. |
 | extraVolumes | list | `[]` | Extra [volumes](https://kubernetes.io/docs/concepts/storage/volumes/) for the `Pod`. |
 | fullnameOverride | string | `nil` | Override the full name of the chart. |
+| gatewayNamespace | string | `nil` | _Gateway API_ gateway namespace to watch. |
+| global.imagePullSecrets | list | `[]` | Global image pull secrets. |
 | image.pullPolicy | string | `"IfNotPresent"` | Image pull policy for the `external-dns` container. |
 | image.repository | string | `"registry.k8s.io/external-dns/external-dns"` | Image repository for the `external-dns` container. |
 | image.tag | string | `nil` | Image tag for the `external-dns` container, this will default to `.Chart.AppVersion` if not set. |
 | imagePullSecrets | list | `[]` | Image pull secrets. |
 | initContainers | list | `[]` | [Init containers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) to add to the `Pod` definition. |
 | interval | string | `"1m"` | Interval for DNS updates. |
+| labelFilter | string | `nil` | Filter resources queried for endpoints by label selector. |
 | livenessProbe | object | See _values.yaml_ | [Liveness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `external-dns` container. |
 | logFormat | string | `"text"` | Log format. |
 | logLevel | string | `"info"` | Log level. |
+| managedRecordTypes | list | `[]` | Record types to manage (default: A, AAAA, CNAME) |
 | nameOverride | string | `nil` | Override the name of the chart. |
 | namespaced | bool | `false` | if `true`, _ExternalDNS_ will run in a namespaced scope (`Role`` and `Rolebinding`` will be namespaced too). |
 | nodeSelector | object | `{}` | Node labels to match for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). |
 | podAnnotations | object | `{}` | Annotations to add to the `Pod`. |
 | podLabels | object | `{}` | Labels to add to the `Pod`. |
 | podSecurityContext | object | See _values.yaml_ | [Pod security context](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#podsecuritycontext-v1-core), this supports full customisation. |
-| policy | string | `"upsert-only"` | How DNS records are synchronized between sources and providers; available values are `sync` & `upsert-only`. |
+| policy | string | `"upsert-only"` | How DNS records are synchronized between sources and providers; available values are `create-only`, `sync`, & `upsert-only`. |
 | priorityClassName | string | `nil` | Priority class name for the `Pod`. |
 | provider.name | string | `"aws"` | _ExternalDNS_ provider name; for the available providers and how to configure them see [README](https://github.com/kubernetes-sigs/external-dns/blob/master/charts/external-dns/README.md#providers). |
 | provider.webhook.args | list | `[]` | Extra arguments to provide for the `webhook` container. |
@@ -147,11 +157,11 @@ If `namespaced` is set to `true`, please ensure that `sources` my only contains
 | secretConfiguration.subPath | string | `nil` | Sub-path for mounting the `Secret`, this can be templated. |
 | securityContext | object | See _values.yaml_ | [Security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) for the `external-dns` container. |
 | service.annotations | object | `{}` | Service annotations. |
-| service.ipFamilies | list | `[]` | Service IP families. |
+| service.ipFamilies | list | `[]` | Service IP families (e.g. IPv4 and/or IPv6). |
 | service.ipFamilyPolicy | string | `nil` | Service IP family policy. |
 | service.port | int | `7979` | Service HTTP port. |
-| serviceAccount.annotations | object | `{}` | Annotations to add to the service account. |
-| serviceAccount.automountServiceAccountToken | string | `nil` | Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `ServiceAccount`. |
+| serviceAccount.annotations | object | `{}` | Annotations to add to the service account. Templates are allowed in both the key and the value. Example: `example.com/annotation/{{ .Values.nameOverride }}: {{ .Values.nameOverride }}` |
+| serviceAccount.automountServiceAccountToken | bool | `true` | Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `ServiceAccount`. |
 | serviceAccount.create | bool | `true` | If `true`, create a new `ServiceAccount`. |
 | serviceAccount.labels | object | `{}` | Labels to add to the service account. |
 | serviceAccount.name | string | `nil` | If this is set and `serviceAccount.create` is `true` this will be used for the created `ServiceAccount` name, if set and `serviceAccount.create` is `false` then this will define an existing `ServiceAccount` to use. |
@@ -173,7 +183,7 @@ If `namespaced` is set to `true`, please ensure that `sources` my only contains
 | tolerations | list | `[]` | Node taints which will be tolerated for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). |
 | topologySpreadConstraints | list | `[]` | Topology spread constraints for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). If an explicit label selector is not provided one will be created from the pod selector labels. |
 | triggerLoopOnEvent | bool | `false` | If `true`, triggers run loop on create/update/delete events in addition of regular interval. |
-| txtOwnerId | string | `nil` | Specify an identifier for this instance of _ExternalDNS_ wWhen using a registry other than `noop`. |
+| txtOwnerId | string | `nil` | Specify an identifier for this instance of _ExternalDNS_ when using a registry other than `noop`. |
 | txtPrefix | string | `nil` | Specify a prefix for the domain names of TXT records created for the `txt` registry. Mutually exclusive with `txtSuffix`. |
 | txtSuffix | string | `nil` | Specify a suffix for the domain names of TXT records created for the `txt` registry. Mutually exclusive with `txtPrefix`. |
 
diff --git a/packages/system/external-dns/charts/external-dns/README.md.gotmpl b/packages/system/external-dns/charts/external-dns/README.md.gotmpl
index e313a2ba..fc4ada14 100644
--- a/packages/system/external-dns/charts/external-dns/README.md.gotmpl
+++ b/packages/system/external-dns/charts/external-dns/README.md.gotmpl
@@ -27,7 +27,10 @@ helm upgrade --install {{ template "chart.name" . }} external-dns/{{ template "c
 
 ## Providers
 
-Configuring the _ExternalDNS_ provider should be done via the `provider.name` value with provider specific configuration being set via the `provider.<name>.<key>` values, where supported, and the `extraArgs` value. For legacy support `provider` can be set to the name of the provider with all additional configuration being set via the `extraArgs` value.
+> Legacy support of setting `provider: <name>` is deprecated.
+
+Configuring the _ExternalDNS_ provider should be done via the `provider.name` value with provider specific configuration being set via the `provider.<name>.<key>` values, where supported, and the `extraArgs` value.
+
 See [documentation](https://kubernetes-sigs.github.io/external-dns/#new-providers) for more info on available providers and tutorials.
 
 ### Providers with Specific Configuration Support
@@ -40,13 +43,13 @@ See [documentation](https://kubernetes-sigs.github.io/external-dns/#new-provider
 
 For set up for a specific provider using the Helm chart, see the following links:
 
-- [AWS](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/aws.md#using-helm-with-oidc)
-- [akamai-edgedns](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/akamai-edgedns.md#using-helm)
-- [cloudflare](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/cloudflare.md#using-helm)
-- [digitalocean](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/digitalocean.md#using-helm)
-- [godaddy](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/godaddy.md#using-helm)
-- [ns1](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/ns1.md#using-helm)
-- [plural](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/plural.md#using-helm)
+* [AWS](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/aws.md#using-helm-with-oidc)
+* [akamai-edgedns](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/akamai-edgedns.md#using-helm)
+* [cloudflare](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/cloudflare.md#using-helm)
+* [digitalocean](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/digitalocean.md#using-helm)
+* [godaddy](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/godaddy.md#using-helm)
+* [ns1](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/ns1.md#using-helm)
+* [plural](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/plural.md#using-helm)
 
 ## Namespaced Scoped Installation
 
diff --git a/packages/system/external-dns/charts/external-dns/RELEASE.md b/packages/system/external-dns/charts/external-dns/RELEASE.md
index 02634a30..956cb0b5 100644
--- a/packages/system/external-dns/charts/external-dns/RELEASE.md
+++ b/packages/system/external-dns/charts/external-dns/RELEASE.md
@@ -1,10 +1,13 @@
+### Added
+
+- Add option to set `annotationPrefix` ([#5889](https://github.com/kubernetes-sigs/external-dns/pull/5889)) _@lexfrei_
+
 ### Changed
 
-- Updated _ExternalDNS_ OCI image version to [v0.15.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.15.0). ([#xxxx](https://github.com/kubernetes-sigs/external-dns/pull/xxxx)) _@stevehipwell_
+- Grant `networking.k8s.io/ingresses` and `gateway.solo.io/gateways` permissions when using `gloo-proxy` source. ([#5909](https://github.com/kubernetes-sigs/external-dns/pull/5909)) _@cucxabong_
+- Update _ExternalDNS_ OCI image version to [v0.20.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.20.0). ([#6005](https://github.com/kubernetes-sigs/external-dns/pull/6005)) _@vflaux_
 
 ### Fixed
 
-- Fixed `provider.webhook.resources` behavior to correctly leverage resource limits. ([#4560](https://github.com/kubernetes-sigs/external-dns/pull/4560)) _@crutonjohn_
-- Fixed `provider.webhook.imagePullPolicy` behavior to correctly leverage pull policy. ([#4643](https://github.com/kubernetes-sigs/external-dns/pull/4643)) _@kimsondrup_
-- Fixed to add correct webhook metric port to `Service` and `ServiceMonitor`. ([#4643](https://github.com/kubernetes-sigs/external-dns/pull/4643)) _@kimsondrup_
-- Fixed to no longer require the unauthenticated webhook provider port to be exposed for health probes. ([#4691](https://github.com/kubernetes-sigs/external-dns/pull/4691)) _@kimsondrup_ & _@hatrx_
+- Fixed the missing schema for `.provider.webhook.serviceMonitor` configs ([#5932](https://github.com/kubernetes-sigs/external-dns/pull/5932)) _@chrisbsmith_
+- Fixed incorrect indentation of selector labels under `spec.template.spec.topologySpreadConstraints` when `topologySpreadConstraints` is set. ([#6054](https://github.com/kubernetes-sigs/external-dns/pull/6054)) _@andylim0221_
diff --git a/packages/system/external-dns/charts/external-dns/ci/ci-values.yaml b/packages/system/external-dns/charts/external-dns/ci/ci-values.yaml
deleted file mode 100644
index 4d278e94..00000000
--- a/packages/system/external-dns/charts/external-dns/ci/ci-values.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-provider:
-  name: inmemory
diff --git a/packages/system/external-dns/charts/external-dns/crds/dnsendpoint.yaml b/packages/system/external-dns/charts/external-dns/crds/dnsendpoints.externaldns.k8s.io.yaml
similarity index 82%
rename from packages/system/external-dns/charts/external-dns/crds/dnsendpoint.yaml
rename to packages/system/external-dns/charts/external-dns/crds/dnsendpoints.externaldns.k8s.io.yaml
index 822cd850..c983c8d7 100644
--- a/packages/system/external-dns/charts/external-dns/crds/dnsendpoint.yaml
+++ b/packages/system/external-dns/charts/external-dns/crds/dnsendpoints.externaldns.k8s.io.yaml
@@ -1,9 +1,9 @@
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
-  name: dnsendpoints.externaldns.k8s.io
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/external-dns/pull/2007
+  name: dnsendpoints.externaldns.k8s.io
 spec:
   group: externaldns.k8s.io
   names:
@@ -16,6 +16,9 @@ spec:
     - name: v1alpha1
       schema:
         openAPIV3Schema:
+          description: |-
+            DNSEndpoint is a contract that a user-specified CRD must implement to be used as a source for external-dns.
+            The user-specified CRD should also have the status sub-resource.
           properties:
             apiVersion:
               description: |-
@@ -39,9 +42,7 @@ spec:
               properties:
                 endpoints:
                   items:
-                    description:
-                      Endpoint is a high-level way of a connection between
-                      a service and an IP
+                    description: Endpoint is a high-level way of a connection between a service and an IP
                     properties:
                       dnsName:
                         description: The hostname of the DNS record
@@ -54,9 +55,7 @@ spec:
                       providerSpecific:
                         description: ProviderSpecific stores provider specific config
                         items:
-                          description:
-                            ProviderSpecificProperty holds the name and value
-                            of a configuration which is specific to individual DNS providers
+                          description: ProviderSpecificProperty holds the name and value of a configuration which is specific to individual DNS providers
                           properties:
                             name:
                               type: string
@@ -69,15 +68,10 @@ spec:
                         format: int64
                         type: integer
                       recordType:
-                        description:
-                          RecordType type of record, e.g. CNAME, A, AAAA,
-                          SRV, TXT etc
+                        description: RecordType type of record, e.g. CNAME, A, AAAA, SRV, TXT etc
                         type: string
                       setIdentifier:
-                        description:
-                          Identifier to distinguish multiple records with
-                          the same name and type (e.g. Route53 records with routing
-                          policies other than 'simple')
+                        description: Identifier to distinguish multiple records with the same name and type (e.g. Route53 records with routing policies other than 'simple')
                         type: string
                       targets:
                         description: The targets the DNS record points to
diff --git a/packages/system/external-dns/charts/external-dns/templates/NOTES.txt b/packages/system/external-dns/charts/external-dns/templates/NOTES.txt
index 5e37ecca..dedcff42 100644
--- a/packages/system/external-dns/charts/external-dns/templates/NOTES.txt
+++ b/packages/system/external-dns/charts/external-dns/templates/NOTES.txt
@@ -5,3 +5,14 @@
   App version:   {{ .Chart.AppVersion }}
   Image tag:     {{ include "external-dns.image" . }}
 ***********************************************************************
+
+{{- if eq (typeOf .Values.provider) "string" }}
+🚧 DEPRECATIONS 🚧
+
+The following features, functions, or methods are deprecated and no longer recommended for use.
+
+{{/* The deprecation message for legacy 'provider: name'. */}}
+{{- if eq (typeOf .Values.provider) "string" -}}
+❗❗❗ DEPRECATED ❗❗❗ The legacy 'provider: <name>' configuration is in use. Support will be removed in future releases.
+{{- end -}}
+{{- end }}
diff --git a/packages/system/external-dns/charts/external-dns/templates/_helpers.tpl b/packages/system/external-dns/charts/external-dns/templates/_helpers.tpl
index 3ce55cd8..aad09822 100644
--- a/packages/system/external-dns/charts/external-dns/templates/_helpers.tpl
+++ b/packages/system/external-dns/charts/external-dns/templates/_helpers.tpl
@@ -73,6 +73,7 @@ The image to use
 
 {{/*
 Provider name, Keeps backward compatibility on provider
+TODO: line eq (typeOf .Values.provider) "string" to be removed in future releases
 */}}
 {{- define "external-dns.providerName" -}}
 {{- if eq (typeOf .Values.provider) "string" }}
@@ -93,3 +94,21 @@ The image to use for optional webhook sidecar
 {{- printf "%s:%s" .repository .tag }}
 {{- end }}
 {{- end }}
+
+{{/*
+The pod affinity default label Selector
+*/}}
+{{- define "external-dns.labelSelector" -}}
+labelSelector:
+  matchLabels:
+    {{ include "external-dns.selectorLabels" . | nindent 4 }}
+{{- end }}
+
+{{/*
+Check if any Gateway API sources are enabled
+*/}}
+{{- define "external-dns.hasGatewaySources" -}}
+{{- if or (has "gateway-httproute" .Values.sources) (has "gateway-grpcroute" .Values.sources) (has "gateway-tlsroute" .Values.sources) (has "gateway-tcproute" .Values.sources) (has "gateway-udproute" .Values.sources) -}}
+true
+{{- end -}}
+{{- end }}
diff --git a/packages/system/external-dns/charts/external-dns/templates/clusterrole.yaml b/packages/system/external-dns/charts/external-dns/templates/clusterrole.yaml
index 44f72bd2..b3ef006c 100644
--- a/packages/system/external-dns/charts/external-dns/templates/clusterrole.yaml
+++ b/packages/system/external-dns/charts/external-dns/templates/clusterrole.yaml
@@ -18,10 +18,15 @@ rules:
 {{- end }}
 {{- if or (has "service" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "gloo-proxy" .Values.sources) (has "istio-gateway" .Values.sources) (has "istio-virtualservice" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) }}
   - apiGroups: [""]
-    resources: ["services","endpoints"]
+    resources: ["services"]
     verbs: ["get","watch","list"]
 {{- end }}
-{{- if or (has "ingress" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) }}
+{{- if has "service" .Values.sources }}
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get","watch","list"]
+{{- end }}
+{{- if or (has "ingress" .Values.sources) (has "istio-gateway" .Values.sources) (has "istio-virtualservice" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) (has "gloo-proxy" .Values.sources) }}
   - apiGroups: ["extensions","networking.k8s.io"]
     resources: ["ingresses"]
     verbs: ["get","watch","list"]
@@ -55,13 +60,17 @@ rules:
     resources: ["dnsendpoints/status"]
     verbs: ["*"]
 {{- end }}
-{{- if or (has "gateway-httproute" .Values.sources) (has "gateway-grpcroute" .Values.sources) (has "gateway-tlsroute" .Values.sources) (has "gateway-tcproute" .Values.sources) (has "gateway-udproute" .Values.sources) }}
+{{- if include "external-dns.hasGatewaySources" . }}
+{{- if or (not .Values.namespaced) (and .Values.namespaced (not .Values.gatewayNamespace)) }}
   - apiGroups: ["gateway.networking.k8s.io"]
     resources: ["gateways"]
     verbs: ["get","watch","list"]
+{{- end }}
+{{- if not .Values.namespaced }}
   - apiGroups: [""]
     resources: ["namespaces"]
-    verbs: ["get","watch","list"]    
+    verbs: ["get","watch","list"]
+{{- end }}
 {{- end }}
 {{- if has "gateway-httproute" .Values.sources }}
   - apiGroups: ["gateway.networking.k8s.io"]
@@ -90,7 +99,7 @@ rules:
 {{- end }}
 {{- if has "gloo-proxy" .Values.sources }}
   - apiGroups: ["gloo.solo.io","gateway.solo.io"]
-    resources: ["proxies","virtualservices"]
+    resources: ["proxies","virtualservices","gateways"]
     verbs: ["get","watch","list"]
 {{- end }}
 {{- if has "kong-tcpingress" .Values.sources }}
@@ -116,12 +125,39 @@ rules:
     resources: ["routegroups/status"]
     verbs: ["patch","update"]
 {{- end }}
-{{- if has "f5-virtualserver" .Values.sources }}
+{{- if or (has "f5-virtualserver" .Values.sources) (has "f5-transportserver" .Values.sources) }}
   - apiGroups: ["cis.f5.com"]
-    resources: ["virtualservers"]
+    resources: ["virtualservers", "transportservers"]
     verbs: ["get","watch","list"]
 {{- end }}
 {{- with .Values.rbac.additionalPermissions }}
   {{- toYaml . | nindent 2 }}
 {{- end }}
+{{- if and .Values.rbac.create .Values.namespaced (include "external-dns.hasGatewaySources" .) }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "external-dns.fullname" . }}-namespaces
+  labels:
+    {{- include "external-dns.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["get","watch","list"]
+{{- if .Values.gatewayNamespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "external-dns.fullname" . }}-gateway
+  namespace: {{ .Values.gatewayNamespace }}
+  labels:
+    {{- include "external-dns.labels" . | nindent 4 }}
+rules:
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources: ["gateways"]
+    verbs: ["get","watch","list"]
+{{- end }}
+{{- end }}
 {{- end }}
diff --git a/packages/system/external-dns/charts/external-dns/templates/clusterrolebinding.yaml b/packages/system/external-dns/charts/external-dns/templates/clusterrolebinding.yaml
index 74a51476..49400c0b 100644
--- a/packages/system/external-dns/charts/external-dns/templates/clusterrolebinding.yaml
+++ b/packages/system/external-dns/charts/external-dns/templates/clusterrolebinding.yaml
@@ -13,4 +13,39 @@ subjects:
   - kind: ServiceAccount
     name: {{ template "external-dns.serviceAccountName" . }}
     namespace: {{ .Release.Namespace }}
+{{- if and .Values.rbac.create .Values.namespaced (include "external-dns.hasGatewaySources" .) }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "external-dns.fullname" . }}-namespaces
+  labels:
+    {{- include "external-dns.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "external-dns.fullname" . }}-namespaces
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "external-dns.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- if .Values.gatewayNamespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "external-dns.fullname" . }}-gateway
+  namespace: {{ .Values.gatewayNamespace }}
+  labels:
+    {{- include "external-dns.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "external-dns.fullname" . }}-gateway
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "external-dns.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}
+{{- end }}
 {{- end }}
diff --git a/packages/system/external-dns/charts/external-dns/templates/deployment.yaml b/packages/system/external-dns/charts/external-dns/templates/deployment.yaml
index 02e9b397..b213f754 100644
--- a/packages/system/external-dns/charts/external-dns/templates/deployment.yaml
+++ b/packages/system/external-dns/charts/external-dns/templates/deployment.yaml
@@ -1,3 +1,4 @@
+{{- $defaultSelector := (include "external-dns.labelSelector" $ ) | fromYaml -}}
 {{- $providerName := tpl (include "external-dns.providerName" .) $ }}
 apiVersion: apps/v1
 kind: Deployment
@@ -40,7 +41,7 @@ spec:
     {{- if not (quote .Values.automountServiceAccountToken | empty) }}
       automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
     {{- end }}
-      {{- with .Values.imagePullSecrets }}
+      {{- with (default .Values.global.imagePullSecrets .Values.imagePullSecrets) }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
@@ -99,25 +100,59 @@ spec:
             {{- if .Values.txtOwnerId }}
             - --txt-owner-id={{ .Values.txtOwnerId }}
             {{- end }}
+            {{- if and .Values.txtPrefix .Values.txtSuffix }}
+            {{- fail (printf "'txtPrefix' and 'txtSuffix' are mutually exclusive") }}
+            {{- end }}
             {{- if .Values.txtPrefix }}
             - --txt-prefix={{ .Values.txtPrefix }}
-            {{- end }}
-            {{- if and (eq .Values.txtPrefix "") (ne .Values.txtSuffix "") }}
+            {{- else if .Values.txtSuffix }}
             - --txt-suffix={{ .Values.txtSuffix }}
             {{- end }}
             {{- if .Values.namespaced }}
             - --namespace={{ .Release.Namespace }}
             {{- end }}
+            {{- if .Values.gatewayNamespace }}
+            - --gateway-namespace={{ .Values.gatewayNamespace }}
+            {{- end }}
             {{- range .Values.domainFilters }}
             - --domain-filter={{ . }}
             {{- end }}
             {{- range .Values.excludeDomains }}
             - --exclude-domains={{ . }}
             {{- end }}
+            {{- if .Values.labelFilter }}
+            - --label-filter={{ .Values.labelFilter }}
+            {{- end }}
+            {{- if .Values.annotationFilter }}
+            - --annotation-filter={{ .Values.annotationFilter }}
+            {{- end }}
+            {{- if .Values.annotationPrefix }}
+            - --annotation-prefix={{ .Values.annotationPrefix }}
+            {{- end }}
+            {{- range .Values.managedRecordTypes }}
+            - --managed-record-types={{ . }}
+            {{- end }}
             - --provider={{ $providerName }}
-          {{- range .Values.extraArgs }}
+            {{- if kindIs "map" .Values.extraArgs }}
+            {{- range $key, $value := .Values.extraArgs }}
+            {{- if not (kindIs "invalid" $value) }}
+            {{- if kindIs "slice" $value }}
+            {{- range $value }}
+            - --{{ $key }}={{ tpl (. | toString) $ }}
+            {{- end }}
+            {{- else }}
+            - --{{ $key }}={{ tpl ($value | toString) $ }}
+            {{- end }}
+            {{- else }}
+            - --{{ $key }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
+            {{- if kindIs "slice" .Values.extraArgs }}
+            {{- range .Values.extraArgs }}
             - {{ tpl . $ }}
-          {{- end }}
+            {{- end }}
+            {{- end }}
           ports:
             - name: http
               protocol: TCP
@@ -197,11 +232,71 @@ spec:
       {{- end }}
       {{- with .Values.affinity }}
       affinity:
-        {{- toYaml . | nindent 8 }}
+      {{- with .nodeAffinity }}
+        nodeAffinity:
+          {{- toYaml . | nindent 10 }}
+      {{- end }}
+      {{- with .podAffinity }}
+        podAffinity:
+          {{- with .preferredDuringSchedulingIgnoredDuringExecution }}
+          preferredDuringSchedulingIgnoredDuringExecution:
+          {{- range . }}
+            - podAffinityTerm:
+              {{- if dig "podAffinityTerm" "labelSelector" nil . }}
+                {{- toYaml .podAffinityTerm | nindent 16 }}
+              {{- else }}
+                {{- (merge $defaultSelector .podAffinityTerm) | toYaml | nindent 16 }}
+              {{- end }}
+              weight: {{ .weight  }}
+          {{- end }}
+          {{- end }}
+          {{- with .requiredDuringSchedulingIgnoredDuringExecution }}
+          requiredDuringSchedulingIgnoredDuringExecution:
+          {{- range . }}
+            {{- if dig "labelSelector" nil . }}
+              - {{ toYaml . | indent 16 | trim }}
+            {{- else }}
+              - {{ (merge $defaultSelector .) | toYaml | indent 16 | trim }}
+            {{- end }}
+          {{- end }}
+          {{- end }}
+      {{- end }}
+      {{- with .podAntiAffinity }}
+        podAntiAffinity:
+          {{- with .preferredDuringSchedulingIgnoredDuringExecution }}
+          preferredDuringSchedulingIgnoredDuringExecution:
+          {{- range . }}
+            - podAffinityTerm:
+              {{- if dig "podAffinityTerm" "labelSelector" nil . }}
+                {{- toYaml .podAffinityTerm | nindent 16 }}
+              {{- else }}
+                {{- (merge $defaultSelector .podAffinityTerm) | toYaml | nindent 16 }}
+              {{- end }}
+              weight: {{ .weight  }}
+          {{- end }}
+          {{- end }}
+          {{- with .requiredDuringSchedulingIgnoredDuringExecution }}
+          requiredDuringSchedulingIgnoredDuringExecution:
+          {{- range . }}
+            {{- if dig "labelSelector" nil . }}
+              - {{ toYaml . | indent 16 | trim }}
+            {{- else }}
+              - {{ (merge $defaultSelector .) | toYaml | indent 16 | trim }}
+            {{- end }}
+          {{- end }}
+          {{- end }}
+      {{- end }}
       {{- end }}
       {{- with .Values.topologySpreadConstraints }}
       topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
+        {{- range . }}
+        - {{ toYaml . | nindent 10 | trim }}
+          {{- if not (hasKey . "labelSelector") }}
+          labelSelector:
+            matchLabels:
+              {{- include "external-dns.selectorLabels" $ | nindent 14 }}
+          {{- end }}
+        {{- end }}
       {{- end }}
       {{- with .Values.tolerations }}
       tolerations:
diff --git a/packages/system/external-dns/charts/external-dns/templates/serviceaccount.yaml b/packages/system/external-dns/charts/external-dns/templates/serviceaccount.yaml
index f627313a..27196a2a 100644
--- a/packages/system/external-dns/charts/external-dns/templates/serviceaccount.yaml
+++ b/packages/system/external-dns/charts/external-dns/templates/serviceaccount.yaml
@@ -11,7 +11,9 @@ metadata:
   {{- end }}
   {{- with .Values.serviceAccount.annotations }}
   annotations:
-    {{- toYaml . | nindent 4 }}
+    {{- range $k, $v := . }}
+      {{- printf "%s: %s" (toYaml (tpl $k $)) (toYaml (tpl $v $)) | nindent 4 }}
+    {{- end }}
   {{- end }}
 automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
 {{- end }}
diff --git a/packages/system/external-dns/charts/external-dns/values.schema.json b/packages/system/external-dns/charts/external-dns/values.schema.json
index 614deeac..b4c5e3a4 100644
--- a/packages/system/external-dns/charts/external-dns/values.schema.json
+++ b/packages/system/external-dns/charts/external-dns/values.schema.json
@@ -1,54 +1,697 @@
 {
-  "$schema": "http://json-schema.org/draft-07/schema",
+  "$schema": "http://json-schema.org/draft-07/schema#",
   "type": "object",
   "properties": {
-    "provider": {
-      "anyOf": [
-        {
-          "type": "string"
-        },
-        {
-          "type": "object",
-          "properties": {
-            "name": {
-              "type": "string"
-            }
-          }
-        }
+    "affinity": {
+      "description": "Affinity settings for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). If an explicit label selector is not provided for pod affinity or pod anti-affinity one will be created from the pod selector labels.",
+      "type": "object"
+    },
+    "annotationFilter": {
+      "description": "Filter resources queried for endpoints by annotation selector.",
+      "type": [
+        "string",
+        "null"
       ]
     },
+    "annotationPrefix": {
+      "description": "Annotation prefix for external-dns annotations (useful for split horizon DNS with multiple instances).",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "automountServiceAccountToken": {
+      "description": "Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `Pod`.",
+      "type": "boolean"
+    },
+    "commonLabels": {
+      "description": "Labels to add to all chart resources.",
+      "type": "object"
+    },
+    "deploymentAnnotations": {
+      "description": "Annotations to add to the `Deployment`.",
+      "type": "object"
+    },
+    "deploymentStrategy": {
+      "description": "[Deployment Strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy).",
+      "type": "object",
+      "properties": {
+        "type": {
+          "default": "Recreate",
+          "type": "string",
+          "enum": [
+            "Recreate",
+            "RollingUpdate"
+          ]
+        }
+      },
+      "additionalProperties": true
+    },
+    "dnsConfig": {
+      "description": "[DNS config](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config) for the pod, if not set the default will be used.",
+      "type": [
+        "object",
+        "null"
+      ]
+    },
+    "dnsPolicy": {
+      "description": "[DNS policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy) for the pod, if not set the default will be used.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "domainFilters": {
+      "description": "Limit possible target zones by domain suffixes.",
+      "type": "array"
+    },
+    "enabled": {
+      "description": "No effect - reserved for use in sub-charting",
+      "type": [
+        "boolean",
+        "null"
+      ]
+    },
+    "env": {
+      "description": "[Environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) for the `external-dns` container.",
+      "type": "array"
+    },
+    "excludeDomains": {
+      "description": "Intentionally exclude domains from being managed.",
+      "type": "array"
+    },
     "extraArgs": {
-      "type": "array",
+      "description": "Extra arguments to provide to _ExternalDNS_. An array or map can be used, with maps allowing for value overrides; maps also support slice values to use the same arg multiple times.",
+      "type": [
+        "array",
+        "null",
+        "object"
+      ],
+      "uniqueItems": true,
       "items": {
         "type": "string"
       }
     },
-    "secretConfiguration": {
-      "$comment": "This value is DEPRECATED as secrets should be configured external to the chart and exposed to the container via extraVolumes & extraVolumeMounts.",
+    "extraContainers": {
+      "description": "Extra containers to add to the `Deployment`.",
+      "type": "array"
+    },
+    "extraVolumeMounts": {
+      "description": "Extra [volume mounts](https://kubernetes.io/docs/concepts/storage/volumes/) for the `external-dns` container.",
+      "type": "array"
+    },
+    "extraVolumes": {
+      "description": "Extra [volumes](https://kubernetes.io/docs/concepts/storage/volumes/) for the `Pod`.",
+      "type": "array"
+    },
+    "fullnameOverride": {
+      "description": "Override the full name of the chart.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "gatewayNamespace": {
+      "description": "_Gateway API_ gateway namespace to watch.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "global": {
       "type": "object",
       "properties": {
+        "imagePullSecrets": {
+          "description": "Global image pull secrets.",
+          "type": "array",
+          "items": {
+            "type": "object"
+          }
+        }
+      }
+    },
+    "image": {
+      "type": "object",
+      "properties": {
+        "pullPolicy": {
+          "description": "Image pull policy for the `external-dns` container.",
+          "type": "string",
+          "enum": [
+            "IfNotPresent",
+            "Always"
+          ]
+        },
+        "repository": {
+          "description": "Image repository for the `external-dns` container.",
+          "type": "string"
+        },
+        "tag": {
+          "description": "Image tag for the `external-dns` container, this will default to `.Chart.AppVersion` if not set.",
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      },
+      "additionalProperties": false
+    },
+    "imagePullSecrets": {
+      "description": "Image pull secrets.",
+      "type": "array",
+      "items": {
+        "type": "object"
+      }
+    },
+    "initContainers": {
+      "description": "[Init containers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) to add to the `Pod` definition.",
+      "type": "array"
+    },
+    "interval": {
+      "description": "Interval for DNS updates.",
+      "type": "string"
+    },
+    "labelFilter": {
+      "description": "Filter resources queried for endpoints by label selector.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "livenessProbe": {
+      "description": "[Liveness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `external-dns` container.",
+      "type": "object",
+      "properties": {
+        "failureThreshold": {
+          "type": "integer"
+        },
+        "httpGet": {
+          "type": "object",
+          "properties": {
+            "path": {
+              "type": "string"
+            },
+            "port": {
+              "type": "string"
+            }
+          }
+        },
+        "initialDelaySeconds": {
+          "type": "integer"
+        },
+        "periodSeconds": {
+          "type": "integer"
+        },
+        "successThreshold": {
+          "type": "integer"
+        },
+        "timeoutSeconds": {
+          "type": "integer"
+        }
+      }
+    },
+    "logFormat": {
+      "description": "Log format.",
+      "default": "text",
+      "type": "string",
+      "enum": [
+        "text",
+        "json"
+      ]
+    },
+    "logLevel": {
+      "description": "Log level.",
+      "default": "info",
+      "type": "string",
+      "enum": [
+        "panic",
+        "debug",
+        "info",
+        "warning",
+        "error",
+        "fatal"
+      ]
+    },
+    "managedRecordTypes": {
+      "description": "Record types to manage (default: A, AAAA, CNAME)",
+      "type": [
+        "array",
+        "null"
+      ],
+      "uniqueItems": true,
+      "items": {
+        "type": "string"
+      }
+    },
+    "nameOverride": {
+      "description": "Override the name of the chart.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "namespaced": {
+      "description": "if `true`, _ExternalDNS_ will run in a namespaced scope (`Role`` and `Rolebinding`` will be namespaced too).",
+      "type": "boolean"
+    },
+    "nodeSelector": {
+      "description": "Node labels to match for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).",
+      "type": "object"
+    },
+    "podAnnotations": {
+      "description": "Annotations to add to the `Pod`.",
+      "type": "object"
+    },
+    "podLabels": {
+      "description": "Labels to add to the `Pod`.",
+      "type": "object"
+    },
+    "podSecurityContext": {
+      "description": "[Pod security context](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#podsecuritycontext-v1-core), this supports full customisation.",
+      "type": "object",
+      "properties": {
+        "fsGroup": {
+          "type": "integer"
+        },
+        "runAsNonRoot": {
+          "type": "boolean"
+        },
+        "seccompProfile": {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string"
+            }
+          }
+        }
+      }
+    },
+    "policy": {
+      "description": "How DNS records are synchronized between sources and providers; available values are `create-only`, `sync`, \u0026 `upsert-only`.",
+      "default": "upsert-only",
+      "type": "string",
+      "enum": [
+        "create-only",
+        "sync",
+        "upsert-only"
+      ]
+    },
+    "priorityClassName": {
+      "description": "Priority class name for the `Pod`.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "provider": {
+      "type": [
+        "object",
+        "string"
+      ],
+      "properties": {
+        "name": {
+          "description": "_ExternalDNS_ provider name; for the available providers and how to configure them see [README](https://github.com/kubernetes-sigs/external-dns/blob/master/charts/external-dns/README.md#providers).",
+          "type": "string"
+        },
+        "webhook": {
+          "type": "object",
+          "properties": {
+            "args": {
+              "description": "Extra arguments to provide for the `webhook` container.",
+              "type": "array"
+            },
+            "env": {
+              "description": "[Environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) for the `webhook` container.",
+              "type": "array"
+            },
+            "extraVolumeMounts": {
+              "description": "Extra [volume mounts](https://kubernetes.io/docs/concepts/storage/volumes/) for the `webhook` container.",
+              "type": "array"
+            },
+            "image": {
+              "type": "object",
+              "properties": {
+                "pullPolicy": {
+                  "description": "Image pull policy for the `webhook` container.",
+                  "type": "string"
+                },
+                "repository": {
+                  "description": "Image repository for the `webhook` container.",
+                  "type": [
+                    "string",
+                    "null"
+                  ]
+                },
+                "tag": {
+                  "description": "Image tag for the `webhook` container.",
+                  "type": [
+                    "string",
+                    "null"
+                  ]
+                }
+              }
+            },
+            "limits": {
+              "type": "object",
+              "properties": {
+                "cpu": {
+                  "type": "string"
+                },
+                "memory": {
+                  "type": "string"
+                }
+              }
+            },
+            "livenessProbe": {
+              "description": "[Liveness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `external-dns` container.",
+              "type": "object",
+              "properties": {
+                "failureThreshold": {
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                },
+                "httpGet": {
+                  "type": "object",
+                  "properties": {
+                    "path": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "port": {
+                      "default": "string",
+                      "type": [
+                        "integer",
+                        "string"
+                      ]
+                    }
+                  }
+                },
+                "initialDelaySeconds": {
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                },
+                "periodSeconds": {
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                },
+                "successThreshold": {
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                },
+                "timeoutSeconds": {
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              }
+            },
+            "readinessProbe": {
+              "description": "[Readiness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `webhook` container.",
+              "type": "object",
+              "properties": {
+                "failureThreshold": {
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                },
+                "httpGet": {
+                  "type": "object",
+                  "properties": {
+                    "path": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "port": {
+                      "default": "string",
+                      "type": [
+                        "integer",
+                        "string"
+                      ]
+                    }
+                  }
+                },
+                "initialDelaySeconds": {
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                },
+                "periodSeconds": {
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                },
+                "successThreshold": {
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                },
+                "timeoutSeconds": {
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              }
+            },
+            "requests": {
+              "type": "object",
+              "properties": {
+                "cpu": {
+                  "type": "string"
+                },
+                "memory": {
+                  "type": "string"
+                }
+              }
+            },
+            "resources": {
+              "description": "[Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for the `webhook` container.",
+              "type": "object"
+            },
+            "securityContext": {
+              "description": "[Pod security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) for the `webhook` container.",
+              "type": "object"
+            },
+            "service": {
+              "type": "object",
+              "properties": {
+                "port": {
+                  "description": "Webhook exposed HTTP port for the service.",
+                  "type": "integer"
+                }
+              }
+            },
+            "serviceMonitor": {
+              "description": "Optional [Service Monitor](https://prometheus-operator.dev/docs/operator/design/#servicemonitor) configuration for the `webhook` container.",
+              "type": "object",
+              "properties": {
+                "bearerTokenFile": {
+                  "type": [
+                    "string",
+                    "null"
+                  ]
+                },
+                "interval": {
+                  "type": [
+                    "string",
+                    "null"
+                  ]
+                },
+                "metricRelabelings": {
+                  "type": "array"
+                },
+                "relabelings": {
+                  "type": "array"
+                },
+                "scheme": {
+                  "type": [
+                    "string",
+                    "null"
+                  ]
+                },
+                "scrapeTimeout": {
+                  "type": [
+                    "string",
+                    "null"
+                  ]
+                },
+                "tlsConfig": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "rbac": {
+      "type": "object",
+      "properties": {
+        "additionalPermissions": {
+          "description": "Additional rules to add to the `ClusterRole`.",
+          "type": "array"
+        },
+        "create": {
+          "description": "If `true`, create a `ClusterRole` \u0026 `ClusterRoleBinding` with access to the Kubernetes API.",
+          "type": "boolean"
+        }
+      },
+      "additionalProperties": true
+    },
+    "readinessProbe": {
+      "description": "[Readiness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `external-dns` container.",
+      "type": "object",
+      "properties": {
+        "failureThreshold": {
+          "type": "integer"
+        },
+        "httpGet": {
+          "type": "object",
+          "properties": {
+            "path": {
+              "type": "string"
+            },
+            "port": {
+              "type": "string"
+            }
+          }
+        },
+        "initialDelaySeconds": {
+          "type": "integer"
+        },
+        "periodSeconds": {
+          "type": "integer"
+        },
+        "successThreshold": {
+          "type": "integer"
+        },
+        "timeoutSeconds": {
+          "type": "integer"
+        }
+      }
+    },
+    "registry": {
+      "description": "Specify the registry for storing ownership and labels. Valid values are `txt`, `aws-sd`, `dynamodb` \u0026 `noop`.",
+      "default": "txt",
+      "type": "string",
+      "enum": [
+        "txt",
+        "aws-sd",
+        "dynamodb",
+        "noop"
+      ]
+    },
+    "resources": {
+      "description": "[Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for the `external-dns` container.",
+      "type": "object",
+      "properties": {
+        "limits": {
+          "type": "object",
+          "properties": {
+            "cpu": {
+              "type": "string"
+            },
+            "memory": {
+              "type": "string"
+            }
+          }
+        },
+        "requests": {
+          "type": "object",
+          "properties": {
+            "cpu": {
+              "type": "string"
+            },
+            "memory": {
+              "type": "string"
+            }
+          }
+        }
+      }
+    },
+    "revisionHistoryLimit": {
+      "description": "Specify the number of old `ReplicaSets` to retain to allow rollback of the `Deployment``.",
+      "type": [
+        "integer",
+        "null"
+      ],
+      "minimum": 0
+    },
+    "secretConfiguration": {
+      "type": "object",
+      "properties": {
+        "data": {
+          "description": "`Secret` data.",
+          "type": "object"
+        },
         "enabled": {
+          "description": "If `true`, create a `Secret` to store sensitive provider configuration (**DEPRECATED**).",
           "type": "boolean"
         },
         "mountPath": {
+          "description": "Mount path for the `Secret`, this can be templated.",
           "type": [
             "string",
             "null"
           ]
         },
         "subPath": {
+          "description": "Sub-path for mounting the `Secret`, this can be templated.",
           "type": [
             "string",
             "null"
           ]
+        }
+      }
+    },
+    "securityContext": {
+      "description": "[Security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) for the `external-dns` container.",
+      "type": "object",
+      "properties": {
+        "allowPrivilegeEscalation": {
+          "type": "boolean"
         },
-        "data": {
+        "capabilities": {
           "type": "object",
-          "patternProperties": {
-            ".+": {
-              "type": "string"
+          "properties": {
+            "drop": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
             }
           }
+        },
+        "privileged": {
+          "type": "boolean"
+        },
+        "readOnlyRootFilesystem": {
+          "type": "boolean"
+        },
+        "runAsGroup": {
+          "type": "integer"
+        },
+        "runAsNonRoot": {
+          "type": "boolean"
+        },
+        "runAsUser": {
+          "type": "integer"
         }
       }
     },
@@ -56,36 +699,194 @@
       "type": "object",
       "properties": {
         "annotations": {
+          "description": "Service annotations.",
           "type": "object"
         },
         "ipFamilies": {
-          "type": "array",
+          "description": "Service IP families (e.g. IPv4 and/or IPv6).",
+          "type": [
+            "array",
+            "null"
+          ],
+          "maxItems": 2,
+          "minItems": 0,
+          "uniqueItems": true,
           "items": {
             "type": "string",
             "enum": [
-              "IPv6",
-              "IPv4"
+              "IPv4",
+              "IPv6"
             ]
           }
         },
         "ipFamilyPolicy": {
+          "description": "Service IP family policy.",
           "type": [
             "string",
             "null"
           ],
-          "items": {
-            "type": "string",
-            "enum": [
-              "SingleStack",
-              "PreferDualStack",
-              "RequireDualStack"
-            ]
-          }
+          "enum": [
+            "SingleStack",
+            "PreferDualStack",
+            "RequireDualStack",
+            null
+          ]
         },
         "port": {
-          "type": "integer"
+          "description": "Service HTTP port.",
+          "default": 7979,
+          "type": "integer",
+          "minimum": 0
         }
       }
+    },
+    "serviceAccount": {
+      "type": "object",
+      "properties": {
+        "annotations": {
+          "description": "Annotations to add to the service account. Templates are allowed in both the key and the value. Example: `example.com/annotation/{{ .Values.nameOverride }}: {{ .Values.nameOverride }}`",
+          "type": "object"
+        },
+        "automountServiceAccountToken": {
+          "description": "Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `ServiceAccount`.",
+          "type": "boolean"
+        },
+        "create": {
+          "description": "If `true`, create a new `ServiceAccount`.",
+          "type": "boolean"
+        },
+        "labels": {
+          "description": "Labels to add to the service account.",
+          "type": "object"
+        },
+        "name": {
+          "description": "If this is set and `serviceAccount.create` is `true` this will be used for the created `ServiceAccount` name, if set and `serviceAccount.create` is `false` then this will define an existing `ServiceAccount` to use.",
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      }
+    },
+    "serviceMonitor": {
+      "type": "object",
+      "properties": {
+        "additionalLabels": {
+          "description": "Additional labels for the `ServiceMonitor`.",
+          "type": "object"
+        },
+        "annotations": {
+          "description": "Annotations to add to the `ServiceMonitor`.",
+          "type": "object"
+        },
+        "bearerTokenFile": {
+          "description": "Provide a bearer token file for the `ServiceMonitor`.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "enabled": {
+          "description": "If `true`, create a `ServiceMonitor` resource to support the _Prometheus Operator_.",
+          "type": "boolean"
+        },
+        "interval": {
+          "description": "If set override the _Prometheus_ default interval.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "metricRelabelings": {
+          "description": "[Metric relabel configs](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) to apply to samples before ingestion.",
+          "type": "array"
+        },
+        "namespace": {
+          "description": "If set create the `ServiceMonitor` in an alternate namespace.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "relabelings": {
+          "description": "[Relabel configs](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config) to apply to samples before ingestion.",
+          "type": "array"
+        },
+        "scheme": {
+          "description": "If set overrides the _Prometheus_ default scheme.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "scrapeTimeout": {
+          "description": "If set override the _Prometheus_ default scrape timeout.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "targetLabels": {
+          "description": "Provide target labels for the `ServiceMonitor`.",
+          "type": "array"
+        },
+        "tlsConfig": {
+          "description": "Configure the `ServiceMonitor` [TLS config](https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#tlsconfig).",
+          "type": "object"
+        }
+      }
+    },
+    "shareProcessNamespace": {
+      "description": "If `true`, the `Pod` will have [process namespace sharing](https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/) enabled.",
+      "type": "boolean"
+    },
+    "sources": {
+      "description": "_Kubernetes_ resources to monitor for DNS entries.",
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "terminationGracePeriodSeconds": {
+      "description": "Termination grace period for the `Pod` in seconds.",
+      "type": [
+        "integer",
+        "null"
+      ]
+    },
+    "tolerations": {
+      "description": "Node taints which will be tolerated for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).",
+      "type": "array"
+    },
+    "topologySpreadConstraints": {
+      "description": "Topology spread constraints for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). If an explicit label selector is not provided one will be created from the pod selector labels.",
+      "type": "array"
+    },
+    "triggerLoopOnEvent": {
+      "description": "If `true`, triggers run loop on create/update/delete events in addition of regular interval.",
+      "type": "boolean"
+    },
+    "txtOwnerId": {
+      "description": "Specify an identifier for this instance of _ExternalDNS_ when using a registry other than `noop`.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "txtPrefix": {
+      "description": "Specify a prefix for the domain names of TXT records created for the `txt` registry. Mutually exclusive with `txtSuffix`.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "txtSuffix": {
+      "description": "Specify a suffix for the domain names of TXT records created for the `txt` registry. Mutually exclusive with `txtPrefix`.",
+      "type": [
+        "string",
+        "null"
+      ]
     }
-  }
+  },
+  "additionalProperties": true
 }
diff --git a/packages/system/external-dns/charts/external-dns/values.yaml b/packages/system/external-dns/charts/external-dns/values.yaml
index 9d7dea1b..46fbe8f7 100644
--- a/packages/system/external-dns/charts/external-dns/values.yaml
+++ b/packages/system/external-dns/charts/external-dns/values.yaml
@@ -2,22 +2,26 @@
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
 
-image:
+global:
+  # -- Global image pull secrets.
+  imagePullSecrets: []  # @schema item: object
+
+image:  # @schema additionalProperties: false
   # -- Image repository for the `external-dns` container.
   repository: registry.k8s.io/external-dns/external-dns
-  # -- (string) Image tag for the `external-dns` container, this will default to `.Chart.AppVersion` if not set.
-  tag:
+  # -- Image tag for the `external-dns` container, this will default to `.Chart.AppVersion` if not set.
+  tag:  # @schema type:[string, null]
   # -- Image pull policy for the `external-dns` container.
-  pullPolicy: IfNotPresent
+  pullPolicy: IfNotPresent  # @schema enum:[IfNotPresent, Always]
 
 # -- Image pull secrets.
-imagePullSecrets: []
+imagePullSecrets: []  # @schema item: object
 
 # -- (string) Override the name of the chart.
-nameOverride:
+nameOverride:  # @schema type:[string, null]; default: null
 
 # -- (string) Override the full name of the chart.
-fullnameOverride:
+fullnameOverride:  # @schema type:[string, null]; default: null
 
 # -- Labels to add to all chart resources.
 commonLabels: {}
@@ -27,24 +31,26 @@ serviceAccount:
   create: true
   # -- Labels to add to the service account.
   labels: {}
-  # -- Annotations to add to the service account.
+  # -- Annotations to add to the service account. Templates are allowed in both the key and the value. Example: `example.com/annotation/{{ .Values.nameOverride }}: {{ .Values.nameOverride }}`
   annotations: {}
   # -- (string) If this is set and `serviceAccount.create` is `true` this will be used for the created `ServiceAccount` name, if set and `serviceAccount.create` is `false` then this will define an existing `ServiceAccount` to use.
-  name:
+  name:  # @schema type:[string, null]; default: null
   # -- Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `ServiceAccount`.
-  automountServiceAccountToken:
+  automountServiceAccountToken: true
 
 service:
   # -- Service annotations.
   annotations: {}
   # -- Service HTTP port.
-  port: 7979
-  # -- Service IP families.
-  ipFamilies: []
-  # -- (string) Service IP family policy.
-  ipFamilyPolicy:
+  port: 7979  # @schema minimum:0; default:7979
+  # -- Service IP families (e.g. IPv4 and/or IPv6).
+  ipFamilies: []  # @schema type: [array, null]; item: string; itemEnum: ["IPv4", "IPv6"]; minItems:0; maxItems:2; uniqueItems: true
+  #  - IPv4
+  #  - IPv6
+  # -- Service IP family policy.
+  ipFamilyPolicy:  # @schema type: [string, null];  enum:[SingleStack, PreferDualStack, RequireDualStack, null]
 
-rbac:
+rbac:  # @schema additionalProperties: true
   # -- If `true`, create a `ClusterRole` & `ClusterRoleBinding` with access to the Kubernetes API.
   create: true
   # -- Additional rules to add to the `ClusterRole`.
@@ -54,14 +60,14 @@ rbac:
 deploymentAnnotations: {}
 
 # -- Extra containers to add to the `Deployment`.
-extraContainers: {}
+extraContainers: []
 
 # -- [Deployment Strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy).
-deploymentStrategy:
-  type: Recreate
+deploymentStrategy:  # @schema additionalProperties: true
+  type: Recreate  # @schema enum:[Recreate, RollingUpdate]; type:string; default: Recreate
 
 # -- (int) Specify the number of old `ReplicaSets` to retain to allow rollback of the `Deployment``.
-revisionHistoryLimit:
+revisionHistoryLimit:  # @schema type:[integer, null];minimum:0
 
 # -- Labels to add to the `Pod`.
 podLabels: {}
@@ -70,7 +76,7 @@ podLabels: {}
 podAnnotations: {}
 
 # -- (bool) Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `Pod`.
-automountServiceAccountToken:
+automountServiceAccountToken: true
 
 # -- If `true`, the `Pod` will have [process namespace sharing](https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/) enabled.
 shareProcessNamespace: false
@@ -84,16 +90,16 @@ podSecurityContext:
     type: RuntimeDefault
 
 # -- (string) Priority class name for the `Pod`.
-priorityClassName:
+priorityClassName:  # @schema type:[string, null]; default: null
 
 # -- (int) Termination grace period for the `Pod` in seconds.
-terminationGracePeriodSeconds:
+terminationGracePeriodSeconds:  # @schema type:[integer, null]
 
 # -- (string) [DNS policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy) for the pod, if not set the default will be used.
-dnsPolicy:
+dnsPolicy:  # @schema type:[string, null]; default: null
 
 # -- (object) [DNS config](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config) for the pod, if not set the default will be used.
-dnsConfig:
+dnsConfig:  # @schema type:[object, null]; default: null
 
 # -- [Init containers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) to add to the `Pod` definition.
 initContainers: []
@@ -166,17 +172,17 @@ serviceMonitor:
   # -- Annotations to add to the `ServiceMonitor`.
   annotations: {}
   # -- (string) If set create the `ServiceMonitor` in an alternate namespace.
-  namespace:
+  namespace:  # @schema type:[string, null]; default: null
   # -- (string) If set override the _Prometheus_ default interval.
-  interval:
+  interval:  # @schema type:[string, null]; default: null
   # -- (string) If set override the _Prometheus_ default scrape timeout.
-  scrapeTimeout:
+  scrapeTimeout:  # @schema type:[string, null]; default: null
   # -- (string) If set overrides the _Prometheus_ default scheme.
-  scheme:
+  scheme:  # @schema type:[string, null]; default: null
   # -- Configure the `ServiceMonitor` [TLS config](https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#tlsconfig).
   tlsConfig: {}
   # -- (string) Provide a bearer token file for the `ServiceMonitor`.
-  bearerTokenFile:
+  bearerTokenFile:  # @schema type:[string, null]; default: null
   # -- [Relabel configs](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config) to apply to samples before ingestion.
   relabelings: []
   # -- [Metric relabel configs](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) to apply to samples before ingestion.
@@ -185,10 +191,10 @@ serviceMonitor:
   targetLabels: []
 
 # -- Log level.
-logLevel: info
+logLevel: info  # @schema enum:[panic, debug, info, warning, error, fatal]; type:string; default: "info"
 
 # -- Log format.
-logFormat: text
+logFormat: text  # @schema enum:["text", "json"]; type:string; default: "text"
 
 # -- Interval for DNS updates.
 interval: 1m
@@ -199,41 +205,56 @@ triggerLoopOnEvent: false
 # -- if `true`, _ExternalDNS_ will run in a namespaced scope (`Role`` and `Rolebinding`` will be namespaced too).
 namespaced: false
 
+# -- _Gateway API_ gateway namespace to watch.
+gatewayNamespace:  # @schema type:[string, null]; default: null
+
 # -- _Kubernetes_ resources to monitor for DNS entries.
 sources:
   - service
   - ingress
 
-# -- How DNS records are synchronized between sources and providers; available values are `sync` & `upsert-only`.
-policy: upsert-only
+# -- How DNS records are synchronized between sources and providers; available values are `create-only`, `sync`, & `upsert-only`.
+policy: upsert-only  # @schema enum:[create-only, sync, upsert-only]; type:string; default: "upsert-only"
 
 # -- Specify the registry for storing ownership and labels.
 # Valid values are `txt`, `aws-sd`, `dynamodb` & `noop`.
-registry: txt
-# -- (string) Specify an identifier for this instance of _ExternalDNS_ wWhen using a registry other than `noop`.
-txtOwnerId:
+registry: txt  # @schema enum:[txt, aws-sd, dynamodb, noop]; default: "txt"
+# -- (string) Specify an identifier for this instance of _ExternalDNS_ when using a registry other than `noop`.
+txtOwnerId:  # @schema type:[string, null]; default: null
 # -- (string) Specify a prefix for the domain names of TXT records created for the `txt` registry.
 # Mutually exclusive with `txtSuffix`.
-txtPrefix:
+txtPrefix:  # @schema type:[string, null]; default: null
 # -- (string) Specify a suffix for the domain names of TXT records created for the `txt` registry.
 # Mutually exclusive with `txtPrefix`.
-txtSuffix:
+txtSuffix:  # @schema type:[string, null]; default: null
 
-## - Limit possible target zones by domain suffixes.
+# -- Limit possible target zones by domain suffixes.
 domainFilters: []
 
-## -- Intentionally exclude domains from being managed.
+# -- Intentionally exclude domains from being managed.
 excludeDomains: []
 
-provider:
+# -- Filter resources queried for endpoints by label selector.
+labelFilter:  # @schema type: [string,null]; default: null
+
+# -- Filter resources queried for endpoints by annotation selector.
+annotationFilter:  # @schema type: [string,null]; default: null
+
+# -- Annotation prefix for external-dns annotations (useful for split horizon DNS with multiple instances).
+annotationPrefix:  # @schema type: [string,null]; default: null
+
+# -- Record types to manage (default: A, AAAA, CNAME)
+managedRecordTypes: []  # @schema type: [array, null]; item: string; uniqueItems: true
+
+provider:  # @schema type: [object, string]
   # -- _ExternalDNS_ provider name; for the available providers and how to configure them see [README](https://github.com/kubernetes-sigs/external-dns/blob/master/charts/external-dns/README.md#providers).
   name: aws
   webhook:
     image:
       # -- (string) Image repository for the `webhook` container.
-      repository:
+      repository:  # @schema type:[string, null]; default: null
       # -- (string) Image tag for the `webhook` container.
-      tag:
+      tag:  # @schema type:[string, null]; default: null
       # -- Image pull policy for the `webhook` container.
       pullPolicy: IfNotPresent
     # -- [Environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) for the `webhook` container.
@@ -251,47 +272,51 @@ provider:
     # @default -- See _values.yaml_
     livenessProbe:
       httpGet:
-        path: /healthz
-        port: http-webhook
-      initialDelaySeconds: 10
-      periodSeconds: 10
-      timeoutSeconds: 5
-      failureThreshold: 2
-      successThreshold: 1
+        path: /healthz  # @schema type:[string, null]; default: null
+        port: http-webhook  # @schema type:[integer,string]; default: string
+      initialDelaySeconds: 10  # @schema type:[integer, null]; default: null
+      periodSeconds: 10  # @schema type:[integer, null]; default: null
+      timeoutSeconds: 5  # @schema type:[integer, null]; default: null
+      failureThreshold: 2  # @schema type:[integer, null]; default: null
+      successThreshold: 1  # @schema type:[integer, null]; default: null
     # -- [Readiness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `webhook` container.
     # @default -- See _values.yaml_
     readinessProbe:
       httpGet:
-        path: /healthz
-        port: http-webhook
-      initialDelaySeconds: 5
-      periodSeconds: 10
-      timeoutSeconds: 5
-      failureThreshold: 6
-      successThreshold: 1
+        path: /healthz  # @schema type:[string, null]; default: null
+        port: http-webhook  # @schema type:[integer,string]; default: string
+      initialDelaySeconds: 5  # @schema type:[integer, null]; default: null
+      periodSeconds: 10  # @schema type:[integer, null]; default: null
+      timeoutSeconds: 5  # @schema type:[integer, null]; default: null
+      failureThreshold: 6  # @schema type:[integer, null]; default: null
+      successThreshold: 1  # @schema type:[integer, null]; default: null
     service:
       # -- Webhook exposed HTTP port for the service.
       port: 8080
     # -- Optional [Service Monitor](https://prometheus-operator.dev/docs/operator/design/#servicemonitor) configuration for the `webhook` container.
     # @default -- See _values.yaml_
     serviceMonitor:
-      interval:
-      scheme:
+      interval:  # @schema type:[string, null]; default: null
+      scheme:  # @schema type:[string, null]; default: null
       tlsConfig: {}
-      bearerTokenFile:
-      scrapeTimeout:
+      bearerTokenFile:  # @schema type:[string, null]; default: null
+      scrapeTimeout:  # @schema type:[string, null]; default: null
       metricRelabelings: []
       relabelings: []
 
 # -- Extra arguments to provide to _ExternalDNS_.
-extraArgs: []
+# An array or map can be used, with maps allowing for value overrides; maps also support slice values to use the same arg multiple times.
+extraArgs: {}  # @schema type: [array, null, object]; item: string; uniqueItems: true
 
 secretConfiguration:
   # -- If `true`, create a `Secret` to store sensitive provider configuration (**DEPRECATED**).
   enabled: false
   # -- Mount path for the `Secret`, this can be templated.
-  mountPath:
+  mountPath:  # @schema type:[string, null]; default: null
   # -- Sub-path for mounting the `Secret`, this can be templated.
-  subPath:
+  subPath:  # @schema type:[string, null]; default: null
   # -- `Secret` data.
   data: {}
+
+# -- (bool) No effect - reserved for use in sub-charting.
+enabled:  # @schema type: [boolean, null]; description: No effect - reserved for use in sub-charting

From 630dfc767ac4359fa91ef5e200c446a6538dcf22 Mon Sep 17 00:00:00 2001
From: Mattia Eleuteri <mattia.eleuteri@hidora.io>
Date: Tue, 10 Mar 2026 16:56:50 +0100
Subject: [PATCH 246/666] [tenant] Allow egress to virt-handler for VM metrics
 scraping

- Add CiliumClusterwideNetworkPolicy for vmagent egress to virt-handler
- Restrict endpointSelector to vmagent pods only via app.kubernetes.io/name label

Signed-off-by: Mattia Eleuteri <mattia.eleuteri@hidora.io>
Signed-off-by: mattia-eleuteri <mattia@hidora.io>
---
 .../apps/tenant/templates/networkpolicy.yaml  | 21 +++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/packages/apps/tenant/templates/networkpolicy.yaml b/packages/apps/tenant/templates/networkpolicy.yaml
index d9f87856..ce3e33ab 100644
--- a/packages/apps/tenant/templates/networkpolicy.yaml
+++ b/packages/apps/tenant/templates/networkpolicy.yaml
@@ -207,6 +207,27 @@ spec:
   - toEndpoints:
       - matchLabels:
           "k8s:io.kubernetes.pod.namespace": cozy-kubevirt-cdi
+{{- if .Values.monitoring }}
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: {{ include "tenant.name" . }}-egress-virt-handler
+spec:
+  endpointSelector:
+    matchLabels:
+      "k8s:io.kubernetes.pod.namespace": "{{ include "tenant.name" . }}"
+      "k8s:app.kubernetes.io/name": "vmagent"
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        "k8s:kubevirt.io": "virt-handler"
+        "k8s:io.kubernetes.pod.namespace": "cozy-kubevirt"
+    toPorts:
+    - ports:
+      - port: "8443"
+        protocol: TCP
+{{- end }}
 ---
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy

From e08c895a09e22b93997513ef15f784215a6f2ab3 Mon Sep 17 00:00:00 2001
From: Mattia Eleuteri <mattia.eleuteri@hidora.io>
Date: Tue, 10 Mar 2026 15:58:30 +0100
Subject: [PATCH 247/666] [monitoring] Scope infrastructure dashboards to
 tenant-root only

Signed-off-by: Mattia Eleuteri <mattia@hidora.io>
Signed-off-by: mattia-eleuteri <mattia@hidora.io>
---
 .../system/monitoring/dashboards-infra.list   | 34 +++++++++++++++++++
 packages/system/monitoring/dashboards.list    | 34 -------------------
 .../monitoring/templates/dashboards.yaml      | 18 ++++++++++
 3 files changed, 52 insertions(+), 34 deletions(-)
 create mode 100644 packages/system/monitoring/dashboards-infra.list

diff --git a/packages/system/monitoring/dashboards-infra.list b/packages/system/monitoring/dashboards-infra.list
new file mode 100644
index 00000000..b5b9f52a
--- /dev/null
+++ b/packages/system/monitoring/dashboards-infra.list
@@ -0,0 +1,34 @@
+main/controller
+main/namespaces
+main/capacity-planning
+main/ntp
+main/namespace
+main/pod
+main/volumes
+main/node
+main/nodes
+control-plane/control-plane-status
+control-plane/deprecated-resources
+control-plane/dns-coredns
+control-plane/kube-etcd
+victoria-metrics/vmalert
+victoria-metrics/vmagent
+victoria-metrics/victoriametrics-cluster
+victoria-metrics/backupmanager
+victoria-metrics/victoriametrics
+victoria-metrics/operator
+dotdc/k8s-views-global
+dotdc/k8s-views-namespaces
+dotdc/k8s-system-coredns
+dotdc/k8s-views-pods
+flux/flux-control-plane
+flux/flux-stats
+kubevirt/kubevirt-control-plane
+goldpinger/goldpinger
+cache/nginx-vts-stats
+storage/linstor
+seaweedfs/seaweedfs
+hubble/overview
+hubble/dns-namespace
+hubble/l7-http-metrics
+hubble/network-overview
diff --git a/packages/system/monitoring/dashboards.list b/packages/system/monitoring/dashboards.list
index 34aead18..aee8c2dc 100644
--- a/packages/system/monitoring/dashboards.list
+++ b/packages/system/monitoring/dashboards.list
@@ -1,14 +1,3 @@
-dotdc/k8s-views-global
-dotdc/k8s-views-namespaces
-dotdc/k8s-system-coredns
-dotdc/k8s-views-pods
-cache/nginx-vts-stats
-victoria-metrics/vmalert
-victoria-metrics/vmagent
-victoria-metrics/victoriametrics-cluster
-victoria-metrics/backupmanager
-victoria-metrics/victoriametrics
-victoria-metrics/operator
 ingress/controller-detail
 ingress/controllers
 ingress/namespaces
@@ -18,31 +7,8 @@ ingress/namespace-detail
 db/cloudnativepg
 db/maria-db
 db/redis
-main/controller
-main/namespaces
-main/capacity-planning
-main/ntp
-main/namespace
-main/pod
-main/volumes
-main/node
-main/nodes
-control-plane/control-plane-status
-control-plane/deprecated-resources
-control-plane/dns-coredns
-control-plane/kube-etcd
-kubevirt/kubevirt-control-plane
-flux/flux-control-plane
-flux/flux-stats
 kafka/strimzi-kafka
-goldpinger/goldpinger
 clickhouse/altinity-clickhouse-operator-dashboard
-storage/linstor
-seaweedfs/seaweedfs
-hubble/overview
-hubble/dns-namespace
-hubble/l7-http-metrics
-hubble/network-overview
 nats/nats-jetstream
 nats/nats-server
 mongodb/mongodb-overview
diff --git a/packages/system/monitoring/templates/dashboards.yaml b/packages/system/monitoring/templates/dashboards.yaml
index 3872f9b7..01f1c009 100644
--- a/packages/system/monitoring/templates/dashboards.yaml
+++ b/packages/system/monitoring/templates/dashboards.yaml
@@ -14,3 +14,21 @@ spec:
   url: http://grafana-dashboards.cozy-grafana-operator.svc/{{ . }}.json
 {{- end }}
 {{- end }}
+{{- if eq .Release.Namespace "tenant-root" }}
+{{- range (split "\n" (.Files.Get "dashboards-infra.list")) }}
+{{- $parts := split "/" . }}
+{{- if eq (len $parts) 2 }}
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: {{ $parts._0 }}-{{ $parts._1 }}
+spec:
+  folder: {{ $parts._0 }}
+  instanceSelector:
+    matchLabels:
+      dashboards: grafana
+  url: http://grafana-dashboards.cozy-grafana-operator.svc/{{ . }}.json
+{{- end }}
+{{- end }}
+{{- end }}

From b772475ad5fc2c60184e75e8c8bce35d57c36218 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Tue, 10 Mar 2026 22:06:50 +0500
Subject: [PATCH 248/666] fix(e2e): update VLogs to VLCluster resource in
 tenant monitoring test

After migrating VictoriaLogs from VLogs to VLCluster, the e2e test
still waited for the old vlogs/generic resource which no longer exists.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 hack/e2e-install-cozystack.bats | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hack/e2e-install-cozystack.bats b/hack/e2e-install-cozystack.bats
index 43b8ab8f..cc1aa8b7 100644
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -175,7 +175,7 @@ EOF
 
   # VictoriaMetrics components
   kubectl wait vmalert/vmalert-shortterm vmalertmanager/alertmanager -n tenant-root --for=jsonpath='{.status.updateStatus}'=operational --timeout=15m
-  kubectl wait vlogs/generic -n tenant-root --for=jsonpath='{.status.updateStatus}'=operational --timeout=5m
+  kubectl wait vlclusters/generic -n tenant-root --for=jsonpath='{.status.updateStatus}'=operational --timeout=5m
   kubectl wait vmcluster/shortterm vmcluster/longterm -n tenant-root --for=jsonpath='{.status.clusterStatus}'=operational --timeout=5m
 
   # Grafana

From 1dd27f6b23868320103d1f901fbcf17d04be4eaf Mon Sep 17 00:00:00 2001
From: Timofei Larkin <lllamnyp@gmail.com>
Date: Tue, 10 Mar 2026 22:39:46 +0300
Subject: [PATCH 249/666] [cozystack-scheduler] Add custom scheduler as an
 optional system package

## What this PR does

Adds the cozystack-scheduler as an optional system package, vendored from
https://github.com/cozystack/cozystack-scheduler. The scheduler extends
the default kube-scheduler with SchedulingClass-aware affinity plugins,
allowing platform operators to define cluster-wide scheduling constraints
via a SchedulingClass CRD. Pods opt in via the
`scheduler.cozystack.io/scheduling-class` annotation.

The package includes:
- Helm chart with RBAC, ConfigMap, Deployment, and CRD
- PackageSource definition for the cozystack package system
- Optional inclusion in the platform system bundle

### Release note

```release-note
[cozystack-scheduler] Add cozystack-scheduler as an optional system
package. The custom scheduler supports SchedulingClass CRDs for
cluster-wide node affinity, pod affinity, and topology spread constraints.
```

Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
---
 .../platform/sources/cozystack-scheduler.yaml |   19 +
 .../platform/templates/bundles/system.yaml    |    1 +
 .../system/cozystack-scheduler/Chart.yaml     |    3 +
 packages/system/cozystack-scheduler/Makefile  |   10 +
 .../crds/cozystack.io_schedulingclasses.yaml  | 1123 +++++++++++++++++
 .../templates/clusterrole.yaml                |    9 +
 .../templates/clusterrolebinding.yaml         |   38 +
 .../templates/configmap.yaml                  |   54 +
 .../templates/deployment.yaml                 |   37 +
 .../templates/rolebinding.yaml                |   40 +
 .../templates/serviceaccount.yaml             |    5 +
 .../system/cozystack-scheduler/values.yaml    |    2 +
 12 files changed, 1341 insertions(+)
 create mode 100644 packages/core/platform/sources/cozystack-scheduler.yaml
 create mode 100644 packages/system/cozystack-scheduler/Chart.yaml
 create mode 100644 packages/system/cozystack-scheduler/Makefile
 create mode 100644 packages/system/cozystack-scheduler/crds/cozystack.io_schedulingclasses.yaml
 create mode 100644 packages/system/cozystack-scheduler/templates/clusterrole.yaml
 create mode 100644 packages/system/cozystack-scheduler/templates/clusterrolebinding.yaml
 create mode 100644 packages/system/cozystack-scheduler/templates/configmap.yaml
 create mode 100644 packages/system/cozystack-scheduler/templates/deployment.yaml
 create mode 100644 packages/system/cozystack-scheduler/templates/rolebinding.yaml
 create mode 100644 packages/system/cozystack-scheduler/templates/serviceaccount.yaml
 create mode 100644 packages/system/cozystack-scheduler/values.yaml

diff --git a/packages/core/platform/sources/cozystack-scheduler.yaml b/packages/core/platform/sources/cozystack-scheduler.yaml
new file mode 100644
index 00000000..af4c8338
--- /dev/null
+++ b/packages/core/platform/sources/cozystack-scheduler.yaml
@@ -0,0 +1,19 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.cozystack-scheduler
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+    path: /
+  variants:
+  - name: default
+    components:
+    - name: cozystack-scheduler
+      path: system/cozystack-scheduler
+      install:
+        namespace: kube-system
+        releaseName: cozystack-scheduler
diff --git a/packages/core/platform/templates/bundles/system.yaml b/packages/core/platform/templates/bundles/system.yaml
index c24726ef..72e5331e 100644
--- a/packages/core/platform/templates/bundles/system.yaml
+++ b/packages/core/platform/templates/bundles/system.yaml
@@ -155,5 +155,6 @@
 {{include "cozystack.platform.package.default" (list "cozystack.bootbox" $) }}
 {{- end }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.hetzner-robotlb" $) }}
+{{include "cozystack.platform.package.optional.default" (list "cozystack.cozystack-scheduler" $) }}
 
 {{- end }}
diff --git a/packages/system/cozystack-scheduler/Chart.yaml b/packages/system/cozystack-scheduler/Chart.yaml
new file mode 100644
index 00000000..7c99eaf0
--- /dev/null
+++ b/packages/system/cozystack-scheduler/Chart.yaml
@@ -0,0 +1,3 @@
+apiVersion: v2
+name: cozy-cozystack-scheduler
+version: 0.1.0
diff --git a/packages/system/cozystack-scheduler/Makefile b/packages/system/cozystack-scheduler/Makefile
new file mode 100644
index 00000000..dc48eefe
--- /dev/null
+++ b/packages/system/cozystack-scheduler/Makefile
@@ -0,0 +1,10 @@
+export NAME=cozystack-scheduler
+export NAMESPACE=kube-system
+
+include ../../../hack/package.mk
+
+update:
+	rm -rf crds templates values.yaml Chart.yaml
+	tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/cozystack/cozystack-scheduler | awk -F'[/^]' 'END{print $$3}') && \
+	curl -sSL https://github.com/cozystack/cozystack-scheduler/archive/refs/tags/$${tag}.tar.gz | \
+	tar xzvf - --strip 2 cozystack-scheduler-$${tag#*v}/chart
diff --git a/packages/system/cozystack-scheduler/crds/cozystack.io_schedulingclasses.yaml b/packages/system/cozystack-scheduler/crds/cozystack.io_schedulingclasses.yaml
new file mode 100644
index 00000000..d6b60d8b
--- /dev/null
+++ b/packages/system/cozystack-scheduler/crds/cozystack.io_schedulingclasses.yaml
@@ -0,0 +1,1123 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.19.0
+  name: schedulingclasses.cozystack.io
+spec:
+  group: cozystack.io
+  names:
+    kind: SchedulingClass
+    listKind: SchedulingClassList
+    plural: schedulingclasses
+    singular: schedulingclass
+  scope: Cluster
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              nodeAffinity:
+                description: Node affinity is a group of node affinity scheduling
+                  rules.
+                properties:
+                  preferredDuringSchedulingIgnoredDuringExecution:
+                    description: |-
+                      The scheduler will prefer to schedule pods to nodes that satisfy
+                      the affinity expressions specified by this field, but it may choose
+                      a node that violates one or more of the expressions. The node that is
+                      most preferred is the one with the greatest sum of weights, i.e.
+                      for each node that meets all of the scheduling requirements (resource
+                      request, requiredDuringScheduling affinity expressions, etc.),
+                      compute a sum by iterating through the elements of this field and adding
+                      "weight" to the sum if the node matches the corresponding matchExpressions; the
+                      node(s) with the highest sum are the most preferred.
+                    items:
+                      description: |-
+                        An empty preferred scheduling term matches all objects with implicit weight 0
+                        (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+                      properties:
+                        preference:
+                          description: A node selector term, associated with the corresponding
+                            weight.
+                          properties:
+                            matchExpressions:
+                              description: A list of node selector requirements by
+                                node's labels.
+                              items:
+                                description: |-
+                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                  that relates the key and values.
+                                properties:
+                                  key:
+                                    description: The label key that the selector applies
+                                      to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      Represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                    type: string
+                                  values:
+                                    description: |-
+                                      An array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                      array must have a single element, which will be interpreted as an integer.
+                                      This array is replaced during a strategic merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchFields:
+                              description: A list of node selector requirements by
+                                node's fields.
+                              items:
+                                description: |-
+                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                  that relates the key and values.
+                                properties:
+                                  key:
+                                    description: The label key that the selector applies
+                                      to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      Represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                    type: string
+                                  values:
+                                    description: |-
+                                      An array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                      array must have a single element, which will be interpreted as an integer.
+                                      This array is replaced during a strategic merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        weight:
+                          description: Weight associated with matching the corresponding
+                            nodeSelectorTerm, in the range 1-100.
+                          format: int32
+                          type: integer
+                      required:
+                      - preference
+                      - weight
+                      type: object
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  requiredDuringSchedulingIgnoredDuringExecution:
+                    description: |-
+                      If the affinity requirements specified by this field are not met at
+                      scheduling time, the pod will not be scheduled onto the node.
+                      If the affinity requirements specified by this field cease to be met
+                      at some point during pod execution (e.g. due to an update), the system
+                      may or may not try to eventually evict the pod from its node.
+                    properties:
+                      nodeSelectorTerms:
+                        description: Required. A list of node selector terms. The
+                          terms are ORed.
+                        items:
+                          description: |-
+                            A null or empty node selector term matches no objects. The requirements of
+                            them are ANDed.
+                            The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+                          properties:
+                            matchExpressions:
+                              description: A list of node selector requirements by
+                                node's labels.
+                              items:
+                                description: |-
+                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                  that relates the key and values.
+                                properties:
+                                  key:
+                                    description: The label key that the selector applies
+                                      to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      Represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                    type: string
+                                  values:
+                                    description: |-
+                                      An array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                      array must have a single element, which will be interpreted as an integer.
+                                      This array is replaced during a strategic merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchFields:
+                              description: A list of node selector requirements by
+                                node's fields.
+                              items:
+                                description: |-
+                                  A node selector requirement is a selector that contains values, a key, and an operator
+                                  that relates the key and values.
+                                properties:
+                                  key:
+                                    description: The label key that the selector applies
+                                      to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      Represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                    type: string
+                                  values:
+                                    description: |-
+                                      An array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. If the operator is Gt or Lt, the values
+                                      array must have a single element, which will be interpreted as an integer.
+                                      This array is replaced during a strategic merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        type: array
+                        x-kubernetes-list-type: atomic
+                    required:
+                    - nodeSelectorTerms
+                    type: object
+                    x-kubernetes-map-type: atomic
+                type: object
+              nodeSelector:
+                additionalProperties:
+                  type: string
+                type: object
+              podAffinity:
+                description: Pod affinity is a group of inter pod affinity scheduling
+                  rules.
+                properties:
+                  preferredDuringSchedulingIgnoredDuringExecution:
+                    description: |-
+                      The scheduler will prefer to schedule pods to nodes that satisfy
+                      the affinity expressions specified by this field, but it may choose
+                      a node that violates one or more of the expressions. The node that is
+                      most preferred is the one with the greatest sum of weights, i.e.
+                      for each node that meets all of the scheduling requirements (resource
+                      request, requiredDuringScheduling affinity expressions, etc.),
+                      compute a sum by iterating through the elements of this field and adding
+                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                      node(s) with the highest sum are the most preferred.
+                    items:
+                      description: The weights of all of the matched WeightedPodAffinityTerm
+                        fields are added per-node to find the most preferred node(s)
+                      properties:
+                        podAffinityTerm:
+                          description: Required. A pod affinity term, associated with
+                            the corresponding weight.
+                          properties:
+                            labelSelector:
+                              description: |-
+                                A label query over a set of resources, in this case pods.
+                                If it's null, this PodAffinityTerm matches with no Pods.
+                              properties:
+                                matchExpressions:
+                                  description: matchExpressions is a list of label
+                                    selector requirements. The requirements are ANDed.
+                                  items:
+                                    description: |-
+                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                      relates the key and values.
+                                    properties:
+                                      key:
+                                        description: key is the label key that the
+                                          selector applies to.
+                                        type: string
+                                      operator:
+                                        description: |-
+                                          operator represents a key's relationship to a set of values.
+                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          values is an array of string values. If the operator is In or NotIn,
+                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                          the values array must be empty. This array is replaced during a strategic
+                                          merge patch.
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    required:
+                                    - key
+                                    - operator
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                matchLabels:
+                                  additionalProperties:
+                                    type: string
+                                  description: |-
+                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                  type: object
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            matchLabelKeys:
+                              description: |-
+                                MatchLabelKeys is a set of pod label keys to select which pods will
+                                be taken into consideration. The keys are used to lookup values from the
+                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                to select the group of existing pods which pods will be taken into consideration
+                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                pod labels will be ignored. The default value is empty.
+                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            mismatchLabelKeys:
+                              description: |-
+                                MismatchLabelKeys is a set of pod label keys to select which pods will
+                                be taken into consideration. The keys are used to lookup values from the
+                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                to select the group of existing pods which pods will be taken into consideration
+                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                pod labels will be ignored. The default value is empty.
+                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            namespaceSelector:
+                              description: |-
+                                A label query over the set of namespaces that the term applies to.
+                                The term is applied to the union of the namespaces selected by this field
+                                and the ones listed in the namespaces field.
+                                null selector and null or empty namespaces list means "this pod's namespace".
+                                An empty selector ({}) matches all namespaces.
+                              properties:
+                                matchExpressions:
+                                  description: matchExpressions is a list of label
+                                    selector requirements. The requirements are ANDed.
+                                  items:
+                                    description: |-
+                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                      relates the key and values.
+                                    properties:
+                                      key:
+                                        description: key is the label key that the
+                                          selector applies to.
+                                        type: string
+                                      operator:
+                                        description: |-
+                                          operator represents a key's relationship to a set of values.
+                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          values is an array of string values. If the operator is In or NotIn,
+                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                          the values array must be empty. This array is replaced during a strategic
+                                          merge patch.
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    required:
+                                    - key
+                                    - operator
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                matchLabels:
+                                  additionalProperties:
+                                    type: string
+                                  description: |-
+                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                  type: object
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            namespaces:
+                              description: |-
+                                namespaces specifies a static list of namespace names that the term applies to.
+                                The term is applied to the union of the namespaces listed in this field
+                                and the ones selected by namespaceSelector.
+                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            topologyKey:
+                              description: |-
+                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                whose value of the label with key topologyKey matches that of any node on which any of the
+                                selected pods is running.
+                                Empty topologyKey is not allowed.
+                              type: string
+                          required:
+                          - topologyKey
+                          type: object
+                        weight:
+                          description: |-
+                            weight associated with matching the corresponding podAffinityTerm,
+                            in the range 1-100.
+                          format: int32
+                          type: integer
+                      required:
+                      - podAffinityTerm
+                      - weight
+                      type: object
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  requiredDuringSchedulingIgnoredDuringExecution:
+                    description: |-
+                      If the affinity requirements specified by this field are not met at
+                      scheduling time, the pod will not be scheduled onto the node.
+                      If the affinity requirements specified by this field cease to be met
+                      at some point during pod execution (e.g. due to a pod label update), the
+                      system may or may not try to eventually evict the pod from its node.
+                      When there are multiple elements, the lists of nodes corresponding to each
+                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                    items:
+                      description: |-
+                        Defines a set of pods (namely those matching the labelSelector
+                        relative to the given namespace(s)) that this pod should be
+                        co-located (affinity) or not co-located (anti-affinity) with,
+                        where co-located is defined as running on a node whose value of
+                        the label with key <topologyKey> matches that of any node on which
+                        a pod of the set of pods is running
+                      properties:
+                        labelSelector:
+                          description: |-
+                            A label query over a set of resources, in this case pods.
+                            If it's null, this PodAffinityTerm matches with no Pods.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        matchLabelKeys:
+                          description: |-
+                            MatchLabelKeys is a set of pod label keys to select which pods will
+                            be taken into consideration. The keys are used to lookup values from the
+                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                            to select the group of existing pods which pods will be taken into consideration
+                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                            pod labels will be ignored. The default value is empty.
+                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        mismatchLabelKeys:
+                          description: |-
+                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                            be taken into consideration. The keys are used to lookup values from the
+                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                            to select the group of existing pods which pods will be taken into consideration
+                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                            pod labels will be ignored. The default value is empty.
+                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        namespaceSelector:
+                          description: |-
+                            A label query over the set of namespaces that the term applies to.
+                            The term is applied to the union of the namespaces selected by this field
+                            and the ones listed in the namespaces field.
+                            null selector and null or empty namespaces list means "this pod's namespace".
+                            An empty selector ({}) matches all namespaces.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        namespaces:
+                          description: |-
+                            namespaces specifies a static list of namespace names that the term applies to.
+                            The term is applied to the union of the namespaces listed in this field
+                            and the ones selected by namespaceSelector.
+                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        topologyKey:
+                          description: |-
+                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                            whose value of the label with key topologyKey matches that of any node on which any of the
+                            selected pods is running.
+                            Empty topologyKey is not allowed.
+                          type: string
+                      required:
+                      - topologyKey
+                      type: object
+                    type: array
+                    x-kubernetes-list-type: atomic
+                type: object
+              podAntiAffinity:
+                description: Pod anti affinity is a group of inter pod anti affinity
+                  scheduling rules.
+                properties:
+                  preferredDuringSchedulingIgnoredDuringExecution:
+                    description: |-
+                      The scheduler will prefer to schedule pods to nodes that satisfy
+                      the anti-affinity expressions specified by this field, but it may choose
+                      a node that violates one or more of the expressions. The node that is
+                      most preferred is the one with the greatest sum of weights, i.e.
+                      for each node that meets all of the scheduling requirements (resource
+                      request, requiredDuringScheduling anti-affinity expressions, etc.),
+                      compute a sum by iterating through the elements of this field and adding
+                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                      node(s) with the highest sum are the most preferred.
+                    items:
+                      description: The weights of all of the matched WeightedPodAffinityTerm
+                        fields are added per-node to find the most preferred node(s)
+                      properties:
+                        podAffinityTerm:
+                          description: Required. A pod affinity term, associated with
+                            the corresponding weight.
+                          properties:
+                            labelSelector:
+                              description: |-
+                                A label query over a set of resources, in this case pods.
+                                If it's null, this PodAffinityTerm matches with no Pods.
+                              properties:
+                                matchExpressions:
+                                  description: matchExpressions is a list of label
+                                    selector requirements. The requirements are ANDed.
+                                  items:
+                                    description: |-
+                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                      relates the key and values.
+                                    properties:
+                                      key:
+                                        description: key is the label key that the
+                                          selector applies to.
+                                        type: string
+                                      operator:
+                                        description: |-
+                                          operator represents a key's relationship to a set of values.
+                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          values is an array of string values. If the operator is In or NotIn,
+                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                          the values array must be empty. This array is replaced during a strategic
+                                          merge patch.
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    required:
+                                    - key
+                                    - operator
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                matchLabels:
+                                  additionalProperties:
+                                    type: string
+                                  description: |-
+                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                  type: object
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            matchLabelKeys:
+                              description: |-
+                                MatchLabelKeys is a set of pod label keys to select which pods will
+                                be taken into consideration. The keys are used to lookup values from the
+                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                to select the group of existing pods which pods will be taken into consideration
+                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                pod labels will be ignored. The default value is empty.
+                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            mismatchLabelKeys:
+                              description: |-
+                                MismatchLabelKeys is a set of pod label keys to select which pods will
+                                be taken into consideration. The keys are used to lookup values from the
+                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                to select the group of existing pods which pods will be taken into consideration
+                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                pod labels will be ignored. The default value is empty.
+                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            namespaceSelector:
+                              description: |-
+                                A label query over the set of namespaces that the term applies to.
+                                The term is applied to the union of the namespaces selected by this field
+                                and the ones listed in the namespaces field.
+                                null selector and null or empty namespaces list means "this pod's namespace".
+                                An empty selector ({}) matches all namespaces.
+                              properties:
+                                matchExpressions:
+                                  description: matchExpressions is a list of label
+                                    selector requirements. The requirements are ANDed.
+                                  items:
+                                    description: |-
+                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                      relates the key and values.
+                                    properties:
+                                      key:
+                                        description: key is the label key that the
+                                          selector applies to.
+                                        type: string
+                                      operator:
+                                        description: |-
+                                          operator represents a key's relationship to a set of values.
+                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          values is an array of string values. If the operator is In or NotIn,
+                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                          the values array must be empty. This array is replaced during a strategic
+                                          merge patch.
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    required:
+                                    - key
+                                    - operator
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                matchLabels:
+                                  additionalProperties:
+                                    type: string
+                                  description: |-
+                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                  type: object
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            namespaces:
+                              description: |-
+                                namespaces specifies a static list of namespace names that the term applies to.
+                                The term is applied to the union of the namespaces listed in this field
+                                and the ones selected by namespaceSelector.
+                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            topologyKey:
+                              description: |-
+                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                whose value of the label with key topologyKey matches that of any node on which any of the
+                                selected pods is running.
+                                Empty topologyKey is not allowed.
+                              type: string
+                          required:
+                          - topologyKey
+                          type: object
+                        weight:
+                          description: |-
+                            weight associated with matching the corresponding podAffinityTerm,
+                            in the range 1-100.
+                          format: int32
+                          type: integer
+                      required:
+                      - podAffinityTerm
+                      - weight
+                      type: object
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  requiredDuringSchedulingIgnoredDuringExecution:
+                    description: |-
+                      If the anti-affinity requirements specified by this field are not met at
+                      scheduling time, the pod will not be scheduled onto the node.
+                      If the anti-affinity requirements specified by this field cease to be met
+                      at some point during pod execution (e.g. due to a pod label update), the
+                      system may or may not try to eventually evict the pod from its node.
+                      When there are multiple elements, the lists of nodes corresponding to each
+                      podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                    items:
+                      description: |-
+                        Defines a set of pods (namely those matching the labelSelector
+                        relative to the given namespace(s)) that this pod should be
+                        co-located (affinity) or not co-located (anti-affinity) with,
+                        where co-located is defined as running on a node whose value of
+                        the label with key <topologyKey> matches that of any node on which
+                        a pod of the set of pods is running
+                      properties:
+                        labelSelector:
+                          description: |-
+                            A label query over a set of resources, in this case pods.
+                            If it's null, this PodAffinityTerm matches with no Pods.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        matchLabelKeys:
+                          description: |-
+                            MatchLabelKeys is a set of pod label keys to select which pods will
+                            be taken into consideration. The keys are used to lookup values from the
+                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                            to select the group of existing pods which pods will be taken into consideration
+                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                            pod labels will be ignored. The default value is empty.
+                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        mismatchLabelKeys:
+                          description: |-
+                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                            be taken into consideration. The keys are used to lookup values from the
+                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                            to select the group of existing pods which pods will be taken into consideration
+                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                            pod labels will be ignored. The default value is empty.
+                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        namespaceSelector:
+                          description: |-
+                            A label query over the set of namespaces that the term applies to.
+                            The term is applied to the union of the namespaces selected by this field
+                            and the ones listed in the namespaces field.
+                            null selector and null or empty namespaces list means "this pod's namespace".
+                            An empty selector ({}) matches all namespaces.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        namespaces:
+                          description: |-
+                            namespaces specifies a static list of namespace names that the term applies to.
+                            The term is applied to the union of the namespaces listed in this field
+                            and the ones selected by namespaceSelector.
+                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        topologyKey:
+                          description: |-
+                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                            whose value of the label with key topologyKey matches that of any node on which any of the
+                            selected pods is running.
+                            Empty topologyKey is not allowed.
+                          type: string
+                      required:
+                      - topologyKey
+                      type: object
+                    type: array
+                    x-kubernetes-list-type: atomic
+                type: object
+              topologySpreadConstraints:
+                items:
+                  description: TopologySpreadConstraint specifies how to spread matching
+                    pods among the given topology.
+                  properties:
+                    labelSelector:
+                      description: |-
+                        LabelSelector is used to find matching pods.
+                        Pods that match this label selector are counted to determine the number of pods
+                        in their corresponding topology domain.
+                      properties:
+                        matchExpressions:
+                          description: matchExpressions is a list of label selector
+                            requirements. The requirements are ANDed.
+                          items:
+                            description: |-
+                              A label selector requirement is a selector that contains values, a key, and an operator that
+                              relates the key and values.
+                            properties:
+                              key:
+                                description: key is the label key that the selector
+                                  applies to.
+                                type: string
+                              operator:
+                                description: |-
+                                  operator represents a key's relationship to a set of values.
+                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                type: string
+                              values:
+                                description: |-
+                                  values is an array of string values. If the operator is In or NotIn,
+                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                  the values array must be empty. This array is replaced during a strategic
+                                  merge patch.
+                                items:
+                                  type: string
+                                type: array
+                                x-kubernetes-list-type: atomic
+                            required:
+                            - key
+                            - operator
+                            type: object
+                          type: array
+                          x-kubernetes-list-type: atomic
+                        matchLabels:
+                          additionalProperties:
+                            type: string
+                          description: |-
+                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                          type: object
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    matchLabelKeys:
+                      description: |-
+                        MatchLabelKeys is a set of pod label keys to select the pods over which
+                        spreading will be calculated. The keys are used to lookup values from the
+                        incoming pod labels, those key-value labels are ANDed with labelSelector
+                        to select the group of existing pods over which spreading will be calculated
+                        for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.
+                        MatchLabelKeys cannot be set when LabelSelector isn't set.
+                        Keys that don't exist in the incoming pod labels will
+                        be ignored. A null or empty list means only match against labelSelector.
+
+                        This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    maxSkew:
+                      description: |-
+                        MaxSkew describes the degree to which pods may be unevenly distributed.
+                        When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference
+                        between the number of matching pods in the target topology and the global minimum.
+                        The global minimum is the minimum number of matching pods in an eligible domain
+                        or zero if the number of eligible domains is less than MinDomains.
+                        For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same
+                        labelSelector spread as 2/2/1:
+                        In this case, the global minimum is 1.
+                        | zone1 | zone2 | zone3 |
+                        |  P P  |  P P  |   P   |
+                        - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2;
+                        scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2)
+                        violate MaxSkew(1).
+                        - if MaxSkew is 2, incoming pod can be scheduled onto any zone.
+                        When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence
+                        to topologies that satisfy it.
+                        It's a required field. Default value is 1 and 0 is not allowed.
+                      format: int32
+                      type: integer
+                    minDomains:
+                      description: |-
+                        MinDomains indicates a minimum number of eligible domains.
+                        When the number of eligible domains with matching topology keys is less than minDomains,
+                        Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed.
+                        And when the number of eligible domains with matching topology keys equals or greater than minDomains,
+                        this value has no effect on scheduling.
+                        As a result, when the number of eligible domains is less than minDomains,
+                        scheduler won't schedule more than maxSkew Pods to those domains.
+                        If value is nil, the constraint behaves as if MinDomains is equal to 1.
+                        Valid values are integers greater than 0.
+                        When value is not nil, WhenUnsatisfiable must be DoNotSchedule.
+
+                        For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same
+                        labelSelector spread as 2/2/2:
+                        | zone1 | zone2 | zone3 |
+                        |  P P  |  P P  |  P P  |
+                        The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0.
+                        In this situation, new pod with the same labelSelector cannot be scheduled,
+                        because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones,
+                        it will violate MaxSkew.
+                      format: int32
+                      type: integer
+                    nodeAffinityPolicy:
+                      description: |-
+                        NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector
+                        when calculating pod topology spread skew. Options are:
+                        - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.
+                        - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
+
+                        If this value is nil, the behavior is equivalent to the Honor policy.
+                      type: string
+                    nodeTaintsPolicy:
+                      description: |-
+                        NodeTaintsPolicy indicates how we will treat node taints when calculating
+                        pod topology spread skew. Options are:
+                        - Honor: nodes without taints, along with tainted nodes for which the incoming pod
+                        has a toleration, are included.
+                        - Ignore: node taints are ignored. All nodes are included.
+
+                        If this value is nil, the behavior is equivalent to the Ignore policy.
+                      type: string
+                    topologyKey:
+                      description: |-
+                        TopologyKey is the key of node labels. Nodes that have a label with this key
+                        and identical values are considered to be in the same topology.
+                        We consider each <key, value> as a "bucket", and try to put balanced number
+                        of pods into each bucket.
+                        We define a domain as a particular instance of a topology.
+                        Also, we define an eligible domain as a domain whose nodes meet the requirements of
+                        nodeAffinityPolicy and nodeTaintsPolicy.
+                        e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology.
+                        And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology.
+                        It's a required field.
+                      type: string
+                    whenUnsatisfiable:
+                      description: |-
+                        WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy
+                        the spread constraint.
+                        - DoNotSchedule (default) tells the scheduler not to schedule it.
+                        - ScheduleAnyway tells the scheduler to schedule the pod in any location,
+                          but giving higher precedence to topologies that would help reduce the
+                          skew.
+                        A constraint is considered "Unsatisfiable" for an incoming pod
+                        if and only if every possible node assignment for that pod would violate
+                        "MaxSkew" on some topology.
+                        For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same
+                        labelSelector spread as 3/1/1:
+                        | zone1 | zone2 | zone3 |
+                        | P P P |   P   |   P   |
+                        If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled
+                        to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies
+                        MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler
+                        won't make it *more* imbalanced.
+                        It's a required field.
+                      type: string
+                  required:
+                  - maxSkew
+                  - topologyKey
+                  - whenUnsatisfiable
+                  type: object
+                type: array
+            type: object
+        type: object
+    served: true
+    storage: true
diff --git a/packages/system/cozystack-scheduler/templates/clusterrole.yaml b/packages/system/cozystack-scheduler/templates/clusterrole.yaml
new file mode 100644
index 00000000..22f196a5
--- /dev/null
+++ b/packages/system/cozystack-scheduler/templates/clusterrole.yaml
@@ -0,0 +1,9 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cozystack-scheduler
+rules:
+  - apiGroups: ["cozystack.io"]
+    resources:
+      - schedulingclasses
+    verbs: ["get", "list", "watch"]
diff --git a/packages/system/cozystack-scheduler/templates/clusterrolebinding.yaml b/packages/system/cozystack-scheduler/templates/clusterrolebinding.yaml
new file mode 100644
index 00000000..00fcd968
--- /dev/null
+++ b/packages/system/cozystack-scheduler/templates/clusterrolebinding.yaml
@@ -0,0 +1,38 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cozystack-scheduler:kube-scheduler
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:kube-scheduler
+subjects:
+  - kind: ServiceAccount
+    name: cozystack-scheduler
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cozystack-scheduler:volume-scheduler
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:volume-scheduler
+subjects:
+  - kind: ServiceAccount
+    name: cozystack-scheduler
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cozystack-scheduler
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cozystack-scheduler
+subjects:
+  - kind: ServiceAccount
+    name: cozystack-scheduler
+    namespace: {{ .Release.Namespace }}
diff --git a/packages/system/cozystack-scheduler/templates/configmap.yaml b/packages/system/cozystack-scheduler/templates/configmap.yaml
new file mode 100644
index 00000000..1d78b225
--- /dev/null
+++ b/packages/system/cozystack-scheduler/templates/configmap.yaml
@@ -0,0 +1,54 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cozystack-scheduler-config
+  namespace: {{ .Release.Namespace }}
+data:
+  scheduler-config.yaml: |
+    apiVersion: kubescheduler.config.k8s.io/v1
+    kind: KubeSchedulerConfiguration
+    leaderElection:
+      leaderElect: true
+      resourceNamespace: {{ .Release.Namespace }}
+      resourceName: cozystack-scheduler
+    profiles:
+      - schedulerName: cozystack-scheduler
+        plugins:
+          preFilter:
+            disabled:
+              - name: InterPodAffinity
+              - name: NodeAffinity
+              - name: PodTopologySpread
+            enabled:
+              - name: CozystackInterPodAffinity
+              - name: CozystackNodeAffinity
+              - name: CozystackPodTopologySpread
+              - name: CozystackSchedulingClass
+          filter:
+            disabled:
+              - name: InterPodAffinity
+              - name: NodeAffinity
+              - name: PodTopologySpread
+            enabled:
+              - name: CozystackInterPodAffinity
+              - name: CozystackNodeAffinity
+              - name: CozystackPodTopologySpread
+              - name: CozystackSchedulingClass
+          preScore:
+            disabled:
+              - name: InterPodAffinity
+              - name: NodeAffinity
+              - name: PodTopologySpread
+            enabled:
+              - name: CozystackInterPodAffinity
+              - name: CozystackNodeAffinity
+              - name: CozystackPodTopologySpread
+          score:
+            disabled:
+              - name: InterPodAffinity
+              - name: NodeAffinity
+              - name: PodTopologySpread
+            enabled:
+              - name: CozystackInterPodAffinity
+              - name: CozystackNodeAffinity
+              - name: CozystackPodTopologySpread
diff --git a/packages/system/cozystack-scheduler/templates/deployment.yaml b/packages/system/cozystack-scheduler/templates/deployment.yaml
new file mode 100644
index 00000000..4be389cc
--- /dev/null
+++ b/packages/system/cozystack-scheduler/templates/deployment.yaml
@@ -0,0 +1,37 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cozystack-scheduler
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: {{ .Values.replicas }}
+  selector:
+    matchLabels:
+      app: cozystack-scheduler
+  template:
+    metadata:
+      labels:
+        app: cozystack-scheduler
+    spec:
+      serviceAccountName: cozystack-scheduler
+      containers:
+        - name: cozystack-scheduler
+          image: {{ .Values.image }}
+          command:
+            - /cozystack-scheduler
+            - --config=/etc/kubernetes/scheduler-config.yaml
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 10259
+              scheme: HTTPS
+            initialDelaySeconds: 15
+          volumeMounts:
+            - name: config
+              mountPath: /etc/kubernetes/scheduler-config.yaml
+              subPath: scheduler-config.yaml
+              readOnly: true
+      volumes:
+        - name: config
+          configMap:
+            name: cozystack-scheduler-config
diff --git a/packages/system/cozystack-scheduler/templates/rolebinding.yaml b/packages/system/cozystack-scheduler/templates/rolebinding.yaml
new file mode 100644
index 00000000..796bf55c
--- /dev/null
+++ b/packages/system/cozystack-scheduler/templates/rolebinding.yaml
@@ -0,0 +1,40 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cozystack-scheduler:extension-apiserver-authentication-reader
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: extension-apiserver-authentication-reader
+subjects:
+  - kind: ServiceAccount
+    name: cozystack-scheduler
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cozystack-scheduler:leader-election
+  namespace: {{ .Release.Namespace }}
+rules:
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["create", "get", "list", "update", "watch"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leasecandidates"]
+    verbs: ["create", "get", "list", "update", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cozystack-scheduler:leader-election
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cozystack-scheduler:leader-election
+subjects:
+  - kind: ServiceAccount
+    name: cozystack-scheduler
+    namespace: {{ .Release.Namespace }}
diff --git a/packages/system/cozystack-scheduler/templates/serviceaccount.yaml b/packages/system/cozystack-scheduler/templates/serviceaccount.yaml
new file mode 100644
index 00000000..876e5f01
--- /dev/null
+++ b/packages/system/cozystack-scheduler/templates/serviceaccount.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cozystack-scheduler
+  namespace: {{ .Release.Namespace }}
diff --git a/packages/system/cozystack-scheduler/values.yaml b/packages/system/cozystack-scheduler/values.yaml
new file mode 100644
index 00000000..87086dc7
--- /dev/null
+++ b/packages/system/cozystack-scheduler/values.yaml
@@ -0,0 +1,2 @@
+image: ghcr.io/cozystack/cozystack/cozystack-scheduler:v0.1.0@sha256:5f7150c82177478467ff80628acb5a400291aff503364aa9e26fc346d79a73cf
+replicas: 1

From 12b34c737a080fd1d851a6a0764f52f85262109a Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Tue, 10 Mar 2026 20:39:12 +0000
Subject: [PATCH 250/666] docs: add changelog for v1.1.1

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.1.1.md | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 docs/changelogs/v1.1.1.md

diff --git a/docs/changelogs/v1.1.1.md b/docs/changelogs/v1.1.1.md
new file mode 100644
index 00000000..18bb6814
--- /dev/null
+++ b/docs/changelogs/v1.1.1.md
@@ -0,0 +1,23 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.1.1
+-->
+
+## Fixes
+
+* **[dashboard] Fix hidden MarketplacePanel resources appearing in sidebar menu**: The sidebar was generated independently from MarketplacePanels, always showing all resources regardless of their `hidden` state. Fixed by fetching MarketplacePanels during sidebar reconciliation and skipping resources where `hidden=true`, so hiding a resource from the marketplace also removes it from the sidebar navigation ([**@IvanHunters**](https://github.com/IvanHunters) in #2177, #2203).
+
+* **[dashboard] Fix disabled/hidden state overwritten on every MarketplacePanel reconciliation**: The controller was hardcoding `disabled=false` and `hidden=false` on every reconciliation, silently overwriting any user changes made through the dashboard UI. Fixed by reading and preserving the current `disabled`/`hidden` values from the existing resource before updating ([**@IvanHunters**](https://github.com/IvanHunters) in #2176, #2201).
+
+* **[dashboard] Fix External IPs factory EnrichedTable rendering**: The external-IPs table displayed empty rows because the factory used incorrect `EnrichedTable` properties. Replaced `clusterNamePartOfUrl` with `cluster` and changed `pathToItems` from array to dot-path string format, consistent with all other working `EnrichedTable` instances ([**@IvanHunters**](https://github.com/IvanHunters) in #2175, #2193).
+
+* **[platform] Fix VM MAC address not preserved during virtual-machine to vm-instance migration**: Kube-OVN reads MAC address exclusively from the pod annotation `ovn.kubernetes.io/mac_address`, not from the IP resource `spec.macAddress`. Without the annotation, migrated VMs received a new random MAC, breaking OS-level network configurations that match by MAC (e.g. netplan). Added a Helm `lookup` for the Kube-OVN IP resource in the vm-instance chart so that MAC and IP addresses are automatically injected as pod annotations when the resource exists ([**@sircthulhu**](https://github.com/sircthulhu) in #2169, #2190).
+
+* **[etcd-operator] Replace deprecated kube-rbac-proxy image**: The `gcr.io/kubebuilder/kube-rbac-proxy` image became unavailable after Google Container Registry was deprecated. Replaced it with `quay.io/brancz/kube-rbac-proxy` from the original upstream author, restoring etcd-operator functionality ([**@kvaps**](https://github.com/kvaps) in #2181, #2182).
+
+* **[migrations] Handle missing RabbitMQ CRD in migration 34**: Migration 34 failed with an error when the `rabbitmqs.apps.cozystack.io` CRD did not exist — which occurs on clusters where RabbitMQ was never installed. Added a CRD presence check before attempting to list resources so that migration 34 completes cleanly on such clusters ([**@IvanHunters**](https://github.com/IvanHunters) in #2168, #2180).
+
+* **[keycloak] Fix Keycloak crashloop due to misconfigured health probes**: Keycloak 26.x redirects all HTTP requests on port 8080 to the configured HTTPS hostname; since kubelet does not follow redirects, liveness and readiness probes failed causing a crashloop. Fixed by enabling `KC_HEALTH_ENABLED=true`, exposing management port 9000, and switching all probes to `/health/live` and `/health/ready` on port 9000. Also added a `startupProbe` for improved startup tolerance ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2162, #2179).
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.1.0...v1.1.1

From 7b0a5d216fced424a63240d7ada71545b50e449f Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Tue, 10 Mar 2026 20:44:49 +0000
Subject: [PATCH 251/666] docs: add changelog for v1.0.4

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.0.4.md | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 docs/changelogs/v1.0.4.md

diff --git a/docs/changelogs/v1.0.4.md b/docs/changelogs/v1.0.4.md
new file mode 100644
index 00000000..4c55e2f3
--- /dev/null
+++ b/docs/changelogs/v1.0.4.md
@@ -0,0 +1,25 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.0.4
+-->
+
+## Fixes
+
+* **[system] Fix Keycloak probe crashloop with management port health endpoints**: Fixed a crashloop where Keycloak 26.x was endlessly restarting because liveness and readiness probes were sending HTTP requests to port 8080. Keycloak 26.x redirects all requests on port 8080 to `KC_HOSTNAME` (HTTPS), and since kubelet does not follow redirects, probes failed, eventually triggering container restarts. The fix switches probes to the dedicated management port 9000 (`/health/live`, `/health/ready`) enabled via `KC_HEALTH_ENABLED=true`, exposes management port 9000, and adds a `startupProbe` with appropriate failure thresholds for better startup tolerance ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2162, #2178).
+
+* **[system] Fix etcd-operator deprecated kube-rbac-proxy image**: Replaced the deprecated `gcr.io/kubebuilder/kube-rbac-proxy:v0.16.0` image with `quay.io/brancz/kube-rbac-proxy:v0.18.1` in the vendored etcd-operator chart. The GCR-hosted image became unavailable after March 18, 2025, causing etcd-operator pods to fail on image pull ([**@kvaps**](https://github.com/kvaps) in #2181, #2183).
+
+* **[platform] Fix VM MAC address not preserved during virtual-machine to vm-instance migration**: During the `virtual-machine` → `vm-instance` migration (script 29), VM MAC addresses were not preserved. Kube-OVN reads MAC addresses exclusively from the pod annotation `ovn.kubernetes.io/mac_address`, not from `spec.macAddress` of the IP resource. Without this annotation, migrated VMs received a new random MAC address, breaking OS-level network configuration that matches by MAC (e.g., netplan). The fix adds a Helm `lookup` in the vm-instance chart template to read the Kube-OVN IP resource and automatically inject the MAC and IP addresses as pod annotations ([**@sircthulhu**](https://github.com/sircthulhu) in #2169, #2191).
+
+* **[dashboard] Fix External IPs page showing empty rows**: Fixed the External IPs administration page displaying empty rows instead of service data. The `EnrichedTable` configuration in the `external-ips` factory was using incorrect property names — replaced `clusterNamePartOfUrl` with `cluster` and changed `pathToItems` from array format to dot-path string format, matching the convention used by all other `EnrichedTable` instances ([**@IvanHunters**](https://github.com/IvanHunters) in #2175, #2192).
+
+* **[dashboard] Fix disabled/hidden state reset on MarketplacePanel reconciliation**: Fixed a bug where the dashboard controller was hardcoding `disabled=false` and `hidden=false` on every reconcile loop, overwriting changes made through the dashboard UI. Services disabled or hidden via the marketplace panel now correctly retain their state after controller reconciliation ([**@IvanHunters**](https://github.com/IvanHunters) in #2176, #2202).
+
+* **[dashboard] Fix hidden MarketplacePanel resources appearing in sidebar menu**: Fixed the sidebar navigation showing all resources regardless of their MarketplacePanel `hidden` state. The controller now fetches MarketplacePanels during sidebar reconciliation and filters out resources where `hidden=true`, ensuring that hiding a resource from the marketplace also removes it from the sidebar navigation. Listing failures are non-fatal — if the configuration fetch fails, no hiding is applied and the dashboard remains functional ([**@IvanHunters**](https://github.com/IvanHunters) in #2177, #2204).
+
+## Documentation
+
+* **[website] Add OIDC self-signed certificates configuration guide**: Added a comprehensive guide for configuring OIDC authentication with Keycloak when using self-signed certificates (the default in Cozystack). Covers Talos machine configuration with certificate mounting and host entries, kubelogin setup instructions, and a troubleshooting section. The guide is available for both v0 and v1 versioned documentation paths ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#443).
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.3...v1.0.4

From 9e166300a7fa8815e58eb786e225bf587c753c73 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Wed, 11 Mar 2026 09:30:41 +0500
Subject: [PATCH 252/666] fix(e2e): update VMCluster status field after
 operator upgrade

The victoria-metrics-operator v0.68.1 renamed VMCluster status field
from .status.clusterStatus to .status.updateStatus.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 hack/e2e-install-cozystack.bats | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hack/e2e-install-cozystack.bats b/hack/e2e-install-cozystack.bats
index cc1aa8b7..9f64361b 100644
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -176,7 +176,7 @@ EOF
   # VictoriaMetrics components
   kubectl wait vmalert/vmalert-shortterm vmalertmanager/alertmanager -n tenant-root --for=jsonpath='{.status.updateStatus}'=operational --timeout=15m
   kubectl wait vlclusters/generic -n tenant-root --for=jsonpath='{.status.updateStatus}'=operational --timeout=5m
-  kubectl wait vmcluster/shortterm vmcluster/longterm -n tenant-root --for=jsonpath='{.status.clusterStatus}'=operational --timeout=5m
+  kubectl wait vmcluster/shortterm vmcluster/longterm -n tenant-root --for=jsonpath='{.status.updateStatus}'=operational --timeout=5m
 
   # Grafana
   kubectl wait clusters.postgresql.cnpg.io/grafana-db -n tenant-root --for=condition=ready --timeout=5m

From f5d8c89ddf70c488214f2796abb1e0ae2f2f3dbf Mon Sep 17 00:00:00 2001
From: Mattia Eleuteri <mattia.eleuteri@hidora.io>
Date: Tue, 10 Mar 2026 16:08:18 +0100
Subject: [PATCH 253/666] [monitoring] Add inlineScrapeConfig support to tenant
 vmagent

Signed-off-by: Mattia Eleuteri <mattia.eleuteri@hidora.io>
Signed-off-by: mattia-eleuteri <mattia@hidora.io>
---
 packages/extra/monitoring/values.yaml                | 4 ++++
 packages/system/monitoring/templates/vm/vmagent.yaml | 4 ++++
 packages/system/monitoring/values.yaml               | 6 +++++-
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/packages/extra/monitoring/values.yaml b/packages/extra/monitoring/values.yaml
index ab32b1b2..c521f389 100644
--- a/packages/extra/monitoring/values.yaml
+++ b/packages/extra/monitoring/values.yaml
@@ -178,3 +178,7 @@ vmagent:
     urls:
       - http://vminsert-shortterm:8480/insert/0/prometheus
       - http://vminsert-longterm:8480/insert/0/prometheus
+  ## inlineScrapeConfig: |
+  ##   - job_name: "custom"
+  ##     static_configs:
+  ##       - targets: ["my-service:9090"]
diff --git a/packages/system/monitoring/templates/vm/vmagent.yaml b/packages/system/monitoring/templates/vm/vmagent.yaml
index fb3edd30..c787376b 100644
--- a/packages/system/monitoring/templates/vm/vmagent.yaml
+++ b/packages/system/monitoring/templates/vm/vmagent.yaml
@@ -21,6 +21,10 @@ spec:
 
   scrapeInterval: 30s
   selectAllByDefault: false
+  {{- with .Values.vmagent.inlineScrapeConfig }}
+  inlineScrapeConfig: |
+    {{- . | nindent 4 }}
+  {{- end }}
   podScrapeNamespaceSelector:
     matchLabels:
       namespace.cozystack.io/monitoring: {{ .Release.Namespace }}
diff --git a/packages/system/monitoring/values.yaml b/packages/system/monitoring/values.yaml
index 564c654d..45b87cb1 100644
--- a/packages/system/monitoring/values.yaml
+++ b/packages/system/monitoring/values.yaml
@@ -79,4 +79,8 @@ vmagent:
   remoteWrite:
     urls:
       - http://vminsert-shortterm:8480/insert/0/prometheus
-      - http://vminsert-longterm:8480/insert/0/prometheus
\ No newline at end of file
+      - http://vminsert-longterm:8480/insert/0/prometheus
+  ## inlineScrapeConfig: |
+  ##   - job_name: "custom"
+  ##     static_configs:
+  ##       - targets: ["my-service:9090"]

From cfd57f8c1e0a3527b5f7940626e5478553ecdac4 Mon Sep 17 00:00:00 2001
From: Timofei Larkin <lllamnyp@gmail.com>
Date: Tue, 10 Mar 2026 23:32:13 +0300
Subject: [PATCH 254/666] [keycloak-operator] Update to v1.32.0

## What this PR does

Updates the Keycloak Operator Helm chart to v1.32.0 and builds a custom
operator image from upstream master (epam/edp-keycloak-operator@facbc36)
with the group rename detection patch from PR
epam/edp-keycloak-operator#309 applied on top.

Bumps Keycloak server from 26.0.4 to 26.5.2, which is required by the
new operator client (sends `description` field rejected by older versions).

Adds SSO session settings (idleTimeout: 86400, maxLifespan: 604800) to
the ClusterKeycloakRealm to match the dashboard client's session attributes,
as Keycloak 26 enforces realm-level session limits strictly.

Removes `authorizationServicesEnabled` from the dashboard KeycloakClient,
which is incompatible with Keycloak 26's stricter validation.

### Release note

```release-note
[keycloak-operator] Update the operator to v1.32.0 with group rename fix
(epam/edp-keycloak-operator#309). Bump Keycloak to 26.5.2.
```

Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
---
 .../dashboard/templates/keycloakclient.yaml   |   1 -
 .../templates/configure-kk.yaml               |   4 +
 packages/system/keycloak-operator/Makefile    |  11 +
 .../charts/keycloak-operator/Chart.yaml       |  19 +-
 .../charts/keycloak-operator/README.md        |  12 +-
 .../charts/keycloak-operator/README.md.gotmpl |   3 +-
 .../_crd_examples/clusterkeycloakrealm.yaml   |  22 +
 .../_crd_examples/keycloakclient.yaml         |   9 +-
 .../_crd_examples/keycloakclientscope.yaml    |   1 +
 .../keycloakorganizationorganization.yaml     |  45 ++
 .../_crd_examples/keycloakrealm.yaml          |  24 +-
 .../_crd_examples/keycloakrealmgroup.yaml     |  26 ++
 .../keycloakrealmidentityprovider.yaml        |  22 +-
 .../_crd_examples/keycloakrealmuser.yaml      |  21 +-
 .../keycloakrealmuser_password.yaml           |   2 +
 ...v1.edp.epam.com_clusterkeycloakrealms.yaml | 147 ++++++-
 .../v1.edp.epam.com_clusterkeycloaks.yaml     |  12 +-
 .../v1.edp.epam.com_keycloakauthflows.yaml    |  13 +-
 .../crds/v1.edp.epam.com_keycloakclients.yaml | 132 +++++-
 .../v1.edp.epam.com_keycloakclientscopes.yaml |  29 +-
 ...v1.edp.epam.com_keycloakorganizations.yaml | 149 +++++++
 ....edp.epam.com_keycloakrealmcomponents.yaml |  13 +-
 .../v1.edp.epam.com_keycloakrealmgroups.yaml  |  33 +-
 ...am.com_keycloakrealmidentityproviders.yaml |  43 +-
 ...edp.epam.com_keycloakrealmrolebatches.yaml |  13 +-
 .../v1.edp.epam.com_keycloakrealmroles.yaml   |  13 +-
 .../crds/v1.edp.epam.com_keycloakrealms.yaml  | 162 +++++++-
 .../v1.edp.epam.com_keycloakrealmusers.yaml   | 131 +++++-
 .../crds/v1.edp.epam.com_keycloaks.yaml       |  12 +-
 .../templates/clusterrole.yaml                |  26 ++
 .../templates/deployment.yaml                 |  51 ++-
 .../templates/operator_role.yaml              | 385 ++++--------------
 .../templates/webhook/certmanager.yaml        |  25 ++
 .../templates/webhook/manifest.yaml           |  78 ++++
 .../templates/webhook/rbac.yaml               |  33 ++
 .../templates/webhook/service.yaml            |  16 +
 .../charts/keycloak-operator/values.yaml      |  24 ++
 .../images/keycloak-operator/Dockerfile       |  29 ++
 .../keycloak-operator/patches/pr309.diff      | 187 +++++++++
 packages/system/keycloak-operator/values.yaml |   4 +
 packages/system/keycloak/values.yaml          |   2 +-
 41 files changed, 1540 insertions(+), 444 deletions(-)
 create mode 100644 packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakorganizationorganization.yaml
 create mode 100644 packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakorganizations.yaml
 create mode 100644 packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/certmanager.yaml
 create mode 100644 packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/manifest.yaml
 create mode 100644 packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/rbac.yaml
 create mode 100644 packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/service.yaml
 create mode 100644 packages/system/keycloak-operator/images/keycloak-operator/Dockerfile
 create mode 100644 packages/system/keycloak-operator/images/keycloak-operator/patches/pr309.diff

diff --git a/packages/system/dashboard/templates/keycloakclient.yaml b/packages/system/dashboard/templates/keycloakclient.yaml
index d8e47e8a..c9c17090 100644
--- a/packages/system/dashboard/templates/keycloakclient.yaml
+++ b/packages/system/dashboard/templates/keycloakclient.yaml
@@ -57,7 +57,6 @@ spec:
     kind: ClusterKeycloakRealm
   secret: $dashboard-client:client-secret-key
   advancedProtocolMappers: true
-  authorizationServicesEnabled: true
   name: dashboard
   clientId: dashboard
   directAccess: true
diff --git a/packages/system/keycloak-configure/templates/configure-kk.yaml b/packages/system/keycloak-configure/templates/configure-kk.yaml
index d2ed13d5..5d1d7f15 100644
--- a/packages/system/keycloak-configure/templates/configure-kk.yaml
+++ b/packages/system/keycloak-configure/templates/configure-kk.yaml
@@ -37,6 +37,10 @@ spec:
   displayHtmlName: {{ $brandingConfig.branding }}
   {{- end }}
   {{- end }}
+  sessions:
+    ssoSessionSettings:
+      idleTimeout: 86400
+      maxLifespan: 604800
 
 ---
 
diff --git a/packages/system/keycloak-operator/Makefile b/packages/system/keycloak-operator/Makefile
index 9c8d63c1..3386cf18 100644
--- a/packages/system/keycloak-operator/Makefile
+++ b/packages/system/keycloak-operator/Makefile
@@ -4,6 +4,17 @@ export NAMESPACE=cozy-keycloak
 include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
+image:
+	docker buildx build images/keycloak-operator \
+		--tag $(REGISTRY)/keycloak-operator:$(call settag,$(TAG)) \
+		--cache-from type=registry,ref=$(REGISTRY)/keycloak-operator:latest \
+		--cache-to   type=inline \
+		--metadata-file images/keycloak-operator.json \
+		$(BUILDX_ARGS)
+	TAG="$(call settag,$(TAG))@$$(yq e '."containerimage.digest"' images/keycloak-operator.json -r)" \
+		yq -i '.keycloak-operator.image.tag = strenv(TAG)' values.yaml
+	rm -f images/keycloak-operator.json
+
 update:
 	rm -rf charts
 	helm repo add epamedp https://epam.github.io/edp-helm-charts/stable
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/Chart.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/Chart.yaml
index f9d53963..5bd434ce 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/Chart.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/Chart.yaml
@@ -157,30 +157,29 @@ annotations:
     - apiVersion: v1.edp.epam.com/v1
       kind: KeycloakRealmIdentityProvider
       metadata:
-        name: instagram-test
+        name: github-test
       spec:
         realm: d2-id-k8s-realm-name
-        alias: instagram
+        alias: github
         authenticateByDefault: false
         enabled: true
         firstBrokerLoginFlowAlias: "first broker login"
-        providerId: "instagram"
+        providerId: "github"
         config:
           clientId: "foo"
           clientSecret: "bar"
-          hideOnLoginPage: "true"
           syncMode: "IMPORT"
           useJwksUrl: "true"
         mappers:
           - name: "test3212"
             identityProviderMapper: "oidc-hardcoded-role-idp-mapper"
-            identityProviderAlias: "instagram"
+            identityProviderAlias: "github"
             config:
               role: "role-tr"
               syncMode: "INHERIT"
           - name: "test-33221"
             identityProviderMapper: "hardcoded-attribute-idp-mapper"
-            identityProviderAlias: "instagram"
+            identityProviderAlias: "github"
             config:
               attribute: "foo"
               "attribute.value": "bar"
@@ -272,8 +271,8 @@ annotations:
         secret: secret-name-in-operator-ns
         url: https://keycloak.example.com
   artifacthub.io/images: |
-    - name: keycloak-operator:1.25.0
-      image: epamedp/keycloak-operator:1.25.0
+    - name: keycloak-operator:1.32.0
+      image: epamedp/keycloak-operator:1.32.0
   artifacthub.io/license: Apache-2.0
   artifacthub.io/links: |
     - name: KubeRocketCI Documentation
@@ -283,7 +282,7 @@ annotations:
   artifacthub.io/operator: "true"
   artifacthub.io/operatorCapabilities: Deep Insights
 apiVersion: v2
-appVersion: 1.25.0
+appVersion: 1.32.0
 description: A Helm chart for KubeRocketCI Keycloak Operator
 home: https://docs.kuberocketci.io/
 icon: https://docs.kuberocketci.io/img/logo.svg
@@ -308,4 +307,4 @@ name: keycloak-operator
 sources:
 - https://github.com/epam/edp-keycloak-operator
 type: application
-version: 1.25.0
+version: 1.32.0
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/README.md b/packages/system/keycloak-operator/charts/keycloak-operator/README.md
index abd23443..61355b59 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/README.md
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/README.md
@@ -1,6 +1,6 @@
 # keycloak-operator
 
-![Version: 1.25.0](https://img.shields.io/badge/Version-1.25.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.25.0](https://img.shields.io/badge/AppVersion-1.25.0-informational?style=flat-square)
+![Version: 1.32.0](https://img.shields.io/badge/Version-1.32.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.32.0](https://img.shields.io/badge/AppVersion-1.32.0-informational?style=flat-square)
 
 A Helm chart for KubeRocketCI Keycloak Operator
 
@@ -16,6 +16,7 @@ _**NOTE:** Operator is platform-independent, which is why there is a unified ins
 
 1. Linux machine or Windows Subsystem for Linux instance with [Helm 3](https://helm.sh/docs/intro/install/) installed;
 2. Cluster admin access to the cluster;
+3. [cert-manager](https://cert-manager.io/docs/installation/) installed in the cluster (required for webhook functionality, can be disabled via `enableWebhooks: false`);
 
 ## Installation Using Helm Chart
 
@@ -32,7 +33,7 @@ To install the Keycloak Operator, follow the steps below:
      ```bash
      helm search repo epamedp/keycloak-operator -l
      NAME                           CHART VERSION   APP VERSION     DESCRIPTION
-     epamedp/keycloak-operator      1.24.0          1.24.0          A Helm chart for KRCI Keycloak Operator
+     epamedp/keycloak-operator      1.31.0          1.31.0          A Helm chart for KRCI Keycloak Operator
      ```
 
     _**NOTE:** It is highly recommended to use the latest stable version._
@@ -129,14 +130,21 @@ Development versions are also available from the [snapshot helm chart repository
 |-----|------|---------|-------------|
 | affinity | object | `{}` | Affinity for pod assignment |
 | annotations | object | `{}` | Annotations to be added to the Deployment |
+| clusterDomain | string | `"cluster.local"` | Cluster domain for constructing service DNS names |
 | clusterReconciliationEnabled | bool | `false` | If clusterReconciliationEnabled is true, the operator reconciles all Keycloak instances in the cluster;  otherwise, it only reconciles instances in the same namespace by default, and cluster-scoped resources are ignored. |
+| containerSecurityContext | object | `{"allowPrivilegeEscalation":false}` | Container Security Context Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ |
+| enableOwnerRef | bool | `true` | If set to true, the operator will set the owner reference for all resources that have Keycloak or KeycloakRealm as reference. This is legacy behavior and not recommended for use. In the future, this will be set to false by default. |
+| enableWebhooks | bool | `true` | If set to true, enables webhook resources (ValidatingWebhookConfiguration, Service, and Certificate). Webhooks require cert-manager to be installed in the cluster. |
 | extraVolumeMounts | list | `[]` | Additional volumeMounts to be added to the container |
 | extraVolumes | list | `[]` | Additional volumes to be added to the pod |
+| image.registry | string | `""` | KubeRocketCI keycloak-operator Docker image registry. |
 | image.repository | string | `"epamedp/keycloak-operator"` | KubeRocketCI keycloak-operator Docker image name. The released image can be found on [Dockerhub](https://hub.docker.com/r/epamedp/keycloak-operator) |
 | image.tag | string | `nil` | KubeRocketCI keycloak-operator Docker image tag. The released image can be found on [Dockerhub](https://hub.docker.com/r/epamedp/keycloak-operator/tags) |
 | imagePullPolicy | string | `"IfNotPresent"` | If defined, a imagePullPolicy applied to the deployment |
 | imagePullSecrets | list | `[]` | If defined, imagePullSecrets are applied to deployment |
 | name | string | `"keycloak-operator"` | Application name string |
 | nodeSelector | object | `{}` | Node labels for pod assignment |
+| podLabels | object | `{}` | Labels to be added to the pod |
 | resources | object | `{"limits":{"memory":"192Mi"},"requests":{"cpu":"50m","memory":"64Mi"}}` | Resource limits and requests for the pod |
+| securityContext | object | `{"runAsNonRoot":true}` | Deployment Security Context Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ |
 | tolerations | list | `[]` | Node tolerations for server scheduling to nodes with taints |
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/README.md.gotmpl b/packages/system/keycloak-operator/charts/keycloak-operator/README.md.gotmpl
index 9dffecab..3b67933b 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/README.md.gotmpl
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/README.md.gotmpl
@@ -17,6 +17,7 @@ _**NOTE:** Operator is platform-independent, which is why there is a unified ins
 
 1. Linux machine or Windows Subsystem for Linux instance with [Helm 3](https://helm.sh/docs/intro/install/) installed;
 2. Cluster admin access to the cluster;
+3. [cert-manager](https://cert-manager.io/docs/installation/) installed in the cluster (required for webhook functionality, can be disabled via `enableWebhooks: false`);
 
 ## Installation Using Helm Chart
 
@@ -33,7 +34,7 @@ To install the Keycloak Operator, follow the steps below:
      ```bash
      helm search repo epamedp/keycloak-operator -l
      NAME                           CHART VERSION   APP VERSION     DESCRIPTION
-     epamedp/keycloak-operator      1.24.0          1.24.0          A Helm chart for KRCI Keycloak Operator
+     epamedp/keycloak-operator      1.31.0          1.31.0          A Helm chart for KRCI Keycloak Operator
      ```
 
     _**NOTE:** It is highly recommended to use the latest stable version._
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/clusterkeycloakrealm.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/clusterkeycloakrealm.yaml
index 20d7c6f4..287938b4 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/clusterkeycloakrealm.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/clusterkeycloakrealm.yaml
@@ -7,3 +7,25 @@ spec:
   realmName: realm-sample1234
   authenticationFlows:
     browserFlow: browserFlow-sample
+  login:
+    userRegistration: true
+    forgotPassword: true
+    rememberMe: true
+    emailAsUsername: false
+    loginWithEmail: true
+    duplicateEmails: false
+    verifyEmail: true
+    editUsername: false
+  sessions:
+    ssoLoginSettings:
+      accessCodeLifespanLogin: 1800      # 30 minutes
+      accessCodeLifespanUserAction: 300  # 5 minutes
+    ssoSessionSettings:
+      idleTimeout: 1800                  # 30 minutes
+      idleTimeoutRememberMe: 604800      # 7 days
+      maxLifespan: 36000                 # 10 hours
+      maxLifespanRememberMe: 2592000     # 30 days
+    ssoOfflineSessionSettings:
+      idleTimeout: 2592000               # 30 days
+      maxLifespan: 5184000               # 60 days
+      maxLifespanEnabled: true
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakclient.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakclient.yaml
index fdd9d018..97dde9c2 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakclient.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakclient.yaml
@@ -14,11 +14,16 @@ spec:
   webUrl: https://argocd.example.com
   adminUrl: https://admin.example.com
   homeUrl: /home/
-  defaultClientScopes:
-    - groups
   redirectUris:
     - /url1/*
     - /url2/*
+  clientRolesV2:
+    - name: roleA
+      description: "Role A"
+      associatedClientRoles:
+        - roleB
+    - name: roleB
+      description: "Role B"
 
 ---
 
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakclientscope.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakclientscope.yaml
index d19a317c..5b4c2d13 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakclientscope.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakclientscope.yaml
@@ -8,6 +8,7 @@ spec:
     name: keycloakrealm-sample
     kind: KeycloakRealm
   description: "Group Membership"
+  type: default
   protocol: openid-connect
   protocolMappers:
     - name: groups
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakorganizationorganization.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakorganizationorganization.yaml
new file mode 100644
index 00000000..506da761
--- /dev/null
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakorganizationorganization.yaml
@@ -0,0 +1,45 @@
+# Organization with identity provider configuration
+apiVersion: v1.edp.epam.com/v1alpha1
+kind: KeycloakOrganization
+metadata:
+  name: test-keycloak-organization
+  namespace: default
+spec:
+  name: "Test Organization"
+  alias: "test-org"
+  domains:
+    - "example.com"
+    - "test.com"
+  redirectUrl: "https://example.com/redirect"
+  description: "Test organization"
+  attributes:
+    department:
+      - "engineering"
+      - "qa"
+    location:
+      - "us-east"
+  identityProviders:
+    - alias: "test-org-idp"
+  realmRef:
+    kind: KeycloakRealm
+    name: test-org-realm
+
+---
+
+apiVersion: v1.edp.epam.com/v1
+kind: KeycloakRealmIdentityProvider
+metadata:
+  name: test-org-idp
+  namespace: default
+spec:
+  alias: "test-org-idp"
+  enabled: true
+  providerId: "github"
+  realmRef:
+    kind: KeycloakRealm
+    name: test-org-realm
+  config:
+    clientId: "test-org-client-id"
+    clientSecret: "test-org-client-secret"
+    kc.org.domain: "example.com"
+    kc.org.broker.redirect.mode.email-matches: "true"
\ No newline at end of file
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealm.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealm.yaml
index 4f6c080a..bd8771e5 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealm.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealm.yaml
@@ -3,7 +3,6 @@ kind: KeycloakRealm
 metadata:
   name: keycloakrealm-sample
 spec:
-  id: bfebeff6-ac63-4b46-a1f3-37df5099a9c4
   realmName: realm-sample
   keycloakRef:
     name: keycloak-sample
@@ -16,6 +15,7 @@ spec:
   realmEventConfig:
     adminEventsDetailsEnabled: false
     adminEventsEnabled: true
+    adminEventsExpiration: 544
     enabledEventTypes:
       - UPDATE_CONSENT_ERROR
       - CLIENT_LOGIN
@@ -32,6 +32,15 @@ spec:
     refreshTokenMaxReuse: 300
     revokeRefreshToken: true
     defaultSignatureAlgorithm: RS256
+  login:
+    userRegistration: true
+    forgotPassword: true
+    rememberMe: true
+    emailAsUsername: true
+    loginWithEmail: true
+    duplicateEmails: false
+    verifyEmail: true
+    editUsername: true
   userProfileConfig:
     unmanagedAttributePolicy: "ENABLED"
     attributes:
@@ -94,3 +103,16 @@ spec:
             key: "password"
         username:
           value: "username"
+  sessions:
+    ssoLoginSettings:
+      accessCodeLifespanLogin: 1800      # 30 minutes
+      accessCodeLifespanUserAction: 300  # 5 minutes
+    ssoSessionSettings:
+      idleTimeout: 1800                  # 30 minutes
+      idleTimeoutRememberMe: 604800      # 7 days
+      maxLifespan: 36000                 # 10 hours
+      maxLifespanRememberMe: 2592000     # 30 days
+    ssoOfflineSessionSettings:
+      idleTimeout: 2592000               # 30 days
+      maxLifespan: 5184000               # 60 days
+      maxLifespanEnabled: true
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmgroup.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmgroup.yaml
index 59333660..0f0ded93 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmgroup.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmgroup.yaml
@@ -7,3 +7,29 @@ spec:
     name: keycloakrealm-sample
     kind: KeycloakRealm
   name: ArgoCDAdmins
+---
+# Example of a child group using parentGroup
+apiVersion: v1.edp.epam.com/v1
+kind: KeycloakRealmGroup
+metadata:
+  name: keycloakrealmgroup-child-sample
+spec:
+  realmRef:
+    name: keycloakrealm-sample
+    kind: KeycloakRealm
+  name: ArgoCDDevelopers
+  parentGroup:
+    name: keycloakrealmgroup-sample
+
+---
+apiVersion: v1.edp.epam.com/v1
+kind: KeycloakRealmGroup
+metadata:
+  name: keycloakrealmgroup-child-sample2
+spec:
+  realmRef:
+    name: keycloakrealm-sample
+    kind: KeycloakRealm
+  name: ArgoCDGoDevs
+  parentGroup:
+    name: keycloakrealmgroup-child-sample
\ No newline at end of file
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmidentityprovider.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmidentityprovider.yaml
index a66a628c..812ed081 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmidentityprovider.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmidentityprovider.yaml
@@ -5,23 +5,33 @@ metadata:
 spec:
   realmRef:
     kind: KeycloakRealm
-    name: realm
-  alias: instagram
+    name: keycloakrealm-sample
+  alias: github
   authenticateByDefault: false
   enabled: true
   firstBrokerLoginFlowAlias: "first broker login"
-  providerId: "instagram"
+  postBrokerLoginFlowAlias: "browser"
+  providerId: "github"
   config:
     clientId: "foo"
-    clientSecret: "$secretName:secretKey"
-    hideOnLoginPage: "true"
+    clientSecret: "$test-idp-secret:secret"
     syncMode: "IMPORT"
     useJwksUrl: "true"
   mappers:
     - name: "test-33221"
       identityProviderMapper: "hardcoded-attribute-idp-mapper"
-      identityProviderAlias: "instagram"
+      identityProviderAlias: "github"
       config:
         attribute: "foo"
         "attribute.value": "bar"
         syncMode: "IMPORT"
+
+---
+  
+apiVersion: v1
+kind: Secret
+metadata:
+  name: test-idp-secret
+type: Opaque
+data:
+  secret: "c2VjcmV0"  # base64 encoded value of "secret"
\ No newline at end of file
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmuser.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmuser.yaml
index 1847d992..97289a66 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmuser.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmuser.yaml
@@ -13,8 +13,21 @@ spec:
   enabled: true
   emailVerified: true
   keepResource: true
+  passwordSecret:
+    key: password
+    name: keycloakrealmuser-sample-password
+    temporary: true
   requiredUserActions:
-    - UPDATE_PASSWORD
-  attributes:
-    foo: "bar"
-    baz: "jazz"
+    - UPDATE_PROFILE
+  attributesV2:
+    department: ["IT"]
+    location: ["Winterfell"]
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: keycloakrealmuser-sample-password
+type: Opaque
+data:
+  password: "U29tZVBhc3N3b3JkMTIzIQ==" # SomePassword123!
\ No newline at end of file
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmuser_password.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmuser_password.yaml
index daf3f6a7..ea99e794 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmuser_password.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmuser_password.yaml
@@ -19,3 +19,5 @@ spec:
   passwordSecret:
     name: existing-k8s-secret
     key: key-which-contains-password
+  identityProviders:
+    - provider-alias
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_clusterkeycloakrealms.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_clusterkeycloakrealms.yaml
index f2d8e337..b3a363c8 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_clusterkeycloakrealms.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_clusterkeycloakrealms.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: clusterkeycloakrealms.v1.edp.epam.com
 spec:
   group: v1.edp.epam.com
@@ -97,6 +97,57 @@ spec:
                     nullable: true
                     type: boolean
                 type: object
+              login:
+                description: Login settings for the realm.
+                nullable: true
+                properties:
+                  duplicateEmails:
+                    default: false
+                    description: DuplicateEmails allows multiple users to have the
+                      same email address.
+                    type: boolean
+                  editUsername:
+                    default: false
+                    description: EditUsername allows to edit username.
+                    type: boolean
+                  emailAsUsername:
+                    default: false
+                    description: EmailAsUsername allows users to set email as username.
+                    type: boolean
+                  forgotPassword:
+                    default: false
+                    description: ForgotPassword shows a link on the login page for
+                      users who have forgotten their credentials.
+                    type: boolean
+                  loginWithEmail:
+                    default: true
+                    description: LoginWithEmail allows users to log in with their
+                      email address.
+                    type: boolean
+                  rememberMe:
+                    default: false
+                    description: RememberMe shows checkbox on the login page to allow
+                      the user to remain logged in between browser restarts until
+                      the session expires.
+                    type: boolean
+                  userRegistration:
+                    default: false
+                    description: UserRegistration enables/disables the registration
+                      page. A link for registration will show on the login page too.
+                    type: boolean
+                  verifyEmail:
+                    default: false
+                    description: VerifyEmail requires user to verify their email address
+                      after initial login or after address changes are submitted.
+                    type: boolean
+                type: object
+              organizationsEnabled:
+                default: false
+                description: |-
+                  OrganizationsEnabled enables Keycloak Organizations feature for this realm.
+                  When enabled, this realm can support Organization resources for multi-tenant scenarios,
+                  identity provider groupings, and domain-based user routing.
+                type: boolean
               passwordPolicy:
                 description: PasswordPolicies is a list of password policies to apply
                   to the realm.
@@ -153,6 +204,80 @@ spec:
               realmName:
                 description: RealmName specifies the name of the realm.
                 type: string
+              sessions:
+                description: Sessions defines the session settings for the realm.
+                properties:
+                  ssoLoginSettings:
+                    description: SSOLoginSettings defines the SSO login settings for
+                      the realm.
+                    properties:
+                      accessCodeLifespanLogin:
+                        default: 1800
+                        description: AccessCodeLifespanLogin represents the max time
+                          a user has to complete a login. This is recommended to be
+                          relatively long, such as 30 minutes or more.
+                        type: integer
+                      accessCodeLifespanUserAction:
+                        default: 300
+                        description: AccessCodeLifespanUserAction represents the max
+                          time a user has to complete login related actions like update
+                          password or configure totp. This is recommended to be relatively
+                          long, such as 5 minutes or more.
+                        type: integer
+                    type: object
+                  ssoOfflineSessionSettings:
+                    description: SSOOfflineSessionSettings defines the SSO offline
+                      session settings for the realm.
+                    properties:
+                      idleTimeout:
+                        default: 2592000
+                        description: |-
+                          IdleTimeout represents the time an offline session is allowed to be idle before it expires.
+                          You need to use offline token to refresh at least once within this period; otherwise offline session will expire.
+                        type: integer
+                      maxLifespan:
+                        default: 5184000
+                        description: MaxLifespan represents the max time before an
+                          offline session is expired regardless of activity.
+                        type: integer
+                      maxLifespanEnabled:
+                        default: false
+                        description: MaxLifespanEnabled enables the offline session
+                          maximum lifetime.
+                        type: boolean
+                    type: object
+                  ssoSessionSettings:
+                    description: SSOSessionSettings defines the SSO session settings
+                      for the realm.
+                    properties:
+                      idleTimeout:
+                        default: 1800
+                        description: |-
+                          IdleTimeout represents the time a session is allowed to be idle before it expires.
+                          Tokens and browser sessions are invalidated when a session is expired.
+                        type: integer
+                      idleTimeoutRememberMe:
+                        default: 0
+                        description: |-
+                          IdleTimeoutRememberMe represents the time a session is allowed to be idle before it expires.
+                          Tokens and browser sessions are invalidated when a session is expired.
+                          If not set it uses the standard ssoSessionIdle value.
+                        type: integer
+                      maxLifespan:
+                        default: 36000
+                        description: |-
+                          MaxLifespan represents the max time before a session is expired.
+                          Tokens and browser sessions are invalidated when a session is expired.
+                        type: integer
+                      maxLifespanRememberMe:
+                        default: 0
+                        description: |-
+                          MaxLifespanRememberMe represents the max time before a session is expired when a user has set the remember me option.
+                          Tokens and browser sessions are invalidated when a session is expired.
+                          If not set it uses the standard ssoSessionMax value.
+                        type: integer
+                    type: object
+                type: object
               smtp:
                 description: Smtp is the configuration for email in the realm.
                 nullable: true
@@ -174,10 +299,13 @@ spec:
                                     description: The key to select.
                                     type: string
                                   name:
+                                    default: ""
                                     description: |-
                                       Name of the referent.
+                                      This field is effectively required, but due to backwards compatibility is
+                                      allowed to be empty. Instances of this type with an empty value here are
+                                      almost certainly wrong.
                                       More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                      TODO: Add other useful fields. apiVersion, kind, uid?
                                     type: string
                                 required:
                                 - key
@@ -190,10 +318,13 @@ spec:
                                     description: The key of the secret to select from.
                                     type: string
                                   name:
+                                    default: ""
                                     description: |-
                                       Name of the referent.
+                                      This field is effectively required, but due to backwards compatibility is
+                                      allowed to be empty. Instances of this type with an empty value here are
+                                      almost certainly wrong.
                                       More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                      TODO: Add other useful fields. apiVersion, kind, uid?
                                     type: string
                                 required:
                                 - key
@@ -210,10 +341,13 @@ spec:
                                     description: The key to select.
                                     type: string
                                   name:
+                                    default: ""
                                     description: |-
                                       Name of the referent.
+                                      This field is effectively required, but due to backwards compatibility is
+                                      allowed to be empty. Instances of this type with an empty value here are
+                                      almost certainly wrong.
                                       More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                      TODO: Add other useful fields. apiVersion, kind, uid?
                                     type: string
                                 required:
                                 - key
@@ -226,10 +360,13 @@ spec:
                                     description: The key of the secret to select from.
                                     type: string
                                   name:
+                                    default: ""
                                     description: |-
                                       Name of the referent.
+                                      This field is effectively required, but due to backwards compatibility is
+                                      allowed to be empty. Instances of this type with an empty value here are
+                                      almost certainly wrong.
                                       More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                      TODO: Add other useful fields. apiVersion, kind, uid?
                                     type: string
                                 required:
                                 - key
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_clusterkeycloaks.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_clusterkeycloaks.yaml
index 45628ebf..971a88b5 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_clusterkeycloaks.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_clusterkeycloaks.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: clusterkeycloaks.v1.edp.epam.com
 spec:
   group: v1.edp.epam.com
@@ -66,10 +66,13 @@ spec:
                         description: The key to select.
                         type: string
                       name:
+                        default: ""
                         description: |-
                           Name of the referent.
+                          This field is effectively required, but due to backwards compatibility is
+                          allowed to be empty. Instances of this type with an empty value here are
+                          almost certainly wrong.
                           More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          TODO: Add other useful fields. apiVersion, kind, uid?
                         type: string
                     required:
                     - key
@@ -82,10 +85,13 @@ spec:
                         description: The key of the secret to select from.
                         type: string
                       name:
+                        default: ""
                         description: |-
                           Name of the referent.
+                          This field is effectively required, but due to backwards compatibility is
+                          allowed to be empty. Instances of this type with an empty value here are
+                          almost certainly wrong.
                           More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          TODO: Add other useful fields. apiVersion, kind, uid?
                         type: string
                     required:
                     - key
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakauthflows.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakauthflows.yaml
index 7ac30a14..7a2cca34 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakauthflows.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakauthflows.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: keycloakauthflows.v1.edp.epam.com
 spec:
   group: v1.edp.epam.com
@@ -15,7 +15,7 @@ spec:
   scope: Namespaced
   versions:
   - additionalPrinterColumns:
-    - description: Reconcilation status
+    - description: Reconciliation status
       jsonPath: .status.value
       name: Status
       type: string
@@ -109,15 +109,11 @@ spec:
                 description: ProviderID for root auth flow and provider for child
                   auth flows.
                 type: string
-              realm:
-                description: |-
-                  Deprecated: use RealmRef instead.
-                  Realm is name of KeycloakRealm custom resource.
-                type: string
               realmRef:
                 description: RealmRef is reference to Realm custom resource.
                 properties:
                   kind:
+                    default: KeycloakRealm
                     description: Kind specifies the kind of the Keycloak resource.
                     enum:
                     - KeycloakRealm
@@ -126,6 +122,8 @@ spec:
                   name:
                     description: Name specifies the name of the Keycloak resource.
                     type: string
+                required:
+                - name
                 type: object
               topLevel:
                 description: TopLevel is true if this is root auth flow.
@@ -134,6 +132,7 @@ spec:
             - alias
             - builtIn
             - providerId
+            - realmRef
             - topLevel
             type: object
           status:
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakclients.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakclients.yaml
index c79d8376..a1505689 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakclients.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakclients.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: keycloakclients.v1.edp.epam.com
 spec:
   group: v1.edp.epam.com
@@ -15,7 +15,7 @@ spec:
   scope: Namespaced
   versions:
   - additionalPrinterColumns:
-    - description: Reconcilation status
+    - description: Reconciliation status
       jsonPath: .status.value
       name: Status
       type: string
@@ -45,8 +45,10 @@ spec:
             description: KeycloakClientSpec defines the desired state of KeycloakClient.
             properties:
               adminFineGrainedPermissionsEnabled:
-                description: AdminFineGrainedPermissionsEnabled enable/disable fine-grained
-                  admin permissions for a client.
+                description: |-
+                  AdminFineGrainedPermissionsEnabled enable/disable fine-grained admin permissions for a client.
+                  Feature flag admin-fine-grained-authz:v1 should be enabled in Keycloak server.
+                  Important: FGAP:V1 Keycloak feature remains in preview and may be deprecated and removed in a future releases.
                 type: boolean
               adminUrl:
                 description: |-
@@ -222,6 +224,8 @@ spec:
                                 within an access token or ID token representing the identity asking permissions.
                                 If not defined, user's groups are obtained from your realm configuration.
                               type: string
+                          required:
+                          - groups
                           type: object
                         logic:
                           default: POSITIVE
@@ -419,12 +423,36 @@ spec:
                   URI and tokens.
                 type: string
               clientRoles:
-                description: ClientRoles is a list of client roles names assigned
-                  to client.
+                description: |-
+                  ClientRoles is a list of client roles names assigned to client.
+                  Deprecated: Use ClientRolesV2 instead.
                 items:
                   type: string
                 nullable: true
                 type: array
+              clientRolesV2:
+                description: ClientRolesV2 is a list of client roles assigned to client.
+                items:
+                  properties:
+                    associatedClientRoles:
+                      description: |-
+                        AssociatedClientRoles is a list of client roles names associated with the current role.
+                        These roles won't be created automatically, user should specify them separately in clientRolesV2.
+                      items:
+                        type: string
+                      nullable: true
+                      type: array
+                    description:
+                      description: Description is a client role description.
+                      type: string
+                    name:
+                      description: Name is a client role name.
+                      type: string
+                  required:
+                  - name
+                  type: object
+                nullable: true
+                type: array
               consentRequired:
                 description: ConsentRequired is a flag to enable consent.
                 type: boolean
@@ -524,6 +552,7 @@ spec:
                 description: RealmRef is reference to Realm custom resource.
                 properties:
                   kind:
+                    default: KeycloakRealm
                     description: Kind specifies the kind of the Keycloak resource.
                     enum:
                     - KeycloakRealm
@@ -532,6 +561,8 @@ spec:
                   name:
                     description: Name specifies the name of the Keycloak resource.
                     type: string
+                required:
+                - name
                 type: object
               realmRoles:
                 description: RealmRoles is a list of realm roles assigned to client.
@@ -582,7 +613,19 @@ spec:
                   attributes:
                     additionalProperties:
                       type: string
-                    description: Attributes is a map of service account attributes.
+                    description: |-
+                      Attributes is a map of service account attributes.
+                      Deprecated: Use AttributesV2 instead.
+                    nullable: true
+                    type: object
+                  attributesV2:
+                    additionalProperties:
+                      items:
+                        type: string
+                      type: array
+                    description: |-
+                      AttributesV2 is a map of service account attributes.
+                      Each attribute can have multiple values.
                     nullable: true
                     type: object
                   clientRoles:
@@ -595,7 +638,7 @@ spec:
                           type: string
                         roles:
                           description: Roles is a list of client roles names assigned
-                            to service account.
+                            to user.
                           items:
                             type: string
                           nullable: true
@@ -608,6 +651,12 @@ spec:
                   enabled:
                     description: Enabled is a flag to enable service account.
                     type: boolean
+                  groups:
+                    description: Groups is a list of groups assigned to service account
+                    items:
+                      type: string
+                    nullable: true
+                    type: array
                   realmRoles:
                     description: RealmRoles is a list of realm roles assigned to service
                       account.
@@ -623,13 +672,6 @@ spec:
               surrogateAuthRequired:
                 description: SurrogateAuthRequired is a flag to enable surrogate auth.
                 type: boolean
-              targetRealm:
-                description: |-
-                  Deprecated: use RealmRef instead.
-                  TargetRealm is a realm name where client will be created.
-                  It has higher priority than RealmRef for backward compatibility.
-                  If both TargetRealm and RealmRef are specified, TargetRealm will be used for client creation.
-                type: string
               webOrigins:
                 description: |-
                   WebOrigins is a list of allowed CORS origins.
@@ -647,12 +689,72 @@ spec:
                 type: string
             required:
             - clientId
+            - realmRef
             type: object
           status:
             description: KeycloakClientStatus defines the observed state of KeycloakClient.
             properties:
               clientId:
                 type: string
+              conditions:
+                description: Conditions represent the latest available observations
+                  of an object's state.
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                nullable: true
+                type: array
               failureCount:
                 format: int64
                 type: integer
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakclientscopes.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakclientscopes.yaml
index 26e9876b..a5329ecb 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakclientscopes.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakclientscopes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: keycloakclientscopes.v1.edp.epam.com
 spec:
   group: v1.edp.epam.com
@@ -15,7 +15,7 @@ spec:
   scope: Namespaced
   versions:
   - additionalPrinterColumns:
-    - description: Reconcilation status
+    - description: Reconciliation status
       jsonPath: .status.value
       name: Status
       type: string
@@ -52,7 +52,9 @@ spec:
                 nullable: true
                 type: object
               default:
-                description: Default is a flag to set client scope as default.
+                description: |-
+                  Default is a flag to set client scope as default.
+                  Deprecated: Use Type: default instead.
                 type: boolean
               description:
                 description: Description is a description of client scope.
@@ -87,15 +89,11 @@ spec:
                   type: object
                 nullable: true
                 type: array
-              realm:
-                description: |-
-                  Deprecated: use RealmRef instead.
-                  Realm is name of KeycloakRealm custom resource.
-                type: string
               realmRef:
                 description: RealmRef is reference to Realm custom resource.
                 properties:
                   kind:
+                    default: KeycloakRealm
                     description: Kind specifies the kind of the Keycloak resource.
                     enum:
                     - KeycloakRealm
@@ -104,10 +102,25 @@ spec:
                   name:
                     description: Name specifies the name of the Keycloak resource.
                     type: string
+                required:
+                - name
                 type: object
+              type:
+                default: none
+                description: |-
+                  Type of the client scope.
+                  If set to "default", the client scope is assigned to all clients by default.
+                  If set to "optional", the client scope can be assigned to clients on demand.
+                  If set to "none", the client scope is not assigned to any clients by default.
+                enum:
+                - default
+                - optional
+                - none
+                type: string
             required:
             - name
             - protocol
+            - realmRef
             type: object
           status:
             description: KeycloakClientScopeStatus defines the observed state of KeycloakClientScope.
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakorganizations.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakorganizations.yaml
new file mode 100644
index 00000000..2ca7c1de
--- /dev/null
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakorganizations.yaml
@@ -0,0 +1,149 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.18.0
+  name: keycloakorganizations.v1.edp.epam.com
+spec:
+  group: v1.edp.epam.com
+  names:
+    kind: KeycloakOrganization
+    listKind: KeycloakOrganizationList
+    plural: keycloakorganizations
+    singular: keycloakorganization
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: Reconciliation status
+      jsonPath: .status.value
+      name: Status
+      type: string
+    - description: Keycloak organization ID
+      jsonPath: .status.organizationId
+      name: Organization ID
+      type: string
+    - description: Keycloak realm name
+      jsonPath: .spec.realmName
+      name: Realm
+      type: string
+    - description: Keycloak instance name
+      jsonPath: .spec.keycloakRef.name
+      name: Keycloak
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: KeycloakOrganization is the Schema for the organizations API.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: KeycloakOrganizationSpec defines the desired state of Organization.
+            properties:
+              alias:
+                description: |-
+                  Alias is the unique alias for the organization.
+                  The alias should be unique across Organizations.
+                type: string
+              attributes:
+                additionalProperties:
+                  items:
+                    type: string
+                  type: array
+                description: Attributes is a map of custom attributes for the organization.
+                nullable: true
+                type: object
+              description:
+                description: Description is an optional description of the organization.
+                type: string
+              domains:
+                description: |-
+                  Domains is a list of email domains associated with the organization.
+                  Each domain should be unique across Organizations.
+                items:
+                  type: string
+                minItems: 1
+                type: array
+              identityProviders:
+                description: |-
+                  IdentityProviders is a list of identity providers associated with the organization.
+                  One identity provider can't be assigned to multiple organizations.
+                items:
+                  description: OrgIdentityProvider defines an identity provider for
+                    an organization.
+                  properties:
+                    alias:
+                      description: Alias is the unique identifier for the identity
+                        provider within the organization.
+                      type: string
+                  required:
+                  - alias
+                  type: object
+                nullable: true
+                type: array
+              name:
+                description: |-
+                  Name is the unique name of the organization.
+                  The name should be unique across Organizations.
+                type: string
+              realmRef:
+                description: RealmRef is reference to Realm custom resource.
+                properties:
+                  kind:
+                    default: KeycloakRealm
+                    description: Kind specifies the kind of the Keycloak resource.
+                    enum:
+                    - KeycloakRealm
+                    - ClusterKeycloakRealm
+                    type: string
+                  name:
+                    description: Name specifies the name of the Keycloak resource.
+                    type: string
+                required:
+                - name
+                type: object
+              redirectUrl:
+                description: RedirectURL is the optional redirect URL for the organization.
+                type: string
+            required:
+            - alias
+            - domains
+            - name
+            - realmRef
+            type: object
+          status:
+            description: KeycloakOrganizationStatus defines the observed state of
+              Organization.
+            properties:
+              error:
+                description: Error is the error message if the reconciliation failed.
+                type: string
+              organizationId:
+                description: OrganizationID is the unique identifier of the organization
+                  in Keycloak.
+                type: string
+              value:
+                description: Value contains the current reconciliation status.
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmcomponents.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmcomponents.yaml
index 52129b3a..c73c2b63 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmcomponents.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmcomponents.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: keycloakrealmcomponents.v1.edp.epam.com
 spec:
   group: v1.edp.epam.com
@@ -15,7 +15,7 @@ spec:
   scope: Namespaced
   versions:
   - additionalPrinterColumns:
-    - description: Reconcilation status
+    - description: Reconciliation status
       jsonPath: .status.value
       name: Status
       type: string
@@ -90,15 +90,11 @@ spec:
               providerType:
                 description: ProviderType is a provider type of component.
                 type: string
-              realm:
-                description: |-
-                  Deprecated: use RealmRef instead.
-                  Realm is name of KeycloakRealm custom resource.
-                type: string
               realmRef:
                 description: RealmRef is reference to Realm custom resource.
                 properties:
                   kind:
+                    default: KeycloakRealm
                     description: Kind specifies the kind of the Keycloak resource.
                     enum:
                     - KeycloakRealm
@@ -107,11 +103,14 @@ spec:
                   name:
                     description: Name specifies the name of the Keycloak resource.
                     type: string
+                required:
+                - name
                 type: object
             required:
             - name
             - providerId
             - providerType
+            - realmRef
             type: object
           status:
             description: KeycloakComponentStatus defines the observed state of KeycloakRealmComponent.
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmgroups.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmgroups.yaml
index a8d3dee6..2eb3f1d2 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmgroups.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmgroups.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: keycloakrealmgroups.v1.edp.epam.com
 spec:
   group: v1.edp.epam.com
@@ -15,7 +15,7 @@ spec:
   scope: Namespaced
   versions:
   - additionalPrinterColumns:
-    - description: Reconcilation status
+    - description: Reconciliation status
       jsonPath: .status.value
       name: Status
       type: string
@@ -67,7 +67,7 @@ spec:
                       type: string
                     roles:
                       description: Roles is a list of client roles names assigned
-                        to service account.
+                        to user.
                       items:
                         type: string
                       nullable: true
@@ -80,18 +80,28 @@ spec:
               name:
                 description: Name of keycloak group.
                 type: string
+              parentGroup:
+                description: |-
+                  ParentGroup is a reference to a parent KeycloakRealmGroup custom resource.
+                  If specified, this group will be created as a child group of the referenced parent.
+                  The parent KeycloakRealmGroup must exist in the same namespace.
+                nullable: true
+                properties:
+                  name:
+                    description: Name specifies the name of the KeycloakRealmGroup
+                      custom resource.
+                    type: string
+                required:
+                - name
+                type: object
               path:
                 description: Path is a group path.
                 type: string
-              realm:
-                description: |-
-                  Deprecated: use RealmRef instead.
-                  Realm is name of KeycloakRealm custom resource.
-                type: string
               realmRef:
                 description: RealmRef is reference to Realm custom resource.
                 properties:
                   kind:
+                    default: KeycloakRealm
                     description: Kind specifies the kind of the Keycloak resource.
                     enum:
                     - KeycloakRealm
@@ -100,6 +110,8 @@ spec:
                   name:
                     description: Name specifies the name of the Keycloak resource.
                     type: string
+                required:
+                - name
                 type: object
               realmRoles:
                 description: RealmRoles is a list of realm roles assigned to group.
@@ -108,13 +120,16 @@ spec:
                 nullable: true
                 type: array
               subGroups:
-                description: SubGroups is a list of subgroups assigned to group.
+                description: |-
+                  SubGroups is a list of subgroups assigned to group.
+                  Deprecated: This filed doesn't allow to fully support child groups. Use ParentGroup approach instead.
                 items:
                   type: string
                 nullable: true
                 type: array
             required:
             - name
+            - realmRef
             type: object
           status:
             description: KeycloakRealmGroupStatus defines the observed state of KeycloakRealmGroup.
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmidentityproviders.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmidentityproviders.yaml
index b779f5b1..ceaf14de 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmidentityproviders.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmidentityproviders.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: keycloakrealmidentityproviders.v1.edp.epam.com
 spec:
   group: v1.edp.epam.com
@@ -15,7 +15,7 @@ spec:
   scope: Namespaced
   versions:
   - additionalPrinterColumns:
-    - description: Reconcilation status
+    - description: Reconciliation status
       jsonPath: .status.value
       name: Status
       type: string
@@ -50,6 +50,12 @@ spec:
                 description: AddReadTokenRoleOnCreate is a flag to add read token
                   role on create.
                 type: boolean
+              adminFineGrainedPermissionsEnabled:
+                description: |-
+                  AdminFineGrainedPermissionsEnabled enable/disable fine-grained admin permissions for an identity provider.
+                  Feature flag admin-fine-grained-authz:v1 should be enabled in Keycloak server.
+                  Important: FGAP:V1 Keycloak feature remains in preview and may be deprecated and removed in a future releases.
+                type: boolean
               alias:
                 description: Alias is a alias of identity provider.
                 type: string
@@ -102,18 +108,38 @@ spec:
                   type: object
                 nullable: true
                 type: array
+              permission:
+                description: Permission is a identity provider permissions configuration
+                nullable: true
+                properties:
+                  scopePermissions:
+                    description: ScopePermissions mapping of scope and the policies
+                      attached
+                    items:
+                      properties:
+                        name:
+                          type: string
+                        policies:
+                          items:
+                            type: string
+                          type: array
+                      required:
+                      - name
+                      type: object
+                    type: array
+                type: object
+              postBrokerLoginFlowAlias:
+                description: PostBrokerLoginFlowAlias is a post broker login flow
+                  alias.
+                type: string
               providerId:
                 description: ProviderID is a provider ID of identity provider.
                 type: string
-              realm:
-                description: |-
-                  Deprecated: use RealmRef instead.
-                  Realm is name of KeycloakRealm custom resource.
-                type: string
               realmRef:
                 description: RealmRef is reference to Realm custom resource.
                 properties:
                   kind:
+                    default: KeycloakRealm
                     description: Kind specifies the kind of the Keycloak resource.
                     enum:
                     - KeycloakRealm
@@ -122,6 +148,8 @@ spec:
                   name:
                     description: Name specifies the name of the Keycloak resource.
                     type: string
+                required:
+                - name
                 type: object
               storeToken:
                 description: StoreToken is a flag to store token.
@@ -134,6 +162,7 @@ spec:
             - config
             - enabled
             - providerId
+            - realmRef
             type: object
           status:
             description: KeycloakRealmIdentityProviderStatus defines the observed
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmrolebatches.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmrolebatches.yaml
index b691a407..aa926c6f 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmrolebatches.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmrolebatches.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: keycloakrealmrolebatches.v1.edp.epam.com
 spec:
   group: v1.edp.epam.com
@@ -15,7 +15,7 @@ spec:
   scope: Namespaced
   versions:
   - additionalPrinterColumns:
-    - description: Reconcilation status
+    - description: Reconciliation status
       jsonPath: .status.value
       name: Status
       type: string
@@ -44,15 +44,11 @@ spec:
           spec:
             description: KeycloakRealmRoleBatchSpec defines the desired state of KeycloakRealmRoleBatch.
             properties:
-              realm:
-                description: |-
-                  Deprecated: use RealmRef instead.
-                  Realm is name of KeycloakRealm custom resource.
-                type: string
               realmRef:
                 description: RealmRef is reference to Realm custom resource.
                 properties:
                   kind:
+                    default: KeycloakRealm
                     description: Kind specifies the kind of the Keycloak resource.
                     enum:
                     - KeycloakRealm
@@ -61,6 +57,8 @@ spec:
                   name:
                     description: Name specifies the name of the Keycloak resource.
                     type: string
+                required:
+                - name
                 type: object
               roles:
                 description: Roles is a list of roles to be created.
@@ -104,6 +102,7 @@ spec:
                   type: object
                 type: array
             required:
+            - realmRef
             - roles
             type: object
           status:
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmroles.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmroles.yaml
index 20adde93..1ed11331 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmroles.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmroles.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: keycloakrealmroles.v1.edp.epam.com
 spec:
   group: v1.edp.epam.com
@@ -15,7 +15,7 @@ spec:
   scope: Namespaced
   versions:
   - additionalPrinterColumns:
-    - description: Reconcilation status
+    - description: Reconciliation status
       jsonPath: .status.value
       name: Status
       type: string
@@ -98,15 +98,11 @@ spec:
               name:
                 description: Name of keycloak role.
                 type: string
-              realm:
-                description: |-
-                  Deprecated: use RealmRef instead.
-                  Realm is name of KeycloakRealm custom resource.
-                type: string
               realmRef:
                 description: RealmRef is reference to Realm custom resource.
                 properties:
                   kind:
+                    default: KeycloakRealm
                     description: Kind specifies the kind of the Keycloak resource.
                     enum:
                     - KeycloakRealm
@@ -115,9 +111,12 @@ spec:
                   name:
                     description: Name specifies the name of the Keycloak resource.
                     type: string
+                required:
+                - name
                 type: object
             required:
             - name
+            - realmRef
             type: object
           status:
             description: KeycloakRealmRoleStatus defines the observed state of KeycloakRealmRole.
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealms.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealms.yaml
index 69523264..312a6055 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealms.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealms.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: keycloakrealms.v1.edp.epam.com
 spec:
   group: v1.edp.epam.com
@@ -19,7 +19,7 @@ spec:
       jsonPath: .status.available
       name: Available
       type: boolean
-    - description: Reconcilation status
+    - description: Reconciliation status
       jsonPath: .status.value
       name: Status
       type: string
@@ -83,16 +83,11 @@ spec:
                 description: ID is the ID of the realm.
                 nullable: true
                 type: string
-              keycloakOwner:
-                description: |-
-                  Deprecated: use KeycloakRef instead.
-                  KeycloakOwner specifies the name of the Keycloak instance that owns the realm.
-                nullable: true
-                type: string
               keycloakRef:
                 description: KeycloakRef is reference to Keycloak custom resource.
                 properties:
                   kind:
+                    default: Keycloak
                     description: Kind specifies the kind of the Keycloak resource.
                     enum:
                     - Keycloak
@@ -101,7 +96,60 @@ spec:
                   name:
                     description: Name specifies the name of the Keycloak resource.
                     type: string
+                required:
+                - name
                 type: object
+              login:
+                description: Login settings for the realm.
+                nullable: true
+                properties:
+                  duplicateEmails:
+                    default: false
+                    description: DuplicateEmails allows multiple users to have the
+                      same email address.
+                    type: boolean
+                  editUsername:
+                    default: false
+                    description: EditUsername allows to edit username.
+                    type: boolean
+                  emailAsUsername:
+                    default: false
+                    description: EmailAsUsername allows users to set email as username.
+                    type: boolean
+                  forgotPassword:
+                    default: false
+                    description: ForgotPassword shows a link on the login page for
+                      users who have forgotten their credentials.
+                    type: boolean
+                  loginWithEmail:
+                    default: true
+                    description: LoginWithEmail allows users to log in with their
+                      email address.
+                    type: boolean
+                  rememberMe:
+                    default: false
+                    description: RememberMe shows checkbox on the login page to allow
+                      the user to remain logged in between browser restarts until
+                      the session expires.
+                    type: boolean
+                  userRegistration:
+                    default: false
+                    description: UserRegistration enables/disables the registration
+                      page. A link for registration will show on the login page too.
+                    type: boolean
+                  verifyEmail:
+                    default: false
+                    description: VerifyEmail requires user to verify their email address
+                      after initial login or after address changes are submitted.
+                    type: boolean
+                type: object
+              organizationsEnabled:
+                default: false
+                description: |-
+                  OrganizationsEnabled enables Keycloak Organizations feature for this realm.
+                  When enabled, this realm can support Organization resources for multi-tenant scenarios,
+                  identity provider groupings, and domain-based user routing.
+                type: boolean
               passwordPolicy:
                 description: PasswordPolicies is a list of password policies to apply
                   to the realm.
@@ -158,6 +206,83 @@ spec:
               realmName:
                 description: RealmName specifies the name of the realm.
                 type: string
+                x-kubernetes-validations:
+                - message: Value is immutable
+                  rule: self == oldSelf
+              sessions:
+                description: Sessions defines the session settings for the realm.
+                properties:
+                  ssoLoginSettings:
+                    description: SSOLoginSettings defines the SSO login settings for
+                      the realm.
+                    properties:
+                      accessCodeLifespanLogin:
+                        default: 1800
+                        description: AccessCodeLifespanLogin represents the max time
+                          a user has to complete a login. This is recommended to be
+                          relatively long, such as 30 minutes or more.
+                        type: integer
+                      accessCodeLifespanUserAction:
+                        default: 300
+                        description: AccessCodeLifespanUserAction represents the max
+                          time a user has to complete login related actions like update
+                          password or configure totp. This is recommended to be relatively
+                          long, such as 5 minutes or more.
+                        type: integer
+                    type: object
+                  ssoOfflineSessionSettings:
+                    description: SSOOfflineSessionSettings defines the SSO offline
+                      session settings for the realm.
+                    properties:
+                      idleTimeout:
+                        default: 2592000
+                        description: |-
+                          IdleTimeout represents the time an offline session is allowed to be idle before it expires.
+                          You need to use offline token to refresh at least once within this period; otherwise offline session will expire.
+                        type: integer
+                      maxLifespan:
+                        default: 5184000
+                        description: MaxLifespan represents the max time before an
+                          offline session is expired regardless of activity.
+                        type: integer
+                      maxLifespanEnabled:
+                        default: false
+                        description: MaxLifespanEnabled enables the offline session
+                          maximum lifetime.
+                        type: boolean
+                    type: object
+                  ssoSessionSettings:
+                    description: SSOSessionSettings defines the SSO session settings
+                      for the realm.
+                    properties:
+                      idleTimeout:
+                        default: 1800
+                        description: |-
+                          IdleTimeout represents the time a session is allowed to be idle before it expires.
+                          Tokens and browser sessions are invalidated when a session is expired.
+                        type: integer
+                      idleTimeoutRememberMe:
+                        default: 0
+                        description: |-
+                          IdleTimeoutRememberMe represents the time a session is allowed to be idle before it expires.
+                          Tokens and browser sessions are invalidated when a session is expired.
+                          If not set it uses the standard ssoSessionIdle value.
+                        type: integer
+                      maxLifespan:
+                        default: 36000
+                        description: |-
+                          MaxLifespan represents the max time before a session is expired.
+                          Tokens and browser sessions are invalidated when a session is expired.
+                        type: integer
+                      maxLifespanRememberMe:
+                        default: 0
+                        description: |-
+                          MaxLifespanRememberMe represents the max time before a session is expired when a user has set the remember me option.
+                          Tokens and browser sessions are invalidated when a session is expired.
+                          If not set it uses the standard ssoSessionMax value.
+                        type: integer
+                    type: object
+                type: object
               smtp:
                 description: Smtp is the configuration for email in the realm.
                 nullable: true
@@ -179,10 +304,13 @@ spec:
                                     description: The key to select.
                                     type: string
                                   name:
+                                    default: ""
                                     description: |-
                                       Name of the referent.
+                                      This field is effectively required, but due to backwards compatibility is
+                                      allowed to be empty. Instances of this type with an empty value here are
+                                      almost certainly wrong.
                                       More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                      TODO: Add other useful fields. apiVersion, kind, uid?
                                     type: string
                                 required:
                                 - key
@@ -195,10 +323,13 @@ spec:
                                     description: The key of the secret to select from.
                                     type: string
                                   name:
+                                    default: ""
                                     description: |-
                                       Name of the referent.
+                                      This field is effectively required, but due to backwards compatibility is
+                                      allowed to be empty. Instances of this type with an empty value here are
+                                      almost certainly wrong.
                                       More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                      TODO: Add other useful fields. apiVersion, kind, uid?
                                     type: string
                                 required:
                                 - key
@@ -215,10 +346,13 @@ spec:
                                     description: The key to select.
                                     type: string
                                   name:
+                                    default: ""
                                     description: |-
                                       Name of the referent.
+                                      This field is effectively required, but due to backwards compatibility is
+                                      allowed to be empty. Instances of this type with an empty value here are
+                                      almost certainly wrong.
                                       More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                      TODO: Add other useful fields. apiVersion, kind, uid?
                                     type: string
                                 required:
                                 - key
@@ -231,10 +365,13 @@ spec:
                                     description: The key of the secret to select from.
                                     type: string
                                   name:
+                                    default: ""
                                     description: |-
                                       Name of the referent.
+                                      This field is effectively required, but due to backwards compatibility is
+                                      allowed to be empty. Instances of this type with an empty value here are
+                                      almost certainly wrong.
                                       More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                      TODO: Add other useful fields. apiVersion, kind, uid?
                                     type: string
                                 required:
                                 - key
@@ -550,6 +687,7 @@ spec:
                 nullable: true
                 type: array
             required:
+            - keycloakRef
             - realmName
             type: object
           status:
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmusers.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmusers.yaml
index 05097bcd..ac2538fe 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmusers.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmusers.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: keycloakrealmusers.v1.edp.epam.com
 spec:
   group: v1.edp.epam.com
@@ -15,7 +15,7 @@ spec:
   scope: Namespaced
   versions:
   - additionalPrinterColumns:
-    - description: Reconcilation status
+    - description: Reconciliation status
       jsonPath: .status.value
       name: Status
       type: string
@@ -47,9 +47,40 @@ spec:
               attributes:
                 additionalProperties:
                   type: string
-                description: Attributes is a map of user attributes.
+                description: |-
+                  Attributes is a map of user attributes.
+                  Deprecated: Use AttributesV2 instead.
                 nullable: true
                 type: object
+              attributesV2:
+                additionalProperties:
+                  items:
+                    type: string
+                  type: array
+                description: |-
+                  AttributesV2 is a map of service account attributes.
+                  Each attribute can have multiple values.
+                nullable: true
+                type: object
+              clientRoles:
+                description: ClientRoles is a list of client roles assigned to user.
+                items:
+                  properties:
+                    clientId:
+                      description: ClientID is a client ID.
+                      type: string
+                    roles:
+                      description: Roles is a list of client roles names assigned
+                        to user.
+                      items:
+                        type: string
+                      nullable: true
+                      type: array
+                  required:
+                  - clientId
+                  type: object
+                nullable: true
+                type: array
               email:
                 description: Email is a user email.
                 type: string
@@ -68,6 +99,13 @@ spec:
                   type: string
                 nullable: true
                 type: array
+              identityProviders:
+                description: IdentityProviders is a list of identity providers aliases
+                  linked to the user.
+                items:
+                  type: string
+                nullable: true
+                type: array
               keepResource:
                 default: true
                 description: |-
@@ -79,9 +117,9 @@ spec:
                 description: LastName is a user last name.
                 type: string
               password:
-                description: Password is a user password. Allows to keep user password
-                  within Custom Resource. For security concerns, it is recommended
-                  to use PasswordSecret instead.
+                description: |-
+                  Password is a user password. Allows to keep user password within Custom Resource. For security concerns, it is recommended to use PasswordSecret instead.
+                  Deperecated: use PasswordSecret instead.
                 type: string
               passwordSecret:
                 description: PasswordSecret defines Kubernetes secret Name and Key,
@@ -94,19 +132,19 @@ spec:
                   name:
                     description: Name is the name of the secret.
                     type: string
+                  temporary:
+                    default: false
+                    description: Temporary indicates whether the password is temporary.
+                    type: boolean
                 required:
                 - key
                 - name
                 type: object
-              realm:
-                description: |-
-                  Deprecated: use RealmRef instead.
-                  Realm is name of KeycloakRealm custom resource.
-                type: string
               realmRef:
                 description: RealmRef is reference to Realm custom resource.
                 properties:
                   kind:
+                    default: KeycloakRealm
                     description: Kind specifies the kind of the Keycloak resource.
                     enum:
                     - KeycloakRealm
@@ -115,11 +153,13 @@ spec:
                   name:
                     description: Name specifies the name of the Keycloak resource.
                     type: string
+                required:
+                - name
                 type: object
               reconciliationStrategy:
                 description: |-
-                  ReconciliationStrategy is a strategy for reconciliation. Possible values: full, create-only.
-                  Default value: full. If set to create-only, user will be created only if it does not exist. If user exists, it will not be updated.
+                  ReconciliationStrategy is a strategy for reconciliation. Possible values: full, addOnly.
+                  Default value: full. If set to addOnly, user will be created only if it does not exist. If user exists, it will not be updated.
                   If set to full, user will be created if it does not exist, or updated if it exists.
                 type: string
               requiredUserActions:
@@ -139,14 +179,79 @@ spec:
                 description: Username is a username in keycloak.
                 type: string
             required:
+            - realmRef
             - username
             type: object
           status:
             description: KeycloakRealmUserStatus defines the observed state of KeycloakRealmUser.
             properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of an object's state.
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                nullable: true
+                type: array
               failureCount:
                 format: int64
                 type: integer
+              lastSyncedPasswordSecretVersion:
+                description: |-
+                  LastSyncedPasswordSecretVersion stores the ResourceVersion of the password secret
+                  that was last successfully synced to Keycloak. Used to detect secret changes.
+                type: string
               value:
                 type: string
             type: object
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloaks.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloaks.yaml
index 99660f8c..9b48d9ca 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloaks.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloaks.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: keycloaks.v1.edp.epam.com
 spec:
   group: v1.edp.epam.com
@@ -64,10 +64,13 @@ spec:
                         description: The key to select.
                         type: string
                       name:
+                        default: ""
                         description: |-
                           Name of the referent.
+                          This field is effectively required, but due to backwards compatibility is
+                          allowed to be empty. Instances of this type with an empty value here are
+                          almost certainly wrong.
                           More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          TODO: Add other useful fields. apiVersion, kind, uid?
                         type: string
                     required:
                     - key
@@ -80,10 +83,13 @@ spec:
                         description: The key of the secret to select from.
                         type: string
                       name:
+                        default: ""
                         description: |-
                           Name of the referent.
+                          This field is effectively required, but due to backwards compatibility is
+                          allowed to be empty. Instances of this type with an empty value here are
+                          almost certainly wrong.
                           More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          TODO: Add other useful fields. apiVersion, kind, uid?
                         type: string
                     required:
                     - key
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/templates/clusterrole.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/templates/clusterrole.yaml
index fe8f80e8..4c290815 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/templates/clusterrole.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/templates/clusterrole.yaml
@@ -156,6 +156,32 @@ rules:
       - get
       - patch
       - update
+  - apiGroups:
+      - v1.edp.epam.com
+    resources:
+      - keycloakorganizations
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - v1.edp.epam.com
+    resources:
+      - keycloakorganizations/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - v1.edp.epam.com
+    resources:
+      - keycloakorganizations/status
+    verbs:
+      - get
+      - patch
+      - update
   - apiGroups:
       - v1.edp.epam.com
     resources:
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/templates/deployment.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/templates/deployment.yaml
index fbeaa42e..cd73c03a 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/templates/deployment.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/templates/deployment.yaml
@@ -16,11 +16,20 @@ spec:
   template:
     metadata:
       labels:
+        {{- include "keycloak-operator.selectorLabels" . | nindent 8 }}
         name: {{ .Values.name }}
+        control-plane: controller-manager
+        {{- if hasKey .Values.podLabels "name" }}
+        {{ fail "The 'name' key is not allowed in podLabels" }}
+        {{- end }}
+        {{- range $key, $value := .Values.podLabels }}
+        {{ $key }}: {{ $value | quote }}
+        {{- end }}
     spec:
       serviceAccountName: edp-{{ .Values.name }}
-      securityContext:
-        runAsNonRoot: true
+      {{- if .Values.securityContext }}
+      securityContext: {{ toYaml .Values.securityContext | nindent 8 }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
@@ -28,12 +37,20 @@ spec:
       containers:
         - name: {{ .Values.name }}
           # Replace this with the built image name
-          image: {{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}
+          image: {{ if .Values.image.registry }}{{ .Values.image.registry }}/{{ end }}{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}
           imagePullPolicy: "{{ .Values.imagePullPolicy }}"
           command:
             - /manager
-          securityContext:
-            allowPrivilegeEscalation: false
+          args:
+            - --metrics-bind-address=:8443
+            - --leader-elect
+            - --health-probe-bind-address=:8081
+            {{- if .Values.enableWebhooks }}
+            - --webhook-cert-path=/tmp/k8s-webhook-server/serving-certs
+            {{- end }}
+          {{- if .Values.containerSecurityContext }}
+          securityContext: {{ toYaml .Values.containerSecurityContext | nindent 12 }}
+          {{- end }}
           env:
             - name: WATCH_NAMESPACE
               {{- if .Values.clusterReconciliationEnabled }}
@@ -51,11 +68,26 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.name
-        {{- if .Values.extraVolumeMounts }}
+            - name: ENABLE_OWNER_REF
+              value: {{ .Values.enableOwnerRef | quote }}
+            - name: ENABLE_WEBHOOKS
+              value: {{ .Values.enableWebhooks | quote }}
+        {{- if or .Values.extraVolumeMounts .Values.enableWebhooks }}
           volumeMounts:
+          {{- if .Values.enableWebhooks }}
+            - mountPath: /tmp/k8s-webhook-server/serving-certs
+              name: webhook-certs
+              readOnly: true
+          {{- end }}
           {{- if .Values.extraVolumeMounts }}
             {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
           {{- end }}
+        {{- end }}
+        {{- if .Values.enableWebhooks }}
+          ports:
+          - containerPort: 9443
+            name: webhook-server
+            protocol: TCP
         {{- end }}
           livenessProbe:
             httpGet:
@@ -71,8 +103,13 @@ spec:
             periodSeconds: 10
           resources:
 {{ toYaml .Values.resources | indent 12 }}
-    {{- if .Values.extraVolumes }}
+    {{- if or .Values.extraVolumes .Values.enableWebhooks }}
       volumes:
+      {{- if .Values.enableWebhooks }}
+        - name: webhook-certs
+          secret:
+            secretName: webhook-server-cert
+      {{- end }}
       {{- if .Values.extraVolumes }}
         {{- toYaml .Values.extraVolumes | nindent 8 }}
       {{- end }}
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/templates/operator_role.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/templates/operator_role.yaml
index 1d95a354..0f9f3b6e 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/templates/operator_role.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/templates/operator_role.yaml
@@ -5,309 +5,82 @@ metadata:
   labels:
       {{- include "keycloak-operator.labels" . | nindent 4 }}
 rules:
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakauthflows
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakauthflows/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakauthflows/status
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakclients
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakclients/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakclients/status
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakclientscopes
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakclientscopes/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakclientscopes/status
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealmcomponents
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealmcomponents/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealmcomponents/status
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealmgroups
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealmgroups/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealmgroups/status
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealmidentityproviders
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealmidentityproviders/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealmidentityproviders/status
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealmrolebatches
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealmrolebatches/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealmrolebatches/status
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealmroles
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealmroles/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealmroles/status
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealms
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealms/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealms/status
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealmusers
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealmusers/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloakrealmusers/status
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloaks
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloaks/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - v1.edp.epam.com
-    resources:
-      - keycloaks/status
-    verbs:
-      - get
-      - patch
-      - update
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - v1
+  resources:
+  - configmap
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - v1.edp.epam.com
+  resources:
+  - keycloakauthflows
+  - keycloakclients
+  - keycloakclientscopes
+  - keycloakorganizations
+  - keycloakrealmcomponents
+  - keycloakrealmgroups
+  - keycloakrealmidentityproviders
+  - keycloakrealmrolebatches
+  - keycloakrealmroles
+  - keycloakrealms
+  - keycloakrealmusers
+  - keycloaks
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - v1.edp.epam.com
+  resources:
+  - keycloakauthflows/finalizers
+  - keycloakclients/finalizers
+  - keycloakclientscopes/finalizers
+  - keycloakorganizations/finalizers
+  - keycloakrealmcomponents/finalizers
+  - keycloakrealmgroups/finalizers
+  - keycloakrealmidentityproviders/finalizers
+  - keycloakrealmrolebatches/finalizers
+  - keycloakrealmroles/finalizers
+  - keycloakrealms/finalizers
+  - keycloakrealmusers/finalizers
+  - keycloaks/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - v1.edp.epam.com
+  resources:
+  - keycloakauthflows/status
+  - keycloakclients/status
+  - keycloakclientscopes/status
+  - keycloakorganizations/status
+  - keycloakrealmcomponents/status
+  - keycloakrealmgroups/status
+  - keycloakrealmidentityproviders/status
+  - keycloakrealmrolebatches/status
+  - keycloakrealmroles/status
+  - keycloakrealms/status
+  - keycloakrealmusers/status
+  - keycloaks/status
+  verbs:
+  - get
+  - patch
+  - update
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/certmanager.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/certmanager.yaml
new file mode 100644
index 00000000..e3cec94e
--- /dev/null
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/certmanager.yaml
@@ -0,0 +1,25 @@
+{{- if .Values.enableWebhooks }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  labels:
+      {{- include "keycloak-operator.labels" . | nindent 4 }}
+  name: {{ .Values.name }}-serving-cert
+spec:
+  dnsNames:
+  - {{ .Values.name }}-webhook-service.{{ .Release.Namespace }}.svc
+  - {{ .Values.name }}-webhook-service.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}
+  issuerRef:
+    kind: Issuer
+    name: {{ .Values.name }}-selfsigned-issuer
+  secretName: webhook-server-cert
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  labels:
+    {{- include "keycloak-operator.labels" . | nindent 4 }}
+  name: {{ .Values.name }}-selfsigned-issuer
+spec:
+  selfSigned: {}
+{{- end }}
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/manifest.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/manifest.yaml
new file mode 100644
index 00000000..2f5a222b
--- /dev/null
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/manifest.yaml
@@ -0,0 +1,78 @@
+{{- if .Values.enableWebhooks }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: {{ .Values.name }}-mutating-webhook-configuration-{{ .Release.Namespace }}
+  labels:
+      {{- include "keycloak-operator.labels" . | nindent 4 }}
+  annotations:
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ .Values.name }}-serving-cert
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: {{ .Values.name }}-webhook-service
+      namespace: {{ .Release.Namespace }}
+      path: /mutate-v1-edp-epam-com-v1-keycloakclient
+  failurePolicy: Fail
+  name: mkeycloakclient-v1.kb.io
+  {{- /* Namespace-scoped webhook to prevent cross-namespace conflicts. */ -}}
+  {{- if not .Values.clusterReconciliationEnabled }}
+  namespaceSelector:
+    matchExpressions:
+    - key: kubernetes.io/metadata.name
+      operator: In
+      values:
+      - {{ .Release.Namespace }}
+  {{- end }}
+  rules:
+  - apiGroups:
+    - v1.edp.epam.com
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - keycloakclients
+  sideEffects: None
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  labels:
+      {{- include "keycloak-operator.labels" . | nindent 4 }}
+  annotations:
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ .Values.name }}-serving-cert
+  name: {{ .Values.name }}-validating-webhook-configuration-{{ .Release.Namespace }}
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: {{ .Values.name }}-webhook-service
+      namespace: {{ .Release.Namespace }}
+      path: /validate-v1-edp-epam-com-v1-keycloakrealm
+  failurePolicy: Fail
+  name: vkeycloakrealm-v1.kb.io
+  {{- /* Namespace-scoped webhook validation to prevent cross-namespace conflicts. */ -}}
+  {{- if not .Values.clusterReconciliationEnabled }}
+  namespaceSelector:
+    matchExpressions:
+    - key: kubernetes.io/metadata.name
+      operator: In
+      values:
+      - {{ .Release.Namespace }}
+  {{- end }}
+  rules:
+  - apiGroups:
+    - v1.edp.epam.com
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    resources:
+    - keycloakrealms
+  sideEffects: None
+{{- end }}
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/rbac.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/rbac.yaml
new file mode 100644
index 00000000..6fca5e20
--- /dev/null
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/rbac.yaml
@@ -0,0 +1,33 @@
+{{- if .Values.enableWebhooks }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    {{- include "keycloak-operator.labels" . | nindent 4 }}
+  name: edp-{{ .Release.Namespace }}-webhook-clusterrole
+rules:
+- apiGroups:
+  - v1.edp.epam.com
+  resources:
+  - keycloakrealms
+  verbs:
+  - get
+  - list
+  - watch
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    {{- include "keycloak-operator.labels" . | nindent 4 }}
+  name: edp-{{ .Release.Namespace }}-webhook-clusterrolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: edp-{{ .Release.Namespace }}-webhook-clusterrole
+subjects:
+  - kind: ServiceAccount
+    name: edp-{{ .Values.name }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/service.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/service.yaml
new file mode 100644
index 00000000..96a7c245
--- /dev/null
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/service.yaml
@@ -0,0 +1,16 @@
+{{- if .Values.enableWebhooks }}
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+      {{- include "keycloak-operator.labels" . | nindent 4 }}
+  name: {{ .Values.name }}-webhook-service
+spec:
+  ports:
+    - port: 443
+      protocol: TCP
+      targetPort: 9443
+  selector:
+    {{- include "keycloak-operator.selectorLabels" . | nindent 4 }}
+    control-plane: controller-manager
+{{- end }}
diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/values.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/values.yaml
index fbd6ae53..64226135 100644
--- a/packages/system/keycloak-operator/charts/keycloak-operator/values.yaml
+++ b/packages/system/keycloak-operator/charts/keycloak-operator/values.yaml
@@ -2,6 +2,10 @@
 name: keycloak-operator
 # -- Annotations to be added to the Deployment
 annotations: {}
+# -- Cluster domain for constructing service DNS names
+clusterDomain: cluster.local
+# -- Labels to be added to the pod
+podLabels: {}
 # -- Node labels for pod assignment
 nodeSelector: {}
 # -- Node tolerations for server scheduling to nodes with taints
@@ -9,6 +13,8 @@ tolerations: []
 # -- Affinity for pod assignment
 affinity: {}
 image:
+  # -- KubeRocketCI keycloak-operator Docker image registry.
+  registry: ""
   # -- KubeRocketCI keycloak-operator Docker image name. The released image can be found on [Dockerhub](https://hub.docker.com/r/epamedp/keycloak-operator)
   repository: epamedp/keycloak-operator
   # if not defined then .Chart.AppVersion is used
@@ -27,6 +33,16 @@ resources:
     cpu: 50m
     memory: 64Mi
 
+# -- Deployment Security Context
+# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+securityContext:
+  runAsNonRoot: true
+
+# -- Container Security Context
+# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+
 # -- Additional volumes to be added to the pod
 extraVolumes: []
 #  - name: custom-ca
@@ -44,3 +60,11 @@ extraVolumeMounts: []
 # -- If clusterReconciliationEnabled is true, the operator reconciles all Keycloak instances in the cluster;
 #  otherwise, it only reconciles instances in the same namespace by default, and cluster-scoped resources are ignored.
 clusterReconciliationEnabled: false
+
+# -- If set to true, the operator will set the owner reference for all resources that have Keycloak or KeycloakRealm as reference.
+# This is legacy behavior and not recommended for use. In the future, this will be set to false by default.
+enableOwnerRef: true
+
+# -- If set to true, enables webhook resources (ValidatingWebhookConfiguration, Service, and Certificate).
+# Webhooks require cert-manager to be installed in the cluster.
+enableWebhooks: true
diff --git a/packages/system/keycloak-operator/images/keycloak-operator/Dockerfile b/packages/system/keycloak-operator/images/keycloak-operator/Dockerfile
new file mode 100644
index 00000000..8167042f
--- /dev/null
+++ b/packages/system/keycloak-operator/images/keycloak-operator/Dockerfile
@@ -0,0 +1,29 @@
+# syntax=docker/dockerfile:1.2
+
+FROM alpine AS source
+ARG COMMIT_REF=facbc36
+RUN apk add --no-cache curl tar git
+WORKDIR /src
+
+RUN curl -sSL https://github.com/epam/edp-keycloak-operator/archive/${COMMIT_REF}.tar.gz \
+        | tar -xz --strip-components=1
+
+COPY patches /patches
+RUN git apply /patches/*.diff
+
+FROM --platform=$BUILDPLATFORM docker.io/golang:1.24 AS builder
+ARG TARGETOS
+ARG TARGETARCH
+
+WORKDIR /go/src/keycloak-operator
+
+COPY --from=source /src/go.mod /src/go.sum ./
+RUN go mod download
+
+COPY --from=source /src .
+RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -o /build/manager ./cmd
+
+FROM gcr.io/distroless/static:nonroot
+COPY --from=builder /build/manager /manager
+USER 65532:65532
+ENTRYPOINT ["/manager"]
diff --git a/packages/system/keycloak-operator/images/keycloak-operator/patches/pr309.diff b/packages/system/keycloak-operator/images/keycloak-operator/patches/pr309.diff
new file mode 100644
index 00000000..80f08777
--- /dev/null
+++ b/packages/system/keycloak-operator/images/keycloak-operator/patches/pr309.diff
@@ -0,0 +1,187 @@
+diff --git a/internal/controller/keycloakrealmgroup/chain/chain.go b/internal/controller/keycloakrealmgroup/chain/chain.go
+index 1ca497a0..dbc3844b 100644
+--- a/internal/controller/keycloakrealmgroup/chain/chain.go
++++ b/internal/controller/keycloakrealmgroup/chain/chain.go
+@@ -15,6 +15,10 @@ type GroupContext struct {
+ 	// GroupID is the Keycloak group ID, set by CreateOrUpdateGroup handler.
+ 	GroupID string
+ 
++	// ExistingGroupID is the Keycloak group ID from a previous reconciliation (status.ID).
++	// Used to detect renames: if set, the group is fetched by ID first.
++	ExistingGroupID string
++
+ 	// ParentGroupID is the parent group's Keycloak ID (empty if top-level).
+ 	ParentGroupID string
+ 
+diff --git a/internal/controller/keycloakrealmgroup/chain/create_or_update_group.go b/internal/controller/keycloakrealmgroup/chain/create_or_update_group.go
+index 0504d9dd..931fab27 100644
+--- a/internal/controller/keycloakrealmgroup/chain/create_or_update_group.go
++++ b/internal/controller/keycloakrealmgroup/chain/create_or_update_group.go
+@@ -33,17 +33,34 @@ func (h *CreateOrUpdateGroup) Serve(
+ 		err           error
+ 	)
+ 
+-	if groupCtx.ParentGroupID != "" {
+-		existingGroup, _, err = kClient.Groups.FindChildGroupByName(ctx, realm, groupCtx.ParentGroupID, spec.Name)
+-	} else {
+-		existingGroup, _, err = kClient.Groups.FindGroupByName(ctx, realm, spec.Name)
++	// If we already have an ID from a previous reconciliation, fetch by ID first.
++	// This handles renames: spec.Name may have changed but the ID stays the same.
++	if groupCtx.ExistingGroupID != "" {
++		existingGroup, _, err = kClient.Groups.GetGroup(ctx, realm, groupCtx.ExistingGroupID)
++		if err != nil && !keycloakv2.IsNotFound(err) {
++			return fmt.Errorf("unable to get group by ID %q: %w", groupCtx.ExistingGroupID, err)
++		}
++
++		if keycloakv2.IsNotFound(err) {
++			log.Info("Group not found by ID, will search by name", "groupID", groupCtx.ExistingGroupID)
++			existingGroup = nil
++		}
+ 	}
+ 
+-	if err != nil && !keycloakv2.IsNotFound(err) {
+-		return fmt.Errorf("unable to search for group %q: %w", spec.Name, err)
++	// If we didn't find the group by ID, search by name.
++	if existingGroup == nil {
++		if groupCtx.ParentGroupID != "" {
++			existingGroup, _, err = kClient.Groups.FindChildGroupByName(ctx, realm, groupCtx.ParentGroupID, spec.Name)
++		} else {
++			existingGroup, _, err = kClient.Groups.FindGroupByName(ctx, realm, spec.Name)
++		}
++
++		if err != nil && !keycloakv2.IsNotFound(err) {
++			return fmt.Errorf("unable to search for group %q: %w", spec.Name, err)
++		}
+ 	}
+ 
+-	if keycloakv2.IsNotFound(err) {
++	if existingGroup == nil {
+ 		groupRep := keycloakv2.GroupRepresentation{
+ 			Name:        &spec.Name,
+ 			Description: &spec.Description,
+@@ -67,6 +84,7 @@ func (h *CreateOrUpdateGroup) Serve(
+ 		log.Info("Group created", "groupID", groupCtx.GroupID)
+ 	} else {
+ 		groupCtx.GroupID = *existingGroup.Id
++		existingGroup.Name = &spec.Name
+ 		existingGroup.Description = &spec.Description
+ 		existingGroup.Path = &spec.Path
+ 		existingGroup.Attributes = &spec.Attributes
+diff --git a/internal/controller/keycloakrealmgroup/chain/create_or_update_group_test.go b/internal/controller/keycloakrealmgroup/chain/create_or_update_group_test.go
+index 26841a71..000c7538 100644
+--- a/internal/controller/keycloakrealmgroup/chain/create_or_update_group_test.go
++++ b/internal/controller/keycloakrealmgroup/chain/create_or_update_group_test.go
+@@ -265,3 +265,97 @@ func TestCreateOrUpdateGroup_Serve_FindChildGroupError(t *testing.T) {
+ 	err := h.Serve(context.Background(), group, kClient, groupCtx)
+ 	assert.ErrorContains(t, err, "unable to search for group")
+ }
++
++func TestCreateOrUpdateGroup_Serve_RenameByID(t *testing.T) {
++	mockGroups := mocks.NewMockGroupsClient(t)
++
++	kClient := &keycloakv2.KeycloakClient{Groups: mockGroups}
++	groupCtx := &GroupContext{RealmName: "test-realm", ExistingGroupID: "existing-id"}
++
++	group := &keycloakApi.KeycloakRealmGroup{}
++	group.Spec.Name = "new-name"
++	group.Spec.Description = "Updated desc"
++	group.Spec.Path = "/new-name"
++	group.Spec.Attributes = map[string][]string{"key": {"val"}}
++
++	mockGroups.EXPECT().GetGroup(
++		context.Background(), "test-realm", "existing-id",
++	).Return(&keycloakv2.GroupRepresentation{
++		Id:   ptr.To("existing-id"),
++		Name: ptr.To("old-name"),
++		Path: ptr.To("/old-name"),
++	}, nil, nil)
++
++	mockGroups.EXPECT().UpdateGroup(
++		context.Background(), "test-realm", "existing-id",
++		keycloakv2.GroupRepresentation{
++			Id:          ptr.To("existing-id"),
++			Name:        ptr.To("new-name"),
++			Description: ptr.To("Updated desc"),
++			Path:        ptr.To("/new-name"),
++			Attributes:  &map[string][]string{"key": {"val"}},
++		},
++	).Return(nil, nil)
++
++	h := NewCreateOrUpdateGroup()
++	err := h.Serve(context.Background(), group, kClient, groupCtx)
++	require.NoError(t, err)
++	assert.Equal(t, "existing-id", groupCtx.GroupID)
++}
++
++func TestCreateOrUpdateGroup_Serve_ExistingIDNotFound_FallsBackToName(t *testing.T) {
++	mockGroups := mocks.NewMockGroupsClient(t)
++
++	kClient := &keycloakv2.KeycloakClient{Groups: mockGroups}
++	groupCtx := &GroupContext{RealmName: "test-realm", ExistingGroupID: "deleted-id"}
++
++	group := &keycloakApi.KeycloakRealmGroup{}
++	group.Spec.Name = testGroupName
++	group.Spec.Path = "/test-group"
++	group.Spec.Attributes = map[string][]string{"key": {"val"}}
++
++	mockGroups.EXPECT().GetGroup(
++		context.Background(), "test-realm", "deleted-id",
++	).Return(nil, nil, keycloakv2.ErrNotFound)
++
++	mockGroups.EXPECT().FindGroupByName(
++		context.Background(), "test-realm", testGroupName,
++	).Return(nil, nil, keycloakv2.ErrNotFound)
++
++	mockGroups.EXPECT().CreateGroup(
++		context.Background(), "test-realm",
++		keycloakv2.GroupRepresentation{
++			Name:        ptr.To(testGroupName),
++			Description: ptr.To(""),
++			Path:        ptr.To("/test-group"),
++			Attributes:  &map[string][]string{"key": {"val"}},
++		},
++	).Return(&keycloakv2.Response{
++		HTTPResponse: &http.Response{
++			Header: http.Header{"Location": []string{"http://localhost/admin/realms/test-realm/groups/new-id"}},
++		},
++	}, nil)
++
++	h := NewCreateOrUpdateGroup()
++	err := h.Serve(context.Background(), group, kClient, groupCtx)
++	require.NoError(t, err)
++	assert.Equal(t, "new-id", groupCtx.GroupID)
++}
++
++func TestCreateOrUpdateGroup_Serve_GetGroupByIDError(t *testing.T) {
++	mockGroups := mocks.NewMockGroupsClient(t)
++
++	kClient := &keycloakv2.KeycloakClient{Groups: mockGroups}
++	groupCtx := &GroupContext{RealmName: "test-realm", ExistingGroupID: "existing-id"}
++
++	group := &keycloakApi.KeycloakRealmGroup{}
++	group.Spec.Name = testGroupName
++
++	mockGroups.EXPECT().GetGroup(
++		context.Background(), "test-realm", "existing-id",
++	).Return(nil, nil, errors.New("connection error"))
++
++	h := NewCreateOrUpdateGroup()
++	err := h.Serve(context.Background(), group, kClient, groupCtx)
++	assert.ErrorContains(t, err, "unable to get group by ID")
++}
+diff --git a/internal/controller/keycloakrealmgroup/keycloakrealmgroup_controller.go b/internal/controller/keycloakrealmgroup/keycloakrealmgroup_controller.go
+index 0f7e6ce3..52015e24 100644
+--- a/internal/controller/keycloakrealmgroup/keycloakrealmgroup_controller.go
++++ b/internal/controller/keycloakrealmgroup/keycloakrealmgroup_controller.go
+@@ -166,8 +166,9 @@ func (r *ReconcileKeycloakRealmGroup) tryReconcile(ctx context.Context, keycloak
+ 	}
+ 
+ 	groupCtx := &chain.GroupContext{
+-		RealmName:     realmName,
+-		ParentGroupID: parentGroupID,
++		RealmName:       realmName,
++		ParentGroupID:   parentGroupID,
++		ExistingGroupID: keycloakRealmGroup.Status.ID,
+ 	}
+ 
+ 	if err := chain.MakeChain().Serve(ctx, keycloakRealmGroup, kClientV2, groupCtx); err != nil {
diff --git a/packages/system/keycloak-operator/values.yaml b/packages/system/keycloak-operator/values.yaml
index fc61c51f..3bdacddc 100644
--- a/packages/system/keycloak-operator/values.yaml
+++ b/packages/system/keycloak-operator/values.yaml
@@ -1,4 +1,8 @@
 keycloak-operator:
+  image:
+    registry: ghcr.io
+    repository: cozystack/cozystack/keycloak-operator
+    tag: "latest@sha256:27279247dfbd2d1e86fc4e827d34c891880ca65eefd75da1701bc0a1adf865a9"
   clusterReconciliationEnabled: true
   resources:
     limits:
diff --git a/packages/system/keycloak/values.yaml b/packages/system/keycloak/values.yaml
index 708edc2c..b2f53d01 100644
--- a/packages/system/keycloak/values.yaml
+++ b/packages/system/keycloak/values.yaml
@@ -1,4 +1,4 @@
-image: quay.io/keycloak/keycloak:26.0.4
+image: quay.io/keycloak/keycloak:26.5.2
 
 ingress:
   # Custom hostname for the Keycloak Ingress.

From f82f13bf320491fe06e26c998be3b3bbe627f835 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Thu, 12 Mar 2026 11:11:25 +0500
Subject: [PATCH 255/666] [kubernetes] Fixed k8s<1.32 creation

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/apps/kubernetes/Makefile             | 26 ++++++++++---------
 .../images/ubuntu-container-disk-v1.30.tag    |  1 +
 .../images/ubuntu-container-disk-v1.31.tag    |  1 +
 .../images/ubuntu-container-disk-v1.32.tag    |  1 +
 .../images/ubuntu-container-disk-v1.33.tag    |  1 +
 .../images/ubuntu-container-disk-v1.34.tag    |  1 +
 .../images/ubuntu-container-disk-v1.35.tag    |  1 +
 .../images/ubuntu-container-disk.tag          |  1 -
 .../apps/kubernetes/templates/cluster.yaml    |  5 +++-
 9 files changed, 24 insertions(+), 14 deletions(-)
 create mode 100644 packages/apps/kubernetes/images/ubuntu-container-disk-v1.30.tag
 create mode 100644 packages/apps/kubernetes/images/ubuntu-container-disk-v1.31.tag
 create mode 100644 packages/apps/kubernetes/images/ubuntu-container-disk-v1.32.tag
 create mode 100644 packages/apps/kubernetes/images/ubuntu-container-disk-v1.33.tag
 create mode 100644 packages/apps/kubernetes/images/ubuntu-container-disk-v1.34.tag
 create mode 100644 packages/apps/kubernetes/images/ubuntu-container-disk-v1.35.tag
 delete mode 100644 packages/apps/kubernetes/images/ubuntu-container-disk.tag

diff --git a/packages/apps/kubernetes/Makefile b/packages/apps/kubernetes/Makefile
index 48bdc33d..b19f624d 100644
--- a/packages/apps/kubernetes/Makefile
+++ b/packages/apps/kubernetes/Makefile
@@ -1,4 +1,4 @@
-KUBERNETES_VERSION = v1.35
+KUBERNETES_VERSIONS = $(shell awk -F'"' '{print $$2}' files/versions.yaml)
 KUBERNETES_PKG_TAG = $(shell awk '$$1 == "version:" {print $$2}' Chart.yaml)
 
 include ../../../hack/common-envs.mk
@@ -15,17 +15,19 @@ update:
 image: image-ubuntu-container-disk image-kubevirt-cloud-provider image-kubevirt-csi-driver image-cluster-autoscaler
 
 image-ubuntu-container-disk:
-	docker buildx build images/ubuntu-container-disk \
-		--build-arg KUBERNETES_VERSION=${KUBERNETES_VERSION} \
-		--tag $(REGISTRY)/ubuntu-container-disk:$(call settag,$(KUBERNETES_VERSION)) \
-		--tag $(REGISTRY)/ubuntu-container-disk:$(call settag,$(KUBERNETES_VERSION)-$(TAG)) \
-		--cache-from type=registry,ref=$(REGISTRY)/ubuntu-container-disk:latest \
-		--cache-to type=inline \
-		--metadata-file images/ubuntu-container-disk.json \
-		$(BUILDX_ARGS)
-	echo "$(REGISTRY)/ubuntu-container-disk:$(call settag,$(KUBERNETES_VERSION))@$$(yq e '."containerimage.digest"' images/ubuntu-container-disk.json -o json -r)" \
-		> images/ubuntu-container-disk.tag
-	rm -f images/ubuntu-container-disk.json
+	$(foreach ver,$(KUBERNETES_VERSIONS), \
+		docker buildx build images/ubuntu-container-disk \
+			--build-arg KUBERNETES_VERSION=$(ver) \
+			--tag $(REGISTRY)/ubuntu-container-disk:$(call settag,$(ver)) \
+			--tag $(REGISTRY)/ubuntu-container-disk:$(call settag,$(ver)-$(TAG)) \
+			--cache-from type=registry,ref=$(REGISTRY)/ubuntu-container-disk:$(call settag,$(ver)) \
+			--cache-to type=inline \
+			--metadata-file images/ubuntu-container-disk-$(ver).json \
+			$(BUILDX_ARGS) && \
+		echo "$(REGISTRY)/ubuntu-container-disk:$(call settag,$(ver))@$$(yq e '."containerimage.digest"' images/ubuntu-container-disk-$(ver).json -o json -r)" \
+			> images/ubuntu-container-disk-$(ver).tag && \
+		rm -f images/ubuntu-container-disk-$(ver).json; \
+	)
 
 image-kubevirt-cloud-provider:
 	docker buildx build images/kubevirt-cloud-provider \
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.30.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.30.tag
new file mode 100644
index 00000000..0a444548
--- /dev/null
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.30.tag
@@ -0,0 +1 @@
+ttl.sh/rjfkdsjflsk/ubuntu-container-disk:v1.30@sha256:8c2276f68beb67edf5bf76d6c97b271dd9303b336e1d5850ae2b91a590c9bb57
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.31.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.31.tag
new file mode 100644
index 00000000..48878d18
--- /dev/null
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.31.tag
@@ -0,0 +1 @@
+ttl.sh/rjfkdsjflsk/ubuntu-container-disk:v1.31@sha256:2b631cd227bc9b1bae16de033830e756cd6590b512dc0d2b13367ee626f3e4ca
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.32.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.32.tag
new file mode 100644
index 00000000..948c89ce
--- /dev/null
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.32.tag
@@ -0,0 +1 @@
+ttl.sh/rjfkdsjflsk/ubuntu-container-disk:v1.32@sha256:600d6ce7df4eaa8cc79c7d6d1b01ecac43e7696beb84eafce752d9210a16455f
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.33.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.33.tag
new file mode 100644
index 00000000..6f0b3c5e
--- /dev/null
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.33.tag
@@ -0,0 +1 @@
+ttl.sh/rjfkdsjflsk/ubuntu-container-disk:v1.33@sha256:243e55d6f2887a4f6ce8526de52fd083b7b88194d5c7f3eaa51b87efb557ac88
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.34.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.34.tag
new file mode 100644
index 00000000..2ac7be2e
--- /dev/null
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.34.tag
@@ -0,0 +1 @@
+ttl.sh/rjfkdsjflsk/ubuntu-container-disk:v1.34@sha256:ad8377d5644ba51729dc69dff4c9f6b4a48957075d054a58c61a45d0bb41f6af
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.35.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.35.tag
new file mode 100644
index 00000000..9d749933
--- /dev/null
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.35.tag
@@ -0,0 +1 @@
+ttl.sh/rjfkdsjflsk/ubuntu-container-disk:v1.35@sha256:1c2f2430383a9b9882358c60c194465c1b6092b4aa77536a0343cf74155c0067
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk.tag b/packages/apps/kubernetes/images/ubuntu-container-disk.tag
deleted file mode 100644
index ddc7baa4..00000000
--- a/packages/apps/kubernetes/images/ubuntu-container-disk.tag
+++ /dev/null
@@ -1 +0,0 @@
-ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.35@sha256:39f626c802dd84f95720ffb54fcd80dfb8a58ac280498870d0a1aa30d4252f94
diff --git a/packages/apps/kubernetes/templates/cluster.yaml b/packages/apps/kubernetes/templates/cluster.yaml
index b97af93e..7d71858b 100644
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -74,7 +74,7 @@ spec:
           volumes:
           - name: system
             containerDisk:
-              image: "{{ $.Files.Get "images/ubuntu-container-disk.tag" | trim }}"
+              image: "{{ $.Files.Get (printf "images/ubuntu-container-disk-%s.tag" $.Values.version) | trim }}"
           - name: ephemeral
             emptyDisk:
               capacity: {{ .group.ephemeralStorage | default "20Gi" }}
@@ -249,6 +249,9 @@ spec:
       joinConfiguration:
         nodeRegistration:
           kubeletExtraArgs: {}
+          # Ignore this for 1.31
+          ignorePreflightErrors:
+          - FileExisting-conntrack
         discovery:
           bootstrapToken:
             apiServerEndpoint: {{ $.Release.Name }}.{{ $.Release.Namespace }}.svc:6443

From 93992ef00b8a4e5e3116684903c6d9446d818980 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Thu, 12 Mar 2026 13:44:16 +0500
Subject: [PATCH 256/666] [backups] Added fix to roles and
 backupstrategy-controller location

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .../core/platform/sources/backupstrategy-controller.yaml   | 2 +-
 packages/system/backup-controller/templates/rbac.yaml      | 7 +++++++
 .../system/backupstrategy-controller/templates/rbac.yaml   | 4 ++++
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/packages/core/platform/sources/backupstrategy-controller.yaml b/packages/core/platform/sources/backupstrategy-controller.yaml
index 3647e8dc..b86c5c0d 100644
--- a/packages/core/platform/sources/backupstrategy-controller.yaml
+++ b/packages/core/platform/sources/backupstrategy-controller.yaml
@@ -18,5 +18,5 @@ spec:
       path: system/backupstrategy-controller
       install:
         privileged: true
-        namespace: cozy-backupstrategy-controller
+        namespace: cozy-backup-controller
         releaseName: backupstrategy-controller
diff --git a/packages/system/backup-controller/templates/rbac.yaml b/packages/system/backup-controller/templates/rbac.yaml
index 37ab7243..da2460c0 100644
--- a/packages/system/backup-controller/templates/rbac.yaml
+++ b/packages/system/backup-controller/templates/rbac.yaml
@@ -14,3 +14,10 @@ rules:
 - apiGroups: ["backups.cozystack.io"]
   resources: ["backupjobs"]
   verbs: ["create", "get", "list", "watch"]
+# Leader election (--leader-elect)
+- apiGroups: ["coordination.k8s.io"]
+  resources: ["leases"]
+  verbs: ["get", "list", "watch", "create", "update", "patch"]
+- apiGroups: [""]
+  resources: ["events"]
+  verbs: ["create", "patch"]
diff --git a/packages/system/backupstrategy-controller/templates/rbac.yaml b/packages/system/backupstrategy-controller/templates/rbac.yaml
index b69a2744..7c31d408 100644
--- a/packages/system/backupstrategy-controller/templates/rbac.yaml
+++ b/packages/system/backupstrategy-controller/templates/rbac.yaml
@@ -30,6 +30,10 @@ rules:
 - apiGroups: ["velero.io"]
   resources: ["backups", "restores"]
   verbs: ["create", "get", "list", "watch", "update", "patch"]
+# Events from Recorder.Event() calls
+- apiGroups: [""]
+  resources: ["events"]
+  verbs: ["create", "patch"]
 # Leader election (--leader-elect)
 - apiGroups: ["coordination.k8s.io"]
   resources: ["leases"]

From 450e2e8ec4810d6bda17d1ce6b2c3ba268db6d40 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 12 Mar 2026 13:51:02 +0100
Subject: [PATCH 257/666] refactor(linstor): hardcode relocate defaults, remove
 SC/VSC parameters

Hardcode relocateAfterClone=true and relocateAfterRestore=false as
defaults in the CSI driver patch instead of exposing them via
StorageClass/VolumeSnapshotClass parameters.

Remove the extra linstor-snapshots-ephemeral VolumeSnapshotClass (Velero)
and the relocateAfterRestore parameter from the default VolumeSnapshotClass.

This is a temporary measure while upstream linstor-server is deciding on
the interface for the rebalance feature (see LINBIT/linstor-server#487).
Once upstream provides native rebalance support, these hardcoded defaults
will be replaced by the proper upstream mechanism.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../patches/001-relocate-after-clone-restore.diff     |  2 +-
 .../system/linstor/templates/volumesnapshotclass.yaml | 11 -----------
 2 files changed, 1 insertion(+), 12 deletions(-)

diff --git a/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff b/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
index bef36969..ff0aec0c 100644
--- a/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
+++ b/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
@@ -264,7 +264,7 @@ index 39acd95..aed18ab 100644
  		NfsServiceName:         "linstor-csi-nfs",
  		NfsSquash:              "no_root_squash",
  		NfsRecoveryVolumeBytes: 300 * 1024 * 1024,
-+		RelocateAfterClone:     false,
++		RelocateAfterClone:     true,
  	}
  
  	for k, v := range params {
diff --git a/packages/system/linstor/templates/volumesnapshotclass.yaml b/packages/system/linstor/templates/volumesnapshotclass.yaml
index 17350a1b..4e950f3f 100644
--- a/packages/system/linstor/templates/volumesnapshotclass.yaml
+++ b/packages/system/linstor/templates/volumesnapshotclass.yaml
@@ -6,14 +6,3 @@ metadata:
  name: linstor-snapshots
 driver: linstor.csi.linbit.com
 deletionPolicy: Delete
-parameters:
-  snap.linstor.csi.linbit.com/relocateAfterRestore: "true"
----
-apiVersion: snapshot.storage.k8s.io/v1
-kind: VolumeSnapshotClass
-metadata:
- annotations:
-   velero.io/csi-volumesnapshot-class: "true"
- name: linstor-snapshots-ephemeral
-driver: linstor.csi.linbit.com
-deletionPolicy: Delete

From f647cfd7b9b339b2dc4aa0078b480239fe30095e Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Fri, 13 Mar 2026 01:08:13 +0300
Subject: [PATCH 258/666] [bucket] Fix s3manager endpoint to use actual S3
 endpoint from BucketInfo

The deployment template was constructing the S3 endpoint from the tenant's
namespace host (e.g. s3.freedom.infra.example.com), while COSI credentials
are issued for the actual SeaweedFS endpoint (e.g. s3.infra.example.com).
This mismatch caused 'invalid credentials' errors when users tried to log
in with valid credentials from the bucket secret.

Now the endpoint is resolved from BucketInfo (same source as credentials),
with a fallback to the constructed namespace host for first-time deploys
before BucketAccess secrets are created.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 packages/system/bucket/templates/deployment.yaml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/packages/system/bucket/templates/deployment.yaml b/packages/system/bucket/templates/deployment.yaml
index 4e055334..5c13cb2d 100644
--- a/packages/system/bucket/templates/deployment.yaml
+++ b/packages/system/bucket/templates/deployment.yaml
@@ -1,3 +1,12 @@
+{{- $endpoint := printf "s3.%s" .Values._namespace.host }}
+{{- range $name, $user := .Values.users }}
+  {{- $secretName := printf "%s-%s" $.Values.bucketName $name }}
+  {{- $existingSecret := lookup "v1" "Secret" $.Release.Namespace $secretName }}
+  {{- if $existingSecret }}
+    {{- $bucketInfo := fromJson (b64dec (index $existingSecret.data "BucketInfo")) }}
+    {{- $endpoint = trimPrefix "https://" (index $bucketInfo.spec.secretS3 "endpoint") }}
+  {{- end }}
+{{- end }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -17,6 +26,6 @@ spec:
         image: "{{ $.Files.Get "images/s3manager.tag" | trim }}"
         env:
         - name: ENDPOINT
-          value: "s3.{{ .Values._namespace.host }}"
+          value: {{ $endpoint | quote }}
         - name: SKIP_SSL_VERIFICATION
           value: "true"

From ee83aaa82e9a3d213f2942ddc745bcc0bc2bf132 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 12 Mar 2026 23:58:55 +0100
Subject: [PATCH 259/666] fix(api): skip OpenAPI post-processor for non-apps
 group versions

The OpenAPI PostProcessSpec callback is invoked for every group-version
(apps, core, version, etc.), but the Application schema cloning logic
only applies to apps.cozystack.io. When called for other GVs the base
Application schemas are absent, causing a spurious error log on every
API server start.

Return early instead of erroring when the base schemas are not found.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 pkg/cmd/server/openapi.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkg/cmd/server/openapi.go b/pkg/cmd/server/openapi.go
index 616709ca..5d1b35db 100644
--- a/pkg/cmd/server/openapi.go
+++ b/pkg/cmd/server/openapi.go
@@ -224,8 +224,8 @@ func buildPostProcessV3(kindSchemas map[string]string) func(*spec3.OpenAPI) (*sp
 		base, ok1 := doc.Components.Schemas[baseRef]
 		list, ok2 := doc.Components.Schemas[baseListRef]
 		stat, ok3 := doc.Components.Schemas[baseStatusRef]
-		if !(ok1 && ok2 && ok3) && len(kindSchemas) > 0 {
-			return doc, fmt.Errorf("base Application* schemas not found")
+		if !(ok1 && ok2 && ok3) {
+			return doc, nil // not the apps GV — nothing to patch
 		}
 
 		// Clone base schemas for each kind
@@ -339,8 +339,8 @@ func buildPostProcessV2(kindSchemas map[string]string) func(*spec.Swagger) (*spe
 		base, ok1 := defs[baseRef]
 		list, ok2 := defs[baseListRef]
 		stat, ok3 := defs[baseStatusRef]
-		if !(ok1 && ok2 && ok3) && len(kindSchemas) > 0 {
-			return sw, fmt.Errorf("base Application* schemas not found")
+		if !(ok1 && ok2 && ok3) {
+			return sw, nil // not the apps GV — nothing to patch
 		}
 
 		for kind, raw := range kindSchemas {

From f906a0d8ad56f9cee705b6ae3c8332bce8eac525 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Fri, 13 Mar 2026 00:31:56 +0100
Subject: [PATCH 260/666] fix(operator): requeue packages when dependencies are
 not ready

When dependencies are not ready the reconciler returned without
requeueing, relying solely on watch events to re-trigger. If a watch
event was missed (controller restart, race condition, dependency already
ready before watch setup), the package would stay stuck in
DependenciesNotReady forever.

Add RequeueAfter: 30s so dependencies are periodically rechecked.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 internal/operator/package_reconciler.go | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/internal/operator/package_reconciler.go b/internal/operator/package_reconciler.go
index 32e667e4..d95d3e67 100644
--- a/internal/operator/package_reconciler.go
+++ b/internal/operator/package_reconciler.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"fmt"
 	"strings"
+	"time"
 
 	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
 	helmv2 "github.com/fluxcd/helm-controller/api/v2"
@@ -141,8 +142,8 @@ func (r *PackageReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
 		if err := r.Status().Update(ctx, pkg); err != nil {
 			return ctrl.Result{}, err
 		}
-		// Return success to avoid requeue, but don't create HelmReleases
-		return ctrl.Result{}, nil
+		// Requeue to periodically recheck dependencies in case watch events are missed
+		return ctrl.Result{RequeueAfter: 30 * time.Second}, nil
 	}
 
 	// Create HelmReleases for components with Install section

From 2b60c010ddea2c28c43d9ec3e89de13025129b99 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Fri, 13 Mar 2026 00:56:27 +0100
Subject: [PATCH 261/666] Revert "fix(operator): requeue packages when
 dependencies are not ready"

This reverts commit f906a0d8ad56f9cee705b6ae3c8332bce8eac525.

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 internal/operator/package_reconciler.go | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/internal/operator/package_reconciler.go b/internal/operator/package_reconciler.go
index d95d3e67..32e667e4 100644
--- a/internal/operator/package_reconciler.go
+++ b/internal/operator/package_reconciler.go
@@ -20,7 +20,6 @@ import (
 	"context"
 	"fmt"
 	"strings"
-	"time"
 
 	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
 	helmv2 "github.com/fluxcd/helm-controller/api/v2"
@@ -142,8 +141,8 @@ func (r *PackageReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
 		if err := r.Status().Update(ctx, pkg); err != nil {
 			return ctrl.Result{}, err
 		}
-		// Requeue to periodically recheck dependencies in case watch events are missed
-		return ctrl.Result{RequeueAfter: 30 * time.Second}, nil
+		// Return success to avoid requeue, but don't create HelmReleases
+		return ctrl.Result{}, nil
 	}
 
 	// Create HelmReleases for components with Install section

From b3f356a5ed78ddbd37ee7011f1c26005acd09523 Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Fri, 13 Mar 2026 15:41:31 +0000
Subject: [PATCH 262/666] docs: add changelog for v1.0.5

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.0.5.md | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 docs/changelogs/v1.0.5.md

diff --git a/docs/changelogs/v1.0.5.md b/docs/changelogs/v1.0.5.md
new file mode 100644
index 00000000..51f01143
--- /dev/null
+++ b/docs/changelogs/v1.0.5.md
@@ -0,0 +1,29 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.0.5
+-->
+
+## Fixes
+
+* **[api] Fix spurious OpenAPI post-processing errors for non-apps group versions**: The API server no longer logs false errors while generating OpenAPI specs for core and other non-`apps.cozystack.io` group versions. The post-processor now exits early when the base `Application` schemas are absent, reducing noisy startup logs without affecting application schema generation ([**@kvaps**](https://github.com/kvaps) in #2212, #2216).
+
+## Documentation
+
+* **[website] Add `DependenciesNotReady` troubleshooting and correct packages management build target**: Added a troubleshooting guide for packages stuck in `DependenciesNotReady`, including how to inspect operator logs and identify missing dependencies, and fixed the outdated `make image-cozystack` command to `make image-packages` in the packages management guide ([**@kvaps**](https://github.com/kvaps) in cozystack/website#450).
+
+* **[website] Clarify operator-first installation order**: Reordered the platform installation guide and tutorial so users install the Cozystack operator before preparing and applying the Platform Package, matching the rest of the installation docs and reducing setup confusion during fresh installs ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#449).
+
+* **[website] Add automated installation guide for Ansible**: Added end-to-end documentation for deploying Cozystack with the `cozystack.installer` Ansible collection, including inventory examples, distro-specific playbooks, configuration reference, verification steps, and explicit version pinning guidance to help operators automate installs safely ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#442).
+
+* **[website] Expand CA rotation operations guide**: Completed the CA rotation documentation with separate Talos and Kubernetes certificate rotation procedures, dry-run preview steps, and post-rotation guidance for fetching updated `talosconfig` and `kubeconfig` files after certificate changes ([**@kvaps**](https://github.com/kvaps) in cozystack/website#406).
+
+* **[website] Improve backup operations documentation**: Enhanced the operator backup and recovery guide with clearer Velero enablement steps, concrete provider and bucket examples, and more useful commands for inspecting backups, schedules, restores, CRD status, and logs ([**@androndo**](https://github.com/androndo) in cozystack/website#440).
+
+* **[website] Add custom metrics collection guide**: Added a monitoring guide showing how tenants can expose their own Prometheus exporters through `VMServiceScrape` and `VMPodScrape`, including namespace labeling requirements, example manifests, verification steps, and troubleshooting advice ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#444).
+
+* **[website] Document PackageSource and Package architecture**: Added a Key Concepts reference covering `PackageSource` and `Package` reconciliation flow, dependency handling, update propagation, rollback behavior, FluxPlunger recovery, and the `cozypkg` CLI for package management ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#445).
+
+* **[website] Refresh v1 application and platform documentation**: Fixed the documentation auto-update flow and published a broad v1 documentation refresh covering newly documented applications, updated naming and navigation, virtualization and platform content updates, and reorganized versioned docs pages ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#439).
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.4...v1.0.5

From b821c0748e9d3a349b27c4fa0afeb5bcee2dc4ba Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Sun, 15 Mar 2026 22:00:25 +0500
Subject: [PATCH 263/666] feat(tenant): add schedulingClass parameter for
 tenant workloads

Allow administrators to assign a SchedulingClass CR to a tenant.
The schedulingClass is inherited by child tenants and cannot be
overridden once set by a parent.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/apps/tenant/templates/namespace.yaml | 9 +++++++++
 packages/apps/tenant/values.schema.json       | 5 +++++
 packages/apps/tenant/values.yaml              | 3 +++
 3 files changed, 17 insertions(+)

diff --git a/packages/apps/tenant/templates/namespace.yaml b/packages/apps/tenant/templates/namespace.yaml
index 5942cba3..51cd1b02 100644
--- a/packages/apps/tenant/templates/namespace.yaml
+++ b/packages/apps/tenant/templates/namespace.yaml
@@ -38,6 +38,12 @@
 {{- if .Values.seaweedfs }}
 {{- $seaweedfs = $tenantName }}
 {{- end }}
+
+{{/* SchedulingClass: inherited from parent, can be set if parent has none */}}
+{{- $schedulingClass := $parentNamespace.schedulingClass | default "" }}
+{{- if and (not $schedulingClass) .Values.schedulingClass }}
+{{- $schedulingClass = .Values.schedulingClass }}
+{{- end }}
 ---
 apiVersion: v1
 kind: Namespace
@@ -86,4 +92,7 @@ stringData:
       monitoring: {{ $monitoring | quote }}
       seaweedfs: {{ $seaweedfs | quote }}
       host: {{ $computedHost | quote }}
+      {{- with $schedulingClass }}
+      schedulingClass: {{ . | quote }}
+      {{- end }}
 {{- end }}
diff --git a/packages/apps/tenant/values.schema.json b/packages/apps/tenant/values.schema.json
index 2c3d5f89..a03f4674 100644
--- a/packages/apps/tenant/values.schema.json
+++ b/packages/apps/tenant/values.schema.json
@@ -39,6 +39,11 @@
         "x-kubernetes-int-or-string": true
       }
     },
+    "schedulingClass": {
+      "description": "The name of a SchedulingClass CR to apply scheduling constraints for this tenant's workloads.",
+      "type": "string",
+      "default": ""
+    },
     "seaweedfs": {
       "description": "Deploy own SeaweedFS.",
       "type": "boolean",
diff --git a/packages/apps/tenant/values.yaml b/packages/apps/tenant/values.yaml
index 58bb451f..f9f8a999 100644
--- a/packages/apps/tenant/values.yaml
+++ b/packages/apps/tenant/values.yaml
@@ -17,5 +17,8 @@ ingress: false
 ## @param {bool} seaweedfs - Deploy own SeaweedFS.
 seaweedfs: false
 
+## @param {string} [schedulingClass] - The name of a SchedulingClass CR to apply scheduling constraints for this tenant's workloads.
+schedulingClass: ""
+
 ## @param {map[string]quantity} resourceQuotas - Define resource quotas for the tenant.
 resourceQuotas: {}

From 0387fae62c2f2569e101689a5a24daec8cf128c5 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Sun, 15 Mar 2026 22:08:01 +0500
Subject: [PATCH 264/666] feat(dashboard): add SchedulingClass dropdown for
 Tenant form

Add an API-backed listInput dropdown for the schedulingClass field
in the Tenant creation form. The dropdown lists available
SchedulingClass CRs from cozystack.io/v1alpha1.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .../dashboard/customformsoverride.go           | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/internal/controller/dashboard/customformsoverride.go b/internal/controller/dashboard/customformsoverride.go
index e06ca909..8fb65de7 100644
--- a/internal/controller/dashboard/customformsoverride.go
+++ b/internal/controller/dashboard/customformsoverride.go
@@ -230,6 +230,10 @@ func applyListInputOverrides(schema map[string]any, kind string, openAPIProps ma
 		kafkaProps["storageClass"] = storageClassListInput()
 		zkProps := ensureSchemaPath(schema, "spec", "zookeeper")
 		zkProps["storageClass"] = storageClassListInput()
+
+	case "Tenant":
+		specProps := ensureSchemaPath(schema, "spec")
+		specProps["schedulingClass"] = schedulingClassListInput()
 	}
 }
 
@@ -246,6 +250,20 @@ func storageClassListInput() map[string]any {
 	}
 }
 
+// schedulingClassListInput returns a listInput field config for a schedulingClass dropdown
+// backed by the cluster's available SchedulingClass CRs.
+func schedulingClassListInput() map[string]any {
+	return map[string]any{
+		"type": "listInput",
+		"customProps": map[string]any{
+			"valueUri":    "/api/clusters/{cluster}/k8s/apis/cozystack.io/v1alpha1/schedulingclasses",
+			"keysToValue": []any{"metadata", "name"},
+			"keysToLabel": []any{"metadata", "name"},
+			"allowEmpty":  true,
+		},
+	}
+}
+
 // ensureArrayItemProps ensures that parentProps[fieldName].items.properties exists
 // and returns the items properties map. Used for overriding fields inside array items.
 func ensureArrayItemProps(parentProps map[string]any, fieldName string) map[string]any {

From 6046a31e8c8f3ead08cf9cf8d3e80db37493b5a9 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Sun, 15 Mar 2026 22:26:02 +0500
Subject: [PATCH 265/666] feat(tenant): add scheduling.cozystack.io/class label
 to namespace

The label is read by the lineage-controller-webhook to inject
schedulerName and scheduling-class annotation into all pods
in the tenant namespace.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/apps/tenant/templates/namespace.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/packages/apps/tenant/templates/namespace.yaml b/packages/apps/tenant/templates/namespace.yaml
index 51cd1b02..0a364e0a 100644
--- a/packages/apps/tenant/templates/namespace.yaml
+++ b/packages/apps/tenant/templates/namespace.yaml
@@ -64,6 +64,9 @@ metadata:
     namespace.cozystack.io/monitoring: {{ $monitoring | quote }}
     namespace.cozystack.io/seaweedfs: {{ $seaweedfs | quote }}
     namespace.cozystack.io/host: {{ $computedHost | quote }}
+    {{- with $schedulingClass }}
+    scheduling.cozystack.io/class: {{ . | quote }}
+    {{- end }}
     alpha.kubevirt.io/auto-memory-limits-ratio: "1.0"
   ownerReferences:
   - apiVersion: v1

From 1024ee76070c47fbe51c04a64dca3545a095ff83 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Sun, 15 Mar 2026 22:27:35 +0500
Subject: [PATCH 266/666] feat(lineage-webhook): inject schedulerName for
 tenant scheduling

When a namespace carries the scheduling.cozystack.io/class label,
the webhook injects schedulerName=cozystack-scheduler and the
scheduler.cozystack.io/scheduling-class annotation into every Pod.
This covers all workloads in the tenant namespace regardless of
whether the operator CRD supports schedulerName natively.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 internal/lineagecontrollerwebhook/webhook.go | 43 ++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/internal/lineagecontrollerwebhook/webhook.go b/internal/lineagecontrollerwebhook/webhook.go
index 299cbaee..18749b05 100644
--- a/internal/lineagecontrollerwebhook/webhook.go
+++ b/internal/lineagecontrollerwebhook/webhook.go
@@ -8,11 +8,13 @@ import (
 	"strings"
 
 	"github.com/cozystack/cozystack/pkg/lineage"
+	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/dynamic"
 	"k8s.io/client-go/rest"
 	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
@@ -31,6 +33,11 @@ const (
 	ManagerGroupKey  = "apps.cozystack.io/application.group"
 	ManagerKindKey   = "apps.cozystack.io/application.kind"
 	ManagerNameKey   = "apps.cozystack.io/application.name"
+
+	// Scheduling constants
+	SchedulingClassLabel      = "scheduling.cozystack.io/class"
+	SchedulingClassAnnotation = "scheduler.cozystack.io/scheduling-class"
+	CozystackSchedulerName    = "cozystack-scheduler"
 )
 
 // getResourceSelectors returns the appropriate ApplicationDefinitionResources for a given GroupKind
@@ -115,6 +122,11 @@ func (h *LineageControllerWebhook) Handle(ctx context.Context, req admission.Req
 
 	h.applyLabels(obj, labels)
 
+	if err := h.applySchedulingClass(ctx, obj, req.Namespace); err != nil {
+		logger.Error(err, "error applying scheduling class")
+		return admission.Errored(500, fmt.Errorf("error applying scheduling class: %w", err))
+	}
+
 	mutated, err := json.Marshal(obj)
 	if err != nil {
 		return admission.Errored(500, fmt.Errorf("marshal mutated pod: %w", err))
@@ -185,6 +197,37 @@ func (h *LineageControllerWebhook) applyLabels(o *unstructured.Unstructured, lab
 	o.SetLabels(existing)
 }
 
+// applySchedulingClass injects schedulerName and scheduling-class annotation
+// into Pods whose namespace carries the scheduling.cozystack.io/class label.
+func (h *LineageControllerWebhook) applySchedulingClass(ctx context.Context, obj *unstructured.Unstructured, namespace string) error {
+	if obj.GetKind() != "Pod" {
+		return nil
+	}
+
+	ns := &corev1.Namespace{}
+	if err := h.Get(ctx, client.ObjectKey{Name: namespace}, ns); err != nil {
+		return fmt.Errorf("getting namespace %s: %w", namespace, err)
+	}
+
+	schedulingClass, ok := ns.Labels[SchedulingClassLabel]
+	if !ok || schedulingClass == "" {
+		return nil
+	}
+
+	if err := unstructured.SetNestedField(obj.Object, CozystackSchedulerName, "spec", "schedulerName"); err != nil {
+		return fmt.Errorf("setting schedulerName: %w", err)
+	}
+
+	annotations := obj.GetAnnotations()
+	if annotations == nil {
+		annotations = make(map[string]string)
+	}
+	annotations[SchedulingClassAnnotation] = schedulingClass
+	obj.SetAnnotations(annotations)
+
+	return nil
+}
+
 func (h *LineageControllerWebhook) decodeUnstructured(req admission.Request, out *unstructured.Unstructured) error {
 	if h.decoder != nil {
 		if err := h.decoder.Decode(req, out); err == nil {

From 43d49b6e4631054d27447b9e64c90c81ba5149bb Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Sun, 15 Mar 2026 22:33:43 +0500
Subject: [PATCH 267/666] feat(lineage-webhook): verify SchedulingClass CR
 before injection

Before injecting schedulerName and annotation, the webhook now
checks that the referenced SchedulingClass CR actually exists.
If the CRD is not installed or the CR is missing, injection is
skipped so that pods are not stuck Pending on a non-existent
scheduler.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 internal/lineagecontrollerwebhook/webhook.go | 21 ++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/internal/lineagecontrollerwebhook/webhook.go b/internal/lineagecontrollerwebhook/webhook.go
index 18749b05..6955518e 100644
--- a/internal/lineagecontrollerwebhook/webhook.go
+++ b/internal/lineagecontrollerwebhook/webhook.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/cozystack/cozystack/pkg/lineage"
 	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/dynamic"
@@ -199,6 +200,9 @@ func (h *LineageControllerWebhook) applyLabels(o *unstructured.Unstructured, lab
 
 // applySchedulingClass injects schedulerName and scheduling-class annotation
 // into Pods whose namespace carries the scheduling.cozystack.io/class label.
+// If the referenced SchedulingClass CR does not exist (e.g. the scheduler
+// package is not installed), the injection is silently skipped so that pods
+// are not left Pending.
 func (h *LineageControllerWebhook) applySchedulingClass(ctx context.Context, obj *unstructured.Unstructured, namespace string) error {
 	if obj.GetKind() != "Pod" {
 		return nil
@@ -214,6 +218,17 @@ func (h *LineageControllerWebhook) applySchedulingClass(ctx context.Context, obj
 		return nil
 	}
 
+	// Verify that the referenced SchedulingClass CR exists.
+	// If the CRD is not installed or the CR is missing, skip injection
+	// so that pods are not stuck Pending on a non-existent scheduler.
+	_, err := h.dynClient.Resource(schedulingClassGVR).Get(ctx, schedulingClass, metav1.GetOptions{})
+	if err != nil {
+		logger := log.FromContext(ctx)
+		logger.Info("SchedulingClass not found, skipping scheduler injection",
+			"schedulingClass", schedulingClass, "namespace", namespace)
+		return nil
+	}
+
 	if err := unstructured.SetNestedField(obj.Object, CozystackSchedulerName, "spec", "schedulerName"); err != nil {
 		return fmt.Errorf("setting schedulerName: %w", err)
 	}
@@ -228,6 +243,12 @@ func (h *LineageControllerWebhook) applySchedulingClass(ctx context.Context, obj
 	return nil
 }
 
+var schedulingClassGVR = schema.GroupVersionResource{
+	Group:    "cozystack.io",
+	Version:  "v1alpha1",
+	Resource: "schedulingclasses",
+}
+
 func (h *LineageControllerWebhook) decodeUnstructured(req admission.Request, out *unstructured.Unstructured) error {
 	if h.decoder != nil {
 		if err := h.decoder.Decode(req, out); err == nil {

From 7c59b6dc51a077b27e301192bdc3616f4669004a Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Sun, 15 Mar 2026 22:39:49 +0500
Subject: [PATCH 268/666] chore(tenant): generate readme and app definition for
 schedulingClass support

Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/apps/tenant/README.md                | 17 +++++++++--------
 packages/system/tenant-rd/cozyrds/tenant.yaml |  4 ++--
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/packages/apps/tenant/README.md b/packages/apps/tenant/README.md
index 472ccce2..987e2c99 100644
--- a/packages/apps/tenant/README.md
+++ b/packages/apps/tenant/README.md
@@ -74,14 +74,15 @@ tenant-u1
 
 ### Common parameters
 
-| Name             | Description                                                                                                                | Type                  | Value   |
-| ---------------- | -------------------------------------------------------------------------------------------------------------------------- | --------------------- | ------- |
-| `host`           | The hostname used to access tenant services (defaults to using the tenant name as a subdomain for its parent tenant host). | `string`              | `""`    |
-| `etcd`           | Deploy own Etcd cluster.                                                                                                   | `bool`                | `false` |
-| `monitoring`     | Deploy own Monitoring Stack.                                                                                               | `bool`                | `false` |
-| `ingress`        | Deploy own Ingress Controller.                                                                                             | `bool`                | `false` |
-| `seaweedfs`      | Deploy own SeaweedFS.                                                                                                      | `bool`                | `false` |
-| `resourceQuotas` | Define resource quotas for the tenant.                                                                                     | `map[string]quantity` | `{}`    |
+| Name              | Description                                                                                                                | Type                  | Value   |
+| ----------------- | -------------------------------------------------------------------------------------------------------------------------- | --------------------- | ------- |
+| `host`            | The hostname used to access tenant services (defaults to using the tenant name as a subdomain for its parent tenant host). | `string`              | `""`    |
+| `etcd`            | Deploy own Etcd cluster.                                                                                                   | `bool`                | `false` |
+| `monitoring`      | Deploy own Monitoring Stack.                                                                                               | `bool`                | `false` |
+| `ingress`         | Deploy own Ingress Controller.                                                                                             | `bool`                | `false` |
+| `seaweedfs`       | Deploy own SeaweedFS.                                                                                                      | `bool`                | `false` |
+| `schedulingClass` | The name of a SchedulingClass CR to apply scheduling constraints for this tenant's workloads.                              | `string`              | `""`    |
+| `resourceQuotas`  | Define resource quotas for the tenant.                                                                                     | `map[string]quantity` | `{}`    |
 
 
 ## Configuration
diff --git a/packages/system/tenant-rd/cozyrds/tenant.yaml b/packages/system/tenant-rd/cozyrds/tenant.yaml
index 9b09692c..42286a5b 100644
--- a/packages/system/tenant-rd/cozyrds/tenant.yaml
+++ b/packages/system/tenant-rd/cozyrds/tenant.yaml
@@ -8,7 +8,7 @@ spec:
     singular: tenant
     plural: tenants
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"etcd":{"description":"Deploy own Etcd cluster.","type":"boolean","default":false},"host":{"description":"The hostname used to access tenant services (defaults to using the tenant name as a subdomain for its parent tenant host).","type":"string","default":""},"ingress":{"description":"Deploy own Ingress Controller.","type":"boolean","default":false},"monitoring":{"description":"Deploy own Monitoring Stack.","type":"boolean","default":false},"resourceQuotas":{"description":"Define resource quotas for the tenant.","type":"object","default":{},"additionalProperties":{"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}},"seaweedfs":{"description":"Deploy own SeaweedFS.","type":"boolean","default":false}}}
+      {"title":"Chart Values","type":"object","properties":{"etcd":{"description":"Deploy own Etcd cluster.","type":"boolean","default":false},"host":{"description":"The hostname used to access tenant services (defaults to using the tenant name as a subdomain for its parent tenant host).","type":"string","default":""},"ingress":{"description":"Deploy own Ingress Controller.","type":"boolean","default":false},"monitoring":{"description":"Deploy own Monitoring Stack.","type":"boolean","default":false},"resourceQuotas":{"description":"Define resource quotas for the tenant.","type":"object","default":{},"additionalProperties":{"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}},"schedulingClass":{"description":"The name of a SchedulingClass CR to apply scheduling constraints for this tenant's workloads.","type":"string","default":""},"seaweedfs":{"description":"Deploy own SeaweedFS.","type":"boolean","default":false}}}
   release:
     prefix: tenant-
     labels:
@@ -23,7 +23,7 @@ spec:
     plural: Tenants
     description: Separated tenant namespace
     icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl82ODdfMzQwMykiLz4KPGcgY2xpcC1wYXRoPSJ1cmwoI2NsaXAwXzY4N18zNDAzKSI+CjxwYXRoIGQ9Ik03MiAyOUM2Ni4zOTI2IDI5IDYxLjAxNDggMzEuMjM4OCA1Ny4wNDk3IDM1LjIyNEM1My4wODQ3IDM5LjIwOTEgNTAuODU3MSA0NC42MTQxIDUwLjg1NzEgNTAuMjVDNTAuODU3MSA1NS44ODU5IDUzLjA4NDcgNjEuMjkwOSA1Ny4wNDk3IDY1LjI3NkM2MS4wMTQ4IDY5LjI2MTIgNjYuMzkyNiA3MS41IDcyIDcxLjVDNzcuNjA3NCA3MS41IDgyLjk4NTIgNjkuMjYxMiA4Ni45NTAzIDY1LjI3NkM5MC45MTUzIDYxLjI5MDkgOTMuMTQyOSA1NS44ODU5IDkzLjE0MjkgNTAuMjVDOTMuMTQyOSA0NC42MTQxIDkwLjkxNTMgMzkuMjA5MSA4Ni45NTAzIDM1LjIyNEM4Mi45ODUyIDMxLjIzODggNzcuNjA3NCAyOSA3MiAyOVpNNjAuOTgyNiA4My4zMDM3QzYwLjQ1NCA4Mi41ODk4IDU5LjU5NTEgODIuMTkxNCA1OC43MTk2IDgyLjI3NDRDNDUuMzg5NyA4My43MzU0IDM1IDk1LjEwNzQgMzUgMTA4LjkwM0MzNSAxMTEuNzI2IDM3LjI3OTUgMTE0IDQwLjA3MSAxMTRIMTAzLjkyOUMxMDYuNzM3IDExNCAxMDkgMTExLjcwOSAxMDkgMTA4LjkwM0MxMDkgOTUuMTA3NCA5OC42MTAzIDgzLjc1MiA4NS4yNjM4IDgyLjI5MUM4NC4zODg0IDgyLjE5MTQgODMuNTI5NSA4Mi42MDY0IDgzLjAwMDkgODMuMzIwM0w3NC4wOTc4IDk1LjI0MDJDNzMuMDQwNiA5Ni42NTE0IDcwLjkyNjMgOTYuNjUxNCA2OS44NjkyIDk1LjI0MDJMNjAuOTY2MSA4My4zMjAzTDYwLjk4MjYgODMuMzAzN1oiIGZpbGw9ImJsYWNrIi8+CjwvZz4KPGRlZnM+CjxsaW5lYXJHcmFkaWVudCBpZD0icGFpbnQwX2xpbmVhcl82ODdfMzQwMyIgeDE9IjcyIiB5MT0iMTQ0IiB4Mj0iLTEuMjgxN2UtMDUiIHkyPSI0IiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+CjxzdG9wIHN0b3AtY29sb3I9IiNDMEQ2RkYiLz4KPHN0b3Agb2Zmc2V0PSIwLjMiIHN0b3AtY29sb3I9IiNDNERBRkYiLz4KPHN0b3Agb2Zmc2V0PSIwLjY1IiBzdG9wLWNvbG9yPSIjRDNFOUZGIi8+CjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iI0U5RkZGRiIvPgo8L2xpbmVhckdyYWRpZW50Pgo8Y2xpcFBhdGggaWQ9ImNsaXAwXzY4N18zNDAzIj4KPHJlY3Qgd2lkdGg9Ijc0IiBoZWlnaHQ9Ijg1IiBmaWxsPSJ3aGl0ZSIgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoMzUgMjkpIi8+CjwvY2xpcFBhdGg+CjwvZGVmcz4KPC9zdmc+Cg==
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "host"], ["spec", "etcd"], ["spec", "monitoring"], ["spec", "ingress"], ["spec", "seaweedfs"], ["spec", "resourceQuotas"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "host"], ["spec", "etcd"], ["spec", "monitoring"], ["spec", "ingress"], ["spec", "seaweedfs"], ["spec", "schedulingClass"], ["spec", "resourceQuotas"]]
   secrets:
     exclude: []
     include: []

From 7e0a059d34ba6b4057b9f7a111a3b2fbaf37ab2d Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Mon, 16 Mar 2026 01:43:05 +0000
Subject: [PATCH 269/666] docs: add changelog for v1.1.2

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.1.2.md | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 docs/changelogs/v1.1.2.md

diff --git a/docs/changelogs/v1.1.2.md b/docs/changelogs/v1.1.2.md
new file mode 100644
index 00000000..29dba321
--- /dev/null
+++ b/docs/changelogs/v1.1.2.md
@@ -0,0 +1,25 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.1.2
+-->
+
+## Fixes
+
+* **[bucket] Fix S3 Manager endpoint mismatch with COSI credentials**: The S3 Manager UI previously constructed an `s3.<tenant>.<cluster-domain>` endpoint even though COSI-issued bucket credentials point to the root-level S3 endpoint. This caused login failures with "invalid credentials" despite valid secrets. The deployment now uses the actual endpoint from `BucketInfo`, with the old namespace-based endpoint kept only as a fallback before `BucketAccess` secrets exist ([**@IvanHunters**](https://github.com/IvanHunters) in #2211, #2215).
+
+* **[platform] Fix spurious OpenAPI post-processing errors on cozystack-api startup**: The OpenAPI post-processor was being invoked for non-`apps.cozystack.io` group versions where the base `Application*` schemas do not exist, producing noisy startup errors on every API server launch. It now skips those non-apps group versions gracefully instead of returning an error ([**@kvaps**](https://github.com/kvaps) in #2212, #2217).
+
+## Documentation
+
+* **[website] Add troubleshooting for packages stuck in `DependenciesNotReady`**: Added an operations guide that explains how to diagnose missing package dependencies in operator logs and corrected the packages management development docs to use the current `make image-packages` target ([**@kvaps**](https://github.com/kvaps) in cozystack/website#450).
+
+* **[website] Reorder installation docs to install the operator before the platform package**: Updated the platform installation guide and tutorial so the setup sequence consistently installs the Cozystack operator first, then prepares and applies the Platform Package, matching the rest of the documentation set ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#449).
+
+* **[website] Add automated installation guide for the Ansible collection**: Added a full guide for deploying Cozystack with the `cozystack.installer` collection, including inventory examples, distro-specific playbooks, configuration reference, and explicit version pinning guidance ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#442).
+
+* **[website] Expand monitoring and platform architecture reference docs**: Added a tenant custom metrics collection guide for `VMServiceScrape` and `VMPodScrape`, and documented `PackageSource`/`Package` architecture, reconciliation flow, rollback behavior, and the `cozypkg` workflow in Key Concepts ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#444, cozystack/website#445).
+
+* **[website] Improve operations guides for CA rotation and Velero backups**: Completed the CA rotation documentation with dry-run and post-rotation credential retrieval steps, and expanded the backup configuration guide with concrete examples, verification commands, and clearer operator procedures ([**@kvaps**](https://github.com/kvaps) in cozystack/website#406; [**@androndo**](https://github.com/androndo) in cozystack/website#440).
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.1.1...v1.1.2

From 689c2a5e4abe61893d533f26a1a5d8af8d2d6013 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Mon, 16 Mar 2026 11:03:55 +0500
Subject: [PATCH 270/666] feat(dashboard): add keycloakInternalUrl for
 backend-to-backend OIDC requests

When set, oauth2-proxy skips OIDC discovery and routes all backend calls
(token exchange, JWKS, userinfo, logout) through the internal cluster URL
while keeping browser redirects on the external URL. This avoids external
DNS lookups and TLS overhead for pod-to-pod communication with Keycloak.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/core/platform/templates/apps.yaml          |  1 +
 packages/core/platform/values.yaml                  |  5 +++++
 packages/system/dashboard/templates/gatekeeper.yaml | 10 ++++++++++
 3 files changed, 16 insertions(+)

diff --git a/packages/core/platform/templates/apps.yaml b/packages/core/platform/templates/apps.yaml
index 96415325..16ef3c35 100644
--- a/packages/core/platform/templates/apps.yaml
+++ b/packages/core/platform/templates/apps.yaml
@@ -26,6 +26,7 @@ stringData:
       oidc-enabled: {{ .Values.authentication.oidc.enabled | quote }}
       oidc-insecure-skip-verify: {{ .Values.authentication.oidc.insecureSkipVerify | quote }}
       extra-keycloak-redirect-uri-for-dashboard: {{ index .Values.authentication.oidc.keycloakExtraRedirectUri | quote }}
+      keycloak-internal-url: {{ .Values.authentication.oidc.keycloakInternalUrl | quote }}
       expose-services: {{ .Values.publishing.exposedServices | join "," | quote }}
       expose-ingress: {{ .Values.publishing.ingressName | quote }}
       expose-external-ips: {{ .Values.publishing.externalIPs | join "," | quote }}
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index 0d33c752..7fd7751d 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -54,6 +54,11 @@ authentication:
     enabled: false
     insecureSkipVerify: false
     keycloakExtraRedirectUri: ""
+    # Internal URL to access KeyCloak realm for backend-to-backend requests (bypasses external DNS).
+    # When set, oauth2-proxy uses --skip-oidc-discovery and routes all backend calls (token, jwks,
+    # userinfo, logout) through this URL while keeping browser redirects on the external URL.
+    # Example: http://keycloak-http.cozy-keycloak.svc:8080/realms/cozy
+    keycloakInternalUrl: ""
 # Pod scheduling configuration
 scheduling:
   globalAppTopologySpreadConstraints: ""
diff --git a/packages/system/dashboard/templates/gatekeeper.yaml b/packages/system/dashboard/templates/gatekeeper.yaml
index 23427239..f7b1c7f7 100644
--- a/packages/system/dashboard/templates/gatekeeper.yaml
+++ b/packages/system/dashboard/templates/gatekeeper.yaml
@@ -1,6 +1,7 @@
 {{- $host := index .Values._cluster "root-host" }}
 {{- $oidcEnabled := index .Values._cluster "oidc-enabled" }}
 {{- $oidcInsecureSkipVerify := index .Values._cluster "oidc-insecure-skip-verify" }}
+{{- $keycloakInternalUrl := index .Values._cluster "keycloak-internal-url" | default "" }}
 
 apiVersion: apps/v1
 kind: Deployment
@@ -55,7 +56,16 @@ spec:
             - --http-address=0.0.0.0:8000
             - --redirect-url=https://dashboard.{{ $host }}/oauth2/callback
             - --oidc-issuer-url=https://keycloak.{{ $host }}/realms/cozy
+            {{- if $keycloakInternalUrl }}
+            - --skip-oidc-discovery
+            - --login-url=https://keycloak.{{ $host }}/realms/cozy/protocol/openid-connect/auth
+            - --redeem-url={{ $keycloakInternalUrl }}/protocol/openid-connect/token
+            - --oidc-jwks-url={{ $keycloakInternalUrl }}/protocol/openid-connect/certs
+            - --validate-url={{ $keycloakInternalUrl }}/protocol/openid-connect/userinfo
+            - --backend-logout-url={{ $keycloakInternalUrl }}/protocol/openid-connect/logout?id_token_hint={id_token}
+            {{- else }}
             - --backend-logout-url=https://keycloak.{{ $host }}/realms/cozy/protocol/openid-connect/logout?id_token_hint={id_token}
+            {{- end }}
             - --whitelist-domain=keycloak.{{ $host }}
             - --email-domain=*
             - --pass-access-token=true

From 2482586127903f46b36e8cd3c399d218fc11ac30 Mon Sep 17 00:00:00 2001
From: Matthieu <matthieu@hidora.com>
Date: Mon, 16 Mar 2026 09:30:06 +0100
Subject: [PATCH 271/666] [opensearch] Fix PR review issues: YAML keys and
 DaemonSet naming

Fix versions.yaml to use unquoted keys for valid YAML mapping, and
use release-based naming for sysctl DaemonSet to avoid conflicts.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Matthieu <matthieu@hidora.com>
---
 packages/apps/opensearch/files/versions.yaml              | 6 +++---
 .../opensearch-operator/templates/sysctl-daemonset.yaml   | 8 ++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/packages/apps/opensearch/files/versions.yaml b/packages/apps/opensearch/files/versions.yaml
index 5e88df94..be39fc80 100644
--- a/packages/apps/opensearch/files/versions.yaml
+++ b/packages/apps/opensearch/files/versions.yaml
@@ -1,5 +1,5 @@
 # OpenSearch version mapping (major version -> image tag)
 # Auto-generated by hack/update-versions.sh - do not edit manually
-"v3": "3.0.0"
-"v2": "2.11.1"
-"v1": "1.3.20"
+v3: "3.0.0"
+v2: "2.11.1"
+v1: "1.3.20"
diff --git a/packages/system/opensearch-operator/templates/sysctl-daemonset.yaml b/packages/system/opensearch-operator/templates/sysctl-daemonset.yaml
index 76c3569e..5c549b25 100644
--- a/packages/system/opensearch-operator/templates/sysctl-daemonset.yaml
+++ b/packages/system/opensearch-operator/templates/sysctl-daemonset.yaml
@@ -4,18 +4,18 @@
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
-  name: opensearch-sysctl-setter
+  name: {{ .Release.Name }}-sysctl-setter
   labels:
-    app.kubernetes.io/name: opensearch-sysctl-setter
+    app.kubernetes.io/name: {{ .Release.Name }}-sysctl-setter
     app.kubernetes.io/component: sysctl
 spec:
   selector:
     matchLabels:
-      app.kubernetes.io/name: opensearch-sysctl-setter
+      app.kubernetes.io/name: {{ .Release.Name }}-sysctl-setter
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: opensearch-sysctl-setter
+        app.kubernetes.io/name: {{ .Release.Name }}-sysctl-setter
     spec:
       initContainers:
         - name: sysctl

From cc5ec0b7a338f0a25973a53d043efb48ff27b695 Mon Sep 17 00:00:00 2001
From: mattia-eleuteri <mattia@hidora.io>
Date: Mon, 16 Mar 2026 14:38:26 +0100
Subject: [PATCH 272/666] [kubernetes] Fix CiliumNetworkPolicy endpointSelector
 for multi-node RWX volumes

When an NFS-backed RWX volume is published to multiple VMs, the
CiliumNetworkPolicy egress rule only allowed traffic from the first VM.
The endpointSelector.matchLabels was set once on creation and never
broadened, causing NFS mounts to hang on all nodes except the first.

Switch from matchLabels to matchExpressions (operator: In) so the
selector can list multiple VM names. Rebuild the selector whenever
ownerReferences are added or removed.

Signed-off-by: mattia-eleuteri <mattia@hidora.io>
---
 .../images/kubevirt-csi-driver/controller.go  | 51 +++++++++++++++++--
 1 file changed, 46 insertions(+), 5 deletions(-)

diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/controller.go b/packages/apps/kubernetes/images/kubevirt-csi-driver/controller.go
index 7192b95b..edddec09 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver/controller.go
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/controller.go
@@ -317,11 +317,7 @@ func (w *WrappedControllerService) ControllerPublishVolume(ctx context.Context,
 				"ownerReferences": []interface{}{vmiOwnerRef},
 			},
 			"spec": map[string]interface{}{
-				"endpointSelector": map[string]interface{}{
-					"matchLabels": map[string]interface{}{
-						"kubevirt.io/vm": vmName,
-					},
-				},
+				"endpointSelector": buildEndpointSelector([]string{vmName}),
 				"egress": []interface{}{
 					map[string]interface{}{
 						"toEndpoints": []interface{}{
@@ -441,6 +437,13 @@ func (w *WrappedControllerService) addCNPOwnerReference(ctx context.Context, nam
 		if err := unstructured.SetNestedSlice(existing.Object, ownerRefs, "metadata", "ownerReferences"); err != nil {
 			return status.Errorf(codes.Internal, "failed to set ownerReferences: %v", err)
 		}
+
+		// Rebuild endpointSelector to include all VMs
+		selector := buildEndpointSelector(vmNamesFromOwnerRefs(ownerRefs))
+		if err := unstructured.SetNestedField(existing.Object, selector, "spec", "endpointSelector"); err != nil {
+			return status.Errorf(codes.Internal, "failed to set endpointSelector: %v", err)
+		}
+
 		if _, err := w.dynamicClient.Resource(ciliumNetworkPolicyGVR).Namespace(namespace).Update(ctx, existing, metav1.UpdateOptions{}); err != nil {
 			return err
 		}
@@ -486,6 +489,13 @@ func (w *WrappedControllerService) removeCNPOwnerReference(ctx context.Context,
 		if err := unstructured.SetNestedSlice(existing.Object, remaining, "metadata", "ownerReferences"); err != nil {
 			return status.Errorf(codes.Internal, "failed to set ownerReferences: %v", err)
 		}
+
+		// Rebuild endpointSelector from remaining VMs
+		selector := buildEndpointSelector(vmNamesFromOwnerRefs(remaining))
+		if err := unstructured.SetNestedField(existing.Object, selector, "spec", "endpointSelector"); err != nil {
+			return status.Errorf(codes.Internal, "failed to set endpointSelector: %v", err)
+		}
+
 		if _, err := w.dynamicClient.Resource(ciliumNetworkPolicyGVR).Namespace(namespace).Update(ctx, existing, metav1.UpdateOptions{}); err != nil {
 			return err
 		}
@@ -494,6 +504,37 @@ func (w *WrappedControllerService) removeCNPOwnerReference(ctx context.Context,
 	})
 }
 
+// buildEndpointSelector returns an endpointSelector using matchExpressions
+// so that multiple VMs can be listed in a single selector.
+func buildEndpointSelector(vmNames []string) map[string]interface{} {
+	values := make([]interface{}, len(vmNames))
+	for i, name := range vmNames {
+		values[i] = name
+	}
+	return map[string]interface{}{
+		"matchExpressions": []interface{}{
+			map[string]interface{}{
+				"key":      "kubevirt.io/vm",
+				"operator": "In",
+				"values":   values,
+			},
+		},
+	}
+}
+
+// vmNamesFromOwnerRefs extracts VM names from ownerReferences.
+func vmNamesFromOwnerRefs(ownerRefs []interface{}) []string {
+	var names []string
+	for _, ref := range ownerRefs {
+		if refMap, ok := ref.(map[string]interface{}); ok {
+			if name, ok := refMap["name"].(string); ok {
+				names = append(names, name)
+			}
+		}
+	}
+	return names
+}
+
 func hasRWXAccessMode(pvc *corev1.PersistentVolumeClaim) bool {
 	for _, mode := range pvc.Spec.AccessModes {
 		if mode == corev1.ReadWriteMany {

From ba3ecf6893e15322a50f4a2fc0af5e8885ce58ac Mon Sep 17 00:00:00 2001
From: tym83 <6355522@gmail.com>
Date: Tue, 17 Mar 2026 02:57:52 +0500
Subject: [PATCH 273/666] docs: add SECURITY.md

Signed-off-by: tym83 <6355522@gmail.com>
---
 SECURITY.md | 102 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 102 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..b64e533b
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,102 @@
+# Security Policy
+
+## Scope
+
+This policy applies to the [`cozystack/cozystack`](https://github.com/cozystack/cozystack) repository and to release artifacts produced from it, including Cozystack core components, operators, packaged manifests, container images, and installation assets published by the project.
+
+Cozystack integrates and ships many upstream cloud native components. If you believe a vulnerability originates in an upstream project rather than in Cozystack-specific code, packaging, defaults, or integration logic, please report it to the upstream project as well. If you are unsure, report it to Cozystack first and we will help route or coordinate the issue.
+
+## Supported Versions
+
+As of March 17, 2026, the Cozystack project maintains multiple release lines. Security fixes are prioritized for the latest stable release line and, when needed, backported to other supported lines.
+
+| Version line | Status | Notes |
+| --- | --- | --- |
+| `v1.1.x` | Supported | Current stable release line. |
+| `v1.0.x` | Supported | Previous stable release line; receives security and important maintenance fixes. |
+| `v0.41.x` | Limited support | Legacy pre-v1 line during the v0 to v1 transition; critical security and upgrade-blocking fixes may be backported at maintainer discretion. |
+| `< v0.41` | Not supported | Please upgrade to a supported release line before requesting a security fix. |
+| `alpha`, `beta`, `rc` releases | Not supported | Pre-release builds are for testing and evaluation only. |
+
+Supported versions may change over time as new release lines are cut. The authoritative source for current releases is the GitHub Releases page:
+
+<https://github.com/cozystack/cozystack/releases>
+
+## Reporting a Vulnerability
+
+Please do **not** report security vulnerabilities through public GitHub issues, discussions, pull requests, Telegram, Slack, or other public community channels.
+
+At the moment, this repository does not publish a dedicated private security mailbox in-tree. If you need to report a vulnerability:
+
+1. Contact one of the project maintainers listed in `CODEOWNERS` using an existing private channel you already have.
+2. If you do not already have a private maintainer contact, use a public community channel only to request a private contact path, without disclosing any vulnerability details.
+
+Please do not include exploit details, credentials, tokens, private keys, customer data, or other sensitive material in any public message.
+
+When reporting a vulnerability, please include as much of the following as possible:
+
+- affected Cozystack version, tag, or commit
+- affected component or package, for example operator, API server, dashboard, installer, or a packaged system component
+- deployment environment and provider, for example bare metal, Hetzner, Oracle Cloud, or other infrastructure
+- prerequisites and exact reproduction steps
+- impact, attack scenario, and expected blast radius
+- whether authentication, tenant access, cluster-admin access, or network adjacency is required
+- known mitigations or workarounds
+- whether you believe the issue also affects an upstream dependency
+
+## What to Expect
+
+The maintainers will aim to:
+
+- acknowledge receipt within 3 business days
+- perform an initial triage and severity assessment within 7 business days
+- keep the reporter informed as the fix and disclosure plan are developed
+
+Resolution timelines depend on severity, complexity, release branch applicability, and whether coordination with upstream projects is required.
+
+## Disclosure Process
+
+The Cozystack project follows a coordinated disclosure model.
+
+- We ask reporters to keep details private until a fix or mitigation is available and users have had a reasonable opportunity to upgrade.
+- When appropriate, maintainers may use GitHub Security Advisories or equivalent coordinated disclosure tooling to manage remediation and public disclosure.
+- If appropriate, the project may request or publish a GHSA and/or CVE as part of the disclosure process.
+- Fixes will normally be released in the supported version lines affected by the issue, subject to severity and feasibility.
+
+Public disclosure will typically happen through one or more of the following:
+
+- GitHub Releases and release notes
+- project changelogs and documentation updates
+- GitHub Security Advisories, when used for coordinated disclosure
+
+## Project Security Practices
+
+Security is part of the normal Cozystack development and release process. Current project practices include:
+
+- maintainer-owned review through pull requests and `CODEOWNERS`
+- automated pull request checks, including pre-commit validation, unit tests, builds, and end-to-end testing
+- release automation with patch releases, release branches, and backport workflows
+- ongoing maintenance of packaged dependencies and platform integrations across supported release lines
+
+Because Cozystack is an integration-heavy platform, some vulnerabilities may require coordination across multiple repositories or with upstream maintainers before a public fix can be released.
+
+## Security Fixes and Announcements
+
+Security fixes are published in normal release artifacts whenever possible. Users should monitor:
+
+- GitHub Releases: <https://github.com/cozystack/cozystack/releases>
+- project changelogs in this repository
+- the Cozystack website and documentation: <https://cozystack.io>
+
+## Out of Scope
+
+The following are generally out of scope for private security reporting unless there is a clear Cozystack-specific impact:
+
+- vulnerabilities in unsupported or end-of-life Cozystack versions
+- issues that require access already equivalent to cluster-admin, node root, or direct infrastructure administrator privileges, unless they bypass an expected Cozystack security boundary
+- vulnerabilities that exist only in an upstream dependency and are not introduced or materially worsened by Cozystack packaging, configuration, or defaults
+- requests for security best-practice advice without a concrete vulnerability
+
+## Credits
+
+We appreciate responsible disclosure and will credit reporters in public advisories or release notes unless anonymous disclosure is requested.

From 1edbb4af97c4ea8e45a958a60ae38abd539870e5 Mon Sep 17 00:00:00 2001
From: Dmitrii Popov <dmpopof@gmail.com>
Date: Mon, 16 Mar 2026 15:27:16 +0300
Subject: [PATCH 274/666] [postgres-operator] Update to v1.27.3

Signed-off-by: Dmitrii Popov <dmpopof@gmail.com>
---
 .../charts/cloudnative-pg/Chart.lock          |    6 +-
 .../charts/cloudnative-pg/Chart.yaml          |    4 +-
 .../charts/cloudnative-pg/README.md           |   11 +-
 .../charts/cloudnative-pg/templates/NOTES.txt |    4 +-
 .../cloudnative-pg/templates/_helpers.tpl     |   11 +
 .../cloudnative-pg/templates/config.yaml      |    5 +-
 .../cloudnative-pg/templates/crds/crds.yaml   | 2209 +++++++++++++++--
 .../cloudnative-pg/templates/deployment.yaml  |   32 +-
 .../templates/monitoring-configmap.yaml       |    5 +-
 .../mutatingwebhookconfiguration.yaml         |   32 +-
 .../cloudnative-pg/templates/podmonitor.yaml  |    5 +-
 .../charts/cloudnative-pg/templates/rbac.yaml |   17 +-
 .../cloudnative-pg/templates/service.yaml     |    5 +-
 .../validatingwebhookconfiguration.yaml       |   34 +-
 .../charts/cloudnative-pg/values.schema.json  |   17 +
 .../charts/cloudnative-pg/values.yaml         |  189 +-
 16 files changed, 2264 insertions(+), 322 deletions(-)

diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/Chart.lock b/packages/system/postgres-operator/charts/cloudnative-pg/Chart.lock
index 610070fb..ca3548df 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/Chart.lock
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: cluster
   repository: https://cloudnative-pg.github.io/grafana-dashboards
-  version: 0.0.2
-digest: sha256:fcf16ad357c17be3dd79c138723e78e9e101fecc5d07d9371299c32b9f85dbd9
-generated: "2024-04-25T12:32:36.61779032-04:00"
+  version: 0.0.5
+digest: sha256:92acaa7742cad61339d69da604eda609e3d5e02f05efa224f5a58f2b845cd2b4
+generated: "2026-01-19T21:05:18.955160552+02:00"
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/Chart.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/Chart.yaml
index 191ae9c9..8ea6169e 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/Chart.yaml
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 1.25.0
+appVersion: 1.28.1
 dependencies:
 - alias: monitoring
   condition: monitoring.grafanaDashboard.create
@@ -22,4 +22,4 @@ name: cloudnative-pg
 sources:
 - https://github.com/cloudnative-pg/charts
 type: application
-version: 0.23.0
+version: 0.27.1
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/README.md b/packages/system/postgres-operator/charts/cloudnative-pg/README.md
index 9ac1378d..656bb573 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/README.md
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/README.md
@@ -1,6 +1,6 @@
 # cloudnative-pg
 
-![Version: 0.23.0](https://img.shields.io/badge/Version-0.23.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.25.0](https://img.shields.io/badge/AppVersion-1.25.0-informational?style=flat-square)
+![Version: 0.27.1](https://img.shields.io/badge/Version-0.27.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.28.1](https://img.shields.io/badge/AppVersion-1.28.1-informational?style=flat-square)
 
 CloudNativePG Operator Helm Chart
 
@@ -26,7 +26,7 @@ CloudNativePG Operator Helm Chart
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| additionalArgs | list | `[]` | Additinal arguments to be added to the operator's args list. |
+| additionalArgs | list | `[]` | Additional arguments to be added to the operator's args list. |
 | additionalEnv | list | `[]` | Array containing extra environment variables which can be templated. For example:  - name: RELEASE_NAME    value: "{{ .Release.Name }}"  - name: MY_VAR    value: "mySpecialKey" |
 | affinity | object | `{}` | Affinity for the operator to be installed. |
 | commonAnnotations | object | `{}` | Annotations to be added to all other resources. |
@@ -57,7 +57,7 @@ CloudNativePG Operator Helm Chart
 | monitoring.podMonitorMetricRelabelings | list | `[]` | Metrics relabel configurations to apply to samples before ingestion. |
 | monitoring.podMonitorRelabelings | list | `[]` | Relabel configurations to apply to samples before scraping. |
 | monitoringQueriesConfigMap.name | string | `"cnpg-default-monitoring"` | The name of the default monitoring configmap. |
-| monitoringQueriesConfigMap.queries | string | `"backends:\n  query: |\n   SELECT sa.datname\n       , sa.usename\n       , sa.application_name\n       , states.state\n       , COALESCE(sa.count, 0) AS total\n       , COALESCE(sa.max_tx_secs, 0) AS max_tx_duration_seconds\n       FROM ( VALUES ('active')\n           , ('idle')\n           , ('idle in transaction')\n           , ('idle in transaction (aborted)')\n           , ('fastpath function call')\n           , ('disabled')\n           ) AS states(state)\n       LEFT JOIN (\n           SELECT datname\n               , state\n               , usename\n               , COALESCE(application_name, '') AS application_name\n               , COUNT(*)\n               , COALESCE(EXTRACT (EPOCH FROM (max(now() - xact_start))), 0) AS max_tx_secs\n           FROM pg_catalog.pg_stat_activity\n           GROUP BY datname, state, usename, application_name\n       ) sa ON states.state = sa.state\n       WHERE sa.usename IS NOT NULL\n  metrics:\n    - datname:\n        usage: \"LABEL\"\n        description: \"Name of the database\"\n    - usename:\n        usage: \"LABEL\"\n        description: \"Name of the user\"\n    - application_name:\n        usage: \"LABEL\"\n        description: \"Name of the application\"\n    - state:\n        usage: \"LABEL\"\n        description: \"State of the backend\"\n    - total:\n        usage: \"GAUGE\"\n        description: \"Number of backends\"\n    - max_tx_duration_seconds:\n        usage: \"GAUGE\"\n        description: \"Maximum duration of a transaction in seconds\"\n\nbackends_waiting:\n  query: |\n   SELECT count(*) AS total\n   FROM pg_catalog.pg_locks blocked_locks\n   JOIN pg_catalog.pg_locks blocking_locks\n     ON blocking_locks.locktype = blocked_locks.locktype\n     AND blocking_locks.database IS NOT DISTINCT FROM blocked_locks.database\n     AND blocking_locks.relation IS NOT DISTINCT FROM blocked_locks.relation\n     AND blocking_locks.page IS NOT DISTINCT FROM blocked_locks.page\n     AND blocking_locks.tuple IS NOT DISTINCT FROM blocked_locks.tuple\n     AND blocking_locks.virtualxid IS NOT DISTINCT FROM blocked_locks.virtualxid\n     AND blocking_locks.transactionid IS NOT DISTINCT FROM blocked_locks.transactionid\n     AND blocking_locks.classid IS NOT DISTINCT FROM blocked_locks.classid\n     AND blocking_locks.objid IS NOT DISTINCT FROM blocked_locks.objid\n     AND blocking_locks.objsubid IS NOT DISTINCT FROM blocked_locks.objsubid\n     AND blocking_locks.pid != blocked_locks.pid\n   JOIN pg_catalog.pg_stat_activity blocking_activity ON blocking_activity.pid = blocking_locks.pid\n   WHERE NOT blocked_locks.granted\n  metrics:\n    - total:\n        usage: \"GAUGE\"\n        description: \"Total number of backends that are currently waiting on other queries\"\n\npg_database:\n  query: |\n    SELECT datname\n      , pg_catalog.pg_database_size(datname) AS size_bytes\n      , pg_catalog.age(datfrozenxid) AS xid_age\n      , pg_catalog.mxid_age(datminmxid) AS mxid_age\n    FROM pg_catalog.pg_database\n    WHERE datallowconn\n  metrics:\n    - datname:\n        usage: \"LABEL\"\n        description: \"Name of the database\"\n    - size_bytes:\n        usage: \"GAUGE\"\n        description: \"Disk space used by the database\"\n    - xid_age:\n        usage: \"GAUGE\"\n        description: \"Number of transactions from the frozen XID to the current one\"\n    - mxid_age:\n        usage: \"GAUGE\"\n        description: \"Number of multiple transactions (Multixact) from the frozen XID to the current one\"\n\npg_postmaster:\n  query: |\n    SELECT EXTRACT(EPOCH FROM pg_postmaster_start_time) AS start_time\n    FROM pg_catalog.pg_postmaster_start_time()\n  metrics:\n    - start_time:\n        usage: \"GAUGE\"\n        description: \"Time at which postgres started (based on epoch)\"\n\npg_replication:\n  query: \"SELECT CASE WHEN (\n            NOT pg_catalog.pg_is_in_recovery()\n            OR pg_catalog.pg_last_wal_receive_lsn() = pg_catalog.pg_last_wal_replay_lsn())\n          THEN 0\n          ELSE GREATEST (0,\n            EXTRACT(EPOCH FROM (now() - pg_catalog.pg_last_xact_replay_timestamp())))\n          END AS lag,\n          pg_catalog.pg_is_in_recovery() AS in_recovery,\n          EXISTS (TABLE pg_stat_wal_receiver) AS is_wal_receiver_up,\n          (SELECT count(*) FROM pg_catalog.pg_stat_replication) AS streaming_replicas\"\n  metrics:\n    - lag:\n        usage: \"GAUGE\"\n        description: \"Replication lag behind primary in seconds\"\n    - in_recovery:\n        usage: \"GAUGE\"\n        description: \"Whether the instance is in recovery\"\n    - is_wal_receiver_up:\n        usage: \"GAUGE\"\n        description: \"Whether the instance wal_receiver is up\"\n    - streaming_replicas:\n        usage: \"GAUGE\"\n        description: \"Number of streaming replicas connected to the instance\"\n\npg_replication_slots:\n  query: |\n    SELECT slot_name,\n      slot_type,\n      database,\n      active,\n      (CASE pg_catalog.pg_is_in_recovery()\n        WHEN TRUE THEN pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_last_wal_receive_lsn(), restart_lsn)\n        ELSE pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), restart_lsn)\n      END) as pg_wal_lsn_diff\n    FROM pg_catalog.pg_replication_slots\n    WHERE NOT temporary\n  metrics:\n    - slot_name:\n        usage: \"LABEL\"\n        description: \"Name of the replication slot\"\n    - slot_type:\n        usage: \"LABEL\"\n        description: \"Type of the replication slot\"\n    - database:\n        usage: \"LABEL\"\n        description: \"Name of the database\"\n    - active:\n        usage: \"GAUGE\"\n        description: \"Flag indicating whether the slot is active\"\n    - pg_wal_lsn_diff:\n        usage: \"GAUGE\"\n        description: \"Replication lag in bytes\"\n\npg_stat_archiver:\n  query: |\n    SELECT archived_count\n      , failed_count\n      , COALESCE(EXTRACT(EPOCH FROM (now() - last_archived_time)), -1) AS seconds_since_last_archival\n      , COALESCE(EXTRACT(EPOCH FROM (now() - last_failed_time)), -1) AS seconds_since_last_failure\n      , COALESCE(EXTRACT(EPOCH FROM last_archived_time), -1) AS last_archived_time\n      , COALESCE(EXTRACT(EPOCH FROM last_failed_time), -1) AS last_failed_time\n      , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_archived_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_archived_wal_start_lsn\n      , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_failed_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_failed_wal_start_lsn\n      , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n    FROM pg_catalog.pg_stat_archiver\n  metrics:\n    - archived_count:\n        usage: \"COUNTER\"\n        description: \"Number of WAL files that have been successfully archived\"\n    - failed_count:\n        usage: \"COUNTER\"\n        description: \"Number of failed attempts for archiving WAL files\"\n    - seconds_since_last_archival:\n        usage: \"GAUGE\"\n        description: \"Seconds since the last successful archival operation\"\n    - seconds_since_last_failure:\n        usage: \"GAUGE\"\n        description: \"Seconds since the last failed archival operation\"\n    - last_archived_time:\n        usage: \"GAUGE\"\n        description: \"Epoch of the last time WAL archiving succeeded\"\n    - last_failed_time:\n        usage: \"GAUGE\"\n        description: \"Epoch of the last time WAL archiving failed\"\n    - last_archived_wal_start_lsn:\n        usage: \"GAUGE\"\n        description: \"Archived WAL start LSN\"\n    - last_failed_wal_start_lsn:\n        usage: \"GAUGE\"\n        description: \"Last failed WAL LSN\"\n    - stats_reset_time:\n        usage: \"GAUGE\"\n        description: \"Time at which these statistics were last reset\"\n\npg_stat_bgwriter:\n  runonserver: \"<17.0.0\"\n  query: |\n    SELECT checkpoints_timed\n      , checkpoints_req\n      , checkpoint_write_time\n      , checkpoint_sync_time\n      , buffers_checkpoint\n      , buffers_clean\n      , maxwritten_clean\n      , buffers_backend\n      , buffers_backend_fsync\n      , buffers_alloc\n    FROM pg_catalog.pg_stat_bgwriter\n  metrics:\n    - checkpoints_timed:\n        usage: \"COUNTER\"\n        description: \"Number of scheduled checkpoints that have been performed\"\n    - checkpoints_req:\n        usage: \"COUNTER\"\n        description: \"Number of requested checkpoints that have been performed\"\n    - checkpoint_write_time:\n        usage: \"COUNTER\"\n        description: \"Total amount of time that has been spent in the portion of checkpoint processing where files are written to disk, in milliseconds\"\n    - checkpoint_sync_time:\n        usage: \"COUNTER\"\n        description: \"Total amount of time that has been spent in the portion of checkpoint processing where files are synchronized to disk, in milliseconds\"\n    - buffers_checkpoint:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written during checkpoints\"\n    - buffers_clean:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written by the background writer\"\n    - maxwritten_clean:\n        usage: \"COUNTER\"\n        description: \"Number of times the background writer stopped a cleaning scan because it had written too many buffers\"\n    - buffers_backend:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written directly by a backend\"\n    - buffers_backend_fsync:\n        usage: \"COUNTER\"\n        description: \"Number of times a backend had to execute its own fsync call (normally the background writer handles those even when the backend does its own write)\"\n    - buffers_alloc:\n        usage: \"COUNTER\"\n        description: \"Number of buffers allocated\"\n\npg_stat_bgwriter_17:\n  runonserver: \">=17.0.0\"\n  name: pg_stat_bgwriter\n  query: |\n    SELECT buffers_clean\n      , maxwritten_clean\n      , buffers_alloc\n      , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n    FROM pg_catalog.pg_stat_bgwriter\n  metrics:\n    - buffers_clean:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written by the background writer\"\n    - maxwritten_clean:\n        usage: \"COUNTER\"\n        description: \"Number of times the background writer stopped a cleaning scan because it had written too many buffers\"\n    - buffers_alloc:\n        usage: \"COUNTER\"\n        description: \"Number of buffers allocated\"\n    - stats_reset_time:\n        usage: \"GAUGE\"\n        description: \"Time at which these statistics were last reset\"\n\npg_stat_checkpointer:\n  runonserver: \">=17.0.0\"\n  query: |\n    SELECT num_timed AS checkpoints_timed\n      , num_requested AS checkpoints_req\n      , restartpoints_timed\n      , restartpoints_req\n      , restartpoints_done\n      , write_time\n      , sync_time\n      , buffers_written\n      , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n    FROM pg_catalog.pg_stat_checkpointer\n  metrics:\n    - checkpoints_timed:\n        usage: \"COUNTER\"\n        description: \"Number of scheduled checkpoints that have been performed\"\n    - checkpoints_req:\n        usage: \"COUNTER\"\n        description: \"Number of requested checkpoints that have been performed\"\n    - restartpoints_timed:\n        usage: \"COUNTER\"\n        description: \"Number of scheduled restartpoints due to timeout or after a failed attempt to perform it\"\n    - restartpoints_req:\n        usage: \"COUNTER\"\n        description: \"Number of requested restartpoints that have been performed\"\n    - restartpoints_done:\n        usage: \"COUNTER\"\n        description: \"Number of restartpoints that have been performed\"\n    - write_time:\n        usage: \"COUNTER\"\n        description: \"Total amount of time that has been spent in the portion of processing checkpoints and restartpoints where files are written to disk, in milliseconds\"\n    - sync_time:\n        usage: \"COUNTER\"\n        description: \"Total amount of time that has been spent in the portion of processing checkpoints and restartpoints where files are synchronized to disk, in milliseconds\"\n    - buffers_written:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written during checkpoints and restartpoints\"\n    - stats_reset_time:\n        usage: \"GAUGE\"\n        description: \"Time at which these statistics were last reset\"\n\npg_stat_database:\n  query: |\n    SELECT datname\n      , xact_commit\n      , xact_rollback\n      , blks_read\n      , blks_hit\n      , tup_returned\n      , tup_fetched\n      , tup_inserted\n      , tup_updated\n      , tup_deleted\n      , conflicts\n      , temp_files\n      , temp_bytes\n      , deadlocks\n      , blk_read_time\n      , blk_write_time\n    FROM pg_catalog.pg_stat_database\n  metrics:\n    - datname:\n        usage: \"LABEL\"\n        description: \"Name of this database\"\n    - xact_commit:\n        usage: \"COUNTER\"\n        description: \"Number of transactions in this database that have been committed\"\n    - xact_rollback:\n        usage: \"COUNTER\"\n        description: \"Number of transactions in this database that have been rolled back\"\n    - blks_read:\n        usage: \"COUNTER\"\n        description: \"Number of disk blocks read in this database\"\n    - blks_hit:\n        usage: \"COUNTER\"\n        description: \"Number of times disk blocks were found already in the buffer cache, so that a read was not necessary (this only includes hits in the PostgreSQL buffer cache, not the operating system's file system cache)\"\n    - tup_returned:\n        usage: \"COUNTER\"\n        description: \"Number of rows returned by queries in this database\"\n    - tup_fetched:\n        usage: \"COUNTER\"\n        description: \"Number of rows fetched by queries in this database\"\n    - tup_inserted:\n        usage: \"COUNTER\"\n        description: \"Number of rows inserted by queries in this database\"\n    - tup_updated:\n        usage: \"COUNTER\"\n        description: \"Number of rows updated by queries in this database\"\n    - tup_deleted:\n        usage: \"COUNTER\"\n        description: \"Number of rows deleted by queries in this database\"\n    - conflicts:\n        usage: \"COUNTER\"\n        description: \"Number of queries canceled due to conflicts with recovery in this database\"\n    - temp_files:\n        usage: \"COUNTER\"\n        description: \"Number of temporary files created by queries in this database\"\n    - temp_bytes:\n        usage: \"COUNTER\"\n        description: \"Total amount of data written to temporary files by queries in this database\"\n    - deadlocks:\n        usage: \"COUNTER\"\n        description: \"Number of deadlocks detected in this database\"\n    - blk_read_time:\n        usage: \"COUNTER\"\n        description: \"Time spent reading data file blocks by backends in this database, in milliseconds\"\n    - blk_write_time:\n        usage: \"COUNTER\"\n        description: \"Time spent writing data file blocks by backends in this database, in milliseconds\"\n\npg_stat_replication:\n  primary: true\n  query: |\n   SELECT usename\n     , COALESCE(application_name, '') AS application_name\n     , COALESCE(client_addr::text, '') AS client_addr\n     , COALESCE(client_port::text, '') AS client_port\n     , EXTRACT(EPOCH FROM backend_start) AS backend_start\n     , COALESCE(pg_catalog.age(backend_xmin), 0) AS backend_xmin_age\n     , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), sent_lsn) AS sent_diff_bytes\n     , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), write_lsn) AS write_diff_bytes\n     , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), flush_lsn) AS flush_diff_bytes\n     , COALESCE(pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), replay_lsn),0) AS replay_diff_bytes\n     , COALESCE((EXTRACT(EPOCH FROM write_lag)),0)::float AS write_lag_seconds\n     , COALESCE((EXTRACT(EPOCH FROM flush_lag)),0)::float AS flush_lag_seconds\n     , COALESCE((EXTRACT(EPOCH FROM replay_lag)),0)::float AS replay_lag_seconds\n   FROM pg_catalog.pg_stat_replication\n  metrics:\n    - usename:\n        usage: \"LABEL\"\n        description: \"Name of the replication user\"\n    - application_name:\n        usage: \"LABEL\"\n        description: \"Name of the application\"\n    - client_addr:\n        usage: \"LABEL\"\n        description: \"Client IP address\"\n    - client_port:\n        usage: \"LABEL\"\n        description: \"Client TCP port\"\n    - backend_start:\n        usage: \"COUNTER\"\n        description: \"Time when this process was started\"\n    - backend_xmin_age:\n        usage: \"COUNTER\"\n        description: \"The age of this standby's xmin horizon\"\n    - sent_diff_bytes:\n        usage: \"GAUGE\"\n        description: \"Difference in bytes from the last write-ahead log location sent on this connection\"\n    - write_diff_bytes:\n        usage: \"GAUGE\"\n        description: \"Difference in bytes from the last write-ahead log location written to disk by this standby server\"\n    - flush_diff_bytes:\n        usage: \"GAUGE\"\n        description: \"Difference in bytes from the last write-ahead log location flushed to disk by this standby server\"\n    - replay_diff_bytes:\n        usage: \"GAUGE\"\n        description: \"Difference in bytes from the last write-ahead log location replayed into the database on this standby server\"\n    - write_lag_seconds:\n        usage: \"GAUGE\"\n        description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written it\"\n    - flush_lag_seconds:\n        usage: \"GAUGE\"\n        description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written and flushed it\"\n    - replay_lag_seconds:\n        usage: \"GAUGE\"\n        description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written, flushed and applied it\"\n\npg_settings:\n  query: |\n    SELECT name,\n    CASE setting WHEN 'on' THEN '1' WHEN 'off' THEN '0' ELSE setting END AS setting\n    FROM pg_catalog.pg_settings\n    WHERE vartype IN ('integer', 'real', 'bool')\n    ORDER BY 1\n  metrics:\n    - name:\n        usage: \"LABEL\"\n        description: \"Name of the setting\"\n    - setting:\n        usage: \"GAUGE\"\n        description: \"Setting value\"\n"` | A string representation of a YAML defining monitoring queries. |
+| monitoringQueriesConfigMap.queries | string | `"backends:\n  query: |\n    SELECT sa.datname\n      , sa.usename\n      , sa.application_name\n      , states.state\n      , COALESCE(sa.count, 0) AS total\n      , COALESCE(sa.max_tx_secs, 0) AS max_tx_duration_seconds\n    FROM ( VALUES ('active')\n      , ('idle')\n      , ('idle in transaction')\n      , ('idle in transaction (aborted)')\n      , ('fastpath function call')\n      , ('disabled')\n      ) AS states(state)\n    LEFT JOIN (\n      SELECT datname\n        , state\n        , usename\n        , COALESCE(application_name, '') AS application_name\n        , COUNT(*)\n        , COALESCE(EXTRACT (EPOCH FROM (max(now() - xact_start))), 0) AS max_tx_secs\n      FROM pg_catalog.pg_stat_activity\n      GROUP BY datname, state, usename, application_name\n    ) sa ON states.state = sa.state\n    WHERE sa.usename IS NOT NULL\n  metrics:\n    - datname:\n        usage: \"LABEL\"\n        description: \"Name of the database\"\n    - usename:\n        usage: \"LABEL\"\n        description: \"Name of the user\"\n    - application_name:\n        usage: \"LABEL\"\n        description: \"Name of the application\"\n    - state:\n        usage: \"LABEL\"\n        description: \"State of the backend\"\n    - total:\n        usage: \"GAUGE\"\n        description: \"Number of backends\"\n    - max_tx_duration_seconds:\n        usage: \"GAUGE\"\n        description: \"Maximum duration of a transaction in seconds\"\n\nbackends_waiting:\n  query: |\n    SELECT count(*) AS total\n    FROM pg_catalog.pg_locks blocked_locks\n    JOIN pg_catalog.pg_locks blocking_locks\n      ON blocking_locks.locktype = blocked_locks.locktype\n      AND blocking_locks.database IS NOT DISTINCT FROM blocked_locks.database\n      AND blocking_locks.relation IS NOT DISTINCT FROM blocked_locks.relation\n      AND blocking_locks.page IS NOT DISTINCT FROM blocked_locks.page\n      AND blocking_locks.tuple IS NOT DISTINCT FROM blocked_locks.tuple\n      AND blocking_locks.virtualxid IS NOT DISTINCT FROM blocked_locks.virtualxid\n      AND blocking_locks.transactionid IS NOT DISTINCT FROM blocked_locks.transactionid\n      AND blocking_locks.classid IS NOT DISTINCT FROM blocked_locks.classid\n      AND blocking_locks.objid IS NOT DISTINCT FROM blocked_locks.objid\n      AND blocking_locks.objsubid IS NOT DISTINCT FROM blocked_locks.objsubid\n      AND blocking_locks.pid != blocked_locks.pid\n    JOIN pg_catalog.pg_stat_activity blocking_activity ON blocking_activity.pid = blocking_locks.pid\n    WHERE NOT blocked_locks.granted\n  metrics:\n    - total:\n        usage: \"GAUGE\"\n        description: \"Total number of backends that are currently waiting on other queries\"\n\npg_database:\n  query: |\n    SELECT datname\n      , pg_catalog.pg_database_size(datname) AS size_bytes\n      , pg_catalog.age(datfrozenxid) AS xid_age\n      , pg_catalog.mxid_age(datminmxid) AS mxid_age\n    FROM pg_catalog.pg_database\n    WHERE datallowconn\n  metrics:\n    - datname:\n        usage: \"LABEL\"\n        description: \"Name of the database\"\n    - size_bytes:\n        usage: \"GAUGE\"\n        description: \"Disk space used by the database\"\n    - xid_age:\n        usage: \"GAUGE\"\n        description: \"Number of transactions from the frozen XID to the current one\"\n    - mxid_age:\n        usage: \"GAUGE\"\n        description: \"Number of multiple transactions (Multixact) from the frozen XID to the current one\"\n\npg_postmaster:\n  query: |\n    SELECT EXTRACT(EPOCH FROM pg_postmaster_start_time) AS start_time\n    FROM pg_catalog.pg_postmaster_start_time()\n  metrics:\n    - start_time:\n        usage: \"GAUGE\"\n        description: \"Time at which postgres started (based on epoch)\"\n\npg_replication:\n  query: |\n    SELECT CASE WHEN (\n        NOT pg_catalog.pg_is_in_recovery()\n        OR pg_catalog.pg_last_wal_receive_lsn() = pg_catalog.pg_last_wal_replay_lsn())\n      THEN 0\n      ELSE GREATEST (0,\n        EXTRACT(EPOCH FROM (now() - pg_catalog.pg_last_xact_replay_timestamp())))\n      END AS lag,\n      pg_catalog.pg_is_in_recovery() AS in_recovery,\n      EXISTS (TABLE pg_stat_wal_receiver) AS is_wal_receiver_up,\n      (SELECT count(*) FROM pg_catalog.pg_stat_replication) AS streaming_replicas\n  metrics:\n    - lag:\n        usage: \"GAUGE\"\n        description: \"Replication lag behind primary in seconds\"\n    - in_recovery:\n        usage: \"GAUGE\"\n        description: \"Whether the instance is in recovery\"\n    - is_wal_receiver_up:\n        usage: \"GAUGE\"\n        description: \"Whether the instance wal_receiver is up\"\n    - streaming_replicas:\n        usage: \"GAUGE\"\n        description: \"Number of streaming replicas connected to the instance\"\n\npg_replication_slots:\n  query: |\n    SELECT slot_name,\n      slot_type,\n      database,\n      active,\n      (CASE pg_catalog.pg_is_in_recovery()\n        WHEN TRUE THEN pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_last_wal_receive_lsn(), restart_lsn)\n        ELSE pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), restart_lsn)\n      END) as pg_wal_lsn_diff\n    FROM pg_catalog.pg_replication_slots\n    WHERE NOT temporary\n  metrics:\n    - slot_name:\n        usage: \"LABEL\"\n        description: \"Name of the replication slot\"\n    - slot_type:\n        usage: \"LABEL\"\n        description: \"Type of the replication slot\"\n    - database:\n        usage: \"LABEL\"\n        description: \"Name of the database\"\n    - active:\n        usage: \"GAUGE\"\n        description: \"Flag indicating whether the slot is active\"\n    - pg_wal_lsn_diff:\n        usage: \"GAUGE\"\n        description: \"Replication lag in bytes\"\n\npg_stat_archiver:\n  query: |\n    SELECT archived_count\n      , failed_count\n      , COALESCE(EXTRACT(EPOCH FROM (now() - last_archived_time)), -1) AS seconds_since_last_archival\n      , COALESCE(EXTRACT(EPOCH FROM (now() - last_failed_time)), -1) AS seconds_since_last_failure\n      , COALESCE(EXTRACT(EPOCH FROM last_archived_time), -1) AS last_archived_time\n      , COALESCE(EXTRACT(EPOCH FROM last_failed_time), -1) AS last_failed_time\n      , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_archived_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_archived_wal_start_lsn\n      , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_failed_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_failed_wal_start_lsn\n      , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n    FROM pg_catalog.pg_stat_archiver\n  predicate_query: |\n    SELECT NOT pg_catalog.pg_is_in_recovery()\n      OR pg_catalog.current_setting('archive_mode') = 'always'\n  metrics:\n    - archived_count:\n        usage: \"COUNTER\"\n        description: \"Number of WAL files that have been successfully archived\"\n    - failed_count:\n        usage: \"COUNTER\"\n        description: \"Number of failed attempts for archiving WAL files\"\n    - seconds_since_last_archival:\n        usage: \"GAUGE\"\n        description: \"Seconds since the last successful archival operation\"\n    - seconds_since_last_failure:\n        usage: \"GAUGE\"\n        description: \"Seconds since the last failed archival operation\"\n    - last_archived_time:\n        usage: \"GAUGE\"\n        description: \"Epoch of the last time WAL archiving succeeded\"\n    - last_failed_time:\n        usage: \"GAUGE\"\n        description: \"Epoch of the last time WAL archiving failed\"\n    - last_archived_wal_start_lsn:\n        usage: \"GAUGE\"\n        description: \"Archived WAL start LSN\"\n    - last_failed_wal_start_lsn:\n        usage: \"GAUGE\"\n        description: \"Last failed WAL LSN\"\n    - stats_reset_time:\n        usage: \"GAUGE\"\n        description: \"Time at which these statistics were last reset\"\n\npg_stat_bgwriter:\n  runonserver: \"<17.0.0\"\n  query: |\n    SELECT checkpoints_timed\n      , checkpoints_req\n      , checkpoint_write_time\n      , checkpoint_sync_time\n      , buffers_checkpoint\n      , buffers_clean\n      , maxwritten_clean\n      , buffers_backend\n      , buffers_backend_fsync\n      , buffers_alloc\n    FROM pg_catalog.pg_stat_bgwriter\n  metrics:\n    - checkpoints_timed:\n        usage: \"COUNTER\"\n        description: \"Number of scheduled checkpoints that have been performed\"\n    - checkpoints_req:\n        usage: \"COUNTER\"\n        description: \"Number of requested checkpoints that have been performed\"\n    - checkpoint_write_time:\n        usage: \"COUNTER\"\n        description: \"Total amount of time that has been spent in the portion of checkpoint processing where files are written to disk, in milliseconds\"\n    - checkpoint_sync_time:\n        usage: \"COUNTER\"\n        description: \"Total amount of time that has been spent in the portion of checkpoint processing where files are synchronized to disk, in milliseconds\"\n    - buffers_checkpoint:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written during checkpoints\"\n    - buffers_clean:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written by the background writer\"\n    - maxwritten_clean:\n        usage: \"COUNTER\"\n        description: \"Number of times the background writer stopped a cleaning scan because it had written too many buffers\"\n    - buffers_backend:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written directly by a backend\"\n    - buffers_backend_fsync:\n        usage: \"COUNTER\"\n        description: \"Number of times a backend had to execute its own fsync call (normally the background writer handles those even when the backend does its own write)\"\n    - buffers_alloc:\n        usage: \"COUNTER\"\n        description: \"Number of buffers allocated\"\n\npg_stat_bgwriter_17:\n  runonserver: \">=17.0.0\"\n  name: pg_stat_bgwriter\n  query: |\n    SELECT buffers_clean\n      , maxwritten_clean\n      , buffers_alloc\n      , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n    FROM pg_catalog.pg_stat_bgwriter\n  metrics:\n    - buffers_clean:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written by the background writer\"\n    - maxwritten_clean:\n        usage: \"COUNTER\"\n        description: \"Number of times the background writer stopped a cleaning scan because it had written too many buffers\"\n    - buffers_alloc:\n        usage: \"COUNTER\"\n        description: \"Number of buffers allocated\"\n    - stats_reset_time:\n        usage: \"GAUGE\"\n        description: \"Time at which these statistics were last reset\"\n\npg_stat_checkpointer:\n  runonserver: \">=17.0.0\"\n  query: |\n    SELECT num_timed AS checkpoints_timed\n      , num_requested AS checkpoints_req\n      , restartpoints_timed\n      , restartpoints_req\n      , restartpoints_done\n      , write_time\n      , sync_time\n      , buffers_written\n      , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n    FROM pg_catalog.pg_stat_checkpointer\n  metrics:\n    - checkpoints_timed:\n        usage: \"COUNTER\"\n        description: \"Number of scheduled checkpoints that have been performed\"\n    - checkpoints_req:\n        usage: \"COUNTER\"\n        description: \"Number of requested checkpoints that have been performed\"\n    - restartpoints_timed:\n        usage: \"COUNTER\"\n        description: \"Number of scheduled restartpoints due to timeout or after a failed attempt to perform it\"\n    - restartpoints_req:\n        usage: \"COUNTER\"\n        description: \"Number of requested restartpoints that have been performed\"\n    - restartpoints_done:\n        usage: \"COUNTER\"\n        description: \"Number of restartpoints that have been performed\"\n    - write_time:\n        usage: \"COUNTER\"\n        description: \"Total amount of time that has been spent in the portion of processing checkpoints and restartpoints where files are written to disk, in milliseconds\"\n    - sync_time:\n        usage: \"COUNTER\"\n        description: \"Total amount of time that has been spent in the portion of processing checkpoints and restartpoints where files are synchronized to disk, in milliseconds\"\n    - buffers_written:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written during checkpoints and restartpoints\"\n    - stats_reset_time:\n        usage: \"GAUGE\"\n        description: \"Time at which these statistics were last reset\"\n\npg_stat_database:\n  query: |\n    SELECT datname\n      , xact_commit\n      , xact_rollback\n      , blks_read\n      , blks_hit\n      , tup_returned\n      , tup_fetched\n      , tup_inserted\n      , tup_updated\n      , tup_deleted\n      , conflicts\n      , temp_files\n      , temp_bytes\n      , deadlocks\n      , blk_read_time\n      , blk_write_time\n    FROM pg_catalog.pg_stat_database\n  metrics:\n    - datname:\n        usage: \"LABEL\"\n        description: \"Name of this database\"\n    - xact_commit:\n        usage: \"COUNTER\"\n        description: \"Number of transactions in this database that have been committed\"\n    - xact_rollback:\n        usage: \"COUNTER\"\n        description: \"Number of transactions in this database that have been rolled back\"\n    - blks_read:\n        usage: \"COUNTER\"\n        description: \"Number of disk blocks read in this database\"\n    - blks_hit:\n        usage: \"COUNTER\"\n        description: \"Number of times disk blocks were found already in the buffer cache, so that a read was not necessary (this only includes hits in the PostgreSQL buffer cache, not the operating system's file system cache)\"\n    - tup_returned:\n        usage: \"COUNTER\"\n        description: \"Number of rows returned by queries in this database\"\n    - tup_fetched:\n        usage: \"COUNTER\"\n        description: \"Number of rows fetched by queries in this database\"\n    - tup_inserted:\n        usage: \"COUNTER\"\n        description: \"Number of rows inserted by queries in this database\"\n    - tup_updated:\n        usage: \"COUNTER\"\n        description: \"Number of rows updated by queries in this database\"\n    - tup_deleted:\n        usage: \"COUNTER\"\n        description: \"Number of rows deleted by queries in this database\"\n    - conflicts:\n        usage: \"COUNTER\"\n        description: \"Number of queries canceled due to conflicts with recovery in this database\"\n    - temp_files:\n        usage: \"COUNTER\"\n        description: \"Number of temporary files created by queries in this database\"\n    - temp_bytes:\n        usage: \"COUNTER\"\n        description: \"Total amount of data written to temporary files by queries in this database\"\n    - deadlocks:\n        usage: \"COUNTER\"\n        description: \"Number of deadlocks detected in this database\"\n    - blk_read_time:\n        usage: \"COUNTER\"\n        description: \"Time spent reading data file blocks by backends in this database, in milliseconds\"\n    - blk_write_time:\n        usage: \"COUNTER\"\n        description: \"Time spent writing data file blocks by backends in this database, in milliseconds\"\n\npg_stat_replication:\n  primary: true\n  query: |\n    SELECT usename\n      , COALESCE(application_name, '') AS application_name\n      , COALESCE(client_addr::text, '') AS client_addr\n      , COALESCE(client_port::text, '') AS client_port\n      , EXTRACT(EPOCH FROM backend_start) AS backend_start\n      , COALESCE(pg_catalog.age(backend_xmin), 0) AS backend_xmin_age\n      , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), sent_lsn) AS sent_diff_bytes\n      , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), write_lsn) AS write_diff_bytes\n      , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), flush_lsn) AS flush_diff_bytes\n      , COALESCE(pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), replay_lsn),0) AS replay_diff_bytes\n      , COALESCE((EXTRACT(EPOCH FROM write_lag)),0)::float AS write_lag_seconds\n      , COALESCE((EXTRACT(EPOCH FROM flush_lag)),0)::float AS flush_lag_seconds\n      , COALESCE((EXTRACT(EPOCH FROM replay_lag)),0)::float AS replay_lag_seconds\n    FROM pg_catalog.pg_stat_replication\n  metrics:\n    - usename:\n        usage: \"LABEL\"\n        description: \"Name of the replication user\"\n    - application_name:\n        usage: \"LABEL\"\n        description: \"Name of the application\"\n    - client_addr:\n        usage: \"LABEL\"\n        description: \"Client IP address\"\n    - client_port:\n        usage: \"LABEL\"\n        description: \"Client TCP port\"\n    - backend_start:\n        usage: \"COUNTER\"\n        description: \"Time when this process was started\"\n    - backend_xmin_age:\n        usage: \"COUNTER\"\n        description: \"The age of this standby's xmin horizon\"\n    - sent_diff_bytes:\n        usage: \"GAUGE\"\n        description: \"Difference in bytes from the last write-ahead log location sent on this connection\"\n    - write_diff_bytes:\n        usage: \"GAUGE\"\n        description: \"Difference in bytes from the last write-ahead log location written to disk by this standby server\"\n    - flush_diff_bytes:\n        usage: \"GAUGE\"\n        description: \"Difference in bytes from the last write-ahead log location flushed to disk by this standby server\"\n    - replay_diff_bytes:\n        usage: \"GAUGE\"\n        description: \"Difference in bytes from the last write-ahead log location replayed into the database on this standby server\"\n    - write_lag_seconds:\n        usage: \"GAUGE\"\n        description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written it\"\n    - flush_lag_seconds:\n        usage: \"GAUGE\"\n        description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written and flushed it\"\n    - replay_lag_seconds:\n        usage: \"GAUGE\"\n        description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written, flushed and applied it\"\n\npg_settings:\n  query: |\n    SELECT name,\n    CASE setting WHEN 'on' THEN '1' WHEN 'off' THEN '0' ELSE setting END AS setting\n    FROM pg_catalog.pg_settings\n    WHERE vartype IN ('integer', 'real', 'bool')\n    ORDER BY 1\n  metrics:\n    - name:\n        usage: \"LABEL\"\n        description: \"Name of the setting\"\n    - setting:\n        usage: \"GAUGE\"\n        description: \"Setting value\"\n\npg_extensions:\n  query: |\n    SELECT\n      current_database() as datname,\n      name as extname,\n      default_version,\n      installed_version,\n      CASE\n        WHEN default_version = installed_version THEN 0\n        ELSE 1\n    END AS update_available\n    FROM pg_catalog.pg_available_extensions\n    WHERE installed_version IS NOT NULL\n  metrics:\n    - datname:\n        usage: \"LABEL\"\n        description: \"Name of the database\"\n    - extname:\n        usage: \"LABEL\"\n        description: \"Extension name\"\n    - default_version:\n        usage: \"LABEL\"\n        description: \"Default version\"\n    - installed_version:\n        usage: \"LABEL\"\n        description: \"Installed version\"\n    - update_available:\n        usage: \"GAUGE\"\n        description: \"An update is available\"\n  target_databases:\n    - '*'\n"` | A string representation of a YAML defining monitoring queries. |
 | nameOverride | string | `""` |  |
 | namespaceOverride | string | `""` |  |
 | nodeSelector | object | `{}` | Nodeselector for the operator to be installed. |
@@ -77,5 +77,6 @@ CloudNativePG Operator Helm Chart
 | serviceAccount.create | bool | `true` | Specifies whether the service account should be created. |
 | serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template. |
 | tolerations | list | `[]` | Tolerations for the operator to be installed. |
-| webhook | object | `{"livenessProbe":{"initialDelaySeconds":3},"mutating":{"create":true,"failurePolicy":"Fail"},"port":9443,"readinessProbe":{"initialDelaySeconds":3},"validating":{"create":true,"failurePolicy":"Fail"}}` | The webhook configuration. |
-
+| topologySpreadConstraints | list | `[]` | Topology Spread Constraints for the operator to be installed. |
+| updateStrategy | object | `{}` | Update strategy for the operator. ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy For example:  type: RollingUpdate  rollingUpdate:    maxSurge: 25%    maxUnavailable: 25% |
+| webhook | object | `{"livenessProbe":{"initialDelaySeconds":3},"mutating":{"create":true,"failurePolicy":"Fail"},"port":9443,"readinessProbe":{"initialDelaySeconds":3},"startupProbe":{"failureThreshold":6,"periodSeconds":5},"validating":{"create":true,"failurePolicy":"Fail"}}` | The webhook configuration. |
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/NOTES.txt b/packages/system/postgres-operator/charts/cloudnative-pg/templates/NOTES.txt
index d0b65b9b..4c8ef66d 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/NOTES.txt
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/NOTES.txt
@@ -1,5 +1,5 @@
 
-CloudNativePG operator should be installed in namespace "{{ .Release.Namespace }}".
+CloudNativePG operator should be installed in namespace "{{ include "cloudnative-pg.namespace" . }}".
 You can now create a PostgreSQL cluster with 3 nodes as follows:
 
 cat <<EOF | kubectl apply -f -
@@ -9,7 +9,7 @@ kind: Cluster
 metadata:
   name: cluster-example
   {{if not .Values.config.clusterWide  -}}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "cloudnative-pg.namespace" . }}
   {{- end }}
 spec:
   instances: 3
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/_helpers.tpl b/packages/system/postgres-operator/charts/cloudnative-pg/templates/_helpers.tpl
index 191e745f..045b06d9 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/_helpers.tpl
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/_helpers.tpl
@@ -209,6 +209,16 @@ namespace scope or clusterwide
   - patch
   - update
   - watch
+- apiGroups:
+  - postgresql.cnpg.io
+  resources:
+  - failoverquorums
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
 - apiGroups:
   - postgresql.cnpg.io
   resources:
@@ -241,6 +251,7 @@ namespace scope or clusterwide
   resources:
   - clusters/status
   - poolers/status
+  - failoverquorums/status
   verbs:
   - get
   - patch
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/config.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/templates/config.yaml
index 89fcb418..a06cfa81 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/config.yaml
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/config.yaml
@@ -1,5 +1,6 @@
 #
-# Copyright The CloudNativePG Contributors
+# Copyright © contributors to CloudNativePG, established as
+# CloudNativePG a Series of LF Projects, LLC.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,6 +14,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+# SPDX-License-Identifier: Apache-2.0
+#
 {{- if .Values.config.create }}
 {{- if not .Values.config.secret }}
 apiVersion: v1
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/crds/crds.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/templates/crds/crds.yaml
index 595faa32..7982b5e1 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/crds/crds.yaml
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/crds/crds.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.20.0
     helm.sh/resource-policy: keep
   name: backups.postgresql.cnpg.io
 spec:
@@ -34,7 +34,8 @@ spec:
     name: v1
     schema:
       openAPIV3Schema:
-        description: Backup is the Schema for the backups API
+        description: A Backup resource is a request for a PostgreSQL backup by the
+          user.
         properties:
           apiVersion:
             description: |-
@@ -142,6 +143,9 @@ spec:
             required:
             - cluster
             type: object
+            x-kubernetes-validations:
+            - message: BackupSpec is immutable once set
+              rule: oldSelf == self
           status:
             description: |-
               Most recently observed status of the backup. This data may not be up to
@@ -211,6 +215,11 @@ spec:
                     - key
                     - name
                     type: object
+                  useDefaultAzureCredentials:
+                    description: |-
+                      Use the default Azure authentication flow, which includes DefaultAzureCredential.
+                      This allows authentication using environment variables and managed identities.
+                    type: boolean
                 type: object
               backupId:
                 description: The ID of the Barman backup
@@ -308,7 +317,19 @@ spec:
                   podName:
                     description: The pod name
                     type: string
+                  sessionID:
+                    description: |-
+                      The instance manager session ID. This is a unique identifier generated at instance manager
+                      startup and changes on every restart (including container reboots). Used to detect if
+                      the instance manager was restarted during long-running operations like backups, which
+                      would terminate any running backup process.
+                    type: string
                 type: object
+              majorVersion:
+                description: |-
+                  The PostgreSQL major version that was running when the
+                  backup was taken.
+                type: integer
               method:
                 description: The backup method being used
                 type: string
@@ -445,7 +466,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.20.0
     helm.sh/resource-policy: keep
   name: clusterimagecatalogs.postgresql.cnpg.io
 spec:
@@ -527,7 +548,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.20.0
     helm.sh/resource-policy: keep
   name: clusters.postgresql.cnpg.io
 spec:
@@ -562,7 +583,9 @@ spec:
     name: v1
     schema:
       openAPIV3Schema:
-        description: Cluster is the Schema for the PostgreSQL API
+        description: |-
+          Cluster defines the API schema for a highly available PostgreSQL database cluster
+          managed by CloudNativePG.
         properties:
           apiVersion:
             description: |-
@@ -671,7 +694,6 @@ spec:
                                     pod labels will be ignored. The default value is empty.
                                     The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                     Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                   items:
                                     type: string
                                   type: array
@@ -686,7 +708,6 @@ spec:
                                     pod labels will be ignored. The default value is empty.
                                     The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                     Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                   items:
                                     type: string
                                   type: array
@@ -852,7 +873,6 @@ spec:
                                 pod labels will be ignored. The default value is empty.
                                 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                 Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                               items:
                                 type: string
                               type: array
@@ -867,7 +887,6 @@ spec:
                                 pod labels will be ignored. The default value is empty.
                                 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                               items:
                                 type: string
                               type: array
@@ -960,8 +979,8 @@ spec:
                           most preferred is the one with the greatest sum of weights, i.e.
                           for each node that meets all of the scheduling requirements (resource
                           request, requiredDuringScheduling anti-affinity expressions, etc.),
-                          compute a sum by iterating through the elements of this field and adding
-                          "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                          compute a sum by iterating through the elements of this field and subtracting
+                          "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                           node(s) with the highest sum are the most preferred.
                         items:
                           description: The weights of all of the matched WeightedPodAffinityTerm
@@ -1030,7 +1049,6 @@ spec:
                                     pod labels will be ignored. The default value is empty.
                                     The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                     Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                   items:
                                     type: string
                                   type: array
@@ -1045,7 +1063,6 @@ spec:
                                     pod labels will be ignored. The default value is empty.
                                     The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                     Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                   items:
                                     type: string
                                   type: array
@@ -1211,7 +1228,6 @@ spec:
                                 pod labels will be ignored. The default value is empty.
                                 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                 Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                               items:
                                 type: string
                               type: array
@@ -1226,7 +1242,6 @@ spec:
                                 pod labels will be ignored. The default value is empty.
                                 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                               items:
                                 type: string
                               type: array
@@ -1551,9 +1566,10 @@ spec:
                         operator:
                           description: |-
                             Operator represents a key's relationship to the value.
-                            Valid operators are Exists and Equal. Defaults to Equal.
+                            Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
                             Exists is equivalent to wildcard for value, so that a pod can
                             tolerate all taints of a particular category.
+                            Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                           type: string
                         tolerationSeconds:
                           description: |-
@@ -1646,6 +1662,11 @@ spec:
                             - key
                             - name
                             type: object
+                          useDefaultAzureCredentials:
+                            description: |-
+                              Use the default Azure authentication flow, which includes DefaultAzureCredential.
+                              This allows authentication using environment variables and managed identities.
+                            type: boolean
                         type: object
                       data:
                         description: |-
@@ -1677,10 +1698,10 @@ spec:
                             description: |-
                               Compress a backup file (a tar file per tablespace) while streaming it
                               to the object store. Available options are empty string (no
-                              compression, default), `gzip`, `bzip2` or `snappy`.
+                              compression, default), `gzip`, `bzip2`, and `snappy`.
                             enum:
-                            - gzip
                             - bzip2
+                            - gzip
                             - snappy
                             type: string
                           encryption:
@@ -1868,11 +1889,15 @@ spec:
                           compression:
                             description: |-
                               Compress a WAL file before sending it to the object store. Available
-                              options are empty string (no compression, default), `gzip`, `bzip2` or `snappy`.
+                              options are empty string (no compression, default), `gzip`, `bzip2`,
+                              `lz4`, `snappy`, `xz`, and `zstd`.
                             enum:
-                            - gzip
                             - bzip2
+                            - gzip
+                            - lz4
                             - snappy
+                            - xz
+                            - zstd
                             type: string
                           encryption:
                             description: |-
@@ -2063,19 +2088,59 @@ spec:
                             type: array
                           pgDumpExtraOptions:
                             description: |-
-                              List of custom options to pass to the `pg_dump` command. IMPORTANT:
-                              Use these options with caution and at your own risk, as the operator
-                              does not validate their content. Be aware that certain options may
-                              conflict with the operator's intended functionality or design.
+                              List of custom options to pass to the `pg_dump` command.
+
+                              IMPORTANT: Use with caution. The operator does not validate these options,
+                              and certain flags may interfere with its intended functionality or design.
+                              You are responsible for ensuring that the provided options are compatible
+                              with your environment and desired behavior.
+                            items:
+                              type: string
+                            type: array
+                          pgRestoreDataOptions:
+                            description: |-
+                              Custom options to pass to the `pg_restore` command during the `data`
+                              section. This setting overrides the generic `pgRestoreExtraOptions` value.
+
+                              IMPORTANT: Use with caution. The operator does not validate these options,
+                              and certain flags may interfere with its intended functionality or design.
+                              You are responsible for ensuring that the provided options are compatible
+                              with your environment and desired behavior.
                             items:
                               type: string
                             type: array
                           pgRestoreExtraOptions:
                             description: |-
-                              List of custom options to pass to the `pg_restore` command. IMPORTANT:
-                              Use these options with caution and at your own risk, as the operator
-                              does not validate their content. Be aware that certain options may
-                              conflict with the operator's intended functionality or design.
+                              List of custom options to pass to the `pg_restore` command.
+
+                              IMPORTANT: Use with caution. The operator does not validate these options,
+                              and certain flags may interfere with its intended functionality or design.
+                              You are responsible for ensuring that the provided options are compatible
+                              with your environment and desired behavior.
+                            items:
+                              type: string
+                            type: array
+                          pgRestorePostdataOptions:
+                            description: |-
+                              Custom options to pass to the `pg_restore` command during the `post-data`
+                              section. This setting overrides the generic `pgRestoreExtraOptions` value.
+
+                              IMPORTANT: Use with caution. The operator does not validate these options,
+                              and certain flags may interfere with its intended functionality or design.
+                              You are responsible for ensuring that the provided options are compatible
+                              with your environment and desired behavior.
+                            items:
+                              type: string
+                            type: array
+                          pgRestorePredataOptions:
+                            description: |-
+                              Custom options to pass to the `pg_restore` command during the `pre-data`
+                              section. This setting overrides the generic `pgRestoreExtraOptions` value.
+
+                              IMPORTANT: Use with caution. The operator does not validate these options,
+                              and certain flags may interfere with its intended functionality or design.
+                              You are responsible for ensuring that the provided options are compatible
+                              with your environment and desired behavior.
                             items:
                               type: string
                             type: array
@@ -2139,6 +2204,7 @@ spec:
                       options:
                         description: |-
                           The list of options that must be passed to initdb when creating the cluster.
+
                           Deprecated: This could lead to inconsistent configurations,
                           please use the explicit provided parameters instead.
                           If defined, explicit values will be ignored.
@@ -2463,8 +2529,9 @@ spec:
                               integer)
                             type: string
                           targetTime:
-                            description: The target time as a timestamp in the RFC3339
-                              standard
+                            description: |-
+                              The target time as a timestamp in RFC3339 format or PostgreSQL timestamp format.
+                              Timestamps without an explicit timezone are interpreted as UTC.
                             type: string
                           targetXID:
                             description: The target transaction ID
@@ -2656,7 +2723,9 @@ spec:
                     a Container.
                   properties:
                     name:
-                      description: Name of the environment variable. Must be a C_IDENTIFIER.
+                      description: |-
+                        Name of the environment variable.
+                        May consist of any printable ASCII characters except '='.
                       type: string
                     value:
                       description: |-
@@ -2714,6 +2783,43 @@ spec:
                           - fieldPath
                           type: object
                           x-kubernetes-map-type: atomic
+                        fileKeyRef:
+                          description: |-
+                            FileKeyRef selects a key of the env file.
+                            Requires the EnvFiles feature gate to be enabled.
+                          properties:
+                            key:
+                              description: |-
+                                The key within the env file. An invalid key will prevent the pod from starting.
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                              type: string
+                            optional:
+                              default: false
+                              description: |-
+                                Specify whether the file or its key must be defined. If the file or key
+                                does not exist, then the env var is not published.
+                                If optional is set to true and the specified key does not exist,
+                                the environment variable will not be set in the Pod's containers.
+
+                                If optional is set to false and the specified key does not exist,
+                                an error will be returned during Pod creation.
+                              type: boolean
+                            path:
+                              description: |-
+                                The path within the volume from which to select the file.
+                                Must be relative and may not contain the '..' path or start with '..'.
+                              type: string
+                            volumeName:
+                              description: The name of the volume mount containing
+                                the env file.
+                              type: string
+                          required:
+                          - key
+                          - path
+                          - volumeName
+                          type: object
+                          x-kubernetes-map-type: atomic
                         resourceFieldRef:
                           description: |-
                             Selects a resource of the container: only resources limits and requests
@@ -2773,6 +2879,7 @@ spec:
                   sources to the pods to be used by Env
                 items:
                   description: EnvFromSource represents the source of a set of ConfigMaps
+                    or Secrets
                   properties:
                     configMapRef:
                       description: The ConfigMap to select from
@@ -2792,8 +2899,9 @@ spec:
                       type: object
                       x-kubernetes-map-type: atomic
                     prefix:
-                      description: An optional identifier to prepend to each key in
-                        the ConfigMap. Must be a C_IDENTIFIER.
+                      description: |-
+                        Optional text to prepend to the name of each environment variable.
+                        May consist of any printable ASCII characters except '='.
                       type: string
                     secretRef:
                       description: The Secret to select from
@@ -2942,7 +3050,7 @@ spec:
                           resources:
                             description: |-
                               resources represents the minimum resources the volume should have.
-                              If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
+                              Users are allowed to specify resource requirements
                               that are lower than previous value but must still be higher than capacity recorded in the
                               status field of the claim.
                               More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -3029,15 +3137,13 @@ spec:
                               volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                               If specified, the CSI driver will create or update the volume with the attributes defined
                               in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                              it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                              will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                              If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                              will be set by the persistentvolume controller if it exists.
+                              it can be changed after the claim is created. An empty string or nil value indicates that no
+                              VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                              this field can be reset to its previous value (including nil) to cancel the modification.
                               If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                               set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                               exists.
                               More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                              (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                             type: string
                           volumeMode:
                             description: |-
@@ -3148,6 +3254,11 @@ spec:
                               - key
                               - name
                               type: object
+                            useDefaultAzureCredentials:
+                              description: |-
+                                Use the default Azure authentication flow, which includes DefaultAzureCredential.
+                                This allows authentication using environment variables and managed identities.
+                              type: boolean
                           type: object
                         data:
                           description: |-
@@ -3179,10 +3290,10 @@ spec:
                               description: |-
                                 Compress a backup file (a tar file per tablespace) while streaming it
                                 to the object store. Available options are empty string (no
-                                compression, default), `gzip`, `bzip2` or `snappy`.
+                                compression, default), `gzip`, `bzip2`, and `snappy`.
                               enum:
-                              - gzip
                               - bzip2
+                              - gzip
                               - snappy
                               type: string
                             encryption:
@@ -3370,11 +3481,15 @@ spec:
                             compression:
                               description: |-
                                 Compress a WAL file before sending it to the object store. Available
-                                options are empty string (no compression, default), `gzip`, `bzip2` or `snappy`.
+                                options are empty string (no compression, default), `gzip`, `bzip2`,
+                                `lz4`, `snappy`, `xz`, and `zstd`.
                               enum:
-                              - gzip
                               - bzip2
+                              - gzip
+                              - lz4
                               - snappy
+                              - xz
+                              - zstd
                               type: string
                             encryption:
                               description: |-
@@ -3467,6 +3582,13 @@ spec:
                           default: true
                           description: Enabled is true if this plugin will be used
                           type: boolean
+                        isWALArchiver:
+                          default: false
+                          description: |-
+                            Marks the plugin as the WAL archiver. At most one plugin can be
+                            designated as a WAL archiver. This cannot be enabled if the
+                            `.spec.backup.barmanObjectStore` configuration is present.
+                          type: boolean
                         name:
                           description: Name is the plugin name
                           type: string
@@ -3585,9 +3707,6 @@ spec:
                     description: The major version of PostgreSQL we want to use from
                       the ImageCatalog
                     type: integer
-                    x-kubernetes-validations:
-                    - message: Major is immutable
-                      rule: self == oldSelf
                   name:
                     description: Name is the name of resource being referenced
                     type: string
@@ -4152,13 +4271,12 @@ spec:
                                       type: object
                                     trafficDistribution:
                                       description: |-
-                                        TrafficDistribution offers a way to express preferences for how traffic is
-                                        distributed to Service endpoints. Implementations can use this field as a
-                                        hint, but are not required to guarantee strict adherence. If the field is
-                                        not set, the implementation will apply its default routing strategy. If set
-                                        to "PreferClose", implementations should prioritize endpoints that are
-                                        topologically close (e.g., same zone).
-                                        This is a beta field and requires enabling ServiceTrafficDistribution feature.
+                                        TrafficDistribution offers a way to express preferences for how traffic
+                                        is distributed to Service endpoints. Implementations can use this field
+                                        as a hint, but are not required to guarantee strict adherence. If the
+                                        field is not set, the implementation will apply its default routing
+                                        strategy. If set to "PreferClose", implementations should prioritize
+                                        endpoints that are in the same zone.
                                       type: string
                                     type:
                                       description: |-
@@ -4275,11 +4393,26 @@ spec:
                     type: boolean
                   enablePodMonitor:
                     default: false
-                    description: Enable or disable the `PodMonitor`
+                    description: |-
+                      Enable or disable the `PodMonitor`
+
+                      Deprecated: This feature will be removed in an upcoming release. If
+                      you need this functionality, you can create a PodMonitor manually.
                     type: boolean
+                  metricsQueriesTTL:
+                    description: |-
+                      The interval during which metrics computed from queries are considered current.
+                      Once it is exceeded, a new scrape will trigger a rerun
+                      of the queries.
+                      If not set, defaults to 30 seconds, in line with Prometheus scraping defaults.
+                      Setting this to zero disables the caching mechanism and can cause heavy load on the PostgreSQL server.
+                    type: string
                   podMonitorMetricRelabelings:
-                    description: The list of metric relabelings for the `PodMonitor`.
-                      Applied to samples before ingestion.
+                    description: |-
+                      The list of metric relabelings for the `PodMonitor`. Applied to samples before ingestion.
+
+                      Deprecated: This feature will be removed in an upcoming release. If
+                      you need this functionality, you can create a PodMonitor manually.
                     items:
                       description: |-
                         RelabelConfig allows dynamic rewriting of the label set for targets, alerts,
@@ -4290,7 +4423,7 @@ spec:
                         action:
                           default: replace
                           description: |-
-                            Action to perform based on the regex matching.
+                            action to perform based on the regex matching.
 
                             `Uppercase` and `Lowercase` actions require Prometheus >= v2.36.0.
                             `DropEqual` and `KeepEqual` actions require Prometheus >= v2.41.0.
@@ -4322,41 +4455,41 @@ spec:
                           type: string
                         modulus:
                           description: |-
-                            Modulus to take of the hash of the source label values.
+                            modulus to take of the hash of the source label values.
 
                             Only applicable when the action is `HashMod`.
                           format: int64
                           type: integer
                         regex:
-                          description: Regular expression against which the extracted
-                            value is matched.
+                          description: regex defines the regular expression against
+                            which the extracted value is matched.
                           type: string
                         replacement:
                           description: |-
-                            Replacement value against which a Replace action is performed if the
+                            replacement value against which a Replace action is performed if the
                             regular expression matches.
 
                             Regex capture groups are available.
                           type: string
                         separator:
-                          description: Separator is the string between concatenated
+                          description: separator defines the string between concatenated
                             SourceLabels.
                           type: string
                         sourceLabels:
                           description: |-
-                            The source labels select values from existing labels. Their content is
+                            sourceLabels defines the source labels select values from existing labels. Their content is
                             concatenated using the configured Separator and matched against the
                             configured regular expression.
                           items:
                             description: |-
-                              LabelName is a valid Prometheus label name which may only contain ASCII
-                              letters, numbers, as well as underscores.
-                            pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$
+                              LabelName is a valid Prometheus label name.
+                              For Prometheus 3.x, a label name is valid if it contains UTF-8 characters.
+                              For Prometheus 2.x, a label name is only valid if it contains ASCII characters, letters, numbers, as well as underscores.
                             type: string
                           type: array
                         targetLabel:
                           description: |-
-                            Label to which the resulting string is written in a replacement.
+                            targetLabel defines the label to which the resulting string is written in a replacement.
 
                             It is mandatory for `Replace`, `HashMod`, `Lowercase`, `Uppercase`,
                             `KeepEqual` and `DropEqual` actions.
@@ -4366,8 +4499,11 @@ spec:
                       type: object
                     type: array
                   podMonitorRelabelings:
-                    description: The list of relabelings for the `PodMonitor`. Applied
-                      to samples before scraping.
+                    description: |-
+                      The list of relabelings for the `PodMonitor`. Applied to samples before scraping.
+
+                      Deprecated: This feature will be removed in an upcoming release. If
+                      you need this functionality, you can create a PodMonitor manually.
                     items:
                       description: |-
                         RelabelConfig allows dynamic rewriting of the label set for targets, alerts,
@@ -4378,7 +4514,7 @@ spec:
                         action:
                           default: replace
                           description: |-
-                            Action to perform based on the regex matching.
+                            action to perform based on the regex matching.
 
                             `Uppercase` and `Lowercase` actions require Prometheus >= v2.36.0.
                             `DropEqual` and `KeepEqual` actions require Prometheus >= v2.41.0.
@@ -4410,41 +4546,41 @@ spec:
                           type: string
                         modulus:
                           description: |-
-                            Modulus to take of the hash of the source label values.
+                            modulus to take of the hash of the source label values.
 
                             Only applicable when the action is `HashMod`.
                           format: int64
                           type: integer
                         regex:
-                          description: Regular expression against which the extracted
-                            value is matched.
+                          description: regex defines the regular expression against
+                            which the extracted value is matched.
                           type: string
                         replacement:
                           description: |-
-                            Replacement value against which a Replace action is performed if the
+                            replacement value against which a Replace action is performed if the
                             regular expression matches.
 
                             Regex capture groups are available.
                           type: string
                         separator:
-                          description: Separator is the string between concatenated
+                          description: separator defines the string between concatenated
                             SourceLabels.
                           type: string
                         sourceLabels:
                           description: |-
-                            The source labels select values from existing labels. Their content is
+                            sourceLabels defines the source labels select values from existing labels. Their content is
                             concatenated using the configured Separator and matched against the
                             configured regular expression.
                           items:
                             description: |-
-                              LabelName is a valid Prometheus label name which may only contain ASCII
-                              letters, numbers, as well as underscores.
-                            pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$
+                              LabelName is a valid Prometheus label name.
+                              For Prometheus 3.x, a label name is valid if it contains UTF-8 characters.
+                              For Prometheus 2.x, a label name is only valid if it contains ASCII characters, letters, numbers, as well as underscores.
                             type: string
                           type: array
                         targetLabel:
                           description: |-
-                            Label to which the resulting string is written in a replacement.
+                            targetLabel defines the label to which the resulting string is written in a replacement.
 
                             It is mandatory for `Replace`, `HashMod`, `Lowercase`, `Uppercase`,
                             `KeepEqual` and `DropEqual` actions.
@@ -4493,6 +4629,13 @@ spec:
                       default: true
                       description: Enabled is true if this plugin will be used
                       type: boolean
+                    isWALArchiver:
+                      default: false
+                      description: |-
+                        Marks the plugin as the WAL archiver. At most one plugin can be
+                        designated as a WAL archiver. This cannot be enabled if the
+                        `.spec.backup.barmanObjectStore` configuration is present.
+                      type: boolean
                     name:
                       description: Name is the plugin name
                       type: string
@@ -4505,6 +4648,242 @@ spec:
                   - name
                   type: object
                 type: array
+              podSecurityContext:
+                description: |-
+                  Override the PodSecurityContext applied to every Pod of the cluster.
+                  When set, this overrides the operator's default PodSecurityContext for the cluster.
+                  If omitted, the operator defaults are used.
+                  This field doesn't have any effect if SecurityContextConstraints are present.
+                properties:
+                  appArmorProfile:
+                    description: |-
+                      appArmorProfile is the AppArmor options to use by the containers in this pod.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    properties:
+                      localhostProfile:
+                        description: |-
+                          localhostProfile indicates a profile loaded on the node that should be used.
+                          The profile must be preconfigured on the node to work.
+                          Must match the loaded name of the profile.
+                          Must be set if and only if type is "Localhost".
+                        type: string
+                      type:
+                        description: |-
+                          type indicates which kind of AppArmor profile will be applied.
+                          Valid options are:
+                            Localhost - a profile pre-loaded on the node.
+                            RuntimeDefault - the container runtime's default profile.
+                            Unconfined - no AppArmor enforcement.
+                        type: string
+                    required:
+                    - type
+                    type: object
+                  fsGroup:
+                    description: |-
+                      A special supplemental group that applies to all containers in a pod.
+                      Some volume types allow the Kubelet to change the ownership of that volume
+                      to be owned by the pod:
+
+                      1. The owning GID will be the FSGroup
+                      2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
+                      3. The permission bits are OR'd with rw-rw----
+
+                      If unset, the Kubelet will not modify the ownership and permissions of any volume.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    format: int64
+                    type: integer
+                  fsGroupChangePolicy:
+                    description: |-
+                      fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
+                      before being exposed inside Pod. This field will only apply to
+                      volume types which support fsGroup based ownership(and permissions).
+                      It will have no effect on ephemeral volume types such as: secret, configmaps
+                      and emptydir.
+                      Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    type: string
+                  runAsGroup:
+                    description: |-
+                      The GID to run the entrypoint of the container process.
+                      Uses runtime default if unset.
+                      May also be set in SecurityContext.  If set in both SecurityContext and
+                      PodSecurityContext, the value specified in SecurityContext takes precedence
+                      for that container.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    format: int64
+                    type: integer
+                  runAsNonRoot:
+                    description: |-
+                      Indicates that the container must run as a non-root user.
+                      If true, the Kubelet will validate the image at runtime to ensure that it
+                      does not run as UID 0 (root) and fail to start the container if it does.
+                      If unset or false, no such validation will be performed.
+                      May also be set in SecurityContext.  If set in both SecurityContext and
+                      PodSecurityContext, the value specified in SecurityContext takes precedence.
+                    type: boolean
+                  runAsUser:
+                    description: |-
+                      The UID to run the entrypoint of the container process.
+                      Defaults to user specified in image metadata if unspecified.
+                      May also be set in SecurityContext.  If set in both SecurityContext and
+                      PodSecurityContext, the value specified in SecurityContext takes precedence
+                      for that container.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    format: int64
+                    type: integer
+                  seLinuxChangePolicy:
+                    description: |-
+                      seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod.
+                      It has no effect on nodes that do not support SELinux or to volumes does not support SELinux.
+                      Valid values are "MountOption" and "Recursive".
+
+                      "Recursive" means relabeling of all files on all Pod volumes by the container runtime.
+                      This may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node.
+
+                      "MountOption" mounts all eligible Pod volumes with `-o context` mount option.
+                      This requires all Pods that share the same volume to use the same SELinux label.
+                      It is not possible to share the same volume among privileged and unprivileged Pods.
+                      Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
+                      whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
+                      CSIDriver instance. Other volumes are always re-labelled recursively.
+                      "MountOption" value is allowed only when SELinuxMount feature gate is enabled.
+
+                      If not specified and SELinuxMount feature gate is enabled, "MountOption" is used.
+                      If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes
+                      and "Recursive" for all other volumes.
+
+                      This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.
+
+                      All Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    type: string
+                  seLinuxOptions:
+                    description: |-
+                      The SELinux context to be applied to all containers.
+                      If unspecified, the container runtime will allocate a random SELinux context for each
+                      container.  May also be set in SecurityContext.  If set in
+                      both SecurityContext and PodSecurityContext, the value specified in SecurityContext
+                      takes precedence for that container.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    properties:
+                      level:
+                        description: Level is SELinux level label that applies to
+                          the container.
+                        type: string
+                      role:
+                        description: Role is a SELinux role label that applies to
+                          the container.
+                        type: string
+                      type:
+                        description: Type is a SELinux type label that applies to
+                          the container.
+                        type: string
+                      user:
+                        description: User is a SELinux user label that applies to
+                          the container.
+                        type: string
+                    type: object
+                  seccompProfile:
+                    description: |-
+                      The seccomp options to use by the containers in this pod.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    properties:
+                      localhostProfile:
+                        description: |-
+                          localhostProfile indicates a profile defined in a file on the node should be used.
+                          The profile must be preconfigured on the node to work.
+                          Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                          Must be set if type is "Localhost". Must NOT be set for any other type.
+                        type: string
+                      type:
+                        description: |-
+                          type indicates which kind of seccomp profile will be applied.
+                          Valid options are:
+
+                          Localhost - a profile defined in a file on the node should be used.
+                          RuntimeDefault - the container runtime default profile should be used.
+                          Unconfined - no profile should be applied.
+                        type: string
+                    required:
+                    - type
+                    type: object
+                  supplementalGroups:
+                    description: |-
+                      A list of groups applied to the first process run in each container, in
+                      addition to the container's primary GID and fsGroup (if specified).  If
+                      the SupplementalGroupsPolicy feature is enabled, the
+                      supplementalGroupsPolicy field determines whether these are in addition
+                      to or instead of any group memberships defined in the container image.
+                      If unspecified, no additional groups are added, though group memberships
+                      defined in the container image may still be used, depending on the
+                      supplementalGroupsPolicy field.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    items:
+                      format: int64
+                      type: integer
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  supplementalGroupsPolicy:
+                    description: |-
+                      Defines how supplemental groups of the first container processes are calculated.
+                      Valid values are "Merge" and "Strict". If not specified, "Merge" is used.
+                      (Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled
+                      and the container runtime must implement support for this feature.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    type: string
+                  sysctls:
+                    description: |-
+                      Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
+                      sysctls (by the container runtime) might fail to launch.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    items:
+                      description: Sysctl defines a kernel parameter to be set
+                      properties:
+                        name:
+                          description: Name of a property to set
+                          type: string
+                        value:
+                          description: Value of a property to set
+                          type: string
+                      required:
+                      - name
+                      - value
+                      type: object
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  windowsOptions:
+                    description: |-
+                      The Windows specific settings applied to all containers.
+                      If unspecified, the options within a container's SecurityContext will be used.
+                      If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+                      Note that this field cannot be set when spec.os.name is linux.
+                    properties:
+                      gmsaCredentialSpec:
+                        description: |-
+                          GMSACredentialSpec is where the GMSA admission webhook
+                          (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
+                          GMSA credential spec named by the GMSACredentialSpecName field.
+                        type: string
+                      gmsaCredentialSpecName:
+                        description: GMSACredentialSpecName is the name of the GMSA
+                          credential spec to use.
+                        type: string
+                      hostProcess:
+                        description: |-
+                          HostProcess determines if a container should be run as a 'Host Process' container.
+                          All of a Pod's containers must have the same effective HostProcess value
+                          (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
+                          In addition, if HostProcess is true then HostNetwork must also be set to true.
+                        type: boolean
+                      runAsUserName:
+                        description: |-
+                          The UserName in Windows to run the entrypoint of the container process.
+                          Defaults to the user specified in image metadata if unspecified.
+                          May also be set in PodSecurityContext. If set in both SecurityContext and
+                          PodSecurityContext, the value specified in SecurityContext takes precedence.
+                        type: string
+                    type: object
+                type: object
               postgresGID:
                 default: 26
                 description: The GID of the `postgres` user inside the image, defaults
@@ -4527,6 +4906,67 @@ spec:
                       This should only be used for debugging and troubleshooting.
                       Defaults to false.
                     type: boolean
+                  extensions:
+                    description: The configuration of the extensions to be added
+                    items:
+                      description: |-
+                        ExtensionConfiguration is the configuration used to add
+                        PostgreSQL extensions to the Cluster.
+                      properties:
+                        dynamic_library_path:
+                          description: |-
+                            The list of directories inside the image which should be added to dynamic_library_path.
+                            If not defined, defaults to "/lib".
+                          items:
+                            type: string
+                          type: array
+                        extension_control_path:
+                          description: |-
+                            The list of directories inside the image which should be added to extension_control_path.
+                            If not defined, defaults to "/share".
+                          items:
+                            type: string
+                          type: array
+                        image:
+                          description: The image containing the extension, required
+                          properties:
+                            pullPolicy:
+                              description: |-
+                                Policy for pulling OCI objects. Possible values are:
+                                Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.
+                                Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.
+                                IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.
+                                Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+                              type: string
+                            reference:
+                              description: |-
+                                Required: Image or artifact reference to be used.
+                                Behaves in the same way as pod.spec.containers[*].image.
+                                Pull secrets will be assembled in the same way as for the container image by looking up node credentials, SA image pull secrets, and pod spec image pull secrets.
+                                More info: https://kubernetes.io/docs/concepts/containers/images
+                                This field is optional to allow higher level config management to default or override
+                                container images in workload controllers like Deployments and StatefulSets.
+                              type: string
+                          type: object
+                          x-kubernetes-validations:
+                          - message: An image reference is required
+                            rule: has(self.reference)
+                        ld_library_path:
+                          description: The list of directories inside the image which
+                            should be added to ld_library_path.
+                          items:
+                            type: string
+                          type: array
+                        name:
+                          description: The name of the extension, required
+                          minLength: 1
+                          pattern: ^[a-z0-9]([-a-z0-9_]*[a-z0-9])?$
+                          type: string
+                      required:
+                      - image
+                      - name
+                      type: object
+                    type: array
                   ldap:
                     description: Options to specify LDAP configuration
                     properties:
@@ -4654,7 +5094,6 @@ spec:
                       feature
                     properties:
                       dataDurability:
-                        default: required
                         description: |-
                           If set to "required", data durability is strictly enforced. Write operations
                           with synchronous commit settings (`on`, `remote_write`, or `remote_apply`) will
@@ -4668,6 +5107,12 @@ spec:
                         - required
                         - preferred
                         type: string
+                      failoverQuorum:
+                        description: |-
+                          FailoverQuorum enables a quorum-based check before failover, improving
+                          data durability and safety during failover events in CloudNativePG-managed
+                          PostgreSQL clusters.
+                        type: boolean
                       maxStandbyNamesFromCluster:
                         description: |-
                           Specifies the maximum number of local cluster pods that can be
@@ -4724,7 +5169,10 @@ spec:
                 description: |-
                   Method to follow to upgrade the primary server during a rolling
                   update procedure, after all replicas have been successfully updated:
-                  it can be with a switchover (`switchover`) or in-place (`restart` - default)
+                  it can be with a switchover (`switchover`) or in-place (`restart` - default).
+                  Note: when using `switchover`, the operator will reject updates that change both
+                  the image name and PostgreSQL configuration parameters simultaneously to avoid
+                  configuration mismatches during the switchover process.
                 enum:
                 - switchover
                 - restart
@@ -4766,6 +5214,30 @@ spec:
                           More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
                         format: int32
                         type: integer
+                      isolationCheck:
+                        description: |-
+                          Configure the feature that extends the liveness probe for a primary
+                          instance. In addition to the basic checks, this verifies whether the
+                          primary is isolated from the Kubernetes API server and from its
+                          replicas, ensuring that it can be safely shut down if network
+                          partition or API unavailability is detected. Enabled by default.
+                        properties:
+                          connectionTimeout:
+                            default: 1000
+                            description: Timeout in milliseconds for connections during
+                              the primary isolation check
+                            type: integer
+                          enabled:
+                            default: true
+                            description: Whether primary isolation checking is enabled
+                              for the liveness probe
+                            type: boolean
+                          requestTimeout:
+                            default: 1000
+                            description: Timeout in milliseconds for requests during
+                              the primary isolation check
+                            type: integer
+                        type: object
                       periodSeconds:
                         description: |-
                           How often (in seconds) to perform the probe.
@@ -4815,6 +5287,13 @@ spec:
                           More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
                         format: int32
                         type: integer
+                      maximumLag:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        description: Lag limit. Used only for `streaming` strategy
+                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                        x-kubernetes-int-or-string: true
                       periodSeconds:
                         description: |-
                           How often (in seconds) to perform the probe.
@@ -4848,6 +5327,13 @@ spec:
                           More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
                         format: int32
                         type: integer
+                      type:
+                        description: The probe strategy
+                        enum:
+                        - pg_isready
+                        - streaming
+                        - query
+                        type: string
                     type: object
                   startup:
                     description: The startup probe configuration
@@ -4864,6 +5350,13 @@ spec:
                           More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
                         format: int32
                         type: integer
+                      maximumLag:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        description: Lag limit. Used only for `streaming` strategy
+                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                        x-kubernetes-int-or-string: true
                       periodSeconds:
                         description: |-
                           How often (in seconds) to perform the probe.
@@ -4897,6 +5390,13 @@ spec:
                           More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
                         format: int32
                         type: integer
+                      type:
+                        description: The probe strategy
+                        enum:
+                        - pg_isready
+                        - streaming
+                        - query
+                        type: string
                     type: object
                 type: object
               projectedVolumeTemplate:
@@ -5147,6 +5647,129 @@ spec:
                               type: array
                               x-kubernetes-list-type: atomic
                           type: object
+                        podCertificate:
+                          description: |-
+                            Projects an auto-rotating credential bundle (private key and certificate
+                            chain) that the pod can use either as a TLS client or server.
+
+                            Kubelet generates a private key and uses it to send a
+                            PodCertificateRequest to the named signer.  Once the signer approves the
+                            request and issues a certificate chain, Kubelet writes the key and
+                            certificate chain to the pod filesystem.  The pod does not start until
+                            certificates have been issued for each podCertificate projected volume
+                            source in its spec.
+
+                            Kubelet will begin trying to rotate the certificate at the time indicated
+                            by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                            timestamp.
+
+                            Kubelet can write a single file, indicated by the credentialBundlePath
+                            field, or separate files, indicated by the keyPath and
+                            certificateChainPath fields.
+
+                            The credential bundle is a single file in PEM format.  The first PEM
+                            entry is the private key (in PKCS#8 format), and the remaining PEM
+                            entries are the certificate chain issued by the signer (typically,
+                            signers will return their certificate chain in leaf-to-root order).
+
+                            Prefer using the credential bundle format, since your application code
+                            can read it atomically.  If you use keyPath and certificateChainPath,
+                            your application must make two separate file reads. If these coincide
+                            with a certificate rotation, it is possible that the private key and leaf
+                            certificate you read may not correspond to each other.  Your application
+                            will need to check for this condition, and re-read until they are
+                            consistent.
+
+                            The named signer controls chooses the format of the certificate it
+                            issues; consult the signer implementation's documentation to learn how to
+                            use the certificates it issues.
+                          properties:
+                            certificateChainPath:
+                              description: |-
+                                Write the certificate chain at this path in the projected volume.
+
+                                Most applications should use credentialBundlePath.  When using keyPath
+                                and certificateChainPath, your application needs to check that the key
+                                and leaf certificate are consistent, because it is possible to read the
+                                files mid-rotation.
+                              type: string
+                            credentialBundlePath:
+                              description: |-
+                                Write the credential bundle at this path in the projected volume.
+
+                                The credential bundle is a single file that contains multiple PEM blocks.
+                                The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                key.
+
+                                The remaining blocks are CERTIFICATE blocks, containing the issued
+                                certificate chain from the signer (leaf and any intermediates).
+
+                                Using credentialBundlePath lets your Pod's application code make a single
+                                atomic read that retrieves a consistent key and certificate chain.  If you
+                                project them to separate files, your application code will need to
+                                additionally check that the leaf certificate was issued to the key.
+                              type: string
+                            keyPath:
+                              description: |-
+                                Write the key at this path in the projected volume.
+
+                                Most applications should use credentialBundlePath.  When using keyPath
+                                and certificateChainPath, your application needs to check that the key
+                                and leaf certificate are consistent, because it is possible to read the
+                                files mid-rotation.
+                              type: string
+                            keyType:
+                              description: |-
+                                The type of keypair Kubelet will generate for the pod.
+
+                                Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                "ECDSAP521", and "ED25519".
+                              type: string
+                            maxExpirationSeconds:
+                              description: |-
+                                maxExpirationSeconds is the maximum lifetime permitted for the
+                                certificate.
+
+                                Kubelet copies this value verbatim into the PodCertificateRequests it
+                                generates for this projection.
+
+                                If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                value is 7862400 (91 days).
+
+                                The signer implementation is then free to issue a certificate with any
+                                lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                `kubernetes.io` signers will never issue certificates with a lifetime
+                                longer than 24 hours.
+                              format: int32
+                              type: integer
+                            signerName:
+                              description: Kubelet's generated CSRs will be addressed
+                                to this signer.
+                              type: string
+                            userAnnotations:
+                              additionalProperties:
+                                type: string
+                              description: |-
+                                userAnnotations allow pod authors to pass additional information to
+                                the signer implementation.  Kubernetes does not restrict or validate this
+                                metadata in any way.
+
+                                These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of
+                                the PodCertificateRequest objects that Kubelet creates.
+
+                                Entries are subject to the same validation as object metadata annotations,
+                                with the addition that all keys must be domain-prefixed. No restrictions
+                                are placed on values, except an overall size limitation on the entire field.
+
+                                Signers should document the keys and values they support. Signers should
+                                deny requests that contain keys they do not recognize.
+                              type: object
+                          required:
+                          - keyType
+                          - signerName
+                          type: object
                         secret:
                           description: secret information about the secret data to
                             project
@@ -5309,6 +5932,15 @@ spec:
                           This can only be set at creation time. By default set to `_cnpg_`.
                         pattern: ^[0-9a-z_]*$
                         type: string
+                      synchronizeLogicalDecoding:
+                        description: |-
+                          When enabled, the operator automatically manages synchronization of logical
+                          decoding (replication) slots across high-availability clusters.
+
+                          Requires one of the following conditions:
+                          - PostgreSQL version 17 or later
+                          - PostgreSQL version < 17 with pg_failover_slots extension enabled
+                        type: boolean
                     type: object
                   synchronizeReplicas:
                     description: Configures the synchronization of the user defined
@@ -5348,7 +5980,7 @@ spec:
                       Claims lists the names of resources, defined in spec.resourceClaims,
                       that are used by this container.
 
-                      This is an alpha field and requires enabling the
+                      This field depends on the
                       DynamicResourceAllocation feature gate.
 
                       This field is immutable. It can only be set for containers.
@@ -5430,6 +6062,199 @@ spec:
                 required:
                 - type
                 type: object
+              securityContext:
+                description: |-
+                  Override the SecurityContext applied to every Container in the Pod of the cluster.
+                  When set, this overrides the operator's default Container SecurityContext.
+                  If omitted, the operator defaults are used.
+                properties:
+                  allowPrivilegeEscalation:
+                    description: |-
+                      AllowPrivilegeEscalation controls whether a process can gain more
+                      privileges than its parent process. This bool directly controls if
+                      the no_new_privs flag will be set on the container process.
+                      AllowPrivilegeEscalation is true always when the container is:
+                      1) run as Privileged
+                      2) has CAP_SYS_ADMIN
+                      Note that this field cannot be set when spec.os.name is windows.
+                    type: boolean
+                  appArmorProfile:
+                    description: |-
+                      appArmorProfile is the AppArmor options to use by this container. If set, this profile
+                      overrides the pod's appArmorProfile.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    properties:
+                      localhostProfile:
+                        description: |-
+                          localhostProfile indicates a profile loaded on the node that should be used.
+                          The profile must be preconfigured on the node to work.
+                          Must match the loaded name of the profile.
+                          Must be set if and only if type is "Localhost".
+                        type: string
+                      type:
+                        description: |-
+                          type indicates which kind of AppArmor profile will be applied.
+                          Valid options are:
+                            Localhost - a profile pre-loaded on the node.
+                            RuntimeDefault - the container runtime's default profile.
+                            Unconfined - no AppArmor enforcement.
+                        type: string
+                    required:
+                    - type
+                    type: object
+                  capabilities:
+                    description: |-
+                      The capabilities to add/drop when running containers.
+                      Defaults to the default set of capabilities granted by the container runtime.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    properties:
+                      add:
+                        description: Added capabilities
+                        items:
+                          description: Capability represent POSIX capabilities type
+                          type: string
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      drop:
+                        description: Removed capabilities
+                        items:
+                          description: Capability represent POSIX capabilities type
+                          type: string
+                        type: array
+                        x-kubernetes-list-type: atomic
+                    type: object
+                  privileged:
+                    description: |-
+                      Run container in privileged mode.
+                      Processes in privileged containers are essentially equivalent to root on the host.
+                      Defaults to false.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    type: boolean
+                  procMount:
+                    description: |-
+                      procMount denotes the type of proc mount to use for the containers.
+                      The default value is Default which uses the container runtime defaults for
+                      readonly paths and masked paths.
+                      This requires the ProcMountType feature flag to be enabled.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    type: string
+                  readOnlyRootFilesystem:
+                    description: |-
+                      Whether this container has a read-only root filesystem.
+                      Default is false.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    type: boolean
+                  runAsGroup:
+                    description: |-
+                      The GID to run the entrypoint of the container process.
+                      Uses runtime default if unset.
+                      May also be set in PodSecurityContext.  If set in both SecurityContext and
+                      PodSecurityContext, the value specified in SecurityContext takes precedence.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    format: int64
+                    type: integer
+                  runAsNonRoot:
+                    description: |-
+                      Indicates that the container must run as a non-root user.
+                      If true, the Kubelet will validate the image at runtime to ensure that it
+                      does not run as UID 0 (root) and fail to start the container if it does.
+                      If unset or false, no such validation will be performed.
+                      May also be set in PodSecurityContext.  If set in both SecurityContext and
+                      PodSecurityContext, the value specified in SecurityContext takes precedence.
+                    type: boolean
+                  runAsUser:
+                    description: |-
+                      The UID to run the entrypoint of the container process.
+                      Defaults to user specified in image metadata if unspecified.
+                      May also be set in PodSecurityContext.  If set in both SecurityContext and
+                      PodSecurityContext, the value specified in SecurityContext takes precedence.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    format: int64
+                    type: integer
+                  seLinuxOptions:
+                    description: |-
+                      The SELinux context to be applied to the container.
+                      If unspecified, the container runtime will allocate a random SELinux context for each
+                      container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
+                      PodSecurityContext, the value specified in SecurityContext takes precedence.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    properties:
+                      level:
+                        description: Level is SELinux level label that applies to
+                          the container.
+                        type: string
+                      role:
+                        description: Role is a SELinux role label that applies to
+                          the container.
+                        type: string
+                      type:
+                        description: Type is a SELinux type label that applies to
+                          the container.
+                        type: string
+                      user:
+                        description: User is a SELinux user label that applies to
+                          the container.
+                        type: string
+                    type: object
+                  seccompProfile:
+                    description: |-
+                      The seccomp options to use by this container. If seccomp options are
+                      provided at both the pod & container level, the container options
+                      override the pod options.
+                      Note that this field cannot be set when spec.os.name is windows.
+                    properties:
+                      localhostProfile:
+                        description: |-
+                          localhostProfile indicates a profile defined in a file on the node should be used.
+                          The profile must be preconfigured on the node to work.
+                          Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                          Must be set if type is "Localhost". Must NOT be set for any other type.
+                        type: string
+                      type:
+                        description: |-
+                          type indicates which kind of seccomp profile will be applied.
+                          Valid options are:
+
+                          Localhost - a profile defined in a file on the node should be used.
+                          RuntimeDefault - the container runtime default profile should be used.
+                          Unconfined - no profile should be applied.
+                        type: string
+                    required:
+                    - type
+                    type: object
+                  windowsOptions:
+                    description: |-
+                      The Windows specific settings applied to all containers.
+                      If unspecified, the options from the PodSecurityContext will be used.
+                      If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+                      Note that this field cannot be set when spec.os.name is linux.
+                    properties:
+                      gmsaCredentialSpec:
+                        description: |-
+                          GMSACredentialSpec is where the GMSA admission webhook
+                          (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
+                          GMSA credential spec named by the GMSACredentialSpecName field.
+                        type: string
+                      gmsaCredentialSpecName:
+                        description: GMSACredentialSpecName is the name of the GMSA
+                          credential spec to use.
+                        type: string
+                      hostProcess:
+                        description: |-
+                          HostProcess determines if a container should be run as a 'Host Process' container.
+                          All of a Pod's containers must have the same effective HostProcess value
+                          (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
+                          In addition, if HostProcess is true then HostNetwork must also be set to true.
+                        type: boolean
+                      runAsUserName:
+                        description: |-
+                          The UserName in Windows to run the entrypoint of the container process.
+                          Defaults to the user specified in image metadata if unspecified.
+                          May also be set in PodSecurityContext. If set in both SecurityContext and
+                          PodSecurityContext, the value specified in SecurityContext takes precedence.
+                        type: string
+                    type: object
+                type: object
               serviceAccountTemplate:
                 description: Configure the generation of the service account
                 properties:
@@ -5469,7 +6294,7 @@ spec:
                 description: |-
                   The time in seconds that controls the window of time reserved for the smart shutdown of Postgres to complete.
                   Make sure you reserve enough time for the operator to request a fast shutdown of Postgres
-                  (that is: `stopDelay` - `smartShutdownTimeout`).
+                  (that is: `stopDelay` - `smartShutdownTimeout`). Default is 180 seconds.
                 format: int32
                 type: integer
               startDelay:
@@ -5582,7 +6407,7 @@ spec:
                       resources:
                         description: |-
                           resources represents the minimum resources the volume should have.
-                          If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
+                          Users are allowed to specify resource requirements
                           that are lower than previous value but must still be higher than capacity recorded in the
                           status field of the claim.
                           More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -5669,15 +6494,13 @@ spec:
                           volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                           If specified, the CSI driver will create or update the volume with the attributes defined
                           in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                          it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                          will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                          If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                          will be set by the persistentvolume controller if it exists.
+                          it can be changed after the claim is created. An empty string or nil value indicates that no
+                          VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                          this field can be reset to its previous value (including nil) to cancel the modification.
                           If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                           set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                           exists.
                           More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                          (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                         type: string
                       volumeMode:
                         description: |-
@@ -5840,7 +6663,7 @@ spec:
                             resources:
                               description: |-
                                 resources represents the minimum resources the volume should have.
-                                If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
+                                Users are allowed to specify resource requirements
                                 that are lower than previous value but must still be higher than capacity recorded in the
                                 status field of the claim.
                                 More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -5927,15 +6750,13 @@ spec:
                                 volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                 If specified, the CSI driver will create or update the volume with the attributes defined
                                 in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                will be set by the persistentvolume controller if it exists.
+                                it can be changed after the claim is created. An empty string or nil value indicates that no
+                                VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                this field can be reset to its previous value (including nil) to cancel the modification.
                                 If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                 set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                 exists.
                                 More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                               type: string
                             volumeMode:
                               description: |-
@@ -6104,7 +6925,6 @@ spec:
                         - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
 
                         If this value is nil, the behavior is equivalent to the Honor policy.
-                        This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                       type: string
                     nodeTaintsPolicy:
                       description: |-
@@ -6115,7 +6935,6 @@ spec:
                         - Ignore: node taints are ignored. All nodes are included.
 
                         If this value is nil, the behavior is equivalent to the Ignore policy.
-                        This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                       type: string
                     topologyKey:
                       description: |-
@@ -6252,7 +7071,7 @@ spec:
                       resources:
                         description: |-
                           resources represents the minimum resources the volume should have.
-                          If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
+                          Users are allowed to specify resource requirements
                           that are lower than previous value but must still be higher than capacity recorded in the
                           status field of the claim.
                           More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -6339,15 +7158,13 @@ spec:
                           volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                           If specified, the CSI driver will create or update the volume with the attributes defined
                           in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                          it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                          will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                          If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                          will be set by the persistentvolume controller if it exists.
+                          it can be changed after the claim is created. An empty string or nil value indicates that no
+                          VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                          this field can be reset to its previous value (including nil) to cancel the modification.
                           If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                           set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                           exists.
                           More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                          (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                         type: string
                       volumeMode:
                         description: |-
@@ -6407,10 +7224,6 @@ spec:
                   - hash
                   type: object
                 type: array
-              azurePVCUpdateEnabled:
-                description: AzurePVCUpdateEnabled shows if the PVC online upgrade
-                  is enabled for this cluster
-                type: boolean
               certificates:
                 description: The configuration for the CA and related certificates,
                   initialized with defaults.
@@ -6572,14 +7385,18 @@ spec:
               firstRecoverabilityPoint:
                 description: |-
                   The first recoverability point, stored as a date in RFC3339 format.
-                  This field is calculated from the content of FirstRecoverabilityPointByMethod
+                  This field is calculated from the content of FirstRecoverabilityPointByMethod.
+
+                  Deprecated: the field is not set for backup plugins.
                 type: string
               firstRecoverabilityPointByMethod:
                 additionalProperties:
                   format: date-time
                   type: string
-                description: The first recoverability point, stored as a date in RFC3339
-                  format, per backup method type
+                description: |-
+                  The first recoverability point, stored as a date in RFC3339 format, per backup method type.
+
+                  Deprecated: the field is not set for backup plugins.
                 type: object
               healthyPVC:
                 description: List of all the PVCs not dangling nor initializing
@@ -6609,6 +7426,9 @@ spec:
                   description: InstanceReportedState describes the last reported state
                     of an instance during a reconciliation loop
                   properties:
+                    ip:
+                      description: IP address of the instance
+                      type: string
                     isPrimary:
                       description: indicates if an instance is the primary one
                       type: boolean
@@ -6634,7 +7454,10 @@ spec:
                 format: int32
                 type: integer
               lastFailedBackup:
-                description: Stored as a date in RFC3339 format
+                description: |-
+                  Last failed backup, stored as a date in RFC3339 format.
+
+                  Deprecated: the field is not set for backup plugins.
                 type: string
               lastPromotionToken:
                 description: |-
@@ -6643,15 +7466,19 @@ spec:
                 type: string
               lastSuccessfulBackup:
                 description: |-
-                  Last successful backup, stored as a date in RFC3339 format
-                  This field is calculated from the content of LastSuccessfulBackupByMethod
+                  Last successful backup, stored as a date in RFC3339 format.
+                  This field is calculated from the content of LastSuccessfulBackupByMethod.
+
+                  Deprecated: the field is not set for backup plugins.
                 type: string
               lastSuccessfulBackupByMethod:
                 additionalProperties:
                   format: date-time
                   type: string
-                description: Last successful backup, stored as a date in RFC3339 format,
-                  per backup method type
+                description: |-
+                  Last successful backup, stored as a date in RFC3339 format, per backup method type.
+
+                  Deprecated: the field is not set for backup plugins.
                 type: object
               latestGeneratedNode:
                 description: ID of the latest generated node (used to avoid node name
@@ -6699,6 +7526,20 @@ spec:
                 description: OnlineUpdateEnabled shows if the online upgrade is enabled
                   inside the cluster
                 type: boolean
+              pgDataImageInfo:
+                description: PGDataImageInfo contains the details of the latest image
+                  that has run on the current data directory.
+                properties:
+                  image:
+                    description: Image is the image name
+                    type: string
+                  majorVersion:
+                    description: MajorVersion is the major version of the image
+                    type: integer
+                required:
+                - image
+                - majorVersion
+                type: object
               phase:
                 description: Current phase of the cluster
                 type: string
@@ -6854,6 +7695,9 @@ spec:
                       of switching a cluster to a replica cluster.
                     type: boolean
                 type: object
+              systemID:
+                description: SystemID is the latest detected PostgreSQL SystemID
+                type: string
               tablespacesStatus:
                 description: TablespacesStatus reports the state of the declarative
                   tablespaces in the cluster
@@ -6943,7 +7787,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.20.0
     helm.sh/resource-policy: keep
   name: databases.postgresql.cnpg.io
 spec:
@@ -7065,6 +7909,137 @@ spec:
                 - present
                 - absent
                 type: string
+              extensions:
+                description: The list of extensions to be managed in the database
+                items:
+                  description: ExtensionSpec configures an extension in a database
+                  properties:
+                    ensure:
+                      default: present
+                      description: |-
+                        Specifies whether an object (e.g schema) should be present or absent
+                        in the database. If set to `present`, the object will be created if
+                        it does not exist. If set to `absent`, the extension/schema will be
+                        removed if it exists.
+                      enum:
+                      - present
+                      - absent
+                      type: string
+                    name:
+                      description: Name of the object (extension, schema, FDW, server)
+                      type: string
+                    schema:
+                      description: |-
+                        The name of the schema in which to install the extension's objects,
+                        in case the extension allows its contents to be relocated. If not
+                        specified (default), and the extension's control file does not
+                        specify a schema either, the current default object creation schema
+                        is used.
+                      type: string
+                    version:
+                      description: |-
+                        The version of the extension to install. If empty, the operator will
+                        install the default version (whatever is specified in the
+                        extension's control file)
+                      type: string
+                  required:
+                  - name
+                  type: object
+                type: array
+              fdws:
+                description: The list of foreign data wrappers to be managed in the
+                  database
+                items:
+                  description: FDWSpec configures an Foreign Data Wrapper in a database
+                  properties:
+                    ensure:
+                      default: present
+                      description: |-
+                        Specifies whether an object (e.g schema) should be present or absent
+                        in the database. If set to `present`, the object will be created if
+                        it does not exist. If set to `absent`, the extension/schema will be
+                        removed if it exists.
+                      enum:
+                      - present
+                      - absent
+                      type: string
+                    handler:
+                      description: |-
+                        Name of the handler function (e.g., "postgres_fdw_handler").
+                        This will be empty if no handler is specified. In that case,
+                        the default handler is registered when the FDW extension is created.
+                      type: string
+                    name:
+                      description: Name of the object (extension, schema, FDW, server)
+                      type: string
+                    options:
+                      description: Options specifies the configuration options for
+                        the FDW.
+                      items:
+                        description: OptionSpec holds the name, value and the ensure
+                          field for an option
+                        properties:
+                          ensure:
+                            default: present
+                            description: |-
+                              Specifies whether an option should be present or absent in
+                              the database. If set to `present`, the option will be
+                              created if it does not exist. If set to `absent`, the
+                              option will be removed if it exists.
+                            enum:
+                            - present
+                            - absent
+                            type: string
+                          name:
+                            description: Name of the option
+                            type: string
+                          value:
+                            description: Value of the option
+                            type: string
+                        required:
+                        - name
+                        - value
+                        type: object
+                      type: array
+                    owner:
+                      description: |-
+                        Owner specifies the database role that will own the Foreign Data Wrapper.
+                        The role must have superuser privileges in the target database.
+                      type: string
+                    usage:
+                      description: List of roles for which `USAGE` privileges on the
+                        FDW are granted or revoked.
+                      items:
+                        description: UsageSpec configures a usage for a foreign data
+                          wrapper
+                        properties:
+                          name:
+                            description: Name of the usage
+                            type: string
+                            x-kubernetes-validations:
+                            - message: name is required
+                              rule: self != ''
+                          type:
+                            default: grant
+                            description: The type of usage
+                            enum:
+                            - grant
+                            - revoke
+                            type: string
+                        required:
+                        - name
+                        type: object
+                      type: array
+                    validator:
+                      description: |-
+                        Name of the validator function (e.g., "postgres_fdw_validator").
+                        This will be empty if no validator is specified. In that case,
+                        the default validator is registered when the FDW extension is created.
+                      type: string
+                  required:
+                  - name
+                  type: object
+                type: array
               icuLocale:
                 description: |-
                   Maps to the `ICU_LOCALE` parameter of `CREATE DATABASE`. This
@@ -7144,6 +8119,119 @@ spec:
                   Maps to the `OWNER TO` command of `ALTER DATABASE`.
                   The role name of the user who owns the database inside PostgreSQL.
                 type: string
+              schemas:
+                description: The list of schemas to be managed in the database
+                items:
+                  description: SchemaSpec configures a schema in a database
+                  properties:
+                    ensure:
+                      default: present
+                      description: |-
+                        Specifies whether an object (e.g schema) should be present or absent
+                        in the database. If set to `present`, the object will be created if
+                        it does not exist. If set to `absent`, the extension/schema will be
+                        removed if it exists.
+                      enum:
+                      - present
+                      - absent
+                      type: string
+                    name:
+                      description: Name of the object (extension, schema, FDW, server)
+                      type: string
+                    owner:
+                      description: |-
+                        The role name of the user who owns the schema inside PostgreSQL.
+                        It maps to the `AUTHORIZATION` parameter of `CREATE SCHEMA` and the
+                        `OWNER TO` command of `ALTER SCHEMA`.
+                      type: string
+                  required:
+                  - name
+                  type: object
+                type: array
+              servers:
+                description: The list of foreign servers to be managed in the database
+                items:
+                  description: ServerSpec configures a server of a foreign data wrapper
+                  properties:
+                    ensure:
+                      default: present
+                      description: |-
+                        Specifies whether an object (e.g schema) should be present or absent
+                        in the database. If set to `present`, the object will be created if
+                        it does not exist. If set to `absent`, the extension/schema will be
+                        removed if it exists.
+                      enum:
+                      - present
+                      - absent
+                      type: string
+                    fdw:
+                      description: The name of the Foreign Data Wrapper (FDW)
+                      type: string
+                      x-kubernetes-validations:
+                      - message: fdw is required
+                        rule: self != ''
+                    name:
+                      description: Name of the object (extension, schema, FDW, server)
+                      type: string
+                    options:
+                      description: |-
+                        Options specifies the configuration options for the server
+                        (key is the option name, value is the option value).
+                      items:
+                        description: OptionSpec holds the name, value and the ensure
+                          field for an option
+                        properties:
+                          ensure:
+                            default: present
+                            description: |-
+                              Specifies whether an option should be present or absent in
+                              the database. If set to `present`, the option will be
+                              created if it does not exist. If set to `absent`, the
+                              option will be removed if it exists.
+                            enum:
+                            - present
+                            - absent
+                            type: string
+                          name:
+                            description: Name of the option
+                            type: string
+                          value:
+                            description: Value of the option
+                            type: string
+                        required:
+                        - name
+                        - value
+                        type: object
+                      type: array
+                    usage:
+                      description: List of roles for which `USAGE` privileges on the
+                        server are granted or revoked.
+                      items:
+                        description: UsageSpec configures a usage for a foreign data
+                          wrapper
+                        properties:
+                          name:
+                            description: Name of the usage
+                            type: string
+                            x-kubernetes-validations:
+                            - message: name is required
+                              rule: self != ''
+                          type:
+                            default: grant
+                            description: The type of usage
+                            enum:
+                            - grant
+                            - revoke
+                            type: string
+                        required:
+                        - name
+                        type: object
+                      type: array
+                  required:
+                  - fdw
+                  - name
+                  type: object
+                type: array
               tablespace:
                 description: |-
                   Maps to the `TABLESPACE` parameter of `CREATE DATABASE`.
@@ -7183,6 +8271,50 @@ spec:
               applied:
                 description: Applied is true if the database was reconciled correctly
                 type: boolean
+              extensions:
+                description: Extensions is the status of the managed extensions
+                items:
+                  description: DatabaseObjectStatus is the status of the managed database
+                    objects
+                  properties:
+                    applied:
+                      description: |-
+                        True of the object has been installed successfully in
+                        the database
+                      type: boolean
+                    message:
+                      description: Message is the object reconciliation message
+                      type: string
+                    name:
+                      description: The name of the object
+                      type: string
+                  required:
+                  - applied
+                  - name
+                  type: object
+                type: array
+              fdws:
+                description: FDWs is the status of the managed FDWs
+                items:
+                  description: DatabaseObjectStatus is the status of the managed database
+                    objects
+                  properties:
+                    applied:
+                      description: |-
+                        True of the object has been installed successfully in
+                        the database
+                      type: boolean
+                    message:
+                      description: Message is the object reconciliation message
+                      type: string
+                    name:
+                      description: The name of the object
+                      type: string
+                  required:
+                  - applied
+                  - name
+                  type: object
+                type: array
               message:
                 description: Message is the reconciliation output message
                 type: string
@@ -7192,6 +8324,50 @@ spec:
                   desired state that was synchronized
                 format: int64
                 type: integer
+              schemas:
+                description: Schemas is the status of the managed schemas
+                items:
+                  description: DatabaseObjectStatus is the status of the managed database
+                    objects
+                  properties:
+                    applied:
+                      description: |-
+                        True of the object has been installed successfully in
+                        the database
+                      type: boolean
+                    message:
+                      description: Message is the object reconciliation message
+                      type: string
+                    name:
+                      description: The name of the object
+                      type: string
+                  required:
+                  - applied
+                  - name
+                  type: object
+                type: array
+              servers:
+                description: Servers is the status of the managed servers
+                items:
+                  description: DatabaseObjectStatus is the status of the managed database
+                    objects
+                  properties:
+                    applied:
+                      description: |-
+                        True of the object has been installed successfully in
+                        the database
+                      type: boolean
+                    message:
+                      description: Message is the object reconciliation message
+                      type: string
+                    name:
+                      description: The name of the object
+                      type: string
+                  required:
+                  - applied
+                  - name
+                  type: object
+                type: array
             type: object
         required:
         - metadata
@@ -7206,7 +8382,85 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.20.0
+    helm.sh/resource-policy: keep
+  name: failoverquorums.postgresql.cnpg.io
+spec:
+  group: postgresql.cnpg.io
+  names:
+    kind: FailoverQuorum
+    listKind: FailoverQuorumList
+    plural: failoverquorums
+    singular: failoverquorum
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          FailoverQuorum contains the information about the current failover
+          quorum status of a PG cluster. It is updated by the instance manager
+          of the primary node and reset to zero by the operator to trigger
+          an update.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          status:
+            description: Most recently observed status of the failover quorum.
+            properties:
+              method:
+                description: Contains the latest reported Method value.
+                type: string
+              primary:
+                description: |-
+                  Primary is the name of the primary instance that updated
+                  this object the latest time.
+                type: string
+              standbyNames:
+                description: |-
+                  StandbyNames is the list of potentially synchronous
+                  instance names.
+                items:
+                  type: string
+                type: array
+              standbyNumber:
+                description: |-
+                  StandbyNumber is the number of synchronous standbys that transactions
+                  need to wait for replies from.
+                type: integer
+            type: object
+        required:
+        - metadata
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
     helm.sh/resource-policy: keep
   name: imagecatalogs.postgresql.cnpg.io
 spec:
@@ -7287,7 +8541,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.20.0
     helm.sh/resource-policy: keep
   name: poolers.postgresql.cnpg.io
 spec:
@@ -7401,8 +8655,11 @@ spec:
                 format: int32
                 type: integer
               monitoring:
-                description: The configuration of the monitoring infrastructure of
-                  this pooler.
+                description: |-
+                  The configuration of the monitoring infrastructure of this pooler.
+
+                  Deprecated: This feature will be removed in an upcoming release. If
+                  you need this functionality, you can create a PodMonitor manually.
                 properties:
                   enablePodMonitor:
                     default: false
@@ -7421,7 +8678,7 @@ spec:
                         action:
                           default: replace
                           description: |-
-                            Action to perform based on the regex matching.
+                            action to perform based on the regex matching.
 
                             `Uppercase` and `Lowercase` actions require Prometheus >= v2.36.0.
                             `DropEqual` and `KeepEqual` actions require Prometheus >= v2.41.0.
@@ -7453,41 +8710,41 @@ spec:
                           type: string
                         modulus:
                           description: |-
-                            Modulus to take of the hash of the source label values.
+                            modulus to take of the hash of the source label values.
 
                             Only applicable when the action is `HashMod`.
                           format: int64
                           type: integer
                         regex:
-                          description: Regular expression against which the extracted
-                            value is matched.
+                          description: regex defines the regular expression against
+                            which the extracted value is matched.
                           type: string
                         replacement:
                           description: |-
-                            Replacement value against which a Replace action is performed if the
+                            replacement value against which a Replace action is performed if the
                             regular expression matches.
 
                             Regex capture groups are available.
                           type: string
                         separator:
-                          description: Separator is the string between concatenated
+                          description: separator defines the string between concatenated
                             SourceLabels.
                           type: string
                         sourceLabels:
                           description: |-
-                            The source labels select values from existing labels. Their content is
+                            sourceLabels defines the source labels select values from existing labels. Their content is
                             concatenated using the configured Separator and matched against the
                             configured regular expression.
                           items:
                             description: |-
-                              LabelName is a valid Prometheus label name which may only contain ASCII
-                              letters, numbers, as well as underscores.
-                            pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$
+                              LabelName is a valid Prometheus label name.
+                              For Prometheus 3.x, a label name is valid if it contains UTF-8 characters.
+                              For Prometheus 2.x, a label name is only valid if it contains ASCII characters, letters, numbers, as well as underscores.
                             type: string
                           type: array
                         targetLabel:
                           description: |-
-                            Label to which the resulting string is written in a replacement.
+                            targetLabel defines the label to which the resulting string is written in a replacement.
 
                             It is mandatory for `Replace`, `HashMod`, `Lowercase`, `Uppercase`,
                             `KeepEqual` and `DropEqual` actions.
@@ -7509,7 +8766,7 @@ spec:
                         action:
                           default: replace
                           description: |-
-                            Action to perform based on the regex matching.
+                            action to perform based on the regex matching.
 
                             `Uppercase` and `Lowercase` actions require Prometheus >= v2.36.0.
                             `DropEqual` and `KeepEqual` actions require Prometheus >= v2.41.0.
@@ -7541,41 +8798,41 @@ spec:
                           type: string
                         modulus:
                           description: |-
-                            Modulus to take of the hash of the source label values.
+                            modulus to take of the hash of the source label values.
 
                             Only applicable when the action is `HashMod`.
                           format: int64
                           type: integer
                         regex:
-                          description: Regular expression against which the extracted
-                            value is matched.
+                          description: regex defines the regular expression against
+                            which the extracted value is matched.
                           type: string
                         replacement:
                           description: |-
-                            Replacement value against which a Replace action is performed if the
+                            replacement value against which a Replace action is performed if the
                             regular expression matches.
 
                             Regex capture groups are available.
                           type: string
                         separator:
-                          description: Separator is the string between concatenated
+                          description: separator defines the string between concatenated
                             SourceLabels.
                           type: string
                         sourceLabels:
                           description: |-
-                            The source labels select values from existing labels. Their content is
+                            sourceLabels defines the source labels select values from existing labels. Their content is
                             concatenated using the configured Separator and matched against the
                             configured regular expression.
                           items:
                             description: |-
-                              LabelName is a valid Prometheus label name which may only contain ASCII
-                              letters, numbers, as well as underscores.
-                            pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$
+                              LabelName is a valid Prometheus label name.
+                              For Prometheus 3.x, a label name is valid if it contains UTF-8 characters.
+                              For Prometheus 2.x, a label name is only valid if it contains ASCII characters, letters, numbers, as well as underscores.
                             type: string
                           type: array
                         targetLabel:
                           description: |-
-                            Label to which the resulting string is written in a replacement.
+                            targetLabel defines the label to which the resulting string is written in a replacement.
 
                             It is mandatory for `Replace`, `HashMod`, `Lowercase`, `Uppercase`,
                             `KeepEqual` and `DropEqual` actions.
@@ -7601,6 +8858,30 @@ spec:
                       query. In case it is specified, also an AuthQuery
                       (e.g. "SELECT usename, passwd FROM pg_catalog.pg_shadow WHERE usename=$1")
                       has to be specified and no automatic CNPG Cluster integration will be triggered.
+
+                      Deprecated.
+                    properties:
+                      name:
+                        description: Name of the referent.
+                        type: string
+                    required:
+                    - name
+                    type: object
+                  clientCASecret:
+                    description: |-
+                      ClientCASecret provides PgBouncer’s client_tls_ca_file, the root
+                      CA for validating client certificates
+                    properties:
+                      name:
+                        description: Name of the referent.
+                        type: string
+                    required:
+                    - name
+                    type: object
+                  clientTLSSecret:
+                    description: |-
+                      ClientTLSSecret provides PgBouncer’s client_tls_key_file (private key)
+                      and client_tls_cert_file (certificate) used to accept client connections
                     properties:
                       name:
                         description: Name of the referent.
@@ -7637,6 +8918,29 @@ spec:
                     - session
                     - transaction
                     type: string
+                  serverCASecret:
+                    description: |-
+                      ServerCASecret provides PgBouncer’s server_tls_ca_file, the root
+                      CA for validating PostgreSQL certificates
+                    properties:
+                      name:
+                        description: Name of the referent.
+                        type: string
+                    required:
+                    - name
+                    type: object
+                  serverTLSSecret:
+                    description: |-
+                      ServerTLSSecret, when pointing to a TLS secret, provides pgbouncer's
+                      `server_tls_key_file` and `server_tls_cert_file`, used when
+                      authenticating against PostgreSQL.
+                    properties:
+                      name:
+                        description: Name of the referent.
+                        type: string
+                    required:
+                    - name
+                    type: object
                 type: object
               serviceTemplate:
                 description: Template for the Service to be created
@@ -7986,13 +9290,12 @@ spec:
                         type: object
                       trafficDistribution:
                         description: |-
-                          TrafficDistribution offers a way to express preferences for how traffic is
-                          distributed to Service endpoints. Implementations can use this field as a
-                          hint, but are not required to guarantee strict adherence. If the field is
-                          not set, the implementation will apply its default routing strategy. If set
-                          to "PreferClose", implementations should prioritize endpoints that are
-                          topologically close (e.g., same zone).
-                          This is a beta field and requires enabling ServiceTrafficDistribution feature.
+                          TrafficDistribution offers a way to express preferences for how traffic
+                          is distributed to Service endpoints. Implementations can use this field
+                          as a hint, but are not required to guarantee strict adherence. If the
+                          field is not set, the implementation will apply its default routing
+                          strategy. If set to "PreferClose", implementations should prioritize
+                          endpoints that are in the same zone.
                         type: string
                       type:
                         description: |-
@@ -8346,7 +9649,6 @@ spec:
                                             pod labels will be ignored. The default value is empty.
                                             The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                             Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                           items:
                                             type: string
                                           type: array
@@ -8361,7 +9663,6 @@ spec:
                                             pod labels will be ignored. The default value is empty.
                                             The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                             Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                           items:
                                             type: string
                                           type: array
@@ -8529,7 +9830,6 @@ spec:
                                         pod labels will be ignored. The default value is empty.
                                         The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                         Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                       items:
                                         type: string
                                       type: array
@@ -8544,7 +9844,6 @@ spec:
                                         pod labels will be ignored. The default value is empty.
                                         The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                         Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                       items:
                                         type: string
                                       type: array
@@ -8638,8 +9937,8 @@ spec:
                                   most preferred is the one with the greatest sum of weights, i.e.
                                   for each node that meets all of the scheduling requirements (resource
                                   request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                  compute a sum by iterating through the elements of this field and adding
-                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  compute a sum by iterating through the elements of this field and subtracting
+                                  "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                   node(s) with the highest sum are the most preferred.
                                 items:
                                   description: The weights of all of the matched WeightedPodAffinityTerm
@@ -8710,7 +10009,6 @@ spec:
                                             pod labels will be ignored. The default value is empty.
                                             The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                             Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                           items:
                                             type: string
                                           type: array
@@ -8725,7 +10023,6 @@ spec:
                                             pod labels will be ignored. The default value is empty.
                                             The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                             Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                           items:
                                             type: string
                                           type: array
@@ -8893,7 +10190,6 @@ spec:
                                         pod labels will be ignored. The default value is empty.
                                         The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                         Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                       items:
                                         type: string
                                       type: array
@@ -8908,7 +10204,6 @@ spec:
                                         pod labels will be ignored. The default value is empty.
                                         The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                         Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                       items:
                                         type: string
                                       type: array
@@ -9041,8 +10336,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -9101,6 +10397,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -9163,14 +10496,14 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
                               items:
                                 description: EnvFromSource represents the source of
-                                  a set of ConfigMaps
+                                  a set of ConfigMaps or Secrets
                                 properties:
                                   configMapRef:
                                     description: The ConfigMap to select from
@@ -9191,8 +10524,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: An optional identifier to prepend
-                                      to each key in the ConfigMap. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -9458,6 +10792,12 @@ spec:
                                       - port
                                       type: object
                                   type: object
+                                stopSignal:
+                                  description: |-
+                                    StopSignal defines which signal will be sent to a container when it is being stopped.
+                                    If not specified, the default is defined by the container runtime in use.
+                                    StopSignal can only be set for Pods with a non-empty .spec.os.name
+                                  type: string
                               type: object
                             livenessProbe:
                               description: |-
@@ -9833,7 +11173,9 @@ spec:
                                   type: integer
                               type: object
                             resizePolicy:
-                              description: Resources resize policy for the container.
+                              description: |-
+                                Resources resize policy for the container.
+                                This field cannot be set on ephemeral containers.
                               items:
                                 description: ContainerResizePolicy represents resource
                                   resize policy for the container.
@@ -9865,7 +11207,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -9920,10 +11262,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This field may only be set for init containers, and the only allowed value is "Always".
-                                For non-init containers or when this field is not specified,
+                                This overrides the pod-level restart policy. When this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -9935,6 +11277,59 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -10555,8 +11950,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -10615,6 +12011,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -10677,14 +12110,14 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
                               items:
                                 description: EnvFromSource represents the source of
-                                  a set of ConfigMaps
+                                  a set of ConfigMaps or Secrets
                                 properties:
                                   configMapRef:
                                     description: The ConfigMap to select from
@@ -10705,8 +12138,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: An optional identifier to prepend
-                                      to each key in the ConfigMap. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -10969,6 +12403,12 @@ spec:
                                       - port
                                       type: object
                                   type: object
+                                stopSignal:
+                                  description: |-
+                                    StopSignal defines which signal will be sent to a container when it is being stopped.
+                                    If not specified, the default is defined by the container runtime in use.
+                                    StopSignal can only be set for Pods with a non-empty .spec.os.name
+                                  type: string
                               type: object
                             livenessProbe:
                               description: Probes are not allowed for ephemeral containers.
@@ -11359,7 +12799,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -11415,9 +12855,53 @@ spec:
                               description: |-
                                 Restart policy for the container to manage the restart behavior of each
                                 container within a pod.
-                                This may only be set for init containers. You cannot set this field on
-                                ephemeral containers.
+                                You cannot set this field on ephemeral containers.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. You cannot set this field on
+                                ephemeral containers.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -11956,7 +13440,9 @@ spec:
                       hostNetwork:
                         description: |-
                           Host networking requested for this pod. Use the host's network namespace.
-                          If this option is set, the ports that will be used must be specified.
+                          When using HostNetwork you should specify ports so the scheduler is aware.
+                          When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
+                          and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
                           Default to false.
                         type: boolean
                       hostPID:
@@ -11981,6 +13467,19 @@ spec:
                           Specifies the hostname of the Pod
                           If not specified, the pod's hostname will be set to a system-defined value.
                         type: string
+                      hostnameOverride:
+                        description: |-
+                          HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
+                          This field only specifies the pod's hostname and does not affect its DNS records.
+                          When this field is set to a non-empty string:
+                          - It takes precedence over the values set in `hostname` and `subdomain`.
+                          - The Pod's hostname will be set to this value.
+                          - `setHostnameAsFQDN` must be nil or set to false.
+                          - `hostNetwork` must be set to false.
+
+                          This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
+                          Requires the HostnameOverride feature gate to be enabled.
+                        type: string
                       imagePullSecrets:
                         description: |-
                           ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -12016,7 +13515,7 @@ spec:
                           Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.
                           The resourceRequirements of an init container are taken into account during scheduling
                           by finding the highest request/limit for each resource type, and then using the max of
-                          of that value or the sum of the normal containers. Limits are applied to init containers
+                          that value or the sum of the normal containers. Limits are applied to init containers
                           in a similar fashion.
                           Init containers cannot currently be added or removed.
                           Cannot be updated.
@@ -12062,8 +13561,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -12122,6 +13622,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -12184,14 +13721,14 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
                               items:
                                 description: EnvFromSource represents the source of
-                                  a set of ConfigMaps
+                                  a set of ConfigMaps or Secrets
                                 properties:
                                   configMapRef:
                                     description: The ConfigMap to select from
@@ -12212,8 +13749,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: An optional identifier to prepend
-                                      to each key in the ConfigMap. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -12479,6 +14017,12 @@ spec:
                                       - port
                                       type: object
                                   type: object
+                                stopSignal:
+                                  description: |-
+                                    StopSignal defines which signal will be sent to a container when it is being stopped.
+                                    If not specified, the default is defined by the container runtime in use.
+                                    StopSignal can only be set for Pods with a non-empty .spec.os.name
+                                  type: string
                               type: object
                             livenessProbe:
                               description: |-
@@ -12854,7 +14398,9 @@ spec:
                                   type: integer
                               type: object
                             resizePolicy:
-                              description: Resources resize policy for the container.
+                              description: |-
+                                Resources resize policy for the container.
+                                This field cannot be set on ephemeral containers.
                               items:
                                 description: ContainerResizePolicy represents resource
                                   resize policy for the container.
@@ -12886,7 +14432,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -12941,10 +14487,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This field may only be set for init containers, and the only allowed value is "Always".
-                                For non-init containers or when this field is not specified,
+                                This overrides the pod-level restart policy. When this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -12956,6 +14502,59 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -13489,6 +15088,7 @@ spec:
                           - spec.hostPID
                           - spec.hostIPC
                           - spec.hostUsers
+                          - spec.resources
                           - spec.securityContext.appArmorProfile
                           - spec.securityContext.seLinuxOptions
                           - spec.securityContext.seccompProfile
@@ -13587,8 +15187,8 @@ spec:
                           will be made available to those containers which consume them
                           by name.
 
-                          This is an alpha field and requires enabling the
-                          DynamicResourceAllocation feature gate.
+                          This is a stable field but requires that the
+                          DynamicResourceAllocation feature gate is enabled.
 
                           This field is immutable.
                         items:
@@ -13642,7 +15242,7 @@ spec:
                         description: |-
                           Resources is the total amount of CPU and Memory resources required by all
                           containers in the pod. It supports specifying Requests and Limits for
-                          "cpu" and "memory" resource names only. ResourceClaims are not supported.
+                          "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
 
                           This field enables fine-grained control over resource allocation for the
                           entire pod, allowing resource sharing among containers in a pod.
@@ -13655,7 +15255,7 @@ spec:
                               Claims lists the names of resources, defined in spec.resourceClaims,
                               that are used by this container.
 
-                              This is an alpha field and requires enabling the
+                              This field depends on the
                               DynamicResourceAllocation feature gate.
 
                               This field is immutable. It can only be set for containers.
@@ -14047,9 +15647,10 @@ spec:
                             operator:
                               description: |-
                                 Operator represents a key's relationship to the value.
-                                Valid operators are Exists and Equal. Defaults to Equal.
+                                Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
                                 Exists is equivalent to wildcard for value, so that a pod can
                                 tolerate all taints of a particular category.
+                                Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                               type: string
                             tolerationSeconds:
                               description: |-
@@ -14193,7 +15794,6 @@ spec:
                                 - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
 
                                 If this value is nil, the behavior is equivalent to the Honor policy.
-                                This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                               type: string
                             nodeTaintsPolicy:
                               description: |-
@@ -14204,7 +15804,6 @@ spec:
                                 - Ignore: node taints are ignored. All nodes are included.
 
                                 If this value is nil, the behavior is equivalent to the Ignore policy.
-                                This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                               type: string
                             topologyKey:
                               description: |-
@@ -14845,7 +16444,7 @@ spec:
                                         resources:
                                           description: |-
                                             resources represents the minimum resources the volume should have.
-                                            If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
+                                            Users are allowed to specify resource requirements
                                             that are lower than previous value but must still be higher than capacity recorded in the
                                             status field of the claim.
                                             More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -14934,15 +16533,13 @@ spec:
                                             volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                             If specified, the CSI driver will create or update the volume with the attributes defined
                                             in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                            it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                            will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                            If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                            will be set by the persistentvolume controller if it exists.
+                                            it can be changed after the claim is created. An empty string or nil value indicates that no
+                                            VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                            this field can be reset to its previous value (including nil) to cancel the modification.
                                             If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                             set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                             exists.
                                             More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                            (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                           type: string
                                         volumeMode:
                                           description: |-
@@ -15124,12 +16721,10 @@ spec:
                               description: |-
                                 glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                 Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                                More info: https://examples.k8s.io/volumes/glusterfs/README.md
                               properties:
                                 endpoints:
-                                  description: |-
-                                    endpoints is the endpoint name that details Glusterfs topology.
-                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                  description: endpoints is the endpoint name that
+                                    details Glusterfs topology.
                                   type: string
                                 path:
                                   description: |-
@@ -15183,7 +16778,7 @@ spec:
                                 The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
                                 The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
                                 The volume will be mounted read-only (ro) and non-executable files (noexec).
-                                Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
+                                Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
                                 The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
                               properties:
                                 pullPolicy:
@@ -15208,7 +16803,7 @@ spec:
                               description: |-
                                 iscsi represents an ISCSI Disk resource that is attached to a
                                 kubelet's host machine and then exposed to the pod.
-                                More info: https://examples.k8s.io/volumes/iscsi/README.md
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                               properties:
                                 chapAuthDiscovery:
                                   description: chapAuthDiscovery defines whether support
@@ -15634,6 +17229,129 @@ spec:
                                             type: array
                                             x-kubernetes-list-type: atomic
                                         type: object
+                                      podCertificate:
+                                        description: |-
+                                          Projects an auto-rotating credential bundle (private key and certificate
+                                          chain) that the pod can use either as a TLS client or server.
+
+                                          Kubelet generates a private key and uses it to send a
+                                          PodCertificateRequest to the named signer.  Once the signer approves the
+                                          request and issues a certificate chain, Kubelet writes the key and
+                                          certificate chain to the pod filesystem.  The pod does not start until
+                                          certificates have been issued for each podCertificate projected volume
+                                          source in its spec.
+
+                                          Kubelet will begin trying to rotate the certificate at the time indicated
+                                          by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                          timestamp.
+
+                                          Kubelet can write a single file, indicated by the credentialBundlePath
+                                          field, or separate files, indicated by the keyPath and
+                                          certificateChainPath fields.
+
+                                          The credential bundle is a single file in PEM format.  The first PEM
+                                          entry is the private key (in PKCS#8 format), and the remaining PEM
+                                          entries are the certificate chain issued by the signer (typically,
+                                          signers will return their certificate chain in leaf-to-root order).
+
+                                          Prefer using the credential bundle format, since your application code
+                                          can read it atomically.  If you use keyPath and certificateChainPath,
+                                          your application must make two separate file reads. If these coincide
+                                          with a certificate rotation, it is possible that the private key and leaf
+                                          certificate you read may not correspond to each other.  Your application
+                                          will need to check for this condition, and re-read until they are
+                                          consistent.
+
+                                          The named signer controls chooses the format of the certificate it
+                                          issues; consult the signer implementation's documentation to learn how to
+                                          use the certificates it issues.
+                                        properties:
+                                          certificateChainPath:
+                                            description: |-
+                                              Write the certificate chain at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          credentialBundlePath:
+                                            description: |-
+                                              Write the credential bundle at this path in the projected volume.
+
+                                              The credential bundle is a single file that contains multiple PEM blocks.
+                                              The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                              key.
+
+                                              The remaining blocks are CERTIFICATE blocks, containing the issued
+                                              certificate chain from the signer (leaf and any intermediates).
+
+                                              Using credentialBundlePath lets your Pod's application code make a single
+                                              atomic read that retrieves a consistent key and certificate chain.  If you
+                                              project them to separate files, your application code will need to
+                                              additionally check that the leaf certificate was issued to the key.
+                                            type: string
+                                          keyPath:
+                                            description: |-
+                                              Write the key at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          keyType:
+                                            description: |-
+                                              The type of keypair Kubelet will generate for the pod.
+
+                                              Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                              "ECDSAP521", and "ED25519".
+                                            type: string
+                                          maxExpirationSeconds:
+                                            description: |-
+                                              maxExpirationSeconds is the maximum lifetime permitted for the
+                                              certificate.
+
+                                              Kubelet copies this value verbatim into the PodCertificateRequests it
+                                              generates for this projection.
+
+                                              If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                              will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                              value is 7862400 (91 days).
+
+                                              The signer implementation is then free to issue a certificate with any
+                                              lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                              seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                              `kubernetes.io` signers will never issue certificates with a lifetime
+                                              longer than 24 hours.
+                                            format: int32
+                                            type: integer
+                                          signerName:
+                                            description: Kubelet's generated CSRs
+                                              will be addressed to this signer.
+                                            type: string
+                                          userAnnotations:
+                                            additionalProperties:
+                                              type: string
+                                            description: |-
+                                              userAnnotations allow pod authors to pass additional information to
+                                              the signer implementation.  Kubernetes does not restrict or validate this
+                                              metadata in any way.
+
+                                              These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of
+                                              the PodCertificateRequest objects that Kubelet creates.
+
+                                              Entries are subject to the same validation as object metadata annotations,
+                                              with the addition that all keys must be domain-prefixed. No restrictions
+                                              are placed on values, except an overall size limitation on the entire field.
+
+                                              Signers should document the keys and values they support. Signers should
+                                              deny requests that contain keys they do not recognize.
+                                            type: object
+                                        required:
+                                        - keyType
+                                        - signerName
+                                        type: object
                                       secret:
                                         description: secret information about the
                                           secret data to project
@@ -15768,7 +17486,6 @@ spec:
                               description: |-
                                 rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                 Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                                More info: https://examples.k8s.io/volumes/rbd/README.md
                               properties:
                                 fsType:
                                   description: |-
@@ -16056,6 +17773,42 @@ spec:
                         x-kubernetes-list-map-keys:
                         - name
                         x-kubernetes-list-type: map
+                      workloadRef:
+                        description: |-
+                          WorkloadRef provides a reference to the Workload object that this Pod belongs to.
+                          This field is used by the scheduler to identify the PodGroup and apply the
+                          correct group scheduling policies. The Workload object referenced
+                          by this field may not exist at the time the Pod is created.
+                          This field is immutable, but a Workload object with the same name
+                          may be recreated with different policies. Doing this during pod scheduling
+                          may result in the placement not conforming to the expected policies.
+                        properties:
+                          name:
+                            description: |-
+                              Name defines the name of the Workload object this Pod belongs to.
+                              Workload must be in the same namespace as the Pod.
+                              If it doesn't match any existing Workload, the Pod will remain unschedulable
+                              until a Workload object is created and observed by the kube-scheduler.
+                              It must be a DNS subdomain.
+                            type: string
+                          podGroup:
+                            description: |-
+                              PodGroup is the name of the PodGroup within the Workload that this Pod
+                              belongs to. If it doesn't match any existing PodGroup within the Workload,
+                              the Pod will remain unschedulable until the Workload object is recreated
+                              and observed by the kube-scheduler. It must be a DNS label.
+                            type: string
+                          podGroupReplicaKey:
+                            description: |-
+                              PodGroupReplicaKey specifies the replica key of the PodGroup to which this
+                              Pod belongs. It is used to distinguish pods belonging to different replicas
+                              of the same pod group. The pod group policy is applied separately to each replica.
+                              When set, it must be a DNS label.
+                            type: string
+                        required:
+                        - name
+                        - podGroup
+                        type: object
                     required:
                     - containers
                     type: object
@@ -16066,6 +17819,7 @@ spec:
                 enum:
                 - rw
                 - ro
+                - r
                 type: string
             required:
             - cluster
@@ -16094,6 +17848,16 @@ spec:
                         description: The ResourceVersion of the secret
                         type: string
                     type: object
+                  clientTLS:
+                    description: The client TLS secret version
+                    properties:
+                      name:
+                        description: The name of the secret
+                        type: string
+                      version:
+                        description: The ResourceVersion of the secret
+                        type: string
+                    type: object
                   pgBouncerSecrets:
                     description: The version of the secrets used by PgBouncer
                     properties:
@@ -16146,7 +17910,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.20.0
     helm.sh/resource-policy: keep
   name: publications.postgresql.cnpg.io
 spec:
@@ -16342,7 +18106,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.20.0
     helm.sh/resource-policy: keep
   name: scheduledbackups.postgresql.cnpg.io
 spec:
@@ -16534,7 +18298,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.20.0
     helm.sh/resource-policy: keep
   name: subscriptions.postgresql.cnpg.io
 spec:
@@ -16625,8 +18389,11 @@ spec:
                 additionalProperties:
                   type: string
                 description: |-
-                  Subscription parameters part of the `WITH` clause as expected by
-                  PostgreSQL `CREATE SUBSCRIPTION` command
+                  Subscription parameters included in the `WITH` clause of the PostgreSQL
+                  `CREATE SUBSCRIPTION` command. Most parameters cannot be changed
+                  after the subscription is created and will be ignored if modified
+                  later, except for a limited set documented at:
+                  https://www.postgresql.org/docs/current/sql-altersubscription.html#SQL-ALTERSUBSCRIPTION-PARAMS-SET
                 type: object
               publicationDBName:
                 description: |-
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/deployment.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/templates/deployment.yaml
index 7e0bce72..c17e6a74 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/deployment.yaml
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/deployment.yaml
@@ -1,5 +1,6 @@
 #
-# Copyright The CloudNativePG Contributors
+# Copyright © contributors to CloudNativePG, established as
+# CloudNativePG a Series of LF Projects, LLC.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,6 +14,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+# SPDX-License-Identifier: Apache-2.0
+#
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -30,6 +33,10 @@ spec:
   selector:
     matchLabels:
       {{- include "cloudnative-pg.selectorLabels" . | nindent 6 }}
+  {{- if .Values.updateStrategy }}
+  strategy:
+    {{- toYaml .Values.updateStrategy | nindent 4 }}
+  {{- end }}
   template:
     metadata:
       annotations:
@@ -84,7 +91,7 @@ spec:
           value: "{{ .Values.monitoringQueriesConfigMap.name }}"
         {{- if not .Values.config.clusterWide }}
         - name: WATCH_NAMESPACE
-          value: "{{ .Release.Namespace }}"
+          value: "{{ include "cloudnative-pg.namespace" . }}"
         {{- end }}
         {{- if .Values.additionalEnv }}
         {{- tpl (.Values.additionalEnv | toYaml) . | nindent 8 }}
@@ -94,7 +101,7 @@ spec:
         livenessProbe:
           httpGet:
             path: /readyz
-            port: {{ .Values.webhook.port }}
+            port: webhook-server
             scheme: HTTPS
           {{- if .Values.webhook.livenessProbe.initialDelaySeconds }}
           initialDelaySeconds: {{ .Values.webhook.livenessProbe.initialDelaySeconds }}
@@ -110,7 +117,7 @@ spec:
         readinessProbe:
           httpGet:
             path: /readyz
-            port: {{ .Values.webhook.port }}
+            port: webhook-server
             scheme: HTTPS
           {{- if .Values.webhook.readinessProbe.initialDelaySeconds }}
           initialDelaySeconds: {{ .Values.webhook.readinessProbe.initialDelaySeconds }}
@@ -119,6 +126,17 @@ spec:
           {{- toYaml .Values.resources | nindent 10 }}
         securityContext:
           {{- toYaml .Values.containerSecurityContext | nindent 10 }}
+        startupProbe:
+          {{- if .Values.webhook.startupProbe.failureThreshold }}
+          failureThreshold: {{ .Values.webhook.startupProbe.failureThreshold }}
+          {{- end }}
+          httpGet:
+            path: /readyz
+            port: webhook-server
+            scheme: HTTPS
+          {{- if .Values.webhook.startupProbe.periodSeconds }}
+          periodSeconds: {{ .Values.webhook.startupProbe.periodSeconds }}
+          {{- end }}
         volumeMounts:
         - mountPath: /controller
           name: scratch-data
@@ -135,6 +153,10 @@ spec:
       nodeSelector:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- with .Values.affinity }}
       affinity:
         {{- toYaml . | nindent 8 }}
@@ -151,5 +173,3 @@ spec:
           defaultMode: 420
           optional: true
           secretName: cnpg-webhook-cert
-
-
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/monitoring-configmap.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/templates/monitoring-configmap.yaml
index aa5937d5..d47bc744 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/monitoring-configmap.yaml
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/monitoring-configmap.yaml
@@ -1,5 +1,6 @@
 #
-# Copyright The CloudNativePG Contributors
+# Copyright © contributors to CloudNativePG, established as
+# CloudNativePG a Series of LF Projects, LLC.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,6 +14,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+# SPDX-License-Identifier: Apache-2.0
+#
 ---
 apiVersion: v1
 kind: ConfigMap
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/mutatingwebhookconfiguration.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/templates/mutatingwebhookconfiguration.yaml
index 200695b1..c58628a6 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/mutatingwebhookconfiguration.yaml
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/mutatingwebhookconfiguration.yaml
@@ -1,5 +1,6 @@
 #
-# Copyright The CloudNativePG Contributors
+# Copyright © contributors to CloudNativePG, established as
+# CloudNativePG a Series of LF Projects, LLC.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,6 +14,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+# SPDX-License-Identifier: Apache-2.0
+#
 {{- if .Values.webhook.mutating.create }}
 ---
 apiVersion: admissionregistration.k8s.io/v1
@@ -31,7 +34,7 @@ webhooks:
   clientConfig:
     service:
       name: {{ .Values.service.name }}
-      namespace: {{ .Release.Namespace }}
+      namespace: {{ include "cloudnative-pg.namespace" . }}
       path: /mutate-postgresql-cnpg-io-v1-backup
       port: {{ .Values.service.port }}
   failurePolicy: {{ .Values.webhook.mutating.failurePolicy }}
@@ -52,7 +55,7 @@ webhooks:
   clientConfig:
     service:
       name: {{ .Values.service.name }}
-      namespace: {{ .Release.Namespace }}
+      namespace: {{ include "cloudnative-pg.namespace" . }}
       path: /mutate-postgresql-cnpg-io-v1-cluster
       port: {{ .Values.service.port }}
   failurePolicy: {{ .Values.webhook.mutating.failurePolicy }}
@@ -73,7 +76,28 @@ webhooks:
   clientConfig:
     service:
       name: {{ .Values.service.name }}
-      namespace: {{ .Release.Namespace }}
+      namespace: {{ include "cloudnative-pg.namespace" . }}
+      path: /mutate-postgresql-cnpg-io-v1-database
+      port: {{ .Values.service.port }}
+  failurePolicy: {{ .Values.webhook.mutating.failurePolicy }}
+  name: mdatabase.cnpg.io
+  rules:
+  - apiGroups:
+    - postgresql.cnpg.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - databases
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: {{ .Values.service.name }}
+      namespace: {{ include "cloudnative-pg.namespace" . }}
       path: /mutate-postgresql-cnpg-io-v1-scheduledbackup
       port: {{ .Values.service.port }}
   failurePolicy: {{ .Values.webhook.mutating.failurePolicy }}
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/podmonitor.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/templates/podmonitor.yaml
index 8984c00f..0d22102b 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/podmonitor.yaml
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/podmonitor.yaml
@@ -1,5 +1,6 @@
 #
-# Copyright The CloudNativePG Contributors
+# Copyright © contributors to CloudNativePG, established as
+# CloudNativePG a Series of LF Projects, LLC.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,6 +14,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+# SPDX-License-Identifier: Apache-2.0
+#
 {{- if .Values.monitoring.podMonitorEnabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: PodMonitor
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/rbac.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/templates/rbac.yaml
index cf213f35..0dc17080 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/rbac.yaml
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/rbac.yaml
@@ -1,5 +1,6 @@
 #
-# Copyright The CloudNativePG Contributors
+# Copyright © contributors to CloudNativePG, established as
+# CloudNativePG a Series of LF Projects, LLC.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,6 +14,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+# SPDX-License-Identifier: Apache-2.0
+#
 {{- if .Values.serviceAccount.create }}
 ---
 apiVersion: v1
@@ -67,7 +70,7 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: {{ include "cloudnative-pg.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "cloudnative-pg.namespace" . }}
 {{/*
 If we're doing a single-namespace installation
 we create a Role with the common rules for the operator,
@@ -108,7 +111,7 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: {{ include "cloudnative-pg.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "cloudnative-pg.namespace" . }}
 {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -128,10 +131,14 @@ rules:
   resources:
   - backups
   - clusters
+  - clusters/status
   - databases
+  - failoverquorums
   - poolers
   - publications
   - scheduledbackups
+  - imagecatalogs
+  - clusterimagecatalogs
   - subscriptions
   verbs:
   - get
@@ -154,10 +161,14 @@ rules:
   resources:
   - backups
   - clusters
+  - clusters/status
   - databases
+  - failoverquorums
   - poolers
   - publications
   - scheduledbackups
+  - imagecatalogs
+  - clusterimagecatalogs
   - subscriptions
   verbs:
   - create
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/service.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/templates/service.yaml
index 13be46ae..8afa02fc 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/service.yaml
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/service.yaml
@@ -1,5 +1,6 @@
 #
-# Copyright The CloudNativePG Contributors
+# Copyright © contributors to CloudNativePG, established as
+# CloudNativePG a Series of LF Projects, LLC.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,6 +14,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+# SPDX-License-Identifier: Apache-2.0
+#
 ---
 apiVersion: v1
 kind: Service
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/validatingwebhookconfiguration.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/templates/validatingwebhookconfiguration.yaml
index be9fff18..c171c911 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/validatingwebhookconfiguration.yaml
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/validatingwebhookconfiguration.yaml
@@ -1,5 +1,6 @@
 #
-# Copyright The CloudNativePG Contributors
+# Copyright © contributors to CloudNativePG, established as
+# CloudNativePG a Series of LF Projects, LLC.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,6 +14,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+# SPDX-License-Identifier: Apache-2.0
+#
 {{- if .Values.webhook.validating.create }}
 ---
 apiVersion: admissionregistration.k8s.io/v1
@@ -31,7 +34,7 @@ webhooks:
   clientConfig:
     service:
       name: {{ .Values.service.name }}
-      namespace: {{ .Release.Namespace }}
+      namespace: {{ include "cloudnative-pg.namespace" . }}
       path: /validate-postgresql-cnpg-io-v1-backup
       port: {{ .Values.service.port }}
   failurePolicy: {{ .Values.webhook.validating.failurePolicy }}
@@ -52,7 +55,7 @@ webhooks:
   clientConfig:
     service:
       name: {{ .Values.service.name }}
-      namespace: {{ .Release.Namespace }}
+      namespace: {{ include "cloudnative-pg.namespace" . }}
       path: /validate-postgresql-cnpg-io-v1-cluster
       port: {{ .Values.service.port }}
   failurePolicy: {{ .Values.webhook.validating.failurePolicy }}
@@ -73,7 +76,7 @@ webhooks:
   clientConfig:
     service:
       name: {{ .Values.service.name }}
-      namespace: {{ .Release.Namespace }}
+      namespace: {{ include "cloudnative-pg.namespace" . }}
       path: /validate-postgresql-cnpg-io-v1-scheduledbackup
       port: {{ .Values.service.port }}
   failurePolicy: {{ .Values.webhook.validating.failurePolicy }}
@@ -89,12 +92,33 @@ webhooks:
     resources:
     - scheduledbackups
   sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: {{ .Values.service.name }}
+      namespace: {{ include "cloudnative-pg.namespace" . }}
+      path: /validate-postgresql-cnpg-io-v1-database
+      port: {{ .Values.service.port }}
+  failurePolicy: {{ .Values.webhook.validating.failurePolicy }}
+  name: vdatabase.cnpg.io
+  rules:
+  - apiGroups:
+    - postgresql.cnpg.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - databases
+  sideEffects: None
 - admissionReviewVersions:
     - v1
   clientConfig:
     service:
       name: {{ .Values.service.name }}
-      namespace: {{ .Release.Namespace }}
+      namespace: {{ include "cloudnative-pg.namespace" . }}
       path: /validate-postgresql-cnpg-io-v1-pooler
       port: {{ .Values.service.port }}
   failurePolicy: {{ .Values.webhook.validating.failurePolicy }}
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/values.schema.json b/packages/system/postgres-operator/charts/cloudnative-pg/values.schema.json
index 4ba70818..4c69aae6 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/values.schema.json
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/values.schema.json
@@ -246,6 +246,12 @@
         "tolerations": {
             "type": "array"
         },
+        "topologySpreadConstraints": {
+            "type": "array"
+        },
+        "updateStrategy": {
+            "type": "object"
+        },
         "webhook": {
             "type": "object",
             "properties": {
@@ -279,6 +285,17 @@
                         }
                     }
                 },
+                "startupProbe": {
+                    "type": "object",
+                    "properties": {
+                        "failureThreshold": {
+                            "type": "integer"
+                        },
+                        "periodSeconds": {
+                            "type": "integer"
+                        }
+                    }
+                },
                 "validating": {
                     "type": "object",
                     "properties": {
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/values.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/values.yaml
index cdfb4cf8..f437a5ee 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/values.yaml
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/values.yaml
@@ -1,5 +1,6 @@
 #
-# Copyright The CloudNativePG Contributors
+# Copyright © contributors to CloudNativePG, established as
+# CloudNativePG a Series of LF Projects, LLC.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,6 +14,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+# SPDX-License-Identifier: Apache-2.0
+#
 # Default values for CloudNativePG.
 # This is a YAML-formatted file.
 # Please declare variables to be passed to your templates.
@@ -23,7 +26,8 @@ image:
   repository: ghcr.io/cloudnative-pg/cloudnative-pg
   pullPolicy: IfNotPresent
   # -- Overrides the image tag whose default is the chart appVersion.
-  tag: ""
+  # tag: ""
+  tag: "1.27.3"
 
 imagePullSecrets: []
 nameOverride: ""
@@ -33,6 +37,15 @@ namespaceOverride: ""
 hostNetwork: false
 dnsPolicy: ""
 
+# -- Update strategy for the operator.
+# ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
+# For example:
+#  type: RollingUpdate
+#  rollingUpdate:
+#    maxSurge: 25%
+#    maxUnavailable: 25%
+updateStrategy: {}
+
 crds:
   # -- Specifies whether the CRDs should be created when installing the chart.
   create: true
@@ -50,6 +63,9 @@ webhook:
     initialDelaySeconds: 3
   readinessProbe:
     initialDelaySeconds: 3
+  startupProbe:
+    failureThreshold: 6
+    periodSeconds: 5
 
 # Operator configuration.
 config:
@@ -73,7 +89,7 @@ config:
   # -- The maximum number of concurrent reconciles. Defaults to 10.
   maxConcurrentReconciles: 10
 
-# -- Additinal arguments to be added to the operator's args list.
+# -- Additional arguments to be added to the operator's args list.
 additionalArgs: []
 
 # -- Array containing extra environment variables which can be templated.
@@ -152,6 +168,9 @@ resources: {}
 # -- Nodeselector for the operator to be installed.
 nodeSelector: {}
 
+# -- Topology Spread Constraints for the operator to be installed.
+topologySpreadConstraints: []
+
 # -- Tolerations for the operator to be installed.
 tolerations: []
 
@@ -192,30 +211,30 @@ monitoringQueriesConfigMap:
   queries: |
     backends:
       query: |
-       SELECT sa.datname
-           , sa.usename
-           , sa.application_name
-           , states.state
-           , COALESCE(sa.count, 0) AS total
-           , COALESCE(sa.max_tx_secs, 0) AS max_tx_duration_seconds
-           FROM ( VALUES ('active')
-               , ('idle')
-               , ('idle in transaction')
-               , ('idle in transaction (aborted)')
-               , ('fastpath function call')
-               , ('disabled')
-               ) AS states(state)
-           LEFT JOIN (
-               SELECT datname
-                   , state
-                   , usename
-                   , COALESCE(application_name, '') AS application_name
-                   , COUNT(*)
-                   , COALESCE(EXTRACT (EPOCH FROM (max(now() - xact_start))), 0) AS max_tx_secs
-               FROM pg_catalog.pg_stat_activity
-               GROUP BY datname, state, usename, application_name
-           ) sa ON states.state = sa.state
-           WHERE sa.usename IS NOT NULL
+        SELECT sa.datname
+          , sa.usename
+          , sa.application_name
+          , states.state
+          , COALESCE(sa.count, 0) AS total
+          , COALESCE(sa.max_tx_secs, 0) AS max_tx_duration_seconds
+        FROM ( VALUES ('active')
+          , ('idle')
+          , ('idle in transaction')
+          , ('idle in transaction (aborted)')
+          , ('fastpath function call')
+          , ('disabled')
+          ) AS states(state)
+        LEFT JOIN (
+          SELECT datname
+            , state
+            , usename
+            , COALESCE(application_name, '') AS application_name
+            , COUNT(*)
+            , COALESCE(EXTRACT (EPOCH FROM (max(now() - xact_start))), 0) AS max_tx_secs
+          FROM pg_catalog.pg_stat_activity
+          GROUP BY datname, state, usename, application_name
+        ) sa ON states.state = sa.state
+        WHERE sa.usename IS NOT NULL
       metrics:
         - datname:
             usage: "LABEL"
@@ -238,22 +257,22 @@ monitoringQueriesConfigMap:
 
     backends_waiting:
       query: |
-       SELECT count(*) AS total
-       FROM pg_catalog.pg_locks blocked_locks
-       JOIN pg_catalog.pg_locks blocking_locks
-         ON blocking_locks.locktype = blocked_locks.locktype
-         AND blocking_locks.database IS NOT DISTINCT FROM blocked_locks.database
-         AND blocking_locks.relation IS NOT DISTINCT FROM blocked_locks.relation
-         AND blocking_locks.page IS NOT DISTINCT FROM blocked_locks.page
-         AND blocking_locks.tuple IS NOT DISTINCT FROM blocked_locks.tuple
-         AND blocking_locks.virtualxid IS NOT DISTINCT FROM blocked_locks.virtualxid
-         AND blocking_locks.transactionid IS NOT DISTINCT FROM blocked_locks.transactionid
-         AND blocking_locks.classid IS NOT DISTINCT FROM blocked_locks.classid
-         AND blocking_locks.objid IS NOT DISTINCT FROM blocked_locks.objid
-         AND blocking_locks.objsubid IS NOT DISTINCT FROM blocked_locks.objsubid
-         AND blocking_locks.pid != blocked_locks.pid
-       JOIN pg_catalog.pg_stat_activity blocking_activity ON blocking_activity.pid = blocking_locks.pid
-       WHERE NOT blocked_locks.granted
+        SELECT count(*) AS total
+        FROM pg_catalog.pg_locks blocked_locks
+        JOIN pg_catalog.pg_locks blocking_locks
+          ON blocking_locks.locktype = blocked_locks.locktype
+          AND blocking_locks.database IS NOT DISTINCT FROM blocked_locks.database
+          AND blocking_locks.relation IS NOT DISTINCT FROM blocked_locks.relation
+          AND blocking_locks.page IS NOT DISTINCT FROM blocked_locks.page
+          AND blocking_locks.tuple IS NOT DISTINCT FROM blocked_locks.tuple
+          AND blocking_locks.virtualxid IS NOT DISTINCT FROM blocked_locks.virtualxid
+          AND blocking_locks.transactionid IS NOT DISTINCT FROM blocked_locks.transactionid
+          AND blocking_locks.classid IS NOT DISTINCT FROM blocked_locks.classid
+          AND blocking_locks.objid IS NOT DISTINCT FROM blocked_locks.objid
+          AND blocking_locks.objsubid IS NOT DISTINCT FROM blocked_locks.objsubid
+          AND blocking_locks.pid != blocked_locks.pid
+        JOIN pg_catalog.pg_stat_activity blocking_activity ON blocking_activity.pid = blocking_locks.pid
+        WHERE NOT blocked_locks.granted
       metrics:
         - total:
             usage: "GAUGE"
@@ -291,16 +310,17 @@ monitoringQueriesConfigMap:
             description: "Time at which postgres started (based on epoch)"
 
     pg_replication:
-      query: "SELECT CASE WHEN (
-                NOT pg_catalog.pg_is_in_recovery()
-                OR pg_catalog.pg_last_wal_receive_lsn() = pg_catalog.pg_last_wal_replay_lsn())
-              THEN 0
-              ELSE GREATEST (0,
-                EXTRACT(EPOCH FROM (now() - pg_catalog.pg_last_xact_replay_timestamp())))
-              END AS lag,
-              pg_catalog.pg_is_in_recovery() AS in_recovery,
-              EXISTS (TABLE pg_stat_wal_receiver) AS is_wal_receiver_up,
-              (SELECT count(*) FROM pg_catalog.pg_stat_replication) AS streaming_replicas"
+      query: |
+        SELECT CASE WHEN (
+            NOT pg_catalog.pg_is_in_recovery()
+            OR pg_catalog.pg_last_wal_receive_lsn() = pg_catalog.pg_last_wal_replay_lsn())
+          THEN 0
+          ELSE GREATEST (0,
+            EXTRACT(EPOCH FROM (now() - pg_catalog.pg_last_xact_replay_timestamp())))
+          END AS lag,
+          pg_catalog.pg_is_in_recovery() AS in_recovery,
+          EXISTS (TABLE pg_stat_wal_receiver) AS is_wal_receiver_up,
+          (SELECT count(*) FROM pg_catalog.pg_stat_replication) AS streaming_replicas
       metrics:
         - lag:
             usage: "GAUGE"
@@ -356,6 +376,9 @@ monitoringQueriesConfigMap:
           , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_failed_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_failed_wal_start_lsn
           , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time
         FROM pg_catalog.pg_stat_archiver
+      predicate_query: |
+        SELECT NOT pg_catalog.pg_is_in_recovery()
+          OR pg_catalog.current_setting('archive_mode') = 'always'
       metrics:
         - archived_count:
             usage: "COUNTER"
@@ -568,20 +591,20 @@ monitoringQueriesConfigMap:
     pg_stat_replication:
       primary: true
       query: |
-       SELECT usename
-         , COALESCE(application_name, '') AS application_name
-         , COALESCE(client_addr::text, '') AS client_addr
-         , COALESCE(client_port::text, '') AS client_port
-         , EXTRACT(EPOCH FROM backend_start) AS backend_start
-         , COALESCE(pg_catalog.age(backend_xmin), 0) AS backend_xmin_age
-         , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), sent_lsn) AS sent_diff_bytes
-         , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), write_lsn) AS write_diff_bytes
-         , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), flush_lsn) AS flush_diff_bytes
-         , COALESCE(pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), replay_lsn),0) AS replay_diff_bytes
-         , COALESCE((EXTRACT(EPOCH FROM write_lag)),0)::float AS write_lag_seconds
-         , COALESCE((EXTRACT(EPOCH FROM flush_lag)),0)::float AS flush_lag_seconds
-         , COALESCE((EXTRACT(EPOCH FROM replay_lag)),0)::float AS replay_lag_seconds
-       FROM pg_catalog.pg_stat_replication
+        SELECT usename
+          , COALESCE(application_name, '') AS application_name
+          , COALESCE(client_addr::text, '') AS client_addr
+          , COALESCE(client_port::text, '') AS client_port
+          , EXTRACT(EPOCH FROM backend_start) AS backend_start
+          , COALESCE(pg_catalog.age(backend_xmin), 0) AS backend_xmin_age
+          , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), sent_lsn) AS sent_diff_bytes
+          , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), write_lsn) AS write_diff_bytes
+          , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), flush_lsn) AS flush_diff_bytes
+          , COALESCE(pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), replay_lsn),0) AS replay_diff_bytes
+          , COALESCE((EXTRACT(EPOCH FROM write_lag)),0)::float AS write_lag_seconds
+          , COALESCE((EXTRACT(EPOCH FROM flush_lag)),0)::float AS flush_lag_seconds
+          , COALESCE((EXTRACT(EPOCH FROM replay_lag)),0)::float AS replay_lag_seconds
+        FROM pg_catalog.pg_stat_replication
       metrics:
         - usename:
             usage: "LABEL"
@@ -637,3 +660,35 @@ monitoringQueriesConfigMap:
         - setting:
             usage: "GAUGE"
             description: "Setting value"
+
+    pg_extensions:
+      query: |
+        SELECT
+          current_database() as datname,
+          name as extname,
+          default_version,
+          installed_version,
+          CASE
+            WHEN default_version = installed_version THEN 0
+            ELSE 1
+        END AS update_available
+        FROM pg_catalog.pg_available_extensions
+        WHERE installed_version IS NOT NULL
+      metrics:
+        - datname:
+            usage: "LABEL"
+            description: "Name of the database"
+        - extname:
+            usage: "LABEL"
+            description: "Extension name"
+        - default_version:
+            usage: "LABEL"
+            description: "Default version"
+        - installed_version:
+            usage: "LABEL"
+            description: "Installed version"
+        - update_available:
+            usage: "GAUGE"
+            description: "An update is available"
+      target_databases:
+        - '*'

From 845192b93379c3a64e390693fd6f800efc914899 Mon Sep 17 00:00:00 2001
From: Dmitrii Popov <dmpopof@gmail.com>
Date: Tue, 17 Mar 2026 01:59:28 +0300
Subject: [PATCH 275/666] [postgres-operator] Update to v1.27.3

Signed-off-by: Dmitrii Popov <dmpopof@gmail.com>
---
 packages/system/postgres-operator/Makefile    |   2 +-
 .../charts/cloudnative-pg/Chart.lock          |   6 +-
 .../charts/cloudnative-pg/Chart.yaml          |   4 +-
 .../charts/cloudnative-pg/README.md           |   5 +-
 .../cloudnative-pg/templates/crds/crds.yaml   | 953 +-----------------
 .../cloudnative-pg/templates/deployment.yaml  |   6 +-
 .../charts/cloudnative-pg/values.yaml         | 149 ++-
 packages/system/postgres-operator/values.yaml |   2 +
 8 files changed, 129 insertions(+), 998 deletions(-)

diff --git a/packages/system/postgres-operator/Makefile b/packages/system/postgres-operator/Makefile
index f58f235f..f6d7ddaa 100644
--- a/packages/system/postgres-operator/Makefile
+++ b/packages/system/postgres-operator/Makefile
@@ -7,5 +7,5 @@ update:
 	rm -rf charts
 	helm repo add cnpg https://cloudnative-pg.github.io/charts
 	helm repo update cnpg
-	helm pull cnpg/cloudnative-pg --untar --untardir charts
+	helm pull cnpg/cloudnative-pg --untar --untardir charts --version 0.26.1
 	rm -rf charts/cloudnative-pg/charts
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/Chart.lock b/packages/system/postgres-operator/charts/cloudnative-pg/Chart.lock
index ca3548df..610070fb 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/Chart.lock
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: cluster
   repository: https://cloudnative-pg.github.io/grafana-dashboards
-  version: 0.0.5
-digest: sha256:92acaa7742cad61339d69da604eda609e3d5e02f05efa224f5a58f2b845cd2b4
-generated: "2026-01-19T21:05:18.955160552+02:00"
+  version: 0.0.2
+digest: sha256:fcf16ad357c17be3dd79c138723e78e9e101fecc5d07d9371299c32b9f85dbd9
+generated: "2024-04-25T12:32:36.61779032-04:00"
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/Chart.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/Chart.yaml
index 8ea6169e..31e6afd0 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/Chart.yaml
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 1.28.1
+appVersion: 1.27.1
 dependencies:
 - alias: monitoring
   condition: monitoring.grafanaDashboard.create
@@ -22,4 +22,4 @@ name: cloudnative-pg
 sources:
 - https://github.com/cloudnative-pg/charts
 type: application
-version: 0.27.1
+version: 0.26.1
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/README.md b/packages/system/postgres-operator/charts/cloudnative-pg/README.md
index 656bb573..10a69657 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/README.md
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/README.md
@@ -1,6 +1,6 @@
 # cloudnative-pg
 
-![Version: 0.27.1](https://img.shields.io/badge/Version-0.27.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.28.1](https://img.shields.io/badge/AppVersion-1.28.1-informational?style=flat-square)
+![Version: 0.26.1](https://img.shields.io/badge/Version-0.26.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.27.1](https://img.shields.io/badge/AppVersion-1.27.1-informational?style=flat-square)
 
 CloudNativePG Operator Helm Chart
 
@@ -57,7 +57,7 @@ CloudNativePG Operator Helm Chart
 | monitoring.podMonitorMetricRelabelings | list | `[]` | Metrics relabel configurations to apply to samples before ingestion. |
 | monitoring.podMonitorRelabelings | list | `[]` | Relabel configurations to apply to samples before scraping. |
 | monitoringQueriesConfigMap.name | string | `"cnpg-default-monitoring"` | The name of the default monitoring configmap. |
-| monitoringQueriesConfigMap.queries | string | `"backends:\n  query: |\n    SELECT sa.datname\n      , sa.usename\n      , sa.application_name\n      , states.state\n      , COALESCE(sa.count, 0) AS total\n      , COALESCE(sa.max_tx_secs, 0) AS max_tx_duration_seconds\n    FROM ( VALUES ('active')\n      , ('idle')\n      , ('idle in transaction')\n      , ('idle in transaction (aborted)')\n      , ('fastpath function call')\n      , ('disabled')\n      ) AS states(state)\n    LEFT JOIN (\n      SELECT datname\n        , state\n        , usename\n        , COALESCE(application_name, '') AS application_name\n        , COUNT(*)\n        , COALESCE(EXTRACT (EPOCH FROM (max(now() - xact_start))), 0) AS max_tx_secs\n      FROM pg_catalog.pg_stat_activity\n      GROUP BY datname, state, usename, application_name\n    ) sa ON states.state = sa.state\n    WHERE sa.usename IS NOT NULL\n  metrics:\n    - datname:\n        usage: \"LABEL\"\n        description: \"Name of the database\"\n    - usename:\n        usage: \"LABEL\"\n        description: \"Name of the user\"\n    - application_name:\n        usage: \"LABEL\"\n        description: \"Name of the application\"\n    - state:\n        usage: \"LABEL\"\n        description: \"State of the backend\"\n    - total:\n        usage: \"GAUGE\"\n        description: \"Number of backends\"\n    - max_tx_duration_seconds:\n        usage: \"GAUGE\"\n        description: \"Maximum duration of a transaction in seconds\"\n\nbackends_waiting:\n  query: |\n    SELECT count(*) AS total\n    FROM pg_catalog.pg_locks blocked_locks\n    JOIN pg_catalog.pg_locks blocking_locks\n      ON blocking_locks.locktype = blocked_locks.locktype\n      AND blocking_locks.database IS NOT DISTINCT FROM blocked_locks.database\n      AND blocking_locks.relation IS NOT DISTINCT FROM blocked_locks.relation\n      AND blocking_locks.page IS NOT DISTINCT FROM blocked_locks.page\n      AND blocking_locks.tuple IS NOT DISTINCT FROM blocked_locks.tuple\n      AND blocking_locks.virtualxid IS NOT DISTINCT FROM blocked_locks.virtualxid\n      AND blocking_locks.transactionid IS NOT DISTINCT FROM blocked_locks.transactionid\n      AND blocking_locks.classid IS NOT DISTINCT FROM blocked_locks.classid\n      AND blocking_locks.objid IS NOT DISTINCT FROM blocked_locks.objid\n      AND blocking_locks.objsubid IS NOT DISTINCT FROM blocked_locks.objsubid\n      AND blocking_locks.pid != blocked_locks.pid\n    JOIN pg_catalog.pg_stat_activity blocking_activity ON blocking_activity.pid = blocking_locks.pid\n    WHERE NOT blocked_locks.granted\n  metrics:\n    - total:\n        usage: \"GAUGE\"\n        description: \"Total number of backends that are currently waiting on other queries\"\n\npg_database:\n  query: |\n    SELECT datname\n      , pg_catalog.pg_database_size(datname) AS size_bytes\n      , pg_catalog.age(datfrozenxid) AS xid_age\n      , pg_catalog.mxid_age(datminmxid) AS mxid_age\n    FROM pg_catalog.pg_database\n    WHERE datallowconn\n  metrics:\n    - datname:\n        usage: \"LABEL\"\n        description: \"Name of the database\"\n    - size_bytes:\n        usage: \"GAUGE\"\n        description: \"Disk space used by the database\"\n    - xid_age:\n        usage: \"GAUGE\"\n        description: \"Number of transactions from the frozen XID to the current one\"\n    - mxid_age:\n        usage: \"GAUGE\"\n        description: \"Number of multiple transactions (Multixact) from the frozen XID to the current one\"\n\npg_postmaster:\n  query: |\n    SELECT EXTRACT(EPOCH FROM pg_postmaster_start_time) AS start_time\n    FROM pg_catalog.pg_postmaster_start_time()\n  metrics:\n    - start_time:\n        usage: \"GAUGE\"\n        description: \"Time at which postgres started (based on epoch)\"\n\npg_replication:\n  query: |\n    SELECT CASE WHEN (\n        NOT pg_catalog.pg_is_in_recovery()\n        OR pg_catalog.pg_last_wal_receive_lsn() = pg_catalog.pg_last_wal_replay_lsn())\n      THEN 0\n      ELSE GREATEST (0,\n        EXTRACT(EPOCH FROM (now() - pg_catalog.pg_last_xact_replay_timestamp())))\n      END AS lag,\n      pg_catalog.pg_is_in_recovery() AS in_recovery,\n      EXISTS (TABLE pg_stat_wal_receiver) AS is_wal_receiver_up,\n      (SELECT count(*) FROM pg_catalog.pg_stat_replication) AS streaming_replicas\n  metrics:\n    - lag:\n        usage: \"GAUGE\"\n        description: \"Replication lag behind primary in seconds\"\n    - in_recovery:\n        usage: \"GAUGE\"\n        description: \"Whether the instance is in recovery\"\n    - is_wal_receiver_up:\n        usage: \"GAUGE\"\n        description: \"Whether the instance wal_receiver is up\"\n    - streaming_replicas:\n        usage: \"GAUGE\"\n        description: \"Number of streaming replicas connected to the instance\"\n\npg_replication_slots:\n  query: |\n    SELECT slot_name,\n      slot_type,\n      database,\n      active,\n      (CASE pg_catalog.pg_is_in_recovery()\n        WHEN TRUE THEN pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_last_wal_receive_lsn(), restart_lsn)\n        ELSE pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), restart_lsn)\n      END) as pg_wal_lsn_diff\n    FROM pg_catalog.pg_replication_slots\n    WHERE NOT temporary\n  metrics:\n    - slot_name:\n        usage: \"LABEL\"\n        description: \"Name of the replication slot\"\n    - slot_type:\n        usage: \"LABEL\"\n        description: \"Type of the replication slot\"\n    - database:\n        usage: \"LABEL\"\n        description: \"Name of the database\"\n    - active:\n        usage: \"GAUGE\"\n        description: \"Flag indicating whether the slot is active\"\n    - pg_wal_lsn_diff:\n        usage: \"GAUGE\"\n        description: \"Replication lag in bytes\"\n\npg_stat_archiver:\n  query: |\n    SELECT archived_count\n      , failed_count\n      , COALESCE(EXTRACT(EPOCH FROM (now() - last_archived_time)), -1) AS seconds_since_last_archival\n      , COALESCE(EXTRACT(EPOCH FROM (now() - last_failed_time)), -1) AS seconds_since_last_failure\n      , COALESCE(EXTRACT(EPOCH FROM last_archived_time), -1) AS last_archived_time\n      , COALESCE(EXTRACT(EPOCH FROM last_failed_time), -1) AS last_failed_time\n      , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_archived_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_archived_wal_start_lsn\n      , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_failed_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_failed_wal_start_lsn\n      , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n    FROM pg_catalog.pg_stat_archiver\n  predicate_query: |\n    SELECT NOT pg_catalog.pg_is_in_recovery()\n      OR pg_catalog.current_setting('archive_mode') = 'always'\n  metrics:\n    - archived_count:\n        usage: \"COUNTER\"\n        description: \"Number of WAL files that have been successfully archived\"\n    - failed_count:\n        usage: \"COUNTER\"\n        description: \"Number of failed attempts for archiving WAL files\"\n    - seconds_since_last_archival:\n        usage: \"GAUGE\"\n        description: \"Seconds since the last successful archival operation\"\n    - seconds_since_last_failure:\n        usage: \"GAUGE\"\n        description: \"Seconds since the last failed archival operation\"\n    - last_archived_time:\n        usage: \"GAUGE\"\n        description: \"Epoch of the last time WAL archiving succeeded\"\n    - last_failed_time:\n        usage: \"GAUGE\"\n        description: \"Epoch of the last time WAL archiving failed\"\n    - last_archived_wal_start_lsn:\n        usage: \"GAUGE\"\n        description: \"Archived WAL start LSN\"\n    - last_failed_wal_start_lsn:\n        usage: \"GAUGE\"\n        description: \"Last failed WAL LSN\"\n    - stats_reset_time:\n        usage: \"GAUGE\"\n        description: \"Time at which these statistics were last reset\"\n\npg_stat_bgwriter:\n  runonserver: \"<17.0.0\"\n  query: |\n    SELECT checkpoints_timed\n      , checkpoints_req\n      , checkpoint_write_time\n      , checkpoint_sync_time\n      , buffers_checkpoint\n      , buffers_clean\n      , maxwritten_clean\n      , buffers_backend\n      , buffers_backend_fsync\n      , buffers_alloc\n    FROM pg_catalog.pg_stat_bgwriter\n  metrics:\n    - checkpoints_timed:\n        usage: \"COUNTER\"\n        description: \"Number of scheduled checkpoints that have been performed\"\n    - checkpoints_req:\n        usage: \"COUNTER\"\n        description: \"Number of requested checkpoints that have been performed\"\n    - checkpoint_write_time:\n        usage: \"COUNTER\"\n        description: \"Total amount of time that has been spent in the portion of checkpoint processing where files are written to disk, in milliseconds\"\n    - checkpoint_sync_time:\n        usage: \"COUNTER\"\n        description: \"Total amount of time that has been spent in the portion of checkpoint processing where files are synchronized to disk, in milliseconds\"\n    - buffers_checkpoint:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written during checkpoints\"\n    - buffers_clean:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written by the background writer\"\n    - maxwritten_clean:\n        usage: \"COUNTER\"\n        description: \"Number of times the background writer stopped a cleaning scan because it had written too many buffers\"\n    - buffers_backend:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written directly by a backend\"\n    - buffers_backend_fsync:\n        usage: \"COUNTER\"\n        description: \"Number of times a backend had to execute its own fsync call (normally the background writer handles those even when the backend does its own write)\"\n    - buffers_alloc:\n        usage: \"COUNTER\"\n        description: \"Number of buffers allocated\"\n\npg_stat_bgwriter_17:\n  runonserver: \">=17.0.0\"\n  name: pg_stat_bgwriter\n  query: |\n    SELECT buffers_clean\n      , maxwritten_clean\n      , buffers_alloc\n      , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n    FROM pg_catalog.pg_stat_bgwriter\n  metrics:\n    - buffers_clean:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written by the background writer\"\n    - maxwritten_clean:\n        usage: \"COUNTER\"\n        description: \"Number of times the background writer stopped a cleaning scan because it had written too many buffers\"\n    - buffers_alloc:\n        usage: \"COUNTER\"\n        description: \"Number of buffers allocated\"\n    - stats_reset_time:\n        usage: \"GAUGE\"\n        description: \"Time at which these statistics were last reset\"\n\npg_stat_checkpointer:\n  runonserver: \">=17.0.0\"\n  query: |\n    SELECT num_timed AS checkpoints_timed\n      , num_requested AS checkpoints_req\n      , restartpoints_timed\n      , restartpoints_req\n      , restartpoints_done\n      , write_time\n      , sync_time\n      , buffers_written\n      , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n    FROM pg_catalog.pg_stat_checkpointer\n  metrics:\n    - checkpoints_timed:\n        usage: \"COUNTER\"\n        description: \"Number of scheduled checkpoints that have been performed\"\n    - checkpoints_req:\n        usage: \"COUNTER\"\n        description: \"Number of requested checkpoints that have been performed\"\n    - restartpoints_timed:\n        usage: \"COUNTER\"\n        description: \"Number of scheduled restartpoints due to timeout or after a failed attempt to perform it\"\n    - restartpoints_req:\n        usage: \"COUNTER\"\n        description: \"Number of requested restartpoints that have been performed\"\n    - restartpoints_done:\n        usage: \"COUNTER\"\n        description: \"Number of restartpoints that have been performed\"\n    - write_time:\n        usage: \"COUNTER\"\n        description: \"Total amount of time that has been spent in the portion of processing checkpoints and restartpoints where files are written to disk, in milliseconds\"\n    - sync_time:\n        usage: \"COUNTER\"\n        description: \"Total amount of time that has been spent in the portion of processing checkpoints and restartpoints where files are synchronized to disk, in milliseconds\"\n    - buffers_written:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written during checkpoints and restartpoints\"\n    - stats_reset_time:\n        usage: \"GAUGE\"\n        description: \"Time at which these statistics were last reset\"\n\npg_stat_database:\n  query: |\n    SELECT datname\n      , xact_commit\n      , xact_rollback\n      , blks_read\n      , blks_hit\n      , tup_returned\n      , tup_fetched\n      , tup_inserted\n      , tup_updated\n      , tup_deleted\n      , conflicts\n      , temp_files\n      , temp_bytes\n      , deadlocks\n      , blk_read_time\n      , blk_write_time\n    FROM pg_catalog.pg_stat_database\n  metrics:\n    - datname:\n        usage: \"LABEL\"\n        description: \"Name of this database\"\n    - xact_commit:\n        usage: \"COUNTER\"\n        description: \"Number of transactions in this database that have been committed\"\n    - xact_rollback:\n        usage: \"COUNTER\"\n        description: \"Number of transactions in this database that have been rolled back\"\n    - blks_read:\n        usage: \"COUNTER\"\n        description: \"Number of disk blocks read in this database\"\n    - blks_hit:\n        usage: \"COUNTER\"\n        description: \"Number of times disk blocks were found already in the buffer cache, so that a read was not necessary (this only includes hits in the PostgreSQL buffer cache, not the operating system's file system cache)\"\n    - tup_returned:\n        usage: \"COUNTER\"\n        description: \"Number of rows returned by queries in this database\"\n    - tup_fetched:\n        usage: \"COUNTER\"\n        description: \"Number of rows fetched by queries in this database\"\n    - tup_inserted:\n        usage: \"COUNTER\"\n        description: \"Number of rows inserted by queries in this database\"\n    - tup_updated:\n        usage: \"COUNTER\"\n        description: \"Number of rows updated by queries in this database\"\n    - tup_deleted:\n        usage: \"COUNTER\"\n        description: \"Number of rows deleted by queries in this database\"\n    - conflicts:\n        usage: \"COUNTER\"\n        description: \"Number of queries canceled due to conflicts with recovery in this database\"\n    - temp_files:\n        usage: \"COUNTER\"\n        description: \"Number of temporary files created by queries in this database\"\n    - temp_bytes:\n        usage: \"COUNTER\"\n        description: \"Total amount of data written to temporary files by queries in this database\"\n    - deadlocks:\n        usage: \"COUNTER\"\n        description: \"Number of deadlocks detected in this database\"\n    - blk_read_time:\n        usage: \"COUNTER\"\n        description: \"Time spent reading data file blocks by backends in this database, in milliseconds\"\n    - blk_write_time:\n        usage: \"COUNTER\"\n        description: \"Time spent writing data file blocks by backends in this database, in milliseconds\"\n\npg_stat_replication:\n  primary: true\n  query: |\n    SELECT usename\n      , COALESCE(application_name, '') AS application_name\n      , COALESCE(client_addr::text, '') AS client_addr\n      , COALESCE(client_port::text, '') AS client_port\n      , EXTRACT(EPOCH FROM backend_start) AS backend_start\n      , COALESCE(pg_catalog.age(backend_xmin), 0) AS backend_xmin_age\n      , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), sent_lsn) AS sent_diff_bytes\n      , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), write_lsn) AS write_diff_bytes\n      , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), flush_lsn) AS flush_diff_bytes\n      , COALESCE(pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), replay_lsn),0) AS replay_diff_bytes\n      , COALESCE((EXTRACT(EPOCH FROM write_lag)),0)::float AS write_lag_seconds\n      , COALESCE((EXTRACT(EPOCH FROM flush_lag)),0)::float AS flush_lag_seconds\n      , COALESCE((EXTRACT(EPOCH FROM replay_lag)),0)::float AS replay_lag_seconds\n    FROM pg_catalog.pg_stat_replication\n  metrics:\n    - usename:\n        usage: \"LABEL\"\n        description: \"Name of the replication user\"\n    - application_name:\n        usage: \"LABEL\"\n        description: \"Name of the application\"\n    - client_addr:\n        usage: \"LABEL\"\n        description: \"Client IP address\"\n    - client_port:\n        usage: \"LABEL\"\n        description: \"Client TCP port\"\n    - backend_start:\n        usage: \"COUNTER\"\n        description: \"Time when this process was started\"\n    - backend_xmin_age:\n        usage: \"COUNTER\"\n        description: \"The age of this standby's xmin horizon\"\n    - sent_diff_bytes:\n        usage: \"GAUGE\"\n        description: \"Difference in bytes from the last write-ahead log location sent on this connection\"\n    - write_diff_bytes:\n        usage: \"GAUGE\"\n        description: \"Difference in bytes from the last write-ahead log location written to disk by this standby server\"\n    - flush_diff_bytes:\n        usage: \"GAUGE\"\n        description: \"Difference in bytes from the last write-ahead log location flushed to disk by this standby server\"\n    - replay_diff_bytes:\n        usage: \"GAUGE\"\n        description: \"Difference in bytes from the last write-ahead log location replayed into the database on this standby server\"\n    - write_lag_seconds:\n        usage: \"GAUGE\"\n        description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written it\"\n    - flush_lag_seconds:\n        usage: \"GAUGE\"\n        description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written and flushed it\"\n    - replay_lag_seconds:\n        usage: \"GAUGE\"\n        description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written, flushed and applied it\"\n\npg_settings:\n  query: |\n    SELECT name,\n    CASE setting WHEN 'on' THEN '1' WHEN 'off' THEN '0' ELSE setting END AS setting\n    FROM pg_catalog.pg_settings\n    WHERE vartype IN ('integer', 'real', 'bool')\n    ORDER BY 1\n  metrics:\n    - name:\n        usage: \"LABEL\"\n        description: \"Name of the setting\"\n    - setting:\n        usage: \"GAUGE\"\n        description: \"Setting value\"\n\npg_extensions:\n  query: |\n    SELECT\n      current_database() as datname,\n      name as extname,\n      default_version,\n      installed_version,\n      CASE\n        WHEN default_version = installed_version THEN 0\n        ELSE 1\n    END AS update_available\n    FROM pg_catalog.pg_available_extensions\n    WHERE installed_version IS NOT NULL\n  metrics:\n    - datname:\n        usage: \"LABEL\"\n        description: \"Name of the database\"\n    - extname:\n        usage: \"LABEL\"\n        description: \"Extension name\"\n    - default_version:\n        usage: \"LABEL\"\n        description: \"Default version\"\n    - installed_version:\n        usage: \"LABEL\"\n        description: \"Installed version\"\n    - update_available:\n        usage: \"GAUGE\"\n        description: \"An update is available\"\n  target_databases:\n    - '*'\n"` | A string representation of a YAML defining monitoring queries. |
+| monitoringQueriesConfigMap.queries | string | `"backends:\n  query: |\n   SELECT sa.datname\n       , sa.usename\n       , sa.application_name\n       , states.state\n       , COALESCE(sa.count, 0) AS total\n       , COALESCE(sa.max_tx_secs, 0) AS max_tx_duration_seconds\n       FROM ( VALUES ('active')\n           , ('idle')\n           , ('idle in transaction')\n           , ('idle in transaction (aborted)')\n           , ('fastpath function call')\n           , ('disabled')\n           ) AS states(state)\n       LEFT JOIN (\n           SELECT datname\n               , state\n               , usename\n               , COALESCE(application_name, '') AS application_name\n               , COUNT(*)\n               , COALESCE(EXTRACT (EPOCH FROM (max(now() - xact_start))), 0) AS max_tx_secs\n           FROM pg_catalog.pg_stat_activity\n           GROUP BY datname, state, usename, application_name\n       ) sa ON states.state = sa.state\n       WHERE sa.usename IS NOT NULL\n  metrics:\n    - datname:\n        usage: \"LABEL\"\n        description: \"Name of the database\"\n    - usename:\n        usage: \"LABEL\"\n        description: \"Name of the user\"\n    - application_name:\n        usage: \"LABEL\"\n        description: \"Name of the application\"\n    - state:\n        usage: \"LABEL\"\n        description: \"State of the backend\"\n    - total:\n        usage: \"GAUGE\"\n        description: \"Number of backends\"\n    - max_tx_duration_seconds:\n        usage: \"GAUGE\"\n        description: \"Maximum duration of a transaction in seconds\"\n\nbackends_waiting:\n  query: |\n   SELECT count(*) AS total\n   FROM pg_catalog.pg_locks blocked_locks\n   JOIN pg_catalog.pg_locks blocking_locks\n     ON blocking_locks.locktype = blocked_locks.locktype\n     AND blocking_locks.database IS NOT DISTINCT FROM blocked_locks.database\n     AND blocking_locks.relation IS NOT DISTINCT FROM blocked_locks.relation\n     AND blocking_locks.page IS NOT DISTINCT FROM blocked_locks.page\n     AND blocking_locks.tuple IS NOT DISTINCT FROM blocked_locks.tuple\n     AND blocking_locks.virtualxid IS NOT DISTINCT FROM blocked_locks.virtualxid\n     AND blocking_locks.transactionid IS NOT DISTINCT FROM blocked_locks.transactionid\n     AND blocking_locks.classid IS NOT DISTINCT FROM blocked_locks.classid\n     AND blocking_locks.objid IS NOT DISTINCT FROM blocked_locks.objid\n     AND blocking_locks.objsubid IS NOT DISTINCT FROM blocked_locks.objsubid\n     AND blocking_locks.pid != blocked_locks.pid\n   JOIN pg_catalog.pg_stat_activity blocking_activity ON blocking_activity.pid = blocking_locks.pid\n   WHERE NOT blocked_locks.granted\n  metrics:\n    - total:\n        usage: \"GAUGE\"\n        description: \"Total number of backends that are currently waiting on other queries\"\n\npg_database:\n  query: |\n    SELECT datname\n      , pg_catalog.pg_database_size(datname) AS size_bytes\n      , pg_catalog.age(datfrozenxid) AS xid_age\n      , pg_catalog.mxid_age(datminmxid) AS mxid_age\n    FROM pg_catalog.pg_database\n    WHERE datallowconn\n  metrics:\n    - datname:\n        usage: \"LABEL\"\n        description: \"Name of the database\"\n    - size_bytes:\n        usage: \"GAUGE\"\n        description: \"Disk space used by the database\"\n    - xid_age:\n        usage: \"GAUGE\"\n        description: \"Number of transactions from the frozen XID to the current one\"\n    - mxid_age:\n        usage: \"GAUGE\"\n        description: \"Number of multiple transactions (Multixact) from the frozen XID to the current one\"\n\npg_postmaster:\n  query: |\n    SELECT EXTRACT(EPOCH FROM pg_postmaster_start_time) AS start_time\n    FROM pg_catalog.pg_postmaster_start_time()\n  metrics:\n    - start_time:\n        usage: \"GAUGE\"\n        description: \"Time at which postgres started (based on epoch)\"\n\npg_replication:\n  query: \"SELECT CASE WHEN (\n            NOT pg_catalog.pg_is_in_recovery()\n            OR pg_catalog.pg_last_wal_receive_lsn() = pg_catalog.pg_last_wal_replay_lsn())\n          THEN 0\n          ELSE GREATEST (0,\n            EXTRACT(EPOCH FROM (now() - pg_catalog.pg_last_xact_replay_timestamp())))\n          END AS lag,\n          pg_catalog.pg_is_in_recovery() AS in_recovery,\n          EXISTS (TABLE pg_stat_wal_receiver) AS is_wal_receiver_up,\n          (SELECT count(*) FROM pg_catalog.pg_stat_replication) AS streaming_replicas\"\n  metrics:\n    - lag:\n        usage: \"GAUGE\"\n        description: \"Replication lag behind primary in seconds\"\n    - in_recovery:\n        usage: \"GAUGE\"\n        description: \"Whether the instance is in recovery\"\n    - is_wal_receiver_up:\n        usage: \"GAUGE\"\n        description: \"Whether the instance wal_receiver is up\"\n    - streaming_replicas:\n        usage: \"GAUGE\"\n        description: \"Number of streaming replicas connected to the instance\"\n\npg_replication_slots:\n  query: |\n    SELECT slot_name,\n      slot_type,\n      database,\n      active,\n      (CASE pg_catalog.pg_is_in_recovery()\n        WHEN TRUE THEN pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_last_wal_receive_lsn(), restart_lsn)\n        ELSE pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), restart_lsn)\n      END) as pg_wal_lsn_diff\n    FROM pg_catalog.pg_replication_slots\n    WHERE NOT temporary\n  metrics:\n    - slot_name:\n        usage: \"LABEL\"\n        description: \"Name of the replication slot\"\n    - slot_type:\n        usage: \"LABEL\"\n        description: \"Type of the replication slot\"\n    - database:\n        usage: \"LABEL\"\n        description: \"Name of the database\"\n    - active:\n        usage: \"GAUGE\"\n        description: \"Flag indicating whether the slot is active\"\n    - pg_wal_lsn_diff:\n        usage: \"GAUGE\"\n        description: \"Replication lag in bytes\"\n\npg_stat_archiver:\n  query: |\n    SELECT archived_count\n      , failed_count\n      , COALESCE(EXTRACT(EPOCH FROM (now() - last_archived_time)), -1) AS seconds_since_last_archival\n      , COALESCE(EXTRACT(EPOCH FROM (now() - last_failed_time)), -1) AS seconds_since_last_failure\n      , COALESCE(EXTRACT(EPOCH FROM last_archived_time), -1) AS last_archived_time\n      , COALESCE(EXTRACT(EPOCH FROM last_failed_time), -1) AS last_failed_time\n      , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_archived_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_archived_wal_start_lsn\n      , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_failed_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_failed_wal_start_lsn\n      , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n    FROM pg_catalog.pg_stat_archiver\n  metrics:\n    - archived_count:\n        usage: \"COUNTER\"\n        description: \"Number of WAL files that have been successfully archived\"\n    - failed_count:\n        usage: \"COUNTER\"\n        description: \"Number of failed attempts for archiving WAL files\"\n    - seconds_since_last_archival:\n        usage: \"GAUGE\"\n        description: \"Seconds since the last successful archival operation\"\n    - seconds_since_last_failure:\n        usage: \"GAUGE\"\n        description: \"Seconds since the last failed archival operation\"\n    - last_archived_time:\n        usage: \"GAUGE\"\n        description: \"Epoch of the last time WAL archiving succeeded\"\n    - last_failed_time:\n        usage: \"GAUGE\"\n        description: \"Epoch of the last time WAL archiving failed\"\n    - last_archived_wal_start_lsn:\n        usage: \"GAUGE\"\n        description: \"Archived WAL start LSN\"\n    - last_failed_wal_start_lsn:\n        usage: \"GAUGE\"\n        description: \"Last failed WAL LSN\"\n    - stats_reset_time:\n        usage: \"GAUGE\"\n        description: \"Time at which these statistics were last reset\"\n\npg_stat_bgwriter:\n  runonserver: \"<17.0.0\"\n  query: |\n    SELECT checkpoints_timed\n      , checkpoints_req\n      , checkpoint_write_time\n      , checkpoint_sync_time\n      , buffers_checkpoint\n      , buffers_clean\n      , maxwritten_clean\n      , buffers_backend\n      , buffers_backend_fsync\n      , buffers_alloc\n    FROM pg_catalog.pg_stat_bgwriter\n  metrics:\n    - checkpoints_timed:\n        usage: \"COUNTER\"\n        description: \"Number of scheduled checkpoints that have been performed\"\n    - checkpoints_req:\n        usage: \"COUNTER\"\n        description: \"Number of requested checkpoints that have been performed\"\n    - checkpoint_write_time:\n        usage: \"COUNTER\"\n        description: \"Total amount of time that has been spent in the portion of checkpoint processing where files are written to disk, in milliseconds\"\n    - checkpoint_sync_time:\n        usage: \"COUNTER\"\n        description: \"Total amount of time that has been spent in the portion of checkpoint processing where files are synchronized to disk, in milliseconds\"\n    - buffers_checkpoint:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written during checkpoints\"\n    - buffers_clean:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written by the background writer\"\n    - maxwritten_clean:\n        usage: \"COUNTER\"\n        description: \"Number of times the background writer stopped a cleaning scan because it had written too many buffers\"\n    - buffers_backend:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written directly by a backend\"\n    - buffers_backend_fsync:\n        usage: \"COUNTER\"\n        description: \"Number of times a backend had to execute its own fsync call (normally the background writer handles those even when the backend does its own write)\"\n    - buffers_alloc:\n        usage: \"COUNTER\"\n        description: \"Number of buffers allocated\"\n\npg_stat_bgwriter_17:\n  runonserver: \">=17.0.0\"\n  name: pg_stat_bgwriter\n  query: |\n    SELECT buffers_clean\n      , maxwritten_clean\n      , buffers_alloc\n      , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n    FROM pg_catalog.pg_stat_bgwriter\n  metrics:\n    - buffers_clean:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written by the background writer\"\n    - maxwritten_clean:\n        usage: \"COUNTER\"\n        description: \"Number of times the background writer stopped a cleaning scan because it had written too many buffers\"\n    - buffers_alloc:\n        usage: \"COUNTER\"\n        description: \"Number of buffers allocated\"\n    - stats_reset_time:\n        usage: \"GAUGE\"\n        description: \"Time at which these statistics were last reset\"\n\npg_stat_checkpointer:\n  runonserver: \">=17.0.0\"\n  query: |\n    SELECT num_timed AS checkpoints_timed\n      , num_requested AS checkpoints_req\n      , restartpoints_timed\n      , restartpoints_req\n      , restartpoints_done\n      , write_time\n      , sync_time\n      , buffers_written\n      , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n    FROM pg_catalog.pg_stat_checkpointer\n  metrics:\n    - checkpoints_timed:\n        usage: \"COUNTER\"\n        description: \"Number of scheduled checkpoints that have been performed\"\n    - checkpoints_req:\n        usage: \"COUNTER\"\n        description: \"Number of requested checkpoints that have been performed\"\n    - restartpoints_timed:\n        usage: \"COUNTER\"\n        description: \"Number of scheduled restartpoints due to timeout or after a failed attempt to perform it\"\n    - restartpoints_req:\n        usage: \"COUNTER\"\n        description: \"Number of requested restartpoints that have been performed\"\n    - restartpoints_done:\n        usage: \"COUNTER\"\n        description: \"Number of restartpoints that have been performed\"\n    - write_time:\n        usage: \"COUNTER\"\n        description: \"Total amount of time that has been spent in the portion of processing checkpoints and restartpoints where files are written to disk, in milliseconds\"\n    - sync_time:\n        usage: \"COUNTER\"\n        description: \"Total amount of time that has been spent in the portion of processing checkpoints and restartpoints where files are synchronized to disk, in milliseconds\"\n    - buffers_written:\n        usage: \"COUNTER\"\n        description: \"Number of buffers written during checkpoints and restartpoints\"\n    - stats_reset_time:\n        usage: \"GAUGE\"\n        description: \"Time at which these statistics were last reset\"\n\npg_stat_database:\n  query: |\n    SELECT datname\n      , xact_commit\n      , xact_rollback\n      , blks_read\n      , blks_hit\n      , tup_returned\n      , tup_fetched\n      , tup_inserted\n      , tup_updated\n      , tup_deleted\n      , conflicts\n      , temp_files\n      , temp_bytes\n      , deadlocks\n      , blk_read_time\n      , blk_write_time\n    FROM pg_catalog.pg_stat_database\n  metrics:\n    - datname:\n        usage: \"LABEL\"\n        description: \"Name of this database\"\n    - xact_commit:\n        usage: \"COUNTER\"\n        description: \"Number of transactions in this database that have been committed\"\n    - xact_rollback:\n        usage: \"COUNTER\"\n        description: \"Number of transactions in this database that have been rolled back\"\n    - blks_read:\n        usage: \"COUNTER\"\n        description: \"Number of disk blocks read in this database\"\n    - blks_hit:\n        usage: \"COUNTER\"\n        description: \"Number of times disk blocks were found already in the buffer cache, so that a read was not necessary (this only includes hits in the PostgreSQL buffer cache, not the operating system's file system cache)\"\n    - tup_returned:\n        usage: \"COUNTER\"\n        description: \"Number of rows returned by queries in this database\"\n    - tup_fetched:\n        usage: \"COUNTER\"\n        description: \"Number of rows fetched by queries in this database\"\n    - tup_inserted:\n        usage: \"COUNTER\"\n        description: \"Number of rows inserted by queries in this database\"\n    - tup_updated:\n        usage: \"COUNTER\"\n        description: \"Number of rows updated by queries in this database\"\n    - tup_deleted:\n        usage: \"COUNTER\"\n        description: \"Number of rows deleted by queries in this database\"\n    - conflicts:\n        usage: \"COUNTER\"\n        description: \"Number of queries canceled due to conflicts with recovery in this database\"\n    - temp_files:\n        usage: \"COUNTER\"\n        description: \"Number of temporary files created by queries in this database\"\n    - temp_bytes:\n        usage: \"COUNTER\"\n        description: \"Total amount of data written to temporary files by queries in this database\"\n    - deadlocks:\n        usage: \"COUNTER\"\n        description: \"Number of deadlocks detected in this database\"\n    - blk_read_time:\n        usage: \"COUNTER\"\n        description: \"Time spent reading data file blocks by backends in this database, in milliseconds\"\n    - blk_write_time:\n        usage: \"COUNTER\"\n        description: \"Time spent writing data file blocks by backends in this database, in milliseconds\"\n\npg_stat_replication:\n  primary: true\n  query: |\n   SELECT usename\n     , COALESCE(application_name, '') AS application_name\n     , COALESCE(client_addr::text, '') AS client_addr\n     , COALESCE(client_port::text, '') AS client_port\n     , EXTRACT(EPOCH FROM backend_start) AS backend_start\n     , COALESCE(pg_catalog.age(backend_xmin), 0) AS backend_xmin_age\n     , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), sent_lsn) AS sent_diff_bytes\n     , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), write_lsn) AS write_diff_bytes\n     , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), flush_lsn) AS flush_diff_bytes\n     , COALESCE(pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), replay_lsn),0) AS replay_diff_bytes\n     , COALESCE((EXTRACT(EPOCH FROM write_lag)),0)::float AS write_lag_seconds\n     , COALESCE((EXTRACT(EPOCH FROM flush_lag)),0)::float AS flush_lag_seconds\n     , COALESCE((EXTRACT(EPOCH FROM replay_lag)),0)::float AS replay_lag_seconds\n   FROM pg_catalog.pg_stat_replication\n  metrics:\n    - usename:\n        usage: \"LABEL\"\n        description: \"Name of the replication user\"\n    - application_name:\n        usage: \"LABEL\"\n        description: \"Name of the application\"\n    - client_addr:\n        usage: \"LABEL\"\n        description: \"Client IP address\"\n    - client_port:\n        usage: \"LABEL\"\n        description: \"Client TCP port\"\n    - backend_start:\n        usage: \"COUNTER\"\n        description: \"Time when this process was started\"\n    - backend_xmin_age:\n        usage: \"COUNTER\"\n        description: \"The age of this standby's xmin horizon\"\n    - sent_diff_bytes:\n        usage: \"GAUGE\"\n        description: \"Difference in bytes from the last write-ahead log location sent on this connection\"\n    - write_diff_bytes:\n        usage: \"GAUGE\"\n        description: \"Difference in bytes from the last write-ahead log location written to disk by this standby server\"\n    - flush_diff_bytes:\n        usage: \"GAUGE\"\n        description: \"Difference in bytes from the last write-ahead log location flushed to disk by this standby server\"\n    - replay_diff_bytes:\n        usage: \"GAUGE\"\n        description: \"Difference in bytes from the last write-ahead log location replayed into the database on this standby server\"\n    - write_lag_seconds:\n        usage: \"GAUGE\"\n        description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written it\"\n    - flush_lag_seconds:\n        usage: \"GAUGE\"\n        description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written and flushed it\"\n    - replay_lag_seconds:\n        usage: \"GAUGE\"\n        description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written, flushed and applied it\"\n\npg_settings:\n  query: |\n    SELECT name,\n    CASE setting WHEN 'on' THEN '1' WHEN 'off' THEN '0' ELSE setting END AS setting\n    FROM pg_catalog.pg_settings\n    WHERE vartype IN ('integer', 'real', 'bool')\n    ORDER BY 1\n  metrics:\n    - name:\n        usage: \"LABEL\"\n        description: \"Name of the setting\"\n    - setting:\n        usage: \"GAUGE\"\n        description: \"Setting value\"\n\npg_extensions:\n  query: |\n    SELECT\n     current_database() as datname,\n     name as extname,\n     default_version,\n     installed_version,\n     CASE\n       WHEN default_version = installed_version THEN 0\n       ELSE 1\n    END AS update_available\n    FROM pg_catalog.pg_available_extensions\n    WHERE installed_version IS NOT NULL\n  metrics:\n    - datname:\n        usage: \"LABEL\"\n        description: \"Name of the database\"\n    - extname:\n        usage: \"LABEL\"\n        description: \"Extension name\"\n    - default_version:\n        usage: \"LABEL\"\n        description: \"Default version\"\n    - installed_version:\n        usage: \"LABEL\"\n        description: \"Installed version\"\n    - update_available:\n        usage: \"GAUGE\"\n        description: \"An update is available\"\n  target_databases:\n    - '*'\n"` | A string representation of a YAML defining monitoring queries. |
 | nameOverride | string | `""` |  |
 | namespaceOverride | string | `""` |  |
 | nodeSelector | object | `{}` | Nodeselector for the operator to be installed. |
@@ -80,3 +80,4 @@ CloudNativePG Operator Helm Chart
 | topologySpreadConstraints | list | `[]` | Topology Spread Constraints for the operator to be installed. |
 | updateStrategy | object | `{}` | Update strategy for the operator. ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy For example:  type: RollingUpdate  rollingUpdate:    maxSurge: 25%    maxUnavailable: 25% |
 | webhook | object | `{"livenessProbe":{"initialDelaySeconds":3},"mutating":{"create":true,"failurePolicy":"Fail"},"port":9443,"readinessProbe":{"initialDelaySeconds":3},"startupProbe":{"failureThreshold":6,"periodSeconds":5},"validating":{"create":true,"failurePolicy":"Fail"}}` | The webhook configuration. |
+
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/crds/crds.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/templates/crds/crds.yaml
index 7982b5e1..ef934e1b 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/crds/crds.yaml
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/crds/crds.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   name: backups.postgresql.cnpg.io
 spec:
@@ -215,11 +215,6 @@ spec:
                     - key
                     - name
                     type: object
-                  useDefaultAzureCredentials:
-                    description: |-
-                      Use the default Azure authentication flow, which includes DefaultAzureCredential.
-                      This allows authentication using environment variables and managed identities.
-                    type: boolean
                 type: object
               backupId:
                 description: The ID of the Barman backup
@@ -317,13 +312,6 @@ spec:
                   podName:
                     description: The pod name
                     type: string
-                  sessionID:
-                    description: |-
-                      The instance manager session ID. This is a unique identifier generated at instance manager
-                      startup and changes on every restart (including container reboots). Used to detect if
-                      the instance manager was restarted during long-running operations like backups, which
-                      would terminate any running backup process.
-                    type: string
                 type: object
               majorVersion:
                 description: |-
@@ -466,7 +454,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   name: clusterimagecatalogs.postgresql.cnpg.io
 spec:
@@ -548,7 +536,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   name: clusters.postgresql.cnpg.io
 spec:
@@ -1566,10 +1554,9 @@ spec:
                         operator:
                           description: |-
                             Operator represents a key's relationship to the value.
-                            Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
+                            Valid operators are Exists and Equal. Defaults to Equal.
                             Exists is equivalent to wildcard for value, so that a pod can
                             tolerate all taints of a particular category.
-                            Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                           type: string
                         tolerationSeconds:
                           description: |-
@@ -1662,11 +1649,6 @@ spec:
                             - key
                             - name
                             type: object
-                          useDefaultAzureCredentials:
-                            description: |-
-                              Use the default Azure authentication flow, which includes DefaultAzureCredential.
-                              This allows authentication using environment variables and managed identities.
-                            type: boolean
                         type: object
                       data:
                         description: |-
@@ -2088,59 +2070,19 @@ spec:
                             type: array
                           pgDumpExtraOptions:
                             description: |-
-                              List of custom options to pass to the `pg_dump` command.
-
-                              IMPORTANT: Use with caution. The operator does not validate these options,
-                              and certain flags may interfere with its intended functionality or design.
-                              You are responsible for ensuring that the provided options are compatible
-                              with your environment and desired behavior.
-                            items:
-                              type: string
-                            type: array
-                          pgRestoreDataOptions:
-                            description: |-
-                              Custom options to pass to the `pg_restore` command during the `data`
-                              section. This setting overrides the generic `pgRestoreExtraOptions` value.
-
-                              IMPORTANT: Use with caution. The operator does not validate these options,
-                              and certain flags may interfere with its intended functionality or design.
-                              You are responsible for ensuring that the provided options are compatible
-                              with your environment and desired behavior.
+                              List of custom options to pass to the `pg_dump` command. IMPORTANT:
+                              Use these options with caution and at your own risk, as the operator
+                              does not validate their content. Be aware that certain options may
+                              conflict with the operator's intended functionality or design.
                             items:
                               type: string
                             type: array
                           pgRestoreExtraOptions:
                             description: |-
-                              List of custom options to pass to the `pg_restore` command.
-
-                              IMPORTANT: Use with caution. The operator does not validate these options,
-                              and certain flags may interfere with its intended functionality or design.
-                              You are responsible for ensuring that the provided options are compatible
-                              with your environment and desired behavior.
-                            items:
-                              type: string
-                            type: array
-                          pgRestorePostdataOptions:
-                            description: |-
-                              Custom options to pass to the `pg_restore` command during the `post-data`
-                              section. This setting overrides the generic `pgRestoreExtraOptions` value.
-
-                              IMPORTANT: Use with caution. The operator does not validate these options,
-                              and certain flags may interfere with its intended functionality or design.
-                              You are responsible for ensuring that the provided options are compatible
-                              with your environment and desired behavior.
-                            items:
-                              type: string
-                            type: array
-                          pgRestorePredataOptions:
-                            description: |-
-                              Custom options to pass to the `pg_restore` command during the `pre-data`
-                              section. This setting overrides the generic `pgRestoreExtraOptions` value.
-
-                              IMPORTANT: Use with caution. The operator does not validate these options,
-                              and certain flags may interfere with its intended functionality or design.
-                              You are responsible for ensuring that the provided options are compatible
-                              with your environment and desired behavior.
+                              List of custom options to pass to the `pg_restore` command. IMPORTANT:
+                              Use these options with caution and at your own risk, as the operator
+                              does not validate their content. Be aware that certain options may
+                              conflict with the operator's intended functionality or design.
                             items:
                               type: string
                             type: array
@@ -2204,7 +2146,6 @@ spec:
                       options:
                         description: |-
                           The list of options that must be passed to initdb when creating the cluster.
-
                           Deprecated: This could lead to inconsistent configurations,
                           please use the explicit provided parameters instead.
                           If defined, explicit values will be ignored.
@@ -2529,9 +2470,8 @@ spec:
                               integer)
                             type: string
                           targetTime:
-                            description: |-
-                              The target time as a timestamp in RFC3339 format or PostgreSQL timestamp format.
-                              Timestamps without an explicit timezone are interpreted as UTC.
+                            description: The target time as a timestamp in the RFC3339
+                              standard
                             type: string
                           targetXID:
                             description: The target transaction ID
@@ -3050,7 +2990,7 @@ spec:
                           resources:
                             description: |-
                               resources represents the minimum resources the volume should have.
-                              Users are allowed to specify resource requirements
+                              If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
                               that are lower than previous value but must still be higher than capacity recorded in the
                               status field of the claim.
                               More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -3254,11 +3194,6 @@ spec:
                               - key
                               - name
                               type: object
-                            useDefaultAzureCredentials:
-                              description: |-
-                                Use the default Azure authentication flow, which includes DefaultAzureCredential.
-                                This allows authentication using environment variables and managed identities.
-                              type: boolean
                           type: object
                         data:
                           description: |-
@@ -4399,14 +4334,6 @@ spec:
                       Deprecated: This feature will be removed in an upcoming release. If
                       you need this functionality, you can create a PodMonitor manually.
                     type: boolean
-                  metricsQueriesTTL:
-                    description: |-
-                      The interval during which metrics computed from queries are considered current.
-                      Once it is exceeded, a new scrape will trigger a rerun
-                      of the queries.
-                      If not set, defaults to 30 seconds, in line with Prometheus scraping defaults.
-                      Setting this to zero disables the caching mechanism and can cause heavy load on the PostgreSQL server.
-                    type: string
                   podMonitorMetricRelabelings:
                     description: |-
                       The list of metric relabelings for the `PodMonitor`. Applied to samples before ingestion.
@@ -4648,242 +4575,6 @@ spec:
                   - name
                   type: object
                 type: array
-              podSecurityContext:
-                description: |-
-                  Override the PodSecurityContext applied to every Pod of the cluster.
-                  When set, this overrides the operator's default PodSecurityContext for the cluster.
-                  If omitted, the operator defaults are used.
-                  This field doesn't have any effect if SecurityContextConstraints are present.
-                properties:
-                  appArmorProfile:
-                    description: |-
-                      appArmorProfile is the AppArmor options to use by the containers in this pod.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    properties:
-                      localhostProfile:
-                        description: |-
-                          localhostProfile indicates a profile loaded on the node that should be used.
-                          The profile must be preconfigured on the node to work.
-                          Must match the loaded name of the profile.
-                          Must be set if and only if type is "Localhost".
-                        type: string
-                      type:
-                        description: |-
-                          type indicates which kind of AppArmor profile will be applied.
-                          Valid options are:
-                            Localhost - a profile pre-loaded on the node.
-                            RuntimeDefault - the container runtime's default profile.
-                            Unconfined - no AppArmor enforcement.
-                        type: string
-                    required:
-                    - type
-                    type: object
-                  fsGroup:
-                    description: |-
-                      A special supplemental group that applies to all containers in a pod.
-                      Some volume types allow the Kubelet to change the ownership of that volume
-                      to be owned by the pod:
-
-                      1. The owning GID will be the FSGroup
-                      2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
-                      3. The permission bits are OR'd with rw-rw----
-
-                      If unset, the Kubelet will not modify the ownership and permissions of any volume.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    format: int64
-                    type: integer
-                  fsGroupChangePolicy:
-                    description: |-
-                      fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
-                      before being exposed inside Pod. This field will only apply to
-                      volume types which support fsGroup based ownership(and permissions).
-                      It will have no effect on ephemeral volume types such as: secret, configmaps
-                      and emptydir.
-                      Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    type: string
-                  runAsGroup:
-                    description: |-
-                      The GID to run the entrypoint of the container process.
-                      Uses runtime default if unset.
-                      May also be set in SecurityContext.  If set in both SecurityContext and
-                      PodSecurityContext, the value specified in SecurityContext takes precedence
-                      for that container.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    format: int64
-                    type: integer
-                  runAsNonRoot:
-                    description: |-
-                      Indicates that the container must run as a non-root user.
-                      If true, the Kubelet will validate the image at runtime to ensure that it
-                      does not run as UID 0 (root) and fail to start the container if it does.
-                      If unset or false, no such validation will be performed.
-                      May also be set in SecurityContext.  If set in both SecurityContext and
-                      PodSecurityContext, the value specified in SecurityContext takes precedence.
-                    type: boolean
-                  runAsUser:
-                    description: |-
-                      The UID to run the entrypoint of the container process.
-                      Defaults to user specified in image metadata if unspecified.
-                      May also be set in SecurityContext.  If set in both SecurityContext and
-                      PodSecurityContext, the value specified in SecurityContext takes precedence
-                      for that container.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    format: int64
-                    type: integer
-                  seLinuxChangePolicy:
-                    description: |-
-                      seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod.
-                      It has no effect on nodes that do not support SELinux or to volumes does not support SELinux.
-                      Valid values are "MountOption" and "Recursive".
-
-                      "Recursive" means relabeling of all files on all Pod volumes by the container runtime.
-                      This may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node.
-
-                      "MountOption" mounts all eligible Pod volumes with `-o context` mount option.
-                      This requires all Pods that share the same volume to use the same SELinux label.
-                      It is not possible to share the same volume among privileged and unprivileged Pods.
-                      Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
-                      whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
-                      CSIDriver instance. Other volumes are always re-labelled recursively.
-                      "MountOption" value is allowed only when SELinuxMount feature gate is enabled.
-
-                      If not specified and SELinuxMount feature gate is enabled, "MountOption" is used.
-                      If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes
-                      and "Recursive" for all other volumes.
-
-                      This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.
-
-                      All Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    type: string
-                  seLinuxOptions:
-                    description: |-
-                      The SELinux context to be applied to all containers.
-                      If unspecified, the container runtime will allocate a random SELinux context for each
-                      container.  May also be set in SecurityContext.  If set in
-                      both SecurityContext and PodSecurityContext, the value specified in SecurityContext
-                      takes precedence for that container.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    properties:
-                      level:
-                        description: Level is SELinux level label that applies to
-                          the container.
-                        type: string
-                      role:
-                        description: Role is a SELinux role label that applies to
-                          the container.
-                        type: string
-                      type:
-                        description: Type is a SELinux type label that applies to
-                          the container.
-                        type: string
-                      user:
-                        description: User is a SELinux user label that applies to
-                          the container.
-                        type: string
-                    type: object
-                  seccompProfile:
-                    description: |-
-                      The seccomp options to use by the containers in this pod.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    properties:
-                      localhostProfile:
-                        description: |-
-                          localhostProfile indicates a profile defined in a file on the node should be used.
-                          The profile must be preconfigured on the node to work.
-                          Must be a descending path, relative to the kubelet's configured seccomp profile location.
-                          Must be set if type is "Localhost". Must NOT be set for any other type.
-                        type: string
-                      type:
-                        description: |-
-                          type indicates which kind of seccomp profile will be applied.
-                          Valid options are:
-
-                          Localhost - a profile defined in a file on the node should be used.
-                          RuntimeDefault - the container runtime default profile should be used.
-                          Unconfined - no profile should be applied.
-                        type: string
-                    required:
-                    - type
-                    type: object
-                  supplementalGroups:
-                    description: |-
-                      A list of groups applied to the first process run in each container, in
-                      addition to the container's primary GID and fsGroup (if specified).  If
-                      the SupplementalGroupsPolicy feature is enabled, the
-                      supplementalGroupsPolicy field determines whether these are in addition
-                      to or instead of any group memberships defined in the container image.
-                      If unspecified, no additional groups are added, though group memberships
-                      defined in the container image may still be used, depending on the
-                      supplementalGroupsPolicy field.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    items:
-                      format: int64
-                      type: integer
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  supplementalGroupsPolicy:
-                    description: |-
-                      Defines how supplemental groups of the first container processes are calculated.
-                      Valid values are "Merge" and "Strict". If not specified, "Merge" is used.
-                      (Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled
-                      and the container runtime must implement support for this feature.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    type: string
-                  sysctls:
-                    description: |-
-                      Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
-                      sysctls (by the container runtime) might fail to launch.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    items:
-                      description: Sysctl defines a kernel parameter to be set
-                      properties:
-                        name:
-                          description: Name of a property to set
-                          type: string
-                        value:
-                          description: Value of a property to set
-                          type: string
-                      required:
-                      - name
-                      - value
-                      type: object
-                    type: array
-                    x-kubernetes-list-type: atomic
-                  windowsOptions:
-                    description: |-
-                      The Windows specific settings applied to all containers.
-                      If unspecified, the options within a container's SecurityContext will be used.
-                      If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
-                      Note that this field cannot be set when spec.os.name is linux.
-                    properties:
-                      gmsaCredentialSpec:
-                        description: |-
-                          GMSACredentialSpec is where the GMSA admission webhook
-                          (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
-                          GMSA credential spec named by the GMSACredentialSpecName field.
-                        type: string
-                      gmsaCredentialSpecName:
-                        description: GMSACredentialSpecName is the name of the GMSA
-                          credential spec to use.
-                        type: string
-                      hostProcess:
-                        description: |-
-                          HostProcess determines if a container should be run as a 'Host Process' container.
-                          All of a Pod's containers must have the same effective HostProcess value
-                          (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
-                          In addition, if HostProcess is true then HostNetwork must also be set to true.
-                        type: boolean
-                      runAsUserName:
-                        description: |-
-                          The UserName in Windows to run the entrypoint of the container process.
-                          Defaults to the user specified in image metadata if unspecified.
-                          May also be set in PodSecurityContext. If set in both SecurityContext and
-                          PodSecurityContext, the value specified in SecurityContext takes precedence.
-                        type: string
-                    type: object
-                type: object
               postgresGID:
                 default: 26
                 description: The GID of the `postgres` user inside the image, defaults
@@ -4960,7 +4651,7 @@ spec:
                         name:
                           description: The name of the extension, required
                           minLength: 1
-                          pattern: ^[a-z0-9]([-a-z0-9_]*[a-z0-9])?$
+                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                           type: string
                       required:
                       - image
@@ -5107,12 +4798,6 @@ spec:
                         - required
                         - preferred
                         type: string
-                      failoverQuorum:
-                        description: |-
-                          FailoverQuorum enables a quorum-based check before failover, improving
-                          data durability and safety during failover events in CloudNativePG-managed
-                          PostgreSQL clusters.
-                        type: boolean
                       maxStandbyNamesFromCluster:
                         description: |-
                           Specifies the maximum number of local cluster pods that can be
@@ -5169,10 +4854,7 @@ spec:
                 description: |-
                   Method to follow to upgrade the primary server during a rolling
                   update procedure, after all replicas have been successfully updated:
-                  it can be with a switchover (`switchover`) or in-place (`restart` - default).
-                  Note: when using `switchover`, the operator will reject updates that change both
-                  the image name and PostgreSQL configuration parameters simultaneously to avoid
-                  configuration mismatches during the switchover process.
+                  it can be with a switchover (`switchover`) or in-place (`restart` - default)
                 enum:
                 - switchover
                 - restart
@@ -5748,24 +5430,6 @@ spec:
                               description: Kubelet's generated CSRs will be addressed
                                 to this signer.
                               type: string
-                            userAnnotations:
-                              additionalProperties:
-                                type: string
-                              description: |-
-                                userAnnotations allow pod authors to pass additional information to
-                                the signer implementation.  Kubernetes does not restrict or validate this
-                                metadata in any way.
-
-                                These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of
-                                the PodCertificateRequest objects that Kubelet creates.
-
-                                Entries are subject to the same validation as object metadata annotations,
-                                with the addition that all keys must be domain-prefixed. No restrictions
-                                are placed on values, except an overall size limitation on the entire field.
-
-                                Signers should document the keys and values they support. Signers should
-                                deny requests that contain keys they do not recognize.
-                              type: object
                           required:
                           - keyType
                           - signerName
@@ -6062,199 +5726,6 @@ spec:
                 required:
                 - type
                 type: object
-              securityContext:
-                description: |-
-                  Override the SecurityContext applied to every Container in the Pod of the cluster.
-                  When set, this overrides the operator's default Container SecurityContext.
-                  If omitted, the operator defaults are used.
-                properties:
-                  allowPrivilegeEscalation:
-                    description: |-
-                      AllowPrivilegeEscalation controls whether a process can gain more
-                      privileges than its parent process. This bool directly controls if
-                      the no_new_privs flag will be set on the container process.
-                      AllowPrivilegeEscalation is true always when the container is:
-                      1) run as Privileged
-                      2) has CAP_SYS_ADMIN
-                      Note that this field cannot be set when spec.os.name is windows.
-                    type: boolean
-                  appArmorProfile:
-                    description: |-
-                      appArmorProfile is the AppArmor options to use by this container. If set, this profile
-                      overrides the pod's appArmorProfile.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    properties:
-                      localhostProfile:
-                        description: |-
-                          localhostProfile indicates a profile loaded on the node that should be used.
-                          The profile must be preconfigured on the node to work.
-                          Must match the loaded name of the profile.
-                          Must be set if and only if type is "Localhost".
-                        type: string
-                      type:
-                        description: |-
-                          type indicates which kind of AppArmor profile will be applied.
-                          Valid options are:
-                            Localhost - a profile pre-loaded on the node.
-                            RuntimeDefault - the container runtime's default profile.
-                            Unconfined - no AppArmor enforcement.
-                        type: string
-                    required:
-                    - type
-                    type: object
-                  capabilities:
-                    description: |-
-                      The capabilities to add/drop when running containers.
-                      Defaults to the default set of capabilities granted by the container runtime.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    properties:
-                      add:
-                        description: Added capabilities
-                        items:
-                          description: Capability represent POSIX capabilities type
-                          type: string
-                        type: array
-                        x-kubernetes-list-type: atomic
-                      drop:
-                        description: Removed capabilities
-                        items:
-                          description: Capability represent POSIX capabilities type
-                          type: string
-                        type: array
-                        x-kubernetes-list-type: atomic
-                    type: object
-                  privileged:
-                    description: |-
-                      Run container in privileged mode.
-                      Processes in privileged containers are essentially equivalent to root on the host.
-                      Defaults to false.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    type: boolean
-                  procMount:
-                    description: |-
-                      procMount denotes the type of proc mount to use for the containers.
-                      The default value is Default which uses the container runtime defaults for
-                      readonly paths and masked paths.
-                      This requires the ProcMountType feature flag to be enabled.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    type: string
-                  readOnlyRootFilesystem:
-                    description: |-
-                      Whether this container has a read-only root filesystem.
-                      Default is false.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    type: boolean
-                  runAsGroup:
-                    description: |-
-                      The GID to run the entrypoint of the container process.
-                      Uses runtime default if unset.
-                      May also be set in PodSecurityContext.  If set in both SecurityContext and
-                      PodSecurityContext, the value specified in SecurityContext takes precedence.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    format: int64
-                    type: integer
-                  runAsNonRoot:
-                    description: |-
-                      Indicates that the container must run as a non-root user.
-                      If true, the Kubelet will validate the image at runtime to ensure that it
-                      does not run as UID 0 (root) and fail to start the container if it does.
-                      If unset or false, no such validation will be performed.
-                      May also be set in PodSecurityContext.  If set in both SecurityContext and
-                      PodSecurityContext, the value specified in SecurityContext takes precedence.
-                    type: boolean
-                  runAsUser:
-                    description: |-
-                      The UID to run the entrypoint of the container process.
-                      Defaults to user specified in image metadata if unspecified.
-                      May also be set in PodSecurityContext.  If set in both SecurityContext and
-                      PodSecurityContext, the value specified in SecurityContext takes precedence.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    format: int64
-                    type: integer
-                  seLinuxOptions:
-                    description: |-
-                      The SELinux context to be applied to the container.
-                      If unspecified, the container runtime will allocate a random SELinux context for each
-                      container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
-                      PodSecurityContext, the value specified in SecurityContext takes precedence.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    properties:
-                      level:
-                        description: Level is SELinux level label that applies to
-                          the container.
-                        type: string
-                      role:
-                        description: Role is a SELinux role label that applies to
-                          the container.
-                        type: string
-                      type:
-                        description: Type is a SELinux type label that applies to
-                          the container.
-                        type: string
-                      user:
-                        description: User is a SELinux user label that applies to
-                          the container.
-                        type: string
-                    type: object
-                  seccompProfile:
-                    description: |-
-                      The seccomp options to use by this container. If seccomp options are
-                      provided at both the pod & container level, the container options
-                      override the pod options.
-                      Note that this field cannot be set when spec.os.name is windows.
-                    properties:
-                      localhostProfile:
-                        description: |-
-                          localhostProfile indicates a profile defined in a file on the node should be used.
-                          The profile must be preconfigured on the node to work.
-                          Must be a descending path, relative to the kubelet's configured seccomp profile location.
-                          Must be set if type is "Localhost". Must NOT be set for any other type.
-                        type: string
-                      type:
-                        description: |-
-                          type indicates which kind of seccomp profile will be applied.
-                          Valid options are:
-
-                          Localhost - a profile defined in a file on the node should be used.
-                          RuntimeDefault - the container runtime default profile should be used.
-                          Unconfined - no profile should be applied.
-                        type: string
-                    required:
-                    - type
-                    type: object
-                  windowsOptions:
-                    description: |-
-                      The Windows specific settings applied to all containers.
-                      If unspecified, the options from the PodSecurityContext will be used.
-                      If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
-                      Note that this field cannot be set when spec.os.name is linux.
-                    properties:
-                      gmsaCredentialSpec:
-                        description: |-
-                          GMSACredentialSpec is where the GMSA admission webhook
-                          (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
-                          GMSA credential spec named by the GMSACredentialSpecName field.
-                        type: string
-                      gmsaCredentialSpecName:
-                        description: GMSACredentialSpecName is the name of the GMSA
-                          credential spec to use.
-                        type: string
-                      hostProcess:
-                        description: |-
-                          HostProcess determines if a container should be run as a 'Host Process' container.
-                          All of a Pod's containers must have the same effective HostProcess value
-                          (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
-                          In addition, if HostProcess is true then HostNetwork must also be set to true.
-                        type: boolean
-                      runAsUserName:
-                        description: |-
-                          The UserName in Windows to run the entrypoint of the container process.
-                          Defaults to the user specified in image metadata if unspecified.
-                          May also be set in PodSecurityContext. If set in both SecurityContext and
-                          PodSecurityContext, the value specified in SecurityContext takes precedence.
-                        type: string
-                    type: object
-                type: object
               serviceAccountTemplate:
                 description: Configure the generation of the service account
                 properties:
@@ -6407,7 +5878,7 @@ spec:
                       resources:
                         description: |-
                           resources represents the minimum resources the volume should have.
-                          Users are allowed to specify resource requirements
+                          If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
                           that are lower than previous value but must still be higher than capacity recorded in the
                           status field of the claim.
                           More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -6663,7 +6134,7 @@ spec:
                             resources:
                               description: |-
                                 resources represents the minimum resources the volume should have.
-                                Users are allowed to specify resource requirements
+                                If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
                                 that are lower than previous value but must still be higher than capacity recorded in the
                                 status field of the claim.
                                 More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -7071,7 +6542,7 @@ spec:
                       resources:
                         description: |-
                           resources represents the minimum resources the volume should have.
-                          Users are allowed to specify resource requirements
+                          If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
                           that are lower than previous value but must still be higher than capacity recorded in the
                           status field of the claim.
                           More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -7787,7 +7258,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   name: databases.postgresql.cnpg.io
 spec:
@@ -7917,16 +7388,16 @@ spec:
                     ensure:
                       default: present
                       description: |-
-                        Specifies whether an object (e.g schema) should be present or absent
-                        in the database. If set to `present`, the object will be created if
-                        it does not exist. If set to `absent`, the extension/schema will be
-                        removed if it exists.
+                        Specifies whether an extension/schema should be present or absent in
+                        the database. If set to `present`, the extension/schema will be
+                        created if it does not exist. If set to `absent`, the
+                        extension/schema will be removed if it exists.
                       enum:
                       - present
                       - absent
                       type: string
                     name:
-                      description: Name of the object (extension, schema, FDW, server)
+                      description: Name of the extension/schema
                       type: string
                     schema:
                       description: |-
@@ -7946,100 +7417,6 @@ spec:
                   - name
                   type: object
                 type: array
-              fdws:
-                description: The list of foreign data wrappers to be managed in the
-                  database
-                items:
-                  description: FDWSpec configures an Foreign Data Wrapper in a database
-                  properties:
-                    ensure:
-                      default: present
-                      description: |-
-                        Specifies whether an object (e.g schema) should be present or absent
-                        in the database. If set to `present`, the object will be created if
-                        it does not exist. If set to `absent`, the extension/schema will be
-                        removed if it exists.
-                      enum:
-                      - present
-                      - absent
-                      type: string
-                    handler:
-                      description: |-
-                        Name of the handler function (e.g., "postgres_fdw_handler").
-                        This will be empty if no handler is specified. In that case,
-                        the default handler is registered when the FDW extension is created.
-                      type: string
-                    name:
-                      description: Name of the object (extension, schema, FDW, server)
-                      type: string
-                    options:
-                      description: Options specifies the configuration options for
-                        the FDW.
-                      items:
-                        description: OptionSpec holds the name, value and the ensure
-                          field for an option
-                        properties:
-                          ensure:
-                            default: present
-                            description: |-
-                              Specifies whether an option should be present or absent in
-                              the database. If set to `present`, the option will be
-                              created if it does not exist. If set to `absent`, the
-                              option will be removed if it exists.
-                            enum:
-                            - present
-                            - absent
-                            type: string
-                          name:
-                            description: Name of the option
-                            type: string
-                          value:
-                            description: Value of the option
-                            type: string
-                        required:
-                        - name
-                        - value
-                        type: object
-                      type: array
-                    owner:
-                      description: |-
-                        Owner specifies the database role that will own the Foreign Data Wrapper.
-                        The role must have superuser privileges in the target database.
-                      type: string
-                    usage:
-                      description: List of roles for which `USAGE` privileges on the
-                        FDW are granted or revoked.
-                      items:
-                        description: UsageSpec configures a usage for a foreign data
-                          wrapper
-                        properties:
-                          name:
-                            description: Name of the usage
-                            type: string
-                            x-kubernetes-validations:
-                            - message: name is required
-                              rule: self != ''
-                          type:
-                            default: grant
-                            description: The type of usage
-                            enum:
-                            - grant
-                            - revoke
-                            type: string
-                        required:
-                        - name
-                        type: object
-                      type: array
-                    validator:
-                      description: |-
-                        Name of the validator function (e.g., "postgres_fdw_validator").
-                        This will be empty if no validator is specified. In that case,
-                        the default validator is registered when the FDW extension is created.
-                      type: string
-                  required:
-                  - name
-                  type: object
-                type: array
               icuLocale:
                 description: |-
                   Maps to the `ICU_LOCALE` parameter of `CREATE DATABASE`. This
@@ -8127,16 +7504,16 @@ spec:
                     ensure:
                       default: present
                       description: |-
-                        Specifies whether an object (e.g schema) should be present or absent
-                        in the database. If set to `present`, the object will be created if
-                        it does not exist. If set to `absent`, the extension/schema will be
-                        removed if it exists.
+                        Specifies whether an extension/schema should be present or absent in
+                        the database. If set to `present`, the extension/schema will be
+                        created if it does not exist. If set to `absent`, the
+                        extension/schema will be removed if it exists.
                       enum:
                       - present
                       - absent
                       type: string
                     name:
-                      description: Name of the object (extension, schema, FDW, server)
+                      description: Name of the extension/schema
                       type: string
                     owner:
                       description: |-
@@ -8148,90 +7525,6 @@ spec:
                   - name
                   type: object
                 type: array
-              servers:
-                description: The list of foreign servers to be managed in the database
-                items:
-                  description: ServerSpec configures a server of a foreign data wrapper
-                  properties:
-                    ensure:
-                      default: present
-                      description: |-
-                        Specifies whether an object (e.g schema) should be present or absent
-                        in the database. If set to `present`, the object will be created if
-                        it does not exist. If set to `absent`, the extension/schema will be
-                        removed if it exists.
-                      enum:
-                      - present
-                      - absent
-                      type: string
-                    fdw:
-                      description: The name of the Foreign Data Wrapper (FDW)
-                      type: string
-                      x-kubernetes-validations:
-                      - message: fdw is required
-                        rule: self != ''
-                    name:
-                      description: Name of the object (extension, schema, FDW, server)
-                      type: string
-                    options:
-                      description: |-
-                        Options specifies the configuration options for the server
-                        (key is the option name, value is the option value).
-                      items:
-                        description: OptionSpec holds the name, value and the ensure
-                          field for an option
-                        properties:
-                          ensure:
-                            default: present
-                            description: |-
-                              Specifies whether an option should be present or absent in
-                              the database. If set to `present`, the option will be
-                              created if it does not exist. If set to `absent`, the
-                              option will be removed if it exists.
-                            enum:
-                            - present
-                            - absent
-                            type: string
-                          name:
-                            description: Name of the option
-                            type: string
-                          value:
-                            description: Value of the option
-                            type: string
-                        required:
-                        - name
-                        - value
-                        type: object
-                      type: array
-                    usage:
-                      description: List of roles for which `USAGE` privileges on the
-                        server are granted or revoked.
-                      items:
-                        description: UsageSpec configures a usage for a foreign data
-                          wrapper
-                        properties:
-                          name:
-                            description: Name of the usage
-                            type: string
-                            x-kubernetes-validations:
-                            - message: name is required
-                              rule: self != ''
-                          type:
-                            default: grant
-                            description: The type of usage
-                            enum:
-                            - grant
-                            - revoke
-                            type: string
-                        required:
-                        - name
-                        type: object
-                      type: array
-                  required:
-                  - fdw
-                  - name
-                  type: object
-                type: array
               tablespace:
                 description: |-
                   Maps to the `TABLESPACE` parameter of `CREATE DATABASE`.
@@ -8293,28 +7586,6 @@ spec:
                   - name
                   type: object
                 type: array
-              fdws:
-                description: FDWs is the status of the managed FDWs
-                items:
-                  description: DatabaseObjectStatus is the status of the managed database
-                    objects
-                  properties:
-                    applied:
-                      description: |-
-                        True of the object has been installed successfully in
-                        the database
-                      type: boolean
-                    message:
-                      description: Message is the object reconciliation message
-                      type: string
-                    name:
-                      description: The name of the object
-                      type: string
-                  required:
-                  - applied
-                  - name
-                  type: object
-                type: array
               message:
                 description: Message is the reconciliation output message
                 type: string
@@ -8346,28 +7617,6 @@ spec:
                   - name
                   type: object
                 type: array
-              servers:
-                description: Servers is the status of the managed servers
-                items:
-                  description: DatabaseObjectStatus is the status of the managed database
-                    objects
-                  properties:
-                    applied:
-                      description: |-
-                        True of the object has been installed successfully in
-                        the database
-                      type: boolean
-                    message:
-                      description: Message is the object reconciliation message
-                      type: string
-                    name:
-                      description: The name of the object
-                      type: string
-                  required:
-                  - applied
-                  - name
-                  type: object
-                type: array
             type: object
         required:
         - metadata
@@ -8382,7 +7631,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   name: failoverquorums.postgresql.cnpg.io
 spec:
@@ -8460,7 +7709,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   name: imagecatalogs.postgresql.cnpg.io
 spec:
@@ -8541,7 +7790,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   name: poolers.postgresql.cnpg.io
 spec:
@@ -8858,30 +8107,6 @@ spec:
                       query. In case it is specified, also an AuthQuery
                       (e.g. "SELECT usename, passwd FROM pg_catalog.pg_shadow WHERE usename=$1")
                       has to be specified and no automatic CNPG Cluster integration will be triggered.
-
-                      Deprecated.
-                    properties:
-                      name:
-                        description: Name of the referent.
-                        type: string
-                    required:
-                    - name
-                    type: object
-                  clientCASecret:
-                    description: |-
-                      ClientCASecret provides PgBouncer’s client_tls_ca_file, the root
-                      CA for validating client certificates
-                    properties:
-                      name:
-                        description: Name of the referent.
-                        type: string
-                    required:
-                    - name
-                    type: object
-                  clientTLSSecret:
-                    description: |-
-                      ClientTLSSecret provides PgBouncer’s client_tls_key_file (private key)
-                      and client_tls_cert_file (certificate) used to accept client connections
                     properties:
                       name:
                         description: Name of the referent.
@@ -8918,29 +8143,6 @@ spec:
                     - session
                     - transaction
                     type: string
-                  serverCASecret:
-                    description: |-
-                      ServerCASecret provides PgBouncer’s server_tls_ca_file, the root
-                      CA for validating PostgreSQL certificates
-                    properties:
-                      name:
-                        description: Name of the referent.
-                        type: string
-                    required:
-                    - name
-                    type: object
-                  serverTLSSecret:
-                    description: |-
-                      ServerTLSSecret, when pointing to a TLS secret, provides pgbouncer's
-                      `server_tls_key_file` and `server_tls_cert_file`, used when
-                      authenticating against PostgreSQL.
-                    properties:
-                      name:
-                        description: Name of the referent.
-                        type: string
-                    required:
-                    - name
-                    type: object
                 type: object
               serviceTemplate:
                 description: Template for the Service to be created
@@ -11173,9 +10375,7 @@ spec:
                                   type: integer
                               type: object
                             resizePolicy:
-                              description: |-
-                                Resources resize policy for the container.
-                                This field cannot be set on ephemeral containers.
+                              description: Resources resize policy for the container.
                               items:
                                 description: ContainerResizePolicy represents resource
                                   resize policy for the container.
@@ -14398,9 +13598,7 @@ spec:
                                   type: integer
                               type: object
                             resizePolicy:
-                              description: |-
-                                Resources resize policy for the container.
-                                This field cannot be set on ephemeral containers.
+                              description: Resources resize policy for the container.
                               items:
                                 description: ContainerResizePolicy represents resource
                                   resize policy for the container.
@@ -15187,8 +14385,8 @@ spec:
                           will be made available to those containers which consume them
                           by name.
 
-                          This is a stable field but requires that the
-                          DynamicResourceAllocation feature gate is enabled.
+                          This is an alpha field and requires enabling the
+                          DynamicResourceAllocation feature gate.
 
                           This field is immutable.
                         items:
@@ -15647,10 +14845,9 @@ spec:
                             operator:
                               description: |-
                                 Operator represents a key's relationship to the value.
-                                Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
+                                Valid operators are Exists and Equal. Defaults to Equal.
                                 Exists is equivalent to wildcard for value, so that a pod can
                                 tolerate all taints of a particular category.
-                                Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                               type: string
                             tolerationSeconds:
                               description: |-
@@ -16444,7 +15641,7 @@ spec:
                                         resources:
                                           description: |-
                                             resources represents the minimum resources the volume should have.
-                                            Users are allowed to specify resource requirements
+                                            If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
                                             that are lower than previous value but must still be higher than capacity recorded in the
                                             status field of the claim.
                                             More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -17330,24 +16527,6 @@ spec:
                                             description: Kubelet's generated CSRs
                                               will be addressed to this signer.
                                             type: string
-                                          userAnnotations:
-                                            additionalProperties:
-                                              type: string
-                                            description: |-
-                                              userAnnotations allow pod authors to pass additional information to
-                                              the signer implementation.  Kubernetes does not restrict or validate this
-                                              metadata in any way.
-
-                                              These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of
-                                              the PodCertificateRequest objects that Kubelet creates.
-
-                                              Entries are subject to the same validation as object metadata annotations,
-                                              with the addition that all keys must be domain-prefixed. No restrictions
-                                              are placed on values, except an overall size limitation on the entire field.
-
-                                              Signers should document the keys and values they support. Signers should
-                                              deny requests that contain keys they do not recognize.
-                                            type: object
                                         required:
                                         - keyType
                                         - signerName
@@ -17773,42 +16952,6 @@ spec:
                         x-kubernetes-list-map-keys:
                         - name
                         x-kubernetes-list-type: map
-                      workloadRef:
-                        description: |-
-                          WorkloadRef provides a reference to the Workload object that this Pod belongs to.
-                          This field is used by the scheduler to identify the PodGroup and apply the
-                          correct group scheduling policies. The Workload object referenced
-                          by this field may not exist at the time the Pod is created.
-                          This field is immutable, but a Workload object with the same name
-                          may be recreated with different policies. Doing this during pod scheduling
-                          may result in the placement not conforming to the expected policies.
-                        properties:
-                          name:
-                            description: |-
-                              Name defines the name of the Workload object this Pod belongs to.
-                              Workload must be in the same namespace as the Pod.
-                              If it doesn't match any existing Workload, the Pod will remain unschedulable
-                              until a Workload object is created and observed by the kube-scheduler.
-                              It must be a DNS subdomain.
-                            type: string
-                          podGroup:
-                            description: |-
-                              PodGroup is the name of the PodGroup within the Workload that this Pod
-                              belongs to. If it doesn't match any existing PodGroup within the Workload,
-                              the Pod will remain unschedulable until the Workload object is recreated
-                              and observed by the kube-scheduler. It must be a DNS label.
-                            type: string
-                          podGroupReplicaKey:
-                            description: |-
-                              PodGroupReplicaKey specifies the replica key of the PodGroup to which this
-                              Pod belongs. It is used to distinguish pods belonging to different replicas
-                              of the same pod group. The pod group policy is applied separately to each replica.
-                              When set, it must be a DNS label.
-                            type: string
-                        required:
-                        - name
-                        - podGroup
-                        type: object
                     required:
                     - containers
                     type: object
@@ -17848,16 +16991,6 @@ spec:
                         description: The ResourceVersion of the secret
                         type: string
                     type: object
-                  clientTLS:
-                    description: The client TLS secret version
-                    properties:
-                      name:
-                        description: The name of the secret
-                        type: string
-                      version:
-                        description: The ResourceVersion of the secret
-                        type: string
-                    type: object
                   pgBouncerSecrets:
                     description: The version of the secrets used by PgBouncer
                     properties:
@@ -17910,7 +17043,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   name: publications.postgresql.cnpg.io
 spec:
@@ -18106,7 +17239,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   name: scheduledbackups.postgresql.cnpg.io
 spec:
@@ -18298,7 +17431,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   name: subscriptions.postgresql.cnpg.io
 spec:
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/deployment.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/templates/deployment.yaml
index c17e6a74..760b3768 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/deployment.yaml
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/deployment.yaml
@@ -101,7 +101,7 @@ spec:
         livenessProbe:
           httpGet:
             path: /readyz
-            port: webhook-server
+            port: {{ .Values.webhook.port }}
             scheme: HTTPS
           {{- if .Values.webhook.livenessProbe.initialDelaySeconds }}
           initialDelaySeconds: {{ .Values.webhook.livenessProbe.initialDelaySeconds }}
@@ -117,7 +117,7 @@ spec:
         readinessProbe:
           httpGet:
             path: /readyz
-            port: webhook-server
+            port: {{ .Values.webhook.port }}
             scheme: HTTPS
           {{- if .Values.webhook.readinessProbe.initialDelaySeconds }}
           initialDelaySeconds: {{ .Values.webhook.readinessProbe.initialDelaySeconds }}
@@ -132,7 +132,7 @@ spec:
           {{- end }}
           httpGet:
             path: /readyz
-            port: webhook-server
+            port: {{ .Values.webhook.port }}
             scheme: HTTPS
           {{- if .Values.webhook.startupProbe.periodSeconds }}
           periodSeconds: {{ .Values.webhook.startupProbe.periodSeconds }}
diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/values.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/values.yaml
index f437a5ee..cbba7505 100644
--- a/packages/system/postgres-operator/charts/cloudnative-pg/values.yaml
+++ b/packages/system/postgres-operator/charts/cloudnative-pg/values.yaml
@@ -26,8 +26,7 @@ image:
   repository: ghcr.io/cloudnative-pg/cloudnative-pg
   pullPolicy: IfNotPresent
   # -- Overrides the image tag whose default is the chart appVersion.
-  # tag: ""
-  tag: "1.27.3"
+  tag: ""
 
 imagePullSecrets: []
 nameOverride: ""
@@ -211,30 +210,30 @@ monitoringQueriesConfigMap:
   queries: |
     backends:
       query: |
-        SELECT sa.datname
-          , sa.usename
-          , sa.application_name
-          , states.state
-          , COALESCE(sa.count, 0) AS total
-          , COALESCE(sa.max_tx_secs, 0) AS max_tx_duration_seconds
-        FROM ( VALUES ('active')
-          , ('idle')
-          , ('idle in transaction')
-          , ('idle in transaction (aborted)')
-          , ('fastpath function call')
-          , ('disabled')
-          ) AS states(state)
-        LEFT JOIN (
-          SELECT datname
-            , state
-            , usename
-            , COALESCE(application_name, '') AS application_name
-            , COUNT(*)
-            , COALESCE(EXTRACT (EPOCH FROM (max(now() - xact_start))), 0) AS max_tx_secs
-          FROM pg_catalog.pg_stat_activity
-          GROUP BY datname, state, usename, application_name
-        ) sa ON states.state = sa.state
-        WHERE sa.usename IS NOT NULL
+       SELECT sa.datname
+           , sa.usename
+           , sa.application_name
+           , states.state
+           , COALESCE(sa.count, 0) AS total
+           , COALESCE(sa.max_tx_secs, 0) AS max_tx_duration_seconds
+           FROM ( VALUES ('active')
+               , ('idle')
+               , ('idle in transaction')
+               , ('idle in transaction (aborted)')
+               , ('fastpath function call')
+               , ('disabled')
+               ) AS states(state)
+           LEFT JOIN (
+               SELECT datname
+                   , state
+                   , usename
+                   , COALESCE(application_name, '') AS application_name
+                   , COUNT(*)
+                   , COALESCE(EXTRACT (EPOCH FROM (max(now() - xact_start))), 0) AS max_tx_secs
+               FROM pg_catalog.pg_stat_activity
+               GROUP BY datname, state, usename, application_name
+           ) sa ON states.state = sa.state
+           WHERE sa.usename IS NOT NULL
       metrics:
         - datname:
             usage: "LABEL"
@@ -257,22 +256,22 @@ monitoringQueriesConfigMap:
 
     backends_waiting:
       query: |
-        SELECT count(*) AS total
-        FROM pg_catalog.pg_locks blocked_locks
-        JOIN pg_catalog.pg_locks blocking_locks
-          ON blocking_locks.locktype = blocked_locks.locktype
-          AND blocking_locks.database IS NOT DISTINCT FROM blocked_locks.database
-          AND blocking_locks.relation IS NOT DISTINCT FROM blocked_locks.relation
-          AND blocking_locks.page IS NOT DISTINCT FROM blocked_locks.page
-          AND blocking_locks.tuple IS NOT DISTINCT FROM blocked_locks.tuple
-          AND blocking_locks.virtualxid IS NOT DISTINCT FROM blocked_locks.virtualxid
-          AND blocking_locks.transactionid IS NOT DISTINCT FROM blocked_locks.transactionid
-          AND blocking_locks.classid IS NOT DISTINCT FROM blocked_locks.classid
-          AND blocking_locks.objid IS NOT DISTINCT FROM blocked_locks.objid
-          AND blocking_locks.objsubid IS NOT DISTINCT FROM blocked_locks.objsubid
-          AND blocking_locks.pid != blocked_locks.pid
-        JOIN pg_catalog.pg_stat_activity blocking_activity ON blocking_activity.pid = blocking_locks.pid
-        WHERE NOT blocked_locks.granted
+       SELECT count(*) AS total
+       FROM pg_catalog.pg_locks blocked_locks
+       JOIN pg_catalog.pg_locks blocking_locks
+         ON blocking_locks.locktype = blocked_locks.locktype
+         AND blocking_locks.database IS NOT DISTINCT FROM blocked_locks.database
+         AND blocking_locks.relation IS NOT DISTINCT FROM blocked_locks.relation
+         AND blocking_locks.page IS NOT DISTINCT FROM blocked_locks.page
+         AND blocking_locks.tuple IS NOT DISTINCT FROM blocked_locks.tuple
+         AND blocking_locks.virtualxid IS NOT DISTINCT FROM blocked_locks.virtualxid
+         AND blocking_locks.transactionid IS NOT DISTINCT FROM blocked_locks.transactionid
+         AND blocking_locks.classid IS NOT DISTINCT FROM blocked_locks.classid
+         AND blocking_locks.objid IS NOT DISTINCT FROM blocked_locks.objid
+         AND blocking_locks.objsubid IS NOT DISTINCT FROM blocked_locks.objsubid
+         AND blocking_locks.pid != blocked_locks.pid
+       JOIN pg_catalog.pg_stat_activity blocking_activity ON blocking_activity.pid = blocking_locks.pid
+       WHERE NOT blocked_locks.granted
       metrics:
         - total:
             usage: "GAUGE"
@@ -310,17 +309,16 @@ monitoringQueriesConfigMap:
             description: "Time at which postgres started (based on epoch)"
 
     pg_replication:
-      query: |
-        SELECT CASE WHEN (
-            NOT pg_catalog.pg_is_in_recovery()
-            OR pg_catalog.pg_last_wal_receive_lsn() = pg_catalog.pg_last_wal_replay_lsn())
-          THEN 0
-          ELSE GREATEST (0,
-            EXTRACT(EPOCH FROM (now() - pg_catalog.pg_last_xact_replay_timestamp())))
-          END AS lag,
-          pg_catalog.pg_is_in_recovery() AS in_recovery,
-          EXISTS (TABLE pg_stat_wal_receiver) AS is_wal_receiver_up,
-          (SELECT count(*) FROM pg_catalog.pg_stat_replication) AS streaming_replicas
+      query: "SELECT CASE WHEN (
+                NOT pg_catalog.pg_is_in_recovery()
+                OR pg_catalog.pg_last_wal_receive_lsn() = pg_catalog.pg_last_wal_replay_lsn())
+              THEN 0
+              ELSE GREATEST (0,
+                EXTRACT(EPOCH FROM (now() - pg_catalog.pg_last_xact_replay_timestamp())))
+              END AS lag,
+              pg_catalog.pg_is_in_recovery() AS in_recovery,
+              EXISTS (TABLE pg_stat_wal_receiver) AS is_wal_receiver_up,
+              (SELECT count(*) FROM pg_catalog.pg_stat_replication) AS streaming_replicas"
       metrics:
         - lag:
             usage: "GAUGE"
@@ -376,9 +374,6 @@ monitoringQueriesConfigMap:
           , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_failed_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_failed_wal_start_lsn
           , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time
         FROM pg_catalog.pg_stat_archiver
-      predicate_query: |
-        SELECT NOT pg_catalog.pg_is_in_recovery()
-          OR pg_catalog.current_setting('archive_mode') = 'always'
       metrics:
         - archived_count:
             usage: "COUNTER"
@@ -591,20 +586,20 @@ monitoringQueriesConfigMap:
     pg_stat_replication:
       primary: true
       query: |
-        SELECT usename
-          , COALESCE(application_name, '') AS application_name
-          , COALESCE(client_addr::text, '') AS client_addr
-          , COALESCE(client_port::text, '') AS client_port
-          , EXTRACT(EPOCH FROM backend_start) AS backend_start
-          , COALESCE(pg_catalog.age(backend_xmin), 0) AS backend_xmin_age
-          , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), sent_lsn) AS sent_diff_bytes
-          , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), write_lsn) AS write_diff_bytes
-          , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), flush_lsn) AS flush_diff_bytes
-          , COALESCE(pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), replay_lsn),0) AS replay_diff_bytes
-          , COALESCE((EXTRACT(EPOCH FROM write_lag)),0)::float AS write_lag_seconds
-          , COALESCE((EXTRACT(EPOCH FROM flush_lag)),0)::float AS flush_lag_seconds
-          , COALESCE((EXTRACT(EPOCH FROM replay_lag)),0)::float AS replay_lag_seconds
-        FROM pg_catalog.pg_stat_replication
+       SELECT usename
+         , COALESCE(application_name, '') AS application_name
+         , COALESCE(client_addr::text, '') AS client_addr
+         , COALESCE(client_port::text, '') AS client_port
+         , EXTRACT(EPOCH FROM backend_start) AS backend_start
+         , COALESCE(pg_catalog.age(backend_xmin), 0) AS backend_xmin_age
+         , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), sent_lsn) AS sent_diff_bytes
+         , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), write_lsn) AS write_diff_bytes
+         , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), flush_lsn) AS flush_diff_bytes
+         , COALESCE(pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), replay_lsn),0) AS replay_diff_bytes
+         , COALESCE((EXTRACT(EPOCH FROM write_lag)),0)::float AS write_lag_seconds
+         , COALESCE((EXTRACT(EPOCH FROM flush_lag)),0)::float AS flush_lag_seconds
+         , COALESCE((EXTRACT(EPOCH FROM replay_lag)),0)::float AS replay_lag_seconds
+       FROM pg_catalog.pg_stat_replication
       metrics:
         - usename:
             usage: "LABEL"
@@ -664,13 +659,13 @@ monitoringQueriesConfigMap:
     pg_extensions:
       query: |
         SELECT
-          current_database() as datname,
-          name as extname,
-          default_version,
-          installed_version,
-          CASE
-            WHEN default_version = installed_version THEN 0
-            ELSE 1
+         current_database() as datname,
+         name as extname,
+         default_version,
+         installed_version,
+         CASE
+           WHEN default_version = installed_version THEN 0
+           ELSE 1
         END AS update_available
         FROM pg_catalog.pg_available_extensions
         WHERE installed_version IS NOT NULL
diff --git a/packages/system/postgres-operator/values.yaml b/packages/system/postgres-operator/values.yaml
index 6bc9595b..cae3dc53 100644
--- a/packages/system/postgres-operator/values.yaml
+++ b/packages/system/postgres-operator/values.yaml
@@ -1,3 +1,5 @@
 cloudnative-pg:
   crds:
     create: true
+  image:
+    tag: "1.27.3"

From bb5ee3ea4a67a6bfbb4f5a5ca92ace9e1a43472a Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Tue, 17 Mar 2026 12:35:39 +0500
Subject: [PATCH 276/666] [dashboard] Add secret-hash annotation to
 KeycloakClient for secret sync
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add secret-hash annotation to the dashboard KeycloakClient CRD resource
so that when the Kubernetes Secret value changes, the operator detects
the CRD update and reconciles the client secret in Keycloak.

Without this annotation, if the dashboard-client Secret is recreated
with a new value (e.g. after upgrade), the KeycloakClient spec remains
unchanged, the operator skips reconciliation, and Keycloak retains the
stale secret — causing authentication failures for the dashboard.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/system/dashboard/templates/keycloakclient.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/packages/system/dashboard/templates/keycloakclient.yaml b/packages/system/dashboard/templates/keycloakclient.yaml
index c9c17090..fa33fea4 100644
--- a/packages/system/dashboard/templates/keycloakclient.yaml
+++ b/packages/system/dashboard/templates/keycloakclient.yaml
@@ -49,6 +49,8 @@ apiVersion: v1.edp.epam.com/v1
 kind: KeycloakClient
 metadata:
   name: dashboard-client
+  annotations:
+    secret-hash: {{ $dashboardClient | sha256sum }}
 spec:
   serviceAccount:
     enabled: true

From 398ca5844aa84c07244b29be78636209df2923ca Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Tue, 17 Mar 2026 12:53:37 +0500
Subject: [PATCH 277/666] [dashboard] Add missing baseFactoriesMapping for
 backup resources

Backup resources (plans, backupjobs, backups) are not
ApplicationDefinitions, so ensureNavigation() never adds their
baseFactoriesMapping entries. Without these mappings the OpenUI
frontend cannot resolve the {cluster} context for backup pages,
producing broken sidebar links with an empty cluster segment
(e.g. /openapi-ui//tenant-root/...).

Add the three missing entries to the static Navigation resource.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 internal/controller/dashboard/static_refactored.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/internal/controller/dashboard/static_refactored.go b/internal/controller/dashboard/static_refactored.go
index e48552af..ae2a35d3 100644
--- a/internal/controller/dashboard/static_refactored.go
+++ b/internal/controller/dashboard/static_refactored.go
@@ -1985,6 +1985,10 @@ func CreateAllNavigations() []*dashboardv1alpha1.Navigation {
 		// Namespaced API resources
 		"base-factory-namespaced-api-networking.k8s.io-v1-ingresses":         "kube-ingress-details",
 		"base-factory-namespaced-api-cozystack.io-v1alpha1-workloadmonitors": "workloadmonitor-details",
+		// Backup resources (not ApplicationDefinitions, so ensureNavigation doesn't cover them)
+		"base-factory-namespaced-api-backups.cozystack.io-v1alpha1-plans":      "plan-details",
+		"base-factory-namespaced-api-backups.cozystack.io-v1alpha1-backupjobs": "backupjob-details",
+		"base-factory-namespaced-api-backups.cozystack.io-v1alpha1-backups":    "backup-details",
 	}
 
 	return []*dashboardv1alpha1.Navigation{

From ed8ba3beec3a1747633d83c8ef6ef4fdea7c8561 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Tue, 17 Mar 2026 13:21:28 +0500
Subject: [PATCH 278/666] fix(etcd): add protective limits to defrag CronJob

Without concurrencyPolicy and job limits, the defrag CronJob can
accumulate hundreds of running/failed pods during cluster upgrades
when etcd is temporarily unavailable. This was observed after
upgrading to v1.1.2 where defrag jobs piled up across tenants.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/extra/etcd/templates/etcd-defrag.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/packages/extra/etcd/templates/etcd-defrag.yaml b/packages/extra/etcd/templates/etcd-defrag.yaml
index 089df920..0478129f 100644
--- a/packages/extra/etcd/templates/etcd-defrag.yaml
+++ b/packages/extra/etcd/templates/etcd-defrag.yaml
@@ -4,9 +4,14 @@ metadata:
   name: {{ .Release.Name }}-defrag
 spec:
   schedule: "0 * * * *"
+  concurrencyPolicy: Forbid
+  startingDeadlineSeconds: 300
   successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 1
   jobTemplate:
     spec:
+      activeDeadlineSeconds: 1800
+      backoffLimit: 2
       template:
         spec:
           containers:

From bb660b57c77f2d6c97d02182bfcda066a86b11b2 Mon Sep 17 00:00:00 2001
From: Matthieu <matthieu@hidora.com>
Date: Tue, 17 Mar 2026 11:20:44 +0100
Subject: [PATCH 279/666] [opensearch] Address PR review feedback

Remove sysctl DaemonSet in favor of operator's built-in setVMMaxMapCount
init container, fix schema conflicts with required+empty default, fix
update-versions.sh YAML output format, and use $(MAKE) in Makefile.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Matthieu <matthieu@hidora.com>
---
 packages/apps/opensearch/Makefile             |  2 +-
 .../apps/opensearch/hack/update-versions.sh   |  2 +-
 .../apps/opensearch/templates/opensearch.yaml |  1 +
 packages/apps/opensearch/values.schema.json   | 14 ----
 .../templates/sysctl-daemonset.yaml           | 64 -------------------
 .../opensearch-rd/cozyrds/opensearch.yaml     |  2 +-
 6 files changed, 4 insertions(+), 81 deletions(-)
 delete mode 100644 packages/system/opensearch-operator/templates/sysctl-daemonset.yaml

diff --git a/packages/apps/opensearch/Makefile b/packages/apps/opensearch/Makefile
index 9440c3fd..937c7d41 100644
--- a/packages/apps/opensearch/Makefile
+++ b/packages/apps/opensearch/Makefile
@@ -8,4 +8,4 @@ generate:
 
 update:
 	hack/update-versions.sh
-	make generate
+	$(MAKE) generate
diff --git a/packages/apps/opensearch/hack/update-versions.sh b/packages/apps/opensearch/hack/update-versions.sh
index 19d9e7b2..b2c4c946 100755
--- a/packages/apps/opensearch/hack/update-versions.sh
+++ b/packages/apps/opensearch/hack/update-versions.sh
@@ -42,7 +42,7 @@ for MAJOR in $SUPPORTED_MAJOR_VERSIONS; do
 
     if [ -n "$LATEST" ]; then
         echo "v${MAJOR}: latest tag is ${LATEST}"
-        echo "\"v${MAJOR}\": \"${LATEST}\"" >> "${VERSIONS_FILE}"
+        echo "v${MAJOR}: \"${LATEST}\"" >> "${VERSIONS_FILE}"
     else
         echo "WARNING: No stable release found for major version ${MAJOR}" >&2
     fi
diff --git a/packages/apps/opensearch/templates/opensearch.yaml b/packages/apps/opensearch/templates/opensearch.yaml
index 9917cf5f..6eaee86d 100644
--- a/packages/apps/opensearch/templates/opensearch.yaml
+++ b/packages/apps/opensearch/templates/opensearch.yaml
@@ -13,6 +13,7 @@ spec:
     serviceName: {{ .Release.Name }}
     version: {{ include "opensearch.versionMap" $ }}
     httpPort: 9200
+    setVMMaxMapCount: true
     drainDataNodes: true
     {{- if gt (len .Values.images.opensearch) 0 }}
     image: {{ .Values.images.opensearch }}
diff --git a/packages/apps/opensearch/values.schema.json b/packages/apps/opensearch/values.schema.json
index 54a6bb00..059ef6da 100644
--- a/packages/apps/opensearch/values.schema.json
+++ b/packages/apps/opensearch/values.schema.json
@@ -6,11 +6,6 @@
       "description": "OpenSearch Dashboards configuration.",
       "type": "object",
       "default": {},
-      "required": [
-        "enabled",
-        "replicas",
-        "resourcesPreset"
-      ],
       "properties": {
         "enabled": {
           "description": "Enable OpenSearch Dashboards deployment.",
@@ -80,9 +75,6 @@
       "description": "Container images used by the operator.",
       "type": "object",
       "default": {},
-      "required": [
-        "opensearch"
-      ],
       "properties": {
         "opensearch": {
           "description": "OpenSearch image.",
@@ -95,12 +87,6 @@
       "description": "Node roles configuration.",
       "type": "object",
       "default": {},
-      "required": [
-        "data",
-        "ingest",
-        "master",
-        "ml"
-      ],
       "properties": {
         "data": {
           "description": "Enable data role.",
diff --git a/packages/system/opensearch-operator/templates/sysctl-daemonset.yaml b/packages/system/opensearch-operator/templates/sysctl-daemonset.yaml
deleted file mode 100644
index 5c549b25..00000000
--- a/packages/system/opensearch-operator/templates/sysctl-daemonset.yaml
+++ /dev/null
@@ -1,64 +0,0 @@
----
-# DaemonSet to configure vm.max_map_count on all nodes for OpenSearch
-# This runs once on each node to ensure the kernel parameter is set
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: {{ .Release.Name }}-sysctl-setter
-  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}-sysctl-setter
-    app.kubernetes.io/component: sysctl
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: {{ .Release.Name }}-sysctl-setter
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: {{ .Release.Name }}-sysctl-setter
-    spec:
-      initContainers:
-        - name: sysctl
-          image: busybox:1.36
-          securityContext:
-            privileged: true
-          resources:
-            requests:
-              cpu: 1m
-              memory: 1Mi
-            limits:
-              cpu: 50m
-              memory: 16Mi
-          command:
-            - sh
-            - -c
-            - |
-              sysctl -w vm.max_map_count=262144
-              # Keep the value persistent by writing to sysctl.conf if writable
-              if [ -w /host-etc/sysctl.conf ]; then
-                grep -q "vm.max_map_count" /host-etc/sysctl.conf || echo "vm.max_map_count=262144" >> /host-etc/sysctl.conf
-              fi
-          volumeMounts:
-            - name: host-etc
-              mountPath: /host-etc
-              readOnly: false
-      containers:
-        - name: pause
-          image: registry.k8s.io/pause:3.9
-          resources:
-            requests:
-              cpu: 1m
-              memory: 1Mi
-            limits:
-              cpu: 10m
-              memory: 10Mi
-      volumes:
-        - name: host-etc
-          hostPath:
-            path: /etc
-            type: Directory
-      tolerations:
-        - operator: Exists
-          effect: NoSchedule
-        - operator: Exists
-          effect: NoExecute
diff --git a/packages/system/opensearch-rd/cozyrds/opensearch.yaml b/packages/system/opensearch-rd/cozyrds/opensearch.yaml
index be15d8a1..9a2866de 100644
--- a/packages/system/opensearch-rd/cozyrds/opensearch.yaml
+++ b/packages/system/opensearch-rd/cozyrds/opensearch.yaml
@@ -8,7 +8,7 @@ spec:
     singular: opensearch
     plural: opensearches
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"dashboards":{"description":"OpenSearch Dashboards configuration.","type":"object","default":{},"required":["enabled","replicas","resourcesPreset"],"properties":{"enabled":{"description":"Enable OpenSearch Dashboards deployment.","type":"boolean","default":false},"replicas":{"description":"Number of Dashboards replicas.","type":"integer","default":1},"resources":{"description":"Explicit CPU and memory configuration for Dashboards.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset for Dashboards.","type":"string","default":"medium","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"images":{"description":"Container images used by the operator.","type":"object","default":{},"required":["opensearch"],"properties":{"opensearch":{"description":"OpenSearch image.","type":"string","default":""}}},"nodeRoles":{"description":"Node roles configuration.","type":"object","default":{},"required":["data","ingest","master","ml"],"properties":{"data":{"description":"Enable data role.","type":"boolean","default":true},"ingest":{"description":"Enable ingest role.","type":"boolean","default":true},"master":{"description":"Enable cluster_manager role.","type":"boolean","default":true},"ml":{"description":"Enable machine learning role.","type":"boolean","default":false}}},"replicas":{"description":"Number of OpenSearch nodes in the cluster.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration for each OpenSearch node. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. OpenSearch requires minimum 2Gi memory.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"topologySpreadPolicy":{"description":"How strictly to enforce pod distribution across nodes and zones.","type":"string","default":"soft","enum":["soft","hard"]},"users":{"description":"Custom OpenSearch users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user (auto-generated if omitted).","type":"string"},"roles":{"description":"List of OpenSearch roles.","type":"array","items":{"type":"string"}}}}},"version":{"description":"OpenSearch major version to deploy.","type":"string","default":"v2","enum":["v3","v2","v1"]}}}
+      {"title":"Chart Values","type":"object","properties":{"dashboards":{"description":"OpenSearch Dashboards configuration.","type":"object","default":{},"properties":{"enabled":{"description":"Enable OpenSearch Dashboards deployment.","type":"boolean","default":false},"replicas":{"description":"Number of Dashboards replicas.","type":"integer","default":1},"resources":{"description":"Explicit CPU and memory configuration for Dashboards.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset for Dashboards.","type":"string","default":"medium","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"images":{"description":"Container images used by the operator.","type":"object","default":{},"properties":{"opensearch":{"description":"OpenSearch image.","type":"string","default":""}}},"nodeRoles":{"description":"Node roles configuration.","type":"object","default":{},"properties":{"data":{"description":"Enable data role.","type":"boolean","default":true},"ingest":{"description":"Enable ingest role.","type":"boolean","default":true},"master":{"description":"Enable cluster_manager role.","type":"boolean","default":true},"ml":{"description":"Enable machine learning role.","type":"boolean","default":false}}},"replicas":{"description":"Number of OpenSearch nodes in the cluster.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration for each OpenSearch node. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. OpenSearch requires minimum 2Gi memory.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"topologySpreadPolicy":{"description":"How strictly to enforce pod distribution across nodes and zones.","type":"string","default":"soft","enum":["soft","hard"]},"users":{"description":"Custom OpenSearch users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user (auto-generated if omitted).","type":"string"},"roles":{"description":"List of OpenSearch roles.","type":"array","items":{"type":"string"}}}}},"version":{"description":"OpenSearch major version to deploy.","type":"string","default":"v2","enum":["v3","v2","v1"]}}}
   release:
     prefix: opensearch-
     labels:

From fc6bb0feea02db2998d9ff6d7769cefe4f7f1dcd Mon Sep 17 00:00:00 2001
From: Matthieu <matthieu@hidora.com>
Date: Tue, 17 Mar 2026 13:33:01 +0100
Subject: [PATCH 280/666] [opensearch] Regenerate schema after make generate

The required fields in schema are auto-generated by cozyvalues-gen
and must be kept in sync.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Matthieu <matthieu@hidora.com>
---
 packages/apps/opensearch/values.schema.json        | 14 ++++++++++++++
 .../system/opensearch-rd/cozyrds/opensearch.yaml   |  2 +-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/packages/apps/opensearch/values.schema.json b/packages/apps/opensearch/values.schema.json
index 059ef6da..54a6bb00 100644
--- a/packages/apps/opensearch/values.schema.json
+++ b/packages/apps/opensearch/values.schema.json
@@ -6,6 +6,11 @@
       "description": "OpenSearch Dashboards configuration.",
       "type": "object",
       "default": {},
+      "required": [
+        "enabled",
+        "replicas",
+        "resourcesPreset"
+      ],
       "properties": {
         "enabled": {
           "description": "Enable OpenSearch Dashboards deployment.",
@@ -75,6 +80,9 @@
       "description": "Container images used by the operator.",
       "type": "object",
       "default": {},
+      "required": [
+        "opensearch"
+      ],
       "properties": {
         "opensearch": {
           "description": "OpenSearch image.",
@@ -87,6 +95,12 @@
       "description": "Node roles configuration.",
       "type": "object",
       "default": {},
+      "required": [
+        "data",
+        "ingest",
+        "master",
+        "ml"
+      ],
       "properties": {
         "data": {
           "description": "Enable data role.",
diff --git a/packages/system/opensearch-rd/cozyrds/opensearch.yaml b/packages/system/opensearch-rd/cozyrds/opensearch.yaml
index 9a2866de..be15d8a1 100644
--- a/packages/system/opensearch-rd/cozyrds/opensearch.yaml
+++ b/packages/system/opensearch-rd/cozyrds/opensearch.yaml
@@ -8,7 +8,7 @@ spec:
     singular: opensearch
     plural: opensearches
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"dashboards":{"description":"OpenSearch Dashboards configuration.","type":"object","default":{},"properties":{"enabled":{"description":"Enable OpenSearch Dashboards deployment.","type":"boolean","default":false},"replicas":{"description":"Number of Dashboards replicas.","type":"integer","default":1},"resources":{"description":"Explicit CPU and memory configuration for Dashboards.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset for Dashboards.","type":"string","default":"medium","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"images":{"description":"Container images used by the operator.","type":"object","default":{},"properties":{"opensearch":{"description":"OpenSearch image.","type":"string","default":""}}},"nodeRoles":{"description":"Node roles configuration.","type":"object","default":{},"properties":{"data":{"description":"Enable data role.","type":"boolean","default":true},"ingest":{"description":"Enable ingest role.","type":"boolean","default":true},"master":{"description":"Enable cluster_manager role.","type":"boolean","default":true},"ml":{"description":"Enable machine learning role.","type":"boolean","default":false}}},"replicas":{"description":"Number of OpenSearch nodes in the cluster.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration for each OpenSearch node. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. OpenSearch requires minimum 2Gi memory.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"topologySpreadPolicy":{"description":"How strictly to enforce pod distribution across nodes and zones.","type":"string","default":"soft","enum":["soft","hard"]},"users":{"description":"Custom OpenSearch users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user (auto-generated if omitted).","type":"string"},"roles":{"description":"List of OpenSearch roles.","type":"array","items":{"type":"string"}}}}},"version":{"description":"OpenSearch major version to deploy.","type":"string","default":"v2","enum":["v3","v2","v1"]}}}
+      {"title":"Chart Values","type":"object","properties":{"dashboards":{"description":"OpenSearch Dashboards configuration.","type":"object","default":{},"required":["enabled","replicas","resourcesPreset"],"properties":{"enabled":{"description":"Enable OpenSearch Dashboards deployment.","type":"boolean","default":false},"replicas":{"description":"Number of Dashboards replicas.","type":"integer","default":1},"resources":{"description":"Explicit CPU and memory configuration for Dashboards.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset for Dashboards.","type":"string","default":"medium","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"images":{"description":"Container images used by the operator.","type":"object","default":{},"required":["opensearch"],"properties":{"opensearch":{"description":"OpenSearch image.","type":"string","default":""}}},"nodeRoles":{"description":"Node roles configuration.","type":"object","default":{},"required":["data","ingest","master","ml"],"properties":{"data":{"description":"Enable data role.","type":"boolean","default":true},"ingest":{"description":"Enable ingest role.","type":"boolean","default":true},"master":{"description":"Enable cluster_manager role.","type":"boolean","default":true},"ml":{"description":"Enable machine learning role.","type":"boolean","default":false}}},"replicas":{"description":"Number of OpenSearch nodes in the cluster.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration for each OpenSearch node. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. OpenSearch requires minimum 2Gi memory.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"topologySpreadPolicy":{"description":"How strictly to enforce pod distribution across nodes and zones.","type":"string","default":"soft","enum":["soft","hard"]},"users":{"description":"Custom OpenSearch users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user (auto-generated if omitted).","type":"string"},"roles":{"description":"List of OpenSearch roles.","type":"array","items":{"type":"string"}}}}},"version":{"description":"OpenSearch major version to deploy.","type":"string","default":"v2","enum":["v3","v2","v1"]}}}
   release:
     prefix: opensearch-
     labels:

From 2c34dbc0429bc4bd0138a9fdeded1115968d20f2 Mon Sep 17 00:00:00 2001
From: Matthieu <matthieu@hidora.com>
Date: Wed, 18 Mar 2026 10:08:12 +0100
Subject: [PATCH 281/666] [opensearch] Add validation to ensure at least one
 node role is enabled

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Matthieu <matthieu@hidora.com>
---
 .../apps/opensearch/templates/opensearch.yaml    |  3 +++
 .../apps/opensearch/tests/opensearch_test.yaml   | 16 ++++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/packages/apps/opensearch/templates/opensearch.yaml b/packages/apps/opensearch/templates/opensearch.yaml
index 6eaee86d..fcf431ac 100644
--- a/packages/apps/opensearch/templates/opensearch.yaml
+++ b/packages/apps/opensearch/templates/opensearch.yaml
@@ -58,6 +58,9 @@ spec:
           storageClass: local
           {{- end }}
       resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.resourcesPreset .Values.resources $) | nindent 8 }}
+      {{- if not (or .Values.nodeRoles.master .Values.nodeRoles.data .Values.nodeRoles.ingest .Values.nodeRoles.ml) }}
+      {{- fail "At least one node role must be enabled (master, data, ingest, or ml)" }}
+      {{- end }}
       roles:
         {{- if .Values.nodeRoles.master }}
         - cluster_manager
diff --git a/packages/apps/opensearch/tests/opensearch_test.yaml b/packages/apps/opensearch/tests/opensearch_test.yaml
index 78850134..2959ec18 100644
--- a/packages/apps/opensearch/tests/opensearch_test.yaml
+++ b/packages/apps/opensearch/tests/opensearch_test.yaml
@@ -250,6 +250,22 @@ tests:
           content: cluster_manager
         documentIndex: 0
 
+  - it: fails when all node roles are disabled
+    release:
+      name: test-os
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      nodeRoles:
+        master: false
+        data: false
+        ingest: false
+        ml: false
+    asserts:
+      - failedTemplate:
+          errorMessage: "At least one node role must be enabled (master, data, ingest, or ml)"
+
   - it: enables ml role when configured
     release:
       name: test-os

From bdeb3a7e8c7240254fdb2d6dc3ef3be9c067a502 Mon Sep 17 00:00:00 2001
From: Timofei Larkin <lllamnyp@gmail.com>
Date: Wed, 18 Mar 2026 11:03:15 +0300
Subject: [PATCH 282/666] feat(lineage-webhook): import scheduling constants
 from cozystack-scheduler

Import SchedulingClassAnnotation, SchedulingClassLabel, SchedulerName,
and GVR components from the cozystack-scheduler/pkg/apis sub-module
instead of defining them locally. This ensures the webhook and scheduler
stay in sync on label/annotation keys.

Also standardize the namespace label from scheduling.cozystack.io/class
to scheduler.cozystack.io/scheduling-class for consistency with the
scheduler, and resolve scheduling class from the owner Application CR
(via a new SchedulingClass() stub method) before falling back to the
namespace label.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
---
 go.mod                                        |   1 +
 go.sum                                        |   2 +
 internal/lineagecontrollerwebhook/webhook.go  | 118 ++++++++++--------
 packages/apps/tenant/templates/namespace.yaml |   2 +-
 pkg/apis/apps/v1alpha1/types.go               |   6 +
 5 files changed, 76 insertions(+), 53 deletions(-)

diff --git a/go.mod b/go.mod
index 3ecda336..00e8e129 100644
--- a/go.mod
+++ b/go.mod
@@ -42,6 +42,7 @@ require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
+	github.com/cozystack/cozystack-scheduler/pkg/apis v0.1.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
diff --git a/go.sum b/go.sum
index 0a69ac87..52942562 100644
--- a/go.sum
+++ b/go.sum
@@ -20,6 +20,8 @@ github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/cozystack/apimachinery v0.0.0-20251219010959-1f91eabae46c h1:C2wIfH/OzhU9XOK/e6Ik9cg7nZ1z6fN4lf6a3yFdik8=
 github.com/cozystack/apimachinery v0.0.0-20251219010959-1f91eabae46c/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+github.com/cozystack/cozystack-scheduler/pkg/apis v0.1.1 h1:9uLa/8J4lRx3sNuaVH8UZqgZvnskHATPo5GxEKh0iSM=
+github.com/cozystack/cozystack-scheduler/pkg/apis v0.1.1/go.mod h1:kPeS9YPB4ENbvNINEkkp0SX8FB+gvwoOHGOHMT3Tg9Y=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
diff --git a/internal/lineagecontrollerwebhook/webhook.go b/internal/lineagecontrollerwebhook/webhook.go
index 6955518e..cf871fb0 100644
--- a/internal/lineagecontrollerwebhook/webhook.go
+++ b/internal/lineagecontrollerwebhook/webhook.go
@@ -11,6 +11,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/dynamic"
 	"k8s.io/client-go/rest"
@@ -21,12 +22,14 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 
 	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+	appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
 	corev1alpha1 "github.com/cozystack/cozystack/pkg/apis/core/v1alpha1"
+	schedulerapi "github.com/cozystack/cozystack-scheduler/pkg/apis/v1alpha1"
 )
 
 var (
-	NoAncestors       = fmt.Errorf("no managed apps found in lineage")
-	AncestryAmbiguous = fmt.Errorf("object ancestry is ambiguous")
+	NoAncestors       = errors.New("no managed apps found in lineage")
+	AncestryAmbiguous = errors.New("object ancestry is ambiguous")
 )
 
 const (
@@ -34,11 +37,6 @@ const (
 	ManagerGroupKey  = "apps.cozystack.io/application.group"
 	ManagerKindKey   = "apps.cozystack.io/application.kind"
 	ManagerNameKey   = "apps.cozystack.io/application.name"
-
-	// Scheduling constants
-	SchedulingClassLabel      = "scheduling.cozystack.io/class"
-	SchedulingClassAnnotation = "scheduler.cozystack.io/scheduling-class"
-	CozystackSchedulerName    = "cozystack-scheduler"
 )
 
 // getResourceSelectors returns the appropriate ApplicationDefinitionResources for a given GroupKind
@@ -103,27 +101,25 @@ func (h *LineageControllerWebhook) Handle(ctx context.Context, req admission.Req
 		return admission.Errored(400, fmt.Errorf("decode object: %w", err))
 	}
 
-	labels, err := h.computeLabels(ctx, obj)
-	for {
-		if err != nil && errors.Is(err, NoAncestors) {
-			break // not a problem, mark object as unmanaged
-		}
-		if err != nil && errors.Is(err, AncestryAmbiguous) {
-			warn = append(warn, "object ancestry ambiguous, using first ancestor found")
-			break
-		}
-		if err != nil {
-			logger.Error(err, "error computing lineage labels")
-			return admission.Errored(500, fmt.Errorf("error computing lineage labels: %w", err))
-		}
-		if err == nil {
-			break
-		}
+	owner, err := h.getOwner(ctx, obj)
+	switch {
+	case err != nil && errors.Is(err, AncestryAmbiguous):
+		warn = append(warn, "object ancestry ambiguous, using first ancestor found")
+	case err != nil && errors.Is(err, NoAncestors):
+		// not a problem, mark object as unmanaged
+	case err != nil:
+		logger.Error(err, "error computing lineage labels")
+		return admission.Errored(500, fmt.Errorf("error computing lineage labels: %w", err))
+	}
+	labels, err := h.computeLabels(ctx, obj, owner)
+	if err != nil {
+		logger.Error(err, "error computing lineage labels")
+		return admission.Errored(500, fmt.Errorf("error computing lineage labels: %w", err))
 	}
 
 	h.applyLabels(obj, labels)
 
-	if err := h.applySchedulingClass(ctx, obj, req.Namespace); err != nil {
+	if err := h.applySchedulingClass(ctx, obj, owner, req.Namespace); err != nil {
 		logger.Error(err, "error applying scheduling class")
 		return admission.Errored(500, fmt.Errorf("error applying scheduling class: %w", err))
 	}
@@ -136,23 +132,30 @@ func (h *LineageControllerWebhook) Handle(ctx context.Context, req admission.Req
 	return admission.PatchResponseFromRaw(req.Object.Raw, mutated).WithWarnings(warn...)
 }
 
-func (h *LineageControllerWebhook) computeLabels(ctx context.Context, o *unstructured.Unstructured) (map[string]string, error) {
+func (h *LineageControllerWebhook) getOwner(ctx context.Context, o *unstructured.Unstructured) (*unstructured.Unstructured, error) {
 	owners := lineage.WalkOwnershipGraph(ctx, h.dynClient, h.mapper, h, o)
 	if len(owners) == 0 {
-		return map[string]string{ManagedObjectKey: "false"}, NoAncestors
+		return nil, NoAncestors
 	}
 	obj, err := owners[0].GetUnstructured(ctx, h.dynClient, h.mapper)
 	if err != nil {
 		return nil, err
 	}
-	gv, err := schema.ParseGroupVersion(obj.GetAPIVersion())
-	if err != nil {
-		// should never happen, we got an APIVersion right from the API
-		return nil, fmt.Errorf("could not parse APIVersion %s to a group and version: %w", obj.GetAPIVersion(), err)
-	}
 	if len(owners) > 1 {
 		err = AncestryAmbiguous
 	}
+	return obj, err
+}
+
+func (h *LineageControllerWebhook) computeLabels(ctx context.Context, obj *unstructured.Unstructured, owner *unstructured.Unstructured) (map[string]string, error) {
+	if owner == nil {
+		return nil, nil
+	}
+	gv, err := schema.ParseGroupVersion(owner.GetAPIVersion())
+	if err != nil {
+		// should never happen, we got an APIVersion right from the API
+		return nil, fmt.Errorf("could not parse APIVersion %s to a group and version: %w", owner.GetAPIVersion(), err)
+	}
 	labels := map[string]string{
 		// truncate apigroup to first 63 chars
 		ManagedObjectKey: "true",
@@ -166,25 +169,25 @@ func (h *LineageControllerWebhook) computeLabels(ctx context.Context, o *unstruc
 			}
 			return s
 		}(gv.Group),
-		ManagerKindKey: obj.GetKind(),
-		ManagerNameKey: obj.GetName(),
+		ManagerKindKey: owner.GetKind(),
+		ManagerNameKey: owner.GetName(),
 	}
 	templateLabels := map[string]string{
-		"kind":      strings.ToLower(obj.GetKind()),
-		"name":      obj.GetName(),
-		"namespace": o.GetNamespace(),
+		"kind":      strings.ToLower(owner.GetKind()),
+		"name":      owner.GetName(),
+		"namespace": obj.GetNamespace(),
 	}
 	cfg := h.config.Load().(*runtimeConfig)
-	crd := cfg.appCRDMap[appRef{gv.Group, obj.GetKind()}]
-	resourceSelectors := h.getResourceSelectors(o.GroupVersionKind().GroupKind(), crd)
+	crd := cfg.appCRDMap[appRef{gv.Group, owner.GetKind()}]
+	resourceSelectors := h.getResourceSelectors(obj.GroupVersionKind().GroupKind(), crd)
 
 	labels[corev1alpha1.TenantResourceLabelKey] = func(b bool) string {
 		if b {
 			return corev1alpha1.TenantResourceLabelValue
 		}
 		return "false"
-	}(matchResourceToExcludeInclude(ctx, o.GetName(), templateLabels, o.GetLabels(), resourceSelectors))
-	return labels, err
+	}(matchResourceToExcludeInclude(ctx, obj.GetName(), templateLabels, obj.GetLabels(), resourceSelectors))
+	return labels, nil
 }
 
 func (h *LineageControllerWebhook) applyLabels(o *unstructured.Unstructured, labels map[string]string) {
@@ -199,22 +202,33 @@ func (h *LineageControllerWebhook) applyLabels(o *unstructured.Unstructured, lab
 }
 
 // applySchedulingClass injects schedulerName and scheduling-class annotation
-// into Pods whose namespace carries the scheduling.cozystack.io/class label.
+// into Pods whose namespace carries the scheduler.cozystack.io/scheduling-class label.
 // If the referenced SchedulingClass CR does not exist (e.g. the scheduler
 // package is not installed), the injection is silently skipped so that pods
 // are not left Pending.
-func (h *LineageControllerWebhook) applySchedulingClass(ctx context.Context, obj *unstructured.Unstructured, namespace string) error {
+func (h *LineageControllerWebhook) applySchedulingClass(ctx context.Context, obj, owner *unstructured.Unstructured, namespace string) error {
 	if obj.GetKind() != "Pod" {
 		return nil
 	}
 
-	ns := &corev1.Namespace{}
-	if err := h.Get(ctx, client.ObjectKey{Name: namespace}, ns); err != nil {
-		return fmt.Errorf("getting namespace %s: %w", namespace, err)
+	// Determine scheduling class: owner Application field takes priority,
+	// then fall back to namespace label.
+	var schedulingClass string
+	if owner != nil {
+		var app appsv1alpha1.Application
+		if err := runtime.DefaultUnstructuredConverter.FromUnstructured(owner.Object, &app); err == nil {
+			schedulingClass = app.SchedulingClass()
+		}
+	}
+	if schedulingClass == "" {
+		ns := &corev1.Namespace{}
+		if err := h.Get(ctx, client.ObjectKey{Name: namespace}, ns); err != nil {
+			return fmt.Errorf("getting namespace %s: %w", namespace, err)
+		}
+		schedulingClass = ns.Labels[schedulerapi.SchedulingClassLabel]
 	}
 
-	schedulingClass, ok := ns.Labels[SchedulingClassLabel]
-	if !ok || schedulingClass == "" {
+	if schedulingClass == "" {
 		return nil
 	}
 
@@ -229,7 +243,7 @@ func (h *LineageControllerWebhook) applySchedulingClass(ctx context.Context, obj
 		return nil
 	}
 
-	if err := unstructured.SetNestedField(obj.Object, CozystackSchedulerName, "spec", "schedulerName"); err != nil {
+	if err := unstructured.SetNestedField(obj.Object, schedulerapi.SchedulerName, "spec", "schedulerName"); err != nil {
 		return fmt.Errorf("setting schedulerName: %w", err)
 	}
 
@@ -237,16 +251,16 @@ func (h *LineageControllerWebhook) applySchedulingClass(ctx context.Context, obj
 	if annotations == nil {
 		annotations = make(map[string]string)
 	}
-	annotations[SchedulingClassAnnotation] = schedulingClass
+	annotations[schedulerapi.SchedulingClassAnnotation] = schedulingClass
 	obj.SetAnnotations(annotations)
 
 	return nil
 }
 
 var schedulingClassGVR = schema.GroupVersionResource{
-	Group:    "cozystack.io",
-	Version:  "v1alpha1",
-	Resource: "schedulingclasses",
+	Group:    schedulerapi.Group,
+	Version:  schedulerapi.Version,
+	Resource: schedulerapi.Resource,
 }
 
 func (h *LineageControllerWebhook) decodeUnstructured(req admission.Request, out *unstructured.Unstructured) error {
diff --git a/packages/apps/tenant/templates/namespace.yaml b/packages/apps/tenant/templates/namespace.yaml
index 0a364e0a..dfb83730 100644
--- a/packages/apps/tenant/templates/namespace.yaml
+++ b/packages/apps/tenant/templates/namespace.yaml
@@ -65,7 +65,7 @@ metadata:
     namespace.cozystack.io/seaweedfs: {{ $seaweedfs | quote }}
     namespace.cozystack.io/host: {{ $computedHost | quote }}
     {{- with $schedulingClass }}
-    scheduling.cozystack.io/class: {{ . | quote }}
+    scheduler.cozystack.io/scheduling-class: {{ . | quote }}
     {{- end }}
     alpha.kubevirt.io/auto-memory-limits-ratio: "1.0"
   ownerReferences:
diff --git a/pkg/apis/apps/v1alpha1/types.go b/pkg/apis/apps/v1alpha1/types.go
index 51247efb..3332ce55 100644
--- a/pkg/apis/apps/v1alpha1/types.go
+++ b/pkg/apis/apps/v1alpha1/types.go
@@ -52,6 +52,12 @@ type ApplicationStatus struct {
 	ExternalIPsCount int32 `json:"externalIPsCount,omitempty"`
 }
 
+// SchedulingClass returns the scheduling class requested by this Application.
+// TODO: read from a dedicated Application field once the struct is extended.
+func (in Application) SchedulingClass() string {
+	return ""
+}
+
 // GetConditions returns the status conditions of the object.
 func (in Application) GetConditions() []metav1.Condition {
 	return in.Status.Conditions

From 4861d59852a3cf03114fb0a5d4696a3147fc01b1 Mon Sep 17 00:00:00 2001
From: mattia-eleuteri <mattia@hidora.io>
Date: Wed, 18 Mar 2026 15:02:33 +0100
Subject: [PATCH 283/666] fix(csi): hide disk.img and lost+found from RWX NFS
 mounts

Mount the /data subdirectory of the NFS export instead of the root,
so pods no longer see internal LINSTOR/CDI artifacts (disk.img,
lost+found). On first mount after upgrade, any existing user files
at the NFS root are automatically migrated into /data.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: mattia-eleuteri <mattia@hidora.io>
---
 .../images/kubevirt-csi-driver/node.go        | 57 ++++++++++++++++---
 1 file changed, 48 insertions(+), 9 deletions(-)

diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go b/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go
index 5636a1d5..c39ab402 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"path/filepath"
 
 	csi "github.com/container-storage-interface/spec/lib/go/csi"
 	"google.golang.org/grpc/codes"
@@ -32,7 +33,8 @@ func (w *WrappedNodeService) NodeStageVolume(ctx context.Context, req *csi.NodeS
 	return w.NodeService.NodeStageVolume(ctx, req)
 }
 
-// NodePublishVolume for NFS volumes: mounts NFS at the target path.
+// NodePublishVolume for NFS volumes: mounts the /data subdir of the NFS export
+// at the target path, hiding internal artifacts (disk.img, lost+found).
 // For RWO volumes, delegates to upstream (mount block device).
 func (w *WrappedNodeService) NodePublishVolume(ctx context.Context, req *csi.NodePublishVolumeRequest) (*csi.NodePublishVolumeResponse, error) {
 	nfsExport := req.GetPublishContext()[nfsExportKey]
@@ -40,8 +42,6 @@ func (w *WrappedNodeService) NodePublishVolume(ctx context.Context, req *csi.Nod
 		return w.NodeService.NodePublishVolume(ctx, req)
 	}
 
-	klog.V(3).Infof("Publishing NFS volume %s at %s", req.GetVolumeId(), req.GetTargetPath())
-
 	host, port, path, err := parseNFSExport(nfsExport)
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, "failed to parse NFS export: %v", err)
@@ -60,13 +60,10 @@ func (w *WrappedNodeService) NodePublishVolume(ctx context.Context, req *csi.Nod
 		}
 		notMnt = true
 	}
-
 	if !notMnt {
-		klog.V(3).Infof("NFS volume %s already mounted at %s", req.GetVolumeId(), targetPath)
 		return &csi.NodePublishVolumeResponse{}, nil
 	}
 
-	source := fmt.Sprintf("%s:%s", host, path)
 	mountOptions := []string{
 		"nfsvers=4.2",
 		fmt.Sprintf("port=%s", port),
@@ -75,9 +72,51 @@ func (w *WrappedNodeService) NodePublishVolume(ctx context.Context, req *csi.Nod
 		mountOptions = append(mountOptions, "ro")
 	}
 
-	klog.V(3).Infof("Mounting NFS %s at %s with options %v", source, targetPath, mountOptions)
-	if err := w.mounter.Mount(source, targetPath, "nfs", mountOptions); err != nil {
-		return nil, status.Errorf(codes.Internal, "NFS mount of %s at %s failed: %v", source, targetPath, err)
+	// Temp-mount the NFS root to ensure /data subdir exists and migrate any
+	// user files that were written before this fix (backward compatibility).
+	tmpMount := fmt.Sprintf("/tmp/nfs-init-%s", req.GetVolumeId())
+	if err := os.MkdirAll(tmpMount, 0750); err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to create temp mount: %v", err)
+	}
+
+	rootSource := fmt.Sprintf("%s:%s", host, path)
+	rootOpts := []string{"nfsvers=4.2", fmt.Sprintf("port=%s", port)}
+	if err := w.mounter.Mount(rootSource, tmpMount, "nfs", rootOpts); err != nil {
+		os.Remove(tmpMount)
+		return nil, status.Errorf(codes.Internal, "NFS temp mount failed: %v", err)
+	}
+
+	dataDir := filepath.Join(tmpMount, "data")
+	if err := os.MkdirAll(dataDir, 0777); err != nil {
+		w.mounter.Unmount(tmpMount)
+		os.Remove(tmpMount)
+		return nil, status.Errorf(codes.Internal, "failed to create /data subdir: %v", err)
+	}
+
+	// Auto-migrate: move user files from root into /data (skip internal artifacts).
+	entries, _ := os.ReadDir(tmpMount)
+	for _, entry := range entries {
+		name := entry.Name()
+		if name == "data" || name == "disk.img" || name == "lost+found" {
+			continue
+		}
+		src := filepath.Join(tmpMount, name)
+		dst := filepath.Join(dataDir, name)
+		if _, err := os.Stat(dst); err == nil {
+			continue // already exists in /data, skip
+		}
+		klog.Infof("Migrating %s to /data/%s for volume %s", name, name, req.GetVolumeId())
+		os.Rename(src, dst)
+	}
+
+	w.mounter.Unmount(tmpMount)
+	os.Remove(tmpMount)
+
+	// Mount only the /data subdir at the pod's target path.
+	dataSource := fmt.Sprintf("%s:%s/data", host, path)
+	klog.V(3).Infof("Mounting NFS %s at %s with options %v", dataSource, targetPath, mountOptions)
+	if err := w.mounter.Mount(dataSource, targetPath, "nfs", mountOptions); err != nil {
+		return nil, status.Errorf(codes.Internal, "NFS mount of %s at %s failed: %v", dataSource, targetPath, err)
 	}
 
 	return &csi.NodePublishVolumeResponse{}, nil

From 276879dcf82178d74d3aa07168ae54494e8473ea Mon Sep 17 00:00:00 2001
From: mattia-eleuteri <mattia@hidora.io>
Date: Wed, 18 Mar 2026 15:04:56 +0100
Subject: [PATCH 284/666] fix(csi): restore klog debug statements

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: mattia-eleuteri <mattia@hidora.io>
---
 packages/apps/kubernetes/images/kubevirt-csi-driver/node.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go b/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go
index c39ab402..dc0ef876 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go
@@ -42,6 +42,8 @@ func (w *WrappedNodeService) NodePublishVolume(ctx context.Context, req *csi.Nod
 		return w.NodeService.NodePublishVolume(ctx, req)
 	}
 
+	klog.V(3).Infof("Publishing NFS volume %s at %s", req.GetVolumeId(), req.GetTargetPath())
+
 	host, port, path, err := parseNFSExport(nfsExport)
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, "failed to parse NFS export: %v", err)
@@ -61,6 +63,7 @@ func (w *WrappedNodeService) NodePublishVolume(ctx context.Context, req *csi.Nod
 		notMnt = true
 	}
 	if !notMnt {
+		klog.V(3).Infof("NFS volume %s already mounted at %s", req.GetVolumeId(), targetPath)
 		return &csi.NodePublishVolumeResponse{}, nil
 	}
 

From 7c2c8048103986bdd652ca05ccf27864e1f05566 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 18 Mar 2026 17:05:09 +0300
Subject: [PATCH 285/666] fix(kubeovn): let kube-ovn discover master nodes by
 label on multi-master clusters

Remove the apiServerEndpoint fallback for MASTER_NODES in the
isp-full-generic variant. When MASTER_NODES is not explicitly set,
kube-ovn now uses its built-in Helm lookup to find all control-plane
nodes by the MASTER_NODES_LABEL, correctly discovering all masters
instead of just the single API server IP.

The previous fallback always produced a single IP (the API endpoint),
which broke OVN RAFT consensus on multi-master clusters because
ovn-central was configured with only one node in NODE_IPS.

Explicit MASTER_NODES override is preserved for users who need it.

Fixes: #2242

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/core/platform/templates/bundles/system.yaml | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/packages/core/platform/templates/bundles/system.yaml b/packages/core/platform/templates/bundles/system.yaml
index d9d977a6..8d7e948f 100644
--- a/packages/core/platform/templates/bundles/system.yaml
+++ b/packages/core/platform/templates/bundles/system.yaml
@@ -70,15 +70,12 @@
   "SVC_CIDR" $svcCIDR
   "JOIN_CIDR" $joinCIDR -}}
 {{- $kubeovnDict := dict "ipv4" $kubeovnIpv4 -}}
-{{- /* Set MASTER_NODES: explicit value > parsed from apiServerEndpoint > empty (use helm lookup) */ -}}
+{{- /* Set MASTER_NODES: explicit value or empty (let kube-ovn discover nodes by label) */ -}}
 {{- $masterNodes := .Values.networking.kubeovn.MASTER_NODES -}}
-{{- if and (not $masterNodes) $apiServerEndpoint -}}
-{{- $masterNodes = $apiHost -}}
-{{- end -}}
 {{- if $masterNodes -}}
 {{- $_ := set $kubeovnDict "MASTER_NODES" $masterNodes -}}
 {{- end -}}
-{{- /* For generic k8s (k3s, kubeadm), control-plane label has value "true" */ -}}
+{{- /* For generic k8s (k3s), control-plane label has value "true" */ -}}
 {{- $_ := set $kubeovnDict "MASTER_NODES_LABEL" "node-role.kubernetes.io/control-plane=true" -}}
 {{- $kubeovnValues := dict "kube-ovn" $kubeovnDict -}}
 {{- $_ := set $networkingComponents "kubeovn" (dict "values" $kubeovnValues) -}}

From 247f89dffd3a676276eb25d188d0cb1c9d52ac26 Mon Sep 17 00:00:00 2001
From: mattia-eleuteri <mattia@hidora.io>
Date: Wed, 18 Mar 2026 15:36:32 +0100
Subject: [PATCH 286/666] fix(csi): address review comments on temp mount and
 error handling

- Use os.MkdirTemp instead of predictable path (fixes race condition/TOCTOU)
- Use defer for cleanup (unmount + remove temp dir)
- Handle os.ReadDir and os.Rename errors with klog warnings
- Log unmount failures instead of ignoring them

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: mattia-eleuteri <mattia@hidora.io>
---
 .../images/kubevirt-csi-driver/node.go        | 27 +++++++++++--------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go b/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go
index dc0ef876..9c87309d 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go
@@ -77,27 +77,33 @@ func (w *WrappedNodeService) NodePublishVolume(ctx context.Context, req *csi.Nod
 
 	// Temp-mount the NFS root to ensure /data subdir exists and migrate any
 	// user files that were written before this fix (backward compatibility).
-	tmpMount := fmt.Sprintf("/tmp/nfs-init-%s", req.GetVolumeId())
-	if err := os.MkdirAll(tmpMount, 0750); err != nil {
-		return nil, status.Errorf(codes.Internal, "failed to create temp mount: %v", err)
+	tmpMount, err := os.MkdirTemp("", fmt.Sprintf("nfs-init-%s-", req.GetVolumeId()))
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to create temp mount dir: %v", err)
 	}
+	defer os.Remove(tmpMount)
 
 	rootSource := fmt.Sprintf("%s:%s", host, path)
 	rootOpts := []string{"nfsvers=4.2", fmt.Sprintf("port=%s", port)}
 	if err := w.mounter.Mount(rootSource, tmpMount, "nfs", rootOpts); err != nil {
-		os.Remove(tmpMount)
 		return nil, status.Errorf(codes.Internal, "NFS temp mount failed: %v", err)
 	}
+	defer func() {
+		if err := w.mounter.Unmount(tmpMount); err != nil {
+			klog.Warningf("Failed to unmount temp dir %s: %v", tmpMount, err)
+		}
+	}()
 
 	dataDir := filepath.Join(tmpMount, "data")
 	if err := os.MkdirAll(dataDir, 0777); err != nil {
-		w.mounter.Unmount(tmpMount)
-		os.Remove(tmpMount)
 		return nil, status.Errorf(codes.Internal, "failed to create /data subdir: %v", err)
 	}
 
 	// Auto-migrate: move user files from root into /data (skip internal artifacts).
-	entries, _ := os.ReadDir(tmpMount)
+	entries, err := os.ReadDir(tmpMount)
+	if err != nil {
+		klog.Warningf("Failed to read NFS root for migration (volume %s): %v", req.GetVolumeId(), err)
+	}
 	for _, entry := range entries {
 		name := entry.Name()
 		if name == "data" || name == "disk.img" || name == "lost+found" {
@@ -109,12 +115,11 @@ func (w *WrappedNodeService) NodePublishVolume(ctx context.Context, req *csi.Nod
 			continue // already exists in /data, skip
 		}
 		klog.Infof("Migrating %s to /data/%s for volume %s", name, name, req.GetVolumeId())
-		os.Rename(src, dst)
+		if err := os.Rename(src, dst); err != nil {
+			klog.Warningf("Failed to migrate %s for volume %s: %v", name, req.GetVolumeId(), err)
+		}
 	}
 
-	w.mounter.Unmount(tmpMount)
-	os.Remove(tmpMount)
-
 	// Mount only the /data subdir at the pod's target path.
 	dataSource := fmt.Sprintf("%s:%s/data", host, path)
 	klog.V(3).Infof("Mounting NFS %s at %s with options %v", dataSource, targetPath, mountOptions)

From 91e15b343f7d20b3b49c3f94e702a8754775aab0 Mon Sep 17 00:00:00 2001
From: Timofei Larkin <lllamnyp@gmail.com>
Date: Wed, 18 Mar 2026 18:05:49 +0300
Subject: [PATCH 287/666] [cozystack-scheduler] Update to v0.2.0

## What this PR does

Update the Cozystack scheduler to its latest version, supporting
automatic placement of label selectors for affinity and topology spread
constraints.

### Release note

```release-note
[cozystack-scheduler] Update Cozystack scheduler to v0.2.0 with support
for reusable affinity terms.
```

Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
---
 packages/system/cozystack-scheduler/Chart.yaml |  2 +-
 packages/system/cozystack-scheduler/Makefile   |  5 +++--
 .../charts/cozystack-scheduler/Chart.yaml      |  3 +++
 .../crds/cozystack.io_schedulingclasses.yaml   |  0
 .../templates/clusterrole.yaml                 |  0
 .../templates/clusterrolebinding.yaml          |  0
 .../templates/configmap.yaml                   |  0
 .../templates/deployment.yaml                  |  3 +++
 .../templates/rolebinding.yaml                 |  0
 .../templates/serviceaccount.yaml              |  0
 .../charts/cozystack-scheduler/values.yaml     |  9 +++++++++
 .../templates/tenant-clusterroles.yaml         | 18 ++++++++++++++++++
 .../system/cozystack-scheduler/values.yaml     |  2 --
 13 files changed, 37 insertions(+), 5 deletions(-)
 create mode 100644 packages/system/cozystack-scheduler/charts/cozystack-scheduler/Chart.yaml
 rename packages/system/cozystack-scheduler/{ => charts/cozystack-scheduler}/crds/cozystack.io_schedulingclasses.yaml (100%)
 rename packages/system/cozystack-scheduler/{ => charts/cozystack-scheduler}/templates/clusterrole.yaml (100%)
 rename packages/system/cozystack-scheduler/{ => charts/cozystack-scheduler}/templates/clusterrolebinding.yaml (100%)
 rename packages/system/cozystack-scheduler/{ => charts/cozystack-scheduler}/templates/configmap.yaml (100%)
 rename packages/system/cozystack-scheduler/{ => charts/cozystack-scheduler}/templates/deployment.yaml (87%)
 rename packages/system/cozystack-scheduler/{ => charts/cozystack-scheduler}/templates/rolebinding.yaml (100%)
 rename packages/system/cozystack-scheduler/{ => charts/cozystack-scheduler}/templates/serviceaccount.yaml (100%)
 create mode 100644 packages/system/cozystack-scheduler/charts/cozystack-scheduler/values.yaml
 create mode 100644 packages/system/cozystack-scheduler/templates/tenant-clusterroles.yaml
 delete mode 100644 packages/system/cozystack-scheduler/values.yaml

diff --git a/packages/system/cozystack-scheduler/Chart.yaml b/packages/system/cozystack-scheduler/Chart.yaml
index 7c99eaf0..c869abb4 100644
--- a/packages/system/cozystack-scheduler/Chart.yaml
+++ b/packages/system/cozystack-scheduler/Chart.yaml
@@ -1,3 +1,3 @@
 apiVersion: v2
 name: cozy-cozystack-scheduler
-version: 0.1.0
+version: 0.2.0
diff --git a/packages/system/cozystack-scheduler/Makefile b/packages/system/cozystack-scheduler/Makefile
index dc48eefe..fd4bdf30 100644
--- a/packages/system/cozystack-scheduler/Makefile
+++ b/packages/system/cozystack-scheduler/Makefile
@@ -4,7 +4,8 @@ export NAMESPACE=kube-system
 include ../../../hack/package.mk
 
 update:
-	rm -rf crds templates values.yaml Chart.yaml
+	rm -rf charts
 	tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/cozystack/cozystack-scheduler | awk -F'[/^]' 'END{print $$3}') && \
+	mkdir -p charts/cozystack-scheduler && \
 	curl -sSL https://github.com/cozystack/cozystack-scheduler/archive/refs/tags/$${tag}.tar.gz | \
-	tar xzvf - --strip 2 cozystack-scheduler-$${tag#*v}/chart
+	tar xzvf - --strip 2 -C charts/cozystack-scheduler cozystack-scheduler-$${tag#*v}/chart
diff --git a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/Chart.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/Chart.yaml
new file mode 100644
index 00000000..c869abb4
--- /dev/null
+++ b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/Chart.yaml
@@ -0,0 +1,3 @@
+apiVersion: v2
+name: cozy-cozystack-scheduler
+version: 0.2.0
diff --git a/packages/system/cozystack-scheduler/crds/cozystack.io_schedulingclasses.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/crds/cozystack.io_schedulingclasses.yaml
similarity index 100%
rename from packages/system/cozystack-scheduler/crds/cozystack.io_schedulingclasses.yaml
rename to packages/system/cozystack-scheduler/charts/cozystack-scheduler/crds/cozystack.io_schedulingclasses.yaml
diff --git a/packages/system/cozystack-scheduler/templates/clusterrole.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/clusterrole.yaml
similarity index 100%
rename from packages/system/cozystack-scheduler/templates/clusterrole.yaml
rename to packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/clusterrole.yaml
diff --git a/packages/system/cozystack-scheduler/templates/clusterrolebinding.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/clusterrolebinding.yaml
similarity index 100%
rename from packages/system/cozystack-scheduler/templates/clusterrolebinding.yaml
rename to packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/clusterrolebinding.yaml
diff --git a/packages/system/cozystack-scheduler/templates/configmap.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/configmap.yaml
similarity index 100%
rename from packages/system/cozystack-scheduler/templates/configmap.yaml
rename to packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/configmap.yaml
diff --git a/packages/system/cozystack-scheduler/templates/deployment.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/deployment.yaml
similarity index 87%
rename from packages/system/cozystack-scheduler/templates/deployment.yaml
rename to packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/deployment.yaml
index 4be389cc..0365f0de 100644
--- a/packages/system/cozystack-scheduler/templates/deployment.yaml
+++ b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/deployment.yaml
@@ -20,6 +20,9 @@ spec:
           command:
             - /cozystack-scheduler
             - --config=/etc/kubernetes/scheduler-config.yaml
+            {{- with .Values.defaultLabelSelectorKeys }}
+            - --default-label-selector-keys={{ join "," . }}
+            {{- end }}
           livenessProbe:
             httpGet:
               path: /healthz
diff --git a/packages/system/cozystack-scheduler/templates/rolebinding.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/rolebinding.yaml
similarity index 100%
rename from packages/system/cozystack-scheduler/templates/rolebinding.yaml
rename to packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/rolebinding.yaml
diff --git a/packages/system/cozystack-scheduler/templates/serviceaccount.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/serviceaccount.yaml
similarity index 100%
rename from packages/system/cozystack-scheduler/templates/serviceaccount.yaml
rename to packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/serviceaccount.yaml
diff --git a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/values.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/values.yaml
new file mode 100644
index 00000000..5ab78dbe
--- /dev/null
+++ b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/values.yaml
@@ -0,0 +1,9 @@
+image: ghcr.io/cozystack/cozystack/cozystack-scheduler:v0.2.0@sha256:89c285c5c5fe3ed8d7d597acf32fc9f045394e0f8efafd1878d6080cf112f6c2
+replicas: 1
+# defaultLabelSelectorKeys overrides the pod label keys used to auto-populate
+# nil LabelSelectors in SchedulingClass affinity and topology spread terms.
+# When empty or unset, the binary defaults are used:
+#   - apps.cozystack.io/application.group
+#   - apps.cozystack.io/application.kind
+#   - apps.cozystack.io/application.name
+# defaultLabelSelectorKeys: []
diff --git a/packages/system/cozystack-scheduler/templates/tenant-clusterroles.yaml b/packages/system/cozystack-scheduler/templates/tenant-clusterroles.yaml
new file mode 100644
index 00000000..a7b8fd21
--- /dev/null
+++ b/packages/system/cozystack-scheduler/templates/tenant-clusterroles.yaml
@@ -0,0 +1,18 @@
+---
+# == schedulingclass view cluster role ==
+# Aggregated into cozy-tenant-view (and consequently use, admin, super-admin)
+# Provides read-only access to SchedulingClass resources
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cozy:schedulingclass:view
+  labels:
+    rbac.cozystack.io/aggregate-to-tenant-view: "true"
+rules:
+- apiGroups: ["cozystack.io"]
+  resources:
+  - schedulingclasses
+  verbs:
+  - get
+  - list
+  - watch
diff --git a/packages/system/cozystack-scheduler/values.yaml b/packages/system/cozystack-scheduler/values.yaml
deleted file mode 100644
index 87086dc7..00000000
--- a/packages/system/cozystack-scheduler/values.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-image: ghcr.io/cozystack/cozystack/cozystack-scheduler:v0.1.0@sha256:5f7150c82177478467ff80628acb5a400291aff503364aa9e26fc346d79a73cf
-replicas: 1

From 4978458a266371d433ee0eaf533b9b6426896894 Mon Sep 17 00:00:00 2001
From: mattia-eleuteri <mattia@hidora.io>
Date: Wed, 18 Mar 2026 16:11:28 +0100
Subject: [PATCH 288/666] fix(csi): fail publish when migration cannot complete

ReadDir and Rename errors during migration are now hard failures
instead of warnings, preventing user data from becoming invisible
behind the /data subpath mount. Tolerate os.IsNotExist on Rename
for concurrent publish calls that already moved the file.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: mattia-eleuteri <mattia@hidora.io>
---
 .../apps/kubernetes/images/kubevirt-csi-driver/node.go    | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go b/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go
index 9c87309d..a367f27f 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go
@@ -100,9 +100,10 @@ func (w *WrappedNodeService) NodePublishVolume(ctx context.Context, req *csi.Nod
 	}
 
 	// Auto-migrate: move user files from root into /data (skip internal artifacts).
+	// Fail the publish if migration cannot complete to avoid hiding user data.
 	entries, err := os.ReadDir(tmpMount)
 	if err != nil {
-		klog.Warningf("Failed to read NFS root for migration (volume %s): %v", req.GetVolumeId(), err)
+		return nil, status.Errorf(codes.Internal, "failed to read NFS root for migration (volume %s): %v", req.GetVolumeId(), err)
 	}
 	for _, entry := range entries {
 		name := entry.Name()
@@ -116,7 +117,10 @@ func (w *WrappedNodeService) NodePublishVolume(ctx context.Context, req *csi.Nod
 		}
 		klog.Infof("Migrating %s to /data/%s for volume %s", name, name, req.GetVolumeId())
 		if err := os.Rename(src, dst); err != nil {
-			klog.Warningf("Failed to migrate %s for volume %s: %v", name, req.GetVolumeId(), err)
+			if os.IsNotExist(err) {
+				continue // benign: concurrent publish already moved it
+			}
+			return nil, status.Errorf(codes.Internal, "failed to migrate %s for volume %s: %v", name, req.GetVolumeId(), err)
 		}
 	}
 

From 08676b9c05d8d08c305d168cca8fc628b8441ec4 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Wed, 18 Mar 2026 21:37:23 +0500
Subject: [PATCH 289/666] fix(installer): add build revision marker to trigger
 platform reconciliation

When only leaf packages change but the platform chart remains unchanged,
the Flux ArtifactGenerator produces an ExternalArtifact with the same
content digest. This prevents the platform HelmRelease from reconciling,
so lookup() in repository.yaml never runs and cozystack-packages
OCIRepository does not pick up the new OCI digest.

Write a content-based hash of the working tree state to
core/platform/.build-revision before pushing the OCI artifact, ensuring
the platform chart content always changes on every build.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .gitignore                       | 3 +++
 packages/core/installer/Makefile | 1 +
 2 files changed, 4 insertions(+)

diff --git a/.gitignore b/.gitignore
index 0ecfa223..4e1e3119 100644
--- a/.gitignore
+++ b/.gitignore
@@ -80,3 +80,6 @@ fabric.properties
 **/.DS_Store
 
 tmp/
+
+# build revision marker (generated by make image-packages)
+packages/core/platform/.build-revision
diff --git a/packages/core/installer/Makefile b/packages/core/installer/Makefile
index 7038bb9c..a661bed4 100644
--- a/packages/core/installer/Makefile
+++ b/packages/core/installer/Makefile
@@ -31,6 +31,7 @@ image-operator:
 
 image-packages:
 	mkdir -p ../../../_out/assets images
+	echo $$(git rev-parse HEAD; git diff HEAD; git ls-files --others --exclude-standard) | shasum -a 256 > ../platform/.build-revision
 	flux push artifact \
 		oci://$(REGISTRY)/cozystack-packages:$(call settag,$(TAG)) \
 		--path=../../../packages \

From 5f740134b546c577a97ec42da67de1280e739543 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Wed, 18 Mar 2026 22:33:35 +0500
Subject: [PATCH 290/666] fix(postgres): add lifecycle management for
 helm-managed databases
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previously, removing a database from values.databases had no effect —
the database and its associated roles persisted in PostgreSQL. This
made it impossible to cleanly delete databases via Helm.

Add two cleanup stages to the init script:
- Delete databases that have the 'database managed by helm' comment
  but are no longer listed in values.databases
- Delete orphaned roles (db_admin, db_readonly) with proper membership
  revocation before dropping

This mirrors the existing user deletion logic and completes the
declarative lifecycle for databases.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .../apps/postgres/templates/init-script.yaml  | 33 +++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/packages/apps/postgres/templates/init-script.yaml b/packages/apps/postgres/templates/init-script.yaml
index 80f7c4c7..1a295034 100644
--- a/packages/apps/postgres/templates/init-script.yaml
+++ b/packages/apps/postgres/templates/init-script.yaml
@@ -66,6 +66,39 @@ stringData:
     EOT
     done
 
+    echo "== delete databases"
+    MANAGED_DBS=$(psql -v ON_ERROR_STOP=1 -t -A -c "SELECT datname FROM pg_database d JOIN pg_shdescription s ON d.oid = s.objoid WHERE s.description = 'database managed by helm'")
+    DEFINED_DBS="{{ join " " (keys .Values.databases) }}"
+    DELETE_DBS=$(for db in $MANAGED_DBS; do case " $DEFINED_DBS " in *" $db "*) :;; *) echo $db;; esac; done)
+
+    echo "databases to delete: $DELETE_DBS"
+    for db in $DELETE_DBS; do
+    psql -v ON_ERROR_STOP=1 --echo-all -c "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = '$db' AND pid <> pg_backend_pid();"
+    psql -v ON_ERROR_STOP=1 --echo-all -c "DROP DATABASE IF EXISTS \"$db\";"
+    done
+
+    echo "== delete orphaned managed roles"
+    MANAGED_ROLES=$(psql -v ON_ERROR_STOP=1 -t -A -c "SELECT rolname FROM pg_roles r JOIN pg_shdescription s ON r.oid = s.objoid WHERE s.description = 'role managed by helm'")
+    DEFINED_ROLES="{{ range $database, $d := .Values.databases }}{{ $database }}_admin {{ $database }}_readonly {{ end }}"
+    DELETE_ROLES=$(for role in $MANAGED_ROLES; do case " $DEFINED_ROLES " in *" $role "*) :;; *) echo $role;; esac; done)
+
+    echo "roles to delete: $DELETE_ROLES"
+    for role in $DELETE_ROLES; do
+    psql -v ON_ERROR_STOP=1 --echo-all <<EOT
+    DO \$\$
+    DECLARE
+        member record;
+    BEGIN
+        FOR member IN SELECT m.rolname FROM pg_auth_members am JOIN pg_roles m ON am.member = m.oid JOIN pg_roles r ON am.roleid = r.oid WHERE r.rolname = '$role' LOOP
+            EXECUTE format('REVOKE %I FROM %I', '$role', member.rolname);
+        END LOOP;
+    END\$\$;
+    REASSIGN OWNED BY "$role" TO postgres;
+    DROP OWNED BY "$role";
+    DROP ROLE IF EXISTS "$role";
+    EOT
+    done
+
     echo "== create databases and roles"
     {{- if .Values.databases }}
     psql -v ON_ERROR_STOP=1 --echo-all <<\EOT

From 7f38b67ac05c959041d88b4da0b099eb43f9fd42 Mon Sep 17 00:00:00 2001
From: Timofei Larkin <lllamnyp@gmail.com>
Date: Tue, 3 Mar 2026 10:36:49 +0300
Subject: [PATCH 291/666] [keycloak] Enable injecting themes

This patch lets Cozystack admins specify initContainers that will run
`cp -r /themes/ /opt/keycloak/themes/` on startup, effectively providing
an interface for operators to inject custom themes into the keycloak
deployment to customize the UI.

```release-note
[keycloak] Enable injection of user-provided themes for Keycloak via
initContainers.
```

Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
---
 packages/system/keycloak/templates/sts.yaml | 21 +++++++++++++++++++++
 packages/system/keycloak/values.yaml        |  4 ++++
 2 files changed, 25 insertions(+)

diff --git a/packages/system/keycloak/templates/sts.yaml b/packages/system/keycloak/templates/sts.yaml
index e2bba431..90d2d95c 100644
--- a/packages/system/keycloak/templates/sts.yaml
+++ b/packages/system/keycloak/templates/sts.yaml
@@ -41,6 +41,17 @@ spec:
       restartPolicy: Always
       securityContext:
         fsGroup: 1000
+      {{- if .Values.themes }}
+      initContainers:
+        {{- range .Values.themes }}
+        - name: theme-{{ .name }}
+          image: {{ .image }}
+          command: ["sh", "-c", "cp -r /themes/* /opt/keycloak/themes/"]
+          volumeMounts:
+            - name: themes
+              mountPath: /opt/keycloak/themes
+        {{- end }}
+      {{- end }}
       containers:
         - name: keycloak
           image: {{ .Values.image }}
@@ -128,6 +139,11 @@ spec:
               value: https://{{ $ingressHost }}
             - name: JAVA_OPTS_APPEND
               value: "-Djgroups.dns.query=keycloak-headless.cozy-keycloak.svc.{{ $clusterDomain }}"
+          {{- if .Values.themes }}
+          volumeMounts:
+            - name: themes
+              mountPath: /opt/keycloak/themes
+          {{- end }}
           ports:
             - name: http
               containerPort: 8080
@@ -155,4 +171,9 @@ spec:
             periodSeconds: 10
             timeoutSeconds: 5
             failureThreshold: 3
+      {{- if .Values.themes }}
+      volumes:
+        - name: themes
+          emptyDir: {}
+      {{- end }}
       terminationGracePeriodSeconds: 60
diff --git a/packages/system/keycloak/values.yaml b/packages/system/keycloak/values.yaml
index b2f53d01..6cba9aef 100644
--- a/packages/system/keycloak/values.yaml
+++ b/packages/system/keycloak/values.yaml
@@ -14,3 +14,7 @@ resources:
   requests:
     memory: 500Mi
     cpu: 100m
+
+themes: []
+# - name: my-theme
+#   image: my-registry/my-keycloak-theme:v1.0

From 83c0271d0c6e9b783632baf79fb40e78bb46cb4f Mon Sep 17 00:00:00 2001
From: Viktor Nyakas <viktor.nyakas@alphacruncher.com>
Date: Thu, 12 Mar 2026 13:57:55 +0100
Subject: [PATCH 292/666] [monitoring] Add Slack DASHBOARD_URL,
 SLACK_SUMMARY_FMT envars, vmagent environment label, and dynamictext Grafana
 plugin

Signed-off-by: Viktor Nyakas <viktor.nyakas@alphacruncher.com>
---
 packages/system/monitoring/images/grafana/Dockerfile    | 1 +
 packages/system/monitoring/templates/alerta/alerta.yaml | 8 ++++++++
 packages/system/monitoring/templates/vm/vmagent.yaml    | 3 +++
 packages/system/monitoring/values.yaml                  | 3 +++
 4 files changed, 15 insertions(+)

diff --git a/packages/system/monitoring/images/grafana/Dockerfile b/packages/system/monitoring/images/grafana/Dockerfile
index f8597a5c..cc65c9d3 100644
--- a/packages/system/monitoring/images/grafana/Dockerfile
+++ b/packages/system/monitoring/images/grafana/Dockerfile
@@ -13,3 +13,4 @@ RUN curl -L https://github.com/VictoriaMetrics/victorialogs-datasource/releases/
 
 RUN grafana-cli --pluginsDir /var/lib/grafana-plugins plugins install natel-discrete-panel
 RUN grafana-cli --pluginsDir /var/lib/grafana-plugins plugins install grafana-worldmap-panel
+RUN grafana-cli --pluginsDir /var/lib/grafana-plugins plugins install marcusolsson-dynamictext-panel
diff --git a/packages/system/monitoring/templates/alerta/alerta.yaml b/packages/system/monitoring/templates/alerta/alerta.yaml
index d727d5e6..44046d1f 100644
--- a/packages/system/monitoring/templates/alerta/alerta.yaml
+++ b/packages/system/monitoring/templates/alerta/alerta.yaml
@@ -140,6 +140,14 @@ spec:
             - name: SLACK_SEVERITY_FILTER
               value: {{ .Values.alerta.alerts.slack.disabledSeverity | toJson | quote }}
             {{- end }}
+            {{- if .Values.alerta.alerts.slack.dashboardUrl }}
+            - name: DASHBOARD_URL
+              value: {{ .Values.alerta.alerts.slack.dashboardUrl | quote }}
+            {{- end }}
+            {{- if .Values.alerta.alerts.slack.summaryFmt }}
+            - name: SLACK_SUMMARY_FMT
+              value: {{ .Values.alerta.alerts.slack.summaryFmt | quote }}
+            {{- end }}
             {{- end }}
 
           ports:
diff --git a/packages/system/monitoring/templates/vm/vmagent.yaml b/packages/system/monitoring/templates/vm/vmagent.yaml
index c787376b..98bff1e1 100644
--- a/packages/system/monitoring/templates/vm/vmagent.yaml
+++ b/packages/system/monitoring/templates/vm/vmagent.yaml
@@ -11,6 +11,9 @@ spec:
   externalLabels:
     cluster: {{ .Values.vmagent.externalLabels.cluster }}
     tenant: {{ .Release.Namespace }}
+    {{- if .Values.vmagent.externalLabels.environment }}
+    environment: {{ .Values.vmagent.externalLabels.environment | quote }}
+    {{- end }}
   extraArgs:
     promscrape.maxScrapeSize: "32MB"
     promscrape.streamParse: "true"
diff --git a/packages/system/monitoring/values.yaml b/packages/system/monitoring/values.yaml
index 648a4b4a..3b632cbe 100644
--- a/packages/system/monitoring/values.yaml
+++ b/packages/system/monitoring/values.yaml
@@ -63,6 +63,8 @@ alerta:
     slack:
       url: ""
       disabledSeverity: []
+      dashboardUrl: ""
+      summaryFmt: ""
 grafana:
   db:
     size: 10Gi
@@ -76,6 +78,7 @@ grafana:
 vmagent:
   externalLabels:
     cluster: cozystack
+    environment: ""
   remoteWrite:
     urls:
       - http://vminsert-shortterm:8480/insert/0/prometheus

From ea82c5e65896a65198a4cf469297e358ecabdd2b Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Thu, 19 Mar 2026 01:43:00 +0000
Subject: [PATCH 293/666] docs: add changelog for v1.1.3

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.1.3.md | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 docs/changelogs/v1.1.3.md

diff --git a/docs/changelogs/v1.1.3.md b/docs/changelogs/v1.1.3.md
new file mode 100644
index 00000000..f589476e
--- /dev/null
+++ b/docs/changelogs/v1.1.3.md
@@ -0,0 +1,19 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.1.3
+-->
+
+## Fixes
+
+* **[kubernetes] Fix CiliumNetworkPolicy endpointSelector not updated for multi-node RWX volumes**: When an NFS-backed RWX volume was published to multiple VMs, the `CiliumNetworkPolicy` `endpointSelector.matchLabels` was set only for the first VM and never broadened on subsequent `ControllerPublishVolume` calls. This caused Cilium to block NFS egress so that mounts hung on all nodes except the first. The selector now uses `matchExpressions` with `operator: In` and is rebuilt whenever owner references are added or removed ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2227, #2229).
+
+* **[dashboard] Fix dashboard-client secret desynchronization with Keycloak after upgrades**: When the `dashboard-client` Kubernetes Secret was recreated with a new value after an upgrade or reinstall, the `KeycloakClient` spec remained unchanged and the EDP Keycloak operator skipped reconciliation, leaving Keycloak with the stale secret and causing authentication failures for the dashboard. A `secret-hash` annotation containing the SHA256 hash of the client secret is now added to the `KeycloakClient` resource; any secret rotation updates the hash in metadata, triggering operator reconciliation and syncing the new secret to Keycloak ([**@sircthulhu**](https://github.com/sircthulhu) in #2231, #2241).
+
+* **[etcd] Fix defrag CronJob accumulating hundreds of pods during cluster upgrades**: After upgrading CozyStack, the etcd defrag CronJob could accumulate hundreds of running and failed pods when etcd was temporarily unavailable during the upgrade, because no concurrency or retry limits were configured. Added `concurrencyPolicy: Forbid` to prevent parallel jobs, `startingDeadlineSeconds: 300` to discard missed schedules older than 5 minutes, `failedJobsHistoryLimit: 1` to limit failure retention, `activeDeadlineSeconds: 1800` for a 30-minute per-job timeout, and `backoffLimit: 2` to cap retries ([**@sircthulhu**](https://github.com/sircthulhu) in #2233, #2234).
+
+## Documentation
+
+* **[website] Document `keycloakInternalUrl` platform value**: Added reference documentation for the `authentication.oidc.keycloakInternalUrl` platform value to the Platform Package Reference, Self-Signed Certificates guide, and Enable OIDC Server guide, explaining how to route dashboard backend OIDC requests through the internal Keycloak service URL ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#452).
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.1.2...v1.1.3

From 2237f9114c922b3a64340a5f4e3169ed9d7e83e2 Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Thu, 19 Mar 2026 01:43:04 +0000
Subject: [PATCH 294/666] docs: add changelog for v1.0.6

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.0.6.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 docs/changelogs/v1.0.6.md

diff --git a/docs/changelogs/v1.0.6.md b/docs/changelogs/v1.0.6.md
new file mode 100644
index 00000000..c65c5fd5
--- /dev/null
+++ b/docs/changelogs/v1.0.6.md
@@ -0,0 +1,21 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.0.6
+-->
+
+## Fixes
+
+* **[kubernetes] Fix CiliumNetworkPolicy endpointSelector for multi-node RWX volumes**: When an NFS-backed RWX volume is published to multiple VMs, the network policy's `endpointSelector` was only capturing the first VM. Subsequent volume publications added owner references but never broadened the selector, causing Cilium to block NFS egress and making mounts hang on all nodes except the first. The fix switches from `matchLabels` to `matchExpressions` (`operator: In`) so the selector lists all VM names and is rebuilt whenever owner references change ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2227, #2228).
+
+* **[dashboard] Fix dashboard authentication failures after secret recreation**: Added a `secret-hash` annotation containing the SHA256 hash of the client secret to the dashboard `KeycloakClient` resource. Without this annotation, if the `dashboard-client` Secret was recreated (e.g. after an upgrade or reinstall), the `KeycloakClient` spec stayed unchanged, the EDP Keycloak operator skipped reconciliation, and Keycloak kept the stale secret — causing dashboard authentication failures. Now any secret value change updates the annotation hash, triggering operator reconciliation and syncing the new secret to Keycloak ([**@sircthulhu**](https://github.com/sircthulhu) in #2231, #2240).
+
+* **[etcd] Fix defrag CronJob accumulating pods during cluster upgrades**: Added protective limits to the etcd defragmentation CronJob to prevent job pile-up when etcd is temporarily unavailable during upgrades. Without `concurrencyPolicy: Forbid`, new jobs kept being created hourly while previous ones were still failing, accumulating hundreds of running/failed pods across tenants. The fix adds `concurrencyPolicy: Forbid`, a `startingDeadlineSeconds: 300` guard against missed schedules, a 30-minute job timeout, and limits retries to 2 ([**@sircthulhu**](https://github.com/sircthulhu) in #2233, #2235).
+
+## Documentation
+
+* **[website] Document `keycloakInternalUrl` platform value**: Added documentation for the `authentication.oidc.keycloakInternalUrl` platform value to the Platform Package Reference, Self-Signed Certificates guide, and Enable OIDC Server pages. This value routes dashboard backend OIDC requests through the internal Keycloak service, which is useful in environments with self-signed certificates ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#452).
+
+* **[website] Publish Cozystack v1.0 release announcement**: Added the official Cozystack v1.0 release announcement blog post and supporting images, celebrating the first stable release of the platform ([**@tym83**](https://github.com/tym83) in cozystack/website#453, cozystack/website#454).
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.5...v1.0.6

From 55f6882387a0cc7f8abfed0587eb5ee1f6efd90b Mon Sep 17 00:00:00 2001
From: Timofei Larkin <lllamnyp@gmail.com>
Date: Thu, 19 Mar 2026 07:29:47 +0300
Subject: [PATCH 295/666] [cozy-lib] Add a hexToInt helper

Simplifies parsing sha256 digits to decimals for the VPC peering
feature.

Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
---
 packages/apps/vpc/templates/vpc.yaml             | 9 ++-------
 packages/library/cozy-lib/templates/_strings.tpl | 3 +++
 2 files changed, 5 insertions(+), 7 deletions(-)
 create mode 100644 packages/library/cozy-lib/templates/_strings.tpl

diff --git a/packages/apps/vpc/templates/vpc.yaml b/packages/apps/vpc/templates/vpc.yaml
index cb860279..784c181b 100644
--- a/packages/apps/vpc/templates/vpc.yaml
+++ b/packages/apps/vpc/templates/vpc.yaml
@@ -16,7 +16,6 @@ spec:
   namespaces:
     - {{ .Release.Namespace }}
 {{- if .Values.peers }}
-{{- $hexLookup := dict "0" 0 "1" 1 "2" 2 "3" 3 "4" 4 "5" 5 "6" 6 "7" 7 "8" 8 "9" 9 "a" 10 "b" 11 "c" 12 "d" 13 "e" 14 "f" 15 }}
   vpcPeerings:
 {{- range .Values.peers }}
 {{- $remoteRelease := printf "virtualprivatecloud-%s" .vpcName }}
@@ -24,12 +23,8 @@ spec:
 {{- $sorted := list $vpcId $remoteVpcId | sortAlpha }}
 {{- $pairKey := join "/" $sorted }}
 {{- $pairHash := sha256sum $pairKey }}
-{{- $h0 := int (get $hexLookup (substr 0 1 $pairHash)) }}
-{{- $h1 := int (get $hexLookup (substr 1 2 $pairHash)) }}
-{{- $h2 := int (get $hexLookup (substr 2 3 $pairHash)) }}
-{{- $h3 := int (get $hexLookup (substr 3 4 $pairHash)) }}
-{{- $byte0 := add (mul $h0 16) $h1 }}
-{{- $byte1 := add (mul $h2 16) $h3 }}
+{{- $byte0 := int (include "cozy-lib.strings.hexToInt" (substr 0 2 $pairHash)) }}
+{{- $byte1 := int (include "cozy-lib.strings.hexToInt" (substr 2 4 $pairHash)) }}
 {{- $oct3 := int (add (mod $byte0 254) 1) }}
 {{- $base4 := int (mul (mod $byte1 64) 4) }}
 {{- if eq $vpcId (index $sorted 0) }}
diff --git a/packages/library/cozy-lib/templates/_strings.tpl b/packages/library/cozy-lib/templates/_strings.tpl
new file mode 100644
index 00000000..0ba8153f
--- /dev/null
+++ b/packages/library/cozy-lib/templates/_strings.tpl
@@ -0,0 +1,3 @@
+{{- define "cozy-lib.strings.hexToInt" }}
+{{- printf "num: 0x%s" . | fromYaml | dig "num" 0 }}
+{{- end }}

From 8285191fb1887f66c161073d2eb015983c39a2b5 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Thu, 19 Mar 2026 11:15:47 +0500
Subject: [PATCH 296/666] fix(dashboard): prevent JSONPath crash on unresolved
 flatMap placeholders

When viewing Tenant details with resourceQuotas, the "Used" column
references $.status.used[_flatMapData_Key]. If the flatMap placeholder
is not resolved (key missing from expanded row), the raw placeholder
is passed to the JSONPath parser which crashes with a parse error.

The original flatmap-dynamic-key.diff patch that handled this was
removed during the 1.4.0 upgrade, assuming upstream included the fix.
Upstream adopted the reordering (flatMap before customFields) but not
the fallback protection.

Add a patch that checks for unresolved _flatMap*_Key placeholders
after regex substitution and returns null instead of calling jp.query()
with an invalid expression.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .../patches/flatmap-unresolved-placeholder.diff | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-unresolved-placeholder.diff

diff --git a/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-unresolved-placeholder.diff b/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-unresolved-placeholder.diff
new file mode 100644
index 00000000..df5856ee
--- /dev/null
+++ b/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-unresolved-placeholder.diff
@@ -0,0 +1,17 @@
+diff --git a/src/components/molecules/EnrichedTable/organisms/EnrichedTableProvider/utils.ts b/src/components/molecules/EnrichedTable/organisms/EnrichedTableProvider/utils.ts
+--- a/src/components/molecules/EnrichedTable/organisms/EnrichedTableProvider/utils.ts
++++ b/src/components/molecules/EnrichedTable/organisms/EnrichedTableProvider/utils.ts
+@@ -185,8 +185,13 @@
+                 return `['${escaped}']`
+               })
+             }
+-            const jpQueryResult = jp.query(el, `$${resolvedJsonPath}`)
+-            fieldValue = Array.isArray(jpQueryResult) && jpQueryResult.length === 1 ? jpQueryResult[0] : jpQueryResult
++            if (/_flatMap[^[\]]+_Key/.test(resolvedJsonPath)) {
++              // Placeholder was not resolved (row not yet expanded or key missing) — skip query
++              fieldValue = null
++            } else {
++              const jpQueryResult = jp.query(el, `$${resolvedJsonPath}`)
++              fieldValue = Array.isArray(jpQueryResult) && jpQueryResult.length === 1 ? jpQueryResult[0] : jpQueryResult
++            }
+           }

From c7509ab4c66ea945176548bdbb7ee23282ca048f Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Thu, 19 Mar 2026 11:24:16 +0500
Subject: [PATCH 297/666] fix(dashboard): align regex with existing pattern in
 toolkit

Use [^\]]+ (same as existing code in utils.ts) instead of [^[\]]+ for
consistency.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .../patches/flatmap-unresolved-placeholder.diff                 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-unresolved-placeholder.diff b/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-unresolved-placeholder.diff
index df5856ee..dceea424 100644
--- a/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-unresolved-placeholder.diff
+++ b/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-unresolved-placeholder.diff
@@ -7,7 +7,7 @@ diff --git a/src/components/molecules/EnrichedTable/organisms/EnrichedTableProvi
              }
 -            const jpQueryResult = jp.query(el, `$${resolvedJsonPath}`)
 -            fieldValue = Array.isArray(jpQueryResult) && jpQueryResult.length === 1 ? jpQueryResult[0] : jpQueryResult
-+            if (/_flatMap[^[\]]+_Key/.test(resolvedJsonPath)) {
++            if (/_flatMap[^\]]+_Key/.test(resolvedJsonPath)) {
 +              // Placeholder was not resolved (row not yet expanded or key missing) — skip query
 +              fieldValue = null
 +            } else {

From 51949124c5f7afafac6bc37d7518ed3cb4fbcac1 Mon Sep 17 00:00:00 2001
From: Timofei Larkin <lllamnyp@gmail.com>
Date: Fri, 20 Mar 2026 11:26:36 +0300
Subject: [PATCH 298/666] [platform] Enable cozystack-scheduler by default

## What this PR does

Install the cozystack-scheduler package and the SchedulingClass CRD by
default.

### Release-note

```release-note
[cozystack-scheduler] Enable the cozystack-scheduler and SchedulingClass
CRD by default.
```

Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
---
 packages/core/platform/templates/bundles/system.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/core/platform/templates/bundles/system.yaml b/packages/core/platform/templates/bundles/system.yaml
index 8d7e948f..795b523f 100644
--- a/packages/core/platform/templates/bundles/system.yaml
+++ b/packages/core/platform/templates/bundles/system.yaml
@@ -130,7 +130,7 @@
 {{include "cozystack.platform.package.default" (list "cozystack.cozystack-basics" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.backupstrategy-controller" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.backup-controller" $) }}
-{{include "cozystack.platform.package.optional.default" (list "cozystack.velero" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.cozystack-scheduler" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.vertical-pod-autoscaler" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.metrics-server" $) }}
 {{- $monitoringAgentsComponents := dict "monitoring-agents" (dict "values" (dict "global" (dict "target" "tenant-root"))) -}}
@@ -148,11 +148,11 @@
 {{include "cozystack.platform.package.optional.default" (list "cozystack.external-dns" $) }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.external-dns-application" $) }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.external-secrets-operator" $) }}
+{{include "cozystack.platform.package.optional.default" (list "cozystack.velero" $) }}
 {{- if has "cozystack.bootbox" (default (list) .Values.bundles.enabledPackages) }}
 {{include "cozystack.platform.package.default" (list "cozystack.bootbox-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.bootbox" $) }}
 {{- end }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.hetzner-robotlb" $) }}
-{{include "cozystack.platform.package.optional.default" (list "cozystack.cozystack-scheduler" $) }}
 
 {{- end }}

From 1598d7fd03e848096f878e06f60ba0a1434e0b9f Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Fri, 20 Mar 2026 15:51:59 +0100
Subject: [PATCH 299/666] [talos] Bump Talos to v1.12.6

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../images/talos/profiles/initramfs.yaml      | 22 +++++++++----------
 .../images/talos/profiles/installer.yaml      | 22 +++++++++----------
 .../core/talos/images/talos/profiles/iso.yaml | 22 +++++++++----------
 .../talos/images/talos/profiles/kernel.yaml   | 22 +++++++++----------
 .../talos/images/talos/profiles/metal.yaml    | 22 +++++++++----------
 .../talos/images/talos/profiles/nocloud.yaml  | 22 +++++++++----------
 6 files changed, 66 insertions(+), 66 deletions(-)

diff --git a/packages/core/talos/images/talos/profiles/initramfs.yaml b/packages/core/talos/images/talos/profiles/initramfs.yaml
index 20bc27d3..182fb3e8 100644
--- a/packages/core/talos/images/talos/profiles/initramfs.yaml
+++ b/packages/core/talos/images/talos/profiles/initramfs.yaml
@@ -3,24 +3,24 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.12.1
+version: v1.12.6
 input:
   kernel:
     path: /usr/install/amd64/vmlinuz
   initramfs:
     path: /usr/install/amd64/initramfs.xz
   baseInstaller:
-    imageRef: "ghcr.io/siderolabs/installer:v1.12.1"
+    imageRef: "ghcr.io/siderolabs/installer:v1.12.6"
   systemExtensions:
-    - imageRef: ghcr.io/siderolabs/amd-ucode:20251125@sha256:aa2c684933d28cf10ef785f0d94f91d6d098e164374114648867cf81c2b585fe
-    - imageRef: ghcr.io/siderolabs/amdgpu:20251125-v1.12.1@sha256:b73aba10ac51cd0d74a6c45210ccee3f6b7d2d97f9b3151d0563b11aa0727599
-    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20251125@sha256:fe33c69c471a8d097c58ab9e5e1e099c3c6e5bb785e74f6f135fdbd71c3b0feb
-    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20251125@sha256:01458f60448e166eeb641ee989b941725cbe6759e10afe2251c6d1b1ca5ba1b7
-    - imageRef: ghcr.io/siderolabs/i915:20251125-v1.12.1@sha256:fb89c85a04ecb85abaec9d400e03a1628bf68aef3580e98f340cbe8920a6e4ed
-    - imageRef: ghcr.io/siderolabs/intel-ucode:20251111@sha256:51b7d1c31cb82f340a96228f1870b1e829e8ed2dfeef6d39926975303736d26a
-    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20251125@sha256:485ef0a0b58328ded511e9a76014c353da24bb147c8b2929068827e5f9a22326
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.1@sha256:2c0dc35d5f3e1ac23de6eeee5554d9da010ac848a733a538c9568a9ccc782d86
-    - imageRef: ghcr.io/siderolabs/zfs:2.4.0-v1.12.1@sha256:926f4cdaaa2cfad09f080eda5cfd08b8ba0bad083df3ca59e9764f4104539246
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20260309@sha256:716cd5350f77e7b10eebef88d8abdd0c32f2d929acd2bceac7ea33c0aac3b1a7
+    - imageRef: ghcr.io/siderolabs/amdgpu:20260309-v1.12.6@sha256:64c7cbcde57a69742c76e3899385f5cd6af1238b0aba094962197fd4098838bd
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20260309@sha256:b17b87d9a20c806cf186e95ab351b771ffd622a35afcbd41eb07d4642680a231
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20260309@sha256:eee55c66cb23fe93380b83909af2cd4ede970205b861c0aa147404c88e8c7f65
+    - imageRef: ghcr.io/siderolabs/i915:20260309-v1.12.6@sha256:6d150e23b2ca98ed34fca2b0510bc97e912f95839926bf6e02c55952e15387c2
+    - imageRef: ghcr.io/siderolabs/intel-ucode:20260227@sha256:6112f6426a7081727545f7c33dcf2a89ff672494847b180380b4c58f3544a7b2
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20260309@sha256:b97cfde1e252412ba594a16302a3505f80aee1f105e2aa76b3bdf3b9dcc56cab
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.6@sha256:f524139c5be4626d7f2b6bd47745ce93648f3f1ab2b681fb00f8ab97ec2c19a3
+    - imageRef: ghcr.io/siderolabs/zfs:2.4.1-v1.12.6@sha256:059d39f1d2d6dde263dbd8062207d0aa68805bb0748c087494791c7f985b87d1
 output:
   kind: initramfs
   imageOptions: {}
diff --git a/packages/core/talos/images/talos/profiles/installer.yaml b/packages/core/talos/images/talos/profiles/installer.yaml
index b219e012..c56c1d32 100644
--- a/packages/core/talos/images/talos/profiles/installer.yaml
+++ b/packages/core/talos/images/talos/profiles/installer.yaml
@@ -3,24 +3,24 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.12.1
+version: v1.12.6
 input:
   kernel:
     path: /usr/install/amd64/vmlinuz
   initramfs:
     path: /usr/install/amd64/initramfs.xz
   baseInstaller:
-    imageRef: "ghcr.io/siderolabs/installer:v1.12.1"
+    imageRef: "ghcr.io/siderolabs/installer:v1.12.6"
   systemExtensions:
-    - imageRef: ghcr.io/siderolabs/amd-ucode:20251125@sha256:aa2c684933d28cf10ef785f0d94f91d6d098e164374114648867cf81c2b585fe
-    - imageRef: ghcr.io/siderolabs/amdgpu:20251125-v1.12.1@sha256:b73aba10ac51cd0d74a6c45210ccee3f6b7d2d97f9b3151d0563b11aa0727599
-    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20251125@sha256:fe33c69c471a8d097c58ab9e5e1e099c3c6e5bb785e74f6f135fdbd71c3b0feb
-    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20251125@sha256:01458f60448e166eeb641ee989b941725cbe6759e10afe2251c6d1b1ca5ba1b7
-    - imageRef: ghcr.io/siderolabs/i915:20251125-v1.12.1@sha256:fb89c85a04ecb85abaec9d400e03a1628bf68aef3580e98f340cbe8920a6e4ed
-    - imageRef: ghcr.io/siderolabs/intel-ucode:20251111@sha256:51b7d1c31cb82f340a96228f1870b1e829e8ed2dfeef6d39926975303736d26a
-    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20251125@sha256:485ef0a0b58328ded511e9a76014c353da24bb147c8b2929068827e5f9a22326
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.1@sha256:2c0dc35d5f3e1ac23de6eeee5554d9da010ac848a733a538c9568a9ccc782d86
-    - imageRef: ghcr.io/siderolabs/zfs:2.4.0-v1.12.1@sha256:926f4cdaaa2cfad09f080eda5cfd08b8ba0bad083df3ca59e9764f4104539246
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20260309@sha256:716cd5350f77e7b10eebef88d8abdd0c32f2d929acd2bceac7ea33c0aac3b1a7
+    - imageRef: ghcr.io/siderolabs/amdgpu:20260309-v1.12.6@sha256:64c7cbcde57a69742c76e3899385f5cd6af1238b0aba094962197fd4098838bd
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20260309@sha256:b17b87d9a20c806cf186e95ab351b771ffd622a35afcbd41eb07d4642680a231
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20260309@sha256:eee55c66cb23fe93380b83909af2cd4ede970205b861c0aa147404c88e8c7f65
+    - imageRef: ghcr.io/siderolabs/i915:20260309-v1.12.6@sha256:6d150e23b2ca98ed34fca2b0510bc97e912f95839926bf6e02c55952e15387c2
+    - imageRef: ghcr.io/siderolabs/intel-ucode:20260227@sha256:6112f6426a7081727545f7c33dcf2a89ff672494847b180380b4c58f3544a7b2
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20260309@sha256:b97cfde1e252412ba594a16302a3505f80aee1f105e2aa76b3bdf3b9dcc56cab
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.6@sha256:f524139c5be4626d7f2b6bd47745ce93648f3f1ab2b681fb00f8ab97ec2c19a3
+    - imageRef: ghcr.io/siderolabs/zfs:2.4.1-v1.12.6@sha256:059d39f1d2d6dde263dbd8062207d0aa68805bb0748c087494791c7f985b87d1
 output:
   kind: installer
   imageOptions: {}
diff --git a/packages/core/talos/images/talos/profiles/iso.yaml b/packages/core/talos/images/talos/profiles/iso.yaml
index 5773c6a6..25fc336a 100644
--- a/packages/core/talos/images/talos/profiles/iso.yaml
+++ b/packages/core/talos/images/talos/profiles/iso.yaml
@@ -3,24 +3,24 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.12.1
+version: v1.12.6
 input:
   kernel:
     path: /usr/install/amd64/vmlinuz
   initramfs:
     path: /usr/install/amd64/initramfs.xz
   baseInstaller:
-    imageRef: "ghcr.io/siderolabs/installer:v1.12.1"
+    imageRef: "ghcr.io/siderolabs/installer:v1.12.6"
   systemExtensions:
-    - imageRef: ghcr.io/siderolabs/amd-ucode:20251125@sha256:aa2c684933d28cf10ef785f0d94f91d6d098e164374114648867cf81c2b585fe
-    - imageRef: ghcr.io/siderolabs/amdgpu:20251125-v1.12.1@sha256:b73aba10ac51cd0d74a6c45210ccee3f6b7d2d97f9b3151d0563b11aa0727599
-    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20251125@sha256:fe33c69c471a8d097c58ab9e5e1e099c3c6e5bb785e74f6f135fdbd71c3b0feb
-    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20251125@sha256:01458f60448e166eeb641ee989b941725cbe6759e10afe2251c6d1b1ca5ba1b7
-    - imageRef: ghcr.io/siderolabs/i915:20251125-v1.12.1@sha256:fb89c85a04ecb85abaec9d400e03a1628bf68aef3580e98f340cbe8920a6e4ed
-    - imageRef: ghcr.io/siderolabs/intel-ucode:20251111@sha256:51b7d1c31cb82f340a96228f1870b1e829e8ed2dfeef6d39926975303736d26a
-    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20251125@sha256:485ef0a0b58328ded511e9a76014c353da24bb147c8b2929068827e5f9a22326
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.1@sha256:2c0dc35d5f3e1ac23de6eeee5554d9da010ac848a733a538c9568a9ccc782d86
-    - imageRef: ghcr.io/siderolabs/zfs:2.4.0-v1.12.1@sha256:926f4cdaaa2cfad09f080eda5cfd08b8ba0bad083df3ca59e9764f4104539246
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20260309@sha256:716cd5350f77e7b10eebef88d8abdd0c32f2d929acd2bceac7ea33c0aac3b1a7
+    - imageRef: ghcr.io/siderolabs/amdgpu:20260309-v1.12.6@sha256:64c7cbcde57a69742c76e3899385f5cd6af1238b0aba094962197fd4098838bd
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20260309@sha256:b17b87d9a20c806cf186e95ab351b771ffd622a35afcbd41eb07d4642680a231
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20260309@sha256:eee55c66cb23fe93380b83909af2cd4ede970205b861c0aa147404c88e8c7f65
+    - imageRef: ghcr.io/siderolabs/i915:20260309-v1.12.6@sha256:6d150e23b2ca98ed34fca2b0510bc97e912f95839926bf6e02c55952e15387c2
+    - imageRef: ghcr.io/siderolabs/intel-ucode:20260227@sha256:6112f6426a7081727545f7c33dcf2a89ff672494847b180380b4c58f3544a7b2
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20260309@sha256:b97cfde1e252412ba594a16302a3505f80aee1f105e2aa76b3bdf3b9dcc56cab
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.6@sha256:f524139c5be4626d7f2b6bd47745ce93648f3f1ab2b681fb00f8ab97ec2c19a3
+    - imageRef: ghcr.io/siderolabs/zfs:2.4.1-v1.12.6@sha256:059d39f1d2d6dde263dbd8062207d0aa68805bb0748c087494791c7f985b87d1
 output:
   kind: iso
   imageOptions: {}
diff --git a/packages/core/talos/images/talos/profiles/kernel.yaml b/packages/core/talos/images/talos/profiles/kernel.yaml
index 2f80bbda..d0153bf8 100644
--- a/packages/core/talos/images/talos/profiles/kernel.yaml
+++ b/packages/core/talos/images/talos/profiles/kernel.yaml
@@ -3,24 +3,24 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.12.1
+version: v1.12.6
 input:
   kernel:
     path: /usr/install/amd64/vmlinuz
   initramfs:
     path: /usr/install/amd64/initramfs.xz
   baseInstaller:
-    imageRef: "ghcr.io/siderolabs/installer:v1.12.1"
+    imageRef: "ghcr.io/siderolabs/installer:v1.12.6"
   systemExtensions:
-    - imageRef: ghcr.io/siderolabs/amd-ucode:20251125@sha256:aa2c684933d28cf10ef785f0d94f91d6d098e164374114648867cf81c2b585fe
-    - imageRef: ghcr.io/siderolabs/amdgpu:20251125-v1.12.1@sha256:b73aba10ac51cd0d74a6c45210ccee3f6b7d2d97f9b3151d0563b11aa0727599
-    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20251125@sha256:fe33c69c471a8d097c58ab9e5e1e099c3c6e5bb785e74f6f135fdbd71c3b0feb
-    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20251125@sha256:01458f60448e166eeb641ee989b941725cbe6759e10afe2251c6d1b1ca5ba1b7
-    - imageRef: ghcr.io/siderolabs/i915:20251125-v1.12.1@sha256:fb89c85a04ecb85abaec9d400e03a1628bf68aef3580e98f340cbe8920a6e4ed
-    - imageRef: ghcr.io/siderolabs/intel-ucode:20251111@sha256:51b7d1c31cb82f340a96228f1870b1e829e8ed2dfeef6d39926975303736d26a
-    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20251125@sha256:485ef0a0b58328ded511e9a76014c353da24bb147c8b2929068827e5f9a22326
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.1@sha256:2c0dc35d5f3e1ac23de6eeee5554d9da010ac848a733a538c9568a9ccc782d86
-    - imageRef: ghcr.io/siderolabs/zfs:2.4.0-v1.12.1@sha256:926f4cdaaa2cfad09f080eda5cfd08b8ba0bad083df3ca59e9764f4104539246
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20260309@sha256:716cd5350f77e7b10eebef88d8abdd0c32f2d929acd2bceac7ea33c0aac3b1a7
+    - imageRef: ghcr.io/siderolabs/amdgpu:20260309-v1.12.6@sha256:64c7cbcde57a69742c76e3899385f5cd6af1238b0aba094962197fd4098838bd
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20260309@sha256:b17b87d9a20c806cf186e95ab351b771ffd622a35afcbd41eb07d4642680a231
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20260309@sha256:eee55c66cb23fe93380b83909af2cd4ede970205b861c0aa147404c88e8c7f65
+    - imageRef: ghcr.io/siderolabs/i915:20260309-v1.12.6@sha256:6d150e23b2ca98ed34fca2b0510bc97e912f95839926bf6e02c55952e15387c2
+    - imageRef: ghcr.io/siderolabs/intel-ucode:20260227@sha256:6112f6426a7081727545f7c33dcf2a89ff672494847b180380b4c58f3544a7b2
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20260309@sha256:b97cfde1e252412ba594a16302a3505f80aee1f105e2aa76b3bdf3b9dcc56cab
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.6@sha256:f524139c5be4626d7f2b6bd47745ce93648f3f1ab2b681fb00f8ab97ec2c19a3
+    - imageRef: ghcr.io/siderolabs/zfs:2.4.1-v1.12.6@sha256:059d39f1d2d6dde263dbd8062207d0aa68805bb0748c087494791c7f985b87d1
 output:
   kind: kernel
   imageOptions: {}
diff --git a/packages/core/talos/images/talos/profiles/metal.yaml b/packages/core/talos/images/talos/profiles/metal.yaml
index d460e0d8..579cc333 100644
--- a/packages/core/talos/images/talos/profiles/metal.yaml
+++ b/packages/core/talos/images/talos/profiles/metal.yaml
@@ -3,24 +3,24 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.12.1
+version: v1.12.6
 input:
   kernel:
     path: /usr/install/amd64/vmlinuz
   initramfs:
     path: /usr/install/amd64/initramfs.xz
   baseInstaller:
-    imageRef: "ghcr.io/siderolabs/installer:v1.12.1"
+    imageRef: "ghcr.io/siderolabs/installer:v1.12.6"
   systemExtensions:
-    - imageRef: ghcr.io/siderolabs/amd-ucode:20251125@sha256:aa2c684933d28cf10ef785f0d94f91d6d098e164374114648867cf81c2b585fe
-    - imageRef: ghcr.io/siderolabs/amdgpu:20251125-v1.12.1@sha256:b73aba10ac51cd0d74a6c45210ccee3f6b7d2d97f9b3151d0563b11aa0727599
-    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20251125@sha256:fe33c69c471a8d097c58ab9e5e1e099c3c6e5bb785e74f6f135fdbd71c3b0feb
-    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20251125@sha256:01458f60448e166eeb641ee989b941725cbe6759e10afe2251c6d1b1ca5ba1b7
-    - imageRef: ghcr.io/siderolabs/i915:20251125-v1.12.1@sha256:fb89c85a04ecb85abaec9d400e03a1628bf68aef3580e98f340cbe8920a6e4ed
-    - imageRef: ghcr.io/siderolabs/intel-ucode:20251111@sha256:51b7d1c31cb82f340a96228f1870b1e829e8ed2dfeef6d39926975303736d26a
-    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20251125@sha256:485ef0a0b58328ded511e9a76014c353da24bb147c8b2929068827e5f9a22326
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.1@sha256:2c0dc35d5f3e1ac23de6eeee5554d9da010ac848a733a538c9568a9ccc782d86
-    - imageRef: ghcr.io/siderolabs/zfs:2.4.0-v1.12.1@sha256:926f4cdaaa2cfad09f080eda5cfd08b8ba0bad083df3ca59e9764f4104539246
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20260309@sha256:716cd5350f77e7b10eebef88d8abdd0c32f2d929acd2bceac7ea33c0aac3b1a7
+    - imageRef: ghcr.io/siderolabs/amdgpu:20260309-v1.12.6@sha256:64c7cbcde57a69742c76e3899385f5cd6af1238b0aba094962197fd4098838bd
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20260309@sha256:b17b87d9a20c806cf186e95ab351b771ffd622a35afcbd41eb07d4642680a231
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20260309@sha256:eee55c66cb23fe93380b83909af2cd4ede970205b861c0aa147404c88e8c7f65
+    - imageRef: ghcr.io/siderolabs/i915:20260309-v1.12.6@sha256:6d150e23b2ca98ed34fca2b0510bc97e912f95839926bf6e02c55952e15387c2
+    - imageRef: ghcr.io/siderolabs/intel-ucode:20260227@sha256:6112f6426a7081727545f7c33dcf2a89ff672494847b180380b4c58f3544a7b2
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20260309@sha256:b97cfde1e252412ba594a16302a3505f80aee1f105e2aa76b3bdf3b9dcc56cab
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.6@sha256:f524139c5be4626d7f2b6bd47745ce93648f3f1ab2b681fb00f8ab97ec2c19a3
+    - imageRef: ghcr.io/siderolabs/zfs:2.4.1-v1.12.6@sha256:059d39f1d2d6dde263dbd8062207d0aa68805bb0748c087494791c7f985b87d1
 output:
   kind: image
   imageOptions: { diskSize: 1306525696, diskFormat: raw }
diff --git a/packages/core/talos/images/talos/profiles/nocloud.yaml b/packages/core/talos/images/talos/profiles/nocloud.yaml
index 3dfb37f7..24ad7f3c 100644
--- a/packages/core/talos/images/talos/profiles/nocloud.yaml
+++ b/packages/core/talos/images/talos/profiles/nocloud.yaml
@@ -3,24 +3,24 @@
 arch: amd64
 platform: nocloud
 secureboot: false
-version: v1.12.1
+version: v1.12.6
 input:
   kernel:
     path: /usr/install/amd64/vmlinuz
   initramfs:
     path: /usr/install/amd64/initramfs.xz
   baseInstaller:
-    imageRef: "ghcr.io/siderolabs/installer:v1.12.1"
+    imageRef: "ghcr.io/siderolabs/installer:v1.12.6"
   systemExtensions:
-    - imageRef: ghcr.io/siderolabs/amd-ucode:20251125@sha256:aa2c684933d28cf10ef785f0d94f91d6d098e164374114648867cf81c2b585fe
-    - imageRef: ghcr.io/siderolabs/amdgpu:20251125-v1.12.1@sha256:b73aba10ac51cd0d74a6c45210ccee3f6b7d2d97f9b3151d0563b11aa0727599
-    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20251125@sha256:fe33c69c471a8d097c58ab9e5e1e099c3c6e5bb785e74f6f135fdbd71c3b0feb
-    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20251125@sha256:01458f60448e166eeb641ee989b941725cbe6759e10afe2251c6d1b1ca5ba1b7
-    - imageRef: ghcr.io/siderolabs/i915:20251125-v1.12.1@sha256:fb89c85a04ecb85abaec9d400e03a1628bf68aef3580e98f340cbe8920a6e4ed
-    - imageRef: ghcr.io/siderolabs/intel-ucode:20251111@sha256:51b7d1c31cb82f340a96228f1870b1e829e8ed2dfeef6d39926975303736d26a
-    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20251125@sha256:485ef0a0b58328ded511e9a76014c353da24bb147c8b2929068827e5f9a22326
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.1@sha256:2c0dc35d5f3e1ac23de6eeee5554d9da010ac848a733a538c9568a9ccc782d86
-    - imageRef: ghcr.io/siderolabs/zfs:2.4.0-v1.12.1@sha256:926f4cdaaa2cfad09f080eda5cfd08b8ba0bad083df3ca59e9764f4104539246
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20260309@sha256:716cd5350f77e7b10eebef88d8abdd0c32f2d929acd2bceac7ea33c0aac3b1a7
+    - imageRef: ghcr.io/siderolabs/amdgpu:20260309-v1.12.6@sha256:64c7cbcde57a69742c76e3899385f5cd6af1238b0aba094962197fd4098838bd
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20260309@sha256:b17b87d9a20c806cf186e95ab351b771ffd622a35afcbd41eb07d4642680a231
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20260309@sha256:eee55c66cb23fe93380b83909af2cd4ede970205b861c0aa147404c88e8c7f65
+    - imageRef: ghcr.io/siderolabs/i915:20260309-v1.12.6@sha256:6d150e23b2ca98ed34fca2b0510bc97e912f95839926bf6e02c55952e15387c2
+    - imageRef: ghcr.io/siderolabs/intel-ucode:20260227@sha256:6112f6426a7081727545f7c33dcf2a89ff672494847b180380b4c58f3544a7b2
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20260309@sha256:b97cfde1e252412ba594a16302a3505f80aee1f105e2aa76b3bdf3b9dcc56cab
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.6@sha256:f524139c5be4626d7f2b6bd47745ce93648f3f1ab2b681fb00f8ab97ec2c19a3
+    - imageRef: ghcr.io/siderolabs/zfs:2.4.1-v1.12.6@sha256:059d39f1d2d6dde263dbd8062207d0aa68805bb0748c087494791c7f985b87d1
 output:
   kind: image
   imageOptions: { diskSize: 1306525696, diskFormat: raw }

From ab92b67c3feed9b95e087670a809b21a49cd2edb Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Mon, 23 Mar 2026 09:48:39 +0500
Subject: [PATCH 300/666] fix(rbac): add endpointslices read access for tenant
 roles

Dashboard requests EndpointSlices from discovery.k8s.io API group
to display "Pod serving" section on Service details page. Without
this permission, tenant users see a 403 error.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .../cozystack-basics/templates/clusterroles.yaml      | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/packages/system/cozystack-basics/templates/clusterroles.yaml b/packages/system/cozystack-basics/templates/clusterroles.yaml
index 72d924ef..931bf6f8 100644
--- a/packages/system/cozystack-basics/templates/clusterroles.yaml
+++ b/packages/system/cozystack-basics/templates/clusterroles.yaml
@@ -21,6 +21,9 @@ rules:
 - apiGroups: [""]
   resources: ["pods", "services", "persistentvolumes", "endpoints", "events", "resourcequotas"]
   verbs: ["get", "list", "watch"]
+- apiGroups: ["discovery.k8s.io"]
+  resources: ["endpointslices"]
+  verbs: ["get", "list", "watch"]
 - apiGroups: ["networking.k8s.io"]
   resources: ["ingresses"]
   verbs: ["get", "list", "watch"]
@@ -94,6 +97,14 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - discovery.k8s.io
+  resources:
+  - endpointslices
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - networking.k8s.io
   resources:

From b43b7b2f25b182554665f430930e74c216be62ad Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 23 Mar 2026 15:18:23 +0300
Subject: [PATCH 301/666] [kilo] Switch from fork to upstream squat/kilo

All functional patches from the cozystack/kilo fork have been
upstreamed and included in squat/kilo v0.7.0:
- --internal-cidr flag (PR #403)
- allowed-location-ips overlap fix (PR #404)
- Auto-detect WireGuard MTU (PR #406)
- Preferred source for WireGuard routes (PR #408)
- Cilium IPIP overlay support (PR #409)

The fork only contained rebranding and CI-specific commits beyond
upstream, which are no longer needed.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/kilo/Makefile    | 6 +++---
 packages/system/kilo/values.yaml | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/packages/system/kilo/Makefile b/packages/system/kilo/Makefile
index 48dcb938..c6f47322 100644
--- a/packages/system/kilo/Makefile
+++ b/packages/system/kilo/Makefile
@@ -5,9 +5,9 @@ include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
 update:
-	tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/cozystack/kilo | awk -F'[/^]' 'END{print $$3}') && \
-	digest=$$(skopeo inspect --override-os linux --override-arch amd64 --format '{{.Digest}}' docker://ghcr.io/cozystack/cozystack/kilo:amd64-$${tag}) && \
-	REPOSITORY="ghcr.io/cozystack/cozystack/kilo" \
+	tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/squat/kilo | awk -F'[/^]' 'END{print $$3}') && \
+	digest=$$(skopeo inspect --override-os linux --override-arch amd64 --format '{{.Digest}}' docker://ghcr.io/squat/kilo:$${tag}) && \
+	REPOSITORY="ghcr.io/squat/kilo" \
 		yq -i '.kilo.image.repository = strenv(REPOSITORY)' values.yaml && \
 	TAG="$${tag}@$${digest}" \
 		yq -i '.kilo.image.tag = strenv(TAG)' values.yaml
diff --git a/packages/system/kilo/values.yaml b/packages/system/kilo/values.yaml
index d7c00af4..0c2e4439 100644
--- a/packages/system/kilo/values.yaml
+++ b/packages/system/kilo/values.yaml
@@ -1,8 +1,8 @@
 kilo:
   image:
     pullPolicy: IfNotPresent
-    tag: v0.8.2@sha256:9f27000ffd0bbf9adf3aefd017b7835dfae57b6ea38bf7488fb636536c2467da
-    repository: ghcr.io/cozystack/cozystack/kilo
+    tag: 0.7.0@sha256:c7468aee96425f47369fd1d33b9736147aebc2e9c6e4355d0593461c30af308e
+    repository: ghcr.io/squat/kilo
   transitCIDR: 100.66.0.0/16
   meshGranularity: location
   cleanUpInterface: false

From 9ba5b7e9038f8a9a457f7f59ea1a3d6313a82cf8 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 23 Mar 2026 15:19:36 +0300
Subject: [PATCH 302/666] [kamaji] Update to 26.3.5-edge, drop 2 upstreamed
 patches

Update kamaji from edge-26.2.4 to 26.3.5-edge and remove patches
that have been accepted upstream:

- increase-startup-probe-threshold.diff: upstream PR #1086 added
  configurable startupProbeFailureThreshold field
- disable-datastore-check.diff: upstream PR #1087 refactored
  DataStore initialization, removing the blocking startup check

The remaining fix-kubelet-config-compat.diff patch (PR #1084) is
still needed as the maintainer has not accepted the upstream fix
for kubelet config compatibility with K8s < 1.35.

Also update Makefile to match the new upstream tag format
(26.x.x-edge instead of edge-26.x.x) introduced in PR #1094.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/kamaji/Makefile               |   2 +-
 .../kamaji.clastix.io_datastores_spec.yaml    |  69 +++
 ...i.clastix.io_tenantcontrolplanes_spec.yaml | 414 +++++++++++++++++-
 .../controller-gen/validating-webhook.yaml    |  40 --
 .../crds/kamaji.clastix.io_datastores.yaml    |  69 +++
 ...kamaji.clastix.io_tenantcontrolplanes.yaml | 414 +++++++++++++++++-
 .../system/kamaji/images/kamaji/Dockerfile    |   2 +-
 .../patches/disable-datastore-check.diff      |  30 --
 .../increase-startup-probe-threshold.diff     |  31 --
 9 files changed, 956 insertions(+), 115 deletions(-)
 delete mode 100644 packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff
 delete mode 100644 packages/system/kamaji/images/kamaji/patches/increase-startup-probe-threshold.diff

diff --git a/packages/system/kamaji/Makefile b/packages/system/kamaji/Makefile
index f82c4c7a..793b53dd 100644
--- a/packages/system/kamaji/Makefile
+++ b/packages/system/kamaji/Makefile
@@ -6,7 +6,7 @@ include ../../../hack/package.mk
 
 update:
 	rm -rf charts
-	tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/clastix/kamaji | grep refs/tags/edge- | awk -F'[/^]' 'END{print $$3}') && \
+	tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/clastix/kamaji | grep -E 'refs/tags/[0-9]+\.[0-9]+\.[0-9]+-edge$$' | awk -F'[/^]' 'END{print $$3}') && \
 	curl -sSL https://github.com/clastix/kamaji/archive/refs/tags/$${tag}.tar.gz | \
 	tar -xzvf - --strip 1 kamaji-$${tag}/charts && \
 	sed -i "/ARG VERSION/ s|=.*|=$${tag}|g" images/kamaji/Dockerfile
diff --git a/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml
index 253cebae..c02419af 100644
--- a/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml
+++ b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml
@@ -11,6 +11,10 @@ versions:
         jsonPath: .spec.driver
         name: Driver
         type: string
+      - description: DataStore validated and ready for use
+        jsonPath: .status.ready
+        name: Ready
+        type: boolean
       - description: Age
         jsonPath: .metadata.creationTimestamp
         name: Age
@@ -272,18 +276,83 @@ versions:
                 rule: '(self.driver != "etcd" && has(self.basicAuth)) ? ((has(self.basicAuth.password.secretReference) || has(self.basicAuth.password.content))) : true'
               - message: When driver is not etcd, either tlsConfig or basicAuth must be provided
                 rule: '(self.driver != "etcd") ? (has(self.tlsConfig) || has(self.basicAuth)) : true'
+              - message: driver is immutable and cannot be changed after creation
+                rule: oldSelf == null || self.driver == oldSelf.driver
           status:
             description: DataStoreStatus defines the observed state of DataStore.
             properties:
+              conditions:
+                description: Conditions contains the validation conditions for the given Datastore.
+                items:
+                  description: Condition contains details for one aspect of the current state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                        - "True"
+                        - "False"
+                        - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                    - lastTransitionTime
+                    - message
+                    - reason
+                    - status
+                    - type
+                  type: object
+                type: array
               observedGeneration:
                 description: ObservedGeneration represents the .metadata.generation that was last reconciled.
                 format: int64
                 type: integer
+              ready:
+                description: |-
+                  Ready returns if the DataStore is accepted and ready to get used:
+                  Kamaji will ensure certificates are available, or correctly referenced.
+                type: boolean
               usedBy:
                 description: List of the Tenant Control Planes, namespaced named, using this data store.
                 items:
                   type: string
                 type: array
+            required:
+              - ready
             type: object
         type: object
     served: true
diff --git a/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml
index 43fbc59a..9625abb4 100644
--- a/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml
+++ b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml
@@ -6165,6 +6165,397 @@ versions:
                               type: string
                             type: object
                         type: object
+                      probes:
+                        description: |-
+                          Probes defines the probe configuration for the Control Plane components
+                          (kube-apiserver, controller-manager, and scheduler).
+                          Override TimeoutSeconds, PeriodSeconds, and FailureThreshold for resource-constrained environments.
+                        properties:
+                          apiServer:
+                            description: APIServer defines probe overrides for kube-apiserver, taking precedence over global probe settings.
+                            properties:
+                              liveness:
+                                description: Liveness defines parameters for the liveness probe.
+                                properties:
+                                  failureThreshold:
+                                    description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  initialDelaySeconds:
+                                    description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                    format: int32
+                                    minimum: 0
+                                    type: integer
+                                  periodSeconds:
+                                    description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  successThreshold:
+                                    description: |-
+                                      SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                      Must be 1 for liveness and startup probes.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  timeoutSeconds:
+                                    description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                type: object
+                              readiness:
+                                description: Readiness defines parameters for the readiness probe.
+                                properties:
+                                  failureThreshold:
+                                    description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  initialDelaySeconds:
+                                    description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                    format: int32
+                                    minimum: 0
+                                    type: integer
+                                  periodSeconds:
+                                    description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  successThreshold:
+                                    description: |-
+                                      SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                      Must be 1 for liveness and startup probes.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  timeoutSeconds:
+                                    description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                type: object
+                              startup:
+                                description: Startup defines parameters for the startup probe.
+                                properties:
+                                  failureThreshold:
+                                    description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  initialDelaySeconds:
+                                    description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                    format: int32
+                                    minimum: 0
+                                    type: integer
+                                  periodSeconds:
+                                    description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  successThreshold:
+                                    description: |-
+                                      SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                      Must be 1 for liveness and startup probes.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  timeoutSeconds:
+                                    description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                type: object
+                            type: object
+                          controllerManager:
+                            description: ControllerManager defines probe overrides for kube-controller-manager, taking precedence over global probe settings.
+                            properties:
+                              liveness:
+                                description: Liveness defines parameters for the liveness probe.
+                                properties:
+                                  failureThreshold:
+                                    description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  initialDelaySeconds:
+                                    description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                    format: int32
+                                    minimum: 0
+                                    type: integer
+                                  periodSeconds:
+                                    description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  successThreshold:
+                                    description: |-
+                                      SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                      Must be 1 for liveness and startup probes.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  timeoutSeconds:
+                                    description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                type: object
+                              readiness:
+                                description: Readiness defines parameters for the readiness probe.
+                                properties:
+                                  failureThreshold:
+                                    description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  initialDelaySeconds:
+                                    description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                    format: int32
+                                    minimum: 0
+                                    type: integer
+                                  periodSeconds:
+                                    description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  successThreshold:
+                                    description: |-
+                                      SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                      Must be 1 for liveness and startup probes.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  timeoutSeconds:
+                                    description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                type: object
+                              startup:
+                                description: Startup defines parameters for the startup probe.
+                                properties:
+                                  failureThreshold:
+                                    description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  initialDelaySeconds:
+                                    description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                    format: int32
+                                    minimum: 0
+                                    type: integer
+                                  periodSeconds:
+                                    description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  successThreshold:
+                                    description: |-
+                                      SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                      Must be 1 for liveness and startup probes.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  timeoutSeconds:
+                                    description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                type: object
+                            type: object
+                          liveness:
+                            description: Liveness defines default parameters for liveness probes of all Control Plane components.
+                            properties:
+                              failureThreshold:
+                                description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                format: int32
+                                minimum: 1
+                                type: integer
+                              initialDelaySeconds:
+                                description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                format: int32
+                                minimum: 0
+                                type: integer
+                              periodSeconds:
+                                description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                format: int32
+                                minimum: 1
+                                type: integer
+                              successThreshold:
+                                description: |-
+                                  SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                  Must be 1 for liveness and startup probes.
+                                format: int32
+                                minimum: 1
+                                type: integer
+                              timeoutSeconds:
+                                description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                format: int32
+                                minimum: 1
+                                type: integer
+                            type: object
+                          readiness:
+                            description: Readiness defines default parameters for the readiness probe of kube-apiserver.
+                            properties:
+                              failureThreshold:
+                                description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                format: int32
+                                minimum: 1
+                                type: integer
+                              initialDelaySeconds:
+                                description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                format: int32
+                                minimum: 0
+                                type: integer
+                              periodSeconds:
+                                description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                format: int32
+                                minimum: 1
+                                type: integer
+                              successThreshold:
+                                description: |-
+                                  SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                  Must be 1 for liveness and startup probes.
+                                format: int32
+                                minimum: 1
+                                type: integer
+                              timeoutSeconds:
+                                description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                format: int32
+                                minimum: 1
+                                type: integer
+                            type: object
+                          scheduler:
+                            description: Scheduler defines probe overrides for kube-scheduler, taking precedence over global probe settings.
+                            properties:
+                              liveness:
+                                description: Liveness defines parameters for the liveness probe.
+                                properties:
+                                  failureThreshold:
+                                    description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  initialDelaySeconds:
+                                    description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                    format: int32
+                                    minimum: 0
+                                    type: integer
+                                  periodSeconds:
+                                    description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  successThreshold:
+                                    description: |-
+                                      SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                      Must be 1 for liveness and startup probes.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  timeoutSeconds:
+                                    description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                type: object
+                              readiness:
+                                description: Readiness defines parameters for the readiness probe.
+                                properties:
+                                  failureThreshold:
+                                    description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  initialDelaySeconds:
+                                    description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                    format: int32
+                                    minimum: 0
+                                    type: integer
+                                  periodSeconds:
+                                    description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  successThreshold:
+                                    description: |-
+                                      SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                      Must be 1 for liveness and startup probes.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  timeoutSeconds:
+                                    description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                type: object
+                              startup:
+                                description: Startup defines parameters for the startup probe.
+                                properties:
+                                  failureThreshold:
+                                    description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  initialDelaySeconds:
+                                    description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                    format: int32
+                                    minimum: 0
+                                    type: integer
+                                  periodSeconds:
+                                    description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  successThreshold:
+                                    description: |-
+                                      SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                      Must be 1 for liveness and startup probes.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  timeoutSeconds:
+                                    description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                type: object
+                            type: object
+                          startup:
+                            description: Startup defines default parameters for startup probes of all Control Plane components.
+                            properties:
+                              failureThreshold:
+                                description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                format: int32
+                                minimum: 1
+                                type: integer
+                              initialDelaySeconds:
+                                description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                format: int32
+                                minimum: 0
+                                type: integer
+                              periodSeconds:
+                                description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                format: int32
+                                minimum: 1
+                                type: integer
+                              successThreshold:
+                                description: |-
+                                  SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                  Must be 1 for liveness and startup probes.
+                                format: int32
+                                minimum: 1
+                                type: integer
+                              timeoutSeconds:
+                                description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                format: int32
+                                minimum: 1
+                                type: integer
+                            type: object
+                        type: object
                       registrySettings:
                         default:
                           apiServerImage: kube-apiserver
@@ -6896,9 +7287,6 @@ versions:
                           type: object
                         type: array
                     type: object
-                    x-kubernetes-validations:
-                      - message: parentRefs must not specify port or sectionName, these are set automatically by Kamaji
-                        rule: '!has(self.parentRefs) || size(self.parentRefs) == 0 || self.parentRefs.all(ref, !has(ref.port) && !has(ref.sectionName))'
                   ingress:
                     description: Defining the options for an Optional Ingress which will expose API Server of the Tenant Control Plane
                     properties:
@@ -7188,8 +7576,8 @@ versions:
                 properties:
                   address:
                     description: |-
-                      Address where API server of will be exposed.
-                      In case of LoadBalancer Service, this can be empty in order to use the exposed IP provided by the cloud controller manager.
+                      Address where API server will be exposed.
+                      In the case of LoadBalancer Service, this can be empty in order to use the exposed IP provided by the cloud controller manager.
                     type: string
                   allowAddressAsExternalIP:
                     description: |-
@@ -7219,6 +7607,7 @@ versions:
                       for IPv6 from the CIDR 2001:db8:abcd::/64 the resulting DNS Service IP will be 2001:db8:abcd::10.
                     items:
                       type: string
+                    maxItems: 8
                     type: array
                   loadBalancerClass:
                     description: |-
@@ -7240,21 +7629,34 @@ versions:
                       Example: {"192.168.1.0/24", "10.0.0.0/8"}
                     items:
                       type: string
+                    maxItems: 16
                     type: array
+                    x-kubernetes-validations:
+                      - message: all LoadBalancer source range entries must be valid CIDR
+                        rule: self.all(r, isCIDR(r))
                   podCidr:
                     default: 10.244.0.0/16
                     description: 'CIDR for Kubernetes Pods: if empty, defaulted to 10.244.0.0/16.'
                     type: string
+                    x-kubernetes-validations:
+                      - message: podCidr must be empty or a valid CIDR
+                        rule: self == '' || isCIDR(self)
                   port:
                     default: 6443
-                    description: Port where API server of will be exposed
+                    description: Port where API server will be exposed
                     format: int32
                     type: integer
                   serviceCidr:
                     default: 10.96.0.0/16
                     description: 'CIDR for Kubernetes Services: if empty, defaulted to 10.96.0.0/16.'
                     type: string
+                    x-kubernetes-validations:
+                      - message: serviceCidr must be empty or a valid CIDR
+                        rule: self == '' || isCIDR(self)
                 type: object
+                x-kubernetes-validations:
+                  - message: all DNS service IPs must be part of the Service CIDR
+                    rule: '!has(self.dnsServiceIPs) || self.dnsServiceIPs.all(r, cidr(self.serviceCidr).containsIP(r))'
               writePermissions:
                 description: |-
                   WritePermissions allows to select which operations (create, delete, update) must be blocked:
diff --git a/packages/system/kamaji/charts/kamaji/controller-gen/validating-webhook.yaml b/packages/system/kamaji/charts/kamaji/controller-gen/validating-webhook.yaml
index 7042df0b..b7eb1690 100644
--- a/packages/system/kamaji/charts/kamaji/controller-gen/validating-webhook.yaml
+++ b/packages/system/kamaji/charts/kamaji/controller-gen/validating-webhook.yaml
@@ -19,46 +19,6 @@
       resources:
         - tenantcontrolplanes
   sideEffects: None
-- admissionReviewVersions:
-    - v1
-  clientConfig:
-    service:
-      name: '{{ include "kamaji.webhookServiceName" . }}'
-      namespace: '{{ .Release.Namespace }}'
-      path: /validate-kamaji-clastix-io-v1alpha1-datastore
-  failurePolicy: Fail
-  name: vdatastore.kb.io
-  rules:
-    - apiGroups:
-        - kamaji.clastix.io
-      apiVersions:
-        - v1alpha1
-      operations:
-        - CREATE
-        - UPDATE
-        - DELETE
-      resources:
-        - datastores
-  sideEffects: None
-- admissionReviewVersions:
-    - v1
-  clientConfig:
-    service:
-      name: '{{ include "kamaji.webhookServiceName" . }}'
-      namespace: '{{ .Release.Namespace }}'
-      path: /validate--v1-secret
-  failurePolicy: Ignore
-  name: vdatastoresecrets.kb.io
-  rules:
-    - apiGroups:
-        - ""
-      apiVersions:
-        - v1
-      operations:
-        - DELETE
-      resources:
-        - secrets
-  sideEffects: None
 - admissionReviewVersions:
     - v1
   clientConfig:
diff --git a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml
index 896a40e8..903f7c69 100644
--- a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml
+++ b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml
@@ -20,6 +20,10 @@ spec:
           jsonPath: .spec.driver
           name: Driver
           type: string
+        - description: DataStore validated and ready for use
+          jsonPath: .status.ready
+          name: Ready
+          type: boolean
         - description: Age
           jsonPath: .metadata.creationTimestamp
           name: Age
@@ -281,18 +285,83 @@ spec:
                   rule: '(self.driver != "etcd" && has(self.basicAuth)) ? ((has(self.basicAuth.password.secretReference) || has(self.basicAuth.password.content))) : true'
                 - message: When driver is not etcd, either tlsConfig or basicAuth must be provided
                   rule: '(self.driver != "etcd") ? (has(self.tlsConfig) || has(self.basicAuth)) : true'
+                - message: driver is immutable and cannot be changed after creation
+                  rule: oldSelf == null || self.driver == oldSelf.driver
             status:
               description: DataStoreStatus defines the observed state of DataStore.
               properties:
+                conditions:
+                  description: Conditions contains the validation conditions for the given Datastore.
+                  items:
+                    description: Condition contains details for one aspect of the current state of this API Resource.
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          lastTransitionTime is the last time the condition transitioned from one status to another.
+                          This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                        format: date-time
+                        type: string
+                      message:
+                        description: |-
+                          message is a human readable message indicating details about the transition.
+                          This may be an empty string.
+                        maxLength: 32768
+                        type: string
+                      observedGeneration:
+                        description: |-
+                          observedGeneration represents the .metadata.generation that the condition was set based upon.
+                          For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                          with respect to the current state of the instance.
+                        format: int64
+                        minimum: 0
+                        type: integer
+                      reason:
+                        description: |-
+                          reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                          Producers of specific condition types may define expected values and meanings for this field,
+                          and whether the values are considered a guaranteed API.
+                          The value should be a CamelCase string.
+                          This field may not be empty.
+                        maxLength: 1024
+                        minLength: 1
+                        pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                        type: string
+                      status:
+                        description: status of the condition, one of True, False, Unknown.
+                        enum:
+                          - "True"
+                          - "False"
+                          - Unknown
+                        type: string
+                      type:
+                        description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                        maxLength: 316
+                        pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                        type: string
+                    required:
+                      - lastTransitionTime
+                      - message
+                      - reason
+                      - status
+                      - type
+                    type: object
+                  type: array
                 observedGeneration:
                   description: ObservedGeneration represents the .metadata.generation that was last reconciled.
                   format: int64
                   type: integer
+                ready:
+                  description: |-
+                    Ready returns if the DataStore is accepted and ready to get used:
+                    Kamaji will ensure certificates are available, or correctly referenced.
+                  type: boolean
                 usedBy:
                   description: List of the Tenant Control Planes, namespaced named, using this data store.
                   items:
                     type: string
                   type: array
+              required:
+                - ready
               type: object
           type: object
       served: true
diff --git a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
index 506d4379..f3c72dcd 100644
--- a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
+++ b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
@@ -6173,6 +6173,397 @@ spec:
                                 type: string
                               type: object
                           type: object
+                        probes:
+                          description: |-
+                            Probes defines the probe configuration for the Control Plane components
+                            (kube-apiserver, controller-manager, and scheduler).
+                            Override TimeoutSeconds, PeriodSeconds, and FailureThreshold for resource-constrained environments.
+                          properties:
+                            apiServer:
+                              description: APIServer defines probe overrides for kube-apiserver, taking precedence over global probe settings.
+                              properties:
+                                liveness:
+                                  description: Liveness defines parameters for the liveness probe.
+                                  properties:
+                                    failureThreshold:
+                                      description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    initialDelaySeconds:
+                                      description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                      format: int32
+                                      minimum: 0
+                                      type: integer
+                                    periodSeconds:
+                                      description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    successThreshold:
+                                      description: |-
+                                        SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                        Must be 1 for liveness and startup probes.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    timeoutSeconds:
+                                      description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                  type: object
+                                readiness:
+                                  description: Readiness defines parameters for the readiness probe.
+                                  properties:
+                                    failureThreshold:
+                                      description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    initialDelaySeconds:
+                                      description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                      format: int32
+                                      minimum: 0
+                                      type: integer
+                                    periodSeconds:
+                                      description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    successThreshold:
+                                      description: |-
+                                        SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                        Must be 1 for liveness and startup probes.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    timeoutSeconds:
+                                      description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                  type: object
+                                startup:
+                                  description: Startup defines parameters for the startup probe.
+                                  properties:
+                                    failureThreshold:
+                                      description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    initialDelaySeconds:
+                                      description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                      format: int32
+                                      minimum: 0
+                                      type: integer
+                                    periodSeconds:
+                                      description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    successThreshold:
+                                      description: |-
+                                        SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                        Must be 1 for liveness and startup probes.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    timeoutSeconds:
+                                      description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                  type: object
+                              type: object
+                            controllerManager:
+                              description: ControllerManager defines probe overrides for kube-controller-manager, taking precedence over global probe settings.
+                              properties:
+                                liveness:
+                                  description: Liveness defines parameters for the liveness probe.
+                                  properties:
+                                    failureThreshold:
+                                      description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    initialDelaySeconds:
+                                      description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                      format: int32
+                                      minimum: 0
+                                      type: integer
+                                    periodSeconds:
+                                      description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    successThreshold:
+                                      description: |-
+                                        SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                        Must be 1 for liveness and startup probes.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    timeoutSeconds:
+                                      description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                  type: object
+                                readiness:
+                                  description: Readiness defines parameters for the readiness probe.
+                                  properties:
+                                    failureThreshold:
+                                      description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    initialDelaySeconds:
+                                      description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                      format: int32
+                                      minimum: 0
+                                      type: integer
+                                    periodSeconds:
+                                      description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    successThreshold:
+                                      description: |-
+                                        SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                        Must be 1 for liveness and startup probes.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    timeoutSeconds:
+                                      description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                  type: object
+                                startup:
+                                  description: Startup defines parameters for the startup probe.
+                                  properties:
+                                    failureThreshold:
+                                      description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    initialDelaySeconds:
+                                      description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                      format: int32
+                                      minimum: 0
+                                      type: integer
+                                    periodSeconds:
+                                      description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    successThreshold:
+                                      description: |-
+                                        SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                        Must be 1 for liveness and startup probes.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    timeoutSeconds:
+                                      description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                  type: object
+                              type: object
+                            liveness:
+                              description: Liveness defines default parameters for liveness probes of all Control Plane components.
+                              properties:
+                                failureThreshold:
+                                  description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                  format: int32
+                                  minimum: 1
+                                  type: integer
+                                initialDelaySeconds:
+                                  description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                  format: int32
+                                  minimum: 0
+                                  type: integer
+                                periodSeconds:
+                                  description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                  format: int32
+                                  minimum: 1
+                                  type: integer
+                                successThreshold:
+                                  description: |-
+                                    SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                    Must be 1 for liveness and startup probes.
+                                  format: int32
+                                  minimum: 1
+                                  type: integer
+                                timeoutSeconds:
+                                  description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                  format: int32
+                                  minimum: 1
+                                  type: integer
+                              type: object
+                            readiness:
+                              description: Readiness defines default parameters for the readiness probe of kube-apiserver.
+                              properties:
+                                failureThreshold:
+                                  description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                  format: int32
+                                  minimum: 1
+                                  type: integer
+                                initialDelaySeconds:
+                                  description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                  format: int32
+                                  minimum: 0
+                                  type: integer
+                                periodSeconds:
+                                  description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                  format: int32
+                                  minimum: 1
+                                  type: integer
+                                successThreshold:
+                                  description: |-
+                                    SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                    Must be 1 for liveness and startup probes.
+                                  format: int32
+                                  minimum: 1
+                                  type: integer
+                                timeoutSeconds:
+                                  description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                  format: int32
+                                  minimum: 1
+                                  type: integer
+                              type: object
+                            scheduler:
+                              description: Scheduler defines probe overrides for kube-scheduler, taking precedence over global probe settings.
+                              properties:
+                                liveness:
+                                  description: Liveness defines parameters for the liveness probe.
+                                  properties:
+                                    failureThreshold:
+                                      description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    initialDelaySeconds:
+                                      description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                      format: int32
+                                      minimum: 0
+                                      type: integer
+                                    periodSeconds:
+                                      description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    successThreshold:
+                                      description: |-
+                                        SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                        Must be 1 for liveness and startup probes.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    timeoutSeconds:
+                                      description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                  type: object
+                                readiness:
+                                  description: Readiness defines parameters for the readiness probe.
+                                  properties:
+                                    failureThreshold:
+                                      description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    initialDelaySeconds:
+                                      description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                      format: int32
+                                      minimum: 0
+                                      type: integer
+                                    periodSeconds:
+                                      description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    successThreshold:
+                                      description: |-
+                                        SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                        Must be 1 for liveness and startup probes.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    timeoutSeconds:
+                                      description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                  type: object
+                                startup:
+                                  description: Startup defines parameters for the startup probe.
+                                  properties:
+                                    failureThreshold:
+                                      description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    initialDelaySeconds:
+                                      description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                      format: int32
+                                      minimum: 0
+                                      type: integer
+                                    periodSeconds:
+                                      description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    successThreshold:
+                                      description: |-
+                                        SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                        Must be 1 for liveness and startup probes.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                    timeoutSeconds:
+                                      description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                  type: object
+                              type: object
+                            startup:
+                              description: Startup defines default parameters for startup probes of all Control Plane components.
+                              properties:
+                                failureThreshold:
+                                  description: FailureThreshold is the consecutive failure count required to consider the probe failed.
+                                  format: int32
+                                  minimum: 1
+                                  type: integer
+                                initialDelaySeconds:
+                                  description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated.
+                                  format: int32
+                                  minimum: 0
+                                  type: integer
+                                periodSeconds:
+                                  description: PeriodSeconds is how often (in seconds) to perform the probe.
+                                  format: int32
+                                  minimum: 1
+                                  type: integer
+                                successThreshold:
+                                  description: |-
+                                    SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
+                                    Must be 1 for liveness and startup probes.
+                                  format: int32
+                                  minimum: 1
+                                  type: integer
+                                timeoutSeconds:
+                                  description: TimeoutSeconds is the number of seconds after which the probe times out.
+                                  format: int32
+                                  minimum: 1
+                                  type: integer
+                              type: object
+                          type: object
                         registrySettings:
                           default:
                             apiServerImage: kube-apiserver
@@ -6904,9 +7295,6 @@ spec:
                             type: object
                           type: array
                       type: object
-                      x-kubernetes-validations:
-                        - message: parentRefs must not specify port or sectionName, these are set automatically by Kamaji
-                          rule: '!has(self.parentRefs) || size(self.parentRefs) == 0 || self.parentRefs.all(ref, !has(ref.port) && !has(ref.sectionName))'
                     ingress:
                       description: Defining the options for an Optional Ingress which will expose API Server of the Tenant Control Plane
                       properties:
@@ -7196,8 +7584,8 @@ spec:
                   properties:
                     address:
                       description: |-
-                        Address where API server of will be exposed.
-                        In case of LoadBalancer Service, this can be empty in order to use the exposed IP provided by the cloud controller manager.
+                        Address where API server will be exposed.
+                        In the case of LoadBalancer Service, this can be empty in order to use the exposed IP provided by the cloud controller manager.
                       type: string
                     allowAddressAsExternalIP:
                       description: |-
@@ -7227,6 +7615,7 @@ spec:
                         for IPv6 from the CIDR 2001:db8:abcd::/64 the resulting DNS Service IP will be 2001:db8:abcd::10.
                       items:
                         type: string
+                      maxItems: 8
                       type: array
                     loadBalancerClass:
                       description: |-
@@ -7248,21 +7637,34 @@ spec:
                         Example: {"192.168.1.0/24", "10.0.0.0/8"}
                       items:
                         type: string
+                      maxItems: 16
                       type: array
+                      x-kubernetes-validations:
+                        - message: all LoadBalancer source range entries must be valid CIDR
+                          rule: self.all(r, isCIDR(r))
                     podCidr:
                       default: 10.244.0.0/16
                       description: 'CIDR for Kubernetes Pods: if empty, defaulted to 10.244.0.0/16.'
                       type: string
+                      x-kubernetes-validations:
+                        - message: podCidr must be empty or a valid CIDR
+                          rule: self == '' || isCIDR(self)
                     port:
                       default: 6443
-                      description: Port where API server of will be exposed
+                      description: Port where API server will be exposed
                       format: int32
                       type: integer
                     serviceCidr:
                       default: 10.96.0.0/16
                       description: 'CIDR for Kubernetes Services: if empty, defaulted to 10.96.0.0/16.'
                       type: string
+                      x-kubernetes-validations:
+                        - message: serviceCidr must be empty or a valid CIDR
+                          rule: self == '' || isCIDR(self)
                   type: object
+                  x-kubernetes-validations:
+                    - message: all DNS service IPs must be part of the Service CIDR
+                      rule: '!has(self.dnsServiceIPs) || self.dnsServiceIPs.all(r, cidr(self.serviceCidr).containsIP(r))'
                 writePermissions:
                   description: |-
                     WritePermissions allows to select which operations (create, delete, update) must be blocked:
diff --git a/packages/system/kamaji/images/kamaji/Dockerfile b/packages/system/kamaji/images/kamaji/Dockerfile
index ddb49636..4dd0bb3f 100644
--- a/packages/system/kamaji/images/kamaji/Dockerfile
+++ b/packages/system/kamaji/images/kamaji/Dockerfile
@@ -1,7 +1,7 @@
 # Build the manager binary
 FROM golang:1.26 AS builder
 
-ARG VERSION=edge-26.2.4
+ARG VERSION=26.3.5-edge
 ARG TARGETOS
 ARG TARGETARCH
 
diff --git a/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff b/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff
deleted file mode 100644
index 1a8767b5..00000000
--- a/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff
+++ /dev/null
@@ -1,30 +0,0 @@
-diff --git a/cmd/manager/cmd.go b/cmd/manager/cmd.go
---- a/cmd/manager/cmd.go
-+++ b/cmd/manager/cmd.go
-@@ -4,7 +4,6 @@
- package manager
-
- import (
--	"context"
- 	"flag"
- 	"fmt"
- 	"io"
-@@ -34,7 +33,6 @@
- 	"github.com/clastix/kamaji/controllers/soot"
- 	"github.com/clastix/kamaji/internal"
- 	"github.com/clastix/kamaji/internal/builders/controlplane"
--	datastoreutils "github.com/clastix/kamaji/internal/datastore/utils"
- 	"github.com/clastix/kamaji/internal/utilities"
- 	"github.com/clastix/kamaji/internal/webhook"
- 	"github.com/clastix/kamaji/internal/webhook/handlers"
-@@ -85,10 +83,6 @@
-
- 			if webhookCABundle, err = os.ReadFile(webhookCAPath); err != nil {
- 				return fmt.Errorf("unable to read webhook CA: %w", err)
--			}
--
--			if err = datastoreutils.CheckExists(context.Background(), scheme, datastore); err != nil {
--				return err
- 			}
-
- 			if controllerReconcileTimeout.Seconds() == 0 {
diff --git a/packages/system/kamaji/images/kamaji/patches/increase-startup-probe-threshold.diff b/packages/system/kamaji/images/kamaji/patches/increase-startup-probe-threshold.diff
deleted file mode 100644
index 1938c9f6..00000000
--- a/packages/system/kamaji/images/kamaji/patches/increase-startup-probe-threshold.diff
+++ /dev/null
@@ -1,31 +0,0 @@
-diff --git a/internal/builders/controlplane/deployment.go b/internal/builders/controlplane/deployment.go
-index e7f0b88..d67a851 100644
---- a/internal/builders/controlplane/deployment.go
-+++ b/internal/builders/controlplane/deployment.go
-@@ -376,7 +376,7 @@ func (d Deployment) buildScheduler(podSpec *corev1.PodSpec, tenantControlPlane k
- 		TimeoutSeconds:      1,
- 		PeriodSeconds:       10,
- 		SuccessThreshold:    1,
--		FailureThreshold:    3,
-+		FailureThreshold:    30,
- 	}
- 
- 	switch {
-@@ -469,7 +469,7 @@ func (d Deployment) buildControllerManager(podSpec *corev1.PodSpec, tenantContro
- 		TimeoutSeconds:      1,
- 		PeriodSeconds:       10,
- 		SuccessThreshold:    1,
--		FailureThreshold:    3,
-+		FailureThreshold:    30,
- 	}
- 	switch {
- 	case tenantControlPlane.Spec.ControlPlane.Deployment.Resources == nil:
-@@ -600,7 +600,7 @@ func (d Deployment) buildKubeAPIServer(podSpec *corev1.PodSpec, tenantControlPla
- 		TimeoutSeconds:      1,
- 		PeriodSeconds:       10,
- 		SuccessThreshold:    1,
--		FailureThreshold:    3,
-+		FailureThreshold:    30,
- 	}
- 	podSpec.Containers[index].ImagePullPolicy = corev1.PullAlways
- 	// Volume mounts

From 50d6c29c72e58bb7077a40e95af24339093eb55c Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 23 Mar 2026 15:55:51 +0300
Subject: [PATCH 303/666] [objectstorage-controller] Update to v0.2.2, drop
 upstreamed patches

Update COSI controller/sidecar from commit c2f6e65 to v0.2.2
(f75d475) and remove two patches that have been merged upstream:

- 89-reconciliation.diff: fix reconciliation logic for existing
  and deleted objects (PR #89)
- 90-bucket-name.diff: prefix bucket names with bucket- using
  UID only (PR #90)

Both patches were contributed by kvaps and included in the
upstream v0.2.2 release (2025-12-08).

Also remove git from Dockerfile dependencies as it was only
needed for applying patches.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../images/objectstorage/Dockerfile           |   7 +-
 .../patches/89-reconciliation.diff            | 398 ------------------
 .../objectstorage/patches/90-bucket-name.diff |  13 -
 3 files changed, 2 insertions(+), 416 deletions(-)
 delete mode 100644 packages/system/objectstorage-controller/images/objectstorage/patches/89-reconciliation.diff
 delete mode 100644 packages/system/objectstorage-controller/images/objectstorage/patches/90-bucket-name.diff

diff --git a/packages/system/objectstorage-controller/images/objectstorage/Dockerfile b/packages/system/objectstorage-controller/images/objectstorage/Dockerfile
index 01dafe83..46699e02 100644
--- a/packages/system/objectstorage-controller/images/objectstorage/Dockerfile
+++ b/packages/system/objectstorage-controller/images/objectstorage/Dockerfile
@@ -1,16 +1,13 @@
 # syntax=docker/dockerfile:1.2
 
 FROM alpine AS source
-ARG COMMIT_REF=c2f6e651eb58880627ccddafe0d84fb36e03a780
-RUN apk add --no-cache curl tar git
+ARG COMMIT_REF=f75d47509dae3e4ed0fd18ce0a60474b78e8d29b
+RUN apk add --no-cache curl tar
 WORKDIR /src
 
 RUN curl -sSL https://github.com/kubernetes-sigs/container-object-storage-interface/archive/${COMMIT_REF}.tar.gz \
         | tar -xz --strip-components=1
 
-COPY patches /patches
-RUN git apply /patches/*.diff
-
 FROM --platform=$BUILDPLATFORM docker.io/golang:1.24 AS builder
 ARG TARGETOS
 ARG TARGETARCH
diff --git a/packages/system/objectstorage-controller/images/objectstorage/patches/89-reconciliation.diff b/packages/system/objectstorage-controller/images/objectstorage/patches/89-reconciliation.diff
deleted file mode 100644
index 8a3f11ab..00000000
--- a/packages/system/objectstorage-controller/images/objectstorage/patches/89-reconciliation.diff
+++ /dev/null
@@ -1,398 +0,0 @@
-diff --git a/controller/pkg/bucketclaim/bucketclaim.go b/controller/pkg/bucketclaim/bucketclaim.go
-index 2f4d565e..8ad7baed 100644
---- a/controller/pkg/bucketclaim/bucketclaim.go
-+++ b/controller/pkg/bucketclaim/bucketclaim.go
-@@ -32,6 +32,10 @@ func NewBucketClaimListener() *BucketClaimListener {
- 
- // Add creates a bucket in response to a bucketClaim
- func (b *BucketClaimListener) Add(ctx context.Context, bucketClaim *v1alpha1.BucketClaim) error {
-+	if !bucketClaim.GetDeletionTimestamp().IsZero() {
-+		return b.handleDeletion(ctx, bucketClaim)
-+	}
-+
- 	klog.V(3).InfoS("Add BucketClaim",
- 		"name", bucketClaim.ObjectMeta.Name,
- 		"ns", bucketClaim.ObjectMeta.Namespace,
-@@ -76,18 +80,11 @@ func (b *BucketClaimListener) Update(ctx context.Context, old, new *v1alpha1.Buc
- 	bucketClaim := new.DeepCopy()
- 
- 	if !new.GetDeletionTimestamp().IsZero() {
--		if controllerutil.ContainsFinalizer(bucketClaim, util.BucketClaimFinalizer) {
--			bucketName := bucketClaim.Status.BucketName
--			err := b.buckets().Delete(ctx, bucketName, metav1.DeleteOptions{})
--			if err != nil {
--				klog.V(3).ErrorS(err, "Error deleting bucket",
--					"bucket", bucketName,
--					"bucketClaim", bucketClaim.ObjectMeta.Name)
--				return b.recordError(bucketClaim, v1.EventTypeWarning, v1alpha1.FailedDeleteBucket, err)
--			}
--
--			klog.V(5).Infof("Successfully deleted bucket: %s from bucketClaim: %s", bucketName, bucketClaim.ObjectMeta.Name)
--		}
-+		return b.handleDeletion(ctx, bucketClaim)
-+	}
-+
-+	if err := b.Add(ctx, bucketClaim); err != nil {
-+		return err
- 	}
- 
- 	klog.V(3).InfoS("Update BucketClaim success",
-@@ -96,6 +93,27 @@ func (b *BucketClaimListener) Update(ctx context.Context, old, new *v1alpha1.Buc
- 	return nil
- }
- 
-+// handleDeletion processes the deletion of a bucketClaim.
-+func (b *BucketClaimListener) handleDeletion(ctx context.Context, bucketClaim *v1alpha1.BucketClaim) error {
-+	if !controllerutil.ContainsFinalizer(bucketClaim, util.BucketClaimFinalizer) {
-+		return nil
-+	}
-+
-+	bucketName := bucketClaim.Status.BucketName
-+	if bucketName != "" {
-+		if err := b.buckets().Delete(ctx, bucketName, metav1.DeleteOptions{}); err != nil && !kubeerrors.IsNotFound(err) {
-+			klog.V(3).ErrorS(err, "Error deleting bucket",
-+				"bucket", bucketName,
-+				"bucketClaim", bucketClaim.ObjectMeta.Name)
-+			return b.recordError(bucketClaim, v1.EventTypeWarning, v1alpha1.FailedDeleteBucket, err)
-+		}
-+		klog.V(5).Infof("Successfully requested deletion of bucket: %s for bucketClaim: %s",
-+			bucketName, bucketClaim.ObjectMeta.Name)
-+	}
-+
-+	return nil
-+}
-+
- // Delete processes a bucket for which bucket request is deleted
- func (b *BucketClaimListener) Delete(ctx context.Context, bucketClaim *v1alpha1.BucketClaim) error {
- 	klog.V(3).InfoS("Delete BucketClaim",
-diff --git a/controller/pkg/bucketclaim/bucketclaim_test.go b/controller/pkg/bucketclaim/bucketclaim_test.go
-index 284185b6..e2e2d3d2 100644
---- a/controller/pkg/bucketclaim/bucketclaim_test.go
-+++ b/controller/pkg/bucketclaim/bucketclaim_test.go
-@@ -323,3 +323,32 @@ func TestRecordEvents(t *testing.T) {
- func newEvent(eventType, reason, message string) string {
- 	return fmt.Sprintf("%s %s %s", eventType, reason, message)
- }
-+
-+// Claim already marked for deletion must not create a bucket
-+func TestAddDeletedBucketClaim(t *testing.T) {
-+	ctx, cancel := context.WithCancel(context.Background())
-+	defer cancel()
-+
-+	client := fakebucketclientset.NewSimpleClientset()
-+	kubeClient := fakekubeclientset.NewSimpleClientset()
-+	eventRecorder := record.NewFakeRecorder(3)
-+
-+	listener := NewBucketClaimListener()
-+	listener.InitializeKubeClient(kubeClient)
-+	listener.InitializeBucketClient(client)
-+	listener.InitializeEventRecorder(eventRecorder)
-+
-+	_, _ = util.CreateBucketClass(ctx, client, &goldClass)
-+
-+	claimToDelete := bucketClaim1.DeepCopy()
-+	now := metav1.Now()
-+	claimToDelete.ObjectMeta.DeletionTimestamp = &now
-+
-+	if err := listener.Add(ctx, claimToDelete); err != nil {
-+		t.Fatalf("Add returned error for deleted claim: %v", err)
-+	}
-+
-+	if bl := util.GetBuckets(ctx, client, 0); len(bl.Items) != 0 {
-+		t.Fatalf("expected 0 buckets, got %d", len(bl.Items))
-+	}
-+}
-diff --git a/sidecar/pkg/bucket/bucket_controller.go b/sidecar/pkg/bucket/bucket_controller.go
-index a934d0c5..bf8b5311 100644
---- a/sidecar/pkg/bucket/bucket_controller.go
-+++ b/sidecar/pkg/bucket/bucket_controller.go
-@@ -68,6 +68,10 @@ func (b *BucketListener) Add(ctx context.Context, inputBucket *v1alpha1.Bucket)
- 
- 	var err error
- 
-+	if !bucket.GetDeletionTimestamp().IsZero() {
-+		return b.handleDeletion(ctx, bucket)
-+	}
-+
- 	klog.V(3).InfoS("Add Bucket",
- 		"name", bucket.ObjectMeta.Name)
- 
-@@ -212,55 +216,60 @@ func (b *BucketListener) Update(ctx context.Context, old, new *v1alpha1.Bucket)
- 	var err error
- 
- 	if !bucket.GetDeletionTimestamp().IsZero() {
--		if controllerutil.ContainsFinalizer(bucket, consts.BABucketFinalizer) {
--			bucketClaimNs := bucket.Spec.BucketClaim.Namespace
--			bucketClaimName := bucket.Spec.BucketClaim.Name
--			bucketAccessList, err := b.bucketAccesses(bucketClaimNs).List(ctx, metav1.ListOptions{})
--			if err != nil {
--				klog.V(3).ErrorS(err, "Error fetching BucketAccessList",
--					"bucket", bucket.ObjectMeta.Name)
--				return err
--			}
--
--			for _, bucketAccess := range bucketAccessList.Items {
--				if strings.EqualFold(bucketAccess.Spec.BucketClaimName, bucketClaimName) {
--					err = b.bucketAccesses(bucketClaimNs).Delete(ctx, bucketAccess.Name, metav1.DeleteOptions{})
--					if err != nil {
--						klog.V(3).ErrorS(err, "Error deleting BucketAccess",
--							"name", bucketAccess.Name,
--							"bucket", bucket.ObjectMeta.Name)
--						return err
--					}
--				}
--			}
-+		return b.handleDeletion(ctx, bucket)
-+	}
- 
--			klog.V(5).Infof("Successfully deleted dependent bucketAccess of bucket:%s", bucket.ObjectMeta.Name)
-+	if err = b.Add(ctx, bucket); err != nil {
-+		return err
-+	}
- 
--			controllerutil.RemoveFinalizer(bucket, consts.BABucketFinalizer)
--			klog.V(5).Infof("Successfully removed finalizer: %s of bucket: %s", consts.BABucketFinalizer, bucket.ObjectMeta.Name)
--		}
-+	klog.V(3).InfoS("Update Bucket success",
-+		"name", bucket.ObjectMeta.Name,
-+		"ns", bucket.ObjectMeta.Namespace)
-+	return nil
-+}
- 
--		if controllerutil.ContainsFinalizer(bucket, consts.BucketFinalizer) {
--			err = b.deleteBucketOp(ctx, bucket)
--			if err != nil {
--				return b.recordError(bucket, v1.EventTypeWarning, v1alpha1.FailedDeleteBucket, err)
--			}
-+func (b *BucketListener) handleDeletion(ctx context.Context, bucket *v1alpha1.Bucket) error {
-+	var err error
- 
--			controllerutil.RemoveFinalizer(bucket, consts.BucketFinalizer)
--			klog.V(5).Infof("Successfully removed finalizer: %s of bucket: %s", consts.BucketFinalizer, bucket.ObjectMeta.Name)
--		}
-+	if controllerutil.ContainsFinalizer(bucket, consts.BABucketFinalizer) {
-+		bucketClaimNs := bucket.Spec.BucketClaim.Namespace
-+		bucketClaimName := bucket.Spec.BucketClaim.Name
- 
--		_, err = b.buckets().Update(ctx, bucket, metav1.UpdateOptions{})
-+		bucketAccessList, err := b.bucketAccesses(bucketClaimNs).List(ctx, metav1.ListOptions{})
- 		if err != nil {
--			klog.V(3).ErrorS(err, "Error updating bucket after removing finalizers",
-+			klog.V(3).ErrorS(err, "Error fetching BucketAccessList",
- 				"bucket", bucket.ObjectMeta.Name)
- 			return err
- 		}
-+
-+		for _, ba := range bucketAccessList.Items {
-+			if strings.EqualFold(ba.Spec.BucketClaimName, bucketClaimName) {
-+				if err = b.bucketAccesses(bucketClaimNs).Delete(ctx, ba.Name, metav1.DeleteOptions{}); err != nil {
-+					klog.V(3).ErrorS(err, "Error deleting BucketAccess",
-+						"name", ba.Name,
-+						"bucket", bucket.ObjectMeta.Name)
-+					return err
-+				}
-+			}
-+		}
-+
-+		controllerutil.RemoveFinalizer(bucket, consts.BABucketFinalizer)
-+	}
-+
-+	if controllerutil.ContainsFinalizer(bucket, consts.BucketFinalizer) {
-+		if err = b.deleteBucketOp(ctx, bucket); err != nil {
-+			return b.recordError(bucket, v1.EventTypeWarning, v1alpha1.FailedDeleteBucket, err)
-+		}
-+		controllerutil.RemoveFinalizer(bucket, consts.BucketFinalizer)
-+	}
-+
-+	if _, err = b.buckets().Update(ctx, bucket, metav1.UpdateOptions{}); err != nil {
-+		klog.V(3).ErrorS(err, "Error updating bucket after removing finalizers",
-+			"bucket", bucket.ObjectMeta.Name)
-+		return err
- 	}
- 
--	klog.V(3).InfoS("Update Bucket success",
--		"name", bucket.ObjectMeta.Name,
--		"ns", bucket.ObjectMeta.Namespace)
- 	return nil
- }
- 
-diff --git a/sidecar/pkg/bucket/bucket_controller_test.go b/sidecar/pkg/bucket/bucket_controller_test.go
-index 9be6cc4a..ae63464e 100644
---- a/sidecar/pkg/bucket/bucket_controller_test.go
-+++ b/sidecar/pkg/bucket/bucket_controller_test.go
-@@ -310,3 +310,43 @@ func TestRecordEvents(t *testing.T) {
- func newEvent(eventType, reason, message string) string {
- 	return fmt.Sprintf("%s %s %s", eventType, reason, message)
- }
-+
-+// TestAddDeletedBucket tests that the Add method does not call the driver
-+func TestAddDeletedBucket(t *testing.T) {
-+	driver := "driver1"
-+
-+	mpc := struct{ fakespec.FakeProvisionerClient }{}
-+	mpc.FakeDriverDeleteBucket = func(
-+		_ context.Context,
-+		_ *cosi.DriverDeleteBucketRequest,
-+		_ ...grpc.CallOption,
-+	) (*cosi.DriverDeleteBucketResponse, error) {
-+		t.Fatalf("driver should NOT be called from Add when object has DeletionTimestamp")
-+		return nil, nil
-+	}
-+
-+	now := metav1.Now()
-+	b := v1alpha1.Bucket{
-+		ObjectMeta: metav1.ObjectMeta{
-+			Name:              "testbucket",
-+			DeletionTimestamp: &now,
-+			ResourceVersion:   "1",
-+		},
-+		Spec: v1alpha1.BucketSpec{
-+			DriverName:      driver,
-+			BucketClassName: "ignored",
-+		},
-+	}
-+
-+	client := fakebucketclientset.NewSimpleClientset(&b)
-+
-+	bl := BucketListener{
-+		driverName:        driver,
-+		provisionerClient: &mpc,
-+	}
-+	bl.InitializeBucketClient(client)
-+
-+	if err := bl.Add(context.TODO(), &b); err != nil {
-+		t.Fatalf("Add returned error for deleted bucket: %v", err)
-+	}
-+}
-diff --git a/sidecar/pkg/bucketaccess/bucketaccess_controller.go b/sidecar/pkg/bucketaccess/bucketaccess_controller.go
-index c6d0ed07..dd18202f 100644
---- a/sidecar/pkg/bucketaccess/bucketaccess_controller.go
-+++ b/sidecar/pkg/bucketaccess/bucketaccess_controller.go
-@@ -68,6 +68,12 @@ func NewBucketAccessListener(driverName string, client cosi.ProvisionerClient) *
- func (bal *BucketAccessListener) Add(ctx context.Context, inputBucketAccess *v1alpha1.BucketAccess) error {
- 	bucketAccess := inputBucketAccess.DeepCopy()
- 
-+	if !bucketAccess.GetDeletionTimestamp().IsZero() {
-+		klog.V(3).InfoS("BucketAccess has deletion timestamp, handling deletion",
-+			"name", bucketAccess.ObjectMeta.Name)
-+		return bal.deleteBucketAccessOp(ctx, bucketAccess)
-+	}
-+
- 	if bucketAccess.Status.AccessGranted && bucketAccess.Status.AccountID != "" {
- 		klog.V(3).InfoS("BucketAccess already exists", bucketAccess.ObjectMeta.Name)
- 		return nil
-@@ -310,10 +316,13 @@ func (bal *BucketAccessListener) Update(ctx context.Context, old, new *v1alpha1.
- 
- 	bucketAccess := new.DeepCopy()
- 	if !bucketAccess.GetDeletionTimestamp().IsZero() {
--		err := bal.deleteBucketAccessOp(ctx, bucketAccess)
--		if err != nil {
-+		if err := bal.deleteBucketAccessOp(ctx, bucketAccess); err != nil {
- 			return bal.recordError(bucketAccess, v1.EventTypeWarning, v1alpha1.FailedRevokeAccess, err)
- 		}
-+	} else {
-+		if err := bal.Add(ctx, bucketAccess); err != nil {
-+			return bal.recordError(bucketAccess, v1.EventTypeWarning, v1alpha1.FailedGrantAccess, err)
-+		}
- 	}
- 
- 	klog.V(3).InfoS("Update BucketAccess success",
-diff --git a/sidecar/pkg/bucketaccess/bucketaccess_controller_test.go b/sidecar/pkg/bucketaccess/bucketaccess_controller_test.go
-index 2371c81e..d8da44a2 100644
---- a/sidecar/pkg/bucketaccess/bucketaccess_controller_test.go
-+++ b/sidecar/pkg/bucketaccess/bucketaccess_controller_test.go
-@@ -502,3 +502,94 @@ func TestRecordEvents(t *testing.T) {
- func newEvent(eventType, reason, message string) string {
- 	return fmt.Sprintf("%s %s %s", eventType, reason, message)
- }
-+
-+// TestAddDeletedBucketAccess tests that a deleted BucketAccess does not
-+// trigger a call to the driver to grant access, and that no secrets are created.
-+func TestAddDeletedBucketAccess(t *testing.T) {
-+	driver := "driver"
-+	baName := "bucketaccess-deleted"
-+	ns := "testns"
-+
-+	mpc := struct{ fakespec.FakeProvisionerClient }{}
-+	mpc.FakeDriverGrantBucketAccess = func(
-+		_ context.Context,
-+		_ *cosi.DriverGrantBucketAccessRequest,
-+		_ ...grpc.CallOption,
-+	) (*cosi.DriverGrantBucketAccessResponse, error) {
-+		t.Fatalf("driver Grant should NOT be called on deleted BA")
-+		return nil, nil
-+	}
-+	mpc.FakeDriverRevokeBucketAccess = func(
-+		_ context.Context,
-+		_ *cosi.DriverRevokeBucketAccessRequest,
-+		_ ...grpc.CallOption,
-+	) (*cosi.DriverRevokeBucketAccessResponse, error) {
-+		return &cosi.DriverRevokeBucketAccessResponse{}, nil
-+	}
-+
-+	// minimal stub objects just to satisfy look-ups inside delete-path
-+	bac := &v1alpha1.BucketAccessClass{
-+		ObjectMeta: metav1.ObjectMeta{Name: "bac"},
-+		DriverName: driver,
-+	}
-+	claim := &v1alpha1.BucketClaim{
-+		ObjectMeta: metav1.ObjectMeta{Name: "claim", Namespace: ns},
-+		Status: v1alpha1.BucketClaimStatus{
-+			BucketReady: true,
-+			BucketName:  "bucket",
-+		},
-+	}
-+	bucket := &v1alpha1.Bucket{
-+		ObjectMeta: metav1.ObjectMeta{Name: "bucket"},
-+		Status: v1alpha1.BucketStatus{
-+			BucketReady: true,
-+			BucketID:    "id",
-+		},
-+	}
-+
-+	now := metav1.Now()
-+	ba := &v1alpha1.BucketAccess{
-+		ObjectMeta: metav1.ObjectMeta{
-+			Name:              baName,
-+			Namespace:         ns,
-+			DeletionTimestamp: &now,
-+			Finalizers:        []string{consts.BAFinalizer},
-+		},
-+		Spec: v1alpha1.BucketAccessSpec{
-+			BucketClaimName:       claim.Name,
-+			BucketAccessClassName: bac.Name,
-+			CredentialsSecretName: "creds",
-+		},
-+		Status: v1alpha1.BucketAccessStatus{
-+			AccountID:     "acc",
-+			AccessGranted: true,
-+		},
-+	}
-+
-+	secret := &v1.Secret{
-+		ObjectMeta: metav1.ObjectMeta{
-+			Name:       "creds",
-+			Namespace:  ns,
-+			Finalizers: []string{consts.SecretFinalizer},
-+		},
-+		StringData: map[string]string{"dummy": "val"},
-+	}
-+
-+	client := fakebucketclientset.NewSimpleClientset(bac, claim, bucket, ba)
-+	kubeClient := fakekubeclientset.NewSimpleClientset(secret)
-+
-+	bal := BucketAccessListener{
-+		driverName:        driver,
-+		provisionerClient: &mpc,
-+		bucketClient:      client,
-+		kubeClient:        kubeClient,
-+	}
-+
-+	if err := bal.Add(context.TODO(), ba); err != nil {
-+		t.Fatalf("Add returned error for deleted BucketAccess: %v", err)
-+	}
-+
-+	if _, err := bal.secrets(ns).Get(context.TODO(), "creds", metav1.GetOptions{}); !kubeerrors.IsNotFound(err) {
-+		t.Fatalf("secret was not cleaned up, err=%v", err)
-+	}
-+}
diff --git a/packages/system/objectstorage-controller/images/objectstorage/patches/90-bucket-name.diff b/packages/system/objectstorage-controller/images/objectstorage/patches/90-bucket-name.diff
deleted file mode 100644
index de2d2c6b..00000000
--- a/packages/system/objectstorage-controller/images/objectstorage/patches/90-bucket-name.diff
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/controller/pkg/bucketclaim/bucketclaim.go b/controller/pkg/bucketclaim/bucketclaim.go
-index 2f4d565e..2addcee8 100644
---- a/controller/pkg/bucketclaim/bucketclaim.go
-+++ b/controller/pkg/bucketclaim/bucketclaim.go
-@@ -165,7 +165,7 @@ func (b *BucketClaimListener) provisionBucketClaimOperation(ctx context.Context,
- 			return b.recordError(inputBucketClaim, v1.EventTypeWarning, v1alpha1.FailedCreateBucket, err)
- 		}
- 
--		bucketName = bucketClassName + string(bucketClaim.ObjectMeta.UID)
-+		bucketName = fmt.Sprintf("bucket-%s", bucketClaim.ObjectMeta.UID)
- 
- 		// create bucket
- 		bucket := &v1alpha1.Bucket{}

From c2a1ed131547697348843d45e12dbfc80029c427 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 23 Mar 2026 16:18:21 +0300
Subject: [PATCH 304/666] [kamaji] Simplify awk in Makefile update target

Use -F/ with $NF (last field) instead of -F'[/^]' with $3.
The ^{} separator is unnecessary since the grep pattern already
filters out annotated tag dereferences.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/kamaji/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/system/kamaji/Makefile b/packages/system/kamaji/Makefile
index 793b53dd..b23fb1bf 100644
--- a/packages/system/kamaji/Makefile
+++ b/packages/system/kamaji/Makefile
@@ -6,7 +6,7 @@ include ../../../hack/package.mk
 
 update:
 	rm -rf charts
-	tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/clastix/kamaji | grep -E 'refs/tags/[0-9]+\.[0-9]+\.[0-9]+-edge$$' | awk -F'[/^]' 'END{print $$3}') && \
+	tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/clastix/kamaji | grep -E 'refs/tags/[0-9]+\.[0-9]+\.[0-9]+-edge$$' | awk -F/ 'END{print $$NF}') && \
 	curl -sSL https://github.com/clastix/kamaji/archive/refs/tags/$${tag}.tar.gz | \
 	tar -xzvf - --strip 1 kamaji-$${tag}/charts && \
 	sed -i "/ARG VERSION/ s|=.*|=$${tag}|g" images/kamaji/Dockerfile

From f1482c5bfe4e0efab7b65d2280b600cb584792a6 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 23 Mar 2026 16:19:04 +0300
Subject: [PATCH 305/666] [objectstorage-controller] Use version tag instead of
 commit hash

Replace commit hash with v0.2.2 tag for better readability.
GitHub archive URLs work with tags identically.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../objectstorage-controller/images/objectstorage/Dockerfile    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/system/objectstorage-controller/images/objectstorage/Dockerfile b/packages/system/objectstorage-controller/images/objectstorage/Dockerfile
index 46699e02..260446c3 100644
--- a/packages/system/objectstorage-controller/images/objectstorage/Dockerfile
+++ b/packages/system/objectstorage-controller/images/objectstorage/Dockerfile
@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1.2
 
 FROM alpine AS source
-ARG COMMIT_REF=f75d47509dae3e4ed0fd18ce0a60474b78e8d29b
+ARG COMMIT_REF=v0.2.2
 RUN apk add --no-cache curl tar
 WORKDIR /src
 

From 64b370bfefc5a70ab38eebf1a7153741dac1223d Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 23 Mar 2026 16:54:09 +0300
Subject: [PATCH 306/666] [tests] Stabilize E2E kubernetes tests

Three changes to reduce flakiness in kubernetes E2E tests:

- Increase node Ready timeout from 2m to 5m to accommodate
  resource-constrained CI runners
- Fail fast when nodes are not Ready instead of continuing to
  LB/NFS tests that will also fail, saving ~7 minutes per attempt
- Delete stale Kubernetes resources at test start to ensure
  retries provision from scratch instead of patching stuck state

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/run-kubernetes.sh | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index dbdebd5e..739e637a 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -4,6 +4,10 @@ run_kubernetes_test() {
     local port="$3"
     local k8s_version=$(yq "$version_expr" packages/apps/kubernetes/files/versions.yaml)
 
+  # Clean up stale resources from a previous failed retry to ensure fresh provisioning
+  kubectl delete kuberneteses.apps.cozystack.io "${test_name}" \
+    -n tenant-test --ignore-not-found --timeout=2m || true
+
   kubectl apply -f - <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: Kubernetes
@@ -102,10 +106,11 @@ EOF
     done
   '
   # Verify the nodes are ready
-  if ! kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait node --all --timeout=2m --for=condition=Ready; then
-    # Additional debug messages
+  if ! kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait node --all --timeout=5m --for=condition=Ready; then
+    # Dump debug info and fail fast — no point running LB/NFS tests without Ready nodes
     kubectl --kubeconfig "tenantkubeconfig-${test_name}" describe nodes
     kubectl -n tenant-test get hr
+    exit 1
   fi
   kubectl --kubeconfig "tenantkubeconfig-${test_name}" get nodes -o wide
 

From 18961de36b32d785510e5c9788e8936c37ec150f Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 23 Mar 2026 17:25:01 +0300
Subject: [PATCH 307/666] [tests] Add pre-cleanup, fix port-forward race, fix
 temp leak

- Add pre-cleanup of stale resources to all app E2E tests so
  retries start fresh instead of patching stuck state
- Wait for port-forward to be ready before using it in
  kubernetes tests (fixes race condition)
- Reduce version check sleep from 5s to 1s for faster retries
- Clean up temp directory on test failure in cozytest.sh

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/cozytest.sh                | 1 +
 hack/e2e-apps/bucket.bats       | 1 +
 hack/e2e-apps/clickhouse.bats   | 1 +
 hack/e2e-apps/foundationdb.bats | 1 +
 hack/e2e-apps/kafka.bats        | 1 +
 hack/e2e-apps/mariadb.bats      | 1 +
 hack/e2e-apps/mongodb.bats      | 1 +
 hack/e2e-apps/openbao.bats      | 1 +
 hack/e2e-apps/postgres.bats     | 1 +
 hack/e2e-apps/qdrant.bats       | 1 +
 hack/e2e-apps/redis.bats        | 1 +
 hack/e2e-apps/run-kubernetes.sh | 4 +++-
 hack/e2e-apps/vminstance.bats   | 2 ++
 13 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/hack/cozytest.sh b/hack/cozytest.sh
index 363a4d9f..a3955fd1 100755
--- a/hack/cozytest.sh
+++ b/hack/cozytest.sh
@@ -65,6 +65,7 @@ run_one() {
     echo "----- captured output -----------------------------------------"
     grep -v '^__RC__' "$log"
     echo "$LINE"
+    rm -rf "$tmp"
     exit "$rc"
   fi
 
diff --git a/hack/e2e-apps/bucket.bats b/hack/e2e-apps/bucket.bats
index 9239d780..a606bf68 100644
--- a/hack/e2e-apps/bucket.bats
+++ b/hack/e2e-apps/bucket.bats
@@ -3,6 +3,7 @@
 @test "Create and Verify Seeweedfs Bucket" {
   # Create the bucket resource with readwrite and readonly users
   name='test'
+  kubectl -n tenant-test delete bucket.apps.cozystack.io $name --ignore-not-found --timeout=2m || true
   kubectl apply -f - <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: Bucket
diff --git a/hack/e2e-apps/clickhouse.bats b/hack/e2e-apps/clickhouse.bats
index 1684c0c4..fbc9f906 100644
--- a/hack/e2e-apps/clickhouse.bats
+++ b/hack/e2e-apps/clickhouse.bats
@@ -2,6 +2,7 @@
 
 @test "Create DB ClickHouse" {
   name='test'
+  kubectl -n tenant-test delete clickhouse.apps.cozystack.io $name --ignore-not-found --timeout=2m || true
   kubectl apply -f- <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: ClickHouse
diff --git a/hack/e2e-apps/foundationdb.bats b/hack/e2e-apps/foundationdb.bats
index 4c8d1b53..199bda11 100644
--- a/hack/e2e-apps/foundationdb.bats
+++ b/hack/e2e-apps/foundationdb.bats
@@ -2,6 +2,7 @@
 
 @test "Create DB FoundationDB" {
   name='test'
+  kubectl -n tenant-test delete foundationdb.apps.cozystack.io $name --ignore-not-found --timeout=2m || true
   kubectl apply -f - <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: FoundationDB
diff --git a/hack/e2e-apps/kafka.bats b/hack/e2e-apps/kafka.bats
index ceaf2cde..0afd374d 100644
--- a/hack/e2e-apps/kafka.bats
+++ b/hack/e2e-apps/kafka.bats
@@ -2,6 +2,7 @@
 
 @test "Create Kafka" {
   name='test'
+  kubectl -n tenant-test delete kafka.apps.cozystack.io $name --ignore-not-found --timeout=2m || true
   kubectl apply -f- <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: Kafka
diff --git a/hack/e2e-apps/mariadb.bats b/hack/e2e-apps/mariadb.bats
index 5b11c4c0..68f5fc00 100644
--- a/hack/e2e-apps/mariadb.bats
+++ b/hack/e2e-apps/mariadb.bats
@@ -2,6 +2,7 @@
 
 @test "Create DB MariaDB" {
   name='test'
+  kubectl -n tenant-test delete mariadbs.apps.cozystack.io $name --ignore-not-found --timeout=2m || true
   kubectl apply -f- <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: MariaDB
diff --git a/hack/e2e-apps/mongodb.bats b/hack/e2e-apps/mongodb.bats
index db58b2cf..7712fe01 100644
--- a/hack/e2e-apps/mongodb.bats
+++ b/hack/e2e-apps/mongodb.bats
@@ -2,6 +2,7 @@
 
 @test "Create DB MongoDB" {
   name='test'
+  kubectl -n tenant-test delete mongodbs.apps.cozystack.io $name --ignore-not-found --timeout=2m || true
   kubectl apply -f - <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: MongoDB
diff --git a/hack/e2e-apps/openbao.bats b/hack/e2e-apps/openbao.bats
index cd9d47d3..35271e55 100644
--- a/hack/e2e-apps/openbao.bats
+++ b/hack/e2e-apps/openbao.bats
@@ -2,6 +2,7 @@
 
 @test "Create OpenBAO (standalone)" {
   name='test'
+  kubectl -n tenant-test delete openbao.apps.cozystack.io $name --ignore-not-found --timeout=2m || true
   kubectl apply -f- <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: OpenBAO
diff --git a/hack/e2e-apps/postgres.bats b/hack/e2e-apps/postgres.bats
index 024ce086..b86bc664 100644
--- a/hack/e2e-apps/postgres.bats
+++ b/hack/e2e-apps/postgres.bats
@@ -2,6 +2,7 @@
 
 @test "Create DB PostgreSQL" {
   name='test'
+  kubectl -n tenant-test delete postgreses.apps.cozystack.io $name --ignore-not-found --timeout=2m || true
   kubectl apply -f - <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: Postgres
diff --git a/hack/e2e-apps/qdrant.bats b/hack/e2e-apps/qdrant.bats
index 63b82a3b..9d37ce01 100755
--- a/hack/e2e-apps/qdrant.bats
+++ b/hack/e2e-apps/qdrant.bats
@@ -2,6 +2,7 @@
 
 @test "Create Qdrant" {
   name='test'
+  kubectl -n tenant-test delete qdrant.apps.cozystack.io $name --ignore-not-found --timeout=2m || true
   kubectl apply -f- <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: Qdrant
diff --git a/hack/e2e-apps/redis.bats b/hack/e2e-apps/redis.bats
index 050f407b..3ddff71a 100644
--- a/hack/e2e-apps/redis.bats
+++ b/hack/e2e-apps/redis.bats
@@ -2,6 +2,7 @@
 
 @test "Create Redis" {
   name='test'
+  kubectl -n tenant-test delete redis.apps.cozystack.io $name --ignore-not-found --timeout=2m || true
   kubectl apply -f- <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: Redis
diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index 739e637a..fc131aa8 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -96,8 +96,10 @@ EOF
 
   # Set up port forwarding to the Kubernetes API server
   bash -c 'timeout 500s kubectl port-forward service/kubernetes-'"${test_name}"' -n tenant-test '"${port}"':6443 > /dev/null 2>&1 &'
+  # Wait for port-forward to be ready before using it
+  timeout 15 sh -ec 'until curl -sk https://localhost:'"${port}"' >/dev/null 2>&1; do sleep 1; done'
   # Verify the Kubernetes version matches what we expect (retry for up to 20 seconds)
-  timeout 20 sh -ec 'until kubectl --kubeconfig tenantkubeconfig-'"${test_name}"' version 2>/dev/null | grep -Fq "Server Version: ${k8s_version}"; do sleep 5; done'
+  timeout 20 sh -ec 'until kubectl --kubeconfig tenantkubeconfig-'"${test_name}"' version 2>/dev/null | grep -Fq "Server Version: ${k8s_version}"; do sleep 1; done'
 
   # Wait for at least 2 nodes to join (timeout after 8 minutes)
   timeout 8m bash -c '
diff --git a/hack/e2e-apps/vminstance.bats b/hack/e2e-apps/vminstance.bats
index 60513e8e..9f32fcc2 100644
--- a/hack/e2e-apps/vminstance.bats
+++ b/hack/e2e-apps/vminstance.bats
@@ -2,6 +2,8 @@
 
 @test "Create a VM Disk" {
   name='test'
+  kubectl -n tenant-test delete vminstances.apps.cozystack.io $name --ignore-not-found --timeout=2m || true
+  kubectl -n tenant-test delete vmdisks.apps.cozystack.io $name --ignore-not-found --timeout=2m || true
   kubectl apply -f - <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: VMDisk

From e3acb3a67e7c786c57311bdac1c89f86265115fe Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 23 Mar 2026 17:33:27 +0300
Subject: [PATCH 308/666] [tests] Fix port-forward leak and LB retry off-by-one

- Add EXIT trap in run-kubernetes.sh to clean up port-forward
  process and tenantkubeconfig file on any exit path
- Fix LoadBalancer retry loop: success on attempt 20 was falsely
  reported as failure due to $i -eq 20 check after break
- Kill stale port-forward in bucket.bats before retry

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/bucket.bats       |  1 +
 hack/e2e-apps/run-kubernetes.sh | 11 +++++++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/hack/e2e-apps/bucket.bats b/hack/e2e-apps/bucket.bats
index a606bf68..31e7efb0 100644
--- a/hack/e2e-apps/bucket.bats
+++ b/hack/e2e-apps/bucket.bats
@@ -4,6 +4,7 @@
   # Create the bucket resource with readwrite and readonly users
   name='test'
   kubectl -n tenant-test delete bucket.apps.cozystack.io $name --ignore-not-found --timeout=2m || true
+  pkill -f "port-forward.*8333:" 2>/dev/null || true
   kubectl apply -f - <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: Bucket
diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index fc131aa8..15e52ac5 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -4,6 +4,9 @@ run_kubernetes_test() {
     local port="$3"
     local k8s_version=$(yq "$version_expr" packages/apps/kubernetes/files/versions.yaml)
 
+  # Ensure port-forward and temp files are cleaned up on any exit
+  trap 'pkill -f "port-forward.*${port}:" 2>/dev/null || true; rm -f "tenantkubeconfig-${test_name}"' EXIT
+
   # Clean up stale resources from a previous failed retry to ensure fresh provisioning
   kubectl delete kuberneteses.apps.cozystack.io "${test_name}" \
     -n tenant-test --ignore-not-found --timeout=2m || true
@@ -224,13 +227,17 @@ if [ -z "$LB_ADDR" ]; then
   exit 1
 fi
 
+  lb_ok=false
   for i in $(seq 1 20); do
     echo "Attempt $i"
-    curl --silent --fail "http://${LB_ADDR}" && break
+    if curl --silent --fail "http://${LB_ADDR}"; then
+      lb_ok=true
+      break
+    fi
     sleep 3
   done
 
-  if [ "$i" -eq 20 ]; then
+  if [ "$lb_ok" != true ]; then
     echo "LoadBalancer not reachable" >&2
     exit 1
   fi

From c9b04c4ba33d17a578d1cab5bd19900ece3d38eb Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 23 Mar 2026 17:42:23 +0300
Subject: [PATCH 309/666] [tests] Fix review findings: vminstance pre-cleanup,
 indentation, --ignore-not-found

- Add pre-cleanup for VMInstance in second vminstance.bats test
- Fix indentation of LB_ADDR block in run-kubernetes.sh
- Add --ignore-not-found to final Kubernetes resource cleanup

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/run-kubernetes.sh | 20 ++++++++++----------
 hack/e2e-apps/vminstance.bats   |  1 +
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index 15e52ac5..aef63f30 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -216,16 +216,16 @@ EOF
     done
   "
 
-LB_ADDR=$(
-  kubectl get svc --kubeconfig "tenantkubeconfig-${test_name}" "${test_name}-backend" \
-    -n tenant-test \
-    -o jsonpath='{.status.loadBalancer.ingress[0].ip}{.status.loadBalancer.ingress[0].hostname}'
-)
+  LB_ADDR=$(
+    kubectl get svc --kubeconfig "tenantkubeconfig-${test_name}" "${test_name}-backend" \
+      -n tenant-test \
+      -o jsonpath='{.status.loadBalancer.ingress[0].ip}{.status.loadBalancer.ingress[0].hostname}'
+  )
 
-if [ -z "$LB_ADDR" ]; then
-  echo "LoadBalancer address is empty" >&2
-  exit 1
-fi
+  if [ -z "$LB_ADDR" ]; then
+    echo "LoadBalancer address is empty" >&2
+    exit 1
+  fi
 
   lb_ok=false
   for i in $(seq 1 20); do
@@ -318,6 +318,6 @@ EOF
     kubectl wait hr kubernetes-${test_name}-ingress-nginx -n tenant-test --timeout=5m --for=condition=ready
 
   # Clean up by deleting the Kubernetes resource
-  kubectl -n tenant-test delete kuberneteses.apps.cozystack.io $test_name
+  kubectl -n tenant-test delete kuberneteses.apps.cozystack.io $test_name --ignore-not-found
 
 }
diff --git a/hack/e2e-apps/vminstance.bats b/hack/e2e-apps/vminstance.bats
index 9f32fcc2..fa0f0b5b 100644
--- a/hack/e2e-apps/vminstance.bats
+++ b/hack/e2e-apps/vminstance.bats
@@ -27,6 +27,7 @@ EOF
 @test "Create a VM Instance" {
   diskName='test'
   name='test'
+  kubectl -n tenant-test delete vminstances.apps.cozystack.io $name --ignore-not-found --timeout=2m || true
   kubectl apply -f - <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: VMInstance

From 1c7c1f6c78f3c9fcb358dd4697b39f948ad99703 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 23 Mar 2026 17:47:48 +0300
Subject: [PATCH 310/666] [tests] Include Kubernetes resource cleanup in EXIT
 trap

Expand the EXIT trap in run_kubernetes_test to also delete the
Kubernetes tenant resource. Previously, early exit paths (exit 1
on node readiness failure, LB failure, etc.) would skip the final
kubectl delete, leaving the resource behind.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/run-kubernetes.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index aef63f30..1c90f9fc 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -4,8 +4,8 @@ run_kubernetes_test() {
     local port="$3"
     local k8s_version=$(yq "$version_expr" packages/apps/kubernetes/files/versions.yaml)
 
-  # Ensure port-forward and temp files are cleaned up on any exit
-  trap 'pkill -f "port-forward.*${port}:" 2>/dev/null || true; rm -f "tenantkubeconfig-${test_name}"' EXIT
+  # Ensure all resources are cleaned up on any exit (port-forward, kubeconfig, k8s resource)
+  trap 'pkill -f "port-forward.*${port}:" 2>/dev/null || true; rm -f "tenantkubeconfig-${test_name}"; kubectl -n tenant-test delete kuberneteses.apps.cozystack.io "${test_name}" --ignore-not-found --timeout=2m 2>/dev/null || true' EXIT
 
   # Clean up stale resources from a previous failed retry to ensure fresh provisioning
   kubectl delete kuberneteses.apps.cozystack.io "${test_name}" \

From 8f2c452ff3a5f8d8bca17542f8d0f627d21aece2 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 23 Mar 2026 17:51:57 +0300
Subject: [PATCH 311/666] [tests] Replace EXIT trap with explicit cleanup
 function

Use a _k8s_test_cleanup helper called at every exit point
instead of a process-scoped EXIT trap. This avoids any
potential trap scope issues and makes cleanup behavior
explicit and visible at each error path.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/run-kubernetes.sh | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index 1c90f9fc..7aa84cef 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -4,8 +4,12 @@ run_kubernetes_test() {
     local port="$3"
     local k8s_version=$(yq "$version_expr" packages/apps/kubernetes/files/versions.yaml)
 
-  # Ensure all resources are cleaned up on any exit (port-forward, kubeconfig, k8s resource)
-  trap 'pkill -f "port-forward.*${port}:" 2>/dev/null || true; rm -f "tenantkubeconfig-${test_name}"; kubectl -n tenant-test delete kuberneteses.apps.cozystack.io "${test_name}" --ignore-not-found --timeout=2m 2>/dev/null || true' EXIT
+  # Cleanup helper — called at every exit point and at the end of the test
+  _k8s_test_cleanup() {
+    pkill -f "port-forward.*${port}:" 2>/dev/null || true
+    rm -f "tenantkubeconfig-${test_name}"
+    kubectl -n tenant-test delete kuberneteses.apps.cozystack.io "${test_name}" --ignore-not-found --timeout=2m 2>/dev/null || true
+  }
 
   # Clean up stale resources from a previous failed retry to ensure fresh provisioning
   kubectl delete kuberneteses.apps.cozystack.io "${test_name}" \
@@ -115,7 +119,7 @@ EOF
     # Dump debug info and fail fast — no point running LB/NFS tests without Ready nodes
     kubectl --kubeconfig "tenantkubeconfig-${test_name}" describe nodes
     kubectl -n tenant-test get hr
-    exit 1
+    _k8s_test_cleanup; exit 1
   fi
   kubectl --kubeconfig "tenantkubeconfig-${test_name}" get nodes -o wide
 
@@ -139,7 +143,7 @@ EOF
 
   if [ "$node_ok" != true ]; then
     echo "Kubelet versions did not match expected ${k8s_version}" >&2
-    exit 1
+    _k8s_test_cleanup; exit 1
   fi
 
 
@@ -224,7 +228,7 @@ EOF
 
   if [ -z "$LB_ADDR" ]; then
     echo "LoadBalancer address is empty" >&2
-    exit 1
+    _k8s_test_cleanup; exit 1
   fi
 
   lb_ok=false
@@ -239,7 +243,7 @@ EOF
 
   if [ "$lb_ok" != true ]; then
     echo "LoadBalancer not reachable" >&2
-    exit 1
+    _k8s_test_cleanup; exit 1
   fi
 
   # Cleanup
@@ -302,7 +306,7 @@ EOF
     echo "NFS mount test failed: expected 'nfs-mount-ok', got '$nfs_result'" >&2
     kubectl --kubeconfig "tenantkubeconfig-${test_name}" delete pod nfs-test-pod -n tenant-test --wait=false 2>/dev/null || true
     kubectl --kubeconfig "tenantkubeconfig-${test_name}" delete pvc nfs-test-pvc -n tenant-test --wait=false 2>/dev/null || true
-    exit 1
+    _k8s_test_cleanup; exit 1
   fi
 
   # Cleanup NFS test resources in tenant cluster
@@ -317,7 +321,7 @@ EOF
     done
     kubectl wait hr kubernetes-${test_name}-ingress-nginx -n tenant-test --timeout=5m --for=condition=ready
 
-  # Clean up by deleting the Kubernetes resource
-  kubectl -n tenant-test delete kuberneteses.apps.cozystack.io $test_name --ignore-not-found
+  # Clean up all test resources (port-forward, kubeconfig, k8s resource)
+  _k8s_test_cleanup
 
 }

From a610d1331dc4d92fe6a0d7ea44c53f74d79f5d73 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 23 Mar 2026 17:55:30 +0300
Subject: [PATCH 312/666] [tests] Add EXIT trap as safety net for unexpected
 set -e exits

The explicit _k8s_test_cleanup calls cover known error paths, but
set -e can terminate the script at any kubectl/wait command. Add
an EXIT trap to catch these unexpected exits. The function runs
in a cozytest.sh subshell, so the trap is scoped and does not
affect parent traps. Removed 2>/dev/null from kubectl delete in
cleanup to preserve useful error output.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/run-kubernetes.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index 7aa84cef..52ae6e4c 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -4,12 +4,14 @@ run_kubernetes_test() {
     local port="$3"
     local k8s_version=$(yq "$version_expr" packages/apps/kubernetes/files/versions.yaml)
 
-  # Cleanup helper — called at every exit point and at the end of the test
+  # Cleanup helper — idempotent, safe to call multiple times
   _k8s_test_cleanup() {
     pkill -f "port-forward.*${port}:" 2>/dev/null || true
     rm -f "tenantkubeconfig-${test_name}"
-    kubectl -n tenant-test delete kuberneteses.apps.cozystack.io "${test_name}" --ignore-not-found --timeout=2m 2>/dev/null || true
+    kubectl -n tenant-test delete kuberneteses.apps.cozystack.io "${test_name}" --ignore-not-found --timeout=2m || true
   }
+  # Catch unexpected set -e exits (runs in subshell via cozytest.sh, does not affect parent traps)
+  trap '_k8s_test_cleanup' EXIT
 
   # Clean up stale resources from a previous failed retry to ensure fresh provisioning
   kubectl delete kuberneteses.apps.cozystack.io "${test_name}" \

From 262db2f176909d96994f982382a9cec021888fd4 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 23 Mar 2026 18:45:50 +0300
Subject: [PATCH 313/666] [tests] Increase CAPI deployment timeouts in
 install-cozystack

On resource-constrained CI runners, HelmReleases may take close
to 15 minutes to reconcile, leaving very little time for CAPI
deployments to start and become available. Increase timeouts:
- CAPI deployment discovery: 60s -> 180s
- CAPI deployment availability: 1m -> 5m

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-install-cozystack.bats | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hack/e2e-install-cozystack.bats b/hack/e2e-install-cozystack.bats
index 7656b898..42198ae0 100644
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -65,8 +65,8 @@ EOF
 
 @test "Wait for Cluster‑API provider deployments" {
   # Wait for Cluster‑API provider deployments
-  timeout 60 sh -ec 'until kubectl get deploy -n cozy-cluster-api capi-controller-manager capi-kamaji-controller-manager capi-kubeadm-bootstrap-controller-manager capi-operator-cluster-api-operator capk-controller-manager >/dev/null 2>&1; do sleep 1; done'
-  kubectl wait deployment/capi-controller-manager deployment/capi-kamaji-controller-manager deployment/capi-kubeadm-bootstrap-controller-manager deployment/capi-operator-cluster-api-operator deployment/capk-controller-manager -n cozy-cluster-api --timeout=1m --for=condition=available
+  timeout 180 sh -ec 'until kubectl get deploy -n cozy-cluster-api capi-controller-manager capi-kamaji-controller-manager capi-kubeadm-bootstrap-controller-manager capi-operator-cluster-api-operator capk-controller-manager >/dev/null 2>&1; do sleep 1; done'
+  kubectl wait deployment/capi-controller-manager deployment/capi-kamaji-controller-manager deployment/capi-kubeadm-bootstrap-controller-manager deployment/capi-operator-cluster-api-operator deployment/capk-controller-manager -n cozy-cluster-api --timeout=5m --for=condition=available
 }
 
 @test "Wait for LINSTOR and configure storage" {

From 8477e72ad2e996b05e0910ff3073ffa12c1aac11 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 23 Mar 2026 20:40:45 +0300
Subject: [PATCH 315/666] [ci] Add timeout-minutes to Build and E2E jobs

Without explicit timeouts, stuck jobs use the GitHub Actions
default of 360 minutes (6 hours). This blocks the concurrency
group and prevents new runs from starting.

Set reasonable limits:
- Build: 30 minutes (normally ~5 min)
- E2E: 120 minutes (normally ~60 min)

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .github/workflows/pull-requests.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/pull-requests.yaml b/.github/workflows/pull-requests.yaml
index 1f0f733a..76dbfc17 100644
--- a/.github/workflows/pull-requests.yaml
+++ b/.github/workflows/pull-requests.yaml
@@ -29,6 +29,7 @@ jobs:
   build:
     name: Build
     runs-on: [self-hosted]
+    timeout-minutes: 30
     permissions:
       contents: read
       packages: write
@@ -150,6 +151,7 @@ jobs:
     name: "E2E Tests"
     runs-on: ${{ contains(github.event.pull_request.labels.*.name, 'debug') && 'self-hosted' || 'oracle-vm-24cpu-96gb-x86-64' }}
     #runs-on: [oracle-vm-32cpu-128gb-x86-64]
+    timeout-minutes: 120
     permissions:
       contents: read
       packages: read

From 8c11ece4ce782879a0fb09ce512f459f6526a3a4 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 24 Mar 2026 03:23:16 +0300
Subject: [PATCH 318/666] [tests] Improve NFS test: increase PVC timeout, add
 debug on failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Increase NFS PVC Bound timeout from 2m to 5m — RWX via kubevirt
  CSI provisions an NFS server pod which takes time
- Add pod describe and events dump when NFS test pod fails to
  complete, making the root cause visible in CI logs

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/run-kubernetes.sh | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index 52ae6e4c..44765f8f 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -274,8 +274,8 @@ spec:
       storage: 1Gi
 EOF
 
-  # Wait for PVC to be bound
-  kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait pvc nfs-test-pvc -n tenant-test --timeout=2m --for=jsonpath='{.status.phase}'=Bound
+  # Wait for PVC to be bound (RWX via kubevirt CSI provisions an NFS server pod, needs time)
+  kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait pvc nfs-test-pvc -n tenant-test --timeout=5m --for=jsonpath='{.status.phase}'=Bound
 
   # Create Pod that writes and reads data from NFS volume
   kubectl --kubeconfig "tenantkubeconfig-${test_name}" apply -f - <<EOF
@@ -300,7 +300,12 @@ spec:
 EOF
 
   # Wait for Pod to complete successfully
-  kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait pod nfs-test-pod -n tenant-test --timeout=5m --for=jsonpath='{.status.phase}'=Succeeded
+  if ! kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait pod nfs-test-pod -n tenant-test --timeout=5m --for=jsonpath='{.status.phase}'=Succeeded; then
+    echo "=== NFS test pod did not complete ===" >&2
+    kubectl --kubeconfig "tenantkubeconfig-${test_name}" describe pod nfs-test-pod -n tenant-test >&2 || true
+    kubectl --kubeconfig "tenantkubeconfig-${test_name}" get events -n tenant-test --sort-by='.lastTimestamp' >&2 || true
+    _k8s_test_cleanup; exit 1
+  fi
 
   # Verify NFS data integrity
   nfs_result=$(kubectl --kubeconfig "tenantkubeconfig-${test_name}" logs nfs-test-pod -n tenant-test)

From 30e36a22253e4fa3294be6441690cb497576f998 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 24 Mar 2026 13:44:38 +0300
Subject: [PATCH 319/666] [tests] Remove port-forward timeout that kills NFS
 tests

Root cause of NFS test failures: port-forward had `timeout 500s`
(8.3 minutes), but tests after it take up to 26 minutes (node
join 8m + node Ready 5m + LB test 2.5m + NFS 10m). Port-forward
was guaranteed to die mid-test.

Remove the timeout entirely. Cleanup is already handled by:
- EXIT trap (_k8s_test_cleanup does pkill port-forward)
- Explicit cleanup at every exit point
- Job-level timeout-minutes: 120 as backstop

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/run-kubernetes.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index 44765f8f..e2cefc33 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -104,7 +104,8 @@ EOF
   sleep 1
 
   # Set up port forwarding to the Kubernetes API server
-  bash -c 'timeout 500s kubectl port-forward service/kubernetes-'"${test_name}"' -n tenant-test '"${port}"':6443 > /dev/null 2>&1 &'
+  # No timeout — cleanup is handled by EXIT trap (_k8s_test_cleanup) and job-level timeout-minutes
+  kubectl port-forward service/kubernetes-"${test_name}" -n tenant-test "${port}":6443 > /dev/null 2>&1 &
   # Wait for port-forward to be ready before using it
   timeout 15 sh -ec 'until curl -sk https://localhost:'"${port}"' >/dev/null 2>&1; do sleep 1; done'
   # Verify the Kubernetes version matches what we expect (retry for up to 20 seconds)

From 72cad3b7d6a763db492dd22d20bb7ca1465bc374 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 24 Mar 2026 18:25:50 +0300
Subject: [PATCH 322/666] [tests] Optimize cleanup and timeouts to reduce E2E
 duration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous changes increased worst-case E2E time by ~60 minutes
due to blocking cleanup (--timeout=2m × multiple calls) and
generous timeouts on retry.

Changes:
- Use --wait=false in _k8s_test_cleanup (non-blocking fire-and-forget)
- Pre-cleanup: delete --wait=false + wait --for=delete (only blocks once)
- Node Ready timeout: 5m -> 3m (was 2m originally)
- NFS PVC timeout: 5m -> 3m (was 2m originally)
- CAPI discovery: 180s -> 120s, availability: 5m -> 2m (was 1m originally)

Estimated savings: ~40 minutes on worst-case retry path.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/run-kubernetes.sh | 15 +++++++--------
 hack/e2e-install-cozystack.bats |  4 ++--
 2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index e2cefc33..5bad4bb8 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -4,18 +4,17 @@ run_kubernetes_test() {
     local port="$3"
     local k8s_version=$(yq "$version_expr" packages/apps/kubernetes/files/versions.yaml)
 
-  # Cleanup helper — idempotent, safe to call multiple times
+  # Cleanup helper — idempotent, non-blocking
   _k8s_test_cleanup() {
     pkill -f "port-forward.*${port}:" 2>/dev/null || true
     rm -f "tenantkubeconfig-${test_name}"
-    kubectl -n tenant-test delete kuberneteses.apps.cozystack.io "${test_name}" --ignore-not-found --timeout=2m || true
+    kubectl -n tenant-test delete kuberneteses.apps.cozystack.io "${test_name}" --ignore-not-found --wait=false 2>/dev/null || true
   }
-  # Catch unexpected set -e exits (runs in subshell via cozytest.sh, does not affect parent traps)
   trap '_k8s_test_cleanup' EXIT
 
-  # Clean up stale resources from a previous failed retry to ensure fresh provisioning
-  kubectl delete kuberneteses.apps.cozystack.io "${test_name}" \
-    -n tenant-test --ignore-not-found --timeout=2m || true
+  # Clean up stale resources from a previous failed retry and wait for deletion
+  kubectl -n tenant-test delete kuberneteses.apps.cozystack.io "${test_name}" --ignore-not-found --wait=false 2>/dev/null || true
+  kubectl -n tenant-test wait kuberneteses.apps.cozystack.io "${test_name}" --for=delete --timeout=2m 2>/dev/null || true
 
   kubectl apply -f - <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
@@ -118,7 +117,7 @@ EOF
     done
   '
   # Verify the nodes are ready
-  if ! kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait node --all --timeout=5m --for=condition=Ready; then
+  if ! kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait node --all --timeout=3m --for=condition=Ready; then
     # Dump debug info and fail fast — no point running LB/NFS tests without Ready nodes
     kubectl --kubeconfig "tenantkubeconfig-${test_name}" describe nodes
     kubectl -n tenant-test get hr
@@ -276,7 +275,7 @@ spec:
 EOF
 
   # Wait for PVC to be bound (RWX via kubevirt CSI provisions an NFS server pod, needs time)
-  kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait pvc nfs-test-pvc -n tenant-test --timeout=5m --for=jsonpath='{.status.phase}'=Bound
+  kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait pvc nfs-test-pvc -n tenant-test --timeout=3m --for=jsonpath='{.status.phase}'=Bound
 
   # Create Pod that writes and reads data from NFS volume
   kubectl --kubeconfig "tenantkubeconfig-${test_name}" apply -f - <<EOF
diff --git a/hack/e2e-install-cozystack.bats b/hack/e2e-install-cozystack.bats
index 42198ae0..743782e9 100644
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -65,8 +65,8 @@ EOF
 
 @test "Wait for Cluster‑API provider deployments" {
   # Wait for Cluster‑API provider deployments
-  timeout 180 sh -ec 'until kubectl get deploy -n cozy-cluster-api capi-controller-manager capi-kamaji-controller-manager capi-kubeadm-bootstrap-controller-manager capi-operator-cluster-api-operator capk-controller-manager >/dev/null 2>&1; do sleep 1; done'
-  kubectl wait deployment/capi-controller-manager deployment/capi-kamaji-controller-manager deployment/capi-kubeadm-bootstrap-controller-manager deployment/capi-operator-cluster-api-operator deployment/capk-controller-manager -n cozy-cluster-api --timeout=5m --for=condition=available
+  timeout 120 sh -ec 'until kubectl get deploy -n cozy-cluster-api capi-controller-manager capi-kamaji-controller-manager capi-kubeadm-bootstrap-controller-manager capi-operator-cluster-api-operator capk-controller-manager >/dev/null 2>&1; do sleep 1; done'
+  kubectl wait deployment/capi-controller-manager deployment/capi-kamaji-controller-manager deployment/capi-kubeadm-bootstrap-controller-manager deployment/capi-operator-cluster-api-operator deployment/capk-controller-manager -n cozy-cluster-api --timeout=2m --for=condition=available
 }
 
 @test "Wait for LINSTOR and configure storage" {

From 67b41801529af546a7b121757ac336ba171af7f5 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 24 Mar 2026 21:30:06 +0300
Subject: [PATCH 325/666] [tests] Fix: remove EXIT trap that broke successful
 kubernetes tests

Root cause: EXIT trap called _k8s_test_cleanup after subshell exit,
but variables ${port} and ${test_name} were not available in that
context. set -u caught the unset variable and exited with error,
marking a successful test as failed. This caused every kubernetes
test to "fail" on attempt 1, then retry 2 more times with real
failures (NFS PVC timeout because the cluster was being deleted).

Fix: remove trap and cleanup function entirely. Pre-cleanup at
test start handles stale resources. Inline cleanup at test end
handles normal path. On failure, resources are cleaned up by
pre-cleanup on the next retry.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/run-kubernetes.sh | 30 ++++++++++++------------------
 1 file changed, 12 insertions(+), 18 deletions(-)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index 5bad4bb8..be6dcd6f 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -4,15 +4,7 @@ run_kubernetes_test() {
     local port="$3"
     local k8s_version=$(yq "$version_expr" packages/apps/kubernetes/files/versions.yaml)
 
-  # Cleanup helper — idempotent, non-blocking
-  _k8s_test_cleanup() {
-    pkill -f "port-forward.*${port}:" 2>/dev/null || true
-    rm -f "tenantkubeconfig-${test_name}"
-    kubectl -n tenant-test delete kuberneteses.apps.cozystack.io "${test_name}" --ignore-not-found --wait=false 2>/dev/null || true
-  }
-  trap '_k8s_test_cleanup' EXIT
-
-  # Clean up stale resources from a previous failed retry and wait for deletion
+  # Clean up stale resources from a previous failed retry
   kubectl -n tenant-test delete kuberneteses.apps.cozystack.io "${test_name}" --ignore-not-found --wait=false 2>/dev/null || true
   kubectl -n tenant-test wait kuberneteses.apps.cozystack.io "${test_name}" --for=delete --timeout=2m 2>/dev/null || true
 
@@ -103,7 +95,7 @@ EOF
   sleep 1
 
   # Set up port forwarding to the Kubernetes API server
-  # No timeout — cleanup is handled by EXIT trap (_k8s_test_cleanup) and job-level timeout-minutes
+  # No timeout — process is killed at end of test or by job-level timeout-minutes
   kubectl port-forward service/kubernetes-"${test_name}" -n tenant-test "${port}":6443 > /dev/null 2>&1 &
   # Wait for port-forward to be ready before using it
   timeout 15 sh -ec 'until curl -sk https://localhost:'"${port}"' >/dev/null 2>&1; do sleep 1; done'
@@ -121,7 +113,7 @@ EOF
     # Dump debug info and fail fast — no point running LB/NFS tests without Ready nodes
     kubectl --kubeconfig "tenantkubeconfig-${test_name}" describe nodes
     kubectl -n tenant-test get hr
-    _k8s_test_cleanup; exit 1
+    exit 1
   fi
   kubectl --kubeconfig "tenantkubeconfig-${test_name}" get nodes -o wide
 
@@ -145,7 +137,7 @@ EOF
 
   if [ "$node_ok" != true ]; then
     echo "Kubelet versions did not match expected ${k8s_version}" >&2
-    _k8s_test_cleanup; exit 1
+    exit 1
   fi
 
 
@@ -230,7 +222,7 @@ EOF
 
   if [ -z "$LB_ADDR" ]; then
     echo "LoadBalancer address is empty" >&2
-    _k8s_test_cleanup; exit 1
+    exit 1
   fi
 
   lb_ok=false
@@ -245,7 +237,7 @@ EOF
 
   if [ "$lb_ok" != true ]; then
     echo "LoadBalancer not reachable" >&2
-    _k8s_test_cleanup; exit 1
+    exit 1
   fi
 
   # Cleanup
@@ -304,7 +296,7 @@ EOF
     echo "=== NFS test pod did not complete ===" >&2
     kubectl --kubeconfig "tenantkubeconfig-${test_name}" describe pod nfs-test-pod -n tenant-test >&2 || true
     kubectl --kubeconfig "tenantkubeconfig-${test_name}" get events -n tenant-test --sort-by='.lastTimestamp' >&2 || true
-    _k8s_test_cleanup; exit 1
+    exit 1
   fi
 
   # Verify NFS data integrity
@@ -313,7 +305,7 @@ EOF
     echo "NFS mount test failed: expected 'nfs-mount-ok', got '$nfs_result'" >&2
     kubectl --kubeconfig "tenantkubeconfig-${test_name}" delete pod nfs-test-pod -n tenant-test --wait=false 2>/dev/null || true
     kubectl --kubeconfig "tenantkubeconfig-${test_name}" delete pvc nfs-test-pvc -n tenant-test --wait=false 2>/dev/null || true
-    _k8s_test_cleanup; exit 1
+    exit 1
   fi
 
   # Cleanup NFS test resources in tenant cluster
@@ -328,7 +320,9 @@ EOF
     done
     kubectl wait hr kubernetes-${test_name}-ingress-nginx -n tenant-test --timeout=5m --for=condition=ready
 
-  # Clean up all test resources (port-forward, kubeconfig, k8s resource)
-  _k8s_test_cleanup
+  # Clean up
+  pkill -f "port-forward.*${port}:" 2>/dev/null || true
+  rm -f "tenantkubeconfig-${test_name}"
+  kubectl -n tenant-test delete kuberneteses.apps.cozystack.io "${test_name}" --ignore-not-found --wait=false 2>/dev/null || true
 
 }

From 0185208ca52720713d0a5d181de3329fae13fbed Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Wed, 25 Mar 2026 12:17:51 +0500
Subject: [PATCH 326/666] fix(postgres): use DROP DATABASE WITH (FORCE) to
 avoid race condition

Replace separate pg_terminate_backend + DROP DATABASE calls with a
single DROP DATABASE ... WITH (FORCE) statement. This eliminates the
race window where new sessions could reconnect between termination
and drop. Available since PostgreSQL 13.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/apps/postgres/templates/init-script.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/packages/apps/postgres/templates/init-script.yaml b/packages/apps/postgres/templates/init-script.yaml
index 1a295034..500d54d4 100644
--- a/packages/apps/postgres/templates/init-script.yaml
+++ b/packages/apps/postgres/templates/init-script.yaml
@@ -73,8 +73,7 @@ stringData:
 
     echo "databases to delete: $DELETE_DBS"
     for db in $DELETE_DBS; do
-    psql -v ON_ERROR_STOP=1 --echo-all -c "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = '$db' AND pid <> pg_backend_pid();"
-    psql -v ON_ERROR_STOP=1 --echo-all -c "DROP DATABASE IF EXISTS \"$db\";"
+    psql -v ON_ERROR_STOP=1 --echo-all -c "DROP DATABASE IF EXISTS \"$db\" WITH (FORCE);"
     done
 
     echo "== delete orphaned managed roles"

From e090e2f317e6a7474adaf6b567a81692e441cbe2 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 16 Mar 2026 12:34:37 +0500
Subject: [PATCH 327/666] [docs] Added go types codegeneration for managed apps

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .github/workflows/tags.yaml                   |  19 ++
 api/apps/v1alpha1/bucket/types.go             |  35 +++
 api/apps/v1alpha1/clickhouse/types.go         | 114 ++++++++
 api/apps/v1alpha1/foundationdb/types.go       | 164 +++++++++++
 api/apps/v1alpha1/go.mod                      |  24 ++
 api/apps/v1alpha1/go.sum                      |  56 ++++
 api/apps/v1alpha1/harbor/types.go             | 116 ++++++++
 api/apps/v1alpha1/httpcache/types.go          |  74 +++++
 api/apps/v1alpha1/kafka/types.go              |  92 +++++++
 api/apps/v1alpha1/kubernetes/types.go         | 260 ++++++++++++++++++
 api/apps/v1alpha1/mariadb/types.go            | 111 ++++++++
 api/apps/v1alpha1/mongodb/types.go            | 151 ++++++++++
 api/apps/v1alpha1/nats/types.go               |  80 ++++++
 api/apps/v1alpha1/openbao/types.go            |  53 ++++
 api/apps/v1alpha1/postgresql/types.go         | 152 ++++++++++
 api/apps/v1alpha1/qdrant/types.go             |  50 ++++
 api/apps/v1alpha1/rabbitmq/types.go           |  79 ++++++
 api/apps/v1alpha1/redis/types.go              |  59 ++++
 api/apps/v1alpha1/tcpbalancer/types.go        |  77 ++++++
 api/apps/v1alpha1/tenant/types.go             |  40 +++
 api/apps/v1alpha1/vmdisk/types.go             |  56 ++++
 api/apps/v1alpha1/vminstance/types.go         |  96 +++++++
 api/apps/v1alpha1/vpc/types.go                |  31 +++
 api/apps/v1alpha1/vpn/types.go                |  58 ++++
 hack/update-codegen.sh                        |   5 +-
 packages/apps/bucket/Makefile                 |   2 +-
 packages/apps/clickhouse/Makefile             |   2 +-
 packages/apps/foundationdb/Makefile           |   2 +-
 packages/apps/harbor/Makefile                 |   2 +-
 packages/apps/http-cache/Makefile             |   2 +-
 packages/apps/kafka/Makefile                  |   2 +-
 packages/apps/kubernetes/Makefile             |   2 +-
 packages/apps/mariadb/Makefile                |   2 +-
 packages/apps/mongodb/Makefile                |   2 +-
 packages/apps/nats/Makefile                   |   2 +-
 packages/apps/openbao/Makefile                |   2 +-
 packages/apps/postgres/Makefile               |   2 +-
 packages/apps/qdrant/Makefile                 |   2 +-
 packages/apps/rabbitmq/Makefile               |   2 +-
 packages/apps/redis/Makefile                  |   2 +-
 packages/apps/tcp-balancer/Makefile           |   2 +-
 packages/apps/tenant/Makefile                 |   2 +-
 packages/apps/vm-disk/Makefile                |   2 +-
 packages/apps/vm-disk/values.schema.json      |   3 +-
 packages/apps/vm-instance/Makefile            |   2 +-
 packages/apps/vpc/Makefile                    |   2 +-
 packages/apps/vpn/Makefile                    |   2 +-
 .../system/vm-disk-rd/cozyrds/vm-disk.yaml    |   2 +-
 48 files changed, 2075 insertions(+), 24 deletions(-)
 create mode 100644 api/apps/v1alpha1/bucket/types.go
 create mode 100644 api/apps/v1alpha1/clickhouse/types.go
 create mode 100644 api/apps/v1alpha1/foundationdb/types.go
 create mode 100644 api/apps/v1alpha1/go.mod
 create mode 100644 api/apps/v1alpha1/go.sum
 create mode 100644 api/apps/v1alpha1/harbor/types.go
 create mode 100644 api/apps/v1alpha1/httpcache/types.go
 create mode 100644 api/apps/v1alpha1/kafka/types.go
 create mode 100644 api/apps/v1alpha1/kubernetes/types.go
 create mode 100644 api/apps/v1alpha1/mariadb/types.go
 create mode 100644 api/apps/v1alpha1/mongodb/types.go
 create mode 100644 api/apps/v1alpha1/nats/types.go
 create mode 100644 api/apps/v1alpha1/openbao/types.go
 create mode 100644 api/apps/v1alpha1/postgresql/types.go
 create mode 100644 api/apps/v1alpha1/qdrant/types.go
 create mode 100644 api/apps/v1alpha1/rabbitmq/types.go
 create mode 100644 api/apps/v1alpha1/redis/types.go
 create mode 100644 api/apps/v1alpha1/tcpbalancer/types.go
 create mode 100644 api/apps/v1alpha1/tenant/types.go
 create mode 100644 api/apps/v1alpha1/vmdisk/types.go
 create mode 100644 api/apps/v1alpha1/vminstance/types.go
 create mode 100644 api/apps/v1alpha1/vpc/types.go
 create mode 100644 api/apps/v1alpha1/vpn/types.go

diff --git a/.github/workflows/tags.yaml b/.github/workflows/tags.yaml
index ad9dd0a9..9ac6f6ca 100644
--- a/.github/workflows/tags.yaml
+++ b/.github/workflows/tags.yaml
@@ -123,6 +123,25 @@ jobs:
           git commit -m "Prepare release ${GITHUB_REF#refs/tags/}" -s || echo "No changes to commit"
           git push origin HEAD || true
 
+      # Tag the api/apps/v1alpha1 submodule for pkg.go.dev
+      - name: Tag API submodule
+        if: steps.check_release.outputs.skip == 'false'
+        env:
+          GH_PAT: ${{ secrets.GH_PAT }}
+        run: |
+          VTAG="${{ steps.tag.outputs.tag }}"
+          SUBTAG="api/apps/v1alpha1/${VTAG}"
+          git config user.name  "cozystack-bot"
+          git config user.email "217169706+cozystack-bot@users.noreply.github.com"
+          git remote set-url origin https://cozystack-bot:${GH_PAT}@github.com/${GITHUB_REPOSITORY}
+          TARGET="$(git rev-parse "${VTAG}^{}")"
+          if git rev-parse -q --verify "refs/tags/${SUBTAG}" >/dev/null; then
+            test "$(git rev-list -n1 "${SUBTAG}")" = "$TARGET"
+          else
+            git tag "${SUBTAG}" "$TARGET"
+          fi
+          git push origin "${SUBTAG}"
+
       # Create or reuse draft release
       - name: Create / reuse draft release
         if: steps.check_release.outputs.skip == 'false'
diff --git a/api/apps/v1alpha1/bucket/types.go b/api/apps/v1alpha1/bucket/types.go
new file mode 100644
index 00000000..fa586252
--- /dev/null
+++ b/api/apps/v1alpha1/bucket/types.go
@@ -0,0 +1,35 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package bucket
+
+import (
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Provisions bucket from the `-lock` BucketClass (with object lock enabled).
+	// +kubebuilder:default:=false
+	Locking bool `json:"locking"`
+	// Selects a specific BucketClass by storage pool name.
+	// +kubebuilder:default:=""
+	StoragePool string `json:"storagePool,omitempty"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+}
+
+type User struct {
+	// Whether the user has read-only access.
+	Readonly bool `json:"readonly,omitempty"`
+}
diff --git a/api/apps/v1alpha1/clickhouse/types.go b/api/apps/v1alpha1/clickhouse/types.go
new file mode 100644
index 00000000..29bb87df
--- /dev/null
+++ b/api/apps/v1alpha1/clickhouse/types.go
@@ -0,0 +1,114 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package clickhouse
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Backup configuration.
+	// +kubebuilder:default:={}
+	Backup Backup `json:"backup"`
+	// ClickHouse Keeper configuration.
+	// +kubebuilder:default:={}
+	ClickhouseKeeper ClickHouseKeeper `json:"clickhouseKeeper"`
+	// Size of Persistent Volume for logs.
+	// +kubebuilder:default:="2Gi"
+	LogStorageSize resource.Quantity `json:"logStorageSize"`
+	// TTL (expiration time) for `query_log` and `query_thread_log`.
+	// +kubebuilder:default:=15
+	LogTTL int `json:"logTTL"`
+	// Number of ClickHouse replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each ClickHouse replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="small"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Number of ClickHouse shards.
+	// +kubebuilder:default:=1
+	Shards int `json:"shards"`
+	// Persistent Volume Claim size available for application data.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+}
+
+type Backup struct {
+	// Retention strategy for cleaning up old backups.
+	// +kubebuilder:default:="--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
+	CleanupStrategy string `json:"cleanupStrategy"`
+	// Enable regular backups (default: false).
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Password for Restic backup encryption.
+	// +kubebuilder:default:="<password>"
+	ResticPassword string `json:"resticPassword"`
+	// Access key for S3 authentication.
+	// +kubebuilder:default:="<your-access-key>"
+	S3AccessKey string `json:"s3AccessKey"`
+	// S3 bucket used for storing backups.
+	// +kubebuilder:default:="s3.example.org/clickhouse-backups"
+	S3Bucket string `json:"s3Bucket"`
+	// AWS S3 region where backups are stored.
+	// +kubebuilder:default:="us-east-1"
+	S3Region string `json:"s3Region"`
+	// Secret key for S3 authentication.
+	// +kubebuilder:default:="<your-secret-key>"
+	S3SecretKey string `json:"s3SecretKey"`
+	// Cron schedule for automated backups.
+	// +kubebuilder:default:="0 2 * * *"
+	Schedule string `json:"schedule"`
+}
+
+type ClickHouseKeeper struct {
+	// Deploy ClickHouse Keeper for cluster coordination.
+	// +kubebuilder:default:=true
+	Enabled bool `json:"enabled,omitempty"`
+	// Number of Keeper replicas.
+	// +kubebuilder:default:=3
+	Replicas int `json:"replicas,omitempty"`
+	// Default sizing preset.
+	// +kubebuilder:default:="micro"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"`
+	// Persistent Volume Claim size available for application data.
+	// +kubebuilder:default:="1Gi"
+	Size resource.Quantity `json:"size,omitempty"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type User struct {
+	// Password for the user.
+	Password string `json:"password,omitempty"`
+	// User is readonly (default: false).
+	Readonly bool `json:"readonly,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
diff --git a/api/apps/v1alpha1/foundationdb/types.go b/api/apps/v1alpha1/foundationdb/types.go
new file mode 100644
index 00000000..105a0d23
--- /dev/null
+++ b/api/apps/v1alpha1/foundationdb/types.go
@@ -0,0 +1,164 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package foundationdb
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Enable automatic pod replacements.
+	// +kubebuilder:default:=true
+	AutomaticReplacements bool `json:"automaticReplacements"`
+	// Backup configuration.
+	// +kubebuilder:default:={}
+	Backup Backup `json:"backup"`
+	// Cluster configuration.
+	// +kubebuilder:default:={}
+	Cluster Cluster `json:"cluster"`
+	// Custom parameters to pass to FoundationDB.
+	// +kubebuilder:default:={}
+	CustomParameters []string `json:"customParameters,omitempty"`
+	// Container image deployment type.
+	// +kubebuilder:default:="unified"
+	ImageType ImageType `json:"imageType"`
+	// Monitoring configuration.
+	// +kubebuilder:default:={}
+	Monitoring Monitoring `json:"monitoring"`
+	// Explicit CPU and memory configuration for each FoundationDB instance. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="medium"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Security context for containers.
+	// +kubebuilder:default:={}
+	SecurityContext SecurityContext `json:"securityContext"`
+	// Storage configuration.
+	// +kubebuilder:default:={}
+	Storage Storage `json:"storage"`
+}
+
+type Backup struct {
+	// Enable backups.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Retention policy for backups.
+	// +kubebuilder:default:="7d"
+	RetentionPolicy string `json:"retentionPolicy"`
+	// S3 configuration for backups.
+	// +kubebuilder:default:={}
+	S3 BackupS3 `json:"s3"`
+}
+
+type BackupS3 struct {
+	// S3 bucket name.
+	// +kubebuilder:default:=""
+	Bucket string `json:"bucket"`
+	// S3 credentials.
+	// +kubebuilder:default:={}
+	Credentials BackupS3Credentials `json:"credentials"`
+	// S3 endpoint URL.
+	// +kubebuilder:default:=""
+	Endpoint string `json:"endpoint"`
+	// S3 region.
+	// +kubebuilder:default:="us-east-1"
+	Region string `json:"region"`
+}
+
+type BackupS3Credentials struct {
+	// S3 access key ID.
+	// +kubebuilder:default:=""
+	AccessKeyId string `json:"accessKeyId"`
+	// S3 secret access key.
+	// +kubebuilder:default:=""
+	SecretAccessKey string `json:"secretAccessKey"`
+}
+
+type Cluster struct {
+	// Fault domain configuration.
+	// +kubebuilder:default:={}
+	FaultDomain ClusterFaultDomain `json:"faultDomain"`
+	// Process counts for different roles.
+	// +kubebuilder:default:={}
+	ProcessCounts ClusterProcessCounts `json:"processCounts"`
+	// Database redundancy mode (single, double, triple, three_datacenter, three_datacenter_fallback).
+	// +kubebuilder:default:="double"
+	RedundancyMode string `json:"redundancyMode"`
+	// Storage engine (ssd-2, ssd-redwood-v1, ssd-rocksdb-v1, memory).
+	// +kubebuilder:default:="ssd-2"
+	StorageEngine string `json:"storageEngine"`
+	// Version of FoundationDB to use.
+	// +kubebuilder:default:="7.3.63"
+	Version string `json:"version"`
+}
+
+type ClusterFaultDomain struct {
+	// Fault domain key.
+	// +kubebuilder:default:="kubernetes.io/hostname"
+	Key string `json:"key"`
+	// Fault domain value source.
+	// +kubebuilder:default:="spec.nodeName"
+	ValueFrom string `json:"valueFrom"`
+}
+
+type ClusterProcessCounts struct {
+	// Number of cluster controller processes.
+	// +kubebuilder:default:=1
+	ClusterController int `json:"cluster_controller"`
+	// Number of stateless processes (-1 for automatic).
+	// +kubebuilder:default:=-1
+	Stateless int `json:"stateless"`
+	// Number of storage processes (determines cluster size).
+	// +kubebuilder:default:=3
+	Storage int `json:"storage"`
+}
+
+type Monitoring struct {
+	// Enable WorkloadMonitor integration.
+	// +kubebuilder:default:=true
+	Enabled bool `json:"enabled"`
+}
+
+type Resources struct {
+	// CPU available to each instance.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each instance.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type SecurityContext struct {
+	// Group ID to run the container.
+	// +kubebuilder:default:=4059
+	RunAsGroup int `json:"runAsGroup"`
+	// User ID to run the container.
+	// +kubebuilder:default:=4059
+	RunAsUser int `json:"runAsUser"`
+}
+
+type Storage struct {
+	// Size of persistent volumes for each instance.
+	// +kubebuilder:default:="16Gi"
+	Size resource.Quantity `json:"size"`
+	// Storage class (if not set, uses cluster default).
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+}
+
+// +kubebuilder:validation:Enum="unified";"split"
+type ImageType string
+
+// +kubebuilder:validation:Enum="small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
diff --git a/api/apps/v1alpha1/go.mod b/api/apps/v1alpha1/go.mod
new file mode 100644
index 00000000..d5d57383
--- /dev/null
+++ b/api/apps/v1alpha1/go.mod
@@ -0,0 +1,24 @@
+module github.com/cozystack/cozystack/api/apps/v1alpha1
+
+go 1.25.0
+
+require k8s.io/apimachinery v0.35.2
+
+require (
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
+	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+)
diff --git a/api/apps/v1alpha1/go.sum b/api/apps/v1alpha1/go.sum
new file mode 100644
index 00000000..d9b1cf31
--- /dev/null
+++ b/api/apps/v1alpha1/go.sum
@@ -0,0 +1,56 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
+go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+k8s.io/apimachinery v0.35.2 h1:NqsM/mmZA7sHW02JZ9RTtk3wInRgbVxL8MPfzSANAK8=
+k8s.io/apimachinery v0.35.2/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
+k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
+k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=
+k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
+k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzkbzn+gDM4X9T4Ck=
+k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/api/apps/v1alpha1/harbor/types.go b/api/apps/v1alpha1/harbor/types.go
new file mode 100644
index 00000000..852dc198
--- /dev/null
+++ b/api/apps/v1alpha1/harbor/types.go
@@ -0,0 +1,116 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package harbor
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Core API server configuration.
+	// +kubebuilder:default:={}
+	Core Core `json:"core"`
+	// PostgreSQL database configuration.
+	// +kubebuilder:default:={}
+	Database Database `json:"database"`
+	// Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).
+	// +kubebuilder:default:=""
+	Host string `json:"host,omitempty"`
+	// Background job service configuration.
+	// +kubebuilder:default:={}
+	Jobservice Jobservice `json:"jobservice"`
+	// Redis cache configuration.
+	// +kubebuilder:default:={}
+	Redis Redis `json:"redis"`
+	// Container image registry configuration.
+	// +kubebuilder:default:={}
+	Registry Registry `json:"registry"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+	// Trivy vulnerability scanner configuration.
+	// +kubebuilder:default:={}
+	Trivy Trivy `json:"trivy"`
+}
+
+type Core struct {
+	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="small"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"`
+}
+
+type Database struct {
+	// Number of database instances.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Persistent Volume size for database storage.
+	// +kubebuilder:default:="5Gi"
+	Size resource.Quantity `json:"size"`
+}
+
+type Jobservice struct {
+	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"`
+}
+
+type Redis struct {
+	// Number of Redis replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Persistent Volume size for cache storage.
+	// +kubebuilder:default:="1Gi"
+	Size resource.Quantity `json:"size"`
+}
+
+type Registry struct {
+	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="small"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"`
+}
+
+type Resources struct {
+	// Number of CPU cores allocated.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Amount of memory allocated.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type Trivy struct {
+	// Enable or disable the vulnerability scanner.
+	// +kubebuilder:default:=true
+	Enabled bool `json:"enabled"`
+	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"`
+	// Persistent Volume size for vulnerability database cache.
+	// +kubebuilder:default:="5Gi"
+	Size resource.Quantity `json:"size"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
diff --git a/api/apps/v1alpha1/httpcache/types.go b/api/apps/v1alpha1/httpcache/types.go
new file mode 100644
index 00000000..47dfa2d5
--- /dev/null
+++ b/api/apps/v1alpha1/httpcache/types.go
@@ -0,0 +1,74 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package httpcache
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Endpoints configuration, as a list of <ip:port>.
+	// +kubebuilder:default:={}
+	Endpoints []string `json:"endpoints,omitempty"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// HAProxy configuration.
+	// +kubebuilder:default:={}
+	Haproxy HAProxy `json:"haproxy"`
+	// Nginx configuration.
+	// +kubebuilder:default:={}
+	Nginx Nginx `json:"nginx"`
+	// Persistent Volume Claim size available for application data.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+}
+
+type HAProxy struct {
+	// Number of HAProxy replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+}
+
+type Nginx struct {
+	// Number of Nginx replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
diff --git a/api/apps/v1alpha1/kafka/types.go b/api/apps/v1alpha1/kafka/types.go
new file mode 100644
index 00000000..2b1b76e4
--- /dev/null
+++ b/api/apps/v1alpha1/kafka/types.go
@@ -0,0 +1,92 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package kafka
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	k8sRuntime "k8s.io/apimachinery/pkg/runtime"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Kafka configuration.
+	// +kubebuilder:default:={}
+	Kafka Kafka `json:"kafka"`
+	// Topics configuration.
+	// +kubebuilder:default:={}
+	Topics []Topic `json:"topics,omitempty"`
+	// ZooKeeper configuration.
+	// +kubebuilder:default:={}
+	Zookeeper ZooKeeper `json:"zookeeper"`
+}
+
+type Kafka struct {
+	// Number of Kafka replicas.
+	// +kubebuilder:default:=3
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="small"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Persistent Volume size for Kafka.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the Kafka data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type Topic struct {
+	// Topic configuration.
+	Config k8sRuntime.RawExtension `json:"config"`
+	// Topic name.
+	Name string `json:"name"`
+	// Number of partitions.
+	Partitions int `json:"partitions"`
+	// Number of replicas.
+	Replicas int `json:"replicas"`
+}
+
+type ZooKeeper struct {
+	// Number of ZooKeeper replicas.
+	// +kubebuilder:default:=3
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="small"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Persistent Volume size for ZooKeeper.
+	// +kubebuilder:default:="5Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the ZooKeeper data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
diff --git a/api/apps/v1alpha1/kubernetes/types.go b/api/apps/v1alpha1/kubernetes/types.go
new file mode 100644
index 00000000..698985cd
--- /dev/null
+++ b/api/apps/v1alpha1/kubernetes/types.go
@@ -0,0 +1,260 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package kubernetes
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	k8sRuntime "k8s.io/apimachinery/pkg/runtime"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Cluster addons configuration.
+	// +kubebuilder:default:={}
+	Addons Addons `json:"addons"`
+	// Kubernetes control-plane configuration.
+	// +kubebuilder:default:={}
+	ControlPlane ControlPlane `json:"controlPlane"`
+	// External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.
+	// +kubebuilder:default:=""
+	Host string `json:"host"`
+	// Worker nodes configuration map.
+	// +kubebuilder:default:={"md0":{"ephemeralStorage":"20Gi","gpus":{},"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":{"ingress-nginx"}}}
+	NodeGroups map[string]NodeGroup `json:"nodeGroups,omitempty"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:="replicated"
+	StorageClass string `json:"storageClass"`
+	// Kubernetes major.minor version to deploy
+	// +kubebuilder:default:="v1.35"
+	Version Version `json:"version"`
+}
+
+type APIServer struct {
+	// CPU and memory resources for API Server.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources"`
+	// Preset if `resources` omitted.
+	// +kubebuilder:default:="large"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+}
+
+type Addons struct {
+	// Cert-manager addon.
+	// +kubebuilder:default:={}
+	CertManager CertManagerAddon `json:"certManager"`
+	// Cilium CNI plugin.
+	// +kubebuilder:default:={}
+	Cilium CiliumAddon `json:"cilium"`
+	// CoreDNS addon.
+	// +kubebuilder:default:={}
+	Coredns CoreDNSAddon `json:"coredns"`
+	// FluxCD GitOps operator.
+	// +kubebuilder:default:={}
+	Fluxcd FluxCDAddon `json:"fluxcd"`
+	// Gateway API addon.
+	// +kubebuilder:default:={}
+	GatewayAPI GatewayAPIAddon `json:"gatewayAPI"`
+	// NVIDIA GPU Operator.
+	// +kubebuilder:default:={}
+	GpuOperator GPUOperatorAddon `json:"gpuOperator"`
+	// Ingress-NGINX controller.
+	// +kubebuilder:default:={}
+	IngressNginx IngressNginxAddon `json:"ingressNginx"`
+	// Monitoring agents.
+	// +kubebuilder:default:={}
+	MonitoringAgents MonitoringAgentsAddon `json:"monitoringAgents"`
+	// Velero backup/restore addon.
+	// +kubebuilder:default:={}
+	Velero VeleroAddon `json:"velero"`
+	// Vertical Pod Autoscaler.
+	// +kubebuilder:default:={}
+	VerticalPodAutoscaler VerticalPodAutoscalerAddon `json:"verticalPodAutoscaler"`
+}
+
+type CertManagerAddon struct {
+	// Enable cert-manager.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Custom Helm values overrides.
+	// +kubebuilder:default:={}
+	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
+}
+
+type CiliumAddon struct {
+	// Custom Helm values overrides.
+	// +kubebuilder:default:={}
+	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
+}
+
+type ControlPlane struct {
+	// API Server configuration.
+	// +kubebuilder:default:={}
+	ApiServer APIServer `json:"apiServer"`
+	// Controller Manager configuration.
+	// +kubebuilder:default:={}
+	ControllerManager ControllerManager `json:"controllerManager"`
+	// Konnectivity configuration.
+	// +kubebuilder:default:={}
+	Konnectivity Konnectivity `json:"konnectivity"`
+	// Number of control-plane replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Scheduler configuration.
+	// +kubebuilder:default:={}
+	Scheduler Scheduler `json:"scheduler"`
+}
+
+type ControllerManager struct {
+	// CPU and memory resources for Controller Manager.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources"`
+	// Preset if `resources` omitted.
+	// +kubebuilder:default:="micro"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+}
+
+type CoreDNSAddon struct {
+	// Custom Helm values overrides.
+	// +kubebuilder:default:={}
+	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
+}
+
+type FluxCDAddon struct {
+	// Enable FluxCD.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Custom Helm values overrides.
+	// +kubebuilder:default:={}
+	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
+}
+
+type GPU struct {
+	// Name of GPU, such as "nvidia.com/AD102GL_L40S".
+	Name string `json:"name"`
+}
+
+type GPUOperatorAddon struct {
+	// Enable GPU Operator.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Custom Helm values overrides.
+	// +kubebuilder:default:={}
+	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
+}
+
+type GatewayAPIAddon struct {
+	// Enable Gateway API.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+}
+
+type IngressNginxAddon struct {
+	// Enable the controller (requires nodes labeled `ingress-nginx`).
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.
+	// +kubebuilder:default:="Proxied"
+	ExposeMethod IngressNginxExposeMethod `json:"exposeMethod"`
+	// Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.
+	// +kubebuilder:default:={}
+	Hosts []string `json:"hosts,omitempty"`
+	// Custom Helm values overrides.
+	// +kubebuilder:default:={}
+	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
+}
+
+type Konnectivity struct {
+	// Konnectivity Server configuration.
+	// +kubebuilder:default:={}
+	Server KonnectivityServer `json:"server"`
+}
+
+type KonnectivityServer struct {
+	// CPU and memory resources for Konnectivity.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources"`
+	// Preset if `resources` omitted.
+	// +kubebuilder:default:="micro"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+}
+
+type MonitoringAgentsAddon struct {
+	// Enable monitoring agents.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Custom Helm values overrides.
+	// +kubebuilder:default:={}
+	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
+}
+
+type NodeGroup struct {
+	// Ephemeral storage size.
+	// +kubebuilder:default:="20Gi"
+	EphemeralStorage resource.Quantity `json:"ephemeralStorage"`
+	// List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).
+	Gpus []GPU `json:"gpus,omitempty"`
+	// Virtual machine instance type.
+	// +kubebuilder:default:="u1.medium"
+	InstanceType string `json:"instanceType"`
+	// Maximum number of replicas.
+	// +kubebuilder:default:=10
+	MaxReplicas int `json:"maxReplicas"`
+	// Minimum number of replicas.
+	// +kubebuilder:default:=0
+	MinReplicas int `json:"minReplicas"`
+	// CPU and memory resources for each worker node.
+	Resources Resources `json:"resources"`
+	// List of node roles.
+	Roles []string `json:"roles,omitempty"`
+}
+
+type Resources struct {
+	// CPU available.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type Scheduler struct {
+	// CPU and memory resources for Scheduler.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources"`
+	// Preset if `resources` omitted.
+	// +kubebuilder:default:="micro"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+}
+
+type VeleroAddon struct {
+	// Enable Velero.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Custom Helm values overrides.
+	// +kubebuilder:default:={}
+	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
+}
+
+type VerticalPodAutoscalerAddon struct {
+	// Custom Helm values overrides.
+	// +kubebuilder:default:={}
+	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
+}
+
+// +kubebuilder:validation:Enum="Proxied";"LoadBalancer"
+type IngressNginxExposeMethod string
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
+
+// +kubebuilder:validation:Enum="v1.35";"v1.34";"v1.33";"v1.32";"v1.31";"v1.30"
+type Version string
diff --git a/api/apps/v1alpha1/mariadb/types.go b/api/apps/v1alpha1/mariadb/types.go
new file mode 100644
index 00000000..5520b5ed
--- /dev/null
+++ b/api/apps/v1alpha1/mariadb/types.go
@@ -0,0 +1,111 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package mariadb
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Backup configuration.
+	// +kubebuilder:default:={}
+	Backup Backup `json:"backup"`
+	// Databases configuration map.
+	// +kubebuilder:default:={}
+	Databases map[string]Database `json:"databases,omitempty"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Number of MariaDB replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each MariaDB replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Persistent Volume Claim size available for application data.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+	// MariaDB major.minor version to deploy
+	// +kubebuilder:default:="v11.8"
+	Version Version `json:"version"`
+}
+
+type Backup struct {
+	// Retention strategy for cleaning up old backups.
+	// +kubebuilder:default:="--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
+	CleanupStrategy string `json:"cleanupStrategy"`
+	// Enable regular backups (default: false).
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Password for Restic backup encryption.
+	// +kubebuilder:default:="<password>"
+	ResticPassword string `json:"resticPassword"`
+	// Access key for S3 authentication.
+	// +kubebuilder:default:="<your-access-key>"
+	S3AccessKey string `json:"s3AccessKey"`
+	// S3 bucket used for storing backups.
+	// +kubebuilder:default:="s3.example.org/mariadb-backups"
+	S3Bucket string `json:"s3Bucket"`
+	// AWS S3 region where backups are stored.
+	// +kubebuilder:default:="us-east-1"
+	S3Region string `json:"s3Region"`
+	// Secret key for S3 authentication.
+	// +kubebuilder:default:="<your-secret-key>"
+	S3SecretKey string `json:"s3SecretKey"`
+	// Cron schedule for automated backups.
+	// +kubebuilder:default:="0 2 * * *"
+	Schedule string `json:"schedule"`
+}
+
+type Database struct {
+	// Roles assigned to users.
+	Roles DatabaseRoles `json:"roles,omitempty"`
+}
+
+type DatabaseRoles struct {
+	// List of users with admin privileges.
+	Admin []string `json:"admin,omitempty"`
+	// List of users with read-only privileges.
+	Readonly []string `json:"readonly,omitempty"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type User struct {
+	// Maximum number of connections.
+	MaxUserConnections int `json:"maxUserConnections"`
+	// Password for the user.
+	Password string `json:"password"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
+
+// +kubebuilder:validation:Enum="v11.8";"v11.4";"v10.11";"v10.6"
+type Version string
diff --git a/api/apps/v1alpha1/mongodb/types.go b/api/apps/v1alpha1/mongodb/types.go
new file mode 100644
index 00000000..14564f7d
--- /dev/null
+++ b/api/apps/v1alpha1/mongodb/types.go
@@ -0,0 +1,151 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package mongodb
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Backup configuration.
+	// +kubebuilder:default:={}
+	Backup Backup `json:"backup"`
+	// Bootstrap configuration.
+	// +kubebuilder:default:={}
+	Bootstrap Bootstrap `json:"bootstrap"`
+	// Databases configuration map.
+	// +kubebuilder:default:={}
+	Databases map[string]Database `json:"databases,omitempty"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Number of MongoDB replicas in replica set.
+	// +kubebuilder:default:=3
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each MongoDB replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="small"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Enable sharded cluster mode. When disabled, deploys a replica set.
+	// +kubebuilder:default:=false
+	Sharding bool `json:"sharding"`
+	// Configuration for sharded cluster mode.
+	// +kubebuilder:default:={}
+	ShardingConfig ShardingConfig `json:"shardingConfig"`
+	// Persistent Volume Claim size available for application data.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+	// MongoDB major version to deploy.
+	// +kubebuilder:default:="v8"
+	Version Version `json:"version"`
+}
+
+type Backup struct {
+	// Destination path for backups (e.g. s3://bucket/path/).
+	// +kubebuilder:default:="s3://bucket/path/to/folder/"
+	DestinationPath string `json:"destinationPath,omitempty"`
+	// Enable regular backups.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// S3 endpoint URL for uploads.
+	// +kubebuilder:default:="http://minio-gateway-service:9000"
+	EndpointURL string `json:"endpointURL,omitempty"`
+	// Retention policy (e.g. "30d").
+	// +kubebuilder:default:="30d"
+	RetentionPolicy string `json:"retentionPolicy,omitempty"`
+	// Access key for S3 authentication.
+	// +kubebuilder:default:=""
+	S3AccessKey string `json:"s3AccessKey,omitempty"`
+	// Secret key for S3 authentication.
+	// +kubebuilder:default:=""
+	S3SecretKey string `json:"s3SecretKey,omitempty"`
+	// Cron schedule for automated backups.
+	// +kubebuilder:default:="0 2 * * *"
+	Schedule string `json:"schedule,omitempty"`
+}
+
+type Bootstrap struct {
+	// Name of backup to restore from.
+	// +kubebuilder:default:=""
+	BackupName string `json:"backupName"`
+	// Whether to restore from a backup.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Timestamp for point-in-time recovery; empty means latest.
+	// +kubebuilder:default:=""
+	RecoveryTime string `json:"recoveryTime,omitempty"`
+}
+
+type Database struct {
+	// Roles assigned to users.
+	Roles DatabaseRoles `json:"roles,omitempty"`
+}
+
+type DatabaseRoles struct {
+	// List of users with admin privileges (readWrite + dbAdmin).
+	Admin []string `json:"admin,omitempty"`
+	// List of users with read-only privileges.
+	Readonly []string `json:"readonly,omitempty"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type Shard struct {
+	// Shard name.
+	Name string `json:"name"`
+	// Number of replicas in this shard.
+	Replicas int `json:"replicas"`
+	// PVC size for this shard.
+	Size resource.Quantity `json:"size"`
+}
+
+type ShardingConfig struct {
+	// PVC size for config servers.
+	// +kubebuilder:default:="3Gi"
+	ConfigServerSize resource.Quantity `json:"configServerSize"`
+	// Number of config server replicas.
+	// +kubebuilder:default:=3
+	ConfigServers int `json:"configServers"`
+	// Number of mongos router replicas.
+	// +kubebuilder:default:=2
+	Mongos int `json:"mongos"`
+	// List of shard configurations.
+	// +kubebuilder:default:={{"name":"rs0","replicas":3,"size":"10Gi"}}
+	Shards []Shard `json:"shards,omitempty"`
+}
+
+type User struct {
+	// Password for the user (auto-generated if omitted).
+	Password string `json:"password,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
+
+// +kubebuilder:validation:Enum="v8";"v7";"v6"
+type Version string
diff --git a/api/apps/v1alpha1/nats/types.go b/api/apps/v1alpha1/nats/types.go
new file mode 100644
index 00000000..449ac20a
--- /dev/null
+++ b/api/apps/v1alpha1/nats/types.go
@@ -0,0 +1,80 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package nats
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	k8sRuntime "k8s.io/apimachinery/pkg/runtime"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// NATS configuration.
+	// +kubebuilder:default:={}
+	Config ValuesConfig `json:"config"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Jetstream configuration.
+	// +kubebuilder:default:={}
+	Jetstream Jetstream `json:"jetstream"`
+	// Number of replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each NATS replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+}
+
+type ValuesConfig struct {
+	// Additional configuration to merge into NATS config.
+	// +kubebuilder:default:={}
+	Merge *k8sRuntime.RawExtension `json:"merge,omitempty"`
+	// Additional resolver configuration to merge into NATS config.
+	// +kubebuilder:default:={}
+	Resolver *k8sRuntime.RawExtension `json:"resolver,omitempty"`
+}
+
+type Jetstream struct {
+	// Enable or disable Jetstream for persistent messaging in NATS.
+	// +kubebuilder:default:=true
+	Enabled bool `json:"enabled"`
+	// Jetstream persistent storage size.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type User struct {
+	// Password for the user.
+	Password string `json:"password,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
diff --git a/api/apps/v1alpha1/openbao/types.go b/api/apps/v1alpha1/openbao/types.go
new file mode 100644
index 00000000..43400e18
--- /dev/null
+++ b/api/apps/v1alpha1/openbao/types.go
@@ -0,0 +1,53 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package openbao
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas > 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration.
+	// +kubebuilder:default:=1
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each OpenBAO replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="small"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Persistent Volume Claim size for data storage.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+	// Enable the OpenBAO web UI.
+	// +kubebuilder:default:=true
+	Ui bool `json:"ui"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
diff --git a/api/apps/v1alpha1/postgresql/types.go b/api/apps/v1alpha1/postgresql/types.go
new file mode 100644
index 00000000..55c73310
--- /dev/null
+++ b/api/apps/v1alpha1/postgresql/types.go
@@ -0,0 +1,152 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package postgresql
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Backup configuration.
+	// +kubebuilder:default:={}
+	Backup Backup `json:"backup"`
+	// Bootstrap configuration.
+	// +kubebuilder:default:={}
+	Bootstrap Bootstrap `json:"bootstrap"`
+	// Databases configuration map.
+	// +kubebuilder:default:={}
+	Databases map[string]Database `json:"databases,omitempty"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// PostgreSQL server configuration.
+	// +kubebuilder:default:={}
+	Postgresql PostgreSQL `json:"postgresql"`
+	// Quorum configuration for synchronous replication.
+	// +kubebuilder:default:={}
+	Quorum Quorum `json:"quorum"`
+	// Number of Postgres replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each PostgreSQL replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="micro"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Persistent Volume Claim size available for application data.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+	// PostgreSQL major version to deploy
+	// +kubebuilder:default:="v18"
+	Version Version `json:"version"`
+}
+
+type Backup struct {
+	// Destination path for backups (e.g. s3://bucket/path/).
+	// +kubebuilder:default:="s3://bucket/path/to/folder/"
+	DestinationPath string `json:"destinationPath,omitempty"`
+	// Enable regular backups.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// S3 endpoint URL for uploads.
+	// +kubebuilder:default:="http://minio-gateway-service:9000"
+	EndpointURL string `json:"endpointURL,omitempty"`
+	// Retention policy (e.g. "30d").
+	// +kubebuilder:default:="30d"
+	RetentionPolicy string `json:"retentionPolicy,omitempty"`
+	// Access key for S3 authentication.
+	// +kubebuilder:default:="<your-access-key>"
+	S3AccessKey string `json:"s3AccessKey,omitempty"`
+	// Secret key for S3 authentication.
+	// +kubebuilder:default:="<your-secret-key>"
+	S3SecretKey string `json:"s3SecretKey,omitempty"`
+	// Cron schedule for automated backups.
+	// +kubebuilder:default:="0 2 * * * *"
+	Schedule string `json:"schedule,omitempty"`
+}
+
+type Bootstrap struct {
+	// Whether to restore from a backup.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Previous cluster name before deletion.
+	// +kubebuilder:default:=""
+	OldName string `json:"oldName"`
+	// Timestamp (RFC3339) for point-in-time recovery; empty means latest.
+	// +kubebuilder:default:=""
+	RecoveryTime string `json:"recoveryTime,omitempty"`
+}
+
+type Database struct {
+	// List of enabled PostgreSQL extensions.
+	Extensions []string `json:"extensions,omitempty"`
+	// Roles assigned to users.
+	Roles DatabaseRoles `json:"roles,omitempty"`
+}
+
+type DatabaseRoles struct {
+	// List of users with admin privileges.
+	Admin []string `json:"admin,omitempty"`
+	// List of users with read-only privileges.
+	Readonly []string `json:"readonly,omitempty"`
+}
+
+type PostgreSQL struct {
+	// PostgreSQL server parameters.
+	// +kubebuilder:default:={}
+	Parameters PostgreSQLParameters `json:"parameters,omitempty"`
+}
+
+type PostgreSQLParameters struct {
+	// Maximum number of concurrent connections to the database server.
+	// +kubebuilder:default:=100
+	MaxConnections int `json:"max_connections,omitempty"`
+}
+
+type Quorum struct {
+	// Maximum number of synchronous replicas allowed (must be less than total replicas).
+	// +kubebuilder:default:=0
+	MaxSyncReplicas int `json:"maxSyncReplicas"`
+	// Minimum number of synchronous replicas required for commit.
+	// +kubebuilder:default:=0
+	MinSyncReplicas int `json:"minSyncReplicas"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type User struct {
+	// Password for the user.
+	Password string `json:"password,omitempty"`
+	// Whether the user has replication privileges.
+	Replication bool `json:"replication,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
+
+// +kubebuilder:validation:Enum="v18";"v17";"v16";"v15";"v14";"v13"
+type Version string
diff --git a/api/apps/v1alpha1/qdrant/types.go b/api/apps/v1alpha1/qdrant/types.go
new file mode 100644
index 00000000..d2735ce4
--- /dev/null
+++ b/api/apps/v1alpha1/qdrant/types.go
@@ -0,0 +1,50 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package qdrant
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Number of Qdrant replicas. Cluster mode is automatically enabled when replicas > 1.
+	// +kubebuilder:default:=1
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each Qdrant replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="small"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Persistent Volume Claim size available for vector data storage.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
diff --git a/api/apps/v1alpha1/rabbitmq/types.go b/api/apps/v1alpha1/rabbitmq/types.go
new file mode 100644
index 00000000..1524455b
--- /dev/null
+++ b/api/apps/v1alpha1/rabbitmq/types.go
@@ -0,0 +1,79 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package rabbitmq
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Number of RabbitMQ replicas.
+	// +kubebuilder:default:=3
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each RabbitMQ replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Persistent Volume Claim size available for application data.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+	// RabbitMQ major.minor version to deploy
+	// +kubebuilder:default:="v4.2"
+	Version Version `json:"version"`
+	// Virtual hosts configuration map.
+	// +kubebuilder:default:={}
+	Vhosts map[string]Vhost `json:"vhosts,omitempty"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type Roles struct {
+	// List of admin users.
+	Admin []string `json:"admin,omitempty"`
+	// List of readonly users.
+	Readonly []string `json:"readonly,omitempty"`
+}
+
+type User struct {
+	// Password for the user.
+	Password string `json:"password,omitempty"`
+}
+
+type Vhost struct {
+	// Virtual host roles list.
+	Roles Roles `json:"roles"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
+
+// +kubebuilder:validation:Enum="v4.2";"v4.1";"v4.0";"v3.13"
+type Version string
diff --git a/api/apps/v1alpha1/redis/types.go b/api/apps/v1alpha1/redis/types.go
new file mode 100644
index 00000000..8f0fcbd4
--- /dev/null
+++ b/api/apps/v1alpha1/redis/types.go
@@ -0,0 +1,59 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package redis
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Enable password generation.
+	// +kubebuilder:default:=true
+	AuthEnabled bool `json:"authEnabled"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Number of Redis replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each Redis replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Persistent Volume Claim size available for application data.
+	// +kubebuilder:default:="1Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+	// Redis major version to deploy
+	// +kubebuilder:default:="v8"
+	Version Version `json:"version"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
+
+// +kubebuilder:validation:Enum="v8";"v7"
+type Version string
diff --git a/api/apps/v1alpha1/tcpbalancer/types.go b/api/apps/v1alpha1/tcpbalancer/types.go
new file mode 100644
index 00000000..45657fc0
--- /dev/null
+++ b/api/apps/v1alpha1/tcpbalancer/types.go
@@ -0,0 +1,77 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package tcpbalancer
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// HTTP and HTTPS configuration.
+	// +kubebuilder:default:={}
+	HttpAndHttps HttpAndHttps `json:"httpAndHttps"`
+	// Number of HAProxy replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each TCP Balancer replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// List of allowed client networks.
+	// +kubebuilder:default:={}
+	Whitelist []string `json:"whitelist,omitempty"`
+	// Secure HTTP by whitelisting client networks (default: false).
+	// +kubebuilder:default:=false
+	WhitelistHTTP bool `json:"whitelistHTTP"`
+}
+
+type HttpAndHttps struct {
+	// Endpoint addresses list.
+	// +kubebuilder:default:={}
+	Endpoints []string `json:"endpoints,omitempty"`
+	// Mode for balancer.
+	// +kubebuilder:default:="tcp"
+	Mode Mode `json:"mode"`
+	// Target ports configuration.
+	// +kubebuilder:default:={}
+	TargetPorts TargetPorts `json:"targetPorts"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type TargetPorts struct {
+	// HTTP port number.
+	// +kubebuilder:default:=80
+	Http int `json:"http"`
+	// HTTPS port number.
+	// +kubebuilder:default:=443
+	Https int `json:"https"`
+}
+
+// +kubebuilder:validation:Enum="tcp";"tcp-with-proxy"
+type Mode string
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
diff --git a/api/apps/v1alpha1/tenant/types.go b/api/apps/v1alpha1/tenant/types.go
new file mode 100644
index 00000000..a193c2c6
--- /dev/null
+++ b/api/apps/v1alpha1/tenant/types.go
@@ -0,0 +1,40 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package tenant
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Deploy own Etcd cluster.
+	// +kubebuilder:default:=false
+	Etcd bool `json:"etcd"`
+	// The hostname used to access tenant services (defaults to using the tenant name as a subdomain for its parent tenant host).
+	// +kubebuilder:default:=""
+	Host string `json:"host,omitempty"`
+	// Deploy own Ingress Controller.
+	// +kubebuilder:default:=false
+	Ingress bool `json:"ingress"`
+	// Deploy own Monitoring Stack.
+	// +kubebuilder:default:=false
+	Monitoring bool `json:"monitoring"`
+	// Define resource quotas for the tenant.
+	// +kubebuilder:default:={}
+	ResourceQuotas map[string]resource.Quantity `json:"resourceQuotas,omitempty"`
+	// Deploy own SeaweedFS.
+	// +kubebuilder:default:=false
+	Seaweedfs bool `json:"seaweedfs"`
+}
diff --git a/api/apps/v1alpha1/vmdisk/types.go b/api/apps/v1alpha1/vmdisk/types.go
new file mode 100644
index 00000000..fdbcd47f
--- /dev/null
+++ b/api/apps/v1alpha1/vmdisk/types.go
@@ -0,0 +1,56 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package vmdisk
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Defines if disk should be considered optical.
+	// +kubebuilder:default:=false
+	Optical bool `json:"optical"`
+	// The source image location used to create a disk.
+	// +kubebuilder:default:={}
+	Source Source `json:"source"`
+	// The size of the disk allocated for the virtual machine.
+	// +kubebuilder:default:="5Gi"
+	Storage resource.Quantity `json:"storage"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:="replicated"
+	StorageClass string `json:"storageClass"`
+}
+
+type Source struct {
+	// Download image from an HTTP source.
+	Http *SourceHTTP `json:"http,omitempty"`
+	// Use image by name.
+	Image *SourceImage `json:"image,omitempty"`
+	// Upload local image.
+	Upload *SourceUpload `json:"upload,omitempty"`
+}
+
+type SourceHTTP struct {
+	// URL to download the image.
+	Url string `json:"url"`
+}
+
+type SourceImage struct {
+	// Name of the image to use (uploaded as "golden image" or from the list: `ubuntu`, `fedora`, `cirros`, `alpine`, `talos`).
+	Name string `json:"name"`
+}
+
+type SourceUpload struct {
+}
diff --git a/api/apps/v1alpha1/vminstance/types.go b/api/apps/v1alpha1/vminstance/types.go
new file mode 100644
index 00000000..491a2b30
--- /dev/null
+++ b/api/apps/v1alpha1/vminstance/types.go
@@ -0,0 +1,96 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package vminstance
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Cloud-init user data.
+	// +kubebuilder:default:=""
+	CloudInit string `json:"cloudInit"`
+	// Seed string to generate SMBIOS UUID for the VM.
+	// +kubebuilder:default:=""
+	CloudInitSeed string `json:"cloudInitSeed"`
+	// Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map
+	// +kubebuilder:default:=""
+	CpuModel string `json:"cpuModel"`
+	// List of disks to attach.
+	// +kubebuilder:default:={}
+	Disks []Disk `json:"disks,omitempty"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Method to pass through traffic to the VM.
+	// +kubebuilder:default:="PortList"
+	ExternalMethod ExternalMethod `json:"externalMethod"`
+	// Ports to forward from outside the cluster.
+	// +kubebuilder:default:={22}
+	ExternalPorts []int `json:"externalPorts,omitempty"`
+	// List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).
+	// +kubebuilder:default:={}
+	Gpus []GPU `json:"gpus,omitempty"`
+	// Virtual Machine preferences profile.
+	// +kubebuilder:default:="ubuntu"
+	InstanceProfile string `json:"instanceProfile"`
+	// Virtual Machine instance type.
+	// +kubebuilder:default:="u1.medium"
+	InstanceType string `json:"instanceType"`
+	// Resource configuration for the virtual machine.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Requested running state of the VirtualMachineInstance
+	// +kubebuilder:default:="Always"
+	RunStrategy RunStrategy `json:"runStrategy"`
+	// List of SSH public keys for authentication.
+	// +kubebuilder:default:={}
+	SshKeys []string `json:"sshKeys,omitempty"`
+	// Additional subnets
+	// +kubebuilder:default:={}
+	Subnets []Subnet `json:"subnets,omitempty"`
+}
+
+type Disk struct {
+	// Disk bus type (e.g. "sata").
+	Bus string `json:"bus,omitempty"`
+	// Disk name.
+	Name string `json:"name"`
+}
+
+type GPU struct {
+	// The name of the GPU resource to attach.
+	Name string `json:"name"`
+}
+
+type Resources struct {
+	// Number of CPU cores allocated.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Amount of memory allocated.
+	Memory resource.Quantity `json:"memory,omitempty"`
+	// Number of CPU sockets (vCPU topology).
+	Sockets resource.Quantity `json:"sockets,omitempty"`
+}
+
+type Subnet struct {
+	// Subnet name
+	Name string `json:"name,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="PortList";"WholeIP"
+type ExternalMethod string
+
+// +kubebuilder:validation:Enum="Always";"Halted";"Manual";"RerunOnFailure";"Once"
+type RunStrategy string
diff --git a/api/apps/v1alpha1/vpc/types.go b/api/apps/v1alpha1/vpc/types.go
new file mode 100644
index 00000000..6b216044
--- /dev/null
+++ b/api/apps/v1alpha1/vpc/types.go
@@ -0,0 +1,31 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package vpc
+
+import (
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Subnets of a VPC
+	// +kubebuilder:default:={}
+	Subnets []Subnet `json:"subnets,omitempty"`
+}
+
+type Subnet struct {
+	// IP address range
+	Cidr string `json:"cidr,omitempty"`
+	// Subnet name
+	Name string `json:"name"`
+}
diff --git a/api/apps/v1alpha1/vpn/types.go b/api/apps/v1alpha1/vpn/types.go
new file mode 100644
index 00000000..fbada3e8
--- /dev/null
+++ b/api/apps/v1alpha1/vpn/types.go
@@ -0,0 +1,58 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package vpn
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// List of externalIPs for service. Optional. If not specified, will use LoadBalancer service by default.
+	// +kubebuilder:default:={}
+	ExternalIPs []string `json:"externalIPs,omitempty"`
+	// Host used to substitute into generated URLs.
+	// +kubebuilder:default:=""
+	Host string `json:"host"`
+	// Number of VPN server replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each VPN server replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type User struct {
+	// Password for the user (autogenerated if not provided).
+	Password string `json:"password,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh
index 6a6fc3be..cbf4bedc 100755
--- a/hack/update-codegen.sh
+++ b/hack/update-codegen.sh
@@ -68,7 +68,7 @@ kube::codegen::gen_client \
     "${SCRIPT_ROOT}/pkg/apis"
 
 $CONTROLLER_GEN object:headerFile="hack/boilerplate.go.txt" paths="./api/..."
-$CONTROLLER_GEN rbac:roleName=manager-role crd paths="./api/..." output:crd:artifacts:config=${TMPDIR} 
+$CONTROLLER_GEN rbac:roleName=manager-role crd paths="./api/..." output:crd:artifacts:config=${TMPDIR}
 
 mv ${TMPDIR}/cozystack.io_packages.yaml ${OPERATOR_CRDDIR}/cozystack.io_packages.yaml
 mv ${TMPDIR}/cozystack.io_packagesources.yaml ${OPERATOR_CRDDIR}/cozystack.io_packagesources.yaml
@@ -80,3 +80,6 @@ mv ${TMPDIR}/backups.cozystack.io*.yaml ${BACKUPS_CORE_CRDDIR}/
 mv ${TMPDIR}/strategy.backups.cozystack.io*.yaml ${BACKUPSTRATEGY_CRDDIR}/
 
 mv ${TMPDIR}/*.yaml ${COZY_CONTROLLER_CRDDIR}/
+
+# Tidy dependencies for standalone api/apps/v1alpha1 submodule
+(cd "${SCRIPT_ROOT}/api/apps/v1alpha1" && go mod tidy)
diff --git a/packages/apps/bucket/Makefile b/packages/apps/bucket/Makefile
index d1cfda8e..1e35bd53 100644
--- a/packages/apps/bucket/Makefile
+++ b/packages/apps/bucket/Makefile
@@ -1,5 +1,5 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'bucket' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/bucket/types.go
 	../../../hack/update-crd.sh
diff --git a/packages/apps/clickhouse/Makefile b/packages/apps/clickhouse/Makefile
index 2c77add9..2d671d1d 100644
--- a/packages/apps/clickhouse/Makefile
+++ b/packages/apps/clickhouse/Makefile
@@ -4,7 +4,7 @@ include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'clickhouse' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/clickhouse/types.go
 	../../../hack/update-crd.sh
 
 image:
diff --git a/packages/apps/foundationdb/Makefile b/packages/apps/foundationdb/Makefile
index 76c84980..1a07cd5b 100644
--- a/packages/apps/foundationdb/Makefile
+++ b/packages/apps/foundationdb/Makefile
@@ -1,4 +1,4 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
\ No newline at end of file
+	cozyvalues-gen -m 'foundationdb' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/foundationdb/types.go
\ No newline at end of file
diff --git a/packages/apps/harbor/Makefile b/packages/apps/harbor/Makefile
index f0ce9944..43c25998 100644
--- a/packages/apps/harbor/Makefile
+++ b/packages/apps/harbor/Makefile
@@ -3,5 +3,5 @@ NAME=harbor
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'harbor' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/harbor/types.go
 	../../../hack/update-crd.sh
diff --git a/packages/apps/http-cache/Makefile b/packages/apps/http-cache/Makefile
index 2cc11f87..899f0288 100644
--- a/packages/apps/http-cache/Makefile
+++ b/packages/apps/http-cache/Makefile
@@ -17,7 +17,7 @@ image-nginx:
 	rm -f images/nginx-cache.json
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'httpcache' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/httpcache/types.go
 	../../../hack/update-crd.sh
 
 update:
diff --git a/packages/apps/kafka/Makefile b/packages/apps/kafka/Makefile
index 2cffdfa7..c1084e86 100644
--- a/packages/apps/kafka/Makefile
+++ b/packages/apps/kafka/Makefile
@@ -2,5 +2,5 @@ include ../../../hack/package.mk
 PRESET_ENUM := ["nano","micro","small","medium","large","xlarge","2xlarge"]
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'kafka' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/kafka/types.go
 	../../../hack/update-crd.sh
diff --git a/packages/apps/kubernetes/Makefile b/packages/apps/kubernetes/Makefile
index b19f624d..01cf736d 100644
--- a/packages/apps/kubernetes/Makefile
+++ b/packages/apps/kubernetes/Makefile
@@ -5,7 +5,7 @@ include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'kubernetes' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/kubernetes/types.go
 	../../../hack/update-crd.sh
 
 update:
diff --git a/packages/apps/mariadb/Makefile b/packages/apps/mariadb/Makefile
index e8f02703..9833f302 100644
--- a/packages/apps/mariadb/Makefile
+++ b/packages/apps/mariadb/Makefile
@@ -4,7 +4,7 @@ include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'mariadb' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/mariadb/types.go
 	../../../hack/update-crd.sh
 
 update:
diff --git a/packages/apps/mongodb/Makefile b/packages/apps/mongodb/Makefile
index 9440c3fd..37f30ccc 100644
--- a/packages/apps/mongodb/Makefile
+++ b/packages/apps/mongodb/Makefile
@@ -3,7 +3,7 @@ include ../../../hack/package.mk
 .PHONY: generate update
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'mongodb' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/mongodb/types.go
 	../../../hack/update-crd.sh
 
 update:
diff --git a/packages/apps/nats/Makefile b/packages/apps/nats/Makefile
index d1cfda8e..29f6f9bc 100644
--- a/packages/apps/nats/Makefile
+++ b/packages/apps/nats/Makefile
@@ -1,5 +1,5 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'nats' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/nats/types.go
 	../../../hack/update-crd.sh
diff --git a/packages/apps/openbao/Makefile b/packages/apps/openbao/Makefile
index d1cfda8e..b9530139 100644
--- a/packages/apps/openbao/Makefile
+++ b/packages/apps/openbao/Makefile
@@ -1,5 +1,5 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'openbao' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/openbao/types.go
 	../../../hack/update-crd.sh
diff --git a/packages/apps/postgres/Makefile b/packages/apps/postgres/Makefile
index aa9b0ccc..dff0b9c6 100644
--- a/packages/apps/postgres/Makefile
+++ b/packages/apps/postgres/Makefile
@@ -1,7 +1,7 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'postgresql' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/postgresql/types.go
 	../../../hack/update-crd.sh
 
 update:
diff --git a/packages/apps/qdrant/Makefile b/packages/apps/qdrant/Makefile
index d1cfda8e..2110125f 100644
--- a/packages/apps/qdrant/Makefile
+++ b/packages/apps/qdrant/Makefile
@@ -1,5 +1,5 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'qdrant' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/qdrant/types.go
 	../../../hack/update-crd.sh
diff --git a/packages/apps/rabbitmq/Makefile b/packages/apps/rabbitmq/Makefile
index aa9b0ccc..9b045b66 100644
--- a/packages/apps/rabbitmq/Makefile
+++ b/packages/apps/rabbitmq/Makefile
@@ -1,7 +1,7 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'rabbitmq' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/rabbitmq/types.go
 	../../../hack/update-crd.sh
 
 update:
diff --git a/packages/apps/redis/Makefile b/packages/apps/redis/Makefile
index aa9b0ccc..939b75ee 100644
--- a/packages/apps/redis/Makefile
+++ b/packages/apps/redis/Makefile
@@ -1,7 +1,7 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'redis' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/redis/types.go
 	../../../hack/update-crd.sh
 
 update:
diff --git a/packages/apps/tcp-balancer/Makefile b/packages/apps/tcp-balancer/Makefile
index d1cfda8e..e3bf78fe 100644
--- a/packages/apps/tcp-balancer/Makefile
+++ b/packages/apps/tcp-balancer/Makefile
@@ -1,5 +1,5 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'tcpbalancer' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/tcpbalancer/types.go
 	../../../hack/update-crd.sh
diff --git a/packages/apps/tenant/Makefile b/packages/apps/tenant/Makefile
index d1cfda8e..3fe3810d 100644
--- a/packages/apps/tenant/Makefile
+++ b/packages/apps/tenant/Makefile
@@ -1,5 +1,5 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'tenant' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/tenant/types.go
 	../../../hack/update-crd.sh
diff --git a/packages/apps/vm-disk/Makefile b/packages/apps/vm-disk/Makefile
index d1cfda8e..80b1075a 100644
--- a/packages/apps/vm-disk/Makefile
+++ b/packages/apps/vm-disk/Makefile
@@ -1,5 +1,5 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'vmdisk' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/vmdisk/types.go
 	../../../hack/update-crd.sh
diff --git a/packages/apps/vm-disk/values.schema.json b/packages/apps/vm-disk/values.schema.json
index cd2215d8..1fc0370e 100644
--- a/packages/apps/vm-disk/values.schema.json
+++ b/packages/apps/vm-disk/values.schema.json
@@ -39,7 +39,8 @@
           }
         },
         "upload": {
-          "description": "Upload local image."
+          "description": "Upload local image.",
+          "type": "object"
         }
       }
     },
diff --git a/packages/apps/vm-instance/Makefile b/packages/apps/vm-instance/Makefile
index 3b6d471d..92798e4f 100644
--- a/packages/apps/vm-instance/Makefile
+++ b/packages/apps/vm-instance/Makefile
@@ -1,7 +1,7 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'vminstance' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/vminstance/types.go
 	#INSTANCE_TYPES=$$(yq e '.metadata.name' -o=json -r ../../system/kubevirt-instancetypes/templates/instancetypes.yaml | yq 'split(" ") | . + [""]' -o json) \
 	#  && yq -i -o json ".properties.instanceType.enum = $${INSTANCE_TYPES}" values.schema.json
 	PREFERENCES=$$(yq e '.metadata.name' -o=json -r ../../system/kubevirt-instancetypes/templates/preferences.yaml | yq 'split(" ") | . + [""]' -o json) \
diff --git a/packages/apps/vpc/Makefile b/packages/apps/vpc/Makefile
index ea4f5d1b..2f0c193f 100644
--- a/packages/apps/vpc/Makefile
+++ b/packages/apps/vpc/Makefile
@@ -1,7 +1,7 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json
+	cozyvalues-gen -m 'vpc' -v values.yaml -s values.schema.json -g ../../../api/apps/v1alpha1/vpc/types.go
 	../../../hack/update-crd.sh
 
 update:
diff --git a/packages/apps/vpn/Makefile b/packages/apps/vpn/Makefile
index d1cfda8e..d0b8412f 100644
--- a/packages/apps/vpn/Makefile
+++ b/packages/apps/vpn/Makefile
@@ -1,5 +1,5 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'vpn' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/vpn/types.go
 	../../../hack/update-crd.sh
diff --git a/packages/system/vm-disk-rd/cozyrds/vm-disk.yaml b/packages/system/vm-disk-rd/cozyrds/vm-disk.yaml
index 93f8956f..b02797d8 100644
--- a/packages/system/vm-disk-rd/cozyrds/vm-disk.yaml
+++ b/packages/system/vm-disk-rd/cozyrds/vm-disk.yaml
@@ -8,7 +8,7 @@ spec:
     singular: vmdisk
     plural: vmdisks
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"optical":{"description":"Defines if disk should be considered optical.","type":"boolean","default":false},"source":{"description":"The source image location used to create a disk.","type":"object","default":{},"properties":{"http":{"description":"Download image from an HTTP source.","type":"object","required":["url"],"properties":{"url":{"description":"URL to download the image.","type":"string"}}},"image":{"description":"Use image by name.","type":"object","required":["name"],"properties":{"name":{"description":"Name of the image to use (uploaded as \"golden image\" or from the list: `ubuntu`, `fedora`, `cirros`, `alpine`, `talos`).","type":"string"}}},"upload":{"description":"Upload local image."}}},"storage":{"description":"The size of the disk allocated for the virtual machine.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"}}}
+      {"title":"Chart Values","type":"object","properties":{"optical":{"description":"Defines if disk should be considered optical.","type":"boolean","default":false},"source":{"description":"The source image location used to create a disk.","type":"object","default":{},"properties":{"http":{"description":"Download image from an HTTP source.","type":"object","required":["url"],"properties":{"url":{"description":"URL to download the image.","type":"string"}}},"image":{"description":"Use image by name.","type":"object","required":["name"],"properties":{"name":{"description":"Name of the image to use (uploaded as \"golden image\" or from the list: `ubuntu`, `fedora`, `cirros`, `alpine`, `talos`).","type":"string"}}},"upload":{"description":"Upload local image.","type":"object"}}},"storage":{"description":"The size of the disk allocated for the virtual machine.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"}}}
   release:
     prefix: vm-disk-
     labels:

From 9ef0e2ceeb8ac13cdf9e54fe5e373080120a790c Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 16 Mar 2026 14:12:43 +0500
Subject: [PATCH 328/666] [docs] Added openapi generation tool

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 Makefile                   |   6 +-
 hack/upload-assets.sh      |   1 +
 pkg/apiserver/apiserver.go |  12 +-
 pkg/cmd/server/openapi.go  |  40 +++++-
 pkg/cmd/server/start.go    |  25 +---
 tools/openapi-gen/main.go  | 247 +++++++++++++++++++++++++++++++++++++
 6 files changed, 302 insertions(+), 29 deletions(-)
 create mode 100644 tools/openapi-gen/main.go

diff --git a/Makefile b/Makefile
index ca48197c..ce6eb7b3 100644
--- a/Makefile
+++ b/Makefile
@@ -58,7 +58,11 @@ manifests:
 cozypkg:
 	go build -ldflags "-X github.com/cozystack/cozystack/cmd/cozypkg/cmd.Version=v$(COZYSTACK_VERSION)" -o _out/bin/cozypkg ./cmd/cozypkg
 
-assets: assets-talos assets-cozypkg
+assets: assets-talos assets-cozypkg openapi-json
+
+openapi-json:
+	mkdir -p _out/assets
+	VERSION=$(shell git describe --tags --always 2>/dev/null || echo dev) go run ./tools/openapi-gen/ 2>/dev/null > _out/assets/openapi.json
 
 assets-talos:
 	make -C packages/core/talos assets
diff --git a/hack/upload-assets.sh b/hack/upload-assets.sh
index f9bb7b25..2f7f9813 100755
--- a/hack/upload-assets.sh
+++ b/hack/upload-assets.sh
@@ -14,3 +14,4 @@ gh release upload --clobber $version _out/assets/kernel-amd64
 gh release upload --clobber $version _out/assets/initramfs-metal-amd64.xz
 gh release upload --clobber $version _out/assets/cozypkg-*.tar.gz
 gh release upload --clobber $version _out/assets/cozypkg-checksums.txt
+gh release upload --clobber $version _out/assets/openapi.json
diff --git a/pkg/apiserver/apiserver.go b/pkg/apiserver/apiserver.go
index bc2b4857..bf02e642 100644
--- a/pkg/apiserver/apiserver.go
+++ b/pkg/apiserver/apiserver.go
@@ -211,15 +211,21 @@ func (c completedConfig) New() (*CozyServer, error) {
 		storage := applicationstorage.NewREST(cli, watchCli, &resConfig)
 		appsV1alpha1Storage[resConfig.Application.Plural] = cozyregistry.RESTInPeace(storage)
 	}
-	appsApiGroupInfo := genericapiserver.NewDefaultAPIGroupInfo(apps.GroupName, Scheme, metav1.ParameterCodec, Codecs)
-	appsApiGroupInfo.VersionedResourcesStorageMap["v1alpha1"] = appsV1alpha1Storage
-	if err := s.GenericAPIServer.InstallAPIGroup(&appsApiGroupInfo); err != nil {
+	if err := InstallAppsAPIGroup(s.GenericAPIServer, appsV1alpha1Storage); err != nil {
 		return nil, err
 	}
 
 	return s, nil
 }
 
+// InstallAppsAPIGroup registers the apps.cozystack.io API group on the given
+// server using the provided storage map (plural name → rest.Storage).
+func InstallAppsAPIGroup(server *genericapiserver.GenericAPIServer, storage map[string]rest.Storage) error {
+	info := genericapiserver.NewDefaultAPIGroupInfo(apps.GroupName, Scheme, metav1.ParameterCodec, Codecs)
+	info.VersionedResourcesStorageMap["v1alpha1"] = storage
+	return server.InstallAPIGroup(&info)
+}
+
 func mustGetInformers(ctx context.Context, mgr ctrl.Manager, types ...client.Object) error {
 	for i := range types {
 		if _, err := mgr.GetCache().GetInformer(ctx, types[i]); err != nil {
diff --git a/pkg/cmd/server/openapi.go b/pkg/cmd/server/openapi.go
index 5d1b35db..2742f346 100644
--- a/pkg/cmd/server/openapi.go
+++ b/pkg/cmd/server/openapi.go
@@ -5,6 +5,11 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/cozystack/cozystack/pkg/apiserver"
+	"github.com/cozystack/cozystack/pkg/config"
+	sampleopenapi "github.com/cozystack/cozystack/pkg/generated/openapi"
+	"k8s.io/apiserver/pkg/endpoints/openapi"
+	genericapiserver "k8s.io/apiserver/pkg/server"
 	"k8s.io/kube-openapi/pkg/spec3"
 	"k8s.io/kube-openapi/pkg/validation/spec"
 )
@@ -210,7 +215,9 @@ func rewriteRefForKind(old, kind string) string {
 // -----------------------------------------------------------------------------
 // OpenAPI **v3** post-processor
 // -----------------------------------------------------------------------------
-func buildPostProcessV3(kindSchemas map[string]string) func(*spec3.OpenAPI) (*spec3.OpenAPI, error) {
+// BuildPostProcessV3 returns an OpenAPI v3 post-processor that clones base
+// Application schemas into per-kind schemas and rewrites $ref pointers.
+func BuildPostProcessV3(kindSchemas map[string]string) func(*spec3.OpenAPI) (*spec3.OpenAPI, error) {
 	return func(doc *spec3.OpenAPI) (*spec3.OpenAPI, error) {
 
 		if doc.Components == nil {
@@ -333,7 +340,36 @@ func sanitizeForV2(s *spec.Schema) {
 // -----------------------------------------------------------------------------
 // OpenAPI **v2** (swagger) post-processor
 // -----------------------------------------------------------------------------
-func buildPostProcessV2(kindSchemas map[string]string) func(*spec.Swagger) (*spec.Swagger, error) {
+// BuildPostProcessV2 returns a Swagger post-processor that clones base
+// Application schemas into per-kind schemas and rewrites $ref pointers.
+// KindSchemasFromConfig extracts the kind→OpenAPISchema mapping from a ResourceConfig.
+func KindSchemasFromConfig(rc *config.ResourceConfig) map[string]string {
+	m := make(map[string]string, len(rc.Resources))
+	for _, r := range rc.Resources {
+		m[r.Application.Kind] = r.Application.OpenAPISchema
+	}
+	return m
+}
+
+// ConfigureOpenAPI sets up OpenAPI v2 and v3 on a GenericAPIServer Config,
+// including the post-processors that clone Application schemas to per-kind schemas.
+func ConfigureOpenAPI(cfg *genericapiserver.Config, kindSchemas map[string]string, title, version string) {
+	cfg.OpenAPIConfig = genericapiserver.DefaultOpenAPIConfig(
+		sampleopenapi.GetOpenAPIDefinitions, openapi.NewDefinitionNamer(apiserver.Scheme),
+	)
+	cfg.OpenAPIConfig.Info.Title = title
+	cfg.OpenAPIConfig.Info.Version = version
+	cfg.OpenAPIConfig.PostProcessSpec = BuildPostProcessV2(kindSchemas)
+
+	cfg.OpenAPIV3Config = genericapiserver.DefaultOpenAPIV3Config(
+		sampleopenapi.GetOpenAPIDefinitions, openapi.NewDefinitionNamer(apiserver.Scheme),
+	)
+	cfg.OpenAPIV3Config.Info.Title = title
+	cfg.OpenAPIV3Config.Info.Version = version
+	cfg.OpenAPIV3Config.PostProcessSpec = BuildPostProcessV3(kindSchemas)
+}
+
+func BuildPostProcessV2(kindSchemas map[string]string) func(*spec.Swagger) (*spec.Swagger, error) {
 	return func(sw *spec.Swagger) (*spec.Swagger, error) {
 		defs := sw.Definitions
 		base, ok1 := defs[baseRef]
diff --git a/pkg/cmd/server/start.go b/pkg/cmd/server/start.go
index 9a688700..f7791332 100644
--- a/pkg/cmd/server/start.go
+++ b/pkg/cmd/server/start.go
@@ -31,12 +31,10 @@ import (
 	corev1alpha1 "github.com/cozystack/cozystack/pkg/apis/core/v1alpha1"
 	"github.com/cozystack/cozystack/pkg/apiserver"
 	"github.com/cozystack/cozystack/pkg/config"
-	sampleopenapi "github.com/cozystack/cozystack/pkg/generated/openapi"
 	"github.com/spf13/cobra"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	utilerrors "k8s.io/apimachinery/pkg/util/errors"
-	"k8s.io/apiserver/pkg/endpoints/openapi"
 	genericapiserver "k8s.io/apiserver/pkg/server"
 	genericoptions "k8s.io/apiserver/pkg/server/options"
 	utilfeature "k8s.io/apiserver/pkg/util/feature"
@@ -213,10 +211,6 @@ func (o *CozyServerOptions) Config() (*apiserver.Config, error) {
 
 	serverConfig := genericapiserver.NewRecommendedConfig(apiserver.Codecs)
 
-	serverConfig.OpenAPIConfig = genericapiserver.DefaultOpenAPIConfig(
-		sampleopenapi.GetOpenAPIDefinitions, openapi.NewDefinitionNamer(apiserver.Scheme),
-	)
-
 	apiVersion := "0.1"
 	if o.ResourceConfig != nil {
 		raw, err := json.Marshal(o.ResourceConfig)
@@ -227,23 +221,8 @@ func (o *CozyServerOptions) Config() (*apiserver.Config, error) {
 		apiVersion = "0.1-" + hex.EncodeToString(sum[:8])
 	}
 
-	// capture schemas from config once for fast lookup inside the closure
-	kindSchemas := map[string]string{}
-	for _, r := range o.ResourceConfig.Resources {
-		kindSchemas[r.Application.Kind] = r.Application.OpenAPISchema
-	}
-
-	serverConfig.OpenAPIConfig.Info.Title = "Cozy"
-	serverConfig.OpenAPIConfig.Info.Version = apiVersion
-	serverConfig.OpenAPIConfig.PostProcessSpec = buildPostProcessV2(kindSchemas)
-
-	serverConfig.OpenAPIV3Config = genericapiserver.DefaultOpenAPIV3Config(
-		sampleopenapi.GetOpenAPIDefinitions, openapi.NewDefinitionNamer(apiserver.Scheme),
-	)
-	serverConfig.OpenAPIV3Config.Info.Title = "Cozy"
-	serverConfig.OpenAPIV3Config.Info.Version = apiVersion
-
-	serverConfig.OpenAPIV3Config.PostProcessSpec = buildPostProcessV3(kindSchemas)
+	kindSchemas := KindSchemasFromConfig(o.ResourceConfig)
+	ConfigureOpenAPI(&serverConfig.Config, kindSchemas, "Cozy", apiVersion)
 
 	// Set FeatureGate and EffectiveVersion - required for Complete() in Kubernetes v0.34.1
 	// Following the pattern from sample-apiserver, but creating EffectiveVersion directly
diff --git a/tools/openapi-gen/main.go b/tools/openapi-gen/main.go
new file mode 100644
index 00000000..74b23b2b
--- /dev/null
+++ b/tools/openapi-gen/main.go
@@ -0,0 +1,247 @@
+// Copyright 2024 The Cozystack Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Command openapi-gen assembles the OpenAPI v3 spec for apps.cozystack.io by
+// spinning up an in-process Kubernetes API server with stub storage, so the
+// framework generates the exact same paths and schemas as the real server.
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+
+	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+	appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
+	"github.com/cozystack/cozystack/pkg/apiserver"
+	cozyserver "github.com/cozystack/cozystack/pkg/cmd/server"
+	"github.com/cozystack/cozystack/pkg/config"
+	sampleopenapi "github.com/cozystack/cozystack/pkg/generated/openapi"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	metainternalversion "k8s.io/apimachinery/pkg/apis/meta/internalversion"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/apiserver/pkg/endpoints/openapi"
+	"k8s.io/apiserver/pkg/registry/rest"
+	genericapiserver "k8s.io/apiserver/pkg/server"
+	utilfeature "k8s.io/apiserver/pkg/util/feature"
+	restclient "k8s.io/client-go/rest"
+	basecompatibility "k8s.io/component-base/compatibility"
+	baseversion "k8s.io/component-base/version"
+	"sigs.k8s.io/yaml"
+)
+
+func main() {
+	if err := run(); err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+func run() error {
+	// Find all ApplicationDefinition YAML files
+	pattern := "packages/system/*-rd/cozyrds/*.yaml"
+	matches, err := filepath.Glob(pattern)
+	if err != nil {
+		return fmt.Errorf("glob %q: %w", pattern, err)
+	}
+	if len(matches) == 0 {
+		return fmt.Errorf("no files matched %q — run from repo root", pattern)
+	}
+
+	// Parse ApplicationDefinitions and build ResourceConfig
+	var resources []config.Resource
+	for _, path := range matches {
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return fmt.Errorf("read %s: %w", path, err)
+		}
+		var appDef cozyv1alpha1.ApplicationDefinition
+		if err := yaml.Unmarshal(data, &appDef); err != nil {
+			return fmt.Errorf("parse %s: %w", path, err)
+		}
+		if appDef.Spec.Application.Kind == "" {
+			continue
+		}
+		resources = append(resources, config.Resource{
+			Application: config.ApplicationConfig{
+				Kind:          appDef.Spec.Application.Kind,
+				Singular:      appDef.Spec.Application.Singular,
+				Plural:        appDef.Spec.Application.Plural,
+				OpenAPISchema: appDef.Spec.Application.OpenAPISchema,
+			},
+		})
+	}
+
+	if len(resources) == 0 {
+		return fmt.Errorf("no ApplicationDefinitions found")
+	}
+
+	resourceConfig := &config.ResourceConfig{Resources: resources}
+
+	// Register dynamic types in the apiserver scheme (same as the real server)
+	if err := appsv1alpha1.RegisterDynamicTypes(apiserver.Scheme, resourceConfig); err != nil {
+		return fmt.Errorf("register dynamic types: %w", err)
+	}
+
+	version := os.Getenv("VERSION")
+	if version == "" {
+		version = "dev"
+	}
+
+	// Create a minimal GenericAPIServer config
+	serverConfig := genericapiserver.NewConfig(apiserver.Codecs)
+	serverConfig.ExternalAddress = "localhost:443"
+	serverConfig.LoopbackClientConfig = &restclient.Config{}
+	serverConfig.FeatureGate = utilfeature.DefaultMutableFeatureGate
+	if baseversion.DefaultKubeBinaryVersion != "" {
+		serverConfig.EffectiveVersion = basecompatibility.NewEffectiveVersionFromString(baseversion.DefaultKubeBinaryVersion, "", "")
+	}
+
+	// OpenAPI v3 only — the v2 config is required by the framework but we only extract v3.
+	kindSchemas := cozyserver.KindSchemasFromConfig(resourceConfig)
+	serverConfig.OpenAPIConfig = genericapiserver.DefaultOpenAPIConfig(
+		sampleopenapi.GetOpenAPIDefinitions, openapi.NewDefinitionNamer(apiserver.Scheme),
+	)
+	serverConfig.OpenAPIV3Config = genericapiserver.DefaultOpenAPIV3Config(
+		sampleopenapi.GetOpenAPIDefinitions, openapi.NewDefinitionNamer(apiserver.Scheme),
+	)
+	serverConfig.OpenAPIV3Config.Info.Title = "Cozystack apps.cozystack.io API"
+	serverConfig.OpenAPIV3Config.Info.Version = version
+	serverConfig.OpenAPIV3Config.PostProcessSpec = cozyserver.BuildPostProcessV3(kindSchemas)
+
+	// Create the server
+	completed := serverConfig.Complete(nil)
+	server, err := completed.New("openapi-gen", genericapiserver.NewEmptyDelegate())
+	if err != nil {
+		return fmt.Errorf("create server: %w", err)
+	}
+
+	// Install apps API group with stub REST storage
+	appsStorage := map[string]rest.Storage{}
+	for _, res := range resourceConfig.Resources {
+		appsStorage[res.Application.Plural] = &stubREST{
+			gvk: schema.GroupVersion{
+				Group:   "apps.cozystack.io",
+				Version: "v1alpha1",
+			}.WithKind(res.Application.Kind),
+			singularName: res.Application.Singular,
+		}
+	}
+	if err := apiserver.InstallAppsAPIGroup(server, appsStorage); err != nil {
+		return fmt.Errorf("install apps API group: %w", err)
+	}
+
+	// PrepareRun triggers OpenAPI spec generation
+	server.PrepareRun()
+
+	// Extract the v3 spec by hitting the server's HTTP handler directly
+	v3Path := "/openapi/v3/apis/apps.cozystack.io/v1alpha1"
+	req, err := http.NewRequest("GET", v3Path, nil)
+	if err != nil {
+		return fmt.Errorf("create request: %w", err)
+	}
+	req.Header.Set("Accept", "application/json")
+	rec := httptest.NewRecorder()
+	server.Handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		return fmt.Errorf("GET %s returned %d: %s", v3Path, rec.Code, rec.Body.String())
+	}
+
+	// Pretty-print the JSON
+	var raw json.RawMessage
+	if err := json.Unmarshal(rec.Body.Bytes(), &raw); err != nil {
+		return fmt.Errorf("parse v3 response: %w", err)
+	}
+
+	enc := json.NewEncoder(os.Stdout)
+	enc.SetIndent("", "  ")
+	return enc.Encode(raw)
+}
+
+// stubREST implements the same REST interfaces as the real application.REST
+// but never handles actual requests. It exists solely so the K8s framework
+// generates the correct OpenAPI paths and schemas.
+type stubREST struct {
+	gvk          schema.GroupVersionKind
+	singularName string
+}
+
+// Compile-time interface checks — same set as the real application.REST.
+var (
+	_ rest.Getter          = &stubREST{}
+	_ rest.Lister          = &stubREST{}
+	_ rest.Creater         = &stubREST{}
+	_ rest.Updater         = &stubREST{}
+	_ rest.Patcher         = &stubREST{}
+	_ rest.GracefulDeleter = &stubREST{}
+	_ rest.Watcher         = &stubREST{}
+)
+
+func (s *stubREST) New() runtime.Object {
+	obj := &appsv1alpha1.Application{}
+	obj.TypeMeta = metav1.TypeMeta{
+		APIVersion: s.gvk.GroupVersion().String(),
+		Kind:       s.gvk.Kind,
+	}
+	return obj
+}
+
+func (s *stubREST) NewList() runtime.Object {
+	obj := &appsv1alpha1.ApplicationList{}
+	obj.TypeMeta = metav1.TypeMeta{
+		APIVersion: s.gvk.GroupVersion().String(),
+		Kind:       s.gvk.Kind + "List",
+	}
+	return obj
+}
+
+func (s *stubREST) Destroy()                              {}
+func (s *stubREST) NamespaceScoped() bool                 { return true }
+func (s *stubREST) GetSingularName() string               { return s.singularName }
+func (s *stubREST) GroupVersionKind(schema.GroupVersion) schema.GroupVersionKind { return s.gvk }
+
+func (s *stubREST) Get(_ context.Context, _ string, _ *metav1.GetOptions) (runtime.Object, error) {
+	return nil, fmt.Errorf("stub: not implemented")
+}
+
+func (s *stubREST) List(_ context.Context, _ *metainternalversion.ListOptions) (runtime.Object, error) {
+	return nil, fmt.Errorf("stub: not implemented")
+}
+
+func (s *stubREST) Create(_ context.Context, _ runtime.Object, _ rest.ValidateObjectFunc, _ *metav1.CreateOptions) (runtime.Object, error) {
+	return nil, fmt.Errorf("stub: not implemented")
+}
+
+func (s *stubREST) Update(_ context.Context, _ string, _ rest.UpdatedObjectInfo, _ rest.ValidateObjectFunc, _ rest.ValidateObjectUpdateFunc, _ bool, _ *metav1.UpdateOptions) (runtime.Object, bool, error) {
+	return nil, false, fmt.Errorf("stub: not implemented")
+}
+
+func (s *stubREST) Delete(_ context.Context, _ string, _ rest.ValidateObjectFunc, _ *metav1.DeleteOptions) (runtime.Object, bool, error) {
+	return nil, false, fmt.Errorf("stub: not implemented")
+}
+
+func (s *stubREST) Watch(_ context.Context, _ *metainternalversion.ListOptions) (watch.Interface, error) {
+	return nil, fmt.Errorf("stub: not implemented")
+}
+
+func (s *stubREST) ConvertToTable(_ context.Context, _ runtime.Object, _ runtime.Object) (*metav1.Table, error) {
+	return nil, fmt.Errorf("stub: not implemented")
+}

From 1b3fe9d8fcaf21d707adde01475d8e41fc7d9a39 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 16 Mar 2026 14:13:49 +0500
Subject: [PATCH 329/666] [docs] Changed update website docs job to push model

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .github/workflows/tags.yaml | 73 +++++++++++++++++++++++++++++++++++++
 1 file changed, 73 insertions(+)

diff --git a/.github/workflows/tags.yaml b/.github/workflows/tags.yaml
index 9ac6f6ca..f26ef632 100644
--- a/.github/workflows/tags.yaml
+++ b/.github/workflows/tags.yaml
@@ -16,6 +16,8 @@ jobs:
   prepare-release:
     name: Prepare Release
     runs-on: [self-hosted]
+    outputs:
+      skip: ${{ steps.check_release.outputs.skip }}
     permissions:
       contents: write
       packages: write
@@ -389,3 +391,74 @@ jobs:
               
               console.log(`Created PR #${pr.data.number} for changelog`);
             }
+
+  update-website-docs:
+    name: Update Website Docs
+    runs-on: [self-hosted]
+    needs: [generate-changelog, prepare-release]
+    if: needs.generate-changelog.result == 'success' && needs.prepare-release.outputs.skip != 'true'
+    permissions:
+      contents: read
+    steps:
+      - name: Parse tag
+        id: tag
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const ref = context.ref.replace('refs/tags/', '');
+            const m = ref.match(/^v(\d+\.\d+\.\d+)(-(?:alpha|beta|rc)\.\d+)?$/);
+            if (!m) {
+              core.setFailed(`❌ tag '${ref}' must match 'vX.Y.Z' or 'vX.Y.Z-(alpha|beta|rc).N'`);
+              return;
+            }
+            const version = m[1] + (m[2] ?? '');
+            core.setOutput('tag',     ref);      // v0.22.0
+            core.setOutput('version', version);  // 0.22.0
+
+      - name: Checkout website repo
+        uses: actions/checkout@v4
+        with:
+          repository: cozystack/website
+          token: ${{ secrets.GH_PAT }}
+          ref: main
+
+      - name: Update docs from release branch
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT }}
+        run: make update-all BRANCH=release-${{ steps.tag.outputs.version }} RELEASE_TAG=${{ steps.tag.outputs.tag }}
+
+      - name: Commit and push
+        id: commit
+        run: |
+          git config user.name  "cozystack-bot"
+          git config user.email "217169706+cozystack-bot@users.noreply.github.com"
+          git add content
+          if git diff --cached --quiet; then
+            echo "No changes to commit"
+            echo "changed=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+          BRANCH="update-docs-v${{ steps.tag.outputs.version }}"
+          git branch -D "$BRANCH" 2>/dev/null || true
+          git checkout -b "$BRANCH"
+          git commit --signoff -m "[docs] Update managed apps reference for v${{ steps.tag.outputs.version }}"
+          git push --force --set-upstream origin "$BRANCH"
+          echo "changed=true" >> $GITHUB_OUTPUT
+
+      - name: Open pull request
+        if: steps.commit.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT }}
+        run: |
+          BRANCH="update-docs-v${{ steps.tag.outputs.version }}"
+          pr_state=$(gh pr view "$BRANCH" --repo cozystack/website --json state --jq .state 2>/dev/null || echo "")
+          if [[ "$pr_state" == "OPEN" ]]; then
+            echo "PR already open, skipping creation."
+          else
+            gh pr create \
+              --repo cozystack/website \
+              --title "[docs] Update managed apps reference for v${{ steps.tag.outputs.version }}" \
+              --body "Automated docs update for release \`v${{ steps.tag.outputs.version }}\`." \
+              --head "update-docs-v${{ steps.tag.outputs.version }}" \
+              --base main
+          fi

From 733e87137f0b3adb95ecbdc9bdf74222a282c752 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 16 Mar 2026 22:41:19 +0500
Subject: [PATCH 330/666] [docs] Added deepcopy methods to go types

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .../v1alpha1/bucket/zz_generated.deepcopy.go  |  78 ++++
 .../clickhouse/zz_generated.deepcopy.go       | 131 ++++++
 .../foundationdb/zz_generated.deepcopy.go     | 224 ++++++++++
 .../v1alpha1/harbor/zz_generated.deepcopy.go  | 176 ++++++++
 .../httpcache/zz_generated.deepcopy.go        | 113 +++++
 .../v1alpha1/kafka/zz_generated.deepcopy.go   | 132 ++++++
 .../kubernetes/zz_generated.deepcopy.go       | 412 ++++++++++++++++++
 .../v1alpha1/mariadb/zz_generated.deepcopy.go | 161 +++++++
 .../v1alpha1/mongodb/zz_generated.deepcopy.go | 217 +++++++++
 .../v1alpha1/nats/zz_generated.deepcopy.go    | 141 ++++++
 .../v1alpha1/openbao/zz_generated.deepcopy.go |  75 ++++
 .../postgresql/zz_generated.deepcopy.go       | 230 ++++++++++
 .../v1alpha1/qdrant/zz_generated.deepcopy.go  |  75 ++++
 .../rabbitmq/zz_generated.deepcopy.go         | 145 ++++++
 .../v1alpha1/redis/zz_generated.deepcopy.go   |  75 ++++
 .../tcpbalancer/zz_generated.deepcopy.go      | 116 +++++
 .../v1alpha1/tenant/zz_generated.deepcopy.go  |  65 +++
 .../v1alpha1/vmdisk/zz_generated.deepcopy.go  | 133 ++++++
 .../vminstance/zz_generated.deepcopy.go       | 145 ++++++
 .../v1alpha1/vpc/zz_generated.deepcopy.go     |  76 ++++
 .../v1alpha1/vpn/zz_generated.deepcopy.go     | 101 +++++
 hack/update-codegen.sh                        |   2 +-
 22 files changed, 3022 insertions(+), 1 deletion(-)
 create mode 100644 api/apps/v1alpha1/bucket/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/clickhouse/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/foundationdb/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/harbor/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/httpcache/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/kafka/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/mariadb/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/mongodb/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/nats/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/openbao/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/postgresql/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/qdrant/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/rabbitmq/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/redis/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/tcpbalancer/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/tenant/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/vmdisk/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/vminstance/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/vpc/zz_generated.deepcopy.go
 create mode 100644 api/apps/v1alpha1/vpn/zz_generated.deepcopy.go

diff --git a/api/apps/v1alpha1/bucket/zz_generated.deepcopy.go b/api/apps/v1alpha1/bucket/zz_generated.deepcopy.go
new file mode 100644
index 00000000..cd12e83d
--- /dev/null
+++ b/api/apps/v1alpha1/bucket/zz_generated.deepcopy.go
@@ -0,0 +1,78 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package bucket
+
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	if in.Users != nil {
+		in, out := &in.Users, &out.Users
+		*out = make(map[string]User, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *User) DeepCopyInto(out *User) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
+func (in *User) DeepCopy() *User {
+	if in == nil {
+		return nil
+	}
+	out := new(User)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/clickhouse/zz_generated.deepcopy.go b/api/apps/v1alpha1/clickhouse/zz_generated.deepcopy.go
new file mode 100644
index 00000000..4d430573
--- /dev/null
+++ b/api/apps/v1alpha1/clickhouse/zz_generated.deepcopy.go
@@ -0,0 +1,131 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package clickhouse
+
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Backup) DeepCopyInto(out *Backup) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backup.
+func (in *Backup) DeepCopy() *Backup {
+	if in == nil {
+		return nil
+	}
+	out := new(Backup)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClickHouseKeeper) DeepCopyInto(out *ClickHouseKeeper) {
+	*out = *in
+	out.Size = in.Size.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClickHouseKeeper.
+func (in *ClickHouseKeeper) DeepCopy() *ClickHouseKeeper {
+	if in == nil {
+		return nil
+	}
+	out := new(ClickHouseKeeper)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	out.Backup = in.Backup
+	in.ClickhouseKeeper.DeepCopyInto(&out.ClickhouseKeeper)
+	out.LogStorageSize = in.LogStorageSize.DeepCopy()
+	in.Resources.DeepCopyInto(&out.Resources)
+	out.Size = in.Size.DeepCopy()
+	if in.Users != nil {
+		in, out := &in.Users, &out.Users
+		*out = make(map[string]User, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	out.Cpu = in.Cpu.DeepCopy()
+	out.Memory = in.Memory.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *User) DeepCopyInto(out *User) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
+func (in *User) DeepCopy() *User {
+	if in == nil {
+		return nil
+	}
+	out := new(User)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/foundationdb/zz_generated.deepcopy.go b/api/apps/v1alpha1/foundationdb/zz_generated.deepcopy.go
new file mode 100644
index 00000000..c09f7e1d
--- /dev/null
+++ b/api/apps/v1alpha1/foundationdb/zz_generated.deepcopy.go
@@ -0,0 +1,224 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package foundationdb
+
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Backup) DeepCopyInto(out *Backup) {
+	*out = *in
+	out.S3 = in.S3
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backup.
+func (in *Backup) DeepCopy() *Backup {
+	if in == nil {
+		return nil
+	}
+	out := new(Backup)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BackupS3) DeepCopyInto(out *BackupS3) {
+	*out = *in
+	out.Credentials = in.Credentials
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupS3.
+func (in *BackupS3) DeepCopy() *BackupS3 {
+	if in == nil {
+		return nil
+	}
+	out := new(BackupS3)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BackupS3Credentials) DeepCopyInto(out *BackupS3Credentials) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupS3Credentials.
+func (in *BackupS3Credentials) DeepCopy() *BackupS3Credentials {
+	if in == nil {
+		return nil
+	}
+	out := new(BackupS3Credentials)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Cluster) DeepCopyInto(out *Cluster) {
+	*out = *in
+	out.FaultDomain = in.FaultDomain
+	out.ProcessCounts = in.ProcessCounts
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Cluster.
+func (in *Cluster) DeepCopy() *Cluster {
+	if in == nil {
+		return nil
+	}
+	out := new(Cluster)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterFaultDomain) DeepCopyInto(out *ClusterFaultDomain) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterFaultDomain.
+func (in *ClusterFaultDomain) DeepCopy() *ClusterFaultDomain {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterFaultDomain)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterProcessCounts) DeepCopyInto(out *ClusterProcessCounts) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterProcessCounts.
+func (in *ClusterProcessCounts) DeepCopy() *ClusterProcessCounts {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterProcessCounts)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	out.Backup = in.Backup
+	out.Cluster = in.Cluster
+	if in.CustomParameters != nil {
+		in, out := &in.CustomParameters, &out.CustomParameters
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	out.Monitoring = in.Monitoring
+	in.Resources.DeepCopyInto(&out.Resources)
+	out.SecurityContext = in.SecurityContext
+	in.Storage.DeepCopyInto(&out.Storage)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Monitoring) DeepCopyInto(out *Monitoring) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Monitoring.
+func (in *Monitoring) DeepCopy() *Monitoring {
+	if in == nil {
+		return nil
+	}
+	out := new(Monitoring)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	out.Cpu = in.Cpu.DeepCopy()
+	out.Memory = in.Memory.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SecurityContext) DeepCopyInto(out *SecurityContext) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecurityContext.
+func (in *SecurityContext) DeepCopy() *SecurityContext {
+	if in == nil {
+		return nil
+	}
+	out := new(SecurityContext)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Storage) DeepCopyInto(out *Storage) {
+	*out = *in
+	out.Size = in.Size.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Storage.
+func (in *Storage) DeepCopy() *Storage {
+	if in == nil {
+		return nil
+	}
+	out := new(Storage)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/harbor/zz_generated.deepcopy.go b/api/apps/v1alpha1/harbor/zz_generated.deepcopy.go
new file mode 100644
index 00000000..a90e181f
--- /dev/null
+++ b/api/apps/v1alpha1/harbor/zz_generated.deepcopy.go
@@ -0,0 +1,176 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package harbor
+
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	in.Core.DeepCopyInto(&out.Core)
+	in.Database.DeepCopyInto(&out.Database)
+	in.Jobservice.DeepCopyInto(&out.Jobservice)
+	in.Redis.DeepCopyInto(&out.Redis)
+	in.Registry.DeepCopyInto(&out.Registry)
+	in.Trivy.DeepCopyInto(&out.Trivy)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Core) DeepCopyInto(out *Core) {
+	*out = *in
+	in.Resources.DeepCopyInto(&out.Resources)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Core.
+func (in *Core) DeepCopy() *Core {
+	if in == nil {
+		return nil
+	}
+	out := new(Core)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Database) DeepCopyInto(out *Database) {
+	*out = *in
+	out.Size = in.Size.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Database.
+func (in *Database) DeepCopy() *Database {
+	if in == nil {
+		return nil
+	}
+	out := new(Database)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Jobservice) DeepCopyInto(out *Jobservice) {
+	*out = *in
+	in.Resources.DeepCopyInto(&out.Resources)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Jobservice.
+func (in *Jobservice) DeepCopy() *Jobservice {
+	if in == nil {
+		return nil
+	}
+	out := new(Jobservice)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Redis) DeepCopyInto(out *Redis) {
+	*out = *in
+	out.Size = in.Size.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Redis.
+func (in *Redis) DeepCopy() *Redis {
+	if in == nil {
+		return nil
+	}
+	out := new(Redis)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Registry) DeepCopyInto(out *Registry) {
+	*out = *in
+	in.Resources.DeepCopyInto(&out.Resources)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Registry.
+func (in *Registry) DeepCopy() *Registry {
+	if in == nil {
+		return nil
+	}
+	out := new(Registry)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	out.Cpu = in.Cpu.DeepCopy()
+	out.Memory = in.Memory.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Trivy) DeepCopyInto(out *Trivy) {
+	*out = *in
+	in.Resources.DeepCopyInto(&out.Resources)
+	out.Size = in.Size.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Trivy.
+func (in *Trivy) DeepCopy() *Trivy {
+	if in == nil {
+		return nil
+	}
+	out := new(Trivy)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/httpcache/zz_generated.deepcopy.go b/api/apps/v1alpha1/httpcache/zz_generated.deepcopy.go
new file mode 100644
index 00000000..f94fd19b
--- /dev/null
+++ b/api/apps/v1alpha1/httpcache/zz_generated.deepcopy.go
@@ -0,0 +1,113 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package httpcache
+
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	if in.Endpoints != nil {
+		in, out := &in.Endpoints, &out.Endpoints
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	in.Haproxy.DeepCopyInto(&out.Haproxy)
+	in.Nginx.DeepCopyInto(&out.Nginx)
+	out.Size = in.Size.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HAProxy) DeepCopyInto(out *HAProxy) {
+	*out = *in
+	in.Resources.DeepCopyInto(&out.Resources)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HAProxy.
+func (in *HAProxy) DeepCopy() *HAProxy {
+	if in == nil {
+		return nil
+	}
+	out := new(HAProxy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Nginx) DeepCopyInto(out *Nginx) {
+	*out = *in
+	in.Resources.DeepCopyInto(&out.Resources)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Nginx.
+func (in *Nginx) DeepCopy() *Nginx {
+	if in == nil {
+		return nil
+	}
+	out := new(Nginx)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	out.Cpu = in.Cpu.DeepCopy()
+	out.Memory = in.Memory.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/kafka/zz_generated.deepcopy.go b/api/apps/v1alpha1/kafka/zz_generated.deepcopy.go
new file mode 100644
index 00000000..13e1836c
--- /dev/null
+++ b/api/apps/v1alpha1/kafka/zz_generated.deepcopy.go
@@ -0,0 +1,132 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package kafka
+
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	in.Kafka.DeepCopyInto(&out.Kafka)
+	if in.Topics != nil {
+		in, out := &in.Topics, &out.Topics
+		*out = make([]Topic, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	in.Zookeeper.DeepCopyInto(&out.Zookeeper)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Kafka) DeepCopyInto(out *Kafka) {
+	*out = *in
+	in.Resources.DeepCopyInto(&out.Resources)
+	out.Size = in.Size.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Kafka.
+func (in *Kafka) DeepCopy() *Kafka {
+	if in == nil {
+		return nil
+	}
+	out := new(Kafka)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	out.Cpu = in.Cpu.DeepCopy()
+	out.Memory = in.Memory.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Topic) DeepCopyInto(out *Topic) {
+	*out = *in
+	in.Config.DeepCopyInto(&out.Config)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Topic.
+func (in *Topic) DeepCopy() *Topic {
+	if in == nil {
+		return nil
+	}
+	out := new(Topic)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ZooKeeper) DeepCopyInto(out *ZooKeeper) {
+	*out = *in
+	in.Resources.DeepCopyInto(&out.Resources)
+	out.Size = in.Size.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ZooKeeper.
+func (in *ZooKeeper) DeepCopy() *ZooKeeper {
+	if in == nil {
+		return nil
+	}
+	out := new(ZooKeeper)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go b/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go
new file mode 100644
index 00000000..3c20519c
--- /dev/null
+++ b/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go
@@ -0,0 +1,412 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package kubernetes
+
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *APIServer) DeepCopyInto(out *APIServer) {
+	*out = *in
+	in.Resources.DeepCopyInto(&out.Resources)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIServer.
+func (in *APIServer) DeepCopy() *APIServer {
+	if in == nil {
+		return nil
+	}
+	out := new(APIServer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Addons) DeepCopyInto(out *Addons) {
+	*out = *in
+	in.CertManager.DeepCopyInto(&out.CertManager)
+	in.Cilium.DeepCopyInto(&out.Cilium)
+	in.Coredns.DeepCopyInto(&out.Coredns)
+	in.Fluxcd.DeepCopyInto(&out.Fluxcd)
+	out.GatewayAPI = in.GatewayAPI
+	in.GpuOperator.DeepCopyInto(&out.GpuOperator)
+	in.IngressNginx.DeepCopyInto(&out.IngressNginx)
+	in.MonitoringAgents.DeepCopyInto(&out.MonitoringAgents)
+	in.Velero.DeepCopyInto(&out.Velero)
+	in.VerticalPodAutoscaler.DeepCopyInto(&out.VerticalPodAutoscaler)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Addons.
+func (in *Addons) DeepCopy() *Addons {
+	if in == nil {
+		return nil
+	}
+	out := new(Addons)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CertManagerAddon) DeepCopyInto(out *CertManagerAddon) {
+	*out = *in
+	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertManagerAddon.
+func (in *CertManagerAddon) DeepCopy() *CertManagerAddon {
+	if in == nil {
+		return nil
+	}
+	out := new(CertManagerAddon)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CiliumAddon) DeepCopyInto(out *CiliumAddon) {
+	*out = *in
+	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CiliumAddon.
+func (in *CiliumAddon) DeepCopy() *CiliumAddon {
+	if in == nil {
+		return nil
+	}
+	out := new(CiliumAddon)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	in.Addons.DeepCopyInto(&out.Addons)
+	in.ControlPlane.DeepCopyInto(&out.ControlPlane)
+	if in.NodeGroups != nil {
+		in, out := &in.NodeGroups, &out.NodeGroups
+		*out = make(map[string]NodeGroup, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ControlPlane) DeepCopyInto(out *ControlPlane) {
+	*out = *in
+	in.ApiServer.DeepCopyInto(&out.ApiServer)
+	in.ControllerManager.DeepCopyInto(&out.ControllerManager)
+	in.Konnectivity.DeepCopyInto(&out.Konnectivity)
+	in.Scheduler.DeepCopyInto(&out.Scheduler)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ControlPlane.
+func (in *ControlPlane) DeepCopy() *ControlPlane {
+	if in == nil {
+		return nil
+	}
+	out := new(ControlPlane)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ControllerManager) DeepCopyInto(out *ControllerManager) {
+	*out = *in
+	in.Resources.DeepCopyInto(&out.Resources)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ControllerManager.
+func (in *ControllerManager) DeepCopy() *ControllerManager {
+	if in == nil {
+		return nil
+	}
+	out := new(ControllerManager)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CoreDNSAddon) DeepCopyInto(out *CoreDNSAddon) {
+	*out = *in
+	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CoreDNSAddon.
+func (in *CoreDNSAddon) DeepCopy() *CoreDNSAddon {
+	if in == nil {
+		return nil
+	}
+	out := new(CoreDNSAddon)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *FluxCDAddon) DeepCopyInto(out *FluxCDAddon) {
+	*out = *in
+	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FluxCDAddon.
+func (in *FluxCDAddon) DeepCopy() *FluxCDAddon {
+	if in == nil {
+		return nil
+	}
+	out := new(FluxCDAddon)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GPU) DeepCopyInto(out *GPU) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GPU.
+func (in *GPU) DeepCopy() *GPU {
+	if in == nil {
+		return nil
+	}
+	out := new(GPU)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GPUOperatorAddon) DeepCopyInto(out *GPUOperatorAddon) {
+	*out = *in
+	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GPUOperatorAddon.
+func (in *GPUOperatorAddon) DeepCopy() *GPUOperatorAddon {
+	if in == nil {
+		return nil
+	}
+	out := new(GPUOperatorAddon)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GatewayAPIAddon) DeepCopyInto(out *GatewayAPIAddon) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GatewayAPIAddon.
+func (in *GatewayAPIAddon) DeepCopy() *GatewayAPIAddon {
+	if in == nil {
+		return nil
+	}
+	out := new(GatewayAPIAddon)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *IngressNginxAddon) DeepCopyInto(out *IngressNginxAddon) {
+	*out = *in
+	if in.Hosts != nil {
+		in, out := &in.Hosts, &out.Hosts
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNginxAddon.
+func (in *IngressNginxAddon) DeepCopy() *IngressNginxAddon {
+	if in == nil {
+		return nil
+	}
+	out := new(IngressNginxAddon)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Konnectivity) DeepCopyInto(out *Konnectivity) {
+	*out = *in
+	in.Server.DeepCopyInto(&out.Server)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Konnectivity.
+func (in *Konnectivity) DeepCopy() *Konnectivity {
+	if in == nil {
+		return nil
+	}
+	out := new(Konnectivity)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *KonnectivityServer) DeepCopyInto(out *KonnectivityServer) {
+	*out = *in
+	in.Resources.DeepCopyInto(&out.Resources)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KonnectivityServer.
+func (in *KonnectivityServer) DeepCopy() *KonnectivityServer {
+	if in == nil {
+		return nil
+	}
+	out := new(KonnectivityServer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *MonitoringAgentsAddon) DeepCopyInto(out *MonitoringAgentsAddon) {
+	*out = *in
+	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MonitoringAgentsAddon.
+func (in *MonitoringAgentsAddon) DeepCopy() *MonitoringAgentsAddon {
+	if in == nil {
+		return nil
+	}
+	out := new(MonitoringAgentsAddon)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *NodeGroup) DeepCopyInto(out *NodeGroup) {
+	*out = *in
+	out.EphemeralStorage = in.EphemeralStorage.DeepCopy()
+	if in.Gpus != nil {
+		in, out := &in.Gpus, &out.Gpus
+		*out = make([]GPU, len(*in))
+		copy(*out, *in)
+	}
+	in.Resources.DeepCopyInto(&out.Resources)
+	if in.Roles != nil {
+		in, out := &in.Roles, &out.Roles
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeGroup.
+func (in *NodeGroup) DeepCopy() *NodeGroup {
+	if in == nil {
+		return nil
+	}
+	out := new(NodeGroup)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	out.Cpu = in.Cpu.DeepCopy()
+	out.Memory = in.Memory.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Scheduler) DeepCopyInto(out *Scheduler) {
+	*out = *in
+	in.Resources.DeepCopyInto(&out.Resources)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Scheduler.
+func (in *Scheduler) DeepCopy() *Scheduler {
+	if in == nil {
+		return nil
+	}
+	out := new(Scheduler)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *VeleroAddon) DeepCopyInto(out *VeleroAddon) {
+	*out = *in
+	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VeleroAddon.
+func (in *VeleroAddon) DeepCopy() *VeleroAddon {
+	if in == nil {
+		return nil
+	}
+	out := new(VeleroAddon)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *VerticalPodAutoscalerAddon) DeepCopyInto(out *VerticalPodAutoscalerAddon) {
+	*out = *in
+	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VerticalPodAutoscalerAddon.
+func (in *VerticalPodAutoscalerAddon) DeepCopy() *VerticalPodAutoscalerAddon {
+	if in == nil {
+		return nil
+	}
+	out := new(VerticalPodAutoscalerAddon)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/mariadb/zz_generated.deepcopy.go b/api/apps/v1alpha1/mariadb/zz_generated.deepcopy.go
new file mode 100644
index 00000000..05df8ad0
--- /dev/null
+++ b/api/apps/v1alpha1/mariadb/zz_generated.deepcopy.go
@@ -0,0 +1,161 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package mariadb
+
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Backup) DeepCopyInto(out *Backup) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backup.
+func (in *Backup) DeepCopy() *Backup {
+	if in == nil {
+		return nil
+	}
+	out := new(Backup)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	out.Backup = in.Backup
+	if in.Databases != nil {
+		in, out := &in.Databases, &out.Databases
+		*out = make(map[string]Database, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+	in.Resources.DeepCopyInto(&out.Resources)
+	out.Size = in.Size.DeepCopy()
+	if in.Users != nil {
+		in, out := &in.Users, &out.Users
+		*out = make(map[string]User, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Database) DeepCopyInto(out *Database) {
+	*out = *in
+	in.Roles.DeepCopyInto(&out.Roles)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Database.
+func (in *Database) DeepCopy() *Database {
+	if in == nil {
+		return nil
+	}
+	out := new(Database)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DatabaseRoles) DeepCopyInto(out *DatabaseRoles) {
+	*out = *in
+	if in.Admin != nil {
+		in, out := &in.Admin, &out.Admin
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Readonly != nil {
+		in, out := &in.Readonly, &out.Readonly
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DatabaseRoles.
+func (in *DatabaseRoles) DeepCopy() *DatabaseRoles {
+	if in == nil {
+		return nil
+	}
+	out := new(DatabaseRoles)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	out.Cpu = in.Cpu.DeepCopy()
+	out.Memory = in.Memory.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *User) DeepCopyInto(out *User) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
+func (in *User) DeepCopy() *User {
+	if in == nil {
+		return nil
+	}
+	out := new(User)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/mongodb/zz_generated.deepcopy.go b/api/apps/v1alpha1/mongodb/zz_generated.deepcopy.go
new file mode 100644
index 00000000..5b20c6d6
--- /dev/null
+++ b/api/apps/v1alpha1/mongodb/zz_generated.deepcopy.go
@@ -0,0 +1,217 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package mongodb
+
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Backup) DeepCopyInto(out *Backup) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backup.
+func (in *Backup) DeepCopy() *Backup {
+	if in == nil {
+		return nil
+	}
+	out := new(Backup)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Bootstrap) DeepCopyInto(out *Bootstrap) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Bootstrap.
+func (in *Bootstrap) DeepCopy() *Bootstrap {
+	if in == nil {
+		return nil
+	}
+	out := new(Bootstrap)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	out.Backup = in.Backup
+	out.Bootstrap = in.Bootstrap
+	if in.Databases != nil {
+		in, out := &in.Databases, &out.Databases
+		*out = make(map[string]Database, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+	in.Resources.DeepCopyInto(&out.Resources)
+	in.ShardingConfig.DeepCopyInto(&out.ShardingConfig)
+	out.Size = in.Size.DeepCopy()
+	if in.Users != nil {
+		in, out := &in.Users, &out.Users
+		*out = make(map[string]User, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Database) DeepCopyInto(out *Database) {
+	*out = *in
+	in.Roles.DeepCopyInto(&out.Roles)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Database.
+func (in *Database) DeepCopy() *Database {
+	if in == nil {
+		return nil
+	}
+	out := new(Database)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DatabaseRoles) DeepCopyInto(out *DatabaseRoles) {
+	*out = *in
+	if in.Admin != nil {
+		in, out := &in.Admin, &out.Admin
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Readonly != nil {
+		in, out := &in.Readonly, &out.Readonly
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DatabaseRoles.
+func (in *DatabaseRoles) DeepCopy() *DatabaseRoles {
+	if in == nil {
+		return nil
+	}
+	out := new(DatabaseRoles)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	out.Cpu = in.Cpu.DeepCopy()
+	out.Memory = in.Memory.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Shard) DeepCopyInto(out *Shard) {
+	*out = *in
+	out.Size = in.Size.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Shard.
+func (in *Shard) DeepCopy() *Shard {
+	if in == nil {
+		return nil
+	}
+	out := new(Shard)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ShardingConfig) DeepCopyInto(out *ShardingConfig) {
+	*out = *in
+	out.ConfigServerSize = in.ConfigServerSize.DeepCopy()
+	if in.Shards != nil {
+		in, out := &in.Shards, &out.Shards
+		*out = make([]Shard, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ShardingConfig.
+func (in *ShardingConfig) DeepCopy() *ShardingConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(ShardingConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *User) DeepCopyInto(out *User) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
+func (in *User) DeepCopy() *User {
+	if in == nil {
+		return nil
+	}
+	out := new(User)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/nats/zz_generated.deepcopy.go b/api/apps/v1alpha1/nats/zz_generated.deepcopy.go
new file mode 100644
index 00000000..bd13e721
--- /dev/null
+++ b/api/apps/v1alpha1/nats/zz_generated.deepcopy.go
@@ -0,0 +1,141 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package nats
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	in.Config.DeepCopyInto(&out.Config)
+	in.Jetstream.DeepCopyInto(&out.Jetstream)
+	in.Resources.DeepCopyInto(&out.Resources)
+	if in.Users != nil {
+		in, out := &in.Users, &out.Users
+		*out = make(map[string]User, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Jetstream) DeepCopyInto(out *Jetstream) {
+	*out = *in
+	out.Size = in.Size.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Jetstream.
+func (in *Jetstream) DeepCopy() *Jetstream {
+	if in == nil {
+		return nil
+	}
+	out := new(Jetstream)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	out.Cpu = in.Cpu.DeepCopy()
+	out.Memory = in.Memory.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *User) DeepCopyInto(out *User) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
+func (in *User) DeepCopy() *User {
+	if in == nil {
+		return nil
+	}
+	out := new(User)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ValuesConfig) DeepCopyInto(out *ValuesConfig) {
+	*out = *in
+	if in.Merge != nil {
+		in, out := &in.Merge, &out.Merge
+		*out = new(runtime.RawExtension)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Resolver != nil {
+		in, out := &in.Resolver, &out.Resolver
+		*out = new(runtime.RawExtension)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValuesConfig.
+func (in *ValuesConfig) DeepCopy() *ValuesConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(ValuesConfig)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/openbao/zz_generated.deepcopy.go b/api/apps/v1alpha1/openbao/zz_generated.deepcopy.go
new file mode 100644
index 00000000..8ba57fbf
--- /dev/null
+++ b/api/apps/v1alpha1/openbao/zz_generated.deepcopy.go
@@ -0,0 +1,75 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package openbao
+
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	in.Resources.DeepCopyInto(&out.Resources)
+	out.Size = in.Size.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	out.Cpu = in.Cpu.DeepCopy()
+	out.Memory = in.Memory.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/postgresql/zz_generated.deepcopy.go b/api/apps/v1alpha1/postgresql/zz_generated.deepcopy.go
new file mode 100644
index 00000000..5dfe67de
--- /dev/null
+++ b/api/apps/v1alpha1/postgresql/zz_generated.deepcopy.go
@@ -0,0 +1,230 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package postgresql
+
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Backup) DeepCopyInto(out *Backup) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backup.
+func (in *Backup) DeepCopy() *Backup {
+	if in == nil {
+		return nil
+	}
+	out := new(Backup)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Bootstrap) DeepCopyInto(out *Bootstrap) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Bootstrap.
+func (in *Bootstrap) DeepCopy() *Bootstrap {
+	if in == nil {
+		return nil
+	}
+	out := new(Bootstrap)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	out.Backup = in.Backup
+	out.Bootstrap = in.Bootstrap
+	if in.Databases != nil {
+		in, out := &in.Databases, &out.Databases
+		*out = make(map[string]Database, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+	out.Postgresql = in.Postgresql
+	out.Quorum = in.Quorum
+	in.Resources.DeepCopyInto(&out.Resources)
+	out.Size = in.Size.DeepCopy()
+	if in.Users != nil {
+		in, out := &in.Users, &out.Users
+		*out = make(map[string]User, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Database) DeepCopyInto(out *Database) {
+	*out = *in
+	if in.Extensions != nil {
+		in, out := &in.Extensions, &out.Extensions
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	in.Roles.DeepCopyInto(&out.Roles)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Database.
+func (in *Database) DeepCopy() *Database {
+	if in == nil {
+		return nil
+	}
+	out := new(Database)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DatabaseRoles) DeepCopyInto(out *DatabaseRoles) {
+	*out = *in
+	if in.Admin != nil {
+		in, out := &in.Admin, &out.Admin
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Readonly != nil {
+		in, out := &in.Readonly, &out.Readonly
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DatabaseRoles.
+func (in *DatabaseRoles) DeepCopy() *DatabaseRoles {
+	if in == nil {
+		return nil
+	}
+	out := new(DatabaseRoles)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PostgreSQL) DeepCopyInto(out *PostgreSQL) {
+	*out = *in
+	out.Parameters = in.Parameters
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PostgreSQL.
+func (in *PostgreSQL) DeepCopy() *PostgreSQL {
+	if in == nil {
+		return nil
+	}
+	out := new(PostgreSQL)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PostgreSQLParameters) DeepCopyInto(out *PostgreSQLParameters) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PostgreSQLParameters.
+func (in *PostgreSQLParameters) DeepCopy() *PostgreSQLParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(PostgreSQLParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Quorum) DeepCopyInto(out *Quorum) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Quorum.
+func (in *Quorum) DeepCopy() *Quorum {
+	if in == nil {
+		return nil
+	}
+	out := new(Quorum)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	out.Cpu = in.Cpu.DeepCopy()
+	out.Memory = in.Memory.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *User) DeepCopyInto(out *User) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
+func (in *User) DeepCopy() *User {
+	if in == nil {
+		return nil
+	}
+	out := new(User)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/qdrant/zz_generated.deepcopy.go b/api/apps/v1alpha1/qdrant/zz_generated.deepcopy.go
new file mode 100644
index 00000000..46b4e838
--- /dev/null
+++ b/api/apps/v1alpha1/qdrant/zz_generated.deepcopy.go
@@ -0,0 +1,75 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package qdrant
+
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	in.Resources.DeepCopyInto(&out.Resources)
+	out.Size = in.Size.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	out.Cpu = in.Cpu.DeepCopy()
+	out.Memory = in.Memory.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/rabbitmq/zz_generated.deepcopy.go b/api/apps/v1alpha1/rabbitmq/zz_generated.deepcopy.go
new file mode 100644
index 00000000..81447693
--- /dev/null
+++ b/api/apps/v1alpha1/rabbitmq/zz_generated.deepcopy.go
@@ -0,0 +1,145 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package rabbitmq
+
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	in.Resources.DeepCopyInto(&out.Resources)
+	out.Size = in.Size.DeepCopy()
+	if in.Users != nil {
+		in, out := &in.Users, &out.Users
+		*out = make(map[string]User, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Vhosts != nil {
+		in, out := &in.Vhosts, &out.Vhosts
+		*out = make(map[string]Vhost, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	out.Cpu = in.Cpu.DeepCopy()
+	out.Memory = in.Memory.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Roles) DeepCopyInto(out *Roles) {
+	*out = *in
+	if in.Admin != nil {
+		in, out := &in.Admin, &out.Admin
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Readonly != nil {
+		in, out := &in.Readonly, &out.Readonly
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Roles.
+func (in *Roles) DeepCopy() *Roles {
+	if in == nil {
+		return nil
+	}
+	out := new(Roles)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *User) DeepCopyInto(out *User) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
+func (in *User) DeepCopy() *User {
+	if in == nil {
+		return nil
+	}
+	out := new(User)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Vhost) DeepCopyInto(out *Vhost) {
+	*out = *in
+	in.Roles.DeepCopyInto(&out.Roles)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Vhost.
+func (in *Vhost) DeepCopy() *Vhost {
+	if in == nil {
+		return nil
+	}
+	out := new(Vhost)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/redis/zz_generated.deepcopy.go b/api/apps/v1alpha1/redis/zz_generated.deepcopy.go
new file mode 100644
index 00000000..8b5a7620
--- /dev/null
+++ b/api/apps/v1alpha1/redis/zz_generated.deepcopy.go
@@ -0,0 +1,75 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package redis
+
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	in.Resources.DeepCopyInto(&out.Resources)
+	out.Size = in.Size.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	out.Cpu = in.Cpu.DeepCopy()
+	out.Memory = in.Memory.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/tcpbalancer/zz_generated.deepcopy.go b/api/apps/v1alpha1/tcpbalancer/zz_generated.deepcopy.go
new file mode 100644
index 00000000..fbd94c36
--- /dev/null
+++ b/api/apps/v1alpha1/tcpbalancer/zz_generated.deepcopy.go
@@ -0,0 +1,116 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package tcpbalancer
+
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	in.HttpAndHttps.DeepCopyInto(&out.HttpAndHttps)
+	in.Resources.DeepCopyInto(&out.Resources)
+	if in.Whitelist != nil {
+		in, out := &in.Whitelist, &out.Whitelist
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HttpAndHttps) DeepCopyInto(out *HttpAndHttps) {
+	*out = *in
+	if in.Endpoints != nil {
+		in, out := &in.Endpoints, &out.Endpoints
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	out.TargetPorts = in.TargetPorts
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HttpAndHttps.
+func (in *HttpAndHttps) DeepCopy() *HttpAndHttps {
+	if in == nil {
+		return nil
+	}
+	out := new(HttpAndHttps)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	out.Cpu = in.Cpu.DeepCopy()
+	out.Memory = in.Memory.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TargetPorts) DeepCopyInto(out *TargetPorts) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TargetPorts.
+func (in *TargetPorts) DeepCopy() *TargetPorts {
+	if in == nil {
+		return nil
+	}
+	out := new(TargetPorts)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/tenant/zz_generated.deepcopy.go b/api/apps/v1alpha1/tenant/zz_generated.deepcopy.go
new file mode 100644
index 00000000..01e896f3
--- /dev/null
+++ b/api/apps/v1alpha1/tenant/zz_generated.deepcopy.go
@@ -0,0 +1,65 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package tenant
+
+import (
+	"k8s.io/apimachinery/pkg/api/resource"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	if in.ResourceQuotas != nil {
+		in, out := &in.ResourceQuotas, &out.ResourceQuotas
+		*out = make(map[string]resource.Quantity, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val.DeepCopy()
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/vmdisk/zz_generated.deepcopy.go b/api/apps/v1alpha1/vmdisk/zz_generated.deepcopy.go
new file mode 100644
index 00000000..e874223b
--- /dev/null
+++ b/api/apps/v1alpha1/vmdisk/zz_generated.deepcopy.go
@@ -0,0 +1,133 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package vmdisk
+
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	in.Source.DeepCopyInto(&out.Source)
+	out.Storage = in.Storage.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Source) DeepCopyInto(out *Source) {
+	*out = *in
+	if in.Http != nil {
+		in, out := &in.Http, &out.Http
+		*out = new(SourceHTTP)
+		**out = **in
+	}
+	if in.Image != nil {
+		in, out := &in.Image, &out.Image
+		*out = new(SourceImage)
+		**out = **in
+	}
+	if in.Upload != nil {
+		in, out := &in.Upload, &out.Upload
+		*out = new(SourceUpload)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Source.
+func (in *Source) DeepCopy() *Source {
+	if in == nil {
+		return nil
+	}
+	out := new(Source)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SourceHTTP) DeepCopyInto(out *SourceHTTP) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourceHTTP.
+func (in *SourceHTTP) DeepCopy() *SourceHTTP {
+	if in == nil {
+		return nil
+	}
+	out := new(SourceHTTP)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SourceImage) DeepCopyInto(out *SourceImage) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourceImage.
+func (in *SourceImage) DeepCopy() *SourceImage {
+	if in == nil {
+		return nil
+	}
+	out := new(SourceImage)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SourceUpload) DeepCopyInto(out *SourceUpload) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourceUpload.
+func (in *SourceUpload) DeepCopy() *SourceUpload {
+	if in == nil {
+		return nil
+	}
+	out := new(SourceUpload)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/vminstance/zz_generated.deepcopy.go b/api/apps/v1alpha1/vminstance/zz_generated.deepcopy.go
new file mode 100644
index 00000000..d0ba0d35
--- /dev/null
+++ b/api/apps/v1alpha1/vminstance/zz_generated.deepcopy.go
@@ -0,0 +1,145 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package vminstance
+
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	if in.Disks != nil {
+		in, out := &in.Disks, &out.Disks
+		*out = make([]Disk, len(*in))
+		copy(*out, *in)
+	}
+	if in.ExternalPorts != nil {
+		in, out := &in.ExternalPorts, &out.ExternalPorts
+		*out = make([]int, len(*in))
+		copy(*out, *in)
+	}
+	if in.Gpus != nil {
+		in, out := &in.Gpus, &out.Gpus
+		*out = make([]GPU, len(*in))
+		copy(*out, *in)
+	}
+	in.Resources.DeepCopyInto(&out.Resources)
+	if in.SshKeys != nil {
+		in, out := &in.SshKeys, &out.SshKeys
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Subnets != nil {
+		in, out := &in.Subnets, &out.Subnets
+		*out = make([]Subnet, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Disk) DeepCopyInto(out *Disk) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Disk.
+func (in *Disk) DeepCopy() *Disk {
+	if in == nil {
+		return nil
+	}
+	out := new(Disk)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GPU) DeepCopyInto(out *GPU) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GPU.
+func (in *GPU) DeepCopy() *GPU {
+	if in == nil {
+		return nil
+	}
+	out := new(GPU)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	out.Cpu = in.Cpu.DeepCopy()
+	out.Memory = in.Memory.DeepCopy()
+	out.Sockets = in.Sockets.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Subnet) DeepCopyInto(out *Subnet) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Subnet.
+func (in *Subnet) DeepCopy() *Subnet {
+	if in == nil {
+		return nil
+	}
+	out := new(Subnet)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/vpc/zz_generated.deepcopy.go b/api/apps/v1alpha1/vpc/zz_generated.deepcopy.go
new file mode 100644
index 00000000..bb6fb69c
--- /dev/null
+++ b/api/apps/v1alpha1/vpc/zz_generated.deepcopy.go
@@ -0,0 +1,76 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package vpc
+
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	if in.Subnets != nil {
+		in, out := &in.Subnets, &out.Subnets
+		*out = make([]Subnet, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Subnet) DeepCopyInto(out *Subnet) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Subnet.
+func (in *Subnet) DeepCopy() *Subnet {
+	if in == nil {
+		return nil
+	}
+	out := new(Subnet)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/vpn/zz_generated.deepcopy.go b/api/apps/v1alpha1/vpn/zz_generated.deepcopy.go
new file mode 100644
index 00000000..db1943b2
--- /dev/null
+++ b/api/apps/v1alpha1/vpn/zz_generated.deepcopy.go
@@ -0,0 +1,101 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package vpn
+
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	if in.ExternalIPs != nil {
+		in, out := &in.ExternalIPs, &out.ExternalIPs
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	in.Resources.DeepCopyInto(&out.Resources)
+	if in.Users != nil {
+		in, out := &in.Users, &out.Users
+		*out = make(map[string]User, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	out.Cpu = in.Cpu.DeepCopy()
+	out.Memory = in.Memory.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *User) DeepCopyInto(out *User) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
+func (in *User) DeepCopy() *User {
+	if in == nil {
+		return nil
+	}
+	out := new(User)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh
index cbf4bedc..96956965 100755
--- a/hack/update-codegen.sh
+++ b/hack/update-codegen.sh
@@ -68,7 +68,7 @@ kube::codegen::gen_client \
     "${SCRIPT_ROOT}/pkg/apis"
 
 $CONTROLLER_GEN object:headerFile="hack/boilerplate.go.txt" paths="./api/..."
-$CONTROLLER_GEN rbac:roleName=manager-role crd paths="./api/..." output:crd:artifacts:config=${TMPDIR}
+$CONTROLLER_GEN rbac:roleName=manager-role crd paths="./api/v1alpha1/..." paths="./api/backups/..." paths="./api/dashboard/..." output:crd:artifacts:config=${TMPDIR}
 
 mv ${TMPDIR}/cozystack.io_packages.yaml ${OPERATOR_CRDDIR}/cozystack.io_packages.yaml
 mv ${TMPDIR}/cozystack.io_packagesources.yaml ${OPERATOR_CRDDIR}/cozystack.io_packagesources.yaml

From 9e5555291016fe7d018a459971ee4eedc1977367 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Wed, 18 Mar 2026 21:24:15 +0500
Subject: [PATCH 331/666] [docs] Updated app go types

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .github/workflows/pre-commit.yml              |   2 +-
 api/apps/v1alpha1/bucket/types.go             |   1 +
 .../v1alpha1/bucket/zz_generated.deepcopy.go  |  12 +-
 api/apps/v1alpha1/clickhouse/types.go         |  31 +-
 .../clickhouse/zz_generated.deepcopy.go       |  18 +-
 api/apps/v1alpha1/foundationdb/types.go       |  35 +-
 .../foundationdb/zz_generated.deepcopy.go     |  20 +-
 api/apps/v1alpha1/harbor/types.go             |  31 +-
 .../v1alpha1/harbor/zz_generated.deepcopy.go  |  18 +-
 api/apps/v1alpha1/httpcache/types.go          |  25 +-
 .../httpcache/zz_generated.deepcopy.go        |  14 +-
 api/apps/v1alpha1/kafka/types.go              |   7 +-
 .../v1alpha1/kafka/zz_generated.deepcopy.go   |  14 +-
 api/apps/v1alpha1/kubernetes/types.go         |  25 +-
 .../kubernetes/zz_generated.deepcopy.go       |  16 +-
 api/apps/v1alpha1/mariadb/types.go            |  25 +-
 .../v1alpha1/mariadb/zz_generated.deepcopy.go |  28 +-
 api/apps/v1alpha1/mongodb/types.go            |  43 +-
 .../v1alpha1/mongodb/zz_generated.deepcopy.go |  32 +-
 api/apps/v1alpha1/nats/types.go               |  19 +-
 .../v1alpha1/nats/zz_generated.deepcopy.go    |  12 +-
 api/apps/v1alpha1/openbao/types.go            |   7 +-
 .../v1alpha1/openbao/zz_generated.deepcopy.go |  12 +-
 api/apps/v1alpha1/postgresql/types.go         |  43 +-
 .../postgresql/zz_generated.deepcopy.go       |  34 +-
 api/apps/v1alpha1/qdrant/types.go             |   7 +-
 .../v1alpha1/qdrant/zz_generated.deepcopy.go  |  12 +-
 api/apps/v1alpha1/rabbitmq/types.go           |  13 +-
 .../rabbitmq/zz_generated.deepcopy.go         |  12 +-
 api/apps/v1alpha1/redis/types.go              |  13 +-
 .../v1alpha1/redis/zz_generated.deepcopy.go   |  12 +-
 api/apps/v1alpha1/tcpbalancer/types.go        |  17 +-
 .../tcpbalancer/zz_generated.deepcopy.go      |  14 +-
 api/apps/v1alpha1/tenant/types.go             |  20 +-
 .../v1alpha1/tenant/zz_generated.deepcopy.go  |   9 +
 api/apps/v1alpha1/vmdisk/types.go             |   7 +-
 .../v1alpha1/vmdisk/zz_generated.deepcopy.go  |  12 +-
 api/apps/v1alpha1/vminstance/types.go         |  53 +-
 .../vminstance/zz_generated.deepcopy.go       |  28 +-
 api/apps/v1alpha1/vpc/types.go                |   1 +
 .../v1alpha1/vpc/zz_generated.deepcopy.go     |  12 +-
 api/apps/v1alpha1/vpn/types.go                |  19 +-
 .../v1alpha1/vpn/zz_generated.deepcopy.go     |  22 +-
 hack/update-codegen.sh                        |   5 +
 packages/apps/bucket/values.schema.json       |   2 +-
 packages/apps/clickhouse/values.schema.json   | 228 +++----
 packages/apps/foundationdb/values.schema.json | 260 ++++----
 packages/apps/harbor/values.schema.json       | 248 ++++----
 packages/apps/http-cache/values.schema.json   |  50 +-
 packages/apps/kafka/values.schema.json        |  68 +-
 packages/apps/kubernetes/values.schema.json   | 274 ++++----
 packages/apps/mariadb/values.schema.json      | 206 +++---
 packages/apps/mongodb/values.schema.json      | 270 ++++----
 packages/apps/nats/values.schema.json         | 110 ++--
 packages/apps/openbao/values.schema.json      |  12 +-
 packages/apps/opensearch/values.schema.json   | 264 ++++----
 packages/apps/postgres/values.schema.json     | 332 +++++-----
 packages/apps/qdrant/values.schema.json       |  12 +-
 packages/apps/rabbitmq/values.schema.json     |  34 +-
 packages/apps/redis/values.schema.json        |  22 +-
 packages/apps/tcp-balancer/values.schema.json | 114 ++--
 packages/apps/tenant/values.schema.json       |  36 +-
 packages/apps/vm-disk/values.schema.json      |  12 +-
 packages/apps/vm-instance/values.schema.json  | 160 ++---
 packages/apps/vpc/values.schema.json          |   2 +-
 packages/apps/vpn/values.schema.json          |  38 +-
 packages/extra/bootbox/values.schema.json     |  28 +-
 packages/extra/etcd/values.schema.json        |  40 +-
 .../extra/external-dns/values.schema.json     | 158 ++---
 packages/extra/ingress/values.schema.json     |  28 +-
 packages/extra/monitoring/values.schema.json  | 586 +++++++++---------
 packages/extra/seaweedfs/values.schema.json   | 278 ++++-----
 .../system/bootbox-rd/cozyrds/bootbox.yaml    |   2 +-
 .../clickhouse-rd/cozyrds/clickhouse.yaml     |   2 +-
 packages/system/etcd-rd/cozyrds/etcd.yaml     |   2 +-
 .../external-dns-rd/cozyrds/external-dns.yaml |   2 +-
 packages/system/harbor-rd/cozyrds/harbor.yaml |   2 +-
 .../http-cache-rd/cozyrds/http-cache.yaml     |   2 +-
 .../system/ingress-rd/cozyrds/ingress.yaml    |   2 +-
 packages/system/kafka-rd/cozyrds/kafka.yaml   |   2 +-
 .../kubernetes-rd/cozyrds/kubernetes.yaml     |   2 +-
 .../system/mariadb-rd/cozyrds/mariadb.yaml    |   2 +-
 .../system/mongodb-rd/cozyrds/mongodb.yaml    |   2 +-
 .../monitoring-rd/cozyrds/monitoring.yaml     |   2 +-
 packages/system/nats-rd/cozyrds/nats.yaml     |   2 +-
 .../system/openbao-rd/cozyrds/openbao.yaml    |   2 +-
 .../opensearch-rd/cozyrds/opensearch.yaml     |   2 +-
 .../system/postgres-rd/cozyrds/postgres.yaml  |   2 +-
 packages/system/qdrant-rd/cozyrds/qdrant.yaml |   2 +-
 .../system/rabbitmq-rd/cozyrds/rabbitmq.yaml  |   2 +-
 packages/system/redis-rd/cozyrds/redis.yaml   |   2 +-
 .../seaweedfs-rd/cozyrds/seaweedfs.yaml       |   2 +-
 .../tcp-balancer-rd/cozyrds/tcp-balancer.yaml |   2 +-
 packages/system/tenant-rd/cozyrds/tenant.yaml |   2 +-
 .../system/vm-disk-rd/cozyrds/vm-disk.yaml    |   2 +-
 .../vm-instance-rd/cozyrds/vm-instance.yaml   |   2 +-
 packages/system/vpn-rd/cozyrds/vpn.yaml       |   2 +-
 pkg/cmd/server/openapi.go                     |  10 +-
 98 files changed, 2491 insertions(+), 2253 deletions(-)

diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index ef1ce088..1e867332 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -28,7 +28,7 @@ jobs:
 
       - name: Install generate
         run: |
-          curl -sSL https://github.com/cozystack/cozyvalues-gen/releases/download/v1.0.6/cozyvalues-gen-linux-amd64.tar.gz | tar -xzvf- -C /usr/local/bin/ cozyvalues-gen
+          curl -sSL https://github.com/cozystack/cozyvalues-gen/releases/download/v1.2.0/cozyvalues-gen-linux-amd64.tar.gz | tar -xzvf- -C /usr/local/bin/ cozyvalues-gen
 
       - name: Run pre-commit hooks
         run: |
diff --git a/api/apps/v1alpha1/bucket/types.go b/api/apps/v1alpha1/bucket/types.go
index fa586252..3f7cd3c2 100644
--- a/api/apps/v1alpha1/bucket/types.go
+++ b/api/apps/v1alpha1/bucket/types.go
@@ -11,6 +11,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/api/apps/v1alpha1/bucket/zz_generated.deepcopy.go b/api/apps/v1alpha1/bucket/zz_generated.deepcopy.go
index cd12e83d..26f925cd 100644
--- a/api/apps/v1alpha1/bucket/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/bucket/zz_generated.deepcopy.go
@@ -20,7 +20,9 @@ limitations under the License.
 
 package bucket
 
-import ()
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Config) DeepCopyInto(out *Config) {
@@ -40,6 +42,14 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
diff --git a/api/apps/v1alpha1/clickhouse/types.go b/api/apps/v1alpha1/clickhouse/types.go
index 29bb87df..174eda95 100644
--- a/api/apps/v1alpha1/clickhouse/types.go
+++ b/api/apps/v1alpha1/clickhouse/types.go
@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
@@ -19,39 +20,39 @@ type Config struct {
 }
 
 type ConfigSpec struct {
-	// Backup configuration.
-	// +kubebuilder:default:={}
-	Backup Backup `json:"backup"`
-	// ClickHouse Keeper configuration.
-	// +kubebuilder:default:={}
-	ClickhouseKeeper ClickHouseKeeper `json:"clickhouseKeeper"`
-	// Size of Persistent Volume for logs.
-	// +kubebuilder:default:="2Gi"
-	LogStorageSize resource.Quantity `json:"logStorageSize"`
-	// TTL (expiration time) for `query_log` and `query_thread_log`.
-	// +kubebuilder:default:=15
-	LogTTL int `json:"logTTL"`
 	// Number of ClickHouse replicas.
 	// +kubebuilder:default:=2
 	Replicas int `json:"replicas"`
+	// Number of ClickHouse shards.
+	// +kubebuilder:default:=1
+	Shards int `json:"shards"`
 	// Explicit CPU and memory configuration for each ClickHouse replica. When omitted, the preset defined in `resourcesPreset` is applied.
 	// +kubebuilder:default:={}
 	Resources Resources `json:"resources,omitempty"`
 	// Default sizing preset used when `resources` is omitted.
 	// +kubebuilder:default:="small"
 	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-	// Number of ClickHouse shards.
-	// +kubebuilder:default:=1
-	Shards int `json:"shards"`
 	// Persistent Volume Claim size available for application data.
 	// +kubebuilder:default:="10Gi"
 	Size resource.Quantity `json:"size"`
 	// StorageClass used to store the data.
 	// +kubebuilder:default:=""
 	StorageClass string `json:"storageClass"`
+	// Size of Persistent Volume for logs.
+	// +kubebuilder:default:="2Gi"
+	LogStorageSize resource.Quantity `json:"logStorageSize"`
+	// TTL (expiration time) for `query_log` and `query_thread_log`.
+	// +kubebuilder:default:=15
+	LogTTL int `json:"logTTL"`
 	// Users configuration map.
 	// +kubebuilder:default:={}
 	Users map[string]User `json:"users,omitempty"`
+	// Backup configuration.
+	// +kubebuilder:default:={}
+	Backup Backup `json:"backup"`
+	// ClickHouse Keeper configuration.
+	// +kubebuilder:default:={}
+	ClickhouseKeeper ClickHouseKeeper `json:"clickhouseKeeper"`
 }
 
 type Backup struct {
diff --git a/api/apps/v1alpha1/clickhouse/zz_generated.deepcopy.go b/api/apps/v1alpha1/clickhouse/zz_generated.deepcopy.go
index 4d430573..2c3a6ed8 100644
--- a/api/apps/v1alpha1/clickhouse/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/clickhouse/zz_generated.deepcopy.go
@@ -20,7 +20,9 @@ limitations under the License.
 
 package clickhouse
 
-import ()
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Backup) DeepCopyInto(out *Backup) {
@@ -71,14 +73,20 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
-	out.Backup = in.Backup
-	in.ClickhouseKeeper.DeepCopyInto(&out.ClickhouseKeeper)
-	out.LogStorageSize = in.LogStorageSize.DeepCopy()
 	in.Resources.DeepCopyInto(&out.Resources)
 	out.Size = in.Size.DeepCopy()
+	out.LogStorageSize = in.LogStorageSize.DeepCopy()
 	if in.Users != nil {
 		in, out := &in.Users, &out.Users
 		*out = make(map[string]User, len(*in))
@@ -86,6 +94,8 @@ func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 			(*out)[key] = val
 		}
 	}
+	out.Backup = in.Backup
+	in.ClickhouseKeeper.DeepCopyInto(&out.ClickhouseKeeper)
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
diff --git a/api/apps/v1alpha1/foundationdb/types.go b/api/apps/v1alpha1/foundationdb/types.go
index 105a0d23..b78c2497 100644
--- a/api/apps/v1alpha1/foundationdb/types.go
+++ b/api/apps/v1alpha1/foundationdb/types.go
@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
@@ -19,36 +20,36 @@ type Config struct {
 }
 
 type ConfigSpec struct {
-	// Enable automatic pod replacements.
-	// +kubebuilder:default:=true
-	AutomaticReplacements bool `json:"automaticReplacements"`
-	// Backup configuration.
-	// +kubebuilder:default:={}
-	Backup Backup `json:"backup"`
 	// Cluster configuration.
 	// +kubebuilder:default:={}
 	Cluster Cluster `json:"cluster"`
-	// Custom parameters to pass to FoundationDB.
+	// Storage configuration.
 	// +kubebuilder:default:={}
-	CustomParameters []string `json:"customParameters,omitempty"`
-	// Container image deployment type.
-	// +kubebuilder:default:="unified"
-	ImageType ImageType `json:"imageType"`
-	// Monitoring configuration.
-	// +kubebuilder:default:={}
-	Monitoring Monitoring `json:"monitoring"`
+	Storage Storage `json:"storage"`
 	// Explicit CPU and memory configuration for each FoundationDB instance. When omitted, the preset defined in `resourcesPreset` is applied.
 	// +kubebuilder:default:={}
 	Resources Resources `json:"resources,omitempty"`
 	// Default sizing preset used when `resources` is omitted.
 	// +kubebuilder:default:="medium"
 	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Backup configuration.
+	// +kubebuilder:default:={}
+	Backup Backup `json:"backup"`
+	// Monitoring configuration.
+	// +kubebuilder:default:={}
+	Monitoring Monitoring `json:"monitoring"`
+	// Custom parameters to pass to FoundationDB.
+	// +kubebuilder:default:={}
+	CustomParameters []string `json:"customParameters,omitempty"`
+	// Container image deployment type.
+	// +kubebuilder:default:="unified"
+	ImageType ImageType `json:"imageType"`
 	// Security context for containers.
 	// +kubebuilder:default:={}
 	SecurityContext SecurityContext `json:"securityContext"`
-	// Storage configuration.
-	// +kubebuilder:default:={}
-	Storage Storage `json:"storage"`
+	// Enable automatic pod replacements.
+	// +kubebuilder:default:=true
+	AutomaticReplacements bool `json:"automaticReplacements"`
 }
 
 type Backup struct {
diff --git a/api/apps/v1alpha1/foundationdb/zz_generated.deepcopy.go b/api/apps/v1alpha1/foundationdb/zz_generated.deepcopy.go
index c09f7e1d..92d80421 100644
--- a/api/apps/v1alpha1/foundationdb/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/foundationdb/zz_generated.deepcopy.go
@@ -20,7 +20,9 @@ limitations under the License.
 
 package foundationdb
 
-import ()
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Backup) DeepCopyInto(out *Backup) {
@@ -134,20 +136,28 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
-	out.Backup = in.Backup
 	out.Cluster = in.Cluster
+	in.Storage.DeepCopyInto(&out.Storage)
+	in.Resources.DeepCopyInto(&out.Resources)
+	out.Backup = in.Backup
+	out.Monitoring = in.Monitoring
 	if in.CustomParameters != nil {
 		in, out := &in.CustomParameters, &out.CustomParameters
 		*out = make([]string, len(*in))
 		copy(*out, *in)
 	}
-	out.Monitoring = in.Monitoring
-	in.Resources.DeepCopyInto(&out.Resources)
 	out.SecurityContext = in.SecurityContext
-	in.Storage.DeepCopyInto(&out.Storage)
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
diff --git a/api/apps/v1alpha1/harbor/types.go b/api/apps/v1alpha1/harbor/types.go
index 852dc198..6d2d07fd 100644
--- a/api/apps/v1alpha1/harbor/types.go
+++ b/api/apps/v1alpha1/harbor/types.go
@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
@@ -19,30 +20,30 @@ type Config struct {
 }
 
 type ConfigSpec struct {
-	// Core API server configuration.
-	// +kubebuilder:default:={}
-	Core Core `json:"core"`
-	// PostgreSQL database configuration.
-	// +kubebuilder:default:={}
-	Database Database `json:"database"`
 	// Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).
 	// +kubebuilder:default:=""
 	Host string `json:"host,omitempty"`
-	// Background job service configuration.
-	// +kubebuilder:default:={}
-	Jobservice Jobservice `json:"jobservice"`
-	// Redis cache configuration.
-	// +kubebuilder:default:={}
-	Redis Redis `json:"redis"`
-	// Container image registry configuration.
-	// +kubebuilder:default:={}
-	Registry Registry `json:"registry"`
 	// StorageClass used to store the data.
 	// +kubebuilder:default:=""
 	StorageClass string `json:"storageClass"`
+	// Core API server configuration.
+	// +kubebuilder:default:={}
+	Core Core `json:"core"`
+	// Container image registry configuration.
+	// +kubebuilder:default:={}
+	Registry Registry `json:"registry"`
+	// Background job service configuration.
+	// +kubebuilder:default:={}
+	Jobservice Jobservice `json:"jobservice"`
 	// Trivy vulnerability scanner configuration.
 	// +kubebuilder:default:={}
 	Trivy Trivy `json:"trivy"`
+	// PostgreSQL database configuration.
+	// +kubebuilder:default:={}
+	Database Database `json:"database"`
+	// Redis cache configuration.
+	// +kubebuilder:default:={}
+	Redis Redis `json:"redis"`
 }
 
 type Core struct {
diff --git a/api/apps/v1alpha1/harbor/zz_generated.deepcopy.go b/api/apps/v1alpha1/harbor/zz_generated.deepcopy.go
index a90e181f..3e7338ad 100644
--- a/api/apps/v1alpha1/harbor/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/harbor/zz_generated.deepcopy.go
@@ -20,7 +20,9 @@ limitations under the License.
 
 package harbor
 
-import ()
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Config) DeepCopyInto(out *Config) {
@@ -40,15 +42,23 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
 	in.Core.DeepCopyInto(&out.Core)
-	in.Database.DeepCopyInto(&out.Database)
-	in.Jobservice.DeepCopyInto(&out.Jobservice)
-	in.Redis.DeepCopyInto(&out.Redis)
 	in.Registry.DeepCopyInto(&out.Registry)
+	in.Jobservice.DeepCopyInto(&out.Jobservice)
 	in.Trivy.DeepCopyInto(&out.Trivy)
+	in.Database.DeepCopyInto(&out.Database)
+	in.Redis.DeepCopyInto(&out.Redis)
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
diff --git a/api/apps/v1alpha1/httpcache/types.go b/api/apps/v1alpha1/httpcache/types.go
index 47dfa2d5..b31e2f6e 100644
--- a/api/apps/v1alpha1/httpcache/types.go
+++ b/api/apps/v1alpha1/httpcache/types.go
@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
@@ -19,24 +20,24 @@ type Config struct {
 }
 
 type ConfigSpec struct {
-	// Endpoints configuration, as a list of <ip:port>.
-	// +kubebuilder:default:={}
-	Endpoints []string `json:"endpoints,omitempty"`
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
-	// HAProxy configuration.
-	// +kubebuilder:default:={}
-	Haproxy HAProxy `json:"haproxy"`
-	// Nginx configuration.
-	// +kubebuilder:default:={}
-	Nginx Nginx `json:"nginx"`
 	// Persistent Volume Claim size available for application data.
 	// +kubebuilder:default:="10Gi"
 	Size resource.Quantity `json:"size"`
 	// StorageClass used to store the data.
 	// +kubebuilder:default:=""
 	StorageClass string `json:"storageClass"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Endpoints configuration, as a list of <ip:port>.
+	// +kubebuilder:default:={}
+	Endpoints []string `json:"endpoints,omitempty"`
+	// HAProxy configuration.
+	// +kubebuilder:default:={}
+	Haproxy HAProxy `json:"haproxy"`
+	// Nginx configuration.
+	// +kubebuilder:default:={}
+	Nginx Nginx `json:"nginx"`
 }
 
 type HAProxy struct {
diff --git a/api/apps/v1alpha1/httpcache/zz_generated.deepcopy.go b/api/apps/v1alpha1/httpcache/zz_generated.deepcopy.go
index f94fd19b..47da2baa 100644
--- a/api/apps/v1alpha1/httpcache/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/httpcache/zz_generated.deepcopy.go
@@ -20,7 +20,9 @@ limitations under the License.
 
 package httpcache
 
-import ()
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Config) DeepCopyInto(out *Config) {
@@ -40,9 +42,18 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
+	out.Size = in.Size.DeepCopy()
 	if in.Endpoints != nil {
 		in, out := &in.Endpoints, &out.Endpoints
 		*out = make([]string, len(*in))
@@ -50,7 +61,6 @@ func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	}
 	in.Haproxy.DeepCopyInto(&out.Haproxy)
 	in.Nginx.DeepCopyInto(&out.Nginx)
-	out.Size = in.Size.DeepCopy()
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
diff --git a/api/apps/v1alpha1/kafka/types.go b/api/apps/v1alpha1/kafka/types.go
index 2b1b76e4..80978ae5 100644
--- a/api/apps/v1alpha1/kafka/types.go
+++ b/api/apps/v1alpha1/kafka/types.go
@@ -13,6 +13,7 @@ import (
 	k8sRuntime "k8s.io/apimachinery/pkg/runtime"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
@@ -23,12 +24,12 @@ type ConfigSpec struct {
 	// Enable external access from outside the cluster.
 	// +kubebuilder:default:=false
 	External bool `json:"external"`
-	// Kafka configuration.
-	// +kubebuilder:default:={}
-	Kafka Kafka `json:"kafka"`
 	// Topics configuration.
 	// +kubebuilder:default:={}
 	Topics []Topic `json:"topics,omitempty"`
+	// Kafka configuration.
+	// +kubebuilder:default:={}
+	Kafka Kafka `json:"kafka"`
 	// ZooKeeper configuration.
 	// +kubebuilder:default:={}
 	Zookeeper ZooKeeper `json:"zookeeper"`
diff --git a/api/apps/v1alpha1/kafka/zz_generated.deepcopy.go b/api/apps/v1alpha1/kafka/zz_generated.deepcopy.go
index 13e1836c..c2d39077 100644
--- a/api/apps/v1alpha1/kafka/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/kafka/zz_generated.deepcopy.go
@@ -20,7 +20,9 @@ limitations under the License.
 
 package kafka
 
-import ()
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Config) DeepCopyInto(out *Config) {
@@ -40,10 +42,17 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
-	in.Kafka.DeepCopyInto(&out.Kafka)
 	if in.Topics != nil {
 		in, out := &in.Topics, &out.Topics
 		*out = make([]Topic, len(*in))
@@ -51,6 +60,7 @@ func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	in.Kafka.DeepCopyInto(&out.Kafka)
 	in.Zookeeper.DeepCopyInto(&out.Zookeeper)
 }
 
diff --git a/api/apps/v1alpha1/kubernetes/types.go b/api/apps/v1alpha1/kubernetes/types.go
index 698985cd..485b7eff 100644
--- a/api/apps/v1alpha1/kubernetes/types.go
+++ b/api/apps/v1alpha1/kubernetes/types.go
@@ -13,6 +13,7 @@ import (
 	k8sRuntime "k8s.io/apimachinery/pkg/runtime"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
@@ -20,24 +21,24 @@ type Config struct {
 }
 
 type ConfigSpec struct {
+	// StorageClass used to store the data.
+	// +kubebuilder:default:="replicated"
+	StorageClass string `json:"storageClass"`
+	// Worker nodes configuration map.
+	// +kubebuilder:default:={"md0":{"ephemeralStorage":"20Gi","gpus":{},"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":{"ingress-nginx"}}}
+	NodeGroups map[string]NodeGroup `json:"nodeGroups,omitempty"`
+	// Kubernetes major.minor version to deploy
+	// +kubebuilder:default:="v1.35"
+	Version Version `json:"version"`
+	// External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.
+	// +kubebuilder:default:=""
+	Host string `json:"host"`
 	// Cluster addons configuration.
 	// +kubebuilder:default:={}
 	Addons Addons `json:"addons"`
 	// Kubernetes control-plane configuration.
 	// +kubebuilder:default:={}
 	ControlPlane ControlPlane `json:"controlPlane"`
-	// External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.
-	// +kubebuilder:default:=""
-	Host string `json:"host"`
-	// Worker nodes configuration map.
-	// +kubebuilder:default:={"md0":{"ephemeralStorage":"20Gi","gpus":{},"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":{"ingress-nginx"}}}
-	NodeGroups map[string]NodeGroup `json:"nodeGroups,omitempty"`
-	// StorageClass used to store the data.
-	// +kubebuilder:default:="replicated"
-	StorageClass string `json:"storageClass"`
-	// Kubernetes major.minor version to deploy
-	// +kubebuilder:default:="v1.35"
-	Version Version `json:"version"`
 }
 
 type APIServer struct {
diff --git a/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go b/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go
index 3c20519c..2cbe3ba1 100644
--- a/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go
@@ -20,7 +20,9 @@ limitations under the License.
 
 package kubernetes
 
-import ()
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *APIServer) DeepCopyInto(out *APIServer) {
@@ -113,11 +115,17 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
-	in.Addons.DeepCopyInto(&out.Addons)
-	in.ControlPlane.DeepCopyInto(&out.ControlPlane)
 	if in.NodeGroups != nil {
 		in, out := &in.NodeGroups, &out.NodeGroups
 		*out = make(map[string]NodeGroup, len(*in))
@@ -125,6 +133,8 @@ func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 			(*out)[key] = *val.DeepCopy()
 		}
 	}
+	in.Addons.DeepCopyInto(&out.Addons)
+	in.ControlPlane.DeepCopyInto(&out.ControlPlane)
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
diff --git a/api/apps/v1alpha1/mariadb/types.go b/api/apps/v1alpha1/mariadb/types.go
index 5520b5ed..c456c64f 100644
--- a/api/apps/v1alpha1/mariadb/types.go
+++ b/api/apps/v1alpha1/mariadb/types.go
@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
@@ -19,15 +20,6 @@ type Config struct {
 }
 
 type ConfigSpec struct {
-	// Backup configuration.
-	// +kubebuilder:default:={}
-	Backup Backup `json:"backup"`
-	// Databases configuration map.
-	// +kubebuilder:default:={}
-	Databases map[string]Database `json:"databases,omitempty"`
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
 	// Number of MariaDB replicas.
 	// +kubebuilder:default:=2
 	Replicas int `json:"replicas"`
@@ -43,12 +35,21 @@ type ConfigSpec struct {
 	// StorageClass used to store the data.
 	// +kubebuilder:default:=""
 	StorageClass string `json:"storageClass"`
-	// Users configuration map.
-	// +kubebuilder:default:={}
-	Users map[string]User `json:"users,omitempty"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
 	// MariaDB major.minor version to deploy
 	// +kubebuilder:default:="v11.8"
 	Version Version `json:"version"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+	// Databases configuration map.
+	// +kubebuilder:default:={}
+	Databases map[string]Database `json:"databases,omitempty"`
+	// Backup configuration.
+	// +kubebuilder:default:={}
+	Backup Backup `json:"backup"`
 }
 
 type Backup struct {
diff --git a/api/apps/v1alpha1/mariadb/zz_generated.deepcopy.go b/api/apps/v1alpha1/mariadb/zz_generated.deepcopy.go
index 05df8ad0..4cc5a94f 100644
--- a/api/apps/v1alpha1/mariadb/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/mariadb/zz_generated.deepcopy.go
@@ -20,7 +20,9 @@ limitations under the License.
 
 package mariadb
 
-import ()
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Backup) DeepCopyInto(out *Backup) {
@@ -55,17 +57,17 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
-	out.Backup = in.Backup
-	if in.Databases != nil {
-		in, out := &in.Databases, &out.Databases
-		*out = make(map[string]Database, len(*in))
-		for key, val := range *in {
-			(*out)[key] = *val.DeepCopy()
-		}
-	}
 	in.Resources.DeepCopyInto(&out.Resources)
 	out.Size = in.Size.DeepCopy()
 	if in.Users != nil {
@@ -75,6 +77,14 @@ func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 			(*out)[key] = val
 		}
 	}
+	if in.Databases != nil {
+		in, out := &in.Databases, &out.Databases
+		*out = make(map[string]Database, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+	out.Backup = in.Backup
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
diff --git a/api/apps/v1alpha1/mongodb/types.go b/api/apps/v1alpha1/mongodb/types.go
index 14564f7d..c5e23838 100644
--- a/api/apps/v1alpha1/mongodb/types.go
+++ b/api/apps/v1alpha1/mongodb/types.go
@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
@@ -19,18 +20,6 @@ type Config struct {
 }
 
 type ConfigSpec struct {
-	// Backup configuration.
-	// +kubebuilder:default:={}
-	Backup Backup `json:"backup"`
-	// Bootstrap configuration.
-	// +kubebuilder:default:={}
-	Bootstrap Bootstrap `json:"bootstrap"`
-	// Databases configuration map.
-	// +kubebuilder:default:={}
-	Databases map[string]Database `json:"databases,omitempty"`
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
 	// Number of MongoDB replicas in replica set.
 	// +kubebuilder:default:=3
 	Replicas int `json:"replicas"`
@@ -40,24 +29,36 @@ type ConfigSpec struct {
 	// Default sizing preset used when `resources` is omitted.
 	// +kubebuilder:default:="small"
 	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-	// Enable sharded cluster mode. When disabled, deploys a replica set.
-	// +kubebuilder:default:=false
-	Sharding bool `json:"sharding"`
-	// Configuration for sharded cluster mode.
-	// +kubebuilder:default:={}
-	ShardingConfig ShardingConfig `json:"shardingConfig"`
 	// Persistent Volume Claim size available for application data.
 	// +kubebuilder:default:="10Gi"
 	Size resource.Quantity `json:"size"`
 	// StorageClass used to store the data.
 	// +kubebuilder:default:=""
 	StorageClass string `json:"storageClass"`
-	// Users configuration map.
-	// +kubebuilder:default:={}
-	Users map[string]User `json:"users,omitempty"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
 	// MongoDB major version to deploy.
 	// +kubebuilder:default:="v8"
 	Version Version `json:"version"`
+	// Enable sharded cluster mode. When disabled, deploys a replica set.
+	// +kubebuilder:default:=false
+	Sharding bool `json:"sharding"`
+	// Configuration for sharded cluster mode.
+	// +kubebuilder:default:={}
+	ShardingConfig ShardingConfig `json:"shardingConfig"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+	// Databases configuration map.
+	// +kubebuilder:default:={}
+	Databases map[string]Database `json:"databases,omitempty"`
+	// Backup configuration.
+	// +kubebuilder:default:={}
+	Backup Backup `json:"backup"`
+	// Bootstrap configuration.
+	// +kubebuilder:default:={}
+	Bootstrap Bootstrap `json:"bootstrap"`
 }
 
 type Backup struct {
diff --git a/api/apps/v1alpha1/mongodb/zz_generated.deepcopy.go b/api/apps/v1alpha1/mongodb/zz_generated.deepcopy.go
index 5b20c6d6..694009f4 100644
--- a/api/apps/v1alpha1/mongodb/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/mongodb/zz_generated.deepcopy.go
@@ -20,7 +20,9 @@ limitations under the License.
 
 package mongodb
 
-import ()
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Backup) DeepCopyInto(out *Backup) {
@@ -70,21 +72,20 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
-	out.Backup = in.Backup
-	out.Bootstrap = in.Bootstrap
-	if in.Databases != nil {
-		in, out := &in.Databases, &out.Databases
-		*out = make(map[string]Database, len(*in))
-		for key, val := range *in {
-			(*out)[key] = *val.DeepCopy()
-		}
-	}
 	in.Resources.DeepCopyInto(&out.Resources)
-	in.ShardingConfig.DeepCopyInto(&out.ShardingConfig)
 	out.Size = in.Size.DeepCopy()
+	in.ShardingConfig.DeepCopyInto(&out.ShardingConfig)
 	if in.Users != nil {
 		in, out := &in.Users, &out.Users
 		*out = make(map[string]User, len(*in))
@@ -92,6 +93,15 @@ func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 			(*out)[key] = val
 		}
 	}
+	if in.Databases != nil {
+		in, out := &in.Databases, &out.Databases
+		*out = make(map[string]Database, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+	out.Backup = in.Backup
+	out.Bootstrap = in.Bootstrap
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
diff --git a/api/apps/v1alpha1/nats/types.go b/api/apps/v1alpha1/nats/types.go
index 449ac20a..b165dac5 100644
--- a/api/apps/v1alpha1/nats/types.go
+++ b/api/apps/v1alpha1/nats/types.go
@@ -13,6 +13,7 @@ import (
 	k8sRuntime "k8s.io/apimachinery/pkg/runtime"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
@@ -20,15 +21,6 @@ type Config struct {
 }
 
 type ConfigSpec struct {
-	// NATS configuration.
-	// +kubebuilder:default:={}
-	Config ValuesConfig `json:"config"`
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
-	// Jetstream configuration.
-	// +kubebuilder:default:={}
-	Jetstream Jetstream `json:"jetstream"`
 	// Number of replicas.
 	// +kubebuilder:default:=2
 	Replicas int `json:"replicas"`
@@ -41,9 +33,18 @@ type ConfigSpec struct {
 	// StorageClass used to store the data.
 	// +kubebuilder:default:=""
 	StorageClass string `json:"storageClass"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
 	// Users configuration map.
 	// +kubebuilder:default:={}
 	Users map[string]User `json:"users,omitempty"`
+	// Jetstream configuration.
+	// +kubebuilder:default:={}
+	Jetstream Jetstream `json:"jetstream"`
+	// NATS configuration.
+	// +kubebuilder:default:={}
+	Config ValuesConfig `json:"config"`
 }
 
 type ValuesConfig struct {
diff --git a/api/apps/v1alpha1/nats/zz_generated.deepcopy.go b/api/apps/v1alpha1/nats/zz_generated.deepcopy.go
index bd13e721..f6c23cb1 100644
--- a/api/apps/v1alpha1/nats/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/nats/zz_generated.deepcopy.go
@@ -42,11 +42,17 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
-	in.Config.DeepCopyInto(&out.Config)
-	in.Jetstream.DeepCopyInto(&out.Jetstream)
 	in.Resources.DeepCopyInto(&out.Resources)
 	if in.Users != nil {
 		in, out := &in.Users, &out.Users
@@ -55,6 +61,8 @@ func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 			(*out)[key] = val
 		}
 	}
+	in.Jetstream.DeepCopyInto(&out.Jetstream)
+	in.Config.DeepCopyInto(&out.Config)
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
diff --git a/api/apps/v1alpha1/openbao/types.go b/api/apps/v1alpha1/openbao/types.go
index 43400e18..12fb9d5e 100644
--- a/api/apps/v1alpha1/openbao/types.go
+++ b/api/apps/v1alpha1/openbao/types.go
@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
@@ -19,9 +20,6 @@ type Config struct {
 }
 
 type ConfigSpec struct {
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
 	// Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas > 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration.
 	// +kubebuilder:default:=1
 	Replicas int `json:"replicas"`
@@ -37,6 +35,9 @@ type ConfigSpec struct {
 	// StorageClass used to store the data.
 	// +kubebuilder:default:=""
 	StorageClass string `json:"storageClass"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
 	// Enable the OpenBAO web UI.
 	// +kubebuilder:default:=true
 	Ui bool `json:"ui"`
diff --git a/api/apps/v1alpha1/openbao/zz_generated.deepcopy.go b/api/apps/v1alpha1/openbao/zz_generated.deepcopy.go
index 8ba57fbf..baa1258b 100644
--- a/api/apps/v1alpha1/openbao/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/openbao/zz_generated.deepcopy.go
@@ -20,7 +20,9 @@ limitations under the License.
 
 package openbao
 
-import ()
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Config) DeepCopyInto(out *Config) {
@@ -40,6 +42,14 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
diff --git a/api/apps/v1alpha1/postgresql/types.go b/api/apps/v1alpha1/postgresql/types.go
index 55c73310..fa7017e2 100644
--- a/api/apps/v1alpha1/postgresql/types.go
+++ b/api/apps/v1alpha1/postgresql/types.go
@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
@@ -19,24 +20,6 @@ type Config struct {
 }
 
 type ConfigSpec struct {
-	// Backup configuration.
-	// +kubebuilder:default:={}
-	Backup Backup `json:"backup"`
-	// Bootstrap configuration.
-	// +kubebuilder:default:={}
-	Bootstrap Bootstrap `json:"bootstrap"`
-	// Databases configuration map.
-	// +kubebuilder:default:={}
-	Databases map[string]Database `json:"databases,omitempty"`
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
-	// PostgreSQL server configuration.
-	// +kubebuilder:default:={}
-	Postgresql PostgreSQL `json:"postgresql"`
-	// Quorum configuration for synchronous replication.
-	// +kubebuilder:default:={}
-	Quorum Quorum `json:"quorum"`
 	// Number of Postgres replicas.
 	// +kubebuilder:default:=2
 	Replicas int `json:"replicas"`
@@ -52,12 +35,30 @@ type ConfigSpec struct {
 	// StorageClass used to store the data.
 	// +kubebuilder:default:=""
 	StorageClass string `json:"storageClass"`
-	// Users configuration map.
-	// +kubebuilder:default:={}
-	Users map[string]User `json:"users,omitempty"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
 	// PostgreSQL major version to deploy
 	// +kubebuilder:default:="v18"
 	Version Version `json:"version"`
+	// PostgreSQL server configuration.
+	// +kubebuilder:default:={}
+	Postgresql PostgreSQL `json:"postgresql"`
+	// Quorum configuration for synchronous replication.
+	// +kubebuilder:default:={}
+	Quorum Quorum `json:"quorum"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+	// Databases configuration map.
+	// +kubebuilder:default:={}
+	Databases map[string]Database `json:"databases,omitempty"`
+	// Backup configuration.
+	// +kubebuilder:default:={}
+	Backup Backup `json:"backup"`
+	// Bootstrap configuration.
+	// +kubebuilder:default:={}
+	Bootstrap Bootstrap `json:"bootstrap"`
 }
 
 type Backup struct {
diff --git a/api/apps/v1alpha1/postgresql/zz_generated.deepcopy.go b/api/apps/v1alpha1/postgresql/zz_generated.deepcopy.go
index 5dfe67de..5fba855e 100644
--- a/api/apps/v1alpha1/postgresql/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/postgresql/zz_generated.deepcopy.go
@@ -20,7 +20,9 @@ limitations under the License.
 
 package postgresql
 
-import ()
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Backup) DeepCopyInto(out *Backup) {
@@ -70,22 +72,21 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
-	out.Backup = in.Backup
-	out.Bootstrap = in.Bootstrap
-	if in.Databases != nil {
-		in, out := &in.Databases, &out.Databases
-		*out = make(map[string]Database, len(*in))
-		for key, val := range *in {
-			(*out)[key] = *val.DeepCopy()
-		}
-	}
-	out.Postgresql = in.Postgresql
-	out.Quorum = in.Quorum
 	in.Resources.DeepCopyInto(&out.Resources)
 	out.Size = in.Size.DeepCopy()
+	out.Postgresql = in.Postgresql
+	out.Quorum = in.Quorum
 	if in.Users != nil {
 		in, out := &in.Users, &out.Users
 		*out = make(map[string]User, len(*in))
@@ -93,6 +94,15 @@ func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 			(*out)[key] = val
 		}
 	}
+	if in.Databases != nil {
+		in, out := &in.Databases, &out.Databases
+		*out = make(map[string]Database, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+	out.Backup = in.Backup
+	out.Bootstrap = in.Bootstrap
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
diff --git a/api/apps/v1alpha1/qdrant/types.go b/api/apps/v1alpha1/qdrant/types.go
index d2735ce4..041c7e78 100644
--- a/api/apps/v1alpha1/qdrant/types.go
+++ b/api/apps/v1alpha1/qdrant/types.go
@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
@@ -19,9 +20,6 @@ type Config struct {
 }
 
 type ConfigSpec struct {
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
 	// Number of Qdrant replicas. Cluster mode is automatically enabled when replicas > 1.
 	// +kubebuilder:default:=1
 	Replicas int `json:"replicas"`
@@ -37,6 +35,9 @@ type ConfigSpec struct {
 	// StorageClass used to store the data.
 	// +kubebuilder:default:=""
 	StorageClass string `json:"storageClass"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
 }
 
 type Resources struct {
diff --git a/api/apps/v1alpha1/qdrant/zz_generated.deepcopy.go b/api/apps/v1alpha1/qdrant/zz_generated.deepcopy.go
index 46b4e838..2abfd37e 100644
--- a/api/apps/v1alpha1/qdrant/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/qdrant/zz_generated.deepcopy.go
@@ -20,7 +20,9 @@ limitations under the License.
 
 package qdrant
 
-import ()
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Config) DeepCopyInto(out *Config) {
@@ -40,6 +42,14 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
diff --git a/api/apps/v1alpha1/rabbitmq/types.go b/api/apps/v1alpha1/rabbitmq/types.go
index 1524455b..e8713e90 100644
--- a/api/apps/v1alpha1/rabbitmq/types.go
+++ b/api/apps/v1alpha1/rabbitmq/types.go
@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
@@ -19,9 +20,6 @@ type Config struct {
 }
 
 type ConfigSpec struct {
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
 	// Number of RabbitMQ replicas.
 	// +kubebuilder:default:=3
 	Replicas int `json:"replicas"`
@@ -37,12 +35,15 @@ type ConfigSpec struct {
 	// StorageClass used to store the data.
 	// +kubebuilder:default:=""
 	StorageClass string `json:"storageClass"`
-	// Users configuration map.
-	// +kubebuilder:default:={}
-	Users map[string]User `json:"users,omitempty"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
 	// RabbitMQ major.minor version to deploy
 	// +kubebuilder:default:="v4.2"
 	Version Version `json:"version"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
 	// Virtual hosts configuration map.
 	// +kubebuilder:default:={}
 	Vhosts map[string]Vhost `json:"vhosts,omitempty"`
diff --git a/api/apps/v1alpha1/rabbitmq/zz_generated.deepcopy.go b/api/apps/v1alpha1/rabbitmq/zz_generated.deepcopy.go
index 81447693..a1d55f89 100644
--- a/api/apps/v1alpha1/rabbitmq/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/rabbitmq/zz_generated.deepcopy.go
@@ -20,7 +20,9 @@ limitations under the License.
 
 package rabbitmq
 
-import ()
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Config) DeepCopyInto(out *Config) {
@@ -40,6 +42,14 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
diff --git a/api/apps/v1alpha1/redis/types.go b/api/apps/v1alpha1/redis/types.go
index 8f0fcbd4..28a6c53a 100644
--- a/api/apps/v1alpha1/redis/types.go
+++ b/api/apps/v1alpha1/redis/types.go
@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
@@ -19,12 +20,6 @@ type Config struct {
 }
 
 type ConfigSpec struct {
-	// Enable password generation.
-	// +kubebuilder:default:=true
-	AuthEnabled bool `json:"authEnabled"`
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
 	// Number of Redis replicas.
 	// +kubebuilder:default:=2
 	Replicas int `json:"replicas"`
@@ -40,9 +35,15 @@ type ConfigSpec struct {
 	// StorageClass used to store the data.
 	// +kubebuilder:default:=""
 	StorageClass string `json:"storageClass"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
 	// Redis major version to deploy
 	// +kubebuilder:default:="v8"
 	Version Version `json:"version"`
+	// Enable password generation.
+	// +kubebuilder:default:=true
+	AuthEnabled bool `json:"authEnabled"`
 }
 
 type Resources struct {
diff --git a/api/apps/v1alpha1/redis/zz_generated.deepcopy.go b/api/apps/v1alpha1/redis/zz_generated.deepcopy.go
index 8b5a7620..6390200c 100644
--- a/api/apps/v1alpha1/redis/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/redis/zz_generated.deepcopy.go
@@ -20,7 +20,9 @@ limitations under the License.
 
 package redis
 
-import ()
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Config) DeepCopyInto(out *Config) {
@@ -40,6 +42,14 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
diff --git a/api/apps/v1alpha1/tcpbalancer/types.go b/api/apps/v1alpha1/tcpbalancer/types.go
index 45657fc0..cdb8d3dc 100644
--- a/api/apps/v1alpha1/tcpbalancer/types.go
+++ b/api/apps/v1alpha1/tcpbalancer/types.go
@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
@@ -19,12 +20,6 @@ type Config struct {
 }
 
 type ConfigSpec struct {
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
-	// HTTP and HTTPS configuration.
-	// +kubebuilder:default:={}
-	HttpAndHttps HttpAndHttps `json:"httpAndHttps"`
 	// Number of HAProxy replicas.
 	// +kubebuilder:default:=2
 	Replicas int `json:"replicas"`
@@ -34,12 +29,18 @@ type ConfigSpec struct {
 	// Default sizing preset used when `resources` is omitted.
 	// +kubebuilder:default:="nano"
 	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-	// List of allowed client networks.
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// HTTP and HTTPS configuration.
 	// +kubebuilder:default:={}
-	Whitelist []string `json:"whitelist,omitempty"`
+	HttpAndHttps HttpAndHttps `json:"httpAndHttps"`
 	// Secure HTTP by whitelisting client networks (default: false).
 	// +kubebuilder:default:=false
 	WhitelistHTTP bool `json:"whitelistHTTP"`
+	// List of allowed client networks.
+	// +kubebuilder:default:={}
+	Whitelist []string `json:"whitelist,omitempty"`
 }
 
 type HttpAndHttps struct {
diff --git a/api/apps/v1alpha1/tcpbalancer/zz_generated.deepcopy.go b/api/apps/v1alpha1/tcpbalancer/zz_generated.deepcopy.go
index fbd94c36..1c63eafc 100644
--- a/api/apps/v1alpha1/tcpbalancer/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/tcpbalancer/zz_generated.deepcopy.go
@@ -20,7 +20,9 @@ limitations under the License.
 
 package tcpbalancer
 
-import ()
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Config) DeepCopyInto(out *Config) {
@@ -40,11 +42,19 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
-	in.HttpAndHttps.DeepCopyInto(&out.HttpAndHttps)
 	in.Resources.DeepCopyInto(&out.Resources)
+	in.HttpAndHttps.DeepCopyInto(&out.HttpAndHttps)
 	if in.Whitelist != nil {
 		in, out := &in.Whitelist, &out.Whitelist
 		*out = make([]string, len(*in))
diff --git a/api/apps/v1alpha1/tenant/types.go b/api/apps/v1alpha1/tenant/types.go
index a193c2c6..1dd0ee58 100644
--- a/api/apps/v1alpha1/tenant/types.go
+++ b/api/apps/v1alpha1/tenant/types.go
@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
@@ -19,22 +20,25 @@ type Config struct {
 }
 
 type ConfigSpec struct {
-	// Deploy own Etcd cluster.
-	// +kubebuilder:default:=false
-	Etcd bool `json:"etcd"`
 	// The hostname used to access tenant services (defaults to using the tenant name as a subdomain for its parent tenant host).
 	// +kubebuilder:default:=""
 	Host string `json:"host,omitempty"`
-	// Deploy own Ingress Controller.
+	// Deploy own Etcd cluster.
 	// +kubebuilder:default:=false
-	Ingress bool `json:"ingress"`
+	Etcd bool `json:"etcd"`
 	// Deploy own Monitoring Stack.
 	// +kubebuilder:default:=false
 	Monitoring bool `json:"monitoring"`
-	// Define resource quotas for the tenant.
-	// +kubebuilder:default:={}
-	ResourceQuotas map[string]resource.Quantity `json:"resourceQuotas,omitempty"`
+	// Deploy own Ingress Controller.
+	// +kubebuilder:default:=false
+	Ingress bool `json:"ingress"`
 	// Deploy own SeaweedFS.
 	// +kubebuilder:default:=false
 	Seaweedfs bool `json:"seaweedfs"`
+	// The name of a SchedulingClass CR to apply scheduling constraints for this tenant's workloads.
+	// +kubebuilder:default:=""
+	SchedulingClass string `json:"schedulingClass,omitempty"`
+	// Define resource quotas for the tenant.
+	// +kubebuilder:default:={}
+	ResourceQuotas map[string]resource.Quantity `json:"resourceQuotas,omitempty"`
 }
diff --git a/api/apps/v1alpha1/tenant/zz_generated.deepcopy.go b/api/apps/v1alpha1/tenant/zz_generated.deepcopy.go
index 01e896f3..784a8f25 100644
--- a/api/apps/v1alpha1/tenant/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/tenant/zz_generated.deepcopy.go
@@ -22,6 +22,7 @@ package tenant
 
 import (
 	"k8s.io/apimachinery/pkg/api/resource"
+	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
@@ -42,6 +43,14 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
diff --git a/api/apps/v1alpha1/vmdisk/types.go b/api/apps/v1alpha1/vmdisk/types.go
index fdbcd47f..6637a620 100644
--- a/api/apps/v1alpha1/vmdisk/types.go
+++ b/api/apps/v1alpha1/vmdisk/types.go
@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
@@ -19,12 +20,12 @@ type Config struct {
 }
 
 type ConfigSpec struct {
-	// Defines if disk should be considered optical.
-	// +kubebuilder:default:=false
-	Optical bool `json:"optical"`
 	// The source image location used to create a disk.
 	// +kubebuilder:default:={}
 	Source Source `json:"source"`
+	// Defines if disk should be considered optical.
+	// +kubebuilder:default:=false
+	Optical bool `json:"optical"`
 	// The size of the disk allocated for the virtual machine.
 	// +kubebuilder:default:="5Gi"
 	Storage resource.Quantity `json:"storage"`
diff --git a/api/apps/v1alpha1/vmdisk/zz_generated.deepcopy.go b/api/apps/v1alpha1/vmdisk/zz_generated.deepcopy.go
index e874223b..e8ca986e 100644
--- a/api/apps/v1alpha1/vmdisk/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/vmdisk/zz_generated.deepcopy.go
@@ -20,7 +20,9 @@ limitations under the License.
 
 package vmdisk
 
-import ()
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Config) DeepCopyInto(out *Config) {
@@ -40,6 +42,14 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
diff --git a/api/apps/v1alpha1/vminstance/types.go b/api/apps/v1alpha1/vminstance/types.go
index 491a2b30..518070e0 100644
--- a/api/apps/v1alpha1/vminstance/types.go
+++ b/api/apps/v1alpha1/vminstance/types.go
@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
@@ -19,18 +20,6 @@ type Config struct {
 }
 
 type ConfigSpec struct {
-	// Cloud-init user data.
-	// +kubebuilder:default:=""
-	CloudInit string `json:"cloudInit"`
-	// Seed string to generate SMBIOS UUID for the VM.
-	// +kubebuilder:default:=""
-	CloudInitSeed string `json:"cloudInitSeed"`
-	// Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map
-	// +kubebuilder:default:=""
-	CpuModel string `json:"cpuModel"`
-	// List of disks to attach.
-	// +kubebuilder:default:={}
-	Disks []Disk `json:"disks,omitempty"`
 	// Enable external access from outside the cluster.
 	// +kubebuilder:default:=false
 	External bool `json:"external"`
@@ -40,27 +29,39 @@ type ConfigSpec struct {
 	// Ports to forward from outside the cluster.
 	// +kubebuilder:default:={22}
 	ExternalPorts []int `json:"externalPorts,omitempty"`
-	// List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).
-	// +kubebuilder:default:={}
-	Gpus []GPU `json:"gpus,omitempty"`
-	// Virtual Machine preferences profile.
-	// +kubebuilder:default:="ubuntu"
-	InstanceProfile string `json:"instanceProfile"`
-	// Virtual Machine instance type.
-	// +kubebuilder:default:="u1.medium"
-	InstanceType string `json:"instanceType"`
-	// Resource configuration for the virtual machine.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
 	// Requested running state of the VirtualMachineInstance
 	// +kubebuilder:default:="Always"
 	RunStrategy RunStrategy `json:"runStrategy"`
-	// List of SSH public keys for authentication.
+	// Virtual Machine instance type.
+	// +kubebuilder:default:="u1.medium"
+	InstanceType string `json:"instanceType"`
+	// Virtual Machine preferences profile.
+	// +kubebuilder:default:="ubuntu"
+	InstanceProfile string `json:"instanceProfile"`
+	// List of disks to attach.
 	// +kubebuilder:default:={}
-	SshKeys []string `json:"sshKeys,omitempty"`
+	Disks []Disk `json:"disks,omitempty"`
 	// Additional subnets
 	// +kubebuilder:default:={}
 	Subnets []Subnet `json:"subnets,omitempty"`
+	// List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).
+	// +kubebuilder:default:={}
+	Gpus []GPU `json:"gpus,omitempty"`
+	// Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map
+	// +kubebuilder:default:=""
+	CpuModel string `json:"cpuModel"`
+	// Resource configuration for the virtual machine.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// List of SSH public keys for authentication.
+	// +kubebuilder:default:={}
+	SshKeys []string `json:"sshKeys,omitempty"`
+	// Cloud-init user data.
+	// +kubebuilder:default:=""
+	CloudInit string `json:"cloudInit"`
+	// Seed string to generate SMBIOS UUID for the VM.
+	// +kubebuilder:default:=""
+	CloudInitSeed string `json:"cloudInitSeed"`
 }
 
 type Disk struct {
diff --git a/api/apps/v1alpha1/vminstance/zz_generated.deepcopy.go b/api/apps/v1alpha1/vminstance/zz_generated.deepcopy.go
index d0ba0d35..00b2a710 100644
--- a/api/apps/v1alpha1/vminstance/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/vminstance/zz_generated.deepcopy.go
@@ -20,7 +20,9 @@ limitations under the License.
 
 package vminstance
 
-import ()
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Config) DeepCopyInto(out *Config) {
@@ -40,17 +42,30 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
+	if in.ExternalPorts != nil {
+		in, out := &in.ExternalPorts, &out.ExternalPorts
+		*out = make([]int, len(*in))
+		copy(*out, *in)
+	}
 	if in.Disks != nil {
 		in, out := &in.Disks, &out.Disks
 		*out = make([]Disk, len(*in))
 		copy(*out, *in)
 	}
-	if in.ExternalPorts != nil {
-		in, out := &in.ExternalPorts, &out.ExternalPorts
-		*out = make([]int, len(*in))
+	if in.Subnets != nil {
+		in, out := &in.Subnets, &out.Subnets
+		*out = make([]Subnet, len(*in))
 		copy(*out, *in)
 	}
 	if in.Gpus != nil {
@@ -64,11 +79,6 @@ func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 		*out = make([]string, len(*in))
 		copy(*out, *in)
 	}
-	if in.Subnets != nil {
-		in, out := &in.Subnets, &out.Subnets
-		*out = make([]Subnet, len(*in))
-		copy(*out, *in)
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
diff --git a/api/apps/v1alpha1/vpc/types.go b/api/apps/v1alpha1/vpc/types.go
index 6b216044..3f770050 100644
--- a/api/apps/v1alpha1/vpc/types.go
+++ b/api/apps/v1alpha1/vpc/types.go
@@ -11,6 +11,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/api/apps/v1alpha1/vpc/zz_generated.deepcopy.go b/api/apps/v1alpha1/vpc/zz_generated.deepcopy.go
index bb6fb69c..cd718167 100644
--- a/api/apps/v1alpha1/vpc/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/vpc/zz_generated.deepcopy.go
@@ -20,7 +20,9 @@ limitations under the License.
 
 package vpc
 
-import ()
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Config) DeepCopyInto(out *Config) {
@@ -40,6 +42,14 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
diff --git a/api/apps/v1alpha1/vpn/types.go b/api/apps/v1alpha1/vpn/types.go
index fbada3e8..f2c3c87a 100644
--- a/api/apps/v1alpha1/vpn/types.go
+++ b/api/apps/v1alpha1/vpn/types.go
@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+// +kubebuilder:object:root=true
 type Config struct {
 	v1.TypeMeta   `json:",inline"`
 	v1.ObjectMeta `json:"metadata,omitempty"`
@@ -19,15 +20,6 @@ type Config struct {
 }
 
 type ConfigSpec struct {
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
-	// List of externalIPs for service. Optional. If not specified, will use LoadBalancer service by default.
-	// +kubebuilder:default:={}
-	ExternalIPs []string `json:"externalIPs,omitempty"`
-	// Host used to substitute into generated URLs.
-	// +kubebuilder:default:=""
-	Host string `json:"host"`
 	// Number of VPN server replicas.
 	// +kubebuilder:default:=2
 	Replicas int `json:"replicas"`
@@ -37,9 +29,18 @@ type ConfigSpec struct {
 	// Default sizing preset used when `resources` is omitted.
 	// +kubebuilder:default:="nano"
 	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Host used to substitute into generated URLs.
+	// +kubebuilder:default:=""
+	Host string `json:"host"`
 	// Users configuration map.
 	// +kubebuilder:default:={}
 	Users map[string]User `json:"users,omitempty"`
+	// List of externalIPs for service. Optional. If not specified, will use LoadBalancer service by default.
+	// +kubebuilder:default:={}
+	ExternalIPs []string `json:"externalIPs,omitempty"`
 }
 
 type Resources struct {
diff --git a/api/apps/v1alpha1/vpn/zz_generated.deepcopy.go b/api/apps/v1alpha1/vpn/zz_generated.deepcopy.go
index db1943b2..a3595bb0 100644
--- a/api/apps/v1alpha1/vpn/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/vpn/zz_generated.deepcopy.go
@@ -20,7 +20,9 @@ limitations under the License.
 
 package vpn
 
-import ()
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Config) DeepCopyInto(out *Config) {
@@ -40,14 +42,17 @@ func (in *Config) DeepCopy() *Config {
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
-	if in.ExternalIPs != nil {
-		in, out := &in.ExternalIPs, &out.ExternalIPs
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
 	in.Resources.DeepCopyInto(&out.Resources)
 	if in.Users != nil {
 		in, out := &in.Users, &out.Users
@@ -56,6 +61,11 @@ func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 			(*out)[key] = val
 		}
 	}
+	if in.ExternalIPs != nil {
+		in, out := &in.ExternalIPs, &out.ExternalIPs
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh
index 96956965..e8f19e43 100755
--- a/hack/update-codegen.sh
+++ b/hack/update-codegen.sh
@@ -81,5 +81,10 @@ mv ${TMPDIR}/strategy.backups.cozystack.io*.yaml ${BACKUPSTRATEGY_CRDDIR}/
 
 mv ${TMPDIR}/*.yaml ${COZY_CONTROLLER_CRDDIR}/
 
+# Generate deepcopy for standalone api/apps/v1alpha1 submodule (separate Go module)
+# Use absolute path for headerFile since we cd into the submodule directory
+APPS_API_ROOT="$(cd "${SCRIPT_ROOT}" && pwd)"
+(cd "${APPS_API_ROOT}/api/apps/v1alpha1" && $CONTROLLER_GEN object:headerFile="${APPS_API_ROOT}/hack/boilerplate.go.txt" paths="./...")
+
 # Tidy dependencies for standalone api/apps/v1alpha1 submodule
 (cd "${SCRIPT_ROOT}/api/apps/v1alpha1" && go mod tidy)
diff --git a/packages/apps/bucket/values.schema.json b/packages/apps/bucket/values.schema.json
index ef213a18..d302842c 100644
--- a/packages/apps/bucket/values.schema.json
+++ b/packages/apps/bucket/values.schema.json
@@ -27,4 +27,4 @@
       }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/clickhouse/values.schema.json b/packages/apps/clickhouse/values.schema.json
index abb3aeb1..e4e1df7d 100644
--- a/packages/apps/clickhouse/values.schema.json
+++ b/packages/apps/clickhouse/values.schema.json
@@ -2,6 +2,119 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
+    "replicas": {
+      "description": "Number of ClickHouse replicas.",
+      "type": "integer",
+      "default": 2
+    },
+    "shards": {
+      "description": "Number of ClickHouse shards.",
+      "type": "integer",
+      "default": 1
+    },
+    "resources": {
+      "description": "Explicit CPU and memory configuration for each ClickHouse replica. When omitted, the preset defined in `resourcesPreset` is applied.",
+      "type": "object",
+      "default": {},
+      "properties": {
+        "cpu": {
+          "description": "CPU available to each replica.",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        },
+        "memory": {
+          "description": "Memory (RAM) available to each replica.",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        }
+      }
+    },
+    "resourcesPreset": {
+      "description": "Default sizing preset used when `resources` is omitted.",
+      "type": "string",
+      "default": "small",
+      "enum": [
+        "nano",
+        "micro",
+        "small",
+        "medium",
+        "large",
+        "xlarge",
+        "2xlarge"
+      ]
+    },
+    "size": {
+      "description": "Persistent Volume Claim size available for application data.",
+      "default": "10Gi",
+      "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+      "anyOf": [
+        {
+          "type": "integer"
+        },
+        {
+          "type": "string"
+        }
+      ],
+      "x-kubernetes-int-or-string": true
+    },
+    "storageClass": {
+      "description": "StorageClass used to store the data.",
+      "type": "string",
+      "default": ""
+    },
+    "logStorageSize": {
+      "description": "Size of Persistent Volume for logs.",
+      "default": "2Gi",
+      "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+      "anyOf": [
+        {
+          "type": "integer"
+        },
+        {
+          "type": "string"
+        }
+      ],
+      "x-kubernetes-int-or-string": true
+    },
+    "logTTL": {
+      "description": "TTL (expiration time) for `query_log` and `query_thread_log`.",
+      "type": "integer",
+      "default": 15
+    },
+    "users": {
+      "description": "Users configuration map.",
+      "type": "object",
+      "default": {},
+      "additionalProperties": {
+        "type": "object",
+        "properties": {
+          "password": {
+            "description": "Password for the user.",
+            "type": "string"
+          },
+          "readonly": {
+            "description": "User is readonly (default: false).",
+            "type": "boolean"
+          }
+        }
+      }
+    },
     "backup": {
       "description": "Backup configuration.",
       "type": "object",
@@ -103,119 +216,6 @@
           "x-kubernetes-int-or-string": true
         }
       }
-    },
-    "logStorageSize": {
-      "description": "Size of Persistent Volume for logs.",
-      "default": "2Gi",
-      "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-      "anyOf": [
-        {
-          "type": "integer"
-        },
-        {
-          "type": "string"
-        }
-      ],
-      "x-kubernetes-int-or-string": true
-    },
-    "logTTL": {
-      "description": "TTL (expiration time) for `query_log` and `query_thread_log`.",
-      "type": "integer",
-      "default": 15
-    },
-    "replicas": {
-      "description": "Number of ClickHouse replicas.",
-      "type": "integer",
-      "default": 2
-    },
-    "resources": {
-      "description": "Explicit CPU and memory configuration for each ClickHouse replica. When omitted, the preset defined in `resourcesPreset` is applied.",
-      "type": "object",
-      "default": {},
-      "properties": {
-        "cpu": {
-          "description": "CPU available to each replica.",
-          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "string"
-            }
-          ],
-          "x-kubernetes-int-or-string": true
-        },
-        "memory": {
-          "description": "Memory (RAM) available to each replica.",
-          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "string"
-            }
-          ],
-          "x-kubernetes-int-or-string": true
-        }
-      }
-    },
-    "resourcesPreset": {
-      "description": "Default sizing preset used when `resources` is omitted.",
-      "type": "string",
-      "default": "small",
-      "enum": [
-        "nano",
-        "micro",
-        "small",
-        "medium",
-        "large",
-        "xlarge",
-        "2xlarge"
-      ]
-    },
-    "shards": {
-      "description": "Number of ClickHouse shards.",
-      "type": "integer",
-      "default": 1
-    },
-    "size": {
-      "description": "Persistent Volume Claim size available for application data.",
-      "default": "10Gi",
-      "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-      "anyOf": [
-        {
-          "type": "integer"
-        },
-        {
-          "type": "string"
-        }
-      ],
-      "x-kubernetes-int-or-string": true
-    },
-    "storageClass": {
-      "description": "StorageClass used to store the data.",
-      "type": "string",
-      "default": ""
-    },
-    "users": {
-      "description": "Users configuration map.",
-      "type": "object",
-      "default": {},
-      "additionalProperties": {
-        "type": "object",
-        "properties": {
-          "password": {
-            "description": "Password for the user.",
-            "type": "string"
-          },
-          "readonly": {
-            "description": "User is readonly (default: false).",
-            "type": "boolean"
-          }
-        }
-      }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/foundationdb/values.schema.json b/packages/apps/foundationdb/values.schema.json
index 7b3a1ba5..1fc77d59 100644
--- a/packages/apps/foundationdb/values.schema.json
+++ b/packages/apps/foundationdb/values.schema.json
@@ -2,82 +2,6 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
-    "automaticReplacements": {
-      "description": "Enable automatic pod replacements.",
-      "type": "boolean",
-      "default": true
-    },
-    "backup": {
-      "description": "Backup configuration.",
-      "type": "object",
-      "default": {},
-      "required": [
-        "enabled",
-        "retentionPolicy",
-        "s3"
-      ],
-      "properties": {
-        "enabled": {
-          "description": "Enable backups.",
-          "type": "boolean",
-          "default": false
-        },
-        "retentionPolicy": {
-          "description": "Retention policy for backups.",
-          "type": "string",
-          "default": "7d"
-        },
-        "s3": {
-          "description": "S3 configuration for backups.",
-          "type": "object",
-          "default": {},
-          "required": [
-            "bucket",
-            "credentials",
-            "endpoint",
-            "region"
-          ],
-          "properties": {
-            "bucket": {
-              "description": "S3 bucket name.",
-              "type": "string",
-              "default": ""
-            },
-            "credentials": {
-              "description": "S3 credentials.",
-              "type": "object",
-              "default": {},
-              "required": [
-                "accessKeyId",
-                "secretAccessKey"
-              ],
-              "properties": {
-                "accessKeyId": {
-                  "description": "S3 access key ID.",
-                  "type": "string",
-                  "default": ""
-                },
-                "secretAccessKey": {
-                  "description": "S3 secret access key.",
-                  "type": "string",
-                  "default": ""
-                }
-              }
-            },
-            "endpoint": {
-              "description": "S3 endpoint URL.",
-              "type": "string",
-              "default": ""
-            },
-            "region": {
-              "description": "S3 region.",
-              "type": "string",
-              "default": "us-east-1"
-            }
-          }
-        }
-      }
-    },
     "cluster": {
       "description": "Cluster configuration.",
       "type": "object",
@@ -155,35 +79,33 @@
         }
       }
     },
-    "customParameters": {
-      "description": "Custom parameters to pass to FoundationDB.",
-      "type": "array",
-      "default": [],
-      "items": {
-        "type": "string"
-      }
-    },
-    "imageType": {
-      "description": "Container image deployment type.",
-      "type": "string",
-      "default": "unified",
-      "enum": [
-        "unified",
-        "split"
-      ]
-    },
-    "monitoring": {
-      "description": "Monitoring configuration.",
+    "storage": {
+      "description": "Storage configuration.",
       "type": "object",
       "default": {},
       "required": [
-        "enabled"
+        "size",
+        "storageClass"
       ],
       "properties": {
-        "enabled": {
-          "description": "Enable WorkloadMonitor integration.",
-          "type": "boolean",
-          "default": true
+        "size": {
+          "description": "Size of persistent volumes for each instance.",
+          "default": "16Gi",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        },
+        "storageClass": {
+          "description": "Storage class (if not set, uses cluster default).",
+          "type": "string",
+          "default": ""
         }
       }
     },
@@ -232,6 +154,109 @@
         "2xlarge"
       ]
     },
+    "backup": {
+      "description": "Backup configuration.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "enabled",
+        "retentionPolicy",
+        "s3"
+      ],
+      "properties": {
+        "enabled": {
+          "description": "Enable backups.",
+          "type": "boolean",
+          "default": false
+        },
+        "retentionPolicy": {
+          "description": "Retention policy for backups.",
+          "type": "string",
+          "default": "7d"
+        },
+        "s3": {
+          "description": "S3 configuration for backups.",
+          "type": "object",
+          "default": {},
+          "required": [
+            "bucket",
+            "credentials",
+            "endpoint",
+            "region"
+          ],
+          "properties": {
+            "bucket": {
+              "description": "S3 bucket name.",
+              "type": "string",
+              "default": ""
+            },
+            "credentials": {
+              "description": "S3 credentials.",
+              "type": "object",
+              "default": {},
+              "required": [
+                "accessKeyId",
+                "secretAccessKey"
+              ],
+              "properties": {
+                "accessKeyId": {
+                  "description": "S3 access key ID.",
+                  "type": "string",
+                  "default": ""
+                },
+                "secretAccessKey": {
+                  "description": "S3 secret access key.",
+                  "type": "string",
+                  "default": ""
+                }
+              }
+            },
+            "endpoint": {
+              "description": "S3 endpoint URL.",
+              "type": "string",
+              "default": ""
+            },
+            "region": {
+              "description": "S3 region.",
+              "type": "string",
+              "default": "us-east-1"
+            }
+          }
+        }
+      }
+    },
+    "monitoring": {
+      "description": "Monitoring configuration.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "enabled"
+      ],
+      "properties": {
+        "enabled": {
+          "description": "Enable WorkloadMonitor integration.",
+          "type": "boolean",
+          "default": true
+        }
+      }
+    },
+    "customParameters": {
+      "description": "Custom parameters to pass to FoundationDB.",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "string"
+      }
+    },
+    "imageType": {
+      "description": "Container image deployment type.",
+      "type": "string",
+      "default": "unified",
+      "enum": [
+        "unified",
+        "split"
+      ]
+    },
     "securityContext": {
       "description": "Security context for containers.",
       "type": "object",
@@ -253,35 +278,10 @@
         }
       }
     },
-    "storage": {
-      "description": "Storage configuration.",
-      "type": "object",
-      "default": {},
-      "required": [
-        "size",
-        "storageClass"
-      ],
-      "properties": {
-        "size": {
-          "description": "Size of persistent volumes for each instance.",
-          "default": "16Gi",
-          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "string"
-            }
-          ],
-          "x-kubernetes-int-or-string": true
-        },
-        "storageClass": {
-          "description": "Storage class (if not set, uses cluster default).",
-          "type": "string",
-          "default": ""
-        }
-      }
+    "automaticReplacements": {
+      "description": "Enable automatic pod replacements.",
+      "type": "boolean",
+      "default": true
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/harbor/values.schema.json b/packages/apps/harbor/values.schema.json
index 1352f5dc..23860ca3 100644
--- a/packages/apps/harbor/values.schema.json
+++ b/packages/apps/harbor/values.schema.json
@@ -2,6 +2,16 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
+    "host": {
+      "description": "Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).",
+      "type": "string",
+      "default": ""
+    },
+    "storageClass": {
+      "description": "StorageClass used to store the data.",
+      "type": "string",
+      "default": ""
+    },
     "core": {
       "description": "Core API server configuration.",
       "type": "object",
@@ -56,125 +66,6 @@
         }
       }
     },
-    "database": {
-      "description": "PostgreSQL database configuration.",
-      "type": "object",
-      "default": {},
-      "required": [
-        "replicas",
-        "size"
-      ],
-      "properties": {
-        "replicas": {
-          "description": "Number of database instances.",
-          "type": "integer",
-          "default": 2
-        },
-        "size": {
-          "description": "Persistent Volume size for database storage.",
-          "default": "5Gi",
-          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "string"
-            }
-          ],
-          "x-kubernetes-int-or-string": true
-        }
-      }
-    },
-    "host": {
-      "description": "Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).",
-      "type": "string",
-      "default": ""
-    },
-    "jobservice": {
-      "description": "Background job service configuration.",
-      "type": "object",
-      "default": {},
-      "properties": {
-        "resources": {
-          "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
-          "type": "object",
-          "default": {},
-          "properties": {
-            "cpu": {
-              "description": "Number of CPU cores allocated.",
-              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-              "anyOf": [
-                {
-                  "type": "integer"
-                },
-                {
-                  "type": "string"
-                }
-              ],
-              "x-kubernetes-int-or-string": true
-            },
-            "memory": {
-              "description": "Amount of memory allocated.",
-              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-              "anyOf": [
-                {
-                  "type": "integer"
-                },
-                {
-                  "type": "string"
-                }
-              ],
-              "x-kubernetes-int-or-string": true
-            }
-          }
-        },
-        "resourcesPreset": {
-          "description": "Default sizing preset used when `resources` is omitted.",
-          "type": "string",
-          "default": "nano",
-          "enum": [
-            "nano",
-            "micro",
-            "small",
-            "medium",
-            "large",
-            "xlarge",
-            "2xlarge"
-          ]
-        }
-      }
-    },
-    "redis": {
-      "description": "Redis cache configuration.",
-      "type": "object",
-      "default": {},
-      "required": [
-        "replicas",
-        "size"
-      ],
-      "properties": {
-        "replicas": {
-          "description": "Number of Redis replicas.",
-          "type": "integer",
-          "default": 2
-        },
-        "size": {
-          "description": "Persistent Volume size for cache storage.",
-          "default": "1Gi",
-          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "string"
-            }
-          ],
-          "x-kubernetes-int-or-string": true
-        }
-      }
-    },
     "registry": {
       "description": "Container image registry configuration.",
       "type": "object",
@@ -229,10 +120,59 @@
         }
       }
     },
-    "storageClass": {
-      "description": "StorageClass used to store the data.",
-      "type": "string",
-      "default": ""
+    "jobservice": {
+      "description": "Background job service configuration.",
+      "type": "object",
+      "default": {},
+      "properties": {
+        "resources": {
+          "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
+          "type": "object",
+          "default": {},
+          "properties": {
+            "cpu": {
+              "description": "Number of CPU cores allocated.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            },
+            "memory": {
+              "description": "Amount of memory allocated.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            }
+          }
+        },
+        "resourcesPreset": {
+          "description": "Default sizing preset used when `resources` is omitted.",
+          "type": "string",
+          "default": "nano",
+          "enum": [
+            "nano",
+            "micro",
+            "small",
+            "medium",
+            "large",
+            "xlarge",
+            "2xlarge"
+          ]
+        }
+      }
     },
     "trivy": {
       "description": "Trivy vulnerability scanner configuration.",
@@ -310,6 +250,66 @@
           "x-kubernetes-int-or-string": true
         }
       }
+    },
+    "database": {
+      "description": "PostgreSQL database configuration.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "replicas",
+        "size"
+      ],
+      "properties": {
+        "replicas": {
+          "description": "Number of database instances.",
+          "type": "integer",
+          "default": 2
+        },
+        "size": {
+          "description": "Persistent Volume size for database storage.",
+          "default": "5Gi",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        }
+      }
+    },
+    "redis": {
+      "description": "Redis cache configuration.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "replicas",
+        "size"
+      ],
+      "properties": {
+        "replicas": {
+          "description": "Number of Redis replicas.",
+          "type": "integer",
+          "default": 2
+        },
+        "size": {
+          "description": "Persistent Volume size for cache storage.",
+          "default": "1Gi",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        }
+      }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/http-cache/values.schema.json b/packages/apps/http-cache/values.schema.json
index 7fd1a37a..14609cc3 100644
--- a/packages/apps/http-cache/values.schema.json
+++ b/packages/apps/http-cache/values.schema.json
@@ -2,6 +2,30 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
+    "size": {
+      "description": "Persistent Volume Claim size available for application data.",
+      "default": "10Gi",
+      "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+      "anyOf": [
+        {
+          "type": "integer"
+        },
+        {
+          "type": "string"
+        }
+      ],
+      "x-kubernetes-int-or-string": true
+    },
+    "storageClass": {
+      "description": "StorageClass used to store the data.",
+      "type": "string",
+      "default": ""
+    },
+    "external": {
+      "description": "Enable external access from outside the cluster.",
+      "type": "boolean",
+      "default": false
+    },
     "endpoints": {
       "description": "Endpoints configuration, as a list of \u003cip:port\u003e.",
       "type": "array",
@@ -10,11 +34,6 @@
         "type": "string"
       }
     },
-    "external": {
-      "description": "Enable external access from outside the cluster.",
-      "type": "boolean",
-      "default": false
-    },
     "haproxy": {
       "description": "HAProxy configuration.",
       "type": "object",
@@ -140,25 +159,6 @@
           ]
         }
       }
-    },
-    "size": {
-      "description": "Persistent Volume Claim size available for application data.",
-      "default": "10Gi",
-      "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-      "anyOf": [
-        {
-          "type": "integer"
-        },
-        {
-          "type": "string"
-        }
-      ],
-      "x-kubernetes-int-or-string": true
-    },
-    "storageClass": {
-      "description": "StorageClass used to store the data.",
-      "type": "string",
-      "default": ""
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/kafka/values.schema.json b/packages/apps/kafka/values.schema.json
index 4b375b63..e3b6db12 100644
--- a/packages/apps/kafka/values.schema.json
+++ b/packages/apps/kafka/values.schema.json
@@ -7,6 +7,39 @@
       "type": "boolean",
       "default": false
     },
+    "topics": {
+      "description": "Topics configuration.",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "object",
+        "required": [
+          "config",
+          "name",
+          "partitions",
+          "replicas"
+        ],
+        "properties": {
+          "config": {
+            "description": "Topic configuration.",
+            "type": "object",
+            "x-kubernetes-preserve-unknown-fields": true
+          },
+          "name": {
+            "description": "Topic name.",
+            "type": "string"
+          },
+          "partitions": {
+            "description": "Number of partitions.",
+            "type": "integer"
+          },
+          "replicas": {
+            "description": "Number of replicas.",
+            "type": "integer"
+          }
+        }
+      }
+    },
     "kafka": {
       "description": "Kafka configuration.",
       "type": "object",
@@ -91,39 +124,6 @@
         }
       }
     },
-    "topics": {
-      "description": "Topics configuration.",
-      "type": "array",
-      "default": [],
-      "items": {
-        "type": "object",
-        "required": [
-          "config",
-          "name",
-          "partitions",
-          "replicas"
-        ],
-        "properties": {
-          "config": {
-            "description": "Topic configuration.",
-            "type": "object",
-            "x-kubernetes-preserve-unknown-fields": true
-          },
-          "name": {
-            "description": "Topic name.",
-            "type": "string"
-          },
-          "partitions": {
-            "description": "Number of partitions.",
-            "type": "integer"
-          },
-          "replicas": {
-            "description": "Number of replicas.",
-            "type": "integer"
-          }
-        }
-      }
-    },
     "zookeeper": {
       "description": "ZooKeeper configuration.",
       "type": "object",
@@ -209,4 +209,4 @@
       }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/kubernetes/values.schema.json b/packages/apps/kubernetes/values.schema.json
index 15f600a8..1beeff9c 100644
--- a/packages/apps/kubernetes/values.schema.json
+++ b/packages/apps/kubernetes/values.schema.json
@@ -2,6 +2,142 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
+    "storageClass": {
+      "description": "StorageClass used to store the data.",
+      "type": "string",
+      "default": "replicated"
+    },
+    "nodeGroups": {
+      "description": "Worker nodes configuration map.",
+      "type": "object",
+      "default": {
+        "md0": {
+          "ephemeralStorage": "20Gi",
+          "gpus": [],
+          "instanceType": "u1.medium",
+          "maxReplicas": 10,
+          "minReplicas": 0,
+          "resources": {},
+          "roles": [
+            "ingress-nginx"
+          ]
+        }
+      },
+      "additionalProperties": {
+        "type": "object",
+        "required": [
+          "ephemeralStorage",
+          "instanceType",
+          "maxReplicas",
+          "minReplicas",
+          "resources"
+        ],
+        "properties": {
+          "ephemeralStorage": {
+            "description": "Ephemeral storage size.",
+            "default": "20Gi",
+            "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "x-kubernetes-int-or-string": true
+          },
+          "gpus": {
+            "description": "List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).",
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": [
+                "name"
+              ],
+              "properties": {
+                "name": {
+                  "description": "Name of GPU, such as \"nvidia.com/AD102GL_L40S\".",
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "instanceType": {
+            "description": "Virtual machine instance type.",
+            "type": "string",
+            "default": "u1.medium"
+          },
+          "maxReplicas": {
+            "description": "Maximum number of replicas.",
+            "type": "integer",
+            "default": 10
+          },
+          "minReplicas": {
+            "description": "Minimum number of replicas.",
+            "type": "integer",
+            "default": 0
+          },
+          "resources": {
+            "description": "CPU and memory resources for each worker node.",
+            "type": "object",
+            "properties": {
+              "cpu": {
+                "description": "CPU available.",
+                "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                "anyOf": [
+                  {
+                    "type": "integer"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "x-kubernetes-int-or-string": true
+              },
+              "memory": {
+                "description": "Memory (RAM) available.",
+                "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                "anyOf": [
+                  {
+                    "type": "integer"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "x-kubernetes-int-or-string": true
+              }
+            }
+          },
+          "roles": {
+            "description": "List of node roles.",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      }
+    },
+    "version": {
+      "description": "Kubernetes major.minor version to deploy",
+      "type": "string",
+      "default": "v1.35",
+      "enum": [
+        "v1.35",
+        "v1.34",
+        "v1.33",
+        "v1.32",
+        "v1.31",
+        "v1.30"
+      ]
+    },
+    "host": {
+      "description": "External hostname for Kubernetes cluster. Defaults to `\u003ccluster-name\u003e.\u003ctenant-host\u003e` if empty.",
+      "type": "string",
+      "default": ""
+    },
     "addons": {
       "description": "Cluster addons configuration.",
       "type": "object",
@@ -494,142 +630,6 @@
           }
         }
       }
-    },
-    "host": {
-      "description": "External hostname for Kubernetes cluster. Defaults to `\u003ccluster-name\u003e.\u003ctenant-host\u003e` if empty.",
-      "type": "string",
-      "default": ""
-    },
-    "nodeGroups": {
-      "description": "Worker nodes configuration map.",
-      "type": "object",
-      "default": {
-        "md0": {
-          "ephemeralStorage": "20Gi",
-          "gpus": [],
-          "instanceType": "u1.medium",
-          "maxReplicas": 10,
-          "minReplicas": 0,
-          "resources": {},
-          "roles": [
-            "ingress-nginx"
-          ]
-        }
-      },
-      "additionalProperties": {
-        "type": "object",
-        "required": [
-          "ephemeralStorage",
-          "instanceType",
-          "maxReplicas",
-          "minReplicas",
-          "resources"
-        ],
-        "properties": {
-          "ephemeralStorage": {
-            "description": "Ephemeral storage size.",
-            "default": "20Gi",
-            "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-            "anyOf": [
-              {
-                "type": "integer"
-              },
-              {
-                "type": "string"
-              }
-            ],
-            "x-kubernetes-int-or-string": true
-          },
-          "gpus": {
-            "description": "List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).",
-            "type": "array",
-            "items": {
-              "type": "object",
-              "required": [
-                "name"
-              ],
-              "properties": {
-                "name": {
-                  "description": "Name of GPU, such as \"nvidia.com/AD102GL_L40S\".",
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "instanceType": {
-            "description": "Virtual machine instance type.",
-            "type": "string",
-            "default": "u1.medium"
-          },
-          "maxReplicas": {
-            "description": "Maximum number of replicas.",
-            "type": "integer",
-            "default": 10
-          },
-          "minReplicas": {
-            "description": "Minimum number of replicas.",
-            "type": "integer",
-            "default": 0
-          },
-          "resources": {
-            "description": "CPU and memory resources for each worker node.",
-            "type": "object",
-            "properties": {
-              "cpu": {
-                "description": "CPU available.",
-                "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                "anyOf": [
-                  {
-                    "type": "integer"
-                  },
-                  {
-                    "type": "string"
-                  }
-                ],
-                "x-kubernetes-int-or-string": true
-              },
-              "memory": {
-                "description": "Memory (RAM) available.",
-                "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                "anyOf": [
-                  {
-                    "type": "integer"
-                  },
-                  {
-                    "type": "string"
-                  }
-                ],
-                "x-kubernetes-int-or-string": true
-              }
-            }
-          },
-          "roles": {
-            "description": "List of node roles.",
-            "type": "array",
-            "items": {
-              "type": "string"
-            }
-          }
-        }
-      }
-    },
-    "storageClass": {
-      "description": "StorageClass used to store the data.",
-      "type": "string",
-      "default": "replicated"
-    },
-    "version": {
-      "description": "Kubernetes major.minor version to deploy",
-      "type": "string",
-      "default": "v1.35",
-      "enum": [
-        "v1.35",
-        "v1.34",
-        "v1.33",
-        "v1.32",
-        "v1.31",
-        "v1.30"
-      ]
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/mariadb/values.schema.json b/packages/apps/mariadb/values.schema.json
index 31c56378..49df40f0 100644
--- a/packages/apps/mariadb/values.schema.json
+++ b/packages/apps/mariadb/values.schema.json
@@ -2,98 +2,6 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
-    "backup": {
-      "description": "Backup configuration.",
-      "type": "object",
-      "default": {},
-      "required": [
-        "cleanupStrategy",
-        "enabled",
-        "resticPassword",
-        "s3AccessKey",
-        "s3Bucket",
-        "s3Region",
-        "s3SecretKey",
-        "schedule"
-      ],
-      "properties": {
-        "cleanupStrategy": {
-          "description": "Retention strategy for cleaning up old backups.",
-          "type": "string",
-          "default": "--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
-        },
-        "enabled": {
-          "description": "Enable regular backups (default: false).",
-          "type": "boolean",
-          "default": false
-        },
-        "resticPassword": {
-          "description": "Password for Restic backup encryption.",
-          "type": "string",
-          "default": "\u003cpassword\u003e"
-        },
-        "s3AccessKey": {
-          "description": "Access key for S3 authentication.",
-          "type": "string",
-          "default": "\u003cyour-access-key\u003e"
-        },
-        "s3Bucket": {
-          "description": "S3 bucket used for storing backups.",
-          "type": "string",
-          "default": "s3.example.org/mariadb-backups"
-        },
-        "s3Region": {
-          "description": "AWS S3 region where backups are stored.",
-          "type": "string",
-          "default": "us-east-1"
-        },
-        "s3SecretKey": {
-          "description": "Secret key for S3 authentication.",
-          "type": "string",
-          "default": "\u003cyour-secret-key\u003e"
-        },
-        "schedule": {
-          "description": "Cron schedule for automated backups.",
-          "type": "string",
-          "default": "0 2 * * *"
-        }
-      }
-    },
-    "databases": {
-      "description": "Databases configuration map.",
-      "type": "object",
-      "default": {},
-      "additionalProperties": {
-        "type": "object",
-        "properties": {
-          "roles": {
-            "description": "Roles assigned to users.",
-            "type": "object",
-            "properties": {
-              "admin": {
-                "description": "List of users with admin privileges.",
-                "type": "array",
-                "items": {
-                  "type": "string"
-                }
-              },
-              "readonly": {
-                "description": "List of users with read-only privileges.",
-                "type": "array",
-                "items": {
-                  "type": "string"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    "external": {
-      "description": "Enable external access from outside the cluster.",
-      "type": "boolean",
-      "default": false
-    },
     "replicas": {
       "description": "Number of MariaDB replicas.",
       "type": "integer",
@@ -165,6 +73,22 @@
       "type": "string",
       "default": ""
     },
+    "external": {
+      "description": "Enable external access from outside the cluster.",
+      "type": "boolean",
+      "default": false
+    },
+    "version": {
+      "description": "MariaDB major.minor version to deploy",
+      "type": "string",
+      "default": "v11.8",
+      "enum": [
+        "v11.8",
+        "v11.4",
+        "v10.11",
+        "v10.6"
+      ]
+    },
     "users": {
       "description": "Users configuration map.",
       "type": "object",
@@ -187,16 +111,92 @@
         }
       }
     },
-    "version": {
-      "description": "MariaDB major.minor version to deploy",
-      "type": "string",
-      "default": "v11.8",
-      "enum": [
-        "v11.8",
-        "v11.4",
-        "v10.11",
-        "v10.6"
-      ]
+    "databases": {
+      "description": "Databases configuration map.",
+      "type": "object",
+      "default": {},
+      "additionalProperties": {
+        "type": "object",
+        "properties": {
+          "roles": {
+            "description": "Roles assigned to users.",
+            "type": "object",
+            "properties": {
+              "admin": {
+                "description": "List of users with admin privileges.",
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "readonly": {
+                "description": "List of users with read-only privileges.",
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "backup": {
+      "description": "Backup configuration.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "cleanupStrategy",
+        "enabled",
+        "resticPassword",
+        "s3AccessKey",
+        "s3Bucket",
+        "s3Region",
+        "s3SecretKey",
+        "schedule"
+      ],
+      "properties": {
+        "cleanupStrategy": {
+          "description": "Retention strategy for cleaning up old backups.",
+          "type": "string",
+          "default": "--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
+        },
+        "enabled": {
+          "description": "Enable regular backups (default: false).",
+          "type": "boolean",
+          "default": false
+        },
+        "resticPassword": {
+          "description": "Password for Restic backup encryption.",
+          "type": "string",
+          "default": "\u003cpassword\u003e"
+        },
+        "s3AccessKey": {
+          "description": "Access key for S3 authentication.",
+          "type": "string",
+          "default": "\u003cyour-access-key\u003e"
+        },
+        "s3Bucket": {
+          "description": "S3 bucket used for storing backups.",
+          "type": "string",
+          "default": "s3.example.org/mariadb-backups"
+        },
+        "s3Region": {
+          "description": "AWS S3 region where backups are stored.",
+          "type": "string",
+          "default": "us-east-1"
+        },
+        "s3SecretKey": {
+          "description": "Secret key for S3 authentication.",
+          "type": "string",
+          "default": "\u003cyour-secret-key\u003e"
+        },
+        "schedule": {
+          "description": "Cron schedule for automated backups.",
+          "type": "string",
+          "default": "0 2 * * *"
+        }
+      }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/mongodb/values.schema.json b/packages/apps/mongodb/values.schema.json
index 3a66d60d..2d077cfc 100644
--- a/packages/apps/mongodb/values.schema.json
+++ b/packages/apps/mongodb/values.schema.json
@@ -2,112 +2,6 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
-    "backup": {
-      "description": "Backup configuration.",
-      "type": "object",
-      "default": {},
-      "required": [
-        "enabled"
-      ],
-      "properties": {
-        "destinationPath": {
-          "description": "Destination path for backups (e.g. s3://bucket/path/).",
-          "type": "string",
-          "default": "s3://bucket/path/to/folder/"
-        },
-        "enabled": {
-          "description": "Enable regular backups.",
-          "type": "boolean",
-          "default": false
-        },
-        "endpointURL": {
-          "description": "S3 endpoint URL for uploads.",
-          "type": "string",
-          "default": "http://minio-gateway-service:9000"
-        },
-        "retentionPolicy": {
-          "description": "Retention policy (e.g. \"30d\").",
-          "type": "string",
-          "default": "30d"
-        },
-        "s3AccessKey": {
-          "description": "Access key for S3 authentication.",
-          "type": "string",
-          "default": ""
-        },
-        "s3SecretKey": {
-          "description": "Secret key for S3 authentication.",
-          "type": "string",
-          "default": ""
-        },
-        "schedule": {
-          "description": "Cron schedule for automated backups.",
-          "type": "string",
-          "default": "0 2 * * *"
-        }
-      }
-    },
-    "bootstrap": {
-      "description": "Bootstrap configuration.",
-      "type": "object",
-      "default": {},
-      "required": [
-        "backupName",
-        "enabled"
-      ],
-      "properties": {
-        "backupName": {
-          "description": "Name of backup to restore from.",
-          "type": "string",
-          "default": ""
-        },
-        "enabled": {
-          "description": "Whether to restore from a backup.",
-          "type": "boolean",
-          "default": false
-        },
-        "recoveryTime": {
-          "description": "Timestamp for point-in-time recovery; empty means latest.",
-          "type": "string",
-          "default": ""
-        }
-      }
-    },
-    "databases": {
-      "description": "Databases configuration map.",
-      "type": "object",
-      "default": {},
-      "additionalProperties": {
-        "type": "object",
-        "properties": {
-          "roles": {
-            "description": "Roles assigned to users.",
-            "type": "object",
-            "properties": {
-              "admin": {
-                "description": "List of users with admin privileges (readWrite + dbAdmin).",
-                "type": "array",
-                "items": {
-                  "type": "string"
-                }
-              },
-              "readonly": {
-                "description": "List of users with read-only privileges.",
-                "type": "array",
-                "items": {
-                  "type": "string"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    "external": {
-      "description": "Enable external access from outside the cluster.",
-      "type": "boolean",
-      "default": false
-    },
     "replicas": {
       "description": "Number of MongoDB replicas in replica set.",
       "type": "integer",
@@ -160,6 +54,40 @@
         "2xlarge"
       ]
     },
+    "size": {
+      "description": "Persistent Volume Claim size available for application data.",
+      "default": "10Gi",
+      "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+      "anyOf": [
+        {
+          "type": "integer"
+        },
+        {
+          "type": "string"
+        }
+      ],
+      "x-kubernetes-int-or-string": true
+    },
+    "storageClass": {
+      "description": "StorageClass used to store the data.",
+      "type": "string",
+      "default": ""
+    },
+    "external": {
+      "description": "Enable external access from outside the cluster.",
+      "type": "boolean",
+      "default": false
+    },
+    "version": {
+      "description": "MongoDB major version to deploy.",
+      "type": "string",
+      "default": "v8",
+      "enum": [
+        "v8",
+        "v7",
+        "v6"
+      ]
+    },
     "sharding": {
       "description": "Enable sharded cluster mode. When disabled, deploys a replica set.",
       "type": "boolean",
@@ -243,25 +171,6 @@
         }
       }
     },
-    "size": {
-      "description": "Persistent Volume Claim size available for application data.",
-      "default": "10Gi",
-      "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-      "anyOf": [
-        {
-          "type": "integer"
-        },
-        {
-          "type": "string"
-        }
-      ],
-      "x-kubernetes-int-or-string": true
-    },
-    "storageClass": {
-      "description": "StorageClass used to store the data.",
-      "type": "string",
-      "default": ""
-    },
     "users": {
       "description": "Users configuration map.",
       "type": "object",
@@ -276,15 +185,106 @@
         }
       }
     },
-    "version": {
-      "description": "MongoDB major version to deploy.",
-      "type": "string",
-      "default": "v8",
-      "enum": [
-        "v8",
-        "v7",
-        "v6"
-      ]
+    "databases": {
+      "description": "Databases configuration map.",
+      "type": "object",
+      "default": {},
+      "additionalProperties": {
+        "type": "object",
+        "properties": {
+          "roles": {
+            "description": "Roles assigned to users.",
+            "type": "object",
+            "properties": {
+              "admin": {
+                "description": "List of users with admin privileges (readWrite + dbAdmin).",
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "readonly": {
+                "description": "List of users with read-only privileges.",
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "backup": {
+      "description": "Backup configuration.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "enabled"
+      ],
+      "properties": {
+        "destinationPath": {
+          "description": "Destination path for backups (e.g. s3://bucket/path/).",
+          "type": "string",
+          "default": "s3://bucket/path/to/folder/"
+        },
+        "enabled": {
+          "description": "Enable regular backups.",
+          "type": "boolean",
+          "default": false
+        },
+        "endpointURL": {
+          "description": "S3 endpoint URL for uploads.",
+          "type": "string",
+          "default": "http://minio-gateway-service:9000"
+        },
+        "retentionPolicy": {
+          "description": "Retention policy (e.g. \"30d\").",
+          "type": "string",
+          "default": "30d"
+        },
+        "s3AccessKey": {
+          "description": "Access key for S3 authentication.",
+          "type": "string",
+          "default": ""
+        },
+        "s3SecretKey": {
+          "description": "Secret key for S3 authentication.",
+          "type": "string",
+          "default": ""
+        },
+        "schedule": {
+          "description": "Cron schedule for automated backups.",
+          "type": "string",
+          "default": "0 2 * * *"
+        }
+      }
+    },
+    "bootstrap": {
+      "description": "Bootstrap configuration.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "backupName",
+        "enabled"
+      ],
+      "properties": {
+        "backupName": {
+          "description": "Name of backup to restore from.",
+          "type": "string",
+          "default": ""
+        },
+        "enabled": {
+          "description": "Whether to restore from a backup.",
+          "type": "boolean",
+          "default": false
+        },
+        "recoveryTime": {
+          "description": "Timestamp for point-in-time recovery; empty means latest.",
+          "type": "string",
+          "default": ""
+        }
+      }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/nats/values.schema.json b/packages/apps/nats/values.schema.json
index 3ef5fef7..605c8752 100644
--- a/packages/apps/nats/values.schema.json
+++ b/packages/apps/nats/values.schema.json
@@ -2,60 +2,6 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
-    "config": {
-      "description": "NATS configuration.",
-      "type": "object",
-      "default": {},
-      "properties": {
-        "merge": {
-          "description": "Additional configuration to merge into NATS config.",
-          "type": "object",
-          "default": {},
-          "x-kubernetes-preserve-unknown-fields": true
-        },
-        "resolver": {
-          "description": "Additional resolver configuration to merge into NATS config.",
-          "type": "object",
-          "default": {},
-          "x-kubernetes-preserve-unknown-fields": true
-        }
-      }
-    },
-    "external": {
-      "description": "Enable external access from outside the cluster.",
-      "type": "boolean",
-      "default": false
-    },
-    "jetstream": {
-      "description": "Jetstream configuration.",
-      "type": "object",
-      "default": {},
-      "required": [
-        "enabled",
-        "size"
-      ],
-      "properties": {
-        "enabled": {
-          "description": "Enable or disable Jetstream for persistent messaging in NATS.",
-          "type": "boolean",
-          "default": true
-        },
-        "size": {
-          "description": "Jetstream persistent storage size.",
-          "default": "10Gi",
-          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "string"
-            }
-          ],
-          "x-kubernetes-int-or-string": true
-        }
-      }
-    },
     "replicas": {
       "description": "Number of replicas.",
       "type": "integer",
@@ -113,6 +59,11 @@
       "type": "string",
       "default": ""
     },
+    "external": {
+      "description": "Enable external access from outside the cluster.",
+      "type": "boolean",
+      "default": false
+    },
     "users": {
       "description": "Users configuration map.",
       "type": "object",
@@ -126,6 +77,55 @@
           }
         }
       }
+    },
+    "jetstream": {
+      "description": "Jetstream configuration.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "enabled",
+        "size"
+      ],
+      "properties": {
+        "enabled": {
+          "description": "Enable or disable Jetstream for persistent messaging in NATS.",
+          "type": "boolean",
+          "default": true
+        },
+        "size": {
+          "description": "Jetstream persistent storage size.",
+          "default": "10Gi",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        }
+      }
+    },
+    "config": {
+      "description": "NATS configuration.",
+      "type": "object",
+      "default": {},
+      "properties": {
+        "merge": {
+          "description": "Additional configuration to merge into NATS config.",
+          "type": "object",
+          "default": {},
+          "x-kubernetes-preserve-unknown-fields": true
+        },
+        "resolver": {
+          "description": "Additional resolver configuration to merge into NATS config.",
+          "type": "object",
+          "default": {},
+          "x-kubernetes-preserve-unknown-fields": true
+        }
+      }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/openbao/values.schema.json b/packages/apps/openbao/values.schema.json
index b48f28a6..9b32ddd6 100644
--- a/packages/apps/openbao/values.schema.json
+++ b/packages/apps/openbao/values.schema.json
@@ -2,11 +2,6 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
-    "external": {
-      "description": "Enable external access from outside the cluster.",
-      "type": "boolean",
-      "default": false
-    },
     "replicas": {
       "description": "Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas \u003e 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration.",
       "type": "integer",
@@ -78,10 +73,15 @@
       "type": "string",
       "default": ""
     },
+    "external": {
+      "description": "Enable external access from outside the cluster.",
+      "type": "boolean",
+      "default": false
+    },
     "ui": {
       "description": "Enable the OpenBAO web UI.",
       "type": "boolean",
       "default": true
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/opensearch/values.schema.json b/packages/apps/opensearch/values.schema.json
index 54a6bb00..04b530ba 100644
--- a/packages/apps/opensearch/values.schema.json
+++ b/packages/apps/opensearch/values.schema.json
@@ -2,128 +2,6 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
-    "dashboards": {
-      "description": "OpenSearch Dashboards configuration.",
-      "type": "object",
-      "default": {},
-      "required": [
-        "enabled",
-        "replicas",
-        "resourcesPreset"
-      ],
-      "properties": {
-        "enabled": {
-          "description": "Enable OpenSearch Dashboards deployment.",
-          "type": "boolean",
-          "default": false
-        },
-        "replicas": {
-          "description": "Number of Dashboards replicas.",
-          "type": "integer",
-          "default": 1
-        },
-        "resources": {
-          "description": "Explicit CPU and memory configuration for Dashboards.",
-          "type": "object",
-          "default": {},
-          "properties": {
-            "cpu": {
-              "description": "CPU available to each node.",
-              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-              "anyOf": [
-                {
-                  "type": "integer"
-                },
-                {
-                  "type": "string"
-                }
-              ],
-              "x-kubernetes-int-or-string": true
-            },
-            "memory": {
-              "description": "Memory (RAM) available to each node.",
-              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-              "anyOf": [
-                {
-                  "type": "integer"
-                },
-                {
-                  "type": "string"
-                }
-              ],
-              "x-kubernetes-int-or-string": true
-            }
-          }
-        },
-        "resourcesPreset": {
-          "description": "Default sizing preset for Dashboards.",
-          "type": "string",
-          "default": "medium",
-          "enum": [
-            "nano",
-            "micro",
-            "small",
-            "medium",
-            "large",
-            "xlarge",
-            "2xlarge"
-          ]
-        }
-      }
-    },
-    "external": {
-      "description": "Enable external access from outside the cluster.",
-      "type": "boolean",
-      "default": false
-    },
-    "images": {
-      "description": "Container images used by the operator.",
-      "type": "object",
-      "default": {},
-      "required": [
-        "opensearch"
-      ],
-      "properties": {
-        "opensearch": {
-          "description": "OpenSearch image.",
-          "type": "string",
-          "default": ""
-        }
-      }
-    },
-    "nodeRoles": {
-      "description": "Node roles configuration.",
-      "type": "object",
-      "default": {},
-      "required": [
-        "data",
-        "ingest",
-        "master",
-        "ml"
-      ],
-      "properties": {
-        "data": {
-          "description": "Enable data role.",
-          "type": "boolean",
-          "default": true
-        },
-        "ingest": {
-          "description": "Enable ingest role.",
-          "type": "boolean",
-          "default": true
-        },
-        "master": {
-          "description": "Enable cluster_manager role.",
-          "type": "boolean",
-          "default": true
-        },
-        "ml": {
-          "description": "Enable machine learning role.",
-          "type": "boolean",
-          "default": false
-        }
-      }
-    },
     "replicas": {
       "description": "Number of OpenSearch nodes in the cluster.",
       "type": "integer",
@@ -195,6 +73,11 @@
       "type": "string",
       "default": ""
     },
+    "external": {
+      "description": "Enable external access from outside the cluster.",
+      "type": "boolean",
+      "default": false
+    },
     "topologySpreadPolicy": {
       "description": "How strictly to enforce pod distribution across nodes and zones.",
       "type": "string",
@@ -204,6 +87,64 @@
         "hard"
       ]
     },
+    "version": {
+      "description": "OpenSearch major version to deploy.",
+      "type": "string",
+      "default": "v2",
+      "enum": [
+        "v3",
+        "v2",
+        "v1"
+      ]
+    },
+    "images": {
+      "description": "Container images used by the operator.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "opensearch"
+      ],
+      "properties": {
+        "opensearch": {
+          "description": "OpenSearch image.",
+          "type": "string",
+          "default": ""
+        }
+      }
+    },
+    "nodeRoles": {
+      "description": "Node roles configuration.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "data",
+        "ingest",
+        "master",
+        "ml"
+      ],
+      "properties": {
+        "data": {
+          "description": "Enable data role.",
+          "type": "boolean",
+          "default": true
+        },
+        "ingest": {
+          "description": "Enable ingest role.",
+          "type": "boolean",
+          "default": true
+        },
+        "master": {
+          "description": "Enable cluster_manager role.",
+          "type": "boolean",
+          "default": true
+        },
+        "ml": {
+          "description": "Enable machine learning role.",
+          "type": "boolean",
+          "default": false
+        }
+      }
+    },
     "users": {
       "description": "Custom OpenSearch users configuration map.",
       "type": "object",
@@ -225,15 +166,74 @@
         }
       }
     },
-    "version": {
-      "description": "OpenSearch major version to deploy.",
-      "type": "string",
-      "default": "v2",
-      "enum": [
-        "v3",
-        "v2",
-        "v1"
-      ]
+    "dashboards": {
+      "description": "OpenSearch Dashboards configuration.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "enabled",
+        "replicas",
+        "resourcesPreset"
+      ],
+      "properties": {
+        "enabled": {
+          "description": "Enable OpenSearch Dashboards deployment.",
+          "type": "boolean",
+          "default": false
+        },
+        "replicas": {
+          "description": "Number of Dashboards replicas.",
+          "type": "integer",
+          "default": 1
+        },
+        "resources": {
+          "description": "Explicit CPU and memory configuration for Dashboards.",
+          "type": "object",
+          "default": {},
+          "properties": {
+            "cpu": {
+              "description": "CPU available to each node.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            },
+            "memory": {
+              "description": "Memory (RAM) available to each node.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            }
+          }
+        },
+        "resourcesPreset": {
+          "description": "Default sizing preset for Dashboards.",
+          "type": "string",
+          "default": "medium",
+          "enum": [
+            "nano",
+            "micro",
+            "small",
+            "medium",
+            "large",
+            "xlarge",
+            "2xlarge"
+          ]
+        }
+      }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/postgres/values.schema.json b/packages/apps/postgres/values.schema.json
index 005ff26c..b2a4aeba 100644
--- a/packages/apps/postgres/values.schema.json
+++ b/packages/apps/postgres/values.schema.json
@@ -2,159 +2,6 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
-    "backup": {
-      "description": "Backup configuration.",
-      "type": "object",
-      "default": {},
-      "required": [
-        "enabled"
-      ],
-      "properties": {
-        "destinationPath": {
-          "description": "Destination path for backups (e.g. s3://bucket/path/).",
-          "type": "string",
-          "default": "s3://bucket/path/to/folder/"
-        },
-        "enabled": {
-          "description": "Enable regular backups.",
-          "type": "boolean",
-          "default": false
-        },
-        "endpointURL": {
-          "description": "S3 endpoint URL for uploads.",
-          "type": "string",
-          "default": "http://minio-gateway-service:9000"
-        },
-        "retentionPolicy": {
-          "description": "Retention policy (e.g. \"30d\").",
-          "type": "string",
-          "default": "30d"
-        },
-        "s3AccessKey": {
-          "description": "Access key for S3 authentication.",
-          "type": "string",
-          "default": "\u003cyour-access-key\u003e"
-        },
-        "s3SecretKey": {
-          "description": "Secret key for S3 authentication.",
-          "type": "string",
-          "default": "\u003cyour-secret-key\u003e"
-        },
-        "schedule": {
-          "description": "Cron schedule for automated backups.",
-          "type": "string",
-          "default": "0 2 * * * *"
-        }
-      }
-    },
-    "bootstrap": {
-      "description": "Bootstrap configuration.",
-      "type": "object",
-      "default": {},
-      "required": [
-        "enabled",
-        "oldName"
-      ],
-      "properties": {
-        "enabled": {
-          "description": "Whether to restore from a backup.",
-          "type": "boolean",
-          "default": false
-        },
-        "oldName": {
-          "description": "Previous cluster name before deletion.",
-          "type": "string",
-          "default": ""
-        },
-        "recoveryTime": {
-          "description": "Timestamp (RFC3339) for point-in-time recovery; empty means latest.",
-          "type": "string",
-          "default": ""
-        }
-      }
-    },
-    "databases": {
-      "description": "Databases configuration map.",
-      "type": "object",
-      "default": {},
-      "additionalProperties": {
-        "type": "object",
-        "properties": {
-          "extensions": {
-            "description": "List of enabled PostgreSQL extensions.",
-            "type": "array",
-            "items": {
-              "type": "string"
-            }
-          },
-          "roles": {
-            "description": "Roles assigned to users.",
-            "type": "object",
-            "properties": {
-              "admin": {
-                "description": "List of users with admin privileges.",
-                "type": "array",
-                "items": {
-                  "type": "string"
-                }
-              },
-              "readonly": {
-                "description": "List of users with read-only privileges.",
-                "type": "array",
-                "items": {
-                  "type": "string"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    "external": {
-      "description": "Enable external access from outside the cluster.",
-      "type": "boolean",
-      "default": false
-    },
-    "postgresql": {
-      "description": "PostgreSQL server configuration.",
-      "type": "object",
-      "default": {},
-      "properties": {
-        "parameters": {
-          "description": "PostgreSQL server parameters.",
-          "type": "object",
-          "default": {},
-          "properties": {
-            "max_connections": {
-              "description": "Maximum number of concurrent connections to the database server.",
-              "type": "integer",
-              "default": 100
-            }
-          }
-        }
-      }
-    },
-    "quorum": {
-      "description": "Quorum configuration for synchronous replication.",
-      "type": "object",
-      "default": {},
-      "required": [
-        "maxSyncReplicas",
-        "minSyncReplicas"
-      ],
-      "properties": {
-        "maxSyncReplicas": {
-          "description": "Maximum number of synchronous replicas allowed (must be less than total replicas).",
-          "type": "integer",
-          "default": 0
-        },
-        "minSyncReplicas": {
-          "description": "Minimum number of synchronous replicas required for commit.",
-          "type": "integer",
-          "default": 0
-        }
-      }
-    },
     "replicas": {
       "description": "Number of Postgres replicas.",
       "type": "integer",
@@ -226,6 +73,64 @@
       "type": "string",
       "default": ""
     },
+    "external": {
+      "description": "Enable external access from outside the cluster.",
+      "type": "boolean",
+      "default": false
+    },
+    "version": {
+      "description": "PostgreSQL major version to deploy",
+      "type": "string",
+      "default": "v18",
+      "enum": [
+        "v18",
+        "v17",
+        "v16",
+        "v15",
+        "v14",
+        "v13"
+      ]
+    },
+    "postgresql": {
+      "description": "PostgreSQL server configuration.",
+      "type": "object",
+      "default": {},
+      "properties": {
+        "parameters": {
+          "description": "PostgreSQL server parameters.",
+          "type": "object",
+          "default": {},
+          "properties": {
+            "max_connections": {
+              "description": "Maximum number of concurrent connections to the database server.",
+              "type": "integer",
+              "default": 100
+            }
+          }
+        }
+      }
+    },
+    "quorum": {
+      "description": "Quorum configuration for synchronous replication.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "maxSyncReplicas",
+        "minSyncReplicas"
+      ],
+      "properties": {
+        "maxSyncReplicas": {
+          "description": "Maximum number of synchronous replicas allowed (must be less than total replicas).",
+          "type": "integer",
+          "default": 0
+        },
+        "minSyncReplicas": {
+          "description": "Minimum number of synchronous replicas required for commit.",
+          "type": "integer",
+          "default": 0
+        }
+      }
+    },
     "users": {
       "description": "Users configuration map.",
       "type": "object",
@@ -244,18 +149,113 @@
         }
       }
     },
-    "version": {
-      "description": "PostgreSQL major version to deploy",
-      "type": "string",
-      "default": "v18",
-      "enum": [
-        "v18",
-        "v17",
-        "v16",
-        "v15",
-        "v14",
-        "v13"
-      ]
+    "databases": {
+      "description": "Databases configuration map.",
+      "type": "object",
+      "default": {},
+      "additionalProperties": {
+        "type": "object",
+        "properties": {
+          "extensions": {
+            "description": "List of enabled PostgreSQL extensions.",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "roles": {
+            "description": "Roles assigned to users.",
+            "type": "object",
+            "properties": {
+              "admin": {
+                "description": "List of users with admin privileges.",
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "readonly": {
+                "description": "List of users with read-only privileges.",
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "backup": {
+      "description": "Backup configuration.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "enabled"
+      ],
+      "properties": {
+        "destinationPath": {
+          "description": "Destination path for backups (e.g. s3://bucket/path/).",
+          "type": "string",
+          "default": "s3://bucket/path/to/folder/"
+        },
+        "enabled": {
+          "description": "Enable regular backups.",
+          "type": "boolean",
+          "default": false
+        },
+        "endpointURL": {
+          "description": "S3 endpoint URL for uploads.",
+          "type": "string",
+          "default": "http://minio-gateway-service:9000"
+        },
+        "retentionPolicy": {
+          "description": "Retention policy (e.g. \"30d\").",
+          "type": "string",
+          "default": "30d"
+        },
+        "s3AccessKey": {
+          "description": "Access key for S3 authentication.",
+          "type": "string",
+          "default": "\u003cyour-access-key\u003e"
+        },
+        "s3SecretKey": {
+          "description": "Secret key for S3 authentication.",
+          "type": "string",
+          "default": "\u003cyour-secret-key\u003e"
+        },
+        "schedule": {
+          "description": "Cron schedule for automated backups.",
+          "type": "string",
+          "default": "0 2 * * * *"
+        }
+      }
+    },
+    "bootstrap": {
+      "description": "Bootstrap configuration.",
+      "type": "object",
+      "default": {},
+      "required": [
+        "enabled",
+        "oldName"
+      ],
+      "properties": {
+        "enabled": {
+          "description": "Whether to restore from a backup.",
+          "type": "boolean",
+          "default": false
+        },
+        "oldName": {
+          "description": "Previous cluster name before deletion.",
+          "type": "string",
+          "default": ""
+        },
+        "recoveryTime": {
+          "description": "Timestamp (RFC3339) for point-in-time recovery; empty means latest.",
+          "type": "string",
+          "default": ""
+        }
+      }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/qdrant/values.schema.json b/packages/apps/qdrant/values.schema.json
index de3331c4..90af7c3d 100644
--- a/packages/apps/qdrant/values.schema.json
+++ b/packages/apps/qdrant/values.schema.json
@@ -2,11 +2,6 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
-    "external": {
-      "description": "Enable external access from outside the cluster.",
-      "type": "boolean",
-      "default": false
-    },
     "replicas": {
       "description": "Number of Qdrant replicas. Cluster mode is automatically enabled when replicas \u003e 1.",
       "type": "integer",
@@ -77,6 +72,11 @@
       "description": "StorageClass used to store the data.",
       "type": "string",
       "default": ""
+    },
+    "external": {
+      "description": "Enable external access from outside the cluster.",
+      "type": "boolean",
+      "default": false
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/rabbitmq/values.schema.json b/packages/apps/rabbitmq/values.schema.json
index 87b1a6da..43eaa206 100644
--- a/packages/apps/rabbitmq/values.schema.json
+++ b/packages/apps/rabbitmq/values.schema.json
@@ -2,11 +2,6 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
-    "external": {
-      "description": "Enable external access from outside the cluster.",
-      "type": "boolean",
-      "default": false
-    },
     "replicas": {
       "description": "Number of RabbitMQ replicas.",
       "type": "integer",
@@ -78,6 +73,22 @@
       "type": "string",
       "default": ""
     },
+    "external": {
+      "description": "Enable external access from outside the cluster.",
+      "type": "boolean",
+      "default": false
+    },
+    "version": {
+      "description": "RabbitMQ major.minor version to deploy",
+      "type": "string",
+      "default": "v4.2",
+      "enum": [
+        "v4.2",
+        "v4.1",
+        "v4.0",
+        "v3.13"
+      ]
+    },
     "users": {
       "description": "Users configuration map.",
       "type": "object",
@@ -92,17 +103,6 @@
         }
       }
     },
-    "version": {
-      "description": "RabbitMQ major.minor version to deploy",
-      "type": "string",
-      "default": "v4.2",
-      "enum": [
-        "v4.2",
-        "v4.1",
-        "v4.0",
-        "v3.13"
-      ]
-    },
     "vhosts": {
       "description": "Virtual hosts configuration map.",
       "type": "object",
@@ -137,4 +137,4 @@
       }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/redis/values.schema.json b/packages/apps/redis/values.schema.json
index 5c01cc31..a93d92ac 100644
--- a/packages/apps/redis/values.schema.json
+++ b/packages/apps/redis/values.schema.json
@@ -2,16 +2,6 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
-    "authEnabled": {
-      "description": "Enable password generation.",
-      "type": "boolean",
-      "default": true
-    },
-    "external": {
-      "description": "Enable external access from outside the cluster.",
-      "type": "boolean",
-      "default": false
-    },
     "replicas": {
       "description": "Number of Redis replicas.",
       "type": "integer",
@@ -83,6 +73,11 @@
       "type": "string",
       "default": ""
     },
+    "external": {
+      "description": "Enable external access from outside the cluster.",
+      "type": "boolean",
+      "default": false
+    },
     "version": {
       "description": "Redis major version to deploy",
       "type": "string",
@@ -91,6 +86,11 @@
         "v8",
         "v7"
       ]
+    },
+    "authEnabled": {
+      "description": "Enable password generation.",
+      "type": "boolean",
+      "default": true
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/tcp-balancer/values.schema.json b/packages/apps/tcp-balancer/values.schema.json
index ea30664a..20d04d80 100644
--- a/packages/apps/tcp-balancer/values.schema.json
+++ b/packages/apps/tcp-balancer/values.schema.json
@@ -2,6 +2,58 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
+    "replicas": {
+      "description": "Number of HAProxy replicas.",
+      "type": "integer",
+      "default": 2
+    },
+    "resources": {
+      "description": "Explicit CPU and memory configuration for each TCP Balancer replica. When omitted, the preset defined in `resourcesPreset` is applied.",
+      "type": "object",
+      "default": {},
+      "properties": {
+        "cpu": {
+          "description": "CPU available to each replica.",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        },
+        "memory": {
+          "description": "Memory (RAM) available to each replica.",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        }
+      }
+    },
+    "resourcesPreset": {
+      "description": "Default sizing preset used when `resources` is omitted.",
+      "type": "string",
+      "default": "nano",
+      "enum": [
+        "nano",
+        "micro",
+        "small",
+        "medium",
+        "large",
+        "xlarge",
+        "2xlarge"
+      ]
+    },
     "external": {
       "description": "Enable external access from outside the cluster.",
       "type": "boolean",
@@ -56,57 +108,10 @@
         }
       }
     },
-    "replicas": {
-      "description": "Number of HAProxy replicas.",
-      "type": "integer",
-      "default": 2
-    },
-    "resources": {
-      "description": "Explicit CPU and memory configuration for each TCP Balancer replica. When omitted, the preset defined in `resourcesPreset` is applied.",
-      "type": "object",
-      "default": {},
-      "properties": {
-        "cpu": {
-          "description": "CPU available to each replica.",
-          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "string"
-            }
-          ],
-          "x-kubernetes-int-or-string": true
-        },
-        "memory": {
-          "description": "Memory (RAM) available to each replica.",
-          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "string"
-            }
-          ],
-          "x-kubernetes-int-or-string": true
-        }
-      }
-    },
-    "resourcesPreset": {
-      "description": "Default sizing preset used when `resources` is omitted.",
-      "type": "string",
-      "default": "nano",
-      "enum": [
-        "nano",
-        "micro",
-        "small",
-        "medium",
-        "large",
-        "xlarge",
-        "2xlarge"
-      ]
+    "whitelistHTTP": {
+      "description": "Secure HTTP by whitelisting client networks (default: false).",
+      "type": "boolean",
+      "default": false
     },
     "whitelist": {
       "description": "List of allowed client networks.",
@@ -115,11 +120,6 @@
       "items": {
         "type": "string"
       }
-    },
-    "whitelistHTTP": {
-      "description": "Secure HTTP by whitelisting client networks (default: false).",
-      "type": "boolean",
-      "default": false
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/tenant/values.schema.json b/packages/apps/tenant/values.schema.json
index a03f4674..28d9ac1e 100644
--- a/packages/apps/tenant/values.schema.json
+++ b/packages/apps/tenant/values.schema.json
@@ -2,18 +2,13 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
-    "etcd": {
-      "description": "Deploy own Etcd cluster.",
-      "type": "boolean",
-      "default": false
-    },
     "host": {
       "description": "The hostname used to access tenant services (defaults to using the tenant name as a subdomain for its parent tenant host).",
       "type": "string",
       "default": ""
     },
-    "ingress": {
-      "description": "Deploy own Ingress Controller.",
+    "etcd": {
+      "description": "Deploy own Etcd cluster.",
       "type": "boolean",
       "default": false
     },
@@ -22,6 +17,21 @@
       "type": "boolean",
       "default": false
     },
+    "ingress": {
+      "description": "Deploy own Ingress Controller.",
+      "type": "boolean",
+      "default": false
+    },
+    "seaweedfs": {
+      "description": "Deploy own SeaweedFS.",
+      "type": "boolean",
+      "default": false
+    },
+    "schedulingClass": {
+      "description": "The name of a SchedulingClass CR to apply scheduling constraints for this tenant's workloads.",
+      "type": "string",
+      "default": ""
+    },
     "resourceQuotas": {
       "description": "Define resource quotas for the tenant.",
       "type": "object",
@@ -38,16 +48,6 @@
         ],
         "x-kubernetes-int-or-string": true
       }
-    },
-    "schedulingClass": {
-      "description": "The name of a SchedulingClass CR to apply scheduling constraints for this tenant's workloads.",
-      "type": "string",
-      "default": ""
-    },
-    "seaweedfs": {
-      "description": "Deploy own SeaweedFS.",
-      "type": "boolean",
-      "default": false
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/vm-disk/values.schema.json b/packages/apps/vm-disk/values.schema.json
index 1fc0370e..aec36a47 100644
--- a/packages/apps/vm-disk/values.schema.json
+++ b/packages/apps/vm-disk/values.schema.json
@@ -2,11 +2,6 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
-    "optical": {
-      "description": "Defines if disk should be considered optical.",
-      "type": "boolean",
-      "default": false
-    },
     "source": {
       "description": "The source image location used to create a disk.",
       "type": "object",
@@ -44,6 +39,11 @@
         }
       }
     },
+    "optical": {
+      "description": "Defines if disk should be considered optical.",
+      "type": "boolean",
+      "default": false
+    },
     "storage": {
       "description": "The size of the disk allocated for the virtual machine.",
       "default": "5Gi",
@@ -64,4 +64,4 @@
       "default": "replicated"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/vm-instance/values.schema.json b/packages/apps/vm-instance/values.schema.json
index 0788c879..1b2b3515 100644
--- a/packages/apps/vm-instance/values.schema.json
+++ b/packages/apps/vm-instance/values.schema.json
@@ -2,42 +2,6 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
-    "cloudInit": {
-      "description": "Cloud-init user data.",
-      "type": "string",
-      "default": ""
-    },
-    "cloudInitSeed": {
-      "description": "Seed string to generate SMBIOS UUID for the VM.",
-      "type": "string",
-      "default": ""
-    },
-    "cpuModel": {
-      "description": "Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map",
-      "type": "string",
-      "default": ""
-    },
-    "disks": {
-      "description": "List of disks to attach.",
-      "type": "array",
-      "default": [],
-      "items": {
-        "type": "object",
-        "required": [
-          "name"
-        ],
-        "properties": {
-          "bus": {
-            "description": "Disk bus type (e.g. \"sata\").",
-            "type": "string"
-          },
-          "name": {
-            "description": "Disk name.",
-            "type": "string"
-          }
-        }
-      }
-    },
     "external": {
       "description": "Enable external access from outside the cluster.",
       "type": "boolean",
@@ -62,22 +26,22 @@
         "type": "integer"
       }
     },
-    "gpus": {
-      "description": "List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).",
-      "type": "array",
-      "default": [],
-      "items": {
-        "type": "object",
-        "required": [
-          "name"
-        ],
-        "properties": {
-          "name": {
-            "description": "The name of the GPU resource to attach.",
-            "type": "string"
-          }
-        }
-      }
+    "runStrategy": {
+      "description": "Requested running state of the VirtualMachineInstance",
+      "type": "string",
+      "default": "Always",
+      "enum": [
+        "Always",
+        "Halted",
+        "Manual",
+        "RerunOnFailure",
+        "Once"
+      ]
+    },
+    "instanceType": {
+      "description": "Virtual Machine instance type.",
+      "type": "string",
+      "default": "u1.medium"
     },
     "instanceProfile": {
       "description": "Virtual Machine preferences profile.",
@@ -129,10 +93,62 @@
         ""
       ]
     },
-    "instanceType": {
-      "description": "Virtual Machine instance type.",
+    "disks": {
+      "description": "List of disks to attach.",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "object",
+        "required": [
+          "name"
+        ],
+        "properties": {
+          "bus": {
+            "description": "Disk bus type (e.g. \"sata\").",
+            "type": "string"
+          },
+          "name": {
+            "description": "Disk name.",
+            "type": "string"
+          }
+        }
+      }
+    },
+    "subnets": {
+      "description": "Additional subnets",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "description": "Subnet name",
+            "type": "string"
+          }
+        }
+      }
+    },
+    "gpus": {
+      "description": "List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "object",
+        "required": [
+          "name"
+        ],
+        "properties": {
+          "name": {
+            "description": "The name of the GPU resource to attach.",
+            "type": "string"
+          }
+        }
+      }
+    },
+    "cpuModel": {
+      "description": "Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map",
       "type": "string",
-      "default": "u1.medium"
+      "default": ""
     },
     "resources": {
       "description": "Resource configuration for the virtual machine.",
@@ -180,18 +196,6 @@
         }
       }
     },
-    "runStrategy": {
-      "description": "Requested running state of the VirtualMachineInstance",
-      "type": "string",
-      "default": "Always",
-      "enum": [
-        "Always",
-        "Halted",
-        "Manual",
-        "RerunOnFailure",
-        "Once"
-      ]
-    },
     "sshKeys": {
       "description": "List of SSH public keys for authentication.",
       "type": "array",
@@ -200,19 +204,15 @@
         "type": "string"
       }
     },
-    "subnets": {
-      "description": "Additional subnets",
-      "type": "array",
-      "default": [],
-      "items": {
-        "type": "object",
-        "properties": {
-          "name": {
-            "description": "Subnet name",
-            "type": "string"
-          }
-        }
-      }
+    "cloudInit": {
+      "description": "Cloud-init user data.",
+      "type": "string",
+      "default": ""
+    },
+    "cloudInitSeed": {
+      "description": "Seed string to generate SMBIOS UUID for the VM.",
+      "type": "string",
+      "default": ""
     }
   }
 }
diff --git a/packages/apps/vpc/values.schema.json b/packages/apps/vpc/values.schema.json
index c3d5d65a..f03c33e6 100644
--- a/packages/apps/vpc/values.schema.json
+++ b/packages/apps/vpc/values.schema.json
@@ -68,4 +68,4 @@
       }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/apps/vpn/values.schema.json b/packages/apps/vpn/values.schema.json
index 14e85262..abfd7b52 100644
--- a/packages/apps/vpn/values.schema.json
+++ b/packages/apps/vpn/values.schema.json
@@ -2,24 +2,6 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
-    "external": {
-      "description": "Enable external access from outside the cluster.",
-      "type": "boolean",
-      "default": false
-    },
-    "externalIPs": {
-      "description": "List of externalIPs for service. Optional. If not specified, will use LoadBalancer service by default.",
-      "type": "array",
-      "default": [],
-      "items": {
-        "type": "string"
-      }
-    },
-    "host": {
-      "description": "Host used to substitute into generated URLs.",
-      "type": "string",
-      "default": ""
-    },
     "replicas": {
       "description": "Number of VPN server replicas.",
       "type": "integer",
@@ -72,6 +54,16 @@
         "2xlarge"
       ]
     },
+    "external": {
+      "description": "Enable external access from outside the cluster.",
+      "type": "boolean",
+      "default": false
+    },
+    "host": {
+      "description": "Host used to substitute into generated URLs.",
+      "type": "string",
+      "default": ""
+    },
     "users": {
       "description": "Users configuration map.",
       "type": "object",
@@ -85,6 +77,14 @@
           }
         }
       }
+    },
+    "externalIPs": {
+      "description": "List of externalIPs for service. Optional. If not specified, will use LoadBalancer service by default.",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "string"
+      }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/extra/bootbox/values.schema.json b/packages/extra/bootbox/values.schema.json
index 994f47cd..8e243c12 100644
--- a/packages/extra/bootbox/values.schema.json
+++ b/packages/extra/bootbox/values.schema.json
@@ -2,6 +2,19 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
+    "whitelistHTTP": {
+      "description": "Secure HTTP by enabling client networks whitelisting.",
+      "type": "boolean",
+      "default": true
+    },
+    "whitelist": {
+      "description": "List of client networks.",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "string"
+      }
+    },
     "machines": {
       "description": "Configuration of physical machine instances.",
       "type": "array",
@@ -78,19 +91,6 @@
           }
         }
       }
-    },
-    "whitelist": {
-      "description": "List of client networks.",
-      "type": "array",
-      "default": [],
-      "items": {
-        "type": "string"
-      }
-    },
-    "whitelistHTTP": {
-      "description": "Secure HTTP by enabling client networks whitelisting.",
-      "type": "boolean",
-      "default": true
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/extra/etcd/values.schema.json b/packages/extra/etcd/values.schema.json
index 0f696c57..3c66664c 100644
--- a/packages/extra/etcd/values.schema.json
+++ b/packages/extra/etcd/values.schema.json
@@ -2,6 +2,25 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
+    "size": {
+      "description": "Persistent Volume size.",
+      "default": "4Gi",
+      "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+      "anyOf": [
+        {
+          "type": "integer"
+        },
+        {
+          "type": "string"
+        }
+      ],
+      "x-kubernetes-int-or-string": true
+    },
+    "storageClass": {
+      "description": "StorageClass used to store the data.",
+      "type": "string",
+      "default": ""
+    },
     "replicas": {
       "description": "Number of etcd replicas.",
       "type": "integer",
@@ -41,25 +60,6 @@
           "x-kubernetes-int-or-string": true
         }
       }
-    },
-    "size": {
-      "description": "Persistent Volume size.",
-      "default": "4Gi",
-      "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-      "anyOf": [
-        {
-          "type": "integer"
-        },
-        {
-          "type": "string"
-        }
-      ],
-      "x-kubernetes-int-or-string": true
-    },
-    "storageClass": {
-      "description": "StorageClass used to store the data.",
-      "type": "string",
-      "default": ""
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/extra/external-dns/values.schema.json b/packages/extra/external-dns/values.schema.json
index 0ba69c9d..08de0f8e 100644
--- a/packages/extra/external-dns/values.schema.json
+++ b/packages/extra/external-dns/values.schema.json
@@ -2,11 +2,69 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
+    "provider": {
+      "description": "DNS provider name.",
+      "type": "string",
+      "enum": [
+        "cloudflare",
+        "aws",
+        "azure",
+        "google",
+        "digitalocean",
+        "linode",
+        "ovh",
+        "exoscale",
+        "godaddy",
+        "inmemory"
+      ]
+    },
+    "domainFilters": {
+      "description": "List of domains this external-dns instance can manage.",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "string"
+      }
+    },
+    "policy": {
+      "description": "How DNS records are synchronized.",
+      "type": "string",
+      "default": "upsert-only",
+      "enum": [
+        "create-only",
+        "sync",
+        "upsert-only"
+      ]
+    },
+    "extraArgs": {
+      "description": "Extra arguments for external-dns.",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "string"
+      }
+    },
+    "gatewayAPI": {
+      "description": "Enable Gateway API HTTPRoute as a source for DNS records.",
+      "type": "boolean",
+      "default": false
+    },
     "annotationPrefix": {
       "description": "Custom annotation prefix for external-dns (useful for running multiple instances).",
       "type": "string",
       "default": ""
     },
+    "cloudflare": {
+      "description": "Cloudflare provider credentials.",
+      "type": "object",
+      "default": {
+        "apiEmail": "",
+        "apiKey": "",
+        "apiToken": "",
+        "proxied": false
+      },
+      "x-kubernetes-preserve-unknown-fields": true
+    },
     "aws": {
       "description": "AWS Route53 provider credentials.",
       "type": "object",
@@ -30,14 +88,12 @@
       },
       "x-kubernetes-preserve-unknown-fields": true
     },
-    "cloudflare": {
-      "description": "Cloudflare provider credentials.",
+    "google": {
+      "description": "Google Cloud DNS provider credentials.",
       "type": "object",
       "default": {
-        "apiEmail": "",
-        "apiKey": "",
-        "apiToken": "",
-        "proxied": false
+        "project": "",
+        "serviceAccountKey": ""
       },
       "x-kubernetes-preserve-unknown-fields": true
     },
@@ -49,54 +105,6 @@
       },
       "x-kubernetes-preserve-unknown-fields": true
     },
-    "domainFilters": {
-      "description": "List of domains this external-dns instance can manage.",
-      "type": "array",
-      "default": [],
-      "items": {
-        "type": "string"
-      }
-    },
-    "exoscale": {
-      "description": "Exoscale DNS provider credentials.",
-      "type": "object",
-      "default": {
-        "apiKey": "",
-        "apiSecret": ""
-      },
-      "x-kubernetes-preserve-unknown-fields": true
-    },
-    "extraArgs": {
-      "description": "Extra arguments for external-dns.",
-      "type": "array",
-      "default": [],
-      "items": {
-        "type": "string"
-      }
-    },
-    "gatewayAPI": {
-      "description": "Enable Gateway API HTTPRoute as a source for DNS records.",
-      "type": "boolean",
-      "default": false
-    },
-    "godaddy": {
-      "description": "GoDaddy DNS provider credentials.",
-      "type": "object",
-      "default": {
-        "apiKey": "",
-        "apiSecret": ""
-      },
-      "x-kubernetes-preserve-unknown-fields": true
-    },
-    "google": {
-      "description": "Google Cloud DNS provider credentials.",
-      "type": "object",
-      "default": {
-        "project": "",
-        "serviceAccountKey": ""
-      },
-      "x-kubernetes-preserve-unknown-fields": true
-    },
     "linode": {
       "description": "Linode DNS provider credentials.",
       "type": "object",
@@ -116,31 +124,23 @@
       },
       "x-kubernetes-preserve-unknown-fields": true
     },
-    "policy": {
-      "description": "How DNS records are synchronized.",
-      "type": "string",
-      "default": "upsert-only",
-      "enum": [
-        "create-only",
-        "sync",
-        "upsert-only"
-      ]
+    "exoscale": {
+      "description": "Exoscale DNS provider credentials.",
+      "type": "object",
+      "default": {
+        "apiKey": "",
+        "apiSecret": ""
+      },
+      "x-kubernetes-preserve-unknown-fields": true
     },
-    "provider": {
-      "description": "DNS provider name.",
-      "type": "string",
-      "enum": [
-        "cloudflare",
-        "aws",
-        "azure",
-        "google",
-        "digitalocean",
-        "linode",
-        "ovh",
-        "exoscale",
-        "godaddy",
-        "inmemory"
-      ]
+    "godaddy": {
+      "description": "GoDaddy DNS provider credentials.",
+      "type": "object",
+      "default": {
+        "apiKey": "",
+        "apiSecret": ""
+      },
+      "x-kubernetes-preserve-unknown-fields": true
     },
     "resources": {
       "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
@@ -190,4 +190,4 @@
       ]
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/extra/ingress/values.schema.json b/packages/extra/ingress/values.schema.json
index 650a5824..7a53a197 100644
--- a/packages/extra/ingress/values.schema.json
+++ b/packages/extra/ingress/values.schema.json
@@ -2,16 +2,24 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
-    "cloudflareProxy": {
-      "description": "Restoring original visitor IPs when Cloudflare proxied is enabled.",
-      "type": "boolean",
-      "default": false
-    },
     "replicas": {
       "description": "Number of ingress-nginx replicas.",
       "type": "integer",
       "default": 2
     },
+    "whitelist": {
+      "description": "List of client networks.",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "string"
+      }
+    },
+    "cloudflareProxy": {
+      "description": "Restoring original visitor IPs when Cloudflare proxied is enabled.",
+      "type": "boolean",
+      "default": false
+    },
     "resources": {
       "description": "Explicit CPU and memory configuration for each ingress-nginx replica. When omitted, the preset defined in `resourcesPreset` is applied.",
       "type": "object",
@@ -58,14 +66,6 @@
         "xlarge",
         "2xlarge"
       ]
-    },
-    "whitelist": {
-      "description": "List of client networks.",
-      "type": "array",
-      "default": [],
-      "items": {
-        "type": "string"
-      }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/extra/monitoring/values.schema.json b/packages/extra/monitoring/values.schema.json
index 0a6f0e64..4bc6906e 100644
--- a/packages/extra/monitoring/values.schema.json
+++ b/packages/extra/monitoring/values.schema.json
@@ -2,302 +2,11 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
-    "alerta": {
-      "description": "Configuration for the Alerta service.",
-      "type": "object",
-      "default": {},
-      "properties": {
-        "alerts": {
-          "description": "Alert routing configuration.",
-          "type": "object",
-          "default": {},
-          "properties": {
-            "slack": {
-              "description": "Configuration for Slack alerts.",
-              "type": "object",
-              "default": {},
-              "required": [
-                "url"
-              ],
-              "properties": {
-                "disabledSeverity": {
-                  "description": "List of severities without alerts (e.g. [\"informational\",\"warning\"]).",
-                  "type": "array",
-                  "default": [],
-                  "items": {
-                    "type": "string"
-                  }
-                },
-                "url": {
-                  "description": "Configuration uri for Slack alerts.",
-                  "type": "string",
-                  "default": ""
-                }
-              }
-            },
-            "telegram": {
-              "description": "Configuration for Telegram alerts.",
-              "type": "object",
-              "default": {},
-              "required": [
-                "chatID",
-                "token"
-              ],
-              "properties": {
-                "chatID": {
-                  "description": "Telegram chat ID(s), separated by commas.",
-                  "type": "string",
-                  "default": ""
-                },
-                "disabledSeverity": {
-                  "description": "List of severities without alerts (e.g. [\"informational\",\"warning\"]).",
-                  "type": "array",
-                  "default": [],
-                  "items": {
-                    "type": "string"
-                  }
-                },
-                "token": {
-                  "description": "Telegram bot token.",
-                  "type": "string",
-                  "default": ""
-                }
-              }
-            }
-          }
-        },
-        "resources": {
-          "description": "Resource configuration.",
-          "type": "object",
-          "default": {},
-          "properties": {
-            "limits": {
-              "description": "Resource limits.",
-              "type": "object",
-              "default": {},
-              "properties": {
-                "cpu": {
-                  "description": "CPU limit.",
-                  "default": 1,
-                  "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                  "anyOf": [
-                    {
-                      "type": "integer"
-                    },
-                    {
-                      "type": "string"
-                    }
-                  ],
-                  "x-kubernetes-int-or-string": true
-                },
-                "memory": {
-                  "description": "Memory limit.",
-                  "default": "1Gi",
-                  "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                  "anyOf": [
-                    {
-                      "type": "integer"
-                    },
-                    {
-                      "type": "string"
-                    }
-                  ],
-                  "x-kubernetes-int-or-string": true
-                }
-              }
-            },
-            "requests": {
-              "description": "Resource requests.",
-              "type": "object",
-              "default": {},
-              "properties": {
-                "cpu": {
-                  "description": "CPU request.",
-                  "default": "100m",
-                  "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                  "anyOf": [
-                    {
-                      "type": "integer"
-                    },
-                    {
-                      "type": "string"
-                    }
-                  ],
-                  "x-kubernetes-int-or-string": true
-                },
-                "memory": {
-                  "description": "Memory request.",
-                  "default": "256Mi",
-                  "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                  "anyOf": [
-                    {
-                      "type": "integer"
-                    },
-                    {
-                      "type": "string"
-                    }
-                  ],
-                  "x-kubernetes-int-or-string": true
-                }
-              }
-            }
-          }
-        },
-        "storage": {
-          "description": "Persistent volume size for the database.",
-          "type": "string",
-          "default": "10Gi"
-        },
-        "storageClassName": {
-          "description": "StorageClass used for the database.",
-          "type": "string",
-          "default": ""
-        }
-      }
-    },
-    "grafana": {
-      "description": "Configuration for Grafana.",
-      "type": "object",
-      "default": {},
-      "properties": {
-        "db": {
-          "description": "Database configuration.",
-          "type": "object",
-          "default": {},
-          "properties": {
-            "size": {
-              "description": "Persistent volume size for the database.",
-              "type": "string",
-              "default": "10Gi"
-            }
-          }
-        },
-        "resources": {
-          "description": "Resource configuration.",
-          "type": "object",
-          "default": {},
-          "properties": {
-            "limits": {
-              "description": "Resource limits.",
-              "type": "object",
-              "default": {},
-              "properties": {
-                "cpu": {
-                  "description": "CPU limit.",
-                  "default": 1,
-                  "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                  "anyOf": [
-                    {
-                      "type": "integer"
-                    },
-                    {
-                      "type": "string"
-                    }
-                  ],
-                  "x-kubernetes-int-or-string": true
-                },
-                "memory": {
-                  "description": "Memory limit.",
-                  "default": "1Gi",
-                  "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                  "anyOf": [
-                    {
-                      "type": "integer"
-                    },
-                    {
-                      "type": "string"
-                    }
-                  ],
-                  "x-kubernetes-int-or-string": true
-                }
-              }
-            },
-            "requests": {
-              "description": "Resource requests.",
-              "type": "object",
-              "default": {},
-              "properties": {
-                "cpu": {
-                  "description": "CPU request.",
-                  "default": "100m",
-                  "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                  "anyOf": [
-                    {
-                      "type": "integer"
-                    },
-                    {
-                      "type": "string"
-                    }
-                  ],
-                  "x-kubernetes-int-or-string": true
-                },
-                "memory": {
-                  "description": "Memory request.",
-                  "default": "256Mi",
-                  "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                  "anyOf": [
-                    {
-                      "type": "integer"
-                    },
-                    {
-                      "type": "string"
-                    }
-                  ],
-                  "x-kubernetes-int-or-string": true
-                }
-              }
-            }
-          }
-        }
-      }
-    },
     "host": {
       "description": "The hostname used to access Grafana externally (defaults to 'grafana' subdomain for the tenant host).",
       "type": "string",
       "default": ""
     },
-    "logsStorages": {
-      "description": "Configuration of logs storage instances.",
-      "type": "array",
-      "default": [
-        {
-          "name": "generic",
-          "retentionPeriod": "1",
-          "storage": "10Gi",
-          "storageClassName": "replicated"
-        }
-      ],
-      "items": {
-        "type": "object",
-        "required": [
-          "name",
-          "retentionPeriod",
-          "storage",
-          "storageClassName"
-        ],
-        "properties": {
-          "name": {
-            "description": "Name of the storage instance.",
-            "type": "string"
-          },
-          "retentionPeriod": {
-            "description": "Retention period for logs.",
-            "type": "string",
-            "default": "1"
-          },
-          "storage": {
-            "description": "Persistent volume size.",
-            "type": "string",
-            "default": "10Gi"
-          },
-          "storageClassName": {
-            "description": "StorageClass used to store the data.",
-            "type": "string",
-            "default": "replicated"
-          }
-        }
-      }
-    },
     "metricsStorages": {
       "description": "Configuration of metrics storage instances.",
       "type": "array",
@@ -572,6 +281,297 @@
         }
       }
     },
+    "logsStorages": {
+      "description": "Configuration of logs storage instances.",
+      "type": "array",
+      "default": [
+        {
+          "name": "generic",
+          "retentionPeriod": "1",
+          "storage": "10Gi",
+          "storageClassName": "replicated"
+        }
+      ],
+      "items": {
+        "type": "object",
+        "required": [
+          "name",
+          "retentionPeriod",
+          "storage",
+          "storageClassName"
+        ],
+        "properties": {
+          "name": {
+            "description": "Name of the storage instance.",
+            "type": "string"
+          },
+          "retentionPeriod": {
+            "description": "Retention period for logs.",
+            "type": "string",
+            "default": "1"
+          },
+          "storage": {
+            "description": "Persistent volume size.",
+            "type": "string",
+            "default": "10Gi"
+          },
+          "storageClassName": {
+            "description": "StorageClass used to store the data.",
+            "type": "string",
+            "default": "replicated"
+          }
+        }
+      }
+    },
+    "alerta": {
+      "description": "Configuration for the Alerta service.",
+      "type": "object",
+      "default": {},
+      "properties": {
+        "alerts": {
+          "description": "Alert routing configuration.",
+          "type": "object",
+          "default": {},
+          "properties": {
+            "slack": {
+              "description": "Configuration for Slack alerts.",
+              "type": "object",
+              "default": {},
+              "required": [
+                "url"
+              ],
+              "properties": {
+                "disabledSeverity": {
+                  "description": "List of severities without alerts (e.g. [\"informational\",\"warning\"]).",
+                  "type": "array",
+                  "default": [],
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "url": {
+                  "description": "Configuration uri for Slack alerts.",
+                  "type": "string",
+                  "default": ""
+                }
+              }
+            },
+            "telegram": {
+              "description": "Configuration for Telegram alerts.",
+              "type": "object",
+              "default": {},
+              "required": [
+                "chatID",
+                "token"
+              ],
+              "properties": {
+                "chatID": {
+                  "description": "Telegram chat ID(s), separated by commas.",
+                  "type": "string",
+                  "default": ""
+                },
+                "disabledSeverity": {
+                  "description": "List of severities without alerts (e.g. [\"informational\",\"warning\"]).",
+                  "type": "array",
+                  "default": [],
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "token": {
+                  "description": "Telegram bot token.",
+                  "type": "string",
+                  "default": ""
+                }
+              }
+            }
+          }
+        },
+        "resources": {
+          "description": "Resource configuration.",
+          "type": "object",
+          "default": {},
+          "properties": {
+            "limits": {
+              "description": "Resource limits.",
+              "type": "object",
+              "default": {},
+              "properties": {
+                "cpu": {
+                  "description": "CPU limit.",
+                  "default": 1,
+                  "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                  "anyOf": [
+                    {
+                      "type": "integer"
+                    },
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "x-kubernetes-int-or-string": true
+                },
+                "memory": {
+                  "description": "Memory limit.",
+                  "default": "1Gi",
+                  "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                  "anyOf": [
+                    {
+                      "type": "integer"
+                    },
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "x-kubernetes-int-or-string": true
+                }
+              }
+            },
+            "requests": {
+              "description": "Resource requests.",
+              "type": "object",
+              "default": {},
+              "properties": {
+                "cpu": {
+                  "description": "CPU request.",
+                  "default": "100m",
+                  "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                  "anyOf": [
+                    {
+                      "type": "integer"
+                    },
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "x-kubernetes-int-or-string": true
+                },
+                "memory": {
+                  "description": "Memory request.",
+                  "default": "256Mi",
+                  "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                  "anyOf": [
+                    {
+                      "type": "integer"
+                    },
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "x-kubernetes-int-or-string": true
+                }
+              }
+            }
+          }
+        },
+        "storage": {
+          "description": "Persistent volume size for the database.",
+          "type": "string",
+          "default": "10Gi"
+        },
+        "storageClassName": {
+          "description": "StorageClass used for the database.",
+          "type": "string",
+          "default": ""
+        }
+      }
+    },
+    "grafana": {
+      "description": "Configuration for Grafana.",
+      "type": "object",
+      "default": {},
+      "properties": {
+        "db": {
+          "description": "Database configuration.",
+          "type": "object",
+          "default": {},
+          "properties": {
+            "size": {
+              "description": "Persistent volume size for the database.",
+              "type": "string",
+              "default": "10Gi"
+            }
+          }
+        },
+        "resources": {
+          "description": "Resource configuration.",
+          "type": "object",
+          "default": {},
+          "properties": {
+            "limits": {
+              "description": "Resource limits.",
+              "type": "object",
+              "default": {},
+              "properties": {
+                "cpu": {
+                  "description": "CPU limit.",
+                  "default": 1,
+                  "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                  "anyOf": [
+                    {
+                      "type": "integer"
+                    },
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "x-kubernetes-int-or-string": true
+                },
+                "memory": {
+                  "description": "Memory limit.",
+                  "default": "1Gi",
+                  "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                  "anyOf": [
+                    {
+                      "type": "integer"
+                    },
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "x-kubernetes-int-or-string": true
+                }
+              }
+            },
+            "requests": {
+              "description": "Resource requests.",
+              "type": "object",
+              "default": {},
+              "properties": {
+                "cpu": {
+                  "description": "CPU request.",
+                  "default": "100m",
+                  "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                  "anyOf": [
+                    {
+                      "type": "integer"
+                    },
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "x-kubernetes-int-or-string": true
+                },
+                "memory": {
+                  "description": "Memory request.",
+                  "default": "256Mi",
+                  "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                  "anyOf": [
+                    {
+                      "type": "integer"
+                    },
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "x-kubernetes-int-or-string": true
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "vmagent": {
       "description": "Configuration for VictoriaMetrics Agent.",
       "type": "object",
@@ -579,12 +579,14 @@
       "properties": {
         "externalLabels": {
           "description": "External labels applied to all metrics.",
+          "type": "object",
           "default": {
             "cluster": "cozystack"
           }
         },
         "remoteWrite": {
           "description": "Remote write configuration.",
+          "type": "object",
           "default": {
             "urls": [
               "http://vminsert-shortterm:8480/insert/0/prometheus",
@@ -595,4 +597,4 @@
       }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/extra/seaweedfs/values.schema.json b/packages/extra/seaweedfs/values.schema.json
index b80a2b33..9b48043d 100644
--- a/packages/extra/seaweedfs/values.schema.json
+++ b/packages/extra/seaweedfs/values.schema.json
@@ -2,6 +2,26 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
+    "host": {
+      "description": "The hostname used to access SeaweedFS externally (defaults to 's3' subdomain for the tenant host).",
+      "type": "string",
+      "default": ""
+    },
+    "topology": {
+      "description": "The topology of the SeaweedFS cluster.",
+      "type": "string",
+      "default": "Simple",
+      "enum": [
+        "Simple",
+        "MultiZone",
+        "Client"
+      ]
+    },
+    "replicationFactor": {
+      "description": "Replication factor: number of replicas for each volume in the SeaweedFS cluster.",
+      "type": "integer",
+      "default": 2
+    },
     "db": {
       "description": "Database configuration.",
       "type": "object",
@@ -80,6 +100,65 @@
         }
       }
     },
+    "master": {
+      "description": "Master service configuration.",
+      "type": "object",
+      "default": {},
+      "properties": {
+        "replicas": {
+          "description": "Number of master replicas.",
+          "type": "integer",
+          "default": 3
+        },
+        "resources": {
+          "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
+          "type": "object",
+          "default": {},
+          "properties": {
+            "cpu": {
+              "description": "Number of CPU cores allocated.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            },
+            "memory": {
+              "description": "Amount of memory allocated.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            }
+          }
+        },
+        "resourcesPreset": {
+          "description": "Default sizing preset used when `resources` is omitted.",
+          "type": "string",
+          "default": "small",
+          "enum": [
+            "nano",
+            "micro",
+            "small",
+            "medium",
+            "large",
+            "xlarge",
+            "2xlarge"
+          ]
+        }
+      }
+    },
     "filer": {
       "description": "Filer service configuration.",
       "type": "object",
@@ -157,144 +236,6 @@
         }
       }
     },
-    "host": {
-      "description": "The hostname used to access SeaweedFS externally (defaults to 's3' subdomain for the tenant host).",
-      "type": "string",
-      "default": ""
-    },
-    "master": {
-      "description": "Master service configuration.",
-      "type": "object",
-      "default": {},
-      "properties": {
-        "replicas": {
-          "description": "Number of master replicas.",
-          "type": "integer",
-          "default": 3
-        },
-        "resources": {
-          "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
-          "type": "object",
-          "default": {},
-          "properties": {
-            "cpu": {
-              "description": "Number of CPU cores allocated.",
-              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-              "anyOf": [
-                {
-                  "type": "integer"
-                },
-                {
-                  "type": "string"
-                }
-              ],
-              "x-kubernetes-int-or-string": true
-            },
-            "memory": {
-              "description": "Amount of memory allocated.",
-              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-              "anyOf": [
-                {
-                  "type": "integer"
-                },
-                {
-                  "type": "string"
-                }
-              ],
-              "x-kubernetes-int-or-string": true
-            }
-          }
-        },
-        "resourcesPreset": {
-          "description": "Default sizing preset used when `resources` is omitted.",
-          "type": "string",
-          "default": "small",
-          "enum": [
-            "nano",
-            "micro",
-            "small",
-            "medium",
-            "large",
-            "xlarge",
-            "2xlarge"
-          ]
-        }
-      }
-    },
-    "replicationFactor": {
-      "description": "Replication factor: number of replicas for each volume in the SeaweedFS cluster.",
-      "type": "integer",
-      "default": 2
-    },
-    "s3": {
-      "description": "S3 service configuration.",
-      "type": "object",
-      "default": {},
-      "properties": {
-        "replicas": {
-          "description": "Number of S3 replicas.",
-          "type": "integer",
-          "default": 2
-        },
-        "resources": {
-          "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
-          "type": "object",
-          "default": {},
-          "properties": {
-            "cpu": {
-              "description": "Number of CPU cores allocated.",
-              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-              "anyOf": [
-                {
-                  "type": "integer"
-                },
-                {
-                  "type": "string"
-                }
-              ],
-              "x-kubernetes-int-or-string": true
-            },
-            "memory": {
-              "description": "Amount of memory allocated.",
-              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-              "anyOf": [
-                {
-                  "type": "integer"
-                },
-                {
-                  "type": "string"
-                }
-              ],
-              "x-kubernetes-int-or-string": true
-            }
-          }
-        },
-        "resourcesPreset": {
-          "description": "Default sizing preset used when `resources` is omitted.",
-          "type": "string",
-          "default": "small",
-          "enum": [
-            "nano",
-            "micro",
-            "small",
-            "medium",
-            "large",
-            "xlarge",
-            "2xlarge"
-          ]
-        }
-      }
-    },
-    "topology": {
-      "description": "The topology of the SeaweedFS cluster.",
-      "type": "string",
-      "default": "Simple",
-      "enum": [
-        "Simple",
-        "MultiZone",
-        "Client"
-      ]
-    },
     "volume": {
       "description": "Volume service configuration.",
       "type": "object",
@@ -581,6 +522,65 @@
           }
         }
       }
+    },
+    "s3": {
+      "description": "S3 service configuration.",
+      "type": "object",
+      "default": {},
+      "properties": {
+        "replicas": {
+          "description": "Number of S3 replicas.",
+          "type": "integer",
+          "default": 2
+        },
+        "resources": {
+          "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
+          "type": "object",
+          "default": {},
+          "properties": {
+            "cpu": {
+              "description": "Number of CPU cores allocated.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            },
+            "memory": {
+              "description": "Amount of memory allocated.",
+              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "x-kubernetes-int-or-string": true
+            }
+          }
+        },
+        "resourcesPreset": {
+          "description": "Default sizing preset used when `resources` is omitted.",
+          "type": "string",
+          "default": "small",
+          "enum": [
+            "nano",
+            "micro",
+            "small",
+            "medium",
+            "large",
+            "xlarge",
+            "2xlarge"
+          ]
+        }
+      }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/system/bootbox-rd/cozyrds/bootbox.yaml b/packages/system/bootbox-rd/cozyrds/bootbox.yaml
index 62e87931..667740e3 100644
--- a/packages/system/bootbox-rd/cozyrds/bootbox.yaml
+++ b/packages/system/bootbox-rd/cozyrds/bootbox.yaml
@@ -8,7 +8,7 @@ spec:
     plural: bootboxes
     singular: bootbox
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"machines":{"description":"Configuration of physical machine instances.","type":"array","default":[],"items":{"type":"object","required":["arch","hostname","ip","leaseTime","uefi"],"properties":{"arch":{"description":"Architecture.","type":"string"},"hostname":{"description":"Hostname.","type":"string"},"ip":{"description":"IP address configuration.","type":"object","required":["address","gateway","netmask"],"properties":{"address":{"description":"IP address.","type":"string"},"gateway":{"description":"IP gateway.","type":"string"},"netmask":{"description":"Netmask.","type":"string"}}},"leaseTime":{"description":"Lease time.","type":"integer"},"mac":{"description":"MAC addresses.","type":"array","items":{"type":"string"}},"nameServers":{"description":"Name servers.","type":"array","items":{"type":"string"}},"timeServers":{"description":"Time servers.","type":"array","items":{"type":"string"}},"uefi":{"description":"UEFI.","type":"boolean"}}}},"whitelist":{"description":"List of client networks.","type":"array","default":[],"items":{"type":"string"}},"whitelistHTTP":{"description":"Secure HTTP by enabling client networks whitelisting.","type":"boolean","default":true}}}
+      {"title":"Chart Values","type":"object","properties":{"whitelistHTTP":{"description":"Secure HTTP by enabling client networks whitelisting.","type":"boolean","default":true},"whitelist":{"description":"List of client networks.","type":"array","default":[],"items":{"type":"string"}},"machines":{"description":"Configuration of physical machine instances.","type":"array","default":[],"items":{"type":"object","required":["arch","hostname","ip","leaseTime","uefi"],"properties":{"arch":{"description":"Architecture.","type":"string"},"hostname":{"description":"Hostname.","type":"string"},"ip":{"description":"IP address configuration.","type":"object","required":["address","gateway","netmask"],"properties":{"address":{"description":"IP address.","type":"string"},"gateway":{"description":"IP gateway.","type":"string"},"netmask":{"description":"Netmask.","type":"string"}}},"leaseTime":{"description":"Lease time.","type":"integer"},"mac":{"description":"MAC addresses.","type":"array","items":{"type":"string"}},"nameServers":{"description":"Name servers.","type":"array","items":{"type":"string"}},"timeServers":{"description":"Time servers.","type":"array","items":{"type":"string"}},"uefi":{"description":"UEFI.","type":"boolean"}}}}}}
   release:
     prefix: ""
     labels:
diff --git a/packages/system/clickhouse-rd/cozyrds/clickhouse.yaml b/packages/system/clickhouse-rd/cozyrds/clickhouse.yaml
index eb6c67f6..3655a8db 100644
--- a/packages/system/clickhouse-rd/cozyrds/clickhouse.yaml
+++ b/packages/system/clickhouse-rd/cozyrds/clickhouse.yaml
@@ -8,7 +8,7 @@ spec:
     singular: clickhouse
     plural: clickhouses
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["cleanupStrategy","enabled","resticPassword","s3AccessKey","s3Bucket","s3Region","s3SecretKey","schedule"],"properties":{"cleanupStrategy":{"description":"Retention strategy for cleaning up old backups.","type":"string","default":"--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"},"enabled":{"description":"Enable regular backups (default: false).","type":"boolean","default":false},"resticPassword":{"description":"Password for Restic backup encryption.","type":"string","default":"<password>"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":"<your-access-key>"},"s3Bucket":{"description":"S3 bucket used for storing backups.","type":"string","default":"s3.example.org/clickhouse-backups"},"s3Region":{"description":"AWS S3 region where backups are stored.","type":"string","default":"us-east-1"},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":"<your-secret-key>"},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * *"}}},"clickhouseKeeper":{"description":"ClickHouse Keeper configuration.","type":"object","default":{},"properties":{"enabled":{"description":"Deploy ClickHouse Keeper for cluster coordination.","type":"boolean","default":true},"replicas":{"description":"Number of Keeper replicas.","type":"integer","default":3},"resourcesPreset":{"description":"Default sizing preset.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"logStorageSize":{"description":"Size of Persistent Volume for logs.","default":"2Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"logTTL":{"description":"TTL (expiration time) for `query_log` and `query_thread_log`.","type":"integer","default":15},"replicas":{"description":"Number of ClickHouse replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each ClickHouse replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"shards":{"description":"Number of ClickHouse shards.","type":"integer","default":1},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"},"readonly":{"description":"User is readonly (default: false).","type":"boolean"}}}}}}
+      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of ClickHouse replicas.","type":"integer","default":2},"shards":{"description":"Number of ClickHouse shards.","type":"integer","default":1},"resources":{"description":"Explicit CPU and memory configuration for each ClickHouse replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"logStorageSize":{"description":"Size of Persistent Volume for logs.","default":"2Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"logTTL":{"description":"TTL (expiration time) for `query_log` and `query_thread_log`.","type":"integer","default":15},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"},"readonly":{"description":"User is readonly (default: false).","type":"boolean"}}}},"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["cleanupStrategy","enabled","resticPassword","s3AccessKey","s3Bucket","s3Region","s3SecretKey","schedule"],"properties":{"cleanupStrategy":{"description":"Retention strategy for cleaning up old backups.","type":"string","default":"--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"},"enabled":{"description":"Enable regular backups (default: false).","type":"boolean","default":false},"resticPassword":{"description":"Password for Restic backup encryption.","type":"string","default":"<password>"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":"<your-access-key>"},"s3Bucket":{"description":"S3 bucket used for storing backups.","type":"string","default":"s3.example.org/clickhouse-backups"},"s3Region":{"description":"AWS S3 region where backups are stored.","type":"string","default":"us-east-1"},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":"<your-secret-key>"},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * *"}}},"clickhouseKeeper":{"description":"ClickHouse Keeper configuration.","type":"object","default":{},"properties":{"enabled":{"description":"Deploy ClickHouse Keeper for cluster coordination.","type":"boolean","default":true},"replicas":{"description":"Number of Keeper replicas.","type":"integer","default":3},"resourcesPreset":{"description":"Default sizing preset.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}
   release:
     prefix: clickhouse-
     labels:
diff --git a/packages/system/etcd-rd/cozyrds/etcd.yaml b/packages/system/etcd-rd/cozyrds/etcd.yaml
index 49e25708..7ff7c39c 100644
--- a/packages/system/etcd-rd/cozyrds/etcd.yaml
+++ b/packages/system/etcd-rd/cozyrds/etcd.yaml
@@ -8,7 +8,7 @@ spec:
     plural: etcds
     singular: etcd
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of etcd replicas.","type":"integer","default":3},"resources":{"description":"Resource configuration for etcd.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","default":"1000m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","default":"512Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"size":{"description":"Persistent Volume size.","default":"4Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""}}}
+      {"title":"Chart Values","type":"object","properties":{"size":{"description":"Persistent Volume size.","default":"4Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"replicas":{"description":"Number of etcd replicas.","type":"integer","default":3},"resources":{"description":"Resource configuration for etcd.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","default":"1000m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","default":"512Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}
   release:
     prefix: ""
     labels:
diff --git a/packages/system/external-dns-rd/cozyrds/external-dns.yaml b/packages/system/external-dns-rd/cozyrds/external-dns.yaml
index 8792ca88..849b16ad 100644
--- a/packages/system/external-dns-rd/cozyrds/external-dns.yaml
+++ b/packages/system/external-dns-rd/cozyrds/external-dns.yaml
@@ -8,7 +8,7 @@ spec:
     plural: externaldns
     singular: externaldns
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"annotationPrefix":{"description":"Custom annotation prefix for external-dns (useful for running multiple instances).","type":"string","default":""},"aws":{"description":"AWS Route53 provider credentials.","type":"object","default":{"accessKeyId":"","region":"","secretAccessKey":"","zoneType":""},"x-kubernetes-preserve-unknown-fields":true},"azure":{"description":"Azure DNS provider credentials.","type":"object","default":{"aadClientId":"","aadClientSecret":"","resourceGroup":"","subscriptionId":"","tenantId":""},"x-kubernetes-preserve-unknown-fields":true},"cloudflare":{"description":"Cloudflare provider credentials.","type":"object","default":{"apiEmail":"","apiKey":"","apiToken":"","proxied":false},"x-kubernetes-preserve-unknown-fields":true},"digitalocean":{"description":"DigitalOcean DNS provider credentials.","type":"object","default":{"token":""},"x-kubernetes-preserve-unknown-fields":true},"domainFilters":{"description":"List of domains this external-dns instance can manage.","type":"array","default":[],"items":{"type":"string"}},"exoscale":{"description":"Exoscale DNS provider credentials.","type":"object","default":{"apiKey":"","apiSecret":""},"x-kubernetes-preserve-unknown-fields":true},"extraArgs":{"description":"Extra arguments for external-dns.","type":"array","default":[],"items":{"type":"string"}},"gatewayAPI":{"description":"Enable Gateway API HTTPRoute as a source for DNS records.","type":"boolean","default":false},"godaddy":{"description":"GoDaddy DNS provider credentials.","type":"object","default":{"apiKey":"","apiSecret":""},"x-kubernetes-preserve-unknown-fields":true},"google":{"description":"Google Cloud DNS provider credentials.","type":"object","default":{"project":"","serviceAccountKey":""},"x-kubernetes-preserve-unknown-fields":true},"linode":{"description":"Linode DNS provider credentials.","type":"object","default":{"token":""},"x-kubernetes-preserve-unknown-fields":true},"ovh":{"description":"OVH DNS provider credentials.","type":"object","default":{"applicationKey":"","applicationSecret":"","consumerKey":"","endpoint":""},"x-kubernetes-preserve-unknown-fields":true},"policy":{"description":"How DNS records are synchronized.","type":"string","default":"upsert-only","enum":["create-only","sync","upsert-only"]},"provider":{"description":"DNS provider name.","type":"string","enum":["cloudflare","aws","azure","google","digitalocean","linode","ovh","exoscale","godaddy","inmemory"]},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}
+      {"title":"Chart Values","type":"object","properties":{"provider":{"description":"DNS provider name.","type":"string","enum":["cloudflare","aws","azure","google","digitalocean","linode","ovh","exoscale","godaddy","inmemory"]},"domainFilters":{"description":"List of domains this external-dns instance can manage.","type":"array","default":[],"items":{"type":"string"}},"policy":{"description":"How DNS records are synchronized.","type":"string","default":"upsert-only","enum":["create-only","sync","upsert-only"]},"extraArgs":{"description":"Extra arguments for external-dns.","type":"array","default":[],"items":{"type":"string"}},"gatewayAPI":{"description":"Enable Gateway API HTTPRoute as a source for DNS records.","type":"boolean","default":false},"annotationPrefix":{"description":"Custom annotation prefix for external-dns (useful for running multiple instances).","type":"string","default":""},"cloudflare":{"description":"Cloudflare provider credentials.","type":"object","default":{"apiEmail":"","apiKey":"","apiToken":"","proxied":false},"x-kubernetes-preserve-unknown-fields":true},"aws":{"description":"AWS Route53 provider credentials.","type":"object","default":{"accessKeyId":"","region":"","secretAccessKey":"","zoneType":""},"x-kubernetes-preserve-unknown-fields":true},"azure":{"description":"Azure DNS provider credentials.","type":"object","default":{"aadClientId":"","aadClientSecret":"","resourceGroup":"","subscriptionId":"","tenantId":""},"x-kubernetes-preserve-unknown-fields":true},"google":{"description":"Google Cloud DNS provider credentials.","type":"object","default":{"project":"","serviceAccountKey":""},"x-kubernetes-preserve-unknown-fields":true},"digitalocean":{"description":"DigitalOcean DNS provider credentials.","type":"object","default":{"token":""},"x-kubernetes-preserve-unknown-fields":true},"linode":{"description":"Linode DNS provider credentials.","type":"object","default":{"token":""},"x-kubernetes-preserve-unknown-fields":true},"ovh":{"description":"OVH DNS provider credentials.","type":"object","default":{"applicationKey":"","applicationSecret":"","consumerKey":"","endpoint":""},"x-kubernetes-preserve-unknown-fields":true},"exoscale":{"description":"Exoscale DNS provider credentials.","type":"object","default":{"apiKey":"","apiSecret":""},"x-kubernetes-preserve-unknown-fields":true},"godaddy":{"description":"GoDaddy DNS provider credentials.","type":"object","default":{"apiKey":"","apiSecret":""},"x-kubernetes-preserve-unknown-fields":true},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}
   release:
     prefix: ""
     chartRef:
diff --git a/packages/system/harbor-rd/cozyrds/harbor.yaml b/packages/system/harbor-rd/cozyrds/harbor.yaml
index 0112dc11..5abc725f 100644
--- a/packages/system/harbor-rd/cozyrds/harbor.yaml
+++ b/packages/system/harbor-rd/cozyrds/harbor.yaml
@@ -8,7 +8,7 @@ spec:
     singular: harbor
     plural: harbors
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"core":{"description":"Core API server configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"database":{"description":"PostgreSQL database configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of database instances.","type":"integer","default":2},"size":{"description":"Persistent Volume size for database storage.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"host":{"description":"Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).","type":"string","default":""},"jobservice":{"description":"Background job service configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"redis":{"description":"Redis cache configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of Redis replicas.","type":"integer","default":2},"size":{"description":"Persistent Volume size for cache storage.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"registry":{"description":"Container image registry configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"trivy":{"description":"Trivy vulnerability scanner configuration.","type":"object","default":{},"required":["enabled","size"],"properties":{"enabled":{"description":"Enable or disable the vulnerability scanner.","type":"boolean","default":true},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for vulnerability database cache.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}
+      {"title":"Chart Values","type":"object","properties":{"host":{"description":"Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).","type":"string","default":""},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"core":{"description":"Core API server configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"registry":{"description":"Container image registry configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"jobservice":{"description":"Background job service configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"trivy":{"description":"Trivy vulnerability scanner configuration.","type":"object","default":{},"required":["enabled","size"],"properties":{"enabled":{"description":"Enable or disable the vulnerability scanner.","type":"boolean","default":true},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for vulnerability database cache.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"database":{"description":"PostgreSQL database configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of database instances.","type":"integer","default":2},"size":{"description":"Persistent Volume size for database storage.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"redis":{"description":"Redis cache configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of Redis replicas.","type":"integer","default":2},"size":{"description":"Persistent Volume size for cache storage.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}
   release:
     prefix: "harbor-"
     labels:
diff --git a/packages/system/http-cache-rd/cozyrds/http-cache.yaml b/packages/system/http-cache-rd/cozyrds/http-cache.yaml
index 0fe2c9cf..6e5e0619 100644
--- a/packages/system/http-cache-rd/cozyrds/http-cache.yaml
+++ b/packages/system/http-cache-rd/cozyrds/http-cache.yaml
@@ -8,7 +8,7 @@ spec:
     plural: httpcaches
     singular: httpcache
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"endpoints":{"description":"Endpoints configuration, as a list of <ip:port>.","type":"array","default":[],"items":{"type":"string"}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"haproxy":{"description":"HAProxy configuration.","type":"object","default":{},"required":["replicas","resourcesPreset"],"properties":{"replicas":{"description":"Number of HAProxy replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"nginx":{"description":"Nginx configuration.","type":"object","default":{},"required":["replicas","resourcesPreset"],"properties":{"replicas":{"description":"Number of Nginx replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""}}}
+      {"title":"Chart Values","type":"object","properties":{"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"endpoints":{"description":"Endpoints configuration, as a list of <ip:port>.","type":"array","default":[],"items":{"type":"string"}},"haproxy":{"description":"HAProxy configuration.","type":"object","default":{},"required":["replicas","resourcesPreset"],"properties":{"replicas":{"description":"Number of HAProxy replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"nginx":{"description":"Nginx configuration.","type":"object","default":{},"required":["replicas","resourcesPreset"],"properties":{"replicas":{"description":"Number of Nginx replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}}
   release:
     prefix: http-cache-
     labels:
diff --git a/packages/system/ingress-rd/cozyrds/ingress.yaml b/packages/system/ingress-rd/cozyrds/ingress.yaml
index 5743856f..f814ac52 100644
--- a/packages/system/ingress-rd/cozyrds/ingress.yaml
+++ b/packages/system/ingress-rd/cozyrds/ingress.yaml
@@ -8,7 +8,7 @@ spec:
     plural: ingresses
     singular: ingress
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"cloudflareProxy":{"description":"Restoring original visitor IPs when Cloudflare proxied is enabled.","type":"boolean","default":false},"replicas":{"description":"Number of ingress-nginx replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each ingress-nginx replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"whitelist":{"description":"List of client networks.","type":"array","default":[],"items":{"type":"string"}}}}
+      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of ingress-nginx replicas.","type":"integer","default":2},"whitelist":{"description":"List of client networks.","type":"array","default":[],"items":{"type":"string"}},"cloudflareProxy":{"description":"Restoring original visitor IPs when Cloudflare proxied is enabled.","type":"boolean","default":false},"resources":{"description":"Explicit CPU and memory configuration for each ingress-nginx replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}
   release:
     prefix: ""
     labels:
diff --git a/packages/system/kafka-rd/cozyrds/kafka.yaml b/packages/system/kafka-rd/cozyrds/kafka.yaml
index a4cc11e1..8685792f 100644
--- a/packages/system/kafka-rd/cozyrds/kafka.yaml
+++ b/packages/system/kafka-rd/cozyrds/kafka.yaml
@@ -8,7 +8,7 @@ spec:
     plural: kafkas
     singular: kafka
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"kafka":{"description":"Kafka configuration.","type":"object","default":{},"required":["replicas","resourcesPreset","size","storageClass"],"properties":{"replicas":{"description":"Number of Kafka replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for Kafka.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the Kafka data.","type":"string","default":""}}},"topics":{"description":"Topics configuration.","type":"array","default":[],"items":{"type":"object","required":["config","name","partitions","replicas"],"properties":{"config":{"description":"Topic configuration.","type":"object","x-kubernetes-preserve-unknown-fields":true},"name":{"description":"Topic name.","type":"string"},"partitions":{"description":"Number of partitions.","type":"integer"},"replicas":{"description":"Number of replicas.","type":"integer"}}}},"zookeeper":{"description":"ZooKeeper configuration.","type":"object","default":{},"required":["replicas","resourcesPreset","size","storageClass"],"properties":{"replicas":{"description":"Number of ZooKeeper replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for ZooKeeper.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the ZooKeeper data.","type":"string","default":""}}}}}
+      {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"topics":{"description":"Topics configuration.","type":"array","default":[],"items":{"type":"object","required":["config","name","partitions","replicas"],"properties":{"config":{"description":"Topic configuration.","type":"object","x-kubernetes-preserve-unknown-fields":true},"name":{"description":"Topic name.","type":"string"},"partitions":{"description":"Number of partitions.","type":"integer"},"replicas":{"description":"Number of replicas.","type":"integer"}}}},"kafka":{"description":"Kafka configuration.","type":"object","default":{},"required":["replicas","resourcesPreset","size","storageClass"],"properties":{"replicas":{"description":"Number of Kafka replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for Kafka.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the Kafka data.","type":"string","default":""}}},"zookeeper":{"description":"ZooKeeper configuration.","type":"object","default":{},"required":["replicas","resourcesPreset","size","storageClass"],"properties":{"replicas":{"description":"Number of ZooKeeper replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for ZooKeeper.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the ZooKeeper data.","type":"string","default":""}}}}}
   release:
     prefix: kafka-
     labels:
diff --git a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
index 9ed813f6..5e9e8f94 100644
--- a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
+++ b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
@@ -8,7 +8,7 @@ spec:
     singular: kubernetes
     plural: kuberneteses
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"addons":{"description":"Cluster addons configuration.","type":"object","default":{},"required":["certManager","cilium","coredns","fluxcd","gatewayAPI","gpuOperator","ingressNginx","monitoringAgents","velero","verticalPodAutoscaler"],"properties":{"certManager":{"description":"Cert-manager addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable cert-manager.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"cilium":{"description":"Cilium CNI plugin.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"coredns":{"description":"CoreDNS addon.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"fluxcd":{"description":"FluxCD GitOps operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable FluxCD.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"gatewayAPI":{"description":"Gateway API addon.","type":"object","default":{},"required":["enabled"],"properties":{"enabled":{"description":"Enable Gateway API.","type":"boolean","default":false}}},"gpuOperator":{"description":"NVIDIA GPU Operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable GPU Operator.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"ingressNginx":{"description":"Ingress-NGINX controller.","type":"object","default":{},"required":["enabled","exposeMethod","valuesOverride"],"properties":{"enabled":{"description":"Enable the controller (requires nodes labeled `ingress-nginx`).","type":"boolean","default":false},"exposeMethod":{"description":"Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.","type":"string","default":"Proxied","enum":["Proxied","LoadBalancer"]},"hosts":{"description":"Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.","type":"array","default":[],"items":{"type":"string"}},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"monitoringAgents":{"description":"Monitoring agents.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable monitoring agents.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"velero":{"description":"Velero backup/restore addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable Velero.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"verticalPodAutoscaler":{"description":"Vertical Pod Autoscaler.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}}}},"controlPlane":{"description":"Kubernetes control-plane configuration.","type":"object","default":{},"required":["apiServer","controllerManager","konnectivity","replicas","scheduler"],"properties":{"apiServer":{"description":"API Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for API Server.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"controllerManager":{"description":"Controller Manager configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Controller Manager.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"konnectivity":{"description":"Konnectivity configuration.","type":"object","default":{},"required":["server"],"properties":{"server":{"description":"Konnectivity Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Konnectivity.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"replicas":{"description":"Number of control-plane replicas.","type":"integer","default":2},"scheduler":{"description":"Scheduler configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Scheduler.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"host":{"description":"External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.","type":"string","default":""},"nodeGroups":{"description":"Worker nodes configuration map.","type":"object","default":{"md0":{"ephemeralStorage":"20Gi","gpus":[],"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":["ingress-nginx"]}},"additionalProperties":{"type":"object","required":["ephemeralStorage","instanceType","maxReplicas","minReplicas","resources"],"properties":{"ephemeralStorage":{"description":"Ephemeral storage size.","default":"20Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"description":"Name of GPU, such as \"nvidia.com/AD102GL_L40S\".","type":"string"}}}},"instanceType":{"description":"Virtual machine instance type.","type":"string","default":"u1.medium"},"maxReplicas":{"description":"Maximum number of replicas.","type":"integer","default":10},"minReplicas":{"description":"Minimum number of replicas.","type":"integer","default":0},"resources":{"description":"CPU and memory resources for each worker node.","type":"object","properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"roles":{"description":"List of node roles.","type":"array","items":{"type":"string"}}}}},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"},"version":{"description":"Kubernetes major.minor version to deploy","type":"string","default":"v1.35","enum":["v1.35","v1.34","v1.33","v1.32","v1.31","v1.30"]}}}
+      {"title":"Chart Values","type":"object","properties":{"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"},"nodeGroups":{"description":"Worker nodes configuration map.","type":"object","default":{"md0":{"ephemeralStorage":"20Gi","gpus":[],"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":["ingress-nginx"]}},"additionalProperties":{"type":"object","required":["ephemeralStorage","instanceType","maxReplicas","minReplicas","resources"],"properties":{"ephemeralStorage":{"description":"Ephemeral storage size.","default":"20Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"description":"Name of GPU, such as \"nvidia.com/AD102GL_L40S\".","type":"string"}}}},"instanceType":{"description":"Virtual machine instance type.","type":"string","default":"u1.medium"},"maxReplicas":{"description":"Maximum number of replicas.","type":"integer","default":10},"minReplicas":{"description":"Minimum number of replicas.","type":"integer","default":0},"resources":{"description":"CPU and memory resources for each worker node.","type":"object","properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"roles":{"description":"List of node roles.","type":"array","items":{"type":"string"}}}}},"version":{"description":"Kubernetes major.minor version to deploy","type":"string","default":"v1.35","enum":["v1.35","v1.34","v1.33","v1.32","v1.31","v1.30"]},"host":{"description":"External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.","type":"string","default":""},"addons":{"description":"Cluster addons configuration.","type":"object","default":{},"required":["certManager","cilium","coredns","fluxcd","gatewayAPI","gpuOperator","ingressNginx","monitoringAgents","velero","verticalPodAutoscaler"],"properties":{"certManager":{"description":"Cert-manager addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable cert-manager.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"cilium":{"description":"Cilium CNI plugin.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"coredns":{"description":"CoreDNS addon.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"fluxcd":{"description":"FluxCD GitOps operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable FluxCD.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"gatewayAPI":{"description":"Gateway API addon.","type":"object","default":{},"required":["enabled"],"properties":{"enabled":{"description":"Enable Gateway API.","type":"boolean","default":false}}},"gpuOperator":{"description":"NVIDIA GPU Operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable GPU Operator.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"ingressNginx":{"description":"Ingress-NGINX controller.","type":"object","default":{},"required":["enabled","exposeMethod","valuesOverride"],"properties":{"enabled":{"description":"Enable the controller (requires nodes labeled `ingress-nginx`).","type":"boolean","default":false},"exposeMethod":{"description":"Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.","type":"string","default":"Proxied","enum":["Proxied","LoadBalancer"]},"hosts":{"description":"Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.","type":"array","default":[],"items":{"type":"string"}},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"monitoringAgents":{"description":"Monitoring agents.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable monitoring agents.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"velero":{"description":"Velero backup/restore addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable Velero.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"verticalPodAutoscaler":{"description":"Vertical Pod Autoscaler.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}}}},"controlPlane":{"description":"Kubernetes control-plane configuration.","type":"object","default":{},"required":["apiServer","controllerManager","konnectivity","replicas","scheduler"],"properties":{"apiServer":{"description":"API Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for API Server.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"controllerManager":{"description":"Controller Manager configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Controller Manager.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"konnectivity":{"description":"Konnectivity configuration.","type":"object","default":{},"required":["server"],"properties":{"server":{"description":"Konnectivity Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Konnectivity.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"replicas":{"description":"Number of control-plane replicas.","type":"integer","default":2},"scheduler":{"description":"Scheduler configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Scheduler.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}}}}
   release:
     prefix: kubernetes-
     labels:
diff --git a/packages/system/mariadb-rd/cozyrds/mariadb.yaml b/packages/system/mariadb-rd/cozyrds/mariadb.yaml
index 5e8088c8..6dacdf0e 100644
--- a/packages/system/mariadb-rd/cozyrds/mariadb.yaml
+++ b/packages/system/mariadb-rd/cozyrds/mariadb.yaml
@@ -8,7 +8,7 @@ spec:
     plural: mariadbs
     singular: mariadb
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["cleanupStrategy","enabled","resticPassword","s3AccessKey","s3Bucket","s3Region","s3SecretKey","schedule"],"properties":{"cleanupStrategy":{"description":"Retention strategy for cleaning up old backups.","type":"string","default":"--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"},"enabled":{"description":"Enable regular backups (default: false).","type":"boolean","default":false},"resticPassword":{"description":"Password for Restic backup encryption.","type":"string","default":"<password>"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":"<your-access-key>"},"s3Bucket":{"description":"S3 bucket used for storing backups.","type":"string","default":"s3.example.org/mariadb-backups"},"s3Region":{"description":"AWS S3 region where backups are stored.","type":"string","default":"us-east-1"},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":"<your-secret-key>"},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * *"}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"replicas":{"description":"Number of MariaDB replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each MariaDB replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","required":["maxUserConnections","password"],"properties":{"maxUserConnections":{"description":"Maximum number of connections.","type":"integer"},"password":{"description":"Password for the user.","type":"string"}}}},"version":{"description":"MariaDB major.minor version to deploy","type":"string","default":"v11.8","enum":["v11.8","v11.4","v10.11","v10.6"]}}}
+      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of MariaDB replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each MariaDB replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"version":{"description":"MariaDB major.minor version to deploy","type":"string","default":"v11.8","enum":["v11.8","v11.4","v10.11","v10.6"]},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","required":["maxUserConnections","password"],"properties":{"maxUserConnections":{"description":"Maximum number of connections.","type":"integer"},"password":{"description":"Password for the user.","type":"string"}}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["cleanupStrategy","enabled","resticPassword","s3AccessKey","s3Bucket","s3Region","s3SecretKey","schedule"],"properties":{"cleanupStrategy":{"description":"Retention strategy for cleaning up old backups.","type":"string","default":"--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"},"enabled":{"description":"Enable regular backups (default: false).","type":"boolean","default":false},"resticPassword":{"description":"Password for Restic backup encryption.","type":"string","default":"<password>"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":"<your-access-key>"},"s3Bucket":{"description":"S3 bucket used for storing backups.","type":"string","default":"s3.example.org/mariadb-backups"},"s3Region":{"description":"AWS S3 region where backups are stored.","type":"string","default":"us-east-1"},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":"<your-secret-key>"},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * *"}}}}}
   release:
     prefix: mariadb-
     labels:
diff --git a/packages/system/mongodb-rd/cozyrds/mongodb.yaml b/packages/system/mongodb-rd/cozyrds/mongodb.yaml
index a79398c2..78141023 100644
--- a/packages/system/mongodb-rd/cozyrds/mongodb.yaml
+++ b/packages/system/mongodb-rd/cozyrds/mongodb.yaml
@@ -8,7 +8,7 @@ spec:
     singular: mongodb
     plural: mongodbs
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["enabled"],"properties":{"destinationPath":{"description":"Destination path for backups (e.g. s3://bucket/path/).","type":"string","default":"s3://bucket/path/to/folder/"},"enabled":{"description":"Enable regular backups.","type":"boolean","default":false},"endpointURL":{"description":"S3 endpoint URL for uploads.","type":"string","default":"http://minio-gateway-service:9000"},"retentionPolicy":{"description":"Retention policy (e.g. \"30d\").","type":"string","default":"30d"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":""},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":""},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * *"}}},"bootstrap":{"description":"Bootstrap configuration.","type":"object","default":{},"required":["backupName","enabled"],"properties":{"backupName":{"description":"Name of backup to restore from.","type":"string","default":""},"enabled":{"description":"Whether to restore from a backup.","type":"boolean","default":false},"recoveryTime":{"description":"Timestamp for point-in-time recovery; empty means latest.","type":"string","default":""}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges (readWrite + dbAdmin).","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"replicas":{"description":"Number of MongoDB replicas in replica set.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration for each MongoDB replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"sharding":{"description":"Enable sharded cluster mode. When disabled, deploys a replica set.","type":"boolean","default":false},"shardingConfig":{"description":"Configuration for sharded cluster mode.","type":"object","default":{},"required":["configServerSize","configServers","mongos"],"properties":{"configServerSize":{"description":"PVC size for config servers.","default":"3Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"configServers":{"description":"Number of config server replicas.","type":"integer","default":3},"mongos":{"description":"Number of mongos router replicas.","type":"integer","default":2},"shards":{"description":"List of shard configurations.","type":"array","default":[{"name":"rs0","replicas":3,"size":"10Gi"}],"items":{"type":"object","required":["name","replicas","size"],"properties":{"name":{"description":"Shard name.","type":"string"},"replicas":{"description":"Number of replicas in this shard.","type":"integer"},"size":{"description":"PVC size for this shard.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user (auto-generated if omitted).","type":"string"}}}},"version":{"description":"MongoDB major version to deploy.","type":"string","default":"v8","enum":["v8","v7","v6"]}}}
+      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of MongoDB replicas in replica set.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration for each MongoDB replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"version":{"description":"MongoDB major version to deploy.","type":"string","default":"v8","enum":["v8","v7","v6"]},"sharding":{"description":"Enable sharded cluster mode. When disabled, deploys a replica set.","type":"boolean","default":false},"shardingConfig":{"description":"Configuration for sharded cluster mode.","type":"object","default":{},"required":["configServerSize","configServers","mongos"],"properties":{"configServerSize":{"description":"PVC size for config servers.","default":"3Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"configServers":{"description":"Number of config server replicas.","type":"integer","default":3},"mongos":{"description":"Number of mongos router replicas.","type":"integer","default":2},"shards":{"description":"List of shard configurations.","type":"array","default":[{"name":"rs0","replicas":3,"size":"10Gi"}],"items":{"type":"object","required":["name","replicas","size"],"properties":{"name":{"description":"Shard name.","type":"string"},"replicas":{"description":"Number of replicas in this shard.","type":"integer"},"size":{"description":"PVC size for this shard.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user (auto-generated if omitted).","type":"string"}}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges (readWrite + dbAdmin).","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["enabled"],"properties":{"destinationPath":{"description":"Destination path for backups (e.g. s3://bucket/path/).","type":"string","default":"s3://bucket/path/to/folder/"},"enabled":{"description":"Enable regular backups.","type":"boolean","default":false},"endpointURL":{"description":"S3 endpoint URL for uploads.","type":"string","default":"http://minio-gateway-service:9000"},"retentionPolicy":{"description":"Retention policy (e.g. \"30d\").","type":"string","default":"30d"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":""},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":""},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * *"}}},"bootstrap":{"description":"Bootstrap configuration.","type":"object","default":{},"required":["backupName","enabled"],"properties":{"backupName":{"description":"Name of backup to restore from.","type":"string","default":""},"enabled":{"description":"Whether to restore from a backup.","type":"boolean","default":false},"recoveryTime":{"description":"Timestamp for point-in-time recovery; empty means latest.","type":"string","default":""}}}}}
   release:
     prefix: mongodb-
     labels:
diff --git a/packages/system/monitoring-rd/cozyrds/monitoring.yaml b/packages/system/monitoring-rd/cozyrds/monitoring.yaml
index b79f1cf6..ce4d75c5 100644
--- a/packages/system/monitoring-rd/cozyrds/monitoring.yaml
+++ b/packages/system/monitoring-rd/cozyrds/monitoring.yaml
@@ -8,7 +8,7 @@ spec:
     singular: monitoring
     plural: monitorings
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"alerta":{"description":"Configuration for the Alerta service.","type":"object","default":{},"properties":{"alerts":{"description":"Alert routing configuration.","type":"object","default":{},"properties":{"slack":{"description":"Configuration for Slack alerts.","type":"object","default":{},"required":["url"],"properties":{"disabledSeverity":{"description":"List of severities without alerts (e.g. [\"informational\",\"warning\"]).","type":"array","default":[],"items":{"type":"string"}},"url":{"description":"Configuration uri for Slack alerts.","type":"string","default":""}}},"telegram":{"description":"Configuration for Telegram alerts.","type":"object","default":{},"required":["chatID","token"],"properties":{"chatID":{"description":"Telegram chat ID(s), separated by commas.","type":"string","default":""},"disabledSeverity":{"description":"List of severities without alerts (e.g. [\"informational\",\"warning\"]).","type":"array","default":[],"items":{"type":"string"}},"token":{"description":"Telegram bot token.","type":"string","default":""}}}}},"resources":{"description":"Resource configuration.","type":"object","default":{},"properties":{"limits":{"description":"Resource limits.","type":"object","default":{},"properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"requests":{"description":"Resource requests.","type":"object","default":{},"properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}},"storage":{"description":"Persistent volume size for the database.","type":"string","default":"10Gi"},"storageClassName":{"description":"StorageClass used for the database.","type":"string","default":""}}},"grafana":{"description":"Configuration for Grafana.","type":"object","default":{},"properties":{"db":{"description":"Database configuration.","type":"object","default":{},"properties":{"size":{"description":"Persistent volume size for the database.","type":"string","default":"10Gi"}}},"resources":{"description":"Resource configuration.","type":"object","default":{},"properties":{"limits":{"description":"Resource limits.","type":"object","default":{},"properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"requests":{"description":"Resource requests.","type":"object","default":{},"properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}}},"host":{"description":"The hostname used to access Grafana externally (defaults to 'grafana' subdomain for the tenant host).","type":"string","default":""},"logsStorages":{"description":"Configuration of logs storage instances.","type":"array","default":[{"name":"generic","retentionPeriod":"1","storage":"10Gi","storageClassName":"replicated"}],"items":{"type":"object","required":["name","retentionPeriod","storage","storageClassName"],"properties":{"name":{"description":"Name of the storage instance.","type":"string"},"retentionPeriod":{"description":"Retention period for logs.","type":"string","default":"1"},"storage":{"description":"Persistent volume size.","type":"string","default":"10Gi"},"storageClassName":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"}}}},"metricsStorages":{"description":"Configuration of metrics storage instances.","type":"array","default":[{"deduplicationInterval":"15s","name":"shortterm","retentionPeriod":"3d","storage":"10Gi","storageClassName":""},{"deduplicationInterval":"5m","name":"longterm","retentionPeriod":"14d","storage":"10Gi","storageClassName":""}],"items":{"type":"object","required":["deduplicationInterval","name","retentionPeriod","storage"],"properties":{"deduplicationInterval":{"description":"Deduplication interval for metrics.","type":"string"},"name":{"description":"Name of the storage instance.","type":"string"},"retentionPeriod":{"description":"Retention period for metrics.","type":"string"},"storage":{"description":"Persistent volume size.","type":"string","default":"10Gi"},"storageClassName":{"description":"StorageClass used for the data.","type":"string"},"vminsert":{"description":"Configuration for vminsert.","type":"object","properties":{"maxAllowed":{"description":"Maximum allowed resources.","type":"object","properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"minAllowed":{"description":"Minimum guaranteed resources.","type":"object","properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}},"vmselect":{"description":"Configuration for vmselect.","type":"object","properties":{"maxAllowed":{"description":"Maximum allowed resources.","type":"object","properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"minAllowed":{"description":"Minimum guaranteed resources.","type":"object","properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}},"vmstorage":{"description":"Configuration for vmstorage.","type":"object","properties":{"maxAllowed":{"description":"Maximum allowed resources.","type":"object","properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"minAllowed":{"description":"Minimum guaranteed resources.","type":"object","properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}}}},"vmagent":{"description":"Configuration for VictoriaMetrics Agent.","type":"object","default":{},"properties":{"externalLabels":{"description":"External labels applied to all metrics.","default":{"cluster":"cozystack"}},"remoteWrite":{"description":"Remote write configuration.","default":{"urls":["http://vminsert-shortterm:8480/insert/0/prometheus","http://vminsert-longterm:8480/insert/0/prometheus"]}}}}}}
+      {"title":"Chart Values","type":"object","properties":{"host":{"description":"The hostname used to access Grafana externally (defaults to 'grafana' subdomain for the tenant host).","type":"string","default":""},"metricsStorages":{"description":"Configuration of metrics storage instances.","type":"array","default":[{"deduplicationInterval":"15s","name":"shortterm","retentionPeriod":"3d","storage":"10Gi","storageClassName":""},{"deduplicationInterval":"5m","name":"longterm","retentionPeriod":"14d","storage":"10Gi","storageClassName":""}],"items":{"type":"object","required":["deduplicationInterval","name","retentionPeriod","storage"],"properties":{"deduplicationInterval":{"description":"Deduplication interval for metrics.","type":"string"},"name":{"description":"Name of the storage instance.","type":"string"},"retentionPeriod":{"description":"Retention period for metrics.","type":"string"},"storage":{"description":"Persistent volume size.","type":"string","default":"10Gi"},"storageClassName":{"description":"StorageClass used for the data.","type":"string"},"vminsert":{"description":"Configuration for vminsert.","type":"object","properties":{"maxAllowed":{"description":"Maximum allowed resources.","type":"object","properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"minAllowed":{"description":"Minimum guaranteed resources.","type":"object","properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}},"vmselect":{"description":"Configuration for vmselect.","type":"object","properties":{"maxAllowed":{"description":"Maximum allowed resources.","type":"object","properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"minAllowed":{"description":"Minimum guaranteed resources.","type":"object","properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}},"vmstorage":{"description":"Configuration for vmstorage.","type":"object","properties":{"maxAllowed":{"description":"Maximum allowed resources.","type":"object","properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"minAllowed":{"description":"Minimum guaranteed resources.","type":"object","properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}}}},"logsStorages":{"description":"Configuration of logs storage instances.","type":"array","default":[{"name":"generic","retentionPeriod":"1","storage":"10Gi","storageClassName":"replicated"}],"items":{"type":"object","required":["name","retentionPeriod","storage","storageClassName"],"properties":{"name":{"description":"Name of the storage instance.","type":"string"},"retentionPeriod":{"description":"Retention period for logs.","type":"string","default":"1"},"storage":{"description":"Persistent volume size.","type":"string","default":"10Gi"},"storageClassName":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"}}}},"alerta":{"description":"Configuration for the Alerta service.","type":"object","default":{},"properties":{"alerts":{"description":"Alert routing configuration.","type":"object","default":{},"properties":{"slack":{"description":"Configuration for Slack alerts.","type":"object","default":{},"required":["url"],"properties":{"disabledSeverity":{"description":"List of severities without alerts (e.g. [\"informational\",\"warning\"]).","type":"array","default":[],"items":{"type":"string"}},"url":{"description":"Configuration uri for Slack alerts.","type":"string","default":""}}},"telegram":{"description":"Configuration for Telegram alerts.","type":"object","default":{},"required":["chatID","token"],"properties":{"chatID":{"description":"Telegram chat ID(s), separated by commas.","type":"string","default":""},"disabledSeverity":{"description":"List of severities without alerts (e.g. [\"informational\",\"warning\"]).","type":"array","default":[],"items":{"type":"string"}},"token":{"description":"Telegram bot token.","type":"string","default":""}}}}},"resources":{"description":"Resource configuration.","type":"object","default":{},"properties":{"limits":{"description":"Resource limits.","type":"object","default":{},"properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"requests":{"description":"Resource requests.","type":"object","default":{},"properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}},"storage":{"description":"Persistent volume size for the database.","type":"string","default":"10Gi"},"storageClassName":{"description":"StorageClass used for the database.","type":"string","default":""}}},"grafana":{"description":"Configuration for Grafana.","type":"object","default":{},"properties":{"db":{"description":"Database configuration.","type":"object","default":{},"properties":{"size":{"description":"Persistent volume size for the database.","type":"string","default":"10Gi"}}},"resources":{"description":"Resource configuration.","type":"object","default":{},"properties":{"limits":{"description":"Resource limits.","type":"object","default":{},"properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"requests":{"description":"Resource requests.","type":"object","default":{},"properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}}},"vmagent":{"description":"Configuration for VictoriaMetrics Agent.","type":"object","default":{},"properties":{"externalLabels":{"description":"External labels applied to all metrics.","type":"object","default":{"cluster":"cozystack"}},"remoteWrite":{"description":"Remote write configuration.","type":"object","default":{"urls":["http://vminsert-shortterm:8480/insert/0/prometheus","http://vminsert-longterm:8480/insert/0/prometheus"]}}}}}}
   release:
     prefix: ""
     labels:
diff --git a/packages/system/nats-rd/cozyrds/nats.yaml b/packages/system/nats-rd/cozyrds/nats.yaml
index 61c590d3..69cad09c 100644
--- a/packages/system/nats-rd/cozyrds/nats.yaml
+++ b/packages/system/nats-rd/cozyrds/nats.yaml
@@ -8,7 +8,7 @@ spec:
     plural: natses
     singular: nats
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"config":{"description":"NATS configuration.","type":"object","default":{},"properties":{"merge":{"description":"Additional configuration to merge into NATS config.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true},"resolver":{"description":"Additional resolver configuration to merge into NATS config.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"jetstream":{"description":"Jetstream configuration.","type":"object","default":{},"required":["enabled","size"],"properties":{"enabled":{"description":"Enable or disable Jetstream for persistent messaging in NATS.","type":"boolean","default":true},"size":{"description":"Jetstream persistent storage size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"replicas":{"description":"Number of replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each NATS replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"}}}}}}
+      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each NATS replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"}}}},"jetstream":{"description":"Jetstream configuration.","type":"object","default":{},"required":["enabled","size"],"properties":{"enabled":{"description":"Enable or disable Jetstream for persistent messaging in NATS.","type":"boolean","default":true},"size":{"description":"Jetstream persistent storage size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"config":{"description":"NATS configuration.","type":"object","default":{},"properties":{"merge":{"description":"Additional configuration to merge into NATS config.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true},"resolver":{"description":"Additional resolver configuration to merge into NATS config.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}}}}
   release:
     prefix: nats-
     labels:
diff --git a/packages/system/openbao-rd/cozyrds/openbao.yaml b/packages/system/openbao-rd/cozyrds/openbao.yaml
index 9c20776e..47691c88 100644
--- a/packages/system/openbao-rd/cozyrds/openbao.yaml
+++ b/packages/system/openbao-rd/cozyrds/openbao.yaml
@@ -8,7 +8,7 @@ spec:
     plural: openbaos
     singular: openbao
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"replicas":{"description":"Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas > 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration.","type":"integer","default":1},"resources":{"description":"Explicit CPU and memory configuration for each OpenBAO replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size for data storage.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"ui":{"description":"Enable the OpenBAO web UI.","type":"boolean","default":true}}}
+      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas > 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration.","type":"integer","default":1},"resources":{"description":"Explicit CPU and memory configuration for each OpenBAO replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size for data storage.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"ui":{"description":"Enable the OpenBAO web UI.","type":"boolean","default":true}}}
   release:
     prefix: openbao-
     labels:
diff --git a/packages/system/opensearch-rd/cozyrds/opensearch.yaml b/packages/system/opensearch-rd/cozyrds/opensearch.yaml
index be15d8a1..d74430c1 100644
--- a/packages/system/opensearch-rd/cozyrds/opensearch.yaml
+++ b/packages/system/opensearch-rd/cozyrds/opensearch.yaml
@@ -8,7 +8,7 @@ spec:
     singular: opensearch
     plural: opensearches
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"dashboards":{"description":"OpenSearch Dashboards configuration.","type":"object","default":{},"required":["enabled","replicas","resourcesPreset"],"properties":{"enabled":{"description":"Enable OpenSearch Dashboards deployment.","type":"boolean","default":false},"replicas":{"description":"Number of Dashboards replicas.","type":"integer","default":1},"resources":{"description":"Explicit CPU and memory configuration for Dashboards.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset for Dashboards.","type":"string","default":"medium","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"images":{"description":"Container images used by the operator.","type":"object","default":{},"required":["opensearch"],"properties":{"opensearch":{"description":"OpenSearch image.","type":"string","default":""}}},"nodeRoles":{"description":"Node roles configuration.","type":"object","default":{},"required":["data","ingest","master","ml"],"properties":{"data":{"description":"Enable data role.","type":"boolean","default":true},"ingest":{"description":"Enable ingest role.","type":"boolean","default":true},"master":{"description":"Enable cluster_manager role.","type":"boolean","default":true},"ml":{"description":"Enable machine learning role.","type":"boolean","default":false}}},"replicas":{"description":"Number of OpenSearch nodes in the cluster.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration for each OpenSearch node. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. OpenSearch requires minimum 2Gi memory.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"topologySpreadPolicy":{"description":"How strictly to enforce pod distribution across nodes and zones.","type":"string","default":"soft","enum":["soft","hard"]},"users":{"description":"Custom OpenSearch users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user (auto-generated if omitted).","type":"string"},"roles":{"description":"List of OpenSearch roles.","type":"array","items":{"type":"string"}}}}},"version":{"description":"OpenSearch major version to deploy.","type":"string","default":"v2","enum":["v3","v2","v1"]}}}
+      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of OpenSearch nodes in the cluster.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration for each OpenSearch node. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. OpenSearch requires minimum 2Gi memory.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"topologySpreadPolicy":{"description":"How strictly to enforce pod distribution across nodes and zones.","type":"string","default":"soft","enum":["soft","hard"]},"version":{"description":"OpenSearch major version to deploy.","type":"string","default":"v2","enum":["v3","v2","v1"]},"images":{"description":"Container images used by the operator.","type":"object","default":{},"required":["opensearch"],"properties":{"opensearch":{"description":"OpenSearch image.","type":"string","default":""}}},"nodeRoles":{"description":"Node roles configuration.","type":"object","default":{},"required":["data","ingest","master","ml"],"properties":{"data":{"description":"Enable data role.","type":"boolean","default":true},"ingest":{"description":"Enable ingest role.","type":"boolean","default":true},"master":{"description":"Enable cluster_manager role.","type":"boolean","default":true},"ml":{"description":"Enable machine learning role.","type":"boolean","default":false}}},"users":{"description":"Custom OpenSearch users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user (auto-generated if omitted).","type":"string"},"roles":{"description":"List of OpenSearch roles.","type":"array","items":{"type":"string"}}}}},"dashboards":{"description":"OpenSearch Dashboards configuration.","type":"object","default":{},"required":["enabled","replicas","resourcesPreset"],"properties":{"enabled":{"description":"Enable OpenSearch Dashboards deployment.","type":"boolean","default":false},"replicas":{"description":"Number of Dashboards replicas.","type":"integer","default":1},"resources":{"description":"Explicit CPU and memory configuration for Dashboards.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset for Dashboards.","type":"string","default":"medium","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}}
   release:
     prefix: opensearch-
     labels:
diff --git a/packages/system/postgres-rd/cozyrds/postgres.yaml b/packages/system/postgres-rd/cozyrds/postgres.yaml
index b2980e8c..c74c5783 100644
--- a/packages/system/postgres-rd/cozyrds/postgres.yaml
+++ b/packages/system/postgres-rd/cozyrds/postgres.yaml
@@ -8,7 +8,7 @@ spec:
     singular: postgres
     plural: postgreses
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["enabled"],"properties":{"destinationPath":{"description":"Destination path for backups (e.g. s3://bucket/path/).","type":"string","default":"s3://bucket/path/to/folder/"},"enabled":{"description":"Enable regular backups.","type":"boolean","default":false},"endpointURL":{"description":"S3 endpoint URL for uploads.","type":"string","default":"http://minio-gateway-service:9000"},"retentionPolicy":{"description":"Retention policy (e.g. \"30d\").","type":"string","default":"30d"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":"<your-access-key>"},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":"<your-secret-key>"},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * * *"}}},"bootstrap":{"description":"Bootstrap configuration.","type":"object","default":{},"required":["enabled","oldName"],"properties":{"enabled":{"description":"Whether to restore from a backup.","type":"boolean","default":false},"oldName":{"description":"Previous cluster name before deletion.","type":"string","default":""},"recoveryTime":{"description":"Timestamp (RFC3339) for point-in-time recovery; empty means latest.","type":"string","default":""}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"extensions":{"description":"List of enabled PostgreSQL extensions.","type":"array","items":{"type":"string"}},"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"postgresql":{"description":"PostgreSQL server configuration.","type":"object","default":{},"properties":{"parameters":{"description":"PostgreSQL server parameters.","type":"object","default":{},"properties":{"max_connections":{"description":"Maximum number of concurrent connections to the database server.","type":"integer","default":100}}}}},"quorum":{"description":"Quorum configuration for synchronous replication.","type":"object","default":{},"required":["maxSyncReplicas","minSyncReplicas"],"properties":{"maxSyncReplicas":{"description":"Maximum number of synchronous replicas allowed (must be less than total replicas).","type":"integer","default":0},"minSyncReplicas":{"description":"Minimum number of synchronous replicas required for commit.","type":"integer","default":0}}},"replicas":{"description":"Number of Postgres replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each PostgreSQL replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"},"replication":{"description":"Whether the user has replication privileges.","type":"boolean"}}}},"version":{"description":"PostgreSQL major version to deploy","type":"string","default":"v18","enum":["v18","v17","v16","v15","v14","v13"]}}}
+      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of Postgres replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each PostgreSQL replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"version":{"description":"PostgreSQL major version to deploy","type":"string","default":"v18","enum":["v18","v17","v16","v15","v14","v13"]},"postgresql":{"description":"PostgreSQL server configuration.","type":"object","default":{},"properties":{"parameters":{"description":"PostgreSQL server parameters.","type":"object","default":{},"properties":{"max_connections":{"description":"Maximum number of concurrent connections to the database server.","type":"integer","default":100}}}}},"quorum":{"description":"Quorum configuration for synchronous replication.","type":"object","default":{},"required":["maxSyncReplicas","minSyncReplicas"],"properties":{"maxSyncReplicas":{"description":"Maximum number of synchronous replicas allowed (must be less than total replicas).","type":"integer","default":0},"minSyncReplicas":{"description":"Minimum number of synchronous replicas required for commit.","type":"integer","default":0}}},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"},"replication":{"description":"Whether the user has replication privileges.","type":"boolean"}}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"extensions":{"description":"List of enabled PostgreSQL extensions.","type":"array","items":{"type":"string"}},"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["enabled"],"properties":{"destinationPath":{"description":"Destination path for backups (e.g. s3://bucket/path/).","type":"string","default":"s3://bucket/path/to/folder/"},"enabled":{"description":"Enable regular backups.","type":"boolean","default":false},"endpointURL":{"description":"S3 endpoint URL for uploads.","type":"string","default":"http://minio-gateway-service:9000"},"retentionPolicy":{"description":"Retention policy (e.g. \"30d\").","type":"string","default":"30d"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":"<your-access-key>"},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":"<your-secret-key>"},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * * *"}}},"bootstrap":{"description":"Bootstrap configuration.","type":"object","default":{},"required":["enabled","oldName"],"properties":{"enabled":{"description":"Whether to restore from a backup.","type":"boolean","default":false},"oldName":{"description":"Previous cluster name before deletion.","type":"string","default":""},"recoveryTime":{"description":"Timestamp (RFC3339) for point-in-time recovery; empty means latest.","type":"string","default":""}}}}}
   release:
     prefix: postgres-
     labels:
diff --git a/packages/system/qdrant-rd/cozyrds/qdrant.yaml b/packages/system/qdrant-rd/cozyrds/qdrant.yaml
index c89692c0..37a695f0 100644
--- a/packages/system/qdrant-rd/cozyrds/qdrant.yaml
+++ b/packages/system/qdrant-rd/cozyrds/qdrant.yaml
@@ -8,7 +8,7 @@ spec:
     plural: qdrants
     singular: qdrant
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"replicas":{"description":"Number of Qdrant replicas. Cluster mode is automatically enabled when replicas > 1.","type":"integer","default":1},"resources":{"description":"Explicit CPU and memory configuration for each Qdrant replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for vector data storage.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""}}}
+      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of Qdrant replicas. Cluster mode is automatically enabled when replicas > 1.","type":"integer","default":1},"resources":{"description":"Explicit CPU and memory configuration for each Qdrant replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for vector data storage.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false}}}
   release:
     prefix: qdrant-
     labels:
diff --git a/packages/system/rabbitmq-rd/cozyrds/rabbitmq.yaml b/packages/system/rabbitmq-rd/cozyrds/rabbitmq.yaml
index 6ca2b79f..575c4c4c 100644
--- a/packages/system/rabbitmq-rd/cozyrds/rabbitmq.yaml
+++ b/packages/system/rabbitmq-rd/cozyrds/rabbitmq.yaml
@@ -8,7 +8,7 @@ spec:
     plural: rabbitmqs
     singular: rabbitmq
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"replicas":{"description":"Number of RabbitMQ replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration for each RabbitMQ replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"}}}},"version":{"description":"RabbitMQ major.minor version to deploy","type":"string","default":"v4.2","enum":["v4.2","v4.1","v4.0","v3.13"]},"vhosts":{"description":"Virtual hosts configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","required":["roles"],"properties":{"roles":{"description":"Virtual host roles list.","type":"object","properties":{"admin":{"description":"List of admin users.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of readonly users.","type":"array","items":{"type":"string"}}}}}}}}}
+      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of RabbitMQ replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration for each RabbitMQ replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"version":{"description":"RabbitMQ major.minor version to deploy","type":"string","default":"v4.2","enum":["v4.2","v4.1","v4.0","v3.13"]},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"}}}},"vhosts":{"description":"Virtual hosts configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","required":["roles"],"properties":{"roles":{"description":"Virtual host roles list.","type":"object","properties":{"admin":{"description":"List of admin users.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of readonly users.","type":"array","items":{"type":"string"}}}}}}}}}
   release:
     prefix: rabbitmq-
     labels:
diff --git a/packages/system/redis-rd/cozyrds/redis.yaml b/packages/system/redis-rd/cozyrds/redis.yaml
index 0a9aa989..e5191aa4 100644
--- a/packages/system/redis-rd/cozyrds/redis.yaml
+++ b/packages/system/redis-rd/cozyrds/redis.yaml
@@ -8,7 +8,7 @@ spec:
     plural: redises
     singular: redis
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"authEnabled":{"description":"Enable password generation.","type":"boolean","default":true},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"replicas":{"description":"Number of Redis replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each Redis replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"version":{"description":"Redis major version to deploy","type":"string","default":"v8","enum":["v8","v7"]}}}
+      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of Redis replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each Redis replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"version":{"description":"Redis major version to deploy","type":"string","default":"v8","enum":["v8","v7"]},"authEnabled":{"description":"Enable password generation.","type":"boolean","default":true}}}
   release:
     prefix: redis-
     labels:
diff --git a/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml b/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml
index e31c3f3a..8b23b9ed 100644
--- a/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml
+++ b/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml
@@ -8,7 +8,7 @@ spec:
     singular: seaweedfs
     plural: seaweedfses
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"db":{"description":"Database configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of database replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""}}},"filer":{"description":"Filer service configuration.","type":"object","default":{},"properties":{"grpcHost":{"description":"The hostname used to expose or access the filer service externally.","type":"string","default":""},"grpcPort":{"description":"The port used to access the filer service externally.","type":"integer","default":443},"replicas":{"description":"Number of filer replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"whitelist":{"description":"A list of IP addresses or CIDR ranges that are allowed to access the filer service.","type":"array","default":[],"items":{"type":"string"}}}},"host":{"description":"The hostname used to access SeaweedFS externally (defaults to 's3' subdomain for the tenant host).","type":"string","default":""},"master":{"description":"Master service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of master replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"replicationFactor":{"description":"Replication factor: number of replicas for each volume in the SeaweedFS cluster.","type":"integer","default":2},"s3":{"description":"S3 service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of S3 replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"topology":{"description":"The topology of the SeaweedFS cluster.","type":"string","default":"Simple","enum":["Simple","MultiZone","Client"]},"volume":{"description":"Volume service configuration.","type":"object","default":{},"properties":{"diskType":{"description":"SeaweedFS disk type tag for the default volume servers (e.g., \"hdd\", \"ssd\").","type":"string","default":""},"pools":{"description":"A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.","type":"object","default":{},"additionalProperties":{"type":"object","required":["diskType"],"properties":{"diskType":{"description":"SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").","type":"string"},"replicas":{"description":"Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone).","type":"integer"},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.","type":"string","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"Kubernetes StorageClass for the pool. Defaults to volume.storageClass.","type":"string"}}}},"replicas":{"description":"Number of volume replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"zones":{"description":"A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"dataCenter":{"description":"SeaweedFS data center name for this zone. Defaults to the zone name.","type":"string"},"nodeSelector":{"description":"YAML nodeSelector for this zone (default: topology.kubernetes.io/zone: <zoneName>).","type":"string"},"pools":{"description":"A map of storage pools for this zone. Each pool creates a separate Volume StatefulSet per zone.","type":"object","additionalProperties":{"type":"object","required":["diskType"],"properties":{"diskType":{"description":"SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").","type":"string"},"replicas":{"description":"Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone).","type":"integer"},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.","type":"string","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"Kubernetes StorageClass for the pool. Defaults to volume.storageClass.","type":"string"}}}},"replicas":{"description":"Number of replicas in the zone.","type":"integer"},"size":{"description":"Zone storage size.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store zone data. Defaults to volume.storageClass.","type":"string"}}}}}}}}
+      {"title":"Chart Values","type":"object","properties":{"host":{"description":"The hostname used to access SeaweedFS externally (defaults to 's3' subdomain for the tenant host).","type":"string","default":""},"topology":{"description":"The topology of the SeaweedFS cluster.","type":"string","default":"Simple","enum":["Simple","MultiZone","Client"]},"replicationFactor":{"description":"Replication factor: number of replicas for each volume in the SeaweedFS cluster.","type":"integer","default":2},"db":{"description":"Database configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of database replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""}}},"master":{"description":"Master service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of master replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"filer":{"description":"Filer service configuration.","type":"object","default":{},"properties":{"grpcHost":{"description":"The hostname used to expose or access the filer service externally.","type":"string","default":""},"grpcPort":{"description":"The port used to access the filer service externally.","type":"integer","default":443},"replicas":{"description":"Number of filer replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"whitelist":{"description":"A list of IP addresses or CIDR ranges that are allowed to access the filer service.","type":"array","default":[],"items":{"type":"string"}}}},"volume":{"description":"Volume service configuration.","type":"object","default":{},"properties":{"diskType":{"description":"SeaweedFS disk type tag for the default volume servers (e.g., \"hdd\", \"ssd\").","type":"string","default":""},"pools":{"description":"A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.","type":"object","default":{},"additionalProperties":{"type":"object","required":["diskType"],"properties":{"diskType":{"description":"SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").","type":"string"},"replicas":{"description":"Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone).","type":"integer"},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.","type":"string","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"Kubernetes StorageClass for the pool. Defaults to volume.storageClass.","type":"string"}}}},"replicas":{"description":"Number of volume replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"zones":{"description":"A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"dataCenter":{"description":"SeaweedFS data center name for this zone. Defaults to the zone name.","type":"string"},"nodeSelector":{"description":"YAML nodeSelector for this zone (default: topology.kubernetes.io/zone: <zoneName>).","type":"string"},"pools":{"description":"A map of storage pools for this zone. Each pool creates a separate Volume StatefulSet per zone.","type":"object","additionalProperties":{"type":"object","required":["diskType"],"properties":{"diskType":{"description":"SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").","type":"string"},"replicas":{"description":"Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone).","type":"integer"},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.","type":"string","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"Kubernetes StorageClass for the pool. Defaults to volume.storageClass.","type":"string"}}}},"replicas":{"description":"Number of replicas in the zone.","type":"integer"},"size":{"description":"Zone storage size.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store zone data. Defaults to volume.storageClass.","type":"string"}}}}}},"s3":{"description":"S3 service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of S3 replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}}
   release:
     prefix: ""
     labels:
diff --git a/packages/system/tcp-balancer-rd/cozyrds/tcp-balancer.yaml b/packages/system/tcp-balancer-rd/cozyrds/tcp-balancer.yaml
index 4f87f888..cabeedb3 100644
--- a/packages/system/tcp-balancer-rd/cozyrds/tcp-balancer.yaml
+++ b/packages/system/tcp-balancer-rd/cozyrds/tcp-balancer.yaml
@@ -8,7 +8,7 @@ spec:
     plural: tcpbalancers
     singular: tcpbalancer
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"httpAndHttps":{"description":"HTTP and HTTPS configuration.","type":"object","default":{},"required":["mode","targetPorts"],"properties":{"endpoints":{"description":"Endpoint addresses list.","type":"array","default":[],"items":{"type":"string"}},"mode":{"description":"Mode for balancer.","type":"string","default":"tcp","enum":["tcp","tcp-with-proxy"]},"targetPorts":{"description":"Target ports configuration.","type":"object","default":{},"required":["http","https"],"properties":{"http":{"description":"HTTP port number.","type":"integer","default":80},"https":{"description":"HTTPS port number.","type":"integer","default":443}}}}},"replicas":{"description":"Number of HAProxy replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each TCP Balancer replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"whitelist":{"description":"List of allowed client networks.","type":"array","default":[],"items":{"type":"string"}},"whitelistHTTP":{"description":"Secure HTTP by whitelisting client networks (default: false).","type":"boolean","default":false}}}
+      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of HAProxy replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each TCP Balancer replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"httpAndHttps":{"description":"HTTP and HTTPS configuration.","type":"object","default":{},"required":["mode","targetPorts"],"properties":{"endpoints":{"description":"Endpoint addresses list.","type":"array","default":[],"items":{"type":"string"}},"mode":{"description":"Mode for balancer.","type":"string","default":"tcp","enum":["tcp","tcp-with-proxy"]},"targetPorts":{"description":"Target ports configuration.","type":"object","default":{},"required":["http","https"],"properties":{"http":{"description":"HTTP port number.","type":"integer","default":80},"https":{"description":"HTTPS port number.","type":"integer","default":443}}}}},"whitelistHTTP":{"description":"Secure HTTP by whitelisting client networks (default: false).","type":"boolean","default":false},"whitelist":{"description":"List of allowed client networks.","type":"array","default":[],"items":{"type":"string"}}}}
   release:
     prefix: tcp-balancer-
     labels:
diff --git a/packages/system/tenant-rd/cozyrds/tenant.yaml b/packages/system/tenant-rd/cozyrds/tenant.yaml
index 42286a5b..9af11af0 100644
--- a/packages/system/tenant-rd/cozyrds/tenant.yaml
+++ b/packages/system/tenant-rd/cozyrds/tenant.yaml
@@ -8,7 +8,7 @@ spec:
     singular: tenant
     plural: tenants
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"etcd":{"description":"Deploy own Etcd cluster.","type":"boolean","default":false},"host":{"description":"The hostname used to access tenant services (defaults to using the tenant name as a subdomain for its parent tenant host).","type":"string","default":""},"ingress":{"description":"Deploy own Ingress Controller.","type":"boolean","default":false},"monitoring":{"description":"Deploy own Monitoring Stack.","type":"boolean","default":false},"resourceQuotas":{"description":"Define resource quotas for the tenant.","type":"object","default":{},"additionalProperties":{"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}},"schedulingClass":{"description":"The name of a SchedulingClass CR to apply scheduling constraints for this tenant's workloads.","type":"string","default":""},"seaweedfs":{"description":"Deploy own SeaweedFS.","type":"boolean","default":false}}}
+      {"title":"Chart Values","type":"object","properties":{"host":{"description":"The hostname used to access tenant services (defaults to using the tenant name as a subdomain for its parent tenant host).","type":"string","default":""},"etcd":{"description":"Deploy own Etcd cluster.","type":"boolean","default":false},"monitoring":{"description":"Deploy own Monitoring Stack.","type":"boolean","default":false},"ingress":{"description":"Deploy own Ingress Controller.","type":"boolean","default":false},"seaweedfs":{"description":"Deploy own SeaweedFS.","type":"boolean","default":false},"schedulingClass":{"description":"The name of a SchedulingClass CR to apply scheduling constraints for this tenant's workloads.","type":"string","default":""},"resourceQuotas":{"description":"Define resource quotas for the tenant.","type":"object","default":{},"additionalProperties":{"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}
   release:
     prefix: tenant-
     labels:
diff --git a/packages/system/vm-disk-rd/cozyrds/vm-disk.yaml b/packages/system/vm-disk-rd/cozyrds/vm-disk.yaml
index b02797d8..4d0d7e37 100644
--- a/packages/system/vm-disk-rd/cozyrds/vm-disk.yaml
+++ b/packages/system/vm-disk-rd/cozyrds/vm-disk.yaml
@@ -8,7 +8,7 @@ spec:
     singular: vmdisk
     plural: vmdisks
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"optical":{"description":"Defines if disk should be considered optical.","type":"boolean","default":false},"source":{"description":"The source image location used to create a disk.","type":"object","default":{},"properties":{"http":{"description":"Download image from an HTTP source.","type":"object","required":["url"],"properties":{"url":{"description":"URL to download the image.","type":"string"}}},"image":{"description":"Use image by name.","type":"object","required":["name"],"properties":{"name":{"description":"Name of the image to use (uploaded as \"golden image\" or from the list: `ubuntu`, `fedora`, `cirros`, `alpine`, `talos`).","type":"string"}}},"upload":{"description":"Upload local image.","type":"object"}}},"storage":{"description":"The size of the disk allocated for the virtual machine.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"}}}
+      {"title":"Chart Values","type":"object","properties":{"source":{"description":"The source image location used to create a disk.","type":"object","default":{},"properties":{"http":{"description":"Download image from an HTTP source.","type":"object","required":["url"],"properties":{"url":{"description":"URL to download the image.","type":"string"}}},"image":{"description":"Use image by name.","type":"object","required":["name"],"properties":{"name":{"description":"Name of the image to use (uploaded as \"golden image\" or from the list: `ubuntu`, `fedora`, `cirros`, `alpine`, `talos`).","type":"string"}}},"upload":{"description":"Upload local image.","type":"object"}}},"optical":{"description":"Defines if disk should be considered optical.","type":"boolean","default":false},"storage":{"description":"The size of the disk allocated for the virtual machine.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"}}}
   release:
     prefix: vm-disk-
     labels:
diff --git a/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml b/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml
index ff7c8cfe..3cfbf4ef 100644
--- a/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml
+++ b/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml
@@ -8,7 +8,7 @@ spec:
     singular: vminstance
     plural: vminstances
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"cloudInit":{"description":"Cloud-init user data.","type":"string","default":""},"cloudInitSeed":{"description":"Seed string to generate SMBIOS UUID for the VM.","type":"string","default":""},"cpuModel":{"description":"Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map","type":"string","default":""},"disks":{"description":"List of disks to attach.","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"bus":{"description":"Disk bus type (e.g. \"sata\").","type":"string"},"name":{"description":"Disk name.","type":"string"}}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"externalMethod":{"description":"Method to pass through traffic to the VM.","type":"string","default":"PortList","enum":["PortList","WholeIP"]},"externalPorts":{"description":"Ports to forward from outside the cluster.","type":"array","default":[22],"items":{"type":"integer"}},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"name":{"description":"The name of the GPU resource to attach.","type":"string"}}}},"instanceProfile":{"description":"Virtual Machine preferences profile.","type":"string","default":"ubuntu","enum":["alpine","centos.7","centos.7.desktop","centos.stream10","centos.stream10.desktop","centos.stream8","centos.stream8.desktop","centos.stream8.dpdk","centos.stream9","centos.stream9.desktop","centos.stream9.dpdk","cirros","fedora","fedora.arm64","opensuse.leap","opensuse.tumbleweed","rhel.10","rhel.10.arm64","rhel.7","rhel.7.desktop","rhel.8","rhel.8.desktop","rhel.8.dpdk","rhel.9","rhel.9.arm64","rhel.9.desktop","rhel.9.dpdk","rhel.9.realtime","sles","ubuntu","windows.10","windows.10.virtio","windows.11","windows.11.virtio","windows.2k16","windows.2k16.virtio","windows.2k19","windows.2k19.virtio","windows.2k22","windows.2k22.virtio","windows.2k25","windows.2k25.virtio",""]},"instanceType":{"description":"Virtual Machine instance type.","type":"string","default":"u1.medium"},"resources":{"description":"Resource configuration for the virtual machine.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"sockets":{"description":"Number of CPU sockets (vCPU topology).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"runStrategy":{"description":"Requested running state of the VirtualMachineInstance","type":"string","default":"Always","enum":["Always","Halted","Manual","RerunOnFailure","Once"]},"sshKeys":{"description":"List of SSH public keys for authentication.","type":"array","default":[],"items":{"type":"string"}},"subnets":{"description":"Additional subnets","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Subnet name","type":"string"}}}}}}
+      {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"externalMethod":{"description":"Method to pass through traffic to the VM.","type":"string","default":"PortList","enum":["PortList","WholeIP"]},"externalPorts":{"description":"Ports to forward from outside the cluster.","type":"array","default":[22],"items":{"type":"integer"}},"runStrategy":{"description":"Requested running state of the VirtualMachineInstance","type":"string","default":"Always","enum":["Always","Halted","Manual","RerunOnFailure","Once"]},"instanceType":{"description":"Virtual Machine instance type.","type":"string","default":"u1.medium"},"instanceProfile":{"description":"Virtual Machine preferences profile.","type":"string","default":"ubuntu","enum":["alpine","centos.7","centos.7.desktop","centos.stream10","centos.stream10.desktop","centos.stream8","centos.stream8.desktop","centos.stream8.dpdk","centos.stream9","centos.stream9.desktop","centos.stream9.dpdk","cirros","fedora","fedora.arm64","opensuse.leap","opensuse.tumbleweed","rhel.10","rhel.10.arm64","rhel.7","rhel.7.desktop","rhel.8","rhel.8.desktop","rhel.8.dpdk","rhel.9","rhel.9.arm64","rhel.9.desktop","rhel.9.dpdk","rhel.9.realtime","sles","ubuntu","windows.10","windows.10.virtio","windows.11","windows.11.virtio","windows.2k16","windows.2k16.virtio","windows.2k19","windows.2k19.virtio","windows.2k22","windows.2k22.virtio","windows.2k25","windows.2k25.virtio",""]},"disks":{"description":"List of disks to attach.","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"bus":{"description":"Disk bus type (e.g. \"sata\").","type":"string"},"name":{"description":"Disk name.","type":"string"}}}},"subnets":{"description":"Additional subnets","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Subnet name","type":"string"}}}},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"name":{"description":"The name of the GPU resource to attach.","type":"string"}}}},"cpuModel":{"description":"Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map","type":"string","default":""},"resources":{"description":"Resource configuration for the virtual machine.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"sockets":{"description":"Number of CPU sockets (vCPU topology).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"sshKeys":{"description":"List of SSH public keys for authentication.","type":"array","default":[],"items":{"type":"string"}},"cloudInit":{"description":"Cloud-init user data.","type":"string","default":""},"cloudInitSeed":{"description":"Seed string to generate SMBIOS UUID for the VM.","type":"string","default":""}}}
   release:
     prefix: vm-instance-
     labels:
diff --git a/packages/system/vpn-rd/cozyrds/vpn.yaml b/packages/system/vpn-rd/cozyrds/vpn.yaml
index 1d3fe7fb..d2fb9efa 100644
--- a/packages/system/vpn-rd/cozyrds/vpn.yaml
+++ b/packages/system/vpn-rd/cozyrds/vpn.yaml
@@ -8,7 +8,7 @@ spec:
     plural: vpns
     singular: vpn
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"externalIPs":{"description":"List of externalIPs for service. Optional. If not specified, will use LoadBalancer service by default.","type":"array","default":[],"items":{"type":"string"}},"host":{"description":"Host used to substitute into generated URLs.","type":"string","default":""},"replicas":{"description":"Number of VPN server replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each VPN server replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user (autogenerated if not provided).","type":"string"}}}}}}
+      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of VPN server replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each VPN server replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"host":{"description":"Host used to substitute into generated URLs.","type":"string","default":""},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user (autogenerated if not provided).","type":"string"}}}},"externalIPs":{"description":"List of externalIPs for service. Optional. If not specified, will use LoadBalancer service by default.","type":"array","default":[],"items":{"type":"string"}}}}
   release:
     prefix: vpn-
     labels:
diff --git a/pkg/cmd/server/openapi.go b/pkg/cmd/server/openapi.go
index 2742f346..a75fc1a5 100644
--- a/pkg/cmd/server/openapi.go
+++ b/pkg/cmd/server/openapi.go
@@ -337,11 +337,6 @@ func sanitizeForV2(s *spec.Schema) {
 	}
 }
 
-// -----------------------------------------------------------------------------
-// OpenAPI **v2** (swagger) post-processor
-// -----------------------------------------------------------------------------
-// BuildPostProcessV2 returns a Swagger post-processor that clones base
-// Application schemas into per-kind schemas and rewrites $ref pointers.
 // KindSchemasFromConfig extracts the kind→OpenAPISchema mapping from a ResourceConfig.
 func KindSchemasFromConfig(rc *config.ResourceConfig) map[string]string {
 	m := make(map[string]string, len(rc.Resources))
@@ -369,6 +364,11 @@ func ConfigureOpenAPI(cfg *genericapiserver.Config, kindSchemas map[string]strin
 	cfg.OpenAPIV3Config.PostProcessSpec = BuildPostProcessV3(kindSchemas)
 }
 
+// -----------------------------------------------------------------------------
+// OpenAPI **v2** (swagger) post-processor
+// -----------------------------------------------------------------------------
+// BuildPostProcessV2 returns a Swagger post-processor that clones base
+// Application schemas into per-kind schemas and rewrites $ref pointers.
 func BuildPostProcessV2(kindSchemas map[string]string) func(*spec.Swagger) (*spec.Swagger, error) {
 	return func(sw *spec.Swagger) (*spec.Swagger, error) {
 		defs := sw.Definitions

From e0ab4d0639db02a94750fedb4e531f3838a0c74b Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Thu, 19 Mar 2026 12:37:54 +0500
Subject: [PATCH 332/666] [docs] Fixed controller-gen markers

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 api/apps/v1alpha1/bucket/types.go             |   9 +-
 api/apps/v1alpha1/clickhouse/types.go         |   9 +-
 api/apps/v1alpha1/foundationdb/types.go       |   9 +-
 api/apps/v1alpha1/harbor/types.go             |   9 +-
 api/apps/v1alpha1/httpcache/types.go          |   9 +-
 api/apps/v1alpha1/kafka/types.go              |   9 +-
 api/apps/v1alpha1/kubernetes/types.go         |   9 +-
 api/apps/v1alpha1/mariadb/types.go            |   9 +-
 api/apps/v1alpha1/mongodb/types.go            |   9 +-
 api/apps/v1alpha1/nats/types.go               |   9 +-
 api/apps/v1alpha1/openbao/types.go            |   9 +-
 api/apps/v1alpha1/opensearch/types.go         | 115 +++++++++++++
 .../opensearch/zz_generated.deepcopy.go       | 161 ++++++++++++++++++
 api/apps/v1alpha1/postgresql/types.go         |   9 +-
 api/apps/v1alpha1/qdrant/types.go             |   9 +-
 api/apps/v1alpha1/rabbitmq/types.go           |   9 +-
 api/apps/v1alpha1/redis/types.go              |   9 +-
 api/apps/v1alpha1/tcpbalancer/types.go        |   9 +-
 api/apps/v1alpha1/tenant/types.go             |   9 +-
 api/apps/v1alpha1/vmdisk/types.go             |   9 +-
 api/apps/v1alpha1/vminstance/types.go         |   9 +-
 api/apps/v1alpha1/vpc/types.go                |   9 +-
 api/apps/v1alpha1/vpn/types.go                |   9 +-
 hack/update-codegen.sh                        |   5 +-
 packages/apps/opensearch/Makefile             |   2 +-
 25 files changed, 343 insertions(+), 129 deletions(-)
 create mode 100644 api/apps/v1alpha1/opensearch/types.go
 create mode 100644 api/apps/v1alpha1/opensearch/zz_generated.deepcopy.go

diff --git a/api/apps/v1alpha1/bucket/types.go b/api/apps/v1alpha1/bucket/types.go
index 3f7cd3c2..96082a67 100644
--- a/api/apps/v1alpha1/bucket/types.go
+++ b/api/apps/v1alpha1/bucket/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package bucket
 
 import (
diff --git a/api/apps/v1alpha1/clickhouse/types.go b/api/apps/v1alpha1/clickhouse/types.go
index 174eda95..153ff5e0 100644
--- a/api/apps/v1alpha1/clickhouse/types.go
+++ b/api/apps/v1alpha1/clickhouse/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package clickhouse
 
 import (
diff --git a/api/apps/v1alpha1/foundationdb/types.go b/api/apps/v1alpha1/foundationdb/types.go
index b78c2497..5b0e5920 100644
--- a/api/apps/v1alpha1/foundationdb/types.go
+++ b/api/apps/v1alpha1/foundationdb/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package foundationdb
 
 import (
diff --git a/api/apps/v1alpha1/harbor/types.go b/api/apps/v1alpha1/harbor/types.go
index 6d2d07fd..974576b3 100644
--- a/api/apps/v1alpha1/harbor/types.go
+++ b/api/apps/v1alpha1/harbor/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package harbor
 
 import (
diff --git a/api/apps/v1alpha1/httpcache/types.go b/api/apps/v1alpha1/httpcache/types.go
index b31e2f6e..30bb10ba 100644
--- a/api/apps/v1alpha1/httpcache/types.go
+++ b/api/apps/v1alpha1/httpcache/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package httpcache
 
 import (
diff --git a/api/apps/v1alpha1/kafka/types.go b/api/apps/v1alpha1/kafka/types.go
index 80978ae5..485f34ee 100644
--- a/api/apps/v1alpha1/kafka/types.go
+++ b/api/apps/v1alpha1/kafka/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package kafka
 
 import (
diff --git a/api/apps/v1alpha1/kubernetes/types.go b/api/apps/v1alpha1/kubernetes/types.go
index 485b7eff..774fcdc5 100644
--- a/api/apps/v1alpha1/kubernetes/types.go
+++ b/api/apps/v1alpha1/kubernetes/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package kubernetes
 
 import (
diff --git a/api/apps/v1alpha1/mariadb/types.go b/api/apps/v1alpha1/mariadb/types.go
index c456c64f..b3b6c414 100644
--- a/api/apps/v1alpha1/mariadb/types.go
+++ b/api/apps/v1alpha1/mariadb/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package mariadb
 
 import (
diff --git a/api/apps/v1alpha1/mongodb/types.go b/api/apps/v1alpha1/mongodb/types.go
index c5e23838..886b716c 100644
--- a/api/apps/v1alpha1/mongodb/types.go
+++ b/api/apps/v1alpha1/mongodb/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package mongodb
 
 import (
diff --git a/api/apps/v1alpha1/nats/types.go b/api/apps/v1alpha1/nats/types.go
index b165dac5..5437355d 100644
--- a/api/apps/v1alpha1/nats/types.go
+++ b/api/apps/v1alpha1/nats/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package nats
 
 import (
diff --git a/api/apps/v1alpha1/openbao/types.go b/api/apps/v1alpha1/openbao/types.go
index 12fb9d5e..bb5d12d9 100644
--- a/api/apps/v1alpha1/openbao/types.go
+++ b/api/apps/v1alpha1/openbao/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package openbao
 
 import (
diff --git a/api/apps/v1alpha1/opensearch/types.go b/api/apps/v1alpha1/opensearch/types.go
new file mode 100644
index 00000000..b188cdfa
--- /dev/null
+++ b/api/apps/v1alpha1/opensearch/types.go
@@ -0,0 +1,115 @@
+// Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
+package opensearch
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +kubebuilder:object:root=true
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Number of OpenSearch nodes in the cluster.
+	// +kubebuilder:default:=3
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each OpenSearch node. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted. OpenSearch requires minimum 2Gi memory.
+	// +kubebuilder:default:="large"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Persistent Volume Claim size available for application data.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// How strictly to enforce pod distribution across nodes and zones.
+	// +kubebuilder:default:="soft"
+	TopologySpreadPolicy TopologySpreadPolicy `json:"topologySpreadPolicy"`
+	// OpenSearch major version to deploy.
+	// +kubebuilder:default:="v2"
+	Version Version `json:"version"`
+	// Container images used by the operator.
+	// +kubebuilder:default:={}
+	Images Images `json:"images"`
+	// Node roles configuration.
+	// +kubebuilder:default:={}
+	NodeRoles NodeRoles `json:"nodeRoles"`
+	// Custom OpenSearch users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+	// OpenSearch Dashboards configuration.
+	// +kubebuilder:default:={}
+	Dashboards Dashboards `json:"dashboards"`
+}
+
+type Dashboards struct {
+	// Enable OpenSearch Dashboards deployment.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Number of Dashboards replicas.
+	// +kubebuilder:default:=1
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for Dashboards.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset for Dashboards.
+	// +kubebuilder:default:="medium"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+}
+
+type Images struct {
+	// OpenSearch image.
+	// +kubebuilder:default:=""
+	Opensearch string `json:"opensearch"`
+}
+
+type NodeRoles struct {
+	// Enable data role.
+	// +kubebuilder:default:=true
+	Data bool `json:"data"`
+	// Enable ingest role.
+	// +kubebuilder:default:=true
+	Ingest bool `json:"ingest"`
+	// Enable cluster_manager role.
+	// +kubebuilder:default:=true
+	Master bool `json:"master"`
+	// Enable machine learning role.
+	// +kubebuilder:default:=false
+	Ml bool `json:"ml"`
+}
+
+type Resources struct {
+	// CPU available to each node.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each node.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type User struct {
+	// Password for the user (auto-generated if omitted).
+	Password string `json:"password,omitempty"`
+	// List of OpenSearch roles.
+	Roles []string `json:"roles,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
+
+// +kubebuilder:validation:Enum="soft";"hard"
+type TopologySpreadPolicy string
+
+// +kubebuilder:validation:Enum="v3";"v2";"v1"
+type Version string
diff --git a/api/apps/v1alpha1/opensearch/zz_generated.deepcopy.go b/api/apps/v1alpha1/opensearch/zz_generated.deepcopy.go
new file mode 100644
index 00000000..f7f2daef
--- /dev/null
+++ b/api/apps/v1alpha1/opensearch/zz_generated.deepcopy.go
@@ -0,0 +1,161 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package opensearch
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Config) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
+	*out = *in
+	in.Resources.DeepCopyInto(&out.Resources)
+	out.Size = in.Size.DeepCopy()
+	out.Images = in.Images
+	out.NodeRoles = in.NodeRoles
+	if in.Users != nil {
+		in, out := &in.Users, &out.Users
+		*out = make(map[string]User, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+	in.Dashboards.DeepCopyInto(&out.Dashboards)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
+func (in *ConfigSpec) DeepCopy() *ConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Dashboards) DeepCopyInto(out *Dashboards) {
+	*out = *in
+	in.Resources.DeepCopyInto(&out.Resources)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Dashboards.
+func (in *Dashboards) DeepCopy() *Dashboards {
+	if in == nil {
+		return nil
+	}
+	out := new(Dashboards)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Images) DeepCopyInto(out *Images) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Images.
+func (in *Images) DeepCopy() *Images {
+	if in == nil {
+		return nil
+	}
+	out := new(Images)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *NodeRoles) DeepCopyInto(out *NodeRoles) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeRoles.
+func (in *NodeRoles) DeepCopy() *NodeRoles {
+	if in == nil {
+		return nil
+	}
+	out := new(NodeRoles)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	out.Cpu = in.Cpu.DeepCopy()
+	out.Memory = in.Memory.DeepCopy()
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *User) DeepCopyInto(out *User) {
+	*out = *in
+	if in.Roles != nil {
+		in, out := &in.Roles, &out.Roles
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
+func (in *User) DeepCopy() *User {
+	if in == nil {
+		return nil
+	}
+	out := new(User)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/apps/v1alpha1/postgresql/types.go b/api/apps/v1alpha1/postgresql/types.go
index fa7017e2..fa85d51f 100644
--- a/api/apps/v1alpha1/postgresql/types.go
+++ b/api/apps/v1alpha1/postgresql/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package postgresql
 
 import (
diff --git a/api/apps/v1alpha1/qdrant/types.go b/api/apps/v1alpha1/qdrant/types.go
index 041c7e78..203e9a97 100644
--- a/api/apps/v1alpha1/qdrant/types.go
+++ b/api/apps/v1alpha1/qdrant/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package qdrant
 
 import (
diff --git a/api/apps/v1alpha1/rabbitmq/types.go b/api/apps/v1alpha1/rabbitmq/types.go
index e8713e90..f67c4402 100644
--- a/api/apps/v1alpha1/rabbitmq/types.go
+++ b/api/apps/v1alpha1/rabbitmq/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package rabbitmq
 
 import (
diff --git a/api/apps/v1alpha1/redis/types.go b/api/apps/v1alpha1/redis/types.go
index 28a6c53a..e9a02c72 100644
--- a/api/apps/v1alpha1/redis/types.go
+++ b/api/apps/v1alpha1/redis/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package redis
 
 import (
diff --git a/api/apps/v1alpha1/tcpbalancer/types.go b/api/apps/v1alpha1/tcpbalancer/types.go
index cdb8d3dc..aa99cd6d 100644
--- a/api/apps/v1alpha1/tcpbalancer/types.go
+++ b/api/apps/v1alpha1/tcpbalancer/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package tcpbalancer
 
 import (
diff --git a/api/apps/v1alpha1/tenant/types.go b/api/apps/v1alpha1/tenant/types.go
index 1dd0ee58..60f8bb22 100644
--- a/api/apps/v1alpha1/tenant/types.go
+++ b/api/apps/v1alpha1/tenant/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package tenant
 
 import (
diff --git a/api/apps/v1alpha1/vmdisk/types.go b/api/apps/v1alpha1/vmdisk/types.go
index 6637a620..aefac1e4 100644
--- a/api/apps/v1alpha1/vmdisk/types.go
+++ b/api/apps/v1alpha1/vmdisk/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package vmdisk
 
 import (
diff --git a/api/apps/v1alpha1/vminstance/types.go b/api/apps/v1alpha1/vminstance/types.go
index 518070e0..33f58b86 100644
--- a/api/apps/v1alpha1/vminstance/types.go
+++ b/api/apps/v1alpha1/vminstance/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package vminstance
 
 import (
diff --git a/api/apps/v1alpha1/vpc/types.go b/api/apps/v1alpha1/vpc/types.go
index 3f770050..ab447f75 100644
--- a/api/apps/v1alpha1/vpc/types.go
+++ b/api/apps/v1alpha1/vpc/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package vpc
 
 import (
diff --git a/api/apps/v1alpha1/vpn/types.go b/api/apps/v1alpha1/vpn/types.go
index f2c3c87a..7ec0b0e3 100644
--- a/api/apps/v1alpha1/vpn/types.go
+++ b/api/apps/v1alpha1/vpn/types.go
@@ -1,10 +1,7 @@
-// +kubebuilder:object:generate=true
-// +kubebuilder:object:root=true
-// +groupName=values.helm.io
-
-// +versionName=v1alpha1
-
 // Code generated by values-gen. DO NOT EDIT.
+// +kubebuilder:object:generate=true
+// +groupName=apps.cozystack.io
+// +versionName=v1alpha1
 package vpn
 
 import (
diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh
index e8f19e43..f3a47e78 100755
--- a/hack/update-codegen.sh
+++ b/hack/update-codegen.sh
@@ -81,10 +81,11 @@ mv ${TMPDIR}/strategy.backups.cozystack.io*.yaml ${BACKUPSTRATEGY_CRDDIR}/
 
 mv ${TMPDIR}/*.yaml ${COZY_CONTROLLER_CRDDIR}/
 
+# Tidy dependencies for standalone api/apps/v1alpha1 submodule
+(cd "${SCRIPT_ROOT}/api/apps/v1alpha1" && go mod tidy)
+
 # Generate deepcopy for standalone api/apps/v1alpha1 submodule (separate Go module)
 # Use absolute path for headerFile since we cd into the submodule directory
 APPS_API_ROOT="$(cd "${SCRIPT_ROOT}" && pwd)"
 (cd "${APPS_API_ROOT}/api/apps/v1alpha1" && $CONTROLLER_GEN object:headerFile="${APPS_API_ROOT}/hack/boilerplate.go.txt" paths="./...")
 
-# Tidy dependencies for standalone api/apps/v1alpha1 submodule
-(cd "${SCRIPT_ROOT}/api/apps/v1alpha1" && go mod tidy)
diff --git a/packages/apps/opensearch/Makefile b/packages/apps/opensearch/Makefile
index 937c7d41..1781661f 100644
--- a/packages/apps/opensearch/Makefile
+++ b/packages/apps/opensearch/Makefile
@@ -3,7 +3,7 @@ include ../../../hack/package.mk
 .PHONY: generate update
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'opensearch' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/opensearch/types.go
 	../../../hack/update-crd.sh
 
 update:

From fe6b81ea03ba0a366bbee4fef909c3f12e082e7c Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Wed, 25 Mar 2026 15:59:22 +0500
Subject: [PATCH 333/666] [docs] Update cozyvalues-gen

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .github/workflows/pre-commit.yml              |  2 +-
 api/apps/v1alpha1/vpc/types.go                | 20 +++++++++
 packages/apps/vpc/values.schema.json          | 42 +++++++++----------
 .../cozyrds/virtualprivatecloud.yaml          |  2 +-
 4 files changed, 43 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 1e867332..b2d82ff3 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -28,7 +28,7 @@ jobs:
 
       - name: Install generate
         run: |
-          curl -sSL https://github.com/cozystack/cozyvalues-gen/releases/download/v1.2.0/cozyvalues-gen-linux-amd64.tar.gz | tar -xzvf- -C /usr/local/bin/ cozyvalues-gen
+          curl -sSL https://github.com/cozystack/cozyvalues-gen/releases/download/v1.3.0/cozyvalues-gen-linux-amd64.tar.gz | tar -xzvf- -C /usr/local/bin/ cozyvalues-gen
 
       - name: Run pre-commit hooks
         run: |
diff --git a/api/apps/v1alpha1/vpc/types.go b/api/apps/v1alpha1/vpc/types.go
index ab447f75..fed72f58 100644
--- a/api/apps/v1alpha1/vpc/types.go
+++ b/api/apps/v1alpha1/vpc/types.go
@@ -19,6 +19,26 @@ type ConfigSpec struct {
 	// Subnets of a VPC
 	// +kubebuilder:default:={}
 	Subnets []Subnet `json:"subnets,omitempty"`
+	// VPC peering connections (bidirectional declaration required)
+	// +kubebuilder:default:={}
+	Peers []Peer `json:"peers,omitempty"`
+	// Static routes for the VPC
+	// +kubebuilder:default:={}
+	Routes []Route `json:"routes,omitempty"`
+}
+
+type Peer struct {
+	// Namespace of the remote tenant
+	TenantNamespace string `json:"tenantNamespace"`
+	// Logical name of the remote VPC (without "virtualprivatecloud-" prefix)
+	VpcName string `json:"vpcName"`
+}
+
+type Route struct {
+	// Destination CIDR
+	Cidr string `json:"cidr"`
+	// Next hop IP address
+	NextHopIP string `json:"nextHopIP"`
 }
 
 type Subnet struct {
diff --git a/packages/apps/vpc/values.schema.json b/packages/apps/vpc/values.schema.json
index f03c33e6..b25b46ed 100644
--- a/packages/apps/vpc/values.schema.json
+++ b/packages/apps/vpc/values.schema.json
@@ -2,6 +2,27 @@
   "title": "Chart Values",
   "type": "object",
   "properties": {
+    "subnets": {
+      "description": "Subnets of a VPC",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "object",
+        "required": [
+          "name"
+        ],
+        "properties": {
+          "cidr": {
+            "description": "IP address range",
+            "type": "string"
+          },
+          "name": {
+            "description": "Subnet name",
+            "type": "string"
+          }
+        }
+      }
+    },
     "peers": {
       "description": "VPC peering connections (bidirectional declaration required)",
       "type": "array",
@@ -45,27 +66,6 @@
           }
         }
       }
-    },
-    "subnets": {
-      "description": "Subnets of a VPC",
-      "type": "array",
-      "default": [],
-      "items": {
-        "type": "object",
-        "required": [
-          "name"
-        ],
-        "properties": {
-          "cidr": {
-            "description": "IP address range",
-            "type": "string"
-          },
-          "name": {
-            "description": "Subnet name",
-            "type": "string"
-          }
-        }
-      }
     }
   }
 }
diff --git a/packages/system/virtualprivatecloud-rd/cozyrds/virtualprivatecloud.yaml b/packages/system/virtualprivatecloud-rd/cozyrds/virtualprivatecloud.yaml
index ad3b26e4..e1397d2d 100644
--- a/packages/system/virtualprivatecloud-rd/cozyrds/virtualprivatecloud.yaml
+++ b/packages/system/virtualprivatecloud-rd/cozyrds/virtualprivatecloud.yaml
@@ -8,7 +8,7 @@ spec:
     plural: virtualprivateclouds
     singular: virtualprivatecloud
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"peers":{"description":"VPC peering connections (bidirectional declaration required)","type":"array","default":[],"items":{"type":"object","required":["tenantNamespace","vpcName"],"properties":{"tenantNamespace":{"description":"Namespace of the remote tenant","type":"string"},"vpcName":{"description":"Logical name of the remote VPC (without \"virtualprivatecloud-\" prefix)","type":"string"}}}},"routes":{"description":"Static routes for the VPC","type":"array","default":[],"items":{"type":"object","required":["cidr","nextHopIP"],"properties":{"cidr":{"description":"Destination CIDR","type":"string"},"nextHopIP":{"description":"Next hop IP address","type":"string"}}}},"subnets":{"description":"Subnets of a VPC","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"cidr":{"description":"IP address range","type":"string"},"name":{"description":"Subnet name","type":"string"}}}}}}
+      {"title":"Chart Values","type":"object","properties":{"subnets":{"description":"Subnets of a VPC","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"cidr":{"description":"IP address range","type":"string"},"name":{"description":"Subnet name","type":"string"}}}},"peers":{"description":"VPC peering connections (bidirectional declaration required)","type":"array","default":[],"items":{"type":"object","required":["tenantNamespace","vpcName"],"properties":{"tenantNamespace":{"description":"Namespace of the remote tenant","type":"string"},"vpcName":{"description":"Logical name of the remote VPC (without \"virtualprivatecloud-\" prefix)","type":"string"}}}},"routes":{"description":"Static routes for the VPC","type":"array","default":[],"items":{"type":"object","required":["cidr","nextHopIP"],"properties":{"cidr":{"description":"Destination CIDR","type":"string"},"nextHopIP":{"description":"Next hop IP address","type":"string"}}}}}}
   release:
     prefix: "virtualprivatecloud-"
     labels:

From a562d9cb80b28ab75afa95c636fb8fff8bae0595 Mon Sep 17 00:00:00 2001
From: sasha-sup <alexsup4ik@gmail.com>
Date: Wed, 25 Mar 2026 15:42:07 +0300
Subject: [PATCH 334/666] [piraeus-operator] Fix LINSTOR satellite alert labels
 and scrape flapping false positives

Signed-off-by: sasha-sup <alexsup4ik@gmail.com>
---
 .../piraeus-operator/alerts/piraeus-datastore.yaml    | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/packages/system/piraeus-operator/alerts/piraeus-datastore.yaml b/packages/system/piraeus-operator/alerts/piraeus-datastore.yaml
index 77512847..bbc1c81a 100644
--- a/packages/system/piraeus-operator/alerts/piraeus-datastore.yaml
+++ b/packages/system/piraeus-operator/alerts/piraeus-datastore.yaml
@@ -17,9 +17,12 @@ spec:
         - alert: linstorSatelliteErrorRate
           annotations:
             description: |
-              LINSTOR Satellite "{{ $labels.name }}" reports {{ $value }} errors in the last 15 minutes.
-              Use "linstor error-reports list --nodes {{ $labels.name }} --since 15minutes" to see them.
-          expr: increase(linstor_error_reports_count{module="SATELLITE"}[15m]) > 0
+              LINSTOR Satellite "{{ $labels.hostname }}" reports {{ $value }} errors in the last 15 minutes.
+              Use "linstor error-reports list --nodes {{ $labels.hostname }}" to inspect the reports.
+          expr: |
+            increase(linstor_error_reports_count{module="SATELLITE"}[15m]) > 0
+            and on(instance, job)
+            min_over_time(up{job="linstor-controller"}[15m]) == 1
           labels:
             severity: warning
         - alert: linstorControllerErrorRate
@@ -33,7 +36,7 @@ spec:
         - alert: linstorSatelliteNotOnline
           annotations:
             description: |
-              LINSTOR Satellite "{{ $labels.name }}" is not ONLINE.
+              LINSTOR Satellite "{{ $labels.hostname }}" is not ONLINE.
               Check that the Satellite is running and reachable from the LINSTOR Controller.
           expr: linstor_node_state{nodetype="SATELLITE"} != 2
           labels:

From 4a92d7753ceffad979a83793703e99e68e0ab126 Mon Sep 17 00:00:00 2001
From: sasha-sup <alexsup4ik@gmail.com>
Date: Wed, 25 Mar 2026 16:02:59 +0300
Subject: [PATCH 335/666] [piraeus-operator] Add hold time to LINSTOR
 controller offline alert

Signed-off-by: sasha-sup <alexsup4ik@gmail.com>
---
 packages/system/piraeus-operator/alerts/piraeus-datastore.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/system/piraeus-operator/alerts/piraeus-datastore.yaml b/packages/system/piraeus-operator/alerts/piraeus-datastore.yaml
index bbc1c81a..f63c7d10 100644
--- a/packages/system/piraeus-operator/alerts/piraeus-datastore.yaml
+++ b/packages/system/piraeus-operator/alerts/piraeus-datastore.yaml
@@ -12,6 +12,7 @@ spec:
             description: |
               LINSTOR Controller is not reachable.
           expr: up{job="linstor-controller"} == 0
+          for: 3m
           labels:
             severity: critical
         - alert: linstorSatelliteErrorRate

From a052a650b0308538fb0e85511c899a77a60e6b3e Mon Sep 17 00:00:00 2001
From: sasha-sup <alexsup4ik@gmail.com>
Date: Wed, 25 Mar 2026 16:11:14 +0300
Subject: [PATCH 336/666] [piraeus-operator] Split LINSTOR controller
 availability and metrics alerts

Signed-off-by: sasha-sup <alexsup4ik@gmail.com>
---
 .../piraeus-operator/alerts/piraeus-datastore.yaml | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/packages/system/piraeus-operator/alerts/piraeus-datastore.yaml b/packages/system/piraeus-operator/alerts/piraeus-datastore.yaml
index f63c7d10..0cc39fe8 100644
--- a/packages/system/piraeus-operator/alerts/piraeus-datastore.yaml
+++ b/packages/system/piraeus-operator/alerts/piraeus-datastore.yaml
@@ -7,14 +7,22 @@ spec:
   groups:
     - name: linstor.rules
       rules:
-        - alert: linstorControllerOffline
+        - alert: linstorControllerUnavailable
           annotations:
             description: |
-              LINSTOR Controller is not reachable.
-          expr: up{job="linstor-controller"} == 0
+              LINSTOR Controller deployment has no available replicas.
+          expr: kube_deployment_status_replicas_available{namespace="cozy-linstor",deployment="linstor-controller"} < 1
           for: 3m
           labels:
             severity: critical
+        - alert: linstorControllerMetricsScrapeFailing
+          annotations:
+            description: |
+              LINSTOR Controller metrics endpoint is not being scraped successfully.
+          expr: up{job="linstor-controller"} == 0
+          for: 10m
+          labels:
+            severity: warning
         - alert: linstorSatelliteErrorRate
           annotations:
             description: |

From 37f1b3b59c13340623a7ae37cd5b51511f12ddf7 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Thu, 26 Mar 2026 10:13:20 +0500
Subject: [PATCH 337/666] fix(dashboard): add EndpointSlice column definitions
 for Pod serving table

The service details page showed "Raw:" and "Invalid Date" in the Pod
serving table because the EnrichedTable referenced customizationId
"factory-kube-service-details-endpointslice" which had no corresponding
CustomColumnsOverride. Add column definitions for Pod, Addresses, Ready,
and Node fields.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 internal/controller/dashboard/static_refactored.go | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/internal/controller/dashboard/static_refactored.go b/internal/controller/dashboard/static_refactored.go
index e48552af..48576043 100644
--- a/internal/controller/dashboard/static_refactored.go
+++ b/internal/controller/dashboard/static_refactored.go
@@ -154,6 +154,14 @@ func CreateAllCustomColumnsOverrides() []*dashboardv1alpha1.CustomColumnsOverrid
 			createStringColumn("Version", ".status.version"),
 		}),
 
+		// Factory service details endpointslice (Pod serving table)
+		createCustomColumnsOverride("factory-kube-service-details-endpointslice", []any{
+			createStringColumn("Pod", ".targetRef.name"),
+			createArrayColumn("Addresses", ".addresses"),
+			createBoolColumn("Ready", ".conditions.ready"),
+			createStringColumn("Node", ".nodeName"),
+		}),
+
 		// Factory service details port mapping
 		createCustomColumnsOverride("factory-kube-service-details-port-mapping", []any{
 			createStringColumn("Name", ".name"),

From 2a6c4a71547f1af9e3075ba85843bbbc7455a321 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Thu, 26 Mar 2026 10:40:14 +0500
Subject: [PATCH 338/666] fix(dashboard): correct hunk header in flatmap patch

The hunk header claimed 8/13 lines but only 6/11 were present,
causing "corrupt patch at line 18" during git apply in the
openapi-ui image build.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .../patches/flatmap-unresolved-placeholder.diff                 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-unresolved-placeholder.diff b/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-unresolved-placeholder.diff
index dceea424..e98861a3 100644
--- a/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-unresolved-placeholder.diff
+++ b/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-unresolved-placeholder.diff
@@ -1,7 +1,7 @@
 diff --git a/src/components/molecules/EnrichedTable/organisms/EnrichedTableProvider/utils.ts b/src/components/molecules/EnrichedTable/organisms/EnrichedTableProvider/utils.ts
 --- a/src/components/molecules/EnrichedTable/organisms/EnrichedTableProvider/utils.ts
 +++ b/src/components/molecules/EnrichedTable/organisms/EnrichedTableProvider/utils.ts
-@@ -185,8 +185,13 @@
+@@ -185,6 +185,11 @@
                  return `['${escaped}']`
                })
              }

From bad59103f43a2554907490f8713f9b114be7dabe Mon Sep 17 00:00:00 2001
From: sasha-sup <alexsup4ik@gmail.com>
Date: Wed, 25 Mar 2026 13:54:56 +0300
Subject: [PATCH 339/666] [linstor] Fix swapped VMPodScrape job labels

Signed-off-by: sasha-sup <alexsup4ik@gmail.com>
---
 packages/system/linstor/templates/podscrape.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/system/linstor/templates/podscrape.yaml b/packages/system/linstor/templates/podscrape.yaml
index 786bc687..05b1483e 100644
--- a/packages/system/linstor/templates/podscrape.yaml
+++ b/packages/system/linstor/templates/podscrape.yaml
@@ -11,7 +11,7 @@ spec:
     relabelConfigs:
     - action: labeldrop
       regex: (endpoint|namespace|pod|container)
-    - replacement: linstor-controller
+    - replacement: linstor-satellite
       targetLabel: job
     - sourceLabels: [__meta_kubernetes_pod_node_name]
       targetLabel: node
@@ -34,7 +34,7 @@ spec:
     relabelConfigs:
     - action: labeldrop
       regex: (endpoint|namespace|pod|container)
-    - replacement: linstor-satellite
+    - replacement: linstor-controller
       targetLabel: job
     - sourceLabels: [__meta_kubernetes_pod_node_name]
       targetLabel: controller_node

From a7a80a7628d9f6916328d1ecd2d6ca972ba4f18b Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Thu, 26 Mar 2026 16:25:18 +0500
Subject: [PATCH 340/666] fix(dashboard): grant read access to storageclasses
 for authenticated users

The dashboard UI fetches StorageClasses via the Kubernetes API to populate
dropdowns (e.g. in the Postgres form), but the cozystack-dashboard-readonly
ClusterRole did not include storage.k8s.io/storageclasses. This caused
authenticated users to see "Error" instead of the StorageClass name.

Add get/list/watch permissions for storageclasses to the dashboard readonly
role, consistent with the existing backupclasses entry.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/system/dashboard/templates/rbac.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/packages/system/dashboard/templates/rbac.yaml b/packages/system/dashboard/templates/rbac.yaml
index 6dcb5da5..eb687a3e 100644
--- a/packages/system/dashboard/templates/rbac.yaml
+++ b/packages/system/dashboard/templates/rbac.yaml
@@ -20,6 +20,14 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - storage.k8s.io
+  resources:
+  - storageclasses
+  verbs:
+  - get
+  - list
+  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

From 8e01eb5f7ed9f76df42559b6688d41823741ce5c Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Thu, 26 Mar 2026 16:38:12 +0500
Subject: [PATCH 341/666] fix(platform): add missing apps to tenant admin RBAC

The cozy:tenant:admin:base ClusterRole was missing several application
resources from apps.cozystack.io, preventing tenant admins from creating
them (the "Add" button was inactive in the dashboard).

Add the following resources: foundationdbs, harbors, mongodbs, openbaos,
opensearches, qdrants, vpns.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .../system/cozystack-basics/templates/clusterroles.yaml    | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/packages/system/cozystack-basics/templates/clusterroles.yaml b/packages/system/cozystack-basics/templates/clusterroles.yaml
index 72d924ef..32d48557 100644
--- a/packages/system/cozystack-basics/templates/clusterroles.yaml
+++ b/packages/system/cozystack-basics/templates/clusterroles.yaml
@@ -194,12 +194,18 @@ rules:
   - buckets
   - clickhouses
   - foos
+  - foundationdbs
+  - harbors
   - httpcaches
   - kafkas
   - kuberneteses
   - mariadbs
+  - mongodbs
   - natses
+  - openbaos
+  - opensearches
   - postgreses
+  - qdrants
   - rabbitmqs
   - redises
   - seaweedfses
@@ -207,6 +213,7 @@ rules:
   - virtualmachines
   - vmdisks
   - vminstances
+  - vpns
   - infos
   - virtualprivateclouds
   verbs:

From a243f3d72a333caa52cb72ab7a9c8ea4e8b75af4 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Thu, 26 Mar 2026 19:06:04 +0500
Subject: [PATCH 342/666] [platform] Added resource-policy to keep installed
 packages

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/core/platform/templates/_helpers.tpl | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/packages/core/platform/templates/_helpers.tpl b/packages/core/platform/templates/_helpers.tpl
index 684ee812..4bc02429 100644
--- a/packages/core/platform/templates/_helpers.tpl
+++ b/packages/core/platform/templates/_helpers.tpl
@@ -13,6 +13,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: Package
 metadata:
   name: {{ $name }}
+  annotations:
+    helm.sh/resource-policy: keep
 spec:
   variant: {{ $variant }}
 {{- if $components }}
@@ -40,6 +42,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: Package
 metadata:
   name: {{ $name }}
+  annotations:
+    helm.sh/resource-policy: keep
 spec:
   variant: {{ $variant }}
 {{- end }}

From d2030bef87c747bbf59e9757037162cc63c33e90 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Fri, 27 Mar 2026 11:03:23 +0500
Subject: [PATCH 343/666] fix(mariadb): always enable replication for
 consistent service naming

Enable replication unconditionally regardless of replica count.
Previously, single-replica instances created a general service
without -primary/-secondary suffixes, causing dashboard and
backup-cronjob to reference non-existent services.

Also fix duplicate YAML key in backup-cronjob template.

BREAKING CHANGE: Single-replica MariaDB instances will now have
service names with -primary/-secondary suffixes instead of the
bare instance name. Applications connecting via the old service
DNS name need to be updated.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/apps/mariadb/templates/backup-cronjob.yaml | 3 ---
 packages/apps/mariadb/templates/mariadb.yaml        | 7 +------
 2 files changed, 1 insertion(+), 9 deletions(-)

diff --git a/packages/apps/mariadb/templates/backup-cronjob.yaml b/packages/apps/mariadb/templates/backup-cronjob.yaml
index 97b52208..b9ee37ab 100644
--- a/packages/apps/mariadb/templates/backup-cronjob.yaml
+++ b/packages/apps/mariadb/templates/backup-cronjob.yaml
@@ -13,9 +13,6 @@ spec:
   jobTemplate:
     spec:
       backoffLimit: 2
-      template:
-        spec:
-          restartPolicy: OnFailure
       template:
         metadata:
           annotations:
diff --git a/packages/apps/mariadb/templates/mariadb.yaml b/packages/apps/mariadb/templates/mariadb.yaml
index 8a530134..d3d5e636 100644
--- a/packages/apps/mariadb/templates/mariadb.yaml
+++ b/packages/apps/mariadb/templates/mariadb.yaml
@@ -29,13 +29,11 @@ spec:
             - {{ .Release.Name }}
         topologyKey: "kubernetes.io/hostname"
 
-  {{- if gt (int .Values.replicas) 1 }}
   replication:
     enabled: true
     #primary:
     #  podIndex: 0
     #  automaticFailover: true
-  {{- end }}
 
   podMetadata:
     labels:
@@ -65,9 +63,6 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/instance: {{ $.Release.Name }}
-    {{- if and .Values.external (eq (int .Values.replicas) 1) }}
-    type: LoadBalancer
-    {{- end }}
   storage:
     size: {{ .Values.size }}
     resizeInUseVolumes: true
@@ -76,7 +71,7 @@ spec:
     storageClassName: {{ . }}
     {{- end }}
 
-  {{- if and .Values.external (gt (int .Values.replicas) 1) }}
+  {{- if .Values.external }}
   primaryService:
     type: LoadBalancer
   {{- end }}

From 1d58c18ff782c822119c20bc4df9375841b46e07 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Fri, 27 Mar 2026 11:47:32 +0500
Subject: [PATCH 344/666] fix(mariadb): use primary service for backups with
 single replica

When replicas=1, the secondary service has no endpoints because the
only pod is the primary. Route backups to the primary service in this
case to ensure they work correctly.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/apps/mariadb/templates/backup-cronjob.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/apps/mariadb/templates/backup-cronjob.yaml b/packages/apps/mariadb/templates/backup-cronjob.yaml
index b9ee37ab..ddb237cd 100644
--- a/packages/apps/mariadb/templates/backup-cronjob.yaml
+++ b/packages/apps/mariadb/templates/backup-cronjob.yaml
@@ -41,7 +41,7 @@ spec:
                   name: {{ .Release.Name }}
                   key: root-password
             - name: MYSQL_HOST
-              value: {{ .Release.Name }}-secondary
+              value: "{{ .Release.Name }}-{{ if eq (int .Values.replicas) 1 }}primary{{ else }}secondary{{ end }}"
             - name: AWS_ACCESS_KEY_ID
               valueFrom:
                 secretKeyRef:

From c652e1e0f926f89804010b96fb811b948fcfef01 Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Fri, 27 Mar 2026 14:00:46 +0000
Subject: [PATCH 345/666] Prepare release v1.2.0

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 packages/apps/http-cache/images/nginx-cache.tag             | 2 +-
 packages/apps/kubernetes/images/cluster-autoscaler.tag      | 2 +-
 packages/apps/kubernetes/images/kubevirt-csi-driver.tag     | 2 +-
 .../apps/kubernetes/images/ubuntu-container-disk-v1.30.tag  | 2 +-
 .../apps/kubernetes/images/ubuntu-container-disk-v1.31.tag  | 2 +-
 .../apps/kubernetes/images/ubuntu-container-disk-v1.32.tag  | 2 +-
 .../apps/kubernetes/images/ubuntu-container-disk-v1.33.tag  | 2 +-
 .../apps/kubernetes/images/ubuntu-container-disk-v1.34.tag  | 2 +-
 .../apps/kubernetes/images/ubuntu-container-disk-v1.35.tag  | 2 +-
 packages/core/installer/values.yaml                         | 4 ++--
 packages/core/platform/values.yaml                          | 2 +-
 packages/core/testing/values.yaml                           | 2 +-
 packages/extra/bootbox/images/matchbox.tag                  | 2 +-
 packages/extra/seaweedfs/images/objectstorage-sidecar.tag   | 2 +-
 packages/system/backup-controller/values.yaml               | 2 +-
 packages/system/backupstrategy-controller/values.yaml       | 2 +-
 packages/system/bucket/images/s3manager.tag                 | 2 +-
 packages/system/cozystack-api/values.yaml                   | 2 +-
 packages/system/cozystack-controller/values.yaml            | 2 +-
 packages/system/dashboard/templates/configmap.yaml          | 2 +-
 packages/system/dashboard/values.yaml                       | 6 +++---
 .../system/grafana-operator/images/grafana-dashboards.tag   | 2 +-
 packages/system/kamaji/values.yaml                          | 4 ++--
 packages/system/kubeovn-plunger/values.yaml                 | 2 +-
 packages/system/kubeovn-webhook/values.yaml                 | 2 +-
 packages/system/kubevirt-csi-node/values.yaml               | 2 +-
 packages/system/lineage-controller-webhook/values.yaml      | 2 +-
 packages/system/linstor/values.yaml                         | 4 ++--
 packages/system/monitoring/images/grafana.tag               | 2 +-
 packages/system/objectstorage-controller/values.yaml        | 2 +-
 packages/system/seaweedfs/values.yaml                       | 2 +-
 31 files changed, 36 insertions(+), 36 deletions(-)

diff --git a/packages/apps/http-cache/images/nginx-cache.tag b/packages/apps/http-cache/images/nginx-cache.tag
index 2d0e803a..1da929ec 100644
--- a/packages/apps/http-cache/images/nginx-cache.tag
+++ b/packages/apps/http-cache/images/nginx-cache.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/nginx-cache:0.0.0@sha256:cb25e40cb665b8bbeee8cb1ec39da4c9a7452ef3f2f371912bbc0d1b1e2d40a8
+ghcr.io/cozystack/cozystack/nginx-cache:0.0.0@sha256:2f987017ff95d3c782e16ef0d99928831f520daf154d08a2fa38c2d68363e036
diff --git a/packages/apps/kubernetes/images/cluster-autoscaler.tag b/packages/apps/kubernetes/images/cluster-autoscaler.tag
index 22598190..d9fd9a52 100644
--- a/packages/apps/kubernetes/images/cluster-autoscaler.tag
+++ b/packages/apps/kubernetes/images/cluster-autoscaler.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/cluster-autoscaler:0.0.0@sha256:3753b735b0315bee90de54cb25cfebc63bd2cc90ad11ca4fdc0e70439abd5096
+ghcr.io/cozystack/cozystack/cluster-autoscaler:0.0.0@sha256:e9d0aa7e651b03a6713b380101a61832818a91b5f989da9754f58693898c4056
diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
index 925ee9bd..e623b778 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:faaa6bcdb68196edb4baafe643679bd7d2ef35f910c639b71e06a4ecc034f232
+ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:5b209248acba3d8cf0d999edd8a915915a2e565a1c8ac1f5dde0dffec20fa02e
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.30.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.30.tag
index 0a444548..2d1e4d52 100644
--- a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.30.tag
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.30.tag
@@ -1 +1 @@
-ttl.sh/rjfkdsjflsk/ubuntu-container-disk:v1.30@sha256:8c2276f68beb67edf5bf76d6c97b271dd9303b336e1d5850ae2b91a590c9bb57
+ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.30@sha256:51e272db23d64eb20bc44e38cdbb70199fd00a49a958b76c2a89d4a46fec9256
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.31.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.31.tag
index 48878d18..9698df5c 100644
--- a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.31.tag
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.31.tag
@@ -1 +1 @@
-ttl.sh/rjfkdsjflsk/ubuntu-container-disk:v1.31@sha256:2b631cd227bc9b1bae16de033830e756cd6590b512dc0d2b13367ee626f3e4ca
+ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.31@sha256:31c3290305159fe484caf6c5780960cf071dc3939528295336da4abfa731a81b
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.32.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.32.tag
index 948c89ce..90545820 100644
--- a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.32.tag
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.32.tag
@@ -1 +1 @@
-ttl.sh/rjfkdsjflsk/ubuntu-container-disk:v1.32@sha256:600d6ce7df4eaa8cc79c7d6d1b01ecac43e7696beb84eafce752d9210a16455f
+ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.32@sha256:9efb1fe18cffb045530b43ac4b39910f1802d3c16798d733165dcd1c67de9237
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.33.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.33.tag
index 6f0b3c5e..64345fab 100644
--- a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.33.tag
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.33.tag
@@ -1 +1 @@
-ttl.sh/rjfkdsjflsk/ubuntu-container-disk:v1.33@sha256:243e55d6f2887a4f6ce8526de52fd083b7b88194d5c7f3eaa51b87efb557ac88
+ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.33@sha256:a0afca1d6f720cfff764a1bc912bfe404b5e97ff731f6c126a7abdb51ed23f85
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.34.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.34.tag
index 2ac7be2e..f6916755 100644
--- a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.34.tag
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.34.tag
@@ -1 +1 @@
-ttl.sh/rjfkdsjflsk/ubuntu-container-disk:v1.34@sha256:ad8377d5644ba51729dc69dff4c9f6b4a48957075d054a58c61a45d0bb41f6af
+ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.34@sha256:51dfe5ce3e2f8765fde9422ae7e9fba677016ec5e2be41559c5f11a56958b0e6
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.35.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.35.tag
index 9d749933..b80ce821 100644
--- a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.35.tag
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.35.tag
@@ -1 +1 @@
-ttl.sh/rjfkdsjflsk/ubuntu-container-disk:v1.35@sha256:1c2f2430383a9b9882358c60c194465c1b6092b4aa77536a0343cf74155c0067
+ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.35@sha256:c4ae418b2a2c139794cd9630c3b2c2171870cc7748ac200344d2c4ed4283cf0b
diff --git a/packages/core/installer/values.yaml b/packages/core/installer/values.yaml
index c8b5edd7..13c8fd4e 100644
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -1,9 +1,9 @@
 cozystackOperator:
   # Deployment variant: talos, generic, hosted
   variant: talos
-  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.1.0@sha256:9367001a8d1d2dcf08ae74a42ac234eaa6af18f1af64ac28ce8a5946af9c5d3f
+  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.2.0@sha256:dbc0cbd99dbc2405769bed0d33d5e5d3f53e79e0269ad9ddaa26d9eebbcc6da2
   platformSourceUrl: 'oci://ghcr.io/cozystack/cozystack/cozystack-packages'
-  platformSourceRef: 'digest=sha256:7c6da38e7b99ec80d35ba2cef721ea1579f8a0824989454544fa85318bb7bf15'
+  platformSourceRef: 'digest=sha256:c659905000e8279d32965169cde0817e16a5b46f81d305a3606defcd5446abae'
 # Generic variant configuration (only used when cozystackOperator.variant=generic)
 cozystack:
   # Kubernetes API server host (IP only, no protocol/port)
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index 7fd7751d..8baa6845 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -5,7 +5,7 @@ sourceRef:
   path: /
 migrations:
   enabled: false
-  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.1.0@sha256:d7e8955c1ad8c8fbd4ce42b014c0f849d73d0c3faf0cedaac8e15d647fb2f663
+  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.2.0@sha256:3a3d8cfa4323d8023b7c7800d8b552b250bc2de01ca7550fd024a10b12324f6d
   targetVersion: 36
 # Bundle deployment configuration
 bundles:
diff --git a/packages/core/testing/values.yaml b/packages/core/testing/values.yaml
index f80ea6c5..8a1887bd 100644
--- a/packages/core/testing/values.yaml
+++ b/packages/core/testing/values.yaml
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.1.0@sha256:0eae9f519669667d60b160ebb93c127843c470ad9ca3447fceaa54604503a7ba
+  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.2.0@sha256:7964a3e4b11053887be201d62f94138c3a7836c861036c26fb833aa1fcb934e1
diff --git a/packages/extra/bootbox/images/matchbox.tag b/packages/extra/bootbox/images/matchbox.tag
index 81f52edf..67beab8c 100644
--- a/packages/extra/bootbox/images/matchbox.tag
+++ b/packages/extra/bootbox/images/matchbox.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/matchbox:v1.1.0@sha256:e4c872f6dadc2bbcb9200d04a1d9878f62502f74e979b4eae6c7203abc6d8fa6
+ghcr.io/cozystack/cozystack/matchbox:v1.2.0@sha256:313f36db2e8b9dea0cd1a80d73f27a0694e996631d430bbd1b8391fbb9859020
diff --git a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
index 704e9bc7..b4262b02 100644
--- a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
+++ b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.1.0@sha256:2a3595cd88b30af55b2000d3ca204899beecef0012b0e0402754c3914aad1f7f
+ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.2.0@sha256:b508ca451c6051b64e71cedd6209c80ac0e0bea8aa6bb47e838ec9d99bf4796a
diff --git a/packages/system/backup-controller/values.yaml b/packages/system/backup-controller/values.yaml
index 03a9ce6a..a868fba0 100644
--- a/packages/system/backup-controller/values.yaml
+++ b/packages/system/backup-controller/values.yaml
@@ -1,5 +1,5 @@
 backupController:
-  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.1.0@sha256:8e42e29f5d30ecbef1f05cb0601c32703c5f9572b89d2c9032c1dff186e9a526"
+  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.2.0@sha256:07bcd89bd725951801870d819f0fc536705069608f0fe5c20617607af6f8a61a"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/backupstrategy-controller/values.yaml b/packages/system/backupstrategy-controller/values.yaml
index 1cb94695..39466430 100644
--- a/packages/system/backupstrategy-controller/values.yaml
+++ b/packages/system/backupstrategy-controller/values.yaml
@@ -1,5 +1,5 @@
 backupStrategyController:
-  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.1.0@sha256:508e3bd5a83a316732cfb84fe598064e3092482d941cfc53738ca21237642e6f"
+  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.2.0@sha256:0039ec58f531faf5a5ba3f70993c2c71d74dae4cc8e8e83bd21d2cc2adf10d8a"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/bucket/images/s3manager.tag b/packages/system/bucket/images/s3manager.tag
index b799967a..6c3d1449 100644
--- a/packages/system/bucket/images/s3manager.tag
+++ b/packages/system/bucket/images/s3manager.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:5a7cae722ff6b424bdfbc4aba9d072c11b6930e2ee0f5fa97c3a565bd1c8dc88
+ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:73382d7911274e6528cc2272ca9bfdb095c59e78845a3cdffd39d6c8ac29d920
diff --git a/packages/system/cozystack-api/values.yaml b/packages/system/cozystack-api/values.yaml
index dcd174c4..cafd81c9 100644
--- a/packages/system/cozystack-api/values.yaml
+++ b/packages/system/cozystack-api/values.yaml
@@ -1,3 +1,3 @@
 cozystackAPI:
-  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.1.0@sha256:3a8e559b1a71cffb445bab14178d9abeba1b90509f9fec31df5ff5a9a38333d1
+  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.2.0@sha256:b40ba5c87bb625d646dd69075d21dcc1aca18775b3de8e63d04466d60d42cee5
   replicas: 2
diff --git a/packages/system/cozystack-controller/values.yaml b/packages/system/cozystack-controller/values.yaml
index e01aa8be..ab64e34d 100644
--- a/packages/system/cozystack-controller/values.yaml
+++ b/packages/system/cozystack-controller/values.yaml
@@ -1,4 +1,4 @@
 cozystackController:
-  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.1.0@sha256:f04fa839924a761571e1035d83f380f39f62d1708ea8d22f7a323f17bb59ff96
+  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.2.0@sha256:f56c8222411fed890331502939c8d4c5700489e697da39e8e46896cf674cce71
   debug: false
   disableTelemetry: false
diff --git a/packages/system/dashboard/templates/configmap.yaml b/packages/system/dashboard/templates/configmap.yaml
index 9a63c182..69541202 100644
--- a/packages/system/dashboard/templates/configmap.yaml
+++ b/packages/system/dashboard/templates/configmap.yaml
@@ -1,6 +1,6 @@
 {{- $brandingConfig := .Values._cluster.branding | default dict }}
 
-{{- $tenantText := "v1.1.0" }}
+{{- $tenantText := "v1.2.0" }}
 {{- $footerText := "Cozystack" }}
 {{- $titleText := "Cozystack Dashboard" }}
 {{- $logoText := "" }}
diff --git a/packages/system/dashboard/values.yaml b/packages/system/dashboard/values.yaml
index d8550368..5246eb1c 100644
--- a/packages/system/dashboard/values.yaml
+++ b/packages/system/dashboard/values.yaml
@@ -1,6 +1,6 @@
 openapiUI:
-  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.1.0@sha256:bc530ae2e428727eed284d7f80b2eea4fdd98b7618d20cab262eef7199af5fa5
+  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.2.0@sha256:bf68676a809be8b37ae3ab7416b2ae3185a4efa216b8b09358d916df081d0a3e
 openapiUIK8sBff:
-  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.1.0@sha256:c938fee904acd948800d4dc5e121c4c5cd64cb4a3160fb8d2f9dbff0e5168740
+  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.2.0@sha256:89b5c62df0ed9a1984023ba909765e4b60af3f9a61e42ebdd67437d71ebbb645
 tokenProxy:
-  image: ghcr.io/cozystack/cozystack/token-proxy:v1.1.0@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
+  image: ghcr.io/cozystack/cozystack/token-proxy:v1.2.0@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
diff --git a/packages/system/grafana-operator/images/grafana-dashboards.tag b/packages/system/grafana-operator/images/grafana-dashboards.tag
index 71332750..60839fd4 100644
--- a/packages/system/grafana-operator/images/grafana-dashboards.tag
+++ b/packages/system/grafana-operator/images/grafana-dashboards.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/grafana-dashboards:v1.1.0@sha256:2c9aa0b48e2bf6167db198f4d15882bfe51700108edf2e9f6d0942940a2c1204
+ghcr.io/cozystack/cozystack/grafana-dashboards:v1.2.0@sha256:2c9aa0b48e2bf6167db198f4d15882bfe51700108edf2e9f6d0942940a2c1204
diff --git a/packages/system/kamaji/values.yaml b/packages/system/kamaji/values.yaml
index 89227000..63970e8f 100644
--- a/packages/system/kamaji/values.yaml
+++ b/packages/system/kamaji/values.yaml
@@ -3,7 +3,7 @@ kamaji:
     deploy: false
   image:
     pullPolicy: IfNotPresent
-    tag: v1.1.0@sha256:914d04f7442f0faecf18f8282c192dee9fe244a711494a8c892e2f9e2ad415f7
+    tag: v1.2.0@sha256:071f5f893f16918e6f03c3cf42315a3bce1c7624f10c155f3b3e6dfcd4d60c2a
     repository: ghcr.io/cozystack/cozystack/kamaji
   resources:
     limits:
@@ -13,4 +13,4 @@ kamaji:
       cpu: 100m
       memory: 100Mi
   extraArgs:
-    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.1.0@sha256:914d04f7442f0faecf18f8282c192dee9fe244a711494a8c892e2f9e2ad415f7
+    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.2.0@sha256:071f5f893f16918e6f03c3cf42315a3bce1c7624f10c155f3b3e6dfcd4d60c2a
diff --git a/packages/system/kubeovn-plunger/values.yaml b/packages/system/kubeovn-plunger/values.yaml
index 7f22578d..c52e699b 100644
--- a/packages/system/kubeovn-plunger/values.yaml
+++ b/packages/system/kubeovn-plunger/values.yaml
@@ -1,4 +1,4 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.1.0@sha256:b91bf0964a3204e50f703092f190b7d96c078a6ccee430215042ae1275ed5127
+image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.2.0@sha256:39f9f0e6ec42afdd91082f7c025699425096244bb10f4e2f7a1d17155ac0cebb
 ovnCentralName: ovn-central
diff --git a/packages/system/kubeovn-webhook/values.yaml b/packages/system/kubeovn-webhook/values.yaml
index c2fe2c6f..8db1d9af 100644
--- a/packages/system/kubeovn-webhook/values.yaml
+++ b/packages/system/kubeovn-webhook/values.yaml
@@ -1,3 +1,3 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.1.0@sha256:e18f9fd679e38f65362a8d0042f25468272f6d081136ad47027168d8e7e07a4a
+image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.2.0@sha256:e6334c29d3aaf0dea766c88e3e05b53ad623d1bb497b3c836e6f76adade45b29
diff --git a/packages/system/kubevirt-csi-node/values.yaml b/packages/system/kubevirt-csi-node/values.yaml
index 439edef4..ad7e6f01 100644
--- a/packages/system/kubevirt-csi-node/values.yaml
+++ b/packages/system/kubevirt-csi-node/values.yaml
@@ -1,3 +1,3 @@
 storageClass: replicated
 csiDriver:
-  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:faaa6bcdb68196edb4baafe643679bd7d2ef35f910c639b71e06a4ecc034f232
+  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:5b209248acba3d8cf0d999edd8a915915a2e565a1c8ac1f5dde0dffec20fa02e
diff --git a/packages/system/lineage-controller-webhook/values.yaml b/packages/system/lineage-controller-webhook/values.yaml
index f4d62e1c..0776861c 100644
--- a/packages/system/lineage-controller-webhook/values.yaml
+++ b/packages/system/lineage-controller-webhook/values.yaml
@@ -1,5 +1,5 @@
 lineageControllerWebhook:
-  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.1.0@sha256:4d6a2bb76cae84e24cd48c7377b03ed6bdfefe611221d2c0a7f77a5457db8849
+  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.2.0@sha256:fdbd4ed09c2e825880e84b8668d8bb6e0795da5c51d7c20b9d5eb4abe31d3ae0
   debug: false
   localK8sAPIEndpoint:
     enabled: true
diff --git a/packages/system/linstor/values.yaml b/packages/system/linstor/values.yaml
index bcf530b3..3986fc4f 100644
--- a/packages/system/linstor/values.yaml
+++ b/packages/system/linstor/values.yaml
@@ -1,7 +1,7 @@
 piraeusServer:
   image:
     repository: ghcr.io/cozystack/cozystack/piraeus-server
-    tag: 1.32.3@sha256:aa97f39d90c0726b587f0a376504f13d1f308adeb42db7d98cec9ac7de237361
+    tag: 1.32.3@sha256:64c91357affc6317d9544fc35b3ff8b2fcb065ad8fc5ed26f7a2fa8ac991a1c1
 # Talos-specific workarounds (disable for generic Linux like Ubuntu/Debian)
 talos:
   enabled: true
@@ -13,4 +13,4 @@ linstor:
 linstorCSI:
   image:
     repository: ghcr.io/cozystack/cozystack/linstor-csi
-    tag: v1.10.5@sha256:50ab1ab0210d4e7ebfca311f445bb764516db5ddb63fc6d28536b28622eee753
+    tag: v1.10.5@sha256:585ee6336036cb9e0b2183a6ab3f67e1ccb6d35a1df484d36e734444ee09eb4f
diff --git a/packages/system/monitoring/images/grafana.tag b/packages/system/monitoring/images/grafana.tag
index 06fa403d..06eb755a 100644
--- a/packages/system/monitoring/images/grafana.tag
+++ b/packages/system/monitoring/images/grafana.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/grafana:0.0.0@sha256:8ce0cd90c8f614cdabf5a41f8aa50b7dfbd02b31b9a0bd7897927e7f89968e07
+ghcr.io/cozystack/cozystack/grafana:0.0.0@sha256:58ee26efdccf81ee79b4d5478df347b91398280600971eaf4b9626b0ca72ed35
diff --git a/packages/system/objectstorage-controller/values.yaml b/packages/system/objectstorage-controller/values.yaml
index 2145657c..d2a5fc7c 100644
--- a/packages/system/objectstorage-controller/values.yaml
+++ b/packages/system/objectstorage-controller/values.yaml
@@ -1,3 +1,3 @@
 objectstorage:
   controller:
-    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.1.0@sha256:e40e94f3014cfd04cce4230597315a1acfcca2daa8051b987614d0c05da6d928"
+    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.2.0@sha256:05aee8bf8b292150090868163c6bb49962d874ac63858c93f8e130f53dd40b85"
diff --git a/packages/system/seaweedfs/values.yaml b/packages/system/seaweedfs/values.yaml
index 5fea4a0d..679203f5 100644
--- a/packages/system/seaweedfs/values.yaml
+++ b/packages/system/seaweedfs/values.yaml
@@ -177,7 +177,7 @@ seaweedfs:
     bucketClassName: "seaweedfs"
     region: ""
     sidecar:
-      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.1.0@sha256:2a3595cd88b30af55b2000d3ca204899beecef0012b0e0402754c3914aad1f7f"
+      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.2.0@sha256:b508ca451c6051b64e71cedd6209c80ac0e0bea8aa6bb47e838ec9d99bf4796a"
   certificates:
     commonName: "SeaweedFS CA"
     ipAddresses: []

From 662591919b474a0e30cf778456a4fe8bc03edf7b Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Fri, 27 Mar 2026 17:28:43 +0300
Subject: [PATCH 346/666] docs: add changelog for v1.2.0

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.2.0.md | 202 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 202 insertions(+)
 create mode 100644 docs/changelogs/v1.2.0.md

diff --git a/docs/changelogs/v1.2.0.md b/docs/changelogs/v1.2.0.md
new file mode 100644
index 00000000..7624f0c4
--- /dev/null
+++ b/docs/changelogs/v1.2.0.md
@@ -0,0 +1,202 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.2.0
+-->
+
+# Cozystack v1.2.0
+
+Cozystack v1.2.0 delivers significant platform enhancements: a fully managed **OpenSearch** service joining the application catalog, **VPC peering** for secure inter-tenant networking, tenant workload placement control via the new **SchedulingClass** system, a highly-available **VictoriaLogs cluster** replacing the single-node setup, and **Linstor volume relocation** for optimized clone and snapshot restore placement. Additional highlights include external-dns as a standalone extra package, multi-node RWX volume fixes, and a wave of dashboard and monitoring improvements.
+
+## Feature Highlights
+
+### OpenSearch: Managed Search and Analytics Service
+
+Cozystack now ships **OpenSearch** as a fully managed PaaS application — supporting OpenSearch v1, v2, and v3 in a multi-role topology with dedicated master, data, ingest, coordinating, and ML nodes. TLS is enabled by default, HTTP Basic auth is provided out of the box, and custom user definitions allow per-application credentials. The optional **OpenSearch Dashboards** UI can be enabled alongside the engine. External access, topology spread policies, and a comprehensive JSON schema are all included.
+
+A companion `opensearch-operator` system package wraps the upstream Opster OpenSearch Operator v2.8.0 and adds a sysctl DaemonSet to configure the required `vm.max_map_count` kernel parameter on every node automatically. An ApplicationDefinition package ties everything into the Cozystack platform dashboard with schema validation and resource management.
+
+### SchedulingClass: Tenant Workload Placement
+
+Cozystack now supports a **SchedulingClass** CRD that allows platform operators to define cluster-wide scheduling constraints — pinning tenant workloads to specific data centers, hardware generations, or node groups without requiring tenants to manage scheduler configuration themselves. Tenants declare a `schedulingClass` in their Tenant spec; the platform injects the appropriate `schedulerName` into all workloads in that namespace.
+
+The `lineage-controller-webhook` has been extended to verify the referenced SchedulingClass CR before injection, and child tenants inherit their parent's scheduling constraints (children cannot override). A **SchedulingClass dropdown** in the Tenant creation form in the dashboard makes the feature fully self-service. The underlying `cozystack-scheduler` — a custom kube-scheduler extension with SchedulingClass-aware affinity plugins — is now installed and enabled by default as part of the platform.
+
+### VPC Peering for Multi-Tenant Environments
+
+The `vpc` application gains bilateral **VPC peering** using Kube-OVN's native `vpcPeerings` mechanism, allowing tenants to securely interconnect their private networks without routing traffic through public endpoints. Peering link-local IPs (`169.254.0.0/16`) are allocated deterministically from a hash of the sorted VPC pair names, ensuring stable addresses across reconciliations. Static route support (`staticRoutes`) enables fine-grained inter-VPC routing policies. A `cozy-lib` helper (`hexToInt`) performs the deterministic IP allocation, and a JSON Schema validation enforces the `^tenant-` namespace pattern for peered VPCs.
+
+### VictoriaLogs: Clustered Mode for High Availability
+
+The platform's log storage has been upgraded from the deprecated single-node `VLogs` CR to a **VLCluster** deployment with separate vlinsert, vlselect, and vlstorage components, each running with 2 replicas by default — consistent with the existing VMCluster setup. This brings horizontal scalability and resilience to the logging tier. VPA autoscaling is enabled for all VLCluster components, and the victoria-metrics-operator has been upgraded from v0.55.0 to v0.68.1 to add VLCluster CRD support.
+
+### Linstor CSI: Volume Relocation After Clone and Restore
+
+The Linstor CSI driver now carries upstream patches enabling **automatic replica relocation** after PVC clone and snapshot restore operations. Two new parameters control the behavior: `linstor.csi.linbit.com/relocateAfterClone` on StorageClasses moves replicas to optimal nodes after a clone, and `snap.linstor.csi.linbit.com/relocate-after-restore` on VolumeSnapshotClasses does the same after a restore. VolumeSnapshotClasses for Velero and Kasten use cases are pre-configured. This enables full PVC-level backup and restore workflows with automatic data rebalancing, a key prerequisite for production Velero/Kasten integrations.
+
+## Major Features and Improvements
+
+* **[apps] Add managed OpenSearch service**: Deployed as a PaaS application supporting OpenSearch v1/v2/v3 with multi-role node topology, TLS, HTTP Basic auth, custom users, optional OpenSearch Dashboards UI, external access, and topology spread policies; backed by the opster OpenSearch Operator v2.8.0 and a sysctl DaemonSet for `vm.max_map_count` ([**@matthieu-robin**](https://github.com/matthieu-robin) in #1953).
+
+* **[vpc] Add VPC peering support for multi-tenant environments**: Bilateral VPC peering via Kube-OVN's `vpcPeerings`, deterministic link-local IP allocation from sorted VPC pair hash, static routes support, ConfigMap peer discovery enrichment, and JSON Schema validation enforcing `^tenant-` namespace pattern ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2152).
+
+* **[monitoring] Migrate VictoriaLogs from VLogs to VLCluster**: Replaced deprecated single-node `VLogs` CR with clustered `VLCluster` (vlinsert/vlselect/vlstorage, 2 replicas each), added VPA for all components, upgraded victoria-metrics-operator to v0.68.1 ([**@sircthulhu**](https://github.com/sircthulhu) in #2153).
+
+* **[scheduler] Integrate SchedulingClass support for tenant workloads**: Added `schedulingClass` Tenant parameter with inheritance enforcement, `scheduling.cozystack.io/class` namespace label, lineage-webhook extension to verify and inject `schedulerName`, SchedulingClass dropdown in Tenant dashboard form ([**@sircthulhu**](https://github.com/sircthulhu) in #2223).
+
+* **[cozystack-scheduler] Add custom scheduler as an optional system package**: Vendored `cozystack-scheduler` from github.com/cozystack/cozystack-scheduler — a kube-scheduler extension with SchedulingClass-aware affinity plugins, including Helm chart with RBAC, ConfigMap, Deployment, and CRD ([**@lllamnyp**](https://github.com/lllamnyp) in #2205).
+
+* **[platform] Enable cozystack-scheduler by default**: The cozystack-scheduler and SchedulingClass CRD are now installed as default system packages; the backup tool has been moved to optional packages ([**@lllamnyp**](https://github.com/lllamnyp) in #2253).
+
+* **[extra] Add external-dns as a standalone extra package**: Packaged external-dns as an installable extra (tenant-level) component for automatic DNS record management from Kubernetes Service and Ingress resources ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #1988).
+
+* **[linstor] Add linstor-csi patches for clone/snapshot relocation**: New patch enabling `relocateAfterClone` StorageClass parameter and `relocate-after-restore` VolumeSnapshotClass parameter; pre-configured VolumeSnapshotClasses for Velero and relocation workflows; CDI switched to csi-clone strategy ([**@kvaps**](https://github.com/kvaps) in #2133).
+
+* **[monitoring] Add inlineScrapeConfig support to tenant vmagent**: Tenants can now define inline scrape configurations directly in their VMAgent spec, enabling custom metrics collection from services that are not discoverable via standard Kubernetes service discovery ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2200).
+
+* **[monitoring] Add Slack dashboard URL, vmagent environment label, and dynamictext Grafana plugin**: Added `SLACK_DASHBOARD_URL` and `SLACK_SUMMARY_FMT` environment variables for richer alert notifications, per-vmagent `environment` label for metric source identification, and the `dynamictext-panel` plugin for Grafana dashboards ([**@vnyakas**](https://github.com/vnyakas) in #2210).
+
+* **[monitoring] Scope infrastructure dashboards to tenant-root only**: Infrastructure-level Grafana dashboards are now scoped to the tenant-root namespace only, preventing them from appearing in tenant sub-namespaces and reducing dashboard noise ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2197).
+
+* **[tenant] Allow egress to virt-handler for VM metrics scraping**: Extended tenant NetworkPolicy to permit egress to virt-handler pods, enabling Prometheus to scrape VM-level metrics from KubeVirt without additional policy exceptions ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2199).
+
+* **[dashboard] Add keycloakInternalUrl for backend-to-backend OIDC requests**: Added a `keycloakInternalUrl` platform value for the dashboard backend to perform OIDC token introspection via an internal cluster URL, avoiding external round-trips and improving reliability in air-gapped environments ([**@sircthulhu**](https://github.com/sircthulhu) in #2224).
+
+* **[dashboard] Add secret-hash annotation to KeycloakClient for secret sync**: Added a `secret-hash` annotation to the KeycloakClient resource so that changes to the client secret trigger automatic reconciliation and propagation to dependent components ([**@sircthulhu**](https://github.com/sircthulhu) in #2231).
+
+* **[docs] Add OpenAPI and Go types code generation for apps**: Added tooling to generate OpenAPI schemas and Go types from Helm chart values, enabling type-safe programmatic access to managed application configurations and automatic API reference generation ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2214).
+
+## Improvements (minor)
+
+* **[cozystack-scheduler] Update to v0.2.0**: Updated the cozystack-scheduler to v0.2.0 with improved SchedulingClass affinity handling ([**@lllamnyp**](https://github.com/lllamnyp) in #2244).
+
+* **[platform] Ensure cozystack-packages OCIRepository updates reliably**: Added configuration to ensure the `cozystack-packages` OCIRepository resource is consistently reconciled and reflects the latest package versions on upgrade ([**@sircthulhu**](https://github.com/sircthulhu) in #2246).
+
+* **[etcd] Add protective limits to defrag CronJob**: Added CPU and memory resource limits to the etcd defragmentation CronJob to prevent it from starving other workloads during scheduled defragmentation runs ([**@sircthulhu**](https://github.com/sircthulhu) in #2233).
+
+* **[platform] Add missing apps to tenant admin RBAC**: Extended the tenant admin ClusterRole to include RBAC permissions for recently added applications that were missing from the role binding ([**@sircthulhu**](https://github.com/sircthulhu) in #2268).
+
+## Bug Fixes
+
+* **[keycloak] Fix health probe configuration for Keycloak v26.x+**: Replaced deprecated `KC_PROXY=edge` with `KC_PROXY_HEADERS=xforwarded`/`KC_HTTP_ENABLED=true`; replaced liveness/readiness probes with management port endpoints (`/health/live`, `/health/ready`) and added a `startupProbe` to handle slow Keycloak startup without triggering premature restarts ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2162).
+
+* **[migrations] Handle missing RabbitMQ CRD in migration 34**: Fixed a crash in migration script 34 that occurred when the RabbitMQ CRD was not yet installed, allowing upgrades from environments where RabbitMQ was never deployed ([**@IvanHunters**](https://github.com/IvanHunters) in #2168).
+
+* **[platform] Fix VM MAC address not preserved during migration**: Fixed the `virtual-machine` to `vm-instance` migration script to correctly carry over the MAC address, preventing network identity changes after upgrading existing VM resources ([**@sircthulhu**](https://github.com/sircthulhu) in #2169).
+
+* **[dashboard] Fix External IPs factory EnrichedTable rendering**: Corrected the External IPs factory component to use the EnrichedTable renderer, resolving blank/broken rendering of the external IP address list in the dashboard ([**@IvanHunters**](https://github.com/IvanHunters) in #2175).
+
+* **[dashboard] Preserve disabled/hidden state on MarketplacePanel reconciliation**: Fixed a regression where MarketplacePanel reconciliation would reset the `disabled` and `hidden` flags set by operators, causing hidden applications to reappear in the catalog ([**@IvanHunters**](https://github.com/IvanHunters) in #2176).
+
+* **[dashboard] Exclude hidden MarketplacePanel resources from sidebar menu**: Fixed the sidebar to omit applications that have been hidden via MarketplacePanel flags, preventing inaccessible menu entries from being displayed to users ([**@IvanHunters**](https://github.com/IvanHunters) in #2177).
+
+* **[etcd-operator] Replace deprecated kube-rbac-proxy image**: Replaced the unmaintained `gcr.io/kubebuilder/kube-rbac-proxy` sidecar with the actively maintained `quay.io/brancz/kube-rbac-proxy` image to eliminate deprecation warnings and ensure continued security updates ([**@kvaps**](https://github.com/kvaps) in #2181).
+
+* **[backups] Fix RBAC and backupstrategy-controller location**: Corrected role bindings and the deployment location for the backup strategy controller to restore full backup and restore functionality ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2149).
+
+* **[api] Skip OpenAPI post-processor for non-apps group versions**: Fixed the API server to bypass OpenAPI schema post-processing for non-`apps` group versions, preventing schema corruption in unrelated API groups ([**@kvaps**](https://github.com/kvaps) in #2212).
+
+* **[bucket] Fix s3manager endpoint mismatch with COSI credentials**: Corrected the S3 Manager UI to use the actual S3 endpoint from the BucketInfo COSI resource rather than a hardcoded value, resolving connection failures when the S3 endpoint differs from the default ([**@IvanHunters**](https://github.com/IvanHunters) in #2211).
+
+* **[kubernetes] Fix tenant Kubernetes cluster creation for versions < 1.32**: Resolved a template rendering error that prevented creation of tenant Kubernetes clusters with versions older than 1.32 ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2209).
+
+* **[kube-ovn] Fix MASTER_NODES detection for multi-master Kubernetes clusters**: Updated kube-ovn configuration to discover control-plane nodes via the standard `node-role.kubernetes.io/control-plane` label rather than relying on static node lists, fixing OVN connectivity issues in multi-master generic Kubernetes deployments ([**@lexfrei**](https://github.com/lexfrei) in #2245).
+
+* **[kubernetes] Fix CiliumNetworkPolicy endpointSelector for multi-node RWX volumes**: Corrected the CiliumNetworkPolicy endpoint selector for NFS-based ReadWriteMany volumes to properly allow NFS traffic when data is spread across multiple Linstor storage nodes ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2227).
+
+* **[csi] Hide disk.img and lost+found from RWX NFS mounts**: Fixed the Linstor CSI NFS server to exclude internal files (`disk.img`, `lost+found`) from being visible inside NFS-mounted volumes, preventing application errors caused by unexpected files in volume root directories ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2243).
+
+* **[dashboard] Fix broken backup menu links missing cluster context**: Restored cluster context in backup-related sidebar navigation links, fixing 404 errors when navigating to BackupJob and Plan pages from the cluster-level dashboard view ([**@kvaps**](https://github.com/kvaps) in #2232).
+
+* **[dashboard] Fix StorageClass dropdown "Error" state by granting RBAC read access**: Added a ClusterRole/ClusterRoleBinding to grant authenticated users read access to StorageClass resources, resolving the "Error" state displayed in StorageClass dropdowns on application forms ([**@sircthulhu**](https://github.com/sircthulhu) in #2267).
+
+* **[postgres] Fix database deletion lifecycle management**: Added cleanup stages to delete databases and orphaned roles when removed from `values.databases`, enabling declarative database lifecycle management and preventing stale data retention ([**@sircthulhu**](https://github.com/sircthulhu) in #2247).
+
+* **[dashboard] Fix JSONPath crash on Tenant details with resourceQuotas**: Restored fallback protection for unresolved flatMap placeholders in the ResourceQuota "Used" column, preventing JSONPath parser crashes on the Tenant details page ([**@sircthulhu**](https://github.com/sircthulhu) in #2249).
+
+* **[system] Fix tenant RBAC for endpointslices read access**: Added `discovery.k8s.io/endpointslices` read permissions to tenant ClusterRoles, resolving 403 errors on the Service details page when displaying the "Pod serving" section ([**@sircthulhu**](https://github.com/sircthulhu) in #2257).
+
+* **[linstor] Fix swapped VMPodScrape job labels**: Corrected the `job` label relabeling in LINSTOR VictoriaMetrics PodScrape templates, fixing `linstorControllerOffline` alerts that incorrectly reported satellite endpoints as controller failures ([**@sasha-sup**](https://github.com/sasha-sup) in #2264).
+
+* **[piraeus-operator] Fix LINSTOR satellite alert labels and scrape flapping false positives**: Fixed non-existent `name` label in `linstorSatelliteErrorRate` alert annotations (changed to `hostname`) and prevented false positives caused by scrape flapping and stale metric counters ([**@sasha-sup**](https://github.com/sasha-sup) in #2265).
+
+* **[dashboard] Fix EndpointSlice column definitions for Pod serving table**: Added missing `CustomColumnsOverride` for the EndpointSlice table on service details page, replacing "Raw:" prefixes and "Invalid Date" values with proper Pod, Addresses, Ready, and Node columns ([**@sircthulhu**](https://github.com/sircthulhu) in #2266).
+
+## Dependencies & Version Updates
+
+* **[cilium] Update Cilium to v1.19.1**: Upgraded the Cilium CNI to v1.19.1 with latest bug fixes and performance improvements ([**@BROngineer**](https://github.com/BROngineer) in #2173).
+
+* **[keycloak-operator] Update to v1.32.0**: Updated the Keycloak Operator to v1.32.0 (based on epam/edp-keycloak-operator with upstream patches), bumping Keycloak to 26.5.2 ([**@lllamnyp**](https://github.com/lllamnyp) in #2206).
+
+* **[postgres-operator] Update to v1.27.3**: Upgraded the Postgres Operator (Patroni-based) to v1.27.3 with latest upstream fixes ([**@dmpopoff**](https://github.com/dmpopoff) in #2226).
+
+* **[objectstorage-controller] Update to v0.2.2, drop upstreamed patches**: Updated the object storage controller to v0.2.2 and removed patches that were accepted upstream, reducing the maintenance delta ([**@lexfrei**](https://github.com/lexfrei) in #2261).
+
+* **[kilo] Switch from fork to upstream squat/kilo**: Replaced the Cozystack-maintained Kilo fork with the upstream `squat/kilo` image now that required patches (`--internal-cidr`, allowed-location-ips fix, preferred source for WireGuard routes, Cilium IPIP overlay support) have been merged upstream ([**@lexfrei**](https://github.com/lexfrei) in #2259).
+
+* **[talos] Bump Talos to v1.12.6**: Updated the pinned Talos version to v1.12.6 ([**@kvaps**](https://github.com/kvaps) in #2254).
+
+* **[talm] Release v0.22.4** (github.com/cozystack/talm): Fixed `--file`/`--template` flag requirement to prevent ambiguous invocations ([**@kvaps**](https://github.com/kvaps) in cozystack/talm#112).
+
+* **[boot-to-talos] Release v0.7.0** (github.com/cozystack/boot-to-talos): Added support for ISO, RAW, and HTTP image sources ([**@lexfrei**](https://github.com/lexfrei) in cozystack/boot-to-talos#13); permanent MAC addresses for predictable interface names ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/boot-to-talos#14); detection and workaround for 5-level paging (LA57) incompatibility with kexec ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/boot-to-talos#15).
+
+* **[boot-to-talos] Release v0.7.1** (github.com/cozystack/boot-to-talos): Fixed EFI boot entry creation to use the target disk rather than relying on the installer disk, preventing boot failures on bare-metal systems ([**@kvaps**](https://github.com/kvaps) in cozystack/boot-to-talos#16).
+
+## Development, Testing, and CI/CD
+
+* **[tests] Stabilize E2E Kubernetes tests**: Comprehensive improvements to E2E test stability: pre-cleanup of leftover resources, fixes for port-forward race conditions and leaks, improved NFS PVC timeout and debug output, proper EXIT trap handling, and increased CAPI deployment timeouts ([**@lexfrei**](https://github.com/lexfrei) in #2262).
+
+* **[ci] Fix E2E check blocking docs-only PRs**: Moved path filtering to the job level so that documentation-only pull requests are not blocked by pending E2E CI checks ([**@IvanHunters**](https://github.com/IvanHunters) in #2170).
+
+* **[ci] Add timeout-minutes to Build and E2E jobs**: Added explicit `timeout-minutes` constraints to Build and E2E workflow jobs to prevent stuck runners from consuming CI resources indefinitely.
+
+## Documentation
+
+* **[website] Complete CA rotation documentation**: Added comprehensive CA certificate rotation procedures for all Cozystack system components ([**@kvaps**](https://github.com/kvaps) in cozystack/website#406).
+
+* **[website] Add Ansible automated installation guide**: Added a step-by-step guide for automated Cozystack installation using Ansible playbooks ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#442).
+
+* **[website] Add self-signed certificates configuration guide for OIDC**: Added documentation for configuring Cozystack to use self-signed TLS certificates with OIDC providers, covering certificate authority setup and kubeconfig integration ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#443).
+
+* **[website] Add custom metrics collection guide**: Added a guide explaining how to configure custom Prometheus scrape targets using the new `inlineScrapeConfig` feature of tenant VMAgent ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#444).
+
+* **[website] Add PackageSource/Package architecture to Key Concepts**: Documented the PackageSource and Package CRD architecture, explaining how operators extend the platform with custom application catalogs ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#445).
+
+* **[website] Add SchedulingClass operations guide**: Added a guide covering SchedulingClass CRD creation, tenant assignment, and workload placement verification ([**@lllamnyp**](https://github.com/lllamnyp) in cozystack/website#455).
+
+* **[website] Add VMInstance and VMDisk backups documentation**: Added user-facing documentation for backing up and restoring virtual machine instances and VM disk images using Velero ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#456).
+
+* **[website] Update developer guide**: Updated the developer guide with current build, test, and contribution workflows including OCIRepository and migration tooling ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#458).
+
+* **[website] Document keycloakInternalUrl platform value**: Added documentation explaining how to configure `keycloakInternalUrl` for backend-to-backend OIDC token introspection in cluster-internal environments ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#452).
+
+* **[website] Add DependenciesNotReady troubleshooting guide**: Added a troubleshooting article explaining how to diagnose and resolve the `DependenciesNotReady` package status condition ([**@kvaps**](https://github.com/kvaps) in cozystack/website#450).
+
+* **[website] Reorder installation steps for operator-before-platform**: Updated the installation guide to install the cozystack-operator before applying the platform package, reflecting the correct dependency order ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#449).
+
+* **[website] Update managed apps reference**: Updated the automatically generated managed applications reference documentation to reflect new apps and schema changes in this release ([**@app/github-actions**](https://github.com/apps/github-actions) in cozystack/website#448).
+
+* **[website] Update screenshots for Cozystack v1.1**: Refreshed dashboard screenshots to reflect the updated UI in Cozystack v1.1 ([**@kvaps**](https://github.com/kvaps) in cozystack/website#447).
+
+* **[website] Enhance operator backups guide**: Improved the backup and recovery guide for operators with additional recovery scenarios and procedures ([**@androndo**](https://github.com/androndo) in cozystack/website#440).
+
+## Contributors
+
+We'd like to thank all contributors who made this release possible:
+
+* [**@androndo**](https://github.com/androndo)
+* [**@BROngineer**](https://github.com/BROngineer)
+* [**@dmpopoff**](https://github.com/dmpopoff)
+* [**@IvanHunters**](https://github.com/IvanHunters)
+* [**@kvaps**](https://github.com/kvaps)
+* [**@lexfrei**](https://github.com/lexfrei)
+* [**@lllamnyp**](https://github.com/lllamnyp)
+* [**@mattia-eleuteri**](https://github.com/mattia-eleuteri)
+* [**@matthieu-robin**](https://github.com/matthieu-robin)
+* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
+* [**@sasha-sup**](https://github.com/sasha-sup)
+* [**@sircthulhu**](https://github.com/sircthulhu)
+* [**@tym83**](https://github.com/tym83)
+* [**@vnyakas**](https://github.com/vnyakas)
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.1.0...v1.2.0

From 812d4138bba92aec7c51c955cab1696cbbd8bcb3 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Sat, 28 Mar 2026 08:31:56 +0100
Subject: [PATCH 347/666] fix(linstor): preserve TCP ports during toggle-disk
 operations

Update fix-duplicate-tcp-ports patch to preserve existing TCP ports when
DrbdRscData is recreated during toggle-disk operations. Without this,
removeLayerData() frees ports and ensureStackDataExists() may allocate
different ones, causing port mismatches between controller and satellites
if the satellite misses the update.

Also add dh_strip_nondeterminism override in Dockerfile to fix build
failures on some JAR files.

Upstream: https://github.com/LINBIT/linstor-server/pull/476#issuecomment-4147527442

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../linstor/images/piraeus-server/Dockerfile  |   2 +
 .../images/piraeus-server/patches/README.md   |   4 +-
 .../patches/fix-duplicate-tcp-ports.diff      | 165 ++++++++++++------
 3 files changed, 112 insertions(+), 59 deletions(-)

diff --git a/packages/system/linstor/images/piraeus-server/Dockerfile b/packages/system/linstor/images/piraeus-server/Dockerfile
index 049a3f47..f93e494f 100644
--- a/packages/system/linstor/images/piraeus-server/Dockerfile
+++ b/packages/system/linstor/images/piraeus-server/Dockerfile
@@ -61,6 +61,8 @@ RUN test -d .gradlehome && echo ".gradlehome found in tarball" || (echo ".gradle
 # Build DEB packages from tarball
 # Override GRADLE_FLAGS to remove --offline flag, allowing Gradle to download missing dependencies
 RUN sed -i 's/GRADLE_FLAGS = --offline/GRADLE_FLAGS =/' debian/rules || true
+# Skip dh_strip_nondeterminism to avoid failures on some JAR files (logback-core)
+RUN printf '\noverride_dh_strip_nondeterminism:\n\ttrue\n' >> debian/rules
 RUN LD_LIBRARY_PATH='' dpkg-buildpackage -rfakeroot -b -uc
 
 # Copy built .deb packages to a location accessible from final image
diff --git a/packages/system/linstor/images/piraeus-server/patches/README.md b/packages/system/linstor/images/piraeus-server/patches/README.md
index 5ee29318..558fdfeb 100644
--- a/packages/system/linstor/images/piraeus-server/patches/README.md
+++ b/packages/system/linstor/images/piraeus-server/patches/README.md
@@ -8,7 +8,7 @@ Custom patches for piraeus-server (linstor-server) v1.32.3.
   - Upstream: [#475](https://github.com/LINBIT/linstor-server/pull/475)
 - **force-metadata-check-on-disk-add.diff** — Create metadata during toggle-disk from diskless to diskful
   - Upstream: [#474](https://github.com/LINBIT/linstor-server/pull/474)
-- **fix-duplicate-tcp-ports.diff** — Prevent duplicate TCP ports after toggle-disk operations
-  - Upstream: [#476](https://github.com/LINBIT/linstor-server/pull/476)
+- **fix-duplicate-tcp-ports.diff** — Preserve TCP ports during toggle-disk to prevent port mismatch between controller and satellites
+  - Upstream: [#476](https://github.com/LINBIT/linstor-server/pull/476) (superseded by this expanded fix)
 - **skip-adjust-when-device-inaccessible.diff** — Fix resources stuck in StandAlone after reboot, Unknown state race condition, and encrypted resource deletion
   - Upstream: [#477](https://github.com/LINBIT/linstor-server/pull/477)
diff --git a/packages/system/linstor/images/piraeus-server/patches/fix-duplicate-tcp-ports.diff b/packages/system/linstor/images/piraeus-server/patches/fix-duplicate-tcp-ports.diff
index 07cd9eac..b34a2500 100644
--- a/packages/system/linstor/images/piraeus-server/patches/fix-duplicate-tcp-ports.diff
+++ b/packages/system/linstor/images/piraeus-server/patches/fix-duplicate-tcp-ports.diff
@@ -1,80 +1,131 @@
-From 1250abe99d64a0501795e37d3b6af62410002239 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Andrei Kvapil <kvapss@gmail.com>
-Date: Mon, 12 Jan 2026 13:44:46 +0100
-Subject: [PATCH] fix(drbd): prevent duplicate TCP ports after toggle-disk
- operations
+Date: Fri, 28 Mar 2026 13:00:00 +0100
+Subject: [PATCH] fix(drbd): preserve TCP ports during toggle-disk operations
 
-Remove redundant ensureStackDataExists() call with empty payload from
-resetStoragePools() method that was causing TCP port conflicts after
-toggle-disk operations.
+Prevent TCP port mismatches after toggle-disk operations by preserving
+existing TCP ports when rebuilding DrbdRscData.
 
 Root Cause:
 -----------
-The resetStoragePools() method, introduced in 2019 (commit 95cc17d0b8),
-calls ensureStackDataExists() with an empty LayerPayload. This worked
-correctly when TCP ports were stored at RscDfn level.
+During toggle-disk operations, removeLayerData() deletes DrbdRscData
+(freeing its TCP ports from the number pool), then ensureStackDataExists()
+creates new DrbdRscData. Since the payload has no explicit tcpPorts,
+the controller allocates new ports from the pool -- which may differ from
+the old ports if other resources claimed them in the meantime.
 
-After the TCP port migration to per-node level (commit f754943463, May
-2025), this empty payload results in DrbdRscData being created without
-TCP ports assigned. The controller then sends a Pojo with an empty port
-Set to satellites.
+The controller correctly avoids collisions in its own number pool, but
+the satellite may miss the update (e.g. during controller restart or
+network issues). When this happens, the satellite keeps the old ports
+while peers receive the new ones, causing DRBD connection failures
+(StandAlone/Connecting state).
 
-On satellites, when DrbdRscData is initialized with an empty port list,
-initPorts() uses preferredNewPortsRef from peer resources. Since
-SatelliteDynamicNumberPool.tryAllocate() always returns true (no-op),
-any port from preferredNewPortsRef is accepted without conflict checking,
-leading to duplicate TCP port assignments.
-
-Impact:
--------
-This regression affects toggle-disk operations, particularly:
-- Snapshot creation/restore operations
-- Manual toggle-disk operations
-- Any operation calling resetStoragePools()
-
-Symptoms include:
-- DRBD resources failing to adjust with "port is also used" errors
-- Resources stuck in StandAlone or Connecting states
-- Multiple resources on the same node using identical TCP ports
+Additionally, remove the redundant ensureStackDataExists() call from
+resetStoragePools() -- the caller already invokes it with the correct
+payload.
 
 Solution:
 ---------
-Remove the ensureStackDataExists() call from resetStoragePools() as it
-is redundant. The calling code (e.g., CtrlRscToggleDiskApiCallHandler
-line 1071) already invokes ensureStackDataExists() with the correct
-payload immediately after resetStoragePools().
+1. Add copyDrbdTcpPortsIfExists() to save existing TCP ports into the
+   LayerPayload before removeLayerData() deletes them.
+2. Call it from copyDrbdNodeIdIfExists() (covers both toggle-disk paths)
+   and from the needsDeactivate path (shared storage pool case).
+3. Remove the redundant ensureStackDataExists() from resetStoragePools().
 
-This fix ensures:
-1. resetStoragePools() only resets storage pool assignments
-2. Layer data creation with proper TCP ports happens via the caller's
-   ensureStackDataExists() with correct payload
-3. No DrbdRscData objects are created without TCP port assignments
-
-Related Issues:
----------------
-Fixes #454 - Duplicate TCP ports after backup/restore operations
-Related to user reports of resources stuck in StandAlone after node
-reboots when toggle-disk or backup operations were in progress.
-
-Testing:
---------
-Verified that:
-- Toggle-disk operations no longer create resources without TCP ports
-- Backup/restore operations complete without TCP port conflicts
-- Resources maintain unique TCP ports across toggle-disk cycles
+This ensures the same TCP ports are reused when DrbdRscData is recreated,
+eliminating the window for port mismatch between controller and satellites.
 
 Co-Authored-By: Claude <noreply@anthropic.com>
 Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
 ---
- .../linbit/linstor/layer/resource/CtrlRscLayerDataFactory.java  | 2 --
- 1 file changed, 2 deletions(-)
+ .../controller/CtrlRscToggleDiskApiCallHandler.java | 40 +++++++++++++++++++--
+ .../linstor/layer/resource/CtrlRscLayerDataFactory.java |  2 --
+ 2 files changed, 38 insertions(+), 4 deletions(-)
 
+diff --git a/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java b/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java
+index ccdb0cee5..b0554c2ec 100644
+--- a/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java
++++ b/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java
+@@ -58,6 +58,7 @@ import com.linbit.linstor.stateflags.StateFlags;
+ import com.linbit.linstor.storage.StorageException;
+ import com.linbit.linstor.storage.data.adapter.drbd.DrbdRscData;
+ import com.linbit.linstor.storage.interfaces.categories.resource.AbsRscLayerObject;
++import com.linbit.linstor.core.types.TcpPortNumber;
+ import com.linbit.linstor.storage.interfaces.categories.resource.VlmProviderObject;
+ import com.linbit.linstor.storage.kinds.DeviceLayerKind;
+ import com.linbit.linstor.storage.kinds.DeviceProviderKind;
+@@ -88,6 +89,7 @@ import java.util.LinkedHashMap;
+ import java.util.List;
+ import java.util.Map.Entry;
+ import java.util.Set;
++import java.util.TreeSet;
+
+ import org.reactivestreams.Publisher;
+ import reactor.core.publisher.Flux;
+@@ -587,8 +589,9 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL
+
+                 /*
+                  * We also have to remove the currently diskless DrbdRscData and free up the node-id as now we must
+-                 * use the shared resource's node-id
++                 * use the shared resource's node-id. We still need to preserve TCP ports though.
+                  */
++                copyDrbdTcpPortsIfExists(rsc, payload);
+             }
+             else
+             {
+@@ -726,7 +729,7 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL
+     /**
+      * Although we need to rebuild the layerData as the layerList might have changed, if we do not
+      * deactivate (i.e. down) the current resource, we need to make sure that deleting DrbdRscData
+-     * and recreating a new DrbdRscData ends up with the same node-id as before.
++     * and recreating a new DrbdRscData ends up with the same node-id and TCP ports as before.
+      */
+     private void copyDrbdNodeIdIfExists(Resource rsc, LayerPayload payload) throws ImplementationError
+     {
+@@ -743,6 +746,37 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL
+             DrbdRscData<Resource> drbdRscData = (DrbdRscData<Resource>) drbdRscDataSet.iterator().next();
+             payload.drbdRsc.nodeId = drbdRscData.getNodeId().value;
+         }
++        copyDrbdTcpPortsIfExists(rsc, payload);
++    }
++
++    /**
++     * Preserves existing TCP ports during toggle-disk operations.
++     *
++     * When removeLayerData() deletes DrbdRscData, the TCP ports are freed from the number pool.
++     * If ensureStackDataExists() then allocates different ports, and the satellite misses the update
++     * (e.g. due to controller restart or connectivity issues), the satellite keeps the old ports
++     * while peers get the new ones, causing DRBD connections to fail with StandAlone state.
++     */
++    private void copyDrbdTcpPortsIfExists(Resource rsc, LayerPayload payload) throws ImplementationError
++    {
++        Set<AbsRscLayerObject<Resource>> drbdRscDataSet = LayerRscUtils.getRscDataByLayer(
++            getLayerData(apiCtx, rsc),
++            DeviceLayerKind.DRBD
++        );
++        if (!drbdRscDataSet.isEmpty())
++        {
++            DrbdRscData<Resource> drbdRscData = (DrbdRscData<Resource>) drbdRscDataSet.iterator().next();
++            Collection<TcpPortNumber> tcpPorts = drbdRscData.getTcpPortList();
++            if (tcpPorts != null && !tcpPorts.isEmpty())
++            {
++                Set<Integer> portInts = new TreeSet<>();
++                for (TcpPortNumber port : tcpPorts)
++                {
++                    portInts.add(port.value);
++                }
++                payload.drbdRsc.tcpPorts = portInts;
++            }
++        }
+     }
+
+     private List<DeviceLayerKind> removeLayerData(Resource rscRef)
 diff --git a/controller/src/main/java/com/linbit/linstor/layer/resource/CtrlRscLayerDataFactory.java b/controller/src/main/java/com/linbit/linstor/layer/resource/CtrlRscLayerDataFactory.java
 index 3538b380c..4f589145e 100644
 --- a/controller/src/main/java/com/linbit/linstor/layer/resource/CtrlRscLayerDataFactory.java
 +++ b/controller/src/main/java/com/linbit/linstor/layer/resource/CtrlRscLayerDataFactory.java
 @@ -276,8 +276,6 @@ public class CtrlRscLayerDataFactory
- 
+
                  rscDataToProcess.addAll(rscData.getChildren());
              }
 -
@@ -82,6 +133,6 @@ index 3538b380c..4f589145e 100644
          }
          catch (AccessDeniedException exc)
          {
--- 
+--
 2.39.5 (Apple Git-154)
 

From 8d566eedd801ba166a45ef1f89466537e137436b Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Sun, 29 Mar 2026 13:16:35 +0500
Subject: [PATCH 348/666] Added check-readiness.sh script

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 hack/check-readiness.sh | 83 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 83 insertions(+)
 create mode 100755 hack/check-readiness.sh

diff --git a/hack/check-readiness.sh b/hack/check-readiness.sh
new file mode 100755
index 00000000..bd3a3ffc
--- /dev/null
+++ b/hack/check-readiness.sh
@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+# Check readiness of Packages, ArtifactGenerators, ExternalArtifacts, and HelmReleases
+# Shows only non-ready resources
+#
+# Usage: check-readiness.sh [-w [INTERVAL]]
+#   -w [INTERVAL]  Watch mode: refresh continuously every INTERVAL seconds (default: 5)
+
+set -euo pipefail
+
+KUBECTL="kubectl"
+if [[ -n "${KUBECONFIG:-}" ]]; then
+  KUBECTL="kubectl --kubeconfig=${KUBECONFIG}"
+fi
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BOLD='\033[1m'
+RESET='\033[0m'
+
+WATCH=0
+INTERVAL=5
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -w|--watch)
+      WATCH=1
+      if [[ $# -gt 1 && "$2" =~ ^[0-9]+$ ]]; then
+        INTERVAL="$2"
+        shift
+      fi
+      shift
+      ;;
+    *) echo "Unknown argument: $1"; exit 2 ;;
+  esac
+done
+
+check_resource() {
+  local kind="$1"
+  local header_printed=0
+
+  while IFS= read -r line; do
+    if [[ "$line" =~ ^(NAME|NAMESPACE) ]]; then
+      continue
+    fi
+    if ! echo "$line" | awk '{for(i=1;i<=NF;i++) if($i=="True") exit 0; exit 1}'; then
+      if [[ $header_printed -eq 0 ]]; then
+        echo -e "${BOLD}${YELLOW}=== ${kind} (not ready) ===${RESET}"
+        header_printed=1
+      fi
+      echo -e "${RED}${line}${RESET}"
+      found_issues=1
+    fi
+  done < <($KUBECTL get "$kind" -A 2>/dev/null)
+
+  return 0
+}
+
+run_once() {
+  found_issues=0
+
+  check_resource packages.cozystack.io
+  check_resource artifactgenerators.source.extensions.fluxcd.io
+  check_resource externalartifacts.source.toolkit.fluxcd.io
+  check_resource helmreleases.helm.toolkit.fluxcd.io
+
+  if [[ $found_issues -eq 0 ]]; then
+    echo -e "${GREEN}${BOLD}All resources are ready.${RESET}"
+  fi
+}
+
+if [[ $WATCH -eq 1 ]]; then
+  while true; do
+    output=$(run_once 2>&1)
+    clear
+    echo -e "${BOLD}Last updated: $(date)  (refreshing every ${INTERVAL}s, Ctrl+C to stop)${RESET}\n"
+    echo -e "$output"
+    sleep "$INTERVAL"
+  done
+else
+  run_once
+  [[ $found_issues -eq 0 ]] || exit 1
+fi

From ad21e38219a3f8acdb4a23772db8ab3ad18054e3 Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Mon, 30 Mar 2026 01:44:23 +0000
Subject: [PATCH 349/666] docs: add changelog for v1.0.7

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.0.7.md | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 docs/changelogs/v1.0.7.md

diff --git a/docs/changelogs/v1.0.7.md b/docs/changelogs/v1.0.7.md
new file mode 100644
index 00000000..942115bf
--- /dev/null
+++ b/docs/changelogs/v1.0.7.md
@@ -0,0 +1,27 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.0.7
+-->
+
+## Fixes
+
+* **[platform] Fix tenant admins unable to create FoundationDB, Harbor, MongoDB, OpenBAO, OpenSearch, Qdrant, and VPN applications**: The `cozy:tenant:admin:base` ClusterRole was missing RBAC entries for `foundationdbs`, `harbors`, `mongodbs`, `openbaos`, `opensearches`, `qdrants`, and `vpns` resources from `apps.cozystack.io`. Without these permissions, tenant admins could not create these applications — the "Add" button was inactive in the dashboard. The fix adds all seven missing resource verbs ([**@sircthulhu**](https://github.com/sircthulhu) in #2268, #2271).
+
+* **[system] Fix 403 error on Service details page for tenant users**: The `cozy:tenant:base` and `cozy:tenant:view:base` ClusterRoles were missing read permissions for `discovery.k8s.io/endpointslices`. The dashboard requests EndpointSlices to display the "Pod serving" section on the Service details page, and without this permission tenant users received a 403 error. The fix adds `get`, `list`, and `watch` verbs for endpointslices to both tenant roles ([**@sircthulhu**](https://github.com/sircthulhu) in #2257, #2284).
+
+* **[dashboard] Fix "Pod serving" table showing "Raw:" prefixes and "Invalid Date" on Service details page**: The EndpointSlice table on the service details page displayed raw data and broken timestamps because the `EnrichedTable` component referenced the `factory-kube-service-details-endpointslice` customization ID which had no corresponding `CustomColumnsOverride`. The fix adds column definitions for Pod (`.targetRef.name`), Addresses (`.addresses`), Ready (`.conditions.ready`), and Node (`.nodeName`) ([**@sircthulhu**](https://github.com/sircthulhu) in #2266, #2282).
+
+* **[dashboard] Fix broken backup menu links missing cluster context**: Backup resources (plans, backupjobs, backups) are not `ApplicationDefinitions`, so `ensureNavigation()` never created their `baseFactoriesMapping` entries. Without these mappings, the OpenUI frontend could not resolve the `{cluster}` context for backup pages, producing broken sidebar links with an empty cluster segment (e.g. `/openapi-ui//tenant-root/...` instead of `/openapi-ui/default/tenant-root/...`). The fix adds the three missing static entries to the Navigation resource ([**@sircthulhu**](https://github.com/sircthulhu) in #2232, #2270).
+
+* **[linstor] Fix swapped VMPodScrape job labels causing incorrect alerts**: The `job` labels in the `cozy-linstor` VictoriaMetrics `VMPodScrape` templates were swapped: `linstor-satellite` metrics were relabeled as `job=linstor-controller` and vice versa. This caused `linstorControllerOffline` alerts to fire against satellite endpoints (`:9942`) while reporting the controller as unreachable. The fix ensures `linstor-satellite` metrics keep `job=linstor-satellite` and `linstor-controller` metrics keep `job=linstor-controller`, restoring consistent alerting and dashboard semantics ([**@sasha-sup**](https://github.com/sasha-sup) in #2264, #2288).
+
+* **[piraeus-operator] Fix LINSTOR satellite alert annotations and reduce false-positive alerts**: Two issues in the LINSTOR alerts shipped by `cozy-piraeus-operator` were fixed. First, `linstorSatelliteErrorRate` used a non-existent `name` label in annotations, resulting in `Satellite ""` in alert notifications — corrected to use `{{ $labels.hostname }}`. Second, `linstorSatelliteErrorRate` produced false positives when the `linstor-controller` scrape flapped and historical `linstor_error_reports_count` counters reappeared inside the alert window — fixed by requiring stable `up{job="linstor-controller"}` for the full 15-minute window. Additionally, the controller availability alert was split to add a dedicated warning for metrics scrape failures with a 10-minute hold time to reduce transient noise ([**@sasha-sup**](https://github.com/sasha-sup) in #2265, #2287).
+
+## Documentation
+
+* **[website] Add Backup and Recovery guide for VMInstance and VMDisk**: Replaced the generic Kubernetes Backup and Recovery guide with a virtualization-focused Backup and Recovery doc covering VMInstance and VMDisk one-off and scheduled backups, restores, status checks, and troubleshooting (including Velero-related notes) ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#456).
+
+* **[website] Update developer guide with operator-driven architecture and OCIRepository/migration flow**: Rewrote the development guide to describe the operator-driven in-cluster architecture, bootstrap flow, operator responsibilities, and platform install/update sequence. Added documentation for OCIRepositories and the migration flow with migration hook examples and sequencing rules for pre-upgrade/install migrations. Also updated the concepts guide with the two-repository update model, dependency ordering rules, namespace creation behavior, and cluster-wide values injection ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#458).
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.6...v1.0.7

From ea6f030b6a7a9990ef787832b9a83e55e7263d44 Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Mon, 30 Mar 2026 01:49:34 +0000
Subject: [PATCH 350/666] docs: add changelog for v1.1.4

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.1.4.md | 41 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 docs/changelogs/v1.1.4.md

diff --git a/docs/changelogs/v1.1.4.md b/docs/changelogs/v1.1.4.md
new file mode 100644
index 00000000..f1e4ede9
--- /dev/null
+++ b/docs/changelogs/v1.1.4.md
@@ -0,0 +1,41 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.1.4
+-->
+
+## Features and Improvements
+
+* **[boot-to-talos] Add support for ISO, RAW, and HTTP image sources**: The `boot-to-talos` tool can now use ISO files, raw disk images, and HTTP URLs as Talos image sources in addition to container registry images. This allows bootstrapping nodes in air-gapped environments or from locally stored images without requiring a container registry ([**@lexfrei**](https://github.com/lexfrei) in cozystack/boot-to-talos#13).
+
+* **[boot-to-talos] Use permanent MAC address for predictable network interface names**: Interface name detection now reads the permanent MAC address directly from sysfs instead of relying on udev data, providing a stable hardware MAC that is unaffected by user modifications to the active MAC address. This makes network interface naming more reliable across reboots and hardware changes ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/boot-to-talos#14).
+
+## Fixes
+
+* **[dashboard] Fix broken backup menu links missing cluster context**: Backup resources (plans, backupjobs, backups) are not `ApplicationDefinition`s, so `ensureNavigation()` never created their `baseFactoriesMapping` entries. Without these entries the OpenUI frontend could not resolve the `{cluster}` context for backup pages, producing broken sidebar links with an empty cluster segment (e.g. `/openapi-ui//tenant-root/...`). The missing `baseFactoriesMapping` entries for all backup resource types are now added to the static `Navigation` resource ([**@sircthulhu**](https://github.com/sircthulhu) in #2232, #2269).
+
+* **[platform] Fix tenant admins unable to create FoundationDB, Harbor, MongoDB, OpenBAO, OpenSearch, Qdrant, and VPN applications**: The `cozy:tenant:admin:base` `ClusterRole` was missing seven application resources from `apps.cozystack.io` (`foundationdbs`, `harbors`, `mongodbs`, `openbaos`, `opensearches`, `qdrants`, `vpns`). Without these permissions, tenant admins could not create these applications — the "Add" button was inactive in the dashboard. The missing resources have been added to the ClusterRole ([**@sircthulhu**](https://github.com/sircthulhu) in #2268, #2272).
+
+* **[dashboard] Fix StorageClass dropdown showing "Error" in application forms**: The dashboard UI fetches `StorageClass` resources to populate dropdowns (e.g. in the Postgres form), but the `cozystack-dashboard-readonly` `ClusterRole` did not include `storage.k8s.io/storageclasses`. This caused authenticated users to see "Error" instead of the StorageClass name. `get`/`list`/`watch` permissions for `storageclasses` have been added to the dashboard readonly role ([**@sircthulhu**](https://github.com/sircthulhu) in #2267, #2274).
+
+* **[system] Fix 403 error on Service details page by granting tenants read access to EndpointSlices**: The dashboard requested `EndpointSlices` from the `discovery.k8s.io` API group to display the "Pod serving" section on the Service details page, but `cozy:tenant:base` and `cozy:tenant:view:base` `ClusterRole`s lacked permissions for this resource. Tenant users received a 403 error when opening the Service details page. `get`/`list`/`watch` permissions for `endpointslices` have been added to both tenant ClusterRoles ([**@sircthulhu**](https://github.com/sircthulhu) in #2257, #2285).
+
+* **[dashboard] Fix "Pod serving" table displaying "Raw:" and "Invalid Date" on Service details page**: The Service details page `EndpointSlice` table showed "Raw:" prefixes and "Invalid Date" values because the `EnrichedTable` referenced `customizationId` `factory-kube-service-details-endpointslice` which had no corresponding `CustomColumnsOverride`. Column definitions for Pod (`.targetRef.name`), Addresses (`.addresses`), Ready (`.conditions.ready`), and Node (`.nodeName`) have been added ([**@sircthulhu**](https://github.com/sircthulhu) in #2266, #2283).
+
+* **[piraeus-operator] Fix LINSTOR satellite alert labels, reduce scrape-flap false positives, and improve controller alerting**: Three alerting issues in `cozy-piraeus-operator` have been addressed: (1) `linstorSatelliteErrorRate` used a non-existent `name` label in annotations, resulting in `Satellite ""` in alert notifications — corrected to `{{ $labels.hostname }}`; (2) `linstorSatelliteErrorRate` could produce false positives when the `linstor-controller` scrape flapped and historical `linstor_error_reports_count` counters reappeared inside the alert window — fixed by adding a minimum scrape-count guard; (3) The `LinstorControllerOffline` alert has been split into separate availability and metrics-availability alerts with configurable hold time to reduce noise during brief connectivity interruptions ([**@sasha-sup**](https://github.com/sasha-sup) in #2265, #2286).
+
+* **[linstor] Fix swapped VMPodScrape job labels causing incorrect controller offline alerts**: The `cozy-linstor` VictoriaMetrics `VMPodScrape` templates had the `job` relabeling rules swapped: `linstor-satellite` metrics were labeled as `job=linstor-controller` and vice versa. This caused `linstorControllerOffline` alerts to fire for satellite endpoints (`:9942`) while reporting that the controller was unreachable. The `job` labels are now correctly assigned to their respective targets ([**@sasha-sup**](https://github.com/sasha-sup) in #2264, #2289).
+
+* **[boot-to-talos] Fix triple-fault on hosts with 5-level paging (LA57) enabled**: On hosts with `CONFIG_X86_5LEVEL=y` in the kernel, kexec into Talos caused a triple-fault because the Talos kernel does not support 5-level page tables. `boot-to-talos` now detects LA57 before kexec and automatically patches GRUB with `no5lvl`, runs `update-grub`, and reboots. After reboot with 5-level paging disabled, `boot-to-talos` proceeds normally ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/boot-to-talos#15).
+
+* **[boot-to-talos] Fix EFI boot entry creation when using loop device images**: Talos installer skips EFI variable creation when running on loop devices. `boot-to-talos` now creates a proper UEFI boot entry with an `HD()` device path pointing to the real target disk's ESP by reading the GPT partition table from the target disk after image copy, instead of relying on the Talos installer ([**@kvaps**](https://github.com/kvaps) in cozystack/boot-to-talos#16).
+
+* **[talm] Fix silent empty output when no template files are specified**: Running `talm template` without `--file` or `--template` flags previously produced minimal or empty output without any error. Validation has been added to `engine.Render` to return a clear error message when no template files are specified, making misconfigured invocations immediately apparent ([**@kvaps**](https://github.com/kvaps) in cozystack/talm#112).
+
+## Documentation
+
+* **[website] Add documentation for VMInstance and VMDisk backups**: Added a new virtualization-focused Backup and Recovery guide covering one-off and scheduled backups for `VMInstance` and `VMDisk` resources, restore procedures, status verification commands, and troubleshooting notes including Velero-related issues ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#456).
+
+* **[website] Update developer guide with operator-driven architecture and OCIRepository migration flow**: Rewrote the development guide to describe the operator-driven in-cluster architecture, bootstrap flow, operator responsibilities, and the platform install/update sequence. Added an "OCIRepositories and Migration Flow" section with migration hook examples and sequencing rules for pre-upgrade hooks ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#458).
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.1.3...v1.1.4

From b42a8ed7e4e1cfe4d6b6d455727f61c8926b6b84 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Mon, 30 Mar 2026 09:50:08 +0500
Subject: [PATCH 351/666] fix(platform): propagate resource allocation ratios
 to packages

Since the bundle restructure in 2d022e38, the cpuAllocationRatio,
memoryAllocationRatio and ephemeralStorageAllocationRatio values from
platform values.yaml were no longer propagated to child packages.

The old monolithic bundles read these values from the cozystack
ConfigMap via lookup and passed them explicitly. After migration to
the Package CRD model, the bridge was lost: cozy-lib expects the
ratios in _cluster config (via cozystack-values Secret), but platform
never wrote them there, so the hardcoded defaults were always used.

This commit restores the propagation by:
- Adding cpu/memory/ephemeral-storage allocation ratios to the
  _cluster section in the cozystack-values Secret, so cozy-lib in
  all managed applications picks them up.
- Passing cpuAllocationRatio to the kubevirt Package component, so
  the KubeVirt CR gets the configured value.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/core/platform/templates/apps.yaml         | 3 +++
 packages/core/platform/templates/bundles/iaas.yaml | 6 +++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/packages/core/platform/templates/apps.yaml b/packages/core/platform/templates/apps.yaml
index 16ef3c35..7ee0de52 100644
--- a/packages/core/platform/templates/apps.yaml
+++ b/packages/core/platform/templates/apps.yaml
@@ -36,6 +36,9 @@ stringData:
       branding:
         {{- . | toYaml | nindent 8 }}
       {{- end }}
+      cpu-allocation-ratio: {{ .Values.resources.cpuAllocationRatio | quote }}
+      memory-allocation-ratio: {{ .Values.resources.memoryAllocationRatio | quote }}
+      ephemeral-storage-allocation-ratio: {{ .Values.resources.ephemeralStorageAllocationRatio | quote }}
       {{- with .Values.scheduling }}
       scheduling:
         {{- . | toYaml | nindent 8 }}
diff --git a/packages/core/platform/templates/bundles/iaas.yaml b/packages/core/platform/templates/bundles/iaas.yaml
index 41dc5181..bd002c16 100644
--- a/packages/core/platform/templates/bundles/iaas.yaml
+++ b/packages/core/platform/templates/bundles/iaas.yaml
@@ -2,7 +2,11 @@
 {{- fail "bundles.iaas.enabled can only be true when bundles.system.variant is 'isp-full' or 'isp-full-generic'" }}
 {{- end }}
 {{- if and .Values.bundles.iaas.enabled (or (eq .Values.bundles.system.variant "isp-full") (eq .Values.bundles.system.variant "isp-full-generic")) }}
-{{include "cozystack.platform.package.default" (list "cozystack.kubevirt" $) }}
+{{- $kubevirtComponents := dict -}}
+{{- if .Values.resources.cpuAllocationRatio -}}
+{{- $_ := set $kubevirtComponents "kubevirt" (dict "values" (dict "cpuAllocationRatio" (.Values.resources.cpuAllocationRatio | int))) -}}
+{{- end -}}
+{{include "cozystack.platform.package" (list "cozystack.kubevirt" "default" $ $kubevirtComponents) }}
 {{include "cozystack.platform.package.default" (list "cozystack.kubevirt-cdi" $) }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.gpu-operator" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.kamaji" $) }}

From c27807952aa07b6a174cc97c67dff0061d58011f Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Wed, 25 Mar 2026 09:52:43 +0500
Subject: [PATCH 352/666] [vm-instance] Rename subnets to networks and add
 dropdown selector

Rename the misleading 'subnets' field to 'networks' in VMInstance to
better reflect that it attaches the VM to VPC network attachments, not
creates subnets. The old 'subnets' field is kept as deprecated with
fallback logic for backward compatibility.

Add an API-backed dropdown (listInput) for networks[].name that lists
available NetworkAttachmentDefinitions in the namespace, and hide the
deprecated subnets field from the dashboard UI.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .../dashboard/customformsoverride.go          | 26 ++++++++++
 .../dashboard/customformsoverride_test.go     | 50 +++++++++++++++++++
 packages/apps/vm-instance/templates/vm.yaml   | 16 +++---
 packages/apps/vm-instance/values.yaml         | 14 +++---
 4 files changed, 91 insertions(+), 15 deletions(-)

diff --git a/internal/controller/dashboard/customformsoverride.go b/internal/controller/dashboard/customformsoverride.go
index 8fb65de7..907ebedd 100644
--- a/internal/controller/dashboard/customformsoverride.go
+++ b/internal/controller/dashboard/customformsoverride.go
@@ -61,6 +61,9 @@ func (m *Manager) ensureCustomFormsOverride(ctx context.Context, crd *cozyv1alph
 	// Override specific fields with API-backed dropdowns (listInput type)
 	applyListInputOverrides(schema, kind, openAPIProps)
 
+	// Hide deprecated fields from the UI
+	hidden = append(hidden, hiddenDeprecatedFields(kind)...)
+
 	spec := map[string]any{
 		"customizationId": customizationID,
 		"hidden":          hidden,
@@ -216,6 +219,17 @@ func applyListInputOverrides(schema map[string]any, kind string, openAPIProps ma
 			},
 		}
 
+		// Override networks[].name to be an API-backed dropdown listing NetworkAttachmentDefinitions
+		networksItemProps := ensureArrayItemProps(specProps, "networks")
+		networksItemProps["name"] = map[string]any{
+			"type": "listInput",
+			"customProps": map[string]any{
+				"valueUri":    "/api/clusters/{cluster}/k8s/apis/k8s.cni.cncf.io/v1/namespaces/{namespace}/network-attachment-definitions",
+				"keysToValue": []any{"metadata", "name"},
+				"keysToLabel": []any{"metadata", "name"},
+			},
+		}
+
 	case "ClickHouse", "Harbor", "HTTPCache", "Kubernetes", "MariaDB", "MongoDB",
 		"NATS", "OpenBAO", "Postgres", "Qdrant", "RabbitMQ", "Redis", "VMDisk":
 		specProps := ensureSchemaPath(schema, "spec")
@@ -237,6 +251,18 @@ func applyListInputOverrides(schema map[string]any, kind string, openAPIProps ma
 	}
 }
 
+// hiddenDeprecatedFields returns hidden paths for deprecated fields that should not
+// appear in the dashboard UI for the given kind.
+func hiddenDeprecatedFields(kind string) []any {
+	switch kind {
+	case "VMInstance":
+		return []any{
+			[]any{"spec", "subnets"},
+		}
+	}
+	return nil
+}
+
 // storageClassListInput returns a listInput field config for a storageClass dropdown
 // backed by the cluster's available StorageClasses.
 func storageClassListInput() map[string]any {
diff --git a/internal/controller/dashboard/customformsoverride_test.go b/internal/controller/dashboard/customformsoverride_test.go
index d0a34abc..7833d2e9 100644
--- a/internal/controller/dashboard/customformsoverride_test.go
+++ b/internal/controller/dashboard/customformsoverride_test.go
@@ -234,6 +234,56 @@ func TestApplyListInputOverrides_VMInstance(t *testing.T) {
 	if diskCustomProps["valueUri"] != expectedDiskURI {
 		t.Errorf("expected disks valueUri %s, got %v", expectedDiskURI, diskCustomProps["valueUri"])
 	}
+
+	// Check networks[].name is a listInput
+	networks, ok := specProps["networks"].(map[string]any)
+	if !ok {
+		t.Fatal("networks not found in schema.properties.spec.properties")
+	}
+	netItems, ok := networks["items"].(map[string]any)
+	if !ok {
+		t.Fatal("networks.items not found")
+	}
+	netItemProps, ok := netItems["properties"].(map[string]any)
+	if !ok {
+		t.Fatal("networks.items.properties not found")
+	}
+	netName, ok := netItemProps["name"].(map[string]any)
+	if !ok {
+		t.Fatal("networks.items.properties.name not found")
+	}
+	if netName["type"] != "listInput" {
+		t.Errorf("expected networks name type listInput, got %v", netName["type"])
+	}
+	netCustomProps, ok := netName["customProps"].(map[string]any)
+	if !ok {
+		t.Fatal("networks name customProps not found")
+	}
+	expectedNetURI := "/api/clusters/{cluster}/k8s/apis/k8s.cni.cncf.io/v1/namespaces/{namespace}/network-attachment-definitions"
+	if netCustomProps["valueUri"] != expectedNetURI {
+		t.Errorf("expected networks valueUri %s, got %v", expectedNetURI, netCustomProps["valueUri"])
+	}
+}
+
+func TestHiddenDeprecatedFields_VMInstance(t *testing.T) {
+	hidden := hiddenDeprecatedFields("VMInstance")
+	if len(hidden) != 1 {
+		t.Fatalf("expected 1 hidden path, got %d", len(hidden))
+	}
+	path, ok := hidden[0].([]any)
+	if !ok {
+		t.Fatal("hidden path is not []any")
+	}
+	if len(path) != 2 || path[0] != "spec" || path[1] != "subnets" {
+		t.Errorf("expected [spec subnets], got %v", path)
+	}
+}
+
+func TestHiddenDeprecatedFields_UnknownKind(t *testing.T) {
+	hidden := hiddenDeprecatedFields("SomeOtherKind")
+	if hidden != nil {
+		t.Errorf("expected nil for unknown kind, got %v", hidden)
+	}
 }
 
 func TestApplyListInputOverrides_StorageClassSimple(t *testing.T) {
diff --git a/packages/apps/vm-instance/templates/vm.yaml b/packages/apps/vm-instance/templates/vm.yaml
index 0a7eb7c5..d5c51ac9 100644
--- a/packages/apps/vm-instance/templates/vm.yaml
+++ b/packages/apps/vm-instance/templates/vm.yaml
@@ -86,12 +86,11 @@ spec:
           interfaces:
           - name: default
             bridge: {}
-          {{- if .Values.subnets }}
-          {{- range $i, $subnet := .Values.subnets }}
-          - name: {{ $subnet.name }}
+          {{- $networks := .Values.networks | default .Values.subnets }}
+          {{- range $i, $net := $networks }}
+          - name: {{ $net.name }}
             bridge: {}
           {{- end }}
-          {{- end }}
         machine:
           type: ""
       {{- with .Values.sshKeys }}
@@ -123,10 +122,9 @@ spec:
       networks:
       - name: default
         pod: {}
-      {{- if .Values.subnets }}
-      {{- range $i, $subnet := .Values.subnets }}
-      - name: {{ $subnet.name }}
+      {{- $networks := .Values.networks | default .Values.subnets }}
+      {{- range $i, $net := $networks }}
+      - name: {{ $net.name }}
         multus:
-          networkName: {{ $.Release.Namespace }}/{{ $subnet.name }}
-      {{- end }}
+          networkName: {{ $.Release.Namespace }}/{{ $net.name }}
       {{- end }}
diff --git a/packages/apps/vm-instance/values.yaml b/packages/apps/vm-instance/values.yaml
index d5ed5679..f07b75d3 100644
--- a/packages/apps/vm-instance/values.yaml
+++ b/packages/apps/vm-instance/values.yaml
@@ -10,8 +10,8 @@
 ## @field {string} name - Disk name.
 ## @field {string} [bus] - Disk bus type (e.g. "sata").
 
-## @typedef {struct} Subnet - Additional subnets
-## @field {string} [name] - Subnet name
+## @typedef {struct} Network - Network to attach the VM to.
+## @field {string} [name] - Network attachment name.
 
 ## @typedef {struct} GPU - GPU device configuration.
 ## @field {string} name - The name of the GPU resource to attach.
@@ -55,13 +55,15 @@ disks: []
 ## - name: example-data
 ##   bus: sata
 
-## @param {[]Subnet} subnets - Additional subnets
-subnets: []
+## @param {[]Network} networks - Networks to attach the VM to.
+networks: []
 ## Example:
-## subnets:
+## networks:
 ##   - name: subnet-84dbec17
 ##   - name: subnet-aa8896b5
-##   - name: subnet-e9b97196
+
+## @param {[]Network} subnets - Deprecated: use networks instead.
+subnets: []
 
 ## @param {[]GPU} gpus - List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).
 gpus: []

From a56ef30df653d31b5c48c2ebaa7dfd9971d41e53 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Wed, 25 Mar 2026 09:56:29 +0500
Subject: [PATCH 353/666] [vm-instance] Fix review issues: validation, DRY, and
 regenerate CRD

Add fail validation when both 'networks' and 'subnets' are set to
prevent silent data loss during migration. Compute $networks variable
once at template top level to eliminate DRY violation. Regenerate CRD
via make generate instead of manual editing.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/apps/vm-instance/README.md          |  6 +++--
 packages/apps/vm-instance/templates/vm.yaml  |  6 +++--
 packages/apps/vm-instance/values.schema.json | 28 ++++++++++++++++++++
 3 files changed, 36 insertions(+), 4 deletions(-)

diff --git a/packages/apps/vm-instance/README.md b/packages/apps/vm-instance/README.md
index 11d1441d..a2b6603e 100644
--- a/packages/apps/vm-instance/README.md
+++ b/packages/apps/vm-instance/README.md
@@ -47,8 +47,10 @@ virtctl ssh <user>@<vm>
 | `disks`             | List of disks to attach.                                                                                                          | `[]object` | `[]`        |
 | `disks[i].name`     | Disk name.                                                                                                                        | `string`   | `""`        |
 | `disks[i].bus`      | Disk bus type (e.g. "sata").                                                                                                      | `string`   | `""`        |
-| `subnets`           | Additional subnets                                                                                                                | `[]object` | `[]`        |
-| `subnets[i].name`   | Subnet name                                                                                                                       | `string`   | `""`        |
+| `networks`          | Networks to attach the VM to.                                                                                                     | `[]object` | `[]`        |
+| `networks[i].name`  | Network attachment name.                                                                                                          | `string`   | `""`        |
+| `subnets`           | Deprecated: use networks instead.                                                                                                 | `[]object` | `[]`        |
+| `subnets[i].name`   | Network attachment name.                                                                                                          | `string`   | `""`        |
 | `gpus`              | List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).                                                               | `[]object` | `[]`        |
 | `gpus[i].name`      | The name of the GPU resource to attach.                                                                                           | `string`   | `""`        |
 | `cpuModel`          | Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map | `string`   | `""`        |
diff --git a/packages/apps/vm-instance/templates/vm.yaml b/packages/apps/vm-instance/templates/vm.yaml
index d5c51ac9..23d9a1c4 100644
--- a/packages/apps/vm-instance/templates/vm.yaml
+++ b/packages/apps/vm-instance/templates/vm.yaml
@@ -7,6 +7,10 @@
 {{- if and (not .Values.instanceType) (not (and .Values.resources .Values.resources.cpu .Values.resources.sockets .Values.resources.memory)) }}
 {{-   fail "Either instanceType or resources (cpu, sockets, memory) must be specified" }}
 {{- end }}
+{{- if and .Values.networks .Values.subnets }}
+{{-   fail "Both 'networks' and 'subnets' are set. Use only 'networks'; 'subnets' is deprecated." }}
+{{- end }}
+{{- $networks := .Values.networks | default .Values.subnets }}
 
 apiVersion: kubevirt.io/v1
 kind: VirtualMachine
@@ -86,7 +90,6 @@ spec:
           interfaces:
           - name: default
             bridge: {}
-          {{- $networks := .Values.networks | default .Values.subnets }}
           {{- range $i, $net := $networks }}
           - name: {{ $net.name }}
             bridge: {}
@@ -122,7 +125,6 @@ spec:
       networks:
       - name: default
         pod: {}
-      {{- $networks := .Values.networks | default .Values.subnets }}
       {{- range $i, $net := $networks }}
       - name: {{ $net.name }}
         multus:
diff --git a/packages/apps/vm-instance/values.schema.json b/packages/apps/vm-instance/values.schema.json
index 1b2b3515..eae70e32 100644
--- a/packages/apps/vm-instance/values.schema.json
+++ b/packages/apps/vm-instance/values.schema.json
@@ -150,6 +150,20 @@
       "type": "string",
       "default": ""
     },
+    "networks": {
+      "description": "Networks to attach the VM to.",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "description": "Network attachment name.",
+            "type": "string"
+          }
+        }
+      }
+    },
     "resources": {
       "description": "Resource configuration for the virtual machine.",
       "type": "object",
@@ -204,6 +218,20 @@
         "type": "string"
       }
     },
+    "subnets": {
+      "description": "Deprecated: use networks instead.",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "description": "Network attachment name.",
+            "type": "string"
+          }
+        }
+      }
+    },
     "cloudInit": {
       "description": "Cloud-init user data.",
       "type": "string",

From cb79c5fac73787ab07caf4334f76a46541f4eb00 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Mon, 30 Mar 2026 10:55:26 +0500
Subject: [PATCH 354/666] chore(vm-instance): regenerate CRD and schema via
 make generate

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 api/apps/v1alpha1/vminstance/types.go         | 17 ++++---
 packages/apps/vm-instance/values.schema.json  | 48 +++++++------------
 .../vm-instance-rd/cozyrds/vm-instance.yaml   |  4 +-
 3 files changed, 29 insertions(+), 40 deletions(-)

diff --git a/api/apps/v1alpha1/vminstance/types.go b/api/apps/v1alpha1/vminstance/types.go
index 33f58b86..2bb059c6 100644
--- a/api/apps/v1alpha1/vminstance/types.go
+++ b/api/apps/v1alpha1/vminstance/types.go
@@ -38,9 +38,12 @@ type ConfigSpec struct {
 	// List of disks to attach.
 	// +kubebuilder:default:={}
 	Disks []Disk `json:"disks,omitempty"`
-	// Additional subnets
+	// Networks to attach the VM to.
 	// +kubebuilder:default:={}
-	Subnets []Subnet `json:"subnets,omitempty"`
+	Networks []Network `json:"networks,omitempty"`
+	// Deprecated: use networks instead.
+	// +kubebuilder:default:={}
+	Subnets []Network `json:"subnets,omitempty"`
 	// List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).
 	// +kubebuilder:default:={}
 	Gpus []GPU `json:"gpus,omitempty"`
@@ -73,6 +76,11 @@ type GPU struct {
 	Name string `json:"name"`
 }
 
+type Network struct {
+	// Network attachment name.
+	Name string `json:"name,omitempty"`
+}
+
 type Resources struct {
 	// Number of CPU cores allocated.
 	Cpu resource.Quantity `json:"cpu,omitempty"`
@@ -82,11 +90,6 @@ type Resources struct {
 	Sockets resource.Quantity `json:"sockets,omitempty"`
 }
 
-type Subnet struct {
-	// Subnet name
-	Name string `json:"name,omitempty"`
-}
-
 // +kubebuilder:validation:Enum="PortList";"WholeIP"
 type ExternalMethod string
 
diff --git a/packages/apps/vm-instance/values.schema.json b/packages/apps/vm-instance/values.schema.json
index eae70e32..34f7f634 100644
--- a/packages/apps/vm-instance/values.schema.json
+++ b/packages/apps/vm-instance/values.schema.json
@@ -114,15 +114,29 @@
         }
       }
     },
-    "subnets": {
-      "description": "Additional subnets",
+    "networks": {
+      "description": "Networks to attach the VM to.",
       "type": "array",
       "default": [],
       "items": {
         "type": "object",
         "properties": {
           "name": {
-            "description": "Subnet name",
+            "description": "Network attachment name.",
+            "type": "string"
+          }
+        }
+      }
+    },
+    "subnets": {
+      "description": "Deprecated: use networks instead.",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "description": "Network attachment name.",
             "type": "string"
           }
         }
@@ -150,20 +164,6 @@
       "type": "string",
       "default": ""
     },
-    "networks": {
-      "description": "Networks to attach the VM to.",
-      "type": "array",
-      "default": [],
-      "items": {
-        "type": "object",
-        "properties": {
-          "name": {
-            "description": "Network attachment name.",
-            "type": "string"
-          }
-        }
-      }
-    },
     "resources": {
       "description": "Resource configuration for the virtual machine.",
       "type": "object",
@@ -218,20 +218,6 @@
         "type": "string"
       }
     },
-    "subnets": {
-      "description": "Deprecated: use networks instead.",
-      "type": "array",
-      "default": [],
-      "items": {
-        "type": "object",
-        "properties": {
-          "name": {
-            "description": "Network attachment name.",
-            "type": "string"
-          }
-        }
-      }
-    },
     "cloudInit": {
       "description": "Cloud-init user data.",
       "type": "string",
diff --git a/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml b/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml
index 3cfbf4ef..e93fa86b 100644
--- a/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml
+++ b/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml
@@ -8,7 +8,7 @@ spec:
     singular: vminstance
     plural: vminstances
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"externalMethod":{"description":"Method to pass through traffic to the VM.","type":"string","default":"PortList","enum":["PortList","WholeIP"]},"externalPorts":{"description":"Ports to forward from outside the cluster.","type":"array","default":[22],"items":{"type":"integer"}},"runStrategy":{"description":"Requested running state of the VirtualMachineInstance","type":"string","default":"Always","enum":["Always","Halted","Manual","RerunOnFailure","Once"]},"instanceType":{"description":"Virtual Machine instance type.","type":"string","default":"u1.medium"},"instanceProfile":{"description":"Virtual Machine preferences profile.","type":"string","default":"ubuntu","enum":["alpine","centos.7","centos.7.desktop","centos.stream10","centos.stream10.desktop","centos.stream8","centos.stream8.desktop","centos.stream8.dpdk","centos.stream9","centos.stream9.desktop","centos.stream9.dpdk","cirros","fedora","fedora.arm64","opensuse.leap","opensuse.tumbleweed","rhel.10","rhel.10.arm64","rhel.7","rhel.7.desktop","rhel.8","rhel.8.desktop","rhel.8.dpdk","rhel.9","rhel.9.arm64","rhel.9.desktop","rhel.9.dpdk","rhel.9.realtime","sles","ubuntu","windows.10","windows.10.virtio","windows.11","windows.11.virtio","windows.2k16","windows.2k16.virtio","windows.2k19","windows.2k19.virtio","windows.2k22","windows.2k22.virtio","windows.2k25","windows.2k25.virtio",""]},"disks":{"description":"List of disks to attach.","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"bus":{"description":"Disk bus type (e.g. \"sata\").","type":"string"},"name":{"description":"Disk name.","type":"string"}}}},"subnets":{"description":"Additional subnets","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Subnet name","type":"string"}}}},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"name":{"description":"The name of the GPU resource to attach.","type":"string"}}}},"cpuModel":{"description":"Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map","type":"string","default":""},"resources":{"description":"Resource configuration for the virtual machine.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"sockets":{"description":"Number of CPU sockets (vCPU topology).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"sshKeys":{"description":"List of SSH public keys for authentication.","type":"array","default":[],"items":{"type":"string"}},"cloudInit":{"description":"Cloud-init user data.","type":"string","default":""},"cloudInitSeed":{"description":"Seed string to generate SMBIOS UUID for the VM.","type":"string","default":""}}}
+      {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"externalMethod":{"description":"Method to pass through traffic to the VM.","type":"string","default":"PortList","enum":["PortList","WholeIP"]},"externalPorts":{"description":"Ports to forward from outside the cluster.","type":"array","default":[22],"items":{"type":"integer"}},"runStrategy":{"description":"Requested running state of the VirtualMachineInstance","type":"string","default":"Always","enum":["Always","Halted","Manual","RerunOnFailure","Once"]},"instanceType":{"description":"Virtual Machine instance type.","type":"string","default":"u1.medium"},"instanceProfile":{"description":"Virtual Machine preferences profile.","type":"string","default":"ubuntu","enum":["alpine","centos.7","centos.7.desktop","centos.stream10","centos.stream10.desktop","centos.stream8","centos.stream8.desktop","centos.stream8.dpdk","centos.stream9","centos.stream9.desktop","centos.stream9.dpdk","cirros","fedora","fedora.arm64","opensuse.leap","opensuse.tumbleweed","rhel.10","rhel.10.arm64","rhel.7","rhel.7.desktop","rhel.8","rhel.8.desktop","rhel.8.dpdk","rhel.9","rhel.9.arm64","rhel.9.desktop","rhel.9.dpdk","rhel.9.realtime","sles","ubuntu","windows.10","windows.10.virtio","windows.11","windows.11.virtio","windows.2k16","windows.2k16.virtio","windows.2k19","windows.2k19.virtio","windows.2k22","windows.2k22.virtio","windows.2k25","windows.2k25.virtio",""]},"disks":{"description":"List of disks to attach.","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"bus":{"description":"Disk bus type (e.g. \"sata\").","type":"string"},"name":{"description":"Disk name.","type":"string"}}}},"networks":{"description":"Networks to attach the VM to.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"subnets":{"description":"Deprecated: use networks instead.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"name":{"description":"The name of the GPU resource to attach.","type":"string"}}}},"cpuModel":{"description":"Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map","type":"string","default":""},"resources":{"description":"Resource configuration for the virtual machine.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"sockets":{"description":"Number of CPU sockets (vCPU topology).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"sshKeys":{"description":"List of SSH public keys for authentication.","type":"array","default":[],"items":{"type":"string"}},"cloudInit":{"description":"Cloud-init user data.","type":"string","default":""},"cloudInitSeed":{"description":"Seed string to generate SMBIOS UUID for the VM.","type":"string","default":""}}}
   release:
     prefix: vm-instance-
     labels:
@@ -26,7 +26,7 @@ spec:
     tags:
       - compute
     icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl82ODdfMzQ1NCkiLz4KPGcgY2xpcC1wYXRoPSJ1cmwoI2NsaXAwXzY4N18zNDU0KSI+CjxwYXRoIGQ9Ik04OS41MDM5IDExMS43MDdINTQuNDk3QzU0LjE3MjcgMTExLjcwNyA1NC4wMTA4IDExMS4yMjEgNTQuMzM0OSAxMTEuMDU5TDU3LjI1MjIgMTA4Ljk1MkM2MC4zMzE0IDEwNi42ODMgNjEuOTUyMiAxMDIuNjMxIDYwLjk3OTcgOTguNzQxMkg4My4wMjFDODIuMDQ4NSAxMDIuNjMxIDgzLjY2OTMgMTA2LjY4MyA4Ni43NDg1IDEwOC45NTJMODkuNjY1OCAxMTEuMDU5Qzg5Ljk5IDExMS4yMjEgODkuODI3OSAxMTEuNzA3IDg5LjUwMzkgMTExLjcwN1oiIGZpbGw9IiNCMEI2QkIiLz4KPHBhdGggZD0iTTExMy4zMjggOTguNzQxSDMwLjY3MjVDMjcuNTkzMSA5OC43NDEgMjUgOTYuMTQ4IDI1IDkzLjA2ODdWMzMuMTAzMkMyNSAzMC4wMjM5IDI3LjU5MzEgMjcuNDMwNyAzMC42NzI1IDI3LjQzMDdIMTEzLjMyOEMxMTYuNDA3IDI3LjQzMDcgMTE5IDMwLjAyMzcgMTE5IDMzLjEwMzJWOTMuMDY4N0MxMTkgOTYuMTQ4IDExNi40MDcgOTguNzQxIDExMy4zMjggOTguNzQxWiIgZmlsbD0iI0U4RURFRSIvPgo8cGF0aCBkPSJNMTE5IDg0LjE1NDlIMjVWMzMuMTAzMkMyNSAzMC4wMjM5IDI3LjU5MzEgMjcuNDMwNyAzMC42NzI1IDI3LjQzMDdIMTEzLjMyOEMxMTYuNDA3IDI3LjQzMDcgMTE5IDMwLjAyMzcgMTE5IDMzLjEwMzJMMTE5IDg0LjE1NDlaIiBmaWxsPSIjMDBCM0ZGIi8+CjxwYXRoIGQ9Ik05MC42Mzc0IDExNi41NjlINTMuMzYxNkM1Mi4wNjUxIDExNi41NjkgNTAuOTMwNyAxMTUuNDM1IDUwLjkzMDcgMTE0LjEzOEM1MC45MzA3IDExMi44NDEgNTIuMDY1MSAxMTEuNzA3IDUzLjM2MTYgMTExLjcwN0g5MC42Mzc0QzkxLjkzMzkgMTExLjcwNyA5My4wNjg0IDExMi44NDEgOTMuMDY4NCAxMTQuMTM4QzkzLjA2ODQgMTE1LjQzNSA5MS45MzM5IDExNi41NjkgOTAuNjM3NCAxMTYuNTY5WiIgZmlsbD0iI0U4RURFRSIvPgo8L2c+CjxwYXRoIGQ9Ik03Mi41Mjc1IDUzLjgzNjdDNzIuNDQzMSA1My44MzUxIDcyLjM2MDUgNTMuODEyMiA3Mi4yODczIDUzLjc3MDFMNTYuNDY5OSA0NC43OTM0QzU2LjM5ODMgNDQuNzUxOSA1Ni4zMzg4IDQ0LjY5MjMgNTYuMjk3MyA0NC42MjA3QzU2LjI1NTkgNDQuNTQ5IDU2LjIzMzggNDQuNDY3OCA1Ni4yMzM0IDQ0LjM4NUM1Ni4yMzM0IDQ0LjIxNjkgNTYuMzI1OCA0NC4wNjE3IDU2LjQ2OTkgNDMuOTc4NUw3Mi4xOTEyIDM1LjA2MDlDNzIuMjYzNyAzNS4wMjEgNzIuMzQ1IDM1IDcyLjQyNzcgMzVDNzIuNTEwNSAzNSA3Mi41OTE4IDM1LjAyMSA3Mi42NjQzIDM1LjA2MDlMODguNDg3MiA0NC4wMzk1Qzg4LjU1OTEgNDQuMDgwMSA4OC42MTg4IDQ0LjEzOTIgODguNjYgNDQuMjEwN0M4OC43MDEzIDQ0LjI4MjIgODguNzIyNyA0NC4zNjM1IDg4LjcyMTkgNDQuNDQ2Qzg4LjcyMjUgNDQuNTI4NSA4OC43MDEgNDQuNjA5NyA4OC42NTk4IDQ0LjY4MTJDODguNjE4NSA0NC43NTI2IDg4LjU1ODkgNDQuODExOCA4OC40ODcyIDQ0Ljg1MjVMNzIuNzcxNCA1My43NjgzQzcyLjY5NzIgNTMuODExNCA3Mi42MTMzIDUzLjgzNDkgNzIuNTI3NSA1My44MzY3IiBmaWxsPSJ3aGl0ZSIvPgo8cGF0aCBvcGFjaXR5PSIwLjciIGQ9Ik03MC4yNTUzIDc1LjY1MTdDNzAuMTcxIDc1LjY1MzUgNzAuMDg3OCA3NS42MzE3IDcwLjAxNTEgNzUuNTg4OEw1NC4yNDU4IDY2LjY0MTdDNTQuMTcxNSA2Ni42MDI0IDU0LjEwOTUgNjYuNTQzNiA1NC4wNjYxIDY2LjQ3MTZDNTQuMDIyOCA2Ni4zOTk3IDU0IDY2LjMxNzMgNTQgNjYuMjMzM1Y0OC4yNzhDNTQgNDguMTA4IDU0LjA5MjQgNDcuOTU0NiA1NC4yNDM5IDQ3Ljg2OTZDNTQuMzE3MiA0Ny44MjcxIDU0LjQwMDQgNDcuODA0NyA1NC40ODUxIDQ3LjgwNDdDNTQuNTY5NyA0Ny44MDQ3IDU0LjY1MjkgNDcuODI3MSA1NC43MjYyIDQ3Ljg2OTZMNzAuNDkzNyA1Ni44MTMxQzcwLjU2NDIgNTYuODU2NSA3MC42MjI1IDU2LjkxNyA3MC42NjMyIDU2Ljk4OTFDNzAuNzAzOSA1Ny4wNjEyIDcwLjcyNTcgNTcuMTQyNCA3MC43MjY1IDU3LjIyNTFWNzUuMTgwNUM3MC43MjU5IDc1LjI2MjggNzAuNzA0MiA3NS4zNDM2IDcwLjY2MzUgNzUuNDE1MUM3MC42MjI3IDc1LjQ4NjYgNzAuNTY0MiA3NS41NDY0IDcwLjQ5MzcgNzUuNTg4OEM3MC40MjA2IDc1LjYyOTEgNzAuMzM4NyA3NS42NTA3IDcwLjI1NTMgNzUuNjUxNyIgZmlsbD0id2hpdGUiLz4KPHBhdGggb3BhY2l0eT0iMC40IiBkPSJNNzQuNzE5OCA3NS42NTExQzc0LjYzMzMgNzUuNjUxMiA3NC41NDgyIDc1LjYyOTYgNzQuNDcyMiA3NS41ODgzQzc0LjQwMTYgNzUuNTQ2MSA3NC4zNDMyIDc1LjQ4NjIgNzQuMzAyNyA3NS40MTQ3Qzc0LjI2MjMgNzUuMzQzMSA3NC4yNDExIDc1LjI2MjIgNzQuMjQxMiA3NS4xOFY1Ny4zMzczQzc0LjI0MTIgNTcuMTcxIDc0LjMzMzYgNTcuMDE1OCA3NC40NzIyIDU2LjkyOUw5MC4yMzk3IDQ3Ljk4NTVDOTAuMzExOSA0Ny45NDM4IDkwLjM5MzggNDcuOTIxOSA5MC40NzcxIDQ3LjkyMTlDOTAuNTYwNSA0Ny45MjE5IDkwLjY0MjQgNDcuOTQzOCA5MC43MTQ2IDQ3Ljk4NTVDOTAuNzg3NiA0OC4wMjU1IDkwLjg0ODUgNDguMDg0MiA5MC44OTExIDQ4LjE1NTdDOTAuOTMzNyA0OC4yMjcyIDkwLjk1NjMgNDguMzA4OCA5MC45NTY2IDQ4LjM5MlY2Ni4yMzI4QzkwLjk1NyA2Ni4zMTY0IDkwLjkzNDcgNjYuMzk4NSA5MC44OTIxIDY2LjQ3MDRDOTAuODQ5NSA2Ni41NDI0IDkwLjc4ODEgNjYuNjAxNCA5MC43MTQ2IDY2LjY0MTFMNzQuOTUyNiA3NS41ODgzQzc0Ljg4MjUgNzUuNjMwNyA3NC44MDE4IDc1LjY1MjUgNzQuNzE5OCA3NS42NTExIiBmaWxsPSJ3aGl0ZSIvPgo8ZGVmcz4KPGxpbmVhckdyYWRpZW50IGlkPSJwYWludDBfbGluZWFyXzY4N18zNDU0IiB4MT0iMTYxIiB5MT0iMTgwIiB4Mj0iMy41OTI4NGUtMDciIHkyPSI0Ljk5OTk4IiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+CjxzdG9wLz4KPHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjNTk1NjU2Ii8+CjwvbGluZWFyR3JhZGllbnQ+CjxjbGlwUGF0aCBpZD0iY2xpcDBfNjg3XzM0NTQiPgo8cmVjdCB3aWR0aD0iOTQiIGhlaWdodD0iOTQiIGZpbGw9IndoaXRlIiB0cmFuc2Zvcm09InRyYW5zbGF0ZSgyNSAyNSkiLz4KPC9jbGlwUGF0aD4KPC9kZWZzPgo8L3N2Zz4K
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "external"], ["spec", "externalMethod"], ["spec", "externalPorts"], ["spec", "runStrategy"], ["spec", "instanceType"], ["spec", "instanceProfile"], ["spec", "disks"], ["spec", "subnets"], ["spec", "gpus"], ["spec", "cpuModel"], ["spec", "resources"], ["spec", "sshKeys"], ["spec", "cloudInit"], ["spec", "cloudInitSeed"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "external"], ["spec", "externalMethod"], ["spec", "externalPorts"], ["spec", "runStrategy"], ["spec", "instanceType"], ["spec", "instanceProfile"], ["spec", "disks"], ["spec", "networks"], ["spec", "subnets"], ["spec", "gpus"], ["spec", "cpuModel"], ["spec", "resources"], ["spec", "sshKeys"], ["spec", "cloudInit"], ["spec", "cloudInitSeed"]]
   secrets:
     exclude: []
     include: []

From 149cb67692e2031c39bda68e5e6b1e94b8a93f19 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Mon, 30 Mar 2026 10:56:09 +0500
Subject: [PATCH 355/666] feat(platform): add migration 36 to copy subnets to
 networks in VMInstance

Existing VMInstance resources store network attachments in the deprecated
spec.subnets field. This migration copies subnets to the new spec.networks
field so the dashboard UI correctly displays attached networks. The old
subnets field is kept intact because migrations run before the new CRD is
applied.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .../platform/images/migrations/migrations/36   | 18 ++++++++++++++++++
 packages/core/platform/values.yaml             |  2 +-
 2 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100755 packages/core/platform/images/migrations/migrations/36

diff --git a/packages/core/platform/images/migrations/migrations/36 b/packages/core/platform/images/migrations/migrations/36
new file mode 100755
index 00000000..744a2480
--- /dev/null
+++ b/packages/core/platform/images/migrations/migrations/36
@@ -0,0 +1,18 @@
+#!/bin/sh
+# Migration 36 --> 37
+#
+# Copy spec.subnets to spec.networks in VMInstance resources.
+# The old "subnets" field is kept intact because migrations run before
+# the new CRD is applied; removing it now would lose data.
+
+set -e
+
+kubectl get vminstances.apps.cozystack.io -A -o json | jq -r '
+  .items[]
+  | select(.spec.subnets != null and (.spec.subnets | length) > 0)
+  | select(.spec.networks == null or (.spec.networks | length) == 0)
+  | "kubectl -n \(.metadata.namespace) patch vminstances.apps.cozystack.io \(.metadata.name) --type=json -p '\''[{\"op\":\"add\",\"path\":\"/spec/networks\",\"value\":\(.spec.subnets|tojson)}]'\''"
+' | sh -ex
+
+# Write version to cozystack-version config
+kubectl create configmap -n cozy-system cozystack-version --from-literal=version=37 --dry-run=client -o yaml | kubectl apply -f-
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index 8baa6845..c9af0e5e 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -6,7 +6,7 @@ sourceRef:
 migrations:
   enabled: false
   image: ghcr.io/cozystack/cozystack/platform-migrations:v1.2.0@sha256:3a3d8cfa4323d8023b7c7800d8b552b250bc2de01ca7550fd024a10b12324f6d
-  targetVersion: 36
+  targetVersion: 37
 # Bundle deployment configuration
 bundles:
   system:

From c73f677c798c809cd4939aa8ad93a56256418021 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Mon, 30 Mar 2026 11:11:56 +0500
Subject: [PATCH 356/666] fix(vm-instance): remove fail on both networks and
 subnets set

After migration 36 copies subnets to networks, both fields are populated.
The fail guard would break Helm reconciliation. Instead, networks simply
takes priority via the existing default fallback.

Also handle missing VMInstance CRD gracefully in migration 36.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/apps/vm-instance/templates/vm.yaml            | 3 ---
 packages/core/platform/images/migrations/migrations/36 | 4 ++++
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/packages/apps/vm-instance/templates/vm.yaml b/packages/apps/vm-instance/templates/vm.yaml
index 23d9a1c4..55f278c1 100644
--- a/packages/apps/vm-instance/templates/vm.yaml
+++ b/packages/apps/vm-instance/templates/vm.yaml
@@ -7,9 +7,6 @@
 {{- if and (not .Values.instanceType) (not (and .Values.resources .Values.resources.cpu .Values.resources.sockets .Values.resources.memory)) }}
 {{-   fail "Either instanceType or resources (cpu, sockets, memory) must be specified" }}
 {{- end }}
-{{- if and .Values.networks .Values.subnets }}
-{{-   fail "Both 'networks' and 'subnets' are set. Use only 'networks'; 'subnets' is deprecated." }}
-{{- end }}
 {{- $networks := .Values.networks | default .Values.subnets }}
 
 apiVersion: kubevirt.io/v1
diff --git a/packages/core/platform/images/migrations/migrations/36 b/packages/core/platform/images/migrations/migrations/36
index 744a2480..0f0a94dd 100755
--- a/packages/core/platform/images/migrations/migrations/36
+++ b/packages/core/platform/images/migrations/migrations/36
@@ -7,12 +7,16 @@
 
 set -e
 
+if ! kubectl get crd vminstances.apps.cozystack.io >/dev/null 2>&1; then
+  echo "VMInstance CRD not found, skipping migration"
+else
 kubectl get vminstances.apps.cozystack.io -A -o json | jq -r '
   .items[]
   | select(.spec.subnets != null and (.spec.subnets | length) > 0)
   | select(.spec.networks == null or (.spec.networks | length) == 0)
   | "kubectl -n \(.metadata.namespace) patch vminstances.apps.cozystack.io \(.metadata.name) --type=json -p '\''[{\"op\":\"add\",\"path\":\"/spec/networks\",\"value\":\(.spec.subnets|tojson)}]'\''"
 ' | sh -ex
+fi
 
 # Write version to cozystack-version config
 kubectl create configmap -n cozy-system cozystack-version --from-literal=version=37 --dry-run=client -o yaml | kubectl apply -f-

From ed51d3e16e2831b7a6c8df5cafa7c9be8c4c25e8 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 30 Mar 2026 17:01:10 +0300
Subject: [PATCH 357/666] [keycloak] Harden theme injection with validation and
 security

Add securityContext to theme init containers matching the main
container security posture. Add input validation for theme entries:
required fields, DNS-1123 name sanitization, duplicate detection,
and container name length limit. Add imagePullSecrets support for
private registries and sizeLimit on the emptyDir volume.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/keycloak/templates/sts.yaml | 42 +++++++++++++++++++--
 packages/system/keycloak/values.yaml        |  6 +++
 2 files changed, 44 insertions(+), 4 deletions(-)

diff --git a/packages/system/keycloak/templates/sts.yaml b/packages/system/keycloak/templates/sts.yaml
index 90d2d95c..c1827b93 100644
--- a/packages/system/keycloak/templates/sts.yaml
+++ b/packages/system/keycloak/templates/sts.yaml
@@ -1,3 +1,7 @@
+{{- define "keycloak.theme.sanitizedName" -}}
+{{- regexReplaceAll "-+" (regexReplaceAll "[^a-z0-9-]" (. | lower) "-") "-" | trimPrefix "-" | trimSuffix "-" -}}
+{{- end -}}
+
 {{- $host := index .Values._cluster "root-host" }}
 {{- $ingressHost := .Values.ingress.host | default (printf "keycloak.%s" $host) }}
 {{- $clusterDomain := (index .Values._cluster "cluster-domain") | default "cozy.local" }}
@@ -39,14 +43,43 @@ spec:
         app: keycloak-ha
     spec:
       restartPolicy: Always
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       securityContext:
         fsGroup: 1000
       {{- if .Values.themes }}
+      {{- $themeNames := list }}
+      {{- range .Values.themes }}
+      {{- if not .name }}{{ fail "theme entry missing required field: name" }}{{- end }}
+      {{- if not .image }}{{ fail "theme entry missing required field: image" }}{{- end }}
+      {{- $sanitized := include "keycloak.theme.sanitizedName" .name }}
+      {{- if not $sanitized }}{{ fail (printf "theme name %q produces empty container name after sanitization" .name) }}{{- end }}
+      {{- if gt (len (printf "theme-%s" $sanitized)) 63 }}{{ fail (printf "theme name %q produces container name exceeding 63 characters" .name) }}{{- end }}
+      {{- if has $sanitized $themeNames }}{{ fail (printf "duplicate theme name after sanitization: %s (from %s)" $sanitized .name) }}{{- end }}
+      {{- $themeNames = append $themeNames $sanitized }}
+      {{- end }}
       initContainers:
         {{- range .Values.themes }}
-        - name: theme-{{ .name }}
-          image: {{ .image }}
-          command: ["sh", "-c", "cp -r /themes/* /opt/keycloak/themes/"]
+        - name: theme-{{ include "keycloak.theme.sanitizedName" .name }}
+          image: "{{ .image }}"
+          imagePullPolicy: IfNotPresent
+          command: ["sh", "-c", "[ -d /themes ] && cp -r /themes/. /opt/keycloak/themes/ || { echo 'ERROR: /themes directory not found in image'; exit 1; }"]
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              memory: 64Mi
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
           volumeMounts:
             - name: themes
               mountPath: /opt/keycloak/themes
@@ -174,6 +207,7 @@ spec:
       {{- if .Values.themes }}
       volumes:
         - name: themes
-          emptyDir: {}
+          emptyDir:
+            sizeLimit: 256Mi
       {{- end }}
       terminationGracePeriodSeconds: 60
diff --git a/packages/system/keycloak/values.yaml b/packages/system/keycloak/values.yaml
index 6cba9aef..4368ea2c 100644
--- a/packages/system/keycloak/values.yaml
+++ b/packages/system/keycloak/values.yaml
@@ -18,3 +18,9 @@ resources:
 themes: []
 # - name: my-theme
 #   image: my-registry/my-keycloak-theme:v1.0
+# Theme images must contain theme files under /themes/ directory.
+# Each theme is copied into Keycloak's /opt/keycloak/themes/ via init container.
+# If multiple themes contain files with the same path, later entries take precedence.
+
+imagePullSecrets: []
+# - name: my-registry-secret

From 30616b73f34198a1fc5bc8069d7a38c705bc72d9 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Mon, 30 Mar 2026 20:58:43 +0200
Subject: [PATCH 358/666] fix(linstor): set verify-alg to crc32c to avoid
 crct10dif unavailability

The crct10dif kernel crypto module is no longer available in Talos
v1.12.6 (kernel 6.18.18). DRBD auto-verify selects crct10dif by
default, causing peer connections to fail with VERIFYAlgNotAvail.
Setting verify-alg explicitly to crc32c at the controller level
ensures all resources use an available algorithm.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/system/linstor/templates/cluster.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/packages/system/linstor/templates/cluster.yaml b/packages/system/linstor/templates/cluster.yaml
index ba611e17..e45b1dff 100644
--- a/packages/system/linstor/templates/cluster.yaml
+++ b/packages/system/linstor/templates/cluster.yaml
@@ -20,6 +20,8 @@ spec:
   - name: DrbdOptions/auto-diskful-allow-cleanup
     value: {{ .Values.linstor.autoDiskful.allowCleanup | quote }}
   {{- end }}
+  - name: DrbdOptions/Net/verify-alg
+    value: "crc32c"
   - name: DrbdOptions/Net/connect-int
     value: "15"
   - name: DrbdOptions/Net/ping-int

From fd1714442e44946a90d8864577e73e942e2ebb8d Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Tue, 31 Mar 2026 00:46:47 +0300
Subject: [PATCH 359/666] feat(postgres): hardcode PostgreSQL 17 for monitoring
 and add migration

Add migration 37 to backfill spec.version=v17 for existing PostgreSQL
resources without a version set.

Hardcode PostgreSQL 17.7 image in monitoring databases (Grafana and Alerta)
to ensure compatibility with monitoring queries that expect PostgreSQL 17
features (pg_stat_checkpointer, updated pg_stat_bgwriter).

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 .../platform/images/migrations/migrations/37  | 43 +++++++++++++++++++
 .../templates/alerta/alerta-db.yaml           |  1 +
 .../monitoring/templates/grafana/db.yaml      |  1 +
 3 files changed, 45 insertions(+)
 create mode 100755 packages/core/platform/images/migrations/migrations/37

diff --git a/packages/core/platform/images/migrations/migrations/37 b/packages/core/platform/images/migrations/migrations/37
new file mode 100755
index 00000000..b8ff3147
--- /dev/null
+++ b/packages/core/platform/images/migrations/migrations/37
@@ -0,0 +1,43 @@
+#!/bin/sh
+# Migration 37 --> 38
+# Backfill spec.version on postgreses.apps.cozystack.io resources.
+#
+# Before this migration PostgreSQL had a default version field set to v18.
+# This migration sets spec.version to "v17" for any postgres app resource that
+# does not already have it set, to ensure compatibility with monitoring
+# configurations that are hardcoded to PostgreSQL 17.
+
+set -euo pipefail
+
+DEFAULT_VERSION="v17"
+
+# Skip if the CRD does not exist (postgres was never installed)
+if ! kubectl api-resources --api-group=apps.cozystack.io -o name 2>/dev/null | grep -q '^postgreses\.'; then
+  echo "CRD postgreses.apps.cozystack.io not found, skipping migration"
+  kubectl create configmap -n cozy-system cozystack-version \
+    --from-literal=version=38 --dry-run=client -o yaml | kubectl apply -f-
+  exit 0
+fi
+
+POSTGRESES=$(kubectl get postgreses.apps.cozystack.io -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}')
+for resource in $POSTGRESES; do
+  NS="${resource%%/*}"
+  APP_NAME="${resource##*/}"
+
+  # Skip if spec.version is already set
+  CURRENT_VER=$(kubectl get postgreses.apps.cozystack.io -n "$NS" "$APP_NAME" \
+    -o jsonpath='{.spec.version}')
+  if [ -n "$CURRENT_VER" ]; then
+    echo "SKIP $NS/$APP_NAME: spec.version already set to '$CURRENT_VER'"
+    continue
+  fi
+
+  echo "Patching postgres/$APP_NAME in $NS: setting version=$DEFAULT_VERSION"
+
+  kubectl patch postgreses.apps.cozystack.io -n "$NS" "$APP_NAME" --type=merge \
+    --patch "{\"spec\":{\"version\":\"${DEFAULT_VERSION}\"}}"
+done
+
+# Stamp version
+kubectl create configmap -n cozy-system cozystack-version \
+  --from-literal=version=38 --dry-run=client -o yaml | kubectl apply -f-
diff --git a/packages/system/monitoring/templates/alerta/alerta-db.yaml b/packages/system/monitoring/templates/alerta/alerta-db.yaml
index fc03cd31..71df5428 100644
--- a/packages/system/monitoring/templates/alerta/alerta-db.yaml
+++ b/packages/system/monitoring/templates/alerta/alerta-db.yaml
@@ -5,6 +5,7 @@ metadata:
   name: alerta-db
 spec:
   instances: 2
+  imageName: ghcr.io/cloudnative-pg/postgresql:17.7
   {{- if .Values._cluster.scheduling }}
   {{- $rawConstraints := get .Values._cluster.scheduling "globalAppTopologySpreadConstraints" }}
   {{- if $rawConstraints }}
diff --git a/packages/system/monitoring/templates/grafana/db.yaml b/packages/system/monitoring/templates/grafana/db.yaml
index b20a8fd8..73d6502e 100644
--- a/packages/system/monitoring/templates/grafana/db.yaml
+++ b/packages/system/monitoring/templates/grafana/db.yaml
@@ -4,6 +4,7 @@ metadata:
   name: grafana-db
 spec:
   instances: 2
+  imageName: ghcr.io/cloudnative-pg/postgresql:17.7
   storage:
     size: {{ .Values.grafana.db.size }}
   {{- if .Values._cluster.scheduling }}

From 6ad777077ed67c3d3fc8f65f6c9bdf991628cfbf Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Tue, 31 Mar 2026 01:45:22 +0000
Subject: [PATCH 360/666] docs: add changelog for v1.1.5

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.1.5.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 docs/changelogs/v1.1.5.md

diff --git a/docs/changelogs/v1.1.5.md b/docs/changelogs/v1.1.5.md
new file mode 100644
index 00000000..e756bdd9
--- /dev/null
+++ b/docs/changelogs/v1.1.5.md
@@ -0,0 +1,13 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.1.5
+-->
+
+## Fixes
+
+* **[platform] Prevent installed packages deletion**: Added the `helm.sh/resource-policy: keep` annotation to all platform packages. Previously, moving a package to `disabledPackages` or removing it from `enabledPackages` caused Helm to automatically delete it, contradicting the documented behavior that requires the platform administrator to manually delete packages when needed ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2273, #2298).
+
+* **[linstor] Fix TCP port mismatches after toggle-disk operations causing DRBD resources to enter StandAlone state**: During toggle-disk operations, `removeLayerData()` freed TCP ports from the number pool and `ensureStackDataExists()` could then allocate different ports. If a satellite missed the resulting update (e.g. due to a controller restart), it retained the old ports while peers received the new ones, causing DRBD connections to fail with StandAlone state. The fix introduces `copyDrbdTcpPortsIfExists()`, which preserves existing TCP ports in the `LayerPayload` before `removeLayerData()` releases them ([**@kvaps**](https://github.com/kvaps) in #2292, #2300).
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.1.4...v1.1.5

From 620c8fb3c0f30976666afb830b2c79388a5dc88e Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Tue, 31 Mar 2026 09:01:44 +0300
Subject: [PATCH 361/666] feat(postgres): extend v17 hardcode to all system
 components

Add explicit PostgreSQL 17.7 image to Harbor, SeaweedFS, and Keycloak
databases to ensure consistent version across all system components.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 packages/system/harbor/templates/database.yaml    | 1 +
 packages/system/keycloak/templates/db.yaml        | 1 +
 packages/system/seaweedfs/templates/database.yaml | 1 +
 3 files changed, 3 insertions(+)

diff --git a/packages/system/harbor/templates/database.yaml b/packages/system/harbor/templates/database.yaml
index b1221e1c..02e11faa 100644
--- a/packages/system/harbor/templates/database.yaml
+++ b/packages/system/harbor/templates/database.yaml
@@ -5,6 +5,7 @@ metadata:
   name: {{ .Values.harbor.fullnameOverride }}-db
 spec:
   instances: {{ .Values.db.replicas }}
+  imageName: ghcr.io/cloudnative-pg/postgresql:17.7
   storage:
     size: {{ .Values.db.size }}
     {{- with .Values.db.storageClass }}
diff --git a/packages/system/keycloak/templates/db.yaml b/packages/system/keycloak/templates/db.yaml
index 1cd98ffc..fb649a43 100644
--- a/packages/system/keycloak/templates/db.yaml
+++ b/packages/system/keycloak/templates/db.yaml
@@ -4,6 +4,7 @@ metadata:
   name: keycloak-db
 spec:
   instances: 2
+  imageName: ghcr.io/cloudnative-pg/postgresql:17.7
   storage:
     size: 20Gi
   {{- if .Values._cluster.scheduling }}
diff --git a/packages/system/seaweedfs/templates/database.yaml b/packages/system/seaweedfs/templates/database.yaml
index e78caa89..1c116dd0 100644
--- a/packages/system/seaweedfs/templates/database.yaml
+++ b/packages/system/seaweedfs/templates/database.yaml
@@ -5,6 +5,7 @@ metadata:
   name: seaweedfs-db
 spec:
   instances: {{ .Values.db.replicas }}
+  imageName: ghcr.io/cloudnative-pg/postgresql:17.7
   storage:
     size: {{ .Values.db.size }}
     {{- with .Values.db.storageClass }}

From 15d319bfa121074efcec8bd0b88edd3594da9821 Mon Sep 17 00:00:00 2001
From: Andrey Kolkov <androndo@gmail.com>
Date: Wed, 18 Mar 2026 12:01:28 +0400
Subject: [PATCH 362/666] feat(backup): no manual actions required to perform
 restorejob for VMInstance

Signed-off-by: Andrey Kolkov <androndo@gmail.com>
---
 api/backups/v1alpha1/backup_types.go          |  32 +
 api/backups/v1alpha1/zz_generated.deepcopy.go |  56 +-
 cmd/backupstrategy-controller/main.go         |   9 +
 examples/desired-backup.yaml                  |  20 -
 .../backupcontroller/backup_controller.go     | 136 ++++
 .../backupclass_resolver_test.go              |   4 -
 .../backupcontroller/restorejob_controller.go |  59 +-
 .../velerostrategy_controller.go              | 716 ++++++++++++++++--
 .../backups.cozystack.io_backups.yaml         |  23 +
 .../templates/rbac-bind.yaml                  |  14 +
 .../templates/rbac.yaml                       |  62 +-
 11 files changed, 1026 insertions(+), 105 deletions(-)
 delete mode 100644 examples/desired-backup.yaml
 create mode 100644 internal/backupcontroller/backup_controller.go

diff --git a/api/backups/v1alpha1/backup_types.go b/api/backups/v1alpha1/backup_types.go
index 9371c27f..5859d592 100644
--- a/api/backups/v1alpha1/backup_types.go
+++ b/api/backups/v1alpha1/backup_types.go
@@ -72,6 +72,33 @@ type BackupSpec struct {
 	DriverMetadata map[string]string `json:"driverMetadata,omitempty"`
 }
 
+// DataVolumeResource describes a dataVolume associated with the backed-up application.
+type DataVolumeResource struct {
+	// DataVolumeName is the name of the dataVolume/PVC (e.g., "vm-disk-ubuntu-source").
+	DataVolumeName string `json:"dataVolumeName"`
+
+	// ApplicationName is the cozystack application name for this disk (e.g., "ubuntu-source").
+	ApplicationName string `json:"applicationName"`
+}
+
+// UnderlyingResources contains information about resources associated with the
+// backed-up application that were discovered at backup time (e.g., VM disks,
+// network configuration). This data is used during restore to correctly
+// reconstruct the application's environment.
+type UnderlyingResources struct {
+	// DataVolumes lists the dataVolume resources used by the application.
+	// +optional
+	DataVolumes []DataVolumeResource `json:"dataVolumes,omitempty"`
+
+	// IP is the OVN IP address assigned to the application at backup time.
+	// +optional
+	IP string `json:"ip,omitempty"`
+
+	// MAC is the OVN MAC address assigned to the application at backup time.
+	// +optional
+	MAC string `json:"mac,omitempty"`
+}
+
 // BackupStatus represents the observed state of a Backup.
 type BackupStatus struct {
 	// Phase is a simple, high-level summary of the backup's state.
@@ -83,6 +110,11 @@ type BackupStatus struct {
 	// +optional
 	Artifact *BackupArtifact `json:"artifact,omitempty"`
 
+	// UnderlyingResources contains information about underlying resources
+	// discovered during backup (e.g., VM disks, IP/MAC addresses).
+	// +optional
+	UnderlyingResources *UnderlyingResources `json:"underlyingResources,omitempty"`
+
 	// Conditions represents the latest available observations of a Backup's state.
 	// +optional
 	Conditions []metav1.Condition `json:"conditions,omitempty"`
diff --git a/api/backups/v1alpha1/zz_generated.deepcopy.go b/api/backups/v1alpha1/zz_generated.deepcopy.go
index b2e4a680..7b5ab25b 100644
--- a/api/backups/v1alpha1/zz_generated.deepcopy.go
+++ b/api/backups/v1alpha1/zz_generated.deepcopy.go
@@ -1,21 +1,5 @@
 //go:build !ignore_autogenerated
 
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
 // Code generated by controller-gen. DO NOT EDIT.
 
 package v1alpha1
@@ -400,6 +384,11 @@ func (in *BackupStatus) DeepCopyInto(out *BackupStatus) {
 		*out = new(BackupArtifact)
 		**out = **in
 	}
+	if in.UnderlyingResources != nil {
+		in, out := &in.UnderlyingResources, &out.UnderlyingResources
+		*out = new(UnderlyingResources)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.Conditions != nil {
 		in, out := &in.Conditions, &out.Conditions
 		*out = make([]metav1.Condition, len(*in))
@@ -419,6 +408,21 @@ func (in *BackupStatus) DeepCopy() *BackupStatus {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DataVolumeResource) DeepCopyInto(out *DataVolumeResource) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataVolumeResource.
+func (in *DataVolumeResource) DeepCopy() *DataVolumeResource {
+	if in == nil {
+		return nil
+	}
+	out := new(DataVolumeResource)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Plan) DeepCopyInto(out *Plan) {
 	*out = *in
@@ -641,3 +645,23 @@ func (in *RestoreJobStatus) DeepCopy() *RestoreJobStatus {
 	in.DeepCopyInto(out)
 	return out
 }
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *UnderlyingResources) DeepCopyInto(out *UnderlyingResources) {
+	*out = *in
+	if in.DataVolumes != nil {
+		in, out := &in.DataVolumes, &out.DataVolumes
+		*out = make([]DataVolumeResource, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UnderlyingResources.
+func (in *UnderlyingResources) DeepCopy() *UnderlyingResources {
+	if in == nil {
+		return nil
+	}
+	out := new(UnderlyingResources)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/cmd/backupstrategy-controller/main.go b/cmd/backupstrategy-controller/main.go
index 6c0ee2e6..03396979 100644
--- a/cmd/backupstrategy-controller/main.go
+++ b/cmd/backupstrategy-controller/main.go
@@ -176,6 +176,15 @@ func main() {
 		os.Exit(1)
 	}
 
+	if err = (&backupcontroller.BackupReconciler{
+		Client:   mgr.GetClient(),
+		Scheme:   mgr.GetScheme(),
+		Recorder: mgr.GetEventRecorderFor("backup-controller"),
+	}).SetupWithManager(mgr); err != nil {
+		setupLog.Error(err, "unable to create controller", "controller", "Backup")
+		os.Exit(1)
+	}
+
 	// +kubebuilder:scaffold:builder
 
 	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
diff --git a/examples/desired-backup.yaml b/examples/desired-backup.yaml
deleted file mode 100644
index c06b8f82..00000000
--- a/examples/desired-backup.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-apiVersion: backups.cozystack.io/v1alpha1
-kind: BackupJob
-metadata:
-  name: desired-backup
-  namespace: tenant-root
-  labels:
-    backups.cozystack.io/triggered-by: manual
-spec:
-  applicationRef:
-    apiGroup: apps.cozystack.io
-    kind: VirtualMachine
-    name: vm1
-  storageRef:
-    apiGroup: apps.cozystack.io
-    kind: Bucket
-    name: test-bucket
-  strategyRef:
-    apiGroup: strategy.backups.cozystack.io
-    kind: Velero
-    name: velero-strategy-default
\ No newline at end of file
diff --git a/internal/backupcontroller/backup_controller.go b/internal/backupcontroller/backup_controller.go
new file mode 100644
index 00000000..486a24ae
--- /dev/null
+++ b/internal/backupcontroller/backup_controller.go
@@ -0,0 +1,136 @@
+package backupcontroller
+
+import (
+	"context"
+	"fmt"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/tools/record"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+
+	backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1"
+	velerov1 "github.com/vmware-tanzu/velero/pkg/apis/velero/v1"
+)
+
+const backupFinalizer = "backups.cozystack.io/cleanup-velero"
+
+// BackupReconciler reconciles Backup objects.
+// It manages a finalizer that ensures the underlying Velero backup is deleted
+// when the cozystack Backup resource is deleted.
+type BackupReconciler struct {
+	client.Client
+	Scheme   *runtime.Scheme
+	Recorder record.EventRecorder
+}
+
+func (r *BackupReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	logger := log.FromContext(ctx)
+	logger.V(1).Info("reconciling Backup", "namespace", req.Namespace, "name", req.Name)
+
+	backup := &backupsv1alpha1.Backup{}
+	if err := r.Get(ctx, types.NamespacedName{Namespace: req.Namespace, Name: req.Name}, backup); err != nil {
+		if apierrors.IsNotFound(err) {
+			return ctrl.Result{}, nil
+		}
+		return ctrl.Result{}, err
+	}
+
+	// Handle deletion: clean up Velero backup
+	if !backup.DeletionTimestamp.IsZero() {
+		if controllerutil.ContainsFinalizer(backup, backupFinalizer) {
+			if err := r.cleanupVeleroBackup(ctx, backup); err != nil {
+				logger.Error(err, "failed to clean up Velero backup")
+				return ctrl.Result{}, err
+			}
+
+			controllerutil.RemoveFinalizer(backup, backupFinalizer)
+			if err := r.Update(ctx, backup); err != nil {
+				return ctrl.Result{}, err
+			}
+			logger.V(1).Info("removed finalizer and cleaned up Velero backup", "backup", backup.Name)
+		}
+		return ctrl.Result{}, nil
+	}
+
+	// Ensure finalizer is present
+	if !controllerutil.ContainsFinalizer(backup, backupFinalizer) {
+		controllerutil.AddFinalizer(backup, backupFinalizer)
+		if err := r.Update(ctx, backup); err != nil {
+			return ctrl.Result{}, err
+		}
+		logger.V(1).Info("added finalizer to Backup", "backup", backup.Name)
+	}
+
+	return ctrl.Result{}, nil
+}
+
+// cleanupVeleroBackup deletes the Velero backup and its data from storage
+// by creating a Velero DeleteBackupRequest. A direct Delete of the
+// backup.velero.io resource only removes the Kubernetes object; Velero's
+// BSL sync will recreate it from the object store. The DeleteBackupRequest
+// tells Velero to also purge the data, preventing resurrection.
+func (r *BackupReconciler) cleanupVeleroBackup(ctx context.Context, backup *backupsv1alpha1.Backup) error {
+	logger := log.FromContext(ctx)
+
+	veleroBackupName, ok := backup.Spec.DriverMetadata[veleroBackupNameMetadataKey]
+	if !ok || veleroBackupName == "" {
+		logger.V(1).Info("no Velero backup name in driverMetadata, nothing to clean up")
+		return nil
+	}
+
+	veleroBackupNamespace := backup.Spec.DriverMetadata[veleroBackupNamespaceMetadataKey]
+	if veleroBackupNamespace == "" {
+		veleroBackupNamespace = veleroNamespace
+	}
+
+	// Check if the Velero Backup still exists
+	veleroBackup := &velerov1.Backup{}
+	err := r.Get(ctx, types.NamespacedName{
+		Namespace: veleroBackupNamespace,
+		Name:      veleroBackupName,
+	}, veleroBackup)
+	if err != nil {
+		if apierrors.IsNotFound(err) {
+			logger.V(1).Info("Velero backup already deleted", "name", veleroBackupName)
+			return nil
+		}
+		return fmt.Errorf("failed to get Velero backup %s/%s: %w", veleroBackupNamespace, veleroBackupName, err)
+	}
+
+	// Create a DeleteBackupRequest so Velero removes backup data from storage.
+	// Without this, BSL sync will recreate the backup.velero.io resource.
+	dbr := &velerov1.DeleteBackupRequest{
+		ObjectMeta: metav1.ObjectMeta{
+			GenerateName: veleroBackupName + "-",
+			Namespace:    veleroBackupNamespace,
+		},
+		Spec: velerov1.DeleteBackupRequestSpec{
+			BackupName: veleroBackupName,
+		},
+	}
+	if err := r.Create(ctx, dbr); err != nil {
+		if apierrors.IsAlreadyExists(err) {
+			logger.V(1).Info("DeleteBackupRequest already exists", "backup", veleroBackupName)
+			return nil
+		}
+		return fmt.Errorf("failed to create DeleteBackupRequest for %s/%s: %w", veleroBackupNamespace, veleroBackupName, err)
+	}
+
+	logger.Info("created DeleteBackupRequest for Velero backup",
+		"name", veleroBackupName, "namespace", veleroBackupNamespace,
+		"deleteRequest", dbr.Name)
+	return nil
+}
+
+// SetupWithManager registers the BackupReconciler with the Manager.
+func (r *BackupReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewControllerManagedBy(mgr).
+		For(&backupsv1alpha1.Backup{}).
+		Complete(r)
+}
diff --git a/internal/backupcontroller/backupclass_resolver_test.go b/internal/backupcontroller/backupclass_resolver_test.go
index 5e29cd02..cd65f22a 100644
--- a/internal/backupcontroller/backupclass_resolver_test.go
+++ b/internal/backupcontroller/backupclass_resolver_test.go
@@ -369,7 +369,3 @@ func TestResolveBackupClass(t *testing.T) {
 		})
 	}
 }
-
-func stringPtr(s string) *string {
-	return &s
-}
diff --git a/internal/backupcontroller/restorejob_controller.go b/internal/backupcontroller/restorejob_controller.go
index 71307ba3..d73b0c24 100644
--- a/internal/backupcontroller/restorejob_controller.go
+++ b/internal/backupcontroller/restorejob_controller.go
@@ -17,12 +17,16 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	strategyv1alpha1 "github.com/cozystack/cozystack/api/backups/strategy/v1alpha1"
 	backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1"
+	velerov1 "github.com/vmware-tanzu/velero/pkg/apis/velero/v1"
 )
 
+const restoreJobFinalizer = "backups.cozystack.io/cleanup-velero-restore"
+
 // RestoreJobReconciler reconciles RestoreJob objects.
 // It routes RestoreJobs to strategy-specific handlers based on the strategy
 // referenced in the Backup that the RestoreJob is restoring from.
@@ -49,6 +53,27 @@ func (r *RestoreJobReconciler) Reconcile(ctx context.Context, req ctrl.Request)
 		return ctrl.Result{}, err
 	}
 
+	// Handle deletion: clean up Velero Restore
+	if !restoreJob.DeletionTimestamp.IsZero() {
+		if controllerutil.ContainsFinalizer(restoreJob, restoreJobFinalizer) {
+			r.cleanupVeleroRestore(ctx, restoreJob)
+			controllerutil.RemoveFinalizer(restoreJob, restoreJobFinalizer)
+			if err := r.Update(ctx, restoreJob); err != nil {
+				return ctrl.Result{}, err
+			}
+			logger.V(1).Info("removed finalizer and cleaned up Velero Restore", "restoreJob", restoreJob.Name)
+		}
+		return ctrl.Result{}, nil
+	}
+
+	// Ensure finalizer is present
+	if !controllerutil.ContainsFinalizer(restoreJob, restoreJobFinalizer) {
+		controllerutil.AddFinalizer(restoreJob, restoreJobFinalizer)
+		if err := r.Update(ctx, restoreJob); err != nil {
+			return ctrl.Result{}, err
+		}
+	}
+
 	// If already completed, no need to reconcile
 	if restoreJob.Status.Phase == backupsv1alpha1.RestoreJobPhaseSucceeded ||
 		restoreJob.Status.Phase == backupsv1alpha1.RestoreJobPhaseFailed {
@@ -103,17 +128,6 @@ func (r *RestoreJobReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		Complete(r)
 }
 
-// getTargetApplicationRef determines the effective target application reference.
-// According to DESIGN.md, if spec.targetApplicationRef is omitted, drivers SHOULD
-// restore into backup.spec.applicationRef.
-// The returned reference is normalized to ensure APIGroup has a default value.
-func (r *RestoreJobReconciler) getTargetApplicationRef(restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup) corev1.TypedLocalObjectReference {
-	if restoreJob.Spec.TargetApplicationRef != nil {
-		return backupsv1alpha1.NormalizeApplicationRef(*restoreJob.Spec.TargetApplicationRef)
-	}
-	return backup.Spec.ApplicationRef
-}
-
 // markRestoreJobFailed updates the RestoreJob status to Failed with the given message.
 func (r *RestoreJobReconciler) markRestoreJobFailed(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, message string) (ctrl.Result, error) {
 	logger := getLogger(ctx)
@@ -138,3 +152,26 @@ func (r *RestoreJobReconciler) markRestoreJobFailed(ctx context.Context, restore
 	logger.Debug("RestoreJob failed", "message", message)
 	return ctrl.Result{}, nil
 }
+
+// cleanupVeleroRestore deletes all Velero Restores and resourceModifier
+// ConfigMaps owned by this RestoreJob (identified by labels).
+func (r *RestoreJobReconciler) cleanupVeleroRestore(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob) {
+	logger := log.FromContext(ctx)
+	opts := []client.DeleteAllOfOption{
+		client.InNamespace(veleroNamespace),
+		client.MatchingLabels{
+			backupsv1alpha1.OwningJobNameLabel:      restoreJob.Name,
+			backupsv1alpha1.OwningJobNamespaceLabel: restoreJob.Namespace,
+		},
+	}
+
+	if err := r.DeleteAllOf(ctx, &velerov1.Restore{}, opts...); err != nil {
+		logger.Error(err, "failed to delete Velero Restore(s)")
+		r.Recorder.Event(restoreJob, corev1.EventTypeWarning, "CleanupFailed",
+			fmt.Sprintf("Failed to delete Velero Restore: %v", err))
+	}
+
+	if err := r.DeleteAllOf(ctx, &corev1.ConfigMap{}, opts...); err != nil {
+		logger.Error(err, "failed to delete resourceModifiers ConfigMap(s)")
+	}
+}
diff --git a/internal/backupcontroller/velerostrategy_controller.go b/internal/backupcontroller/velerostrategy_controller.go
index 6809bd4f..5ff3348a 100644
--- a/internal/backupcontroller/velerostrategy_controller.go
+++ b/internal/backupcontroller/velerostrategy_controller.go
@@ -2,13 +2,20 @@ package backupcontroller
 
 import (
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
 	"fmt"
+	"strings"
 	"time"
 
+	"sigs.k8s.io/yaml"
+
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -37,15 +44,6 @@ func (l loggerWithDebug) Debug(msg string, keysAndValues ...interface{}) {
 	l.Logger.V(1).Info(msg, keysAndValues...)
 }
 
-// S3Credentials holds the discovered S3 credentials from a Bucket storageRef
-type S3Credentials struct {
-	BucketName      string
-	Endpoint        string
-	Region          string
-	AccessKeyID     string
-	AccessSecretKey string
-}
-
 const (
 	defaultRequeueAfter                 = 5 * time.Second
 	defaultActiveJobPollingInterval     = defaultRequeueAfter
@@ -55,10 +53,25 @@ const (
 	veleroNamespace                  = "cozy-velero"
 	veleroBackupNameMetadataKey      = "velero.io/backup-name"
 	veleroBackupNamespaceMetadataKey = "velero.io/backup-namespace"
+
+	// Annotation key for persisting underlying resources on the Velero Backup object
+	underlyingResourcesAnnotation = "backups.cozystack.io/underlying-resources"
+
+	// VM-specific constants
+	vmInstanceKind        = "VMInstance"
+	vmDiskAppKind         = "VMDisk"
+	vmNamePrefix          = "vm-instance-"
+	vmDiskNamePrefix      = "vm-disk-"
+	appKindLabel          = "apps.cozystack.io/application.kind"
+	appNameLabel          = "apps.cozystack.io/application.name"
+	vmPodNameLabel        = "vm.kubevirt.io/name"
+	ovnIPAnnotation       = "ovn.kubernetes.io/ip_address"
+	ovnMACAnnotation      = "ovn.kubernetes.io/mac_address"
+	cdiAllowClaimAdoption = "cdi.kubevirt.io/allowClaimAdoption"
 )
 
-func boolPtr(b bool) *bool {
-	return &b
+func stringPtr(s string) *string {
+	return &s
 }
 
 func (r *BackupJobReconciler) reconcileVelero(ctx context.Context, j *backupsv1alpha1.BackupJob, resolved *ResolvedBackupConfig) (ctrl.Result, error) {
@@ -197,10 +210,7 @@ func (r *BackupJobReconciler) reconcileVelero(ctx context.Context, j *backupsv1a
 
 	// Step 5: On failure
 	if phase == "Failed" || phase == "PartiallyFailed" {
-		message := fmt.Sprintf("Velero Backup failed with phase: %s", phase)
-		if len(veleroBackup.Status.ValidationErrors) > 0 {
-			message = fmt.Sprintf("%s: %v", message, veleroBackup.Status.ValidationErrors)
-		}
+		message := formatVeleroBackupFailureMessageForBackupJob(ctx, r.Client, veleroBackup)
 		return r.markBackupJobFailed(ctx, j, message)
 	}
 
@@ -208,6 +218,76 @@ func (r *BackupJobReconciler) reconcileVelero(ctx context.Context, j *backupsv1a
 	return ctrl.Result{RequeueAfter: 5 * time.Second}, nil
 }
 
+// collectUnderlyingResources discovers resources associated with a VM application
+// (dataVolumes, IP/MAC addresses) that need to be backed up and restored.
+// Returns nil if the application is not a VM type or has no underlying resources.
+func (r *BackupJobReconciler) collectUnderlyingResources(ctx context.Context, app *unstructured.Unstructured, appKind, ns string) (*backupsv1alpha1.UnderlyingResources, error) {
+	logger := getLogger(ctx)
+
+	if appKind != vmInstanceKind {
+		logger.Debug("application is not a VMInstance, skipping underlying resource collection", "kind", appKind)
+		return nil, nil
+	}
+
+	appName := app.GetName()
+
+	// Extract disk names from VMInstance spec.disks[].name
+	disks, found, err := unstructured.NestedSlice(app.Object, "spec", "disks")
+	if err != nil {
+		return nil, fmt.Errorf("failed to read spec.disks from application: %w", err)
+	}
+
+	var dataVolumes []backupsv1alpha1.DataVolumeResource
+	if found {
+		for _, d := range disks {
+			disk, ok := d.(map[string]interface{})
+			if !ok {
+				continue
+			}
+			name, ok := disk["name"].(string)
+			if !ok || name == "" {
+				continue
+			}
+			dataVolumes = append(dataVolumes, backupsv1alpha1.DataVolumeResource{
+				DataVolumeName:  vmDiskNamePrefix + name,
+				ApplicationName: name,
+			})
+		}
+	}
+	logger.Debug("collected dataVolumes from VMInstance", "count", len(dataVolumes), "appName", appName)
+
+	// Find VM Pod to extract OVN IP/MAC addresses
+	vmName := vmNamePrefix + appName
+	podList := &corev1.PodList{}
+	if err := r.List(ctx, podList,
+		client.InNamespace(ns),
+		client.MatchingLabels{vmPodNameLabel: vmName},
+	); err != nil {
+		logger.Error(err, "failed to list VM pods for IP/MAC collection", "vmName", vmName)
+		// Non-fatal: we can still proceed without IP/MAC
+	}
+
+	var ip, mac string
+	if len(podList.Items) > 0 {
+		pod := podList.Items[0]
+		ip = pod.Annotations[ovnIPAnnotation]
+		mac = pod.Annotations[ovnMACAnnotation]
+		logger.Debug("collected OVN network info from VM pod", "ip", ip, "mac", mac, "pod", pod.Name)
+	} else {
+		logger.Debug("no VM pod found for OVN info", "vmName", vmName)
+	}
+
+	if len(dataVolumes) == 0 && ip == "" && mac == "" {
+		return nil, nil
+	}
+
+	return &backupsv1alpha1.UnderlyingResources{
+		DataVolumes: dataVolumes,
+		IP:          ip,
+		MAC:         mac,
+	}, nil
+}
+
 func (r *BackupJobReconciler) createVeleroBackup(ctx context.Context, backupJob *backupsv1alpha1.BackupJob, strategy *strategyv1alpha1.Velero, resolved *ResolvedBackupConfig) error {
 	logger := getLogger(ctx)
 	logger.Debug("createVeleroBackup called", "strategy", strategy.Name)
@@ -225,6 +305,13 @@ func (r *BackupJobReconciler) createVeleroBackup(ctx context.Context, backupJob
 		return err
 	}
 
+	// Collect underlying resources (VM disks, IP/MAC)
+	underlyingResources, err := r.collectUnderlyingResources(ctx, app, backupJob.Spec.ApplicationRef.Kind, backupJob.Namespace)
+	if err != nil {
+		logger.Error(err, "failed to collect underlying resources, proceeding without them")
+		// Non-fatal: proceed with backup even if collection fails
+	}
+
 	templateContext := map[string]interface{}{
 		"Application": app.Object,
 		"Parameters":  resolved.Parameters,
@@ -234,6 +321,33 @@ func (r *BackupJobReconciler) createVeleroBackup(ctx context.Context, backupJob
 	if err != nil {
 		return err
 	}
+
+	// Add label selectors for underlying VMDisk HelmReleases
+	if underlyingResources != nil {
+		for _, dv := range underlyingResources.DataVolumes {
+			veleroBackupSpec.OrLabelSelectors = append(veleroBackupSpec.OrLabelSelectors, &metav1.LabelSelector{
+				MatchLabels: map[string]string{
+					appKindLabel: vmDiskAppKind,
+					appNameLabel: dv.ApplicationName,
+				},
+			})
+		}
+		if len(underlyingResources.DataVolumes) > 0 {
+			logger.Debug("added VMDisk label selectors to Velero backup", "count", len(underlyingResources.DataVolumes))
+		}
+	}
+
+	// Serialize underlying resources as annotation to persist across reconcile cycles
+	annotations := map[string]string{}
+	if underlyingResources != nil {
+		urJSON, err := json.Marshal(underlyingResources)
+		if err != nil {
+			logger.Error(err, "failed to marshal underlying resources annotation")
+		} else {
+			annotations[underlyingResourcesAnnotation] = string(urJSON)
+		}
+	}
+
 	veleroBackup := &velerov1.Backup{
 		ObjectMeta: metav1.ObjectMeta{
 			GenerateName: fmt.Sprintf("%s.%s-", backupJob.Namespace, backupJob.Name),
@@ -242,6 +356,7 @@ func (r *BackupJobReconciler) createVeleroBackup(ctx context.Context, backupJob
 				backupsv1alpha1.OwningJobNameLabel:      backupJob.Name,
 				backupsv1alpha1.OwningJobNamespaceLabel: backupJob.Namespace,
 			},
+			Annotations: annotations,
 		},
 		Spec: *veleroBackupSpec,
 	}
@@ -284,19 +399,22 @@ func (r *BackupJobReconciler) createBackupResource(ctx context.Context, backupJo
 		URI: fmt.Sprintf("velero://%s/%s", veleroBackup.Namespace, veleroBackup.Name),
 	}
 
+	// Read underlying resources from Velero Backup annotation
+	var underlyingResources *backupsv1alpha1.UnderlyingResources
+	if urJSON, ok := veleroBackup.Annotations[underlyingResourcesAnnotation]; ok && urJSON != "" {
+		underlyingResources = &backupsv1alpha1.UnderlyingResources{}
+		if err := json.Unmarshal([]byte(urJSON), underlyingResources); err != nil {
+			logger.Error(err, "failed to unmarshal underlying resources from Velero Backup annotation")
+			underlyingResources = nil
+		}
+	}
+
+	// Note: No OwnerReferences set on Backup. The Backup must survive BackupJob deletion
+	// so users don't lose their backup artifacts when cleaning up completed jobs.
 	backup := &backupsv1alpha1.Backup{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      backupJob.Name,
 			Namespace: backupJob.Namespace,
-			OwnerReferences: []metav1.OwnerReference{
-				{
-					APIVersion: backupJob.APIVersion,
-					Kind:       backupJob.Kind,
-					Name:       backupJob.Name,
-					UID:        backupJob.UID,
-					Controller: boolPtr(true),
-				},
-			},
 		},
 		Spec: backupsv1alpha1.BackupSpec{
 			ApplicationRef: backupJob.Spec.ApplicationRef,
@@ -305,8 +423,9 @@ func (r *BackupJobReconciler) createBackupResource(ctx context.Context, backupJo
 			DriverMetadata: driverMetadata,
 		},
 		Status: backupsv1alpha1.BackupStatus{
-			Phase:    backupsv1alpha1.BackupPhaseReady,
-			Artifact: artifact,
+			Phase:               backupsv1alpha1.BackupPhaseReady,
+			Artifact:            artifact,
+			UnderlyingResources: underlyingResources,
 		},
 	}
 
@@ -319,7 +438,8 @@ func (r *BackupJobReconciler) createBackupResource(ctx context.Context, backupJo
 		return nil, err
 	}
 
-	logger.Debug("created Backup resource", "name", backup.Name)
+	logger.Debug("created Backup resource", "name", backup.Name,
+		"hasUnderlyingResources", underlyingResources != nil)
 	return backup, nil
 }
 
@@ -378,6 +498,16 @@ func (r *RestoreJobReconciler) reconcileVeleroRestore(ctx context.Context, resto
 	}
 
 	if len(veleroRestoreList.Items) == 0 {
+		// Pre-restore: graceful shutdown, suspend HRs, rename PVCs
+		ready, result, err := r.prepareForRestore(ctx, restoreJob, backup)
+		if err != nil {
+			return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf("pre-restore preparation failed: %v", err))
+		}
+		if !ready {
+			logger.Debug("pre-restore preparation in progress, requeuing")
+			return result, nil
+		}
+
 		// Create Velero Restore
 		logger.Debug("Velero Restore not found, creating new one")
 		if err := r.createVeleroRestore(ctx, restoreJob, backup, veleroStrategy, veleroBackupName); err != nil {
@@ -430,31 +560,436 @@ func (r *RestoreJobReconciler) reconcileVeleroRestore(ctx context.Context, resto
 	return ctrl.Result{RequeueAfter: defaultRestoreRequeueAfter}, nil
 }
 
+// Velero resource modifier types (local mirrors of the internal Velero types).
+
+type resourceModifiers struct {
+	Version               string                 `yaml:"version"`
+	ResourceModifierRules []resourceModifierRule `yaml:"resourceModifierRules"`
+}
+
+type resourceModifierRule struct {
+	Conditions   resourceModifierConditions `yaml:"conditions"`
+	MergePatches []mergePatch               `yaml:"mergePatches,omitempty"`
+}
+
+type resourceModifierConditions struct {
+	GroupResource     string   `yaml:"groupResource"`
+	ResourceNameRegex string   `yaml:"resourceNameRegex,omitempty"`
+	Namespaces        []string `yaml:"namespaces,omitempty"`
+}
+
+type mergePatch struct {
+	PatchData string `yaml:"patchData"`
+}
+
+// marshalPatchData marshals an arbitrary object to YAML for use as
+// mergePatch.PatchData in Velero resource modifiers.
+func marshalPatchData(v interface{}) (string, error) {
+	b, err := yaml.Marshal(v)
+	if err != nil {
+		return "", fmt.Errorf("failed to marshal patch data: %w", err)
+	}
+	return string(b), nil
+}
+
+// createResourceModifiersConfigMap creates a Velero resource modifiers ConfigMap
+// that patches VM resources during restore:
+//   - PVC adoption: always adds cdi.kubevirt.io/allowClaimAdoption=true to all
+//     restored PVCs so CDI can adopt them when a HelmRelease of VMDisk recreates a DV.
+//   - OVN IP/MAC: sets OVN annotations on the VirtualMachine for correct ssh access to restored VM.
+func (r *RestoreJobReconciler) createResourceModifiersConfigMap(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup) (*corev1.ConfigMap, error) {
+	logger := getLogger(ctx)
+
+	ur := backup.Status.UnderlyingResources
+	targetNS := backup.Namespace
+
+	var rules []resourceModifierRule
+
+	// PVC adoption: allow CDI to adopt restored PVCs when the HelmRelease recreates a DV.
+	pvcPatch, err := marshalPatchData(map[string]interface{}{
+		"metadata": map[string]interface{}{
+			"annotations": map[string]string{
+				cdiAllowClaimAdoption: "true",
+			},
+		},
+	})
+	if err != nil {
+		return nil, err
+	}
+	rules = append(rules, resourceModifierRule{
+		Conditions: resourceModifierConditions{
+			GroupResource:     "persistentvolumeclaims",
+			ResourceNameRegex: ".*",
+			Namespaces:        []string{targetNS},
+		},
+		MergePatches: []mergePatch{{PatchData: pvcPatch}},
+	})
+
+	// OVN IP/MAC annotations on VirtualMachine for correct network identity after restore.
+	if ur != nil && (ur.IP != "" || ur.MAC != "") {
+		ovnAnnotations := map[string]string{}
+		if ur.IP != "" {
+			ovnAnnotations[ovnIPAnnotation] = ur.IP
+		}
+		if ur.MAC != "" {
+			ovnAnnotations[ovnMACAnnotation] = ur.MAC
+		}
+		vmPatch, err := marshalPatchData(map[string]interface{}{
+			"spec": map[string]interface{}{
+				"template": map[string]interface{}{
+					"metadata": map[string]interface{}{
+						"annotations": ovnAnnotations,
+					},
+				},
+			},
+		})
+		if err != nil {
+			return nil, err
+		}
+		rules = append(rules, resourceModifierRule{
+			Conditions: resourceModifierConditions{
+				GroupResource:     "virtualmachines.kubevirt.io",
+				ResourceNameRegex: ".*",
+				Namespaces:        []string{targetNS},
+			},
+			MergePatches: []mergePatch{{PatchData: vmPatch}},
+		})
+	}
+
+	rulesYAML, err := yaml.Marshal(resourceModifiers{
+		Version:               "v1",
+		ResourceModifierRules: rules,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal resource modifier rules: %w", err)
+	}
+
+	cmName := fmt.Sprintf("restore-modifiers-%s-%s", restoreJob.Namespace, restoreJob.Name)
+	// Truncate name to fit Kubernetes 253-char limit
+	if len(cmName) > 253 {
+		cmName = cmName[:253]
+	}
+
+	cm := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      cmName,
+			Namespace: veleroNamespace,
+			Labels: map[string]string{
+				backupsv1alpha1.OwningJobNameLabel:      restoreJob.Name,
+				backupsv1alpha1.OwningJobNamespaceLabel: restoreJob.Namespace,
+			},
+		},
+		Data: map[string]string{
+			"resource-modifier-rules.yaml": string(rulesYAML),
+		},
+	}
+
+	if err := r.Create(ctx, cm); err != nil {
+		if errors.IsAlreadyExists(err) {
+			// ConfigMap already exists (e.g. RestoreJob recreated with same name).
+			// Update its data to reflect the current backup's underlying resources.
+			existing := &corev1.ConfigMap{}
+			if err := r.Get(ctx, client.ObjectKey{Namespace: veleroNamespace, Name: cmName}, existing); err != nil {
+				return nil, fmt.Errorf("failed to get existing resourceModifiers ConfigMap: %w", err)
+			}
+			existing.Data = cm.Data
+			if err := r.Update(ctx, existing); err != nil {
+				return nil, fmt.Errorf("failed to update existing resourceModifiers ConfigMap: %w", err)
+			}
+			logger.Debug("updated existing resourceModifiers ConfigMap", "name", cmName)
+			return existing, nil
+		}
+		return nil, fmt.Errorf("failed to create resourceModifiers ConfigMap: %w", err)
+	}
+
+	logger.Debug("created resourceModifiers ConfigMap", "name", cm.Name, "namespace", cm.Namespace)
+	return cm, nil
+}
+
+// resolveUnderlyingResourcesForRestore returns disk (and network) metadata for symmetric
+// restore label selectors. Velero Backup annotation is used when Backup.status was empty
+// (e.g. CRD without underlyingResources in schema).
+func (r *RestoreJobReconciler) resolveUnderlyingResourcesForRestore(ctx context.Context, backup *backupsv1alpha1.Backup, veleroBackupName string) *backupsv1alpha1.UnderlyingResources {
+	if backup.Status.UnderlyingResources != nil && len(backup.Status.UnderlyingResources.DataVolumes) > 0 {
+		return backup.Status.UnderlyingResources
+	}
+	vb := &velerov1.Backup{}
+	if err := r.Get(ctx, client.ObjectKey{Namespace: veleroNamespace, Name: veleroBackupName}, vb); err != nil {
+		return backup.Status.UnderlyingResources
+	}
+	if urJSON, ok := vb.Annotations[underlyingResourcesAnnotation]; ok && urJSON != "" {
+		ur := &backupsv1alpha1.UnderlyingResources{}
+		if err := json.Unmarshal([]byte(urJSON), ur); err != nil {
+			return backup.Status.UnderlyingResources
+		}
+		return ur
+	}
+	return backup.Status.UnderlyingResources
+}
+
+// GVRs used during pre-restore preparation.
+var (
+	helmReleaseGVR    = schema.GroupVersionResource{Group: "helm.toolkit.fluxcd.io", Version: "v2", Resource: "helmreleases"}
+	virtualMachineGVR = schema.GroupVersionResource{Group: "kubevirt.io", Version: "v1", Resource: "virtualmachines"}
+	vmiGVR            = schema.GroupVersionResource{Group: "kubevirt.io", Version: "v1", Resource: "virtualmachineinstances"}
+	dataVolumeGVR     = schema.GroupVersionResource{Group: "cdi.kubevirt.io", Version: "v1beta1", Resource: "datavolumes"}
+)
+
+// shortHash returns the first 4 hex characters of sha256(input).
+func shortHash(input string) string {
+	h := sha256.Sum256([]byte(input))
+	return hex.EncodeToString(h[:])[:4]
+}
+
+// prepareForRestore performs graceful pre-restore cleanup:
+//  1. Suspends HelmReleases that belong to the backup scope.
+//  2. Halts the VirtualMachine (sets spec.runStrategy=Halted).
+//  3. Waits for the VMI to disappear (graceful shutdown complete).
+//  4. Deletes DataVolumes so CDI doesn't recreate PVCs after rename.
+//  5. Renames existing PVCs to <name>-orig-<hash> so Velero can create fresh
+//     ones via Data Movement.
+//
+// Failures in individual steps are non-fatal: missing resources are expected
+// (e.g. restore requested when app was already deleted). Each action emits
+// a Kubernetes Event on the RestoreJob for observability.
+//
+// Returns true when preparation is complete and the Velero Restore can be created.
+// Returns false (with a requeue) when still waiting for VM shutdown.
+func (r *RestoreJobReconciler) prepareForRestore(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup) (ready bool, result ctrl.Result, err error) {
+	ns := restoreJob.Namespace
+	appName := backup.Spec.ApplicationRef.Name
+	appKind := backup.Spec.ApplicationRef.Kind
+	origSuffix := "-orig-" + shortHash(restoreJob.Name)
+
+	// --- Step 1: Suspend HelmReleases ---
+	hrNames := []string{}
+	if appKind == vmInstanceKind {
+		hrNames = append(hrNames, vmNamePrefix+appName)
+	}
+	if backup.Status.UnderlyingResources != nil {
+		for _, dv := range backup.Status.UnderlyingResources.DataVolumes {
+			hrNames = append(hrNames, dv.DataVolumeName)
+		}
+	}
+	for _, hrName := range hrNames {
+		if err := r.suspendHelmRelease(ctx, ns, hrName); err != nil {
+			r.Recorder.Event(restoreJob, corev1.EventTypeWarning, "PrepareForRestore",
+				fmt.Sprintf("Failed to suspend HelmRelease %s: %v", hrName, err))
+		} else {
+			r.Recorder.Event(restoreJob, corev1.EventTypeNormal, "PrepareForRestore",
+				fmt.Sprintf("Suspended HelmRelease %s", hrName))
+		}
+	}
+
+	// --- Step 2: Halt VM and wait for shutdown ---
+	if appKind == vmInstanceKind {
+		vmName := vmNamePrefix + appName
+		halted, err := r.haltVirtualMachine(ctx, ns, vmName)
+		if err != nil {
+			r.Recorder.Event(restoreJob, corev1.EventTypeWarning, "PrepareForRestore",
+				fmt.Sprintf("Failed to halt VM %s: %v", vmName, err))
+			// Non-fatal: proceed even if halting fails (VM might not exist)
+		} else if !halted {
+			r.Recorder.Event(restoreJob, corev1.EventTypeNormal, "PrepareForRestore",
+				fmt.Sprintf("Waiting for VM %s to shut down", vmName))
+			return false, ctrl.Result{RequeueAfter: defaultRestoreRequeueAfter}, nil
+		} else {
+			r.Recorder.Event(restoreJob, corev1.EventTypeNormal, "PrepareForRestore",
+				fmt.Sprintf("VM %s is halted", vmName))
+		}
+	}
+
+	// --- Step 3: Rename PVCs to <name>-orig-<hash> ---
+	// Must happen BEFORE deleting DVs: the PVC has an ownerReference to the DV,
+	// so deleting the DV first would cascade-delete the PVC via garbage collection.
+	if backup.Status.UnderlyingResources != nil {
+		for _, dv := range backup.Status.UnderlyingResources.DataVolumes {
+			if err := r.renamePVC(ctx, restoreJob, ns, dv.DataVolumeName, dv.DataVolumeName+origSuffix); err != nil {
+				r.Recorder.Event(restoreJob, corev1.EventTypeWarning, "PrepareForRestore",
+					fmt.Sprintf("Failed to keep old PVC %s: %v", dv.DataVolumeName, err))
+			}
+		}
+	}
+
+	// --- Step 4: Delete DataVolumes so CDI doesn't recreate PVCs ---
+	if backup.Status.UnderlyingResources != nil {
+		for _, dv := range backup.Status.UnderlyingResources.DataVolumes {
+			if err := r.deleteDataVolume(ctx, ns, dv.DataVolumeName); err != nil {
+				r.Recorder.Event(restoreJob, corev1.EventTypeWarning, "PrepareForRestore",
+					fmt.Sprintf("Failed to delete DataVolume %s: %v", dv.DataVolumeName, err))
+			} else {
+				r.Recorder.Event(restoreJob, corev1.EventTypeNormal, "PrepareForRestore",
+					fmt.Sprintf("Deleted DataVolume %s", dv.DataVolumeName))
+			}
+		}
+	}
+
+	r.Recorder.Event(restoreJob, corev1.EventTypeNormal, "PrepareForRestore", "Pre-restore preparation complete")
+	return true, ctrl.Result{}, nil
+}
+
+// suspendHelmRelease sets spec.suspend=true on a HelmRelease.
+func (r *RestoreJobReconciler) suspendHelmRelease(ctx context.Context, ns, name string) error {
+	hr, err := r.Resource(helmReleaseGVR).Namespace(ns).Get(ctx, name, metav1.GetOptions{})
+	if err != nil {
+		if errors.IsNotFound(err) {
+			return nil
+		}
+		return err
+	}
+	suspended, _, _ := unstructured.NestedBool(hr.Object, "spec", "suspend")
+	if suspended {
+		return nil
+	}
+	if err := unstructured.SetNestedField(hr.Object, true, "spec", "suspend"); err != nil {
+		return err
+	}
+	if _, err := r.Resource(helmReleaseGVR).Namespace(ns).Update(ctx, hr, metav1.UpdateOptions{}); err != nil {
+		return err
+	}
+	return nil
+}
+
+// haltVirtualMachine sets runStrategy=Halted and returns true when the VMI is gone.
+func (r *RestoreJobReconciler) haltVirtualMachine(ctx context.Context, ns, vmName string) (bool, error) {
+	vm, err := r.Resource(virtualMachineGVR).Namespace(ns).Get(ctx, vmName, metav1.GetOptions{})
+	if err != nil {
+		if errors.IsNotFound(err) {
+			return true, nil
+		}
+		return false, err
+	}
+
+	currentStrategy, _, _ := unstructured.NestedString(vm.Object, "spec", "runStrategy")
+	if currentStrategy != "Halted" {
+		if err := unstructured.SetNestedField(vm.Object, "Halted", "spec", "runStrategy"); err != nil {
+			return false, err
+		}
+		if _, err := r.Resource(virtualMachineGVR).Namespace(ns).Update(ctx, vm, metav1.UpdateOptions{}); err != nil {
+			return false, err
+		}
+	}
+
+	// VMI gone = shutdown complete
+	_, err = r.Resource(vmiGVR).Namespace(ns).Get(ctx, vmName, metav1.GetOptions{})
+	if err != nil {
+		if errors.IsNotFound(err) {
+			return true, nil
+		}
+		return false, err
+	}
+	return false, nil
+}
+
+// deleteDataVolume deletes a DataVolume so CDI doesn't recreate the PVC after rename.
+func (r *RestoreJobReconciler) deleteDataVolume(ctx context.Context, ns, name string) error {
+	err := r.Resource(dataVolumeGVR).Namespace(ns).Delete(ctx, name, metav1.DeleteOptions{})
+	if err != nil && !errors.IsNotFound(err) {
+		return err
+	}
+	return nil
+}
+
+// renamePVC preserves an existing PVC by rebinding it under a new name.
+// The original PVC is deleted and a new one pointing to the same PV is created.
+// Missing resources are silently skipped (non-fatal).
+func (r *RestoreJobReconciler) renamePVC(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, ns, oldName, newName string) error {
+	logger := getLogger(ctx)
+
+	// Check if already renamed
+	existingNew := &corev1.PersistentVolumeClaim{}
+	if err := r.Get(ctx, client.ObjectKey{Namespace: ns, Name: newName}, existingNew); err == nil {
+		return nil
+	}
+
+	// Get the original PVC
+	oldPVC := &corev1.PersistentVolumeClaim{}
+	if err := r.Get(ctx, client.ObjectKey{Namespace: ns, Name: oldName}, oldPVC); err != nil {
+		if errors.IsNotFound(err) {
+			return nil // nothing to rename
+		}
+		return err
+	}
+
+	pvName := oldPVC.Spec.VolumeName
+	if pvName == "" {
+		logger.Debug("PVC not bound, deleting", "name", oldName)
+		return r.Delete(ctx, oldPVC)
+	}
+
+	// Patch PV reclaim policy to Retain so it survives PVC deletion
+	pv := &corev1.PersistentVolume{}
+	if err := r.Get(ctx, client.ObjectKey{Name: pvName}, pv); err != nil {
+		return fmt.Errorf("failed to get PV %s: %w", pvName, err)
+	}
+	if pv.Spec.PersistentVolumeReclaimPolicy != corev1.PersistentVolumeReclaimRetain {
+		pv.Spec.PersistentVolumeReclaimPolicy = corev1.PersistentVolumeReclaimRetain
+		if err := r.Update(ctx, pv); err != nil {
+			return fmt.Errorf("failed to set Retain policy on PV %s: %w", pvName, err)
+		}
+	}
+
+	// Create the new -orig PVC first (unbound, just the object)
+	newPVC := &corev1.PersistentVolumeClaim{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      newName,
+			Namespace: ns,
+		},
+		Spec: corev1.PersistentVolumeClaimSpec{
+			AccessModes:      oldPVC.Spec.AccessModes,
+			Resources:        oldPVC.Spec.Resources,
+			StorageClassName: oldPVC.Spec.StorageClassName,
+			VolumeMode:       oldPVC.Spec.VolumeMode,
+			VolumeName:       pvName,
+		},
+	}
+	if err := r.Create(ctx, newPVC); err != nil && !errors.IsAlreadyExists(err) {
+		return fmt.Errorf("failed to create -orig PVC %s: %w", newName, err)
+	}
+	// Re-read to get UID for the claimRef
+	if err := r.Get(ctx, client.ObjectKey{Namespace: ns, Name: newName}, newPVC); err != nil {
+		return fmt.Errorf("failed to get -orig PVC %s: %w", newName, err)
+	}
+
+	// Delete the original PVC
+	if err := r.Delete(ctx, oldPVC); err != nil && !errors.IsNotFound(err) {
+		return fmt.Errorf("failed to delete PVC %s: %w", oldName, err)
+	}
+
+	// Point the PV's claimRef directly to the new -orig PVC.
+	// This is atomic — no window where the PV is Available for other PVCs to grab.
+	if err := r.Get(ctx, client.ObjectKey{Name: pvName}, pv); err != nil {
+		return fmt.Errorf("failed to re-fetch PV %s: %w", pvName, err)
+	}
+	pv.Spec.ClaimRef = &corev1.ObjectReference{
+		APIVersion: "v1",
+		Kind:       "PersistentVolumeClaim",
+		Namespace:  ns,
+		Name:       newName,
+		UID:        newPVC.UID,
+	}
+	if err := r.Update(ctx, pv); err != nil {
+		return fmt.Errorf("failed to rebind PV %s to %s: %w", pvName, newName, err)
+	}
+
+	r.Recorder.Event(restoreJob, corev1.EventTypeNormal, "PrepareForRestore",
+		fmt.Sprintf("Keep old PVC %s as %s (PV: %s)", oldName, newName, pvName))
+	return nil
+}
+
 // createVeleroRestore creates a Velero Restore resource.
 func (r *RestoreJobReconciler) createVeleroRestore(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, strategy *strategyv1alpha1.Velero, veleroBackupName string) error {
 	logger := getLogger(ctx)
 	logger.Debug("createVeleroRestore called", "strategy", strategy.Name, "veleroBackupName", veleroBackupName)
 
-	// Determine target application reference
-	targetAppRef := r.getTargetApplicationRef(restoreJob, backup)
-
-	// Get the target application object for templating
-	mapping, err := r.RESTMapping(schema.GroupKind{Group: *targetAppRef.APIGroup, Kind: targetAppRef.Kind})
-	if err != nil {
-		return fmt.Errorf("failed to get REST mapping for target application: %w", err)
-	}
-	ns := restoreJob.Namespace
-	if mapping.Scope.Name() != meta.RESTScopeNameNamespace {
-		ns = ""
-	}
-	app, err := r.Resource(mapping.Resource).Namespace(ns).Get(ctx, targetAppRef.Name, metav1.GetOptions{})
-	if err != nil {
-		return fmt.Errorf("failed to get target application: %w", err)
-	}
-
-	// Build template context
 	templateContext := map[string]interface{}{
-		"Application": app.Object,
+		"Application": map[string]interface{}{
+			"metadata": map[string]interface{}{
+				"name":      backup.Spec.ApplicationRef.Name,
+				"namespace": backup.Namespace,
+			},
+			"kind": backup.Spec.ApplicationRef.Kind,
+		},
 		// TODO: Parameters are not currently stored on Backup, so they're unavailable during restore.
 		// This is a design limitation that should be addressed by persisting Parameters on the Backup object.
 		"Parameters": map[string]string{},
@@ -473,6 +1008,38 @@ func (r *RestoreJobReconciler) createVeleroRestore(ctx context.Context, restoreJ
 	// Set the backupName in the spec (required by Velero)
 	veleroRestoreSpec.BackupName = veleroBackupName
 
+	// Match backup: add OR selectors for each underlying VMDisk so restore applies the same
+	// scope as the intended backup (see createVeleroBackup). Prefer Backup status; fall back
+	// to Velero Backup annotation when status was pruned by an older CRD.
+	ur := r.resolveUnderlyingResourcesForRestore(ctx, backup, veleroBackupName)
+	if ur != nil {
+		for _, dv := range ur.DataVolumes {
+			veleroRestoreSpec.OrLabelSelectors = append(veleroRestoreSpec.OrLabelSelectors, &metav1.LabelSelector{
+				MatchLabels: map[string]string{
+					appKindLabel: vmDiskAppKind,
+					appNameLabel: dv.ApplicationName,
+				},
+			})
+		}
+		if len(ur.DataVolumes) > 0 {
+			logger.Debug("added VMDisk label selectors to Velero restore", "count", len(ur.DataVolumes))
+		}
+	}
+
+	// Create resourceModifiers ConfigMap
+	resourceModifierCM, err := r.createResourceModifiersConfigMap(ctx, restoreJob, backup)
+	if err != nil {
+		return fmt.Errorf("failed to create resourceModifiers ConfigMap: %w", err)
+	}
+	if resourceModifierCM != nil {
+		veleroRestoreSpec.ResourceModifier = &corev1.TypedLocalObjectReference{
+			APIGroup: stringPtr(""),
+			Kind:     "ConfigMap",
+			Name:     resourceModifierCM.Name,
+		}
+		logger.Debug("set resourceModifier on Velero Restore", "configMap", resourceModifierCM.Name)
+	}
+
 	generateName := fmt.Sprintf("%s.%s-", restoreJob.Namespace, restoreJob.Name)
 	veleroRestore := &velerov1.Restore{
 		ObjectMeta: metav1.ObjectMeta{
@@ -497,3 +1064,60 @@ func (r *RestoreJobReconciler) createVeleroRestore(ctx context.Context, restoreJ
 		fmt.Sprintf("Created Velero Restore %s/%s", veleroNamespace, veleroRestore.Name))
 	return nil
 }
+
+// dataUploadListGVK is the API version shipped with Velero data mover CRDs (see velero datauploads CRD).
+var dataUploadListGVK = schema.GroupVersionKind{Group: "velero.io", Version: "v2alpha1", Kind: "DataUploadList"}
+
+// formatVeleroBackupFailureMessageForBackupJob builds a BackupJob status message from Velero Backup
+// status plus failed DataUpload resources (CSI data mover), similar to `velero backup describe`.
+func formatVeleroBackupFailureMessageForBackupJob(ctx context.Context, c client.Client, veleroBackup *velerov1.Backup) string {
+	var b strings.Builder
+	fmt.Fprintf(&b, "Velero Backup failed with phase %s", veleroBackup.Status.Phase)
+	if fr := strings.TrimSpace(veleroBackup.Status.FailureReason); fr != "" {
+		fmt.Fprintf(&b, ": %s", fr)
+	}
+	if len(veleroBackup.Status.ValidationErrors) > 0 {
+		fmt.Fprintf(&b, "; validation: %v", veleroBackup.Status.ValidationErrors)
+	}
+	if h := veleroBackup.Status.HookStatus; h != nil && h.HooksFailed > 0 {
+		fmt.Fprintf(&b, "; hooks failed %d/%d", h.HooksFailed, h.HooksAttempted)
+	}
+	if veleroBackup.Status.BackupItemOperationsFailed > 0 {
+		fmt.Fprintf(&b, "; async item operations failed %d (completed %d, attempted %d)",
+			veleroBackup.Status.BackupItemOperationsFailed,
+			veleroBackup.Status.BackupItemOperationsCompleted,
+			veleroBackup.Status.BackupItemOperationsAttempted)
+	}
+	b.WriteString(appendFailedDataUploadMessages(ctx, c, veleroBackup.Name))
+	return b.String()
+}
+
+func appendFailedDataUploadMessages(ctx context.Context, c client.Client, veleroBackupName string) string {
+	ul := unstructured.UnstructuredList{}
+	ul.SetGroupVersionKind(dataUploadListGVK)
+	if err := c.List(ctx, &ul, client.InNamespace(veleroNamespace)); err != nil {
+		return ""
+	}
+	prefix := veleroBackupName + "-"
+	var b strings.Builder
+	for _, item := range ul.Items {
+		if !strings.HasPrefix(item.GetName(), prefix) {
+			continue
+		}
+		phase, _, _ := unstructured.NestedString(item.Object, "status", "phase")
+		if phase != "Failed" {
+			continue
+		}
+		msg, _, _ := unstructured.NestedString(item.Object, "status", "message")
+		if strings.TrimSpace(msg) == "" {
+			msg = "(empty status.message)"
+		}
+		srcPVC, _, _ := unstructured.NestedString(item.Object, "spec", "sourcePVC")
+		if srcPVC != "" {
+			fmt.Fprintf(&b, "; DataUpload %s failed for PVC %s: %s", item.GetName(), srcPVC, msg)
+		} else {
+			fmt.Fprintf(&b, "; DataUpload %s failed: %s", item.GetName(), msg)
+		}
+	}
+	return b.String()
+}
diff --git a/packages/system/backup-controller/definitions/backups.cozystack.io_backups.yaml b/packages/system/backup-controller/definitions/backups.cozystack.io_backups.yaml
index 6d55cb84..76d8a477 100644
--- a/packages/system/backup-controller/definitions/backups.cozystack.io_backups.yaml
+++ b/packages/system/backup-controller/definitions/backups.cozystack.io_backups.yaml
@@ -142,6 +142,29 @@ spec:
                 required:
                 - uri
                 type: object
+              underlyingResources:
+                description: |-
+                  UnderlyingResources contains information about underlying resources
+                  discovered during backup (e.g., VM disks, IP/MAC addresses).
+                properties:
+                  dataVolumes:
+                    items:
+                      properties:
+                        applicationName:
+                          description: Cozystack application name for this disk (e.g. ubuntu-source).
+                          type: string
+                        dataVolumeName:
+                          description: Name of the DataVolume/PVC (e.g. vm-disk-ubuntu-source).
+                          type: string
+                      type: object
+                    type: array
+                  ip:
+                    description: OVN IP address assigned to the application at backup time.
+                    type: string
+                  mac:
+                    description: OVN MAC address assigned to the application at backup time.
+                    type: string
+                type: object
               conditions:
                 description: Conditions represents the latest available observations
                   of a Backup's state.
diff --git a/packages/system/backupstrategy-controller/templates/rbac-bind.yaml b/packages/system/backupstrategy-controller/templates/rbac-bind.yaml
index 03578cc2..4ecacce0 100644
--- a/packages/system/backupstrategy-controller/templates/rbac-bind.yaml
+++ b/packages/system/backupstrategy-controller/templates/rbac-bind.yaml
@@ -10,3 +10,17 @@ subjects:
 - kind: ServiceAccount
   name: backupstrategy-controller
   namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: backups.cozystack.io:strategy-controller:velero-configmaps
+  namespace: cozy-velero
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: backups.cozystack.io:strategy-controller:velero-configmaps
+subjects:
+- kind: ServiceAccount
+  name: backupstrategy-controller
+  namespace: {{ .Release.Namespace }}
diff --git a/packages/system/backupstrategy-controller/templates/rbac.yaml b/packages/system/backupstrategy-controller/templates/rbac.yaml
index 7c31d408..2216577e 100644
--- a/packages/system/backupstrategy-controller/templates/rbac.yaml
+++ b/packages/system/backupstrategy-controller/templates/rbac.yaml
@@ -11,25 +11,60 @@ rules:
 - apiGroups: ["backups.cozystack.io"]
   resources: ["backupclasses"]
   verbs: ["get", "list", "watch"]
-# BackupJob / RestoreJob: reconcile and update status
+# BackupJob / RestoreJob: reconcile; update for RestoreJob finalizers
 - apiGroups: ["backups.cozystack.io"]
   resources: ["backupjobs", "restorejobs"]
-  verbs: ["get", "list", "watch"]
+  verbs: ["get", "list", "watch", "update", "patch"]
 - apiGroups: ["backups.cozystack.io"]
   resources: ["backupjobs/status", "restorejobs/status"]
   verbs: ["get", "update", "patch"]
-# Backup: create after Velero backup completes
+# Backup: create after Velero job completes; update/patch for BackupReconciler finalizers
 - apiGroups: ["backups.cozystack.io"]
   resources: ["backups"]
-  verbs: ["create", "get", "list", "watch"]
-# Application refs (e.g. VMInstance, VirtualMachine) for backup/restore scope
+  verbs: ["create", "get", "list", "watch", "update", "patch"]
+# Pods: BackupJob lists virt-launcher pods by label (manager cache uses cluster-scoped list/watch)
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "list", "watch"]
+# ConfigMaps: controller-runtime cache requires cluster-scoped list/watch;
+# create/update/delete is scoped to cozy-velero via the Role below.
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["get", "list", "watch"]
+# Application refs (e.g. VMInstance) for backup/restore scope
 - apiGroups: ["apps.cozystack.io"]
   resources: ["*"]
   verbs: ["get", "list", "watch"]
-# Velero Backup/Restore in cozy-velero namespace
+# KubeVirt: pre-restore halts VMs and checks VMI shutdown
+- apiGroups: ["kubevirt.io"]
+  resources: ["virtualmachines"]
+  verbs: ["get", "update"]
+- apiGroups: ["kubevirt.io"]
+  resources: ["virtualmachineinstances"]
+  verbs: ["get"]
+# CDI DataVolumes: pre-restore deletes DVs so CDI doesn't recreate PVCs after rename
+- apiGroups: ["cdi.kubevirt.io"]
+  resources: ["datavolumes"]
+  verbs: ["delete"]
+# HelmReleases: pre-restore suspends HRs to prevent Flux interference
+- apiGroups: ["helm.toolkit.fluxcd.io"]
+  resources: ["helmreleases"]
+  verbs: ["get", "update"]
+# PVCs and PVs: pre-restore renames PVCs (delete old, create new) and patches PV reclaim policy
+- apiGroups: [""]
+  resources: ["persistentvolumeclaims"]
+  verbs: ["get", "list", "watch", "create", "delete"]
+- apiGroups: [""]
+  resources: ["persistentvolumes"]
+  verbs: ["get", "list", "watch", "update"]
+# Velero Backup/Restore/DataUpload in cozy-velero namespace (DataUpload: enrich BackupJob failure messages)
 - apiGroups: ["velero.io"]
-  resources: ["backups", "restores"]
-  verbs: ["create", "get", "list", "watch", "update", "patch"]
+  resources: ["backups", "restores", "datauploads"]
+  verbs: ["create", "get", "list", "watch", "update", "patch", "delete", "deletecollection"]
+# Velero DeleteBackupRequest: used by BackupReconciler to delete Velero backups with their storage data
+- apiGroups: ["velero.io"]
+  resources: ["deletebackuprequests"]
+  verbs: ["create", "get", "list", "watch"]
 # Events from Recorder.Event() calls
 - apiGroups: [""]
   resources: ["events"]
@@ -38,3 +73,14 @@ rules:
 - apiGroups: ["coordination.k8s.io"]
   resources: ["leases"]
   verbs: ["get", "list", "watch", "create", "update", "patch"]
+---
+# To create ResourceModifiers in ConfigMaps for Restore in Velero install namespace.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: backups.cozystack.io:strategy-controller:velero-configmaps
+  namespace: cozy-velero
+rules:
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["create", "get", "list", "delete", "deletecollection", "patch", "update"]

From 094b80ae16aef967b8f57167ee4f06c89b4a7d78 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 31 Mar 2026 11:15:40 +0200
Subject: [PATCH 363/666] fix(multus): build custom image with DEL cache fix

When CNI ADD never completes, multus DEL fails because delegate plugins
require runtime state that only exists after a successful ADD. This
creates a deadlock where containerd cannot release sandbox name
reservations, permanently blocking pod creation on the affected node.

Build a custom multus-cni image with a patch that returns success on
DEL when no cache file exists (ADD was never completed).

Upstream PR: https://github.com/k8snetworkplumbingwg/multus-cni/pull/1498
Tracking issue: https://github.com/cozystack/cozystack/issues/2310

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 Makefile                                      |  1 +
 packages/system/multus/Makefile               | 12 +++++
 packages/system/multus/images/multus-cni.json | 54 +++++++++++++++++++
 .../multus/images/multus-cni/Dockerfile       | 25 +++++++++
 .../patches/fix-del-without-cache.diff        | 49 +++++++++++++++++
 .../templates/multus-daemonset-thick.yml      |  4 +-
 6 files changed, 143 insertions(+), 2 deletions(-)
 create mode 100644 packages/system/multus/images/multus-cni.json
 create mode 100644 packages/system/multus/images/multus-cni/Dockerfile
 create mode 100644 packages/system/multus/images/multus-cni/patches/fix-del-without-cache.diff

diff --git a/Makefile b/Makefile
index ce6eb7b3..59a55bfb 100644
--- a/Makefile
+++ b/Makefile
@@ -27,6 +27,7 @@ build: build-deps
 	make -C packages/system/dashboard image
 	make -C packages/system/metallb image
 	make -C packages/system/kamaji image
+	make -C packages/system/multus image
 	make -C packages/system/bucket image
 	make -C packages/system/objectstorage-controller image
 	make -C packages/system/grafana-operator image
diff --git a/packages/system/multus/Makefile b/packages/system/multus/Makefile
index 9b34606d..399af728 100644
--- a/packages/system/multus/Makefile
+++ b/packages/system/multus/Makefile
@@ -11,3 +11,15 @@ update:
 	wget -q https://raw.githubusercontent.com/k8snetworkplumbingwg/multus-cni/refs/tags/$(RELEASE)/deployments/multus-daemonset-thick.yml -O templates/multus-daemonset-thick.yml
 	sed -i '/multus-cni/s/snapshot-thick/$(RELEASE)-thick/' templates/multus-daemonset-thick.yml && \
 	patch --no-backup-if-mismatch -p4 < patches/customize-deployment.patch
+	$(SED_INPLACE) "/ARG VERSION/ s|=.*|=$(RELEASE)|g" images/multus-cni/Dockerfile
+
+image:
+	docker buildx build images/multus-cni \
+		--tag $(REGISTRY)/multus-cni:$(call settag,$(TAG)) \
+		--cache-from type=registry,ref=$(REGISTRY)/multus-cni:latest \
+		--cache-to type=inline \
+		--metadata-file images/multus-cni.json \
+		$(BUILDX_ARGS)
+	DIGEST=$$(yq e '."containerimage.digest"' images/multus-cni.json -o json -r) && \
+		sed -i "s|image: .*multus-cni.*|image: $(REGISTRY)/multus-cni:$(TAG)@$${DIGEST}|g" templates/multus-daemonset-thick.yml
+	rm -f images/multus-cni.json
diff --git a/packages/system/multus/images/multus-cni.json b/packages/system/multus/images/multus-cni.json
new file mode 100644
index 00000000..9848b688
--- /dev/null
+++ b/packages/system/multus/images/multus-cni.json
@@ -0,0 +1,54 @@
+{
+  "buildx.build.provenance": {
+    "buildType": "https://mobyproject.org/buildkit@v1",
+    "materials": [
+      {
+        "uri": "pkg:docker/debian@stable-slim?platform=linux%2Famd64",
+        "digest": {
+          "sha256": "99fc6d2a0882fcbcdc452948d2d54eab91faafc7db037df82425edcdcf950e1f"
+        }
+      },
+      {
+        "uri": "pkg:docker/golang@1.24?platform=linux%2Famd64",
+        "digest": {
+          "sha256": "d2d2bc1c84f7e60d7d2438a3836ae7d0c847f4888464e7ec9ba3a1339a1ee804"
+        }
+      }
+    ],
+    "invocation": {
+      "configSource": {
+        "entryPoint": "Dockerfile"
+      },
+      "parameters": {
+        "frontend": "dockerfile.v0",
+        "args": {
+          "label:org.opencontainers.image.source": "https://github.com/cozystack/cozystack"
+        },
+        "locals": [
+          {
+            "name": "context"
+          },
+          {
+            "name": "dockerfile"
+          }
+        ]
+      },
+      "environment": {
+        "platform": "linux/amd64"
+      }
+    }
+  },
+  "buildx.build.ref": "buildkit-builder/buildkit-builder0/84w636wch59pt7uaw1mvwfg2w",
+  "containerimage.config.digest": "sha256:407e75f5f1122abc86ec12ea1d70b233941f1c431ee03cf9b7cae55d890b9c98",
+  "containerimage.descriptor": {
+    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
+    "digest": "sha256:4b7d9081bdb9d6608ff9b941364fb3c71bf56a352ca3da1bbe14e6b64e6aa459",
+    "size": 1098,
+    "platform": {
+      "architecture": "amd64",
+      "os": "linux"
+    }
+  },
+  "containerimage.digest": "sha256:4b7d9081bdb9d6608ff9b941364fb3c71bf56a352ca3da1bbe14e6b64e6aa459",
+  "image.name": "ghcr.io/cozystack/cozystack/multus-cni:latest"
+}
\ No newline at end of file
diff --git a/packages/system/multus/images/multus-cni/Dockerfile b/packages/system/multus/images/multus-cni/Dockerfile
new file mode 100644
index 00000000..feecbc6c
--- /dev/null
+++ b/packages/system/multus/images/multus-cni/Dockerfile
@@ -0,0 +1,25 @@
+FROM --platform=$BUILDPLATFORM golang:1.24 AS build
+
+ARG VERSION=v4.2.3
+ARG TARGETPLATFORM
+
+WORKDIR /usr/src/multus-cni
+
+RUN curl -sSL https://github.com/k8snetworkplumbingwg/multus-cni/archive/refs/tags/${VERSION}.tar.gz | \
+    tar -xzf - --strip=1
+
+COPY patches /patches
+RUN git init && git config user.email "build@cozystack" && git config user.name "build" && \
+    git add -A && git commit -m "init" && git tag ${VERSION} && \
+    git apply /patches/*.diff
+
+RUN ./hack/build-go.sh
+
+FROM debian:stable-slim
+LABEL org.opencontainers.image.source=https://github.com/cozystack/cozystack
+COPY --from=build /usr/src/multus-cni/bin /usr/src/multus-cni/bin
+COPY --from=build /usr/src/multus-cni/LICENSE /usr/src/multus-cni/LICENSE
+COPY --from=build /usr/src/multus-cni/bin/cert-approver /
+WORKDIR /
+
+ENTRYPOINT ["/usr/src/multus-cni/bin/multus-daemon"]
diff --git a/packages/system/multus/images/multus-cni/patches/fix-del-without-cache.diff b/packages/system/multus/images/multus-cni/patches/fix-del-without-cache.diff
new file mode 100644
index 00000000..7595ddb2
--- /dev/null
+++ b/packages/system/multus/images/multus-cni/patches/fix-del-without-cache.diff
@@ -0,0 +1,49 @@
+diff --git a/pkg/multus/multus.go b/pkg/multus/multus.go
+index a7941fe..eff0406 100644
+--- a/pkg/multus/multus.go
++++ b/pkg/multus/multus.go
+@@ -954,33 +954,19 @@ func CmdDel(args *skel.CmdArgs, exec invoke.Exec, kubeClient *k8s.ClientInfo) er
+ 	}
+ 
+ 	if !useCacheConf {
+-		// Fetch delegates again if cache is not exist and pod info can be read
+-		if os.IsNotExist(err) && pod != nil {
+-			if in.ClusterNetwork != "" {
+-				_, err = k8s.GetDefaultNetworks(pod, in, kubeClient, nil)
+-				if err != nil {
+-					return cmdErr(k8sArgs, "failed to get clusterNetwork/defaultNetworks: %v", err)
+-				}
+-				// First delegate is always the master plugin
+-				in.Delegates[0].MasterPlugin = true
+-			}
+-
+-			// Get pod annotation and so on
+-			_, _, err := k8s.TryLoadPodDelegates(pod, in, kubeClient, nil)
+-			if err != nil {
+-				if len(in.Delegates) == 0 {
+-					// No delegate available so send error
+-					return cmdErr(k8sArgs, "failed to get delegates: %v", err)
+-				}
+-				// Get clusterNetwork before, so continue to delete
+-				logging.Errorf("Multus: failed to get delegates: %v, but continue to delete clusterNetwork", err)
+-			}
+-		} else {
+-			// The options to continue with a delete have been exhausted (cachefile + API query didn't work)
+-			// We cannot exit with an error as this may cause a sandbox to never get deleted.
+-			logging.Errorf("Multus: failed to get the cached delegates file: %v, cannot properly delete", err)
++		// If cache does not exist, ADD was never completed for this sandbox.
++		// Attempting DEL with a config reconstructed from the API will fail because
++		// delegate plugins (e.g. kube-ovn) require runtime state that only exists
++		// after a successful ADD (socket paths, cached results, etc.).
++		// Return success to allow containerd to release the sandbox name reservation.
++		if os.IsNotExist(err) {
++			logging.Verbosef("Multus: no cache found for container %s (ADD was never completed), skip DEL", args.ContainerID)
+ 			return nil
+ 		}
++		// The options to continue with a delete have been exhausted
++		// We cannot exit with an error as this may cause a sandbox to never get deleted.
++		logging.Errorf("Multus: failed to get the cached delegates file: %v, cannot properly delete", err)
++		return nil
+ 	}
+ 
+ 	// set CNIVersion in delegate CNI config if there is no CNIVersion and multus conf have CNIVersion.
diff --git a/packages/system/multus/templates/multus-daemonset-thick.yml b/packages/system/multus/templates/multus-daemonset-thick.yml
index 2f00de85..97144d67 100644
--- a/packages/system/multus/templates/multus-daemonset-thick.yml
+++ b/packages/system/multus/templates/multus-daemonset-thick.yml
@@ -154,7 +154,7 @@ spec:
       serviceAccountName: multus
       containers:
         - name: kube-multus
-          image: ghcr.io/k8snetworkplumbingwg/multus-cni:v4.2.3-thick
+          image: ghcr.io/cozystack/cozystack/multus-cni:latest@sha256:4b7d9081bdb9d6608ff9b941364fb3c71bf56a352ca3da1bbe14e6b64e6aa459
           command: [ "/usr/src/multus-cni/bin/multus-daemon" ]
           resources:
             requests:
@@ -200,7 +200,7 @@ spec:
                   fieldPath: spec.nodeName
       initContainers:
         - name: install-multus-binary
-          image: ghcr.io/k8snetworkplumbingwg/multus-cni:v4.2.3-thick
+          image: ghcr.io/cozystack/cozystack/multus-cni:latest@sha256:4b7d9081bdb9d6608ff9b941364fb3c71bf56a352ca3da1bbe14e6b64e6aa459
           command:
             - "/usr/src/multus-cni/bin/install_multus"
             - "-d"

From 1cd564330cb7137c2994afa1b5ca78a3b062dc08 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 31 Mar 2026 11:15:45 +0200
Subject: [PATCH 364/666] chore: remove build artifact

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/system/multus/images/multus-cni.json | 54 -------------------
 1 file changed, 54 deletions(-)
 delete mode 100644 packages/system/multus/images/multus-cni.json

diff --git a/packages/system/multus/images/multus-cni.json b/packages/system/multus/images/multus-cni.json
deleted file mode 100644
index 9848b688..00000000
--- a/packages/system/multus/images/multus-cni.json
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  "buildx.build.provenance": {
-    "buildType": "https://mobyproject.org/buildkit@v1",
-    "materials": [
-      {
-        "uri": "pkg:docker/debian@stable-slim?platform=linux%2Famd64",
-        "digest": {
-          "sha256": "99fc6d2a0882fcbcdc452948d2d54eab91faafc7db037df82425edcdcf950e1f"
-        }
-      },
-      {
-        "uri": "pkg:docker/golang@1.24?platform=linux%2Famd64",
-        "digest": {
-          "sha256": "d2d2bc1c84f7e60d7d2438a3836ae7d0c847f4888464e7ec9ba3a1339a1ee804"
-        }
-      }
-    ],
-    "invocation": {
-      "configSource": {
-        "entryPoint": "Dockerfile"
-      },
-      "parameters": {
-        "frontend": "dockerfile.v0",
-        "args": {
-          "label:org.opencontainers.image.source": "https://github.com/cozystack/cozystack"
-        },
-        "locals": [
-          {
-            "name": "context"
-          },
-          {
-            "name": "dockerfile"
-          }
-        ]
-      },
-      "environment": {
-        "platform": "linux/amd64"
-      }
-    }
-  },
-  "buildx.build.ref": "buildkit-builder/buildkit-builder0/84w636wch59pt7uaw1mvwfg2w",
-  "containerimage.config.digest": "sha256:407e75f5f1122abc86ec12ea1d70b233941f1c431ee03cf9b7cae55d890b9c98",
-  "containerimage.descriptor": {
-    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
-    "digest": "sha256:4b7d9081bdb9d6608ff9b941364fb3c71bf56a352ca3da1bbe14e6b64e6aa459",
-    "size": 1098,
-    "platform": {
-      "architecture": "amd64",
-      "os": "linux"
-    }
-  },
-  "containerimage.digest": "sha256:4b7d9081bdb9d6608ff9b941364fb3c71bf56a352ca3da1bbe14e6b64e6aa459",
-  "image.name": "ghcr.io/cozystack/cozystack/multus-cni:latest"
-}
\ No newline at end of file

From e09cd0f37f7cf399878bcf7c13247a047d4f116f Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 31 Mar 2026 11:30:25 +0200
Subject: [PATCH 365/666] fix(multus): pin master CNI to 05-cilium.conflist

Set multusMasterCNI to explicitly use 05-cilium.conflist instead of
auto-detecting the first available conflist at boot. This prevents a
race condition where multus picks 10-kube-ovn.conflist if it appears
before 05-cilium.conflist during node startup, bypassing the Cilium
CNI chain entirely.

Upstream issue: https://github.com/k8snetworkplumbingwg/multus-cni/issues/1499
Tracking issue: https://github.com/cozystack/cozystack/issues/2310

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/system/multus/templates/multus-daemonset-thick.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/system/multus/templates/multus-daemonset-thick.yml b/packages/system/multus/templates/multus-daemonset-thick.yml
index 2f00de85..2a2842f4 100644
--- a/packages/system/multus/templates/multus-daemonset-thick.yml
+++ b/packages/system/multus/templates/multus-daemonset-thick.yml
@@ -119,6 +119,7 @@ data:
         "cniConfigDir": "/host/etc/cni/net.d",
         "multusAutoconfigDir": "/host/etc/cni/net.d",
         "multusConfigFile": "auto",
+        "multusMasterCNI": "05-cilium.conflist",
         "socketDir": "/host/run/multus/"
     }
 ---

From 94d42749a7b1fd01ba4f99dec7dc975b19f0f2e7 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 31 Mar 2026 12:48:07 +0200
Subject: [PATCH 366/666] fix(kubernetes): set explicit ephemeral-storage on
 virt-launcher pods

Without explicit ephemeral-storage resources on the VirtualMachine spec,
virt-launcher pods inherit default limits from the namespace LimitRange,
which can be much lower than the emptyDisk capacity. This causes kubelet
to evict the pod when the VM's containerd unpacks images exceeding the
limit.

Set domain.resources with ephemeral-storage calculated via cozy-lib
allocation ratio based on the configured ephemeralStorage value.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/apps/kubernetes/templates/cluster.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/packages/apps/kubernetes/templates/cluster.yaml b/packages/apps/kubernetes/templates/cluster.yaml
index 7d71858b..10d6fd80 100644
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -70,6 +70,8 @@ spec:
             memory:
               guest: {{ .group.resources.memory }}
             {{- end }}
+            resources:
+              {{- include "cozy-lib.resources.sanitize" (list (dict "ephemeral-storage" .group.ephemeralStorage) $) | nindent 14 }}
           evictionStrategy: External
           volumes:
           - name: system

From 83b8940024621e723f175c23b76704806a7998fd Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 31 Mar 2026 13:14:21 +0200
Subject: [PATCH 367/666] fix(ci): make tags workflow idempotent on re-runs

- Remove broken `git push origin HEAD` in detached HEAD state (commit
  artifacts are already pushed via the "Create release branch" step)
- Make subtag push idempotent: use explicit refs/tags/ prefix and
  tolerate already-existing remote tags after verifying they point to
  the correct commit

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .github/workflows/tags.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/tags.yaml b/.github/workflows/tags.yaml
index f26ef632..2ef1c8f4 100644
--- a/.github/workflows/tags.yaml
+++ b/.github/workflows/tags.yaml
@@ -123,7 +123,6 @@ jobs:
           git config --unset-all http.https://github.com/.extraheader || true
           git add .
           git commit -m "Prepare release ${GITHUB_REF#refs/tags/}" -s || echo "No changes to commit"
-          git push origin HEAD || true
 
       # Tag the api/apps/v1alpha1 submodule for pkg.go.dev
       - name: Tag API submodule
@@ -142,7 +141,7 @@ jobs:
           else
             git tag "${SUBTAG}" "$TARGET"
           fi
-          git push origin "${SUBTAG}"
+          git push origin "refs/tags/${SUBTAG}" 2>&1 || echo "Tag ${SUBTAG} already exists on remote"
 
       # Create or reuse draft release
       - name: Create / reuse draft release

From 38b5d8601769eea1a56d940bc337f21113928275 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 31 Mar 2026 13:15:47 +0200
Subject: [PATCH 368/666] fix(ci): force-update API subtag on re-runs

Always force-create and force-push the API submodule tag so it stays
in sync with the main version tag, even when re-tagging.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .github/workflows/tags.yaml | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/tags.yaml b/.github/workflows/tags.yaml
index 2ef1c8f4..2bbdb7a6 100644
--- a/.github/workflows/tags.yaml
+++ b/.github/workflows/tags.yaml
@@ -136,12 +136,8 @@ jobs:
           git config user.email "217169706+cozystack-bot@users.noreply.github.com"
           git remote set-url origin https://cozystack-bot:${GH_PAT}@github.com/${GITHUB_REPOSITORY}
           TARGET="$(git rev-parse "${VTAG}^{}")"
-          if git rev-parse -q --verify "refs/tags/${SUBTAG}" >/dev/null; then
-            test "$(git rev-list -n1 "${SUBTAG}")" = "$TARGET"
-          else
-            git tag "${SUBTAG}" "$TARGET"
-          fi
-          git push origin "refs/tags/${SUBTAG}" 2>&1 || echo "Tag ${SUBTAG} already exists on remote"
+          git tag -f "${SUBTAG}" "$TARGET"
+          git push -f origin "refs/tags/${SUBTAG}"
 
       # Create or reuse draft release
       - name: Create / reuse draft release

From f2487cca3c94ac7df5604972e5001d628c46f850 Mon Sep 17 00:00:00 2001
From: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
Date: Tue, 31 Mar 2026 11:42:15 +0000
Subject: [PATCH 369/666] docs: add changelog for v1.2.1

Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
---
 docs/changelogs/v1.2.1.md | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 docs/changelogs/v1.2.1.md

diff --git a/docs/changelogs/v1.2.1.md b/docs/changelogs/v1.2.1.md
new file mode 100644
index 00000000..29e3fdf6
--- /dev/null
+++ b/docs/changelogs/v1.2.1.md
@@ -0,0 +1,31 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.2.1
+-->
+
+## Features and Improvements
+
+* **[postgres] Hardcode PostgreSQL 17 for monitoring databases and add migration**: CloudNativePG operator defaults to PostgreSQL 18.3 when no explicit image is specified, but monitoring queries in Grafana and Alerta rely on PostgreSQL 17 features such as `pg_stat_checkpointer` and the updated `pg_stat_bgwriter`. This mismatch could break monitoring after fresh installs or database recreation. PostgreSQL 17.7 images are now hardcoded for monitoring databases, and migration 37 is added to set version v17 for any existing PostgreSQL resources ([**@IvanHunters**](https://github.com/IvanHunters) in #2304, #2309).
+
+## Fixes
+
+* **[platform] Prevent installed packages deletion**: Added the `helm.sh/resource-policy: keep` annotation to all platform packages. Previously, moving a package to `disabledPackages` or removing it from `enabledPackages` caused Helm to automatically delete the corresponding resource, contradicting the documented behavior that requires the platform administrator to manually delete packages when needed ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2273, #2297).
+
+* **[linstor] Preserve TCP ports during toggle-disk operations**: During toggle-disk operations, `removeLayerData()` freed TCP ports from the number pool and `ensureStackDataExists()` could then allocate different ports. If a satellite missed the resulting update (e.g. due to a controller restart), it retained the old ports while peers received the new ones, causing DRBD connections to fail with StandAlone state. The fix adds `copyDrbdTcpPortsIfExists()` which saves existing TCP ports into the `LayerPayload` before `removeLayerData()` deletes them ([**@kvaps**](https://github.com/kvaps) in #2292, #2299).
+
+* **[platform] Fix resource allocation ratios not propagated to managed packages**: A regression introduced in the bundle restructure caused `cpuAllocationRatio`, `memoryAllocationRatio`, and `ephemeralStorageAllocationRatio` set in `platform/values.yaml` to become no-ops — they were never written to the `cozystack-values` Secret that cozy-lib reads in child packages. This meant all managed applications silently used the hardcoded defaults (10, 1, 40) regardless of operator-configured values. The fix restores propagation by writing the ratios into the `_cluster` section of the `cozystack-values` Secret and passing `cpuAllocationRatio` to the KubeVirt Package component ([**@sircthulhu**](https://github.com/sircthulhu) in #2296, #2301).
+
+* **[linstor] Fix DRBD connectivity failures on kernels without `crct10dif` by setting verify-alg to `crc32c`**: LINSTOR's auto-verify algorithm selection defaults to `crct10dif`, but this kernel crypto module is no longer available in newer kernels (e.g. Talos v1.12.6, kernel 6.18.18). When `crct10dif` is unavailable, DRBD peer connections fail with `VERIFYAlgNotAvail: failed to allocate crct10dif for verify`, causing all DRBD resources to enter Diskless state and lose quorum. `DrbdOptions/Net/verify-alg` is now set to `crc32c` at the controller level ([**@kvaps**](https://github.com/kvaps) in #2303, #2312).
+
+* **[multus] Fix stale sandbox reservations permanently blocking pod creation after CNI ADD failure**: After a node disruption (e.g. DRBD or kube-ovn issues during upgrade), containerd accumulated stale sandbox name reservations. Cleanup failed because multus called delegate plugins for DEL without cached state and they rejected the incomplete config, causing DEL to fail instead of succeeding. Stale entries were never released, permanently blocking new pod creation on the affected node. A custom multus-cni image is now built with a patch that returns success from DEL when CNI ADD never completed ([**@kvaps**](https://github.com/kvaps) in #2313, #2314).
+
+* **[multus] Pin master CNI to `05-cilium.conflist` to prevent race condition at boot**: During node boot or Talos upgrade, multus auto-detects the master CNI conflist by scanning the CNI config directory. If kube-ovn writes `10-kube-ovn.conflist` before Cilium writes `05-cilium.conflist`, multus selects the wrong file and pods bypass the Cilium chain entirely, have no Cilium endpoint, and their traffic is blocked by cluster-wide network policies. `multusMasterCNI` is now pinned to `05-cilium.conflist` ([**@kvaps**](https://github.com/kvaps) in #2315, #2316).
+
+## Documentation
+
+* **[website] Add custom Keycloak themes documentation**: Added documentation for custom Keycloak theme injection to the White Labeling guide, covering the theme image contract (`/themes/` directory structure), configuration via the `cozystack.keycloak` Package resource, `imagePullSecrets` for private registries, and theme activation in the Keycloak admin console ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#463).
+
+* **[website] Add documentation for Go types usage**: Added a guide for using the generated Go types for Cozystack managed applications as a Go module, including installation instructions, programmatic resource management examples, and deployment approaches ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#465).
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.2.0...v1.2.1

From aad494da28ae49f7da099677920211890000e798 Mon Sep 17 00:00:00 2001
From: Artem Bortnikov <brongineer747@gmail.com>
Date: Wed, 1 Apr 2026 00:15:02 +0100
Subject: [PATCH 370/666] chore: verify email and smtp config for kk

Signed-off-by: Artem Bortnikov <brongineer747@gmail.com>
---
 .../templates/configure-kk.yaml               |  9 ++++++++
 .../system/keycloak-configure/values.yaml     | 23 +++++++++++++++++++
 2 files changed, 32 insertions(+)
 create mode 100644 packages/system/keycloak-configure/values.yaml

diff --git a/packages/system/keycloak-configure/templates/configure-kk.yaml b/packages/system/keycloak-configure/templates/configure-kk.yaml
index 5d1d7f15..69c07ed6 100644
--- a/packages/system/keycloak-configure/templates/configure-kk.yaml
+++ b/packages/system/keycloak-configure/templates/configure-kk.yaml
@@ -37,6 +37,15 @@ spec:
   displayHtmlName: {{ $brandingConfig.branding }}
   {{- end }}
   {{- end }}
+  {{- if or .Values.login.userRegistration .Values.login.verifyEmail }}
+  login:
+    userRegistration: {{ .Values.login.userRegistration }}
+    verifyEmail: {{ .Values.login.verifyEmail }}
+  {{- end }}
+  {{- with .Values.smtp }}
+  smtp:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   sessions:
     ssoSessionSettings:
       idleTimeout: 86400
diff --git a/packages/system/keycloak-configure/values.yaml b/packages/system/keycloak-configure/values.yaml
new file mode 100644
index 00000000..e4df2c17
--- /dev/null
+++ b/packages/system/keycloak-configure/values.yaml
@@ -0,0 +1,23 @@
+login:
+  userRegistration: false
+  verifyEmail: false
+
+smtp: {}
+#  template:
+#    from: "noreply@example.com"
+#    fromDisplayName: ""
+#    replyTo: ""
+#    replyToDisplayName: ""
+#    envelopeFrom: ""
+#  connection:
+#    host: "smtp.example.com"
+#    port: 587
+#    enableSSL: false
+#    enableStartTLS: true
+#    authentication:
+#      username:
+#        value: "user"
+#      password:
+#        secretKeyRef:
+#          name: "smtp-credentials"
+#          key: "password"

From 3828ea443ce594745fae32e63f2f6167d978b7f0 Mon Sep 17 00:00:00 2001
From: Artem Bortnikov <brongineer747@gmail.com>
Date: Wed, 1 Apr 2026 00:24:39 +0100
Subject: [PATCH 371/666] chore: following the review

Signed-off-by: Artem Bortnikov <brongineer747@gmail.com>
---
 .../system/keycloak-configure/templates/configure-kk.yaml    | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/packages/system/keycloak-configure/templates/configure-kk.yaml b/packages/system/keycloak-configure/templates/configure-kk.yaml
index 69c07ed6..a5683957 100644
--- a/packages/system/keycloak-configure/templates/configure-kk.yaml
+++ b/packages/system/keycloak-configure/templates/configure-kk.yaml
@@ -37,10 +37,9 @@ spec:
   displayHtmlName: {{ $brandingConfig.branding }}
   {{- end }}
   {{- end }}
-  {{- if or .Values.login.userRegistration .Values.login.verifyEmail }}
+  {{- with .Values.login }}
   login:
-    userRegistration: {{ .Values.login.userRegistration }}
-    verifyEmail: {{ .Values.login.verifyEmail }}
+    {{- toYaml . | nindent 4 }}
   {{- end }}
   {{- with .Values.smtp }}
   smtp:

From 16223dcffa3da6ef1a3f590b61abd3974ac4750a Mon Sep 17 00:00:00 2001
From: Andrey Kolkov <androndo@gmail.com>
Date: Wed, 1 Apr 2026 18:40:23 +0400
Subject: [PATCH 372/666] fix(backup): abstract underlying resources by
 applicationRef.kind

Signed-off-by: Andrey Kolkov <androndo@gmail.com>
---
 api/backups/v1alpha1/backup_types.go          |  28 +---
 api/backups/v1alpha1/zz_generated.deepcopy.go |  21 +--
 .../velerostrategy_controller.go              | 136 ++++++++++--------
 .../backups.cozystack.io_backups.yaml         |  25 +---
 4 files changed, 93 insertions(+), 117 deletions(-)

diff --git a/api/backups/v1alpha1/backup_types.go b/api/backups/v1alpha1/backup_types.go
index 5859d592..e46212f6 100644
--- a/api/backups/v1alpha1/backup_types.go
+++ b/api/backups/v1alpha1/backup_types.go
@@ -81,24 +81,6 @@ type DataVolumeResource struct {
 	ApplicationName string `json:"applicationName"`
 }
 
-// UnderlyingResources contains information about resources associated with the
-// backed-up application that were discovered at backup time (e.g., VM disks,
-// network configuration). This data is used during restore to correctly
-// reconstruct the application's environment.
-type UnderlyingResources struct {
-	// DataVolumes lists the dataVolume resources used by the application.
-	// +optional
-	DataVolumes []DataVolumeResource `json:"dataVolumes,omitempty"`
-
-	// IP is the OVN IP address assigned to the application at backup time.
-	// +optional
-	IP string `json:"ip,omitempty"`
-
-	// MAC is the OVN MAC address assigned to the application at backup time.
-	// +optional
-	MAC string `json:"mac,omitempty"`
-}
-
 // BackupStatus represents the observed state of a Backup.
 type BackupStatus struct {
 	// Phase is a simple, high-level summary of the backup's state.
@@ -110,10 +92,14 @@ type BackupStatus struct {
 	// +optional
 	Artifact *BackupArtifact `json:"artifact,omitempty"`
 
-	// UnderlyingResources contains information about underlying resources
-	// discovered during backup (e.g., VM disks, IP/MAC addresses).
+	// UnderlyingResources holds application-specific resource metadata discovered
+	// during backup (e.g., VM disks, network configuration). The payload is a
+	// self-typed JSON object carrying an inlined TypeMeta (kind/apiVersion) so
+	// the consuming controller can dispatch on the application kind.
 	// +optional
-	UnderlyingResources *UnderlyingResources `json:"underlyingResources,omitempty"`
+	// +kubebuilder:pruning:PreserveUnknownFields
+	// +kubebuilder:validation:Type=object
+	UnderlyingResources *runtime.RawExtension `json:"underlyingResources,omitempty"`
 
 	// Conditions represents the latest available observations of a Backup's state.
 	// +optional
diff --git a/api/backups/v1alpha1/zz_generated.deepcopy.go b/api/backups/v1alpha1/zz_generated.deepcopy.go
index 7b5ab25b..b7387772 100644
--- a/api/backups/v1alpha1/zz_generated.deepcopy.go
+++ b/api/backups/v1alpha1/zz_generated.deepcopy.go
@@ -386,7 +386,7 @@ func (in *BackupStatus) DeepCopyInto(out *BackupStatus) {
 	}
 	if in.UnderlyingResources != nil {
 		in, out := &in.UnderlyingResources, &out.UnderlyingResources
-		*out = new(UnderlyingResources)
+		*out = new(runtime.RawExtension)
 		(*in).DeepCopyInto(*out)
 	}
 	if in.Conditions != nil {
@@ -646,22 +646,3 @@ func (in *RestoreJobStatus) DeepCopy() *RestoreJobStatus {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *UnderlyingResources) DeepCopyInto(out *UnderlyingResources) {
-	*out = *in
-	if in.DataVolumes != nil {
-		in, out := &in.DataVolumes, &out.DataVolumes
-		*out = make([]DataVolumeResource, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UnderlyingResources.
-func (in *UnderlyingResources) DeepCopy() *UnderlyingResources {
-	if in == nil {
-		return nil
-	}
-	out := new(UnderlyingResources)
-	in.DeepCopyInto(out)
-	return out
-}
diff --git a/internal/backupcontroller/velerostrategy_controller.go b/internal/backupcontroller/velerostrategy_controller.go
index 5ff3348a..d5c330ae 100644
--- a/internal/backupcontroller/velerostrategy_controller.go
+++ b/internal/backupcontroller/velerostrategy_controller.go
@@ -16,6 +16,7 @@ import (
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -74,6 +75,41 @@ func stringPtr(s string) *string {
 	return &s
 }
 
+// vmInstanceResources contains VM-specific underlying resources discovered during backup.
+type vmInstanceResources struct {
+	DataVolumes []backupsv1alpha1.DataVolumeResource `json:"dataVolumes,omitempty"`
+	IP          string                                `json:"ip,omitempty"`
+	MAC         string                                `json:"mac,omitempty"`
+}
+
+// marshalUnderlyingResources serializes application-specific data into a
+// runtime.RawExtension suitable for Backup.Status.UnderlyingResources.
+func marshalUnderlyingResources(data interface{}) (*runtime.RawExtension, error) {
+	raw, err := json.Marshal(data)
+	if err != nil {
+		return nil, err
+	}
+	return &runtime.RawExtension{Raw: raw}, nil
+}
+
+// getVMInstanceResources extracts VMInstance-specific resources from the opaque blob.
+// The caller is responsible for checking that the application kind is VMInstance
+// (via backup.Spec.ApplicationRef.Kind) before calling this function.
+// Returns nil if ur is nil or has no VM-specific data.
+func getVMInstanceResources(ur *runtime.RawExtension) *vmInstanceResources {
+	if ur == nil || len(ur.Raw) == 0 {
+		return nil
+	}
+	var res vmInstanceResources
+	if err := json.Unmarshal(ur.Raw, &res); err != nil {
+		return nil
+	}
+	if len(res.DataVolumes) == 0 && res.IP == "" && res.MAC == "" {
+		return nil
+	}
+	return &res
+}
+
 func (r *BackupJobReconciler) reconcileVelero(ctx context.Context, j *backupsv1alpha1.BackupJob, resolved *ResolvedBackupConfig) (ctrl.Result, error) {
 	logger := getLogger(ctx)
 	logger.Debug("reconciling Velero strategy", "backupjob", j.Name, "phase", j.Status.Phase)
@@ -218,10 +254,10 @@ func (r *BackupJobReconciler) reconcileVelero(ctx context.Context, j *backupsv1a
 	return ctrl.Result{RequeueAfter: 5 * time.Second}, nil
 }
 
-// collectUnderlyingResources discovers resources associated with a VM application
-// (dataVolumes, IP/MAC addresses) that need to be backed up and restored.
-// Returns nil if the application is not a VM type or has no underlying resources.
-func (r *BackupJobReconciler) collectUnderlyingResources(ctx context.Context, app *unstructured.Unstructured, appKind, ns string) (*backupsv1alpha1.UnderlyingResources, error) {
+// collectUnderlyingResources discovers resources associated with an application
+// that need to be backed up and restored. Returns a map keyed by application kind.
+// Returns nil if the application type has no underlying resources to collect.
+func (r *BackupJobReconciler) collectUnderlyingResources(ctx context.Context, app *unstructured.Unstructured, appKind, ns string) (*runtime.RawExtension, error) {
 	logger := getLogger(ctx)
 
 	if appKind != vmInstanceKind {
@@ -281,11 +317,11 @@ func (r *BackupJobReconciler) collectUnderlyingResources(ctx context.Context, ap
 		return nil, nil
 	}
 
-	return &backupsv1alpha1.UnderlyingResources{
+	return marshalUnderlyingResources(vmInstanceResources{
 		DataVolumes: dataVolumes,
 		IP:          ip,
 		MAC:         mac,
-	}, nil
+	})
 }
 
 func (r *BackupJobReconciler) createVeleroBackup(ctx context.Context, backupJob *backupsv1alpha1.BackupJob, strategy *strategyv1alpha1.Velero, resolved *ResolvedBackupConfig) error {
@@ -323,8 +359,8 @@ func (r *BackupJobReconciler) createVeleroBackup(ctx context.Context, backupJob
 	}
 
 	// Add label selectors for underlying VMDisk HelmReleases
-	if underlyingResources != nil {
-		for _, dv := range underlyingResources.DataVolumes {
+	if vmRes := getVMInstanceResources(underlyingResources); vmRes != nil {
+		for _, dv := range vmRes.DataVolumes {
 			veleroBackupSpec.OrLabelSelectors = append(veleroBackupSpec.OrLabelSelectors, &metav1.LabelSelector{
 				MatchLabels: map[string]string{
 					appKindLabel: vmDiskAppKind,
@@ -332,20 +368,15 @@ func (r *BackupJobReconciler) createVeleroBackup(ctx context.Context, backupJob
 				},
 			})
 		}
-		if len(underlyingResources.DataVolumes) > 0 {
-			logger.Debug("added VMDisk label selectors to Velero backup", "count", len(underlyingResources.DataVolumes))
+		if len(vmRes.DataVolumes) > 0 {
+			logger.Debug("added VMDisk label selectors to Velero backup", "count", len(vmRes.DataVolumes))
 		}
 	}
 
 	// Serialize underlying resources as annotation to persist across reconcile cycles
 	annotations := map[string]string{}
-	if underlyingResources != nil {
-		urJSON, err := json.Marshal(underlyingResources)
-		if err != nil {
-			logger.Error(err, "failed to marshal underlying resources annotation")
-		} else {
-			annotations[underlyingResourcesAnnotation] = string(urJSON)
-		}
+	if underlyingResources != nil && len(underlyingResources.Raw) > 0 {
+		annotations[underlyingResourcesAnnotation] = string(underlyingResources.Raw)
 	}
 
 	veleroBackup := &velerov1.Backup{
@@ -400,13 +431,9 @@ func (r *BackupJobReconciler) createBackupResource(ctx context.Context, backupJo
 	}
 
 	// Read underlying resources from Velero Backup annotation
-	var underlyingResources *backupsv1alpha1.UnderlyingResources
+	var underlyingResources *runtime.RawExtension
 	if urJSON, ok := veleroBackup.Annotations[underlyingResourcesAnnotation]; ok && urJSON != "" {
-		underlyingResources = &backupsv1alpha1.UnderlyingResources{}
-		if err := json.Unmarshal([]byte(urJSON), underlyingResources); err != nil {
-			logger.Error(err, "failed to unmarshal underlying resources from Velero Backup annotation")
-			underlyingResources = nil
-		}
+		underlyingResources = &runtime.RawExtension{Raw: []byte(urJSON)}
 	}
 
 	// Note: No OwnerReferences set on Backup. The Backup must survive BackupJob deletion
@@ -498,8 +525,11 @@ func (r *RestoreJobReconciler) reconcileVeleroRestore(ctx context.Context, resto
 	}
 
 	if len(veleroRestoreList.Items) == 0 {
+		// Resolve underlying resources once; prefer Backup status, fall back to Velero annotation.
+		ur := r.resolveUnderlyingResourcesForRestore(ctx, backup, veleroBackupName)
+
 		// Pre-restore: graceful shutdown, suspend HRs, rename PVCs
-		ready, result, err := r.prepareForRestore(ctx, restoreJob, backup)
+		ready, result, err := r.prepareForRestore(ctx, restoreJob, backup, ur)
 		if err != nil {
 			return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf("pre-restore preparation failed: %v", err))
 		}
@@ -510,7 +540,7 @@ func (r *RestoreJobReconciler) reconcileVeleroRestore(ctx context.Context, resto
 
 		// Create Velero Restore
 		logger.Debug("Velero Restore not found, creating new one")
-		if err := r.createVeleroRestore(ctx, restoreJob, backup, veleroStrategy, veleroBackupName); err != nil {
+		if err := r.createVeleroRestore(ctx, restoreJob, backup, veleroStrategy, veleroBackupName, ur); err != nil {
 			logger.Error(err, "failed to create Velero Restore")
 			return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf("failed to create Velero Restore: %v", err))
 		}
@@ -597,10 +627,9 @@ func marshalPatchData(v interface{}) (string, error) {
 //   - PVC adoption: always adds cdi.kubevirt.io/allowClaimAdoption=true to all
 //     restored PVCs so CDI can adopt them when a HelmRelease of VMDisk recreates a DV.
 //   - OVN IP/MAC: sets OVN annotations on the VirtualMachine for correct ssh access to restored VM.
-func (r *RestoreJobReconciler) createResourceModifiersConfigMap(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup) (*corev1.ConfigMap, error) {
+func (r *RestoreJobReconciler) createResourceModifiersConfigMap(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, ur *runtime.RawExtension) (*corev1.ConfigMap, error) {
 	logger := getLogger(ctx)
 
-	ur := backup.Status.UnderlyingResources
 	targetNS := backup.Namespace
 
 	var rules []resourceModifierRule
@@ -626,13 +655,13 @@ func (r *RestoreJobReconciler) createResourceModifiersConfigMap(ctx context.Cont
 	})
 
 	// OVN IP/MAC annotations on VirtualMachine for correct network identity after restore.
-	if ur != nil && (ur.IP != "" || ur.MAC != "") {
+	if vmRes := getVMInstanceResources(ur); vmRes != nil && (vmRes.IP != "" || vmRes.MAC != "") {
 		ovnAnnotations := map[string]string{}
-		if ur.IP != "" {
-			ovnAnnotations[ovnIPAnnotation] = ur.IP
+		if vmRes.IP != "" {
+			ovnAnnotations[ovnIPAnnotation] = vmRes.IP
 		}
-		if ur.MAC != "" {
-			ovnAnnotations[ovnMACAnnotation] = ur.MAC
+		if vmRes.MAC != "" {
+			ovnAnnotations[ovnMACAnnotation] = vmRes.MAC
 		}
 		vmPatch, err := marshalPatchData(map[string]interface{}{
 			"spec": map[string]interface{}{
@@ -706,11 +735,11 @@ func (r *RestoreJobReconciler) createResourceModifiersConfigMap(ctx context.Cont
 	return cm, nil
 }
 
-// resolveUnderlyingResourcesForRestore returns disk (and network) metadata for symmetric
+// resolveUnderlyingResourcesForRestore returns underlying resources for symmetric
 // restore label selectors. Velero Backup annotation is used when Backup.status was empty
 // (e.g. CRD without underlyingResources in schema).
-func (r *RestoreJobReconciler) resolveUnderlyingResourcesForRestore(ctx context.Context, backup *backupsv1alpha1.Backup, veleroBackupName string) *backupsv1alpha1.UnderlyingResources {
-	if backup.Status.UnderlyingResources != nil && len(backup.Status.UnderlyingResources.DataVolumes) > 0 {
+func (r *RestoreJobReconciler) resolveUnderlyingResourcesForRestore(ctx context.Context, backup *backupsv1alpha1.Backup, veleroBackupName string) *runtime.RawExtension {
+	if backup.Status.UnderlyingResources != nil && len(backup.Status.UnderlyingResources.Raw) > 0 {
 		return backup.Status.UnderlyingResources
 	}
 	vb := &velerov1.Backup{}
@@ -718,11 +747,7 @@ func (r *RestoreJobReconciler) resolveUnderlyingResourcesForRestore(ctx context.
 		return backup.Status.UnderlyingResources
 	}
 	if urJSON, ok := vb.Annotations[underlyingResourcesAnnotation]; ok && urJSON != "" {
-		ur := &backupsv1alpha1.UnderlyingResources{}
-		if err := json.Unmarshal([]byte(urJSON), ur); err != nil {
-			return backup.Status.UnderlyingResources
-		}
-		return ur
+		return &runtime.RawExtension{Raw: []byte(urJSON)}
 	}
 	return backup.Status.UnderlyingResources
 }
@@ -755,19 +780,20 @@ func shortHash(input string) string {
 //
 // Returns true when preparation is complete and the Velero Restore can be created.
 // Returns false (with a requeue) when still waiting for VM shutdown.
-func (r *RestoreJobReconciler) prepareForRestore(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup) (ready bool, result ctrl.Result, err error) {
+func (r *RestoreJobReconciler) prepareForRestore(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, ur *runtime.RawExtension) (ready bool, result ctrl.Result, err error) {
 	ns := restoreJob.Namespace
 	appName := backup.Spec.ApplicationRef.Name
 	appKind := backup.Spec.ApplicationRef.Kind
 	origSuffix := "-orig-" + shortHash(restoreJob.Name)
 
 	// --- Step 1: Suspend HelmReleases ---
+	vmRes := getVMInstanceResources(ur)
 	hrNames := []string{}
 	if appKind == vmInstanceKind {
 		hrNames = append(hrNames, vmNamePrefix+appName)
 	}
-	if backup.Status.UnderlyingResources != nil {
-		for _, dv := range backup.Status.UnderlyingResources.DataVolumes {
+	if vmRes != nil {
+		for _, dv := range vmRes.DataVolumes {
 			hrNames = append(hrNames, dv.DataVolumeName)
 		}
 	}
@@ -802,8 +828,8 @@ func (r *RestoreJobReconciler) prepareForRestore(ctx context.Context, restoreJob
 	// --- Step 3: Rename PVCs to <name>-orig-<hash> ---
 	// Must happen BEFORE deleting DVs: the PVC has an ownerReference to the DV,
 	// so deleting the DV first would cascade-delete the PVC via garbage collection.
-	if backup.Status.UnderlyingResources != nil {
-		for _, dv := range backup.Status.UnderlyingResources.DataVolumes {
+	if vmRes != nil {
+		for _, dv := range vmRes.DataVolumes {
 			if err := r.renamePVC(ctx, restoreJob, ns, dv.DataVolumeName, dv.DataVolumeName+origSuffix); err != nil {
 				r.Recorder.Event(restoreJob, corev1.EventTypeWarning, "PrepareForRestore",
 					fmt.Sprintf("Failed to keep old PVC %s: %v", dv.DataVolumeName, err))
@@ -812,8 +838,8 @@ func (r *RestoreJobReconciler) prepareForRestore(ctx context.Context, restoreJob
 	}
 
 	// --- Step 4: Delete DataVolumes so CDI doesn't recreate PVCs ---
-	if backup.Status.UnderlyingResources != nil {
-		for _, dv := range backup.Status.UnderlyingResources.DataVolumes {
+	if vmRes != nil {
+		for _, dv := range vmRes.DataVolumes {
 			if err := r.deleteDataVolume(ctx, ns, dv.DataVolumeName); err != nil {
 				r.Recorder.Event(restoreJob, corev1.EventTypeWarning, "PrepareForRestore",
 					fmt.Sprintf("Failed to delete DataVolume %s: %v", dv.DataVolumeName, err))
@@ -978,7 +1004,7 @@ func (r *RestoreJobReconciler) renamePVC(ctx context.Context, restoreJob *backup
 }
 
 // createVeleroRestore creates a Velero Restore resource.
-func (r *RestoreJobReconciler) createVeleroRestore(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, strategy *strategyv1alpha1.Velero, veleroBackupName string) error {
+func (r *RestoreJobReconciler) createVeleroRestore(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, strategy *strategyv1alpha1.Velero, veleroBackupName string, ur *runtime.RawExtension) error {
 	logger := getLogger(ctx)
 	logger.Debug("createVeleroRestore called", "strategy", strategy.Name, "veleroBackupName", veleroBackupName)
 
@@ -1009,11 +1035,9 @@ func (r *RestoreJobReconciler) createVeleroRestore(ctx context.Context, restoreJ
 	veleroRestoreSpec.BackupName = veleroBackupName
 
 	// Match backup: add OR selectors for each underlying VMDisk so restore applies the same
-	// scope as the intended backup (see createVeleroBackup). Prefer Backup status; fall back
-	// to Velero Backup annotation when status was pruned by an older CRD.
-	ur := r.resolveUnderlyingResourcesForRestore(ctx, backup, veleroBackupName)
-	if ur != nil {
-		for _, dv := range ur.DataVolumes {
+	// scope as the intended backup (see createVeleroBackup).
+	if vmRes := getVMInstanceResources(ur); vmRes != nil {
+		for _, dv := range vmRes.DataVolumes {
 			veleroRestoreSpec.OrLabelSelectors = append(veleroRestoreSpec.OrLabelSelectors, &metav1.LabelSelector{
 				MatchLabels: map[string]string{
 					appKindLabel: vmDiskAppKind,
@@ -1021,13 +1045,13 @@ func (r *RestoreJobReconciler) createVeleroRestore(ctx context.Context, restoreJ
 				},
 			})
 		}
-		if len(ur.DataVolumes) > 0 {
-			logger.Debug("added VMDisk label selectors to Velero restore", "count", len(ur.DataVolumes))
+		if len(vmRes.DataVolumes) > 0 {
+			logger.Debug("added VMDisk label selectors to Velero restore", "count", len(vmRes.DataVolumes))
 		}
 	}
 
 	// Create resourceModifiers ConfigMap
-	resourceModifierCM, err := r.createResourceModifiersConfigMap(ctx, restoreJob, backup)
+	resourceModifierCM, err := r.createResourceModifiersConfigMap(ctx, restoreJob, backup, ur)
 	if err != nil {
 		return fmt.Errorf("failed to create resourceModifiers ConfigMap: %w", err)
 	}
diff --git a/packages/system/backup-controller/definitions/backups.cozystack.io_backups.yaml b/packages/system/backup-controller/definitions/backups.cozystack.io_backups.yaml
index 76d8a477..6e031a84 100644
--- a/packages/system/backup-controller/definitions/backups.cozystack.io_backups.yaml
+++ b/packages/system/backup-controller/definitions/backups.cozystack.io_backups.yaml
@@ -144,27 +144,12 @@ spec:
                 type: object
               underlyingResources:
                 description: |-
-                  UnderlyingResources contains information about underlying resources
-                  discovered during backup (e.g., VM disks, IP/MAC addresses).
-                properties:
-                  dataVolumes:
-                    items:
-                      properties:
-                        applicationName:
-                          description: Cozystack application name for this disk (e.g. ubuntu-source).
-                          type: string
-                        dataVolumeName:
-                          description: Name of the DataVolume/PVC (e.g. vm-disk-ubuntu-source).
-                          type: string
-                      type: object
-                    type: array
-                  ip:
-                    description: OVN IP address assigned to the application at backup time.
-                    type: string
-                  mac:
-                    description: OVN MAC address assigned to the application at backup time.
-                    type: string
+                  Holds application-specific resource metadata discovered during backup.
+                  The payload is a self-typed JSON object carrying an inlined TypeMeta
+                  (kind/apiVersion) so the consuming controller can dispatch on the
+                  application kind.
                 type: object
+                x-kubernetes-preserve-unknown-fields: true
               conditions:
                 description: Conditions represents the latest available observations
                   of a Backup's state.

From 3e41bd1c563f3559c21c5fa2efa2d76ea6402026 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Wed, 1 Apr 2026 22:32:08 +0200
Subject: [PATCH 373/666] docs: add OpenSSF Best Practices badge to README

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 README.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index b81af2a7..dc1b0634 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,8 @@
 [![Support](https://img.shields.io/badge/$-support-12a0df.svg?style=flat)](https://cozystack.io/support/)
 [![Active](http://img.shields.io/badge/Status-Active-green.svg)](https://github.com/cozystack/cozystack)
 [![GitHub Release](https://img.shields.io/github/release/cozystack/cozystack.svg?style=flat)](https://github.com/cozystack/cozystack/releases/latest)
-[![GitHub Commit](https://img.shields.io/github/commit-activity/y/cozystack/cozystack)](https://github.com/cozystack/cozystack/graphs/contributors) 
+[![GitHub Commit](https://img.shields.io/github/commit-activity/y/cozystack/cozystack)](https://github.com/cozystack/cozystack/graphs/contributors)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/10177/badge)](https://www.bestpractices.dev/projects/10177)
 
 # Cozystack
 

From cdfcd61c1bd43d52f7faa9bd7f1ec1b3d6966a19 Mon Sep 17 00:00:00 2001
From: Timofei Larkin <lllamnyp@gmail.com>
Date: Thu, 2 Apr 2026 19:29:54 +0300
Subject: [PATCH 374/666] [keycloak-configure] Make values.yaml
 self-documenting

Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
---
 .../system/keycloak-configure/values.yaml     | 60 ++++++++++++-------
 1 file changed, 38 insertions(+), 22 deletions(-)

diff --git a/packages/system/keycloak-configure/values.yaml b/packages/system/keycloak-configure/values.yaml
index e4df2c17..0b4fa03c 100644
--- a/packages/system/keycloak-configure/values.yaml
+++ b/packages/system/keycloak-configure/values.yaml
@@ -1,23 +1,39 @@
-login:
-  userRegistration: false
-  verifyEmail: false
+# login:
+#   userRegistration: false
+#   verifyEmail: false
+#   duplicateEmails: false
+#   editUsername: false
+#   emailAsUsername: false
+#   forgotPassword: false
+#   loginWithEmail: true
+#   rememberMe: false
 
-smtp: {}
-#  template:
-#    from: "noreply@example.com"
-#    fromDisplayName: ""
-#    replyTo: ""
-#    replyToDisplayName: ""
-#    envelopeFrom: ""
-#  connection:
-#    host: "smtp.example.com"
-#    port: 587
-#    enableSSL: false
-#    enableStartTLS: true
-#    authentication:
-#      username:
-#        value: "user"
-#      password:
-#        secretKeyRef:
-#          name: "smtp-credentials"
-#          key: "password"
+# smtp:
+#   template:
+#     from: "noreply@example.com"
+#     fromDisplayName: ""
+#     replyTo: ""
+#     replyToDisplayName: ""
+#     envelopeFrom: ""
+#   connection:
+#     host: "smtp.example.com"
+#     port: 587
+#     enableSSL: false
+#     enableStartTLS: true
+#     authentication:
+#       username:
+#         value: "user"
+#         # secretKeyRef:
+#         #   name: "secret-name"
+#         #   key: "key"
+#         # configMapKeyRef:
+#         #   name: "configmap-name"
+#         #   key: "key"
+#       password:
+#         secretKeyRef:
+#           name: "smtp-credentials"
+#           key: "password"
+#         # value: "plaintext-password"
+#         # configMapKeyRef:
+#         #   name: "configmap-name"
+#         #   key: "key"

From 959ba4013741c6ba0b8f751ecbb1d6d19bfdae0d Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 2 Apr 2026 18:52:25 +0200
Subject: [PATCH 375/666] docs(changelog): add deprecation warning to v1.2.0

CNPG operator in v1.2.0 updates default PostgreSQL image to v18
and cannot migrate from the previous major version automatically,
causing PostgreSQL clusters to fail after upgrade.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 docs/changelogs/v1.2.0.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/changelogs/v1.2.0.md b/docs/changelogs/v1.2.0.md
index 7624f0c4..8e0a0ff5 100644
--- a/docs/changelogs/v1.2.0.md
+++ b/docs/changelogs/v1.2.0.md
@@ -4,6 +4,8 @@ https://github.com/cozystack/cozystack/releases/tag/v1.2.0
 
 # Cozystack v1.2.0
 
+> **⚠️ WARNING: Do not use this release.** This version includes CloudNativePG operator, which updates the default PostgreSQL image to version 18. CNPG is unable to perform the migration from the previous major version automatically, which will cause PostgreSQL clusters to fail to start after the upgrade. Please use [v1.2.1](v1.2.1.md) instead.
+
 Cozystack v1.2.0 delivers significant platform enhancements: a fully managed **OpenSearch** service joining the application catalog, **VPC peering** for secure inter-tenant networking, tenant workload placement control via the new **SchedulingClass** system, a highly-available **VictoriaLogs cluster** replacing the single-node setup, and **Linstor volume relocation** for optimized clone and snapshot restore placement. Additional highlights include external-dns as a standalone extra package, multi-node RWX volume fixes, and a wave of dashboard and monitoring improvements.
 
 ## Feature Highlights

From 94223327fe6ec792bf8e4b78edc95baed625c037 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 31 Mar 2026 14:59:27 +0200
Subject: [PATCH 376/666] Release v1.2.1 (#2306)

This PR prepares the release `v1.2.1`.
---
 packages/core/installer/values.yaml                         | 4 ++--
 packages/core/platform/values.yaml                          | 2 +-
 packages/core/testing/values.yaml                           | 2 +-
 packages/extra/bootbox/images/matchbox.tag                  | 2 +-
 packages/extra/seaweedfs/images/objectstorage-sidecar.tag   | 2 +-
 packages/system/backup-controller/values.yaml               | 2 +-
 packages/system/backupstrategy-controller/values.yaml       | 2 +-
 packages/system/cozystack-api/values.yaml                   | 2 +-
 packages/system/cozystack-controller/values.yaml            | 2 +-
 packages/system/dashboard/templates/configmap.yaml          | 2 +-
 packages/system/dashboard/values.yaml                       | 6 +++---
 .../system/grafana-operator/images/grafana-dashboards.tag   | 2 +-
 packages/system/kamaji/values.yaml                          | 4 ++--
 packages/system/kubeovn-plunger/values.yaml                 | 2 +-
 packages/system/kubeovn-webhook/values.yaml                 | 2 +-
 packages/system/lineage-controller-webhook/values.yaml      | 2 +-
 packages/system/linstor/values.yaml                         | 4 ++--
 packages/system/multus/templates/multus-daemonset-thick.yml | 4 ++--
 packages/system/objectstorage-controller/values.yaml        | 2 +-
 packages/system/seaweedfs/values.yaml                       | 2 +-
 20 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/packages/core/installer/values.yaml b/packages/core/installer/values.yaml
index 13c8fd4e..98443211 100644
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -1,9 +1,9 @@
 cozystackOperator:
   # Deployment variant: talos, generic, hosted
   variant: talos
-  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.2.0@sha256:dbc0cbd99dbc2405769bed0d33d5e5d3f53e79e0269ad9ddaa26d9eebbcc6da2
+  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.2.1@sha256:c89352808022944c4791d63cf82cc95d78124ce799d355b60427f317087e8909
   platformSourceUrl: 'oci://ghcr.io/cozystack/cozystack/cozystack-packages'
-  platformSourceRef: 'digest=sha256:c659905000e8279d32965169cde0817e16a5b46f81d305a3606defcd5446abae'
+  platformSourceRef: 'digest=sha256:d02f211f79d4912f04c21856de078b5b41bb3976d84504d37cf8d9108f7cbec6'
 # Generic variant configuration (only used when cozystackOperator.variant=generic)
 cozystack:
   # Kubernetes API server host (IP only, no protocol/port)
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index c9af0e5e..a2c97d8c 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -5,7 +5,7 @@ sourceRef:
   path: /
 migrations:
   enabled: false
-  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.2.0@sha256:3a3d8cfa4323d8023b7c7800d8b552b250bc2de01ca7550fd024a10b12324f6d
+  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.2.1@sha256:e8fcf006a4451fc0e961455e9b27a61b7103ee49b1a81fe5e4662ffed093fad6
   targetVersion: 37
 # Bundle deployment configuration
 bundles:
diff --git a/packages/core/testing/values.yaml b/packages/core/testing/values.yaml
index 8a1887bd..b17da614 100644
--- a/packages/core/testing/values.yaml
+++ b/packages/core/testing/values.yaml
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.2.0@sha256:7964a3e4b11053887be201d62f94138c3a7836c861036c26fb833aa1fcb934e1
+  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.2.1@sha256:7964a3e4b11053887be201d62f94138c3a7836c861036c26fb833aa1fcb934e1
diff --git a/packages/extra/bootbox/images/matchbox.tag b/packages/extra/bootbox/images/matchbox.tag
index 67beab8c..0ba57d47 100644
--- a/packages/extra/bootbox/images/matchbox.tag
+++ b/packages/extra/bootbox/images/matchbox.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/matchbox:v1.2.0@sha256:313f36db2e8b9dea0cd1a80d73f27a0694e996631d430bbd1b8391fbb9859020
+ghcr.io/cozystack/cozystack/matchbox:v1.2.1@sha256:64685523ba693964f22ce7d7dc545bf7bf96dea34e5ae525a2315614adef4b3d
diff --git a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
index b4262b02..bb0702e8 100644
--- a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
+++ b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.2.0@sha256:b508ca451c6051b64e71cedd6209c80ac0e0bea8aa6bb47e838ec9d99bf4796a
+ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.2.1@sha256:1ad07fb9e96477e5c322f240f6023ceedd8762261d8379ec784dde92797ee206
diff --git a/packages/system/backup-controller/values.yaml b/packages/system/backup-controller/values.yaml
index a868fba0..ff5fe774 100644
--- a/packages/system/backup-controller/values.yaml
+++ b/packages/system/backup-controller/values.yaml
@@ -1,5 +1,5 @@
 backupController:
-  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.2.0@sha256:07bcd89bd725951801870d819f0fc536705069608f0fe5c20617607af6f8a61a"
+  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.2.1@sha256:6e515cdfe302bb079dafa0f7f302c6ff7b7e9c02a75574880a45e35d5acb1f59"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/backupstrategy-controller/values.yaml b/packages/system/backupstrategy-controller/values.yaml
index 39466430..bd3cad8c 100644
--- a/packages/system/backupstrategy-controller/values.yaml
+++ b/packages/system/backupstrategy-controller/values.yaml
@@ -1,5 +1,5 @@
 backupStrategyController:
-  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.2.0@sha256:0039ec58f531faf5a5ba3f70993c2c71d74dae4cc8e8e83bd21d2cc2adf10d8a"
+  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.2.1@sha256:3544a08bfac2df6dcb1842f73747768b24625c6d6b97230be9a00f80637f0d32"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/cozystack-api/values.yaml b/packages/system/cozystack-api/values.yaml
index cafd81c9..ca4cf5e2 100644
--- a/packages/system/cozystack-api/values.yaml
+++ b/packages/system/cozystack-api/values.yaml
@@ -1,3 +1,3 @@
 cozystackAPI:
-  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.2.0@sha256:b40ba5c87bb625d646dd69075d21dcc1aca18775b3de8e63d04466d60d42cee5
+  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.2.1@sha256:afcc72ec5b8ff6eea7fbf927d518f277a7bfead44948f45ed17eda90d47253d5
   replicas: 2
diff --git a/packages/system/cozystack-controller/values.yaml b/packages/system/cozystack-controller/values.yaml
index ab64e34d..030a4564 100644
--- a/packages/system/cozystack-controller/values.yaml
+++ b/packages/system/cozystack-controller/values.yaml
@@ -1,4 +1,4 @@
 cozystackController:
-  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.2.0@sha256:f56c8222411fed890331502939c8d4c5700489e697da39e8e46896cf674cce71
+  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.2.1@sha256:0b1d49b29e8860f13f7afc8d7b6265f36c9d24d6ad7c40f5164535dd8e933c73
   debug: false
   disableTelemetry: false
diff --git a/packages/system/dashboard/templates/configmap.yaml b/packages/system/dashboard/templates/configmap.yaml
index 69541202..d260c5d9 100644
--- a/packages/system/dashboard/templates/configmap.yaml
+++ b/packages/system/dashboard/templates/configmap.yaml
@@ -1,6 +1,6 @@
 {{- $brandingConfig := .Values._cluster.branding | default dict }}
 
-{{- $tenantText := "v1.2.0" }}
+{{- $tenantText := "v1.2.1" }}
 {{- $footerText := "Cozystack" }}
 {{- $titleText := "Cozystack Dashboard" }}
 {{- $logoText := "" }}
diff --git a/packages/system/dashboard/values.yaml b/packages/system/dashboard/values.yaml
index 5246eb1c..1aa69b09 100644
--- a/packages/system/dashboard/values.yaml
+++ b/packages/system/dashboard/values.yaml
@@ -1,6 +1,6 @@
 openapiUI:
-  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.2.0@sha256:bf68676a809be8b37ae3ab7416b2ae3185a4efa216b8b09358d916df081d0a3e
+  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.2.1@sha256:a77c502c4b67fa5f0698f66a82eb2ad30e138f9bd2700aa40a63f73cb86a559d
 openapiUIK8sBff:
-  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.2.0@sha256:89b5c62df0ed9a1984023ba909765e4b60af3f9a61e42ebdd67437d71ebbb645
+  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.2.1@sha256:1b3ea6d4c7dbbe6a8def3b2807fffdfab2ac4afc39d7a846e57dd491fa168f92
 tokenProxy:
-  image: ghcr.io/cozystack/cozystack/token-proxy:v1.2.0@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
+  image: ghcr.io/cozystack/cozystack/token-proxy:v1.2.1@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
diff --git a/packages/system/grafana-operator/images/grafana-dashboards.tag b/packages/system/grafana-operator/images/grafana-dashboards.tag
index 60839fd4..08f6bd0b 100644
--- a/packages/system/grafana-operator/images/grafana-dashboards.tag
+++ b/packages/system/grafana-operator/images/grafana-dashboards.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/grafana-dashboards:v1.2.0@sha256:2c9aa0b48e2bf6167db198f4d15882bfe51700108edf2e9f6d0942940a2c1204
+ghcr.io/cozystack/cozystack/grafana-dashboards:v1.2.1@sha256:2c9aa0b48e2bf6167db198f4d15882bfe51700108edf2e9f6d0942940a2c1204
diff --git a/packages/system/kamaji/values.yaml b/packages/system/kamaji/values.yaml
index 63970e8f..9c6eea0e 100644
--- a/packages/system/kamaji/values.yaml
+++ b/packages/system/kamaji/values.yaml
@@ -3,7 +3,7 @@ kamaji:
     deploy: false
   image:
     pullPolicy: IfNotPresent
-    tag: v1.2.0@sha256:071f5f893f16918e6f03c3cf42315a3bce1c7624f10c155f3b3e6dfcd4d60c2a
+    tag: v1.2.1@sha256:34b9af510bbad3e64ea5cd7afdffa2b31c0751009c467355c8f67f8f9c5b3513
     repository: ghcr.io/cozystack/cozystack/kamaji
   resources:
     limits:
@@ -13,4 +13,4 @@ kamaji:
       cpu: 100m
       memory: 100Mi
   extraArgs:
-    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.2.0@sha256:071f5f893f16918e6f03c3cf42315a3bce1c7624f10c155f3b3e6dfcd4d60c2a
+    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.2.1@sha256:34b9af510bbad3e64ea5cd7afdffa2b31c0751009c467355c8f67f8f9c5b3513
diff --git a/packages/system/kubeovn-plunger/values.yaml b/packages/system/kubeovn-plunger/values.yaml
index c52e699b..7691803e 100644
--- a/packages/system/kubeovn-plunger/values.yaml
+++ b/packages/system/kubeovn-plunger/values.yaml
@@ -1,4 +1,4 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.2.0@sha256:39f9f0e6ec42afdd91082f7c025699425096244bb10f4e2f7a1d17155ac0cebb
+image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.2.1@sha256:71d487b9da211061921c7183d5a1e19a32c64dffe33a3fac0557c4cb25764dfe
 ovnCentralName: ovn-central
diff --git a/packages/system/kubeovn-webhook/values.yaml b/packages/system/kubeovn-webhook/values.yaml
index 8db1d9af..df5215d1 100644
--- a/packages/system/kubeovn-webhook/values.yaml
+++ b/packages/system/kubeovn-webhook/values.yaml
@@ -1,3 +1,3 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.2.0@sha256:e6334c29d3aaf0dea766c88e3e05b53ad623d1bb497b3c836e6f76adade45b29
+image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.2.1@sha256:e6334c29d3aaf0dea766c88e3e05b53ad623d1bb497b3c836e6f76adade45b29
diff --git a/packages/system/lineage-controller-webhook/values.yaml b/packages/system/lineage-controller-webhook/values.yaml
index 0776861c..103dbf85 100644
--- a/packages/system/lineage-controller-webhook/values.yaml
+++ b/packages/system/lineage-controller-webhook/values.yaml
@@ -1,5 +1,5 @@
 lineageControllerWebhook:
-  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.2.0@sha256:fdbd4ed09c2e825880e84b8668d8bb6e0795da5c51d7c20b9d5eb4abe31d3ae0
+  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.2.1@sha256:0fef727af2ea8d87503ba998d2ec03c12eb432d03b6642a555b81b95fbec4cb0
   debug: false
   localK8sAPIEndpoint:
     enabled: true
diff --git a/packages/system/linstor/values.yaml b/packages/system/linstor/values.yaml
index 3986fc4f..b3f13443 100644
--- a/packages/system/linstor/values.yaml
+++ b/packages/system/linstor/values.yaml
@@ -1,7 +1,7 @@
 piraeusServer:
   image:
     repository: ghcr.io/cozystack/cozystack/piraeus-server
-    tag: 1.32.3@sha256:64c91357affc6317d9544fc35b3ff8b2fcb065ad8fc5ed26f7a2fa8ac991a1c1
+    tag: 1.32.3@sha256:d78071fdc33220168e3f2ab112a86208be95898b75268a0c62763b8a04e145ad
 # Talos-specific workarounds (disable for generic Linux like Ubuntu/Debian)
 talos:
   enabled: true
@@ -13,4 +13,4 @@ linstor:
 linstorCSI:
   image:
     repository: ghcr.io/cozystack/cozystack/linstor-csi
-    tag: v1.10.5@sha256:585ee6336036cb9e0b2183a6ab3f67e1ccb6d35a1df484d36e734444ee09eb4f
+    tag: v1.10.5@sha256:e80ae94d8acd8774cb35715b1f103071ae6cd3160f1ebea915e5e6ee49234448
diff --git a/packages/system/multus/templates/multus-daemonset-thick.yml b/packages/system/multus/templates/multus-daemonset-thick.yml
index 3839ff61..bedffee3 100644
--- a/packages/system/multus/templates/multus-daemonset-thick.yml
+++ b/packages/system/multus/templates/multus-daemonset-thick.yml
@@ -155,7 +155,7 @@ spec:
       serviceAccountName: multus
       containers:
         - name: kube-multus
-          image: ghcr.io/cozystack/cozystack/multus-cni:latest@sha256:4b7d9081bdb9d6608ff9b941364fb3c71bf56a352ca3da1bbe14e6b64e6aa459
+          image: ghcr.io/cozystack/cozystack/multus-cni:v1.2.1@sha256:aaf2ed6a5db1ee5acc0cd4f4683ea33570ff922c211bef37d407d6a01427b566
           command: [ "/usr/src/multus-cni/bin/multus-daemon" ]
           resources:
             requests:
@@ -201,7 +201,7 @@ spec:
                   fieldPath: spec.nodeName
       initContainers:
         - name: install-multus-binary
-          image: ghcr.io/cozystack/cozystack/multus-cni:latest@sha256:4b7d9081bdb9d6608ff9b941364fb3c71bf56a352ca3da1bbe14e6b64e6aa459
+          image: ghcr.io/cozystack/cozystack/multus-cni:v1.2.1@sha256:aaf2ed6a5db1ee5acc0cd4f4683ea33570ff922c211bef37d407d6a01427b566
           command:
             - "/usr/src/multus-cni/bin/install_multus"
             - "-d"
diff --git a/packages/system/objectstorage-controller/values.yaml b/packages/system/objectstorage-controller/values.yaml
index d2a5fc7c..1439e583 100644
--- a/packages/system/objectstorage-controller/values.yaml
+++ b/packages/system/objectstorage-controller/values.yaml
@@ -1,3 +1,3 @@
 objectstorage:
   controller:
-    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.2.0@sha256:05aee8bf8b292150090868163c6bb49962d874ac63858c93f8e130f53dd40b85"
+    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.2.1@sha256:036be10f26c4871c63fb63c6a294476289aa063610e7fbbc0dbd21d3cd7bfe5e"
diff --git a/packages/system/seaweedfs/values.yaml b/packages/system/seaweedfs/values.yaml
index 679203f5..7d598649 100644
--- a/packages/system/seaweedfs/values.yaml
+++ b/packages/system/seaweedfs/values.yaml
@@ -177,7 +177,7 @@ seaweedfs:
     bucketClassName: "seaweedfs"
     region: ""
     sidecar:
-      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.2.0@sha256:b508ca451c6051b64e71cedd6209c80ac0e0bea8aa6bb47e838ec9d99bf4796a"
+      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.2.1@sha256:1ad07fb9e96477e5c322f240f6023ceedd8762261d8379ec784dde92797ee206"
   certificates:
     commonName: "SeaweedFS CA"
     ipAddresses: []

From dbb94ad6f4c27f21b7f1fdf454f11331f8c0fb34 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 2 Apr 2026 19:00:43 +0200
Subject: [PATCH 377/666] docs(changelog): fix v1.2.1 link in v1.2.0
 deprecation warning

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 docs/changelogs/v1.2.0.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelogs/v1.2.0.md b/docs/changelogs/v1.2.0.md
index 8e0a0ff5..7c5b5e24 100644
--- a/docs/changelogs/v1.2.0.md
+++ b/docs/changelogs/v1.2.0.md
@@ -4,7 +4,7 @@ https://github.com/cozystack/cozystack/releases/tag/v1.2.0
 
 # Cozystack v1.2.0
 
-> **⚠️ WARNING: Do not use this release.** This version includes CloudNativePG operator, which updates the default PostgreSQL image to version 18. CNPG is unable to perform the migration from the previous major version automatically, which will cause PostgreSQL clusters to fail to start after the upgrade. Please use [v1.2.1](v1.2.1.md) instead.
+> **⚠️ WARNING: Do not use this release.** This version includes CloudNativePG operator, which updates the default PostgreSQL image to version 18. CNPG is unable to perform the migration from the previous major version automatically, which will cause PostgreSQL clusters to fail to start after the upgrade. Please use [v1.2.1](https://github.com/cozystack/cozystack/releases/tag/v1.2.1) instead.
 
 Cozystack v1.2.0 delivers significant platform enhancements: a fully managed **OpenSearch** service joining the application catalog, **VPC peering** for secure inter-tenant networking, tenant workload placement control via the new **SchedulingClass** system, a highly-available **VictoriaLogs cluster** replacing the single-node setup, and **Linstor volume relocation** for optimized clone and snapshot restore placement. Additional highlights include external-dns as a standalone extra package, multi-node RWX volume fixes, and a wave of dashboard and monitoring improvements.
 

From e4468148f6f217b8791677cf7af1de17a9363236 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Fri, 3 Apr 2026 20:24:25 +0200
Subject: [PATCH 378/666] linstor: update piraeus-server patches for v1.33.1

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/system/linstor/Makefile              |   2 +-
 .../images/piraeus-server/patches/README.md   |  22 +-
 .../patches/adjust-on-resfile-change.diff     |  48 --
 .../patches/allow-toggle-disk-retry.diff      | 406 +++++++------
 .../patches/fix-duplicate-tcp-ports.diff      | 165 +++--
 .../patches/fix-luks-header-size.diff         | 570 ++++++++++++++++++
 .../force-metadata-check-on-disk-add.diff     |  63 --
 .../skip-adjust-when-device-inaccessible.diff | 155 -----
 8 files changed, 883 insertions(+), 548 deletions(-)
 delete mode 100644 packages/system/linstor/images/piraeus-server/patches/adjust-on-resfile-change.diff
 create mode 100644 packages/system/linstor/images/piraeus-server/patches/fix-luks-header-size.diff
 delete mode 100644 packages/system/linstor/images/piraeus-server/patches/force-metadata-check-on-disk-add.diff
 delete mode 100644 packages/system/linstor/images/piraeus-server/patches/skip-adjust-when-device-inaccessible.diff

diff --git a/packages/system/linstor/Makefile b/packages/system/linstor/Makefile
index b211baec..2bc3a2a1 100644
--- a/packages/system/linstor/Makefile
+++ b/packages/system/linstor/Makefile
@@ -4,7 +4,7 @@ export NAMESPACE=cozy-$(NAME)
 include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
-LINSTOR_VERSION ?= 1.32.3
+LINSTOR_VERSION ?= 1.33.1
 LINSTOR_CSI_VERSION ?= v1.10.5
 
 image: image-piraeus-server image-linstor-csi
diff --git a/packages/system/linstor/images/piraeus-server/patches/README.md b/packages/system/linstor/images/piraeus-server/patches/README.md
index 558fdfeb..db497b7e 100644
--- a/packages/system/linstor/images/piraeus-server/patches/README.md
+++ b/packages/system/linstor/images/piraeus-server/patches/README.md
@@ -1,14 +1,14 @@
 # LINSTOR Server Patches
 
-Custom patches for piraeus-server (linstor-server) v1.32.3.
+Custom patches for piraeus-server (linstor-server) v1.33.1.
 
-- **adjust-on-resfile-change.diff** — Use actual device path in res file during toggle-disk; fix LUKS data offset
-  - Upstream: [#473](https://github.com/LINBIT/linstor-server/pull/473), [#472](https://github.com/LINBIT/linstor-server/pull/472)
-- **allow-toggle-disk-retry.diff** — Allow retry and cancellation of failed toggle-disk operations
-  - Upstream: [#475](https://github.com/LINBIT/linstor-server/pull/475)
-- **force-metadata-check-on-disk-add.diff** — Create metadata during toggle-disk from diskless to diskful
-  - Upstream: [#474](https://github.com/LINBIT/linstor-server/pull/474)
-- **fix-duplicate-tcp-ports.diff** — Preserve TCP ports during toggle-disk to prevent port mismatch between controller and satellites
-  - Upstream: [#476](https://github.com/LINBIT/linstor-server/pull/476) (superseded by this expanded fix)
-- **skip-adjust-when-device-inaccessible.diff** — Fix resources stuck in StandAlone after reboot, Unknown state race condition, and encrypted resource deletion
-  - Upstream: [#477](https://github.com/LINBIT/linstor-server/pull/477)
+- **allow-toggle-disk-retry.diff** — Backport maintainer implementation of toggle-disk retry/abort
+  - Source PR/comment: [#475](https://github.com/LINBIT/linstor-server/pull/475), [maintainer note](https://github.com/LINBIT/linstor-server/pull/475#issuecomment-3949630419)
+  - Backported from upstream commit: [`3d97f71c9`](https://github.com/LINBIT/linstor-server/commit/3d97f71c95a493588d3d521c63eac4d846935fb3)
+- **fix-duplicate-tcp-ports.diff** — Preserve DRBD TCP ports during toggle-disk and avoid redundant `ensureStackDataExists()`
+  - Source PR/review: [#476](https://github.com/LINBIT/linstor-server/pull/476), [review suggestion](https://github.com/LINBIT/linstor-server/pull/476#discussion_r3007725079)
+  - Backported from commits: [`79d6375c5`](https://github.com/kvaps/linstor-server/commit/79d6375c55d6181b35a7b7f0fe8dbdfb86e126cd), [`bcc89902f`](https://github.com/kvaps/linstor-server/commit/bcc89902f4f61ac1589dd07ebb7f5aae1935370d)
+- **fix-luks-header-size.diff** — Account for LUKS2 `--offset`, metadata/keyslots sizing, and device `optimal_io_size`
+  - Source PR/comment: [#472](https://github.com/LINBIT/linstor-server/pull/472), [maintainer note](https://github.com/LINBIT/linstor-server/pull/472#issuecomment-3949687603)
+  - Backported from commits: [`ccc85fbd2`](https://github.com/LINBIT/linstor-server/commit/ccc85fbd2c65f0b97c52403fa80f1efdb886ec4e), [`71b601554`](https://github.com/LINBIT/linstor-server/commit/71b601554f41bcb50cd5bd06989c5b0d3a814acd)
+  - Note: upstream commit [`3d0402a0c`](https://github.com/LINBIT/linstor-server/commit/3d0402a0c25f0a4b57b380321f10e89982f26e7a) is already included in `v1.33.1`
diff --git a/packages/system/linstor/images/piraeus-server/patches/adjust-on-resfile-change.diff b/packages/system/linstor/images/piraeus-server/patches/adjust-on-resfile-change.diff
deleted file mode 100644
index 6788efaf..00000000
--- a/packages/system/linstor/images/piraeus-server/patches/adjust-on-resfile-change.diff
+++ /dev/null
@@ -1,48 +0,0 @@
-diff --git a/satellite/src/main/java/com/linbit/linstor/layer/drbd/utils/ConfFileBuilder.java b/satellite/src/main/java/com/linbit/linstor/layer/drbd/utils/ConfFileBuilder.java
-index 36c52ccf8..c0bb7b967 100644
---- a/satellite/src/main/java/com/linbit/linstor/layer/drbd/utils/ConfFileBuilder.java
-+++ b/satellite/src/main/java/com/linbit/linstor/layer/drbd/utils/ConfFileBuilder.java
-@@ -894,12 +894,16 @@ public class ConfFileBuilder
-         if (((Volume) vlmData.getVolume()).getFlags().isUnset(localAccCtx, Volume.Flags.DELETE))
-         {
-             final String disk;
-+            // Check if we're in toggle-disk operation (adding disk to diskless resource)
-+            boolean isDiskAdding = vlmData.getVolume().getAbsResource().getStateFlags().isSomeSet(
-+                localAccCtx, Resource.Flags.DISK_ADD_REQUESTED, Resource.Flags.DISK_ADDING);
-             if ((!isPeerRsc && vlmData.getDataDevice() == null) ||
-                 (isPeerRsc &&
-                 // FIXME: vlmData.getRscLayerObject().getFlags should be used here
-                      vlmData.getVolume().getAbsResource().disklessForDrbdPeers(accCtx)
-                 ) ||
--                (!isPeerRsc &&
-+                // For toggle-disk: if dataDevice is set and we're adding disk, use the actual device
-+                (!isPeerRsc && !isDiskAdding &&
-                 // FIXME: vlmData.getRscLayerObject().getFlags should be used here
-                      vlmData.getVolume().getAbsResource().isDrbdDiskless(accCtx)
-                 )
-diff --git a/satellite/src/main/java/com/linbit/linstor/layer/luks/CryptSetupCommands.java b/satellite/src/main/java/com/linbit/linstor/layer/luks/CryptSetupCommands.java
-index 54dd5c19f..018de58cf 100644
---- a/satellite/src/main/java/com/linbit/linstor/layer/luks/CryptSetupCommands.java
-+++ b/satellite/src/main/java/com/linbit/linstor/layer/luks/CryptSetupCommands.java
-@@ -34,6 +34,9 @@ public class CryptSetupCommands implements Luks
-     private static final Version V2_1_0 = new Version(2, 1, 0);
-     private static final Version V2_0_0 = new Version(2, 0, 0);
-     private static final String PBDKF_MAX_MEMORY_KIB = "262144";  // 256 MiB
-+    // Fixed LUKS2 data offset in 512-byte sectors (16 MiB = 32768 sectors)
-+    // This ensures consistent LUKS header size across all nodes regardless of system defaults
-+    private static final String LUKS2_DATA_OFFSET_SECTORS = "32768";
-
-     @SuppressWarnings("unused")
-     private final ErrorReporter errorReporter;
-@@ -78,6 +81,11 @@ public class CryptSetupCommands implements Luks
-             command.add(CRYPTSETUP);
-             command.add("-q");
-             command.add("luksFormat");
-+            // Always specify explicit offset to ensure consistent LUKS header size across all nodes
-+            // Without this, different systems may create LUKS with different header sizes (16MiB vs 32MiB)
-+            // which causes "Low.dev. smaller than requested DRBD-dev. size" errors during toggle-disk
-+            command.add("--offset");
-+            command.add(LUKS2_DATA_OFFSET_SECTORS);
-             if (version.greaterOrEqual(V2_0_0))
-             {
-                 command.add("--pbkdf-memory");
diff --git a/packages/system/linstor/images/piraeus-server/patches/allow-toggle-disk-retry.diff b/packages/system/linstor/images/piraeus-server/patches/allow-toggle-disk-retry.diff
index 264e0221..952ba16c 100644
--- a/packages/system/linstor/images/piraeus-server/patches/allow-toggle-disk-retry.diff
+++ b/packages/system/linstor/images/piraeus-server/patches/allow-toggle-disk-retry.diff
@@ -1,168 +1,232 @@
 diff --git a/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java b/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java
-index d93a18014..cc8ce4f04 100644
+index d93a18014..a944cb809 100644
 --- a/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java
 +++ b/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java
-@@ -57,7 +57,9 @@ import com.linbit.linstor.stateflags.StateFlags;
- import com.linbit.linstor.storage.StorageException;
- import com.linbit.linstor.storage.data.adapter.drbd.DrbdRscData;
- import com.linbit.linstor.storage.interfaces.categories.resource.AbsRscLayerObject;
-+import com.linbit.linstor.storage.interfaces.categories.resource.VlmProviderObject;
- import com.linbit.linstor.storage.kinds.DeviceLayerKind;
-+import com.linbit.linstor.storage.kinds.DeviceProviderKind;
- import com.linbit.linstor.storage.utils.LayerUtils;
- import com.linbit.linstor.tasks.AutoDiskfulTask;
- import com.linbit.linstor.utils.layer.LayerRscUtils;
-@@ -387,21 +389,84 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL
+@@ -111,6 +111,14 @@ import reactor.util.function.Tuple2;
+ @Singleton
+ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionListener
+ {
++    private enum ToggleDiskAction
++    {
++        NOOP,
++        NORMAL,
++        ABORT,
++        RETRY
++    }
++
+     private final AccessContext apiCtx;
+     private final ScopeRunner scopeRunner;
+     private final BackgroundRunner backgroundRunner;
+@@ -386,69 +394,33 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL
+             "Toggle Disk on %s/%s %s", nodeNameStr, rscNameStr, removeDisk ? "removing disk" : "adding disk");
  
          Resource rsc = ctrlApiDataLoader.loadRsc(nodeName, rscName, true);
++        ResourceDefinition rscDfn = rsc.getResourceDefinition();
  
-+        // Allow retry of the same operation if the previous attempt failed
-+        // (the requested flag remains set for retry on reconnection, but we should also allow manual retry)
-+        // Also allow cancellation of a failed operation by requesting the opposite operation
-         if (hasDiskAddRequested(rsc))
-         {
+-        if (hasDiskAddRequested(rsc))
+-        {
 -            throw new ApiRcException(ApiCallRcImpl.simpleEntry(
 -                ApiConsts.FAIL_RSC_BUSY,
 -                "Addition of disk to resource already requested",
 -                true
 -            ));
-+            if (removeDisk)
-+            {
-+                // User wants to cancel the failed add-disk operation and go back to diskless
-+                // Use the existing disk removal flow to properly cleanup storage on satellite
-+                errorReporter.logInfo(
-+                    "Toggle Disk cancel on %s/%s - cancelling failed DISK_ADD_REQUESTED, reverting to diskless",
-+                    nodeNameStr, rscNameStr);
-+                unmarkDiskAddRequested(rsc);
-+                // Also clear DISK_ADDING if it was set
-+                unmarkDiskAdding(rsc);
-+
-+                // Set storage pool to diskless pool (overwrite the diskful pool that was set)
-+                Props rscProps = ctrlPropsHelper.getProps(rsc);
-+                rscProps.map().put(ApiConsts.KEY_STOR_POOL_NAME, LinStor.DISKLESS_STOR_POOL_NAME);
-+
-+                // Set DISK_REMOVE_REQUESTED to use the existing disk removal flow
-+                // This will:
-+                // 1. updateAndAdjustDisk sets DISK_REMOVING flag
-+                // 2. Satellite sees DISK_REMOVING and deletes LUKS/storage devices
-+                // 3. finishOperation rebuilds layer stack as diskless
-+                // We keep the existing layer data so satellite can properly cleanup
-+                markDiskRemoveRequested(rsc);
-+
-+                ctrlTransactionHelper.commit();
-+
-+                // Use existing disk removal flow - this will properly cleanup storage on satellite
-+                return Flux
-+                    .<ApiCallRc>just(ApiCallRcImpl.singleApiCallRc(
-+                        ApiConsts.MODIFIED,
-+                        "Cancelling disk addition, reverting to diskless"
-+                    ))
-+                    .concatWith(updateAndAdjustDisk(nodeName, rscName, true, toggleIntoTiebreakerRef, context))
-+                    .concatWith(ctrlRscDfnApiCallHandler.get().updateProps(rsc.getResourceDefinition()));
-+            }
-+            // If adding disk and DISK_ADD_REQUESTED is already set, treat as retry
-+            // Simply retry the operation with existing layer data - satellite will handle it idempotently
-+            // NOTE: We don't remove/recreate layer data here because removeLayerData() only deletes
-+            // from controller DB without calling drbdadm down on satellite, leaving orphaned DRBD devices
-+            errorReporter.logInfo(
-+                "Toggle Disk retry on %s/%s - DISK_ADD_REQUESTED already set, retrying operation",
-+                nodeNameStr, rscNameStr);
-+            ctrlTransactionHelper.commit();
-+            return Flux
-+                .<ApiCallRc>just(new ApiCallRcImpl())
-+                .concatWith(updateAndAdjustDisk(nodeName, rscName, false, toggleIntoTiebreakerRef, context))
-+                .concatWith(ctrlRscDfnApiCallHandler.get().updateProps(rsc.getResourceDefinition()));
-         }
-         if (hasDiskRemoveRequested(rsc))
-         {
+-        }
+-        if (hasDiskRemoveRequested(rsc))
+-        {
 -            throw new ApiRcException(ApiCallRcImpl.simpleEntry(
 -                ApiConsts.FAIL_RSC_BUSY,
 -                "Removal of disk from resource already requested",
 -                true
 -            ));
-+            if (!removeDisk)
-+            {
-+                // User wants to cancel the failed remove-disk operation
+-        }
++        ToggleDiskAction action = determineToggleDiskAction(rsc, removeDisk);
++        errorReporter.logDebug("Toggle Disk action: %s", action);
+ 
+-        if (!removeDisk && !ctrlVlmCrtApiHelper.isDiskless(rsc))
++        switch (action)
+         {
+-            throw new ApiRcException(ApiCallRcImpl.simpleEntry(
+-                ApiConsts.WARN_RSC_ALREADY_HAS_DISK,
+-                "Resource already has disk",
+-                true
+-            ));
+-        }
+-        if (removeDisk && ctrlVlmCrtApiHelper.isDiskless(rsc))
+-        {
+-            throw new ApiRcException(ApiCallRcImpl.simpleEntry(
+-                ApiConsts.WARN_RSC_ALREADY_DISKLESS,
+-                "Resource already diskless",
+-                true
+-            ));
++            case NOOP:
++                return handleNoopAction(rsc, removeDisk);
++            case RETRY:
++                return handleRetryAction(rsc, removeDisk, toggleIntoTiebreakerRef, context);
++            case ABORT:
++                clearToggleDiskFlags(rsc);
 +                errorReporter.logInfo(
-+                    "Toggle Disk cancel on %s/%s - cancelling failed DISK_REMOVE_REQUESTED",
-+                    nodeNameStr, rscNameStr);
-+                unmarkDiskRemoveRequested(rsc);
-+                ctrlTransactionHelper.commit();
-+                return Flux.<ApiCallRc>just(
-+                    ApiCallRcImpl.singleApiCallRc(
-+                        ApiConsts.MODIFIED,
-+                        "Cancelled disk removal request"
-+                    )
++                    "Aborting previous toggle disk transition, starting new transition to %s",
++                    removeDisk ? "diskless" : "diskful"
 +                );
-+            }
-+            // If removing disk and DISK_REMOVE_REQUESTED is already set, treat as retry
-+            errorReporter.logInfo(
-+                "Toggle Disk retry on %s/%s - DISK_REMOVE_REQUESTED already set, continuing operation",
-+                nodeNameStr, rscNameStr);
-+            ctrlTransactionHelper.commit();
-+            return Flux
-+                .<ApiCallRc>just(new ApiCallRcImpl())
-+                .concatWith(updateAndAdjustDisk(nodeName, rscName, true, toggleIntoTiebreakerRef, context))
-+                .concatWith(ctrlRscDfnApiCallHandler.get().updateProps(rsc.getResourceDefinition()));
++                break;
++            case NORMAL:
++                break;
++            default:
++                throw new ImplementationError("Unhandled case: " + action);
          }
  
-         if (!removeDisk && !ctrlVlmCrtApiHelper.isDiskless(rsc))
-@@ -412,17 +477,43 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL
-                 true
-             ));
-         }
-+        ResourceDefinition rscDfn = rsc.getResourceDefinition();
-+        AccessContext peerCtx = peerAccCtx.get();
-+
-         if (removeDisk && ctrlVlmCrtApiHelper.isDiskless(rsc))
-         {
-+            // Resource is marked as diskless - check if it has orphaned storage layers that need cleanup
-+            AbsRscLayerObject<Resource> layerData = getLayerData(peerCtx, rsc);
-+            if (layerData != null && (LayerUtils.hasLayer(layerData, DeviceLayerKind.LUKS) ||
-+                hasNonDisklessStorageLayer(layerData)))
-+            {
-+                // Resource is marked as diskless but has orphaned storage layers - need cleanup
-+                // Use the existing disk removal flow to properly cleanup storage on satellite
-+                errorReporter.logInfo(
-+                    "Toggle Disk cleanup on %s/%s - resource is diskless but has orphaned storage layers, cleaning up",
-+                    nodeNameStr, rscNameStr);
-+
-+                // Set DISK_REMOVE_REQUESTED to use the existing disk removal flow
-+                // This will trigger proper satellite cleanup via DISK_REMOVING flag
-+                markDiskRemoveRequested(rsc);
-+
-+                ctrlTransactionHelper.commit();
-+
-+                // Use existing disk removal flow - this will properly cleanup storage on satellite
-+                return Flux
-+                    .<ApiCallRc>just(ApiCallRcImpl.singleApiCallRc(
-+                        ApiConsts.MODIFIED,
-+                        "Cleaning up orphaned storage layers"
-+                    ))
-+                    .concatWith(updateAndAdjustDisk(nodeName, rscName, true, toggleIntoTiebreakerRef, context))
-+                    .concatWith(ctrlRscDfnApiCallHandler.get().updateProps(rsc.getResourceDefinition()));
-+            }
-             throw new ApiRcException(ApiCallRcImpl.simpleEntry(
-                 ApiConsts.WARN_RSC_ALREADY_DISKLESS,
-                 "Resource already diskless",
-                 true
-             ));
-         }
--
 -        ResourceDefinition rscDfn = rsc.getResourceDefinition();
 -        AccessContext peerCtx = peerAccCtx.get();
-         if (removeDisk)
-         {
-             // Prevent removal of the last disk
-@@ -1446,6 +1537,30 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL
+-        if (removeDisk)
+-        {
+-            // Prevent removal of the last disk
+-            int haveDiskCount = countDisksAndIsOnline(rscDfn);
+-            if (haveDiskCount <= 1)
+-            {
+-                throw new ApiRcException(ApiCallRcImpl.simpleEntry(
+-                    ApiConsts.FAIL_INSUFFICIENT_REPLICA_COUNT,
+-                    "Cannot remove the disk from the only online resource with a disk",
+-                    true
+-                ));
+-            }
++        validateToggleDiskPreconditions(rsc, removeDisk);
+ 
+-            if (!LayerUtils.hasLayer(getLayerData(peerCtx, rsc), DeviceLayerKind.DRBD))
+-            {
+-                throw new ApiRcException(ApiCallRcImpl.simpleEntry(
+-                    ApiConsts.FAIL_INVLD_LAYER_STACK,
+-                    "Toggle disk is only supported in combination with DRBD",
+-                    true
+-                ));
+-            }
+-        }
+-        else
+-        {
+-            ensureAllPeersHavePeerSlotLeft(rscDfn);
+-        }
++        AccessContext peerCtx = peerAccCtx.get();
+ 
+         // Save the requested storage pool in the resource properties.
+         // This does not cause the storage pool to be used automatically.
+@@ -628,10 +600,10 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL
+ 
+         ctrlTransactionHelper.commit();
+ 
+-        String action = removeDisk ? "Removal of disk from" : "Addition of disk to";
++        String actionStr = removeDisk ? "Removal of disk from" : "Addition of disk to";
+         responses.addEntry(ApiCallRcImpl.simpleEntry(
+             ApiConsts.MODIFIED,
+-            action + " resource '" + rscDfn.getName().displayValue + "' " +
++            actionStr + " resource '" + rscDfn.getName().displayValue + "' " +
+                 "on node '" + rsc.getNode().getName().displayValue + "' registered"
+         ));
+ 
+@@ -651,6 +623,40 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL
+             );
+     }
+ 
++    private Flux<ApiCallRc> handleNoopAction(Resource rscRef, boolean removeDiskRef)
++    {
++        String state = removeDiskRef ? "diskless" : "diskful";
++        ApiCallRcImpl responses = new ApiCallRcImpl();
++        responses.addEntry(ApiCallRcImpl.simpleEntry(
++            ApiConsts.INFO_NOOP,
++            "Resource '" + rscRef.getResourceDefinition().getName().displayValue + "' on node '" +
++                rscRef.getNode().getName().displayValue + "' is already " + state
++        ));
++        return Flux.just(responses);
++    }
++
++    private Flux<ApiCallRc> handleRetryAction(
++        Resource rscRef,
++        boolean removeDisk,
++        boolean toggleIntoTiebreakerRef,
++        ResponseContext context
++    )
++    {
++        String direction = removeDisk ? "diskless" : "diskful";
++        ApiCallRcImpl responses = new ApiCallRcImpl();
++        NodeName nodeName = rscRef.getNode().getName();
++        ResourceName rscName = rscRef.getResourceDefinition().getName();
++        responses.addEntry(ApiCallRcImpl.simpleEntry(
++            ApiConsts.INFO_NOOP,
++            "Retrying toggle disk to " + direction + " for resource '" + rscName.displayValue +
++                "' on node '" + nodeName.displayValue + "'"
++        ));
++
++        return Flux
++            .<ApiCallRc>just(responses)
++            .concatWith(updateAndAdjustDisk(nodeName, rscName, removeDisk, toggleIntoTiebreakerRef, context));
++    }
++
+     private long getVlmDfnSizePrivileged(VolumeDefinition vlmDfnRef)
+     {
+         try
+@@ -781,6 +787,96 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL
          }
      }
  
-+    private void unmarkDiskAddRequested(Resource rsc)
++    private ToggleDiskAction determineToggleDiskAction(Resource rsc, boolean removeDisk)
++    {
++        boolean isDiskless = ctrlVlmCrtApiHelper.isDiskless(rsc);
++        boolean diskAddRequested = hasDiskAddRequested(rsc);
++        boolean diskRemoveRequested = hasDiskRemoveRequested(rsc);
++
++        ToggleDiskAction action;
++        if (isDiskless)
++        {
++            if (diskAddRequested)
++            {
++                action = removeDisk ? ToggleDiskAction.ABORT : ToggleDiskAction.RETRY;
++            }
++            else if (diskRemoveRequested)
++            {
++                action = removeDisk ? ToggleDiskAction.RETRY : ToggleDiskAction.ABORT;
++            }
++            else
++            {
++                action = removeDisk ? ToggleDiskAction.NOOP : ToggleDiskAction.NORMAL;
++            }
++        }
++        else
++        {
++            if (diskRemoveRequested)
++            {
++                action = removeDisk ? ToggleDiskAction.RETRY : ToggleDiskAction.ABORT;
++            }
++            else
++            {
++                action = removeDisk ? ToggleDiskAction.NORMAL : ToggleDiskAction.NOOP;
++            }
++        }
++
++        return action;
++    }
++
++    private void validateToggleDiskPreconditions(Resource rsc, boolean removeDisk)
++    {
++        ResourceDefinition rscDfn = rsc.getResourceDefinition();
++        if (removeDisk)
++        {
++            validateDiskRemovalAllowed(rsc, rscDfn);
++        }
++        else
++        {
++            ensureAllPeersHavePeerSlotLeft(rscDfn);
++        }
++    }
++
++    private void clearToggleDiskFlags(Resource rsc)
 +    {
 +        try
 +        {
-+            rsc.getStateFlags().disableFlags(apiCtx, Resource.Flags.DISK_ADD_REQUESTED);
++            rsc.getStateFlags().disableFlags(
++                apiCtx,
++                Resource.Flags.DISK_ADD_REQUESTED,
++                Resource.Flags.DISK_ADDING,
++                Resource.Flags.DISK_REMOVE_REQUESTED,
++                Resource.Flags.DISK_REMOVING
++            );
 +        }
 +        catch (AccessDeniedException | DatabaseException exc)
 +        {
@@ -170,60 +234,28 @@ index d93a18014..cc8ce4f04 100644
 +        }
 +    }
 +
-+    private void unmarkDiskRemoveRequested(Resource rsc)
++    private void validateDiskRemovalAllowed(Resource rsc, ResourceDefinition rscDfn)
 +    {
-+        try
++        int haveDiskCount = countDisksAndIsOnline(rscDfn);
++        if (haveDiskCount <= 1)
 +        {
-+            rsc.getStateFlags().disableFlags(apiCtx, Resource.Flags.DISK_REMOVE_REQUESTED);
++            throw new ApiRcException(ApiCallRcImpl.simpleEntry(
++                ApiConsts.FAIL_INSUFFICIENT_REPLICA_COUNT,
++                "Cannot remove the disk from the only online resource with a disk",
++                true
++            ));
 +        }
-+        catch (AccessDeniedException | DatabaseException exc)
++
++        if (!LayerUtils.hasLayer(getLayerData(peerAccCtx.get(), rsc), DeviceLayerKind.DRBD))
 +        {
-+            throw new ImplementationError(exc);
++            throw new ApiRcException(ApiCallRcImpl.simpleEntry(
++                ApiConsts.FAIL_INVLD_LAYER_STACK,
++                "Toggle disk is only supported in combination with DRBD",
++                true
++            ));
 +        }
 +    }
 +
-     private void markDiskAdded(Resource rscData)
-     {
-         try
-@@ -1511,6 +1626,41 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL
-         return layerData;
-     }
- 
-+    /**
-+     * Check if the layer stack has a non-diskless STORAGE layer.
-+     * This is used to detect orphaned storage layers that need cleanup.
-+     */
-+    private boolean hasNonDisklessStorageLayer(AbsRscLayerObject<Resource> layerDataRef)
-+    {
-+        boolean hasNonDiskless = false;
-+        if (layerDataRef != null)
-+        {
-+            if (layerDataRef.getLayerKind() == DeviceLayerKind.STORAGE)
-+            {
-+                for (VlmProviderObject<Resource> vlmData : layerDataRef.getVlmLayerObjects().values())
-+                {
-+                    if (vlmData.getProviderKind() != DeviceProviderKind.DISKLESS)
-+                    {
-+                        hasNonDiskless = true;
-+                        break;
-+                    }
-+                }
-+            }
-+            if (!hasNonDiskless)
-+            {
-+                for (AbsRscLayerObject<Resource> child : layerDataRef.getChildren())
-+                {
-+                    if (hasNonDisklessStorageLayer(child))
-+                    {
-+                        hasNonDiskless = true;
-+                        break;
-+                    }
-+                }
-+            }
-+        }
-+        return hasNonDiskless;
-+    }
-+
-     private LockGuard createLockGuard()
-     {
-         return lockGuardFactory.buildDeferred(LockType.WRITE, LockObj.NODES_MAP, LockObj.RSC_DFN_MAP);
+     /**
+      * Although we need to rebuild the layerData as the layerList might have changed, if we do not
+      * deactivate (i.e. down) the current resource, we need to make sure that deleting DrbdRscData
diff --git a/packages/system/linstor/images/piraeus-server/patches/fix-duplicate-tcp-ports.diff b/packages/system/linstor/images/piraeus-server/patches/fix-duplicate-tcp-ports.diff
index b34a2500..ed106f98 100644
--- a/packages/system/linstor/images/piraeus-server/patches/fix-duplicate-tcp-ports.diff
+++ b/packages/system/linstor/images/piraeus-server/patches/fix-duplicate-tcp-ports.diff
@@ -1,69 +1,25 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Andrei Kvapil <kvapss@gmail.com>
-Date: Fri, 28 Mar 2026 13:00:00 +0100
-Subject: [PATCH] fix(drbd): preserve TCP ports during toggle-disk operations
-
-Prevent TCP port mismatches after toggle-disk operations by preserving
-existing TCP ports when rebuilding DrbdRscData.
-
-Root Cause:
------------
-During toggle-disk operations, removeLayerData() deletes DrbdRscData
-(freeing its TCP ports from the number pool), then ensureStackDataExists()
-creates new DrbdRscData. Since the payload has no explicit tcpPorts,
-the controller allocates new ports from the pool -- which may differ from
-the old ports if other resources claimed them in the meantime.
-
-The controller correctly avoids collisions in its own number pool, but
-the satellite may miss the update (e.g. during controller restart or
-network issues). When this happens, the satellite keeps the old ports
-while peers receive the new ones, causing DRBD connection failures
-(StandAlone/Connecting state).
-
-Additionally, remove the redundant ensureStackDataExists() call from
-resetStoragePools() -- the caller already invokes it with the correct
-payload.
-
-Solution:
----------
-1. Add copyDrbdTcpPortsIfExists() to save existing TCP ports into the
-   LayerPayload before removeLayerData() deletes them.
-2. Call it from copyDrbdNodeIdIfExists() (covers both toggle-disk paths)
-   and from the needsDeactivate path (shared storage pool case).
-3. Remove the redundant ensureStackDataExists() from resetStoragePools().
-
-This ensures the same TCP ports are reused when DrbdRscData is recreated,
-eliminating the window for port mismatch between controller and satellites.
-
-Co-Authored-By: Claude <noreply@anthropic.com>
-Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
----
- .../controller/CtrlRscToggleDiskApiCallHandler.java | 40 +++++++++++++++++++--
- .../linstor/layer/resource/CtrlRscLayerDataFactory.java |  2 --
- 2 files changed, 38 insertions(+), 4 deletions(-)
-
 diff --git a/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java b/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java
-index ccdb0cee5..b0554c2ec 100644
+index d93a18014..01cfbbacf 100644
 --- a/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java
 +++ b/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java
-@@ -58,6 +58,7 @@ import com.linbit.linstor.stateflags.StateFlags;
- import com.linbit.linstor.storage.StorageException;
- import com.linbit.linstor.storage.data.adapter.drbd.DrbdRscData;
- import com.linbit.linstor.storage.interfaces.categories.resource.AbsRscLayerObject;
+@@ -37,6 +37,7 @@ import com.linbit.linstor.core.objects.StorPool;
+ import com.linbit.linstor.core.objects.Volume;
+ import com.linbit.linstor.core.objects.VolumeDefinition;
+ import com.linbit.linstor.core.objects.utils.MixedStorPoolHelper;
 +import com.linbit.linstor.core.types.TcpPortNumber;
- import com.linbit.linstor.storage.interfaces.categories.resource.VlmProviderObject;
- import com.linbit.linstor.storage.kinds.DeviceLayerKind;
- import com.linbit.linstor.storage.kinds.DeviceProviderKind;
-@@ -88,6 +89,7 @@ import java.util.LinkedHashMap;
- import java.util.List;
+ import com.linbit.linstor.dbdrivers.DatabaseException;
+ import com.linbit.linstor.event.EventWaiter;
+ import com.linbit.linstor.event.ObjectIdentifier;
+@@ -85,6 +86,7 @@ import java.util.List;
+ import java.util.Map;
  import java.util.Map.Entry;
  import java.util.Set;
 +import java.util.TreeSet;
-
+ 
  import org.reactivestreams.Publisher;
  import reactor.core.publisher.Flux;
-@@ -587,8 +589,9 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL
-
+@@ -575,12 +577,13 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL
+ 
                  /*
                   * We also have to remove the currently diskless DrbdRscData and free up the node-id as now we must
 -                 * use the shared resource's node-id
@@ -73,30 +29,39 @@ index ccdb0cee5..b0554c2ec 100644
              }
              else
              {
-@@ -726,7 +729,7 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL
+-                copyDrbdNodeIdIfExists(rsc, payload);
++                copyDrbdSettings(rsc, payload);
+             }
+             /*
+              * rebuilds the layerdata in case we just removed it..
+@@ -782,10 +785,20 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL
+     }
+ 
      /**
-      * Although we need to rebuild the layerData as the layerList might have changed, if we do not
-      * deactivate (i.e. down) the current resource, we need to make sure that deleting DrbdRscData
+-     * Although we need to rebuild the layerData as the layerList might have changed, if we do not
+-     * deactivate (i.e. down) the current resource, we need to make sure that deleting DrbdRscData
 -     * and recreating a new DrbdRscData ends up with the same node-id as before.
-+     * and recreating a new DrbdRscData ends up with the same node-id and TCP ports as before.
++     * Copies DRBD settings (node-id and TCP ports) from the existing DrbdRscData into the payload
++     * before removeLayerData() deletes them. This ensures that recreated DrbdRscData ends up with
++     * the same node-id and TCP ports as before.
++     *
++     * TCP ports must be preserved because if the satellite misses the update (e.g. due to controller
++     * restart or connectivity issues), it will keep the old ports while peers receive the new ones,
++     * causing DRBD connections to fail with StandAlone state.
       */
-     private void copyDrbdNodeIdIfExists(Resource rsc, LayerPayload payload) throws ImplementationError
-     {
-@@ -743,6 +746,37 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL
-             DrbdRscData<Resource> drbdRscData = (DrbdRscData<Resource>) drbdRscDataSet.iterator().next();
-             payload.drbdRsc.nodeId = drbdRscData.getNodeId().value;
-         }
++    private void copyDrbdSettings(Resource rsc, LayerPayload payload) throws ImplementationError
++    {
++        copyDrbdNodeIdIfExists(rsc, payload);
 +        copyDrbdTcpPortsIfExists(rsc, payload);
 +    }
 +
-+    /**
-+     * Preserves existing TCP ports during toggle-disk operations.
-+     *
-+     * When removeLayerData() deletes DrbdRscData, the TCP ports are freed from the number pool.
-+     * If ensureStackDataExists() then allocates different ports, and the satellite misses the update
-+     * (e.g. due to controller restart or connectivity issues), the satellite keeps the old ports
-+     * while peers get the new ones, causing DRBD connections to fail with StandAlone state.
-+     */
+     private void copyDrbdNodeIdIfExists(Resource rsc, LayerPayload payload) throws ImplementationError
+     {
+         Set<AbsRscLayerObject<Resource>> drbdRscDataSet = LayerRscUtils.getRscDataByLayer(
+@@ -804,6 +817,28 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL
+         }
+     }
+ 
 +    private void copyDrbdTcpPortsIfExists(Resource rsc, LayerPayload payload) throws ImplementationError
 +    {
 +        Set<AbsRscLayerObject<Resource>> drbdRscDataSet = LayerRscUtils.getRscDataByLayer(
@@ -117,22 +82,56 @@ index ccdb0cee5..b0554c2ec 100644
 +                payload.drbdRsc.tcpPorts = portInts;
 +            }
 +        }
-     }
-
++    }
++
      private List<DeviceLayerKind> removeLayerData(Resource rscRef)
+     {
+         List<DeviceLayerKind> layerList;
+@@ -1058,15 +1093,15 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL
+             /*
+              * We also have to remove the possible meta-children of previous StorageRscData.
+              * LayerData will be recreated with ensureStackDataExists.
+-             * However, we still need to remember our node-id if we had / have DRBD in the list
++             * However, we still need to remember our DRBD settings if we had / have DRBD in the list
+              */
+-            copyDrbdNodeIdIfExists(rsc, payload);
++            copyDrbdSettings(rsc, payload);
+             layerList = removeLayerData(rsc);
+         }
+         else
+         {
+             markDiskAdded(rsc);
+-            ctrlLayerStackHelper.resetStoragePools(rsc);
++            ctrlLayerStackHelper.resetStoragePools(rsc, false);
+         }
+         ctrlLayerStackHelper.ensureStackDataExists(rsc, layerList, payload);
+ 
 diff --git a/controller/src/main/java/com/linbit/linstor/layer/resource/CtrlRscLayerDataFactory.java b/controller/src/main/java/com/linbit/linstor/layer/resource/CtrlRscLayerDataFactory.java
-index 3538b380c..4f589145e 100644
+index 3538b380c..f9733b6f1 100644
 --- a/controller/src/main/java/com/linbit/linstor/layer/resource/CtrlRscLayerDataFactory.java
 +++ b/controller/src/main/java/com/linbit/linstor/layer/resource/CtrlRscLayerDataFactory.java
-@@ -276,8 +276,6 @@ public class CtrlRscLayerDataFactory
-
+@@ -263,6 +263,11 @@ public class CtrlRscLayerDataFactory
+     }
+ 
+     public void resetStoragePools(Resource rscRef)
++    {
++        resetStoragePools(rscRef, true);
++    }
++
++    public void resetStoragePools(Resource rscRef, boolean callEnsureStackDataExistsRef)
+     {
+         try
+         {
+@@ -276,8 +281,10 @@ public class CtrlRscLayerDataFactory
+ 
                  rscDataToProcess.addAll(rscData.getChildren());
              }
 -
 -            ensureStackDataExists(rscRef, null, new LayerPayload());
++            if (callEnsureStackDataExistsRef)
++            {
++                ensureStackDataExists(rscRef, null, new LayerPayload());
++            }
          }
          catch (AccessDeniedException exc)
          {
---
-2.39.5 (Apple Git-154)
-
diff --git a/packages/system/linstor/images/piraeus-server/patches/fix-luks-header-size.diff b/packages/system/linstor/images/piraeus-server/patches/fix-luks-header-size.diff
new file mode 100644
index 00000000..8611825b
--- /dev/null
+++ b/packages/system/linstor/images/piraeus-server/patches/fix-luks-header-size.diff
@@ -0,0 +1,570 @@
+diff --git a/satellite/src/main/java/com/linbit/linstor/layer/storage/AbsStorageProvider.java b/satellite/src/main/java/com/linbit/linstor/layer/storage/AbsStorageProvider.java
+--- a/satellite/src/main/java/com/linbit/linstor/layer/storage/AbsStorageProvider.java
++++ b/satellite/src/main/java/com/linbit/linstor/layer/storage/AbsStorageProvider.java
+@@ -2081,7 +2081,6 @@ public abstract class AbsStorageProvider<
+     )
+         throws IOException, AccessDeniedException
+     {
+-        final StorPoolName storPoolObjName = storPoolObj.getName();
+         if (storDevicePath != null)
+         {
+             errorReporter.logDebug("updateMinIoSize: Have storDevicePath \"%s\"", storDevicePath);
+@@ -2094,35 +2093,18 @@ public abstract class AbsStorageProvider<
+                 "updateMinIoSize: Block device path is \"%s\"",
+                 blockDevicePath.toString()
+             );
+-            final long minIoSize = BlockSizeInfo.getBlockSize(blockDevicePath);
+-
+-            boolean updateValue = true;
+-
+-            final String propKey = StorageConstants.NAMESPACE_INTERNAL + '/' +
+-                StorageConstants.BLK_DEV_MIN_IO_SIZE;
+-            final Props storPoolProps = storPoolObj.getProps(storDriverAccCtx);
+-            final @Nullable String currentPropValue = storPoolProps.getProp(propKey);
+-            if (currentPropValue != null)
+-            {
+-                try
+-                {
+-                    final long currentPropMinIoSize = Long.parseLong(currentPropValue);
+-                    updateValue = currentPropMinIoSize != minIoSize;
+-                }
+-                catch (NumberFormatException ignored)
+-                {
+-                }
+-            }
+-
+-            if (updateValue)
+-            {
+-                final String propValue = Long.toString(minIoSize);
+-                errorReporter.logDebug(
+-                    "Storage pool \"%s\": Set property \"%s\" = \"%s\"",
+-                    storPoolObjName.displayValue, propKey, propValue
+-                );
+-                propsChange.changeStorPoolProp(storPoolObj, propKey, propValue);
+-            }
++            updatePropIfNeeded(
++                propsChange,
++                storPoolObj,
++                StorageConstants.NAMESPACE_INTERNAL + '/' + StorageConstants.BLK_DEV_MIN_IO_SIZE,
++                Long.toString(BlockSizeInfo.getBlockSize(blockDevicePath))
++            );
++            updatePropIfNeeded(
++                propsChange,
++                storPoolObj,
++                StorageConstants.NAMESPACE_INTERNAL + '/' + StorageConstants.BLK_DEV_OPT_IO_SIZE,
++                Long.toString(BlockSizeInfo.getOptimalIoSize(blockDevicePath))
++            );
+         }
+         else
+         {
+@@ -2130,6 +2112,28 @@ public abstract class AbsStorageProvider<
+         }
+     }
+
++    private void updatePropIfNeeded(
++        LocalPropsChangePojo propsChangeRef,
++        StorPool storPoolObjRef,
++        String propKeyRef,
++        String propValueRef
++    )
++        throws AccessDeniedException
++    {
++        final Props storPoolProps = storPoolObjRef.getProps(storDriverAccCtx);
++        final @Nullable String currentPropValue = storPoolProps.getProp(propKeyRef);
++        if (currentPropValue == null || !currentPropValue.equals(propValueRef))
++        {
++            errorReporter.logDebug(
++                "Storage pool \"%s\": Set property \"%s\" = \"%s\"",
++                storPoolObjRef.getName().displayValue,
++                propKeyRef,
++                propValueRef
++            );
++            propsChangeRef.changeStorPoolProp(storPoolObjRef, propKeyRef, propValueRef);
++        }
++    }
++
+     @SuppressWarnings("unchecked")
+     @Override
+     public void updateAllocatedSize(VlmProviderObject<Resource> vlmDataRef)
+diff --git a/satellite/src/main/java/com/linbit/linstor/layer/storage/utils/BlockSizeInfo.java b/satellite/src/main/java/com/linbit/linstor/layer/storage/utils/BlockSizeInfo.java
+--- a/satellite/src/main/java/com/linbit/linstor/layer/storage/utils/BlockSizeInfo.java
++++ b/satellite/src/main/java/com/linbit/linstor/layer/storage/utils/BlockSizeInfo.java
+@@ -3,8 +3,11 @@ package com.linbit.linstor.layer.storage.utils;
+ import com.linbit.utils.MathUtils;
+ import com.linbit.utils.SymbolicLinkResolver;
+
++import static com.linbit.linstor.layer.storage.BlockSizeConsts.DFLT_OPT_IO_SIZE;
+ import static com.linbit.linstor.layer.storage.BlockSizeConsts.DFLT_IO_SIZE;
++import static com.linbit.linstor.layer.storage.BlockSizeConsts.MAX_OPT_IO_SIZE;
+ import static com.linbit.linstor.layer.storage.BlockSizeConsts.MAX_IO_SIZE;
++import static com.linbit.linstor.layer.storage.BlockSizeConsts.MIN_OPT_IO_SIZE;
+ import static com.linbit.linstor.layer.storage.BlockSizeConsts.MIN_IO_SIZE;
+
+ import java.io.FileInputStream;
+@@ -13,6 +16,8 @@ import java.nio.file.Path;
+
+ public class BlockSizeInfo
+ {
++    private static final int NUMBER_BUFFER_SIZE = 32;
++
+     /**
+      * Determines the blocksize, aka minimum I/O size, for the specified backing storage path.
+      *
+@@ -51,7 +56,7 @@ public class BlockSizeInfo
+             final Path infoSourceName = blockDevice.getFileName();
+             final Path infoSource = Path.of("/sys/block", infoSourceName.toString(), "queue/physical_block_size");
+
+-            final byte[] data = new byte[32];
++            final byte[] data = new byte[NUMBER_BUFFER_SIZE];
+             try (final FileInputStream fileIn = new FileInputStream(infoSource.toString()))
+             {
+                 final int readCount = fileIn.read(data);
+@@ -75,4 +80,38 @@ public class BlockSizeInfo
+         }
+         return blockSize;
+     }
++
++    public static long getOptimalIoSize(final Path storageObj)
++    {
++        long optIoSize = DFLT_OPT_IO_SIZE;
++        try
++        {
++            final Path blockDevice = SymbolicLinkResolver.resolveSymLink(storageObj);
++            final Path infoSourceName = blockDevice.getFileName();
++            final Path infoSource = Path.of("/sys/block", infoSourceName.toString(), "queue/optimal_io_size");
++
++            final byte[] data = new byte[NUMBER_BUFFER_SIZE];
++            try (final FileInputStream fileIn = new FileInputStream(infoSource.toString()))
++            {
++                final int readCount = fileIn.read(data);
++                if (readCount > 0)
++                {
++                    String numberStr = new String(data, 0, readCount);
++                    numberStr = numberStr.trim();
++                    try
++                    {
++                        final long unboundedOptIoSize = Long.parseLong(numberStr);
++                        optIoSize = MathUtils.bounds(MIN_OPT_IO_SIZE, unboundedOptIoSize, MAX_OPT_IO_SIZE);
++                    }
++                    catch (NumberFormatException ignored)
++                    {
++                    }
++                }
++            }
++        }
++        catch (IOException ignored)
++        {
++        }
++        return optIoSize;
++    }
+ }
+diff --git a/server/src/main/java/com/linbit/SizeConv.java b/server/src/main/java/com/linbit/SizeConv.java
+--- a/server/src/main/java/com/linbit/SizeConv.java
++++ b/server/src/main/java/com/linbit/SizeConv.java
+@@ -16,6 +16,7 @@ public class SizeConv
+     public enum SizeUnit
+     {
+         UNIT_B,
++        UNIT_SECTORS,
+         UNIT_KiB,
+         UNIT_MiB,
+         UNIT_GiB,
+@@ -41,6 +42,9 @@ public class SizeConv
+                 case UNIT_B:
+                     factor = FACTOR_B;
+                     break;
++                case UNIT_SECTORS:
++                    factor = FACTOR_SECTORS;
++                    break;
+                 case UNIT_KiB:
+                     factor = FACTOR_KiB;
+                     break;
+@@ -111,6 +115,9 @@ public class SizeConv
+                 case "b":
+                     unit = SizeUnit.UNIT_B;
+                     break;
++                case "s":
++                    unit = SizeUnit.UNIT_SECTORS;
++                    break;
+                 case "k":
+                     // fall-through
+                 case "kb":
+@@ -217,6 +224,9 @@ public class SizeConv
+     // Factor 1
+     public static final BigInteger FACTOR_B   = BigInteger.valueOf(1L);
+
++    // Factor 512
++    public static final BigInteger FACTOR_SECTORS = BigInteger.valueOf(512L);
++
+     // Factor 1,024
+     // Naming convention exception: SI unit capitalization rules
+     @SuppressWarnings("checkstyle:constantname")
+diff --git a/server/src/main/java/com/linbit/linstor/layer/luks/LuksLayerSizeCalculator.java b/server/src/main/java/com/linbit/linstor/layer/luks/LuksLayerSizeCalculator.java
+--- a/server/src/main/java/com/linbit/linstor/layer/luks/LuksLayerSizeCalculator.java
++++ b/server/src/main/java/com/linbit/linstor/layer/luks/LuksLayerSizeCalculator.java
+@@ -1,27 +1,62 @@
+ package com.linbit.linstor.layer.luks;
+
++import com.linbit.SizeConv;
++import com.linbit.SizeConv.SizeUnit;
+ import com.linbit.exceptions.InvalidSizeException;
++import com.linbit.linstor.PriorityProps;
++import com.linbit.linstor.annotation.Nullable;
++import com.linbit.linstor.api.ApiConsts;
++import com.linbit.linstor.core.objects.AbsResource;
++import com.linbit.linstor.core.objects.AbsVolume;
++import com.linbit.linstor.core.objects.Resource;
++import com.linbit.linstor.core.objects.ResourceDefinition;
++import com.linbit.linstor.core.objects.ResourceGroup;
++import com.linbit.linstor.core.objects.Snapshot;
++import com.linbit.linstor.core.objects.SnapshotVolume;
++import com.linbit.linstor.core.objects.StorPool;
++import com.linbit.linstor.core.objects.Volume;
++import com.linbit.linstor.core.objects.VolumeDefinition;
+ import com.linbit.linstor.dbdrivers.DatabaseException;
+ import com.linbit.linstor.layer.AbsLayerSizeCalculator;
++import com.linbit.linstor.netcom.Peer;
++import com.linbit.linstor.propscon.InvalidKeyException;
++import com.linbit.linstor.propscon.ReadOnlyProps;
+ import com.linbit.linstor.security.AccessDeniedException;
++import com.linbit.linstor.storage.StorageConstants;
+ import com.linbit.linstor.storage.data.adapter.luks.LuksVlmData;
+ import com.linbit.linstor.storage.interfaces.categories.resource.VlmProviderObject;
+ import com.linbit.linstor.storage.kinds.DeviceLayerKind;
+ import com.linbit.linstor.storage.kinds.ExtTools;
+ import com.linbit.linstor.storage.kinds.ExtToolsInfo;
+ import com.linbit.linstor.storage.kinds.ExtToolsInfo.Version;
++import com.linbit.linstor.utils.layer.LayerVlmUtils;
++import com.linbit.utils.ShellUtils;
++import com.linbit.utils.SignedAlign;
+
+ import javax.inject.Inject;
+ import javax.inject.Singleton;
+
++import java.util.Iterator;
++import java.util.LinkedList;
++import java.util.List;
++import java.util.Set;
++import java.util.regex.Matcher;
++import java.util.regex.Pattern;
++
+ @Singleton
+ public class LuksLayerSizeCalculator extends AbsLayerSizeCalculator<LuksVlmData<?>>
+ {
++    public static final String LUKS2_OPT_METADATA_SIZE = "--luks2-metadata-size";
++    public static final String LUKS2_OPT_KEYSLOTS_SIZE = "--luks2-keyslots-size";
++    public static final String LUKS2_OPT_OFFSET = "--offset";
++    private static final String LUKS2_OPT_ALIGN_PAYLOAD = "--align-payload";
++    private static final long DFLT_LUKS2_METADATA_SIZE_IN_BYTES = 16L << 10;
++    private static final long DFLT_ALIGNMENT_1MIB_IN_BYTES = 1L << 20;
++    private static final long LUKS1_HEADER_SIZE_IN_KIB = 2L << 10;
++    private static final long LUKS2_HEADER_SIZE_IN_KIB = 16L << 10;
++    private static final long LUKS2_HEADER_SIZE_IN_BYTES = LUKS2_HEADER_SIZE_IN_KIB << 10;
+
+-    // linstor calculates in KiB
+-    private static final int MIB = 1024;
+-    private static final int LUKS1_HEADER_SIZE = 2 * MIB;
+-    private static final int LUKS2_HEADER_SIZE = 16 * MIB;
++    private static final Pattern PATTERN_SIZE = Pattern.compile("(\\d+)([kKmMgGtT]i?[bB]?|[sS]|)");
+
+     @Inject
+     public LuksLayerSizeCalculator(AbsLayerSizeCalculatorInit initRef)
+@@ -74,30 +109,266 @@ public class LuksLayerSizeCalculator extends AbsLayerSizeCalculator<LuksVlmData<
+     }
+
+     private long getLuksHeaderSize(VlmProviderObject<?> vlmDataRef)
+-        throws AccessDeniedException
++        throws AccessDeniedException, InvalidSizeException
+     {
+-        ExtToolsInfo cryptSetupInfo = vlmDataRef.getRscLayerObject()
++        @Nullable Peer peer = vlmDataRef.getRscLayerObject()
+             .getAbsResource()
+             .getNode()
+-            .getPeer(sysCtx)
+-            .getExtToolsManager()
++            .getPeer(sysCtx);
++        if (peer == null)
++        {
++            throw new InvalidSizeException(
++                "Could not calculate size of LUKS volume, since cryptsetup's version could not be determined",
++                null
++            );
++        }
++        ExtToolsInfo cryptSetupInfo = peer.getExtToolsManager()
+             .getExtToolInfo(ExtTools.CRYPT_SETUP);
+-        long luksHeaderSize;
++
++        final long luksHeaderSize;
+         if (cryptSetupInfo != null && cryptSetupInfo.isSupported())
+         {
+             if (cryptSetupInfo.hasVersionOrHigher(new Version(2, 1)))
+             {
+-                luksHeaderSize = LUKS2_HEADER_SIZE;
++                luksHeaderSize = calcLuks2HeaderSize(vlmDataRef);
+             }
+             else
+             {
+-                luksHeaderSize = LUKS1_HEADER_SIZE;
++                luksHeaderSize = LUKS1_HEADER_SIZE_IN_KIB;
+             }
+         }
+         else
+         {
+-            luksHeaderSize = -1;
++            throw new InvalidSizeException(
++                "Could not calculate size of LUKS volume, since cryptsetup's version could not be determined",
++                null
++            );
+         }
+         return luksHeaderSize;
+     }
++
++    private long calcLuks2HeaderSize(VlmProviderObject<?> vlmDataRef) throws AccessDeniedException
++    {
++        PriorityProps prioProps = getPrioProps(vlmDataRef);
++
++        final @Nullable String userOptProp = prioProps.getProp(
++            ApiConsts.KEY_STOR_DRIVER_LUKS_FORMAT_OPTIONS,
++            ApiConsts.NAMESPC_STORAGE_DRIVER
++        );
++        List<String> userOptions = userOptProp != null ?
++            ShellUtils.shellSplit(userOptProp) :
++            new LinkedList<>();
++
++        final long alignedHeaderSizeInBytes;
++        final long unalignedHeaderSizeInBytes;
++        @Nullable Long cryptsetupOffsetInBytes = getLongOptionValue(
++            userOptions,
++            LUKS2_OPT_OFFSET,
++            SizeUnit.UNIT_SECTORS
++        );
++        if (cryptsetupOffsetInBytes != null)
++        {
++            alignedHeaderSizeInBytes = cryptsetupOffsetInBytes;
++        }
++        else
++        {
++            @Nullable Long cryptsetupLuks2KeyslotsSize = getLongOptionValue(
++                userOptions,
++                LUKS2_OPT_KEYSLOTS_SIZE
++            );
++            if (cryptsetupLuks2KeyslotsSize == null)
++            {
++                unalignedHeaderSizeInBytes = LUKS2_HEADER_SIZE_IN_BYTES;
++            }
++            else
++            {
++                @Nullable Long cryptsetupLuks2MetadataSize = getLongOptionValue(
++                    userOptions,
++                    LUKS2_OPT_METADATA_SIZE
++                );
++                cryptsetupLuks2MetadataSize = cryptsetupLuks2MetadataSize == null ?
++                    DFLT_LUKS2_METADATA_SIZE_IN_BYTES :
++                    cryptsetupLuks2MetadataSize;
++
++                unalignedHeaderSizeInBytes = 2 * cryptsetupLuks2MetadataSize + cryptsetupLuks2KeyslotsSize;
++            }
++
++            long alignment = getAlignment(vlmDataRef, userOptions);
++            alignedHeaderSizeInBytes = new SignedAlign(alignment).ceiling(unalignedHeaderSizeInBytes);
++        }
++        return SizeConv.convert(
++            alignedHeaderSizeInBytes,
++            SizeUnit.UNIT_B,
++            SizeUnit.UNIT_KiB
++        );
++    }
++
++    private long getAlignment(VlmProviderObject<?> vlmDataRef, List<String> userOptions) throws AccessDeniedException
++    {
++        @Nullable Long cryptsetupAlignPayloadInBytes = getLongOptionValue(
++            userOptions,
++            LUKS2_OPT_ALIGN_PAYLOAD,
++            SizeUnit.UNIT_SECTORS
++        );
++
++        long alignment = DFLT_ALIGNMENT_1MIB_IN_BYTES;
++        if (cryptsetupAlignPayloadInBytes != null)
++        {
++            alignment = cryptsetupAlignPayloadInBytes;
++        }
++        else
++        {
++            final long maxOptIoSize = getMaxOptIoSize(vlmDataRef);
++            alignment = Math.max(alignment, maxOptIoSize);
++        }
++        return alignment;
++    }
++
++    private long getMaxOptIoSize(VlmProviderObject<?> vlmDataRef) throws InvalidKeyException, AccessDeniedException
++    {
++        long ret = 0;
++        Set<StorPool> storPoolSet = LayerVlmUtils.getStorPoolSet(vlmDataRef, sysCtx);
++        for (StorPool sp : storPoolSet)
++        {
++            @Nullable String strValue = sp.getProps(sysCtx)
++                .getProp(
++                    StorageConstants.BLK_DEV_OPT_IO_SIZE,
++                    StorageConstants.NAMESPACE_INTERNAL
++                );
++            if (strValue != null)
++            {
++                try
++                {
++                    long parsed = Long.parseLong(strValue);
++                    ret = Math.max(parsed, ret);
++                }
++                catch (NumberFormatException ignored)
++                {
++                    errorReporter.logWarning(
++                        "LuksHeaderSize: Failed to parse '%s' from prop %s. Defaulting to 0 opt_io_size " +
++                            "(no recommendation/hint)",
++                        strValue,
++                        StorageConstants.NAMESPACE_INTERNAL + "/" + StorageConstants.BLK_DEV_OPT_IO_SIZE
++                    );
++                }
++            }
++        }
++        return ret;
++    }
++
++    private @Nullable Long getLongOptionValue(List<String> userOptionsRef, String optRef)
++    {
++        return getLongOptionValue(userOptionsRef, optRef, SizeUnit.UNIT_B);
++    }
++
++    @SuppressWarnings("checkstyle:magicnumber")
++    private @Nullable Long getLongOptionValue(List<String> userOptionsRef, String optRef, SizeUnit dfltSizeUnit)
++    {
++        @Nullable Long ret = null;
++        @Nullable String val = findLastValue(userOptionsRef, optRef);
++        if (val != null && !val.isBlank())
++        {
++            Matcher matcher = PATTERN_SIZE.matcher(val);
++            if (matcher.matches())
++            {
++                try
++                {
++                    ret = Long.parseLong(matcher.group(1));
++                    String unit = matcher.group(2);
++                    SizeUnit sizeUnit;
++                    if (unit.isBlank())
++                    {
++                        sizeUnit = dfltSizeUnit;
++                    }
++                    else
++                    {
++                        boolean forcePowerOfTwo = unit.length() == 1 || unit.length() == 3;
++                        sizeUnit = SizeUnit.parse(unit, forcePowerOfTwo);
++                    }
++
++                    ret = SizeConv.convert(ret, sizeUnit, SizeUnit.UNIT_B);
++                }
++                catch (NumberFormatException ignored)
++                {
++                    errorReporter.logWarning(
++                        "LuksHeaderSize: Failed to parse '%s' from option '%s %s'.",
++                        matcher.group(1),
++                        optRef,
++                        val
++                    );
++                }
++            }
++        }
++        return ret;
++    }
++
++    private @Nullable String findLastValue(List<String> userOptionsRef, String optRef)
++    {
++        Iterator<String> it = userOptionsRef.iterator();
++        @Nullable String val = null;
++        while (it.hasNext())
++        {
++            String opt = it.next();
++            if (opt.equals(optRef))
++            {
++                if (it.hasNext())
++                {
++                    val = it.next();
++                }
++                else
++                {
++                    val = null;
++                }
++            }
++            else if (opt.startsWith(optRef + "="))
++            {
++                val = opt.substring(optRef.length() + 1);
++                if (val.isBlank())
++                {
++                    val = null;
++                }
++            }
++        }
++        return val;
++    }
++
++    private PriorityProps getPrioProps(VlmProviderObject<?> vlmDataRef) throws AccessDeniedException
++    {
++        final AbsVolume<?> vlm = vlmDataRef.getVolume();
++        final AbsResource<?> rsc = vlm.getAbsResource();
++        final ResourceDefinition rscDfn = vlm.getResourceDefinition();
++        final VolumeDefinition vlmDfn = vlm.getVolumeDefinition();
++        final ResourceGroup rscGrp = rscDfn.getResourceGroup();
++
++        final ReadOnlyProps vlmProps;
++        final ReadOnlyProps rscProps;
++        if (vlm instanceof Volume)
++        {
++            vlmProps = ((Volume) vlm).getProps(sysCtx);
++            rscProps = ((Resource) rsc).getProps(sysCtx);
++        }
++        else
++        {
++            vlmProps = ((SnapshotVolume) vlm).getVlmProps(sysCtx);
++            rscProps = ((Snapshot) rsc).getRscProps(sysCtx);
++        }
++
++        final PriorityProps prioProps = new PriorityProps(
++            vlmProps,
++            rscProps
++        );
++        for (StorPool storPool : LayerVlmUtils.getStorPoolSet(vlmDataRef, sysCtx))
++        {
++            prioProps.addProps(storPool.getProps(sysCtx));
++        }
++        prioProps.addProps(
++            rsc.getNode().getProps(sysCtx),
++            vlmDfn.getProps(sysCtx),
++            rscDfn.getProps(sysCtx),
++            rscGrp.getVolumeGroupProps(sysCtx, vlmDfn.getVolumeNumber()),
++            rscGrp.getProps(sysCtx),
++            stltProps
++        );
++        return prioProps;
++    }
+ }
+diff --git a/server/src/main/java/com/linbit/linstor/layer/storage/BlockSizeConsts.java b/server/src/main/java/com/linbit/linstor/layer/storage/BlockSizeConsts.java
+--- a/server/src/main/java/com/linbit/linstor/layer/storage/BlockSizeConsts.java
++++ b/server/src/main/java/com/linbit/linstor/layer/storage/BlockSizeConsts.java
+@@ -13,4 +13,9 @@ public class BlockSizeConsts
+
+     // Default value for the minimum_io_size value of non-storage layers
+     public static final long DFLT_SPECIAL_IO_SIZE   = (1L << 12);
++
++    // optimal_io_size may be 0 to indicate no recommendation.
++    public static final long MIN_OPT_IO_SIZE = 0;
++    public static final long DFLT_OPT_IO_SIZE = 0;
++    public static final long MAX_OPT_IO_SIZE = Long.MAX_VALUE;
+ }
+diff --git a/server/src/main/java/com/linbit/linstor/storage/StorageConstants.java b/server/src/main/java/com/linbit/linstor/storage/StorageConstants.java
+--- a/server/src/main/java/com/linbit/linstor/storage/StorageConstants.java
++++ b/server/src/main/java/com/linbit/linstor/storage/StorageConstants.java
+@@ -11,6 +11,7 @@ public class StorageConstants
+     public static final String NAMESPACE_NVME = ApiConsts.NAMESPC_STORAGE_DRIVER + "/NVME";
+     public static final String NAMESPACE_INTERNAL = NAMESPACE_STOR_DRIVER + "/internal/";
+
++    public static final String BLK_DEV_OPT_IO_SIZE      = "optIoSize";
+     public static final String BLK_DEV_MIN_IO_SIZE      = "minIoSize";
+     public static final String BLK_DEV_MIN_IO_SIZE_AUTO = "minIoSizeAuto";
+     public static final String BLK_DEV_MAX_BIO_SIZE     = "maxBioSize";
diff --git a/packages/system/linstor/images/piraeus-server/patches/force-metadata-check-on-disk-add.diff b/packages/system/linstor/images/piraeus-server/patches/force-metadata-check-on-disk-add.diff
deleted file mode 100644
index 0c413005..00000000
--- a/packages/system/linstor/images/piraeus-server/patches/force-metadata-check-on-disk-add.diff
+++ /dev/null
@@ -1,63 +0,0 @@
-diff --git a/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java b/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java
-index a302ee835..01967a31f 100644
---- a/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java
-+++ b/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java
-@@ -371,10 +371,13 @@ public class DrbdLayer implements DeviceLayer
-         boolean isDiskless = drbdRscData.getAbsResource().isDrbdDiskless(workerCtx);
-         StateFlags<Flags> rscFlags = drbdRscData.getAbsResource().getStateFlags();
-         boolean isDiskRemoving = rscFlags.isSet(workerCtx, Resource.Flags.DISK_REMOVING);
-+        // Check if we're in toggle-disk operation (adding disk to diskless resource)
-+        boolean isDiskAdding = rscFlags.isSomeSet(workerCtx, Resource.Flags.DISK_ADD_REQUESTED, Resource.Flags.DISK_ADDING);
- 
-         boolean contProcess = isDiskless;
- 
--        boolean processChildren = !isDiskless || isDiskRemoving;
-+        // Process children when: has disk, removing disk, OR adding disk (toggle-disk)
-+        boolean processChildren = !isDiskless || isDiskRemoving || isDiskAdding;
-         // do not process children when ONLY DRBD_DELETE flag is set (DELETE flag is still unset)
-         processChildren &= (!rscFlags.isSet(workerCtx, Resource.Flags.DRBD_DELETE) ||
-             rscFlags.isSet(workerCtx, Resource.Flags.DELETE));
-@@ -570,7 +573,11 @@ public class DrbdLayer implements DeviceLayer
-         {
-             // hasMetaData needs to be run after child-resource processed
-             List<DrbdVlmData<Resource>> createMetaData = new ArrayList<>();
--            if (!drbdRscData.getAbsResource().isDrbdDiskless(workerCtx) && !skipDisk)
-+            // Check if we're in toggle-disk operation (adding disk to diskless resource)
-+            boolean isDiskAddingForMd = drbdRscData.getAbsResource().getStateFlags()
-+                .isSomeSet(workerCtx, Resource.Flags.DISK_ADD_REQUESTED, Resource.Flags.DISK_ADDING);
-+            // Create metadata when: has disk OR adding disk (toggle-disk), and skipDisk is disabled
-+            if ((!drbdRscData.getAbsResource().isDrbdDiskless(workerCtx) || isDiskAddingForMd) && !skipDisk)
-             {
-                 // do not try to create meta data while the resource is diskless or skipDisk is enabled
-                 for (DrbdVlmData<Resource> drbdVlmData : checkMetaData)
-@@ -988,8 +995,10 @@ public class DrbdLayer implements DeviceLayer
-     {
-         List<DrbdVlmData<Resource>> checkMetaData = new ArrayList<>();
-         Resource rsc = drbdRscData.getAbsResource();
-+        // Include DISK_ADD_REQUESTED/DISK_ADDING for toggle-disk scenario where we need to check/create metadata
-         if (!rsc.isDrbdDiskless(workerCtx) ||
--            rsc.getStateFlags().isSet(workerCtx, Resource.Flags.DISK_REMOVING)
-+            rsc.getStateFlags().isSet(workerCtx, Resource.Flags.DISK_REMOVING) ||
-+            rsc.getStateFlags().isSomeSet(workerCtx, Resource.Flags.DISK_ADD_REQUESTED, Resource.Flags.DISK_ADDING)
-         )
-         {
-             // using a dedicated list to prevent concurrentModificationException
-@@ -1177,9 +1186,16 @@ public class DrbdLayer implements DeviceLayer
- 
-         boolean hasMetaData;
- 
-+        // Check if we need to verify/create metadata
-+        // Force metadata check when:
-+        // 1. checkMetaData is enabled
-+        // 2. volume doesn't have disk yet (diskless -> diskful transition)
-+        // 3. DISK_ADD_REQUESTED/DISK_ADDING flag is set (retry scenario where storage exists but no metadata)
-+        boolean isDiskAddingState = drbdVlmData.getRscLayerObject().getAbsResource().getStateFlags()
-+            .isSomeSet(workerCtx, Resource.Flags.DISK_ADD_REQUESTED, Resource.Flags.DISK_ADDING);
-         if (drbdVlmData.checkMetaData() ||
--            // when adding a disk, DRBD believes that it is diskless but we still need to create metadata
--            !drbdVlmData.hasDisk())
-+            !drbdVlmData.hasDisk() ||
-+            isDiskAddingState)
-         {
-             if (mdUtils.hasMetaData())
-             {
diff --git a/packages/system/linstor/images/piraeus-server/patches/skip-adjust-when-device-inaccessible.diff b/packages/system/linstor/images/piraeus-server/patches/skip-adjust-when-device-inaccessible.diff
deleted file mode 100644
index a93d7811..00000000
--- a/packages/system/linstor/images/piraeus-server/patches/skip-adjust-when-device-inaccessible.diff
+++ /dev/null
@@ -1,155 +0,0 @@
-diff --git a/satellite/src/main/java/com/linbit/linstor/core/devmgr/DeviceHandlerImpl.java b/satellite/src/main/java/com/linbit/linstor/core/devmgr/DeviceHandlerImpl.java
-index 49138a8fd..2f768ca0d 100644
---- a/satellite/src/main/java/com/linbit/linstor/core/devmgr/DeviceHandlerImpl.java
-+++ b/satellite/src/main/java/com/linbit/linstor/core/devmgr/DeviceHandlerImpl.java
-@@ -83,6 +83,8 @@ import java.util.TreeMap;
- import java.util.TreeSet;
- import java.util.concurrent.atomic.AtomicBoolean;
- import java.util.function.Function;
-+import java.nio.file.Files;
-+import java.nio.file.Paths;
- 
- @Singleton
- public class DeviceHandlerImpl implements DeviceHandler
-@@ -1646,7 +1648,10 @@ public class DeviceHandlerImpl implements DeviceHandler
-     private void updateDiscGran(VlmProviderObject<Resource> vlmData) throws DatabaseException, StorageException
-     {
-         String devicePath = vlmData.getDevicePath();
--        if (devicePath != null && vlmData.exists())
-+        // Check if device path physically exists before calling lsblk
-+        // This is important for DRBD devices which might be temporarily unavailable during adjust
-+        // (drbdadm adjust brings devices down/up, and kernel might not have created the device node yet)
-+        if (devicePath != null && vlmData.exists() && Files.exists(Paths.get(devicePath)))
-         {
-             if (vlmData.getDiscGran() == VlmProviderObject.UNINITIALIZED_SIZE)
-             {
-diff --git a/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java b/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java
-index 01967a31f..78b8195a4 100644
---- a/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java
-+++ b/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java
-@@ -592,7 +592,29 @@ public class DrbdLayer implements DeviceLayer
-             // The .res file might not have been generated in the prepare method since it was
-             // missing information from the child-layers. Now that we have processed them, we
-             // need to make sure the .res file exists in all circumstances.
--            regenerateResFile(drbdRscData);
-+            // However, if the underlying devices are not accessible (e.g., LUKS device is closed
-+            // during resource deletion), we skip regenerating the res file to avoid errors
-+            boolean canRegenerateResFile = true;
-+            if (!skipDisk && !drbdRscData.getAbsResource().isDrbdDiskless(workerCtx))
-+            {
-+                AbsRscLayerObject<Resource> dataChild = drbdRscData.getChildBySuffix(RscLayerSuffixes.SUFFIX_DATA);
-+                if (dataChild != null)
-+                {
-+                    for (DrbdVlmData<Resource> drbdVlmData : drbdRscData.getVlmLayerObjects().values())
-+                    {
-+                        VlmProviderObject<Resource> childVlm = dataChild.getVlmProviderObject(drbdVlmData.getVlmNr());
-+                        if (childVlm == null || !childVlm.exists() || childVlm.getDevicePath() == null)
-+                        {
-+                            canRegenerateResFile = false;
-+                            break;
-+                        }
-+                    }
-+                }
-+            }
-+            if (canRegenerateResFile)
-+            {
-+                regenerateResFile(drbdRscData);
-+            }
- 
-             // createMetaData needs rendered resFile
-             for (DrbdVlmData<Resource> drbdVlmData : createMetaData)
-@@ -766,19 +788,72 @@ public class DrbdLayer implements DeviceLayer
- 
-                 if (drbdRscData.isAdjustRequired())
-                 {
--                    try
-+                    // Check if underlying devices are accessible before adjusting
-+                    // This is important for encrypted resources (LUKS) where the device
-+                    // might be closed during deletion
-+                    boolean canAdjust = true;
-+
-+                    // IMPORTANT: Check child volumes only when disk access is actually needed.
-+                    // For network reconnect (StandAlone -> Connected), disk access is not required.
-+                    boolean needsDiskAccess = false;
-+
-+                    // Check if there are pending operations that require disk access
-+                    for (DrbdVlmData<Resource> drbdVlmData : drbdRscData.getVlmLayerObjects().values())
-                     {
--                        drbdUtils.adjust(
--                            drbdRscData,
--                            false,
--                            skipDisk,
--                            false
--                        );
-+                        Volume vlm = (Volume) drbdVlmData.getVolume();
-+                        StateFlags<Volume.Flags> vlmFlags = vlm.getFlags();
-+
-+                        // Disk access is needed if:
-+                        // - creating a new volume
-+                        // - resizing
-+                        // - checking/creating metadata
-+                        if (!drbdVlmData.exists() ||
-+                            drbdVlmData.checkMetaData() ||
-+                            vlmFlags.isSomeSet(workerCtx, Volume.Flags.RESIZE, Volume.Flags.DRBD_RESIZE))
-+                        {
-+                            needsDiskAccess = true;
-+                            break;
-+                        }
-+                    }
-+
-+                    // Check child volumes only if disk access is actually needed
-+                    if (needsDiskAccess && !skipDisk && !drbdRscData.getAbsResource().isDrbdDiskless(workerCtx))
-+                    {
-+                        AbsRscLayerObject<Resource> dataChild = drbdRscData.getChildBySuffix(RscLayerSuffixes.SUFFIX_DATA);
-+                        if (dataChild != null)
-+                        {
-+                            for (DrbdVlmData<Resource> drbdVlmData : drbdRscData.getVlmLayerObjects().values())
-+                            {
-+                                VlmProviderObject<Resource> childVlm = dataChild.getVlmProviderObject(drbdVlmData.getVlmNr());
-+                                if (childVlm == null || !childVlm.exists() || childVlm.getDevicePath() == null)
-+                                {
-+                                    canAdjust = false;
-+                                    break;
-+                                }
-+                            }
-+                        }
-                     }
--                    catch (ExtCmdFailedException extCmdExc)
-+
-+                    if (canAdjust)
-+                    {
-+                        try
-+                        {
-+                            drbdUtils.adjust(
-+                                drbdRscData,
-+                                false,
-+                                skipDisk,
-+                                false
-+                            );
-+                        }
-+                        catch (ExtCmdFailedException extCmdExc)
-+                        {
-+                            restoreBackupResFile(drbdRscData);
-+                            throw extCmdExc;
-+                        }
-+                    }
-+                    else
-                     {
--                        restoreBackupResFile(drbdRscData);
--                        throw extCmdExc;
-+                        drbdRscData.setAdjustRequired(false);
-                     }
-                 }
- 
-diff --git a/satellite/src/main/java/com/linbit/linstor/layer/luks/LuksLayer.java b/satellite/src/main/java/com/linbit/linstor/layer/luks/LuksLayer.java
-index cdca0b6d2..89c8be9da 100644
---- a/satellite/src/main/java/com/linbit/linstor/layer/luks/LuksLayer.java
-+++ b/satellite/src/main/java/com/linbit/linstor/layer/luks/LuksLayer.java
-@@ -383,6 +383,7 @@ public class LuksLayer implements DeviceLayer
-                 vlmData.setSizeState(Size.AS_EXPECTED);
- 
-                 vlmData.setOpened(true);
-+                vlmData.setExists(true);
-                 vlmData.setFailed(false);
-             }
-         }

From fd6bae62b2ea9a353230637ac2b717c473d7de7d Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Fri, 3 Apr 2026 21:50:52 +0200
Subject: [PATCH 379/666] linstor: add stale bitmap adjust retry patch

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../images/piraeus-server/patches/README.md   |   3 +
 .../retry-adjust-after-stale-bitmap.diff      | 141 ++++++++++++++++++
 2 files changed, 144 insertions(+)
 create mode 100644 packages/system/linstor/images/piraeus-server/patches/retry-adjust-after-stale-bitmap.diff

diff --git a/packages/system/linstor/images/piraeus-server/patches/README.md b/packages/system/linstor/images/piraeus-server/patches/README.md
index db497b7e..47e5f635 100644
--- a/packages/system/linstor/images/piraeus-server/patches/README.md
+++ b/packages/system/linstor/images/piraeus-server/patches/README.md
@@ -12,3 +12,6 @@ Custom patches for piraeus-server (linstor-server) v1.33.1.
   - Source PR/comment: [#472](https://github.com/LINBIT/linstor-server/pull/472), [maintainer note](https://github.com/LINBIT/linstor-server/pull/472#issuecomment-3949687603)
   - Backported from commits: [`ccc85fbd2`](https://github.com/LINBIT/linstor-server/commit/ccc85fbd2c65f0b97c52403fa80f1efdb886ec4e), [`71b601554`](https://github.com/LINBIT/linstor-server/commit/71b601554f41bcb50cd5bd06989c5b0d3a814acd)
   - Note: upstream commit [`3d0402a0c`](https://github.com/LINBIT/linstor-server/commit/3d0402a0c25f0a4b57b380321f10e89982f26e7a) is already included in `v1.33.1`
+- **retry-adjust-after-stale-bitmap.diff** — Retry `drbdadm adjust` after detaching a stale local bitmap state
+  - Source PR: [#491](https://github.com/LINBIT/linstor-server/pull/491)
+  - Backported from commit: [`51ae50a84`](https://github.com/kvaps/linstor-server/commit/51ae50a84dcb98093f543b819652c750a94d96c9)
diff --git a/packages/system/linstor/images/piraeus-server/patches/retry-adjust-after-stale-bitmap.diff b/packages/system/linstor/images/piraeus-server/patches/retry-adjust-after-stale-bitmap.diff
new file mode 100644
index 00000000..00959167
--- /dev/null
+++ b/packages/system/linstor/images/piraeus-server/patches/retry-adjust-after-stale-bitmap.diff
@@ -0,0 +1,141 @@
+diff --git a/satellite/src/main/java/com/linbit/linstor/layer/drbd/utils/DrbdAdm.java b/satellite/src/main/java/com/linbit/linstor/layer/drbd/utils/DrbdAdm.java
+index 5627d1be8..ece191292 100644
+--- a/satellite/src/main/java/com/linbit/linstor/layer/drbd/utils/DrbdAdm.java
++++ b/satellite/src/main/java/com/linbit/linstor/layer/drbd/utils/DrbdAdm.java
+@@ -42,6 +42,9 @@ import java.util.Arrays;
+ import java.util.List;
+ import java.util.concurrent.ArrayBlockingQueue;
+ import java.util.concurrent.TimeUnit;
++import java.nio.charset.StandardCharsets;
++import java.util.regex.Matcher;
++import java.util.regex.Pattern;
+ import java.util.stream.Collectors;
+ 
+ @Singleton
+@@ -56,6 +58,9 @@ public class DrbdAdm
+ 
+     public static final int WAIT_CONNECT_RES_TIME = 10;
+     private static final long DOWN_WAIT_TIMEOUT_SEC = 5;
++    private static final long FORCE_DETACH_RETRY_WAIT_MS = 250;
++    private static final String BITMAP_LEAK_ERR_MSG = "already has a bitmap, this should not happen";
++    private static final Pattern BITMAP_LEAK_MINOR_PATTERN = Pattern.compile("\\bminor\\s+(\\d+)\\b");
+ 
+     private final ExtCmdFactory extCmdFactory;
+     private final AccessContext sysCtx;
+@@ -131,8 +136,38 @@ public class DrbdAdm
+         // command.add(resName);
+         command.add(drbdRscData.getSuffixedResourceName());
+         // execute(Arrays.asList("drbdsetup", "show", drbdRscData.getSuffixedResourceName()));
+-        execute(command);
+-        // execute(Arrays.asList("drbdsetup", "show", drbdRscData.getSuffixedResourceName()));
++        String[] commandArr = command.toArray(new String[0]);
++        try
++        {
++            File nullDevice = new File(Platform.nullDevice());
++            ExtCmd extCmd = extCmdFactory.create();
++            if (Platform.isWindows())
++            {
++                extCmd.setTimeout(TimeoutType.WAIT, 5 * 60 * 1000);
++            }
++
++            OutputData outputData = extCmd.pipeExec(ProcessBuilder.Redirect.from(nullDevice), commandArr);
++            if (
++                outputData.exitCode != 0 &&
++                isBitmapLeakOnAttach(outputData) &&
++                cleanupStaleBitmapAndRetry(extCmd, nullDevice, outputData)
++            )
++            {
++                outputData = extCmd.pipeExec(ProcessBuilder.Redirect.from(nullDevice), commandArr);
++            }
++            if (outputData.exitCode != 0)
++            {
++                throw new ExtCmdFailedException(commandArr, outputData);
++            }
++        }
++        catch (ChildProcessTimeoutException timeoutExc)
++        {
++            throw new ExtCmdFailedException(commandArr, timeoutExc);
++        }
++        catch (IOException ioExc)
++        {
++            throw new ExtCmdFailedException(commandArr, ioExc);
++        }
+ 
+         drbdRscData.setAdjustRequired(false);
+     }
+@@ -805,6 +840,75 @@ public class DrbdAdm
+         }
+     }
+ 
++    static boolean isBitmapLeakOnAttach(OutputData outputData)
++    {
++        return extractBitmapLeakMinor(outputData) != null;
++    }
++
++    static @Nullable Integer extractBitmapLeakMinor(OutputData outputData)
++    {
++        String stderr = new String(outputData.stderrData, StandardCharsets.UTF_8);
++        if (!stderr.contains(BITMAP_LEAK_ERR_MSG))
++        {
++            return null;
++        }
++
++        Matcher matcher = BITMAP_LEAK_MINOR_PATTERN.matcher(stderr);
++        if (!matcher.find())
++        {
++            return null;
++        }
++
++        return Integer.parseInt(matcher.group(1));
++    }
++
++    private boolean cleanupStaleBitmapAndRetry(
++        ExtCmd extCmd,
++        File nullDevice,
++        OutputData outputData
++    )
++        throws IOException, ChildProcessTimeoutException, ExtCmdFailedException
++    {
++        @Nullable Integer minor = extractBitmapLeakMinor(outputData);
++        if (minor == null)
++        {
++            return false;
++        }
++
++        OutputData detachOut = extCmd.pipeExec(
++            ProcessBuilder.Redirect.from(nullDevice),
++            DRBDSETUP_UTIL,
++            "detach",
++            Integer.toString(minor)
++        );
++        if (detachOut.exitCode == 0)
++        {
++            return true;
++        }
++
++        OutputData forceDetachOut = extCmd.pipeExec(
++            ProcessBuilder.Redirect.from(nullDevice),
++            DRBDSETUP_UTIL,
++            "detach",
++            Integer.toString(minor),
++            "--force"
++        );
++        if (forceDetachOut.exitCode != 0)
++        {
++            throw new ExtCmdFailedException(forceDetachOut.executedCommand, forceDetachOut);
++        }
++
++        try
++        {
++            Thread.sleep(FORCE_DETACH_RETRY_WAIT_MS);
++        }
++        catch (InterruptedException ignored)
++        {
++            Thread.currentThread().interrupt();
++        }
++        return true;
++    }
++
+     public static class DrbdPrimary implements AutoCloseable
+     {
+         private final DrbdAdm drbdAdm;

From 7ab462f67ecfecb81fe9649498add08e68fe291d Mon Sep 17 00:00:00 2001
From: tym83 <6355522@gmail.com>
Date: Mon, 6 Apr 2026 20:21:53 +0500
Subject: [PATCH 380/666] Add Matthieu Robin (@matthieu-robin) as Maintainer

Ref: #2344

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 MAINTAINERS.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS.md b/MAINTAINERS.md
index 9c44daab..e5c07714 100644
--- a/MAINTAINERS.md
+++ b/MAINTAINERS.md
@@ -10,3 +10,4 @@
 | Timur Tukaev | [@tym83](https://github.com/tym83) | Ænix | Cozystack Website, Marketing, Community Management |
 | Kirill Klinchenkov | [@klinch0](https://github.com/klinch0) | Ænix | Core Maintainer |
 | Nikita Bykov | [@nbykov0](https://github.com/nbykov0) | Ænix | Maintainer of ARM and stuff |
+| Matthieu Robin | [@matthieu-robin](https://github.com/matthieu-robin) | Hidora | Managed Applications, Platform Quality & Benchmarking |

From f96b2da19938f220f04ce1aba5019379f1f887c7 Mon Sep 17 00:00:00 2001
From: tym83 <6355522@gmail.com>
Date: Tue, 7 Apr 2026 01:43:04 +0500
Subject: [PATCH 381/666] chore: replace cozystack-bot PAT with cozystack-ci
 GitHub App

Replace the cozystack-bot personal access token (GH_PAT) with a
GitHub App (cozystack-ci) installation token across all CI/CD
workflows. This improves security by using short-lived, scoped
tokens instead of a long-lived PAT tied to a user account.

Changes:
- tags.yaml: use app token in all 3 jobs (prepare-release,
  generate-changelog, update-website-docs)
- auto-release.yaml: use app token for daily patch releases
- pull-requests-release.yaml: use app token for release finalization

The cozystack-ci GitHub App (ID: 3297617) is installed org-wide
with contents:write and pull-requests:write permissions. Secrets
COZYSTACK_CI_APP_ID and COZYSTACK_CI_PRIVATE_KEY are set at org
level.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/auto-release.yaml          | 30 +++++---
 .github/workflows/pull-requests-release.yaml | 18 +++--
 .github/workflows/tags.yaml                  | 74 +++++++++++++-------
 3 files changed, 81 insertions(+), 41 deletions(-)

diff --git a/.github/workflows/auto-release.yaml b/.github/workflows/auto-release.yaml
index 19d4b460..d3b892d3 100644
--- a/.github/workflows/auto-release.yaml
+++ b/.github/workflows/auto-release.yaml
@@ -20,6 +20,14 @@ jobs:
       pull-requests: read
 
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
+          private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
+          owner: cozystack
+
       - name: Checkout code
         uses: actions/checkout@v4
         with:
@@ -28,27 +36,27 @@ jobs:
 
       - name: Configure git
         env:
-          GH_PAT: ${{ secrets.GH_PAT }}
+          APP_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
-          git config user.name  "cozystack-bot"
-          git config user.email "217169706+cozystack-bot@users.noreply.github.com"
-          git remote set-url origin https://cozystack-bot:${GH_PAT}@github.com/${GITHUB_REPOSITORY}
+          git config user.name  "cozystack-ci[bot]"
+          git config user.email "3297617+cozystack-ci[bot]@users.noreply.github.com"
+          git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}
           git config --unset-all http.https://github.com/.extraheader || true
 
       - name: Process release branches
         uses: actions/github-script@v7
         env:
-          GH_PAT: ${{ secrets.GH_PAT }}
+          APP_TOKEN: ${{ steps.app-token.outputs.token }}
         with:
-          github-token: ${{ secrets.GH_PAT }}
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             const { execSync } = require('child_process');
 
-            // Configure git to use PAT for authentication
-            execSync('git config user.name "cozystack-bot"', { encoding: 'utf8' });
-            execSync('git config user.email "217169706+cozystack-bot@users.noreply.github.com"', { encoding: 'utf8' });
-            execSync(`git remote set-url origin https://cozystack-bot:${process.env.GH_PAT}@github.com/${process.env.GITHUB_REPOSITORY}`, { encoding: 'utf8' });
-            // Remove GITHUB_TOKEN extraheader to ensure PAT is used (needed to trigger other workflows)
+            // Configure git to use GitHub App token for authentication
+            execSync('git config user.name "cozystack-ci[bot]"', { encoding: 'utf8' });
+            execSync('git config user.email "3297617+cozystack-ci[bot]@users.noreply.github.com"', { encoding: 'utf8' });
+            execSync(`git remote set-url origin https://x-access-token:${process.env.APP_TOKEN}@github.com/${process.env.GITHUB_REPOSITORY}`, { encoding: 'utf8' });
+            // Remove GITHUB_TOKEN extraheader to ensure App token is used (needed to trigger other workflows)
             execSync('git config --unset-all http.https://github.com/.extraheader || true', { encoding: 'utf8' });
 
             // Get all release-X.Y branches
diff --git a/.github/workflows/pull-requests-release.yaml b/.github/workflows/pull-requests-release.yaml
index 72f31b54..a1dc08d7 100644
--- a/.github/workflows/pull-requests-release.yaml
+++ b/.github/workflows/pull-requests-release.yaml
@@ -23,6 +23,14 @@ jobs:
       contains(github.event.pull_request.labels.*.name, 'release')
 
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
+          private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
+          owner: cozystack
+
       # Extract tag from branch name  (branch = release-X.Y.Z*)
       - name: Extract tag from branch name
         id: get_tag
@@ -47,11 +55,11 @@ jobs:
 
       - name: Create tag on merge commit
         env:
-          GH_PAT: ${{ secrets.GH_PAT }}
+          APP_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
-          git config user.name  "cozystack-bot"
-          git config user.email "217169706+cozystack-bot@users.noreply.github.com"
-          git remote set-url origin https://cozystack-bot:${GH_PAT}@github.com/${GITHUB_REPOSITORY}
+          git config user.name  "cozystack-ci[bot]"
+          git config user.email "3297617+cozystack-ci[bot]@users.noreply.github.com"
+          git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}
           git tag -f ${{ steps.get_tag.outputs.tag }} ${{ github.sha }}
           git push -f origin ${{ steps.get_tag.outputs.tag }}
 
@@ -59,7 +67,7 @@ jobs:
       - name: Ensure maintenance branch release-X.Y
         uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.GH_PAT }}
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             const tag = '${{ steps.get_tag.outputs.tag }}';  // e.g. v0.1.3 or v0.1.3-rc3
             const match = tag.match(/^v(\d+)\.(\d+)\.\d+(?:[-\w\.]+)?$/);
diff --git a/.github/workflows/tags.yaml b/.github/workflows/tags.yaml
index 2bbdb7a6..2725d594 100644
--- a/.github/workflows/tags.yaml
+++ b/.github/workflows/tags.yaml
@@ -25,6 +25,14 @@ jobs:
       actions: write
 
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
+          private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
+          owner: cozystack
+
       # Check if a non-draft release with this tag already exists
       - name: Check if release already exists
         id: check_release
@@ -115,11 +123,11 @@ jobs:
       - name: Commit release artifacts
         if: steps.check_release.outputs.skip == 'false'
         env:
-          GH_PAT: ${{ secrets.GH_PAT }}
+          APP_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
-          git config user.name  "cozystack-bot"
-          git config user.email "217169706+cozystack-bot@users.noreply.github.com"
-          git remote set-url origin https://cozystack-bot:${GH_PAT}@github.com/${GITHUB_REPOSITORY}
+          git config user.name  "cozystack-ci[bot]"
+          git config user.email "3297617+cozystack-ci[bot]@users.noreply.github.com"
+          git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}
           git config --unset-all http.https://github.com/.extraheader || true
           git add .
           git commit -m "Prepare release ${GITHUB_REF#refs/tags/}" -s || echo "No changes to commit"
@@ -128,13 +136,13 @@ jobs:
       - name: Tag API submodule
         if: steps.check_release.outputs.skip == 'false'
         env:
-          GH_PAT: ${{ secrets.GH_PAT }}
+          APP_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           VTAG="${{ steps.tag.outputs.tag }}"
           SUBTAG="api/apps/v1alpha1/${VTAG}"
-          git config user.name  "cozystack-bot"
-          git config user.email "217169706+cozystack-bot@users.noreply.github.com"
-          git remote set-url origin https://cozystack-bot:${GH_PAT}@github.com/${GITHUB_REPOSITORY}
+          git config user.name  "cozystack-ci[bot]"
+          git config user.email "3297617+cozystack-ci[bot]@users.noreply.github.com"
+          git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}
           TARGET="$(git rev-parse "${VTAG}^{}")"
           git tag -f "${SUBTAG}" "$TARGET"
           git push -f origin "refs/tags/${SUBTAG}"
@@ -183,11 +191,11 @@ jobs:
       - name: Create release branch
         if: steps.check_release.outputs.skip == 'false'
         env:
-          GH_PAT: ${{ secrets.GH_PAT }}
+          APP_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
-          git config user.name  "cozystack-bot"
-          git config user.email "217169706+cozystack-bot@users.noreply.github.com"
-          git remote set-url origin https://cozystack-bot:${GH_PAT}@github.com/${GITHUB_REPOSITORY}
+          git config user.name  "cozystack-ci[bot]"
+          git config user.email "3297617+cozystack-ci[bot]@users.noreply.github.com"
+          git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}
           BRANCH="release-${GITHUB_REF#refs/tags/v}"
           git branch -f "$BRANCH"
           git push -f origin "$BRANCH"
@@ -197,7 +205,7 @@ jobs:
         if: steps.check_release.outputs.skip == 'false'
         uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.GH_PAT }}
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             const version = context.ref.replace('refs/tags/v', '');
             const base    = '${{ steps.get_base.outputs.branch }}';
@@ -239,6 +247,14 @@ jobs:
       pull-requests: write
     if: needs.prepare-release.result == 'success'
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
+          private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
+          owner: cozystack
+
       - name: Parse tag
         id: tag
         uses: actions/github-script@v7
@@ -261,7 +277,7 @@ jobs:
           ref: main
           fetch-depth: 0
           fetch-tags: true
-          token: ${{ secrets.GH_PAT }}
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Check if changelog already exists
         id: check_changelog
@@ -289,7 +305,7 @@ jobs:
         if: steps.check_changelog.outputs.exists == 'false'
         env:
           COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
-          GH_TOKEN: ${{ secrets.GH_PAT }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           copilot --prompt "prepare changelog file for tagged release v${{ steps.tag.outputs.version }}, use @docs/agents/changelog.md for it. Create the changelog file at docs/changelogs/v${{ steps.tag.outputs.version }}.md" \
             --allow-all-tools --allow-all-paths < /dev/null
@@ -297,11 +313,11 @@ jobs:
       - name: Create changelog branch and commit
         if: steps.check_changelog.outputs.exists == 'false'
         env:
-          GH_PAT: ${{ secrets.GH_PAT }}
+          APP_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
-          git config user.name  "cozystack-bot"
-          git config user.email "217169706+cozystack-bot@users.noreply.github.com"
-          git remote set-url origin https://cozystack-bot:${GH_PAT}@github.com/${GITHUB_REPOSITORY}
+          git config user.name  "cozystack-ci[bot]"
+          git config user.email "3297617+cozystack-ci[bot]@users.noreply.github.com"
+          git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}
           
           CHANGELOG_FILE="docs/changelogs/v${{ steps.tag.outputs.version }}.md"
           CHANGELOG_BRANCH="changelog-v${{ steps.tag.outputs.version }}"
@@ -336,7 +352,7 @@ jobs:
         if: steps.check_changelog.outputs.exists == 'false'
         uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.GH_PAT }}
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             const version = '${{ steps.tag.outputs.version }}';
             const changelogBranch = `changelog-v${version}`;
@@ -395,6 +411,14 @@ jobs:
     permissions:
       contents: read
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
+          private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
+          owner: cozystack
+
       - name: Parse tag
         id: tag
         uses: actions/github-script@v7
@@ -414,19 +438,19 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: cozystack/website
-          token: ${{ secrets.GH_PAT }}
+          token: ${{ steps.app-token.outputs.token }}
           ref: main
 
       - name: Update docs from release branch
         env:
-          GH_TOKEN: ${{ secrets.GH_PAT }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: make update-all BRANCH=release-${{ steps.tag.outputs.version }} RELEASE_TAG=${{ steps.tag.outputs.tag }}
 
       - name: Commit and push
         id: commit
         run: |
-          git config user.name  "cozystack-bot"
-          git config user.email "217169706+cozystack-bot@users.noreply.github.com"
+          git config user.name  "cozystack-ci[bot]"
+          git config user.email "3297617+cozystack-ci[bot]@users.noreply.github.com"
           git add content
           if git diff --cached --quiet; then
             echo "No changes to commit"
@@ -443,7 +467,7 @@ jobs:
       - name: Open pull request
         if: steps.commit.outputs.changed == 'true'
         env:
-          GH_TOKEN: ${{ secrets.GH_PAT }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           BRANCH="update-docs-v${{ steps.tag.outputs.version }}"
           pr_state=$(gh pr view "$BRANCH" --repo cozystack/website --json state --jq .state 2>/dev/null || echo "")

From 026b1c78116fbe4d25155050f7a8319783ae6964 Mon Sep 17 00:00:00 2001
From: mattia-eleuteri <mattia@hidora.io>
Date: Wed, 8 Apr 2026 15:20:58 +0200
Subject: [PATCH 382/666] [virtual-machine] Exclude external VM services from
 Cilium BPF LB

Add service.kubernetes.io/service-proxy-name label to LoadBalancer
services when external: true. This prevents Cilium from adding the
service to its BPF service map, fixing two issues:

1. Inter-tenant connectivity via public LB IPs: Cilium's kube-proxy
   replacement DNATs traffic to LB IPs before policy evaluation,
   causing the CiliumClusterwideNetworkPolicy to block legitimate
   cross-tenant traffic through public IPs.

2. WholeIP broken on Cilium 1.19+ (#2327): wildcard service drop
   entries block all ports not declared in the Service spec before
   traffic reaches cozy-proxy's nftables rules.

With this label, Cilium completely ignores the Service. Routing is
handled by kube-ovn (via the wholeIP annotation) and MetalLB
continues to advertise the IP via L2 unaffected.

Tested on Cilium 1.18.6 and 1.19.1: inter-tenant via LB IP works,
pod IP isolation preserved, external access unaffected.

Signed-off-by: mattia-eleuteri <mattia@hidora.io>
---
 packages/apps/vm-instance/templates/service.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/apps/vm-instance/templates/service.yaml b/packages/apps/vm-instance/templates/service.yaml
index b12f7612..b7e3a420 100644
--- a/packages/apps/vm-instance/templates/service.yaml
+++ b/packages/apps/vm-instance/templates/service.yaml
@@ -7,6 +7,7 @@ metadata:
     apps.cozystack.io/user-service: "true"
     {{- include "virtual-machine.labels" . | nindent 4 }}
 {{- if .Values.external }}
+    service.kubernetes.io/service-proxy-name: "cozy-proxy"
   annotations:
     networking.cozystack.io/wholeIP: "true"
 {{- end }}

From e16908bb62a94c7aa9cc5912617d7f5248909d93 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Wed, 8 Apr 2026 17:32:50 +0300
Subject: [PATCH 383/666] [tests] Fix Kafka E2E test timeout and retry race
 condition

Increase Kafka CR readiness timeout from 60s to 300s to account for
slow Strimzi startup on QEMU-based CI sandbox (4 JVM pods).

Add wait-for-delete before re-applying to prevent race condition where
kubectl apply hits a still-deleting resource on retry attempts.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/kafka.bats | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hack/e2e-apps/kafka.bats b/hack/e2e-apps/kafka.bats
index 0afd374d..d85837bd 100644
--- a/hack/e2e-apps/kafka.bats
+++ b/hack/e2e-apps/kafka.bats
@@ -3,6 +3,7 @@
 @test "Create Kafka" {
   name='test'
   kubectl -n tenant-test delete kafka.apps.cozystack.io $name --ignore-not-found --timeout=2m || true
+  kubectl -n tenant-test wait kafka.apps.cozystack.io $name --for=delete --timeout=2m 2>/dev/null || true
   kubectl apply -f- <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: Kafka
@@ -40,7 +41,7 @@ spec:
 EOF
   sleep 5
   kubectl -n tenant-test wait hr kafka-$name --timeout=30s --for=condition=ready
-  kubectl wait kafkas -n tenant-test test --timeout=60s --for=condition=ready
+  kubectl wait kafkas -n tenant-test test --timeout=300s --for=condition=ready
   timeout 60 sh -ec "until kubectl -n tenant-test get pvc data-kafka-$name-zookeeper-0; do sleep 10; done"
   kubectl -n tenant-test wait pvc data-kafka-$name-zookeeper-0 --timeout=50s --for=jsonpath='{.status.phase}'=Bound
   timeout 40 sh -ec "until kubectl -n tenant-test get svc kafka-$name-zookeeper-client -o jsonpath='{.spec.ports[0].port}' | grep -q '2181'; do sleep 10; done"

From 7fb0c575c01f039d747e7a112fdabc0b21681b4b Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Wed, 8 Apr 2026 17:08:54 +0200
Subject: [PATCH 384/666] linstor: bump piraeus-server from v1.33.1 to v1.33.2

All existing patches (allow-toggle-disk-retry, fix-duplicate-tcp-ports,
fix-luks-header-size, retry-adjust-after-stale-bitmap) apply cleanly on
the new version without modifications.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/system/linstor/Makefile                                | 2 +-
 packages/system/linstor/images/piraeus-server/patches/README.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/system/linstor/Makefile b/packages/system/linstor/Makefile
index 2bc3a2a1..2ad4def9 100644
--- a/packages/system/linstor/Makefile
+++ b/packages/system/linstor/Makefile
@@ -4,7 +4,7 @@ export NAMESPACE=cozy-$(NAME)
 include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
-LINSTOR_VERSION ?= 1.33.1
+LINSTOR_VERSION ?= 1.33.2
 LINSTOR_CSI_VERSION ?= v1.10.5
 
 image: image-piraeus-server image-linstor-csi
diff --git a/packages/system/linstor/images/piraeus-server/patches/README.md b/packages/system/linstor/images/piraeus-server/patches/README.md
index 47e5f635..dfe75c2e 100644
--- a/packages/system/linstor/images/piraeus-server/patches/README.md
+++ b/packages/system/linstor/images/piraeus-server/patches/README.md
@@ -1,6 +1,6 @@
 # LINSTOR Server Patches
 
-Custom patches for piraeus-server (linstor-server) v1.33.1.
+Custom patches for piraeus-server (linstor-server) v1.33.2.
 
 - **allow-toggle-disk-retry.diff** — Backport maintainer implementation of toggle-disk retry/abort
   - Source PR/comment: [#475](https://github.com/LINBIT/linstor-server/pull/475), [maintainer note](https://github.com/LINBIT/linstor-server/pull/475#issuecomment-3949630419)

From 2234824febbf53b32b613059140e78d05271468d Mon Sep 17 00:00:00 2001
From: Andrey Kolkov <androndo@gmail.com>
Date: Fri, 3 Apr 2026 11:53:59 +0400
Subject: [PATCH 385/666] feat(backups): restore vmi to copy in another
 namespace

Signed-off-by: Andrey Kolkov <androndo@gmail.com>
---
 api/backups/v1alpha1/restorejob_types.go      |    6 +
 examples/backups/vmi/00-helpers.sh            |  112 ++
 examples/backups/vmi/01-create-strategies.sh  |  145 +++
 examples/backups/vmi/02-create-backupclass.sh |   52 +
 examples/backups/vmi/03-create-vmdisk.sh      |   40 +
 examples/backups/vmi/04-create-vminstance.sh  |   44 +
 examples/backups/vmi/05-create-backupjob.sh   |   50 +
 examples/backups/vmi/06-restore-in-place.sh   |   49 +
 examples/backups/vmi/07-restore-to-copy.sh    |   68 ++
 examples/backups/vmi/cleanup.sh               |   70 ++
 examples/backups/vmi/run-all.sh               |   62 +
 .../backups/vmi/scenario-admin-prepare.md     |   73 ++
 examples/backups/vmi/scenario-user-backup.md  |   91 ++
 examples/backups/vmi/scenario-user-restore.md |  101 ++
 .../backupcontroller/restorejob_controller.go |   17 +
 .../velerostrategy_controller.go              |  390 ++++++-
 .../velerostrategy_controller_test.go         | 1005 +++++++++++++++++
 .../backups.cozystack.io_restorejobs.yaml     |    6 +
 .../templates/rbac.yaml                       |    9 +-
 19 files changed, 2360 insertions(+), 30 deletions(-)
 create mode 100755 examples/backups/vmi/00-helpers.sh
 create mode 100755 examples/backups/vmi/01-create-strategies.sh
 create mode 100755 examples/backups/vmi/02-create-backupclass.sh
 create mode 100755 examples/backups/vmi/03-create-vmdisk.sh
 create mode 100755 examples/backups/vmi/04-create-vminstance.sh
 create mode 100755 examples/backups/vmi/05-create-backupjob.sh
 create mode 100755 examples/backups/vmi/06-restore-in-place.sh
 create mode 100755 examples/backups/vmi/07-restore-to-copy.sh
 create mode 100755 examples/backups/vmi/cleanup.sh
 create mode 100755 examples/backups/vmi/run-all.sh
 create mode 100644 examples/backups/vmi/scenario-admin-prepare.md
 create mode 100644 examples/backups/vmi/scenario-user-backup.md
 create mode 100644 examples/backups/vmi/scenario-user-restore.md

diff --git a/api/backups/v1alpha1/restorejob_types.go b/api/backups/v1alpha1/restorejob_types.go
index 1a2dfa00..9817e8c1 100644
--- a/api/backups/v1alpha1/restorejob_types.go
+++ b/api/backups/v1alpha1/restorejob_types.go
@@ -42,6 +42,12 @@ type RestoreJobSpec struct {
 	// application as referenced by backup.spec.applicationRef.
 	// +optional
 	TargetApplicationRef *corev1.TypedLocalObjectReference `json:"targetApplicationRef,omitempty"`
+
+	// Options is a driver-specific blob of restore options, typed based on
+	// targetApplicationRef and the current controller implementation.
+	// +optional
+	// +kubebuilder:pruning:PreserveUnknownFields
+	Options *runtime.RawExtension `json:"options,omitempty"`
 }
 
 // RestoreJobStatus represents the observed state of a RestoreJob.
diff --git a/examples/backups/vmi/00-helpers.sh b/examples/backups/vmi/00-helpers.sh
new file mode 100755
index 00000000..38405495
--- /dev/null
+++ b/examples/backups/vmi/00-helpers.sh
@@ -0,0 +1,112 @@
+#!/bin/bash
+# Helper functions and variables for the VMInstance backup/restore demo
+# Source this file in other scripts: source "$(dirname "$0")/00-helpers.sh"
+
+# ANSI color codes
+export RED='\033[0;31m'
+export GREEN='\033[0;32m'
+export YELLOW='\033[1;33m'
+export BLUE='\033[0;34m'
+export MAGENTA='\033[0;35m'
+export CYAN='\033[0;36m'
+export WHITE='\033[1;37m'
+export NC='\033[0m' # No Color
+export BOLD='\033[1m'
+
+# Default settings
+export NAMESPACE="${NAMESPACE:-tenant-root}"
+export BACKUP_STORAGE_LOCATION="${BACKUP_STORAGE_LOCATION:-default}"
+
+# Logging functions (output to stderr to avoid polluting captured output)
+log_info() {
+    echo -e "${BLUE}ℹ${NC} $*" >&2
+}
+
+log_success() {
+    echo -e "${GREEN}✔${NC} $*" >&2
+}
+
+log_warning() {
+    echo -e "${YELLOW}⚠${NC} $*" >&2
+}
+
+log_error() {
+    echo -e "${RED}✖${NC} $*" >&2
+}
+
+log_step() {
+    echo -e "\n${MAGENTA}${BOLD}▶ $*${NC}" >&2
+}
+
+log_substep() {
+    echo -e "${CYAN}  → $*${NC}" >&2
+}
+
+log_command() {
+    echo -e "${WHITE}  \$ $*${NC}" >&2
+}
+
+# Wait for user to press Enter
+wait_for_enter() {
+    echo -e "\n${CYAN}Press Enter to continue...${NC}" >&2
+    read -r
+}
+
+# Check if a Kubernetes resource exists
+resource_exists() {
+    local resource_type="$1"
+    local resource_name="$2"
+    local namespace="${3:-}"
+
+    if [[ -n "$namespace" ]]; then
+        kubectl get "$resource_type" "$resource_name" -n "$namespace" &>/dev/null
+    else
+        kubectl get "$resource_type" "$resource_name" &>/dev/null
+    fi
+}
+
+# Wait for a resource field to reach a desired value
+wait_for_field() {
+    local resource_type="$1"
+    local resource_name="$2"
+    local jsonpath="$3"
+    local desired="$4"
+    local namespace="${5:-}"
+    local timeout="${6:-300}"
+
+    log_substep "Waiting for $resource_type/$resource_name $jsonpath to become '$desired'..."
+
+    local elapsed=0
+    local ns_flag=""
+    [[ -n "$namespace" ]] && ns_flag="-n $namespace"
+
+    while true; do
+        local current
+        # shellcheck disable=SC2086
+        current=$(kubectl get "$resource_type" "$resource_name" $ns_flag -o jsonpath="$jsonpath" 2>/dev/null || true)
+        if [[ "$current" == "$desired" ]]; then
+            log_success "$resource_type/$resource_name reached '$desired'"
+            return 0
+        fi
+        if [[ $elapsed -ge $timeout ]]; then
+            log_error "Timeout waiting for $resource_type/$resource_name (current: '$current', expected: '$desired')"
+            return 1
+        fi
+        sleep 5
+        elapsed=$((elapsed + 5))
+        echo -n "." >&2
+    done
+}
+
+# Print a separator line
+separator() {
+    echo -e "\n${CYAN}────────────────────────────────────────────────────────────${NC}\n" >&2
+}
+
+# Print script header
+print_header() {
+    local title="$1"
+    echo -e "\n${MAGENTA}${BOLD}╔════════════════════════════════════════════════════════════╗${NC}" >&2
+    echo -e "${MAGENTA}${BOLD}║${NC} ${WHITE}${BOLD}$title${NC}" >&2
+    echo -e "${MAGENTA}${BOLD}╚════════════════════════════════════════════════════════════╝${NC}\n" >&2
+}
diff --git a/examples/backups/vmi/01-create-strategies.sh b/examples/backups/vmi/01-create-strategies.sh
new file mode 100755
index 00000000..78aa34d3
--- /dev/null
+++ b/examples/backups/vmi/01-create-strategies.sh
@@ -0,0 +1,145 @@
+#!/bin/bash
+# Step 01: Create Velero backup/restore strategies for VMInstance and VMDisk
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/00-helpers.sh"
+
+print_header "Step 1: Create Velero Strategies"
+
+log_step "Creating VMInstance strategy..."
+log_command "kubectl apply -f - (Velero strategy: vminstance-strategy)"
+
+kubectl apply -f - <<'EOF'
+apiVersion: strategy.backups.cozystack.io/v1alpha1
+kind: Velero
+metadata:
+  name: vminstance-strategy
+spec:
+  template:
+    # Symmetric restore filters: kubevirt-velero-plugin requires launcher pods in the backup,
+    # but restore orLabelSelectors limit what is applied from the tarball (e.g. skip another
+    # VM's pod that Velero added via PVC item action). VMDisk OR branches are appended by
+    # the controller from backup.status.underlyingResources or the Velero backup annotation.
+    restoreSpec:
+      existingResourcePolicy: update
+      includedNamespaces:
+        - '{{ .Application.metadata.namespace }}'
+      orLabelSelectors:
+        - matchLabels:
+            app.kubernetes.io/instance: 'vm-instance-{{ .Application.metadata.name }}'
+        - matchLabels:
+            apps.cozystack.io/application.kind: '{{ .Application.kind }}'
+            apps.cozystack.io/application.name: '{{ .Application.metadata.name }}'
+      includedResources:
+        - helmreleases.helm.toolkit.fluxcd.io
+        - virtualmachines.kubevirt.io
+        - virtualmachineinstances.kubevirt.io
+        - pods
+        - persistentvolumeclaims
+        - configmaps
+        - secrets
+        - controllerrevisions.apps
+      includeClusterResources: false
+      excludedResources:
+        # Required to avoid conflict with restored DV from HR VMDisk
+        - datavolumes.cdi.kubevirt.io
+
+    spec: # see https://velero.io/docs/v1.17/api-types/backup/
+      includedNamespaces:
+        - '{{ .Application.metadata.namespace }}'
+      orLabelSelectors:
+        # VM resources (VirtualMachine, DataVolume, PVC, etc.)
+        - matchLabels:
+            app.kubernetes.io/instance: 'vm-instance-{{ .Application.metadata.name }}'
+        # HelmRelease (the Cozystack app object)
+        - matchLabels:
+            apps.cozystack.io/application.kind: '{{ .Application.kind }}'
+            apps.cozystack.io/application.name: '{{ .Application.metadata.name }}'
+      includedResources:
+        - helmreleases.helm.toolkit.fluxcd.io
+        - virtualmachines.kubevirt.io
+        - virtualmachineinstances.kubevirt.io
+        # Required by kubevirt-velero-plugin for running VMs ("launcher pod must be in backup").
+        - pods
+        # Required by kubevirt-velero-plugin requires DV to be in backup of VM, but it excludes in restores
+        - datavolumes.cdi.kubevirt.io
+        - persistentvolumeclaims
+        - configmaps
+        - secrets
+        - controllerrevisions.apps
+      includeClusterResources: false
+      storageLocation: '{{ .Parameters.backupStorageLocationName }}'
+      volumeSnapshotLocations:
+        - '{{ .Parameters.backupStorageLocationName }}'
+      snapshotVolumes: true
+      snapshotMoveData: true
+      ttl: 720h0m0s
+      itemOperationTimeout: 24h0m0s
+EOF
+
+log_success "VMInstance strategy created"
+
+separator
+
+log_step "Creating VMDisk strategy..."
+log_command "kubectl apply -f - (Velero strategy: vmdisk-strategy)"
+
+kubectl apply -f - <<'EOF'
+apiVersion: strategy.backups.cozystack.io/v1alpha1
+kind: Velero
+metadata:
+  name: vmdisk-strategy
+spec:
+  template:
+    restoreSpec:
+      existingResourcePolicy: update
+      includedNamespaces:
+        - '{{ .Application.metadata.namespace }}'
+      orLabelSelectors:
+        - matchLabels:
+            app.kubernetes.io/instance: 'vm-disk-{{ .Application.metadata.name }}'
+        - matchLabels:
+            apps.cozystack.io/application.kind: '{{ .Application.kind }}'
+            apps.cozystack.io/application.name: '{{ .Application.metadata.name }}'
+      includedResources:
+        - helmreleases.helm.toolkit.fluxcd.io
+        - persistentvolumeclaims
+        - configmaps
+      includeClusterResources: false
+
+    spec:
+      includedNamespaces:
+        - '{{ .Application.metadata.namespace }}'
+      orLabelSelectors:
+        - matchLabels:
+            app.kubernetes.io/instance: 'vm-disk-{{ .Application.metadata.name }}'
+        - matchLabels:
+            apps.cozystack.io/application.kind: '{{ .Application.kind }}'
+            apps.cozystack.io/application.name: '{{ .Application.metadata.name }}'
+      includedResources:
+        - helmreleases.helm.toolkit.fluxcd.io
+        - persistentvolumeclaims
+        - configmaps
+      includeClusterResources: false
+      storageLocation: '{{ .Parameters.backupStorageLocationName }}'
+      volumeSnapshotLocations:
+        - '{{ .Parameters.backupStorageLocationName }}'
+      snapshotVolumes: true
+      snapshotMoveData: true
+      ttl: 720h0m0s
+      itemOperationTimeout: 24h0m0s
+EOF
+
+log_success "VMDisk strategy created"
+
+separator
+
+log_step "Verifying strategies..."
+log_command "kubectl get velero.strategy.backups.cozystack.io"
+kubectl get velero.strategy.backups.cozystack.io
+
+separator
+
+log_success "Velero strategies are ready"
+echo -e "\n${GREEN}${BOLD}Next step:${NC} ./02-create-backupclass.sh"
diff --git a/examples/backups/vmi/02-create-backupclass.sh b/examples/backups/vmi/02-create-backupclass.sh
new file mode 100755
index 00000000..08c29fc1
--- /dev/null
+++ b/examples/backups/vmi/02-create-backupclass.sh
@@ -0,0 +1,52 @@
+#!/bin/bash
+# Step 02: Create BackupClass that binds strategies to application types
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/00-helpers.sh"
+
+print_header "Step 2: Create BackupClass"
+
+log_step "Creating BackupClass 'velero'..."
+log_info "BackupClass maps application kinds (VMInstance, VMDisk) to their Velero strategies"
+log_command "kubectl apply -f - (BackupClass: velero)"
+
+kubectl apply -f - <<EOF
+apiVersion: backups.cozystack.io/v1alpha1
+kind: BackupClass
+metadata:
+  name: velero
+spec:
+  strategies:
+    - strategyRef:
+        apiGroup: strategy.backups.cozystack.io
+        kind: Velero
+        name: vminstance-strategy
+      application:
+        kind: VMInstance
+        apiGroup: apps.cozystack.io
+      parameters:
+        backupStorageLocationName: ${BACKUP_STORAGE_LOCATION}
+    - strategyRef:
+        apiGroup: strategy.backups.cozystack.io
+        kind: Velero
+        name: vmdisk-strategy
+      application:
+        kind: VMDisk
+        apiGroup: apps.cozystack.io
+      parameters:
+        backupStorageLocationName: ${BACKUP_STORAGE_LOCATION}
+EOF
+
+log_success "BackupClass created"
+
+separator
+
+log_step "Verifying BackupClass..."
+log_command "kubectl get backupclass velero -o yaml"
+kubectl get backupclass velero -o yaml
+
+separator
+
+log_success "BackupClass is ready"
+echo -e "\n${GREEN}${BOLD}Next step:${NC} ./03-create-vmdisk.sh"
diff --git a/examples/backups/vmi/03-create-vmdisk.sh b/examples/backups/vmi/03-create-vmdisk.sh
new file mode 100755
index 00000000..89d59886
--- /dev/null
+++ b/examples/backups/vmi/03-create-vmdisk.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+# Step 03: Create a VMDisk with Ubuntu cloud image
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/00-helpers.sh"
+
+print_header "Step 3: Create VMDisk"
+
+log_step "Creating VMDisk 'ubuntu-source' in namespace $NAMESPACE..."
+log_info "This will download the Ubuntu Noble cloud image (~700MB)"
+log_command "kubectl apply -f - (VMDisk: ubuntu-source)"
+
+kubectl apply -f - <<EOF
+apiVersion: apps.cozystack.io/v1alpha1
+kind: VMDisk
+metadata:
+  name: ubuntu-source
+  namespace: ${NAMESPACE}
+spec:
+  optical: false
+  source:
+    http:
+      url: https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img
+  storage: 20Gi
+  storageClass: replicated
+EOF
+
+log_success "VMDisk created"
+
+separator
+
+log_step "Verifying VMDisk..."
+log_command "kubectl get vmdisk ubuntu-source -n $NAMESPACE"
+kubectl get vmdisk ubuntu-source -n "$NAMESPACE"
+
+separator
+
+log_success "VMDisk is ready (image download may still be in progress)"
+echo -e "\n${GREEN}${BOLD}Next step:${NC} ./04-create-vminstance.sh"
diff --git a/examples/backups/vmi/04-create-vminstance.sh b/examples/backups/vmi/04-create-vminstance.sh
new file mode 100755
index 00000000..f595dd88
--- /dev/null
+++ b/examples/backups/vmi/04-create-vminstance.sh
@@ -0,0 +1,44 @@
+#!/bin/bash
+# Step 04: Create a VMInstance using the previously created VMDisk
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/00-helpers.sh"
+
+print_header "Step 4: Create VMInstance"
+
+log_step "Creating VMInstance 'test' in namespace $NAMESPACE..."
+log_command "kubectl apply -f - (VMInstance: test)"
+
+kubectl apply -f - <<EOF
+apiVersion: apps.cozystack.io/v1alpha1
+kind: VMInstance
+metadata:
+  name: test
+  namespace: ${NAMESPACE}
+spec:
+  disks:
+    - name: ubuntu-source
+  instanceProfile: ubuntu
+  instanceType: "u1.medium"
+  running: true
+  sshKeys:
+    #- <paste your ssh public key here>
+  external: false
+  externalMethod: PortList
+  externalPorts:
+    - 22
+EOF
+
+log_success "VMInstance created"
+
+separator
+
+log_step "Verifying VMInstance..."
+log_command "kubectl get vminstance test -n $NAMESPACE"
+kubectl get vminstance test -n "$NAMESPACE"
+
+separator
+
+log_success "VMInstance is ready"
+echo -e "\n${GREEN}${BOLD}Next step:${NC} ./05-create-backupjob.sh"
diff --git a/examples/backups/vmi/05-create-backupjob.sh b/examples/backups/vmi/05-create-backupjob.sh
new file mode 100755
index 00000000..581490a4
--- /dev/null
+++ b/examples/backups/vmi/05-create-backupjob.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+# Step 05: Create a BackupJob to back up the VMInstance
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/00-helpers.sh"
+
+print_header "Step 5: Create BackupJob"
+
+log_step "Creating BackupJob 'test-backup' in namespace $NAMESPACE..."
+log_info "This triggers a Velero backup of VMInstance 'test' and all its disks"
+log_command "kubectl apply -f - (BackupJob: test-backup)"
+
+kubectl apply -f - <<EOF
+apiVersion: backups.cozystack.io/v1alpha1
+kind: BackupJob
+metadata:
+  name: test-backup
+  namespace: ${NAMESPACE}
+spec:
+  applicationRef:
+    apiGroup: apps.cozystack.io
+    kind: VMInstance
+    name: test
+  backupClassName: velero
+EOF
+
+log_success "BackupJob created"
+
+separator
+
+log_step "Waiting for BackupJob to complete..."
+wait_for_field backupjob test-backup '{.status.phase}' Succeeded "$NAMESPACE" 600
+
+separator
+
+log_step "Verifying BackupJob result..."
+log_command "kubectl get backupjob test-backup -n $NAMESPACE -o yaml"
+kubectl get backupjob test-backup -n "$NAMESPACE" -o wide
+
+separator
+
+log_step "Checking created Backup..."
+log_command "kubectl get backups -n $NAMESPACE"
+kubectl get backups -n "$NAMESPACE"
+
+separator
+
+log_success "BackupJob completed successfully"
+echo -e "\n${GREEN}${BOLD}Next step:${NC} ./06-restore-in-place.sh"
diff --git a/examples/backups/vmi/06-restore-in-place.sh b/examples/backups/vmi/06-restore-in-place.sh
new file mode 100755
index 00000000..ea424ed5
--- /dev/null
+++ b/examples/backups/vmi/06-restore-in-place.sh
@@ -0,0 +1,49 @@
+#!/bin/bash
+# Step 06: Restore the VMInstance in-place (same namespace, same application)
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/00-helpers.sh"
+
+print_header "Step 6: Restore VMInstance In-Place"
+
+log_step "Creating RestoreJob 'restore-in-place-test' in namespace $NAMESPACE..."
+log_info "In-place restore: the VM will be halted, PVCs renamed, and data restored from backup"
+log_command "kubectl apply -f - (RestoreJob: restore-in-place-test)"
+
+kubectl apply -f - <<EOF
+apiVersion: backups.cozystack.io/v1alpha1
+kind: RestoreJob
+metadata:
+  name: restore-in-place-test
+  namespace: ${NAMESPACE}
+spec:
+  backupRef:
+    name: test-backup
+  targetApplicationRef:
+    apiGroup: apps.cozystack.io
+    kind: VMInstance
+    name: test
+  options:
+    failIfTargetExists: true # if true, restore will fail when the target resource already exists
+    keepOriginalPVC: true # renames original VMI PVC before restore to `<name>-orig-<hash>`, only for in-place restore
+    keepOriginalIpAndMac: true # restores original IP and MAC address of VMI via OVN annotations
+EOF
+
+log_success "RestoreJob created"
+
+separator
+
+log_step "Waiting for RestoreJob to complete..."
+wait_for_field restorejob restore-in-place-test '{.status.phase}' Succeeded "$NAMESPACE" 600
+
+separator
+
+log_step "Verifying RestoreJob result..."
+log_command "kubectl get restorejob restore-in-place-test -n $NAMESPACE -o yaml"
+kubectl get restorejob restore-in-place-test -n "$NAMESPACE" -o wide
+
+separator
+
+log_success "In-place restore completed successfully"
+echo -e "\n${GREEN}${BOLD}Next step:${NC} ./07-restore-to-copy.sh"
diff --git a/examples/backups/vmi/07-restore-to-copy.sh b/examples/backups/vmi/07-restore-to-copy.sh
new file mode 100755
index 00000000..9b84ce55
--- /dev/null
+++ b/examples/backups/vmi/07-restore-to-copy.sh
@@ -0,0 +1,68 @@
+#!/bin/bash
+# Step 07: Restore the VMInstance to a copy in a different namespace
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/00-helpers.sh"
+
+TARGET_NAMESPACE="${TARGET_NAMESPACE:-tenant-root-copy}"
+
+print_header "Step 7: Restore VMInstance to Copy (Cross-Namespace)"
+
+log_info "Restoring to the same namespace with a different app name is not supported"
+log_info "due to Velero DataUpload limitations. Cross-namespace restore uses Velero's namespaceMapping."
+
+separator
+
+log_step "Ensuring target namespace '$TARGET_NAMESPACE' exists..."
+kubectl create namespace "$TARGET_NAMESPACE" --dry-run=client -o yaml | kubectl apply -f -
+log_success "Namespace '$TARGET_NAMESPACE' is ready"
+
+separator
+
+log_step "Creating RestoreJob 'restore-to-copy-test' in namespace $NAMESPACE..."
+log_info "The backup will be restored into namespace '$TARGET_NAMESPACE' using Velero namespaceMapping"
+log_command "kubectl apply -f - (RestoreJob: restore-to-copy-test)"
+
+kubectl apply -f - <<EOF
+apiVersion: backups.cozystack.io/v1alpha1
+kind: RestoreJob
+metadata:
+  name: restore-to-copy-test
+  namespace: ${NAMESPACE}
+spec:
+  backupRef:
+    name: test-backup
+  targetApplicationRef:
+    apiGroup: apps.cozystack.io
+    kind: VMInstance
+    name: test
+  options: # runtime.RawExtension, typed based on targetApplicationRef and current controller implementation (for additional restore options)
+    targetNamespace: ${TARGET_NAMESPACE} # when set to a different namespace, triggers cross-namespace restore via Velero namespaceMapping
+    failIfTargetExists: true # if true, restore will fail when the target resource already exists
+    keepOriginalPVC: false # renames original VMI PVC before restore to `<name>-orig-<hash>`, only for in-place restore
+    keepOriginalIpAndMac: false # restores original IP and MAC address of VMI via OVN annotations
+EOF
+
+log_success "RestoreJob created"
+
+separator
+
+log_step "Waiting for RestoreJob to complete..."
+wait_for_field restorejob restore-to-copy-test '{.status.phase}' Succeeded "$NAMESPACE" 600
+
+separator
+
+log_step "Verifying RestoreJob result..."
+log_command "kubectl get restorejob restore-to-copy-test -n $NAMESPACE -o yaml"
+kubectl get restorejob restore-to-copy-test -n "$NAMESPACE" -o wide
+
+separator
+
+log_step "Checking resources in target namespace..."
+log_command "kubectl get all -n $TARGET_NAMESPACE"
+kubectl get all -n "$TARGET_NAMESPACE" 2>/dev/null || log_warning "No resources found in $TARGET_NAMESPACE"
+
+separator
+
+log_success "Cross-namespace restore completed successfully"
diff --git a/examples/backups/vmi/cleanup.sh b/examples/backups/vmi/cleanup.sh
new file mode 100755
index 00000000..5965c3f0
--- /dev/null
+++ b/examples/backups/vmi/cleanup.sh
@@ -0,0 +1,70 @@
+#!/bin/bash
+# Clean up all resources created by the demo
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/00-helpers.sh"
+
+TARGET_NAMESPACE="${TARGET_NAMESPACE:-tenant-root-copy}"
+
+print_header "Cleanup Demo Resources"
+
+log_warning "This script will delete all resources created during the demo"
+echo -e "\n${YELLOW}The following will be deleted:${NC}"
+echo "  - RestoreJobs (restore-in-place-test, restore-to-copy-test)"
+echo "  - BackupJob (test-backup) and associated Backup"
+echo "  - VMInstance (test)"
+echo "  - VMDisk (ubuntu-source)"
+echo "  - BackupClass (velero)"
+echo "  - Velero strategies (vminstance-strategy, vmdisk-strategy)"
+echo "  - Target namespace ($TARGET_NAMESPACE)"
+echo ""
+
+read -p "Continue? (y/N): " -n 1 -r
+echo
+if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+    log_info "Cancelled"
+    exit 0
+fi
+
+separator
+
+log_step "Deleting RestoreJobs..."
+kubectl delete restorejob restore-to-copy-test -n "$NAMESPACE" 2>/dev/null || log_warning "RestoreJob restore-to-copy-test not found"
+kubectl delete restorejob restore-in-place-test -n "$NAMESPACE" 2>/dev/null || log_warning "RestoreJob restore-in-place-test not found"
+
+separator
+
+log_step "Deleting BackupJob and Backup..."
+kubectl delete backupjob test-backup -n "$NAMESPACE" 2>/dev/null || log_warning "BackupJob test-backup not found"
+kubectl delete backup test-backup -n "$NAMESPACE" 2>/dev/null || log_warning "Backup test-backup not found"
+
+separator
+
+log_step "Deleting VMInstance..."
+kubectl delete vminstance test -n "$NAMESPACE" 2>/dev/null || log_warning "VMInstance test not found"
+
+log_step "Deleting VMDisk..."
+kubectl delete vmdisk ubuntu-source -n "$NAMESPACE" 2>/dev/null || log_warning "VMDisk ubuntu-source not found"
+
+separator
+
+log_step "Deleting BackupClass..."
+kubectl delete backupclass velero 2>/dev/null || log_warning "BackupClass velero not found"
+
+separator
+
+log_step "Deleting Velero strategies..."
+kubectl delete velero.strategy.backups.cozystack.io vminstance-strategy 2>/dev/null || log_warning "Strategy vminstance-strategy not found"
+kubectl delete velero.strategy.backups.cozystack.io vmdisk-strategy 2>/dev/null || log_warning "Strategy vmdisk-strategy not found"
+
+separator
+
+log_step "Deleting target namespace..."
+kubectl delete namespace "$TARGET_NAMESPACE" 2>/dev/null || log_warning "Namespace $TARGET_NAMESPACE not found"
+
+separator
+
+log_success "Cleanup complete"
+log_info "All demo resources have been deleted"
+echo -e "\n${GREEN}${BOLD}To re-run the demo:${NC} ./01-create-strategies.sh"
diff --git a/examples/backups/vmi/run-all.sh b/examples/backups/vmi/run-all.sh
new file mode 100755
index 00000000..b58f4b9d
--- /dev/null
+++ b/examples/backups/vmi/run-all.sh
@@ -0,0 +1,62 @@
+#!/bin/bash
+# Run the full VMInstance backup/restore demo sequentially
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/00-helpers.sh"
+
+print_header "VMInstance Backup & Restore Demo"
+
+log_info "This script will run all demo steps sequentially"
+log_info "There will be a pause between steps for observation"
+echo ""
+
+SCRIPTS=(
+    "01-create-strategies.sh"
+    "02-create-backupclass.sh"
+    "03-create-vmdisk.sh"
+    "04-create-vminstance.sh"
+    "05-create-backupjob.sh"
+    "06-restore-in-place.sh"
+    "07-restore-to-copy.sh"
+)
+
+echo -e "${CYAN}Demo steps:${NC}"
+for i in "${!SCRIPTS[@]}"; do
+    echo "  $((i+1)). ${SCRIPTS[$i]}"
+done
+echo ""
+
+read -p "Run demo? (y/N): " -n 1 -r
+echo
+if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+    log_info "Cancelled"
+    exit 0
+fi
+
+separator
+
+for script in "${SCRIPTS[@]}"; do
+    if [[ -x "$SCRIPT_DIR/$script" ]]; then
+        "$SCRIPT_DIR/$script"
+        separator
+        wait_for_enter
+    else
+        log_error "Script not found or not executable: $script"
+        exit 1
+    fi
+done
+
+print_header "Demo Complete"
+
+log_success "All steps completed successfully!"
+echo ""
+log_info "What was demonstrated:"
+echo "  1. Created Velero backup strategies for VMInstance and VMDisk"
+echo "  2. Created BackupClass binding strategies to application types"
+echo "  3. Provisioned a VMDisk and VMInstance"
+echo "  4. Created a backup of the VMInstance via BackupJob"
+echo "  5. Restored the VMInstance in-place"
+echo "  6. Restored the VMInstance to a copy in a different namespace"
+echo ""
+log_info "To clean up resources: ./cleanup.sh"
diff --git a/examples/backups/vmi/scenario-admin-prepare.md b/examples/backups/vmi/scenario-admin-prepare.md
new file mode 100644
index 00000000..edfca5d1
--- /dev/null
+++ b/examples/backups/vmi/scenario-admin-prepare.md
@@ -0,0 +1,73 @@
+# Scenario: Cluster Administrator Configures Backups
+
+This scenario walks through the cluster-level setup required before users can
+back up and restore their virtual machines. A cluster administrator creates
+Velero strategies and a BackupClass that binds those strategies to Cozystack
+application types.
+
+## Prerequisites
+
+- A running Cozystack cluster with the backup-controller installed.
+- Velero deployed in the `cozy-velero` namespace with a configured
+  BackupStorageLocation (default: `default`).
+- `kubectl` access with cluster-admin privileges.
+
+## Steps
+
+### 1. Create Velero Strategies
+
+```bash
+./01-create-strategies.sh
+```
+
+This creates two cluster-scoped `Velero` strategy objects:
+
+| Strategy | Purpose |
+|---|---|
+| `vminstance-strategy` | Defines backup and restore templates for `VMInstance` applications. Includes VirtualMachine, PVCs, HelmReleases, pods (required by kubevirt-velero-plugin), and supporting resources. Uses `snapshotMoveData: true` for portable volume snapshots. |
+| `vmdisk-strategy` | Defines backup and restore templates for standalone `VMDisk` applications. Covers HelmReleases, PVCs, and ConfigMaps. |
+
+Both strategies use Go templates with `{{ .Application.metadata.name }}`,
+`{{ .Application.metadata.namespace }}`, and `{{ .Parameters.backupStorageLocationName }}`
+so they can be reused across any application instance.
+
+**Key design details:**
+
+- `orLabelSelectors` scope backups to only the resources belonging to a
+  specific application, preventing cross-contamination between VMs in the
+  same namespace.
+- The restore spec excludes `datavolumes.cdi.kubevirt.io` to avoid conflicts
+  when the HelmRelease of VMDisk recreates DataVolumes after restore.
+- `existingResourcePolicy: update` allows restoring over existing resources
+  during in-place restore.
+
+### 2. Create BackupClass
+
+```bash
+./02-create-backupclass.sh
+```
+
+Creates a `BackupClass` named `velero` that maps application types to their
+strategies:
+
+| Application Kind | Strategy | Parameters |
+|---|---|---|
+| `VMInstance` (`apps.cozystack.io`) | `vminstance-strategy` | `backupStorageLocationName: default` |
+| `VMDisk` (`apps.cozystack.io`) | `vmdisk-strategy` | `backupStorageLocationName: default` |
+
+The `backupStorageLocationName` parameter can be overridden via the
+`BACKUP_STORAGE_LOCATION` environment variable if your Velero installation
+uses a non-default storage location.
+
+## Configuration
+
+| Variable | Default | Description |
+|---|---|---|
+| `BACKUP_STORAGE_LOCATION` | `default` | Velero BackupStorageLocation name |
+
+## Result
+
+After completing these steps the cluster is ready for users to create backups
+of their `VMInstance` and `VMDisk` applications by referencing the `velero`
+BackupClass. No further admin action is required for individual backup or
+restore operations.
diff --git a/examples/backups/vmi/scenario-user-backup.md b/examples/backups/vmi/scenario-user-backup.md
new file mode 100644
index 00000000..31241fd9
--- /dev/null
+++ b/examples/backups/vmi/scenario-user-backup.md
@@ -0,0 +1,91 @@
+# Scenario: User Creates a VM Backup
+
+This scenario demonstrates how a tenant user provisions a virtual machine and
+creates a backup of it. The backup captures the VM definition, its disks, and
+network identity so it can be restored later.
+
+## Prerequisites
+
+- Cluster administrator has completed the setup from
+  [scenario-admin.md](scenario-admin.md) (strategies and BackupClass exist).
+- A tenant namespace (default: `tenant-root`).
+- `kubectl` access scoped to the tenant namespace.
+
+## Steps
+
+### 1. Create a VMDisk
+
+```bash
+./03-create-vmdisk.sh
+```
+
+Creates a `VMDisk` named `ubuntu-source` that downloads the Ubuntu Noble cloud
+image and provisions a 20Gi replicated PVC. The disk serves as the boot volume
+for the virtual machine.
+
+Wait for the image download to complete before proceeding. You can monitor
+progress with:
+
+```bash
+kubectl get vmdisk ubuntu-source -n tenant-root -w
+```
+
+### 2. Create a VMInstance
+
+```bash
+./04-create-vminstance.sh
+```
+
+Creates a `VMInstance` named `test` that references the `ubuntu-source` disk.
+The VM boots with the `ubuntu` instance profile on a `u1.medium` instance type.
+
+Verify the VM is running:
+
+```bash
+kubectl get vmi -n tenant-root
+```
+
+### 3. Create a BackupJob
+
+```bash
+./05-create-backupjob.sh
+```
+
+Creates a `BackupJob` named `test-backup` that triggers a full backup of the
+`test` VMInstance. The backup controller:
+
+1. Resolves the `velero` BackupClass to find the matching `vminstance-strategy`.
+2. Discovers underlying resources (DataVolumes, OVN IP/MAC from the VM pod).
+3. Creates a Velero Backup in the `cozy-velero` namespace with label selectors
+   scoped to this specific VM and its disks.
+4. Velero snapshots and moves the volume data to the configured storage
+   location.
+
+The script waits up to 10 minutes for the BackupJob to reach the `Succeeded`
+phase. On completion, a `Backup` object is created in the same namespace
+containing:
+
+- `spec.applicationRef` — reference to the backed-up VMInstance.
+- `spec.strategyRef` — reference to the Velero strategy used.
+- `spec.driverMetadata` — Velero backup name for later restore.
+- `status.underlyingResources` — captured DataVolume names and OVN IP/MAC
+  addresses.
+
+You can inspect the resulting Backup:
+
+```bash
+kubectl get backups -n tenant-root
+kubectl get backup test-backup -n tenant-root -o yaml
+```
+
+## Configuration
+
+| Variable | Default | Description |
+|---|---|---|
+| `NAMESPACE` | `tenant-root` | Tenant namespace for all resources |
+
+## Result
+
+After completing these steps you have a `Backup` artifact that can be used to
+restore the VM either in-place or to a different namespace. See
+[scenario-user-restore.md](scenario-user-restore.md) for restore options.
diff --git a/examples/backups/vmi/scenario-user-restore.md b/examples/backups/vmi/scenario-user-restore.md
new file mode 100644
index 00000000..1d35b22b
--- /dev/null
+++ b/examples/backups/vmi/scenario-user-restore.md
@@ -0,0 +1,101 @@
+# Scenario: User Restores a VM
+
+This scenario demonstrates two restore methods: in-place restore (rollback the
+VM to a previous state) and cross-namespace restore (create a copy of the VM in
+a different namespace).
+
+## Prerequisites
+
+- A completed backup from [scenario-user-backup.md](scenario-user-backup.md)
+  (the `test-backup` Backup object exists in the tenant namespace).
+- `kubectl` access scoped to the tenant namespace.
+
+## Method 1: In-Place Restore
+
+```bash
+./06-restore-in-place.sh
+```
+
+Creates a `RestoreJob` that restores the `test` VMInstance back to the state
+captured in the `test-backup` Backup. The `targetApplicationRef` points to the
+same application as the original backup.
+
+The backup controller performs the following steps automatically:
+
+1. **Suspends HelmReleases** — prevents Flux from reconciling the VM and its
+   disks during restore.
+2. **Halts the VirtualMachine** — sets `runStrategy: Halted` and waits for the
+   VirtualMachineInstance (launcher pod) to terminate.
+3. **Renames existing PVCs** — moves each PVC to `<name>-orig-<hash>` to
+   preserve the current disk data as a safety net.
+4. **Deletes DataVolumes** — removes DVs so CDI does not recreate PVCs before
+   Velero restores them.
+5. **Creates Velero Restore** — restores resources from the backup with:
+   - `existingResourcePolicy: update` to overwrite existing objects.
+   - Resource modifier rules that add `cdi.kubevirt.io/allowClaimAdoption=true`
+     to restored PVCs so CDI can adopt them.
+   - OVN IP/MAC annotations to preserve the VM's network identity.
+
+After the Velero Restore completes, the HelmReleases resume and the VM boots
+with the restored disk data while retaining its original IP and MAC addresses.
+
+## Method 2: Cross-Namespace Restore (Copy)
+
+```bash
+./07-restore-to-copy.sh
+```
+
+Creates a `RestoreJob` with `spec.options.targetNamespace` set to a different namespace
+(default: `tenant-root-copy`). This creates an independent copy of the VM
+without affecting the original.
+
+Key differences from in-place restore:
+
+| Aspect | In-Place | Cross-Namespace |
+|---|---|---|
+| Source VM affected | Yes (halted, PVCs renamed) | No (untouched) |
+| Velero namespaceMapping | Not used | Maps source NS to target NS |
+| OVN IP/MAC | Preserved from backup | Skipped (new IP/MAC assigned) |
+| Pre-restore preparation | Full (suspend, halt, rename, delete) | Skipped |
+
+The script ensures the target namespace exists before creating the RestoreJob.
+Velero's `namespaceMapping` redirects all resources from the source namespace to
+the target namespace during restore.
+
+### Important limitation
+
+Restoring to the **same namespace** with a **different application name** is not
+supported. Velero's DataUpload always writes volume data to PVCs with the
+original name regardless of resource modifiers, which causes conflicts. If you
+attempt this, the RestoreJob will fail with an error message suggesting
+cross-namespace restore instead.
+
+## Configuration
+
+| Variable | Default | Description |
+|---|---|---|
+| `NAMESPACE` | `tenant-root` | Source namespace (where the Backup lives) |
+| `TARGET_NAMESPACE` | `tenant-root-copy` | Target namespace for cross-namespace restore |
+
+## Verify
+
+After either restore method, verify the VM is running:
+
+```bash
+# In-place
+kubectl get vmi -n tenant-root
+
+# Cross-namespace copy
+kubectl get vmi -n tenant-root-copy
+```
+
+## Cleanup
+
+To remove all resources created by the demo:
+
+```bash
+./cleanup.sh
+```
+
+This deletes RestoreJobs, BackupJobs, Backups, VMInstance, VMDisk, BackupClass,
+strategies, and the target namespace.
diff --git a/internal/backupcontroller/restorejob_controller.go b/internal/backupcontroller/restorejob_controller.go
index d73b0c24..f0062064 100644
--- a/internal/backupcontroller/restorejob_controller.go
+++ b/internal/backupcontroller/restorejob_controller.go
@@ -153,6 +153,23 @@ func (r *RestoreJobReconciler) markRestoreJobFailed(ctx context.Context, restore
 	return ctrl.Result{}, nil
 }
 
+// cleanupResourceModifierConfigMaps deletes resource modifier ConfigMaps owned
+// by this RestoreJob. Called on completion (success or failure) to avoid leaking
+// ConfigMaps in cozy-velero when RestoreJobs are not immediately deleted.
+func (r *RestoreJobReconciler) cleanupResourceModifierConfigMaps(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob) {
+	logger := log.FromContext(ctx)
+	opts := []client.DeleteAllOfOption{
+		client.InNamespace(veleroNamespace),
+		client.MatchingLabels{
+			backupsv1alpha1.OwningJobNameLabel:      restoreJob.Name,
+			backupsv1alpha1.OwningJobNamespaceLabel: restoreJob.Namespace,
+		},
+	}
+	if err := r.DeleteAllOf(ctx, &corev1.ConfigMap{}, opts...); err != nil {
+		logger.Error(err, "failed to clean up resourceModifiers ConfigMap(s)")
+	}
+}
+
 // cleanupVeleroRestore deletes all Velero Restores and resourceModifier
 // ConfigMaps owned by this RestoreJob (identified by labels).
 func (r *RestoreJobReconciler) cleanupVeleroRestore(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob) {
diff --git a/internal/backupcontroller/velerostrategy_controller.go b/internal/backupcontroller/velerostrategy_controller.go
index d5c330ae..8b063519 100644
--- a/internal/backupcontroller/velerostrategy_controller.go
+++ b/internal/backupcontroller/velerostrategy_controller.go
@@ -75,6 +75,107 @@ func stringPtr(s string) *string {
 	return &s
 }
 
+// boolPtr returns a pointer to a bool value.
+func boolPtr(b bool) *bool {
+	return &b
+}
+
+// boolDefault returns the value of a *bool pointer, or the given default if nil.
+func boolDefault(p *bool, def bool) bool {
+	if p != nil {
+		return *p
+	}
+	return def
+}
+
+// CommonRestoreOptions contains driver-agnostic restore options shared across
+// all application kinds.
+type CommonRestoreOptions struct {
+	// TargetNamespace is the namespace to restore into. When set (and differs
+	// from the backup namespace), a cross-namespace restore (copy) is performed
+	// using Velero's namespaceMapping.
+	TargetNamespace string `json:"targetNamespace,omitempty"`
+	// FailIfTargetExists makes the restore fail if the target resource already
+	// exists. Defaults to true when omitted.
+	FailIfTargetExists *bool `json:"failIfTargetExists,omitempty"`
+}
+
+// RestoreOptions is the typed representation of RestoreJob.Spec.Options for the
+// Velero driver. The struct is deserialized from runtime.RawExtension and used
+// for all application kinds. VMInstance-specific fields (KeepOriginalPVC,
+// KeepOriginalIpAndMac) are only effective when the application kind is VMInstance.
+type RestoreOptions struct {
+	CommonRestoreOptions `json:",inline"`
+	// KeepOriginalPVC renames the original PVC to <name>-orig-<hash> before restore.
+	// Only effective for in-place VMInstance restore (no targetNamespace). Defaults to true when omitted.
+	KeepOriginalPVC *bool `json:"keepOriginalPVC,omitempty"`
+	// KeepOriginalIpAndMac preserves the original IP and MAC address via OVN
+	// annotations. Only effective for VMInstance restores. Defaults to true when omitted.
+	KeepOriginalIpAndMac *bool `json:"keepOriginalIpAndMac,omitempty"`
+}
+
+// GetFailIfTargetExists returns the effective value (default: true).
+func (o *CommonRestoreOptions) GetFailIfTargetExists() bool {
+	return boolDefault(o.FailIfTargetExists, true)
+}
+
+// GetKeepOriginalPVC returns the effective value (default: true).
+func (o *RestoreOptions) GetKeepOriginalPVC() bool {
+	return boolDefault(o.KeepOriginalPVC, true)
+}
+
+// GetKeepOriginalIpAndMac returns the effective value (default: true).
+func (o *RestoreOptions) GetKeepOriginalIpAndMac() bool {
+	return boolDefault(o.KeepOriginalIpAndMac, true)
+}
+
+// parseRestoreOptions deserializes RestoreJob.Spec.Options into RestoreOptions.
+// Returns zero-value RestoreOptions if options is nil.
+func parseRestoreOptions(opts *runtime.RawExtension) (RestoreOptions, error) {
+	var ro RestoreOptions
+	if opts == nil || len(opts.Raw) == 0 {
+		return ro, nil
+	}
+	if err := json.Unmarshal(opts.Raw, &ro); err != nil {
+		return ro, fmt.Errorf("failed to parse restore options: %w", err)
+	}
+	return ro, nil
+}
+
+// restoreTarget holds the resolved target namespace and app identity for a restore operation.
+type restoreTarget struct {
+	Namespace string
+	AppName   string
+	AppKind   string
+	IsCopy    bool // true when targetNamespace differs from backup namespace
+	IsRenamed bool // true when target app name differs from source app name
+}
+
+// resolveRestoreTarget computes the effective restore target from RestoreJob, Backup, and options.
+func resolveRestoreTarget(restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, opts RestoreOptions) restoreTarget {
+	targetNS := backup.Namespace
+	isCopy := false
+	if opts.TargetNamespace != "" && opts.TargetNamespace != backup.Namespace {
+		targetNS = opts.TargetNamespace
+		isCopy = true
+	}
+	targetAppName := backup.Spec.ApplicationRef.Name
+	if restoreJob.Spec.TargetApplicationRef != nil && restoreJob.Spec.TargetApplicationRef.Name != "" {
+		targetAppName = restoreJob.Spec.TargetApplicationRef.Name
+	}
+	targetAppKind := backup.Spec.ApplicationRef.Kind
+	if restoreJob.Spec.TargetApplicationRef != nil && restoreJob.Spec.TargetApplicationRef.Kind != "" {
+		targetAppKind = restoreJob.Spec.TargetApplicationRef.Kind
+	}
+	return restoreTarget{
+		Namespace: targetNS,
+		AppName:   targetAppName,
+		AppKind:   targetAppKind,
+		IsCopy:    isCopy,
+		IsRenamed: targetAppName != backup.Spec.ApplicationRef.Name,
+	}
+}
+
 // vmInstanceResources contains VM-specific underlying resources discovered during backup.
 type vmInstanceResources struct {
 	DataVolumes []backupsv1alpha1.DataVolumeResource `json:"dataVolumes,omitempty"`
@@ -475,6 +576,37 @@ func (r *RestoreJobReconciler) reconcileVeleroRestore(ctx context.Context, resto
 	logger := getLogger(ctx)
 	logger.Debug("reconciling Velero strategy restore", "restorejob", restoreJob.Name, "backup", backup.Name)
 
+	// Parse restore options from the opaque blob
+	restoreOpts, err := parseRestoreOptions(restoreJob.Spec.Options)
+	if err != nil {
+		return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf("invalid restore options: %v", err))
+	}
+
+	target := resolveRestoreTarget(restoreJob, backup, restoreOpts)
+	logger.Debug("resolved restore target", "targetNS", target.Namespace, "targetApp", target.AppName, "isCopy", target.IsCopy)
+
+	// Validate: target namespace must exist for cross-namespace copies
+	if target.IsCopy {
+		targetNS := &corev1.Namespace{}
+		if err := r.Get(ctx, client.ObjectKey{Name: target.Namespace}, targetNS); err != nil {
+			if errors.IsNotFound(err) {
+				return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf(
+					"target namespace %q does not exist; create it before requesting a cross-namespace restore",
+					target.Namespace))
+			}
+			return ctrl.Result{}, fmt.Errorf("failed to check target namespace %q: %w", target.Namespace, err)
+		}
+	}
+
+	// Validate: same-namespace restore with a different app name is not supported
+	// due to Velero DataUpload always writing to PVCs with the original name.
+	if !target.IsCopy && target.AppName != backup.Spec.ApplicationRef.Name {
+		return r.markRestoreJobFailed(ctx, restoreJob,
+			"restoring to the same namespace with a different application name is not supported "+
+				"due to Velero DataUpload limitations: data is always uploaded to PVCs with the original name. "+
+				"Use options.targetNamespace to restore into a different namespace")
+	}
+
 	// Step 1: On first reconcile, set startedAt and phase = Running
 	if restoreJob.Status.StartedAt == nil {
 		logger.Debug("setting RestoreJob StartedAt and phase to Running")
@@ -525,11 +657,29 @@ func (r *RestoreJobReconciler) reconcileVeleroRestore(ctx context.Context, resto
 	}
 
 	if len(veleroRestoreList.Items) == 0 {
+		// For copy restores, enforce failIfTargetExists before touching anything.
+		// In-place restores are excluded: the source application is expected to exist
+		// and will be halted/overwritten deliberately.
+		if target.IsCopy && restoreOpts.GetFailIfTargetExists() {
+			targetHRName := helmReleaseNameForApp(target.AppKind, target.AppName)
+			exists, err := r.targetHelmReleaseExists(ctx, target.AppKind, targetHRName, target.Namespace)
+			if err != nil {
+				logger.Error(err, "failed to check whether target HelmRelease exists")
+				return ctrl.Result{}, err
+			}
+			if exists {
+				return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf(
+					"target application %q already exists in namespace %q; "+
+						"set options.failIfTargetExists=false to overwrite",
+					target.AppName, target.Namespace))
+			}
+		}
+
 		// Resolve underlying resources once; prefer Backup status, fall back to Velero annotation.
 		ur := r.resolveUnderlyingResourcesForRestore(ctx, backup, veleroBackupName)
 
-		// Pre-restore: graceful shutdown, suspend HRs, rename PVCs
-		ready, result, err := r.prepareForRestore(ctx, restoreJob, backup, ur)
+		// Pre-restore: graceful shutdown, suspend HRs, rename PVCs (skipped for copy)
+		ready, result, err := r.prepareForRestore(ctx, restoreJob, backup, ur, target, restoreOpts)
 		if err != nil {
 			return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf("pre-restore preparation failed: %v", err))
 		}
@@ -540,7 +690,7 @@ func (r *RestoreJobReconciler) reconcileVeleroRestore(ctx context.Context, resto
 
 		// Create Velero Restore
 		logger.Debug("Velero Restore not found, creating new one")
-		if err := r.createVeleroRestore(ctx, restoreJob, backup, veleroStrategy, veleroBackupName, ur); err != nil {
+		if err := r.createVeleroRestore(ctx, restoreJob, backup, veleroStrategy, veleroBackupName, ur, target, restoreOpts); err != nil {
 			logger.Error(err, "failed to create Velero Restore")
 			return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf("failed to create Velero Restore: %v", err))
 		}
@@ -566,6 +716,18 @@ func (r *RestoreJobReconciler) reconcileVeleroRestore(ctx context.Context, resto
 
 	// Step 4: On success
 	if phase == "Completed" {
+		// Post-restore: rename resources if target app name differs from source.
+		// Velero resource modifiers cannot change metadata.name, so we do it after restore.
+		if target.IsRenamed {
+			if err := r.postRestoreRename(ctx, restoreJob, backup, target); err != nil {
+				r.cleanupResourceModifierConfigMaps(ctx, restoreJob)
+				return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf("post-restore rename failed: %v", err))
+			}
+		}
+
+		// Clean up resource modifier ConfigMaps now that the restore is complete.
+		r.cleanupResourceModifierConfigMaps(ctx, restoreJob)
+
 		now := metav1.Now()
 		restoreJob.Status.CompletedAt = &now
 		restoreJob.Status.Phase = backupsv1alpha1.RestoreJobPhaseSucceeded
@@ -579,6 +741,7 @@ func (r *RestoreJobReconciler) reconcileVeleroRestore(ctx context.Context, resto
 
 	// Step 5: On failure
 	if phase == "Failed" || phase == "PartiallyFailed" {
+		r.cleanupResourceModifierConfigMaps(ctx, restoreJob)
 		message := fmt.Sprintf("Velero Restore failed with phase: %s", phase)
 		if veleroRestore.Status.FailureReason != "" {
 			message = fmt.Sprintf("%s: %s", message, veleroRestore.Status.FailureReason)
@@ -600,6 +763,7 @@ type resourceModifiers struct {
 type resourceModifierRule struct {
 	Conditions   resourceModifierConditions `yaml:"conditions"`
 	MergePatches []mergePatch               `yaml:"mergePatches,omitempty"`
+	Patches      []jsonPatch                `yaml:"patches,omitempty"`
 }
 
 type resourceModifierConditions struct {
@@ -612,6 +776,12 @@ type mergePatch struct {
 	PatchData string `yaml:"patchData"`
 }
 
+type jsonPatch struct {
+	Operation string `yaml:"operation"`
+	Path      string `yaml:"path"`
+	Value     string `yaml:"value,omitempty"`
+}
+
 // marshalPatchData marshals an arbitrary object to YAML for use as
 // mergePatch.PatchData in Velero resource modifiers.
 func marshalPatchData(v interface{}) (string, error) {
@@ -627,10 +797,10 @@ func marshalPatchData(v interface{}) (string, error) {
 //   - PVC adoption: always adds cdi.kubevirt.io/allowClaimAdoption=true to all
 //     restored PVCs so CDI can adopt them when a HelmRelease of VMDisk recreates a DV.
 //   - OVN IP/MAC: sets OVN annotations on the VirtualMachine for correct ssh access to restored VM.
-func (r *RestoreJobReconciler) createResourceModifiersConfigMap(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, ur *runtime.RawExtension) (*corev1.ConfigMap, error) {
+func (r *RestoreJobReconciler) createResourceModifiersConfigMap(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, ur *runtime.RawExtension, target restoreTarget, opts RestoreOptions) (*corev1.ConfigMap, error) {
 	logger := getLogger(ctx)
 
-	targetNS := backup.Namespace
+	targetNS := target.Namespace
 
 	var rules []resourceModifierRule
 
@@ -654,22 +824,17 @@ func (r *RestoreJobReconciler) createResourceModifiersConfigMap(ctx context.Cont
 		MergePatches: []mergePatch{{PatchData: pvcPatch}},
 	})
 
-	// OVN IP/MAC annotations on VirtualMachine for correct network identity after restore.
-	if vmRes := getVMInstanceResources(ur); vmRes != nil && (vmRes.IP != "" || vmRes.MAC != "") {
-		ovnAnnotations := map[string]string{}
-		if vmRes.IP != "" {
-			ovnAnnotations[ovnIPAnnotation] = vmRes.IP
-		}
-		if vmRes.MAC != "" {
-			ovnAnnotations[ovnMACAnnotation] = vmRes.MAC
-		}
-		vmPatch, err := marshalPatchData(map[string]interface{}{
+	// For cross-namespace restore: strip Velero's dynamic PV restore selector and
+	// volumeName from PVCs so the storage provisioner can dynamically provision new PVs.
+	// Without this, Velero's CSI PVCAction adds spec.selector with a velero.io/dynamic-pv-restore
+	// label that prevents dynamic provisioning when PVs are not included in the restore.
+	// Uses merge patch (null values) instead of JSON Patch remove to avoid RFC 6902
+	// failures when the fields don't exist on the PVC (e.g. statically provisioned PVCs).
+	if target.IsCopy {
+		pvcStripPatch, err := marshalPatchData(map[string]interface{}{
 			"spec": map[string]interface{}{
-				"template": map[string]interface{}{
-					"metadata": map[string]interface{}{
-						"annotations": ovnAnnotations,
-					},
-				},
+				"selector":   nil,
+				"volumeName": nil,
 			},
 		})
 		if err != nil {
@@ -677,14 +842,49 @@ func (r *RestoreJobReconciler) createResourceModifiersConfigMap(ctx context.Cont
 		}
 		rules = append(rules, resourceModifierRule{
 			Conditions: resourceModifierConditions{
-				GroupResource:     "virtualmachines.kubevirt.io",
+				GroupResource:     "persistentvolumeclaims",
 				ResourceNameRegex: ".*",
 				Namespaces:        []string{targetNS},
 			},
-			MergePatches: []mergePatch{{PatchData: vmPatch}},
+			MergePatches: []mergePatch{{PatchData: pvcStripPatch}},
 		})
 	}
 
+	// OVN IP/MAC annotations on VirtualMachine for correct network identity after restore.
+	// Only applied when keepOriginalIpAndMac is true; for restore-to-copy the copy
+	// should get new IP/MAC from the network to avoid conflicts.
+	if opts.GetKeepOriginalIpAndMac() {
+		if vmRes := getVMInstanceResources(ur); vmRes != nil && (vmRes.IP != "" || vmRes.MAC != "") {
+			ovnAnnotations := map[string]string{}
+			if vmRes.IP != "" {
+				ovnAnnotations[ovnIPAnnotation] = vmRes.IP
+			}
+			if vmRes.MAC != "" {
+				ovnAnnotations[ovnMACAnnotation] = vmRes.MAC
+			}
+			vmPatch, err := marshalPatchData(map[string]interface{}{
+				"spec": map[string]interface{}{
+					"template": map[string]interface{}{
+						"metadata": map[string]interface{}{
+							"annotations": ovnAnnotations,
+						},
+					},
+				},
+			})
+			if err != nil {
+				return nil, err
+			}
+			rules = append(rules, resourceModifierRule{
+				Conditions: resourceModifierConditions{
+					GroupResource:     "virtualmachines.kubevirt.io",
+					ResourceNameRegex: ".*",
+					Namespaces:        []string{targetNS},
+				},
+				MergePatches: []mergePatch{{PatchData: vmPatch}},
+			})
+		}
+	}
+
 	rulesYAML, err := yaml.Marshal(resourceModifiers{
 		Version:               "v1",
 		ResourceModifierRules: rules,
@@ -760,6 +960,36 @@ var (
 	dataVolumeGVR     = schema.GroupVersionResource{Group: "cdi.kubevirt.io", Version: "v1beta1", Resource: "datavolumes"}
 )
 
+// helmReleaseNameForApp returns the HelmRelease name for the given application
+// kind and name. Returns empty string for unsupported kinds.
+func helmReleaseNameForApp(appKind, appName string) string {
+	switch appKind {
+	case vmInstanceKind:
+		return vmNamePrefix + appName
+	case vmDiskAppKind:
+		return vmDiskNamePrefix + appName
+	default:
+		return ""
+	}
+}
+
+// targetHelmReleaseExists returns true when a HelmRelease with the given name
+// already exists in namespace. Returns false for unsupported application kinds
+// (those where helmReleaseNameForApp returns "").
+func (r *RestoreJobReconciler) targetHelmReleaseExists(ctx context.Context, appKind, hrName, namespace string) (bool, error) {
+	if hrName == "" {
+		return false, nil
+	}
+	_, err := r.Resource(helmReleaseGVR).Namespace(namespace).Get(ctx, hrName, metav1.GetOptions{})
+	if err != nil {
+		if errors.IsNotFound(err) {
+			return false, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
+
 // shortHash returns the first 4 hex characters of sha256(input).
 func shortHash(input string) string {
 	h := sha256.Sum256([]byte(input))
@@ -778,9 +1008,90 @@ func shortHash(input string) string {
 // (e.g. restore requested when app was already deleted). Each action emits
 // a Kubernetes Event on the RestoreJob for observability.
 //
+// postRestoreRename renames VMInstance HelmRelease after Velero Restore completes.
+// Velero resource modifiers cannot change metadata.name, so this step creates
+// a new HelmRelease with the target name and deletes the old one.
+// Flux will reconcile the renamed HelmRelease and recreate downstream resources
+// (VM, VMI) with the new name.
+func (r *RestoreJobReconciler) postRestoreRename(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, target restoreTarget) error {
+	logger := getLogger(ctx)
+	sourceAppName := backup.Spec.ApplicationRef.Name
+	sourceHRName := vmNamePrefix + sourceAppName
+	targetHRName := vmNamePrefix + target.AppName
+
+	logger.Debug("post-restore rename", "from", sourceHRName, "to", targetHRName, "namespace", target.Namespace)
+
+	// Get the restored HelmRelease with the original name
+	hrClient := r.Resource(helmReleaseGVR).Namespace(target.Namespace)
+	oldHR, err := hrClient.Get(ctx, sourceHRName, metav1.GetOptions{})
+	if err != nil {
+		if errors.IsNotFound(err) {
+			logger.Debug("source HelmRelease not found, skipping rename", "name", sourceHRName)
+			return nil
+		}
+		return fmt.Errorf("failed to get HelmRelease %s: %w", sourceHRName, err)
+	}
+
+	// Create new HelmRelease with the target name
+	newHR := oldHR.DeepCopy()
+	newHR.SetName(targetHRName)
+	newHR.SetResourceVersion("")
+	newHR.SetUID("")
+	newHR.SetCreationTimestamp(metav1.Time{})
+	newHR.SetManagedFields(nil)
+	newHR.SetGeneration(0)
+
+	// Update labels
+	labels := newHR.GetLabels()
+	if labels == nil {
+		labels = map[string]string{}
+	}
+	labels[appNameLabel] = target.AppName
+	labels["app.kubernetes.io/instance"] = targetHRName
+	labels["helm.toolkit.fluxcd.io/name"] = targetHRName
+	newHR.SetLabels(labels)
+
+	// Remove Velero restore annotations/labels that tie it to the old restore
+	annotations := newHR.GetAnnotations()
+	delete(annotations, "velero.io/restore-name")
+	newHR.SetAnnotations(annotations)
+
+	// Clear status so Flux reconciles fresh
+	unstructured.RemoveNestedField(newHR.Object, "status")
+
+	if _, err := hrClient.Create(ctx, newHR, metav1.CreateOptions{}); err != nil {
+		if errors.IsAlreadyExists(err) {
+			logger.Debug("target HelmRelease already exists, skipping create", "name", targetHRName)
+		} else {
+			return fmt.Errorf("failed to create renamed HelmRelease %s: %w", targetHRName, err)
+		}
+	} else {
+		r.Recorder.Event(restoreJob, corev1.EventTypeNormal, "PostRestoreRename",
+			fmt.Sprintf("Created renamed HelmRelease %s (from %s)", targetHRName, sourceHRName))
+	}
+
+	// Delete the old HelmRelease
+	if err := hrClient.Delete(ctx, sourceHRName, metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
+		return fmt.Errorf("failed to delete old HelmRelease %s: %w", sourceHRName, err)
+	}
+	r.Recorder.Event(restoreJob, corev1.EventTypeNormal, "PostRestoreRename",
+		fmt.Sprintf("Deleted old HelmRelease %s", sourceHRName))
+
+	logger.Debug("post-restore rename complete", "from", sourceHRName, "to", targetHRName)
+	return nil
+}
+
 // Returns true when preparation is complete and the Velero Restore can be created.
 // Returns false (with a requeue) when still waiting for VM shutdown.
-func (r *RestoreJobReconciler) prepareForRestore(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, ur *runtime.RawExtension) (ready bool, result ctrl.Result, err error) {
+func (r *RestoreJobReconciler) prepareForRestore(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, ur *runtime.RawExtension, target restoreTarget, opts RestoreOptions) (ready bool, result ctrl.Result, err error) {
+	// For restore-to-copy, skip all source-app preparation.
+	// The source application remains untouched; we're restoring a copy into another namespace.
+	if target.IsCopy {
+		r.Recorder.Event(restoreJob, corev1.EventTypeNormal, "PrepareForRestore",
+			"Restore to copy: skipping source application preparation")
+		return true, ctrl.Result{}, nil
+	}
+
 	ns := restoreJob.Namespace
 	appName := backup.Spec.ApplicationRef.Name
 	appKind := backup.Spec.ApplicationRef.Kind
@@ -828,7 +1139,8 @@ func (r *RestoreJobReconciler) prepareForRestore(ctx context.Context, restoreJob
 	// --- Step 3: Rename PVCs to <name>-orig-<hash> ---
 	// Must happen BEFORE deleting DVs: the PVC has an ownerReference to the DV,
 	// so deleting the DV first would cascade-delete the PVC via garbage collection.
-	if vmRes != nil {
+	// Only when keepOriginalPVC is true (default for in-place restore).
+	if opts.GetKeepOriginalPVC() && vmRes != nil {
 		for _, dv := range vmRes.DataVolumes {
 			if err := r.renamePVC(ctx, restoreJob, ns, dv.DataVolumeName, dv.DataVolumeName+origSuffix); err != nil {
 				r.Recorder.Event(restoreJob, corev1.EventTypeWarning, "PrepareForRestore",
@@ -908,8 +1220,14 @@ func (r *RestoreJobReconciler) haltVirtualMachine(ctx context.Context, ns, vmNam
 }
 
 // deleteDataVolume deletes a DataVolume so CDI doesn't recreate the PVC after rename.
+// Uses Orphan propagation to avoid cascade-deleting the PVC that the DV owns via
+// ownerReference. Without this, keepOriginalPVC=false would silently destroy the
+// original PVC through garbage collection instead of leaving it for Velero to overwrite.
 func (r *RestoreJobReconciler) deleteDataVolume(ctx context.Context, ns, name string) error {
-	err := r.Resource(dataVolumeGVR).Namespace(ns).Delete(ctx, name, metav1.DeleteOptions{})
+	orphan := metav1.DeletePropagationOrphan
+	err := r.Resource(dataVolumeGVR).Namespace(ns).Delete(ctx, name, metav1.DeleteOptions{
+		PropagationPolicy: &orphan,
+	})
 	if err != nil && !errors.IsNotFound(err) {
 		return err
 	}
@@ -1004,10 +1322,16 @@ func (r *RestoreJobReconciler) renamePVC(ctx context.Context, restoreJob *backup
 }
 
 // createVeleroRestore creates a Velero Restore resource.
-func (r *RestoreJobReconciler) createVeleroRestore(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, strategy *strategyv1alpha1.Velero, veleroBackupName string, ur *runtime.RawExtension) error {
+func (r *RestoreJobReconciler) createVeleroRestore(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, strategy *strategyv1alpha1.Velero, veleroBackupName string, ur *runtime.RawExtension, target restoreTarget, opts RestoreOptions) error {
 	logger := getLogger(ctx)
-	logger.Debug("createVeleroRestore called", "strategy", strategy.Name, "veleroBackupName", veleroBackupName)
+	logger.Debug("createVeleroRestore called", "strategy", strategy.Name, "veleroBackupName", veleroBackupName, "targetNS", target.Namespace, "isCopy", target.IsCopy)
 
+	// For restore template context, always use the source (backup) namespace and app name.
+	// The strategy template uses includedNamespaces and orLabelSelectors to select
+	// resources from the backup tarball, which are stored under the source namespace
+	// and labeled with the source app name.
+	// Velero's namespaceMapping handles redirecting to the target namespace;
+	// resource modifiers handle renaming when the target app name differs.
 	templateContext := map[string]interface{}{
 		"Application": map[string]interface{}{
 			"metadata": map[string]interface{}{
@@ -1034,6 +1358,16 @@ func (r *RestoreJobReconciler) createVeleroRestore(ctx context.Context, restoreJ
 	// Set the backupName in the spec (required by Velero)
 	veleroRestoreSpec.BackupName = veleroBackupName
 
+	// For restore-to-copy, set Velero namespaceMapping to redirect resources
+	// from the source namespace to the target namespace.
+	if target.IsCopy {
+		if veleroRestoreSpec.NamespaceMapping == nil {
+			veleroRestoreSpec.NamespaceMapping = make(map[string]string)
+		}
+		veleroRestoreSpec.NamespaceMapping[backup.Namespace] = target.Namespace
+		logger.Debug("set namespaceMapping on Velero Restore", "from", backup.Namespace, "to", target.Namespace)
+	}
+
 	// Match backup: add OR selectors for each underlying VMDisk so restore applies the same
 	// scope as the intended backup (see createVeleroBackup).
 	if vmRes := getVMInstanceResources(ur); vmRes != nil {
@@ -1051,7 +1385,7 @@ func (r *RestoreJobReconciler) createVeleroRestore(ctx context.Context, restoreJ
 	}
 
 	// Create resourceModifiers ConfigMap
-	resourceModifierCM, err := r.createResourceModifiersConfigMap(ctx, restoreJob, backup, ur)
+	resourceModifierCM, err := r.createResourceModifiersConfigMap(ctx, restoreJob, backup, ur, target, opts)
 	if err != nil {
 		return fmt.Errorf("failed to create resourceModifiers ConfigMap: %w", err)
 	}
diff --git a/internal/backupcontroller/velerostrategy_controller_test.go b/internal/backupcontroller/velerostrategy_controller_test.go
index a7de2076..7b085dbf 100644
--- a/internal/backupcontroller/velerostrategy_controller_test.go
+++ b/internal/backupcontroller/velerostrategy_controller_test.go
@@ -2,11 +2,13 @@ package backupcontroller
 
 import (
 	"context"
+	"encoding/json"
 	"testing"
 
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	dynamicfake "k8s.io/client-go/dynamic/fake"
@@ -206,3 +208,1006 @@ func TestCreateVeleroBackup_TemplateContext(t *testing.T) {
 		t.Errorf("Template context Parameters.backupStorageLocationName not applied correctly. Expected 'default-storage', got '%s'", veleroBackup.Spec.StorageLocation)
 	}
 }
+
+func TestResolveRestoreTarget_NoTargetNamespace_InPlace(t *testing.T) {
+	restoreJob := &backupsv1alpha1.RestoreJob{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "restore-test",
+			Namespace: "tenant-root",
+		},
+		Spec: backupsv1alpha1.RestoreJobSpec{
+			BackupRef: corev1.LocalObjectReference{Name: "my-backup"},
+			TargetApplicationRef: &corev1.TypedLocalObjectReference{
+				APIGroup: stringPtr("apps.cozystack.io"),
+				Kind:     "VMInstance",
+				Name:     "test-vm",
+			},
+		},
+	}
+
+	backup := &backupsv1alpha1.Backup{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-backup",
+			Namespace: "tenant-root",
+		},
+		Spec: backupsv1alpha1.BackupSpec{
+			ApplicationRef: corev1.TypedLocalObjectReference{
+				APIGroup: stringPtr("apps.cozystack.io"),
+				Kind:     "VMInstance",
+				Name:     "test-vm",
+			},
+		},
+	}
+
+	// No targetNamespace in options → in-place restore
+	opts := RestoreOptions{}
+	target := resolveRestoreTarget(restoreJob, backup, opts)
+
+	if target.IsCopy {
+		t.Error("expected IsCopy=false when targetNamespace is omitted, got true")
+	}
+	if target.Namespace != "tenant-root" {
+		t.Errorf("expected namespace 'tenant-root', got '%s'", target.Namespace)
+	}
+	if target.AppName != "test-vm" {
+		t.Errorf("expected appName 'test-vm', got '%s'", target.AppName)
+	}
+	if target.AppKind != "VMInstance" {
+		t.Errorf("expected appKind 'VMInstance', got '%s'", target.AppKind)
+	}
+}
+
+func TestResolveRestoreTarget_SameTargetNamespace_InPlace(t *testing.T) {
+	restoreJob := &backupsv1alpha1.RestoreJob{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "restore-test",
+			Namespace: "tenant-root",
+		},
+		Spec: backupsv1alpha1.RestoreJobSpec{
+			BackupRef: corev1.LocalObjectReference{Name: "my-backup"},
+		},
+	}
+
+	backup := &backupsv1alpha1.Backup{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-backup",
+			Namespace: "tenant-root",
+		},
+		Spec: backupsv1alpha1.BackupSpec{
+			ApplicationRef: corev1.TypedLocalObjectReference{
+				APIGroup: stringPtr("apps.cozystack.io"),
+				Kind:     "VMInstance",
+				Name:     "test-vm",
+			},
+		},
+	}
+
+	// targetNamespace equals backup namespace → still in-place
+	opts := RestoreOptions{
+		CommonRestoreOptions: CommonRestoreOptions{
+			TargetNamespace: "tenant-root",
+		},
+	}
+	target := resolveRestoreTarget(restoreJob, backup, opts)
+
+	if target.IsCopy {
+		t.Error("expected IsCopy=false when targetNamespace equals backup namespace, got true")
+	}
+	if target.Namespace != "tenant-root" {
+		t.Errorf("expected namespace 'tenant-root', got '%s'", target.Namespace)
+	}
+}
+
+func TestResolveRestoreTarget_DifferentTargetNamespace_Copy(t *testing.T) {
+	restoreJob := &backupsv1alpha1.RestoreJob{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "restore-test",
+			Namespace: "tenant-root",
+		},
+		Spec: backupsv1alpha1.RestoreJobSpec{
+			BackupRef: corev1.LocalObjectReference{Name: "my-backup"},
+		},
+	}
+
+	backup := &backupsv1alpha1.Backup{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-backup",
+			Namespace: "tenant-root",
+		},
+		Spec: backupsv1alpha1.BackupSpec{
+			ApplicationRef: corev1.TypedLocalObjectReference{
+				APIGroup: stringPtr("apps.cozystack.io"),
+				Kind:     "VMInstance",
+				Name:     "test-vm",
+			},
+		},
+	}
+
+	opts := RestoreOptions{
+		CommonRestoreOptions: CommonRestoreOptions{
+			TargetNamespace: "tenant-copy",
+		},
+	}
+	target := resolveRestoreTarget(restoreJob, backup, opts)
+
+	if !target.IsCopy {
+		t.Error("expected IsCopy=true when targetNamespace differs from backup namespace, got false")
+	}
+	if target.Namespace != "tenant-copy" {
+		t.Errorf("expected namespace 'tenant-copy', got '%s'", target.Namespace)
+	}
+}
+
+// newTestRestoreJobReconcilerWithDynamic builds a RestoreJobReconciler with
+// both static and dynamic fake clients. Use dynamicObjects to pre-populate
+// unstructured resources (e.g. HelmReleases).
+func newTestRestoreJobReconcilerWithDynamic(t *testing.T, dynamicObjects []runtime.Object, objects ...client.Object) *RestoreJobReconciler {
+	t.Helper()
+	testScheme := runtime.NewScheme()
+	_ = scheme.AddToScheme(testScheme)
+	_ = backupsv1alpha1.AddToScheme(testScheme)
+	_ = velerov1.AddToScheme(testScheme)
+
+	fakeClient := clientfake.NewClientBuilder().
+		WithScheme(testScheme).
+		WithObjects(objects...).
+		Build()
+
+	dynamicClient := dynamicfake.NewSimpleDynamicClient(testScheme, dynamicObjects...)
+
+	mapping := &meta.RESTMapping{
+		Resource:         schema.GroupVersionResource{Group: "", Version: "v1", Resource: "pods"},
+		GroupVersionKind: schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Pod"},
+		Scope:            meta.RESTScopeNamespace,
+	}
+
+	return &RestoreJobReconciler{
+		Client:     fakeClient,
+		Interface:  dynamicClient,
+		RESTMapper: &mockRESTMapper{mapping: mapping},
+		Scheme:     testScheme,
+		Recorder:   record.NewFakeRecorder(100),
+	}
+}
+
+// newTestRestoreJobReconciler builds a RestoreJobReconciler with fake clients for testing.
+func newTestRestoreJobReconciler(t *testing.T, objects ...client.Object) *RestoreJobReconciler {
+	t.Helper()
+	testScheme := runtime.NewScheme()
+	_ = scheme.AddToScheme(testScheme)
+	_ = backupsv1alpha1.AddToScheme(testScheme)
+	_ = velerov1.AddToScheme(testScheme)
+
+	fakeClient := clientfake.NewClientBuilder().
+		WithScheme(testScheme).
+		WithObjects(objects...).
+		Build()
+
+	dynamicClient := dynamicfake.NewSimpleDynamicClient(testScheme)
+
+	mapping := &meta.RESTMapping{
+		Resource:         schema.GroupVersionResource{Group: "", Version: "v1", Resource: "pods"},
+		GroupVersionKind: schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Pod"},
+		Scope:            meta.RESTScopeNamespace,
+	}
+
+	return &RestoreJobReconciler{
+		Client:     fakeClient,
+		Interface:  dynamicClient,
+		RESTMapper: &mockRESTMapper{mapping: mapping},
+		Scheme:     testScheme,
+		Recorder:   record.NewFakeRecorder(100),
+	}
+}
+
+func TestPrepareForRestore_KeepOriginalPVCFalse_SkipsRename(t *testing.T) {
+	ns := "tenant-root"
+
+	// Create a PVC that would be renamed if keepOriginalPVC were true
+	pvc := &corev1.PersistentVolumeClaim{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "vm-disk-ubuntu-source",
+			Namespace: ns,
+		},
+		Spec: corev1.PersistentVolumeClaimSpec{},
+	}
+
+	restoreJob := &backupsv1alpha1.RestoreJob{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "restore-test",
+			Namespace: ns,
+		},
+		Spec: backupsv1alpha1.RestoreJobSpec{
+			BackupRef: corev1.LocalObjectReference{Name: "my-backup"},
+		},
+	}
+
+	backup := &backupsv1alpha1.Backup{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-backup",
+			Namespace: ns,
+		},
+		Spec: backupsv1alpha1.BackupSpec{
+			ApplicationRef: corev1.TypedLocalObjectReference{
+				APIGroup: stringPtr("apps.cozystack.io"),
+				Kind:     "VMInstance",
+				Name:     "test-vm",
+			},
+		},
+	}
+
+	// underlyingResources with a DataVolume referencing the PVC
+	urData := vmInstanceResources{
+		DataVolumes: []backupsv1alpha1.DataVolumeResource{
+			{DataVolumeName: "vm-disk-ubuntu-source", ApplicationName: "ubuntu-source"},
+		},
+	}
+	urRaw, _ := json.Marshal(urData)
+	ur := &runtime.RawExtension{Raw: urRaw}
+
+	target := restoreTarget{
+		Namespace: ns,
+		AppName:   "test-vm",
+		AppKind:   "VMInstance",
+		IsCopy:    false,
+	}
+
+	// keepOriginalPVC = false → PVCs should NOT be renamed
+	opts := RestoreOptions{
+		KeepOriginalPVC: boolPtr(false),
+	}
+
+	reconciler := newTestRestoreJobReconciler(t, pvc, restoreJob, backup)
+
+	ctx := context.Background()
+	ready, _, err := reconciler.prepareForRestore(ctx, restoreJob, backup, ur, target, opts)
+	if err != nil {
+		t.Fatalf("prepareForRestore() error = %v", err)
+	}
+	if !ready {
+		t.Fatal("expected ready=true, got false")
+	}
+
+	// Verify the original PVC still exists with its original name (not renamed)
+	origPVC := &corev1.PersistentVolumeClaim{}
+	err = reconciler.Get(ctx, client.ObjectKey{Namespace: ns, Name: "vm-disk-ubuntu-source"}, origPVC)
+	if err != nil {
+		t.Errorf("original PVC should still exist with original name when keepOriginalPVC=false, got error: %v", err)
+	}
+
+	// Verify no -orig PVC was created
+	origSuffix := "-orig-" + shortHash(restoreJob.Name)
+	renamedPVC := &corev1.PersistentVolumeClaim{}
+	err = reconciler.Get(ctx, client.ObjectKey{Namespace: ns, Name: "vm-disk-ubuntu-source" + origSuffix}, renamedPVC)
+	if err == nil {
+		t.Error("PVC should NOT have been renamed when keepOriginalPVC=false, but found renamed PVC")
+	}
+}
+
+func TestResolveRestoreTarget_VMDisk_CommonRestoreOptions(t *testing.T) {
+	tests := []struct {
+		name           string
+		targetNS       string
+		wantIsCopy     bool
+		wantNamespace  string
+	}{
+		{
+			name:          "VMDisk in-place restore when targetNamespace is omitted",
+			targetNS:      "",
+			wantIsCopy:    false,
+			wantNamespace: "tenant-root",
+		},
+		{
+			name:          "VMDisk cross-namespace restore when targetNamespace differs",
+			targetNS:      "tenant-copy",
+			wantIsCopy:    true,
+			wantNamespace: "tenant-copy",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			restoreJob := &backupsv1alpha1.RestoreJob{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "restore-vmdisk",
+					Namespace: "tenant-root",
+				},
+				Spec: backupsv1alpha1.RestoreJobSpec{
+					BackupRef: corev1.LocalObjectReference{Name: "disk-backup"},
+					TargetApplicationRef: &corev1.TypedLocalObjectReference{
+						APIGroup: stringPtr("apps.cozystack.io"),
+						Kind:     "VMDisk",
+						Name:     "ubuntu-source",
+					},
+				},
+			}
+
+			backup := &backupsv1alpha1.Backup{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "disk-backup",
+					Namespace: "tenant-root",
+				},
+				Spec: backupsv1alpha1.BackupSpec{
+					ApplicationRef: corev1.TypedLocalObjectReference{
+						APIGroup: stringPtr("apps.cozystack.io"),
+						Kind:     "VMDisk",
+						Name:     "ubuntu-source",
+					},
+				},
+			}
+
+			// VMDisk uses only CommonRestoreOptions (no VMI-specific fields)
+			opts := RestoreOptions{
+				CommonRestoreOptions: CommonRestoreOptions{
+					TargetNamespace: tt.targetNS,
+				},
+			}
+
+			target := resolveRestoreTarget(restoreJob, backup, opts)
+
+			if target.IsCopy != tt.wantIsCopy {
+				t.Errorf("IsCopy = %v, want %v", target.IsCopy, tt.wantIsCopy)
+			}
+			if target.Namespace != tt.wantNamespace {
+				t.Errorf("Namespace = %q, want %q", target.Namespace, tt.wantNamespace)
+			}
+			if target.AppKind != "VMDisk" {
+				t.Errorf("AppKind = %q, want 'VMDisk'", target.AppKind)
+			}
+			if target.AppName != "ubuntu-source" {
+				t.Errorf("AppName = %q, want 'ubuntu-source'", target.AppName)
+			}
+		})
+	}
+}
+
+func TestParseRestoreOptions_VMDiskOnlyCommonFields(t *testing.T) {
+	// Simulate a VMDisk restore where only CommonRestoreOptions fields are set
+	raw, _ := json.Marshal(map[string]interface{}{
+		"targetNamespace":    "tenant-copy",
+		"failIfTargetExists": true,
+	})
+	ext := &runtime.RawExtension{Raw: raw}
+
+	opts, err := parseRestoreOptions(ext)
+	if err != nil {
+		t.Fatalf("parseRestoreOptions() error = %v", err)
+	}
+
+	if opts.TargetNamespace != "tenant-copy" {
+		t.Errorf("TargetNamespace = %q, want 'tenant-copy'", opts.TargetNamespace)
+	}
+	if !opts.GetFailIfTargetExists() {
+		t.Error("GetFailIfTargetExists() = false, want true")
+	}
+	// VMI-specific fields should be nil (not set by VMDisk options)
+	if opts.KeepOriginalPVC != nil {
+		t.Errorf("KeepOriginalPVC should be nil for VMDisk options, got %v", *opts.KeepOriginalPVC)
+	}
+	if opts.KeepOriginalIpAndMac != nil {
+		t.Errorf("KeepOriginalIpAndMac should be nil for VMDisk options, got %v", *opts.KeepOriginalIpAndMac)
+	}
+}
+
+func TestRestoreOptions_Defaults(t *testing.T) {
+	t.Run("nil options default all bools to true", func(t *testing.T) {
+		opts, err := parseRestoreOptions(nil)
+		if err != nil {
+			t.Fatalf("parseRestoreOptions(nil) error = %v", err)
+		}
+
+		if opts.TargetNamespace != "" {
+			t.Errorf("TargetNamespace default should be empty, got %q", opts.TargetNamespace)
+		}
+		if !opts.GetFailIfTargetExists() {
+			t.Error("GetFailIfTargetExists() should default to true")
+		}
+		if !opts.GetKeepOriginalPVC() {
+			t.Error("GetKeepOriginalPVC() should default to true")
+		}
+		if !opts.GetKeepOriginalIpAndMac() {
+			t.Error("GetKeepOriginalIpAndMac() should default to true")
+		}
+	})
+
+	t.Run("empty JSON defaults all bools to true", func(t *testing.T) {
+		raw, _ := json.Marshal(map[string]interface{}{})
+		opts, err := parseRestoreOptions(&runtime.RawExtension{Raw: raw})
+		if err != nil {
+			t.Fatalf("parseRestoreOptions({}) error = %v", err)
+		}
+
+		if !opts.GetFailIfTargetExists() {
+			t.Error("GetFailIfTargetExists() should default to true")
+		}
+		if !opts.GetKeepOriginalPVC() {
+			t.Error("GetKeepOriginalPVC() should default to true")
+		}
+		if !opts.GetKeepOriginalIpAndMac() {
+			t.Error("GetKeepOriginalIpAndMac() should default to true")
+		}
+	})
+
+	t.Run("explicit false overrides defaults", func(t *testing.T) {
+		raw, _ := json.Marshal(map[string]interface{}{
+			"failIfTargetExists":   false,
+			"keepOriginalPVC":      false,
+			"keepOriginalIpAndMac": false,
+		})
+		opts, err := parseRestoreOptions(&runtime.RawExtension{Raw: raw})
+		if err != nil {
+			t.Fatalf("parseRestoreOptions() error = %v", err)
+		}
+
+		if opts.GetFailIfTargetExists() {
+			t.Error("GetFailIfTargetExists() should be false when explicitly set")
+		}
+		if opts.GetKeepOriginalPVC() {
+			t.Error("GetKeepOriginalPVC() should be false when explicitly set")
+		}
+		if opts.GetKeepOriginalIpAndMac() {
+			t.Error("GetKeepOriginalIpAndMac() should be false when explicitly set")
+		}
+	})
+}
+
+func TestResolveRestoreTarget_IsRenamed(t *testing.T) {
+	backup := &backupsv1alpha1.Backup{
+		ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: "tenant-root"},
+		Spec: backupsv1alpha1.BackupSpec{
+			ApplicationRef: corev1.TypedLocalObjectReference{
+				APIGroup: stringPtr("apps.cozystack.io"),
+				Kind:     "VMInstance",
+				Name:     "test-alpine",
+			},
+		},
+	}
+
+	t.Run("same name is not renamed", func(t *testing.T) {
+		rj := &backupsv1alpha1.RestoreJob{
+			ObjectMeta: metav1.ObjectMeta{Name: "rj", Namespace: "tenant-root"},
+			Spec: backupsv1alpha1.RestoreJobSpec{
+				BackupRef: corev1.LocalObjectReference{Name: "bk"},
+				TargetApplicationRef: &corev1.TypedLocalObjectReference{
+					APIGroup: stringPtr("apps.cozystack.io"),
+					Kind:     "VMInstance",
+					Name:     "test-alpine",
+				},
+			},
+		}
+		target := resolveRestoreTarget(rj, backup, RestoreOptions{
+			CommonRestoreOptions: CommonRestoreOptions{TargetNamespace: "tenant-foo"},
+		})
+		if target.IsRenamed {
+			t.Error("IsRenamed should be false when names match")
+		}
+	})
+
+	t.Run("different name is renamed", func(t *testing.T) {
+		rj := &backupsv1alpha1.RestoreJob{
+			ObjectMeta: metav1.ObjectMeta{Name: "rj", Namespace: "tenant-root"},
+			Spec: backupsv1alpha1.RestoreJobSpec{
+				BackupRef: corev1.LocalObjectReference{Name: "bk"},
+				TargetApplicationRef: &corev1.TypedLocalObjectReference{
+					APIGroup: stringPtr("apps.cozystack.io"),
+					Kind:     "VMInstance",
+					Name:     "test-new",
+				},
+			},
+		}
+		target := resolveRestoreTarget(rj, backup, RestoreOptions{
+			CommonRestoreOptions: CommonRestoreOptions{TargetNamespace: "tenant-foo"},
+		})
+		if !target.IsRenamed {
+			t.Error("IsRenamed should be true when names differ")
+		}
+		if target.AppName != "test-new" {
+			t.Errorf("AppName = %q, want 'test-new'", target.AppName)
+		}
+		if !target.IsCopy {
+			t.Error("IsCopy should be true")
+		}
+	})
+
+	t.Run("no targetApplicationRef is not renamed", func(t *testing.T) {
+		rj := &backupsv1alpha1.RestoreJob{
+			ObjectMeta: metav1.ObjectMeta{Name: "rj", Namespace: "tenant-root"},
+			Spec: backupsv1alpha1.RestoreJobSpec{
+				BackupRef: corev1.LocalObjectReference{Name: "bk"},
+			},
+		}
+		target := resolveRestoreTarget(rj, backup, RestoreOptions{
+			CommonRestoreOptions: CommonRestoreOptions{TargetNamespace: "tenant-foo"},
+		})
+		if target.IsRenamed {
+			t.Error("IsRenamed should be false when targetApplicationRef is nil")
+		}
+		if target.AppName != "test-alpine" {
+			t.Errorf("AppName = %q, want 'test-alpine'", target.AppName)
+		}
+	})
+}
+
+// makeUnstructuredHelmRelease creates an unstructured HelmRelease for dynamic client tests.
+func makeUnstructuredHelmRelease(name, namespace string, labels map[string]string) *unstructured.Unstructured {
+	hr := &unstructured.Unstructured{}
+	hr.SetAPIVersion("helm.toolkit.fluxcd.io/v2")
+	hr.SetKind("HelmRelease")
+	hr.SetName(name)
+	hr.SetNamespace(namespace)
+	hr.SetLabels(labels)
+	return hr
+}
+
+func TestPostRestoreRename_RenamesHelmRelease(t *testing.T) {
+	ns := "tenant-foo"
+	sourceHR := makeUnstructuredHelmRelease("vm-instance-test-alpine", ns, map[string]string{
+		appNameLabel:                 "test-alpine",
+		"app.kubernetes.io/instance": "vm-instance-test-alpine",
+		"helm.toolkit.fluxcd.io/name": "vm-instance-test-alpine",
+	})
+
+	restoreJob := &backupsv1alpha1.RestoreJob{
+		ObjectMeta: metav1.ObjectMeta{Name: "rj-rename", Namespace: "tenant-root"},
+		Spec: backupsv1alpha1.RestoreJobSpec{
+			BackupRef: corev1.LocalObjectReference{Name: "bk"},
+		},
+	}
+	backup := &backupsv1alpha1.Backup{
+		ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: "tenant-root"},
+		Spec: backupsv1alpha1.BackupSpec{
+			ApplicationRef: corev1.TypedLocalObjectReference{
+				APIGroup: stringPtr("apps.cozystack.io"),
+				Kind:     "VMInstance",
+				Name:     "test-alpine",
+			},
+		},
+	}
+	target := restoreTarget{
+		Namespace: ns,
+		AppName:   "test-new",
+		AppKind:   "VMInstance",
+		IsCopy:    true,
+		IsRenamed: true,
+	}
+
+	reconciler := newTestRestoreJobReconcilerWithDynamic(t, []runtime.Object{sourceHR}, restoreJob, backup)
+	ctx := context.Background()
+
+	err := reconciler.postRestoreRename(ctx, restoreJob, backup, target)
+	if err != nil {
+		t.Fatalf("postRestoreRename() error = %v", err)
+	}
+
+	hrClient := reconciler.Resource(helmReleaseGVR).Namespace(ns)
+
+	// New HelmRelease should exist with target name
+	newHR, err := hrClient.Get(ctx, "vm-instance-test-new", metav1.GetOptions{})
+	if err != nil {
+		t.Fatalf("new HelmRelease vm-instance-test-new not found: %v", err)
+	}
+
+	// Check labels were updated
+	labels := newHR.GetLabels()
+	if labels[appNameLabel] != "test-new" {
+		t.Errorf("label %s = %q, want 'test-new'", appNameLabel, labels[appNameLabel])
+	}
+	if labels["app.kubernetes.io/instance"] != "vm-instance-test-new" {
+		t.Errorf("label app.kubernetes.io/instance = %q, want 'vm-instance-test-new'", labels["app.kubernetes.io/instance"])
+	}
+	if labels["helm.toolkit.fluxcd.io/name"] != "vm-instance-test-new" {
+		t.Errorf("label helm.toolkit.fluxcd.io/name = %q, want 'vm-instance-test-new'", labels["helm.toolkit.fluxcd.io/name"])
+	}
+
+	// Old HelmRelease should be deleted
+	_, err = hrClient.Get(ctx, "vm-instance-test-alpine", metav1.GetOptions{})
+	if err == nil {
+		t.Error("old HelmRelease vm-instance-test-alpine should have been deleted")
+	}
+}
+
+func TestPostRestoreRename_SkipsWhenSourceNotFound(t *testing.T) {
+	restoreJob := &backupsv1alpha1.RestoreJob{
+		ObjectMeta: metav1.ObjectMeta{Name: "rj-rename", Namespace: "tenant-root"},
+		Spec: backupsv1alpha1.RestoreJobSpec{
+			BackupRef: corev1.LocalObjectReference{Name: "bk"},
+		},
+	}
+	backup := &backupsv1alpha1.Backup{
+		ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: "tenant-root"},
+		Spec: backupsv1alpha1.BackupSpec{
+			ApplicationRef: corev1.TypedLocalObjectReference{
+				APIGroup: stringPtr("apps.cozystack.io"),
+				Kind:     "VMInstance",
+				Name:     "test-alpine",
+			},
+		},
+	}
+	target := restoreTarget{
+		Namespace: "tenant-foo",
+		AppName:   "test-new",
+		AppKind:   "VMInstance",
+		IsCopy:    true,
+		IsRenamed: true,
+	}
+
+	// No HelmRelease in dynamic client — should skip gracefully
+	reconciler := newTestRestoreJobReconcilerWithDynamic(t, nil, restoreJob, backup)
+	ctx := context.Background()
+
+	err := reconciler.postRestoreRename(ctx, restoreJob, backup, target)
+	if err != nil {
+		t.Fatalf("postRestoreRename() should skip gracefully when source HR not found, got error: %v", err)
+	}
+}
+
+func TestPostRestoreRename_IdempotentWhenTargetExists(t *testing.T) {
+	ns := "tenant-foo"
+	sourceHR := makeUnstructuredHelmRelease("vm-instance-test-alpine", ns, map[string]string{
+		appNameLabel: "test-alpine",
+	})
+	// Target already exists (e.g. from a previous reconcile)
+	targetHR := makeUnstructuredHelmRelease("vm-instance-test-new", ns, map[string]string{
+		appNameLabel: "test-new",
+	})
+
+	restoreJob := &backupsv1alpha1.RestoreJob{
+		ObjectMeta: metav1.ObjectMeta{Name: "rj-rename", Namespace: "tenant-root"},
+		Spec: backupsv1alpha1.RestoreJobSpec{
+			BackupRef: corev1.LocalObjectReference{Name: "bk"},
+		},
+	}
+	backup := &backupsv1alpha1.Backup{
+		ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: "tenant-root"},
+		Spec: backupsv1alpha1.BackupSpec{
+			ApplicationRef: corev1.TypedLocalObjectReference{
+				APIGroup: stringPtr("apps.cozystack.io"),
+				Kind:     "VMInstance",
+				Name:     "test-alpine",
+			},
+		},
+	}
+	target := restoreTarget{
+		Namespace: ns,
+		AppName:   "test-new",
+		AppKind:   "VMInstance",
+		IsCopy:    true,
+		IsRenamed: true,
+	}
+
+	reconciler := newTestRestoreJobReconcilerWithDynamic(t, []runtime.Object{sourceHR, targetHR}, restoreJob, backup)
+	ctx := context.Background()
+
+	err := reconciler.postRestoreRename(ctx, restoreJob, backup, target)
+	if err != nil {
+		t.Fatalf("postRestoreRename() should be idempotent, got error: %v", err)
+	}
+
+	hrClient := reconciler.Resource(helmReleaseGVR).Namespace(ns)
+
+	// Target should still exist
+	_, err = hrClient.Get(ctx, "vm-instance-test-new", metav1.GetOptions{})
+	if err != nil {
+		t.Fatalf("target HelmRelease should exist: %v", err)
+	}
+
+	// Source should be deleted
+	_, err = hrClient.Get(ctx, "vm-instance-test-alpine", metav1.GetOptions{})
+	if err == nil {
+		t.Error("source HelmRelease should have been deleted")
+	}
+}
+
+// --- failIfTargetExists enforcement tests ---
+
+func TestTargetHelmReleaseExists_ReturnsTrueWhenPresent(t *testing.T) {
+	ns := "tenant-copy"
+	hr := makeUnstructuredHelmRelease("vm-instance-test", ns, nil)
+
+	restoreJob := &backupsv1alpha1.RestoreJob{
+		ObjectMeta: metav1.ObjectMeta{Name: "rj", Namespace: "tenant-root"},
+	}
+	backup := &backupsv1alpha1.Backup{ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: "tenant-root"}}
+
+	reconciler := newTestRestoreJobReconcilerWithDynamic(t, []runtime.Object{hr}, restoreJob, backup)
+	ctx := context.Background()
+
+	exists, err := reconciler.targetHelmReleaseExists(ctx, vmInstanceKind, "vm-instance-test", ns)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !exists {
+		t.Error("expected exists=true when HelmRelease is present")
+	}
+}
+
+func TestTargetHelmReleaseExists_ReturnsFalseWhenAbsent(t *testing.T) {
+	ns := "tenant-copy"
+	restoreJob := &backupsv1alpha1.RestoreJob{
+		ObjectMeta: metav1.ObjectMeta{Name: "rj", Namespace: "tenant-root"},
+	}
+	backup := &backupsv1alpha1.Backup{ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: "tenant-root"}}
+
+	reconciler := newTestRestoreJobReconcilerWithDynamic(t, nil, restoreJob, backup)
+	ctx := context.Background()
+
+	exists, err := reconciler.targetHelmReleaseExists(ctx, vmInstanceKind, "vm-instance-test", ns)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if exists {
+		t.Error("expected exists=false when HelmRelease is absent")
+	}
+}
+
+func TestTargetHelmReleaseExists_UnsupportedKindViaHelper(t *testing.T) {
+	ns := "tenant-copy"
+	// Even though a HR exists, unsupported kinds produce an empty hrName
+	// from helmReleaseNameForApp, which makes targetHelmReleaseExists return false.
+	hr := makeUnstructuredHelmRelease("vm-instance-test", ns, nil)
+
+	restoreJob := &backupsv1alpha1.RestoreJob{
+		ObjectMeta: metav1.ObjectMeta{Name: "rj", Namespace: "tenant-root"},
+	}
+	backup := &backupsv1alpha1.Backup{ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: "tenant-root"}}
+
+	reconciler := newTestRestoreJobReconcilerWithDynamic(t, []runtime.Object{hr}, restoreJob, backup)
+	ctx := context.Background()
+
+	// Unsupported kinds get empty hrName from the helper
+	hrName := helmReleaseNameForApp("MariaDB", "mydb")
+	exists, err := reconciler.targetHelmReleaseExists(ctx, "MariaDB", hrName, ns)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if exists {
+		t.Error("expected exists=false for unsupported kind (empty hrName)")
+	}
+}
+
+// --- createResourceModifiersConfigMap tests ---
+
+func makeTestBackup(ns, appName, appKind string) *backupsv1alpha1.Backup {
+	return &backupsv1alpha1.Backup{
+		ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: ns},
+		Spec: backupsv1alpha1.BackupSpec{
+			ApplicationRef: corev1.TypedLocalObjectReference{
+				APIGroup: stringPtr("apps.cozystack.io"),
+				Kind:     appKind,
+				Name:     appName,
+			},
+		},
+	}
+}
+
+func makeTestRestoreJob(ns, name string) *backupsv1alpha1.RestoreJob {
+	return &backupsv1alpha1.RestoreJob{
+		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: ns},
+		Spec: backupsv1alpha1.RestoreJobSpec{
+			BackupRef: corev1.LocalObjectReference{Name: "bk"},
+		},
+	}
+}
+
+func makeVMInstanceUR(ip, mac string, dvs []backupsv1alpha1.DataVolumeResource) *runtime.RawExtension {
+	data := vmInstanceResources{IP: ip, MAC: mac, DataVolumes: dvs}
+	raw, _ := json.Marshal(data)
+	return &runtime.RawExtension{Raw: raw}
+}
+
+func TestCreateResourceModifiersConfigMap_InPlace_WithOVN(t *testing.T) {
+	ns := "tenant-root"
+	restoreJob := makeTestRestoreJob(ns, "rj-inplace")
+	backup := makeTestBackup(ns, "test-vm", "VMInstance")
+
+	ur := makeVMInstanceUR("10.0.0.5", "aa:bb:cc:dd:ee:ff", nil)
+	target := restoreTarget{Namespace: ns, AppName: "test-vm", AppKind: "VMInstance", IsCopy: false}
+	opts := RestoreOptions{} // defaults: keepOriginalIpAndMac=true
+
+	reconciler := newTestRestoreJobReconciler(t, restoreJob, backup)
+	ctx := context.Background()
+
+	cm, err := reconciler.createResourceModifiersConfigMap(ctx, restoreJob, backup, ur, target, opts)
+	if err != nil {
+		t.Fatalf("createResourceModifiersConfigMap() error = %v", err)
+	}
+	if cm == nil {
+		t.Fatal("expected non-nil ConfigMap")
+	}
+
+	rulesYAML, ok := cm.Data["resource-modifier-rules.yaml"]
+	if !ok {
+		t.Fatal("ConfigMap missing resource-modifier-rules.yaml key")
+	}
+
+	// Should contain PVC adoption annotation
+	if !containsString(rulesYAML, cdiAllowClaimAdoption) {
+		t.Error("expected PVC adoption annotation in rules")
+	}
+	// Should contain OVN IP annotation (keepOriginalIpAndMac defaults to true)
+	if !containsString(rulesYAML, ovnIPAnnotation) {
+		t.Error("expected OVN IP annotation in rules for in-place restore with IP")
+	}
+	// Should NOT contain selector removal (in-place, not copy)
+	if containsString(rulesYAML, "/spec/selector") {
+		t.Error("selector removal rule should not be present for in-place restore")
+	}
+}
+
+func TestCreateResourceModifiersConfigMap_Copy_NoOVN(t *testing.T) {
+	sourceNS := "tenant-root"
+	targetNS := "tenant-copy"
+	restoreJob := makeTestRestoreJob(sourceNS, "rj-copy")
+	backup := makeTestBackup(sourceNS, "test-vm", "VMInstance")
+
+	// Copy restore: keepOriginalIpAndMac=false, no OVN annotations on copy
+	opts := RestoreOptions{
+		KeepOriginalIpAndMac: boolPtr(false),
+	}
+	ur := makeVMInstanceUR("10.0.0.5", "aa:bb:cc:dd:ee:ff", nil)
+	target := restoreTarget{Namespace: targetNS, AppName: "test-vm", AppKind: "VMInstance", IsCopy: true}
+
+	reconciler := newTestRestoreJobReconciler(t, restoreJob, backup)
+	ctx := context.Background()
+
+	cm, err := reconciler.createResourceModifiersConfigMap(ctx, restoreJob, backup, ur, target, opts)
+	if err != nil {
+		t.Fatalf("createResourceModifiersConfigMap() error = %v", err)
+	}
+
+	rulesYAML := cm.Data["resource-modifier-rules.yaml"]
+
+	// Should contain PVC adoption annotation
+	if !containsString(rulesYAML, cdiAllowClaimAdoption) {
+		t.Error("expected PVC adoption annotation in rules")
+	}
+	// Should contain merge patch nulling out selector and volumeName (copy restore)
+	if !containsString(rulesYAML, "selector: null") {
+		t.Error("expected selector: null merge patch for copy restore")
+	}
+	if !containsString(rulesYAML, "volumeName: null") {
+		t.Error("expected volumeName: null merge patch for copy restore")
+	}
+	// Should NOT contain OVN annotations (keepOriginalIpAndMac=false)
+	if containsString(rulesYAML, ovnIPAnnotation) {
+		t.Error("OVN IP annotation should not be present when keepOriginalIpAndMac=false")
+	}
+}
+
+func TestCreateResourceModifiersConfigMap_AlreadyExists_IsIdempotent(t *testing.T) {
+	ns := "tenant-root"
+	restoreJob := makeTestRestoreJob(ns, "rj-idem")
+	backup := makeTestBackup(ns, "test-vm", "VMInstance")
+
+	target := restoreTarget{Namespace: ns, AppName: "test-vm", AppKind: "VMInstance", IsCopy: false}
+	opts := RestoreOptions{}
+	ur := makeVMInstanceUR("", "", nil)
+
+	reconciler := newTestRestoreJobReconciler(t, restoreJob, backup)
+	ctx := context.Background()
+
+	// First call creates the ConfigMap.
+	cm1, err := reconciler.createResourceModifiersConfigMap(ctx, restoreJob, backup, ur, target, opts)
+	if err != nil {
+		t.Fatalf("first call error = %v", err)
+	}
+
+	// Second call must not error (AlreadyExists → update path).
+	cm2, err := reconciler.createResourceModifiersConfigMap(ctx, restoreJob, backup, ur, target, opts)
+	if err != nil {
+		t.Fatalf("second call error = %v", err)
+	}
+	if cm1.Name != cm2.Name {
+		t.Errorf("ConfigMap name changed: %q → %q", cm1.Name, cm2.Name)
+	}
+}
+
+// --- helmReleaseNameForApp tests ---
+
+func TestHelmReleaseNameForApp(t *testing.T) {
+	tests := []struct {
+		kind, name, want string
+	}{
+		{vmInstanceKind, "test-alpine", "vm-instance-test-alpine"},
+		{vmDiskAppKind, "ubuntu-source", "vm-disk-ubuntu-source"},
+		{"MariaDB", "mydb", ""},
+	}
+	for _, tt := range tests {
+		t.Run(tt.kind+"/"+tt.name, func(t *testing.T) {
+			got := helmReleaseNameForApp(tt.kind, tt.name)
+			if got != tt.want {
+				t.Errorf("helmReleaseNameForApp(%q, %q) = %q, want %q", tt.kind, tt.name, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestTargetHelmReleaseExists_VMDisk(t *testing.T) {
+	ns := "tenant-copy"
+	hr := makeUnstructuredHelmRelease("vm-disk-ubuntu-source", ns, nil)
+
+	restoreJob := &backupsv1alpha1.RestoreJob{
+		ObjectMeta: metav1.ObjectMeta{Name: "rj", Namespace: "tenant-root"},
+	}
+	backup := &backupsv1alpha1.Backup{ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: "tenant-root"}}
+
+	reconciler := newTestRestoreJobReconcilerWithDynamic(t, []runtime.Object{hr}, restoreJob, backup)
+	ctx := context.Background()
+
+	hrName := helmReleaseNameForApp(vmDiskAppKind, "ubuntu-source")
+	exists, err := reconciler.targetHelmReleaseExists(ctx, vmDiskAppKind, hrName, ns)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !exists {
+		t.Error("expected exists=true for VMDisk HelmRelease")
+	}
+}
+
+func TestTargetHelmReleaseExists_UnsupportedKind_ReturnsFalse(t *testing.T) {
+	restoreJob := &backupsv1alpha1.RestoreJob{
+		ObjectMeta: metav1.ObjectMeta{Name: "rj", Namespace: "tenant-root"},
+	}
+	backup := &backupsv1alpha1.Backup{ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: "tenant-root"}}
+
+	reconciler := newTestRestoreJobReconcilerWithDynamic(t, nil, restoreJob, backup)
+	ctx := context.Background()
+
+	// Unsupported kinds produce empty hrName which returns false
+	hrName := helmReleaseNameForApp("MariaDB", "mydb")
+	exists, err := reconciler.targetHelmReleaseExists(ctx, "MariaDB", hrName, "tenant-copy")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if exists {
+		t.Error("expected exists=false for unsupported kind")
+	}
+}
+
+// --- ResourceModifier merge patch test for copy restore ---
+
+func TestCreateResourceModifiersConfigMap_Copy_UsesMergePatchForPVC(t *testing.T) {
+	sourceNS := "tenant-root"
+	targetNS := "tenant-copy"
+	restoreJob := makeTestRestoreJob(sourceNS, "rj-copy-merge")
+	backup := makeTestBackup(sourceNS, "test-vm", "VMInstance")
+
+	opts := RestoreOptions{KeepOriginalIpAndMac: boolPtr(false)}
+	ur := makeVMInstanceUR("", "", nil)
+	target := restoreTarget{Namespace: targetNS, AppName: "test-vm", AppKind: "VMInstance", IsCopy: true}
+
+	reconciler := newTestRestoreJobReconciler(t, restoreJob, backup)
+	ctx := context.Background()
+
+	cm, err := reconciler.createResourceModifiersConfigMap(ctx, restoreJob, backup, ur, target, opts)
+	if err != nil {
+		t.Fatalf("createResourceModifiersConfigMap() error = %v", err)
+	}
+
+	rulesYAML := cm.Data["resource-modifier-rules.yaml"]
+
+	// Should use merge patch (patchData with null), NOT JSON patch (operation: remove)
+	if containsString(rulesYAML, "operation: remove") {
+		t.Error("should use merge patch instead of JSON Patch remove for PVC fields")
+	}
+	// The merge patch should null out selector and volumeName
+	if !containsString(rulesYAML, "selector: null") {
+		t.Error("expected selector: null in merge patch")
+	}
+	if !containsString(rulesYAML, "volumeName: null") {
+		t.Error("expected volumeName: null in merge patch")
+	}
+}
+
+// containsString reports whether substr appears in s.
+func containsString(s, substr string) bool {
+	if len(substr) == 0 || len(s) < len(substr) {
+		return false
+	}
+	for i := 0; i <= len(s)-len(substr); i++ {
+		if s[i:i+len(substr)] == substr {
+			return true
+		}
+	}
+	return false
+}
diff --git a/packages/system/backup-controller/definitions/backups.cozystack.io_restorejobs.yaml b/packages/system/backup-controller/definitions/backups.cozystack.io_restorejobs.yaml
index 400737fc..b9465994 100644
--- a/packages/system/backup-controller/definitions/backups.cozystack.io_restorejobs.yaml
+++ b/packages/system/backup-controller/definitions/backups.cozystack.io_restorejobs.yaml
@@ -59,6 +59,12 @@ spec:
                     type: string
                 type: object
                 x-kubernetes-map-type: atomic
+              options:
+                description: |-
+                  Options is a driver-specific blob of restore options, typed based on
+                  targetApplicationRef and the current controller implementation.
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
               targetApplicationRef:
                 description: |-
                   TargetApplicationRef refers to the application into which the backup
diff --git a/packages/system/backupstrategy-controller/templates/rbac.yaml b/packages/system/backupstrategy-controller/templates/rbac.yaml
index 2216577e..bbdb74f8 100644
--- a/packages/system/backupstrategy-controller/templates/rbac.yaml
+++ b/packages/system/backupstrategy-controller/templates/rbac.yaml
@@ -46,10 +46,10 @@ rules:
 - apiGroups: ["cdi.kubevirt.io"]
   resources: ["datavolumes"]
   verbs: ["delete"]
-# HelmReleases: pre-restore suspends HRs to prevent Flux interference
+# HelmReleases: pre-restore suspends HRs; post-restore rename creates new HR and deletes old
 - apiGroups: ["helm.toolkit.fluxcd.io"]
   resources: ["helmreleases"]
-  verbs: ["get", "update"]
+  verbs: ["get", "create", "update", "delete"]
 # PVCs and PVs: pre-restore renames PVCs (delete old, create new) and patches PV reclaim policy
 - apiGroups: [""]
   resources: ["persistentvolumeclaims"]
@@ -65,6 +65,11 @@ rules:
 - apiGroups: ["velero.io"]
   resources: ["deletebackuprequests"]
   verbs: ["create", "get", "list", "watch"]
+# Namespaces: validate target namespace exists for cross-namespace restore
+# controller-runtime cache requires list/watch for any resource accessed via r.Get()
+- apiGroups: [""]
+  resources: ["namespaces"]
+  verbs: ["get", "list", "watch"]
 # Events from Recorder.Event() calls
 - apiGroups: [""]
   resources: ["events"]

From b8d48ad7115cff008ae4b1238de62f40243e633b Mon Sep 17 00:00:00 2001
From: mattia-eleuteri <mattia@hidora.io>
Date: Thu, 9 Apr 2026 16:31:24 +0200
Subject: [PATCH 386/666] [monitoring] Fix infra dashboards missing in default
 variant

The default variant deploys monitoring to the cozy-monitoring namespace,
but the infra dashboards condition only checked for tenant-root. This
adds cozy-monitoring to the condition, consistent with the existing
pattern in vmagent.yaml.

Fixes cozystack/cozystack#2349

Signed-off-by: mattia-eleuteri <mattia@hidora.io>
---
 packages/system/monitoring/templates/dashboards.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/system/monitoring/templates/dashboards.yaml b/packages/system/monitoring/templates/dashboards.yaml
index 01f1c009..0427bfa0 100644
--- a/packages/system/monitoring/templates/dashboards.yaml
+++ b/packages/system/monitoring/templates/dashboards.yaml
@@ -14,7 +14,7 @@ spec:
   url: http://grafana-dashboards.cozy-grafana-operator.svc/{{ . }}.json
 {{- end }}
 {{- end }}
-{{- if eq .Release.Namespace "tenant-root" }}
+{{- if or (eq .Release.Namespace "tenant-root") (eq .Release.Namespace "cozy-monitoring") }}
 {{- range (split "\n" (.Files.Get "dashboards-infra.list")) }}
 {{- $parts := split "/" . }}
 {{- if eq (len $parts) 2 }}

From a3f50ba2bd92865d11caf2da6f659ccbf636f953 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Fri, 10 Apr 2026 12:47:46 +0500
Subject: [PATCH 387/666] Fix system postgresql images to 17.7-standard-trixie

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .../platform/images/migrations/migrations/37  | 89 +++++++++++++------
 packages/core/platform/values.yaml            |  2 +-
 .../system/harbor/templates/database.yaml     |  4 +-
 packages/system/keycloak/templates/db.yaml    |  4 +-
 .../templates/alerta/alerta-db.yaml           |  4 +-
 .../monitoring/templates/grafana/db.yaml      |  4 +-
 .../system/seaweedfs/templates/database.yaml  |  4 +-
 7 files changed, 78 insertions(+), 33 deletions(-)

diff --git a/packages/core/platform/images/migrations/migrations/37 b/packages/core/platform/images/migrations/migrations/37
index b8ff3147..856da262 100755
--- a/packages/core/platform/images/migrations/migrations/37
+++ b/packages/core/platform/images/migrations/migrations/37
@@ -1,42 +1,77 @@
-#!/bin/sh
+#!/bin/bash
 # Migration 37 --> 38
-# Backfill spec.version on postgreses.apps.cozystack.io resources.
+# Pin PostgreSQL image to 17.7-standard-trixie for system databases.
 #
-# Before this migration PostgreSQL had a default version field set to v18.
-# This migration sets spec.version to "v17" for any postgres app resource that
-# does not already have it set, to ensure compatibility with monitoring
-# configurations that are hardcoded to PostgreSQL 17.
+# This migration updates the imageName for all CNPG clusters belonging to
+# system components (keycloak-db, grafana-db, alerta-db, seaweedfs-db, and
+# harbor's dynamically-named DB):
+# - If imageName is not set: pins to 17.7-standard-trixie
+# - If imageName has any PG 17 tag: forces 17.7-standard-trixie
+# - If imageName has a bare version tag (e.g. :18.1): appends -standard-trixie
+#
+# NOTE: This migration ONLY updates system CNPG Cluster resources (clusters.postgresql.cnpg.io),
+# NOT user-created Postgres applications.
 
 set -euo pipefail
 
-DEFAULT_VERSION="v17"
+TARGET_IMAGE="ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie"
 
-# Skip if the CRD does not exist (postgres was never installed)
-if ! kubectl api-resources --api-group=apps.cozystack.io -o name 2>/dev/null | grep -q '^postgreses\.'; then
-  echo "CRD postgreses.apps.cozystack.io not found, skipping migration"
-  kubectl create configmap -n cozy-system cozystack-version \
-    --from-literal=version=38 --dry-run=client -o yaml | kubectl apply -f-
-  exit 0
-fi
+# Static system database names
+STATIC_DB_NAMES="keycloak-db grafana-db alerta-db seaweedfs-db"
 
-POSTGRESES=$(kubectl get postgreses.apps.cozystack.io -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}')
-for resource in $POSTGRESES; do
-  NS="${resource%%/*}"
-  APP_NAME="${resource##*/}"
+echo "=== Updating PostgreSQL images for system databases ==="
+echo "Target image: $TARGET_IMAGE"
 
-  # Skip if spec.version is already set
-  CURRENT_VER=$(kubectl get postgreses.apps.cozystack.io -n "$NS" "$APP_NAME" \
-    -o jsonpath='{.spec.version}')
-  if [ -n "$CURRENT_VER" ]; then
-    echo "SKIP $NS/$APP_NAME: spec.version already set to '$CURRENT_VER'"
+# Fetch all CNPG clusters with their name, namespace, imageName, and Helm release annotation in one call
+ALL_CLUSTERS=$(kubectl get clusters.postgresql.cnpg.io -A \
+  -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}{.spec.imageName}{"\t"}{.metadata.annotations.meta\.helm\.sh/release-name}{"\n"}{end}' 2>/dev/null || true)
+
+while IFS=$'\t' read -r NAMESPACE CLUSTER_NAME CURRENT_IMAGE HELM_RELEASE; do
+  [ -z "$NAMESPACE" ] && continue
+
+  # Check if cluster name matches one of the static system databases
+  MATCH=false
+  for db_name in $STATIC_DB_NAMES; do
+    if [ "$CLUSTER_NAME" = "$db_name" ]; then
+      MATCH=true
+      break
+    fi
+  done
+
+  # For harbor: match clusters ending with -db whose Helm release ends with -system
+  if [ "$MATCH" = false ] && [[ "$CLUSTER_NAME" == *-db ]] && [[ "$HELM_RELEASE" == *-system ]]; then
+    MATCH=true
+  fi
+
+  if [ "$MATCH" = false ]; then
     continue
   fi
 
-  echo "Patching postgres/$APP_NAME in $NS: setting version=$DEFAULT_VERSION"
+  PATCH_IMAGE=""
 
-  kubectl patch postgreses.apps.cozystack.io -n "$NS" "$APP_NAME" --type=merge \
-    --patch "{\"spec\":{\"version\":\"${DEFAULT_VERSION}\"}}"
-done
+  if [ -z "$CURRENT_IMAGE" ]; then
+    # imageName not set — pin to target
+    PATCH_IMAGE="$TARGET_IMAGE"
+    echo "PATCH $NAMESPACE/$CLUSTER_NAME: imageName not set, setting to $PATCH_IMAGE"
+  elif [[ "$CURRENT_IMAGE" =~ :17\. ]]; then
+    # Any PG 17 image — force to the pinned 17.7-standard-trixie
+    PATCH_IMAGE="$TARGET_IMAGE"
+    echo "PATCH $NAMESPACE/$CLUSTER_NAME: PG 17 detected, $CURRENT_IMAGE -> $PATCH_IMAGE"
+  elif [[ "$CURRENT_IMAGE" =~ :[0-9]+\.[0-9]+$ ]]; then
+    # Bare version tag for other majors (e.g. :18.1) — append -standard-trixie suffix
+    PATCH_IMAGE="${CURRENT_IMAGE}-standard-trixie"
+    echo "PATCH $NAMESPACE/$CLUSTER_NAME: bare tag detected, $CURRENT_IMAGE -> $PATCH_IMAGE"
+  else
+    echo "SKIP $NAMESPACE/$CLUSTER_NAME: imageName already set to $CURRENT_IMAGE"
+    continue
+  fi
+
+  kubectl patch clusters.postgresql.cnpg.io -n "$NAMESPACE" "$CLUSTER_NAME" \
+    --type=merge \
+    --patch "{\"spec\":{\"imageName\":\"${PATCH_IMAGE}\"}}"
+done <<< "$ALL_CLUSTERS"
+
+echo "=== PostgreSQL image update completed ==="
 
 # Stamp version
 kubectl create configmap -n cozy-system cozystack-version \
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index a2c97d8c..77eb00d7 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -6,7 +6,7 @@ sourceRef:
 migrations:
   enabled: false
   image: ghcr.io/cozystack/cozystack/platform-migrations:v1.2.1@sha256:e8fcf006a4451fc0e961455e9b27a61b7103ee49b1a81fe5e4662ffed093fad6
-  targetVersion: 37
+  targetVersion: 38
 # Bundle deployment configuration
 bundles:
   system:
diff --git a/packages/system/harbor/templates/database.yaml b/packages/system/harbor/templates/database.yaml
index 02e11faa..9a948601 100644
--- a/packages/system/harbor/templates/database.yaml
+++ b/packages/system/harbor/templates/database.yaml
@@ -5,7 +5,9 @@ metadata:
   name: {{ .Values.harbor.fullnameOverride }}-db
 spec:
   instances: {{ .Values.db.replicas }}
-  imageName: ghcr.io/cloudnative-pg/postgresql:17.7
+  {{- $existingCluster := lookup "postgresql.cnpg.io/v1" "Cluster" .Release.Namespace (printf "%s-db" .Values.harbor.fullnameOverride) }}
+  {{- $image := dig "spec" "imageName" "ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie" $existingCluster }}
+  imageName: {{ if regexMatch ":17\\." $image }}ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie{{ else if regexMatch ":[0-9]+\\.[0-9]+$" $image }}{{ printf "%s-standard-trixie" $image }}{{ else }}{{ $image }}{{ end }}
   storage:
     size: {{ .Values.db.size }}
     {{- with .Values.db.storageClass }}
diff --git a/packages/system/keycloak/templates/db.yaml b/packages/system/keycloak/templates/db.yaml
index fb649a43..6a57e93a 100644
--- a/packages/system/keycloak/templates/db.yaml
+++ b/packages/system/keycloak/templates/db.yaml
@@ -4,7 +4,9 @@ metadata:
   name: keycloak-db
 spec:
   instances: 2
-  imageName: ghcr.io/cloudnative-pg/postgresql:17.7
+  {{- $existingCluster := lookup "postgresql.cnpg.io/v1" "Cluster" .Release.Namespace "keycloak-db" }}
+  {{- $image := dig "spec" "imageName" "ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie" $existingCluster }}
+  imageName: {{ if regexMatch ":17\\." $image }}ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie{{ else if regexMatch ":[0-9]+\\.[0-9]+$" $image }}{{ printf "%s-standard-trixie" $image }}{{ else }}{{ $image }}{{ end }}
   storage:
     size: 20Gi
   {{- if .Values._cluster.scheduling }}
diff --git a/packages/system/monitoring/templates/alerta/alerta-db.yaml b/packages/system/monitoring/templates/alerta/alerta-db.yaml
index 71df5428..af9dc72c 100644
--- a/packages/system/monitoring/templates/alerta/alerta-db.yaml
+++ b/packages/system/monitoring/templates/alerta/alerta-db.yaml
@@ -5,7 +5,9 @@ metadata:
   name: alerta-db
 spec:
   instances: 2
-  imageName: ghcr.io/cloudnative-pg/postgresql:17.7
+  {{- $existingCluster := lookup "postgresql.cnpg.io/v1" "Cluster" .Release.Namespace "alerta-db" }}
+  {{- $image := dig "spec" "imageName" "ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie" $existingCluster }}
+  imageName: {{ if regexMatch ":17\\." $image }}ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie{{ else if regexMatch ":[0-9]+\\.[0-9]+$" $image }}{{ printf "%s-standard-trixie" $image }}{{ else }}{{ $image }}{{ end }}
   {{- if .Values._cluster.scheduling }}
   {{- $rawConstraints := get .Values._cluster.scheduling "globalAppTopologySpreadConstraints" }}
   {{- if $rawConstraints }}
diff --git a/packages/system/monitoring/templates/grafana/db.yaml b/packages/system/monitoring/templates/grafana/db.yaml
index 73d6502e..afc2d0d7 100644
--- a/packages/system/monitoring/templates/grafana/db.yaml
+++ b/packages/system/monitoring/templates/grafana/db.yaml
@@ -4,7 +4,9 @@ metadata:
   name: grafana-db
 spec:
   instances: 2
-  imageName: ghcr.io/cloudnative-pg/postgresql:17.7
+  {{- $existingCluster := lookup "postgresql.cnpg.io/v1" "Cluster" .Release.Namespace "grafana-db" }}
+  {{- $image := dig "spec" "imageName" "ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie" $existingCluster }}
+  imageName: {{ if regexMatch ":17\\." $image }}ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie{{ else if regexMatch ":[0-9]+\\.[0-9]+$" $image }}{{ printf "%s-standard-trixie" $image }}{{ else }}{{ $image }}{{ end }}
   storage:
     size: {{ .Values.grafana.db.size }}
   {{- if .Values._cluster.scheduling }}
diff --git a/packages/system/seaweedfs/templates/database.yaml b/packages/system/seaweedfs/templates/database.yaml
index 1c116dd0..b9b50c49 100644
--- a/packages/system/seaweedfs/templates/database.yaml
+++ b/packages/system/seaweedfs/templates/database.yaml
@@ -5,7 +5,9 @@ metadata:
   name: seaweedfs-db
 spec:
   instances: {{ .Values.db.replicas }}
-  imageName: ghcr.io/cloudnative-pg/postgresql:17.7
+  {{- $existingCluster := lookup "postgresql.cnpg.io/v1" "Cluster" .Release.Namespace "seaweedfs-db" }}
+  {{- $image := dig "spec" "imageName" "ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie" $existingCluster }}
+  imageName: {{ if regexMatch ":17\\." $image }}ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie{{ else if regexMatch ":[0-9]+\\.[0-9]+$" $image }}{{ printf "%s-standard-trixie" $image }}{{ else }}{{ $image }}{{ end }}
   storage:
     size: {{ .Values.db.size }}
     {{- with .Values.db.storageClass }}

From 6c0ae2570ec36f3edbb09c8136535b4c1807c273 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 13:23:33 +0300
Subject: [PATCH 388/666] [cilium] Opt-out of cri-containerd.apparmor.d for
 nsenter init containers

Cilium 1.19 init containers mount-cgroup, apply-sysctl-overwrites,
mount-bpf-fs and clean-cilium-state call nsenter --ptrace, which is
denied by the cri-containerd.apparmor.d profile on Ubuntu 22.04+ and
any other distro loading this AppArmor profile. As a result cilium
agent pods land in Init:CrashLoopBackOff and downstream HelmReleases
cascade into "dependency not ready".

The modern k8s >= 1.30 pod-level appArmorProfile: Unconfined field is
accepted into the DaemonSet spec but not honoured by containerd CRI
at runtime (kubernetes/kubernetes#125069), so the deprecated
per-container AppArmor annotations remain the only reliable opt-out.

Add the annotations via podAnnotations in the wrapper values.yaml.
The change is harmless on systems without AppArmor (Talos,
RHEL/Rocky/AlmaLinux with SELinux) because kubelet silently ignores
unknown AppArmor annotations when the LSM is not loaded.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/cilium/values.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml
index cfb2cd6b..048c4312 100644
--- a/packages/system/cilium/values.yaml
+++ b/packages/system/cilium/values.yaml
@@ -23,3 +23,18 @@ cilium:
   operator:
     rollOutPods: true
     replicas: 1
+  # Opt out of the cri-containerd.apparmor.d profile for containers that invoke
+  # nsenter --ptrace to join the host cgroup/mount namespace. Required on
+  # Ubuntu 22.04+ and other distros that load this AppArmor profile by default,
+  # where the denial puts cilium-agent into Init:CrashLoopBackOff.
+  # The deprecated annotations are used because k8s >= 1.30 pod-level
+  # appArmorProfile: Unconfined is not honoured by containerd CRI today
+  # (kubernetes/kubernetes#125069).
+  # Safe on Talos / RHEL family without AppArmor: kubelet ignores these
+  # annotations when the AppArmor LSM is not loaded.
+  podAnnotations:
+    container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined
+    container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined
+    container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined
+    container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: unconfined
+    container.apparmor.security.beta.kubernetes.io/mount-bpf-fs: unconfined

From 2531ab661a34ea9f07040db965d8db5d2ffe7201 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 13:41:01 +0300
Subject: [PATCH 389/666] [cilium] Drop mount-bpf-fs from AppArmor unconfined
 annotations

mount-bpf-fs runs as privileged in the vendored chart, and the Linux
kernel does not apply AppArmor profiles to privileged containers. The
per-container unconfined annotation for this container is a no-op and
only widens the pod's admission-policy surface for no reason.

Keep the four meaningful annotations (cilium-agent, clean-cilium-state,
mount-cgroup, apply-sysctl-overwrites) which target unprivileged agent
and init containers actually affected by the cri-containerd.apparmor.d
profile.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/cilium/values.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml
index 048c4312..4b2e1ff3 100644
--- a/packages/system/cilium/values.yaml
+++ b/packages/system/cilium/values.yaml
@@ -32,9 +32,10 @@ cilium:
   # (kubernetes/kubernetes#125069).
   # Safe on Talos / RHEL family without AppArmor: kubelet ignores these
   # annotations when the AppArmor LSM is not loaded.
+  # mount-bpf-fs is intentionally excluded: it runs as privileged, and the
+  # kernel does not apply AppArmor profiles to privileged containers.
   podAnnotations:
     container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined
     container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined
     container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined
     container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: unconfined
-    container.apparmor.security.beta.kubernetes.io/mount-bpf-fs: unconfined

From 703dbca734c07162036d4d9dc5c12180ce59b438 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 13:54:16 +0300
Subject: [PATCH 390/666] [cilium] Document duplicate-key rendering on
 unsupported k8s < 1.30

On Kubernetes versions below 1.30 the upstream cilium chart still emits
the deprecated per-container AppArmor annotations from its own
semverCompare '<1.30.0' branch. Our podAnnotations override then emits
the same keys again, yielding a YAML mapping with duplicate entries
(identical values, last-wins by kubernetes API server JSON semantics).

Cozystack's supported Kubernetes matrix starts at 1.30
(packages/apps/kubernetes/files/versions.yaml), so this rendering
quirk never affects any shipped version. Document the behaviour in a
comment so future readers are not surprised.

No functional change.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/cilium/values.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml
index 4b2e1ff3..cd31c107 100644
--- a/packages/system/cilium/values.yaml
+++ b/packages/system/cilium/values.yaml
@@ -34,6 +34,11 @@ cilium:
   # annotations when the AppArmor LSM is not loaded.
   # mount-bpf-fs is intentionally excluded: it runs as privileged, and the
   # kernel does not apply AppArmor profiles to privileged containers.
+  # On unsupported k8s < 1.30 the upstream chart renders the same keys
+  # inside its own <1.30 branch, yielding a duplicate mapping with
+  # identical values (last-wins). The supported matrix starts at 1.30
+  # (packages/apps/kubernetes/files/versions.yaml), so this does not
+  # affect any shipped version.
   podAnnotations:
     container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined
     container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined

From 55c2dcf869f05065c99d6084255e9150d30350d6 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 14:03:55 +0300
Subject: [PATCH 391/666] test(hack): add bats tests for host runtime preflight
 check

Add hack/check-host-runtime.bats with six self-contained test cases that
exercise the check-host-runtime.sh preflight script: clean host exits
silently, standalone containerd.service warns, standalone docker.service
warns, both services warn, du failures do not suppress warnings, and the
socket-only fallback fires when systemctl is unavailable.

Tests inject a stub systemctl and du binary via PATH and redirect the
script's probe paths through COZYSTACK_PREFLIGHT_* environment variables,
so they run without root and on any host (including non-systemd macOS).

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/check-host-runtime.bats | 214 +++++++++++++++++++++++++++++++++++
 1 file changed, 214 insertions(+)
 create mode 100644 hack/check-host-runtime.bats

diff --git a/hack/check-host-runtime.bats b/hack/check-host-runtime.bats
new file mode 100644
index 00000000..8ae478c9
--- /dev/null
+++ b/hack/check-host-runtime.bats
@@ -0,0 +1,214 @@
+#!/usr/bin/env bats
+# -----------------------------------------------------------------------------
+# Unit tests for hack/check-host-runtime.sh
+#
+# The script warns when a standalone containerd.service or docker.service is
+# active alongside the embedded k3s runtime on Ubuntu hosts running the
+# cozystack "generic" variant. Warnings go to stderr; exit code is always 0.
+#
+# Test strategy: each test builds its own temporary stub directory and prepends
+# it to PATH to inject a fake `systemctl` (and optionally `du`) binary. The
+# script itself honors a small set of COZYSTACK_PREFLIGHT_* environment
+# variables to redirect socket/dir probes into the stub tree, so tests do not
+# need root privileges or a real systemd host.
+#
+# Tests are self-contained — no shared setup/teardown helpers, because
+# cozytest.sh's awk parser only recognizes @test blocks and treats a bare `}`
+# on its own line as the end of a test function.
+#
+# Run with: hack/cozytest.sh hack/check-host-runtime.bats
+#           (or `bats hack/check-host-runtime.bats` if the bats binary is
+#           installed; cozytest.sh is the CI path.)
+# -----------------------------------------------------------------------------
+
+@test "clean host with no runtime services exits silently" {
+  STUB_DIR=$(mktemp -d)
+  cat >"$STUB_DIR/systemctl" <<'STUBEOF'
+#!/bin/sh
+if [ "$1" = "--version" ]; then
+  echo "systemd stub"
+  exit 0
+fi
+exit 1
+STUBEOF
+  chmod +x "$STUB_DIR/systemctl"
+
+  STDERR_FILE="$STUB_DIR/stderr"
+  COZYSTACK_CONTAINERD_SOCKET="$STUB_DIR/missing-containerd.sock" \
+  COZYSTACK_DOCKER_SOCKET_PATHS="$STUB_DIR/missing-docker1.sock $STUB_DIR/missing-docker2.sock" \
+  COZYSTACK_CONTAINERD_DIR="$STUB_DIR/missing-containerd-dir" \
+  COZYSTACK_DOCKER_DIR="$STUB_DIR/missing-docker-dir" \
+  PATH="$STUB_DIR:$PATH" \
+    bash hack/check-host-runtime.sh >"$STUB_DIR/stdout" 2>"$STDERR_FILE"
+
+  [ ! -s "$STDERR_FILE" ]
+  [ ! -s "$STUB_DIR/stdout" ]
+
+  rm -rf "$STUB_DIR"
+}
+
+@test "standalone containerd service active prints warning" {
+  STUB_DIR=$(mktemp -d)
+  cat >"$STUB_DIR/systemctl" <<'STUBEOF'
+#!/bin/sh
+if [ "$1" = "--version" ]; then
+  echo "systemd stub"
+  exit 0
+fi
+if [ "$1" = "is-active" ] && [ "$2" = "containerd.service" ]; then
+  echo active
+  exit 0
+fi
+exit 1
+STUBEOF
+  chmod +x "$STUB_DIR/systemctl"
+
+  mkdir -p "$STUB_DIR/var-lib-containerd"
+  echo dummy >"$STUB_DIR/var-lib-containerd/dummy"
+
+  STDERR_FILE="$STUB_DIR/stderr"
+  COZYSTACK_CONTAINERD_SOCKET="$STUB_DIR/missing-containerd.sock" \
+  COZYSTACK_DOCKER_SOCKET_PATHS="$STUB_DIR/missing-docker.sock" \
+  COZYSTACK_CONTAINERD_DIR="$STUB_DIR/var-lib-containerd" \
+  COZYSTACK_DOCKER_DIR="$STUB_DIR/missing-docker-dir" \
+  PATH="$STUB_DIR:$PATH" \
+    bash hack/check-host-runtime.sh 2>"$STDERR_FILE"
+
+  grep -q 'standalone containerd.service' "$STDERR_FILE"
+  if grep -q 'standalone docker.service' "$STDERR_FILE"; then
+    echo "unexpected docker warning found:" >&2
+    cat "$STDERR_FILE" >&2
+    exit 1
+  fi
+
+  rm -rf "$STUB_DIR"
+}
+
+@test "standalone docker service active prints warning" {
+  STUB_DIR=$(mktemp -d)
+  cat >"$STUB_DIR/systemctl" <<'STUBEOF'
+#!/bin/sh
+if [ "$1" = "--version" ]; then
+  echo "systemd stub"
+  exit 0
+fi
+if [ "$1" = "is-active" ] && [ "$2" = "docker.service" ]; then
+  echo active
+  exit 0
+fi
+exit 1
+STUBEOF
+  chmod +x "$STUB_DIR/systemctl"
+
+  mkdir -p "$STUB_DIR/var-lib-docker"
+  echo dummy >"$STUB_DIR/var-lib-docker/dummy"
+
+  STDERR_FILE="$STUB_DIR/stderr"
+  COZYSTACK_CONTAINERD_SOCKET="$STUB_DIR/missing-containerd.sock" \
+  COZYSTACK_DOCKER_SOCKET_PATHS="$STUB_DIR/missing-docker.sock" \
+  COZYSTACK_CONTAINERD_DIR="$STUB_DIR/missing-containerd-dir" \
+  COZYSTACK_DOCKER_DIR="$STUB_DIR/var-lib-docker" \
+  PATH="$STUB_DIR:$PATH" \
+    bash hack/check-host-runtime.sh 2>"$STDERR_FILE"
+
+  grep -q 'standalone docker.service' "$STDERR_FILE"
+  if grep -q 'standalone containerd.service' "$STDERR_FILE"; then
+    echo "unexpected containerd warning found:" >&2
+    cat "$STDERR_FILE" >&2
+    exit 1
+  fi
+
+  rm -rf "$STUB_DIR"
+}
+
+@test "both services active prints two warnings" {
+  STUB_DIR=$(mktemp -d)
+  cat >"$STUB_DIR/systemctl" <<'STUBEOF'
+#!/bin/sh
+if [ "$1" = "--version" ]; then
+  echo "systemd stub"
+  exit 0
+fi
+if [ "$1" = "is-active" ]; then
+  case "$2" in
+    containerd.service|docker.service) echo active; exit 0 ;;
+  esac
+fi
+exit 1
+STUBEOF
+  chmod +x "$STUB_DIR/systemctl"
+
+  mkdir -p "$STUB_DIR/var-lib-containerd" "$STUB_DIR/var-lib-docker"
+
+  STDERR_FILE="$STUB_DIR/stderr"
+  COZYSTACK_CONTAINERD_SOCKET="$STUB_DIR/missing-containerd.sock" \
+  COZYSTACK_DOCKER_SOCKET_PATHS="$STUB_DIR/missing-docker.sock" \
+  COZYSTACK_CONTAINERD_DIR="$STUB_DIR/var-lib-containerd" \
+  COZYSTACK_DOCKER_DIR="$STUB_DIR/var-lib-docker" \
+  PATH="$STUB_DIR:$PATH" \
+    bash hack/check-host-runtime.sh 2>"$STDERR_FILE"
+
+  grep -q 'standalone containerd.service' "$STDERR_FILE"
+  grep -q 'standalone docker.service' "$STDERR_FILE"
+
+  rm -rf "$STUB_DIR"
+}
+
+@test "failing du does not suppress the containerd warning" {
+  STUB_DIR=$(mktemp -d)
+  cat >"$STUB_DIR/systemctl" <<'STUBEOF'
+#!/bin/sh
+if [ "$1" = "--version" ]; then
+  echo "systemd stub"
+  exit 0
+fi
+if [ "$1" = "is-active" ] && [ "$2" = "containerd.service" ]; then
+  echo active
+  exit 0
+fi
+exit 1
+STUBEOF
+  chmod +x "$STUB_DIR/systemctl"
+  cat >"$STUB_DIR/du" <<'DUEOF'
+#!/bin/sh
+exit 1
+DUEOF
+  chmod +x "$STUB_DIR/du"
+
+  mkdir -p "$STUB_DIR/var-lib-containerd"
+
+  STDERR_FILE="$STUB_DIR/stderr"
+  COZYSTACK_CONTAINERD_SOCKET="$STUB_DIR/missing-containerd.sock" \
+  COZYSTACK_DOCKER_SOCKET_PATHS="$STUB_DIR/missing-docker.sock" \
+  COZYSTACK_CONTAINERD_DIR="$STUB_DIR/var-lib-containerd" \
+  COZYSTACK_DOCKER_DIR="$STUB_DIR/missing-docker-dir" \
+  PATH="$STUB_DIR:$PATH" \
+    bash hack/check-host-runtime.sh 2>"$STDERR_FILE"
+
+  grep -q 'standalone containerd.service' "$STDERR_FILE"
+
+  rm -rf "$STUB_DIR"
+}
+
+@test "socket only fallback fires when systemctl is unavailable" {
+  STUB_DIR=$(mktemp -d)
+  SOCK="$STUB_DIR/containerd.sock"
+  if ! command -v python3 >/dev/null 2>&1; then
+    echo "python3 not available - skipping socket fallback test" >&2
+    rm -rf "$STUB_DIR"
+    return 0
+  fi
+  python3 -c 'import socket,sys; s=socket.socket(socket.AF_UNIX); s.bind(sys.argv[1])' "$SOCK"
+
+  STDERR_FILE="$STUB_DIR/stderr"
+  COZYSTACK_PREFLIGHT_FORCE_NO_SYSTEMCTL=1 \
+  COZYSTACK_CONTAINERD_SOCKET="$SOCK" \
+  COZYSTACK_DOCKER_SOCKET_PATHS="$STUB_DIR/missing-docker.sock" \
+  COZYSTACK_CONTAINERD_DIR="$STUB_DIR/missing-containerd-dir" \
+  COZYSTACK_DOCKER_DIR="$STUB_DIR/missing-docker-dir" \
+    bash hack/check-host-runtime.sh 2>"$STDERR_FILE"
+
+  grep -q 'standalone containerd.service' "$STDERR_FILE"
+
+  rm -rf "$STUB_DIR"
+}

From 7c822166d86c0000e6c9949eadcb10dbbcf242f5 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 14:04:13 +0300
Subject: [PATCH 392/666] feat(hack): add check-host-runtime.sh preflight
 diagnostic
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Ubuntu hosts running the cozystack "generic" variant (k3s or kubeadm)
sometimes end up with a standalone containerd.service or docker.service
running alongside the embedded k3s runtime. The two runtimes do not fight
over sockets — k3s uses /run/k3s/containerd/containerd.sock while the
standalone package uses /run/containerd/containerd.sock — so both keep
running silently, and the standalone one accumulates unpruned images and
build cache in /var/lib/containerd. Over time this fills the root disk,
triggers DiskPressure, and sends cozystack-api into an eviction loop.

hack/check-host-runtime.sh warns an operator about this before install
without blocking it. The script probes systemctl and well-known socket
paths, reports disk usage of the standalone data directory when present,
prints a hint on how to disable the shadow runtime, and always exits 0.

Covered by hack/check-host-runtime.bats (six test cases).

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/check-host-runtime.sh | 129 +++++++++++++++++++++++++++++++++++++
 1 file changed, 129 insertions(+)
 create mode 100755 hack/check-host-runtime.sh

diff --git a/hack/check-host-runtime.sh b/hack/check-host-runtime.sh
new file mode 100755
index 00000000..a3ec6f2d
--- /dev/null
+++ b/hack/check-host-runtime.sh
@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+# -----------------------------------------------------------------------------
+# check-host-runtime.sh — operator preflight warning
+#
+# Purpose:
+#   Warn when a standalone containerd.service or docker.service is running on
+#   the host alongside the embedded k3s runtime. This mismatch is silent on
+#   day 0 (k3s uses its own containerd at /run/k3s/containerd/containerd.sock
+#   and /var/lib/rancher/k3s/agent/containerd) but over time the standalone
+#   runtime accumulates unpruned images and build cache in /var/lib/containerd
+#   — enough to trigger DiskPressure and crash cozystack-api with eviction
+#   loops. The script does NOT block install; it only prints a warning.
+#
+# When to run:
+#   Before `helm install cozy-installer` on an Ubuntu host prepared with k3s
+#   or kubeadm (cozystack "generic" variant). Irrelevant on Talos where the
+#   container runtime lifecycle is fully managed.
+#
+# Exit code:
+#   Always 0 (warning, not a blocker). Warnings go to stderr.
+#
+# Environment variables (test hooks — override default probe paths):
+#   COZYSTACK_CONTAINERD_SOCKET        standalone containerd socket path
+#   COZYSTACK_DOCKER_SOCKET_PATHS      space-separated list of docker socket paths
+#   COZYSTACK_CONTAINERD_DIR           standalone containerd data directory
+#   COZYSTACK_DOCKER_DIR               standalone docker data directory
+#   COZYSTACK_PREFLIGHT_FORCE_NO_SYSTEMCTL=1    pretend systemctl is absent
+# -----------------------------------------------------------------------------
+set -euo pipefail
+
+YELLOW='\033[1;33m'
+RESET='\033[0m'
+
+CONTAINERD_SOCKET=${COZYSTACK_CONTAINERD_SOCKET:-/run/containerd/containerd.sock}
+DOCKER_SOCKET_PATHS=${COZYSTACK_DOCKER_SOCKET_PATHS:-/run/docker.sock /var/run/docker.sock}
+CONTAINERD_DIR=${COZYSTACK_CONTAINERD_DIR:-/var/lib/containerd}
+DOCKER_DIR=${COZYSTACK_DOCKER_DIR:-/var/lib/docker}
+
+WARNINGS=0
+
+warn() {
+    printf '%bWARNING:%b %s\n' "$YELLOW" "$RESET" "$1" >&2
+    WARNINGS=$((WARNINGS + 1))
+}
+
+detect_systemctl() {
+    if [ "${COZYSTACK_PREFLIGHT_FORCE_NO_SYSTEMCTL:-0}" = "1" ]; then
+        return 1
+    fi
+    if command -v systemctl >/dev/null 2>&1 && systemctl --version >/dev/null 2>&1; then
+        return 0
+    fi
+    return 1
+}
+
+disk_usage() {
+    local path=$1
+    local usage
+    if [ -d "$path" ]; then
+        usage=$(du -sh "$path" 2>/dev/null | awk '{print $1}' || true)
+        if [ -n "${usage:-}" ]; then
+            printf ' (%s uses %s)' "$path" "$usage"
+            return 0
+        fi
+    fi
+    printf ''
+}
+
+service_active() {
+    local service=$1
+    if [ "$HAS_SYSTEMCTL" = "1" ]; then
+        if systemctl is-active "$service" >/dev/null 2>&1; then
+            return 0
+        fi
+    fi
+    return 1
+}
+
+check_containerd() {
+    local detail=""
+    local found=0
+    if service_active containerd.service; then
+        found=1
+    fi
+    if [ -e "$CONTAINERD_SOCKET" ]; then
+        found=1
+    fi
+    if [ "$found" -eq 1 ]; then
+        detail=$(disk_usage "$CONTAINERD_DIR")
+        warn "standalone containerd.service detected alongside k3s embedded runtime${detail}"
+    fi
+}
+
+check_docker() {
+    local detail=""
+    local found=0
+    if service_active docker.service; then
+        found=1
+    fi
+    if [ "$found" -eq 0 ]; then
+        for sock in $DOCKER_SOCKET_PATHS; do
+            if [ -e "$sock" ]; then
+                found=1
+                break
+            fi
+        done
+    fi
+    if [ "$found" -eq 1 ]; then
+        detail=$(disk_usage "$DOCKER_DIR")
+        warn "standalone docker.service detected alongside k3s embedded runtime${detail}"
+    fi
+}
+
+if detect_systemctl; then
+    HAS_SYSTEMCTL=1
+else
+    HAS_SYSTEMCTL=0
+fi
+
+check_containerd
+check_docker
+
+if [ "$WARNINGS" -gt 0 ]; then
+    printf '%bHINT:%b cozystack runs its own containerd under k3s. To stop the shadow runtime:\n' "$YELLOW" "$RESET" >&2
+    printf '  sudo systemctl disable --now docker.service containerd.service\n' >&2
+    printf '  sudo rm -rf /var/lib/docker /var/lib/containerd\n' >&2
+fi
+
+exit 0

From 7b1364e00bcea5df6856e4a27cdd3158e07dd3e5 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 14:11:40 +0300
Subject: [PATCH 393/666] build(hack): wire bats unit tests into make
 unit-tests target

Add a bats-unit-tests Make target that runs hack/cozytest.sh against
hack/check-host-runtime.bats, and make unit-tests depend on it so the
existing CI step (make unit-tests in .github/workflows/pull-requests.yaml)
exercises the preflight script on every PR. Without this the bats file
exists in the tree but is never executed, leaving future regressions
undetected.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 Makefile | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 59a55bfb..aaffcc81 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: manifests assets unit-tests helm-unit-tests
+.PHONY: manifests assets unit-tests helm-unit-tests bats-unit-tests
 
 include hack/common-envs.mk
 
@@ -82,11 +82,14 @@ test:
 	make -C packages/core/testing apply
 	make -C packages/core/testing test
 
-unit-tests: helm-unit-tests
+unit-tests: helm-unit-tests bats-unit-tests
 
 helm-unit-tests:
 	hack/helm-unit-tests.sh
 
+bats-unit-tests:
+	hack/cozytest.sh hack/check-host-runtime.bats
+
 prepare-env:
 	make -C packages/core/testing apply
 	make -C packages/core/testing prepare-cluster

From 87e206de3924b0925c4591dfbc131f704aaeeff2 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 14:11:50 +0300
Subject: [PATCH 394/666] fix(hack): symmetrize runtime checks and soften HINT
 text

Two small issues caught in review:

1. check_containerd probed the socket unconditionally even when
   service_active had already set found=1, while check_docker short
   circuited the same path behind 'if \[ $found -eq 0 \]'. The
   asymmetry was not user visible but violated least surprise for
   future maintainers. check_containerd now uses the same gated pattern.

2. The HINT block recommended 'sudo rm -rf /var/lib/docker
   /var/lib/containerd' as a casual follow up, which could destroy data
   the operator still needs. Replace that line with a warning telling
   the operator to inspect and reclaim standalone runtime storage
   manually rather than deleting it blindly.

Also drop a no op 'printf' from disk_usage that served no purpose.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/check-host-runtime.sh | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/hack/check-host-runtime.sh b/hack/check-host-runtime.sh
index a3ec6f2d..97401391 100755
--- a/hack/check-host-runtime.sh
+++ b/hack/check-host-runtime.sh
@@ -60,10 +60,8 @@ disk_usage() {
         usage=$(du -sh "$path" 2>/dev/null | awk '{print $1}' || true)
         if [ -n "${usage:-}" ]; then
             printf ' (%s uses %s)' "$path" "$usage"
-            return 0
         fi
     fi
-    printf ''
 }
 
 service_active() {
@@ -82,7 +80,7 @@ check_containerd() {
     if service_active containerd.service; then
         found=1
     fi
-    if [ -e "$CONTAINERD_SOCKET" ]; then
+    if [ "$found" -eq 0 ] && [ -e "$CONTAINERD_SOCKET" ]; then
         found=1
     fi
     if [ "$found" -eq 1 ]; then
@@ -123,7 +121,8 @@ check_docker
 if [ "$WARNINGS" -gt 0 ]; then
     printf '%bHINT:%b cozystack runs its own containerd under k3s. To stop the shadow runtime:\n' "$YELLOW" "$RESET" >&2
     printf '  sudo systemctl disable --now docker.service containerd.service\n' >&2
-    printf '  sudo rm -rf /var/lib/docker /var/lib/containerd\n' >&2
+    printf 'Inspect and reclaim standalone runtime storage separately — it may contain container data\n' >&2
+    printf 'that the operator still needs; do not delete it blindly.\n' >&2
 fi
 
 exit 0

From 9a2e889dd9a8369f84115762c1ab4f883cad83fc Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 14:12:00 +0300
Subject: [PATCH 395/666] test(hack): cover docker socket fallback, HINT block,
 and single warning guarantee
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Address review feedback on the preflight test suite:

- Add a trap 'rm -rf $STUB_DIR' EXIT in every test immediately after
  mktemp -d, so temp dirs are cleaned up even when an assertion fails
  and terminates the test early under set -e.

- Assert the HINT block and 'systemctl disable --now' line in the
  'both services active' test so a future silent removal or typo in
  the HINT output is caught by CI.

- New test: 'docker socket fallback fires when systemctl is
  unavailable' — mirrors the existing containerd socket fallback test
  and exercises the same code path in check_docker.

- New test: 'containerd service plus socket still emits exactly one
  warning' — documents and locks in the intent of the symmetric gated
  check in check_containerd. Uses grep -c to assert the warning is not
  double printed when both signals fire.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/check-host-runtime.bats | 116 +++++++++++++++++++++++++++++------
 1 file changed, 97 insertions(+), 19 deletions(-)

diff --git a/hack/check-host-runtime.bats b/hack/check-host-runtime.bats
index 8ae478c9..73b464ea 100644
--- a/hack/check-host-runtime.bats
+++ b/hack/check-host-runtime.bats
@@ -12,9 +12,14 @@
 # variables to redirect socket/dir probes into the stub tree, so tests do not
 # need root privileges or a real systemd host.
 #
-# Tests are self-contained — no shared setup/teardown helpers, because
-# cozytest.sh's awk parser only recognizes @test blocks and treats a bare `}`
-# on its own line as the end of a test function.
+# Each test installs a `trap 'rm -rf "$STUB_DIR"' EXIT` immediately after
+# creating the stub dir so cleanup runs even when an assertion fails mid-test
+# under `set -e`. cozytest.sh runs each @test in its own subshell, so traps
+# scope per test and do not leak across tests.
+#
+# Tests are otherwise self-contained — no shared setup/teardown helpers,
+# because cozytest.sh's awk parser only recognizes @test blocks and treats a
+# bare `}` on its own line as the end of a test function.
 #
 # Run with: hack/cozytest.sh hack/check-host-runtime.bats
 #           (or `bats hack/check-host-runtime.bats` if the bats binary is
@@ -23,6 +28,8 @@
 
 @test "clean host with no runtime services exits silently" {
   STUB_DIR=$(mktemp -d)
+  trap 'rm -rf "$STUB_DIR"' EXIT
+
   cat >"$STUB_DIR/systemctl" <<'STUBEOF'
 #!/bin/sh
 if [ "$1" = "--version" ]; then
@@ -43,12 +50,12 @@ STUBEOF
 
   [ ! -s "$STDERR_FILE" ]
   [ ! -s "$STUB_DIR/stdout" ]
-
-  rm -rf "$STUB_DIR"
 }
 
 @test "standalone containerd service active prints warning" {
   STUB_DIR=$(mktemp -d)
+  trap 'rm -rf "$STUB_DIR"' EXIT
+
   cat >"$STUB_DIR/systemctl" <<'STUBEOF'
 #!/bin/sh
 if [ "$1" = "--version" ]; then
@@ -80,12 +87,12 @@ STUBEOF
     cat "$STDERR_FILE" >&2
     exit 1
   fi
-
-  rm -rf "$STUB_DIR"
 }
 
 @test "standalone docker service active prints warning" {
   STUB_DIR=$(mktemp -d)
+  trap 'rm -rf "$STUB_DIR"' EXIT
+
   cat >"$STUB_DIR/systemctl" <<'STUBEOF'
 #!/bin/sh
 if [ "$1" = "--version" ]; then
@@ -117,12 +124,12 @@ STUBEOF
     cat "$STDERR_FILE" >&2
     exit 1
   fi
-
-  rm -rf "$STUB_DIR"
 }
 
-@test "both services active prints two warnings" {
+@test "both services active prints two warnings and the HINT block" {
   STUB_DIR=$(mktemp -d)
+  trap 'rm -rf "$STUB_DIR"' EXIT
+
   cat >"$STUB_DIR/systemctl" <<'STUBEOF'
 #!/bin/sh
 if [ "$1" = "--version" ]; then
@@ -150,12 +157,16 @@ STUBEOF
 
   grep -q 'standalone containerd.service' "$STDERR_FILE"
   grep -q 'standalone docker.service' "$STDERR_FILE"
-
-  rm -rf "$STUB_DIR"
+  # HINT block must fire whenever warnings exist; otherwise a future silent
+  # removal of the HINT would go unnoticed.
+  grep -q 'HINT:' "$STDERR_FILE"
+  grep -q 'systemctl disable --now' "$STDERR_FILE"
 }
 
 @test "failing du does not suppress the containerd warning" {
   STUB_DIR=$(mktemp -d)
+  trap 'rm -rf "$STUB_DIR"' EXIT
+
   cat >"$STUB_DIR/systemctl" <<'STUBEOF'
 #!/bin/sh
 if [ "$1" = "--version" ]; then
@@ -186,18 +197,17 @@ DUEOF
     bash hack/check-host-runtime.sh 2>"$STDERR_FILE"
 
   grep -q 'standalone containerd.service' "$STDERR_FILE"
-
-  rm -rf "$STUB_DIR"
 }
 
-@test "socket only fallback fires when systemctl is unavailable" {
+@test "containerd socket fallback fires when systemctl is unavailable" {
   STUB_DIR=$(mktemp -d)
-  SOCK="$STUB_DIR/containerd.sock"
+  trap 'rm -rf "$STUB_DIR"' EXIT
+
   if ! command -v python3 >/dev/null 2>&1; then
     echo "python3 not available - skipping socket fallback test" >&2
-    rm -rf "$STUB_DIR"
     return 0
   fi
+  SOCK="$STUB_DIR/containerd.sock"
   python3 -c 'import socket,sys; s=socket.socket(socket.AF_UNIX); s.bind(sys.argv[1])' "$SOCK"
 
   STDERR_FILE="$STUB_DIR/stderr"
@@ -209,6 +219,74 @@ DUEOF
     bash hack/check-host-runtime.sh 2>"$STDERR_FILE"
 
   grep -q 'standalone containerd.service' "$STDERR_FILE"
-
-  rm -rf "$STUB_DIR"
+}
+
+@test "docker socket fallback fires when systemctl is unavailable" {
+  STUB_DIR=$(mktemp -d)
+  trap 'rm -rf "$STUB_DIR"' EXIT
+
+  if ! command -v python3 >/dev/null 2>&1; then
+    echo "python3 not available - skipping docker socket fallback test" >&2
+    return 0
+  fi
+  SOCK="$STUB_DIR/docker.sock"
+  python3 -c 'import socket,sys; s=socket.socket(socket.AF_UNIX); s.bind(sys.argv[1])' "$SOCK"
+
+  STDERR_FILE="$STUB_DIR/stderr"
+  COZYSTACK_PREFLIGHT_FORCE_NO_SYSTEMCTL=1 \
+  COZYSTACK_CONTAINERD_SOCKET="$STUB_DIR/missing-containerd.sock" \
+  COZYSTACK_DOCKER_SOCKET_PATHS="$SOCK" \
+  COZYSTACK_CONTAINERD_DIR="$STUB_DIR/missing-containerd-dir" \
+  COZYSTACK_DOCKER_DIR="$STUB_DIR/missing-docker-dir" \
+    bash hack/check-host-runtime.sh 2>"$STDERR_FILE"
+
+  grep -q 'standalone docker.service' "$STDERR_FILE"
+  if grep -q 'standalone containerd.service' "$STDERR_FILE"; then
+    echo "unexpected containerd warning found:" >&2
+    cat "$STDERR_FILE" >&2
+    exit 1
+  fi
+}
+
+@test "containerd service plus socket still emits exactly one warning" {
+  STUB_DIR=$(mktemp -d)
+  trap 'rm -rf "$STUB_DIR"' EXIT
+
+  cat >"$STUB_DIR/systemctl" <<'STUBEOF'
+#!/bin/sh
+if [ "$1" = "--version" ]; then
+  echo "systemd stub"
+  exit 0
+fi
+if [ "$1" = "is-active" ] && [ "$2" = "containerd.service" ]; then
+  echo active
+  exit 0
+fi
+exit 1
+STUBEOF
+  chmod +x "$STUB_DIR/systemctl"
+
+  if ! command -v python3 >/dev/null 2>&1; then
+    echo "python3 not available - skipping service+socket test" >&2
+    return 0
+  fi
+  SOCK="$STUB_DIR/containerd.sock"
+  python3 -c 'import socket,sys; s=socket.socket(socket.AF_UNIX); s.bind(sys.argv[1])' "$SOCK"
+
+  mkdir -p "$STUB_DIR/var-lib-containerd"
+
+  STDERR_FILE="$STUB_DIR/stderr"
+  COZYSTACK_CONTAINERD_SOCKET="$SOCK" \
+  COZYSTACK_DOCKER_SOCKET_PATHS="$STUB_DIR/missing-docker.sock" \
+  COZYSTACK_CONTAINERD_DIR="$STUB_DIR/var-lib-containerd" \
+  COZYSTACK_DOCKER_DIR="$STUB_DIR/missing-docker-dir" \
+  PATH="$STUB_DIR:$PATH" \
+    bash hack/check-host-runtime.sh 2>"$STDERR_FILE"
+
+  count=$(grep -c 'standalone containerd.service' "$STDERR_FILE")
+  if [ "$count" != "1" ]; then
+    echo "expected exactly one containerd warning, got $count" >&2
+    cat "$STDERR_FILE" >&2
+    exit 1
+  fi
 }

From e803ce77a7dd90f553b8e075f33519d65722a748 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 14:21:18 +0300
Subject: [PATCH 396/666] fix(hack): conditional HINT names only detected
 services

When only containerd.service was active, the HINT block still advised
the operator to disable both containerd.service and docker.service,
which is misleading and potentially dangerous on hosts where docker is
legitimately in use. Track per service warnings (CONTAINERD_WARN and
DOCKER_WARN) and build the HINT systemctl disable argument from the
services that actually fired.

Also guard the ANSI color escapes behind an 'is stderr a TTY' check so
log files (CI and reviewer captures) do not accumulate raw escape
sequences.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/check-host-runtime.sh | 37 ++++++++++++++++++++++++++++---------
 1 file changed, 28 insertions(+), 9 deletions(-)

diff --git a/hack/check-host-runtime.sh b/hack/check-host-runtime.sh
index 97401391..653f3cb3 100755
--- a/hack/check-host-runtime.sh
+++ b/hack/check-host-runtime.sh
@@ -14,7 +14,8 @@
 # When to run:
 #   Before `helm install cozy-installer` on an Ubuntu host prepared with k3s
 #   or kubeadm (cozystack "generic" variant). Irrelevant on Talos where the
-#   container runtime lifecycle is fully managed.
+#   container runtime lifecycle is fully managed. Discoverable via
+#   `make preflight` from the repository root.
 #
 # Exit code:
 #   Always 0 (warning, not a blocker). Warnings go to stderr.
@@ -28,19 +29,24 @@
 # -----------------------------------------------------------------------------
 set -euo pipefail
 
-YELLOW='\033[1;33m'
-RESET='\033[0m'
+if [ -t 2 ]; then
+    YELLOW=$'\033[1;33m'
+    RESET=$'\033[0m'
+else
+    YELLOW=''
+    RESET=''
+fi
 
 CONTAINERD_SOCKET=${COZYSTACK_CONTAINERD_SOCKET:-/run/containerd/containerd.sock}
 DOCKER_SOCKET_PATHS=${COZYSTACK_DOCKER_SOCKET_PATHS:-/run/docker.sock /var/run/docker.sock}
 CONTAINERD_DIR=${COZYSTACK_CONTAINERD_DIR:-/var/lib/containerd}
 DOCKER_DIR=${COZYSTACK_DOCKER_DIR:-/var/lib/docker}
 
-WARNINGS=0
+CONTAINERD_WARN=0
+DOCKER_WARN=0
 
 warn() {
-    printf '%bWARNING:%b %s\n' "$YELLOW" "$RESET" "$1" >&2
-    WARNINGS=$((WARNINGS + 1))
+    printf '%sWARNING:%s %s\n' "$YELLOW" "$RESET" "$1" >&2
 }
 
 detect_systemctl() {
@@ -86,6 +92,7 @@ check_containerd() {
     if [ "$found" -eq 1 ]; then
         detail=$(disk_usage "$CONTAINERD_DIR")
         warn "standalone containerd.service detected alongside k3s embedded runtime${detail}"
+        CONTAINERD_WARN=1
     fi
 }
 
@@ -106,6 +113,7 @@ check_docker() {
     if [ "$found" -eq 1 ]; then
         detail=$(disk_usage "$DOCKER_DIR")
         warn "standalone docker.service detected alongside k3s embedded runtime${detail}"
+        DOCKER_WARN=1
     fi
 }
 
@@ -118,9 +126,20 @@ fi
 check_containerd
 check_docker
 
-if [ "$WARNINGS" -gt 0 ]; then
-    printf '%bHINT:%b cozystack runs its own containerd under k3s. To stop the shadow runtime:\n' "$YELLOW" "$RESET" >&2
-    printf '  sudo systemctl disable --now docker.service containerd.service\n' >&2
+if [ "$CONTAINERD_WARN" -eq 1 ] || [ "$DOCKER_WARN" -eq 1 ]; then
+    services=""
+    if [ "$CONTAINERD_WARN" -eq 1 ]; then
+        services="containerd.service"
+    fi
+    if [ "$DOCKER_WARN" -eq 1 ]; then
+        if [ -n "$services" ]; then
+            services="$services docker.service"
+        else
+            services="docker.service"
+        fi
+    fi
+    printf '%sHINT:%s cozystack runs its own containerd under k3s. To stop the shadow runtime:\n' "$YELLOW" "$RESET" >&2
+    printf '  sudo systemctl disable --now %s\n' "$services" >&2
     printf 'Inspect and reclaim standalone runtime storage separately — it may contain container data\n' >&2
     printf 'that the operator still needs; do not delete it blindly.\n' >&2
 fi

From 70f02799b5f6746d989bb6285fb0b9c76f5f7bb0 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 14:21:30 +0300
Subject: [PATCH 397/666] test(hack): cover conditional HINT, clean
 no-systemctl, docker symmetry
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Expand the bats suite to address a second review pass:

- Assert that a containerd only warning produces a HINT that names
  containerd.service and NOT docker.service, and mirror the check in
  the docker only test. When both fire, assert the HINT lists both
  services in a single systemctl disable invocation.

- New test: 'clean host without systemctl exits silently' — exercises
  the COZYSTACK_PREFLIGHT_FORCE_NO_SYSTEMCTL=1 path when no standalone
  sockets exist. Previously the tests only covered the systemd enabled
  clean host, leaving the non systemd clean path unverified.

- New test: 'docker service plus socket still emits exactly one
  warning' — mirrors the existing containerd service+socket test and
  locks in the gated check in check_docker.

- Replace silent 'return 0' on missing python3 with a visible
  '# SKIP: python3 unavailable' message on stderr so CI logs make it
  obvious which tests were skipped on a given runner.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/check-host-runtime.bats | 85 +++++++++++++++++++++++++++++++++---
 1 file changed, 80 insertions(+), 5 deletions(-)

diff --git a/hack/check-host-runtime.bats b/hack/check-host-runtime.bats
index 73b464ea..98c5603b 100644
--- a/hack/check-host-runtime.bats
+++ b/hack/check-host-runtime.bats
@@ -87,6 +87,14 @@ STUBEOF
     cat "$STDERR_FILE" >&2
     exit 1
   fi
+  # HINT line must name only the detected service, not advise disabling
+  # docker.service when only containerd.service is running.
+  grep -q 'systemctl disable --now containerd.service' "$STDERR_FILE"
+  if grep -q 'systemctl disable --now.*docker' "$STDERR_FILE"; then
+    echo "HINT unexpectedly mentions docker:" >&2
+    cat "$STDERR_FILE" >&2
+    exit 1
+  fi
 }
 
 @test "standalone docker service active prints warning" {
@@ -124,6 +132,13 @@ STUBEOF
     cat "$STDERR_FILE" >&2
     exit 1
   fi
+  # HINT line must name only the detected service.
+  grep -q 'systemctl disable --now docker.service' "$STDERR_FILE"
+  if grep -q 'systemctl disable --now.*containerd' "$STDERR_FILE"; then
+    echo "HINT unexpectedly mentions containerd:" >&2
+    cat "$STDERR_FILE" >&2
+    exit 1
+  fi
 }
 
 @test "both services active prints two warnings and the HINT block" {
@@ -158,9 +173,10 @@ STUBEOF
   grep -q 'standalone containerd.service' "$STDERR_FILE"
   grep -q 'standalone docker.service' "$STDERR_FILE"
   # HINT block must fire whenever warnings exist; otherwise a future silent
-  # removal of the HINT would go unnoticed.
+  # removal of the HINT would go unnoticed. When both services fire the HINT
+  # must list both in a single systemctl disable invocation.
   grep -q 'HINT:' "$STDERR_FILE"
-  grep -q 'systemctl disable --now' "$STDERR_FILE"
+  grep -q 'systemctl disable --now containerd.service docker.service' "$STDERR_FILE"
 }
 
 @test "failing du does not suppress the containerd warning" {
@@ -204,7 +220,7 @@ DUEOF
   trap 'rm -rf "$STUB_DIR"' EXIT
 
   if ! command -v python3 >/dev/null 2>&1; then
-    echo "python3 not available - skipping socket fallback test" >&2
+    echo "# SKIP: python3 unavailable - cannot create unix socket" >&2
     return 0
   fi
   SOCK="$STUB_DIR/containerd.sock"
@@ -226,7 +242,7 @@ DUEOF
   trap 'rm -rf "$STUB_DIR"' EXIT
 
   if ! command -v python3 >/dev/null 2>&1; then
-    echo "python3 not available - skipping docker socket fallback test" >&2
+    echo "# SKIP: python3 unavailable - cannot create unix socket" >&2
     return 0
   fi
   SOCK="$STUB_DIR/docker.sock"
@@ -248,6 +264,65 @@ DUEOF
   fi
 }
 
+@test "clean host without systemctl exits silently" {
+  STUB_DIR=$(mktemp -d)
+  trap 'rm -rf "$STUB_DIR"' EXIT
+
+  STDERR_FILE="$STUB_DIR/stderr"
+  COZYSTACK_PREFLIGHT_FORCE_NO_SYSTEMCTL=1 \
+  COZYSTACK_CONTAINERD_SOCKET="$STUB_DIR/missing-containerd.sock" \
+  COZYSTACK_DOCKER_SOCKET_PATHS="$STUB_DIR/missing-docker1.sock $STUB_DIR/missing-docker2.sock" \
+  COZYSTACK_CONTAINERD_DIR="$STUB_DIR/missing-containerd-dir" \
+  COZYSTACK_DOCKER_DIR="$STUB_DIR/missing-docker-dir" \
+    bash hack/check-host-runtime.sh >"$STUB_DIR/stdout" 2>"$STDERR_FILE"
+
+  [ ! -s "$STDERR_FILE" ]
+  [ ! -s "$STUB_DIR/stdout" ]
+}
+
+@test "docker service plus socket still emits exactly one warning" {
+  STUB_DIR=$(mktemp -d)
+  trap 'rm -rf "$STUB_DIR"' EXIT
+
+  cat >"$STUB_DIR/systemctl" <<'STUBEOF'
+#!/bin/sh
+if [ "$1" = "--version" ]; then
+  echo "systemd stub"
+  exit 0
+fi
+if [ "$1" = "is-active" ] && [ "$2" = "docker.service" ]; then
+  echo active
+  exit 0
+fi
+exit 1
+STUBEOF
+  chmod +x "$STUB_DIR/systemctl"
+
+  if ! command -v python3 >/dev/null 2>&1; then
+    echo "# SKIP: python3 unavailable - cannot create unix socket" >&2
+    return 0
+  fi
+  SOCK="$STUB_DIR/docker.sock"
+  python3 -c 'import socket,sys; s=socket.socket(socket.AF_UNIX); s.bind(sys.argv[1])' "$SOCK"
+
+  mkdir -p "$STUB_DIR/var-lib-docker"
+
+  STDERR_FILE="$STUB_DIR/stderr"
+  COZYSTACK_CONTAINERD_SOCKET="$STUB_DIR/missing-containerd.sock" \
+  COZYSTACK_DOCKER_SOCKET_PATHS="$SOCK" \
+  COZYSTACK_CONTAINERD_DIR="$STUB_DIR/missing-containerd-dir" \
+  COZYSTACK_DOCKER_DIR="$STUB_DIR/var-lib-docker" \
+  PATH="$STUB_DIR:$PATH" \
+    bash hack/check-host-runtime.sh 2>"$STDERR_FILE"
+
+  count=$(grep -c 'standalone docker.service' "$STDERR_FILE")
+  if [ "$count" != "1" ]; then
+    echo "expected exactly one docker warning, got $count" >&2
+    cat "$STDERR_FILE" >&2
+    exit 1
+  fi
+}
+
 @test "containerd service plus socket still emits exactly one warning" {
   STUB_DIR=$(mktemp -d)
   trap 'rm -rf "$STUB_DIR"' EXIT
@@ -267,7 +342,7 @@ STUBEOF
   chmod +x "$STUB_DIR/systemctl"
 
   if ! command -v python3 >/dev/null 2>&1; then
-    echo "python3 not available - skipping service+socket test" >&2
+    echo "# SKIP: python3 unavailable - cannot create unix socket" >&2
     return 0
   fi
   SOCK="$STUB_DIR/containerd.sock"

From cae08932d3baffa41564f7b50f626e5664cf0c35 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 14:21:45 +0300
Subject: [PATCH 398/666] build(hack): auto discover unit bats files and expose
 make preflight
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two small Makefile tweaks:

1. bats-unit-tests now iterates over every hack/*.bats file that is
   not an e2e-*.bats file (wildcard + filter-out), so dropping a new
   unit bats file into hack/ is enough to get it picked up by CI on
   the next run. The previous hard coded single file path would have
   required a Makefile edit for every new unit suite.

2. Add a new 'preflight' target that runs hack/check-host-runtime.sh.
   This gives the script a discoverable entry point — an operator
   preparing a generic (k3s/kubeadm) host for cozystack can now run
   'make preflight' from the repository root to get the same warning
   that is described in the script header, without having to know
   the exact path under hack/.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 Makefile | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index aaffcc81..7f5e715d 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: manifests assets unit-tests helm-unit-tests bats-unit-tests
+.PHONY: manifests assets unit-tests helm-unit-tests bats-unit-tests preflight
 
 include hack/common-envs.mk
 
@@ -87,8 +87,22 @@ unit-tests: helm-unit-tests bats-unit-tests
 helm-unit-tests:
 	hack/helm-unit-tests.sh
 
+# Discover every hack/*.bats file that is NOT an e2e test and run it
+# through cozytest.sh. Drop a new *.bats file in hack/ and it is picked
+# up automatically on the next `make unit-tests` run.
+BATS_UNIT_FILES := $(filter-out hack/e2e-%.bats,$(wildcard hack/*.bats))
+
 bats-unit-tests:
-	hack/cozytest.sh hack/check-host-runtime.bats
+	@for f in $(BATS_UNIT_FILES); do \
+		echo "--- running $$f ---"; \
+		hack/cozytest.sh "$$f" || exit 1; \
+	done
+
+# Operator-facing host preflight check. Warns about a standalone
+# containerd.service or docker.service running alongside the embedded
+# k3s runtime. Safe to run at any time; always exits 0.
+preflight:
+	@hack/check-host-runtime.sh
 
 prepare-env:
 	make -C packages/core/testing apply

From bce98a432b61698f92607d93b0702a7133c1f762 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 14:29:30 +0300
Subject: [PATCH 399/666] test(hack): drop python3 dependency and assert sudo
 in HINT
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two review findings:

1. The socket fallback tests previously branched on 'command -v
   python3' and fell through to 'return 0' when it was missing.
   cozytest.sh has no SKIP concept — 'return 0' is indistinguishable
   from a real pass, so on a runner without python3 the socket
   fallback paths were silently unverified. Since the script uses
   '[ -e "$sock" ]' rather than '[ -S ... ]', a regular file is
   sufficient to exercise the detection path. Replace the python3
   unix-socket creation with 'touch "$SOCK"' so the tests run
   unconditionally on every runner.

2. Extend the 'both services active' HINT assertion to require the
   'sudo ' prefix on the 'systemctl disable --now' line. Without sudo
   the operator would be instructed to run a privileged command as a
   non-root user and hit a silent failure; the prefix is as important
   as the verb itself and must be locked in by a test.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/check-host-runtime.bats | 38 +++++++++++++++---------------------
 1 file changed, 16 insertions(+), 22 deletions(-)

diff --git a/hack/check-host-runtime.bats b/hack/check-host-runtime.bats
index 98c5603b..7506bbab 100644
--- a/hack/check-host-runtime.bats
+++ b/hack/check-host-runtime.bats
@@ -174,9 +174,11 @@ STUBEOF
   grep -q 'standalone docker.service' "$STDERR_FILE"
   # HINT block must fire whenever warnings exist; otherwise a future silent
   # removal of the HINT would go unnoticed. When both services fire the HINT
-  # must list both in a single systemctl disable invocation.
+  # must list both in a single sudo systemctl disable invocation — the sudo
+  # prefix is as important as the systemctl verb, otherwise the operator
+  # would be told to run it as a non-root user and quietly fail.
   grep -q 'HINT:' "$STDERR_FILE"
-  grep -q 'systemctl disable --now containerd.service docker.service' "$STDERR_FILE"
+  grep -q 'sudo systemctl disable --now containerd.service docker.service' "$STDERR_FILE"
 }
 
 @test "failing du does not suppress the containerd warning" {
@@ -219,12 +221,12 @@ DUEOF
   STUB_DIR=$(mktemp -d)
   trap 'rm -rf "$STUB_DIR"' EXIT
 
-  if ! command -v python3 >/dev/null 2>&1; then
-    echo "# SKIP: python3 unavailable - cannot create unix socket" >&2
-    return 0
-  fi
+  # The script uses `[ -e "$sock" ]`, not `[ -S ... ]`, so a regular
+  # file is a valid stand-in for a unix socket in tests. This also
+  # removes any optional runtime dependency on python3 and makes the
+  # test unconditional on every CI runner.
   SOCK="$STUB_DIR/containerd.sock"
-  python3 -c 'import socket,sys; s=socket.socket(socket.AF_UNIX); s.bind(sys.argv[1])' "$SOCK"
+  touch "$SOCK"
 
   STDERR_FILE="$STUB_DIR/stderr"
   COZYSTACK_PREFLIGHT_FORCE_NO_SYSTEMCTL=1 \
@@ -241,12 +243,8 @@ DUEOF
   STUB_DIR=$(mktemp -d)
   trap 'rm -rf "$STUB_DIR"' EXIT
 
-  if ! command -v python3 >/dev/null 2>&1; then
-    echo "# SKIP: python3 unavailable - cannot create unix socket" >&2
-    return 0
-  fi
   SOCK="$STUB_DIR/docker.sock"
-  python3 -c 'import socket,sys; s=socket.socket(socket.AF_UNIX); s.bind(sys.argv[1])' "$SOCK"
+  touch "$SOCK"
 
   STDERR_FILE="$STUB_DIR/stderr"
   COZYSTACK_PREFLIGHT_FORCE_NO_SYSTEMCTL=1 \
@@ -298,12 +296,8 @@ exit 1
 STUBEOF
   chmod +x "$STUB_DIR/systemctl"
 
-  if ! command -v python3 >/dev/null 2>&1; then
-    echo "# SKIP: python3 unavailable - cannot create unix socket" >&2
-    return 0
-  fi
   SOCK="$STUB_DIR/docker.sock"
-  python3 -c 'import socket,sys; s=socket.socket(socket.AF_UNIX); s.bind(sys.argv[1])' "$SOCK"
+  touch "$SOCK"
 
   mkdir -p "$STUB_DIR/var-lib-docker"
 
@@ -341,12 +335,12 @@ exit 1
 STUBEOF
   chmod +x "$STUB_DIR/systemctl"
 
-  if ! command -v python3 >/dev/null 2>&1; then
-    echo "# SKIP: python3 unavailable - cannot create unix socket" >&2
-    return 0
-  fi
+  # The script uses `[ -e "$sock" ]`, not `[ -S ... ]`, so a regular
+  # file is a valid stand-in for a unix socket in tests. This also
+  # removes any optional runtime dependency on python3 and makes the
+  # test unconditional on every CI runner.
   SOCK="$STUB_DIR/containerd.sock"
-  python3 -c 'import socket,sys; s=socket.socket(socket.AF_UNIX); s.bind(sys.argv[1])' "$SOCK"
+  touch "$SOCK"
 
   mkdir -p "$STUB_DIR/var-lib-containerd"
 

From 2e13648194f1f54716c713b8f3715a92d1dc6ee5 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 14:29:39 +0300
Subject: [PATCH 400/666] build(hack): fail bats-unit-tests target when no test
 files are found

Without a guard, running make bats-unit-tests in a tree where the
hack/*.bats wildcard matches nothing (for example a rename, a shallow
clone, or a future reorganization that moves the tests elsewhere)
would silently succeed with zero tests run. Add an explicit guard that
fails the target with a clear error message when BATS_UNIT_FILES
expands to an empty list, so the developer cannot accidentally believe
tests passed when no tests executed.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 Makefile | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Makefile b/Makefile
index 7f5e715d..8daeabda 100644
--- a/Makefile
+++ b/Makefile
@@ -93,6 +93,10 @@ helm-unit-tests:
 BATS_UNIT_FILES := $(filter-out hack/e2e-%.bats,$(wildcard hack/*.bats))
 
 bats-unit-tests:
+	@if [ -z "$(BATS_UNIT_FILES)" ]; then \
+		echo "ERROR: no hack/*.bats unit test files found"; \
+		exit 1; \
+	fi
 	@for f in $(BATS_UNIT_FILES); do \
 		echo "--- running $$f ---"; \
 		hack/cozytest.sh "$$f" || exit 1; \

From 57b00248798a973b154dc9b6611d1f314fdea64c Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 14:29:48 +0300
Subject: [PATCH 401/666] docs(hack): document intentional unquoted word split
 on DOCKER_SOCKET_PATHS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

DOCKER_SOCKET_PATHS is a space separated list of socket paths (its
default is "/run/docker.sock /var/run/docker.sock") that the loop
iterates by word splitting. Socket paths never contain whitespace on
Linux hosts, so this is the documented and correct idiom — not a
shellcheck oversight. Add an inline comment so a future maintainer (or
a linter that has not seen the comment) does not break the loop by
adding quotes around the expansion.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/check-host-runtime.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hack/check-host-runtime.sh b/hack/check-host-runtime.sh
index 653f3cb3..2301db0d 100755
--- a/hack/check-host-runtime.sh
+++ b/hack/check-host-runtime.sh
@@ -103,6 +103,11 @@ check_docker() {
         found=1
     fi
     if [ "$found" -eq 0 ]; then
+        # Intentional unquoted expansion: DOCKER_SOCKET_PATHS is a space
+        # separated list of socket paths (e.g. "/run/docker.sock
+        # /var/run/docker.sock"). Socket paths never contain spaces in
+        # practice on Linux hosts, so word splitting is the documented
+        # mechanism and must not be "fixed" by quoting the expansion.
         for sock in $DOCKER_SOCKET_PATHS; do
             if [ -e "$sock" ]; then
                 found=1

From 8d93b5113aecae0a8fb3575c9ae8c3e35e350f72 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 14:36:44 +0300
Subject: [PATCH 402/666] fix(hack): parse DOCKER_SOCKET_PATHS into an array to
 suppress glob expansion
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

'set -euo pipefail' does not include 'set -f', so the previous
'for sock in $DOCKER_SOCKET_PATHS' loop relied on both word splitting
AND unintended glob expansion. If the variable ever contained a
literal '*' or '?' — for example a test setting
COZYSTACK_DOCKER_SOCKET_PATHS='/run/docker-*.sock' against a tree
that happens to have real files matching the pattern — the loop
would iterate over directory entries instead of the intended socket
paths, producing false-positive docker warnings.

Replace the implicit split+glob loop with 'read -ra' into a bash
array and iterate 'for sock in "${_socks[@]}"'. This keeps the
space-separated input format, disables glob expansion, and removes
the fragile word splitting that shellcheck otherwise has to be
talked out of.

Covered by a new regression test ('docker socket paths with glob
chars do not expand') that sets the env var to a literal '*' pattern
pointing at real directories; without this fix the test fails with
an unexpected docker.service warning.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/check-host-runtime.sh | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/hack/check-host-runtime.sh b/hack/check-host-runtime.sh
index 2301db0d..0ba6d301 100755
--- a/hack/check-host-runtime.sh
+++ b/hack/check-host-runtime.sh
@@ -103,12 +103,15 @@ check_docker() {
         found=1
     fi
     if [ "$found" -eq 0 ]; then
-        # Intentional unquoted expansion: DOCKER_SOCKET_PATHS is a space
-        # separated list of socket paths (e.g. "/run/docker.sock
-        # /var/run/docker.sock"). Socket paths never contain spaces in
-        # practice on Linux hosts, so word splitting is the documented
-        # mechanism and must not be "fixed" by quoting the expansion.
-        for sock in $DOCKER_SOCKET_PATHS; do
+        # DOCKER_SOCKET_PATHS is a space separated list of paths. Parse
+        # it into an array via `read -ra` so that word splitting is
+        # explicit AND glob expansion is suppressed — `for sock in
+        # $DOCKER_SOCKET_PATHS` would both word split and glob, so a
+        # path containing a literal `*` or `?` could expand into
+        # directory entries and produce false positives.
+        local -a _socks
+        read -ra _socks <<<"$DOCKER_SOCKET_PATHS"
+        for sock in "${_socks[@]}"; do
             if [ -e "$sock" ]; then
                 found=1
                 break

From 786ea8a7d8faaba82f9284d15f785bac4c6d768b Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 14:36:58 +0300
Subject: [PATCH 403/666] test(hack): assert sudo prefix in single-service
 HINTs, explicit exit code, and glob regression
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Address three review findings on the bats suite:

- The 'standalone containerd service active' and 'standalone docker
  service active' tests previously asserted 'systemctl disable --now
  <service>' but did not require the 'sudo ' prefix, so the two-
  service test was the only guard against a silent drop of the
  prefix. Extend both single-service tests to require the prefix
  exactly as the 'both services active' test does.

- The 'both services active' test now captures the exit code
  explicitly with 'bash ... || status=$?' and asserts '$status -eq
  0'. The script contract ('always exits 0') was previously enforced
  implicitly via 'set -e', which produces a generic test failure on
  a regression instead of a contract-specific error. The explicit
  check locks in the contract and makes regressions readable.

- New test: 'docker socket paths with glob chars do not expand' —
  sets COZYSTACK_DOCKER_SOCKET_PATHS to a literal glob against real
  directories and asserts no docker warning fires. Locks in the
  array-based parsing of the path list.

- Extend the file header with a 'title syntax constraints' section
  documenting how cozytest.sh's awk parser treats double quotes and
  non-alphanumeric characters in @test titles, so future
  contributors do not stumble on the parser's quirks.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/check-host-runtime.bats | 64 +++++++++++++++++++++++++++++++++---
 1 file changed, 59 insertions(+), 5 deletions(-)

diff --git a/hack/check-host-runtime.bats b/hack/check-host-runtime.bats
index 7506bbab..b121b31b 100644
--- a/hack/check-host-runtime.bats
+++ b/hack/check-host-runtime.bats
@@ -21,6 +21,14 @@
 # because cozytest.sh's awk parser only recognizes @test blocks and treats a
 # bare `}` on its own line as the end of a test function.
 #
+# Title syntax constraints (inherited from cozytest.sh's awk parser):
+#   - Titles must be delimited by ASCII double quotes; embedded literal
+#     double quotes are NOT escaped and will silently truncate the title.
+#   - Only alphanumeric characters from the title survive into the shell
+#     function name (everything else becomes '_'), so titles that differ
+#     only in punctuation collapse to the same function name. Keep titles
+#     distinctive in their alphanumeric run.
+#
 # Run with: hack/cozytest.sh hack/check-host-runtime.bats
 #           (or `bats hack/check-host-runtime.bats` if the bats binary is
 #           installed; cozytest.sh is the CI path.)
@@ -88,8 +96,10 @@ STUBEOF
     exit 1
   fi
   # HINT line must name only the detected service, not advise disabling
-  # docker.service when only containerd.service is running.
-  grep -q 'systemctl disable --now containerd.service' "$STDERR_FILE"
+  # docker.service when only containerd.service is running. The sudo
+  # prefix is also required — without it the command silently no-ops
+  # for a non-root operator, so the prefix is part of the contract.
+  grep -q 'sudo systemctl disable --now containerd.service' "$STDERR_FILE"
   if grep -q 'systemctl disable --now.*docker' "$STDERR_FILE"; then
     echo "HINT unexpectedly mentions docker:" >&2
     cat "$STDERR_FILE" >&2
@@ -132,8 +142,9 @@ STUBEOF
     cat "$STDERR_FILE" >&2
     exit 1
   fi
-  # HINT line must name only the detected service.
-  grep -q 'systemctl disable --now docker.service' "$STDERR_FILE"
+  # HINT line must name only the detected service. As in the
+  # containerd test, the sudo prefix is part of the contract.
+  grep -q 'sudo systemctl disable --now docker.service' "$STDERR_FILE"
   if grep -q 'systemctl disable --now.*containerd' "$STDERR_FILE"; then
     echo "HINT unexpectedly mentions containerd:" >&2
     cat "$STDERR_FILE" >&2
@@ -163,13 +174,21 @@ STUBEOF
   mkdir -p "$STUB_DIR/var-lib-containerd" "$STUB_DIR/var-lib-docker"
 
   STDERR_FILE="$STUB_DIR/stderr"
+  # Capture exit code explicitly: the script contract says exit 0
+  # unconditionally (warning, not blocker). `set -e` in the test
+  # function body would already fail on a nonzero exit, but an
+  # explicit status check locks in the contract and makes a
+  # regression show up as "expected 0, got N" rather than as a
+  # generic test failure.
+  status=0
   COZYSTACK_CONTAINERD_SOCKET="$STUB_DIR/missing-containerd.sock" \
   COZYSTACK_DOCKER_SOCKET_PATHS="$STUB_DIR/missing-docker.sock" \
   COZYSTACK_CONTAINERD_DIR="$STUB_DIR/var-lib-containerd" \
   COZYSTACK_DOCKER_DIR="$STUB_DIR/var-lib-docker" \
   PATH="$STUB_DIR:$PATH" \
-    bash hack/check-host-runtime.sh 2>"$STDERR_FILE"
+    bash hack/check-host-runtime.sh 2>"$STDERR_FILE" || status=$?
 
+  [ "$status" -eq 0 ]
   grep -q 'standalone containerd.service' "$STDERR_FILE"
   grep -q 'standalone docker.service' "$STDERR_FILE"
   # HINT block must fire whenever warnings exist; otherwise a future silent
@@ -317,6 +336,41 @@ STUBEOF
   fi
 }
 
+@test "docker socket paths with glob chars do not expand" {
+  STUB_DIR=$(mktemp -d)
+  trap 'rm -rf "$STUB_DIR"' EXIT
+
+  # Create two directories that a naive `for sock in $PATHS` loop
+  # would glob-expand and treat as existing "sockets". With the
+  # array-based parsing the literal path "$STUB_DIR/var-lib-*" does
+  # not exist and no warning must fire.
+  mkdir -p "$STUB_DIR/var-lib-docker" "$STUB_DIR/var-lib-containerd"
+
+  cat >"$STUB_DIR/systemctl" <<'STUBEOF'
+#!/bin/sh
+if [ "$1" = "--version" ]; then
+  echo "systemd stub"
+  exit 0
+fi
+exit 1
+STUBEOF
+  chmod +x "$STUB_DIR/systemctl"
+
+  STDERR_FILE="$STUB_DIR/stderr"
+  COZYSTACK_CONTAINERD_SOCKET="$STUB_DIR/missing-containerd.sock" \
+  COZYSTACK_DOCKER_SOCKET_PATHS="$STUB_DIR/var-lib-*" \
+  COZYSTACK_CONTAINERD_DIR="$STUB_DIR/missing-containerd-dir" \
+  COZYSTACK_DOCKER_DIR="$STUB_DIR/missing-docker-dir" \
+  PATH="$STUB_DIR:$PATH" \
+    bash hack/check-host-runtime.sh 2>"$STDERR_FILE"
+
+  if grep -q 'standalone docker.service' "$STDERR_FILE"; then
+    echo "glob pattern expanded — docker warning should not fire:" >&2
+    cat "$STDERR_FILE" >&2
+    exit 1
+  fi
+}
+
 @test "containerd service plus socket still emits exactly one warning" {
   STUB_DIR=$(mktemp -d)
   trap 'rm -rf "$STUB_DIR"' EXIT

From c7c170447208e3537636a074fabafe57e81ba7fa Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 14:37:06 +0300
Subject: [PATCH 404/666] docs(hack): note whitespace caveat on BATS_UNIT_FILES
 wildcard

$(wildcard ...) returns a space-separated list, so a bats file with
a literal space in its name would silently split into multiple
tokens in the subsequent 'for' loop. All current bats files use
hyphen-separated names, so this is not an immediate risk, but the
caveat is worth calling out so a future contributor who adopts a
different naming convention rewrites the recipe instead of tripping
over it.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 Makefile | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/Makefile b/Makefile
index 8daeabda..0e94c5e6 100644
--- a/Makefile
+++ b/Makefile
@@ -90,6 +90,12 @@ helm-unit-tests:
 # Discover every hack/*.bats file that is NOT an e2e test and run it
 # through cozytest.sh. Drop a new *.bats file in hack/ and it is picked
 # up automatically on the next `make unit-tests` run.
+#
+# Caveat: $(wildcard ...) returns space-separated names, so a filename
+# containing a literal space would split into multiple tokens here. All
+# current bats files use hyphen-separated names; if the project ever
+# introduces whitespace-bearing filenames this recipe must be rewritten
+# (e.g. to use `find ... -print0 | xargs -0`).
 BATS_UNIT_FILES := $(filter-out hack/e2e-%.bats,$(wildcard hack/*.bats))
 
 bats-unit-tests:

From 182fc0b52d936a94144d1ba85723d3afd7b090dc Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 14:39:37 +0300
Subject: [PATCH 405/666] [cilium] Strip hardcoded AppArmor annotations from
 vendored daemonset

The upstream chart emits per-container AppArmor unconfined annotations
inside a k8s<1.30 branch of cilium-agent/daemonset.yaml. Cozystack now
owns these annotations via cilium.podAnnotations in values.yaml so they
also take effect on k8s>=1.30 (where upstream drops them in favour of
the containerd-broken podSecurityContext.appArmorProfile). Having both
sources emit the same keys produced a duplicate mapping on k8s<1.30.

Add a new SED_INPLACE invocation to the package Makefile that removes
the four hardcoded annotation lines from the vendored template, and
apply the patch to the currently vendored copy so make update will
reproduce the same state on future refreshes.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/cilium/Makefile                        | 10 ++++++++++
 .../cilium/templates/cilium-agent/daemonset.yaml       |  4 ----
 packages/system/cilium/values.yaml                     |  5 -----
 3 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/packages/system/cilium/Makefile b/packages/system/cilium/Makefile
index 07d4ca97..3c90fd21 100644
--- a/packages/system/cilium/Makefile
+++ b/packages/system/cilium/Makefile
@@ -12,6 +12,16 @@ update:
 	helm repo update cilium
 	helm pull cilium/cilium --untar --untardir charts --version 1.19
 	$(SED_INPLACE) -e '/Used in iptables/d' -e '/SYS_MODULE/d' charts/cilium/values.yaml
+	# Drop the hardcoded AppArmor unconfined annotations from the cilium-agent
+	# DaemonSet's k8s<1.30 branch. Cozystack manages these through
+	# cilium.podAnnotations in values.yaml for all k8s versions, and keeping the
+	# upstream block would produce duplicate mapping keys on k8s<1.30.
+	$(SED_INPLACE) \
+		-e '/container\.apparmor\.security\.beta\.kubernetes\.io\/cilium-agent: "unconfined"/d' \
+		-e '/container\.apparmor\.security\.beta\.kubernetes\.io\/clean-cilium-state: "unconfined"/d' \
+		-e '/container\.apparmor\.security\.beta\.kubernetes\.io\/mount-cgroup: "unconfined"/d' \
+		-e '/container\.apparmor\.security\.beta\.kubernetes\.io\/apply-sysctl-overwrites: "unconfined"/d' \
+		charts/cilium/templates/cilium-agent/daemonset.yaml
 	version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \
 	$(SED_INPLACE) "s/ARG VERSION=.*/ARG VERSION=v$${version}/" images/cilium/Dockerfile
 
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml b/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
index f9a4cec7..bb2c5a15 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
@@ -62,11 +62,7 @@ spec:
         # Set app AppArmor's profile to "unconfined". The value of this annotation
         # can be modified as long users know which profiles they have available
         # in AppArmor.
-        container.apparmor.security.beta.kubernetes.io/cilium-agent: "unconfined"
-        container.apparmor.security.beta.kubernetes.io/clean-cilium-state: "unconfined"
         {{- if .Values.cgroup.autoMount.enabled }}
-        container.apparmor.security.beta.kubernetes.io/mount-cgroup: "unconfined"
-        container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: "unconfined"
         {{- end }}
         {{- end }}
         {{- end }}
diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml
index cd31c107..4b2e1ff3 100644
--- a/packages/system/cilium/values.yaml
+++ b/packages/system/cilium/values.yaml
@@ -34,11 +34,6 @@ cilium:
   # annotations when the AppArmor LSM is not loaded.
   # mount-bpf-fs is intentionally excluded: it runs as privileged, and the
   # kernel does not apply AppArmor profiles to privileged containers.
-  # On unsupported k8s < 1.30 the upstream chart renders the same keys
-  # inside its own <1.30 branch, yielding a duplicate mapping with
-  # identical values (last-wins). The supported matrix starts at 1.30
-  # (packages/apps/kubernetes/files/versions.yaml), so this does not
-  # affect any shipped version.
   podAnnotations:
     container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined
     container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined

From 5a50df800d803d3947db70e0bc5bac52891ccb1a Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 14:54:47 +0300
Subject: [PATCH 406/666] [cilium] Strip the entire k8s<1.30 AppArmor block
 from vendored daemonset
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous sed patch removed only the four annotation lines and
left an empty nested '{{- if ... }}{{- end }}{{- end }}{{- end }}'
skeleton behind. That skeleton was dead code, but it also meant that
the next make update would re-fetch the upstream chart with the
annotations back inside the same block, and the sed would strip them
again — leaving the skeleton behind forever.

Replace the per-line sed patch with a single perl -i -0pe multi-line
delete that removes the entire <1.30 AppArmor block in one step, and
apply the same patch to the currently vendored copy for consistency.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/cilium/Makefile                    | 14 +++++---------
 .../cilium/templates/cilium-agent/daemonset.yaml   |  9 ---------
 2 files changed, 5 insertions(+), 18 deletions(-)

diff --git a/packages/system/cilium/Makefile b/packages/system/cilium/Makefile
index 3c90fd21..4a9799f0 100644
--- a/packages/system/cilium/Makefile
+++ b/packages/system/cilium/Makefile
@@ -12,15 +12,11 @@ update:
 	helm repo update cilium
 	helm pull cilium/cilium --untar --untardir charts --version 1.19
 	$(SED_INPLACE) -e '/Used in iptables/d' -e '/SYS_MODULE/d' charts/cilium/values.yaml
-	# Drop the hardcoded AppArmor unconfined annotations from the cilium-agent
-	# DaemonSet's k8s<1.30 branch. Cozystack manages these through
-	# cilium.podAnnotations in values.yaml for all k8s versions, and keeping the
-	# upstream block would produce duplicate mapping keys on k8s<1.30.
-	$(SED_INPLACE) \
-		-e '/container\.apparmor\.security\.beta\.kubernetes\.io\/cilium-agent: "unconfined"/d' \
-		-e '/container\.apparmor\.security\.beta\.kubernetes\.io\/clean-cilium-state: "unconfined"/d' \
-		-e '/container\.apparmor\.security\.beta\.kubernetes\.io\/mount-cgroup: "unconfined"/d' \
-		-e '/container\.apparmor\.security\.beta\.kubernetes\.io\/apply-sysctl-overwrites: "unconfined"/d' \
+	# Drop the whole k8s<1.30 AppArmor annotations block from the cilium-agent
+	# DaemonSet. Cozystack manages these annotations through cilium.podAnnotations
+	# in values.yaml on every k8s version, so keeping the upstream block would
+	# produce duplicate mapping keys on k8s<1.30.
+	perl -i -0pe 's|\n        \{\{- if not \.Values\.securityContext\.privileged \}\}\n        \{\{- if semverCompare "<1\.30\.0".*?\n        \{\{- end \}\}\n        \{\{- end \}\}\n        \{\{- end \}\}||s' \
 		charts/cilium/templates/cilium-agent/daemonset.yaml
 	version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \
 	$(SED_INPLACE) "s/ARG VERSION=.*/ARG VERSION=v$${version}/" images/cilium/Dockerfile
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml b/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
index bb2c5a15..fa3afc14 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
@@ -57,15 +57,6 @@ spec:
         # ensure pods roll when configmap updates
         cilium.io/cilium-configmap-checksum: {{ include (print $.Template.BasePath "/cilium-configmap.yaml") . | sha256sum | quote }}
         {{- end }}
-        {{- if not .Values.securityContext.privileged }}
-        {{- if semverCompare "<1.30.0" (printf "%d.%d.0" (semver .Capabilities.KubeVersion.Version).Major (semver .Capabilities.KubeVersion.Version).Minor) }}
-        # Set app AppArmor's profile to "unconfined". The value of this annotation
-        # can be modified as long users know which profiles they have available
-        # in AppArmor.
-        {{- if .Values.cgroup.autoMount.enabled }}
-        {{- end }}
-        {{- end }}
-        {{- end }}
         {{- with .Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
         {{- end }}

From 39cd2658b53547f570cb57caa667eedfd15cb5ce Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 15:03:54 +0300
Subject: [PATCH 407/666] [cilium] Add fail-fast guard for the vendored
 daemonset patch

The perl multi-line delete in the update: target silently becomes a
no-op if the upstream template is ever reformatted. Verify the patch
applied by grepping for one of the stripped annotation keys after the
perl runs; fail the update: target loudly if it still exists, so a
future upstream reformat is caught instead of silently reintroducing
the duplicate-key rendering on k8s < 1.30.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/cilium/Makefile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/packages/system/cilium/Makefile b/packages/system/cilium/Makefile
index 4a9799f0..14abbf54 100644
--- a/packages/system/cilium/Makefile
+++ b/packages/system/cilium/Makefile
@@ -18,6 +18,9 @@ update:
 	# produce duplicate mapping keys on k8s<1.30.
 	perl -i -0pe 's|\n        \{\{- if not \.Values\.securityContext\.privileged \}\}\n        \{\{- if semverCompare "<1\.30\.0".*?\n        \{\{- end \}\}\n        \{\{- end \}\}\n        \{\{- end \}\}||s' \
 		charts/cilium/templates/cilium-agent/daemonset.yaml
+	@! grep -q 'container\.apparmor\.security\.beta\.kubernetes\.io/cilium-agent: "unconfined"' \
+		charts/cilium/templates/cilium-agent/daemonset.yaml || \
+		{ echo 'ERROR: perl patch did not remove the upstream AppArmor block from cilium-agent/daemonset.yaml (upstream template format may have changed)' >&2; exit 1; }
 	version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \
 	$(SED_INPLACE) "s/ARG VERSION=.*/ARG VERSION=v$${version}/" images/cilium/Dockerfile
 

From 0b0d3de99d63ae02cc7d8d1db234dc34c9c544b4 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 15:13:03 +0300
Subject: [PATCH 408/666] [cilium] Clarify nsenter/AppArmor comment wording

Replace the misleading 'nsenter --ptrace' shorthand with an accurate
description: nsenter joins the host cgroup/mount namespace, and the
cri-containerd.apparmor.d profile reports the denial as a blocked
'ptrace' operation (operation name, not an nsenter CLI flag).

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/cilium/values.yaml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml
index 4b2e1ff3..3902287c 100644
--- a/packages/system/cilium/values.yaml
+++ b/packages/system/cilium/values.yaml
@@ -24,9 +24,10 @@ cilium:
     rollOutPods: true
     replicas: 1
   # Opt out of the cri-containerd.apparmor.d profile for containers that invoke
-  # nsenter --ptrace to join the host cgroup/mount namespace. Required on
-  # Ubuntu 22.04+ and other distros that load this AppArmor profile by default,
-  # where the denial puts cilium-agent into Init:CrashLoopBackOff.
+  # nsenter to join the host cgroup/mount namespace. The kernel reports the
+  # denial as a blocked "ptrace" operation. Required on Ubuntu 22.04+ and
+  # other distros that load this AppArmor profile by default, where the
+  # denial otherwise puts cilium-agent into Init:CrashLoopBackOff.
   # The deprecated annotations are used because k8s >= 1.30 pod-level
   # appArmorProfile: Unconfined is not honoured by containerd CRI today
   # (kubernetes/kubernetes#125069).

From fc9ef55c425dcd281f12eeb962282034f561b958 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 15:20:55 +0300
Subject: [PATCH 409/666] [cilium] Harden vendoring guard and clarify Talos
 annotation comment

- Broaden the grep guard in the Makefile update: target to match any
  container.apparmor.security.beta.kubernetes.io key, not only the
  quoted cilium-agent line. The previous pattern would silently pass
  if upstream switched to an unquoted annotation value, masking a
  failed perl patch; grepping for the prefix catches any residual
  hardcoded AppArmor annotation regardless of format.

- Rewrite the values.yaml comment to distinguish the two Talos-safe
  reasons: mount-cgroup is simply not rendered when
  cgroup.autoMount.enabled is false (Talos default), while the other
  annotations are harmless because kubelet ignores AppArmor metadata
  on nodes without the LSM loaded.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/cilium/Makefile    |  2 +-
 packages/system/cilium/values.yaml | 11 +++++++----
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/packages/system/cilium/Makefile b/packages/system/cilium/Makefile
index 14abbf54..71b47a77 100644
--- a/packages/system/cilium/Makefile
+++ b/packages/system/cilium/Makefile
@@ -18,7 +18,7 @@ update:
 	# produce duplicate mapping keys on k8s<1.30.
 	perl -i -0pe 's|\n        \{\{- if not \.Values\.securityContext\.privileged \}\}\n        \{\{- if semverCompare "<1\.30\.0".*?\n        \{\{- end \}\}\n        \{\{- end \}\}\n        \{\{- end \}\}||s' \
 		charts/cilium/templates/cilium-agent/daemonset.yaml
-	@! grep -q 'container\.apparmor\.security\.beta\.kubernetes\.io/cilium-agent: "unconfined"' \
+	@! grep -q 'container\.apparmor\.security\.beta\.kubernetes\.io' \
 		charts/cilium/templates/cilium-agent/daemonset.yaml || \
 		{ echo 'ERROR: perl patch did not remove the upstream AppArmor block from cilium-agent/daemonset.yaml (upstream template format may have changed)' >&2; exit 1; }
 	version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \
diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml
index 3902287c..8aee34d9 100644
--- a/packages/system/cilium/values.yaml
+++ b/packages/system/cilium/values.yaml
@@ -31,10 +31,13 @@ cilium:
   # The deprecated annotations are used because k8s >= 1.30 pod-level
   # appArmorProfile: Unconfined is not honoured by containerd CRI today
   # (kubernetes/kubernetes#125069).
-  # Safe on Talos / RHEL family without AppArmor: kubelet ignores these
-  # annotations when the AppArmor LSM is not loaded.
-  # mount-bpf-fs is intentionally excluded: it runs as privileged, and the
-  # kernel does not apply AppArmor profiles to privileged containers.
+  # On Talos mount-cgroup is not rendered (cgroup.autoMount.enabled=false in
+  # values-talos.yaml) so its annotation is inert there. On RHEL-family and
+  # other AppArmor-less hosts kubelet silently ignores these annotations
+  # because the AppArmor LSM is not loaded.
+  # mount-bpf-fs is intentionally excluded: it renders with its own
+  # securityContext.privileged=true, and the kernel does not apply AppArmor
+  # profiles to privileged containers.
   podAnnotations:
     container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined
     container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined

From abd6667eb399f7e785c947f55a6fe16a8a8ecbba Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 16:39:58 +0300
Subject: [PATCH 410/666] [cilium] Move AppArmor podAnnotations to a
 non-Talos-only values file

E2E revealed that the kube-apiserver rejects a DaemonSet carrying a
per-container AppArmor annotation for a container that is not present
in the pod spec:

    DaemonSet.apps 'cilium' is invalid:
    spec.template.annotations[container.apparmor.security.beta.kubernetes.io/mount-cgroup]:
    Invalid value: 'mount-cgroup': container not found

On Talos (isp-full bundle) values-talos.yaml sets
cgroup.autoMount.enabled=false, so the upstream chart does not render
the mount-cgroup init container, and our unconditional podAnnotations
entry for it becomes an invalid reference.

Move the podAnnotations block from the shared values.yaml into a new
values-apparmor.yaml and include it only in the cilium-generic and
kubeovn-cilium-generic PackageSource variants, where
cgroup.autoMount.enabled is explicitly true. Talos variants
(cilium, cilium-kilo, kubeovn-cilium) get no AppArmor annotations,
which is safe because the Talos kernel does not load the AppArmor
LSM anyway.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../core/platform/sources/networking.yaml     |  2 ++
 packages/system/cilium/values-apparmor.yaml   | 20 +++++++++++++++++++
 packages/system/cilium/values.yaml            | 20 -------------------
 3 files changed, 22 insertions(+), 20 deletions(-)
 create mode 100644 packages/system/cilium/values-apparmor.yaml

diff --git a/packages/core/platform/sources/networking.yaml b/packages/core/platform/sources/networking.yaml
index 8e8485b3..bece76f8 100644
--- a/packages/core/platform/sources/networking.yaml
+++ b/packages/core/platform/sources/networking.yaml
@@ -66,6 +66,7 @@ spec:
       path: system/cilium
       valuesFiles:
       - values.yaml
+      - values-apparmor.yaml
       install:
         privileged: true
         namespace: cozy-cilium
@@ -117,6 +118,7 @@ spec:
       path: system/cilium
       valuesFiles:
       - values.yaml
+      - values-apparmor.yaml
       - values-kubeovn.yaml
       install:
         privileged: true
diff --git a/packages/system/cilium/values-apparmor.yaml b/packages/system/cilium/values-apparmor.yaml
new file mode 100644
index 00000000..0712836c
--- /dev/null
+++ b/packages/system/cilium/values-apparmor.yaml
@@ -0,0 +1,20 @@
+cilium:
+  # Opt out of the cri-containerd.apparmor.d profile for containers that invoke
+  # nsenter to join the host cgroup/mount namespace. The kernel reports the
+  # denial as a blocked "ptrace" operation. Required on Ubuntu 22.04+ and
+  # other distros that load this AppArmor profile by default, where the
+  # denial otherwise puts cilium-agent into Init:CrashLoopBackOff.
+  # The deprecated annotations are used because k8s >= 1.30 pod-level
+  # appArmorProfile: Unconfined is not honoured by containerd CRI today
+  # (kubernetes/kubernetes#125069).
+  # Only applied on non-Talos cilium variants where cgroup.autoMount.enabled is
+  # true — on Talos mount-cgroup is not rendered and the kube-apiserver would
+  # reject an annotation referencing a non-existent container.
+  # mount-bpf-fs is intentionally excluded: it renders with its own
+  # securityContext.privileged=true, and the kernel does not apply AppArmor
+  # profiles to privileged containers.
+  podAnnotations:
+    container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined
+    container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined
+    container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined
+    container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: unconfined
diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml
index 8aee34d9..cfb2cd6b 100644
--- a/packages/system/cilium/values.yaml
+++ b/packages/system/cilium/values.yaml
@@ -23,23 +23,3 @@ cilium:
   operator:
     rollOutPods: true
     replicas: 1
-  # Opt out of the cri-containerd.apparmor.d profile for containers that invoke
-  # nsenter to join the host cgroup/mount namespace. The kernel reports the
-  # denial as a blocked "ptrace" operation. Required on Ubuntu 22.04+ and
-  # other distros that load this AppArmor profile by default, where the
-  # denial otherwise puts cilium-agent into Init:CrashLoopBackOff.
-  # The deprecated annotations are used because k8s >= 1.30 pod-level
-  # appArmorProfile: Unconfined is not honoured by containerd CRI today
-  # (kubernetes/kubernetes#125069).
-  # On Talos mount-cgroup is not rendered (cgroup.autoMount.enabled=false in
-  # values-talos.yaml) so its annotation is inert there. On RHEL-family and
-  # other AppArmor-less hosts kubelet silently ignores these annotations
-  # because the AppArmor LSM is not loaded.
-  # mount-bpf-fs is intentionally excluded: it renders with its own
-  # securityContext.privileged=true, and the kernel does not apply AppArmor
-  # profiles to privileged containers.
-  podAnnotations:
-    container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined
-    container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined
-    container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined
-    container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: unconfined

From 44dd0021e42f24fa3d85b39f5991463f32e58a16 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 11 Apr 2026 17:07:35 +0300
Subject: [PATCH 411/666] fix(hack): wrap du in 'timeout 5s' to prevent
 preflight stall
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The disk_usage helper shells out to 'du -sh $path' for reporting in
the warning message. On the exact directories this script is meant
to warn about (a /var/lib/containerd accumulating millions of files
from months of unpruned builds), traversing the tree with du can
take minutes and stall the preflight indefinitely.

Wrap the call in 'timeout 5s' so the helper returns quickly even on
a pathologically slow filesystem. If the timeout binary is absent
(e.g. minimal busybox userland), the pipeline still exits 0 via the
existing '|| true' guard and usage stays empty — the warning still
prints, just without the size detail — so the change is backward
compatible.

Addresses an inline review comment from gemini-code-assist on the
open PR.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/check-host-runtime.sh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/hack/check-host-runtime.sh b/hack/check-host-runtime.sh
index 0ba6d301..917453d2 100755
--- a/hack/check-host-runtime.sh
+++ b/hack/check-host-runtime.sh
@@ -63,7 +63,13 @@ disk_usage() {
     local path=$1
     local usage
     if [ -d "$path" ]; then
-        usage=$(du -sh "$path" 2>/dev/null | awk '{print $1}' || true)
+        # Wrap `du` in `timeout 5s` so a container data directory with
+        # millions of files (the exact scenario this script exists to
+        # warn about) cannot stall the preflight indefinitely. If the
+        # `timeout` binary is absent the pipeline still exits 0 via
+        # `|| true` and `usage` stays empty; the warning itself is
+        # still printed, just without the size detail.
+        usage=$(timeout 5s du -sh "$path" 2>/dev/null | awk '{print $1}' || true)
         if [ -n "${usage:-}" ]; then
             printf ' (%s uses %s)' "$path" "$usage"
         fi

From 2b96be8a65449e03b0037124d1a7260bb7aad5a6 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sun, 12 Apr 2026 03:29:25 +0300
Subject: [PATCH 412/666] [platform] Validate computed tenant namespace length
 in cozystack-api

Reject Tenant creation when the computed workload namespace (parent
namespace + "-" + tenant name) would exceed the 63-character DNS-1123
label limit. Previously only the per-name length was checked against
the Helm release limit, so a deeply-nested tenant could pass Create()
and then fail later as an opaque HelmRelease reconcile error.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 pkg/registry/apps/application/rest.go         | 35 +++++++
 .../apps/application/rest_validation_test.go  | 99 +++++++++++++++++++
 2 files changed, 134 insertions(+)

diff --git a/pkg/registry/apps/application/rest.go b/pkg/registry/apps/application/rest.go
index 7871bbe7..43398751 100644
--- a/pkg/registry/apps/application/rest.go
+++ b/pkg/registry/apps/application/rest.go
@@ -164,6 +164,17 @@ func (r *REST) Create(ctx context.Context, obj runtime.Object, createValidation
 		return nil, apierrors.NewInvalid(r.gvk.GroupKind(), app.Name, nameLenErrs)
 	}
 
+	// For Tenant applications, also validate that the computed workload
+	// namespace fits within the DNS-1123 label limit. A deeply-nested tenant
+	// can exceed the limit even when its own name passes the per-name Helm
+	// release length check, because the namespace is formed from the full
+	// ancestor chain.
+	if r.kindName == "Tenant" {
+		if nsErrs := r.validateTenantNamespaceLength(app.Namespace, app.Name); len(nsErrs) > 0 {
+			return nil, apierrors.NewInvalid(r.gvk.GroupKind(), app.Name, nsErrs)
+		}
+	}
+
 	// Validate that values don't contain reserved keys (starting with "_")
 	if err := validateNoInternalKeys(app.Spec); err != nil {
 		return nil, apierrors.NewBadRequest(err.Error())
@@ -1049,6 +1060,12 @@ func validateNoInternalKeys(values *apiextv1.JSON) error {
 // chart-generated resource suffixes within the 63-char DNS-1035 label limit.
 const maxHelmReleaseName = 53
 
+// maxNamespaceName is the DNS-1123 label limit for Kubernetes namespace names.
+// The tenant Helm chart creates a Namespace whose name is the computed
+// workload namespace (parent namespace + "-" + tenant name), so the total
+// must fit inside a single 63-char DNS-1123 label.
+const maxNamespaceName = 63
+
 // validateNameLength checks that the application name won't exceed Kubernetes limits.
 // prefix + name must fit within the Helm release name limit (53 chars).
 func (r *REST) validateNameLength(name string) field.ErrorList {
@@ -1070,6 +1087,24 @@ func (r *REST) validateNameLength(name string) field.ErrorList {
 	return allErrs
 }
 
+// validateTenantNamespaceLength checks that the computed workload namespace
+// for a Tenant application fits within the DNS-1123 label limit. The namespace
+// is formed by dash-joining the parent namespace with the tenant name, so
+// deep nesting can exceed the limit even when each individual name passes the
+// per-name Helm release length check.
+func (r *REST) validateTenantNamespaceLength(currentNamespace, tenantName string) field.ErrorList {
+	fldPath := field.NewPath("metadata").Child("name")
+	allErrs := field.ErrorList{}
+
+	computed := r.computeTenantNamespace(currentNamespace, tenantName)
+	if len(computed) > maxNamespaceName {
+		allErrs = append(allErrs, field.Invalid(fldPath, tenantName,
+			fmt.Sprintf("computed tenant namespace %q would be %d characters, which exceeds the %d-character Kubernetes namespace limit; shorten the tenant name or reduce ancestor nesting depth",
+				computed, len(computed), maxNamespaceName)))
+	}
+	return allErrs
+}
+
 // convertHelmReleaseToApplication implements the actual conversion logic
 func (r *REST) convertHelmReleaseToApplication(ctx context.Context, hr *helmv2.HelmRelease) (appsv1alpha1.Application, error) {
 	// Filter out internal keys (starting with "_") from spec
diff --git a/pkg/registry/apps/application/rest_validation_test.go b/pkg/registry/apps/application/rest_validation_test.go
index c5d331b2..f65a2247 100644
--- a/pkg/registry/apps/application/rest_validation_test.go
+++ b/pkg/registry/apps/application/rest_validation_test.go
@@ -17,6 +17,7 @@ limitations under the License.
 package application
 
 import (
+	"fmt"
 	"strings"
 	"testing"
 
@@ -102,3 +103,101 @@ func TestValidateNameLength(t *testing.T) {
 		})
 	}
 }
+
+// TestValidateTenantNamespaceLength covers the check that the computed
+// workload namespace for a Tenant application fits inside the 63-char
+// DNS-1123 label limit. The namespace is formed by dash-joining the
+// parent namespace with the tenant name, so deep nesting can exceed the
+// limit even when each individual name passes the per-name Helm release
+// length check.
+//
+// The "tenant-root" branches of computeTenantNamespace do not get a
+// dedicated overflow case: that branch produces "tenant-<name>" (7 +
+// len(name)), so for the computed result to exceed 63 chars the name
+// would need to exceed 56 chars, which is already blocked by
+// validateNameLength (max 46 for the "tenant-" prefix). The invariant
+// holds by arithmetic.
+func TestValidateTenantNamespaceLength(t *testing.T) {
+	tests := []struct {
+		name             string
+		currentNamespace string
+		tenantName       string
+		wantError        bool
+	}{
+		{
+			name:             "tenant-root with short name passes",
+			currentNamespace: "tenant-root",
+			tenantName:       "alpha",
+			wantError:        false,
+		},
+		{
+			name:             "root tenant inside root namespace passes",
+			currentNamespace: "tenant-root",
+			tenantName:       "root",
+			wantError:        false,
+		},
+		{
+			name:             "short parent and short name passes",
+			currentNamespace: "tenant-foo",
+			tenantName:       "bar",
+			wantError:        false,
+		},
+		{
+			name:             "exactly at 63-char limit passes",
+			currentNamespace: "tenant-" + strings.Repeat("a", 45), // 52 chars
+			tenantName:       strings.Repeat("b", 10),             // 10 chars -> 52+1+10 = 63
+			wantError:        false,
+		},
+		{
+			name:             "one char over the limit fails",
+			currentNamespace: "tenant-" + strings.Repeat("a", 45), // 52 chars
+			tenantName:       strings.Repeat("b", 11),             // 11 chars -> 52+1+11 = 64
+			wantError:        true,
+		},
+		{
+			name:             "deeply nested failure with issue-style names",
+			currentNamespace: "tenant-" + strings.Repeat("a", 35), // 42 chars
+			tenantName:       strings.Repeat("b", 25),             // 25 chars -> 42+1+25 = 68
+			wantError:        true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := &REST{
+				kindName: "Tenant",
+				releaseConfig: config.ReleaseConfig{
+					Prefix: "tenant-",
+				},
+			}
+
+			errs := r.validateTenantNamespaceLength(tt.currentNamespace, tt.tenantName)
+
+			if tt.wantError && len(errs) == 0 {
+				computed := r.computeTenantNamespace(tt.currentNamespace, tt.tenantName)
+				t.Errorf("expected error for parent=%q name=%q (computed=%q, len=%d), got none",
+					tt.currentNamespace, tt.tenantName, computed, len(computed))
+				return
+			}
+			if !tt.wantError && len(errs) > 0 {
+				t.Errorf("unexpected error for parent=%q name=%q: %v",
+					tt.currentNamespace, tt.tenantName, errs)
+				return
+			}
+
+			// For failing cases, verify the error message surfaces the
+			// computed namespace string and its actual length so a
+			// regression in the message format is caught.
+			if tt.wantError {
+				computed := r.computeTenantNamespace(tt.currentNamespace, tt.tenantName)
+				msg := errs.ToAggregate().Error()
+				if !strings.Contains(msg, computed) {
+					t.Errorf("error message must contain computed namespace %q, got: %s", computed, msg)
+				}
+				if !strings.Contains(msg, fmt.Sprintf("%d characters", len(computed))) {
+					t.Errorf("error message must contain the computed length %d, got: %s", len(computed), msg)
+				}
+			}
+		})
+	}
+}

From a5bdf5ea0c4d896cf9371a4a894fd93570f10603 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sun, 12 Apr 2026 03:01:24 +0300
Subject: [PATCH 413/666] fix(api): reject tenant names with dashes at Create
 time

ValidateApplicationName previously delegated to IsDNS1035Label, which permits hyphens. The tenant Helm chart's tenant.name helper rejects them at template time, so users saw a successful kubectl apply followed by a Flux reconciliation error.

Extend ValidateApplicationName with a kindName parameter and enforce alphanumeric-only names for the Tenant kind, matching the documented naming rules. Wire the check into REST.Create via a small validateNameFormat wrapper that mirrors validateNameLength.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 pkg/apis/apps/validation/validation.go        | 34 ++++++--
 pkg/apis/apps/validation/validation_test.go   | 84 ++++++++++++-------
 pkg/registry/apps/application/rest.go         | 11 ++-
 .../apps/application/rest_validation_test.go  | 40 +++++++++
 4 files changed, 130 insertions(+), 39 deletions(-)

diff --git a/pkg/apis/apps/validation/validation.go b/pkg/apis/apps/validation/validation.go
index 273873a4..3506dc1e 100644
--- a/pkg/apis/apps/validation/validation.go
+++ b/pkg/apis/apps/validation/validation.go
@@ -17,16 +17,29 @@ limitations under the License.
 package validation
 
 import (
+	"regexp"
+
 	k8svalidation "k8s.io/apimachinery/pkg/util/validation"
 	"k8s.io/apimachinery/pkg/util/validation/field"
 )
 
-// ValidateApplicationName validates that an Application name conforms to DNS-1035.
-// This is required because Application names are used to create Kubernetes resources
-// (Services, Namespaces, etc.) that must have DNS-1035 compliant names.
-// Note: length validation is handled separately by validateNameLength in the REST
-// handler, which computes dynamic limits based on Helm release prefix.
-func ValidateApplicationName(name string, fldPath *field.Path) field.ErrorList {
+// tenantNameRegex enforces alphanumeric-only tenant names. This is stricter
+// than DNS-1035 because the tenant Helm chart's tenant.name helper
+// (packages/apps/tenant/templates/_helpers.tpl) splits Release.Name on "-"
+// and fails unless the result is exactly ["tenant", "<name>"]. Any dash
+// inside <name> would break that invariant at Helm template time, so the
+// aggregated API must reject such names up-front with a specific error.
+var tenantNameRegex = regexp.MustCompile(`^[a-z0-9]+$`)
+
+// ValidateApplicationName validates that an Application name is acceptable for
+// the given kind. All applications must conform to DNS-1035 because their
+// names are used to create Kubernetes resources (Services, Namespaces, etc.)
+// that require DNS-1035 compliance. Tenant applications additionally must be
+// alphanumeric (no dashes) because of the Helm chart constraint described on
+// tenantNameRegex.
+// Note: length validation is handled separately by validateNameLength in the
+// REST handler, which computes dynamic limits based on Helm release prefix.
+func ValidateApplicationName(name, kindName string, fldPath *field.Path) field.ErrorList {
 	allErrs := field.ErrorList{}
 
 	if len(name) == 0 {
@@ -34,6 +47,15 @@ func ValidateApplicationName(name string, fldPath *field.Path) field.ErrorList {
 		return allErrs
 	}
 
+	// Tenant names must be alphanumeric — see tenantNameRegex comment for the
+	// reason. Check before DNS-1035 so the error message is specific to the
+	// tenant contract, not the generic DNS label rules.
+	if kindName == "Tenant" && !tenantNameRegex.MatchString(name) {
+		allErrs = append(allErrs, field.Invalid(fldPath, name,
+			"tenant names must be alphanumeric (lowercase letters and digits only); dashes are not allowed"))
+		return allErrs
+	}
+
 	for _, msg := range k8svalidation.IsDNS1035Label(name) {
 		allErrs = append(allErrs, field.Invalid(fldPath, name, msg))
 	}
diff --git a/pkg/apis/apps/validation/validation_test.go b/pkg/apis/apps/validation/validation_test.go
index 7bf194d5..808d676f 100644
--- a/pkg/apis/apps/validation/validation_test.go
+++ b/pkg/apis/apps/validation/validation_test.go
@@ -27,54 +27,76 @@ func TestValidateApplicationName(t *testing.T) {
 	tests := []struct {
 		name      string
 		appName   string
+		kindName  string
 		wantError bool
 	}{
-		// Valid names
-		{"valid simple name", "tenant-one", false},
-		{"valid single letter", "a", false},
-		{"valid with numbers", "abc-123", false},
-		{"valid lowercase", "my-tenant", false},
-		{"valid long name", "my-very-long-tenant-name", false},
-		{"valid double hyphen", "my--tenant", false},
-		{"valid at DNS-1035 max (63 chars)", strings.Repeat("a", 63), false},
+		// Valid names (non-tenant kinds permit DNS-1035 including hyphens)
+		{"valid simple name", "tenant-one", "MySQL", false},
+		{"valid single letter", "a", "MySQL", false},
+		{"valid with numbers", "abc-123", "MySQL", false},
+		{"valid lowercase", "my-tenant", "MySQL", false},
+		{"valid long name", "my-very-long-tenant-name", "MySQL", false},
+		{"valid double hyphen", "my--tenant", "MySQL", false},
+		{"valid at DNS-1035 max (63 chars)", strings.Repeat("a", 63), "MySQL", false},
+		{"valid with empty kind", "my-db", "", false},
 
 		// Invalid: starts with wrong character
-		{"starts with digit", "1john", true},
-		{"only digits", "123", true},
-		{"starts with hyphen", "-tenant", true},
+		{"starts with digit", "1john", "MySQL", true},
+		{"only digits", "123", "MySQL", true},
+		{"starts with hyphen", "-tenant", "MySQL", true},
 
 		// Invalid: ends with wrong character
-		{"ends with hyphen", "tenant-", true},
+		{"ends with hyphen", "tenant-", "MySQL", true},
 
 		// Invalid: wrong characters
-		{"uppercase letters", "Tenant", true},
-		{"mixed case", "myTenant", true},
-		{"underscore", "my_tenant", true},
-		{"dot", "my.tenant", true},
-		{"space", "my tenant", true},
-		{"unicode cyrillic", "тенант", true},
-		{"unicode emoji", "tenant🚀", true},
-		{"special chars", "tenant@home", true},
-		{"colon", "tenant:one", true},
-		{"slash", "tenant/one", true},
+		{"uppercase letters", "Tenant", "MySQL", true},
+		{"mixed case", "myTenant", "MySQL", true},
+		{"underscore", "my_tenant", "MySQL", true},
+		{"dot", "my.tenant", "MySQL", true},
+		{"space", "my tenant", "MySQL", true},
+		{"unicode cyrillic", "тенант", "MySQL", true},
+		{"unicode emoji", "tenant🚀", "MySQL", true},
+		{"special chars", "tenant@home", "MySQL", true},
+		{"colon", "tenant:one", "MySQL", true},
+		{"slash", "tenant/one", "MySQL", true},
 
 		// Invalid: empty or whitespace
-		{"empty string", "", true},
-		{"only spaces", "   ", true},
-		{"leading space", " tenant", true},
-		{"trailing space", "tenant ", true},
+		{"empty string", "", "MySQL", true},
+		{"only spaces", "   ", "MySQL", true},
+		{"leading space", " tenant", "MySQL", true},
+		{"trailing space", "tenant ", "MySQL", true},
 
 		// Invalid: exceeds DNS-1035 max length (63)
-		{"too long (64 chars)", strings.Repeat("a", 64), true},
-		{"way too long (100 chars)", strings.Repeat("a", 100), true},
+		{"too long (64 chars)", strings.Repeat("a", 64), "MySQL", true},
+		{"way too long (100 chars)", strings.Repeat("a", 100), "MySQL", true},
+
+		// Tenant kind: stricter alphanumeric-only rule.
+		// The tenant Helm chart's tenant.name helper (packages/apps/tenant/templates/_helpers.tpl)
+		// splits Release.Name on "-" and fails unless the result is exactly
+		// ["tenant", "<name>"]. Any dash inside <name> breaks that invariant, so
+		// the aggregated API must reject tenant names containing dashes up-front
+		// with a specific error — instead of letting Flux reconciliation fail later.
+		{"tenant alphanumeric simple", "foo", "Tenant", false},
+		{"tenant alphanumeric with digits", "foo123", "Tenant", false},
+		{"tenant single char", "a", "Tenant", false},
+		{"tenant single hyphen", "foo-bar", "Tenant", true},
+		{"tenant leading hyphen", "-foo", "Tenant", true},
+		{"tenant trailing hyphen", "foo-", "Tenant", true},
+		{"tenant double hyphen", "foo--bar", "Tenant", true},
+		{"tenant uppercase", "Foo", "Tenant", true},
+		{"tenant underscore", "foo_bar", "Tenant", true},
+		{"tenant empty", "", "Tenant", true},
+		// Leading digit is alphanumeric (tenant regex passes) but falls through
+		// to DNS-1035, which requires a leading alphabetic character.
+		{"tenant leading digit", "123foo", "Tenant", true},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			errs := ValidateApplicationName(tt.appName, field.NewPath("metadata").Child("name"))
+			errs := ValidateApplicationName(tt.appName, tt.kindName, field.NewPath("metadata").Child("name"))
 			if (len(errs) > 0) != tt.wantError {
-				t.Errorf("ValidateApplicationName(%q) returned %d errors, wantError = %v, errors = %v",
-					tt.appName, len(errs), tt.wantError, errs)
+				t.Errorf("ValidateApplicationName(%q, kind=%q) returned %d errors, wantError = %v, errors = %v",
+					tt.appName, tt.kindName, len(errs), tt.wantError, errs)
 			}
 		})
 	}
diff --git a/pkg/registry/apps/application/rest.go b/pkg/registry/apps/application/rest.go
index 43398751..ca75576b 100644
--- a/pkg/registry/apps/application/rest.go
+++ b/pkg/registry/apps/application/rest.go
@@ -154,8 +154,8 @@ func (r *REST) Create(ctx context.Context, obj runtime.Object, createValidation
 		return nil, fmt.Errorf("expected *appsv1alpha1.Application object, got %T", obj)
 	}
 
-	// Validate Application name conforms to DNS-1035
-	if errs := validation.ValidateApplicationName(app.Name, field.NewPath("metadata").Child("name")); len(errs) > 0 {
+	// Validate Application name format (DNS-1035 plus any kind-specific rules)
+	if errs := r.validateNameFormat(app.Name); len(errs) > 0 {
 		return nil, apierrors.NewInvalid(r.gvk.GroupKind(), app.Name, errs)
 	}
 
@@ -1066,6 +1066,13 @@ const maxHelmReleaseName = 53
 // must fit inside a single 63-char DNS-1123 label.
 const maxNamespaceName = 63
 
+// validateNameFormat checks an Application name against DNS-1035 and any
+// kind-specific format rules (e.g. Tenant names must be alphanumeric — see
+// validation.ValidateApplicationName for the reasoning).
+func (r *REST) validateNameFormat(name string) field.ErrorList {
+	return validation.ValidateApplicationName(name, r.kindName, field.NewPath("metadata").Child("name"))
+}
+
 // validateNameLength checks that the application name won't exceed Kubernetes limits.
 // prefix + name must fit within the Helm release name limit (53 chars).
 func (r *REST) validateNameLength(name string) field.ErrorList {
diff --git a/pkg/registry/apps/application/rest_validation_test.go b/pkg/registry/apps/application/rest_validation_test.go
index f65a2247..c0e5f9f5 100644
--- a/pkg/registry/apps/application/rest_validation_test.go
+++ b/pkg/registry/apps/application/rest_validation_test.go
@@ -24,6 +24,46 @@ import (
 	"github.com/cozystack/cozystack/pkg/config"
 )
 
+func TestValidateNameFormat(t *testing.T) {
+	tests := []struct {
+		name      string
+		kindName  string
+		appName   string
+		wantError bool
+	}{
+		// Non-tenant kinds follow DNS-1035 only — hyphens are allowed.
+		{"non-tenant accepts hyphen", "MySQL", "my-db", false},
+		{"non-tenant accepts double hyphen", "MySQL", "my--db", false},
+		{"non-tenant rejects uppercase", "MySQL", "MyDB", true},
+
+		// Tenant kind enforces alphanumeric-only — see
+		// packages/apps/tenant/templates/_helpers.tpl for the reason.
+		{"tenant accepts alphanumeric", "Tenant", "foo", false},
+		{"tenant accepts digits", "Tenant", "foo123", false},
+		{"tenant rejects single hyphen", "Tenant", "foo-bar", true},
+		{"tenant rejects leading hyphen", "Tenant", "-foo", true},
+		{"tenant rejects trailing hyphen", "Tenant", "foo-", true},
+		{"tenant rejects uppercase", "Tenant", "Foo", true},
+		{"tenant rejects underscore", "Tenant", "foo_bar", true},
+		{"tenant rejects empty", "Tenant", "", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := &REST{kindName: tt.kindName}
+
+			errs := r.validateNameFormat(tt.appName)
+
+			if tt.wantError && len(errs) == 0 {
+				t.Errorf("expected error for name %q (kind=%q), got none", tt.appName, tt.kindName)
+			}
+			if !tt.wantError && len(errs) > 0 {
+				t.Errorf("unexpected error for name %q (kind=%q): %v", tt.appName, tt.kindName, errs)
+			}
+		})
+	}
+}
+
 func TestValidateNameLength(t *testing.T) {
 	tests := []struct {
 		name      string

From fef0f10bfda3736a8e830f5c1e0ec098f25bfe5c Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sun, 12 Apr 2026 03:01:57 +0300
Subject: [PATCH 414/666] docs(tenant): align chart README with tenant naming
 rules

The README stated that dashes are 'allowed but discouraged' in tenant names, but the tenant.name Helm helper explicitly fails on release names that contain more than one dash, and the platform guide on the website already says tenant names must be alphanumeric. Bring the chart README in line with both the website documentation and the enforcement now present on the aggregated API.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/apps/tenant/README.md | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/packages/apps/tenant/README.md b/packages/apps/tenant/README.md
index 987e2c99..96cf5c6e 100644
--- a/packages/apps/tenant/README.md
+++ b/packages/apps/tenant/README.md
@@ -6,15 +6,15 @@ Tenants can be created recursively and are subject to the following rules:
 
 ### Tenant naming
 
-Tenant names must follow DNS-1035 naming rules:
--   Must start with a lowercase letter (`a-z`)
--   Can only contain lowercase letters, numbers, and hyphens (`a-z`, `0-9`, `-`)
--   Must end with a letter or number (not a hyphen)
+Tenant names must be alphanumeric:
+
+-   Lowercase letters (`a-z`) and digits (`0-9`) only
+-   Must start with a lowercase letter
+-   Dashes (`-`) are **not allowed**, unlike with other services
 -   Maximum length depends on the cluster configuration (Helm release prefix and root domain)
 
-**Note:** Using dashes (`-`) in tenant names is **allowed but discouraged**, unlike with other services.
-This is to keep consistent naming in tenants, nested tenants, and services deployed in them.
-Names with dashes (e.g., `foo-bar`) may lead to ambiguous parsing of internal resource names like `tenant-foo-bar`.
+This restriction exists to keep consistent naming in tenants, nested tenants, and services deployed in them.
+A tenant cannot be named `foo-bar` because parsing internal resource names like `tenant-foo-bar` would be ambiguous.
 
 For example:
 

From be40ac55c61dabe3dd94ff7e50f0b8de6c91e727 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sun, 12 Apr 2026 03:20:23 +0300
Subject: [PATCH 415/666] fix(api): tighten tenant name regex and add
 regression guards

Two follow-ups from review:

1. The original tenantNameRegex ^[a-z0-9]+$ let leading-digit names like 123foo slip past the tenant check and receive a generic DNS-1035 error, which defeated the goal of surfacing a tenant-specific message. Require a leading lowercase letter so every tenant-invalid name returns the tenant-contract error.

2. Add a BATS regression test in hack/e2e-install-cozystack.bats that exercises the aggregated API end-to-end. Unit tests construct REST{kindName: "Tenant"} by hand, so a future change to ApplicationDefinition kind registration could break real behavior without breaking the unit tests.

Also pin the error-message contract with a new TestValidateApplicationName_TenantErrorMessage that asserts every tenant-invalid input returns a message containing 'tenant names must' (not the generic DNS-1035 text).

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-install-cozystack.bats             | 22 ++++++++++-
 pkg/apis/apps/validation/validation.go      | 30 +++++++-------
 pkg/apis/apps/validation/validation_test.go | 43 ++++++++++++++++++++-
 3 files changed, 79 insertions(+), 16 deletions(-)

diff --git a/hack/e2e-install-cozystack.bats b/hack/e2e-install-cozystack.bats
index 743782e9..7e3664ba 100644
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -200,8 +200,28 @@ EOF
   kubectl wait hr/keycloak hr/keycloak-configure hr/keycloak-operator -n cozy-keycloak --timeout=10m --for=condition=ready
 }
 
+@test "Aggregated API rejects Tenant name with dashes" {
+  # Regression guard: the tenant Helm chart's tenant.name helper splits the
+  # Release.Name on "-" and fails unless the result is exactly
+  # ["tenant", "<name>"]. The aggregated API must catch tenant names
+  # containing dashes up-front with a tenant-specific error, instead of
+  # silently accepting the Application and letting Flux fail later.
+  local output
+  output=$(kubectl apply -f - <<EOF 2>&1 || true
+apiVersion: apps.cozystack.io/v1alpha1
+kind: Tenant
+metadata:
+  name: foo-bar
+  namespace: tenant-root
+spec: {}
+EOF
+)
+  echo "$output" | grep -q "tenant names must"
+  ! echo "$output" | grep -qi "created"
+}
+
 @test "Create tenant with isolated mode enabled" {
-  kubectl -n tenant-root get tenants.apps.cozystack.io test || 
+  kubectl -n tenant-root get tenants.apps.cozystack.io test ||
   kubectl apply -f - <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: Tenant
diff --git a/pkg/apis/apps/validation/validation.go b/pkg/apis/apps/validation/validation.go
index 3506dc1e..8f0f6681 100644
--- a/pkg/apis/apps/validation/validation.go
+++ b/pkg/apis/apps/validation/validation.go
@@ -23,20 +23,23 @@ import (
 	"k8s.io/apimachinery/pkg/util/validation/field"
 )
 
-// tenantNameRegex enforces alphanumeric-only tenant names. This is stricter
-// than DNS-1035 because the tenant Helm chart's tenant.name helper
-// (packages/apps/tenant/templates/_helpers.tpl) splits Release.Name on "-"
-// and fails unless the result is exactly ["tenant", "<name>"]. Any dash
-// inside <name> would break that invariant at Helm template time, so the
-// aggregated API must reject such names up-front with a specific error.
-var tenantNameRegex = regexp.MustCompile(`^[a-z0-9]+$`)
+// tenantNameRegex enforces alphanumeric-only tenant names that begin with a
+// lowercase letter. This is stricter than DNS-1035 because the tenant Helm
+// chart's tenant.name helper (packages/apps/tenant/templates/_helpers.tpl)
+// splits Release.Name on "-" and fails unless the result is exactly
+// ["tenant", "<name>"]. Any dash inside <name> would break that invariant at
+// Helm template time, so the aggregated API must reject such names up-front
+// with a specific error. Requiring a leading letter (rather than letting
+// leading-digit names fall through to DNS-1035) keeps the error message
+// tenant-specific for all invalid inputs.
+var tenantNameRegex = regexp.MustCompile(`^[a-z][a-z0-9]*$`)
 
 // ValidateApplicationName validates that an Application name is acceptable for
 // the given kind. All applications must conform to DNS-1035 because their
 // names are used to create Kubernetes resources (Services, Namespaces, etc.)
 // that require DNS-1035 compliance. Tenant applications additionally must be
-// alphanumeric (no dashes) because of the Helm chart constraint described on
-// tenantNameRegex.
+// alphanumeric and begin with a lowercase letter because of the Helm chart
+// constraint described on tenantNameRegex.
 // Note: length validation is handled separately by validateNameLength in the
 // REST handler, which computes dynamic limits based on Helm release prefix.
 func ValidateApplicationName(name, kindName string, fldPath *field.Path) field.ErrorList {
@@ -47,12 +50,13 @@ func ValidateApplicationName(name, kindName string, fldPath *field.Path) field.E
 		return allErrs
 	}
 
-	// Tenant names must be alphanumeric — see tenantNameRegex comment for the
-	// reason. Check before DNS-1035 so the error message is specific to the
-	// tenant contract, not the generic DNS label rules.
+	// Tenant names must be alphanumeric starting with a letter — see
+	// tenantNameRegex comment for the reason. Check before DNS-1035 so the
+	// error message is specific to the tenant contract, not the generic DNS
+	// label rules.
 	if kindName == "Tenant" && !tenantNameRegex.MatchString(name) {
 		allErrs = append(allErrs, field.Invalid(fldPath, name,
-			"tenant names must be alphanumeric (lowercase letters and digits only); dashes are not allowed"))
+			"tenant names must start with a lowercase letter and contain only lowercase letters and digits; dashes are not allowed"))
 		return allErrs
 	}
 
diff --git a/pkg/apis/apps/validation/validation_test.go b/pkg/apis/apps/validation/validation_test.go
index 808d676f..dfcb01a7 100644
--- a/pkg/apis/apps/validation/validation_test.go
+++ b/pkg/apis/apps/validation/validation_test.go
@@ -86,8 +86,9 @@ func TestValidateApplicationName(t *testing.T) {
 		{"tenant uppercase", "Foo", "Tenant", true},
 		{"tenant underscore", "foo_bar", "Tenant", true},
 		{"tenant empty", "", "Tenant", true},
-		// Leading digit is alphanumeric (tenant regex passes) but falls through
-		// to DNS-1035, which requires a leading alphabetic character.
+		// Leading digit must be caught by the tenant-specific regex (not by
+		// falling through to DNS-1035) so the error message reflects the
+		// tenant contract — see TestValidateApplicationName_TenantErrorMessage.
 		{"tenant leading digit", "123foo", "Tenant", true},
 	}
 
@@ -101,3 +102,41 @@ func TestValidateApplicationName(t *testing.T) {
 		})
 	}
 }
+
+// TestValidateApplicationName_TenantErrorMessage pins the contract that when
+// a tenant name is invalid, the returned error message is specific to the
+// tenant naming rule — not the generic DNS-1035 message. Otherwise users get
+// back "must start with an alphabetic character" or similar and have no way
+// to know the constraint is tied to the tenant Helm chart.
+func TestValidateApplicationName_TenantErrorMessage(t *testing.T) {
+	// Every tenant-invalid name below must surface a tenant-specific error
+	// message. In particular, "123foo" starts with a digit — the original
+	// implementation let that fall through to DNS-1035 with a generic error;
+	// the regex is tightened specifically so this case fails up-front.
+	invalidTenantNames := []string{
+		"foo-bar",  // dash
+		"-foo",     // leading dash
+		"foo-",     // trailing dash
+		"foo--bar", // double dash
+		"Foo",      // uppercase
+		"foo_bar",  // underscore
+		"foo.bar",  // dot
+		"foo bar",  // space
+		"123foo",   // leading digit — must not fall through to DNS-1035
+	}
+
+	const wantSubstring = "tenant names must"
+
+	for _, name := range invalidTenantNames {
+		t.Run(name, func(t *testing.T) {
+			errs := ValidateApplicationName(name, "Tenant", field.NewPath("metadata").Child("name"))
+			if len(errs) == 0 {
+				t.Fatalf("expected error for tenant name %q, got none", name)
+			}
+			if !strings.Contains(errs[0].Detail, wantSubstring) {
+				t.Errorf("tenant name %q: error detail = %q, want substring %q (generic DNS-1035 message is not tenant-specific)",
+					name, errs[0].Detail, wantSubstring)
+			}
+		})
+	}
+}

From 1ffb529f06392c22fbbba1ae7b31e0a0506c2def Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sun, 12 Apr 2026 03:28:53 +0300
Subject: [PATCH 416/666] test(api): harden tenant name validation test
 coverage
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up from review round 2:

The BATS regression test now pins a namespace precondition, disables kubectl client-side validation with --validate=false so the request is guaranteed to reach the server-side name check, and documents the intent of each assertion. Previously a client-side schema rejection could have produced a false negative on the tenant-specific error grep, and a missing tenant-root namespace could have produced an unrelated failure that was hard to diagnose.

Also pin the edge case where a tenant name consists of valid characters but exceeds the DNS-1035 63-char label limit. The resulting error is intentionally the generic DNS-1035 message because length is not a tenant-specific constraint — the package-level function is not responsible for the stricter Helm-release-prefix length budget that REST.validateNameLength enforces.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-install-cozystack.bats             | 16 +++++++++++-
 pkg/apis/apps/validation/validation_test.go | 27 +++++++++++++++++++++
 2 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/hack/e2e-install-cozystack.bats b/hack/e2e-install-cozystack.bats
index 7e3664ba..41c4decb 100644
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -206,8 +206,18 @@ EOF
   # ["tenant", "<name>"]. The aggregated API must catch tenant names
   # containing dashes up-front with a tenant-specific error, instead of
   # silently accepting the Application and letting Flux fail later.
+
+  # Preflight: tenant-root is created by earlier tests in this suite. Fail
+  # loudly if it is missing so this test does not silently trigger an
+  # unrelated "namespace not found" error and misreport as a pass.
+  kubectl get namespace tenant-root
+
+  # --validate=false forces kubectl to skip client-side OpenAPI validation
+  # and send the payload straight to the aggregated API. This guarantees the
+  # server-side name check runs and the error we grep for is the tenant
+  # contract error, not a kubectl schema rejection.
   local output
-  output=$(kubectl apply -f - <<EOF 2>&1 || true
+  output=$(kubectl apply --validate=false -f - <<EOF 2>&1 || true
 apiVersion: apps.cozystack.io/v1alpha1
 kind: Tenant
 metadata:
@@ -216,7 +226,11 @@ metadata:
 spec: {}
 EOF
 )
+  # Assert the tenant-specific message is present (distinguishes from
+  # generic DNS-1035 errors and from network/auth failures).
   echo "$output" | grep -q "tenant names must"
+  # And assert kubectl did NOT report creation — if validation regressed,
+  # the server would accept the object and kubectl would print "... created".
   ! echo "$output" | grep -qi "created"
 }
 
diff --git a/pkg/apis/apps/validation/validation_test.go b/pkg/apis/apps/validation/validation_test.go
index dfcb01a7..431bf08d 100644
--- a/pkg/apis/apps/validation/validation_test.go
+++ b/pkg/apis/apps/validation/validation_test.go
@@ -140,3 +140,30 @@ func TestValidateApplicationName_TenantErrorMessage(t *testing.T) {
 		})
 	}
 }
+
+// TestValidateApplicationName_TenantLengthFallthrough documents the one
+// invalid-tenant case where the error message is intentionally NOT tenant-
+// specific: when a name contains only valid tenant characters but exceeds
+// the DNS-1035 63-char label limit, the length error comes from DNS-1035
+// because length is not a tenant-specific constraint (every application
+// kind is subject to the same Kubernetes label limit). REST.validateNameLength
+// further tightens the limit using the Helm release prefix, so tenants cannot
+// actually reach 64 characters end-to-end — this test only pins the package-
+// level fallthrough so a future refactor does not accidentally promote the
+// length error into tenant-specific wording.
+func TestValidateApplicationName_TenantLengthFallthrough(t *testing.T) {
+	name := strings.Repeat("a", 64) // valid tenant pattern, too long for DNS-1035
+
+	errs := ValidateApplicationName(name, "Tenant", field.NewPath("metadata").Child("name"))
+	if len(errs) == 0 {
+		t.Fatalf("expected DNS-1035 length error for 64-char tenant name, got none")
+	}
+	// This error is the generic DNS-1035 one, NOT the tenant-specific message.
+	if strings.Contains(errs[0].Detail, "tenant names must") {
+		t.Errorf("64-char tenant name should surface the generic DNS-1035 error, got tenant-specific: %q", errs[0].Detail)
+	}
+	// Sanity check: the DNS-1035 error we do expect mentions length bounds.
+	if !strings.Contains(errs[0].Detail, "63") {
+		t.Errorf("expected DNS-1035 length hint in error detail, got: %q", errs[0].Detail)
+	}
+}

From a32825d9b4fe9901b999498291fa08f1020d50dd Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sun, 12 Apr 2026 03:35:25 +0300
Subject: [PATCH 417/666] test(api): address review round 3 fixes

Three follow-ups from review:

1. Add defensive cleanup of the foo-bar tenant before and after the e2e regression test. If a prior run left the object in the cluster (e.g. a transient validation regression), the test no longer inherits that state; and if the test itself trips a regression in the future, the cluster is left clean for subsequent tests.

2. Switch kubectl --validate=false to --validate=ignore. The bool form was deprecated in kubectl 1.25 and only kept as an alias; --validate=ignore is the modern, stable spelling.

3. Drop the brittle Contains("63") assertion in TestValidateApplicationName_TenantLengthFallthrough. It pinned the test to the exact DNS-1035 error text from k8s.io/apimachinery, which could break on unrelated upstream wording changes. The surviving assertions still cover the intent: an error exists and it is not the tenant-specific message.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-install-cozystack.bats             | 17 ++++++++++++++---
 pkg/apis/apps/validation/validation_test.go |  7 +++----
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/hack/e2e-install-cozystack.bats b/hack/e2e-install-cozystack.bats
index 41c4decb..d57002f0 100644
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -207,17 +207,23 @@ EOF
   # containing dashes up-front with a tenant-specific error, instead of
   # silently accepting the Application and letting Flux fail later.
 
+  # Defensive cleanup: if a prior regression left foo-bar in the cluster,
+  # remove it before exercising the validation so we are not observing
+  # stale state. Safe even in the happy path because of --ignore-not-found.
+  kubectl delete tenants.apps.cozystack.io foo-bar -n tenant-root --ignore-not-found
+
   # Preflight: tenant-root is created by earlier tests in this suite. Fail
   # loudly if it is missing so this test does not silently trigger an
   # unrelated "namespace not found" error and misreport as a pass.
   kubectl get namespace tenant-root
 
-  # --validate=false forces kubectl to skip client-side OpenAPI validation
+  # --validate=ignore forces kubectl to skip client-side OpenAPI validation
   # and send the payload straight to the aggregated API. This guarantees the
   # server-side name check runs and the error we grep for is the tenant
-  # contract error, not a kubectl schema rejection.
+  # contract error, not a kubectl schema rejection. (--validate=false is the
+  # deprecated alias.)
   local output
-  output=$(kubectl apply --validate=false -f - <<EOF 2>&1 || true
+  output=$(kubectl apply --validate=ignore -f - <<EOF 2>&1 || true
 apiVersion: apps.cozystack.io/v1alpha1
 kind: Tenant
 metadata:
@@ -232,6 +238,11 @@ EOF
   # And assert kubectl did NOT report creation — if validation regressed,
   # the server would accept the object and kubectl would print "... created".
   ! echo "$output" | grep -qi "created"
+
+  # Post-condition cleanup: even though we expect validation to reject the
+  # create, removing foo-bar unconditionally keeps the cluster clean for
+  # subsequent tests in case validation regresses and the object is created.
+  kubectl delete tenants.apps.cozystack.io foo-bar -n tenant-root --ignore-not-found
 }
 
 @test "Create tenant with isolated mode enabled" {
diff --git a/pkg/apis/apps/validation/validation_test.go b/pkg/apis/apps/validation/validation_test.go
index 431bf08d..51f36fd6 100644
--- a/pkg/apis/apps/validation/validation_test.go
+++ b/pkg/apis/apps/validation/validation_test.go
@@ -159,11 +159,10 @@ func TestValidateApplicationName_TenantLengthFallthrough(t *testing.T) {
 		t.Fatalf("expected DNS-1035 length error for 64-char tenant name, got none")
 	}
 	// This error is the generic DNS-1035 one, NOT the tenant-specific message.
+	// We deliberately do not assert against the exact upstream DNS-1035 text
+	// (that would tie this test to a k8s.io/apimachinery internal string and
+	// break on unrelated upstream wording changes).
 	if strings.Contains(errs[0].Detail, "tenant names must") {
 		t.Errorf("64-char tenant name should surface the generic DNS-1035 error, got tenant-specific: %q", errs[0].Detail)
 	}
-	// Sanity check: the DNS-1035 error we do expect mentions length bounds.
-	if !strings.Contains(errs[0].Detail, "63") {
-		t.Errorf("expected DNS-1035 length hint in error detail, got: %q", errs[0].Detail)
-	}
 }

From ac1132e16a1e349bf2c8c62b5b70cf08a12f5da7 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sun, 12 Apr 2026 03:47:02 +0300
Subject: [PATCH 418/666] test(api): address review round 4 findings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Four follow-ups from review round 4:

1. BLOCKER: the Update(forceAllowCreate=true) path delegates to Create() when the object does not yet exist (rest.go:452) — the typical kubectl apply upsert flow. Add TestUpdate_ForceAllowCreate_RejectsTenantDashName using a fake client so a future refactor of that delegation cannot silently bypass the tenant name check that r.validateNameFormat alone cannot catch.

2. BLOCKER: the e2e BATS test used || true inside the command substitution, which swallowed the kubectl exit code. Rework the test to capture exit code and stdout+stderr explicitly, then assert the exit code is non-zero before asserting on the error message. This distinguishes validation-success (kubectl exit 0 — regression) from environmental failures (exit non-zero but wrong message) from the happy path.

3. Extract TenantKind = "Tenant" as a named constant in the validation package with a comment pointing at the upstream ApplicationDefinition source of truth, and switch the kindName check to use it.

4. Add a clarifying comment on TestValidateApplicationName_TenantLengthFallthrough that it pins an architectural layering decision and is not a user-facing requirement, so a future promotion of tenant length into tenant-specific wording is a legitimate change rather than a test regression.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-install-cozystack.bats               | 17 ++--
 pkg/apis/apps/validation/validation.go        |  9 +-
 pkg/apis/apps/validation/validation_test.go   |  6 ++
 .../apps/application/rest_validation_test.go  | 90 +++++++++++++++++++
 4 files changed, 116 insertions(+), 6 deletions(-)

diff --git a/hack/e2e-install-cozystack.bats b/hack/e2e-install-cozystack.bats
index d57002f0..cf66b73f 100644
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -222,8 +222,12 @@ EOF
   # server-side name check runs and the error we grep for is the tenant
   # contract error, not a kubectl schema rejection. (--validate=false is the
   # deprecated alias.)
-  local output
-  output=$(kubectl apply --validate=ignore -f - <<EOF 2>&1 || true
+  local output rc
+  # Run the apply in its own subshell so we can capture BOTH stdout+stderr
+  # AND the exit code explicitly, without `|| true` swallowing a real failure
+  # mode (e.g. network error, auth failure) that should also fail the test.
+  output=$(
+    kubectl apply --validate=ignore -f - 2>&1 <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: Tenant
 metadata:
@@ -231,12 +235,15 @@ metadata:
   namespace: tenant-root
 spec: {}
 EOF
-)
+  ) && rc=0 || rc=$?
+  echo "kubectl apply exit=$rc, output=$output"
+  # kubectl MUST have failed: success would mean validation regressed.
+  [ "$rc" -ne 0 ]
   # Assert the tenant-specific message is present (distinguishes from
   # generic DNS-1035 errors and from network/auth failures).
   echo "$output" | grep -q "tenant names must"
-  # And assert kubectl did NOT report creation — if validation regressed,
-  # the server would accept the object and kubectl would print "... created".
+  # And assert kubectl did NOT report creation — if validation regressed
+  # into a "warn" variant, the server could still accept the object.
   ! echo "$output" | grep -qi "created"
 
   # Post-condition cleanup: even though we expect validation to reject the
diff --git a/pkg/apis/apps/validation/validation.go b/pkg/apis/apps/validation/validation.go
index 8f0f6681..d62f2f22 100644
--- a/pkg/apis/apps/validation/validation.go
+++ b/pkg/apis/apps/validation/validation.go
@@ -23,6 +23,13 @@ import (
 	"k8s.io/apimachinery/pkg/util/validation/field"
 )
 
+// TenantKind is the Application.Kind string that gates the tenant-specific
+// name rules below. It must stay in sync with the `kind` field of the tenant
+// ApplicationDefinition (packages/system/tenant-rd/cozyrds/tenant.yaml) which
+// is the upstream source the aggregated API reads at startup via
+// config.Application.Kind.
+const TenantKind = "Tenant"
+
 // tenantNameRegex enforces alphanumeric-only tenant names that begin with a
 // lowercase letter. This is stricter than DNS-1035 because the tenant Helm
 // chart's tenant.name helper (packages/apps/tenant/templates/_helpers.tpl)
@@ -54,7 +61,7 @@ func ValidateApplicationName(name, kindName string, fldPath *field.Path) field.E
 	// tenantNameRegex comment for the reason. Check before DNS-1035 so the
 	// error message is specific to the tenant contract, not the generic DNS
 	// label rules.
-	if kindName == "Tenant" && !tenantNameRegex.MatchString(name) {
+	if kindName == TenantKind && !tenantNameRegex.MatchString(name) {
 		allErrs = append(allErrs, field.Invalid(fldPath, name,
 			"tenant names must start with a lowercase letter and contain only lowercase letters and digits; dashes are not allowed"))
 		return allErrs
diff --git a/pkg/apis/apps/validation/validation_test.go b/pkg/apis/apps/validation/validation_test.go
index 51f36fd6..7930f8ae 100644
--- a/pkg/apis/apps/validation/validation_test.go
+++ b/pkg/apis/apps/validation/validation_test.go
@@ -151,6 +151,12 @@ func TestValidateApplicationName_TenantErrorMessage(t *testing.T) {
 // actually reach 64 characters end-to-end — this test only pins the package-
 // level fallthrough so a future refactor does not accidentally promote the
 // length error into tenant-specific wording.
+//
+// NOTE: this is an architectural decision, not a user-facing requirement.
+// If tenant length is ever promoted into a tenant-specific rule (e.g. to
+// include the Helm release prefix budget in this package's error message),
+// this test should be updated or deleted — it is not a backwards-compat
+// guarantee, just a checkpoint on the current layering.
 func TestValidateApplicationName_TenantLengthFallthrough(t *testing.T) {
 	name := strings.Repeat("a", 64) // valid tenant pattern, too long for DNS-1035
 
diff --git a/pkg/registry/apps/application/rest_validation_test.go b/pkg/registry/apps/application/rest_validation_test.go
index c0e5f9f5..a1f69cf1 100644
--- a/pkg/registry/apps/application/rest_validation_test.go
+++ b/pkg/registry/apps/application/rest_validation_test.go
@@ -17,10 +17,21 @@ limitations under the License.
 package application
 
 import (
+	"context"
 	"fmt"
 	"strings"
 	"testing"
 
+	helmv2 "github.com/fluxcd/helm-controller/api/v2"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apiserver/pkg/endpoints/request"
+	"k8s.io/apiserver/pkg/registry/rest"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
 	"github.com/cozystack/cozystack/pkg/config"
 )
 
@@ -64,6 +75,85 @@ func TestValidateNameFormat(t *testing.T) {
 	}
 }
 
+// TestUpdate_ForceAllowCreate_RejectsTenantDashName pins the wiring from the
+// Update → Create fall-through path. When a user runs `kubectl apply` and
+// the object does not yet exist, Kubernetes routes the request through
+// REST.Update with forceAllowCreate=true, which delegates to REST.Create
+// (rest.go:452). This test ensures tenant name validation fires on that
+// upsert path — otherwise a future refactor could silently regress the
+// fix for #2375 while unit tests of r.validateNameFormat alone keep passing.
+func TestUpdate_ForceAllowCreate_RejectsTenantDashName(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := helmv2.AddToScheme(scheme); err != nil {
+		t.Fatalf("register helmv2 scheme: %v", err)
+	}
+	// Register the dynamic Tenant kind so the Application type round-trips
+	// through the scheme the same way the real aggregated API server wires
+	// it at startup.
+	resourceCfg := &config.ResourceConfig{
+		Resources: []config.Resource{
+			{
+				Application: config.ApplicationConfig{Kind: "Tenant"},
+			},
+		},
+	}
+	if err := appsv1alpha1.RegisterDynamicTypes(scheme, resourceCfg); err != nil {
+		t.Fatalf("register dynamic Tenant type: %v", err)
+	}
+
+	fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
+
+	r := &REST{
+		c: fakeClient,
+		gvr: schema.GroupVersionResource{
+			Group:    appsv1alpha1.GroupName,
+			Version:  "v1alpha1",
+			Resource: "tenants",
+		},
+		gvk: schema.GroupVersionKind{
+			Group:   appsv1alpha1.GroupName,
+			Version: "v1alpha1",
+			Kind:    "Tenant",
+		},
+		kindName: "Tenant",
+		releaseConfig: config.ReleaseConfig{
+			Prefix: "tenant-",
+		},
+	}
+
+	newApp := &appsv1alpha1.Application{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "apps.cozystack.io/v1alpha1",
+			Kind:       "Tenant",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "foo-bar",
+			Namespace: "tenant-root",
+		},
+	}
+
+	ctx := request.WithNamespace(context.Background(), "tenant-root")
+
+	_, _, err := r.Update(
+		ctx,
+		"foo-bar",
+		rest.DefaultUpdatedObjectInfo(newApp),
+		nil,                      // createValidation
+		nil,                      // updateValidation
+		true,                     // forceAllowCreate → routes through Create on NotFound
+		&metav1.UpdateOptions{},
+	)
+	if err == nil {
+		t.Fatalf("expected Update to reject tenant name with dashes, got no error")
+	}
+	if !apierrors.IsInvalid(err) {
+		t.Errorf("expected Invalid status error, got %T: %v", err, err)
+	}
+	if !strings.Contains(err.Error(), "tenant names must") {
+		t.Errorf("expected tenant-specific error in %q", err.Error())
+	}
+}
+
 func TestValidateNameLength(t *testing.T) {
 	tests := []struct {
 		name      string

From d188aaf7ca0364388293b6518f203a3505604ae6 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sun, 12 Apr 2026 03:54:17 +0300
Subject: [PATCH 419/666] refactor(api): route tenant kind check through
 validation.TenantKind

The convertHelmReleaseToApplication fall-through that populates Status.Namespace for tenant resources still compared r.kindName against the bare string "Tenant". The validation package already exposes TenantKind for exactly this reason: if the kind string ever diverges from the ApplicationDefinition source of truth, the constant and the call site drift together rather than silently desynchronizing.

Add TestConvertHelmReleaseToApplication_TenantNamespaceKindGate to pin both sides of the gate: tenant kind populates Status.Namespace, non-tenant kind leaves it empty. Also rewrite the TestUpdate comment to describe the upsert invariant directly instead of referencing an issue number.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 pkg/registry/apps/application/rest.go         |  2 +-
 .../apps/application/rest_validation_test.go  | 70 ++++++++++++++++++-
 2 files changed, 68 insertions(+), 4 deletions(-)

diff --git a/pkg/registry/apps/application/rest.go b/pkg/registry/apps/application/rest.go
index ca75576b..470da560 100644
--- a/pkg/registry/apps/application/rest.go
+++ b/pkg/registry/apps/application/rest.go
@@ -1153,7 +1153,7 @@ func (r *REST) convertHelmReleaseToApplication(ctx context.Context, hr *helmv2.H
 	app.SetConditions(conditions)
 
 	// Add namespace field for Tenant applications
-	if r.kindName == "Tenant" {
+	if r.kindName == validation.TenantKind {
 		app.Status.Namespace = r.computeTenantNamespace(hr.Namespace, app.Name)
 		externalIPsCount, err := r.countTenantExternalIPs(ctx, app.Status.Namespace)
 		if err != nil {
diff --git a/pkg/registry/apps/application/rest_validation_test.go b/pkg/registry/apps/application/rest_validation_test.go
index a1f69cf1..d94c501c 100644
--- a/pkg/registry/apps/application/rest_validation_test.go
+++ b/pkg/registry/apps/application/rest_validation_test.go
@@ -23,6 +23,7 @@ import (
 	"testing"
 
 	helmv2 "github.com/fluxcd/helm-controller/api/v2"
+	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -32,6 +33,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
 	appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
+	"github.com/cozystack/cozystack/pkg/apis/apps/validation"
 	"github.com/cozystack/cozystack/pkg/config"
 )
 
@@ -79,9 +81,10 @@ func TestValidateNameFormat(t *testing.T) {
 // Update → Create fall-through path. When a user runs `kubectl apply` and
 // the object does not yet exist, Kubernetes routes the request through
 // REST.Update with forceAllowCreate=true, which delegates to REST.Create
-// (rest.go:452). This test ensures tenant name validation fires on that
-// upsert path — otherwise a future refactor could silently regress the
-// fix for #2375 while unit tests of r.validateNameFormat alone keep passing.
+// (rest.go:452). Without this test, a future refactor could quietly reroute
+// that delegation and bypass the tenant name check — unit tests of the
+// pure r.validateNameFormat method would still pass while upsert-style
+// kubectl apply regressed back to accepting tenant names with dashes.
 func TestUpdate_ForceAllowCreate_RejectsTenantDashName(t *testing.T) {
 	scheme := runtime.NewScheme()
 	if err := helmv2.AddToScheme(scheme); err != nil {
@@ -154,6 +157,67 @@ func TestUpdate_ForceAllowCreate_RejectsTenantDashName(t *testing.T) {
 	}
 }
 
+// TestConvertHelmReleaseToApplication_TenantNamespaceKindGate pins the
+// behavior that convertHelmReleaseToApplication fills Status.Namespace only
+// when the kind is Tenant. This path is gated on r.kindName matching a
+// specific literal — the test uses the validation.TenantKind constant so
+// that if the source of truth for the tenant kind string is ever renamed,
+// the gate and the constant drift together (or the test fails).
+func TestConvertHelmReleaseToApplication_TenantNamespaceKindGate(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := helmv2.AddToScheme(scheme); err != nil {
+		t.Fatalf("register helmv2 scheme: %v", err)
+	}
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatalf("register corev1 scheme: %v", err)
+	}
+
+	fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
+
+	hr := &helmv2.HelmRelease{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "tenant-foo",
+			Namespace: "tenant-root",
+		},
+	}
+
+	t.Run("tenant kind fills Status.Namespace", func(t *testing.T) {
+		r := &REST{
+			c:        fakeClient,
+			kindName: validation.TenantKind,
+			releaseConfig: config.ReleaseConfig{
+				Prefix: "tenant-",
+			},
+		}
+
+		app, err := r.convertHelmReleaseToApplication(context.Background(), hr)
+		if err != nil {
+			t.Fatalf("convertHelmReleaseToApplication: %v", err)
+		}
+		if app.Status.Namespace == "" {
+			t.Errorf("expected Status.Namespace to be populated for tenant kind, got empty")
+		}
+	})
+
+	t.Run("non-tenant kind leaves Status.Namespace empty", func(t *testing.T) {
+		r := &REST{
+			c:        fakeClient,
+			kindName: "MySQL",
+			releaseConfig: config.ReleaseConfig{
+				Prefix: "mysql-",
+			},
+		}
+
+		app, err := r.convertHelmReleaseToApplication(context.Background(), hr)
+		if err != nil {
+			t.Fatalf("convertHelmReleaseToApplication: %v", err)
+		}
+		if app.Status.Namespace != "" {
+			t.Errorf("expected Status.Namespace to be empty for non-tenant kind, got %q", app.Status.Namespace)
+		}
+	})
+}
+
 func TestValidateNameLength(t *testing.T) {
 	tests := []struct {
 		name      string

From 637dd739341ffeef7607b050ce7b53cd75cad54c Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sun, 12 Apr 2026 14:27:43 +0300
Subject: [PATCH 420/666] style(api): use validation.TenantKind in test tables

Replace bare "Tenant" string literals with the validation.TenantKind constant in all test table entries, struct fields, and TypeMeta. Prevents silent drift if the canonical kind string is ever renamed.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../apps/application/rest_validation_test.go  | 24 +++++++++----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/pkg/registry/apps/application/rest_validation_test.go b/pkg/registry/apps/application/rest_validation_test.go
index d94c501c..088990ce 100644
--- a/pkg/registry/apps/application/rest_validation_test.go
+++ b/pkg/registry/apps/application/rest_validation_test.go
@@ -51,14 +51,14 @@ func TestValidateNameFormat(t *testing.T) {
 
 		// Tenant kind enforces alphanumeric-only — see
 		// packages/apps/tenant/templates/_helpers.tpl for the reason.
-		{"tenant accepts alphanumeric", "Tenant", "foo", false},
-		{"tenant accepts digits", "Tenant", "foo123", false},
-		{"tenant rejects single hyphen", "Tenant", "foo-bar", true},
-		{"tenant rejects leading hyphen", "Tenant", "-foo", true},
-		{"tenant rejects trailing hyphen", "Tenant", "foo-", true},
-		{"tenant rejects uppercase", "Tenant", "Foo", true},
-		{"tenant rejects underscore", "Tenant", "foo_bar", true},
-		{"tenant rejects empty", "Tenant", "", true},
+		{"tenant accepts alphanumeric", validation.TenantKind, "foo", false},
+		{"tenant accepts digits", validation.TenantKind, "foo123", false},
+		{"tenant rejects single hyphen", validation.TenantKind, "foo-bar", true},
+		{"tenant rejects leading hyphen", validation.TenantKind, "-foo", true},
+		{"tenant rejects trailing hyphen", validation.TenantKind, "foo-", true},
+		{"tenant rejects uppercase", validation.TenantKind, "Foo", true},
+		{"tenant rejects underscore", validation.TenantKind, "foo_bar", true},
+		{"tenant rejects empty", validation.TenantKind, "", true},
 	}
 
 	for _, tt := range tests {
@@ -96,7 +96,7 @@ func TestUpdate_ForceAllowCreate_RejectsTenantDashName(t *testing.T) {
 	resourceCfg := &config.ResourceConfig{
 		Resources: []config.Resource{
 			{
-				Application: config.ApplicationConfig{Kind: "Tenant"},
+				Application: config.ApplicationConfig{Kind: validation.TenantKind},
 			},
 		},
 	}
@@ -116,9 +116,9 @@ func TestUpdate_ForceAllowCreate_RejectsTenantDashName(t *testing.T) {
 		gvk: schema.GroupVersionKind{
 			Group:   appsv1alpha1.GroupName,
 			Version: "v1alpha1",
-			Kind:    "Tenant",
+			Kind:    validation.TenantKind,
 		},
-		kindName: "Tenant",
+		kindName: validation.TenantKind,
 		releaseConfig: config.ReleaseConfig{
 			Prefix: "tenant-",
 		},
@@ -127,7 +127,7 @@ func TestUpdate_ForceAllowCreate_RejectsTenantDashName(t *testing.T) {
 	newApp := &appsv1alpha1.Application{
 		TypeMeta: metav1.TypeMeta{
 			APIVersion: "apps.cozystack.io/v1alpha1",
-			Kind:       "Tenant",
+			Kind:       validation.TenantKind,
 		},
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "foo-bar",

From 677e186286331548b4b20cec30e74878c89a3fd7 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 13 Apr 2026 02:03:03 +0300
Subject: [PATCH 421/666] [ci] Add Gemini Code Assist configuration

Configure the Gemini Code Assist GitHub reviewer with project-specific
ignore patterns and a natural-language style guide.

The config silences noise from vendored upstream Helm charts, generated
Go code, build artifacts, and Grafana dashboard JSONs, while keeping the
severity threshold at LOW for strict review of hand-written code.

The style guide teaches the reviewer about the vendoring model, commit
format requirements, sensitive components like packages/core/platform/,
and lists anti-patterns not to flag (patch files, go.sum, upstream forks).

Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .gemini/config.yaml   |  23 +++++++++
 .gemini/styleguide.md | 107 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 130 insertions(+)
 create mode 100644 .gemini/config.yaml
 create mode 100644 .gemini/styleguide.md

diff --git a/.gemini/config.yaml b/.gemini/config.yaml
new file mode 100644
index 00000000..3b5e413e
--- /dev/null
+++ b/.gemini/config.yaml
@@ -0,0 +1,23 @@
+have_fun: false
+
+ignore_patterns:
+  - "**/charts/**"
+  - "**/vendor/**"
+  - "**/zz_generated.*.go"
+  - "**/pkg/generated/**"
+  - "**/_out/**"
+  - "**/*.tgz"
+  - "**/dashboards/**/*.json"
+  - "**/*.patch"
+  - "**/*.diff"
+  - "**/images/*.json"
+
+code_review:
+  disable: false
+  comment_severity_threshold: LOW
+  max_review_comments: 50
+  pull_request_opened:
+    help: false
+    summary: true
+    code_review: true
+    include_drafts: false
diff --git a/.gemini/styleguide.md b/.gemini/styleguide.md
new file mode 100644
index 00000000..e519f018
--- /dev/null
+++ b/.gemini/styleguide.md
@@ -0,0 +1,107 @@
+# Cozystack Review Guidelines
+
+## Project Architecture
+
+Cozystack is a Kubernetes-based PaaS built on Helm umbrella charts and FluxCD.
+Packages live in `packages/{core,system,apps,extra}/`.
+Each package wraps one or more upstream Helm charts.
+Go code in `cmd/`, `internal/`, `pkg/` implements Kubernetes controllers and API server.
+CRDs are in `api/v1alpha1/` and `api/apps/v1alpha1/`.
+App Kinds (like `Postgres`, `Kafka`) are registered dynamically at runtime from `ApplicationDefinition` resources — they are not static CRDs.
+
+## Vendored Code — Critical Rules
+
+**Never suggest editing files inside any `charts/` directory under `packages/`.**
+Those are upstream Helm charts vendored via `make update` (which runs `helm pull`).
+Any direct edit is overwritten on the next update and provides zero value.
+
+If you find an issue that appears to live in vendored chart code:
+
+- For configuration-level changes: suggest overrides in the package root `values.yaml`.
+- For structural changes: suggest a patch file in `packages/<name>/patches/` applied by the Makefile.
+- For source-code changes in images: suggest a patch in `packages/<name>/images/<name>/patches/`.
+- For true upstream bugs: point to the upstream repository and suggest an upstream issue/PR.
+- Do NOT suggest creating `charts/patches/` — patches never live inside `charts/`.
+
+Similarly, never propose edits to:
+
+- `vendor/` — Go dependencies. Changes go through `go get` and `go mod tidy`.
+- `zz_generated.*.go` — regenerated by `make generate`.
+- `pkg/generated/` — auto-generated Kubernetes client code.
+- Image digest values in `values.yaml` — set by CI via `make image`, not by humans.
+- `go.mod` / `go.sum` by hand — use `go get` and `go mod tidy`.
+
+## Commit and PR Requirements
+
+Each commit must start with a component prefix: `[component] Brief description`.
+
+Valid prefixes:
+
+- System: `[dashboard]`, `[platform]`, `[cilium]`, `[kube-ovn]`, `[linstor]`, `[fluxcd]`, `[cluster-api]`
+- Apps: `[postgres]`, `[mariadb]`, `[redis]`, `[kafka]`, `[clickhouse]`, `[kubernetes]`, `[virtual-machine]`
+- Meta: `[tests]`, `[ci]`, `[docs]`, `[maintenance]`
+- Package-specific: any `[<package-name>]` matching a directory under `packages/`
+
+Each commit must have a `Signed-off-by:` trailer (produced by `git commit --signoff`).
+
+PR body must contain a release note block:
+
+```text
+ ```release-note
+ [component] Human-readable changelog entry
+ ```
+```
+
+Flag any PR whose commits lack the prefix or signoff, or whose body has no release-note block.
+
+## Helm Chart Conventions
+
+Packages follow an umbrella chart pattern:
+
+- `charts/` — vendored upstream, read-only
+- `templates/` — Cozystack-specific extra manifests
+- `values.yaml` — override values for the upstream chart
+- `values.schema.json` — JSON Schema for dashboard UI and input validation
+
+When reviewing `values.schema.json`:
+
+- `make generate` regenerates this file and strips `title`, `description`, and `x-*` custom annotations. Do not suggest adding fields that will be stripped on the next regeneration.
+- Focus on type correctness, `required` fields, `enum` values, and default values.
+- Flag breaking changes: removing a field, changing its type, or narrowing its enum.
+
+## Sensitive Components
+
+**`packages/core/platform/`**: the platform chart that deploys everything. Changes here can require migration scripts in `scripts/migrations/`. Flag any change to this package that lacks a corresponding migration script or an explicit note that backward compatibility is preserved.
+
+**`api/apps/v1alpha1/`**: app CRD Kinds are registered at runtime from `ApplicationDefinition` resources and the matching `values.schema.json`. Suggest changes to the relevant package schema rather than hand-editing generated types.
+
+**RBAC, ServiceAccounts, and SecurityContext**: flag overly broad RBAC (`*` on resources or verbs without justification), missing `securityContext`, containers running as root without an explicit reason, and `hostPath`/`hostNetwork` usage without clear rationale.
+
+## Go Code Standards
+
+- Use controller-runtime patterns for reconcilers.
+- Use structured logging via `logr` — flag `fmt.Print*` and `log.Print*` in controller code.
+- Handle errors explicitly. Discarding meaningful errors with `_` is a bug.
+- Propagate `context.Context` through call chains. Flag `context.Background()` created inside a reconciler or request handler.
+- Prefer `ctrl.Result{RequeueAfter: ...}` over empty requeue for predictable reconciliation loops.
+- Tests live beside the code (`*_test.go`). New behavior without tests is worth flagging.
+
+## What to Review Carefully
+
+- Logic errors, off-by-one bugs, nil dereferences.
+- Missing error handling, especially in reconcilers and API handlers.
+- Helm template correctness: missing `quote`, incorrect indentation, wrong scope in `with`/`range`.
+- Security: permissive RBAC, privileged containers, secrets in environment variables, hardcoded credentials.
+- Missing resource requests/limits on new workloads.
+- Breaking changes in `values.schema.json`: removed fields, tightened types, narrower enums.
+
+## Anti-patterns — Do Not Flag These
+
+- Large JSON files in `dashboards/` — imported from upstream Grafana sources, not hand-written.
+- `*.tgz` files — Helm chart archives, expected in the repo.
+- Files under any `charts/` directory — vendored upstream, left as-is intentionally.
+- Whitespace or formatting in `*.patch` / `*.diff` files — machine-applied, not authored.
+- Missing comments on generated code.
+- `go.sum` changes accompanying `go.mod` changes — expected and correct.
+- Fork relationships for vendored tooling images — intentional (e.g., `cozystack/kilo` fork is expected).
+- Absence of unit tests for vendored chart overrides — covered by E2E tests in `hack/e2e-apps/`.

From ae88fe3779bb8d990f29958cc7e87f6a72834de5 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 13 Apr 2026 11:42:42 +0500
Subject: [PATCH 422/666] [linstor-gui] Add package for LINBIT linstor-gui web
 UI

Ships LINBIT's LINSTOR web UI (GPL-3.0) as an opt-in system package under
packages/system/linstor-gui so operators can manage LINSTOR nodes, resources,
and volumes from a browser instead of the linstor CLI.

The UI is built from the upstream pkg.linbit.com tarball onto an
nginx-unprivileged base image. A chart-supplied nginx.conf proxies /v1 and
/metrics to the LINSTOR controller REST API over mTLS using the existing
linstor-client-tls secret created by the linstor package.

Only a ClusterIP Service is created; no Ingress is shipped, because LINSTOR's
controller API is a privileged cluster-wide storage surface and auth depends
on the deployment's OIDC setup. Operators opt in via bundles.enabledPackages
and wire up ingress + auth themselves (port-forward works out of the box).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .../core/platform/sources/linstor-gui.yaml    |  21 ++++
 .../platform/templates/bundles/system.yaml    |   1 +
 packages/system/linstor-gui/Chart.yaml        |   3 +
 packages/system/linstor-gui/Makefile          |  32 ++++++
 packages/system/linstor-gui/README.md         |  43 ++++++++
 .../linstor-gui/images/linstor-gui/Dockerfile |  19 ++++
 .../system/linstor-gui/templates/_helpers.tpl |  17 +++
 .../templates/configmap-nginx.yaml            |  82 ++++++++++++++
 .../linstor-gui/templates/deployment.yaml     | 101 ++++++++++++++++++
 .../system/linstor-gui/templates/service.yaml |  15 +++
 .../linstor-gui/templates/serviceaccount.yaml |   7 ++
 .../linstor-gui/tests/deployment_test.yaml    |  95 ++++++++++++++++
 packages/system/linstor-gui/values.yaml       |  17 +++
 13 files changed, 453 insertions(+)
 create mode 100644 packages/core/platform/sources/linstor-gui.yaml
 create mode 100644 packages/system/linstor-gui/Chart.yaml
 create mode 100644 packages/system/linstor-gui/Makefile
 create mode 100644 packages/system/linstor-gui/README.md
 create mode 100644 packages/system/linstor-gui/images/linstor-gui/Dockerfile
 create mode 100644 packages/system/linstor-gui/templates/_helpers.tpl
 create mode 100644 packages/system/linstor-gui/templates/configmap-nginx.yaml
 create mode 100644 packages/system/linstor-gui/templates/deployment.yaml
 create mode 100644 packages/system/linstor-gui/templates/service.yaml
 create mode 100644 packages/system/linstor-gui/templates/serviceaccount.yaml
 create mode 100644 packages/system/linstor-gui/tests/deployment_test.yaml
 create mode 100644 packages/system/linstor-gui/values.yaml

diff --git a/packages/core/platform/sources/linstor-gui.yaml b/packages/core/platform/sources/linstor-gui.yaml
new file mode 100644
index 00000000..005e1fb7
--- /dev/null
+++ b/packages/core/platform/sources/linstor-gui.yaml
@@ -0,0 +1,21 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.linstor-gui
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+    path: /
+  variants:
+  - name: default
+    dependsOn:
+    - cozystack.linstor
+    components:
+    - name: linstor-gui
+      path: system/linstor-gui
+      install:
+        namespace: cozy-linstor
+        releaseName: linstor-gui
diff --git a/packages/core/platform/templates/bundles/system.yaml b/packages/core/platform/templates/bundles/system.yaml
index 795b523f..754851af 100644
--- a/packages/core/platform/templates/bundles/system.yaml
+++ b/packages/core/platform/templates/bundles/system.yaml
@@ -149,6 +149,7 @@
 {{include "cozystack.platform.package.optional.default" (list "cozystack.external-dns-application" $) }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.external-secrets-operator" $) }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.velero" $) }}
+{{include "cozystack.platform.package.optional.default" (list "cozystack.linstor-gui" $) }}
 {{- if has "cozystack.bootbox" (default (list) .Values.bundles.enabledPackages) }}
 {{include "cozystack.platform.package.default" (list "cozystack.bootbox-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.bootbox" $) }}
diff --git a/packages/system/linstor-gui/Chart.yaml b/packages/system/linstor-gui/Chart.yaml
new file mode 100644
index 00000000..e361a819
--- /dev/null
+++ b/packages/system/linstor-gui/Chart.yaml
@@ -0,0 +1,3 @@
+apiVersion: v2
+name: cozy-linstor-gui
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
diff --git a/packages/system/linstor-gui/Makefile b/packages/system/linstor-gui/Makefile
new file mode 100644
index 00000000..2937ae0a
--- /dev/null
+++ b/packages/system/linstor-gui/Makefile
@@ -0,0 +1,32 @@
+export NAME=linstor-gui
+export NAMESPACE=cozy-linstor
+
+include ../../../hack/common-envs.mk
+include ../../../hack/package.mk
+
+LINSTOR_GUI_VERSION ?= 2.3.0
+
+image: image-linstor-gui
+
+image-linstor-gui:
+	docker buildx build images/linstor-gui \
+		--provenance false \
+		--builder=$(BUILDER) \
+		--platform=linux/amd64,linux/arm64 \
+		--build-arg LINSTOR_GUI_VERSION=$(LINSTOR_GUI_VERSION) \
+		--tag $(REGISTRY)/linstor-gui:$(call settag,$(LINSTOR_GUI_VERSION)) \
+		--tag $(REGISTRY)/linstor-gui:$(call settag,$(LINSTOR_GUI_VERSION)-$(TAG)) \
+		--cache-from type=registry,ref=$(REGISTRY)/linstor-gui:latest \
+		--cache-to type=inline \
+		--metadata-file images/linstor-gui.json \
+		--push=$(PUSH) \
+		--label "org.opencontainers.image.source=https://github.com/cozystack/cozystack" \
+		--load=$(LOAD)
+	REPOSITORY="$(REGISTRY)/linstor-gui" \
+		yq -i '.image.repository = strenv(REPOSITORY)' values.yaml
+	TAG="$(call settag,$(LINSTOR_GUI_VERSION))@$$(yq e '."containerimage.digest"' images/linstor-gui.json -o json -r)" \
+		yq -i '.image.tag = strenv(TAG)' values.yaml
+	rm -f images/linstor-gui.json
+
+test:
+	helm unittest .
diff --git a/packages/system/linstor-gui/README.md b/packages/system/linstor-gui/README.md
new file mode 100644
index 00000000..e4de2314
--- /dev/null
+++ b/packages/system/linstor-gui/README.md
@@ -0,0 +1,43 @@
+# linstor-gui
+
+Cozystack system package for [LINBIT/linstor-gui](https://github.com/LINBIT/linstor-gui)
+— a web UI for managing LINSTOR nodes, resources, volumes and snapshots.
+
+Installed alongside the `linstor` package in the `cozy-linstor` namespace. The UI
+proxies the LINSTOR controller REST API at `https://linstor-controller.cozy-linstor.svc:3371`
+using mTLS with the `linstor-client-tls` secret created by the `linstor` package.
+
+## Exposing the UI
+
+This package only creates a `ClusterIP` Service. It does **not** ship an ingress,
+because authentication depends on the deployment's Keycloak / OIDC setup and
+LINSTOR's controller API is a privileged cluster-wide storage management
+surface. Cluster admins should wire up ingress + auth explicitly, for example:
+
+```bash
+kubectl -n cozy-linstor port-forward svc/linstor-gui 3373:80
+```
+
+then open <http://localhost:3373>.
+
+## Parameters
+
+### Image
+
+| Name               | Description                                                | Value                                     |
+| ------------------ | ---------------------------------------------------------- | ----------------------------------------- |
+| `image.repository` | LINSTOR GUI container image repository                     | `ghcr.io/cozystack/cozystack/linstor-gui` |
+| `image.tag`        | LINSTOR GUI container image tag (digest recommended)       | `2.3.0`                                   |
+
+### Deployment
+
+| Name       | Description                     | Value |
+| ---------- | ------------------------------- | ----- |
+| `replicas` | Number of linstor-gui replicas  | `1`   |
+
+### LINSTOR controller connection
+
+| Name                    | Description                                                                                                                          | Value                                                    |
+| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------- |
+| `linstor.endpoint`      | In-cluster URL of the LINSTOR controller REST API (HTTPS, mTLS)                                                                      | `https://linstor-controller.cozy-linstor.svc:3371`       |
+| `linstor.clientSecret`  | Kubernetes Secret with `tls.crt`, `tls.key`, `ca.crt` used as the mTLS client certificate against the LINSTOR controller. Created by the `linstor` package. | `linstor-client-tls`                                     |
diff --git a/packages/system/linstor-gui/images/linstor-gui/Dockerfile b/packages/system/linstor-gui/images/linstor-gui/Dockerfile
new file mode 100644
index 00000000..aadc1162
--- /dev/null
+++ b/packages/system/linstor-gui/images/linstor-gui/Dockerfile
@@ -0,0 +1,19 @@
+# Upstream: https://github.com/LINBIT/linstor-gui (GPL-3.0)
+# Serves the pre-built LINSTOR GUI tarball published by LINBIT from a hardened
+# nginx-unprivileged image. nginx.conf is supplied by the chart via ConfigMap,
+# so the upstream docker-entrypoint.sh / nginx.conf.template is not used.
+FROM nginxinc/nginx-unprivileged:1.29-alpine
+
+ARG LINSTOR_GUI_VERSION
+USER root
+RUN apk add --no-cache curl tar && \
+    curl -fsSL "https://pkg.linbit.com/downloads/linstor/linstor-gui-${LINSTOR_GUI_VERSION}.tar.gz" -o /tmp/linstor-gui.tar.gz && \
+    mkdir -p /usr/share/nginx/html && \
+    tar -xzf /tmp/linstor-gui.tar.gz -C /usr/share/nginx/html --strip-components=2 "linstor-gui-${LINSTOR_GUI_VERSION}/dist" && \
+    rm -f /tmp/linstor-gui.tar.gz && \
+    apk del curl tar && \
+    chown -R 101:0 /usr/share/nginx/html
+
+USER 101
+EXPOSE 3373
+CMD ["nginx", "-g", "daemon off;"]
diff --git a/packages/system/linstor-gui/templates/_helpers.tpl b/packages/system/linstor-gui/templates/_helpers.tpl
new file mode 100644
index 00000000..6cad99ee
--- /dev/null
+++ b/packages/system/linstor-gui/templates/_helpers.tpl
@@ -0,0 +1,17 @@
+{{/*
+Common labels
+*/}}
+{{- define "linstor-gui.labels" -}}
+app.kubernetes.io/name: linstor-gui
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+app.kubernetes.io/part-of: cozystack
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "linstor-gui.selectorLabels" -}}
+app.kubernetes.io/name: linstor-gui
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
diff --git a/packages/system/linstor-gui/templates/configmap-nginx.yaml b/packages/system/linstor-gui/templates/configmap-nginx.yaml
new file mode 100644
index 00000000..0b2d97f9
--- /dev/null
+++ b/packages/system/linstor-gui/templates/configmap-nginx.yaml
@@ -0,0 +1,82 @@
+{{/*
+Parse the LINSTOR endpoint so nginx can set `proxy_ssl_name` correctly.
+The endpoint is expected to be an https:// URL like
+  https://linstor-controller.cozy-linstor.svc:3371
+*/}}
+{{- $endpoint := trimPrefix "https://" (trimPrefix "http://" .Values.linstor.endpoint) -}}
+{{- $endpointHost := (splitList ":" $endpoint) | first -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: linstor-gui-nginx
+  labels:
+    {{- include "linstor-gui.labels" . | nindent 4 }}
+data:
+  nginx.conf: |
+    worker_processes auto;
+    pid /tmp/nginx.pid;
+
+    events {
+      worker_connections 1024;
+    }
+
+    http {
+      include       /etc/nginx/mime.types;
+      default_type  application/octet-stream;
+      server_tokens off;
+
+      client_body_temp_path /tmp/client_body;
+      proxy_temp_path       /tmp/proxy;
+      fastcgi_temp_path     /tmp/fastcgi;
+      uwsgi_temp_path       /tmp/uwsgi;
+      scgi_temp_path        /tmp/scgi;
+
+      sendfile        on;
+      keepalive_timeout  65;
+
+      server {
+        listen 3373;
+        server_name _;
+
+        root /usr/share/nginx/html;
+        index index.html;
+
+        # Static UI assets
+        location / {
+          try_files $uri $uri/ /index.html;
+        }
+
+        # Proxy LINSTOR REST API over mTLS to the controller
+        location /v1 {
+          proxy_pass {{ .Values.linstor.endpoint }};
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_ssl_certificate     /etc/linstor/client/tls.crt;
+          proxy_ssl_certificate_key /etc/linstor/client/tls.key;
+          proxy_ssl_trusted_certificate /etc/linstor/client/ca.crt;
+          proxy_ssl_verify       on;
+          proxy_ssl_verify_depth 2;
+          proxy_ssl_server_name  on;
+          proxy_ssl_name         {{ $endpointHost }};
+        }
+
+        location /metrics {
+          proxy_pass {{ .Values.linstor.endpoint }};
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_ssl_certificate     /etc/linstor/client/tls.crt;
+          proxy_ssl_certificate_key /etc/linstor/client/tls.key;
+          proxy_ssl_trusted_certificate /etc/linstor/client/ca.crt;
+          proxy_ssl_verify       on;
+          proxy_ssl_verify_depth 2;
+          proxy_ssl_server_name  on;
+          proxy_ssl_name         {{ $endpointHost }};
+        }
+
+        location = /healthz {
+          access_log off;
+          return 200 'ok';
+          add_header Content-Type text/plain;
+        }
+      }
+    }
diff --git a/packages/system/linstor-gui/templates/deployment.yaml b/packages/system/linstor-gui/templates/deployment.yaml
new file mode 100644
index 00000000..b1407bdb
--- /dev/null
+++ b/packages/system/linstor-gui/templates/deployment.yaml
@@ -0,0 +1,101 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: linstor-gui
+  labels:
+    {{- include "linstor-gui.labels" . | nindent 4 }}
+  annotations:
+    reloader.stakater.com/auto: "true"
+spec:
+  replicas: {{ .Values.replicas }}
+  selector:
+    matchLabels:
+      {{- include "linstor-gui.selectorLabels" . | nindent 6 }}
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  template:
+    metadata:
+      annotations:
+        checksum/nginx-config: {{ include (print $.Template.BasePath "/configmap-nginx.yaml") . | sha256sum }}
+      labels:
+        {{- include "linstor-gui.labels" . | nindent 8 }}
+    spec:
+      serviceAccountName: linstor-gui
+      automountServiceAccountToken: false
+      priorityClassName: system-cluster-critical
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    {{- include "linstor-gui.selectorLabels" . | nindent 20 }}
+                topologyKey: kubernetes.io/hostname
+      containers:
+        - name: linstor-gui
+          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 3373
+              protocol: TCP
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 20
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 2
+            periodSeconds: 10
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 101
+            runAsGroup: 101
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: nginx-config
+              mountPath: /etc/nginx/nginx.conf
+              subPath: nginx.conf
+              readOnly: true
+            - name: linstor-client-tls
+              mountPath: /etc/linstor/client
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+            - name: nginx-cache
+              mountPath: /var/cache/nginx
+      volumes:
+        - name: nginx-config
+          configMap:
+            name: linstor-gui-nginx
+        - name: linstor-client-tls
+          secret:
+            secretName: {{ .Values.linstor.clientSecret }}
+            defaultMode: 0400
+        - name: tmp
+          emptyDir: {}
+        - name: nginx-cache
+          emptyDir: {}
diff --git a/packages/system/linstor-gui/templates/service.yaml b/packages/system/linstor-gui/templates/service.yaml
new file mode 100644
index 00000000..66ae2b2d
--- /dev/null
+++ b/packages/system/linstor-gui/templates/service.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: linstor-gui
+  labels:
+    {{- include "linstor-gui.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      protocol: TCP
+  selector:
+    {{- include "linstor-gui.selectorLabels" . | nindent 4 }}
diff --git a/packages/system/linstor-gui/templates/serviceaccount.yaml b/packages/system/linstor-gui/templates/serviceaccount.yaml
new file mode 100644
index 00000000..8e472671
--- /dev/null
+++ b/packages/system/linstor-gui/templates/serviceaccount.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: linstor-gui
+  labels:
+    {{- include "linstor-gui.labels" . | nindent 4 }}
+automountServiceAccountToken: false
diff --git a/packages/system/linstor-gui/tests/deployment_test.yaml b/packages/system/linstor-gui/tests/deployment_test.yaml
new file mode 100644
index 00000000..420ec3e1
--- /dev/null
+++ b/packages/system/linstor-gui/tests/deployment_test.yaml
@@ -0,0 +1,95 @@
+suite: linstor-gui deployment
+templates:
+  - templates/deployment.yaml
+  - templates/service.yaml
+  - templates/configmap-nginx.yaml
+
+tests:
+  - it: renders a ClusterIP service on port 80 -> http
+    template: templates/service.yaml
+    release:
+      name: linstor-gui
+      namespace: cozy-linstor
+    asserts:
+      - isKind:
+          of: Service
+      - equal:
+          path: spec.type
+          value: ClusterIP
+      - equal:
+          path: spec.ports[0].port
+          value: 80
+      - equal:
+          path: spec.ports[0].targetPort
+          value: http
+
+  - it: mounts the LINSTOR client TLS secret into the pod
+    template: templates/deployment.yaml
+    release:
+      name: linstor-gui
+      namespace: cozy-linstor
+    asserts:
+      - isKind:
+          of: Deployment
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: linstor-client-tls
+            secret:
+              secretName: linstor-client-tls
+              defaultMode: 0400
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            name: linstor-client-tls
+            mountPath: /etc/linstor/client
+            readOnly: true
+
+  - it: runs as a non-root user with a read-only root filesystem
+    template: templates/deployment.yaml
+    release:
+      name: linstor-gui
+      namespace: cozy-linstor
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.runAsNonRoot
+          value: true
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
+          value: true
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation
+          value: false
+
+  - it: proxies /v1 to the configured LINSTOR controller with mTLS
+    template: templates/configmap-nginx.yaml
+    release:
+      name: linstor-gui
+      namespace: cozy-linstor
+    asserts:
+      - isKind:
+          of: ConfigMap
+      - matchRegex:
+          path: data["nginx.conf"]
+          pattern: "location /v1"
+      - matchRegex:
+          path: data["nginx.conf"]
+          pattern: "proxy_pass https://linstor-controller.cozy-linstor.svc:3371"
+      - matchRegex:
+          path: data["nginx.conf"]
+          pattern: "proxy_ssl_certificate     /etc/linstor/client/tls.crt"
+
+  - it: overrides linstor endpoint and client secret
+    template: templates/configmap-nginx.yaml
+    release:
+      name: linstor-gui
+      namespace: cozy-linstor
+    set:
+      linstor.endpoint: https://my-controller.example.svc:3371
+    asserts:
+      - matchRegex:
+          path: data["nginx.conf"]
+          pattern: "proxy_pass https://my-controller.example.svc:3371"
+      - matchRegex:
+          path: data["nginx.conf"]
+          pattern: "proxy_ssl_name         my-controller.example.svc"
diff --git a/packages/system/linstor-gui/values.yaml b/packages/system/linstor-gui/values.yaml
new file mode 100644
index 00000000..e3c49aea
--- /dev/null
+++ b/packages/system/linstor-gui/values.yaml
@@ -0,0 +1,17 @@
+## @section Image
+## @param image.repository LINSTOR GUI container image repository
+## @param image.tag LINSTOR GUI container image tag (digest recommended)
+image:
+  repository: ghcr.io/cozystack/cozystack/linstor-gui
+  tag: 2.3.0
+
+## @section Deployment
+## @param replicas Number of linstor-gui replicas
+replicas: 1
+
+## @section LINSTOR controller connection
+## @param linstor.endpoint In-cluster URL of the LINSTOR controller REST API (HTTPS, mTLS)
+## @param linstor.clientSecret Kubernetes Secret with `tls.crt`, `tls.key`, `ca.crt` used as the mTLS client certificate against the LINSTOR controller. Created by the `linstor` package.
+linstor:
+  endpoint: "https://linstor-controller.cozy-linstor.svc:3371"
+  clientSecret: "linstor-client-tls"

From ba9f9e9f2ced7eb411e491ae51d2518d04b5a3ac Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 13 Apr 2026 11:59:46 +0500
Subject: [PATCH 423/666] [linstor-gui] Address review comments on #2382

- Dockerfile: chown html root to 101:101 (match runAsGroup, not 101:0)
- Makefile: declare .PHONY targets (image, image-linstor-gui, test)
- deployment: drop priorityClassName system-cluster-critical (GUI is
  not control-plane critical; chart does not need to reserve the slot)
- configmap-nginx:
  - fail the render if linstor.endpoint is not https:// so a misconfig
    cannot silently downgrade the mTLS-protected controller path
  - hoist proxy_set_header and proxy_ssl_* directives to the server
    block instead of duplicating across /v1 and /metrics locations

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/system/linstor-gui/Makefile          |  2 +
 .../linstor-gui/images/linstor-gui/Dockerfile |  2 +-
 .../templates/configmap-nginx.yaml            | 38 +++++++++----------
 .../linstor-gui/templates/deployment.yaml     |  1 -
 4 files changed, 20 insertions(+), 23 deletions(-)

diff --git a/packages/system/linstor-gui/Makefile b/packages/system/linstor-gui/Makefile
index 2937ae0a..e202f4cc 100644
--- a/packages/system/linstor-gui/Makefile
+++ b/packages/system/linstor-gui/Makefile
@@ -6,6 +6,8 @@ include ../../../hack/package.mk
 
 LINSTOR_GUI_VERSION ?= 2.3.0
 
+.PHONY: image image-linstor-gui test
+
 image: image-linstor-gui
 
 image-linstor-gui:
diff --git a/packages/system/linstor-gui/images/linstor-gui/Dockerfile b/packages/system/linstor-gui/images/linstor-gui/Dockerfile
index aadc1162..2082ef0d 100644
--- a/packages/system/linstor-gui/images/linstor-gui/Dockerfile
+++ b/packages/system/linstor-gui/images/linstor-gui/Dockerfile
@@ -12,7 +12,7 @@ RUN apk add --no-cache curl tar && \
     tar -xzf /tmp/linstor-gui.tar.gz -C /usr/share/nginx/html --strip-components=2 "linstor-gui-${LINSTOR_GUI_VERSION}/dist" && \
     rm -f /tmp/linstor-gui.tar.gz && \
     apk del curl tar && \
-    chown -R 101:0 /usr/share/nginx/html
+    chown -R 101:101 /usr/share/nginx/html
 
 USER 101
 EXPOSE 3373
diff --git a/packages/system/linstor-gui/templates/configmap-nginx.yaml b/packages/system/linstor-gui/templates/configmap-nginx.yaml
index 0b2d97f9..e7ba02bd 100644
--- a/packages/system/linstor-gui/templates/configmap-nginx.yaml
+++ b/packages/system/linstor-gui/templates/configmap-nginx.yaml
@@ -1,9 +1,12 @@
 {{/*
 Parse the LINSTOR endpoint so nginx can set `proxy_ssl_name` correctly.
-The endpoint is expected to be an https:// URL like
-  https://linstor-controller.cozy-linstor.svc:3371
+The endpoint must be an https:// URL — http:// would downgrade the
+mTLS-protected controller path.
 */}}
-{{- $endpoint := trimPrefix "https://" (trimPrefix "http://" .Values.linstor.endpoint) -}}
+{{- if not (hasPrefix "https://" .Values.linstor.endpoint) -}}
+{{- fail "linstor.endpoint must start with https:// to enforce mTLS to the LINSTOR controller" -}}
+{{- end -}}
+{{- $endpoint := trimPrefix "https://" .Values.linstor.endpoint -}}
 {{- $endpointHost := (splitList ":" $endpoint) | first -}}
 apiVersion: v1
 kind: ConfigMap
@@ -41,6 +44,17 @@ data:
         root /usr/share/nginx/html;
         index index.html;
 
+        # Shared proxy + mTLS settings for the LINSTOR controller upstream
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_ssl_certificate         /etc/linstor/client/tls.crt;
+        proxy_ssl_certificate_key     /etc/linstor/client/tls.key;
+        proxy_ssl_trusted_certificate /etc/linstor/client/ca.crt;
+        proxy_ssl_verify       on;
+        proxy_ssl_verify_depth 2;
+        proxy_ssl_server_name  on;
+        proxy_ssl_name         {{ $endpointHost }};
+
         # Static UI assets
         location / {
           try_files $uri $uri/ /index.html;
@@ -49,28 +63,10 @@ data:
         # Proxy LINSTOR REST API over mTLS to the controller
         location /v1 {
           proxy_pass {{ .Values.linstor.endpoint }};
-          proxy_set_header Host $host;
-          proxy_set_header X-Real-IP $remote_addr;
-          proxy_ssl_certificate     /etc/linstor/client/tls.crt;
-          proxy_ssl_certificate_key /etc/linstor/client/tls.key;
-          proxy_ssl_trusted_certificate /etc/linstor/client/ca.crt;
-          proxy_ssl_verify       on;
-          proxy_ssl_verify_depth 2;
-          proxy_ssl_server_name  on;
-          proxy_ssl_name         {{ $endpointHost }};
         }
 
         location /metrics {
           proxy_pass {{ .Values.linstor.endpoint }};
-          proxy_set_header Host $host;
-          proxy_set_header X-Real-IP $remote_addr;
-          proxy_ssl_certificate     /etc/linstor/client/tls.crt;
-          proxy_ssl_certificate_key /etc/linstor/client/tls.key;
-          proxy_ssl_trusted_certificate /etc/linstor/client/ca.crt;
-          proxy_ssl_verify       on;
-          proxy_ssl_verify_depth 2;
-          proxy_ssl_server_name  on;
-          proxy_ssl_name         {{ $endpointHost }};
         }
 
         location = /healthz {
diff --git a/packages/system/linstor-gui/templates/deployment.yaml b/packages/system/linstor-gui/templates/deployment.yaml
index b1407bdb..963f437a 100644
--- a/packages/system/linstor-gui/templates/deployment.yaml
+++ b/packages/system/linstor-gui/templates/deployment.yaml
@@ -25,7 +25,6 @@ spec:
     spec:
       serviceAccountName: linstor-gui
       automountServiceAccountToken: false
-      priorityClassName: system-cluster-critical
       securityContext:
         runAsNonRoot: true
         seccompProfile:

From 1144211a85571654b2e09a40d816db93253b54f6 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Mon, 13 Apr 2026 09:28:52 +0200
Subject: [PATCH 424/666] ci(pull-requests): replace GH_PAT with cozystack-ci
 GitHub App token

The GH_PAT secret tied to cozystack-bot is no longer valid after
migrating release workflows to the cozystack-ci GitHub App in #2351.
This broke the resolve_assets and e2e jobs for release PRs.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .github/workflows/pull-requests.yaml | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/pull-requests.yaml b/.github/workflows/pull-requests.yaml
index 76dbfc17..d9898616 100644
--- a/.github/workflows/pull-requests.yaml
+++ b/.github/workflows/pull-requests.yaml
@@ -99,6 +99,14 @@ jobs:
       disk_id:      ${{ steps.fetch_assets.outputs.disk_id }}
 
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
+          private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
+          owner: cozystack
+
       - name: Checkout code
         if: contains(github.event.pull_request.labels.*.name, 'release')
         uses: actions/checkout@v4
@@ -125,7 +133,7 @@ jobs:
         id: fetch_assets
         uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.GH_PAT }}
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             const tag = '${{ steps.get_tag.outputs.tag }}';
             const releases = await github.rest.repos.listReleases({
@@ -159,6 +167,15 @@ jobs:
     if: ${{ always() && (needs.build.result == 'success' || needs.resolve_assets.result == 'success') }}
 
     steps:
+      - name: Generate GitHub App token
+        if: contains(github.event.pull_request.labels.*.name, 'release')
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
+          private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
+          owner: cozystack
+
       # ▸ Checkout and prepare the codebase
       - name: Checkout code
         uses: actions/checkout@v4
@@ -188,11 +205,11 @@ jobs:
         if: contains(github.event.pull_request.labels.*.name, 'release')
         run: |
           mkdir -p _out/assets
-          curl -sSL -H "Authorization: token ${GH_PAT}" -H "Accept: application/octet-stream" \
+          curl -sSL -H "Authorization: token ${APP_TOKEN}" -H "Accept: application/octet-stream" \
             -o _out/assets/nocloud-amd64.raw.xz \
             "https://api.github.com/repos/${GITHUB_REPOSITORY}/releases/assets/${{ needs.resolve_assets.outputs.disk_id }}"
         env:
-          GH_PAT: ${{ secrets.GH_PAT }}
+          APP_TOKEN: ${{ steps.app-token.outputs.token }}
 
       - name: Set sandbox ID
         run: echo "SANDBOX_NAME=cozy-e2e-sandbox-$(echo "${GITHUB_REPOSITORY}:${GITHUB_WORKFLOW}:${GITHUB_REF}" | sha256sum | cut -c1-10)" >> $GITHUB_ENV

From 4b76a93dc1bfdfe7ec9fc2714c99e4cef84d303b Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 13 Apr 2026 12:41:58 +0500
Subject: [PATCH 425/666] [linstor-gui] Fix secret mount mode so nginx can read
 mTLS client certs

The linstor-client-tls secret was mounted with defaultMode 0400 and
owned by root, so the nginx process (UID 101) got EACCES on tls.crt
and crash-looped with:

  [emerg] cannot load certificate "/etc/linstor/client/tls.crt":
  BIO_new_file() failed ... Permission denied

Set defaultMode to 0444. The secret volume is pod-local and
readOnlyRootFilesystem is on, so making it world-readable inside the
pod is not a broader disclosure.

Verified on dev10: pod Ready, /healthz 200, /v1/nodes proxied through
mTLS to linstor-controller:3371 returns real node data.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/system/linstor-gui/templates/deployment.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/packages/system/linstor-gui/templates/deployment.yaml b/packages/system/linstor-gui/templates/deployment.yaml
index 963f437a..838e87bd 100644
--- a/packages/system/linstor-gui/templates/deployment.yaml
+++ b/packages/system/linstor-gui/templates/deployment.yaml
@@ -93,7 +93,9 @@ spec:
         - name: linstor-client-tls
           secret:
             secretName: {{ .Values.linstor.clientSecret }}
-            defaultMode: 0400
+            # 0444 so nginx (UID 101) can read the mTLS client keypair;
+            # the secret volume is pod-local, not a broader disclosure.
+            defaultMode: 0444
         - name: tmp
           emptyDir: {}
         - name: nginx-cache

From bbeaaf3dab4078c1c9a3c9635dd36176a74f344b Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 13 Apr 2026 12:49:48 +0500
Subject: [PATCH 426/666] [linstor-gui] Update test to match 0444 secret mount
 mode

Follow-up to 4b76a93d: the assertion still expected defaultMode 0400
and would fail in CI.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/system/linstor-gui/tests/deployment_test.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/system/linstor-gui/tests/deployment_test.yaml b/packages/system/linstor-gui/tests/deployment_test.yaml
index 420ec3e1..05013d2a 100644
--- a/packages/system/linstor-gui/tests/deployment_test.yaml
+++ b/packages/system/linstor-gui/tests/deployment_test.yaml
@@ -37,7 +37,7 @@ tests:
             name: linstor-client-tls
             secret:
               secretName: linstor-client-tls
-              defaultMode: 0400
+              defaultMode: 0444
       - contains:
           path: spec.template.spec.containers[0].volumeMounts
           content:

From b74a9610d4da03f32faab50ce73b333b421deb68 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 13 Apr 2026 13:27:35 +0300
Subject: [PATCH 427/666] [ci] Address CodeRabbit feedback on Gemini style
 guide

Fix two issues caught in PR review:

- Use quadruple-backtick fence around the release-note example so the
  inner triple-backtick block renders correctly and satisfies markdownlint.
- Correct the platform migration path. The previous text pointed at
  scripts/migrations/, which does not exist. The actual migration flow
  lives in packages/core/platform/templates/migration-hook.yaml and
  packages/core/platform/images/migrations/.

Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .gemini/styleguide.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.gemini/styleguide.md b/.gemini/styleguide.md
index e519f018..64f9adb3 100644
--- a/.gemini/styleguide.md
+++ b/.gemini/styleguide.md
@@ -46,11 +46,11 @@ Each commit must have a `Signed-off-by:` trailer (produced by `git commit --sign
 
 PR body must contain a release note block:
 
-```text
- ```release-note
- [component] Human-readable changelog entry
- ```
+````text
+```release-note
+[component] Human-readable changelog entry
 ```
+````
 
 Flag any PR whose commits lack the prefix or signoff, or whose body has no release-note block.
 
@@ -71,7 +71,7 @@ When reviewing `values.schema.json`:
 
 ## Sensitive Components
 
-**`packages/core/platform/`**: the platform chart that deploys everything. Changes here can require migration scripts in `scripts/migrations/`. Flag any change to this package that lacks a corresponding migration script or an explicit note that backward compatibility is preserved.
+**`packages/core/platform/`**: the platform chart that deploys everything. Changes here can require updates to the migration flow — the Helm hook in `packages/core/platform/templates/migration-hook.yaml` and the runner image with scripts in `packages/core/platform/images/migrations/`. Flag any change to this package that lacks a corresponding migration update or an explicit note that backward compatibility is preserved.
 
 **`api/apps/v1alpha1/`**: app CRD Kinds are registered at runtime from `ApplicationDefinition` resources and the matching `values.schema.json`. Suggest changes to the relevant package schema rather than hand-editing generated types.
 

From c8488815e0c59b26093c459d1da98db627470410 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 13 Apr 2026 13:32:15 +0300
Subject: [PATCH 428/666] [ci] Enable CodeRabbit incremental reviews

Add a minimal .coderabbit.yaml that ensures CodeRabbit re-reviews each
push to a PR (incremental review on new commits) and skips drafts.
Without this file, the org-level configuration left incremental reviews
disabled, so only the initial PR open triggered a review.

Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .coderabbit.yaml | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 .coderabbit.yaml

diff --git a/.coderabbit.yaml b/.coderabbit.yaml
new file mode 100644
index 00000000..46a4f0b9
--- /dev/null
+++ b/.coderabbit.yaml
@@ -0,0 +1,5 @@
+reviews:
+  auto_review:
+    enabled: true
+    auto_incremental_review: true
+    drafts: false

From fbbccdbb7b53f2d612801229143db0f6365da2e0 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Mon, 13 Apr 2026 14:25:25 +0200
Subject: [PATCH 429/666] fix(build): filter git describe to match only v* tags

The api/apps/v1alpha1/* subtags share the same commit as the release
tags. git describe --exact-match picks the first match alphabetically,
returning api/apps/v1alpha1/vX.Y.Z instead of vX.Y.Z, which produces
invalid Docker image tags.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 hack/common-envs.mk | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hack/common-envs.mk b/hack/common-envs.mk
index 56eb5478..9b8db5db 100644
--- a/hack/common-envs.mk
+++ b/hack/common-envs.mk
@@ -6,13 +6,13 @@ else
 endif
 
 REGISTRY ?= ghcr.io/cozystack/cozystack
-TAG = $(shell git describe --tags --exact-match 2>/dev/null || echo latest)
+TAG = $(shell git describe --tags --exact-match --match 'v*' 2>/dev/null || echo latest)
 PUSH := 1
 LOAD := 0
 BUILDER ?=
 PLATFORM ?= 
 BUILDX_EXTRA_ARGS ?=
-COZYSTACK_VERSION = $(patsubst v%,%,$(shell git describe --tags))
+COZYSTACK_VERSION = $(patsubst v%,%,$(shell git describe --tags --match 'v*'))
 
 BUILDX_ARGS := --provenance=false --push=$(PUSH) --load=$(LOAD) \
   --label org.opencontainers.image.source=https://github.com/cozystack/cozystack \
@@ -28,6 +28,6 @@ endef
 ifeq ($(COZYSTACK_VERSION),)
     $(shell git remote add upstream https://github.com/cozystack/cozystack.git || true)
     $(shell git fetch upstream --tags)
-    COZYSTACK_VERSION = $(patsubst v%,%,$(shell git describe --tags))
+    COZYSTACK_VERSION = $(patsubst v%,%,$(shell git describe --tags --match 'v*'))
 endif
 

From 37229aa0ac9f270c6b97b18d9a86fc552ceca3db Mon Sep 17 00:00:00 2001
From: Timofei Larkin <lllamnyp@gmail.com>
Date: Fri, 3 Apr 2026 14:09:57 +0300
Subject: [PATCH 430/666] feat(scheduler): storage-aware scheduling

Expose the existing linstor-scheduler-extender sidecar as a ClusterIP
Service and configure cozystack-scheduler to call it during the
scheduling cycle. Pods with both a SchedulingClass and LINSTOR PVCs
now get storage-locality-aware placement.

- Add extender Service (port 8099) for linstor-scheduler
- Patch vendored deployment to label pods for Service selector
- Bump cozystack-scheduler to v0.3.0 (configurable extenders)
- Add "linstor" PackageSource variant with extender values
- Default variant ships without extender for non-LINSTOR clusters
- Select linstor variant in system bundle
- Add helm-unittest tests for both packages

Ref: #2328

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
---
 .../platform/sources/cozystack-scheduler.yaml | 11 ++++++
 .../platform/templates/bundles/system.yaml    |  4 ++-
 .../system/cozystack-scheduler/Chart.yaml     |  2 +-
 packages/system/cozystack-scheduler/Makefile  |  3 ++
 .../charts/cozystack-scheduler/Chart.yaml     |  2 +-
 .../templates/configmap.yaml                  |  4 +++
 .../charts/cozystack-scheduler/values.yaml    | 16 ++++++++-
 .../tests/configmap_test.yaml                 | 26 ++++++++++++++
 .../cozystack-scheduler/values-linstor.yaml   | 10 ++++++
 packages/system/linstor-scheduler/Makefile    |  4 +++
 .../templates/deployment.yaml                 |  1 +
 .../add-scheduler-component-label.patch       |  9 +++++
 .../templates/extender-service.yaml           | 26 ++++++++++++++
 .../tests/extender-service_test.yaml          | 35 +++++++++++++++++++
 14 files changed, 149 insertions(+), 4 deletions(-)
 create mode 100644 packages/system/cozystack-scheduler/tests/configmap_test.yaml
 create mode 100644 packages/system/cozystack-scheduler/values-linstor.yaml
 create mode 100644 packages/system/linstor-scheduler/patches/add-scheduler-component-label.patch
 create mode 100644 packages/system/linstor-scheduler/templates/extender-service.yaml
 create mode 100644 packages/system/linstor-scheduler/tests/extender-service_test.yaml

diff --git a/packages/core/platform/sources/cozystack-scheduler.yaml b/packages/core/platform/sources/cozystack-scheduler.yaml
index af4c8338..52e85a4f 100644
--- a/packages/core/platform/sources/cozystack-scheduler.yaml
+++ b/packages/core/platform/sources/cozystack-scheduler.yaml
@@ -17,3 +17,14 @@ spec:
       install:
         namespace: kube-system
         releaseName: cozystack-scheduler
+  - name: linstor
+    dependsOn:
+    - cozystack.linstor-scheduler
+    components:
+    - name: cozystack-scheduler
+      path: system/cozystack-scheduler
+      valuesFiles:
+      - values-linstor.yaml
+      install:
+        namespace: kube-system
+        releaseName: cozystack-scheduler
diff --git a/packages/core/platform/templates/bundles/system.yaml b/packages/core/platform/templates/bundles/system.yaml
index 795b523f..bddcbf14 100644
--- a/packages/core/platform/templates/bundles/system.yaml
+++ b/packages/core/platform/templates/bundles/system.yaml
@@ -25,10 +25,12 @@
 {{include "cozystack.platform.package" (list "cozystack.networking" "kubeovn-cilium" $ $networkingComponents) }}
 {{include "cozystack.platform.system.common-packages" $ }}
 {{include "cozystack.platform.package.default" (list "cozystack.linstor" $) }}
+{{include "cozystack.platform.package" (list "cozystack.cozystack-scheduler" "linstor" $) }}
 {{- end }}
 
 {{- if eq .Values.bundles.system.variant "isp-hosted" }}
 {{include "cozystack.platform.package" (list "cozystack.networking" "noop" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.cozystack-scheduler" $) }}
 {{- end }}
 
 {{- if eq .Values.bundles.system.variant "isp-full-generic" }}
@@ -92,6 +94,7 @@
 {{- /* Pass talos.enabled: false to linstor for generic Linux */ -}}
 {{- $linstorComponents := dict "linstor" (dict "values" (dict "talos" (dict "enabled" false))) -}}
 {{include "cozystack.platform.package" (list "cozystack.linstor" "default" $ $linstorComponents) }}
+{{include "cozystack.platform.package" (list "cozystack.cozystack-scheduler" "linstor" $) }}
 {{- end }}
 
 # Cozystack Engine
@@ -130,7 +133,6 @@
 {{include "cozystack.platform.package.default" (list "cozystack.cozystack-basics" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.backupstrategy-controller" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.backup-controller" $) }}
-{{include "cozystack.platform.package.default" (list "cozystack.cozystack-scheduler" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.vertical-pod-autoscaler" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.metrics-server" $) }}
 {{- $monitoringAgentsComponents := dict "monitoring-agents" (dict "values" (dict "global" (dict "target" "tenant-root"))) -}}
diff --git a/packages/system/cozystack-scheduler/Chart.yaml b/packages/system/cozystack-scheduler/Chart.yaml
index c869abb4..f2dd13ee 100644
--- a/packages/system/cozystack-scheduler/Chart.yaml
+++ b/packages/system/cozystack-scheduler/Chart.yaml
@@ -1,3 +1,3 @@
 apiVersion: v2
 name: cozy-cozystack-scheduler
-version: 0.2.0
+version: 0.3.0
diff --git a/packages/system/cozystack-scheduler/Makefile b/packages/system/cozystack-scheduler/Makefile
index fd4bdf30..d075ec63 100644
--- a/packages/system/cozystack-scheduler/Makefile
+++ b/packages/system/cozystack-scheduler/Makefile
@@ -3,6 +3,9 @@ export NAMESPACE=kube-system
 
 include ../../../hack/package.mk
 
+test:
+	helm unittest .
+
 update:
 	rm -rf charts
 	tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/cozystack/cozystack-scheduler | awk -F'[/^]' 'END{print $$3}') && \
diff --git a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/Chart.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/Chart.yaml
index c869abb4..f2dd13ee 100644
--- a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/Chart.yaml
+++ b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/Chart.yaml
@@ -1,3 +1,3 @@
 apiVersion: v2
 name: cozy-cozystack-scheduler
-version: 0.2.0
+version: 0.3.0
diff --git a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/configmap.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/configmap.yaml
index 1d78b225..24e0bc6f 100644
--- a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/configmap.yaml
+++ b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/configmap.yaml
@@ -52,3 +52,7 @@ data:
               - name: CozystackInterPodAffinity
               - name: CozystackNodeAffinity
               - name: CozystackPodTopologySpread
+    {{- with .Values.extenders }}
+    extenders:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
diff --git a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/values.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/values.yaml
index 5ab78dbe..55b6faff 100644
--- a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/values.yaml
+++ b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/values.yaml
@@ -1,4 +1,4 @@
-image: ghcr.io/cozystack/cozystack/cozystack-scheduler:v0.2.0@sha256:89c285c5c5fe3ed8d7d597acf32fc9f045394e0f8efafd1878d6080cf112f6c2
+image: ghcr.io/cozystack/cozystack/cozystack-scheduler:v0.3.0@sha256:89c285c5c5fe3ed8d7d597acf32fc9f045394e0f8efafd1878d6080cf112f6c2
 replicas: 1
 # defaultLabelSelectorKeys overrides the pod label keys used to auto-populate
 # nil LabelSelectors in SchedulingClass affinity and topology spread terms.
@@ -7,3 +7,17 @@ replicas: 1
 #   - apps.cozystack.io/application.kind
 #   - apps.cozystack.io/application.name
 # defaultLabelSelectorKeys: []
+
+# extenders is a list of scheduler extenders to call during the scheduling cycle.
+# Each entry is passed directly into KubeSchedulerConfiguration.extenders[].
+# Example:
+#   extenders:
+#     - urlPrefix: http://linstor-scheduler-extender.cozy-linstor.svc:8099
+#       filterVerb: filter
+#       prioritizeVerb: prioritize
+#       weight: 5
+#       enableHTTPS: false
+#       httpTimeout: 10s
+#       nodeCacheCapable: false
+#       ignorable: true
+extenders: []
diff --git a/packages/system/cozystack-scheduler/tests/configmap_test.yaml b/packages/system/cozystack-scheduler/tests/configmap_test.yaml
new file mode 100644
index 00000000..ce8f372d
--- /dev/null
+++ b/packages/system/cozystack-scheduler/tests/configmap_test.yaml
@@ -0,0 +1,26 @@
+suite: scheduler configmap tests
+
+templates:
+  - charts/cozy-cozystack-scheduler/templates/configmap.yaml
+
+tests:
+  - it: renders extenders when configured
+    values:
+      - ../values-linstor.yaml
+    asserts:
+      - isKind:
+          of: ConfigMap
+      - matchRegex:
+          path: data["scheduler-config.yaml"]
+          pattern: "urlPrefix: http://linstor-scheduler-extender"
+      - matchRegex:
+          path: data["scheduler-config.yaml"]
+          pattern: "ignorable: true"
+
+  - it: omits extenders by default
+    asserts:
+      - isKind:
+          of: ConfigMap
+      - notMatchRegex:
+          path: data["scheduler-config.yaml"]
+          pattern: "extenders:"
diff --git a/packages/system/cozystack-scheduler/values-linstor.yaml b/packages/system/cozystack-scheduler/values-linstor.yaml
new file mode 100644
index 00000000..ab16ca57
--- /dev/null
+++ b/packages/system/cozystack-scheduler/values-linstor.yaml
@@ -0,0 +1,10 @@
+cozy-cozystack-scheduler:
+  extenders:
+    - urlPrefix: http://linstor-scheduler-extender.cozy-linstor.svc:8099
+      filterVerb: filter
+      prioritizeVerb: prioritize
+      weight: 5
+      enableHTTPS: false
+      httpTimeout: 10s
+      nodeCacheCapable: false
+      ignorable: true
diff --git a/packages/system/linstor-scheduler/Makefile b/packages/system/linstor-scheduler/Makefile
index f9986c9a..d83a2929 100644
--- a/packages/system/linstor-scheduler/Makefile
+++ b/packages/system/linstor-scheduler/Makefile
@@ -3,9 +3,13 @@ export NAMESPACE=cozy-linstor
 
 include ../../../hack/package.mk
 
+test:
+	helm unittest .
+
 update:
 	rm -rf charts
 	helm repo add piraeus-charts https://piraeus.io/helm-charts/
 	helm repo update piraeus-charts
 	helm pull piraeus-charts/linstor-scheduler --untar --untardir charts
 	patch --no-backup-if-mismatch -p4 < patches/disable-ca-key-rotation.patch
+	patch --no-backup-if-mismatch -p4 < patches/add-scheduler-component-label.patch
diff --git a/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/deployment.yaml b/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/deployment.yaml
index ea43cb83..289021fd 100644
--- a/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/deployment.yaml
+++ b/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/deployment.yaml
@@ -20,6 +20,7 @@ spec:
       {{- end }}
       labels:
         {{- include "linstor-scheduler.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: scheduler
     spec:
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
diff --git a/packages/system/linstor-scheduler/patches/add-scheduler-component-label.patch b/packages/system/linstor-scheduler/patches/add-scheduler-component-label.patch
new file mode 100644
index 00000000..01eed9a8
--- /dev/null
+++ b/packages/system/linstor-scheduler/patches/add-scheduler-component-label.patch
@@ -0,0 +1,9 @@
+diff --git a/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/deployment.yaml b/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/deployment.yaml
+--- a/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/deployment.yaml
++++ b/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/deployment.yaml
+@@ -21,4 +21,5 @@
+       labels:
+         {{- include "linstor-scheduler.selectorLabels" . | nindent 8 }}
++        app.kubernetes.io/component: scheduler
+     spec:
+       {{- with .Values.imagePullSecrets }}
diff --git a/packages/system/linstor-scheduler/templates/extender-service.yaml b/packages/system/linstor-scheduler/templates/extender-service.yaml
new file mode 100644
index 00000000..e8148b43
--- /dev/null
+++ b/packages/system/linstor-scheduler/templates/extender-service.yaml
@@ -0,0 +1,26 @@
+{{/*
+  Exposes the linstor-scheduler-extender sidecar (port 8099) as a
+  cluster-internal Service so that other schedulers (e.g. cozystack-scheduler)
+  can use it as a scheduler extender.
+
+  The selector labels match the subchart's deployment pods. They are
+  hardcoded here because the subchart helpers expect a subchart rendering
+  context that is unavailable in the wrapper chart.
+*/}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: linstor-scheduler-extender
+  labels:
+    app.kubernetes.io/component: extender
+spec:
+  type: ClusterIP
+  ports:
+    - port: 8099
+      targetPort: 8099
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: linstor-scheduler
+    app.kubernetes.io/instance: linstor-scheduler
+    app.kubernetes.io/component: scheduler
diff --git a/packages/system/linstor-scheduler/tests/extender-service_test.yaml b/packages/system/linstor-scheduler/tests/extender-service_test.yaml
new file mode 100644
index 00000000..60e272c2
--- /dev/null
+++ b/packages/system/linstor-scheduler/tests/extender-service_test.yaml
@@ -0,0 +1,35 @@
+suite: extender service targets deployment pods
+
+templates:
+  - templates/extender-service.yaml
+  - charts/linstor-scheduler/templates/deployment.yaml
+
+release:
+  name: linstor-scheduler
+
+tests:
+  - it: service selector matches deployment pod labels
+    template: charts/linstor-scheduler/templates/deployment.yaml
+    asserts:
+      - equal:
+          path: spec.template.metadata.labels["app.kubernetes.io/name"]
+          value: linstor-scheduler
+      - equal:
+          path: spec.template.metadata.labels["app.kubernetes.io/instance"]
+          value: linstor-scheduler
+      - equal:
+          path: spec.template.metadata.labels["app.kubernetes.io/component"]
+          value: scheduler
+
+  - it: service selector uses the same values
+    template: templates/extender-service.yaml
+    asserts:
+      - equal:
+          path: spec.selector["app.kubernetes.io/name"]
+          value: linstor-scheduler
+      - equal:
+          path: spec.selector["app.kubernetes.io/instance"]
+          value: linstor-scheduler
+      - equal:
+          path: spec.selector["app.kubernetes.io/component"]
+          value: scheduler

From 81a0d523d6f85a952f9e53c6a7de88039dc6863c Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 13 Apr 2026 17:18:34 +0300
Subject: [PATCH 431/666] [ci] Fix factual errors in Gemini style guide
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three corrections from PR review:

- Package group list was incomplete. Added library/ (reusable helper
  charts) and tests/ (tests for library charts, which are not directly
  testable otherwise).
- CRD generation was described incorrectly. Static CRDs are generated
  by hack/update-codegen.sh from types under api/v1alpha1/, api/backups/,
  and api/dashboard/. Types under api/apps/v1alpha1/ are not static
  CRDs — they are registered at runtime from ApplicationDefinition.
- Removed the tgz anti-pattern. No *.tgz files exist outside _out/,
  which is gitignored. The guidance was fabricated.

Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .gemini/styleguide.md | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/.gemini/styleguide.md b/.gemini/styleguide.md
index 64f9adb3..00201bfb 100644
--- a/.gemini/styleguide.md
+++ b/.gemini/styleguide.md
@@ -3,11 +3,11 @@
 ## Project Architecture
 
 Cozystack is a Kubernetes-based PaaS built on Helm umbrella charts and FluxCD.
-Packages live in `packages/{core,system,apps,extra}/`.
+Packages live in `packages/{core,system,apps,extra,library,tests}/`. The `library/` group holds reusable helper charts; the `tests/` group exists because library charts are not directly testable.
 Each package wraps one or more upstream Helm charts.
 Go code in `cmd/`, `internal/`, `pkg/` implements Kubernetes controllers and API server.
-CRDs are in `api/v1alpha1/` and `api/apps/v1alpha1/`.
-App Kinds (like `Postgres`, `Kafka`) are registered dynamically at runtime from `ApplicationDefinition` resources — they are not static CRDs.
+Static CRDs are generated by `hack/update-codegen.sh` from types under `api/v1alpha1/`, `api/backups/`, and `api/dashboard/`.
+App Kinds (like `Postgres`, `Kafka`) live in `api/apps/v1alpha1/` but are registered dynamically at runtime from `ApplicationDefinition` resources — they are not static CRDs.
 
 ## Vendored Code — Critical Rules
 
@@ -98,7 +98,6 @@ When reviewing `values.schema.json`:
 ## Anti-patterns — Do Not Flag These
 
 - Large JSON files in `dashboards/` — imported from upstream Grafana sources, not hand-written.
-- `*.tgz` files — Helm chart archives, expected in the repo.
 - Files under any `charts/` directory — vendored upstream, left as-is intentionally.
 - Whitespace or formatting in `*.patch` / `*.diff` files — machine-applied, not authored.
 - Missing comments on generated code.

From ce0e709be8aa1effb8fd792a65c66fbd8f53fc47 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Mon, 13 Apr 2026 16:21:14 +0200
Subject: [PATCH 432/666] ci: use cozystack org noreply email for bot commits

The cozystack-ci[bot] noreply email with brackets is rejected by DCO
probot as an invalid email address, causing release PRs to fail DCO
checks.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .github/workflows/auto-release.yaml          |  4 ++--
 .github/workflows/pull-requests-release.yaml |  2 +-
 .github/workflows/tags.yaml                  | 10 +++++-----
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/auto-release.yaml b/.github/workflows/auto-release.yaml
index d3b892d3..44ca8ca6 100644
--- a/.github/workflows/auto-release.yaml
+++ b/.github/workflows/auto-release.yaml
@@ -39,7 +39,7 @@ jobs:
           APP_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           git config user.name  "cozystack-ci[bot]"
-          git config user.email "3297617+cozystack-ci[bot]@users.noreply.github.com"
+          git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"
           git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}
           git config --unset-all http.https://github.com/.extraheader || true
 
@@ -54,7 +54,7 @@ jobs:
 
             // Configure git to use GitHub App token for authentication
             execSync('git config user.name "cozystack-ci[bot]"', { encoding: 'utf8' });
-            execSync('git config user.email "3297617+cozystack-ci[bot]@users.noreply.github.com"', { encoding: 'utf8' });
+            execSync('git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"', { encoding: 'utf8' });
             execSync(`git remote set-url origin https://x-access-token:${process.env.APP_TOKEN}@github.com/${process.env.GITHUB_REPOSITORY}`, { encoding: 'utf8' });
             // Remove GITHUB_TOKEN extraheader to ensure App token is used (needed to trigger other workflows)
             execSync('git config --unset-all http.https://github.com/.extraheader || true', { encoding: 'utf8' });
diff --git a/.github/workflows/pull-requests-release.yaml b/.github/workflows/pull-requests-release.yaml
index a1dc08d7..bb7f5da5 100644
--- a/.github/workflows/pull-requests-release.yaml
+++ b/.github/workflows/pull-requests-release.yaml
@@ -58,7 +58,7 @@ jobs:
           APP_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           git config user.name  "cozystack-ci[bot]"
-          git config user.email "3297617+cozystack-ci[bot]@users.noreply.github.com"
+          git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"
           git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}
           git tag -f ${{ steps.get_tag.outputs.tag }} ${{ github.sha }}
           git push -f origin ${{ steps.get_tag.outputs.tag }}
diff --git a/.github/workflows/tags.yaml b/.github/workflows/tags.yaml
index 2725d594..d698333e 100644
--- a/.github/workflows/tags.yaml
+++ b/.github/workflows/tags.yaml
@@ -126,7 +126,7 @@ jobs:
           APP_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           git config user.name  "cozystack-ci[bot]"
-          git config user.email "3297617+cozystack-ci[bot]@users.noreply.github.com"
+          git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"
           git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}
           git config --unset-all http.https://github.com/.extraheader || true
           git add .
@@ -141,7 +141,7 @@ jobs:
           VTAG="${{ steps.tag.outputs.tag }}"
           SUBTAG="api/apps/v1alpha1/${VTAG}"
           git config user.name  "cozystack-ci[bot]"
-          git config user.email "3297617+cozystack-ci[bot]@users.noreply.github.com"
+          git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"
           git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}
           TARGET="$(git rev-parse "${VTAG}^{}")"
           git tag -f "${SUBTAG}" "$TARGET"
@@ -194,7 +194,7 @@ jobs:
           APP_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           git config user.name  "cozystack-ci[bot]"
-          git config user.email "3297617+cozystack-ci[bot]@users.noreply.github.com"
+          git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"
           git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}
           BRANCH="release-${GITHUB_REF#refs/tags/v}"
           git branch -f "$BRANCH"
@@ -316,7 +316,7 @@ jobs:
           APP_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           git config user.name  "cozystack-ci[bot]"
-          git config user.email "3297617+cozystack-ci[bot]@users.noreply.github.com"
+          git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"
           git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}
           
           CHANGELOG_FILE="docs/changelogs/v${{ steps.tag.outputs.version }}.md"
@@ -450,7 +450,7 @@ jobs:
         id: commit
         run: |
           git config user.name  "cozystack-ci[bot]"
-          git config user.email "3297617+cozystack-ci[bot]@users.noreply.github.com"
+          git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"
           git add content
           if git diff --cached --quiet; then
             echo "No changes to commit"

From 727401c2c63b2e4f6cfafbe8aff4d0771001d52a Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 13 Apr 2026 20:42:14 +0500
Subject: [PATCH 433/666] [linstor-gui] Address coderabbit feedback on /healthz
 and reload annotation

- Fix /healthz Content-Type header: nginx silently drops `add_header`
  after `return` because the response is already finalized. Switch to
  `default_type text/plain;` placed BEFORE the `return 200` so the
  probe response is actually labeled as text/plain.
- Drop the redundant `checksum/nginx-config` pod-template annotation:
  the deployment already carries `reloader.stakater.com/auto: "true"`,
  so Stakater Reloader handles ConfigMap rollouts. Matches the sister
  `linstor` package convention.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/system/linstor-gui/templates/configmap-nginx.yaml | 5 ++++-
 packages/system/linstor-gui/templates/deployment.yaml      | 2 --
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/packages/system/linstor-gui/templates/configmap-nginx.yaml b/packages/system/linstor-gui/templates/configmap-nginx.yaml
index e7ba02bd..0ba8e4fe 100644
--- a/packages/system/linstor-gui/templates/configmap-nginx.yaml
+++ b/packages/system/linstor-gui/templates/configmap-nginx.yaml
@@ -71,8 +71,11 @@ data:
 
         location = /healthz {
           access_log off;
+          # default_type must come BEFORE `return` — `add_header` after a
+          # `return` is silently dropped by nginx because the response is
+          # already finalized.
+          default_type text/plain;
           return 200 'ok';
-          add_header Content-Type text/plain;
         }
       }
     }
diff --git a/packages/system/linstor-gui/templates/deployment.yaml b/packages/system/linstor-gui/templates/deployment.yaml
index 838e87bd..92e2f7a6 100644
--- a/packages/system/linstor-gui/templates/deployment.yaml
+++ b/packages/system/linstor-gui/templates/deployment.yaml
@@ -18,8 +18,6 @@ spec:
       maxSurge: 1
   template:
     metadata:
-      annotations:
-        checksum/nginx-config: {{ include (print $.Template.BasePath "/configmap-nginx.yaml") . | sha256sum }}
       labels:
         {{- include "linstor-gui.labels" . | nindent 8 }}
     spec:

From 6bf3c86aad5e26ce28386f0b013cd62c3a61fe80 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 13 Apr 2026 22:50:08 +0300
Subject: [PATCH 434/666] docs: adopt Conventional Commits across contributing
 docs

Refocus docs/agents/contributing.md on project-side conventions only
and drop personal agent-behavior guidance.

Switch commit format from [component] prefix to Conventional Commits
(type(scope): description) in contributing.md, overview.md, AGENTS.md,
.gemini/styleguide.md and the PR template.

Reference .github/PULL_REQUEST_TEMPLATE.md instead of duplicating the
PR body template in contributing.md.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .gemini/styleguide.md            |  20 +--
 .github/PULL_REQUEST_TEMPLATE.md |  14 +-
 AGENTS.md                        |   2 +-
 docs/agents/contributing.md      | 219 ++++---------------------------
 docs/agents/overview.md          |   3 +-
 5 files changed, 48 insertions(+), 210 deletions(-)

diff --git a/.gemini/styleguide.md b/.gemini/styleguide.md
index 00201bfb..7185a625 100644
--- a/.gemini/styleguide.md
+++ b/.gemini/styleguide.md
@@ -33,14 +33,18 @@ Similarly, never propose edits to:
 
 ## Commit and PR Requirements
 
-Each commit must start with a component prefix: `[component] Brief description`.
+Each commit must follow [Conventional Commits](https://www.conventionalcommits.org/) format: `type(scope): brief description`.
 
-Valid prefixes:
+Valid types: `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `build`, `ci`, `chore`.
 
-- System: `[dashboard]`, `[platform]`, `[cilium]`, `[kube-ovn]`, `[linstor]`, `[fluxcd]`, `[cluster-api]`
-- Apps: `[postgres]`, `[mariadb]`, `[redis]`, `[kafka]`, `[clickhouse]`, `[kubernetes]`, `[virtual-machine]`
-- Meta: `[tests]`, `[ci]`, `[docs]`, `[maintenance]`
-- Package-specific: any `[<package-name>]` matching a directory under `packages/`
+Valid scopes:
+
+- System: `dashboard`, `platform`, `cilium`, `kube-ovn`, `linstor`, `fluxcd`, `cluster-api`
+- Apps: `postgres`, `mariadb`, `redis`, `kafka`, `clickhouse`, `kubernetes`, `virtual-machine`
+- Meta: `api`, `hack`, `tests`, `ci`, `docs`
+- Package-specific: any `<package-name>` matching a directory under `packages/`
+
+Breaking changes: append `!` after type/scope (`feat(api)!: ...`) or add a `BREAKING CHANGE:` footer.
 
 Each commit must have a `Signed-off-by:` trailer (produced by `git commit --signoff`).
 
@@ -48,11 +52,11 @@ PR body must contain a release note block:
 
 ````text
 ```release-note
-[component] Human-readable changelog entry
+type(scope): human-readable changelog entry
 ```
 ````
 
-Flag any PR whose commits lack the prefix or signoff, or whose body has no release-note block.
+Flag any PR whose commits lack the Conventional Commits format or signoff, or whose body has no release-note block.
 
 ## Helm Chart Conventions
 
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 9a52457c..3588adc1 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -1,8 +1,10 @@
 <!-- Thank you for making a contribution! Here are some tips for you:
-- Start the PR title with the [label] of Cozystack component:
-  - For system components: [platform], [system], [linstor], [cilium], [kube-ovn], [dashboard], [cluster-api], etc.
-  - For managed apps: [apps], [tenant], [kubernetes], [postgres], [virtual-machine] etc.
-  - For development and maintenance: [tests], [ci], [docs], [maintenance].
+- Use Conventional Commits for the PR title: `type(scope): description`
+  - Types: feat, fix, docs, style, refactor, perf, test, build, ci, chore
+  - Scopes for system components: platform, system, linstor, cilium, kube-ovn, dashboard, cluster-api, etc.
+  - Scopes for managed apps: apps, tenant, kubernetes, postgres, virtual-machine, etc.
+  - Scopes for development and maintenance: tests, ci, docs, maintenance
+  - Breaking changes: append `!` after type/scope (`feat(api)!: ...`) or add a `BREAKING CHANGE:` footer
 - If it's a work in progress, consider creating this PR as a draft.
 - Don't hesistate to ask for opinion and review in the community chats, even if it's still a draft.
 - Add the label `backport` if it's a bugfix that needs to be backported to a previous version.
@@ -15,10 +17,10 @@
 
 <!--  Write a release note:
 - Explain what has changed internally and for users.
-- Start with the same [label] as in the PR title
+- Start with the same `type(scope):` prefix as in the PR title
 - Follow the guidelines at https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
 -->
 
 ```release-note
-[]
+
 ```
\ No newline at end of file
diff --git a/AGENTS.md b/AGENTS.md
index eb1febf7..fe9aa8e1 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -53,7 +53,7 @@ working with the **Cozystack** project.
 ### Conventions
 - **Helm Charts**: Umbrella pattern, vendored upstream charts in `charts/`
 - **Go Code**: Controller-runtime patterns, kubebuilder style
-- **Git Commits**: `[component] Description` format with `--signoff`
+- **Git Commits**: Conventional Commits (`type(scope): description`) with `--signoff`
 
 ### What NOT to Do
 - ❌ Edit `/vendor/`, `zz_generated.*.go`, upstream charts directly
diff --git a/docs/agents/contributing.md b/docs/agents/contributing.md
index d5a4366e..946ae838 100644
--- a/docs/agents/contributing.md
+++ b/docs/agents/contributing.md
@@ -1,167 +1,60 @@
-# Instructions for AI Agents
+# Contributing Conventions for AI Agents
 
-Guidelines for AI agents contributing to Cozystack.
+Project-side conventions for commits, branches, and pull requests in Cozystack.
 
 ## Checklist for Creating a Pull Request
 
-- [ ] Changes are made and tested
-- [ ] Commit message uses correct `[component]` prefix
+- [ ] Commit message follows Conventional Commits format
 - [ ] Commit is signed off with `--signoff`
 - [ ] Branch is rebased on `upstream/main` (no extra commits)
 - [ ] PR body includes description and release note
-- [ ] PR is pushed and created with `gh pr create`
 
-## How to Commit and Create Pull Requests
+## Commit Format
 
-### 1. Make Your Changes
-
-Edit the necessary files in the codebase.
-
-### 2. Commit with Proper Format
-
-Use the `[component]` prefix and `--signoff` flag:
+Follow [Conventional Commits](https://www.conventionalcommits.org/) with `--signoff`:
 
 ```bash
-git commit --signoff -m "[component] Brief description of changes"
+git commit --signoff -m "type(scope): brief description"
 ```
 
-**Component prefixes:**
-- System: `[dashboard]`, `[platform]`, `[cilium]`, `[kube-ovn]`, `[linstor]`, `[fluxcd]`, `[cluster-api]`
-- Apps: `[postgres]`, `[mariadb]`, `[redis]`, `[kafka]`, `[clickhouse]`, `[virtual-machine]`, `[kubernetes]`
-- Other: `[tests]`, `[ci]`, `[docs]`, `[maintenance]`
+**Types:** `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `build`, `ci`, `chore`
+
+**Scopes:**
+- System: `dashboard`, `platform`, `cilium`, `kube-ovn`, `linstor`, `fluxcd`, `cluster-api`
+- Apps: `postgres`, `mariadb`, `redis`, `kafka`, `clickhouse`, `virtual-machine`, `kubernetes`
+- Other: `api`, `hack`, `tests`, `ci`, `docs`
+
+Breaking changes: append `!` after type/scope (`feat(api)!: ...`) or add a `BREAKING CHANGE:` footer.
 
 **Examples:**
 ```bash
-git commit --signoff -m "[dashboard] Add config hash annotations to restart pods on config changes"
-git commit --signoff -m "[postgres] Update operator to version 1.2.3"
-git commit --signoff -m "[docs] Add installation guide"
+git commit --signoff -m "feat(dashboard): add config hash annotations to restart pods on config changes"
+git commit --signoff -m "fix(postgres): update operator to version 1.2.3"
+git commit --signoff -m "docs: add installation guide"
 ```
 
-### 3. Rebase on upstream/main (if needed)
+## Rebasing on upstream/main
 
-If your branch has extra commits, clean it up:
+If the branch has extra commits, clean it up:
 
 ```bash
-# Fetch latest
 git fetch upstream
-
-# Create clean branch from upstream/main
 git checkout -b my-feature upstream/main
-
-# Cherry-pick only your commit
 git cherry-pick <your-commit-hash>
-
-# Force push to your branch
 git push -f origin my-feature:my-branch-name
 ```
 
-### 4. Push Your Branch
+## Pull Request Body
 
-```bash
-git push origin <branch-name>
-```
+Fill in the template at [`.github/PULL_REQUEST_TEMPLATE.md`](../../.github/PULL_REQUEST_TEMPLATE.md). It includes the required `release-note` block.
 
-### 5. Create Pull Request
+Create the PR with `gh pr create --title "type(scope): brief description" --body-file <file>`.
 
-Write the PR body to a temporary file:
+## Fetching Unresolved Review Comments
 
-```bash
-cat > /tmp/pr_body.md << 'EOF'
-## What this PR does
+Cozystack uses GitHub review threads with resolution status. Only unresolved threads are actionable — resolved threads are already handled.
 
-Brief description of the changes.
-
-Changes:
-- Change 1
-- Change 2
-
-### Release note
-
-```release-note
-[component] Description for changelog
-```
-EOF
-```
-
-Create the PR:
-
-```bash
-gh pr create --title "[component] Brief description" --body-file /tmp/pr_body.md
-```
-
-Clean up:
-
-```bash
-rm /tmp/pr_body.md
-```
-
-## Addressing AI Bot Reviewer Comments
-
-When the user asks to fix comments from AI bot reviewers (like Qodo, Copilot, etc.):
-
-### 1. Get PR Comments
-
-View all comments on the pull request:
-
-```bash
-gh pr view <PR-number> --comments
-```
-
-Or for the current branch:
-
-```bash
-gh pr view --comments
-```
-
-### 2. Review Each Comment Carefully
-
-**Important**: Do NOT blindly apply all suggestions. Each comment should be evaluated:
-
-- **Consider context** - Does the suggestion make sense for this specific case?
-- **Check project conventions** - Does it align with Cozystack patterns?
-- **Evaluate impact** - Will this improve code quality or introduce issues?
-- **Question validity** - AI bots can be wrong or miss context
-
-**When to apply:**
-- ✅ Legitimate bugs or security issues
-- ✅ Clear improvements to code quality
-- ✅ Better error handling or edge cases
-- ✅ Conformance to project conventions
-
-**When to skip:**
-- ❌ Stylistic preferences that don't match project style
-- ❌ Over-engineering simple code
-- ❌ Changes that break existing patterns
-- ❌ Suggestions that show misunderstanding of the code
-
-### 3. Apply Valid Fixes
-
-Make changes addressing the valid comments. Use your judgment.
-
-### 4. Leave Changes Uncommitted
-
-**Critical**: Do NOT commit or push the changes automatically.
-
-Leave the changes in the working directory so the user can:
-- Review the fixes
-- Decide whether to commit them
-- Make additional adjustments if needed
-
-```bash
-# After making changes, show status but DON'T commit
-git status
-git diff
-```
-
-The user will commit and push when ready.
-
-## Code Review Comments
-
-When asked to fix code review comments, **always work only with unresolved (open) comments**. Resolved comments should be ignored as they have already been addressed.
-
-### Getting Unresolved Review Comments
-
-Use GitHub GraphQL API to fetch only unresolved review comments from a pull request:
+The REST endpoint `/pulls/{pr}/reviews` returns review summaries, not individual review comments. Use the GraphQL API to access `reviewThreads` with `isResolved` status:
 
 ```bash
 gh api graphql -F owner=cozystack -F repo=cozystack -F pr=<PR_NUMBER> -f query='
@@ -189,27 +82,7 @@ query($owner: String!, $repo: String!, $pr: Int!) {
 }' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | .comments.nodes[]'
 ```
 
-### Filtering for Unresolved Comments
-
-The key filter is `select(.isResolved == false)` which ensures only unresolved review threads are processed. Each thread can contain multiple comments, but if the thread is resolved, all its comments should be ignored.
-
-### Working with Review Comments
-
-1. **Fetch unresolved comments** using the GraphQL query above
-2. **Parse the results** to identify:
-   - File path (`path`)
-   - Line number (`line` or `originalLine`)
-   - Comment text (`bodyText`)
-   - Author (`author.login`)
-3. **Address each unresolved comment** by:
-   - Locating the relevant code section
-   - Making the requested changes
-   - Ensuring the fix addresses the concern raised
-4. **Do NOT process resolved comments** - they have already been handled
-
-### Example: Compact List of Unresolved Comments
-
-For a quick overview of unresolved comments:
+Compact one-line variant:
 
 ```bash
 gh api graphql -F owner=cozystack -F repo=cozystack -F pr=<PR_NUMBER> -f query='
@@ -233,43 +106,3 @@ query($owner: String!, $repo: String!, $pr: Int!) {
   }
 }' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | .comments.nodes[] | "\(.path):\(.line // "N/A") - \(.author.login): \(.bodyText[:150])"'
 ```
-
-### Important Notes
-
-- **REST API limitation**: The REST endpoint `/pulls/{pr}/reviews` returns review summaries, not individual review comments. Use GraphQL API for accessing `reviewThreads` with `isResolved` status.
-- **Thread-based resolution**: Comments are organized in threads. If a thread is resolved (`isResolved: true`), ignore all comments in that thread.
-- **Always filter**: Never process comments from resolved threads, even if they appear in the results.
-
-### Example Workflow
-
-```bash
-# Get PR comments
-gh pr view 1234 --comments
-
-# Review comments and identify valid ones
-# Make necessary changes to address valid comments
-# ... edit files ...
-
-# Show what was changed (but don't commit)
-git status
-git diff
-
-# Tell the user what was fixed and what was skipped
-```
-
-## Git Permissions
-
-Request these permissions when needed:
-- `git_write` - For commit, rebase, cherry-pick, branch operations
-- `network` - For push, fetch, pull operations
-
-## Common Issues
-
-**PR has extra commits?**  
-→ Rebase on `upstream/main` and cherry-pick only your commits
-
-**Wrong commit message?**  
-→ `git commit --amend --signoff -m "[correct] message"` then `git push -f`
-
-**Need to update PR?**  
-→ `gh pr edit <number> --body "new description"`
diff --git a/docs/agents/overview.md b/docs/agents/overview.md
index b6d69e68..35798961 100644
--- a/docs/agents/overview.md
+++ b/docs/agents/overview.md
@@ -78,11 +78,10 @@ packages/<category>/<package-name>/
 - Add proper error handling and structured logging
 
 ### Git Commits
-- Use format: `[component] Description`
+- Follow [Conventional Commits](https://www.conventionalcommits.org/) format: `type(scope): description`
 - Always use `--signoff` flag
 - Reference PR numbers when available
 - Keep commits atomic and focused
-- Follow conventional commit format for changelogs
 
 ### Documentation
 

From 525cc9eab2139b2076c50631f3e2117a51034862 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 13 Apr 2026 22:50:50 +0300
Subject: [PATCH 435/666] docs(agents): document Assisted-By trailer for
 AI-authored commits

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 docs/agents/contributing.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/docs/agents/contributing.md b/docs/agents/contributing.md
index 946ae838..17da488c 100644
--- a/docs/agents/contributing.md
+++ b/docs/agents/contributing.md
@@ -33,6 +33,18 @@ git commit --signoff -m "fix(postgres): update operator to version 1.2.3"
 git commit --signoff -m "docs: add installation guide"
 ```
 
+### AI Agent Attribution
+
+When an AI agent authors or materially assists with a commit, add an `Assisted-By:` trailer naming the model:
+
+```
+Assisted-By: Claude <noreply@anthropic.com>
+Assisted-By: GPT-5 <noreply@openai.com>
+Assisted-By: Gemini <noreply@google.com>
+```
+
+This sits alongside the `Signed-off-by:` trailer produced by `--signoff`. Use one trailer per model if multiple contributed.
+
 ## Rebasing on upstream/main
 
 If the branch has extra commits, clean it up:

From 90a9d6e905ad95d8a8edba7f4b95ed3ef3316371 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 13 Apr 2026 23:09:27 +0300
Subject: [PATCH 436/666] docs(contributing): sync scope lists and fix lint
 nits

Address review feedback:
- Sync scope lists between PR template and contributing guide
- Add 'maintenance' to Other scopes in contributing guide
- Add scope to the docs example for format consistency
- Simplify rebase push example to drop unnecessary refspec mapping
- Add 'text' language tag to trailer code fence (MD040)

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .github/PULL_REQUEST_TEMPLATE.md | 6 +++---
 docs/agents/contributing.md      | 8 ++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 3588adc1..7710149c 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -1,9 +1,9 @@
 <!-- Thank you for making a contribution! Here are some tips for you:
 - Use Conventional Commits for the PR title: `type(scope): description`
   - Types: feat, fix, docs, style, refactor, perf, test, build, ci, chore
-  - Scopes for system components: platform, system, linstor, cilium, kube-ovn, dashboard, cluster-api, etc.
-  - Scopes for managed apps: apps, tenant, kubernetes, postgres, virtual-machine, etc.
-  - Scopes for development and maintenance: tests, ci, docs, maintenance
+  - Scopes for system components: dashboard, platform, cilium, kube-ovn, linstor, fluxcd, cluster-api
+  - Scopes for managed apps: postgres, mariadb, redis, kafka, clickhouse, virtual-machine, kubernetes
+  - Scopes for development and maintenance: api, hack, tests, ci, docs, maintenance
   - Breaking changes: append `!` after type/scope (`feat(api)!: ...`) or add a `BREAKING CHANGE:` footer
 - If it's a work in progress, consider creating this PR as a draft.
 - Don't hesistate to ask for opinion and review in the community chats, even if it's still a draft.
diff --git a/docs/agents/contributing.md b/docs/agents/contributing.md
index 17da488c..68a584ee 100644
--- a/docs/agents/contributing.md
+++ b/docs/agents/contributing.md
@@ -22,7 +22,7 @@ git commit --signoff -m "type(scope): brief description"
 **Scopes:**
 - System: `dashboard`, `platform`, `cilium`, `kube-ovn`, `linstor`, `fluxcd`, `cluster-api`
 - Apps: `postgres`, `mariadb`, `redis`, `kafka`, `clickhouse`, `virtual-machine`, `kubernetes`
-- Other: `api`, `hack`, `tests`, `ci`, `docs`
+- Other: `api`, `hack`, `tests`, `ci`, `docs`, `maintenance`
 
 Breaking changes: append `!` after type/scope (`feat(api)!: ...`) or add a `BREAKING CHANGE:` footer.
 
@@ -30,14 +30,14 @@ Breaking changes: append `!` after type/scope (`feat(api)!: ...`) or add a `BREA
 ```bash
 git commit --signoff -m "feat(dashboard): add config hash annotations to restart pods on config changes"
 git commit --signoff -m "fix(postgres): update operator to version 1.2.3"
-git commit --signoff -m "docs: add installation guide"
+git commit --signoff -m "docs(contributing): add installation guide"
 ```
 
 ### AI Agent Attribution
 
 When an AI agent authors or materially assists with a commit, add an `Assisted-By:` trailer naming the model:
 
-```
+```text
 Assisted-By: Claude <noreply@anthropic.com>
 Assisted-By: GPT-5 <noreply@openai.com>
 Assisted-By: Gemini <noreply@google.com>
@@ -53,7 +53,7 @@ If the branch has extra commits, clean it up:
 git fetch upstream
 git checkout -b my-feature upstream/main
 git cherry-pick <your-commit-hash>
-git push -f origin my-feature:my-branch-name
+git push -f origin my-feature
 ```
 
 ## Pull Request Body

From 43222e8be0032eabcfd3411da7970a4c1c1c5247 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Tue, 14 Apr 2026 12:32:41 +0500
Subject: [PATCH 437/666] [linstor-gui] Fix test regex for
 proxy_ssl_certificate spacing

The matchRegex assertion used 5 literal spaces but the template
renders 9 (aligned with proxy_ssl_trusted_certificate). Use \s+
so the test is resilient to alignment changes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/system/linstor-gui/tests/deployment_test.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/system/linstor-gui/tests/deployment_test.yaml b/packages/system/linstor-gui/tests/deployment_test.yaml
index 05013d2a..50711eb3 100644
--- a/packages/system/linstor-gui/tests/deployment_test.yaml
+++ b/packages/system/linstor-gui/tests/deployment_test.yaml
@@ -77,7 +77,7 @@ tests:
           pattern: "proxy_pass https://linstor-controller.cozy-linstor.svc:3371"
       - matchRegex:
           path: data["nginx.conf"]
-          pattern: "proxy_ssl_certificate     /etc/linstor/client/tls.crt"
+          pattern: "proxy_ssl_certificate\\s+/etc/linstor/client/tls.crt"
 
   - it: overrides linstor endpoint and client secret
     template: templates/configmap-nginx.yaml

From bdb0e3a72c4381b107646202f5e956b49a5cdbec Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 13 Apr 2026 12:51:59 +0500
Subject: [PATCH 438/666] [linstor-gui] Add Keycloak-protected Ingress for the
 UI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up to the initial linstor-gui package (#2382). Publishes the UI on
https://linstor-gui.<root-host> behind the cluster Keycloak realm using
the same oauth2-proxy gatekeeper pattern that dashboard uses, so the
LINSTOR REST API is never exposed unauthenticated through Ingress.

Rendered only when both gates are satisfied:
  * _cluster.oidc-enabled == "true"
  * "linstor-gui" is listed in _cluster.expose-services
    (i.e. in publishing.exposedServices in the core cozystack values).

If OIDC is disabled cluster-wide we intentionally do not ship an
unauthenticated token-proxy fallback — unlike dashboard, there is no
reason to front a raw storage-management API with k8s bearer tokens.
Operators can still reach the UI via `kubectl port-forward` to the
ClusterIP service.

New resources:
  * templates/gatekeeper.yaml       — oauth2-proxy Deployment (OIDC mode)
  * templates/gatekeeper-svc.yaml   — ClusterIP :8000 in front of it
  * templates/gatekeeper-sa.yaml    — dedicated SA, no autotoken
  * templates/keycloakclient.yaml   — persistent client + cookie
                                      Secrets, KeycloakClient CRD with
                                      redirectUris for /oauth2/callback
  * templates/ingress.yaml          — Ingress to the gatekeeper Service,
                                      cert-manager ClusterIssuer, gated
                                      on expose-services + oidc-enabled
  * tests/ingress_auth_test.yaml    — unit tests for each conditional
                                      branch and the client CRD

README.md updated with both Option 1 (Keycloak-protected Ingress) and
the existing Option 2 (port-forward).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/system/linstor-gui/README.md         |  26 ++-
 .../linstor-gui/templates/gatekeeper-sa.yaml  |  12 ++
 .../linstor-gui/templates/gatekeeper-svc.yaml |  21 +++
 .../linstor-gui/templates/gatekeeper.yaml     | 142 +++++++++++++++
 .../system/linstor-gui/templates/ingress.yaml |  47 +++++
 .../linstor-gui/templates/keycloakclient.yaml |  74 ++++++++
 .../linstor-gui/tests/ingress_auth_test.yaml  | 171 ++++++++++++++++++
 7 files changed, 489 insertions(+), 4 deletions(-)
 create mode 100644 packages/system/linstor-gui/templates/gatekeeper-sa.yaml
 create mode 100644 packages/system/linstor-gui/templates/gatekeeper-svc.yaml
 create mode 100644 packages/system/linstor-gui/templates/gatekeeper.yaml
 create mode 100644 packages/system/linstor-gui/templates/ingress.yaml
 create mode 100644 packages/system/linstor-gui/templates/keycloakclient.yaml
 create mode 100644 packages/system/linstor-gui/tests/ingress_auth_test.yaml

diff --git a/packages/system/linstor-gui/README.md b/packages/system/linstor-gui/README.md
index e4de2314..2c9ac5d5 100644
--- a/packages/system/linstor-gui/README.md
+++ b/packages/system/linstor-gui/README.md
@@ -9,10 +9,28 @@ using mTLS with the `linstor-client-tls` secret created by the `linstor` package
 
 ## Exposing the UI
 
-This package only creates a `ClusterIP` Service. It does **not** ship an ingress,
-because authentication depends on the deployment's Keycloak / OIDC setup and
-LINSTOR's controller API is a privileged cluster-wide storage management
-surface. Cluster admins should wire up ingress + auth explicitly, for example:
+### Option 1 — Keycloak-protected Ingress (recommended)
+
+The chart ships an `oauth2-proxy` based gatekeeper plus a `KeycloakClient` CRD
+so the UI can be published on `linstor-gui.<root-host>` behind the cluster
+Keycloak realm. Access is granted to any user who can authenticate against the
+`cozy` realm.
+
+To turn it on, add `linstor-gui` to `publishing.exposedServices` in the core
+`cozystack` values (same list that controls `dashboard`). OIDC must be
+enabled (`authentication.oidc.enabled: true`) — if it is not, the Ingress and
+gatekeeper Deployment are deliberately **not** rendered, because the LINSTOR
+REST API surface must not be exposed unauthenticated.
+
+Once enabled, the UI is reachable at `https://linstor-gui.<root-host>` and
+authentication is delegated to Keycloak via the `linstor-gui` client
+(auto-provisioned through the `KeycloakClient` CRD; the client secret is
+persisted in the `linstor-gui-client` Secret in `cozy-linstor`).
+
+### Option 2 — Port-forward
+
+If you have not set up Keycloak or want ad-hoc access, use the `ClusterIP`
+Service:
 
 ```bash
 kubectl -n cozy-linstor port-forward svc/linstor-gui 3373:80
diff --git a/packages/system/linstor-gui/templates/gatekeeper-sa.yaml b/packages/system/linstor-gui/templates/gatekeeper-sa.yaml
new file mode 100644
index 00000000..44dadf07
--- /dev/null
+++ b/packages/system/linstor-gui/templates/gatekeeper-sa.yaml
@@ -0,0 +1,12 @@
+{{- $oidcEnabled := index .Values._cluster "oidc-enabled" }}
+{{- if eq $oidcEnabled "true" }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: linstor-gui-gatekeeper
+  labels:
+    app.kubernetes.io/instance: linstor-gui
+    app.kubernetes.io/name: gatekeeper
+    {{- include "linstor-gui.labels" . | nindent 4 }}
+automountServiceAccountToken: false
+{{- end }}
diff --git a/packages/system/linstor-gui/templates/gatekeeper-svc.yaml b/packages/system/linstor-gui/templates/gatekeeper-svc.yaml
new file mode 100644
index 00000000..bdd98585
--- /dev/null
+++ b/packages/system/linstor-gui/templates/gatekeeper-svc.yaml
@@ -0,0 +1,21 @@
+{{- $oidcEnabled := index .Values._cluster "oidc-enabled" }}
+{{- if eq $oidcEnabled "true" }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: linstor-gui-gatekeeper
+  labels:
+    app.kubernetes.io/instance: linstor-gui
+    app.kubernetes.io/name: gatekeeper
+    {{- include "linstor-gui.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    - name: ingress
+      port: 8000
+      protocol: TCP
+      targetPort: 8000
+  selector:
+    app.kubernetes.io/instance: linstor-gui
+    app.kubernetes.io/name: gatekeeper
+{{- end }}
diff --git a/packages/system/linstor-gui/templates/gatekeeper.yaml b/packages/system/linstor-gui/templates/gatekeeper.yaml
new file mode 100644
index 00000000..60ae0584
--- /dev/null
+++ b/packages/system/linstor-gui/templates/gatekeeper.yaml
@@ -0,0 +1,142 @@
+{{- $host := index .Values._cluster "root-host" }}
+{{- $oidcEnabled := index .Values._cluster "oidc-enabled" }}
+{{- $oidcInsecureSkipVerify := index .Values._cluster "oidc-insecure-skip-verify" }}
+{{- $keycloakInternalUrl := index .Values._cluster "keycloak-internal-url" | default "" }}
+
+{{- /*
+Gatekeeper (oauth2-proxy) fronts the linstor-gui Service and handles the
+OIDC flow against the cluster Keycloak realm. The Ingress below points at
+this Service — not at linstor-gui directly — so every external request
+authenticates before hitting nginx/mTLS→controller.
+
+Only rendered when oidc-enabled=true. If the cluster has OIDC disabled we
+deliberately do not ship an unauthenticated token-proxy fallback (unlike
+dashboard): linstor-gui surfaces raw storage state and should not be
+reachable via Ingress without Keycloak login.
+*/ -}}
+{{- if eq $oidcEnabled "true" }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: linstor-gui-gatekeeper
+  labels:
+    app.kubernetes.io/instance: linstor-gui
+    app.kubernetes.io/name: gatekeeper
+    {{- include "linstor-gui.labels" . | nindent 4 }}
+  annotations:
+    reloader.stakater.com/auto: "true"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: linstor-gui
+      app.kubernetes.io/name: gatekeeper
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: linstor-gui
+        app.kubernetes.io/name: gatekeeper
+        {{- include "linstor-gui.selectorLabels" . | nindent 8 }}
+    spec:
+      serviceAccountName: linstor-gui-gatekeeper
+      automountServiceAccountToken: false
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app.kubernetes.io/instance: linstor-gui
+                    app.kubernetes.io/name: gatekeeper
+                topologyKey: kubernetes.io/hostname
+      containers:
+        - name: auth-proxy
+          image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
+          imagePullPolicy: IfNotPresent
+          args:
+            - --provider=oidc
+            - --upstream=http://linstor-gui.{{ .Release.Namespace }}.svc:80
+            - --http-address=0.0.0.0:8000
+            - --redirect-url=https://linstor-gui.{{ $host }}/oauth2/callback
+            - --oidc-issuer-url=https://keycloak.{{ $host }}/realms/cozy
+            {{- if $keycloakInternalUrl }}
+            - --skip-oidc-discovery
+            - --login-url=https://keycloak.{{ $host }}/realms/cozy/protocol/openid-connect/auth
+            - --redeem-url={{ $keycloakInternalUrl }}/protocol/openid-connect/token
+            - --oidc-jwks-url={{ $keycloakInternalUrl }}/protocol/openid-connect/certs
+            - --validate-url={{ $keycloakInternalUrl }}/protocol/openid-connect/userinfo
+            - --backend-logout-url={{ $keycloakInternalUrl }}/protocol/openid-connect/logout?id_token_hint={id_token}
+            {{- else }}
+            - --backend-logout-url=https://keycloak.{{ $host }}/realms/cozy/protocol/openid-connect/logout?id_token_hint={id_token}
+            {{- end }}
+            - --whitelist-domain=keycloak.{{ $host }}
+            - --email-domain=*
+            - --pass-access-token=true
+            - --pass-authorization-header=true
+            - --cookie-refresh=3m
+            - --cookie-name=kc-access
+            - --cookie-secure=true
+            - --cookie-secret=$(OAUTH2_PROXY_COOKIE_SECRET)
+            - --skip-provider-button
+            - --scope=openid email profile offline_access
+            {{- if eq $oidcInsecureSkipVerify "true" }}
+            - --ssl-insecure-skip-verify=true
+            {{- end }}
+          env:
+            - name: OAUTH2_PROXY_CLIENT_ID
+              value: linstor-gui
+            - name: OAUTH2_PROXY_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: linstor-gui-client
+                  key: client-secret-key
+            - name: OAUTH2_PROXY_COOKIE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: linstor-gui-auth-config
+                  key: cookieSecret
+          ports:
+            - name: proxy
+              containerPort: 8000
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: proxy
+            initialDelaySeconds: 10
+            periodSeconds: 15
+            timeoutSeconds: 2
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: proxy
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 2
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 256Mi
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1001
+            runAsGroup: 1001
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+{{- end }}
diff --git a/packages/system/linstor-gui/templates/ingress.yaml b/packages/system/linstor-gui/templates/ingress.yaml
new file mode 100644
index 00000000..86fd9175
--- /dev/null
+++ b/packages/system/linstor-gui/templates/ingress.yaml
@@ -0,0 +1,47 @@
+{{- $solver := (index .Values._cluster "solver") | default "http01" }}
+{{- $clusterIssuer := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }}
+{{- $host := index .Values._cluster "root-host" }}
+{{- $oidcEnabled := index .Values._cluster "oidc-enabled" }}
+{{- $exposeServices := splitList "," ((index .Values._cluster "expose-services") | default "") }}
+{{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
+
+{{- /*
+Only publish an Ingress when the operator has opted this service in AND
+OIDC is enabled cluster-wide. If OIDC is off we deliberately do not
+expose linstor-gui: without Keycloak there is no authentication layer in
+front of the LINSTOR REST API proxy. Users can still reach the UI via
+`kubectl port-forward` to the ClusterIP service.
+*/ -}}
+{{- if and (has "linstor-gui" $exposeServices) (eq $oidcEnabled "true") }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: linstor-gui-ingress
+  labels:
+    {{- include "linstor-gui.labels" . | nindent 4 }}
+  annotations:
+    cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
+    {{- if eq $solver "http01" }}
+    acme.cert-manager.io/http01-ingress-class: {{ $exposeIngress }}
+    {{- end }}
+    nginx.ingress.kubernetes.io/proxy-body-size: 100m
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+spec:
+  ingressClassName: {{ $exposeIngress }}
+  rules:
+    - host: linstor-gui.{{ $host }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: linstor-gui-gatekeeper
+                port:
+                  number: 8000
+  tls:
+    - hosts:
+        - linstor-gui.{{ $host }}
+      secretName: linstor-gui-ingress-tls
+{{- end }}
diff --git a/packages/system/linstor-gui/templates/keycloakclient.yaml b/packages/system/linstor-gui/templates/keycloakclient.yaml
new file mode 100644
index 00000000..8e00be3c
--- /dev/null
+++ b/packages/system/linstor-gui/templates/keycloakclient.yaml
@@ -0,0 +1,74 @@
+{{- $host := index .Values._cluster "root-host" }}
+
+{{- /*
+Persist client + cookie secrets across upgrades: if the Secrets already
+exist, reuse their values; otherwise generate new random ones. The
+KeycloakClient CRD references the same client secret so Keycloak stays
+in sync with what oauth2-proxy reads.
+*/ -}}
+{{- $existingClientSecret := lookup "v1" "Secret" .Release.Namespace "linstor-gui-client" }}
+{{- $clientSecret := "" }}
+{{- if $existingClientSecret }}
+  {{- $clientSecret = index $existingClientSecret.data "client-secret-key" | b64dec }}
+{{- else }}
+  {{- $clientSecret = randAlphaNum 32 }}
+{{- end }}
+
+{{- $existingAuthConfig := lookup "v1" "Secret" .Release.Namespace "linstor-gui-auth-config" }}
+{{- $cookieSecret := "" }}
+{{- if $existingAuthConfig }}
+  {{- $cookieSecret = index $existingAuthConfig.data "cookieSecret" | b64dec }}
+{{- else }}
+  {{- $cookieSecret = randAlphaNum 16 }}
+{{- end }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: linstor-gui-client
+  labels:
+    {{- include "linstor-gui.labels" . | nindent 4 }}
+type: Opaque
+data:
+  client-secret-key: {{ $clientSecret | b64enc }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: linstor-gui-auth-config
+  labels:
+    {{- include "linstor-gui.labels" . | nindent 4 }}
+type: Opaque
+data:
+  cookieSecret: {{ $cookieSecret | b64enc }}
+{{- if .Capabilities.APIVersions.Has "v1.edp.epam.com/v1" }}
+---
+apiVersion: v1.edp.epam.com/v1
+kind: KeycloakClient
+metadata:
+  name: linstor-gui-client
+  annotations:
+    # Re-reconcile the Keycloak client if the random secret regenerates.
+    secret-hash: {{ $clientSecret | sha256sum }}
+spec:
+  realmRef:
+    name: keycloakrealm-cozy
+    kind: ClusterKeycloakRealm
+  secret: $linstor-gui-client:client-secret-key
+  advancedProtocolMappers: true
+  name: linstor-gui
+  clientId: linstor-gui
+  directAccess: true
+  public: false
+  webUrl: "https://linstor-gui.{{ $host }}"
+  defaultClientScopes:
+    - groups
+  optionalClientScopes:
+    - offline_access
+  attributes:
+    post.logout.redirect.uris: "+"
+    client.session.idle.timeout: "86400"
+    client.session.max.lifespan: "604800"
+  redirectUris:
+    - "https://linstor-gui.{{ $host }}/oauth2/callback/*"
+{{- end }}
diff --git a/packages/system/linstor-gui/tests/ingress_auth_test.yaml b/packages/system/linstor-gui/tests/ingress_auth_test.yaml
new file mode 100644
index 00000000..fe735f50
--- /dev/null
+++ b/packages/system/linstor-gui/tests/ingress_auth_test.yaml
@@ -0,0 +1,171 @@
+suite: linstor-gui ingress + keycloak auth
+templates:
+  - templates/ingress.yaml
+  - templates/gatekeeper.yaml
+  - templates/gatekeeper-svc.yaml
+  - templates/gatekeeper-sa.yaml
+  - templates/keycloakclient.yaml
+
+release:
+  name: linstor-gui
+  namespace: cozy-linstor
+
+tests:
+  - it: does not render an Ingress when OIDC is disabled cluster-wide
+    template: templates/ingress.yaml
+    set:
+      _cluster:
+        root-host: example.org
+        oidc-enabled: "false"
+        expose-services: "linstor-gui"
+        expose-ingress: "tenant-root"
+        issuer-name: "letsencrypt-prod"
+        solver: "http01"
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: does not render an Ingress when linstor-gui is not in expose-services
+    template: templates/ingress.yaml
+    set:
+      _cluster:
+        root-host: example.org
+        oidc-enabled: "true"
+        expose-services: "dashboard,api"
+        expose-ingress: "tenant-root"
+        issuer-name: "letsencrypt-prod"
+        solver: "http01"
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: renders an Ingress to the gatekeeper service when exposed and OIDC enabled
+    template: templates/ingress.yaml
+    set:
+      _cluster:
+        root-host: dev10.example.org
+        oidc-enabled: "true"
+        expose-services: "dashboard,linstor-gui"
+        expose-ingress: "tenant-root"
+        issuer-name: "letsencrypt-prod"
+        solver: "http01"
+    asserts:
+      - isKind:
+          of: Ingress
+      - equal:
+          path: spec.ingressClassName
+          value: tenant-root
+      - equal:
+          path: spec.rules[0].host
+          value: linstor-gui.dev10.example.org
+      - equal:
+          path: spec.rules[0].http.paths[0].backend.service.name
+          value: linstor-gui-gatekeeper
+      - equal:
+          path: spec.rules[0].http.paths[0].backend.service.port.number
+          value: 8000
+      - equal:
+          path: metadata.annotations["cert-manager.io/cluster-issuer"]
+          value: letsencrypt-prod
+
+  - it: does not render the gatekeeper Deployment when OIDC is disabled
+    template: templates/gatekeeper.yaml
+    set:
+      _cluster:
+        root-host: example.org
+        oidc-enabled: "false"
+        expose-services: "linstor-gui"
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: renders an oauth2-proxy Deployment pointing at the cluster Keycloak realm
+    template: templates/gatekeeper.yaml
+    set:
+      _cluster:
+        root-host: dev10.example.org
+        oidc-enabled: "true"
+        oidc-insecure-skip-verify: "false"
+        keycloak-internal-url: ""
+        expose-services: "linstor-gui"
+    asserts:
+      - isKind:
+          of: Deployment
+      - equal:
+          path: metadata.name
+          value: linstor-gui-gatekeeper
+      - matchRegex:
+          path: spec.template.spec.containers[0].image
+          pattern: "^quay\\.io/oauth2-proxy/oauth2-proxy:"
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --provider=oidc
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --upstream=http://linstor-gui.cozy-linstor.svc:80
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --redirect-url=https://linstor-gui.dev10.example.org/oauth2/callback
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --oidc-issuer-url=https://keycloak.dev10.example.org/realms/cozy
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OAUTH2_PROXY_CLIENT_ID
+            value: linstor-gui
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
+          value: true
+
+  - it: creates client + cookie Secrets and a KeycloakClient CRD
+    template: templates/keycloakclient.yaml
+    capabilities:
+      apiVersions:
+        - v1.edp.epam.com/v1
+    set:
+      _cluster:
+        root-host: dev10.example.org
+    asserts:
+      - hasDocuments:
+          count: 3
+      - documentIndex: 0
+        isKind:
+          of: Secret
+      - documentIndex: 0
+        equal:
+          path: metadata.name
+          value: linstor-gui-client
+      - documentIndex: 1
+        isKind:
+          of: Secret
+      - documentIndex: 1
+        equal:
+          path: metadata.name
+          value: linstor-gui-auth-config
+      - documentIndex: 2
+        isKind:
+          of: KeycloakClient
+      - documentIndex: 2
+        equal:
+          path: spec.clientId
+          value: linstor-gui
+      - documentIndex: 2
+        contains:
+          path: spec.redirectUris
+          content: "https://linstor-gui.dev10.example.org/oauth2/callback/*"
+
+  - it: skips the KeycloakClient CRD when the API is absent, still creates Secrets
+    template: templates/keycloakclient.yaml
+    set:
+      _cluster:
+        root-host: example.org
+    asserts:
+      - hasDocuments:
+          count: 2
+      - documentIndex: 0
+        isKind:
+          of: Secret
+      - documentIndex: 1
+        isKind:
+          of: Secret

From dc4513a8af220ac355c00340d283a5b9f01a8f95 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 13 Apr 2026 19:23:01 +0500
Subject: [PATCH 439/666] [linstor-gui] Fix gatekeeper label conflicts and drop
 realm-capped session attrs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two issues surfaced while deploying to dev10:

1. The shared linstor-gui.labels / linstor-gui.selectorLabels helpers
   set app.kubernetes.io/name=linstor-gui, which overrode the
   app.kubernetes.io/name=gatekeeper that the gatekeeper templates set
   first. The resulting Deployment had selector.matchLabels=gatekeeper
   but template.metadata.labels=linstor-gui, failing admission with
   "selector does not match template labels". Drop the helper include
   from the three gatekeeper templates and inline the remaining common
   labels (managed-by, part-of) so the gatekeeper keeps its own
   name label.

2. Copying client.session.idle.timeout=86400 and
   client.session.max.lifespan=604800 from the dashboard KeycloakClient
   caused the keycloak-operator to reject the client ("Client session
   idle timeout cannot exceed realm SSO session idle timeout"). Our
   dev10 realm has smaller defaults, and dashboard's own client is
   also stuck in this failed state. Drop the overrides and let the
   realm defaults apply — the UI has no reason to demand longer
   sessions than the realm is willing to grant.

Verified on dev10:
  * gatekeeper Deployment rolls out cleanly
  * KeycloakClient reconciles to status=OK
  * https://linstor-gui.<root-host>/ returns HTTP 302 to
    keycloak.<root-host>/realms/cozy/protocol/openid-connect/auth
    with client_id=linstor-gui and the correct callback URI

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/system/linstor-gui/templates/gatekeeper-sa.yaml  | 3 ++-
 packages/system/linstor-gui/templates/gatekeeper-svc.yaml | 3 ++-
 packages/system/linstor-gui/templates/gatekeeper.yaml     | 4 ++--
 packages/system/linstor-gui/templates/keycloakclient.yaml | 2 --
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/packages/system/linstor-gui/templates/gatekeeper-sa.yaml b/packages/system/linstor-gui/templates/gatekeeper-sa.yaml
index 44dadf07..d89f68dc 100644
--- a/packages/system/linstor-gui/templates/gatekeeper-sa.yaml
+++ b/packages/system/linstor-gui/templates/gatekeeper-sa.yaml
@@ -7,6 +7,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: linstor-gui
     app.kubernetes.io/name: gatekeeper
-    {{- include "linstor-gui.labels" . | nindent 4 }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/part-of: cozystack
 automountServiceAccountToken: false
 {{- end }}
diff --git a/packages/system/linstor-gui/templates/gatekeeper-svc.yaml b/packages/system/linstor-gui/templates/gatekeeper-svc.yaml
index bdd98585..7d50219e 100644
--- a/packages/system/linstor-gui/templates/gatekeeper-svc.yaml
+++ b/packages/system/linstor-gui/templates/gatekeeper-svc.yaml
@@ -7,7 +7,8 @@ metadata:
   labels:
     app.kubernetes.io/instance: linstor-gui
     app.kubernetes.io/name: gatekeeper
-    {{- include "linstor-gui.labels" . | nindent 4 }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/part-of: cozystack
 spec:
   type: ClusterIP
   ports:
diff --git a/packages/system/linstor-gui/templates/gatekeeper.yaml b/packages/system/linstor-gui/templates/gatekeeper.yaml
index 60ae0584..0830a5fa 100644
--- a/packages/system/linstor-gui/templates/gatekeeper.yaml
+++ b/packages/system/linstor-gui/templates/gatekeeper.yaml
@@ -22,7 +22,8 @@ metadata:
   labels:
     app.kubernetes.io/instance: linstor-gui
     app.kubernetes.io/name: gatekeeper
-    {{- include "linstor-gui.labels" . | nindent 4 }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/part-of: cozystack
   annotations:
     reloader.stakater.com/auto: "true"
 spec:
@@ -41,7 +42,6 @@ spec:
       labels:
         app.kubernetes.io/instance: linstor-gui
         app.kubernetes.io/name: gatekeeper
-        {{- include "linstor-gui.selectorLabels" . | nindent 8 }}
     spec:
       serviceAccountName: linstor-gui-gatekeeper
       automountServiceAccountToken: false
diff --git a/packages/system/linstor-gui/templates/keycloakclient.yaml b/packages/system/linstor-gui/templates/keycloakclient.yaml
index 8e00be3c..e5dab87b 100644
--- a/packages/system/linstor-gui/templates/keycloakclient.yaml
+++ b/packages/system/linstor-gui/templates/keycloakclient.yaml
@@ -67,8 +67,6 @@ spec:
     - offline_access
   attributes:
     post.logout.redirect.uris: "+"
-    client.session.idle.timeout: "86400"
-    client.session.max.lifespan: "604800"
   redirectUris:
     - "https://linstor-gui.{{ $host }}/oauth2/callback/*"
 {{- end }}

From e2b6c2c3dda4fb915f6af69b0e4ea1ce6aee316f Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 13 Apr 2026 19:23:13 +0500
Subject: [PATCH 440/666] [tenant] Allow ingress to linstor-gui gatekeeper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tenant chart declares per-namespace egress CNPs so the tenant-root
ingress-nginx can reach auth-fronted UIs in the system namespaces
(dashboard, keycloak, cdi-upload-proxy). linstor-gui's gatekeeper in
cozy-linstor needs the same allowance — without it, requests to
https://linstor-gui.<root-host> time out at the Ingress with 504
because tenant-root → cozy-linstor egress is denied by default-deny.

Scoped to the gatekeeper pods (instance=linstor-gui, name=gatekeeper)
rather than the whole cozy-linstor namespace — the ingress controller
does not need to reach the LINSTOR controller, satellites, or CSI.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/apps/tenant/templates/networkpolicy.yaml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/packages/apps/tenant/templates/networkpolicy.yaml b/packages/apps/tenant/templates/networkpolicy.yaml
index ce3e33ab..31fb0639 100644
--- a/packages/apps/tenant/templates/networkpolicy.yaml
+++ b/packages/apps/tenant/templates/networkpolicy.yaml
@@ -186,6 +186,20 @@ spec:
 ---
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
+metadata:
+  name: allow-to-linstor-gui
+  namespace: {{ include "tenant.name" . }}
+spec:
+  endpointSelector: {}
+  egress:
+  - toEndpoints:
+      - matchLabels:
+          "k8s:io.kubernetes.pod.namespace": cozy-linstor
+          "k8s:app.kubernetes.io/instance": linstor-gui
+          "k8s:app.kubernetes.io/name": gatekeeper
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
 metadata:
   name: allow-to-keycloak
   namespace: {{ include "tenant.name" . }}

From 80968410b0d84c51e0fefd3b403152a7e81e319f Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 13 Apr 2026 19:26:29 +0500
Subject: [PATCH 441/666] [tenant] Widen linstor-gui egress to whole
 cozy-linstor namespace
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Narrowing to (instance=linstor-gui, name=gatekeeper) also blocked the
transient cm-acme-http-solver pods that cert-manager spins up in the
same namespace during http-01 challenges — the solver pods carry
different labels, so the Certificate never became Ready and TLS
handshakes failed.

Broaden the rule to the whole cozy-linstor namespace to mirror
allow-to-dashboard / allow-to-keycloak. The ingress controller only
initiates upstream HTTP calls driven by Ingress resources, so allowing
namespace-wide egress is not a practical escalation.

Verified on dev10 after patching the live CNP: Certificate
linstor-gui-ingress-tls becomes Ready (Let's Encrypt prod), and the
Ingress returns HTTP 302 to the Keycloak authorize endpoint with the
correct client_id and redirect_uri.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/apps/tenant/templates/networkpolicy.yaml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/packages/apps/tenant/templates/networkpolicy.yaml b/packages/apps/tenant/templates/networkpolicy.yaml
index 31fb0639..4bd3ba02 100644
--- a/packages/apps/tenant/templates/networkpolicy.yaml
+++ b/packages/apps/tenant/templates/networkpolicy.yaml
@@ -187,6 +187,11 @@ spec:
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
+  # Allow the tenant's ingress-nginx to reach both the linstor-gui
+  # gatekeeper pods (for /oauth2/* and app traffic) AND the transient
+  # ACME http-01 solver pods that cert-manager spins up in the same
+  # namespace during certificate issuance/renewal. Matching the whole
+  # namespace mirrors allow-to-dashboard / allow-to-keycloak.
   name: allow-to-linstor-gui
   namespace: {{ include "tenant.name" . }}
 spec:
@@ -195,8 +200,6 @@ spec:
   - toEndpoints:
       - matchLabels:
           "k8s:io.kubernetes.pod.namespace": cozy-linstor
-          "k8s:app.kubernetes.io/instance": linstor-gui
-          "k8s:app.kubernetes.io/name": gatekeeper
 ---
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy

From 574941123b6e8cede9693524abced3a7c9d2e99f Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 13 Apr 2026 19:50:56 +0500
Subject: [PATCH 442/666] [linstor-gui] Bump nginx proxy buffer for
 oauth2-proxy session cookies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Keycloak access+refresh+id tokens push the oauth2-proxy session cookie
to ~8-10 KB (split across multiple Set-Cookie headers), which overflows
ingress-nginx's default proxy_buffer_size and produces "upstream sent too
big header" -> HTTP 502 on /oauth2/callback right after a successful
Keycloak login.

Mirror the dashboard ingress: proxy-buffer-size: 100m and
proxy-buffers-number: "4". Verified on dev10 — unauthenticated requests
now return 302 to Keycloak instead of 502.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/system/linstor-gui/templates/ingress.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/packages/system/linstor-gui/templates/ingress.yaml b/packages/system/linstor-gui/templates/ingress.yaml
index 86fd9175..bf950eab 100644
--- a/packages/system/linstor-gui/templates/ingress.yaml
+++ b/packages/system/linstor-gui/templates/ingress.yaml
@@ -25,6 +25,13 @@ metadata:
     acme.cert-manager.io/http01-ingress-class: {{ $exposeIngress }}
     {{- end }}
     nginx.ingress.kubernetes.io/proxy-body-size: 100m
+    # Keycloak access+refresh+id tokens make the oauth2-proxy session
+    # cookie ~8–10 KB (split across multiple Set-Cookie headers), which
+    # overflows the default proxy_buffer_size and causes "upstream sent
+    # too big header" -> HTTP 502 on /oauth2/callback. Same numbers as
+    # dashboard ingress.
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 100m
+    nginx.ingress.kubernetes.io/proxy-buffers-number: "4"
     nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
 spec:

From 7bf162217239ea35e4569371258d58dba0b7c5bf Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 13 Apr 2026 20:04:27 +0500
Subject: [PATCH 443/666] [linstor-gui] Block in-app LINSTOR auth setup at the
 nginx proxy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The upstream linstor-gui SPA exposes a "Users" / sign-in panel that
POSTs to /v1/security/* on the LINSTOR controller. If a cozystack user
turns on HTTP auth via that panel, every subsequent REST call —
including from this very GUI, which talks to the controller via mTLS,
not bearer tokens — starts returning 401, locking the user out of
LINSTOR with no in-product recovery path.

Now that authentication for the cozystack-shipped GUI is enforced one
layer up at the Ingress (oauth2-proxy + Keycloak), the in-app auth is
both redundant and a footgun. Short-circuit /v1/security/* in the
gateway nginx with a 403 + explanatory JSON body so the setting cannot
be enabled regardless of what the SPA renders. Other LINSTOR REST paths
(/v1/nodes, /v1/resource-definitions, /metrics, …) continue to proxy
through unchanged.

Verified on dev10:
  POST /v1/security/sign-in  -> 403 (with explanation body)
  GET  /v1/security/users    -> 403
  GET  /v1/nodes             -> 200

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .../linstor-gui/templates/configmap-nginx.yaml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/packages/system/linstor-gui/templates/configmap-nginx.yaml b/packages/system/linstor-gui/templates/configmap-nginx.yaml
index 0ba8e4fe..2bc11fab 100644
--- a/packages/system/linstor-gui/templates/configmap-nginx.yaml
+++ b/packages/system/linstor-gui/templates/configmap-nginx.yaml
@@ -60,6 +60,24 @@ data:
           try_files $uri $uri/ /index.html;
         }
 
+        # Block the LINSTOR controller's auth/identity management endpoints.
+        # The upstream linstor-gui exposes a "Users" / sign-in panel that
+        # POSTs to /v1/security/* on the controller. If a cozystack user
+        # enables HTTP auth via that panel, every subsequent REST call
+        # (including from this very GUI, which proxies via mTLS, not
+        # bearer tokens) starts returning 401 and the user is locked out
+        # of LINSTOR with no in-product recovery path.
+        #
+        # Authentication for cozystack is handled one layer up at the
+        # Ingress (oauth2-proxy + Keycloak), so the in-app auth is not
+        # only redundant but actively dangerous. Refuse the calls here so
+        # the setting cannot be turned on regardless of what the SPA UI
+        # shows.
+        location /v1/security {
+          default_type application/json;
+          return 403 '{"ret_code":-1,"message":"LINSTOR auth setup is disabled by cozystack: authentication is enforced at the Ingress via Keycloak."}';
+        }
+
         # Proxy LINSTOR REST API over mTLS to the controller
         location /v1 {
           proxy_pass {{ .Values.linstor.endpoint }};

From 1509f5a62079e1cc0590562e99b908d7c88a94f0 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 13 Apr 2026 20:24:55 +0500
Subject: [PATCH 444/666] [linstor-gui] Lock the right endpoints to disable
 in-app auth setup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous commit blocked /v1/security/* on the LINSTOR controller,
but that turned out to be wishful thinking: that path doesn't exist in
the LINSTOR REST API at all (the controller responds 404 for everything
under /v1/security), and the linstor-gui SPA never calls it.

The actual storage for the GUI's authentication panel is two LINSTOR
KeyValueStore instances managed by the SPA itself:

  - __gui__settings  — holds `authenticationEnabled` (the on/off toggle)
  - __gui__users     — holds the encrypted admin credential

The SPA reads them on every page load via
`GET /v1/key-value-store/__gui__settings`, so we cannot blanket-block
the path or the UI fails to render. Instead, restrict to read-only:
allow GET/HEAD (so the SPA can confirm auth=off and skip its login
screen), reject every mutating method (PUT/POST/PATCH/DELETE) with the
same explanatory 403 JSON. Other GUI key-value entries (e.g.
__gui__mode) are unaffected.

The dev10 cluster had this footgun tripped already
(authenticationEnabled=true, an admin entry in __gui__users); cleared
manually with `linstor key-value-store modify __gui__settings
authenticationEnabled false` so the existing release stops gating the
UI behind a login the user no longer has the password for.

Verified end-to-end on dev10 after upgrade:
  GET    /v1/key-value-store/__gui__settings -> 200
  PUT    /v1/key-value-store/__gui__settings -> 403 (with JSON body)
  POST   /v1/key-value-store/__gui__users    -> 403
  PUT    /v1/key-value-store/__gui__mode     -> 200 (other KV writes ok)
  GET    /v1/nodes                           -> 200

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .../templates/configmap-nginx.yaml            | 42 ++++++++++++-------
 1 file changed, 28 insertions(+), 14 deletions(-)

diff --git a/packages/system/linstor-gui/templates/configmap-nginx.yaml b/packages/system/linstor-gui/templates/configmap-nginx.yaml
index 2bc11fab..86acd0f7 100644
--- a/packages/system/linstor-gui/templates/configmap-nginx.yaml
+++ b/packages/system/linstor-gui/templates/configmap-nginx.yaml
@@ -60,22 +60,36 @@ data:
           try_files $uri $uri/ /index.html;
         }
 
-        # Block the LINSTOR controller's auth/identity management endpoints.
-        # The upstream linstor-gui exposes a "Users" / sign-in panel that
-        # POSTs to /v1/security/* on the controller. If a cozystack user
-        # enables HTTP auth via that panel, every subsequent REST call
-        # (including from this very GUI, which proxies via mTLS, not
-        # bearer tokens) starts returning 401 and the user is locked out
-        # of LINSTOR with no in-product recovery path.
+        # Lock the linstor-gui in-app authentication panel.
         #
-        # Authentication for cozystack is handled one layer up at the
-        # Ingress (oauth2-proxy + Keycloak), so the in-app auth is not
-        # only redundant but actively dangerous. Refuse the calls here so
-        # the setting cannot be turned on regardless of what the SPA UI
-        # shows.
-        location /v1/security {
+        # Unlike most LINSTOR features, the GUI's "authenticationEnabled"
+        # toggle and user list are NOT controller-side properties — they
+        # are persisted as ordinary KeyValueStore instances named
+        # `__gui__settings` and `__gui__users`. The SPA reads them on
+        # every page load and, if `authenticationEnabled=true`, gates the
+        # whole UI behind its own login screen against a self-managed
+        # admin user.
+        #
+        # Cozystack already enforces authentication at the Ingress
+        # (oauth2-proxy + Keycloak), and the in-app login is a foot-gun:
+        # if a user enables it and forgets/misconfigures the password, the
+        # only recovery is shelling into the linstor-controller pod and
+        # running `linstor key-value-store modify __gui__settings
+        # authenticationEnabled false`.
+        #
+        # We allow GETs (so the SPA can read state and render normally
+        # with auth=off) but reject every mutating method on those two
+        # KeyValueStore instances. Any other key-value-store entry the
+        # GUI uses (e.g. __gui__mode) keeps working as expected.
+        location ~ ^/v1/key-value-store/__gui__(settings|users)(/|$) {
           default_type application/json;
-          return 403 '{"ret_code":-1,"message":"LINSTOR auth setup is disabled by cozystack: authentication is enforced at the Ingress via Keycloak."}';
+          # `if ... return` is the one documented-safe use of `if` in
+          # nginx (see "If is Evil"), so it's fine here. We allow GET/HEAD
+          # for the SPA's read path and reject every mutating method.
+          if ($request_method !~ ^(GET|HEAD)$) {
+            return 403 '{"ret_code":-1,"message":"linstor-gui in-app authentication is disabled by cozystack: authentication is enforced at the Ingress via Keycloak."}';
+          }
+          proxy_pass {{ .Values.linstor.endpoint }};
         }
 
         # Proxy LINSTOR REST API over mTLS to the controller

From 25f6ae2f296e1a89d58d0ab519949a9b9ce56fba Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Tue, 14 Apr 2026 14:38:50 +0500
Subject: [PATCH 445/666] docs: add changelogs for v1.2.2 and v1.1.6

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 docs/changelogs/v1.1.6.md | 19 ++++++++++++
 docs/changelogs/v1.2.2.md | 63 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 82 insertions(+)
 create mode 100644 docs/changelogs/v1.1.6.md
 create mode 100644 docs/changelogs/v1.2.2.md

diff --git a/docs/changelogs/v1.1.6.md b/docs/changelogs/v1.1.6.md
new file mode 100644
index 00000000..77c49475
--- /dev/null
+++ b/docs/changelogs/v1.1.6.md
@@ -0,0 +1,19 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.1.6
+-->
+
+## Fixes
+
+* **[build] Filter git describe to match only v* tags**: Adds `--match 'v*'` to all `git describe` calls in `hack/common-envs.mk`. The `api/apps/v1alpha1/*` subtags share the same commit as release tags, causing `git describe --exact-match` to pick `api/apps/v1alpha1/vX.Y.Z` instead of `vX.Y.Z`, producing invalid Docker image tags ([**@kvaps**](https://github.com/kvaps) in #2386, #2388).
+
+## Development, Testing, and CI/CD
+
+* **[ci] Replace cozystack-bot PAT with cozystack-ci GitHub App**: Replaces the long-lived `cozystack-bot` personal access token with short-lived, scoped tokens from the `cozystack-ci` GitHub App across all release workflows. Improves security and auditability of CI operations ([**@tym83**](https://github.com/tym83) in #2351).
+
+* **[ci] Replace GH_PAT with cozystack-ci GitHub App token in pull-requests workflow**: Switches the pull-requests release workflow to use the cozystack-ci GitHub App token instead of the personal access token ([**@kvaps**](https://github.com/kvaps) in #2383).
+
+* **[ci] Use cozystack org noreply email for bot commits**: Updates CI workflows to use the cozystack organization noreply email for bot commits ([**@kvaps**](https://github.com/kvaps) in #2392).
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.1.5...v1.1.6
diff --git a/docs/changelogs/v1.2.2.md b/docs/changelogs/v1.2.2.md
new file mode 100644
index 00000000..3cf1731c
--- /dev/null
+++ b/docs/changelogs/v1.2.2.md
@@ -0,0 +1,63 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.2.2
+-->
+
+## Features and Improvements
+
+* **[linstor] Update piraeus-server to v1.33.2 with selected backports**: Bumps LINSTOR server from v1.33.1 to v1.33.2 and adds backported patches for improved storage reliability: a stale bitmap adjust retry mechanism for automatic recovery after bitmap attach errors, LUKS2 header sizing and optimal I/O size detection improvements for more reliable disk formatting, and the maintainer implementation backport. All patches verified against upstream v1.33.1 with `git apply --check` and `gradlew compileJava` ([**@kvaps**](https://github.com/kvaps) in #2331, #2377).
+
+* **[postgres] Fix system PostgreSQL images to 17.7-standard-trixie**: Hardcodes PostgreSQL 17.7-standard-trixie images for system PostgreSQL instances. This ensures system databases use the correct image variant consistent with the monitoring stack requirements introduced in v1.2.1 ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2369).
+
+## Fixes
+
+* **[cilium] Opt-out of cri-containerd.apparmor.d for nsenter init containers**: On Ubuntu 22.04+, Debian, and other distributions that load the `cri-containerd.apparmor.d` AppArmor profile by default for containerd workloads, the kernel denied `nsenter` namespace entry in cilium-agent init containers (`mount-cgroup`, `apply-sysctl-overwrites`, `clean-cilium-state`), causing the agent to land in `Init:CrashLoopBackOff` and cascading platform failures. Per-container `container.apparmor.security.beta.kubernetes.io` annotations now opt the affected containers out of this profile, applied only on non-Talos cilium variants (`cilium-generic`, `kubeovn-cilium-generic`). The vendored daemonset template is also patched to strip the upstream `semverCompare "<1.30.0"` AppArmor block, preventing duplicate annotation keys. Talos variants are untouched as Talos does not load the AppArmor LSM ([**@lexfrei**](https://github.com/lexfrei) in #2370, #2378).
+
+* **[virtual-machine] Exclude external VM services from Cilium BPF LB**: Adds the `service.kubernetes.io/service-proxy-name: "cozy-proxy"` label to VM LoadBalancer services when `external: true`, telling Cilium to skip BPF processing entirely for these services. This fixes two issues: inter-tenant connectivity via public LB IPs (Cilium's DNAT caused cross-tenant pod-to-pod flow classification, triggering CiliumClusterwideNetworkPolicy blocks) and WholeIP broken on Cilium 1.19+ (wildcard service drop entries blocked traffic to LB IPs on undeclared ports before it reached netfilter/cozy-proxy). MetalLB L2 advertisement and kube-ovn routing remain unaffected ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2357, #2361).
+
+* **[monitoring] Fix infra dashboards missing in default variant**: The default platform variant deploys the monitoring chart to the `cozy-monitoring` namespace, but the dashboard rendering condition introduced in #2197 only checked for `tenant-root`. Infrastructure dashboards were not rendered in the default variant. The `cozy-monitoring` namespace is now included in the rendering condition, consistent with the existing pattern in `vmagent.yaml` ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2365, #2367).
+
+* **[build] Filter git describe to match only v* tags**: Adds `--match 'v*'` to all `git describe` calls in `hack/common-envs.mk`. The `api/apps/v1alpha1/*` subtags share the same commit as release tags, causing `git describe --exact-match` to pick `api/apps/v1alpha1/vX.Y.Z` instead of `vX.Y.Z`, producing invalid Docker image tags ([**@kvaps**](https://github.com/kvaps) in #2386, #2389).
+
+## Development, Testing, and CI/CD
+
+* **[ci] Replace cozystack-bot PAT with cozystack-ci GitHub App**: Replaces the long-lived `cozystack-bot` personal access token with short-lived, scoped tokens from the `cozystack-ci` GitHub App across all release workflows (`tags.yaml`, `auto-release.yaml`, `pull-requests-release.yaml`). Improves security and auditability of CI operations ([**@tym83**](https://github.com/tym83) in #2351).
+
+* **[ci] Use cozystack org noreply email for bot commits**: Updates CI workflows to use the cozystack organization noreply email for bot commits ([**@kvaps**](https://github.com/kvaps) in #2392, #2393).
+
+* **[ci] Replace GH_PAT with cozystack-ci GitHub App token in pull-requests workflow**: Switches the pull-requests release workflow to use the cozystack-ci GitHub App token instead of the personal access token ([**@kvaps**](https://github.com/kvaps) in #2383, #2384).
+
+## Documentation
+
+* **[website] Add ApplicationDefinition naming convention reference**: Added documentation on ApplicationDefinition naming conventions and auto-restart behavior for the applicationdefinition-controller ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#478).
+
+* **[website] Document Talos / talosctl / Cozystack version pairing**: Added documentation covering Talos, talosctl, and Cozystack version compatibility matrix for installation ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#484).
+
+* **[website] Fix KubeOVN MASTER_NODES example path and key in troubleshooting**: Corrected the MASTER_NODES example path and key in the KubeOVN troubleshooting guide ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#483).
+
+* **[website] Prefix bundle package names with cozystack. in v1 examples**: Updated documentation examples to use the correct `cozystack.` prefix for bundle package names in enabled/disabledPackages ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#482).
+
+* **[website] Finish isolated-field removal and document opt-in policy labels**: Removed the obsolete `isolated` field from tenant documentation and documented the new opt-in policy labels approach ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#481).
+
+* **[website] Add --take-ownership flag and describe networking.* fields**: Added documentation for the `--take-ownership` flag and described the `networking.*` fields in the installation guide ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#480).
+
+* **[website] Add bonding (LACP) configuration how-to guide**: Added a guide for configuring network bonding with LACP on Cozystack installations ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#459).
+
+* **[website] Improve registry mirrors for tenant Kubernetes in air-gapped guide**: Improved documentation for configuring registry mirrors in tenant Kubernetes clusters for air-gapped environments ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#461).
+
+* **[website] Update backup/restore documentation for VMI/VMDisk**: Updated backup documentation with information related to VM instance and VM disk restore improvements ([**@androndo**](https://github.com/androndo) in cozystack/website#466).
+
+* **[website] Add updated OpenAPI spec**: Updated the OpenAPI specification for managed applications reference ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#469).
+
+* **[website] Add OSS Health pages and OpenSSF badge**: Added OSS Health section with OpenSSF Scorecard and Best Practices badge to the website footer ([**@tym83**](https://github.com/tym83) in cozystack/website#470).
+
+* **[website] Add CozySummit Virtual 2026 program announcement**: Published the CozySummit Virtual 2026 program announcement blog post ([**@tym83**](https://github.com/tym83) in cozystack/website#472).
+
+* **[website] Add missing release announcements for v0.1–v0.41**: Backfilled missing release announcement blog posts for Cozystack versions v0.1 through v0.41 ([**@tym83**](https://github.com/tym83) in cozystack/website#468).
+
+* **[talm] Render templates online in apply to resolve lookups**: Fixed talm `apply` command to render templates online, resolving template lookup failures when using modeline templates ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/talm#119).
+
+* **[talm] Update default Talos image to v1.12.6**: Updated the default Talos image version to v1.12.6 in talm ([**@kvaps**](https://github.com/kvaps) in cozystack/talm@03e9b6e).
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.2.1...v1.2.2

From bec35e3aade31fdca231915fc6ba95647a621cef Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Wed, 8 Apr 2026 13:15:43 +0500
Subject: [PATCH 446/666] [vm-default-images] Added new  optional package

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 api/apps/v1alpha1/vmdisk/types.go             |  11 +-
 hack/cdi_golden_image_create.sh               |   2 +-
 .../dashboard/customformsoverride.go          |  62 ++++++-
 .../dashboard/customformsoverride_test.go     | 102 +++++++++++
 packages/apps/vm-disk/README.md               |  24 +--
 packages/apps/vm-disk/templates/dv.yaml       |   8 +-
 packages/apps/vm-disk/values.schema.json      |  17 +-
 packages/apps/vm-disk/values.yaml             |   8 +-
 .../platform/sources/vm-default-images.yaml   |  22 +++
 packages/system/vm-default-images/Chart.yaml  |   5 +
 packages/system/vm-default-images/Makefile    |   4 +
 .../vm-default-images/templates/dv.yaml       |  45 +++++
 packages/system/vm-default-images/values.yaml | 167 ++++++++++++++++++
 13 files changed, 448 insertions(+), 29 deletions(-)
 create mode 100644 packages/core/platform/sources/vm-default-images.yaml
 create mode 100644 packages/system/vm-default-images/Chart.yaml
 create mode 100644 packages/system/vm-default-images/Makefile
 create mode 100644 packages/system/vm-default-images/templates/dv.yaml
 create mode 100644 packages/system/vm-default-images/values.yaml

diff --git a/api/apps/v1alpha1/vmdisk/types.go b/api/apps/v1alpha1/vmdisk/types.go
index aefac1e4..c493f49c 100644
--- a/api/apps/v1alpha1/vmdisk/types.go
+++ b/api/apps/v1alpha1/vmdisk/types.go
@@ -32,21 +32,28 @@ type ConfigSpec struct {
 }
 
 type Source struct {
+	// Clone an existing vm-disk.
+	Disk *SourceDisk `json:"disk,omitempty"`
 	// Download image from an HTTP source.
 	Http *SourceHTTP `json:"http,omitempty"`
-	// Use image by name.
+	// Use image by name from default collection.
 	Image *SourceImage `json:"image,omitempty"`
 	// Upload local image.
 	Upload *SourceUpload `json:"upload,omitempty"`
 }
 
+type SourceDisk struct {
+	// Name of the vm-disk to clone.
+	Name string `json:"name"`
+}
+
 type SourceHTTP struct {
 	// URL to download the image.
 	Url string `json:"url"`
 }
 
 type SourceImage struct {
-	// Name of the image to use (uploaded as "golden image" or from the list: `ubuntu`, `fedora`, `cirros`, `alpine`, `talos`).
+	// Name of the image to use.
 	Name string `json:"name"`
 }
 
diff --git a/hack/cdi_golden_image_create.sh b/hack/cdi_golden_image_create.sh
index be1558d0..f19f9970 100644
--- a/hack/cdi_golden_image_create.sh
+++ b/hack/cdi_golden_image_create.sh
@@ -16,7 +16,7 @@ kubectl create -f - <<EOF
 apiVersion: cdi.kubevirt.io/v1beta1
 kind: DataVolume
 metadata:
-  name: "vm-image-$name"
+  name: "vm-default-images-$name"
   namespace: cozy-public
   annotations:
     cdi.kubevirt.io/storage.bind.immediate.requested: "true"
diff --git a/internal/controller/dashboard/customformsoverride.go b/internal/controller/dashboard/customformsoverride.go
index 907ebedd..13809248 100644
--- a/internal/controller/dashboard/customformsoverride.go
+++ b/internal/controller/dashboard/customformsoverride.go
@@ -141,7 +141,10 @@ func (m *Manager) ensureCFOMapping(ctx context.Context, crd *cozyv1alpha1.Applic
 }
 
 // buildMultilineStringSchema parses OpenAPI schema and creates schema with multilineString
-// for all string fields inside spec that don't have enum
+// for all string fields inside spec that don't have enum.
+// It handles two structures:
+// - properties.spec.properties (most resources)
+// - properties.properties (VMDisk and similar resources without spec wrapper)
 func buildMultilineStringSchema(openAPISchema string) (map[string]any, error) {
 	if openAPISchema == "" {
 		return map[string]any{}, nil
@@ -161,15 +164,25 @@ func buildMultilineStringSchema(openAPISchema string) (map[string]any, error) {
 		"properties": map[string]any{},
 	}
 
-	// Check if there's a spec property
-	specProp, ok := props["spec"].(map[string]any)
-	if !ok {
-		return map[string]any{}, nil
+	var specProps map[string]any
+	var hasSpec bool
+
+	// First try to find properties under spec
+	if specProp, ok := props["spec"].(map[string]any); ok {
+		specProps, hasSpec = specProp["properties"].(map[string]any)
 	}
 
-	specProps, ok := specProp["properties"].(map[string]any)
-	if !ok {
-		return map[string]any{}, nil
+	// If no spec wrapper, use top-level properties directly (VMDisk pattern)
+	if !hasSpec {
+		specProps = props
+		// Still wrap in spec for consistency with applyListInputOverrides
+		schemaProps := schema["properties"].(map[string]any)
+		specSchema := map[string]any{
+			"properties": map[string]any{},
+		}
+		schemaProps["spec"] = specSchema
+		processSpecProperties(specProps, specSchema["properties"].(map[string]any))
+		return schema, nil
 	}
 
 	// Create spec.properties structure in schema
@@ -231,10 +244,41 @@ func applyListInputOverrides(schema map[string]any, kind string, openAPIProps ma
 		}
 
 	case "ClickHouse", "Harbor", "HTTPCache", "Kubernetes", "MariaDB", "MongoDB",
-		"NATS", "OpenBAO", "Postgres", "Qdrant", "RabbitMQ", "Redis", "VMDisk":
+		"NATS", "OpenBAO", "Postgres", "Qdrant", "RabbitMQ", "Redis":
 		specProps := ensureSchemaPath(schema, "spec")
 		specProps["storageClass"] = storageClassListInput()
 
+	case "VMDisk":
+		specProps := ensureSchemaPath(schema, "spec")
+		specProps["storageClass"] = storageClassListInput()
+
+		// Override source.image.name to be an API-backed dropdown listing default images
+		if sourceObj, ok := specProps["source"].(map[string]any); ok {
+			if imgProps, ok := sourceObj["properties"].(map[string]any); ok {
+				if imgName, ok := imgProps["image"].(map[string]any); ok {
+					imgName["properties"].(map[string]any)["name"] = map[string]any{
+						"type": "listInput",
+						"customProps": map[string]any{
+							"valueUri":    "/api/clusters/{cluster}/k8s/apis/cdi.kubevirt.io/v1beta1/namespaces/cozy-public/datavolumes",
+							"keysToValue": []any{"metadata", "annotations", "vm-default-images.cozystack.io/name"},
+							"keysToLabel": []any{"metadata", "annotations", "vm-default-images.cozystack.io/description"},
+						},
+					}
+				}
+				// Override source.disk.name to be an API-backed dropdown listing VMDisk resources
+				if diskName, ok := imgProps["disk"].(map[string]any); ok {
+					diskName["properties"].(map[string]any)["name"] = map[string]any{
+						"type": "listInput",
+						"customProps": map[string]any{
+							"valueUri":    "/api/clusters/{cluster}/k8s/apis/apps.cozystack.io/v1alpha1/namespaces/{namespace}/vmdisks",
+							"keysToValue": []any{"metadata", "name"},
+							"keysToLabel": []any{"metadata", "name"},
+						},
+					}
+				}
+			}
+		}
+
 	case "FoundationDB":
 		storageProps := ensureSchemaPath(schema, "spec", "storage")
 		storageProps["storageClass"] = storageClassListInput()
diff --git a/internal/controller/dashboard/customformsoverride_test.go b/internal/controller/dashboard/customformsoverride_test.go
index 7833d2e9..6a83d62e 100644
--- a/internal/controller/dashboard/customformsoverride_test.go
+++ b/internal/controller/dashboard/customformsoverride_test.go
@@ -317,6 +317,108 @@ func TestApplyListInputOverrides_StorageClassFoundationDB(t *testing.T) {
 	assertStorageClassListInput(t, sc)
 }
 
+func TestApplyListInputOverrides_VMDisk_SourceFields(t *testing.T) {
+	openAPISchema := `{
+		"properties":{
+			"optical":{"type":"boolean"},
+			"source":{
+				"type":"object",
+				"properties":{
+					"image":{
+						"type":"object",
+						"properties":{
+							"name":{"type":"string"}
+						}
+					},
+					"disk":{
+						"type":"object",
+						"properties":{
+							"name":{"type":"string"}
+						}
+					}
+				}
+			},
+			"storage":{"type":"string"},
+			"storageClass":{"type":"string"}
+		}
+	}`
+
+	schema, err := buildMultilineStringSchema(openAPISchema)
+	if err != nil {
+		t.Fatalf("buildMultilineStringSchema failed: %v", err)
+	}
+
+	applyListInputOverrides(schema, "VMDisk", map[string]any{})
+
+	specProps := schema["properties"].(map[string]any)["spec"].(map[string]any)["properties"].(map[string]any)
+
+	// Check storageClass
+	sc, ok := specProps["storageClass"].(map[string]any)
+	if !ok {
+		t.Fatal("storageClass not found in spec.properties")
+	}
+	assertStorageClassListInput(t, sc)
+
+	// Check source.image.name listInput
+	// Structure: specProps["source"]["properties"]["image"]["properties"]["name"]
+	sourceObj, ok := specProps["source"].(map[string]any)
+	if !ok {
+		t.Fatal("source not found in spec.properties")
+	}
+	sourceObjProps, ok := sourceObj["properties"].(map[string]any)
+	if !ok {
+		t.Fatal("source.properties not found")
+	}
+	imageObj, ok := sourceObjProps["image"].(map[string]any)
+	if !ok {
+		t.Fatal("image not found in source.properties")
+	}
+	imageObjProps, ok := imageObj["properties"].(map[string]any)
+	if !ok {
+		t.Fatal("image.properties not found")
+	}
+	imgName, ok := imageObjProps["name"].(map[string]any)
+	if !ok {
+		t.Fatal("name not found in image.properties")
+	}
+	if imgName["type"] != "listInput" {
+		t.Errorf("expected type listInput, got %v", imgName["type"])
+	}
+	imgNameCustomProps, ok := imgName["customProps"].(map[string]any)
+	if !ok {
+		t.Fatal("name.customProps not found")
+	}
+	expectedImageURI := "/api/clusters/{cluster}/k8s/apis/cdi.kubevirt.io/v1beta1/namespaces/cozy-public/datavolumes"
+	if imgNameCustomProps["valueUri"] != expectedImageURI {
+		t.Errorf("expected valueUri %s, got %v", expectedImageURI, imgNameCustomProps["valueUri"])
+	}
+
+	// Check source.disk.name listInput
+	diskObj, ok := sourceObjProps["disk"].(map[string]any)
+	if !ok {
+		t.Fatal("disk not found in source.properties")
+	}
+	diskObjProps, ok := diskObj["properties"].(map[string]any)
+	if !ok {
+		t.Fatal("disk.properties not found")
+	}
+	diskName, ok := diskObjProps["name"].(map[string]any)
+	if !ok {
+		t.Fatal("name not found in disk.properties")
+	}
+	if diskName["type"] != "listInput" {
+		t.Errorf("expected type listInput, got %v", diskName["type"])
+	}
+	diskNameCustomProps, ok := diskName["customProps"].(map[string]any)
+	if !ok {
+		t.Fatal("disk name.customProps not found")
+	}
+	expectedDiskURI := "/api/clusters/{cluster}/k8s/apis/apps.cozystack.io/v1alpha1/namespaces/{namespace}/vmdisks"
+	if diskNameCustomProps["valueUri"] != expectedDiskURI {
+		t.Errorf("expected valueUri %s, got %v", expectedDiskURI, diskNameCustomProps["valueUri"])
+	}
+}
+
 func TestApplyListInputOverrides_StorageClassKafka(t *testing.T) {
 	schema := map[string]any{}
 	applyListInputOverrides(schema, "Kafka", map[string]any{})
diff --git a/packages/apps/vm-disk/README.md b/packages/apps/vm-disk/README.md
index b8a4cdac..3727d0f5 100644
--- a/packages/apps/vm-disk/README.md
+++ b/packages/apps/vm-disk/README.md
@@ -6,15 +6,17 @@ A Virtual Machine Disk
 
 ### Common parameters
 
-| Name                | Description                                                                                                              | Type       | Value        |
-| ------------------- | ------------------------------------------------------------------------------------------------------------------------ | ---------- | ------------ |
-| `source`            | The source image location used to create a disk.                                                                         | `object`   | `{}`         |
-| `source.image`      | Use image by name.                                                                                                       | `*object`  | `null`       |
-| `source.image.name` | Name of the image to use (uploaded as "golden image" or from the list: `ubuntu`, `fedora`, `cirros`, `alpine`, `talos`). | `string`   | `""`         |
-| `source.upload`     | Upload local image.                                                                                                      | `*object`  | `null`       |
-| `source.http`       | Download image from an HTTP source.                                                                                      | `*object`  | `null`       |
-| `source.http.url`   | URL to download the image.                                                                                               | `string`   | `""`         |
-| `optical`           | Defines if disk should be considered optical.                                                                            | `bool`     | `false`      |
-| `storage`           | The size of the disk allocated for the virtual machine.                                                                  | `quantity` | `5Gi`        |
-| `storageClass`      | StorageClass used to store the data.                                                                                     | `string`   | `replicated` |
+| Name                | Description                                             | Type       | Value        |
+| ------------------- | ------------------------------------------------------- | ---------- | ------------ |
+| `source`            | The source image location used to create a disk.        | `object`   | `{}`         |
+| `source.image`      | Use image by name from default collection.              | `*object`  | `null`       |
+| `source.image.name` | Name of the image to use.                               | `string`   | `""`         |
+| `source.upload`     | Upload local image.                                     | `*object`  | `null`       |
+| `source.http`       | Download image from an HTTP source.                     | `*object`  | `null`       |
+| `source.http.url`   | URL to download the image.                              | `string`   | `""`         |
+| `source.disk`       | Clone an existing vm-disk.                              | `*object`  | `null`       |
+| `source.disk.name`  | Name of the vm-disk to clone.                           | `string`   | `""`         |
+| `optical`           | Defines if disk should be considered optical.           | `bool`     | `false`      |
+| `storage`           | The size of the disk allocated for the virtual machine. | `quantity` | `5Gi`        |
+| `storageClass`      | StorageClass used to store the data.                    | `string`   | `replicated` |
 
diff --git a/packages/apps/vm-disk/templates/dv.yaml b/packages/apps/vm-disk/templates/dv.yaml
index 3d68e639..e1227dcd 100644
--- a/packages/apps/vm-disk/templates/dv.yaml
+++ b/packages/apps/vm-disk/templates/dv.yaml
@@ -21,15 +21,19 @@ spec:
   {{- end }}
   source:
     {{- if hasKey .Values.source "image" }}
-    {{- $dv := lookup "cdi.kubevirt.io/v1beta1" "DataVolume" "cozy-public" (printf "vm-image-%s" .Values.source.image.name) }}
+    {{- $dv := lookup "cdi.kubevirt.io/v1beta1" "DataVolume" "cozy-public" (printf "vm-default-images-%s" .Values.source.image.name) }}
     pvc:
-      name: vm-image-{{ required "A valid .Values.source.image.name entry required!" .Values.source.image.name }}
+      name: vm-default-images-{{ required "A valid .Values.source.image.name entry required!" .Values.source.image.name }}
       namespace: cozy-public
     {{- else if hasKey .Values.source "http" }}
     http:
       url: {{ required "A valid .Values.source.http.url entry required!" .Values.source.http.url }}
     {{- else if hasKey .Values.source "upload" }}
     upload: {}
+    {{- else if hasKey .Values.source "disk" }}
+    pvc:
+      name: vm-disk-{{ required "A valid .Values.source.disk.name entry required!" .Values.source.disk.name }}
+      namespace: {{ $.Release.Namespace }}
     {{- end }}
   {{- else }}
   source:
diff --git a/packages/apps/vm-disk/values.schema.json b/packages/apps/vm-disk/values.schema.json
index aec36a47..d61fc359 100644
--- a/packages/apps/vm-disk/values.schema.json
+++ b/packages/apps/vm-disk/values.schema.json
@@ -7,6 +7,19 @@
       "type": "object",
       "default": {},
       "properties": {
+        "disk": {
+          "description": "Clone an existing vm-disk.",
+          "type": "object",
+          "required": [
+            "name"
+          ],
+          "properties": {
+            "name": {
+              "description": "Name of the vm-disk to clone.",
+              "type": "string"
+            }
+          }
+        },
         "http": {
           "description": "Download image from an HTTP source.",
           "type": "object",
@@ -21,14 +34,14 @@
           }
         },
         "image": {
-          "description": "Use image by name.",
+          "description": "Use image by name from default collection.",
           "type": "object",
           "required": [
             "name"
           ],
           "properties": {
             "name": {
-              "description": "Name of the image to use (uploaded as \"golden image\" or from the list: `ubuntu`, `fedora`, `cirros`, `alpine`, `talos`).",
+              "description": "Name of the image to use.",
               "type": "string"
             }
           }
diff --git a/packages/apps/vm-disk/values.yaml b/packages/apps/vm-disk/values.yaml
index 33bd174f..b9a20d68 100644
--- a/packages/apps/vm-disk/values.yaml
+++ b/packages/apps/vm-disk/values.yaml
@@ -3,17 +3,21 @@
 ##
 
 ## @typedef {struct} SourceImage - Use image by name.
-## @field {string} name - Name of the image to use (uploaded as "golden image" or from the list: `ubuntu`, `fedora`, `cirros`, `alpine`, `talos`).
+## @field {string} name - Name of the image to use.
 
 ## @typedef {struct} SourceUpload - Upload local image.
 
 ## @typedef {struct} SourceHTTP - Download image from an HTTP source.
 ## @field {string} url - URL to download the image.
 
+## @typedef {struct} SourceDisk - Clone an existing vm-disk.
+## @field {string} name - Name of the vm-disk to clone.
+
 ## @typedef {struct} Source - The source image location used to create a disk.
-## @field {*SourceImage} [image] - Use image by name.
+## @field {*SourceImage} [image] - Use image by name from default collection.
 ## @field {*SourceUpload} [upload] - Upload local image.
 ## @field {*SourceHTTP} [http] - Download image from an HTTP source.
+## @field {*SourceDisk} [disk] - Clone an existing vm-disk.
 
 ## @param {Source} source - The source image location used to create a disk.
 source: {}
diff --git a/packages/core/platform/sources/vm-default-images.yaml b/packages/core/platform/sources/vm-default-images.yaml
new file mode 100644
index 00000000..16cd6a94
--- /dev/null
+++ b/packages/core/platform/sources/vm-default-images.yaml
@@ -0,0 +1,22 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.vm-default-images
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+    path: /
+  variants:
+    - name: default
+      dependsOn:
+        - cozystack.networking
+        - cozystack.kubevirt-cdi
+      components:
+        - name: vm-default-images
+          path: system/vm-default-images
+          install:
+            namespace: cozy-system
+            releaseName: vm-default-images
diff --git a/packages/system/vm-default-images/Chart.yaml b/packages/system/vm-default-images/Chart.yaml
new file mode 100644
index 00000000..aac0ccca
--- /dev/null
+++ b/packages/system/vm-default-images/Chart.yaml
@@ -0,0 +1,5 @@
+apiVersion: v2
+name: vm-default-images
+description: Global Golden Image collection for virtual machines
+type: application
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
diff --git a/packages/system/vm-default-images/Makefile b/packages/system/vm-default-images/Makefile
new file mode 100644
index 00000000..a3f9fac7
--- /dev/null
+++ b/packages/system/vm-default-images/Makefile
@@ -0,0 +1,4 @@
+export NAME=vm-default-images
+export NAMESPACE=cozy-system
+
+include ../../../hack/package.mk
diff --git a/packages/system/vm-default-images/templates/dv.yaml b/packages/system/vm-default-images/templates/dv.yaml
new file mode 100644
index 00000000..84b9a758
--- /dev/null
+++ b/packages/system/vm-default-images/templates/dv.yaml
@@ -0,0 +1,45 @@
+{{- range .Values.images }}
+---
+apiVersion: cdi.kubevirt.io/v1beta1
+kind: DataVolume
+metadata:
+  annotations:
+    vm-default-images.cozystack.io/name: {{ .name | quote }}
+    {{- with .os }}
+    {{- with .family }}
+    vm-default-images.cozystack.io/os-family: {{ . | quote }}
+    {{- end }}
+    {{- with .name }}
+    vm-default-images.cozystack.io/os-name: {{ . | quote }}
+    {{- end }}
+    {{- with .version }}
+    vm-default-images.cozystack.io/os-version: {{ . | quote }}
+    {{- end }}
+    {{- end }}
+    {{- with .architecture }}
+    vm-default-images.cozystack.io/architecture: {{ . | quote }}
+    {{- end }}
+    {{- with .description }}
+    vm-default-images.cozystack.io/description: {{ . | quote }}
+    {{- end }}
+    cdi.kubevirt.io/storage.bind.immediate.requested: "true"
+    cdi.kubevirt.io/storage.usePopulator: "true"
+  labels:
+    app.kubernetes.io/managed-by: cozystack
+  name: vm-default-images-{{ required "A valid .name entry required for each image!" .name }}
+  namespace: cozy-public
+spec:
+  contentType: kubevirt
+  source:
+    http:
+      url: {{ required (printf "A valid .url entry required for image '%s'!" .name) .url | quote }}
+  storage:
+    resources:
+      requests:
+        storage: {{ default "5Gi" .storage }}
+    {{- if .storageClass }}
+    storageClassName: {{ .storageClass }}
+    {{- else if $.Values.storageClass }}
+    storageClassName: {{ $.Values.storageClass }}
+    {{- end }}
+{{- end }}
diff --git a/packages/system/vm-default-images/values.yaml b/packages/system/vm-default-images/values.yaml
new file mode 100644
index 00000000..8d66c281
--- /dev/null
+++ b/packages/system/vm-default-images/values.yaml
@@ -0,0 +1,167 @@
+##
+## @section Global Golden Image Collection
+##
+
+## @param {string} storageClass - Default StorageClass for all images. If empty, uses the cluster default StorageClass.
+storageClass: ""
+
+## @typedef {struct} ImageOS - Operating system metadata for a Golden Image.
+## @field {string} [family] - OS family (e.g. "Linux", "Windows").
+## @field {string} [name] - OS distribution name (e.g. "Ubuntu", "Fedora").
+## @field {string} [version] - OS version (e.g. "24.04", "40").
+
+## @typedef {struct} GlobalImage - A global Golden Image entry.
+## @field {string} name - Unique image name used to reference this image in vm-disk (e.g. "ubuntu").
+## @field {string} url - HTTP(S) URL to download the image from.
+## @field {quantity} storage - Storage size to allocate for this image.
+## @field {string} storageClass - StorageClass used to store the image (overrides global default).
+## @field {ImageOS} [os] - Operating system metadata.
+## @field {string} [architecture] - CPU architecture (e.g. "amd64", "arm64").
+## @field {string} [description] - Human-readable description.
+
+## @param {[]GlobalImage} images - List of global Golden Images to provision in the cozy-public namespace.
+images:
+  - name: ubuntu-22.04
+    url: https://cloud-images.ubuntu.com/jammy/current/jammy-server-cloudimg-amd64.img
+    storage: 20Gi
+    os:
+      family: Linux
+      name: Ubuntu
+      version: "22.04"
+    architecture: amd64
+    description: "Ubuntu 22.04 LTS (Jammy Jellyfish) cloud image"
+  - name: ubuntu-24.04
+    url: https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img
+    storage: 20Gi
+    os:
+      family: Linux
+      name: Ubuntu
+      version: "24.04"
+    architecture: amd64
+    description: "Ubuntu 24.04 LTS (Noble Numbat) cloud image"
+  - name: rocky-8
+    url: https://dl.rockylinux.org/pub/rocky/8/images/x86_64/Rocky-8-GenericCloud-Base.latest.x86_64.qcow2
+    storage: 20Gi
+    os:
+      family: Linux
+      name: Rocky Linux
+      version: "8"
+    architecture: amd64
+    description: "Rocky Linux 8 GenericCloud image"
+  - name: rocky-9
+    url: https://dl.rockylinux.org/pub/rocky/9/images/x86_64/Rocky-9-GenericCloud-Base.latest.x86_64.qcow2
+    storage: 20Gi
+    os:
+      family: Linux
+      name: Rocky Linux
+      version: "9"
+    architecture: amd64
+    description: "Rocky Linux 9 GenericCloud image"
+  - name: rocky-10
+    url: https://dl.rockylinux.org/pub/rocky/10/images/x86_64/Rocky-10-GenericCloud-Base.latest.x86_64.qcow2
+    storage: 20Gi
+    os:
+      family: Linux
+      name: Rocky Linux
+      version: "10"
+    architecture: amd64
+    description: "Rocky Linux 10 GenericCloud image"
+  - name: almalinux-8
+    url: https://repo.almalinux.org/almalinux/8/cloud/x86_64/images/AlmaLinux-8-GenericCloud-latest.x86_64.qcow2
+    storage: 20Gi
+    os:
+      family: Linux
+      name: AlmaLinux
+      version: "8"
+    architecture: amd64
+    description: "AlmaLinux 8 GenericCloud image"
+  - name: almalinux-9
+    url: https://repo.almalinux.org/almalinux/9/cloud/x86_64/images/AlmaLinux-9-GenericCloud-latest.x86_64.qcow2
+    storage: 20Gi
+    os:
+      family: Linux
+      name: AlmaLinux
+      version: "9"
+    architecture: amd64
+    description: "AlmaLinux 9 GenericCloud image"
+  - name: almalinux-10
+    url: https://repo.almalinux.org/almalinux/10/cloud/x86_64/images/AlmaLinux-10-GenericCloud-latest.x86_64.qcow2
+    storage: 20Gi
+    os:
+      family: Linux
+      name: AlmaLinux
+      version: "10"
+    architecture: amd64
+    description: "AlmaLinux 10 GenericCloud image"
+  - name: debian-12
+    url: https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-generic-amd64.qcow2
+    storage: 20Gi
+    os:
+      family: Linux
+      name: Debian
+      version: "12"
+    architecture: amd64
+    description: "Debian 12 (Bookworm) generic cloud image"
+  - name: debian-13
+    url: https://cloud.debian.org/images/cloud/trixie/latest/debian-13-generic-amd64.qcow2
+    storage: 20Gi
+    os:
+      family: Linux
+      name: Debian
+      version: "13"
+    architecture: amd64
+    description: "Debian 13 (Trixie) generic cloud image"
+  - name: centos-stream-9
+    url: https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-x86_64-9-latest.x86_64.qcow2
+    storage: 20Gi
+    os:
+      family: Linux
+      name: CentOS
+      version: "9"
+    architecture: amd64
+    description: "CentOS Stream 9 GenericCloud image"
+  - name: centos-stream-10
+    url: https://cloud.centos.org/centos/10-stream/x86_64/images/CentOS-Stream-GenericCloud-x86_64-10-latest.x86_64.qcow2
+    storage: 20Gi
+    os:
+      family: Linux
+      name: CentOS
+      version: "10"
+    architecture: amd64
+    description: "CentOS Stream 10 GenericCloud image"
+  - name: opensuse-leap-15.6
+    url: https://download.opensuse.org/repositories/Cloud:/Images:/Leap_15.6/images/openSUSE-Leap-15.6.x86_64-NoCloud.qcow2
+    storage: 20Gi
+    os:
+      family: Linux
+      name: openSUSE
+      version: "15.6"
+    architecture: amd64
+    description: "openSUSE Leap 15.6 NoCloud image"
+  - name: opensuse-leap-16.0
+    url: https://download.opensuse.org/repositories/openSUSE:/Leap:/16.0:/Images/images/Leap-16.0-Minimal-VM.x86_64-Cloud.qcow2
+    storage: 20Gi
+    os:
+      family: Linux
+      name: openSUSE
+      version: "16.0"
+    architecture: amd64
+    description: "openSUSE Leap 16.0 Minimal VM cloud image"
+  - name: ubuntu-20.04
+    url: https://cloud-images.ubuntu.com/focal/current/focal-server-cloudimg-amd64.img
+    storage: 20Gi
+    os:
+      family: Linux
+      name: Ubuntu
+      version: "20.04"
+    architecture: amd64
+    description: "Ubuntu 20.04 LTS (Focal Fossa) cloud image"
+  - name: alpine-3.21
+    url: https://dl-cdn.alpinelinux.org/alpine/v3.21/releases/cloud/nocloud_alpine-3.21.6-x86_64-bios-cloudinit-r0.qcow2
+    storage: 20Gi
+    os:
+      family: Linux
+      name: Alpine
+      version: "3.21"
+    architecture: amd64
+    description: "Alpine Linux 3.21 cloud image (cloud-init)"

From 939a7d8eb37889b96d0cee6878019939531404bf Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Wed, 8 Apr 2026 14:26:51 +0500
Subject: [PATCH 447/666] [vm-disk] Fix vm-disk-rd

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/system/vm-disk-rd/cozyrds/vm-disk.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/system/vm-disk-rd/cozyrds/vm-disk.yaml b/packages/system/vm-disk-rd/cozyrds/vm-disk.yaml
index 4d0d7e37..3ce046ed 100644
--- a/packages/system/vm-disk-rd/cozyrds/vm-disk.yaml
+++ b/packages/system/vm-disk-rd/cozyrds/vm-disk.yaml
@@ -8,7 +8,7 @@ spec:
     singular: vmdisk
     plural: vmdisks
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"source":{"description":"The source image location used to create a disk.","type":"object","default":{},"properties":{"http":{"description":"Download image from an HTTP source.","type":"object","required":["url"],"properties":{"url":{"description":"URL to download the image.","type":"string"}}},"image":{"description":"Use image by name.","type":"object","required":["name"],"properties":{"name":{"description":"Name of the image to use (uploaded as \"golden image\" or from the list: `ubuntu`, `fedora`, `cirros`, `alpine`, `talos`).","type":"string"}}},"upload":{"description":"Upload local image.","type":"object"}}},"optical":{"description":"Defines if disk should be considered optical.","type":"boolean","default":false},"storage":{"description":"The size of the disk allocated for the virtual machine.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"}}}
+      {"title":"Chart Values","type":"object","properties":{"source":{"description":"The source image location used to create a disk.","type":"object","default":{},"properties":{"disk":{"description":"Clone an existing vm-disk.","type":"object","required":["name"],"properties":{"name":{"description":"Name of the vm-disk to clone.","type":"string"}}},"http":{"description":"Download image from an HTTP source.","type":"object","required":["url"],"properties":{"url":{"description":"URL to download the image.","type":"string"}}},"image":{"description":"Use image by name from default collection.","type":"object","required":["name"],"properties":{"name":{"description":"Name of the image to use.","type":"string"}}},"upload":{"description":"Upload local image.","type":"object"}}},"optical":{"description":"Defines if disk should be considered optical.","type":"boolean","default":false},"storage":{"description":"The size of the disk allocated for the virtual machine.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"}}}
   release:
     prefix: vm-disk-
     labels:

From 6b6118ce56f559e9136c2543eec075f95b2495e6 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 13 Apr 2026 20:44:13 +0500
Subject: [PATCH 448/666] [platform] Add migration 38 to rename vm-image-*
 DataVolumes to vm-default-images-*

The vm-disk package previously referenced golden-image DataVolumes with
the prefix "vm-image-<name>" in the cozy-public namespace.  The new
vm-default-images package creates them as "vm-default-images-<name>",
so any existing vm-disk that sources an image by name would fail to
find its PVC after upgrade.

Migration 38 renames every DataVolume in cozy-public whose name starts
with "vm-image-" to "vm-default-images-" (dropping the old object and
re-creating with the new name) so live vm-disk resources keep resolving
their source PVC transparently.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .../platform/images/migrations/migrations/38  | 52 +++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100755 packages/core/platform/images/migrations/migrations/38

diff --git a/packages/core/platform/images/migrations/migrations/38 b/packages/core/platform/images/migrations/migrations/38
new file mode 100755
index 00000000..59536cb1
--- /dev/null
+++ b/packages/core/platform/images/migrations/migrations/38
@@ -0,0 +1,52 @@
+#!/bin/sh
+# Migration 38 --> 39
+# Rename DataVolumes/PVCs in cozy-public from vm-image-<name> to vm-default-images-<name>.
+#
+# The vm-disk package previously looked up golden images with the prefix "vm-image-".
+# The new vm-default-images package uses the prefix "vm-default-images-".
+# This migration renames any existing DataVolumes so that live vm-disk resources
+# continue to resolve their source PVC after upgrade.
+
+set -euo pipefail
+
+NAMESPACE="cozy-public"
+
+# Skip if CDI DataVolume CRD is not installed
+if ! kubectl api-resources --api-group=cdi.kubevirt.io -o name 2>/dev/null | grep -q '^datavolumes\.'; then
+  echo "CDI DataVolume CRD not found, skipping rename"
+  kubectl create configmap -n cozy-system cozystack-version \
+    --from-literal=version=39 --dry-run=client -o yaml | kubectl apply -f-
+  exit 0
+fi
+
+# Find DataVolumes whose name starts with "vm-image-"
+DVNAMES=$(kubectl get datavolumes.cdi.kubevirt.io -n "$NAMESPACE" \
+  -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' 2>/dev/null \
+  | grep '^vm-image-' || true)
+
+if [ -z "$DVNAMES" ]; then
+  echo "No vm-image-* DataVolumes found in $NAMESPACE, nothing to rename"
+else
+  for DVNAME in $DVNAMES; do
+    NEWNAME="vm-default-images-${DVNAME#vm-image-}"
+    echo "Renaming DataVolume $DVNAME -> $NEWNAME in namespace $NAMESPACE"
+
+    # Export existing DV spec, swap name, and apply as new object
+    kubectl get datavolumes.cdi.kubevirt.io -n "$NAMESPACE" "$DVNAME" -o json \
+      | jq --arg new "$NEWNAME" '
+          del(.metadata.resourceVersion, .metadata.uid, .metadata.creationTimestamp,
+              .metadata.generation, .metadata.selfLink, .metadata.managedFields,
+              .status)
+          | .metadata.name = $new
+        ' \
+      | kubectl apply -f -
+
+    # Delete the old DataVolume
+    kubectl delete datavolumes.cdi.kubevirt.io -n "$NAMESPACE" "$DVNAME" --ignore-not-found=true
+    echo "Renamed $DVNAME -> $NEWNAME"
+  done
+fi
+
+# Stamp version
+kubectl create configmap -n cozy-system cozystack-version \
+  --from-literal=version=39 --dry-run=client -o yaml | kubectl apply -f-

From b9a17295cccda01f2644399f55236e6e4ab58db4 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 13 Apr 2026 20:44:19 +0500
Subject: [PATCH 449/666] [platform] Wire vm-default-images into iaas bundle

The PackageSource for vm-default-images existed but was never included
in any bundle, so it would never be installed.  Add it to iaas.yaml
immediately after kubevirt-cdi (which it depends on) so it is deployed
together with the rest of the KubeVirt IaaS stack.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/core/platform/templates/bundles/iaas.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/core/platform/templates/bundles/iaas.yaml b/packages/core/platform/templates/bundles/iaas.yaml
index bd002c16..7485eb91 100644
--- a/packages/core/platform/templates/bundles/iaas.yaml
+++ b/packages/core/platform/templates/bundles/iaas.yaml
@@ -8,6 +8,7 @@
 {{- end -}}
 {{include "cozystack.platform.package" (list "cozystack.kubevirt" "default" $ $kubevirtComponents) }}
 {{include "cozystack.platform.package.default" (list "cozystack.kubevirt-cdi" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.vm-default-images" $) }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.gpu-operator" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.kamaji" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.capi-operator" $) }}

From 15dfc2521ed5c9fa281dafc42be01dca242ecd32 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 13 Apr 2026 20:44:25 +0500
Subject: [PATCH 450/666] [vm-disk] Remove unused DataVolume lookup in dv.yaml

The \$dv variable assigned by the lookup call on the image PVC was never
read.  Remove the dead line to keep the template tidy.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/apps/vm-disk/templates/dv.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/packages/apps/vm-disk/templates/dv.yaml b/packages/apps/vm-disk/templates/dv.yaml
index e1227dcd..521a82b8 100644
--- a/packages/apps/vm-disk/templates/dv.yaml
+++ b/packages/apps/vm-disk/templates/dv.yaml
@@ -21,7 +21,6 @@ spec:
   {{- end }}
   source:
     {{- if hasKey .Values.source "image" }}
-    {{- $dv := lookup "cdi.kubevirt.io/v1beta1" "DataVolume" "cozy-public" (printf "vm-default-images-%s" .Values.source.image.name) }}
     pvc:
       name: vm-default-images-{{ required "A valid .Values.source.image.name entry required!" .Values.source.image.name }}
       namespace: cozy-public

From 551b4e65ac439c8dc310fa583f6961b3ad2ad2a0 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 13 Apr 2026 20:44:32 +0500
Subject: [PATCH 451/666] [vm-default-images] Fix CentOS Stream image URLs

The x86_64 architecture token was placed inside the filename segment
(CentOS-Stream-GenericCloud-x86_64-N-latest.x86_64.qcow2) which does
not match the actual CentOS mirror layout.  Correct both CentOS Stream 9
and 10 URLs to the canonical form without the extra architecture infix.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/system/vm-default-images/values.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/system/vm-default-images/values.yaml b/packages/system/vm-default-images/values.yaml
index 8d66c281..a4677bc8 100644
--- a/packages/system/vm-default-images/values.yaml
+++ b/packages/system/vm-default-images/values.yaml
@@ -112,7 +112,7 @@ images:
     architecture: amd64
     description: "Debian 13 (Trixie) generic cloud image"
   - name: centos-stream-9
-    url: https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-x86_64-9-latest.x86_64.qcow2
+    url: https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-latest.x86_64.qcow2
     storage: 20Gi
     os:
       family: Linux
@@ -121,7 +121,7 @@ images:
     architecture: amd64
     description: "CentOS Stream 9 GenericCloud image"
   - name: centos-stream-10
-    url: https://cloud.centos.org/centos/10-stream/x86_64/images/CentOS-Stream-GenericCloud-x86_64-10-latest.x86_64.qcow2
+    url: https://cloud.centos.org/centos/10-stream/x86_64/images/CentOS-Stream-GenericCloud-10-latest.x86_64.qcow2
     storage: 20Gi
     os:
       family: Linux

From 776b4f2c8d9d24c5a5e9501f7276bede666c86df Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 13 Apr 2026 20:44:39 +0500
Subject: [PATCH 452/666] [dashboard] Guard nested type assertions in VMDisk
 customformsoverride

Accessing imgName["properties"].(map[string]any) and
diskName["properties"].(map[string]any) without an ok-check would panic
if the schema does not contain a "properties" key.  Wrap both assertions
in ok-guarded form consistent with the outer defensive style.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .../dashboard/customformsoverride.go          | 32 +++++++++++--------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/internal/controller/dashboard/customformsoverride.go b/internal/controller/dashboard/customformsoverride.go
index 13809248..0a20ae71 100644
--- a/internal/controller/dashboard/customformsoverride.go
+++ b/internal/controller/dashboard/customformsoverride.go
@@ -256,24 +256,28 @@ func applyListInputOverrides(schema map[string]any, kind string, openAPIProps ma
 		if sourceObj, ok := specProps["source"].(map[string]any); ok {
 			if imgProps, ok := sourceObj["properties"].(map[string]any); ok {
 				if imgName, ok := imgProps["image"].(map[string]any); ok {
-					imgName["properties"].(map[string]any)["name"] = map[string]any{
-						"type": "listInput",
-						"customProps": map[string]any{
-							"valueUri":    "/api/clusters/{cluster}/k8s/apis/cdi.kubevirt.io/v1beta1/namespaces/cozy-public/datavolumes",
-							"keysToValue": []any{"metadata", "annotations", "vm-default-images.cozystack.io/name"},
-							"keysToLabel": []any{"metadata", "annotations", "vm-default-images.cozystack.io/description"},
-						},
+					if imgNameProps, ok := imgName["properties"].(map[string]any); ok {
+						imgNameProps["name"] = map[string]any{
+							"type": "listInput",
+							"customProps": map[string]any{
+								"valueUri":    "/api/clusters/{cluster}/k8s/apis/cdi.kubevirt.io/v1beta1/namespaces/cozy-public/datavolumes",
+								"keysToValue": []any{"metadata", "annotations", "vm-default-images.cozystack.io/name"},
+								"keysToLabel": []any{"metadata", "annotations", "vm-default-images.cozystack.io/description"},
+							},
+						}
 					}
 				}
 				// Override source.disk.name to be an API-backed dropdown listing VMDisk resources
 				if diskName, ok := imgProps["disk"].(map[string]any); ok {
-					diskName["properties"].(map[string]any)["name"] = map[string]any{
-						"type": "listInput",
-						"customProps": map[string]any{
-							"valueUri":    "/api/clusters/{cluster}/k8s/apis/apps.cozystack.io/v1alpha1/namespaces/{namespace}/vmdisks",
-							"keysToValue": []any{"metadata", "name"},
-							"keysToLabel": []any{"metadata", "name"},
-						},
+					if diskNameProps, ok := diskName["properties"].(map[string]any); ok {
+						diskNameProps["name"] = map[string]any{
+							"type": "listInput",
+							"customProps": map[string]any{
+								"valueUri":    "/api/clusters/{cluster}/k8s/apis/apps.cozystack.io/v1alpha1/namespaces/{namespace}/vmdisks",
+								"keysToValue": []any{"metadata", "name"},
+								"keysToLabel": []any{"metadata", "name"},
+							},
+						}
 					}
 				}
 			}

From eeda31eb95430105e3798a93eb956c134e67d65b Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 13 Apr 2026 20:44:47 +0500
Subject: [PATCH 453/666] [api] Regenerate deepcopy and CRD manifests via make
 generate

Running make generate at repo root regenerates the zz_generated.deepcopy.go
files.  Key fix: Source.DeepCopyInto in the vmdisk package now handles
the new Disk *SourceDisk pointer field, which was previously missing and
would cause pointer aliasing on deep-copy.

Other generated changes are incidental updates to vminstance (Networks
field added, Subnet renamed to Network) and backups CRD manifests picked
up by controller-gen from the current HEAD.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .../v1alpha1/vmdisk/zz_generated.deepcopy.go  | 20 ++++++++++
 .../vminstance/zz_generated.deepcopy.go       | 37 +++++++++--------
 .../v1alpha1/vpc/zz_generated.deepcopy.go     | 40 +++++++++++++++++++
 api/backups/v1alpha1/zz_generated.deepcopy.go | 17 +++++++-
 .../backups.cozystack.io_backups.yaml         | 16 ++++----
 5 files changed, 105 insertions(+), 25 deletions(-)

diff --git a/api/apps/v1alpha1/vmdisk/zz_generated.deepcopy.go b/api/apps/v1alpha1/vmdisk/zz_generated.deepcopy.go
index e8ca986e..301bb1d9 100644
--- a/api/apps/v1alpha1/vmdisk/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/vmdisk/zz_generated.deepcopy.go
@@ -70,6 +70,11 @@ func (in *ConfigSpec) DeepCopy() *ConfigSpec {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Source) DeepCopyInto(out *Source) {
 	*out = *in
+	if in.Disk != nil {
+		in, out := &in.Disk, &out.Disk
+		*out = new(SourceDisk)
+		**out = **in
+	}
 	if in.Http != nil {
 		in, out := &in.Http, &out.Http
 		*out = new(SourceHTTP)
@@ -97,6 +102,21 @@ func (in *Source) DeepCopy() *Source {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SourceDisk) DeepCopyInto(out *SourceDisk) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourceDisk.
+func (in *SourceDisk) DeepCopy() *SourceDisk {
+	if in == nil {
+		return nil
+	}
+	out := new(SourceDisk)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *SourceHTTP) DeepCopyInto(out *SourceHTTP) {
 	*out = *in
diff --git a/api/apps/v1alpha1/vminstance/zz_generated.deepcopy.go b/api/apps/v1alpha1/vminstance/zz_generated.deepcopy.go
index 00b2a710..86d5ddfc 100644
--- a/api/apps/v1alpha1/vminstance/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/vminstance/zz_generated.deepcopy.go
@@ -63,9 +63,14 @@ func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 		*out = make([]Disk, len(*in))
 		copy(*out, *in)
 	}
+	if in.Networks != nil {
+		in, out := &in.Networks, &out.Networks
+		*out = make([]Network, len(*in))
+		copy(*out, *in)
+	}
 	if in.Subnets != nil {
 		in, out := &in.Subnets, &out.Subnets
-		*out = make([]Subnet, len(*in))
+		*out = make([]Network, len(*in))
 		copy(*out, *in)
 	}
 	if in.Gpus != nil {
@@ -121,6 +126,21 @@ func (in *GPU) DeepCopy() *GPU {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Network) DeepCopyInto(out *Network) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Network.
+func (in *Network) DeepCopy() *Network {
+	if in == nil {
+		return nil
+	}
+	out := new(Network)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Resources) DeepCopyInto(out *Resources) {
 	*out = *in
@@ -138,18 +158,3 @@ func (in *Resources) DeepCopy() *Resources {
 	in.DeepCopyInto(out)
 	return out
 }
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Subnet) DeepCopyInto(out *Subnet) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Subnet.
-func (in *Subnet) DeepCopy() *Subnet {
-	if in == nil {
-		return nil
-	}
-	out := new(Subnet)
-	in.DeepCopyInto(out)
-	return out
-}
diff --git a/api/apps/v1alpha1/vpc/zz_generated.deepcopy.go b/api/apps/v1alpha1/vpc/zz_generated.deepcopy.go
index cd718167..3cda29c4 100644
--- a/api/apps/v1alpha1/vpc/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/vpc/zz_generated.deepcopy.go
@@ -58,6 +58,16 @@ func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 		*out = make([]Subnet, len(*in))
 		copy(*out, *in)
 	}
+	if in.Peers != nil {
+		in, out := &in.Peers, &out.Peers
+		*out = make([]Peer, len(*in))
+		copy(*out, *in)
+	}
+	if in.Routes != nil {
+		in, out := &in.Routes, &out.Routes
+		*out = make([]Route, len(*in))
+		copy(*out, *in)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
@@ -70,6 +80,36 @@ func (in *ConfigSpec) DeepCopy() *ConfigSpec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Peer) DeepCopyInto(out *Peer) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Peer.
+func (in *Peer) DeepCopy() *Peer {
+	if in == nil {
+		return nil
+	}
+	out := new(Peer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Route) DeepCopyInto(out *Route) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Route.
+func (in *Route) DeepCopy() *Route {
+	if in == nil {
+		return nil
+	}
+	out := new(Route)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Subnet) DeepCopyInto(out *Subnet) {
 	*out = *in
diff --git a/api/backups/v1alpha1/zz_generated.deepcopy.go b/api/backups/v1alpha1/zz_generated.deepcopy.go
index b7387772..89f6171f 100644
--- a/api/backups/v1alpha1/zz_generated.deepcopy.go
+++ b/api/backups/v1alpha1/zz_generated.deepcopy.go
@@ -1,5 +1,21 @@
 //go:build !ignore_autogenerated
 
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
 // Code generated by controller-gen. DO NOT EDIT.
 
 package v1alpha1
@@ -645,4 +661,3 @@ func (in *RestoreJobStatus) DeepCopy() *RestoreJobStatus {
 	in.DeepCopyInto(out)
 	return out
 }
-
diff --git a/packages/system/backup-controller/definitions/backups.cozystack.io_backups.yaml b/packages/system/backup-controller/definitions/backups.cozystack.io_backups.yaml
index 6e031a84..d48df533 100644
--- a/packages/system/backup-controller/definitions/backups.cozystack.io_backups.yaml
+++ b/packages/system/backup-controller/definitions/backups.cozystack.io_backups.yaml
@@ -142,14 +142,6 @@ spec:
                 required:
                 - uri
                 type: object
-              underlyingResources:
-                description: |-
-                  Holds application-specific resource metadata discovered during backup.
-                  The payload is a self-typed JSON object carrying an inlined TypeMeta
-                  (kind/apiVersion) so the consuming controller can dispatch on the
-                  application kind.
-                type: object
-                x-kubernetes-preserve-unknown-fields: true
               conditions:
                 description: Conditions represents the latest available observations
                   of a Backup's state.
@@ -213,6 +205,14 @@ spec:
                   Phase is a simple, high-level summary of the backup's state.
                   Typical values are: Pending, Ready, Failed.
                 type: string
+              underlyingResources:
+                description: |-
+                  UnderlyingResources holds application-specific resource metadata discovered
+                  during backup (e.g., VM disks, network configuration). The payload is a
+                  self-typed JSON object carrying an inlined TypeMeta (kind/apiVersion) so
+                  the consuming controller can dispatch on the application kind.
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
             type: object
         type: object
     selectableFields:

From 2def6cda67e169a065e9b8c3a8f98fb17e702983 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Tue, 14 Apr 2026 10:46:12 +0500
Subject: [PATCH 454/666] [vm-default-images] Default to replicated
 storageClass and document storage requirements
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The package is wired into the iaas bundle where LINSTOR replicated storage is
available. Set storageClass to "replicated" by default and add a note that the
full image set needs ~320Gi (16 images × 20Gi).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/system/vm-default-images/values.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/packages/system/vm-default-images/values.yaml b/packages/system/vm-default-images/values.yaml
index a4677bc8..9d777f0b 100644
--- a/packages/system/vm-default-images/values.yaml
+++ b/packages/system/vm-default-images/values.yaml
@@ -3,7 +3,9 @@
 ##
 
 ## @param {string} storageClass - Default StorageClass for all images. If empty, uses the cluster default StorageClass.
-storageClass: ""
+## NOTE: The default set of images requires approximately 320Gi of storage (16 images × 20Gi each).
+## Adjust the image list or per-image storage sizes to match your cluster capacity.
+storageClass: "replicated"
 
 ## @typedef {struct} ImageOS - Operating system metadata for a Golden Image.
 ## @field {string} [family] - OS family (e.g. "Linux", "Windows").

From 0b5a1df3c288de84808a7247aa103e0b797cc5cf Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Tue, 14 Apr 2026 20:00:25 +0500
Subject: [PATCH 455/666] [platform] Bump migration targetVersion to 39 for
 migration 38

Address review feedback from lexfrei on migrations/38:2:
Migration 38 requires targetVersion 39 to execute, since run-migrations.sh
iterates seq $CURRENT_VERSION $((TARGET_VERSION - 1)).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/core/platform/values.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index 77eb00d7..c21b4f35 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -6,7 +6,7 @@ sourceRef:
 migrations:
   enabled: false
   image: ghcr.io/cozystack/cozystack/platform-migrations:v1.2.1@sha256:e8fcf006a4451fc0e961455e9b27a61b7103ee49b1a81fe5e4662ffed093fad6
-  targetVersion: 38
+  targetVersion: 39
 # Bundle deployment configuration
 bundles:
   system:

From cc3af6c0db7646ffb85b427b61f8ea7210e558aa Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Tue, 14 Apr 2026 23:10:10 +0500
Subject: [PATCH 456/666] [docs] Address review comments on v1.2.2 changelog
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Fix LINSTOR verification version: v1.33.1 → v1.33.2 (upstream base)
- Move postgres image fix entry from Features to Fixes, add missing #2364 ref
- Fix ApplicationDefinition docs description to match actual website#478 scope

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 docs/changelogs/v1.2.2.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/changelogs/v1.2.2.md b/docs/changelogs/v1.2.2.md
index 3cf1731c..2b6a1ae5 100644
--- a/docs/changelogs/v1.2.2.md
+++ b/docs/changelogs/v1.2.2.md
@@ -4,12 +4,12 @@ https://github.com/cozystack/cozystack/releases/tag/v1.2.2
 
 ## Features and Improvements
 
-* **[linstor] Update piraeus-server to v1.33.2 with selected backports**: Bumps LINSTOR server from v1.33.1 to v1.33.2 and adds backported patches for improved storage reliability: a stale bitmap adjust retry mechanism for automatic recovery after bitmap attach errors, LUKS2 header sizing and optimal I/O size detection improvements for more reliable disk formatting, and the maintainer implementation backport. All patches verified against upstream v1.33.1 with `git apply --check` and `gradlew compileJava` ([**@kvaps**](https://github.com/kvaps) in #2331, #2377).
-
-* **[postgres] Fix system PostgreSQL images to 17.7-standard-trixie**: Hardcodes PostgreSQL 17.7-standard-trixie images for system PostgreSQL instances. This ensures system databases use the correct image variant consistent with the monitoring stack requirements introduced in v1.2.1 ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2369).
+* **[linstor] Update piraeus-server to v1.33.2 with selected backports**: Bumps LINSTOR server from v1.33.1 to v1.33.2 and adds backported patches for improved storage reliability: a stale bitmap adjust retry mechanism for automatic recovery after bitmap attach errors, LUKS2 header sizing and optimal I/O size detection improvements for more reliable disk formatting, and the maintainer implementation backport. All patches verified against upstream v1.33.2 with `git apply --check` and `gradlew compileJava` ([**@kvaps**](https://github.com/kvaps) in #2331, #2377).
 
 ## Fixes
 
+* **[postgres] Fix system PostgreSQL images to 17.7-standard-trixie**: Hardcodes PostgreSQL 17.7-standard-trixie images for system PostgreSQL instances. This ensures system databases use the correct image variant consistent with the monitoring stack requirements introduced in v1.2.1 ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2364, #2369).
+
 * **[cilium] Opt-out of cri-containerd.apparmor.d for nsenter init containers**: On Ubuntu 22.04+, Debian, and other distributions that load the `cri-containerd.apparmor.d` AppArmor profile by default for containerd workloads, the kernel denied `nsenter` namespace entry in cilium-agent init containers (`mount-cgroup`, `apply-sysctl-overwrites`, `clean-cilium-state`), causing the agent to land in `Init:CrashLoopBackOff` and cascading platform failures. Per-container `container.apparmor.security.beta.kubernetes.io` annotations now opt the affected containers out of this profile, applied only on non-Talos cilium variants (`cilium-generic`, `kubeovn-cilium-generic`). The vendored daemonset template is also patched to strip the upstream `semverCompare "<1.30.0"` AppArmor block, preventing duplicate annotation keys. Talos variants are untouched as Talos does not load the AppArmor LSM ([**@lexfrei**](https://github.com/lexfrei) in #2370, #2378).
 
 * **[virtual-machine] Exclude external VM services from Cilium BPF LB**: Adds the `service.kubernetes.io/service-proxy-name: "cozy-proxy"` label to VM LoadBalancer services when `external: true`, telling Cilium to skip BPF processing entirely for these services. This fixes two issues: inter-tenant connectivity via public LB IPs (Cilium's DNAT caused cross-tenant pod-to-pod flow classification, triggering CiliumClusterwideNetworkPolicy blocks) and WholeIP broken on Cilium 1.19+ (wildcard service drop entries blocked traffic to LB IPs on undeclared ports before it reached netfilter/cozy-proxy). MetalLB L2 advertisement and kube-ovn routing remain unaffected ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2357, #2361).
@@ -28,7 +28,7 @@ https://github.com/cozystack/cozystack/releases/tag/v1.2.2
 
 ## Documentation
 
-* **[website] Add ApplicationDefinition naming convention reference**: Added documentation on ApplicationDefinition naming conventions and auto-restart behavior for the applicationdefinition-controller ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#478).
+* **[website] Add ApplicationDefinition naming convention reference**: Added reference documentation on ApplicationDefinition naming conventions and how `cozystack-api` resolves kinds to their backing definitions ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#478).
 
 * **[website] Document Talos / talosctl / Cozystack version pairing**: Added documentation covering Talos, talosctl, and Cozystack version compatibility matrix for installation ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#484).
 

From 1bae0775be1992769ff8e90a32a15594d69b4b01 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 9 Apr 2026 20:25:20 +0300
Subject: [PATCH 457/666] feat(application): add WorkloadsReady condition and
 Events tab

Add two features to improve application observability in the dashboard:

1. WorkloadsReady condition on Application status
   - Query WorkloadMonitor resources to determine if all pods are running
   - Expose WorkloadsReady as a separate condition alongside Ready
   - Ready continues to reflect HelmRelease state only (no override) to
     preserve backward compatibility with tooling and avoid false-negatives
     during normal startup windows when pods are still coming up
   - Handle three states: operational, not operational, unknown (pending)
   - Fail-open on WorkloadMonitor query errors
   - Integrate with Application Watch to emit MODIFIED events on
     WorkloadMonitor changes (with initial-events-end safety)
   - Register cozystack.io/v1alpha1 types in API server scheme

2. Events tab in dashboard
   - Show Kubernetes Events scoped to application namespace
   - Use status.namespace for Tenant applications
   - Include both lastTimestamp and eventTime columns for K8s compat

3. Bug fix: WorkloadMonitor Operational status persistence
   - Operational was written to stale 'monitor' instead of 'fresh'
     inside RetryOnConflict, so it was never persisted to the cluster

Closes #2359
Closes #2360

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .gitignore                                    |   1 +
 internal/controller/dashboard/factory.go      |  32 ++
 internal/controller/dashboard/factory_test.go |  60 +++
 .../controller/dashboard/static_refactored.go |  11 +
 .../controller/workloadmonitor_controller.go  |   4 +-
 .../workloadmonitor_controller_test.go        | 180 +++++++++
 pkg/apiserver/apiserver.go                    |   7 +
 pkg/registry/apps/application/rest.go         | 186 ++++++++++
 .../apps/application/rest_conditions_test.go  | 331 +++++++++++++++++
 .../apps/application/rest_watch_test.go       | 223 ++++++++++++
 .../apps/application/rest_workloads_test.go   | 342 ++++++++++++++++++
 11 files changed, 1375 insertions(+), 2 deletions(-)
 create mode 100644 internal/controller/dashboard/factory_test.go
 create mode 100644 internal/controller/workloadmonitor_controller_test.go
 create mode 100644 pkg/registry/apps/application/rest_conditions_test.go
 create mode 100644 pkg/registry/apps/application/rest_watch_test.go
 create mode 100644 pkg/registry/apps/application/rest_workloads_test.go

diff --git a/.gitignore b/.gitignore
index 4e1e3119..61003de5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -83,3 +83,4 @@ tmp/
 
 # build revision marker (generated by make image-packages)
 packages/core/platform/.build-revision
+.claude/
diff --git a/internal/controller/dashboard/factory.go b/internal/controller/dashboard/factory.go
index 539e503b..fe0cadfd 100644
--- a/internal/controller/dashboard/factory.go
+++ b/internal/controller/dashboard/factory.go
@@ -47,6 +47,7 @@ func (m *Manager) ensureFactory(ctx context.Context, crd *cozyv1alpha1.Applicati
 	if prefix, ok := vncTabPrefix(kind); ok {
 		tabs = append(tabs, vncTab(prefix))
 	}
+	tabs = append(tabs, eventsTab(kind))
 	tabs = append(tabs, yamlTab(g, v, plural))
 
 	// Use unified factory creation
@@ -358,6 +359,37 @@ func secretsTab(kind string) map[string]any {
 	}
 }
 
+// eventsTab shows Kubernetes Events scoped to the application's namespace.
+// Events are namespace-scoped because Kubernetes Events don't carry application
+// labels and cannot be filtered by label selector. In Cozystack's multi-tenancy
+// model, each tenant namespace maps to a single application scope, so namespace
+// filtering provides the correct event scope.
+// For Tenant applications, events are fetched from status.namespace (the tenant's
+// own namespace) instead of the parent namespace where the Tenant object lives.
+func eventsTab(kind string) map[string]any {
+	nsPlaceholder := "{3}"
+	if kind == "Tenant" {
+		nsPlaceholder = "{reqsJsonPath[0]['.status.namespace']}"
+	}
+	return map[string]any{
+		"key":   "events",
+		"label": "Events",
+		"children": []any{
+			map[string]any{
+				"type": "EnrichedTable",
+				"data": map[string]any{
+					"id":              "events-table",
+					"fetchUrl":        "/api/clusters/{2}/k8s/api/v1/namespaces/" + nsPlaceholder + "/events",
+					"cluster":         "{2}",
+					"baseprefix":      "/openapi-ui",
+					"customizationId": "factory-details-events",
+					"pathToItems":     []any{"items"},
+				},
+			},
+		},
+	}
+}
+
 func yamlTab(group, version, plural string) map[string]any {
 	return map[string]any{
 		"key":   "yaml",
diff --git a/internal/controller/dashboard/factory_test.go b/internal/controller/dashboard/factory_test.go
new file mode 100644
index 00000000..b3742564
--- /dev/null
+++ b/internal/controller/dashboard/factory_test.go
@@ -0,0 +1,60 @@
+package dashboard
+
+import (
+	"testing"
+)
+
+func TestEventsTab_Structure(t *testing.T) {
+	tab := eventsTab("PostgreSQL")
+
+	if tab["key"] != "events" {
+		t.Errorf("expected key=events, got %v", tab["key"])
+	}
+	if tab["label"] != "Events" {
+		t.Errorf("expected label=Events, got %v", tab["label"])
+	}
+
+	children, ok := tab["children"].([]any)
+	if !ok || len(children) != 1 {
+		t.Fatal("expected exactly 1 child in events tab")
+	}
+
+	table, ok := children[0].(map[string]any)
+	if !ok {
+		t.Fatal("child is not a map")
+	}
+	if table["type"] != "EnrichedTable" {
+		t.Errorf("expected type=EnrichedTable, got %v", table["type"])
+	}
+
+	data, ok := table["data"].(map[string]any)
+	if !ok {
+		t.Fatal("table data is not a map")
+	}
+	if data["id"] != "events-table" {
+		t.Errorf("expected id=events-table, got %v", data["id"])
+	}
+	if data["fetchUrl"] != "/api/clusters/{2}/k8s/api/v1/namespaces/{3}/events" {
+		t.Errorf("unexpected fetchUrl for non-Tenant: %v", data["fetchUrl"])
+	}
+	if data["customizationId"] != "factory-details-events" {
+		t.Errorf("expected customizationId=factory-details-events, got %v", data["customizationId"])
+	}
+
+	pathToItems, ok := data["pathToItems"].([]any)
+	if !ok || len(pathToItems) != 1 || pathToItems[0] != "items" {
+		t.Errorf("expected pathToItems=[items], got %v", data["pathToItems"])
+	}
+}
+
+func TestEventsTab_TenantUsesStatusNamespace(t *testing.T) {
+	tab := eventsTab("Tenant")
+	children := tab["children"].([]any)
+	table := children[0].(map[string]any)
+	data := table["data"].(map[string]any)
+
+	expectedURL := "/api/clusters/{2}/k8s/api/v1/namespaces/{reqsJsonPath[0]['.status.namespace']}/events"
+	if data["fetchUrl"] != expectedURL {
+		t.Errorf("expected Tenant fetchUrl to use status.namespace, got %v", data["fetchUrl"])
+	}
+}
diff --git a/internal/controller/dashboard/static_refactored.go b/internal/controller/dashboard/static_refactored.go
index 06c4239f..a73026bc 100644
--- a/internal/controller/dashboard/static_refactored.go
+++ b/internal/controller/dashboard/static_refactored.go
@@ -224,6 +224,17 @@ func CreateAllCustomColumnsOverrides() []*dashboardv1alpha1.CustomColumnsOverrid
 			createStringColumn("Name", ".name"),
 		}),
 
+		// Factory details events
+		createCustomColumnsOverride("factory-details-events", []any{
+			createTimestampColumn("Last Seen", ".lastTimestamp"),
+			createTimestampColumn("Event Time", ".eventTime"),
+			createStringColumn("Type", ".type"),
+			createStringColumn("Reason", ".reason"),
+			createStringColumn("Object", ".involvedObject.kind"),
+			createStringColumn("Name", ".involvedObject.name"),
+			createStringColumn("Message", ".message"),
+		}),
+
 		// Factory status conditions
 		createCustomColumnsOverride("factory-status-conditions", []any{
 			createStringColumn("Type", ".type"),
diff --git a/internal/controller/workloadmonitor_controller.go b/internal/controller/workloadmonitor_controller.go
index a684df9b..0cd3103e 100644
--- a/internal/controller/workloadmonitor_controller.go
+++ b/internal/controller/workloadmonitor_controller.go
@@ -389,9 +389,9 @@ func (r *WorkloadMonitorReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		fresh.Status.AvailableReplicas = availableReplicas
 
 		// Default to operational = true, but check MinReplicas if set
-		monitor.Status.Operational = pointer.Bool(true)
+		fresh.Status.Operational = pointer.Bool(true)
 		if monitor.Spec.MinReplicas != nil && availableReplicas < *monitor.Spec.MinReplicas {
-			monitor.Status.Operational = pointer.Bool(false)
+			fresh.Status.Operational = pointer.Bool(false)
 		}
 		return r.Status().Update(ctx, fresh)
 	})
diff --git a/internal/controller/workloadmonitor_controller_test.go b/internal/controller/workloadmonitor_controller_test.go
new file mode 100644
index 00000000..e1ed0c0d
--- /dev/null
+++ b/internal/controller/workloadmonitor_controller_test.go
@@ -0,0 +1,180 @@
+package controller
+
+import (
+	"context"
+	"testing"
+
+	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+)
+
+func TestReconcile_OperationalStatusPersisted(t *testing.T) {
+	scheme := runtime.NewScheme()
+	_ = cozyv1alpha1.AddToScheme(scheme)
+	_ = corev1.AddToScheme(scheme)
+
+	minReplicas := int32(2)
+	monitor := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-monitor",
+			Namespace: "default",
+		},
+		Spec: cozyv1alpha1.WorkloadMonitorSpec{
+			Selector:    map[string]string{"app": "test"},
+			MinReplicas: &minReplicas,
+		},
+	}
+
+	// Create one pod that is ready — availableReplicas=1 < minReplicas=2, so Operational should be false
+	pod := &corev1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-pod-1",
+			Namespace: "default",
+			Labels:    map[string]string{"app": "test"},
+		},
+		Status: corev1.PodStatus{
+			Conditions: []corev1.PodCondition{
+				{Type: corev1.PodReady, Status: corev1.ConditionTrue},
+			},
+		},
+	}
+
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(monitor, pod).
+		WithStatusSubresource(monitor).
+		Build()
+
+	reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: scheme}
+	req := reconcile.Request{NamespacedName: types.NamespacedName{Name: "test-monitor", Namespace: "default"}}
+
+	_, err := reconciler.Reconcile(context.TODO(), req)
+	if err != nil {
+		t.Fatalf("Reconcile returned error: %v", err)
+	}
+
+	// Fetch the monitor back from fake client and check Operational is persisted
+	updated := &cozyv1alpha1.WorkloadMonitor{}
+	if err := fakeClient.Get(context.TODO(), req.NamespacedName, updated); err != nil {
+		t.Fatalf("Failed to get updated WorkloadMonitor: %v", err)
+	}
+
+	if updated.Status.Operational == nil {
+		t.Fatal("Expected Operational to be set, got nil")
+	}
+	if *updated.Status.Operational {
+		t.Error("Expected Operational=false (1 available < 2 minReplicas), got true")
+	}
+	if updated.Status.ObservedReplicas != 1 {
+		t.Errorf("Expected ObservedReplicas=1, got %d", updated.Status.ObservedReplicas)
+	}
+	if updated.Status.AvailableReplicas != 1 {
+		t.Errorf("Expected AvailableReplicas=1, got %d", updated.Status.AvailableReplicas)
+	}
+}
+
+func TestReconcile_OperationalTrue_WhenEnoughReplicas(t *testing.T) {
+	scheme := runtime.NewScheme()
+	_ = cozyv1alpha1.AddToScheme(scheme)
+	_ = corev1.AddToScheme(scheme)
+
+	minReplicas := int32(1)
+	monitor := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-monitor",
+			Namespace: "default",
+		},
+		Spec: cozyv1alpha1.WorkloadMonitorSpec{
+			Selector:    map[string]string{"app": "test"},
+			MinReplicas: &minReplicas,
+		},
+	}
+
+	pod := &corev1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-pod-1",
+			Namespace: "default",
+			Labels:    map[string]string{"app": "test"},
+		},
+		Status: corev1.PodStatus{
+			Conditions: []corev1.PodCondition{
+				{Type: corev1.PodReady, Status: corev1.ConditionTrue},
+			},
+		},
+	}
+
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(monitor, pod).
+		WithStatusSubresource(monitor).
+		Build()
+
+	reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: scheme}
+	req := reconcile.Request{NamespacedName: types.NamespacedName{Name: "test-monitor", Namespace: "default"}}
+
+	_, err := reconciler.Reconcile(context.TODO(), req)
+	if err != nil {
+		t.Fatalf("Reconcile returned error: %v", err)
+	}
+
+	updated := &cozyv1alpha1.WorkloadMonitor{}
+	if err := fakeClient.Get(context.TODO(), req.NamespacedName, updated); err != nil {
+		t.Fatalf("Failed to get updated WorkloadMonitor: %v", err)
+	}
+
+	if updated.Status.Operational == nil {
+		t.Fatal("Expected Operational to be set, got nil")
+	}
+	if !*updated.Status.Operational {
+		t.Error("Expected Operational=true (1 available >= 1 minReplicas), got false")
+	}
+}
+
+func TestReconcile_OperationalTrue_WhenNoMinReplicas(t *testing.T) {
+	scheme := runtime.NewScheme()
+	_ = cozyv1alpha1.AddToScheme(scheme)
+	_ = corev1.AddToScheme(scheme)
+
+	monitor := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-monitor",
+			Namespace: "default",
+		},
+		Spec: cozyv1alpha1.WorkloadMonitorSpec{
+			Selector: map[string]string{"app": "test"},
+			// No MinReplicas — should default to operational=true
+		},
+	}
+
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(monitor).
+		WithStatusSubresource(monitor).
+		Build()
+
+	reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: scheme}
+	req := reconcile.Request{NamespacedName: types.NamespacedName{Name: "test-monitor", Namespace: "default"}}
+
+	_, err := reconciler.Reconcile(context.TODO(), req)
+	if err != nil {
+		t.Fatalf("Reconcile returned error: %v", err)
+	}
+
+	updated := &cozyv1alpha1.WorkloadMonitor{}
+	if err := fakeClient.Get(context.TODO(), req.NamespacedName, updated); err != nil {
+		t.Fatalf("Failed to get updated WorkloadMonitor: %v", err)
+	}
+
+	if updated.Status.Operational == nil {
+		t.Fatal("Expected Operational to be set, got nil")
+	}
+	if !*updated.Status.Operational {
+		t.Error("Expected Operational=true (no MinReplicas constraint), got false")
+	}
+}
+
diff --git a/pkg/apiserver/apiserver.go b/pkg/apiserver/apiserver.go
index bf02e642..005fc640 100644
--- a/pkg/apiserver/apiserver.go
+++ b/pkg/apiserver/apiserver.go
@@ -21,6 +21,7 @@ import (
 	"fmt"
 	"time"
 
+	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
 	helmv2 "github.com/fluxcd/helm-controller/api/v2"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
@@ -79,6 +80,11 @@ func init() {
 	if err := rbacv1.AddToScheme(mgrScheme); err != nil {
 		panic(fmt.Errorf("Failed to add RBAC types to scheme: %w", err))
 	}
+
+	// Register Cozystack types for WorkloadMonitor queries.
+	if err := cozyv1alpha1.AddToScheme(mgrScheme); err != nil {
+		panic(fmt.Errorf("failed to add Cozystack types to scheme: %w", err))
+	}
 	// Add unversioned types.
 	metav1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"})
 
@@ -168,6 +174,7 @@ func (c completedConfig) New() (*CozyServer, error) {
 		&corev1.Namespace{},
 		&corev1.Service{},
 		&rbacv1.RoleBinding{},
+		&cozyv1alpha1.WorkloadMonitor{},
 	); err != nil {
 		return nil, fmt.Errorf("failed to get informers: %w", err)
 	}
diff --git a/pkg/registry/apps/application/rest.go b/pkg/registry/apps/application/rest.go
index 470da560..583a4a8c 100644
--- a/pkg/registry/apps/application/rest.go
+++ b/pkg/registry/apps/application/rest.go
@@ -26,6 +26,7 @@ import (
 	"sync"
 	"time"
 
+	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
 	helmv2 "github.com/fluxcd/helm-controller/api/v2"
 	corev1 "k8s.io/api/core/v1"
 	metainternalversion "k8s.io/apimachinery/pkg/apis/meta/internalversion"
@@ -703,9 +704,28 @@ func (r *REST) Watch(ctx context.Context, options *metainternalversion.ListOptio
 	}
 	customW.underlying = helmWatcher
 
+	// Start watch on WorkloadMonitor to detect pod readiness changes
+	wmLabelSelector := labels.NewSelector().Add(*appKindReq, *appGroupReq)
+	wmList := &cozyv1alpha1.WorkloadMonitorList{}
+	wmWatcher, err := r.w.Watch(ctx, wmList, &client.ListOptions{
+		Namespace:     namespace,
+		LabelSelector: wmLabelSelector,
+	})
+	if err != nil {
+		klog.Warningf("Failed to set up WorkloadMonitor watch, workload status changes won't trigger events: %v", err)
+		// Non-fatal: proceed without WorkloadMonitor watch
+		wmWatcher = nil
+	}
+
 	go func() {
+		// Capture wmWatcher for cleanup; the variable may be set to nil
+		// inside the loop when the channel closes, so defer must use this copy.
+		wmWatcherForCleanup := wmWatcher
 		defer close(customW.resultChan)
 		defer customW.underlying.Stop()
+		if wmWatcherForCleanup != nil {
+			defer wmWatcherForCleanup.Stop()
+		}
 
 		// Track whether we've sent the initial-events-end bookmark
 		initialEventsEndSent := !sendInitialEvents // If not sendInitialEvents, consider it already sent
@@ -879,6 +899,77 @@ func (r *REST) Watch(ctx context.Context, options *metainternalversion.ListOptio
 					return
 				}
 
+			case wmEvent, ok := <-wmResultChan(wmWatcher):
+				if !ok {
+					klog.V(4).Info("WorkloadMonitor watcher closed")
+					wmWatcher = nil
+					continue
+				}
+				if wmEvent.Type == watch.Bookmark || wmEvent.Type == watch.Error {
+					if wmEvent.Type == watch.Error {
+						klog.V(4).Infof("WorkloadMonitor watch error event: %v", wmEvent.Object)
+					}
+					continue
+				}
+				// Don't emit WM-triggered events until the initial snapshot is
+				// complete — the watch-list contract requires all ADDED events
+				// followed by the initial-events-end bookmark before any live updates.
+				if !initialEventsEndSent {
+					continue
+				}
+				wm, ok := wmEvent.Object.(*cozyv1alpha1.WorkloadMonitor)
+				if !ok {
+					continue
+				}
+				// All WM event types (Added/Modified/Deleted) produce a Modified
+				// Application event because the Application itself is what changed
+				// from the client's perspective.
+				wmAppName, hasLabel := wm.Labels[ApplicationNameLabel]
+				if !hasLabel {
+					continue
+				}
+				// Filter: skip WorkloadMonitor events for applications not matching
+				// the watch scope (single-resource or field-selector filtered watches)
+				hrName := r.releaseConfig.Prefix + wmAppName
+				if filterByName != "" && hrName != filterByName {
+					continue
+				}
+				if resourceName != "" && wmAppName != resourceName {
+					continue
+				}
+				hr := &helmv2.HelmRelease{}
+				if err := r.c.Get(ctx, client.ObjectKey{Namespace: wm.Namespace, Name: hrName}, hr); err != nil {
+					klog.V(4).Infof("Cannot find HelmRelease %s/%s for WorkloadMonitor event: %v", wm.Namespace, hrName, err)
+					continue
+				}
+				app, err := r.ConvertHelmReleaseToApplication(ctx, hr)
+				if err != nil {
+					klog.V(4).Infof("Error converting HelmRelease for WorkloadMonitor event: %v", err)
+					continue
+				}
+				// Apply label selector filtering (same as HelmRelease event path)
+				if options.LabelSelector != nil {
+					sel, err := labels.Parse(options.LabelSelector.String())
+					if err != nil {
+						klog.Errorf("Invalid label selector: %v", err)
+						continue
+					}
+					if !sel.Matches(labels.Set(app.Labels)) {
+						continue
+					}
+				}
+				// Use the WorkloadMonitor's ResourceVersion for the emitted event
+				// so clients see a monotonically increasing RV and don't skip this update.
+				app.SetResourceVersion(wm.GetResourceVersion())
+				lastResourceVersion = wm.GetResourceVersion()
+				select {
+				case customW.resultChan <- watch.Event{Type: watch.Modified, Object: &app}:
+				case <-customW.stopChan:
+					return
+				case <-ctx.Done():
+					return
+				}
+
 			case <-customW.stopChan:
 				return
 			case <-ctx.Done():
@@ -891,6 +982,15 @@ func (r *REST) Watch(ctx context.Context, options *metainternalversion.ListOptio
 	return customW, nil
 }
 
+// wmResultChan returns the result channel of a WorkloadMonitor watcher, or a nil
+// channel (which blocks forever in select) if the watcher is nil.
+func wmResultChan(w watch.Interface) <-chan watch.Event {
+	if w == nil {
+		return nil
+	}
+	return w.ResultChan()
+}
+
 // customWatcher wraps the original watcher and filters/converts events
 type customWatcher struct {
 	resultChan chan watch.Event
@@ -1150,6 +1250,56 @@ func (r *REST) convertHelmReleaseToApplication(ctx context.Context, hr *helmv2.H
 			})
 		}
 	}
+	// Enrich conditions with WorkloadMonitor operational status
+	ws, wsErr := r.getWorkloadsOperational(ctx, hr.Namespace, app.Name)
+	if wsErr != nil {
+		// Fail-open: if we can't query WorkloadMonitors (e.g., informer cache not ready),
+		// don't override Ready. Prefer operational availability over safety.
+		// The WorkloadsReady=Unknown condition still signals the issue to the user.
+		klog.Warningf("Failed to check workload monitors for %s/%s: %v", hr.Namespace, app.Name, wsErr)
+		conditions = append(conditions, metav1.Condition{
+			Type:               "WorkloadsReady",
+			Status:             metav1.ConditionUnknown,
+			LastTransitionTime: metav1.Now(),
+			Reason:             "Error",
+			Message:            fmt.Sprintf("Failed to check workload status: %v", wsErr),
+		})
+	} else if ws.found {
+		// LastTransitionTime is set to the current time because the Application
+		// resource is virtual (computed on-the-fly from HelmRelease). There is no
+		// persistent condition state to track actual transitions. This is consistent
+		// with how computed/virtual API resources work in Kubernetes.
+		workloadsCondition := metav1.Condition{
+			Type:               "WorkloadsReady",
+			LastTransitionTime: metav1.Now(),
+			Reason:             "WorkloadMonitorCheck",
+		}
+		switch {
+		case !ws.operational:
+			// Concrete failure takes priority over unknown/pending state
+			workloadsCondition.Status = metav1.ConditionFalse
+			workloadsCondition.Message = "One or more workloads are not operational"
+		case ws.unknown:
+			workloadsCondition.Status = metav1.ConditionUnknown
+			workloadsCondition.Reason = "Pending"
+			workloadsCondition.Message = "One or more workloads have not been reconciled yet"
+		default:
+			workloadsCondition.Status = metav1.ConditionTrue
+			workloadsCondition.Message = "All workloads are operational"
+		}
+		conditions = append(conditions, workloadsCondition)
+
+		// Intentionally do NOT override the Ready condition based on WorkloadsReady.
+		// Ready continues to reflect HelmRelease state only, which:
+		//   - preserves backward compatibility with existing tooling (kubectl wait,
+		//     GitOps health checks) that expect Ready to match HelmRelease
+		//   - avoids false-negative Ready=False during normal startup windows where
+		//     pods are still coming up but WorkloadMonitor has already reported
+		//     Operational=false due to availableReplicas < MinReplicas
+		// WorkloadsReady is a separate condition that surfaces workload health
+		// independently — users and dashboards can observe it for operational visibility.
+	}
+
 	app.SetConditions(conditions)
 
 	// Add namespace field for Tenant applications
@@ -1166,6 +1316,42 @@ func (r *REST) convertHelmReleaseToApplication(ctx context.Context, hr *helmv2.H
 	return app, nil
 }
 
+// workloadsStatus holds the aggregated operational status of WorkloadMonitors.
+type workloadsStatus struct {
+	operational bool
+	found       bool
+	unknown     bool // true when at least one monitor has nil Operational (not yet reconciled)
+}
+
+// getWorkloadsOperational checks WorkloadMonitor resources for an application and returns
+// aggregated operational status. If no monitors exist, returns found=false.
+func (r *REST) getWorkloadsOperational(ctx context.Context, namespace, appName string) (workloadsStatus, error) {
+	monitors := &cozyv1alpha1.WorkloadMonitorList{}
+	if err := r.c.List(ctx, monitors,
+		client.InNamespace(namespace),
+		client.MatchingLabels{
+			appsv1alpha1.ApplicationKindLabel:  r.kindName,
+			appsv1alpha1.ApplicationGroupLabel: r.gvk.Group,
+			appsv1alpha1.ApplicationNameLabel:  appName,
+		},
+	); err != nil {
+		return workloadsStatus{}, err
+	}
+	if len(monitors.Items) == 0 {
+		return workloadsStatus{operational: true, found: false}, nil
+	}
+	operational := true
+	unknown := false
+	for _, m := range monitors.Items {
+		if m.Status.Operational == nil {
+			unknown = true
+		} else if !*m.Status.Operational {
+			operational = false
+		}
+	}
+	return workloadsStatus{operational: operational, found: true, unknown: unknown}, nil
+}
+
 // convertApplicationToHelmRelease implements the actual conversion logic
 func (r *REST) convertApplicationToHelmRelease(app *appsv1alpha1.Application) (*helmv2.HelmRelease, error) {
 	helmRelease := &helmv2.HelmRelease{
diff --git a/pkg/registry/apps/application/rest_conditions_test.go b/pkg/registry/apps/application/rest_conditions_test.go
new file mode 100644
index 00000000..dbb99d52
--- /dev/null
+++ b/pkg/registry/apps/application/rest_conditions_test.go
@@ -0,0 +1,331 @@
+package application
+
+import (
+	"context"
+	"testing"
+
+	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+	helmv2 "github.com/fluxcd/helm-controller/api/v2"
+	appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
+	"github.com/cozystack/cozystack/pkg/config"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/utils/ptr"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+)
+
+func findCondition(conditions []metav1.Condition, condType string) *metav1.Condition {
+	for i := range conditions {
+		if conditions[i].Type == condType {
+			return &conditions[i]
+		}
+	}
+	return nil
+}
+
+func makeHelmRelease(name, namespace string) *helmv2.HelmRelease {
+	hr := &helmv2.HelmRelease{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: namespace,
+			Labels: map[string]string{
+				ApplicationKindLabel:  "PostgreSQL",
+				ApplicationGroupLabel: "apps.cozystack.io",
+				ApplicationNameLabel:  "mydb",
+			},
+		},
+	}
+	return hr
+}
+
+func TestConvertConditions_WorkloadsReadyAdded(t *testing.T) {
+	monitor := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mon-1",
+			Namespace: "default",
+			Labels: map[string]string{
+				appsv1alpha1.ApplicationKindLabel:  "PostgreSQL",
+				appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io",
+				appsv1alpha1.ApplicationNameLabel:  "mydb",
+			},
+		},
+		Status: cozyv1alpha1.WorkloadMonitorStatus{
+			Operational: ptr.To(true),
+		},
+	}
+
+	r := newTestRESTWithSchemes(monitor)
+	hr := makeHelmRelease("postgresql-mydb", "default")
+	hr.Status.Conditions = []metav1.Condition{
+		{Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "Release applied"},
+		{Type: "Released", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "Released"},
+	}
+
+	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	wc := findCondition(app.GetConditions(), "WorkloadsReady")
+	if wc == nil {
+		t.Fatal("expected WorkloadsReady condition to be present")
+	}
+	if wc.Status != metav1.ConditionTrue {
+		t.Errorf("expected WorkloadsReady=True, got %s", wc.Status)
+	}
+
+	rc := findCondition(app.GetConditions(), "Ready")
+	if rc == nil {
+		t.Fatal("expected Ready condition to be present")
+	}
+	if rc.Status != metav1.ConditionTrue {
+		t.Errorf("expected Ready=True, got %s", rc.Status)
+	}
+}
+
+func TestConvertConditions_ReadyNotOverriddenWhenWorkloadsNotReady(t *testing.T) {
+	// Ready must reflect HelmRelease state only. WorkloadsReady is a separate
+	// signal that users/dashboards can observe independently.
+	monitor := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mon-1",
+			Namespace: "default",
+			Labels: map[string]string{
+				appsv1alpha1.ApplicationKindLabel:  "PostgreSQL",
+				appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io",
+				appsv1alpha1.ApplicationNameLabel:  "mydb",
+			},
+		},
+		Status: cozyv1alpha1.WorkloadMonitorStatus{
+			Operational: ptr.To(false),
+		},
+	}
+
+	r := newTestRESTWithSchemes(monitor)
+	hr := makeHelmRelease("postgresql-mydb", "default")
+	hr.Status.Conditions = []metav1.Condition{
+		{Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "Release applied"},
+	}
+
+	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	wc := findCondition(app.GetConditions(), "WorkloadsReady")
+	if wc == nil {
+		t.Fatal("expected WorkloadsReady condition to be present")
+	}
+	if wc.Status != metav1.ConditionFalse {
+		t.Errorf("expected WorkloadsReady=False, got %s", wc.Status)
+	}
+
+	rc := findCondition(app.GetConditions(), "Ready")
+	if rc == nil {
+		t.Fatal("expected Ready condition to be present")
+	}
+	if rc.Status != metav1.ConditionTrue {
+		t.Errorf("expected Ready=True (reflects HelmRelease only), got %s", rc.Status)
+	}
+	if rc.Reason != "Succeeded" {
+		t.Errorf("expected Ready.Reason=Succeeded (unchanged), got %s", rc.Reason)
+	}
+}
+
+func TestConvertConditions_NoOverrideWhenNoMonitors(t *testing.T) {
+	r := newTestRESTWithSchemes()
+	hr := makeHelmRelease("postgresql-mydb", "default")
+	hr.Status.Conditions = []metav1.Condition{
+		{Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "Release applied"},
+	}
+
+	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	wc := findCondition(app.GetConditions(), "WorkloadsReady")
+	if wc != nil {
+		t.Error("expected no WorkloadsReady condition when no monitors exist")
+	}
+
+	rc := findCondition(app.GetConditions(), "Ready")
+	if rc == nil {
+		t.Fatal("expected Ready condition to be present")
+	}
+	if rc.Status != metav1.ConditionTrue {
+		t.Errorf("expected Ready=True unchanged, got %s", rc.Status)
+	}
+}
+
+func TestConvertConditions_ReadyStaysTrue_WhenAllOperational(t *testing.T) {
+	monitor := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mon-1",
+			Namespace: "default",
+			Labels: map[string]string{
+				appsv1alpha1.ApplicationKindLabel:  "PostgreSQL",
+				appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io",
+				appsv1alpha1.ApplicationNameLabel:  "mydb",
+			},
+		},
+		Status: cozyv1alpha1.WorkloadMonitorStatus{
+			Operational: ptr.To(true),
+		},
+	}
+
+	r := newTestRESTWithSchemes(monitor)
+	hr := makeHelmRelease("postgresql-mydb", "default")
+	hr.Status.Conditions = []metav1.Condition{
+		{Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "Release applied"},
+		{Type: "Released", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "Released"},
+	}
+
+	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	rc := findCondition(app.GetConditions(), "Ready")
+	if rc == nil {
+		t.Fatal("expected Ready condition")
+	}
+	if rc.Status != metav1.ConditionTrue {
+		t.Errorf("expected Ready=True when all workloads operational, got %s", rc.Status)
+	}
+	if rc.Reason != "Succeeded" {
+		t.Errorf("expected Ready.Reason=Succeeded (unchanged), got %s", rc.Reason)
+	}
+}
+
+func TestConvertConditions_WorkloadsReadyTimestampIsNonZero(t *testing.T) {
+	monitor := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mon-1",
+			Namespace: "default",
+			Labels: map[string]string{
+				appsv1alpha1.ApplicationKindLabel:  "PostgreSQL",
+				appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io",
+				appsv1alpha1.ApplicationNameLabel:  "mydb",
+			},
+		},
+		Status: cozyv1alpha1.WorkloadMonitorStatus{
+			Operational: ptr.To(true),
+		},
+	}
+
+	r := newTestRESTWithSchemes(monitor)
+	hr := makeHelmRelease("postgresql-mydb", "default")
+	// No Ready condition — HR still being reconciled
+	hr.Status.Conditions = []metav1.Condition{}
+
+	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	wc := findCondition(app.GetConditions(), "WorkloadsReady")
+	if wc == nil {
+		t.Fatal("expected WorkloadsReady condition")
+	}
+	if wc.LastTransitionTime.IsZero() {
+		t.Error("expected non-zero LastTransitionTime")
+	}
+}
+
+func TestConvertConditions_WorkloadsReadyUnknownWhenNilOperational(t *testing.T) {
+	monitor := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mon-1",
+			Namespace: "default",
+			Labels: map[string]string{
+				appsv1alpha1.ApplicationKindLabel:  "PostgreSQL",
+				appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io",
+				appsv1alpha1.ApplicationNameLabel:  "mydb",
+			},
+		},
+		Status: cozyv1alpha1.WorkloadMonitorStatus{
+			Operational: nil, // Not yet reconciled
+		},
+	}
+
+	r := newTestRESTWithSchemes(monitor)
+	hr := makeHelmRelease("postgresql-mydb", "default")
+	hr.Status.Conditions = []metav1.Condition{
+		{Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "ok"},
+	}
+
+	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	wc := findCondition(app.GetConditions(), "WorkloadsReady")
+	if wc == nil {
+		t.Fatal("expected WorkloadsReady condition")
+	}
+	if wc.Status != metav1.ConditionUnknown {
+		t.Errorf("expected WorkloadsReady=Unknown for nil Operational, got %s", wc.Status)
+	}
+
+	// Ready should NOT be overridden for unknown — prefer availability during startup
+	rc := findCondition(app.GetConditions(), "Ready")
+	if rc == nil {
+		t.Fatal("expected Ready condition")
+	}
+	if rc.Status != metav1.ConditionTrue {
+		t.Errorf("expected Ready=True when workloads unknown (pending), got %s", rc.Status)
+	}
+}
+
+func TestConvertConditions_WorkloadsReadyUnknownOnError(t *testing.T) {
+	// Create a client with only HelmRelease scheme — WorkloadMonitor List will fail
+	scheme := runtime.NewScheme()
+	_ = helmv2.AddToScheme(scheme)
+	// Deliberately NOT registering cozyv1alpha1 so that List returns an error
+
+	c := fake.NewClientBuilder().WithScheme(scheme).Build()
+	r := NewREST(c, nil, &config.Resource{
+		Application: config.ApplicationConfig{
+			Kind:     "PostgreSQL",
+			Plural:   "postgresqls",
+			Singular: "postgresql",
+		},
+		Release: config.ReleaseConfig{
+			Prefix: "postgresql-",
+		},
+	})
+
+	hr := makeHelmRelease("postgresql-mydb", "default")
+	hr.CreationTimestamp = metav1.Now()
+	hr.Status.Conditions = []metav1.Condition{
+		{Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "ok"},
+	}
+
+	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	wc := findCondition(app.GetConditions(), "WorkloadsReady")
+	if wc == nil {
+		t.Fatal("expected WorkloadsReady condition with Unknown status on error")
+	}
+	if wc.Status != metav1.ConditionUnknown {
+		t.Errorf("expected WorkloadsReady=Unknown, got %s", wc.Status)
+	}
+	if wc.Reason != "Error" {
+		t.Errorf("expected reason=Error, got %s", wc.Reason)
+	}
+
+	// Ready should NOT be overridden on error (fail-open: prefer availability)
+	rc := findCondition(app.GetConditions(), "Ready")
+	if rc == nil {
+		t.Fatal("expected Ready condition")
+	}
+	if rc.Status != metav1.ConditionTrue {
+		t.Errorf("expected Ready=True (fail-open on error), got %s", rc.Status)
+	}
+}
+
+
diff --git a/pkg/registry/apps/application/rest_watch_test.go b/pkg/registry/apps/application/rest_watch_test.go
new file mode 100644
index 00000000..8fe2a04a
--- /dev/null
+++ b/pkg/registry/apps/application/rest_watch_test.go
@@ -0,0 +1,223 @@
+package application
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+	appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
+	"github.com/cozystack/cozystack/pkg/config"
+	helmv2 "github.com/fluxcd/helm-controller/api/v2"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/utils/ptr"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+)
+
+func TestWmResultChan_NilWatcher(t *testing.T) {
+	ch := wmResultChan(nil)
+	if ch != nil {
+		t.Error("expected nil channel for nil watcher")
+	}
+}
+
+func TestWmResultChan_ValidWatcher(t *testing.T) {
+	fw := watch.NewFake()
+	ch := wmResultChan(fw)
+	if ch == nil {
+		t.Error("expected non-nil channel for valid watcher")
+	}
+	fw.Stop()
+}
+
+// TestWatchIntegration_WorkloadMonitorTriggersModifiedEvent verifies the
+// full path: WM event → label lookup → HelmRelease Get → Application conversion.
+func TestWatchIntegration_WorkloadMonitorTriggersModifiedEvent(t *testing.T) {
+	scheme := runtime.NewScheme()
+	_ = cozyv1alpha1.AddToScheme(scheme)
+	_ = helmv2.AddToScheme(scheme)
+
+	hr := &helmv2.HelmRelease{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "postgresql-mydb",
+			Namespace: "default",
+			Labels: map[string]string{
+				ApplicationKindLabel:  "PostgreSQL",
+				ApplicationGroupLabel: "apps.cozystack.io",
+				ApplicationNameLabel:  "mydb",
+			},
+		},
+	}
+	hr.Status.Conditions = []metav1.Condition{
+		{Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "ok"},
+	}
+
+	wm := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mon-1",
+			Namespace: "default",
+			Labels: map[string]string{
+				appsv1alpha1.ApplicationKindLabel:  "PostgreSQL",
+				appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io",
+				appsv1alpha1.ApplicationNameLabel:  "mydb",
+			},
+		},
+		Status: cozyv1alpha1.WorkloadMonitorStatus{
+			Operational: ptr.To(false),
+		},
+	}
+
+	c := fake.NewClientBuilder().WithScheme(scheme).WithRuntimeObjects(hr, wm).Build()
+
+	r := newTestRESTWithSchemesFromClient(c)
+
+	// Simulate the Watch goroutine path: extract app name from WM labels,
+	// construct HelmRelease name, look up HR, convert to Application
+	wmAppName := wm.Labels[ApplicationNameLabel]
+	hrName := r.releaseConfig.Prefix + wmAppName
+
+	foundHR := &helmv2.HelmRelease{}
+	if err := c.Get(context.TODO(), types.NamespacedName{Namespace: "default", Name: hrName}, foundHR); err != nil {
+		t.Fatalf("failed to get HelmRelease: %v", err)
+	}
+	app, err := r.ConvertHelmReleaseToApplication(context.TODO(), foundHR)
+	if err != nil {
+		t.Fatalf("failed to convert: %v", err)
+	}
+	if app.Name != "mydb" {
+		t.Errorf("expected app name 'mydb', got %q", app.Name)
+	}
+
+	// Verify WorkloadsReady is False due to non-operational WM
+	wc := findCondition(app.GetConditions(), "WorkloadsReady")
+	if wc == nil {
+		t.Fatal("expected WorkloadsReady condition")
+	}
+	if wc.Status != metav1.ConditionFalse {
+		t.Errorf("expected WorkloadsReady=False, got %s", wc.Status)
+	}
+}
+
+// TestWatchIntegration_MonitorDeletionDropsWorkloadsReady verifies that when a
+// WorkloadMonitor is deleted, the Application's WorkloadsReady condition
+// disappears. Ready condition always reflects HelmRelease state regardless.
+func TestWatchIntegration_MonitorDeletionDropsWorkloadsReady(t *testing.T) {
+	scheme := runtime.NewScheme()
+	_ = cozyv1alpha1.AddToScheme(scheme)
+	_ = helmv2.AddToScheme(scheme)
+
+	hr := &helmv2.HelmRelease{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "postgresql-mydb",
+			Namespace: "default",
+			Labels: map[string]string{
+				ApplicationKindLabel:  "PostgreSQL",
+				ApplicationGroupLabel: "apps.cozystack.io",
+				ApplicationNameLabel:  "mydb",
+			},
+		},
+	}
+	hr.Status.Conditions = []metav1.Condition{
+		{Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "ok"},
+	}
+
+	nonOpMonitor := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mon-1",
+			Namespace: "default",
+			Labels: map[string]string{
+				appsv1alpha1.ApplicationKindLabel:  "PostgreSQL",
+				appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io",
+				appsv1alpha1.ApplicationNameLabel:  "mydb",
+			},
+		},
+		Status: cozyv1alpha1.WorkloadMonitorStatus{
+			Operational: ptr.To(false),
+		},
+	}
+
+	c := fake.NewClientBuilder().WithScheme(scheme).WithRuntimeObjects(hr, nonOpMonitor).Build()
+	r := newTestRESTWithSchemesFromClient(c)
+
+	// Step 1: With non-operational monitor, WorkloadsReady=False, Ready=True
+	app1, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	wc1 := findCondition(app1.GetConditions(), "WorkloadsReady")
+	if wc1 == nil || wc1.Status != metav1.ConditionFalse {
+		t.Fatalf("expected WorkloadsReady=False with non-operational monitor, got %v", wc1)
+	}
+	rc1 := findCondition(app1.GetConditions(), "Ready")
+	if rc1 == nil || rc1.Status != metav1.ConditionTrue {
+		t.Fatalf("expected Ready=True (reflects HelmRelease), got %v", rc1)
+	}
+
+	// Step 2: Delete the monitor
+	if err := c.Delete(context.TODO(), nonOpMonitor); err != nil {
+		t.Fatalf("failed to delete monitor: %v", err)
+	}
+
+	// Step 3: WorkloadsReady should disappear, Ready stays True
+	app2, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	wc2 := findCondition(app2.GetConditions(), "WorkloadsReady")
+	if wc2 != nil {
+		t.Error("expected no WorkloadsReady condition after monitor deletion")
+	}
+	rc2 := findCondition(app2.GetConditions(), "Ready")
+	if rc2 == nil {
+		t.Fatal("expected Ready condition")
+	}
+	if rc2.Status != metav1.ConditionTrue {
+		t.Errorf("expected Ready=True after monitor deletion, got %s", rc2.Status)
+	}
+}
+
+// TestWatchIntegration_WMWatcherCloseProducesNilChannel verifies that
+// after wmWatcher is set to nil, wmResultChan returns nil channel.
+func TestWatchIntegration_WMWatcherCloseProducesNilChannel(t *testing.T) {
+	fw := watch.NewFake()
+	ch := wmResultChan(fw)
+	if ch == nil {
+		t.Fatal("expected non-nil channel before close")
+	}
+
+	fw.Stop()
+
+	timeout := time.After(time.Second)
+	for {
+		select {
+		case _, ok := <-ch:
+			if !ok {
+				var nilWatcher watch.Interface
+				nilCh := wmResultChan(nilWatcher)
+				if nilCh != nil {
+					t.Error("expected nil channel after watcher set to nil")
+				}
+				return
+			}
+		case <-timeout:
+			t.Fatal("timeout waiting for watcher channel to close")
+		}
+	}
+}
+
+func newTestRESTWithSchemesFromClient(c client.Client) *REST {
+	return NewREST(c, nil, &config.Resource{
+		Application: config.ApplicationConfig{
+			Kind:     "PostgreSQL",
+			Plural:   "postgresqls",
+			Singular: "postgresql",
+		},
+		Release: config.ReleaseConfig{
+			Prefix: "postgresql-",
+		},
+	})
+}
diff --git a/pkg/registry/apps/application/rest_workloads_test.go b/pkg/registry/apps/application/rest_workloads_test.go
new file mode 100644
index 00000000..30dd85c6
--- /dev/null
+++ b/pkg/registry/apps/application/rest_workloads_test.go
@@ -0,0 +1,342 @@
+package application
+
+import (
+	"context"
+	"testing"
+
+	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+	appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
+	"github.com/cozystack/cozystack/pkg/config"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/utils/ptr"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	helmv2 "github.com/fluxcd/helm-controller/api/v2"
+)
+
+func newTestRESTWithSchemes(objs ...runtime.Object) *REST {
+	scheme := runtime.NewScheme()
+	_ = cozyv1alpha1.AddToScheme(scheme)
+	_ = helmv2.AddToScheme(scheme)
+
+	builder := fake.NewClientBuilder().WithScheme(scheme)
+	for _, obj := range objs {
+		builder = builder.WithRuntimeObjects(obj)
+	}
+	c := builder.Build()
+
+	return NewREST(c, nil, &config.Resource{
+		Application: config.ApplicationConfig{
+			Kind:     "PostgreSQL",
+			Plural:   "postgresqls",
+			Singular: "postgresql",
+		},
+		Release: config.ReleaseConfig{
+			Prefix: "postgresql-",
+		},
+	})
+}
+
+func TestGetWorkloadsOperational_NoMonitors(t *testing.T) {
+	r := newTestRESTWithSchemes()
+	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if ws.found {
+		t.Error("expected found=false when no monitors exist")
+	}
+	if !ws.operational {
+		t.Error("expected operational=true when no monitors exist")
+	}
+}
+
+func TestGetWorkloadsOperational_AllOperational(t *testing.T) {
+	m1 := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mon-1",
+			Namespace: "default",
+			Labels: map[string]string{
+				appsv1alpha1.ApplicationKindLabel:  "PostgreSQL",
+				appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io",
+				appsv1alpha1.ApplicationNameLabel:  "mydb",
+			},
+		},
+		Status: cozyv1alpha1.WorkloadMonitorStatus{
+			Operational: ptr.To(true),
+		},
+	}
+	m2 := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mon-2",
+			Namespace: "default",
+			Labels: map[string]string{
+				appsv1alpha1.ApplicationKindLabel:  "PostgreSQL",
+				appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io",
+				appsv1alpha1.ApplicationNameLabel:  "mydb",
+			},
+		},
+		Status: cozyv1alpha1.WorkloadMonitorStatus{
+			Operational: ptr.To(true),
+		},
+	}
+
+	r := newTestRESTWithSchemes(m1, m2)
+	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !ws.found {
+		t.Error("expected found=true")
+	}
+	if !ws.operational {
+		t.Error("expected operational=true when all monitors are operational")
+	}
+}
+
+func TestGetWorkloadsOperational_SomeNotOperational(t *testing.T) {
+	m1 := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mon-1",
+			Namespace: "default",
+			Labels: map[string]string{
+				appsv1alpha1.ApplicationKindLabel:  "PostgreSQL",
+				appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io",
+				appsv1alpha1.ApplicationNameLabel:  "mydb",
+			},
+		},
+		Status: cozyv1alpha1.WorkloadMonitorStatus{
+			Operational: ptr.To(true),
+		},
+	}
+	m2 := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mon-2",
+			Namespace: "default",
+			Labels: map[string]string{
+				appsv1alpha1.ApplicationKindLabel:  "PostgreSQL",
+				appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io",
+				appsv1alpha1.ApplicationNameLabel:  "mydb",
+			},
+		},
+		Status: cozyv1alpha1.WorkloadMonitorStatus{
+			Operational: ptr.To(false),
+		},
+	}
+
+	r := newTestRESTWithSchemes(m1, m2)
+	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !ws.found {
+		t.Error("expected found=true")
+	}
+	if ws.operational {
+		t.Error("expected operational=false when at least one monitor is not operational")
+	}
+}
+
+func TestGetWorkloadsOperational_OperationalNil(t *testing.T) {
+	m := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mon-1",
+			Namespace: "default",
+			Labels: map[string]string{
+				appsv1alpha1.ApplicationKindLabel:  "PostgreSQL",
+				appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io",
+				appsv1alpha1.ApplicationNameLabel:  "mydb",
+			},
+		},
+		Status: cozyv1alpha1.WorkloadMonitorStatus{
+			Operational: nil, // Not yet reconciled
+		},
+	}
+
+	r := newTestRESTWithSchemes(m)
+	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !ws.found {
+		t.Error("expected found=true")
+	}
+	if !ws.unknown {
+		t.Error("expected unknown=true when Operational is nil")
+	}
+}
+
+func TestGetWorkloadsOperational_MixedNilAndOperational(t *testing.T) {
+	m1 := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mon-1",
+			Namespace: "default",
+			Labels: map[string]string{
+				appsv1alpha1.ApplicationKindLabel:  "PostgreSQL",
+				appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io",
+				appsv1alpha1.ApplicationNameLabel:  "mydb",
+			},
+		},
+		Status: cozyv1alpha1.WorkloadMonitorStatus{
+			Operational: ptr.To(true),
+		},
+	}
+	m2 := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mon-2",
+			Namespace: "default",
+			Labels: map[string]string{
+				appsv1alpha1.ApplicationKindLabel:  "PostgreSQL",
+				appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io",
+				appsv1alpha1.ApplicationNameLabel:  "mydb",
+			},
+		},
+		Status: cozyv1alpha1.WorkloadMonitorStatus{
+			Operational: nil,
+		},
+	}
+
+	r := newTestRESTWithSchemes(m1, m2)
+	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !ws.unknown {
+		t.Error("expected unknown=true when at least one monitor has nil Operational")
+	}
+}
+
+func TestGetWorkloadsOperational_MixedFailedAndPending(t *testing.T) {
+	m1 := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mon-1",
+			Namespace: "default",
+			Labels: map[string]string{
+				appsv1alpha1.ApplicationKindLabel:  "PostgreSQL",
+				appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io",
+				appsv1alpha1.ApplicationNameLabel:  "mydb",
+			},
+		},
+		Status: cozyv1alpha1.WorkloadMonitorStatus{
+			Operational: ptr.To(false), // Confirmed failure
+		},
+	}
+	m2 := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mon-2",
+			Namespace: "default",
+			Labels: map[string]string{
+				appsv1alpha1.ApplicationKindLabel:  "PostgreSQL",
+				appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io",
+				appsv1alpha1.ApplicationNameLabel:  "mydb",
+			},
+		},
+		Status: cozyv1alpha1.WorkloadMonitorStatus{
+			Operational: nil, // Not yet reconciled
+		},
+	}
+
+	r := newTestRESTWithSchemes(m1, m2)
+	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if ws.operational {
+		t.Error("expected operational=false when at least one monitor is explicitly failed")
+	}
+	if !ws.unknown {
+		t.Error("expected unknown=true when at least one monitor has nil Operational")
+	}
+}
+
+func TestConvertConditions_MixedFailedAndPendingShowsFalse(t *testing.T) {
+	mFailed := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mon-failed",
+			Namespace: "default",
+			Labels: map[string]string{
+				appsv1alpha1.ApplicationKindLabel:  "PostgreSQL",
+				appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io",
+				appsv1alpha1.ApplicationNameLabel:  "mydb",
+			},
+		},
+		Status: cozyv1alpha1.WorkloadMonitorStatus{
+			Operational: ptr.To(false),
+		},
+	}
+	mPending := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mon-pending",
+			Namespace: "default",
+			Labels: map[string]string{
+				appsv1alpha1.ApplicationKindLabel:  "PostgreSQL",
+				appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io",
+				appsv1alpha1.ApplicationNameLabel:  "mydb",
+			},
+		},
+		Status: cozyv1alpha1.WorkloadMonitorStatus{
+			Operational: nil,
+		},
+	}
+
+	r := newTestRESTWithSchemes(mFailed, mPending)
+	hr := &helmv2.HelmRelease{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "postgresql-mydb",
+			Namespace: "default",
+			Labels: map[string]string{
+				ApplicationKindLabel:  "PostgreSQL",
+				ApplicationGroupLabel: "apps.cozystack.io",
+				ApplicationNameLabel:  "mydb",
+			},
+		},
+	}
+	hr.Status.Conditions = []metav1.Condition{
+		{Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "ok"},
+	}
+
+	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	// Concrete failure should take priority over unknown
+	wc := findCondition(app.GetConditions(), "WorkloadsReady")
+	if wc == nil {
+		t.Fatal("expected WorkloadsReady condition")
+	}
+	if wc.Status != metav1.ConditionFalse {
+		t.Errorf("expected WorkloadsReady=False (failure takes priority over unknown), got %s", wc.Status)
+	}
+}
+
+func TestGetWorkloadsOperational_DifferentApp_NotFound(t *testing.T) {
+	m := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mon-1",
+			Namespace: "default",
+			Labels: map[string]string{
+				appsv1alpha1.ApplicationKindLabel:  "PostgreSQL",
+				appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io",
+				appsv1alpha1.ApplicationNameLabel:  "other-db",
+			},
+		},
+		Status: cozyv1alpha1.WorkloadMonitorStatus{
+			Operational: ptr.To(false),
+		},
+	}
+
+	r := newTestRESTWithSchemes(m)
+	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if ws.found {
+		t.Error("expected found=false for different app name")
+	}
+	if !ws.operational {
+		t.Error("expected operational=true when no matching monitors found")
+	}
+}
+

From dc3387c635eef5ee795c31a0909910eed052dd5f Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 13 Apr 2026 22:27:01 +0300
Subject: [PATCH 458/666] fix(workload-monitor): use fresh spec for MinReplicas
 check on retry

Inside the RetryOnConflict block, derive the operational status from
fresh.Spec.MinReplicas instead of the stale monitor.Spec.MinReplicas
so that concurrent spec updates observed by the retry are respected.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 internal/controller/workloadmonitor_controller.go | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/internal/controller/workloadmonitor_controller.go b/internal/controller/workloadmonitor_controller.go
index 0cd3103e..9a967e65 100644
--- a/internal/controller/workloadmonitor_controller.go
+++ b/internal/controller/workloadmonitor_controller.go
@@ -388,9 +388,11 @@ func (r *WorkloadMonitorReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		fresh.Status.ObservedReplicas = observedReplicas
 		fresh.Status.AvailableReplicas = availableReplicas
 
-		// Default to operational = true, but check MinReplicas if set
+		// Default to operational = true, but check MinReplicas if set.
+		// Use fresh.Spec to avoid making decisions based on a stale cached copy
+		// when the spec was updated between the initial read and this retry.
 		fresh.Status.Operational = pointer.Bool(true)
-		if monitor.Spec.MinReplicas != nil && availableReplicas < *monitor.Spec.MinReplicas {
+		if fresh.Spec.MinReplicas != nil && availableReplicas < *fresh.Spec.MinReplicas {
 			fresh.Status.Operational = pointer.Bool(false)
 		}
 		return r.Status().Update(ctx, fresh)

From d369b64d718beee24ff4dc57582af5710c05d1d5 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 13 Apr 2026 22:42:11 +0300
Subject: [PATCH 459/666] fix(application): address review feedback for
 WorkloadMonitor integration

Tenant applications live in a child namespace computed from the Tenant
name, not in the HelmRelease's namespace. Scope the WorkloadMonitor
watch cluster-wide when kindName is Tenant and reverse-map WM events
back to the owning HelmRelease via computeTenantNamespace. The
condition-enrichment path now looks up monitors in the computed child
namespace too, so WorkloadsReady is populated for Tenants.

Buffer WorkloadMonitor events that arrive before the initial-events-end
bookmark and replay them once the bookmark is emitted, to preserve the
watch-list contract while not dropping workload-state transitions that
happen during the snapshot window.

Pass the fresh WorkloadMonitor object from the watch event into the
conversion path so WorkloadsReady reflects the state that triggered
the event, even when the cache client is lagging behind the watch
client.

Derive WorkloadsReady.LastTransitionTime from a stable source
(max of HelmRelease creation and condition timestamps, plus monitor
timestamps) instead of metav1.Now(), so repeated conversions of the
same underlying state produce identical timestamps.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 pkg/registry/apps/application/rest.go         | 196 +++++++++++++++---
 .../apps/application/rest_conditions_test.go  |  14 +-
 .../apps/application/rest_validation_test.go  |   4 +-
 .../apps/application/rest_watch_test.go       |   4 +-
 .../apps/application/rest_workloads_test.go   |  16 +-
 5 files changed, 184 insertions(+), 50 deletions(-)

diff --git a/pkg/registry/apps/application/rest.go b/pkg/registry/apps/application/rest.go
index 583a4a8c..0728ea13 100644
--- a/pkg/registry/apps/application/rest.go
+++ b/pkg/registry/apps/application/rest.go
@@ -704,13 +704,19 @@ func (r *REST) Watch(ctx context.Context, options *metainternalversion.ListOptio
 	}
 	customW.underlying = helmWatcher
 
-	// Start watch on WorkloadMonitor to detect pod readiness changes
+	// Start watch on WorkloadMonitor to detect pod readiness changes.
+	// For Tenant applications the WorkloadMonitor lives in a computed child
+	// namespace (see computeTenantNamespace), not in the HelmRelease namespace,
+	// so scoping the watch to `namespace` would miss all events. Use a
+	// cluster-wide watch in that case — label selectors still restrict the
+	// stream to the relevant kind/group.
 	wmLabelSelector := labels.NewSelector().Add(*appKindReq, *appGroupReq)
 	wmList := &cozyv1alpha1.WorkloadMonitorList{}
-	wmWatcher, err := r.w.Watch(ctx, wmList, &client.ListOptions{
-		Namespace:     namespace,
-		LabelSelector: wmLabelSelector,
-	})
+	wmListOpts := &client.ListOptions{LabelSelector: wmLabelSelector}
+	if r.kindName != "Tenant" {
+		wmListOpts.Namespace = namespace
+	}
+	wmWatcher, err := r.w.Watch(ctx, wmList, wmListOpts)
 	if err != nil {
 		klog.Warningf("Failed to set up WorkloadMonitor watch, workload status changes won't trigger events: %v", err)
 		// Non-fatal: proceed without WorkloadMonitor watch
@@ -731,6 +737,16 @@ func (r *REST) Watch(ctx context.Context, options *metainternalversion.ListOptio
 		initialEventsEndSent := !sendInitialEvents // If not sendInitialEvents, consider it already sent
 		var lastResourceVersion string
 
+		// Buffer of WorkloadMonitor events that arrived before the initial
+		// snapshot finished. The watch-list contract requires the stream to
+		// deliver all ADDED events followed by the initial-events-end bookmark
+		// before any live updates, so we hold WM-triggered Modified events and
+		// replay them once the bookmark has been emitted. Without this, a
+		// workload whose status flips during the snapshot window (after the
+		// Application ADDED but before the bookmark) and then stops changing
+		// would leave the client with a stale WorkloadsReady forever.
+		var pendingWMEvents []watch.Event
+
 		// Get the starting resourceVersion from options
 		// If client provides resourceVersion (e.g., from a previous List), we should skip
 		// objects with resourceVersion <= startingRV (client already has them)
@@ -741,6 +757,19 @@ func (r *REST) Watch(ctx context.Context, options *metainternalversion.ListOptio
 			}
 		}
 
+		drainPendingWMEvents := func() {
+			for _, ev := range pendingWMEvents {
+				select {
+				case customW.resultChan <- ev:
+				case <-customW.stopChan:
+					return
+				case <-ctx.Done():
+					return
+				}
+			}
+			pendingWMEvents = nil
+		}
+
 		// Helper function to send initial-events-end bookmark
 		sendInitialEventsEndBookmark := func() {
 			if initialEventsEndSent {
@@ -765,8 +794,11 @@ func (r *REST) Watch(ctx context.Context, options *metainternalversion.ListOptio
 			select {
 			case customW.resultChan <- bookmarkEvent:
 			case <-customW.stopChan:
+				return
 			case <-ctx.Done():
+				return
 			}
+			drainPendingWMEvents()
 		}
 
 		// Process watch events
@@ -794,8 +826,10 @@ func (r *REST) Watch(ctx context.Context, options *metainternalversion.ListOptio
 							APIVersion: appsv1alpha1.SchemeGroupVersion.String(),
 							Kind:       r.kindName,
 						}
+						justFlipped := false
 						if !initialEventsEndSent {
 							initialEventsEndSent = true
+							justFlipped = true
 							bookmarkApp.SetAnnotations(map[string]string{
 								"k8s.io/initial-events-end": "true",
 							})
@@ -812,6 +846,9 @@ func (r *REST) Watch(ctx context.Context, options *metainternalversion.ListOptio
 						case <-ctx.Done():
 							return
 						}
+						if justFlipped {
+							drainPendingWMEvents()
+						}
 					}
 					continue
 				}
@@ -911,12 +948,6 @@ func (r *REST) Watch(ctx context.Context, options *metainternalversion.ListOptio
 					}
 					continue
 				}
-				// Don't emit WM-triggered events until the initial snapshot is
-				// complete — the watch-list contract requires all ADDED events
-				// followed by the initial-events-end bookmark before any live updates.
-				if !initialEventsEndSent {
-					continue
-				}
 				wm, ok := wmEvent.Object.(*cozyv1alpha1.WorkloadMonitor)
 				if !ok {
 					continue
@@ -937,12 +968,37 @@ func (r *REST) Watch(ctx context.Context, options *metainternalversion.ListOptio
 				if resourceName != "" && wmAppName != resourceName {
 					continue
 				}
-				hr := &helmv2.HelmRelease{}
-				if err := r.c.Get(ctx, client.ObjectKey{Namespace: wm.Namespace, Name: hrName}, hr); err != nil {
-					klog.V(4).Infof("Cannot find HelmRelease %s/%s for WorkloadMonitor event: %v", wm.Namespace, hrName, err)
+
+				// Locate the owning HelmRelease. For most application kinds the
+				// WorkloadMonitor and its HelmRelease live in the same namespace,
+				// but Tenant workloads live in a child namespace (see
+				// computeTenantNamespace) while the HelmRelease remains in the
+				// parent/requested namespace — so the WM-to-HR namespace mapping
+				// differs.
+				hrNS := wm.Namespace
+				if r.kindName == "Tenant" {
+					hrNS = namespace
+					// Filter out WM events whose child namespace does not
+					// correspond to the Tenant in our watched namespace, since
+					// the cluster-wide WM watch delivers events for all tenants.
+					if r.computeTenantNamespace(namespace, wmAppName) != wm.Namespace {
+						continue
+					}
+					if !fieldFilter.MatchesNamespace(hrNS) {
+						continue
+					}
+				} else if !fieldFilter.MatchesNamespace(hrNS) {
 					continue
 				}
-				app, err := r.ConvertHelmReleaseToApplication(ctx, hr)
+				hr := &helmv2.HelmRelease{}
+				if err := r.c.Get(ctx, client.ObjectKey{Namespace: hrNS, Name: hrName}, hr); err != nil {
+					klog.V(4).Infof("Cannot find HelmRelease %s/%s for WorkloadMonitor event: %v", hrNS, hrName, err)
+					continue
+				}
+				// Pass the fresh WorkloadMonitor so conversion uses the latest
+				// operational status even if the cache (r.c) has not yet
+				// observed this watch event.
+				app, err := r.ConvertHelmReleaseToApplicationWithMonitor(ctx, hr, wm)
 				if err != nil {
 					klog.V(4).Infof("Error converting HelmRelease for WorkloadMonitor event: %v", err)
 					continue
@@ -961,9 +1017,17 @@ func (r *REST) Watch(ctx context.Context, options *metainternalversion.ListOptio
 				// Use the WorkloadMonitor's ResourceVersion for the emitted event
 				// so clients see a monotonically increasing RV and don't skip this update.
 				app.SetResourceVersion(wm.GetResourceVersion())
+				outEvent := watch.Event{Type: watch.Modified, Object: &app}
+				// Buffer WM-triggered events that arrive before the
+				// initial-events-end bookmark. They will be replayed in order
+				// immediately after the bookmark is emitted.
+				if !initialEventsEndSent {
+					pendingWMEvents = append(pendingWMEvents, outEvent)
+					continue
+				}
 				lastResourceVersion = wm.GetResourceVersion()
 				select {
-				case customW.resultChan <- watch.Event{Type: watch.Modified, Object: &app}:
+				case customW.resultChan <- outEvent:
 				case <-customW.stopChan:
 					return
 				case <-ctx.Done():
@@ -1094,12 +1158,21 @@ func filterPrefixedMap(original map[string]string, prefix string) map[string]str
 	return processed
 }
 
-// ConvertHelmReleaseToApplication converts a HelmRelease to an Application
+// ConvertHelmReleaseToApplication converts a HelmRelease to an Application.
 func (r *REST) ConvertHelmReleaseToApplication(ctx context.Context, hr *helmv2.HelmRelease) (appsv1alpha1.Application, error) {
+	return r.ConvertHelmReleaseToApplicationWithMonitor(ctx, hr, nil)
+}
+
+// ConvertHelmReleaseToApplicationWithMonitor converts a HelmRelease to an
+// Application, optionally overriding the cached copy of a WorkloadMonitor with
+// a fresher version received from the watch client. This prevents the emitted
+// Application object from carrying stale WorkloadsReady data when r.c (cache)
+// lags behind r.w (watch).
+func (r *REST) ConvertHelmReleaseToApplicationWithMonitor(ctx context.Context, hr *helmv2.HelmRelease, freshMonitor *cozyv1alpha1.WorkloadMonitor) (appsv1alpha1.Application, error) {
 	klog.V(6).Infof("Converting HelmRelease to Application for resource %s", hr.GetName())
 
 	// Convert HelmRelease struct to Application struct
-	app, err := r.convertHelmReleaseToApplication(ctx, hr)
+	app, err := r.convertHelmReleaseToApplication(ctx, hr, freshMonitor)
 	if err != nil {
 		klog.Errorf("Error converting from HelmRelease to Application: %v", err)
 		return appsv1alpha1.Application{}, err
@@ -1212,8 +1285,11 @@ func (r *REST) validateTenantNamespaceLength(currentNamespace, tenantName string
 	return allErrs
 }
 
-// convertHelmReleaseToApplication implements the actual conversion logic
-func (r *REST) convertHelmReleaseToApplication(ctx context.Context, hr *helmv2.HelmRelease) (appsv1alpha1.Application, error) {
+// convertHelmReleaseToApplication implements the actual conversion logic.
+// The optional freshMonitor is used to override the cache copy of a
+// WorkloadMonitor when a newer version was delivered via the watch client —
+// see ConvertHelmReleaseToApplicationWithMonitor for the rationale.
+func (r *REST) convertHelmReleaseToApplication(ctx context.Context, hr *helmv2.HelmRelease, freshMonitor *cozyv1alpha1.WorkloadMonitor) (appsv1alpha1.Application, error) {
 	// Filter out internal keys (starting with "_") from spec
 	filteredSpec := filterInternalKeys(hr.Spec.Values)
 
@@ -1250,28 +1326,49 @@ func (r *REST) convertHelmReleaseToApplication(ctx context.Context, hr *helmv2.H
 			})
 		}
 	}
-	// Enrich conditions with WorkloadMonitor operational status
-	ws, wsErr := r.getWorkloadsOperational(ctx, hr.Namespace, app.Name)
+	// Enrich conditions with WorkloadMonitor operational status.
+	// Tenant workloads live in a child namespace (computed from the Tenant name),
+	// not in the same namespace as the owning HelmRelease — look there instead.
+	workloadsNS := hr.Namespace
+	if r.kindName == "Tenant" {
+		workloadsNS = r.computeTenantNamespace(hr.Namespace, app.Name)
+	}
+	ws, wsErr := r.getWorkloadsOperational(ctx, workloadsNS, app.Name, freshMonitor)
+	// Derive a stable LastTransitionTime: use the owning HelmRelease's own
+	// condition update time (or CreationTimestamp as a floor) so that repeated
+	// conversions of the same underlying state produce identical timestamps.
+	wrTransition := hr.CreationTimestamp
+	for _, c := range hr.GetConditions() {
+		if c.LastTransitionTime.After(wrTransition.Time) {
+			wrTransition = c.LastTransitionTime
+		}
+	}
+	if ws.transitionTime.After(wrTransition.Time) {
+		wrTransition = ws.transitionTime
+	}
+	if wrTransition.IsZero() {
+		// Fallback for objects that somehow have no timestamps at all
+		// (e.g. hand-crafted test fixtures). In production HelmReleases
+		// always carry a CreationTimestamp, so the stable branch above
+		// is used.
+		wrTransition = metav1.Now()
+	}
 	if wsErr != nil {
 		// Fail-open: if we can't query WorkloadMonitors (e.g., informer cache not ready),
 		// don't override Ready. Prefer operational availability over safety.
 		// The WorkloadsReady=Unknown condition still signals the issue to the user.
-		klog.Warningf("Failed to check workload monitors for %s/%s: %v", hr.Namespace, app.Name, wsErr)
+		klog.Warningf("Failed to check workload monitors for %s/%s: %v", workloadsNS, app.Name, wsErr)
 		conditions = append(conditions, metav1.Condition{
 			Type:               "WorkloadsReady",
 			Status:             metav1.ConditionUnknown,
-			LastTransitionTime: metav1.Now(),
+			LastTransitionTime: wrTransition,
 			Reason:             "Error",
 			Message:            fmt.Sprintf("Failed to check workload status: %v", wsErr),
 		})
 	} else if ws.found {
-		// LastTransitionTime is set to the current time because the Application
-		// resource is virtual (computed on-the-fly from HelmRelease). There is no
-		// persistent condition state to track actual transitions. This is consistent
-		// with how computed/virtual API resources work in Kubernetes.
 		workloadsCondition := metav1.Condition{
 			Type:               "WorkloadsReady",
-			LastTransitionTime: metav1.Now(),
+			LastTransitionTime: wrTransition,
 			Reason:             "WorkloadMonitorCheck",
 		}
 		switch {
@@ -1321,11 +1418,20 @@ type workloadsStatus struct {
 	operational bool
 	found       bool
 	unknown     bool // true when at least one monitor has nil Operational (not yet reconciled)
+	// transitionTime is the most recent metadata update time across the
+	// matching monitors. Used as WorkloadsReady.LastTransitionTime so that
+	// repeated conversions for the same underlying state produce stable
+	// timestamps (preserving the Kubernetes contract that identical
+	// resource versions represent identical content).
+	transitionTime metav1.Time
 }
 
 // getWorkloadsOperational checks WorkloadMonitor resources for an application and returns
 // aggregated operational status. If no monitors exist, returns found=false.
-func (r *REST) getWorkloadsOperational(ctx context.Context, namespace, appName string) (workloadsStatus, error) {
+// When freshOverride is non-nil, its status replaces the cached copy for the
+// corresponding monitor — this keeps the result consistent with watch events
+// when the cache (r.c) lags behind the watch client (r.w).
+func (r *REST) getWorkloadsOperational(ctx context.Context, namespace, appName string, freshOverride *cozyv1alpha1.WorkloadMonitor) (workloadsStatus, error) {
 	monitors := &cozyv1alpha1.WorkloadMonitorList{}
 	if err := r.c.List(ctx, monitors,
 		client.InNamespace(namespace),
@@ -1337,19 +1443,47 @@ func (r *REST) getWorkloadsOperational(ctx context.Context, namespace, appName s
 	); err != nil {
 		return workloadsStatus{}, err
 	}
+	// Ensure the freshOverride is represented in the aggregation even when
+	// the cache has not yet observed it (brand-new resource) or is behind.
+	replaced := false
+	if freshOverride != nil {
+		for i := range monitors.Items {
+			if monitors.Items[i].UID == freshOverride.UID ||
+				(monitors.Items[i].Name == freshOverride.Name && monitors.Items[i].Namespace == freshOverride.Namespace) {
+				monitors.Items[i] = *freshOverride
+				replaced = true
+				break
+			}
+		}
+		if !replaced {
+			monitors.Items = append(monitors.Items, *freshOverride)
+		}
+	}
 	if len(monitors.Items) == 0 {
 		return workloadsStatus{operational: true, found: false}, nil
 	}
 	operational := true
 	unknown := false
+	var latest metav1.Time
 	for _, m := range monitors.Items {
 		if m.Status.Operational == nil {
 			unknown = true
 		} else if !*m.Status.Operational {
 			operational = false
 		}
+		// Pick the most recent monitor mtime as a stable transition time.
+		if t := latestMonitorTime(&m); t.After(latest.Time) {
+			latest = t
+		}
 	}
-	return workloadsStatus{operational: operational, found: true, unknown: unknown}, nil
+	return workloadsStatus{operational: operational, found: true, unknown: unknown, transitionTime: latest}, nil
+}
+
+// latestMonitorTime returns the most recent timestamp associated with a
+// WorkloadMonitor — currently only the object creation time is guaranteed.
+// Status does not carry a transition time, so we fall back to CreationTimestamp.
+func latestMonitorTime(m *cozyv1alpha1.WorkloadMonitor) metav1.Time {
+	return m.CreationTimestamp
 }
 
 // convertApplicationToHelmRelease implements the actual conversion logic
diff --git a/pkg/registry/apps/application/rest_conditions_test.go b/pkg/registry/apps/application/rest_conditions_test.go
index dbb99d52..185f59b2 100644
--- a/pkg/registry/apps/application/rest_conditions_test.go
+++ b/pkg/registry/apps/application/rest_conditions_test.go
@@ -61,7 +61,7 @@ func TestConvertConditions_WorkloadsReadyAdded(t *testing.T) {
 		{Type: "Released", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "Released"},
 	}
 
-	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -107,7 +107,7 @@ func TestConvertConditions_ReadyNotOverriddenWhenWorkloadsNotReady(t *testing.T)
 		{Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "Release applied"},
 	}
 
-	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -139,7 +139,7 @@ func TestConvertConditions_NoOverrideWhenNoMonitors(t *testing.T) {
 		{Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "Release applied"},
 	}
 
-	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -181,7 +181,7 @@ func TestConvertConditions_ReadyStaysTrue_WhenAllOperational(t *testing.T) {
 		{Type: "Released", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "Released"},
 	}
 
-	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -219,7 +219,7 @@ func TestConvertConditions_WorkloadsReadyTimestampIsNonZero(t *testing.T) {
 	// No Ready condition — HR still being reconciled
 	hr.Status.Conditions = []metav1.Condition{}
 
-	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -255,7 +255,7 @@ func TestConvertConditions_WorkloadsReadyUnknownWhenNilOperational(t *testing.T)
 		{Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "ok"},
 	}
 
-	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -302,7 +302,7 @@ func TestConvertConditions_WorkloadsReadyUnknownOnError(t *testing.T) {
 		{Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "ok"},
 	}
 
-	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
diff --git a/pkg/registry/apps/application/rest_validation_test.go b/pkg/registry/apps/application/rest_validation_test.go
index 088990ce..b806161c 100644
--- a/pkg/registry/apps/application/rest_validation_test.go
+++ b/pkg/registry/apps/application/rest_validation_test.go
@@ -190,7 +190,7 @@ func TestConvertHelmReleaseToApplication_TenantNamespaceKindGate(t *testing.T) {
 			},
 		}
 
-		app, err := r.convertHelmReleaseToApplication(context.Background(), hr)
+		app, err := r.convertHelmReleaseToApplication(context.Background(), hr, nil)
 		if err != nil {
 			t.Fatalf("convertHelmReleaseToApplication: %v", err)
 		}
@@ -208,7 +208,7 @@ func TestConvertHelmReleaseToApplication_TenantNamespaceKindGate(t *testing.T) {
 			},
 		}
 
-		app, err := r.convertHelmReleaseToApplication(context.Background(), hr)
+		app, err := r.convertHelmReleaseToApplication(context.Background(), hr, nil)
 		if err != nil {
 			t.Fatalf("convertHelmReleaseToApplication: %v", err)
 		}
diff --git a/pkg/registry/apps/application/rest_watch_test.go b/pkg/registry/apps/application/rest_watch_test.go
index 8fe2a04a..93a51f3c 100644
--- a/pkg/registry/apps/application/rest_watch_test.go
+++ b/pkg/registry/apps/application/rest_watch_test.go
@@ -144,7 +144,7 @@ func TestWatchIntegration_MonitorDeletionDropsWorkloadsReady(t *testing.T) {
 	r := newTestRESTWithSchemesFromClient(c)
 
 	// Step 1: With non-operational monitor, WorkloadsReady=False, Ready=True
-	app1, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	app1, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -163,7 +163,7 @@ func TestWatchIntegration_MonitorDeletionDropsWorkloadsReady(t *testing.T) {
 	}
 
 	// Step 3: WorkloadsReady should disappear, Ready stays True
-	app2, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	app2, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
diff --git a/pkg/registry/apps/application/rest_workloads_test.go b/pkg/registry/apps/application/rest_workloads_test.go
index 30dd85c6..b706c323 100644
--- a/pkg/registry/apps/application/rest_workloads_test.go
+++ b/pkg/registry/apps/application/rest_workloads_test.go
@@ -40,7 +40,7 @@ func newTestRESTWithSchemes(objs ...runtime.Object) *REST {
 
 func TestGetWorkloadsOperational_NoMonitors(t *testing.T) {
 	r := newTestRESTWithSchemes()
-	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb")
+	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -83,7 +83,7 @@ func TestGetWorkloadsOperational_AllOperational(t *testing.T) {
 	}
 
 	r := newTestRESTWithSchemes(m1, m2)
-	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb")
+	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -126,7 +126,7 @@ func TestGetWorkloadsOperational_SomeNotOperational(t *testing.T) {
 	}
 
 	r := newTestRESTWithSchemes(m1, m2)
-	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb")
+	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -155,7 +155,7 @@ func TestGetWorkloadsOperational_OperationalNil(t *testing.T) {
 	}
 
 	r := newTestRESTWithSchemes(m)
-	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb")
+	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -198,7 +198,7 @@ func TestGetWorkloadsOperational_MixedNilAndOperational(t *testing.T) {
 	}
 
 	r := newTestRESTWithSchemes(m1, m2)
-	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb")
+	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -238,7 +238,7 @@ func TestGetWorkloadsOperational_MixedFailedAndPending(t *testing.T) {
 	}
 
 	r := newTestRESTWithSchemes(m1, m2)
-	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb")
+	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -296,7 +296,7 @@ func TestConvertConditions_MixedFailedAndPendingShowsFalse(t *testing.T) {
 		{Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "ok"},
 	}
 
-	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr)
+	app, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -328,7 +328,7 @@ func TestGetWorkloadsOperational_DifferentApp_NotFound(t *testing.T) {
 	}
 
 	r := newTestRESTWithSchemes(m)
-	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb")
+	ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}

From e6ba9817be1a42281e73dbedd68aa1ba0b2f9192 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Wed, 15 Apr 2026 19:47:25 +0500
Subject: [PATCH 460/666] [platform] Make vm-default-images opt-in, not default
 in iaas bundle
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The package imports ~320Gi of golden-image PVCs (ubuntu-noble, fedora,
debian, centos, etc.) as soon as it's installed. On small test and dev
clusters that's enough to consume the entire replicated storage pool,
after which no tenant PVCs — including the ones E2E itself provisions —
can be bound. It's also unreasonable to force that cost on every iaas
user: many deployments don't need prebuilt images at all, and the ones
that do often want to curate their own subset.

Switch the bundle entry from 'package.default' to 'package.optional.default',
matching the treatment already applied to gpu-operator directly below it.
Users who want the golden images can opt in via:

    bundles:
      enabledPackages:
        - cozystack.vm-default-images

The package, its Source, and migration 38 all stay in place — nothing
else changes for users who explicitly enable it. Users who previously
relied on the bundle auto-installing it will need to add the package
to enabledPackages on upgrade; this is called out in the release note.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/core/platform/templates/bundles/iaas.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/core/platform/templates/bundles/iaas.yaml b/packages/core/platform/templates/bundles/iaas.yaml
index 7485eb91..ced0a322 100644
--- a/packages/core/platform/templates/bundles/iaas.yaml
+++ b/packages/core/platform/templates/bundles/iaas.yaml
@@ -8,7 +8,7 @@
 {{- end -}}
 {{include "cozystack.platform.package" (list "cozystack.kubevirt" "default" $ $kubevirtComponents) }}
 {{include "cozystack.platform.package.default" (list "cozystack.kubevirt-cdi" $) }}
-{{include "cozystack.platform.package.default" (list "cozystack.vm-default-images" $) }}
+{{include "cozystack.platform.package.optional.default" (list "cozystack.vm-default-images" $) }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.gpu-operator" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.kamaji" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.capi-operator" $) }}

From 8fc82b18c0fc40a58ab2f170abecf22527e943db Mon Sep 17 00:00:00 2001
From: tym83 <6355522@gmail.com>
Date: Mon, 6 Apr 2026 20:14:59 +0500
Subject: [PATCH 461/666] Add Mattia Eleuteri (@mattia-eleuteri) as Maintainer

Ref: #2343

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

-e
Signed-off-by: tym83 <6355522@gmail.com>
---
 MAINTAINERS.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS.md b/MAINTAINERS.md
index e5c07714..d7061941 100644
--- a/MAINTAINERS.md
+++ b/MAINTAINERS.md
@@ -11,3 +11,4 @@
 | Kirill Klinchenkov | [@klinch0](https://github.com/klinch0) | Ænix | Core Maintainer |
 | Nikita Bykov | [@nbykov0](https://github.com/nbykov0) | Ænix | Maintainer of ARM and stuff |
 | Matthieu Robin | [@matthieu-robin](https://github.com/matthieu-robin) | Hidora | Managed Applications, Platform Quality & Benchmarking |
+| Mattia Eleuteri | [@mattia-eleuteri](https://github.com/mattia-eleuteri) | Hidora | CSI, Storage, Networking & Security |

From 2e6a68541135681a95ee6edf2f7adbfa4514f84b Mon Sep 17 00:00:00 2001
From: ZverGuy <maximbel2003@gmail.com>
Date: Thu, 16 Apr 2026 00:34:52 +0300
Subject: [PATCH 462/666] docs(ci): require screenshots for UI changes in PR
 template

Add a Screenshots section to the pull request template that requires
contributors to attach screenshots or screen recordings when their
changes affect the UI.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
---
 .github/PULL_REQUEST_TEMPLATE.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 7710149c..b9475846 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -13,6 +13,11 @@
 ## What this PR does
 
 
+### Screenshots
+
+<!-- REQUIRED for UI changes: attach screenshots or screen recordings demonstrating
+the visual impact of your changes. PRs with UI changes without screenshots will not be merged. -->
+
 ### Release note
 
 <!--  Write a release note:

From 9cc5deeabe390857381e7519151872ef30f4674a Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 01:10:10 +0300
Subject: [PATCH 463/666] fix(dashboard): fall back to .firstTimestamp in Event
 Time column
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

core/v1 Events populate .lastTimestamp and .firstTimestamp but leave
.eventTime null; events.k8s.io/v1 Events do the opposite. The previous
column bound to .eventTime alone and rendered 'Invalid Date' for every
Helm-generated event.

Extend createTimestampColumn with an optional second jsonPath that is
encoded as a nested reqsJsonPath fallback in the template, and use
.eventTime → .firstTimestamp for Event Time and .lastTimestamp →
.eventTime for Last Seen so both APIs render correctly.

Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../controller/dashboard/static_helpers.go    | 27 ++++++++++++++++---
 .../controller/dashboard/static_refactored.go |  9 ++++---
 2 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/internal/controller/dashboard/static_helpers.go b/internal/controller/dashboard/static_helpers.go
index 1a1018cb..db37e05b 100644
--- a/internal/controller/dashboard/static_helpers.go
+++ b/internal/controller/dashboard/static_helpers.go
@@ -650,12 +650,31 @@ func createStringColumn(name, jsonPath string) map[string]any {
 	}
 }
 
-// createTimestampColumn creates a timestamp column with custom formatting
-func createTimestampColumn(name, jsonPath string) map[string]any {
+// createTimestampColumn creates a timestamp column with custom formatting.
+// Extra jsonPaths act as ordered fallbacks: the first non-null path wins,
+// and `-` is used only when every path is null. Depth is capped at two
+// because the template parser's non-greedy matcher cannot track more than
+// one level of alternating quotes in a nested reqsJsonPath fallback.
+func createTimestampColumn(name string, jsonPaths ...string) map[string]any {
+	if len(jsonPaths) == 0 {
+		panic("createTimestampColumn requires at least one jsonPath")
+	}
+	if len(jsonPaths) > 2 {
+		panic("createTimestampColumn supports at most two jsonPaths (primary + one fallback)")
+	}
+
+	var text string
+	switch len(jsonPaths) {
+	case 1:
+		text = "{reqsJsonPath[0]['" + jsonPaths[0] + "']['-']}"
+	case 2:
+		text = "{reqsJsonPath[0]['" + jsonPaths[0] + "'][\"{reqsJsonPath[0]['" + jsonPaths[1] + "']['-']}\"]}"
+	}
+
 	return map[string]any{
 		"name":     name,
 		"type":     "factory",
-		"jsonPath": jsonPath,
+		"jsonPath": jsonPaths[0],
 		"customProps": map[string]any{
 			"disableEventBubbling": true,
 			"items": []any{
@@ -673,7 +692,7 @@ func createTimestampColumn(name, jsonPath string) map[string]any {
 							"data": map[string]any{
 								"formatter": "timestamp",
 								"id":        "time-value",
-								"text":      "{reqsJsonPath[0]['" + jsonPath + "']['-']}",
+								"text":      text,
 							},
 						},
 					},
diff --git a/internal/controller/dashboard/static_refactored.go b/internal/controller/dashboard/static_refactored.go
index a73026bc..d96bbaaa 100644
--- a/internal/controller/dashboard/static_refactored.go
+++ b/internal/controller/dashboard/static_refactored.go
@@ -224,10 +224,13 @@ func CreateAllCustomColumnsOverrides() []*dashboardv1alpha1.CustomColumnsOverrid
 			createStringColumn("Name", ".name"),
 		}),
 
-		// Factory details events
+		// Factory details events. Event Time falls back to `.firstTimestamp`
+		// because core/v1 Events (Helm, controller-runtime) populate only the
+		// legacy timestamps while events.k8s.io/v1 Events populate only
+		// `.eventTime`; taking the first non-null of the two covers both.
 		createCustomColumnsOverride("factory-details-events", []any{
-			createTimestampColumn("Last Seen", ".lastTimestamp"),
-			createTimestampColumn("Event Time", ".eventTime"),
+			createTimestampColumn("Last Seen", ".lastTimestamp", ".eventTime"),
+			createTimestampColumn("Event Time", ".eventTime", ".firstTimestamp"),
 			createStringColumn("Type", ".type"),
 			createStringColumn("Reason", ".reason"),
 			createStringColumn("Object", ".involvedObject.kind"),

From 12bf6b0e262279be1fc7fbf904c38219d18cb343 Mon Sep 17 00:00:00 2001
From: "cozystack-ci[bot]"
 <274107086+cozystack-ci[bot]@users.noreply.github.com>
Date: Thu, 16 Apr 2026 08:50:30 +0000
Subject: [PATCH 464/666] Prepare release v1.3.0-rc.1

Signed-off-by: cozystack-ci[bot] <274107086+cozystack-ci[bot]@users.noreply.github.com>
---
 packages/apps/http-cache/images/nginx-cache.tag             | 2 +-
 packages/apps/kubernetes/images/kubevirt-csi-driver.tag     | 2 +-
 .../apps/kubernetes/images/ubuntu-container-disk-v1.30.tag  | 2 +-
 .../apps/kubernetes/images/ubuntu-container-disk-v1.31.tag  | 2 +-
 .../apps/kubernetes/images/ubuntu-container-disk-v1.32.tag  | 2 +-
 .../apps/kubernetes/images/ubuntu-container-disk-v1.33.tag  | 2 +-
 .../apps/kubernetes/images/ubuntu-container-disk-v1.34.tag  | 2 +-
 .../apps/kubernetes/images/ubuntu-container-disk-v1.35.tag  | 2 +-
 packages/core/installer/values.yaml                         | 4 ++--
 packages/core/platform/values.yaml                          | 2 +-
 packages/core/testing/values.yaml                           | 2 +-
 packages/extra/bootbox/images/matchbox.tag                  | 2 +-
 packages/extra/seaweedfs/images/objectstorage-sidecar.tag   | 2 +-
 packages/system/backup-controller/values.yaml               | 2 +-
 packages/system/backupstrategy-controller/values.yaml       | 2 +-
 packages/system/bucket/images/s3manager.tag                 | 2 +-
 packages/system/cozystack-api/values.yaml                   | 2 +-
 packages/system/cozystack-controller/values.yaml            | 2 +-
 packages/system/dashboard/templates/configmap.yaml          | 2 +-
 packages/system/dashboard/values.yaml                       | 6 +++---
 .../system/grafana-operator/images/grafana-dashboards.tag   | 2 +-
 packages/system/kamaji/values.yaml                          | 4 ++--
 packages/system/kubeovn-plunger/values.yaml                 | 2 +-
 packages/system/kubeovn-webhook/values.yaml                 | 2 +-
 packages/system/kubevirt-csi-node/values.yaml               | 2 +-
 packages/system/lineage-controller-webhook/values.yaml      | 2 +-
 packages/system/linstor/values.yaml                         | 4 ++--
 packages/system/multus/templates/multus-daemonset-thick.yml | 4 ++--
 packages/system/objectstorage-controller/values.yaml        | 2 +-
 packages/system/seaweedfs/values.yaml                       | 2 +-
 30 files changed, 36 insertions(+), 36 deletions(-)

diff --git a/packages/apps/http-cache/images/nginx-cache.tag b/packages/apps/http-cache/images/nginx-cache.tag
index 1da929ec..b08a374e 100644
--- a/packages/apps/http-cache/images/nginx-cache.tag
+++ b/packages/apps/http-cache/images/nginx-cache.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/nginx-cache:0.0.0@sha256:2f987017ff95d3c782e16ef0d99928831f520daf154d08a2fa38c2d68363e036
+ghcr.io/cozystack/cozystack/nginx-cache:0.0.0@sha256:d397781152ab9123b11b8191d92eba7a0d2faa376aa2c15ddeb67842a9b59bab
diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
index e623b778..ea4a21b3 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:5b209248acba3d8cf0d999edd8a915915a2e565a1c8ac1f5dde0dffec20fa02e
+ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:36e26a6b9063761ca3f5597bbd6272651d8a502abbc1c4e3a20e6b7e45a2875a
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.30.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.30.tag
index 2d1e4d52..f49fffe6 100644
--- a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.30.tag
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.30.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.30@sha256:51e272db23d64eb20bc44e38cdbb70199fd00a49a958b76c2a89d4a46fec9256
+ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.30@sha256:f460ed1fd5a721aed423e6c3b8be0105d7f693cd86ad992d9c15fd4b27e58cec
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.31.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.31.tag
index 9698df5c..b5bdc79a 100644
--- a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.31.tag
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.31.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.31@sha256:31c3290305159fe484caf6c5780960cf071dc3939528295336da4abfa731a81b
+ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.31@sha256:aaa2dfa8ee53ae26295f44d2491330f51412457bbe4aa6ba256297cc0bd8a0da
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.32.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.32.tag
index 90545820..ca285644 100644
--- a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.32.tag
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.32.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.32@sha256:9efb1fe18cffb045530b43ac4b39910f1802d3c16798d733165dcd1c67de9237
+ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.32@sha256:7acb4728ef6b9c0ff3344bf486bb00f2a083f2098452344a362242235013db01
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.33.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.33.tag
index 64345fab..bb58690a 100644
--- a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.33.tag
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.33.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.33@sha256:a0afca1d6f720cfff764a1bc912bfe404b5e97ff731f6c126a7abdb51ed23f85
+ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.33@sha256:a2024339ab9edb980a96b43ad2744b7aa31afaef0983ddbc6a546068b4cfa87a
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.34.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.34.tag
index f6916755..36eed7a7 100644
--- a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.34.tag
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.34.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.34@sha256:51dfe5ce3e2f8765fde9422ae7e9fba677016ec5e2be41559c5f11a56958b0e6
+ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.34@sha256:97bcf946a5687889c6a421d14e5adece11f0978151b2165dc87b28f77f7607db
diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.35.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.35.tag
index b80ce821..faae83d2 100644
--- a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.35.tag
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.35.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.35@sha256:c4ae418b2a2c139794cd9630c3b2c2171870cc7748ac200344d2c4ed4283cf0b
+ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.35@sha256:364c6d454891f1eb1a598fddb69cf328a14dbc451a8ac65812b038a7756da60a
diff --git a/packages/core/installer/values.yaml b/packages/core/installer/values.yaml
index 98443211..f0a363e1 100644
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -1,9 +1,9 @@
 cozystackOperator:
   # Deployment variant: talos, generic, hosted
   variant: talos
-  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.2.1@sha256:c89352808022944c4791d63cf82cc95d78124ce799d355b60427f317087e8909
+  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.3.0-rc.1@sha256:d833abf3eac990732440d7d04e2df62ef9cd46704e0637e63e86983132c6d958
   platformSourceUrl: 'oci://ghcr.io/cozystack/cozystack/cozystack-packages'
-  platformSourceRef: 'digest=sha256:d02f211f79d4912f04c21856de078b5b41bb3976d84504d37cf8d9108f7cbec6'
+  platformSourceRef: 'digest=sha256:db28afd18635f6295342f58cd90ac7015c8f59d46ae9704fffeb2c654c3c8a0e'
 # Generic variant configuration (only used when cozystackOperator.variant=generic)
 cozystack:
   # Kubernetes API server host (IP only, no protocol/port)
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index c21b4f35..1d9a51c5 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -5,7 +5,7 @@ sourceRef:
   path: /
 migrations:
   enabled: false
-  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.2.1@sha256:e8fcf006a4451fc0e961455e9b27a61b7103ee49b1a81fe5e4662ffed093fad6
+  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.3.0-rc.1@sha256:555e4b76421361805a84bc9088b01b23a9c4a9430bd8ebd2db82ef9677d7008c
   targetVersion: 39
 # Bundle deployment configuration
 bundles:
diff --git a/packages/core/testing/values.yaml b/packages/core/testing/values.yaml
index b17da614..fe76a451 100644
--- a/packages/core/testing/values.yaml
+++ b/packages/core/testing/values.yaml
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.2.1@sha256:7964a3e4b11053887be201d62f94138c3a7836c861036c26fb833aa1fcb934e1
+  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.3.0-rc.1@sha256:0367a03b981df2a3ea13f411d4cb7869c2bf2c89c07d3d5c8971b9a28921ccef
diff --git a/packages/extra/bootbox/images/matchbox.tag b/packages/extra/bootbox/images/matchbox.tag
index 0ba57d47..214064c3 100644
--- a/packages/extra/bootbox/images/matchbox.tag
+++ b/packages/extra/bootbox/images/matchbox.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/matchbox:v1.2.1@sha256:64685523ba693964f22ce7d7dc545bf7bf96dea34e5ae525a2315614adef4b3d
+ghcr.io/cozystack/cozystack/matchbox:v1.3.0-rc.1@sha256:27959a7e36fb5594049cf88e7b196e661c6ad161dc89330b2c0ef543d1d48367
diff --git a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
index bb0702e8..6d85d153 100644
--- a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
+++ b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.2.1@sha256:1ad07fb9e96477e5c322f240f6023ceedd8762261d8379ec784dde92797ee206
+ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.3.0-rc.1@sha256:5bcccbdb13979a16cee535eb5fbcdf0d87973689010a10b7b25e55c5be3edaa6
diff --git a/packages/system/backup-controller/values.yaml b/packages/system/backup-controller/values.yaml
index ff5fe774..3c8834dc 100644
--- a/packages/system/backup-controller/values.yaml
+++ b/packages/system/backup-controller/values.yaml
@@ -1,5 +1,5 @@
 backupController:
-  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.2.1@sha256:6e515cdfe302bb079dafa0f7f302c6ff7b7e9c02a75574880a45e35d5acb1f59"
+  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.3.0-rc.1@sha256:9d1727b80b436387141b43fd8c12ec36d75220e1d6014ebb58e2e8df3caba5e8"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/backupstrategy-controller/values.yaml b/packages/system/backupstrategy-controller/values.yaml
index bd3cad8c..326dd7c2 100644
--- a/packages/system/backupstrategy-controller/values.yaml
+++ b/packages/system/backupstrategy-controller/values.yaml
@@ -1,5 +1,5 @@
 backupStrategyController:
-  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.2.1@sha256:3544a08bfac2df6dcb1842f73747768b24625c6d6b97230be9a00f80637f0d32"
+  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.3.0-rc.1@sha256:aebdf354e15bff73d4e12d3f6117494002e8a4e586d1c46450cd0a3da493fbb5"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/bucket/images/s3manager.tag b/packages/system/bucket/images/s3manager.tag
index 6c3d1449..30b082df 100644
--- a/packages/system/bucket/images/s3manager.tag
+++ b/packages/system/bucket/images/s3manager.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:73382d7911274e6528cc2272ca9bfdb095c59e78845a3cdffd39d6c8ac29d920
+ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:cfffa1267ad72d138c6e9eed6fa282f4fa23698bef2180be98c0be39c073ec28
diff --git a/packages/system/cozystack-api/values.yaml b/packages/system/cozystack-api/values.yaml
index ca4cf5e2..2ccdb706 100644
--- a/packages/system/cozystack-api/values.yaml
+++ b/packages/system/cozystack-api/values.yaml
@@ -1,3 +1,3 @@
 cozystackAPI:
-  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.2.1@sha256:afcc72ec5b8ff6eea7fbf927d518f277a7bfead44948f45ed17eda90d47253d5
+  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.3.0-rc.1@sha256:c57f2e62a547e4d62ec1c88708bbce146653bc68e1e312ab16f97a9206bd6750
   replicas: 2
diff --git a/packages/system/cozystack-controller/values.yaml b/packages/system/cozystack-controller/values.yaml
index 030a4564..6addae2b 100644
--- a/packages/system/cozystack-controller/values.yaml
+++ b/packages/system/cozystack-controller/values.yaml
@@ -1,4 +1,4 @@
 cozystackController:
-  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.2.1@sha256:0b1d49b29e8860f13f7afc8d7b6265f36c9d24d6ad7c40f5164535dd8e933c73
+  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.3.0-rc.1@sha256:5ab50893e9d0237d26f366c9d647da6337ca9b97bae764430571d4fb080f6200
   debug: false
   disableTelemetry: false
diff --git a/packages/system/dashboard/templates/configmap.yaml b/packages/system/dashboard/templates/configmap.yaml
index d260c5d9..c2be8d46 100644
--- a/packages/system/dashboard/templates/configmap.yaml
+++ b/packages/system/dashboard/templates/configmap.yaml
@@ -1,6 +1,6 @@
 {{- $brandingConfig := .Values._cluster.branding | default dict }}
 
-{{- $tenantText := "v1.2.1" }}
+{{- $tenantText := "v1.3.0-rc.1" }}
 {{- $footerText := "Cozystack" }}
 {{- $titleText := "Cozystack Dashboard" }}
 {{- $logoText := "" }}
diff --git a/packages/system/dashboard/values.yaml b/packages/system/dashboard/values.yaml
index 1aa69b09..63305af8 100644
--- a/packages/system/dashboard/values.yaml
+++ b/packages/system/dashboard/values.yaml
@@ -1,6 +1,6 @@
 openapiUI:
-  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.2.1@sha256:a77c502c4b67fa5f0698f66a82eb2ad30e138f9bd2700aa40a63f73cb86a559d
+  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.3.0-rc.1@sha256:69dcecbea0cfff681043c75e3508c84f03a01b7be3e3a425deb740d629d3ab04
 openapiUIK8sBff:
-  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.2.1@sha256:1b3ea6d4c7dbbe6a8def3b2807fffdfab2ac4afc39d7a846e57dd491fa168f92
+  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.3.0-rc.1@sha256:873cf834deddaa3954b6d9c5d520a8e03714b77178eff44826d93540561f599e
 tokenProxy:
-  image: ghcr.io/cozystack/cozystack/token-proxy:v1.2.1@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
+  image: ghcr.io/cozystack/cozystack/token-proxy:v1.3.0-rc.1@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
diff --git a/packages/system/grafana-operator/images/grafana-dashboards.tag b/packages/system/grafana-operator/images/grafana-dashboards.tag
index 08f6bd0b..033a6742 100644
--- a/packages/system/grafana-operator/images/grafana-dashboards.tag
+++ b/packages/system/grafana-operator/images/grafana-dashboards.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/grafana-dashboards:v1.2.1@sha256:2c9aa0b48e2bf6167db198f4d15882bfe51700108edf2e9f6d0942940a2c1204
+ghcr.io/cozystack/cozystack/grafana-dashboards:v1.3.0-rc.1@sha256:2c9aa0b48e2bf6167db198f4d15882bfe51700108edf2e9f6d0942940a2c1204
diff --git a/packages/system/kamaji/values.yaml b/packages/system/kamaji/values.yaml
index 9c6eea0e..b1ca3cb7 100644
--- a/packages/system/kamaji/values.yaml
+++ b/packages/system/kamaji/values.yaml
@@ -3,7 +3,7 @@ kamaji:
     deploy: false
   image:
     pullPolicy: IfNotPresent
-    tag: v1.2.1@sha256:34b9af510bbad3e64ea5cd7afdffa2b31c0751009c467355c8f67f8f9c5b3513
+    tag: v1.3.0-rc.1@sha256:8c9af083b60600c0800eb56a2cda75f26007b7272a1cf019140de003bfce1a4d
     repository: ghcr.io/cozystack/cozystack/kamaji
   resources:
     limits:
@@ -13,4 +13,4 @@ kamaji:
       cpu: 100m
       memory: 100Mi
   extraArgs:
-    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.2.1@sha256:34b9af510bbad3e64ea5cd7afdffa2b31c0751009c467355c8f67f8f9c5b3513
+    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.3.0-rc.1@sha256:8c9af083b60600c0800eb56a2cda75f26007b7272a1cf019140de003bfce1a4d
diff --git a/packages/system/kubeovn-plunger/values.yaml b/packages/system/kubeovn-plunger/values.yaml
index 7691803e..a6946967 100644
--- a/packages/system/kubeovn-plunger/values.yaml
+++ b/packages/system/kubeovn-plunger/values.yaml
@@ -1,4 +1,4 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.2.1@sha256:71d487b9da211061921c7183d5a1e19a32c64dffe33a3fac0557c4cb25764dfe
+image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.3.0-rc.1@sha256:4819095c5237239b8e2282ed1710141a327b3e97773f598f983a22ec0f5add05
 ovnCentralName: ovn-central
diff --git a/packages/system/kubeovn-webhook/values.yaml b/packages/system/kubeovn-webhook/values.yaml
index df5215d1..24d75d95 100644
--- a/packages/system/kubeovn-webhook/values.yaml
+++ b/packages/system/kubeovn-webhook/values.yaml
@@ -1,3 +1,3 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.2.1@sha256:e6334c29d3aaf0dea766c88e3e05b53ad623d1bb497b3c836e6f76adade45b29
+image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.3.0-rc.1@sha256:e18f9fd679e38f65362a8d0042f25468272f6d081136ad47027168d8e7e07a4a
diff --git a/packages/system/kubevirt-csi-node/values.yaml b/packages/system/kubevirt-csi-node/values.yaml
index ad7e6f01..a4d51b79 100644
--- a/packages/system/kubevirt-csi-node/values.yaml
+++ b/packages/system/kubevirt-csi-node/values.yaml
@@ -1,3 +1,3 @@
 storageClass: replicated
 csiDriver:
-  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:5b209248acba3d8cf0d999edd8a915915a2e565a1c8ac1f5dde0dffec20fa02e
+  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:36e26a6b9063761ca3f5597bbd6272651d8a502abbc1c4e3a20e6b7e45a2875a
diff --git a/packages/system/lineage-controller-webhook/values.yaml b/packages/system/lineage-controller-webhook/values.yaml
index 103dbf85..32439941 100644
--- a/packages/system/lineage-controller-webhook/values.yaml
+++ b/packages/system/lineage-controller-webhook/values.yaml
@@ -1,5 +1,5 @@
 lineageControllerWebhook:
-  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.2.1@sha256:0fef727af2ea8d87503ba998d2ec03c12eb432d03b6642a555b81b95fbec4cb0
+  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.3.0-rc.1@sha256:7e443b9252f0477fe07471f76365edfa28550add51fe8fd4d11312d60a81850e
   debug: false
   localK8sAPIEndpoint:
     enabled: true
diff --git a/packages/system/linstor/values.yaml b/packages/system/linstor/values.yaml
index b3f13443..57f5f331 100644
--- a/packages/system/linstor/values.yaml
+++ b/packages/system/linstor/values.yaml
@@ -1,7 +1,7 @@
 piraeusServer:
   image:
     repository: ghcr.io/cozystack/cozystack/piraeus-server
-    tag: 1.32.3@sha256:d78071fdc33220168e3f2ab112a86208be95898b75268a0c62763b8a04e145ad
+    tag: 1.33.2@sha256:e748ea7b2adb285b0387fde4453320155fc03e4470db7d9af1d5447087bf18b4
 # Talos-specific workarounds (disable for generic Linux like Ubuntu/Debian)
 talos:
   enabled: true
@@ -13,4 +13,4 @@ linstor:
 linstorCSI:
   image:
     repository: ghcr.io/cozystack/cozystack/linstor-csi
-    tag: v1.10.5@sha256:e80ae94d8acd8774cb35715b1f103071ae6cd3160f1ebea915e5e6ee49234448
+    tag: v1.10.5@sha256:a80d39f96a988085e84be2d6e896f4b4a008fccd5bbd9eaa2b8534b076429942
diff --git a/packages/system/multus/templates/multus-daemonset-thick.yml b/packages/system/multus/templates/multus-daemonset-thick.yml
index bedffee3..2ddc6362 100644
--- a/packages/system/multus/templates/multus-daemonset-thick.yml
+++ b/packages/system/multus/templates/multus-daemonset-thick.yml
@@ -155,7 +155,7 @@ spec:
       serviceAccountName: multus
       containers:
         - name: kube-multus
-          image: ghcr.io/cozystack/cozystack/multus-cni:v1.2.1@sha256:aaf2ed6a5db1ee5acc0cd4f4683ea33570ff922c211bef37d407d6a01427b566
+          image: ghcr.io/cozystack/cozystack/multus-cni:v1.3.0-rc.1@sha256:d76cc81c9ef1521e1317aacdc98360325f4fbecdfc687b97852e2f5c275551b1
           command: [ "/usr/src/multus-cni/bin/multus-daemon" ]
           resources:
             requests:
@@ -201,7 +201,7 @@ spec:
                   fieldPath: spec.nodeName
       initContainers:
         - name: install-multus-binary
-          image: ghcr.io/cozystack/cozystack/multus-cni:v1.2.1@sha256:aaf2ed6a5db1ee5acc0cd4f4683ea33570ff922c211bef37d407d6a01427b566
+          image: ghcr.io/cozystack/cozystack/multus-cni:v1.3.0-rc.1@sha256:d76cc81c9ef1521e1317aacdc98360325f4fbecdfc687b97852e2f5c275551b1
           command:
             - "/usr/src/multus-cni/bin/install_multus"
             - "-d"
diff --git a/packages/system/objectstorage-controller/values.yaml b/packages/system/objectstorage-controller/values.yaml
index 1439e583..4def5b26 100644
--- a/packages/system/objectstorage-controller/values.yaml
+++ b/packages/system/objectstorage-controller/values.yaml
@@ -1,3 +1,3 @@
 objectstorage:
   controller:
-    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.2.1@sha256:036be10f26c4871c63fb63c6a294476289aa063610e7fbbc0dbd21d3cd7bfe5e"
+    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.3.0-rc.1@sha256:50b7eb360538dec3db747c9b28792b207068defc1f630d4bd965015d934d5279"
diff --git a/packages/system/seaweedfs/values.yaml b/packages/system/seaweedfs/values.yaml
index 7d598649..daf2c055 100644
--- a/packages/system/seaweedfs/values.yaml
+++ b/packages/system/seaweedfs/values.yaml
@@ -177,7 +177,7 @@ seaweedfs:
     bucketClassName: "seaweedfs"
     region: ""
     sidecar:
-      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.2.1@sha256:1ad07fb9e96477e5c322f240f6023ceedd8762261d8379ec784dde92797ee206"
+      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.3.0-rc.1@sha256:5bcccbdb13979a16cee535eb5fbcdf0d87973689010a10b7b25e55c5be3edaa6"
   certificates:
     commonName: "SeaweedFS CA"
     ipAddresses: []

From 624f00f9c2efc6e69b7d1078754b8149b3f08038 Mon Sep 17 00:00:00 2001
From: Timur Tukaev <90071493+tym83@users.noreply.github.com>
Date: Thu, 16 Apr 2026 14:30:51 +0500
Subject: [PATCH 465/666] Update README.md

Signed-off-by: Timur Tukaev <90071493+tym83@users.noreply.github.com>
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index dc1b0634..5bc8d7be 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,7 @@
 
 # Cozystack
 
-**Cozystack** is a free PaaS platform and framework for building clouds.
+**Cozystack** is a free platform and framework for building clouds.
 
 Cozystack is a [CNCF Sandbox Level Project](https://www.cncf.io/sandbox-projects/) that was originally built and sponsored by [Ænix](https://aenix.io/).
 

From e76b1ccc69671886cb95b1628b4efd9621a66534 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 16 Apr 2026 13:18:14 +0200
Subject: [PATCH 466/666] docs(changelog): add changelog for v1.3.0-rc.1

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 docs/changelogs/v1.3.0-rc.1.md | 173 +++++++++++++++++++++++++++++++++
 1 file changed, 173 insertions(+)
 create mode 100644 docs/changelogs/v1.3.0-rc.1.md

diff --git a/docs/changelogs/v1.3.0-rc.1.md b/docs/changelogs/v1.3.0-rc.1.md
new file mode 100644
index 00000000..9b63c106
--- /dev/null
+++ b/docs/changelogs/v1.3.0-rc.1.md
@@ -0,0 +1,173 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.3.0-rc.1
+-->
+
+# Cozystack v1.3.0-rc.1
+
+Cozystack v1.3.0-rc.1 is the first release candidate for v1.3.0, bringing **storage-aware scheduling** via the LINSTOR scheduler extender, a managed **LINSTOR GUI** web UI with Keycloak SSO, a **VM Default Images** catalog for out-of-the-box virtual machine provisioning, **WorkloadsReady conditions** with a real-time Events tab in the dashboard, and **cross-namespace VM backup restore** capabilities. Additional highlights include stricter tenant name validation, VM network selector improvements, Keycloak theme injection and SMTP configuration, and a comprehensive host runtime preflight check.
+
+> **Note:** Fixes marked with *(backported to v1.2.x)* were also included in v1.2.1 or v1.2.2 patch releases.
+
+## Feature Highlights
+
+### Storage-Aware Scheduling via LINSTOR Extender
+
+The `cozystack-scheduler` now calls the **LINSTOR scheduler extender** for storage-locality-aware pod placement. When a pod declares both a `SchedulingClass` and LINSTOR-backed PVCs, the scheduler consults LINSTOR to prefer nodes where volume replicas already exist — reducing cross-node replication traffic and improving I/O latency for storage-heavy workloads ([**@lllamnyp**](https://github.com/lllamnyp) in #2330).
+
+### LINSTOR GUI: Managed Web UI for Storage Administration
+
+A new opt-in `linstor-gui` system package deploys **LINBIT's linstor-gui web UI** alongside the LINSTOR controller with mTLS client authentication, non-root security context, and ClusterIP-only service. An optional **Keycloak-protected Ingress** (via oauth2-proxy) can be enabled for SSO-authenticated browser access when OIDC is configured on the platform ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2382, #2390).
+
+### VM Default Images: Out-of-the-Box VM Provisioning
+
+The new `vm-default-images` package provides a curated set of **cluster-wide virtual machine images** (Ubuntu, Debian, CentOS Stream, and others) as pre-populated DataVolumes. The package is opt-in via the `iaas` bundle and defaults to replicated storage for high availability. A companion migration (migration 38) renames legacy `vm-image-*` DataVolumes to the new `vm-default-images-*` naming scheme. The `vm-disk` chart also gains a new "disk" source type for cloning from existing vm-disks in the same namespace ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2258).
+
+### WorkloadsReady Condition and Events Tab
+
+Applications now expose a **WorkloadsReady** condition on their status by querying associated WorkloadMonitor resources, giving operators a single place to check whether all underlying workloads (Deployments, StatefulSets, DaemonSets) are healthy. The dashboard gains a new **Events tab** showing namespace-scoped Kubernetes events for each application, with fallback to `.firstTimestamp` when `.eventTime` is absent. A bug where WorkloadMonitor's `Operational` status was never persisted is also fixed ([**@lexfrei**](https://github.com/lexfrei) in #2356).
+
+### Cross-Namespace VM Backup Restore
+
+The backup system now supports **restoring VMInstance backups into a different namespace** (cross-namespace copy restores), with IP/MAC preservation and safe rename semantics. In-place backup/restores for VMDisk and VMInstance are improved: HelmReleases and DataVolumes are properly handled, and Velero failure messages are propagated to the Application status. The backup status structure has been refactored to store underlying resources as a generic opaque JSON object, enabling arbitrary application-specific metadata ([**@androndo**](https://github.com/androndo) in #2251, #2329, #2319).
+
+## Major Features and Improvements
+
+* **[api] Reject tenant names with dashes at Create time**: Enforces alphanumeric-only naming for Tenants at the API level, preventing names with hyphens that would silently fail during Helm reconciliation. A corresponding regex tightening and regression test suite hardens the validation ([**@lexfrei**](https://github.com/lexfrei) in #2380).
+
+* **[platform] Validate computed tenant namespace length**: Rejects Tenant creation when the computed ancestor-chain namespace would exceed the 63-character Kubernetes namespace limit, preventing opaque HelmRelease reconcile errors downstream ([**@lexfrei**](https://github.com/lexfrei) in #2376).
+
+* **[vm-instance] Rename subnets to networks and add dropdown selector**: Renames the misleading `subnets` field to `networks` in VMInstance for clarity, adds a dropdown selector for available networks in the dashboard form, and includes a migration to copy existing `subnets` values. The old field remains supported for backward compatibility ([**@sircthulhu**](https://github.com/sircthulhu) in #2263).
+
+* **[keycloak] Enable injecting themes**: Cozystack administrators can now inject custom Keycloak themes via `initContainers` for UI white-labeling and customization ([**@lllamnyp**](https://github.com/lllamnyp) in #2142).
+
+* **[keycloak-configure] Add email verification and SMTP configuration**: Adds configurable Keycloak settings for user self-registration, email verification, and SMTP server configuration, enabling automated user onboarding flows ([**@BROngineer**](https://github.com/BROngineer) in #2318).
+
+* **[postgres] Hardcode PostgreSQL 17 for monitoring databases**: Pins PostgreSQL 17.7 images for system databases (Grafana, Alerta, Harbor, Keycloak, SeaweedFS) and adds migration 37 to backfill `spec.version=v17` for existing PostgreSQL resources, preventing CNPG from defaulting to PostgreSQL 18 *(backported to v1.2.1)* ([**@IvanHunters**](https://github.com/IvanHunters) in #2304).
+
+* **[hack] Add host runtime preflight check**: New `check-host-runtime.sh` script and `make preflight` target that warns operators when a standalone containerd or docker runtime is running alongside the embedded k3s runtime, helping diagnose container runtime conflicts ([**@lexfrei**](https://github.com/lexfrei) in #2371).
+
+* **[hack] Add check-readiness.sh diagnostic script**: A new diagnostic script for tracking platform reconciliation by checking readiness of Packages, ArtifactGenerators, ExternalArtifacts, and HelmReleases, with support for watch mode and continuous monitoring ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2294).
+
+* **[mariadb] Always enable replication for consistent service naming**: MariaDB now always enables replication, creating `-primary`/`-secondary` services even for single-replica instances. This fixes dashboard visibility and backup functionality for single-replica setups ([**@sircthulhu**](https://github.com/sircthulhu) in #2279).
+
+* **[platform] Prevent installed packages deletion**: Adds `helm.sh/resource-policy: keep` annotation to packages, preventing automatic deletion when packages are disabled and restoring documented behavior *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2273).
+
+## Bug Fixes
+
+* **[cilium] Opt-out of cri-containerd.apparmor.d for nsenter init containers**: Opts cilium-agent init containers out of the `cri-containerd.apparmor.d` AppArmor profile on non-Talos variants, fixing `Init:CrashLoopBackOff` on Ubuntu 22.04+ and Debian *(backported to v1.2.2)* ([**@lexfrei**](https://github.com/lexfrei) in #2370).
+
+* **[virtual-machine] Exclude external VM services from Cilium BPF LB**: Adds `service-proxy-name: cozy-proxy` label to VM LoadBalancer services, telling Cilium to skip BPF processing. Fixes inter-tenant connectivity via public LB IPs and WholeIP functionality on Cilium 1.19+ *(backported to v1.2.2)* ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2357).
+
+* **[monitoring] Fix infra dashboards missing in default variant**: Includes `cozy-monitoring` namespace in the dashboard rendering condition, fixing infrastructure Grafana dashboards not rendering in the default platform variant *(backported to v1.2.2)* ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2365).
+
+* **[postgres] Fix system PostgreSQL images to 17.7-standard-trixie**: Normalizes system PostgreSQL image tags to use `17.7-standard-trixie` variant with migration logic for existing CNPG clusters *(backported to v1.2.2)* ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2364).
+
+* **[build] Filter git describe to match only v\* tags**: Adds `--match 'v*'` to `git describe` calls, preventing API subtags from being picked up instead of release tags and producing invalid Docker image tags *(backported to v1.2.2)* ([**@kvaps**](https://github.com/kvaps) in #2386).
+
+* **[platform] Fix resource allocation ratios not propagated to packages**: Restores propagation of CPU, memory, and ephemeral-storage allocation ratios to managed applications and KubeVirt, which were silently ignored since the bundle restructure *(backported to v1.2.1)* ([**@sircthulhu**](https://github.com/sircthulhu) in #2296).
+
+* **[kubernetes] Set explicit ephemeral-storage on virt-launcher pods**: Sets explicit `domain.resources` with ephemeral-storage on VirtualMachine spec to prevent virt-launcher pods from being evicted due to LimitRange defaults being too low for actual emptyDisk capacity ([**@kvaps**](https://github.com/kvaps) in #2317).
+
+* **[multus] Pin master CNI to 05-cilium.conflist**: Prevents a boot-time race condition where multus could auto-detect kube-ovn's conflist instead of Cilium's *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2315).
+
+* **[multus] Build custom image with DEL cache fix**: Fixes sandbox cleanup deadlock when CNI ADD never completes, preventing stale sandbox name reservations from permanently blocking pod creation *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2313).
+
+* **[linstor] Set verify-alg to crc32c**: Prevents DRBD connection failures on kernels where `crct10dif` is unavailable (e.g., Talos v1.12.6 with kernel 6.18.18) *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2303).
+
+* **[linstor] Preserve TCP ports during toggle-disk operations**: Fixes TCP port mismatches after toggle-disk operations that could cause DRBD resources to enter StandAlone state *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2292).
+
+## Dependencies & Version Updates
+
+* **[linstor] Update piraeus-server to v1.33.2 with selected backports**: Bumps LINSTOR server from v1.33.1 to v1.33.2 with backported patches for stale bitmap adjust retry, LUKS2 header sizing, and optimal I/O size detection *(backported to v1.2.2)* ([**@kvaps**](https://github.com/kvaps) in #2331).
+
+* **[kamaji] Update to 26.3.5-edge, drop upstreamed patches**: Updates Kamaji from edge-26.2.4 to 26.3.5-edge and removes two patches accepted upstream. Adds configurable probe tuning and DataStore readiness conditions ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2260).
+
+* **[talm] Release v0.23.0, v0.23.1, v0.24.0** (github.com/cozystack/talm): Migrates to the Talos v1.12 multi-document machine config format ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#116); fixes template rendering in `apply` command to resolve lookups ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/talm#119); bumps dependencies and modernizes codebase ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#124).
+
+* **[ansible-cozystack] Release v1.2.1, v1.2.2** (github.com/cozystack/ansible-cozystack): Exposes `publishing.externalIPs` and tenant-root ingress via role variables ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#30); adds comprehensive node prerequisites audit ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#27); replaces `ansible.utils.ipaddr` with a stdlib-based test plugin ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#24).
+
+## Security
+
+* **docs: add SECURITY.md**: Adds vulnerability reporting procedures, disclosure expectations, and supported release lines ([**@kvaps**](https://github.com/kvaps) in #2230).
+
+* **docs: add OpenSSF Best Practices badge to README**: Adds the OpenSSF Best Practices passing badge to the project README ([**@lexfrei**](https://github.com/lexfrei) in #2320).
+
+## Development, Testing, and CI/CD
+
+* **[ci] Replace cozystack-bot PAT with cozystack-ci GitHub App**: Replaces the long-lived cozystack-bot personal access token with short-lived, scoped tokens from the cozystack-ci GitHub App across all CI release workflows ([**@tym83**](https://github.com/tym83) in #2351; [**@kvaps**](https://github.com/kvaps) in #2383, #2392).
+
+* **[ci] Add Gemini Code Assist and CodeRabbit configuration**: Adds repository-level configuration for AI code reviewers with ignore patterns for vendored/generated code and incremental review settings ([**@lexfrei**](https://github.com/lexfrei) in #2385).
+
+* **[ci] Make tags workflow idempotent on re-runs**: Fixes CI to force-update API subtags and handle re-runs gracefully ([**@kvaps**](https://github.com/kvaps)).
+
+* **[tests] Fix Kafka E2E test timeout and retry race condition**: Increases Kafka E2E test timeout from 60s to 300s and fixes a retry race condition where `kubectl apply` could hit a still-deleting resource ([**@lexfrei**](https://github.com/lexfrei) in #2358).
+
+* **docs: adopt Conventional Commits for commit and PR titles**: Standardizes commit and PR title format to `type(scope): description` across all contributing docs and the PR template ([**@lexfrei**](https://github.com/lexfrei) in #2395).
+
+* **docs(ci): require screenshots for UI changes in PR template**: Adds a mandatory screenshots section to the PR template for UI-related changes ([**@kitsunoff**](https://github.com/kitsunoff) in #2407).
+
+## Documentation
+
+* **[website] Add ApplicationDefinition naming convention reference**: Documents how `cozystack-api` resolves kinds to their backing definitions ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#478).
+
+* **[website] Document Talos / talosctl / Cozystack version pairing**: Adds version compatibility matrix for installation ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#484).
+
+* **[website] Document namespace layout and parent/child derivation**: Explains tenant namespace hierarchy and parent/child namespace derivation rules ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#479).
+
+* **[website] Document the checkbox-then-edit-CR customization pattern for tenants**: Describes the workflow for customizing tenant settings via the CR after initial checkbox-based creation ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#485).
+
+* **[website] Add custom Keycloak themes documentation**: Covers the theme image contract, configuration, `imagePullSecrets`, and theme activation in the Keycloak admin console ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#463).
+
+* **[website] Add bonding (LACP) configuration how-to guide**: Covers network bonding configuration for Cozystack installations ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#459).
+
+* **[website] Improve registry mirrors for tenant Kubernetes in air-gapped guide**: Improved documentation for configuring registry mirrors in air-gapped environments ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#461).
+
+* **[website] Rewrite guide for ApplicationDefinition API (external-apps)**: Comprehensive rewrite of the external apps guide using the ApplicationDefinition API ([**@kitsunoff**](https://github.com/kitsunoff) in cozystack/website#488).
+
+* **[website] Add documentation for Go types usage**: Guide for using generated Go types for Cozystack managed applications as a Go module ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#465).
+
+* **[website] Update backup/restore documentation for VMI/VMDisk**: Updated backup documentation with VM instance and VM disk restore improvements ([**@androndo**](https://github.com/androndo) in cozystack/website#466).
+
+* **[website] Add OSS Health pages and OpenSSF badge**: Added OSS Health section with OpenSSF Scorecard and Best Practices badge to the website ([**@tym83**](https://github.com/tym83) in cozystack/website#470).
+
+* **[website] Add CozySummit Virtual 2026 program announcement**: Published the CozySummit Virtual 2026 program announcement blog post ([**@tym83**](https://github.com/tym83) in cozystack/website#472).
+
+* **[website] Add missing release announcements for v0.1–v0.41**: Backfilled missing release announcement blog posts for historical Cozystack versions ([**@tym83**](https://github.com/tym83) in cozystack/website#468).
+
+* **[website] Fix broken links and stale anchors across v1 docs**: Fixes 14 broken links and stale talm anchors ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#486).
+
+* **[website] Prefix bundle package names with cozystack. in v1 examples**: Corrects package naming in documentation examples ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#482).
+
+* **[website] Finish isolated-field removal and document opt-in policy labels**: Removes obsolete `isolated` field from tenant documentation and documents the new approach ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#481).
+
+* **[website] Add --take-ownership flag and describe networking.* fields**: Documents the `--take-ownership` flag and `networking.*` fields in the installation guide ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#480).
+
+* **[website] Fix KubeOVN MASTER_NODES example path and key in troubleshooting**: Corrects the MASTER_NODES example path ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#483).
+
+* **[external-apps-example] Replace MongoDB example with Minecraft apps**: Refactors the external apps example to use ApplicationDefinition API with Minecraft server applications ([**@lexfrei**](https://github.com/lexfrei) in cozystack/external-apps-example#2).
+
+## Governance
+
+* **Add Mattia Eleuteri ([@mattia-eleuteri](https://github.com/mattia-eleuteri)) as Maintainer**: CSI, Storage, Networking & Security ([**@tym83**](https://github.com/tym83) in #2345).
+
+* **Add Matthieu Robin ([@matthieu-robin](https://github.com/matthieu-robin)) as Maintainer**: Managed applications, platform quality, and benchmarking ([**@tym83**](https://github.com/tym83) in #2346).
+
+## Contributors
+
+We'd like to thank all contributors who made this release possible:
+
+* [**@androndo**](https://github.com/androndo)
+* [**@BROngineer**](https://github.com/BROngineer)
+* [**@IvanHunters**](https://github.com/IvanHunters)
+* [**@kitsunoff**](https://github.com/kitsunoff)
+* [**@kvaps**](https://github.com/kvaps)
+* [**@lexfrei**](https://github.com/lexfrei)
+* [**@lllamnyp**](https://github.com/lllamnyp)
+* [**@mattia-eleuteri**](https://github.com/mattia-eleuteri)
+* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
+* [**@sircthulhu**](https://github.com/sircthulhu)
+* [**@tym83**](https://github.com/tym83)
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.2.0...v1.3.0-rc.1

From 1e1bb3eb37e0cc3068fd87171f9c8c1ec884c0d6 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 16 Apr 2026 13:18:18 +0200
Subject: [PATCH 467/666] docs(agents): add external-apps-example and
 ansible-cozystack to changelog instructions

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 docs/agents/changelog.md | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/docs/agents/changelog.md b/docs/agents/changelog.md
index feb70597..35d59a00 100644
--- a/docs/agents/changelog.md
+++ b/docs/agents/changelog.md
@@ -22,7 +22,7 @@ When the user asks to generate a changelog, follow these steps in the specified
 - [ ] Step 5: Get the list of commits for the release period
 - [ ] Step 6: Check additional repositories (website is REQUIRED, optional repos if tags exist)
   - [ ] **MANDATORY**: Check website repository for documentation changes WITH authors and PR links via GitHub CLI
-  - [ ] **MANDATORY**: Check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy) for tags during release period
+  - [ ] **MANDATORY**: Check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy, external-apps-example, ansible-cozystack) for tags during release period
   - [ ] **MANDATORY**: For ALL commits from additional repos, get GitHub username via CLI, prioritizing PR author over commit author.
 - [ ] Step 7: Analyze commits (extract PR numbers, authors, user impact)
   - [ ] **MANDATORY**: For EVERY PR in main repo, get PR author via `gh pr view <PR_NUMBER> --json author --jq .author.login` (do NOT skip this step)
@@ -148,6 +148,8 @@ Cozystack release may include changes from related repositories. Check and inclu
 - [https://github.com/cozystack/boot-to-talos](https://github.com/cozystack/boot-to-talos)
 - [https://github.com/cozystack/cozyhr](https://github.com/cozystack/cozyhr)
 - [https://github.com/cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy)
+- [https://github.com/cozystack/external-apps-example](https://github.com/cozystack/external-apps-example)
+- [https://github.com/cozystack/ansible-cozystack](https://github.com/cozystack/ansible-cozystack)
 
 **⚠️ IMPORTANT**: You MUST check ALL optional repositories for tags created during the release period. Do NOT skip this step even if you think there might not be any tags. Use the process below to verify.
 
@@ -195,7 +197,7 @@ Cozystack release may include changes from related repositories. Check and inclu
 
 3. **For optional repositories, check if tags exist during release period:**
 
-   **⚠️ MANDATORY: You MUST check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy). Do NOT skip any repository!**
+   **⚠️ MANDATORY: You MUST check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy, external-apps-example, ansible-cozystack). Do NOT skip any repository!**
 
    **Use the helper script:**
    ```bash
@@ -208,7 +210,7 @@ Cozystack release may include changes from related repositories. Check and inclu
    ```
    
    The script will:
-   - Check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy)
+   - Check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy, external-apps-example, ansible-cozystack)
    - Look for tags created during the release period
    - Get commits between tags (if tags exist) or by date range (if no tags)
    - Extract PR numbers from commit messages
@@ -569,7 +571,7 @@ Create a new changelog file in the format matching previous versions:
 - [ ] Step 5 completed: **ALL commits included** (including merge commits and backports) - do not skip any commits
 - [ ] Step 5 completed: **Backports identified and handled correctly** - original PR author used, both original and backport PR numbers included
 - [ ] Step 6 completed: Website repository checked for documentation changes WITH authors and PR links via GitHub CLI
-- [ ] Step 6 completed: **ALL** optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy) checked for tags during release period
+- [ ] Step 6 completed: **ALL** optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy, external-apps-example, ansible-cozystack) checked for tags during release period
 - [ ] Step 6 completed: For ALL commits from additional repos, GitHub username obtained via GitHub CLI (not skipped). For commits with PR numbers, PR author used via `gh pr view` (not commit author)
 - [ ] Step 7 completed: For EVERY PR in main repo (including backports), PR author obtained via `gh pr view <PR_NUMBER> --json author --jq .author.login` (not skipped or assumed). Commit author NOT used - always use PR author
 - [ ] Step 7 completed: **Backports verified** - for each backport PR, original PR found and original PR author used in changelog
@@ -628,7 +630,7 @@ Save the changelog to file `docs/changelogs/v<version>.md` according to the vers
 
 - **Additional repositories (Step 6) - MANDATORY**: 
   - **⚠️ CRITICAL**: Always check the **website** repository for documentation changes during the release period. This is a required step and MUST NOT be skipped.
-  - **⚠️ CRITICAL**: You MUST check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy) for tags during the release period. Do NOT skip any repository even if you think there might not be tags.
+  - **⚠️ CRITICAL**: You MUST check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy, external-apps-example, ansible-cozystack) for tags during the release period. Do NOT skip any repository even if you think there might not be tags.
   - **CRITICAL**: For ALL entries from additional repositories (website and optional), you MUST:
     - **MANDATORY**: Extract PR number from commit message first
     - **MANDATORY**: For commits with PR numbers, ALWAYS use `gh pr view <PR_NUMBER> --repo cozystack/<repo> --json author --jq .author.login` to get PR author (not commit author)
@@ -637,7 +639,7 @@ Save the changelog to file `docs/changelogs/v<version>.md` according to the vers
     - **MANDATORY**: Do NOT use commit author for PRs - always use PR author
     - Include PR link or commit hash reference
     - Format: `* **[repo] Description**: details ([**@username**](https://github.com/username) in cozystack/repo#123)`
-  - For **optional repositories** (talm, boot-to-talos, cozyhr, cozy-proxy), you MUST check ALL of them for tags during the release period. Use the loop provided in Step 6 to check each repository systematically.
+  - For **optional repositories** (talm, boot-to-talos, cozyhr, cozy-proxy, external-apps-example, ansible-cozystack), you MUST check ALL of them for tags during the release period. Use the loop provided in Step 6 to check each repository systematically.
   - When including changes from additional repositories, use the format: `[repo-name] Description` and link to the repository's PR/issue if available
   - **Prefer PR numbers over commit hashes**: For commits from additional repositories, extract PR number from commit message using GitHub API. Use PR format (`cozystack/website#123`) instead of commit hash (`cozystack/website@abc1234`) when available
   - **Never add entries without author and PR/commit reference**: Every entry from additional repositories must have both author and link

From 7797f4956918f1631c52714034ee1690b8fd3fd3 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 20:20:41 +0300
Subject: [PATCH 468/666] test(api): assert parent HelmRelease Install/Upgrade
 Timeout >= 15m

Adds a failing unit test for convertApplicationToHelmRelease asserting
that Install.Timeout and Upgrade.Timeout are at least 15 minutes. The
default flux helm-controller timeout is too short to cover cold-start
Kamaji control-plane bootstrap (image pull + etcd bootstrap + apiserver
Ready + admin-kubeconfig Secret generation) and causes install
remediation loops.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../apps/application/rest_timeout_test.go     | 53 +++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 pkg/registry/apps/application/rest_timeout_test.go

diff --git a/pkg/registry/apps/application/rest_timeout_test.go b/pkg/registry/apps/application/rest_timeout_test.go
new file mode 100644
index 00000000..8ae13183
--- /dev/null
+++ b/pkg/registry/apps/application/rest_timeout_test.go
@@ -0,0 +1,53 @@
+package application
+
+import (
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
+	"github.com/cozystack/cozystack/pkg/config"
+)
+
+func TestConvertApplicationToHelmRelease_SetsInstallAndUpgradeTimeout(t *testing.T) {
+	r := &REST{
+		releaseConfig: config.ReleaseConfig{
+			Prefix: "kubernetes-",
+			ChartRef: config.ChartRefConfig{
+				Kind:      "HelmChart",
+				Name:      "kubernetes",
+				Namespace: "cozy-system",
+			},
+		},
+	}
+
+	app := &appsv1alpha1.Application{
+		ObjectMeta: metav1.ObjectMeta{Name: "example", Namespace: "tenant-root"},
+	}
+
+	hr, err := r.convertApplicationToHelmRelease(app)
+	if err != nil {
+		t.Fatalf("convertApplicationToHelmRelease returned error: %v", err)
+	}
+
+	if hr.Spec.Install == nil {
+		t.Fatal("Spec.Install must not be nil")
+	}
+	if hr.Spec.Install.Timeout == nil {
+		t.Fatal("Spec.Install.Timeout must be set to cover async admin-kubeconfig provisioning")
+	}
+	if hr.Spec.Install.Timeout.Duration < 15*time.Minute {
+		t.Errorf("Spec.Install.Timeout must be >= 15m (cold bootstrap budget), got %v", hr.Spec.Install.Timeout.Duration)
+	}
+
+	if hr.Spec.Upgrade == nil {
+		t.Fatal("Spec.Upgrade must not be nil")
+	}
+	if hr.Spec.Upgrade.Timeout == nil {
+		t.Fatal("Spec.Upgrade.Timeout must be set to cover async admin-kubeconfig provisioning")
+	}
+	if hr.Spec.Upgrade.Timeout.Duration < 15*time.Minute {
+		t.Errorf("Spec.Upgrade.Timeout must be >= 15m (cold bootstrap budget), got %v", hr.Spec.Upgrade.Timeout.Duration)
+	}
+}

From e4f279f8e2cb08e271130b4a5193d9e0e9d9d3a7 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 20:21:15 +0300
Subject: [PATCH 469/666] fix(api): set 15m Install/Upgrade Timeout for parent
 HelmRelease

Parent HelmRelease created by cozystack-api for Kubernetes tenants
contains CAPI/Kamaji resources (Cluster, KamajiControlPlane,
MachineDeployment) that asynchronously provision the
*-admin-kubeconfig Secret. Three Deployments in the same chart
(cluster-autoscaler, kccm, kcsi-controller) mount that Secret
directly, so the helm-wait cannot complete until control-plane
bootstrap finishes.

Default flux helm-controller timeout is too short for a cold-node
first-tenant bootstrap (image pull + etcd bootstrap + apiserver Ready
+ admin-kubeconfig generation routinely exceed it). On timeout,
install.remediation triggers uninstall, which removes the Cluster CR
and restarts the cycle indefinitely.

Bumping Install.Timeout and Upgrade.Timeout to 15m gives realistic
bootstrap headroom while remaining bounded.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 pkg/registry/apps/application/rest.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkg/registry/apps/application/rest.go b/pkg/registry/apps/application/rest.go
index 0728ea13..77d1d458 100644
--- a/pkg/registry/apps/application/rest.go
+++ b/pkg/registry/apps/application/rest.go
@@ -1509,11 +1509,13 @@ func (r *REST) convertApplicationToHelmRelease(app *appsv1alpha1.Application) (*
 			},
 			Interval: metav1.Duration{Duration: 5 * time.Minute},
 			Install: &helmv2.Install{
+				Timeout: &metav1.Duration{Duration: 15 * time.Minute},
 				Remediation: &helmv2.InstallRemediation{
 					Retries: -1,
 				},
 			},
 			Upgrade: &helmv2.Upgrade{
+				Timeout: &metav1.Duration{Duration: 15 * time.Minute},
 				Remediation: &helmv2.UpgradeRemediation{
 					Retries: -1,
 				},

From 3e26234a1c98f138542471a7f4395532e15c7b46 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 20:24:20 +0300
Subject: [PATCH 470/666] test(kubernetes): assert admin-kubeconfig wait
 pattern and etcd guard

Adds failing helm unittest suite for packages/apps/kubernetes covering:

- cluster-autoscaler, kccm, and csi controller Deployments mount the
  admin-kubeconfig Secret with optional: true
- each of those Deployments has a wait-for-kubeconfig initContainer
  that mounts the same kubeconfig path
- cluster.yaml renders a helm fail with a descriptive message when the
  tenant has no etcd DataStore (empty _namespace.etcd)

Also wires up a test target in the chart Makefile so helm-unit-tests.sh
picks it up.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/apps/kubernetes/Makefile             |  3 +
 .../tests/admin_kubeconfig_wait_test.yaml     | 85 +++++++++++++++++++
 packages/apps/kubernetes/tests/values-ci.yaml |  9 ++
 3 files changed, 97 insertions(+)
 create mode 100644 packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
 create mode 100644 packages/apps/kubernetes/tests/values-ci.yaml

diff --git a/packages/apps/kubernetes/Makefile b/packages/apps/kubernetes/Makefile
index 01cf736d..0f9e6d57 100644
--- a/packages/apps/kubernetes/Makefile
+++ b/packages/apps/kubernetes/Makefile
@@ -4,6 +4,9 @@ KUBERNETES_PKG_TAG = $(shell awk '$$1 == "version:" {print $$2}' Chart.yaml)
 include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
+test:
+	helm unittest .
+
 generate:
 	cozyvalues-gen -m 'kubernetes' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/kubernetes/types.go
 	../../../hack/update-crd.sh
diff --git a/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml b/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
new file mode 100644
index 00000000..e2d9f359
--- /dev/null
+++ b/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
@@ -0,0 +1,85 @@
+suite: admin-kubeconfig wait guards
+
+release:
+  name: test
+  namespace: tenant-root
+
+values:
+  - values-ci.yaml
+
+tests:
+  - it: cluster-autoscaler mounts admin-kubeconfig as optional
+    template: templates/cluster-autoscaler/deployment.yaml
+    documentSelector:
+      path: kind
+      value: Deployment
+    asserts:
+      - equal:
+          path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.secretName
+          value: test-admin-kubeconfig
+      - equal:
+          path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.optional
+          value: true
+
+  - it: cluster-autoscaler waits for admin-kubeconfig via initContainer
+    template: templates/cluster-autoscaler/deployment.yaml
+    documentSelector:
+      path: kind
+      value: Deployment
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[0].name
+          value: wait-for-kubeconfig
+      - contains:
+          path: spec.template.spec.initContainers[0].volumeMounts
+          content:
+            name: kubeconfig
+            mountPath: /etc/kubernetes/kubeconfig
+            readOnly: true
+
+  - it: kccm mounts admin-kubeconfig as optional
+    template: templates/kccm/manager.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.secretName
+          value: test-admin-kubeconfig
+      - equal:
+          path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.optional
+          value: true
+
+  - it: kccm waits for admin-kubeconfig via initContainer
+    template: templates/kccm/manager.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[0].name
+          value: wait-for-kubeconfig
+
+  - it: csi controller mounts admin-kubeconfig as optional
+    template: templates/csi/deploy.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.secretName
+          value: test-admin-kubeconfig
+      - equal:
+          path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.optional
+          value: true
+
+  - it: csi controller waits for admin-kubeconfig via initContainer
+    template: templates/csi/deploy.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[0].name
+          value: wait-for-kubeconfig
+
+  - it: cluster.yaml fails render when tenant has no etcd DataStore
+    template: templates/cluster.yaml
+    set:
+      _namespace:
+        etcd: ""
+        monitoring: ""
+        ingress: ""
+        seaweedfs: ""
+        host: ""
+    asserts:
+      - failedTemplate:
+          errorPattern: "requires a parent tenant with etcd enabled"
diff --git a/packages/apps/kubernetes/tests/values-ci.yaml b/packages/apps/kubernetes/tests/values-ci.yaml
new file mode 100644
index 00000000..13365e8c
--- /dev/null
+++ b/packages/apps/kubernetes/tests/values-ci.yaml
@@ -0,0 +1,9 @@
+_namespace:
+  etcd: tenant-root
+  monitoring: ""
+  ingress: ""
+  seaweedfs: ""
+  host: ""
+_cluster:
+  cluster-domain: cozy.local
+nodeGroups: null

From ca33cc4e3c4b032293fceec2b7d3c1eb13a241bb Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 20:25:42 +0300
Subject: [PATCH 471/666] fix(kubernetes): wait for admin-kubeconfig before
 starting CP-side pods

Three Deployments in the Kubernetes app chart mount the tenant
admin-kubeconfig Secret directly as a volume: cluster-autoscaler,
kccm, and the kcsi controller. That Secret is provisioned
asynchronously by Kamaji after control-plane bootstrap, so on a fresh
install the pods used to hit FailedMount and the parent HelmRelease
ran out of its wait budget.

Mark the Secret volume optional and add a wait-for-kubeconfig
initContainer that polls the mounted path until the Secret appears.
Kubelet remounts the optional Secret within its sync period once
Kamaji publishes it, the init container exits, and the main container
starts cleanly. The Deployment becomes Available without the helm-wait
ever seeing a FailedMount.

Pins a busybox image for the init container via
images/busybox.tag (same format as the other pinned tags in this
chart).

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/apps/kubernetes/images/busybox.tag     |  1 +
 .../cluster-autoscaler/deployment.yaml          | 17 +++++++++++++++++
 .../apps/kubernetes/templates/csi/deploy.yaml   | 17 +++++++++++++++++
 .../apps/kubernetes/templates/kccm/manager.yaml | 17 +++++++++++++++++
 4 files changed, 52 insertions(+)
 create mode 100644 packages/apps/kubernetes/images/busybox.tag

diff --git a/packages/apps/kubernetes/images/busybox.tag b/packages/apps/kubernetes/images/busybox.tag
new file mode 100644
index 00000000..e358c12e
--- /dev/null
+++ b/packages/apps/kubernetes/images/busybox.tag
@@ -0,0 +1 @@
+busybox:1.37.0@sha256:1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e
diff --git a/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml b/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
index a00e0155..47c22f76 100644
--- a/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
+++ b/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
@@ -23,6 +23,22 @@ spec:
         - key: node-role.kubernetes.io/control-plane
           operator: Exists
           effect: "NoSchedule"
+      initContainers:
+      - name: wait-for-kubeconfig
+        image: "{{ $.Files.Get "images/busybox.tag" | trim }}"
+        command:
+        - sh
+        - -c
+        - |
+          set -eu
+          until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
+            echo "waiting for admin kubeconfig to be provisioned by Kamaji..."
+            sleep 5
+          done
+        volumeMounts:
+        - name: kubeconfig
+          mountPath: /etc/kubernetes/kubeconfig
+          readOnly: true
       containers:
       - image: "{{ $.Files.Get "images/cluster-autoscaler.tag" | trim }}"
         name: cluster-autoscaler
@@ -56,6 +72,7 @@ spec:
         name: cloud-config
       - secret:
           secretName: {{ .Release.Name }}-admin-kubeconfig
+          optional: true
         name: kubeconfig
       serviceAccountName: {{ .Release.Name }}-cluster-autoscaler
       terminationGracePeriodSeconds: 10
diff --git a/packages/apps/kubernetes/templates/csi/deploy.yaml b/packages/apps/kubernetes/templates/csi/deploy.yaml
index 938b6d67..2979c75c 100644
--- a/packages/apps/kubernetes/templates/csi/deploy.yaml
+++ b/packages/apps/kubernetes/templates/csi/deploy.yaml
@@ -24,6 +24,22 @@ spec:
         - key: node-role.kubernetes.io/control-plane
           operator: Exists
           effect: "NoSchedule"
+      initContainers:
+        - name: wait-for-kubeconfig
+          image: "{{ $.Files.Get "images/busybox.tag" | trim }}"
+          command:
+          - sh
+          - -c
+          - |
+            set -eu
+            until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
+              echo "waiting for admin kubeconfig to be provisioned by Kamaji..."
+              sleep 5
+            done
+          volumeMounts:
+          - name: kubeconfig
+            mountPath: /etc/kubernetes/kubeconfig
+            readOnly: true
       containers:
         - name: csi-driver
           imagePullPolicy: Always
@@ -234,4 +250,5 @@ spec:
           emptyDir: {}
         - secret:
             secretName: {{ .Release.Name }}-admin-kubeconfig
+            optional: true
           name: kubeconfig
diff --git a/packages/apps/kubernetes/templates/kccm/manager.yaml b/packages/apps/kubernetes/templates/kccm/manager.yaml
index 81426d4e..5c7f15a4 100644
--- a/packages/apps/kubernetes/templates/kccm/manager.yaml
+++ b/packages/apps/kubernetes/templates/kccm/manager.yaml
@@ -22,6 +22,22 @@ spec:
         - key: node-role.kubernetes.io/control-plane
           operator: Exists
           effect: "NoSchedule"
+      initContainers:
+      - name: wait-for-kubeconfig
+        image: "{{ $.Files.Get "images/busybox.tag" | trim }}"
+        command:
+        - sh
+        - -c
+        - |
+          set -eu
+          until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
+            echo "waiting for admin kubeconfig to be provisioned by Kamaji..."
+            sleep 5
+          done
+        volumeMounts:
+        - name: kubeconfig
+          mountPath: /etc/kubernetes/kubeconfig
+          readOnly: true
       containers:
       - name: kubevirt-cloud-controller-manager
         args:
@@ -55,5 +71,6 @@ spec:
         name: cloud-config
       - secret:
           secretName: {{ .Release.Name }}-admin-kubeconfig
+          optional: true
         name: kubeconfig
       serviceAccountName: {{ .Release.Name }}-kccm

From cac514b60fc00717df37780d2183e1702b07e9c6 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 20:26:09 +0300
Subject: [PATCH 472/666] fix(kubernetes): fail fast when tenant has no etcd
 DataStore

When a Kubernetes tenant is created without a parent tenant that has
etcd enabled, .Values._namespace.etcd is empty and the rendered
KamajiControlPlane spec carries an empty dataStoreName. The Kamaji
admission webhook then rejects every TenantControlPlane create with
"tenant-root DataStore does not exist" and the control plane never
comes up.

Add a helm template-level guard that fails rendering with a
descriptive, actionable error message before the HelmRelease even
reaches the webhook. This also closes the narrow race where a
Kubernetes HelmRelease reconciles before the etcd HelmRelease has
created the DataStore CR - flux retries on its interval and picks up
the DataStore once it appears.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/apps/kubernetes/templates/cluster.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/packages/apps/kubernetes/templates/cluster.yaml b/packages/apps/kubernetes/templates/cluster.yaml
index 10d6fd80..99249c1a 100644
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -1,4 +1,7 @@
 {{- $etcd := .Values._namespace.etcd }}
+{{- if not $etcd }}
+{{- fail "Kubernetes tenant requires a parent tenant with etcd enabled: set .Values.etcd=true on tenant-root (or any ancestor tenant), wait for the etcd HelmRelease to reconcile (DataStore CR appears in the tenant namespace), then retry." }}
+{{- end }}
 {{- $ingress := .Values._namespace.ingress }}
 {{- $host := .Values._namespace.host }}
 {{- $kubevirtmachinetemplateNames := list }}

From a7d994365d067dee5d9546a9b95bb555b206a6af Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 20:26:47 +0300
Subject: [PATCH 473/666] test(kubernetes): assert parent HelmRelease did not
 remediate in e2e

Before cleanup, inspect the parent HelmRelease installFailures and
upgradeFailures counters. A non-zero value means flux helm-controller
hit its wait timeout, ran install/upgrade remediation (uninstall),
and re-installed - the exact race condition this PR closes. Fail the
bats test in that case so the signal surfaces in CI instead of being
masked by a green retry.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/run-kubernetes.sh | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index be6dcd6f..f05ec370 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -320,6 +320,19 @@ EOF
     done
     kubectl wait hr kubernetes-${test_name}-ingress-nginx -n tenant-test --timeout=5m --for=condition=ready
 
+  # Guard: parent HelmRelease must not have entered an install/upgrade remediation cycle.
+  # A non-zero installFailures/upgradeFailures indicates the helm-wait budget expired while
+  # admin-kubeconfig was still being provisioned, which would trigger uninstall remediation
+  # and churn the Cluster CR.
+  install_failures=$(kubectl get hr -n tenant-test "kubernetes-${test_name}" -ojsonpath='{.status.installFailures}')
+  upgrade_failures=$(kubectl get hr -n tenant-test "kubernetes-${test_name}" -ojsonpath='{.status.upgradeFailures}')
+  if [ "${install_failures:-0}" != "0" ] && [ -n "${install_failures}" ] || \
+     [ "${upgrade_failures:-0}" != "0" ] && [ -n "${upgrade_failures}" ]; then
+    echo "Parent HelmRelease entered remediation cycle: installFailures=${install_failures:-0}, upgradeFailures=${upgrade_failures:-0}" >&2
+    kubectl -n tenant-test describe hr "kubernetes-${test_name}" >&2
+    exit 1
+  fi
+
   # Clean up
   pkill -f "port-forward.*${port}:" 2>/dev/null || true
   rm -f "tenantkubeconfig-${test_name}"

From f87834a3edba32945f22e8d419a9592e5303b34b Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 20:48:47 +0300
Subject: [PATCH 474/666] fix(hack): group e2e remediation guard conditions
 correctly

Shell && and || have equal precedence and left-to-right associativity,
so the previous guard parsed as (((A && B) || C) && D) and silently
passed on the canonical failure mode: install_failures=1 with an empty
upgrade_failures.

Extract the check into helmrelease_has_remediation_cycle() in a
dedicated helper sourced from run-kubernetes.sh, and add unit tests
under hack/remediation-guard.bats that pin the expected behavior for
every combination of empty, zero, and positive counter values.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/remediation-guard.sh | 24 +++++++++
 hack/e2e-apps/run-kubernetes.sh    |  5 +-
 hack/remediation-guard.bats        | 87 ++++++++++++++++++++++++++++++
 3 files changed, 114 insertions(+), 2 deletions(-)
 create mode 100644 hack/e2e-apps/remediation-guard.sh
 create mode 100644 hack/remediation-guard.bats

diff --git a/hack/e2e-apps/remediation-guard.sh b/hack/e2e-apps/remediation-guard.sh
new file mode 100644
index 00000000..6da69f13
--- /dev/null
+++ b/hack/e2e-apps/remediation-guard.sh
@@ -0,0 +1,24 @@
+# Helpers for asserting that a Flux HelmRelease did not fall into an
+# install/upgrade remediation cycle during an e2e run.
+#
+# A non-zero installFailures/upgradeFailures counter means flux
+# helm-controller hit its wait timeout, ran remediation (uninstall),
+# and re-installed. That is exactly the race this guard is meant to
+# catch, so the function returns success (0) when a cycle is detected
+# and failure (1) otherwise.
+#
+# Both arguments may be empty strings, the literal "0", or a positive
+# integer. Shell's && and || have equal precedence with left-to-right
+# associativity, so each half of the disjunction is grouped explicitly
+# to avoid (A && B) || C && D parsing that masks the common
+# install_failures=1, upgrade_failures="" case.
+
+helmrelease_has_remediation_cycle() {
+    install_failures="$1"
+    upgrade_failures="$2"
+    if { [ -n "${install_failures}" ] && [ "${install_failures}" != "0" ]; } || \
+       { [ -n "${upgrade_failures}" ] && [ "${upgrade_failures}" != "0" ]; }; then
+        return 0
+    fi
+    return 1
+}
diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index f05ec370..811f42a7 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -1,3 +1,5 @@
+. hack/e2e-apps/remediation-guard.sh
+
 run_kubernetes_test() {
     local version_expr="$1"
     local test_name="$2"
@@ -326,8 +328,7 @@ EOF
   # and churn the Cluster CR.
   install_failures=$(kubectl get hr -n tenant-test "kubernetes-${test_name}" -ojsonpath='{.status.installFailures}')
   upgrade_failures=$(kubectl get hr -n tenant-test "kubernetes-${test_name}" -ojsonpath='{.status.upgradeFailures}')
-  if [ "${install_failures:-0}" != "0" ] && [ -n "${install_failures}" ] || \
-     [ "${upgrade_failures:-0}" != "0" ] && [ -n "${upgrade_failures}" ]; then
+  if helmrelease_has_remediation_cycle "${install_failures}" "${upgrade_failures}"; then
     echo "Parent HelmRelease entered remediation cycle: installFailures=${install_failures:-0}, upgradeFailures=${upgrade_failures:-0}" >&2
     kubectl -n tenant-test describe hr "kubernetes-${test_name}" >&2
     exit 1
diff --git a/hack/remediation-guard.bats b/hack/remediation-guard.bats
new file mode 100644
index 00000000..64aa83af
--- /dev/null
+++ b/hack/remediation-guard.bats
@@ -0,0 +1,87 @@
+#!/usr/bin/env bats
+# -----------------------------------------------------------------------------
+# Unit tests for hack/e2e-apps/remediation-guard.sh
+#
+# helmrelease_has_remediation_cycle is consumed from e2e tests to assert that
+# the parent HelmRelease did not hit flux helm-controller's wait timeout and
+# enter uninstall remediation. The function accepts two arguments (values of
+# .status.installFailures and .status.upgradeFailures) and returns 0 when a
+# remediation cycle is detected, 1 otherwise.
+#
+# Each argument can be empty (controller never populated the field), "0"
+# (populated but never failed), or a positive integer. Shell's && and ||
+# have equal precedence with left-to-right associativity, which used to
+# break this check on the most common failure mode - install_failures=1
+# and upgrade_failures="". These tests pin the correct behavior.
+#
+# cozytest.sh's awk parser recognizes only @test blocks and a bare `}` on
+# its own line; there is no bats `run` or `$status`. Assertions are
+# expressed as direct shell tests that exit non-zero on failure.
+#
+# Run with: hack/cozytest.sh hack/remediation-guard.bats
+# -----------------------------------------------------------------------------
+
+@test "no counters set returns not-detected" {
+    . hack/e2e-apps/remediation-guard.sh
+    rc=0
+    helmrelease_has_remediation_cycle "" "" || rc=$?
+    [ "$rc" -eq 1 ]
+}
+
+@test "both counters zero returns not-detected" {
+    . hack/e2e-apps/remediation-guard.sh
+    rc=0
+    helmrelease_has_remediation_cycle "0" "0" || rc=$?
+    [ "$rc" -eq 1 ]
+}
+
+@test "install zero upgrade empty returns not-detected" {
+    . hack/e2e-apps/remediation-guard.sh
+    rc=0
+    helmrelease_has_remediation_cycle "0" "" || rc=$?
+    [ "$rc" -eq 1 ]
+}
+
+@test "install empty upgrade zero returns not-detected" {
+    . hack/e2e-apps/remediation-guard.sh
+    rc=0
+    helmrelease_has_remediation_cycle "" "0" || rc=$?
+    [ "$rc" -eq 1 ]
+}
+
+@test "install one upgrade empty returns detected" {
+    # Canonical race: first install exceeded helm-wait, remediation fired,
+    # no upgrade has happened yet.
+    . hack/e2e-apps/remediation-guard.sh
+    rc=0
+    helmrelease_has_remediation_cycle "1" "" || rc=$?
+    [ "$rc" -eq 0 ]
+}
+
+@test "install empty upgrade one returns detected" {
+    . hack/e2e-apps/remediation-guard.sh
+    rc=0
+    helmrelease_has_remediation_cycle "" "1" || rc=$?
+    [ "$rc" -eq 0 ]
+}
+
+@test "install two upgrade zero returns detected" {
+    . hack/e2e-apps/remediation-guard.sh
+    rc=0
+    helmrelease_has_remediation_cycle "2" "0" || rc=$?
+    [ "$rc" -eq 0 ]
+}
+
+@test "install zero upgrade two returns detected" {
+    . hack/e2e-apps/remediation-guard.sh
+    rc=0
+    helmrelease_has_remediation_cycle "0" "2" || rc=$?
+    [ "$rc" -eq 0 ]
+}
+
+@test "both counters positive returns detected" {
+    . hack/e2e-apps/remediation-guard.sh
+    rc=0
+    helmrelease_has_remediation_cycle "3" "5" || rc=$?
+    [ "$rc" -eq 0 ]
+}

From 73b80bfb940ec24459a826b32540f676a00bca36 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 20:51:32 +0300
Subject: [PATCH 475/666] fix(api): scope 15m helm wait budget to Kubernetes
 Application kind

The previous change set Install.Timeout and Upgrade.Timeout to 15m
on every Application's parent HelmRelease, but the admin-kubeconfig
race documented in #2412 is specific to the Kubernetes kind: only its
parent chart creates CAPI/Kamaji resources whose admin-kubeconfig
Secret is asynchronously provisioned and mounted by Deployments in
the same chart. Other kinds (Qdrant, MongoDB, Postgres, ...) have no
such race and should not have their failed installs linger three times
longer before flux triggers remediation.

Gate the timeout on r.kindName == "Kubernetes". Rewrite
rest_timeout_test.go to cover both sides: Kubernetes must get a
>= 15m timeout, other kinds must keep the flux defaults. Both tests
also pin Install/Upgrade Remediation.Retries == -1 so a future edit
that removes unbounded remediation would show up as a red test.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 pkg/registry/apps/application/rest.go         | 16 ++++-
 .../apps/application/rest_timeout_test.go     | 58 ++++++++++++++++---
 2 files changed, 64 insertions(+), 10 deletions(-)

diff --git a/pkg/registry/apps/application/rest.go b/pkg/registry/apps/application/rest.go
index 77d1d458..9b92d2c0 100644
--- a/pkg/registry/apps/application/rest.go
+++ b/pkg/registry/apps/application/rest.go
@@ -1509,13 +1509,11 @@ func (r *REST) convertApplicationToHelmRelease(app *appsv1alpha1.Application) (*
 			},
 			Interval: metav1.Duration{Duration: 5 * time.Minute},
 			Install: &helmv2.Install{
-				Timeout: &metav1.Duration{Duration: 15 * time.Minute},
 				Remediation: &helmv2.InstallRemediation{
 					Retries: -1,
 				},
 			},
 			Upgrade: &helmv2.Upgrade{
-				Timeout: &metav1.Duration{Duration: 15 * time.Minute},
 				Remediation: &helmv2.UpgradeRemediation{
 					Retries: -1,
 				},
@@ -1530,6 +1528,20 @@ func (r *REST) convertApplicationToHelmRelease(app *appsv1alpha1.Application) (*
 		},
 	}
 
+	// The Kubernetes Application's parent chart creates CAPI/Kamaji resources
+	// whose admin-kubeconfig Secret is provisioned asynchronously and mounted
+	// by Deployments in the same chart. On a cold node, Kamaji control-plane
+	// bootstrap routinely exceeds flux helm-controller's default wait budget,
+	// so install remediation loops uninstall the Cluster CR and churn. Extend
+	// the wait budget to 15m for Kubernetes only - other Application kinds
+	// without this race keep flux defaults, so their failed installs do not
+	// linger unnecessarily before remediation fires.
+	if r.kindName == "Kubernetes" {
+		timeout := metav1.Duration{Duration: 15 * time.Minute}
+		helmRelease.Spec.Install.Timeout = &timeout
+		helmRelease.Spec.Upgrade.Timeout = &timeout
+	}
+
 	return helmRelease, nil
 }
 
diff --git a/pkg/registry/apps/application/rest_timeout_test.go b/pkg/registry/apps/application/rest_timeout_test.go
index 8ae13183..fa6d5427 100644
--- a/pkg/registry/apps/application/rest_timeout_test.go
+++ b/pkg/registry/apps/application/rest_timeout_test.go
@@ -10,18 +10,22 @@ import (
 	"github.com/cozystack/cozystack/pkg/config"
 )
 
-func TestConvertApplicationToHelmRelease_SetsInstallAndUpgradeTimeout(t *testing.T) {
-	r := &REST{
+func newRESTForKind(kind, prefix string) *REST {
+	return &REST{
+		kindName: kind,
 		releaseConfig: config.ReleaseConfig{
-			Prefix: "kubernetes-",
+			Prefix: prefix,
 			ChartRef: config.ChartRefConfig{
 				Kind:      "HelmChart",
-				Name:      "kubernetes",
+				Name:      "x",
 				Namespace: "cozy-system",
 			},
 		},
 	}
+}
 
+func TestConvertApplicationToHelmRelease_KubernetesKindGetsLongTimeout(t *testing.T) {
+	r := newRESTForKind("Kubernetes", "kubernetes-")
 	app := &appsv1alpha1.Application{
 		ObjectMeta: metav1.ObjectMeta{Name: "example", Namespace: "tenant-root"},
 	}
@@ -35,19 +39,57 @@ func TestConvertApplicationToHelmRelease_SetsInstallAndUpgradeTimeout(t *testing
 		t.Fatal("Spec.Install must not be nil")
 	}
 	if hr.Spec.Install.Timeout == nil {
-		t.Fatal("Spec.Install.Timeout must be set to cover async admin-kubeconfig provisioning")
+		t.Fatal("Spec.Install.Timeout must be set for Kubernetes kind")
 	}
 	if hr.Spec.Install.Timeout.Duration < 15*time.Minute {
-		t.Errorf("Spec.Install.Timeout must be >= 15m (cold bootstrap budget), got %v", hr.Spec.Install.Timeout.Duration)
+		t.Errorf("Spec.Install.Timeout must be >= 15m for Kubernetes, got %v", hr.Spec.Install.Timeout.Duration)
 	}
 
 	if hr.Spec.Upgrade == nil {
 		t.Fatal("Spec.Upgrade must not be nil")
 	}
 	if hr.Spec.Upgrade.Timeout == nil {
-		t.Fatal("Spec.Upgrade.Timeout must be set to cover async admin-kubeconfig provisioning")
+		t.Fatal("Spec.Upgrade.Timeout must be set for Kubernetes kind")
 	}
 	if hr.Spec.Upgrade.Timeout.Duration < 15*time.Minute {
-		t.Errorf("Spec.Upgrade.Timeout must be >= 15m (cold bootstrap budget), got %v", hr.Spec.Upgrade.Timeout.Duration)
+		t.Errorf("Spec.Upgrade.Timeout must be >= 15m for Kubernetes, got %v", hr.Spec.Upgrade.Timeout.Duration)
+	}
+
+	if hr.Spec.Install.Remediation == nil || hr.Spec.Install.Remediation.Retries != -1 {
+		t.Errorf("Spec.Install.Remediation.Retries must remain -1, got %+v", hr.Spec.Install.Remediation)
+	}
+	if hr.Spec.Upgrade.Remediation == nil || hr.Spec.Upgrade.Remediation.Retries != -1 {
+		t.Errorf("Spec.Upgrade.Remediation.Retries must remain -1, got %+v", hr.Spec.Upgrade.Remediation)
+	}
+}
+
+func TestConvertApplicationToHelmRelease_NonKubernetesKindKeepsFluxDefaults(t *testing.T) {
+	// For Applications whose parent chart has no admin-kubeconfig race
+	// (Qdrant, MongoDB, Postgres, etc.), do NOT extend the helm-wait
+	// budget - otherwise failed installs would block three times as long
+	// before Flux starts remediating.
+	r := newRESTForKind("Qdrant", "qdrant-")
+	app := &appsv1alpha1.Application{
+		ObjectMeta: metav1.ObjectMeta{Name: "example", Namespace: "tenant-root"},
+	}
+
+	hr, err := r.convertApplicationToHelmRelease(app)
+	if err != nil {
+		t.Fatalf("convertApplicationToHelmRelease returned error: %v", err)
+	}
+
+	if hr.Spec.Install != nil && hr.Spec.Install.Timeout != nil {
+		t.Errorf("Spec.Install.Timeout must be unset for non-Kubernetes kinds, got %v", hr.Spec.Install.Timeout.Duration)
+	}
+	if hr.Spec.Upgrade != nil && hr.Spec.Upgrade.Timeout != nil {
+		t.Errorf("Spec.Upgrade.Timeout must be unset for non-Kubernetes kinds, got %v", hr.Spec.Upgrade.Timeout.Duration)
+	}
+
+	// But remediation must still be -1 across the board.
+	if hr.Spec.Install.Remediation == nil || hr.Spec.Install.Remediation.Retries != -1 {
+		t.Errorf("Spec.Install.Remediation.Retries must remain -1, got %+v", hr.Spec.Install.Remediation)
+	}
+	if hr.Spec.Upgrade.Remediation == nil || hr.Spec.Upgrade.Remediation.Retries != -1 {
+		t.Errorf("Spec.Upgrade.Remediation.Retries must remain -1, got %+v", hr.Spec.Upgrade.Remediation)
 	}
 }

From 03606091df5672b6e857057a349875d534990f3a Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 20:53:17 +0300
Subject: [PATCH 476/666] chore(kubernetes): align busybox image with project
 convention

Adds images/busybox/Dockerfile and an image-busybox Makefile target
that mirror the same pattern as the rest of this chart's images (the
Dockerfile pins the upstream busybox by digest; the Makefile target
builds and tags for ghcr.io/cozystack/cozystack/busybox the same way
cluster-autoscaler et al. are handled). Also wires it into the
umbrella image target so 'make image' rebuilds everything.

Until the first release build runs image-busybox and rewrites the
.tag to point at ghcr.io, the .tag keeps a fully-qualified
docker.io/library/busybox:1.37.0@sha256:... reference so pods do not
silently resolve the short name via the default registry and pulls
remain immutable by digest. The release workflow overwrites this
file the same way it does for the other images.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/apps/kubernetes/Makefile                  | 14 +++++++++++++-
 packages/apps/kubernetes/images/busybox.tag        |  2 +-
 packages/apps/kubernetes/images/busybox/Dockerfile |  1 +
 3 files changed, 15 insertions(+), 2 deletions(-)
 create mode 100644 packages/apps/kubernetes/images/busybox/Dockerfile

diff --git a/packages/apps/kubernetes/Makefile b/packages/apps/kubernetes/Makefile
index 0f9e6d57..eb23c2ef 100644
--- a/packages/apps/kubernetes/Makefile
+++ b/packages/apps/kubernetes/Makefile
@@ -15,7 +15,7 @@ update:
 	hack/update-versions.sh
 	make generate
 
-image: image-ubuntu-container-disk image-kubevirt-cloud-provider image-kubevirt-csi-driver image-cluster-autoscaler
+image: image-ubuntu-container-disk image-kubevirt-cloud-provider image-kubevirt-csi-driver image-cluster-autoscaler image-busybox
 
 image-ubuntu-container-disk:
 	$(foreach ver,$(KUBERNETES_VERSIONS), \
@@ -70,3 +70,15 @@ image-cluster-autoscaler:
 	echo "$(REGISTRY)/cluster-autoscaler:$(call settag,$(KUBERNETES_PKG_TAG))@$$(yq e '."containerimage.digest"' images/cluster-autoscaler.json -o json -r)" \
 		> images/cluster-autoscaler.tag
 	rm -f images/cluster-autoscaler.json
+
+image-busybox:
+	docker buildx build images/busybox \
+		--tag $(REGISTRY)/busybox:$(call settag,$(KUBERNETES_PKG_TAG)) \
+		--tag $(REGISTRY)/busybox:$(call settag,$(KUBERNETES_PKG_TAG)-$(TAG)) \
+		--cache-from type=registry,ref=$(REGISTRY)/busybox:latest \
+		--cache-to type=inline \
+		--metadata-file images/busybox.json \
+		$(BUILDX_ARGS)
+	echo "$(REGISTRY)/busybox:$(call settag,$(KUBERNETES_PKG_TAG))@$$(yq e '."containerimage.digest"' images/busybox.json -o json -r)" \
+		> images/busybox.tag
+	rm -f images/busybox.json
diff --git a/packages/apps/kubernetes/images/busybox.tag b/packages/apps/kubernetes/images/busybox.tag
index e358c12e..39de220a 100644
--- a/packages/apps/kubernetes/images/busybox.tag
+++ b/packages/apps/kubernetes/images/busybox.tag
@@ -1 +1 @@
-busybox:1.37.0@sha256:1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e
+docker.io/library/busybox:1.37.0@sha256:1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e
diff --git a/packages/apps/kubernetes/images/busybox/Dockerfile b/packages/apps/kubernetes/images/busybox/Dockerfile
new file mode 100644
index 00000000..0c57fd39
--- /dev/null
+++ b/packages/apps/kubernetes/images/busybox/Dockerfile
@@ -0,0 +1 @@
+FROM docker.io/library/busybox:1.37.0@sha256:1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e

From 97696b2b036be79ecafd8e96401dc2af3bc39d32 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 20:54:10 +0300
Subject: [PATCH 477/666] test(kubernetes): add positive cluster render test
 and pin document kind

Adds an assertion that cluster.yaml renders successfully when
_namespace.etcd is set and produces a KamajiControlPlane whose
dataStoreName equals the tenant's etcd DataStore name. Without this
positive case a future edit that inverts or removes the existing etcd
guard would pass the suite as long as the negative case still fails.

Also adds documentSelector: kind=Deployment to the kccm and csi
controller assertions so the jsonpath filter operates on a single
document, matching the cluster-autoscaler case and removing
reliance on helm-unittest filter-vs-single-value coercion.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../tests/admin_kubeconfig_wait_test.yaml     | 34 +++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml b/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
index e2d9f359..3b2b1d72 100644
--- a/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
+++ b/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
@@ -39,6 +39,9 @@ tests:
 
   - it: kccm mounts admin-kubeconfig as optional
     template: templates/kccm/manager.yaml
+    documentSelector:
+      path: kind
+      value: Deployment
     asserts:
       - equal:
           path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.secretName
@@ -49,13 +52,25 @@ tests:
 
   - it: kccm waits for admin-kubeconfig via initContainer
     template: templates/kccm/manager.yaml
+    documentSelector:
+      path: kind
+      value: Deployment
     asserts:
       - equal:
           path: spec.template.spec.initContainers[0].name
           value: wait-for-kubeconfig
+      - contains:
+          path: spec.template.spec.initContainers[0].volumeMounts
+          content:
+            name: kubeconfig
+            mountPath: /etc/kubernetes/kubeconfig
+            readOnly: true
 
   - it: csi controller mounts admin-kubeconfig as optional
     template: templates/csi/deploy.yaml
+    documentSelector:
+      path: kind
+      value: Deployment
     asserts:
       - equal:
           path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.secretName
@@ -66,10 +81,29 @@ tests:
 
   - it: csi controller waits for admin-kubeconfig via initContainer
     template: templates/csi/deploy.yaml
+    documentSelector:
+      path: kind
+      value: Deployment
     asserts:
       - equal:
           path: spec.template.spec.initContainers[0].name
           value: wait-for-kubeconfig
+      - contains:
+          path: spec.template.spec.initContainers[0].volumeMounts
+          content:
+            name: kubeconfig
+            mountPath: /etc/kubernetes/kubeconfig
+            readOnly: true
+
+  - it: cluster.yaml renders and wires dataStoreName when tenant has etcd
+    template: templates/cluster.yaml
+    documentSelector:
+      path: kind
+      value: KamajiControlPlane
+    asserts:
+      - equal:
+          path: spec.dataStoreName
+          value: tenant-root
 
   - it: cluster.yaml fails render when tenant has no etcd DataStore
     template: templates/cluster.yaml

From 6afc0eb370f827c55f478045d1aff2a329b25100 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 20:55:17 +0300
Subject: [PATCH 478/666] fix(kubernetes): bound init wait and reword fail-fast
 message

Cap the wait-for-kubeconfig init container at 20m. If Kamaji genuinely
fails to produce the admin-kubeconfig Secret (misconfigured tenant,
etcd outage after the guard already passed, Kamaji crash-loop), the
pod now exits non-zero and goes CrashLoopBackOff so the failure is
visible in dashboards, instead of silently sleeping in Init forever
and leaving only the flux helm-wait timeout to surface the problem.

Reword the etcd DataStore guard to reference the parent Tenant
application's etcd flag (not .Values.etcd of the Kubernetes chart,
which is a different chart). Update the helm unittest errorPattern
accordingly.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../kubernetes/templates/cluster-autoscaler/deployment.yaml  | 5 +++++
 packages/apps/kubernetes/templates/cluster.yaml              | 2 +-
 packages/apps/kubernetes/templates/csi/deploy.yaml           | 5 +++++
 packages/apps/kubernetes/templates/kccm/manager.yaml         | 5 +++++
 .../apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml    | 2 +-
 5 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml b/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
index 47c22f76..277b6df8 100644
--- a/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
+++ b/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
@@ -31,7 +31,12 @@ spec:
         - -c
         - |
           set -eu
+          deadline=$(( $(date +%s) + 1200 ))
           until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
+            if [ "$(date +%s)" -ge "$deadline" ]; then
+              echo "admin kubeconfig was not provisioned within 20m; exiting so the pod goes CrashLoopBackOff and surfaces in dashboards" >&2
+              exit 1
+            fi
             echo "waiting for admin kubeconfig to be provisioned by Kamaji..."
             sleep 5
           done
diff --git a/packages/apps/kubernetes/templates/cluster.yaml b/packages/apps/kubernetes/templates/cluster.yaml
index 99249c1a..1747df4e 100644
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -1,6 +1,6 @@
 {{- $etcd := .Values._namespace.etcd }}
 {{- if not $etcd }}
-{{- fail "Kubernetes tenant requires a parent tenant with etcd enabled: set .Values.etcd=true on tenant-root (or any ancestor tenant), wait for the etcd HelmRelease to reconcile (DataStore CR appears in the tenant namespace), then retry." }}
+{{- fail "Kubernetes tenant requires a parent Tenant application with etcd: true so the etcd module deploys a DataStore CR in the tenant namespace. Set spec.etcd: true on the root Tenant (or any ancestor Tenant), wait for the etcd HelmRelease to reconcile and the DataStore CR to appear, then retry." }}
 {{- end }}
 {{- $ingress := .Values._namespace.ingress }}
 {{- $host := .Values._namespace.host }}
diff --git a/packages/apps/kubernetes/templates/csi/deploy.yaml b/packages/apps/kubernetes/templates/csi/deploy.yaml
index 2979c75c..ff170cb8 100644
--- a/packages/apps/kubernetes/templates/csi/deploy.yaml
+++ b/packages/apps/kubernetes/templates/csi/deploy.yaml
@@ -32,7 +32,12 @@ spec:
           - -c
           - |
             set -eu
+            deadline=$(( $(date +%s) + 1200 ))
             until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
+              if [ "$(date +%s)" -ge "$deadline" ]; then
+                echo "admin kubeconfig was not provisioned within 20m; exiting so the pod goes CrashLoopBackOff and surfaces in dashboards" >&2
+                exit 1
+              fi
               echo "waiting for admin kubeconfig to be provisioned by Kamaji..."
               sleep 5
             done
diff --git a/packages/apps/kubernetes/templates/kccm/manager.yaml b/packages/apps/kubernetes/templates/kccm/manager.yaml
index 5c7f15a4..67321647 100644
--- a/packages/apps/kubernetes/templates/kccm/manager.yaml
+++ b/packages/apps/kubernetes/templates/kccm/manager.yaml
@@ -30,7 +30,12 @@ spec:
         - -c
         - |
           set -eu
+          deadline=$(( $(date +%s) + 1200 ))
           until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
+            if [ "$(date +%s)" -ge "$deadline" ]; then
+              echo "admin kubeconfig was not provisioned within 20m; exiting so the pod goes CrashLoopBackOff and surfaces in dashboards" >&2
+              exit 1
+            fi
             echo "waiting for admin kubeconfig to be provisioned by Kamaji..."
             sleep 5
           done
diff --git a/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml b/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
index 3b2b1d72..2a43e13f 100644
--- a/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
+++ b/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
@@ -116,4 +116,4 @@ tests:
         host: ""
     asserts:
       - failedTemplate:
-          errorPattern: "requires a parent tenant with etcd enabled"
+          errorPattern: "requires a parent Tenant application with etcd: true"

From b38ae605495ff30a71013037af94839c4944e815 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 21:05:23 +0300
Subject: [PATCH 479/666] fix(kubernetes): soft-skip cluster resources when
 tenant has no DataStore

A hard helm fail in cluster.yaml made every cold bootstrap racy: if
the parent Tenant chart had not yet populated _namespace.etcd in
cozystack-values when the Kubernetes HelmRelease first reconciled, the
fail fired, install.remediation triggered, installFailures incremented
and the new e2e remediation-guard flagged it as a bug. That directly
contradicts the race the rest of this PR is trying to close.

Replace fail with a graceful skip: render only a status-beacon
ConfigMap (test-awaiting-etcd) when etcd is empty, wrap all
CAPI/Kamaji resources in {{ if $etcd }}. The HelmRelease installs
successfully and goes Ready; flux retries on its 5m interval and picks
up the DataStore as soon as the Tenant chart finishes reconciling.

Update the helm unittest: positive test still asserts dataStoreName on
KamajiControlPlane; the negative test now asserts exactly one
ConfigMap document with status=awaiting-etcd, no Cluster / KCP /
KubevirtCluster / WorkloadMonitor rendered.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../apps/kubernetes/templates/cluster.yaml    | 37 +++++++++++++++++--
 .../tests/admin_kubeconfig_wait_test.yaml     | 19 ++++++++--
 2 files changed, 50 insertions(+), 6 deletions(-)

diff --git a/packages/apps/kubernetes/templates/cluster.yaml b/packages/apps/kubernetes/templates/cluster.yaml
index 1747df4e..12da9818 100644
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -1,7 +1,15 @@
 {{- $etcd := .Values._namespace.etcd }}
-{{- if not $etcd }}
-{{- fail "Kubernetes tenant requires a parent Tenant application with etcd: true so the etcd module deploys a DataStore CR in the tenant namespace. Set spec.etcd: true on the root Tenant (or any ancestor Tenant), wait for the etcd HelmRelease to reconcile and the DataStore CR to appear, then retry." }}
-{{- end }}
+{{- /*
+  When $etcd is empty, the parent Tenant application has not populated
+  _namespace.etcd in cozystack-values yet - either the operator forgot to
+  set etcd: true on an ancestor Tenant, or the Tenant HelmRelease is still
+  reconciling. Either way, rendering a KamajiControlPlane with an empty
+  dataStoreName would be rejected by Kamaji's admission webhook and the
+  HelmRelease would fail to install, triggering remediation. Instead, emit
+  a single ConfigMap as a user-visible status beacon and skip the rest so
+  flux marks the HelmRelease Ready and retries its 5m reconcile loop until
+  the Tenant chart catches up.
+*/}}
 {{- $ingress := .Values._namespace.ingress }}
 {{- $host := .Values._namespace.host }}
 {{- $kubevirtmachinetemplateNames := list }}
@@ -87,6 +95,28 @@ spec:
           - name: default
             pod: {}
 {{- end }}
+{{- if not $etcd }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-awaiting-etcd
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/name: kubernetes
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  annotations:
+    cozystack.io/status-beacon: "true"
+data:
+  status: "awaiting-etcd"
+  message: |
+    No DataStore is available for this tenant Kubernetes cluster. The parent
+    Tenant application has not populated _namespace.etcd. Set spec.etcd: true
+    on an ancestor Tenant (usually tenant-root) and wait for its HelmRelease
+    to reconcile - this HelmRelease will pick up the DataStore on its next
+    5m reconcile loop and provision the cluster.
+{{- else }}
 ---
 apiVersion: cluster.x-k8s.io/v1beta1
 kind: Cluster
@@ -407,3 +437,4 @@ metadata:
 spec:
   {{- .spec | toYaml | nindent 2 }}
 {{- end }}
+{{- end }}
diff --git a/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml b/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
index 2a43e13f..e7c03bd1 100644
--- a/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
+++ b/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
@@ -105,7 +105,12 @@ tests:
           path: spec.dataStoreName
           value: tenant-root
 
-  - it: cluster.yaml fails render when tenant has no etcd DataStore
+  - it: cluster.yaml skips Cluster resources when tenant has no etcd DataStore
+    # Must NOT fail rendering - the parent Tenant chart populates
+    # _namespace.etcd asynchronously, so rendering failures here would cause
+    # flux install remediation on every cold bootstrap. Instead, emit only a
+    # ConfigMap status beacon so the HelmRelease reports Ready while flux
+    # retries on its interval until the DataStore appears.
     template: templates/cluster.yaml
     set:
       _namespace:
@@ -115,5 +120,13 @@ tests:
         seaweedfs: ""
         host: ""
     asserts:
-      - failedTemplate:
-          errorPattern: "requires a parent Tenant application with etcd: true"
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - equal:
+          path: metadata.name
+          value: test-awaiting-etcd
+      - equal:
+          path: data.status
+          value: awaiting-etcd

From 1757567218ac313a030da1f82e64541a3f9bfbae Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 21:06:47 +0300
Subject: [PATCH 480/666] refactor(kubernetes): extract wait-for-kubeconfig
 init into shared helper

The three control-plane-side Deployments (cluster-autoscaler, kccm,
kcsi-controller) carried three copies of the same 20-line init
container. That already drifted: the CSI copy used 4-space nesting
while the other two used 2-space. Any future update to the image,
the deadline, or the poll script had to land in three places or
silently diverge.

Extract the block into a new kubernetes.waitForAdminKubeconfig helper
in templates/_helpers.tpl and include it at each call site. Tighten
the deadline from 20m to 10m so it stays strictly below the 15m
HelmRelease Install.Timeout and the CrashLoopBackOff surfaces in
dashboards before flux remediation can fire. Also clarify the wait
message so operators debugging a stuck init container do not chase
Kamaji for what is actually kubelet's optional-Secret refresh cadence.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../apps/kubernetes/templates/_helpers.tpl    | 40 +++++++++++++++++++
 .../cluster-autoscaler/deployment.yaml        | 21 +---------
 .../apps/kubernetes/templates/csi/deploy.yaml | 21 +---------
 .../kubernetes/templates/kccm/manager.yaml    | 21 +---------
 4 files changed, 43 insertions(+), 60 deletions(-)

diff --git a/packages/apps/kubernetes/templates/_helpers.tpl b/packages/apps/kubernetes/templates/_helpers.tpl
index 36c06b64..89f06934 100644
--- a/packages/apps/kubernetes/templates/_helpers.tpl
+++ b/packages/apps/kubernetes/templates/_helpers.tpl
@@ -49,3 +49,43 @@ Selector labels
 app.kubernetes.io/name: {{ include "kubernetes.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
+
+{{/*
+wait-for-kubeconfig init container shared by the control-plane-side
+Deployments (cluster-autoscaler, kccm, kcsi-controller) that mount the
+*-admin-kubeconfig Secret provisioned asynchronously by Kamaji. The
+Secret volume is declared optional so kubelet does not FailedMount while
+Kamaji is still bootstrapping; this container polls the mounted path and
+exits only when super-admin.svc appears, which happens after kubelet's
+optional-Secret refresh cycle.
+
+The 10m deadline stays strictly below the 15m HelmRelease
+Install.Timeout scoped to the Kubernetes Application kind so the
+CrashLoopBackOff surfaces before flux remediation fires and uninstalls
+the Cluster CR.
+
+Call site owns the surrounding volumes block; the kubeconfig volume
+must exist on the pod and mount at /etc/kubernetes/kubeconfig.
+*/}}
+{{- define "kubernetes.waitForAdminKubeconfig" -}}
+- name: wait-for-kubeconfig
+  image: "{{ .Files.Get "images/busybox.tag" | trim }}"
+  command:
+  - sh
+  - -c
+  - |
+    set -eu
+    deadline=$(( $(date +%s) + 600 ))
+    until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
+      if [ "$(date +%s)" -ge "$deadline" ]; then
+        echo "admin kubeconfig was not provisioned within 10m; exiting so the pod goes CrashLoopBackOff and surfaces in dashboards" >&2
+        exit 1
+      fi
+      echo "waiting for admin kubeconfig (provisioned by Kamaji, visible after kubelet Secret refresh)..."
+      sleep 5
+    done
+  volumeMounts:
+  - name: kubeconfig
+    mountPath: /etc/kubernetes/kubeconfig
+    readOnly: true
+{{- end }}
diff --git a/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml b/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
index 277b6df8..348b017d 100644
--- a/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
+++ b/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
@@ -24,26 +24,7 @@ spec:
           operator: Exists
           effect: "NoSchedule"
       initContainers:
-      - name: wait-for-kubeconfig
-        image: "{{ $.Files.Get "images/busybox.tag" | trim }}"
-        command:
-        - sh
-        - -c
-        - |
-          set -eu
-          deadline=$(( $(date +%s) + 1200 ))
-          until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
-            if [ "$(date +%s)" -ge "$deadline" ]; then
-              echo "admin kubeconfig was not provisioned within 20m; exiting so the pod goes CrashLoopBackOff and surfaces in dashboards" >&2
-              exit 1
-            fi
-            echo "waiting for admin kubeconfig to be provisioned by Kamaji..."
-            sleep 5
-          done
-        volumeMounts:
-        - name: kubeconfig
-          mountPath: /etc/kubernetes/kubeconfig
-          readOnly: true
+      {{- include "kubernetes.waitForAdminKubeconfig" $ | nindent 6 }}
       containers:
       - image: "{{ $.Files.Get "images/cluster-autoscaler.tag" | trim }}"
         name: cluster-autoscaler
diff --git a/packages/apps/kubernetes/templates/csi/deploy.yaml b/packages/apps/kubernetes/templates/csi/deploy.yaml
index ff170cb8..c1af7f13 100644
--- a/packages/apps/kubernetes/templates/csi/deploy.yaml
+++ b/packages/apps/kubernetes/templates/csi/deploy.yaml
@@ -25,26 +25,7 @@ spec:
           operator: Exists
           effect: "NoSchedule"
       initContainers:
-        - name: wait-for-kubeconfig
-          image: "{{ $.Files.Get "images/busybox.tag" | trim }}"
-          command:
-          - sh
-          - -c
-          - |
-            set -eu
-            deadline=$(( $(date +%s) + 1200 ))
-            until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
-              if [ "$(date +%s)" -ge "$deadline" ]; then
-                echo "admin kubeconfig was not provisioned within 20m; exiting so the pod goes CrashLoopBackOff and surfaces in dashboards" >&2
-                exit 1
-              fi
-              echo "waiting for admin kubeconfig to be provisioned by Kamaji..."
-              sleep 5
-            done
-          volumeMounts:
-          - name: kubeconfig
-            mountPath: /etc/kubernetes/kubeconfig
-            readOnly: true
+      {{- include "kubernetes.waitForAdminKubeconfig" $ | nindent 6 }}
       containers:
         - name: csi-driver
           imagePullPolicy: Always
diff --git a/packages/apps/kubernetes/templates/kccm/manager.yaml b/packages/apps/kubernetes/templates/kccm/manager.yaml
index 67321647..20ac0a1e 100644
--- a/packages/apps/kubernetes/templates/kccm/manager.yaml
+++ b/packages/apps/kubernetes/templates/kccm/manager.yaml
@@ -23,26 +23,7 @@ spec:
           operator: Exists
           effect: "NoSchedule"
       initContainers:
-      - name: wait-for-kubeconfig
-        image: "{{ $.Files.Get "images/busybox.tag" | trim }}"
-        command:
-        - sh
-        - -c
-        - |
-          set -eu
-          deadline=$(( $(date +%s) + 1200 ))
-          until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
-            if [ "$(date +%s)" -ge "$deadline" ]; then
-              echo "admin kubeconfig was not provisioned within 20m; exiting so the pod goes CrashLoopBackOff and surfaces in dashboards" >&2
-              exit 1
-            fi
-            echo "waiting for admin kubeconfig to be provisioned by Kamaji..."
-            sleep 5
-          done
-        volumeMounts:
-        - name: kubeconfig
-          mountPath: /etc/kubernetes/kubeconfig
-          readOnly: true
+      {{- include "kubernetes.waitForAdminKubeconfig" $ | nindent 6 }}
       containers:
       - name: kubevirt-cloud-controller-manager
         args:

From 7b146cbe56c26511d2228c17cdb7c2201f480395 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 21:09:35 +0300
Subject: [PATCH 481/666] feat(api): make HelmRelease Install/Upgrade timeout
 per-Application

Replace the hardcoded r.kindName == "Kubernetes" switch in rest.go
with a config-driven path. The ApplicationDefinition CR now accepts a
release.cozystack.io/helm-install-timeout annotation that is parsed
at cozystack-api startup into config.ReleaseConfig.HelmInstallTimeout
and applied to both Install.Timeout and Upgrade.Timeout on the
rendered HelmRelease. Applications that leave the annotation unset
keep flux defaults so their failed installs remediate on the normal
cadence - only the Kubernetes kind carries the override and gets a
15m budget. New kinds with a similar race can opt in by setting the
same annotation; no rest.go patch needed.

Kubernetes-rd sets the annotation to 15m. Table-driven test in
rest_timeout_test.go covers three cases: Kubernetes with 15m, Qdrant
unset, and an arbitrary future kind with 20m - all of which pin the
Remediation.Retries == -1 contract as well.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../kubernetes-rd/cozyrds/kubernetes.yaml     |   8 +
 pkg/cmd/server/start.go                       |  35 +++--
 pkg/config/config.go                          |   8 +
 pkg/registry/apps/application/rest.go         |  21 +--
 .../apps/application/rest_timeout_test.go     | 143 ++++++++++--------
 5 files changed, 133 insertions(+), 82 deletions(-)

diff --git a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
index 5e9e8f94..1128abe8 100644
--- a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
+++ b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
@@ -2,6 +2,14 @@ apiVersion: cozystack.io/v1alpha1
 kind: ApplicationDefinition
 metadata:
   name: kubernetes
+  annotations:
+    # Kubernetes tenants boot a Kamaji control plane whose admin-kubeconfig
+    # Secret is provisioned asynchronously. Cold Kamaji start (image pull +
+    # etcd + apiserver Ready) plus admin-kubeconfig generation can exceed
+    # Flux helm-controller's default wait budget, causing remediation loops
+    # that uninstall the Cluster CR. This override applied by cozystack-api
+    # to the HelmRelease Spec.Install.Timeout and Spec.Upgrade.Timeout.
+    release.cozystack.io/helm-install-timeout: "15m"
 spec:
   application:
     kind: Kubernetes
diff --git a/pkg/cmd/server/start.go b/pkg/cmd/server/start.go
index f7791332..3e905735 100644
--- a/pkg/cmd/server/start.go
+++ b/pkg/cmd/server/start.go
@@ -160,6 +160,31 @@ func (o *CozyServerOptions) Complete() error {
 	// Convert to ResourceConfig
 	o.ResourceConfig = &config.ResourceConfig{}
 	for _, crd := range crdList.Items {
+		release := config.ReleaseConfig{
+			Prefix: crd.Spec.Release.Prefix,
+			Labels: crd.Spec.Release.Labels,
+			ChartRef: config.ChartRefConfig{
+				Kind:      crd.Spec.Release.ChartRef.Kind,
+				Name:      crd.Spec.Release.ChartRef.Name,
+				Namespace: crd.Spec.Release.ChartRef.Namespace,
+			},
+		}
+		// Per-Application HelmRelease Install/Upgrade timeout. Applications
+		// whose parent chart contains asynchronously-provisioned resources
+		// the chart itself depends on (for example, the Kamaji-provisioned
+		// admin-kubeconfig Secret for Kubernetes tenants) need a longer
+		// wait budget than the Flux default. Consumed by the REST storage
+		// layer when building the HelmRelease Spec.
+		if raw, ok := crd.Annotations["release.cozystack.io/helm-install-timeout"]; ok && raw != "" {
+			d, err := time.ParseDuration(raw)
+			if err != nil {
+				return fmt.Errorf(
+					"ApplicationDefinition %q has invalid release.cozystack.io/helm-install-timeout %q: %w",
+					crd.Name, raw, err,
+				)
+			}
+			release.HelmInstallTimeout = d
+		}
 		resource := config.Resource{
 			Application: config.ApplicationConfig{
 				Kind:          crd.Spec.Application.Kind,
@@ -168,15 +193,7 @@ func (o *CozyServerOptions) Complete() error {
 				ShortNames:    []string{}, // TODO: implement shortnames
 				OpenAPISchema: crd.Spec.Application.OpenAPISchema,
 			},
-			Release: config.ReleaseConfig{
-				Prefix: crd.Spec.Release.Prefix,
-				Labels: crd.Spec.Release.Labels,
-				ChartRef: config.ChartRefConfig{
-					Kind:      crd.Spec.Release.ChartRef.Kind,
-					Name:      crd.Spec.Release.ChartRef.Name,
-					Namespace: crd.Spec.Release.ChartRef.Namespace,
-				},
-			},
+			Release: release,
 		}
 		o.ResourceConfig.Resources = append(o.ResourceConfig.Resources, resource)
 	}
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 1e123e2c..16cf4f0c 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -16,6 +16,8 @@ limitations under the License.
 
 package config
 
+import "time"
+
 // ResourceConfig represents the structure of the configuration file.
 type ResourceConfig struct {
 	Resources []Resource `yaml:"resources"`
@@ -41,6 +43,12 @@ type ReleaseConfig struct {
 	Prefix   string            `yaml:"prefix"`
 	Labels   map[string]string `yaml:"labels"`
 	ChartRef ChartRefConfig    `yaml:"chartRef"`
+	// HelmInstallTimeout overrides the Flux HelmRelease Install.Timeout and
+	// Upgrade.Timeout for this Application kind. When zero, flux defaults
+	// apply. Populated from the
+	// release.cozystack.io/helm-install-timeout annotation on the
+	// ApplicationDefinition at start-up.
+	HelmInstallTimeout time.Duration `yaml:"helmInstallTimeout,omitempty"`
 }
 
 // ChartRefConfig references a Flux source artifact for the Helm chart.
diff --git a/pkg/registry/apps/application/rest.go b/pkg/registry/apps/application/rest.go
index 9b92d2c0..406d3738 100644
--- a/pkg/registry/apps/application/rest.go
+++ b/pkg/registry/apps/application/rest.go
@@ -1528,16 +1528,17 @@ func (r *REST) convertApplicationToHelmRelease(app *appsv1alpha1.Application) (*
 		},
 	}
 
-	// The Kubernetes Application's parent chart creates CAPI/Kamaji resources
-	// whose admin-kubeconfig Secret is provisioned asynchronously and mounted
-	// by Deployments in the same chart. On a cold node, Kamaji control-plane
-	// bootstrap routinely exceeds flux helm-controller's default wait budget,
-	// so install remediation loops uninstall the Cluster CR and churn. Extend
-	// the wait budget to 15m for Kubernetes only - other Application kinds
-	// without this race keep flux defaults, so their failed installs do not
-	// linger unnecessarily before remediation fires.
-	if r.kindName == "Kubernetes" {
-		timeout := metav1.Duration{Duration: 15 * time.Minute}
+	// Per-Application HelmRelease wait budget. When an ApplicationDefinition
+	// sets release.cozystack.io/helm-install-timeout, the annotation is
+	// parsed at startup into ReleaseConfig.HelmInstallTimeout and applied
+	// to both Install and Upgrade here. Applications that leave it unset
+	// (the common case) keep flux defaults, so their failed installs
+	// remediate on the normal cadence. Needed for the Kubernetes kind
+	// because its parent chart contains CAPI/Kamaji resources whose
+	// admin-kubeconfig Secret is provisioned asynchronously and Kamaji
+	// cold-start routinely exceeds flux's default wait budget.
+	if r.releaseConfig.HelmInstallTimeout > 0 {
+		timeout := metav1.Duration{Duration: r.releaseConfig.HelmInstallTimeout}
 		helmRelease.Spec.Install.Timeout = &timeout
 		helmRelease.Spec.Upgrade.Timeout = &timeout
 	}
diff --git a/pkg/registry/apps/application/rest_timeout_test.go b/pkg/registry/apps/application/rest_timeout_test.go
index fa6d5427..8474d1cb 100644
--- a/pkg/registry/apps/application/rest_timeout_test.go
+++ b/pkg/registry/apps/application/rest_timeout_test.go
@@ -10,7 +10,7 @@ import (
 	"github.com/cozystack/cozystack/pkg/config"
 )
 
-func newRESTForKind(kind, prefix string) *REST {
+func newRESTForTimeout(kind, prefix string, helmInstallTimeout time.Duration) *REST {
 	return &REST{
 		kindName: kind,
 		releaseConfig: config.ReleaseConfig{
@@ -20,76 +20,93 @@ func newRESTForKind(kind, prefix string) *REST {
 				Name:      "x",
 				Namespace: "cozy-system",
 			},
+			HelmInstallTimeout: helmInstallTimeout,
 		},
 	}
 }
 
-func TestConvertApplicationToHelmRelease_KubernetesKindGetsLongTimeout(t *testing.T) {
-	r := newRESTForKind("Kubernetes", "kubernetes-")
-	app := &appsv1alpha1.Application{
-		ObjectMeta: metav1.ObjectMeta{Name: "example", Namespace: "tenant-root"},
+// Table-driven: every Application kind carries a per-CRD HelmRelease wait
+// budget. The Kubernetes kind's parent chart contains CAPI/Kamaji resources
+// whose admin-kubeconfig Secret is provisioned asynchronously, so its
+// ApplicationDefinition sets release.cozystack.io/helm-install-timeout=15m
+// (or longer). Other kinds leave the annotation unset and keep flux defaults
+// so their failed installs remediate on the normal cadence. The test must
+// cover both paths: a kind with the timeout set and one without.
+func TestConvertApplicationToHelmRelease_AppliesReleaseConfigTimeout(t *testing.T) {
+	cases := []struct {
+		name       string
+		kind       string
+		prefix     string
+		configured time.Duration
+		wantSet    bool
+	}{
+		{
+			name:       "Kubernetes kind with 15m configured gets Install and Upgrade Timeout",
+			kind:       "Kubernetes",
+			prefix:     "kubernetes-",
+			configured: 15 * time.Minute,
+			wantSet:    true,
+		},
+		{
+			name:       "Qdrant kind without configured timeout keeps flux defaults",
+			kind:       "Qdrant",
+			prefix:     "qdrant-",
+			configured: 0,
+			wantSet:    false,
+		},
+		{
+			name:       "arbitrary future kind with 20m configured gets 20m",
+			kind:       "TalosCluster",
+			prefix:     "talos-",
+			configured: 20 * time.Minute,
+			wantSet:    true,
+		},
 	}
 
-	hr, err := r.convertApplicationToHelmRelease(app)
-	if err != nil {
-		t.Fatalf("convertApplicationToHelmRelease returned error: %v", err)
-	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := newRESTForTimeout(tc.kind, tc.prefix, tc.configured)
+			app := &appsv1alpha1.Application{
+				ObjectMeta: metav1.ObjectMeta{Name: "example", Namespace: "tenant-root"},
+			}
 
-	if hr.Spec.Install == nil {
-		t.Fatal("Spec.Install must not be nil")
-	}
-	if hr.Spec.Install.Timeout == nil {
-		t.Fatal("Spec.Install.Timeout must be set for Kubernetes kind")
-	}
-	if hr.Spec.Install.Timeout.Duration < 15*time.Minute {
-		t.Errorf("Spec.Install.Timeout must be >= 15m for Kubernetes, got %v", hr.Spec.Install.Timeout.Duration)
-	}
+			hr, err := r.convertApplicationToHelmRelease(app)
+			if err != nil {
+				t.Fatalf("convertApplicationToHelmRelease returned error: %v", err)
+			}
 
-	if hr.Spec.Upgrade == nil {
-		t.Fatal("Spec.Upgrade must not be nil")
-	}
-	if hr.Spec.Upgrade.Timeout == nil {
-		t.Fatal("Spec.Upgrade.Timeout must be set for Kubernetes kind")
-	}
-	if hr.Spec.Upgrade.Timeout.Duration < 15*time.Minute {
-		t.Errorf("Spec.Upgrade.Timeout must be >= 15m for Kubernetes, got %v", hr.Spec.Upgrade.Timeout.Duration)
-	}
+			if hr.Spec.Install == nil || hr.Spec.Upgrade == nil {
+				t.Fatalf("Spec.Install/Upgrade must be non-nil")
+			}
 
-	if hr.Spec.Install.Remediation == nil || hr.Spec.Install.Remediation.Retries != -1 {
-		t.Errorf("Spec.Install.Remediation.Retries must remain -1, got %+v", hr.Spec.Install.Remediation)
-	}
-	if hr.Spec.Upgrade.Remediation == nil || hr.Spec.Upgrade.Remediation.Retries != -1 {
-		t.Errorf("Spec.Upgrade.Remediation.Retries must remain -1, got %+v", hr.Spec.Upgrade.Remediation)
-	}
-}
-
-func TestConvertApplicationToHelmRelease_NonKubernetesKindKeepsFluxDefaults(t *testing.T) {
-	// For Applications whose parent chart has no admin-kubeconfig race
-	// (Qdrant, MongoDB, Postgres, etc.), do NOT extend the helm-wait
-	// budget - otherwise failed installs would block three times as long
-	// before Flux starts remediating.
-	r := newRESTForKind("Qdrant", "qdrant-")
-	app := &appsv1alpha1.Application{
-		ObjectMeta: metav1.ObjectMeta{Name: "example", Namespace: "tenant-root"},
-	}
-
-	hr, err := r.convertApplicationToHelmRelease(app)
-	if err != nil {
-		t.Fatalf("convertApplicationToHelmRelease returned error: %v", err)
-	}
-
-	if hr.Spec.Install != nil && hr.Spec.Install.Timeout != nil {
-		t.Errorf("Spec.Install.Timeout must be unset for non-Kubernetes kinds, got %v", hr.Spec.Install.Timeout.Duration)
-	}
-	if hr.Spec.Upgrade != nil && hr.Spec.Upgrade.Timeout != nil {
-		t.Errorf("Spec.Upgrade.Timeout must be unset for non-Kubernetes kinds, got %v", hr.Spec.Upgrade.Timeout.Duration)
-	}
-
-	// But remediation must still be -1 across the board.
-	if hr.Spec.Install.Remediation == nil || hr.Spec.Install.Remediation.Retries != -1 {
-		t.Errorf("Spec.Install.Remediation.Retries must remain -1, got %+v", hr.Spec.Install.Remediation)
-	}
-	if hr.Spec.Upgrade.Remediation == nil || hr.Spec.Upgrade.Remediation.Retries != -1 {
-		t.Errorf("Spec.Upgrade.Remediation.Retries must remain -1, got %+v", hr.Spec.Upgrade.Remediation)
+			if tc.wantSet {
+				if hr.Spec.Install.Timeout == nil {
+					t.Fatalf("Spec.Install.Timeout must be set when HelmInstallTimeout=%v", tc.configured)
+				}
+				if hr.Spec.Install.Timeout.Duration != tc.configured {
+					t.Errorf("Spec.Install.Timeout = %v, want %v", hr.Spec.Install.Timeout.Duration, tc.configured)
+				}
+				if hr.Spec.Upgrade.Timeout == nil {
+					t.Fatalf("Spec.Upgrade.Timeout must be set when HelmInstallTimeout=%v", tc.configured)
+				}
+				if hr.Spec.Upgrade.Timeout.Duration != tc.configured {
+					t.Errorf("Spec.Upgrade.Timeout = %v, want %v", hr.Spec.Upgrade.Timeout.Duration, tc.configured)
+				}
+			} else {
+				if hr.Spec.Install.Timeout != nil {
+					t.Errorf("Spec.Install.Timeout must be nil when HelmInstallTimeout=0, got %v", hr.Spec.Install.Timeout.Duration)
+				}
+				if hr.Spec.Upgrade.Timeout != nil {
+					t.Errorf("Spec.Upgrade.Timeout must be nil when HelmInstallTimeout=0, got %v", hr.Spec.Upgrade.Timeout.Duration)
+				}
+			}
+
+			if hr.Spec.Install.Remediation == nil || hr.Spec.Install.Remediation.Retries != -1 {
+				t.Errorf("Spec.Install.Remediation.Retries must remain -1, got %+v", hr.Spec.Install.Remediation)
+			}
+			if hr.Spec.Upgrade.Remediation == nil || hr.Spec.Upgrade.Remediation.Retries != -1 {
+				t.Errorf("Spec.Upgrade.Remediation.Retries must remain -1, got %+v", hr.Spec.Upgrade.Remediation)
+			}
+		})
 	}
 }

From bc5473d4fc9bb1b43be79ea5eb8d370d9e6c00b7 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 21:11:38 +0300
Subject: [PATCH 482/666] test(kubernetes): chart-wide invariant for
 admin-kubeconfig guards

The per-template unittests in packages/apps/kubernetes/tests/ assert
that cluster-autoscaler, kccm, and the csi controller each mount the
admin-kubeconfig Secret optional and carry the wait-for-kubeconfig
init. That locks in today's three Deployments by name - a fourth
Deployment that mounts the same Secret but forgets the guard would
slip past them.

Add a bats-unit test that renders the entire chart, enumerates every
Deployment whose spec mounts a Secret ending in -admin-kubeconfig, and
asserts optional:true plus wait-for-kubeconfig init on all of them.
Verified by temporarily removing optional:true from csi/deploy.yaml:
the test correctly flagged invariant-kcsi-controller as an offender.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/admin-kubeconfig-invariant.bats | 72 ++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)
 create mode 100644 hack/admin-kubeconfig-invariant.bats

diff --git a/hack/admin-kubeconfig-invariant.bats b/hack/admin-kubeconfig-invariant.bats
new file mode 100644
index 00000000..d699de83
--- /dev/null
+++ b/hack/admin-kubeconfig-invariant.bats
@@ -0,0 +1,72 @@
+#!/usr/bin/env bats
+# -----------------------------------------------------------------------------
+# Chart-wide invariant for packages/apps/kubernetes:
+#
+# Every Deployment in this chart that mounts <release>-admin-kubeconfig as a
+# Secret volume MUST:
+#   - declare that volume optional: true (so kubelet does not FailedMount
+#     while Kamaji is still provisioning the Secret), AND
+#   - include the wait-for-kubeconfig init container (so the pod becomes
+#     Ready only after Kamaji publishes the Secret).
+#
+# The per-template unittests in packages/apps/kubernetes/tests/ lock in
+# today's three Deployments (cluster-autoscaler, kccm, csi controller) by
+# name. This invariant is stricter: any future Deployment added to this
+# chart that mounts the same Secret but forgets the guard will fail here.
+#
+# Requires: helm, yq (mikefarah v4+), jq. All three are available on the
+# project's CI runners and on the maintainer workstation.
+# -----------------------------------------------------------------------------
+
+@test "every Deployment mounting admin-kubeconfig has optional:true and wait-for-kubeconfig init" {
+  values_file="packages/apps/kubernetes/tests/values-ci.yaml"
+  [ -f "$values_file" ]
+
+  tmp=$(mktemp -d)
+  trap 'rm -rf "$tmp"' EXIT
+
+  helm template invariant packages/apps/kubernetes \
+    --namespace tenant-root \
+    --values "$values_file" \
+    2>/dev/null > "$tmp/rendered.yaml"
+
+  # yq streams one JSON object per input document. jq -s slurps the stream
+  # into an array so we can treat all Deployments as a single collection.
+  yq --output-format=json eval-all '.' "$tmp/rendered.yaml" \
+    | jq -s --raw-output '
+        map(select(.kind == "Deployment")) |
+        map({
+          name: .metadata.name,
+          volumes: (.spec.template.spec.volumes // []),
+          initNames: ((.spec.template.spec.initContainers // []) | map(.name)),
+        }) |
+        map(
+          .name as $n |
+          .initNames as $ins |
+          (.volumes[] | select(.secret.secretName | test("-admin-kubeconfig$")?))
+          | {
+              name: $n,
+              optional: (.secret.optional == true),
+              hasInit: ($ins | index("wait-for-kubeconfig") != null),
+            }
+        )
+      ' > "$tmp/summary.json"
+
+  # At least one Deployment must match; if a refactor removes every
+  # admin-kubeconfig volume from this chart, the test must be updated
+  # deliberately rather than silently passing.
+  matched=$(jq 'length' "$tmp/summary.json")
+  [ "$matched" -ge 1 ]
+
+  offenders=$(jq --raw-output '.[] | select(.optional != true or .hasInit != true) | .name' "$tmp/summary.json")
+
+  if [ -n "$offenders" ]; then
+    echo "Deployments mounting *-admin-kubeconfig without optional:true + wait-for-kubeconfig init:" >&2
+    echo "$offenders" >&2
+    echo "Full summary:" >&2
+    cat "$tmp/summary.json" >&2
+    exit 1
+  fi
+
+  echo "Invariant holds for $matched Deployment(s)"
+}

From 03426fbd718029e40d6680f299189e97f915a614 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 21:13:06 +0300
Subject: [PATCH 483/666] test(hack): pin HelmRelease v2 status shape used by
 remediation guard

run-kubernetes.sh extracts .status.installFailures and
.status.upgradeFailures via kubectl -o jsonpath. If a future flux
release renames the counters, kubectl returns empty, the guard reports
no cycle, and e2e silently misses real remediation loops.

Add a bats unit test that feeds a pinned HelmRelease v2 status snippet
through the same jsonpath and asserts the extraction still yields the
expected values. Also leave a pointer comment in run-kubernetes.sh so a
future flux bump surfaces the version coupling in review.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/run-kubernetes.sh |  7 ++++++
 hack/remediation-guard.bats     | 44 +++++++++++++++++++++++++++++++++
 2 files changed, 51 insertions(+)

diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index 811f42a7..e6002b53 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -326,6 +326,13 @@ EOF
   # A non-zero installFailures/upgradeFailures indicates the helm-wait budget expired while
   # admin-kubeconfig was still being provisioned, which would trigger uninstall remediation
   # and churn the Cluster CR.
+  # Flux helm-controller v2 status shape: .status.installFailures and
+  # .status.upgradeFailures are counters populated by the controller on
+  # every failed install/upgrade. If a future flux release renames them,
+  # kubectl returns the empty string and the guard silently passes. The
+  # shape is pinned by hack/remediation-guard.bats (see that file for
+  # details), and the vendored API types live under
+  # vendor/github.com/fluxcd/helm-controller/api/v2.
   install_failures=$(kubectl get hr -n tenant-test "kubernetes-${test_name}" -ojsonpath='{.status.installFailures}')
   upgrade_failures=$(kubectl get hr -n tenant-test "kubernetes-${test_name}" -ojsonpath='{.status.upgradeFailures}')
   if helmrelease_has_remediation_cycle "${install_failures}" "${upgrade_failures}"; then
diff --git a/hack/remediation-guard.bats b/hack/remediation-guard.bats
index 64aa83af..9c33452a 100644
--- a/hack/remediation-guard.bats
+++ b/hack/remediation-guard.bats
@@ -85,3 +85,47 @@
     helmrelease_has_remediation_cycle "3" "5" || rc=$?
     [ "$rc" -eq 0 ]
 }
+
+@test "installFailures and upgradeFailures extraction pins HR v2 status shape" {
+    # Pins the Flux HelmRelease v2 status shape that run-kubernetes.sh relies
+    # on. If a future Flux version renames .status.installFailures (or
+    # .status.upgradeFailures), kubectl get -o jsonpath returns an empty
+    # string, the guard quietly says "no cycle", and real remediation loops
+    # slip past the e2e assertion.
+    #
+    # This test uses yq to read the exact path used in the e2e script. yq
+    # evaluates the same json-ish jsonpath against a pinned HR snippet, so
+    # the test fails loudly if the field ever disappears or moves. Cross
+    # reference: vendor/github.com/fluxcd/helm-controller/api/v2/ status
+    # struct field tags.
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' EXIT
+
+    cat > "$tmp/hr.yaml" <<'YAML'
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kubernetes-test
+  namespace: tenant-test
+spec:
+  interval: 5m
+status:
+  installFailures: 2
+  upgradeFailures: 0
+  conditions:
+    - type: Ready
+      status: "False"
+      reason: UninstallSucceeded
+YAML
+
+    install_failures=$(yq '.status.installFailures' "$tmp/hr.yaml")
+    upgrade_failures=$(yq '.status.upgradeFailures' "$tmp/hr.yaml")
+
+    [ "$install_failures" = "2" ]
+    [ "$upgrade_failures" = "0" ]
+
+    . hack/e2e-apps/remediation-guard.sh
+    rc=0
+    helmrelease_has_remediation_cycle "$install_failures" "$upgrade_failures" || rc=$?
+    [ "$rc" -eq 0 ]
+}

From 12632c60c76b77639c8e2edd7ab5bdb248398a7e Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 21:25:50 +0300
Subject: [PATCH 484/666] fix(kubernetes): gate CP-side Deployments on tenant
 etcd DataStore

The soft-skip wrap in cluster.yaml only silenced Cluster and
KamajiControlPlane rendering when _namespace.etcd is empty. The three
CP-side Deployments (cluster-autoscaler, kccm, kcsi-controller) still
rendered, their wait-for-kubeconfig init containers CrashLoopBackOff'd
forever (no KamajiControlPlane = no admin-kubeconfig Secret),
HelmRelease hit its 15m wait timeout and triggered the very install
remediation cycle the rest of this PR prevents. Self-contradiction.

Wrap each of the three Deployment templates in
{{- if .Values._namespace.etcd }}...{{- end }} so they render only
when there is a DataStore to back them. Add an invariant bats test
that renders the whole chart with etcd empty and asserts zero
Deployments reference *-admin-kubeconfig.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/admin-kubeconfig-invariant.bats          | 45 +++++++++++++++++++
 .../cluster-autoscaler/deployment.yaml        | 12 +++++
 .../apps/kubernetes/templates/csi/deploy.yaml |  2 +
 .../kubernetes/templates/kccm/manager.yaml    |  2 +
 4 files changed, 61 insertions(+)

diff --git a/hack/admin-kubeconfig-invariant.bats b/hack/admin-kubeconfig-invariant.bats
index d699de83..c027e2c4 100644
--- a/hack/admin-kubeconfig-invariant.bats
+++ b/hack/admin-kubeconfig-invariant.bats
@@ -70,3 +70,48 @@
 
   echo "Invariant holds for $matched Deployment(s)"
 }
+
+@test "chart emits zero admin-kubeconfig Deployments when tenant has no etcd DataStore" {
+  # Without a DataStore (parent Tenant has not populated _namespace.etcd yet)
+  # the control-plane-side Deployments must NOT render at all. If they did,
+  # the wait-for-kubeconfig init would CrashLoopBackOff indefinitely - there
+  # would be no KamajiControlPlane to provision the Secret - consuming the
+  # HelmRelease wait budget and triggering exactly the remediation cycle the
+  # rest of this chart tries to avoid. This test renders the whole chart
+  # with etcd empty and asserts no Deployment references the admin-kubeconfig
+  # Secret.
+  tmp=$(mktemp -d)
+  trap 'rm -rf "$tmp"' EXIT
+
+  helm template invariant packages/apps/kubernetes \
+    --namespace tenant-root \
+    --set _namespace.etcd="" \
+    --set _namespace.monitoring="" \
+    --set _namespace.ingress="" \
+    --set _namespace.seaweedfs="" \
+    --set _namespace.host="" \
+    --set _cluster.cluster-domain=cozy.local \
+    --set 'nodeGroups=null' \
+    2>/dev/null > "$tmp/rendered.yaml"
+
+  matched=$(
+    yq --output-format=json eval-all '.' "$tmp/rendered.yaml" \
+      | jq -s '
+          map(select(.kind == "Deployment")) |
+          map(select(
+            (.spec.template.spec.volumes // [])
+              | any(.secret.secretName | test("-admin-kubeconfig$")?)
+          )) |
+          length
+        '
+  )
+
+  if [ "$matched" -ne 0 ]; then
+    echo "Expected zero Deployments mounting *-admin-kubeconfig when etcd is empty, got $matched:" >&2
+    yq --output-format=json eval-all '.' "$tmp/rendered.yaml" \
+      | jq -s 'map(select(.kind == "Deployment") | .metadata.name)' >&2
+    exit 1
+  fi
+
+  echo "No admin-kubeconfig Deployments rendered for empty etcd (as expected)"
+}
diff --git a/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml b/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
index 348b017d..298d86db 100644
--- a/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
+++ b/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
@@ -1,3 +1,14 @@
+{{- /*
+  Gate the control-plane-side workloads on the parent tenant having an etcd
+  DataStore. Without it no KamajiControlPlane is ever created, Kamaji never
+  provisions -admin-kubeconfig, and rendering these Deployments would cause
+  the wait-for-kubeconfig init to CrashLoopBackOff indefinitely, consuming
+  the parent HelmRelease install timeout and triggering the very uninstall
+  remediation cycle this chart is supposed to avoid. Rendering them only
+  when $etcd is set keeps the HelmRelease Ready while flux retries on its
+  interval and picks up the DataStore as soon as the Tenant chart finishes.
+*/}}
+{{- if .Values._namespace.etcd }}
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -108,3 +119,4 @@ rules:
     - list
     - update
     - watch
+{{- end }}
diff --git a/packages/apps/kubernetes/templates/csi/deploy.yaml b/packages/apps/kubernetes/templates/csi/deploy.yaml
index c1af7f13..de62104c 100644
--- a/packages/apps/kubernetes/templates/csi/deploy.yaml
+++ b/packages/apps/kubernetes/templates/csi/deploy.yaml
@@ -1,3 +1,4 @@
+{{- if .Values._namespace.etcd }}
 kind: Deployment
 apiVersion: apps/v1
 metadata:
@@ -238,3 +239,4 @@ spec:
             secretName: {{ .Release.Name }}-admin-kubeconfig
             optional: true
           name: kubeconfig
+{{- end }}
diff --git a/packages/apps/kubernetes/templates/kccm/manager.yaml b/packages/apps/kubernetes/templates/kccm/manager.yaml
index 20ac0a1e..bd9e2798 100644
--- a/packages/apps/kubernetes/templates/kccm/manager.yaml
+++ b/packages/apps/kubernetes/templates/kccm/manager.yaml
@@ -1,3 +1,4 @@
+{{- if .Values._namespace.etcd }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -60,3 +61,4 @@ spec:
           optional: true
         name: kubeconfig
       serviceAccountName: {{ .Release.Name }}-kccm
+{{- end }}

From 1ddd2aaea97024f6803c60d29a946273b55e4185 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 21:28:11 +0300
Subject: [PATCH 485/666] fix(hack): detect remediation via status.history, not
 transient counters

Flux helm-controller's ClearFailures() zeroes installFailures and
upgradeFailures on every successful reconciliation (see the upstream
HelmReleaseStatus method). The previous guard ran after the HelmRelease
was Ready, at which point the counters were always 0 - the assertion
was vacuous and would have passed against a reverted fix.

Switch to .status.history, which retains per-revision release
Snapshots that survive a subsequent successful reconciliation. A
remediation cycle leaves behind a Snapshot with status=uninstalled
(the install-remediation code path) or status=failed (Helm release
failure that remediation then uninstalled). Either one signals the
race actually fired.

Rewrite the bats unit tests to cover: empty history, deployed-only,
deployed+superseded (happy path - not detected), single failed,
single uninstalled, uninstalled-then-deployed, and deployed-then-failed
(all detected). The pinned-shape test feeds a realistic HR status
snippet through yq the same way run-kubernetes.sh does via kubectl
-o jsonpath.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/e2e-apps/remediation-guard.sh |  45 +++++---
 hack/e2e-apps/run-kubernetes.sh    |  24 +++--
 hack/remediation-guard.bats        | 158 ++++++++++++++---------------
 3 files changed, 120 insertions(+), 107 deletions(-)

diff --git a/hack/e2e-apps/remediation-guard.sh b/hack/e2e-apps/remediation-guard.sh
index 6da69f13..38463310 100644
--- a/hack/e2e-apps/remediation-guard.sh
+++ b/hack/e2e-apps/remediation-guard.sh
@@ -1,24 +1,39 @@
 # Helpers for asserting that a Flux HelmRelease did not fall into an
 # install/upgrade remediation cycle during an e2e run.
 #
-# A non-zero installFailures/upgradeFailures counter means flux
-# helm-controller hit its wait timeout, ran remediation (uninstall),
-# and re-installed. That is exactly the race this guard is meant to
-# catch, so the function returns success (0) when a cycle is detected
-# and failure (1) otherwise.
+# Background: Flux helm-controller's ClearFailures() zeroes
+# .status.installFailures / .status.upgradeFailures on every successful
+# reconciliation (see the upstream ClearFailures method on
+# HelmReleaseStatus). That makes those counters useless for a guard that
+# runs after the HelmRelease has reached Ready - the values are always 0.
 #
-# Both arguments may be empty strings, the literal "0", or a positive
-# integer. Shell's && and || have equal precedence with left-to-right
-# associativity, so each half of the disjunction is grouped explicitly
-# to avoid (A && B) || C && D parsing that masks the common
-# install_failures=1, upgrade_failures="" case.
+# What survives a successful reconciliation is .status.history, a bounded
+# list of release Snapshots. Each Snapshot carries a status field that
+# tracks the Helm release state: deployed, superseded, failed, uninstalled,
+# and so on. A remediation cycle leaves the footprint behind: a snapshot
+# with status "uninstalled" (from install/upgrade remediation) or "failed"
+# (Helm release failure that remediation then uninstalled). Those stay in
+# history even after a subsequent successful reinstall.
+#
+# helmrelease_has_remediation_cycle takes a newline-delimited list of
+# snapshot statuses (whatever the caller extracted via kubectl -o jsonpath
+# or equivalent) and returns 0 (detected) when any entry is "failed" or
+# "uninstalled", 1 otherwise. Empty input is treated as "no history yet,
+# no cycle observed".
 
 helmrelease_has_remediation_cycle() {
-    install_failures="$1"
-    upgrade_failures="$2"
-    if { [ -n "${install_failures}" ] && [ "${install_failures}" != "0" ]; } || \
-       { [ -n "${upgrade_failures}" ] && [ "${upgrade_failures}" != "0" ]; }; then
-        return 0
+    statuses="$1"
+    if [ -z "${statuses}" ]; then
+        return 1
     fi
+    while IFS= read -r status; do
+        case "${status}" in
+            failed|uninstalled)
+                return 0
+                ;;
+        esac
+    done <<EOF
+${statuses}
+EOF
     return 1
 }
diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index e6002b53..64b1ae90 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -326,17 +326,19 @@ EOF
   # A non-zero installFailures/upgradeFailures indicates the helm-wait budget expired while
   # admin-kubeconfig was still being provisioned, which would trigger uninstall remediation
   # and churn the Cluster CR.
-  # Flux helm-controller v2 status shape: .status.installFailures and
-  # .status.upgradeFailures are counters populated by the controller on
-  # every failed install/upgrade. If a future flux release renames them,
-  # kubectl returns the empty string and the guard silently passes. The
-  # shape is pinned by hack/remediation-guard.bats (see that file for
-  # details), and the vendored API types live under
-  # vendor/github.com/fluxcd/helm-controller/api/v2.
-  install_failures=$(kubectl get hr -n tenant-test "kubernetes-${test_name}" -ojsonpath='{.status.installFailures}')
-  upgrade_failures=$(kubectl get hr -n tenant-test "kubernetes-${test_name}" -ojsonpath='{.status.upgradeFailures}')
-  if helmrelease_has_remediation_cycle "${install_failures}" "${upgrade_failures}"; then
-    echo "Parent HelmRelease entered remediation cycle: installFailures=${install_failures:-0}, upgradeFailures=${upgrade_failures:-0}" >&2
+  # Flux helm-controller v2 retains per-revision release Snapshots in
+  # .status.history; each Snapshot's .status reflects the Helm release
+  # state (deployed/superseded/failed/uninstalled). A remediation cycle
+  # leaves a "failed" or "uninstalled" entry behind that survives a later
+  # successful reinstall, unlike the installFailures/upgradeFailures
+  # counters (which ClearFailures zeroes on every successful reconcile).
+  # The shape is pinned by hack/remediation-guard.bats; the upstream
+  # types are github.com/fluxcd/helm-controller/api v2 Snapshot.
+  history_statuses=$(kubectl get hr -n tenant-test "kubernetes-${test_name}" \
+    -ojsonpath='{range .status.history[*]}{.status}{"\n"}{end}')
+  if helmrelease_has_remediation_cycle "${history_statuses}"; then
+    echo "Parent HelmRelease entered remediation cycle. History statuses:" >&2
+    printf '%s\n' "${history_statuses}" >&2
     kubectl -n tenant-test describe hr "kubernetes-${test_name}" >&2
     exit 1
   fi
diff --git a/hack/remediation-guard.bats b/hack/remediation-guard.bats
index 9c33452a..30e4e04c 100644
--- a/hack/remediation-guard.bats
+++ b/hack/remediation-guard.bats
@@ -2,17 +2,15 @@
 # -----------------------------------------------------------------------------
 # Unit tests for hack/e2e-apps/remediation-guard.sh
 #
-# helmrelease_has_remediation_cycle is consumed from e2e tests to assert that
-# the parent HelmRelease did not hit flux helm-controller's wait timeout and
-# enter uninstall remediation. The function accepts two arguments (values of
-# .status.installFailures and .status.upgradeFailures) and returns 0 when a
-# remediation cycle is detected, 1 otherwise.
+# helmrelease_has_remediation_cycle takes a newline-delimited list of
+# HelmRelease history snapshot status values (deployed/superseded/failed/
+# uninstalled/...) and returns 0 when any entry is "failed" or "uninstalled"
+# (meaning flux helm-controller performed install/upgrade remediation).
 #
-# Each argument can be empty (controller never populated the field), "0"
-# (populated but never failed), or a positive integer. Shell's && and ||
-# have equal precedence with left-to-right associativity, which used to
-# break this check on the most common failure mode - install_failures=1
-# and upgrade_failures="". These tests pin the correct behavior.
+# This is used by the e2e script after the HelmRelease reaches Ready. The
+# failure/upgrade counters (.status.installFailures / .status.upgradeFailures)
+# are useless there because flux's ClearFailures zeroes them on successful
+# reconciliation; .status.history retains the snapshot trail.
 #
 # cozytest.sh's awk parser recognizes only @test blocks and a bare `}` on
 # its own line; there is no bats `run` or `$status`. Assertions are
@@ -21,83 +19,76 @@
 # Run with: hack/cozytest.sh hack/remediation-guard.bats
 # -----------------------------------------------------------------------------
 
-@test "no counters set returns not-detected" {
+@test "empty history returns not-detected" {
     . hack/e2e-apps/remediation-guard.sh
-    rc=0
-    helmrelease_has_remediation_cycle "" "" || rc=$?
-    [ "$rc" -eq 1 ]
+    if helmrelease_has_remediation_cycle ""; then
+        echo "expected not-detected for empty history" >&2
+        exit 1
+    fi
 }
 
-@test "both counters zero returns not-detected" {
+@test "single deployed snapshot returns not-detected" {
     . hack/e2e-apps/remediation-guard.sh
-    rc=0
-    helmrelease_has_remediation_cycle "0" "0" || rc=$?
-    [ "$rc" -eq 1 ]
+    if helmrelease_has_remediation_cycle "deployed"; then
+        echo "expected not-detected for deployed-only history" >&2
+        exit 1
+    fi
 }
 
-@test "install zero upgrade empty returns not-detected" {
+@test "deployed then superseded returns not-detected" {
     . hack/e2e-apps/remediation-guard.sh
-    rc=0
-    helmrelease_has_remediation_cycle "0" "" || rc=$?
-    [ "$rc" -eq 1 ]
+    statuses=$(printf 'deployed\nsuperseded\n')
+    if helmrelease_has_remediation_cycle "${statuses}"; then
+        echo "expected not-detected for deployed+superseded history" >&2
+        exit 1
+    fi
 }
 
-@test "install empty upgrade zero returns not-detected" {
+@test "single failed snapshot returns detected" {
     . hack/e2e-apps/remediation-guard.sh
-    rc=0
-    helmrelease_has_remediation_cycle "" "0" || rc=$?
-    [ "$rc" -eq 1 ]
+    if ! helmrelease_has_remediation_cycle "failed"; then
+        echo "expected detected when history contains failed snapshot" >&2
+        exit 1
+    fi
 }
 
-@test "install one upgrade empty returns detected" {
-    # Canonical race: first install exceeded helm-wait, remediation fired,
-    # no upgrade has happened yet.
+@test "single uninstalled snapshot returns detected" {
+    # The exact signature of the install-remediation race: the first install
+    # exceeded flux's wait budget, remediation uninstalled, the next retry
+    # eventually succeeded. History still carries the uninstalled snapshot.
     . hack/e2e-apps/remediation-guard.sh
-    rc=0
-    helmrelease_has_remediation_cycle "1" "" || rc=$?
-    [ "$rc" -eq 0 ]
+    if ! helmrelease_has_remediation_cycle "uninstalled"; then
+        echo "expected detected when history contains uninstalled snapshot" >&2
+        exit 1
+    fi
 }
 
-@test "install empty upgrade one returns detected" {
+@test "uninstalled then deployed still returns detected" {
     . hack/e2e-apps/remediation-guard.sh
-    rc=0
-    helmrelease_has_remediation_cycle "" "1" || rc=$?
-    [ "$rc" -eq 0 ]
+    statuses=$(printf 'uninstalled\ndeployed\n')
+    if ! helmrelease_has_remediation_cycle "${statuses}"; then
+        echo "expected detected despite later successful deploy" >&2
+        exit 1
+    fi
 }
 
-@test "install two upgrade zero returns detected" {
+@test "deployed then failed still returns detected" {
     . hack/e2e-apps/remediation-guard.sh
-    rc=0
-    helmrelease_has_remediation_cycle "2" "0" || rc=$?
-    [ "$rc" -eq 0 ]
+    statuses=$(printf 'deployed\nfailed\n')
+    if ! helmrelease_has_remediation_cycle "${statuses}"; then
+        echo "expected detected when any entry is failed" >&2
+        exit 1
+    fi
 }
 
-@test "install zero upgrade two returns detected" {
-    . hack/e2e-apps/remediation-guard.sh
-    rc=0
-    helmrelease_has_remediation_cycle "0" "2" || rc=$?
-    [ "$rc" -eq 0 ]
-}
-
-@test "both counters positive returns detected" {
-    . hack/e2e-apps/remediation-guard.sh
-    rc=0
-    helmrelease_has_remediation_cycle "3" "5" || rc=$?
-    [ "$rc" -eq 0 ]
-}
-
-@test "installFailures and upgradeFailures extraction pins HR v2 status shape" {
-    # Pins the Flux HelmRelease v2 status shape that run-kubernetes.sh relies
-    # on. If a future Flux version renames .status.installFailures (or
-    # .status.upgradeFailures), kubectl get -o jsonpath returns an empty
-    # string, the guard quietly says "no cycle", and real remediation loops
-    # slip past the e2e assertion.
-    #
-    # This test uses yq to read the exact path used in the e2e script. yq
-    # evaluates the same json-ish jsonpath against a pinned HR snippet, so
-    # the test fails loudly if the field ever disappears or moves. Cross
-    # reference: vendor/github.com/fluxcd/helm-controller/api/v2/ status
-    # struct field tags.
+@test "installFailures extraction pins HR v2 status.history shape" {
+    # Pins the Flux HelmRelease v2 .status.history[].status shape that
+    # run-kubernetes.sh relies on. If a future flux release renames the
+    # field, the jsonpath returns nothing, the guard reports no cycle,
+    # and real remediation loops slip past the e2e assertion. This test
+    # uses yq to read the exact path used in the e2e script; the upstream
+    # Snapshot type lives at
+    # github.com/fluxcd/helm-controller/api/v2.Snapshot (via go.mod).
     tmp=$(mktemp -d)
     trap 'rm -rf "$tmp"' EXIT
 
@@ -107,25 +98,30 @@ kind: HelmRelease
 metadata:
   name: kubernetes-test
   namespace: tenant-test
-spec:
-  interval: 5m
 status:
-  installFailures: 2
-  upgradeFailures: 0
-  conditions:
-    - type: Ready
-      status: "False"
-      reason: UninstallSucceeded
+  history:
+    - name: kubernetes-test
+      namespace: tenant-test
+      version: 1
+      status: uninstalled
+    - name: kubernetes-test
+      namespace: tenant-test
+      version: 2
+      status: deployed
 YAML
 
-    install_failures=$(yq '.status.installFailures' "$tmp/hr.yaml")
-    upgrade_failures=$(yq '.status.upgradeFailures' "$tmp/hr.yaml")
+    # Default yq output is yaml scalar format, which for string values emits
+    # bare unquoted tokens - matching what kubectl -o jsonpath produces in
+    # e2e. Do not switch to JSON output here; that would quote the values
+    # and break the loop in helmrelease_has_remediation_cycle.
+    statuses=$(yq '.status.history[].status' "$tmp/hr.yaml")
 
-    [ "$install_failures" = "2" ]
-    [ "$upgrade_failures" = "0" ]
+    [ -n "$statuses" ]
+    echo "$statuses" | grep --quiet '^uninstalled$'
 
     . hack/e2e-apps/remediation-guard.sh
-    rc=0
-    helmrelease_has_remediation_cycle "$install_failures" "$upgrade_failures" || rc=$?
-    [ "$rc" -eq 0 ]
+    if ! helmrelease_has_remediation_cycle "$statuses"; then
+        echo "expected detected for pinned HR snippet with uninstalled + deployed history" >&2
+        exit 1
+    fi
 }

From 48312cc3696904235e87fcf2bc33d05e21a77b72 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 21:29:49 +0300
Subject: [PATCH 486/666] build: wire go-unit-tests into make unit-tests

CI runs make unit-tests on every PR, which already covers helm
unittests and bats (hack/admin-kubeconfig-invariant.bats and
hack/remediation-guard.bats are both picked up by the existing
hack/*.bats glob). What was missing was any go test invocation.

Add a go-unit-tests target scoped to pkg/registry, pkg/config, and
pkg/cmd/server - the cozystack-api surface this repo actually owns
and tests in-tree. Running go test ./... pulls in generated-code
round-trip suites whose behavior is governed by generator tool
versions outside this repo's control; those are better exercised
from their own generator workflows.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 Makefile | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 0e94c5e6..10a55314 100644
--- a/Makefile
+++ b/Makefile
@@ -82,11 +82,19 @@ test:
 	make -C packages/core/testing apply
 	make -C packages/core/testing test
 
-unit-tests: helm-unit-tests bats-unit-tests
+unit-tests: helm-unit-tests bats-unit-tests go-unit-tests
 
 helm-unit-tests:
 	hack/helm-unit-tests.sh
 
+# Scoped go test over the cozystack-api surface that this repo owns. Kept
+# narrow intentionally - running `go test ./...` pulls in generated code
+# round-trip suites whose behavior depends on tool versions outside this
+# repo's control (kubebuilder, openapi-gen, etc.) and is better exercised
+# from their generator workflows.
+go-unit-tests:
+	go test ./pkg/registry/... ./pkg/config/... ./pkg/cmd/server/...
+
 # Discover every hack/*.bats file that is NOT an e2e test and run it
 # through cozytest.sh. Drop a new *.bats file in hack/ and it is picked
 # up automatically on the next `make unit-tests` run.

From d2e8f7e86cc7157aa83a7130b3f9857f10518218 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 21:31:29 +0300
Subject: [PATCH 487/666] chore(kubernetes): drop busybox mirror Containerfile,
 pin upstream directly

The image-busybox Makefile target + images/busybox/Dockerfile wrapper
just rebuilt an upstream busybox digest as ghcr.io/cozystack/cozystack/
busybox. Payload is a one-shot sh loop run once per pod; the pinned
upstream digest is already immutable, so maintaining a private mirror
adds churn (rebuild on every release) for no real hardening benefit.
Delete the wrapper and reference docker.io/library/busybox:<digest>
directly from images/busybox.tag. Document the choice in _helpers.tpl.

Also drop the false coupling in the go table test: the "unrelated
kind without configured timeout" case used the real kind name Qdrant,
which tied the test to the Qdrant ApplicationDefinition for no reason.
Switch to a clearly fictional kind so a future Qdrant timeout override
does not break this assertion.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/apps/kubernetes/Makefile                  | 13 +------------
 packages/apps/kubernetes/images/busybox/Dockerfile |  1 -
 packages/apps/kubernetes/templates/_helpers.tpl    |  9 ++++++++-
 pkg/registry/apps/application/rest_timeout_test.go | 10 +++++++---
 4 files changed, 16 insertions(+), 17 deletions(-)
 delete mode 100644 packages/apps/kubernetes/images/busybox/Dockerfile

diff --git a/packages/apps/kubernetes/Makefile b/packages/apps/kubernetes/Makefile
index eb23c2ef..4fea42ef 100644
--- a/packages/apps/kubernetes/Makefile
+++ b/packages/apps/kubernetes/Makefile
@@ -15,7 +15,7 @@ update:
 	hack/update-versions.sh
 	make generate
 
-image: image-ubuntu-container-disk image-kubevirt-cloud-provider image-kubevirt-csi-driver image-cluster-autoscaler image-busybox
+image: image-ubuntu-container-disk image-kubevirt-cloud-provider image-kubevirt-csi-driver image-cluster-autoscaler
 
 image-ubuntu-container-disk:
 	$(foreach ver,$(KUBERNETES_VERSIONS), \
@@ -71,14 +71,3 @@ image-cluster-autoscaler:
 		> images/cluster-autoscaler.tag
 	rm -f images/cluster-autoscaler.json
 
-image-busybox:
-	docker buildx build images/busybox \
-		--tag $(REGISTRY)/busybox:$(call settag,$(KUBERNETES_PKG_TAG)) \
-		--tag $(REGISTRY)/busybox:$(call settag,$(KUBERNETES_PKG_TAG)-$(TAG)) \
-		--cache-from type=registry,ref=$(REGISTRY)/busybox:latest \
-		--cache-to type=inline \
-		--metadata-file images/busybox.json \
-		$(BUILDX_ARGS)
-	echo "$(REGISTRY)/busybox:$(call settag,$(KUBERNETES_PKG_TAG))@$$(yq e '."containerimage.digest"' images/busybox.json -o json -r)" \
-		> images/busybox.tag
-	rm -f images/busybox.json
diff --git a/packages/apps/kubernetes/images/busybox/Dockerfile b/packages/apps/kubernetes/images/busybox/Dockerfile
deleted file mode 100644
index 0c57fd39..00000000
--- a/packages/apps/kubernetes/images/busybox/Dockerfile
+++ /dev/null
@@ -1 +0,0 @@
-FROM docker.io/library/busybox:1.37.0@sha256:1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e
diff --git a/packages/apps/kubernetes/templates/_helpers.tpl b/packages/apps/kubernetes/templates/_helpers.tpl
index 89f06934..e6ad9dcf 100644
--- a/packages/apps/kubernetes/templates/_helpers.tpl
+++ b/packages/apps/kubernetes/templates/_helpers.tpl
@@ -60,10 +60,17 @@ exits only when super-admin.svc appears, which happens after kubelet's
 optional-Secret refresh cycle.
 
 The 10m deadline stays strictly below the 15m HelmRelease
-Install.Timeout scoped to the Kubernetes Application kind so the
+Install.Timeout set by cozystack-api for the Kubernetes kind (via the
+release.cozystack.io/helm-install-timeout annotation) so the
 CrashLoopBackOff surfaces before flux remediation fires and uninstalls
 the Cluster CR.
 
+The pinned busybox image in images/busybox.tag points directly at
+docker.io by digest (not mirrored to ghcr.io like the other .tag files
+here): the payload is a one-shot sh loop, the digest pin makes the
+pull immutable, and the cost of maintaining a private mirror of a tiny
+upstream image that does not move often is not worth it.
+
 Call site owns the surrounding volumes block; the kubeconfig volume
 must exist on the pod and mount at /etc/kubernetes/kubeconfig.
 */}}
diff --git a/pkg/registry/apps/application/rest_timeout_test.go b/pkg/registry/apps/application/rest_timeout_test.go
index 8474d1cb..85ac0b97 100644
--- a/pkg/registry/apps/application/rest_timeout_test.go
+++ b/pkg/registry/apps/application/rest_timeout_test.go
@@ -48,9 +48,13 @@ func TestConvertApplicationToHelmRelease_AppliesReleaseConfigTimeout(t *testing.
 			wantSet:    true,
 		},
 		{
-			name:       "Qdrant kind without configured timeout keeps flux defaults",
-			kind:       "Qdrant",
-			prefix:     "qdrant-",
+			// Fictional kind on purpose: the test is about the unset path
+			// regardless of which real Application kind ends up needing a
+			// timeout override. Using a real kind name would create false
+			// coupling to that Application's ApplicationDefinition.
+			name:       "unrelated kind without configured timeout keeps flux defaults",
+			kind:       "PlaceholderKindForDefaults",
+			prefix:     "placeholder-",
 			configured: 0,
 			wantSet:    false,
 		},

From 64b216e10a2392394add9eb7fbf7e908f4c8864a Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 21:46:01 +0300
Subject: [PATCH 488/666] fix(kubernetes): gate child HelmReleases on tenant
 etcd DataStore

17 child HelmReleases (cilium, coredns, csi, cert-manager,
metrics-server, ...) referenced *-admin-kubeconfig via
kubeConfig.secretRef and rendered even when _namespace.etcd was empty.
On an etcd-less tenant each one sat in NotReady forever because the
admin-kubeconfig Secret only exists after a KamajiControlPlane
reconciles, and KamajiControlPlane now only renders when etcd is set.
The outcome contradicted the "beacon only" contract claimed in the
soft-skip commit.

Extend the existing addon guards to also require _namespace.etcd, and
wrap the four unconditional HelmReleases (csi, metrics-server,
prometheus-operator-crds, volumesnapshot-crd) plus the always-on
cilium/coredns HR resources in the same gate. Add an invariant bats
test that renders the whole chart with etcd empty and asserts zero
HelmReleases reference *-admin-kubeconfig.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/admin-kubeconfig-invariant.bats          | 40 +++++++++++++++++++
 .../helmreleases/cert-manager-crds.yaml       |  2 +-
 .../templates/helmreleases/cert-manager.yaml  |  2 +-
 .../templates/helmreleases/cilium.yaml        |  2 +
 .../templates/helmreleases/coredns.yaml       |  2 +
 .../templates/helmreleases/csi.yaml           |  2 +
 .../templates/helmreleases/fluxcd.yaml        |  2 +-
 .../helmreleases/gateway-api-crds.yaml        |  2 +-
 .../templates/helmreleases/gpu-operator.yaml  |  2 +-
 .../templates/helmreleases/ingress-nginx.yaml |  2 +-
 .../helmreleases/metrics-server.yaml          |  2 +
 .../helmreleases/monitoring-agents.yaml       |  2 +-
 .../prometheus-operator-crds.yaml             |  2 +
 .../templates/helmreleases/velero.yaml        |  2 +-
 .../vertical-pod-autoscaler-crds.yaml         |  2 +-
 .../helmreleases/vertical-pod-autoscaler.yaml |  2 +-
 .../victoria-metrics-operator.yaml            |  2 +-
 .../helmreleases/volumesnapshot-crd.yaml      |  2 +
 18 files changed, 63 insertions(+), 11 deletions(-)

diff --git a/hack/admin-kubeconfig-invariant.bats b/hack/admin-kubeconfig-invariant.bats
index c027e2c4..4c809c41 100644
--- a/hack/admin-kubeconfig-invariant.bats
+++ b/hack/admin-kubeconfig-invariant.bats
@@ -115,3 +115,43 @@
 
   echo "No admin-kubeconfig Deployments rendered for empty etcd (as expected)"
 }
+
+@test "chart emits zero admin-kubeconfig HelmReleases when tenant has no etcd DataStore" {
+  # Same principle as the Deployment variant above, extended to every child
+  # HelmRelease (cilium, coredns, csi, cert-manager, ...). They reference
+  # *-admin-kubeconfig via kubeConfig.secretRef and would otherwise sit in
+  # NotReady forever on an etcd-less tenant, polluting the HelmRelease list
+  # the operator sees and contradicting the "awaiting-etcd beacon only"
+  # contract of the soft-skip path.
+  tmp=$(mktemp -d)
+  trap 'rm -rf "$tmp"' EXIT
+
+  helm template invariant packages/apps/kubernetes \
+    --namespace tenant-root \
+    --set _namespace.etcd="" \
+    --set _namespace.monitoring="" \
+    --set _namespace.ingress="" \
+    --set _namespace.seaweedfs="" \
+    --set _namespace.host="" \
+    --set _cluster.cluster-domain=cozy.local \
+    --set 'nodeGroups=null' \
+    2>/dev/null > "$tmp/rendered.yaml"
+
+  matched=$(
+    yq --output-format=json eval-all '.' "$tmp/rendered.yaml" \
+      | jq -s '
+          map(select(.kind == "HelmRelease")) |
+          map(select(.spec.kubeConfig.secretRef.name | test("-admin-kubeconfig$")?)) |
+          length
+        '
+  )
+
+  if [ "$matched" -ne 0 ]; then
+    echo "Expected zero HelmReleases referencing *-admin-kubeconfig when etcd is empty, got $matched:" >&2
+    yq --output-format=json eval-all '.' "$tmp/rendered.yaml" \
+      | jq -s 'map(select(.kind == "HelmRelease") | .metadata.name)' >&2
+    exit 1
+  fi
+
+  echo "No admin-kubeconfig HelmReleases rendered for empty etcd (as expected)"
+}
diff --git a/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml b/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml
index be07a8b9..fd9dac7e 100644
--- a/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.addons.certManager.enabled }}
+{{- if and .Values.addons.certManager.enabled .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml b/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml
index 6857581a..700b666e 100644
--- a/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml
@@ -8,7 +8,7 @@ cert-manager:
 {{- end }}
 {{- end }}
 
-{{- if .Values.addons.certManager.enabled }}
+{{- if and .Values.addons.certManager.enabled .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/cilium.yaml b/packages/apps/kubernetes/templates/helmreleases/cilium.yaml
index d032f5b6..d8c90cbf 100644
--- a/packages/apps/kubernetes/templates/helmreleases/cilium.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/cilium.yaml
@@ -14,6 +14,7 @@ cilium:
   {{- end }}
 {{- end }}
 
+{{- if .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -55,3 +56,4 @@ spec:
   - name: {{ .Release.Name }}-gateway-api-crds
     namespace: {{ .Release.Namespace }}
   {{- end }}
+{{- end }}
diff --git a/packages/apps/kubernetes/templates/helmreleases/coredns.yaml b/packages/apps/kubernetes/templates/helmreleases/coredns.yaml
index bdb6c682..0711a51d 100644
--- a/packages/apps/kubernetes/templates/helmreleases/coredns.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/coredns.yaml
@@ -4,6 +4,7 @@ coredns:
     clusterIP: "10.95.0.10"
 {{- end }}
 
+{{- if .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -42,3 +43,4 @@ spec:
   {{- end }}
   - name: {{ .Release.Name }}-cilium
     namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/packages/apps/kubernetes/templates/helmreleases/csi.yaml b/packages/apps/kubernetes/templates/helmreleases/csi.yaml
index dd2c69a6..109d78e1 100644
--- a/packages/apps/kubernetes/templates/helmreleases/csi.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/csi.yaml
@@ -1,3 +1,4 @@
+{{- if .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -39,3 +40,4 @@ spec:
   - name: {{ .Release.Name }}
     namespace: {{ .Release.Namespace }}
   {{- end }}
+{{- end }}
diff --git a/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml b/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml
index 76499dfe..25fff01c 100644
--- a/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.addons.fluxcd.enabled }}
+{{- if and .Values.addons.fluxcd.enabled .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml b/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml
index 2bcc8d4d..b4172ed1 100644
--- a/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml
@@ -1,4 +1,4 @@
-{{- if $.Values.addons.gatewayAPI.enabled }}
+{{- if and $.Values.addons.gatewayAPI.enabled $.Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml b/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml
index 5ef48912..e243bfad 100644
--- a/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.addons.gpuOperator.enabled }}
+{{- if and .Values.addons.gpuOperator.enabled .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml b/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml
index 5cafff90..6e2183d3 100644
--- a/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml
@@ -20,7 +20,7 @@ ingress-nginx:
     node-role.kubernetes.io/ingress-nginx: ""
 {{- end }}
 
-{{- if .Values.addons.ingressNginx.enabled }}
+{{- if and .Values.addons.ingressNginx.enabled .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/metrics-server.yaml b/packages/apps/kubernetes/templates/helmreleases/metrics-server.yaml
index 3cc81a14..3e6f9660 100644
--- a/packages/apps/kubernetes/templates/helmreleases/metrics-server.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/metrics-server.yaml
@@ -1,3 +1,4 @@
+{{- if .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -36,3 +37,4 @@ spec:
     namespace: {{ .Release.Namespace }}
   - name: {{ .Release.Name }}-prometheus-operator-crds
     namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml b/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml
index ea84dec0..a811f7dd 100644
--- a/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml
@@ -1,6 +1,6 @@
 {{- $targetTenant := .Values._namespace.monitoring }}
 {{- $clusterDomain := (index .Values._cluster "cluster-domain") | default "cozy.local" }}
-{{- if .Values.addons.monitoringAgents.enabled }}
+{{- if and .Values.addons.monitoringAgents.enabled .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/prometheus-operator-crds.yaml b/packages/apps/kubernetes/templates/helmreleases/prometheus-operator-crds.yaml
index 600a7994..3038a058 100644
--- a/packages/apps/kubernetes/templates/helmreleases/prometheus-operator-crds.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/prometheus-operator-crds.yaml
@@ -1,3 +1,4 @@
+{{- if .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -31,3 +32,4 @@ spec:
   - name: {{ .Release.Name }}
     namespace: {{ .Release.Namespace }}
   {{- end }}
+{{- end }}
diff --git a/packages/apps/kubernetes/templates/helmreleases/velero.yaml b/packages/apps/kubernetes/templates/helmreleases/velero.yaml
index ad236d53..781b9c49 100644
--- a/packages/apps/kubernetes/templates/helmreleases/velero.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/velero.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.addons.velero.enabled }}
+{{- if and .Values.addons.velero.enabled .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler-crds.yaml b/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler-crds.yaml
index a3b7a9b4..55a5faac 100644
--- a/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler-crds.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler-crds.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.addons.monitoringAgents.enabled }}
+{{- if and .Values.addons.monitoringAgents.enabled .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml b/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml
index 178df3e3..74fb5a39 100644
--- a/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml
@@ -24,7 +24,7 @@ vertical-pod-autoscaler:
         memory: 1600Mi
 {{- end }}
 
-{{- if .Values.addons.monitoringAgents.enabled }}
+{{- if and .Values.addons.monitoringAgents.enabled .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml b/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml
index 99744277..7302f8f5 100644
--- a/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.addons.monitoringAgents.enabled }}
+{{- if and .Values.addons.monitoringAgents.enabled .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml b/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml
index 025f01b7..d50fd93c 100644
--- a/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml
@@ -1,3 +1,4 @@
+{{- if .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -33,3 +34,4 @@ spec:
   - name: {{ .Release.Name }}
     namespace: {{ .Release.Namespace }}
   {{- end }}
+{{- end }}

From 6072723e1e03c0072fe3bd83e2a5723c50d6ebd8 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 21:47:19 +0300
Subject: [PATCH 489/666] feat(config): extract + test annotation-timeout
 parser with Flux unit gate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pulls the release.cozystack.io/helm-install-timeout parsing out of
start.go into ParseHelmInstallTimeoutAnnotation in pkg/config. The
helper rejects units that time.ParseDuration accepts but Flux
helm-controller rejects (ns, us, µs): feeding one of those through
would cause the HelmRelease admission webhook to reject the object at
install time, giving a silent drop to flux defaults that is hard to
debug. Fail loudly at cozystack-api startup instead.

Adds a table-driven unit test covering: unset (empty), accepted units
ms/s/m/h, compound 2h30m, decimal 1.5m, and the rejected shapes
(bare digits, garbage, negative, ns/us/µs). The test lives in
pkg/config so it runs under the existing go-unit-tests make target.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 pkg/cmd/server/start.go   |  23 ++++----
 pkg/config/config.go      |  42 +++++++++++++-
 pkg/config/config_test.go | 119 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 173 insertions(+), 11 deletions(-)
 create mode 100644 pkg/config/config_test.go

diff --git a/pkg/cmd/server/start.go b/pkg/cmd/server/start.go
index 3e905735..7ebbbc89 100644
--- a/pkg/cmd/server/start.go
+++ b/pkg/cmd/server/start.go
@@ -174,17 +174,20 @@ func (o *CozyServerOptions) Complete() error {
 		// the chart itself depends on (for example, the Kamaji-provisioned
 		// admin-kubeconfig Secret for Kubernetes tenants) need a longer
 		// wait budget than the Flux default. Consumed by the REST storage
-		// layer when building the HelmRelease Spec.
-		if raw, ok := crd.Annotations["release.cozystack.io/helm-install-timeout"]; ok && raw != "" {
-			d, err := time.ParseDuration(raw)
-			if err != nil {
-				return fmt.Errorf(
-					"ApplicationDefinition %q has invalid release.cozystack.io/helm-install-timeout %q: %w",
-					crd.Name, raw, err,
-				)
-			}
-			release.HelmInstallTimeout = d
+		// layer when building the HelmRelease Spec. The parser rejects
+		// units Flux would reject at webhook time, so a bad annotation
+		// surfaces as a loud startup failure instead of a silent drop to
+		// defaults.
+		d, err := config.ParseHelmInstallTimeoutAnnotation(
+			crd.Annotations[config.HelmInstallTimeoutAnnotation],
+		)
+		if err != nil {
+			return fmt.Errorf(
+				"ApplicationDefinition %q has invalid %s annotation: %w",
+				crd.Name, config.HelmInstallTimeoutAnnotation, err,
+			)
 		}
+		release.HelmInstallTimeout = d
 		resource := config.Resource{
 			Application: config.ApplicationConfig{
 				Kind:          crd.Spec.Application.Kind,
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 16cf4f0c..21de27b2 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -16,7 +16,47 @@ limitations under the License.
 
 package config
 
-import "time"
+import (
+	"fmt"
+	"regexp"
+	"time"
+)
+
+// HelmInstallTimeoutAnnotation is the ApplicationDefinition metadata
+// annotation key that overrides the Flux HelmRelease Install.Timeout and
+// Upgrade.Timeout for a given Application kind.
+const HelmInstallTimeoutAnnotation = "release.cozystack.io/helm-install-timeout"
+
+// helmTimeoutPattern mirrors the CRD validation pattern used by Flux
+// helm-controller on HelmReleaseSpec.Install.Timeout (ms/s/m/h units only).
+// time.ParseDuration accepts ns/us/µs, but Flux rejects them - parsing here
+// with the same shape avoids feeding the controller a value it will later
+// reject at webhook time. See
+// github.com/fluxcd/helm-controller/api/v2 HelmReleaseSpec.Install.Timeout
+// in the go module cache.
+var helmTimeoutPattern = regexp.MustCompile(`^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$`)
+
+// ParseHelmInstallTimeoutAnnotation parses the value of the
+// release.cozystack.io/helm-install-timeout annotation. The empty string is
+// treated as "unset" and returns (0, nil) so callers can leave
+// HelmInstallTimeout zeroed and let flux defaults apply. Values accepted by
+// time.ParseDuration but rejected by Flux (ns/us/µs) return a helpful
+// error instead of silently parsing and failing later at HelmRelease
+// admission.
+func ParseHelmInstallTimeoutAnnotation(raw string) (time.Duration, error) {
+	if raw == "" {
+		return 0, nil
+	}
+	if !helmTimeoutPattern.MatchString(raw) {
+		return 0, fmt.Errorf("must match %s (Flux accepts ms/s/m/h units only), got %q",
+			helmTimeoutPattern, raw)
+	}
+	d, err := time.ParseDuration(raw)
+	if err != nil {
+		return 0, fmt.Errorf("time.ParseDuration(%q): %w", raw, err)
+	}
+	return d, nil
+}
 
 // ResourceConfig represents the structure of the configuration file.
 type ResourceConfig struct {
diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go
new file mode 100644
index 00000000..eb6990af
--- /dev/null
+++ b/pkg/config/config_test.go
@@ -0,0 +1,119 @@
+package config
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+// Cover the annotation parser used by cozystack-api at startup. The parser
+// is consumed by pkg/cmd/server/start.go on every ApplicationDefinition; a
+// typo here silently drops back to flux defaults and the Kubernetes tenant
+// race described in cozystack#2412 reappears, so the table must exercise:
+// - the unset path (empty string treated as "no override"),
+// - every unit Flux accepts (ms, s, m, h),
+// - compound forms (the CRD pattern accepts repeats),
+// - units time.ParseDuration accepts but Flux rejects (ns, us, µs),
+// - outright garbage.
+func TestParseHelmInstallTimeoutAnnotation(t *testing.T) {
+	cases := []struct {
+		name     string
+		input    string
+		want     time.Duration
+		wantErr  bool
+		errMatch string
+	}{
+		{
+			name:  "empty string leaves flux defaults in place",
+			input: "",
+			want:  0,
+		},
+		{
+			name:  "minutes",
+			input: "15m",
+			want:  15 * time.Minute,
+		},
+		{
+			name:  "hours",
+			input: "1h",
+			want:  time.Hour,
+		},
+		{
+			name:  "seconds",
+			input: "45s",
+			want:  45 * time.Second,
+		},
+		{
+			name:  "milliseconds",
+			input: "500ms",
+			want:  500 * time.Millisecond,
+		},
+		{
+			name:  "compound hour and minutes",
+			input: "2h30m",
+			want:  2*time.Hour + 30*time.Minute,
+		},
+		{
+			name:  "decimal minutes",
+			input: "1.5m",
+			want:  90 * time.Second,
+		},
+		{
+			name:     "nanoseconds rejected - Flux CRD pattern excludes ns",
+			input:    "500ns",
+			wantErr:  true,
+			errMatch: "Flux accepts ms/s/m/h units only",
+		},
+		{
+			name:     "microseconds rejected - Flux CRD pattern excludes us",
+			input:    "500us",
+			wantErr:  true,
+			errMatch: "Flux accepts ms/s/m/h units only",
+		},
+		{
+			name:     "microseconds unicode rejected",
+			input:    "500µs",
+			wantErr:  true,
+			errMatch: "Flux accepts ms/s/m/h units only",
+		},
+		{
+			name:     "bare digits rejected",
+			input:    "15",
+			wantErr:  true,
+			errMatch: "Flux accepts ms/s/m/h units only",
+		},
+		{
+			name:     "garbage rejected",
+			input:    "abc",
+			wantErr:  true,
+			errMatch: "Flux accepts ms/s/m/h units only",
+		},
+		{
+			name:     "negative rejected",
+			input:    "-15m",
+			wantErr:  true,
+			errMatch: "Flux accepts ms/s/m/h units only",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := ParseHelmInstallTimeoutAnnotation(tc.input)
+			if tc.wantErr {
+				if err == nil {
+					t.Fatalf("expected error, got duration=%v", got)
+				}
+				if tc.errMatch != "" && !strings.Contains(err.Error(), tc.errMatch) {
+					t.Errorf("error %q does not contain %q", err.Error(), tc.errMatch)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if got != tc.want {
+				t.Errorf("got %v, want %v", got, tc.want)
+			}
+		})
+	}
+}

From b8aec9a9731885cae9217271381680f3e274f46f Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 21:50:10 +0300
Subject: [PATCH 490/666] fix(kubernetes): history guard non-empty check + nits
 from review

- Log .status.history regardless of content so a silently empty result
  (Flux field rename) shows up in CI logs, and treat empty history on
  a Ready HelmRelease as a distinct failure. A Ready HR by definition
  has at least one snapshot; anything else is a shape-drift signal.
- Replace the unquoted heredoc in remediation-guard.sh with a printf |
  grep pipeline. printf %s treats statuses as literal payload (no $
  expansion surprises for future callers), grep --quiet --extended-regexp
  returns exit status the caller can forward directly.
- Share the etcd-absent values file between both invariant tests
  (packages/apps/kubernetes/tests/values-ci-no-etcd.yaml) instead of
  duplicating the --set block.
- Fix typo "override applied" -> "override is applied" in the
  Kubernetes ApplicationDefinition.
- Add a coupling comment in the ApplicationDefinition annotation that
  points at the wait-for-kubeconfig init deadline in _helpers.tpl, so
  a future operator raising the HR timeout updates the init deadline
  too.
- Clarify the per-annotation timeout comment in rest.go so it stops
  implying the feature is Kubernetes-only (it is not - only today's
  one user is).

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/admin-kubeconfig-invariant.bats          | 16 ++------------
 hack/e2e-apps/remediation-guard.sh            | 18 ++++++++--------
 hack/e2e-apps/run-kubernetes.sh               | 12 +++++++++--
 .../kubernetes/tests/values-ci-no-etcd.yaml   |  9 ++++++++
 .../kubernetes-rd/cozyrds/kubernetes.yaml     |  8 ++++++-
 pkg/registry/apps/application/rest.go         | 21 +++++++++++--------
 6 files changed, 49 insertions(+), 35 deletions(-)
 create mode 100644 packages/apps/kubernetes/tests/values-ci-no-etcd.yaml

diff --git a/hack/admin-kubeconfig-invariant.bats b/hack/admin-kubeconfig-invariant.bats
index 4c809c41..a4b98b00 100644
--- a/hack/admin-kubeconfig-invariant.bats
+++ b/hack/admin-kubeconfig-invariant.bats
@@ -85,13 +85,7 @@
 
   helm template invariant packages/apps/kubernetes \
     --namespace tenant-root \
-    --set _namespace.etcd="" \
-    --set _namespace.monitoring="" \
-    --set _namespace.ingress="" \
-    --set _namespace.seaweedfs="" \
-    --set _namespace.host="" \
-    --set _cluster.cluster-domain=cozy.local \
-    --set 'nodeGroups=null' \
+    --values packages/apps/kubernetes/tests/values-ci-no-etcd.yaml \
     2>/dev/null > "$tmp/rendered.yaml"
 
   matched=$(
@@ -128,13 +122,7 @@
 
   helm template invariant packages/apps/kubernetes \
     --namespace tenant-root \
-    --set _namespace.etcd="" \
-    --set _namespace.monitoring="" \
-    --set _namespace.ingress="" \
-    --set _namespace.seaweedfs="" \
-    --set _namespace.host="" \
-    --set _cluster.cluster-domain=cozy.local \
-    --set 'nodeGroups=null' \
+    --values packages/apps/kubernetes/tests/values-ci-no-etcd.yaml \
     2>/dev/null > "$tmp/rendered.yaml"
 
   matched=$(
diff --git a/hack/e2e-apps/remediation-guard.sh b/hack/e2e-apps/remediation-guard.sh
index 38463310..b45561b9 100644
--- a/hack/e2e-apps/remediation-guard.sh
+++ b/hack/e2e-apps/remediation-guard.sh
@@ -26,14 +26,14 @@ helmrelease_has_remediation_cycle() {
     if [ -z "${statuses}" ]; then
         return 1
     fi
-    while IFS= read -r status; do
-        case "${status}" in
-            failed|uninstalled)
-                return 0
-                ;;
-        esac
-    done <<EOF
-${statuses}
-EOF
+    # printf + grep over the pipe, rather than a heredoc plus while read.
+    # printf %s treats the status string as a literal payload, so any stray
+    # $ in a future caller's input does not trigger shell expansion. grep
+    # returns 0 iff at least one line matches the allowlist, which is
+    # exactly the contract the caller wants, so we can return its exit
+    # status directly.
+    if printf '%s\n' "${statuses}" | grep --extended-regexp --quiet '^(failed|uninstalled)$'; then
+        return 0
+    fi
     return 1
 }
diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index 64b1ae90..761ee57d 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -336,9 +336,17 @@ EOF
   # types are github.com/fluxcd/helm-controller/api v2 Snapshot.
   history_statuses=$(kubectl get hr -n tenant-test "kubernetes-${test_name}" \
     -ojsonpath='{range .status.history[*]}{.status}{"\n"}{end}')
+  # Always emit the raw value so a silent future-Flux field rename shows
+  # up as "empty history on a Ready HR" in CI logs rather than vanishing.
+  echo "Parent HelmRelease history statuses:"
+  printf '%s\n' "${history_statuses:-<empty>}"
+  if [ -z "${history_statuses}" ]; then
+    echo "Unexpected empty .status.history on a Ready HelmRelease - Flux API shape may have changed." >&2
+    kubectl -n tenant-test describe hr "kubernetes-${test_name}" >&2
+    exit 1
+  fi
   if helmrelease_has_remediation_cycle "${history_statuses}"; then
-    echo "Parent HelmRelease entered remediation cycle. History statuses:" >&2
-    printf '%s\n' "${history_statuses}" >&2
+    echo "Parent HelmRelease entered remediation cycle." >&2
     kubectl -n tenant-test describe hr "kubernetes-${test_name}" >&2
     exit 1
   fi
diff --git a/packages/apps/kubernetes/tests/values-ci-no-etcd.yaml b/packages/apps/kubernetes/tests/values-ci-no-etcd.yaml
new file mode 100644
index 00000000..c7c8196f
--- /dev/null
+++ b/packages/apps/kubernetes/tests/values-ci-no-etcd.yaml
@@ -0,0 +1,9 @@
+_namespace:
+  etcd: ""
+  monitoring: ""
+  ingress: ""
+  seaweedfs: ""
+  host: ""
+_cluster:
+  cluster-domain: cozy.local
+nodeGroups: null
diff --git a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
index 1128abe8..aaa01247 100644
--- a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
+++ b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
@@ -7,8 +7,14 @@ metadata:
     # Secret is provisioned asynchronously. Cold Kamaji start (image pull +
     # etcd + apiserver Ready) plus admin-kubeconfig generation can exceed
     # Flux helm-controller's default wait budget, causing remediation loops
-    # that uninstall the Cluster CR. This override applied by cozystack-api
+    # that uninstall the Cluster CR. This override is applied by cozystack-api
     # to the HelmRelease Spec.Install.Timeout and Spec.Upgrade.Timeout.
+    #
+    # Coupling: the wait-for-kubeconfig init container in
+    # packages/apps/kubernetes/templates/_helpers.tpl hard-codes a 10m
+    # deadline chosen to stay strictly below this value so the pod's
+    # CrashLoopBackOff surfaces before flux remediation fires. If this
+    # annotation is raised, update that init deadline correspondingly.
     release.cozystack.io/helm-install-timeout: "15m"
 spec:
   application:
diff --git a/pkg/registry/apps/application/rest.go b/pkg/registry/apps/application/rest.go
index 406d3738..d233ecc3 100644
--- a/pkg/registry/apps/application/rest.go
+++ b/pkg/registry/apps/application/rest.go
@@ -1528,15 +1528,18 @@ func (r *REST) convertApplicationToHelmRelease(app *appsv1alpha1.Application) (*
 		},
 	}
 
-	// Per-Application HelmRelease wait budget. When an ApplicationDefinition
-	// sets release.cozystack.io/helm-install-timeout, the annotation is
-	// parsed at startup into ReleaseConfig.HelmInstallTimeout and applied
-	// to both Install and Upgrade here. Applications that leave it unset
-	// (the common case) keep flux defaults, so their failed installs
-	// remediate on the normal cadence. Needed for the Kubernetes kind
-	// because its parent chart contains CAPI/Kamaji resources whose
-	// admin-kubeconfig Secret is provisioned asynchronously and Kamaji
-	// cold-start routinely exceeds flux's default wait budget.
+	// Per-Application HelmRelease wait budget. The mechanism is generic:
+	// an ApplicationDefinition that sets
+	// release.cozystack.io/helm-install-timeout gets Install.Timeout and
+	// Upgrade.Timeout populated from ReleaseConfig.HelmInstallTimeout
+	// (parsed at startup). Applications that leave it unset keep flux
+	// defaults so their failed installs remediate on the normal cadence.
+	// Today only kubernetes-rd carries the annotation because the
+	// Kubernetes Application's parent chart contains CAPI/Kamaji
+	// resources whose admin-kubeconfig Secret is provisioned
+	// asynchronously and Kamaji cold-start routinely exceeds flux's
+	// default wait budget; any future kind with the same shape can opt
+	// in by setting the same annotation.
 	if r.releaseConfig.HelmInstallTimeout > 0 {
 		timeout := metav1.Duration{Duration: r.releaseConfig.HelmInstallTimeout}
 		helmRelease.Spec.Install.Timeout = &timeout

From 39b8f0252b6fb07d510c83aacf48fc20d7fdd96c Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 22:32:24 +0300
Subject: [PATCH 491/666] test(hack): rename remediation-guard bats test to
 match what it pins

The test body asserts .status.history[].status extraction, but the
test name still referenced the old installFailures counter (leftover
from when the guard used that field before switching to status.history
to avoid ClearFailures zeroing the counters on successful reconcile).

Address review feedback from coderabbitai on
hack/remediation-guard.bats:84: rename so grep for what the test
actually pins matches the test name.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/remediation-guard.bats | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hack/remediation-guard.bats b/hack/remediation-guard.bats
index 30e4e04c..092fe06d 100644
--- a/hack/remediation-guard.bats
+++ b/hack/remediation-guard.bats
@@ -81,7 +81,7 @@
     fi
 }
 
-@test "installFailures extraction pins HR v2 status.history shape" {
+@test "status.history extraction pins HR v2 status.history shape" {
     # Pins the Flux HelmRelease v2 .status.history[].status shape that
     # run-kubernetes.sh relies on. If a future flux release renames the
     # field, the jsonpath returns nothing, the guard reports no cycle,

From 9b54e4672364a0de7859c5273dd2b280374083ea Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Fri, 17 Apr 2026 11:32:44 +0500
Subject: [PATCH 492/666] fix(linstor): restrict linstor-gui to
 cozystack-cluster-admin group
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Before this change oauth2-proxy fronting linstor-gui only enforced that
the user could authenticate against the `cozy` Keycloak realm
(`--email-domain=*`, no group restriction). Any realm user could reach
the UI and, through it, the LINSTOR controller REST API — which the
gatekeeper proxies with a static mTLS client cert and no per-user RBAC.

Add `--allowed-group=cozystack-cluster-admin` and include `groups` in
the OIDC scope so the claim is present at validation time. The
`cozystack-cluster-admin` KeycloakRealmGroup and the `groups` client
scope are already provisioned by keycloak-configure, so no cluster-wide
changes are needed.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/system/linstor-gui/README.md                    | 7 +++++--
 packages/system/linstor-gui/templates/gatekeeper.yaml    | 8 +++++++-
 packages/system/linstor-gui/tests/ingress_auth_test.yaml | 6 ++++++
 3 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/packages/system/linstor-gui/README.md b/packages/system/linstor-gui/README.md
index 2c9ac5d5..8f8053ab 100644
--- a/packages/system/linstor-gui/README.md
+++ b/packages/system/linstor-gui/README.md
@@ -13,8 +13,11 @@ using mTLS with the `linstor-client-tls` secret created by the `linstor` package
 
 The chart ships an `oauth2-proxy` based gatekeeper plus a `KeycloakClient` CRD
 so the UI can be published on `linstor-gui.<root-host>` behind the cluster
-Keycloak realm. Access is granted to any user who can authenticate against the
-`cozy` realm.
+Keycloak realm. Access is restricted to members of the
+`cozystack-cluster-admin` Keycloak group — the same group that grants
+cluster-admin RBAC on the host cluster. Authenticating against the `cozy`
+realm alone is not sufficient; users outside that group receive a 403 from
+oauth2-proxy before any request reaches the UI or the LINSTOR controller.
 
 To turn it on, add `linstor-gui` to `publishing.exposedServices` in the core
 `cozystack` values (same list that controls `dashboard`). OIDC must be
diff --git a/packages/system/linstor-gui/templates/gatekeeper.yaml b/packages/system/linstor-gui/templates/gatekeeper.yaml
index 0830a5fa..81451f41 100644
--- a/packages/system/linstor-gui/templates/gatekeeper.yaml
+++ b/packages/system/linstor-gui/templates/gatekeeper.yaml
@@ -13,6 +13,11 @@ Only rendered when oidc-enabled=true. If the cluster has OIDC disabled we
 deliberately do not ship an unauthenticated token-proxy fallback (unlike
 dashboard): linstor-gui surfaces raw storage state and should not be
 reachable via Ingress without Keycloak login.
+
+Access is further restricted to the cozystack-cluster-admin group
+(--allowed-group below). The proxy authenticates with a static mTLS client
+cert and LINSTOR itself has no per-user RBAC, so group membership is the
+only boundary between a realm user and raw storage state.
 */ -}}
 {{- if eq $oidcEnabled "true" }}
 apiVersion: apps/v1
@@ -84,7 +89,8 @@ spec:
             - --cookie-secure=true
             - --cookie-secret=$(OAUTH2_PROXY_COOKIE_SECRET)
             - --skip-provider-button
-            - --scope=openid email profile offline_access
+            - --scope=openid email profile groups offline_access
+            - --allowed-group=cozystack-cluster-admin
             {{- if eq $oidcInsecureSkipVerify "true" }}
             - --ssl-insecure-skip-verify=true
             {{- end }}
diff --git a/packages/system/linstor-gui/tests/ingress_auth_test.yaml b/packages/system/linstor-gui/tests/ingress_auth_test.yaml
index fe735f50..2f0b1d73 100644
--- a/packages/system/linstor-gui/tests/ingress_auth_test.yaml
+++ b/packages/system/linstor-gui/tests/ingress_auth_test.yaml
@@ -109,6 +109,12 @@ tests:
       - contains:
           path: spec.template.spec.containers[0].args
           content: --oidc-issuer-url=https://keycloak.dev10.example.org/realms/cozy
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --scope=openid email profile groups offline_access
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --allowed-group=cozystack-cluster-admin
       - contains:
           path: spec.template.spec.containers[0].env
           content:

From ee4e71b1393027376c3fc48a30d9262b2cf9fa69 Mon Sep 17 00:00:00 2001
From: ZverGuy <maximbel2003@gmail.com>
Date: Mon, 13 Apr 2026 14:34:22 +0300
Subject: [PATCH 493/666] feat(bucket): add WorkloadMonitor for billing
 integration

Add WorkloadMonitor CR to bucket Helm chart so that the billing
pipeline can discover and track S3 buckets. Add instance label
to BucketClaim metadata for WorkloadMonitor selector matching.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
---
 packages/apps/bucket/templates/bucketclaim.yaml     |  2 ++
 packages/apps/bucket/templates/workloadmonitor.yaml | 13 +++++++++++++
 2 files changed, 15 insertions(+)
 create mode 100644 packages/apps/bucket/templates/workloadmonitor.yaml

diff --git a/packages/apps/bucket/templates/bucketclaim.yaml b/packages/apps/bucket/templates/bucketclaim.yaml
index 2f57fd70..0639916f 100644
--- a/packages/apps/bucket/templates/bucketclaim.yaml
+++ b/packages/apps/bucket/templates/bucketclaim.yaml
@@ -4,6 +4,8 @@ apiVersion: objectstorage.k8s.io/v1alpha1
 kind: BucketClaim
 metadata:
   name: {{ .Release.Name }}
+  labels:
+    app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
   bucketClassName: {{ $seaweedfs }}{{- if $pool }}-{{ $pool }}{{- end }}{{- if .Values.locking }}-lock{{- end }}
   protocols:
diff --git a/packages/apps/bucket/templates/workloadmonitor.yaml b/packages/apps/bucket/templates/workloadmonitor.yaml
new file mode 100644
index 00000000..4e618ddd
--- /dev/null
+++ b/packages/apps/bucket/templates/workloadmonitor.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ $.Release.Name }}
+spec:
+  replicas: 1
+  minReplicas: 1
+  kind: bucket
+  type: s3
+  selector:
+    app.kubernetes.io/instance: {{ $.Release.Name }}
+  version: {{ $.Chart.Version }}

From 92286213ab377aa4db4845c66b9a1b94f2f2a0ab Mon Sep 17 00:00:00 2001
From: ZverGuy <maximbel2003@gmail.com>
Date: Mon, 13 Apr 2026 14:41:10 +0300
Subject: [PATCH 494/666] feat(controller): add BucketClaim support to
 WorkloadMonitorReconciler

Add reconcileBucketClaimForMonitor() that watches COSI BucketClaim
objects and creates Workload CRDs with s3-buckets resource, following
the same pattern as PVC and Service reconcilers. This enables the
billing pipeline to discover and track S3 buckets per tenant.

Changes:
- Add COSI API types dependency (container-object-storage-interface-api)
- Register cosiv1alpha1 scheme in controller main
- Add BucketClaim watch in SetupWithManager
- Add BucketClaim list + reconcile in Reconcile loop
- Add RBAC annotation for objectstorage.k8s.io/bucketclaims
- Add unit tests for BucketClaim reconciliation

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
---
 cmd/cozystack-controller/main.go              |   2 +
 go.mod                                        |   6 +-
 go.sum                                        |   2 +
 .../controller/workloadmonitor_controller.go  |  73 +++++++
 .../workloadmonitor_controller_test.go        | 204 ++++++++++++++++++
 5 files changed, 284 insertions(+), 3 deletions(-)

diff --git a/cmd/cozystack-controller/main.go b/cmd/cozystack-controller/main.go
index 77c4f9dc..bcaca9c9 100644
--- a/cmd/cozystack-controller/main.go
+++ b/cmd/cozystack-controller/main.go
@@ -42,6 +42,7 @@ import (
 	"github.com/cozystack/cozystack/internal/telemetry"
 
 	helmv2 "github.com/fluxcd/helm-controller/api/v2"
+	cosiv1alpha1 "sigs.k8s.io/container-object-storage-interface-api/apis/objectstorage/v1alpha1"
 	// +kubebuilder:scaffold:imports
 )
 
@@ -56,6 +57,7 @@ func init() {
 	utilruntime.Must(cozystackiov1alpha1.AddToScheme(scheme))
 	utilruntime.Must(dashboard.AddToScheme(scheme))
 	utilruntime.Must(helmv2.AddToScheme(scheme))
+	utilruntime.Must(cosiv1alpha1.AddToScheme(scheme))
 	// +kubebuilder:scaffold:scheme
 }
 
diff --git a/go.mod b/go.mod
index 00e8e129..7b7d5bc4 100644
--- a/go.mod
+++ b/go.mod
@@ -5,6 +5,7 @@ module github.com/cozystack/cozystack
 go 1.25.0
 
 require (
+	github.com/cozystack/cozystack-scheduler/pkg/apis v0.1.1
 	github.com/emicklei/dot v1.10.0
 	github.com/fluxcd/helm-controller/api v1.4.3
 	github.com/fluxcd/source-controller/api v1.7.4
@@ -28,8 +29,10 @@ require (
 	k8s.io/klog/v2 v2.130.1
 	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b
 	k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d
+	sigs.k8s.io/container-object-storage-interface-api v0.1.0
 	sigs.k8s.io/controller-runtime v0.22.4
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.0
+	sigs.k8s.io/yaml v1.6.0
 )
 
 require (
@@ -42,10 +45,8 @@ require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
-	github.com/cozystack/cozystack-scheduler/pkg/apis v0.1.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
-	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fluxcd/pkg/apis/acl v0.9.0 // indirect
@@ -126,7 +127,6 @@ require (
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/yaml v1.6.0 // indirect
 )
 
 // See: issues.k8s.io/135537
diff --git a/go.sum b/go.sum
index 52942562..81e1779f 100644
--- a/go.sum
+++ b/go.sum
@@ -321,6 +321,8 @@ k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d h1:wAhiDyZ4Tdtt7e46e9M5ZSAJ/MnPG
 k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 h1:jpcvIRr3GLoUoEKRkHKSmGjxb6lWwrBlJsXc+eUYQHM=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
+sigs.k8s.io/container-object-storage-interface-api v0.1.0 h1:8tB6JFQhbQIC1hwGQ+q4+tmSSNfjKemb7bFI6C0CK/4=
+sigs.k8s.io/container-object-storage-interface-api v0.1.0/go.mod h1:YiB+i/UGkzqgODDhRG3u7jkbWkQcoUeLEJ7hwOT/2Qk=
 sigs.k8s.io/controller-runtime v0.22.4 h1:GEjV7KV3TY8e+tJ2LCTxUTanW4z/FmNB7l327UfMq9A=
 sigs.k8s.io/controller-runtime v0.22.4/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
diff --git a/internal/controller/workloadmonitor_controller.go b/internal/controller/workloadmonitor_controller.go
index 9a967e65..3b69d0fb 100644
--- a/internal/controller/workloadmonitor_controller.go
+++ b/internal/controller/workloadmonitor_controller.go
@@ -22,6 +22,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+	cosiv1alpha1 "sigs.k8s.io/container-object-storage-interface-api/apis/objectstorage/v1alpha1"
 )
 
 // WorkloadMonitorReconciler reconciles a WorkloadMonitor object
@@ -36,6 +37,12 @@ type WorkloadMonitorReconciler struct {
 // +kubebuilder:rbac:groups=cozystack.io,resources=workloads/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch
 // +kubebuilder:rbac:groups=core,resources=persistentvolumeclaims,verbs=get;list;watch
+// +kubebuilder:rbac:groups=objectstorage.k8s.io,resources=bucketclaims,verbs=get;list;watch
+
+// isBucketClaimReady checks if the BucketClaim has been provisioned.
+func (r *WorkloadMonitorReconciler) isBucketClaimReady(bc *cosiv1alpha1.BucketClaim) bool {
+	return bc.Status.BucketReady
+}
 
 // isServiceReady checks if the service has an external IP bound
 func (r *WorkloadMonitorReconciler) isServiceReady(svc *corev1.Service) bool {
@@ -101,6 +108,47 @@ func updateOwnerReferences(obj metav1.Object, monitor client.Object) {
 	obj.SetOwnerReferences(owners)
 }
 
+// reconcileBucketClaimForMonitor creates or updates a Workload object for the given BucketClaim and WorkloadMonitor.
+func (r *WorkloadMonitorReconciler) reconcileBucketClaimForMonitor(
+	ctx context.Context,
+	monitor *cozyv1alpha1.WorkloadMonitor,
+	bc cosiv1alpha1.BucketClaim,
+) error {
+	logger := log.FromContext(ctx)
+	workload := &cozyv1alpha1.Workload{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      fmt.Sprintf("bucket-%s", bc.Name),
+			Namespace: bc.Namespace,
+			Labels:    make(map[string]string, len(bc.Labels)),
+		},
+	}
+
+	resources := make(map[string]resource.Quantity)
+	resources["s3-buckets"] = resource.MustParse("1")
+
+	_, err := ctrl.CreateOrUpdate(ctx, r.Client, workload, func() error {
+		updateOwnerReferences(workload.GetObjectMeta(), &bc)
+
+		for k, v := range bc.Labels {
+			workload.Labels[k] = v
+		}
+		workload.Labels["workloads.cozystack.io/monitor"] = monitor.Name
+
+		workload.Status.Kind = monitor.Spec.Kind
+		workload.Status.Type = monitor.Spec.Type
+		workload.Status.Resources = resources
+		workload.Status.Operational = r.isBucketClaimReady(&bc)
+
+		return nil
+	})
+	if err != nil {
+		logger.Error(err, "Failed to CreateOrUpdate Workload", "workload", workload.Name)
+		return err
+	}
+
+	return nil
+}
+
 // reconcileServiceForMonitor creates or updates a Workload object for the given Service and WorkloadMonitor.
 func (r *WorkloadMonitorReconciler) reconcileServiceForMonitor(
 	ctx context.Context,
@@ -375,6 +423,26 @@ func (r *WorkloadMonitorReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		}
 	}
 
+	bucketClaimList := &cosiv1alpha1.BucketClaimList{}
+	if err := r.List(
+		ctx,
+		bucketClaimList,
+		client.InNamespace(monitor.Namespace),
+		client.MatchingLabels(monitor.Spec.Selector),
+	); err != nil {
+		if !apierrors.IsNotFound(err) {
+			logger.Error(err, "Unable to list BucketClaims for WorkloadMonitor", "monitor", monitor.Name)
+			return ctrl.Result{}, err
+		}
+	}
+
+	for _, bc := range bucketClaimList.Items {
+		if err := r.reconcileBucketClaimForMonitor(ctx, monitor, bc); err != nil {
+			logger.Error(err, "Failed to reconcile Workload for BucketClaim", "BucketClaim", bc.Name)
+			continue
+		}
+	}
+
 	// Update WorkloadMonitor status based on observed pods
 	monitor.Status.ObservedReplicas = observedReplicas
 	monitor.Status.AvailableReplicas = availableReplicas
@@ -421,6 +489,11 @@ func (r *WorkloadMonitorReconciler) SetupWithManager(mgr ctrl.Manager) error {
 			&corev1.PersistentVolumeClaim{},
 			handler.EnqueueRequestsFromMapFunc(mapObjectToMonitor(&corev1.PersistentVolumeClaim{}, r.Client)),
 		).
+		// Watch BucketClaims for S3 bucket billing
+		Watches(
+			&cosiv1alpha1.BucketClaim{},
+			handler.EnqueueRequestsFromMapFunc(mapObjectToMonitor(&cosiv1alpha1.BucketClaim{}, r.Client)),
+		).
 		// Watch for changes to Workload objects we create (owned by WorkloadMonitor)
 		Owns(&cozyv1alpha1.Workload{}).
 		Complete(r)
diff --git a/internal/controller/workloadmonitor_controller_test.go b/internal/controller/workloadmonitor_controller_test.go
index e1ed0c0d..9df61cf3 100644
--- a/internal/controller/workloadmonitor_controller_test.go
+++ b/internal/controller/workloadmonitor_controller_test.go
@@ -6,9 +6,11 @@ import (
 
 	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
 	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
+	cosiv1alpha1 "sigs.k8s.io/container-object-storage-interface-api/apis/objectstorage/v1alpha1"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 )
@@ -17,6 +19,7 @@ func TestReconcile_OperationalStatusPersisted(t *testing.T) {
 	scheme := runtime.NewScheme()
 	_ = cozyv1alpha1.AddToScheme(scheme)
 	_ = corev1.AddToScheme(scheme)
+	_ = cosiv1alpha1.AddToScheme(scheme)
 
 	minReplicas := int32(2)
 	monitor := &cozyv1alpha1.WorkloadMonitor{
@@ -82,6 +85,7 @@ func TestReconcile_OperationalTrue_WhenEnoughReplicas(t *testing.T) {
 	scheme := runtime.NewScheme()
 	_ = cozyv1alpha1.AddToScheme(scheme)
 	_ = corev1.AddToScheme(scheme)
+	_ = cosiv1alpha1.AddToScheme(scheme)
 
 	minReplicas := int32(1)
 	monitor := &cozyv1alpha1.WorkloadMonitor{
@@ -139,6 +143,7 @@ func TestReconcile_OperationalTrue_WhenNoMinReplicas(t *testing.T) {
 	scheme := runtime.NewScheme()
 	_ = cozyv1alpha1.AddToScheme(scheme)
 	_ = corev1.AddToScheme(scheme)
+	_ = cosiv1alpha1.AddToScheme(scheme)
 
 	monitor := &cozyv1alpha1.WorkloadMonitor{
 		ObjectMeta: metav1.ObjectMeta{
@@ -178,3 +183,202 @@ func TestReconcile_OperationalTrue_WhenNoMinReplicas(t *testing.T) {
 	}
 }
 
+func newTestScheme() *runtime.Scheme {
+	s := runtime.NewScheme()
+	_ = cozyv1alpha1.AddToScheme(s)
+	_ = corev1.AddToScheme(s)
+	_ = cosiv1alpha1.AddToScheme(s)
+	return s
+}
+
+func TestReconcileBucketClaimCreatesWorkload(t *testing.T) {
+	s := newTestScheme()
+
+	monitor := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-bucket",
+			Namespace: "tenant-demo",
+		},
+		Spec: cozyv1alpha1.WorkloadMonitorSpec{
+			Kind: "bucket",
+			Type: "s3",
+			Selector: map[string]string{
+				"app.kubernetes.io/instance": "my-bucket",
+			},
+		},
+	}
+
+	bc := &cosiv1alpha1.BucketClaim{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-bucket",
+			Namespace: "tenant-demo",
+			Labels: map[string]string{
+				"app.kubernetes.io/instance": "my-bucket",
+			},
+		},
+		Spec: cosiv1alpha1.BucketClaimSpec{
+			BucketClassName: "seaweedfs",
+			Protocols:       []cosiv1alpha1.Protocol{cosiv1alpha1.ProtocolS3},
+		},
+		Status: cosiv1alpha1.BucketClaimStatus{
+			BucketReady: true,
+			BucketName:  "cosi-abc123",
+		},
+	}
+
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(s).
+		WithObjects(monitor, bc).
+		WithStatusSubresource(monitor).
+		Build()
+
+	reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: s}
+	req := reconcile.Request{NamespacedName: types.NamespacedName{
+		Name:      "my-bucket",
+		Namespace: "tenant-demo",
+	}}
+
+	_, err := reconciler.Reconcile(context.TODO(), req)
+	if err != nil {
+		t.Fatalf("Reconcile returned error: %v", err)
+	}
+
+	workload := &cozyv1alpha1.Workload{}
+	err = fakeClient.Get(context.TODO(), types.NamespacedName{
+		Name:      "bucket-my-bucket",
+		Namespace: "tenant-demo",
+	}, workload)
+	if err != nil {
+		t.Fatalf("expected Workload to be created, got error: %v", err)
+	}
+
+	if workload.Status.Kind != "bucket" {
+		t.Errorf("expected Kind=bucket, got %q", workload.Status.Kind)
+	}
+	if workload.Status.Type != "s3" {
+		t.Errorf("expected Type=s3, got %q", workload.Status.Type)
+	}
+	if !workload.Status.Operational {
+		t.Error("expected Operational=true for ready BucketClaim")
+	}
+
+	qty, ok := workload.Status.Resources["s3-buckets"]
+	if !ok {
+		t.Fatal("expected s3-buckets resource to be set")
+	}
+	if qty.Cmp(resource.MustParse("1")) != 0 {
+		t.Errorf("expected s3-buckets=1, got %s", qty.String())
+	}
+}
+
+func TestReconcileBucketClaimNotReady(t *testing.T) {
+	s := newTestScheme()
+
+	monitor := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-bucket",
+			Namespace: "tenant-demo",
+		},
+		Spec: cozyv1alpha1.WorkloadMonitorSpec{
+			Kind: "bucket",
+			Type: "s3",
+			Selector: map[string]string{
+				"app.kubernetes.io/instance": "my-bucket",
+			},
+		},
+	}
+
+	bc := &cosiv1alpha1.BucketClaim{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-bucket",
+			Namespace: "tenant-demo",
+			Labels: map[string]string{
+				"app.kubernetes.io/instance": "my-bucket",
+			},
+		},
+		Spec: cosiv1alpha1.BucketClaimSpec{
+			BucketClassName: "seaweedfs",
+			Protocols:       []cosiv1alpha1.Protocol{cosiv1alpha1.ProtocolS3},
+		},
+		Status: cosiv1alpha1.BucketClaimStatus{
+			BucketReady: false,
+		},
+	}
+
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(s).
+		WithObjects(monitor, bc).
+		WithStatusSubresource(monitor).
+		Build()
+
+	reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: s}
+	req := reconcile.Request{NamespacedName: types.NamespacedName{
+		Name:      "my-bucket",
+		Namespace: "tenant-demo",
+	}}
+
+	_, err := reconciler.Reconcile(context.TODO(), req)
+	if err != nil {
+		t.Fatalf("Reconcile returned error: %v", err)
+	}
+
+	workload := &cozyv1alpha1.Workload{}
+	err = fakeClient.Get(context.TODO(), types.NamespacedName{
+		Name:      "bucket-my-bucket",
+		Namespace: "tenant-demo",
+	}, workload)
+	if err != nil {
+		t.Fatalf("expected Workload to be created, got error: %v", err)
+	}
+
+	if workload.Status.Operational {
+		t.Error("expected Operational=false for not-ready BucketClaim")
+	}
+}
+
+func TestReconcileNoBucketClaimSkips(t *testing.T) {
+	s := newTestScheme()
+
+	monitor := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-postgres",
+			Namespace: "tenant-demo",
+		},
+		Spec: cozyv1alpha1.WorkloadMonitorSpec{
+			Kind: "postgres",
+			Type: "postgres",
+			Selector: map[string]string{
+				"app.kubernetes.io/instance": "my-postgres",
+			},
+		},
+	}
+
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(s).
+		WithObjects(monitor).
+		WithStatusSubresource(monitor).
+		Build()
+
+	reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: s}
+	req := reconcile.Request{NamespacedName: types.NamespacedName{
+		Name:      "my-postgres",
+		Namespace: "tenant-demo",
+	}}
+
+	_, err := reconciler.Reconcile(context.TODO(), req)
+	if err != nil {
+		t.Fatalf("Reconcile returned error: %v", err)
+	}
+
+	workloadList := &cozyv1alpha1.WorkloadList{}
+	err = fakeClient.List(context.TODO(), workloadList)
+	if err != nil {
+		t.Fatalf("List returned error: %v", err)
+	}
+
+	for _, w := range workloadList.Items {
+		if w.Status.Kind == "bucket" {
+			t.Error("expected no bucket workloads to be created for postgres monitor")
+		}
+	}
+}

From 0aab19f50003149d2bfc63137a09696b4777eb48 Mon Sep 17 00:00:00 2001
From: ZverGuy <maximbel2003@gmail.com>
Date: Mon, 13 Apr 2026 14:45:06 +0300
Subject: [PATCH 495/666] feat(controller): add SeaweedFS bucket size metrics
 via Prometheus

Query SeaweedFS_s3_bucket_size_bytes from a Prometheus-compatible API
to populate s3-storage-bytes resource on bucket Workloads. The
Prometheus URL is configurable via --prometheus-url flag. When set,
bucket WorkloadMonitors are requeued every 60s to keep sizes current.

When Prometheus is not configured, buckets still get tracked with
s3-buckets=1 for existence-based billing.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
---
 cmd/cozystack-controller/main.go              |   9 +-
 .../controller/workloadmonitor_controller.go  |  91 ++++++++++++-
 .../workloadmonitor_controller_test.go        | 128 ++++++++++++++++++
 3 files changed, 225 insertions(+), 3 deletions(-)

diff --git a/cmd/cozystack-controller/main.go b/cmd/cozystack-controller/main.go
index bcaca9c9..1175e2b4 100644
--- a/cmd/cozystack-controller/main.go
+++ b/cmd/cozystack-controller/main.go
@@ -70,6 +70,7 @@ func main() {
 	var disableTelemetry bool
 	var telemetryEndpoint string
 	var telemetryInterval string
+	var prometheusURL string
 	var tlsOpts []func(*tls.Config)
 	flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+
 		"Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.")
@@ -87,6 +88,9 @@ func main() {
 		"Endpoint for sending telemetry data")
 	flag.StringVar(&telemetryInterval, "telemetry-interval", "15m",
 		"Interval between telemetry data collection (e.g. 15m, 1h)")
+	flag.StringVar(&prometheusURL, "prometheus-url", "",
+		"Prometheus-compatible API URL for querying SeaweedFS bucket metrics (e.g. http://vmselect:8481). "+
+			"If empty, S3 bucket size metrics are not collected.")
 	opts := zap.Options{
 		Development: false,
 	}
@@ -180,8 +184,9 @@ func main() {
 	}
 
 	if err = (&controller.WorkloadMonitorReconciler{
-		Client: mgr.GetClient(),
-		Scheme: mgr.GetScheme(),
+		Client:        mgr.GetClient(),
+		Scheme:        mgr.GetScheme(),
+		PrometheusURL: prometheusURL,
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "WorkloadMonitor")
 		os.Exit(1)
diff --git a/internal/controller/workloadmonitor_controller.go b/internal/controller/workloadmonitor_controller.go
index 3b69d0fb..960be5c4 100644
--- a/internal/controller/workloadmonitor_controller.go
+++ b/internal/controller/workloadmonitor_controller.go
@@ -4,7 +4,11 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"io"
+	"net/http"
+	"net/url"
 	"sort"
+	"time"
 
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -29,6 +33,9 @@ import (
 type WorkloadMonitorReconciler struct {
 	client.Client
 	Scheme *runtime.Scheme
+	// PrometheusURL is the base URL of a Prometheus-compatible API for querying
+	// SeaweedFS bucket metrics. If empty, bucket size metrics are not collected.
+	PrometheusURL string
 }
 
 // +kubebuilder:rbac:groups=cozystack.io,resources=workloadmonitors,verbs=get;list;watch;create;update;patch;delete
@@ -108,6 +115,76 @@ func updateOwnerReferences(obj metav1.Object, monitor client.Object) {
 	obj.SetOwnerReferences(owners)
 }
 
+// queryBucketSizeBytes queries Prometheus for the logical size of a SeaweedFS bucket.
+// Returns 0 if the metric is not available or PrometheusURL is not configured.
+func (r *WorkloadMonitorReconciler) queryBucketSizeBytes(ctx context.Context, seaweedBucketName string) int64 {
+	if r.PrometheusURL == "" || seaweedBucketName == "" {
+		return 0
+	}
+	logger := log.FromContext(ctx)
+
+	query := fmt.Sprintf(`SeaweedFS_s3_bucket_size_bytes{bucket="%s"}`, seaweedBucketName)
+	u, err := url.Parse(r.PrometheusURL + "/api/v1/query")
+	if err != nil {
+		logger.Error(err, "Failed to parse Prometheus URL")
+		return 0
+	}
+	u.RawQuery = url.Values{"query": {query}}.Encode()
+
+	httpCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(httpCtx, http.MethodGet, u.String(), nil)
+	if err != nil {
+		logger.Error(err, "Failed to create Prometheus request")
+		return 0
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		logger.V(1).Info("Failed to query Prometheus for bucket size", "bucket", seaweedBucketName, "error", err)
+		return 0
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		logger.Error(err, "Failed to read Prometheus response")
+		return 0
+	}
+
+	// Parse Prometheus instant query response:
+	// {"status":"success","data":{"resultType":"vector","result":[{"metric":{...},"value":[timestamp,"value"]}]}}
+	var promResp struct {
+		Status string `json:"status"`
+		Data   struct {
+			Result []struct {
+				Value [2]json.RawMessage `json:"value"`
+			} `json:"result"`
+		} `json:"data"`
+	}
+	if err := json.Unmarshal(body, &promResp); err != nil {
+		logger.Error(err, "Failed to parse Prometheus response")
+		return 0
+	}
+	if promResp.Status != "success" || len(promResp.Data.Result) == 0 {
+		return 0
+	}
+
+	var valueStr string
+	if err := json.Unmarshal(promResp.Data.Result[0].Value[1], &valueStr); err != nil {
+		logger.Error(err, "Failed to parse Prometheus metric value")
+		return 0
+	}
+
+	qty, err := resource.ParseQuantity(valueStr)
+	if err != nil {
+		logger.Error(err, "Failed to parse metric value as quantity", "value", valueStr)
+		return 0
+	}
+	return qty.Value()
+}
+
 // reconcileBucketClaimForMonitor creates or updates a Workload object for the given BucketClaim and WorkloadMonitor.
 func (r *WorkloadMonitorReconciler) reconcileBucketClaimForMonitor(
 	ctx context.Context,
@@ -126,6 +203,13 @@ func (r *WorkloadMonitorReconciler) reconcileBucketClaimForMonitor(
 	resources := make(map[string]resource.Quantity)
 	resources["s3-buckets"] = resource.MustParse("1")
 
+	// Query actual bucket size from SeaweedFS metrics via Prometheus.
+	// bc.Status.BucketName is the COSI Bucket name, which the COSI driver
+	// uses directly as the SeaweedFS bucket name.
+	if sizeBytes := r.queryBucketSizeBytes(ctx, bc.Status.BucketName); sizeBytes > 0 {
+		resources["s3-storage-bytes"] = *resource.NewQuantity(sizeBytes, resource.BinarySI)
+	}
+
 	_, err := ctrl.CreateOrUpdate(ctx, r.Client, workload, func() error {
 		updateOwnerReferences(workload.GetObjectMeta(), &bc)
 
@@ -470,7 +554,12 @@ func (r *WorkloadMonitorReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		return ctrl.Result{}, err
 	}
 
-	// Return without requeue if we want purely event-driven reconciliations
+	// Requeue periodically if there are BucketClaims to keep sizes up to date.
+	// Bucket sizes come from Prometheus metrics that update every 60s.
+	if len(bucketClaimList.Items) > 0 && r.PrometheusURL != "" {
+		return ctrl.Result{RequeueAfter: 60 * time.Second}, nil
+	}
+
 	return ctrl.Result{}, nil
 }
 
diff --git a/internal/controller/workloadmonitor_controller_test.go b/internal/controller/workloadmonitor_controller_test.go
index 9df61cf3..fa7074cb 100644
--- a/internal/controller/workloadmonitor_controller_test.go
+++ b/internal/controller/workloadmonitor_controller_test.go
@@ -2,6 +2,9 @@ package controller
 
 import (
 	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
 	"testing"
 
 	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
@@ -382,3 +385,128 @@ func TestReconcileNoBucketClaimSkips(t *testing.T) {
 		}
 	}
 }
+
+func TestQueryBucketSizeBytes(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[{"metric":{"bucket":"cosi-abc123"},"value":[1713000000,"5368709120"]}]}}`)
+	}))
+	defer srv.Close()
+
+	reconciler := &WorkloadMonitorReconciler{PrometheusURL: srv.URL}
+	size := reconciler.queryBucketSizeBytes(context.TODO(), "cosi-abc123")
+	if size != 5368709120 {
+		t.Errorf("expected 5368709120, got %d", size)
+	}
+}
+
+func TestQueryBucketSizeBytesEmpty(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[]}}`)
+	}))
+	defer srv.Close()
+
+	reconciler := &WorkloadMonitorReconciler{PrometheusURL: srv.URL}
+	size := reconciler.queryBucketSizeBytes(context.TODO(), "nonexistent")
+	if size != 0 {
+		t.Errorf("expected 0 for empty result, got %d", size)
+	}
+}
+
+func TestQueryBucketSizeBytesNoPrometheus(t *testing.T) {
+	reconciler := &WorkloadMonitorReconciler{PrometheusURL: ""}
+	size := reconciler.queryBucketSizeBytes(context.TODO(), "cosi-abc123")
+	if size != 0 {
+		t.Errorf("expected 0 when PrometheusURL is empty, got %d", size)
+	}
+}
+
+func TestReconcileBucketClaimWithPrometheus(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[{"metric":{"bucket":"cosi-abc123"},"value":[1713000000,"1073741824"]}]}}`)
+	}))
+	defer srv.Close()
+
+	s := newTestScheme()
+
+	monitor := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-bucket",
+			Namespace: "tenant-demo",
+		},
+		Spec: cozyv1alpha1.WorkloadMonitorSpec{
+			Kind: "bucket",
+			Type: "s3",
+			Selector: map[string]string{
+				"app.kubernetes.io/instance": "my-bucket",
+			},
+		},
+	}
+
+	bc := &cosiv1alpha1.BucketClaim{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-bucket",
+			Namespace: "tenant-demo",
+			Labels: map[string]string{
+				"app.kubernetes.io/instance": "my-bucket",
+			},
+		},
+		Spec: cosiv1alpha1.BucketClaimSpec{
+			BucketClassName: "seaweedfs",
+			Protocols:       []cosiv1alpha1.Protocol{cosiv1alpha1.ProtocolS3},
+		},
+		Status: cosiv1alpha1.BucketClaimStatus{
+			BucketReady: true,
+			BucketName:  "cosi-abc123",
+		},
+	}
+
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(s).
+		WithObjects(monitor, bc).
+		WithStatusSubresource(monitor).
+		Build()
+
+	reconciler := &WorkloadMonitorReconciler{
+		Client:        fakeClient,
+		Scheme:        s,
+		PrometheusURL: srv.URL,
+	}
+	req := reconcile.Request{NamespacedName: types.NamespacedName{
+		Name:      "my-bucket",
+		Namespace: "tenant-demo",
+	}}
+
+	result, err := reconciler.Reconcile(context.TODO(), req)
+	if err != nil {
+		t.Fatalf("Reconcile returned error: %v", err)
+	}
+
+	if result.RequeueAfter == 0 {
+		t.Error("expected RequeueAfter > 0 when PrometheusURL is set and buckets exist")
+	}
+
+	workload := &cozyv1alpha1.Workload{}
+	err = fakeClient.Get(context.TODO(), types.NamespacedName{
+		Name:      "bucket-my-bucket",
+		Namespace: "tenant-demo",
+	}, workload)
+	if err != nil {
+		t.Fatalf("expected Workload to be created, got error: %v", err)
+	}
+
+	sizeQty, ok := workload.Status.Resources["s3-storage-bytes"]
+	if !ok {
+		t.Fatal("expected s3-storage-bytes resource to be set")
+	}
+	if sizeQty.Value() != 1073741824 {
+		t.Errorf("expected s3-storage-bytes=1073741824 (1 GiB), got %d", sizeQty.Value())
+	}
+
+	bucketsQty, ok := workload.Status.Resources["s3-buckets"]
+	if !ok {
+		t.Fatal("expected s3-buckets resource to be set")
+	}
+	if bucketsQty.Cmp(resource.MustParse("1")) != 0 {
+		t.Errorf("expected s3-buckets=1, got %s", bucketsQty.String())
+	}
+}

From ddbc5f6f830b3dcc33ebae3573b3513cb6b08494 Mon Sep 17 00:00:00 2001
From: ZverGuy <maximbel2003@gmail.com>
Date: Mon, 13 Apr 2026 14:48:49 +0300
Subject: [PATCH 496/666] feat(chart): add prometheus-url flag to
 cozystack-controller deployment

Pass --prometheus-url to the controller container when configured in
values. This enables querying SeaweedFS bucket size metrics from a
Prometheus-compatible API for S3 bucket billing.

RBAC already covers BucketClaim access via existing wildcard rule
(apiGroups: ['*'], resources: ['*'], verbs: ["get", "list", "watch"]).

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
---
 packages/system/cozystack-controller/templates/deployment.yaml | 3 +++
 packages/system/cozystack-controller/values.yaml               | 1 +
 2 files changed, 4 insertions(+)

diff --git a/packages/system/cozystack-controller/templates/deployment.yaml b/packages/system/cozystack-controller/templates/deployment.yaml
index aab7bbe1..94567881 100644
--- a/packages/system/cozystack-controller/templates/deployment.yaml
+++ b/packages/system/cozystack-controller/templates/deployment.yaml
@@ -27,3 +27,6 @@ spec:
         {{- if .Values.cozystackController.disableTelemetry }}
         - --disable-telemetry
         {{- end }}
+        {{- if .Values.cozystackController.prometheusUrl }}
+        - --prometheus-url={{ .Values.cozystackController.prometheusUrl }}
+        {{- end }}
diff --git a/packages/system/cozystack-controller/values.yaml b/packages/system/cozystack-controller/values.yaml
index 6addae2b..2999730b 100644
--- a/packages/system/cozystack-controller/values.yaml
+++ b/packages/system/cozystack-controller/values.yaml
@@ -2,3 +2,4 @@ cozystackController:
   image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.3.0-rc.1@sha256:5ab50893e9d0237d26f366c9d647da6337ca9b97bae764430571d4fb080f6200
   debug: false
   disableTelemetry: false
+  prometheusUrl: ""

From 04f340ab8461ffcedbbcad89fff162acca101133 Mon Sep 17 00:00:00 2001
From: ZverGuy <maximbel2003@gmail.com>
Date: Mon, 13 Apr 2026 15:03:37 +0300
Subject: [PATCH 497/666] feat(controller): add physical storage size metric
 for S3 buckets

Query SeaweedFS_s3_bucket_physical_size_bytes alongside the logical
size metric. Physical size includes all replicas and reflects actual
disk usage, while logical size reflects what the user stored.

Refactor queryBucketSizeBytes into generic queryPrometheusMetric
to reuse for both metrics.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
---
 .../controller/workloadmonitor_controller.go  | 22 +++++++++------
 .../workloadmonitor_controller_test.go        | 28 ++++++++++++++-----
 2 files changed, 34 insertions(+), 16 deletions(-)

diff --git a/internal/controller/workloadmonitor_controller.go b/internal/controller/workloadmonitor_controller.go
index 960be5c4..d7514552 100644
--- a/internal/controller/workloadmonitor_controller.go
+++ b/internal/controller/workloadmonitor_controller.go
@@ -115,21 +115,20 @@ func updateOwnerReferences(obj metav1.Object, monitor client.Object) {
 	obj.SetOwnerReferences(owners)
 }
 
-// queryBucketSizeBytes queries Prometheus for the logical size of a SeaweedFS bucket.
+// queryPrometheusMetric queries a Prometheus-compatible API for a single instant value.
 // Returns 0 if the metric is not available or PrometheusURL is not configured.
-func (r *WorkloadMonitorReconciler) queryBucketSizeBytes(ctx context.Context, seaweedBucketName string) int64 {
-	if r.PrometheusURL == "" || seaweedBucketName == "" {
+func (r *WorkloadMonitorReconciler) queryPrometheusMetric(ctx context.Context, promQL string) int64 {
+	if r.PrometheusURL == "" {
 		return 0
 	}
 	logger := log.FromContext(ctx)
 
-	query := fmt.Sprintf(`SeaweedFS_s3_bucket_size_bytes{bucket="%s"}`, seaweedBucketName)
 	u, err := url.Parse(r.PrometheusURL + "/api/v1/query")
 	if err != nil {
 		logger.Error(err, "Failed to parse Prometheus URL")
 		return 0
 	}
-	u.RawQuery = url.Values{"query": {query}}.Encode()
+	u.RawQuery = url.Values{"query": {promQL}}.Encode()
 
 	httpCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel()
@@ -142,7 +141,7 @@ func (r *WorkloadMonitorReconciler) queryBucketSizeBytes(ctx context.Context, se
 
 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
-		logger.V(1).Info("Failed to query Prometheus for bucket size", "bucket", seaweedBucketName, "error", err)
+		logger.V(1).Info("Failed to query Prometheus", "query", promQL, "error", err)
 		return 0
 	}
 	defer resp.Body.Close()
@@ -203,11 +202,16 @@ func (r *WorkloadMonitorReconciler) reconcileBucketClaimForMonitor(
 	resources := make(map[string]resource.Quantity)
 	resources["s3-buckets"] = resource.MustParse("1")
 
-	// Query actual bucket size from SeaweedFS metrics via Prometheus.
+	// Query actual bucket sizes from SeaweedFS metrics via Prometheus.
 	// bc.Status.BucketName is the COSI Bucket name, which the COSI driver
 	// uses directly as the SeaweedFS bucket name.
-	if sizeBytes := r.queryBucketSizeBytes(ctx, bc.Status.BucketName); sizeBytes > 0 {
-		resources["s3-storage-bytes"] = *resource.NewQuantity(sizeBytes, resource.BinarySI)
+	if bn := bc.Status.BucketName; bn != "" {
+		if v := r.queryPrometheusMetric(ctx, fmt.Sprintf(`SeaweedFS_s3_bucket_size_bytes{bucket="%s"}`, bn)); v > 0 {
+			resources["s3-storage-bytes"] = *resource.NewQuantity(v, resource.BinarySI)
+		}
+		if v := r.queryPrometheusMetric(ctx, fmt.Sprintf(`SeaweedFS_s3_bucket_physical_size_bytes{bucket="%s"}`, bn)); v > 0 {
+			resources["s3-physical-storage-bytes"] = *resource.NewQuantity(v, resource.BinarySI)
+		}
 	}
 
 	_, err := ctrl.CreateOrUpdate(ctx, r.Client, workload, func() error {
diff --git a/internal/controller/workloadmonitor_controller_test.go b/internal/controller/workloadmonitor_controller_test.go
index fa7074cb..de9b78e5 100644
--- a/internal/controller/workloadmonitor_controller_test.go
+++ b/internal/controller/workloadmonitor_controller_test.go
@@ -386,35 +386,35 @@ func TestReconcileNoBucketClaimSkips(t *testing.T) {
 	}
 }
 
-func TestQueryBucketSizeBytes(t *testing.T) {
+func TestQueryPrometheusMetric(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[{"metric":{"bucket":"cosi-abc123"},"value":[1713000000,"5368709120"]}]}}`)
 	}))
 	defer srv.Close()
 
 	reconciler := &WorkloadMonitorReconciler{PrometheusURL: srv.URL}
-	size := reconciler.queryBucketSizeBytes(context.TODO(), "cosi-abc123")
+	size := reconciler.queryPrometheusMetric(context.TODO(), `SeaweedFS_s3_bucket_size_bytes{bucket="cosi-abc123"}`)
 	if size != 5368709120 {
 		t.Errorf("expected 5368709120, got %d", size)
 	}
 }
 
-func TestQueryBucketSizeBytesEmpty(t *testing.T) {
+func TestQueryPrometheusMetricEmpty(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[]}}`)
 	}))
 	defer srv.Close()
 
 	reconciler := &WorkloadMonitorReconciler{PrometheusURL: srv.URL}
-	size := reconciler.queryBucketSizeBytes(context.TODO(), "nonexistent")
+	size := reconciler.queryPrometheusMetric(context.TODO(), `SeaweedFS_s3_bucket_size_bytes{bucket="nonexistent"}`)
 	if size != 0 {
 		t.Errorf("expected 0 for empty result, got %d", size)
 	}
 }
 
-func TestQueryBucketSizeBytesNoPrometheus(t *testing.T) {
+func TestQueryPrometheusMetricNoURL(t *testing.T) {
 	reconciler := &WorkloadMonitorReconciler{PrometheusURL: ""}
-	size := reconciler.queryBucketSizeBytes(context.TODO(), "cosi-abc123")
+	size := reconciler.queryPrometheusMetric(context.TODO(), `anything`)
 	if size != 0 {
 		t.Errorf("expected 0 when PrometheusURL is empty, got %d", size)
 	}
@@ -422,7 +422,13 @@ func TestQueryBucketSizeBytesNoPrometheus(t *testing.T) {
 
 func TestReconcileBucketClaimWithPrometheus(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[{"metric":{"bucket":"cosi-abc123"},"value":[1713000000,"1073741824"]}]}}`)
+		query := r.URL.Query().Get("query")
+		switch {
+		case len(query) > 0 && query[0:len("SeaweedFS_s3_bucket_physical")] == "SeaweedFS_s3_bucket_physical":
+			fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[{"metric":{"bucket":"cosi-abc123"},"value":[1713000000,"2147483648"]}]}}`)
+		default:
+			fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[{"metric":{"bucket":"cosi-abc123"},"value":[1713000000,"1073741824"]}]}}`)
+		}
 	}))
 	defer srv.Close()
 
@@ -509,4 +515,12 @@ func TestReconcileBucketClaimWithPrometheus(t *testing.T) {
 	if bucketsQty.Cmp(resource.MustParse("1")) != 0 {
 		t.Errorf("expected s3-buckets=1, got %s", bucketsQty.String())
 	}
+
+	physQty, ok := workload.Status.Resources["s3-physical-storage-bytes"]
+	if !ok {
+		t.Fatal("expected s3-physical-storage-bytes resource to be set")
+	}
+	if physQty.Value() != 2147483648 {
+		t.Errorf("expected s3-physical-storage-bytes=2147483648 (2 GiB), got %d", physQty.Value())
+	}
 }

From bfdfe989e05c88b81569fad2f23aa9d0031c007a Mon Sep 17 00:00:00 2001
From: ZverGuy <maximbel2003@gmail.com>
Date: Mon, 13 Apr 2026 18:20:12 +0300
Subject: [PATCH 498/666] fix(controller): add HTTP status check and limit
 response body size

- Check resp.StatusCode before parsing Prometheus response
- Limit response body read to 1 MB via io.LimitReader
- Use strings.HasPrefix in test instead of fragile slice indexing
- Add TestQueryPrometheusMetricServerError for 500 responses

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
---
 .../controller/workloadmonitor_controller.go     |  7 ++++++-
 .../workloadmonitor_controller_test.go           | 16 +++++++++++++++-
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/internal/controller/workloadmonitor_controller.go b/internal/controller/workloadmonitor_controller.go
index d7514552..900610e4 100644
--- a/internal/controller/workloadmonitor_controller.go
+++ b/internal/controller/workloadmonitor_controller.go
@@ -146,7 +146,12 @@ func (r *WorkloadMonitorReconciler) queryPrometheusMetric(ctx context.Context, p
 	}
 	defer resp.Body.Close()
 
-	body, err := io.ReadAll(resp.Body)
+	if resp.StatusCode != http.StatusOK {
+		logger.V(1).Info("Prometheus returned non-OK status", "query", promQL, "status", resp.StatusCode)
+		return 0
+	}
+
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
 	if err != nil {
 		logger.Error(err, "Failed to read Prometheus response")
 		return 0
diff --git a/internal/controller/workloadmonitor_controller_test.go b/internal/controller/workloadmonitor_controller_test.go
index de9b78e5..e8feb0b0 100644
--- a/internal/controller/workloadmonitor_controller_test.go
+++ b/internal/controller/workloadmonitor_controller_test.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 
 	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
@@ -412,6 +413,19 @@ func TestQueryPrometheusMetricEmpty(t *testing.T) {
 	}
 }
 
+func TestQueryPrometheusMetricServerError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+
+	reconciler := &WorkloadMonitorReconciler{PrometheusURL: srv.URL}
+	size := reconciler.queryPrometheusMetric(context.TODO(), `SeaweedFS_s3_bucket_size_bytes{bucket="test"}`)
+	if size != 0 {
+		t.Errorf("expected 0 for server error, got %d", size)
+	}
+}
+
 func TestQueryPrometheusMetricNoURL(t *testing.T) {
 	reconciler := &WorkloadMonitorReconciler{PrometheusURL: ""}
 	size := reconciler.queryPrometheusMetric(context.TODO(), `anything`)
@@ -424,7 +438,7 @@ func TestReconcileBucketClaimWithPrometheus(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		query := r.URL.Query().Get("query")
 		switch {
-		case len(query) > 0 && query[0:len("SeaweedFS_s3_bucket_physical")] == "SeaweedFS_s3_bucket_physical":
+		case strings.HasPrefix(query, "SeaweedFS_s3_bucket_physical"):
 			fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[{"metric":{"bucket":"cosi-abc123"},"value":[1713000000,"2147483648"]}]}}`)
 		default:
 			fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[{"metric":{"bucket":"cosi-abc123"},"value":[1713000000,"1073741824"]}]}}`)

From 0e6b8f7ba1109e32dfa25f30a2863bd2731b3ac3 Mon Sep 17 00:00:00 2001
From: ZverGuy <maximbel2003@gmail.com>
Date: Mon, 13 Apr 2026 18:23:59 +0300
Subject: [PATCH 499/666] fix(controller): address review findings for
 BucketClaim reconciler

- Set replicas/minReplicas to 0 in bucket WorkloadMonitor (buckets
  have no pods, minReplicas=1 would mark monitor as not operational)
- Remove dead IsNotFound check on List (List returns empty, not 404)
- Trim trailing slash from PrometheusURL before path append
- Add strings import for TrimRight

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
---
 internal/controller/workloadmonitor_controller.go   | 9 ++++-----
 packages/apps/bucket/templates/workloadmonitor.yaml | 4 ++--
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/internal/controller/workloadmonitor_controller.go b/internal/controller/workloadmonitor_controller.go
index 900610e4..1e011313 100644
--- a/internal/controller/workloadmonitor_controller.go
+++ b/internal/controller/workloadmonitor_controller.go
@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"net/url"
 	"sort"
+	"strings"
 	"time"
 
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
@@ -123,7 +124,7 @@ func (r *WorkloadMonitorReconciler) queryPrometheusMetric(ctx context.Context, p
 	}
 	logger := log.FromContext(ctx)
 
-	u, err := url.Parse(r.PrometheusURL + "/api/v1/query")
+	u, err := url.Parse(strings.TrimRight(r.PrometheusURL, "/") + "/api/v1/query")
 	if err != nil {
 		logger.Error(err, "Failed to parse Prometheus URL")
 		return 0
@@ -523,10 +524,8 @@ func (r *WorkloadMonitorReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		client.InNamespace(monitor.Namespace),
 		client.MatchingLabels(monitor.Spec.Selector),
 	); err != nil {
-		if !apierrors.IsNotFound(err) {
-			logger.Error(err, "Unable to list BucketClaims for WorkloadMonitor", "monitor", monitor.Name)
-			return ctrl.Result{}, err
-		}
+		logger.Error(err, "Unable to list BucketClaims for WorkloadMonitor", "monitor", monitor.Name)
+		return ctrl.Result{}, err
 	}
 
 	for _, bc := range bucketClaimList.Items {
diff --git a/packages/apps/bucket/templates/workloadmonitor.yaml b/packages/apps/bucket/templates/workloadmonitor.yaml
index 4e618ddd..a23f3147 100644
--- a/packages/apps/bucket/templates/workloadmonitor.yaml
+++ b/packages/apps/bucket/templates/workloadmonitor.yaml
@@ -4,8 +4,8 @@ kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}
 spec:
-  replicas: 1
-  minReplicas: 1
+  replicas: 0
+  minReplicas: 0
   kind: bucket
   type: s3
   selector:

From 7f7f4b218d8e56066592af7326a0aaa0d39db89b Mon Sep 17 00:00:00 2001
From: ZverGuy <maximbel2003@gmail.com>
Date: Mon, 13 Apr 2026 18:42:50 +0300
Subject: [PATCH 500/666] refactor(controller): resolve Prometheus URL from
 namespace labels

Replace static --prometheus-url flag with dynamic resolution from
namespace.cozystack.io/monitoring label. Each tenant namespace knows
which tenant hosts its monitoring stack, so the controller constructs
the vmselect URL automatically. This correctly handles multi-tenant
setups where different tenants may use different monitoring instances.

- Remove PrometheusURL field from WorkloadMonitorReconciler struct
- Remove --prometheus-url flag and prometheusUrl chart value
- Add resolvePrometheusURL() that reads namespace label
- queryPrometheusMetric() now accepts prometheusBaseURL as parameter
- Add tests for resolvePrometheusURL with and without label

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
---
 cmd/cozystack-controller/main.go              |   9 +-
 .../controller/workloadmonitor_controller.go  |  47 ++++++--
 .../workloadmonitor_controller_test.go        | 111 +++++++++++-------
 .../templates/deployment.yaml                 |   3 -
 .../system/cozystack-controller/values.yaml   |   1 -
 5 files changed, 108 insertions(+), 63 deletions(-)

diff --git a/cmd/cozystack-controller/main.go b/cmd/cozystack-controller/main.go
index 1175e2b4..bcaca9c9 100644
--- a/cmd/cozystack-controller/main.go
+++ b/cmd/cozystack-controller/main.go
@@ -70,7 +70,6 @@ func main() {
 	var disableTelemetry bool
 	var telemetryEndpoint string
 	var telemetryInterval string
-	var prometheusURL string
 	var tlsOpts []func(*tls.Config)
 	flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+
 		"Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.")
@@ -88,9 +87,6 @@ func main() {
 		"Endpoint for sending telemetry data")
 	flag.StringVar(&telemetryInterval, "telemetry-interval", "15m",
 		"Interval between telemetry data collection (e.g. 15m, 1h)")
-	flag.StringVar(&prometheusURL, "prometheus-url", "",
-		"Prometheus-compatible API URL for querying SeaweedFS bucket metrics (e.g. http://vmselect:8481). "+
-			"If empty, S3 bucket size metrics are not collected.")
 	opts := zap.Options{
 		Development: false,
 	}
@@ -184,9 +180,8 @@ func main() {
 	}
 
 	if err = (&controller.WorkloadMonitorReconciler{
-		Client:        mgr.GetClient(),
-		Scheme:        mgr.GetScheme(),
-		PrometheusURL: prometheusURL,
+		Client: mgr.GetClient(),
+		Scheme: mgr.GetScheme(),
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "WorkloadMonitor")
 		os.Exit(1)
diff --git a/internal/controller/workloadmonitor_controller.go b/internal/controller/workloadmonitor_controller.go
index 1e011313..e86e5a75 100644
--- a/internal/controller/workloadmonitor_controller.go
+++ b/internal/controller/workloadmonitor_controller.go
@@ -30,13 +30,21 @@ import (
 	cosiv1alpha1 "sigs.k8s.io/container-object-storage-interface-api/apis/objectstorage/v1alpha1"
 )
 
+const (
+	// namespaceMonitoringLabel is the namespace label that indicates which tenant
+	// namespace hosts the monitoring stack (VictoriaMetrics/Prometheus).
+	namespaceMonitoringLabel = "namespace.cozystack.io/monitoring"
+	// vmSelectService is the well-known service name for VictoriaMetrics vmselect
+	// within a monitoring namespace. Port 8481, path /select/0/prometheus.
+	vmSelectService = "vmselect-shortterm"
+	vmSelectPort    = "8481"
+	vmSelectPath    = "/select/0/prometheus"
+)
+
 // WorkloadMonitorReconciler reconciles a WorkloadMonitor object
 type WorkloadMonitorReconciler struct {
 	client.Client
 	Scheme *runtime.Scheme
-	// PrometheusURL is the base URL of a Prometheus-compatible API for querying
-	// SeaweedFS bucket metrics. If empty, bucket size metrics are not collected.
-	PrometheusURL string
 }
 
 // +kubebuilder:rbac:groups=cozystack.io,resources=workloadmonitors,verbs=get;list;watch;create;update;patch;delete
@@ -116,15 +124,30 @@ func updateOwnerReferences(obj metav1.Object, monitor client.Object) {
 	obj.SetOwnerReferences(owners)
 }
 
+// resolvePrometheusURL returns the Prometheus-compatible API base URL for the given namespace.
+// It reads the namespace.cozystack.io/monitoring label to find the monitoring namespace,
+// then constructs the vmselect URL. Returns empty string if monitoring is not configured.
+func (r *WorkloadMonitorReconciler) resolvePrometheusURL(ctx context.Context, namespace string) string {
+	ns := &corev1.Namespace{}
+	if err := r.Get(ctx, types.NamespacedName{Name: namespace}, ns); err != nil {
+		return ""
+	}
+	monitoringNS := ns.Labels[namespaceMonitoringLabel]
+	if monitoringNS == "" {
+		return ""
+	}
+	return fmt.Sprintf("http://%s.%s.svc:%s%s", vmSelectService, monitoringNS, vmSelectPort, vmSelectPath)
+}
+
 // queryPrometheusMetric queries a Prometheus-compatible API for a single instant value.
-// Returns 0 if the metric is not available or PrometheusURL is not configured.
-func (r *WorkloadMonitorReconciler) queryPrometheusMetric(ctx context.Context, promQL string) int64 {
-	if r.PrometheusURL == "" {
+// Returns 0 if prometheusBaseURL is empty or the metric is not available.
+func (r *WorkloadMonitorReconciler) queryPrometheusMetric(ctx context.Context, prometheusBaseURL, promQL string) int64 {
+	if prometheusBaseURL == "" {
 		return 0
 	}
 	logger := log.FromContext(ctx)
 
-	u, err := url.Parse(strings.TrimRight(r.PrometheusURL, "/") + "/api/v1/query")
+	u, err := url.Parse(strings.TrimRight(prometheusBaseURL, "/") + "/api/v1/query")
 	if err != nil {
 		logger.Error(err, "Failed to parse Prometheus URL")
 		return 0
@@ -209,13 +232,17 @@ func (r *WorkloadMonitorReconciler) reconcileBucketClaimForMonitor(
 	resources["s3-buckets"] = resource.MustParse("1")
 
 	// Query actual bucket sizes from SeaweedFS metrics via Prometheus.
+	// The monitoring endpoint is resolved from the namespace label
+	// namespace.cozystack.io/monitoring, which points to the tenant
+	// namespace hosting VictoriaMetrics.
 	// bc.Status.BucketName is the COSI Bucket name, which the COSI driver
 	// uses directly as the SeaweedFS bucket name.
 	if bn := bc.Status.BucketName; bn != "" {
-		if v := r.queryPrometheusMetric(ctx, fmt.Sprintf(`SeaweedFS_s3_bucket_size_bytes{bucket="%s"}`, bn)); v > 0 {
+		promURL := r.resolvePrometheusURL(ctx, bc.Namespace)
+		if v := r.queryPrometheusMetric(ctx, promURL, fmt.Sprintf(`SeaweedFS_s3_bucket_size_bytes{bucket="%s"}`, bn)); v > 0 {
 			resources["s3-storage-bytes"] = *resource.NewQuantity(v, resource.BinarySI)
 		}
-		if v := r.queryPrometheusMetric(ctx, fmt.Sprintf(`SeaweedFS_s3_bucket_physical_size_bytes{bucket="%s"}`, bn)); v > 0 {
+		if v := r.queryPrometheusMetric(ctx, promURL, fmt.Sprintf(`SeaweedFS_s3_bucket_physical_size_bytes{bucket="%s"}`, bn)); v > 0 {
 			resources["s3-physical-storage-bytes"] = *resource.NewQuantity(v, resource.BinarySI)
 		}
 	}
@@ -564,7 +591,7 @@ func (r *WorkloadMonitorReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 
 	// Requeue periodically if there are BucketClaims to keep sizes up to date.
 	// Bucket sizes come from Prometheus metrics that update every 60s.
-	if len(bucketClaimList.Items) > 0 && r.PrometheusURL != "" {
+	if len(bucketClaimList.Items) > 0 {
 		return ctrl.Result{RequeueAfter: 60 * time.Second}, nil
 	}
 
diff --git a/internal/controller/workloadmonitor_controller_test.go b/internal/controller/workloadmonitor_controller_test.go
index e8feb0b0..c78efd18 100644
--- a/internal/controller/workloadmonitor_controller_test.go
+++ b/internal/controller/workloadmonitor_controller_test.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"net/http"
 	"net/http/httptest"
-	"strings"
 	"testing"
 
 	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
@@ -393,8 +392,8 @@ func TestQueryPrometheusMetric(t *testing.T) {
 	}))
 	defer srv.Close()
 
-	reconciler := &WorkloadMonitorReconciler{PrometheusURL: srv.URL}
-	size := reconciler.queryPrometheusMetric(context.TODO(), `SeaweedFS_s3_bucket_size_bytes{bucket="cosi-abc123"}`)
+	reconciler := &WorkloadMonitorReconciler{}
+	size := reconciler.queryPrometheusMetric(context.TODO(), srv.URL, `SeaweedFS_s3_bucket_size_bytes{bucket="cosi-abc123"}`)
 	if size != 5368709120 {
 		t.Errorf("expected 5368709120, got %d", size)
 	}
@@ -406,8 +405,8 @@ func TestQueryPrometheusMetricEmpty(t *testing.T) {
 	}))
 	defer srv.Close()
 
-	reconciler := &WorkloadMonitorReconciler{PrometheusURL: srv.URL}
-	size := reconciler.queryPrometheusMetric(context.TODO(), `SeaweedFS_s3_bucket_size_bytes{bucket="nonexistent"}`)
+	reconciler := &WorkloadMonitorReconciler{}
+	size := reconciler.queryPrometheusMetric(context.TODO(), srv.URL, `SeaweedFS_s3_bucket_size_bytes{bucket="nonexistent"}`)
 	if size != 0 {
 		t.Errorf("expected 0 for empty result, got %d", size)
 	}
@@ -419,35 +418,78 @@ func TestQueryPrometheusMetricServerError(t *testing.T) {
 	}))
 	defer srv.Close()
 
-	reconciler := &WorkloadMonitorReconciler{PrometheusURL: srv.URL}
-	size := reconciler.queryPrometheusMetric(context.TODO(), `SeaweedFS_s3_bucket_size_bytes{bucket="test"}`)
+	reconciler := &WorkloadMonitorReconciler{}
+	size := reconciler.queryPrometheusMetric(context.TODO(), srv.URL, `SeaweedFS_s3_bucket_size_bytes{bucket="test"}`)
 	if size != 0 {
 		t.Errorf("expected 0 for server error, got %d", size)
 	}
 }
 
 func TestQueryPrometheusMetricNoURL(t *testing.T) {
-	reconciler := &WorkloadMonitorReconciler{PrometheusURL: ""}
-	size := reconciler.queryPrometheusMetric(context.TODO(), `anything`)
+	reconciler := &WorkloadMonitorReconciler{}
+	size := reconciler.queryPrometheusMetric(context.TODO(), "", `anything`)
 	if size != 0 {
 		t.Errorf("expected 0 when PrometheusURL is empty, got %d", size)
 	}
 }
 
-func TestReconcileBucketClaimWithPrometheus(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		query := r.URL.Query().Get("query")
-		switch {
-		case strings.HasPrefix(query, "SeaweedFS_s3_bucket_physical"):
-			fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[{"metric":{"bucket":"cosi-abc123"},"value":[1713000000,"2147483648"]}]}}`)
-		default:
-			fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[{"metric":{"bucket":"cosi-abc123"},"value":[1713000000,"1073741824"]}]}}`)
-		}
-	}))
-	defer srv.Close()
-
+func TestResolvePrometheusURL(t *testing.T) {
 	s := newTestScheme()
 
+	ns := &corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "tenant-demo",
+			Labels: map[string]string{
+				"namespace.cozystack.io/monitoring": "tenant-root",
+			},
+		},
+	}
+
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(s).
+		WithObjects(ns).
+		Build()
+
+	reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: s}
+	url := reconciler.resolvePrometheusURL(context.TODO(), "tenant-demo")
+
+	expected := "http://vmselect-shortterm.tenant-root.svc:8481/select/0/prometheus"
+	if url != expected {
+		t.Errorf("expected %q, got %q", expected, url)
+	}
+}
+
+func TestResolvePrometheusURLNoLabel(t *testing.T) {
+	s := newTestScheme()
+
+	ns := &corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "tenant-demo",
+		},
+	}
+
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(s).
+		WithObjects(ns).
+		Build()
+
+	reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: s}
+	url := reconciler.resolvePrometheusURL(context.TODO(), "tenant-demo")
+
+	if url != "" {
+		t.Errorf("expected empty URL when no monitoring label, got %q", url)
+	}
+}
+
+func TestReconcileBucketClaimRequeuesWhenBucketsExist(t *testing.T) {
+	s := newTestScheme()
+
+	ns := &corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "tenant-demo",
+		},
+	}
+
 	monitor := &cozyv1alpha1.WorkloadMonitor{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "my-bucket",
@@ -482,15 +524,11 @@ func TestReconcileBucketClaimWithPrometheus(t *testing.T) {
 
 	fakeClient := fake.NewClientBuilder().
 		WithScheme(s).
-		WithObjects(monitor, bc).
+		WithObjects(ns, monitor, bc).
 		WithStatusSubresource(monitor).
 		Build()
 
-	reconciler := &WorkloadMonitorReconciler{
-		Client:        fakeClient,
-		Scheme:        s,
-		PrometheusURL: srv.URL,
-	}
+	reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: s}
 	req := reconcile.Request{NamespacedName: types.NamespacedName{
 		Name:      "my-bucket",
 		Namespace: "tenant-demo",
@@ -502,7 +540,7 @@ func TestReconcileBucketClaimWithPrometheus(t *testing.T) {
 	}
 
 	if result.RequeueAfter == 0 {
-		t.Error("expected RequeueAfter > 0 when PrometheusURL is set and buckets exist")
+		t.Error("expected RequeueAfter > 0 when buckets exist")
 	}
 
 	workload := &cozyv1alpha1.Workload{}
@@ -514,12 +552,9 @@ func TestReconcileBucketClaimWithPrometheus(t *testing.T) {
 		t.Fatalf("expected Workload to be created, got error: %v", err)
 	}
 
-	sizeQty, ok := workload.Status.Resources["s3-storage-bytes"]
-	if !ok {
-		t.Fatal("expected s3-storage-bytes resource to be set")
-	}
-	if sizeQty.Value() != 1073741824 {
-		t.Errorf("expected s3-storage-bytes=1073741824 (1 GiB), got %d", sizeQty.Value())
+	// Without monitoring label on namespace, only s3-buckets should be set (no size metrics)
+	if _, ok := workload.Status.Resources["s3-storage-bytes"]; ok {
+		t.Error("expected no s3-storage-bytes when monitoring is not configured")
 	}
 
 	bucketsQty, ok := workload.Status.Resources["s3-buckets"]
@@ -529,12 +564,4 @@ func TestReconcileBucketClaimWithPrometheus(t *testing.T) {
 	if bucketsQty.Cmp(resource.MustParse("1")) != 0 {
 		t.Errorf("expected s3-buckets=1, got %s", bucketsQty.String())
 	}
-
-	physQty, ok := workload.Status.Resources["s3-physical-storage-bytes"]
-	if !ok {
-		t.Fatal("expected s3-physical-storage-bytes resource to be set")
-	}
-	if physQty.Value() != 2147483648 {
-		t.Errorf("expected s3-physical-storage-bytes=2147483648 (2 GiB), got %d", physQty.Value())
-	}
 }
diff --git a/packages/system/cozystack-controller/templates/deployment.yaml b/packages/system/cozystack-controller/templates/deployment.yaml
index 94567881..aab7bbe1 100644
--- a/packages/system/cozystack-controller/templates/deployment.yaml
+++ b/packages/system/cozystack-controller/templates/deployment.yaml
@@ -27,6 +27,3 @@ spec:
         {{- if .Values.cozystackController.disableTelemetry }}
         - --disable-telemetry
         {{- end }}
-        {{- if .Values.cozystackController.prometheusUrl }}
-        - --prometheus-url={{ .Values.cozystackController.prometheusUrl }}
-        {{- end }}
diff --git a/packages/system/cozystack-controller/values.yaml b/packages/system/cozystack-controller/values.yaml
index 2999730b..6addae2b 100644
--- a/packages/system/cozystack-controller/values.yaml
+++ b/packages/system/cozystack-controller/values.yaml
@@ -2,4 +2,3 @@ cozystackController:
   image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.3.0-rc.1@sha256:5ab50893e9d0237d26f366c9d647da6337ca9b97bae764430571d4fb080f6200
   debug: false
   disableTelemetry: false
-  prometheusUrl: ""

From 40620b2911604392a392aa5f878a8cabaff01851 Mon Sep 17 00:00:00 2001
From: ZverGuy <maximbel2003@gmail.com>
Date: Mon, 13 Apr 2026 19:04:00 +0300
Subject: [PATCH 501/666] fix(controller): fix nil map panic and scientific
 notation parsing

- Initialize workload.Labels map inside CreateOrUpdate mutate function
  to prevent nil map panic when existing Workload has no labels
- Use strconv.ParseFloat instead of resource.ParseQuantity for
  Prometheus metric values, which may use scientific notation
  (e.g. "1.048576e+06") that ParseQuantity does not support

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
---
 internal/controller/workloadmonitor_controller.go | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/internal/controller/workloadmonitor_controller.go b/internal/controller/workloadmonitor_controller.go
index e86e5a75..61fe8a99 100644
--- a/internal/controller/workloadmonitor_controller.go
+++ b/internal/controller/workloadmonitor_controller.go
@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"net/url"
 	"sort"
+	"strconv"
 	"strings"
 	"time"
 
@@ -205,12 +206,12 @@ func (r *WorkloadMonitorReconciler) queryPrometheusMetric(ctx context.Context, p
 		return 0
 	}
 
-	qty, err := resource.ParseQuantity(valueStr)
+	val, err := strconv.ParseFloat(valueStr, 64)
 	if err != nil {
-		logger.Error(err, "Failed to parse metric value as quantity", "value", valueStr)
+		logger.Error(err, "Failed to parse metric value", "value", valueStr)
 		return 0
 	}
-	return qty.Value()
+	return int64(val)
 }
 
 // reconcileBucketClaimForMonitor creates or updates a Workload object for the given BucketClaim and WorkloadMonitor.
@@ -250,6 +251,9 @@ func (r *WorkloadMonitorReconciler) reconcileBucketClaimForMonitor(
 	_, err := ctrl.CreateOrUpdate(ctx, r.Client, workload, func() error {
 		updateOwnerReferences(workload.GetObjectMeta(), &bc)
 
+		if workload.Labels == nil {
+			workload.Labels = make(map[string]string)
+		}
 		for k, v := range bc.Labels {
 			workload.Labels[k] = v
 		}

From a6f74f3198bb4578139a433eb3036bb01827d1ea Mon Sep 17 00:00:00 2001
From: ZverGuy <maximbel2003@gmail.com>
Date: Tue, 14 Apr 2026 14:06:29 +0300
Subject: [PATCH 502/666] refactor(controller): remove s3-buckets count
 resource from bucket workloads

Bucket existence is already tracked via LifetimeHours. The s3-buckets
count resource produced a meaningless "s3-buckets-Hours" fallback type
in billing. Only storage size metrics (s3-storage-bytes,
s3-physical-storage-bytes) are now set on bucket Workloads.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
---
 .../controller/workloadmonitor_controller.go  |  1 -
 .../workloadmonitor_controller_test.go        | 20 +++----------------
 2 files changed, 3 insertions(+), 18 deletions(-)

diff --git a/internal/controller/workloadmonitor_controller.go b/internal/controller/workloadmonitor_controller.go
index 61fe8a99..f1f64f29 100644
--- a/internal/controller/workloadmonitor_controller.go
+++ b/internal/controller/workloadmonitor_controller.go
@@ -230,7 +230,6 @@ func (r *WorkloadMonitorReconciler) reconcileBucketClaimForMonitor(
 	}
 
 	resources := make(map[string]resource.Quantity)
-	resources["s3-buckets"] = resource.MustParse("1")
 
 	// Query actual bucket sizes from SeaweedFS metrics via Prometheus.
 	// The monitoring endpoint is resolved from the namespace label
diff --git a/internal/controller/workloadmonitor_controller_test.go b/internal/controller/workloadmonitor_controller_test.go
index c78efd18..71294927 100644
--- a/internal/controller/workloadmonitor_controller_test.go
+++ b/internal/controller/workloadmonitor_controller_test.go
@@ -9,7 +9,6 @@ import (
 
 	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
@@ -264,14 +263,6 @@ func TestReconcileBucketClaimCreatesWorkload(t *testing.T) {
 	if !workload.Status.Operational {
 		t.Error("expected Operational=true for ready BucketClaim")
 	}
-
-	qty, ok := workload.Status.Resources["s3-buckets"]
-	if !ok {
-		t.Fatal("expected s3-buckets resource to be set")
-	}
-	if qty.Cmp(resource.MustParse("1")) != 0 {
-		t.Errorf("expected s3-buckets=1, got %s", qty.String())
-	}
 }
 
 func TestReconcileBucketClaimNotReady(t *testing.T) {
@@ -552,16 +543,11 @@ func TestReconcileBucketClaimRequeuesWhenBucketsExist(t *testing.T) {
 		t.Fatalf("expected Workload to be created, got error: %v", err)
 	}
 
-	// Without monitoring label on namespace, only s3-buckets should be set (no size metrics)
+	// Without monitoring label on namespace, no size metrics should be set
 	if _, ok := workload.Status.Resources["s3-storage-bytes"]; ok {
 		t.Error("expected no s3-storage-bytes when monitoring is not configured")
 	}
-
-	bucketsQty, ok := workload.Status.Resources["s3-buckets"]
-	if !ok {
-		t.Fatal("expected s3-buckets resource to be set")
-	}
-	if bucketsQty.Cmp(resource.MustParse("1")) != 0 {
-		t.Errorf("expected s3-buckets=1, got %s", bucketsQty.String())
+	if len(workload.Status.Resources) != 0 {
+		t.Errorf("expected empty resources without monitoring, got %v", workload.Status.Resources)
 	}
 }

From 260ce84e5f45357942389006a7d856947ecf7260 Mon Sep 17 00:00:00 2001
From: ZverGuy <maximbel2003@gmail.com>
Date: Tue, 14 Apr 2026 14:19:52 +0300
Subject: [PATCH 503/666] fix(controller): distinguish empty buckets from
 monitoring unavailable

Change queryPrometheusMetric to return (int64, bool) so callers can
emit s3-storage-bytes=0 for empty buckets while omitting the field
entirely when monitoring is not configured.

Also:
- Add RBAC marker for core/namespaces GET (used by resolvePrometheusURL)
- Log namespace read errors instead of silently returning empty URL
- Add TestQueryPrometheusMetricZeroValue test

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
---
 .../controller/workloadmonitor_controller.go  | 35 ++++++++++-------
 .../workloadmonitor_controller_test.go        | 39 ++++++++++++++-----
 2 files changed, 49 insertions(+), 25 deletions(-)

diff --git a/internal/controller/workloadmonitor_controller.go b/internal/controller/workloadmonitor_controller.go
index f1f64f29..5b450d75 100644
--- a/internal/controller/workloadmonitor_controller.go
+++ b/internal/controller/workloadmonitor_controller.go
@@ -54,6 +54,7 @@ type WorkloadMonitorReconciler struct {
 // +kubebuilder:rbac:groups=cozystack.io,resources=workloads/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch
 // +kubebuilder:rbac:groups=core,resources=persistentvolumeclaims,verbs=get;list;watch
+// +kubebuilder:rbac:groups=core,resources=namespaces,verbs=get
 // +kubebuilder:rbac:groups=objectstorage.k8s.io,resources=bucketclaims,verbs=get;list;watch
 
 // isBucketClaimReady checks if the BucketClaim has been provisioned.
@@ -129,8 +130,10 @@ func updateOwnerReferences(obj metav1.Object, monitor client.Object) {
 // It reads the namespace.cozystack.io/monitoring label to find the monitoring namespace,
 // then constructs the vmselect URL. Returns empty string if monitoring is not configured.
 func (r *WorkloadMonitorReconciler) resolvePrometheusURL(ctx context.Context, namespace string) string {
+	logger := log.FromContext(ctx)
 	ns := &corev1.Namespace{}
 	if err := r.Get(ctx, types.NamespacedName{Name: namespace}, ns); err != nil {
+		logger.V(1).Info("Failed to read namespace for monitoring resolution", "namespace", namespace, "error", err)
 		return ""
 	}
 	monitoringNS := ns.Labels[namespaceMonitoringLabel]
@@ -141,17 +144,19 @@ func (r *WorkloadMonitorReconciler) resolvePrometheusURL(ctx context.Context, na
 }
 
 // queryPrometheusMetric queries a Prometheus-compatible API for a single instant value.
-// Returns 0 if prometheusBaseURL is empty or the metric is not available.
-func (r *WorkloadMonitorReconciler) queryPrometheusMetric(ctx context.Context, prometheusBaseURL, promQL string) int64 {
+// Returns the value and true if the metric was found, or 0 and false if the query
+// failed or no metric exists. This distinction allows callers to emit a resource
+// with value 0 for empty buckets vs omitting it when monitoring is unavailable.
+func (r *WorkloadMonitorReconciler) queryPrometheusMetric(ctx context.Context, prometheusBaseURL, promQL string) (int64, bool) {
 	if prometheusBaseURL == "" {
-		return 0
+		return 0, false
 	}
 	logger := log.FromContext(ctx)
 
 	u, err := url.Parse(strings.TrimRight(prometheusBaseURL, "/") + "/api/v1/query")
 	if err != nil {
 		logger.Error(err, "Failed to parse Prometheus URL")
-		return 0
+		return 0, false
 	}
 	u.RawQuery = url.Values{"query": {promQL}}.Encode()
 
@@ -161,25 +166,25 @@ func (r *WorkloadMonitorReconciler) queryPrometheusMetric(ctx context.Context, p
 	req, err := http.NewRequestWithContext(httpCtx, http.MethodGet, u.String(), nil)
 	if err != nil {
 		logger.Error(err, "Failed to create Prometheus request")
-		return 0
+		return 0, false
 	}
 
 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		logger.V(1).Info("Failed to query Prometheus", "query", promQL, "error", err)
-		return 0
+		return 0, false
 	}
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
 		logger.V(1).Info("Prometheus returned non-OK status", "query", promQL, "status", resp.StatusCode)
-		return 0
+		return 0, false
 	}
 
 	body, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
 	if err != nil {
 		logger.Error(err, "Failed to read Prometheus response")
-		return 0
+		return 0, false
 	}
 
 	// Parse Prometheus instant query response:
@@ -194,24 +199,24 @@ func (r *WorkloadMonitorReconciler) queryPrometheusMetric(ctx context.Context, p
 	}
 	if err := json.Unmarshal(body, &promResp); err != nil {
 		logger.Error(err, "Failed to parse Prometheus response")
-		return 0
+		return 0, false
 	}
 	if promResp.Status != "success" || len(promResp.Data.Result) == 0 {
-		return 0
+		return 0, false
 	}
 
 	var valueStr string
 	if err := json.Unmarshal(promResp.Data.Result[0].Value[1], &valueStr); err != nil {
 		logger.Error(err, "Failed to parse Prometheus metric value")
-		return 0
+		return 0, false
 	}
 
 	val, err := strconv.ParseFloat(valueStr, 64)
 	if err != nil {
 		logger.Error(err, "Failed to parse metric value", "value", valueStr)
-		return 0
+		return 0, false
 	}
-	return int64(val)
+	return int64(val), true
 }
 
 // reconcileBucketClaimForMonitor creates or updates a Workload object for the given BucketClaim and WorkloadMonitor.
@@ -239,10 +244,10 @@ func (r *WorkloadMonitorReconciler) reconcileBucketClaimForMonitor(
 	// uses directly as the SeaweedFS bucket name.
 	if bn := bc.Status.BucketName; bn != "" {
 		promURL := r.resolvePrometheusURL(ctx, bc.Namespace)
-		if v := r.queryPrometheusMetric(ctx, promURL, fmt.Sprintf(`SeaweedFS_s3_bucket_size_bytes{bucket="%s"}`, bn)); v > 0 {
+		if v, ok := r.queryPrometheusMetric(ctx, promURL, fmt.Sprintf(`SeaweedFS_s3_bucket_size_bytes{bucket="%s"}`, bn)); ok {
 			resources["s3-storage-bytes"] = *resource.NewQuantity(v, resource.BinarySI)
 		}
-		if v := r.queryPrometheusMetric(ctx, promURL, fmt.Sprintf(`SeaweedFS_s3_bucket_physical_size_bytes{bucket="%s"}`, bn)); v > 0 {
+		if v, ok := r.queryPrometheusMetric(ctx, promURL, fmt.Sprintf(`SeaweedFS_s3_bucket_physical_size_bytes{bucket="%s"}`, bn)); ok {
 			resources["s3-physical-storage-bytes"] = *resource.NewQuantity(v, resource.BinarySI)
 		}
 	}
diff --git a/internal/controller/workloadmonitor_controller_test.go b/internal/controller/workloadmonitor_controller_test.go
index 71294927..f702c978 100644
--- a/internal/controller/workloadmonitor_controller_test.go
+++ b/internal/controller/workloadmonitor_controller_test.go
@@ -384,12 +384,31 @@ func TestQueryPrometheusMetric(t *testing.T) {
 	defer srv.Close()
 
 	reconciler := &WorkloadMonitorReconciler{}
-	size := reconciler.queryPrometheusMetric(context.TODO(), srv.URL, `SeaweedFS_s3_bucket_size_bytes{bucket="cosi-abc123"}`)
+	size, ok := reconciler.queryPrometheusMetric(context.TODO(), srv.URL, `SeaweedFS_s3_bucket_size_bytes{bucket="cosi-abc123"}`)
+	if !ok {
+		t.Fatal("expected ok=true for valid metric")
+	}
 	if size != 5368709120 {
 		t.Errorf("expected 5368709120, got %d", size)
 	}
 }
 
+func TestQueryPrometheusMetricZeroValue(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[{"metric":{"bucket":"empty"},"value":[1713000000,"0"]}]}}`)
+	}))
+	defer srv.Close()
+
+	reconciler := &WorkloadMonitorReconciler{}
+	size, ok := reconciler.queryPrometheusMetric(context.TODO(), srv.URL, `SeaweedFS_s3_bucket_size_bytes{bucket="empty"}`)
+	if !ok {
+		t.Fatal("expected ok=true for zero-value metric (empty bucket)")
+	}
+	if size != 0 {
+		t.Errorf("expected 0, got %d", size)
+	}
+}
+
 func TestQueryPrometheusMetricEmpty(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[]}}`)
@@ -397,9 +416,9 @@ func TestQueryPrometheusMetricEmpty(t *testing.T) {
 	defer srv.Close()
 
 	reconciler := &WorkloadMonitorReconciler{}
-	size := reconciler.queryPrometheusMetric(context.TODO(), srv.URL, `SeaweedFS_s3_bucket_size_bytes{bucket="nonexistent"}`)
-	if size != 0 {
-		t.Errorf("expected 0 for empty result, got %d", size)
+	_, ok := reconciler.queryPrometheusMetric(context.TODO(), srv.URL, `SeaweedFS_s3_bucket_size_bytes{bucket="nonexistent"}`)
+	if ok {
+		t.Error("expected ok=false for empty result")
 	}
 }
 
@@ -410,17 +429,17 @@ func TestQueryPrometheusMetricServerError(t *testing.T) {
 	defer srv.Close()
 
 	reconciler := &WorkloadMonitorReconciler{}
-	size := reconciler.queryPrometheusMetric(context.TODO(), srv.URL, `SeaweedFS_s3_bucket_size_bytes{bucket="test"}`)
-	if size != 0 {
-		t.Errorf("expected 0 for server error, got %d", size)
+	_, ok := reconciler.queryPrometheusMetric(context.TODO(), srv.URL, `SeaweedFS_s3_bucket_size_bytes{bucket="test"}`)
+	if ok {
+		t.Error("expected ok=false for server error")
 	}
 }
 
 func TestQueryPrometheusMetricNoURL(t *testing.T) {
 	reconciler := &WorkloadMonitorReconciler{}
-	size := reconciler.queryPrometheusMetric(context.TODO(), "", `anything`)
-	if size != 0 {
-		t.Errorf("expected 0 when PrometheusURL is empty, got %d", size)
+	_, ok := reconciler.queryPrometheusMetric(context.TODO(), "", `anything`)
+	if ok {
+		t.Error("expected ok=false when PrometheusURL is empty")
 	}
 }
 

From ed9808fad6069a996db2ea3147d2ee762286c574 Mon Sep 17 00:00:00 2001
From: ZverGuy <maximbel2003@gmail.com>
Date: Tue, 14 Apr 2026 14:44:38 +0300
Subject: [PATCH 504/666] perf(controller): resolve Prometheus URL once per
 reconcile, not per BucketClaim
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move resolvePrometheusURL call before the BucketClaim loop and pass
the URL as parameter. Avoids redundant namespace lookups and reduces
reconcile time from 2×N+1 to 2×N HTTP calls (where N = BucketClaims).

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
---
 internal/controller/workloadmonitor_controller.go | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/internal/controller/workloadmonitor_controller.go b/internal/controller/workloadmonitor_controller.go
index 5b450d75..cb070e0c 100644
--- a/internal/controller/workloadmonitor_controller.go
+++ b/internal/controller/workloadmonitor_controller.go
@@ -224,6 +224,7 @@ func (r *WorkloadMonitorReconciler) reconcileBucketClaimForMonitor(
 	ctx context.Context,
 	monitor *cozyv1alpha1.WorkloadMonitor,
 	bc cosiv1alpha1.BucketClaim,
+	promURL string,
 ) error {
 	logger := log.FromContext(ctx)
 	workload := &cozyv1alpha1.Workload{
@@ -243,7 +244,6 @@ func (r *WorkloadMonitorReconciler) reconcileBucketClaimForMonitor(
 	// bc.Status.BucketName is the COSI Bucket name, which the COSI driver
 	// uses directly as the SeaweedFS bucket name.
 	if bn := bc.Status.BucketName; bn != "" {
-		promURL := r.resolvePrometheusURL(ctx, bc.Namespace)
 		if v, ok := r.queryPrometheusMetric(ctx, promURL, fmt.Sprintf(`SeaweedFS_s3_bucket_size_bytes{bucket="%s"}`, bn)); ok {
 			resources["s3-storage-bytes"] = *resource.NewQuantity(v, resource.BinarySI)
 		}
@@ -563,8 +563,9 @@ func (r *WorkloadMonitorReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		return ctrl.Result{}, err
 	}
 
+	bucketPromURL := r.resolvePrometheusURL(ctx, monitor.Namespace)
 	for _, bc := range bucketClaimList.Items {
-		if err := r.reconcileBucketClaimForMonitor(ctx, monitor, bc); err != nil {
+		if err := r.reconcileBucketClaimForMonitor(ctx, monitor, bc, bucketPromURL); err != nil {
 			logger.Error(err, "Failed to reconcile Workload for BucketClaim", "BucketClaim", bc.Name)
 			continue
 		}

From 475d24b0296ccee0a0cd9b03553ab29df17d8d97 Mon Sep 17 00:00:00 2001
From: ZverGuy <maximbel2003@gmail.com>
Date: Tue, 14 Apr 2026 14:47:15 +0300
Subject: [PATCH 505/666] perf(controller): batch all bucket metrics into
 single Prometheus query
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace 2×N per-bucket HTTP requests with a single query that fetches
all SeaweedFS bucket size metrics at once:

  {__name__=~"SeaweedFS_s3_bucket_(size|physical_size)_bytes"}

Results are keyed by bucket name in memory, then looked up per
BucketClaim. This reduces HTTP round-trips from 2N+1 to 2 (one
namespace lookup + one Prometheus query) regardless of bucket count.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
---
 .../controller/workloadmonitor_controller.go  | 113 +++++++++++-------
 .../workloadmonitor_controller_test.go        |  72 +++++------
 2 files changed, 108 insertions(+), 77 deletions(-)

diff --git a/internal/controller/workloadmonitor_controller.go b/internal/controller/workloadmonitor_controller.go
index cb070e0c..63ca02cb 100644
--- a/internal/controller/workloadmonitor_controller.go
+++ b/internal/controller/workloadmonitor_controller.go
@@ -143,80 +143,109 @@ func (r *WorkloadMonitorReconciler) resolvePrometheusURL(ctx context.Context, na
 	return fmt.Sprintf("http://%s.%s.svc:%s%s", vmSelectService, monitoringNS, vmSelectPort, vmSelectPath)
 }
 
-// queryPrometheusMetric queries a Prometheus-compatible API for a single instant value.
-// Returns the value and true if the metric was found, or 0 and false if the query
-// failed or no metric exists. This distinction allows callers to emit a resource
-// with value 0 for empty buckets vs omitting it when monitoring is unavailable.
-func (r *WorkloadMonitorReconciler) queryPrometheusMetric(ctx context.Context, prometheusBaseURL, promQL string) (int64, bool) {
+// bucketMetrics holds size metrics for a single bucket, keyed by metric name.
+type bucketMetrics struct {
+	LogicalSize  int64
+	PhysicalSize int64
+	HasLogical   bool
+	HasPhysical  bool
+}
+
+// queryAllBucketMetrics fetches all SeaweedFS bucket size metrics in a single
+// Prometheus query and returns them keyed by bucket name. This avoids 2×N HTTP
+// round-trips when there are N buckets.
+func (r *WorkloadMonitorReconciler) queryAllBucketMetrics(ctx context.Context, prometheusBaseURL string) map[string]*bucketMetrics {
+	result := make(map[string]*bucketMetrics)
 	if prometheusBaseURL == "" {
-		return 0, false
+		return result
 	}
 	logger := log.FromContext(ctx)
 
+	query := `{__name__=~"SeaweedFS_s3_bucket_(size|physical_size)_bytes"}`
 	u, err := url.Parse(strings.TrimRight(prometheusBaseURL, "/") + "/api/v1/query")
 	if err != nil {
 		logger.Error(err, "Failed to parse Prometheus URL")
-		return 0, false
+		return result
 	}
-	u.RawQuery = url.Values{"query": {promQL}}.Encode()
+	u.RawQuery = url.Values{"query": {query}}.Encode()
 
-	httpCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	httpCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
 	defer cancel()
 
 	req, err := http.NewRequestWithContext(httpCtx, http.MethodGet, u.String(), nil)
 	if err != nil {
 		logger.Error(err, "Failed to create Prometheus request")
-		return 0, false
+		return result
 	}
 
 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
-		logger.V(1).Info("Failed to query Prometheus", "query", promQL, "error", err)
-		return 0, false
+		logger.V(1).Info("Failed to query Prometheus for bucket metrics", "error", err)
+		return result
 	}
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
-		logger.V(1).Info("Prometheus returned non-OK status", "query", promQL, "status", resp.StatusCode)
-		return 0, false
+		logger.V(1).Info("Prometheus returned non-OK status for bucket metrics", "status", resp.StatusCode)
+		return result
 	}
 
-	body, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
 	if err != nil {
 		logger.Error(err, "Failed to read Prometheus response")
-		return 0, false
+		return result
 	}
 
-	// Parse Prometheus instant query response:
-	// {"status":"success","data":{"resultType":"vector","result":[{"metric":{...},"value":[timestamp,"value"]}]}}
 	var promResp struct {
 		Status string `json:"status"`
 		Data   struct {
 			Result []struct {
-				Value [2]json.RawMessage `json:"value"`
+				Metric map[string]string  `json:"metric"`
+				Value  [2]json.RawMessage `json:"value"`
 			} `json:"result"`
 		} `json:"data"`
 	}
 	if err := json.Unmarshal(body, &promResp); err != nil {
 		logger.Error(err, "Failed to parse Prometheus response")
-		return 0, false
+		return result
 	}
-	if promResp.Status != "success" || len(promResp.Data.Result) == 0 {
-		return 0, false
+	if promResp.Status != "success" {
+		return result
 	}
 
-	var valueStr string
-	if err := json.Unmarshal(promResp.Data.Result[0].Value[1], &valueStr); err != nil {
-		logger.Error(err, "Failed to parse Prometheus metric value")
-		return 0, false
+	for _, r := range promResp.Data.Result {
+		bucket := r.Metric["bucket"]
+		metricName := r.Metric["__name__"]
+		if bucket == "" || metricName == "" {
+			continue
+		}
+
+		var valueStr string
+		if err := json.Unmarshal(r.Value[1], &valueStr); err != nil {
+			continue
+		}
+		val, err := strconv.ParseFloat(valueStr, 64)
+		if err != nil {
+			continue
+		}
+
+		bm, ok := result[bucket]
+		if !ok {
+			bm = &bucketMetrics{}
+			result[bucket] = bm
+		}
+
+		switch metricName {
+		case "SeaweedFS_s3_bucket_size_bytes":
+			bm.LogicalSize = int64(val)
+			bm.HasLogical = true
+		case "SeaweedFS_s3_bucket_physical_size_bytes":
+			bm.PhysicalSize = int64(val)
+			bm.HasPhysical = true
+		}
 	}
 
-	val, err := strconv.ParseFloat(valueStr, 64)
-	if err != nil {
-		logger.Error(err, "Failed to parse metric value", "value", valueStr)
-		return 0, false
-	}
-	return int64(val), true
+	return result
 }
 
 // reconcileBucketClaimForMonitor creates or updates a Workload object for the given BucketClaim and WorkloadMonitor.
@@ -224,7 +253,7 @@ func (r *WorkloadMonitorReconciler) reconcileBucketClaimForMonitor(
 	ctx context.Context,
 	monitor *cozyv1alpha1.WorkloadMonitor,
 	bc cosiv1alpha1.BucketClaim,
-	promURL string,
+	allMetrics map[string]*bucketMetrics,
 ) error {
 	logger := log.FromContext(ctx)
 	workload := &cozyv1alpha1.Workload{
@@ -237,18 +266,15 @@ func (r *WorkloadMonitorReconciler) reconcileBucketClaimForMonitor(
 
 	resources := make(map[string]resource.Quantity)
 
-	// Query actual bucket sizes from SeaweedFS metrics via Prometheus.
-	// The monitoring endpoint is resolved from the namespace label
-	// namespace.cozystack.io/monitoring, which points to the tenant
-	// namespace hosting VictoriaMetrics.
+	// Look up pre-fetched bucket metrics by the SeaweedFS bucket name.
 	// bc.Status.BucketName is the COSI Bucket name, which the COSI driver
 	// uses directly as the SeaweedFS bucket name.
-	if bn := bc.Status.BucketName; bn != "" {
-		if v, ok := r.queryPrometheusMetric(ctx, promURL, fmt.Sprintf(`SeaweedFS_s3_bucket_size_bytes{bucket="%s"}`, bn)); ok {
-			resources["s3-storage-bytes"] = *resource.NewQuantity(v, resource.BinarySI)
+	if bm, ok := allMetrics[bc.Status.BucketName]; ok {
+		if bm.HasLogical {
+			resources["s3-storage-bytes"] = *resource.NewQuantity(bm.LogicalSize, resource.BinarySI)
 		}
-		if v, ok := r.queryPrometheusMetric(ctx, promURL, fmt.Sprintf(`SeaweedFS_s3_bucket_physical_size_bytes{bucket="%s"}`, bn)); ok {
-			resources["s3-physical-storage-bytes"] = *resource.NewQuantity(v, resource.BinarySI)
+		if bm.HasPhysical {
+			resources["s3-physical-storage-bytes"] = *resource.NewQuantity(bm.PhysicalSize, resource.BinarySI)
 		}
 	}
 
@@ -564,8 +590,9 @@ func (r *WorkloadMonitorReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 	}
 
 	bucketPromURL := r.resolvePrometheusURL(ctx, monitor.Namespace)
+	allBucketMetrics := r.queryAllBucketMetrics(ctx, bucketPromURL)
 	for _, bc := range bucketClaimList.Items {
-		if err := r.reconcileBucketClaimForMonitor(ctx, monitor, bc, bucketPromURL); err != nil {
+		if err := r.reconcileBucketClaimForMonitor(ctx, monitor, bc, allBucketMetrics); err != nil {
 			logger.Error(err, "Failed to reconcile Workload for BucketClaim", "BucketClaim", bc.Name)
 			continue
 		}
diff --git a/internal/controller/workloadmonitor_controller_test.go b/internal/controller/workloadmonitor_controller_test.go
index f702c978..5bb3397e 100644
--- a/internal/controller/workloadmonitor_controller_test.go
+++ b/internal/controller/workloadmonitor_controller_test.go
@@ -377,69 +377,73 @@ func TestReconcileNoBucketClaimSkips(t *testing.T) {
 	}
 }
 
-func TestQueryPrometheusMetric(t *testing.T) {
+func TestQueryAllBucketMetrics(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[{"metric":{"bucket":"cosi-abc123"},"value":[1713000000,"5368709120"]}]}}`)
+		fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[
+			{"metric":{"__name__":"SeaweedFS_s3_bucket_size_bytes","bucket":"bucket-aaa"},"value":[1713000000,"10485864"]},
+			{"metric":{"__name__":"SeaweedFS_s3_bucket_physical_size_bytes","bucket":"bucket-aaa"},"value":[1713000000,"20971728"]},
+			{"metric":{"__name__":"SeaweedFS_s3_bucket_size_bytes","bucket":"bucket-bbb"},"value":[1713000000,"0"]}
+		]}}`)
 	}))
 	defer srv.Close()
 
 	reconciler := &WorkloadMonitorReconciler{}
-	size, ok := reconciler.queryPrometheusMetric(context.TODO(), srv.URL, `SeaweedFS_s3_bucket_size_bytes{bucket="cosi-abc123"}`)
+	metrics := reconciler.queryAllBucketMetrics(context.TODO(), srv.URL)
+
+	bm, ok := metrics["bucket-aaa"]
 	if !ok {
-		t.Fatal("expected ok=true for valid metric")
+		t.Fatal("expected bucket-aaa in metrics")
 	}
-	if size != 5368709120 {
-		t.Errorf("expected 5368709120, got %d", size)
+	if !bm.HasLogical || bm.LogicalSize != 10485864 {
+		t.Errorf("expected logical=10485864, got %d", bm.LogicalSize)
+	}
+	if !bm.HasPhysical || bm.PhysicalSize != 20971728 {
+		t.Errorf("expected physical=20971728, got %d", bm.PhysicalSize)
+	}
+
+	bm2, ok := metrics["bucket-bbb"]
+	if !ok {
+		t.Fatal("expected bucket-bbb in metrics")
+	}
+	if !bm2.HasLogical || bm2.LogicalSize != 0 {
+		t.Errorf("expected logical=0 for empty bucket, got %d", bm2.LogicalSize)
+	}
+	if bm2.HasPhysical {
+		t.Error("expected no physical size for bucket-bbb")
 	}
 }
 
-func TestQueryPrometheusMetricZeroValue(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[{"metric":{"bucket":"empty"},"value":[1713000000,"0"]}]}}`)
-	}))
-	defer srv.Close()
-
-	reconciler := &WorkloadMonitorReconciler{}
-	size, ok := reconciler.queryPrometheusMetric(context.TODO(), srv.URL, `SeaweedFS_s3_bucket_size_bytes{bucket="empty"}`)
-	if !ok {
-		t.Fatal("expected ok=true for zero-value metric (empty bucket)")
-	}
-	if size != 0 {
-		t.Errorf("expected 0, got %d", size)
-	}
-}
-
-func TestQueryPrometheusMetricEmpty(t *testing.T) {
+func TestQueryAllBucketMetricsEmpty(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[]}}`)
 	}))
 	defer srv.Close()
 
 	reconciler := &WorkloadMonitorReconciler{}
-	_, ok := reconciler.queryPrometheusMetric(context.TODO(), srv.URL, `SeaweedFS_s3_bucket_size_bytes{bucket="nonexistent"}`)
-	if ok {
-		t.Error("expected ok=false for empty result")
+	metrics := reconciler.queryAllBucketMetrics(context.TODO(), srv.URL)
+	if len(metrics) != 0 {
+		t.Errorf("expected empty metrics, got %d", len(metrics))
 	}
 }
 
-func TestQueryPrometheusMetricServerError(t *testing.T) {
+func TestQueryAllBucketMetricsServerError(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusInternalServerError)
 	}))
 	defer srv.Close()
 
 	reconciler := &WorkloadMonitorReconciler{}
-	_, ok := reconciler.queryPrometheusMetric(context.TODO(), srv.URL, `SeaweedFS_s3_bucket_size_bytes{bucket="test"}`)
-	if ok {
-		t.Error("expected ok=false for server error")
+	metrics := reconciler.queryAllBucketMetrics(context.TODO(), srv.URL)
+	if len(metrics) != 0 {
+		t.Errorf("expected empty metrics on error, got %d", len(metrics))
 	}
 }
 
-func TestQueryPrometheusMetricNoURL(t *testing.T) {
+func TestQueryAllBucketMetricsNoURL(t *testing.T) {
 	reconciler := &WorkloadMonitorReconciler{}
-	_, ok := reconciler.queryPrometheusMetric(context.TODO(), "", `anything`)
-	if ok {
-		t.Error("expected ok=false when PrometheusURL is empty")
+	metrics := reconciler.queryAllBucketMetrics(context.TODO(), "")
+	if len(metrics) != 0 {
+		t.Errorf("expected empty metrics when URL is empty, got %d", len(metrics))
 	}
 }
 

From 8183b4669a68aef38a606f0430101ead6b88439d Mon Sep 17 00:00:00 2001
From: ZverGuy <maximbel2003@gmail.com>
Date: Tue, 14 Apr 2026 14:59:45 +0300
Subject: [PATCH 506/666] perf(controller): skip Prometheus calls when no
 BucketClaims matched

Wrap resolvePrometheusURL and queryAllBucketMetrics in a
len(bucketClaimList.Items) > 0 guard. Avoids unnecessary namespace
GET and HTTP request to Prometheus on every reconcile of non-bucket
WorkloadMonitors (postgres, redis, kubernetes, etc.).

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
---
 internal/controller/workloadmonitor_controller.go | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/internal/controller/workloadmonitor_controller.go b/internal/controller/workloadmonitor_controller.go
index 63ca02cb..af61ac47 100644
--- a/internal/controller/workloadmonitor_controller.go
+++ b/internal/controller/workloadmonitor_controller.go
@@ -589,12 +589,14 @@ func (r *WorkloadMonitorReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		return ctrl.Result{}, err
 	}
 
-	bucketPromURL := r.resolvePrometheusURL(ctx, monitor.Namespace)
-	allBucketMetrics := r.queryAllBucketMetrics(ctx, bucketPromURL)
-	for _, bc := range bucketClaimList.Items {
-		if err := r.reconcileBucketClaimForMonitor(ctx, monitor, bc, allBucketMetrics); err != nil {
-			logger.Error(err, "Failed to reconcile Workload for BucketClaim", "BucketClaim", bc.Name)
-			continue
+	if len(bucketClaimList.Items) > 0 {
+		bucketPromURL := r.resolvePrometheusURL(ctx, monitor.Namespace)
+		allBucketMetrics := r.queryAllBucketMetrics(ctx, bucketPromURL)
+		for _, bc := range bucketClaimList.Items {
+			if err := r.reconcileBucketClaimForMonitor(ctx, monitor, bc, allBucketMetrics); err != nil {
+				logger.Error(err, "Failed to reconcile Workload for BucketClaim", "BucketClaim", bc.Name)
+				continue
+			}
 		}
 	}
 

From c72fadec3e695154d64288c0a0150ef0f454db61 Mon Sep 17 00:00:00 2001
From: ZverGuy <maximbel2003@gmail.com>
Date: Tue, 14 Apr 2026 16:30:20 +0300
Subject: [PATCH 507/666] fix(controller): scope Prometheus query to only
 matched bucket names
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pass bucket names from BucketClaim.Status.BucketName into the PromQL
query as a bucket=~"name1|name2" filter. This prevents O(N²) load
where N WorkloadMonitors each fetch all buckets globally.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
---
 .../controller/workloadmonitor_controller.go  | 21 ++++++++++++-------
 .../workloadmonitor_controller_test.go        |  8 +++----
 2 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/internal/controller/workloadmonitor_controller.go b/internal/controller/workloadmonitor_controller.go
index af61ac47..7629868d 100644
--- a/internal/controller/workloadmonitor_controller.go
+++ b/internal/controller/workloadmonitor_controller.go
@@ -151,17 +151,18 @@ type bucketMetrics struct {
 	HasPhysical  bool
 }
 
-// queryAllBucketMetrics fetches all SeaweedFS bucket size metrics in a single
-// Prometheus query and returns them keyed by bucket name. This avoids 2×N HTTP
-// round-trips when there are N buckets.
-func (r *WorkloadMonitorReconciler) queryAllBucketMetrics(ctx context.Context, prometheusBaseURL string) map[string]*bucketMetrics {
+// queryAllBucketMetrics fetches SeaweedFS bucket size metrics for the given
+// bucket names in a single Prometheus query and returns them keyed by bucket
+// name. The query is scoped to only the requested buckets to avoid fetching
+// metrics for buckets belonging to other WorkloadMonitors.
+func (r *WorkloadMonitorReconciler) queryAllBucketMetrics(ctx context.Context, prometheusBaseURL string, bucketNames []string) map[string]*bucketMetrics {
 	result := make(map[string]*bucketMetrics)
-	if prometheusBaseURL == "" {
+	if prometheusBaseURL == "" || len(bucketNames) == 0 {
 		return result
 	}
 	logger := log.FromContext(ctx)
 
-	query := `{__name__=~"SeaweedFS_s3_bucket_(size|physical_size)_bytes"}`
+	query := fmt.Sprintf(`{__name__=~"SeaweedFS_s3_bucket_(size|physical_size)_bytes",bucket=~"%s"}`, strings.Join(bucketNames, "|"))
 	u, err := url.Parse(strings.TrimRight(prometheusBaseURL, "/") + "/api/v1/query")
 	if err != nil {
 		logger.Error(err, "Failed to parse Prometheus URL")
@@ -591,7 +592,13 @@ func (r *WorkloadMonitorReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 
 	if len(bucketClaimList.Items) > 0 {
 		bucketPromURL := r.resolvePrometheusURL(ctx, monitor.Namespace)
-		allBucketMetrics := r.queryAllBucketMetrics(ctx, bucketPromURL)
+		var bucketNames []string
+		for _, bc := range bucketClaimList.Items {
+			if bc.Status.BucketName != "" {
+				bucketNames = append(bucketNames, bc.Status.BucketName)
+			}
+		}
+		allBucketMetrics := r.queryAllBucketMetrics(ctx, bucketPromURL, bucketNames)
 		for _, bc := range bucketClaimList.Items {
 			if err := r.reconcileBucketClaimForMonitor(ctx, monitor, bc, allBucketMetrics); err != nil {
 				logger.Error(err, "Failed to reconcile Workload for BucketClaim", "BucketClaim", bc.Name)
diff --git a/internal/controller/workloadmonitor_controller_test.go b/internal/controller/workloadmonitor_controller_test.go
index 5bb3397e..2d487000 100644
--- a/internal/controller/workloadmonitor_controller_test.go
+++ b/internal/controller/workloadmonitor_controller_test.go
@@ -388,7 +388,7 @@ func TestQueryAllBucketMetrics(t *testing.T) {
 	defer srv.Close()
 
 	reconciler := &WorkloadMonitorReconciler{}
-	metrics := reconciler.queryAllBucketMetrics(context.TODO(), srv.URL)
+	metrics := reconciler.queryAllBucketMetrics(context.TODO(), srv.URL, []string{"bucket-aaa", "bucket-bbb"})
 
 	bm, ok := metrics["bucket-aaa"]
 	if !ok {
@@ -420,7 +420,7 @@ func TestQueryAllBucketMetricsEmpty(t *testing.T) {
 	defer srv.Close()
 
 	reconciler := &WorkloadMonitorReconciler{}
-	metrics := reconciler.queryAllBucketMetrics(context.TODO(), srv.URL)
+	metrics := reconciler.queryAllBucketMetrics(context.TODO(), srv.URL, []string{"bucket-aaa", "bucket-bbb"})
 	if len(metrics) != 0 {
 		t.Errorf("expected empty metrics, got %d", len(metrics))
 	}
@@ -433,7 +433,7 @@ func TestQueryAllBucketMetricsServerError(t *testing.T) {
 	defer srv.Close()
 
 	reconciler := &WorkloadMonitorReconciler{}
-	metrics := reconciler.queryAllBucketMetrics(context.TODO(), srv.URL)
+	metrics := reconciler.queryAllBucketMetrics(context.TODO(), srv.URL, []string{"bucket-aaa", "bucket-bbb"})
 	if len(metrics) != 0 {
 		t.Errorf("expected empty metrics on error, got %d", len(metrics))
 	}
@@ -441,7 +441,7 @@ func TestQueryAllBucketMetricsServerError(t *testing.T) {
 
 func TestQueryAllBucketMetricsNoURL(t *testing.T) {
 	reconciler := &WorkloadMonitorReconciler{}
-	metrics := reconciler.queryAllBucketMetrics(context.TODO(), "")
+	metrics := reconciler.queryAllBucketMetrics(context.TODO(), "", nil)
 	if len(metrics) != 0 {
 		t.Errorf("expected empty metrics when URL is empty, got %d", len(metrics))
 	}

From 3803e6e070e987f0f2729bd8ec9d039ae2d6aa65 Mon Sep 17 00:00:00 2001
From: ZverGuy <maximbel2003@gmail.com>
Date: Tue, 14 Apr 2026 16:36:40 +0300
Subject: [PATCH 508/666] fix(controller): use dedicated HTTP client instead of
 http.DefaultClient

Replace http.DefaultClient with a package-level *http.Client with an
explicit 10-second timeout. Avoids sharing the process-wide default
transport with other libraries.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
---
 internal/controller/workloadmonitor_controller.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/internal/controller/workloadmonitor_controller.go b/internal/controller/workloadmonitor_controller.go
index 7629868d..3bc3c1aa 100644
--- a/internal/controller/workloadmonitor_controller.go
+++ b/internal/controller/workloadmonitor_controller.go
@@ -42,6 +42,10 @@ const (
 	vmSelectPath    = "/select/0/prometheus"
 )
 
+// prometheusHTTPClient is a dedicated HTTP client for Prometheus queries,
+// avoiding the shared http.DefaultClient global.
+var prometheusHTTPClient = &http.Client{Timeout: 10 * time.Second}
+
 // WorkloadMonitorReconciler reconciles a WorkloadMonitor object
 type WorkloadMonitorReconciler struct {
 	client.Client
@@ -179,7 +183,7 @@ func (r *WorkloadMonitorReconciler) queryAllBucketMetrics(ctx context.Context, p
 		return result
 	}
 
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := prometheusHTTPClient.Do(req)
 	if err != nil {
 		logger.V(1).Info("Failed to query Prometheus for bucket metrics", "error", err)
 		return result

From 2c141d3f3804bd4e45fb784c0dd28dd017684e74 Mon Sep 17 00:00:00 2001
From: Andrey Kolkov <androndo@gmail.com>
Date: Fri, 17 Apr 2026 14:16:40 +0400
Subject: [PATCH 509/666] feat(platform): add resourcePreset labels

Signed-off-by: Andrey Kolkov <androndo@gmail.com>
---
 .../controller/workloadmonitor_controller.go  |  60 +++-
 .../workloadmonitor_controller_test.go        | 270 ++++++++++++++++++
 .../clickhouse/templates/workloadmonitor.yaml |   4 +
 .../templates/workloadmonitor.yaml            |   1 +
 packages/apps/harbor/templates/harbor.yaml    |   4 +
 .../http-cache/templates/workloadmonitor.yaml |   4 +
 .../apps/kafka/templates/workloadmonitor.yaml |   4 +
 .../mariadb/templates/workloadmonitor.yaml    |   2 +
 packages/apps/mongodb/templates/mongodb.yaml  |   2 +
 .../apps/nats/templates/workloadmonitor.yaml  |   2 +
 .../openbao/templates/workloadmonitor.yaml    |   2 +
 .../apps/opensearch/templates/opensearch.yaml |   2 +
 packages/apps/postgres/templates/db.yaml      |   2 +
 .../templates/dashboard-resourcemap.yaml      |   2 +
 .../rabbitmq/templates/workloadmonitor.yaml   |   2 +
 .../apps/redis/templates/redisfailover.yaml   |   4 +
 .../templates/workloadmonitor.yaml            |   2 +
 .../apps/vpn/templates/workloadmonitor.yaml   |   2 +
 18 files changed, 367 insertions(+), 4 deletions(-)

diff --git a/internal/controller/workloadmonitor_controller.go b/internal/controller/workloadmonitor_controller.go
index 3bc3c1aa..35906a87 100644
--- a/internal/controller/workloadmonitor_controller.go
+++ b/internal/controller/workloadmonitor_controller.go
@@ -35,6 +35,11 @@ const (
 	// namespaceMonitoringLabel is the namespace label that indicates which tenant
 	// namespace hosts the monitoring stack (VictoriaMetrics/Prometheus).
 	namespaceMonitoringLabel = "namespace.cozystack.io/monitoring"
+	workloadLabelPrefix      = "workloads.cozystack.io/"
+	// workloadMonitorLabel is reserved: it names the WorkloadMonitor that owns
+	// the Workload and is always set by the reconciler, so it is never copied
+	// from monitor labels.
+	workloadMonitorLabel = workloadLabelPrefix + "monitor"
 	// vmSelectService is the well-known service name for VictoriaMetrics vmselect
 	// within a monitoring namespace. Port 8481, path /select/0/prometheus.
 	vmSelectService = "vmselect-shortterm"
@@ -283,16 +288,21 @@ func (r *WorkloadMonitorReconciler) reconcileBucketClaimForMonitor(
 		}
 	}
 
+	monitorLabels := r.getMonitorLabels(monitor)
 	_, err := ctrl.CreateOrUpdate(ctx, r.Client, workload, func() error {
 		updateOwnerReferences(workload.GetObjectMeta(), &bc)
 
 		if workload.Labels == nil {
 			workload.Labels = make(map[string]string)
 		}
+		// Apply monitor-level labels first so source-object labels can override on conflict
+		for k, v := range monitorLabels {
+			workload.Labels[k] = v
+		}
 		for k, v := range bc.Labels {
 			workload.Labels[k] = v
 		}
-		workload.Labels["workloads.cozystack.io/monitor"] = monitor.Name
+		workload.Labels[workloadMonitorLabel] = monitor.Name
 
 		workload.Status.Kind = monitor.Spec.Kind
 		workload.Status.Type = monitor.Spec.Type
@@ -345,14 +355,22 @@ func (r *WorkloadMonitorReconciler) reconcileServiceForMonitor(
 	resourceLabel = fmt.Sprintf("%s.ipaddresspool.metallb.io/requests.ipaddresses", resourceLabel)
 	resources[resourceLabel] = quantity
 
+	monitorLabels := r.getMonitorLabels(monitor)
 	_, err := ctrl.CreateOrUpdate(ctx, r.Client, workload, func() error {
 		// Update owner references with the new monitor
 		updateOwnerReferences(workload.GetObjectMeta(), &svc)
 
+		// Apply monitor-level labels first so source-object labels can override on conflict
+		if workload.Labels == nil {
+			workload.Labels = make(map[string]string)
+		}
+		for k, v := range monitorLabels {
+			workload.Labels[k] = v
+		}
 		for k, v := range svc.Labels {
 			workload.Labels[k] = v
 		}
-		workload.Labels["workloads.cozystack.io/monitor"] = monitor.Name
+		workload.Labels[workloadMonitorLabel] = monitor.Name
 
 		// Fill Workload status fields:
 		workload.Status.Kind = monitor.Spec.Kind
@@ -396,14 +414,22 @@ func (r *WorkloadMonitorReconciler) reconcilePVCForMonitor(
 		resources[resourceLabel] = resourceQuantity
 	}
 
+	monitorLabels := r.getMonitorLabels(monitor)
 	_, err := ctrl.CreateOrUpdate(ctx, r.Client, workload, func() error {
 		// Update owner references with the new monitor
 		updateOwnerReferences(workload.GetObjectMeta(), &pvc)
 
+		// Apply monitor-level labels first so source-object labels can override on conflict
+		if workload.Labels == nil {
+			workload.Labels = make(map[string]string)
+		}
+		for k, v := range monitorLabels {
+			workload.Labels[k] = v
+		}
 		for k, v := range pvc.Labels {
 			workload.Labels[k] = v
 		}
-		workload.Labels["workloads.cozystack.io/monitor"] = monitor.Name
+		workload.Labels[workloadMonitorLabel] = monitor.Name
 
 		// Fill Workload status fields:
 		workload.Status.Kind = monitor.Spec.Kind
@@ -470,14 +496,22 @@ func (r *WorkloadMonitorReconciler) reconcilePodForMonitor(
 	}
 
 	metaLabels := r.getWorkloadMetadata(&pod)
+	monitorLabels := r.getMonitorLabels(monitor)
 	_, err := ctrl.CreateOrUpdate(ctx, r.Client, workload, func() error {
 		// Update owner references with the new monitor
 		updateOwnerReferences(workload.GetObjectMeta(), &pod)
 
+		// Apply monitor-level labels first so source-object labels can override on conflict
+		if workload.Labels == nil {
+			workload.Labels = make(map[string]string)
+		}
+		for k, v := range monitorLabels {
+			workload.Labels[k] = v
+		}
 		for k, v := range pod.Labels {
 			workload.Labels[k] = v
 		}
-		workload.Labels["workloads.cozystack.io/monitor"] = monitor.Name
+		workload.Labels[workloadMonitorLabel] = monitor.Name
 
 		// Add workload meta to labels
 		for k, v := range metaLabels {
@@ -720,3 +754,21 @@ func (r *WorkloadMonitorReconciler) getWorkloadMetadata(obj client.Object) map[s
 	}
 	return labels
 }
+
+// getMonitorLabels extracts workloads.cozystack.io/* labels from a WorkloadMonitor
+// so they can be propagated onto Workload objects created for pods, PVCs, services,
+// or bucket claims. The monitor label "workloads.cozystack.io/monitor" is reserved
+// and set separately per Workload, so it is excluded here.
+func (r *WorkloadMonitorReconciler) getMonitorLabels(monitor *cozyv1alpha1.WorkloadMonitor) map[string]string {
+	labels := make(map[string]string)
+	for k, v := range monitor.GetLabels() {
+		if !strings.HasPrefix(k, workloadLabelPrefix) {
+			continue
+		}
+		if k == workloadMonitorLabel {
+			continue
+		}
+		labels[k] = v
+	}
+	return labels
+}
diff --git a/internal/controller/workloadmonitor_controller_test.go b/internal/controller/workloadmonitor_controller_test.go
index 2d487000..355b0379 100644
--- a/internal/controller/workloadmonitor_controller_test.go
+++ b/internal/controller/workloadmonitor_controller_test.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 
 	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
@@ -141,6 +142,199 @@ func TestReconcile_OperationalTrue_WhenEnoughReplicas(t *testing.T) {
 	}
 }
 
+func TestGetMonitorLabels(t *testing.T) {
+	tests := []struct {
+		name     string
+		labels   map[string]string
+		expected map[string]string
+	}{
+		{
+			name:     "nil labels",
+			labels:   nil,
+			expected: map[string]string{},
+		},
+		{
+			name: "only workloads.cozystack.io/* labels are propagated",
+			labels: map[string]string{
+				"workloads.cozystack.io/resource-preset": "medium",
+				"app.kubernetes.io/name":                 "postgres",
+				"custom.example.com/team":                "platform",
+			},
+			expected: map[string]string{
+				"workloads.cozystack.io/resource-preset": "medium",
+			},
+		},
+		{
+			name: "monitor label is reserved and excluded",
+			labels: map[string]string{
+				"workloads.cozystack.io/resource-preset": "small",
+				"workloads.cozystack.io/monitor":         "should-be-dropped",
+			},
+			expected: map[string]string{
+				"workloads.cozystack.io/resource-preset": "small",
+			},
+		},
+		{
+			name: "multiple workloads.cozystack.io labels propagate",
+			labels: map[string]string{
+				"workloads.cozystack.io/resource-preset": "large",
+				"workloads.cozystack.io/tier":            "db",
+			},
+			expected: map[string]string{
+				"workloads.cozystack.io/resource-preset": "large",
+				"workloads.cozystack.io/tier":            "db",
+			},
+		},
+		{
+			name: "no matching labels returns empty map",
+			labels: map[string]string{
+				"app.kubernetes.io/name": "postgres",
+			},
+			expected: map[string]string{},
+		},
+	}
+
+	r := &WorkloadMonitorReconciler{}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			monitor := &cozyv1alpha1.WorkloadMonitor{
+				ObjectMeta: metav1.ObjectMeta{Labels: tc.labels},
+			}
+			got := r.getMonitorLabels(monitor)
+			if len(got) != len(tc.expected) {
+				t.Fatalf("expected %d labels, got %d (%v)", len(tc.expected), len(got), got)
+			}
+			for k, v := range tc.expected {
+				if gv, ok := got[k]; !ok || gv != v {
+					t.Errorf("expected label %q=%q, got %q", k, v, gv)
+				}
+			}
+		})
+	}
+}
+
+func TestReconcile_MonitorLabelsPropagatedToPodWorkload(t *testing.T) {
+	scheme := runtime.NewScheme()
+	_ = cozyv1alpha1.AddToScheme(scheme)
+	_ = corev1.AddToScheme(scheme)
+
+	monitor := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-monitor",
+			Namespace: "default",
+			Labels: map[string]string{
+				"workloads.cozystack.io/resource-preset": "medium",
+				"app.kubernetes.io/name":                 "ignored-not-propagated",
+			},
+		},
+		Spec: cozyv1alpha1.WorkloadMonitorSpec{
+			Selector: map[string]string{"app": "test"},
+			Kind:     "postgres",
+			Type:     "postgres",
+		},
+	}
+
+	pod := &corev1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-pod-1",
+			Namespace: "default",
+			Labels: map[string]string{
+				"app":                    "test",
+				"app.kubernetes.io/name": "pod-wins-on-conflict",
+			},
+		},
+		Status: corev1.PodStatus{
+			Conditions: []corev1.PodCondition{
+				{Type: corev1.PodReady, Status: corev1.ConditionTrue},
+			},
+		},
+	}
+
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(monitor, pod).
+		WithStatusSubresource(monitor).
+		Build()
+
+	reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: scheme}
+	req := reconcile.Request{NamespacedName: types.NamespacedName{Name: "test-monitor", Namespace: "default"}}
+	if _, err := reconciler.Reconcile(context.TODO(), req); err != nil {
+		t.Fatalf("Reconcile returned error: %v", err)
+	}
+
+	workload := &cozyv1alpha1.Workload{}
+	if err := fakeClient.Get(context.TODO(), types.NamespacedName{Name: "pod-test-pod-1", Namespace: "default"}, workload); err != nil {
+		t.Fatalf("Failed to get Workload: %v", err)
+	}
+
+	if got := workload.Labels["workloads.cozystack.io/resource-preset"]; got != "medium" {
+		t.Errorf("expected monitor label propagated, got %q", got)
+	}
+	// Non-workloads.cozystack.io monitor labels must not be copied
+	if _, ok := workload.Labels["app.kubernetes.io/name"]; !ok {
+		t.Error("expected pod label to be present on Workload")
+	}
+	// Source-object label takes precedence on conflict
+	if got := workload.Labels["app.kubernetes.io/name"]; got != "pod-wins-on-conflict" {
+		t.Errorf("expected pod label to win on conflict, got %q", got)
+	}
+	// Reserved monitor label is always set from the monitor name
+	if got := workload.Labels["workloads.cozystack.io/monitor"]; got != "test-monitor" {
+		t.Errorf("expected monitor-name label, got %q", got)
+	}
+}
+
+func TestReconcile_BackwardCompat_NoMonitorLabels(t *testing.T) {
+	scheme := runtime.NewScheme()
+	_ = cozyv1alpha1.AddToScheme(scheme)
+	_ = corev1.AddToScheme(scheme)
+
+	monitor := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-monitor",
+			Namespace: "default",
+		},
+		Spec: cozyv1alpha1.WorkloadMonitorSpec{
+			Selector: map[string]string{"app": "test"},
+		},
+	}
+
+	pod := &corev1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-pod-1",
+			Namespace: "default",
+			Labels:    map[string]string{"app": "test"},
+		},
+		Status: corev1.PodStatus{
+			Conditions: []corev1.PodCondition{
+				{Type: corev1.PodReady, Status: corev1.ConditionTrue},
+			},
+		},
+	}
+
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(monitor, pod).
+		WithStatusSubresource(monitor).
+		Build()
+
+	reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: scheme}
+	req := reconcile.Request{NamespacedName: types.NamespacedName{Name: "test-monitor", Namespace: "default"}}
+	if _, err := reconciler.Reconcile(context.TODO(), req); err != nil {
+		t.Fatalf("Reconcile returned error: %v", err)
+	}
+
+	workload := &cozyv1alpha1.Workload{}
+	if err := fakeClient.Get(context.TODO(), types.NamespacedName{Name: "pod-test-pod-1", Namespace: "default"}, workload); err != nil {
+		t.Fatalf("Failed to get Workload: %v", err)
+	}
+	for k := range workload.Labels {
+		if strings.HasPrefix(k, "workloads.cozystack.io/") && k != "workloads.cozystack.io/monitor" {
+			t.Errorf("unexpected workload label present: %q", k)
+		}
+	}
+}
+
 func TestReconcile_OperationalTrue_WhenNoMinReplicas(t *testing.T) {
 	scheme := runtime.NewScheme()
 	_ = cozyv1alpha1.AddToScheme(scheme)
@@ -330,6 +524,82 @@ func TestReconcileBucketClaimNotReady(t *testing.T) {
 	}
 }
 
+func TestReconcile_MonitorLabelsPropagatedToBucketClaimWorkload(t *testing.T) {
+	s := newTestScheme()
+
+	monitor := &cozyv1alpha1.WorkloadMonitor{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-bucket",
+			Namespace: "tenant-demo",
+			Labels: map[string]string{
+				"workloads.cozystack.io/resource-preset": "medium",
+				"app.kubernetes.io/name":                 "ignored-not-propagated",
+			},
+		},
+		Spec: cozyv1alpha1.WorkloadMonitorSpec{
+			Kind: "bucket",
+			Type: "s3",
+			Selector: map[string]string{
+				"app.kubernetes.io/instance": "my-bucket",
+			},
+		},
+	}
+
+	bc := &cosiv1alpha1.BucketClaim{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-bucket",
+			Namespace: "tenant-demo",
+			Labels: map[string]string{
+				"app.kubernetes.io/instance": "my-bucket",
+				"app.kubernetes.io/name":     "bucket-wins-on-conflict",
+			},
+		},
+		Spec: cosiv1alpha1.BucketClaimSpec{
+			BucketClassName: "seaweedfs",
+			Protocols:       []cosiv1alpha1.Protocol{cosiv1alpha1.ProtocolS3},
+		},
+		Status: cosiv1alpha1.BucketClaimStatus{
+			BucketReady: true,
+			BucketName:  "cosi-abc123",
+		},
+	}
+
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(s).
+		WithObjects(monitor, bc).
+		WithStatusSubresource(monitor).
+		Build()
+
+	reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: s}
+	req := reconcile.Request{NamespacedName: types.NamespacedName{
+		Name:      "my-bucket",
+		Namespace: "tenant-demo",
+	}}
+	if _, err := reconciler.Reconcile(context.TODO(), req); err != nil {
+		t.Fatalf("Reconcile returned error: %v", err)
+	}
+
+	workload := &cozyv1alpha1.Workload{}
+	if err := fakeClient.Get(context.TODO(), types.NamespacedName{
+		Name:      "bucket-my-bucket",
+		Namespace: "tenant-demo",
+	}, workload); err != nil {
+		t.Fatalf("Failed to get Workload: %v", err)
+	}
+
+	if got := workload.Labels["workloads.cozystack.io/resource-preset"]; got != "medium" {
+		t.Errorf("expected monitor label propagated, got %q", got)
+	}
+	// Source-object label takes precedence on conflict
+	if got := workload.Labels["app.kubernetes.io/name"]; got != "bucket-wins-on-conflict" {
+		t.Errorf("expected bucket claim label to win on conflict, got %q", got)
+	}
+	// Reserved monitor label is always set from the monitor name
+	if got := workload.Labels["workloads.cozystack.io/monitor"]; got != "my-bucket" {
+		t.Errorf("expected monitor-name label, got %q", got)
+	}
+}
+
 func TestReconcileNoBucketClaimSkips(t *testing.T) {
 	s := newTestScheme()
 
diff --git a/packages/apps/clickhouse/templates/workloadmonitor.yaml b/packages/apps/clickhouse/templates/workloadmonitor.yaml
index 9020ad41..62c951c2 100644
--- a/packages/apps/clickhouse/templates/workloadmonitor.yaml
+++ b/packages/apps/clickhouse/templates/workloadmonitor.yaml
@@ -3,6 +3,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }}
 spec:
   replicas: {{ .Values.replicas }}
   minReplicas: 1
@@ -17,6 +19,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}-keeper
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.clickhouseKeeper.resourcesPreset | quote }}
 spec:
   replicas: {{ .Values.clickhouseKeeper.replicas }}
   minReplicas: 1
diff --git a/packages/apps/foundationdb/templates/workloadmonitor.yaml b/packages/apps/foundationdb/templates/workloadmonitor.yaml
index 306797f3..2e2a3d19 100644
--- a/packages/apps/foundationdb/templates/workloadmonitor.yaml
+++ b/packages/apps/foundationdb/templates/workloadmonitor.yaml
@@ -8,6 +8,7 @@ metadata:
     app.kubernetes.io/name: foundationdb
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
+    workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }}
 spec:
   replicas: {{ .Values.cluster.processCounts.storage }}
   minReplicas: {{ include "foundationdb.minReplicas" . }}
diff --git a/packages/apps/harbor/templates/harbor.yaml b/packages/apps/harbor/templates/harbor.yaml
index ff8e88ad..bf780967 100644
--- a/packages/apps/harbor/templates/harbor.yaml
+++ b/packages/apps/harbor/templates/harbor.yaml
@@ -158,6 +158,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}-core
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.core.resourcesPreset | quote }}
 spec:
   replicas: 1
   minReplicas: 1
@@ -174,6 +176,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}-registry
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.registry.resourcesPreset | quote }}
 spec:
   replicas: 1
   minReplicas: 1
diff --git a/packages/apps/http-cache/templates/workloadmonitor.yaml b/packages/apps/http-cache/templates/workloadmonitor.yaml
index 150d8bbe..a38a395a 100644
--- a/packages/apps/http-cache/templates/workloadmonitor.yaml
+++ b/packages/apps/http-cache/templates/workloadmonitor.yaml
@@ -3,6 +3,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}-haproxy
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.haproxy.resourcesPreset | quote }}
 spec:
   replicas: {{ .Values.haproxy.replicas }}
   minReplicas: 1
@@ -16,6 +18,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}-nginx
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.nginx.resourcesPreset | quote }}
 spec:
   replicas: {{ .Values.nginx.replicas }}
   minReplicas: 1
diff --git a/packages/apps/kafka/templates/workloadmonitor.yaml b/packages/apps/kafka/templates/workloadmonitor.yaml
index 4b161b04..c31eb425 100644
--- a/packages/apps/kafka/templates/workloadmonitor.yaml
+++ b/packages/apps/kafka/templates/workloadmonitor.yaml
@@ -3,6 +3,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.kafka.resourcesPreset | quote }}
 spec:
   replicas: {{ .Values.replicas }}
   minReplicas: 1
@@ -19,6 +21,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}-zookeeper
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.zookeeper.resourcesPreset | quote }}
 spec:
   replicas: {{ .Values.replicas }}
   minReplicas: 1
diff --git a/packages/apps/mariadb/templates/workloadmonitor.yaml b/packages/apps/mariadb/templates/workloadmonitor.yaml
index b69139bf..36cb59f0 100644
--- a/packages/apps/mariadb/templates/workloadmonitor.yaml
+++ b/packages/apps/mariadb/templates/workloadmonitor.yaml
@@ -3,6 +3,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }}
 spec:
   replicas: {{ .Values.replicas }}
   minReplicas: 1
diff --git a/packages/apps/mongodb/templates/mongodb.yaml b/packages/apps/mongodb/templates/mongodb.yaml
index 67969758..9273e506 100644
--- a/packages/apps/mongodb/templates/mongodb.yaml
+++ b/packages/apps/mongodb/templates/mongodb.yaml
@@ -169,6 +169,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ .Release.Name }}
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }}
 spec:
   {{- if .Values.sharding }}
   {{- $totalReplicas := 0 }}
diff --git a/packages/apps/nats/templates/workloadmonitor.yaml b/packages/apps/nats/templates/workloadmonitor.yaml
index 43d64a46..cb20b4a6 100644
--- a/packages/apps/nats/templates/workloadmonitor.yaml
+++ b/packages/apps/nats/templates/workloadmonitor.yaml
@@ -3,6 +3,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }}
 spec:
   replicas: {{ .Values.replicas }}
   minReplicas: 1
diff --git a/packages/apps/openbao/templates/workloadmonitor.yaml b/packages/apps/openbao/templates/workloadmonitor.yaml
index 0a9acf76..56f9ec8e 100644
--- a/packages/apps/openbao/templates/workloadmonitor.yaml
+++ b/packages/apps/openbao/templates/workloadmonitor.yaml
@@ -3,6 +3,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }}
 spec:
   replicas: {{ .Values.replicas }}
   minReplicas: 1
diff --git a/packages/apps/opensearch/templates/opensearch.yaml b/packages/apps/opensearch/templates/opensearch.yaml
index fcf431ac..836a3d4b 100644
--- a/packages/apps/opensearch/templates/opensearch.yaml
+++ b/packages/apps/opensearch/templates/opensearch.yaml
@@ -93,6 +93,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ .Release.Name }}
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }}
 spec:
   replicas: {{ .Values.replicas }}
   minReplicas: 1
diff --git a/packages/apps/postgres/templates/db.yaml b/packages/apps/postgres/templates/db.yaml
index 7557c436..5c40b2c7 100644
--- a/packages/apps/postgres/templates/db.yaml
+++ b/packages/apps/postgres/templates/db.yaml
@@ -84,6 +84,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }}
 spec:
   replicas: {{ .Values.replicas }}
   minReplicas: 1
diff --git a/packages/apps/qdrant/templates/dashboard-resourcemap.yaml b/packages/apps/qdrant/templates/dashboard-resourcemap.yaml
index b0a85bcc..0986951f 100644
--- a/packages/apps/qdrant/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/qdrant/templates/dashboard-resourcemap.yaml
@@ -41,6 +41,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ .Release.Name }}
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }}
 spec:
   minReplicas: 1
   replicas: {{ .Values.replicas }}
diff --git a/packages/apps/rabbitmq/templates/workloadmonitor.yaml b/packages/apps/rabbitmq/templates/workloadmonitor.yaml
index 0f7462c7..66941153 100644
--- a/packages/apps/rabbitmq/templates/workloadmonitor.yaml
+++ b/packages/apps/rabbitmq/templates/workloadmonitor.yaml
@@ -3,6 +3,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }}
 spec:
   replicas: {{ .Values.replicas }}
   minReplicas: 1
diff --git a/packages/apps/redis/templates/redisfailover.yaml b/packages/apps/redis/templates/redisfailover.yaml
index 936217a3..160e030d 100644
--- a/packages/apps/redis/templates/redisfailover.yaml
+++ b/packages/apps/redis/templates/redisfailover.yaml
@@ -75,6 +75,8 @@ kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}-redis
   namespace: {{ $.Release.Namespace }}
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }}
 spec:
   minReplicas: 1
   replicas: {{ .Values.replicas }}
@@ -90,6 +92,8 @@ kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}-sentinel
   namespace: {{ $.Release.Namespace }}
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }}
 spec:
   minReplicas: 2
   replicas: 3
diff --git a/packages/apps/tcp-balancer/templates/workloadmonitor.yaml b/packages/apps/tcp-balancer/templates/workloadmonitor.yaml
index 41dce2ab..3478826b 100644
--- a/packages/apps/tcp-balancer/templates/workloadmonitor.yaml
+++ b/packages/apps/tcp-balancer/templates/workloadmonitor.yaml
@@ -3,6 +3,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }}
 spec:
   replicas: {{ .Values.replicas }}
   minReplicas: 1
diff --git a/packages/apps/vpn/templates/workloadmonitor.yaml b/packages/apps/vpn/templates/workloadmonitor.yaml
index a75f7940..7fc1ec7a 100644
--- a/packages/apps/vpn/templates/workloadmonitor.yaml
+++ b/packages/apps/vpn/templates/workloadmonitor.yaml
@@ -2,6 +2,8 @@ apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
   name: {{ $.Release.Name }}
+  labels:
+    workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }}
 spec:
   replicas: {{ .Values.replicas }}
   minReplicas: 1

From cb3e0adf6438a2520bf7a943c798da7de8104c42 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Fri, 17 Apr 2026 16:55:42 +0300
Subject: [PATCH 510/666] feat(monitoring): add GPU recording rules
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add VMRule with recording rules for DCGM metrics at three levels:

- gpu.recording.30s: per-GPU aggregates over 30s windows
- gpu.recording.cluster.1m: cluster-wide totals for overview panels
- gpu.recording.namespace.1m: per-namespace aggregates for tenant
  reporting and GPU-hour calculations

The rules are safe to ship on clusters without DCGM — they evaluate to
empty series when no matching metrics are scraped.

Used by dashboards/gpu/gpu-performance.json.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../alerts/gpu-recording.rules.yaml           | 57 +++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml

diff --git a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
new file mode 100644
index 00000000..871a46fc
--- /dev/null
+++ b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
@@ -0,0 +1,57 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMRule
+metadata:
+  name: alerts-gpu-recording.rules
+spec:
+  groups:
+    - name: gpu.recording.30s
+      interval: 30s
+      rules:
+        - record: gpu:util:avg
+          expr: avg by (Hostname, gpu, UUID, modelName, namespace, pod) (DCGM_FI_DEV_GPU_UTIL)
+        - record: gpu:mem_copy_util:avg
+          expr: avg by (Hostname, gpu, UUID, modelName, namespace, pod) (DCGM_FI_DEV_MEM_COPY_UTIL)
+        - record: gpu:fb_used_bytes:max
+          expr: max by (Hostname, gpu, UUID, modelName, namespace, pod) (DCGM_FI_DEV_FB_USED) * 1048576
+        - record: gpu:fb_free_bytes:max
+          expr: max by (Hostname, gpu, UUID, modelName, namespace, pod) (DCGM_FI_DEV_FB_FREE) * 1048576
+        - record: gpu:power_watts:avg
+          expr: avg by (Hostname, gpu, UUID, modelName, namespace, pod) (DCGM_FI_DEV_POWER_USAGE)
+        - record: gpu:temp_celsius:max
+          expr: max by (Hostname, gpu, UUID, modelName) (DCGM_FI_DEV_GPU_TEMP)
+        - record: gpu:tensor_active:avg
+          expr: avg by (Hostname, gpu, UUID, modelName, namespace, pod) (DCGM_FI_PROF_PIPE_TENSOR_ACTIVE)
+        - record: gpu:gr_engine_active:avg
+          expr: avg by (Hostname, gpu, UUID, modelName, namespace, pod) (DCGM_FI_PROF_GR_ENGINE_ACTIVE)
+
+    - name: gpu.recording.cluster.1m
+      interval: 1m
+      rules:
+        - record: cluster:gpu_count:total
+          expr: count(group by (UUID) (DCGM_FI_DEV_GPU_UTIL))
+        - record: cluster:gpu_count:allocated
+          expr: count(group by (UUID) (DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"}))
+        - record: cluster:gpu_count:free
+          expr: cluster:gpu_count:total - (cluster:gpu_count:allocated or vector(0))
+        - record: cluster:gpu_util:avg
+          expr: avg(DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"})
+        - record: cluster:gpu_power_watts:sum
+          expr: sum(DCGM_FI_DEV_POWER_USAGE)
+
+    - name: gpu.recording.namespace.1m
+      interval: 1m
+      rules:
+        - record: namespace:gpu_count:sum
+          expr: count by (namespace) (DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"})
+        - record: namespace:gpu_util:avg
+          expr: avg by (namespace) (DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"})
+        - record: namespace:tensor_active:avg
+          expr: avg by (namespace) (DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{namespace!="", namespace!~"cozy-.*|kube-.*"})
+        - record: namespace:fb_used_bytes:sum
+          expr: sum by (namespace) (DCGM_FI_DEV_FB_USED{namespace!="", namespace!~"cozy-.*|kube-.*"}) * 1048576
+        - record: namespace:power_watts:sum
+          expr: sum by (namespace) (DCGM_FI_DEV_POWER_USAGE{namespace!="", namespace!~"cozy-.*|kube-.*"})
+        - record: namespace:energy_joules:sum
+          expr: sum by (namespace) (DCGM_FI_DEV_TOTAL_ENERGY_CONSUMPTION{namespace!="", namespace!~"cozy-.*|kube-.*"}) / 1000
+        - record: namespace:gpu_allocated_count:gauge
+          expr: count by (namespace) (DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"})

From d1d19e9978f965b65ed910b3b6486469e2d07f8d Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Fri, 17 Apr 2026 16:55:51 +0300
Subject: [PATCH 511/666] feat(monitoring): add GPU performance Grafana
 dashboard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the gpu/gpu-performance dashboard and register it in the infra
dashboard list. The dashboard provides:

- Cluster overview: total/allocated GPUs, average utilization,
  aggregate power draw.
- Utilization: GPU util (NVML), tensor pipe active (realistic load
  for LLM/AI workloads), graphics engine active, memory copy util.
- Memory: VRAM used/free per GPU.
- Power and temperature per GPU.
- Health: XID errors, power and thermal throttling.

The dashboard relies on DCGM_FI_* metrics plus the cluster:gpu_* and
namespace:gpu_* recording rules added to monitoring-agents.

The JSON follows the cozystack convention — Prometheus data source is
selected via the $ds_prometheus template variable.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-performance.json           | 935 ++++++++++++++++++
 .../system/monitoring/dashboards-infra.list   |   1 +
 2 files changed, 936 insertions(+)
 create mode 100644 dashboards/gpu/gpu-performance.json

diff --git a/dashboards/gpu/gpu-performance.json b/dashboards/gpu/gpu-performance.json
new file mode 100644
index 00000000..0b458d4e
--- /dev/null
+++ b/dashboards/gpu/gpu-performance.json
@@ -0,0 +1,935 @@
+{
+  "annotations": {
+    "list": []
+  },
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 1,
+  "id": null,
+  "links": [],
+  "liveNow": false,
+  "schemaVersion": 39,
+  "tags": [
+    "gpu",
+    "dcgm"
+  ],
+  "templating": {
+    "list": [
+      {
+        "current": {
+          "selected": false,
+          "text": "default",
+          "value": "default"
+        },
+        "hide": 0,
+        "includeAll": false,
+        "label": "Prometheus",
+        "multi": false,
+        "name": "ds_prometheus",
+        "options": [],
+        "query": "prometheus",
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "type": "datasource"
+      },
+      {
+        "current": {
+          "selected": true,
+          "text": "All",
+          "value": "$__all"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "$ds_prometheus"
+        },
+        "definition": "label_values(DCGM_FI_DEV_GPU_UTIL, Hostname)",
+        "hide": 0,
+        "includeAll": true,
+        "label": "Host",
+        "multi": true,
+        "name": "Hostname",
+        "options": [],
+        "query": {
+          "query": "label_values(DCGM_FI_DEV_GPU_UTIL, Hostname)",
+          "refId": "StandardVariableQuery"
+        },
+        "refresh": 2,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 1,
+        "type": "query"
+      },
+      {
+        "current": {
+          "selected": true,
+          "text": "All",
+          "value": "$__all"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "$ds_prometheus"
+        },
+        "definition": "label_values(DCGM_FI_DEV_GPU_UTIL{namespace!=\"\",namespace!~\"cozy-.*|kube-.*\"}, namespace)",
+        "hide": 0,
+        "includeAll": true,
+        "label": "Namespace",
+        "multi": true,
+        "name": "namespace",
+        "options": [],
+        "query": {
+          "query": "label_values(DCGM_FI_DEV_GPU_UTIL{namespace!=\"\",namespace!~\"cozy-.*|kube-.*\"}, namespace)",
+          "refId": "StandardVariableQuery"
+        },
+        "refresh": 2,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 1,
+        "type": "query"
+      }
+    ]
+  },
+  "time": {
+    "from": "now-1h",
+    "to": "now"
+  },
+  "timepicker": {},
+  "timezone": "",
+  "title": "GPU Performance",
+  "uid": "gpu-performance",
+  "weekStart": "",
+  "panels": [
+    {
+      "type": "row",
+      "title": "Overview",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 0
+      },
+      "collapsed": false,
+      "id": 1,
+      "panels": []
+    },
+    {
+      "type": "stat",
+      "title": "Total GPUs",
+      "gridPos": {
+        "h": 4,
+        "w": 6,
+        "x": 0,
+        "y": 1
+      },
+      "id": 2,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "targets": [
+        {
+          "expr": "cluster:gpu_count:total",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "color": {
+            "mode": "thresholds"
+          },
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "blue"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "colorMode": "value",
+        "graphMode": "none",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "textMode": "value"
+      }
+    },
+    {
+      "type": "stat",
+      "title": "Allocated",
+      "gridPos": {
+        "h": 4,
+        "w": 6,
+        "x": 6,
+        "y": 1
+      },
+      "id": 3,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "targets": [
+        {
+          "expr": "cluster:gpu_count:allocated",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "color": {
+            "mode": "thresholds"
+          },
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "yellow",
+                "value": 1
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "colorMode": "value",
+        "graphMode": "none",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "textMode": "value"
+      }
+    },
+    {
+      "type": "stat",
+      "title": "Average utilization",
+      "gridPos": {
+        "h": 4,
+        "w": 6,
+        "x": 12,
+        "y": 1
+      },
+      "id": 4,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "targets": [
+        {
+          "expr": "cluster:gpu_util:avg",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percent",
+          "min": 0,
+          "max": 100,
+          "color": {
+            "mode": "thresholds"
+          },
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "blue",
+                "value": null
+              },
+              {
+                "color": "green",
+                "value": 30
+              },
+              {
+                "color": "orange",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "textMode": "value"
+      }
+    },
+    {
+      "type": "stat",
+      "title": "Power draw",
+      "gridPos": {
+        "h": 4,
+        "w": 6,
+        "x": 18,
+        "y": 1
+      },
+      "id": 5,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "targets": [
+        {
+          "expr": "cluster:gpu_power_watts:sum",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "watt",
+          "decimals": 0,
+          "color": {
+            "mode": "thresholds"
+          },
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "textMode": "value"
+      }
+    },
+    {
+      "type": "row",
+      "title": "Utilization",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 5
+      },
+      "collapsed": false,
+      "id": 10,
+      "panels": []
+    },
+    {
+      "type": "timeseries",
+      "title": "GPU Utilization (NVML)",
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 6
+      },
+      "id": 11,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "targets": [
+        {
+          "expr": "DCGM_FI_DEV_GPU_UTIL{Hostname=~\"$Hostname\", namespace=~\"$namespace\"}",
+          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percent",
+          "min": 0,
+          "max": 100,
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 10,
+            "showPoints": "never",
+            "spanNulls": false
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
+    },
+    {
+      "type": "timeseries",
+      "title": "Tensor Pipe Active (realistic load for LLM/AI)",
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 6
+      },
+      "id": 12,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "targets": [
+        {
+          "expr": "DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{Hostname=~\"$Hostname\", namespace=~\"$namespace\"} * 100",
+          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percent",
+          "min": 0,
+          "max": 100,
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 10,
+            "showPoints": "never",
+            "spanNulls": false
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
+    },
+    {
+      "type": "timeseries",
+      "title": "Graphics Engine Active",
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 14
+      },
+      "id": 13,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "targets": [
+        {
+          "expr": "DCGM_FI_PROF_GR_ENGINE_ACTIVE{Hostname=~\"$Hostname\", namespace=~\"$namespace\"} * 100",
+          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percent",
+          "min": 0,
+          "max": 100,
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 10,
+            "showPoints": "never",
+            "spanNulls": false
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
+    },
+    {
+      "type": "timeseries",
+      "title": "Memory Copy Utilization",
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 14
+      },
+      "id": 14,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "targets": [
+        {
+          "expr": "DCGM_FI_DEV_MEM_COPY_UTIL{Hostname=~\"$Hostname\", namespace=~\"$namespace\"}",
+          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percent",
+          "min": 0,
+          "max": 100,
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 10,
+            "showPoints": "never",
+            "spanNulls": false
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
+    },
+    {
+      "type": "row",
+      "title": "Memory",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 22
+      },
+      "collapsed": false,
+      "id": 20,
+      "panels": []
+    },
+    {
+      "type": "timeseries",
+      "title": "VRAM Used",
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 23
+      },
+      "id": 21,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "targets": [
+        {
+          "expr": "DCGM_FI_DEV_FB_USED{Hostname=~\"$Hostname\", namespace=~\"$namespace\"} * 1048576",
+          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "bytes",
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 25,
+            "showPoints": "never",
+            "stacking": {
+              "mode": "none"
+            }
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
+    },
+    {
+      "type": "timeseries",
+      "title": "VRAM Free",
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 23
+      },
+      "id": 22,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "targets": [
+        {
+          "expr": "DCGM_FI_DEV_FB_FREE{Hostname=~\"$Hostname\"} * 1048576",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "bytes",
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 10,
+            "showPoints": "never"
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "calcs": [
+            "mean",
+            "min"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
+    },
+    {
+      "type": "row",
+      "title": "Power & Temperature",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 31
+      },
+      "collapsed": false,
+      "id": 30,
+      "panels": []
+    },
+    {
+      "type": "timeseries",
+      "title": "Power Usage per GPU",
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 32
+      },
+      "id": 31,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "targets": [
+        {
+          "expr": "DCGM_FI_DEV_POWER_USAGE{Hostname=~\"$Hostname\"}",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "watt",
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 10,
+            "showPoints": "never"
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
+    },
+    {
+      "type": "timeseries",
+      "title": "GPU Temperature",
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 32
+      },
+      "id": 32,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "targets": [
+        {
+          "expr": "DCGM_FI_DEV_GPU_TEMP{Hostname=~\"$Hostname\"}",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "celsius",
+          "min": 20,
+          "max": 100,
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 10,
+            "showPoints": "never"
+          },
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "yellow",
+                "value": 75
+              },
+              {
+                "color": "red",
+                "value": 85
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
+    },
+    {
+      "type": "row",
+      "title": "Health",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 40
+      },
+      "collapsed": false,
+      "id": 40,
+      "panels": []
+    },
+    {
+      "type": "stat",
+      "title": "XID errors (latest)",
+      "gridPos": {
+        "h": 5,
+        "w": 8,
+        "x": 0,
+        "y": 41
+      },
+      "id": 41,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "targets": [
+        {
+          "expr": "max by (Hostname, gpu) (DCGM_FI_DEV_XID_ERRORS{Hostname=~\"$Hostname\"})",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "color": {
+            "mode": "thresholds"
+          },
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 1
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "colorMode": "background",
+        "graphMode": "none",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "textMode": "value_and_name"
+      }
+    },
+    {
+      "type": "timeseries",
+      "title": "Power Violation (\u00b5s/s throttled due to power)",
+      "gridPos": {
+        "h": 5,
+        "w": 8,
+        "x": 8,
+        "y": 41
+      },
+      "id": 42,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "targets": [
+        {
+          "expr": "rate(DCGM_FI_DEV_POWER_VIOLATION{Hostname=~\"$Hostname\"}[5m])",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "\u00b5s",
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 10,
+            "showPoints": "never"
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
+    },
+    {
+      "type": "timeseries",
+      "title": "Thermal Violation (\u00b5s/s throttled due to thermals)",
+      "gridPos": {
+        "h": 5,
+        "w": 8,
+        "x": 16,
+        "y": 41
+      },
+      "id": 43,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "targets": [
+        {
+          "expr": "rate(DCGM_FI_DEV_THERMAL_VIOLATION{Hostname=~\"$Hostname\"}[5m])",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "\u00b5s",
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 10,
+            "showPoints": "never"
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/packages/system/monitoring/dashboards-infra.list b/packages/system/monitoring/dashboards-infra.list
index b5b9f52a..581f9a05 100644
--- a/packages/system/monitoring/dashboards-infra.list
+++ b/packages/system/monitoring/dashboards-infra.list
@@ -32,3 +32,4 @@ hubble/overview
 hubble/dns-namespace
 hubble/l7-http-metrics
 hubble/network-overview
+gpu/gpu-performance

From 5d6654c6f4eb63447d91bbf448e6116317228931 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Fri, 17 Apr 2026 16:56:03 +0300
Subject: [PATCH 512/666] docs(gpu-operator): add native-pod Talos reference
 manifests

Add reference manifests (not templates) under
packages/system/gpu-operator/examples/ documenting one working
configuration for running CUDA workloads directly in pods on a Talos
cluster, with DCGM metrics that drive the gpu/gpu-performance
dashboard.

- values-native-talos.yaml: Cozystack Package values that disable the
  sandbox path, enable the device plugin, and wire DCGM to the custom
  metrics ConfigMap.
- dcgm-custom-metrics.yaml: ConfigMap extending the default DCGM CSV
  with profiling, ECC, throttling and energy counters used by the
  dashboard and recording rules.
- nvidia-driver-compat.yaml: DaemonSet that stages libnvidia-ml.so.1
  and nvidia-smi from the Talos glibc tree into a location the
  gpu-operator validator inspects. Workaround for
  NVIDIA/gpu-operator#1687.
- README.md: explains why these are shipped as references rather than
  first-class templates (sandbox vs native is a deployment choice),
  and how the pieces connect.

The out-of-the-box values-talos.yaml still targets the sandbox (VFIO
passthrough) scenario. Operators who want native pod GPU workloads can
start from these references.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../system/gpu-operator/examples/README.md    | 69 ++++++++++++++++
 .../examples/dcgm-custom-metrics.yaml         | 82 +++++++++++++++++++
 .../examples/nvidia-driver-compat.yaml        | 72 ++++++++++++++++
 .../examples/values-native-talos.yaml         | 45 ++++++++++
 4 files changed, 268 insertions(+)
 create mode 100644 packages/system/gpu-operator/examples/README.md
 create mode 100644 packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml
 create mode 100644 packages/system/gpu-operator/examples/nvidia-driver-compat.yaml
 create mode 100644 packages/system/gpu-operator/examples/values-native-talos.yaml

diff --git a/packages/system/gpu-operator/examples/README.md b/packages/system/gpu-operator/examples/README.md
new file mode 100644
index 00000000..dac3703e
--- /dev/null
+++ b/packages/system/gpu-operator/examples/README.md
@@ -0,0 +1,69 @@
+# GPU operator — native pod workload on Talos (reference)
+
+The files in this directory are **not** templates. They are reference
+artifacts that document one working configuration for running GPU
+workloads directly in pods on a Talos-based Cozystack cluster, together
+with the DCGM metrics needed by the `gpu/gpu-performance` Grafana
+dashboard.
+
+The out-of-the-box `values-talos.yaml` for this package targets the
+sandbox (VFIO passthrough to KubeVirt VMs) scenario. The files here
+illustrate an alternative — running CUDA workloads in regular pods with
+the NVIDIA device plugin — and the workarounds it currently requires on
+Talos.
+
+## Files
+
+- [`values-native-talos.yaml`](./values-native-talos.yaml) — Cozystack
+  `Package` values that disable sandbox workloads, enable the device
+  plugin, point `hostPaths.driverInstallDir` at the staging location
+  used by the compat DaemonSet, and wire DCGM to the custom metrics
+  ConfigMap.
+- [`dcgm-custom-metrics.yaml`](./dcgm-custom-metrics.yaml) — `ConfigMap`
+  with a DCGM metrics CSV that adds profiling, ECC, throttling and
+  energy counters on top of the upstream defaults. Required by the
+  recording rules in `packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml`
+  and by several panels in the `gpu/gpu-performance` dashboard.
+- [`nvidia-driver-compat.yaml`](./nvidia-driver-compat.yaml) — DaemonSet
+  that stages `libnvidia-ml.so.1` and `nvidia-smi` from the Talos glibc
+  tree into a path where the NVIDIA GPU Operator validator expects
+  them. See the "Why the compat DaemonSet exists" section below.
+
+## Why these are reference, not templates
+
+Shipping these as first-class templates would silently impose
+assumptions that do not hold for every user:
+
+- Whether the NVIDIA Talos system extension is installed on the nodes.
+- Whether GPUs are exposed directly to pods or passed through to VMs.
+- The exact path the installed driver ends up at (depends on the
+  extension version and Talos release).
+
+The sandbox-oriented `values-talos.yaml` remains the default. Operators
+who want native pod GPU workloads can start from this directory and
+adapt as needed.
+
+## Why the compat DaemonSet exists
+
+The NVIDIA GPU Operator validator checks for `libnvidia-ml.so.1` and
+`bin/nvidia-smi` in the path given by `hostPaths.driverInstallDir`.
+Talos installs them under `/usr/local/glibc/usr/lib/` and
+`/usr/local/bin/`, which the validator does not look at. Until upstream
+addresses [NVIDIA/gpu-operator#1687][1], the DaemonSet copies those
+files into a directory the validator does inspect and creates the
+`.driver-ctr-ready` flag file so the validator proceeds.
+
+[1]: https://github.com/NVIDIA/gpu-operator/issues/1687
+
+## How the dashboard and recording rules fit in
+
+- `dashboards/gpu/gpu-performance.json` expects `DCGM_FI_*` metrics,
+  including profiling series (`DCGM_FI_PROF_PIPE_TENSOR_ACTIVE`,
+  `DCGM_FI_PROF_GR_ENGINE_ACTIVE`) and throttling counters
+  (`DCGM_FI_DEV_POWER_VIOLATION`, `DCGM_FI_DEV_THERMAL_VIOLATION`).
+  These are only emitted when DCGM Exporter is started with the custom
+  CSV in `dcgm-custom-metrics.yaml`.
+- `packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml`
+  precomputes cluster-wide and per-namespace aggregations used by the
+  overview panels of the dashboard. The rules are safe to ship on any
+  cluster — they evaluate to empty series when DCGM is not scraped.
diff --git a/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml b/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml
new file mode 100644
index 00000000..14b89b5c
--- /dev/null
+++ b/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml
@@ -0,0 +1,82 @@
+# Custom DCGM Exporter metrics CSV. Referenced from
+# examples/values-native-talos.yaml via dcgmExporter.config.name.
+#
+# Extends the upstream default set with profiling counters, ECC, page
+# retirement, row remap, energy and throttling violations — everything
+# the gpu/gpu-performance dashboard and the GPU recording rules in
+# monitoring-agents expect.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: dcgm-custom-metrics
+  namespace: cozy-gpu-operator
+data:
+  dcgm-metrics.csv: |
+    # Format
+    # If line starts with a '#' it is considered a comment
+    # DCGM FIELD, Prometheus metric type, help message
+
+    # Clocks
+    DCGM_FI_DEV_SM_CLOCK,  gauge, SM clock frequency (in MHz).
+    DCGM_FI_DEV_MEM_CLOCK, gauge, Memory clock frequency (in MHz).
+
+    # Temperature
+    DCGM_FI_DEV_MEMORY_TEMP, gauge, Memory temperature (in C).
+    DCGM_FI_DEV_GPU_TEMP,    gauge, GPU temperature (in C).
+
+    # Power
+    DCGM_FI_DEV_POWER_USAGE,              gauge, Power draw (in W).
+    DCGM_FI_DEV_TOTAL_ENERGY_CONSUMPTION, counter, Total energy consumption since boot (in mJ).
+
+    # PCIE
+    DCGM_FI_DEV_PCIE_REPLAY_COUNTER, counter, Total number of PCIe retries.
+
+    # Utilization (the sample period varies depending on the product)
+    DCGM_FI_DEV_GPU_UTIL,      gauge, GPU utilization (in %).
+    DCGM_FI_DEV_MEM_COPY_UTIL, gauge, Memory utilization (in %).
+    DCGM_FI_DEV_ENC_UTIL,      gauge, Encoder utilization (in %).
+    DCGM_FI_DEV_DEC_UTIL,      gauge, Decoder utilization (in %).
+
+    # Errors and violations
+    DCGM_FI_DEV_XID_ERRORS, gauge, Value of the last XID error encountered.
+
+    # Memory usage
+    DCGM_FI_DEV_FB_FREE,     gauge, Framebuffer memory free (in MiB).
+    DCGM_FI_DEV_FB_USED,     gauge, Framebuffer memory used (in MiB).
+    DCGM_FI_DEV_FB_RESERVED, gauge, Framebuffer memory reserved (in MiB).
+
+    # ECC (supported on datacenter-class GPUs such as A10)
+    DCGM_FI_DEV_ECC_SBE_VOL_TOTAL, counter, Total number of single-bit volatile ECC errors.
+    DCGM_FI_DEV_ECC_DBE_VOL_TOTAL, counter, Total number of double-bit volatile ECC errors.
+    DCGM_FI_DEV_ECC_SBE_AGG_TOTAL, counter, Total number of single-bit persistent ECC errors.
+    DCGM_FI_DEV_ECC_DBE_AGG_TOTAL, counter, Total number of double-bit persistent ECC errors.
+
+    # Retired pages
+    DCGM_FI_DEV_RETIRED_SBE,     counter, Total number of retired pages due to single-bit errors.
+    DCGM_FI_DEV_RETIRED_DBE,     counter, Total number of retired pages due to double-bit errors.
+    DCGM_FI_DEV_RETIRED_PENDING, counter, Total number of pages pending retirement.
+
+    # Row remapping (not applicable to GDDR6 but left for datacenter GPUs)
+    DCGM_FI_DEV_UNCORRECTABLE_REMAPPED_ROWS, counter, Number of remapped rows for uncorrectable errors.
+    DCGM_FI_DEV_CORRECTABLE_REMAPPED_ROWS,   counter, Number of remapped rows for correctable errors.
+    DCGM_FI_DEV_ROW_REMAP_FAILURE,           gauge,   Whether remapping of rows has failed.
+
+    # Throttle / violation counters (crucial for SLA and tenant monitoring)
+    DCGM_FI_DEV_POWER_VIOLATION,       counter, Throttling duration due to power constraints (in us).
+    DCGM_FI_DEV_THERMAL_VIOLATION,     counter, Throttling duration due to thermal constraints (in us).
+    DCGM_FI_DEV_SYNC_BOOST_VIOLATION,  counter, Throttling duration due to sync-boost constraints (in us).
+    DCGM_FI_DEV_BOARD_LIMIT_VIOLATION, counter, Throttling duration due to board limit constraints (in us).
+    DCGM_FI_DEV_LOW_UTIL_VIOLATION,    counter, Throttling duration due to low utilization (in us).
+    DCGM_FI_DEV_RELIABILITY_VIOLATION, counter, Throttling duration due to reliability constraints (in us).
+
+    # NVLink — enable only for GPUs that actually have NVLink (A10 has none).
+    # DCGM_FI_DEV_NVLINK_BANDWIDTH_TOTAL, counter, Total number of NVLink bandwidth counters for all lanes.
+
+    # DCP (profiling) metrics — supported from Ampere onwards.
+    DCGM_FI_PROF_GR_ENGINE_ACTIVE,   gauge, Ratio of time the graphics engine is active.
+    DCGM_FI_PROF_SM_ACTIVE,          gauge, The ratio of cycles an SM has at least 1 warp assigned.
+    DCGM_FI_PROF_SM_OCCUPANCY,       gauge, The ratio of number of warps resident on an SM.
+    DCGM_FI_PROF_PIPE_TENSOR_ACTIVE, gauge, Ratio of cycles the tensor (HMMA) pipe is active.
+    DCGM_FI_PROF_DRAM_ACTIVE,        gauge, Ratio of cycles the device memory interface is active sending or receiving data.
+    DCGM_FI_PROF_PCIE_TX_BYTES,      counter, The number of bytes of active PCIe tx (transmit) data including both header and payload.
+    DCGM_FI_PROF_PCIE_RX_BYTES,      counter, The number of bytes of active PCIe rx (read) data including both header and payload.
diff --git a/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml b/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml
new file mode 100644
index 00000000..e4718e0a
--- /dev/null
+++ b/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml
@@ -0,0 +1,72 @@
+# Workaround for https://github.com/NVIDIA/gpu-operator/issues/1687
+#
+# On Talos, the NVIDIA system extension installs driver files under
+# /usr/local/glibc/usr/lib/ and /usr/local/bin/. The GPU Operator
+# validator only looks for libnvidia-ml.so.1 and bin/nvidia-smi under
+# the path configured as hostPaths.driverInstallDir. This DaemonSet
+# stages the required files into /var/nvidia-driver on each node and
+# creates the .driver-ctr-ready flag so the validator proceeds.
+#
+# Paired with examples/values-native-talos.yaml, which sets
+# hostPaths.driverInstallDir to /var/nvidia-driver.
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: nvidia-driver-compat
+  namespace: cozy-gpu-operator
+  labels:
+    app: nvidia-driver-compat
+spec:
+  selector:
+    matchLabels:
+      app: nvidia-driver-compat
+  template:
+    metadata:
+      labels:
+        app: nvidia-driver-compat
+    spec:
+      hostPID: true
+      priorityClassName: system-node-critical
+      tolerations:
+        - operator: Exists
+      initContainers:
+        - name: create-driver-tree
+          image: busybox:1.37
+          command:
+            - sh
+            - -c
+            - |
+              set -e
+              GLIBC_LIB="/host/usr/local/glibc/usr/lib"
+              SRC_BIN="/host/usr/local/bin"
+              DST="/host/var/nvidia-driver"
+
+              mkdir -p "$DST/bin"
+
+              if [ -f "$GLIBC_LIB/libnvidia-ml.so.1" ]; then
+                cp -f "$GLIBC_LIB/libnvidia-ml.so.1" "$DST/libnvidia-ml.so.1"
+                echo "Copied libnvidia-ml.so.1"
+              fi
+
+              if [ -f "$SRC_BIN/nvidia-smi" ]; then
+                cp -f "$SRC_BIN/nvidia-smi" "$DST/bin/nvidia-smi"
+                chmod +x "$DST/bin/nvidia-smi"
+                echo "Copied nvidia-smi"
+              fi
+
+              mkdir -p /host/run/nvidia/validations
+              touch /host/run/nvidia/validations/.driver-ctr-ready
+              echo "Created driver-ctr-ready flag"
+              echo "Done"
+          securityContext:
+            privileged: true
+          volumeMounts:
+            - name: host-root
+              mountPath: /host
+      containers:
+        - name: pause
+          image: registry.k8s.io/pause:3.10
+      volumes:
+        - name: host-root
+          hostPath:
+            path: /
diff --git a/packages/system/gpu-operator/examples/values-native-talos.yaml b/packages/system/gpu-operator/examples/values-native-talos.yaml
new file mode 100644
index 00000000..86e436c4
--- /dev/null
+++ b/packages/system/gpu-operator/examples/values-native-talos.yaml
@@ -0,0 +1,45 @@
+# Cozystack Package values for running GPU workloads natively in pods
+# on Talos. This is the counterpart to values-talos.yaml, which targets
+# the sandbox (VFIO passthrough) scenario.
+#
+# Prerequisites:
+#   - NVIDIA Talos system extension installed on GPU nodes.
+#   - examples/nvidia-driver-compat.yaml deployed to stage driver files
+#     where the gpu-operator validator looks for them.
+#   - examples/dcgm-custom-metrics.yaml applied so DCGM Exporter exports
+#     the full set of metrics used by the dashboard and recording rules.
+apiVersion: cozystack.io/v1alpha1
+kind: Package
+metadata:
+  name: cozystack.gpu-operator
+spec:
+  variant: default
+  components:
+    gpu-operator:
+      values:
+        gpu-operator:
+          # The compat DaemonSet stages libnvidia-ml.so.1 and nvidia-smi
+          # under /var/nvidia-driver. Point the validator at that path.
+          hostPaths:
+            driverInstallDir: "/var/nvidia-driver"
+          # Disable the sandbox path — workloads run in pods, not VMs.
+          sandboxWorkloads:
+            enabled: false
+          vfioManager:
+            enabled: false
+          # The Talos extension provides the driver and runtime hooks,
+          # so the operator's own toolkit and driver components must be
+          # switched off to avoid conflicting installations.
+          toolkit:
+            enabled: false
+          devicePlugin:
+            enabled: true
+          # Export full set of DCGM metrics using the ConfigMap in
+          # examples/dcgm-custom-metrics.yaml.
+          dcgmExporter:
+            serviceMonitor:
+              enabled: true
+              interval: "15s"
+              honorLabels: true
+            config:
+              name: dcgm-custom-metrics

From c1b9a06a3647c48df5a8e25327c38c05425504c8 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Fri, 17 Apr 2026 17:08:18 +0300
Subject: [PATCH 513/666] =?UTF-8?q?feat(monitoring):=20expand=20GPU=20dash?=
 =?UTF-8?q?boards=20=E2=80=94=20efficiency=20and=20quotas?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Revise gpu-performance and add two new dashboards, registered in
dashboards-infra.list:

- gpu-efficiency (GPU Efficiency Score) — utilization vs. capacity
  and workload efficiency signals.
- gpu-quotas (GPU Quotas & Allocation) — per-namespace requested vs.
  used GPUs for tenant capacity planning.

All three dashboards use the $ds_prometheus template variable, per
the project convention.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-efficiency.json            | 1131 ++++++++++++
 dashboards/gpu/gpu-performance.json           | 1523 +++++++++++------
 dashboards/gpu/gpu-quotas.json                |  822 +++++++++
 .../system/monitoring/dashboards-infra.list   |    2 +
 4 files changed, 2956 insertions(+), 522 deletions(-)
 create mode 100644 dashboards/gpu/gpu-efficiency.json
 create mode 100644 dashboards/gpu/gpu-quotas.json

diff --git a/dashboards/gpu/gpu-efficiency.json b/dashboards/gpu/gpu-efficiency.json
new file mode 100644
index 00000000..cc2bca6c
--- /dev/null
+++ b/dashboards/gpu/gpu-efficiency.json
@@ -0,0 +1,1131 @@
+{
+  "__inputs": [
+    {
+      "name": "DS_VM-SHORTTERM",
+      "label": "vm-shortterm",
+      "description": "",
+      "type": "datasource",
+      "pluginId": "prometheus",
+      "pluginName": "Prometheus"
+    }
+  ],
+  "__elements": {},
+  "__requires": [
+    {
+      "type": "grafana",
+      "id": "grafana",
+      "name": "Grafana",
+      "version": "11.4.0"
+    },
+    {
+      "type": "datasource",
+      "id": "prometheus",
+      "name": "Prometheus",
+      "version": "1.0.0"
+    },
+    {
+      "type": "panel",
+      "id": "stat",
+      "name": "Stat",
+      "version": ""
+    },
+    {
+      "type": "panel",
+      "id": "table",
+      "name": "Table",
+      "version": ""
+    },
+    {
+      "type": "panel",
+      "id": "timeseries",
+      "name": "Time series",
+      "version": ""
+    }
+  ],
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": {
+          "type": "grafana",
+          "uid": "-- Grafana --"
+        },
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "type": "dashboard"
+      }
+    ]
+  },
+  "description": "Tensor saturation, util/watt and throttling \u2014 reveals inefficient GPU workloads",
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 1,
+  "id": null,
+  "links": [],
+  "panels": [
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 0
+      },
+      "id": 1,
+      "panels": [],
+      "title": "\u041e\u0431\u0449\u0438\u0435 \u043c\u0435\u0442\u0440\u0438\u043a\u0438 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${ds_prometheus}"
+      },
+      "description": "\u0421\u0440\u0435\u0434\u043d\u044f\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0442\u0435\u043d\u0437\u043e\u0440\u043d\u044b\u0445 \u044f\u0434\u0435\u0440. <10% \u2014 GPU \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043d\u0435\u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e (\u043a\u043b\u0438\u0435\u043d\u0442\u044b \u043c\u043e\u0433\u043b\u0438 \u0431\u044b \u043f\u0435\u0440\u0435\u0435\u0445\u0430\u0442\u044c \u043d\u0430 CPU \u0438\u043b\u0438 \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043e\u0434).",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "max": 100,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "red",
+                "value": null
+              },
+              {
+                "color": "orange",
+                "value": 10
+              },
+              {
+                "color": "yellow",
+                "value": 30
+              },
+              {
+                "color": "green",
+                "value": 60
+              }
+            ]
+          },
+          "unit": "percent"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 8,
+        "x": 0,
+        "y": 1
+      },
+      "id": 2,
+      "options": {
+        "colorMode": "background",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "value",
+        "wideLayout": true
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "avg(pod:tensor_saturation:avg5m)",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${ds_prometheus}"
+          }
+        }
+      ],
+      "title": "Cluster Tensor Saturation",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_VM-SHORTTERM}"
+      },
+      "description": "NVML utilization % \u043d\u0430 \u043a\u0430\u0436\u0434\u044b\u0439 \u0432\u0430\u0442\u0442. \u0412\u044b\u0441\u043e\u043a\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 = \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u0430\u044f \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "decimals": 3,
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "red",
+                "value": null
+              },
+              {
+                "color": "yellow",
+                "value": 0.5
+              },
+              {
+                "color": "green",
+                "value": 1
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 8,
+        "x": 8,
+        "y": 1
+      },
+      "id": 3,
+      "options": {
+        "colorMode": "background",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "value",
+        "wideLayout": true
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "avg(pod:util_per_watt:avg5m)",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_VM-SHORTTERM}"
+          }
+        }
+      ],
+      "title": "Avg Utilization per Watt",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${ds_prometheus}"
+      },
+      "description": "\u0414\u043e\u043b\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438, \u043a\u043e\u0433\u0434\u0430 GPU \u0443\u043f\u0438\u0440\u0430\u044e\u0442\u0441\u044f \u0432 TDP \u0438 \u0442\u0435\u0440\u044f\u044e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c. >5% \u2014 \u043a\u043b\u0438\u0435\u043d\u0442\u044b \u043d\u0435\u0434\u043e\u043f\u043e\u043b\u0443\u0447\u0430\u044e\u0442 FLOPS.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "decimals": 2,
+          "mappings": [],
+          "max": 100,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "yellow",
+                "value": 5
+              },
+              {
+                "color": "red",
+                "value": 20
+              }
+            ]
+          },
+          "unit": "percent"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 8,
+        "x": 16,
+        "y": 1
+      },
+      "id": 4,
+      "options": {
+        "colorMode": "background",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "value",
+        "wideLayout": true
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "avg(gpu:power_throttle_fraction:rate5m) * 100",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${ds_prometheus}"
+          }
+        }
+      ],
+      "title": "Avg Power Throttling",
+      "type": "stat"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 6
+      },
+      "id": 10,
+      "panels": [],
+      "title": "NVML vs Tensor (\u043a\u0442\u043e \u043e\u0431\u043c\u0430\u043d\u044b\u0432\u0430\u0435\u0442\u0441\u044f)",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_VM-SHORTTERM}"
+      },
+      "description": "\u041a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043c\u0435\u0442\u0440\u0438\u043a\u0430 \u0443\u0442\u0438\u043b\u0438\u0437\u0430\u0446\u0438\u0438. \u041f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0437\u0430\u043d\u044f\u0442\u043e\u0441\u0442\u044c \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u0432\u0438\u0436\u043a\u0430 (SM, copy, encoder).",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "max": 100,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percent"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 7
+      },
+      "id": 11,
+      "options": {
+        "legend": {
+          "calcs": [
+            "mean",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "DCGM_FI_DEV_GPU_UTIL{namespace=~\"$namespace\", namespace!=\"\"}",
+          "legendFormat": "{{namespace}}/{{pod}}",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_VM-SHORTTERM}"
+          }
+        }
+      ],
+      "title": "NVML GPU Utilization",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${ds_prometheus}"
+      },
+      "description": "\u0420\u0435\u0430\u043b\u044c\u043d\u0430\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0442\u0435\u043d\u0437\u043e\u0440\u043d\u044b\u0445 \u044f\u0434\u0435\u0440 (HMMA). \u0414\u043b\u044f AI/LLM \u0438\u043d\u0444\u0435\u0440\u0435\u043d\u0441\u0430 \u0434\u043e\u043b\u0436\u043d\u0430 \u0431\u044b\u0442\u044c \u226520%, \u0438\u043d\u0430\u0447\u0435 workload \u043d\u0435 \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "max": 100,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percent"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 7
+      },
+      "id": 12,
+      "options": {
+        "legend": {
+          "calcs": [
+            "mean",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{namespace=~\"$namespace\", namespace!=\"\"} * 100",
+          "legendFormat": "{{namespace}}/{{pod}}",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${ds_prometheus}"
+          }
+        }
+      ],
+      "title": "Tensor Pipe Active",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 15
+      },
+      "id": 20,
+      "panels": [],
+      "title": "Per-pod \u0440\u0435\u0439\u0442\u0438\u043d\u0433",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_VM-SHORTTERM}"
+      },
+      "description": "\u041a\u0442\u043e \u0436\u043c\u0451\u0442 \u0442\u0435\u043d\u0437\u043e\u0440\u043d\u044b\u0435 \u044f\u0434\u0440\u0430, \u0430 \u043a\u0442\u043e \u043d\u0435\u0442. \u0421\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u043a\u0430 \u043e\u0442 \u043c\u0430\u043a\u0441\u0438\u043c\u0443\u043c\u0430.",
+      "fieldConfig": {
+        "defaults": {
+          "custom": {
+            "align": "auto",
+            "cellOptions": {
+              "type": "auto"
+            },
+            "inspect": false
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Saturation"
+            },
+            "properties": [
+              {
+                "id": "unit",
+                "value": "percent"
+              },
+              {
+                "id": "min",
+                "value": 0
+              },
+              {
+                "id": "max",
+                "value": 100
+              },
+              {
+                "id": "custom.cellOptions",
+                "value": {
+                  "mode": "gradient",
+                  "type": "gauge"
+                }
+              },
+              {
+                "id": "thresholds",
+                "value": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "red",
+                      "value": null
+                    },
+                    {
+                      "color": "orange",
+                      "value": 10
+                    },
+                    {
+                      "color": "yellow",
+                      "value": 30
+                    },
+                    {
+                      "color": "green",
+                      "value": 60
+                    }
+                  ]
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 16
+      },
+      "id": 21,
+      "options": {
+        "cellHeight": "sm",
+        "footer": {
+          "countRows": false,
+          "fields": "",
+          "reducer": [
+            "sum"
+          ],
+          "show": false
+        },
+        "showHeader": true,
+        "sortBy": [
+          {
+            "desc": true,
+            "displayName": "Saturation"
+          }
+        ]
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "topk(20, pod:tensor_saturation:avg5m)",
+          "format": "table",
+          "instant": true,
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_VM-SHORTTERM}"
+          }
+        }
+      ],
+      "title": "Tensor Saturation per pod (5m avg)",
+      "transformations": [
+        {
+          "id": "organize",
+          "options": {
+            "excludeByName": {
+              "Hostname": true,
+              "Time": true,
+              "UUID": true,
+              "__name__": true,
+              "cluster": true,
+              "container": true,
+              "endpoint": true,
+              "gpu": true,
+              "instance": true,
+              "job": true,
+              "modelName": true,
+              "prometheus": true,
+              "service": true,
+              "tenant": true,
+              "tier": true,
+              "uid": true,
+              "unit": true
+            },
+            "indexByName": {
+              "Value": 2,
+              "namespace": 0,
+              "pod": 1
+            },
+            "renameByName": {
+              "Value": "Saturation",
+              "namespace": "Namespace",
+              "pod": "Pod"
+            }
+          }
+        }
+      ],
+      "type": "table"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${ds_prometheus}"
+      },
+      "description": "\u041d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u043a\u0430\u0436\u0434\u044b\u0439 \u043f\u043e\u0434 \u0442\u0440\u0430\u0442\u0438\u0442 \u0432\u0430\u0442\u0442\u044b. \u041d\u0438\u0437\u043a\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 = \u043f\u043b\u043e\u0445\u0430\u044f \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044f.",
+      "fieldConfig": {
+        "defaults": {
+          "custom": {
+            "align": "auto",
+            "cellOptions": {
+              "type": "auto"
+            },
+            "inspect": false
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Util/Watt"
+            },
+            "properties": [
+              {
+                "id": "unit",
+                "value": "none"
+              },
+              {
+                "id": "decimals",
+                "value": 3
+              },
+              {
+                "id": "min",
+                "value": 0
+              },
+              {
+                "id": "max",
+                "value": 1.5
+              },
+              {
+                "id": "custom.cellOptions",
+                "value": {
+                  "mode": "gradient",
+                  "type": "gauge"
+                }
+              },
+              {
+                "id": "thresholds",
+                "value": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "red",
+                      "value": null
+                    },
+                    {
+                      "color": "yellow",
+                      "value": 0.5
+                    },
+                    {
+                      "color": "green",
+                      "value": 1
+                    }
+                  ]
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 16
+      },
+      "id": 22,
+      "options": {
+        "cellHeight": "sm",
+        "footer": {
+          "countRows": false,
+          "fields": "",
+          "reducer": [
+            "sum"
+          ],
+          "show": false
+        },
+        "showHeader": true,
+        "sortBy": [
+          {
+            "desc": true,
+            "displayName": "Util/Watt"
+          }
+        ]
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "topk(20, pod:util_per_watt:avg5m)",
+          "format": "table",
+          "instant": true,
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${ds_prometheus}"
+          }
+        }
+      ],
+      "title": "Utilization / Watt per pod (5m avg)",
+      "transformations": [
+        {
+          "id": "organize",
+          "options": {
+            "excludeByName": {
+              "Hostname": true,
+              "Time": true,
+              "UUID": true,
+              "__name__": true,
+              "cluster": true,
+              "container": true,
+              "endpoint": true,
+              "gpu": true,
+              "instance": true,
+              "job": true,
+              "modelName": true,
+              "prometheus": true,
+              "service": true,
+              "tenant": true,
+              "tier": true,
+              "uid": true,
+              "unit": true
+            },
+            "indexByName": {
+              "Value": 2,
+              "namespace": 0,
+              "pod": 1
+            },
+            "renameByName": {
+              "Value": "Util/Watt",
+              "namespace": "Namespace",
+              "pod": "Pod"
+            }
+          }
+        }
+      ],
+      "type": "table"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 24
+      },
+      "id": 30,
+      "panels": [],
+      "title": "Throttling",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_VM-SHORTTERM}"
+      },
+      "description": "\u0414\u043e\u043b\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438, \u043a\u043e\u0433\u0434\u0430 GPU \u0434\u0440\u043e\u0441\u0441\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043f\u043e \u043f\u0438\u0442\u0430\u043d\u0438\u044e. 1.0 = \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 25,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "max": 1,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "yellow",
+                "value": 0.05
+              },
+              {
+                "color": "red",
+                "value": 0.2
+              }
+            ]
+          },
+          "unit": "percentunit"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 25
+      },
+      "id": 31,
+      "options": {
+        "legend": {
+          "calcs": [
+            "mean",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "gpu:power_throttle_fraction:rate5m",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_VM-SHORTTERM}"
+          }
+        }
+      ],
+      "title": "Power throttle fraction per GPU",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${ds_prometheus}"
+      },
+      "description": "\u0414\u043e\u043b\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438, \u043a\u043e\u0433\u0434\u0430 GPU \u0434\u0440\u043e\u0441\u0441\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043f\u043e \u0442\u0435\u043c\u043f\u0435\u0440\u0430\u0442\u0443\u0440\u0435.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 25,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "max": 1,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "yellow",
+                "value": 0.05
+              },
+              {
+                "color": "red",
+                "value": 0.2
+              }
+            ]
+          },
+          "unit": "percentunit"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 25
+      },
+      "id": 32,
+      "options": {
+        "legend": {
+          "calcs": [
+            "mean",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "gpu:thermal_throttle_fraction:rate5m",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${ds_prometheus}"
+          }
+        }
+      ],
+      "title": "Thermal throttle fraction per GPU",
+      "type": "timeseries"
+    }
+  ],
+  "refresh": "",
+  "schemaVersion": 40,
+  "tags": [
+    "gpu",
+    "efficiency",
+    "finops"
+  ],
+  "templating": {
+    "list": [
+      {
+        "current": {},
+        "includeAll": false,
+        "label": "Datasource",
+        "name": "ds_prometheus",
+        "options": [],
+        "query": "prometheus",
+        "refresh": 1,
+        "regex": "vm-.*",
+        "type": "datasource"
+      },
+      {
+        "current": {},
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${DS_VM-SHORTTERM}"
+        },
+        "definition": "label_values(DCGM_FI_DEV_GPU_UTIL{namespace!=\"\",namespace!~\"cozy-.*|kube-.*\"}, namespace)",
+        "includeAll": true,
+        "label": "Namespace",
+        "multi": true,
+        "name": "namespace",
+        "options": [],
+        "query": {
+          "query": "label_values(DCGM_FI_DEV_GPU_UTIL{namespace!=\"\",namespace!~\"cozy-.*|kube-.*\"}, namespace)",
+          "refId": "StandardVariableQuery"
+        },
+        "refresh": 2,
+        "regex": "",
+        "sort": 1,
+        "type": "query"
+      }
+    ]
+  },
+  "time": {
+    "from": "now-1h",
+    "to": "now"
+  },
+  "timepicker": {},
+  "timezone": "",
+  "title": "GPU Efficiency Score",
+  "uid": "gpu-efficiency",
+  "version": 2,
+  "weekStart": ""
+}
\ No newline at end of file
diff --git a/dashboards/gpu/gpu-performance.json b/dashboards/gpu/gpu-performance.json
index 0b458d4e..906d6a11 100644
--- a/dashboards/gpu/gpu-performance.json
+++ b/dashboards/gpu/gpu-performance.json
@@ -1,120 +1,100 @@
 {
+  "__inputs": [
+    {
+      "name": "DS_VM-SHORTTERM",
+      "label": "vm-shortterm",
+      "description": "",
+      "type": "datasource",
+      "pluginId": "prometheus",
+      "pluginName": "Prometheus"
+    }
+  ],
+  "__elements": {},
+  "__requires": [
+    {
+      "type": "grafana",
+      "id": "grafana",
+      "name": "Grafana",
+      "version": "11.4.0"
+    },
+    {
+      "type": "datasource",
+      "id": "prometheus",
+      "name": "Prometheus",
+      "version": "1.0.0"
+    },
+    {
+      "type": "panel",
+      "id": "stat",
+      "name": "Stat",
+      "version": ""
+    },
+    {
+      "type": "panel",
+      "id": "timeseries",
+      "name": "Time series",
+      "version": ""
+    }
+  ],
   "annotations": {
-    "list": []
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": {
+          "type": "grafana",
+          "uid": "-- Grafana --"
+        },
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "type": "dashboard"
+      }
+    ]
   },
   "editable": true,
   "fiscalYearStartMonth": 0,
   "graphTooltip": 1,
   "id": null,
   "links": [],
-  "liveNow": false,
-  "schemaVersion": 39,
-  "tags": [
-    "gpu",
-    "dcgm"
-  ],
-  "templating": {
-    "list": [
-      {
-        "current": {
-          "selected": false,
-          "text": "default",
-          "value": "default"
-        },
-        "hide": 0,
-        "includeAll": false,
-        "label": "Prometheus",
-        "multi": false,
-        "name": "ds_prometheus",
-        "options": [],
-        "query": "prometheus",
-        "refresh": 1,
-        "regex": "",
-        "skipUrlSync": false,
-        "type": "datasource"
-      },
-      {
-        "current": {
-          "selected": true,
-          "text": "All",
-          "value": "$__all"
-        },
-        "datasource": {
-          "type": "prometheus",
-          "uid": "$ds_prometheus"
-        },
-        "definition": "label_values(DCGM_FI_DEV_GPU_UTIL, Hostname)",
-        "hide": 0,
-        "includeAll": true,
-        "label": "Host",
-        "multi": true,
-        "name": "Hostname",
-        "options": [],
-        "query": {
-          "query": "label_values(DCGM_FI_DEV_GPU_UTIL, Hostname)",
-          "refId": "StandardVariableQuery"
-        },
-        "refresh": 2,
-        "regex": "",
-        "skipUrlSync": false,
-        "sort": 1,
-        "type": "query"
-      },
-      {
-        "current": {
-          "selected": true,
-          "text": "All",
-          "value": "$__all"
-        },
-        "datasource": {
-          "type": "prometheus",
-          "uid": "$ds_prometheus"
-        },
-        "definition": "label_values(DCGM_FI_DEV_GPU_UTIL{namespace!=\"\",namespace!~\"cozy-.*|kube-.*\"}, namespace)",
-        "hide": 0,
-        "includeAll": true,
-        "label": "Namespace",
-        "multi": true,
-        "name": "namespace",
-        "options": [],
-        "query": {
-          "query": "label_values(DCGM_FI_DEV_GPU_UTIL{namespace!=\"\",namespace!~\"cozy-.*|kube-.*\"}, namespace)",
-          "refId": "StandardVariableQuery"
-        },
-        "refresh": 2,
-        "regex": "",
-        "skipUrlSync": false,
-        "sort": 1,
-        "type": "query"
-      }
-    ]
-  },
-  "time": {
-    "from": "now-1h",
-    "to": "now"
-  },
-  "timepicker": {},
-  "timezone": "",
-  "title": "GPU Performance",
-  "uid": "gpu-performance",
-  "weekStart": "",
   "panels": [
     {
-      "type": "row",
-      "title": "Overview",
+      "collapsed": false,
       "gridPos": {
         "h": 1,
         "w": 24,
         "x": 0,
         "y": 0
       },
-      "collapsed": false,
       "id": 1,
-      "panels": []
+      "panels": [],
+      "title": "Overview",
+      "type": "row"
     },
     {
-      "type": "stat",
-      "title": "Total GPUs",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "blue",
+                "value": null
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
       "gridPos": {
         "h": 4,
         "w": 6,
@@ -122,36 +102,12 @@
         "y": 1
       },
       "id": 2,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "targets": [
-        {
-          "expr": "cluster:gpu_count:total",
-          "refId": "A"
-        }
-      ],
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "color": {
-            "mode": "thresholds"
-          },
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "blue"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      },
       "options": {
         "colorMode": "value",
         "graphMode": "none",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
@@ -159,35 +115,35 @@
           "fields": "",
           "values": false
         },
-        "textMode": "value"
-      }
-    },
-    {
-      "type": "stat",
-      "title": "Allocated",
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 6,
-        "y": 1
-      },
-      "id": 3,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
+        "showPercentChange": false,
+        "textMode": "value",
+        "wideLayout": true
       },
+      "pluginVersion": "11.4.0",
       "targets": [
         {
-          "expr": "cluster:gpu_count:allocated",
-          "refId": "A"
+          "expr": "cluster:gpu_count:total",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "$ds_prometheus"
+          }
         }
       ],
+      "title": "Total GPUs",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_VM-SHORTTERM}"
+      },
       "fieldConfig": {
         "defaults": {
-          "unit": "short",
           "color": {
             "mode": "thresholds"
           },
+          "mappings": [],
           "thresholds": {
             "mode": "absolute",
             "steps": [
@@ -200,13 +156,24 @@
                 "value": 1
               }
             ]
-          }
+          },
+          "unit": "short"
         },
         "overrides": []
       },
+      "gridPos": {
+        "h": 4,
+        "w": 6,
+        "x": 6,
+        "y": 1
+      },
+      "id": 3,
       "options": {
         "colorMode": "value",
         "graphMode": "none",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
@@ -214,37 +181,37 @@
           "fields": "",
           "values": false
         },
-        "textMode": "value"
-      }
+        "showPercentChange": false,
+        "textMode": "value",
+        "wideLayout": true
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "cluster:gpu_count:allocated",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_VM-SHORTTERM}"
+          }
+        }
+      ],
+      "title": "Allocated",
+      "type": "stat"
     },
     {
-      "type": "stat",
-      "title": "Average utilization",
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 12,
-        "y": 1
-      },
-      "id": 4,
       "datasource": {
         "type": "prometheus",
         "uid": "$ds_prometheus"
       },
-      "targets": [
-        {
-          "expr": "cluster:gpu_util:avg",
-          "refId": "A"
-        }
-      ],
       "fieldConfig": {
         "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
           "color": {
             "mode": "thresholds"
           },
+          "mappings": [],
+          "max": 100,
+          "min": 0,
           "thresholds": {
             "mode": "absolute",
             "steps": [
@@ -261,13 +228,24 @@
                 "value": 80
               }
             ]
-          }
+          },
+          "unit": "percent"
         },
         "overrides": []
       },
+      "gridPos": {
+        "h": 4,
+        "w": 6,
+        "x": 12,
+        "y": 1
+      },
+      "id": 4,
       "options": {
         "colorMode": "value",
         "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
@@ -275,12 +253,49 @@
           "fields": "",
           "values": false
         },
-        "textMode": "value"
-      }
+        "showPercentChange": false,
+        "textMode": "value",
+        "wideLayout": true
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "cluster:gpu_util:avg",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "$ds_prometheus"
+          }
+        }
+      ],
+      "title": "Average utilization",
+      "type": "stat"
     },
     {
-      "type": "stat",
-      "title": "Power draw",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_VM-SHORTTERM}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "decimals": 0,
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          },
+          "unit": "watt"
+        },
+        "overrides": []
+      },
       "gridPos": {
         "h": 4,
         "w": 6,
@@ -288,37 +303,12 @@
         "y": 1
       },
       "id": 5,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "targets": [
-        {
-          "expr": "cluster:gpu_power_watts:sum",
-          "refId": "A"
-        }
-      ],
-      "fieldConfig": {
-        "defaults": {
-          "unit": "watt",
-          "decimals": 0,
-          "color": {
-            "mode": "thresholds"
-          },
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      },
       "options": {
         "colorMode": "value",
         "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
@@ -326,25 +316,100 @@
           "fields": "",
           "values": false
         },
-        "textMode": "value"
-      }
+        "showPercentChange": false,
+        "textMode": "value",
+        "wideLayout": true
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "cluster:gpu_power_watts:sum",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_VM-SHORTTERM}"
+          }
+        }
+      ],
+      "title": "Power draw",
+      "type": "stat"
     },
     {
-      "type": "row",
-      "title": "Utilization",
+      "collapsed": false,
       "gridPos": {
         "h": 1,
         "w": 24,
         "x": 0,
         "y": 5
       },
-      "collapsed": false,
       "id": 10,
-      "panels": []
+      "panels": [],
+      "title": "Utilization",
+      "type": "row"
     },
     {
-      "type": "timeseries",
-      "title": "GPU Utilization (NVML)",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "max": 100,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percent"
+        },
+        "overrides": []
+      },
       "gridPos": {
         "h": 8,
         "w": 12,
@@ -352,49 +417,99 @@
         "y": 6
       },
       "id": 11,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
+      "options": {
+        "legend": {
+          "calcs": [
+            "mean",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
       },
+      "pluginVersion": "11.4.0",
       "targets": [
         {
           "expr": "DCGM_FI_DEV_GPU_UTIL{Hostname=~\"$Hostname\", namespace=~\"$namespace\"}",
           "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A"
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "$ds_prometheus"
+          }
         }
       ],
+      "title": "GPU Utilization (NVML)",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_VM-SHORTTERM}"
+      },
       "fieldConfig": {
         "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
+          "color": {
+            "mode": "palette-classic"
+          },
           "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
             "drawStyle": "line",
-            "lineInterpolation": "linear",
             "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
             "showPoints": "never",
-            "spanNulls": false
-          }
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "max": 100,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percent"
         },
         "overrides": []
       },
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi"
-        }
-      }
-    },
-    {
-      "type": "timeseries",
-      "title": "Tensor Pipe Active (realistic load for LLM/AI)",
       "gridPos": {
         "h": 8,
         "w": 12,
@@ -402,49 +517,99 @@
         "y": 6
       },
       "id": 12,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
+      "options": {
+        "legend": {
+          "calcs": [
+            "mean",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
       },
+      "pluginVersion": "11.4.0",
       "targets": [
         {
           "expr": "DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{Hostname=~\"$Hostname\", namespace=~\"$namespace\"} * 100",
           "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A"
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_VM-SHORTTERM}"
+          }
         }
       ],
+      "title": "Tensor Pipe Active (realistic load for LLM/AI)",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
       "fieldConfig": {
         "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
+          "color": {
+            "mode": "palette-classic"
+          },
           "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
             "drawStyle": "line",
-            "lineInterpolation": "linear",
             "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
             "showPoints": "never",
-            "spanNulls": false
-          }
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "max": 100,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percent"
         },
         "overrides": []
       },
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi"
-        }
-      }
-    },
-    {
-      "type": "timeseries",
-      "title": "Graphics Engine Active",
       "gridPos": {
         "h": 8,
         "w": 12,
@@ -452,49 +617,99 @@
         "y": 14
       },
       "id": 13,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
+      "options": {
+        "legend": {
+          "calcs": [
+            "mean",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
       },
+      "pluginVersion": "11.4.0",
       "targets": [
         {
           "expr": "DCGM_FI_PROF_GR_ENGINE_ACTIVE{Hostname=~\"$Hostname\", namespace=~\"$namespace\"} * 100",
           "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A"
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "$ds_prometheus"
+          }
         }
       ],
+      "title": "Graphics Engine Active",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_VM-SHORTTERM}"
+      },
       "fieldConfig": {
         "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
+          "color": {
+            "mode": "palette-classic"
+          },
           "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
             "drawStyle": "line",
-            "lineInterpolation": "linear",
             "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
             "showPoints": "never",
-            "spanNulls": false
-          }
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "max": 100,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percent"
         },
         "overrides": []
       },
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi"
-        }
-      }
-    },
-    {
-      "type": "timeseries",
-      "title": "Memory Copy Utilization",
       "gridPos": {
         "h": 8,
         "w": 12,
@@ -502,62 +717,110 @@
         "y": 14
       },
       "id": 14,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
+      "options": {
+        "legend": {
+          "calcs": [
+            "mean",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
       },
+      "pluginVersion": "11.4.0",
       "targets": [
         {
           "expr": "DCGM_FI_DEV_MEM_COPY_UTIL{Hostname=~\"$Hostname\", namespace=~\"$namespace\"}",
           "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A"
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_VM-SHORTTERM}"
+          }
         }
       ],
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never",
-            "spanNulls": false
-          }
-        },
-        "overrides": []
-      },
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi"
-        }
-      }
+      "title": "Memory Copy Utilization",
+      "type": "timeseries"
     },
     {
-      "type": "row",
-      "title": "Memory",
+      "collapsed": false,
       "gridPos": {
         "h": 1,
         "w": 24,
         "x": 0,
         "y": 22
       },
-      "collapsed": false,
       "id": 20,
-      "panels": []
+      "panels": [],
+      "title": "Memory",
+      "type": "row"
     },
     {
-      "type": "timeseries",
-      "title": "VRAM Used",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 25,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "bytes"
+        },
+        "overrides": []
+      },
       "gridPos": {
         "h": 8,
         "w": 12,
@@ -565,49 +828,97 @@
         "y": 23
       },
       "id": 21,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
+      "options": {
+        "legend": {
+          "calcs": [
+            "mean",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
       },
+      "pluginVersion": "11.4.0",
       "targets": [
         {
           "expr": "DCGM_FI_DEV_FB_USED{Hostname=~\"$Hostname\", namespace=~\"$namespace\"} * 1048576",
           "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A"
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "$ds_prometheus"
+          }
         }
       ],
+      "title": "VRAM Used",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_VM-SHORTTERM}"
+      },
       "fieldConfig": {
         "defaults": {
-          "unit": "bytes",
+          "color": {
+            "mode": "palette-classic"
+          },
           "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
             "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
             "lineInterpolation": "linear",
-            "fillOpacity": 25,
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
             "showPoints": "never",
+            "spanNulls": false,
             "stacking": {
+              "group": "A",
               "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
             }
-          }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "bytes"
         },
         "overrides": []
       },
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi"
-        }
-      }
-    },
-    {
-      "type": "timeseries",
-      "title": "VRAM Free",
       "gridPos": {
         "h": 8,
         "w": 12,
@@ -615,59 +926,110 @@
         "y": 23
       },
       "id": 22,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
+      "options": {
+        "legend": {
+          "calcs": [
+            "mean",
+            "min"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
       },
+      "pluginVersion": "11.4.0",
       "targets": [
         {
           "expr": "DCGM_FI_DEV_FB_FREE{Hostname=~\"$Hostname\"} * 1048576",
           "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_VM-SHORTTERM}"
+          }
         }
       ],
-      "fieldConfig": {
-        "defaults": {
-          "unit": "bytes",
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      },
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "calcs": [
-            "mean",
-            "min"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi"
-        }
-      }
+      "title": "VRAM Free",
+      "type": "timeseries"
     },
     {
-      "type": "row",
-      "title": "Power & Temperature",
+      "collapsed": false,
       "gridPos": {
         "h": 1,
         "w": 24,
         "x": 0,
         "y": 31
       },
-      "collapsed": false,
       "id": 30,
-      "panels": []
+      "panels": [],
+      "title": "Power & Temperature",
+      "type": "row"
     },
     {
-      "type": "timeseries",
-      "title": "Power Usage per GPU",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "watt"
+        },
+        "overrides": []
+      },
       "gridPos": {
         "h": 8,
         "w": 12,
@@ -675,80 +1037,88 @@
         "y": 32
       },
       "id": 31,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
+      "options": {
+        "legend": {
+          "calcs": [
+            "mean",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
       },
+      "pluginVersion": "11.4.0",
       "targets": [
         {
           "expr": "DCGM_FI_DEV_POWER_USAGE{Hostname=~\"$Hostname\"}",
           "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "$ds_prometheus"
+          }
         }
       ],
-      "fieldConfig": {
-        "defaults": {
-          "unit": "watt",
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      },
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi"
-        }
-      }
+      "title": "Power Usage per GPU",
+      "type": "timeseries"
     },
     {
-      "type": "timeseries",
-      "title": "GPU Temperature",
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 32
-      },
-      "id": 32,
       "datasource": {
         "type": "prometheus",
-        "uid": "$ds_prometheus"
+        "uid": "${DS_VM-SHORTTERM}"
       },
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_GPU_TEMP{Hostname=~\"$Hostname\"}",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
       "fieldConfig": {
         "defaults": {
-          "unit": "celsius",
-          "min": 20,
-          "max": 100,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
+          "color": {
+            "mode": "palette-classic"
           },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "max": 100,
+          "min": 20,
           "thresholds": {
             "mode": "absolute",
             "steps": [
               {
-                "color": "green"
+                "color": "green",
+                "value": null
               },
               {
                 "color": "yellow",
@@ -759,61 +1129,68 @@
                 "value": 85
               }
             ]
-          }
+          },
+          "unit": "celsius"
         },
         "overrides": []
       },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 32
+      },
+      "id": 32,
       "options": {
         "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
           "calcs": [
             "mean",
             "max"
-          ]
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
         },
         "tooltip": {
-          "mode": "multi"
+          "mode": "multi",
+          "sort": "none"
         }
-      }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "DCGM_FI_DEV_GPU_TEMP{Hostname=~\"$Hostname\"}",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_VM-SHORTTERM}"
+          }
+        }
+      ],
+      "title": "GPU Temperature",
+      "type": "timeseries"
     },
     {
-      "type": "row",
-      "title": "Health",
+      "collapsed": false,
       "gridPos": {
         "h": 1,
         "w": 24,
         "x": 0,
         "y": 40
       },
-      "collapsed": false,
       "id": 40,
-      "panels": []
+      "panels": [],
+      "title": "Health",
+      "type": "row"
     },
     {
-      "type": "stat",
-      "title": "XID errors (latest)",
-      "gridPos": {
-        "h": 5,
-        "w": 8,
-        "x": 0,
-        "y": 41
-      },
-      "id": 41,
       "datasource": {
         "type": "prometheus",
         "uid": "$ds_prometheus"
       },
-      "targets": [
-        {
-          "expr": "max by (Hostname, gpu) (DCGM_FI_DEV_XID_ERRORS{Hostname=~\"$Hostname\"})",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
       "fieldConfig": {
         "defaults": {
-          "unit": "short",
           "color": {
             "mode": "thresholds"
           },
@@ -828,10 +1205,18 @@
                 "value": 1
               }
             ]
-          }
+          },
+          "unit": "short"
         },
         "overrides": []
       },
+      "gridPos": {
+        "h": 5,
+        "w": 8,
+        "x": 0,
+        "y": 41
+      },
+      "id": 41,
       "options": {
         "colorMode": "background",
         "graphMode": "none",
@@ -843,11 +1228,38 @@
           "values": false
         },
         "textMode": "value_and_name"
-      }
+      },
+      "targets": [
+        {
+          "expr": "max by (Hostname, gpu) (DCGM_FI_DEV_XID_ERRORS{Hostname=~\"$Hostname\"})",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "$ds_prometheus"
+          }
+        }
+      ],
+      "title": "XID errors (latest)",
+      "type": "stat"
     },
     {
-      "type": "timeseries",
-      "title": "Power Violation (\u00b5s/s throttled due to power)",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_VM-SHORTTERM}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "custom": {
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "lineInterpolation": "linear",
+            "showPoints": "never"
+          },
+          "unit": "µs"
+        },
+        "overrides": []
+      },
       "gridPos": {
         "h": 5,
         "w": 8,
@@ -855,29 +1267,6 @@
         "y": 41
       },
       "id": 42,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "targets": [
-        {
-          "expr": "rate(DCGM_FI_DEV_POWER_VIOLATION{Hostname=~\"$Hostname\"}[5m])",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "fieldConfig": {
-        "defaults": {
-          "unit": "\u00b5s",
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      },
       "options": {
         "legend": {
           "displayMode": "list",
@@ -886,11 +1275,38 @@
         "tooltip": {
           "mode": "multi"
         }
-      }
+      },
+      "targets": [
+        {
+          "expr": "rate(DCGM_FI_DEV_POWER_VIOLATION{Hostname=~\"$Hostname\"}[5m])",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_VM-SHORTTERM}"
+          }
+        }
+      ],
+      "title": "Power Violation (µs/s throttled due to power)",
+      "type": "timeseries"
     },
     {
-      "type": "timeseries",
-      "title": "Thermal Violation (\u00b5s/s throttled due to thermals)",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "custom": {
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "lineInterpolation": "linear",
+            "showPoints": "never"
+          },
+          "unit": "µs"
+        },
+        "overrides": []
+      },
       "gridPos": {
         "h": 5,
         "w": 8,
@@ -898,29 +1314,6 @@
         "y": 41
       },
       "id": 43,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "targets": [
-        {
-          "expr": "rate(DCGM_FI_DEV_THERMAL_VIOLATION{Hostname=~\"$Hostname\"}[5m])",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "fieldConfig": {
-        "defaults": {
-          "unit": "\u00b5s",
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      },
       "options": {
         "legend": {
           "displayMode": "list",
@@ -929,7 +1322,93 @@
         "tooltip": {
           "mode": "multi"
         }
-      }
+      },
+      "targets": [
+        {
+          "expr": "rate(DCGM_FI_DEV_THERMAL_VIOLATION{Hostname=~\"$Hostname\"}[5m])",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "$ds_prometheus"
+          }
+        }
+      ],
+      "title": "Thermal Violation (µs/s throttled due to thermals)",
+      "type": "timeseries"
     }
-  ]
-}
\ No newline at end of file
+  ],
+  "refresh": "",
+  "schemaVersion": 40,
+  "tags": [
+    "gpu",
+    "dcgm"
+  ],
+  "templating": {
+    "list": [
+      {
+        "current": {},
+        "includeAll": false,
+        "label": "Prometheus",
+        "name": "ds_prometheus",
+        "options": [],
+        "query": "prometheus",
+        "refresh": 1,
+        "regex": "",
+        "type": "datasource"
+      },
+      {
+        "current": {},
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${DS_VM-SHORTTERM}"
+        },
+        "definition": "label_values(DCGM_FI_DEV_GPU_UTIL, Hostname)",
+        "includeAll": true,
+        "label": "Host",
+        "multi": true,
+        "name": "Hostname",
+        "options": [],
+        "query": {
+          "query": "label_values(DCGM_FI_DEV_GPU_UTIL, Hostname)",
+          "refId": "StandardVariableQuery"
+        },
+        "refresh": 2,
+        "regex": "",
+        "sort": 1,
+        "type": "query"
+      },
+      {
+        "current": {},
+        "datasource": {
+          "type": "prometheus",
+          "uid": "$ds_prometheus"
+        },
+        "definition": "label_values(DCGM_FI_DEV_GPU_UTIL{namespace!=\"\",namespace!~\"cozy-.*|kube-.*\"}, namespace)",
+        "includeAll": true,
+        "label": "Namespace",
+        "multi": true,
+        "name": "namespace",
+        "options": [],
+        "query": {
+          "query": "label_values(DCGM_FI_DEV_GPU_UTIL{namespace!=\"\",namespace!~\"cozy-.*|kube-.*\"}, namespace)",
+          "refId": "StandardVariableQuery"
+        },
+        "refresh": 2,
+        "regex": "",
+        "sort": 1,
+        "type": "query"
+      }
+    ]
+  },
+  "time": {
+    "from": "now-1h",
+    "to": "now"
+  },
+  "timepicker": {},
+  "timezone": "",
+  "title": "GPU Performance",
+  "uid": "gpu-performance",
+  "version": 2,
+  "weekStart": ""
+}
diff --git a/dashboards/gpu/gpu-quotas.json b/dashboards/gpu/gpu-quotas.json
new file mode 100644
index 00000000..28f2c892
--- /dev/null
+++ b/dashboards/gpu/gpu-quotas.json
@@ -0,0 +1,822 @@
+{
+  "__inputs": [
+    {
+      "name": "DS_VM-SHORTTERM",
+      "label": "vm-shortterm",
+      "description": "",
+      "type": "datasource",
+      "pluginId": "prometheus",
+      "pluginName": "Prometheus"
+    }
+  ],
+  "__elements": {},
+  "__requires": [
+    {
+      "type": "panel",
+      "id": "bargauge",
+      "name": "Bar gauge",
+      "version": ""
+    },
+    {
+      "type": "panel",
+      "id": "gauge",
+      "name": "Gauge",
+      "version": ""
+    },
+    {
+      "type": "grafana",
+      "id": "grafana",
+      "name": "Grafana",
+      "version": "11.4.0"
+    },
+    {
+      "type": "datasource",
+      "id": "prometheus",
+      "name": "Prometheus",
+      "version": "1.0.0"
+    },
+    {
+      "type": "panel",
+      "id": "stat",
+      "name": "Stat",
+      "version": ""
+    },
+    {
+      "type": "panel",
+      "id": "table",
+      "name": "Table",
+      "version": ""
+    },
+    {
+      "type": "panel",
+      "id": "timeseries",
+      "name": "Time series",
+      "version": ""
+    }
+  ],
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": {
+          "type": "grafana",
+          "uid": "-- Grafana --"
+        },
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "type": "dashboard"
+      }
+    ]
+  },
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 1,
+  "id": null,
+  "links": [],
+  "panels": [
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 0
+      },
+      "id": 1,
+      "panels": [],
+      "title": "Allocation overview",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "blue",
+                "value": null
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 6,
+        "x": 0,
+        "y": 1
+      },
+      "id": 2,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "none",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "value",
+        "wideLayout": true
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"})",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "$ds_prometheus"
+          }
+        }
+      ],
+      "title": "GPU allocatable",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_VM-SHORTTERM}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "yellow",
+                "value": 1
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 6,
+        "x": 6,
+        "y": 1
+      },
+      "id": 3,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "none",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "value",
+        "wideLayout": true
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "sum(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"})",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_VM-SHORTTERM}"
+          }
+        }
+      ],
+      "title": "GPU requested",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "max": 100,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "blue",
+                "value": null
+              },
+              {
+                "color": "green",
+                "value": 40
+              },
+              {
+                "color": "yellow",
+                "value": 80
+              },
+              {
+                "color": "red",
+                "value": 95
+              }
+            ]
+          },
+          "unit": "percent"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 6,
+        "x": 12,
+        "y": 1
+      },
+      "id": 4,
+      "options": {
+        "minVizHeight": 75,
+        "minVizWidth": 75,
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showThresholdLabels": false,
+        "showThresholdMarkers": true,
+        "sizing": "auto"
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "sum(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"}) / sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"}) * 100",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "$ds_prometheus"
+          }
+        }
+      ],
+      "title": "Allocation ratio",
+      "type": "gauge"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_VM-SHORTTERM}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 1
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 6,
+        "x": 18,
+        "y": 1
+      },
+      "id": 5,
+      "options": {
+        "colorMode": "background",
+        "graphMode": "none",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "value",
+        "wideLayout": true
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "count((kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"} > 0) * on(namespace, pod) group_left() (kube_pod_status_phase{phase=\"Pending\"} == 1)) or vector(0)",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_VM-SHORTTERM}"
+          }
+        }
+      ],
+      "title": "Pending pods (GPU)",
+      "type": "stat"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 5
+      },
+      "id": 10,
+      "panels": [],
+      "title": "Per namespace",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "max": 8,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 6
+      },
+      "id": 11,
+      "options": {
+        "displayMode": "gradient",
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": false
+        },
+        "maxVizHeight": 300,
+        "minVizHeight": 16,
+        "minVizWidth": 8,
+        "namePlacement": "auto",
+        "orientation": "horizontal",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showUnfilled": true,
+        "sizing": "auto",
+        "valueMode": "color"
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "sum by (namespace) (kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"})",
+          "legendFormat": "{{namespace}}",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "$ds_prometheus"
+          }
+        }
+      ],
+      "title": "GPU requested per namespace",
+      "type": "bargauge"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_VM-SHORTTERM}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "stepAfter",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Allocatable (total)"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "blue",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 6
+      },
+      "id": 12,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"})",
+          "legendFormat": "Allocatable (total)",
+          "refId": "A",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_VM-SHORTTERM}"
+          }
+        },
+        {
+          "expr": "sum(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"})",
+          "legendFormat": "Requested",
+          "refId": "B",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_VM-SHORTTERM}"
+          }
+        }
+      ],
+      "title": "GPU allocated over time",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 14
+      },
+      "id": 20,
+      "panels": [],
+      "title": "Pods with GPU",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "custom": {
+            "align": "auto",
+            "cellOptions": {
+              "type": "auto"
+            },
+            "inspect": false
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Status"
+            },
+            "properties": [
+              {
+                "id": "custom.cellOptions",
+                "value": {
+                  "mode": "basic",
+                  "type": "color-background"
+                }
+              },
+              {
+                "id": "mappings",
+                "value": [
+                  {
+                    "options": {
+                      "Failed": {
+                        "color": "red",
+                        "index": 2
+                      },
+                      "Pending": {
+                        "color": "orange",
+                        "index": 1
+                      },
+                      "Running": {
+                        "color": "green",
+                        "index": 0
+                      }
+                    },
+                    "type": "value"
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 10,
+        "w": 24,
+        "x": 0,
+        "y": 15
+      },
+      "id": 21,
+      "options": {
+        "cellHeight": "sm",
+        "footer": {
+          "countRows": false,
+          "fields": "",
+          "reducer": [
+            "sum"
+          ],
+          "show": false
+        },
+        "showHeader": true
+      },
+      "pluginVersion": "11.4.0",
+      "targets": [
+        {
+          "expr": "kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"} * on(namespace, pod) group_left(phase) (kube_pod_status_phase{phase=~\"Running|Pending|Failed|Succeeded\"} == 1)",
+          "format": "table",
+          "instant": true,
+          "legendFormat": "",
+          "refId": "requested",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "$ds_prometheus"
+          }
+        },
+        {
+          "expr": "kube_pod_container_resource_limits{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"}",
+          "format": "table",
+          "instant": true,
+          "legendFormat": "",
+          "refId": "limits",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "$ds_prometheus"
+          }
+        }
+      ],
+      "title": "Pods requesting GPU",
+      "transformations": [
+        {
+          "id": "joinByField",
+          "options": {
+            "byField": "pod",
+            "mode": "outer"
+          }
+        },
+        {
+          "id": "organize",
+          "options": {
+            "excludeByName": {
+              "Time": true,
+              "Time 1": true,
+              "Time 2": true,
+              "__name__": true,
+              "__name__ 1": true,
+              "__name__ 2": true,
+              "cluster": true,
+              "cluster 1": true,
+              "cluster 2": true,
+              "container 2": true,
+              "endpoint": true,
+              "endpoint 1": true,
+              "endpoint 2": true,
+              "instance": true,
+              "instance 1": true,
+              "instance 2": true,
+              "job": true,
+              "job 1": true,
+              "job 2": true,
+              "namespace 2": true,
+              "node 2": true,
+              "prometheus": true,
+              "prometheus 1": true,
+              "prometheus 2": true,
+              "resource": true,
+              "resource 1": true,
+              "resource 2": true,
+              "service": true,
+              "service 1": true,
+              "service 2": true,
+              "tenant": true,
+              "tenant 1": true,
+              "tenant 2": true,
+              "tier": true,
+              "tier 1": true,
+              "tier 2": true,
+              "uid": true,
+              "uid 1": true,
+              "uid 2": true,
+              "unit": true,
+              "unit 1": true,
+              "unit 2": true
+            },
+            "indexByName": {
+              "Value #limits": 5,
+              "Value #requested": 4,
+              "container 1": 2,
+              "namespace 1": 0,
+              "node 1": 3,
+              "phase": 6,
+              "pod": 1
+            },
+            "renameByName": {
+              "Value #limits": "Limit",
+              "Value #requested": "Req",
+              "container 1": "Container",
+              "namespace 1": "Namespace",
+              "node 1": "Node",
+              "phase": "Status"
+            }
+          }
+        }
+      ],
+      "type": "table"
+    }
+  ],
+  "refresh": "",
+  "schemaVersion": 40,
+  "tags": [
+    "gpu",
+    "quotas"
+  ],
+  "templating": {
+    "list": [
+      {
+        "current": {},
+        "includeAll": false,
+        "label": "Prometheus",
+        "name": "ds_prometheus",
+        "options": [],
+        "query": "prometheus",
+        "refresh": 1,
+        "regex": "",
+        "type": "datasource"
+      },
+      {
+        "current": {},
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${DS_VM-SHORTTERM}"
+        },
+        "definition": "label_values(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"}, namespace)",
+        "includeAll": true,
+        "label": "Namespace",
+        "multi": true,
+        "name": "namespace",
+        "options": [],
+        "query": {
+          "query": "label_values(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"}, namespace)",
+          "refId": "StandardVariableQuery"
+        },
+        "refresh": 2,
+        "regex": "",
+        "sort": 1,
+        "type": "query"
+      }
+    ]
+  },
+  "time": {
+    "from": "now-6h",
+    "to": "now"
+  },
+  "timepicker": {},
+  "timezone": "",
+  "title": "GPU Quotas & Allocation",
+  "uid": "gpu-quotas",
+  "version": 4,
+  "weekStart": ""
+}
diff --git a/packages/system/monitoring/dashboards-infra.list b/packages/system/monitoring/dashboards-infra.list
index 581f9a05..b402fa68 100644
--- a/packages/system/monitoring/dashboards-infra.list
+++ b/packages/system/monitoring/dashboards-infra.list
@@ -33,3 +33,5 @@ hubble/dns-namespace
 hubble/l7-http-metrics
 hubble/network-overview
 gpu/gpu-performance
+gpu/gpu-efficiency
+gpu/gpu-quotas

From 7e5f3a7f12ae6ff744032c30eb0e7b05071986a2 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Fri, 17 Apr 2026 17:45:06 +0300
Subject: [PATCH 514/666] refactor(monitoring): clean up GPU dashboards

Strip Grafana export boilerplate (__inputs, __elements, __requires,
default annotations, embedded datasource inputs) and tighten panel
layouts across the three GPU dashboards. All three continue to use
the $ds_prometheus template variable.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-efficiency.json  | 1186 ++++++++------------
 dashboards/gpu/gpu-performance.json | 1574 ++++++++++-----------------
 dashboards/gpu/gpu-quotas.json      |  876 ++++++---------
 3 files changed, 1358 insertions(+), 2278 deletions(-)

diff --git a/dashboards/gpu/gpu-efficiency.json b/dashboards/gpu/gpu-efficiency.json
index cc2bca6c..1a305b4b 100644
--- a/dashboards/gpu/gpu-efficiency.json
+++ b/dashboards/gpu/gpu-efficiency.json
@@ -1,72 +1,26 @@
 {
-  "__inputs": [
-    {
-      "name": "DS_VM-SHORTTERM",
-      "label": "vm-shortterm",
-      "description": "",
-      "type": "datasource",
-      "pluginId": "prometheus",
-      "pluginName": "Prometheus"
-    }
+  "uid": "gpu-efficiency",
+  "title": "GPU Efficiency Score",
+  "description": "Tensor saturation, util/watt and throttling — reveals inefficient GPU workloads",
+  "tags": [
+    "gpu",
+    "efficiency",
+    "finops"
   ],
-  "__elements": {},
-  "__requires": [
-    {
-      "type": "grafana",
-      "id": "grafana",
-      "name": "Grafana",
-      "version": "11.4.0"
-    },
-    {
-      "type": "datasource",
-      "id": "prometheus",
-      "name": "Prometheus",
-      "version": "1.0.0"
-    },
-    {
-      "type": "panel",
-      "id": "stat",
-      "name": "Stat",
-      "version": ""
-    },
-    {
-      "type": "panel",
-      "id": "table",
-      "name": "Table",
-      "version": ""
-    },
-    {
-      "type": "panel",
-      "id": "timeseries",
-      "name": "Time series",
-      "version": ""
-    }
-  ],
-  "annotations": {
-    "list": [
-      {
-        "builtIn": 1,
-        "datasource": {
-          "type": "grafana",
-          "uid": "-- Grafana --"
-        },
-        "enable": true,
-        "hide": true,
-        "iconColor": "rgba(0, 211, 255, 1)",
-        "name": "Annotations & Alerts",
-        "type": "dashboard"
-      }
-    ]
-  },
-  "description": "Tensor saturation, util/watt and throttling \u2014 reveals inefficient GPU workloads",
+  "timezone": "browser",
   "editable": true,
-  "fiscalYearStartMonth": 0,
   "graphTooltip": 1,
-  "id": null,
-  "links": [],
+  "time": {
+    "from": "now-1h",
+    "to": "now"
+  },
+  "fiscalYearStartMonth": 0,
+  "schemaVersion": 42,
   "panels": [
     {
+      "type": "row",
       "collapsed": false,
+      "title": "Overall efficiency metrics",
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -74,48 +28,23 @@
         "y": 0
       },
       "id": 1,
-      "panels": [],
-      "title": "\u041e\u0431\u0449\u0438\u0435 \u043c\u0435\u0442\u0440\u0438\u043a\u0438 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438",
-      "type": "row"
+      "panels": []
     },
     {
+      "type": "stat",
+      "id": 2,
+      "targets": [
+        {
+          "expr": "avg(pod:tensor_saturation:avg5m)",
+          "refId": "A"
+        }
+      ],
+      "title": "Cluster Tensor Saturation",
+      "description": "Mean tensor core saturation. \u003c10% means GPUs are used inefficiently (tenants could move to CPU or optimize their code).",
+      "transparent": false,
       "datasource": {
         "type": "prometheus",
-        "uid": "${ds_prometheus}"
-      },
-      "description": "\u0421\u0440\u0435\u0434\u043d\u044f\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0442\u0435\u043d\u0437\u043e\u0440\u043d\u044b\u0445 \u044f\u0434\u0435\u0440. <10% \u2014 GPU \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043d\u0435\u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e (\u043a\u043b\u0438\u0435\u043d\u0442\u044b \u043c\u043e\u0433\u043b\u0438 \u0431\u044b \u043f\u0435\u0440\u0435\u0435\u0445\u0430\u0442\u044c \u043d\u0430 CPU \u0438\u043b\u0438 \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043e\u0434).",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
-          "max": 100,
-          "min": 0,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "red",
-                "value": null
-              },
-              {
-                "color": "orange",
-                "value": 10
-              },
-              {
-                "color": "yellow",
-                "value": 30
-              },
-              {
-                "color": "green",
-                "value": 60
-              }
-            ]
-          },
-          "unit": "percent"
-        },
-        "overrides": []
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 5,
@@ -123,71 +52,67 @@
         "x": 0,
         "y": 1
       },
-      "id": 2,
+      "repeatDirection": "h",
       "options": {
-        "colorMode": "background",
         "graphMode": "area",
+        "colorMode": "background",
         "justifyMode": "auto",
-        "orientation": "auto",
-        "percentChangeColorMode": "standard",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
+          ]
         },
-        "showPercentChange": false,
-        "textMode": "value",
-        "wideLayout": true
+        "percentChangeColorMode": "standard",
+        "orientation": ""
       },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "avg(pod:tensor_saturation:avg5m)",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${ds_prometheus}"
-          }
-        }
-      ],
-      "title": "Cluster Tensor Saturation",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_VM-SHORTTERM}"
-      },
-      "description": "NVML utilization % \u043d\u0430 \u043a\u0430\u0436\u0434\u044b\u0439 \u0432\u0430\u0442\u0442. \u0412\u044b\u0441\u043e\u043a\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 = \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u0430\u044f \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430.",
       "fieldConfig": {
         "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "decimals": 3,
-          "mappings": [],
+          "unit": "percent",
+          "min": 0,
+          "max": 100,
           "thresholds": {
             "mode": "absolute",
             "steps": [
               {
-                "color": "red",
-                "value": null
+                "value": null,
+                "color": "red"
               },
               {
-                "color": "yellow",
-                "value": 0.5
+                "value": 10,
+                "color": "orange"
               },
               {
-                "color": "green",
-                "value": 1
+                "value": 30,
+                "color": "yellow"
+              },
+              {
+                "value": 60,
+                "color": "green"
               }
             ]
-          },
-          "unit": "none"
+          }
         },
         "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 3,
+      "targets": [
+        {
+          "expr": "avg(pod:util_per_watt:avg5m)",
+          "refId": "A"
+        }
+      ],
+      "title": "Avg Utilization per Watt",
+      "description": "NVML utilization % per watt. Higher value = more efficient workload.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 5,
@@ -195,73 +120,62 @@
         "x": 8,
         "y": 1
       },
-      "id": 3,
+      "repeatDirection": "h",
       "options": {
-        "colorMode": "background",
         "graphMode": "area",
+        "colorMode": "background",
         "justifyMode": "auto",
-        "orientation": "auto",
-        "percentChangeColorMode": "standard",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
+          ]
         },
-        "showPercentChange": false,
-        "textMode": "value",
-        "wideLayout": true
+        "percentChangeColorMode": "standard",
+        "orientation": ""
       },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "avg(pod:util_per_watt:avg5m)",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_VM-SHORTTERM}"
-          }
-        }
-      ],
-      "title": "Avg Utilization per Watt",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${ds_prometheus}"
-      },
-      "description": "\u0414\u043e\u043b\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438, \u043a\u043e\u0433\u0434\u0430 GPU \u0443\u043f\u0438\u0440\u0430\u044e\u0442\u0441\u044f \u0432 TDP \u0438 \u0442\u0435\u0440\u044f\u044e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c. >5% \u2014 \u043a\u043b\u0438\u0435\u043d\u0442\u044b \u043d\u0435\u0434\u043e\u043f\u043e\u043b\u0443\u0447\u0430\u044e\u0442 FLOPS.",
       "fieldConfig": {
         "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "decimals": 2,
-          "mappings": [],
-          "max": 100,
-          "min": 0,
+          "unit": "none",
+          "decimals": 3,
           "thresholds": {
             "mode": "absolute",
             "steps": [
               {
-                "color": "green",
-                "value": null
+                "value": null,
+                "color": "red"
               },
               {
-                "color": "yellow",
-                "value": 5
+                "value": 0.5,
+                "color": "yellow"
               },
               {
-                "color": "red",
-                "value": 20
+                "value": 1,
+                "color": "green"
               }
             ]
-          },
-          "unit": "percent"
+          }
         },
         "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 4,
+      "targets": [
+        {
+          "expr": "avg(gpu:power_throttle_fraction:rate5m)",
+          "refId": "A"
+        }
+      ],
+      "title": "Avg Power Throttling",
+      "description": "Fraction of time GPUs hit the TDP cap and lose performance. \u003e5% means tenants underutilize billed FLOPS.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 5,
@@ -269,40 +183,51 @@
         "x": 16,
         "y": 1
       },
-      "id": 4,
+      "repeatDirection": "h",
       "options": {
-        "colorMode": "background",
         "graphMode": "area",
+        "colorMode": "background",
         "justifyMode": "auto",
-        "orientation": "auto",
-        "percentChangeColorMode": "standard",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
+          ]
         },
-        "showPercentChange": false,
-        "textMode": "value",
-        "wideLayout": true
+        "percentChangeColorMode": "standard",
+        "orientation": ""
       },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "avg(gpu:power_throttle_fraction:rate5m) * 100",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${ds_prometheus}"
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percentunit",
+          "decimals": 2,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "green"
+              },
+              {
+                "value": 0.05,
+                "color": "yellow"
+              },
+              {
+                "value": 0.2,
+                "color": "red"
+              }
+            ]
           }
-        }
-      ],
-      "title": "Avg Power Throttling",
-      "type": "stat"
+        },
+        "overrides": []
+      }
     },
     {
+      "type": "row",
       "collapsed": false,
+      "title": "NVML vs Tensor (mismatch detector)",
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -310,73 +235,24 @@
         "y": 6
       },
       "id": 10,
-      "panels": [],
-      "title": "NVML vs Tensor (\u043a\u0442\u043e \u043e\u0431\u043c\u0430\u043d\u044b\u0432\u0430\u0435\u0442\u0441\u044f)",
-      "type": "row"
+      "panels": []
     },
     {
+      "type": "timeseries",
+      "id": 11,
+      "targets": [
+        {
+          "expr": "DCGM_FI_DEV_GPU_UTIL{namespace=~\"$namespace\", namespace!=\"\"}",
+          "legendFormat": "{{namespace}}/{{pod}}",
+          "refId": "A"
+        }
+      ],
+      "title": "NVML GPU Utilization",
+      "description": "Classic utilization metric. Shows activity of any engine (SM, copy, encoder).",
+      "transparent": false,
       "datasource": {
         "type": "prometheus",
-        "uid": "${DS_VM-SHORTTERM}"
-      },
-      "description": "\u041a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043c\u0435\u0442\u0440\u0438\u043a\u0430 \u0443\u0442\u0438\u043b\u0438\u0437\u0430\u0446\u0438\u0438. \u041f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0437\u0430\u043d\u044f\u0442\u043e\u0441\u0442\u044c \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u0432\u0438\u0436\u043a\u0430 (SM, copy, encoder).",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "max": 100,
-          "min": 0,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "red",
-                "value": 80
-              }
-            ]
-          },
-          "unit": "percent"
-        },
-        "overrides": []
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 8,
@@ -384,100 +260,53 @@
         "x": 0,
         "y": 7
       },
-      "id": 11,
+      "repeatDirection": "h",
       "options": {
         "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
           "calcs": [
             "mean",
             "max"
-          ],
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": true
+          ]
         },
         "tooltip": {
           "mode": "multi",
-          "sort": "none"
+          "sort": ""
         }
       },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_GPU_UTIL{namespace=~\"$namespace\", namespace!=\"\"}",
-          "legendFormat": "{{namespace}}/{{pod}}",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_VM-SHORTTERM}"
-          }
-        }
-      ],
-      "title": "NVML GPU Utilization",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${ds_prometheus}"
-      },
-      "description": "\u0420\u0435\u0430\u043b\u044c\u043d\u0430\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0442\u0435\u043d\u0437\u043e\u0440\u043d\u044b\u0445 \u044f\u0434\u0435\u0440 (HMMA). \u0414\u043b\u044f AI/LLM \u0438\u043d\u0444\u0435\u0440\u0435\u043d\u0441\u0430 \u0434\u043e\u043b\u0436\u043d\u0430 \u0431\u044b\u0442\u044c \u226520%, \u0438\u043d\u0430\u0447\u0435 workload \u043d\u0435 \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d.",
       "fieldConfig": {
         "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "max": 100,
+          "unit": "percent",
           "min": 0,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "red",
-                "value": 80
-              }
-            ]
-          },
-          "unit": "percent"
+          "max": 100,
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 10,
+            "showPoints": "never"
+          }
         },
         "overrides": []
+      }
+    },
+    {
+      "type": "timeseries",
+      "id": 12,
+      "targets": [
+        {
+          "expr": "DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{namespace=~\"$namespace\", namespace!=\"\"} * 100",
+          "legendFormat": "{{namespace}}/{{pod}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Tensor Pipe Active",
+      "description": "Real tensor core load (HMMA). For AI/LLM inference it should be ≥20%, otherwise the workload is unoptimized.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 8,
@@ -485,39 +314,41 @@
         "x": 12,
         "y": 7
       },
-      "id": 12,
+      "repeatDirection": "h",
       "options": {
         "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
           "calcs": [
             "mean",
             "max"
-          ],
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": true
+          ]
         },
         "tooltip": {
           "mode": "multi",
-          "sort": "none"
+          "sort": ""
         }
       },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{namespace=~\"$namespace\", namespace!=\"\"} * 100",
-          "legendFormat": "{{namespace}}/{{pod}}",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${ds_prometheus}"
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percent",
+          "min": 0,
+          "max": 100,
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 10,
+            "showPoints": "never"
           }
-        }
-      ],
-      "title": "Tensor Pipe Active",
-      "type": "timeseries"
+        },
+        "overrides": []
+      }
     },
     {
+      "type": "row",
       "collapsed": false,
+      "title": "Per-pod ranking",
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -525,40 +356,92 @@
         "y": 15
       },
       "id": 20,
-      "panels": [],
-      "title": "Per-pod \u0440\u0435\u0439\u0442\u0438\u043d\u0433",
-      "type": "row"
+      "panels": []
     },
     {
+      "type": "table",
+      "id": 21,
+      "targets": [
+        {
+          "expr": "topk(20, pod:tensor_saturation:avg5m)",
+          "instant": true,
+          "range": false,
+          "format": "table",
+          "refId": "A"
+        }
+      ],
+      "title": "Tensor Saturation per pod (5m avg)",
+      "description": "Who is exercising tensor cores and who is not. Sorted descending.",
+      "transparent": false,
       "datasource": {
         "type": "prometheus",
-        "uid": "${DS_VM-SHORTTERM}"
+        "uid": "$ds_prometheus"
       },
-      "description": "\u041a\u0442\u043e \u0436\u043c\u0451\u0442 \u0442\u0435\u043d\u0437\u043e\u0440\u043d\u044b\u0435 \u044f\u0434\u0440\u0430, \u0430 \u043a\u0442\u043e \u043d\u0435\u0442. \u0421\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u043a\u0430 \u043e\u0442 \u043c\u0430\u043a\u0441\u0438\u043c\u0443\u043c\u0430.",
-      "fieldConfig": {
-        "defaults": {
-          "custom": {
-            "align": "auto",
-            "cellOptions": {
-              "type": "auto"
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 16
+      },
+      "repeatDirection": "h",
+      "transformations": [
+        {
+          "id": "organize",
+          "options": {
+            "excludeByName": {
+              "DCGM_FI_DRIVER_VERSION": true,
+              "Hostname": true,
+              "Time": true,
+              "UUID": true,
+              "__name__": true,
+              "cluster": true,
+              "container": true,
+              "device": true,
+              "endpoint": true,
+              "gpu": true,
+              "gpu_driver_version": true,
+              "instance": true,
+              "job": true,
+              "modelName": true,
+              "pci_bus_id": true,
+              "prometheus": true,
+              "service": true,
+              "tenant": true,
+              "tier": true,
+              "uid": true,
+              "unit": true
             },
-            "inspect": false
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "red",
-                "value": 80
-              }
-            ]
+            "indexByName": {
+              "Value": 2,
+              "namespace": 0,
+              "pod": 1
+            },
+            "renameByName": {
+              "Value": "Saturation",
+              "namespace": "Namespace",
+              "pod": "Pod"
+            }
           }
+        }
+      ],
+      "options": {
+        "frameIndex": 0,
+        "showHeader": true,
+        "showTypeIcons": false,
+        "sortBy": [
+          {
+            "displayName": "Saturation",
+            "desc": true
+          }
+        ],
+        "footer": {
+          "show": false,
+          "reducer": []
         },
+        "cellHeight": "sm"
+      },
+      "fieldConfig": {
+        "defaults": {},
         "overrides": [
           {
             "matcher": {
@@ -591,8 +474,7 @@
                   "mode": "absolute",
                   "steps": [
                     {
-                      "color": "red",
-                      "value": null
+                      "color": "red"
                     },
                     {
                       "color": "orange",
@@ -612,62 +494,54 @@
             ]
           }
         ]
+      }
+    },
+    {
+      "type": "table",
+      "id": 22,
+      "targets": [
+        {
+          "expr": "topk(20, pod:util_per_watt:avg5m)",
+          "instant": true,
+          "range": false,
+          "format": "table",
+          "refId": "A"
+        }
+      ],
+      "title": "Utilization / Watt per pod (5m avg)",
+      "description": "How efficiently each pod spends watts. Low value = poor optimization.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 8,
         "w": 12,
-        "x": 0,
+        "x": 12,
         "y": 16
       },
-      "id": 21,
-      "options": {
-        "cellHeight": "sm",
-        "footer": {
-          "countRows": false,
-          "fields": "",
-          "reducer": [
-            "sum"
-          ],
-          "show": false
-        },
-        "showHeader": true,
-        "sortBy": [
-          {
-            "desc": true,
-            "displayName": "Saturation"
-          }
-        ]
-      },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "topk(20, pod:tensor_saturation:avg5m)",
-          "format": "table",
-          "instant": true,
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_VM-SHORTTERM}"
-          }
-        }
-      ],
-      "title": "Tensor Saturation per pod (5m avg)",
+      "repeatDirection": "h",
       "transformations": [
         {
           "id": "organize",
           "options": {
             "excludeByName": {
+              "DCGM_FI_DRIVER_VERSION": true,
               "Hostname": true,
               "Time": true,
               "UUID": true,
               "__name__": true,
               "cluster": true,
               "container": true,
+              "device": true,
               "endpoint": true,
               "gpu": true,
+              "gpu_driver_version": true,
               "instance": true,
               "job": true,
               "modelName": true,
+              "pci_bus_id": true,
               "prometheus": true,
               "service": true,
               "tenant": true,
@@ -681,45 +555,31 @@
               "pod": 1
             },
             "renameByName": {
-              "Value": "Saturation",
+              "Value": "Util/Watt",
               "namespace": "Namespace",
               "pod": "Pod"
             }
           }
         }
       ],
-      "type": "table"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${ds_prometheus}"
-      },
-      "description": "\u041d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u043a\u0430\u0436\u0434\u044b\u0439 \u043f\u043e\u0434 \u0442\u0440\u0430\u0442\u0438\u0442 \u0432\u0430\u0442\u0442\u044b. \u041d\u0438\u0437\u043a\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 = \u043f\u043b\u043e\u0445\u0430\u044f \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044f.",
-      "fieldConfig": {
-        "defaults": {
-          "custom": {
-            "align": "auto",
-            "cellOptions": {
-              "type": "auto"
-            },
-            "inspect": false
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "red",
-                "value": 80
-              }
-            ]
+      "options": {
+        "frameIndex": 0,
+        "showHeader": true,
+        "showTypeIcons": false,
+        "sortBy": [
+          {
+            "displayName": "Util/Watt",
+            "desc": true
           }
+        ],
+        "footer": {
+          "show": false,
+          "reducer": []
         },
+        "cellHeight": "sm"
+      },
+      "fieldConfig": {
+        "defaults": {},
         "overrides": [
           {
             "matcher": {
@@ -756,8 +616,7 @@
                   "mode": "absolute",
                   "steps": [
                     {
-                      "color": "red",
-                      "value": null
+                      "color": "red"
                     },
                     {
                       "color": "yellow",
@@ -773,86 +632,12 @@
             ]
           }
         ]
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 16
-      },
-      "id": 22,
-      "options": {
-        "cellHeight": "sm",
-        "footer": {
-          "countRows": false,
-          "fields": "",
-          "reducer": [
-            "sum"
-          ],
-          "show": false
-        },
-        "showHeader": true,
-        "sortBy": [
-          {
-            "desc": true,
-            "displayName": "Util/Watt"
-          }
-        ]
-      },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "topk(20, pod:util_per_watt:avg5m)",
-          "format": "table",
-          "instant": true,
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${ds_prometheus}"
-          }
-        }
-      ],
-      "title": "Utilization / Watt per pod (5m avg)",
-      "transformations": [
-        {
-          "id": "organize",
-          "options": {
-            "excludeByName": {
-              "Hostname": true,
-              "Time": true,
-              "UUID": true,
-              "__name__": true,
-              "cluster": true,
-              "container": true,
-              "endpoint": true,
-              "gpu": true,
-              "instance": true,
-              "job": true,
-              "modelName": true,
-              "prometheus": true,
-              "service": true,
-              "tenant": true,
-              "tier": true,
-              "uid": true,
-              "unit": true
-            },
-            "indexByName": {
-              "Value": 2,
-              "namespace": 0,
-              "pod": 1
-            },
-            "renameByName": {
-              "Value": "Util/Watt",
-              "namespace": "Namespace",
-              "pod": "Pod"
-            }
-          }
-        }
-      ],
-      "type": "table"
+      }
     },
     {
+      "type": "row",
       "collapsed": false,
+      "title": "Throttling",
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -860,77 +645,24 @@
         "y": 24
       },
       "id": 30,
-      "panels": [],
-      "title": "Throttling",
-      "type": "row"
+      "panels": []
     },
     {
+      "type": "timeseries",
+      "id": 31,
+      "targets": [
+        {
+          "expr": "gpu:power_throttle_fraction:rate5m",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Power throttle fraction per GPU",
+      "description": "Fraction of time the GPU was power-throttled. 1.0 = always throttled.",
+      "transparent": false,
       "datasource": {
         "type": "prometheus",
-        "uid": "${DS_VM-SHORTTERM}"
-      },
-      "description": "\u0414\u043e\u043b\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438, \u043a\u043e\u0433\u0434\u0430 GPU \u0434\u0440\u043e\u0441\u0441\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043f\u043e \u043f\u0438\u0442\u0430\u043d\u0438\u044e. 1.0 = \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e.",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 25,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "max": 1,
-          "min": 0,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "yellow",
-                "value": 0.05
-              },
-              {
-                "color": "red",
-                "value": 0.2
-              }
-            ]
-          },
-          "unit": "percentunit"
-        },
-        "overrides": []
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 8,
@@ -938,104 +670,70 @@
         "x": 0,
         "y": 25
       },
-      "id": 31,
+      "repeatDirection": "h",
       "options": {
         "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
           "calcs": [
             "mean",
             "max"
-          ],
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": true
+          ]
         },
         "tooltip": {
           "mode": "multi",
-          "sort": "none"
+          "sort": ""
         }
       },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "gpu:power_throttle_fraction:rate5m",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_VM-SHORTTERM}"
-          }
-        }
-      ],
-      "title": "Power throttle fraction per GPU",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${ds_prometheus}"
-      },
-      "description": "\u0414\u043e\u043b\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438, \u043a\u043e\u0433\u0434\u0430 GPU \u0434\u0440\u043e\u0441\u0441\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043f\u043e \u0442\u0435\u043c\u043f\u0435\u0440\u0430\u0442\u0443\u0440\u0435.",
       "fieldConfig": {
         "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 25,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "max": 1,
+          "unit": "percentunit",
           "min": 0,
+          "max": 1,
           "thresholds": {
             "mode": "absolute",
             "steps": [
               {
-                "color": "green",
-                "value": null
+                "value": null,
+                "color": "green"
               },
               {
-                "color": "yellow",
-                "value": 0.05
+                "value": 0.05,
+                "color": "yellow"
               },
               {
-                "color": "red",
-                "value": 0.2
+                "value": 0.2,
+                "color": "red"
               }
             ]
           },
-          "unit": "percentunit"
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 25,
+            "showPoints": "never"
+          }
         },
         "overrides": []
+      }
+    },
+    {
+      "type": "timeseries",
+      "id": 32,
+      "targets": [
+        {
+          "expr": "gpu:thermal_throttle_fraction:rate5m",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Thermal throttle fraction per GPU",
+      "description": "Fraction of time the GPU was thermal-throttled.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 8,
@@ -1043,89 +741,101 @@
         "x": 12,
         "y": 25
       },
-      "id": 32,
+      "repeatDirection": "h",
       "options": {
         "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
           "calcs": [
             "mean",
             "max"
-          ],
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": true
+          ]
         },
         "tooltip": {
           "mode": "multi",
-          "sort": "none"
+          "sort": ""
         }
       },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "gpu:thermal_throttle_fraction:rate5m",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${ds_prometheus}"
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percentunit",
+          "min": 0,
+          "max": 1,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "green"
+              },
+              {
+                "value": 0.05,
+                "color": "yellow"
+              },
+              {
+                "value": 0.2,
+                "color": "red"
+              }
+            ]
+          },
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 25,
+            "showPoints": "never"
           }
-        }
-      ],
-      "title": "Thermal throttle fraction per GPU",
-      "type": "timeseries"
+        },
+        "overrides": []
+      }
     }
   ],
-  "refresh": "",
-  "schemaVersion": 40,
-  "tags": [
-    "gpu",
-    "efficiency",
-    "finops"
-  ],
   "templating": {
     "list": [
       {
-        "current": {},
-        "includeAll": false,
-        "label": "Datasource",
+        "type": "datasource",
         "name": "ds_prometheus",
-        "options": [],
+        "label": "Prometheus",
+        "skipUrlSync": false,
         "query": "prometheus",
-        "refresh": 1,
-        "regex": "vm-.*",
-        "type": "datasource"
+        "current": {
+          "selected": false,
+          "text": "default",
+          "value": "default"
+        },
+        "multi": false,
+        "allowCustomValue": true,
+        "includeAll": false,
+        "regex": "",
+        "auto": false,
+        "auto_min": "10s",
+        "auto_count": 30
       },
       {
-        "current": {},
+        "type": "query",
+        "name": "namespace",
+        "label": "Namespace",
+        "skipUrlSync": false,
+        "query": "label_values(DCGM_FI_DEV_GPU_UTIL{namespace!=\"\",namespace!~\"cozy-.*|kube-.*\"}, namespace)",
         "datasource": {
           "type": "prometheus",
-          "uid": "${DS_VM-SHORTTERM}"
+          "uid": "$ds_prometheus"
+        },
+        "current": {
+          "selected": true,
+          "text": "All",
+          "value": "$__all"
         },
-        "definition": "label_values(DCGM_FI_DEV_GPU_UTIL{namespace!=\"\",namespace!~\"cozy-.*|kube-.*\"}, namespace)",
-        "includeAll": true,
-        "label": "Namespace",
         "multi": true,
-        "name": "namespace",
-        "options": [],
-        "query": {
-          "query": "label_values(DCGM_FI_DEV_GPU_UTIL{namespace!=\"\",namespace!~\"cozy-.*|kube-.*\"}, namespace)",
-          "refId": "StandardVariableQuery"
-        },
+        "allowCustomValue": true,
         "refresh": 2,
-        "regex": "",
         "sort": 1,
-        "type": "query"
+        "includeAll": true,
+        "auto": false,
+        "auto_min": "10s",
+        "auto_count": 30
       }
     ]
   },
-  "time": {
-    "from": "now-1h",
-    "to": "now"
-  },
-  "timepicker": {},
-  "timezone": "",
-  "title": "GPU Efficiency Score",
-  "uid": "gpu-efficiency",
-  "version": 2,
-  "weekStart": ""
+  "annotations": {}
 }
\ No newline at end of file
diff --git a/dashboards/gpu/gpu-performance.json b/dashboards/gpu/gpu-performance.json
index 906d6a11..b0f26958 100644
--- a/dashboards/gpu/gpu-performance.json
+++ b/dashboards/gpu/gpu-performance.json
@@ -1,65 +1,24 @@
 {
-  "__inputs": [
-    {
-      "name": "DS_VM-SHORTTERM",
-      "label": "vm-shortterm",
-      "description": "",
-      "type": "datasource",
-      "pluginId": "prometheus",
-      "pluginName": "Prometheus"
-    }
+  "uid": "gpu-performance",
+  "title": "GPU Performance",
+  "tags": [
+    "gpu",
+    "dcgm"
   ],
-  "__elements": {},
-  "__requires": [
-    {
-      "type": "grafana",
-      "id": "grafana",
-      "name": "Grafana",
-      "version": "11.4.0"
-    },
-    {
-      "type": "datasource",
-      "id": "prometheus",
-      "name": "Prometheus",
-      "version": "1.0.0"
-    },
-    {
-      "type": "panel",
-      "id": "stat",
-      "name": "Stat",
-      "version": ""
-    },
-    {
-      "type": "panel",
-      "id": "timeseries",
-      "name": "Time series",
-      "version": ""
-    }
-  ],
-  "annotations": {
-    "list": [
-      {
-        "builtIn": 1,
-        "datasource": {
-          "type": "grafana",
-          "uid": "-- Grafana --"
-        },
-        "enable": true,
-        "hide": true,
-        "iconColor": "rgba(0, 211, 255, 1)",
-        "name": "Annotations & Alerts",
-        "type": "dashboard"
-      }
-    ]
-  },
+  "timezone": "browser",
   "editable": true,
-  "fiscalYearStartMonth": 0,
   "graphTooltip": 1,
-  "id": null,
-  "links": [],
+  "time": {
+    "from": "now-1h",
+    "to": "now"
+  },
+  "fiscalYearStartMonth": 0,
+  "schemaVersion": 42,
   "panels": [
     {
+      "type": "row",
       "collapsed": false,
+      "title": "Overview",
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -67,99 +26,75 @@
         "y": 0
       },
       "id": 1,
-      "panels": [],
-      "title": "Overview",
-      "type": "row"
+      "panels": []
     },
     {
+      "type": "stat",
+      "id": 2,
+      "targets": [
+        {
+          "expr": "cluster:gpu_count:total",
+          "refId": "A"
+        }
+      ],
+      "title": "Total GPUs",
+      "transparent": false,
       "datasource": {
         "type": "prometheus",
         "uid": "$ds_prometheus"
       },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "blue",
-                "value": null
-              }
-            ]
-          },
-          "unit": "short"
-        },
-        "overrides": []
-      },
       "gridPos": {
         "h": 4,
         "w": 6,
         "x": 0,
         "y": 1
       },
-      "id": 2,
+      "repeatDirection": "h",
       "options": {
-        "colorMode": "value",
         "graphMode": "none",
+        "colorMode": "value",
         "justifyMode": "auto",
-        "orientation": "auto",
-        "percentChangeColorMode": "standard",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
+          ]
         },
-        "showPercentChange": false,
-        "textMode": "value",
-        "wideLayout": true
-      },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "cluster:gpu_count:total",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "$ds_prometheus"
-          }
-        }
-      ],
-      "title": "Total GPUs",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_VM-SHORTTERM}"
+        "percentChangeColorMode": "standard",
+        "orientation": ""
       },
       "fieldConfig": {
         "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
+          "unit": "short",
           "thresholds": {
             "mode": "absolute",
             "steps": [
               {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "yellow",
-                "value": 1
+                "value": null,
+                "color": "blue"
               }
             ]
-          },
-          "unit": "short"
+          }
         },
         "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 3,
+      "targets": [
+        {
+          "expr": "cluster:gpu_count:allocated",
+          "refId": "A"
+        }
+      ],
+      "title": "Allocated",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 4,
@@ -167,71 +102,56 @@
         "x": 6,
         "y": 1
       },
-      "id": 3,
+      "repeatDirection": "h",
       "options": {
-        "colorMode": "value",
         "graphMode": "none",
+        "colorMode": "value",
         "justifyMode": "auto",
-        "orientation": "auto",
-        "percentChangeColorMode": "standard",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
+          ]
         },
-        "showPercentChange": false,
-        "textMode": "value",
-        "wideLayout": true
-      },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "cluster:gpu_count:allocated",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_VM-SHORTTERM}"
-          }
-        }
-      ],
-      "title": "Allocated",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
+        "percentChangeColorMode": "standard",
+        "orientation": ""
       },
       "fieldConfig": {
         "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
-          "max": 100,
-          "min": 0,
+          "unit": "short",
           "thresholds": {
             "mode": "absolute",
             "steps": [
               {
-                "color": "blue",
-                "value": null
+                "value": null,
+                "color": "green"
               },
               {
-                "color": "green",
-                "value": 30
-              },
-              {
-                "color": "orange",
-                "value": 80
+                "value": 1,
+                "color": "yellow"
               }
             ]
-          },
-          "unit": "percent"
+          }
         },
         "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 4,
+      "targets": [
+        {
+          "expr": "cluster:gpu_util:avg",
+          "refId": "A"
+        }
+      ],
+      "title": "Average utilization",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 4,
@@ -239,62 +159,62 @@
         "x": 12,
         "y": 1
       },
-      "id": 4,
+      "repeatDirection": "h",
       "options": {
-        "colorMode": "value",
         "graphMode": "area",
+        "colorMode": "value",
         "justifyMode": "auto",
-        "orientation": "auto",
-        "percentChangeColorMode": "standard",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
+          ]
         },
-        "showPercentChange": false,
-        "textMode": "value",
-        "wideLayout": true
-      },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "cluster:gpu_util:avg",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "$ds_prometheus"
-          }
-        }
-      ],
-      "title": "Average utilization",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_VM-SHORTTERM}"
+        "percentChangeColorMode": "standard",
+        "orientation": ""
       },
       "fieldConfig": {
         "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "decimals": 0,
-          "mappings": [],
+          "unit": "percent",
+          "min": 0,
+          "max": 100,
           "thresholds": {
             "mode": "absolute",
             "steps": [
               {
-                "color": "green",
-                "value": null
+                "value": null,
+                "color": "blue"
+              },
+              {
+                "value": 30,
+                "color": "green"
+              },
+              {
+                "value": 80,
+                "color": "orange"
               }
             ]
-          },
-          "unit": "watt"
+          }
         },
         "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 5,
+      "targets": [
+        {
+          "expr": "cluster:gpu_power_watts:sum",
+          "refId": "A"
+        }
+      ],
+      "title": "Power draw",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 4,
@@ -302,40 +222,43 @@
         "x": 18,
         "y": 1
       },
-      "id": 5,
+      "repeatDirection": "h",
       "options": {
-        "colorMode": "value",
         "graphMode": "area",
+        "colorMode": "value",
         "justifyMode": "auto",
-        "orientation": "auto",
-        "percentChangeColorMode": "standard",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
+          ]
         },
-        "showPercentChange": false,
-        "textMode": "value",
-        "wideLayout": true
+        "percentChangeColorMode": "standard",
+        "orientation": ""
       },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "cluster:gpu_power_watts:sum",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_VM-SHORTTERM}"
+      "fieldConfig": {
+        "defaults": {
+          "unit": "watt",
+          "decimals": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "green"
+              }
+            ]
           }
-        }
-      ],
-      "title": "Power draw",
-      "type": "stat"
+        },
+        "overrides": []
+      }
     },
     {
+      "type": "row",
       "collapsed": false,
+      "title": "Utilization",
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -343,172 +266,77 @@
         "y": 5
       },
       "id": 10,
-      "panels": [],
-      "title": "Utilization",
-      "type": "row"
+      "panels": []
     },
     {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "max": 100,
-          "min": 0,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "red",
-                "value": 80
-              }
-            ]
-          },
-          "unit": "percent"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 6
-      },
+      "type": "timeseries",
       "id": 11,
-      "options": {
-        "legend": {
-          "calcs": [
-            "mean",
-            "max"
-          ],
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": "none"
-        }
-      },
-      "pluginVersion": "11.4.0",
       "targets": [
         {
           "expr": "DCGM_FI_DEV_GPU_UTIL{Hostname=~\"$Hostname\", namespace=~\"$namespace\"}",
           "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "$ds_prometheus"
-          }
+          "refId": "A"
         }
       ],
       "title": "GPU Utilization (NVML)",
-      "type": "timeseries"
-    },
-    {
+      "transparent": false,
       "datasource": {
         "type": "prometheus",
-        "uid": "${DS_VM-SHORTTERM}"
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 6
+      },
+      "repeatDirection": "h",
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": ""
+        }
       },
       "fieldConfig": {
         "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "max": 100,
+          "unit": "percent",
           "min": 0,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "red",
-                "value": 80
-              }
-            ]
-          },
-          "unit": "percent"
+          "max": 100,
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 10,
+            "showPoints": "never",
+            "spanNulls": false
+          }
         },
         "overrides": []
+      }
+    },
+    {
+      "type": "timeseries",
+      "id": 12,
+      "targets": [
+        {
+          "expr": "DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{Hostname=~\"$Hostname\", namespace=~\"$namespace\"} * 100",
+          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Tensor Pipe Active (realistic load for LLM/AI)",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 8,
@@ -516,99 +344,53 @@
         "x": 12,
         "y": 6
       },
-      "id": 12,
+      "repeatDirection": "h",
       "options": {
         "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
           "calcs": [
             "mean",
             "max"
-          ],
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": true
+          ]
         },
         "tooltip": {
           "mode": "multi",
-          "sort": "none"
+          "sort": ""
         }
       },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{Hostname=~\"$Hostname\", namespace=~\"$namespace\"} * 100",
-          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_VM-SHORTTERM}"
-          }
-        }
-      ],
-      "title": "Tensor Pipe Active (realistic load for LLM/AI)",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
       "fieldConfig": {
         "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "max": 100,
+          "unit": "percent",
           "min": 0,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "red",
-                "value": 80
-              }
-            ]
-          },
-          "unit": "percent"
+          "max": 100,
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 10,
+            "showPoints": "never",
+            "spanNulls": false
+          }
         },
         "overrides": []
+      }
+    },
+    {
+      "type": "timeseries",
+      "id": 13,
+      "targets": [
+        {
+          "expr": "DCGM_FI_PROF_GR_ENGINE_ACTIVE{Hostname=~\"$Hostname\", namespace=~\"$namespace\"} * 100",
+          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Graphics Engine Active",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 8,
@@ -616,99 +398,53 @@
         "x": 0,
         "y": 14
       },
-      "id": 13,
+      "repeatDirection": "h",
       "options": {
         "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
           "calcs": [
             "mean",
             "max"
-          ],
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": true
+          ]
         },
         "tooltip": {
           "mode": "multi",
-          "sort": "none"
+          "sort": ""
         }
       },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "DCGM_FI_PROF_GR_ENGINE_ACTIVE{Hostname=~\"$Hostname\", namespace=~\"$namespace\"} * 100",
-          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "$ds_prometheus"
-          }
-        }
-      ],
-      "title": "Graphics Engine Active",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_VM-SHORTTERM}"
-      },
       "fieldConfig": {
         "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "max": 100,
+          "unit": "percent",
           "min": 0,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "red",
-                "value": 80
-              }
-            ]
-          },
-          "unit": "percent"
+          "max": 100,
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 10,
+            "showPoints": "never",
+            "spanNulls": false
+          }
         },
         "overrides": []
+      }
+    },
+    {
+      "type": "timeseries",
+      "id": 14,
+      "targets": [
+        {
+          "expr": "DCGM_FI_DEV_MEM_COPY_UTIL{Hostname=~\"$Hostname\", namespace=~\"$namespace\"}",
+          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Memory Copy Utilization",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 8,
@@ -716,39 +452,42 @@
         "x": 12,
         "y": 14
       },
-      "id": 14,
+      "repeatDirection": "h",
       "options": {
         "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
           "calcs": [
             "mean",
             "max"
-          ],
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": true
+          ]
         },
         "tooltip": {
           "mode": "multi",
-          "sort": "none"
+          "sort": ""
         }
       },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_MEM_COPY_UTIL{Hostname=~\"$Hostname\", namespace=~\"$namespace\"}",
-          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_VM-SHORTTERM}"
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percent",
+          "min": 0,
+          "max": 100,
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 10,
+            "showPoints": "never",
+            "spanNulls": false
           }
-        }
-      ],
-      "title": "Memory Copy Utilization",
-      "type": "timeseries"
+        },
+        "overrides": []
+      }
     },
     {
+      "type": "row",
       "collapsed": false,
+      "title": "Memory",
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -756,168 +495,74 @@
         "y": 22
       },
       "id": 20,
-      "panels": [],
-      "title": "Memory",
-      "type": "row"
+      "panels": []
     },
     {
+      "type": "timeseries",
+      "id": 21,
+      "targets": [
+        {
+          "expr": "DCGM_FI_DEV_FB_USED{Hostname=~\"$Hostname\", namespace=~\"$namespace\"} * 1048576",
+          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
+          "refId": "A"
+        }
+      ],
+      "title": "VRAM Used",
+      "transparent": false,
       "datasource": {
         "type": "prometheus",
         "uid": "$ds_prometheus"
       },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 25,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "red",
-                "value": 80
-              }
-            ]
-          },
-          "unit": "bytes"
-        },
-        "overrides": []
-      },
       "gridPos": {
         "h": 8,
         "w": 12,
         "x": 0,
         "y": 23
       },
-      "id": 21,
+      "repeatDirection": "h",
       "options": {
         "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
           "calcs": [
             "mean",
             "max"
-          ],
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": true
+          ]
         },
         "tooltip": {
           "mode": "multi",
-          "sort": "none"
+          "sort": ""
         }
       },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_FB_USED{Hostname=~\"$Hostname\", namespace=~\"$namespace\"} * 1048576",
-          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "$ds_prometheus"
-          }
-        }
-      ],
-      "title": "VRAM Used",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_VM-SHORTTERM}"
-      },
       "fieldConfig": {
         "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
+          "unit": "bytes",
           "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
             "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
             "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "red",
-                "value": 80
-              }
-            ]
-          },
-          "unit": "bytes"
+            "fillOpacity": 25,
+            "showPoints": "never"
+          }
         },
         "overrides": []
+      }
+    },
+    {
+      "type": "timeseries",
+      "id": 22,
+      "targets": [
+        {
+          "expr": "DCGM_FI_DEV_FB_FREE{Hostname=~\"$Hostname\"} * 1048576",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "title": "VRAM Free",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 8,
@@ -925,39 +570,39 @@
         "x": 12,
         "y": 23
       },
-      "id": 22,
+      "repeatDirection": "h",
       "options": {
         "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
           "calcs": [
             "mean",
             "min"
-          ],
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": true
+          ]
         },
         "tooltip": {
           "mode": "multi",
-          "sort": "none"
+          "sort": ""
         }
       },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_FB_FREE{Hostname=~\"$Hostname\"} * 1048576",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_VM-SHORTTERM}"
+      "fieldConfig": {
+        "defaults": {
+          "unit": "bytes",
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 10,
+            "showPoints": "never"
           }
-        }
-      ],
-      "title": "VRAM Free",
-      "type": "timeseries"
+        },
+        "overrides": []
+      }
     },
     {
+      "type": "row",
       "collapsed": false,
+      "title": "Power \u0026 Temperature",
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -965,174 +610,74 @@
         "y": 31
       },
       "id": 30,
-      "panels": [],
-      "title": "Power & Temperature",
-      "type": "row"
+      "panels": []
     },
     {
+      "type": "timeseries",
+      "id": 31,
+      "targets": [
+        {
+          "expr": "DCGM_FI_DEV_POWER_USAGE{Hostname=~\"$Hostname\"}",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Power Usage per GPU",
+      "transparent": false,
       "datasource": {
         "type": "prometheus",
         "uid": "$ds_prometheus"
       },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "red",
-                "value": 80
-              }
-            ]
-          },
-          "unit": "watt"
-        },
-        "overrides": []
-      },
       "gridPos": {
         "h": 8,
         "w": 12,
         "x": 0,
         "y": 32
       },
-      "id": 31,
+      "repeatDirection": "h",
       "options": {
         "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
           "calcs": [
             "mean",
             "max"
-          ],
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": true
+          ]
         },
         "tooltip": {
           "mode": "multi",
-          "sort": "none"
+          "sort": ""
         }
       },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_POWER_USAGE{Hostname=~\"$Hostname\"}",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "$ds_prometheus"
-          }
-        }
-      ],
-      "title": "Power Usage per GPU",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_VM-SHORTTERM}"
-      },
       "fieldConfig": {
         "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
+          "unit": "watt",
           "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
             "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
             "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "max": 100,
-          "min": 20,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "yellow",
-                "value": 75
-              },
-              {
-                "color": "red",
-                "value": 85
-              }
-            ]
-          },
-          "unit": "celsius"
+            "fillOpacity": 10,
+            "showPoints": "never"
+          }
         },
         "overrides": []
+      }
+    },
+    {
+      "type": "timeseries",
+      "id": 32,
+      "targets": [
+        {
+          "expr": "DCGM_FI_DEV_GPU_TEMP{Hostname=~\"$Hostname\"}",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "title": "GPU Temperature",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 8,
@@ -1140,39 +685,58 @@
         "x": 12,
         "y": 32
       },
-      "id": 32,
+      "repeatDirection": "h",
       "options": {
         "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
           "calcs": [
             "mean",
             "max"
-          ],
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": true
+          ]
         },
         "tooltip": {
           "mode": "multi",
-          "sort": "none"
+          "sort": ""
         }
       },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_GPU_TEMP{Hostname=~\"$Hostname\"}",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_VM-SHORTTERM}"
+      "fieldConfig": {
+        "defaults": {
+          "unit": "celsius",
+          "min": 20,
+          "max": 100,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "green"
+              },
+              {
+                "value": 75,
+                "color": "yellow"
+              },
+              {
+                "value": 85,
+                "color": "red"
+              }
+            ]
+          },
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 10,
+            "showPoints": "never"
           }
-        }
-      ],
-      "title": "GPU Temperature",
-      "type": "timeseries"
+        },
+        "overrides": []
+      }
     },
     {
+      "type": "row",
       "collapsed": false,
+      "title": "Health",
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -1180,85 +744,81 @@
         "y": 40
       },
       "id": 40,
-      "panels": [],
-      "title": "Health",
-      "type": "row"
+      "panels": []
     },
     {
+      "type": "stat",
+      "id": 41,
+      "targets": [
+        {
+          "expr": "max by (Hostname, gpu) (DCGM_FI_DEV_XID_ERRORS{Hostname=~\"$Hostname\"})",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "title": "XID errors (latest)",
+      "transparent": false,
       "datasource": {
         "type": "prometheus",
         "uid": "$ds_prometheus"
       },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green"
-              },
-              {
-                "color": "red",
-                "value": 1
-              }
-            ]
-          },
-          "unit": "short"
-        },
-        "overrides": []
-      },
       "gridPos": {
         "h": 5,
         "w": 8,
         "x": 0,
         "y": 41
       },
-      "id": 41,
+      "repeatDirection": "h",
       "options": {
-        "colorMode": "background",
         "graphMode": "none",
+        "colorMode": "background",
+        "justifyMode": "auto",
+        "textMode": "value_and_name",
+        "wideLayout": true,
+        "showPercentChange": false,
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
+          ]
         },
-        "textMode": "value_and_name"
-      },
-      "targets": [
-        {
-          "expr": "max by (Hostname, gpu) (DCGM_FI_DEV_XID_ERRORS{Hostname=~\"$Hostname\"})",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "$ds_prometheus"
-          }
-        }
-      ],
-      "title": "XID errors (latest)",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_VM-SHORTTERM}"
+        "percentChangeColorMode": "standard",
+        "orientation": ""
       },
       "fieldConfig": {
         "defaults": {
-          "custom": {
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "lineInterpolation": "linear",
-            "showPoints": "never"
-          },
-          "unit": "µs"
+          "unit": "short",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "green"
+              },
+              {
+                "value": 1,
+                "color": "red"
+              }
+            ]
+          }
         },
         "overrides": []
+      }
+    },
+    {
+      "type": "timeseries",
+      "id": 42,
+      "targets": [
+        {
+          "expr": "rate(DCGM_FI_DEV_POWER_VIOLATION{Hostname=~\"$Hostname\"}[5m])",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Power Violation (µs/s throttled due to power)",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 5,
@@ -1266,46 +826,47 @@
         "x": 8,
         "y": 41
       },
-      "id": 42,
+      "repeatDirection": "h",
       "options": {
         "legend": {
           "displayMode": "list",
-          "placement": "bottom"
+          "placement": "bottom",
+          "showLegend": false,
+          "calcs": []
         },
         "tooltip": {
-          "mode": "multi"
+          "mode": "multi",
+          "sort": ""
         }
       },
-      "targets": [
-        {
-          "expr": "rate(DCGM_FI_DEV_POWER_VIOLATION{Hostname=~\"$Hostname\"}[5m])",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_VM-SHORTTERM}"
-          }
-        }
-      ],
-      "title": "Power Violation (µs/s throttled due to power)",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
       "fieldConfig": {
         "defaults": {
+          "unit": "µs",
           "custom": {
             "drawStyle": "line",
-            "fillOpacity": 10,
             "lineInterpolation": "linear",
+            "fillOpacity": 10,
             "showPoints": "never"
-          },
-          "unit": "µs"
+          }
         },
         "overrides": []
+      }
+    },
+    {
+      "type": "timeseries",
+      "id": 43,
+      "targets": [
+        {
+          "expr": "rate(DCGM_FI_DEV_THERMAL_VIOLATION{Hostname=~\"$Hostname\"}[5m])",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Thermal Violation (µs/s throttled due to thermals)",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 5,
@@ -1313,102 +874,103 @@
         "x": 16,
         "y": 41
       },
-      "id": 43,
+      "repeatDirection": "h",
       "options": {
         "legend": {
           "displayMode": "list",
-          "placement": "bottom"
+          "placement": "bottom",
+          "showLegend": false,
+          "calcs": []
         },
         "tooltip": {
-          "mode": "multi"
+          "mode": "multi",
+          "sort": ""
         }
       },
-      "targets": [
-        {
-          "expr": "rate(DCGM_FI_DEV_THERMAL_VIOLATION{Hostname=~\"$Hostname\"}[5m])",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "$ds_prometheus"
+      "fieldConfig": {
+        "defaults": {
+          "unit": "µs",
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 10,
+            "showPoints": "never"
           }
-        }
-      ],
-      "title": "Thermal Violation (µs/s throttled due to thermals)",
-      "type": "timeseries"
+        },
+        "overrides": []
+      }
     }
   ],
-  "refresh": "",
-  "schemaVersion": 40,
-  "tags": [
-    "gpu",
-    "dcgm"
-  ],
   "templating": {
     "list": [
       {
-        "current": {},
-        "includeAll": false,
-        "label": "Prometheus",
+        "type": "datasource",
         "name": "ds_prometheus",
-        "options": [],
+        "label": "Prometheus",
+        "skipUrlSync": false,
         "query": "prometheus",
-        "refresh": 1,
+        "current": {
+          "selected": false,
+          "text": "default",
+          "value": "default"
+        },
+        "multi": false,
+        "allowCustomValue": true,
+        "includeAll": false,
         "regex": "",
-        "type": "datasource"
+        "auto": false,
+        "auto_min": "10s",
+        "auto_count": 30
       },
       {
-        "current": {},
-        "datasource": {
-          "type": "prometheus",
-          "uid": "${DS_VM-SHORTTERM}"
-        },
-        "definition": "label_values(DCGM_FI_DEV_GPU_UTIL, Hostname)",
-        "includeAll": true,
-        "label": "Host",
-        "multi": true,
+        "type": "query",
         "name": "Hostname",
-        "options": [],
-        "query": {
-          "query": "label_values(DCGM_FI_DEV_GPU_UTIL, Hostname)",
-          "refId": "StandardVariableQuery"
-        },
-        "refresh": 2,
-        "regex": "",
-        "sort": 1,
-        "type": "query"
-      },
-      {
-        "current": {},
+        "label": "Host",
+        "skipUrlSync": false,
+        "query": "label_values(DCGM_FI_DEV_GPU_UTIL, Hostname)",
         "datasource": {
           "type": "prometheus",
           "uid": "$ds_prometheus"
         },
-        "definition": "label_values(DCGM_FI_DEV_GPU_UTIL{namespace!=\"\",namespace!~\"cozy-.*|kube-.*\"}, namespace)",
-        "includeAll": true,
-        "label": "Namespace",
-        "multi": true,
-        "name": "namespace",
-        "options": [],
-        "query": {
-          "query": "label_values(DCGM_FI_DEV_GPU_UTIL{namespace!=\"\",namespace!~\"cozy-.*|kube-.*\"}, namespace)",
-          "refId": "StandardVariableQuery"
+        "current": {
+          "selected": true,
+          "text": "All",
+          "value": "$__all"
         },
+        "multi": true,
+        "allowCustomValue": true,
         "refresh": 2,
-        "regex": "",
         "sort": 1,
-        "type": "query"
+        "includeAll": true,
+        "auto": false,
+        "auto_min": "10s",
+        "auto_count": 30
+      },
+      {
+        "type": "query",
+        "name": "namespace",
+        "label": "Namespace",
+        "skipUrlSync": false,
+        "query": "label_values(DCGM_FI_DEV_GPU_UTIL{namespace!=\"\",namespace!~\"cozy-.*|kube-.*\"}, namespace)",
+        "datasource": {
+          "type": "prometheus",
+          "uid": "$ds_prometheus"
+        },
+        "current": {
+          "selected": true,
+          "text": "All",
+          "value": "$__all"
+        },
+        "multi": true,
+        "allowCustomValue": true,
+        "refresh": 2,
+        "sort": 1,
+        "includeAll": true,
+        "auto": false,
+        "auto_min": "10s",
+        "auto_count": 30
       }
     ]
   },
-  "time": {
-    "from": "now-1h",
-    "to": "now"
-  },
-  "timepicker": {},
-  "timezone": "",
-  "title": "GPU Performance",
-  "uid": "gpu-performance",
-  "version": 2,
-  "weekStart": ""
+  "annotations": {}
 }
diff --git a/dashboards/gpu/gpu-quotas.json b/dashboards/gpu/gpu-quotas.json
index 28f2c892..840065f3 100644
--- a/dashboards/gpu/gpu-quotas.json
+++ b/dashboards/gpu/gpu-quotas.json
@@ -1,83 +1,24 @@
 {
-  "__inputs": [
-    {
-      "name": "DS_VM-SHORTTERM",
-      "label": "vm-shortterm",
-      "description": "",
-      "type": "datasource",
-      "pluginId": "prometheus",
-      "pluginName": "Prometheus"
-    }
+  "uid": "gpu-quotas",
+  "title": "GPU Quotas \u0026 Allocation",
+  "tags": [
+    "gpu",
+    "quotas"
   ],
-  "__elements": {},
-  "__requires": [
-    {
-      "type": "panel",
-      "id": "bargauge",
-      "name": "Bar gauge",
-      "version": ""
-    },
-    {
-      "type": "panel",
-      "id": "gauge",
-      "name": "Gauge",
-      "version": ""
-    },
-    {
-      "type": "grafana",
-      "id": "grafana",
-      "name": "Grafana",
-      "version": "11.4.0"
-    },
-    {
-      "type": "datasource",
-      "id": "prometheus",
-      "name": "Prometheus",
-      "version": "1.0.0"
-    },
-    {
-      "type": "panel",
-      "id": "stat",
-      "name": "Stat",
-      "version": ""
-    },
-    {
-      "type": "panel",
-      "id": "table",
-      "name": "Table",
-      "version": ""
-    },
-    {
-      "type": "panel",
-      "id": "timeseries",
-      "name": "Time series",
-      "version": ""
-    }
-  ],
-  "annotations": {
-    "list": [
-      {
-        "builtIn": 1,
-        "datasource": {
-          "type": "grafana",
-          "uid": "-- Grafana --"
-        },
-        "enable": true,
-        "hide": true,
-        "iconColor": "rgba(0, 211, 255, 1)",
-        "name": "Annotations & Alerts",
-        "type": "dashboard"
-      }
-    ]
-  },
+  "timezone": "browser",
   "editable": true,
-  "fiscalYearStartMonth": 0,
   "graphTooltip": 1,
-  "id": null,
-  "links": [],
+  "time": {
+    "from": "now-6h",
+    "to": "now"
+  },
+  "fiscalYearStartMonth": 0,
+  "schemaVersion": 42,
   "panels": [
     {
+      "type": "row",
       "collapsed": false,
+      "title": "Allocation overview",
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -85,99 +26,75 @@
         "y": 0
       },
       "id": 1,
-      "panels": [],
-      "title": "Allocation overview",
-      "type": "row"
+      "panels": []
     },
     {
+      "type": "stat",
+      "id": 2,
+      "targets": [
+        {
+          "expr": "sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"})",
+          "refId": "A"
+        }
+      ],
+      "title": "GPU allocatable",
+      "transparent": false,
       "datasource": {
         "type": "prometheus",
         "uid": "$ds_prometheus"
       },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "blue",
-                "value": null
-              }
-            ]
-          },
-          "unit": "short"
-        },
-        "overrides": []
-      },
       "gridPos": {
         "h": 4,
         "w": 6,
         "x": 0,
         "y": 1
       },
-      "id": 2,
+      "repeatDirection": "h",
       "options": {
-        "colorMode": "value",
         "graphMode": "none",
+        "colorMode": "value",
         "justifyMode": "auto",
-        "orientation": "auto",
-        "percentChangeColorMode": "standard",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
+          ]
         },
-        "showPercentChange": false,
-        "textMode": "value",
-        "wideLayout": true
-      },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"})",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "$ds_prometheus"
-          }
-        }
-      ],
-      "title": "GPU allocatable",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_VM-SHORTTERM}"
+        "percentChangeColorMode": "standard",
+        "orientation": ""
       },
       "fieldConfig": {
         "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
+          "unit": "short",
           "thresholds": {
             "mode": "absolute",
             "steps": [
               {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "yellow",
-                "value": 1
+                "value": null,
+                "color": "blue"
               }
             ]
-          },
-          "unit": "short"
+          }
         },
         "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 3,
+      "targets": [
+        {
+          "expr": "sum(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"})",
+          "refId": "A"
+        }
+      ],
+      "title": "GPU requested",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 4,
@@ -185,75 +102,56 @@
         "x": 6,
         "y": 1
       },
-      "id": 3,
+      "repeatDirection": "h",
       "options": {
-        "colorMode": "value",
         "graphMode": "none",
+        "colorMode": "value",
         "justifyMode": "auto",
-        "orientation": "auto",
-        "percentChangeColorMode": "standard",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
+          ]
         },
-        "showPercentChange": false,
-        "textMode": "value",
-        "wideLayout": true
-      },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "sum(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"})",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_VM-SHORTTERM}"
-          }
-        }
-      ],
-      "title": "GPU requested",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
+        "percentChangeColorMode": "standard",
+        "orientation": ""
       },
       "fieldConfig": {
         "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
-          "max": 100,
-          "min": 0,
+          "unit": "short",
           "thresholds": {
             "mode": "absolute",
             "steps": [
               {
-                "color": "blue",
-                "value": null
+                "value": null,
+                "color": "green"
               },
               {
-                "color": "green",
-                "value": 40
-              },
-              {
-                "color": "yellow",
-                "value": 80
-              },
-              {
-                "color": "red",
-                "value": 95
+                "value": 1,
+                "color": "yellow"
               }
             ]
-          },
-          "unit": "percent"
+          }
         },
         "overrides": []
+      }
+    },
+    {
+      "type": "gauge",
+      "id": 4,
+      "targets": [
+        {
+          "expr": "sum(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"}) / sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"}) * 100",
+          "refId": "A"
+        }
+      ],
+      "title": "Allocation ratio",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 4,
@@ -261,63 +159,64 @@
         "x": 12,
         "y": 1
       },
-      "id": 4,
+      "repeatDirection": "h",
       "options": {
-        "minVizHeight": 75,
+        "showThresholdLabels": false,
+        "showThresholdMarkers": true,
+        "sizing": "auto",
         "minVizWidth": 75,
-        "orientation": "auto",
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
+          ]
         },
-        "showThresholdLabels": false,
-        "showThresholdMarkers": true,
-        "sizing": "auto"
-      },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "sum(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"}) / sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"}) * 100",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "$ds_prometheus"
-          }
-        }
-      ],
-      "title": "Allocation ratio",
-      "type": "gauge"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_VM-SHORTTERM}"
+        "minVizHeight": 75,
+        "orientation": ""
       },
       "fieldConfig": {
         "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
+          "unit": "percent",
+          "min": 0,
+          "max": 100,
           "thresholds": {
             "mode": "absolute",
             "steps": [
               {
-                "color": "green",
-                "value": null
+                "value": null,
+                "color": "blue"
               },
               {
-                "color": "red",
-                "value": 1
+                "value": 40,
+                "color": "green"
+              },
+              {
+                "value": 80,
+                "color": "yellow"
+              },
+              {
+                "value": 95,
+                "color": "red"
               }
             ]
-          },
-          "unit": "short"
+          }
         },
         "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 5,
+      "targets": [
+        {
+          "expr": "count((kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"} \u003e 0) * on(namespace, pod) group_left() (kube_pod_status_phase{phase=\"Pending\"} == 1)) or vector(0)",
+          "refId": "A"
+        }
+      ],
+      "title": "Pending pods (GPU)",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
       },
       "gridPos": {
         "h": 4,
@@ -325,40 +224,46 @@
         "x": 18,
         "y": 1
       },
-      "id": 5,
+      "repeatDirection": "h",
       "options": {
-        "colorMode": "background",
         "graphMode": "none",
+        "colorMode": "background",
         "justifyMode": "auto",
-        "orientation": "auto",
-        "percentChangeColorMode": "standard",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
+          ]
         },
-        "showPercentChange": false,
-        "textMode": "value",
-        "wideLayout": true
+        "percentChangeColorMode": "standard",
+        "orientation": ""
       },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "count((kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"} > 0) * on(namespace, pod) group_left() (kube_pod_status_phase{phase=\"Pending\"} == 1)) or vector(0)",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_VM-SHORTTERM}"
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "green"
+              },
+              {
+                "value": 1,
+                "color": "red"
+              }
+            ]
           }
-        }
-      ],
-      "title": "Pending pods (GPU)",
-      "type": "stat"
+        },
+        "overrides": []
+      }
     },
     {
+      "type": "row",
       "collapsed": false,
+      "title": "Per namespace",
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -366,140 +271,120 @@
         "y": 5
       },
       "id": 10,
-      "panels": [],
-      "title": "Per namespace",
-      "type": "row"
+      "panels": []
     },
     {
+      "type": "bargauge",
+      "id": 11,
+      "targets": [
+        {
+          "expr": "sum by (namespace) (kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"})",
+          "legendFormat": "{{namespace}}",
+          "refId": "A"
+        }
+      ],
+      "title": "GPU requested per namespace",
+      "transparent": false,
       "datasource": {
         "type": "prometheus",
         "uid": "$ds_prometheus"
       },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
-          "max": 8,
-          "min": 0,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              }
-            ]
-          },
-          "unit": "short"
-        },
-        "overrides": []
-      },
       "gridPos": {
         "h": 8,
         "w": 12,
         "x": 0,
         "y": 6
       },
-      "id": 11,
+      "repeatDirection": "h",
       "options": {
         "displayMode": "gradient",
+        "valueMode": "color",
+        "namePlacement": "auto",
+        "showUnfilled": true,
+        "sizing": "auto",
+        "minVizWidth": 8,
+        "minVizHeight": 16,
         "legend": {
-          "calcs": [],
           "displayMode": "list",
           "placement": "bottom",
-          "showLegend": false
+          "showLegend": false,
+          "calcs": []
         },
-        "maxVizHeight": 300,
-        "minVizHeight": 16,
-        "minVizWidth": 8,
-        "namePlacement": "auto",
-        "orientation": "horizontal",
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
+          ]
         },
-        "showUnfilled": true,
-        "sizing": "auto",
-        "valueMode": "color"
-      },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "sum by (namespace) (kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"})",
-          "legendFormat": "{{namespace}}",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "$ds_prometheus"
-          }
-        }
-      ],
-      "title": "GPU requested per namespace",
-      "type": "bargauge"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_VM-SHORTTERM}"
+        "maxVizHeight": 300,
+        "orientation": "horizontal"
       },
       "fieldConfig": {
         "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "stepAfter",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
+          "unit": "short",
+          "min": 0,
+          "max": 8,
           "thresholds": {
             "mode": "absolute",
             "steps": [
               {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "red",
-                "value": 80
+                "value": null,
+                "color": "green"
               }
             ]
-          },
-          "unit": "short"
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "timeseries",
+      "id": 12,
+      "targets": [
+        {
+          "expr": "sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"})",
+          "legendFormat": "Allocatable (total)",
+          "refId": "A"
+        },
+        {
+          "expr": "sum(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"})",
+          "legendFormat": "Requested",
+          "refId": "B"
+        }
+      ],
+      "title": "GPU allocated over time",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 6
+      },
+      "repeatDirection": "h",
+      "options": {
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": false,
+          "calcs": []
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": ""
+        }
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "stepAfter",
+            "fillOpacity": 10,
+            "showPoints": "never"
+          }
         },
         "overrides": [
           {
@@ -518,52 +403,12 @@
             ]
           }
         ]
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 6
-      },
-      "id": 12,
-      "options": {
-        "legend": {
-          "calcs": [],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": "none"
-        }
-      },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"})",
-          "legendFormat": "Allocatable (total)",
-          "refId": "A",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_VM-SHORTTERM}"
-          }
-        },
-        {
-          "expr": "sum(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"})",
-          "legendFormat": "Requested",
-          "refId": "B",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_VM-SHORTTERM}"
-          }
-        }
-      ],
-      "title": "GPU allocated over time",
-      "type": "timeseries"
+      }
     },
     {
+      "type": "row",
       "collapsed": false,
+      "title": "Pods with GPU",
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -571,124 +416,40 @@
         "y": 14
       },
       "id": 20,
-      "panels": [],
-      "title": "Pods with GPU",
-      "type": "row"
+      "panels": []
     },
     {
+      "type": "table",
+      "id": 21,
+      "targets": [
+        {
+          "expr": "kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"} * on(namespace, pod) group_left(phase) (kube_pod_status_phase{phase=~\"Running|Pending|Failed|Succeeded\"} == 1)",
+          "instant": true,
+          "range": false,
+          "format": "table",
+          "refId": "requested"
+        },
+        {
+          "expr": "kube_pod_container_resource_limits{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"}",
+          "instant": true,
+          "range": false,
+          "format": "table",
+          "refId": "limits"
+        }
+      ],
+      "title": "Pods requesting GPU",
+      "transparent": false,
       "datasource": {
         "type": "prometheus",
         "uid": "$ds_prometheus"
       },
-      "fieldConfig": {
-        "defaults": {
-          "custom": {
-            "align": "auto",
-            "cellOptions": {
-              "type": "auto"
-            },
-            "inspect": false
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "red",
-                "value": 80
-              }
-            ]
-          }
-        },
-        "overrides": [
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "Status"
-            },
-            "properties": [
-              {
-                "id": "custom.cellOptions",
-                "value": {
-                  "mode": "basic",
-                  "type": "color-background"
-                }
-              },
-              {
-                "id": "mappings",
-                "value": [
-                  {
-                    "options": {
-                      "Failed": {
-                        "color": "red",
-                        "index": 2
-                      },
-                      "Pending": {
-                        "color": "orange",
-                        "index": 1
-                      },
-                      "Running": {
-                        "color": "green",
-                        "index": 0
-                      }
-                    },
-                    "type": "value"
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
       "gridPos": {
         "h": 10,
         "w": 24,
         "x": 0,
         "y": 15
       },
-      "id": 21,
-      "options": {
-        "cellHeight": "sm",
-        "footer": {
-          "countRows": false,
-          "fields": "",
-          "reducer": [
-            "sum"
-          ],
-          "show": false
-        },
-        "showHeader": true
-      },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "expr": "kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"} * on(namespace, pod) group_left(phase) (kube_pod_status_phase{phase=~\"Running|Pending|Failed|Succeeded\"} == 1)",
-          "format": "table",
-          "instant": true,
-          "legendFormat": "",
-          "refId": "requested",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "$ds_prometheus"
-          }
-        },
-        {
-          "expr": "kube_pod_container_resource_limits{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"}",
-          "format": "table",
-          "instant": true,
-          "legendFormat": "",
-          "refId": "limits",
-          "datasource": {
-            "type": "prometheus",
-            "uid": "$ds_prometheus"
-          }
-        }
-      ],
-      "title": "Pods requesting GPU",
+      "repeatDirection": "h",
       "transformations": [
         {
           "id": "joinByField",
@@ -764,59 +525,106 @@
           }
         }
       ],
-      "type": "table"
+      "options": {
+        "frameIndex": 0,
+        "showHeader": true,
+        "showTypeIcons": false,
+        "footer": {
+          "show": false,
+          "reducer": []
+        },
+        "cellHeight": "sm"
+      },
+      "fieldConfig": {
+        "defaults": {},
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Status"
+            },
+            "properties": [
+              {
+                "id": "custom.cellOptions",
+                "value": {
+                  "mode": "basic",
+                  "type": "color-background"
+                }
+              },
+              {
+                "id": "mappings",
+                "value": [
+                  {
+                    "options": {
+                      "Failed": {
+                        "color": "red",
+                        "index": 2
+                      },
+                      "Pending": {
+                        "color": "orange",
+                        "index": 1
+                      },
+                      "Running": {
+                        "color": "green",
+                        "index": 0
+                      }
+                    },
+                    "type": "value"
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      }
     }
   ],
-  "refresh": "",
-  "schemaVersion": 40,
-  "tags": [
-    "gpu",
-    "quotas"
-  ],
   "templating": {
     "list": [
       {
-        "current": {},
-        "includeAll": false,
-        "label": "Prometheus",
+        "type": "datasource",
         "name": "ds_prometheus",
-        "options": [],
+        "label": "Prometheus",
+        "skipUrlSync": false,
         "query": "prometheus",
-        "refresh": 1,
+        "current": {
+          "selected": false,
+          "text": "default",
+          "value": "default"
+        },
+        "multi": false,
+        "allowCustomValue": true,
+        "includeAll": false,
         "regex": "",
-        "type": "datasource"
+        "auto": false,
+        "auto_min": "10s",
+        "auto_count": 30
       },
       {
-        "current": {},
+        "type": "query",
+        "name": "namespace",
+        "label": "Namespace",
+        "skipUrlSync": false,
+        "query": "label_values(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"}, namespace)",
         "datasource": {
           "type": "prometheus",
-          "uid": "${DS_VM-SHORTTERM}"
+          "uid": "$ds_prometheus"
+        },
+        "current": {
+          "selected": true,
+          "text": "All",
+          "value": "$__all"
         },
-        "definition": "label_values(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"}, namespace)",
-        "includeAll": true,
-        "label": "Namespace",
         "multi": true,
-        "name": "namespace",
-        "options": [],
-        "query": {
-          "query": "label_values(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"}, namespace)",
-          "refId": "StandardVariableQuery"
-        },
+        "allowCustomValue": true,
         "refresh": 2,
-        "regex": "",
         "sort": 1,
-        "type": "query"
+        "includeAll": true,
+        "auto": false,
+        "auto_min": "10s",
+        "auto_count": 30
       }
     ]
   },
-  "time": {
-    "from": "now-6h",
-    "to": "now"
-  },
-  "timepicker": {},
-  "timezone": "",
-  "title": "GPU Quotas & Allocation",
-  "uid": "gpu-quotas",
-  "version": 4,
-  "weekStart": ""
-}
+  "annotations": {}
+}
\ No newline at end of file

From 2461c239b03840cba10111029fb79e8b8195527e Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Fri, 17 Apr 2026 11:32:44 +0500
Subject: [PATCH 515/666] fix(linstor): restrict linstor-gui to
 cozystack-cluster-admin group
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Before this change oauth2-proxy fronting linstor-gui only enforced that
the user could authenticate against the `cozy` Keycloak realm
(`--email-domain=*`, no group restriction). Any realm user could reach
the UI and, through it, the LINSTOR controller REST API — which the
gatekeeper proxies with a static mTLS client cert and no per-user RBAC.

Add `--allowed-group=cozystack-cluster-admin` and include `groups` in
the OIDC scope so the claim is present at validation time. The
`cozystack-cluster-admin` KeycloakRealmGroup and the `groups` client
scope are already provisioned by keycloak-configure, so no cluster-wide
changes are needed.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
(cherry picked from commit 9b54e4672364a0de7859c5273dd2b280374083ea)
---
 packages/system/linstor-gui/README.md                    | 7 +++++--
 packages/system/linstor-gui/templates/gatekeeper.yaml    | 8 +++++++-
 packages/system/linstor-gui/tests/ingress_auth_test.yaml | 6 ++++++
 3 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/packages/system/linstor-gui/README.md b/packages/system/linstor-gui/README.md
index 2c9ac5d5..8f8053ab 100644
--- a/packages/system/linstor-gui/README.md
+++ b/packages/system/linstor-gui/README.md
@@ -13,8 +13,11 @@ using mTLS with the `linstor-client-tls` secret created by the `linstor` package
 
 The chart ships an `oauth2-proxy` based gatekeeper plus a `KeycloakClient` CRD
 so the UI can be published on `linstor-gui.<root-host>` behind the cluster
-Keycloak realm. Access is granted to any user who can authenticate against the
-`cozy` realm.
+Keycloak realm. Access is restricted to members of the
+`cozystack-cluster-admin` Keycloak group — the same group that grants
+cluster-admin RBAC on the host cluster. Authenticating against the `cozy`
+realm alone is not sufficient; users outside that group receive a 403 from
+oauth2-proxy before any request reaches the UI or the LINSTOR controller.
 
 To turn it on, add `linstor-gui` to `publishing.exposedServices` in the core
 `cozystack` values (same list that controls `dashboard`). OIDC must be
diff --git a/packages/system/linstor-gui/templates/gatekeeper.yaml b/packages/system/linstor-gui/templates/gatekeeper.yaml
index 0830a5fa..81451f41 100644
--- a/packages/system/linstor-gui/templates/gatekeeper.yaml
+++ b/packages/system/linstor-gui/templates/gatekeeper.yaml
@@ -13,6 +13,11 @@ Only rendered when oidc-enabled=true. If the cluster has OIDC disabled we
 deliberately do not ship an unauthenticated token-proxy fallback (unlike
 dashboard): linstor-gui surfaces raw storage state and should not be
 reachable via Ingress without Keycloak login.
+
+Access is further restricted to the cozystack-cluster-admin group
+(--allowed-group below). The proxy authenticates with a static mTLS client
+cert and LINSTOR itself has no per-user RBAC, so group membership is the
+only boundary between a realm user and raw storage state.
 */ -}}
 {{- if eq $oidcEnabled "true" }}
 apiVersion: apps/v1
@@ -84,7 +89,8 @@ spec:
             - --cookie-secure=true
             - --cookie-secret=$(OAUTH2_PROXY_COOKIE_SECRET)
             - --skip-provider-button
-            - --scope=openid email profile offline_access
+            - --scope=openid email profile groups offline_access
+            - --allowed-group=cozystack-cluster-admin
             {{- if eq $oidcInsecureSkipVerify "true" }}
             - --ssl-insecure-skip-verify=true
             {{- end }}
diff --git a/packages/system/linstor-gui/tests/ingress_auth_test.yaml b/packages/system/linstor-gui/tests/ingress_auth_test.yaml
index fe735f50..2f0b1d73 100644
--- a/packages/system/linstor-gui/tests/ingress_auth_test.yaml
+++ b/packages/system/linstor-gui/tests/ingress_auth_test.yaml
@@ -109,6 +109,12 @@ tests:
       - contains:
           path: spec.template.spec.containers[0].args
           content: --oidc-issuer-url=https://keycloak.dev10.example.org/realms/cozy
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --scope=openid email profile groups offline_access
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --allowed-group=cozystack-cluster-admin
       - contains:
           path: spec.template.spec.containers[0].env
           content:

From 11f7d3589b3284fca96d0df21a02a5e967dadce7 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 05:47:33 +0300
Subject: [PATCH 516/666] chore: ignore CLAUDE.local.md

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index 61003de5..64470222 100644
--- a/.gitignore
+++ b/.gitignore
@@ -84,3 +84,4 @@ tmp/
 # build revision marker (generated by make image-packages)
 packages/core/platform/.build-revision
 .claude/
+CLAUDE.local.md

From 4f8cef47bf307d7e23eac6536a1e7153a940d283 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 05:54:21 +0300
Subject: [PATCH 517/666] fix(monitoring): restore trailing newline in GPU
 dashboards

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-efficiency.json | 2 +-
 dashboards/gpu/gpu-quotas.json     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dashboards/gpu/gpu-efficiency.json b/dashboards/gpu/gpu-efficiency.json
index 1a305b4b..596961e0 100644
--- a/dashboards/gpu/gpu-efficiency.json
+++ b/dashboards/gpu/gpu-efficiency.json
@@ -838,4 +838,4 @@
     ]
   },
   "annotations": {}
-}
\ No newline at end of file
+}
diff --git a/dashboards/gpu/gpu-quotas.json b/dashboards/gpu/gpu-quotas.json
index 840065f3..60c628f6 100644
--- a/dashboards/gpu/gpu-quotas.json
+++ b/dashboards/gpu/gpu-quotas.json
@@ -627,4 +627,4 @@
     ]
   },
   "annotations": {}
-}
\ No newline at end of file
+}

From 4e8731b58882edab23d79c99b5b6b49dda96c572 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 06:02:17 +0300
Subject: [PATCH 518/666] refactor(monitoring): rework GPU recording rules

- Drop gpu.recording.30s group: per-GPU 30s aggregates had no consumers
  in tracked dashboards, only burned cardinality.
- Drop namespace:gpu_allocated_count:gauge: identical expression to
  namespace:gpu_count:sum under a different name.
- Reground :allocated on kube_pod_container_resource_requests so it
  reflects what tenants requested (Pending+Running) rather than what
  DCGM currently sees. namespace:gpu_count:sum stays DCGM-based and
  represents actually-running pods; the gap between the two is the
  signal admins want.
- Add namespace:gpu_count:allocated as the per-namespace counterpart.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../alerts/gpu-recording.rules.yaml           | 82 +++++++++++++------
 1 file changed, 59 insertions(+), 23 deletions(-)

diff --git a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
index 871a46fc..a54860b7 100644
--- a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
+++ b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
@@ -4,33 +4,17 @@ metadata:
   name: alerts-gpu-recording.rules
 spec:
   groups:
-    - name: gpu.recording.30s
-      interval: 30s
-      rules:
-        - record: gpu:util:avg
-          expr: avg by (Hostname, gpu, UUID, modelName, namespace, pod) (DCGM_FI_DEV_GPU_UTIL)
-        - record: gpu:mem_copy_util:avg
-          expr: avg by (Hostname, gpu, UUID, modelName, namespace, pod) (DCGM_FI_DEV_MEM_COPY_UTIL)
-        - record: gpu:fb_used_bytes:max
-          expr: max by (Hostname, gpu, UUID, modelName, namespace, pod) (DCGM_FI_DEV_FB_USED) * 1048576
-        - record: gpu:fb_free_bytes:max
-          expr: max by (Hostname, gpu, UUID, modelName, namespace, pod) (DCGM_FI_DEV_FB_FREE) * 1048576
-        - record: gpu:power_watts:avg
-          expr: avg by (Hostname, gpu, UUID, modelName, namespace, pod) (DCGM_FI_DEV_POWER_USAGE)
-        - record: gpu:temp_celsius:max
-          expr: max by (Hostname, gpu, UUID, modelName) (DCGM_FI_DEV_GPU_TEMP)
-        - record: gpu:tensor_active:avg
-          expr: avg by (Hostname, gpu, UUID, modelName, namespace, pod) (DCGM_FI_PROF_PIPE_TENSOR_ACTIVE)
-        - record: gpu:gr_engine_active:avg
-          expr: avg by (Hostname, gpu, UUID, modelName, namespace, pod) (DCGM_FI_PROF_GR_ENGINE_ACTIVE)
-
     - name: gpu.recording.cluster.1m
       interval: 1m
       rules:
         - record: cluster:gpu_count:total
           expr: count(group by (UUID) (DCGM_FI_DEV_GPU_UTIL))
+        # Kube-allocated GPU count: GPUs requested by *all* pods regardless of
+        # phase (Pending+Running). Source of truth for "what tenants asked for"
+        # — used for capacity planning and billing. Includes system pods so it
+        # stays consistent with cluster:gpu_count:total when computing :free.
         - record: cluster:gpu_count:allocated
-          expr: count(group by (UUID) (DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"}))
+          expr: sum(kube_pod_container_resource_requests{resource="nvidia_com_gpu"})
         - record: cluster:gpu_count:free
           expr: cluster:gpu_count:total - (cluster:gpu_count:allocated or vector(0))
         - record: cluster:gpu_util:avg
@@ -41,8 +25,16 @@ spec:
     - name: gpu.recording.namespace.1m
       interval: 1m
       rules:
+        # DCGM-visible GPU count per namespace — counts GPUs that are actually
+        # running a tenant pod right now (driver loaded, scheduler placed it).
+        # Differs from :allocated when pods are Pending or stuck.
         - record: namespace:gpu_count:sum
           expr: count by (namespace) (DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"})
+        # Kube-requested GPU count per namespace — billable view, includes
+        # Pending pods. Use this for GPU-hour reporting via
+        # sum_over_time(...[1h:1m])/60.
+        - record: namespace:gpu_count:allocated
+          expr: sum by (namespace) (kube_pod_container_resource_requests{resource="nvidia_com_gpu"})
         - record: namespace:gpu_util:avg
           expr: avg by (namespace) (DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"})
         - record: namespace:tensor_active:avg
@@ -53,5 +45,49 @@ spec:
           expr: sum by (namespace) (DCGM_FI_DEV_POWER_USAGE{namespace!="", namespace!~"cozy-.*|kube-.*"})
         - record: namespace:energy_joules:sum
           expr: sum by (namespace) (DCGM_FI_DEV_TOTAL_ENERGY_CONSUMPTION{namespace!="", namespace!~"cozy-.*|kube-.*"}) / 1000
-        - record: namespace:gpu_allocated_count:gauge
-          expr: count by (namespace) (DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"})
+
+    - name: gpu.recording.efficiency.1m
+      interval: 1m
+      rules:
+        # Tensor hardware saturation — the honest "am I using the GPU" metric
+        # for AI/LLM workloads. Unlike NVML, idle tensor cores are visible.
+        - record: pod:tensor_saturation:avg5m
+          expr: |
+            avg by (Hostname, gpu, UUID, namespace, pod) (
+              avg_over_time(DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{namespace!="", namespace!~"cozy-.*|kube-.*"}[5m])
+            ) * 100
+
+        # NVML vs tensor gap — ratio <10% means NVML lies: user thinks GPU
+        # is busy but specialized hardware is idle (cheap tenant signal).
+        - record: pod:tensor_to_nvml_ratio:avg5m
+          expr: |
+            (
+              avg_over_time(DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{namespace!="", namespace!~"cozy-.*|kube-.*"}[5m]) * 100
+            )
+            /
+            clamp_min(
+              avg_over_time(DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"}[5m]),
+              1
+            )
+
+        # Power efficiency — utilization per watt, reveals unoptimized clients.
+        - record: pod:util_per_watt:avg5m
+          expr: |
+            avg_over_time(DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"}[5m])
+            /
+            clamp_min(
+              avg_over_time(DCGM_FI_DEV_POWER_USAGE{namespace!="", namespace!~"cozy-.*|kube-.*"}[5m]),
+              1
+            )
+
+        # Fraction of time power-throttled (TDP cap) — 1.0 = fully throttled.
+        # DCGM_FI_DEV_*_VIOLATION is documented as µs but on A10/DCGM 3.x the
+        # counter grows in nanoseconds in practice — divide by 1e9 to get a
+        # 0..1 fraction (verified empirically when /1e6 yielded >100× reality).
+        # clamp_max protects against rate() artefacts at counter resets.
+        - record: gpu:power_throttle_fraction:rate5m
+          expr: clamp_max(rate(DCGM_FI_DEV_POWER_VIOLATION[5m]) / 1e9, 1)
+
+        # Fraction of time thermal-throttled.
+        - record: gpu:thermal_throttle_fraction:rate5m
+          expr: clamp_max(rate(DCGM_FI_DEV_THERMAL_VIOLATION[5m]) / 1e9, 1)

From 0e20159bd999795fd92f9b2099529bbe9b4de040 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 06:09:44 +0300
Subject: [PATCH 519/666] fix(gpu-operator): scope compat DaemonSet to GPU
 nodes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Restrict the nvidia-driver-compat DaemonSet to nodes labelled
nvidia.com/gpu.present=true (NFD/GPU Operator label). Without the
nodeSelector it was scheduling onto every node — control-plane and
CPU-only workers included — burning a privileged pod slot per host
for no benefit.

Add resource requests and limits to the init and pause containers so
the DaemonSet stays within control-plane budget on small clusters.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../examples/nvidia-driver-compat.yaml        | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml b/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml
index e4718e0a..63e07c4f 100644
--- a/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml
+++ b/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml
@@ -27,6 +27,14 @@ spec:
     spec:
       hostPID: true
       priorityClassName: system-node-critical
+      # Restrict to GPU nodes only. Without this the DaemonSet schedules onto
+      # every node (including control-plane and CPU-only workers) and burns
+      # resources on hosts where the compat tree is meaningless.
+      # The label is published by Node Feature Discovery / GPU Operator's NFD
+      # subchart; if NFD is disabled, replace this with whatever label your
+      # cluster uses to mark GPU hosts.
+      nodeSelector:
+        nvidia.com/gpu.present: "true"
       tolerations:
         - operator: Exists
       initContainers:
@@ -60,12 +68,26 @@ spec:
               echo "Done"
           securityContext:
             privileged: true
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
           volumeMounts:
             - name: host-root
               mountPath: /host
       containers:
         - name: pause
           image: registry.k8s.io/pause:3.10
+          resources:
+            requests:
+              cpu: 10m
+              memory: 8Mi
+            limits:
+              cpu: 50m
+              memory: 16Mi
       volumes:
         - name: host-root
           hostPath:

From 38c8a37cb585ff235c7d90d0824a457e7da93095 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 06:15:58 +0300
Subject: [PATCH 520/666] docs(gpu-operator): clarify minimum required DCGM
 metrics
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous wording implied that the entire custom DCGM CSV was
required by the recording rules. In fact only the profiling counters
(DCGM_FI_PROF_*) need to be added on top of the upstream defaults —
everything else the rules consume is already in default-counters.csv.

Add a Verification status block flagging that the minimum-set claim is
derived from the DCGM Exporter version pinned in the currently shipped
gpu-operator package and must be re-checked when that package moves to
a newer release.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../system/gpu-operator/examples/README.md    | 30 +++++++++++++++++--
 1 file changed, 27 insertions(+), 3 deletions(-)

diff --git a/packages/system/gpu-operator/examples/README.md b/packages/system/gpu-operator/examples/README.md
index dac3703e..11c2bb09 100644
--- a/packages/system/gpu-operator/examples/README.md
+++ b/packages/system/gpu-operator/examples/README.md
@@ -21,9 +21,16 @@ Talos.
   ConfigMap.
 - [`dcgm-custom-metrics.yaml`](./dcgm-custom-metrics.yaml) — `ConfigMap`
   with a DCGM metrics CSV that adds profiling, ECC, throttling and
-  energy counters on top of the upstream defaults. Required by the
-  recording rules in `packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml`
-  and by several panels in the `gpu/gpu-performance` dashboard.
+  energy counters on top of the upstream defaults. The CSV is the
+  superset needed for full dashboard coverage; the **recording rules
+  themselves** only require the profiling subset
+  (`DCGM_FI_PROF_PIPE_TENSOR_ACTIVE`, `DCGM_FI_PROF_GR_ENGINE_ACTIVE`)
+  on top of the upstream `default-counters.csv` — every other DCGM
+  series the rules consume (utilization, FB used/free, power,
+  temperature, energy) is already in the default set. The
+  `gpu/gpu-performance` dashboard additionally needs the throttle
+  counters (`DCGM_FI_DEV_POWER_VIOLATION`,
+  `DCGM_FI_DEV_THERMAL_VIOLATION`), which are not in the default set.
 - [`nvidia-driver-compat.yaml`](./nvidia-driver-compat.yaml) — DaemonSet
   that stages `libnvidia-ml.so.1` and `nvidia-smi` from the Talos glibc
   tree into a path where the NVIDIA GPU Operator validator expects
@@ -55,6 +62,23 @@ files into a directory the validator does inspect and creates the
 
 [1]: https://github.com/NVIDIA/gpu-operator/issues/1687
 
+## Verification status
+
+> **Pending verification on an updated GPU Operator release.**
+>
+> The minimum-CSV claim above (only `DCGM_FI_PROF_*` is needed beyond
+> the upstream default counters) is derived by cross-referencing
+> `gpu-recording.rules.yaml` against the DCGM Exporter
+> [`default-counters.csv`][default-csv] for the version pinned in the
+> currently shipped `gpu-operator` package. The package in this branch
+> is **not** the latest GPU Operator release; once we move to a newer
+> version, the claim must be re-checked because the upstream default
+> set occasionally adds or removes counters between releases. Until
+> then, treat the CSV in `dcgm-custom-metrics.yaml` as a known-good
+> superset rather than a minimal config.
+
+[default-csv]: https://github.com/NVIDIA/dcgm-exporter/blob/main/etc/default-counters.csv
+
 ## How the dashboard and recording rules fit in
 
 - `dashboards/gpu/gpu-performance.json` expects `DCGM_FI_*` metrics,

From 49c1d7e7abeddebf6047a52b6de7e13f53c60ba5 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 06:22:31 +0300
Subject: [PATCH 521/666] test(monitoring): cross-check GPU dashboards against
 recording rules
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Catch dangling references at PR time: every recording-rule name used
inside a tracked GPU dashboard must exist in
packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml. The
first iteration of gpu-efficiency.json shipped panels keyed on
pod:tensor_saturation:avg5m without the rule defined; the test fails
on exactly that class of bug.

Scoped to dashboards listed under gpu/* in dashboards-infra.list, so
untracked drafts stay out of scope until they are registered. Reverse
direction (rule defined but unused) is intentionally NOT enforced —
some rules exist for ad-hoc PromQL or upcoming dashboards.

Auto-discovered by make bats-unit-tests via hack/cozytest.sh.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 hack/check-gpu-recording-rules.bats | 114 ++++++++++++++++++++++++++++
 1 file changed, 114 insertions(+)
 create mode 100644 hack/check-gpu-recording-rules.bats

diff --git a/hack/check-gpu-recording-rules.bats b/hack/check-gpu-recording-rules.bats
new file mode 100644
index 00000000..87e7c8f1
--- /dev/null
+++ b/hack/check-gpu-recording-rules.bats
@@ -0,0 +1,114 @@
+#!/usr/bin/env bats
+# -----------------------------------------------------------------------------
+# Cross-validation between GPU recording rules and the dashboards that consume
+# them. Catches:
+#
+#   1. dangling references — a dashboard query mentions a recording rule name
+#      that doesn't exist in gpu-recording.rules.yaml. This is the bug the
+#      pre-merge review caught: gpu-efficiency.json shipped panels keyed on
+#      pod:tensor_saturation:avg5m without the rule being defined, so the
+#      panel showed "No data" everywhere.
+#
+#   2. typos in rule names — same bug class, manifested as a single-character
+#      difference between rule and reference.
+#
+# Scope: only dashboards listed in packages/system/monitoring/dashboards-infra.list
+# under the "gpu/" prefix (i.e. shipped to production), not every JSON file in
+# dashboards/gpu/. Untracked drafts stay out of scope on purpose — adding one
+# to dashboards-infra.list is what brings it under the test.
+#
+# Reverse direction (rule defined but never consumed) is intentionally NOT
+# enforced: some rules exist for ad-hoc PromQL or upcoming dashboards. Treat
+# unused rules as an editorial concern, not a regression.
+#
+# Title syntax constraints from cozytest.sh's awk parser:
+#   - Titles delimited by ASCII double quotes; embedded quotes truncate.
+#   - Only [A-Za-z0-9] from the title survives into the function name; titles
+#     differing only in punctuation collapse to the same function.
+#
+# Run with: hack/cozytest.sh hack/check-gpu-recording-rules.bats
+# -----------------------------------------------------------------------------
+
+REPO_ROOT="$(cd "$(dirname "${BATS_TEST_FILENAME:-$0}")/.." && pwd)"
+RULES_FILE="$REPO_ROOT/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml"
+DASHBOARDS_LIST="$REPO_ROOT/packages/system/monitoring/dashboards-infra.list"
+DASHBOARDS_DIR="$REPO_ROOT/dashboards"
+
+# Extract the set of "- record: NAME" entries from the rules YAML.
+# Outputs one rule name per line, sorted and deduplicated.
+extract_rules() {
+  awk '/^[[:space:]]*-[[:space:]]*record:[[:space:]]/ {
+    sub(/^[[:space:]]*-[[:space:]]*record:[[:space:]]*/, "")
+    sub(/[[:space:]]*$/, "")
+    print
+  }' "$RULES_FILE" | sort -u
+}
+
+# Extract the set of recording-rule references from a dashboard JSON.
+# A recording-rule reference is matched by the pattern
+#   <segment>:<segment>(:<segment>)+
+# where each <segment> is [a-z0-9_]. Raw DCGM metrics (DCGM_FI_*),
+# kube-state-metrics (kube_*) and similar uppercase / single-word metric
+# names do not match because the leading segment must be lowercase and the
+# whole expression must contain at least two ':' characters.
+extract_refs() {
+  json_file=$1
+  grep -hoE '[a-z][a-z0-9_]*:[a-z0-9_]+:[a-z0-9_]+' "$json_file" | sort -u
+}
+
+# Resolve "gpu/foo" -> "$DASHBOARDS_DIR/gpu/foo.json"
+list_tracked_gpu_dashboards() {
+  awk '/^gpu\// { print $0 ".json" }' "$DASHBOARDS_LIST"
+}
+
+@test "every recording rule reference in tracked GPU dashboards has a matching record" {
+  TMP=$(mktemp -d)
+  trap 'rm -rf "$TMP"' EXIT
+
+  extract_rules > "$TMP/rules.txt"
+  [ -s "$TMP/rules.txt" ] || { echo "no recording rules extracted from $RULES_FILE" >&2; exit 1; }
+
+  list_tracked_gpu_dashboards > "$TMP/dashboards.txt"
+  [ -s "$TMP/dashboards.txt" ] || { echo "no gpu/* dashboards listed in $DASHBOARDS_LIST" >&2; exit 1; }
+
+  failed=0
+  while IFS= read -r dashboard_rel; do
+    dashboard="$DASHBOARDS_DIR/$dashboard_rel"
+    if [ ! -f "$dashboard" ]; then
+      echo "ERROR: dashboard listed but file missing: $dashboard" >&2
+      failed=1
+      continue
+    fi
+
+    extract_refs "$dashboard" > "$TMP/refs.txt"
+    # comm -23: lines unique to refs.txt (referenced but not defined)
+    # Both inputs must be sorted; extract_* helpers already sort.
+    comm -23 "$TMP/refs.txt" "$TMP/rules.txt" > "$TMP/missing.txt"
+    if [ -s "$TMP/missing.txt" ]; then
+      echo "ERROR: $dashboard_rel references undefined recording rules:" >&2
+      sed 's/^/  - /' "$TMP/missing.txt" >&2
+      failed=1
+    fi
+  done < "$TMP/dashboards.txt"
+
+  [ "$failed" -eq 0 ]
+}
+
+@test "every tracked GPU dashboard listed in dashboards-infra.list exists on disk" {
+  TMP=$(mktemp -d)
+  trap 'rm -rf "$TMP"' EXIT
+
+  list_tracked_gpu_dashboards > "$TMP/dashboards.txt"
+  [ -s "$TMP/dashboards.txt" ] || { echo "no gpu/* dashboards listed in $DASHBOARDS_LIST" >&2; exit 1; }
+
+  failed=0
+  while IFS= read -r dashboard_rel; do
+    dashboard="$DASHBOARDS_DIR/$dashboard_rel"
+    if [ ! -f "$dashboard" ]; then
+      echo "ERROR: $dashboard_rel listed in dashboards-infra.list but $dashboard does not exist" >&2
+      failed=1
+    fi
+  done < "$TMP/dashboards.txt"
+
+  [ "$failed" -eq 0 ]
+}

From dbed4992b08392c28bac8f0b5f917619b88cec65 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 06:28:49 +0300
Subject: [PATCH 522/666] fix(monitoring): exclude system namespaces from
 namespace:gpu_count:allocated
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Align namespace:gpu_count:allocated with every other namespace:* rule
by filtering out cozy-*/kube-*. All other per-namespace rules
(gpu_util, tensor_active, fb_used_bytes, power_watts) already exclude
system namespaces, so the label set produced by :allocated diverged
from them — any dashboard variable or join that reads across these
rules could end up with a different namespace list depending on which
rule supplied the :allocated column.

Trade-off: per-namespace GPU accounting for system workloads is no
longer available through this rule. If it's ever needed, add a
dedicated system:gpu_count:allocated rather than widening this one —
the "billable tenant view" invariant is what the filter is protecting.

Cluster-level cluster:gpu_count:allocated intentionally keeps system
pods so it stays aligned with cluster:gpu_count:total and
cluster:gpu_count:free remains meaningful. As a consequence,
sum(namespace:gpu_count:allocated) no longer equals
cluster:gpu_count:allocated; the delta is system-pod GPU usage, which
is fine for the cluster-admin view.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../alerts/gpu-recording.rules.yaml           | 21 ++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
index a54860b7..3a31f5a2 100644
--- a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
+++ b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
@@ -33,8 +33,27 @@ spec:
         # Kube-requested GPU count per namespace — billable view, includes
         # Pending pods. Use this for GPU-hour reporting via
         # sum_over_time(...[1h:1m])/60.
+        #
+        # Filters cozy-*/kube-* so the namespace set here matches every
+        # other namespace:* rule below. This keeps the $namespace variable
+        # in the tenant dashboard consistent with panels that read filtered
+        # rules — otherwise picking a system ns from the dropdown leaves
+        # half the panels empty while others show values.
+        #
+        # Trade-off: per-namespace GPU accounting for system workloads is
+        # no longer available here. If it's ever needed (e.g. operator
+        # pods pinning tenant GPUs), add a separate rule like
+        # system:gpu_count:allocated rather than widening this one — the
+        # "billable tenant view" invariant is relied on by tenants.json
+        # and keeping it narrow protects consumers from the asymmetry
+        # that triggered this filter in the first place.
+        #
+        # Note: sum(namespace:gpu_count:allocated) no longer equals
+        # cluster:gpu_count:allocated — the cluster-level rule intentionally
+        # keeps system pods to stay aligned with cluster:gpu_count:total
+        # when computing :free.
         - record: namespace:gpu_count:allocated
-          expr: sum by (namespace) (kube_pod_container_resource_requests{resource="nvidia_com_gpu"})
+          expr: sum by (namespace) (kube_pod_container_resource_requests{resource="nvidia_com_gpu", namespace!="", namespace!~"cozy-.*|kube-.*"})
         - record: namespace:gpu_util:avg
           expr: avg by (namespace) (DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"})
         - record: namespace:tensor_active:avg

From 6d9066f0748744d78f823e3137f72b5e912069e9 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 06:35:12 +0300
Subject: [PATCH 523/666] feat(monitoring): add GPU fleet and tenants
 dashboards
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- gpu-fleet: cluster-wide admin view — inventory, capacity (total /
  allocated / free), per-node utilization and power, throttling,
  temperatures, XID errors.
- gpu-tenants: per-namespace view — live allocation, utilization,
  tensor saturation, power, and 24h GPU-hours / kWh integrations for
  billing inputs.

Register both under gpu/* in dashboards-infra.list so they ship as
GrafanaDashboard CRs and fall under the bats cross-check introduced
earlier on this branch.

Update examples/README to spell out which DCGM counters each of the
five gpu/* dashboards actually needs on top of the upstream default
CSV — gpu-performance needs profiling and throttling counters,
gpu-efficiency needs profiling, gpu-tenants needs only
DCGM_FI_PROF_PIPE_TENSOR_ACTIVE for its tensor panel, and gpu-fleet
and gpu-quotas work on the default counter set alone.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-fleet.json                 | 1157 +++++++++++++++
 dashboards/gpu/gpu-tenants.json               | 1236 +++++++++++++++++
 .../system/gpu-operator/examples/README.md    |   74 +-
 .../system/monitoring/dashboards-infra.list   |    2 +
 4 files changed, 2436 insertions(+), 33 deletions(-)
 create mode 100644 dashboards/gpu/gpu-fleet.json
 create mode 100644 dashboards/gpu/gpu-tenants.json

diff --git a/dashboards/gpu/gpu-fleet.json b/dashboards/gpu/gpu-fleet.json
new file mode 100644
index 00000000..af5ad2fa
--- /dev/null
+++ b/dashboards/gpu/gpu-fleet.json
@@ -0,0 +1,1157 @@
+{
+  "uid": "gpu-fleet",
+  "title": "GPU Fleet Overview",
+  "description": "Cluster-wide GPU inventory, capacity, utilization and health — admin view across the whole fleet.",
+  "tags": [
+    "gpu",
+    "fleet",
+    "admin"
+  ],
+  "timezone": "browser",
+  "editable": true,
+  "graphTooltip": 1,
+  "time": {
+    "from": "now-6h",
+    "to": "now"
+  },
+  "fiscalYearStartMonth": 0,
+  "schemaVersion": 42,
+  "panels": [
+    {
+      "type": "row",
+      "collapsed": false,
+      "title": "Cluster snapshot",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 0
+      },
+      "id": 1,
+      "panels": []
+    },
+    {
+      "type": "stat",
+      "id": 2,
+      "targets": [
+        {
+          "expr": "cluster:gpu_count:total",
+          "refId": "A"
+        }
+      ],
+      "title": "Total GPUs",
+      "description": "Physical GPUs discovered by DCGM across all nodes.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 4,
+        "x": 0,
+        "y": 1
+      },
+      "repeatDirection": "h",
+      "options": {
+        "graphMode": "none",
+        "colorMode": "value",
+        "justifyMode": "auto",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "percentChangeColorMode": "standard",
+        "orientation": ""
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "blue"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 3,
+      "targets": [
+        {
+          "expr": "cluster:gpu_count:allocated",
+          "refId": "A"
+        }
+      ],
+      "title": "Allocated",
+      "description": "Sum of kube GPU requests across all pods. Billable view — includes Pending pods.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 4,
+        "x": 4,
+        "y": 1
+      },
+      "repeatDirection": "h",
+      "options": {
+        "graphMode": "none",
+        "colorMode": "background",
+        "justifyMode": "auto",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "percentChangeColorMode": "standard",
+        "orientation": ""
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "blue"
+              },
+              {
+                "value": 1,
+                "color": "green"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 4,
+      "targets": [
+        {
+          "expr": "cluster:gpu_count:free",
+          "refId": "A"
+        }
+      ],
+      "title": "Free",
+      "description": "Unallocated capacity available for new tenants.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 4,
+        "x": 8,
+        "y": 1
+      },
+      "repeatDirection": "h",
+      "options": {
+        "graphMode": "none",
+        "colorMode": "background",
+        "justifyMode": "auto",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "percentChangeColorMode": "standard",
+        "orientation": ""
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "red"
+              },
+              {
+                "value": 1,
+                "color": "yellow"
+              },
+              {
+                "value": 2,
+                "color": "green"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 5,
+      "targets": [
+        {
+          "expr": "count(kube_node_labels{label_nvidia_com_gpu_present=\"true\"})",
+          "refId": "A"
+        }
+      ],
+      "title": "Nodes with GPU",
+      "description": "Kubernetes nodes advertising nvidia.com/gpu.present=true.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 4,
+        "x": 12,
+        "y": 1
+      },
+      "repeatDirection": "h",
+      "options": {
+        "graphMode": "none",
+        "colorMode": "value",
+        "justifyMode": "auto",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "percentChangeColorMode": "standard",
+        "orientation": ""
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "blue"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 6,
+      "targets": [
+        {
+          "expr": "cluster:gpu_util:avg",
+          "refId": "A"
+        }
+      ],
+      "title": "Average utilization",
+      "description": "NVML utilization across all tenant GPUs (engine-active %).",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 4,
+        "x": 16,
+        "y": 1
+      },
+      "repeatDirection": "h",
+      "options": {
+        "graphMode": "area",
+        "colorMode": "value",
+        "justifyMode": "auto",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "percentChangeColorMode": "standard",
+        "orientation": ""
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percent",
+          "min": 0,
+          "max": 100,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "blue"
+              },
+              {
+                "value": 30,
+                "color": "green"
+              },
+              {
+                "value": 80,
+                "color": "orange"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 7,
+      "targets": [
+        {
+          "expr": "cluster:gpu_power_watts:sum",
+          "refId": "A"
+        }
+      ],
+      "title": "Total power",
+      "description": "Live power draw summed across the fleet.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 4,
+        "x": 20,
+        "y": 1
+      },
+      "repeatDirection": "h",
+      "options": {
+        "graphMode": "area",
+        "colorMode": "value",
+        "justifyMode": "auto",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "percentChangeColorMode": "standard",
+        "orientation": ""
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "watt",
+          "decimals": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "green"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "row",
+      "collapsed": false,
+      "title": "Per-node GPU activity",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 5
+      },
+      "id": 10,
+      "panels": []
+    },
+    {
+      "type": "bargauge",
+      "id": 11,
+      "targets": [
+        {
+          "expr": "avg by (Hostname) (DCGM_FI_DEV_GPU_UTIL)",
+          "legendFormat": "{{Hostname}}",
+          "refId": "A"
+        }
+      ],
+      "title": "GPU utilization per node",
+      "description": "Average NVML utilization per node — spot idle or saturated hosts at a glance.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 6
+      },
+      "repeatDirection": "h",
+      "options": {
+        "displayMode": "gradient",
+        "valueMode": "color",
+        "namePlacement": "auto",
+        "showUnfilled": true,
+        "sizing": "auto",
+        "minVizWidth": 8,
+        "minVizHeight": 16,
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": false,
+          "calcs": []
+        },
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "maxVizHeight": 300,
+        "orientation": "horizontal"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percent",
+          "min": 0,
+          "max": 100,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "blue"
+              },
+              {
+                "value": 30,
+                "color": "green"
+              },
+              {
+                "value": 80,
+                "color": "orange"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "bargauge",
+      "id": 12,
+      "targets": [
+        {
+          "expr": "sum by (Hostname) (DCGM_FI_DEV_POWER_USAGE)",
+          "legendFormat": "{{Hostname}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Power draw per node",
+      "description": "Sum of GPU power usage per node in watts.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 6
+      },
+      "repeatDirection": "h",
+      "options": {
+        "displayMode": "gradient",
+        "valueMode": "color",
+        "namePlacement": "auto",
+        "showUnfilled": true,
+        "sizing": "auto",
+        "minVizWidth": 8,
+        "minVizHeight": 16,
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": false,
+          "calcs": []
+        },
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "maxVizHeight": 300,
+        "orientation": "horizontal"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "watt",
+          "min": 0,
+          "max": 200,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "green"
+              },
+              {
+                "value": 120,
+                "color": "yellow"
+              },
+              {
+                "value": 160,
+                "color": "orange"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "row",
+      "collapsed": false,
+      "title": "Usage trends",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 14
+      },
+      "id": 20,
+      "panels": []
+    },
+    {
+      "type": "timeseries",
+      "id": 21,
+      "targets": [
+        {
+          "expr": "avg by (Hostname) (DCGM_FI_DEV_GPU_UTIL)",
+          "legendFormat": "{{Hostname}}",
+          "refId": "A"
+        }
+      ],
+      "title": "GPU utilization per node (trend)",
+      "description": "Per-node NVML utilization over time — shows shifting workload across hosts.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 15
+      },
+      "repeatDirection": "h",
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": ""
+        }
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percent",
+          "min": 0,
+          "max": 100,
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 20,
+            "showPoints": "never"
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "timeseries",
+      "id": 22,
+      "targets": [
+        {
+          "expr": "sum by (Hostname) (DCGM_FI_DEV_POWER_USAGE)",
+          "legendFormat": "{{Hostname}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Power draw per node (trend)",
+      "description": "Per-node GPU power consumption over time.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 15
+      },
+      "repeatDirection": "h",
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": ""
+        }
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "watt",
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 20,
+            "showPoints": "never"
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "row",
+      "collapsed": false,
+      "title": "Health",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 23
+      },
+      "id": 30,
+      "panels": []
+    },
+    {
+      "type": "stat",
+      "id": 31,
+      "targets": [
+        {
+          "expr": "count((max by (Hostname, gpu) (DCGM_FI_DEV_XID_ERRORS)) \u003e 0) or vector(0)",
+          "refId": "A"
+        }
+      ],
+      "title": "GPUs with XID errors",
+      "description": "Count of GPUs reporting a non-zero XID code. XID = NVIDIA hardware/driver error — any non-zero value needs investigation.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 6,
+        "x": 0,
+        "y": 24
+      },
+      "repeatDirection": "h",
+      "options": {
+        "graphMode": "none",
+        "colorMode": "background",
+        "justifyMode": "auto",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "percentChangeColorMode": "standard",
+        "orientation": ""
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "green"
+              },
+              {
+                "value": 1,
+                "color": "red"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 32,
+      "targets": [
+        {
+          "expr": "avg(gpu:power_throttle_fraction:rate5m)",
+          "refId": "A"
+        }
+      ],
+      "title": "Power throttling (cluster avg)",
+      "description": "Fraction of time the fleet spent power-throttled. \u003e5% = billed FLOPS are being underdelivered.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 6,
+        "x": 6,
+        "y": 24
+      },
+      "repeatDirection": "h",
+      "options": {
+        "graphMode": "none",
+        "colorMode": "background",
+        "justifyMode": "auto",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "percentChangeColorMode": "standard",
+        "orientation": ""
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percentunit",
+          "decimals": 2,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "green"
+              },
+              {
+                "value": 0.05,
+                "color": "yellow"
+              },
+              {
+                "value": 0.2,
+                "color": "red"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 33,
+      "targets": [
+        {
+          "expr": "avg(gpu:thermal_throttle_fraction:rate5m)",
+          "refId": "A"
+        }
+      ],
+      "title": "Thermal throttling (cluster avg)",
+      "description": "Fraction of time the fleet spent thermal-throttled. Indicates cooling/datacenter issues.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 6,
+        "x": 12,
+        "y": 24
+      },
+      "repeatDirection": "h",
+      "options": {
+        "graphMode": "none",
+        "colorMode": "background",
+        "justifyMode": "auto",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "percentChangeColorMode": "standard",
+        "orientation": ""
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percentunit",
+          "decimals": 2,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "green"
+              },
+              {
+                "value": 0.05,
+                "color": "yellow"
+              },
+              {
+                "value": 0.2,
+                "color": "red"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 34,
+      "targets": [
+        {
+          "expr": "max(DCGM_FI_DEV_GPU_TEMP)",
+          "refId": "A"
+        }
+      ],
+      "title": "Max GPU temperature",
+      "description": "Hottest GPU in the fleet right now. A10 sustained target \u003c83°C.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 6,
+        "x": 18,
+        "y": 24
+      },
+      "repeatDirection": "h",
+      "options": {
+        "graphMode": "none",
+        "colorMode": "background",
+        "justifyMode": "auto",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "percentChangeColorMode": "standard",
+        "orientation": ""
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "celsius",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "green"
+              },
+              {
+                "value": 75,
+                "color": "yellow"
+              },
+              {
+                "value": 85,
+                "color": "red"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "timeseries",
+      "id": 35,
+      "targets": [
+        {
+          "expr": "DCGM_FI_DEV_GPU_TEMP",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Temperature per GPU",
+      "description": "Per-GPU temperature trace. Sustained red zone = cooling issue or aggressive workload.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 29
+      },
+      "repeatDirection": "h",
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": ""
+        }
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "celsius",
+          "min": 20,
+          "max": 100,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "green"
+              },
+              {
+                "value": 75,
+                "color": "yellow"
+              },
+              {
+                "value": 85,
+                "color": "red"
+              }
+            ]
+          },
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 10,
+            "showPoints": "never"
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "timeseries",
+      "id": 36,
+      "targets": [
+        {
+          "expr": "gpu:power_throttle_fraction:rate5m",
+          "legendFormat": "power {{Hostname}}/{{gpu}}",
+          "refId": "A"
+        },
+        {
+          "expr": "gpu:thermal_throttle_fraction:rate5m",
+          "legendFormat": "thermal {{Hostname}}/{{gpu}}",
+          "refId": "B"
+        }
+      ],
+      "title": "Throttle fraction per GPU",
+      "description": "Red = power throttle, blue = thermal throttle. Both on same chart to compare causes.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 29
+      },
+      "repeatDirection": "h",
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": ""
+        }
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percentunit",
+          "min": 0,
+          "max": 1,
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 25,
+            "showPoints": "never"
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "row",
+      "collapsed": false,
+      "title": "Hardware inventory",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 37
+      },
+      "id": 40,
+      "panels": []
+    },
+    {
+      "type": "table",
+      "id": 41,
+      "targets": [
+        {
+          "expr": "group by (Hostname, modelName, gpu, UUID) (DCGM_FI_DEV_GPU_UTIL)",
+          "instant": true,
+          "range": false,
+          "format": "table",
+          "refId": "A"
+        }
+      ],
+      "title": "GPU inventory",
+      "description": "One row per physical GPU. Model / index / UUID sourced from DCGM labels.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 24,
+        "x": 0,
+        "y": 38
+      },
+      "repeatDirection": "h",
+      "transformations": [
+        {
+          "id": "organize",
+          "options": {
+            "excludeByName": {
+              "Time": true,
+              "Value": true,
+              "__name__": true,
+              "cluster": true,
+              "container": true,
+              "device": true,
+              "endpoint": true,
+              "instance": true,
+              "job": true,
+              "pci_bus_id": true,
+              "prometheus": true,
+              "service": true,
+              "tenant": true,
+              "tier": true,
+              "uid": true,
+              "unit": true
+            },
+            "indexByName": {
+              "Hostname": 0,
+              "UUID": 3,
+              "gpu": 2,
+              "modelName": 1
+            },
+            "renameByName": {
+              "Hostname": "Node",
+              "UUID": "UUID",
+              "gpu": "Index",
+              "modelName": "GPU Model"
+            }
+          }
+        }
+      ],
+      "options": {
+        "frameIndex": 0,
+        "showHeader": true,
+        "showTypeIcons": false,
+        "footer": {
+          "show": false,
+          "reducer": []
+        },
+        "cellHeight": "sm"
+      }
+    }
+  ],
+  "templating": {
+    "list": [
+      {
+        "type": "datasource",
+        "name": "ds_prometheus",
+        "label": "Prometheus",
+        "skipUrlSync": false,
+        "query": "prometheus",
+        "current": {
+          "selected": false,
+          "text": "default",
+          "value": "default"
+        },
+        "multi": false,
+        "allowCustomValue": true,
+        "includeAll": false,
+        "regex": "",
+        "auto": false,
+        "auto_min": "10s",
+        "auto_count": 30
+      }
+    ]
+  },
+  "annotations": {}
+}
diff --git a/dashboards/gpu/gpu-tenants.json b/dashboards/gpu/gpu-tenants.json
new file mode 100644
index 00000000..d0265c0d
--- /dev/null
+++ b/dashboards/gpu/gpu-tenants.json
@@ -0,0 +1,1236 @@
+{
+  "uid": "gpu-tenants",
+  "title": "GPU Tenant Usage",
+  "description": "Per-tenant GPU consumption: live allocation, utilization, tensor saturation, power, and 24h GPU-hours / kWh — admin view across all namespaces.",
+  "tags": [
+    "gpu",
+    "tenants",
+    "admin"
+  ],
+  "timezone": "browser",
+  "editable": true,
+  "graphTooltip": 1,
+  "time": {
+    "from": "now-24h",
+    "to": "now"
+  },
+  "fiscalYearStartMonth": 0,
+  "schemaVersion": 42,
+  "panels": [
+    {
+      "type": "row",
+      "collapsed": false,
+      "title": "Tenant fleet snapshot",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 0
+      },
+      "id": 1,
+      "panels": []
+    },
+    {
+      "type": "stat",
+      "id": 2,
+      "targets": [
+        {
+          "expr": "count(namespace:gpu_count:allocated{namespace=~\"$namespace\"})",
+          "refId": "A"
+        }
+      ],
+      "title": "Active tenants",
+      "description": "Namespaces with at least one GPU request (Pending + Running).",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 4,
+        "x": 0,
+        "y": 1
+      },
+      "repeatDirection": "h",
+      "options": {
+        "graphMode": "none",
+        "colorMode": "value",
+        "justifyMode": "auto",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "percentChangeColorMode": "standard",
+        "orientation": ""
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "blue"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 3,
+      "targets": [
+        {
+          "expr": "sum(namespace:gpu_count:allocated{namespace=~\"$namespace\"})",
+          "refId": "A"
+        }
+      ],
+      "title": "Allocated GPUs",
+      "description": "Sum of kube GPU requests across tenants. Billable view — includes Pending pods.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 4,
+        "x": 4,
+        "y": 1
+      },
+      "repeatDirection": "h",
+      "options": {
+        "graphMode": "none",
+        "colorMode": "background",
+        "justifyMode": "auto",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "percentChangeColorMode": "standard",
+        "orientation": ""
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "blue"
+              },
+              {
+                "value": 1,
+                "color": "green"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 4,
+      "targets": [
+        {
+          "expr": "avg(namespace:gpu_util:avg{namespace=~\"$namespace\"})",
+          "refId": "A"
+        }
+      ],
+      "title": "Avg tenant util",
+      "description": "Average NVML utilization across all tenant GPUs.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 4,
+        "x": 8,
+        "y": 1
+      },
+      "repeatDirection": "h",
+      "options": {
+        "graphMode": "area",
+        "colorMode": "value",
+        "justifyMode": "auto",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "percentChangeColorMode": "standard",
+        "orientation": ""
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percent",
+          "min": 0,
+          "max": 100,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "blue"
+              },
+              {
+                "value": 30,
+                "color": "green"
+              },
+              {
+                "value": 80,
+                "color": "orange"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 5,
+      "targets": [
+        {
+          "expr": "sum(namespace:power_watts:sum{namespace=~\"$namespace\"})",
+          "refId": "A"
+        }
+      ],
+      "title": "Total tenant power",
+      "description": "Live power draw summed across tenant workloads.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 4,
+        "x": 12,
+        "y": 1
+      },
+      "repeatDirection": "h",
+      "options": {
+        "graphMode": "area",
+        "colorMode": "value",
+        "justifyMode": "auto",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "percentChangeColorMode": "standard",
+        "orientation": ""
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "watt",
+          "decimals": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "green"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 6,
+      "targets": [
+        {
+          "expr": "sum(sum_over_time(namespace:power_watts:sum{namespace=~\"$namespace\"}[24h:1m])) / 60 / 1000",
+          "refId": "A"
+        }
+      ],
+      "title": "Energy (last 24h)",
+      "description": "Integrated power draw over 24h. Feed into billing/chargeback as kWh.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 4,
+        "x": 16,
+        "y": 1
+      },
+      "repeatDirection": "h",
+      "options": {
+        "graphMode": "none",
+        "colorMode": "value",
+        "justifyMode": "auto",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "percentChangeColorMode": "standard",
+        "orientation": ""
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "kwatth",
+          "decimals": 1,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "green"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "stat",
+      "id": 7,
+      "targets": [
+        {
+          "expr": "sum(sum_over_time(namespace:gpu_count:allocated{namespace=~\"$namespace\"}[24h:1m])) / 60",
+          "refId": "A"
+        }
+      ],
+      "title": "GPU-hours (last 24h)",
+      "description": "Sum of (GPU count × time requested) across all tenants over the last 24h. Integrated from kube requests, so Pending pods count.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 4,
+        "x": 20,
+        "y": 1
+      },
+      "repeatDirection": "h",
+      "options": {
+        "graphMode": "none",
+        "colorMode": "value",
+        "justifyMode": "auto",
+        "textMode": "value",
+        "wideLayout": true,
+        "showPercentChange": false,
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "percentChangeColorMode": "standard",
+        "orientation": ""
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "decimals": 1,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "blue"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "row",
+      "collapsed": false,
+      "title": "Current allocation",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 5
+      },
+      "id": 10,
+      "panels": []
+    },
+    {
+      "type": "bargauge",
+      "id": 11,
+      "targets": [
+        {
+          "expr": "namespace:gpu_count:allocated{namespace=~\"$namespace\"}",
+          "legendFormat": "{{namespace}}",
+          "refId": "A"
+        }
+      ],
+      "title": "GPUs per namespace",
+      "description": "Kube GPU requests per tenant (billable). Includes Pending pods.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 6
+      },
+      "repeatDirection": "h",
+      "options": {
+        "displayMode": "gradient",
+        "valueMode": "color",
+        "namePlacement": "auto",
+        "showUnfilled": true,
+        "sizing": "auto",
+        "minVizWidth": 8,
+        "minVizHeight": 16,
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": false,
+          "calcs": []
+        },
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "maxVizHeight": 300,
+        "orientation": "horizontal"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "green"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "bargauge",
+      "id": 12,
+      "targets": [
+        {
+          "expr": "namespace:fb_used_bytes:sum{namespace=~\"$namespace\"}",
+          "legendFormat": "{{namespace}}",
+          "refId": "A"
+        }
+      ],
+      "title": "VRAM used per namespace",
+      "description": "FB memory actively used by tenant workloads.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 6
+      },
+      "repeatDirection": "h",
+      "options": {
+        "displayMode": "gradient",
+        "valueMode": "color",
+        "namePlacement": "auto",
+        "showUnfilled": true,
+        "sizing": "auto",
+        "minVizWidth": 8,
+        "minVizHeight": 16,
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": false,
+          "calcs": []
+        },
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "maxVizHeight": 300,
+        "orientation": "horizontal"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "bytes",
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "green"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "row",
+      "collapsed": false,
+      "title": "Utilization",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 14
+      },
+      "id": 20,
+      "panels": []
+    },
+    {
+      "type": "timeseries",
+      "id": 21,
+      "targets": [
+        {
+          "expr": "namespace:gpu_util:avg{namespace=~\"$namespace\"}",
+          "legendFormat": "{{namespace}}",
+          "refId": "A"
+        }
+      ],
+      "title": "NVML utilization per namespace",
+      "description": "Per-tenant NVML utilization. Stacked to show fleet-wide pressure over time.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 15
+      },
+      "repeatDirection": "h",
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": ""
+        }
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percent",
+          "min": 0,
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 40,
+            "showPoints": "never",
+            "stacking": {
+              "mode": "normal"
+            }
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "timeseries",
+      "id": 22,
+      "targets": [
+        {
+          "expr": "namespace:tensor_active:avg{namespace=~\"$namespace\"} * 100",
+          "legendFormat": "{{namespace}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Tensor saturation per namespace",
+      "description": "Real tensor core load per tenant. Useful to find AI tenants that claim GPUs but leave tensor cores idle.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 15
+      },
+      "repeatDirection": "h",
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": ""
+        }
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percent",
+          "min": 0,
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 40,
+            "showPoints": "never",
+            "stacking": {
+              "mode": "normal"
+            }
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "row",
+      "collapsed": false,
+      "title": "Power \u0026 allocation trend",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 23
+      },
+      "id": 30,
+      "panels": []
+    },
+    {
+      "type": "timeseries",
+      "id": 31,
+      "targets": [
+        {
+          "expr": "namespace:power_watts:sum{namespace=~\"$namespace\"}",
+          "legendFormat": "{{namespace}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Power draw per namespace",
+      "description": "Per-tenant power draw. Stacked to see cluster-wide energy burn over time.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 24
+      },
+      "repeatDirection": "h",
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": ""
+        }
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "watt",
+          "min": 0,
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "linear",
+            "fillOpacity": 40,
+            "showPoints": "never",
+            "stacking": {
+              "mode": "normal"
+            }
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "timeseries",
+      "id": 32,
+      "targets": [
+        {
+          "expr": "namespace:gpu_count:allocated{namespace=~\"$namespace\"}",
+          "legendFormat": "{{namespace}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Allocated GPUs per namespace",
+      "description": "Kube-requested GPU count per tenant over time. Step-after interpolation reflects discrete allocation changes.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 24
+      },
+      "repeatDirection": "h",
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": false,
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": ""
+        }
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "min": 0,
+          "custom": {
+            "drawStyle": "line",
+            "lineInterpolation": "stepAfter",
+            "fillOpacity": 40,
+            "showPoints": "never",
+            "stacking": {
+              "mode": "normal"
+            }
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "row",
+      "collapsed": false,
+      "title": "Top consumers (live)",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 32
+      },
+      "id": 40,
+      "panels": []
+    },
+    {
+      "type": "table",
+      "id": 41,
+      "targets": [
+        {
+          "expr": "namespace:gpu_count:allocated{namespace=~\"$namespace\"}",
+          "instant": true,
+          "range": false,
+          "format": "table",
+          "refId": "gpus"
+        },
+        {
+          "expr": "namespace:gpu_util:avg{namespace=~\"$namespace\"}",
+          "instant": true,
+          "range": false,
+          "format": "table",
+          "refId": "util"
+        },
+        {
+          "expr": "namespace:tensor_active:avg{namespace=~\"$namespace\"} * 100",
+          "instant": true,
+          "range": false,
+          "format": "table",
+          "refId": "tensor"
+        },
+        {
+          "expr": "namespace:power_watts:sum{namespace=~\"$namespace\"}",
+          "instant": true,
+          "range": false,
+          "format": "table",
+          "refId": "power"
+        },
+        {
+          "expr": "namespace:fb_used_bytes:sum{namespace=~\"$namespace\"}",
+          "instant": true,
+          "range": false,
+          "format": "table",
+          "refId": "vram"
+        }
+      ],
+      "title": "Top consumers",
+      "description": "Live ranking of tenants by power draw. Columns joined from namespace recording rules.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 10,
+        "w": 24,
+        "x": 0,
+        "y": 33
+      },
+      "repeatDirection": "h",
+      "transformations": [
+        {
+          "id": "joinByField",
+          "options": {
+            "byField": "namespace",
+            "mode": "outer"
+          }
+        },
+        {
+          "id": "organize",
+          "options": {
+            "excludeByName": {
+              "Time": true,
+              "Time 1": true,
+              "Time 2": true,
+              "Time 3": true,
+              "Time 4": true,
+              "Time 5": true,
+              "__name__": true,
+              "__name__ 1": true,
+              "__name__ 2": true,
+              "__name__ 3": true,
+              "__name__ 4": true,
+              "__name__ 5": true,
+              "cluster": true,
+              "cluster 1": true,
+              "cluster 2": true,
+              "cluster 3": true,
+              "cluster 4": true,
+              "cluster 5": true,
+              "endpoint": true,
+              "endpoint 1": true,
+              "endpoint 2": true,
+              "endpoint 3": true,
+              "endpoint 4": true,
+              "endpoint 5": true,
+              "instance": true,
+              "instance 1": true,
+              "instance 2": true,
+              "instance 3": true,
+              "instance 4": true,
+              "instance 5": true,
+              "job": true,
+              "job 1": true,
+              "job 2": true,
+              "job 3": true,
+              "job 4": true,
+              "job 5": true,
+              "prometheus": true,
+              "prometheus 1": true,
+              "prometheus 2": true,
+              "prometheus 3": true,
+              "prometheus 4": true,
+              "prometheus 5": true,
+              "service": true,
+              "service 1": true,
+              "service 2": true,
+              "service 3": true,
+              "service 4": true,
+              "service 5": true,
+              "tenant": true,
+              "tenant 1": true,
+              "tenant 2": true,
+              "tenant 3": true,
+              "tenant 4": true,
+              "tenant 5": true,
+              "tier": true,
+              "tier 1": true,
+              "tier 2": true,
+              "tier 3": true,
+              "tier 4": true,
+              "tier 5": true,
+              "uid": true,
+              "uid 1": true,
+              "uid 2": true,
+              "uid 3": true,
+              "uid 4": true,
+              "uid 5": true,
+              "unit": true,
+              "unit 1": true,
+              "unit 2": true,
+              "unit 3": true,
+              "unit 4": true,
+              "unit 5": true
+            },
+            "indexByName": {
+              "Value #gpus": 1,
+              "Value #power": 4,
+              "Value #tensor": 3,
+              "Value #util": 2,
+              "Value #vram": 5,
+              "namespace": 0
+            },
+            "renameByName": {
+              "Value #gpus": "GPUs",
+              "Value #power": "Power",
+              "Value #tensor": "Tensor %",
+              "Value #util": "Util %",
+              "Value #vram": "VRAM",
+              "namespace": "Namespace"
+            }
+          }
+        }
+      ],
+      "options": {
+        "frameIndex": 0,
+        "showHeader": true,
+        "showTypeIcons": false,
+        "sortBy": [
+          {
+            "displayName": "Power",
+            "desc": true
+          }
+        ],
+        "footer": {
+          "show": false,
+          "reducer": []
+        },
+        "cellHeight": "sm"
+      },
+      "fieldConfig": {
+        "defaults": {},
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Util %"
+            },
+            "properties": [
+              {
+                "id": "unit",
+                "value": "percent"
+              },
+              {
+                "id": "min",
+                "value": 0
+              },
+              {
+                "id": "max",
+                "value": 100
+              },
+              {
+                "id": "decimals",
+                "value": 1
+              },
+              {
+                "id": "custom.cellOptions",
+                "value": {
+                  "mode": "gradient",
+                  "type": "gauge"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Tensor %"
+            },
+            "properties": [
+              {
+                "id": "unit",
+                "value": "percent"
+              },
+              {
+                "id": "min",
+                "value": 0
+              },
+              {
+                "id": "max",
+                "value": 100
+              },
+              {
+                "id": "decimals",
+                "value": 1
+              },
+              {
+                "id": "custom.cellOptions",
+                "value": {
+                  "mode": "gradient",
+                  "type": "gauge"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Power"
+            },
+            "properties": [
+              {
+                "id": "unit",
+                "value": "watt"
+              },
+              {
+                "id": "decimals",
+                "value": 0
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "VRAM"
+            },
+            "properties": [
+              {
+                "id": "unit",
+                "value": "bytes"
+              }
+            ]
+          }
+        ]
+      }
+    },
+    {
+      "type": "row",
+      "collapsed": false,
+      "title": "Historical usage (last 24h)",
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 43
+      },
+      "id": 50,
+      "panels": []
+    },
+    {
+      "type": "bargauge",
+      "id": 51,
+      "targets": [
+        {
+          "expr": "sum_over_time(namespace:gpu_count:allocated{namespace=~\"$namespace\"}[24h:1m]) / 60",
+          "legendFormat": "{{namespace}}",
+          "refId": "A"
+        }
+      ],
+      "title": "GPU-hours per namespace (last 24h)",
+      "description": "Billable GPU-hours per tenant over the last 24h window.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 12,
+        "x": 0,
+        "y": 44
+      },
+      "repeatDirection": "h",
+      "options": {
+        "displayMode": "gradient",
+        "valueMode": "color",
+        "namePlacement": "auto",
+        "showUnfilled": true,
+        "sizing": "auto",
+        "minVizWidth": 8,
+        "minVizHeight": 16,
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": false,
+          "calcs": []
+        },
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "maxVizHeight": 300,
+        "orientation": "horizontal"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "decimals": 1,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "blue"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    },
+    {
+      "type": "bargauge",
+      "id": 52,
+      "targets": [
+        {
+          "expr": "sum_over_time(namespace:power_watts:sum{namespace=~\"$namespace\"}[24h:1m]) / 60 / 1000",
+          "legendFormat": "{{namespace}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Energy per namespace (last 24h)",
+      "description": "kWh consumed per tenant over the last 24h. Integrated from 1-minute power samples.",
+      "transparent": false,
+      "datasource": {
+        "type": "prometheus",
+        "uid": "$ds_prometheus"
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 12,
+        "x": 12,
+        "y": 44
+      },
+      "repeatDirection": "h",
+      "options": {
+        "displayMode": "gradient",
+        "valueMode": "color",
+        "namePlacement": "auto",
+        "showUnfilled": true,
+        "sizing": "auto",
+        "minVizWidth": 8,
+        "minVizHeight": 16,
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": false,
+          "calcs": []
+        },
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "maxVizHeight": 300,
+        "orientation": "horizontal"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "kwatth",
+          "decimals": 2,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "value": null,
+                "color": "green"
+              }
+            ]
+          }
+        },
+        "overrides": []
+      }
+    }
+  ],
+  "templating": {
+    "list": [
+      {
+        "type": "datasource",
+        "name": "ds_prometheus",
+        "label": "Prometheus",
+        "skipUrlSync": false,
+        "query": "prometheus",
+        "current": {
+          "selected": false,
+          "text": "default",
+          "value": "default"
+        },
+        "multi": false,
+        "allowCustomValue": true,
+        "includeAll": false,
+        "regex": "",
+        "auto": false,
+        "auto_min": "10s",
+        "auto_count": 30
+      },
+      {
+        "type": "query",
+        "name": "namespace",
+        "label": "Namespace",
+        "skipUrlSync": false,
+        "query": "label_values(namespace:gpu_count:allocated, namespace)",
+        "datasource": {
+          "type": "prometheus",
+          "uid": "$ds_prometheus"
+        },
+        "current": {
+          "selected": true,
+          "text": "All",
+          "value": "$__all"
+        },
+        "multi": true,
+        "allowCustomValue": true,
+        "refresh": 2,
+        "sort": 1,
+        "includeAll": true,
+        "auto": false,
+        "auto_min": "10s",
+        "auto_count": 30
+      }
+    ]
+  },
+  "annotations": {}
+}
diff --git a/packages/system/gpu-operator/examples/README.md b/packages/system/gpu-operator/examples/README.md
index 11c2bb09..5374bffc 100644
--- a/packages/system/gpu-operator/examples/README.md
+++ b/packages/system/gpu-operator/examples/README.md
@@ -21,16 +21,10 @@ Talos.
   ConfigMap.
 - [`dcgm-custom-metrics.yaml`](./dcgm-custom-metrics.yaml) — `ConfigMap`
   with a DCGM metrics CSV that adds profiling, ECC, throttling and
-  energy counters on top of the upstream defaults. The CSV is the
-  superset needed for full dashboard coverage; the **recording rules
-  themselves** only require the profiling subset
-  (`DCGM_FI_PROF_PIPE_TENSOR_ACTIVE`, `DCGM_FI_PROF_GR_ENGINE_ACTIVE`)
-  on top of the upstream `default-counters.csv` — every other DCGM
-  series the rules consume (utilization, FB used/free, power,
-  temperature, energy) is already in the default set. The
-  `gpu/gpu-performance` dashboard additionally needs the throttle
-  counters (`DCGM_FI_DEV_POWER_VIOLATION`,
-  `DCGM_FI_DEV_THERMAL_VIOLATION`), which are not in the default set.
+  energy counters on top of the upstream defaults. The CSV is a
+  superset needed for full coverage of the `gpu/gpu-performance`
+  dashboard. Which parts are actually required depends on which
+  dashboards you ship — see the table below.
 - [`nvidia-driver-compat.yaml`](./nvidia-driver-compat.yaml) — DaemonSet
   that stages `libnvidia-ml.so.1` and `nvidia-smi` from the Talos glibc
   tree into a path where the NVIDIA GPU Operator validator expects
@@ -62,32 +56,46 @@ files into a directory the validator does inspect and creates the
 
 [1]: https://github.com/NVIDIA/gpu-operator/issues/1687
 
+## Dashboards and what DCGM metrics they need
+
+Five GPU dashboards live under `gpu/*` in
+`packages/system/monitoring/dashboards-infra.list`. All of them share
+`packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml` as
+their source of aggregated series. The recording rules are safe to
+ship on any cluster — they evaluate to empty series when DCGM is not
+scraped, or when optional counters are missing.
+
+What each dashboard needs on top of the upstream DCGM Exporter
+[`default-counters.csv`][default-csv]:
+
+| Dashboard         | Scope                              | Needs beyond defaults                                                                        |
+| ----------------- | ---------------------------------- | -------------------------------------------------------------------------------------------- |
+| `gpu-performance` | Per-node, per-GPU deep dive        | `DCGM_FI_PROF_PIPE_TENSOR_ACTIVE`, `DCGM_FI_PROF_GR_ENGINE_ACTIVE`, `DCGM_FI_DEV_POWER_VIOLATION`, `DCGM_FI_DEV_THERMAL_VIOLATION` |
+| `gpu-efficiency`  | Per-workload util vs tensor active | `DCGM_FI_PROF_PIPE_TENSOR_ACTIVE`                                                            |
+| `gpu-fleet`       | Cluster-wide admin inventory       | nothing (works on default counters)                                                          |
+| `gpu-quotas`      | Kube-quota vs live usage           | nothing (kube-state-metrics + default counters)                                              |
+| `gpu-tenants`     | Per-namespace tenant view          | `DCGM_FI_PROF_PIPE_TENSOR_ACTIVE` for the tensor-saturation panel; other panels work on defaults |
+
+The throttling counters (`DCGM_FI_DEV_POWER_VIOLATION`,
+`DCGM_FI_DEV_THERMAL_VIOLATION`) are only required by `gpu-performance`.
+The profiling counters (`DCGM_FI_PROF_*`) are required by
+`gpu-performance` and `gpu-efficiency`, and unlock the tensor panel in
+`gpu-tenants`. Everything else the recording rules consume —
+utilization, FB used/free, power, temperature, energy — is already in
+the default counter set.
+
 ## Verification status
 
 > **Pending verification on an updated GPU Operator release.**
 >
-> The minimum-CSV claim above (only `DCGM_FI_PROF_*` is needed beyond
-> the upstream default counters) is derived by cross-referencing
-> `gpu-recording.rules.yaml` against the DCGM Exporter
-> [`default-counters.csv`][default-csv] for the version pinned in the
-> currently shipped `gpu-operator` package. The package in this branch
-> is **not** the latest GPU Operator release; once we move to a newer
-> version, the claim must be re-checked because the upstream default
-> set occasionally adds or removes counters between releases. Until
-> then, treat the CSV in `dcgm-custom-metrics.yaml` as a known-good
-> superset rather than a minimal config.
+> The minimum-CSV claims above are derived by cross-referencing
+> `gpu-recording.rules.yaml` and each dashboard against the DCGM
+> Exporter [`default-counters.csv`][default-csv] for the version pinned
+> in the currently shipped `gpu-operator` package. The package in this
+> branch is **not** the latest GPU Operator release; once we move to a
+> newer version, the claims must be re-checked because the upstream
+> default set occasionally adds or removes counters between releases.
+> Until then, treat the CSV in `dcgm-custom-metrics.yaml` as a
+> known-good superset rather than a minimal config.
 
 [default-csv]: https://github.com/NVIDIA/dcgm-exporter/blob/main/etc/default-counters.csv
-
-## How the dashboard and recording rules fit in
-
-- `dashboards/gpu/gpu-performance.json` expects `DCGM_FI_*` metrics,
-  including profiling series (`DCGM_FI_PROF_PIPE_TENSOR_ACTIVE`,
-  `DCGM_FI_PROF_GR_ENGINE_ACTIVE`) and throttling counters
-  (`DCGM_FI_DEV_POWER_VIOLATION`, `DCGM_FI_DEV_THERMAL_VIOLATION`).
-  These are only emitted when DCGM Exporter is started with the custom
-  CSV in `dcgm-custom-metrics.yaml`.
-- `packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml`
-  precomputes cluster-wide and per-namespace aggregations used by the
-  overview panels of the dashboard. The rules are safe to ship on any
-  cluster — they evaluate to empty series when DCGM is not scraped.
diff --git a/packages/system/monitoring/dashboards-infra.list b/packages/system/monitoring/dashboards-infra.list
index b402fa68..4c7e494d 100644
--- a/packages/system/monitoring/dashboards-infra.list
+++ b/packages/system/monitoring/dashboards-infra.list
@@ -35,3 +35,5 @@ hubble/network-overview
 gpu/gpu-performance
 gpu/gpu-efficiency
 gpu/gpu-quotas
+gpu/gpu-fleet
+gpu/gpu-tenants

From 7eb9fe8ade53e450962e71548129d776c8fa7e6d Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 06:41:45 +0300
Subject: [PATCH 524/666] refactor(monitoring): drop unused GPU recording rules
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- namespace:gpu_count:sum — never consumed by any tracked dashboard;
  the billable view is already covered by namespace:gpu_count:allocated,
  and the admin view by cluster:gpu_count:allocated.
- namespace:energy_joules:sum — no panel integrates joules; kWh
  readings on the tenant dashboard compute their own integrations
  from namespace:power_watts:sum.
- pod:tensor_to_nvml_ratio:avg5m — interesting tenant signal in
  theory, but not wired into any panel and carrying it just burns
  cardinality on large fleets.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../alerts/gpu-recording.rules.yaml           | 20 -------------------
 1 file changed, 20 deletions(-)

diff --git a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
index 3a31f5a2..28d6a45e 100644
--- a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
+++ b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
@@ -25,11 +25,6 @@ spec:
     - name: gpu.recording.namespace.1m
       interval: 1m
       rules:
-        # DCGM-visible GPU count per namespace — counts GPUs that are actually
-        # running a tenant pod right now (driver loaded, scheduler placed it).
-        # Differs from :allocated when pods are Pending or stuck.
-        - record: namespace:gpu_count:sum
-          expr: count by (namespace) (DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"})
         # Kube-requested GPU count per namespace — billable view, includes
         # Pending pods. Use this for GPU-hour reporting via
         # sum_over_time(...[1h:1m])/60.
@@ -62,8 +57,6 @@ spec:
           expr: sum by (namespace) (DCGM_FI_DEV_FB_USED{namespace!="", namespace!~"cozy-.*|kube-.*"}) * 1048576
         - record: namespace:power_watts:sum
           expr: sum by (namespace) (DCGM_FI_DEV_POWER_USAGE{namespace!="", namespace!~"cozy-.*|kube-.*"})
-        - record: namespace:energy_joules:sum
-          expr: sum by (namespace) (DCGM_FI_DEV_TOTAL_ENERGY_CONSUMPTION{namespace!="", namespace!~"cozy-.*|kube-.*"}) / 1000
 
     - name: gpu.recording.efficiency.1m
       interval: 1m
@@ -76,19 +69,6 @@ spec:
               avg_over_time(DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{namespace!="", namespace!~"cozy-.*|kube-.*"}[5m])
             ) * 100
 
-        # NVML vs tensor gap — ratio <10% means NVML lies: user thinks GPU
-        # is busy but specialized hardware is idle (cheap tenant signal).
-        - record: pod:tensor_to_nvml_ratio:avg5m
-          expr: |
-            (
-              avg_over_time(DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{namespace!="", namespace!~"cozy-.*|kube-.*"}[5m]) * 100
-            )
-            /
-            clamp_min(
-              avg_over_time(DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"}[5m]),
-              1
-            )
-
         # Power efficiency — utilization per watt, reveals unoptimized clients.
         - record: pod:util_per_watt:avg5m
           expr: |

From 2fa4b3e31cd9777bdc88743272b064f076429c87 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 06:48:33 +0300
Subject: [PATCH 525/666] refactor(monitoring): tighten GPU dashboard queries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- gpu-efficiency: scope Tensor Saturation, Util-per-Watt and Power
  Throttle stats to the $namespace selector. Cluster-wide means were
  misleading when a user had narrowed the dashboard to specific
  tenants — the headline numbers lied relative to the panels below.
- gpu-fleet: show per-node power draw as % of combined TDP cap
  (DCGM_FI_DEV_POWER_MGMT_LIMIT) instead of raw watts. Thresholds
  (60 / 80 %) generalize across GPU SKUs without per-model tuning.
- gpu-quotas: read cluster:gpu_count:allocated from the recording
  rules instead of recomputing sum(kube_pod_container_resource_requests)
  inline. Keeps the dashboard aligned with the canonical definition
  in gpu-recording.rules.yaml so the two can't drift.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-efficiency.json                 | 12 ++++++------
 dashboards/gpu/gpu-fleet.json                      | 14 +++++++-------
 dashboards/gpu/gpu-quotas.json                     |  4 ++--
 .../alerts/gpu-recording.rules.yaml                |  1 +
 4 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/dashboards/gpu/gpu-efficiency.json b/dashboards/gpu/gpu-efficiency.json
index 596961e0..07000f71 100644
--- a/dashboards/gpu/gpu-efficiency.json
+++ b/dashboards/gpu/gpu-efficiency.json
@@ -35,12 +35,12 @@
       "id": 2,
       "targets": [
         {
-          "expr": "avg(pod:tensor_saturation:avg5m)",
+          "expr": "avg(pod:tensor_saturation:avg5m{namespace=~\"$namespace\"})",
           "refId": "A"
         }
       ],
-      "title": "Cluster Tensor Saturation",
-      "description": "Mean tensor core saturation. \u003c10% means GPUs are used inefficiently (tenants could move to CPU or optimize their code).",
+      "title": "Avg Tensor Saturation",
+      "description": "Mean tensor core saturation across selected namespaces. \u003c10% means GPUs are used inefficiently (tenants could move to CPU or optimize their code).",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -103,12 +103,12 @@
       "id": 3,
       "targets": [
         {
-          "expr": "avg(pod:util_per_watt:avg5m)",
+          "expr": "avg(pod:util_per_watt:avg5m{namespace=~\"$namespace\"})",
           "refId": "A"
         }
       ],
       "title": "Avg Utilization per Watt",
-      "description": "NVML utilization % per watt. Higher value = more efficient workload.",
+      "description": "NVML utilization % per watt across selected namespaces. Higher value = more efficient workload.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -166,7 +166,7 @@
       "id": 4,
       "targets": [
         {
-          "expr": "avg(gpu:power_throttle_fraction:rate5m)",
+          "expr": "avg(gpu:power_throttle_fraction:rate5m{namespace=~\"$namespace\"})",
           "refId": "A"
         }
       ],
diff --git a/dashboards/gpu/gpu-fleet.json b/dashboards/gpu/gpu-fleet.json
index af5ad2fa..4cd5b4b5 100644
--- a/dashboards/gpu/gpu-fleet.json
+++ b/dashboards/gpu/gpu-fleet.json
@@ -467,13 +467,13 @@
       "id": 12,
       "targets": [
         {
-          "expr": "sum by (Hostname) (DCGM_FI_DEV_POWER_USAGE)",
+          "expr": "sum by (Hostname) (DCGM_FI_DEV_POWER_USAGE) / sum by (Hostname) (DCGM_FI_DEV_POWER_MGMT_LIMIT) * 100",
           "legendFormat": "{{Hostname}}",
           "refId": "A"
         }
       ],
-      "title": "Power draw per node",
-      "description": "Sum of GPU power usage per node in watts.",
+      "title": "Power draw per node (% of TDP)",
+      "description": "GPU power usage as a fraction of the node's combined TDP cap. Works across GPU SKUs without per-model thresholds.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -510,9 +510,9 @@
       },
       "fieldConfig": {
         "defaults": {
-          "unit": "watt",
+          "unit": "percent",
           "min": 0,
-          "max": 200,
+          "max": 100,
           "thresholds": {
             "mode": "absolute",
             "steps": [
@@ -521,11 +521,11 @@
                 "color": "green"
               },
               {
-                "value": 120,
+                "value": 60,
                 "color": "yellow"
               },
               {
-                "value": 160,
+                "value": 80,
                 "color": "orange"
               }
             ]
diff --git a/dashboards/gpu/gpu-quotas.json b/dashboards/gpu/gpu-quotas.json
index 60c628f6..3bc01a83 100644
--- a/dashboards/gpu/gpu-quotas.json
+++ b/dashboards/gpu/gpu-quotas.json
@@ -86,7 +86,7 @@
       "id": 3,
       "targets": [
         {
-          "expr": "sum(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"})",
+          "expr": "cluster:gpu_count:allocated",
           "refId": "A"
         }
       ],
@@ -143,7 +143,7 @@
       "id": 4,
       "targets": [
         {
-          "expr": "sum(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"}) / sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"}) * 100",
+          "expr": "cluster:gpu_count:allocated / sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"}) * 100",
           "refId": "A"
         }
       ],
diff --git a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
index 28d6a45e..a24951f5 100644
--- a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
+++ b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
@@ -2,6 +2,7 @@ apiVersion: operator.victoriametrics.com/v1beta1
 kind: VMRule
 metadata:
   name: alerts-gpu-recording.rules
+  namespace: cozy-monitoring
 spec:
   groups:
     - name: gpu.recording.cluster.1m

From ccfec2ef62684b854508294ab82e379bffcad771 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 06:55:17 +0300
Subject: [PATCH 526/666] fix(monitoring): close DCGM coverage gap for
 gpu-fleet TDP panel

gpu-fleet.json references DCGM_FI_DEV_POWER_MGMT_LIMIT for its
"TDP vs draw" panel, but the custom DCGM Exporter CSV did not declare
it, so the panel silently rendered "No data" on clusters using that
config. Declare the counter, fix the dashboards table in the
gpu-operator examples README, and add a bats test that cross-checks
every DCGM_FI_* reference in tracked dashboards and recording rules
against the union of the upstream default set (snapshotted under
hack/) and the project's custom CSV.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 hack/check-gpu-recording-rules.bats           |  92 +++++++++++++++-
 hack/dcgm-default-counters.csv                | 104 ++++++++++++++++++
 .../system/gpu-operator/examples/README.md    |  50 ++++-----
 .../examples/dcgm-custom-metrics.yaml         |   1 +
 4 files changed, 220 insertions(+), 27 deletions(-)
 create mode 100644 hack/dcgm-default-counters.csv

diff --git a/hack/check-gpu-recording-rules.bats b/hack/check-gpu-recording-rules.bats
index 87e7c8f1..4981959a 100644
--- a/hack/check-gpu-recording-rules.bats
+++ b/hack/check-gpu-recording-rules.bats
@@ -1,7 +1,7 @@
 #!/usr/bin/env bats
 # -----------------------------------------------------------------------------
-# Cross-validation between GPU recording rules and the dashboards that consume
-# them. Catches:
+# Cross-validation between GPU recording rules, the dashboards that consume
+# them, and the DCGM Exporter metric set the cluster actually scrapes. Catches:
 #
 #   1. dangling references — a dashboard query mentions a recording rule name
 #      that doesn't exist in gpu-recording.rules.yaml. This is the bug the
@@ -12,6 +12,13 @@
 #   2. typos in rule names — same bug class, manifested as a single-character
 #      difference between rule and reference.
 #
+#   3. undeclared DCGM metrics — a dashboard query or recording rule mentions
+#      a DCGM_FI_* metric that is neither in the upstream default CSV nor in
+#      the project's custom CSV (dcgm-custom-metrics.yaml), meaning DCGM
+#      Exporter would never emit it and the panel silently shows "No data".
+#      Example regression: gpu-fleet.json shipped a TDP panel referencing
+#      DCGM_FI_DEV_POWER_MGMT_LIMIT before the custom CSV declared it.
+#
 # Scope: only dashboards listed in packages/system/monitoring/dashboards-infra.list
 # under the "gpu/" prefix (i.e. shipped to production), not every JSON file in
 # dashboards/gpu/. Untracked drafts stay out of scope on purpose — adding one
@@ -33,6 +40,8 @@ REPO_ROOT="$(cd "$(dirname "${BATS_TEST_FILENAME:-$0}")/.." && pwd)"
 RULES_FILE="$REPO_ROOT/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml"
 DASHBOARDS_LIST="$REPO_ROOT/packages/system/monitoring/dashboards-infra.list"
 DASHBOARDS_DIR="$REPO_ROOT/dashboards"
+DCGM_DEFAULT_CSV="$REPO_ROOT/hack/dcgm-default-counters.csv"
+DCGM_CUSTOM_CSV="$REPO_ROOT/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml"
 
 # Extract the set of "- record: NAME" entries from the rules YAML.
 # Outputs one rule name per line, sorted and deduplicated.
@@ -61,6 +70,37 @@ list_tracked_gpu_dashboards() {
   awk '/^gpu\// { print $0 ".json" }' "$DASHBOARDS_LIST"
 }
 
+# Extract the set of DCGM_FI_* metric names declared in a CSV file. Handles
+# both the upstream-style default CSV (unindented) and the ConfigMap-style
+# custom CSV (YAML-indented). A declaration line starts — after any leading
+# whitespace — with "DCGM_FI_<NAME>," ; comment lines begin with "#" and are
+# skipped. Uses POSIX awk's match()+RSTART/RLENGTH so no GNU extensions
+# are required.
+extract_csv_metrics() {
+  file=$1
+  awk '
+    {
+      line = $0
+      sub(/^[[:space:]]+/, "", line)
+      if (line ~ /^#/) next
+      if (match(line, /^DCGM_FI_[A-Z0-9_]+/)) {
+        print substr(line, RSTART, RLENGTH)
+      }
+    }
+  ' "$file" | sort -u
+}
+
+# Extract the set of DCGM_FI_* metric references from a text file (dashboard
+# JSON or rules YAML). A DCGM metric name has at least two underscore-delimited
+# segments after the "DCGM_FI_" prefix (e.g. DCGM_FI_DEV_GPU_UTIL, DCGM_FI_PROF_
+# PIPE_TENSOR_ACTIVE, DCGM_FI_DRIVER_VERSION). Requiring two segments keeps
+# the matcher from latching onto glob stubs like "DCGM_FI_DEV_*_VIOLATION" that
+# appear in comments.
+extract_dcgm_refs() {
+  file=$1
+  grep -hoE 'DCGM_FI_[A-Z0-9]+(_[A-Z0-9]+)+' "$file" | sort -u
+}
+
 @test "every recording rule reference in tracked GPU dashboards has a matching record" {
   TMP=$(mktemp -d)
   trap 'rm -rf "$TMP"' EXIT
@@ -94,6 +134,54 @@ list_tracked_gpu_dashboards() {
   [ "$failed" -eq 0 ]
 }
 
+@test "every DCGM metric referenced in tracked dashboards and rules is declared" {
+  TMP=$(mktemp -d)
+  trap 'rm -rf "$TMP"' EXIT
+
+  [ -f "$DCGM_DEFAULT_CSV" ] || { echo "missing $DCGM_DEFAULT_CSV" >&2; exit 1; }
+  [ -f "$DCGM_CUSTOM_CSV" ]  || { echo "missing $DCGM_CUSTOM_CSV"  >&2; exit 1; }
+
+  {
+    extract_csv_metrics "$DCGM_DEFAULT_CSV"
+    extract_csv_metrics "$DCGM_CUSTOM_CSV"
+  } | sort -u > "$TMP/declared.txt"
+  [ -s "$TMP/declared.txt" ] || { echo "no DCGM metrics extracted from CSVs" >&2; exit 1; }
+
+  list_tracked_gpu_dashboards > "$TMP/dashboards.txt"
+  [ -s "$TMP/dashboards.txt" ] || { echo "no gpu/* dashboards listed in $DASHBOARDS_LIST" >&2; exit 1; }
+
+  failed=0
+
+  # Dashboard coverage — every dashboard's DCGM references must resolve.
+  while IFS= read -r dashboard_rel; do
+    dashboard="$DASHBOARDS_DIR/$dashboard_rel"
+    [ -f "$dashboard" ] || continue  # handled by the existence test
+    extract_dcgm_refs "$dashboard" > "$TMP/refs.txt"
+    [ -s "$TMP/refs.txt" ] || continue  # dashboard relies entirely on recording rules
+    comm -23 "$TMP/refs.txt" "$TMP/declared.txt" > "$TMP/missing.txt"
+    if [ -s "$TMP/missing.txt" ]; then
+      echo "ERROR: $dashboard_rel references DCGM metrics not declared in any CSV:" >&2
+      sed 's/^/  - /' "$TMP/missing.txt" >&2
+      failed=1
+    fi
+  done < "$TMP/dashboards.txt"
+
+  # Rules coverage — recording rules consume DCGM directly, so their set
+  # must be declared too, otherwise derived series on every dashboard
+  # collapse to empty.
+  extract_dcgm_refs "$RULES_FILE" > "$TMP/rule-refs.txt"
+  if [ -s "$TMP/rule-refs.txt" ]; then
+    comm -23 "$TMP/rule-refs.txt" "$TMP/declared.txt" > "$TMP/rule-missing.txt"
+    if [ -s "$TMP/rule-missing.txt" ]; then
+      echo "ERROR: gpu-recording.rules.yaml references DCGM metrics not declared in any CSV:" >&2
+      sed 's/^/  - /' "$TMP/rule-missing.txt" >&2
+      failed=1
+    fi
+  fi
+
+  [ "$failed" -eq 0 ]
+}
+
 @test "every tracked GPU dashboard listed in dashboards-infra.list exists on disk" {
   TMP=$(mktemp -d)
   trap 'rm -rf "$TMP"' EXIT
diff --git a/hack/dcgm-default-counters.csv b/hack/dcgm-default-counters.csv
new file mode 100644
index 00000000..b5e94540
--- /dev/null
+++ b/hack/dcgm-default-counters.csv
@@ -0,0 +1,104 @@
+# Snapshot of the upstream DCGM Exporter default-counters.csv used as a
+# fixture by hack/check-gpu-recording-rules.bats. The test verifies that
+# every DCGM_FI_* metric referenced by a tracked GPU dashboard is either
+# declared here (upstream defaults) or in
+# packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml
+# (the project's custom CSV).
+#
+# Source: https://github.com/NVIDIA/dcgm-exporter/blob/4.1.1-4.0.4/etc/default-counters.csv
+# Pinned to the DCGM Exporter image tag shipped by the gpu-operator
+# chart under packages/system/gpu-operator/charts/gpu-operator/values.yaml
+# (dcgmExporter.version = 4.1.1-4.0.4-ubuntu22.04). When that image is
+# bumped, refresh this file from the matching tag in the NVIDIA/dcgm-exporter
+# repo and re-run `./hack/cozytest.sh hack/check-gpu-recording-rules.bats`.
+
+# Format
+# If line starts with a '#' it is considered a comment
+# DCGM FIELD, Prometheus metric type, help message
+
+# Clocks
+DCGM_FI_DEV_SM_CLOCK,  gauge, SM clock frequency (in MHz).
+DCGM_FI_DEV_MEM_CLOCK, gauge, Memory clock frequency (in MHz).
+
+# Temperature
+DCGM_FI_DEV_MEMORY_TEMP, gauge, Memory temperature (in C).
+DCGM_FI_DEV_GPU_TEMP,    gauge, GPU temperature (in C).
+
+# Power
+DCGM_FI_DEV_POWER_USAGE,              gauge, Power draw (in W).
+DCGM_FI_DEV_TOTAL_ENERGY_CONSUMPTION, counter, Total energy consumption since boot (in mJ).
+
+# PCIE
+# DCGM_FI_PROF_PCIE_TX_BYTES,  counter, Total number of bytes transmitted through PCIe TX via NVML.
+# DCGM_FI_PROF_PCIE_RX_BYTES,  counter, Total number of bytes received through PCIe RX via NVML.
+DCGM_FI_DEV_PCIE_REPLAY_COUNTER, counter, Total number of PCIe retries.
+
+# Utilization (the sample period varies depending on the product)
+DCGM_FI_DEV_GPU_UTIL,      gauge, GPU utilization (in %).
+DCGM_FI_DEV_MEM_COPY_UTIL, gauge, Memory utilization (in %).
+DCGM_FI_DEV_ENC_UTIL,      gauge, Encoder utilization (in %).
+DCGM_FI_DEV_DEC_UTIL ,     gauge, Decoder utilization (in %).
+
+# Errors and violations
+DCGM_FI_DEV_XID_ERRORS,              gauge,   Value of the last XID error encountered.
+# DCGM_FI_DEV_POWER_VIOLATION,       counter, Throttling duration due to power constraints (in us).
+# DCGM_FI_DEV_THERMAL_VIOLATION,     counter, Throttling duration due to thermal constraints (in us).
+# DCGM_FI_DEV_SYNC_BOOST_VIOLATION,  counter, Throttling duration due to sync-boost constraints (in us).
+# DCGM_FI_DEV_BOARD_LIMIT_VIOLATION, counter, Throttling duration due to board limit constraints (in us).
+# DCGM_FI_DEV_LOW_UTIL_VIOLATION,    counter, Throttling duration due to low utilization (in us).
+# DCGM_FI_DEV_RELIABILITY_VIOLATION, counter, Throttling duration due to reliability constraints (in us).
+
+# Memory usage
+DCGM_FI_DEV_FB_FREE, gauge, Framebuffer memory free (in MiB).
+DCGM_FI_DEV_FB_USED, gauge, Framebuffer memory used (in MiB).
+
+# ECC
+# DCGM_FI_DEV_ECC_SBE_VOL_TOTAL, counter, Total number of single-bit volatile ECC errors.
+# DCGM_FI_DEV_ECC_DBE_VOL_TOTAL, counter, Total number of double-bit volatile ECC errors.
+# DCGM_FI_DEV_ECC_SBE_AGG_TOTAL, counter, Total number of single-bit persistent ECC errors.
+# DCGM_FI_DEV_ECC_DBE_AGG_TOTAL, counter, Total number of double-bit persistent ECC errors.
+
+# Retired pages
+# DCGM_FI_DEV_RETIRED_SBE,     counter, Total number of retired pages due to single-bit errors.
+# DCGM_FI_DEV_RETIRED_DBE,     counter, Total number of retired pages due to double-bit errors.
+# DCGM_FI_DEV_RETIRED_PENDING, counter, Total number of pages pending retirement.
+
+# NVLink
+# DCGM_FI_DEV_NVLINK_CRC_FLIT_ERROR_COUNT_TOTAL, counter, Total number of NVLink flow-control CRC errors.
+# DCGM_FI_DEV_NVLINK_CRC_DATA_ERROR_COUNT_TOTAL, counter, Total number of NVLink data CRC errors.
+# DCGM_FI_DEV_NVLINK_REPLAY_ERROR_COUNT_TOTAL,   counter, Total number of NVLink retries.
+# DCGM_FI_DEV_NVLINK_RECOVERY_ERROR_COUNT_TOTAL, counter, Total number of NVLink recovery errors.
+DCGM_FI_DEV_NVLINK_BANDWIDTH_TOTAL,            counter, Total number of NVLink bandwidth counters for all lanes.
+# DCGM_FI_DEV_NVLINK_BANDWIDTH_L0,               counter, The number of bytes of active NVLink rx or tx data including both header and payload.
+
+# VGPU License status
+DCGM_FI_DEV_VGPU_LICENSE_STATUS, gauge, vGPU License status
+
+# Remapped rows
+DCGM_FI_DEV_UNCORRECTABLE_REMAPPED_ROWS, counter, Number of remapped rows for uncorrectable errors
+DCGM_FI_DEV_CORRECTABLE_REMAPPED_ROWS,   counter, Number of remapped rows for correctable errors
+DCGM_FI_DEV_ROW_REMAP_FAILURE,           gauge,   Whether remapping of rows has failed
+
+# Static configuration information. These appear as labels on the other metrics
+DCGM_FI_DRIVER_VERSION,        label, Driver Version
+# DCGM_FI_NVML_VERSION,          label, NVML Version
+# DCGM_FI_DEV_BRAND,             label, Device Brand
+# DCGM_FI_DEV_SERIAL,            label, Device Serial Number
+# DCGM_FI_DEV_OEM_INFOROM_VER,   label, OEM inforom version
+# DCGM_FI_DEV_ECC_INFOROM_VER,   label, ECC inforom version
+# DCGM_FI_DEV_POWER_INFOROM_VER, label, Power management object inforom version
+# DCGM_FI_DEV_INFOROM_IMAGE_VER, label, Inforom image version
+# DCGM_FI_DEV_VBIOS_VERSION,     label, VBIOS version of the device
+
+# Datacenter Profiling (DCP) metrics
+# NOTE: supported on Nvidia datacenter Volta GPUs and newer
+DCGM_FI_PROF_GR_ENGINE_ACTIVE,   gauge, Ratio of time the graphics engine is active.
+# DCGM_FI_PROF_SM_ACTIVE,          gauge, The ratio of cycles an SM has at least 1 warp assigned.
+# DCGM_FI_PROF_SM_OCCUPANCY,       gauge, The ratio of number of warps resident on an SM.
+DCGM_FI_PROF_PIPE_TENSOR_ACTIVE, gauge, Ratio of cycles the tensor (HMMA) pipe is active.
+DCGM_FI_PROF_DRAM_ACTIVE,        gauge, Ratio of cycles the device memory interface is active sending or receiving data.
+# DCGM_FI_PROF_PIPE_FP64_ACTIVE,   gauge, Ratio of cycles the fp64 pipes are active.
+# DCGM_FI_PROF_PIPE_FP32_ACTIVE,   gauge, Ratio of cycles the fp32 pipes are active.
+# DCGM_FI_PROF_PIPE_FP16_ACTIVE,   gauge, Ratio of cycles the fp16 pipes are active.
+DCGM_FI_PROF_PCIE_TX_BYTES,      gauge, The rate of data transmitted over the PCIe bus - including both protocol headers and data payloads - in bytes per second.
+DCGM_FI_PROF_PCIE_RX_BYTES,      gauge, The rate of data received over the PCIe bus - including both protocol headers and data payloads - in bytes per second.
diff --git a/packages/system/gpu-operator/examples/README.md b/packages/system/gpu-operator/examples/README.md
index 5374bffc..9599acb7 100644
--- a/packages/system/gpu-operator/examples/README.md
+++ b/packages/system/gpu-operator/examples/README.md
@@ -68,34 +68,34 @@ scraped, or when optional counters are missing.
 What each dashboard needs on top of the upstream DCGM Exporter
 [`default-counters.csv`][default-csv]:
 
-| Dashboard         | Scope                              | Needs beyond defaults                                                                        |
-| ----------------- | ---------------------------------- | -------------------------------------------------------------------------------------------- |
-| `gpu-performance` | Per-node, per-GPU deep dive        | `DCGM_FI_PROF_PIPE_TENSOR_ACTIVE`, `DCGM_FI_PROF_GR_ENGINE_ACTIVE`, `DCGM_FI_DEV_POWER_VIOLATION`, `DCGM_FI_DEV_THERMAL_VIOLATION` |
-| `gpu-efficiency`  | Per-workload util vs tensor active | `DCGM_FI_PROF_PIPE_TENSOR_ACTIVE`                                                            |
-| `gpu-fleet`       | Cluster-wide admin inventory       | nothing (works on default counters)                                                          |
-| `gpu-quotas`      | Kube-quota vs live usage           | nothing (kube-state-metrics + default counters)                                              |
-| `gpu-tenants`     | Per-namespace tenant view          | `DCGM_FI_PROF_PIPE_TENSOR_ACTIVE` for the tensor-saturation panel; other panels work on defaults |
+| Dashboard         | Scope                              | Needs beyond defaults                                                   |
+| ----------------- | ---------------------------------- | ----------------------------------------------------------------------- |
+| `gpu-performance` | Per-node, per-GPU deep dive        | `DCGM_FI_DEV_POWER_VIOLATION`, `DCGM_FI_DEV_THERMAL_VIOLATION`          |
+| `gpu-efficiency`  | Per-workload util vs tensor active | `DCGM_FI_DEV_POWER_VIOLATION`, `DCGM_FI_DEV_THERMAL_VIOLATION` (via `gpu:*_throttle_fraction:rate5m` recording rules) |
+| `gpu-fleet`       | Cluster-wide admin inventory       | `DCGM_FI_DEV_POWER_MGMT_LIMIT` (for the TDP vs draw panel)              |
+| `gpu-quotas`      | Kube-quota vs live usage           | nothing (kube-state-metrics + default counters)                         |
+| `gpu-tenants`     | Per-namespace tenant view          | nothing (works on default counters)                                     |
 
-The throttling counters (`DCGM_FI_DEV_POWER_VIOLATION`,
-`DCGM_FI_DEV_THERMAL_VIOLATION`) are only required by `gpu-performance`.
-The profiling counters (`DCGM_FI_PROF_*`) are required by
-`gpu-performance` and `gpu-efficiency`, and unlock the tensor panel in
-`gpu-tenants`. Everything else the recording rules consume —
-utilization, FB used/free, power, temperature, energy — is already in
-the default counter set.
+`DCGM_FI_PROF_PIPE_TENSOR_ACTIVE` and `DCGM_FI_PROF_GR_ENGINE_ACTIVE`
+are already in the upstream default set for the pinned DCGM Exporter
+version, so the tensor-saturation and engine-active panels work without
+any CSV override. The three counters listed in the table — throttling
+violations and the power management limit — are the only extras the
+tracked dashboards need. The recording rules in
+`gpu-recording.rules.yaml` consume utilization, FB used, power,
+temperature and the tensor-active profiling counter, all of which are
+in the default set.
 
 ## Verification status
 
-> **Pending verification on an updated GPU Operator release.**
->
-> The minimum-CSV claims above are derived by cross-referencing
-> `gpu-recording.rules.yaml` and each dashboard against the DCGM
-> Exporter [`default-counters.csv`][default-csv] for the version pinned
-> in the currently shipped `gpu-operator` package. The package in this
-> branch is **not** the latest GPU Operator release; once we move to a
-> newer version, the claims must be re-checked because the upstream
-> default set occasionally adds or removes counters between releases.
-> Until then, treat the CSV in `dcgm-custom-metrics.yaml` as a
-> known-good superset rather than a minimal config.
+The minimum-CSV claims above are verified by
+`hack/check-gpu-recording-rules.bats`, which cross-checks every
+`DCGM_FI_*` reference in the tracked GPU dashboards and recording rules
+against the union of the upstream default set (snapshotted at
+`hack/dcgm-default-counters.csv` for the pinned DCGM Exporter version)
+and the custom CSV in `dcgm-custom-metrics.yaml`. When the DCGM
+Exporter image in `packages/system/gpu-operator/charts/gpu-operator/values.yaml`
+is bumped, refresh the snapshot from the matching tag of the
+[`NVIDIA/dcgm-exporter`][default-csv] repository and rerun the test.
 
 [default-csv]: https://github.com/NVIDIA/dcgm-exporter/blob/main/etc/default-counters.csv
diff --git a/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml b/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml
index 14b89b5c..92064701 100644
--- a/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml
+++ b/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml
@@ -26,6 +26,7 @@ data:
 
     # Power
     DCGM_FI_DEV_POWER_USAGE,              gauge, Power draw (in W).
+    DCGM_FI_DEV_POWER_MGMT_LIMIT,         gauge, Current power management limit (in W).
     DCGM_FI_DEV_TOTAL_ENERGY_CONSUMPTION, counter, Total energy consumption since boot (in mJ).
 
     # PCIE

From 2518e09d6775ae9916c52dba16b52d88a0e7beaa Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 07:03:42 +0300
Subject: [PATCH 527/666] refactor(monitoring): store pod:tensor_saturation as
 unitless ratio

Align pod:tensor_saturation:avg5m with namespace:tensor_active:avg and
DCGM's native 0..1 range by dropping the * 100 from the recording rule
and multiplying at display time in gpu-efficiency.json. Also scope
pod:util_per_watt:avg5m with avg by (Hostname, gpu, UUID, namespace,
pod) so the series mirrors pod:tensor_saturation's grouping and stays
usable in topk queries.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-efficiency.json               |  4 ++--
 .../alerts/gpu-recording.rules.yaml              | 16 ++++++++++------
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/dashboards/gpu/gpu-efficiency.json b/dashboards/gpu/gpu-efficiency.json
index 07000f71..dddb2001 100644
--- a/dashboards/gpu/gpu-efficiency.json
+++ b/dashboards/gpu/gpu-efficiency.json
@@ -35,7 +35,7 @@
       "id": 2,
       "targets": [
         {
-          "expr": "avg(pod:tensor_saturation:avg5m{namespace=~\"$namespace\"})",
+          "expr": "avg(pod:tensor_saturation:avg5m{namespace=~\"$namespace\"}) * 100",
           "refId": "A"
         }
       ],
@@ -363,7 +363,7 @@
       "id": 21,
       "targets": [
         {
-          "expr": "topk(20, pod:tensor_saturation:avg5m)",
+          "expr": "topk(20, pod:tensor_saturation:avg5m * 100)",
           "instant": true,
           "range": false,
           "format": "table",
diff --git a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
index a24951f5..a6ecb20a 100644
--- a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
+++ b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
@@ -64,20 +64,24 @@ spec:
       rules:
         # Tensor hardware saturation — the honest "am I using the GPU" metric
         # for AI/LLM workloads. Unlike NVML, idle tensor cores are visible.
+        # Stored as a 0..1 ratio to stay consistent with namespace:tensor_active:avg
+        # and DCGM's native units. Consumers multiply by 100 at display time.
         - record: pod:tensor_saturation:avg5m
           expr: |
             avg by (Hostname, gpu, UUID, namespace, pod) (
               avg_over_time(DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{namespace!="", namespace!~"cozy-.*|kube-.*"}[5m])
-            ) * 100
+            )
 
         # Power efficiency — utilization per watt, reveals unoptimized clients.
         - record: pod:util_per_watt:avg5m
           expr: |
-            avg_over_time(DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"}[5m])
-            /
-            clamp_min(
-              avg_over_time(DCGM_FI_DEV_POWER_USAGE{namespace!="", namespace!~"cozy-.*|kube-.*"}[5m]),
-              1
+            avg by (Hostname, gpu, UUID, namespace, pod) (
+              avg_over_time(DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"}[5m])
+              /
+              clamp_min(
+                avg_over_time(DCGM_FI_DEV_POWER_USAGE{namespace!="", namespace!~"cozy-.*|kube-.*"}[5m]),
+                1
+              )
             )
 
         # Fraction of time power-throttled (TDP cap) — 1.0 = fully throttled.

From 5b210ac7fd29e15804fe787f6de8f29455eeeab4 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 07:11:28 +0300
Subject: [PATCH 528/666] docs(monitoring): mark gpu-fleet average utilization
 as legacy NVML

Clarify that the "Average utilization" panel on gpu-fleet reflects the
legacy NVML view (DCGM_FI_DEV_GPU_UTIL) rather than engine-active
profiling. For AI/LLM workloads the NVML number is optimistic; the
gpu-efficiency dashboard carries the profiling-based view.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-fleet.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dashboards/gpu/gpu-fleet.json b/dashboards/gpu/gpu-fleet.json
index 4cd5b4b5..ea169433 100644
--- a/dashboards/gpu/gpu-fleet.json
+++ b/dashboards/gpu/gpu-fleet.json
@@ -268,7 +268,7 @@
         }
       ],
       "title": "Average utilization",
-      "description": "NVML utilization across all tenant GPUs (engine-active %).",
+      "description": "Legacy NVML utilization across all tenant GPUs.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",

From 4e37f64553728bab5b59ae7d7e8a50ee91c23232 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 07:19:05 +0300
Subject: [PATCH 529/666] docs(gpu-operator): document tolerate-all on compat
 DaemonSet

Explain why tolerations: [{operator: Exists}] is safe on the driver
compat DaemonSet: the nodeSelector already confines scheduling to GPU
nodes, so the blanket toleration only kicks in when those nodes carry
the dedicated=gpu / nvidia.com/gpu taints that the GPU Operator's
default policy and many deployments apply.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../system/gpu-operator/examples/nvidia-driver-compat.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml b/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml
index 63e07c4f..bad8609e 100644
--- a/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml
+++ b/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml
@@ -35,6 +35,13 @@ spec:
       # cluster uses to mark GPU hosts.
       nodeSelector:
         nvidia.com/gpu.present: "true"
+      # Tolerate-all is intentionally broad: the nodeSelector above already
+      # confines scheduling to GPU nodes, so the "Exists" toleration only
+      # matters when those nodes carry extra taints (dedicated=gpu:NoSchedule,
+      # nvidia.com/gpu:NoSchedule from the GPU Operator's default policy,
+      # etc.). This mirrors the stance of the upstream nvidia-driver-daemonset
+      # and nvidia-device-plugin DaemonSets — blanket tolerations plus a
+      # narrow nodeSelector.
       tolerations:
         - operator: Exists
       initContainers:

From 5db6ec3e1fc8b2d30d3aa017f0ff7bc4dd943000 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 07:27:33 +0300
Subject: [PATCH 530/666] fix(dashboard): scope GPU panels to selected
 namespace

Pod-level panels on the efficiency dashboard and DCGM-level panels on
the performance dashboard ignored the $namespace template variable, so
changing it left the visualizations unchanged. Add the filter to each
query. Performance-side queries use the `$namespace|` empty-tolerant
form so host-level DCGM series without a namespace label remain
visible when a specific namespace is selected.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-efficiency.json  |  4 ++--
 dashboards/gpu/gpu-performance.json | 12 ++++++------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/dashboards/gpu/gpu-efficiency.json b/dashboards/gpu/gpu-efficiency.json
index dddb2001..e2e8c105 100644
--- a/dashboards/gpu/gpu-efficiency.json
+++ b/dashboards/gpu/gpu-efficiency.json
@@ -363,7 +363,7 @@
       "id": 21,
       "targets": [
         {
-          "expr": "topk(20, pod:tensor_saturation:avg5m * 100)",
+          "expr": "topk(20, pod:tensor_saturation:avg5m{namespace=~\"$namespace\"} * 100)",
           "instant": true,
           "range": false,
           "format": "table",
@@ -501,7 +501,7 @@
       "id": 22,
       "targets": [
         {
-          "expr": "topk(20, pod:util_per_watt:avg5m)",
+          "expr": "topk(20, pod:util_per_watt:avg5m{namespace=~\"$namespace\"})",
           "instant": true,
           "range": false,
           "format": "table",
diff --git a/dashboards/gpu/gpu-performance.json b/dashboards/gpu/gpu-performance.json
index b0f26958..e16f8c47 100644
--- a/dashboards/gpu/gpu-performance.json
+++ b/dashboards/gpu/gpu-performance.json
@@ -553,7 +553,7 @@
       "id": 22,
       "targets": [
         {
-          "expr": "DCGM_FI_DEV_FB_FREE{Hostname=~\"$Hostname\"} * 1048576",
+          "expr": "DCGM_FI_DEV_FB_FREE{Hostname=~\"$Hostname\", namespace=~\"$namespace|\"} * 1048576",
           "legendFormat": "{{Hostname}}/{{gpu}}",
           "refId": "A"
         }
@@ -617,7 +617,7 @@
       "id": 31,
       "targets": [
         {
-          "expr": "DCGM_FI_DEV_POWER_USAGE{Hostname=~\"$Hostname\"}",
+          "expr": "DCGM_FI_DEV_POWER_USAGE{Hostname=~\"$Hostname\", namespace=~\"$namespace|\"}",
           "legendFormat": "{{Hostname}}/{{gpu}}",
           "refId": "A"
         }
@@ -668,7 +668,7 @@
       "id": 32,
       "targets": [
         {
-          "expr": "DCGM_FI_DEV_GPU_TEMP{Hostname=~\"$Hostname\"}",
+          "expr": "DCGM_FI_DEV_GPU_TEMP{Hostname=~\"$Hostname\", namespace=~\"$namespace|\"}",
           "legendFormat": "{{Hostname}}/{{gpu}}",
           "refId": "A"
         }
@@ -751,7 +751,7 @@
       "id": 41,
       "targets": [
         {
-          "expr": "max by (Hostname, gpu) (DCGM_FI_DEV_XID_ERRORS{Hostname=~\"$Hostname\"})",
+          "expr": "max by (Hostname, gpu) (DCGM_FI_DEV_XID_ERRORS{Hostname=~\"$Hostname\", namespace=~\"$namespace|\"})",
           "legendFormat": "{{Hostname}}/{{gpu}}",
           "refId": "A"
         }
@@ -809,7 +809,7 @@
       "id": 42,
       "targets": [
         {
-          "expr": "rate(DCGM_FI_DEV_POWER_VIOLATION{Hostname=~\"$Hostname\"}[5m])",
+          "expr": "rate(DCGM_FI_DEV_POWER_VIOLATION{Hostname=~\"$Hostname\", namespace=~\"$namespace|\"}[5m])",
           "legendFormat": "{{Hostname}}/{{gpu}}",
           "refId": "A"
         }
@@ -857,7 +857,7 @@
       "id": 43,
       "targets": [
         {
-          "expr": "rate(DCGM_FI_DEV_THERMAL_VIOLATION{Hostname=~\"$Hostname\"}[5m])",
+          "expr": "rate(DCGM_FI_DEV_THERMAL_VIOLATION{Hostname=~\"$Hostname\", namespace=~\"$namespace|\"}[5m])",
           "legendFormat": "{{Hostname}}/{{gpu}}",
           "refId": "A"
         }

From b64bfcc414ec4faddecf49ff9ece8ef169896bc0 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 07:36:14 +0300
Subject: [PATCH 531/666] fix(dashboard): deduplicate pending GPU pods by
 (namespace, pod)

The Pending GPU pods counter on gpu-quotas joined raw
kube_pod_container_resource_requests (per-container series) against
kube_pod_status_phase (per-pod series). Multi-container pods were
counted once per requesting container instead of once per pod, so the
widget over-reported whenever a Pending pod had more than one GPU
container. Collapse the requests to pod level before the join.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-quotas.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dashboards/gpu/gpu-quotas.json b/dashboards/gpu/gpu-quotas.json
index 3bc01a83..624f072b 100644
--- a/dashboards/gpu/gpu-quotas.json
+++ b/dashboards/gpu/gpu-quotas.json
@@ -208,7 +208,7 @@
       "id": 5,
       "targets": [
         {
-          "expr": "count((kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"} \u003e 0) * on(namespace, pod) group_left() (kube_pod_status_phase{phase=\"Pending\"} == 1)) or vector(0)",
+          "expr": "count((sum by (namespace, pod) (kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"}) \u003e 0) * on(namespace, pod) group_left() (kube_pod_status_phase{phase=\"Pending\"} == 1)) or vector(0)",
           "refId": "A"
         }
       ],

From 51b0dedd0820c2a23978880baac0b8a6a3cbca94 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 07:45:02 +0300
Subject: [PATCH 532/666] chore(monitoring): tidy GPU VMRule top-level
 structure

Drop the hardcoded metadata.namespace so the rule inherits the chart's
release namespace, and add an explicit empty params field on every
group for schema consistency. No behavior change.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../system/monitoring-agents/alerts/gpu-recording.rules.yaml  | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
index a6ecb20a..22b3edf0 100644
--- a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
+++ b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
@@ -2,11 +2,11 @@ apiVersion: operator.victoriametrics.com/v1beta1
 kind: VMRule
 metadata:
   name: alerts-gpu-recording.rules
-  namespace: cozy-monitoring
 spec:
   groups:
     - name: gpu.recording.cluster.1m
       interval: 1m
+      params: {}
       rules:
         - record: cluster:gpu_count:total
           expr: count(group by (UUID) (DCGM_FI_DEV_GPU_UTIL))
@@ -25,6 +25,7 @@ spec:
 
     - name: gpu.recording.namespace.1m
       interval: 1m
+      params: {}
       rules:
         # Kube-requested GPU count per namespace — billable view, includes
         # Pending pods. Use this for GPU-hour reporting via
@@ -61,6 +62,7 @@ spec:
 
     - name: gpu.recording.efficiency.1m
       interval: 1m
+      params: {}
       rules:
         # Tensor hardware saturation — the honest "am I using the GPU" metric
         # for AI/LLM workloads. Unlike NVML, idle tensor cores are visible.

From 0634654d63d0a9b6ef17074161fce84443e3ba95 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 07:53:48 +0300
Subject: [PATCH 533/666] fix(monitoring): exclude terminated pods from GPU
 allocation count
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

kube-state-metrics keeps kube_pod_container_resource_requests series
for Failed/Succeeded pods until the apiserver garbage-collects them,
which could inflate :allocated beyond what tenants actually hold and
drive cluster:gpu_count:free negative.

Join the request metric against kube_pod_status_phase filtered to
Pending|Running — the canonical pattern from Kubernetes' own
container_resource recording rules — on both the cluster and namespace
aggregates. Add clamp_min(..., 0) on cluster:gpu_count:free as a
second line of defence against transient label drift between
kube-state-metrics and DCGM.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../alerts/gpu-recording.rules.yaml           | 35 +++++++++++++++----
 1 file changed, 28 insertions(+), 7 deletions(-)

diff --git a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
index 22b3edf0..de81b8cc 100644
--- a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
+++ b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
@@ -10,14 +10,29 @@ spec:
       rules:
         - record: cluster:gpu_count:total
           expr: count(group by (UUID) (DCGM_FI_DEV_GPU_UTIL))
-        # Kube-allocated GPU count: GPUs requested by *all* pods regardless of
-        # phase (Pending+Running). Source of truth for "what tenants asked for"
-        # — used for capacity planning and billing. Includes system pods so it
-        # stays consistent with cluster:gpu_count:total when computing :free.
+        # Kube-allocated GPU count: GPUs requested by *active* pods — Pending
+        # and Running only. Source of truth for "what tenants asked for" — used
+        # for capacity planning and billing. Includes system pods so it stays
+        # consistent with cluster:gpu_count:total when computing :free.
+        #
+        # Phase filter via group_left() on kube_pod_status_phase matches the
+        # canonical pattern from k8s.rules.container_resource.yaml. Without it
+        # kube-state-metrics keeps series for Failed/Succeeded pods until the
+        # apiserver garbage-collects them, which inflates billing hours and
+        # can push :free negative.
         - record: cluster:gpu_count:allocated
-          expr: sum(kube_pod_container_resource_requests{resource="nvidia_com_gpu"})
+          expr: |
+            sum(
+              kube_pod_container_resource_requests{resource="nvidia_com_gpu"}
+              * on (namespace, pod) group_left() max by (namespace, pod) (
+                kube_pod_status_phase{phase=~"Pending|Running"} == 1
+              )
+            )
+        # clamp_min guards against transients at DCGM/kube-state-metrics
+        # restart where cluster:gpu_count:total dips before :allocated catches
+        # up, or rare label drift between the two sources.
         - record: cluster:gpu_count:free
-          expr: cluster:gpu_count:total - (cluster:gpu_count:allocated or vector(0))
+          expr: clamp_min(cluster:gpu_count:total - (cluster:gpu_count:allocated or vector(0)), 0)
         - record: cluster:gpu_util:avg
           expr: avg(DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"})
         - record: cluster:gpu_power_watts:sum
@@ -50,7 +65,13 @@ spec:
         # keeps system pods to stay aligned with cluster:gpu_count:total
         # when computing :free.
         - record: namespace:gpu_count:allocated
-          expr: sum by (namespace) (kube_pod_container_resource_requests{resource="nvidia_com_gpu", namespace!="", namespace!~"cozy-.*|kube-.*"})
+          expr: |
+            sum by (namespace) (
+              kube_pod_container_resource_requests{resource="nvidia_com_gpu", namespace!="", namespace!~"cozy-.*|kube-.*"}
+              * on (namespace, pod) group_left() max by (namespace, pod) (
+                kube_pod_status_phase{phase=~"Pending|Running"} == 1
+              )
+            )
         - record: namespace:gpu_util:avg
           expr: avg by (namespace) (DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"})
         - record: namespace:tensor_active:avg

From 605bcd338c744905097dc5c34a9b26f20b999661 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 08:03:21 +0300
Subject: [PATCH 534/666] fix(monitoring): pin label matching on GPU efficiency
 and throttle rules

pod:util_per_watt:avg5m divided two DCGM metrics without an explicit
on(...) clause, so the match used the intersection of their label
sets. If dcgm-exporter relabeling ever diverges between
DCGM_FI_DEV_GPU_UTIL and DCGM_FI_DEV_POWER_USAGE (e.g. a pod-mapping
label appears on one but not the other after a config change), the
entire result drops to empty silently. Pin the match to the labels we
group by so divergence becomes a missing side, not a missing rule.

Throttle fractions had a related shape problem: dcgm-exporter emits
one series per GPU for each pod-mapping combination. On a shared GPU
(restart races, MIG/MPS) the same physical counter appears under
multiple pod labels and downstream avg(...) panels get diluted by the
pod count. Fold duplicates with max by (Hostname, gpu, UUID) before
clamp_max so the fraction is tied to the physical GPU.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../alerts/gpu-recording.rules.yaml              | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
index de81b8cc..c56ea851 100644
--- a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
+++ b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
@@ -96,11 +96,14 @@ spec:
             )
 
         # Power efficiency — utilization per watt, reveals unoptimized clients.
+        # Explicit on(...) pins the bigop matching set to the labels we
+        # group by — protects against empty results if dcgm-exporter
+        # relabeling ever diverges between the two metrics.
         - record: pod:util_per_watt:avg5m
           expr: |
             avg by (Hostname, gpu, UUID, namespace, pod) (
               avg_over_time(DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"}[5m])
-              /
+              / on (Hostname, gpu, UUID, namespace, pod)
               clamp_min(
                 avg_over_time(DCGM_FI_DEV_POWER_USAGE{namespace!="", namespace!~"cozy-.*|kube-.*"}[5m]),
                 1
@@ -112,9 +115,16 @@ spec:
         # counter grows in nanoseconds in practice — divide by 1e9 to get a
         # 0..1 fraction (verified empirically when /1e6 yielded >100× reality).
         # clamp_max protects against rate() artefacts at counter resets.
+        #
+        # max by (Hostname, gpu, UUID) collapses duplicate series from
+        # dcgm-exporter's pod-mapping labels (one physical GPU may appear
+        # under multiple pod/container labels during restarts or under
+        # MIG/MPS). Throttling is a physical-GPU property; taking max
+        # keeps consumer avg(...) honest — a naive avg() would dilute the
+        # signal by the number of pods sharing the GPU.
         - record: gpu:power_throttle_fraction:rate5m
-          expr: clamp_max(rate(DCGM_FI_DEV_POWER_VIOLATION[5m]) / 1e9, 1)
+          expr: clamp_max(max by (Hostname, gpu, UUID) (rate(DCGM_FI_DEV_POWER_VIOLATION[5m]) / 1e9), 1)
 
         # Fraction of time thermal-throttled.
         - record: gpu:thermal_throttle_fraction:rate5m
-          expr: clamp_max(rate(DCGM_FI_DEV_THERMAL_VIOLATION[5m]) / 1e9, 1)
+          expr: clamp_max(max by (Hostname, gpu, UUID) (rate(DCGM_FI_DEV_THERMAL_VIOLATION[5m]) / 1e9), 1)

From 165e175d70566b6890abea3efd01c18784f9b9ff Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sat, 18 Apr 2026 08:11:57 +0300
Subject: [PATCH 535/666] feat(monitoring): alert on DCGM throttle divisor
 drift
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The /1e9 divisor in gpu:{power,thermal}_throttle_fraction:rate5m was
derived empirically against DCGM 3.x on A10 — the counter documents
itself as microseconds but ticks in nanoseconds in practice. If a
future exporter release honors the documented units, pre-clamp values
would exceed 1.0 while clamp_max(..., 1) silently masks the drift,
plateauing every throttle fraction at 100% and making the panels
lie in unison.

Add a validation group that fires when the raw max/1e9 value exceeds
1.0 for 15m, so we notice and rescale to /1e6 before dashboards
silently mislead operators.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../alerts/gpu-recording.rules.yaml           | 30 +++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
index c56ea851..7589f894 100644
--- a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
+++ b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
@@ -128,3 +128,33 @@ spec:
         # Fraction of time thermal-throttled.
         - record: gpu:thermal_throttle_fraction:rate5m
           expr: clamp_max(max by (Hostname, gpu, UUID) (rate(DCGM_FI_DEV_THERMAL_VIOLATION[5m]) / 1e9), 1)
+
+    # Regression watch — the /1e9 divisor on *_VIOLATION was derived
+    # empirically against DCGM 3.x on A10. If a future DCGM version
+    # restores the documented µs units, pre-clamp values would exceed 1.0
+    # while clamp_max(..., 1) silently masks the drift — recorded
+    # throttle fractions would plateau at 1.0 and consumers would think
+    # every GPU is always throttled. This alert fires on that condition
+    # so we can rescale to /1e6 before dashboards start lying.
+    - name: gpu.recording.throttle.validation.5m
+      interval: 5m
+      params: {}
+      rules:
+        - alert: GPUThrottleFractionOverOne
+          expr: |
+            max by (Hostname, gpu, UUID) (rate(DCGM_FI_DEV_POWER_VIOLATION[5m]) / 1e9) > 1
+            or
+            max by (Hostname, gpu, UUID) (rate(DCGM_FI_DEV_THERMAL_VIOLATION[5m]) / 1e9) > 1
+          for: 15m
+          labels:
+            severity: warning
+            component: gpu-monitoring
+          annotations:
+            summary: "DCGM throttle fraction exceeds 1.0 pre-clamp on {{ $labels.Hostname }}/{{ $labels.gpu }}"
+            description: |
+              gpu:{power,thermal}_throttle_fraction:rate5m clamps to 1.0, but the raw
+              rate(DCGM_FI_DEV_*_VIOLATION)/1e9 value is already >1 on this GPU — the
+              empirical nanosecond assumption is broken. Likely the DCGM exporter
+              version changed and the counter now grows in its documented µs units.
+              Re-verify on the exporter Pod and adjust the divisor (/1e9 → /1e6) in
+              gpu.recording.efficiency.1m before dashboards plateau at 100% throttle.

From 549b341675ea09ce2d61de9c931267adb55801ea Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sun, 19 Apr 2026 10:59:42 +0300
Subject: [PATCH 536/666] fix(efficiency): drop namespace filter on
 cluster-level throttle metrics

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-efficiency.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/dashboards/gpu/gpu-efficiency.json b/dashboards/gpu/gpu-efficiency.json
index e2e8c105..3bd59bc0 100644
--- a/dashboards/gpu/gpu-efficiency.json
+++ b/dashboards/gpu/gpu-efficiency.json
@@ -166,12 +166,12 @@
       "id": 4,
       "targets": [
         {
-          "expr": "avg(gpu:power_throttle_fraction:rate5m{namespace=~\"$namespace\"})",
+          "expr": "avg(gpu:power_throttle_fraction:rate5m)",
           "refId": "A"
         }
       ],
       "title": "Avg Power Throttling",
-      "description": "Fraction of time GPUs hit the TDP cap and lose performance. \u003e5% means tenants underutilize billed FLOPS.",
+      "description": "Fraction of time GPUs hit the TDP cap and lose performance. \u003e5% means tenants underutilize billed FLOPS. Cluster-wide — rule aggregates by (Hostname, gpu, UUID) and drops namespace label.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -658,7 +658,7 @@
         }
       ],
       "title": "Power throttle fraction per GPU",
-      "description": "Fraction of time the GPU was power-throttled. 1.0 = always throttled.",
+      "description": "Fraction of time the GPU was power-throttled. 1.0 = always throttled. Cluster-wide — rule aggregates by (Hostname, gpu, UUID) and drops namespace label.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -729,7 +729,7 @@
         }
       ],
       "title": "Thermal throttle fraction per GPU",
-      "description": "Fraction of time the GPU was thermal-throttled.",
+      "description": "Fraction of time the GPU was thermal-throttled. Cluster-wide — rule aggregates by (Hostname, gpu, UUID) and drops namespace label.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",

From 5e070840d66aa9a5da934db330a8ec16d5448e26 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sun, 19 Apr 2026 11:00:02 +0300
Subject: [PATCH 537/666] fix(fleet): count GPU nodes via DCGM instead of
 kube_node_labels

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-fleet.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dashboards/gpu/gpu-fleet.json b/dashboards/gpu/gpu-fleet.json
index ea169433..8139549e 100644
--- a/dashboards/gpu/gpu-fleet.json
+++ b/dashboards/gpu/gpu-fleet.json
@@ -209,12 +209,12 @@
       "id": 5,
       "targets": [
         {
-          "expr": "count(kube_node_labels{label_nvidia_com_gpu_present=\"true\"})",
+          "expr": "count(count by (Hostname) (DCGM_FI_DEV_GPU_UTIL))",
           "refId": "A"
         }
       ],
       "title": "Nodes with GPU",
-      "description": "Kubernetes nodes advertising nvidia.com/gpu.present=true.",
+      "description": "Nodes reporting at least one GPU to DCGM. Counted via DCGM_FI_DEV_GPU_UTIL because kube-state-metrics does not expose node labels by default.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",

From eefb3651a0b8c16ce4b6aa812fefed3b58019e15 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sun, 19 Apr 2026 11:00:53 +0300
Subject: [PATCH 538/666] fix(performance): drop namespace filter on per-GPU
 physical metrics

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-performance.json | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/dashboards/gpu/gpu-performance.json b/dashboards/gpu/gpu-performance.json
index e16f8c47..e581a76b 100644
--- a/dashboards/gpu/gpu-performance.json
+++ b/dashboards/gpu/gpu-performance.json
@@ -553,7 +553,7 @@
       "id": 22,
       "targets": [
         {
-          "expr": "DCGM_FI_DEV_FB_FREE{Hostname=~\"$Hostname\", namespace=~\"$namespace|\"} * 1048576",
+          "expr": "DCGM_FI_DEV_FB_FREE{Hostname=~\"$Hostname\", namespace=~\"$namespace\"} * 1048576",
           "legendFormat": "{{Hostname}}/{{gpu}}",
           "refId": "A"
         }
@@ -617,12 +617,13 @@
       "id": 31,
       "targets": [
         {
-          "expr": "DCGM_FI_DEV_POWER_USAGE{Hostname=~\"$Hostname\", namespace=~\"$namespace|\"}",
+          "expr": "DCGM_FI_DEV_POWER_USAGE{Hostname=~\"$Hostname\"}",
           "legendFormat": "{{Hostname}}/{{gpu}}",
           "refId": "A"
         }
       ],
       "title": "Power Usage per GPU",
+      "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -668,12 +669,13 @@
       "id": 32,
       "targets": [
         {
-          "expr": "DCGM_FI_DEV_GPU_TEMP{Hostname=~\"$Hostname\", namespace=~\"$namespace|\"}",
+          "expr": "DCGM_FI_DEV_GPU_TEMP{Hostname=~\"$Hostname\"}",
           "legendFormat": "{{Hostname}}/{{gpu}}",
           "refId": "A"
         }
       ],
       "title": "GPU Temperature",
+      "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -751,12 +753,13 @@
       "id": 41,
       "targets": [
         {
-          "expr": "max by (Hostname, gpu) (DCGM_FI_DEV_XID_ERRORS{Hostname=~\"$Hostname\", namespace=~\"$namespace|\"})",
+          "expr": "max by (Hostname, gpu) (DCGM_FI_DEV_XID_ERRORS{Hostname=~\"$Hostname\"})",
           "legendFormat": "{{Hostname}}/{{gpu}}",
           "refId": "A"
         }
       ],
       "title": "XID errors (latest)",
+      "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -809,12 +812,13 @@
       "id": 42,
       "targets": [
         {
-          "expr": "rate(DCGM_FI_DEV_POWER_VIOLATION{Hostname=~\"$Hostname\", namespace=~\"$namespace|\"}[5m])",
+          "expr": "rate(DCGM_FI_DEV_POWER_VIOLATION{Hostname=~\"$Hostname\"}[5m])",
           "legendFormat": "{{Hostname}}/{{gpu}}",
           "refId": "A"
         }
       ],
       "title": "Power Violation (µs/s throttled due to power)",
+      "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -857,12 +861,13 @@
       "id": 43,
       "targets": [
         {
-          "expr": "rate(DCGM_FI_DEV_THERMAL_VIOLATION{Hostname=~\"$Hostname\", namespace=~\"$namespace|\"}[5m])",
+          "expr": "rate(DCGM_FI_DEV_THERMAL_VIOLATION{Hostname=~\"$Hostname\"}[5m])",
           "legendFormat": "{{Hostname}}/{{gpu}}",
           "refId": "A"
         }
       ],
       "title": "Thermal Violation (µs/s throttled due to thermals)",
+      "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",

From 14d9188fcda1a9780912f43d3b3ad3fd11f4c6f4 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sun, 19 Apr 2026 11:01:22 +0300
Subject: [PATCH 539/666] fix(quotas): exclude terminated pods from GPU request
 panel

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-quotas.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dashboards/gpu/gpu-quotas.json b/dashboards/gpu/gpu-quotas.json
index 624f072b..29e727ce 100644
--- a/dashboards/gpu/gpu-quotas.json
+++ b/dashboards/gpu/gpu-quotas.json
@@ -423,7 +423,7 @@
       "id": 21,
       "targets": [
         {
-          "expr": "kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"} * on(namespace, pod) group_left(phase) (kube_pod_status_phase{phase=~\"Running|Pending|Failed|Succeeded\"} == 1)",
+          "expr": "kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"} * on(namespace, pod) group_left(phase) (kube_pod_status_phase{phase=~\"Running|Pending\"} == 1)",
           "instant": true,
           "range": false,
           "format": "table",

From 950c5dd6695872850e0ec87f2c3dbb28f8dbef52 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sun, 19 Apr 2026 11:01:40 +0300
Subject: [PATCH 540/666] fix(fleet): guard TDP division and document DCGM
 dependency

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-fleet.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dashboards/gpu/gpu-fleet.json b/dashboards/gpu/gpu-fleet.json
index 8139549e..a7d3f085 100644
--- a/dashboards/gpu/gpu-fleet.json
+++ b/dashboards/gpu/gpu-fleet.json
@@ -467,13 +467,13 @@
       "id": 12,
       "targets": [
         {
-          "expr": "sum by (Hostname) (DCGM_FI_DEV_POWER_USAGE) / sum by (Hostname) (DCGM_FI_DEV_POWER_MGMT_LIMIT) * 100",
+          "expr": "sum by (Hostname) (DCGM_FI_DEV_POWER_USAGE) / clamp_min(sum by (Hostname) (DCGM_FI_DEV_POWER_MGMT_LIMIT), 1) * 100",
           "legendFormat": "{{Hostname}}",
           "refId": "A"
         }
       ],
       "title": "Power draw per node (% of TDP)",
-      "description": "GPU power usage as a fraction of the node's combined TDP cap. Works across GPU SKUs without per-model thresholds.",
+      "description": "GPU power usage as a fraction of the node's combined TDP cap. Works across GPU SKUs without per-model thresholds. Requires DCGM_FI_DEV_POWER_MGMT_LIMIT from custom DCGM CSV (see packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml).",
       "transparent": false,
       "datasource": {
         "type": "prometheus",

From 43fe172d2f08c9bdf669473913cb485b4e6a6b86 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sun, 19 Apr 2026 11:02:05 +0300
Subject: [PATCH 541/666] docs(gpu-operator): document POWER/THERMAL_VIOLATION
 and PSS requirements

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../system/gpu-operator/examples/README.md    | 24 +++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/packages/system/gpu-operator/examples/README.md b/packages/system/gpu-operator/examples/README.md
index 9599acb7..7922d85a 100644
--- a/packages/system/gpu-operator/examples/README.md
+++ b/packages/system/gpu-operator/examples/README.md
@@ -56,6 +56,14 @@ files into a directory the validator does inspect and creates the
 
 [1]: https://github.com/NVIDIA/gpu-operator/issues/1687
 
+The compat DaemonSet runs privileged and bind-mounts host paths, so
+the target namespace must allow privileged pods. On clusters that
+enforce the Kubernetes Pod Security Standards at `baseline` or
+`restricted`, label the namespace with
+`pod-security.kubernetes.io/enforce: privileged` (and the matching
+`audit`/`warn` labels if the admission webhook is configured to
+surface violations) before applying the manifest.
+
 ## Dashboards and what DCGM metrics they need
 
 Five GPU dashboards live under `gpu/*` in
@@ -83,8 +91,20 @@ any CSV override. The three counters listed in the table — throttling
 violations and the power management limit — are the only extras the
 tracked dashboards need. The recording rules in
 `gpu-recording.rules.yaml` consume utilization, FB used, power,
-temperature and the tensor-active profiling counter, all of which are
-in the default set.
+temperature and the tensor-active profiling counter from the default
+set, plus `DCGM_FI_DEV_POWER_VIOLATION` and
+`DCGM_FI_DEV_THERMAL_VIOLATION` — used by the
+`gpu.recording.efficiency.1m` group to derive the
+`gpu:power_throttle_fraction:rate5m` and
+`gpu:thermal_throttle_fraction:rate5m` series consumed by the
+throttling panels on the efficiency and fleet dashboards.
+
+The `gpu.recording.throttle.validation.5m` group additionally ships the
+`GPUThrottleFractionOverOne` alert (severity `warning`) as a regression
+detector: it fires when either throttle-fraction series exceeds 1.0,
+which would indicate that DCGM changed the scale/divisor of the
+underlying violation counters and the recording rules need to be
+re-derived.
 
 ## Verification status
 

From f8b99008737b7f1067d89220a517edbed77ef777 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sun, 19 Apr 2026 11:08:25 +0300
Subject: [PATCH 542/666] fix(quotas): use allocated recording rules to exclude
 terminated pods

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-quotas.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dashboards/gpu/gpu-quotas.json b/dashboards/gpu/gpu-quotas.json
index 29e727ce..f8ce4ba8 100644
--- a/dashboards/gpu/gpu-quotas.json
+++ b/dashboards/gpu/gpu-quotas.json
@@ -278,7 +278,7 @@
       "id": 11,
       "targets": [
         {
-          "expr": "sum by (namespace) (kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"})",
+          "expr": "sum by (namespace) (namespace:gpu_count:allocated{namespace=~\"$namespace\"})",
           "legendFormat": "{{namespace}}",
           "refId": "A"
         }
@@ -346,7 +346,7 @@
           "refId": "A"
         },
         {
-          "expr": "sum(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"})",
+          "expr": "sum(namespace:gpu_count:allocated{namespace=~\"$namespace\"})",
           "legendFormat": "Requested",
           "refId": "B"
         }

From a3241bf51bf255e24b77ebc23de89e33064370eb Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sun, 19 Apr 2026 11:08:34 +0300
Subject: [PATCH 543/666] fix(quotas): apply phase join to GPU limits column

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-quotas.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dashboards/gpu/gpu-quotas.json b/dashboards/gpu/gpu-quotas.json
index f8ce4ba8..ce1e387e 100644
--- a/dashboards/gpu/gpu-quotas.json
+++ b/dashboards/gpu/gpu-quotas.json
@@ -430,7 +430,7 @@
           "refId": "requested"
         },
         {
-          "expr": "kube_pod_container_resource_limits{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"}",
+          "expr": "kube_pod_container_resource_limits{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"} * on(namespace, pod) group_left() (kube_pod_status_phase{phase=~\"Running|Pending\"} == 1)",
           "instant": true,
           "range": false,
           "format": "table",

From 2cc60f170c3c370a6939e2dfffc20185fb29d0c1 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sun, 19 Apr 2026 11:08:47 +0300
Subject: [PATCH 544/666] docs(gpu-operator): reflect recording-rule dependency
 for gpu-quotas

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/system/gpu-operator/examples/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/system/gpu-operator/examples/README.md b/packages/system/gpu-operator/examples/README.md
index 7922d85a..f9094549 100644
--- a/packages/system/gpu-operator/examples/README.md
+++ b/packages/system/gpu-operator/examples/README.md
@@ -81,7 +81,7 @@ What each dashboard needs on top of the upstream DCGM Exporter
 | `gpu-performance` | Per-node, per-GPU deep dive        | `DCGM_FI_DEV_POWER_VIOLATION`, `DCGM_FI_DEV_THERMAL_VIOLATION`          |
 | `gpu-efficiency`  | Per-workload util vs tensor active | `DCGM_FI_DEV_POWER_VIOLATION`, `DCGM_FI_DEV_THERMAL_VIOLATION` (via `gpu:*_throttle_fraction:rate5m` recording rules) |
 | `gpu-fleet`       | Cluster-wide admin inventory       | `DCGM_FI_DEV_POWER_MGMT_LIMIT` (for the TDP vs draw panel)              |
-| `gpu-quotas`      | Kube-quota vs live usage           | nothing (kube-state-metrics + default counters)                         |
+| `gpu-quotas`      | Kube-quota vs live usage           | `kube_pod_container_resource_requests`, `kube_pod_status_phase`, `DCGM_FI_DEV_GPU_UTIL` (via `namespace:gpu_count:allocated` / `cluster:gpu_count:*` recording rules) |
 | `gpu-tenants`     | Per-namespace tenant view          | nothing (works on default counters)                                     |
 
 `DCGM_FI_PROF_PIPE_TENSOR_ACTIVE` and `DCGM_FI_PROF_GR_ENGINE_ACTIVE`

From 95ea20119e7fddc601addc9f79777d0e24aadd30 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sun, 19 Apr 2026 11:09:01 +0300
Subject: [PATCH 545/666] fix(gpu-operator): drop unused hostPID on
 driver-compat DaemonSet

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../system/gpu-operator/examples/nvidia-driver-compat.yaml   | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml b/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml
index bad8609e..7706b221 100644
--- a/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml
+++ b/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml
@@ -24,8 +24,11 @@ spec:
     metadata:
       labels:
         app: nvidia-driver-compat
+    # DaemonSet rather than a one-shot Job: staging is idempotent per-node,
+    # must re-run after every Talos reboot (hostPath contents are wiped on
+    # reboot when the system extension re-installs), and the pause container
+    # keeps the pod visible for operator observability (kubectl get pods).
     spec:
-      hostPID: true
       priorityClassName: system-node-critical
       # Restrict to GPU nodes only. Without this the DaemonSet schedules onto
       # every node (including control-plane and CPU-only workers) and burns

From 5e8194c850a889d03ba60e900c7e91d3f25b8e53 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sun, 19 Apr 2026 11:09:50 +0300
Subject: [PATCH 546/666] docs(monitoring): explain cluster-layer filter
 asymmetry in GPU rules

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../alerts/gpu-recording.rules.yaml            | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
index 7589f894..681ac3e8 100644
--- a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
+++ b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
@@ -33,6 +33,24 @@ spec:
         # up, or rare label drift between the two sources.
         - record: cluster:gpu_count:free
           expr: clamp_min(cluster:gpu_count:total - (cluster:gpu_count:allocated or vector(0)), 0)
+        # Cluster-layer filter asymmetry — intentional, not a bug:
+        #
+        #   * cluster:gpu_count:total and cluster:gpu_power_watts:sum do NOT
+        #     filter cozy-*/kube-* namespaces because they describe the
+        #     physical hardware fleet. A GPU draws power and occupies a
+        #     slot regardless of which namespace's pod happens to hold it;
+        #     excluding infra pods would under-report raw capacity and
+        #     break capacity-planning math.
+        #
+        #   * cluster:gpu_util:avg DOES filter infra namespaces because it
+        #     is a tenant-oriented KPI. Admins want to see the mean
+        #     utilization of tenant workloads, not have it diluted by
+        #     GPU Operator DaemonSet pods whose containers hold a GPU
+        #     handle but do no useful compute.
+        #
+        # Do not "normalize" by adding the filter to the hardware rules —
+        # downstream consumers (capacity planning, billing) rely on the
+        # raw totals.
         - record: cluster:gpu_util:avg
           expr: avg(DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"})
         - record: cluster:gpu_power_watts:sum

From f5f083e84102d8c7e743766774cd54b226fc6ef1 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sun, 19 Apr 2026 11:09:51 +0300
Subject: [PATCH 547/666] feat(monitoring): annotate GPUThrottleFractionOverOne
 with verified hardware

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../alerts/gpu-recording.rules.yaml                  | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
index 681ac3e8..093a2939 100644
--- a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
+++ b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
@@ -99,6 +99,16 @@ spec:
         - record: namespace:power_watts:sum
           expr: sum by (namespace) (DCGM_FI_DEV_POWER_USAGE{namespace!="", namespace!~"cozy-.*|kube-.*"})
 
+    # Known gap: there is no lower-bound sanity alert for under-reporting.
+    # If DCGM ever switches POWER/THERMAL_VIOLATION counter units the other
+    # direction — e.g. from the current nanoseconds back to microseconds,
+    # making rate()/1e9 produce values around 0.001 instead of real
+    # fractions — the throttle signal would silently collapse to near-zero
+    # instead of plateauing at 1.0. GPUThrottleFractionOverOne below catches
+    # the >1 drift; the <<1 drift would require correlation with independent
+    # signals (power draw vs TDP, clock dips) that we do not yet wire up.
+    # Documented here so future maintainers know this is a known gap, not
+    # an oversight.
     - name: gpu.recording.efficiency.1m
       interval: 1m
       params: {}
@@ -176,3 +186,5 @@ spec:
               version changed and the counter now grows in its documented µs units.
               Re-verify on the exporter Pod and adjust the divisor (/1e9 → /1e6) in
               gpu.recording.efficiency.1m before dashboards plateau at 100% throttle.
+            verified_on: "NVIDIA A10, DCGM 3.x — other GPU families (H100, L40S) may require a different divisor"
+            runbook: "If this alert fires, DCGM may have changed POWER_VIOLATION/THERMAL_VIOLATION counter units. Recalibrate by comparing raw counter rate against known throttle events; see gpu-recording.rules.yaml comments."

From 16b2fd008ba7bc4db6dae122202884791a22887c Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sun, 19 Apr 2026 11:10:43 +0300
Subject: [PATCH 548/666] docs(monitoring): comment bats regex rule-name
 convention

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 hack/check-gpu-recording-rules.bats | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hack/check-gpu-recording-rules.bats b/hack/check-gpu-recording-rules.bats
index 4981959a..bae6785e 100644
--- a/hack/check-gpu-recording-rules.bats
+++ b/hack/check-gpu-recording-rules.bats
@@ -62,6 +62,10 @@ extract_rules() {
 # whole expression must contain at least two ':' characters.
 extract_refs() {
   json_file=$1
+  # Prometheus convention allows 2-segment rule names (level:metric); this
+  # regex is tuned to the 3+ segment convention used in this repo
+  # (level:metric:op — e.g. cluster:gpu_count:total). Update if future
+  # rules use 2 segments, otherwise they will be silently skipped.
   grep -hoE '[a-z][a-z0-9_]*:[a-z0-9_]+:[a-z0-9_]+' "$json_file" | sort -u
 }
 

From b5232bd15c55fb4a1faf25fa3f51e201a3002a60 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sun, 19 Apr 2026 11:10:46 +0300
Subject: [PATCH 549/666] feat(gpu-operator): enable NVLINK bandwidth in
 default DCGM CSV

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../system/gpu-operator/examples/dcgm-custom-metrics.yaml   | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml b/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml
index 92064701..8e57788b 100644
--- a/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml
+++ b/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml
@@ -70,8 +70,10 @@ data:
     DCGM_FI_DEV_LOW_UTIL_VIOLATION,    counter, Throttling duration due to low utilization (in us).
     DCGM_FI_DEV_RELIABILITY_VIOLATION, counter, Throttling duration due to reliability constraints (in us).
 
-    # NVLink — enable only for GPUs that actually have NVLink (A10 has none).
-    # DCGM_FI_DEV_NVLINK_BANDWIDTH_TOTAL, counter, Total number of NVLink bandwidth counters for all lanes.
+    # NVLink — DCGM silently drops this metric on GPUs without NVLink, so
+    # enabling it unconditionally is safe and keeps this file reusable
+    # across GPU families.
+    DCGM_FI_DEV_NVLINK_BANDWIDTH_TOTAL, counter, Total number of NVLink bandwidth counters for all lanes.
 
     # DCP (profiling) metrics — supported from Ampere onwards.
     DCGM_FI_PROF_GR_ENGINE_ACTIVE,   gauge, Ratio of time the graphics engine is active.

From 4d9a61a0ec49538c70d7b0e3c7d3cd37949781fa Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Sun, 19 Apr 2026 11:10:47 +0300
Subject: [PATCH 550/666] docs(gpu-operator): document native-talos
 service-monitor interval

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/system/gpu-operator/examples/values-native-talos.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/packages/system/gpu-operator/examples/values-native-talos.yaml b/packages/system/gpu-operator/examples/values-native-talos.yaml
index 86e436c4..5a3d7786 100644
--- a/packages/system/gpu-operator/examples/values-native-talos.yaml
+++ b/packages/system/gpu-operator/examples/values-native-talos.yaml
@@ -39,6 +39,9 @@ spec:
           dcgmExporter:
             serviceMonitor:
               enabled: true
+              # Matches the 1m evaluation cadence of GPU recording rules with
+              # 4x oversampling headroom. DCGM_FI_PROF_* counters have
+              # documented overhead concerns below 1s; 15s is safe.
               interval: "15s"
               honorLabels: true
             config:

From e148343fd9bf9440d726bf01ebb07374119927d0 Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Sun, 19 Apr 2026 19:01:53 +0300
Subject: [PATCH 551/666] fix(kamaji): increase memory limits and add startup
 probe
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Increase memory limit from 500Mi to 512Mi
- Increase memory request from 100Mi to 256Mi
- Add startup probe with 60s timeout (12 attempts × 5s)
- Increase readiness/liveness initialDelaySeconds from 5/15 to 30s

This fixes OOMKilled crashes observed in production where kamaji
controller was being killed due to insufficient memory during startup.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 packages/system/kamaji/values.yaml | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/packages/system/kamaji/values.yaml b/packages/system/kamaji/values.yaml
index b1ca3cb7..e6dbe99b 100644
--- a/packages/system/kamaji/values.yaml
+++ b/packages/system/kamaji/values.yaml
@@ -8,9 +8,32 @@ kamaji:
   resources:
     limits:
       cpu: 200m
-      memory: 500Mi
+      memory: 512Mi
     requests:
       cpu: 100m
-      memory: 100Mi
+      memory: 256Mi
+  startupProbe:
+    httpGet:
+      path: /healthz
+      port: healthcheck
+    initialDelaySeconds: 5
+    periodSeconds: 5
+    timeoutSeconds: 3
+    successThreshold: 1
+    failureThreshold: 12
+  livenessProbe:
+    httpGet:
+      path: /healthz
+      port: healthcheck
+    initialDelaySeconds: 30
+    periodSeconds: 20
+    timeoutSeconds: 1
+  readinessProbe:
+    httpGet:
+      path: /readyz
+      port: healthcheck
+    initialDelaySeconds: 30
+    periodSeconds: 10
+    timeoutSeconds: 1
   extraArgs:
     - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.3.0-rc.1@sha256:8c9af083b60600c0800eb56a2cda75f26007b7272a1cf019140de003bfce1a4d

From d94f937011cca3981e2c8364da533a6c6d249663 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Mon, 20 Apr 2026 13:01:23 +0300
Subject: [PATCH 552/666] fix(linstor): increase satellite startup probe
 failure threshold
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The default Kubernetes startup probe allows only 30 seconds (3 retries
× 10s) for LINSTOR satellites to become ready. This is insufficient on
nodes with slow storage initialization, causing unnecessary pod restarts.

Raise failureThreshold to 30, giving satellites up to 300 seconds (5
minutes) to complete startup.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/system/linstor/templates/satellites-cozy.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/packages/system/linstor/templates/satellites-cozy.yaml b/packages/system/linstor/templates/satellites-cozy.yaml
index c621126d..1e8f8f72 100644
--- a/packages/system/linstor/templates/satellites-cozy.yaml
+++ b/packages/system/linstor/templates/satellites-cozy.yaml
@@ -14,6 +14,10 @@ spec:
       containers:
       - name: linstor-satellite
         image: {{ .Values.piraeusServer.image.repository }}:{{ .Values.piraeusServer.image.tag }}
+        startupProbe:
+          tcpSocket:
+            port: linstor
+          failureThreshold: 30
         securityContext:
           # real-world installations need some debugging from time to time
           readOnlyRootFilesystem: false

From 8ee6ac96d400e8345141391d45e7fc4a5c28c87b Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Mon, 20 Apr 2026 13:08:44 +0300
Subject: [PATCH 553/666] fix(linstor): explicitly set periodSeconds in
 satellite startup probe

Make the 5-minute timeout self-documenting by setting periodSeconds: 10
explicitly rather than relying on the Kubernetes default.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/system/linstor/templates/satellites-cozy.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/system/linstor/templates/satellites-cozy.yaml b/packages/system/linstor/templates/satellites-cozy.yaml
index 1e8f8f72..e6f877a0 100644
--- a/packages/system/linstor/templates/satellites-cozy.yaml
+++ b/packages/system/linstor/templates/satellites-cozy.yaml
@@ -17,6 +17,7 @@ spec:
         startupProbe:
           tcpSocket:
             port: linstor
+          periodSeconds: 10
           failureThreshold: 30
         securityContext:
           # real-world installations need some debugging from time to time

From 83ae237000149462829a4841bea2dd52929b5cda Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 20 Apr 2026 15:48:53 +0300
Subject: [PATCH 554/666] feat(monitoring): upgrade victoria-metrics-operator
 to v0.68.4

Bumps the vendored victoria-metrics-operator chart from 0.59.1 to 0.61.0
(operator appVersion v0.68.1 to v0.68.4) via `make update`.

Picks up upstream bugfixes in the v0.68.x line: correct VMPodScrape port
for VMAgent/VLAgent, StatefulSet pod deletion when maxUnavailable=100%,
VMDistributed PVC ownership fix, finalizer cleanup, ingest-only mode not
mounting scrape config secrets, STS recreation on immutable field changes,
and PVC resize completion wait.

Chart 0.60.0 is skipped because it introduced a matchLabels change
requiring Deployment recreation that was reverted in 0.61.0.

Local patch disable-ca-key-rotation.patch reapplies cleanly.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../victoria-metrics-operator/Chart.lock      |   8 ++---
 .../victoria-metrics-operator/Chart.yaml      |  13 ++++----
 .../victoria-metrics-operator/README.md       |   3 +-
 .../victoria-metrics-operator/RELEASE_NOTES   |   8 ++---
 .../charts/crds/crds/crd.yaml                 |  29 ++++++++++++++++++
 .../charts/crds/files/crd.yaml.bz2            | Bin 27612 -> 27506 bytes
 .../charts/victoria-metrics-common/Chart.yaml |   7 +++--
 .../charts/victoria-metrics-common/README.md  |   3 +-
 .../victoria-metrics-common/RELEASE_NOTES     |   6 ++--
 .../templates/_helpers.tpl                    |  24 ++++++++++-----
 .../templates/_image.tpl                      |   4 +--
 .../templates/_pod.tpl                        |   8 ++---
 .../templates/_service.tpl                    |  12 ++++----
 .../templates/NOTES.txt                       |   2 +-
 .../templates/pdb.yaml                        |   3 ++
 .../templates/server.yaml                     |   5 ++-
 .../templates/webhook.yaml                    |  19 +++++++++---
 .../victoria-metrics-operator/values.yaml     |  19 ++++++++++--
 18 files changed, 121 insertions(+), 52 deletions(-)

diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.lock b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.lock
index 1b0e2a46..2868e66f 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.lock
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.lock
@@ -1,9 +1,9 @@
 dependencies:
 - name: victoria-metrics-common
-  repository: https://victoriametrics.github.io/helm-charts
-  version: 0.0.46
+  repository: oci://ghcr.io/victoriametrics/helm-charts
+  version: 0.3.0
 - name: crds
   repository: ""
   version: 0.0.*
-digest: sha256:43d3d210a9d1a2234e6c56518f8c477125a5ad5e8ed08d46209528f19acd9c89
-generated: "2025-12-23T12:58:01.428960334Z"
+digest: sha256:adec954bf2814f744f5b69fcf67c8b246bf21f416adb0ab37d91c9b42f72d353
+generated: "2026-04-16T10:14:10.795552631Z"
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.yaml
index bb9253b1..030af8f0 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.yaml
@@ -1,7 +1,7 @@
 annotations:
   artifacthub.io/category: monitoring-logging
   artifacthub.io/changes: |
-    - updates operator to [v0.68.1](https://github.com/VictoriaMetrics/operator/releases/tag/v0.68.1) version
+    - revert change in Deployment's matchLabels, that was introduced in release 0.60.0
   artifacthub.io/license: Apache-2.0
   artifacthub.io/links: |
     - name: Sources
@@ -16,13 +16,14 @@ annotations:
   artifacthub.io/readme: |
     # VictoriaMetrics Operator Helm chart
 
-    Chart documentation is available [here](https://docs.victoriametrics.com/helm/victoria-metrics-operator/)
+    Chart documentation is available [here](https://docs.victoriametrics.com/helm/victoria-metrics-operator/).
+    Changelog is [here](https://docs.victoriametrics.com/helm/victoria-metrics-operator/changelog/).
 apiVersion: v2
-appVersion: v0.68.1
+appVersion: v0.68.4
 dependencies:
 - name: victoria-metrics-common
-  repository: https://victoriametrics.github.io/helm-charts
-  version: 0.0.*
+  repository: oci://ghcr.io/victoriametrics/helm-charts
+  version: 0.3.*
 - condition: crds.plain
   name: crds
   repository: ""
@@ -46,4 +47,4 @@ sources:
 - https://github.com/VictoriaMetrics/helm-charts
 - https://github.com/VictoriaMetrics/operator
 type: application
-version: 0.59.1
+version: 0.61.0
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/README.md b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/README.md
index 49a06de2..6a080424 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/README.md
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/README.md
@@ -1,3 +1,4 @@
 # VictoriaMetrics Operator Helm chart
 
-Chart documentation is available [here](https://docs.victoriametrics.com/helm/victoria-metrics-operator/)
+Chart documentation is available [here](https://docs.victoriametrics.com/helm/victoria-metrics-operator/).
+Changelog is [here](https://docs.victoriametrics.com/helm/victoria-metrics-operator/changelog/).
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/RELEASE_NOTES b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/RELEASE_NOTES
index bf22fd3f..3529783a 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/RELEASE_NOTES
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/RELEASE_NOTES
@@ -1,7 +1,7 @@
-# Release notes for version 0.59.1
+# Release notes for version 0.61.0
 
-**Release date:** 03 Mar 2026
+**Release date:** 16 Apr 2026
 
-![Helm: v3](https://img.shields.io/badge/Helm-v3.14%2B-informational?color=informational&logo=helm&link=https%3A%2F%2Fgithub.com%2Fhelm%2Fhelm%2Freleases%2Ftag%2Fv3.14.0) ![AppVersion: v0.68.1](https://img.shields.io/badge/v0.68.1-success?logo=VictoriaMetrics&labelColor=gray&link=https%3A%2F%2Fdocs.victoriametrics.com%2Foperator%2Fchangelog%2F%23v0681)
+![Helm: v3](https://img.shields.io/badge/Helm-v3.14%2B-informational?color=informational&logo=helm&link=https%3A%2F%2Fgithub.com%2Fhelm%2Fhelm%2Freleases%2Ftag%2Fv3.14.0) ![AppVersion: v0.68.4](https://img.shields.io/badge/v0.68.4-success?logo=VictoriaMetrics&labelColor=gray&link=https%3A%2F%2Fdocs.victoriametrics.com%2Foperator%2Fchangelog%2F%23v0684)
 
-- updates operator to [v0.68.1](https://github.com/VictoriaMetrics/operator/releases/tag/v0.68.1) version
+- revert change in Deployment's matchLabels, that was introduced in release 0.60.0
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/crds/crd.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/crds/crd.yaml
index c4138be8..bdf7e8d0 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/crds/crd.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/crds/crd.yaml
@@ -6079,6 +6079,7 @@ spec:
                 - spec
                 type: object
               shardCount:
+                format: int32
                 type: integer
               startupProbe:
                 type: object
@@ -6087,6 +6088,14 @@ spec:
                 type: boolean
               statefulRollingUpdateStrategy:
                 type: string
+              statefulRollingUpdateStrategyBehavior:
+                properties:
+                  maxUnavailable:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    x-kubernetes-int-or-string: true
+                type: object
               statefulStorage:
                 properties:
                   emptyDir:
@@ -12326,6 +12335,7 @@ spec:
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               shardCount:
+                format: int32
                 type: integer
               startupProbe:
                 type: object
@@ -16808,6 +16818,9 @@ spec:
                 type: boolean
               vmauth:
                 properties:
+                  enabled:
+                    default: true
+                    type: boolean
                   name:
                     type: string
                   spec:
@@ -24727,6 +24740,14 @@ spec:
                             type: boolean
                           statefulRollingUpdateStrategy:
                             type: string
+                          statefulRollingUpdateStrategyBehavior:
+                            properties:
+                              maxUnavailable:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                x-kubernetes-int-or-string: true
+                            type: object
                           statefulStorage:
                             properties:
                               emptyDir:
@@ -28628,6 +28649,14 @@ spec:
                               type: boolean
                             statefulRollingUpdateStrategy:
                               type: string
+                            statefulRollingUpdateStrategyBehavior:
+                              properties:
+                                maxUnavailable:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  x-kubernetes-int-or-string: true
+                              type: object
                             statefulStorage:
                               properties:
                                 emptyDir:
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/files/crd.yaml.bz2 b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/files/crd.yaml.bz2
index 7f518a91e11a4af367dd2ff450bc953ddc650964..ab7c4d95d1fa275eed967afd607309920c09a05d 100644
GIT binary patch
literal 27506
zcmV)MK)Am`T4*^jL0KkKSq!65qyn;j|A19hRaI60|M0)>|Np=L|NdaJ{^7_4J@aTc
zU=&j!q2BLXJ@>J8r`&w@o~NVNyUyrD8%V8H%QtR{6SlqV;3(|so3yLm!R@aAVAcb$
zaqk>=buM!mo4MOG(C{7SxHKbebRvh3C)YB7)`WZD1bsNZjqU>?sP*p3L=+UDbnEDK
zK<MZXHV2?|1rz`a%K3TUeY5X-$BUz`>~zB&_VjsuzE1aUH@n?md+zd{-(J@A>+gi#
zm2bDRdEP36opqF*U0+>#U3VXDShMK*6#Bisd$WD@-+SiK(aRi<M)VC(s)D}m0HfQi
zYjy4Sz4otnseNyczWRLYJ?nH(bKXxmw{MFSYS*tvHrv-d<=yl%?_2GQZ+3L&uRT4>
zRZ$o`4_nEH-#+lt-p;}gZ$95Q$I#ziUspKl6W6_>_2%(<-MzP+Ev>fAcDlJITHS9x
zKKQSEU=A;>?+eYiI`QfC$U9Qo4~?+8`SZJVzGW*~0)PTe?01R{2d3|K)3|M&-hD3b
zfJxW2zCK)!w>-S&_UEU*x8DzUUc?HLB%QXQYTHe<ySn?`=d#XszVXuaudME7_i2;g
z9AW3af+-*X0ttu^G!rECOf@|;CR6oIsj{0*Pez~(01+YtLIh1TD5t5Xsp@)%lmOA7
zGGy9DnrHw30wN+vf<*MhO`>3$o`?e@O&T-->H|OwgFp(Jq)1a!CzOq*Q%umCL8<Cy
zrkWZwVq`J~fB*mqsY*=<6VXpcqyPwy(x;T$RNhqEMKttfG-%1`JwRv%o{%X?2qu9t
z3VJk|F${>r^pn)odYjZw8X8F2hJ#|Bqe1QURIg<riYfh%Z2tE-`?=1Vx?5WdDiCZ_
z5XDpZw?CT>Z}b1c|G&WGaEVDJg%WjB^(sYAOZ<>Lif~lgdbtS+i$;29^D1LVFa|%$
zh4_fb$jC2MHF6;lIx;!{VAcu$7(x(|C8~K9C_vOC0@Tb!JvDS(&BaSpyqU>**>{?`
zbaK37f}|n5Rr6|0g^#nPo34aZmm~;sWN2_P2un$DEG#_QHAyT&A#b(N$Tk}!B#2cw
zLrD2-NGZs2<&29Et{b;v8w??G-M8NCnJco$oQI$|VJuddmtcCB1<7&syJp17WjD|=
z38!YwBaz4j2+1NwJi?YPgK~w7n1@v-nodq>L%33K&cY$vp``3=Bf-m@%abm!(n44S
zV;Q_+SOp=Sg}O6DCGG@r*^NpE0NGCBNN0C8bG>;TYqjIaOUoiwWQoY)n~Q`Obgik|
z10;xax=51ha_V+&o<ANxjDB72Z)|=a$T@gl*%}ucclqvl-hLx!b?KqX%3tS-itCud
znHd)|n^B!*=Yw;M-$=&Ph*HJ0l?niT)Gf5RC}AAiI;krY=6BAfcZ(K=^K5V5L;FgR
zLaYdt3VgqpkGT&|vy?D5H4TtW_xNC(mH{TnB#`WeHF1hrARjF`oDYmh7T-Wifh6!P
z^)ArvH0IkPNWwsb22Y3~^Fk^+7y6KYra(Ob{BI%k$3#x`sun-zZ5JTND=y(^UBa75
zYNjdijHsnZcT`fOEB}-{s#~--Kn#f&(o~_`3K?;z<YV+VInP|vT`9u^j=x0m4&LFz
zaEN$g1&nM%h-qH%I7yC#h)xNDV{6U>NOJP_)|rw)2u1Ty&m}x5y2Rx|ansC0a4C+1
z5rKm2h&xZM8U`Hd7l%kB<SlrK=@U)fQ@*Uv9b)VPX@kQgNhC*t_o{17p-xzV;uDQ#
zXHe)uBm}Bxs2Jl!o1Pp)XlhM~W)O&N7=~bplpvLITDXJ;Y|cw1oSq@8Osh;nCx#(x
zMzP`$P9fc3=s^yd!>vH<;B~HX*oE+$npjrF%yOHx!>1n*!WkWO=l)&><~otw*J2fL
zC)TrW<wE5{--X28sA2&DwG{V6cMYSn6EHI<5W+@Jf)SfZ7!fED!8kN;Ek;p%>FS#Y
zxiWO06wtl@`+026si>Q*iwvX2j0$*sO3A`ZB|eElK_-QPK`vEp8;E@1fyv$GNu}#{
z8j5o{r5zCNs~mJgKtM8RzX4?dik@s16uDG;8vk~SP>67p8hXSq9yIfhtX?@Y5D83`
z8KEYx7b9qFtcancB7xl5K$i5xF;m1Kwm{j@XHnpRRw2^%we4;&1F=&8AhLvNri29Y
zAaI(l=HaCGrcO=iaENvQ=1_xL3_=7#jUtTkj<|*1t=}5OOs-tA+162&m6MdoWo2``
zlVvZ0+fb2D=Bfn#5YyvjY%c6iv~Y!|-X&R1)n+RTwTY}tzZ_s$z-vjMU{DxCSaq!&
z*cT<_C>X&?d@?G$nO*A2<5SMXUNZ-q3*fc!V6~3)`R$uK^JSEN*<)D;CLCc`Zc|cs
zwVpYN<sMsG=B?<!HjXHqf@D^(1c3qHbxc(MXXyFo<$e#1)93B-nYmI4;X;bKO!qoa
za-0Duiy(v{0mS-5$ye=KkWa!Ci@;mj7KoorK9asTv>}5+m|#MQrU%Ou=JN2HW_cQq
zG@Tykp|>HXQ&9$EwX<!Z!#D^B149Z?bBGYX5i5<f>4Jf5L$rul`%q*e9XUeZ__01}
znRM)M-ly->jp3IR%e!52Y(a=six0zsGoLB5LZC0gNeHU7-KgBzGFeSzY{YYulC^N+
zDwYdSh(Qgf5T3YYyqmyD%)TL`=4=TdNQ8+5;oFfs+v`e6AxKqn<xOq7u;%K{8RKEq
z^fI0Wq&*CzJZbJEDg^|A;cgUxe<9_WXY)};rZf=qS+BV(xw7G(kqS?8Wl5Z&3sk}-
zfL|X7K`v4hCw(2rvOVwCE*1US`Es3<%JOdPRopFMVqU-4E-Ra+sm(qnm#YWMH^pU7
zr&MWyn0q$VdDO_fFrc1J{!rXfkonksQs5<M*jVsJ)aS~Rfih+y#zwx^+TNRbY43XL
zn~fh6%=n*ce>}NoHVFDX+wBw7jWr^lNMKYGsfk6ZeJ~=KRJky*v}!di7^b7<Fm7k7
zc^%g+b0G>QxFr<bDn1pe9GpzpSW=_j5JP||%_y-5i9x8+2D)(RlPpc9D%or(yXT|E
z;CazjnDI`Dsl=2_QB#hg&Iy7{h}^UlrLtmN36Ts4@(JX?z-z=PXkre<G*1wyWCl91
z*K)&Vtr=OBmE2W%<?&mn^j~iJHNJtCQj$K~K`hXKnG4c5Av{bYs2SB<aaAL|RJvp}
zJnmzi<Ggc`!#yCOr>JkQ2hzk1nFnXvs`{BJ??Y{y2V6;JORsabQQ;X<_?c62IVWH_
zn8<}AE&4p!iF7`K(FDlm+8>sqB9s}MY~JZJ+db_7=trEfQ$c{ExC&&lZ6*}@Cdq{?
zliMO>g}4(E1p|=@htd$>8^{V_Vb1w?B+cZ~pl)X^vAYbFS)7r)&Ii7j$sWRT&R;jV
zA{^~AxaH0u4bEUID07HGb8O>9S*oid78?zee9dOLA-}5&#F7}0zRY|!B+kVC*46F;
zxB$~rl~5J&F2ch31Z+PJwC;m3GER#OOaP+{yTm<S9_U&|c2XMnD$z1R5<&?em_RqW
z875nkCo*pM*PJJE0Zvljc}((>avbMOQ>OOE0zE>Zq;ktm3CC_~JIfHRhXYt+xa11W
z${gc)9zldiLPB9gC_pZ7T{|A=>2&sX*1@9*ldE$&#%lp_ptxO!xuSzmOa^Hm4WYF>
zlZ_?8jbdz=S~u1m?)bqya;CBux-nZBQp^T)(r=Ypfq1YQijpWJzL1>ac)PNvaRNZN
zGZn!b1b7-i9td1Qtq<e)!Dx6x`2G;aKYFR~SL-jh0@x5WibC^3L5g{!eFbu5mzA1%
zGfkSch<N0fn4-~J_%d9889s{*O-vBT0~;i!rgw%J%r6y0*x^e6o;<?>90*2-E29^9
zqH=xaTo8~|fRG{)D+(ll!O~*|69<VJE**<Wf~x=sLY?$z+n$-BAZsF}flzgVYI?Bl
z7)uK<0Iw-r#)W%tp*mhp^O_zs=WcD?-0wt@s)v_3N@SHQ9n9piwy_l1=ZGWh5&PA!
zk*Gph_--;d!cw8LnhJ#O1=>zsgqX#I2w{X^2Yu2Ou>;6tqcG04x4H_UhAy>O3*0NB
z^OnuR+jk;#ds}$D@+^;zC3C{?!n=I?>=W8ml=x(n%q{}>o(=k>_J9`rn)k(>R7k)u
zBhv9j_RC}vNWngH?E5d-57_l>JZ4<^Y{b8=RVpcQ1wEis0^^nk;vxJ*^b&PRvM~vG
z-N+yLQ}l#;!T9K;>J$)P0_Z!pxl#Inz3P#BgU~q|XefnU*CX`w^Ar+ZW<YSxIoK`o
z?PVE^0|qU&wOY~(TA@-D4!TI-EGHmS3rx~!D*1zO&{y%*fVyC1ft}w60;IiD{9s(2
zJZNlVnAYyZ6~OmhX*QEqm89toU5!lL#h{d+kg<ejHj)9IDxF9?c}{X3Z(Zkh77ufp
znsJu+l}X@G-FtCPCc4K5%H4FzQqL2cTP;MBQRT4Tv-_|mL!(iLstu3y|IwEp9p@e<
zaPD3&9=a_yI(B|7G267pdOdGGbScrk|M$ms9;<;0LQ0}a_&Hd^v?2GGic?`!&p;<;
zZRpo-T`s&0*PfJL9!;Meh1>FV=m$JUBuozc3!X@~#X9!xHH)66h3Qvk$>=zWoI*lk
zr;OT(`GKT`Lt|7X;j&o%XjjUPs8BuF?k1$6@w6p^ZczCW!3{&GU6~MFm9*h3O+M+E
zgj1Rn%K#hZ;n_&DT56hHhm(?G7Iem;Ifco+VvES2nG=)?!UZ23JTTrB4f8kN9FaKD
zwG8D$c1T48hapLUXxi35gxYs#s&Y$CIObeEWr!UToK9)5%^|r?GeJiPcg;0+-oV{T
z4iGsc#7v|XhSj0DBrb<+Ol}y2C#@+-$HqCiq>$zZDI`sV+$-6$(aKKvK5iK(L!>2a
zc!lN-LOGXrP|AiCF$#GxO_-Wc%*<M{+GVq8b9WV9FC6AvAd!pB>|#SvO9IG97B-K~
zp5v9qY6Ot-W{g7wTRR^olUcK=P#fGlk2@9gVdaFru7<2I4izya&u1r+0C|gv=Cw{|
zqb0*RqU^y|{h1ipofLOGxyjJHV_J{N=cLHU$bxDo*oT;l>TVf^eW@vm--MzZq!UC5
zFYlW_74XjS)H)cUAOYB|<W9RDOM5QPNnUFh^-OTn%{bQP957IAw+5==@;6B8Dn?j7
z=3|6wB>@VtRJcAygrXA2;D@~Nf2HX4_*{@bEOn7X+2LGaZIDtAgR#u*0sCGWV8#}_
zZ3JJG6-_V*{EtoftXWfaX-Nte1(HCtB!rjP6d~wKQ;;!OCmcN#!wB~A!MYWKX{#Xv
zP|+=DhR0)~#0<#^M;n_gswAlvr!IMSHZ^QJ!{d>rQL9;Y+M8r;7{=?2k3S9D9#5}0
zy8b_s_mI|W)+>~Rmo<-W^n{3DaEU)%m@8MEndB&`dyY)KVf*{wyp&di>cq2i7cgZh
zw-m6F5}XgB9!Oko6_BCgVj=m8A2A=|AG#1^Q1b!IKEIB_&ojyr!X98EZV!luU?~GL
zvq!<Dd6n79`f{$!F6@TOV`Ox%JTE7~;kKQYjK)L2r)lnb9Oxa3h^loe4gv|O?Fu2H
z21$9p<9S2A4cxXTyM09AfvU5nW#5`_h2=uT-re~^>;>&CA&shZX@(<VvXNwCJRG7J
z@JI|88sG?S79>3q$HEOdQ1Eh)nF$9Ajz|O+WT^y^We;9rjz>x*l)_*yrK8w$L^lwS
z(gZkE1UGYcMq9`nvZOia!-13~<;KE_5IoYmN?EZA@Rwj|(kBqjnp1fPVGzh%)G^TM
zOv7eE^8-d2z}?}Y!Q~l7XL?{YT^hUs4%!kVAtVQCzm*~PG<n;;VvpDJk<1@>IMrjt
zUh(Im-;A4@;gRK-GIjaatQ2I1Wtu~};j26v_cvB2FwirUG{HLi4E+cX;fj(fgjNCp
z&m;*D4a=*Rl@1jNPw2(~^a^-B4?(q4q5dK5CX6!b{qdVkZkNHAGaAdQ5Z#H*kU7+C
zHS$&jeHkc4_9tN~1u+NkWGmhRFtr+J<B^D|kmRIUIt4f}gBs!})5Cl)ruiH!3n2hV
z*wZ>w0Fi>G#|d*LA{BMprWixR0YKv*6E48zmEkFTFgOu8H3$W8oDK$nLA8OkF(7tv
zrkM2U2xGwvj2(n9g~Fc#9L^Btu8eayXzvHOI3_V86p)c1LTgJiI(KAiN#aw+XtdL%
z*_d^r%P4_%!a=ct2Fra}g9ZW?o1%+y6a^1Pj;+IkvdSU6A#UM`>j7E8RdbNIRQvYz
z06xe;5=4MRdw{;X?)$n9q6I{DffarroPsq6?+*|~Je&v2F0NWsJQYHH)FKfb^sf7g
zj&hFXGQ)by8q{0h?UM41qssJaadzWWWX`*0lQ4R0YAe4@8nCMvP8v8dHc^%ww$99>
zt|TnoU8h3qbDKCP%AtoLK_ck@P@$&O(20U1R>KHh6dwlA*oJh&1Ez_g*Hec^Ch4hx
zC_&<Isi8L60x&GjVu*bpA43s?gFAH5;!xF(0l;}K$X-Gc#DVRpdkZjyu*}LQf{9K-
zjA6ip3%rqjPc9%S+(X8xd19xerbEvX%tY8*ygiZLPV#olc`@dabxRLY8S?hUfSiNv
z1YmnKDpJA<(gO?#HI1#JnbF5M;^5;la$L)Sr3z3NUD3Y~&`unn(UCwSPE%G68SEGx
z2$Uue;e*XMGIJM`n}=>~%aORU2uzN#;yr2TB8JVH*|<=*WC}XB1Ir5!d~S~gvG7cm
z1(wm#*SXj};{{+56p50i#No!1$zo)=m387*DvgPd+b;Ykc{Wb=#B#@0K+2Hb(QL?x
zVazy^w&4<R<A%B9i=o^**@)uZu|2ZQ=399Y+s9{-&XvyGq;8@RgdoEv5FD`dp3n^F
z$quZX3z%p(*k3{rPX$#TA;V;j0~|Pu=wnP7OMJ{q&{;z6mw}58uyj*#c{Vj;E_hvw
zOS5F1JDR69vm$M@irbjtMCCF#3(6k{0o6hV5HMnvIoH|+3%bcn8zfc)2w8<agV{E9
zq-QKSd?9PwJEF{z6@bO|BVhnNDHTqVcpT_*Q+T{Bp{l#8=xJ9x2(SboMffFT7(!8^
z=zFzr0On9FW}4Jg!y>{Efefw>LFz`ZlR7}8q?1Y|Nf3ODR1Aydh8?9j4Z~5G!=234
zOO=(}w9-LHp{leX$j}ys4vyhjN$ZG0l5c1afFh}+PY;1I;b|lx!UMtr9|}qp3}H~j
zr1qj68%A}cgwQL5cyUvBS{NB(4o+1Kv7jZ4Q$4kj>#c~mPM(C}f}?^f1~aL+od;Le
zgmODh7pUNi4MC(y)`s&85FBEK1N`MrrA_=puKTV}i+bK|b8~bT_{I6DzieDWuMucH
z(Q1);1*Ia1KI)>1Rw%Rxz<{hQRZ7CjlM6&NERis@lvr35>4hs&9ki=K1#&S`iwjb$
zqbjB*P-Rn6($H3glv=W(t5rT)6VLUtzsoZ)<VOPcMA^g{Xtu~Tk%^nQ&Ne2t$!TKq
zT-PpXX=>G`#zLVR1d*(4Y7&yN)k=V?ciLrzm7H=_VP>U7v^jD_t8%Pat2IpM%Hmqf
zR;I3tE;tKCoKuTvb~QN7nzYMX6JtxGO&nFq(!|bOGHRT$vRYQfiE7ARd#2cC<{PCp
zZ2?$WwNn-r!IqkCwsPpIWa3$2s<hUqEfs7m#;&|^)!ki6sGgpUV%4ha))TN?lZ|F-
zEH!E^TA5~<DmH5cq2zJKF>Pw=MsRAhQhB|5ym!0C%L`abYAxZpxr*BnrJ^xHBp}2v
zcw>>YY)GRSu_@l2CDue#>B*ZZmdx8S!c^3;s|4}Z8JnXASw@POWmLpgLb9eARWMkA
zl?#J)#=~)zI17n6Cap&)%M{L5R;*fP<m9-?YhqQ$FuYT?7Eats%G5R~Y^jx!Hl$rt
zq+i!B+xvM9{I$79EgI()V-XvWrT<1$l5VV4#H#=Ku`1YuclihQq^ZFw*-Ex0T?DIP
zD(1NqHcUd%h1Ovg(Ws?&(jI#4wenWNRm_!PD#BH|`6qGaC10KD==Q!YZfj;QV3lk8
z-Idr%ztEL<E@D;XP{98-f+szcs<slXiWA9C>Z$#I!aukBzrH?xNPn<)hV`qoH;f^_
z@QJZDZ+HU&V8$@;H%$dfLqcfQtZfVC?$ElVD`8~V8WPO!IdYjYCUrK4Dv+$3c9p$z
z056DnY8O>MUgfsiZMNHOw%cvC+ikYnZMNHOx6&Sj@b%30J_m$U>A&jdd_%?6Z^PJh
zCqtj{A!v2X)j5Tfa6BL4>`uh+dh59L{oz_X7I+T^F6yd^D64LPE<*e7DXzMypp-=v
z7GfT!x!>*ln_HF}7~oHgz5a2`#*R9+?YWB9ar4(!6R`>qvxm_->!(rNns;*biNw2d
zL$wZNU7&PS=qcJx(sqgKPg*bHp3!?p_@Ho8`xl7uuBx>ibVEQi(9kn&Ov2MQVN-lC
zz{28Sn4<~ytqM@4jAY3QSRkaOIVTP-S0^LI)1ofwI@Mm%?vdDTRJdD^Zbsw`lrkK|
z%nZQXGs_#Ll-XmBG@?-C6b)%hPD7KBhDJykA-Zlm<YyV<m_lSZWCl(_lH%g$P1fBP
zN>Y&_xW7tqprEYdy$D<-Ahd|mA($C~JoE2%1$3C0;Zmmvs+wpfnrTS3(7Dyueeo?T
zHn|I^C@3$$%Qjii8U|r?*2+?-nrW)C%k?U%t!>ti;5Pxf7g?2+VyS>&1i__MROaJl
zROM<+tjY6Li_fDuy7~8V6epq9khD79a(WL(qtSAus+QWgiEy_!0^AMDb9L$#g5*bJ
zyCbr@QtYeB4*HjTchoNg&>kxAc${DM{yQja3$P)uj=~!YvW~*LAR8(>A+n*cCcx~j
z&c@E$a1IX+8|kn>n(CUNpqdVWpl~=>$GZFHlO{~0Uwe6ZMHJ~Krl&+RLpu3kN5lkI
zs-MiK#Gqfnf0%zg5q=dvJwbk`FaHXJX-HqT3kp=qg32P^pub>_5pNk8VQ68MiKSxO
zWMyHQg|(SjhD6O1Oj(tiRwCLgvddBu6|*Z!NVT*i2~x_Eu{D;9M4BsTtxF<VX;Ru+
zTB>AKw3=I6Qfoz%CWyAE)sn3iB}S68(rmOWu~90uV2vb7NQts0NVbbul4zwRw9+Q2
zq_)(w*)+;a6q8yMtSmO!YZ)-73RCZ@e--}!gjb>$NRZ-rA$1oA`T8m47fF5>L2{R%
zSr_NJ7xLoiQp)r@+46AJ4Xk2SV+2b9P@s_$*cVC4uSfHAbbZg&3$&k?uwR95#qAdg
z{t^GJvU~L*qn9EFaKC`NxzeXK75BalOk*oEGHfR1A+=B7YNi+VRN5IR+{%(~Cw)xo
zQwG&Mk@Mwy9XM4V!>RjqnPz6X3*V(C7an{2Mb%5vEJ@pikQo)waEb}#$Q*L?sgc?$
z+55$%J4Mu7U*RSnT@_Q}ioIgO`6tNeE`sP@sazIa1@jBAU5LL~acZ{G%$nyFiH1?~
zkKjKgo^{-9t|N^jOk<@;->G>?Ep4iq?P6vgmiOa$#@udKVQ1~ocbZ~wuP8V=h4QNL
z0`ia3Z%?)|$6@A*5(jDh{z7RJEWqpz&NZze)^KCoDG8kNR01K`d5QHTi*$Rz!WRR`
zRpJ4_<dc%4Ca^$h4G2;YOH_=3s2zo1-kT)NALEW4W!9=NBiF1A#!4s-8#+4wLK)0M
zre%Obgp`MlZu$!xL2dEiMR)?E^odgwBN!%XS}!^?NUqqfk&@>|P|0tk-8-q-IBRnn
zX)?qq5#W&eiU?c>6{~dw9?*(5!~!^ngQEHIuapkoOb>4lv6g_)lpP0euRR58cK5Ku
zJdxvpC_CSsw(%h1Fy1w-_wTO_Cxmg&y!163rPOm~2lV>0%kG6oC}{PUTFxW(LY9QE
zq>VR?uRd+}y&Oj<!#nJcCCMD)A=qRO=k^RZLS(f&3q$59?EtKjUP*_vK7Cx8^|Ff%
z2?DvgqX_%hWc$(-gw{~56dTGDgDDQCoT1|{_C9hNdT%kYeOmY*3#ZAyP%jZ909h15
zPDAtsp--qPbU_D5#TaMR1eXN7IXwc(d2t>ZsdN_W3kOX$;nT~JXu*u0hB{1Pdy`c)
zj%Y;#)%e*X=O~l9P|$=I7eJnZe5vA;JVis%H{<#(3xVWGNW-9kokzJHqg3+q4M&!5
zhmLUVySDyn)L?Kp7<j3?p=}|p%#)I}p+162oj>IJp=QuC(7mD39&e#}-Sk8{_7GEE
zxknqC^;R_<6`J<Z%NPd9ma~F3lyb>*IRijq7_8{;jWfXEw-)$p$U3o8S!Pm?X@!xg
zpQU;#(=fb!SWsv<h3f4MxFllQJw5`lML_bt>R4IdfaWMW;hy#I9eA_PPq2aE4$r^q
z@8s@xKM--wb&l_Ex)(#OP<x?sfocU=-(TgtgMjxN*m!mzQ0c?*SQ6>_54{*u@tY1H
zBwX+>-_Uh{CNT`k-1en{?lB9bP5bt11}$FFAi`My5VkM69w`k3Pag(@u*2mbebn%$
z5cPv_F&b0hIfXEXwd_m{M65C=W9ow-kwcMBf#nCNIu|Sb*+L#484NM9d;<#%l-QZ1
z@MR8!C&^+~QGg+~30eznOl=x1j5{YqbxpLZ6O5MJi{4My23estCU_m0PSA*2qIJs^
z!XyUIUrEl2L*!qTMo!wL3J;M8F9RaGWji~~4H-(ptYmla-)fjmu`ouMr^G^TfO>%3
zK{-5pQUdZSwN>r&Lswrx-;nkXam*&&Z{KxP=1Up~2H<1fs!Fe3OAPw~txTLlhm?~y
z=f?Q)^4r&33xVUvD?Cf#y73KunB$F~9a&&zQ3huhWU7$h^`xoQP=|k<33;mC`Hr(v
zUNdX@R?fM~^Zok2Q_r6lpMJaQA){K&-##4Pkk}te6TSkx!Se}aGii29%k!JxG;<~p
z@)<)WAWo3TLv&d&@9mDeP#y1lG@F7H-oE`GWF;Xyk7DGiXpoxKTGcwnt|qj3^e-Vo
z6Rxkur4RUFK@mD)hx3{!LqtIcKr}JHx>G|57~v!|wm}3KFojTK{C2kZe){jKkcdhC
zO@6-Eo;75UXGfY!Rs9>IiRD&kF%x^5pLYw8f!n5^kFUdW7)WmvG$5XF>nE6A2x{0@
zq9OZFK@j#5FKkDAcv+Zm446D63cZ1|t&S2Lh|+z8$6K$3J>Ox&;jen}6nml??)rV+
z+xwo78j=ezqX$qEs2q#X!9Fbr%7DZMD>+o4N5^v-z{W4MNvZ%nh>UYmZmAtQqM`^K
zi_WDdmHturZ}4_fc^DKhhp02JC746AB`&^4RnzR`4??H6MzG4sa<iX*8b4{JPmS*V
zK(vQY5Aof3#di5j*@~2U0=#n`$$?YA79BWoR+Y}GVJpHxu!a+$^e{GNP=U%$wS(O=
zzohsD*l3W8P@2wIWu&gyYUI+gyR*G{^GRUDx&bK#J~df~t^3Q{5XB+HF31H!(DqIt
zVf*6|2+N3J2yi-RN68ia$=Lu+5D?oZaiA&>h=#C}7?eqx6~~O+?~%sDCa!x7^691-
zM@sF&>7a6K{rT(PQ_n1n;)k(JD{WyRR5%=r`LiNUA&O7i@>KIcWek<~Xue^=N(nJZ
z^xg`NJUBidO>P0RHKQly(}kXLd6(qw-(o^xs{QAfB|D#s+v<vdn*BI*VKH8;vWnL0
zyeK8-ZDhj7)YL5IZxHibvZh!X_JuL-SM40nkE-Y=#NTtNW7S~2{CnlbeZ$N|Ztj%o
z29wTg_vepmdmut6FqMp#d>CmQowO`isj53QCeMyFmMHAW<i+u0S9?<Hdo<OGmJA5H
zkQN*8<$Vm}K-M#}hTLwZnhthpGz|Rb*R0PPwh(#}heOy{-bnq10rMZn1D1aOR7HNs
zR?QY!_OS9t!bc<ksE&_ri}b)G92+)xJhZGR!;=7GOl=E1uj>8nGW$c-yF&sjM#k*?
zj)TIjkWrrsj8isJyH~-&m9o?z0YV2nR$;qqB1x^%*cQ<FR|AHucF06C2Sx$%JrqZz
z1~6ShYYJi`z0wc41LLnIN6v)J^Jbt~(M1At60Y-d?jDHbB=Rhy0CduMfkPgGFQd@2
zWjZbwQ?obO;I{Vw%nv@tGY8ZTResP<5ja7&bd@$~qKKxC#t&x?NMxXpfjmx*#ka0y
z-d3M7(ApT@E_+v2RM9j^(omL9W3zYbI<gzSc*u|(YTqezSnJ8Fmy_7`c%*K@F}xz4
z2oG=&+9|IEc!sXBj|XM2kE{%8hXW5|g$k}7$5(UQeT;`k473l$)tG2PHX&h5HxdU#
zuw|>kf_XfO5-)<MlAkAnvjD^nH|}_EO;^P0Wm~E$Y=H=wJ+^%oVUXbt1qu+d?mlHh
z#LRu`R#ft6rr}fM!Cu}9_R+K1s`3c)L$X2#AbcI3feqTB1E?nxo=pyf$hA|t)YEIe
zVr(mddMTnHFUF3`u<};Ggn7pBMBixeEInu`@Q0F*t{Q>D3z9&9Q6AqX!Dpc{;JzF}
z9?nc)(3uj)$?j8=2Zq&x!0*FsdUqvx6P0o>?kuK-UfQDA!KED!k`yX?arL_kb_drg
z!(tHmH)Qacu{+pOctBzEzhI0ayDEkEAoN`)uzM6}aCVolQ^HY8F_D8oJQJQA3{@hX
zjvfm72O^vT1EC0lU?L+}4b?a8<91-oH)R)HBvZ9JFdHKHB?m!hbQmiEkg%Q(Am2=O
zgW9-EFg64eBiU49kxc{uEY%2LZi6ev(UA^`P&#@GF99GVu&}9(2-uqth6&JzPFE~&
z2SjNE!2!e!A*UoF5(I&^j?3&0ilCS_AW-nLAarCE?@PxmaROyvaRUHt#m5W~vJV>`
zwx!`y0i-tBR??d$O&Ez*CQ~wyyqnPBGCGy58rBCe2hyjdos|*ET>@(Hi&K@YL77%%
zD`GRqE~(}hZPF^oMsuVtij{O>bb_Il7a+1^D9Aw_^)+o90-<kH1>B=Bo(*kAR!uaE
zTE_9r+?yteHt4a#Yc`^7Sy-r8wKkz-wwozwIjH2)YQ?mzSX(MxN@AzO=WVjtZML?_
zB$T$>EtcDDw%cvC+ikYnZM}M_`u{iU6Z`_Of{b8BN>zP(eT(UA+x-;ysph-9sXx_I
z6aIpf8Xrm34#af6k1D8?rEJqpG%^RJDxV+w5=lRKRK<T>RS5hDdhQ_*lOi^!b=}RE
z$giF^M=~%jACtl^E^$1Y1t~<RL&$&YiCW@5PFpMn41_EYq3{CW^AzZ_g{<yY#6)?_
zfO5GBAqgAZ+~){~Ih-8lGPP+E%1J*thuQUfY848Fx8go}RQ2y~&rr|jq515=?W~LS
z0}ve55&`O7Nj#+dX<{3fu<B#kCxo5UxcHaiGRWf8aT;nh8JU@vy3#iz+^O@!T63Ok
zvg&!mGig42sozW4-tSG<IPqnS#K$Ij2!bHoOvE-esk9-fG8#b*v{ba95nliiT^!%Z
zq<iNoh^vUHViQb-!W#%`?5ebAl?r@SFxT-^<X#DPhBF3?G2Xe>=69V>D{9=_+}~o`
z+k>F$9Omz;QwmczGG>h&9u8(qg5P|OsQ2O5l$+!4X^h5KPyW6lRm7ghwNuWc#4evQ
z<iU&>V+;(x66QbB!Oo-dBhsB@>gdNW{qK`9Ne{@TvU-e+oNf{UcKiHYw|8yc3of-X
z__nO_?iO_9k7_tgQ$|zD9$tIS+&v}1jOTebiD@wq%4n3OlSB7{E206PRaS?uRHZGo
zt!YY9l=Po<M|zum!`{TqGDo@lq3Ri2Uv18&VRfa{(eE~s7MywFwzs~9qm7Meylk?`
zwx+bnrehU7zLXzQC*@P^rHL5CBqR^ACxs{;`_105TJLUrj#+HZ{Aa4`ZQIIrrWF5D
zRr<+RqWCwv1aor??^7&~3|n_C_Hyz0T|lrTu!-u>w4rG90Egs43jUb=h(D!M@Ctp;
zZhU^K?%mpKHg4DNMnXgA51-k-e8k8GA%N`bfua!zJKkt%E>Pf1i=f;L!I?p@mW9Z3
z=dQBo(i6Hm?-}^!m#hslG)_^5XPniW<O?~xo8FCJD{`iZI9-q<We{wuge;MwiUU6@
z-X1gN1cr(9sYcN-7GlOPqp>k+7W|sNN}D$Bseqd3r~~d4y*Zw#=q}o$&6UrGY|U$0
z>R%mS_FqVP6tEFr$gESZw&+rK3SkLGG{!Q<F{Nwhn|AeP{(K%hqvIU(nkH$ZMz5Dx
zqZSlf3=pywU6xs4yZE;5?Yp~d7p4ey!kDR~U3H2Kez0XAH6(z}2v5QF(w+xF#31N_
zNP8hr!3@DO36}|`Q*NHPXAXVync30raMPBYF9;OFXl|Q?g%~m5>>2$8Ea?7oL7Znf
zp}gpgQA8q?d~sLY$GP&D`goYJDNSgRIp>@45f5#Wm8~gCG^Ip5Ku|gJH{jfIIY>aW
zFPf*QRPI6Ssq<9x>y5p{3hR<4AY%j}3Pf-T+IrJdJz`BHH9~OL1i>&aaE&zF(2J;S
zW4ddgVSr*7CYn;3Iy**<qo`lJe$9YKkb=FZUueb>377SF*rq^sDOB*E3Z12+k~1_j
zGb-TSJKX8sHK8&X6vaWv%qSbXfcF4id3X=Y*OmI^mU1ur&#$oU(4T=1>s00^;v#+|
z^ZN4|n$29htA<M~P@;WkL?RImA#Fq5z{l^9EZuR(MmUBcK{rXGqoNgP(QyhN2K?iJ
z1KYJTU~~Fh#W@;6#GzxlB}toD4Cp)Z&sQPk0OJTmCv*etT%5I%BGOApo9WG+?}_rU
zI{u_d>G{}sKO<h+_o}L@s;a8}xtf0<G%e1f+efn~;McDMUTq^WHqS(RVsbMzT#7+7
zRE0-9C!Mjx#i$n0fiF68kEu+rxUf49@)E44ir&A~La-@Qs|sg`^i=L;uslI&8r}>r
z<z;E6nDdK*!o=09R;o&m9;Xh5@*kr4Smlan$B$^m7xxu4>L=j#kg6W!faRdKALxFU
z_ReF8UG+T4!s1~hQKb`&5|pudf*Pt+1=4)<+X~@RZp<+Gy^-qHqj<kJ(^IMqrbb~I
z7b<==So5jlVlE{RL=k$Sk~OM)S((hlfpO6N1Ny*!xJs}}zxYq`R>D=X184MOF|z*<
z({fe)q^lBDvlNwo?munvQXGISQXZsLcI}_(vL*buO&cP949n%!d4cxRM1&+n0n`q_
zQ!rVl`JxaFuWnnJX{3x`x)}tD$`2`17fyP5S%vrCRo_}h=%>WO8_E*a@<9b5L#wD%
zqQ)c`(Ss$QF!9}gL7P5P;t-4t2zL}WIX!bWztgNdW-Yhm!EeEtcVcn&0<Xv8`OA~e
z$e?_U7M6oz6G4xhL`2|dPO^g)!I#@z<XOnL)QXBBx*N6H)vGLw%Ji>r_2Z!8$C&2m
za5qfWkqp>u)dEo5vn;^Y8riVUw?c;G5J9NyXkk-Q6wC&TP!=_W)$3kX5hDr590FYe
z{duz)DX<$O;fO>l*e2*FC_h1SFw`*;aInP8q?K-)A9ydYSRjMe*!HgtvJK}e3wajX
zgIp^vR?TLb+D{5OO7+U%T!wU}u5v4jm3_0<qehmNYRgS)SXmfWwyP#f4J;ZgR+ehS
z*4bETn<!IRRkT{jC>~hnhF_tI#acnANO_xkkSzs=_;voWf6x!+2lG6SsDHuq_t0je
z>xLnS2PHQJsI5@++i7TfO}3ZgZ^otgJQpuvazp(a)BMU!145T?)#2m}B0?~Ny`%)R
zR6^^nZ9n9HNtHjSE@*&t6zYJPl=PH#lmApZ(CZ$k@P~w-CGtT3ihfo8fPK4KcW810
zkq9uVvxF*ronCRyJ^ufH?>=fX2h}U2e5|7-h9|>~Zd@GU!Xhd;wnc&fh*bgzHK*u6
z{MGihPCBn+o)h@hT7Ftz)aX&S5%=0fYC6f^e>Zn^y|U+bHOt$Ru`;jWjulvH8$O_d
zSSmr1Sc06&Ln?ug$SPQ>n5ov0M+Vq3UX(--{nL6ia=%2k92X`_D-$l>#t++Wh(wVB
z9}Q>tcm+W&|3lJ%peUk(iRbt<6c!!*^#4smb{G-^Neo0lrb7LSm->K8Q5Wo5j5RE@
zD{9Kp*%j`(XTNRlm~ZD>O0!Z;s<xJ<OCnm?EwwhH*2S%=S*@v=1!C5VTQxKimcnhc
zt!AuCWXWV&kQCY~(IP_I8p)L`z{@ntSw*#LTUchTt7NgPSd(pQSV=Ori*1sGmRiZJ
zibZ9T5e=f&%QlfFglP*=1!RWWhL$o(D=|S@TST!dZ4GAiHqNj5yT$xh*jUD4q1AO|
zj7tiT`jpT3cf&I?Fu0s2W%bFtr}er8h&z=zDDpt)A<Q_PI@;ih;Gqchbbe=Fl^u%u
z2;nXf!n^5zGOrm|xF@);v{&0p?Wfv4*V}!s-~Il@M0}}?5%E|j+^5A*_%Cqx4{On?
zY8o0m{=EP6sW4s>cQ+lwd3bYgdH<(8RW4G+NYeIWp&2|;JHx~f^8Bbj$`wofX+H({
z)Z>Qojzqt0FpOghAs>-E2y;3fYjp04h$&^DSRhj+WTO)D^F=X7<RVf(P*3cLh=mO8
zQAx*QmD=>mlS=-KiEuLT0-cS&bx8fx!9NTx3J(v9R@FIKWXYPgDv`Y!7@E;%x6WEe
zvX-gr$PO6ebg;K8iT@bPj54YCl-|bAVv{XNm1HUvV=<YtGZw=%R%NR;rifTs60&5X
z*0wEXGc#7x1jOx*(SG-re0>GPHif}2uI$L%7|>F*6jDOmk`+G<PIi;HU9#^NMPg-Q
zwxc)A55Ql!@sx?Yg!tcA)XVJpy_FSn$_0CUzTeR)7msqE2kBFNQoOB1UxWFihrn{?
z6_eBiz=d=s%KXwvC1l@KKKsAy?fX2+zN*w0!31Asg0@iBNwOl>)0&U3lDB_<e>u-z
z(eF=Ci*fze8kP6)0<r+L=DLabF^BXfZ$al*0q_VkZ@P?5($Cw)<;YUx&S~(T9__T5
zxMzXcQ_M?hZ2iI_ycEQ#RRIit+#dnKI{P?6OZ;+*tg=d5NK?C<X5C0#Cy5fTFBIzw
zy-x8x-&Nt&)ayf4i7c<1h)!y$HY!^|Y@&S1;QG;2$RJ3eAnW<D#~7w!7=*(lwQRK*
zvPbf44so<<nPgsd0}8>oZWpPR2T{_XLZGNB2C9mNspvBxg06IZaDC`Mq)7-~UsF+0
za8MLaInx#{g<|+W<j67jsb-$Bs*heDiy6fv3^OTYh{h!X3>?E0h9n$w78pWUV+&B3
zl%=I}GL9LS2Qa|0kjUm%+Tx)QOmV6Nh*?dMfqyNvR&6Q0x~(I4Xo*50(q%~nOq2=H
zkNLhD^ZAyqAnpz-apF`wX$nG+X|$-ev95AzY6I2weVOYJCXk@#J#L#iSdo%$meC@Y
zH@uFD0py4QL;(wmnBs)AB`%Vbso^yhZ`l*DgepR$05v8klsROHh8!mvAPvs)Wpa&H
z1%(n)Gi!}KfuL)Ik+@5LJa}-%r}zecNA7&p9go620P(^a8@AAxW|^4@hH0w*ZlOEr
z>B<dLLc>1))k9rX%2LP<NEn=#^$MJfUPj5H9?>%#!^kaD#S8fb=1&L?%#NKWaYUI4
zkgGiTDoz&$wevR31YZ0V0~IR+00P4d64eV`_o|cDoS8ll_Y-FNc659p@`ty#Ft-9g
zkRk#hh@7)MA~aOKoYKjeN<vAyFx~Qh55w@!L^#?G=H=$uIcA3FU3C#Os6yFE34c{j
zSucBcd?L7?B$wA*td^@YZBT(nrZ(1qcXz6E>C;DB5aK${&pH!~^UrJ&^dk8xH@m&f
z-<?!Kb*Z0S7EMagwXtgv8&xtz^_|l@2LS0mL!~W9xS2&{!WO8|LJUF?2(lt1gFyU}
zw&37fm?!O8X{cuA0gyCsp?CPVTWH%*ia+uog;atjgWpz+f~r}z-}W$ph^mCM{JR{u
zklwj!ZkZ~v$l^FH=^vS9CIVE>S-OfPcwc=Rpg;iV*UV@TMG1lsyx>&B$y5?Oh7IQ<
zgtbJP1|g?eGT|VC<QUX3Gs4_v({VQ&Xzn?U6IQiZizQfGn(iyfOv!XyW1|xjZ221R
zH(oY$+l*CHqfyiq@IdSkF$Bu-P<m*vP6Y@gNd|@wRLY2C8-_u?`<tHbwY&}oIm3rJ
z{NKK{Ra4A75mV_>0E9tL!@u=Bg(Du+m+Sa6G-OVky80iD)NI=I<S#XRrMev=bSmXU
z_CWX`rD__891%|?P9m=rJcrB*>ff8_#tw{K)m2qhRTS0q@Zrsy-@V=V4#LBpmH&YH
z`~(A^oD`gQ<>09U;KHOpgdqY!01rh6B<|6cOduB95iu}38k-$e3sK+N4gd}ISF)6$
zf*4_p(?mc-<d}p)?&e4BeO9-f`zJ3A_c?mx_l=f)f6;akJwhOa0vMxJCf(uS_rEWf
z%F*NMhg3Kr$9_|xIup-4{EEcp&#zv3`l?s62!YLc4P+G_7EJRkG&?~JInA8rmmbx`
zQV2o_rSz;P)1_!I%T|`6zOA(evMj~37BOQPL|Y$@qbPRm*LCG*PiIw5gX<CnzuJ4H
zD2SO3qNn5$f=9|qjcpJKxbai;pgdGb^zhU%NU0DCgmoSy1zN=j<|Y`ALVi32xl+9n
zSb+5isLCYk&Tz;Hn3~oE=16Yc01^RI6vWs>GXNvI4XA0n=mRhs2$Yl<*037iG=@k8
z()CiL3n2(WiD74Ovv(5$w|BTg8VSg@S`%vAs91I_8QoAnbk%FMo0K4gBa}&YPC7%$
zH<g|NR;*K<Co{vGQ0s|ELtse|iArocl#vY4PGvNMQk4j9BxNCj><Sn{5K0CxE>SlK
zLm=XigO!8=xG122QA2T(Ou2ii+t2r0Qk#3?r%g9heiTL0=61ImS(Z9z<eOTDG1?W0
z;YWO6Y$5*pbP7PW14!;+#~uX+8c(Yev$k;$K3`!wIq64FfjmJyDIyS74|F~sS+R4f
zY6_I8=~9a<Pe@!sT1`GGL{B?8q$wbV1P;0{Cx^zC{P5kqxf_6-7cd$^DG*5v3{q|A
zE7JpLO!`9U&`N|H5R2le1$jVfhCn<GH;}+9gebsc!_5Xx^VgoQVYE$<^C;g83u!$|
zA?4in>J&}{q)<zZ=eiwrgQzo44U?|0R80mVHuw_D(M1TrB9>%q#3{h3s0XX&OrCI>
zUV;QXQr3W?1Wtm2?cZWx%rJtO-ikud(NA*B<0iYte2<zj9F1m<=U#Aiu;;zWvQWvH
z9B!B=Vb2M7GvT!&M*^HgxV0*nwNTtPkpsZ^qr@E?nmrm>kT8n})&ra<HAsfRuAmu0
zkbA6^W(I>6WGjAi>l$Qs9HA_i)EfDB4ok{;8y*(VY{n!bZb32>O2~;<VyQWWTKjP&
z<L7DU+8b|^g!O3>3}Skg2S}VDMCjBCR)m#;S)n|F9b7`E2pu{!MX#>!codINi$f^_
z4TXW~92_VP-0t&b4oDgyh-v|rI}#;2psP;6c>s)daAjjTK(N4rtqjKK+}jhdSr#a%
z9Yxz$NSNNErzPCYBY?P*k=EHRm55s)ND={FqT?n9NS!KddUBuG2(OKyqz!v+1PDa)
z5Ym~mhJ+|+ZSc^AHxvpJU`Zf$4P^GJl6xMvIpx=GAVeTZWRP}y(l2kS=&C5FP^C&E
zQIMhpAUWaUsLy9c(Y7hyC?p93d2SX$iVJaowFgAFghER^kRbvQN^s7~Y*)^+NVK8v
z;BqP8JCi(unyQj{s(_edNI=|^6A-y31c@Yo!Ip{8ckR%wK-w7?nZ+lBwJp}gau+vg
z*5a21PSNNN1%}hbhY)&7q#ij<DcLx-2k&`!23JX?;2{v2&Gn_*7txAaJI3#q=*VsU
z=7nMqNF*T?BxaiuNZ!mJ*`|#{a5qhs#>m8KPOcJ=>)$7oqxtz#U261jkHKGx?H6G$
zpXK6H@0!ZSCRno!u*n_K(&^yqTT}Vdg1|ILqTXAtW)7L&n6_IiTOmzS+i43@*)>B^
zX|+=d*;`i3jbg=(w%h;0^fD?;)PpjhvtSDs?&7gE65x|-e9haaCpBsgLdsf|-i~XN
zxO?q-Dru;q?HG!uMIjc#zy-StHX(c4Z|>Ty=_i|)8v)CfZ?!?e3$B+$5=2DPO~D1F
zqAGP$_9zgcQyPFAe&Sjt<U&ZdvSlg(48l31vZ09I{S9jez+cyGuqZ*S2^(ji-;C9=
z#u+wSWj^TnqxOCOtDR0%oYzI_UFgY4S72P_AJTiv)hphA8{b!9rKrq4dfCX-)U?rN
zXRFn1A}dWVH=LhU0q;H~W-T<fVQn<AWvePBlG<2_p$LSDBoK;EY$Ir#56?-`F$Ta+
zRc@*7z__Q4Ou>nVv1&=5hr{1GKZ>Q0KOp>})9KXfP^yY}dX*rP^HlOpLwvx-lM%A{
zX|T4`3_^+NdF0(B)>a~98KKpI_|Ir|AP7ME>+Mok;S3?L%nO!PP5qEN|FBfReM&z)
z)c(06m(ea&J{ul*#KYQ*XgB)5MgSbZ(d7tXSS}+~9E*$rZn^!aK5XWeJu^O@r#gRx
zUy%>055y@@c>s8?anV<xPE1Tlks`bUQwIcF=ab}*t&;2Ryxwm&M`2gjYGxIQvm=+E
zkzFFy7_%lM7FBttySI~bJsjqgzC9_d1@G!jXwAi_HszVPm9eyxz=gU0J%5!`YM4>g
zSMTNh@E%N><SIt-(VYCd@!;lP9d7MSj5eiWaEE=Or^l1UrxIpRlM_>o`9pyafg&>I
zY_TBFN@$EC1Tt>Xf6<A=#!U8l{+NbFXNrzjQ!eFrb<^~^9LU)h!tqZUrX>1mq2_bC
zQ?l+a@Eyz-gnBaAwU)KA#A&9Qb@mP9Rf{O2kuN%^M@ZrMe!IV$o@*qj^RICa<oEpz
zZn6>xT{wfJFYwG@2{I83p%BX~fqAmqgCaP9KO(kTCWY#rr2Jl2{OerJn{2OTE@W09
z6e`eesHy|5J=9Nv0(Pn&CTxk4%q)w#{yx^Vs@KL3(&|an{bq|K5>CNT5WVQ#)RSPj
zRN#jru16Y1y!l6$H8*oY9gssgIAsaJ3c?tm#hpJWWzNK2k=YQkz((;lp`0qDhzizg
zg%~V0gcVwBl&C<!PzdX0_$N|qHb)drW-eCEC2Vx)Y>|()Dq0n+mTvfD?*L^K4w426
zpb*SQM>8^TmQ6Hi0WE_d08CPfVj#?OhB}BKZYNshfOQofgotF*!U$kG;iN|dMMFgt
zb~8hglm`aNM6Pverl5u$+Gw)~fg&V3(+~rO!-0x{g(`*GsP4KLh%luDFmS4gNX)|p
zNf3HtuAO60bhgEWHHa*grrlw1w&~ezu`hh3JJQiO(q9hD+Ljhl$)#GdtXZZ@A}p%X
zWr(Vhj<(sXc0$?iW?X0-Y|^Z;u}|PxZatZf%^`L}%Ps-1wmXeCsJvr(PD^p6ipZf*
zkwV2v{-^7314aT99C1umVi<)`#KAC3HwOn4C{V39aoR1G+B17x9wjTLOxmqk4M~+4
zUV+=PrbUd5EsbQ>YX_R_{jVpPI(SwsF8~a4({D|-tO?9|wV6yxS$KZ*N=%c*`21Bb
zLrlazWAXSQ@WcmT97DKG6bqg|WsQ%$4`81W{UQ28<V;LW`+seQC2T4lrBAo*Z|TP=
zFhH4!F>N!UIFpmlK09Y_`{~kjweIHs3`1)ZY*qm)E7a7e*+sNk$~9?P$hC>AscRuN
zlC7f62CQ1eHKnaVn>MYXt7wgzP^}h5d=2`?;LW~9&Tq@HHmJpTM=4yUlM_nQisW%z
zaGbcg4ht%@!f55ia5->SCZ(yVlMR~7R-ybvIwDiv+~(+p<J>dITLckJXz7YCa&?Q`
zizWAq^|lw|U6J8e)l<E#aKQrjJUj!z@P8l2@!rDD0b}^KS^R&r#Dn=LCiWi&Y&S-4
znvEv0Voek=0T2XZiH<HNC$4|6D<V3oaaARK07=kx2_i@YAQlh9;r8(y%>3`;&)YAj
z-ThH`V8d4U`=wo12{pA>KvXJB1>kCEbq?e8A=HkQ?5BM62ZeW)-$Cb33Xty=IDq7i
zNsxZ<>i7nr2B>N(YpNQ6YC5T?hNhtE4xz50s%ygz@7%(Bf47{aDN0mnq@^Wu7cqMw
z?X(`pW5ras77*BdYZ;qt;#rmT$Zj-q7TL(=$Q@111=l(CxZO&OOJ7==MpD@ks~R-Y
z7>pU&nUNdQ2*QM3v-Q4r6-YrgY?7fYwQZ=T!`Fy)GDx;$(+ag253;8(9%FMX94yKS
ztti$KTEtb8wtpb+TMT5#WXw@Fq2tQ)^Od=H`1tSL76lYhL$tJe&hmNZXD28GegYPI
zTk1!N=Zg9C$fvp$Dq`57&7}#3k=(?EgMu)jaS{?B!|aU$24!vqT`&|(K47@8{H^x3
zHk*ED-`!?Dgb%*jGfKsljbu{^F)YT&W}{N7EPz@cRcnzV)}t63{7><e#lo%&{j3~I
zW3h6z?)<NS&(SjZzGRSeBe;O>=~-7H4KD#KfmF%;pr+GqrWTN6zn0r_huBfCr|J2o
zn*VWh1EkY4Y^c<0@*0FZfjoix0Q&&R3()0%uG7?7RE0=YRYmo+m6%O~F@gC+FGBP$
zzWKHg&_a34OUfwg6UsIY4(yWqkiLBCIVv*?+#!)dAJVKVq1}=ciNJUV0HN8T3B;Xz
z4}t9O&cW<-9&bws*F^v1m49o6#rJ!}+Q!yOpU5o<esxchO<FI_g#K|yWu-?Nk!504
zn1~>2L6PwWr*aVro@#~<RW7qvUVl$bwQC7jX=J<|Qn;{Nly4<IiCbWNa<u%K`hLso
z>__!UQ5LnWRa+BAwlTg(mQl*ro=Bce2x8Jh9MDqJ5f$8CRXdgAA8qu{#QL4ftvaFK
zF8M_MH2aaZ*ChMbzBTlHr;ANvFCV97*4WOHuAM(nA4N}nIIy!C)uyW(7-eB)m8qmz
z1lBCIw9%x~D${06#XfXnQS$rK)+|nK_%kg^;sj0(C}Jn5<)C;6xvRQza&oY1Lb~aP
z;0wY^&}&N*EXy`Vs=wbahAT2ANq8ajmHSUQx7YKU#x@3GhD|KK%V9f=D*C*S_d!1e
zRaHq<RaI40RaIXO{Kfg1iR2xTUEy?lem|B}p>}6-^wL7tQ+2X5k2@MhRAzbH4Y_%P
z<`BTz6JLE{LZtfw!W1D#KInZ<WGx=?l%?P(8KtLpN7h-*#W4xN!h^(cp!j{y*tXkk
z{t13>!@&LT;8X#q0)-KXq5+8VRFyYjGc%YP1TKUv5xfa#0p%-eEYs6{6!ld(=&3&5
zBi|N=W^Jl-3zenImCR{#4rtts%&{YDBt)}GW`%{LDT!GvDw5J-ES5%PR;*fT%NrYN
z#>&9VrG9GMSv-<>qs1Q=i{9zxcZ%!7oX23`21*C`4o&gf_b7b+Yw~@9=*dI?e9m7K
zB&7f?WGKT28~DZ;cOdzlsdbL43|PLh*3@Rm+n>Mj)aId0T50Jk^CjKh*ULPK^kqKD
z{7Py~@8r*#zUvR^6uztN5Pozo$|dVnJ{3pfQSgJ}3islCLa*gZ_SIj6AGJsHh5A$X
z)cxuE=lj?Ez7M{>=gOt|6@~nNlG73R>M3zLM@e6k>jQqJ#AIZ1&3>_?Td>w`sjG=|
z6Q>66PNy#PZWHu&&8E`2s{bOV3hY}$wfEL*bTL}I!7BT)Qmbf+HriPFzUR}Qj#K`n
zk&4K};}+c!?8bW?t+9F%tXr%y!p_;lL)pvoKQHswj-QvENb6TR!94}%MCpYp>r>dD
zoduw!334kQf&mw*o`NapDQYL83FxPygXkxq51>5|Jrwj`LG<7ohT!kHv9`mundfkp
zS6snxT%{Kjl-xH{4cA?08=t+ht{-v$$N~OpoWij$GtCUZv@;6^?rw?9G&#O%pX90D
z2Vq|`$ny~q{F!|!eehHSKHq+x%Kuq{M1L_T+i79$hGU<c*BK!KDWOyJ#Ark$NWg|H
zi&hI^L=Iq;M2JR1DM4OKi6BN0Nt0q2vqcgOl>vzuGE9I2khTzL22so<sF-APGYqaE
zI9Ni7NC?6pzB7(W!r8sO4s6qWdyY3?f(Ufgp@2H6L@}e7AL7BhBtq{odq6#5I>1zk
z;o;#&hk@Q5?|JHcKh?Yg4AkF3tsVty)J?Ly8R}M^o5JPvHR<<(<5%_<;8pPchwOaQ
z3sHP&e3XR4Gy;qf<(Os}_3Cw*Q<9}2NKH*8Gb&Q4{%_hjsC0!gL#QmbHGIZ+0ALV5
zTVJtL6%>Di>xcFDKuA)^!}qO>9iIoDJHQGfhLtf#Dj_1ER+M@WBlpX&7!d<#ZVr<m
ze<XKHumI!}U^Sn=1f`)%bPOV=i3rEoaHUW^_X}v-S&hX_Bu&A3HmyyPko6t$URa3U
za50&f*-xChqmK2;;-_?-Nq-Y|8HEu_J<jFn&PzPkS2R(~dS?0l>>m@U$)ytI8_<Ly
z2#AP`%heMw?-SYV_D*af4=*r;QMlTZ%-EezA76?%BZF9SOB*>J!=E$Od%j&!`yRpG
zA=L3yBXd{So&oj>ATy8AQ_Erb2Q$1*^`Q>PcEX$IeD0JzKDmOsuw(K`J=&$Ex-^7>
z5*9+7Cr<_u#~&Qbu{HvvA6Zov8JiD?c!nx8|26M(0?|1Xa-5umAW6yR-Mj6(e3;F>
z@)?oZq40WHl~?fAm`PzkUvHa+v-Huoe`A@Ij}{WeIRe^2gODizkyOQ62^hkeBdoqb
zYY>y1XiZu9rb4H3A>Vw=erMNHr7n~`)cp0M3NVB)2WAG@*bwp%zu2T%r{Va}A-lVx
zsmaKP)6x(<3ZJa`pwu9N1d5Cx5&%t=NcI%St4y5NW*Zz$G^D~7Qv(1Gr_%_tdNit(
zNLs0w5pWKQnV|oqATk1wkWP_2;PV;Kl5|JEzrUitl@zJyfIjq4N88-M9#rfA3VI9Z
zUWM<V+<6+JX3`XmDd*`}SLgxgeTw~8=ASYBG?Ww<-F3$0K>=|EWEGHRiJO>QIi>gB
z8Q?Ak2;iBfW1dDPCNpq3g!!SB4Kqt}38u#kHB{<(cl6k)WgRx(@8uJIH@9iNX98eD
zO?9WPTKrw<X8HLM`GNUAXjF)RL2?4Nbu*S^EIAv3ZOb;|HcMneN7B$0j7K4Iq@5U(
zm1^kFo0W3t%L2t)5o-{}060J@8B|hAmXjo#Flk{LGSQ0D4H;CMByA=v%7aZ#XEU!)
z7sKZ-DSb8vkrsJW^DAX!wu^L-N(Df{Q-$lGU>ES_aizEb=BfG>EjWP<;kq>w7w%wm
z$C9MV^Jzj&)3*fjn%iAPNv~(~MG#5P$d_1!)s1LZy%fe-eJ}vfy22bE*!DxTH@@z|
z#O7@NU{)0=wp82IE;S8KM<c_UiuVF5!1WxFNuV2<Ds$7481iv(d><F|zG1*RSz*Jc
zaI~R|QdCrUo^f4N4rCOXPuU8Ap+LC|1iZ7WX^Bb{iAhZ@B_|Y1Ie_y?kmSw|!h7z)
zoU5XEba+1<)~>Y^J`~Pqj9M|b88F;rHgimqWgOMUT+uY$nib6HXq#!J4P-&L*p5{3
z`gFY+IQiB0_XB&E_$$Ua(7W)h10*a?O(Fc^)#%iY%Tz6^_<Fb#rctPwl@RPRDu`(T
zNNoXRL@KV*l<gN1Wp2)K8CkLxWT_G~ie$jX+2jC}G{g;(4%<AFcAj?R$!(n=>N=e-
zD0e%vsjDd78$n@&ZMn8hslgbHNwQ?snub(0n4zshQyjFm%V<x&m{!5Cv4PP|iJK<d
zQqnTTh?$8nnp;+t>2BT}of#`w?6iL~v>jYkGYXkx24qu{C}R<8A#z$uR(v9@ky}W%
z6yG1XoN9b|>m4#*j#a}uGOd@%CD61leupbY?Aw*kkfo-D^GNt4T^iaimaCHwI-Idj
z##Q*}eTg4MIK}x<_QUQUl>EQGq5jI9^*tCb&F{o}u^Y1(%svouLzf;lG!_)L4<xB7
z<ypsxz~6pl<>pov1&*(K%ZCRJ96pG?<LLwIKj=sFN91y`KZJt|N>C~=?G^{+0|uzb
z46xpJXj;UzopU*frdn=uG+~A$eiYe^rK=N+#YYQh-F!4zl4h!Bc+I+HYSHp8GwW+@
zB3eT`+hoK>Nb1byELgEsYe^-(9k#+h6LLkl&x7dse7Gr6UKLsS%u4M^SYC-+nvX_H
zu(D4qYA<C@R7IoCLFLC+7>mu6pE2R$$>=g96HVG$YZ~^ZX!m%7Y92P(OJ!a&*+0#<
z6DW@n)B|8snyO>#tkyoFB0Ui98x?v5fVqXWTPmN(OX&FOe2JiO0P%=M3|Qi)-9=@{
z=%ycPu2ez*inLI)go^VFVT^)8G7B8Eg{3S81d9?iT!O2j$!$|2?9^Qf#JMQbn;Qo?
z&9lL6Eh5y~H7y$3ZEG6aItSu*6<t#4aaDql)L2Ilh(RJ9%Y>*)BVk~LW=Hou1BD_A
zbX|Ra5Ay_8&}m21D*UsacvR2N_IB!9Xj=R~L-$`RuUg@pPwugqQu;5<eKh>*?fxs1
z`2@Zc3LlTXrqxRoJKB)Gzy?UbpSe($C>h_1vHDIA=+!Y;TF!v8*1x%{B5n3!oVPJ;
zM<(W)X=9D^g;k}4@Nsvo3S|5)G_=O|667$Cbg#)C5<H^3^DHwK9zc7OcaJyL^tSeX
zBQ031D9JH4A1@tiRV4Y1o7>)p^~GhvQXGkPPRzlJGK|4yDQj&NtQV)MF4EDpX02)R
zGsa=+$Kc=E)u9m)Vw9Dv)=Y}BWV?m=itL5mCEZK2*ZeQnhGnU|q)tM*YE28IJ^L|X
zpEfzRK(@)5qH5KZHYR4$Qwp)z!oBg7xBWlOvV)(sV^X9r>zA_>qx0{b<9FA%-cKch
z(Pfsbn6+tUNs`2|EHO!CmNkt=RhqW7ys_%<e{MFfBuRNA&oj^Bu+Cz|imI)f)99|c
zvn5O0O8P`Ze(@AQ!0I8^RFDu5Cut0-UQvFrdv9j9*?vEvD!)*_BE7Ko*R?*YN`9C0
z{;~WY&LR5?&_8M)a(@y2Jd{-e_!IFcYuDi~f*#<0g0Fff?o{L=oR#DW$W-JfAV-p%
zkmRN)VxArS?%llO*=Ni7c9SwG{nZ75KK!i{4(!>_h10E_LE^$j)Y>hJLs~MMQ&+}K
zXw|&y?u=UuQF5d71Ln#z1ln#>0_ZQeoz;gDzwxQkB%HcscU4XCd`)6Zh}tG;Fs4kl
zMT;#Iwyj=^ZV{_3rK?iaiF0d{jLnYsVo%2FHvE2A%;Q)eYAb!*MUT1mpD-7pcwB8X
zj#hg9sE^l-9?H5<)>V!T%-g^>yPigU?W9{#Nmg3OnwF_gMdLkD=C!grzddC1JNq&v
zjv!a`B$YO*{$U`XAOQQ6*kqr7TUPUF=(Vh!={&;yH9jU!b&fe{oMPE6lG;Zgtk@Bs
z!(=x^GZg;?Tg?!|5Z2HG3Mb&haT|v?ZfaqHiT8rE)eB1CS!LK-Q~*Db3L107hQ&i>
z$s?Cac6}0Bj}Yr9yf+}}Q0P~s=0GjF@uwk&r#J&fe!saGgjw1jl@R@g5vg;P`#u-_
zi$)jc!Q!Lzefw5%!{|N*2uZG{pNjNSn*-`LzfrXNZn?E>62P%6Y#S_qQpU@lQ&7|t
ztAhPh`m1XFK>Dxee>;VRwd|zC`0GBp=QUrjDjmu$t}7?n1Z@ry-CL`Wau-@&q<Y7V
z9;4LRe&=&{^nZ?Fk+^OUO`JqV{E_5@r{U`b;PJk7xpV9r>TI@Igjo`%%|40#pjJ(l
zg>6e_!B@&GQBpWm`F?5h;xbzmsb-CvS+%u=m7N_xuOz(>b>}XS-aZCX?XYYXQEG~y
zITwK-OrM{SR2gNFl~1rVWZc(=nog(&Fsb~Or327b$PoAp49W>6B>weDIR*LOFc}`w
ziYU^5Zz1G|YWJN9(4Kkjpl0JcZcoWo{`eY9N0ILXnjmqm0J9BX6mb(ZJiyV@9Wp}G
zBrOHpM|BOr_krn_HdmeH^OuuKT#;l_Qgsu^VeBhGK|$n+xiD+5af^dPHb`(1MrHD)
zytJ4P!9fSOT!aUZZih59n)uHLGXmQfDW;Z^k^*Qmq6+ED{8c~lihF?<ilNOy@hM)k
zsobQyf;-VyVwY+q-w5z1dWt=$K6*#bQTjphqx8q=AHMJH+bg}AFFCsjkkz{~Y}Yd+
zEE&8$&?ChUPQfH3R?{t%rdRWtADH3+q7czR1ND*!AYuX_DMq|+6R@3$vnbk{bo|2R
zL@ov7<m2r1$82y=;orW>fqp%EcB{~{V=EX|D>3!lZ02L#EX`J;;{%#gm6V!ls>@2b
zsIFRDDCMYgE1E7%6EZZct6G*-nOS9wWUMNfS{5dj)@;#bwn%$tJ=?^0d{~ZV)Ob8@
zy2posDy~J_Otg?lLzqJ_2^(m^flHL5i5YQ*ViAJCBEW>gIJS;lxh-W|DB3$k#D1n5
zrfUM5OE!x(v3uJf;>9pwOMhaMpZvnp{rUY)bS`MJ+D%=mcXgq%ZskheU%HUXZSbsA
z<&t+Sg*k>sVyrAOVPhsTq4-paeAlO^r!VDGsXTEZlEAYhVTg^S>unwwLPcal6oMpE
zF3*HvTCs>|;i?{sDRFGH<9R<6ekAXA(cgF=>Ivd^_fpVMeu;Sr*$*1-oe9vMdD_d0
zIU;)yu~NlMl`smze}BC9_aGmrfEq8hGea|oxFNtzOm%lS6#@#UF$g;_!<oDul(d)B
zd-|IA7n^$g+)wDTm!>))o6RaJB8OS#Y>GHEg!hi^d<44MbU-Y)hMQzne7h;Ir+Ww#
z6;v#csktmNI)mX3A@9y?(E-yPA)z#L*w0_y_(#B*Xrb(OHVe^<(Y=*{dRq0kxa)a&
z^3z8Tp#2&8l6oax>JM5`?U3gcdeS{<C#W8^2dXEmlhqaKLtz)lS9Bf3K7f4y`ZzbY
zy-`EKK?lfD(9opov>;Z2y)7ih`|cYC&bohXwwBr!JR2<El|!LfiO-rFQm6MSccDTw
z8-*#LcWR~OrRC<FEW-@2C%E`0(hh?t5gZ3HgCNMroSdA$Pig{&K`~^4MYv5iSrgh;
zi+B1v)!wf!cc1E>()npq`o*lxWc$@T6Z9gSzdI?cLjb6MMpY8p5we1H<ASN*O7`}B
zgybde7g`_rQ~KR1bGd6$WiObzM@Zb4^Z3?>Dy9874vW7Q;8m!4Ri|xes!Pe_(w1R{
z2S^D(0SI#mjvYApcBSt<rFB!u6zuj(uI;_J?7vk{!x8S=pT#dpUXZ3)M9N`HNs%l`
zl^V1SD<aZhs|lv71vF_|Gz|vYX=x)CTA4|r%GEJbWTsY4WQDbeMhTJ=W-L))SWz<*
zTVl-u+Ss<SG%I}XfwwnS($su^cW<jHiZcwxU}a3QV)1zP?CCmDcXTV`5{uwh#4BIc
zt+Kk!4A8b##_l<0mT5?C3mYBg-orR|khVk`CfiK5MS?r#ZX1^yNyHp!wz%OY4h)vK
zHwP9t<}NTXv88h6)yr;9TExxoDoOVX=E;m>>6zEAy?xDRxSo00$;s!PoSd7=XUOs}
zLgYSwFVFW%^*!oP_E`$NUiRB=V!5v!(m82uE@mP{Fb~1_?74-%k7#6RCiMNI+&!?u
zszxe)E<cvOuuW9A_^DLTj|pdY<6(@+KuX0Kof!`Xkj4KmR-vKCTQ}oES$wmu9D$AJ
z4MzbWW)oA$Go$>9&y^sk2z&)k*n{_~UxgP;O)0UOMbkNNG?!?(g_5odBK);H&d~ZI
z6WtGTDPZY56(Qfw5c$6-UPz%Tr%^N8_|WE|qtOT)zL1SI314iZ{tr(LvzxgNH*o(@
z(Tn05J{3E%45VGKt5Z_5BO@!)oE=i;hlga&%!_4nvbj-tyyHxaNA)b6%#UxUSk0*E
zw4JEs-7iSO6Inwd6t8gjLyh7@DrE~k)unKR5&rBzDhYaN`R0DdjZGF`lP(bE3EO8E
zrkXg0s9v=*Wu<W&JxekfoQ#(8<YaxOMVX;%Di;(^Ku3W{2XRntMF<E(o@2(EOd^K$
zOB1qaY?l{H9ed%TxC!cgNl2P>R_LSY<q^PP4#c!ROc^}GnLAaWdzIWhIOxZtTw<#g
z?gRm$A_)3IK9YF~qe0hjFXEe(PB%=-rm~6Bj!}k=nuD>j?>-t%-W+%j01T==Ryklt
zDdd{*cg<S13qhCy8u+$EA|6nn!R9<QQ3=S0$JO0Ozpdmq0!d!ZarLvo3_#b3a&icK
zmGPuA0YLWfm33bpY$b(cC^z2qgTDo7;h&;`69V@<0T9p}97fe0^TRnXCuH+FA-F-L
z^>1FQ7Bu)F<_f+dgjO*F-yfR*^x}k&GO)1mF{-A(bGprB>buO1iky~YA6!aoL(h|i
z@O$@rya7X)l>bpP5J1r&x`;}oJEY&<kEzvU4Ju(DWh1e=(ZWeU0qF~fR0PDNJwwqp
zLoTeRcbtNG)cTD|!G!9HJIl@g&5;Msf|x=dKVF*xK5=6r8GVkss(K8n<WtBIaBBl-
zsn<oz5Hdp;v&)5j5aduEjRg^WPcZN@;Fv0kJ?PXxZB4Ka$qBK?ivfIq?1M^s%(+N<
zLiZ|yhfwG+V$XP>9c-cx4AVu@xS`jF#xjGDItaKS3C>1RDcXj}G=sMcYauZMqWiT#
z%c3C)DM&|UFDyi%I)%xxbuCcn(E^YmgbV0Q2Ed3TYY4-T?5kG9=<3jQVsCYITOCYE
zx~!dDZIx_}r&(w=bu}z?tEsc8fpH`loM;k_q*r!CrkXap3@B_Oj!+~Gz-b;FN_b)7
zTCF0HIB;rc!~;Z$k;s9HkwOUu%VUDhr77Aj&gosn#9se$xE<0IDJq(hf2<+&@AWVV
z_*B{_&g79}g8NhL#=sEL6sJf`eg?b(ev+t$#UFR9_81lLB6twJ0Tm8w=V{X(e45=K
z$Wf}Fv65kn43DzElKTE%H{s}F1N1}pzY5=<#^0S3G+>3OPd#6Xr41N`O_n$z^b_bm
zV18hoQpf5gLpKq6d!yTs>j-A$b8~GC4HPsqau=g*(R4~B3Mc0<9{0UR&YyMlYggK9
z49#K7dXHa^rnRfh_&A`j3pPW&3oNoylVM>1^$vm1IJPMWSOgDv0cjz(s!488we58`
z(bn0?=V>V>deF$AhbqvZOe`t__NA>0i@`8}dm(xmU3K^BfK-J@RaH$U2FN^ndu1s~
zQv4>Ex=<F{WHuEvCE>MMC23w{V(ccy$-f)M<U8xHEucYSA9o4h@P9w)B!pl>3?RT@
za~j(0ol)Ye-k^izso*MHmRMIc*#<$lIAn1exFseilMPg~vms{z=sYq8+xS&a8bQel
zqy&(aT6aFb0YjJ&5hx7|$J~VjUx*E7wzZfbd)!M2B#AxIuQ5hrt;L~crd0HONM;IN
z@j0J)f0q7rO*GP!vsC=TKYSoDlkBNWM%s$ffc{lVATugQ21*kmzeHIg=)Hpg+sh-m
z(Y;o)d>;CP$T)_h>~XaonZ#Lwh3J0(AyNwzSg0CM-TBG|LgF7WMcTHHuK7-HM<O~L
z)y_HG=QlSVoeDgdU2^N9I8U5@;doQNya(5MFE5E<!-uI;_P<AlXkmGA5vUTB(j-tJ
zK%52`%*6~zWK$Z|D_9lt@8Rv_<VA(oR8-cxQ;jZMoMUKZgvJ&!N7-+s^0=v~ILO{v
zOLeU*iDa6lhS#Iuy<bO_c(>#L!ayHh-$;HC{CNGGo=eolRaI40YwhQEpz&?!z^ei$
zMM~6f3$6@+xiD-xbbZgS;;G*80^-urM2R23bvTETy@XEm0P4;i;H1hn8lDHT-&Cb3
zN>Z0z%+WMG;p|k0#5)ITt~(ui+StRDRZ3Enr726C-1j)5c_LPQJ>F+ltzEgSN>IOr
zL1}d(@n&K%jEKf6W(((}EKZB^`aTUIp(!b)q@>qnOe~q%tqI1V_MPjsMO8{t<4TH8
zJo}s4=##-HF8?8I7US7^r@c~95fR=!lyYW3_>SHI+lsq2MLd(LXhqKwMlp<~TSl8U
zk|_Z~Nw(Qb6%f#YFsdVVsv&~~i~$KI+hxep5dStJFBn+1wV2m@*x5B{BW_%Gz>Z81
z+%S-F3qP{pb^;hc2S_5)A~H_fWfVvO7!ZJQqVgHMEwi&tHQt@sncCYOl2{tHtSYx#
zIOMM7QwpX@Nwu}H66a*9eM1S#?&Fp)wKyNbJVMMVr-E=pqj!+fCU^$Jh-5HBnxu0n
ztA(dn3nFCST1Yb*LnV-1Ga=DO4z!#E=t?UzJc$UWSQN8j+8M(-4yo5%G^y9|#~VAU
z@05jN)2w$57<Jgj0vi&smI=HRWCN=lk6ENAH4ZcZETB!aXwKf|^T(}L@QsjqK-;+F
z!iKywruDS83U+Wz#5NeZ=7$QpH03Y}#tD@-CW~tp(VHs<w3-+*xD<8~iewaJa^6nq
z#g?s(p>z~K)O2R{g~SOK8A2&(xF%4wVx&|&u(MR8WgP^7Q+5q%sEM6<W?Q{;v9&6;
z<8+fvEs2K&fd<+EFpInZ1xeGiOpgI{@srRF;v^na8lw2YQh`9LRjk(LWyb}Fsn?Rx
z2TU?3NCejb4;lrIs8w)l>IxcOisLw`un3?MDvt!8+5)Xn4UqH`k<Xtl;GU-81;k)-
z|8aPeu!v*agW#7dA?tXzp+kaDbtx#Ms(^^1ZyD#OTC58L$H(4!?Y9ds77(?yC@3f}
zs&@&_CZKwfda2G8tv&!-m8{y8fWpD6YSpr>vq@y}b|Ru7J}%{1xi}$!nGV6QU=LOX
z^-e?rfea;na7tw#x%z7)fMk#dTeL7yc_t}c>5UBo@ku4%j{*bxD53!XyUec(6jW3B
zGaynlXP$er@5nirT0Ux*Nkc&x9AH)>#wU@q(<*%=r0_E^>V_y`+!%K|A+YQ-lO5!V
z5<Hbr-t;VEGr@Sxp*;$OdaL5dus;45>I|VBh@_%?&Vpy$O8lV+Z_jsK%GxQU+Odq7
zv|6^BmuBM{YSu$yrS~MSH%COUX{umC0V5L!OF%!`@bdIX8j0ZGA#8M|F-9t}z<Ofb
zcnB$WWTCLC%_5q_R<#Pe)9Qoo6)qq~3XwVG-8tHKrb*G=3df?)pltIGHy6ZrRN$#I
z0R$630RqG_Bj3>K8Kr5d21=Hu5h&qAFu|r6QiNDTKp2&X4JQjHONFMbEo9+42*T1?
zH=+$BMuC+ujYbm?p+quJxaEnM(jj13NEZEc1{V9BVZ@q6iAiN>#ZYV-fwDVzmiS>z
z(GZk03pEb`@EpBWnk(%vn5zCjrvXm5YQsnrr4Tvu>*E3$gJ3=!A?`Pm$k|d9A)XW3
zg@|coIH>N5Aeka$<?I>;tk4SZ!ee0e9@F4xhKOl(+?_#Cfd@&3hBCE{S!&B;Ml#Da
zWY$_~iWxC$9=+?;nOhpsHKRET-?o{9Y9b<JPQWX=9>GM@4s@b$E3_752pKxU&#r~A
zzFR>=vQw-gHQ2x~`$&yopAs|IGE^cKAuTD$4*`foDLzfnc#j0)5eSB9DKm?>j}g$|
zVbXAq8^CyO5<t+VhMJn2yt?a6G42_gh8SUK$2rL)s+qZ;15IyU*vFytMp=Gf2UDrk
zxkmt{RYJ8%o6%T<Gb0R=`elL3Jbdb&nIzA}eKBeA@e)pNAT$8c3lI-46nt02@&5Hi
zF$|dHOe4Xetqd;<BGs#qG*79B#v4hfd0A5xn+c>mu~rytOEpg>46&+OUQv|Vt4V1`
zkCkS{G3AqDnl&Ru;X}by;8p%)Uz%UEU$$S=zp8$(Y9%icr;1APhm0OEu{CK=5N#{Q
z4Hl)XSBxyPR!<Quu)IcwSB$K(){hx1Rx>NbSgi4q)|ZK`UMle~ykChi_?0hz)>F<`
zu9fR#Xssp@>YlSBNoq?G>rY#9I6ZbtD{!2JYFDjTV#F|`*0oZ?y<;kBH6FGmsx*3;
zS|+bk8KT1~^_gDBvy9igs(s@BSykg!v_<bcY8q8?qRA`8Wg4tHNaR%a(7~{)LZ15~
zu)%DFq7Qg%QHn2oV3?R~1*Ie3CT#;kz39Z5RyIQAN$8rDWv4{B6U5S5H$tuw@miBr
ztDsyJ;<AjR8&qnZ{8J+vBxo;qV`*APy=<mb_pOx3eATeX_-$#=XDxdtzNPGi>_T|e
z?4vNrYihC!*h<M(rD`-(_pvrMiG^mdGe~K&F)?OS(u~qWNnm^>7*xu&Rt;rj<-r!L
zr?I7NX0a?J#E>jj!NFW9G?_h=T1jE5Se3Zi4|r&7m1eEAGg?ffZNr!{Z8rCrkYv#r
z2m^s^EEd~kl(K6yl)~F#?=xweBD9vW+FDGc#L-^LF)LeEm@!jJRI3Qcz6mgf7+RVx
z708)dr?MtW)|xRaNNS7^gfOOLjT2RfM)!@TYR3)CG+6huEe=)0ta}bZ<y@(o*;b<~
zPlHl0YWbQBA2TVI*;)R+|MC5wN>AyeQorN5_5RJAr0TzYE9`kMm)a<<yE2PQ6>UaZ
z8Cn`!WY&ohx7*-st)CyG-2d5~ovK-hm?@%$*l&L`{txzc)lL-(b+5r&JgNEx`@J8t
zoN+BVYgNf!wLMvkV;C+&(Gs8CaYJNR;6_9;MZX9>^R2%vz1^E_7_L%Ose~{DKMrvm
zJBNtOhtuct{K^PCYlL}H$oL;E#Fx1J1m(v1OV8(5pTV?k_Y=)6=KKE4dak3z89i!u
z>QztG`zM8NL#Z|Nm-{JPDeAvVO(X7+{@8p_hxXy{MPVPG*r9p8YHqcri}UmKy+iZt
zq#M|6o7UPji!Bt$V=QE+*WNs1x4Jfsw(YmW%a<=56$njLQ-sx^`Dbmf-Jt!?+<nE@
zL}9|Fe3__R)TJ<t#{j@>KJ3c1N8oOxc4UAYl{p77b*)Wm%|=(`a(O>0=2ZT7#7$EM
zWMeR~4X(Wx7+g|s9T)PSSKM7MWUu+u$bFxw!FW;GVlpwaX7xp1or`xQ_~m?5d^GrD
z;jXeiVdf8-A9$a5`@`=Gt}eN>w74lm^%Xwq!m*_*3h*CWh=wL87@_y4-amgI&&5F-
z_Hp$r+l%01nTP2Eqi!WBD3qnP-HR#Y#``ZFym-v)`dd$JPpg#Tk<A$c7GK_tQ_WNP
zdl2vs^JE8)44`&C9>1>JZtb@1{<9TP_&;u&m0gZyPQB(Uj%Fc_W)ElKw$%9tka*ES
z;CJ`dA7E8!U4CT8nK}|-ovFMp3h1D`zWfldObak?FfLM;0HiRbp)d>|HymFws;Y)j
zEReknugZDQpOC3NdD!YO!^%DjBO@~y{|2o^h94Fu%eiymJH#>WGZ?H=RD;Fh&ZeQL
za@Js&CYq#8rMK~PZ>ol)f!t4ef{%m^UgZ?}Dqvb*+U@Jnd@#!+mi`~yJ=A&?=0|^u
zSr1L@wVK=I<SC=op+=spX{?h9_h-7T520vZL8W~LhEwt1neKhRul4}$j{AwYZo7fI
zx|@N!xNmZU*qx;9CPq^1uEtEGwNA!Wt7@+?jWwgqGPM_)%Qlx_%&7L5WM152uWB)o
zdsx8TQ*k}%z<6*0;ExUha1IN=4i5!50m0xLAmDH@5Ij-I0LX=e6C_h8Ld=t4>oTzQ
z*jUPAddn-qv5Datu)GUPN4aAQOr8x4wPf(L*2UqbZ7arcf(|@RCP9#6edYh$a8!5-
zJOoY<sz9o6ST0!!3S29}OTpl998(a-+>h05X0ahOl0JZbO#@h_3Wk2EB&l@@g#kZs
zL)pN=$t2b*Y9^w#TCrO}^CbM8h8wKV)+TIF%`meFG?tI2idQnV45h0@S`4XZSs8Br
za!zoi+0ZydAL^A_s70Fqkf0ic1uHTEG{HjwNI-=mn~E(&V5BCYq{^*KRh48|w6TSz
zmel9dFKyEN&eh(QS1U}i{g}T`L-m?+j@cYXYMC7k<9)Ytg1WIS3qw&uHXItfh!9PQ
zEFsa5bS8mFCPO=p62i05Wy~VAP=w{tsb&dwT*<QAbSlUY&I)f8%KAL#2_UH*i|fjm
z*CI5A=@b${p3{+&Wh1cgb?Jes$gnYu%novks-5p1oC^Rj;t9*9la#}YX^@Z6-Cu$^
zN!5jaOvQEQ26efGsXDg1R2Fe{M?NwAj(kGK@yT{4eV8s3cS+E<*>op-x{VhN&eu&Y
z2NZQ*E`RNess9+kWMNxnZ7gMK+Nj#ZShH5iDWgJImLo$-G@C7!u|-Jz{vJhD<;trS
z`O!6X57;7C1Kc1x4|lWbcMZ!rr^x=G!{VtA@Tm<*eHY<9a``9ek9Lkr`Ks}s;xGS;
Nxgwk>NCr`;(g31i;nDyA

literal 27612
zcmV)9K*hg8T4*^jL0KkKSzvNV*8;Kh|A19hRaI60|M0)>|Np=L|NdaJ-O%RJnz!4#
zT6Y}+hjX|M&8Yg`W7lHYXja{6$7w0sTaHlEv6r?$71oTREYDQcDniwUxipt;)iQR>
zO&Pnc(bbu=dv{<s8n~gRhgiF9sb6^dHQBv^pg8yd^4Yb7@TTS}zP)s!ZS>-bb_cHG
z1p?aM_k+&beE?_@P^A>LK0bHdwcTxf=J#i}z2|*y_Yb$<ci%g1-#OlQ9QVC^_UY2y
zUn||5^d9$Y?al6L04v+pZ7v71*O=N?Uit3#wkT__y}kF3U7Ga!?(5N&_cxA}_kd^x
zNnVw&S2J&I3tfG6;dK)3JU#B*+uYKMtAw@Jc=rzW_Pdxj*WSy_%Y6*q_gvOJa*g(K
zuJ*KRvo0HluX?L}dwJh{40m_Ed)^)QkEh=sLwBX_+TxwD>nM!wIyJL28MOxP&TW=y
zx6hvU)O>9~_V<0Xd^+`g?RUT(0(7;VlUX@^@$a#S^{%uD00^C{cgG>=rkmS)&B||W
z=np&sO<P_$t7~_APkZa@bLr#Dp6|Y4pH$Y`0=1^14UJAa?{RwfH$C@`m#z1APVP=R
z$J%L(UhqXk001Bnks4?OYBXV`Ge@dz4N-~cfEoh`kc2@9K!H&8F{C`82dE7LO*W%X
zQ$PS{&=NHg6o99s(LA8@QUCx4r~m^%01XC!AxMybnFdJ6O+6{6lPQHgO+7Ua)YRHN
zDWlZeQ%xWMXcJVDOh$w<PbEJ|p`#({N2uBgPid-br>ClEkbbCW&<Ci~$^|JA1QQ_{
zGz7_}L`>19gwV()o(c^#3=n8OuMiOP1XfT`e{=N@{T$EVnW!{TNY(`-WHJUxA@?^v
z<{aO<{qOg79J31qt0M%tDt#)Fr$zhV=PAIcygFv0i%WxaZ~H1~!WagB>V|fR(@hJ>
zQ){US6Ohxe14E1_@ra12G^yGuV1ddg4JpKmcR8#sYT~7;UX5tI@VnJqx;n2p(5VP>
zDS4EV;Zg0vrelE>C0v0GON|DDAX2GZ28}z^jD@X%U@xPgsB$+^QW&QMY@T_NLYzk#
ztea%88HVe&2Ga^Sy1u7v%FV5?<vat16|zLgJ44HWIb5D@w`?&rhWZ0SY~^m*I-NjZ
zO;Swpp&KTIaR$km1F0c<((>~}I>9dt>XrvihL@`vS;AwS$1Xc5rKM;QjAt_?fKnRZ
zTeDO`Um!<KnYe+#Hm6w&OzU@f*He~kX0wx(9yY?6awel{Wv!50!kVPrK)E6tCWwL}
z)McpHIynBMKHxuV-1dR}Kd=mZ@Ak%p&iuW2J#SxN+&lKr>18kZ<siMtKvE$PcpNDS
z+CNYX4NRg-78U|FMJoXSJ`fd0Di~80HBl6Vc<(g{v?L}0<|sesL;95>g)Ab{6np>M
zPl6piw?Sc-h;D@6UuJ~j$O_#FQOb=tx@9uj2e(dV1KD9gUjT3|y@L5(A=XSd-en~*
zK@c_C2zQ|>JD2i9{KN-9KU>6kPQ*@JoKVUCYnU#fL#3C1v@Zco$!ex4@{Fj}Bs^6V
zsS5uh9+fTP9H0h7i|r{WH(^0_Z6k4y%U7*+tTDok79?@`oP(9SG-Z(v7Qtg0h-nNd
z-h)#ng|IIOVGN5oz==*gdRUp3(FjH6A$*i@qcMr9LTSU6hFDQ<0}+8@<cK*(=#2qp
zwuNZf1e%3Yq)w4A%+(v}rSZlNKqeMCE<}<<bS{CnX3(Qm5IBU>OuO0}2t<ICrV4>=
zv?R;nq&SA;;Fe+$4kHlM5j2Dnu1i+Xp)TCzZEr7dHbllm$QB)$0c;v$q#&9@c)`Ge
z8!txMK-|!6ru5`OxJ<k%6x3U`=**_gns|mGq2F%5=IA*yxgJgU5UYVc`_;Ua3zUbA
z6=|7BS^)v7MLZ%oW>Dm`yA5jqjTF~n6K@J&lK`Cva2RndMp1o9?@fo!nLAICXkQQg
zy*AG2sGKZ|3`emURGxlKS)47xr@o<S3!u<K4kV5nkUi9ZYHu}iVOwh<h^DVtP~e8~
zSlfaa0s(Uc@+_bjsmy}Hin>wUY5#(Sq#_z614mYcgQkvY>n}Q*hy<oejM$TRmm_F!
ztq7sCB7wWfKuWEag{pA~El3$QEZRB{DPkKdbkn+O*a5hyU=UeB8dSi5oQN7GE0>mG
zJW+E~HdT>2V7I*(wP><1$kNj(XED7H7TR}%AyAc;NhzeDkdTqUWJw7O=m>|zR7ENC
zW&(c%Hu>RP3%e8X975CbiB>7)Sp~xJu{DW#W1I^)4QVu3XmJMd-u89CE=$l*F@lu&
zWI#KJbeS5kysV+{SykheK1_U=En~?(t8KiqYbgF{V_64A9N|}wNvS-V&t_tJN2cyG
zR|vp2Ez)y|whc0+m6YAkErt2}I`;LsK0aH#zTcB)B4doBp1)4-mF?y6;3qlX85s+V
z_er9!;<q55q7;kJE%6IPPsBe3JZ(^>5d^~mi48D4xgpKt!s~Op7*1(=Ct64v<ut_D
zK$j-5x~Oo@NI5t*(@Nhk#=MhO?b^Cnp}Ql(WNq@%$&udXH-BFf>8Y1*6PFb~vr;&Q
zT+=TNcgeCh8my@IXh!3@-LS+3?5ZVI!><t7Xjv?#vNptZlcKe9<~2=XwFra|$~1)Q
zMb&C%fhMlFh7T_wN(w@f6N8p&PJ7OqFsdkks>>=FUC0>fOa$RT)$dg77ZC0n5bWgj
z$r%O(2V&|m170E8+&9gI8=0_&s?~l(uM>sCUttPQl4(h;Aq~{xO@{kkF^Rm?X*@gE
zSxl4c{c4z@_s7d1>=_QLoS<`5iBeHLU$IjV%TNwO?qNJ-4}G{<XWgnaz|1|n)Oys&
zyzxZxcza>Ur6Km<ed%x|Y~Wb*BWRr3iJ+M?5o04?i}7(y`?UBy`s(LL$n`!);^WsY
znbm?m&!3IN_mQTlPkFOZI!(<hRQKVO-l?tT+KtAeQqhWPK9dIqd)!Fyx@(=|8cr(`
zg)<6Ag*2h5q`ZYfibr}Njzu})rDSB9ElW%|ZKG*~kcEUQQcx%@=R=2p=g3vU-6^p#
zG?Ik16*S@+(3T{)i;5CNTXGHs%L4+=QXSk32+kovfoM4t!8nB>a2UXgsYF(oA!H^(
zLz;kgiSEqWJca7z(T#KrsYMb!<pNZ|fR_u}I6`@tj^Jx`amuM4Zl%*9x$BcU#4!q}
zG)~wVg2#ZrEDyRc8)P0Y$5r|nDeyykY&+shGF|*0IY*pjOXOuv1n8b1bu!G2GR;2z
z_T(K8c%%qrnW`UYgtkErUgjL-CcHD|&<@0U>cvfl1s)(Na-_t#C%)~tBW?7{476Me
zkf4Ff0^#+-oCA46Lk67dw{qOxT^I)DacVV?xk}5_jcW8BFt$kU6IC@_&D@A<bYAVc
zy&w%<tQC|R(hyx+I%sg|aIi2t4#fCgxcO<{$$^_~rrKwy&!)th;GfOKd_Y$KHq`2>
z0={L~SYJ>^!}NEzlp2Ymc35P<6k&CmL#A+bp_om|!Z!02a7|Ga5R^j-2KAwq;^oWC
zyS>J9h3hB@#Be!9@`*JKYh|gkH&L*T(4;Vp)Tcu7YnutYYzAm>Hd7|#$_%@Ral@QX
z5X6xbS};Qb0C}JfPQmlXYqz(@TMZaYo!lATIoAgA(Y$YGqoYSmP7ZZ18*$d2NzRhw
z#<4b-S~%7oPbk4X`BPa7=ZGzYRAc}rR3=4S052>CqNIul^Ry>jC!4z}c!&}O!I@nM
z*)GROF38?Sw;xy4!*SyuSJfPG^wm$Izgd1D3t&LrQWvTc1QhxZ$^c!FkIN|eB^Faq
zK=_F=WfqFx(W2x4(f2GjH!y~P7}+Hlm%SEVtgR}Ek+O<_PCBx}8VE**OS5{`@VZ{R
zhh$Kz0zn}rF@jJqaF)SDvC>9`vvFvcRbr?Rr=6QP>$Yr28_=m>R2*QKom4u*3emU#
zGl<N{gF1W+FufZFP&i{YV(#2+f+7Z}4q22?krfn%;W8wpkb<1K^Fbb<pI$i>;t^%;
z%{1wY3`3dIkYrtOU8L&lB+RgZ3}F}n<HaFs5IqKpH4Sfze4wfrWZqz3AW3042%~{3
zxPmktOU3O7B!l9FUT{6t9KAcXs$O~+UHFk^TV))xmBXt;;s9IrH}jTvQ6m7s9@k1Q
zcU2&jFrD|Go_WWore+-5S+4EcO!MJWB{d+Yd>Fy0;e*OU-6wEYRwpuKEpL|~f9X%%
z2>8SF?4<4#5MLtfJX_*ae()E@=@-Nv!O+t|L@Mr^kK<=8K_zPL17+#G!E2S2${B0}
z47S?cZ)h!Ug-B34?IVF<I)O|rHA%Fq>kdtYe-7*g+XGAua{3$<CGMZ$g6Qq(p|Osm
zT)RM52gP@^;!WCC)3iFf8k)O{K`B8YV+hM?i2%KnrqT|bQLRInw>7+lLEY;U4Kk~V
zN=^j^W4g68nByBBP~C|kArpwjl$r>LXgMek#Qba)M^VaQ?t_E<-}<!Y*NtbHta&dl
zJ@#5;aNPb_Ta}5D_<6kdAe|BQf4)tga$r$`YL>rP@yvLHKPh=ia4MPX1n@>raNJ8Z
zO1Bx{ihJZ~_mZbClZ`3|I75(vKpvn2$cQ-wJM-Ww7d_33+OH3>>^enGkdT>E&aFiK
zplu;g;MEDpaF#!{BKi^CA_vPJM8uRHs)AG@xQDc@AZ!kxJ95C2YZT#I4L$~B3n9$}
z#(+n?!>X1`u{J|TA<3yN3Y#sYCakNOwkW!a32`)l@Su~qhh`hWfxYJXuPuinMS+}P
zZre*BLY$&p1tP{;6uO;iNg>Nr<jI)f<~9M*1mroU(=?`C8fF5Gkl!%H%B{fVN)Ct}
zNirsq3qxwq+>#eV#wE37p$XO$Q8e+5<>4eXVX7pFkeOvWnL0H@-(>G_%7r>9SlP%A
zFpLW`9o>P78Zk769PKH)NwWh}GLT6_B{U{n)C0-#oRbz3W$DkD$s3AT7D7O=w0_on
zj+Zr1B!{C^WH5_of%JMet2>nezC+L-Oc(h;`GA+`>}taR<x>(}db?+n1IsIn^496p
z_Gq|kR9%==zlKH(6QM)F^TbZY?2T$Z|6L|VMn)%0p7uPlSDfTE4SZ5l6~8G&I;0b1
z2`}>1pQU{>#&-_JC`hZ}7W5~0_D|HxK@TKZd`4VYdj}Y@R~8f;%*_re+3d_Ch^ZM+
zd>3tztrP?*#Zuwz91{q%PRR6Kn)Yjv)7<KV=bf~n+oGFcRZ<E;;N))iKtILNg^XcT
z>8b=@a8)p{BkcCys>>>Jttlab!J?qj6&0?qFhii3iNqRK38v19EV4VTHZ_4v6Kz=t
z8-~kEgmWHa$k2hsMTQP3B~V0EK{REYw+am?9iSf+h7yJ~A2y}LEeJygQ4g;z+a9Oi
z)?I%O<9yI>RqrdRLQ9*^j~hZnFmV!oyfCfaxNE3UQu!Skd&lzm!t_yF6T1@5Ou2@V
zn{t*CLQ{k6hoTo7%Fs~snGpS=hm4Q9J~Sbv4%i+e)9&jH9k*&0f_Y&lTwXaI0+@50
zV!l|97~@CbAZ}FWBD9pWfzf;*eFvG{tUC)<V<F~K#(eK_)`x<)%BOtRE(8;E;uJ$<
z4HET#!<s-nAQ*1JKRl!pL;$5{Qa+^_0<}m~Ox<U=RzO|RP=&QhY-qC4sAQrnjAsVu
zLfr`gg994@46>p_qEvW6qmhBkb%a`q9T}%o1TCu)5|&VP%Tc)DLR6y3V7)C4;j9qL
zfoY`*a9|KOb9YHslsMKD=Y|{%LcDS`Ndkv@Gf^A112|V;VX`KWyqHm%gOG?^D)9?&
zHc@tDxK^w%VT=sT7#bZ=${BmvVB)(RUI2%Afk_ciJk@=wN37ZFk2=afU)w{dKQME3
zo@)7?yDj?B$-a#bR$-&R+kWt)L^Ukh9xJ1Ec{lQMtWL3@ZkRa2b$W*O5I#()N}($P
z0n@aCkPddUR+A&4kz?#;0qO-i4+Ge7RP29*J|x+Uy1$&3m4ZL19t0{~*oO>Gtbx|0
zxzpO$33<6`7reT{$T5(7jsraqBN>R{vD2xDsc_VyESmz23}D8aMH)C~3=?~^27_rp
zg^h`w34mKEBr-NiyOxMj<CTS$LxqBYra&dTLycz&k7fq~!<S%C8HM0*Gy)A%11T*a
zZfT<nc5H+#(1pehLKZ@-qsa|kh-()HH+nF0L%SUbrb(2dk_e&_W_8X*h)2mm@)%MW
zbZ%p-k)uWsYfMmVU_r9qc43ADEjdLN=qL&v&7Iqh9t$XkF$;MNp71MJRb1*93ZIvS
z-vi$mlQLk*cwt_C9vkr9j`;>i^FWn+Av!`i53V~Q6zw_#+ZR_YDjrIqKP3o+K=h*e
zbf|F@JP?cwSi-3XARb~rC|Vyc+^h@7ol%oJ?=+c%-Lp|%T4>dUSi*AA$%(ZYVXUda
zGY#pC87=1wY-a;nrjyT6w>Z%<uz)B~VU(B=EJTXbEQM&Gcr`(h3)y9c%o77{CXI|t
z!xF;4hlJq7*jvn?m^5+3q8^k3(lHn~YmVAH${Mlg91lg=3(!JXkUlprfo36WH8hFj
zqEn!wF~JBIdLsRgPC!${L(b`U1y8yu5I&(S#7&EbpSC=S<YR=6i0Z~Myv9Spf_o}5
z6P#V~EIZm5m}Ek@K*oX`5LsZMG#DtA0U-)BtSS)@L<u%-lD!53Xw?HlB7jDXQHuu4
z>?}4G2wW+{3C%c5d64L08ZtGZ7EBBnm~J`4(s`LjS65E1xX`y`3Olz4s|ydD<sM68
z<eDrCEu*`?qrkluD#4PO87gd?xzc(pOqWuw{L1N3vSc@xmJ`UEPbSFej_iS!V+GvG
zOfVuq#0(-Sa3F}l!vV9A25fPIibfh`!ZGAzx|v-JHgT}z8KSdhQ3I$VA|Z|qpgLjg
zJ|G&|q8-^f3z*Pzz+YkzPbF0zVbQ`z13EfI_Aycc6mm!+=q#alOU%WGcsnV;y&E-S
zF1TJLrQ+I7-VIY#l3|LhU{c~3L=luE7z@S+W1x1ZL1YUUrAGGm0)n%8DT8E+z<~=f
zPk{JN9qk#_hgZ=HUkvd@nj|X@H{h1c4?1O2yiYT&4vKLnQ)OBm1C44NGORMCWnsx_
zkYNc!Lg095Yyj&>7PD<`Ds82Rh$DsB+#S^B(&Lf_CM9xY)@DWIvZ2bntT6GE=r|1_
zAp?&Bl^wBs4K$EaC~mC?GBgFDhi8aZl6&b0QciIJ@&r{jiRJPpoLWf;bU<`KL(LL`
zkhT<sr4zak*wqa0X$i1b5$Netn6xl7#2p<~4Y8mlj8k43(D&a2Tu$D^=)$9fRt#rz
zkvk6Wy@=>|ofo*_78`>|lf8}V7(jC>D)~j&E*@OD`Z_hoJi9rrS!*?$3;IRwrhZXr
z3cH1ndBv3?>J~vNB>Rd~Qm~@P5rBZK78O#kSg9~s5Xe}OFj*xQ3jtnOQnHZWO0ozm
zQH4rOsf02sAX!Tyt01u~mO)ty6j)%ZO$*`GQ`h#h%hNM3=tm;?;}p{ZWrj*X43HrR
z?gYU?8B!)BE@h3DF)=jLIW%Gukd)&&IE96cn5l>e7eW~&Nf~O=45^k7q{UilDGb0R
zCJBINOok#vkU+ttlN?n@QgH_og?7N>G{Fp!N;I&VVTHsD2uVh8#gTw;mXRSP2?&}<
z4B**HlS-Rekun0XSj?bhB}!G27;Xu}NCP8?l1ji3!~&@b1u9IiagMHTrywbM?#5FL
z9P+7gQ$%rzm=u+Q1)69{7)YoTWCCD01{ffOvsz$G0jYwB=6W5Ww`eIKOo0;6PXmr2
zN`wqdOra!0A)(Q2#;9r}QH;od^o@z7L{J@I%^=B4)Xaeu4H6BIW1Y$+vJKH$L1kG2
z%29<zLd43cg2W6^xj0<xa5Bd#nv&93V7LwvgE$fpN<%gd35<!BVJg#DF67?}6Mho0
zSw)#d%!QGXR$(d3M5p(Y`v0#5Z_pM3;R_jpu?QisKqvj|5=(SsZAd?*wIQ`A;r}51
z)Rj3UTT-o(uEIvuA;NE>t)-Az7%pjor{9GU*p+!582Z(*D(XtGm0>F3eQDr&iC5<L
zyFO>h)zxie^HhevzU3UML;qBVRN+z{l?)I0v=KV(N~>a3vVfQhe-%%s@<a3ff6)$e
zi2pI63MZaP5TaR7=lue3P8{X|f?=7DLCR<<QX3Oy_hV>ZT)RT*kgf%jfNV=O&1uqT
z(3;%h9aSM(IPoi+>cA_Aa;XZ%Pq(<Ls;a80s;a80s;aeBRni>^!>wOulY~_5zv%17
zNO`)hd3*<Ab~^sFEe`tCQ>a--LFE3w0(cY2@4pf6{!v;ymU#~*UDZ_-QC>X3JfZ8?
zqkVPF=!_vW#aD-m#n<Zk^sfuFFSwTY;gqz^1|=-=GDyh@W4&kFzU(J~3J|lS?oRvb
zusjJzjs6f#E61W9G&+@d!0f5mQ^rpj79g4_qJ#ZJ)CW+1L=BYvOSpGaMH!BHA&?nl
zWEi!kAz6!{sjb&sU11<dO?G}dLuhYb6w(`E4Vyz^Xw$c5!{F<wPJ+3?=chtfDsmSn
z<fkO$0|g8R5itW0H4JdR$l)dz-+btkI0VB=PS1eg;30v61_)}Jj<^`Z8}SGx1BL)#
z;216K?lak4kg_q1NR5TLPkhA1ChcZI!6yZrMsW;4#0h1WTP`V_yuRucHiZ+<F(i^k
zC3S_4ZhGr^SxKdcSurs&ZN?a}#$d=X3oNcNjRcZOMO9mwMHFXVbAM5=4N$VIDx&pE
zgV+`yZgY>*@!vP|;VoNFwN_ren$_3a<<L-<4D+EP6;U+B!EteMVx?-8*0+gZwl)IT
z4U1!Cq7{PR2v{Rvg@V{4VlD^;s*R{xs9Fh-JC)hoZhyb&poW0D0vZVDA)vYl=!>EO
zqNAc3DjEW44vOgLXz8ZGv$ophpg>IXOwh<ohaku{Hm7$RZI&!pv59T1rKHnOlv)}b
zki`sX-*n#45nf`SAx<Em1N@i#!}rk_?y32ZU&jUi<WP+%3;Ce1rA#2Qh`1oXkVh!E
zjEt~itg9m_VF^m4SqWL031mt_0U(56h7ge{7LbBiB$7#@0w5_wrYMLeSO|a!sFI>7
z2xOQh2!;w+DWXUsNs5VLVrrovsbUzGS|OMugoX$us2WJAf<h_=BA8+nm<c2*2&!oS
zfrx@Ah#-X^goq`AWFjGgiXvEI2x=IKS|${R5{QtZA(#p&0+p&rmPSfwr9S$n(SCjc
zx}j|n8cujz!qEP$l;{@H{4Is5T|&f9%xO>2DWDQVx#-VxqiP$*WW{pCn!=+*$vdiT
zXgvR?cJJSRo)+?ct-|~(J3K|Aznp*XGZWEL85*?^I1BlUhPaD_QR8>p?4nwv&<U`F
z4Jv)XijY6psib8igDOeHo>eowOdF}_gWWHQ(}7ez?x6h{O;M#!Xn>5Vr%nFhb18X6
zgq!j+DVR6c8wy=6YPh+a;^v$XSpNZJrtxzNOZ=q4?4qiAVy@9(y;IcKTMJ_IO3<-v
zFN|A-xfk#(ND73R7|cRcf>8IN_W|>_g7t>8ggC(r4vLUJhUF0xD^w?FK@d8R?E%sp
zbCSFTpS!T}s$z6kq#Qei^;LNS^pD-Qx8pR&fe0iH)BF5{(k7f8f$zZ@-jMHDXUI|$
zTIy5+A>chk`^h5RA24wXf#@po0nl`-rITE?LgE~RF$hg6O$R7E1!2v$Nvc1^9CxRC
zsKAeY@NP0uKy+~I@A=`aL_21f1Ue+7JoU@$EOHC8mnjY+Ct_MzELK@k%_gPljM6K|
z71}agQIs-Rn@<XOrwwppO(ty`lI)oGWf5>3t=qUD_(CY#5D4Tvo(t>ie`F62wg<<T
z;L|{CN)E%r@7G~l<-Rx=&qR7~N)H_M#@><!kb#I*W_n+AC$#6Uk?u7eCERs$hv(<F
zmFXJGnCSE7-u03EAxlD7QbLSE->w;t+|nCD8RcYpE{N+H9tR`z`wlK6Ic}Z-Xnmre
z5DL*H=$QCJ?e65?z7$w&NDrN<u%7%5A1eWYdgKSe4*3H3N}=4_q&(^W3+q9*wzX|V
z>Z#y)tUa~)g7Aqj3rZnfBiIXqo|shXAqQy17;D`GmjzFnA8L^Y#8G}=P1Md+GOK!T
zmv2smqXsg2h;)#E{$f(4Lx@EK-TC1o>qwKuC~QItmq4DveU$S`9%7;Fob&z5M)2}X
z)Un*do{{sT#x+k*P}F?Pf$=nX!_IvRNI>X140=@NkhYNDCW+Lo>`%B!Q@8s+BrM_v
zyBES8q3Zh=uNT=6@8CgA``Q}7ufVXRIu=*uM@(QFOtqYmxkpTwW1ut!A&Sn=DAPR7
zTjt{pvJUJjWYUTruz{y8Ju3AXq~bNdPJ;ts(igk5IN>7}(e3gTlvEE(@}-1@b_FuT
zE2Nsa@d~Vvwx;m{#49!5g{5$=AEX@XuJgt5`9kP-x(}2tbQYjho;&{?=o}A`z6Y0r
z1rFSPs|31!;rUUDewwk`6Dyv^{XEY61jZqmTpu!6F9Q&}MB~eCaN~7&Op6(|1a8Xo
zj~z!tCy%S4;Bk3OK5BT=v_0X-85&dRI>j*$i{O|w60wmy51x)mly=H`uG&2DbXPV0
ztkOJh9!@N_&r-(DTDF|(c)5<~&ueL}Wr8}`n&@ubF}Tre!^Jx*xh{oZnuy-P{RI7R
z(>5mr*FoUYc#MtIo%?N95@BuU?wz}}9@TqlS)LZPMvrPSJj{ym%6Pnu4GBeoSdi`D
z-m=<rWZ5{%ct~8J9^f|+PN$!$KwhG&RbL-!8oK+3k3sMsBdAV0=g%ss)Rr_54nWVE
zsVcqtEH&^3_cU~eN2Hp+UU}2g>9?->3xVg*D?H2S<#~qxJn7CKUD;r2Q3h)+$yFiH
z_q3_qP=}A(1ie*roo9NfFEwlV*ADvXy?=hM-1Y0t>*v26#5QkwtmmC($Yc+~6MO}A
zgzpN}%|~r``>%cZ(dP|;><&QTv@d9AA<8V7^YNYdP#$xg8%{wAZ-19(;WJU5OTk>V
zt4vg}fs7X_!x4yH*i`CJNV>YU*~-EFv4J9WGKawAV22_B2!Y|fhh}PIyZf;Z9=r&S
z=0lu!|G(AO+djTseOW|>e|IlF{oS0jR5P>HB`W@H(b9TVn+%E0ZoelNK?B3KpRd2@
z+=e7Mlr$iov)+$Tydk?`UdV^;p28vUBwq|iojn$69RZ^cDMGJ+ICsIshfx|Q>PvB~
zcv0c(Z1axx=@fT@80LF^Uk(08v<9St%n^r_3DpNldWI9V#%w@j23F$~pd-gF+F)B3
z;w0Sw9|T4^sX0`R-O*444x;tkr1ZbYe$D=ef|Jm|p@cobo%$@qJQ^u?_8r%6!=OEi
zpB<aVR*RLbeEHe?rqw>V%l87(9l$@ub?Ym`={06lqu3SatoTe7Jb_``j#Z^~-AqdI
zkZd7|*n1cpH7G#plfB{cn&+iF0eOcaiE>ei!d6H`IU?buh{)@gY31dqvcq~4QBPi)
z)IIa&Ul@i`9U*o=Di(*rbcKiS%*e|(k;G%M-qK!7tLbNh1n9vIZFSB8koHJ=WYOMn
zj-`A2we9W0%c%(|mZKawWp)tdO?O!&24aJiH(@+2ra}xUP`rx)?mG%8G@K>)VZs;4
z8pG%LhWijX14VvK7uGmZf=s0Qw}nSMxP3m_<O7DQW{=v_qR(1AOZ0fR;E<Tre);MN
zPbcYoebG=8f1gKYCRe*GqPNQNiV1q-S}|kpZWeW`$a=1<sip@0AxwNq{n6C=``2MU
zr#w#Ok9CFf>*r2u<UK@2?&(h8Z9Qtwp58vq-V8C6Sjxsr$_zA)j~xpZDr%1wq}%0<
zWr{pmJs7@BMYM`FIYf&AQlWs0sQ{?gZT8H{GYun-2jlefz3BbB`&=3OYu~+3JGKye
z5{F~pHn+<!dcp0>;n?lB)9%wM_r|)qHrwB`(H|)t5CWn*K07bl0FZFu!^!ETVMaPI
z4BHz*&rABhm8PGFd$)*SixX+K*P?H(LA8-H$|e^!)`tT5Iw@N%LI4yXb>_7WTUruL
z@|M81htjw>)s9qzLhNv09?psp*#V3f5SYT4i1U<#@<96U(V_LRHGOd03p*&FPO??r
zu3f{~9R!|*lwcjSo}f_2u#4>WEa6Veh1BqB{2ohhkPSff@O7v@;B{5|pq^rMLAR8Z
zIBlYcrq9z4haS+;K_LQpot_1^zO?g8PpN2e4CY+;uI#C@Y?HL1ET0F1m+xD$9KO8h
zNC0Y_iaiWF*-rjXvF-LGaKSOeWjt737)M!7o-KI8cUniG;cO%C1~o&24}+qGS04kr
zx$-{-gR`Se1NC)gG$9)hu%;Y|1F~2$)#zZJk3xit<f-VV(d4Z_G6zlko?F{h^*iBK
z?uwisLMD%nA9BoOIw8<dp$jhK>Qp?<N9MO>Pe#ga6+Xrl@#L?KoIV<_K#yA<5)e9p
z^muuZ*L4_o#B)02(Ckc$RXi<CH+f7=itL_kT4XENqrttNO>hWDuA9OqJR{Ipd)QOu
z4@Dn-jlk%F=#U^3N5km)EcPaOFQcR(@aW7sCn>e$^lIh9&vk;p^22!dcqMuQZFUem
z0~FY+;i@f+8d2E#Aws9ePrg`Nz&`y|hXf(^Ib`yhu{>}oJfJZ9bKoNguL_}lNIjQH
z@E-*m96TlP6!Mf(%+SH0o=Ml21}d_i3yZR^GUZOg3!*Y721siIl}-G4<(O(5vWu?L
zDdA5B2ME4NLD*Uyh82OJu%1qkZ?-%^@UBiQI*d+NgIaN^PKE<+nnw!gG`%*Ah;~YW
z+t^un5&}yL3YoDR6M_)Jb|KrP(;Ne`G=gCP$QXv*5Qs<;2O2yV;10^5nCga?X55bM
zO1wH(Ynxr6oYoznU>tJej1aO9O^<w1@lyk6ak8zYI87TeC0LqGN<#E=V~L^Mt@L#1
z!si9&Q_iP~qB<+EO<u@pZ)-}d!I+hpMmfdIoQ1yHhF0vgwN1hsvZm!itXM5UVqhg<
zDy4LbO_j0{Q*f|c6k`PPG8m~CVHAi#k)cRnh+GK_1(9eWX(<YTkeU{jNR~vRgmMMJ
zgkY4R2rQ7c0S%HFBt3rRTD4VT+ij?-)vBths;a80s=dynhui!=y+72e7@>>^$x5%o
zf2DoRxBo#-BAAVMDu1e_=lw+{GCne@9SCx^Zq!YgoqE=_I1k6kQ^Wq{Rq@%3ub%S+
zd;~oFGBPtcM(N>rb!GLH^+yQmMgV3!E<u^0C5up`=#&U{ANyWXw~uEJd54{(cSkqc
zJWst(rno#VFHa22&%ba3?>%rB76l3RBB4Tnus~K8X^0|9tKew!_IBbJh9Q}qqtBwJ
zo~8F}4Ev~l78-lH;U~#MXih0;9^0HQc})0ptd6<8j^;hGdCB2RpOJkAQXDvk2w{j~
z6;%5i5ZEE?6+WnIPP5gPUC&r%ZcnQ!c~bWIJd+2Ad=Z3&pR1ZABtIcOgg*!4kARO8
z0h|!iB}&PG74HER$;JBehptkHLXE<uNJ%0V2xuXjqN>f3P$}(HyFaB*i^!foZ?j`Y
z81h|fgFKGsrMlqI(A){1EeWAE2RXaqCJ33imo$jj=x**@6EY##hv@^oqGUhOD1?Sr
zZ~neQRm`5(%&F^9><hQjx-eq~7{dcEp>-ehuyv^W(e9^sPNSh5zvTPMsy(8dxI3nr
z=;|m9Y5DrQZtmN>EPGUs?k#7}fEm`rKOqeX6(SH*1Uq<ZD`4`D%rTYT+9hO!AjU{V
zee;v`!V*t}0MD?=5c9-DRg7XLnrWwL?WM&{{;}|4W*H;re?&dumCg9wYGxODUCkc@
za$?h;Tur$DB9PUEQHWT^CDK(9D3F4;pRlU=B`-j`cbKt^R%Mx8sd6O)<HoM{mA@Cw
zhT~-Q3HTn{^YWflfUo{ZSM4QQi{j$(2<qw?<fd5z+ex0HZXJ8QuD}`=w6O6(L==;N
z5IZ3OUsN6FKBZ0~nAJ7AMV460EJ<OLGM~ya5+5P)`sY3bxCNnL<lA9_5ePZGU|}lg
zG!o+AHDPu#=o*Bo3b<?I9qHM$CyG1qn)>T&-VHNUPN>FfuD548foELN&TQTVa#YzT
zMcD#2VGfMcMv8F50OQ4a_VjNUDCAz1NR%Q<5)#NTwr+%lXjkrN_bO=Ds-?nqd8t(S
z;^|Fe%{q&HQOgyt49sH~#yO|fKjB_+=BC7}=v9>O@9UzMTw@Vo7(`4&V7c-pyFEp}
z4g=lP51t2U1cw-%9cP&8ZUSVcl){!>mRVuT`nK-vySr=`wg`A(OjOz~`^pUcV9G#h
zNdcV*Ptg1Jr;*v(F?3<5?;4Gxdrj?|*4e{)Yp0wuhdyJO)##mdhMZG_!h&I_ZkuF<
z3>fHm4F2H@J3q8+HJa9_Z(Ac&VG@{lbX5H4cXkMV1R)6sqK1?yLXU8tfLI=zYB7k2
zkr9Ln5EKcoC9$yHZ-{|b9|cblQ;H8oPlBh1JL}>=S3D6f0{9R@3PKwMto-Mp&V;%{
z?uG_7C5d5IqBLQbffo?S$1ukLvcR+~OfaI192}vc%pIYgv*XAK=@744b$X^^gyHjg
zJ5!N$Q&jVx8lE!I(HWW<nU!*Io=&v#yGG;9(>k9Qsmk&B56CS$caOW#g}LE|F(mKL
zL7|*Y!XEWXWrpY?ZiGF4y=Lb1S1#(|a-~HI6ZAqM5Qu3CszbwJZ|p#+nA>g)Z3{wy
zGYNx(f)ungEulf>uZY+{?{t@tIQux#oK6vzOMF&xJRX2MLG}6gdS5{K!1u^fd{8}B
zMof_e6A=>-MEKG}XXGBZL(}r13+<l{!`OVpecgN2RaMu^w>rLoX;)g0nvZT#$*+GS
zUacY!5=dqtswVRjHNcz`B}ghb<t(jD?`7660}}P8Nc{?BezL&vAMzA1y5{5g6~?XQ
z>0x<#=YYRMU9|3_eB$^R#w!(*CQLd-p<tyLAcCqQpyRB-&<`LzM`9U9V!}D@-7EG~
z;^`;LzGGB)GX_Y+7BW75r^w(pl-onVlq@6?B-u?U%^1e_=!4x;sJl<9o5;CT--`@B
zpKN>D)NvQ(_f+nKb0aW}i={r)W#t!JBz4@`W?9lJ$ecy>Hg3GJiuQY7(7&udtV*y-
zzu=$pR>Z4l4Zq8b#@G9UP6=1`lB`HJvLrv0epjlH)B$Bkd67UTgdqOo0zcujkkJ$7
z$i2C*06wYah=fW5+y}f4S`8eZnnDAb^}IT`am1N`vy31l6^stio)$`Z`PFr{+eM!#
z#>h|9x(%es*7leY$T)VpLlXs=A)FX%FM#8i|7^UT=hPt>8xZjnIXa&D)vxz=k4(#L
z`xsmFUDjkxJ%LN>*Y=9J&B&m8HZB=}<c6ca=c?EqCf6gqdz}2eJ4>teJfCuK)O^MA
z`Dvyx2^a3am>-RF2AK67U5-Z+*199s%fGrB%f`1`F2g#s8CJ+BYCwSlG0@1mhJ+`O
z43>Z@dJF6C*Ux05-09AMmq5RNR%VK92FUqh5eoPT$_zArQRT7V$xpt|gXq~^KX1YM
zfqsEvBhV;yTndl_&M5+U1g-$s6s83+FvSS^0dNrYO3+${Hl|j!6{V`Z^S2`+5)xpN
z7>Jc5Sx|}sMnsi_m0?Lj5@3{Kq$OdRND3J$mI;yopaYT_z?Y>8LZ&5Bh9EhD_do=|
z5I^qse~v%I54;b&{0HX`?|+x+;P6rSPGy*0l=*_xR;YWoxoCXG_b;_9(MR<c4EYO!
zAL!bj=1yc86S{sq{eglc8Hyhcs@IrG<;#<z|E>NT3;byErB~Fa)d}jSx>4gN{-}8&
z-aY8K0_0AE(F6WT`q%pb^=VnhBX}FgAi-5-2r7H|v>`$pw{HEx$wCkVvMnfdV4))f
zC(wgAU>Sjd1Q1jiQw)OxBUCXKtv?uk8oTRRoXx|2HsNRb=xX+p`z|zA+{*E4QKfUG
z()aXqS>r8m)>^!AHzq3ncxa%Nfm(V(36QA`Ss<qx!Y-5xg~3vys#>PnB8`ny87ren
z5&RA))zbb6a5*lFmR2TSKGqNBxJF5)Bldf^{hw*n*V*~MK2A<~<l}q#o(>M9<oP*&
z4@i31goDQhs8i4{*sII%6Qq^?$%SQDOqi(5G9f7xJ#K{d%k2aQ_Y%cO(Gayu6GB9g
zM9M_13qdl3%TXgO2#^IKGX%;sFa$zUqf{Xi1fo(hB#J;l0Ybr31VIoIpvehBOsdH+
z$r1`sL{Td-Eh!QVgoHw~G6X~=EE1^{1Voc0GKCOQNe~b~EE6dr#1RYx3_wi;0Z9-F
z&<sc<L`5PL0ZdB-NJT4x$#^Pvf7RqK@L!~{jKf2^?#dw<MG!v#rT)&;3aST$;7-B(
zD3YR|LXcQM;;FqydIup60l4MPw&_=$87}V6$=~ZoiC<wHrOG)@nLX(1RdtEhuXwM0
zFMU1Z-uK_jf4}}e7*f8vV+4Gb3HsFeDjyNp4S>|l%`*&)o*ynB`&5uE2{^VKM$*vW
z+VKBQ7phpLN|4IdLy-&}$eqE|5bgTfes~v8%$M0dD7m?<$gT9BX=N)I!pKkLpKC8y
z();Vji`!Bu-@tb&-=U&rzE4^%wEZ$$=f0QOnVE%odI+~p*p5!j64ZX&Qgc;~sZ^dO
z|DvRSMKDj@g~>tZ@@m|tCS;OnLa2f0FbG31N!yt*2ZatP;|i|?aj_W<pzxo$3PK8~
z{bdh;r-4Ky(FsyOR0I;tvoy@gQnLyZBokCHKu8in6p)cYGbl|m%*+%rsLDKr<f;F2
z;(r@dq&S7aFTWOOZVYHCS_*1ocPzlas|#Hzb*a%iRNQ4OjH59b#%O-we?#Rd6Nw4M
z?bw6p?UJelYgJJ8dp)0W0x7zL9zTLv`cdIyGt18X`j6PXK7+H4qi}ZSd+F|4S{h$6
zzWa~Wzv|?x=B!Y^L=k;i1!gE^i8B!vUoJ9_W~4%zX^dm1hQs0_*nayA%6qo~NdPN&
zE@FLm!TqU=$aqn(*a$Hwt}tMgq=y?MnV2H86HOMxv93l$k+5Ze=&9f(bTxkg5nYtM
z)Tl;3&>s=WJNtQpOa0jjF^Lm0LYy_GGdYA?PU#dpH5V$KqU}=oy{}GgYm%%PNisg|
zN|vw^%%L+COvsbtR)?{HZIZ0QvnJ=uvu4aKw;PPxc`aL7j9DZ6n+I6jX-F_Z#b7X2
z2BD~0rWYK?Dgg=tfS?*EC>kZ0#DM~i6MU|HXg`3F5VW?2f`i25=Z+swvWu};zAyY)
z20n^er@l0(dbmBYafJqrYYeFwlK_StXvqp>DKchBOetDqqQJR`iZe43VVL1F3<jk#
z%*HD+NEQS#Y|&O?m|IH9r@63Z$hS8`Na7kZStIG)O&x7e;#vO-?e~2j#I1LS5ZtEi
z#RIx<oF@i)$_nWkWh9<}JbnLXho*$_lmj!+Xj4RlK#>lKVT>~wtK%<i2k4MF!IkW%
zv)LNRjCn>epJ^teUWlCpAgKjN05m1&lQ>|Bb=yiaKn+gfMR0~|0brs=CM___(isMK
zMH>W>;Y&$LEb#vEhnFKL#H?{fpc-x?qTcPs*7t5Ux4ysa_Z(lJ=kdq7dtKhW-;B*P
zQy9kpH=tf`U&K`2Uhgzakn$4|#5)CQbwb_YX@j%_qZ5}YThSy!geb=y>XL<lojeUO
zK^MB^K)p&pxB#fS<gG%tU1*%Tc4A``FcN}_nhK0i$qVnMRn!y|6cpCZuMZmWRPE*9
zomz7+Ol-t8dp|#)&m555SUQ@Pnqc9I8lh#ALP*SqMzpPeh`wT925|5dr1eRAD^-bP
z5MaU(0U#*yzPeBjJ<6Q9a>>r5Hx6>Sh+yVtfmBaur}6=3<vu4-(4s847GH>2H7iE#
zma!4Kra}*hR*<kZ4pQ<tPSA^agefEttwv%9G=(D4B2eHTg2yvMpv=~U`IOUOX66Bu
zG?*ao?QX?LtP3GO@gRjNK@(x~yGBG+EaPwb_<@mC31|5D8`2<R?vn(Fs||*b&^V$W
z&Npdbl$WZRh@w-XykOP_0nuvfyF(I;+A*$qH8$&-P)P0;H?0mOswCJk4ZG2&5(qB<
z&On4G1mKGf5a6sEjYWnd7&6LahE&qWT053mCgzc{F&L@)R&g!!O_qctl1B!S#1-Iy
zxFA{ybn{VkaIA1SiJFU>ABO5jq4O99y6S3rxzf@Ug*4JqQ%_z~&ltuQz_5a*YM3Jw
zkKN_`Z$U`M%#!`T7KV(8+oykV_PdR@d-@C2UtG9Dv`)ltDS4GXB^MIAC0_zBkX_Jy
znGcCR&>nZ+vpo&d(A>pURT$@_@bL4piX#}-6$F99DnFq5JH!KrgbB^G-`=SK?_jer
z85o$rzM3yd^m}c3SqF!PX2}82%+ThjR*t?v+yL8EIw?9AA$8Z?$pT?aLLpg~asCff
z(^}v0nyne&)oqd$!Hgpf-seFR#6%E)A$l}UY1|#}bME(hs~z4jb3<e|Yra$^LRn>(
zc}ScYbLYc98Wrfl5I8RJq=7--RF49)Bcup3<0dkhSa~hwF_Da=_beyfrD!nAR+gf_
zM)d}=EXB4gV#YFvwtck_P%N^kN3~qNJk>c5phydEk?M?L2uO!9SMnu|KZjK<TGR~V
zcQrpKT-2HB;My8eRFDipc8>`tt}=w(rIwDuf0<ylbd>B#Q32W!QIsUxt!U5*sGHsi
z)`)W5fD!>zHDu~!bAgv#ooMNAo`KF5j2I!kb)m8EN@burJxK->8%k2b!J~S?ySWSo
zJH25_XhW7ps9j`nfYYlYOV-E-<eMaBvhE>B5jw#vQZUg0$cL1i02MTaM+z|E&PW|h
zf>N78+XBH8Y1SpMGf56&X-L5s6x@ZCDTJE_28f7E156pL6M7;w4wQ(P%1{}iAwWc#
zWw!EidY8H9)isNQqlmf1x)t^mrxyz3-B!%TTxd2Ww1-*Y3d!Y1oiI2M|9!dzBWwnd
z<i|RC3JhsJ_9uhGIz!i|;7<o$)OPt3%oEy@Aq8Ogq4N9Hi>=d8RHaX9lv!eXLgEtA
zZSzthdg0d4q=FbAciDP8zIM0kqn7w|Hvu{qP#Quh5J?Oeq~q9Ewg(WJ_Jz~1l!O})
zi^Wn3>VRoN;2aDys9-CIQGuRbwi-NZzg^!0i4MwpDtE&HQu$j>-OpE05*!MaKuWf?
z;ST%5xHE4@3Ey~BO@>5m@+FtDiV=WCEYRLUoE0|!_kC#5>l16(K!=)I*c3pC*ic=(
z@Fr>)f|<>fg`u*a63u3f_|1ABRAh8Dsyt5pVc!E@D&|Q+a_%<P7AE1Y60+~kQbdh~
zITGU3s$$hckm5uSBj%4Vc6By%VN&2(77tbp=%8sxhC!zg4IxNAD@9p@L6&GMp0)2b
z$nZQ!VP7d3+qiPPPV8*px6?9MQpT<caG@!Y5|<*WHDxV5=_P6A)5B2J?(n`TVM%3&
zm7&pL!if%uz!8XA%0appx<KkofWw6in;H>m>v_Ee5!w-GE{G6n6$7YfY@i-G<?6~E
z5H>?0xCWT;Nd|O+r&K2>7FoB1tg`U|rUe{mF4EajMI2O!q(Kl7bgQ7+rZ}kW(RedR
z<Su0BceaP6f)>aU1b|n#xuXYYovLtqbf4h_SI-dI2L3q$1R{EfZB1Fx(HdG?ylo>^
z@`jVB%*;FsT)rx#p9j89y*u#a2!shNk`E7>MezHs#Sx-NH7snjN)(|v;p<bLqtNXe
zVxBsnkR%RixLFD)EzAp0c3O~-tsSHh1WIGJ>oL%;Z!R$wls<fpg*=CeHPjT{RFl<I
z1jaOk9O~V;)msuupkcI$)E#~OLfnqAk%^qrdCOAaZZ3lA@ty8za;f1i<FT`>@!8rg
z^ID6wq}rYd(%2uq^z;UoX|?DOh)wGI+VP9*%3C~VFRS)wIRCw|ScDP@2uc*pC`3dL
zf&u&(U}y&bwx(>_F&dM*n4~-TN$Dkh+sL`9>d_y9yDj3}OXT>pl>6o+B!rk~CJ7Mh
zL!;BU>Rl=O(~`g}F@|B6OMb9zII$9vk`j;<H4>~qO%jmQ13@sgLIo*HN+b+~goRaq
z^;5ZlKt^E&S&$V;kN^n_^&v<@K^6fKS$l39f^}A)=q#nFUP$V?T@`mV*e&g091{>+
z`c@lO)k@yYn<0D~<LBL6QcqV-b_Y(G#i{|J3dah;1d$Oi!z@8)s!E+Ie3~OloOHnL
ze95^w=0qU{l7dAj0SrPM5z$b*ZT`k|gWfOqSK*2<vIa1z*k9``%3y_LSlTb8UJCmB
ze_sJ_CBku?s_B)9AmXX5MgFtrp45Ez>%NHMu`m{7J~C4vXlR&VkrS`3Sb_?M6SK8P
z;0mkkeaK9tFqF!Z3`j{dl>|u=#DoyQM1>_n5|@6_(kDRn^(RtU7Qme<;Zx_pxu>$G
zV8noAF;Yj_?Dfiz(Nd@nxIb8O`13i?Dx#ln;ZqWRRXr0><1jI##BF_gNCPBLVFeS;
z)3anlIMj)NVuv;Z?Uu0UKnNgwv+`0l-3AC~G6La+5`L%-zr<9yd{lY02hkA;`;nbf
ze1VJz2>{eX8V){x$6)7Y3!NC-Rx5JVOL<$cP8VOr2h*KW$GbD`?scd5#rL4>fN&I`
zI{<ZFCna7%DIp;eBuZ`!?x#{Ol22577?(Gl%a<*iioKRo7$GRrBH`PDhJ_#&Qe<Tj
zRFDqA_19IC-I)j{z7S#+Q`-V8z>X72qmUznQi8-J5D>Rt+h63V#Y|D%SMT)x{0~Nr
z^$L-^?7e?BdeGh19BVR@BMhXbCWvpisq0hCr%5#^Nt1J?{UOjqAV`e4t1L(~5}G3j
zfejqAU-Tk$nWJ70KhGm0GuWf0+{?jUef0hpW2qZK-rgnZqy$c?s2GI}Dp)mx`T<!0
z_aV?pLS&hgkb#C6X8$tiRf{O2p)XRQ9ix}({2yF7DoIoAzmX5)^ZA?QXe1E2at_eH
z(V2irponP*hM8mw)t1~D5y%7LE1-oKRPi4aeLZjZgk;lHhnY2zt02*;(QAQJE-l?S
zlai&rsvfLnB4Sv<VlEfcy$C=z^@rzmB<_B*Ws(UegcJlXn>lqP;11O^2pbOK8lejM
z+8;a=!>keD#B<BDn9j)85yp--?|WmHToHRmghI;!8_C5DVyZ}ht!la`!o!F`Ri?>G
zgbWG+9rbnWo#fcsIihtjbhgq~&fSHGhJG@op<B^sFQZ3{14y8DkT9wN4McWzsiUG<
zHqo#IwhVv)GL%yy49>bUxB>?vcfPCxxTyA-9J*bYjt>2uB)DX#=+jRHn;jIOIB=v&
z>$_Dq1Tp2N%P|p|COUL(2QD$mx`x_njd7|+F~GDzg%k)_*-D8-W!YlP$hM8`xU&On
zsK{WlFak*kYk^Y~t!%1MJ*o&j5g|tyMEL2N1eGKbMi3y7kdcImAc9J!AtWHGh@jG_
z$ZQ}bJCQ6H0i`TemNrxV(#wJE%y_hg;)kYOgJRj>X~jkCjww1W29zv@1|dorDr5A%
zPJlKrA!)YMwPm4bQiY|7Vp*0pHlaa*js^xBAe5DX9;^e1qO>+h!%S7AuvSyDtCuKP
zrV<bou_F@_uVKIIdb<(Vpd})D6$saA?Nylr8jlMk%tQ!4f?6M%B<2a#_WM;WLo7r-
z1MT)9?7Rm+8^eg1C>A@t^#P(QUDP!`v^^qwNAM58J;a2BpO@uPc}oRD#Z&6~n|W@+
zEC>mRk`>P?5{ZUpA%bC<WstHn^GE+AAPW$Jp-2lzDMFDTutE_cktoD~ks_l)AW)>j
ztP+tZF$oYV%`_A%1qv+-KvM*eC(1uyeW<^bQy<z!D+<az6{0j)mQuuG(zO~^nv+(R
zk)dL%CJB<^h+?i7s9?a5FfuZ<#1a7l570xBB>l~fE=X!TMp%nd0xPqd!>um4%@<r)
zm)<Yn%onw8k0c&|8d_HCkS&4V-W~6I^!j}@sH<S9`ZZPheZ}TK@S-nM?UXH&`IuP6
zk&%dCp`f5H{`0@R?>o<i{=n#0xl_qh&fWmWVD1u<fQSr-v$NmAI@Z1q%da9dwZ6Do
z7cgkn|5RzB!6dGVW(oyK0JIFuj$y?7Knj5hS0yb>zzdepTT}xTE>#ZUQ*aIl;Ft&I
z9NzHE0L=`=O!Gr9497Jy5X{UR!OSzvGfeiokMLlgUv~(`F^p!*D8?${E+X_p%CtHi
z4yw-*v4V%{#S*EeGEC3N!4gnlSs>74C;^m=pcfbM5@s_p32X3ENXlD8YQ~K;fdnAq
zZHPXT-1nqk;h)3SKMIiq{5@ExVofVSLV@T)15l9=RG6j}YBC?Dr%z{5!IlnIVhM~z
zV<eLqN*OMT_SMlTSdu`Jg#_Ax-^uXsMc6&}-z{i26HPSEk;(2miDi|Pl$a6r2vy|U
zLOYKO*Ta?s{9vg=3gI)0IuZ=ysd)u~vM{5?noNry9JDar^=oFUhRRL7k#0l#SMgC;
zukL@E+>fsT{$*fBDG4S9NGL#vLL@;*1aNUNQD_Xn_G6BummEfL<NX)<RK?1!OZr$j
zmd_aJYv=t>h=;Wx^5l^YL^zNRJgF$&A(fydP!&uc$cwjcIc_wjIC+~kb1SwcyB&`<
znrrVffX<m>X@uF0J%)h}z@35jf$swZEkk|2iq8_VgeXFaC@rO=q`FI)3y;<zY8Ihw
zw#lG|LK4beT1_`NOBiSyI<ZS^LfLVk-l)hg5ex~C{?uJe&a6<JO^0CECUj<w6NT|U
zC%4NyL)z>;Uh4?gWdGome`}S^`u+lL#_W|p$SnzeYM)sxH7|Av{bG&QN{up+VzERB
z#6bfZ21kfAo47<NIf@z{N(sQh#(!3-2$c|(gpqn&$#Y=1DB?<elDC2K%G2-H&G3F5
zfQR1^P(d>@RZ0-R%9Q<%iAJj~l_GQGA%%)V4QM3Ql9Y5)$S#QMSF!P*L-afsdUr$0
zUQ&tv6#Z!4?uq*sa<%IAS6!=FW3S`d*|u554m^Ka9-(&!3=GQ<Ljf%;tc0l~gbWZ#
z07D@p%M1)d2~!Ov3VVbj5cmB;dXQl`o8T#mEYJ})Z$j}rP5B3SdYU-ON=i}<D0Jz{
zexXy)A`q((l8loi(l!JAGWg=NB4n4EA8}vIdd>bHQLJNN%uvatm+7`AfrVeA(EhXm
zKH93Ph^nfps;a80%=~ZeFUgpmf#Qnt3$y0=ex#)f#hwe@s)E;Zg|ulNwls_*GuGs9
z<M)@|WsAVymzQIjoO{a1<~jN}!SQ+_SoaKL9`QiMD>(9f1za1_@RS>-K9YNQdj7Y_
zs;l)^-93GW>3u-}BP5W3kzz<ai{n#WJbd?V^&ZnJ+REoXY)=4qQJBe=FIV1P(6#0z
z{JNF&Dnhd}P!39%5SU<Ou$e26jzHo_L<=NA1W3eEz{;4cizyi<Ad?c5QbdtvKp>Qc
z2_>bhGP5fKGL`up3n!vaVm*lY7n_Q4JB4%Ggoi-b3=|LOI5xwl@KE@C7u@?J%+V^R
zuJ8JlqUNaMVKJ9?Pj+>A{G$8M8eQYM!xk^VwYoEC-(QE?E)o>V$&<=gxh@=8d{do0
zc&FMvXpuyf_rsF<*ayr79?zr%1I$8uYA)4N!BOo|;15Vwq9>$P_LJ=g*sA+tzZ$3M
zm+u$vm+xP~f4{!*uetFleCok{KRuHO_S90*ZCjQ1{s3{@xr~gCxv$zZYlc>{Z5dii
zSWUDuigOycqcl(3yl7}cgb%F&#SNtj@_(ErEiO@qilje&P=hd(R%T*lexKid82e>E
z>RA}9j6P9svOT!ZYm;o9l!i^yD;Z4XoYt!IZ~5<U+;!^q@DjPl11epWJf$u<L^;Lg
zr{;%&PG^j(KQtNTRQ%GPnw6q?pq^@Zs6JwOfcb;T1I<r0^B+BfP}CiDG&In3%N%SH
zs%elc3ly5da(f2J;MrxBfvNemQMcNFF#vzbQ-D$>rZ}O96^0>D*}=&;21f_MQ~Xss
zfaojWc02@=<l9_D=uuL>9*y@n`q?Z`md#FPVUgB`wCmt)(@_Mb!xQmH;7C$T5v8TY
zg~-7JjR}e*gwd=p72?e$1jHq)avED=i4ItR$uQNZ0CgFW4ghNjm{o)@%QG_!W<Vwl
zD3D4Jl#pH%42nRMdsqxnhwE^`*bEUJ92zz*Drp<Ex3m45T9||ov%p@E2b>d}0)$Tf
z{`tH6&fxBQj~BoFTSL#*mVNNWdQp#UEX<EfFKlA<Fd}#`G1wK{2m6%!)DB;B{9dC4
zNCKTC`v}_J6tSP9)b%}nuc`HJr^cs4ph-OB@+wZL{%_PcsB(gsA<Py!nZ5%o0KkF$
zu0Cp-R8jptQTg~FNW&?I`!!L6lgq9-rD#UXDJ@3n5Rp(Z!v~N-KGQb?G6wP9hh?Zf
z`!`2u0m?&YMqksU5kVI~!pNLRMn40JRRiP1Eu)QUHx)LKIg0GvYHleHc=C$$#774s
z8JUf#^%rz=<hoqc@RPYO@Hk;XK?M{Y+l!`TNzAol1qLC}JU)J>$9it|^tltISgclN
zW@nb^62v=%^!j}=nh1lxz#xh?8cui`5~<hG)f<tyq&KBaThB?uf#^M6?r8hof!ra?
z>Ig$qH`1Nq?-W2~ABv}K2izPE;X9UOIw8{O-e)qE13wgi3tRw!;2@htMk6SMP>4Yw
zu@u@=?_iDh^~A#SKqx`<6ircyp!E)+dW`?%z0M$3Ch~3al8{0IY~J>4`X0}D7QB%H
zknB_sGt$zl_ht}8NE84U<i`P%+(5hjTtuWekup<=Gcbl7L4*Y=npMFuj46^k%j*kS
z1f63-X`ed9Lg<vMrQv1s-zd0~iC4f+HnD<?5Q6|ZFdF4xA=pCSN|38BpVLAanV2e?
znuvZjLI*;p^`8hdgb*PmMj$8x-HJ~r!&0sqwT??NHke^VvK1(>umkba2(vaiYNnGK
z)lKZm*yyRg3;awh$}CxKS-W*T6LPe?6V>YVcn`G~2Y><fqJlnLSOMC71yoNle9KU^
z^BWGvXqdBv<2rbG(iHiCd7kxtOYl#C{u7fE7TINnr2zo2fk^_A1}K=gg@cM)ZJ~|A
z++2;xiefn6US3}&#{icUFqxi6>Ohi9{rmf>cRf7&wklaiZMXaVB6H6;@j2G94IpWz
ziRTu3CiFLZ_`-XD`28f1uz(n;fM!#8n#nL^HHD#y)=JX~V=0CVVfR=DWJVfP(30Jh
zmWCU#Qq2uC&Owr{NVv#pfE^GRhOtIwRJ55S+Xj{qqb(S%FwvDsw2jG&GN98_snqY=
zuJ81hL439YofbM2<gCSFS&<<mLNFBq<xQ<zg5bAq2I<=X4ho;OQnPRnZ4FVNkhfCf
zmHX8sSA#kcY?ZJjjFr~rDoJZEf+&JYeQ9M#SxC}_I_q=iPqqLX7kGz5`;UY?A<lTa
z3lptb)D?oH^~QSnrG{adyxw>4QC=X5?0B2eNgxf3RXAn63-`CTz3*4>d;?(RRYu&n
zi#ivyB?Sjl!W7Xk;y|3rUWiZ($_0pAC8b>2%gNB3Ny+DDCpRKhzz2dzhkJB46VTi-
zs<uxi&m-G&Rn1W`;Vf#y2+IhqCLw7sQ&b?0Ah`xIWGKUK6%3sbOL}QTSrBjZqoqBc
zc9*%6pQ&H7z#Lsa#a_tkLh{123?X84V2k#uLEQo_$OTFd^6|w{)Plk#-69)>-6)0-
z6oya>A|;`3DNW+iOjd5zk&4D*5_MupI7({JY0SC676#2AZlL5-WE>&L)DjU=$N_LJ
z7EQozHzuK^pm-JlkPskO8e??ij7Fr|WYwC6R5h5PtwU2CG`E)FKV>kjhQ*8y%50gm
z-sx!>V#G|uNJbKZ5b$nTxH@D)CD|kTZj?K@s%8~3$PCD*Mo`8oV<k-{Bt~CNLo!jA
zMVKj{4_axI_;K1c#J#eu7~LRJe1ayFg->WJfeUW1GvrY*VyE1d@=9*TVxMSfWnNKf
zihZSDZ4c6s_EVf+sUM6#Sp7%p{>q2*)bgqBV81VhBj?0$%wsS&p}h_Jw^YnjPSiWn
zgrj{X?Z(Es@GUJcsP1=nd>)*+IdbLpMf%UU55WJ7ALWm{<jMMoV=%)2#AB8V2hIkE
z6lfYidD|c+LMBaOVi3YiTGY{o7?Jy_wlbEiPIDC;j*xZqP)Lyo)d{o_bR{&w`AY=;
zMpht+hy>cH2tfiw8j&#x2?+|Rn23q`0-+y6f<?jClkEEbzGzgJomPHk5z<J?o@mWs
zUU?@J$u9+E7q+KLBGKz0^yj;rMe52Ek>Aye$YMk!lcaLa8T6h=db)#J9c!v~syfS5
zzXrR^Ar7OM27sppRKL+loIXM#Jdol!#ndbU)(bMM#Z&eY_53wHM0N)V2R1@smUOA&
zirJ~yrjL5Au@IC6Tof}1rFhY%G|-VWEbB0g!wi9fmPy5RDw~-mV6sz;DY`O~NSJT|
zKr=B@fR-j8nid9$mMWqpik&L@U8n~LnlS*8NZKq;kdTCs<*d<S7E`RXmJO5myer_}
zD7+5Oo5%iChebE1;T1l?&eaeZ{NIn12~epYtNI__e6Jh^s~penv6)i)FUb3;`LD<P
z7f1O7z96D~UrT>Lxy9;mS5G}tNs|5|wbrZ4c2*y_(EmnM!mwFmU|8*6dlEql^ub0>
zAuR?&j4;H850Dj85&`z%ZI}uYKcvBov5qcf&|x1uuf9CwdPREXSWuvH01oJOhco#)
zOX2##CXl8m5+MjsJJ8cLL`R6D+Vl_af|20`5IF)pf_4-HG@(E=C`CeqN~ebirzIh1
zA`|3Ogh1;<?SH^&fPx4hkfMmJv6dzxtV~OQy~S>Y!b_l>uHW`QW>#ZMawRSG9CVhd
zaSx*;WGBsrs$epvB(TH~NDU~=(1<diOSV)!sg$_>ALZJEugtNjQW$s3+lo;B=gWtB
z?jA=XKqd(!nn*%vi4q|qLL?$ULWq({29^boCJG|!7ssRj31~Wn5jue8iO=eg6A+M)
zs;W`x@)orsoY&vu)8nfBs3?KldxSmN$btw@ehyT+1^fl$cjcc|?e(Qs;xC<EF!8Sx
z`7G)9KZo}Z&HaKOxU~cFL+ww{e@);jfqY5yC~M#Gm&Fg9AHY@cME-?N`4@QarQZv_
zUG$yh-mdcNS6aHddTw02s`E49_iUD8i~Ffmz+N?i2IN!dFvT7u2!Uu=B?*9L1fgha
z>j-8Bo^$k}4uOg;X#N0wIYwZcoD{&jlj)_<Wpg9*7ZFKs<A+9OW=|g(ArO#2utG5i
z6eJ|15)w=lOHFhoz=5PFNFrHSOIentn8snnxhJ)<KaTYiOCWz18JF`$86V61PiQZ3
zdED-49W3|%97pZO4{cqjYbuQkQFs6!VsZriD-cUTL{TJ2s|kWHH^F;V;>KjIzsO|#
z-)GlpuV=7!{x+vu!mIbDIWQm7PkKpzKP*|xCsmeMoKkWZ?y2cwdF5)>GE5MZiAa_p
z$O4f;8}(%yqzuUq-eh^C3^E4A05C{=_-;ZtbB5-_3=D_L3{8*}W(F8$211|#{7|8%
zT_iXv95_iGJ5#~;B()xp??}BIkanncE86v-3vRsa(Z$~9fzi*q`m)H%&j|V{A0r6V
zxFhTDeiK!c`ZBJ#udBynIk~S@<8v!cJQ@9~$w}%Dkk<T$v+A<OwX8~lq^YQCssLQ>
zeovLcaINF0_m{kM9{RoK-uvBL_eUKRke2-A&pc$K_XPu~HI%}VT_7V^Od}|=i#P<}
zH7Mu^Xocz;0ibBVYpJXIf8U5;Y8r$IF@zxvccZ-s%eSBxXLL6~j3ed`&ZMM>5J?17
zpvTA`*s6q$Au1FJO)7!%sz@RNE+`Mn^AF&ZSrU{WNrk3~qcXu_v9p*8=a*B?=`E?#
zJ}b$)x3n}0rmO`}91B2*CJ)1~P#9r>g%6}MY01Z{&F0)Hy6|6_z^mwoK1%VKHc&{g
zi}|WWz%9nv0KoDlnrx-=-aF9gPO_mY63Z=<44b8E!S^b^$^$ug?>%5}L=Duy3a-uo
zqj;F9;08`t<$@KMAy_V=I;d&~tPeads+?^tl(dpD-is1)bC{im4?$UpiH^vck_LJ4
zFK%XJ!3~6oiEL+WD<lKvpo7F*1P6F(hXgW`*kf~vaa~L|y}LF*xP59JZ|DBCPx2z4
z&Y%y#s9YkaT@l(s=!rT4u9ZWPOU8+LLOjYI@kh*q>ZBai4{!m|L)?eB58T^jkXuMZ
zwBYC_1n=dU53fAP!1N}4ADjjHV175>g8>+(En06^>2Q7yVBr|yL_fWl#w@}R3DKte
zMCd0%Oi8q!e7?bPAqBV`3CX=0LF0}}9K5*NpkHpjZPo59qGkwYMr4o4r8OhxGD{38
zt17KxEf^(>Dy*1>u%k#yL2!XwkjPU86lO()BnW{d36PRWWswLF22_PfMiPmpM3Pb<
zJ3~E}5N`UAgAr&r4jpL@4g|$rL#kqykfr7n%mUb{DJUa|lM-yx8qyOB0W1+{oJtoA
zH7v1KVvNY%EhF(_n@Ng-g^3mk7DDq<0KtVIA|~%NONadGn!kpBWx%PzQyV3xBAz=?
zEKD|{;y=`)1aBe?6*rQ2EQLCTMq;ciGGSvTSStGjqVRThc5nAZ&r7c)s}lmuk%l5S
zCwp<{h|H@pG^8R*Yd3aGV~a8y7%@QfjH5Fk#F|u22yhb8)eBpMIf8XNxX#Q>e%SUC
zq8(|nR3$=LWoaxX-ihf#rAn1BRJbV#eSWjo#Q^+B0L^W1#SBft+=jwtUz@41Kp?7c
z5P{Ky1`HTr;)wwh(7YfF4k=_bvMByU5KKkM3|<LAK?$7Yk*X7H&Jx->wCp97&yoRE
zgc<9JMX~6nf}P9|CMcj-p+jO+U~>k<DMJcrpqzj+uxCPXCn>y|ui=U|2{Sa$L!qEr
zj4ejiH3g|#&cef;rKh_ro4zCQQ{p0KB76l`X%**6xF~j#yGbtEfYDG51QSF=&_Q$r
zG!c6W>Vv3<#1Duc7UtI1nkaXuAodh;GAB9d1PV|!ot%)@T|+?8&o8>V%IgZ9nyS}*
z1CdF2!-5)4r|(qmLS$w&3DY3snwFK8mYHo;*I{ujhp|2|ISgPTHx4Am0fB)jDJgDV
zND3GPg;5BV-6WV`OIb=O3T~weRnfzz=AI?-Qm6NeEMqKJj4r8tQj34lVQVE>0xJEv
zD3)XunH5W&S|Ga-`#Amzodmvc=PLh+epeB2Z`P8+cvFhFt92*c)@rTcKO9xYbmZLv
zSwqUKu7*$~@81zJ%CfAFrww2rhX9b<mhRmrdygWTC*F#5dL@>0m6Qty;;Z*!K7IB1
zCGM5(3T2c`iz+5bh?Wv!qbnd}tVNPwRf1&7uqly}vM~z^wG1SJEToV!2*Q$JvW1x<
z$jM_Q8Ce)GgA*7rNXX1G2177HAq=QUzyz{{vJk*i<?@S;rHP>W|3dsCgeWK|pez<K
zWb3;5a=5M~Iylk#1fu;4_bL(ns8ojo3d|}~N)F)4Sjl5Cg3!pLiC(19#KDxq0>c$p
znM^VaIMlQpuvm;B3>a3!0wDmv5+=YL0|^W<3l&uXmJq`zB0>=ukRYQ58zO=~Vy9df
zUk{EaK6&%?G@hbaWo0ELmR3?yPSQP&#mHEPYWsbH89M?B`I0IJlkBRpP{{JNI?OXL
z&1)eGA%J}ULtMdrjYBL;ccbY&LFtAJQZZBcY5r<@u`yDs{u(Jv2=q%lU!DePN&;3<
zso9|NZ4AHV-KcDHz8v$hEWWJoqo^6pV^P46H3_-s97p>OkLcPIBlaqPWM9=&%g>)3
zx2^j(qj_nbDL0E)EK0O2Mf$38Z?4M~o<)3-O9yG>sSh7)L+yT$y%9oErqM6I_|VoN
zgRux2u8@rwgs;Yt|DW5@#&ye(>AQ#eX3V~j+4QO6$T2}piiQ>umP*N49<tS3rPU8V
z6wek#wRN((QF^^&OpHhS7EY!|&F=3Rx;t)98ajAO-5f@A<~c!1_=nORH<BS!NLl!;
ztB64#`62;OOWRM|t$q(Xn=HRZoI|W9n>79Cpwa~>58+Z+(7Hm;z%n7J)MU4-lTUrX
zw-_#Pp{Yda0zCr|4!KZnMF<E(uTklylMzD|MhWDa8%vwDj{Z>5T!i<pJk3ec=&n&m
z-Rg+oVjcvvKE@h7LZUlD3Oeh6^5L@%thB<b3hS(?sbCTIgngv+6-L9q5HISRl}4~h
z6-{LmwH+f39kmCEwdD1+JTA`HV0r*FsQOsxfgLBJZ_VFZwQLrHPy{#iY=}fXAwh?z
z^lqXPsE60y?xW-H%?BV!E8*6C_<13aH|AWOK@YKCTSHJ3505EVRrTt^SXP3Ao;kcc
zc`I*5zU2ZY3*vbKA+S0ejjBBB%Q~1Rf_j~h<RH>}x4(6kH2ERw3cg^3t1O47A4bE@
z<4KrvSlR3`s;0o}cbduFc^MljbXk$^?KN#4y&V_O`1yQZ0Yj*i|3NhXK-nO>h)Se9
zQgia7?>nslwM<9hNbqj9bV(=xJ)v<5fSD-|aQ03R)4M6<>p-5jKJlqoVs}LzH1*H$
zXhHSlrVxkQ@9nT7>nvnLPr=`cr?Aqlg*^cm4dB`;ciD2p4G_$;(~A2c)KDJHg%Nzu
zQ1UY1m{k;f(YS!xoM0Xa3Bk`c0{Q{r29)`lbddIi@>K;6;n-o8e8m9og%El*O&3b#
z4*b4zNIC<si-aLM>N1f}3LGHP4;*7!36MK4#i|CKkqA*rLOdyYu@Z#t7bgYWwL`OH
z3P6S+Ut(d@WJ`67vD+REZmp+tyFuNF#ogU(?qW_AWbW^6R?*z=Ee74qOC9R&ZQQ`Q
znTscDL{Y?w^2n6aM;C#L90;SN2?LNCN28>tqaKpgX%va0LrH@W4T&bFQU;YJ2uMjO
zaZ@g6i=|FFqpdY5^mUHMhNDVZj#c?YJug2qV4g~x(L8z8EbP}>p8nRtI!3A9GmnDT
zi9USRnChkJch`WyUm_=w3)m4*>wj)1Q2N<eA^kK~h4t8$R!po{%zmfK`hCwIqU)*p
z!TG+*Ux&88gwr!zg=kAHA4N%-uL>HfZbRZH#C_rR1ge!kAt)I)3(M6HEC)Cti-nDi
zb2Bqc%+0)BO?E=aMiGLE`wNG;?nF6>>w88w;%f}eVbh9_f6LviYW05SG&_#|`1>Qj
ze)`s~?(8q9`cI_zUFnhBV*3H$h}X>`wkTHgvU_IdT%@wIlaf5<VoX88lqM4DiU75t
zX+px#OP~)#Ekg?|w%pJP5TObvp`5tU2X{{>#xab3a!6Si1$CGWMGVPkX+{Z3Q;7@R
z1klkn-Duc_byaI31O<@wyH3Nf_<Jgef+2`tVelT0PN`KL%Du`6J(WAfOA@MzWU~Ok
zH3sYr!$!$DdL)BH?CgkDu<{+S2D^5meba^M9dtDs>+Shpr|nVn3^Q1JUaRtsRXspy
zJgHd%1Ki$JMIuGx4EPE%9PBF!voN2N;)WoluH%9CmiE`ei6oLSjw+raJOTjCdE#N1
zIhcy!fIm8>2o9AmV-*PzUy3YIa$bROY1;#hV`{A?w>{JcVB8sxrM|RzV+d7pg{Xf}
zAgKXhqh&*-9e3r-HI3wZa+TFvkHY%rQ|@dK=r}JB<HX^^Uw(l{xT&a`f{PU%%KwU{
z0MZyM=`JhWRBgA4r{w%^pVmD5o-EIB*0-jdqm=p9F`0@PB*hk5(HhF5)4QwBzTQQG
z=D-vNBa%46VS|jcAuuFB#E5(y;QQVcF%yXmqbTfi28m>vriSlx;=S*)(!Gv41Brt3
zzce=?y3Q=cq?5u}#xaa%(%K}PI<@j(D!@eKsY;EZWr2VeCCx`JPpR~KRXd%)SXS_9
zrk~)w&w=_X`qF)nKC6T5DY{h|o#&>%7{)P-V;+4OAtWB)^r}JX9RsD79S(f!YGC0-
z5sYIP#xdb14Nb_MktsUYh*U+3Wdj97P#?Gu2M4GS_SB5cBQmC-zPm!i?7vU5=-L|-
zX7=pa_xvh*sz*kYB^n3F?p-J-qA`x?)KXbx)Yi8omIg;>?-#6I!|3f)`c*Qj`3GRQ
zGXkfi-=H_)R_v&!Jm!|FQ-(<ph>1mXh8i@8h7c%Kyv(r3Q4NF^j8Pok3L&9|m;@@`
zW?8AjNPgWSFAPXaG9cT<1tF#)1<MWK2<p&=^k|{d8Gk#V<pLTY2V^4QA~kZ%%LNhu
zm?8s*1>yvFB~612HrU*Vn<YbG5K62R6G5D^)ueTT!V4s%-MeT@t&*ww1|y~6&rD-<
z?0rL{Bcw3WoO%;t9h|)e(KXN<4v^4c4!20^Q&$U4@GOa=o$VmZ+8Qi^?V1kCIy>5Q
z3D}fYsCtPAr+6u61++Dc>^rA@^lekW;nSQvRe0)<thDbuLuNbhF@T2ztkVSM6lepx
z9S?e>CtHV2081znjT<$`#OAtt-E$GL4`>{D9T=g%Eh)|MErOm7gw#WUmtAaeS7zNN
z0(8MNrUFnl;@oD{gIY}t8Q=;$L}Hm$BNt92@SNFd+1xJXm+-r}z9De}MTU@yT5<`b
zEm)})4@@lGDH%s$AQat$TdE-hy`oOrHUiO9xH=*jVp7|(f*WWA#9m+kRGqv;(DVz3
z89D*pks;#{aYg3BrU8Id)X8P3GffPKgMArcfwXTZ%n6Nx9B2xTC{ngG^#u*DWpvJ}
zbqt`)s$G*l@vYR4e12)X;lqCrmWIIvykIzgGSMYqh+oAAy)0HE&e3f`X5^UWPE9#P
z!3a$!S!JI(Dhh+IUs>p`yQ;WYAzNBZOiW!wt<sx}z{wHF7~lj$@hYW(6F`KjvZSj8
z1QdZ&2$DWd(LgCb8|yjvUYDGCr=s_s^US`h7nM(o3K-io_rhVU9}mTiP#UNQZf^rh
z3&m-gxai%Zf%ax*Ym~V%K9rDTTF9=|D5$6SG9XSfV~#qq>%2G@Rz3=rVuy%~J@Bo3
z*6{UfN}rPy+&X8{h3H+xF5>8hgP_VtcM&2)?5crjm@qM!=Dm|}p6H<-^?aEc!|2;z
zIdl=oib@mU*d_fXKH&&w`Ns|+AfUoD63Zhg3PD2xZpJcYWr$`KFS#Xh*|IWetuP?~
zk%@<EKtIjp>h?$*iR9=Iwl|iTOa?bsQw_1is4du3GX+*MMKZ!GETBCL-lx_oSU^Sv
z2%IqEDbiP#3CYz8N0Q5sX?+LZdoQ_s)joQgu*Nrl#bj?K*Wt~9nlUyMmatf1V3P!a
zh7oPHnliDD0?Df(X`GoYwMbxui5yYdiz-4SCe#o#ks1b6!ZjF7jT%N&9GKW<M6enS
zN(=T-C6n3fpCy-)M5!k#r5I5IK+Fvh)2Uy5)5!=yCT12%ork<|@ubOLBIyb(-U@6f
z&g|GRK#Gwdb@uo5f*ONhK3qfOZ%3iCh-nY6d0G`Al~dlMswjeBiGzovW*RX-DZ1$m
z1JZdO!z408D=gmT3WNk02*Fqi%OMiMBob1>%MwV^LnOlpPzeZ3hoST#G8C~2F$*{<
zdrBFVXsXgDyej#l@ltzy{*ID-?%ok@7-a7YKMEGb_3o63WT$yVwQ-gPk9i}ECuuiM
zHDVGOA!ZnH1Hdr|g%jIYE|JihLLm^mB@*<xXz3gc1)C;_>8%5!ERqHV7#eIg8@zUG
zO)_<cX5oeyD2mdQ#%5+EsrIZ{dQ?Ya>=kSGh3<N9O~{>9yb9tiohW8rTNRavJyC!J
z@V^yPI3grCJy2qC>LgrU;A8=k6(AkDqt$wyf0Ck?h71-UFlk<vD#j|xo{W^k4M5R9
zLlKNOCZXwNOjc}7A?b>+!(_8m^kB;xrKRZ^P1R{FDE4|*Y^FUjY^IG;u}?%iimxG8
z*o)mS$X}GdwSR2<d{HTP6+5Xbx*gDWMqx6tQ@E=_9zv`s0z?OpsU*Q8+$D<z+%g!h
z=~%I4k=-FEOEMlvN)zNFL?@EO9!Pf=-Y&$$u~PJQl<Ae*L$!+48kSPKW!kY?lSwjH
zYId_xs=e%!BQ%zk8AIO~F=8yDyG;p{cB=)YX<e+AgkXAtTm;9|5nwP%`jSsK&l!(o
z7xUEq+7E!nNl%{m3b6*1SdzPzD9W&HBT^S}Rt<`@De$r@3>MI|LGTTfVvFG!QHh4&
zwIqBb&A`yFf-xpljjEaw^H@VBEy<-Xg<?!rZicBo6A56$bxl-!CPd0Hx{XueiezJH
z8VleU+^r+vwx(40Evb<DYhxqhyB5AWW8!)gyWw}CJF4%a7%?ofD#EGpq-2H>g<^&A
zj8QN`1tTE{!~+UJ2@NaUjM76%V0>j5RLEdpWs1brp%zvt-pNKLD;W%8F^mRAWd?z&
zC5dFdB{3w*uuP;{RtLle0Z6GDR)l6DD1mS?35vyhQeaG2VK86;fD(Zq5~@i=kjTVP
zfeL}<BEl&JF%uy|NHPe@FrnrPD1=Z$0ScJ4O0bNJ;*$trg9{YZ8dAu?d{nYVF=Ap^
zkkuF;7-3Aw8YZeRVSGx&vm-^QSY&);$ySD>WqfN&ni>{a@fcQ1Pm5AAtvoGNWnLB*
zHp4%ccl<uTjz{rSP(Q-YqxMsPj|uz%561N$FVvtYaZG}cl7T?7Lb4F7B&0J0K?43v
z08*6t`W@fp39#8H(3B~nhVbJ4SNfmN<Eosh1<CzOG3!VA6+eG>?96cz93le*Jwl$M
zh?v229_UJcb<GW;zj1`a1jZSEU_Yh0{@lKLRbeXh)lRk{a3S;I2yMi742XPw9}lrX
z2X!K%)`<jOFL@M1z5A46MTd%(+J(0gAt$U85gAfhez+P9KwcpP(Nfr=0Q~=m;2EfM
z6EBp%x|O1yYxgo_o<)!9uPq3FR6dBTBli8p3)ec_<!@~l&U~H#{>3PO9{^N+0>H>g
zFi9Xp#1T&$K)nk#LPR8z$v5FV_rw{Hl8Pk>DM9Uxb-!*y_P=TNmRSg0wG6m2Ot`5!
zT?|IxxNAP#N;5~;YNR?bKn?1f!+?_n0f7LR7DMqkJzrvEfc>wzMihXgF_>6}?){fI
zT+(qJm+>E?^_Oeg7x=139}mcI4{(QI!V(ch7l@^OY%JiD;g#v5!k!V~T+({$*H2hJ
z@jmhOhu#)gSz}pQU`~nRQ2MC~Ms%bpxP1-c7nh)3hu)uf{rkUW<pdwG4+tXRe4-eL
z9}oecTq24hf+(XZxEV7Y5q`HkIp$6ex~I)k^mLrkI-?+B%lpx)da8Y%2=R}*kRG0m
zAb1}yf75NZcH4IUNtIFZ{~R*uX4#m-sn;?|lQSS>%))hk`CjM5J|Xn;hk4!INPEJH
z%4zT<JPA;X23Cg9v?-cm(%WuAp)M-9w79WJ+k$Yqc4W9Nd>ik43MirsVH^;(3@yT0
zP?vbAEjZNXFktUPc)<uJW-<OPT8j)mOi!=Db>%+9dp=K9l!``hcRQI>%rg!7$PxsS
zP>G~;{T!QUnV{I>OKO6Td<KtFihNZrD=s8#(vjZ)%Oj^Af80KFdy4fV%h;Afwd<Bk
z2fZLDXRUysW32`nM1g&mvaJuXXkTHaeTIfp?Y}4Gey{8P!F<x!Q8f)$P&IW^P&IW8
zY*1_ju@b~stS2btSg@`_<ycu+m0XEoh+e^vflk6np*sL6Q1zH(Up6sU%#37TGZ;Q<
zpE7>Au<fu8$nCJ32FtJ;J1MXmI|k4;Ha&=a()5GTm61IqJu(?4F+<Rqko3r8OvGM>
zWO^A{Q^^@vFCk>II_xl6F+7ZfkVyInVwChlG$G_ZQ664Lk?0Hp`)w`#=E{!3j>0C;
zRUj&xEDIJQK}!X8QqXob8`AK<)Q_N8BLpBoLlF>rz&~RE423d?Yw4=Q&7p{33H1nd
zIt>o0qEMh!g&C6!qcK(YNq$^NTb2tW5{$ttLnJX)B*lIjh}K3GWK1zb6<G;^VlihO
zYE5XRyI|3Ze#=8jGP8^sjRz5;nzMK_hSY2+5JnQ4(u;_UDFXtqjDSGO1c4%wkdn%f
z!caN*MEZ>%%<@i%k{A%lKbjw}png!JXnBZf4=RxkgAmKZh*x$cp>fkF=VxWD@`fi=
z&6w`wx+g%S6G5&=62i6FWz0otp$XN|xn>gVxub=)>{XB<tSP*%sp#gkNd-yVy*c7(
z$5J>(_DTsubzDtuQ5=T{9hMlZivrly*lScSDsOsrXet0%q!U$!6I5BHXov`ZrQrR@
z=_hs-{&|Y;)(r1;3sQG(@gTFCx;pcZ_PX;697jdsPb)B7sPL1qakbc<QtmWdxIAv!
zTmiy|Q2Y7*lqFBxgaaW3DpJIPQ%h6}Aq0etDG@^h0TK}*0|3PXBS}da5)!}P>D~v1
zK*~RoPj&7;u@aaM5dqM6`hG_dv1L^EAMpfNm<X@=REAO>yYQW|^-tX%dNnWeRoy?J
Pzy2=dig2MIz~qsxrm1(z

diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/Chart.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/Chart.yaml
index 04aba91f..e8f67b95 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/Chart.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/Chart.yaml
@@ -1,7 +1,7 @@
 annotations:
   artifacthub.io/category: monitoring-logging
   artifacthub.io/changes: |
-    - allow setting global labels for each resource using `.Values.global.extraLabels`. See [#2607](https://github.com/VictoriaMetrics/helm-charts/issues/2607).
+    - reverted usage of `app` label in `vm.selectorLabels`
   artifacthub.io/license: Apache-2.0
   artifacthub.io/links: |
     - name: Sources
@@ -11,7 +11,8 @@ annotations:
   artifacthub.io/readme: |
     # VictoriaMetrics Common Helm chart
 
-    Chart documentation is available [here](https://docs.victoriametrics.com/helm/victoria-metrics-common/)
+    Chart documentation is available [here](https://docs.victoriametrics.com/helm/victoria-metrics-common/).
+    Changelog is [here](https://docs.victoriametrics.com/helm/victoria-metrics-common/changelog/).
 apiVersion: v2
 description: VictoriaMetrics Common - contains shared templates for all Victoria Metrics
   helm charts
@@ -29,4 +30,4 @@ name: victoria-metrics-common
 sources:
 - https://github.com/VictoriaMetrics/helm-charts
 type: library
-version: 0.0.46
+version: 0.3.0
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/README.md b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/README.md
index 9ba0b4f5..c8ee7051 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/README.md
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/README.md
@@ -1,3 +1,4 @@
 # VictoriaMetrics Common Helm chart
 
-Chart documentation is available [here](https://docs.victoriametrics.com/helm/victoria-metrics-common/)
+Chart documentation is available [here](https://docs.victoriametrics.com/helm/victoria-metrics-common/).
+Changelog is [here](https://docs.victoriametrics.com/helm/victoria-metrics-common/changelog/).
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/RELEASE_NOTES b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/RELEASE_NOTES
index 055cd4c5..ad0cdfa9 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/RELEASE_NOTES
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/RELEASE_NOTES
@@ -1,7 +1,7 @@
-# Release notes for version 0.0.46
+# Release notes for version 0.3.0
 
-**Release date:** 23 Dec 2025
+**Release date:** 16 Apr 2026
 
 ![Helm: v3](https://img.shields.io/badge/Helm-v3.14%2B-informational?color=informational&logo=helm&link=https%3A%2F%2Fgithub.com%2Fhelm%2Fhelm%2Freleases%2Ftag%2Fv3.14.0)
 
-- allow setting global labels for each resource using `.Values.global.extraLabels`. See [#2607](https://github.com/VictoriaMetrics/helm-charts/issues/2607).
+- reverted usage of `app` label in `vm.selectorLabels`
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_helpers.tpl b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_helpers.tpl
index 99ac30d5..bd945678 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_helpers.tpl
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_helpers.tpl
@@ -125,8 +125,8 @@ If release name contains chart name it will be used as a full name.
     {{- $ctx := . -}}
     {{- $values := $Values -}}
     {{- range $ak := $appKey }}
-      {{- $values = ternary (default dict) (index $values $ak | default dict) (empty $values) -}}
-      {{- $ctx = ternary (default dict) (index $ctx $ak | default dict) (empty $ctx) -}}
+      {{- $values = ternary (dict) (index $values $ak | default dict) (empty $values) -}}
+      {{- $ctx = ternary (dict) (index $ctx $ak | default dict) (empty $ctx) -}}
       {{- if and (empty $values) (empty $ctx) -}}
         {{- fail (printf "No data for appKey %s" (join "->" $appKey)) -}}
       {{- end -}}
@@ -187,6 +187,9 @@ If release name contains chart name it will be used as a full name.
   {{- include "vm.validate.args" . -}}
   {{- $Release := (.helm).Release | default .Release -}}
   {{- $labels := fromYaml (include "vm.selectorLabels" .) -}}
+  {{- with $labels.app -}}
+    {{- $_ := set $labels "app.kubernetes.io/component" . -}}
+  {{- end -}}
   {{- $labels = mergeOverwrite $labels (.extraLabels | default dict) -}}
   {{- $_ := set $labels "app.kubernetes.io/managed-by" $Release.Service -}}
   {{- toYaml $labels -}}
@@ -197,7 +200,7 @@ If release name contains chart name it will be used as a full name.
   {{- include "vm.validate.args" . -}}
   {{- $Values := (.helm).Values | default .Values -}}
   {{- $globalLabels := deepCopy (($Values.global).extraLabels | default dict) -}}
-  {{- $labels := fromYaml (include "vm.selectorLabels" .) -}}
+  {{- $labels := fromYaml (include "vm.commonLabels" .) -}}
   {{- $labels = mergeOverwrite $globalLabels $labels (fromYaml (include "vm.metaLabels" .)) -}}
   {{- with (include "vm.image.tag" .) }}
     {{- $_ := set $labels "app.kubernetes.io/version" (regexReplaceAll "(.*)(@sha.*)" . "${1}") -}}
@@ -231,11 +234,16 @@ If release name contains chart name it will be used as a full name.
   {{- $_ := set $labels "app.kubernetes.io/name" (include "vm.name" .) -}}
   {{- $_ := set $labels "app.kubernetes.io/instance" (include "vm.release" .) -}}
   {{- with (include "vm.app.name" .) -}}
-    {{- if eq $.style "managed" -}}
-      {{- $_ := set $labels "app.kubernetes.io/component" (printf "%s-%s" (include "vm.name" $) .) -}}
-    {{- else -}}
-      {{- $_ := set $labels "app" . -}}
-    {{- end -}}
+    {{- $_ := set $labels "app" . -}}
   {{- end -}}
   {{- toYaml $labels -}}
 {{- end }}
+
+{{- define "vm.commonLabels" -}}
+  {{- $labels := fromYaml (include "vm.selectorLabels" . ) -}}
+  {{- with $labels.app -}}
+    {{- $_ := set $labels "app.kubernetes.io/component" . -}}
+    {{- $_ := unset $labels "app" -}}
+  {{- end -}}
+  {{- toYaml $labels -}}
+{{- end -}}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_image.tpl b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_image.tpl
index 6d30bd03..66d019e3 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_image.tpl
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_image.tpl
@@ -42,8 +42,8 @@ Victoria Metrics Image
   {{- with .appKey -}}
     {{- $appKey := ternary (list .) . (kindIs "string" .) -}}
     {{- range $ak := $appKey -}}
-      {{- $values = ternary (default dict) (index $values $ak | default dict) (empty $values) -}}
-      {{- $ctx = ternary (default dict) (index $ctx $ak | default dict) (empty $ctx) -}}
+      {{- $values = ternary (dict) (index $values $ak | default dict) (empty $values) -}}
+      {{- $ctx = ternary (dict) (index $ctx $ak | default dict) (empty $ctx) -}}
       {{- if and (empty $values) (empty $ctx) -}}
         {{- fail (printf "No data for appKey %s" (join "->" $appKey)) -}}
       {{- end -}}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_pod.tpl b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_pod.tpl
index 7534ae2d..62981dfb 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_pod.tpl
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_pod.tpl
@@ -39,9 +39,9 @@ Render probe
 {{- define "vm.probe" -}}
   {{- /* undefined value */ -}}
   {{- $null := (fromYaml "value: null").value -}}
-  {{- $probe := dig .type (default dict) .app.probe -}}
+  {{- $probe := dig .type (dict) .app.probe -}}
   {{- $probeType := "" -}}
-  {{- $defaultProbe := default dict -}}
+  {{- $defaultProbe := dict -}}
   {{- if ne (dig "httpGet" $null $probe) $null -}}
     {{- /* httpGet probe */ -}}
     {{- $defaultProbe = dict "path" (include "vm.probe.http.path" .) "scheme" (include "vm.probe.http.scheme" .) "port" (include "vm.probe.port" .) -}}
@@ -51,7 +51,7 @@ Render probe
     {{- $defaultProbe = dict "port" (include "vm.probe.port" .) -}}
     {{- $probeType = "tcpSocket" -}}
   {{- end -}}
-  {{- $defaultProbe = ternary (default dict) (dict $probeType $defaultProbe) (empty $probeType) -}}
+  {{- $defaultProbe = ternary (dict) (dict $probeType $defaultProbe) (empty $probeType) -}}
   {{- $probe = mergeOverwrite $defaultProbe $probe -}}
   {{- range $key, $value := $probe -}}
     {{- if and (has (kindOf $value) (list "object" "map")) (ne $key $probeType) -}}
@@ -100,7 +100,7 @@ Net probe port
 command line arguments
 */ -}}
 {{- define "vm.args" -}}
-  {{- $args := default list -}}
+  {{- $args := list -}}
   {{- range $key, $value := . -}}
     {{- if not $key -}}
       {{- fail "Empty key in command line args is not allowed" -}}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_service.tpl b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_service.tpl
index 77a1365f..77cdeee7 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_service.tpl
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_service.tpl
@@ -37,10 +37,10 @@
     {{- $values := $Values -}}
     {{- $ctx := . -}}
     {{- range $ak := $appKey -}}
-      {{- $values = ternary (default dict) (index $values $ak | default dict) (empty $values) -}}
-      {{- $ctx = ternary (default dict) (index $ctx $ak | default dict) (empty $ctx) -}}
+      {{- $values = ternary (dict) (index $values $ak | default dict) (empty $values) -}}
+      {{- $ctx = ternary (dict) (index $ctx $ak | default dict) (empty $ctx) -}}
     {{- end -}}
-    {{- $spec := default dict -}}
+    {{- $spec := dict -}}
     {{- if $ctx -}}
       {{- $spec = $ctx -}}
     {{- else if $values -}}
@@ -69,10 +69,10 @@
     {{- $values := $Values -}}
     {{- $ctx := . -}}
     {{- range $ak := $appKey -}}
-      {{- $values = ternary (default dict) (index $values $ak | default dict) (empty $values) -}}
-      {{- $ctx = ternary (default dict) (index $ctx $ak | default dict) (empty $ctx) -}}
+      {{- $values = ternary (dict) (index $values $ak | default dict) (empty $values) -}}
+      {{- $ctx = ternary (dict) (index $ctx $ak | default dict) (empty $ctx) -}}
     {{- end -}}
-    {{- $spec := default dict -}}
+    {{- $spec := dict -}}
     {{- if $values -}}
       {{- $spec = $values -}}
     {{- else if $ctx -}}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/NOTES.txt b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/NOTES.txt
index 7fb3fbd9..41f39937 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/NOTES.txt
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/NOTES.txt
@@ -1,5 +1,5 @@
 {{ include "vm.name" . }} has been installed. Check its status by running:
-  kubectl --namespace {{ include "vm.namespace" . }} get pods -l "app.kubernetes.io/instance={{ $.Release.Name }}"
+  kubectl --namespace {{ include "vm.namespace" . }} get pods -l "app.kubernetes.io/name={{ include "vm.name" . }}" -l "app.kubernetes.io/instance={{ include "vm.release" . }}"
 
 Get more information on https://github.com/VictoriaMetrics/helm-charts/tree/master/charts/victoria-metrics-operator.
 See "Getting started guide for VM Operator" on https://docs.victoriametrics.com/guides/getting-started-with-vm-operator
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/pdb.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/pdb.yaml
index 8abd9dea..9ec3c2c2 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/pdb.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/pdb.yaml
@@ -18,6 +18,9 @@ spec:
   {{- with $pdb.maxUnavailable }}
   maxUnavailable: {{ . }}
   {{- end }}
+  {{- with $pdb.unhealthyPodEvictionPolicy }}
+  unhealthyPodEvictionPolicy: {{ . }}
+  {{- end }}
   selector:
     matchLabels: {{ include "vm.selectorLabels" $ctx | nindent 6 }}
 {{- end }}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/server.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/server.yaml
index e224c074..9d7fd7ed 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/server.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/server.yaml
@@ -18,9 +18,12 @@ metadata:
   annotations: {{ toYaml . | nindent 4 }}
   {{- end }}
 spec:
-  replicas: {{.Values.replicaCount }}
+  replicas: {{ .Values.replicaCount }}
   selector:
     matchLabels: {{ include "vm.selectorLabels" $ctx | nindent 6 }}
+  {{- with .Values.strategy }}
+  strategy: {{ toYaml . | nindent 4 }}
+  {{- end }}
   template:
     metadata:
       {{- with .Values.annotations }}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml
index 51039cae..e38f7448 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml
@@ -1,22 +1,31 @@
-{{- if .Values.admissionWebhooks.enabled }}
+{{- $webhooks := .Values.admissionWebhooks }}
+{{- if $webhooks.enabled }}
 {{- $ctx := dict "helm" . "extraLabels" .Values.extraLabels }}
 {{- $tls := fromYaml (include "vm-operator.certs" $ctx) }}
 {{- $fullname := include "vm.plain.fullname" $ctx }}
 {{- $domain := ((.Values.global).cluster).dnsDomain }}
 {{- $ns := include "vm.namespace" $ctx }}
-{{- $certManager := .Values.admissionWebhooks.certManager }}
+{{- $certManager := $webhooks.certManager }}
 {{- $files := .Files }}
 {{- $crds := $files.Get "crd.yaml" | splitList "---" }}
-{{- $disabledFor := .Values.admissionWebhooks.disabledFor | default list }}
+{{- $disabledFor := $webhooks.disabledFor | default list }}
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
   name:  {{ $fullname }}-admission
-  {{- if $certManager.enabled }}
+  {{- if or $certManager.enabled $webhooks.annotations }}
   annotations:
+    {{- if $certManager.enabled }}
     certmanager.k8s.io/inject-ca-from: {{ printf "%s/%s-validation" $ns $fullname | quote }}
     cert-manager.io/inject-ca-from: {{ printf "%s/%s-validation" $ns $fullname | quote }}
+    {{- end }}
+    {{- with $certManager.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with $webhooks.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
   {{- end }}
   labels: {{ include "vm.labels" $ctx | nindent 4 }}
 webhooks:
@@ -34,7 +43,7 @@ webhooks:
       {{- if not $certManager.enabled }}
       caBundle: {{ $tls.caCert }}
       {{- end }}
-    failurePolicy: {{ $.Values.admissionWebhooks.policy }}
+    failurePolicy: {{ $webhooks.policy }}
     name: '{{ $crd.metadata.name }}'
     admissionReviewVersions:
       - v1
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/values.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/values.yaml
index 279ceee9..3a1027f2 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/values.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/values.yaml
@@ -125,7 +125,7 @@ crds:
     #   whenUnsatisfiable: DoNotSchedule
     #   labelSelector:
     #     matchLabels:
-    #       app: alertmanager
+    #       app.kubernetes.io/component: alertmanager
 
     # -- Labels to add to the upgrade job
     labels: {}
@@ -276,8 +276,12 @@ service:
 # -- See `kubectl explain poddisruptionbudget.spec` for more or check [these docs](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
 podDisruptionBudget:
   enabled: false
-  # minAvailable: 1
-  # maxUnavailable: 1
+  # -- min number or percentage of pods that can be unavailable
+  minAvailable: 0
+  # -- max number or percentage of pods that can be unavailable
+  maxUnavailable: 0
+  # -- Defines criteria when unhealthy pods should be considered for eviction
+  unhealthyPodEvictionPolicy:
   labels: {}
 
 # -- Graceful pod termination timeout. See [this article](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#hook-handler-execution) for details.
@@ -299,6 +303,13 @@ resources:
 # -- Pod's node selector. Details are [here](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector)
 nodeSelector: {}
 
+# -- Deployment strategy, set to standard k8s default
+strategy:
+  type: RollingUpdate
+  rollingUpdate:
+    maxSurge: 25%
+    maxUnavailable: 25%
+
 # -- Name of Priority Class
 priorityClassName: ""
 
@@ -364,6 +375,8 @@ shareProcessNamespace: false
 admissionWebhooks:
   # -- Enables validation webhook.
   enabled: true
+  # -- Annotations for webhook. Can be used to define Helm or ArgoCD annotations.
+  annotations: {}
   # -- List of CRD names to disable validation for
   disabledFor: []
   # - vmagent

From e8806fcc6fdec075325352c4dfe7fde7ddb0552a Mon Sep 17 00:00:00 2001
From: "cozystack-ci[bot]"
 <274107086+cozystack-ci[bot]@users.noreply.github.com>
Date: Tue, 21 Apr 2026 01:42:32 +0000
Subject: [PATCH 555/666] docs: add changelog for v1.2.3

Signed-off-by: cozystack-ci[bot] <274107086+cozystack-ci[bot]@users.noreply.github.com>
---
 docs/changelogs/v1.2.3.md | 58 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 docs/changelogs/v1.2.3.md

diff --git a/docs/changelogs/v1.2.3.md b/docs/changelogs/v1.2.3.md
new file mode 100644
index 00000000..6d1b3b74
--- /dev/null
+++ b/docs/changelogs/v1.2.3.md
@@ -0,0 +1,58 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.2.3
+-->
+
+# v1.2.3 (2026-04-20)
+
+A patch release with bug fixes and documentation updates.
+
+## Features and Improvements
+
+_No notable features in this patch release._
+
+## Fixes
+
+* **fix(kubernetes): set explicit ephemeral-storage on virt-launcher pods**: Prevents VM crashes caused by ephemeral-storage eviction by setting explicit `domain.resources` ephemeral-storage on the VirtualMachine spec. Uses sanitized limits and requests so virt-launcher pods do not inherit too-small namespace defaults. ([**@kvaps**](https://github.com/kvaps) in #2317, backport #2423).
+
+## Documentation
+
+* **[website] feat: add Telemetry page under OSS Health section**: Add Telemetry page and initial data seeding to OSS Health docs ([**@tym83**](https://github.com/tym83) in cozystack/website#471).
+* **[website] Refactor docs versions to major.minor variants**: Move docs to major.minor versioning for v1.x series ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#477).
+* **[website] docs(tenants): document namespace layout and parent/child derivation** ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#479).
+* **[website] docs(tenants): document the checkbox-then-edit-CR customization pattern** ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#485).
+* **[website] docs: fix 14 broken links and stale talm anchor across v1 docs** ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#486).
+* **[website] fix(og): update social badge image and title** ([**@tym83**](https://github.com/tym83) in cozystack/website#487).
+* **[website] docs(external-apps): rewrite guide for ApplicationDefinition API** ([**@kitsunoff**](https://github.com/kitsunoff) in cozystack/website#488).
+* **[website] docs: add CLAUDE.md for AI agent guidance** ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#489).
+* **[website] fix: update /docs/v1/ redirect to latest v1.2** ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#492).
+* **[website] fix(ci): add OpenAPI spec download to GitHub Pages build** ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#494).
+* **[website] feat(blog): add managed PostgreSQL with synchronous replication post** ([**@tym83**](https://github.com/tym83) in cozystack/website#497).
+* **[website] chore(blog): add images frontmatter for social preview on existing posts** ([**@tym83**](https://github.com/tym83) in cozystack/website#498).
+* **[website] feat(blog): taxonomies and client-side filter UI** ([**@tym83**](https://github.com/tym83) in cozystack/website#499).
+* **[website] style(oss-health): add breathing room between navbar and hero** ([**@tym83**](https://github.com/tym83) in cozystack/website#500).
+
+## Other repositories
+
+* **[talm] feat(config): migrate to Talos v1.12 multi-document config format**: Upgrade Talos config format and modernize configuration handling ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#116).
+* **[talm] chore(deps): bump dependencies and modernize codebase** ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#124).
+* **[external-apps-example] feat: replace MongoDB example with Minecraft apps from cozylex** ([**@lexfrei**](https://github.com/lexfrei) in cozystack/external-apps-example#2).
+* **[ansible-cozystack] fix(examples): add v prefix to collection version in requirements.yml** ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#23).
+* **[ansible-cozystack] fix(plugins): replace ansible.utils.ipaddr with stdlib-based test plugin** ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#24).
+* **[ansible-cozystack] feat(examples): comprehensive node prerequisites audit (fixes #19)** ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#27).
+* **[ansible-cozystack] chore(deps): update dependency cozystack.installer to v1.2.3** ([**@app/renovate**](https://github.com/apps/renovate) in cozystack/ansible-cozystack#29).
+* **[ansible-cozystack] feat(role): expose publishing.externalIPs and tenant-root ingress via role variables** ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#30).
+
+## Contributors
+
+Thanks to everyone who contributed to this patch release:
+
+* [**@app/github-actions**](https://github.com/apps/github-actions)
+* [**@app/renovate**](https://github.com/apps/renovate)
+* [**@kitsunoff**](https://github.com/kitsunoff)
+* [**@kvaps**](https://github.com/kvaps)
+* [**@lexfrei**](https://github.com/lexfrei)
+* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
+* [**@tym83**](https://github.com/tym83)
+
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.2.2...v1.2.3

From ac14df54d4cdaa75842d4f1e058a10f3ed754229 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Tue, 21 Apr 2026 08:54:41 +0500
Subject: [PATCH 556/666] ci(docs): promote next/ trunk on new minor/major
 releases
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The website repo is switching to a permanent `content/en/docs/next/`
trunk (cozystack/website#495). Released version directories are no
longer pre-created — the upstream release workflow is now responsible
for explicitly promoting `next/` → `vX.Y/` on new minor/major releases
via `make release-next`.

Update the `update-website-docs` job to match that contract:

- New `Determine if this release promotes next/` step parses the tag
  and only enables promotion for final `vX.Y.Z` tags where
  `content/en/docs/vX.Y/` does not already exist. Prereleases and
  patch releases keep the old behaviour (target routing is handled
  by the website Makefile on its own).
- New `Promote next/ to released version` step runs
  `make release-next RELEASE_TAG=...` before `make update-all`, so
  the subsequent `update-all` routes into the freshly-created
  `vX.Y/` directory and `next/` stays untouched as the trunk for
  the following release.
- `git add content hugo.yaml` to pick up the version registration
  that `release-next` writes via `register_version.sh`.
- Convert the existing `update-all` step to use `env:` vars,
  matching the new step and addressing the workflow-injection
  hardening guidance.

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .github/workflows/tags.yaml | 45 +++++++++++++++++++++++++++++++++++--
 1 file changed, 43 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/tags.yaml b/.github/workflows/tags.yaml
index d698333e..b10897cf 100644
--- a/.github/workflows/tags.yaml
+++ b/.github/workflows/tags.yaml
@@ -441,17 +441,58 @@ jobs:
           token: ${{ steps.app-token.outputs.token }}
           ref: main
 
+      # Decide whether this release promotes the `next/` trunk to a new released
+      # version directory. Per the website repo's contract (see website#495):
+      #   - `make release-next` runs only for new minor/major final releases
+      #     (tag matches `vX.Y.Z` with no prerelease suffix AND `vX.Y/` does
+      #     not yet exist on disk).
+      #   - Prereleases and patch releases skip this step and let
+      #     `make update-all` handle routing on its own.
+      - name: Determine if this release promotes next/
+        id: promote
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          if [[ ! "$TAG" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+            echo "promote=false" >> "$GITHUB_OUTPUT"
+            echo "Prerelease tag '$TAG' — skipping release-next."
+            exit 0
+          fi
+          MAJOR="${BASH_REMATCH[1]}"
+          MINOR="${BASH_REMATCH[2]}"
+          if [[ "$MAJOR" == "0" ]]; then
+            DOC_VERSION="v0"
+          else
+            DOC_VERSION="v${MAJOR}.${MINOR}"
+          fi
+          if [[ -d "content/en/docs/${DOC_VERSION}" ]]; then
+            echo "promote=false" >> "$GITHUB_OUTPUT"
+            echo "content/en/docs/${DOC_VERSION}/ already exists — patch release, skipping release-next."
+          else
+            echo "promote=true" >> "$GITHUB_OUTPUT"
+            echo "New minor/major release ${DOC_VERSION} — will promote next/ → ${DOC_VERSION}/."
+          fi
+
+      - name: Promote next/ to released version
+        if: steps.promote.outputs.promote == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: make release-next RELEASE_TAG="$TAG"
+
       - name: Update docs from release branch
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: make update-all BRANCH=release-${{ steps.tag.outputs.version }} RELEASE_TAG=${{ steps.tag.outputs.tag }}
+          TAG: ${{ steps.tag.outputs.tag }}
+          VERSION: ${{ steps.tag.outputs.version }}
+        run: make update-all BRANCH="release-$VERSION" RELEASE_TAG="$TAG"
 
       - name: Commit and push
         id: commit
         run: |
           git config user.name  "cozystack-ci[bot]"
           git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"
-          git add content
+          git add content hugo.yaml
           if git diff --cached --quiet; then
             echo "No changes to commit"
             echo "changed=false" >> $GITHUB_OUTPUT

From a133fa30ddb8ead7d8ad7491dce997a818909289 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Tue, 21 Apr 2026 14:31:07 +0500
Subject: [PATCH 557/666] chore(maintenance): add @myasnikovdaniil to
 CODEOWNERS

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .github/CODEOWNERS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 2045ec5a..2482712d 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1 +1 @@
-* @kvaps @lllamnyp @lexfrei @androndo @IvanHunters @sircthulhu
+* @kvaps @lllamnyp @lexfrei @androndo @IvanHunters @sircthulhu @myasnikovdaniil

From 531bc00524be0789ba99e2082234a1104e010b51 Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Wed, 8 Apr 2026 22:17:34 +0300
Subject: [PATCH 558/666] feat(postgres): add serverName parameter for backup
 recovery

Add serverName field to bootstrap configuration to explicitly specify
Barman server name from backup.info. This fixes "no target backup found"
errors when server_name in backup.info differs from Kubernetes cluster name.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 api/apps/v1alpha1/postgresql/types.go             |  5 ++++-
 packages/apps/postgres/README.md                  | 13 +++++++------
 packages/apps/postgres/templates/db.yaml          |  3 +++
 packages/apps/postgres/values.schema.json         |  7 ++++++-
 packages/apps/postgres/values.yaml                |  4 +++-
 packages/system/postgres-rd/cozyrds/postgres.yaml |  4 ++--
 6 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/api/apps/v1alpha1/postgresql/types.go b/api/apps/v1alpha1/postgresql/types.go
index fa85d51f..56580018 100644
--- a/api/apps/v1alpha1/postgresql/types.go
+++ b/api/apps/v1alpha1/postgresql/types.go
@@ -86,12 +86,15 @@ type Bootstrap struct {
 	// Whether to restore from a backup.
 	// +kubebuilder:default:=false
 	Enabled bool `json:"enabled"`
-	// Previous cluster name before deletion.
+	// Previous cluster name before deletion (matches serverName in backup.info).
 	// +kubebuilder:default:=""
 	OldName string `json:"oldName"`
 	// Timestamp (RFC3339) for point-in-time recovery; empty means latest.
 	// +kubebuilder:default:=""
 	RecoveryTime string `json:"recoveryTime,omitempty"`
+	// Barman server name from the old cluster's backup.info. Use when the original cluster used a different serverName than its Kubernetes cluster name.
+	// +kubebuilder:default:=""
+	ServerName string `json:"serverName,omitempty"`
 }
 
 type Database struct {
diff --git a/packages/apps/postgres/README.md b/packages/apps/postgres/README.md
index 5a550f7a..648b3d71 100644
--- a/packages/apps/postgres/README.md
+++ b/packages/apps/postgres/README.md
@@ -133,12 +133,13 @@ See:
 
 ### Bootstrap (recovery) parameters
 
-| Name                     | Description                                                         | Type     | Value   |
-| ------------------------ | ------------------------------------------------------------------- | -------- | ------- |
-| `bootstrap`              | Bootstrap configuration.                                            | `object` | `{}`    |
-| `bootstrap.enabled`      | Whether to restore from a backup.                                   | `bool`   | `false` |
-| `bootstrap.recoveryTime` | Timestamp (RFC3339) for point-in-time recovery; empty means latest. | `string` | `""`    |
-| `bootstrap.oldName`      | Previous cluster name before deletion.                              | `string` | `""`    |
+| Name                     | Description                                                                                                                                        | Type     | Value   |
+| ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------- |
+| `bootstrap`              | Bootstrap configuration.                                                                                                                           | `object` | `{}`    |
+| `bootstrap.enabled`      | Whether to restore from a backup.                                                                                                                  | `bool`   | `false` |
+| `bootstrap.recoveryTime` | Timestamp (RFC3339) for point-in-time recovery; empty means latest.                                                                                | `string` | `""`    |
+| `bootstrap.oldName`      | Previous cluster name before deletion (matches serverName in backup.info).                                                                         | `string` | `""`    |
+| `bootstrap.serverName`   | Barman server name from the old cluster's backup.info. Use when the original cluster used a different serverName than its Kubernetes cluster name. | `string` | `""`    |
 
 
 ## Parameter examples and reference
diff --git a/packages/apps/postgres/templates/db.yaml b/packages/apps/postgres/templates/db.yaml
index 5c40b2c7..2cdaec1d 100644
--- a/packages/apps/postgres/templates/db.yaml
+++ b/packages/apps/postgres/templates/db.yaml
@@ -32,6 +32,9 @@ spec:
     - name: {{ .Values.bootstrap.oldName }}
       barmanObjectStore:
         destinationPath: {{ .Values.backup.destinationPath }}
+        {{- if .Values.bootstrap.serverName }}
+        serverName: {{ .Values.bootstrap.serverName }}
+        {{- end }}
         endpointURL: {{ .Values.backup.endpointURL }}
         s3Credentials:
           accessKeyId:
diff --git a/packages/apps/postgres/values.schema.json b/packages/apps/postgres/values.schema.json
index b2a4aeba..28acc5a3 100644
--- a/packages/apps/postgres/values.schema.json
+++ b/packages/apps/postgres/values.schema.json
@@ -246,7 +246,7 @@
           "default": false
         },
         "oldName": {
-          "description": "Previous cluster name before deletion.",
+          "description": "Previous cluster name before deletion (matches serverName in backup.info).",
           "type": "string",
           "default": ""
         },
@@ -254,6 +254,11 @@
           "description": "Timestamp (RFC3339) for point-in-time recovery; empty means latest.",
           "type": "string",
           "default": ""
+        },
+        "serverName": {
+          "description": "Barman server name from the old cluster's backup.info. Use when the original cluster used a different serverName than its Kubernetes cluster name.",
+          "type": "string",
+          "default": ""
         }
       }
     }
diff --git a/packages/apps/postgres/values.yaml b/packages/apps/postgres/values.yaml
index b8f07f63..a4a4bf86 100644
--- a/packages/apps/postgres/values.yaml
+++ b/packages/apps/postgres/values.yaml
@@ -153,7 +153,8 @@ backup:
 ## @typedef {struct} Bootstrap - Bootstrap configuration for restoring a database cluster from a backup.
 ## @field {bool} enabled - Whether to restore from a backup.
 ## @field {string} [recoveryTime] - Timestamp (RFC3339) for point-in-time recovery; empty means latest.
-## @field {string} oldName - Previous cluster name before deletion.
+## @field {string} oldName - Previous cluster name before deletion (matches serverName in backup.info).
+## @field {string} [serverName] - Barman server name from the old cluster's backup.info. Use when the original cluster used a different serverName than its Kubernetes cluster name.
 
 ## @param {Bootstrap} bootstrap - Bootstrap configuration.
 bootstrap:
@@ -161,3 +162,4 @@ bootstrap:
   # example: 2020-11-26 15:22:00.00000+00
   recoveryTime: ""
   oldName: ""
+  serverName: ""
diff --git a/packages/system/postgres-rd/cozyrds/postgres.yaml b/packages/system/postgres-rd/cozyrds/postgres.yaml
index c74c5783..41457db4 100644
--- a/packages/system/postgres-rd/cozyrds/postgres.yaml
+++ b/packages/system/postgres-rd/cozyrds/postgres.yaml
@@ -8,7 +8,7 @@ spec:
     singular: postgres
     plural: postgreses
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of Postgres replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each PostgreSQL replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"version":{"description":"PostgreSQL major version to deploy","type":"string","default":"v18","enum":["v18","v17","v16","v15","v14","v13"]},"postgresql":{"description":"PostgreSQL server configuration.","type":"object","default":{},"properties":{"parameters":{"description":"PostgreSQL server parameters.","type":"object","default":{},"properties":{"max_connections":{"description":"Maximum number of concurrent connections to the database server.","type":"integer","default":100}}}}},"quorum":{"description":"Quorum configuration for synchronous replication.","type":"object","default":{},"required":["maxSyncReplicas","minSyncReplicas"],"properties":{"maxSyncReplicas":{"description":"Maximum number of synchronous replicas allowed (must be less than total replicas).","type":"integer","default":0},"minSyncReplicas":{"description":"Minimum number of synchronous replicas required for commit.","type":"integer","default":0}}},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"},"replication":{"description":"Whether the user has replication privileges.","type":"boolean"}}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"extensions":{"description":"List of enabled PostgreSQL extensions.","type":"array","items":{"type":"string"}},"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["enabled"],"properties":{"destinationPath":{"description":"Destination path for backups (e.g. s3://bucket/path/).","type":"string","default":"s3://bucket/path/to/folder/"},"enabled":{"description":"Enable regular backups.","type":"boolean","default":false},"endpointURL":{"description":"S3 endpoint URL for uploads.","type":"string","default":"http://minio-gateway-service:9000"},"retentionPolicy":{"description":"Retention policy (e.g. \"30d\").","type":"string","default":"30d"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":"<your-access-key>"},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":"<your-secret-key>"},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * * *"}}},"bootstrap":{"description":"Bootstrap configuration.","type":"object","default":{},"required":["enabled","oldName"],"properties":{"enabled":{"description":"Whether to restore from a backup.","type":"boolean","default":false},"oldName":{"description":"Previous cluster name before deletion.","type":"string","default":""},"recoveryTime":{"description":"Timestamp (RFC3339) for point-in-time recovery; empty means latest.","type":"string","default":""}}}}}
+      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of Postgres replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each PostgreSQL replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"version":{"description":"PostgreSQL major version to deploy","type":"string","default":"v18","enum":["v18","v17","v16","v15","v14","v13"]},"postgresql":{"description":"PostgreSQL server configuration.","type":"object","default":{},"properties":{"parameters":{"description":"PostgreSQL server parameters.","type":"object","default":{},"properties":{"max_connections":{"description":"Maximum number of concurrent connections to the database server.","type":"integer","default":100}}}}},"quorum":{"description":"Quorum configuration for synchronous replication.","type":"object","default":{},"required":["maxSyncReplicas","minSyncReplicas"],"properties":{"maxSyncReplicas":{"description":"Maximum number of synchronous replicas allowed (must be less than total replicas).","type":"integer","default":0},"minSyncReplicas":{"description":"Minimum number of synchronous replicas required for commit.","type":"integer","default":0}}},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"},"replication":{"description":"Whether the user has replication privileges.","type":"boolean"}}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"extensions":{"description":"List of enabled PostgreSQL extensions.","type":"array","items":{"type":"string"}},"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["enabled"],"properties":{"destinationPath":{"description":"Destination path for backups (e.g. s3://bucket/path/).","type":"string","default":"s3://bucket/path/to/folder/"},"enabled":{"description":"Enable regular backups.","type":"boolean","default":false},"endpointURL":{"description":"S3 endpoint URL for uploads.","type":"string","default":"http://minio-gateway-service:9000"},"retentionPolicy":{"description":"Retention policy (e.g. \"30d\").","type":"string","default":"30d"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":"<your-access-key>"},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":"<your-secret-key>"},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * * *"}}},"bootstrap":{"description":"Bootstrap configuration.","type":"object","default":{},"required":["enabled","oldName"],"properties":{"enabled":{"description":"Whether to restore from a backup.","type":"boolean","default":false},"oldName":{"description":"Previous cluster name before deletion (matches serverName in backup.info).","type":"string","default":""},"recoveryTime":{"description":"Timestamp (RFC3339) for point-in-time recovery; empty means latest.","type":"string","default":""},"serverName":{"description":"Barman server name from the old cluster's backup.info. Use when the original cluster used a different serverName than its Kubernetes cluster name.","type":"string","default":""}}}}}
   release:
     prefix: postgres-
     labels:
@@ -33,7 +33,7 @@ spec:
     #    labelSelector:
     #      helm.toolkit.fluxcd.io/name: "{reqs[0]['metadata','name']}"
 
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "replicas"], ["spec", "resources"], ["spec", "resourcesPreset"], ["spec", "size"], ["spec", "storageClass"], ["spec", "external"], ["spec", "version"], ["spec", "postgresql"], ["spec", "postgresql", "parameters"], ["spec", "postgresql", "parameters", "max_connections"], ["spec", "quorum"], ["spec", "quorum", "minSyncReplicas"], ["spec", "quorum", "maxSyncReplicas"], ["spec", "users"], ["spec", "databases"], ["spec", "backup"], ["spec", "backup", "enabled"], ["spec", "backup", "retentionPolicy"], ["spec", "backup", "destinationPath"], ["spec", "backup", "endpointURL"], ["spec", "backup", "schedule"], ["spec", "backup", "s3AccessKey"], ["spec", "backup", "s3SecretKey"], ["spec", "bootstrap"], ["spec", "bootstrap", "enabled"], ["spec", "bootstrap", "recoveryTime"], ["spec", "bootstrap", "oldName"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "replicas"], ["spec", "resources"], ["spec", "resourcesPreset"], ["spec", "size"], ["spec", "storageClass"], ["spec", "external"], ["spec", "version"], ["spec", "postgresql"], ["spec", "postgresql", "parameters"], ["spec", "postgresql", "parameters", "max_connections"], ["spec", "quorum"], ["spec", "quorum", "minSyncReplicas"], ["spec", "quorum", "maxSyncReplicas"], ["spec", "users"], ["spec", "databases"], ["spec", "backup"], ["spec", "backup", "enabled"], ["spec", "backup", "retentionPolicy"], ["spec", "backup", "destinationPath"], ["spec", "backup", "endpointURL"], ["spec", "backup", "schedule"], ["spec", "backup", "s3AccessKey"], ["spec", "backup", "s3SecretKey"], ["spec", "bootstrap"], ["spec", "bootstrap", "enabled"], ["spec", "bootstrap", "recoveryTime"], ["spec", "bootstrap", "oldName"], ["spec", "bootstrap", "serverName"]]
   secrets:
     exclude: []
     include:

From 9f41dc3228b18308f9cd6819a8b2470778f27f0c Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Tue, 21 Apr 2026 13:17:32 +0300
Subject: [PATCH 559/666] docs(postgres): clarify bootstrap field descriptions

Update oldName and serverName field descriptions based on code review
feedback to avoid confusion about their actual roles:

- oldName: Remove misleading "(matches serverName in backup.info)"
  text. This field represents the Kubernetes cluster resource name,
  not the Barman server name.

- serverName: Provide clearer explanation that it's the S3 path prefix
  (barmanObjectStore.serverName) used by the original cluster, and should
  only be set when it differs from the Kubernetes resource name.

Updated in:
- values.yaml (source of truth for field documentation)
- types.go (Go API type comments)
- values.schema.json (JSON schema for validation)
- postgres.yaml (CRD with embedded OpenAPI schema)

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 api/apps/v1alpha1/postgresql/types.go             |  4 ++--
 api/backups/v1alpha1/zz_generated.deepcopy.go     |  5 +++++
 packages/apps/postgres/README.md                  | 14 +++++++-------
 packages/apps/postgres/values.schema.json         |  4 ++--
 packages/apps/postgres/values.yaml                |  4 ++--
 packages/system/postgres-rd/cozyrds/postgres.yaml |  2 +-
 6 files changed, 19 insertions(+), 14 deletions(-)

diff --git a/api/apps/v1alpha1/postgresql/types.go b/api/apps/v1alpha1/postgresql/types.go
index 56580018..a2ff77a8 100644
--- a/api/apps/v1alpha1/postgresql/types.go
+++ b/api/apps/v1alpha1/postgresql/types.go
@@ -86,13 +86,13 @@ type Bootstrap struct {
 	// Whether to restore from a backup.
 	// +kubebuilder:default:=false
 	Enabled bool `json:"enabled"`
-	// Previous cluster name before deletion (matches serverName in backup.info).
+	// Previous cluster name before deletion.
 	// +kubebuilder:default:=""
 	OldName string `json:"oldName"`
 	// Timestamp (RFC3339) for point-in-time recovery; empty means latest.
 	// +kubebuilder:default:=""
 	RecoveryTime string `json:"recoveryTime,omitempty"`
-	// Barman server name from the old cluster's backup.info. Use when the original cluster used a different serverName than its Kubernetes cluster name.
+	// Barman server name (S3 path prefix) used by the original cluster when writing backups. Set this only when the original cluster had an explicit barmanObjectStore.serverName that differed from its Kubernetes resource name.
 	// +kubebuilder:default:=""
 	ServerName string `json:"serverName,omitempty"`
 }
diff --git a/api/backups/v1alpha1/zz_generated.deepcopy.go b/api/backups/v1alpha1/zz_generated.deepcopy.go
index 89f6171f..61b8f839 100644
--- a/api/backups/v1alpha1/zz_generated.deepcopy.go
+++ b/api/backups/v1alpha1/zz_generated.deepcopy.go
@@ -620,6 +620,11 @@ func (in *RestoreJobSpec) DeepCopyInto(out *RestoreJobSpec) {
 		*out = new(v1.TypedLocalObjectReference)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.Options != nil {
+		in, out := &in.Options, &out.Options
+		*out = new(runtime.RawExtension)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RestoreJobSpec.
diff --git a/packages/apps/postgres/README.md b/packages/apps/postgres/README.md
index 648b3d71..4cda7284 100644
--- a/packages/apps/postgres/README.md
+++ b/packages/apps/postgres/README.md
@@ -133,13 +133,13 @@ See:
 
 ### Bootstrap (recovery) parameters
 
-| Name                     | Description                                                                                                                                        | Type     | Value   |
-| ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------- |
-| `bootstrap`              | Bootstrap configuration.                                                                                                                           | `object` | `{}`    |
-| `bootstrap.enabled`      | Whether to restore from a backup.                                                                                                                  | `bool`   | `false` |
-| `bootstrap.recoveryTime` | Timestamp (RFC3339) for point-in-time recovery; empty means latest.                                                                                | `string` | `""`    |
-| `bootstrap.oldName`      | Previous cluster name before deletion (matches serverName in backup.info).                                                                         | `string` | `""`    |
-| `bootstrap.serverName`   | Barman server name from the old cluster's backup.info. Use when the original cluster used a different serverName than its Kubernetes cluster name. | `string` | `""`    |
+| Name                     | Description                                                                                                                                                                                                                  | Type     | Value   |
+| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------- |
+| `bootstrap`              | Bootstrap configuration.                                                                                                                                                                                                     | `object` | `{}`    |
+| `bootstrap.enabled`      | Whether to restore from a backup.                                                                                                                                                                                            | `bool`   | `false` |
+| `bootstrap.recoveryTime` | Timestamp (RFC3339) for point-in-time recovery; empty means latest.                                                                                                                                                          | `string` | `""`    |
+| `bootstrap.oldName`      | Previous cluster name before deletion.                                                                                                                                                                                       | `string` | `""`    |
+| `bootstrap.serverName`   | Barman server name (S3 path prefix) used by the original cluster when writing backups. Set this only when the original cluster had an explicit barmanObjectStore.serverName that differed from its Kubernetes resource name. | `string` | `""`    |
 
 
 ## Parameter examples and reference
diff --git a/packages/apps/postgres/values.schema.json b/packages/apps/postgres/values.schema.json
index 28acc5a3..98e29822 100644
--- a/packages/apps/postgres/values.schema.json
+++ b/packages/apps/postgres/values.schema.json
@@ -246,7 +246,7 @@
           "default": false
         },
         "oldName": {
-          "description": "Previous cluster name before deletion (matches serverName in backup.info).",
+          "description": "Previous cluster name before deletion.",
           "type": "string",
           "default": ""
         },
@@ -256,7 +256,7 @@
           "default": ""
         },
         "serverName": {
-          "description": "Barman server name from the old cluster's backup.info. Use when the original cluster used a different serverName than its Kubernetes cluster name.",
+          "description": "Barman server name (S3 path prefix) used by the original cluster when writing backups. Set this only when the original cluster had an explicit barmanObjectStore.serverName that differed from its Kubernetes resource name.",
           "type": "string",
           "default": ""
         }
diff --git a/packages/apps/postgres/values.yaml b/packages/apps/postgres/values.yaml
index a4a4bf86..2ceaa9cf 100644
--- a/packages/apps/postgres/values.yaml
+++ b/packages/apps/postgres/values.yaml
@@ -153,8 +153,8 @@ backup:
 ## @typedef {struct} Bootstrap - Bootstrap configuration for restoring a database cluster from a backup.
 ## @field {bool} enabled - Whether to restore from a backup.
 ## @field {string} [recoveryTime] - Timestamp (RFC3339) for point-in-time recovery; empty means latest.
-## @field {string} oldName - Previous cluster name before deletion (matches serverName in backup.info).
-## @field {string} [serverName] - Barman server name from the old cluster's backup.info. Use when the original cluster used a different serverName than its Kubernetes cluster name.
+## @field {string} oldName - Previous cluster name before deletion.
+## @field {string} [serverName] - Barman server name (S3 path prefix) used by the original cluster when writing backups. Set this only when the original cluster had an explicit barmanObjectStore.serverName that differed from its Kubernetes resource name.
 
 ## @param {Bootstrap} bootstrap - Bootstrap configuration.
 bootstrap:
diff --git a/packages/system/postgres-rd/cozyrds/postgres.yaml b/packages/system/postgres-rd/cozyrds/postgres.yaml
index 41457db4..72d013f1 100644
--- a/packages/system/postgres-rd/cozyrds/postgres.yaml
+++ b/packages/system/postgres-rd/cozyrds/postgres.yaml
@@ -8,7 +8,7 @@ spec:
     singular: postgres
     plural: postgreses
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of Postgres replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each PostgreSQL replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"version":{"description":"PostgreSQL major version to deploy","type":"string","default":"v18","enum":["v18","v17","v16","v15","v14","v13"]},"postgresql":{"description":"PostgreSQL server configuration.","type":"object","default":{},"properties":{"parameters":{"description":"PostgreSQL server parameters.","type":"object","default":{},"properties":{"max_connections":{"description":"Maximum number of concurrent connections to the database server.","type":"integer","default":100}}}}},"quorum":{"description":"Quorum configuration for synchronous replication.","type":"object","default":{},"required":["maxSyncReplicas","minSyncReplicas"],"properties":{"maxSyncReplicas":{"description":"Maximum number of synchronous replicas allowed (must be less than total replicas).","type":"integer","default":0},"minSyncReplicas":{"description":"Minimum number of synchronous replicas required for commit.","type":"integer","default":0}}},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"},"replication":{"description":"Whether the user has replication privileges.","type":"boolean"}}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"extensions":{"description":"List of enabled PostgreSQL extensions.","type":"array","items":{"type":"string"}},"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["enabled"],"properties":{"destinationPath":{"description":"Destination path for backups (e.g. s3://bucket/path/).","type":"string","default":"s3://bucket/path/to/folder/"},"enabled":{"description":"Enable regular backups.","type":"boolean","default":false},"endpointURL":{"description":"S3 endpoint URL for uploads.","type":"string","default":"http://minio-gateway-service:9000"},"retentionPolicy":{"description":"Retention policy (e.g. \"30d\").","type":"string","default":"30d"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":"<your-access-key>"},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":"<your-secret-key>"},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * * *"}}},"bootstrap":{"description":"Bootstrap configuration.","type":"object","default":{},"required":["enabled","oldName"],"properties":{"enabled":{"description":"Whether to restore from a backup.","type":"boolean","default":false},"oldName":{"description":"Previous cluster name before deletion (matches serverName in backup.info).","type":"string","default":""},"recoveryTime":{"description":"Timestamp (RFC3339) for point-in-time recovery; empty means latest.","type":"string","default":""},"serverName":{"description":"Barman server name from the old cluster's backup.info. Use when the original cluster used a different serverName than its Kubernetes cluster name.","type":"string","default":""}}}}}
+      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of Postgres replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each PostgreSQL replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"version":{"description":"PostgreSQL major version to deploy","type":"string","default":"v18","enum":["v18","v17","v16","v15","v14","v13"]},"postgresql":{"description":"PostgreSQL server configuration.","type":"object","default":{},"properties":{"parameters":{"description":"PostgreSQL server parameters.","type":"object","default":{},"properties":{"max_connections":{"description":"Maximum number of concurrent connections to the database server.","type":"integer","default":100}}}}},"quorum":{"description":"Quorum configuration for synchronous replication.","type":"object","default":{},"required":["maxSyncReplicas","minSyncReplicas"],"properties":{"maxSyncReplicas":{"description":"Maximum number of synchronous replicas allowed (must be less than total replicas).","type":"integer","default":0},"minSyncReplicas":{"description":"Minimum number of synchronous replicas required for commit.","type":"integer","default":0}}},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"},"replication":{"description":"Whether the user has replication privileges.","type":"boolean"}}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"extensions":{"description":"List of enabled PostgreSQL extensions.","type":"array","items":{"type":"string"}},"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["enabled"],"properties":{"destinationPath":{"description":"Destination path for backups (e.g. s3://bucket/path/).","type":"string","default":"s3://bucket/path/to/folder/"},"enabled":{"description":"Enable regular backups.","type":"boolean","default":false},"endpointURL":{"description":"S3 endpoint URL for uploads.","type":"string","default":"http://minio-gateway-service:9000"},"retentionPolicy":{"description":"Retention policy (e.g. \"30d\").","type":"string","default":"30d"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":"<your-access-key>"},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":"<your-secret-key>"},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * * *"}}},"bootstrap":{"description":"Bootstrap configuration.","type":"object","default":{},"required":["enabled","oldName"],"properties":{"enabled":{"description":"Whether to restore from a backup.","type":"boolean","default":false},"oldName":{"description":"Previous cluster name before deletion.","type":"string","default":""},"recoveryTime":{"description":"Timestamp (RFC3339) for point-in-time recovery; empty means latest.","type":"string","default":""},"serverName":{"description":"Barman server name (S3 path prefix) used by the original cluster when writing backups. Set this only when the original cluster had an explicit barmanObjectStore.serverName that differed from its Kubernetes resource name.","type":"string","default":""}}}}}
   release:
     prefix: postgres-
     labels:

From 2b6e20cc3f96505ee8abdb40be64f1234a40b29d Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Tue, 21 Apr 2026 17:00:31 +0500
Subject: [PATCH 560/666] fix(platform): migrate ACME HTTP-01 to
 ingressClassName API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ClusterIssuer solver referenced IngressClass "nginx" which does not
exist on cozystack clusters — real classes are named after tenant
namespaces (e.g. tenant-root). Cert issuance only worked because every
requesting Ingress overrode the ClusterIssuer via the legacy
acme.cert-manager.io/http01-ingress-class annotation.

Switch both sides to the modern cert-manager API (available since
cert-manager 1.12; cozystack ships 1.19.3):

- ClusterIssuer: http01.ingress.ingressClassName, value parameterized
  from _cluster.expose-ingress (default "tenant-root")
- Ingress annotation: http01-ingress-ingressclassname

These must migrate together — mixing ingressClassName (ClusterIssuer)
with the old http01-ingress-class annotation triggers cert-manager's
"fields ingressClassName and class cannot be set at the same time"
validation and breaks issuance.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/apps/harbor/templates/ingress.yaml       |  2 +-
 .../extra/bootbox/templates/matchbox/ingress.yaml |  2 +-
 packages/extra/seaweedfs/templates/seaweedfs.yaml |  2 +-
 packages/system/bucket/templates/ingress.yaml     |  2 +-
 .../templates/cluster-issuers.yaml                | 15 ++++++++-------
 packages/system/dashboard/templates/ingress.yaml  |  2 +-
 packages/system/keycloak/templates/ingress.yaml   |  2 +-
 .../system/linstor-gui/templates/ingress.yaml     |  2 +-
 .../monitoring/templates/alerta/alerta.yaml       |  2 +-
 .../monitoring/templates/grafana/grafana.yaml     |  2 +-
 packages/system/seaweedfs/values.yaml             |  2 +-
 11 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/packages/apps/harbor/templates/ingress.yaml b/packages/apps/harbor/templates/ingress.yaml
index bb6ef07c..70933f5f 100644
--- a/packages/apps/harbor/templates/ingress.yaml
+++ b/packages/apps/harbor/templates/ingress.yaml
@@ -15,7 +15,7 @@ metadata:
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
     nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
     {{- if eq $solver "http01" }}
-    acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
+    acme.cert-manager.io/http01-ingress-ingressclassname: {{ $ingress }}
     {{- end }}
     cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
 spec:
diff --git a/packages/extra/bootbox/templates/matchbox/ingress.yaml b/packages/extra/bootbox/templates/matchbox/ingress.yaml
index 4262cd10..5eef3489 100644
--- a/packages/extra/bootbox/templates/matchbox/ingress.yaml
+++ b/packages/extra/bootbox/templates/matchbox/ingress.yaml
@@ -10,7 +10,7 @@ metadata:
     app: bootbox
   annotations:
     {{- if eq $solver "http01" }}
-    acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
+    acme.cert-manager.io/http01-ingress-ingressclassname: {{ $ingress }}
     {{- end }}
     cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
     {{- if .Values.whitelistHTTP }}
diff --git a/packages/extra/seaweedfs/templates/seaweedfs.yaml b/packages/extra/seaweedfs/templates/seaweedfs.yaml
index 42441b26..2f5720ca 100644
--- a/packages/extra/seaweedfs/templates/seaweedfs.yaml
+++ b/packages/extra/seaweedfs/templates/seaweedfs.yaml
@@ -243,7 +243,7 @@ spec:
             nginx.ingress.kubernetes.io/proxy-body-size: "0"
             nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
             {{- if eq $solver "http01" }}
-            acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
+            acme.cert-manager.io/http01-ingress-ingressclassname: {{ $ingress }}
             {{- end }}
             cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
           tls:
diff --git a/packages/system/bucket/templates/ingress.yaml b/packages/system/bucket/templates/ingress.yaml
index 6e5028fc..b7ffaf8b 100644
--- a/packages/system/bucket/templates/ingress.yaml
+++ b/packages/system/bucket/templates/ingress.yaml
@@ -12,7 +12,7 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-read-timeout: "99999"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "99999"
     {{- if eq $solver "http01" }}
-    acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
+    acme.cert-manager.io/http01-ingress-ingressclassname: {{ $ingress }}
     {{- end }}
     cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
 spec:
diff --git a/packages/system/cert-manager-issuers/templates/cluster-issuers.yaml b/packages/system/cert-manager-issuers/templates/cluster-issuers.yaml
index 442f1fb3..3b582082 100644
--- a/packages/system/cert-manager-issuers/templates/cluster-issuers.yaml
+++ b/packages/system/cert-manager-issuers/templates/cluster-issuers.yaml
@@ -1,6 +1,7 @@
 {{- $solver := (index .Values._cluster "solver") | default "http01" }}
+{{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
 
-apiVersion: cert-manager.io/v1 
+apiVersion: cert-manager.io/v1
 kind: ClusterIssuer  
 metadata:  
   name: letsencrypt-prod  
@@ -17,9 +18,9 @@ spec:
               name: cloudflare-api-token-secret  
               key: api-token  
       {{- else }}  
-        http01:  
-          ingress:  
-            class: nginx  
+        http01:
+          ingress:
+            ingressClassName: {{ $exposeIngress }}
       {{- end }}  
 
 ---  
@@ -41,9 +42,9 @@ spec:
               name: cloudflare-api-token-secret  
               key: api-token  
       {{- else }}  
-        http01:  
-          ingress:  
-            class: nginx  
+        http01:
+          ingress:
+            ingressClassName: {{ $exposeIngress }}
       {{- end }}  
 
 ---  
diff --git a/packages/system/dashboard/templates/ingress.yaml b/packages/system/dashboard/templates/ingress.yaml
index a10797fb..6cf01490 100644
--- a/packages/system/dashboard/templates/ingress.yaml
+++ b/packages/system/dashboard/templates/ingress.yaml
@@ -11,7 +11,7 @@ metadata:
   annotations:
     cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
     {{- if eq $solver "http01" }}
-    acme.cert-manager.io/http01-ingress-class: {{ $exposeIngress }}
+    acme.cert-manager.io/http01-ingress-ingressclassname: {{ $exposeIngress }}
     {{- end }}
     nginx.ingress.kubernetes.io/rewrite-target: /
     nginx.ingress.kubernetes.io/client-max-body-size: 100m
diff --git a/packages/system/keycloak/templates/ingress.yaml b/packages/system/keycloak/templates/ingress.yaml
index aa282f71..7f9fd476 100644
--- a/packages/system/keycloak/templates/ingress.yaml
+++ b/packages/system/keycloak/templates/ingress.yaml
@@ -11,7 +11,7 @@ metadata:
   {{- with .Values.ingress.annotations }}
   annotations:
     {{- if eq $solver "http01" }}
-    acme.cert-manager.io/http01-ingress-class: {{ $exposeIngress }}
+    acme.cert-manager.io/http01-ingress-ingressclassname: {{ $exposeIngress }}
     {{- end }}
     cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
     {{- toYaml . | nindent 4 }}
diff --git a/packages/system/linstor-gui/templates/ingress.yaml b/packages/system/linstor-gui/templates/ingress.yaml
index bf950eab..c50b0f86 100644
--- a/packages/system/linstor-gui/templates/ingress.yaml
+++ b/packages/system/linstor-gui/templates/ingress.yaml
@@ -22,7 +22,7 @@ metadata:
   annotations:
     cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
     {{- if eq $solver "http01" }}
-    acme.cert-manager.io/http01-ingress-class: {{ $exposeIngress }}
+    acme.cert-manager.io/http01-ingress-ingressclassname: {{ $exposeIngress }}
     {{- end }}
     nginx.ingress.kubernetes.io/proxy-body-size: 100m
     # Keycloak access+refresh+id tokens make the oauth2-proxy session
diff --git a/packages/system/monitoring/templates/alerta/alerta.yaml b/packages/system/monitoring/templates/alerta/alerta.yaml
index 44046d1f..d30e698d 100644
--- a/packages/system/monitoring/templates/alerta/alerta.yaml
+++ b/packages/system/monitoring/templates/alerta/alerta.yaml
@@ -181,7 +181,7 @@ metadata:
     app: alerta
   annotations:
     {{- if eq $solver "http01" }}
-    acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
+    acme.cert-manager.io/http01-ingress-ingressclassname: {{ $ingress }}
     {{- end }}
     cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
 spec:
diff --git a/packages/system/monitoring/templates/grafana/grafana.yaml b/packages/system/monitoring/templates/grafana/grafana.yaml
index d7f51e31..d65a7dc4 100644
--- a/packages/system/monitoring/templates/grafana/grafana.yaml
+++ b/packages/system/monitoring/templates/grafana/grafana.yaml
@@ -74,7 +74,7 @@ spec:
     metadata:
       annotations:
         {{- if eq $solver "http01" }}
-        acme.cert-manager.io/http01-ingress-class: "{{ $ingress }}"
+        acme.cert-manager.io/http01-ingress-ingressclassname: "{{ $ingress }}"
         {{- end }}
         cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
     spec:
diff --git a/packages/system/seaweedfs/values.yaml b/packages/system/seaweedfs/values.yaml
index daf2c055..57843ff5 100644
--- a/packages/system/seaweedfs/values.yaml
+++ b/packages/system/seaweedfs/values.yaml
@@ -111,7 +111,7 @@ seaweedfs:
         nginx.ingress.kubernetes.io/client-body-timeout: "3600"
         nginx.ingress.kubernetes.io/client-header-timeout: "120"
         nginx.ingress.kubernetes.io/service-upstream: "true"
-        acme.cert-manager.io/http01-ingress-class: tenant-root
+        acme.cert-manager.io/http01-ingress-ingressclassname: tenant-root
         cert-manager.io/cluster-issuer: letsencrypt-prod
       tls:
         - hosts:

From 310b0ece6b51572311b00c0b18f30af6afc4889e Mon Sep 17 00:00:00 2001
From: Andrey Kolkov <androndo@gmail.com>
Date: Mon, 13 Apr 2026 13:48:49 +0400
Subject: [PATCH 561/666] feat(dashboard): add restorejob list and add page and
 sidebar link

Signed-off-by: Andrey Kolkov <androndo@gmail.com>
---
 internal/controller/dashboard/sidebar.go      |   9 +
 .../controller/dashboard/static_refactored.go | 222 +++++++++++++++++-
 2 files changed, 228 insertions(+), 3 deletions(-)

diff --git a/internal/controller/dashboard/sidebar.go b/internal/controller/dashboard/sidebar.go
index 90721b3d..c9619f3a 100644
--- a/internal/controller/dashboard/sidebar.go
+++ b/internal/controller/dashboard/sidebar.go
@@ -144,6 +144,9 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 	// Add sidebar for backups.cozystack.io Backup resource
 	keysAndTags["backups"] = []any{"backup-sidebar"}
 
+	// Add sidebar for backups.cozystack.io RestoreJob resource
+	keysAndTags["restorejobs"] = []any{"restorejob-sidebar"}
+
 	// 3) Sort items within each category by Weight (desc), then Label (A→Z)
 	for cat := range categories {
 		sort.Slice(categories[cat], func(i, j int) bool {
@@ -215,6 +218,11 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 				"label": "Backups",
 				"link":  "/openapi-ui/{cluster}/{namespace}/api-table/backups.cozystack.io/v1alpha1/backups",
 			},
+			map[string]any{
+				"key":   "restorejobs",
+				"label": "RestoreJobs",
+				"link":  "/openapi-ui/{cluster}/{namespace}/api-table/backups.cozystack.io/v1alpha1/restorejobs",
+			},
 		},
 	})
 
@@ -258,6 +266,7 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 		"stock-project-factory-plan-details",
 		"stock-project-factory-backupjob-details",
 		"stock-project-factory-backup-details",
+		"stock-project-factory-restorejob-details",
 		"stock-project-factory-external-ips",
 		"stock-project-api-form",
 		"stock-project-api-table",
diff --git a/internal/controller/dashboard/static_refactored.go b/internal/controller/dashboard/static_refactored.go
index d96bbaaa..a180f66d 100644
--- a/internal/controller/dashboard/static_refactored.go
+++ b/internal/controller/dashboard/static_refactored.go
@@ -425,6 +425,14 @@ func CreateAllCustomColumnsOverrides() []*dashboardv1alpha1.CustomColumnsOverrid
 			createTimestampColumn("Taken At", ".spec.takenAt"),
 			createTimestampColumn("Created", ".metadata.creationTimestamp"),
 		}),
+
+		// Stock namespace backups cozystack io v1alpha1 restorejobs
+		createCustomColumnsOverride("stock-namespace-/backups.cozystack.io/v1alpha1/restorejobs", []any{
+			createCustomColumnWithJsonPath("Name", ".metadata.name", "RestoreJob", "", "/openapi-ui/{2}/{reqsJsonPath[0]['.metadata.namespace']['-']}/factory/restorejob-details/{reqsJsonPath[0]['.metadata.name']['-']}"),
+			createStringColumn("Phase", ".status.phase"),
+			createStringColumn("Backup", ".spec.backupRef.name"),
+			createTimestampColumn("Created", ".metadata.creationTimestamp"),
+		}),
 	}
 }
 
@@ -547,6 +555,31 @@ func CreateAllCustomFormsOverrides() []*dashboardv1alpha1.CustomFormsOverride {
 				"backupClassName": listInputScemaItemBackupClass(),
 			}),
 		}),
+
+		// RestoreJobs form override - backups.cozystack.io/v1alpha1
+		createCustomFormsOverride("default-/backups.cozystack.io/v1alpha1/restorejobs", map[string]any{
+			"formItems": []any{
+				createFormItem("metadata.name", "Name", "text"),
+				createFormItem("metadata.namespace", "Namespace", "text"),
+				createFormItem("spec.backupRef.name", "Backup", "text"),
+				// Target application: leave empty to restore into the same application
+				// as referenced by the selected Backup. Fill all three only to rename
+				// or restore into a different application.
+				createFormItem("spec.targetApplicationRef.apiGroup", "Target Application API Group (optional, only for rename)", "text"),
+				createFormItem("spec.targetApplicationRef.kind", "Target Application Kind (optional, only for rename)", "text"),
+				createFormItem("spec.targetApplicationRef.name", "Target Application Name (optional, only for rename)", "text"),
+				// Driver-specific options (key-value editor). Known keys for VMInstance:
+				// targetNamespace, failIfTargetExists, keepOriginalPVC, keepOriginalIpAndMac.
+				createFormItem("spec.options", "Options (VMInstance keys: targetNamespace, failIfTargetExists, keepOriginalPVC, keepOriginalIpAndMac)", "object"),
+			},
+			"schema": createSchema(map[string]any{
+				"backupRef": map[string]any{
+					"properties": map[string]any{
+						"name": listInputSchemaItemBackup(),
+					},
+				},
+			}),
+		}),
 	}
 }
 
@@ -1937,6 +1970,174 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 	}
 	backupSpec := createUnifiedFactory(backupConfig, backupTabs, []any{"/api/clusters/{2}/k8s/apis/backups.cozystack.io/v1alpha1/namespaces/{3}/backups/{6}"})
 
+	// RestoreJob details factory using unified approach
+	restoreJobConfig := UnifiedResourceConfig{
+		Name:         "restorejob-details",
+		ResourceType: "factory",
+		Kind:         "RestoreJob",
+		Plural:       "restorejobs",
+		Title:        "restorejob",
+	}
+	restoreJobTabs := []any{
+		map[string]any{
+			"key":   "details",
+			"label": "Details",
+			"children": []any{
+				contentCard("details-card", map[string]any{
+					"marginBottom": "24px",
+				}, []any{
+					antdText("details-title", true, "RestoreJob details", map[string]any{
+						"fontSize":     20,
+						"marginBottom": "12px",
+					}),
+					spacer("details-spacer", 16),
+					antdRow("details-grid", []any{48, 12}, []any{
+						antdCol("col-left", 12, []any{
+							antdFlexVertical("col-left-stack", 24, []any{
+								antdFlexVertical("meta-name-block", 4, []any{
+									antdText("meta-name-label", true, "Name", nil),
+									parsedText("meta-name-value", "{reqsJsonPath[0]['.metadata.name']['-']}", nil),
+								}),
+								antdFlexVertical("meta-namespace-block", 8, []any{
+									antdText("meta-namespace-label", true, "Namespace", nil),
+									antdFlex("header-row", 6, []any{
+										map[string]any{
+											"type": "antdText",
+											"data": map[string]any{
+												"id":    "header-badge",
+												"text":  "NS",
+												"title": "namespace",
+												"style": map[string]any{
+													"backgroundColor": "#a25792ff",
+													"borderRadius":    "20px",
+													"color":           "#fff",
+													"display":         "inline-block",
+													"fontFamily":      "RedHatDisplay, Overpass, overpass, helvetica, arial, sans-serif",
+													"fontSize":        "15px",
+													"fontWeight":      400,
+													"lineHeight":      "24px",
+													"minWidth":        24,
+													"padding":         "0 9px",
+													"textAlign":       "center",
+													"whiteSpace":      "nowrap",
+												},
+											},
+										},
+										map[string]any{
+											"type": "antdLink",
+											"data": map[string]any{
+												"id":   "namespace-link",
+												"text": "{reqsJsonPath[0]['.metadata.namespace']['-']}",
+												"href": "/openapi-ui/{2}/{reqsJsonPath[0]['.metadata.namespace']['-']}/factory/marketplace",
+											},
+										},
+									}),
+								}),
+								antdFlexVertical("meta-created-block", 4, []any{
+									antdText("time-label", true, "Created", nil),
+									antdFlex("time-block", 6, []any{
+										map[string]any{
+											"type": "antdText",
+											"data": map[string]any{
+												"id":   "time-icon",
+												"text": "🌐",
+											},
+										},
+										map[string]any{
+											"type": "parsedText",
+											"data": map[string]any{
+												"formatter": "timestamp",
+												"id":        "time-value",
+												"text":      "{reqsJsonPath[0]['.metadata.creationTimestamp']['-']}",
+											},
+										},
+									}),
+								}),
+							}),
+						}),
+						antdCol("col-right", 12, []any{
+							antdFlexVertical("col-right-stack", 24, []any{
+								antdFlexVertical("status-phase-block", 4, []any{
+									antdText("phase-label", true, "Phase", nil),
+									parsedText("phase-value", "{reqsJsonPath[0]['.status.phase']['-']}", nil),
+								}),
+								antdFlexVertical("spec-backup-ref-block", 4, []any{
+									antdText("backup-ref-label", true, "Backup Ref", nil),
+									parsedText("backup-ref-value", "{reqsJsonPath[0]['.spec.backupRef.name']['-']}", nil),
+								}),
+								antdFlexVertical("spec-target-application-ref-block", 4, []any{
+									antdText("target-application-ref-label", true, "Target Application", nil),
+									parsedText("target-application-ref-value", "{reqsJsonPath[0]['.spec.targetApplicationRef.kind']['-']}.{reqsJsonPath[0]['.spec.targetApplicationRef.apiGroup']['-']}/{reqsJsonPath[0]['.spec.targetApplicationRef.name']['-']}", nil),
+								}),
+								antdFlexVertical("spec-options-target-namespace-block", 4, []any{
+									antdText("options-target-namespace-label", true, "Target Namespace", nil),
+									parsedText("options-target-namespace-value", "{reqsJsonPath[0]['.spec.options.targetNamespace']['-']}", nil),
+								}),
+								antdFlexVertical("spec-options-fail-if-target-exists-block", 4, []any{
+									antdText("options-fail-if-target-exists-label", true, "Fail If Target Exists", nil),
+									parsedText("options-fail-if-target-exists-value", "{reqsJsonPath[0]['.spec.options.failIfTargetExists']['-']}", nil),
+								}),
+								antdFlexVertical("spec-options-keep-original-pvc-block", 4, []any{
+									antdText("options-keep-original-pvc-label", true, "Keep Original PVC", nil),
+									parsedText("options-keep-original-pvc-value", "{reqsJsonPath[0]['.spec.options.keepOriginalPVC']['-']}", nil),
+								}),
+								antdFlexVertical("spec-options-keep-original-ip-mac-block", 4, []any{
+									antdText("options-keep-original-ip-mac-label", true, "Keep Original IP/MAC", nil),
+									parsedText("options-keep-original-ip-mac-value", "{reqsJsonPath[0]['.spec.options.keepOriginalIpAndMac']['-']}", nil),
+								}),
+								antdFlexVertical("status-started-at-block", 4, []any{
+									antdText("started-at-label", true, "Started At", nil),
+									antdFlex("time-block", 6, []any{
+										map[string]any{
+											"type": "antdText",
+											"data": map[string]any{
+												"id":   "time-icon",
+												"text": "🌐",
+											},
+										},
+										map[string]any{
+											"type": "parsedText",
+											"data": map[string]any{
+												"formatter": "timestamp",
+												"id":        "time-value",
+												"text":      "{reqsJsonPath[0]['.status.startedAt']['-']}",
+											},
+										},
+									}),
+								}),
+								antdFlexVertical("status-completed-at-block", 4, []any{
+									antdText("completed-at-label", true, "Completed At", nil),
+									antdFlex("time-block", 6, []any{
+										map[string]any{
+											"type": "antdText",
+											"data": map[string]any{
+												"id":   "time-icon",
+												"text": "🌐",
+											},
+										},
+										map[string]any{
+											"type": "parsedText",
+											"data": map[string]any{
+												"formatter": "timestamp",
+												"id":        "time-value",
+												"text":      "{reqsJsonPath[0]['.status.completedAt']['-']}",
+											},
+										},
+									}),
+								}),
+								antdFlexVertical("status-message-block", 4, []any{
+									antdText("message-label", true, "Message", nil),
+									parsedText("message-value", "{reqsJsonPath[0]['.status.message']['-']}", nil),
+								}),
+							}),
+						}),
+					}),
+				}),
+			},
+		},
+	}
+	restoreJobSpec := createUnifiedFactory(restoreJobConfig, restoreJobTabs, []any{"/api/clusters/{2}/k8s/apis/backups.cozystack.io/v1alpha1/namespaces/{3}/restorejobs/{6}"})
+
 	// External IPs factory (filtered services)
 	externalIPsTabs := []any{
 		map[string]any{
@@ -1989,6 +2190,7 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 		createFactory("plan-details", planSpec),
 		createFactory("backupjob-details", backupJobSpec),
 		createFactory("backup-details", backupSpec),
+		createFactory("restorejob-details", restoreJobSpec),
 		createFactory("external-ips", externalIPsSpec),
 	}
 }
@@ -2008,9 +2210,10 @@ func CreateAllNavigations() []*dashboardv1alpha1.Navigation {
 		"base-factory-namespaced-api-networking.k8s.io-v1-ingresses":         "kube-ingress-details",
 		"base-factory-namespaced-api-cozystack.io-v1alpha1-workloadmonitors": "workloadmonitor-details",
 		// Backup resources (not ApplicationDefinitions, so ensureNavigation doesn't cover them)
-		"base-factory-namespaced-api-backups.cozystack.io-v1alpha1-plans":      "plan-details",
-		"base-factory-namespaced-api-backups.cozystack.io-v1alpha1-backupjobs": "backupjob-details",
-		"base-factory-namespaced-api-backups.cozystack.io-v1alpha1-backups":    "backup-details",
+		"base-factory-namespaced-api-backups.cozystack.io-v1alpha1-plans":       "plan-details",
+		"base-factory-namespaced-api-backups.cozystack.io-v1alpha1-backupjobs":  "backupjob-details",
+		"base-factory-namespaced-api-backups.cozystack.io-v1alpha1-backups":     "backup-details",
+		"base-factory-namespaced-api-backups.cozystack.io-v1alpha1-restorejobs": "restorejob-details",
 	}
 
 	return []*dashboardv1alpha1.Navigation{
@@ -2135,6 +2338,19 @@ func listInputScemaItemBackupClass() map[string]any {
 	}
 }
 
+// listInputSchemaItemBackup returns a listInput schema overlay for selecting a Backup
+// from the current namespace (used by RestoreJob form for spec.backupRef.name).
+func listInputSchemaItemBackup() map[string]any {
+	return map[string]any{
+		"type": "listInput",
+		"customProps": map[string]any{
+			"valueUri":    "/api/clusters/{cluster}/k8s/apis/backups.cozystack.io/v1alpha1/namespaces/{namespace}/backups",
+			"keysToValue": []any{"metadata", "name"},
+			"keysToLabel": []any{"metadata", "name"},
+		},
+	}
+}
+
 // backupClassSchema returns the schema for spec.backupClassName as listInput (BackupJob/Plan).
 func createSchema(customProps map[string]any) map[string]any {
 	return map[string]any{

From 61058828564c84e19c86607e8cfaa08056a5310c Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Tue, 21 Apr 2026 17:27:30 +0500
Subject: [PATCH 562/666] fix(dashboard): address review feedback on RestoreJob
 views

- Replace rename-only wording on spec.targetApplicationRef form labels so
  users discover that the field also supports restoring into a different
  application, not just renaming.
- Drop VMInstance-specific keys from the spec.options form label; the
  restore options are driver-specific, so hardcoding one driver's keys is
  misleading once other drivers land.
- Render a single "Same as backup" fallback for an omitted
  spec.targetApplicationRef on the details page instead of the noisy
  "-.-/-" produced by concatenating three missing path fallbacks.
- De-duplicate the time-block / time-icon / time-value component IDs
  within the restorejob-details factory by prefixing them with
  created-, started-at-, and completed-at-.
- Mark non-CRD-backed stock-project-factory-*-details sidebars (kube-*,
  plan, backupjob, backup, restorejob) as static in
  upsertMultipleSidebars so they pick up consistent managed-by labels
  instead of being left unmanaged.

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 internal/controller/dashboard/sidebar.go      | 20 +++++++--
 .../controller/dashboard/static_refactored.go | 41 ++++++++++---------
 2 files changed, 38 insertions(+), 23 deletions(-)

diff --git a/internal/controller/dashboard/sidebar.go b/internal/controller/dashboard/sidebar.go
index c9619f3a..69c933fb 100644
--- a/internal/controller/dashboard/sidebar.go
+++ b/internal/controller/dashboard/sidebar.go
@@ -281,7 +281,12 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 		"stock-instance-builtin-table",
 	}
 
-	// Add details sidebars for all CRDs with dashboard config
+	// Add details sidebars for all CRDs with dashboard config, and collect
+	// the set of IDs that are genuinely CRD-backed (dynamic). The hardcoded
+	// `-details` IDs above (e.g. kube-* and backup/backupjob/plan/restorejob)
+	// are not tied to an ApplicationDefinition and must be treated as static
+	// so they receive consistent labels via upsertMultipleSidebars().
+	dynamicDetailsIDs := map[string]bool{}
 	for i := range all {
 		def := &all[i]
 		if def.Spec.Dashboard == nil {
@@ -291,17 +296,22 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 		lowerKind := strings.ToLower(kind)
 		detailsID := fmt.Sprintf("stock-project-factory-%s-details", lowerKind)
 		targetIDs = append(targetIDs, detailsID)
+		dynamicDetailsIDs[detailsID] = true
 	}
 
 	// 7) Upsert all target sidebars with identical menuItems and keysAndTags
-	return m.upsertMultipleSidebars(ctx, crd, targetIDs, keysAndTags, menuItems)
+	return m.upsertMultipleSidebars(ctx, crd, targetIDs, dynamicDetailsIDs, keysAndTags, menuItems)
 }
 
 // upsertMultipleSidebars creates/updates several Sidebar resources with the same menu spec.
+// dynamicDetailsIDs identifies `stock-project-factory-<kind>-details` sidebars that are
+// backed by an ApplicationDefinition and should therefore be owned by that CRD.
+// Any other ID is treated as a static sidebar (managed-by labels, no owner ref).
 func (m *Manager) upsertMultipleSidebars(
 	ctx context.Context,
 	crd *cozyv1alpha1.ApplicationDefinition,
 	ids []string,
+	dynamicDetailsIDs map[string]bool,
 	keysAndTags map[string]any,
 	menuItems []any,
 ) error {
@@ -317,8 +327,10 @@ func (m *Manager) upsertMultipleSidebars(
 
 		if _, err := controllerutil.CreateOrUpdate(ctx, m.Client, obj, func() error {
 			// Only set owner reference for dynamic sidebars (stock-project-factory-{kind}-details)
-			// Static sidebars (stock-instance-*, stock-project-*) should not have owner references
-			if strings.HasPrefix(id, "stock-project-factory-") && strings.HasSuffix(id, "-details") {
+			// that are actually backed by an ApplicationDefinition. Static sidebars — including
+			// hardcoded details sidebars for built-in/backup resources — must fall through to the
+			// static-label branch so they're managed consistently.
+			if strings.HasPrefix(id, "stock-project-factory-") && strings.HasSuffix(id, "-details") && dynamicDetailsIDs[id] {
 				// This is a dynamic sidebar, set owner reference only if it matches the current CRD
 				_, _, kind := pickGVK(crd)
 				lowerKind := strings.ToLower(kind)
diff --git a/internal/controller/dashboard/static_refactored.go b/internal/controller/dashboard/static_refactored.go
index a180f66d..9f28c0fb 100644
--- a/internal/controller/dashboard/static_refactored.go
+++ b/internal/controller/dashboard/static_refactored.go
@@ -563,14 +563,14 @@ func CreateAllCustomFormsOverrides() []*dashboardv1alpha1.CustomFormsOverride {
 				createFormItem("metadata.namespace", "Namespace", "text"),
 				createFormItem("spec.backupRef.name", "Backup", "text"),
 				// Target application: leave empty to restore into the same application
-				// as referenced by the selected Backup. Fill all three only to rename
-				// or restore into a different application.
-				createFormItem("spec.targetApplicationRef.apiGroup", "Target Application API Group (optional, only for rename)", "text"),
-				createFormItem("spec.targetApplicationRef.kind", "Target Application Kind (optional, only for rename)", "text"),
-				createFormItem("spec.targetApplicationRef.name", "Target Application Name (optional, only for rename)", "text"),
-				// Driver-specific options (key-value editor). Known keys for VMInstance:
-				// targetNamespace, failIfTargetExists, keepOriginalPVC, keepOriginalIpAndMac.
-				createFormItem("spec.options", "Options (VMInstance keys: targetNamespace, failIfTargetExists, keepOriginalPVC, keepOriginalIpAndMac)", "object"),
+				// as referenced by the selected Backup. Fill all three to restore into
+				// a different application (e.g. rename, or restore into a new target).
+				createFormItem("spec.targetApplicationRef.apiGroup", "Target Application API Group (optional, used to restore into a different application)", "text"),
+				createFormItem("spec.targetApplicationRef.kind", "Target Application Kind (optional, used to restore into a different application)", "text"),
+				createFormItem("spec.targetApplicationRef.name", "Target Application Name (optional, used to restore into a different application)", "text"),
+				// Driver-specific options (key-value editor). Refer to the backup driver
+				// documentation for supported keys.
+				createFormItem("spec.options", "Options (driver-specific key/value pairs)", "object"),
 			},
 			"schema": createSchema(map[string]any{
 				"backupRef": map[string]any{
@@ -2034,12 +2034,12 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 									}),
 								}),
 								antdFlexVertical("meta-created-block", 4, []any{
-									antdText("time-label", true, "Created", nil),
-									antdFlex("time-block", 6, []any{
+									antdText("created-time-label", true, "Created", nil),
+									antdFlex("created-time-block", 6, []any{
 										map[string]any{
 											"type": "antdText",
 											"data": map[string]any{
-												"id":   "time-icon",
+												"id":   "created-time-icon",
 												"text": "🌐",
 											},
 										},
@@ -2047,7 +2047,7 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 											"type": "parsedText",
 											"data": map[string]any{
 												"formatter": "timestamp",
-												"id":        "time-value",
+												"id":        "created-time-value",
 												"text":      "{reqsJsonPath[0]['.metadata.creationTimestamp']['-']}",
 											},
 										},
@@ -2067,7 +2067,10 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 								}),
 								antdFlexVertical("spec-target-application-ref-block", 4, []any{
 									antdText("target-application-ref-label", true, "Target Application", nil),
-									parsedText("target-application-ref-value", "{reqsJsonPath[0]['.spec.targetApplicationRef.kind']['-']}.{reqsJsonPath[0]['.spec.targetApplicationRef.apiGroup']['-']}/{reqsJsonPath[0]['.spec.targetApplicationRef.name']['-']}", nil),
+									// targetApplicationRef is optional — when absent, the restore targets
+									// the same application as the selected Backup. Show a single friendly
+									// fallback in that case instead of rendering "-.-/-".
+									parsedText("target-application-ref-value", "{reqsJsonPath[0]['.spec.targetApplicationRef.name']['Same as backup']}", nil),
 								}),
 								antdFlexVertical("spec-options-target-namespace-block", 4, []any{
 									antdText("options-target-namespace-label", true, "Target Namespace", nil),
@@ -2087,11 +2090,11 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 								}),
 								antdFlexVertical("status-started-at-block", 4, []any{
 									antdText("started-at-label", true, "Started At", nil),
-									antdFlex("time-block", 6, []any{
+									antdFlex("started-at-time-block", 6, []any{
 										map[string]any{
 											"type": "antdText",
 											"data": map[string]any{
-												"id":   "time-icon",
+												"id":   "started-at-time-icon",
 												"text": "🌐",
 											},
 										},
@@ -2099,7 +2102,7 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 											"type": "parsedText",
 											"data": map[string]any{
 												"formatter": "timestamp",
-												"id":        "time-value",
+												"id":        "started-at-time-value",
 												"text":      "{reqsJsonPath[0]['.status.startedAt']['-']}",
 											},
 										},
@@ -2107,11 +2110,11 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 								}),
 								antdFlexVertical("status-completed-at-block", 4, []any{
 									antdText("completed-at-label", true, "Completed At", nil),
-									antdFlex("time-block", 6, []any{
+									antdFlex("completed-at-time-block", 6, []any{
 										map[string]any{
 											"type": "antdText",
 											"data": map[string]any{
-												"id":   "time-icon",
+												"id":   "completed-at-time-icon",
 												"text": "🌐",
 											},
 										},
@@ -2119,7 +2122,7 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 											"type": "parsedText",
 											"data": map[string]any{
 												"formatter": "timestamp",
-												"id":        "time-value",
+												"id":        "completed-at-time-value",
 												"text":      "{reqsJsonPath[0]['.status.completedAt']['-']}",
 											},
 										},

From 04cc1633be6910e3c0d06f9621ab281f0c8dea02 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 21 Apr 2026 17:13:27 +0200
Subject: [PATCH 563/666] fix(kube-ovn): scope kubeovn-plunger cache and RBAC
 to its namespace

The kubeovn-plunger controller-runtime cache attempted cluster-wide
list/watch on Deployments and Pods, which the namespace-scoped Role
cannot satisfy. Additionally, the deployments rule relied on
resourceNames, which does not restrict list/watch verbs and left the
permission effectively unusable.

Scope the manager cache to the kube-ovn namespace so list/watch hit
the namespaced API, and drop resourceNames from the deployments rule.
Wire --kube-ovn-namespace and --ovn-central-name through the
Deployment so values are actually consumed.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 cmd/kubeovn-plunger/main.go                               | 6 ++++++
 packages/system/kubeovn-plunger/templates/deployment.yaml | 2 ++
 packages/system/kubeovn-plunger/templates/rbac.yaml       | 2 --
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/cmd/kubeovn-plunger/main.go b/cmd/kubeovn-plunger/main.go
index 210405ce..611d030b 100644
--- a/cmd/kubeovn-plunger/main.go
+++ b/cmd/kubeovn-plunger/main.go
@@ -29,6 +29,7 @@ import (
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/cache"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 	"sigs.k8s.io/controller-runtime/pkg/metrics"
@@ -131,6 +132,11 @@ func main() {
 		HealthProbeBindAddress: probeAddr,
 		LeaderElection:         enableLeaderElection,
 		LeaderElectionID:       "29a0338b.cozystack.io",
+		Cache: cache.Options{
+			DefaultNamespaces: map[string]cache.Config{
+				kubeOVNNamespace: {},
+			},
+		},
 		// LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily
 		// when the Manager ends. This requires the binary to immediately end when the
 		// Manager is stopped, otherwise, this setting is unsafe. Setting this significantly
diff --git a/packages/system/kubeovn-plunger/templates/deployment.yaml b/packages/system/kubeovn-plunger/templates/deployment.yaml
index 183e8c5e..37b49620 100644
--- a/packages/system/kubeovn-plunger/templates/deployment.yaml
+++ b/packages/system/kubeovn-plunger/templates/deployment.yaml
@@ -29,6 +29,8 @@ spec:
         {{- end }}
         - --metrics-bind-address=:8080
         - --metrics-secure=false
+        - --kube-ovn-namespace={{ .Release.Namespace }}
+        - --ovn-central-name={{ .Values.ovnCentralName }}
         ports:
         - name: metrics
           containerPort: 8080
diff --git a/packages/system/kubeovn-plunger/templates/rbac.yaml b/packages/system/kubeovn-plunger/templates/rbac.yaml
index a0c5527b..3ca22740 100644
--- a/packages/system/kubeovn-plunger/templates/rbac.yaml
+++ b/packages/system/kubeovn-plunger/templates/rbac.yaml
@@ -22,8 +22,6 @@ rules:
   - get
   - list
   - watch
-  resourceNames:
-  - {{ .Values.ovnCentralName }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding

From bb4be57774ef105c1e52fbbfab8bee0dcf52fd06 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 21 Apr 2026 20:09:19 +0200
Subject: [PATCH 564/666] fix(kube-ovn): bump kube-ovn to v1.15.10 with
 port-group regression fix

Pulls cozystack/kubeovn-chart v1.15.10-cozy.1, which bumps upstream
kube-ovn from v1.15.3 to v1.15.10 and carries a patch over
pkg/controller/pod.go that preserves a VM LSP's port-group memberships
when kubernetes GCs a completed virt-launcher pod while another
virt-launcher pod of the same VM is still running.

Without the patch, the destination pod of a successful live migration
loses its security groups, network policies and node-scoped routing
after kubernetes cleans up the migration source pod, and only recovers
after a kube-ovn-controller restart.

Upstream issue: kubeovn/kube-ovn#6665
Upstream fix PR: kubeovn/kube-ovn#6666
Chart carry: cozystack/kubeovn-chart#4

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../system/kubeovn/charts/kube-ovn/Chart.yaml |   4 +-
 .../kube-ovn/templates/kube-ovn-crd.yaml      |  71 ++++++++++
 .../charts/kube-ovn/templates/ovncni-ds.yaml  |   3 +
 .../templates/pre-upgrade-ovs-ovn.yaml        | 129 ++++++++++++++++++
 .../kubeovn/charts/kube-ovn/values.yaml       |   4 +-
 packages/system/kubeovn/values.yaml           |   2 +-
 6 files changed, 208 insertions(+), 5 deletions(-)
 create mode 100644 packages/system/kubeovn/charts/kube-ovn/templates/pre-upgrade-ovs-ovn.yaml

diff --git a/packages/system/kubeovn/charts/kube-ovn/Chart.yaml b/packages/system/kubeovn/charts/kube-ovn/Chart.yaml
index f0295b87..9c01c123 100644
--- a/packages/system/kubeovn/charts/kube-ovn/Chart.yaml
+++ b/packages/system/kubeovn/charts/kube-ovn/Chart.yaml
@@ -15,12 +15,12 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v1.15.3
+version: v1.15.10
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "1.15.3"
+appVersion: "1.15.10"
 
 kubeVersion: ">= 1.29.0-0"
diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml
index 5b093be6..62ae328e 100644
--- a/packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml
+++ b/packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml
@@ -1353,6 +1353,77 @@ spec:
                         type: string
                     type: object
                   type: array
+                resources:
+                  description: |-
+                    `resources` are the compute resources required by this container.
+                    For more information, see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                  properties:
+                    claims:
+                      description: |-
+                        Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container.
+
+                        This field depends on the DynamicResourceAllocation feature gate.
+
+                        This field is immutable. It can only be set for containers.
+                      items:
+                        description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+                        properties:
+                          name:
+                            description: |-
+                              Name must match the name of one entry in pod.spec.resourceClaims of
+                              the Pod where this field is used. It makes that resource available
+                              inside a container.
+                            type: string
+                          request:
+                            description: |-
+                              Request is the name chosen for a request in the referenced claim.
+                              If empty, everything from the claim is made available, otherwise
+                              only the result of this request.
+                            type: string
+                        required:
+                          - name
+                        type: object
+                      type: array
+                      x-kubernetes-list-map-keys:
+                        - name
+                      x-kubernetes-list-type: map
+                    limits:
+                      additionalProperties:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                        x-kubernetes-int-or-string: true
+                      description: |-
+                        Limits describes the maximum amount of compute resources allowed.
+                        More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                      type: object
+                    requests:
+                      additionalProperties:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                        x-kubernetes-int-or-string: true
+                      description: |-
+                        Requests describes the minimum amount of compute resources required.
+                        If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                        otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                        More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                      type: object
+                  type: object
+                bandwidth:
+                  type: object
+                  description: Optional bandwidth limit for each egress gateway instance in both ingress and egress directions.
+                  properties:
+                    ingress:
+                      type: integer
+                      format: int64
+                      description: ingress bandwidth limit in Mbps
+                    egress:
+                      type: integer
+                      format: int64
+                      description: egress bandwidth limit in Mbps
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml
index 8be8eba6..06971d01 100644
--- a/packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml
+++ b/packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml
@@ -126,6 +126,9 @@ spec:
           - --enable-ovn-ipsec={{- .Values.func.ENABLE_OVN_IPSEC }}
           - --set-vxlan-tx-off={{- .Values.func.SET_VXLAN_TX_OFF }}
           - --non-primary-cni-mode={{- .Values.cni_conf.NON_PRIMARY_CNI }}
+          {{- with .Values.mtu }}
+          - --mtu={{ . }}
+          {{- end }}
         securityContext:
           runAsUser: 0
           privileged: false
diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/pre-upgrade-ovs-ovn.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/pre-upgrade-ovs-ovn.yaml
new file mode 100644
index 00000000..a18a4111
--- /dev/null
+++ b/packages/system/kubeovn/charts/kube-ovn/templates/pre-upgrade-ovs-ovn.yaml
@@ -0,0 +1,129 @@
+{{- if include "kubeovn.ovn.versionCompatibility" . -}}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ovs-ovn-pre-upgrade
+  namespace: {{ .Values.namespace }}
+  annotations:
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-weight": "1"
+    "helm.sh/hook-delete-policy": hook-succeeded
+automountServiceAccountToken: false
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations:
+    rbac.authorization.k8s.io/system-only: "true"
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-weight": "2"
+    "helm.sh/hook-delete-policy": hook-succeeded
+  name: system:ovs-ovn-pre-upgrade
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - list
+      - get
+  - apiGroups:
+      - ""
+    resources:
+      - pods/exec
+    verbs:
+      - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: ovs-ovn-pre-upgrade
+  annotations:
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-weight": "3"
+    "helm.sh/hook-delete-policy": hook-succeeded
+roleRef:
+  name: system:ovs-ovn-pre-upgrade
+  kind: ClusterRole
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    name: ovs-ovn-pre-upgrade
+    namespace: {{ .Values.namespace }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "{{ .Chart.Name }}-pre-upgrade-hook"
+  namespace: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/instance: {{ .Release.Name | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+  annotations:
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-weight": "4"
+    "helm.sh/hook-delete-policy": hook-succeeded
+spec:
+  completions: 1
+  template:
+    metadata:
+      name: "{{ .Release.Name }}"
+      labels:
+        app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+        app.kubernetes.io/instance: {{ .Release.Name | quote }}
+        helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+        app: pre-upgrade
+        component: job
+    spec:
+      tolerations:
+        - key: ""
+          operator: "Exists"
+          effect: "NoSchedule"
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - topologyKey: kubernetes.io/hostname
+              labelSelector:
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - pre-upgrade
+                  - key: component
+                    operator: In
+                    values:
+                      - job
+      restartPolicy: Never
+      hostNetwork: true
+      nodeSelector:
+        kubernetes.io/os: "linux"
+      serviceAccountName: ovs-ovn-pre-upgrade
+      automountServiceAccountToken: true
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: ovs-ovn-pre-upgrade
+          image: "{{ .Values.global.registry.address}}/{{ .Values.global.images.kubeovn.repository }}:{{ .Values.global.images.kubeovn.tag }}"
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+          command:
+            - bash
+            - -eo
+            - pipefail
+            - -c
+            - bash /kube-ovn/pre-upgrade-ovs.sh 2>&1 | tee -a /var/log/kube-ovn/pre-upgrade-ovs.log
+          volumeMounts:
+            - mountPath: /var/log/kube-ovn
+              name: kube-ovn-log
+      volumes:
+        - name: kube-ovn-log
+          hostPath:
+            path: {{ .Values.log_conf.LOG_DIR }}/kube-ovn
+{{- end -}}
diff --git a/packages/system/kubeovn/charts/kube-ovn/values.yaml b/packages/system/kubeovn/charts/kube-ovn/values.yaml
index 3ffb7750..fd3472f6 100644
--- a/packages/system/kubeovn/charts/kube-ovn/values.yaml
+++ b/packages/system/kubeovn/charts/kube-ovn/values.yaml
@@ -8,11 +8,11 @@ global:
   images:
     kubeovn:
       repository: kube-ovn
-      tag: v1.15.3
+      tag: v1.15.10
     natgateway:
       repository: vpc-nat-gateway
       # Falls back to the same tag as kubeovn if empty
-      tag: v1.15.3
+      tag: v1.15.10
 
 image:
   pullPolicy: IfNotPresent
diff --git a/packages/system/kubeovn/values.yaml b/packages/system/kubeovn/values.yaml
index 6911f8aa..e9d2d10f 100644
--- a/packages/system/kubeovn/values.yaml
+++ b/packages/system/kubeovn/values.yaml
@@ -65,4 +65,4 @@ global:
   images:
     kubeovn:
       repository: kubeovn
-      tag: v1.15.3@sha256:fa53d5f254f640cb626329ad35d9e7aad647dd8e1e645e68f3f13c3659472a30
+      tag: v1.15.10@sha256:741299cbd0081a786a6b60c460fa3156b3a42a38141c559dd8ac031f50c5504f

From 68a624dccbe0a50c3731111ba2761f47467c8157 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 21 Apr 2026 20:26:13 +0200
Subject: [PATCH 565/666] fix(harbor): remove incorrect tenant module flags

Harbor is a PaaS service, not a tenant module. It is not deployed
automatically into tenant namespaces (no manifest in
packages/apps/tenant/templates/). Remove the misplaced
`dashboard.module: true` flag and
`internal.cozystack.io/tenantmodule: "true"` release label so Harbor
appears under the PaaS category in the dashboard and is not treated as
a tenant module by the controllers.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/system/harbor-rd/cozyrds/harbor.yaml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/packages/system/harbor-rd/cozyrds/harbor.yaml b/packages/system/harbor-rd/cozyrds/harbor.yaml
index 5abc725f..5682c053 100644
--- a/packages/system/harbor-rd/cozyrds/harbor.yaml
+++ b/packages/system/harbor-rd/cozyrds/harbor.yaml
@@ -13,7 +13,6 @@ spec:
     prefix: "harbor-"
     labels:
       sharding.fluxcd.io/key: tenants
-      internal.cozystack.io/tenantmodule: "true"
     chartRef:
       kind: ExternalArtifact
       name: cozystack-harbor-application-default-harbor
@@ -24,7 +23,6 @@ spec:
     plural: Harbor
     name: harbor
     description: Managed Harbor container registry
-    module: true
     tags:
       - registry
       - container

From 0fdb25df724ba5d44c794271cc0661d97b1d9b13 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Wed, 22 Apr 2026 11:59:50 +0500
Subject: [PATCH 566/666] ci(api): add codegen drift check

Run root 'make generate' as a pre-commit hook and as a dedicated
CI workflow so missed codegen updates (CRDs, deepcopy, clients, RBAC)
are caught instead of merging stale generated files.

Pre-commit hook is scoped to files that actually affect codegen
(api/, pkg/apis/, hack/update-codegen.sh, hack/boilerplate.go.txt)
so unrelated commits are not slowed down. CI job sets up Go from
go.mod, runs make generate, and fails on drift with a pointer to
the local fix.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .github/workflows/codegen-drift.yml | 42 +++++++++++++++++++++++++++++
 .pre-commit-config.yaml             | 11 ++++++++
 2 files changed, 53 insertions(+)
 create mode 100644 .github/workflows/codegen-drift.yml

diff --git a/.github/workflows/codegen-drift.yml b/.github/workflows/codegen-drift.yml
new file mode 100644
index 00000000..bd7927f7
--- /dev/null
+++ b/.github/workflows/codegen-drift.yml
@@ -0,0 +1,42 @@
+name: Codegen Drift Check
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - 'api/**'
+      - 'pkg/apis/**'
+      - 'hack/update-codegen.sh'
+      - 'hack/boilerplate.go.txt'
+      - 'go.mod'
+      - 'go.sum'
+      - '.github/workflows/codegen-drift.yml'
+
+concurrency:
+  group: codegen-drift-${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  codegen-drift:
+    name: Verify generated code is up to date
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Run make generate
+        run: make generate
+
+      - name: Fail on drift
+        run: |
+          if ! git diff --exit-code; then
+            echo "::error::'make generate' produced changes. Run 'make generate' locally and commit the result."
+            git status --short
+            exit 1
+          fi
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index ac0f7e30..836f79c5 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,6 +1,17 @@
 repos:
 - repo: local
   hooks:
+    - id: run-make-generate-root
+      name: Run 'make generate' at repo root
+      entry: |
+        flock -x .git/pre-commit.lock sh -c '
+          echo "Running make generate at repo root"
+          make generate || exit $?
+          git diff --color=always | cat
+        '
+      language: system
+      files: ^(api/|pkg/apis/|hack/update-codegen\.sh$|hack/boilerplate\.go\.txt$)
+      pass_filenames: false
     - id: run-make-generate
       name: Run 'make generate' in all app directories
       entry: |

From 860f431187c3f577bfd2b7ab60201583bdef9384 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Wed, 22 Apr 2026 12:00:22 +0500
Subject: [PATCH 567/666] chore(api): regenerate deepcopy for
 RestoreJobSpec.Options

The Options field was added to RestoreJobSpec without re-running
'make generate', leaving zz_generated.deepcopy.go out of sync.
Regenerated to include the missing DeepCopyInto handling for the
runtime.RawExtension pointer.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 api/backups/v1alpha1/zz_generated.deepcopy.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/api/backups/v1alpha1/zz_generated.deepcopy.go b/api/backups/v1alpha1/zz_generated.deepcopy.go
index 89f6171f..61b8f839 100644
--- a/api/backups/v1alpha1/zz_generated.deepcopy.go
+++ b/api/backups/v1alpha1/zz_generated.deepcopy.go
@@ -620,6 +620,11 @@ func (in *RestoreJobSpec) DeepCopyInto(out *RestoreJobSpec) {
 		*out = new(v1.TypedLocalObjectReference)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.Options != nil {
+		in, out := &in.Options, &out.Options
+		*out = new(runtime.RawExtension)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RestoreJobSpec.

From b52e2801b460e5ba00a864dd5adc29fd4f20fae8 Mon Sep 17 00:00:00 2001
From: "cozystack-ci[bot]"
 <274107086+cozystack-ci[bot]@users.noreply.github.com>
Date: Wed, 22 Apr 2026 07:28:09 +0000
Subject: [PATCH 568/666] Prepare release v1.3.0

Signed-off-by: cozystack-ci[bot] <274107086+cozystack-ci[bot]@users.noreply.github.com>
---
 packages/apps/kubernetes/images/kubevirt-csi-driver.tag     | 2 +-
 packages/apps/mariadb/images/mariadb-backup.tag             | 2 +-
 packages/core/installer/values.yaml                         | 4 ++--
 packages/core/platform/values.yaml                          | 2 +-
 packages/core/testing/values.yaml                           | 2 +-
 packages/extra/bootbox/images/matchbox.tag                  | 2 +-
 packages/extra/seaweedfs/images/objectstorage-sidecar.tag   | 2 +-
 packages/system/backup-controller/values.yaml               | 2 +-
 packages/system/backupstrategy-controller/values.yaml       | 2 +-
 packages/system/bucket/images/s3manager.tag                 | 2 +-
 packages/system/cozystack-api/values.yaml                   | 2 +-
 packages/system/cozystack-controller/values.yaml            | 2 +-
 packages/system/dashboard/templates/configmap.yaml          | 2 +-
 packages/system/dashboard/values.yaml                       | 6 +++---
 .../system/grafana-operator/images/grafana-dashboards.tag   | 2 +-
 packages/system/kamaji/values.yaml                          | 4 ++--
 packages/system/kubeovn-plunger/values.yaml                 | 2 +-
 packages/system/kubeovn-webhook/values.yaml                 | 2 +-
 packages/system/kubevirt-csi-node/values.yaml               | 2 +-
 packages/system/lineage-controller-webhook/values.yaml      | 2 +-
 packages/system/linstor/values.yaml                         | 4 ++--
 packages/system/multus/templates/multus-daemonset-thick.yml | 4 ++--
 packages/system/objectstorage-controller/values.yaml        | 2 +-
 packages/system/seaweedfs/values.yaml                       | 2 +-
 24 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
index ea4a21b3..00aa2caa 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:36e26a6b9063761ca3f5597bbd6272651d8a502abbc1c4e3a20e6b7e45a2875a
+ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:72154a97054e16cdf3dea6129d962b8d7e86b55cf9386095e8ac2ce7c8b69172
diff --git a/packages/apps/mariadb/images/mariadb-backup.tag b/packages/apps/mariadb/images/mariadb-backup.tag
index 1e381661..6c830892 100644
--- a/packages/apps/mariadb/images/mariadb-backup.tag
+++ b/packages/apps/mariadb/images/mariadb-backup.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/mariadb-backup:0.0.0@sha256:0ddbbec0568dcb9fbc317cd9cc654e826dbe88ba3f184fa9b6b58aacb93b4570
+ghcr.io/cozystack/cozystack/mariadb-backup:0.0.0@sha256:3841eb171416711977dea0cf8cd45d32344caac9727af760c37d5e1dd41ee4bb
diff --git a/packages/core/installer/values.yaml b/packages/core/installer/values.yaml
index f0a363e1..eef691ea 100644
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -1,9 +1,9 @@
 cozystackOperator:
   # Deployment variant: talos, generic, hosted
   variant: talos
-  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.3.0-rc.1@sha256:d833abf3eac990732440d7d04e2df62ef9cd46704e0637e63e86983132c6d958
+  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.3.0@sha256:62574f12486bb40c901cf5ed484cca264405ce5810196d86555cbb27cce1ba48
   platformSourceUrl: 'oci://ghcr.io/cozystack/cozystack/cozystack-packages'
-  platformSourceRef: 'digest=sha256:db28afd18635f6295342f58cd90ac7015c8f59d46ae9704fffeb2c654c3c8a0e'
+  platformSourceRef: 'digest=sha256:a0b9ef938446b3132d3d22ad2262beb1027c48c9037b6c2346fdc2f19acd3036'
 # Generic variant configuration (only used when cozystackOperator.variant=generic)
 cozystack:
   # Kubernetes API server host (IP only, no protocol/port)
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index 1d9a51c5..f33926db 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -5,7 +5,7 @@ sourceRef:
   path: /
 migrations:
   enabled: false
-  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.3.0-rc.1@sha256:555e4b76421361805a84bc9088b01b23a9c4a9430bd8ebd2db82ef9677d7008c
+  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.3.0@sha256:555e4b76421361805a84bc9088b01b23a9c4a9430bd8ebd2db82ef9677d7008c
   targetVersion: 39
 # Bundle deployment configuration
 bundles:
diff --git a/packages/core/testing/values.yaml b/packages/core/testing/values.yaml
index fe76a451..9d4bdd10 100644
--- a/packages/core/testing/values.yaml
+++ b/packages/core/testing/values.yaml
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.3.0-rc.1@sha256:0367a03b981df2a3ea13f411d4cb7869c2bf2c89c07d3d5c8971b9a28921ccef
+  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.3.0@sha256:0367a03b981df2a3ea13f411d4cb7869c2bf2c89c07d3d5c8971b9a28921ccef
diff --git a/packages/extra/bootbox/images/matchbox.tag b/packages/extra/bootbox/images/matchbox.tag
index 214064c3..f51c7675 100644
--- a/packages/extra/bootbox/images/matchbox.tag
+++ b/packages/extra/bootbox/images/matchbox.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/matchbox:v1.3.0-rc.1@sha256:27959a7e36fb5594049cf88e7b196e661c6ad161dc89330b2c0ef543d1d48367
+ghcr.io/cozystack/cozystack/matchbox:v1.3.0@sha256:85b8e04bf6f0690612dd63e80475df269f4a436d16680f8a40f2860cf16e2f74
diff --git a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
index 6d85d153..9b413da5 100644
--- a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
+++ b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.3.0-rc.1@sha256:5bcccbdb13979a16cee535eb5fbcdf0d87973689010a10b7b25e55c5be3edaa6
+ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.3.0@sha256:5bcccbdb13979a16cee535eb5fbcdf0d87973689010a10b7b25e55c5be3edaa6
diff --git a/packages/system/backup-controller/values.yaml b/packages/system/backup-controller/values.yaml
index 3c8834dc..34e033ce 100644
--- a/packages/system/backup-controller/values.yaml
+++ b/packages/system/backup-controller/values.yaml
@@ -1,5 +1,5 @@
 backupController:
-  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.3.0-rc.1@sha256:9d1727b80b436387141b43fd8c12ec36d75220e1d6014ebb58e2e8df3caba5e8"
+  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.3.0@sha256:e1a083dc92f26dfef004f47c1cd20a6357174aad835004f58e751c494b76649a"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/backupstrategy-controller/values.yaml b/packages/system/backupstrategy-controller/values.yaml
index 326dd7c2..d6453124 100644
--- a/packages/system/backupstrategy-controller/values.yaml
+++ b/packages/system/backupstrategy-controller/values.yaml
@@ -1,5 +1,5 @@
 backupStrategyController:
-  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.3.0-rc.1@sha256:aebdf354e15bff73d4e12d3f6117494002e8a4e586d1c46450cd0a3da493fbb5"
+  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.3.0@sha256:be0a9ec1f4307064b16388a24628aee46e06252738338add80b99ea1e04e62bf"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/bucket/images/s3manager.tag b/packages/system/bucket/images/s3manager.tag
index 30b082df..889db0af 100644
--- a/packages/system/bucket/images/s3manager.tag
+++ b/packages/system/bucket/images/s3manager.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:cfffa1267ad72d138c6e9eed6fa282f4fa23698bef2180be98c0be39c073ec28
+ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:fb65e734bbdbdaef2238769cc2ecfb54dbddaf1e0952ad438a9b3e26b9dbb4b5
diff --git a/packages/system/cozystack-api/values.yaml b/packages/system/cozystack-api/values.yaml
index 2ccdb706..dddabf54 100644
--- a/packages/system/cozystack-api/values.yaml
+++ b/packages/system/cozystack-api/values.yaml
@@ -1,3 +1,3 @@
 cozystackAPI:
-  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.3.0-rc.1@sha256:c57f2e62a547e4d62ec1c88708bbce146653bc68e1e312ab16f97a9206bd6750
+  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.3.0@sha256:5fa8648821cf1e9e08cf7c2899c4b1c4226bb74c6773327141456c7d3f2b9b7e
   replicas: 2
diff --git a/packages/system/cozystack-controller/values.yaml b/packages/system/cozystack-controller/values.yaml
index 6addae2b..4d0d0fde 100644
--- a/packages/system/cozystack-controller/values.yaml
+++ b/packages/system/cozystack-controller/values.yaml
@@ -1,4 +1,4 @@
 cozystackController:
-  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.3.0-rc.1@sha256:5ab50893e9d0237d26f366c9d647da6337ca9b97bae764430571d4fb080f6200
+  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.3.0@sha256:d03d19b78c4c98f970ac549a68b01ef6bd1ad755f5e0dcb9e08503511cdf2fdc
   debug: false
   disableTelemetry: false
diff --git a/packages/system/dashboard/templates/configmap.yaml b/packages/system/dashboard/templates/configmap.yaml
index c2be8d46..a2b7684c 100644
--- a/packages/system/dashboard/templates/configmap.yaml
+++ b/packages/system/dashboard/templates/configmap.yaml
@@ -1,6 +1,6 @@
 {{- $brandingConfig := .Values._cluster.branding | default dict }}
 
-{{- $tenantText := "v1.3.0-rc.1" }}
+{{- $tenantText := "v1.3.0" }}
 {{- $footerText := "Cozystack" }}
 {{- $titleText := "Cozystack Dashboard" }}
 {{- $logoText := "" }}
diff --git a/packages/system/dashboard/values.yaml b/packages/system/dashboard/values.yaml
index 63305af8..a5188825 100644
--- a/packages/system/dashboard/values.yaml
+++ b/packages/system/dashboard/values.yaml
@@ -1,6 +1,6 @@
 openapiUI:
-  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.3.0-rc.1@sha256:69dcecbea0cfff681043c75e3508c84f03a01b7be3e3a425deb740d629d3ab04
+  image: ghcr.io/cozystack/cozystack/openapi-ui:v1.3.0@sha256:0fa79c373a62840a617ff1ca1b0e31931c13a6cf7b0bb0ff0dc191f047a465a3
 openapiUIK8sBff:
-  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.3.0-rc.1@sha256:873cf834deddaa3954b6d9c5d520a8e03714b77178eff44826d93540561f599e
+  image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.3.0@sha256:1b3ea6d4c7dbbe6a8def3b2807fffdfab2ac4afc39d7a846e57dd491fa168f92
 tokenProxy:
-  image: ghcr.io/cozystack/cozystack/token-proxy:v1.3.0-rc.1@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
+  image: ghcr.io/cozystack/cozystack/token-proxy:v1.3.0@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc
diff --git a/packages/system/grafana-operator/images/grafana-dashboards.tag b/packages/system/grafana-operator/images/grafana-dashboards.tag
index 033a6742..cde83a70 100644
--- a/packages/system/grafana-operator/images/grafana-dashboards.tag
+++ b/packages/system/grafana-operator/images/grafana-dashboards.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/grafana-dashboards:v1.3.0-rc.1@sha256:2c9aa0b48e2bf6167db198f4d15882bfe51700108edf2e9f6d0942940a2c1204
+ghcr.io/cozystack/cozystack/grafana-dashboards:v1.3.0@sha256:2c9aa0b48e2bf6167db198f4d15882bfe51700108edf2e9f6d0942940a2c1204
diff --git a/packages/system/kamaji/values.yaml b/packages/system/kamaji/values.yaml
index b1ca3cb7..4de74113 100644
--- a/packages/system/kamaji/values.yaml
+++ b/packages/system/kamaji/values.yaml
@@ -3,7 +3,7 @@ kamaji:
     deploy: false
   image:
     pullPolicy: IfNotPresent
-    tag: v1.3.0-rc.1@sha256:8c9af083b60600c0800eb56a2cda75f26007b7272a1cf019140de003bfce1a4d
+    tag: v1.3.0@sha256:8c9af083b60600c0800eb56a2cda75f26007b7272a1cf019140de003bfce1a4d
     repository: ghcr.io/cozystack/cozystack/kamaji
   resources:
     limits:
@@ -13,4 +13,4 @@ kamaji:
       cpu: 100m
       memory: 100Mi
   extraArgs:
-    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.3.0-rc.1@sha256:8c9af083b60600c0800eb56a2cda75f26007b7272a1cf019140de003bfce1a4d
+    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.3.0@sha256:8c9af083b60600c0800eb56a2cda75f26007b7272a1cf019140de003bfce1a4d
diff --git a/packages/system/kubeovn-plunger/values.yaml b/packages/system/kubeovn-plunger/values.yaml
index a6946967..02620593 100644
--- a/packages/system/kubeovn-plunger/values.yaml
+++ b/packages/system/kubeovn-plunger/values.yaml
@@ -1,4 +1,4 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.3.0-rc.1@sha256:4819095c5237239b8e2282ed1710141a327b3e97773f598f983a22ec0f5add05
+image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.3.0@sha256:b75a0facb99c3b0fe8090414b3425f5c4858fff632d1de122ce9944c4daa89c0
 ovnCentralName: ovn-central
diff --git a/packages/system/kubeovn-webhook/values.yaml b/packages/system/kubeovn-webhook/values.yaml
index 24d75d95..0c6ce81a 100644
--- a/packages/system/kubeovn-webhook/values.yaml
+++ b/packages/system/kubeovn-webhook/values.yaml
@@ -1,3 +1,3 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.3.0-rc.1@sha256:e18f9fd679e38f65362a8d0042f25468272f6d081136ad47027168d8e7e07a4a
+image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.3.0@sha256:e18f9fd679e38f65362a8d0042f25468272f6d081136ad47027168d8e7e07a4a
diff --git a/packages/system/kubevirt-csi-node/values.yaml b/packages/system/kubevirt-csi-node/values.yaml
index a4d51b79..56e28543 100644
--- a/packages/system/kubevirt-csi-node/values.yaml
+++ b/packages/system/kubevirt-csi-node/values.yaml
@@ -1,3 +1,3 @@
 storageClass: replicated
 csiDriver:
-  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:36e26a6b9063761ca3f5597bbd6272651d8a502abbc1c4e3a20e6b7e45a2875a
+  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:72154a97054e16cdf3dea6129d962b8d7e86b55cf9386095e8ac2ce7c8b69172
diff --git a/packages/system/lineage-controller-webhook/values.yaml b/packages/system/lineage-controller-webhook/values.yaml
index 32439941..c5671548 100644
--- a/packages/system/lineage-controller-webhook/values.yaml
+++ b/packages/system/lineage-controller-webhook/values.yaml
@@ -1,5 +1,5 @@
 lineageControllerWebhook:
-  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.3.0-rc.1@sha256:7e443b9252f0477fe07471f76365edfa28550add51fe8fd4d11312d60a81850e
+  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.3.0@sha256:e8984709686a5eaf19b89da378d7b8c688ea5607e0783a88d9c9e4ccfca96fb0
   debug: false
   localK8sAPIEndpoint:
     enabled: true
diff --git a/packages/system/linstor/values.yaml b/packages/system/linstor/values.yaml
index 57f5f331..62dd2cac 100644
--- a/packages/system/linstor/values.yaml
+++ b/packages/system/linstor/values.yaml
@@ -1,7 +1,7 @@
 piraeusServer:
   image:
     repository: ghcr.io/cozystack/cozystack/piraeus-server
-    tag: 1.33.2@sha256:e748ea7b2adb285b0387fde4453320155fc03e4470db7d9af1d5447087bf18b4
+    tag: 1.33.2@sha256:553f313ab35dc2e345ef3683156d29e75c23177e2750e9af3a83aa9e23941cbb
 # Talos-specific workarounds (disable for generic Linux like Ubuntu/Debian)
 talos:
   enabled: true
@@ -13,4 +13,4 @@ linstor:
 linstorCSI:
   image:
     repository: ghcr.io/cozystack/cozystack/linstor-csi
-    tag: v1.10.5@sha256:a80d39f96a988085e84be2d6e896f4b4a008fccd5bbd9eaa2b8534b076429942
+    tag: v1.10.5@sha256:b8f59b5659fb1791cb764d3f37df4cf29920aadcc10637231ba7d857233f377d
diff --git a/packages/system/multus/templates/multus-daemonset-thick.yml b/packages/system/multus/templates/multus-daemonset-thick.yml
index 2ddc6362..cad330ea 100644
--- a/packages/system/multus/templates/multus-daemonset-thick.yml
+++ b/packages/system/multus/templates/multus-daemonset-thick.yml
@@ -155,7 +155,7 @@ spec:
       serviceAccountName: multus
       containers:
         - name: kube-multus
-          image: ghcr.io/cozystack/cozystack/multus-cni:v1.3.0-rc.1@sha256:d76cc81c9ef1521e1317aacdc98360325f4fbecdfc687b97852e2f5c275551b1
+          image: ghcr.io/cozystack/cozystack/multus-cni:v1.3.0@sha256:6735ffc12e5e660951f5a42943b38c308f33774a55836e94c191001405b58ec0
           command: [ "/usr/src/multus-cni/bin/multus-daemon" ]
           resources:
             requests:
@@ -201,7 +201,7 @@ spec:
                   fieldPath: spec.nodeName
       initContainers:
         - name: install-multus-binary
-          image: ghcr.io/cozystack/cozystack/multus-cni:v1.3.0-rc.1@sha256:d76cc81c9ef1521e1317aacdc98360325f4fbecdfc687b97852e2f5c275551b1
+          image: ghcr.io/cozystack/cozystack/multus-cni:v1.3.0@sha256:6735ffc12e5e660951f5a42943b38c308f33774a55836e94c191001405b58ec0
           command:
             - "/usr/src/multus-cni/bin/install_multus"
             - "-d"
diff --git a/packages/system/objectstorage-controller/values.yaml b/packages/system/objectstorage-controller/values.yaml
index 4def5b26..a3859194 100644
--- a/packages/system/objectstorage-controller/values.yaml
+++ b/packages/system/objectstorage-controller/values.yaml
@@ -1,3 +1,3 @@
 objectstorage:
   controller:
-    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.3.0-rc.1@sha256:50b7eb360538dec3db747c9b28792b207068defc1f630d4bd965015d934d5279"
+    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.3.0@sha256:7a9e4bf9c3f95f364756396815bb51b6c0f58f85db653460574d94b96cd3c7d5"
diff --git a/packages/system/seaweedfs/values.yaml b/packages/system/seaweedfs/values.yaml
index 57843ff5..3542a77f 100644
--- a/packages/system/seaweedfs/values.yaml
+++ b/packages/system/seaweedfs/values.yaml
@@ -177,7 +177,7 @@ seaweedfs:
     bucketClassName: "seaweedfs"
     region: ""
     sidecar:
-      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.3.0-rc.1@sha256:5bcccbdb13979a16cee535eb5fbcdf0d87973689010a10b7b25e55c5be3edaa6"
+      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.3.0@sha256:5bcccbdb13979a16cee535eb5fbcdf0d87973689010a10b7b25e55c5be3edaa6"
   certificates:
     commonName: "SeaweedFS CA"
     ipAddresses: []

From 51c2ec0ad41722f34d6cb8a5d111ceac021c4464 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Wed, 22 Apr 2026 13:25:16 +0300
Subject: [PATCH 569/666] feat(hami): add HAMi GPU virtualization system chart

Add HAMi v2.8.1 (CNCF Sandbox) as a new system package for fractional
GPU sharing in tenant Kubernetes clusters. The chart enables workloads
to request specific amounts of GPU memory and compute cores instead of
claiming entire GPUs.

Vendored upstream chart includes device plugin, scheduler extender,
mutating webhook, and DRA subchart. Wrapper values configure nvidia
RuntimeClass and clear hardcoded node config from upstream defaults.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/system/hami/Chart.yaml               |   3 +
 packages/system/hami/Makefile                 |  11 +
 packages/system/hami/charts/hami/Chart.lock   |   6 +
 packages/system/hami/charts/hami/Chart.yaml   |  22 +
 packages/system/hami/charts/hami/README.md    | 237 +++++++++
 .../charts/hami/charts/hami-dra/.helmignore   |  24 +
 .../charts/hami/charts/hami-dra/Chart.yaml    |  18 +
 .../charts/hami-dra/templates/_commons.tpl    |  84 ++++
 .../charts/hami-dra/templates/_helpers.tpl    |  73 +++
 .../hami-dra-driver/deviceclass.yaml          |  11 +
 .../nvidia-dra-driver-daemonset.yaml          | 145 ++++++
 .../templates/hami-dra-driver/rbac.yaml       | 110 ++++
 .../monitor/monitor-clusterrole.yaml          |  11 +
 .../monitor/monitor-clusterrolebinding.yaml   |  15 +
 .../templates/monitor/monitor-deployment.yaml |  62 +++
 .../templates/monitor/monitor-service.yaml    |  26 +
 .../monitor/monitor-serviceaccount.yaml       |   8 +
 .../templates/webhook/cert-manager.yaml       |  29 ++
 .../templates/webhook/cert-secret.yaml        |  13 +
 .../templates/webhook/device-config.yaml      | 394 +++++++++++++++
 .../webhook/mutatingwebhookconfiguration.yaml |  28 ++
 .../validatingwebhookconfiguration.yaml       |  29 ++
 .../webhook/webhook-clusterrole.yaml          |  14 +
 .../webhook/webhook-clusterrolebinding.yaml   |  12 +
 .../templates/webhook/webhook-deployment.yaml |  59 +++
 .../templates/webhook/webhook-service.yaml    |  15 +
 .../webhook/webhook-serviceaccount.yaml       |   5 +
 .../charts/hami/charts/hami-dra/values.yaml   | 166 ++++++
 .../hami/charts/hami/templates/NOTES.txt      |   3 +
 .../hami/charts/hami/templates/_commons.tpl   |  49 ++
 .../hami/charts/hami/templates/_helpers.tpl   | 163 ++++++
 .../templates/device-plugin/configmap.yaml    |  13 +
 .../device-plugin/daemonsetmock.yaml          |  55 ++
 .../device-plugin/daemonsetnvidia.yaml        | 262 ++++++++++
 .../templates/device-plugin/monitorrole.yaml  |  29 ++
 .../device-plugin/monitorrolebinding.yaml     |  17 +
 .../device-plugin/monitorservice.yaml         |  29 ++
 .../device-plugin/monitorserviceaccount.yaml  |  10 +
 .../device-plugin/runtime-class.yaml          |  11 +
 .../hami/templates/scheduler/certmanager.yaml |  31 ++
 .../hami/templates/scheduler/clusterrole.yaml |  36 ++
 .../scheduler/clusterrolebinding.yaml         |  49 ++
 .../hami/templates/scheduler/configmap.yaml   | 142 ++++++
 .../templates/scheduler/configmapnew.yaml     | 102 ++++
 .../hami/templates/scheduler/deployment.yaml  | 227 +++++++++
 .../templates/scheduler/device-configmap.yaml | 410 +++++++++++++++
 .../scheduler/job-patch/clusterrole.yaml      |  30 ++
 .../job-patch/clusterrolebinding.yaml         |  22 +
 .../scheduler/job-patch/job-createSecret.yaml |  70 +++
 .../scheduler/job-patch/job-patchWebhook.yaml |  65 +++
 .../templates/scheduler/job-patch/psp.yaml    |  40 ++
 .../templates/scheduler/job-patch/role.yaml   |  23 +
 .../scheduler/job-patch/rolebinding.yaml      |  23 +
 .../scheduler/job-patch/serviceaccount.yaml   |  15 +
 .../charts/hami/templates/scheduler/role.yaml |  14 +
 .../hami/templates/scheduler/rolebinding.yaml |  33 ++
 .../hami/templates/scheduler/service.yaml     |  36 ++
 .../templates/scheduler/serviceaccount.yaml   |  18 +
 .../hami/templates/scheduler/webhook.yaml     |  57 +++
 packages/system/hami/charts/hami/values.yaml  | 476 ++++++++++++++++++
 packages/system/hami/values.yaml              |   8 +
 61 files changed, 4198 insertions(+)
 create mode 100644 packages/system/hami/Chart.yaml
 create mode 100644 packages/system/hami/Makefile
 create mode 100644 packages/system/hami/charts/hami/Chart.lock
 create mode 100644 packages/system/hami/charts/hami/Chart.yaml
 create mode 100644 packages/system/hami/charts/hami/README.md
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/.helmignore
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/Chart.yaml
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/_commons.tpl
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/_helpers.tpl
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/deviceclass.yaml
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/nvidia-dra-driver-daemonset.yaml
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/rbac.yaml
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-clusterrole.yaml
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-clusterrolebinding.yaml
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-deployment.yaml
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-service.yaml
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-serviceaccount.yaml
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/cert-manager.yaml
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/cert-secret.yaml
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/device-config.yaml
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/mutatingwebhookconfiguration.yaml
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/validatingwebhookconfiguration.yaml
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-clusterrole.yaml
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-clusterrolebinding.yaml
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-deployment.yaml
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-service.yaml
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-serviceaccount.yaml
 create mode 100644 packages/system/hami/charts/hami/charts/hami-dra/values.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/NOTES.txt
 create mode 100644 packages/system/hami/charts/hami/templates/_commons.tpl
 create mode 100644 packages/system/hami/charts/hami/templates/_helpers.tpl
 create mode 100644 packages/system/hami/charts/hami/templates/device-plugin/configmap.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/device-plugin/daemonsetmock.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/device-plugin/daemonsetnvidia.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/device-plugin/monitorrole.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/device-plugin/monitorrolebinding.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/device-plugin/monitorserviceaccount.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/device-plugin/runtime-class.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/certmanager.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/clusterrole.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/clusterrolebinding.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/configmap.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/configmapnew.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/deployment.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/device-configmap.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrole.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrolebinding.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/job-patch/job-createSecret.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/job-patch/job-patchWebhook.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/job-patch/psp.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/job-patch/role.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/job-patch/rolebinding.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/job-patch/serviceaccount.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/role.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/rolebinding.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/service.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/serviceaccount.yaml
 create mode 100644 packages/system/hami/charts/hami/templates/scheduler/webhook.yaml
 create mode 100644 packages/system/hami/charts/hami/values.yaml
 create mode 100644 packages/system/hami/values.yaml

diff --git a/packages/system/hami/Chart.yaml b/packages/system/hami/Chart.yaml
new file mode 100644
index 00000000..3fcf4c5d
--- /dev/null
+++ b/packages/system/hami/Chart.yaml
@@ -0,0 +1,3 @@
+apiVersion: v2
+name: cozy-hami
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
diff --git a/packages/system/hami/Makefile b/packages/system/hami/Makefile
new file mode 100644
index 00000000..b7a169c2
--- /dev/null
+++ b/packages/system/hami/Makefile
@@ -0,0 +1,11 @@
+export NAME=hami
+export NAMESPACE=cozy-$(NAME)
+
+include ../../../hack/common-envs.mk
+include ../../../hack/package.mk
+
+update:
+	rm -rf charts
+	helm repo add hami-charts https://project-hami.github.io/HAMi/
+	helm repo update hami-charts
+	helm pull hami-charts/hami --untar --untardir charts
diff --git a/packages/system/hami/charts/hami/Chart.lock b/packages/system/hami/charts/hami/Chart.lock
new file mode 100644
index 00000000..25856c07
--- /dev/null
+++ b/packages/system/hami/charts/hami/Chart.lock
@@ -0,0 +1,6 @@
+dependencies:
+- name: hami-dra
+  repository: https://project-hami.github.io/HAMi-DRA/
+  version: 0.1.0
+digest: sha256:374551539570bcee82c1c4dea93eac59e6f410b6d5967d188efd630e203d43bb
+generated: "2026-04-17T04:06:47.689117678Z"
diff --git a/packages/system/hami/charts/hami/Chart.yaml b/packages/system/hami/charts/hami/Chart.yaml
new file mode 100644
index 00000000..aba7e95c
--- /dev/null
+++ b/packages/system/hami/charts/hami/Chart.yaml
@@ -0,0 +1,22 @@
+apiVersion: v2
+appVersion: 2.8.1
+dependencies:
+- condition: dra.enabled
+  name: hami-dra
+  repository: https://project-hami.github.io/HAMi-DRA/
+  version: 0.1.0
+description: Heterogeneous AI Computing Virtualization Middleware
+keywords:
+- vgpu
+- gpu
+kubeVersion: '>= 1.18.0-0'
+maintainers:
+- email: archlitchi@gmail.com
+  name: limengxuan
+- email: xiaozhang0210@hotmail.com
+  name: zhangxiao
+name: hami
+sources:
+- https://github.com/Project-HAMi/HAMi
+type: application
+version: 2.8.1
diff --git a/packages/system/hami/charts/hami/README.md b/packages/system/hami/charts/hami/README.md
new file mode 100644
index 00000000..e8217290
--- /dev/null
+++ b/packages/system/hami/charts/hami/README.md
@@ -0,0 +1,237 @@
+# HAMi Helm Chart Values Documentation
+
+This document provides detailed descriptions of all configurable values parameters for the HAMi Helm Chart.
+
+## Global Configuration
+
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `global.imageRegistry` | Global Docker image registry | `""` |
+| `global.imagePullSecrets` | Global Docker image pull secrets | `[]` |
+| `global.imageTag` | Image tag | `"v2.8.1"` |
+| `global.gpuHookPath` | GPU Hook path | `/usr/local` |
+| `global.labels` | Global labels | `{}` |
+| `global.annotations` | Global annotations | `{}` |
+| `global.managedNodeSelectorEnable` | Whether to enable managed node selector | `false` |
+| `global.managedNodeSelector.usage` | Managed node selector usage | `"gpu"` |
+| `nameOverride` | Name override | `""` |
+| `fullnameOverride` | Full name override | `""` |
+| `namespaceOverride` | Namespace override | `""` |
+
+## Resource Name Configuration
+
+### NVIDIA GPU Resources
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `resourceName` | GPU resource name | `"nvidia.com/gpu"` |
+| `resourceMem` | GPU memory resource name | `"nvidia.com/gpumem"` |
+| `resourceMemPercentage` | GPU memory percentage resource name | `"nvidia.com/gpumem-percentage"` |
+| `resourceCores` | GPU core resource name | `"nvidia.com/gpucores"` |
+| `resourcePriority` | GPU priority resource name | `"nvidia.com/priority"` |
+
+### Cambricon MLU Resources
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `mluResourceName` | MLU resource name | `"cambricon.com/vmlu"` |
+| `mluResourceMem` | MLU memory resource name | `"cambricon.com/mlu.smlu.vmemory"` |
+| `mluResourceCores` | MLU core resource name | `"cambricon.com/mlu.smlu.vcore"` |
+
+### Hygon DCU Resources
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `dcuResourceName` | DCU resource name | `"hygon.com/dcunum"` |
+| `dcuResourceMem` | DCU memory resource name | `"hygon.com/dcumem"` |
+| `dcuResourceCores` | DCU core resource name | `"hygon.com/dcucores"` |
+
+### Metax GPU Resources
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `metaxResourceName` | GPU resource name | `"metax-tech.com/sgpu"` |
+| `metaxResourceCore` | GPU core resource name | `"metax-tech.com/vcore"` |
+| `metaxResourceMem` | GPU memory resource name | `"metax-tech.com/vmemory"` |
+| `metaxsGPUTopologyAware` | GPU topology awareness | `"false"` |
+
+### Enflame GCU Resources
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `enflameResourceNameVGCU` | vGCU resource name | `"enflame.com/vgcu"` |
+| `enflameResourceNameVGCUPercentage` | vGCU percentage resource name | `"enflame.com/vgcu-percentage"` |
+
+### Kunlunxin XPU Resources
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `kunlunResourceName` | XPU resource name | `"kunlunxin.com/xpu"` |
+
+## Scheduler Configuration
+
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `schedulerName` | Scheduler name | `"hami-scheduler"` |
+| `scheduler.nodeName` | Define node name, scheduler will schedule to this node | `""` |
+| `scheduler.overwriteEnv` | Whether to overwrite environment variables | `"false"` |
+| `scheduler.defaultSchedulerPolicy.nodeSchedulerPolicy` | Node scheduler policy | `binpack` |
+| `scheduler.defaultSchedulerPolicy.gpuSchedulerPolicy` | GPU scheduler policy | `spread` |
+| `scheduler.metricsBindAddress` | Metrics bind address | `":9395"` |
+| `scheduler.forceOverwriteDefaultScheduler` | Whether to force overwrite default scheduler | `true` |
+| `scheduler.livenessProbe` | Whether to enable liveness probe | `false` |
+| `scheduler.leaderElect` | Whether to enable leader election | `true` |
+| `scheduler.replicas` | Number of replicas | `1` |
+
+### Kube Scheduler Configuration
+
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `scheduler.kubeScheduler.enabled` | Whether to run kube-scheduler container in scheduler pod | `true` |
+| `scheduler.kubeScheduler.image.registry` | Kube scheduler image registry | `"registry.cn-hangzhou.aliyuncs.com"` |
+| `scheduler.kubeScheduler.image.repository` | Kube scheduler image repository | `"google_containers/kube-scheduler"` |
+| `scheduler.kubeScheduler.image.tag` | Kube scheduler image tag | `""` |
+| `scheduler.kubeScheduler.image.pullPolicy` | Kube scheduler image pull policy | `IfNotPresent` |
+| `scheduler.kubeScheduler.image.pullSecrets` | Kube scheduler image pull secrets | `[]` |
+| `scheduler.kubeScheduler.extraNewArgs` | Extra new arguments | `["--config=/config/config.yaml", "-v=4"]` |
+| `scheduler.kubeScheduler.extraArgs` | Extra arguments | `["--policy-config-file=/config/config.json", "-v=4"]` |
+
+### Extender Configuration
+
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `scheduler.extender.image.registry` | Scheduler extender image registry | `"docker.io"` |
+| `scheduler.extender.image.repository` | Scheduler extender image repository | `"projecthami/hami"` |
+| `scheduler.extender.image.tag` | Scheduler extender image tag | `""` |
+| `scheduler.extender.image.pullPolicy` | Scheduler extender image pull policy | `IfNotPresent` |
+| `scheduler.extender.image.pullSecrets` | Scheduler extender image pull secrets | `[]` |
+| `scheduler.extender.extraArgs` | Scheduler extender extra arguments | `["--debug", "-v=4"]` |
+
+### Admission Webhook Configuration
+
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `scheduler.admissionWebhook.enabled` | Whether to enable admission webhook | `true` |
+| `scheduler.admissionWebhook.customURL.enabled` | Whether to enable custom URL | `false` |
+| `scheduler.admissionWebhook.customURL.host` | Custom URL host | `127.0.0.1` |
+| `scheduler.admissionWebhook.customURL.port` | Custom URL port | `31998` |
+| `scheduler.admissionWebhook.customURL.path` | Custom URL path | `/webhook` |
+| `scheduler.admissionWebhook.reinvocationPolicy` | Reinvocation policy | `Never` |
+| `scheduler.admissionWebhook.failurePolicy` | Failure policy | `Ignore` |
+
+### TLS Certificate Configuration
+
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `scheduler.certManager.enabled` | Whether to use cert-manager to generate self-signed certificates | `false` |
+| `scheduler.patch.enabled` | Whether to use kube-webhook-certgen to generate self-signed certificates | `true` |
+| `scheduler.patch.image.registry` | Certgen image registry | `"docker.io"` |
+| `scheduler.patch.image.repository` | Certgen image repository | `"jettech/kube-webhook-certgen"` |
+| `scheduler.patch.image.tag` | Certgen image tag | `"v1.5.2"` |
+| `scheduler.patch.image.pullPolicy` | Certgen image pull policy | `IfNotPresent` |
+| `scheduler.patch.imageNew.registry` | New certgen image registry | `"docker.io"` |
+| `scheduler.patch.imageNew.repository` | New certgen image repository | `"liangjw/kube-webhook-certgen"` |
+| `scheduler.patch.imageNew.tag` | New certgen image tag | `"v1.1.1"` |
+
+### Scheduler Service Configuration
+
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `scheduler.service.type` | Service type | `NodePort` |
+| `scheduler.service.httpPort` | HTTP port | `443` |
+| `scheduler.service.schedulerPort` | Scheduler NodePort | `31998` |
+| `scheduler.service.monitorPort` | Monitor port | `31993` |
+| `scheduler.service.monitorTargetPort` | Monitor target port | `9395` |
+
+## Device Plugin Configuration
+
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `devicePlugin.image.registry` | Device plugin image registry | `"docker.io"` |
+| `devicePlugin.image.repository` | Device plugin image repository | `"projecthami/hami"` |
+| `devicePlugin.image.tag` | Device plugin image tag | `""` |
+| `devicePlugin.image.pullPolicy` | Device plugin image pull policy | `IfNotPresent` |
+| `devicePlugin.image.pullSecrets` | Device plugin image pull secrets | `[]` |
+
+### Monitor Configuration
+
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `devicePlugin.monitor.image.registry` | Monitor image registry | `"docker.io"` |
+| `devicePlugin.monitor.image.repository` | Monitor image repository | `"projecthami/hami"` |
+| `devicePlugin.monitor.image.tag` | Monitor image tag | `""` |
+| `devicePlugin.monitor.image.pullPolicy` | Monitor image pull policy | `IfNotPresent` |
+| `devicePlugin.monitor.image.pullSecrets` | Monitor image pull secrets | `[]` |
+| `devicePlugin.monitor.ctrPath` | Container path | `/usr/local/vgpu/containers` |
+| `devicePlugin.monitor.extraArgs` | Monitor extra arguments | `["-v=4"]` |
+| `devicePlugin.monitor.extraEnvs` | Monitor extra environments | `{}` |
+
+### Device Plugin Other Configuration
+
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `devicePlugin.deviceSplitCount` | Integer type, default value: 10. Maximum number of tasks assigned to a single GPU device | `10` |
+| `devicePlugin.deviceMemoryScaling` | Device memory scaling ratio | `1` |
+| `devicePlugin.deviceCoreScaling` | Device core scaling ratio | `1` |
+| `devicePlugin.runtimeClassName` | Runtime class name | `""` |
+| `devicePlugin.createRuntimeClass` | Whether to create runtime class | `false` |
+| `devicePlugin.migStrategy` | String type, "none" means ignore MIG functionality, "mixed" means allocate MIG devices through independent resources | `"none"` |
+| `devicePlugin.disablecorelimit` | String type, "true" means disable core limit, "false" means enable core limit | `"false"` |
+| `devicePlugin.passDeviceSpecsEnabled` | Whether to enable passing device specs | `false` |
+| `devicePlugin.extraArgs` | Device plugin extra arguments | `["-v=4"]` |
+| `devicePlugin.nodeConfiguration.config` | Node configuration for device plugin by json | An example of default configuration. |
+| `devicePlugin.nodeConfiguration.externalConfigName` | Node configuration for device plugin by external congimap | `""` |
+| `devicePlugin.extraEnvs` | Device plugin extra environments | `{}` |
+
+### Device Plugin Service Configuration
+
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `devicePlugin.service.type` | Service type | `NodePort` |
+| `devicePlugin.service.httpPort` | HTTP port | `31992` |
+
+### Device Plugin Deployment Configuration
+
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `devicePlugin.pluginPath` | Plugin path | `/var/lib/kubelet/device-plugins` |
+| `devicePlugin.libPath` | Library path | `/usr/local/vgpu` |
+| `devicePlugin.nvidiaNodeSelector` | NVIDIA node selector | `{"gpu": "on"}` |
+| `devicePlugin.updateStrategy.type` | Update strategy type | `RollingUpdate` |
+| `devicePlugin.updateStrategy.rollingUpdate.maxUnavailable` | Maximum unavailable count | `1` |
+
+## Device Configuration
+
+### AWS Neuron
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `devices.awsneuron.customresources` | Custom resources | `["aws.amazon.com/neuron", "aws.amazon.com/neuroncore"]` |
+
+### Kunlunxin
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `devices.kunlun.enabled` | Whether to enable | `true` |
+| `devices.kunlun.customresources` | Custom resources | `["kunlunxin.com/xpu"]` |
+
+### Mthreads
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `devices.mthreads.enabled` | Whether to enable | `true` |
+| `devices.mthreads.customresources` | Custom resources | `["mthreads.com/vgpu"]` |
+
+### NVIDIA
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `devices.nvidia.gpuCorePolicy` | GPU core policy | `default` |
+| `devices.nvidia.libCudaLogLevel` | CUDA library log level | `1` |
+
+### Huawei Ascend
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `devices.ascend.enabled` | Whether to enable | `false` |
+| `devices.ascend.image` | Image | `""` |
+| `devices.ascend.imagePullPolicy` | Image pull policy | `IfNotPresent` |
+| `devices.ascend.extraArgs` | Extra arguments | `[]` |
+| `devices.ascend.nodeSelector` | Node selector | `{"ascend": "on"}` |
+| `devices.ascend.tolerations` | Tolerations | `[]` |
+| `devices.ascend.customresources` | Custom resources | `["huawei.com/Ascend910A", "huawei.com/Ascend910A-memory", ...]` |
+
+### Iluvatar
+| Parameter | Description | Default Value |
+|-----------|-------------|---------------|
+| `devices.iluvatar.enabled` | Whether to enable | `false` |
+| `devices.iluvatar.customresources` | Custom resources | `["iluvatar.ai/BI-V150-vgpu", "iluvatar.ai/BI-V150.vMem","iluvatar.ai/BI-V150.vCore", ...]` |
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/.helmignore b/packages/system/hami/charts/hami/charts/hami-dra/.helmignore
new file mode 100644
index 00000000..898df488
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/.helmignore
@@ -0,0 +1,24 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/Chart.yaml b/packages/system/hami/charts/hami/charts/hami-dra/Chart.yaml
new file mode 100644
index 00000000..d01f678f
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/Chart.yaml
@@ -0,0 +1,18 @@
+apiVersion: v2
+appVersion: 0.1.0
+description: A Helm chart for HAMi DRA
+home: https://github.com/Project-HAMi/HAMi-DRA
+keywords:
+- webhook
+- kubernetes
+- admission-controller
+- hami
+- dra
+maintainers:
+- name: hami-dra
+  url: https://github.com/Project-HAMi/HAMi-DRA
+name: hami-dra
+sources:
+- https://github.com/Project-HAMi/HAMi-DRA
+type: application
+version: 0.1.0
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/_commons.tpl b/packages/system/hami/charts/hami/charts/hami-dra/templates/_commons.tpl
new file mode 100644
index 00000000..02fbed20
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/_commons.tpl
@@ -0,0 +1,84 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/*
+Return the proper image name
+{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" $) }}
+*/}}
+{{- define "common.images.image" -}}
+{{- $registryName := .imageRoot.registry -}}
+{{- $repositoryName := .imageRoot.repository -}}
+{{- $tag := .imageRoot.tag | toString -}}
+{{- if .global }}
+    {{- if .global.imageRegistry }}
+     {{- $registryName = .global.imageRegistry -}}
+    {{- end -}}
+{{- end -}}
+{{- if .tag }}
+    {{- if .tag.imageTag }}
+     {{- $tag = .tag.imageTag -}}
+    {{- end -}}
+{{- end -}}
+{{- if $registryName }}
+{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
+{{- else -}}
+{{- printf "%s:%s" $repositoryName $tag -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead)
+{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }}
+*/}}
+{{- define "common.images.pullSecrets" -}}
+  {{- $pullSecrets := list }}
+
+  {{- if .global }}
+    {{- range .global.imagePullSecrets -}}
+      {{- $pullSecrets = append $pullSecrets . -}}
+    {{- end -}}
+  {{- end -}}
+
+  {{- range .images -}}
+    {{- range .pullSecrets -}}
+      {{- $pullSecrets = append $pullSecrets . -}}
+    {{- end -}}
+  {{- end -}}
+
+  {{- if (not (empty $pullSecrets)) }}
+imagePullSecrets:
+    {{- range $pullSecrets }}
+  - name: {{ . }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Renders a value that contains template.
+Usage:
+{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $) }}
+*/}}
+{{- define "common.tplvalues.render" -}}
+    {{- if typeIs "string" .value }}
+        {{- tpl .value .context }}
+    {{- else }}
+        {{- tpl (.value | toYaml) .context }}
+    {{- end }}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "common.names.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/_helpers.tpl b/packages/system/hami/charts/hami/charts/hami-dra/templates/_helpers.tpl
new file mode 100644
index 00000000..99beec77
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/_helpers.tpl
@@ -0,0 +1,73 @@
+{{- define "hami.dra.webhook.fullname" -}}
+{{- printf "%s-%s" (include "common.names.fullname" .) "webhook" | trunc 63 | trimSuffix "-" -}}
+{{- end }}
+
+{{- define "hami.dra.webhook.image" -}}
+{{ include "common.images.image" (dict "imageRoot" .Values.webhook.image "global" .Values.global) }}
+{{- end -}}
+
+{{- define "hami.dra.webhook.imagePullSecrets" -}}
+{{ include "common.images.pullSecrets" (dict "images" (list .Values.webhook.image) "global" .Values.global) }}
+{{- end -}}
+
+{{- define "hami.dra.driver.nvidia.image" -}}
+{{ include "common.images.image" (dict "imageRoot" .Values.drivers.nvidia.image "global" .Values.global) }}
+{{- end -}}
+
+{{- define "hami.dra.driver.nvidia.imagePullSecrets" -}}
+{{ include "common.images.pullSecrets" (dict "images" (list .Values.drivers.nvidia.image) "global" .Values.global) }}
+{{- end -}}
+
+{{/*
+Common labels
+*/}}
+{{- define "hami-dra-webhook.labels" -}}
+helm.sh/chart: {{ .Chart.Name }}
+{{ include "hami-dra-webhook.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "hami-dra-webhook.selectorLabels" -}}
+app.kubernetes.io/name: {{ .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/component: webhook
+{{- end }}
+
+{{- define "hami.dra.monitor.fullname" -}}
+{{- printf "%s-%s" (include "common.names.fullname" .) "monitor" | trunc 63 | trimSuffix "-" -}}
+{{- end }}
+
+{{- define "hami.dra.monitor.image" -}}
+{{ include "common.images.image" (dict "imageRoot" .Values.monitor.image "global" .Values.global) }}
+{{- end -}}
+
+{{- define "hami.dra.monitor.imagePullSecrets" -}}
+{{ include "common.images.pullSecrets" (dict "images" (list .Values.monitor.image) "global" .Values.global) }}
+{{- end -}}
+
+{{/*
+Common labels for monitor
+*/}}
+{{- define "hami-dra-monitor.labels" -}}
+helm.sh/chart: {{ .Chart.Name }}
+{{ include "hami-dra-monitor.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels for monitor
+*/}}
+{{- define "hami-dra-monitor.selectorLabels" -}}
+app.kubernetes.io/name: {{ .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/component: monitor
+{{- end }}
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/deviceclass.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/deviceclass.yaml
new file mode 100644
index 00000000..bcb6d2c5
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/deviceclass.yaml
@@ -0,0 +1,11 @@
+{{- if .Values.drivers.nvidia.enabled }}
+apiVersion: resource.k8s.io/v1
+kind: DeviceClass
+metadata:
+  name: hami-core-gpu.project-hami.io
+spec:
+  selectors:
+  - cel:
+      expression: |-
+        device.driver == "hami-core-gpu.project-hami.io" && device.attributes["hami-core-gpu.project-hami.io"].type == "hami-gpu"
+{{- end }}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/nvidia-dra-driver-daemonset.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/nvidia-dra-driver-daemonset.yaml
new file mode 100644
index 00000000..a3fb0d01
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/nvidia-dra-driver-daemonset.yaml
@@ -0,0 +1,145 @@
+{{- if .Values.drivers.nvidia.enabled }}
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: hami-dra-driver-kubelet-plugin
+  namespace: {{ .Release.Namespace }}
+spec:
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      hami-dra-driver-component: kubelet-plugin
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: hami-dra-driver
+        app.kubernetes.io/name: hami-dra-driver
+        hami-dra-driver-component: kubelet-plugin
+    spec:
+      {{- include "hami.dra.driver.nvidia.imagePullSecrets" . | nindent 6 }}
+      initContainers:
+      - name: init-container
+        image: {{ include "hami.dra.driver.nvidia.image" . }}
+        securityContext:
+          privileged: true
+        command: [bash, /usr/bin/kubelet-plugin-prestart.sh]
+        env:
+        - name: NVIDIA_DRIVER_ROOT
+          value: {{ if .Values.drivers.nvidia.containerDriver }}/run/nvidia/driver{{ else }}/{{ end }}
+        - name: NVIDIA_VISIBLE_DEVICES
+          value: void
+        - name: KUBELET_REGISTRAR_DIRECTORY_PATH
+          value: /var/lib/kubelet/plugins_registry
+        - name: KUBELET_PLUGINS_DIRECTORY_PATH
+          value: /var/lib/kubelet/plugins
+        volumeMounts:
+        - name: driver-root-parent
+          mountPath: /driver-root-parent
+          readOnly: true
+      containers:
+      - args:
+        - |-
+          # Conditionally mask the params file to prevent this container from
+          # recreating any missing GPU device nodes. This is necessary, for
+          # example, when running under nvkind to limit the set GPUs governed
+          # by the plugin even though it has cgroup access to all of them.
+          if [ "${MASK_NVIDIA_DRIVER_PARAMS}" = "true" ]; then
+            cp /proc/driver/nvidia/params root/gpu-params
+            sed -i 's/^ModifyDeviceFiles: 1$/ModifyDeviceFiles: 0/' root/gpu-params
+            mount --bind root/gpu-params /proc/driver/nvidia/params
+          fi
+          hami-kubelet-plugin -v 6
+        command:
+        - bash
+        - -c
+        env:
+        - name: MASK_NVIDIA_DRIVER_PARAMS
+          value: ""
+        - name: NVIDIA_DRIVER_ROOT
+          value: {{ if .Values.drivers.nvidia.containerDriver }}/run/nvidia/driver{{ else }}/{{ end }}
+        - name: NVIDIA_VISIBLE_DEVICES
+          value: void
+        - name: CDI_ROOT
+          value: /var/run/cdi
+        - name: NVIDIA_MIG_CONFIG_DEVICES
+          value: all
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: spec.nodeName
+        - name: NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: KUBELET_REGISTRAR_DIRECTORY_PATH
+          value: /var/lib/kubelet/plugins_registry
+        - name: KUBELET_PLUGINS_DIRECTORY_PATH
+          value: /var/lib/kubelet/plugins
+        - name: IMAGE_NAME
+          value: {{ include "hami.dra.driver.nvidia.image" . }}
+        lifecycle:
+          postStart:
+            exec:
+              command: ["/bin/bash", "-c", "/usr/bin/vgpu-init.sh /usr/local/vgpu/"]
+        image: {{ include "hami.dra.driver.nvidia.image" . }}
+        imagePullPolicy: {{ .Values.drivers.nvidia.image.pullPolicy | default "IfNotPresent" }}
+        name: gpus
+        securityContext:
+          privileged: true
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /var/lib/kubelet/plugins_registry
+          name: plugins-registry
+        - mountPath: /var/lib/kubelet/plugins
+          mountPropagation: Bidirectional
+          name: plugins
+        - mountPath: /var/run/cdi
+          name: cdi
+        - mountPath: /driver-root
+          mountPropagation: HostToContainer
+          name: driver-root
+          readOnly: true
+        - mountPath: /usr/local/vgpu
+          name: host-vgpu
+        - mountPath: /tmp
+          name: host-tmp
+      dnsPolicy: ClusterFirst
+      serviceAccount: hami-dra-driver-service-account
+      serviceAccountName: hami-dra-driver-service-account
+      volumes:
+      - hostPath:
+          path: /var/lib/kubelet/plugins_registry
+          type: ""
+        name: plugins-registry
+      - hostPath:
+          path: /var/lib/kubelet/plugins
+          type: ""
+        name: plugins
+      - hostPath:
+          path: /var/run/cdi
+          type: ""
+        name: cdi
+      - hostPath:
+          path: {{if .Values.drivers.nvidia.containerDriver }}/run/nvidia{{ else }}/{{ end }}
+          type: DirectoryOrCreate
+        name: driver-root-parent
+      - hostPath:
+          path: {{if .Values.drivers.nvidia.containerDriver }}/run/nvidia/driver{{ else }}/{{ end }}
+          type: DirectoryOrCreate
+        name: driver-root
+      - hostPath:
+          path: /dev
+          type: ""
+        name: host-dev
+      - hostPath:
+          path: /usr/local/vgpu
+          type: DirectoryOrCreate
+        name: host-vgpu
+      - hostPath:
+          path: /tmp
+          type: ""
+        name: host-tmp
+{{- end }}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/rbac.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/rbac.yaml
new file mode 100644
index 00000000..435c37cc
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/rbac.yaml
@@ -0,0 +1,110 @@
+{{- if .Values.drivers.nvidia.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: hami-dra-driver-service-account
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: v1
+items:
+- apiVersion: rbac.authorization.k8s.io/v1
+  kind: Role
+  metadata:
+    name: hami-dra-driver-role
+    namespace: {{ .Release.Namespace }}
+  rules:
+  - apiGroups:
+    - apps
+    resources:
+    - daemonsets
+    - deployments
+    verbs:
+    - get
+    - list
+    - watch
+    - create
+    - update
+    - patch
+    - delete
+kind: List
+metadata:
+  resourceVersion: ""
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: hami-dra-driver-role-binding
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: hami-dra-driver-role
+subjects:
+- kind: ServiceAccount
+  name: hami-dra-driver-service-account
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: hami-dra-driver-clusterrole
+rules:
+- apiGroups:
+  - resource.k8s.io
+  resources:
+  - resourceclaims
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - resource.k8s.io
+  resources:
+  - resourceclaimtemplates
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - delete
+- apiGroups:
+  - resource.k8s.io
+  resources:
+  - resourceslices
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - delete
+- apiGroups:
+  - resource.k8s.io
+  resources:
+  - resourceclaims/status
+  verbs:
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: hami-dra-driver-clusterrole-binding-hami-dra-driver
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: hami-dra-driver-clusterrole
+subjects:
+- kind: ServiceAccount
+  name: hami-dra-driver-service-account
+  namespace: {{ .Release.Namespace }}
+{{- end }}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-clusterrole.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-clusterrole.yaml
new file mode 100644
index 00000000..45c24863
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-clusterrole.yaml
@@ -0,0 +1,11 @@
+{{- if .Values.monitor.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "hami.dra.monitor.fullname" . }}
+rules:
+- apiGroups: ["resource.k8s.io"]
+  resources: ["resourceslices", "resourceclaims"]
+  verbs: ["get", "list", "watch"]
+{{- end }}
+
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-clusterrolebinding.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-clusterrolebinding.yaml
new file mode 100644
index 00000000..766d3098
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-clusterrolebinding.yaml
@@ -0,0 +1,15 @@
+{{- if .Values.monitor.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "hami.dra.monitor.fullname" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "hami.dra.monitor.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "hami.dra.monitor.fullname" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}
+
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-deployment.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-deployment.yaml
new file mode 100644
index 00000000..b544b376
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-deployment.yaml
@@ -0,0 +1,62 @@
+{{- if .Values.monitor.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "hami.dra.monitor.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "hami.dra.monitor.fullname" . }}
+    {{- include "hami-dra-monitor.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.monitor.replicas | default 1 }}
+  selector:
+    matchLabels:
+      {{- include "hami-dra-monitor.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "hami-dra-monitor.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- include "hami.dra.monitor.imagePullSecrets" . | nindent 6 }}
+      serviceAccountName: {{ include "hami.dra.monitor.fullname" . }}
+      containers:
+        - name: monitor
+          image: {{ include "hami.dra.monitor.image" . }}
+          imagePullPolicy: {{ .Values.monitor.image.pullPolicy | default "IfNotPresent" }}
+          command:
+            - /bin/monitor
+            - --v={{ .Values.monitor.logLevel | default 2 }}
+            - --metrics-bind-address={{ .Values.monitor.metricsBindAddress | default ":8080" }}
+            - --health-probe-bind-address={{ .Values.monitor.healthProbeBindAddress | default ":8000" }}
+            - --kube-api-qps={{ .Values.monitor.kubeAPIQPS | default 40.0 }}
+            - --kube-api-burst={{ .Values.monitor.kubeAPIBurst | default 60 }}
+            - --collect-interval={{ .Values.monitor.collectInterval | default "30s" }}
+          ports:
+            - containerPort: 8080
+              name: metrics
+              protocol: TCP
+            - containerPort: 8000
+              name: health
+              protocol: TCP
+          {{- if .Values.monitor.resources }}
+          resources:
+            {{- toYaml .Values.monitor.resources | nindent 12 }}
+          {{- end }}
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8000
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8000
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+{{- end }}
+
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-service.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-service.yaml
new file mode 100644
index 00000000..d740cc38
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-service.yaml
@@ -0,0 +1,26 @@
+{{- if .Values.monitor.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "hami.dra.monitor.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "hami-dra-monitor.selectorLabels" . | nindent 4 }}
+spec:
+  type: {{ .Values.monitor.service.type | default "ClusterIP" }}
+  selector:
+    {{- include "hami-dra-monitor.selectorLabels" . | nindent 4 }}
+  ports:
+    - port: 8080
+      targetPort: 8080
+      name: metrics
+      protocol: TCP
+      {{- if and (eq (.Values.monitor.service.type | default "ClusterIP") "NodePort") .Values.monitor.service.nodePort.metrics }}
+      nodePort: {{ .Values.monitor.service.nodePort.metrics }}
+      {{- end }}
+    - port: 8000
+      targetPort: 8000
+      name: health
+      protocol: TCP
+{{- end }}
+
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-serviceaccount.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-serviceaccount.yaml
new file mode 100644
index 00000000..c61ad454
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-serviceaccount.yaml
@@ -0,0 +1,8 @@
+{{- if .Values.monitor.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "hami.dra.monitor.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}
+
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/cert-manager.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/cert-manager.yaml
new file mode 100644
index 00000000..dd31c71d
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/cert-manager.yaml
@@ -0,0 +1,29 @@
+{{- if .Values.certs.certManager.enabled }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ .Release.Name }}-dra-webhook-serving-cert
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "hami-dra-webhook.labels" . | nindent 4 }}
+spec:
+  dnsNames:
+    - {{ .Release.Name }}-dra-webhook.{{ .Release.Namespace }}.svc
+    - {{ .Release.Name }}-dra-webhook.{{ .Release.Namespace }}.svc.cluster.local
+  issuerRef:
+    kind: Issuer
+    name: {{ .Release.Name }}-dra-webhook-selfsigned-issuer
+  secretName: {{ .Release.Name }}-dra-webhook-tls
+  privateKey:
+    rotationPolicy: {{ .Values.certs.certManager.privateKeyRotationPolicy | default "Never" }}
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: {{ .Release.Name }}-dra-webhook-selfsigned-issuer
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/component: hami-dra-webhook
+spec:
+  selfSigned: {}
+{{- end }}
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/cert-secret.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/cert-secret.yaml
new file mode 100644
index 00000000..eadbb517
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/cert-secret.yaml
@@ -0,0 +1,13 @@
+{{- if eq .Values.certs.mode "custom" }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "hami-dra-webhook.tlsSecretName" . }}
+  namespace: {{ .Release.Namespace }}
+type: kubernetes.io/tls
+data:
+  tls.crt: |
+    {{- .Values.certs.custom.crt | b64enc | indent 4 }}
+  tls.key: |
+    {{- .Values.certs.custom.key | b64enc | indent 4 }}
+{{- end }}
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/device-config.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/device-config.yaml
new file mode 100644
index 00000000..97283f3e
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/device-config.yaml
@@ -0,0 +1,394 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "hami.dra.webhook.fullname" . }}-device-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/component: hami-scheduler
+    {{- include "hami-dra-webhook.selectorLabels" . | nindent 4 }}
+data:
+  device-config.yaml: |-
+  {{- if .Files.Glob "files/device-config.yaml" }}
+  {{- .Files.Get "files/device-config.yaml" | nindent 4}}
+  {{- else }}
+    nvidia:
+      resourceCountName: {{ .Values.resourceName }}
+      resourceMemoryName: {{ .Values.resourceMem }}
+      resourceMemoryPercentageName: {{ .Values.resourceMemPercentage }}
+      resourceCoreName: {{ .Values.resourceCores }}
+      resourcePriorityName: {{ .Values.resourcePriority }}
+      overwriteEnv: false
+      defaultMemory: 0
+      defaultCores: 0
+      defaultGPUNum: 1
+      knownMigGeometries:
+      - models: [ "A30" ]
+        allowedGeometries:
+          - 
+            - name: 1g.6gb
+              core: 25
+              memory: 6144
+              count: 4
+          - 
+            - name: 2g.12gb
+              core: 50
+              memory: 12288
+              count: 2
+          - 
+            - name: 4g.24gb
+              core: 100
+              memory: 24576
+              count: 1
+      - models: [ "A100-SXM4-40GB", "A100-40GB-PCIe", "A100-PCIE-40GB"]
+        allowedGeometries:
+          - 
+            - name: 1g.5gb
+              core: 14
+              memory: 5120
+              count: 7
+          - 
+            - name: 1g.5gb
+              core: 14
+              memory: 5120
+              count: 1
+            - name: 2g.10gb
+              core: 28
+              memory: 10240
+              count: 3
+          - 
+            - name: 3g.20gb
+              core: 42
+              memory: 20480
+              count: 2
+          - 
+            - name: 7g.40gb
+              core: 100
+              memory: 40960
+              count: 1
+      - models: [ "A100-SXM4-80GB", "A100-80GB-PCIe", "A100-PCIE-80GB"]
+        allowedGeometries:
+          - 
+            - name: 1g.10gb
+              core: 14
+              memory: 10240
+              count: 7
+          - 
+            - name: 1g.10gb
+              core: 14
+              memory: 10240
+              count: 1
+            - name: 2g.20gb
+              core: 28
+              memory: 20480
+              count: 3
+          - 
+            - name: 3g.40gb
+              core: 42
+              memory: 40960
+              count: 2
+          - 
+            - name: 7g.79gb
+              core: 100
+              memory: 80896
+              count: 1
+      - models: [ "H100-PCIE-80GB", "H100-SXM5-80GB"]
+        allowedGeometries:
+          - 
+            - name: 1g.10gb
+              core: 14
+              memory: 10240
+              count: 7
+          - 
+            - name: 1g.10gb
+              core: 14
+              memory: 10240
+              count: 1
+            - name: 2g.20gb
+              core: 28
+              memory: 20480
+              count: 3
+          - 
+            - name: 3g.40gb
+              core: 42
+              memory: 40960
+              count: 2
+          - 
+            - name: 7g.80gb
+              core: 100
+              memory: 81920
+              count: 1
+      - models: [ "H100-PCIE-94GB", "H100-SXM5-94GB"]
+        allowedGeometries:
+          - 
+            - name: 1g.12gb
+              core: 14
+              memory: 12288
+              count: 7
+          - 
+            - name: 1g.12gb
+              core: 14
+              memory: 12288
+              count: 1
+            - name: 2g.24gb
+              core: 28
+              memory: 24576
+              count: 3
+          - 
+            - name: 3g.47gb
+              core: 42
+              memory: 48128
+              count: 2
+          - 
+            - name: 7g.94gb
+              core: 100
+              memory: 96256
+              count: 1
+      - models: [ "H20", "H100 on GH200"]
+        allowedGeometries:
+          - 
+            - name: 1g.12gb
+              core: 14
+              memory: 12288
+              count: 7
+          - 
+            - name: 1g.12gb
+              core: 14
+              memory: 12288
+              count: 1
+            - name: 2g.24gb
+              core: 28
+              memory: 24576
+              count: 3 
+          - 
+            - name: 3g.48gb
+              core: 42
+              memory: 49152
+              count: 2
+          - 
+            - name: 7g.96gb
+              core: 100
+              memory: 98304
+              count: 1
+      - models: [ "H200 NVL", "H200-SXM5"]
+        allowedGeometries:
+          - 
+            - name: 1g.18gb
+              core: 14
+              memory: 18432
+              count: 7
+          - 
+            - name: 1g.18gb
+              core: 14
+              memory: 18432
+              count: 1
+            - name: 2g.35gb
+              core: 28
+              memory: 35840
+              count: 3
+          - 
+            - name: 3g.71gb
+              core: 42
+              memory: 72704
+              count: 2
+          - 
+            - name: 7g.141gb
+              core: 100
+              memory: 144384
+              count: 1
+      - models: [ "B200" ]
+        allowedGeometries:
+          - 
+            - name: 1g.23gb
+              core: 14
+              memory: 23552
+              count: 7
+          - 
+            - name: 1g.23gb
+              core: 14
+              memory: 23552
+              count: 1
+            - name: 2g.45gb
+              core: 28
+              memory: 46080
+              count: 3
+          - 
+            - name: 3g.90gb
+              core: 42
+              memory: 92160
+              count: 2
+          - 
+            - name: 7g.180gb
+              core: 100
+              memory: 184320
+              count: 1
+    cambricon:
+      resourceCountName: {{ .Values.mluResourceName }}
+      resourceMemoryName: {{ .Values.mluResourceMem }}
+      resourceCoreName: {{ .Values.mluResourceCores }}
+    hygon:
+      resourceCountName: {{ .Values.dcuResourceName }}
+      resourceMemoryName: {{ .Values.dcuResourceMem }}
+      resourceCoreName: {{ .Values.dcuResourceCores }}
+    metax:
+      resourceCountName: "metax-tech.com/gpu"
+      resourceVCountName: {{ .Values.metaxResourceName }}
+      resourceVMemoryName: {{ .Values.metaxResourceMem }}
+      resourceVCoreName: {{ .Values.metaxResourceCore }}
+      sgpuTopologyAware: {{ .Values.metaxsGPUTopologyAware }}
+    enflame:
+      resourceNameGCU: "enflame.com/gcu"
+      resourceNameVGCU: {{ .Values.enflameResourceNameVGCU }}
+      resourceNameVGCUPercentage: {{ .Values.enflameResourceNameVGCUPercentage }}
+    mthreads:
+      resourceCountName: "mthreads.com/vgpu"
+      resourceMemoryName: "mthreads.com/sgpu-memory"
+      resourceCoreName: "mthreads.com/sgpu-core"
+    iluvatars:
+    - chipName: MR-V100
+      commonWord: MR-V100
+      resourceCountName: iluvatar.ai/MR-V100-vgpu
+      resourceMemoryName: iluvatar.ai/MR-V100.vMem
+      resourceCoreName: iluvatar.ai/MR-V100.vCore
+    - chipName: MR-V50
+      commonWord: MR-V50
+      resourceCountName: iluvatar.ai/MR-V50-vgpu
+      resourceMemoryName: iluvatar.ai/MR-V50.vMem
+      resourceCoreName: iluvatar.ai/MR-V50.vCore
+    - chipName: BI-V150
+      commonWord: BI-V150
+      resourceCountName: iluvatar.ai/BI-V150-vgpu
+      resourceMemoryName: iluvatar.ai/BI-V150.vMem
+      resourceCoreName: iluvatar.ai/BI-V150.vCore
+    - chipName: BI-V100
+      commonWord: BI-V100
+      resourceCountName: iluvatar.ai/BI-V100-vgpu
+      resourceMemoryName: iluvatar.ai/BI-V100.vMem
+      resourceCoreName: iluvatar.ai/BI-V100.vCore
+    kunlun:
+      resourceCountName: {{ .Values.kunlunResourceName }}
+      resourceVCountName: {{ .Values.kunlunResourceVCountName }}
+      resourceVMemoryName: {{ .Values.kunlunResourceVMemoryName }}
+    awsneuron:
+      resourceCountName: "aws.amazon.com/neuron"
+      resourceCoreName: "aws.amazon.com/neuroncore"
+    amd:
+      resourceCountName: "amd.com/gpu"
+    vnpus:
+    - chipName: 910A
+      commonWord: Ascend910A
+      resourceName: huawei.com/Ascend910A
+      resourceMemoryName: huawei.com/Ascend910A-memory
+      memoryAllocatable: 32768
+      memoryCapacity: 32768
+      aiCore: 30
+      templates:
+        - name: vir02
+          memory: 2184
+          aiCore: 2
+        - name: vir04
+          memory: 4369
+          aiCore: 4
+        - name: vir08
+          memory: 8738
+          aiCore: 8
+        - name: vir16
+          memory: 17476
+          aiCore: 16
+    - chipName: 910B2
+      commonWord: Ascend910B2
+      resourceName: huawei.com/Ascend910B2
+      resourceMemoryName: huawei.com/Ascend910B2-memory
+      memoryAllocatable: 65536
+      memoryCapacity: 65536
+      aiCore: 24
+      aiCPU: 6
+      templates:
+        - name: vir03_1c_8g
+          memory: 8192
+          aiCore: 3
+          aiCPU: 1
+        - name: vir06_1c_16g
+          memory: 16384
+          aiCore: 6
+          aiCPU: 1
+        - name: vir12_3c_32g
+          memory: 32768
+          aiCore: 12
+          aiCPU: 3
+    - chipName: 910B3
+      commonWord: Ascend910B3
+      resourceName: huawei.com/Ascend910B3
+      resourceMemoryName: huawei.com/Ascend910B3-memory
+      memoryAllocatable: 65536
+      memoryCapacity: 65536
+      aiCore: 20
+      aiCPU: 7
+      templates:
+        - name: vir05_1c_16g
+          memory: 16384
+          aiCore: 5
+          aiCPU: 1
+        - name: vir10_3c_32g
+          memory: 32768
+          aiCore: 10
+          aiCPU: 3
+    - chipName: 910B4-1
+      commonWord: Ascend910B4-1
+      resourceName: huawei.com/Ascend910B4-1
+      resourceMemoryName: huawei.com/Ascend910B4-1-memory
+      memoryAllocatable: 65536
+      memoryCapacity: 65536
+      aiCore: 20
+      aiCPU: 7
+      templates:
+        # NOTE: Names of vnpu template for 910B4-1 are fixed by Ascend runtime and must not be changed.
+        # The memory is used for scheduling so the correct values must be set.
+        # Template vir05_1c_8g actually provides 16GB memory,
+        - name: vir05_1c_8g
+          memory: 16384
+          aiCore: 5
+          aiCPU: 1
+        # Template vir10_3c_16g actually provides 32GB memory
+        - name: vir10_3c_16g
+          memory: 32768
+          aiCore: 10
+          aiCPU: 3
+    - chipName: 910B4
+      commonWord: Ascend910B4
+      resourceName: huawei.com/Ascend910B4
+      resourceMemoryName: huawei.com/Ascend910B4-memory
+      memoryAllocatable: 32768
+      memoryCapacity: 32768
+      aiCore: 20
+      aiCPU: 7
+      templates:
+        - name: vir05_1c_8g
+          memory: 8192
+          aiCore: 5
+          aiCPU: 1
+        - name: vir10_3c_16g
+          memory: 16384
+          aiCore: 10
+          aiCPU: 3
+    - chipName: 310P3
+      commonWord: Ascend310P
+      resourceName: huawei.com/Ascend310P
+      resourceMemoryName: huawei.com/Ascend310P-memory
+      memoryAllocatable: 21527
+      memoryCapacity: 24576
+      aiCore: 8
+      aiCPU: 7
+      templates:
+        - name: vir01
+          memory: 3072
+          aiCore: 1
+          aiCPU: 1
+        - name: vir02
+          memory: 6144
+          aiCore: 2
+          aiCPU: 2
+        - name: vir04
+          memory: 12288
+          aiCore: 4
+          aiCPU: 4
+  {{ end }}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/mutatingwebhookconfiguration.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/mutatingwebhookconfiguration.yaml
new file mode 100644
index 00000000..c763b6aa
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/mutatingwebhookconfiguration.yaml
@@ -0,0 +1,28 @@
+{{- if .Values.webhook.config.mutating.enabled }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: {{ .Release.Name }}-mutatingwebhookconfiguration
+  annotations:
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ .Release.Name }}-dra-webhook-serving-cert
+webhooks:
+  - name: mutate.hami.io
+    admissionReviewVersions: ["v1"]
+    clientConfig:
+      service:
+        name: {{ .Release.Name }}-dra-webhook
+        namespace: {{ .Release.Namespace }}
+        path: /mutate
+    rules:
+      - apiGroups:
+          - ""
+        apiVersions:
+          - v1
+        operations:
+          - CREATE
+        resources:
+          - pods
+        scope: '*'
+    sideEffects: None
+    timeoutSeconds: 10
+{{- end }}
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/validatingwebhookconfiguration.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/validatingwebhookconfiguration.yaml
new file mode 100644
index 00000000..acdcbb96
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/validatingwebhookconfiguration.yaml
@@ -0,0 +1,29 @@
+{{- if .Values.webhook.config.validating.enabled }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: {{ .Release.Name }}-validatingwebhookconfiguration
+  annotations:
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ .Release.Name }}-dra-webhook-serving-cert
+webhooks:
+  - name: validate.hami.io
+    admissionReviewVersions: ["v1"]
+    clientConfig:
+      service:
+        name: {{ .Release.Name }}-dra-webhook
+        namespace: {{ .Release.Namespace }}
+        path: /validate
+    rules:
+      - apiGroups:
+          - ""
+        apiVersions:
+          - v1
+        operations:
+          - DELETE
+        resources:
+          - pods
+        scope: '*'
+    sideEffects: None
+    timeoutSeconds: 10
+    failurePolicy: Ignore
+{{- end }}
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-clusterrole.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-clusterrole.yaml
new file mode 100644
index 00000000..28916a36
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-clusterrole.yaml
@@ -0,0 +1,14 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "hami.dra.webhook.fullname" . }}
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["admissionregistration.k8s.io"]
+  resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["resource.k8s.io"]
+  resources: ["resourceclaims"]
+  verbs: ["*"]
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-clusterrolebinding.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-clusterrolebinding.yaml
new file mode 100644
index 00000000..daad52f2
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-clusterrolebinding.yaml
@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "hami.dra.webhook.fullname" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "hami.dra.webhook.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "hami.dra.webhook.fullname" . }}
+    namespace: {{ .Release.Namespace }}
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-deployment.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-deployment.yaml
new file mode 100644
index 00000000..8e3cf90c
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-deployment.yaml
@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "hami.dra.webhook.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "hami.dra.webhook.fullname" . }}
+    {{- include "hami-dra-webhook.labels" . | nindent 4 }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "hami-dra-webhook.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "hami-dra-webhook.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- include "hami.dra.webhook.imagePullSecrets" . | nindent 6 }}
+      serviceAccountName: {{ include "hami.dra.webhook.fullname" . }}
+      containers:
+        - name: webhook
+          image: {{ include "hami.dra.webhook.image" . }}
+          imagePullPolicy: {{ .Values.webhook.image.pullPolicy | default "IfNotPresent" }}
+          command:
+            - /bin/webhook
+            - --v=5
+            - --bind-address=0.0.0.0
+            - --secure-port=8443
+            - --cert-dir=/tls
+            - --tls-cert-file-name=tls.crt
+            - --tls-private-key-file-name=tls.key
+            - --metrics-bind-address=:8080
+            - --health-probe-bind-address=:8000
+            - --device-config-file=/device-config.yaml
+          ports:
+            - containerPort: 8443
+              name: webhook
+              protocol: TCP
+            - containerPort: 8080
+              name: metrics
+              protocol: TCP
+            - containerPort: 8000
+              name: health
+              protocol: TCP
+          volumeMounts:
+            - name: device-config
+              mountPath: /device-config.yaml
+              subPath: device-config.yaml
+            - name: tls-config
+              mountPath: /tls
+              readOnly: true
+      volumes:
+        - name: device-config
+          configMap:
+            name: {{ include "hami.dra.webhook.fullname" . }}-device-config
+        - name: tls-config
+          secret:
+            secretName: {{ if .Values.certs.certManager.enabled }}{{ .Release.Name }}-dra-webhook-tls{{ else }}{{ .Release.Name }}-tls{{ end }}
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-service.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-service.yaml
new file mode 100644
index 00000000..290174ec
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-service.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-dra-webhook
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "hami-dra-webhook.selectorLabels" . | nindent 4 }}
+spec:
+  type: "ClusterIP"
+  selector:
+    {{- include "hami-dra-webhook.selectorLabels" . | nindent 4 }}
+  ports:
+    - port: 443
+      targetPort: 8443
+      name: webhook
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-serviceaccount.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-serviceaccount.yaml
new file mode 100644
index 00000000..b0dc2fb2
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-serviceaccount.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "hami.dra.webhook.fullname" . }}
+  namespace: {{ .Release.Namespace }}
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/values.yaml b/packages/system/hami/charts/hami/charts/hami-dra/values.yaml
new file mode 100644
index 00000000..ebbbfed7
--- /dev/null
+++ b/packages/system/hami/charts/hami/charts/hami-dra/values.yaml
@@ -0,0 +1,166 @@
+## @section Global configuration
+## @param global.imageRegistry Global Docker image registry
+## @param global.imagePullSecrets Global Docker image pull secrets
+global:
+  ## @param global.imageRegistry Global Docker image registry
+  imageRegistry: ""
+  ## E.g.
+  ## imagePullSecrets:
+  ##   - myRegistryKeySecretName
+  ## @param global.imagePullSecrets Global Docker image pull secrets
+  imagePullSecrets: []
+
+#Nvidia GPU Parameters
+resourceName: "nvidia.com/gpu"
+resourceMem: "nvidia.com/gpumem"
+resourceMemPercentage: "nvidia.com/gpumem-percentage"
+resourceCores: "nvidia.com/gpucores"
+resourcePriority: "nvidia.com/priority"
+
+#MLU Parameters
+mluResourceName: "cambricon.com/vmlu"
+mluResourceMem: "cambricon.com/mlu.smlu.vmemory"
+mluResourceCores: "cambricon.com/mlu.smlu.vcore"
+
+#Hygon DCU Parameters
+dcuResourceName: "hygon.com/dcunum"
+dcuResourceMem: "hygon.com/dcumem"
+dcuResourceCores: "hygon.com/dcucores"
+
+#Metax sGPU Parameters
+metaxResourceName: "metax-tech.com/sgpu"
+metaxResourceCore: "metax-tech.com/vcore"
+metaxResourceMem: "metax-tech.com/vmemory"
+metaxsGPUTopologyAware: "false"
+
+#Enflame VGCU Parameters
+enflameResourceNameVGCU: "enflame.com/vgcu"
+enflameResourceNameVGCUPercentage: "enflame.com/vgcu-percentage"
+
+#Kunlun XPU Parameters
+kunlunResourceName: "kunlunxin.com/xpu"
+kunlunResourceVCountName: "kunlunxin.com/vxpu"
+kunlunResourceVMemoryName: "kunlunxin.com/vxpu-memory"
+
+# Webhook deployment configuration
+webhook:
+  image:
+    registry: ghcr.io
+    repository: project-hami/hami-dra-webhook
+    tag: "v0.1.0"
+    ## Specify a imagePullPolicy
+    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+    ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+    ##
+    pullPolicy: Always
+    ## Optionally specify an array of imagePullSecrets.
+    ## Secrets must be manually created in the namespace.
+    ## Example:
+    ## pullSecrets:
+    ##   - myRegistryKeySecretName
+    ##
+    pullSecrets: []
+  ## @param resources controllerManager resource requests and limits
+  resources:
+  # If you do want to specify resources, uncomment the following
+  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    limits:
+      cpu: 500m
+      memory: 512Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+  ## @param nodeSelector controllerManager node labels for pod assignment
+  args:
+    webhookName: ""  # Default: {{ .Release.Name }}-hami-dra-webhook
+    secretName: ""  # Default: {{ .Release.Name }}-hami-dra-webhook-tls
+  # Webhook configuration
+  config:
+    mutating:
+      enabled: true
+    validating:
+      enabled: true
+
+# Monitor deployment configuration
+monitor:
+  enabled: true
+  replicas: 1
+  image:
+    registry: ghcr.io
+    repository: project-hami/hami-dra-monitor
+    tag: "v0.1.0"
+    ## Specify a imagePullPolicy
+    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+    ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+    ##
+    pullPolicy: Always
+    ## Optionally specify an array of imagePullSecrets.
+    ## Secrets must be manually created in the namespace.
+    ## Example:
+    ## pullSecrets:
+    ##   - myRegistryKeySecretName
+    ##
+    pullSecrets: []
+  ## @param resources monitor resource requests and limits
+  resources:
+    limits:
+      cpu: 500m
+      memory: 512Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+  ## Monitor configuration
+  logLevel: 2
+  metricsBindAddress: ":8080"
+  healthProbeBindAddress: ":8000"
+  kubeAPIQPS: 40.0
+  kubeAPIBurst: 60
+  collectInterval: "30s"
+  ## Monitor service configuration
+  service:
+    ## Service type: ClusterIP, NodePort, or LoadBalancer
+    ## Defaults to ClusterIP
+    type: ClusterIP
+    ## NodePort configuration (only used when type is NodePort)
+    nodePort:
+      ## Metrics port (NodePort). If not specified, Kubernetes will assign a random port
+      metrics: ""
+
+# Certificate configuration
+certs:
+  # Custom certificate (used when mode is "custom")
+  custom:
+    crt: ""
+    key: ""
+  # Cert-manager configuration (used when mode is "cert-manager")
+  certManager:
+    enabled: true
+    # Private key rotation policy: "Never" or "Always"
+    # In cert-manager >= v1.18.0, the default changed from "Never" to "Always"
+    # Setting to "Never" avoids frequent certificate rotation for webhooks
+    privateKeyRotationPolicy: "Never"
+    issuer:
+      clusterIssuerName: ""  # Required when type is "clusterIssuer"
+
+# DRA Drivers configuration
+drivers:
+  nvidia:
+    enabled: true
+    # If you are using gpu driver on host, you need to set this to false
+    containerDriver: true
+    image:
+      registry: ghcr.io
+      repository: projecthami/k8s-dra-driver
+      tag: "v0.0.1-dev"
+      ## Specify a imagePullPolicy
+      ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+      ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+      ##
+      pullPolicy: IfNotPresent
+      ## Optionally specify an array of imagePullSecrets.
+      ## Secrets must be manually created in the namespace.
+      ## Example:
+      ## pullSecrets:
+      ##   - myRegistryKeySecretName
+      ##
+      pullSecrets: []
diff --git a/packages/system/hami/charts/hami/templates/NOTES.txt b/packages/system/hami/charts/hami/templates/NOTES.txt
new file mode 100644
index 00000000..15bb1218
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/NOTES.txt
@@ -0,0 +1,3 @@
+** Please be patient while the chart is being deployed **
+Resource name: {{ .Values.resourceName }}
+
diff --git a/packages/system/hami/charts/hami/templates/_commons.tpl b/packages/system/hami/charts/hami/templates/_commons.tpl
new file mode 100644
index 00000000..78a262c9
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/_commons.tpl
@@ -0,0 +1,49 @@
+{{/*
+Return the proper image name
+{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" $) }}
+*/}}
+{{- define "common.images.image" -}}
+{{- $registryName := .imageRoot.registry -}}
+{{- $repositoryName := .imageRoot.repository -}}
+{{- $tag := .imageRoot.tag | toString -}}
+{{- if .global }}
+    {{- if .global.imageRegistry }}
+     {{- $registryName = .global.imageRegistry -}}
+    {{- end -}}
+{{- end -}}
+{{- if .tag }}
+     {{- $tag = .tag | toString -}}
+{{- end -}}
+{{- if $registryName }}
+{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
+{{- else -}}
+{{- printf "%s:%s" $repositoryName $tag -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead)
+{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }}
+*/}}
+{{- define "common.images.pullSecrets" -}}
+  {{- $pullSecrets := list }}
+
+  {{- if .global }}
+    {{- range .global.imagePullSecrets -}}
+      {{- $pullSecrets = append $pullSecrets . -}}
+    {{- end -}}
+  {{- end -}}
+
+  {{- range .images -}}
+    {{- range .pullSecrets -}}
+      {{- $pullSecrets = append $pullSecrets . -}}
+    {{- end -}}
+  {{- end -}}
+
+  {{- if (not (empty $pullSecrets)) }}
+imagePullSecrets:
+    {{- range $pullSecrets }}
+  - name: {{ . }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/templates/_helpers.tpl b/packages/system/hami/charts/hami/templates/_helpers.tpl
new file mode 100644
index 00000000..ffcc61da
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/_helpers.tpl
@@ -0,0 +1,163 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "hami-vgpu.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "hami-vgpu.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Allow the release namespace to be overridden for multi-namespace deployments in combined charts
+*/}}
+{{- define "hami-vgpu.namespace" -}}
+  {{- if .Values.namespaceOverride -}}
+    {{- .Values.namespaceOverride -}}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+The app name for Scheduler
+*/}}
+{{- define "hami-vgpu.scheduler" -}}
+{{- printf "%s-scheduler" ( include "hami-vgpu.fullname" . ) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+The app name for DevicePlugin
+*/}}
+{{- define "hami-vgpu.device-plugin" -}}
+{{- printf "%s-device-plugin" ( include "hami-vgpu.fullname" . ) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+  The app name for MockDevicePlugin
+  */}}
+{{- define "hami-vgpu.mock-device-plugin" -}}
+{{- printf "%s-mock-device-plugin" ( include "hami-vgpu.fullname" . ) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+The tls secret name for Scheduler
+*/}}
+{{- define "hami-vgpu.scheduler.tls" -}}
+{{- printf "%s-scheduler-tls" ( include "hami-vgpu.fullname" . ) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+The webhook name
+*/}}
+{{- define "hami-vgpu.scheduler.webhook" -}}
+{{- printf "%s-webhook" ( include "hami-vgpu.fullname" . ) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "hami-vgpu.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "hami-vgpu.labels" -}}
+helm.sh/chart: {{ include "hami-vgpu.chart" . }}
+{{ include "hami-vgpu.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "hami-vgpu.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "hami-vgpu.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+
+{{/*
+    Resolve the tag for kubeScheduler.
+*/}}
+{{- define "resolvedKubeSchedulerTag" -}}
+{{- if .Values.scheduler.kubeScheduler.image.tag }}
+{{- .Values.scheduler.kubeScheduler.image.tag | trim -}}
+{{- else }}
+{{- include "strippedKubeVersion" . | trim -}}
+{{- end }}
+{{- end }}
+
+{{/*
+    Return the stripped Kubernetes version string by removing extra parts after semantic version number.
+    v1.31.1+k3s1 -> v1.31.1
+    v1.30.8-eks-2d5f260 -> v1.30.8
+    v1.31.1 -> v1.31.1
+*/}}
+{{- define "strippedKubeVersion" -}}
+{{ regexReplaceAll "^(v[0-9]+\\.[0-9]+\\.[0-9]+)(.*)$" .Capabilities.KubeVersion.Version "$1" }}
+{{- end -}}
+
+{{- define "hami.scheduler.kubeScheduler.image" -}}
+{{ include "common.images.image" (dict "imageRoot" .Values.scheduler.kubeScheduler.image "global" .Values.global "tag" (include "resolvedKubeSchedulerTag" .)) }}
+{{- end -}}
+
+{{- define "hami.scheduler.extender.image" -}}
+{{ include "common.images.image" (dict "imageRoot" .Values.scheduler.extender.image "global" .Values.global "tag" .Values.global.imageTag) }}
+{{- end -}}
+
+{{- define "hami.devicePlugin.image" -}}
+{{ include "common.images.image" (dict "imageRoot" .Values.devicePlugin.image "global" .Values.global "tag" .Values.global.imageTag) }}
+{{- end -}}
+
+{{- define "hami.mockDevicePlugin.image" -}}
+{{ include "common.images.image" (dict "imageRoot" .Values.mockDevicePlugin.image "global" .Values.global "tag" .Values.mockDevicePlugin.tag) }}
+{{- end -}}
+
+{{- define "hami.devicePlugin.monitor.image" -}}
+{{ include "common.images.image" (dict "imageRoot" .Values.devicePlugin.monitor.image "global" .Values.global "tag" .Values.global.imageTag) }}
+{{- end -}}
+
+{{- define "hami.scheduler.patch.image" -}}
+{{ include "common.images.image" (dict "imageRoot" .Values.scheduler.patch.image "global" .Values.global) }}
+{{- end -}}
+
+{{- define "hami.scheduler.patch.new.image" -}}
+{{ include "common.images.image" (dict "imageRoot" .Values.scheduler.patch.imageNew "global" .Values.global) }}
+{{- end -}}
+
+{{- define "hami.scheduler.extender.imagePullSecrets" -}}
+{{ include "common.images.pullSecrets" (dict "images" (list .Values.scheduler.extender.image) "global" .Values.global) }}
+{{- end -}}
+
+{{- define "hami.devicePlugin.imagePullSecrets" -}}
+{{ include "common.images.pullSecrets" (dict "images" (list .Values.devicePlugin.image) "global" .Values.global) }}
+{{- end -}}
+
+{{- define "hami.scheduler.patch.imagePullSecrets" -}}
+{{ include "common.images.pullSecrets" (dict "images" (list .Values.scheduler.patch.image) "global" .Values.global) }}
+{{- end -}}
+
+{{- define "hami.scheduler.patch.new.imagePullSecrets" -}}
+{{ include "common.images.pullSecrets" (dict "images" (list .Values.scheduler.patch.imageNew) "global" .Values.global) }}
+{{- end -}}
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/configmap.yaml b/packages/system/hami/charts/hami/templates/device-plugin/configmap.yaml
new file mode 100644
index 00000000..b36347f2
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/device-plugin/configmap.yaml
@@ -0,0 +1,13 @@
+{{- if and .Values.devicePlugin.enabled (not .Values.devicePlugin.nodeConfiguration.externalConfigName) (not .Values.dra.enabled) -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "hami-vgpu.device-plugin" . }}
+  namespace: {{ include "hami-vgpu.namespace" . }}
+  labels:
+    app.kubernetes.io/component: hami-device-plugin
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+data:
+  config.json: |
+{{- .Values.devicePlugin.nodeConfiguration.config | nindent 4 }}
+{{- end }}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/daemonsetmock.yaml b/packages/system/hami/charts/hami/templates/device-plugin/daemonsetmock.yaml
new file mode 100644
index 00000000..a0dc4ff3
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/device-plugin/daemonsetmock.yaml
@@ -0,0 +1,55 @@
+{{- if .Values.mockDevicePlugin.enabled }}
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ include "hami-vgpu.mock-device-plugin" . }}
+  namespace: {{ include "hami-vgpu.namespace" . }}
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: hami-mock-device-plugin
+      {{- include "hami-vgpu.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+        scheduler.alpha.kubernetes.io/critical-pod: ""
+      labels:
+        app.kubernetes.io/component: hami-mock-device-plugin
+        {{- include "hami-vgpu.selectorLabels" . | nindent 8 }}
+    spec:
+      serviceAccountName: {{ include "hami-vgpu.mock-device-plugin" . }}
+      tolerations:
+      - key: CriticalAddonsOnly
+        operator: Exists
+      containers:
+      - image: {{ include "hami.mockDevicePlugin.image" . }}
+        imagePullPolicy: {{ .Values.mockDevicePlugin.image.pullPolicy }}
+        name: hami-mock-dp-cntr
+        env:
+          - name: NODE_NAME
+            valueFrom:
+              fieldRef:
+                fieldPath: spec.nodeName
+        command:
+          - ./k8s-device-plugin
+          - -v=5
+          - --device-config-file=/device-config.yaml
+        volumeMounts:
+          - name: dp
+            mountPath: /var/lib/kubelet/device-plugins
+          - name: sys
+            mountPath: /sys
+          - name: device-config
+            mountPath: /device-config.yaml
+            subPath: device-config.yaml
+      volumes:
+        - name: dp
+          hostPath:
+            path: /var/lib/kubelet/device-plugins
+        - name: sys
+          hostPath:
+            path: /sys
+        - name: device-config
+          configMap:
+            name: {{ include "hami-vgpu.scheduler" . }}-device
+{{- end -}}
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/daemonsetnvidia.yaml b/packages/system/hami/charts/hami/templates/device-plugin/daemonsetnvidia.yaml
new file mode 100644
index 00000000..577dc0f9
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/device-plugin/daemonsetnvidia.yaml
@@ -0,0 +1,262 @@
+{{- if and .Values.devicePlugin.enabled (not .Values.dra.enabled) }}
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ include "hami-vgpu.device-plugin" . }}
+  namespace: {{ include "hami-vgpu.namespace" . }}
+  labels:
+    app.kubernetes.io/component: hami-device-plugin
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+    {{- with .Values.global.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- if .Values.global.annotations }}
+  annotations: {{ toYaml .Values.global.annotations | nindent 4}}
+  {{- end }}
+spec:
+  updateStrategy:
+    {{- with .Values.devicePlugin.updateStrategy }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: hami-device-plugin
+      {{- include "hami-vgpu.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: hami-device-plugin
+        hami.io/webhook: ignore
+        {{- include "hami-vgpu.selectorLabels" . | nindent 8 }}
+      annotations:
+        {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }}
+        checksum/hami-scheduler-newversion-config: {{ include (print $.Template.BasePath "/scheduler/configmapnew.yaml") . | sha256sum }}
+        {{- else }}
+        checksum/hami-scheduler-config: {{ include (print $.Template.BasePath "/scheduler/configmap.yaml") . | sha256sum }}
+        {{- end }}
+        checksum/hami-scheduler-device-config: {{ include (print $.Template.BasePath "/scheduler/device-configmap.yaml") . | sha256sum }}
+      {{- if .Values.devicePlugin.podAnnotations }}
+        {{- toYaml .Values.devicePlugin.podAnnotations | nindent 8 }}
+      {{- end }}
+    spec:
+      {{- if .Values.devicePlugin.runtimeClassName }}
+      runtimeClassName: {{ .Values.devicePlugin.runtimeClassName }}
+      {{- end }}
+      serviceAccountName: {{ include "hami-vgpu.device-plugin" . }}
+      priorityClassName: system-node-critical
+      hostPID: true
+      hostNetwork: true
+      {{- include "hami.devicePlugin.imagePullSecrets" . | nindent 6 }}
+      {{- if .Values.devicePlugin.gpuOperatorToolkitReady.enabled }}
+      initContainers:
+        - name: toolkit-validation
+          image: {{ include "hami.devicePlugin.image" . }}
+          imagePullPolicy: {{ .Values.devicePlugin.image.pullPolicy }}
+          securityContext:
+            privileged: true
+            runAsUser: 0
+          command: ["sh", "-c"]
+          args:
+            - |
+              echo "Waiting for NVIDIA Toolkit to be ready..."
+              until [ -f {{ .Values.devicePlugin.gpuOperatorToolkitReady.hostPath }}/toolkit-ready ]; do 
+                echo "Waiting for {{ .Values.devicePlugin.gpuOperatorToolkitReady.hostPath }}/toolkit-ready..."
+                sleep 5
+              done
+              echo "NVIDIA Toolkit is ready!"
+          volumeMounts:
+            - name: nvidia-validations
+              mountPath: {{ .Values.devicePlugin.gpuOperatorToolkitReady.hostPath | quote }}
+              mountPropagation: HostToContainer
+              readOnly: true
+      {{- end }}
+      containers:
+        - name: device-plugin
+          image: {{ include "hami.devicePlugin.image" . }}
+          imagePullPolicy: {{ .Values.devicePlugin.image.pullPolicy }}
+          lifecycle:
+            postStart:
+              exec:
+                command: ["/bin/sh","-c", {{ printf "/k8s-vgpu/bin/vgpu-init.sh %s/vgpu/" .Values.global.gpuHookPath | quote }}]
+          command:
+            - nvidia-device-plugin
+            - --config-file=/device-config.yaml
+            - --mig-strategy={{ .Values.devicePlugin.migStrategy }}
+            - --disable-core-limit={{ .Values.devicePlugin.disablecorelimit }}
+            {{- range .Values.devicePlugin.extraArgs }}
+            - {{ . }}
+            {{- end }}
+          env:
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: NVIDIA_MIG_MONITOR_DEVICES
+              value: all
+            - name: DEVICE_LIST_STRATEGY
+              value: {{ .Values.devicePlugin.deviceListStrategy }}
+            - name: HOOK_PATH
+              value: {{ .Values.global.gpuHookPath }}
+            {{- if typeIs "bool" .Values.devicePlugin.passDeviceSpecsEnabled }}
+            - name: PASS_DEVICE_SPECS
+              value: {{ .Values.devicePlugin.passDeviceSpecsEnabled | quote }}
+            {{- end }}
+            {{- if typeIs "string" .Values.devicePlugin.nvidiaDriverRoot }}
+            - name: NVIDIA_DRIVER_ROOT
+              value: {{ .Values.devicePlugin.nvidiaDriverRoot }}
+            {{- end }}
+            {{- if typeIs "string" .Values.devicePlugin.nvidiaHookPath }}
+            - name: NVIDIA_CDI_HOOK_PATH
+              value: {{ .Values.devicePlugin.nvidiaHookPath }}
+            {{- end }}
+            {{- if typeIs "bool" .Values.devicePlugin.gdrcopyEnabled }}
+            - name: GDRCOPY_ENABLED
+              value: {{ .Values.devicePlugin.gdrcopyEnabled | quote }}
+            {{- end }}
+            {{- if typeIs "bool" .Values.devicePlugin.gdsEnabled }}
+            - name: GDS_ENABLED
+              value: {{ .Values.devicePlugin.gdsEnabled | quote }}
+            {{- end }}
+            {{- if typeIs "bool" .Values.devicePlugin.mofedEnabled }}
+            - name: MOFED_ENABLED
+              value: {{ .Values.devicePlugin.mofedEnabled | quote }}
+            {{- end }}
+            {{- if eq (.Values.scheduler.defaultSchedulerPolicy.gpuSchedulerPolicy | default "spread")  "topology-aware" }}
+            - name: ENABLE_TOPOLOGY_SCORE
+              value: "true"
+            {{- end }}
+            {{- with .Values.devicePlugin.extraEnvs }}
+            {{- . | toYaml | nindent 12 }}
+            {{- end }}
+          securityContext:
+            privileged: true
+            allowPrivilegeEscalation: true
+            capabilities:
+              drop: ["ALL"]
+              add: ["SYS_ADMIN"]
+          resources:
+          {{- toYaml .Values.devicePlugin.resources | nindent 12 }}
+          volumeMounts:
+            - name: device-plugin
+              mountPath: /var/lib/kubelet/device-plugins
+            - name: lib
+              mountPath: {{ printf "%s%s" .Values.global.gpuHookPath "/vgpu" }}
+            - name: usrbin
+              mountPath: /usrbin
+            - name: deviceconfig
+              mountPath: /config
+            - name: hosttmp
+              mountPath: /tmp
+            - name: device-config
+              mountPath: /device-config.yaml
+              subPath: device-config.yaml
+            - name: cdi-root
+              mountPath: /var/run/cdi
+            {{- if typeIs "string" .Values.devicePlugin.nvidiaDriverRoot }}
+            # We always mount the driver root at /driver-root in the container.
+            # This is required for CDI detection to work correctly.
+            - name: driver-root
+              mountPath: /driver-root
+              readOnly: true
+            {{- end }}
+        - name: vgpu-monitor
+          image: {{ include "hami.devicePlugin.monitor.image" . }}
+          imagePullPolicy: {{ .Values.devicePlugin.monitor.image.pullPolicy }}
+          command:
+            - "vGPUmonitor"
+            {{- range .Values.devicePlugin.monitor.extraArgs }}
+            - {{ . }}
+            {{- end }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+              add: ["SYS_ADMIN"]
+          env:
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: NVIDIA_VISIBLE_DEVICES
+              value: "all"
+            - name: NVIDIA_MIG_MONITOR_DEVICES
+              value: "all"
+            - name: HOOK_PATH
+              value: "{{ .Values.global.gpuHookPath }}/vgpu"
+            - name: HAMI_RESYNC_INTERVAL
+              value: {{ .Values.devicePlugin.monitor.resyncInterval | default "5m" | quote }}
+            {{- with .Values.devicePlugin.monitor.extraEnvs }}
+            {{- . | toYaml | nindent 12 }}
+            {{- end }}
+          resources:
+          {{- toYaml .Values.devicePlugin.monitor.resources | nindent 12 }}
+          volumeMounts:
+            - name: ctrs
+              mountPath: {{ .Values.devicePlugin.monitor.ctrPath }}
+            - name: dockers
+              mountPath: /run/docker
+            - name: containerds
+              mountPath: /run/containerd
+            - name: sysinfo
+              mountPath: /sysinfo
+            - name: hostvar
+              mountPath: /hostvar
+            - name: hosttmp
+              mountPath: /tmp
+      volumes:
+        - name: ctrs
+          hostPath:
+            path: {{ .Values.devicePlugin.monitor.ctrPath }}
+        - name: hosttmp
+          hostPath:
+            path: /tmp
+        - name: dockers
+          hostPath:
+            path: /run/docker
+        - name: containerds
+          hostPath:
+            path: /run/containerd
+        - name: device-plugin
+          hostPath:
+            path: {{ .Values.devicePlugin.pluginPath }}
+        - name: lib
+          hostPath:
+            path: {{ .Values.devicePlugin.libPath }}
+        {{- if .Values.devicePlugin.gpuOperatorToolkitReady.enabled }}
+        - name: nvidia-validations
+          hostPath:
+            path: {{ .Values.devicePlugin.gpuOperatorToolkitReady.hostPath }}
+            type: DirectoryOrCreate
+        {{- end }}
+        {{- if typeIs "string" .Values.devicePlugin.nvidiaDriverRoot }}
+        - name: driver-root
+          hostPath:
+            path: {{ .Values.devicePlugin.nvidiaDriverRoot }}
+            type: Directory
+        {{- end }}
+        - name: cdi-root
+          hostPath:
+            path: /var/run/cdi
+            type: DirectoryOrCreate
+        - name: usrbin
+          hostPath:
+            path: /usr/bin
+        - name: sysinfo
+          hostPath:
+            path: /sys
+        - name: hostvar
+          hostPath:
+            path: /var
+        - name: deviceconfig
+          configMap:
+            name: {{ .Values.devicePlugin.nodeConfiguration.externalConfigName | default (include "hami-vgpu.device-plugin" .) }}
+        - name: device-config
+          configMap:
+            name: {{ include "hami-vgpu.scheduler" . }}-device
+      {{- if .Values.devicePlugin.nvidiaNodeSelector }}
+      nodeSelector: {{ toYaml .Values.devicePlugin.nvidiaNodeSelector | nindent 8 }}
+      {{- end }}
+      {{- if .Values.devicePlugin.tolerations }}
+      tolerations: {{ toYaml .Values.devicePlugin.tolerations | nindent 8 }}
+      {{- end }}
+{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/monitorrole.yaml b/packages/system/hami/charts/hami/templates/device-plugin/monitorrole.yaml
new file mode 100644
index 00000000..c51ff6c6
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/device-plugin/monitorrole.yaml
@@ -0,0 +1,29 @@
+{{- if and .Values.devicePlugin.enabled (not .Values.dra.enabled) -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name:  {{ include "hami-vgpu.device-plugin" . }}-monitor
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+      - create
+      - watch
+      - list
+      - update
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+    verbs:
+      - get
+      - update
+      - list
+      - patch
+{{- end -}}
+    
+    
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/monitorrolebinding.yaml b/packages/system/hami/charts/hami/templates/device-plugin/monitorrolebinding.yaml
new file mode 100644
index 00000000..93a118dd
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/device-plugin/monitorrolebinding.yaml
@@ -0,0 +1,17 @@
+{{- if and .Values.devicePlugin.enabled (not .Values.dra.enabled) -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "hami-vgpu.device-plugin" . }}
+  labels:
+    app.kubernetes.io/component: "hami-device-plugin"
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "hami-vgpu.device-plugin" . }}-monitor
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "hami-vgpu.device-plugin" . }}
+    namespace: {{ include "hami-vgpu.namespace" . }}
+{{- end -}}
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml b/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml
new file mode 100644
index 00000000..24daca9b
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml
@@ -0,0 +1,29 @@
+{{- if and .Values.devicePlugin.enabled (not .Values.dra.enabled) -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "hami-vgpu.device-plugin" . }}-monitor
+  namespace: {{ include "hami-vgpu.namespace" . }}
+  labels:
+    app.kubernetes.io/component: hami-device-plugin
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+    {{- if .Values.devicePlugin.service.labels }}  # Use devicePlugin instead of scheduler
+    {{ toYaml .Values.devicePlugin.service.labels | indent 4 }}
+    {{- end }}
+  {{- if .Values.devicePlugin.service.annotations }}  # Use devicePlugin instead of scheduler
+  annotations: {{ toYaml .Values.devicePlugin.service.annotations | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.devicePlugin.service.type | default "NodePort" }}  # Default type is NodePort
+  ports:
+    - name: monitorport
+      port: {{ .Values.devicePlugin.service.httpPort | default 31992 }}  # Default HTTP port is 31992
+      targetPort: 9394
+      {{- if eq (.Values.devicePlugin.service.type | default "NodePort") "NodePort" }}  # If type is NodePort, set nodePort
+      nodePort: {{ .Values.devicePlugin.service.httpPort | default 31992 }}
+      {{- end }}
+      protocol: TCP
+  selector:
+    app.kubernetes.io/component: hami-device-plugin
+    {{- include "hami-vgpu.selectorLabels" . | nindent 4 }}
+{{- end -}}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/monitorserviceaccount.yaml b/packages/system/hami/charts/hami/templates/device-plugin/monitorserviceaccount.yaml
new file mode 100644
index 00000000..b10d2cb9
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/device-plugin/monitorserviceaccount.yaml
@@ -0,0 +1,10 @@
+{{- if and .Values.devicePlugin.enabled (not .Values.dra.enabled) -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "hami-vgpu.device-plugin" . }}
+  namespace: {{ include "hami-vgpu.namespace" . }}
+  labels:
+    app.kubernetes.io/component: "hami-device-plugin"
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+{{- end -}}
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/runtime-class.yaml b/packages/system/hami/charts/hami/templates/device-plugin/runtime-class.yaml
new file mode 100644
index 00000000..cd3d14cc
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/device-plugin/runtime-class.yaml
@@ -0,0 +1,11 @@
+{{- if and .Values.devicePlugin.enabled (not .Values.dra.enabled) -}}
+{{- if and .Values.devicePlugin.createRuntimeClass .Values.devicePlugin.runtimeClassName }}
+apiVersion: node.k8s.io/v1
+kind: RuntimeClass
+metadata:
+  name: {{ .Values.devicePlugin.runtimeClassName }}
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade
+handler: nvidia
+{{- end }}
+{{- end -}}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/certmanager.yaml b/packages/system/hami/charts/hami/templates/scheduler/certmanager.yaml
new file mode 100644
index 00000000..b6edb605
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/certmanager.yaml
@@ -0,0 +1,31 @@
+{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) -}}
+{{- if .Values.scheduler.certManager.enabled }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "hami-vgpu.scheduler" . }}-serving-cert
+  namespace: {{ include "hami-vgpu.namespace" . }}
+  labels:
+    app.kubernetes.io/component: hami-scheduler
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+spec:
+  dnsNames:
+    - {{ include "hami-vgpu.scheduler" . }}.{{ include "hami-vgpu.namespace" . }}.svc
+    - {{ include "hami-vgpu.scheduler" . }}.{{ include "hami-vgpu.namespace" . }}.svc.cluster.local
+  issuerRef:
+    kind: Issuer
+    name: {{ include "hami-vgpu.scheduler" . }}-selfsigned-issuer
+  secretName: {{ include "hami-vgpu.scheduler.tls" . }}
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: {{ include "hami-vgpu.scheduler" . }}-selfsigned-issuer
+  namespace: {{ include "hami-vgpu.namespace" . }}
+  labels:
+    app.kubernetes.io/component: hami-scheduler
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+spec:
+  selfSigned: {}
+{{- end }}
+{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/clusterrole.yaml b/packages/system/hami/charts/hami/templates/scheduler/clusterrole.yaml
new file mode 100644
index 00000000..9c510c00
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/clusterrole.yaml
@@ -0,0 +1,36 @@
+{{- if not .Values.dra.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "hami-vgpu.scheduler" . }}
+  labels:
+    app.kubernetes.io/component: "hami-scheduler"
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "configmaps"]
+    verbs: ["get", "list", "watch", "patch"]
+  - apiGroups: [""]
+    resources: ["pods/binding"]
+    verbs: ["create"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list", "patch", "watch"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["create", "get", "list"]
+  - apiGroups: [""]
+    resources: ["resourcequotas"]
+    verbs: ["get", "list", "watch"]
+---
+{{- if .Values.mockDevicePlugin.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "hami-vgpu.mock-device-plugin" . }}
+rules:
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "update", "list", "patch"]
+{{- end -}}
+{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/clusterrolebinding.yaml b/packages/system/hami/charts/hami/templates/scheduler/clusterrolebinding.yaml
new file mode 100644
index 00000000..69d75986
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/clusterrolebinding.yaml
@@ -0,0 +1,49 @@
+{{- if not .Values.dra.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "hami-vgpu.scheduler" . }}-kube
+  labels:
+    app.kubernetes.io/component: "hami-scheduler"
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:kube-scheduler
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "hami-vgpu.scheduler" . }}
+    namespace: {{ include "hami-vgpu.namespace" . }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "hami-vgpu.scheduler" . }}-volume
+  labels:
+    app.kubernetes.io/component: "hami-scheduler"
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:volume-scheduler
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "hami-vgpu.scheduler" . }}
+    namespace: {{ include "hami-vgpu.namespace" . }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "hami-vgpu.scheduler" . }}
+  labels:
+    app.kubernetes.io/component: "hami-scheduler"
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "hami-vgpu.scheduler" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "hami-vgpu.scheduler" . }}
+    namespace: {{ include "hami-vgpu.namespace" . }}
+{{- end }}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/templates/scheduler/configmap.yaml b/packages/system/hami/charts/hami/templates/scheduler/configmap.yaml
new file mode 100644
index 00000000..75889146
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/configmap.yaml
@@ -0,0 +1,142 @@
+{{- if and .Values.scheduler.kubeScheduler.enabled (not .Values.dra.enabled) -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "hami-vgpu.scheduler" . }}
+  namespace: {{ include "hami-vgpu.namespace" . }}
+  labels:
+    app.kubernetes.io/component: hami-scheduler
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+data:
+  config.json: |
+    {
+        "kind": "Policy",
+        "apiVersion": "v1",
+        "extenders": [
+            {
+                {{- if .Values.scheduler.admissionWebhook.enabled }}
+                "urlPrefix": "https://127.0.0.1:443",
+                "enableHttps": true,
+                "tlsConfig": {
+                    "insecure": true
+                },
+                {{- else }}
+                "urlPrefix": "http://127.0.0.1:80",
+                "enableHttps": false,
+                {{- end }}
+                "filterVerb": "filter",
+                "bindVerb": "bind",
+                "weight": 1,
+                "nodeCacheCapable": true,
+                "httpTimeout": 30000000000,
+                "managedResources": [
+                    {{- range .Values.devices.amd.customresources }}
+                    {
+                      "name": "{{ . }}",
+                      "ignoredByScheduler": true
+                    },
+                    {{- end }}
+                    {{- if .Values.devices.ascend.enabled }}
+                    {{- range .Values.devices.ascend.customresources }}
+                    {
+                      "name": "{{ . }}",
+                      "ignoredByScheduler": true
+                    },
+                    {{- end }}
+                    {{- end }}
+                    {{- if .Values.devices.mthreads.enabled }}
+                    {{- range .Values.devices.mthreads.customresources }}
+                    {
+                      "name": "{{ . }}",
+                      "ignoredByScheduler": true
+                    },
+                    {{- end }}
+                    {{- end }}
+                    {{- if .Values.devices.enflame.enabled }}
+                    {{- range .Values.devices.enflame.customresources }}
+                    {
+                      "name": "{{ . }}",
+                      "ignoredByScheduler": true
+                    },
+                    {{- end }}
+                    {{- end }}
+                    {{- if .Values.devices.kunlun.enabled }}
+                    {{- range .Values.devices.kunlun.customresources }}
+                    {
+                      "name": "{{ . }}",
+                      "ignoredByScheduler": true
+                    },
+                    {{- end }}
+                    {{- end }}
+                    {{- range .Values.devices.awsneuron.customresources }}
+                    {
+                      "name": "{{ . }}",
+                      "ignoredByScheduler": true
+                    },
+                    {{- end }}
+                    {{- if .Values.devices.iluvatar.enabled }}
+                    {{- range .Values.devices.iluvatar.customresources }}
+                    {
+                      "name": "{{ . }}",
+                      "ignoredByScheduler": true
+                    },
+                    {{- end }}
+                    {{- end }}
+                    {
+                        "name": "{{ .Values.resourceName }}",
+                        "ignoredByScheduler": true
+                    },
+                    {
+                        "name": "{{ .Values.resourceMem }}",
+                        "ignoredByScheduler": true
+                    },
+                    {
+                        "name": "{{ .Values.resourceCores }}",
+                        "ignoredByScheduler": true
+                    },
+                    {
+                        "name": "{{ .Values.resourceMemPercentage }}",
+                        "ignoredByScheduler": true
+                    },
+                    {
+                        "name": "{{ .Values.resourcePriority }}",
+                        "ignoredByScheduler": true
+                    },
+                    {
+                        "name": "{{ .Values.mluResourceName }}",
+                        "ignoredByScheduler": true
+                    },
+                    {
+                        "name": "{{ .Values.dcuResourceName }}",
+                        "ignoredByScheduler": true
+                    },
+                    {
+                        "name": "{{ .Values.dcuResourceMem }}",
+                        "ignoredByScheduler": true 
+                    },
+                    {
+                        "name": "{{ .Values.dcuResourceCores }}",
+                        "ignoredByScheduler": true
+                    },
+                    {
+                        "name": "metax-tech.com/gpu",
+                        "ignoredByScheduler": true
+                    },
+                    {
+                        "name": "{{ .Values.metaxResourceName }}",
+                        "ignoredByScheduler": true
+                    },
+                    {
+                        "name": "{{ .Values.metaxResourceCore }}",
+                        "ignoredByScheduler": true
+                    },
+                    {
+                        "name": "{{ .Values.metaxResourceMem }}",
+                        "ignoredByScheduler": true
+                    }
+                ],
+                "ignoreable": false
+            }
+        ]
+    }
+{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/configmapnew.yaml b/packages/system/hami/charts/hami/templates/scheduler/configmapnew.yaml
new file mode 100644
index 00000000..e2a91d8b
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/configmapnew.yaml
@@ -0,0 +1,102 @@
+{{- if and .Values.scheduler.kubeScheduler.enabled (not .Values.dra.enabled) -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "hami-vgpu.scheduler" . }}-newversion
+  namespace: {{ include "hami-vgpu.namespace" . }}
+  labels:
+    app.kubernetes.io/component: hami-scheduler
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+data:
+  config.yaml: |
+    {{- if gt (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 25}}
+    apiVersion: kubescheduler.config.k8s.io/v1
+    {{- else }}
+    apiVersion: kubescheduler.config.k8s.io/v1beta2
+    {{- end }}
+    kind: KubeSchedulerConfiguration
+    leaderElection:
+      leaderElect: false
+    profiles:
+    - schedulerName: {{ .Values.schedulerName }}
+    extenders:
+    {{- if .Values.scheduler.admissionWebhook.enabled }}
+    - urlPrefix: "https://127.0.0.1:443"
+      enableHTTPS: true
+      tlsConfig:
+        insecure: true
+    {{- else }}
+    - urlPrefix: "http://127.0.0.1:80"
+      enableHTTPS: false
+    {{- end }}
+      filterVerb: filter
+      bindVerb: bind
+      nodeCacheCapable: true
+      weight: 1
+      httpTimeout: 30s
+      managedResources:
+      - name: {{ .Values.resourceName }}
+        ignoredByScheduler: true
+      - name: {{ .Values.resourceMem }}
+        ignoredByScheduler: true
+      - name: {{ .Values.resourceCores }}
+        ignoredByScheduler: true
+      - name: {{ .Values.resourceMemPercentage }}
+        ignoredByScheduler: true
+      - name: {{ .Values.resourcePriority }}
+        ignoredByScheduler: true
+      - name: {{ .Values.mluResourceName }}
+        ignoredByScheduler: true
+      - name: {{ .Values.dcuResourceName }}
+        ignoredByScheduler: true
+      - name: {{ .Values.dcuResourceMem }}
+        ignoredByScheduler: true
+      - name: {{ .Values.dcuResourceCores }}
+        ignoredByScheduler: true
+      - name: "metax-tech.com/gpu"
+        ignoredByScheduler: true
+      - name: {{ .Values.metaxResourceName }}
+        ignoredByScheduler: true
+      - name: {{ .Values.metaxResourceCore }}
+        ignoredByScheduler: true
+      - name: {{ .Values.metaxResourceMem }}
+        ignoredByScheduler: true
+      {{- if .Values.devices.ascend.enabled }}
+      {{- range .Values.devices.ascend.customresources }}
+      - name: {{ . }}
+        ignoredByScheduler: true
+      {{- end }}
+      {{- end }}
+      {{- if .Values.devices.mthreads.enabled }}
+      {{- range .Values.devices.mthreads.customresources }}
+      - name: {{ . }}
+        ignoredByScheduler: true
+      {{- end }}
+      {{- end }}
+      {{- if .Values.devices.enflame.enabled }}
+      {{- range .Values.devices.enflame.customresources }}
+      - name: {{ . }}
+        ignoredByScheduler: true
+      {{- end }}
+      {{- end }}
+      {{- if .Values.devices.kunlun.enabled }}
+      {{- range .Values.devices.kunlun.customresources }}
+      - name: {{ . }}
+        ignoredByScheduler: true
+      {{- end }}
+      {{- end }}
+      {{- range .Values.devices.awsneuron.customresources }}
+      - name: {{ . }}
+        ignoredByScheduler: true
+      {{- end }}
+      {{- if .Values.devices.iluvatar.enabled }}
+      {{- range .Values.devices.iluvatar.customresources }}
+      - name: {{ . }}
+        ignoredByScheduler: true
+      {{- end }}
+      {{- end }}
+      {{- range .Values.devices.amd.customresources }}
+      - name: {{ . }}
+        ignoredByScheduler: true
+      {{- end }}
+{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/deployment.yaml b/packages/system/hami/charts/hami/templates/scheduler/deployment.yaml
new file mode 100644
index 00000000..6364cae3
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/deployment.yaml
@@ -0,0 +1,227 @@
+{{- if not .Values.dra.enabled -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "hami-vgpu.scheduler" . }}
+  namespace: {{ include "hami-vgpu.namespace" . }}
+  labels:
+    app.kubernetes.io/component: hami-scheduler
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+    {{- with .Values.global.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- if .Values.global.annotations }}
+  annotations: {{ toYaml .Values.global.annotations | nindent 4}}
+  {{- end }}
+spec:
+  {{- if .Values.scheduler.leaderElect }}
+  replicas: {{ .Values.scheduler.replicas }}
+  {{- else }}
+  replicas: 1
+  {{- end }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: hami-scheduler
+      {{- include "hami-vgpu.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: hami-scheduler
+        {{- include "hami-vgpu.selectorLabels" . | nindent 8 }}
+        hami.io/webhook: ignore
+      annotations:
+        {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }}
+        checksum/hami-scheduler-newversion-config: {{ include (print $.Template.BasePath "/scheduler/configmapnew.yaml") . | sha256sum }}
+        {{- else }}
+        checksum/hami-scheduler-config: {{ include (print $.Template.BasePath "/scheduler/configmap.yaml") . | sha256sum }}
+        {{- end }}
+        checksum/hami-scheduler-device-config: {{ include (print $.Template.BasePath "/scheduler/device-configmap.yaml") . | sha256sum }}
+      {{- if .Values.scheduler.podAnnotations }}
+        {{- toYaml .Values.scheduler.podAnnotations | nindent 8 }}
+      {{- end }}
+    spec:
+      serviceAccountName: {{ include "hami-vgpu.scheduler" . }}
+      priorityClassName: system-node-critical
+      {{- include "hami.scheduler.extender.imagePullSecrets" . | nindent 6 }}
+      containers:
+        {{- if .Values.scheduler.kubeScheduler.enabled }}
+        - name: kube-scheduler
+          image: {{ include "hami.scheduler.kubeScheduler.image" . }}
+          imagePullPolicy: {{ .Values.scheduler.kubeScheduler.image.pullPolicy }}
+          command:
+            - kube-scheduler
+            {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }}
+            {{- range .Values.scheduler.kubeScheduler.extraNewArgs }}
+            - {{ . }}
+            {{- end }}
+            {{- else }}
+            - --scheduler-name={{ .Values.schedulerName }}
+            {{- range .Values.scheduler.kubeScheduler.extraArgs }}
+            - {{ . }}
+            {{- end }}
+            {{- end }}
+            - --leader-elect={{ .Values.scheduler.leaderElect }}
+            - --leader-elect-resource-name={{ .Values.schedulerName }}
+            - --leader-elect-resource-namespace={{ include "hami-vgpu.namespace" . }}
+          resources:
+          {{- toYaml .Values.scheduler.kubeScheduler.resources | nindent 12 }}
+          volumeMounts:
+            - name: scheduler-config
+              mountPath: /config
+        {{- end }}
+          {{- if .Values.scheduler.livenessProbe }}
+          livenessProbe:
+            failureThreshold: 8
+            httpGet:
+              path: /healthz
+              port: 10259
+              scheme: HTTPS
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 15
+          {{- end }}
+        - name: vgpu-scheduler-extender
+          image: {{ include "hami.scheduler.extender.image" . }}
+          imagePullPolicy: {{ .Values.scheduler.extender.image.pullPolicy }}
+          env:
+          {{- if .Values.scheduler.nodeLockExpire }}
+            - name: HAMI_NODELOCK_EXPIRE
+              value: "{{ .Values.scheduler.nodeLockExpire }}"
+          {{- end }}
+          {{- if .Values.global.managedNodeSelectorEnable }}
+          {{- range $key, $value := .Values.global.managedNodeSelector }}
+            - name: NODE_SELECTOR_{{ $key | upper | replace "-" "_" }}
+              value: "{{ $value }}"
+          {{- end }}
+          {{- end }}
+          command:
+            - scheduler
+            {{- if .Values.scheduler.admissionWebhook.enabled }}
+            - --http_bind=0.0.0.0:443
+            - --cert_file=/tls/tls.crt
+            - --key_file=/tls/tls.key
+            {{- else }}
+            - --http_bind=0.0.0.0:80
+            {{- end }}
+            - --scheduler-name={{ .Values.schedulerName }}
+            - --metrics-bind-address={{ .Values.scheduler.metricsBindAddress }}
+            - --node-scheduler-policy={{ .Values.scheduler.defaultSchedulerPolicy.nodeSchedulerPolicy }}
+            - --gpu-scheduler-policy={{ .Values.scheduler.defaultSchedulerPolicy.gpuSchedulerPolicy }}
+            - --force-overwrite-default-scheduler={{ .Values.scheduler.forceOverwriteDefaultScheduler}}
+            - --device-config-file=/device-config.yaml
+            - --leader-elect={{ .Values.scheduler.leaderElect }}
+            - --leader-elect-resource-name={{ .Values.schedulerName }}
+            - --leader-elect-resource-namespace={{ include "hami-vgpu.namespace" . }}
+            {{- if .Values.devices.ascend.enabled }}
+            - --enable-ascend=true
+            {{- end }}
+            {{- if .Values.devices.iluvatar.enabled }}
+            - --enable-iluvatar=true
+            {{- end }}
+            {{- if .Values.scheduler.nodeLabelSelector }}
+            - --node-label-selector={{- $first := true -}}
+              {{- range $key, $value := .Values.scheduler.nodeLabelSelector -}}
+              {{- if not $first }},{{ end -}}
+              {{- $key }}={{ $value -}}
+              {{- $first = false -}}
+              {{- end -}}
+            {{- end }}
+            {{- range .Values.scheduler.extender.extraArgs }}
+            - {{ . }}
+            {{- end }}
+          ports:
+            {{- if .Values.scheduler.admissionWebhook.enabled }}
+            - name: https
+              containerPort: 443
+              protocol: TCP
+            {{- else }}
+            - name: http
+              containerPort: 80
+              protocol: TCP
+            {{- end }}
+            - name: metrics
+              containerPort: {{ last (splitList ":" .Values.scheduler.metricsBindAddress) | int }}
+              protocol: TCP
+          resources:
+          {{- toYaml .Values.scheduler.extender.resources | nindent 12 }}
+          volumeMounts:
+            - name: device-config
+              mountPath: /device-config.yaml
+              subPath: device-config.yaml
+          {{- if .Values.scheduler.admissionWebhook.enabled }}
+            - name: tls-config
+              mountPath: /tls
+          {{- end }}
+          {{- if .Values.scheduler.livenessProbe }}
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              {{- if .Values.scheduler.admissionWebhook.enabled }}
+              port: https
+              scheme: HTTPS
+              {{- else }}
+              port: http
+              scheme: HTTP
+              {{- end }}
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            failureThreshold: 3
+            timeoutSeconds: 5
+          {{- end }}
+          {{- if .Values.scheduler.leaderElect }}
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              {{- if .Values.scheduler.admissionWebhook.enabled }}
+              port: https
+              scheme: HTTPS
+              {{- else }}
+              port: http
+              scheme: HTTP
+              {{- end }}
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            failureThreshold: 3
+            timeoutSeconds: 5
+          {{- end }}
+      {{- if .Values.scheduler.leaderElect }}
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchExpressions:
+              - key: app.kubernetes.io/component
+                operator: In
+                values:
+                - hami-scheduler
+            topologyKey: "kubernetes.io/hostname"
+      {{- end }}
+      volumes:
+        {{- if .Values.scheduler.admissionWebhook.enabled }}
+        - name: tls-config
+          secret:
+            secretName: {{ template "hami-vgpu.scheduler.tls" . }}
+        {{- end }}
+        {{- if .Values.scheduler.kubeScheduler.enabled }}
+        - name: scheduler-config
+          configMap:
+            {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }}
+            name: {{ template "hami-vgpu.scheduler" . }}-newversion
+            {{- else }}
+            name: {{ template "hami-vgpu.scheduler" . }}
+            {{- end }}
+        {{- end }}
+        - name: device-config
+          configMap:
+            name: {{ include "hami-vgpu.scheduler" . }}-device
+      {{- if .Values.scheduler.nodeSelector }}
+      nodeSelector: {{ toYaml .Values.scheduler.nodeSelector | nindent 8 }}
+      {{- end }}
+      {{- if .Values.scheduler.tolerations }}
+      tolerations: {{ toYaml .Values.scheduler.tolerations | nindent 8 }}
+      {{- end }}
+      {{- if .Values.scheduler.nodeName }}
+      nodeName: {{ .Values.scheduler.nodeName }}
+      {{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/templates/scheduler/device-configmap.yaml b/packages/system/hami/charts/hami/templates/scheduler/device-configmap.yaml
new file mode 100644
index 00000000..ccb945ac
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/device-configmap.yaml
@@ -0,0 +1,410 @@
+{{- if not .Values.dra.enabled -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "hami-vgpu.scheduler" . }}-device
+  namespace: {{ include "hami-vgpu.namespace" . }}
+  labels:
+    app.kubernetes.io/component: hami-scheduler
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+data:
+  device-config.yaml: |-
+  {{- if .Files.Glob "files/device-config.yaml" }}
+  {{- .Files.Get "files/device-config.yaml" | nindent 4}}
+  {{- else }}
+    nvidia:
+      resourceCountName: {{ .Values.resourceName }}
+      resourceMemoryName: {{ .Values.resourceMem }}
+      resourceMemoryPercentageName: {{ .Values.resourceMemPercentage }}
+      resourceCoreName: {{ .Values.resourceCores }}
+      resourcePriorityName: {{ .Values.resourcePriority }}
+      overwriteEnv: false
+      defaultMemory: 0
+      defaultCores: 0
+      defaultGPUNum: 1
+      memoryFactor: 1
+      deviceSplitCount: {{ .Values.devicePlugin.deviceSplitCount }}
+      deviceMemoryScaling: {{ .Values.devicePlugin.deviceMemoryScaling }}
+      deviceCoreScaling: {{ .Values.devicePlugin.deviceCoreScaling }}
+      gpuCorePolicy: {{ .Values.devices.nvidia.gpuCorePolicy }}
+      libCudaLogLevel: {{ .Values.devices.nvidia.libCudaLogLevel }}
+      runtimeClassName: "{{ .Values.devicePlugin.runtimeClassName }}"
+      knownMigGeometries:
+      - models: [ "A30" ]
+        allowedGeometries:
+          - 
+            - name: 1g.6gb
+              core: 25
+              memory: 6144
+              count: 4
+          - 
+            - name: 2g.12gb
+              core: 50
+              memory: 12288
+              count: 2
+          - 
+            - name: 4g.24gb
+              core: 100
+              memory: 24576
+              count: 1
+      - models: [ "A100-SXM4-40GB", "A100-40GB-PCIe", "A100-PCIE-40GB"]
+        allowedGeometries:
+          - 
+            - name: 1g.5gb
+              core: 14
+              memory: 5120
+              count: 7
+          - 
+            - name: 1g.5gb
+              core: 14
+              memory: 5120
+              count: 1
+            - name: 2g.10gb
+              core: 28
+              memory: 10240
+              count: 3
+          - 
+            - name: 3g.20gb
+              core: 42
+              memory: 20480
+              count: 2
+          - 
+            - name: 7g.40gb
+              core: 100
+              memory: 40960
+              count: 1
+      - models: [ "A100-SXM4-80GB", "A100-80GB-PCIe", "A100-PCIE-80GB"]
+        allowedGeometries:
+          - 
+            - name: 1g.10gb
+              core: 14
+              memory: 10240
+              count: 7
+          - 
+            - name: 1g.10gb
+              core: 14
+              memory: 10240
+              count: 1
+            - name: 2g.20gb
+              core: 28
+              memory: 20480
+              count: 3
+          - 
+            - name: 3g.40gb
+              core: 42
+              memory: 40960
+              count: 2
+          - 
+            - name: 7g.79gb
+              core: 100
+              memory: 80896
+              count: 1
+      - models: [ "H100-PCIE-80GB", "H100-SXM5-80GB"]
+        allowedGeometries:
+          - 
+            - name: 1g.10gb
+              core: 14
+              memory: 10240
+              count: 7
+          - 
+            - name: 1g.10gb
+              core: 14
+              memory: 10240
+              count: 1
+            - name: 2g.20gb
+              core: 28
+              memory: 20480
+              count: 3
+          - 
+            - name: 3g.40gb
+              core: 42
+              memory: 40960
+              count: 2
+          - 
+            - name: 7g.80gb
+              core: 100
+              memory: 81920
+              count: 1
+      - models: [ "H100-PCIE-94GB", "H100-SXM5-94GB"]
+        allowedGeometries:
+          - 
+            - name: 1g.12gb
+              core: 14
+              memory: 12288
+              count: 7
+          - 
+            - name: 1g.12gb
+              core: 14
+              memory: 12288
+              count: 1
+            - name: 2g.24gb
+              core: 28
+              memory: 24576
+              count: 3
+          - 
+            - name: 3g.47gb
+              core: 42
+              memory: 48128
+              count: 2
+          - 
+            - name: 7g.94gb
+              core: 100
+              memory: 96256
+              count: 1
+      - models: [ "H20", "H100 on GH200"]
+        allowedGeometries:
+          - 
+            - name: 1g.12gb
+              core: 14
+              memory: 12288
+              count: 7
+          - 
+            - name: 1g.12gb
+              core: 14
+              memory: 12288
+              count: 1
+            - name: 2g.24gb
+              core: 28
+              memory: 24576
+              count: 3 
+          - 
+            - name: 3g.48gb
+              core: 42
+              memory: 49152
+              count: 2
+          - 
+            - name: 7g.96gb
+              core: 100
+              memory: 98304
+              count: 1
+      - models: [ "H200 NVL", "H200-SXM5"]
+        allowedGeometries:
+          - 
+            - name: 1g.18gb
+              core: 14
+              memory: 18432
+              count: 7
+          - 
+            - name: 1g.18gb
+              core: 14
+              memory: 18432
+              count: 1
+            - name: 2g.35gb
+              core: 28
+              memory: 35840
+              count: 3
+          - 
+            - name: 3g.71gb
+              core: 42
+              memory: 72704
+              count: 2
+          - 
+            - name: 7g.141gb
+              core: 100
+              memory: 144384
+              count: 1
+      - models: [ "B200" ]
+        allowedGeometries:
+          - 
+            - name: 1g.23gb
+              core: 14
+              memory: 23552
+              count: 7
+          - 
+            - name: 1g.23gb
+              core: 14
+              memory: 23552
+              count: 1
+            - name: 2g.45gb
+              core: 28
+              memory: 46080
+              count: 3
+          - 
+            - name: 3g.90gb
+              core: 42
+              memory: 92160
+              count: 2
+          - 
+            - name: 7g.180gb
+              core: 100
+              memory: 184320
+              count: 1
+    cambricon:
+      resourceCountName: {{ .Values.mluResourceName }}
+      resourceMemoryName: {{ .Values.mluResourceMem }}
+      resourceCoreName: {{ .Values.mluResourceCores }}
+    hygon:
+      resourceCountName: {{ .Values.dcuResourceName }}
+      resourceMemoryName: {{ .Values.dcuResourceMem }}
+      resourceCoreName: {{ .Values.dcuResourceCores }}
+      memoryFactor: 1
+    metax:
+      resourceCountName: "metax-tech.com/gpu"
+      resourceVCountName: {{ .Values.metaxResourceName }}
+      resourceVMemoryName: {{ .Values.metaxResourceMem }}
+      resourceVCoreName: {{ .Values.metaxResourceCore }}
+      sgpuTopologyAware: {{ .Values.metaxsGPUTopologyAware }}
+    enflame:
+      resourceNameGCU: "enflame.com/gcu"
+      resourceNameVGCU: {{ .Values.enflameResourceNameVGCU }}
+      resourceNameVGCUPercentage: {{ .Values.enflameResourceNameVGCUPercentage }}
+    mthreads:
+      resourceCountName: "mthreads.com/vgpu"
+      resourceMemoryName: "mthreads.com/sgpu-memory"
+      resourceCoreName: "mthreads.com/sgpu-core"
+    iluvatars:
+    - chipName: MR-V100
+      commonWord: MR-V100
+      resourceCountName: iluvatar.ai/MR-V100-vgpu
+      resourceMemoryName: iluvatar.ai/MR-V100.vMem
+      resourceCoreName: iluvatar.ai/MR-V100.vCore
+    - chipName: MR-V50
+      commonWord: MR-V50
+      resourceCountName: iluvatar.ai/MR-V50-vgpu
+      resourceMemoryName: iluvatar.ai/MR-V50.vMem
+      resourceCoreName: iluvatar.ai/MR-V50.vCore
+    - chipName: BI-V150
+      commonWord: BI-V150
+      resourceCountName: iluvatar.ai/BI-V150-vgpu
+      resourceMemoryName: iluvatar.ai/BI-V150.vMem
+      resourceCoreName: iluvatar.ai/BI-V150.vCore
+    - chipName: BI-V100
+      commonWord: BI-V100
+      resourceCountName: iluvatar.ai/BI-V100-vgpu
+      resourceMemoryName: iluvatar.ai/BI-V100.vMem
+      resourceCoreName: iluvatar.ai/BI-V100.vCore
+    kunlun:
+      resourceCountName: {{ .Values.kunlunResourceName }}
+      resourceVCountName: {{ .Values.kunlunResourceVCountName }}
+      resourceVMemoryName: {{ .Values.kunlunResourceVMemoryName }}
+    awsneuron:
+      resourceCountName: "aws.amazon.com/neuron"
+      resourceCoreName: "aws.amazon.com/neuroncore"
+    amd:
+      resourceCountName: "amd.com/gpu"
+    vnpus:
+    - chipName: 910A
+      commonWord: Ascend910A
+      resourceName: huawei.com/Ascend910A
+      resourceMemoryName: huawei.com/Ascend910A-memory
+      memoryAllocatable: 32768
+      memoryCapacity: 32768
+      memoryFactor: 1
+      aiCore: 30
+      templates:
+        - name: vir02
+          memory: 2184
+          aiCore: 2
+        - name: vir04
+          memory: 4369
+          aiCore: 4
+        - name: vir08
+          memory: 8738
+          aiCore: 8
+        - name: vir16
+          memory: 17476
+          aiCore: 16
+    - chipName: 910B2
+      commonWord: Ascend910B2
+      resourceName: huawei.com/Ascend910B2
+      resourceMemoryName: huawei.com/Ascend910B2-memory
+      memoryAllocatable: 65536
+      memoryCapacity: 65536
+      memoryFactor: 1
+      aiCore: 24
+      aiCPU: 6
+      templates:
+        - name: vir03_1c_8g
+          memory: 8192
+          aiCore: 3
+          aiCPU: 1
+        - name: vir06_1c_16g
+          memory: 16384
+          aiCore: 6
+          aiCPU: 1
+        - name: vir12_3c_32g
+          memory: 32768
+          aiCore: 12
+          aiCPU: 3
+    - chipName: 910B3
+      commonWord: Ascend910B3
+      resourceName: huawei.com/Ascend910B3
+      resourceMemoryName: huawei.com/Ascend910B3-memory
+      memoryAllocatable: 65536
+      memoryCapacity: 65536
+      memoryFactor: 1
+      aiCore: 20
+      aiCPU: 7
+      templates:
+        - name: vir05_1c_16g
+          memory: 16384
+          aiCore: 5
+          aiCPU: 1
+        - name: vir10_3c_32g
+          memory: 32768
+          aiCore: 10
+          aiCPU: 3
+    - chipName: 910B4-1
+      commonWord: Ascend910B4-1
+      resourceName: huawei.com/Ascend910B4-1
+      resourceMemoryName: huawei.com/Ascend910B4-1-memory
+      memoryAllocatable: 65536
+      memoryCapacity: 65536
+      memoryFactor: 1
+      aiCore: 20
+      aiCPU: 7
+      templates:
+        # NOTE: Names of vnpu template for 910B4-1 are fixed by Ascend runtime and must not be changed.
+        # The memory is used for scheduling so the correct values must be set.
+        # Template vir05_1c_8g actually provides 16GB memory,
+        - name: vir05_1c_8g
+          memory: 16384
+          aiCore: 5
+          aiCPU: 1
+        # Template vir10_3c_16g actually provides 32GB memory
+        - name: vir10_3c_16g
+          memory: 32768
+          aiCore: 10
+          aiCPU: 3
+    - chipName: 910B4
+      commonWord: Ascend910B4
+      resourceName: huawei.com/Ascend910B4
+      resourceMemoryName: huawei.com/Ascend910B4-memory
+      memoryAllocatable: 32768
+      memoryCapacity: 32768
+      memoryFactor: 1
+      aiCore: 20
+      aiCPU: 7
+      templates:
+        - name: vir05_1c_8g
+          memory: 8192
+          aiCore: 5
+          aiCPU: 1
+        - name: vir10_3c_16g
+          memory: 16384
+          aiCore: 10
+          aiCPU: 3
+    - chipName: 310P3
+      commonWord: Ascend310P
+      resourceName: huawei.com/Ascend310P
+      resourceMemoryName: huawei.com/Ascend310P-memory
+      memoryAllocatable: 21527
+      memoryCapacity: 24576
+      memoryFactor: 1
+      aiCore: 8
+      aiCPU: 7
+      templates:
+        - name: vir01
+          memory: 3072
+          aiCore: 1
+          aiCPU: 1
+        - name: vir02
+          memory: 6144
+          aiCore: 2
+          aiCPU: 2
+        - name: vir04
+          memory: 12288
+          aiCore: 4
+          aiCPU: 4
+  {{ end }}
+{{- end }}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrole.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrole.yaml
new file mode 100644
index 00000000..b089ae82
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrole.yaml
@@ -0,0 +1,30 @@
+{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) -}}
+{{- if and (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "hami-vgpu.fullname" . }}-admission
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+  labels:
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+    app.kubernetes.io/component: admission-webhook
+rules:
+  - apiGroups:
+      - admissionregistration.k8s.io
+    resources:
+      #- validatingwebhookconfigurations
+      - mutatingwebhookconfigurations
+    verbs:
+      - get
+      - update
+{{- if .Values.podSecurityPolicy.enabled }}
+  - apiGroups: ['extensions']
+    resources: ['podsecuritypolicies']
+    verbs:     ['use']
+    resourceNames:
+    - {{ include "hami-vgpu.fullname" . }}-admission
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrolebinding.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrolebinding.yaml
new file mode 100644
index 00000000..64f01ecf
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrolebinding.yaml
@@ -0,0 +1,22 @@
+{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) -}}
+{{- if and (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name:  {{ include "hami-vgpu.fullname" . }}-admission
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+  labels:
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+    app.kubernetes.io/component: admission-webhook
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "hami-vgpu.fullname" . }}-admission
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "hami-vgpu.fullname" . }}-admission
+    namespace: {{ include "hami-vgpu.namespace" . }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-createSecret.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-createSecret.yaml
new file mode 100644
index 00000000..400168a7
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-createSecret.yaml
@@ -0,0 +1,70 @@
+{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) -}}
+{{- if and (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "hami-vgpu.fullname" . }}-admission-create
+  namespace: {{ include "hami-vgpu.namespace" . }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+  labels:
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+    app.kubernetes.io/component: admission-webhook
+spec:
+  {{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }}
+  # Alpha feature since k8s 1.12
+  ttlSecondsAfterFinished: 0
+  {{- end }}
+  template:
+    metadata:
+      name: {{ include "hami-vgpu.fullname" . }}-admission-create
+      {{- if .Values.scheduler.patch.podAnnotations }}
+      annotations: {{ toYaml .Values.scheduler.patch.podAnnotations | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "hami-vgpu.labels" . | nindent 8 }}
+        app.kubernetes.io/component: admission-webhook
+        hami.io/webhook: ignore
+    spec:
+      {{- if .Values.scheduler.patch.priorityClassName }}
+      priorityClassName: {{ .Values.scheduler.patch.priorityClassName }}
+      {{- end }}
+      {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }}
+        {{- include "hami.scheduler.patch.new.imagePullSecrets" . | nindent 6 }}
+      {{- else }}
+        {{- include "hami.scheduler.patch.imagePullSecrets" . | nindent 6 }}
+      {{- end }}
+      containers:
+        - name: create
+          {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }}
+          image: {{ include "hami.scheduler.patch.new.image" . }}
+          imagePullPolicy: {{ .Values.scheduler.patch.imageNew.pullPolicy }}
+          {{- else }}
+          image: {{ include "hami.scheduler.patch.image" . }}
+          imagePullPolicy: {{ .Values.scheduler.patch.image.pullPolicy }}
+          {{- end }}
+          args:
+            - create
+            - --cert-name=tls.crt
+            - --key-name=tls.key
+            {{- if .Values.scheduler.admissionWebhook.customURL.enabled }}
+            - --host={{ printf "%s.%s.svc,127.0.0.1,%s" (include "hami-vgpu.scheduler" .) (include "hami-vgpu.namespace" .) .Values.scheduler.admissionWebhook.customURL.host}}
+            {{- else }}
+            - --host={{ printf "%s.%s.svc,127.0.0.1" (include "hami-vgpu.scheduler" .) (include "hami-vgpu.namespace" .) }}
+            {{- end }}
+            - --namespace={{ include "hami-vgpu.namespace" . }}
+            - --secret-name={{ include "hami-vgpu.scheduler.tls" . }}
+      restartPolicy: OnFailure
+      serviceAccountName: {{ include "hami-vgpu.fullname" . }}-admission
+      {{- if .Values.scheduler.patch.nodeSelector }}
+      nodeSelector: {{ toYaml .Values.scheduler.patch.nodeSelector | nindent 8 }}
+      {{- end }}
+      {{- if .Values.scheduler.patch.tolerations }}
+      tolerations: {{ toYaml .Values.scheduler.patch.tolerations | nindent 8 }}
+      {{- end }}
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: {{ .Values.scheduler.patch.runAsUser }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-patchWebhook.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-patchWebhook.yaml
new file mode 100644
index 00000000..71e97f6b
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-patchWebhook.yaml
@@ -0,0 +1,65 @@
+{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) -}}
+{{- if and (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "hami-vgpu.fullname" . }}-admission-patch
+  namespace: {{ include "hami-vgpu.namespace" . }}
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+  labels:
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+    app.kubernetes.io/component: admission-webhook
+spec:
+  {{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }}
+  # Alpha feature since k8s 1.12
+  ttlSecondsAfterFinished: 0
+  {{- end }}
+  template:
+    metadata:
+      name: {{ include "hami-vgpu.fullname" . }}-admission-patch
+      {{- if .Values.scheduler.patch.podAnnotations }}
+      annotations: {{ toYaml .Values.scheduler.patch.podAnnotations | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "hami-vgpu.labels" . | nindent 8 }}
+        app.kubernetes.io/component: admission-webhook
+        hami.io/webhook: ignore
+    spec:
+      {{- if .Values.scheduler.patch.priorityClassName }}
+      priorityClassName: {{ .Values.scheduler.patch.priorityClassName }}
+      {{- end }}
+      {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }}
+        {{- include "hami.scheduler.patch.new.imagePullSecrets" . | nindent 6 }}
+      {{- else }}
+        {{- include "hami.scheduler.patch.imagePullSecrets" . | nindent 6 }}
+      {{- end }}
+      containers:
+        - name: patch
+          {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }}
+          image: {{ include "hami.scheduler.patch.new.image" . }}
+          imagePullPolicy: {{ .Values.scheduler.patch.imageNew.pullPolicy }}
+          {{- else }}
+          image: {{ include "hami.scheduler.patch.image" . }}
+          imagePullPolicy: {{ .Values.scheduler.patch.image.pullPolicy }}
+          {{- end }}
+          args:
+            - patch
+            - --webhook-name={{ include "hami-vgpu.scheduler.webhook" . }}
+            - --namespace={{ include "hami-vgpu.namespace" . }}
+            - --patch-validating=false
+            - --secret-name={{ include "hami-vgpu.scheduler.tls" . }}
+      restartPolicy: OnFailure
+      serviceAccountName: {{ include "hami-vgpu.fullname" . }}-admission
+      {{- if .Values.scheduler.patch.nodeSelector }}
+      nodeSelector: {{ toYaml .Values.scheduler.patch.nodeSelector | nindent 8 }}
+      {{- end }}
+      {{- if .Values.scheduler.patch.tolerations }}
+      tolerations: {{ toYaml .Values.scheduler.patch.tolerations | nindent 8 }}
+      {{- end }}
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: {{ .Values.scheduler.patch.runAsUser }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/psp.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/psp.yaml
new file mode 100644
index 00000000..a48270e7
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/job-patch/psp.yaml
@@ -0,0 +1,40 @@
+{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) -}}
+{{- if and (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) }}
+{{- if .Values.podSecurityPolicy.enabled }}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ include "hami-vgpu.fullname" . }}-admission
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+  labels:
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+    app.kubernetes.io/component: admission-webhook
+spec:
+  allowPrivilegeEscalation: false
+  fsGroup:
+    ranges:
+    - max: 65535
+      min: 1
+    rule: MustRunAs
+  requiredDropCapabilities:
+  - ALL
+  runAsUser:
+    rule: MustRunAsNonRoot
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    ranges:
+    - max: 65535
+      min: 1
+    rule: MustRunAs
+  volumes:
+  - configMap
+  - emptyDir
+  - projected
+  - secret
+  - downwardAPI
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/role.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/role.yaml
new file mode 100644
index 00000000..74e45681
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/job-patch/role.yaml
@@ -0,0 +1,23 @@
+{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) -}}
+{{- if and (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name:  {{ include "hami-vgpu.fullname" . }}-admission
+  namespace: {{ include "hami-vgpu.namespace" . }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+  labels:
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+    app.kubernetes.io/component: admission-webhook
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - get
+      - create
+{{- end }}
+{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/rolebinding.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/rolebinding.yaml
new file mode 100644
index 00000000..32da5ba4
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/job-patch/rolebinding.yaml
@@ -0,0 +1,23 @@
+{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) -}}
+{{- if and (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "hami-vgpu.fullname" . }}-admission
+  namespace: {{ include "hami-vgpu.namespace" . }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+  labels:
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+    app.kubernetes.io/component: admission-webhook
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "hami-vgpu.fullname" . }}-admission
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "hami-vgpu.fullname" . }}-admission
+    namespace: {{ include "hami-vgpu.namespace" . }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/serviceaccount.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/serviceaccount.yaml
new file mode 100644
index 00000000..d2eb41de
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/job-patch/serviceaccount.yaml
@@ -0,0 +1,15 @@
+{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) }}
+{{- if and (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "hami-vgpu.fullname" . }}-admission
+  namespace: {{ include "hami-vgpu.namespace" . }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+  labels:
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+    app.kubernetes.io/component: admission-webhook
+{{- end }}
+{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/role.yaml b/packages/system/hami/charts/hami/templates/scheduler/role.yaml
new file mode 100644
index 00000000..6e681967
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/role.yaml
@@ -0,0 +1,14 @@
+{{- if not .Values.dra.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "hami-vgpu.scheduler" . }}
+  namespace: {{ include "hami-vgpu.namespace" . }}
+  labels:
+    app.kubernetes.io/component: "hami-scheduler"
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+rules:
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["create", "list", "watch", "get", "update", "patch"]
+{{- end }}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/templates/scheduler/rolebinding.yaml b/packages/system/hami/charts/hami/templates/scheduler/rolebinding.yaml
new file mode 100644
index 00000000..934f8223
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/rolebinding.yaml
@@ -0,0 +1,33 @@
+{{- if not .Values.dra.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "hami-vgpu.scheduler" . }}
+  namespace: {{ include "hami-vgpu.namespace" . }}
+  labels:
+    app.kubernetes.io/component: "hami-scheduler"
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "hami-vgpu.scheduler" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "hami-vgpu.scheduler" . }}
+    namespace: {{ include "hami-vgpu.namespace" . }}
+---
+{{- if .Values.mockDevicePlugin.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "hami-vgpu.mock-device-plugin" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "hami-vgpu.mock-device-plugin" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "hami-vgpu.mock-device-plugin" . }}
+    namespace: {{ include "hami-vgpu.namespace" . }}
+{{- end -}}
+{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/service.yaml b/packages/system/hami/charts/hami/templates/scheduler/service.yaml
new file mode 100644
index 00000000..3e18bc98
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/service.yaml
@@ -0,0 +1,36 @@
+{{- if not .Values.dra.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "hami-vgpu.scheduler" . }}
+  namespace: {{ include "hami-vgpu.namespace" . }}
+  labels:
+    app.kubernetes.io/component: hami-scheduler
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+    {{- if .Values.scheduler.service.labels }}
+    {{ toYaml .Values.scheduler.service.labels | indent 4 }}
+    {{- end }}
+  {{- if .Values.scheduler.service.annotations }}
+  annotations: {{ toYaml .Values.scheduler.service.annotations | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.scheduler.service.type | default "NodePort" }}  # Default type is NodePort
+  ports:
+    - name: http
+      port: {{ .Values.scheduler.service.httpPort | default 443 }}  # Default HTTP port is 443
+      targetPort: {{ .Values.scheduler.service.httpTargetPort | default 443 }}
+      {{- if eq (.Values.scheduler.service.type | default "NodePort") "NodePort" }}  # If type is NodePort, set nodePort
+      nodePort: {{ .Values.scheduler.service.schedulerPort | default 31998 }}
+      {{- end }}
+      protocol: TCP
+    - name: monitor
+      port: {{ .Values.scheduler.service.monitorPort | default 31993 }}  # Default monitoring port is 31993
+      targetPort: {{ .Values.scheduler.service.monitorTargetPort | default 9395 }}
+      {{- if eq (.Values.scheduler.service.type | default "NodePort") "NodePort" }}  # If type is NodePort, set nodePort
+      nodePort: {{ .Values.scheduler.service.monitorPort | default 31993 }}
+      {{- end }}
+      protocol: TCP
+  selector:
+    app.kubernetes.io/component: hami-scheduler
+    {{- include "hami-vgpu.selectorLabels" . | nindent 4 }}
+{{- end }}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/templates/scheduler/serviceaccount.yaml b/packages/system/hami/charts/hami/templates/scheduler/serviceaccount.yaml
new file mode 100644
index 00000000..929bf59a
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/serviceaccount.yaml
@@ -0,0 +1,18 @@
+{{- if not .Values.dra.enabled -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "hami-vgpu.scheduler" . }}
+  namespace: {{ include "hami-vgpu.namespace" . }}
+  labels:
+    app.kubernetes.io/component: "hami-scheduler"
+    {{- include "hami-vgpu.labels" . | nindent 4 }}
+---
+{{- if .Values.mockDevicePlugin.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "hami-vgpu.mock-device-plugin" . }}
+  namespace: {{ include "hami-vgpu.namespace" . }}
+{{- end -}}
+{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/webhook.yaml b/packages/system/hami/charts/hami/templates/scheduler/webhook.yaml
new file mode 100644
index 00000000..148feb5c
--- /dev/null
+++ b/packages/system/hami/charts/hami/templates/scheduler/webhook.yaml
@@ -0,0 +1,57 @@
+{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) -}}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  {{- if .Values.scheduler.certManager.enabled }}
+  annotations:
+    cert-manager.io/inject-ca-from: {{ include "hami-vgpu.namespace" . }}/{{ include "hami-vgpu.scheduler" . }}-serving-cert
+  {{- end }}
+  name: {{ include "hami-vgpu.scheduler.webhook" . }}
+webhooks:
+  - admissionReviewVersions:
+    - v1beta1
+    clientConfig:
+      {{- if .Values.scheduler.admissionWebhook.customURL.enabled }}
+      url: https://{{ .Values.scheduler.admissionWebhook.customURL.host}}:{{.Values.scheduler.admissionWebhook.customURL.port}}{{.Values.scheduler.admissionWebhook.customURL.path}}
+      {{- else }}
+      service:
+        name: {{ include "hami-vgpu.scheduler" . }}
+        namespace: {{ include "hami-vgpu.namespace" . }}
+        path: /webhook
+        port: {{ .Values.scheduler.service.httpPort }}
+      {{- end }}
+    failurePolicy: {{ .Values.scheduler.admissionWebhook.failurePolicy }}
+    matchPolicy: Equivalent
+    name: vgpu.hami.io
+    namespaceSelector:
+      matchExpressions:
+      - key: hami.io/webhook
+        operator: NotIn
+        values:
+        - ignore
+      {{- if .Values.scheduler.admissionWebhook.whitelistNamespaces }}
+      - key: kubernetes.io/metadata.name
+        operator: NotIn
+        values:
+        {{- toYaml .Values.scheduler.admissionWebhook.whitelistNamespaces | nindent 10 }}
+      {{- end }}
+    objectSelector:
+      matchExpressions:
+      - key: hami.io/webhook
+        operator: NotIn
+        values:
+        - ignore
+    reinvocationPolicy: {{ .Values.scheduler.admissionWebhook.reinvocationPolicy }}
+    rules:
+      - apiGroups:
+          - ""
+        apiVersions:
+          - v1
+        operations:
+          - CREATE
+        resources:
+          - pods
+        scope: '*'
+    sideEffects: None
+    timeoutSeconds: 10
+{{- end }}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/values.yaml b/packages/system/hami/charts/hami/values.yaml
new file mode 100644
index 00000000..9fbeca70
--- /dev/null
+++ b/packages/system/hami/charts/hami/values.yaml
@@ -0,0 +1,476 @@
+## @section Global configuration
+## @param global.imageRegistry Global Docker image registry
+## @param global.imagePullSecrets Global Docker image pull secrets
+global:
+  ## @param global.imageRegistry Global Docker image registry
+  imageRegistry: ""
+  ## E.g.
+  ## imagePullSecrets:
+  ##   - myRegistryKeySecretName
+  ## @param global.imagePullSecrets Global Docker image pull secrets
+  imagePullSecrets: []
+  imageTag: "v2.8.1"
+  gpuHookPath: /usr/local
+  labels: {}
+  annotations: {}
+  managedNodeSelectorEnable: false
+  managedNodeSelector:
+    usage: "gpu"
+
+nameOverride: ""
+fullnameOverride: ""
+namespaceOverride: ""
+
+#Nvidia GPU Parameters
+resourceName: "nvidia.com/gpu"
+resourceMem: "nvidia.com/gpumem"
+resourceMemPercentage: "nvidia.com/gpumem-percentage"
+resourceCores: "nvidia.com/gpucores"
+resourcePriority: "nvidia.com/priority"
+
+#MLU Parameters
+mluResourceName: "cambricon.com/vmlu"
+mluResourceMem: "cambricon.com/mlu.smlu.vmemory"
+mluResourceCores: "cambricon.com/mlu.smlu.vcore"
+
+#Hygon DCU Parameters
+dcuResourceName: "hygon.com/dcunum"
+dcuResourceMem: "hygon.com/dcumem"
+dcuResourceCores: "hygon.com/dcucores"
+
+#Metax sGPU Parameters
+metaxResourceName: "metax-tech.com/sgpu"
+metaxResourceCore: "metax-tech.com/vcore"
+metaxResourceMem: "metax-tech.com/vmemory"
+metaxsGPUTopologyAware: "false"
+
+#Enflame VGCU Parameters
+enflameResourceNameVGCU: "enflame.com/vgcu"
+enflameResourceNameVGCUPercentage: "enflame.com/vgcu-percentage"
+
+#Kunlun XPU Parameters
+kunlunResourceName: "kunlunxin.com/xpu"
+kunlunResourceVCountName: "kunlunxin.com/vxpu"
+kunlunResourceVMemoryName: "kunlunxin.com/vxpu-memory"
+
+schedulerName: "hami-scheduler"
+
+podSecurityPolicy:
+  enabled: false
+
+scheduler:
+  # @param nodeName defines the node name and the nvidia-vgpu-scheduler-scheduler will schedule to the node.
+  # if we install the nvidia-vgpu-scheduler-scheduler as default scheduler, we need to remove the k8s default
+  # scheduler pod from the cluster first, we must specify node name to skip the schedule workflow.
+  nodeName: ""
+  #nodeLabelSelector:
+  #  "gpu": "on"
+  overwriteEnv: "false"
+  defaultSchedulerPolicy:
+    nodeSchedulerPolicy: binpack
+    gpuSchedulerPolicy: spread
+  metricsBindAddress: ":9395"
+  # If set to false, When Pod.Spec.SchedulerName equals to the const DefaultSchedulerName in k8s.io/api/core/v1 package, webhook will not overwrite it
+  forceOverwriteDefaultScheduler: true
+  livenessProbe: false
+  leaderElect: true
+  # when leaderElect is true, replicas is available, otherwise replicas is 1.
+  replicas: 1
+  kubeScheduler:
+    # @param enabled indicate whether to run kube-scheduler container in the scheduler pod, it's true by default.
+    enabled: true
+    ## @param image.registry kube scheduler image registry
+    ## @param image.repository kube scheduler image repository
+    ## @param image.tag kube scheduler image tag (immutable tags are recommended)
+    ## @param image.pullPolicy kube scheduler image pull policy
+    ## @param image.pullSecrets Specify docker-registry secret names as an array
+    image:
+      registry: "registry.cn-hangzhou.aliyuncs.com"
+      repository: "google_containers/kube-scheduler"
+      tag: ""
+      ## Specify a imagePullPolicy
+      ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+      ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+      ##
+      pullPolicy: IfNotPresent
+      ## Optionally specify an array of imagePullSecrets.
+      ## Secrets must be manually created in the namespace.
+      ## Example:
+      ## pullSecrets:
+      ##   - myRegistryKeySecretName
+      ##
+      pullSecrets: []
+    resources: {}
+      # If you do want to specify resources, uncomment the following lines, adjust them as necessary.
+      # and remove the curly braces after 'resources:'.
+#      limits:
+#        cpu: 1000m
+#        memory: 1000Mi
+#      requests:
+#        cpu: 100m
+#        memory: 100Mi
+    extraNewArgs:
+      - --config=/config/config.yaml
+      - -v=4
+    extraArgs:
+      - --policy-config-file=/config/config.json
+      - -v=4
+  extender:
+    ## @param image.registry scheduler extender image registry
+    ## @param image.repository scheduler extender image repository
+    ## @param image.tag scheduler extender image tag (immutable tags are recommended)
+    ## @param image.pullPolicy scheduler extender image pull policy
+    ## @param image.pullSecrets Specify docker-registry secret names as an array
+    image:
+      registry: "docker.io"
+      repository: "projecthami/hami"
+      tag: ""
+      ## Specify a imagePullPolicy
+      ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+      ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+      ##
+      pullPolicy: IfNotPresent
+      ## Optionally specify an array of imagePullSecrets.
+      ## Secrets must be manually created in the namespace.
+      ## Example:
+      ## pullSecrets:
+      ##   - myRegistryKeySecretName
+      ##
+      pullSecrets: []
+    resources: {}
+      # If you do want to specify resources, uncomment the following lines, adjust them as necessary,
+      # and remove the curly braces after 'resources:'.
+#      limits:
+#        cpu: 1000m
+#        memory: 1000Mi
+#      requests:
+#        cpu: 100m
+#        memory: 100Mi
+    extraArgs:
+      - --debug
+      - -v=4
+  nodeLockExpire: "5m"
+  podAnnotations: {}
+  tolerations: []
+  #serviceAccountName: "hami-vgpu-scheduler-sa"
+  admissionWebhook:
+    # If set to false, the admission webhook is not installed and any pods that should use HAMi must be
+    # configured to use the right 'schedulerName' and other device-specific configurations.
+    enabled: true
+    customURL:
+      enabled: false
+      # must be an endpoint using https.
+      # should generate host certs here
+      host: 127.0.0.1 # hostname or ip, can be your node'IP if you want to use https://<nodeIP>:<schedulerPort>/<path>
+      port: 31998
+      path: /webhook
+    whitelistNamespaces:
+    # Specify the namespaces that the webhook will not be applied to.
+      # - default
+      # - kube-system
+      # - istio-system
+    reinvocationPolicy: Never
+    failurePolicy: Ignore
+  ## TLS Certificate Option 1: Use cert-manager to generate self-signed certificate.
+  ## If enabled, always takes precedence over options 2.
+  certManager:
+    enabled: false
+  ## TLS Certificate Option 2: Use kube-webhook-certgen to generate self-signed certificate.
+  ## If true and certManager.enabled is false, Helm will automatically create a self-signed cert and secret for you.
+  patch:
+    enabled: true
+    ## @param image.registry scheduler extender image registry
+    ## @param image.repository scheduler extender image repository
+    ## @param image.tag scheduler extender image tag (immutable tags are recommended)
+    ## @param image.pullPolicy scheduler extender image pull policy
+    ## @param image.pullSecrets Specify docker-registry secret names as an array
+    image:
+      registry: "docker.io"
+      repository: "jettech/kube-webhook-certgen"
+      tag: "v1.5.2"
+      ## Specify a imagePullPolicy
+      ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+      ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+      ##
+      pullPolicy: IfNotPresent
+      ## Optionally specify an array of imagePullSecrets.
+      ## Secrets must be manually created in the namespace.
+      ## Example:
+      ## pullSecrets:
+      ##   - myRegistryKeySecretName
+      ##
+      pullSecrets: []
+    ## @param image.registry scheduler extender image registry
+    ## @param image.repository scheduler extender image repository
+    ## @param image.tag scheduler extender image tag (immutable tags are recommended)
+    ## @param image.pullPolicy scheduler extender image pull policy
+    ## @param image.pullSecrets Specify docker-registry secret names as an array
+    imageNew: 
+      registry: "docker.io"
+      repository: "liangjw/kube-webhook-certgen"
+      tag: "v1.1.1"
+      ## Specify a imagePullPolicy
+      ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+      ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+      ##
+      pullPolicy: IfNotPresent
+      ## Optionally specify an array of imagePullSecrets.
+      ## Secrets must be manually created in the namespace.
+      ## Example:
+      ## pullSecrets:
+      ##   - myRegistryKeySecretName
+      ##
+      pullSecrets: []
+    priorityClassName: ""
+    podAnnotations: {}
+    nodeSelector: {}
+    tolerations: []
+    runAsUser: 2000
+  service:
+    type: NodePort  # Default type is NodePort, can be changed to ClusterIP
+    httpPort: 443   # HTTP port
+    schedulerPort: 31998  # NodePort for HTTP
+    monitorPort: 31993    # Monitoring port
+    monitorTargetPort: 9395
+    httpTargetPort: 443
+    labels: {}
+    annotations: {}
+
+devicePlugin:
+  enabled: true
+  gpuOperatorToolkitReady:
+    enabled: false
+    hostPath: "/run/nvidia/validations"
+  ## @param image.registry devicePlugin image registry
+  ## @param image.repository devicePlugin image repository
+  ## @param image.tag devicePlugin image tag (immutable tags are recommended)
+  ## @param image.pullPolicy devicePlugin image pull policy
+  ## @param image.pullSecrets Specify docker-registry secret names as an array
+  image:
+    registry: "docker.io"
+    repository: "projecthami/hami"
+    tag: ""
+    ## Specify a imagePullPolicy
+    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+    ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+    ##
+    pullPolicy: IfNotPresent
+    ## Optionally specify an array of imagePullSecrets.
+    ## Secrets must be manually created in the namespace.
+    ## Example:
+    ## pullSecrets:
+    ##   - myRegistryKeySecretName
+    ##
+    pullSecrets: []
+  monitor:
+    ## @param image.registry monitor image registry
+    ## @param image.repository monitor image repository
+    ## @param image.tag monitor image tag (immutable tags are recommended)
+    ## @param image.pullPolicy monitor image pull policy
+    ## @param image.pullSecrets Specify docker-registry secret names as an array
+    image:
+      registry: "docker.io"
+      repository: "projecthami/hami"
+      tag: ""
+      ## Specify a imagePullPolicy
+      ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+      ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+      ##
+      pullPolicy: IfNotPresent
+      ## Optionally specify an array of imagePullSecrets.
+      ## Secrets must be manually created in the namespace.
+      ## Example:
+      ## pullSecrets:
+      ##   - myRegistryKeySecretName
+      ##
+      pullSecrets: []
+    ctrPath: /usr/local/vgpu/containers
+    resyncInterval: "5m"
+    extraArgs:
+      - -v=4
+    extraEnvs: {}
+    resources: {}
+      # If you do want to specify resources, uncomment the following lines, adjust them as necessary.
+      # and remove the curly braces after 'resources:'.
+#      limits:
+#        cpu: 1000m
+#        memory: 1000Mi
+#      requests:
+#        cpu: 100m
+#        memory: 100Mi
+
+  deviceSplitCount: 10
+  deviceMemoryScaling: 1
+  deviceCoreScaling: 1
+  # Node configuration for device plugin, Priority: externalConfigName > config > default config
+  nodeConfiguration:
+    # If you want to use a custom config.json, you can set the content here.
+    # If this is set, it will override the default config.json(An example is as follows).
+    config: |
+      {
+        "nodeconfig": [
+          {
+            "name": "your-node-name",
+            "operatingmode": "hami-core",
+            "devicememoryscaling": 1,
+            "devicesplitcount": 10,
+            "migstrategy": "none",
+            "filterdevices": {
+              "uuid": [],
+              "index": []
+            }
+          }
+        ]
+      }
+    # If you want to use an existing ConfigMap, you can set the name here.
+    # If this is set, the chart will not create the ConfigMap and will use the existing one.
+    externalConfigName: ""
+  # The runtime class name to be used by the device plugin, and added to the pod.spec.runtimeClassName of applications utilizing NVIDIA GPUs
+  runtimeClassName: ""
+  # Whether to create runtime class, name comes from runtimeClassName when it is set
+  createRuntimeClass: false
+  migStrategy: "none"
+  disablecorelimit: "false"
+  passDeviceSpecsEnabled: false
+  deviceListStrategy: "envvar"
+  nvidiaHookPath: null
+  nvidiaDriverRoot: null
+  gdrcopyEnabled: null
+  gdsEnabled: null
+  mofedEnabled: null
+
+  extraArgs:
+    - -v=4
+  extraEnvs: {}
+  service:
+    type: NodePort  # Default type is NodePort, can be changed to ClusterIP
+    httpPort: 31992
+    labels: {}
+    annotations: {}
+
+  pluginPath: /var/lib/kubelet/device-plugins
+  libPath: /usr/local/vgpu
+
+  podAnnotations: {}
+  nvidiaNodeSelector:
+    gpu: "on"
+  tolerations: []
+  # The updateStrategy for DevicePlugin DaemonSet.
+  # If you want to update the DaemonSet by manual, set type as "OnDelete".
+  # We recommend use OnDelete update strategy because DevicePlugin pod restart will cause business pod restart, this behavior is destructive.
+  # Otherwise, you can use RollingUpdate update strategy to rolling update DevicePlugin pod.
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+
+  resources: {}
+    # If you do want to specify resources, uncomment the following lines, adjust them as necessary.
+    # and remove the curly braces after 'resources:'.
+#    limits:
+#       cpu: 1000m
+#       memory: 1000Mi
+#    requests:
+#      cpu: 100m
+#      memory: 100Mi
+
+mockDevicePlugin:
+  enabled: false
+  image:
+    registry: "docker.io"
+    repository: "projecthami/mock-device-plugin"
+    tag: "1.0.1"
+    ## Specify a imagePullPolicy
+    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+    ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+    ##
+    pullPolicy: IfNotPresent
+    ## Optionally specify an array of imagePullSecrets.
+    ## Secrets must be manually created in the namespace.
+    ## Example:
+    ## pullSecrets:
+    ##   - myRegistryKeySecretName
+    ##
+    pullSecrets: []
+# If this option is enabled, the DRA will be installed and the scheduler extender will not be installed.
+dra:
+  enabled: false
+
+# Configuration for the hami-dra subchart, which includes DRA drivers.
+# This is part of config for DRA, please refer to the DRA documentation for more details.
+hami-dra:
+  monitor:
+    enabled: true
+  drivers:
+    nvidia:
+      enabled: true
+      # If you are using gpu driver on host, you need to set this to false
+      containerDriver: true
+      image:
+        repository: projecthami/k8s-dra-driver
+        tag: "v0.0.1-dev"
+
+devices:
+  amd:
+    customresources:
+      - amd.com/gpu
+      - amd.com/gpu-memory
+  awsneuron:
+    customresources:
+      - aws.amazon.com/neuron
+      - aws.amazon.com/neuroncore
+  kunlun:
+    enabled: true
+    customresources:
+      - kunlunxin.com/xpu
+      - kunlunxin.com/vxpu
+      - kunlunxin.com/vxpu-memory
+  enflame:
+    enabled: true
+    customresources:
+      - enflame.com/vgcu
+      - enflame.com/vgcu-percentage
+      - enflame.com/gcu
+  mthreads:
+    enabled: true
+    customresources:
+      - mthreads.com/vgpu
+  nvidia:
+    gpuCorePolicy: default
+    libCudaLogLevel: 1
+  ascend:
+    enabled: false
+    image: ""
+    imagePullPolicy: IfNotPresent
+    extraArgs: []
+    nodeSelector:
+      ascend: "on"
+    tolerations: []
+    customresources:
+      - huawei.com/Ascend910A
+      - huawei.com/Ascend910A-memory
+      - huawei.com/Ascend910B2
+      - huawei.com/Ascend910B2-memory
+      - huawei.com/Ascend910B3
+      - huawei.com/Ascend910B3-memory
+      - huawei.com/Ascend910B4
+      - huawei.com/Ascend910B4-memory
+      - huawei.com/Ascend910B4-1
+      - huawei.com/Ascend910B4-1-memory
+      - huawei.com/Ascend310P
+      - huawei.com/Ascend310P-memory
+  iluvatar:
+    enabled: false
+    customresources:
+      - iluvatar.ai/BI-V100-vgpu
+      - iluvatar.ai/BI-V100.vCore
+      - iluvatar.ai/BI-V100.vMem
+      - iluvatar.ai/BI-V150-vgpu
+      - iluvatar.ai/BI-V150.vCore
+      - iluvatar.ai/BI-V150.vMem
+      - iluvatar.ai/MR-V100-vgpu
+      - iluvatar.ai/MR-V100.vCore
+      - iluvatar.ai/MR-V100.vMem
+      - iluvatar.ai/MR-V50-vgpu
+      - iluvatar.ai/MR-V50.vCore
+      - iluvatar.ai/MR-V50.vMem
diff --git a/packages/system/hami/values.yaml b/packages/system/hami/values.yaml
new file mode 100644
index 00000000..1155e2cb
--- /dev/null
+++ b/packages/system/hami/values.yaml
@@ -0,0 +1,8 @@
+hami:
+  devicePlugin:
+    runtimeClassName: nvidia
+    nodeConfiguration:
+      config: |
+        {
+          "nodeconfig": []
+        }

From a3e2fbd742d0c9f8bf6a255836913f080f42b826 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Wed, 22 Apr 2026 13:25:23 +0300
Subject: [PATCH 570/666] feat(kubernetes): integrate HAMi as optional addon

Add HAMi HelmRelease to the kubernetes app as a toggleable addon.
When enabled, GPU Operator's built-in device plugin is automatically
disabled via a values merge to avoid conflicts with HAMi's own
device plugin.

The HelmRelease fails fast if GPU Operator is not enabled, since HAMi
depends on it for driver management and container toolkit.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../templates/helmreleases/gpu-operator.yaml  | 13 ++++-
 .../templates/helmreleases/hami.yaml          | 49 +++++++++++++++++++
 packages/apps/kubernetes/values.schema.json   | 23 +++++++++
 packages/apps/kubernetes/values.yaml          |  8 +++
 4 files changed, 92 insertions(+), 1 deletion(-)
 create mode 100644 packages/apps/kubernetes/templates/helmreleases/hami.yaml

diff --git a/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml b/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml
index 5ef48912..995aa430 100644
--- a/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml
@@ -1,3 +1,11 @@
+{{- define "cozystack.defaultGpuOperatorValues" -}}
+{{- if and (hasKey .Values.addons "hami") .Values.addons.hami.enabled }}
+gpu-operator:
+  devicePlugin:
+    enabled: false
+{{- end }}
+{{- end }}
+
 {{- if .Values.addons.gpuOperator.enabled }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
@@ -29,7 +37,10 @@ spec:
     force: true
     remediation:
       retries: -1
-  {{- with .Values.addons.gpuOperator.valuesOverride }}
+  {{- $defaults := fromYaml (include "cozystack.defaultGpuOperatorValues" .) }}
+  {{- $overrides := deepCopy (default (dict) .Values.addons.gpuOperator.valuesOverride) }}
+  {{- $merged := mergeOverwrite (default (dict) $defaults) $overrides }}
+  {{- with $merged }}
   values:
     {{- toYaml . | nindent 4 }}
   {{- end }}
diff --git a/packages/apps/kubernetes/templates/helmreleases/hami.yaml b/packages/apps/kubernetes/templates/helmreleases/hami.yaml
new file mode 100644
index 00000000..1f7a5358
--- /dev/null
+++ b/packages/apps/kubernetes/templates/helmreleases/hami.yaml
@@ -0,0 +1,49 @@
+{{- if .Values.addons.hami.enabled }}
+{{- if not .Values.addons.gpuOperator.enabled }}
+{{- fail "addons.hami requires addons.gpuOperator to be enabled" }}
+{{- end }}
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: {{ .Release.Name }}-hami
+  labels:
+    cozystack.io/repository: system
+    cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
+spec:
+  releaseName: hami
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-hami
+    namespace: cozy-system
+  kubeConfig:
+    secretRef:
+      name: {{ .Release.Name }}-admin-kubeconfig
+      key: super-admin.svc
+  targetNamespace: cozy-hami
+  storageNamespace: cozy-hami
+  interval: 5m
+  timeout: 10m
+  install:
+    createNamespace: true
+    remediation:
+      retries: -1
+  upgrade:
+    force: true
+    remediation:
+      retries: -1
+  {{- with .Values.addons.hami.valuesOverride }}
+  values:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+
+  dependsOn:
+  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
+  - name: {{ .Release.Name }}
+    namespace: {{ .Release.Namespace }}
+  {{- end }}
+  - name: {{ .Release.Name }}-cilium
+    namespace: {{ .Release.Namespace }}
+  - name: {{ .Release.Name }}-gpu-operator
+    namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/packages/apps/kubernetes/values.schema.json b/packages/apps/kubernetes/values.schema.json
index 1beeff9c..3d7a17dd 100644
--- a/packages/apps/kubernetes/values.schema.json
+++ b/packages/apps/kubernetes/values.schema.json
@@ -149,6 +149,7 @@
         "fluxcd",
         "gatewayAPI",
         "gpuOperator",
+        "hami",
         "ingressNginx",
         "monitoringAgents",
         "velero",
@@ -268,6 +269,28 @@
             }
           }
         },
+        "hami": {
+          "description": "HAMi GPU virtualization middleware. Enables fractional GPU sharing (memory and compute isolation) for workloads. Requires GPU Operator. Note: workload containers must use glibc < 2.34 (not musl/Alpine) for full compute isolation.",
+          "type": "object",
+          "default": {},
+          "required": [
+            "enabled",
+            "valuesOverride"
+          ],
+          "properties": {
+            "enabled": {
+              "description": "Enable HAMi.",
+              "type": "boolean",
+              "default": false
+            },
+            "valuesOverride": {
+              "description": "Custom Helm values overrides.",
+              "type": "object",
+              "default": {},
+              "x-kubernetes-preserve-unknown-fields": true
+            }
+          }
+        },
         "ingressNginx": {
           "description": "Ingress-NGINX controller.",
           "type": "object",
diff --git a/packages/apps/kubernetes/values.yaml b/packages/apps/kubernetes/values.yaml
index a67b5d69..f601b979 100644
--- a/packages/apps/kubernetes/values.yaml
+++ b/packages/apps/kubernetes/values.yaml
@@ -94,6 +94,10 @@ host: ""
 ## @field {bool} enabled - Enable FluxCD.
 ## @field {object} valuesOverride - Custom Helm values overrides.
 
+## @typedef {struct} HAMiAddon - HAMi GPU virtualization middleware.
+## @field {bool} enabled - Enable HAMi (requires GPU Operator).
+## @field {object} valuesOverride - Custom Helm values overrides.
+
 ## @typedef {struct} MonitoringAgentsAddon - Monitoring agents (Fluent Bit, VMAgents).
 ## @field {bool} enabled - Enable monitoring agents.
 ## @field {object} valuesOverride - Custom Helm values overrides.
@@ -114,6 +118,7 @@ host: ""
 ## @field {GatewayAPIAddon} gatewayAPI - Gateway API addon.
 ## @field {IngressNginxAddon} ingressNginx - Ingress-NGINX controller.
 ## @field {GPUOperatorAddon} gpuOperator - NVIDIA GPU Operator.
+## @field {HAMiAddon} hami - HAMi GPU virtualization middleware.
 ## @field {FluxCDAddon} fluxcd - FluxCD GitOps operator.
 ## @field {MonitoringAgentsAddon} monitoringAgents - Monitoring agents.
 ## @field {VerticalPodAutoscalerAddon} verticalPodAutoscaler - Vertical Pod Autoscaler.
@@ -137,6 +142,9 @@ addons:
   gpuOperator:
     enabled: false
     valuesOverride: {}
+  hami:
+    enabled: false
+    valuesOverride: {}
   fluxcd:
     enabled: false
     valuesOverride: {}

From 273eb7811a36fb69141d80360705f081a3276194 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Wed, 22 Apr 2026 13:25:29 +0300
Subject: [PATCH 571/666] docs(hami): document glibc < 2.34 limitation and
 upstream issues

HAMi-core relies on _dl_sym (private glibc symbol removed in 2.34)
for CUDA interception. This breaks compute isolation on modern
container images using Ubuntu 22.04+ and makes Alpine/musl completely
incompatible.

Include upstream issue references and a compatibility matrix so users
can make informed decisions about base image selection.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/system/hami/README.md | 81 ++++++++++++++++++++++++++++++++++
 1 file changed, 81 insertions(+)
 create mode 100644 packages/system/hami/README.md

diff --git a/packages/system/hami/README.md b/packages/system/hami/README.md
new file mode 100644
index 00000000..283f9e80
--- /dev/null
+++ b/packages/system/hami/README.md
@@ -0,0 +1,81 @@
+# HAMi — GPU Virtualization Middleware
+
+[HAMi](https://github.com/Project-HAMi/HAMi) (Heterogeneous AI Computing Virtualization Middleware) is a CNCF Sandbox project that enables fractional GPU sharing in Kubernetes. It allows workloads to request specific amounts of GPU memory and compute cores instead of claiming entire GPUs.
+
+## Architecture
+
+HAMi consists of four components:
+
+- **MutatingWebhook** — intercepts pod creation, injects `schedulerName: hami-scheduler`
+- **Scheduler Extender** — extends kube-scheduler with GPU-aware Filter and Bind logic
+- **Device Plugin** (DaemonSet) — registers vGPU resources via the Kubernetes Device Plugin API
+- **HAMi-core** (`libvgpu.so`) — `LD_PRELOAD` library injected into workload containers, intercepts CUDA API calls to enforce memory and compute isolation
+
+## Prerequisites
+
+- GPU Operator must be enabled (`addons.gpuOperator.enabled: true`)
+- NVIDIA driver >= 440 on host nodes
+- nvidia-container-toolkit configured as the default container runtime
+- GPU nodes labeled with `gpu=on`
+
+## Known Limitations
+
+### glibc < 2.34 requirement for workload containers
+
+HAMi-core uses `LD_PRELOAD` to intercept `dlsym()` for CUDA symbol resolution. The fallback code path relies on `_dl_sym`, a private glibc internal symbol that was removed in glibc 2.34 when libdl and libpthread were merged into libc.so.
+
+**This limitation affects workload containers only**, not the host OS or HAMi's own components.
+
+| Distribution    | glibc | Result                                       |
+| --------------- | ----- | -------------------------------------------- |
+| Ubuntu 18.04    | 2.27  | Full isolation (memory + compute)            |
+| Ubuntu 20.04    | 2.31  | Full isolation (memory + compute)            |
+| Ubuntu 22.04    | 2.35  | Memory isolation works, compute breaks       |
+| Ubuntu 24.04    | 2.39  | Both memory and compute isolation break      |
+| Alpine (musl)   | N/A   | Completely incompatible (`dlvsym` absent)    |
+
+Most modern ML/AI base images (CUDA 12.x, PyTorch 2.x, TensorFlow 2.x) use Ubuntu 22.04+ with glibc >= 2.35, which means compute isolation will not work with these images until the upstream fix is merged.
+
+**Upstream tracking issues:**
+
+- [HAMi-core#174](https://github.com/Project-HAMi/HAMi-core/issues/174) — `_dl_sym` removal breaks HAMi-core on glibc >= 2.34
+- [HAMi#1190](https://github.com/Project-HAMi/HAMi/issues/1190) — degraded isolation across glibc versions
+- [HAMi#173](https://github.com/Project-HAMi/HAMi/issues/173) — documentation incorrectly states glibc < 2.30 (actual boundary is 2.34)
+
+### musl libc (Alpine) incompatibility
+
+HAMi-core is completely incompatible with musl libc. The `dlvsym()` function used by HAMi-core is a glibc extension not available in musl. Only glibc-based container images (Debian, Ubuntu, RHEL, etc.) can use HAMi GPU isolation.
+
+## Usage
+
+Enable HAMi in your tenant Kubernetes cluster values:
+
+```yaml
+addons:
+  gpuOperator:
+    enabled: true
+  hami:
+    enabled: true
+```
+
+When HAMi is enabled, GPU Operator's built-in device plugin is automatically disabled to avoid conflicts.
+
+### Requesting fractional GPU resources
+
+```yaml
+resources:
+  limits:
+    nvidia.com/gpu: 1
+    nvidia.com/gpumem: 3000     # 3000 MB of GPU memory
+    nvidia.com/gpucores: 30     # 30% of GPU compute cores
+```
+
+## Parameters
+
+| Name | Description | Default |
+| --- | --- | --- |
+| `hami.devicePlugin.runtimeClassName` | RuntimeClass for device plugin pods | `nvidia` |
+| `hami.devicePlugin.deviceSplitCount` | Max virtual GPUs per physical GPU | `10` |
+| `hami.devicePlugin.deviceMemoryScaling` | Memory overcommit factor (> 1.0 enables overcommit) | `1` |
+| `hami.scheduler.defaultSchedulerPolicy.nodeSchedulerPolicy` | Node packing strategy (`binpack` or `spread`) | `binpack` |
+| `hami.scheduler.defaultSchedulerPolicy.gpuSchedulerPolicy` | GPU packing strategy (`binpack` or `spread`) | `spread` |

From 43035562efff34f18c3c439026fe2a233dc8d17b Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Wed, 22 Apr 2026 13:25:35 +0300
Subject: [PATCH 572/666] test(kubernetes): add helm-unittest tests for HAMi
 integration

Cover HelmRelease rendering, gpuOperator dependency validation,
ExternalArtifact chartRef, namespace targeting, dependency chain,
valuesOverride passthrough, and automatic devicePlugin disable in
GPU Operator when HAMi is active.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../tests/gpu_operator_hami_test.yaml         |  80 +++++++++++
 packages/apps/kubernetes/tests/hami_test.yaml | 136 ++++++++++++++++++
 2 files changed, 216 insertions(+)
 create mode 100644 packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml
 create mode 100644 packages/apps/kubernetes/tests/hami_test.yaml

diff --git a/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml b/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml
new file mode 100644
index 00000000..33256ae6
--- /dev/null
+++ b/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml
@@ -0,0 +1,80 @@
+suite: GPU Operator HelmRelease HAMi integration tests
+templates:
+  - templates/helmreleases/gpu-operator.yaml
+tests:
+  - it: should disable devicePlugin when hami is enabled
+    set:
+      addons:
+        gpuOperator:
+          enabled: true
+          valuesOverride: {}
+        hami:
+          enabled: true
+          valuesOverride: {}
+    asserts:
+      - equal:
+          path: spec.values.gpu-operator.devicePlugin.enabled
+          value: false
+
+  - it: should not have values when hami is disabled and no overrides
+    set:
+      addons:
+        gpuOperator:
+          enabled: true
+          valuesOverride: {}
+        hami:
+          enabled: false
+          valuesOverride: {}
+    asserts:
+      - notExists:
+          path: spec.values
+
+  - it: should allow user overrides to merge with hami defaults
+    set:
+      addons:
+        gpuOperator:
+          enabled: true
+          valuesOverride:
+            gpu-operator:
+              driver:
+                enabled: false
+        hami:
+          enabled: true
+          valuesOverride: {}
+    asserts:
+      - equal:
+          path: spec.values.gpu-operator.devicePlugin.enabled
+          value: false
+      - equal:
+          path: spec.values.gpu-operator.driver.enabled
+          value: false
+
+  - it: should let user override devicePlugin back to true if needed
+    set:
+      addons:
+        gpuOperator:
+          enabled: true
+          valuesOverride:
+            gpu-operator:
+              devicePlugin:
+                enabled: true
+        hami:
+          enabled: true
+          valuesOverride: {}
+    asserts:
+      - equal:
+          path: spec.values.gpu-operator.devicePlugin.enabled
+          value: true
+
+  - it: should not render when gpuOperator is disabled
+    set:
+      addons:
+        gpuOperator:
+          enabled: false
+          valuesOverride: {}
+        hami:
+          enabled: false
+          valuesOverride: {}
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/packages/apps/kubernetes/tests/hami_test.yaml b/packages/apps/kubernetes/tests/hami_test.yaml
new file mode 100644
index 00000000..e9d32236
--- /dev/null
+++ b/packages/apps/kubernetes/tests/hami_test.yaml
@@ -0,0 +1,136 @@
+suite: HAMi HelmRelease tests
+templates:
+  - templates/helmreleases/hami.yaml
+tests:
+  - it: should not render when hami is disabled
+    set:
+      addons:
+        hami:
+          enabled: false
+          valuesOverride: {}
+        gpuOperator:
+          enabled: true
+          valuesOverride: {}
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should render HelmRelease when hami is enabled
+    set:
+      addons:
+        hami:
+          enabled: true
+          valuesOverride: {}
+        gpuOperator:
+          enabled: true
+          valuesOverride: {}
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: HelmRelease
+
+  - it: should fail when gpuOperator is not enabled
+    set:
+      addons:
+        hami:
+          enabled: true
+          valuesOverride: {}
+        gpuOperator:
+          enabled: false
+          valuesOverride: {}
+    asserts:
+      - failedTemplate:
+          errorMessage: "addons.hami requires addons.gpuOperator to be enabled"
+
+  - it: should have correct metadata labels
+    set:
+      addons:
+        hami:
+          enabled: true
+          valuesOverride: {}
+        gpuOperator:
+          enabled: true
+          valuesOverride: {}
+    asserts:
+      - equal:
+          path: metadata.labels["cozystack.io/repository"]
+          value: system
+      - equal:
+          path: metadata.labels["sharding.fluxcd.io/key"]
+          value: tenants
+
+  - it: should use ExternalArtifact chartRef
+    set:
+      addons:
+        hami:
+          enabled: true
+          valuesOverride: {}
+        gpuOperator:
+          enabled: true
+          valuesOverride: {}
+    asserts:
+      - equal:
+          path: spec.chartRef.kind
+          value: ExternalArtifact
+      - equal:
+          path: spec.chartRef.namespace
+          value: cozy-system
+
+  - it: should target cozy-hami namespace
+    set:
+      addons:
+        hami:
+          enabled: true
+          valuesOverride: {}
+        gpuOperator:
+          enabled: true
+          valuesOverride: {}
+    asserts:
+      - equal:
+          path: spec.targetNamespace
+          value: cozy-hami
+      - equal:
+          path: spec.storageNamespace
+          value: cozy-hami
+
+  - it: should depend on gpu-operator and cilium
+    release:
+      name: test
+      namespace: test-ns
+    set:
+      addons:
+        hami:
+          enabled: true
+          valuesOverride: {}
+        gpuOperator:
+          enabled: true
+          valuesOverride: {}
+    asserts:
+      - contains:
+          path: spec.dependsOn
+          content:
+            name: test-cilium
+            namespace: test-ns
+      - contains:
+          path: spec.dependsOn
+          content:
+            name: test-gpu-operator
+            namespace: test-ns
+
+  - it: should pass through valuesOverride
+    set:
+      addons:
+        hami:
+          enabled: true
+          valuesOverride:
+            hami:
+              devicePlugin:
+                deviceSplitCount: 5
+        gpuOperator:
+          enabled: true
+          valuesOverride: {}
+    asserts:
+      - equal:
+          path: spec.values.hami.devicePlugin.deviceSplitCount
+          value: 5

From 1eeeb2652aaaf6f92e655f010fb3655e865f6abc Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Wed, 22 Apr 2026 15:51:08 +0500
Subject: [PATCH 573/666] docs: add changelog for v1.3.0

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 docs/changelogs/v1.3.0.md | 242 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 242 insertions(+)
 create mode 100644 docs/changelogs/v1.3.0.md

diff --git a/docs/changelogs/v1.3.0.md b/docs/changelogs/v1.3.0.md
new file mode 100644
index 00000000..af7bb30e
--- /dev/null
+++ b/docs/changelogs/v1.3.0.md
@@ -0,0 +1,242 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.3.0
+-->
+
+# Cozystack v1.3.0
+
+Cozystack v1.3.0 brings **storage-aware pod scheduling** via a LINSTOR scheduler extender, a managed **LINSTOR GUI** web console with Keycloak SSO, a curated **VM Default Images** catalog for out-of-the-box virtual-machine provisioning, a new **WorkloadsReady / Events** observability surface with S3 bucket metering, and **cross-namespace VMInstance backup restore** with a full **RestoreJob dashboard** flow. The release also ships stricter tenant-name validation, VMInstance network-selector improvements, Keycloak theme injection and SMTP configuration, a host-runtime preflight check, and rolls up every fix from the v1.2.1 → v1.2.4 patch line.
+
+> **Note:** Items marked *(backported to v1.2.x)* were also shipped in v1.2.1, v1.2.2, v1.2.3, or v1.2.4 patch releases.
+
+## Feature Highlights
+
+### Storage-Aware Scheduling via the LINSTOR Extender
+
+The `cozystack-scheduler` now calls a **LINSTOR scheduler extender** for storage-locality-aware pod placement. When a pod declares both a `SchedulingClass` and LINSTOR-backed PVCs, the scheduler consults LINSTOR to prefer nodes where volume replicas already exist — reducing cross-node replication traffic and improving I/O latency for storage-heavy workloads such as databases, object stores, and VMs.
+
+The integration builds on the existing `SchedulingClass` tenant workload placement system introduced in v1.2.0 and requires no tenant-side configuration — workloads simply benefit once a SchedulingClass is assigned. Administrators can mix storage locality with the existing data-center / hardware-generation constraints defined on SchedulingClass CRs ([**@lllamnyp**](https://github.com/lllamnyp) in #2330).
+
+### LINSTOR GUI: Managed Web Console for Storage Administration
+
+A new opt-in `linstor-gui` system package deploys **LINBIT's linstor-gui web UI** alongside the LINSTOR controller with mTLS client authentication, non-root security context, and a ClusterIP-only service by default. When OIDC is configured on the platform, an optional **Keycloak-protected Ingress** (via oauth2-proxy) exposes the UI for browser access. Access is restricted to members of the `cozystack-cluster-admin` Keycloak group, consistent with host-cluster admin RBAC, and the gatekeeper blocks in-app LINSTOR authentication setup at the nginx proxy layer so the managed configuration cannot be subverted through the UI.
+
+Operators who prefer CLI access keep the existing `linstor` command; the GUI is strictly additive and stays disabled by default ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2382, #2390, #2415, #2419).
+
+### VM Default Images: Out-of-the-Box VM Provisioning
+
+The new `vm-default-images` package provides a curated set of **cluster-wide virtual-machine images** (Ubuntu, Debian, CentOS Stream, and others) as pre-populated DataVolumes, so tenants can provision VMs against well-known base images without first having to upload them. The package is opt-in via the `iaas` bundle and defaults to replicated storage for high availability. Migration 38 renames legacy `vm-image-*` DataVolumes to the new `vm-default-images-*` naming scheme, and the `vm-disk` chart gains a new "disk" source type for cloning from existing vm-disks in the same namespace ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2258).
+
+### Application Observability: WorkloadsReady, Events, and S3 Bucket Metering
+
+Applications now expose a **WorkloadsReady** condition on their status by querying associated WorkloadMonitor resources, giving operators a single place to check whether all underlying workloads (Deployments, StatefulSets, DaemonSets, PVCs) are healthy. The dashboard gains a new **Events tab** showing namespace-scoped Kubernetes events per application, with fallback to `.firstTimestamp` when `.eventTime` is absent. A long-standing bug where WorkloadMonitor's `Operational` status was never persisted is fixed in the same change ([**@lexfrei**](https://github.com/lexfrei) in #2356).
+
+The WorkloadMonitor reconciler is extended to track **COSI BucketClaim** objects as first-class Workloads, and the bucket controller now queries SeaweedFS logical and physical bucket-size metrics from VictoriaMetrics via a namespace-scoped monitoring endpoint, enabling S3 billing integration on par with Pods and PVCs ([**@kitsunoff**](https://github.com/kitsunoff) in #2391). Workloads are also enriched with `workloads.cozystack.io/resource-preset` and source-object labels so downstream billing pipelines can correlate monitors with the tenant preset that produced them ([**@androndo**](https://github.com/androndo) in #2416).
+
+### Cross-Namespace VM Backup Restore and RestoreJob Dashboard
+
+The backup system now supports **restoring VMInstance backups into a different namespace** (cross-namespace copy restores) with IP/MAC preservation and safe rename semantics. In-place backup and restore flows for VMDisk and VMInstance are improved: HelmReleases and DataVolumes are properly handled, and Velero failure messages are propagated to the Application status. The backup status structure has been refactored to store underlying resources as a generic opaque JSON object, enabling arbitrary application-specific metadata without status-schema churn ([**@androndo**](https://github.com/androndo) in #2251, #2319, #2329).
+
+The dashboard now ships a complete **RestoreJob experience**: list view, details page, create form, and sidebar entry, with a "Same as backup" fallback rendering when `spec.targetApplicationRef` is omitted. Non-CRD-backed sidebar factories (`kube-*`, `plan`, `backupjob`, `backup`, `restorejob`) are marked static so they pick up consistent managed-by labels across reconciles ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2437).
+
+## Major Features and Improvements
+
+* **[api] Reject tenant names with dashes at Create time**: Enforces alphanumeric-only naming for Tenants at the API level, preventing names with hyphens that would silently fail during Helm reconciliation. A corresponding regex tightening and regression test suite hardens the validation ([**@lexfrei**](https://github.com/lexfrei) in #2380).
+
+* **[platform] Validate computed tenant namespace length**: Rejects Tenant creation when the computed ancestor-chain namespace would exceed the 63-character Kubernetes namespace limit, preventing opaque HelmRelease reconcile errors downstream ([**@lexfrei**](https://github.com/lexfrei) in #2376).
+
+* **[vm-instance] Rename subnets to networks and add dropdown selector**: Renames the misleading `subnets` field to `networks` in VMInstance for clarity, adds a dropdown selector for available networks in the dashboard form, and includes migration 36 to copy existing `subnets` values. The old field remains supported for backward compatibility ([**@sircthulhu**](https://github.com/sircthulhu) in #2263).
+
+* **[keycloak] Enable injecting themes**: Cozystack administrators can now inject custom Keycloak themes via `initContainers` for UI white-labeling and customization ([**@lllamnyp**](https://github.com/lllamnyp) in #2142).
+
+* **[keycloak-configure] Add email verification and SMTP configuration**: Adds configurable Keycloak settings for user self-registration, email verification, and SMTP server configuration, enabling automated user onboarding flows ([**@BROngineer**](https://github.com/BROngineer) in #2318).
+
+* **[postgres] Hardcode PostgreSQL 17 for monitoring databases**: Pins PostgreSQL 17.7 images for system databases (Grafana, Alerta, Harbor, Keycloak, SeaweedFS) and adds migration 37 to backfill `spec.version=v17` for existing PostgreSQL resources, preventing CNPG from defaulting to PostgreSQL 18 *(backported to v1.2.1)* ([**@IvanHunters**](https://github.com/IvanHunters) in #2304).
+
+* **[platform] Prevent installed packages deletion**: Adds the `helm.sh/resource-policy: keep` annotation to platform packages so disabling a package no longer triggers automatic Helm deletion, restoring the documented behavior where operators must explicitly delete a package *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2273).
+
+* **[mariadb] Always enable replication for consistent service naming**: MariaDB now always enables replication, creating `-primary`/`-secondary` services even for single-replica instances. This fixes dashboard visibility and backup functionality for single-replica setups ([**@sircthulhu**](https://github.com/sircthulhu) in #2279).
+
+* **[hack] Add host runtime preflight check**: New `check-host-runtime.sh` script and `make preflight` target that warns operators when a standalone containerd or docker runtime is running alongside the embedded k3s runtime, helping diagnose container-runtime conflicts early in an installation ([**@lexfrei**](https://github.com/lexfrei) in #2371).
+
+* **[hack] Add check-readiness.sh diagnostic script**: A new diagnostic script for tracking platform reconciliation by checking readiness of Packages, ArtifactGenerators, ExternalArtifacts, and HelmReleases, with support for watch mode and continuous monitoring ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2294).
+
+* **[platform] Add resourcePreset labels to WorkloadMonitor labels**: WorkloadMonitor labels with the `workloads.cozystack.io/` prefix are now propagated onto created Workloads; created Workloads always include the reserved `workloads.cozystack.io/monitor` label, and Helm app charts add `workloads.cozystack.io/resource-preset` metadata to WorkloadMonitor manifests, enabling downstream billing pipelines to correlate monitors with the tenant preset that produced them ([**@androndo**](https://github.com/androndo) in #2416).
+
+## Bug Fixes
+
+* **[platform] Migrate ACME HTTP-01 to ingressClassName API**: Switches ACME HTTP-01 issuance from the deprecated `acme.cert-manager.io/http01-ingress-class` annotation to the modern `ingressClassName` field on `ClusterIssuer` and solver pods. Previously, ClusterIssuers referenced a non-existent `nginx` class while each Ingress individually overrode it via annotation — producing `ingressClassName and class cannot be set at the same time` errors when tenants attempted to migrate to the modern field. The migration is atomic: both the ClusterIssuer and consuming Ingresses are updated together *(backported to v1.2.4)* ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2436).
+
+* **[harbor] Remove incorrect tenant module flags**: Harbor is a PaaS service, not a tenant module. Incorrect `spec.dashboard.module: true` and `internal.cozystack.io/tenantmodule` flags caused Harbor to appear in the sidebar "Modules" section and be misclassified by controllers handling tenant modules. The flags are now removed so Harbor is displayed in its proper PaaS category and is no longer treated as a tenant-scoped HelmRelease ([**@kvaps**](https://github.com/kvaps) in #2444).
+
+* **[kube-ovn] Resolve kubeovn-plunger RBAC forbidden on deployments**: Grants `kube-ovn-plunger` the RBAC needed to list Deployments so it can reconcile `ovn-central`, fixing `deployments.apps is forbidden` errors in `cozy-kubeovn` ([**@kvaps**](https://github.com/kvaps) in #2441).
+
+* **[cilium] Opt-out of cri-containerd.apparmor.d for nsenter init containers**: Opts cilium-agent init containers out of the `cri-containerd.apparmor.d` AppArmor profile on non-Talos variants (`cilium-generic`, `kubeovn-cilium-generic`), fixing `Init:CrashLoopBackOff` on Ubuntu 22.04+ and Debian where the profile denies `nsenter` namespace entry. Talos variants are untouched as Talos does not load the AppArmor LSM *(backported to v1.2.2)* ([**@lexfrei**](https://github.com/lexfrei) in #2370).
+
+* **[virtual-machine] Exclude external VM services from Cilium BPF LB**: Adds the `service.kubernetes.io/service-proxy-name: cozy-proxy` label to VM LoadBalancer services with `external: true`, telling Cilium to skip BPF processing entirely. Fixes inter-tenant connectivity via public LB IPs (Cilium's DNAT caused cross-tenant pod-to-pod flow classification, triggering CiliumClusterwideNetworkPolicy blocks) and restores WholeIP behavior on Cilium 1.19+ where wildcard service drop entries previously blocked traffic to LB IPs on undeclared ports *(backported to v1.2.2)* ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2357).
+
+* **[monitoring] Fix infra dashboards missing in default variant**: Includes the `cozy-monitoring` namespace in the dashboard rendering condition, fixing infrastructure Grafana dashboards not rendering in the default platform variant (only the `tenant-root` namespace was previously checked) *(backported to v1.2.2)* ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2365).
+
+* **[postgres] Fix system PostgreSQL images to 17.7-standard-trixie**: Normalizes system PostgreSQL image tags to the `17.7-standard-trixie` variant with migration logic for existing CNPG clusters, ensuring system databases use the correct image variant consistent with the monitoring stack requirements introduced in v1.2.1 *(backported to v1.2.2)* ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2364).
+
+* **[build] Filter git describe to match only v* tags**: Adds `--match 'v*'` to all `git describe` calls in `hack/common-envs.mk`, preventing the `api/apps/v1alpha1/vX.Y.Z` subtag from being picked up instead of the release tag and producing invalid Docker image tags *(backported to v1.2.2)* ([**@kvaps**](https://github.com/kvaps) in #2386).
+
+* **[platform] Fix resource allocation ratios not propagated to packages**: Restores propagation of `cpuAllocationRatio`, `memoryAllocationRatio`, and `ephemeralStorageAllocationRatio` from `platform/values.yaml` to the `cozystack-values` Secret that managed applications and KubeVirt read, fixing a regression introduced in the bundle restructure that silently ignored operator-configured ratios *(backported to v1.2.1)* ([**@sircthulhu**](https://github.com/sircthulhu) in #2296).
+
+* **[kubernetes] Set explicit ephemeral-storage on virt-launcher pods**: Sets explicit `domain.resources` ephemeral-storage on the VirtualMachine spec to prevent virt-launcher pods from being evicted because LimitRange defaults were too small for the actual emptyDisk capacity *(backported to v1.2.3)* ([**@kvaps**](https://github.com/kvaps) in #2317).
+
+* **[multus] Pin master CNI to 05-cilium.conflist**: Prevents a boot-time race where multus could auto-detect kube-ovn's conflist instead of Cilium's, which would cause pods to bypass the Cilium chain entirely and lose their endpoint *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2315).
+
+* **[multus] Build custom image with DEL cache fix**: Fixes sandbox cleanup deadlock when CNI ADD never completes, preventing stale sandbox name reservations from permanently blocking pod creation after a node disruption *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2313).
+
+* **[linstor] Set verify-alg to crc32c**: Prevents DRBD connection failures on kernels where `crct10dif` is unavailable (e.g., Talos v1.12.6 with kernel 6.18.18) by setting the LINSTOR verify-alg controller default to `crc32c` *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2303).
+
+* **[linstor] Preserve TCP ports during toggle-disk operations**: Saves existing TCP ports into the `LayerPayload` before `removeLayerData()` deletes them, preventing DRBD resources from entering StandAlone state when a satellite misses the resulting update *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2292).
+
+* **[linstor] Increase satellite startup probe failure threshold**: Raises the LINSTOR satellite `startupProbe` `failureThreshold` from 3 to 30 (30s → 300s) in the `LinstorSatelliteConfiguration` pod template, giving satellites with slow storage initialization enough time to come up without being killed and restarted ([**@Arsolitt**](https://github.com/Arsolitt) in #2425).
+
+## Security
+
+* **docs: add SECURITY.md**: Adds vulnerability reporting procedures, disclosure expectations, and supported release lines ([**@kvaps**](https://github.com/kvaps) in #2230).
+
+* **docs: add OpenSSF Best Practices badge to README**: Adds the OpenSSF Best Practices passing badge to the project README ([**@lexfrei**](https://github.com/lexfrei) in #2320).
+
+* **[linstor-gui] Restrict to cozystack-cluster-admin group**: Tightens access control on the `linstor-gui` Ingress so the UI and its underlying LINSTOR controller REST API are reachable only by members of the `cozystack-cluster-admin` Keycloak group. Previously, the oauth2-proxy gatekeeper enforced only realm membership (`--email-domain=*`), allowing any tenant-scoped account to reach the gatekeeper's static mTLS client cert *(backported to release-1.3 via #2419)* ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2415, #2419).
+
+## Dependencies & Version Updates
+
+* **[kube-ovn] Bump kube-ovn to v1.15.10 with port-group regression fix**: Updates `packages/system/kubeovn` to upstream v1.15.10 (from v1.15.3) and carries a patch for `pkg/controller/pod.go` that preserves a VM LSP's port-group memberships when Kubernetes GCs a completed virt-launcher pod while another virt-launcher pod of the same VM is still running. Without the patch, the destination pod of a successful live migration lost its security groups, network policies, and node-scoped routing until `kube-ovn-controller` was restarted ([**@kvaps**](https://github.com/kvaps) in #2443).
+
+* **[monitoring] Upgrade victoria-metrics-operator to v0.68.4**: Bumps the vendored `victoria-metrics-operator` Helm chart from 0.59.1 to 0.61.0 (operator appVersion v0.68.1 → v0.68.4), picking up upstream fixes for `VMPodScrape` port routing on VMAgent/VLAgent and `StatefulSet` pod deletion (not eviction) when `maxUnavailable=100%` ([**@lexfrei**](https://github.com/lexfrei) in #2426).
+
+* **[linstor] Update piraeus-server to v1.33.2 with selected backports**: Bumps LINSTOR server from v1.33.1 to v1.33.2 with backported patches for stale bitmap adjust retry, LUKS2 header sizing, optimal I/O size detection, and the maintainer implementation. All patches verified against upstream v1.33.2 with `git apply --check` and `gradlew compileJava` *(backported to v1.2.2)* ([**@kvaps**](https://github.com/kvaps) in #2331).
+
+* **[kamaji] Update to 26.3.5-edge, drop upstreamed patches**: Updates Kamaji from edge-26.2.4 to 26.3.5-edge and removes two patches accepted upstream. Adds configurable probe tuning and DataStore readiness conditions ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2260).
+
+* **[talm] Release v0.23.0, v0.23.1, v0.24.0** (github.com/cozystack/talm): Migrates to the Talos v1.12 multi-document machine config format ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#116); renders templates online in `apply` to resolve lookups ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/talm#119); bumps dependencies and modernizes the codebase ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#124).
+
+* **[ansible-cozystack] Release v1.2.1, v1.2.2, v1.2.4** (github.com/cozystack/ansible-cozystack): Exposes `publishing.externalIPs` and tenant-root ingress via role variables ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#30); adds a comprehensive node prerequisites audit ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#27); replaces `ansible.utils.ipaddr` with a stdlib-based test plugin ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#24); adds `v` prefix to collection version in requirements.yml examples ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#23); tracks installer releases v1.2.1 through v1.2.4 ([**@app/renovate**](https://github.com/apps/renovate) in cozystack/ansible-cozystack#20, #22, #29, #31, #32).
+
+## Development, Testing, and CI/CD
+
+* **[ci] Replace cozystack-bot PAT with cozystack-ci GitHub App**: Replaces the long-lived `cozystack-bot` personal access token with short-lived, scoped tokens from the `cozystack-ci` GitHub App across all release workflows (`tags.yaml`, `auto-release.yaml`, `pull-requests-release.yaml`), improving security and auditability of CI operations ([**@tym83**](https://github.com/tym83) in #2351; [**@kvaps**](https://github.com/kvaps) in #2383, #2392).
+
+* **[ci] Add Gemini Code Assist and CodeRabbit configuration**: Adds repository-level configuration for AI code reviewers with ignore patterns for vendored/generated code and incremental review settings ([**@lexfrei**](https://github.com/lexfrei) in #2385).
+
+* **[ci] Promote next/ trunk on new minor/major releases**: Updates `update-website-docs` in `tags.yaml` to match the new docs-versioning contract — the website repo replaces the old "pre-create `vX.Y/` draft directory" scheme with a permanent `content/en/docs/next/` trunk, and released version directories are promoted explicitly by the release workflow ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2433).
+
+* **[tests] Fix Kafka E2E test timeout and retry race condition**: Increases Kafka E2E test timeout from 60s to 300s and fixes a retry race where `kubectl apply` could hit a still-deleting resource ([**@lexfrei**](https://github.com/lexfrei) in #2358).
+
+* **docs: adopt Conventional Commits for commit and PR titles**: Standardizes commit and PR title format to `type(scope): description` across all contributing docs and the PR template ([**@lexfrei**](https://github.com/lexfrei) in #2395).
+
+* **docs(ci): require screenshots for UI changes in PR template**: Adds a mandatory screenshots section to the PR template for UI-related changes ([**@kitsunoff**](https://github.com/kitsunoff) in #2407).
+
+* **chore(maintenance): add @myasnikovdaniil to CODEOWNERS**: Adds @myasnikovdaniil to the default owners in `.github/CODEOWNERS` for automatic review requests ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2434).
+
+## Documentation
+
+* **[website] Add ApplicationDefinition naming convention reference**: Documents how `cozystack-api` resolves kinds to their backing definitions ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#478).
+
+* **[website] Document Talos / talosctl / Cozystack version pairing**: Adds a version compatibility matrix for installation ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#484).
+
+* **[website] Document namespace layout and parent/child derivation**: Explains tenant namespace hierarchy and parent/child namespace derivation rules ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#479).
+
+* **[website] Document the checkbox-then-edit-CR customization pattern for tenants**: Describes the workflow for customizing tenant settings via the CR after initial checkbox-based creation ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#485).
+
+* **[website] Add custom Keycloak themes documentation**: Covers the theme image contract, configuration, `imagePullSecrets`, and theme activation in the Keycloak admin console ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#463).
+
+* **[website] Add bonding (LACP) configuration how-to guide**: Covers network bonding configuration for Cozystack installations ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#459).
+
+* **[website] Improve registry mirrors for tenant Kubernetes in air-gapped guide**: Improves documentation for configuring registry mirrors in air-gapped environments ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#461).
+
+* **[website] Rewrite guide for ApplicationDefinition API (external-apps)**: Comprehensive rewrite of the external apps guide using the ApplicationDefinition API with Minecraft server examples ([**@kitsunoff**](https://github.com/kitsunoff) in cozystack/website#488).
+
+* **[website] Add documentation for Go types usage**: Guide for using generated Go types for Cozystack managed applications as a Go module ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#465).
+
+* **[website] Update backup/restore documentation for VMI/VMDisk**: Updates backup documentation with VM instance and VM disk restore improvements ([**@androndo**](https://github.com/androndo) in cozystack/website#466).
+
+* **[website] Refactor docs versions to major.minor variants**: Moves docs to major.minor versioning for the v1.x series ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#477).
+
+* **[website] Trunk-based versioning with permanent next/ directory**: Replaces the old "pre-create `vX.Y/` draft directory" scheme with a permanent `content/en/docs/next/` trunk; released version directories are promoted explicitly by `hack/release_next.sh` on new minor/major releases, and routing between `next/` and `vX.Y/` is Makefile-driven ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#495).
+
+* **[website] Add updated OpenAPI spec**: Updates the OpenAPI specification for managed applications reference ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#469).
+
+* **[website] Add OpenAPI spec download to GitHub Pages build**: Fixes the GitHub Pages build to include the OpenAPI spec download ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#494).
+
+* **[website] Add OSS Health pages and OpenSSF badge**: Adds OSS Health section with OpenSSF Scorecard and Best Practices badges to the website ([**@tym83**](https://github.com/tym83) in cozystack/website#470).
+
+* **[website] Add Telemetry page under OSS Health section**: Adds the Telemetry page with initial data seeding to the OSS Health docs ([**@tym83**](https://github.com/tym83) in cozystack/website#471, cozystack/website#504).
+
+* **[website] Blog: OSS Health section launch announcement**: Publishes the announcement blog post for the OSS Health section ([**@tym83**](https://github.com/tym83) in cozystack/website#474).
+
+* **[website] Fix OpenSSF canonical status URL**: Changes the OpenSSF canonical status URL from pt-BR to en ([**@tym83**](https://github.com/tym83) in cozystack/website#475).
+
+* **[website] Add CozySummit Virtual 2026 program announcement**: Publishes the CozySummit Virtual 2026 program announcement blog post ([**@tym83**](https://github.com/tym83) in cozystack/website#472).
+
+* **[website] Add missing release announcements for v0.1–v0.41**: Backfills missing release announcement blog posts for historical Cozystack versions ([**@tym83**](https://github.com/tym83) in cozystack/website#468).
+
+* **[website] Blog: managed PostgreSQL with synchronous replication**: Adds a post covering the managed PostgreSQL synchronous-replication feature ([**@tym83**](https://github.com/tym83) in cozystack/website#497).
+
+* **[website] Blog taxonomies and client-side filter UI**: Registers article-type and topic taxonomies and adds a client-side filter on the blog list page ([**@tym83**](https://github.com/tym83) in cozystack/website#499).
+
+* **[website] Add images frontmatter for social preview on existing posts**: Adds images frontmatter for social preview on existing blog posts ([**@tym83**](https://github.com/tym83) in cozystack/website#498).
+
+* **[website] Fix broken links and stale anchors across v1 docs**: Fixes 14 broken links and stale talm anchors ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#486).
+
+* **[website] Prefix bundle package names with cozystack. in v1 examples**: Corrects package naming in documentation examples ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#482).
+
+* **[website] Finish isolated-field removal and document opt-in policy labels**: Removes the obsolete `isolated` field from tenant documentation and documents the new opt-in policy labels approach ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#481).
+
+* **[website] Add --take-ownership flag and describe networking.* fields**: Documents the `--take-ownership` flag and `networking.*` fields in the installation guide ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#480).
+
+* **[website] Fix KubeOVN MASTER_NODES example path and key in troubleshooting**: Corrects the MASTER_NODES example path and key ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#483).
+
+* **[website] Add CLAUDE.md for AI agent guidance**: Adds a CLAUDE.md file describing the trunk-based docs architecture for AI agent guidance ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#489).
+
+* **[website] Update /docs/v1/ redirect to latest v1.2**: Updates the `/docs/v1/` redirect target to point to the latest v1.2 docs on GitHub Pages ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#492).
+
+* **[website] Remove nbykov from CODEOWNERS and CLAUDE.md**: Cleans up CODEOWNERS and CLAUDE.md entries ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#491).
+
+* **[website] Add Ahrefs Analytics tracker**: Adds the Ahrefs Analytics tracker to the website ([**@tym83**](https://github.com/tym83) in cozystack/website#503).
+
+* **[website] Add breathing room between navbar and hero on OSS Health**: Minor styling fix for the OSS Health section ([**@tym83**](https://github.com/tym83) in cozystack/website#500).
+
+* **[website] Fix og social badge image and title**: Updates the social badge image and title ([**@tym83**](https://github.com/tym83) in cozystack/website#487).
+
+* **[website] Update managed apps reference for v1.2.1**: Automated managed-apps reference update ([**@cozystack-bot**](https://github.com/cozystack-bot) in cozystack/website#464).
+
+* **[external-apps-example] Replace MongoDB example with Minecraft apps**: Refactors the external apps example to use the ApplicationDefinition API with Minecraft server applications ([**@lexfrei**](https://github.com/lexfrei) in cozystack/external-apps-example#2).
+
+* **docs: update README introductory description**: Refines the platform positioning and improves clarity on core capabilities in the main README ([**@tym83**](https://github.com/tym83) in #2409).
+
+## Governance
+
+* **Add Mattia Eleuteri ([@mattia-eleuteri](https://github.com/mattia-eleuteri)) as Maintainer**: CSI, Storage, Networking & Security ([**@tym83**](https://github.com/tym83) in #2345).
+
+* **Add Matthieu Robin ([@matthieu-robin](https://github.com/matthieu-robin)) as Maintainer**: Managed applications, platform quality, and benchmarking ([**@tym83**](https://github.com/tym83) in #2346).
+
+## Contributors
+
+We'd like to thank all contributors who made this release possible:
+
+* [**@androndo**](https://github.com/androndo)
+* [**@Arsolitt**](https://github.com/Arsolitt)
+* [**@BROngineer**](https://github.com/BROngineer)
+* [**@IvanHunters**](https://github.com/IvanHunters)
+* [**@kitsunoff**](https://github.com/kitsunoff)
+* [**@kvaps**](https://github.com/kvaps)
+* [**@lexfrei**](https://github.com/lexfrei)
+* [**@lllamnyp**](https://github.com/lllamnyp)
+* [**@mattia-eleuteri**](https://github.com/mattia-eleuteri)
+* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
+* [**@sircthulhu**](https://github.com/sircthulhu)
+* [**@tym83**](https://github.com/tym83)
+
+### New Contributors
+
+We're excited to welcome our first-time contributors:
+
+* [**@Arsolitt**](https://github.com/Arsolitt) — First contribution!
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.2.0...v1.3.0

From 44bc79cef115c02e0e586955c29ee184557c52f3 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Thu, 23 Apr 2026 10:17:30 +0500
Subject: [PATCH 574/666] docs(changelog): correct v1.3.0 postgres and
 linstor-gui entries

Post-release cleanup of docs/changelogs/v1.3.0.md so the notes match
what users actually experience in the released v1.3.0:

- Rewrite the postgres major-features entry so author (myasnikovdaniil),
  PR (#2369), and description all match the 17.7-standard-trixie pin +
  migration-37 imageName rewrite that actually shipped. The previous
  entry credited #2304 (superseded spec.version=v17 backfill approach).
- Remove the duplicate #2364 postgres bug-fix entry; the same work is
  now folded into the single major-features entry above, with backport
  references to #2309 (v1.2.1) and #2364 (v1.2.2).
- Remove the [linstor-gui] Restrict to cozystack-cluster-admin group
  security entry. The vulnerable state never shipped in a tagged
  release, so there is nothing user-facing to announce; the restriction
  is already described in the linstor-gui Feature Highlights section
  as part of the feature's day-one behavior.

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 docs/changelogs/v1.3.0.md | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/docs/changelogs/v1.3.0.md b/docs/changelogs/v1.3.0.md
index af7bb30e..60c800a8 100644
--- a/docs/changelogs/v1.3.0.md
+++ b/docs/changelogs/v1.3.0.md
@@ -50,7 +50,7 @@ The dashboard now ships a complete **RestoreJob experience**: list view, details
 
 * **[keycloak-configure] Add email verification and SMTP configuration**: Adds configurable Keycloak settings for user self-registration, email verification, and SMTP server configuration, enabling automated user onboarding flows ([**@BROngineer**](https://github.com/BROngineer) in #2318).
 
-* **[postgres] Hardcode PostgreSQL 17 for monitoring databases**: Pins PostgreSQL 17.7 images for system databases (Grafana, Alerta, Harbor, Keycloak, SeaweedFS) and adds migration 37 to backfill `spec.version=v17` for existing PostgreSQL resources, preventing CNPG from defaulting to PostgreSQL 18 *(backported to v1.2.1)* ([**@IvanHunters**](https://github.com/IvanHunters) in #2304).
+* **[postgres] Pin system PostgreSQL to 17.7-standard-trixie**: Pins the PostgreSQL image for system databases (Grafana, Alerta, Harbor, Keycloak, SeaweedFS) to `17.7-standard-trixie` across chart templates and `values.yaml`, and ships migration 37 to patch existing CNPG Cluster `imageName` fields to the same variant (handling unset, any PG 17 tag, and bare-version tags). This prevents CNPG from defaulting to PostgreSQL 18 and locks system databases to the trixie variant consistent with the monitoring stack requirements *(related backports shipped in v1.2.1 via #2309 and v1.2.2 via #2364)* ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2369).
 
 * **[platform] Prevent installed packages deletion**: Adds the `helm.sh/resource-policy: keep` annotation to platform packages so disabling a package no longer triggers automatic Helm deletion, restoring the documented behavior where operators must explicitly delete a package *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2273).
 
@@ -76,8 +76,6 @@ The dashboard now ships a complete **RestoreJob experience**: list view, details
 
 * **[monitoring] Fix infra dashboards missing in default variant**: Includes the `cozy-monitoring` namespace in the dashboard rendering condition, fixing infrastructure Grafana dashboards not rendering in the default platform variant (only the `tenant-root` namespace was previously checked) *(backported to v1.2.2)* ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2365).
 
-* **[postgres] Fix system PostgreSQL images to 17.7-standard-trixie**: Normalizes system PostgreSQL image tags to the `17.7-standard-trixie` variant with migration logic for existing CNPG clusters, ensuring system databases use the correct image variant consistent with the monitoring stack requirements introduced in v1.2.1 *(backported to v1.2.2)* ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2364).
-
 * **[build] Filter git describe to match only v* tags**: Adds `--match 'v*'` to all `git describe` calls in `hack/common-envs.mk`, preventing the `api/apps/v1alpha1/vX.Y.Z` subtag from being picked up instead of the release tag and producing invalid Docker image tags *(backported to v1.2.2)* ([**@kvaps**](https://github.com/kvaps) in #2386).
 
 * **[platform] Fix resource allocation ratios not propagated to packages**: Restores propagation of `cpuAllocationRatio`, `memoryAllocationRatio`, and `ephemeralStorageAllocationRatio` from `platform/values.yaml` to the `cozystack-values` Secret that managed applications and KubeVirt read, fixing a regression introduced in the bundle restructure that silently ignored operator-configured ratios *(backported to v1.2.1)* ([**@sircthulhu**](https://github.com/sircthulhu) in #2296).
@@ -100,8 +98,6 @@ The dashboard now ships a complete **RestoreJob experience**: list view, details
 
 * **docs: add OpenSSF Best Practices badge to README**: Adds the OpenSSF Best Practices passing badge to the project README ([**@lexfrei**](https://github.com/lexfrei) in #2320).
 
-* **[linstor-gui] Restrict to cozystack-cluster-admin group**: Tightens access control on the `linstor-gui` Ingress so the UI and its underlying LINSTOR controller REST API are reachable only by members of the `cozystack-cluster-admin` Keycloak group. Previously, the oauth2-proxy gatekeeper enforced only realm membership (`--email-domain=*`), allowing any tenant-scoped account to reach the gatekeeper's static mTLS client cert *(backported to release-1.3 via #2419)* ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2415, #2419).
-
 ## Dependencies & Version Updates
 
 * **[kube-ovn] Bump kube-ovn to v1.15.10 with port-group regression fix**: Updates `packages/system/kubeovn` to upstream v1.15.10 (from v1.15.3) and carries a patch for `pkg/controller/pod.go` that preserves a VM LSP's port-group memberships when Kubernetes GCs a completed virt-launcher pod while another virt-launcher pod of the same VM is still running. Without the patch, the destination pod of a successful live migration lost its security groups, network policies, and node-scoped routing until `kube-ovn-controller` was restarted ([**@kvaps**](https://github.com/kvaps) in #2443).

From e1c6f9c0299c36aae80e71ea7ca9da0eef050a58 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Thu, 23 Apr 2026 10:22:09 +0500
Subject: [PATCH 575/666] docs(agents): scope changelog.md to a file-only
 deliverable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The v1.3.0 release pipeline broke because Copilot, invoked by
.github/workflows/tags.yaml with --allow-all-tools, committed the
generated changelog onto HEAD of main on its own. The workflow's
next step — `git checkout -b ... origin/main` — then wiped the file,
and `git add` failed with a pathspec error.

The root cause is in this document. The checklist ends with "Save
the changelog", which an agent with broad tool access can reasonably
interpret as "also commit it, push it, and open a PR". There was no
explicit boundary.

Add a "Scope and boundaries" section at the top and an explicit
"then exit" at the end of Step 9:

- The single deliverable is docs/changelogs/v<version>.md.
- Forbidden by default: git commit / push / checkout (to switch
  branches) / branch / tag / reset / merge / rebase; PR creation;
  GitHub API writes (POST/PATCH/DELETE); modifying any file other
  than the changelog.
- Read-only analysis (git log/show/fetch/diff, gh pr view, gh api
  GET) remains expected.
- Auxiliary repo clones under _repos/ remain allowed for cross-repo
  analysis per Step 6.
- Scoped "unless the caller explicitly instructs otherwise" so
  interactive use with an IDE remains flexible.

With the rules in the doc, CI and interactive callers share the
same boundary; the workflow can invoke the doc with a one-line
prompt instead of re-stating the constraints every time.

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 docs/agents/changelog.md | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/docs/agents/changelog.md b/docs/agents/changelog.md
index 35d59a00..13a674a2 100644
--- a/docs/agents/changelog.md
+++ b/docs/agents/changelog.md
@@ -6,6 +6,20 @@ This file contains detailed instructions for AI-powered IDE on how to generate c
 
 Follow these instructions when the user explicitly asks to generate a changelog.
 
+## Scope and boundaries
+
+**Your single deliverable is the file `docs/changelogs/v<version>.md`.** Write the complete, verified changelog to that path. That is the entire task. Exit as soon as the file is written and verified against the checklist in Step 9.
+
+Unless the caller explicitly instructs otherwise:
+
+- **Do not** run `git commit`, `git push`, `git checkout` (to switch branches), `git branch`, `git tag`, `git reset`, `git merge`, `git rebase`, or any other command that writes to refs, HEAD, or remotes.
+- **Do not** create pull requests, push branches, or issue GitHub API write calls (POST / PATCH / DELETE).
+- In the cozystack working tree, the **only** file you create or modify is `docs/changelogs/v<version>.md`. Cloning auxiliary repositories under `_repos/` for cross-repo analysis (see Step 6) is fine — that directory is outside the cozystack tree.
+
+The caller — a GitHub Actions workflow in CI, or a developer running you interactively — owns branching, committing, pushing, and PR creation. They will perform those actions after you exit. Do not pre-empt them even if the working tree looks ready.
+
+Read-only analysis is expected and encouraged: `git log`, `git show`, `git fetch`, `git diff`, `gh pr view`, `gh api` GET requests, and reading any file in the repository.
+
 ## Required Tools
 
 Before generating changelogs, ensure you have access to `gh` (GitHub CLI) tool, which is used to fetch commit and PR author information. The GitHub CLI is used to correctly identify PR authors from commits and pull requests.
@@ -608,6 +622,8 @@ Create a new changelog file in the format matching previous versions:
 **Save the changelog:**
 Save the changelog to file `docs/changelogs/v<version>.md` according to the version for which the changelog is being generated.
 
+**Then exit.** Do not commit, push, create a branch, or open a pull request — the caller handles all git and GitHub operations after you return. See the "Scope and boundaries" section at the top of this document.
+
 ### Important notes
 
 - **After fetch with --force** local tags are up-to-date, use them for work

From 3720f0f3f2306db9faa4bf1a68bf928e319a04a3 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Thu, 23 Apr 2026 10:22:26 +0500
Subject: [PATCH 576/666] fix(ci): harden tags.yaml changelog job against agent
 misbehavior

Three changes to the generate-changelog job to fix the v1.3.0
release pipeline failure (run 24765377017) and make the job robust
to whatever state the Copilot step leaves behind.

1. Add `timeout-minutes: 30` to the Generate changelog using AI
   step. On the v1.3.0 re-run the step hung silently for 10+
   minutes; with no timeout a hung Copilot would hold a self-hosted
   runner for up to 6 hours (job default). The previous successful
   run took ~26 minutes, so 30 is a reasonable ceiling.

2. Replace the terse, ambiguous Copilot prompt with a one-liner
   that invokes docs/agents/changelog.md directly. The "Scope and
   boundaries" section added to that doc in the previous commit is
   now the single source of truth for what the agent may and may
   not do, so the workflow only needs to pass the version and
   point at the relevant doc. VERSION is moved to step env: to
   match GitHub's workflow-injection hardening guidance.

3. Rewrite the Create changelog branch and commit step:
   - add `set -euo pipefail` so any failure is visible
   - validate the file exists up front and fail loud with
     `::error::` if not
   - copy the file to a tempfile BEFORE `git checkout -b`, so the
     checkout to `origin/main` cannot remove it (this is the fix
     for the original pathspec error the v1.3.0 run hit)
   - use `trap` to clean up the tempfile on any exit path
   - move VERSION to env
   - drop the dead "no changes to commit" branch: the check_changelog
     step earlier in the job gates this step on the file being
     absent from origin/main, so `git add` + `git commit` must
     produce a diff. If they don't (e.g. Copilot emitted an empty
     file), fail loud instead of pushing an empty branch.

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .github/workflows/tags.yaml | 67 ++++++++++++++++++++-----------------
 1 file changed, 36 insertions(+), 31 deletions(-)

diff --git a/.github/workflows/tags.yaml b/.github/workflows/tags.yaml
index b10897cf..0ec0217d 100644
--- a/.github/workflows/tags.yaml
+++ b/.github/workflows/tags.yaml
@@ -303,51 +303,56 @@ jobs:
 
       - name: Generate changelog using AI
         if: steps.check_changelog.outputs.exists == 'false'
+        timeout-minutes: 30
         env:
           COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          VERSION: ${{ steps.tag.outputs.version }}
         run: |
-          copilot --prompt "prepare changelog file for tagged release v${{ steps.tag.outputs.version }}, use @docs/agents/changelog.md for it. Create the changelog file at docs/changelogs/v${{ steps.tag.outputs.version }}.md" \
+          copilot \
+            --prompt "Generate the release changelog for tag v${VERSION}. Follow the instructions in @docs/agents/changelog.md exactly, including the 'Scope and boundaries' section at the top. Your deliverable is the single file docs/changelogs/v${VERSION}.md — write it and exit; this workflow handles branching, committing, pushing, and opening the PR." \
             --allow-all-tools --allow-all-paths < /dev/null
 
       - name: Create changelog branch and commit
         if: steps.check_changelog.outputs.exists == 'false'
         env:
           APP_TOKEN: ${{ steps.app-token.outputs.token }}
+          VERSION: ${{ steps.tag.outputs.version }}
         run: |
-          git config user.name  "cozystack-ci[bot]"
-          git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"
-          git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}
-          
-          CHANGELOG_FILE="docs/changelogs/v${{ steps.tag.outputs.version }}.md"
-          CHANGELOG_BRANCH="changelog-v${{ steps.tag.outputs.version }}"
-          
-          if [ -f "$CHANGELOG_FILE" ]; then
-            # Fetch latest main branch
-            git fetch origin main
-            
-            # Delete local branch if it exists
-            git branch -D "$CHANGELOG_BRANCH" 2>/dev/null || true
-            
-            # Create and checkout new branch from main
-            git checkout -b "$CHANGELOG_BRANCH" origin/main
-            
-            # Add and commit changelog
-            git add "$CHANGELOG_FILE"
-            if git diff --staged --quiet; then
-              echo "⚠️ No changes to commit (file may already be committed)"
-            else
-              git commit -m "docs: add changelog for v${{ steps.tag.outputs.version }}" -s
-              echo "✅ Changelog committed to branch $CHANGELOG_BRANCH"
-            fi
-            
-            # Push the branch (force push to update if it exists)
-            git push -f origin "$CHANGELOG_BRANCH"
-          else
-            echo "⚠️ Changelog file was not generated"
+          set -euo pipefail
+
+          CHANGELOG_FILE="docs/changelogs/v${VERSION}.md"
+          CHANGELOG_BRANCH="changelog-v${VERSION}"
+
+          if [ ! -f "$CHANGELOG_FILE" ]; then
+            echo "::error::Changelog file $CHANGELOG_FILE was not produced by the Generate changelog using AI step"
             exit 1
           fi
 
+          # Snapshot the file across the branch switch — the checkout below
+          # resets tracked files to match origin/main.
+          TEMP_FILE="$(mktemp)"
+          trap 'rm -f "$TEMP_FILE"' EXIT
+          cp "$CHANGELOG_FILE" "$TEMP_FILE"
+
+          git config user.name  "cozystack-ci[bot]"
+          git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"
+          git remote set-url origin "https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}"
+
+          git fetch origin main
+          git branch -D "$CHANGELOG_BRANCH" 2>/dev/null || true
+          git checkout -b "$CHANGELOG_BRANCH" origin/main
+
+          mkdir -p "$(dirname "$CHANGELOG_FILE")"
+          cp "$TEMP_FILE" "$CHANGELOG_FILE"
+
+          # The `check_changelog` step gated this job on the file being absent
+          # from origin/main, so `git add` + `git commit` must produce a diff.
+          # If they don't, something is wrong (e.g. empty file) — fail loud.
+          git add "$CHANGELOG_FILE"
+          git commit -m "docs: add changelog for v${VERSION}" -s
+          git push -f origin "$CHANGELOG_BRANCH"
+
       - name: Create PR for changelog
         if: steps.check_changelog.outputs.exists == 'false'
         uses: actions/github-script@v7

From c4477259c7e914accaf45238a2b2b591451672a9 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Thu, 23 Apr 2026 10:41:41 +0500
Subject: [PATCH 577/666] fix(backups): move velero-configmap Role to velero
 chart

The backupstrategy-controller chart declared a Role/RoleBinding in the
cozy-velero namespace for ResourceModifier ConfigMap management. Because
velero is an optional package, that namespace does not exist in bundles
without velero, so Helm install aborted with "namespaces \"cozy-velero\"
not found" and blocked the default install of backupstrategy-controller.

Move the Role and RoleBinding into the velero chart so they are created
only when velero is actually installed. The RoleBinding subject points
to the backupstrategy-controller ServiceAccount in its fixed namespace
(cozy-backup-controller).

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .../templates/rbac-bind.yaml                  | 14 ----------
 .../templates/rbac.yaml                       | 15 +++--------
 .../backupstrategy-controller-rbac.yaml       | 26 +++++++++++++++++++
 3 files changed, 29 insertions(+), 26 deletions(-)
 create mode 100644 packages/system/velero/templates/backupstrategy-controller-rbac.yaml

diff --git a/packages/system/backupstrategy-controller/templates/rbac-bind.yaml b/packages/system/backupstrategy-controller/templates/rbac-bind.yaml
index 4ecacce0..03578cc2 100644
--- a/packages/system/backupstrategy-controller/templates/rbac-bind.yaml
+++ b/packages/system/backupstrategy-controller/templates/rbac-bind.yaml
@@ -10,17 +10,3 @@ subjects:
 - kind: ServiceAccount
   name: backupstrategy-controller
   namespace: {{ .Release.Namespace }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: backups.cozystack.io:strategy-controller:velero-configmaps
-  namespace: cozy-velero
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: backups.cozystack.io:strategy-controller:velero-configmaps
-subjects:
-- kind: ServiceAccount
-  name: backupstrategy-controller
-  namespace: {{ .Release.Namespace }}
diff --git a/packages/system/backupstrategy-controller/templates/rbac.yaml b/packages/system/backupstrategy-controller/templates/rbac.yaml
index bbdb74f8..634ea88b 100644
--- a/packages/system/backupstrategy-controller/templates/rbac.yaml
+++ b/packages/system/backupstrategy-controller/templates/rbac.yaml
@@ -27,7 +27,9 @@ rules:
   resources: ["pods"]
   verbs: ["get", "list", "watch"]
 # ConfigMaps: controller-runtime cache requires cluster-scoped list/watch;
-# create/update/delete is scoped to cozy-velero via the Role below.
+# create/update/delete is scoped to cozy-velero via a Role shipped by the
+# velero chart (packages/system/velero/templates/backupstrategy-controller-rbac.yaml)
+# so it is only created when velero is installed.
 - apiGroups: [""]
   resources: ["configmaps"]
   verbs: ["get", "list", "watch"]
@@ -78,14 +80,3 @@ rules:
 - apiGroups: ["coordination.k8s.io"]
   resources: ["leases"]
   verbs: ["get", "list", "watch", "create", "update", "patch"]
----
-# To create ResourceModifiers in ConfigMaps for Restore in Velero install namespace.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: backups.cozystack.io:strategy-controller:velero-configmaps
-  namespace: cozy-velero
-rules:
-- apiGroups: [""]
-  resources: ["configmaps"]
-  verbs: ["create", "get", "list", "delete", "deletecollection", "patch", "update"]
diff --git a/packages/system/velero/templates/backupstrategy-controller-rbac.yaml b/packages/system/velero/templates/backupstrategy-controller-rbac.yaml
new file mode 100644
index 00000000..43c51cd7
--- /dev/null
+++ b/packages/system/velero/templates/backupstrategy-controller-rbac.yaml
@@ -0,0 +1,26 @@
+# Grants the backupstrategy-controller permission to manage ResourceModifier
+# ConfigMaps in the Velero install namespace. Lives here (not in the
+# backupstrategy-controller chart) so that the Role is only created when
+# velero is actually installed — otherwise the chart would try to create it
+# in a namespace that does not exist.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: backups.cozystack.io:strategy-controller:velero-configmaps
+rules:
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["create", "get", "list", "delete", "deletecollection", "patch", "update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: backups.cozystack.io:strategy-controller:velero-configmaps
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: backups.cozystack.io:strategy-controller:velero-configmaps
+subjects:
+- kind: ServiceAccount
+  name: backupstrategy-controller
+  namespace: cozy-backup-controller

From 3c95f3052161372cc0c53c4b7119b56118d19846 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Thu, 23 Apr 2026 12:25:19 +0500
Subject: [PATCH 578/666] docs(agents): scope git-write ban to cozystack
 working tree
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review feedback on PR #2460: the previous "do not write to refs, HEAD,
or remotes" wording contradicted the explicit allowance of `git fetch`
(which updates remote-tracking refs) and the mandatory cross-repo
checks in Step 6, which `cd` into `_repos/<repo>` and run
`git checkout`, `git pull`, etc.

Sharpen the scope paragraph:

- The git-write ban is now explicitly scoped to the cozystack working
  tree — it bans writing to local branches, tags, or HEAD in that
  repo, not "refs/HEAD/remotes" globally.
- `git fetch` is called out as expected.
- Local git operations inside disposable `_repos/` clones
  (`git checkout`, `git pull`, etc.) are explicitly allowed, with
  the remaining rules (no push, no PR creation, no API writes)
  applying to any repository.

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 docs/agents/changelog.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/agents/changelog.md b/docs/agents/changelog.md
index 13a674a2..2fde1224 100644
--- a/docs/agents/changelog.md
+++ b/docs/agents/changelog.md
@@ -12,9 +12,9 @@ Follow these instructions when the user explicitly asks to generate a changelog.
 
 Unless the caller explicitly instructs otherwise:
 
-- **Do not** run `git commit`, `git push`, `git checkout` (to switch branches), `git branch`, `git tag`, `git reset`, `git merge`, `git rebase`, or any other command that writes to refs, HEAD, or remotes.
-- **Do not** create pull requests, push branches, or issue GitHub API write calls (POST / PATCH / DELETE).
-- In the cozystack working tree, the **only** file you create or modify is `docs/changelogs/v<version>.md`. Cloning auxiliary repositories under `_repos/` for cross-repo analysis (see Step 6) is fine — that directory is outside the cozystack tree.
+- **In the cozystack working tree**, do not run `git commit`, `git push`, `git checkout` (to switch branches), `git branch`, `git tag`, `git reset`, `git merge`, or `git rebase`. Do not write to local branches, tags, or HEAD. `git fetch` is expected and fine (see the read-only analysis list below).
+- **Do not** push to any remote, open pull requests, or issue GitHub API write calls (POST / PATCH / DELETE) for any repository.
+- In the cozystack working tree, the **only** file you create or modify is `docs/changelogs/v<version>.md`. Cloning auxiliary repositories under `_repos/` for cross-repo analysis (see Step 6) is fine; local git operations inside those disposable clones (`git checkout`, `git pull`, etc.) are allowed — just never push from them or open PRs against them.
 
 The caller — a GitHub Actions workflow in CI, or a developer running you interactively — owns branching, committing, pushing, and PR creation. They will perform those actions after you exit. Do not pre-empt them even if the working tree looks ready.
 

From e7e83b0d0b299f99c4f8881db5e8474dd0afd25e Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Thu, 23 Apr 2026 12:25:30 +0500
Subject: [PATCH 579/666] fix(ci): reject empty changelog file before commit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review feedback on PR #2460: the existing `[ -f ]` check catches
missing files but a zero-byte `docs/changelogs/v${VERSION}.md` would
still be staged and committed — `git add` + `git commit -s` on a new
empty file succeeds and produces a real commit, leaving the
downstream PR with no actual changelog content.

Add a `[ -s ]` guard after the existence check: if the Generate
changelog using AI step produces an empty file, emit a matching
`::error::` annotation and exit 1 before snapshotting.

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .github/workflows/tags.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/tags.yaml b/.github/workflows/tags.yaml
index 0ec0217d..ae77d015 100644
--- a/.github/workflows/tags.yaml
+++ b/.github/workflows/tags.yaml
@@ -328,6 +328,10 @@ jobs:
             echo "::error::Changelog file $CHANGELOG_FILE was not produced by the Generate changelog using AI step"
             exit 1
           fi
+          if [ ! -s "$CHANGELOG_FILE" ]; then
+            echo "::error::Changelog file $CHANGELOG_FILE is empty"
+            exit 1
+          fi
 
           # Snapshot the file across the branch switch — the checkout below
           # resets tracked files to match origin/main.

From 76c4eabdff8df513cca04c2313928c707df1c6ca Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Thu, 23 Apr 2026 12:26:14 +0500
Subject: [PATCH 580/666] fix(ci): use a read-only app token for the Copilot
 step
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review feedback on PR #2460: the Generate changelog using AI step ran
Copilot with --allow-all-tools and GH_TOKEN set to the write-capable
installation token issued to the job (contents: write,
pull-requests: write on all cozystack/* repos). The scope rules in
docs/agents/changelog.md and the step prompt tell the agent not to
use those permissions, but nothing at the token layer prevented it.

Mint a second, read-only installation token from the same app
(same COZYSTACK_CI_APP_ID / COZYSTACK_CI_PRIVATE_KEY, scoped to
contents/pull-requests/metadata read) and pass that one to the AI
step instead. The write-capable token is still used by the checkout,
commit/push, and PR-creation steps that actually need it.

This is defense in depth: even if a future prompt change or agent
misbehavior ignored the scope rules, the token itself has no write
capability on any repository in the cozystack org. No new secret,
no new GitHub App install, no admin-side change — the RO token is
minted in the same workflow from the same app credentials.

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .github/workflows/tags.yaml | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/tags.yaml b/.github/workflows/tags.yaml
index ae77d015..90f04829 100644
--- a/.github/workflows/tags.yaml
+++ b/.github/workflows/tags.yaml
@@ -255,6 +255,21 @@ jobs:
           private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
           owner: cozystack
 
+      # Read-only token for the AI step. Minting a separate scoped token
+      # means the Generate changelog using AI step cannot push branches,
+      # open PRs, or mutate any repository even with --allow-all-tools,
+      # regardless of whether the agent follows the prompt's instructions.
+      - name: Generate read-only GitHub App token
+        id: app-token-read
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
+          private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
+          owner: cozystack
+          permission-contents: read
+          permission-pull-requests: read
+          permission-metadata: read
+
       - name: Parse tag
         id: tag
         uses: actions/github-script@v7
@@ -306,7 +321,7 @@ jobs:
         timeout-minutes: 30
         env:
           COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ steps.app-token-read.outputs.token }}
           VERSION: ${{ steps.tag.outputs.version }}
         run: |
           copilot \

From c1508940bda27b2979639981fd25461c9d4824b3 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Thu, 23 Apr 2026 13:34:21 +0500
Subject: [PATCH 581/666] fix(etcd): remove destructive post-upgrade
 cert-regeneration hook

The etcd chart shipped a `post-upgrade` Helm hook that `kubectl delete`d the
etcd TLS chain (`etcd-{ca,peer-ca,client,peer,server}-tls`) and then deleted
etcd pods on every chart upgrade, gated by a semver compare of an
`etcd-deployed-version` ConfigMap against `2.6.1`.

The hook was added as a one-shot migration for the chart `2.6.0 -> 2.6.1`
transition. Since commit f871fbdb ("Remove versions_map logic") all chart
versions are stamped as `0.0.0+<git-hash>`, which per semver is always
`< 2.6.1`. The gate therefore always resolves to "update certs", firing the
destructive hook on every etcd upgrade. On clusters running Kamaji-managed
tenant control planes this wipes the etcd CA, cert-manager re-issues it, and
tenant kube-apiservers hit `x509: certificate signed by unknown authority`
against `etcd.<ns>.svc:2379` until each tenant DataStore is manually
re-reconciled.

Commit 47d81f70 ("Disabled private key rotation in CA certs") already fixed
the underlying `rotationPolicy: Always` issue the migration was papering
over, so the hook has no remaining use. Remove the hook Job, its RBAC, the
version ConfigMap it read, and add a helm-unittest suite under
`packages/extra/etcd/tests/` that guards against re-introducing the hook
or the version ConfigMap.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/extra/etcd/Makefile                  |  3 ++
 packages/extra/etcd/templates/hook/job.yaml   | 39 -------------------
 packages/extra/etcd/templates/hook/role.yaml  | 26 -------------
 .../etcd/templates/hook/rolebinding.yaml      | 15 -------
 .../etcd/templates/hook/serviceaccount.yaml   |  7 ----
 packages/extra/etcd/templates/version.yaml    |  6 ---
 .../etcd/tests/no-post-upgrade-hook_test.yaml | 34 ++++++++++++++++
 7 files changed, 37 insertions(+), 93 deletions(-)
 delete mode 100644 packages/extra/etcd/templates/hook/job.yaml
 delete mode 100644 packages/extra/etcd/templates/hook/role.yaml
 delete mode 100644 packages/extra/etcd/templates/hook/rolebinding.yaml
 delete mode 100644 packages/extra/etcd/templates/hook/serviceaccount.yaml
 delete mode 100644 packages/extra/etcd/templates/version.yaml
 create mode 100644 packages/extra/etcd/tests/no-post-upgrade-hook_test.yaml

diff --git a/packages/extra/etcd/Makefile b/packages/extra/etcd/Makefile
index f37d6e1e..2b3ed61e 100644
--- a/packages/extra/etcd/Makefile
+++ b/packages/extra/etcd/Makefile
@@ -5,3 +5,6 @@ include ../../../hack/package.mk
 generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
 	../../../hack/update-crd.sh
+
+test:
+	helm unittest .
diff --git a/packages/extra/etcd/templates/hook/job.yaml b/packages/extra/etcd/templates/hook/job.yaml
deleted file mode 100644
index 3bf2f84b..00000000
--- a/packages/extra/etcd/templates/hook/job.yaml
+++ /dev/null
@@ -1,39 +0,0 @@
-{{- $shouldUpdateCerts := true }}
-{{- $configMap := lookup "v1" "ConfigMap" .Release.Namespace "etcd-deployed-version" }}
-{{- if $configMap }}
-  {{- $deployedVersion := index $configMap "data" "version" }}
-  {{- if $deployedVersion | semverCompare ">= 2.6.1" }}
-    {{- $shouldUpdateCerts = false }}
-  {{- end }}
-{{- end }}
-
-{{- if $shouldUpdateCerts }}
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: etcd-hook
-  annotations:
-    helm.sh/hook: post-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-spec:
-  template:
-    metadata:
-      labels:
-        policy.cozystack.io/allow-to-apiserver: "true"
-    spec:
-      serviceAccountName: etcd-hook
-      containers:
-        - name: kubectl
-          image: docker.io/alpine/k8s:1.33.4
-          command:
-          - sh
-          args:
-            - -exc
-            - |-
-              kubectl --namespace={{ .Release.Namespace }} delete secrets etcd-ca-tls etcd-peer-ca-tls 
-              sleep 10
-              kubectl --namespace={{ .Release.Namespace }} delete secrets etcd-client-tls etcd-peer-tls etcd-server-tls
-              kubectl --namespace={{ .Release.Namespace }} delete pods --selector=app.kubernetes.io/instance=etcd,app.kubernetes.io/managed-by=etcd-operator,app.kubernetes.io/name=etcd,cozystack.io/service=etcd
-      restartPolicy: Never
-{{- end }}
diff --git a/packages/extra/etcd/templates/hook/role.yaml b/packages/extra/etcd/templates/hook/role.yaml
deleted file mode 100644
index 327eeadb..00000000
--- a/packages/extra/etcd/templates/hook/role.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  annotations:
-    helm.sh/hook: post-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-  name: etcd-hook
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  - pods
-  verbs:
-  - get
-  - list
-  - watch
-  - delete
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  verbs:
-  - get
-  - list
-  - watch
diff --git a/packages/extra/etcd/templates/hook/rolebinding.yaml b/packages/extra/etcd/templates/hook/rolebinding.yaml
deleted file mode 100644
index 0ee0ffd1..00000000
--- a/packages/extra/etcd/templates/hook/rolebinding.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: etcd-hook
-  annotations:
-    helm.sh/hook: post-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: etcd-hook
-subjects:
-  - kind: ServiceAccount
-    name: etcd-hook
-    namespace: {{ .Release.Namespace | quote }}
diff --git a/packages/extra/etcd/templates/hook/serviceaccount.yaml b/packages/extra/etcd/templates/hook/serviceaccount.yaml
deleted file mode 100644
index 552fb5fc..00000000
--- a/packages/extra/etcd/templates/hook/serviceaccount.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: etcd-hook
-  annotations:
-    helm.sh/hook: post-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
diff --git a/packages/extra/etcd/templates/version.yaml b/packages/extra/etcd/templates/version.yaml
deleted file mode 100644
index cc9375bb..00000000
--- a/packages/extra/etcd/templates/version.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: etcd-deployed-version
-data:
-  version: {{ .Chart.Version }}
diff --git a/packages/extra/etcd/tests/no-post-upgrade-hook_test.yaml b/packages/extra/etcd/tests/no-post-upgrade-hook_test.yaml
new file mode 100644
index 00000000..0e4f5aa3
--- /dev/null
+++ b/packages/extra/etcd/tests/no-post-upgrade-hook_test.yaml
@@ -0,0 +1,34 @@
+suite: etcd chart does not ship a destructive post-upgrade cert-regeneration hook
+
+release:
+  name: etcd
+  namespace: tenant-root
+
+templates:
+  - templates/check-release-name.yaml
+  - templates/dashboard-resourcemap.yaml
+  - templates/datastore.yaml
+  - templates/etcd-defrag.yaml
+  - templates/hook/job.yaml
+  - templates/podscrape.yaml
+  - templates/prometheus-rules.yaml
+  - templates/version.yaml
+
+tests:
+  - it: renders no Job named etcd-hook
+    documentSelector:
+      path: metadata.name
+      value: etcd-hook
+      skipEmptyTemplates: true
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: renders no ConfigMap named etcd-deployed-version
+    documentSelector:
+      path: metadata.name
+      value: etcd-deployed-version
+      skipEmptyTemplates: true
+    asserts:
+      - hasDocuments:
+          count: 0

From 9222b6feda4d97eda7481569d5d9a466b69fec94 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Thu, 23 Apr 2026 14:32:20 +0500
Subject: [PATCH 582/666] ci(api): pre-fetch k8s.io/code-generator in codegen
 drift job

hack/update-codegen.sh sources kube_codegen.sh from the Go module
cache at ~/go/pkg/mod/k8s.io/code-generator@vX.Y.Z/, but the module
is not declared in go.mod so a fresh runner has nothing to source
from. Add a workflow step that parses the pinned version out of the
script and pulls the module into the cache before running
make generate.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .github/workflows/codegen-drift.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/workflows/codegen-drift.yml b/.github/workflows/codegen-drift.yml
index bd7927f7..b08f5d7e 100644
--- a/.github/workflows/codegen-drift.yml
+++ b/.github/workflows/codegen-drift.yml
@@ -30,6 +30,17 @@ jobs:
           go-version-file: go.mod
           cache: true
 
+      - name: Pre-fetch k8s.io/code-generator module
+        # hack/update-codegen.sh sources kube_codegen.sh from the Go module cache.
+        # The module is not declared in go.mod, so fetch it explicitly at the
+        # version pinned in the script.
+        run: |
+          version=$(grep -oP 'code-generator@\Kv[0-9.]+' hack/update-codegen.sh)
+          tmpdir=$(mktemp -d)
+          cd "$tmpdir"
+          go mod init codegen-fetch
+          go get "k8s.io/code-generator@${version}"
+
       - name: Run make generate
         run: make generate
 

From 0baa93006fcec09fb6245a4ccd8ec8a047448587 Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Thu, 23 Apr 2026 16:57:23 +0500
Subject: [PATCH 583/666] chore(hetzner-robotlb): update robotlb chart to
 appVersion 0.0.6

Pulls the latest robotlb chart (0.1.3) which ships robotlb 0.0.6.
The new appVersion adds RBAC permissions for discovery.k8s.io/endpointslices
needed to support EndpointSlice-based services such as KubeVirt.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 packages/system/hetzner-robotlb/charts/robotlb/Chart.yaml      | 2 +-
 .../hetzner-robotlb/charts/robotlb/templates/deployment.yaml   | 2 +-
 .../system/hetzner-robotlb/charts/robotlb/templates/role.yaml  | 3 ++-
 packages/system/hetzner-robotlb/charts/robotlb/values.yaml     | 3 +++
 4 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/packages/system/hetzner-robotlb/charts/robotlb/Chart.yaml b/packages/system/hetzner-robotlb/charts/robotlb/Chart.yaml
index 743f255d..192470dd 100644
--- a/packages/system/hetzner-robotlb/charts/robotlb/Chart.yaml
+++ b/packages/system/hetzner-robotlb/charts/robotlb/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 0.0.5
+appVersion: 0.0.6
 description: A Helm chart for robotlb (loadbalancer on hetzner cloud).
 name: robotlb
 type: application
diff --git a/packages/system/hetzner-robotlb/charts/robotlb/templates/deployment.yaml b/packages/system/hetzner-robotlb/charts/robotlb/templates/deployment.yaml
index 4fd71366..41b4661a 100644
--- a/packages/system/hetzner-robotlb/charts/robotlb/templates/deployment.yaml
+++ b/packages/system/hetzner-robotlb/charts/robotlb/templates/deployment.yaml
@@ -5,7 +5,7 @@ metadata:
   labels:
     {{- include "robotlb.labels" . | nindent 4 }}
 spec:
-  replicas: {{ .Values.replicas }}
+  replicas: 1
   selector:
     matchLabels:
       {{- include "robotlb.selectorLabels" . | nindent 6 }}
diff --git a/packages/system/hetzner-robotlb/charts/robotlb/templates/role.yaml b/packages/system/hetzner-robotlb/charts/robotlb/templates/role.yaml
index 3a7b9334..76bac249 100644
--- a/packages/system/hetzner-robotlb/charts/robotlb/templates/role.yaml
+++ b/packages/system/hetzner-robotlb/charts/robotlb/templates/role.yaml
@@ -3,7 +3,8 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: {{ include "robotlb.fullname" . }}-cr
-rules: {{- toYaml .Values.serviceAccount.permissions | nindent 2 }}
+rules:
+ {{- toYaml .Values.serviceAccount.permissions | nindent 2 }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
diff --git a/packages/system/hetzner-robotlb/charts/robotlb/values.yaml b/packages/system/hetzner-robotlb/charts/robotlb/values.yaml
index 739c7b73..4365f677 100644
--- a/packages/system/hetzner-robotlb/charts/robotlb/values.yaml
+++ b/packages/system/hetzner-robotlb/charts/robotlb/values.yaml
@@ -36,6 +36,9 @@ serviceAccount:
   - apiGroups: [""]
     resources: [nodes, pods]
     verbs: [get, list, watch]
+  - apiGroups: [discovery.k8s.io]
+    resources: [endpointslices]
+    verbs: [get, list, watch]
 
 podAnnotations: {}
 podLabels: {}

From ecd2ead5defaf25001cbd56e5878b9f4d2c2d27b Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 23 Apr 2026 15:55:49 +0300
Subject: [PATCH 584/666] docs(agents): document make generate requirement
 before committing

Pre-commit CI runs make generate in every package and fails with exit
123 on any uncommitted generator output. Add explicit guidance so
agents stage regenerated README.md, values.schema.json and
packages/system/<name>-rd artifacts alongside the hand edits.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 docs/agents/contributing.md | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/docs/agents/contributing.md b/docs/agents/contributing.md
index 68a584ee..9626e81e 100644
--- a/docs/agents/contributing.md
+++ b/docs/agents/contributing.md
@@ -8,6 +8,30 @@ Project-side conventions for commits, branches, and pull requests in Cozystack.
 - [ ] Commit is signed off with `--signoff`
 - [ ] Branch is rebased on `upstream/main` (no extra commits)
 - [ ] PR body includes description and release note
+- [ ] Ran `make generate` in every package whose `values.yaml`, `values.schema.json`, `Chart.yaml`, or `README.md` was touched, and committed the regenerated files
+
+## Regenerate Artifacts Before Committing
+
+Several files in each package are produced by `make generate` from `values.yaml` + `values.schema.json` and must stay in sync with the hand-edited sources:
+
+- `packages/(apps|extra)/<name>/README.md` — regenerated by `cozyvalues-gen` (parameter table, formatting).
+- `packages/(apps|extra)/<name>/values.schema.json` — `cozyvalues-gen` rewrites ordering and derived fields.
+- `packages/system/<name>-rd/cozyrds/<name>.yaml` — produced by `hack/update-crd.sh`, which `make generate` invokes.
+
+**Before committing edits to any of those sources**, run `make generate` inside the package and stage the full diff:
+
+```bash
+make -C packages/extra/<name> generate
+git add packages/extra/<name>/ packages/system/<name>-rd/
+```
+
+The repo's pre-commit CI job runs `make generate` in every package and then `git diff --exit-code`. Any unstaged generator output fails the job with exit code 123 and blocks the PR. Also rerun `make generate` after a `git commit --amend` if the amended change touched any of the sources above.
+
+To locate packages a WIP branch is likely to need regenerated:
+
+```bash
+git diff --name-only | xargs -n1 dirname | sort -u | grep ^packages/
+```
 
 ## Commit Format
 

From 0e4b66a70f036d446c5d61dfc92174ff6eae34ac Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 23 Apr 2026 13:36:04 +0300
Subject: [PATCH 585/666] chore(cilium): bump to v1.19.3

Vendored chart refreshed via make update in packages/system/cilium.

Motivation: v1.19.2 fixes a cert-manager HTTP-01 bug on hostnames with
both HTTP and HTTPS listeners (cilium#44492, backport PR #44517). This
is a prerequisite for upcoming Gateway API work.

v1.19.3 is the latest stable release in the v1.19.x line (15 Apr 2026).

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../system/cilium/charts/cilium/Chart.yaml    |   4 +-
 .../system/cilium/charts/cilium/README.md     |  50 +++-
 .../configmap/bootstrap-config.yaml           |   9 +
 .../templates/cilium-agent/daemonset.yaml     |   6 +-
 .../cilium/templates/cilium-configmap.yaml    |  20 +-
 .../cilium-operator/clusterrole.yaml          |   9 +
 .../cilium/templates/ztunnel/daemonset.yaml   | 165 +++++++++++++
 .../cilium/templates/ztunnel/secret.yaml      |  23 ++
 .../templates/ztunnel/serviceaccount.yaml     |  21 ++
 .../cilium/charts/cilium/values.schema.json   | 219 +++++++++++++++++-
 .../system/cilium/charts/cilium/values.yaml   | 147 ++++++++++--
 .../cilium/charts/cilium/values.yaml.tmpl     | 106 ++++++++-
 .../system/cilium/images/cilium/Dockerfile    |   2 +-
 13 files changed, 726 insertions(+), 55 deletions(-)
 create mode 100644 packages/system/cilium/charts/cilium/templates/ztunnel/daemonset.yaml
 create mode 100644 packages/system/cilium/charts/cilium/templates/ztunnel/secret.yaml
 create mode 100644 packages/system/cilium/charts/cilium/templates/ztunnel/serviceaccount.yaml

diff --git a/packages/system/cilium/charts/cilium/Chart.yaml b/packages/system/cilium/charts/cilium/Chart.yaml
index 0bb34451..5fe2baed 100644
--- a/packages/system/cilium/charts/cilium/Chart.yaml
+++ b/packages/system/cilium/charts/cilium/Chart.yaml
@@ -76,7 +76,7 @@ annotations:
     Cilium Gateway Class Config\n  description: |\n    CiliumGatewayClassConfig defines
     a configuration for Gateway API GatewayClass.\n"
 apiVersion: v2
-appVersion: 1.19.1
+appVersion: 1.19.3
 description: eBPF-based Networking, Security, and Observability
 home: https://cilium.io/
 icon: https://cdn.jsdelivr.net/gh/cilium/cilium@main/Documentation/images/logo-solo.svg
@@ -92,4 +92,4 @@ kubeVersion: '>= 1.21.0-0'
 name: cilium
 sources:
 - https://github.com/cilium/cilium
-version: 1.19.1
+version: 1.19.3
diff --git a/packages/system/cilium/charts/cilium/README.md b/packages/system/cilium/charts/cilium/README.md
index fe8aea3f..d7697c56 100644
--- a/packages/system/cilium/charts/cilium/README.md
+++ b/packages/system/cilium/charts/cilium/README.md
@@ -1,6 +1,6 @@
 # cilium
 
-![Version: 1.19.1](https://img.shields.io/badge/Version-1.19.1-informational?style=flat-square) ![AppVersion: 1.19.1](https://img.shields.io/badge/AppVersion-1.19.1-informational?style=flat-square)
+![Version: 1.19.3](https://img.shields.io/badge/Version-1.19.3-informational?style=flat-square) ![AppVersion: 1.19.3](https://img.shields.io/badge/AppVersion-1.19.3-informational?style=flat-square)
 
 Cilium is open source software for providing and transparently securing
 network connectivity and loadbalancing between application workloads such as
@@ -89,7 +89,7 @@ contributors across the globe, there is almost always someone available to help.
 | authentication.mutual.spire.install.agent.tolerations | list | `[{"effect":"NoSchedule","key":"node.kubernetes.io/not-ready"},{"effect":"NoSchedule","key":"node-role.kubernetes.io/master"},{"effect":"NoSchedule","key":"node-role.kubernetes.io/control-plane"},{"effect":"NoSchedule","key":"node.cloudprovider.kubernetes.io/uninitialized","value":"true"},{"key":"CriticalAddonsOnly","operator":"Exists"}]` | SPIRE agent tolerations configuration By default it follows the same tolerations as the agent itself to allow the Cilium agent on this node to connect to SPIRE. ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
 | authentication.mutual.spire.install.enabled | bool | `true` | Enable SPIRE installation. This will only take effect only if authentication.mutual.spire.enabled is true |
 | authentication.mutual.spire.install.existingNamespace | bool | `false` | SPIRE namespace already exists. Set to true if Helm should not create, manage, and import the SPIRE namespace. |
-| authentication.mutual.spire.install.initImage | object | `{"digest":"sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f","override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/library/busybox","tag":"1.37.0","useDigest":true}` | init container image of SPIRE agent and server |
+| authentication.mutual.spire.install.initImage | object | `{"digest":"sha256:1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e","override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/library/busybox","tag":"1.37.0","useDigest":true}` | init container image of SPIRE agent and server |
 | authentication.mutual.spire.install.namespace | string | `"cilium-spire"` | SPIRE namespace to install into |
 | authentication.mutual.spire.install.server.affinity | object | `{}` | SPIRE server affinity configuration |
 | authentication.mutual.spire.install.server.annotations | object | `{}` | SPIRE server annotations |
@@ -175,7 +175,7 @@ contributors across the globe, there is almost always someone available to help.
 | bpf.tproxy | bool | `false` | Configure the eBPF-based TPROXY (beta) to reduce reliance on iptables rules for implementing Layer 7 policy. Note this is incompatible with netkit (`bpf.datapathMode=netkit`, `bpf.datapathMode=netkit-l2`). |
 | bpf.vlanBypass | list | `[]` | Configure explicitly allowed VLAN id's for bpf logic bypass. [0] will allow all VLAN id's without any filtering. |
 | bpfClockProbe | bool | `false` | Enable BPF clock source probing for more efficient tick retrieval. |
-| certgen | object | `{"affinity":{},"annotations":{"cronJob":{},"job":{}},"cronJob":{"failedJobsHistoryLimit":1,"successfulJobsHistoryLimit":3},"extraVolumeMounts":[],"extraVolumes":[],"generateCA":true,"image":{"digest":"sha256:19921f48ee7e2295ea4dca955878a6cd8d70e6d4219d08f688e866ece9d95d4d","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/certgen","tag":"v0.3.2","useDigest":true},"nodeSelector":{},"podLabels":{},"priorityClassName":"","resources":{},"tolerations":[],"ttlSecondsAfterFinished":null}` | Configure certificate generation for Hubble integration. If hubble.tls.auto.method=cronJob, these values are used for the Kubernetes CronJob which will be scheduled regularly to (re)generate any certificates not provided manually. |
+| certgen | object | `{"affinity":{},"annotations":{"cronJob":{},"job":{}},"cronJob":{"failedJobsHistoryLimit":1,"successfulJobsHistoryLimit":3},"extraVolumeMounts":[],"extraVolumes":[],"generateCA":true,"image":{"digest":"sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/certgen","tag":"v0.4.1","useDigest":true},"nodeSelector":{},"podLabels":{},"priorityClassName":"","resources":{},"tolerations":[],"ttlSecondsAfterFinished":null}` | Configure certificate generation for Hubble integration. If hubble.tls.auto.method=cronJob, these values are used for the Kubernetes CronJob which will be scheduled regularly to (re)generate any certificates not provided manually. |
 | certgen.affinity | object | `{}` | Affinity for certgen |
 | certgen.annotations | object | `{"cronJob":{},"job":{}}` | Annotations to be added to the hubble-certgen initial Job and CronJob |
 | certgen.cronJob.failedJobsHistoryLimit | int | `1` | The number of failed finished jobs to keep |
@@ -214,7 +214,7 @@ contributors across the globe, there is almost always someone available to help.
 | clustermesh.apiserver.extraVolumeMounts | list | `[]` | Additional clustermesh-apiserver volumeMounts. |
 | clustermesh.apiserver.extraVolumes | list | `[]` | Additional clustermesh-apiserver volumes. |
 | clustermesh.apiserver.healthPort | int | `9880` | TCP port for the clustermesh-apiserver health API. |
-| clustermesh.apiserver.image | object | `{"digest":"sha256:56d6c3dc13b50126b80ecb571707a0ea97f6db694182b9d61efd386d04e5bb28","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.19.1","useDigest":true}` | Clustermesh API server image. |
+| clustermesh.apiserver.image | object | `{"digest":"sha256:a8136a7615d6c6041d3aa6f2674d17beaec238170d669507ccc05328a778e2b7","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.19.3","useDigest":true}` | Clustermesh API server image. |
 | clustermesh.apiserver.kvstoremesh.enabled | bool | `true` | Enable KVStoreMesh. KVStoreMesh caches the information retrieved from the remote clusters in the local etcd instance (deprecated - KVStoreMesh will always be enabled once the option is removed). |
 | clustermesh.apiserver.kvstoremesh.extraArgs | list | `[]` | Additional KVStoreMesh arguments. |
 | clustermesh.apiserver.kvstoremesh.extraEnv | list | `[]` | Additional KVStoreMesh environment variables. |
@@ -340,6 +340,10 @@ contributors across the globe, there is almost always someone available to help.
 | cni.resources | object | `{"limits":{"cpu":1,"memory":"1Gi"},"requests":{"cpu":"100m","memory":"10Mi"}}` | Specifies the resources for the cni initContainer |
 | cni.uninstall | bool | `false` | Remove the CNI configuration and binary files on agent shutdown. Enable this if you're removing Cilium from the cluster. Disable this to prevent the CNI configuration file from being removed during agent upgrade, which can cause nodes to go unmanageable. |
 | commonLabels | object | `{}` | commonLabels allows users to add common labels for all Cilium resources. |
+| configDriftDetection | object | `{"driftChecker":true,"enabled":true,"ignoredKeys":[]}` | Configuration for the ConfigMap drift detection feature. When enabled, the agent continuously watches the cilium-config ConfigMap and exposes a cilium_drift_checker_config_delta Prometheus metric reporting the number of keys that differ between the ConfigMap and the agent's active settings. A non-zero value indicates that the agent has not yet applied all current ConfigMap changes and needs to be restarted. |
+| configDriftDetection.driftChecker | bool | `true` | Enable the drift checker which compares the DynamicConfig table against the agent's active settings and publishes the cilium_drift_checker_config_delta metric. |
+| configDriftDetection.enabled | bool | `true` | Enable watching of the cilium-config ConfigMap and reflecting its contents into the agent's internal DynamicConfig table. |
+| configDriftDetection.ignoredKeys | list | `[]` | List of config-map keys to ignore when computing the drift delta. |
 | connectivityProbeFrequencyRatio | float64 | `0.5` | Ratio of the connectivity probe frequency vs resource usage, a float in [0, 1]. 0 will give more frequent probing, 1 will give less frequent probing. Probing frequency is dynamically adjusted based on the cluster size. |
 | conntrackGCInterval | string | `"0s"` | Configure how frequently garbage collection should occur for the datapath connection tracking table. |
 | conntrackGCMaxInterval | string | `""` | Configure the maximum frequency for the garbage collection of the connection tracking table. Only affects the automatic computation for the frequency and has no effect when 'conntrackGCInterval' is set. This can be set to more frequently clean up unused identities created from ToFQDN policies. |
@@ -380,7 +384,6 @@ contributors across the globe, there is almost always someone available to help.
 | enableMasqueradeRouteSource | bool | `false` | Enables masquerading to the source of the route for traffic leaving the node from endpoints. |
 | enableNoServiceEndpointsRoutable | bool | `true` | Enable routing to a service that has zero endpoints |
 | enableNonDefaultDenyPolicies | bool | `true` | Enable Non-Default-Deny policies |
-| enableTunnelBIGTCP | bool | `false` | Enable BIG TCP in tunneling mode and increase maximum GRO/GSO limits for VXLAN/GENEVE tunnels |
 | enableXTSocketFallback | bool | `true` | Enables the fallback compatibility solution for when the xt_socket kernel module is missing and it is needed for the datapath L7 redirection to work properly. See documentation for details on when this can be disabled: https://docs.cilium.io/en/stable/operations/system_requirements/#linux-kernel. |
 | encryption.enabled | bool | `false` | Enable transparent network encryption. |
 | encryption.ipsec.encryptedOverlay | bool | `false` | Enable IPsec encrypted overlay |
@@ -401,8 +404,29 @@ contributors across the globe, there is almost always someone available to help.
 | encryption.strictMode.ingress.enabled | bool | `false` | Enable strict ingress encryption. When enabled, all unencrypted overlay ingress traffic will be dropped. This option is only applicable when WireGuard and tunneling are enabled. |
 | encryption.type | string | `"ipsec"` | Encryption method. Can be one of ipsec, wireguard or ztunnel. |
 | encryption.wireguard.persistentKeepalive | string | `"0s"` | Controls WireGuard PersistentKeepalive option. Set 0s to disable. |
+| encryption.ztunnel | object | `{"affinity":{},"annotations":{},"caAddress":"https://localhost:15012","extraEnv":[],"extraVolumeMounts":[],"extraVolumes":[],"healthPort":15021,"image":{"digest":null,"override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/istio/ztunnel","tag":"1.28.0-distroless","useDigest":false},"nodeSelector":{"kubernetes.io/os":"linux"},"podAnnotations":{},"podLabels":{},"priorityClassName":null,"readinessProbe":{"failureThreshold":3,"initialDelaySeconds":0,"periodSeconds":10},"resources":{"requests":{"cpu":"200m","memory":"512Mi"}},"secrets":{"bootstrapRootCert":null},"terminationGracePeriodSeconds":30,"tolerations":[{"effect":"NoSchedule","operator":"Exists"},{"key":"CriticalAddonsOnly","operator":"Exists"},{"effect":"NoExecute","operator":"Exists"}],"updateStrategy":{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0},"type":"RollingUpdate"}}` | ztunnel encryption configuration. ztunnel is Istio's purpose-built, per-node proxy for handling L4 traffic in ambient mesh mode. These settings only apply when encryption.type is set to "ztunnel". |
+| encryption.ztunnel.affinity | object | `{}` | Affinity for ztunnel pods. |
+| encryption.ztunnel.annotations | object | `{}` | Annotations to be added to all ztunnel resources. |
+| encryption.ztunnel.caAddress | string | `"https://localhost:15012"` | CA server address for certificate requests. |
+| encryption.ztunnel.extraEnv | list | `[]` | Additional ztunnel container environment variables. |
+| encryption.ztunnel.extraVolumeMounts | list | `[]` | Additional ztunnel volumeMounts. |
+| encryption.ztunnel.extraVolumes | list | `[]` | Additional ztunnel volumes. |
+| encryption.ztunnel.healthPort | int | `15021` | TCP port for the health API. |
+| encryption.ztunnel.image | object | `{"digest":null,"override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/istio/ztunnel","tag":"1.28.0-distroless","useDigest":false}` | ztunnel container image. |
+| encryption.ztunnel.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node selector for ztunnel pods. |
+| encryption.ztunnel.podAnnotations | object | `{}` | Annotations to be added to ztunnel pods. |
+| encryption.ztunnel.podLabels | object | `{}` | Labels to be added to ztunnel pods. |
+| encryption.ztunnel.priorityClassName | string | `nil` | The priority class to use for ztunnel pods. |
+| encryption.ztunnel.readinessProbe | object | `{"failureThreshold":3,"initialDelaySeconds":0,"periodSeconds":10}` | Readiness probe configuration. |
+| encryption.ztunnel.resources | object | `{"requests":{"cpu":"200m","memory":"512Mi"}}` | ztunnel resource limits & requests. |
+| encryption.ztunnel.secrets | object | `{"bootstrapRootCert":null}` | ztunnel secrets configuration. |
+| encryption.ztunnel.secrets.bootstrapRootCert | string | `nil` | Base64-encoded bootstrap root certificate content. If not provided, the secret must be created manually before deploying. @schema type: [null, string] @schema |
+| encryption.ztunnel.terminationGracePeriodSeconds | int | `30` | Configure termination grace period for ztunnel DaemonSet. |
+| encryption.ztunnel.tolerations | list | `[{"effect":"NoSchedule","operator":"Exists"},{"key":"CriticalAddonsOnly","operator":"Exists"},{"effect":"NoExecute","operator":"Exists"}]` | Node tolerations for ztunnel scheduling. |
+| encryption.ztunnel.updateStrategy | object | `{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0},"type":"RollingUpdate"}` | ztunnel update strategy. |
 | endpointHealthChecking.enabled | bool | `true` | Enable connectivity health checking between virtual endpoints. |
 | endpointLockdownOnMapOverflow | bool | `false` | Enable endpoint lockdown on policy map overflow. |
+| endpointPolicyUpdateTimeoutDuration | string | `nil` | Max duration to wait for envoy to respond to configuration changes. Default "10s". |
 | endpointRoutes.enabled | bool | `false` | Enable use of per endpoint routes instead of routing via the cilium_host interface. |
 | eni.awsEnablePrefixDelegation | bool | `false` | Enable ENI prefix delegation |
 | eni.awsReleaseExcessIPs | bool | `false` | Release IPs not used from the ENI |
@@ -446,7 +470,7 @@ contributors across the globe, there is almost always someone available to help.
 | envoy.httpRetryCount | int | `3` | Maximum number of retries for each HTTP request |
 | envoy.httpUpstreamLingerTimeout | string | `nil` | Time in seconds to block Envoy worker thread while an upstream HTTP connection is closing. If set to 0, the connection is closed immediately (with TCP RST). If set to -1, the connection is closed asynchronously in the background. |
 | envoy.idleTimeoutDurationSeconds | int | `60` | Set Envoy upstream HTTP idle connection timeout seconds. Does not apply to connections with pending requests. Default 60s |
-| envoy.image | object | `{"digest":"sha256:8188114a2768b5f49d6ce58e168b20d765e0fbc64eee0d83241aa2b150ccd788","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.35.9-1770979049-232ed4a26881e4ab4f766f251f258ed424fff663","useDigest":true}` | Envoy container image. |
+| envoy.image | object | `{"digest":"sha256:ba0ab8adac082d50d525fd2c5ba096c8facea3a471561b7c61c7a5b9c2e0de0d","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.36.6-1776000132-2437d2edeaf4d9b56ef279bd0d71127440c067aa","useDigest":true}` | Envoy container image. |
 | envoy.initContainers | list | `[]` | Init containers added to the cilium Envoy DaemonSet. |
 | envoy.initialFetchTimeoutSeconds | int | `30` | Time in seconds after which the initial fetch on an xDS stream is considered timed out |
 | envoy.livenessProbe.enabled | bool | `true` | Enable liveness probe for cilium-envoy |
@@ -591,7 +615,7 @@ contributors across the globe, there is almost always someone available to help.
 | hubble.relay.extraVolumes | list | `[]` | Additional hubble-relay volumes. |
 | hubble.relay.gops.enabled | bool | `true` | Enable gops for hubble-relay |
 | hubble.relay.gops.port | int | `9893` | Configure gops listen port for hubble-relay |
-| hubble.relay.image | object | `{"digest":"sha256:d8c4e13bc36a56179292bb52bc6255379cb94cb873700d316ea3139b1bdb8165","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.19.1","useDigest":true}` | Hubble-relay container image. |
+| hubble.relay.image | object | `{"digest":"sha256:5ee21d57b6ef2aa6db67e603a735fdceb162454b352b7335b651456e308f681b","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.19.3","useDigest":true}` | Hubble-relay container image. |
 | hubble.relay.listenHost | string | `""` | Host to listen to. Specify an empty string to bind to all the interfaces. |
 | hubble.relay.listenPort | string | `"4245"` | Port to listen to. |
 | hubble.relay.logOptions | object | `{"format":null,"level":null}` | Logging configuration for hubble-relay. |
@@ -709,7 +733,7 @@ contributors across the globe, there is almost always someone available to help.
 | identityAllocationMode | string | `"crd"` | Method to use for identity allocation (`crd`, `kvstore` or `doublewrite-readkvstore` / `doublewrite-readcrd` for migrating between identity backends). |
 | identityChangeGracePeriod | string | `"5s"` | Time to wait before using new identity on endpoint identity change. |
 | identityManagementMode | string | `"agent"` | Control whether CiliumIdentities are created by the agent ("agent"), the operator ("operator") or both ("both"). "Both" should be used only to migrate between "agent" and "operator". Operator-managed identities is a beta feature. |
-| image | object | `{"digest":"sha256:41f1f74a0000de8656f1de4088ea00c8f2d49d6edea579034c73c5fd5fe01792","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.19.1","useDigest":true}` | Agent container image. |
+| image | object | `{"digest":"sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.19.3","useDigest":true}` | Agent container image. |
 | imagePullSecrets | list | `[]` | Configure image pull secrets for pulling container images |
 | ingressController.default | bool | `false` | Set cilium ingress controller to be the default ingress controller This will let cilium ingress controller route entries without ingress class set |
 | ingressController.defaultSecretName | string | `nil` | Default secret name for ingresses without .spec.tls[].secretName set. |
@@ -797,12 +821,13 @@ contributors across the globe, there is almost always someone available to help.
 | livenessProbe.failureThreshold | int | `10` | failure threshold of liveness probe |
 | livenessProbe.periodSeconds | int | `30` | interval between checks of the liveness probe |
 | livenessProbe.requireK8sConnectivity | bool | `false` | whether to require k8s connectivity as part of the check. |
-| loadBalancer | object | `{"acceleration":"disabled","l7":{"algorithm":"round_robin","backend":"disabled","ports":[]}}` | Configure service load balancing |
+| loadBalancer | object | `{"acceleration":"disabled","l7":{"algorithm":"round_robin","backend":"disabled","ports":[]},"serviceTopology":false}` | Configure service load balancing |
 | loadBalancer.acceleration | string | `"disabled"` | acceleration is the option to accelerate service handling via XDP Applicable values can be: disabled (do not use XDP), native (XDP BPF program is run directly out of the networking driver's early receive path), or best-effort (use native mode XDP acceleration on devices that support it). |
 | loadBalancer.l7 | object | `{"algorithm":"round_robin","backend":"disabled","ports":[]}` | L7 LoadBalancer |
 | loadBalancer.l7.algorithm | string | `"round_robin"` | Default LB algorithm The default LB algorithm to be used for services, which can be overridden by the service annotation (e.g. service.cilium.io/lb-l7-algorithm) Applicable values: round_robin, least_request, random |
 | loadBalancer.l7.backend | string | `"disabled"` | Enable L7 service load balancing via envoy proxy. The request to a k8s service, which has specific annotation e.g. service.cilium.io/lb-l7, will be forwarded to the local backend proxy to be load balanced to the service endpoints. Please refer to docs for supported annotations for more configuration.  Applicable values:   - envoy: Enable L7 load balancing via envoy proxy. This will automatically set enable-envoy-config as well.   - disabled: Disable L7 load balancing by way of service annotation. |
 | loadBalancer.l7.ports | list | `[]` | List of ports from service to be automatically redirected to above backend. Any service exposing one of these ports will be automatically redirected. Fine-grained control can be achieved by using the service annotation. |
+| loadBalancer.serviceTopology | bool | `false` | serviceTopology enables K8s Topology Aware Hints -based service endpoints filtering |
 | localRedirectPolicies.addressMatcherCIDRs | string | `nil` | Limit the allowed addresses in Address Matcher rule of Local Redirect Policies to the given CIDRs. @schema@ type: [null, array] @schema@ |
 | localRedirectPolicies.enabled | bool | `false` | Enable local redirect policies. |
 | localRedirectPolicy | bool | `false` | Enable Local Redirect Policy (deprecated, please use 'localRedirectPolicies.enabled' instead) |
@@ -860,7 +885,7 @@ contributors across the globe, there is almost always someone available to help.
 | operator.hostNetwork | bool | `true` | HostNetwork setting |
 | operator.identityGCInterval | string | `"15m0s"` | Interval for identity garbage collection. |
 | operator.identityHeartbeatTimeout | string | `"30m0s"` | Timeout for identity heartbeats. |
-| operator.image | object | `{"alibabacloudDigest":"sha256:837b12f4239e88ea5b4b5708ab982c319a94ee05edaecaafe5fd0e5b1962f554","awsDigest":"sha256:18913d05a6c4d205f0b7126c4723bb9ccbd4dc24403da46ed0f9f4bf2a142804","azureDigest":"sha256:82bce78603056e709d4c4e9f9ebb25c222c36d8a07f8c05381c2372d9078eca8","genericDigest":"sha256:e7278d763e448bf6c184b0682cf98cdca078d58a27e1b2f3c906792670aa211a","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.19.1","useDigest":true}` | cilium-operator image. |
+| operator.image | object | `{"alibabacloudDigest":"sha256:176321a65123373ff8c7823b25183102cbad98375e8d6c80b96d68b6e8491103","awsDigest":"sha256:a53dcbfb77282bf2ddd3abbe60f6d49762e7c1389a36cb35b71d504644a56640","azureDigest":"sha256:699c1571a3df1a98882ee13610d47cffb7b34ee7e8d276096db798a5f6c7e4cb","genericDigest":"sha256:205b09b0ed6accbf9fe688d312a9f0fcfc6a316fc081c23fbffb472af5dd62cd","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.19.3","useDigest":true}` | cilium-operator image. |
 | operator.nodeGCInterval | string | `"5m0s"` | Interval for cilium node garbage collection. |
 | operator.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for cilium-operator pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | operator.podAnnotations | object | `{}` | Annotations to be added to cilium-operator pods |
@@ -918,11 +943,11 @@ contributors across the globe, there is almost always someone available to help.
 | preflight.affinity | object | `{"podAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"k8s-app":"cilium"}},"topologyKey":"kubernetes.io/hostname"}]}}` | Affinity for cilium-preflight |
 | preflight.annotations | object | `{}` | Annotations to be added to all top-level preflight objects (resources under templates/cilium-preflight) |
 | preflight.enabled | bool | `false` | Enable Cilium pre-flight resources (required for upgrade) |
-| preflight.envoy.image | object | `{"digest":"sha256:8188114a2768b5f49d6ce58e168b20d765e0fbc64eee0d83241aa2b150ccd788","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.35.9-1770979049-232ed4a26881e4ab4f766f251f258ed424fff663","useDigest":true}` | Envoy pre-flight image. |
+| preflight.envoy.image | object | `{"digest":"sha256:ba0ab8adac082d50d525fd2c5ba096c8facea3a471561b7c61c7a5b9c2e0de0d","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.36.6-1776000132-2437d2edeaf4d9b56ef279bd0d71127440c067aa","useDigest":true}` | Envoy pre-flight image. |
 | preflight.extraEnv | list | `[]` | Additional preflight environment variables. |
 | preflight.extraVolumeMounts | list | `[]` | Additional preflight volumeMounts. |
 | preflight.extraVolumes | list | `[]` | Additional preflight volumes. |
-| preflight.image | object | `{"digest":"sha256:41f1f74a0000de8656f1de4088ea00c8f2d49d6edea579034c73c5fd5fe01792","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.19.1","useDigest":true}` | Cilium pre-flight image. |
+| preflight.image | object | `{"digest":"sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.19.3","useDigest":true}` | Cilium pre-flight image. |
 | preflight.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for preflight pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | preflight.podAnnotations | object | `{}` | Annotations to be added to preflight pods |
 | preflight.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
@@ -979,6 +1004,7 @@ contributors across the globe, there is almost always someone available to help.
 | serviceAccounts.corednsMCSAPI | object | `{"annotations":{},"automount":true,"create":true,"name":"cilium-coredns-mcsapi-autoconfig"}` | CorednsMCSAPI is used if clustermesh.mcsapi.corednsAutoConfigure.enabled=true |
 | serviceAccounts.hubblecertgen | object | `{"annotations":{},"automount":true,"create":true,"name":"hubble-generate-certs"}` | Hubblecertgen is used if hubble.tls.auto.method=cronJob |
 | serviceAccounts.nodeinit.enabled | bool | `false` | Enabled is temporary until https://github.com/cilium/cilium-cli/issues/1396 is implemented. Cilium CLI doesn't create the SAs for node-init, thus the workaround. Helm is not affected by this issue. Name and automount can be configured, if enabled is set to true. Otherwise, they are ignored. Enabled can be removed once the issue is fixed. Cilium-nodeinit DS must also be fixed. |
+| serviceAccounts.ztunnel | object | `{"annotations":{},"automount":false,"create":true,"name":"ztunnel-cilium"}` | Ztunnel is used if encryption.type=ztunnel |
 | serviceNoBackendResponse | string | `"reject"` | Configure what the response should be to traffic for a service without backends. Possible values:  - reject (default)  - drop |
 | sleepAfterInit | bool | `false` | Do not run Cilium agent when running with clean mode. Useful to completely uninstall Cilium as it will stop Cilium from starting and create artifacts in the node. |
 | socketLB | object | `{"enabled":false}` | Configure socket LB |
diff --git a/packages/system/cilium/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.yaml b/packages/system/cilium/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.yaml
index ea1d3bda..90ebf4ac 100644
--- a/packages/system/cilium/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.yaml
+++ b/packages/system/cilium/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.yaml
@@ -167,6 +167,8 @@ staticResources:
     circuitBreakers:
       thresholds:
       - maxRetries: {{ .Values.envoy.maxConcurrentRetries }}
+        maxConnections: {{ .Values.envoy.clusterMaxConnections }}
+        maxRequests: {{ .Values.envoy.clusterMaxRequests }}
     lbPolicy: "CLUSTER_PROVIDED"
     typedExtensionProtocolOptions:
       envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
@@ -183,6 +185,8 @@ staticResources:
     circuitBreakers:
       thresholds:
       - maxRetries: {{ .Values.envoy.maxConcurrentRetries }}
+        maxConnections: {{ .Values.envoy.clusterMaxConnections }}
+        maxRequests: {{ .Values.envoy.clusterMaxRequests }}
     lbPolicy: "CLUSTER_PROVIDED"
     typedExtensionProtocolOptions:
       envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
@@ -204,6 +208,8 @@ staticResources:
     circuitBreakers:
       thresholds:
       - maxRetries: {{ .Values.envoy.maxConcurrentRetries }}
+        maxConnections: {{ .Values.envoy.clusterMaxConnections }}
+        maxRequests: {{ .Values.envoy.clusterMaxRequests }}
     lbPolicy: "CLUSTER_PROVIDED"
     typedExtensionProtocolOptions:
       envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
@@ -220,6 +226,8 @@ staticResources:
     circuitBreakers:
       thresholds:
       - maxRetries: {{ .Values.envoy.maxConcurrentRetries }}
+        maxConnections: {{ .Values.envoy.clusterMaxConnections }}
+        maxRequests: {{ .Values.envoy.clusterMaxRequests }}
     lbPolicy: "CLUSTER_PROVIDED"
     typedExtensionProtocolOptions:
       envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
@@ -304,3 +312,4 @@ admin:
   address:
     pipe:
       path: "/var/run/cilium/envoy/sockets/admin.sock"
+      mode: 0660
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml b/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
index fa3afc14..fff1b384 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
@@ -546,7 +546,7 @@ spec:
           {{- toYaml .Values.initResources | trim | nindent 10 }}
         {{- end }}
         command:
-        - sh
+        - bash
         - -ec
         # The statically linked Go program binary is invoked to avoid any
         # dependency on utilities like sh and mount that can be missing on certain
@@ -592,7 +592,7 @@ spec:
         - name: BIN_PATH
           value: {{ .Values.cni.binPath }}
         command:
-        - sh
+        - bash
         - -ec
         # The statically linked Go program binary is invoked to avoid any
         # dependency on utilities like sh that can be missing on certain
@@ -660,7 +660,7 @@ spec:
           {{- toYaml . | trim | nindent 10 }}
         {{- end }}
         command:
-        - sh
+        - bash
         - -c
         - |
           until test -s {{ (print "/tmp/cilium-bootstrap.d/" (.Values.nodeinit.bootstrapFile | base)) | quote }}; do
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-configmap.yaml b/packages/system/cilium/charts/cilium/templates/cilium-configmap.yaml
index a3a38c09..5d76944d 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-configmap.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-configmap.yaml
@@ -464,6 +464,9 @@ data:
 {{- if has (kindOf .Values.bpf.policyMapPressureMetricsThreshold) (list "int64" "float64") }}
   bpf-policy-map-pressure-metrics-threshold: {{ .Values.bpf.policyMapPressureMetricsThreshold | quote }}
 {{- end }}
+{{- if .Values.endpointPolicyUpdateTimeoutDuration }}
+  endpoint-policy-update-timeout: {{ .Values.endpointPolicyUpdateTimeoutDuration | quote }}
+{{- end }}
 {{- if hasKey .Values.bpf "policyStatsMapMax" }}
   # bpf-policy-stats-map-max specifies the maximum number of entries in global
   # policy stats map
@@ -706,7 +709,6 @@ data:
   enable-ipv4-big-tcp: {{ .Values.enableIPv4BIGTCP | quote }}
   enable-ipv6-big-tcp: {{ .Values.enableIPv6BIGTCP | quote }}
   enable-ipv6-masquerade: {{ .Values.enableIPv6Masquerade | quote }}
-  enable-tunnel-big-tcp: {{ .Values.enableTunnelBIGTCP | quote }}
 
 {{- if hasKey .Values.bpf "enableTCX" }}
   enable-tcx: {{ .Values.bpf.enableTCX | quote }}
@@ -906,9 +908,9 @@ data:
 {{- end }}
 {{- if hasKey .Values.loadBalancer "serviceTopology" }}
   enable-service-topology: {{ .Values.loadBalancer.serviceTopology | quote }}
-# {{- end }}
-
 {{- end }}
+{{- end }}
+
 {{- if hasKey .Values.maglev "tableSize" }}
   bpf-lb-maglev-table-size: {{ .Values.maglev.tableSize | quote}}
 {{- end }}
@@ -1380,11 +1382,7 @@ data:
 
 {{- if .Values.operator.unmanagedPodWatcher.restart }}
   {{- $interval := .Values.operator.unmanagedPodWatcher.intervalSeconds }}
-  {{- if kindIs "float64" $interval }}
   unmanaged-pod-watcher-interval: {{ printf "%ds" (int $interval) | quote }}
-  {{- else }}
-  unmanaged-pod-watcher-interval: {{ $interval | quote }}
-  {{- end }}
 {{- else }}
   unmanaged-pod-watcher-interval: "0"
 {{- end }}
@@ -1517,6 +1515,14 @@ data:
   connectivity-probe-frequency-ratio: {{ .Values.connectivityProbeFrequencyRatio | quote }}
 {{- end }}
 
+{{- if hasKey .Values "configDriftDetection" }}
+  enable-dynamic-config: {{ .Values.configDriftDetection.enabled | quote }}
+  enable-drift-checker: {{ .Values.configDriftDetection.driftChecker | quote }}
+  {{- if .Values.configDriftDetection.ignoredKeys }}
+  ignore-flags-drift-checker: {{ join "," .Values.configDriftDetection.ignoredKeys | quote }}
+  {{- end }}
+{{- end }}
+
 # Extra config allows adding arbitrary properties to the cilium config.
 # By putting it at the end of the ConfigMap, it's also possible to override existing properties.
 {{- if .Values.extraConfig }}
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-operator/clusterrole.yaml b/packages/system/cilium/charts/cilium/templates/cilium-operator/clusterrole.yaml
index 96f72c7f..c147e2b5 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-operator/clusterrole.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-operator/clusterrole.yaml
@@ -407,6 +407,15 @@ rules:
   verbs:
   - update
   - patch
+- apiGroups:
+  - multicluster.x-k8s.io
+  resources:
+  # The controller needs to be able to set serviceimport finalizers to be able to create a derived Service
+  # resource that is owned by the ServiceImport and sets blockOwnerDeletion=true in its ownerRef.
+  # This is required when the admission plugin OwnerReferencesPermissionEnforcement is activated.
+  - serviceimports/finalizers
+  verbs:
+  - update
 - apiGroups:
   - multicluster.x-k8s.io
   resources:
diff --git a/packages/system/cilium/charts/cilium/templates/ztunnel/daemonset.yaml b/packages/system/cilium/charts/cilium/templates/ztunnel/daemonset.yaml
new file mode 100644
index 00000000..f9363068
--- /dev/null
+++ b/packages/system/cilium/charts/cilium/templates/ztunnel/daemonset.yaml
@@ -0,0 +1,165 @@
+{{- if and .Values.encryption.enabled (eq .Values.encryption.type "ztunnel") }}
+---
+kind: DaemonSet
+apiVersion: apps/v1
+metadata:
+  name: ztunnel-cilium
+  namespace: {{ include "cilium.namespace" . }}
+  {{- with .Values.encryption.ztunnel.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    app: ztunnel-cilium
+    app.kubernetes.io/part-of: cilium
+    app.kubernetes.io/name: ztunnel-cilium
+    {{- with .Values.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: ztunnel-cilium
+  {{- with .Values.encryption.ztunnel.updateStrategy }}
+  updateStrategy:
+    {{- toYaml . | trim | nindent 4 }}
+  {{- end }}
+  template:
+    metadata:
+      annotations:
+        sidecar.istio.io/inject: "false"
+        {{- with .Values.encryption.ztunnel.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      labels:
+        app: ztunnel-cilium
+        app.kubernetes.io/part-of: cilium
+        app.kubernetes.io/name: ztunnel-cilium
+        {{- with .Values.commonLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.encryption.ztunnel.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      hostNetwork: true
+      dnsPolicy: ClusterFirst
+      containers:
+        - name: istio-proxy
+          image: {{ include "cilium.image" .Values.encryption.ztunnel.image | quote }}
+          imagePullPolicy: {{ .Values.encryption.ztunnel.image.pullPolicy }}
+          args:
+            - proxy
+            - ztunnel
+          env:
+            - name: XDS_ADDRESS
+              value: "https://localhost:15012"
+            - name: XDS_ROOT_CA
+              value: "/etc/ztunnel/bootstrap-root.crt"
+            - name: CA_ROOT_CA
+              value: "/etc/ztunnel/bootstrap-root.crt"
+            - name: CA_ADDRESS
+              value: {{ .Values.encryption.ztunnel.caAddress | quote }}
+            - name: ISTIO_META_DNS_CAPTURE
+              value: "false"
+            - name: INPOD_UDS
+              value: "/var/run/cilium/ztunnel.sock"
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: status.hostIP
+            - name: INSTANCE_IP
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: status.podIP
+            - name: ISTIO_META_ENABLE_HBONE
+              value: "true"
+            {{- with .Values.encryption.ztunnel.extraEnv }}
+            {{- toYaml . | trim | nindent 12 }}
+            {{- end }}
+          readinessProbe:
+            httpGet:
+              path: /healthz/ready
+              port: {{ .Values.encryption.ztunnel.healthPort }}
+              host: "127.0.0.1"
+              scheme: HTTP
+            initialDelaySeconds: {{ .Values.encryption.ztunnel.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.encryption.ztunnel.readinessProbe.periodSeconds }}
+            failureThreshold: {{ .Values.encryption.ztunnel.readinessProbe.failureThreshold }}
+            successThreshold: 1
+            timeoutSeconds: 1
+          {{- with .Values.encryption.ztunnel.resources }}
+          resources:
+            {{- toYaml . | trim | nindent 12 }}
+          {{- end }}
+          securityContext:
+            allowPrivilegeEscalation: true
+            capabilities:
+              add:
+                - NET_ADMIN
+                - SYS_ADMIN
+                - NET_RAW
+              drop:
+                - ALL
+            privileged: false
+            readOnlyRootFilesystem: true
+            runAsGroup: 1337
+            runAsNonRoot: false
+            runAsUser: 0
+          terminationMessagePath: /dev/termination-log
+          terminationMessagePolicy: File
+          volumeMounts:
+            - mountPath: /var/run/cilium
+              name: cilium-dir
+              readOnly: false
+            - mountPath: /etc/ztunnel
+              name: cilium-ztunnel-secrets
+              readOnly: true
+            {{- with .Values.encryption.ztunnel.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+      {{- with .Values.encryption.ztunnel.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.encryption.ztunnel.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | trim | nindent 8 }}
+      {{- end }}
+      {{- with .Values.encryption.ztunnel.tolerations }}
+      tolerations:
+        {{- toYaml . | trim | nindent 8 }}
+      {{- end }}
+      priorityClassName: {{ include "cilium.priorityClass" (list $ .Values.encryption.ztunnel.priorityClassName "system-node-critical") }}
+      restartPolicy: Always
+      terminationGracePeriodSeconds: {{ .Values.encryption.ztunnel.terminationGracePeriodSeconds }}
+      {{- if .Values.serviceAccounts.ztunnel.create }}
+      serviceAccountName: {{ .Values.serviceAccounts.ztunnel.name | quote }}
+      automountServiceAccountToken: {{ .Values.serviceAccounts.ztunnel.automount }}
+      {{- else }}
+      automountServiceAccountToken: false
+      {{- end }}
+      volumes:
+        - name: cilium-dir
+          hostPath:
+            path: /var/run/cilium
+            type: DirectoryOrCreate
+        - name: cilium-ztunnel-secrets
+          secret:
+            secretName: cilium-ztunnel-secrets
+            defaultMode: 420
+            items:
+              - key: bootstrap-root.crt
+                path: bootstrap-root.crt
+                mode: 420
+        {{- with .Values.encryption.ztunnel.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+{{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/ztunnel/secret.yaml b/packages/system/cilium/charts/cilium/templates/ztunnel/secret.yaml
new file mode 100644
index 00000000..520857dc
--- /dev/null
+++ b/packages/system/cilium/charts/cilium/templates/ztunnel/secret.yaml
@@ -0,0 +1,23 @@
+{{- if and .Values.encryption.enabled (eq .Values.encryption.type "ztunnel") }}
+{{- if .Values.encryption.ztunnel.secrets.bootstrapRootCert }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cilium-ztunnel-secrets
+  namespace: {{ include "cilium.namespace" . }}
+  {{- with .Values.encryption.ztunnel.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    app.kubernetes.io/part-of: cilium
+    app.kubernetes.io/name: ztunnel-cilium
+    {{- with .Values.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+type: Opaque
+data:
+  bootstrap-root.crt: {{ .Values.encryption.ztunnel.secrets.bootstrapRootCert | b64enc }}
+{{- end }}
+{{- end }}
diff --git a/packages/system/cilium/charts/cilium/templates/ztunnel/serviceaccount.yaml b/packages/system/cilium/charts/cilium/templates/ztunnel/serviceaccount.yaml
new file mode 100644
index 00000000..4ef9e2bc
--- /dev/null
+++ b/packages/system/cilium/charts/cilium/templates/ztunnel/serviceaccount.yaml
@@ -0,0 +1,21 @@
+{{- if and .Values.encryption.enabled (eq .Values.encryption.type "ztunnel") .Values.serviceAccounts.ztunnel.create }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.serviceAccounts.ztunnel.name | quote }}
+  namespace: {{ include "cilium.namespace" . }}
+  {{- with .Values.commonLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- if or .Values.serviceAccounts.ztunnel.annotations .Values.encryption.ztunnel.annotations }}
+  annotations:
+    {{- with .Values.encryption.ztunnel.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.serviceAccounts.ztunnel.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end }}
diff --git a/packages/system/cilium/charts/cilium/values.schema.json b/packages/system/cilium/charts/cilium/values.schema.json
index d18566d7..65c84af5 100644
--- a/packages/system/cilium/charts/cilium/values.schema.json
+++ b/packages/system/cilium/charts/cilium/values.schema.json
@@ -1714,6 +1714,21 @@
         "object"
       ]
     },
+    "configDriftDetection": {
+      "properties": {
+        "driftChecker": {
+          "type": "boolean"
+        },
+        "enabled": {
+          "type": "boolean"
+        },
+        "ignoredKeys": {
+          "items": {},
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
     "connectivityProbeFrequencyRatio": {
       "type": [
         "null",
@@ -1898,9 +1913,6 @@
     "enableNonDefaultDenyPolicies": {
       "type": "boolean"
     },
-    "enableTunnelBIGTCP": {
-      "type": "boolean"
-    },
     "enableXTSocketFallback": {
       "type": "boolean"
     },
@@ -1984,6 +1996,184 @@
             }
           },
           "type": "object"
+        },
+        "ztunnel": {
+          "properties": {
+            "affinity": {
+              "type": "object"
+            },
+            "annotations": {
+              "type": "object"
+            },
+            "caAddress": {
+              "type": "string"
+            },
+            "extraEnv": {
+              "items": {},
+              "type": "array"
+            },
+            "extraVolumeMounts": {
+              "items": {},
+              "type": "array"
+            },
+            "extraVolumes": {
+              "items": {},
+              "type": "array"
+            },
+            "healthPort": {
+              "type": "integer"
+            },
+            "image": {
+              "properties": {
+                "digest": {
+                  "type": [
+                    "null",
+                    "string"
+                  ]
+                },
+                "override": {
+                  "type": [
+                    "null",
+                    "string"
+                  ]
+                },
+                "pullPolicy": {
+                  "type": "string"
+                },
+                "repository": {
+                  "type": "string"
+                },
+                "tag": {
+                  "type": "string"
+                },
+                "useDigest": {
+                  "type": "boolean"
+                }
+              },
+              "type": "object"
+            },
+            "nodeSelector": {
+              "properties": {
+                "kubernetes.io/os": {
+                  "type": "string"
+                }
+              },
+              "type": "object"
+            },
+            "podAnnotations": {
+              "type": "object"
+            },
+            "podLabels": {
+              "type": "object"
+            },
+            "priorityClassName": {
+              "type": [
+                "null",
+                "string"
+              ]
+            },
+            "readinessProbe": {
+              "properties": {
+                "failureThreshold": {
+                  "type": "integer"
+                },
+                "initialDelaySeconds": {
+                  "type": "integer"
+                },
+                "periodSeconds": {
+                  "type": "integer"
+                }
+              },
+              "type": "object"
+            },
+            "resources": {
+              "properties": {
+                "requests": {
+                  "properties": {
+                    "cpu": {
+                      "type": "string"
+                    },
+                    "memory": {
+                      "type": "string"
+                    }
+                  },
+                  "type": "object"
+                }
+              },
+              "type": "object"
+            },
+            "secrets": {
+              "properties": {
+                "bootstrapRootCert": {
+                  "type": [
+                    "null",
+                    "string"
+                  ]
+                }
+              },
+              "type": "object"
+            },
+            "terminationGracePeriodSeconds": {
+              "type": "integer"
+            },
+            "tolerations": {
+              "items": {
+                "anyOf": [
+                  {
+                    "properties": {
+                      "effect": {
+                        "type": "string"
+                      },
+                      "operator": {
+                        "type": "string"
+                      }
+                    }
+                  },
+                  {
+                    "properties": {
+                      "key": {
+                        "type": "string"
+                      },
+                      "operator": {
+                        "type": "string"
+                      }
+                    }
+                  },
+                  {
+                    "properties": {
+                      "effect": {
+                        "type": "string"
+                      },
+                      "operator": {
+                        "type": "string"
+                      }
+                    }
+                  }
+                ]
+              },
+              "type": "array"
+            },
+            "updateStrategy": {
+              "properties": {
+                "rollingUpdate": {
+                  "properties": {
+                    "maxSurge": {
+                      "type": "integer"
+                    },
+                    "maxUnavailable": {
+                      "type": "integer"
+                    }
+                  },
+                  "type": "object"
+                },
+                "type": {
+                  "type": "string"
+                }
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
         }
       },
       "type": "object"
@@ -1999,6 +2189,9 @@
     "endpointLockdownOnMapOverflow": {
       "type": "boolean"
     },
+    "endpointPolicyUpdateTimeoutDuration": {
+      "type": "null"
+    },
     "endpointRoutes": {
       "properties": {
         "enabled": {
@@ -4484,6 +4677,9 @@
             }
           },
           "type": "object"
+        },
+        "serviceTopology": {
+          "type": "boolean"
         }
       },
       "type": "object"
@@ -6029,6 +6225,23 @@
             }
           },
           "type": "object"
+        },
+        "ztunnel": {
+          "properties": {
+            "annotations": {
+              "type": "object"
+            },
+            "automount": {
+              "type": "boolean"
+            },
+            "create": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "string"
+            }
+          },
+          "type": "object"
         }
       },
       "type": "object"
diff --git a/packages/system/cilium/charts/cilium/values.yaml b/packages/system/cilium/charts/cilium/values.yaml
index b9b30830..66f76982 100644
--- a/packages/system/cilium/charts/cilium/values.yaml
+++ b/packages/system/cilium/charts/cilium/values.yaml
@@ -210,6 +210,12 @@ serviceAccounts:
     name: cilium-coredns-mcsapi-autoconfig
     automount: true
     annotations: {}
+  # -- Ztunnel is used if encryption.type=ztunnel
+  ztunnel:
+    create: true
+    name: ztunnel-cilium
+    automount: false
+    annotations: {}
 # -- Configure termination grace period for cilium-agent DaemonSet.
 terminationGracePeriodSeconds: 1
 # -- Install the cilium agent resources.
@@ -218,6 +224,22 @@ agent: true
 name: cilium
 # -- Roll out cilium agent pods automatically when configmap is updated.
 rollOutCiliumPods: false
+# -- Configuration for the ConfigMap drift detection feature.
+# When enabled, the agent continuously watches the cilium-config ConfigMap
+# and exposes a cilium_drift_checker_config_delta Prometheus metric reporting
+# the number of keys that differ between the ConfigMap and the agent's active
+# settings. A non-zero value indicates that the agent has not yet applied all
+# current ConfigMap changes and needs to be restarted.
+configDriftDetection:
+  # -- Enable watching of the cilium-config ConfigMap and reflecting its
+  # contents into the agent's internal DynamicConfig table.
+  enabled: true
+  # -- Enable the drift checker which compares the DynamicConfig table against
+  # the agent's active settings and publishes the
+  # cilium_drift_checker_config_delta metric.
+  driftChecker: true
+  # -- List of config-map keys to ignore when computing the drift delta.
+  ignoredKeys: []
 # -- Agent container image.
 image:
   # @schema
@@ -225,10 +247,10 @@ image:
   # @schema
   override: ~
   repository: "quay.io/cilium/cilium"
-  tag: "v1.19.1"
+  tag: "v1.19.3"
   pullPolicy: "IfNotPresent"
   # cilium-digest
-  digest: sha256:41f1f74a0000de8656f1de4088ea00c8f2d49d6edea579034c73c5fd5fe01792
+  digest: sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10
   useDigest: true
 # -- Scheduling configurations for cilium pods
 scheduling:
@@ -1133,9 +1155,89 @@ encryption:
   wireguard:
     # -- Controls WireGuard PersistentKeepalive option. Set 0s to disable.
     persistentKeepalive: 0s
+  # -- ztunnel encryption configuration.
+  # ztunnel is Istio's purpose-built, per-node proxy for handling L4 traffic in ambient mesh mode.
+  # These settings only apply when encryption.type is set to "ztunnel".
+  ztunnel:
+    # -- ztunnel container image.
+    image:
+      # @schema
+      # type: [null, string]
+      # @schema
+      override: ~
+      repository: "docker.io/istio/ztunnel"
+      tag: "1.28.0-distroless"
+      pullPolicy: "IfNotPresent"
+      # @schema
+      # type: [null, string]
+      # @schema
+      digest: ~
+      useDigest: false
+    # -- CA server address for certificate requests.
+    caAddress: "https://localhost:15012"
+    # -- TCP port for the health API.
+    healthPort: 15021
+    # -- ztunnel resource limits & requests.
+    resources:
+      requests:
+        cpu: 200m
+        memory: 512Mi
+    # -- ztunnel update strategy.
+    updateStrategy:
+      type: RollingUpdate
+      rollingUpdate:
+        maxSurge: 1
+        maxUnavailable: 0
+    # -- Configure termination grace period for ztunnel DaemonSet.
+    terminationGracePeriodSeconds: 30
+    # -- Readiness probe configuration.
+    readinessProbe:
+      initialDelaySeconds: 0
+      periodSeconds: 10
+      failureThreshold: 3
+    # -- Node selector for ztunnel pods.
+    nodeSelector:
+      kubernetes.io/os: linux
+    # -- Node tolerations for ztunnel scheduling.
+    tolerations:
+      - effect: NoSchedule
+        operator: Exists
+      - key: CriticalAddonsOnly
+        operator: Exists
+      - effect: NoExecute
+        operator: Exists
+    # -- Affinity for ztunnel pods.
+    affinity: {}
+    # @schema
+    # type: [null, string]
+    # @schema
+    # -- The priority class to use for ztunnel pods.
+    priorityClassName: ~
+    # -- Annotations to be added to all ztunnel resources.
+    annotations: {}
+    # -- Annotations to be added to ztunnel pods.
+    podAnnotations: {}
+    # -- Labels to be added to ztunnel pods.
+    podLabels: {}
+    # -- Additional ztunnel container environment variables.
+    extraEnv: []
+    # -- Additional ztunnel volumes.
+    extraVolumes: []
+    # -- Additional ztunnel volumeMounts.
+    extraVolumeMounts: []
+    # -- ztunnel secrets configuration.
+    secrets:
+      # -- Base64-encoded bootstrap root certificate content.
+      # If not provided, the secret must be created manually before deploying.
+      # @schema
+      # type: [null, string]
+      # @schema
+      bootstrapRootCert: ~
 endpointHealthChecking:
   # -- Enable connectivity health checking between virtual endpoints.
   enabled: true
+# -- Max duration to wait for envoy to respond to configuration changes. Default "10s".
+endpointPolicyUpdateTimeoutDuration: null
 endpointRoutes:
   # @schema
   # type: [boolean, string]
@@ -1250,8 +1352,8 @@ certgen:
     # @schema
     override: ~
     repository: "quay.io/cilium/certgen"
-    tag: "v0.3.2"
-    digest: "sha256:19921f48ee7e2295ea4dca955878a6cd8d70e6d4219d08f688e866ece9d95d4d"
+    tag: "v0.4.1"
+    digest: "sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697"
     useDigest: true
     pullPolicy: "IfNotPresent"
   # @schema
@@ -1599,9 +1701,9 @@ hubble:
       # @schema
       override: ~
       repository: "quay.io/cilium/hubble-relay"
-      tag: "v1.19.1"
+      tag: "v1.19.3"
       # hubble-relay-digest
-      digest: sha256:d8c4e13bc36a56179292bb52bc6255379cb94cb873700d316ea3139b1bdb8165
+      digest: sha256:5ee21d57b6ef2aa6db67e603a735fdceb162454b352b7335b651456e308f681b
       useDigest: true
       pullPolicy: "IfNotPresent"
     # -- Specifies the resources for the hubble-relay pods
@@ -2313,8 +2415,6 @@ enableMasqueradeRouteSource: false
 enableIPv4BIGTCP: false
 # -- Enables IPv6 BIG TCP support which increases maximum IPv6 GSO/GRO limits for nodes and pods
 enableIPv6BIGTCP: false
-# -- Enable BIG TCP in tunneling mode and increase maximum GRO/GSO limits for VXLAN/GENEVE tunnels
-enableTunnelBIGTCP: false
 nat:
   # -- Number of the top-k SNAT map connections to track in Cilium statedb.
   mapStatsEntries: 32
@@ -2392,8 +2492,7 @@ loadBalancer:
 
   # -- serviceTopology enables K8s Topology Aware Hints -based service
   # endpoints filtering
-  # serviceTopology: false
-
+  serviceTopology: false
   # -- L7 LoadBalancer
   l7:
     # -- Enable L7 service load balancing via envoy proxy.
@@ -2626,9 +2725,9 @@ envoy:
     # @schema
     override: ~
     repository: "quay.io/cilium/cilium-envoy"
-    tag: "v1.35.9-1770979049-232ed4a26881e4ab4f766f251f258ed424fff663"
+    tag: "v1.36.6-1776000132-2437d2edeaf4d9b56ef279bd0d71127440c067aa"
     pullPolicy: "IfNotPresent"
-    digest: "sha256:8188114a2768b5f49d6ce58e168b20d765e0fbc64eee0d83241aa2b150ccd788"
+    digest: "sha256:ba0ab8adac082d50d525fd2c5ba096c8facea3a471561b7c61c7a5b9c2e0de0d"
     useDigest: true
   # -- Init containers added to the cilium Envoy DaemonSet.
   initContainers: []
@@ -3011,15 +3110,15 @@ operator:
     # @schema
     override: ~
     repository: "quay.io/cilium/operator"
-    tag: "v1.19.1"
+    tag: "v1.19.3"
     # operator-generic-digest
-    genericDigest: sha256:e7278d763e448bf6c184b0682cf98cdca078d58a27e1b2f3c906792670aa211a
+    genericDigest: sha256:205b09b0ed6accbf9fe688d312a9f0fcfc6a316fc081c23fbffb472af5dd62cd
     # operator-azure-digest
-    azureDigest: sha256:82bce78603056e709d4c4e9f9ebb25c222c36d8a07f8c05381c2372d9078eca8
+    azureDigest: sha256:699c1571a3df1a98882ee13610d47cffb7b34ee7e8d276096db798a5f6c7e4cb
     # operator-aws-digest
-    awsDigest: sha256:18913d05a6c4d205f0b7126c4723bb9ccbd4dc24403da46ed0f9f4bf2a142804
+    awsDigest: sha256:a53dcbfb77282bf2ddd3abbe60f6d49762e7c1389a36cb35b71d504644a56640
     # operator-alibabacloud-digest
-    alibabacloudDigest: sha256:837b12f4239e88ea5b4b5708ab982c319a94ee05edaecaafe5fd0e5b1962f554
+    alibabacloudDigest: sha256:176321a65123373ff8c7823b25183102cbad98375e8d6c80b96d68b6e8491103
     useDigest: true
     pullPolicy: "IfNotPresent"
     suffix: ""
@@ -3344,9 +3443,9 @@ preflight:
     # @schema
     override: ~
     repository: "quay.io/cilium/cilium"
-    tag: "v1.19.1"
+    tag: "v1.19.3"
     # cilium-digest
-    digest: sha256:41f1f74a0000de8656f1de4088ea00c8f2d49d6edea579034c73c5fd5fe01792
+    digest: sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10
     useDigest: true
     pullPolicy: "IfNotPresent"
   envoy:
@@ -3357,9 +3456,9 @@ preflight:
       # @schema
       override: ~
       repository: "quay.io/cilium/cilium-envoy"
-      tag: "v1.35.9-1770979049-232ed4a26881e4ab4f766f251f258ed424fff663"
+      tag: "v1.36.6-1776000132-2437d2edeaf4d9b56ef279bd0d71127440c067aa"
       pullPolicy: "IfNotPresent"
-      digest: "sha256:8188114a2768b5f49d6ce58e168b20d765e0fbc64eee0d83241aa2b150ccd788"
+      digest: "sha256:ba0ab8adac082d50d525fd2c5ba096c8facea3a471561b7c61c7a5b9c2e0de0d"
       useDigest: true
   # -- The priority class to use for the preflight pod.
   priorityClassName: ""
@@ -3603,9 +3702,9 @@ clustermesh:
       # @schema
       override: ~
       repository: "quay.io/cilium/clustermesh-apiserver"
-      tag: "v1.19.1"
+      tag: "v1.19.3"
       # clustermesh-apiserver-digest
-      digest: sha256:56d6c3dc13b50126b80ecb571707a0ea97f6db694182b9d61efd386d04e5bb28
+      digest: sha256:a8136a7615d6c6041d3aa6f2674d17beaec238170d669507ccc05328a778e2b7
       useDigest: true
       pullPolicy: "IfNotPresent"
     # -- TCP port for the clustermesh-apiserver health API.
@@ -4140,7 +4239,7 @@ authentication:
           override: ~
           repository: "docker.io/library/busybox"
           tag: "1.37.0"
-          digest: "sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f"
+          digest: "sha256:1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e"
           useDigest: true
           pullPolicy: "IfNotPresent"
         # SPIRE agent configuration
diff --git a/packages/system/cilium/charts/cilium/values.yaml.tmpl b/packages/system/cilium/charts/cilium/values.yaml.tmpl
index c21f1c26..8039b40c 100644
--- a/packages/system/cilium/charts/cilium/values.yaml.tmpl
+++ b/packages/system/cilium/charts/cilium/values.yaml.tmpl
@@ -213,6 +213,12 @@ serviceAccounts:
     name: cilium-coredns-mcsapi-autoconfig
     automount: true
     annotations: {}
+  # -- Ztunnel is used if encryption.type=ztunnel
+  ztunnel:
+    create: true
+    name: ztunnel-cilium
+    automount: false
+    annotations: {}
 # -- Configure termination grace period for cilium-agent DaemonSet.
 terminationGracePeriodSeconds: 1
 # -- Install the cilium agent resources.
@@ -221,6 +227,22 @@ agent: true
 name: cilium
 # -- Roll out cilium agent pods automatically when configmap is updated.
 rollOutCiliumPods: false
+# -- Configuration for the ConfigMap drift detection feature.
+# When enabled, the agent continuously watches the cilium-config ConfigMap
+# and exposes a cilium_drift_checker_config_delta Prometheus metric reporting
+# the number of keys that differ between the ConfigMap and the agent's active
+# settings. A non-zero value indicates that the agent has not yet applied all
+# current ConfigMap changes and needs to be restarted.
+configDriftDetection:
+  # -- Enable watching of the cilium-config ConfigMap and reflecting its
+  # contents into the agent's internal DynamicConfig table.
+  enabled: true
+  # -- Enable the drift checker which compares the DynamicConfig table against
+  # the agent's active settings and publishes the
+  # cilium_drift_checker_config_delta metric.
+  driftChecker: true
+  # -- List of config-map keys to ignore when computing the drift delta.
+  ignoredKeys: []
 # -- Agent container image.
 image:
   # @schema
@@ -1148,9 +1170,89 @@ encryption:
   wireguard:
     # -- Controls WireGuard PersistentKeepalive option. Set 0s to disable.
     persistentKeepalive: 0s
+  # -- ztunnel encryption configuration.
+  # ztunnel is Istio's purpose-built, per-node proxy for handling L4 traffic in ambient mesh mode.
+  # These settings only apply when encryption.type is set to "ztunnel".
+  ztunnel:
+    # -- ztunnel container image.
+    image:
+      # @schema
+      # type: [null, string]
+      # @schema
+      override: ~
+      repository: "docker.io/istio/ztunnel"
+      tag: "1.28.0-distroless"
+      pullPolicy: "IfNotPresent"
+      # @schema
+      # type: [null, string]
+      # @schema
+      digest: ~
+      useDigest: false
+    # -- CA server address for certificate requests.
+    caAddress: "https://localhost:15012"
+    # -- TCP port for the health API.
+    healthPort: 15021
+    # -- ztunnel resource limits & requests.
+    resources:
+      requests:
+        cpu: 200m
+        memory: 512Mi
+    # -- ztunnel update strategy.
+    updateStrategy:
+      type: RollingUpdate
+      rollingUpdate:
+        maxSurge: 1
+        maxUnavailable: 0
+    # -- Configure termination grace period for ztunnel DaemonSet.
+    terminationGracePeriodSeconds: 30
+    # -- Readiness probe configuration.
+    readinessProbe:
+      initialDelaySeconds: 0
+      periodSeconds: 10
+      failureThreshold: 3
+    # -- Node selector for ztunnel pods.
+    nodeSelector:
+      kubernetes.io/os: linux
+    # -- Node tolerations for ztunnel scheduling.
+    tolerations:
+      - effect: NoSchedule
+        operator: Exists
+      - key: CriticalAddonsOnly
+        operator: Exists
+      - effect: NoExecute
+        operator: Exists
+    # -- Affinity for ztunnel pods.
+    affinity: {}
+    # @schema
+    # type: [null, string]
+    # @schema
+    # -- The priority class to use for ztunnel pods.
+    priorityClassName: ~
+    # -- Annotations to be added to all ztunnel resources.
+    annotations: {}
+    # -- Annotations to be added to ztunnel pods.
+    podAnnotations: {}
+    # -- Labels to be added to ztunnel pods.
+    podLabels: {}
+    # -- Additional ztunnel container environment variables.
+    extraEnv: []
+    # -- Additional ztunnel volumes.
+    extraVolumes: []
+    # -- Additional ztunnel volumeMounts.
+    extraVolumeMounts: []
+    # -- ztunnel secrets configuration.
+    secrets:
+      # -- Base64-encoded bootstrap root certificate content.
+      # If not provided, the secret must be created manually before deploying.
+      # @schema
+      # type: [null, string]
+      # @schema
+      bootstrapRootCert: ~
 endpointHealthChecking:
   # -- Enable connectivity health checking between virtual endpoints.
   enabled: true
+# -- Max duration to wait for envoy to respond to configuration changes. Default "10s".
+endpointPolicyUpdateTimeoutDuration: null
 endpointRoutes:
   # @schema
   # type: [boolean, string]
@@ -2339,8 +2441,6 @@ enableMasqueradeRouteSource: false
 enableIPv4BIGTCP: false
 # -- Enables IPv6 BIG TCP support which increases maximum IPv6 GSO/GRO limits for nodes and pods
 enableIPv6BIGTCP: false
-# -- Enable BIG TCP in tunneling mode and increase maximum GRO/GSO limits for VXLAN/GENEVE tunnels
-enableTunnelBIGTCP: false
 
 nat:
   # -- Number of the top-k SNAT map connections to track in Cilium statedb.
@@ -2420,7 +2520,7 @@ loadBalancer:
 
   # -- serviceTopology enables K8s Topology Aware Hints -based service
   # endpoints filtering
-  # serviceTopology: false
+  serviceTopology: false
 
   # -- L7 LoadBalancer
   l7:
diff --git a/packages/system/cilium/images/cilium/Dockerfile b/packages/system/cilium/images/cilium/Dockerfile
index b62f9b46..32fc6fb8 100644
--- a/packages/system/cilium/images/cilium/Dockerfile
+++ b/packages/system/cilium/images/cilium/Dockerfile
@@ -1,2 +1,2 @@
-ARG VERSION=v1.19.1
+ARG VERSION=v1.19.3
 FROM quay.io/cilium/cilium:${VERSION}

From a78505e932650d6dcdab69feb01f6bb3c24f4807 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 23 Apr 2026 13:50:06 +0300
Subject: [PATCH 586/666] chore(cilium): refresh image digest for v1.19.3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Built ghcr.io/cozystack/cozystack/cilium from the refreshed upstream
v1.19.3 base image and updated values.yaml with the new digest.

Previously values.yaml still pointed at the v1.19.1 cozystack rebuild
by digest while Chart.yaml and the Dockerfile were on v1.19.3 — with
chart default useDigest=true that would have silently pulled v1.19.1
until the next release-tag rebuild.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/cilium/values.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml
index cfb2cd6b..c1da6c38 100644
--- a/packages/system/cilium/values.yaml
+++ b/packages/system/cilium/values.yaml
@@ -15,8 +15,8 @@ cilium:
     mode: "kubernetes"
   image:
     repository: ghcr.io/cozystack/cozystack/cilium
-    tag: 1.19.1
-    digest: "sha256:ab3acf270821df4614a8456348a4e0d3098aed72a4b2016a0edfa30d91428c3d"
+    tag: latest
+    digest: "sha256:8f5ab52982fc848ee098ff89919e3528aa8f3a553b82106a25149dcd0b87ea7e"
   envoy:
     enabled: false
   rollOutCiliumPods: true

From 3f36a1b45b2406bc70ab49b4799d45ee88868e48 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 23 Apr 2026 17:14:23 +0300
Subject: [PATCH 587/666] fix(cilium): rebuild image multi-arch and pin tag to
 1.19.3

The previous image digest in values.yaml pointed at a single-arch
linux/arm64 manifest because 'make image' was run from an arm64 host
with the default buildx platform. Cozystack targets amd64 (Talos build
output, E2E runners, most real-world clusters) and also arm64 for
hybrid fleets, so Helm install would fail on amd64 nodes with 'no
matching manifest for linux/amd64 in the manifest list entries'
whenever somebody installed directly from this commit between merge
and the next release-tag CI rebuild.

Fix: rebuilt the image locally with
PLATFORM='linux/amd64,linux/arm64' make image from a buildx
docker-container driver, pushed the multi-arch manifest, and
refreshed values.yaml with:

- digest of the new multi-arch manifest list (verified via
  'docker manifest inspect': amd64 sha256:e1977323..., arm64
  sha256:8f5ab529...).
- tag bumped from 'latest' (emitted by the common-envs.mk settag
  macro on a non-tagged checkout) to '1.19.3', matching the
  established convention in every other packages/system/*/values.yaml
  so reviewers and incident response have a human-readable version
  anchor independent of digest chasing.

The Makefile is left untouched so the CI builder (which only uses the
default docker driver) keeps building single-arch for whatever
architecture it runs on; multi-arch is a responsibility of the
release-tag pipeline or an explicit local rebuild.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/cilium/values.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml
index c1da6c38..9aba7cb9 100644
--- a/packages/system/cilium/values.yaml
+++ b/packages/system/cilium/values.yaml
@@ -15,8 +15,8 @@ cilium:
     mode: "kubernetes"
   image:
     repository: ghcr.io/cozystack/cozystack/cilium
-    tag: latest
-    digest: "sha256:8f5ab52982fc848ee098ff89919e3528aa8f3a553b82106a25149dcd0b87ea7e"
+    tag: 1.19.3
+    digest: "sha256:700f06f4803a838a8e830be5ace4650e3ad82bdefabfb2f4d110368d307a5efb"
   envoy:
     enabled: false
   rollOutCiliumPods: true

From adc7abe5c16fc81ce1c063d153d9a920c0aac097 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 23 Apr 2026 14:55:21 +0300
Subject: [PATCH 588/666] feat(ingress): add loadBalancer exposure mode via
 CiliumLoadBalancerIPPool

Service.spec.externalIPs is deprecated upstream in Kubernetes v1.36
(KEP-5707, kubernetes#137293). The AllowServiceExternalIPs feature gate
is expected to default to off around v1.40 and the implementation to
be removed around v1.43. For bare-metal installs that rely on
externalIPs today, cozystack needs a migration path.

This change adds an opt-in 'loadBalancer' exposure mode for the
ingress-nginx Service:

- New platform value 'publishing.exposure' (enum: externalIPs |
  loadBalancer, default externalIPs). Plumbed through cozystack-values
  into each tenant's ingress HelmRelease via the new 'expose-mode' key.
- Unknown values and loadBalancer with an empty externalIPs list fail
  the chart render with explicit error messages, rather than silently
  producing a broken Service.
- When exposure=loadBalancer and the current namespace matches
  publishing.ingressName, the Service becomes type: LoadBalancer with
  externalTrafficPolicy: Local.
- A new template renders a CiliumLoadBalancerIPPool whose blocks come
  from publishing.externalIPs (IPv4 addresses get /32, IPv6 addresses
  get /128) and whose serviceSelector uses Cilium's synthetic
  io.kubernetes.service.namespace key combined with the standard
  app.kubernetes.io/name: ingress-nginx label. No custom label is
  written to the Service itself, avoiding cross-tenant collisions from
  user-defined labels.

Default behaviour is unchanged: without opting in, the Service is
still ClusterIP + spec.externalIPs as today.

Scope: only ingress-nginx is migrated by this setting. Other cozystack
components that still write Service.spec.externalIPs directly (notably
the vpn app) must be migrated separately before the v1.40 feature gate
flip.

Tests: packages/extra/ingress/tests/exposure_test.yaml adds 13
helm-unittest cases covering both modes, IPv4/IPv6, empty-token
filtering, unknown-mode rejection, and the non-matching-namespace
fallback.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/core/platform/templates/apps.yaml    |   1 +
 packages/core/platform/values.yaml            |  35 +++
 packages/extra/ingress/Makefile               |   3 +
 packages/extra/ingress/README.md              |  14 +
 .../ingress/templates/cilium-lb-pool.yaml     |  25 ++
 .../ingress/templates/nginx-ingress.yaml      |  21 +-
 .../extra/ingress/tests/exposure_test.yaml    | 251 ++++++++++++++++++
 7 files changed, 348 insertions(+), 2 deletions(-)
 create mode 100644 packages/extra/ingress/templates/cilium-lb-pool.yaml
 create mode 100644 packages/extra/ingress/tests/exposure_test.yaml

diff --git a/packages/core/platform/templates/apps.yaml b/packages/core/platform/templates/apps.yaml
index 7ee0de52..6e1ae25a 100644
--- a/packages/core/platform/templates/apps.yaml
+++ b/packages/core/platform/templates/apps.yaml
@@ -30,6 +30,7 @@ stringData:
       expose-services: {{ .Values.publishing.exposedServices | join "," | quote }}
       expose-ingress: {{ .Values.publishing.ingressName | quote }}
       expose-external-ips: {{ .Values.publishing.externalIPs | join "," | quote }}
+      expose-mode: {{ .Values.publishing.exposure | default "externalIPs" | quote }}
       cluster-domain: {{ .Values.networking.clusterDomain | quote }}
       api-server-endpoint: {{ .Values.publishing.apiServerEndpoint | quote }}
       {{- with .Values.branding }}
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index f33926db..605e23bc 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -45,6 +45,41 @@ publishing:
     - cdi-uploadproxy
   apiServerEndpoint: "" # example: "https://api.example.org"
   externalIPs: []
+  # Exposure mode for the ingress-nginx Service. When "externalIPs" (current
+  # default) is selected, the Service is created as ClusterIP with
+  # Service.spec.externalIPs set from publishing.externalIPs. When
+  # "loadBalancer" is selected, the Service is type: LoadBalancer and a
+  # CiliumLoadBalancerIPPool makes those same addresses allocatable via LB IPAM.
+  #
+  # Service.spec.externalIPs is deprecated upstream in Kubernetes v1.36
+  # (KEP-5707). The AllowServiceExternalIPs feature gate is expected to default
+  # to false around v1.40 and the implementation removed around v1.43 — switch
+  # to "loadBalancer" before upgrading past v1.40.
+  #
+  # Caveats for the "loadBalancer" mode:
+  #   - publishing.externalIPs must contain at least one non-empty address,
+  #     otherwise the chart render fails with an explicit error (a LoadBalancer
+  #     Service without a pool would sit in <pending> forever).
+  #   - The ingress-nginx Service is created with externalTrafficPolicy: Local
+  #     to preserve the client source IP. Traffic arriving on a node that does
+  #     not host an ingress-nginx pod is dropped, so the external IP must be
+  #     routed to a node that runs the ingress pod (floating IP / keepalived /
+  #     upstream router / podAntiAffinity).
+  #   - Cilium does NOT announce the IP on its own unless L2 announcements or
+  #     BGP are enabled in the Cilium values (disabled by default in Cozystack).
+  #     This mode assumes the operator already routes the externalIPs to a
+  #     cluster node; enabling announcements is out of scope for this setting.
+  #   - Switching this value on a running cluster causes the ingress-nginx
+  #     Service to be recreated (the HelmRelease has upgrade.force: true and
+  #     the Service kind changes between ClusterIP and LoadBalancer). Expect a
+  #     brief interruption of ingress traffic during the flip.
+  #
+  # Scope: this setting only controls the ingress-nginx Service. Other
+  # cozystack components that currently write Service.spec.externalIPs directly
+  # (e.g. the vpn app at packages/apps/vpn/templates/service.yaml) are NOT
+  # migrated by flipping this value and must be addressed separately before
+  # the AllowServiceExternalIPs feature gate flips to off in ~v1.40.
+  exposure: externalIPs # "externalIPs" or "loadBalancer"
   certificates:
     solver: http01 # "http01" or "dns01"
     issuerName: letsencrypt-prod
diff --git a/packages/extra/ingress/Makefile b/packages/extra/ingress/Makefile
index 958ce484..65b53c03 100644
--- a/packages/extra/ingress/Makefile
+++ b/packages/extra/ingress/Makefile
@@ -10,3 +10,6 @@ get-cloudflare-ips:
 generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
 	../../../hack/update-crd.sh
+
+test:
+	helm unittest .
diff --git a/packages/extra/ingress/README.md b/packages/extra/ingress/README.md
index 0e786dfb..c541d8e9 100644
--- a/packages/extra/ingress/README.md
+++ b/packages/extra/ingress/README.md
@@ -14,3 +14,17 @@
 | `resources.memory` | Memory (RAM) available to each replica.                                                                                                 | `quantity` | `""`    |
 | `resourcesPreset`  | Default sizing preset used when `resources` is omitted.                                                                                 | `string`   | `micro` |
 
+
+## Exposure mode
+
+The ingress Service type is driven by the cluster-wide `publishing.exposure` value in the platform chart, not by any key in this package. Two modes exist:
+
+- `externalIPs` (default) has three rendered shapes:
+  - Release namespace matches `publishing.ingressName` AND `publishing.externalIPs` is non-empty → Service is `ClusterIP` with `Service.spec.externalIPs` set from that list and `externalTrafficPolicy: Cluster`.
+  - Release namespace matches `publishing.ingressName` but `publishing.externalIPs` is empty → Service falls back to `type: LoadBalancer` with `externalTrafficPolicy: Local`.
+  - Release namespace does not match `publishing.ingressName` (non-root tenants) → Service is `type: LoadBalancer` with `externalTrafficPolicy: Local`.
+  `Service.spec.externalIPs` is deprecated upstream in Kubernetes v1.36 (KEP-5707); plan migration before v1.40.
+- `loadBalancer` — Service is `type: LoadBalancer` with `externalTrafficPolicy: Local`, and a `CiliumLoadBalancerIPPool` makes the addresses in `publishing.externalIPs` allocatable via Cilium LB IPAM. Requires `publishing.externalIPs` to contain at least one non-empty address (render fails otherwise) and assumes the addresses are already routed to a cluster node (floating IP / upstream router). See the inline comment on `publishing.exposure` in the platform chart for full caveats, including the note that switching the value on a running cluster causes the ingress Service to be recreated.
+
+This setting only migrates ingress-nginx away from `Service.spec.externalIPs`. Other cozystack components that use the same deprecated field (e.g. the `vpn` app) must be migrated separately before Kubernetes v1.40 flips the `AllowServiceExternalIPs` feature gate off.
+
diff --git a/packages/extra/ingress/templates/cilium-lb-pool.yaml b/packages/extra/ingress/templates/cilium-lb-pool.yaml
new file mode 100644
index 00000000..a383922b
--- /dev/null
+++ b/packages/extra/ingress/templates/cilium-lb-pool.yaml
@@ -0,0 +1,25 @@
+{{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
+{{- $exposeMode := (index .Values._cluster "expose-mode") | default "externalIPs" }}
+{{- $exposeExternalIPs := (index .Values._cluster "expose-external-ips") | default "" | nospace }}
+{{- $exposeIPsList := list }}
+{{- range splitList "," $exposeExternalIPs }}
+  {{- $ip := . | trim }}
+  {{- if $ip }}
+    {{- $exposeIPsList = append $exposeIPsList $ip }}
+  {{- end }}
+{{- end }}
+{{- if and (eq $exposeMode "loadBalancer") (eq $exposeIngress .Release.Namespace) $exposeIPsList }}
+apiVersion: cilium.io/v2
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: {{ trimPrefix "tenant-" .Release.Namespace }}-ingress
+spec:
+  blocks:
+  {{- range $exposeIPsList }}
+  - cidr: {{ . }}/{{ if contains ":" . }}128{{ else }}32{{ end }}
+  {{- end }}
+  serviceSelector:
+    matchLabels:
+      "io.kubernetes.service.namespace": {{ .Release.Namespace | quote }}
+      "app.kubernetes.io/name": ingress-nginx
+{{- end }}
diff --git a/packages/extra/ingress/templates/nginx-ingress.yaml b/packages/extra/ingress/templates/nginx-ingress.yaml
index ca50d276..8e1f00fb 100644
--- a/packages/extra/ingress/templates/nginx-ingress.yaml
+++ b/packages/extra/ingress/templates/nginx-ingress.yaml
@@ -1,5 +1,19 @@
 {{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
 {{- $exposeExternalIPs := (index .Values._cluster "expose-external-ips") | default "" | nospace }}
+{{- $exposeMode := (index .Values._cluster "expose-mode") | default "externalIPs" }}
+{{- $exposeIPsList := list }}
+{{- range splitList "," $exposeExternalIPs }}
+  {{- $ip := . | trim }}
+  {{- if $ip }}
+    {{- $exposeIPsList = append $exposeIPsList $ip }}
+  {{- end }}
+{{- end }}
+{{- if not (has $exposeMode (list "externalIPs" "loadBalancer")) }}
+{{- fail (printf "unknown publishing.exposure mode %q: must be \"externalIPs\" or \"loadBalancer\"" $exposeMode) }}
+{{- end }}
+{{- if and (eq $exposeMode "loadBalancer") (eq $exposeIngress .Release.Namespace) (not $exposeIPsList) }}
+{{- fail "publishing.exposure=loadBalancer requires publishing.externalIPs to contain at least one non-empty address: the CiliumLoadBalancerIPPool has nothing to advertise and the Service would stay in <pending>." }}
+{{- end }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -41,9 +55,12 @@ spec:
           enabled: false
         {{- end }}
         service:
-          {{- if and (eq $exposeIngress .Release.Namespace) $exposeExternalIPs }}
+          {{- if and (eq $exposeIngress .Release.Namespace) (eq $exposeMode "loadBalancer") }}
+          type: LoadBalancer
+          externalTrafficPolicy: Local
+          {{- else if and (eq $exposeIngress .Release.Namespace) $exposeIPsList }}
           externalIPs:
-            {{- toYaml (splitList "," $exposeExternalIPs) | nindent 12 }}
+            {{- toYaml $exposeIPsList | nindent 12 }}
           type: ClusterIP
           externalTrafficPolicy: Cluster
           {{- else }}
diff --git a/packages/extra/ingress/tests/exposure_test.yaml b/packages/extra/ingress/tests/exposure_test.yaml
new file mode 100644
index 00000000..780e0715
--- /dev/null
+++ b/packages/extra/ingress/tests/exposure_test.yaml
@@ -0,0 +1,251 @@
+suite: ingress exposure modes
+templates:
+  - templates/nginx-ingress.yaml
+  - templates/cilium-lb-pool.yaml
+
+release:
+  name: ingress
+  namespace: tenant-root
+
+tests:
+  - it: default exposure (externalIPs) renders ClusterIP Service with spec.externalIPs and no CiliumLoadBalancerIPPool
+    set:
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10,192.0.2.11"
+    asserts:
+      - template: templates/nginx-ingress.yaml
+        equal:
+          path: spec.values.ingress-nginx.controller.service.type
+          value: ClusterIP
+      - template: templates/nginx-ingress.yaml
+        equal:
+          path: spec.values.ingress-nginx.controller.service.externalTrafficPolicy
+          value: Cluster
+      - template: templates/nginx-ingress.yaml
+        equal:
+          path: spec.values.ingress-nginx.controller.service.externalIPs
+          value:
+            - 192.0.2.10
+            - 192.0.2.11
+      - template: templates/nginx-ingress.yaml
+        notExists:
+          path: spec.values.ingress-nginx.controller.service.labels
+      - template: templates/cilium-lb-pool.yaml
+        hasDocuments:
+          count: 0
+
+  - it: legacy config without expose-mode falls back to externalIPs behavior
+    set:
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10"
+    asserts:
+      - template: templates/nginx-ingress.yaml
+        equal:
+          path: spec.values.ingress-nginx.controller.service.type
+          value: ClusterIP
+      - template: templates/cilium-lb-pool.yaml
+        hasDocuments:
+          count: 0
+
+  - it: externalIPs mode in a namespace other than publishing.ingressName renders LoadBalancer fallback without externalIPs
+    set:
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10"
+    release:
+      namespace: tenant-other
+    asserts:
+      - template: templates/nginx-ingress.yaml
+        equal:
+          path: spec.values.ingress-nginx.controller.service.type
+          value: LoadBalancer
+      - template: templates/nginx-ingress.yaml
+        equal:
+          path: spec.values.ingress-nginx.controller.service.externalTrafficPolicy
+          value: Local
+      - template: templates/nginx-ingress.yaml
+        notExists:
+          path: spec.values.ingress-nginx.controller.service.externalIPs
+      - template: templates/cilium-lb-pool.yaml
+        hasDocuments:
+          count: 0
+
+  - it: loadBalancer mode renders LoadBalancer Service with lb-pool label and a v2 CiliumLoadBalancerIPPool
+    set:
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10,192.0.2.11"
+        expose-mode: loadBalancer
+    asserts:
+      - template: templates/nginx-ingress.yaml
+        equal:
+          path: spec.values.ingress-nginx.controller.service.type
+          value: LoadBalancer
+      - template: templates/nginx-ingress.yaml
+        equal:
+          path: spec.values.ingress-nginx.controller.service.externalTrafficPolicy
+          value: Local
+      - template: templates/nginx-ingress.yaml
+        notExists:
+          path: spec.values.ingress-nginx.controller.service.labels
+      - template: templates/nginx-ingress.yaml
+        notExists:
+          path: spec.values.ingress-nginx.controller.service.externalIPs
+      - template: templates/cilium-lb-pool.yaml
+        hasDocuments:
+          count: 1
+      - template: templates/cilium-lb-pool.yaml
+        equal:
+          path: apiVersion
+          value: cilium.io/v2
+      - template: templates/cilium-lb-pool.yaml
+        equal:
+          path: kind
+          value: CiliumLoadBalancerIPPool
+      - template: templates/cilium-lb-pool.yaml
+        equal:
+          path: metadata.name
+          value: root-ingress
+      - template: templates/cilium-lb-pool.yaml
+        equal:
+          path: spec.blocks
+          value:
+            - cidr: 192.0.2.10/32
+            - cidr: 192.0.2.11/32
+      - template: templates/cilium-lb-pool.yaml
+        equal:
+          path: spec.serviceSelector.matchLabels["io.kubernetes.service.namespace"]
+          value: tenant-root
+      - template: templates/cilium-lb-pool.yaml
+        equal:
+          path: spec.serviceSelector.matchLabels["app.kubernetes.io/name"]
+          value: ingress-nginx
+
+  - it: loadBalancer mode with IPv6 address emits /128 CIDR
+    set:
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "2001:db8::1"
+        expose-mode: loadBalancer
+    asserts:
+      - template: templates/cilium-lb-pool.yaml
+        equal:
+          path: spec.blocks
+          value:
+            - cidr: 2001:db8::1/128
+
+  - it: loadBalancer mode with mixed IPv4 and IPv6 emits correct CIDR per family
+    set:
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10,2001:db8::1"
+        expose-mode: loadBalancer
+    asserts:
+      - template: templates/cilium-lb-pool.yaml
+        equal:
+          path: spec.blocks
+          value:
+            - cidr: 192.0.2.10/32
+            - cidr: 2001:db8::1/128
+
+  - it: loadBalancer mode without externalIPs fails chart render with explicit message
+    set:
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: ""
+        expose-mode: loadBalancer
+    asserts:
+      - template: templates/nginx-ingress.yaml
+        failedTemplate:
+          errorMessage: "publishing.exposure=loadBalancer requires publishing.externalIPs to contain at least one non-empty address: the CiliumLoadBalancerIPPool has nothing to advertise and the Service would stay in <pending>."
+
+  - it: unknown exposure mode is rejected with a clear error (case-sensitive enum)
+    set:
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10"
+        expose-mode: LoadBalancer
+    asserts:
+      - template: templates/nginx-ingress.yaml
+        failedTemplate:
+          errorMessage: "unknown publishing.exposure mode \"LoadBalancer\": must be \"externalIPs\" or \"loadBalancer\""
+
+  - it: another typo in exposure mode also fails
+    set:
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10"
+        expose-mode: loadbalancer
+    asserts:
+      - template: templates/nginx-ingress.yaml
+        failedTemplate:
+          errorMessage: "unknown publishing.exposure mode \"loadbalancer\": must be \"externalIPs\" or \"loadBalancer\""
+
+  - it: loadBalancer mode in a namespace other than publishing.ingressName falls back to LoadBalancer Service without pool
+    set:
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10"
+        expose-mode: loadBalancer
+    release:
+      namespace: tenant-other
+    asserts:
+      - template: templates/nginx-ingress.yaml
+        equal:
+          path: spec.values.ingress-nginx.controller.service.type
+          value: LoadBalancer
+      - template: templates/nginx-ingress.yaml
+        equal:
+          path: spec.values.ingress-nginx.controller.service.externalTrafficPolicy
+          value: Local
+      - template: templates/nginx-ingress.yaml
+        notExists:
+          path: spec.values.ingress-nginx.controller.service.labels
+      - template: templates/nginx-ingress.yaml
+        notExists:
+          path: spec.values.ingress-nginx.controller.service.externalIPs
+      - template: templates/cilium-lb-pool.yaml
+        hasDocuments:
+          count: 0
+
+  - it: loadBalancer mode filters out empty entries from externalIPs (trailing comma, leading comma)
+    set:
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10,,192.0.2.11,"
+        expose-mode: loadBalancer
+    asserts:
+      - template: templates/cilium-lb-pool.yaml
+        hasDocuments:
+          count: 1
+      - template: templates/cilium-lb-pool.yaml
+        equal:
+          path: spec.blocks
+          value:
+            - cidr: 192.0.2.10/32
+            - cidr: 192.0.2.11/32
+
+  - it: loadBalancer mode with only-empty externalIPs fails chart render (comma-only input)
+    set:
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: ",,"
+        expose-mode: loadBalancer
+    asserts:
+      - template: templates/nginx-ingress.yaml
+        failedTemplate:
+          errorMessage: "publishing.exposure=loadBalancer requires publishing.externalIPs to contain at least one non-empty address: the CiliumLoadBalancerIPPool has nothing to advertise and the Service would stay in <pending>."
+
+  - it: externalIPs mode also filters out empty entries (trailing comma)
+    set:
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10,"
+    asserts:
+      - template: templates/nginx-ingress.yaml
+        equal:
+          path: spec.values.ingress-nginx.controller.service.externalIPs
+          value:
+            - 192.0.2.10

From c34a9db6bd2d052e290cb550713369e82d1f3d0a Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 23 Apr 2026 17:59:49 +0300
Subject: [PATCH 589/666] docs(agents): broaden make generate example to apps
 packages

Address review feedback from coderabbitai on docs/agents/contributing.md:26:
Replace the hard-coded packages/extra/<name> path in the example with
packages/<apps-or-extra>/<name> so the example matches the preceding
text that describes both apps and extra packages.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 docs/agents/contributing.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/agents/contributing.md b/docs/agents/contributing.md
index 9626e81e..5b1c6ba5 100644
--- a/docs/agents/contributing.md
+++ b/docs/agents/contributing.md
@@ -21,8 +21,8 @@ Several files in each package are produced by `make generate` from `values.yaml`
 **Before committing edits to any of those sources**, run `make generate` inside the package and stage the full diff:
 
 ```bash
-make -C packages/extra/<name> generate
-git add packages/extra/<name>/ packages/system/<name>-rd/
+make -C packages/<apps-or-extra>/<name> generate
+git add packages/<apps-or-extra>/<name>/ packages/system/<name>-rd/
 ```
 
 The repo's pre-commit CI job runs `make generate` in every package and then `git diff --exit-code`. Any unstaged generator output fails the job with exit code 123 and blocks the PR. Also rerun `make generate` after a `git commit --amend` if the amended change touched any of the sources above.

From 41fd80711bbe4a3cdb12b3af0bcd8bfdd40993e5 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 23 Apr 2026 18:00:07 +0300
Subject: [PATCH 590/666] docs(agents): fix grammar in regen discovery hint

Address review feedback from gemini-code-assist on docs/agents/contributing.md:30:
Reword "likely to need regenerated" (regional construction) to
"likely needs to be regenerated" for standard technical prose.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 docs/agents/contributing.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/agents/contributing.md b/docs/agents/contributing.md
index 5b1c6ba5..cef12494 100644
--- a/docs/agents/contributing.md
+++ b/docs/agents/contributing.md
@@ -27,7 +27,7 @@ git add packages/<apps-or-extra>/<name>/ packages/system/<name>-rd/
 
 The repo's pre-commit CI job runs `make generate` in every package and then `git diff --exit-code`. Any unstaged generator output fails the job with exit code 123 and blocks the PR. Also rerun `make generate` after a `git commit --amend` if the amended change touched any of the sources above.
 
-To locate packages a WIP branch is likely to need regenerated:
+To locate packages a WIP branch likely needs to be regenerated:
 
 ```bash
 git diff --name-only | xargs -n1 dirname | sort -u | grep ^packages/

From 4813566a30fb60eca00ce0ac83254daabf65341f Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 23 Apr 2026 18:02:04 +0300
Subject: [PATCH 591/666] docs(agents): mark scopes list as illustrative
 examples

Address review feedback from gemini-code-assist on docs/agents/contributing.md:11:
Scope linters kept flagging valid scopes like 'agents' as unknown because
the list read as exhaustive. Annotate it as examples (not exhaustive) and
add 'agents' to the Other group so both humans and review bots stop
tripping on scopes that are already in regular use across the repo
history.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 docs/agents/contributing.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/agents/contributing.md b/docs/agents/contributing.md
index cef12494..658dab74 100644
--- a/docs/agents/contributing.md
+++ b/docs/agents/contributing.md
@@ -43,10 +43,10 @@ git commit --signoff -m "type(scope): brief description"
 
 **Types:** `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `build`, `ci`, `chore`
 
-**Scopes:**
+**Scopes** (e.g., not exhaustive — use any scope that names the component you are touching):
 - System: `dashboard`, `platform`, `cilium`, `kube-ovn`, `linstor`, `fluxcd`, `cluster-api`
 - Apps: `postgres`, `mariadb`, `redis`, `kafka`, `clickhouse`, `virtual-machine`, `kubernetes`
-- Other: `api`, `hack`, `tests`, `ci`, `docs`, `maintenance`
+- Other: `api`, `hack`, `tests`, `ci`, `docs`, `agents`, `maintenance`
 
 Breaking changes: append `!` after type/scope (`feat(api)!: ...`) or add a `BREAKING CHANGE:` footer.
 

From 64a3edff01533a0483db31686a6385dffa81ee55 Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Thu, 23 Apr 2026 18:13:10 +0300
Subject: [PATCH 592/666] fix(api): prevent IDOR in TenantNamespace Get and
 Watch handlers

Fixed two IDOR vulnerabilities allowing authenticated users to access
metadata of any tenant namespace without proper authorization.

Changes:
- Added hasAccessToNamespace() for efficient single-namespace access checks
- Get() now verifies access before returning namespace metadata
- Watch() filters events per-namespace with proper authorization
- Returns NotFound (not Forbidden) to prevent tenant enumeration

Performance optimization:
- hasAccessToNamespace() lists RoleBindings only in target namespace
  instead of listing all cluster RoleBindings (order of magnitude faster)
- Watch handler logs authorization errors for security audit

Additional fixes:
- Handle ServiceAccount subjects with empty namespace correctly
- Add klog error logging for failed authorization checks

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 pkg/registry/core/tenantnamespace/rest.go | 89 ++++++++++++++++++++++-
 1 file changed, 87 insertions(+), 2 deletions(-)

diff --git a/pkg/registry/core/tenantnamespace/rest.go b/pkg/registry/core/tenantnamespace/rest.go
index f1ed3fab..7724c0e1 100644
--- a/pkg/registry/core/tenantnamespace/rest.go
+++ b/pkg/registry/core/tenantnamespace/rest.go
@@ -24,6 +24,7 @@ import (
 	"k8s.io/apimachinery/pkg/watch"
 	"k8s.io/apiserver/pkg/endpoints/request"
 	"k8s.io/apiserver/pkg/registry/rest"
+	"k8s.io/klog/v2"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	corev1alpha1 "github.com/cozystack/cozystack/pkg/apis/core/v1alpha1"
@@ -123,8 +124,18 @@ func (r *REST) Get(
 		return nil, apierrors.NewNotFound(r.gvr.GroupResource(), name)
 	}
 
+	// Check if user has access to this namespace
+	hasAccess, err := r.hasAccessToNamespace(ctx, name)
+	if err != nil {
+		return nil, err
+	}
+	if !hasAccess {
+		// Return NotFound instead of Forbidden to prevent enumeration
+		return nil, apierrors.NewNotFound(r.gvr.GroupResource(), name)
+	}
+
 	ns := &corev1.Namespace{}
-	err := r.c.Get(ctx, types.NamespacedName{Namespace: "", Name: name}, ns, &client.GetOptions{Raw: opts})
+	err = r.c.Get(ctx, types.NamespacedName{Namespace: "", Name: name}, ns, &client.GetOptions{Raw: opts})
 	if err != nil {
 		return nil, err
 	}
@@ -189,6 +200,17 @@ func (r *REST) Watch(ctx context.Context, opts *metainternal.ListOptions) (watch
 				continue
 			}
 
+			// Check if user has access to this namespace
+			hasAccess, err := r.hasAccessToNamespace(ctx, ns.Name)
+			if err != nil {
+				klog.Errorf("Failed to check access for namespace %s in watch: %v", ns.Name, err)
+				continue
+			}
+			if !hasAccess {
+				// User doesn't have access, skip this event
+				continue
+			}
+
 			out := &corev1alpha1.TenantNamespace{
 				TypeMeta: metav1.TypeMeta{
 					APIVersion: corev1alpha1.SchemeGroupVersion.String(),
@@ -359,7 +381,11 @@ func (r *REST) filterAccessible(
 					break subjectLoop
 				}
 			case "ServiceAccount":
-				if u.GetName() == fmt.Sprintf("system:serviceaccount:%s:%s", subj.Namespace, subj.Name) {
+				saNamespace := subj.Namespace
+				if saNamespace == "" {
+					saNamespace = rbs.Items[i].Namespace
+				}
+				if u.GetName() == fmt.Sprintf("system:serviceaccount:%s:%s", saNamespace, subj.Name) {
 					allowedNameSet[rbs.Items[i].Namespace] = struct{}{}
 					break subjectLoop
 				}
@@ -373,6 +399,65 @@ func (r *REST) filterAccessible(
 	return allowed, nil
 }
 
+// hasAccessToNamespace checks if the user has access to a single namespace.
+// This is optimized for Get/Watch operations where we check one namespace at a time.
+// It lists RoleBindings only in the target namespace instead of all cluster RoleBindings.
+func (r *REST) hasAccessToNamespace(
+	ctx context.Context,
+	namespace string,
+) (bool, error) {
+	u, ok := request.UserFrom(ctx)
+	if !ok {
+		return false, fmt.Errorf("user missing in context")
+	}
+
+	// Check privileged groups
+	groups := make(map[string]struct{})
+	for _, group := range u.GetGroups() {
+		groups[group] = struct{}{}
+	}
+	if _, ok := groups["system:masters"]; ok {
+		return true, nil
+	}
+	if _, ok := groups["cozystack-cluster-admin"]; ok {
+		return true, nil
+	}
+
+	// List RoleBindings only in the target namespace
+	rbs := &rbacv1.RoleBindingList{}
+	err := r.c.List(ctx, rbs, client.InNamespace(namespace))
+	if err != nil {
+		return false, fmt.Errorf("failed to list rolebindings in %s: %w", namespace, err)
+	}
+
+	// Check if user is in any RoleBinding subjects
+	for i := range rbs.Items {
+		for j := range rbs.Items[i].Subjects {
+			subj := rbs.Items[i].Subjects[j]
+			switch subj.Kind {
+			case "Group":
+				if _, ok := groups[subj.Name]; ok {
+					return true, nil
+				}
+			case "User":
+				if subj.Name == u.GetName() {
+					return true, nil
+				}
+			case "ServiceAccount":
+				saNamespace := subj.Namespace
+				if saNamespace == "" {
+					saNamespace = rbs.Items[i].Namespace
+				}
+				if u.GetName() == fmt.Sprintf("system:serviceaccount:%s:%s", saNamespace, subj.Name) {
+					return true, nil
+				}
+			}
+		}
+	}
+
+	return false, nil
+}
+
 // -----------------------------------------------------------------------------
 // Boiler-plate
 // -----------------------------------------------------------------------------

From 5b2501db91c82d8f9ce1d7187325927f7504847c Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Thu, 23 Apr 2026 18:17:47 +0300
Subject: [PATCH 593/666] test(api): add security tests for TenantNamespace
 IDOR fix

Added comprehensive unit tests for authorization logic:

- hasAccessToNamespace() tests:
  - User subject access (positive and negative cases)
  - Group subject access
  - ServiceAccount subject access
  - ServiceAccount with empty namespace (defaults to RoleBinding ns)
  - Privileged groups (system:masters, cozystack-cluster-admin)

- Get() handler tests:
  - Returns namespace when user has access
  - Returns NotFound when user lacks access (not Forbidden)
  - Returns NotFound for non-tenant namespaces

All tests verify that authorization correctly enforces RoleBinding-based
access control and prevents IDOR vulnerabilities.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 .../core/tenantnamespace/rest_test.go         | 461 ++++++++++++++++++
 1 file changed, 461 insertions(+)

diff --git a/pkg/registry/core/tenantnamespace/rest_test.go b/pkg/registry/core/tenantnamespace/rest_test.go
index 7f2979bc..eb678949 100644
--- a/pkg/registry/core/tenantnamespace/rest_test.go
+++ b/pkg/registry/core/tenantnamespace/rest_test.go
@@ -3,10 +3,18 @@
 package tenantnamespace
 
 import (
+	"context"
 	"testing"
 
 	corev1 "k8s.io/api/core/v1"
+	rbacv1 "k8s.io/api/rbac/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apiserver/pkg/authentication/user"
+	"k8s.io/apiserver/pkg/endpoints/request"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 )
 
 func TestMakeListSortsAlphabetically(t *testing.T) {
@@ -38,3 +46,456 @@ func TestMakeListSortsAlphabetically(t *testing.T) {
 		}
 	}
 }
+
+// Security tests for IDOR fix
+
+func TestHasAccessToNamespace_WithUserAccess(t *testing.T) {
+	scheme := runtime.NewScheme()
+	_ = corev1.AddToScheme(scheme)
+	_ = rbacv1.AddToScheme(scheme)
+
+	ns := &corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"},
+	}
+
+	rb := &rbacv1.RoleBinding{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-binding",
+			Namespace: "tenant-test",
+		},
+		Subjects: []rbacv1.Subject{
+			{Kind: "User", Name: "test-user", APIGroup: "rbac.authorization.k8s.io"},
+		},
+		RoleRef: rbacv1.RoleRef{
+			APIGroup: "rbac.authorization.k8s.io",
+			Kind:     "Role",
+			Name:     "test-role",
+		},
+	}
+
+	client := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(ns, rb).
+		Build()
+
+	r := &REST{
+		c:   client,
+		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
+	}
+
+	u := &user.DefaultInfo{
+		Name:   "test-user",
+		Groups: []string{"system:authenticated"},
+	}
+	ctx := request.WithUser(context.Background(), u)
+
+	hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !hasAccess {
+		t.Error("expected user to have access, but got false")
+	}
+}
+
+func TestHasAccessToNamespace_WithoutAccess(t *testing.T) {
+	scheme := runtime.NewScheme()
+	_ = corev1.AddToScheme(scheme)
+	_ = rbacv1.AddToScheme(scheme)
+
+	ns := &corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"},
+	}
+
+	// RoleBinding for different user
+	rb := &rbacv1.RoleBinding{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-binding",
+			Namespace: "tenant-test",
+		},
+		Subjects: []rbacv1.Subject{
+			{Kind: "User", Name: "other-user", APIGroup: "rbac.authorization.k8s.io"},
+		},
+		RoleRef: rbacv1.RoleRef{
+			APIGroup: "rbac.authorization.k8s.io",
+			Kind:     "Role",
+			Name:     "test-role",
+		},
+	}
+
+	client := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(ns, rb).
+		Build()
+
+	r := &REST{
+		c:   client,
+		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
+	}
+
+	u := &user.DefaultInfo{
+		Name:   "test-user",
+		Groups: []string{"system:authenticated"},
+	}
+	ctx := request.WithUser(context.Background(), u)
+
+	hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if hasAccess {
+		t.Error("expected user to NOT have access, but got true")
+	}
+}
+
+func TestHasAccessToNamespace_WithGroupAccess(t *testing.T) {
+	scheme := runtime.NewScheme()
+	_ = corev1.AddToScheme(scheme)
+	_ = rbacv1.AddToScheme(scheme)
+
+	ns := &corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"},
+	}
+
+	rb := &rbacv1.RoleBinding{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-binding",
+			Namespace: "tenant-test",
+		},
+		Subjects: []rbacv1.Subject{
+			{Kind: "Group", Name: "test-group", APIGroup: "rbac.authorization.k8s.io"},
+		},
+		RoleRef: rbacv1.RoleRef{
+			APIGroup: "rbac.authorization.k8s.io",
+			Kind:     "Role",
+			Name:     "test-role",
+		},
+	}
+
+	client := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(ns, rb).
+		Build()
+
+	r := &REST{
+		c:   client,
+		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
+	}
+
+	u := &user.DefaultInfo{
+		Name:   "test-user",
+		Groups: []string{"system:authenticated", "test-group"},
+	}
+	ctx := request.WithUser(context.Background(), u)
+
+	hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !hasAccess {
+		t.Error("expected user to have access via group, but got false")
+	}
+}
+
+func TestHasAccessToNamespace_SystemMasters(t *testing.T) {
+	scheme := runtime.NewScheme()
+	_ = corev1.AddToScheme(scheme)
+	_ = rbacv1.AddToScheme(scheme)
+
+	ns := &corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"},
+	}
+
+	client := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(ns).
+		Build()
+
+	r := &REST{
+		c:   client,
+		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
+	}
+
+	u := &user.DefaultInfo{
+		Name:   "admin",
+		Groups: []string{"system:masters"},
+	}
+	ctx := request.WithUser(context.Background(), u)
+
+	hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !hasAccess {
+		t.Error("expected system:masters to have access, but got false")
+	}
+}
+
+func TestHasAccessToNamespace_CozyAdminGroup(t *testing.T) {
+	scheme := runtime.NewScheme()
+	_ = corev1.AddToScheme(scheme)
+	_ = rbacv1.AddToScheme(scheme)
+
+	ns := &corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"},
+	}
+
+	client := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(ns).
+		Build()
+
+	r := &REST{
+		c:   client,
+		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
+	}
+
+	u := &user.DefaultInfo{
+		Name:   "cozy-admin",
+		Groups: []string{"cozystack-cluster-admin"},
+	}
+	ctx := request.WithUser(context.Background(), u)
+
+	hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !hasAccess {
+		t.Error("expected cozystack-cluster-admin to have access, but got false")
+	}
+}
+
+func TestHasAccessToNamespace_ServiceAccount(t *testing.T) {
+	scheme := runtime.NewScheme()
+	_ = corev1.AddToScheme(scheme)
+	_ = rbacv1.AddToScheme(scheme)
+
+	ns := &corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"},
+	}
+
+	rb := &rbacv1.RoleBinding{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-binding",
+			Namespace: "tenant-test",
+		},
+		Subjects: []rbacv1.Subject{
+			{Kind: "ServiceAccount", Name: "test-sa", Namespace: "tenant-test"},
+		},
+		RoleRef: rbacv1.RoleRef{
+			APIGroup: "rbac.authorization.k8s.io",
+			Kind:     "Role",
+			Name:     "test-role",
+		},
+	}
+
+	client := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(ns, rb).
+		Build()
+
+	r := &REST{
+		c:   client,
+		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
+	}
+
+	u := &user.DefaultInfo{
+		Name:   "system:serviceaccount:tenant-test:test-sa",
+		Groups: []string{"system:authenticated"},
+	}
+	ctx := request.WithUser(context.Background(), u)
+
+	hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !hasAccess {
+		t.Error("expected service account to have access, but got false")
+	}
+}
+
+func TestHasAccessToNamespace_ServiceAccountEmptyNamespace(t *testing.T) {
+	scheme := runtime.NewScheme()
+	_ = corev1.AddToScheme(scheme)
+	_ = rbacv1.AddToScheme(scheme)
+
+	ns := &corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"},
+	}
+
+	// ServiceAccount subject with empty namespace should default to RoleBinding namespace
+	rb := &rbacv1.RoleBinding{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-binding",
+			Namespace: "tenant-test",
+		},
+		Subjects: []rbacv1.Subject{
+			{Kind: "ServiceAccount", Name: "test-sa", Namespace: ""}, // Empty namespace
+		},
+		RoleRef: rbacv1.RoleRef{
+			APIGroup: "rbac.authorization.k8s.io",
+			Kind:     "Role",
+			Name:     "test-role",
+		},
+	}
+
+	client := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(ns, rb).
+		Build()
+
+	r := &REST{
+		c:   client,
+		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
+	}
+
+	u := &user.DefaultInfo{
+		Name:   "system:serviceaccount:tenant-test:test-sa",
+		Groups: []string{"system:authenticated"},
+	}
+	ctx := request.WithUser(context.Background(), u)
+
+	hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !hasAccess {
+		t.Error("expected service account with empty namespace to have access, but got false")
+	}
+}
+
+func TestGet_WithAccess(t *testing.T) {
+	scheme := runtime.NewScheme()
+	_ = corev1.AddToScheme(scheme)
+	_ = rbacv1.AddToScheme(scheme)
+
+	ns := &corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"},
+	}
+
+	rb := &rbacv1.RoleBinding{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-binding",
+			Namespace: "tenant-test",
+		},
+		Subjects: []rbacv1.Subject{
+			{Kind: "User", Name: "test-user", APIGroup: "rbac.authorization.k8s.io"},
+		},
+		RoleRef: rbacv1.RoleRef{
+			APIGroup: "rbac.authorization.k8s.io",
+			Kind:     "Role",
+			Name:     "test-role",
+		},
+	}
+
+	client := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(ns, rb).
+		Build()
+
+	r := &REST{
+		c:   client,
+		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
+	}
+
+	u := &user.DefaultInfo{
+		Name:   "test-user",
+		Groups: []string{"system:authenticated"},
+	}
+	ctx := request.WithUser(context.Background(), u)
+
+	obj, err := r.Get(ctx, "tenant-test", &metav1.GetOptions{})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if obj == nil {
+		t.Fatal("expected object, got nil")
+	}
+}
+
+func TestGet_WithoutAccess(t *testing.T) {
+	scheme := runtime.NewScheme()
+	_ = corev1.AddToScheme(scheme)
+	_ = rbacv1.AddToScheme(scheme)
+
+	ns := &corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"},
+	}
+
+	// RoleBinding for different user
+	rb := &rbacv1.RoleBinding{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-binding",
+			Namespace: "tenant-test",
+		},
+		Subjects: []rbacv1.Subject{
+			{Kind: "User", Name: "other-user", APIGroup: "rbac.authorization.k8s.io"},
+		},
+		RoleRef: rbacv1.RoleRef{
+			APIGroup: "rbac.authorization.k8s.io",
+			Kind:     "Role",
+			Name:     "test-role",
+		},
+	}
+
+	client := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(ns, rb).
+		Build()
+
+	r := &REST{
+		c:   client,
+		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
+	}
+
+	u := &user.DefaultInfo{
+		Name:   "test-user",
+		Groups: []string{"system:authenticated"},
+	}
+	ctx := request.WithUser(context.Background(), u)
+
+	obj, err := r.Get(ctx, "tenant-test", &metav1.GetOptions{})
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+	if obj != nil {
+		t.Errorf("expected nil object, got %v", obj)
+	}
+
+	// Verify it returns NotFound (not Forbidden) to prevent enumeration
+	if !apierrors.IsNotFound(err) {
+		t.Errorf("expected NotFound error, got %v", err)
+	}
+}
+
+func TestGet_NonTenantNamespace(t *testing.T) {
+	scheme := runtime.NewScheme()
+	_ = corev1.AddToScheme(scheme)
+	_ = rbacv1.AddToScheme(scheme)
+
+	client := fake.NewClientBuilder().
+		WithScheme(scheme).
+		Build()
+
+	r := &REST{
+		c:   client,
+		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
+	}
+
+	u := &user.DefaultInfo{
+		Name:   "test-user",
+		Groups: []string{"system:masters"},
+	}
+	ctx := request.WithUser(context.Background(), u)
+
+	obj, err := r.Get(ctx, "default", &metav1.GetOptions{})
+	if err == nil {
+		t.Fatal("expected error for non-tenant namespace, got nil")
+	}
+	if obj != nil {
+		t.Errorf("expected nil object, got %v", obj)
+	}
+	if !apierrors.IsNotFound(err) {
+		t.Errorf("expected NotFound error, got %v", err)
+	}
+}

From 9d552d4086726d2f5c6de5adaa2783082893a8c5 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Thu, 23 Apr 2026 22:19:35 +0500
Subject: [PATCH 594/666] ci(api): broaden codegen drift trigger paths and
 detect untracked files

- Add generated-output dirs (pkg/generated, internal/crdinstall/manifests,
  packages/system/*/definitions) and Makefile to the workflow paths: filter
  so PRs that modify only generated artifacts still trigger the drift check.
- Mirror the same paths in the root pre-commit hook's files: regex so
  manual edits to generated files or changes to the root generate target
  re-run make generate through pre-commit.
- Switch drift detection in the workflow from `git diff --exit-code` to
  `git status --porcelain` so new untracked files produced by make generate
  (e.g. generated YAML/Go for a new API type) also fail the job; dump
  `git diff --color=always` on failure for easier debugging.

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .github/workflows/codegen-drift.yml | 10 +++++++++-
 .pre-commit-config.yaml             |  2 +-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/codegen-drift.yml b/.github/workflows/codegen-drift.yml
index b08f5d7e..a26caf5e 100644
--- a/.github/workflows/codegen-drift.yml
+++ b/.github/workflows/codegen-drift.yml
@@ -6,8 +6,15 @@ on:
     paths:
       - 'api/**'
       - 'pkg/apis/**'
+      - 'pkg/generated/**'
+      - 'internal/crdinstall/manifests/**'
+      - 'packages/system/cozystack-controller/definitions/**'
+      - 'packages/system/application-definition-crd/definition/**'
+      - 'packages/system/backup-controller/definitions/**'
+      - 'packages/system/backupstrategy-controller/definitions/**'
       - 'hack/update-codegen.sh'
       - 'hack/boilerplate.go.txt'
+      - 'Makefile'
       - 'go.mod'
       - 'go.sum'
       - '.github/workflows/codegen-drift.yml'
@@ -46,8 +53,9 @@ jobs:
 
       - name: Fail on drift
         run: |
-          if ! git diff --exit-code; then
+          if [ -n "$(git status --porcelain)" ]; then
             echo "::error::'make generate' produced changes. Run 'make generate' locally and commit the result."
             git status --short
+            git diff --color=always
             exit 1
           fi
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 836f79c5..6492b92d 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -10,7 +10,7 @@ repos:
           git diff --color=always | cat
         '
       language: system
-      files: ^(api/|pkg/apis/|hack/update-codegen\.sh$|hack/boilerplate\.go\.txt$)
+      files: ^(api/|pkg/apis/|pkg/generated/|internal/crdinstall/manifests/|packages/system/cozystack-controller/definitions/|packages/system/application-definition-crd/definition/|packages/system/backup-controller/definitions/|packages/system/backupstrategy-controller/definitions/|hack/update-codegen\.sh$|hack/boilerplate\.go\.txt$|Makefile$)
       pass_filenames: false
     - id: run-make-generate
       name: Run 'make generate' in all app directories

From 3c5521ee992b2dce74ff8956a6d8c581763bf640 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Thu, 23 Apr 2026 22:16:30 +0300
Subject: [PATCH 595/666] fix(hami): remove broken hami-dra subchart

The hami-dra subchart renders resources even when dra.enabled=false
because Helm dependency conditions don't work for vendored subcharts.
The subchart also contains duplicate YAML label keys
(app.kubernetes.io/component, app.kubernetes.io/name) and references
unpublished container images (v0.0.1-dev). DRA support can be
re-added when the upstream project stabilizes it.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../charts/hami/charts/hami-dra/.helmignore   |  24 --
 .../charts/hami/charts/hami-dra/Chart.yaml    |  18 -
 .../charts/hami-dra/templates/_commons.tpl    |  84 ----
 .../charts/hami-dra/templates/_helpers.tpl    |  73 ----
 .../hami-dra-driver/deviceclass.yaml          |  11 -
 .../nvidia-dra-driver-daemonset.yaml          | 145 -------
 .../templates/hami-dra-driver/rbac.yaml       | 110 -----
 .../monitor/monitor-clusterrole.yaml          |  11 -
 .../monitor/monitor-clusterrolebinding.yaml   |  15 -
 .../templates/monitor/monitor-deployment.yaml |  62 ---
 .../templates/monitor/monitor-service.yaml    |  26 --
 .../monitor/monitor-serviceaccount.yaml       |   8 -
 .../templates/webhook/cert-manager.yaml       |  29 --
 .../templates/webhook/cert-secret.yaml        |  13 -
 .../templates/webhook/device-config.yaml      | 394 ------------------
 .../webhook/mutatingwebhookconfiguration.yaml |  28 --
 .../validatingwebhookconfiguration.yaml       |  29 --
 .../webhook/webhook-clusterrole.yaml          |  14 -
 .../webhook/webhook-clusterrolebinding.yaml   |  12 -
 .../templates/webhook/webhook-deployment.yaml |  59 ---
 .../templates/webhook/webhook-service.yaml    |  15 -
 .../webhook/webhook-serviceaccount.yaml       |   5 -
 .../charts/hami/charts/hami-dra/values.yaml   | 166 --------
 23 files changed, 1351 deletions(-)
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/.helmignore
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/Chart.yaml
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/_commons.tpl
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/_helpers.tpl
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/deviceclass.yaml
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/nvidia-dra-driver-daemonset.yaml
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/rbac.yaml
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-clusterrole.yaml
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-clusterrolebinding.yaml
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-deployment.yaml
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-service.yaml
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-serviceaccount.yaml
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/cert-manager.yaml
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/cert-secret.yaml
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/device-config.yaml
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/mutatingwebhookconfiguration.yaml
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/validatingwebhookconfiguration.yaml
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-clusterrole.yaml
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-clusterrolebinding.yaml
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-deployment.yaml
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-service.yaml
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-serviceaccount.yaml
 delete mode 100644 packages/system/hami/charts/hami/charts/hami-dra/values.yaml

diff --git a/packages/system/hami/charts/hami/charts/hami-dra/.helmignore b/packages/system/hami/charts/hami/charts/hami-dra/.helmignore
deleted file mode 100644
index 898df488..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/.helmignore
+++ /dev/null
@@ -1,24 +0,0 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/
-
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/Chart.yaml b/packages/system/hami/charts/hami/charts/hami-dra/Chart.yaml
deleted file mode 100644
index d01f678f..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/Chart.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-apiVersion: v2
-appVersion: 0.1.0
-description: A Helm chart for HAMi DRA
-home: https://github.com/Project-HAMi/HAMi-DRA
-keywords:
-- webhook
-- kubernetes
-- admission-controller
-- hami
-- dra
-maintainers:
-- name: hami-dra
-  url: https://github.com/Project-HAMi/HAMi-DRA
-name: hami-dra
-sources:
-- https://github.com/Project-HAMi/HAMi-DRA
-type: application
-version: 0.1.0
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/_commons.tpl b/packages/system/hami/charts/hami/charts/hami-dra/templates/_commons.tpl
deleted file mode 100644
index 02fbed20..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/_commons.tpl
+++ /dev/null
@@ -1,84 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/*
-Return the proper image name
-{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" $) }}
-*/}}
-{{- define "common.images.image" -}}
-{{- $registryName := .imageRoot.registry -}}
-{{- $repositoryName := .imageRoot.repository -}}
-{{- $tag := .imageRoot.tag | toString -}}
-{{- if .global }}
-    {{- if .global.imageRegistry }}
-     {{- $registryName = .global.imageRegistry -}}
-    {{- end -}}
-{{- end -}}
-{{- if .tag }}
-    {{- if .tag.imageTag }}
-     {{- $tag = .tag.imageTag -}}
-    {{- end -}}
-{{- end -}}
-{{- if $registryName }}
-{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
-{{- else -}}
-{{- printf "%s:%s" $repositoryName $tag -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead)
-{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }}
-*/}}
-{{- define "common.images.pullSecrets" -}}
-  {{- $pullSecrets := list }}
-
-  {{- if .global }}
-    {{- range .global.imagePullSecrets -}}
-      {{- $pullSecrets = append $pullSecrets . -}}
-    {{- end -}}
-  {{- end -}}
-
-  {{- range .images -}}
-    {{- range .pullSecrets -}}
-      {{- $pullSecrets = append $pullSecrets . -}}
-    {{- end -}}
-  {{- end -}}
-
-  {{- if (not (empty $pullSecrets)) }}
-imagePullSecrets:
-    {{- range $pullSecrets }}
-  - name: {{ . }}
-    {{- end }}
-  {{- end }}
-{{- end -}}
-
-{{/*
-Renders a value that contains template.
-Usage:
-{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $) }}
-*/}}
-{{- define "common.tplvalues.render" -}}
-    {{- if typeIs "string" .value }}
-        {{- tpl .value .context }}
-    {{- else }}
-        {{- tpl (.value | toYaml) .context }}
-    {{- end }}
-{{- end -}}
-
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "common.names.fullname" -}}
-{{- if .Values.fullnameOverride -}}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- $name := default .Chart.Name .Values.nameOverride -}}
-{{- if contains $name .Release.Name -}}
-{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/_helpers.tpl b/packages/system/hami/charts/hami/charts/hami-dra/templates/_helpers.tpl
deleted file mode 100644
index 99beec77..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/_helpers.tpl
+++ /dev/null
@@ -1,73 +0,0 @@
-{{- define "hami.dra.webhook.fullname" -}}
-{{- printf "%s-%s" (include "common.names.fullname" .) "webhook" | trunc 63 | trimSuffix "-" -}}
-{{- end }}
-
-{{- define "hami.dra.webhook.image" -}}
-{{ include "common.images.image" (dict "imageRoot" .Values.webhook.image "global" .Values.global) }}
-{{- end -}}
-
-{{- define "hami.dra.webhook.imagePullSecrets" -}}
-{{ include "common.images.pullSecrets" (dict "images" (list .Values.webhook.image) "global" .Values.global) }}
-{{- end -}}
-
-{{- define "hami.dra.driver.nvidia.image" -}}
-{{ include "common.images.image" (dict "imageRoot" .Values.drivers.nvidia.image "global" .Values.global) }}
-{{- end -}}
-
-{{- define "hami.dra.driver.nvidia.imagePullSecrets" -}}
-{{ include "common.images.pullSecrets" (dict "images" (list .Values.drivers.nvidia.image) "global" .Values.global) }}
-{{- end -}}
-
-{{/*
-Common labels
-*/}}
-{{- define "hami-dra-webhook.labels" -}}
-helm.sh/chart: {{ .Chart.Name }}
-{{ include "hami-dra-webhook.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "hami-dra-webhook.selectorLabels" -}}
-app.kubernetes.io/name: {{ .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/component: webhook
-{{- end }}
-
-{{- define "hami.dra.monitor.fullname" -}}
-{{- printf "%s-%s" (include "common.names.fullname" .) "monitor" | trunc 63 | trimSuffix "-" -}}
-{{- end }}
-
-{{- define "hami.dra.monitor.image" -}}
-{{ include "common.images.image" (dict "imageRoot" .Values.monitor.image "global" .Values.global) }}
-{{- end -}}
-
-{{- define "hami.dra.monitor.imagePullSecrets" -}}
-{{ include "common.images.pullSecrets" (dict "images" (list .Values.monitor.image) "global" .Values.global) }}
-{{- end -}}
-
-{{/*
-Common labels for monitor
-*/}}
-{{- define "hami-dra-monitor.labels" -}}
-helm.sh/chart: {{ .Chart.Name }}
-{{ include "hami-dra-monitor.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end }}
-
-{{/*
-Selector labels for monitor
-*/}}
-{{- define "hami-dra-monitor.selectorLabels" -}}
-app.kubernetes.io/name: {{ .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/component: monitor
-{{- end }}
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/deviceclass.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/deviceclass.yaml
deleted file mode 100644
index bcb6d2c5..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/deviceclass.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-{{- if .Values.drivers.nvidia.enabled }}
-apiVersion: resource.k8s.io/v1
-kind: DeviceClass
-metadata:
-  name: hami-core-gpu.project-hami.io
-spec:
-  selectors:
-  - cel:
-      expression: |-
-        device.driver == "hami-core-gpu.project-hami.io" && device.attributes["hami-core-gpu.project-hami.io"].type == "hami-gpu"
-{{- end }}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/nvidia-dra-driver-daemonset.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/nvidia-dra-driver-daemonset.yaml
deleted file mode 100644
index a3fb0d01..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/nvidia-dra-driver-daemonset.yaml
+++ /dev/null
@@ -1,145 +0,0 @@
-{{- if .Values.drivers.nvidia.enabled }}
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: hami-dra-driver-kubelet-plugin
-  namespace: {{ .Release.Namespace }}
-spec:
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      hami-dra-driver-component: kubelet-plugin
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: hami-dra-driver
-        app.kubernetes.io/name: hami-dra-driver
-        hami-dra-driver-component: kubelet-plugin
-    spec:
-      {{- include "hami.dra.driver.nvidia.imagePullSecrets" . | nindent 6 }}
-      initContainers:
-      - name: init-container
-        image: {{ include "hami.dra.driver.nvidia.image" . }}
-        securityContext:
-          privileged: true
-        command: [bash, /usr/bin/kubelet-plugin-prestart.sh]
-        env:
-        - name: NVIDIA_DRIVER_ROOT
-          value: {{ if .Values.drivers.nvidia.containerDriver }}/run/nvidia/driver{{ else }}/{{ end }}
-        - name: NVIDIA_VISIBLE_DEVICES
-          value: void
-        - name: KUBELET_REGISTRAR_DIRECTORY_PATH
-          value: /var/lib/kubelet/plugins_registry
-        - name: KUBELET_PLUGINS_DIRECTORY_PATH
-          value: /var/lib/kubelet/plugins
-        volumeMounts:
-        - name: driver-root-parent
-          mountPath: /driver-root-parent
-          readOnly: true
-      containers:
-      - args:
-        - |-
-          # Conditionally mask the params file to prevent this container from
-          # recreating any missing GPU device nodes. This is necessary, for
-          # example, when running under nvkind to limit the set GPUs governed
-          # by the plugin even though it has cgroup access to all of them.
-          if [ "${MASK_NVIDIA_DRIVER_PARAMS}" = "true" ]; then
-            cp /proc/driver/nvidia/params root/gpu-params
-            sed -i 's/^ModifyDeviceFiles: 1$/ModifyDeviceFiles: 0/' root/gpu-params
-            mount --bind root/gpu-params /proc/driver/nvidia/params
-          fi
-          hami-kubelet-plugin -v 6
-        command:
-        - bash
-        - -c
-        env:
-        - name: MASK_NVIDIA_DRIVER_PARAMS
-          value: ""
-        - name: NVIDIA_DRIVER_ROOT
-          value: {{ if .Values.drivers.nvidia.containerDriver }}/run/nvidia/driver{{ else }}/{{ end }}
-        - name: NVIDIA_VISIBLE_DEVICES
-          value: void
-        - name: CDI_ROOT
-          value: /var/run/cdi
-        - name: NVIDIA_MIG_CONFIG_DEVICES
-          value: all
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: spec.nodeName
-        - name: NAMESPACE
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: metadata.namespace
-        - name: KUBELET_REGISTRAR_DIRECTORY_PATH
-          value: /var/lib/kubelet/plugins_registry
-        - name: KUBELET_PLUGINS_DIRECTORY_PATH
-          value: /var/lib/kubelet/plugins
-        - name: IMAGE_NAME
-          value: {{ include "hami.dra.driver.nvidia.image" . }}
-        lifecycle:
-          postStart:
-            exec:
-              command: ["/bin/bash", "-c", "/usr/bin/vgpu-init.sh /usr/local/vgpu/"]
-        image: {{ include "hami.dra.driver.nvidia.image" . }}
-        imagePullPolicy: {{ .Values.drivers.nvidia.image.pullPolicy | default "IfNotPresent" }}
-        name: gpus
-        securityContext:
-          privileged: true
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-        volumeMounts:
-        - mountPath: /var/lib/kubelet/plugins_registry
-          name: plugins-registry
-        - mountPath: /var/lib/kubelet/plugins
-          mountPropagation: Bidirectional
-          name: plugins
-        - mountPath: /var/run/cdi
-          name: cdi
-        - mountPath: /driver-root
-          mountPropagation: HostToContainer
-          name: driver-root
-          readOnly: true
-        - mountPath: /usr/local/vgpu
-          name: host-vgpu
-        - mountPath: /tmp
-          name: host-tmp
-      dnsPolicy: ClusterFirst
-      serviceAccount: hami-dra-driver-service-account
-      serviceAccountName: hami-dra-driver-service-account
-      volumes:
-      - hostPath:
-          path: /var/lib/kubelet/plugins_registry
-          type: ""
-        name: plugins-registry
-      - hostPath:
-          path: /var/lib/kubelet/plugins
-          type: ""
-        name: plugins
-      - hostPath:
-          path: /var/run/cdi
-          type: ""
-        name: cdi
-      - hostPath:
-          path: {{if .Values.drivers.nvidia.containerDriver }}/run/nvidia{{ else }}/{{ end }}
-          type: DirectoryOrCreate
-        name: driver-root-parent
-      - hostPath:
-          path: {{if .Values.drivers.nvidia.containerDriver }}/run/nvidia/driver{{ else }}/{{ end }}
-          type: DirectoryOrCreate
-        name: driver-root
-      - hostPath:
-          path: /dev
-          type: ""
-        name: host-dev
-      - hostPath:
-          path: /usr/local/vgpu
-          type: DirectoryOrCreate
-        name: host-vgpu
-      - hostPath:
-          path: /tmp
-          type: ""
-        name: host-tmp
-{{- end }}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/rbac.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/rbac.yaml
deleted file mode 100644
index 435c37cc..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/hami-dra-driver/rbac.yaml
+++ /dev/null
@@ -1,110 +0,0 @@
-{{- if .Values.drivers.nvidia.enabled }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: hami-dra-driver-service-account
-  namespace: {{ .Release.Namespace }}
----
-apiVersion: v1
-items:
-- apiVersion: rbac.authorization.k8s.io/v1
-  kind: Role
-  metadata:
-    name: hami-dra-driver-role
-    namespace: {{ .Release.Namespace }}
-  rules:
-  - apiGroups:
-    - apps
-    resources:
-    - daemonsets
-    - deployments
-    verbs:
-    - get
-    - list
-    - watch
-    - create
-    - update
-    - patch
-    - delete
-kind: List
-metadata:
-  resourceVersion: ""
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: hami-dra-driver-role-binding
-  namespace: {{ .Release.Namespace }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: hami-dra-driver-role
-subjects:
-- kind: ServiceAccount
-  name: hami-dra-driver-service-account
-  namespace: {{ .Release.Namespace }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: hami-dra-driver-clusterrole
-rules:
-- apiGroups:
-  - resource.k8s.io
-  resources:
-  - resourceclaims
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - resource.k8s.io
-  resources:
-  - resourceclaimtemplates
-  verbs:
-  - get
-  - list
-  - watch
-  - create
-  - update
-  - delete
-- apiGroups:
-  - resource.k8s.io
-  resources:
-  - resourceslices
-  verbs:
-  - get
-  - list
-  - watch
-  - create
-  - update
-  - delete
-- apiGroups:
-  - resource.k8s.io
-  resources:
-  - resourceclaims/status
-  verbs:
-  - update
-- apiGroups:
-  - ""
-  resources:
-  - nodes
-  verbs:
-  - get
-  - list
-  - watch
-  - update
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: hami-dra-driver-clusterrole-binding-hami-dra-driver
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: hami-dra-driver-clusterrole
-subjects:
-- kind: ServiceAccount
-  name: hami-dra-driver-service-account
-  namespace: {{ .Release.Namespace }}
-{{- end }}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-clusterrole.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-clusterrole.yaml
deleted file mode 100644
index 45c24863..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-clusterrole.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-{{- if .Values.monitor.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "hami.dra.monitor.fullname" . }}
-rules:
-- apiGroups: ["resource.k8s.io"]
-  resources: ["resourceslices", "resourceclaims"]
-  verbs: ["get", "list", "watch"]
-{{- end }}
-
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-clusterrolebinding.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-clusterrolebinding.yaml
deleted file mode 100644
index 766d3098..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-clusterrolebinding.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-{{- if .Values.monitor.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "hami.dra.monitor.fullname" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ include "hami.dra.monitor.fullname" . }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "hami.dra.monitor.fullname" . }}
-    namespace: {{ .Release.Namespace }}
-{{- end }}
-
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-deployment.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-deployment.yaml
deleted file mode 100644
index b544b376..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-deployment.yaml
+++ /dev/null
@@ -1,62 +0,0 @@
-{{- if .Values.monitor.enabled }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ include "hami.dra.monitor.fullname" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "hami.dra.monitor.fullname" . }}
-    {{- include "hami-dra-monitor.labels" . | nindent 4 }}
-spec:
-  replicas: {{ .Values.monitor.replicas | default 1 }}
-  selector:
-    matchLabels:
-      {{- include "hami-dra-monitor.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      labels:
-        {{- include "hami-dra-monitor.selectorLabels" . | nindent 8 }}
-    spec:
-      {{- include "hami.dra.monitor.imagePullSecrets" . | nindent 6 }}
-      serviceAccountName: {{ include "hami.dra.monitor.fullname" . }}
-      containers:
-        - name: monitor
-          image: {{ include "hami.dra.monitor.image" . }}
-          imagePullPolicy: {{ .Values.monitor.image.pullPolicy | default "IfNotPresent" }}
-          command:
-            - /bin/monitor
-            - --v={{ .Values.monitor.logLevel | default 2 }}
-            - --metrics-bind-address={{ .Values.monitor.metricsBindAddress | default ":8080" }}
-            - --health-probe-bind-address={{ .Values.monitor.healthProbeBindAddress | default ":8000" }}
-            - --kube-api-qps={{ .Values.monitor.kubeAPIQPS | default 40.0 }}
-            - --kube-api-burst={{ .Values.monitor.kubeAPIBurst | default 60 }}
-            - --collect-interval={{ .Values.monitor.collectInterval | default "30s" }}
-          ports:
-            - containerPort: 8080
-              name: metrics
-              protocol: TCP
-            - containerPort: 8000
-              name: health
-              protocol: TCP
-          {{- if .Values.monitor.resources }}
-          resources:
-            {{- toYaml .Values.monitor.resources | nindent 12 }}
-          {{- end }}
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: 8000
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: 8000
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            timeoutSeconds: 3
-            failureThreshold: 3
-{{- end }}
-
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-service.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-service.yaml
deleted file mode 100644
index d740cc38..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-service.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-{{- if .Values.monitor.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "hami.dra.monitor.fullname" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "hami-dra-monitor.selectorLabels" . | nindent 4 }}
-spec:
-  type: {{ .Values.monitor.service.type | default "ClusterIP" }}
-  selector:
-    {{- include "hami-dra-monitor.selectorLabels" . | nindent 4 }}
-  ports:
-    - port: 8080
-      targetPort: 8080
-      name: metrics
-      protocol: TCP
-      {{- if and (eq (.Values.monitor.service.type | default "ClusterIP") "NodePort") .Values.monitor.service.nodePort.metrics }}
-      nodePort: {{ .Values.monitor.service.nodePort.metrics }}
-      {{- end }}
-    - port: 8000
-      targetPort: 8000
-      name: health
-      protocol: TCP
-{{- end }}
-
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-serviceaccount.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-serviceaccount.yaml
deleted file mode 100644
index c61ad454..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/monitor/monitor-serviceaccount.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-{{- if .Values.monitor.enabled }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "hami.dra.monitor.fullname" . }}
-  namespace: {{ .Release.Namespace }}
-{{- end }}
-
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/cert-manager.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/cert-manager.yaml
deleted file mode 100644
index dd31c71d..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/cert-manager.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-{{- if .Values.certs.certManager.enabled }}
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: {{ .Release.Name }}-dra-webhook-serving-cert
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "hami-dra-webhook.labels" . | nindent 4 }}
-spec:
-  dnsNames:
-    - {{ .Release.Name }}-dra-webhook.{{ .Release.Namespace }}.svc
-    - {{ .Release.Name }}-dra-webhook.{{ .Release.Namespace }}.svc.cluster.local
-  issuerRef:
-    kind: Issuer
-    name: {{ .Release.Name }}-dra-webhook-selfsigned-issuer
-  secretName: {{ .Release.Name }}-dra-webhook-tls
-  privateKey:
-    rotationPolicy: {{ .Values.certs.certManager.privateKeyRotationPolicy | default "Never" }}
----
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: {{ .Release.Name }}-dra-webhook-selfsigned-issuer
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/component: hami-dra-webhook
-spec:
-  selfSigned: {}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/cert-secret.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/cert-secret.yaml
deleted file mode 100644
index eadbb517..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/cert-secret.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-{{- if eq .Values.certs.mode "custom" }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "hami-dra-webhook.tlsSecretName" . }}
-  namespace: {{ .Release.Namespace }}
-type: kubernetes.io/tls
-data:
-  tls.crt: |
-    {{- .Values.certs.custom.crt | b64enc | indent 4 }}
-  tls.key: |
-    {{- .Values.certs.custom.key | b64enc | indent 4 }}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/device-config.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/device-config.yaml
deleted file mode 100644
index 97283f3e..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/device-config.yaml
+++ /dev/null
@@ -1,394 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "hami.dra.webhook.fullname" . }}-device-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/component: hami-scheduler
-    {{- include "hami-dra-webhook.selectorLabels" . | nindent 4 }}
-data:
-  device-config.yaml: |-
-  {{- if .Files.Glob "files/device-config.yaml" }}
-  {{- .Files.Get "files/device-config.yaml" | nindent 4}}
-  {{- else }}
-    nvidia:
-      resourceCountName: {{ .Values.resourceName }}
-      resourceMemoryName: {{ .Values.resourceMem }}
-      resourceMemoryPercentageName: {{ .Values.resourceMemPercentage }}
-      resourceCoreName: {{ .Values.resourceCores }}
-      resourcePriorityName: {{ .Values.resourcePriority }}
-      overwriteEnv: false
-      defaultMemory: 0
-      defaultCores: 0
-      defaultGPUNum: 1
-      knownMigGeometries:
-      - models: [ "A30" ]
-        allowedGeometries:
-          - 
-            - name: 1g.6gb
-              core: 25
-              memory: 6144
-              count: 4
-          - 
-            - name: 2g.12gb
-              core: 50
-              memory: 12288
-              count: 2
-          - 
-            - name: 4g.24gb
-              core: 100
-              memory: 24576
-              count: 1
-      - models: [ "A100-SXM4-40GB", "A100-40GB-PCIe", "A100-PCIE-40GB"]
-        allowedGeometries:
-          - 
-            - name: 1g.5gb
-              core: 14
-              memory: 5120
-              count: 7
-          - 
-            - name: 1g.5gb
-              core: 14
-              memory: 5120
-              count: 1
-            - name: 2g.10gb
-              core: 28
-              memory: 10240
-              count: 3
-          - 
-            - name: 3g.20gb
-              core: 42
-              memory: 20480
-              count: 2
-          - 
-            - name: 7g.40gb
-              core: 100
-              memory: 40960
-              count: 1
-      - models: [ "A100-SXM4-80GB", "A100-80GB-PCIe", "A100-PCIE-80GB"]
-        allowedGeometries:
-          - 
-            - name: 1g.10gb
-              core: 14
-              memory: 10240
-              count: 7
-          - 
-            - name: 1g.10gb
-              core: 14
-              memory: 10240
-              count: 1
-            - name: 2g.20gb
-              core: 28
-              memory: 20480
-              count: 3
-          - 
-            - name: 3g.40gb
-              core: 42
-              memory: 40960
-              count: 2
-          - 
-            - name: 7g.79gb
-              core: 100
-              memory: 80896
-              count: 1
-      - models: [ "H100-PCIE-80GB", "H100-SXM5-80GB"]
-        allowedGeometries:
-          - 
-            - name: 1g.10gb
-              core: 14
-              memory: 10240
-              count: 7
-          - 
-            - name: 1g.10gb
-              core: 14
-              memory: 10240
-              count: 1
-            - name: 2g.20gb
-              core: 28
-              memory: 20480
-              count: 3
-          - 
-            - name: 3g.40gb
-              core: 42
-              memory: 40960
-              count: 2
-          - 
-            - name: 7g.80gb
-              core: 100
-              memory: 81920
-              count: 1
-      - models: [ "H100-PCIE-94GB", "H100-SXM5-94GB"]
-        allowedGeometries:
-          - 
-            - name: 1g.12gb
-              core: 14
-              memory: 12288
-              count: 7
-          - 
-            - name: 1g.12gb
-              core: 14
-              memory: 12288
-              count: 1
-            - name: 2g.24gb
-              core: 28
-              memory: 24576
-              count: 3
-          - 
-            - name: 3g.47gb
-              core: 42
-              memory: 48128
-              count: 2
-          - 
-            - name: 7g.94gb
-              core: 100
-              memory: 96256
-              count: 1
-      - models: [ "H20", "H100 on GH200"]
-        allowedGeometries:
-          - 
-            - name: 1g.12gb
-              core: 14
-              memory: 12288
-              count: 7
-          - 
-            - name: 1g.12gb
-              core: 14
-              memory: 12288
-              count: 1
-            - name: 2g.24gb
-              core: 28
-              memory: 24576
-              count: 3 
-          - 
-            - name: 3g.48gb
-              core: 42
-              memory: 49152
-              count: 2
-          - 
-            - name: 7g.96gb
-              core: 100
-              memory: 98304
-              count: 1
-      - models: [ "H200 NVL", "H200-SXM5"]
-        allowedGeometries:
-          - 
-            - name: 1g.18gb
-              core: 14
-              memory: 18432
-              count: 7
-          - 
-            - name: 1g.18gb
-              core: 14
-              memory: 18432
-              count: 1
-            - name: 2g.35gb
-              core: 28
-              memory: 35840
-              count: 3
-          - 
-            - name: 3g.71gb
-              core: 42
-              memory: 72704
-              count: 2
-          - 
-            - name: 7g.141gb
-              core: 100
-              memory: 144384
-              count: 1
-      - models: [ "B200" ]
-        allowedGeometries:
-          - 
-            - name: 1g.23gb
-              core: 14
-              memory: 23552
-              count: 7
-          - 
-            - name: 1g.23gb
-              core: 14
-              memory: 23552
-              count: 1
-            - name: 2g.45gb
-              core: 28
-              memory: 46080
-              count: 3
-          - 
-            - name: 3g.90gb
-              core: 42
-              memory: 92160
-              count: 2
-          - 
-            - name: 7g.180gb
-              core: 100
-              memory: 184320
-              count: 1
-    cambricon:
-      resourceCountName: {{ .Values.mluResourceName }}
-      resourceMemoryName: {{ .Values.mluResourceMem }}
-      resourceCoreName: {{ .Values.mluResourceCores }}
-    hygon:
-      resourceCountName: {{ .Values.dcuResourceName }}
-      resourceMemoryName: {{ .Values.dcuResourceMem }}
-      resourceCoreName: {{ .Values.dcuResourceCores }}
-    metax:
-      resourceCountName: "metax-tech.com/gpu"
-      resourceVCountName: {{ .Values.metaxResourceName }}
-      resourceVMemoryName: {{ .Values.metaxResourceMem }}
-      resourceVCoreName: {{ .Values.metaxResourceCore }}
-      sgpuTopologyAware: {{ .Values.metaxsGPUTopologyAware }}
-    enflame:
-      resourceNameGCU: "enflame.com/gcu"
-      resourceNameVGCU: {{ .Values.enflameResourceNameVGCU }}
-      resourceNameVGCUPercentage: {{ .Values.enflameResourceNameVGCUPercentage }}
-    mthreads:
-      resourceCountName: "mthreads.com/vgpu"
-      resourceMemoryName: "mthreads.com/sgpu-memory"
-      resourceCoreName: "mthreads.com/sgpu-core"
-    iluvatars:
-    - chipName: MR-V100
-      commonWord: MR-V100
-      resourceCountName: iluvatar.ai/MR-V100-vgpu
-      resourceMemoryName: iluvatar.ai/MR-V100.vMem
-      resourceCoreName: iluvatar.ai/MR-V100.vCore
-    - chipName: MR-V50
-      commonWord: MR-V50
-      resourceCountName: iluvatar.ai/MR-V50-vgpu
-      resourceMemoryName: iluvatar.ai/MR-V50.vMem
-      resourceCoreName: iluvatar.ai/MR-V50.vCore
-    - chipName: BI-V150
-      commonWord: BI-V150
-      resourceCountName: iluvatar.ai/BI-V150-vgpu
-      resourceMemoryName: iluvatar.ai/BI-V150.vMem
-      resourceCoreName: iluvatar.ai/BI-V150.vCore
-    - chipName: BI-V100
-      commonWord: BI-V100
-      resourceCountName: iluvatar.ai/BI-V100-vgpu
-      resourceMemoryName: iluvatar.ai/BI-V100.vMem
-      resourceCoreName: iluvatar.ai/BI-V100.vCore
-    kunlun:
-      resourceCountName: {{ .Values.kunlunResourceName }}
-      resourceVCountName: {{ .Values.kunlunResourceVCountName }}
-      resourceVMemoryName: {{ .Values.kunlunResourceVMemoryName }}
-    awsneuron:
-      resourceCountName: "aws.amazon.com/neuron"
-      resourceCoreName: "aws.amazon.com/neuroncore"
-    amd:
-      resourceCountName: "amd.com/gpu"
-    vnpus:
-    - chipName: 910A
-      commonWord: Ascend910A
-      resourceName: huawei.com/Ascend910A
-      resourceMemoryName: huawei.com/Ascend910A-memory
-      memoryAllocatable: 32768
-      memoryCapacity: 32768
-      aiCore: 30
-      templates:
-        - name: vir02
-          memory: 2184
-          aiCore: 2
-        - name: vir04
-          memory: 4369
-          aiCore: 4
-        - name: vir08
-          memory: 8738
-          aiCore: 8
-        - name: vir16
-          memory: 17476
-          aiCore: 16
-    - chipName: 910B2
-      commonWord: Ascend910B2
-      resourceName: huawei.com/Ascend910B2
-      resourceMemoryName: huawei.com/Ascend910B2-memory
-      memoryAllocatable: 65536
-      memoryCapacity: 65536
-      aiCore: 24
-      aiCPU: 6
-      templates:
-        - name: vir03_1c_8g
-          memory: 8192
-          aiCore: 3
-          aiCPU: 1
-        - name: vir06_1c_16g
-          memory: 16384
-          aiCore: 6
-          aiCPU: 1
-        - name: vir12_3c_32g
-          memory: 32768
-          aiCore: 12
-          aiCPU: 3
-    - chipName: 910B3
-      commonWord: Ascend910B3
-      resourceName: huawei.com/Ascend910B3
-      resourceMemoryName: huawei.com/Ascend910B3-memory
-      memoryAllocatable: 65536
-      memoryCapacity: 65536
-      aiCore: 20
-      aiCPU: 7
-      templates:
-        - name: vir05_1c_16g
-          memory: 16384
-          aiCore: 5
-          aiCPU: 1
-        - name: vir10_3c_32g
-          memory: 32768
-          aiCore: 10
-          aiCPU: 3
-    - chipName: 910B4-1
-      commonWord: Ascend910B4-1
-      resourceName: huawei.com/Ascend910B4-1
-      resourceMemoryName: huawei.com/Ascend910B4-1-memory
-      memoryAllocatable: 65536
-      memoryCapacity: 65536
-      aiCore: 20
-      aiCPU: 7
-      templates:
-        # NOTE: Names of vnpu template for 910B4-1 are fixed by Ascend runtime and must not be changed.
-        # The memory is used for scheduling so the correct values must be set.
-        # Template vir05_1c_8g actually provides 16GB memory,
-        - name: vir05_1c_8g
-          memory: 16384
-          aiCore: 5
-          aiCPU: 1
-        # Template vir10_3c_16g actually provides 32GB memory
-        - name: vir10_3c_16g
-          memory: 32768
-          aiCore: 10
-          aiCPU: 3
-    - chipName: 910B4
-      commonWord: Ascend910B4
-      resourceName: huawei.com/Ascend910B4
-      resourceMemoryName: huawei.com/Ascend910B4-memory
-      memoryAllocatable: 32768
-      memoryCapacity: 32768
-      aiCore: 20
-      aiCPU: 7
-      templates:
-        - name: vir05_1c_8g
-          memory: 8192
-          aiCore: 5
-          aiCPU: 1
-        - name: vir10_3c_16g
-          memory: 16384
-          aiCore: 10
-          aiCPU: 3
-    - chipName: 310P3
-      commonWord: Ascend310P
-      resourceName: huawei.com/Ascend310P
-      resourceMemoryName: huawei.com/Ascend310P-memory
-      memoryAllocatable: 21527
-      memoryCapacity: 24576
-      aiCore: 8
-      aiCPU: 7
-      templates:
-        - name: vir01
-          memory: 3072
-          aiCore: 1
-          aiCPU: 1
-        - name: vir02
-          memory: 6144
-          aiCore: 2
-          aiCPU: 2
-        - name: vir04
-          memory: 12288
-          aiCore: 4
-          aiCPU: 4
-  {{ end }}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/mutatingwebhookconfiguration.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/mutatingwebhookconfiguration.yaml
deleted file mode 100644
index c763b6aa..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/mutatingwebhookconfiguration.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-{{- if .Values.webhook.config.mutating.enabled }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-  name: {{ .Release.Name }}-mutatingwebhookconfiguration
-  annotations:
-    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ .Release.Name }}-dra-webhook-serving-cert
-webhooks:
-  - name: mutate.hami.io
-    admissionReviewVersions: ["v1"]
-    clientConfig:
-      service:
-        name: {{ .Release.Name }}-dra-webhook
-        namespace: {{ .Release.Namespace }}
-        path: /mutate
-    rules:
-      - apiGroups:
-          - ""
-        apiVersions:
-          - v1
-        operations:
-          - CREATE
-        resources:
-          - pods
-        scope: '*'
-    sideEffects: None
-    timeoutSeconds: 10
-{{- end }}
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/validatingwebhookconfiguration.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/validatingwebhookconfiguration.yaml
deleted file mode 100644
index acdcbb96..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/validatingwebhookconfiguration.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-{{- if .Values.webhook.config.validating.enabled }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: {{ .Release.Name }}-validatingwebhookconfiguration
-  annotations:
-    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ .Release.Name }}-dra-webhook-serving-cert
-webhooks:
-  - name: validate.hami.io
-    admissionReviewVersions: ["v1"]
-    clientConfig:
-      service:
-        name: {{ .Release.Name }}-dra-webhook
-        namespace: {{ .Release.Namespace }}
-        path: /validate
-    rules:
-      - apiGroups:
-          - ""
-        apiVersions:
-          - v1
-        operations:
-          - DELETE
-        resources:
-          - pods
-        scope: '*'
-    sideEffects: None
-    timeoutSeconds: 10
-    failurePolicy: Ignore
-{{- end }}
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-clusterrole.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-clusterrole.yaml
deleted file mode 100644
index 28916a36..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-clusterrole.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "hami.dra.webhook.fullname" . }}
-rules:
-- apiGroups: [""]
-  resources: ["pods"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["admissionregistration.k8s.io"]
-  resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["resource.k8s.io"]
-  resources: ["resourceclaims"]
-  verbs: ["*"]
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-clusterrolebinding.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-clusterrolebinding.yaml
deleted file mode 100644
index daad52f2..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-clusterrolebinding.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "hami.dra.webhook.fullname" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ include "hami.dra.webhook.fullname" . }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "hami.dra.webhook.fullname" . }}
-    namespace: {{ .Release.Namespace }}
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-deployment.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-deployment.yaml
deleted file mode 100644
index 8e3cf90c..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-deployment.yaml
+++ /dev/null
@@ -1,59 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ include "hami.dra.webhook.fullname" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "hami.dra.webhook.fullname" . }}
-    {{- include "hami-dra-webhook.labels" . | nindent 4 }}
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      {{- include "hami-dra-webhook.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      labels:
-        {{- include "hami-dra-webhook.selectorLabels" . | nindent 8 }}
-    spec:
-      {{- include "hami.dra.webhook.imagePullSecrets" . | nindent 6 }}
-      serviceAccountName: {{ include "hami.dra.webhook.fullname" . }}
-      containers:
-        - name: webhook
-          image: {{ include "hami.dra.webhook.image" . }}
-          imagePullPolicy: {{ .Values.webhook.image.pullPolicy | default "IfNotPresent" }}
-          command:
-            - /bin/webhook
-            - --v=5
-            - --bind-address=0.0.0.0
-            - --secure-port=8443
-            - --cert-dir=/tls
-            - --tls-cert-file-name=tls.crt
-            - --tls-private-key-file-name=tls.key
-            - --metrics-bind-address=:8080
-            - --health-probe-bind-address=:8000
-            - --device-config-file=/device-config.yaml
-          ports:
-            - containerPort: 8443
-              name: webhook
-              protocol: TCP
-            - containerPort: 8080
-              name: metrics
-              protocol: TCP
-            - containerPort: 8000
-              name: health
-              protocol: TCP
-          volumeMounts:
-            - name: device-config
-              mountPath: /device-config.yaml
-              subPath: device-config.yaml
-            - name: tls-config
-              mountPath: /tls
-              readOnly: true
-      volumes:
-        - name: device-config
-          configMap:
-            name: {{ include "hami.dra.webhook.fullname" . }}-device-config
-        - name: tls-config
-          secret:
-            secretName: {{ if .Values.certs.certManager.enabled }}{{ .Release.Name }}-dra-webhook-tls{{ else }}{{ .Release.Name }}-tls{{ end }}
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-service.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-service.yaml
deleted file mode 100644
index 290174ec..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-service.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Release.Name }}-dra-webhook
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "hami-dra-webhook.selectorLabels" . | nindent 4 }}
-spec:
-  type: "ClusterIP"
-  selector:
-    {{- include "hami-dra-webhook.selectorLabels" . | nindent 4 }}
-  ports:
-    - port: 443
-      targetPort: 8443
-      name: webhook
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-serviceaccount.yaml b/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-serviceaccount.yaml
deleted file mode 100644
index b0dc2fb2..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/templates/webhook/webhook-serviceaccount.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "hami.dra.webhook.fullname" . }}
-  namespace: {{ .Release.Namespace }}
diff --git a/packages/system/hami/charts/hami/charts/hami-dra/values.yaml b/packages/system/hami/charts/hami/charts/hami-dra/values.yaml
deleted file mode 100644
index ebbbfed7..00000000
--- a/packages/system/hami/charts/hami/charts/hami-dra/values.yaml
+++ /dev/null
@@ -1,166 +0,0 @@
-## @section Global configuration
-## @param global.imageRegistry Global Docker image registry
-## @param global.imagePullSecrets Global Docker image pull secrets
-global:
-  ## @param global.imageRegistry Global Docker image registry
-  imageRegistry: ""
-  ## E.g.
-  ## imagePullSecrets:
-  ##   - myRegistryKeySecretName
-  ## @param global.imagePullSecrets Global Docker image pull secrets
-  imagePullSecrets: []
-
-#Nvidia GPU Parameters
-resourceName: "nvidia.com/gpu"
-resourceMem: "nvidia.com/gpumem"
-resourceMemPercentage: "nvidia.com/gpumem-percentage"
-resourceCores: "nvidia.com/gpucores"
-resourcePriority: "nvidia.com/priority"
-
-#MLU Parameters
-mluResourceName: "cambricon.com/vmlu"
-mluResourceMem: "cambricon.com/mlu.smlu.vmemory"
-mluResourceCores: "cambricon.com/mlu.smlu.vcore"
-
-#Hygon DCU Parameters
-dcuResourceName: "hygon.com/dcunum"
-dcuResourceMem: "hygon.com/dcumem"
-dcuResourceCores: "hygon.com/dcucores"
-
-#Metax sGPU Parameters
-metaxResourceName: "metax-tech.com/sgpu"
-metaxResourceCore: "metax-tech.com/vcore"
-metaxResourceMem: "metax-tech.com/vmemory"
-metaxsGPUTopologyAware: "false"
-
-#Enflame VGCU Parameters
-enflameResourceNameVGCU: "enflame.com/vgcu"
-enflameResourceNameVGCUPercentage: "enflame.com/vgcu-percentage"
-
-#Kunlun XPU Parameters
-kunlunResourceName: "kunlunxin.com/xpu"
-kunlunResourceVCountName: "kunlunxin.com/vxpu"
-kunlunResourceVMemoryName: "kunlunxin.com/vxpu-memory"
-
-# Webhook deployment configuration
-webhook:
-  image:
-    registry: ghcr.io
-    repository: project-hami/hami-dra-webhook
-    tag: "v0.1.0"
-    ## Specify a imagePullPolicy
-    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
-    ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
-    ##
-    pullPolicy: Always
-    ## Optionally specify an array of imagePullSecrets.
-    ## Secrets must be manually created in the namespace.
-    ## Example:
-    ## pullSecrets:
-    ##   - myRegistryKeySecretName
-    ##
-    pullSecrets: []
-  ## @param resources controllerManager resource requests and limits
-  resources:
-  # If you do want to specify resources, uncomment the following
-  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-    limits:
-      cpu: 500m
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 128Mi
-  ## @param nodeSelector controllerManager node labels for pod assignment
-  args:
-    webhookName: ""  # Default: {{ .Release.Name }}-hami-dra-webhook
-    secretName: ""  # Default: {{ .Release.Name }}-hami-dra-webhook-tls
-  # Webhook configuration
-  config:
-    mutating:
-      enabled: true
-    validating:
-      enabled: true
-
-# Monitor deployment configuration
-monitor:
-  enabled: true
-  replicas: 1
-  image:
-    registry: ghcr.io
-    repository: project-hami/hami-dra-monitor
-    tag: "v0.1.0"
-    ## Specify a imagePullPolicy
-    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
-    ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
-    ##
-    pullPolicy: Always
-    ## Optionally specify an array of imagePullSecrets.
-    ## Secrets must be manually created in the namespace.
-    ## Example:
-    ## pullSecrets:
-    ##   - myRegistryKeySecretName
-    ##
-    pullSecrets: []
-  ## @param resources monitor resource requests and limits
-  resources:
-    limits:
-      cpu: 500m
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 128Mi
-  ## Monitor configuration
-  logLevel: 2
-  metricsBindAddress: ":8080"
-  healthProbeBindAddress: ":8000"
-  kubeAPIQPS: 40.0
-  kubeAPIBurst: 60
-  collectInterval: "30s"
-  ## Monitor service configuration
-  service:
-    ## Service type: ClusterIP, NodePort, or LoadBalancer
-    ## Defaults to ClusterIP
-    type: ClusterIP
-    ## NodePort configuration (only used when type is NodePort)
-    nodePort:
-      ## Metrics port (NodePort). If not specified, Kubernetes will assign a random port
-      metrics: ""
-
-# Certificate configuration
-certs:
-  # Custom certificate (used when mode is "custom")
-  custom:
-    crt: ""
-    key: ""
-  # Cert-manager configuration (used when mode is "cert-manager")
-  certManager:
-    enabled: true
-    # Private key rotation policy: "Never" or "Always"
-    # In cert-manager >= v1.18.0, the default changed from "Never" to "Always"
-    # Setting to "Never" avoids frequent certificate rotation for webhooks
-    privateKeyRotationPolicy: "Never"
-    issuer:
-      clusterIssuerName: ""  # Required when type is "clusterIssuer"
-
-# DRA Drivers configuration
-drivers:
-  nvidia:
-    enabled: true
-    # If you are using gpu driver on host, you need to set this to false
-    containerDriver: true
-    image:
-      registry: ghcr.io
-      repository: projecthami/k8s-dra-driver
-      tag: "v0.0.1-dev"
-      ## Specify a imagePullPolicy
-      ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
-      ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
-      ##
-      pullPolicy: IfNotPresent
-      ## Optionally specify an array of imagePullSecrets.
-      ## Secrets must be manually created in the namespace.
-      ## Example:
-      ## pullSecrets:
-      ##   - myRegistryKeySecretName
-      ##
-      pullSecrets: []

From 385ea7a17f8cfc4526c50db036c105c63a5817fc Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Thu, 23 Apr 2026 22:16:34 +0300
Subject: [PATCH 596/666] feat(platform): register HAMi as optional system
 package

Add PackageSource for HAMi with dependency on gpu-operator.
Include HAMi in the iaas bundle as an optional package, allowing
host-level deployment alongside the existing kubernetes addon path.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/core/platform/sources/hami.yaml      | 24 +++++++++++++++++++
 .../core/platform/templates/bundles/iaas.yaml |  1 +
 2 files changed, 25 insertions(+)
 create mode 100644 packages/core/platform/sources/hami.yaml

diff --git a/packages/core/platform/sources/hami.yaml b/packages/core/platform/sources/hami.yaml
new file mode 100644
index 00000000..0184e405
--- /dev/null
+++ b/packages/core/platform/sources/hami.yaml
@@ -0,0 +1,24 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.hami
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+    path: /
+  variants:
+  - name: default
+    dependsOn:
+    - cozystack.gpu-operator
+    components:
+    - name: hami
+      path: system/hami
+      valuesFiles:
+      - values.yaml
+      install:
+        privileged: true
+        namespace: cozy-hami
+        releaseName: hami
diff --git a/packages/core/platform/templates/bundles/iaas.yaml b/packages/core/platform/templates/bundles/iaas.yaml
index ced0a322..66ec98b2 100644
--- a/packages/core/platform/templates/bundles/iaas.yaml
+++ b/packages/core/platform/templates/bundles/iaas.yaml
@@ -10,6 +10,7 @@
 {{include "cozystack.platform.package.default" (list "cozystack.kubevirt-cdi" $) }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.vm-default-images" $) }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.gpu-operator" $) }}
+{{include "cozystack.platform.package.optional.default" (list "cozystack.hami" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.kamaji" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.capi-operator" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.capi-provider-bootstrap-kubeadm" $) }}

From 6af74cec0ea436cbd5aefce5e5c8bedf86e5b81a Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 23 Apr 2026 23:24:38 +0300
Subject: [PATCH 597/666] fix(ingress): accept pre-CIDR externalIPs in
 CiliumLoadBalancerIPPool

Address review feedback from gemini-code-assist on
packages/extra/ingress/templates/cilium-lb-pool.yaml:19: if the operator
passes an externalIP already in CIDR form (192.0.2.10/32 or 2001:db8::1/128),
the template appended a second /32 or /128 suffix producing an invalid
CiliumLoadBalancerIPPool block. Guard the suffix append on the absence of
"/" in the input.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../extra/ingress/templates/cilium-lb-pool.yaml    |  2 +-
 packages/extra/ingress/tests/exposure_test.yaml    | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/packages/extra/ingress/templates/cilium-lb-pool.yaml b/packages/extra/ingress/templates/cilium-lb-pool.yaml
index a383922b..048eb58b 100644
--- a/packages/extra/ingress/templates/cilium-lb-pool.yaml
+++ b/packages/extra/ingress/templates/cilium-lb-pool.yaml
@@ -16,7 +16,7 @@ metadata:
 spec:
   blocks:
   {{- range $exposeIPsList }}
-  - cidr: {{ . }}/{{ if contains ":" . }}128{{ else }}32{{ end }}
+  - cidr: {{ . }}{{ if not (contains "/" .) }}/{{ if contains ":" . }}128{{ else }}32{{ end }}{{ end }}
   {{- end }}
   serviceSelector:
     matchLabels:
diff --git a/packages/extra/ingress/tests/exposure_test.yaml b/packages/extra/ingress/tests/exposure_test.yaml
index 780e0715..323c8e68 100644
--- a/packages/extra/ingress/tests/exposure_test.yaml
+++ b/packages/extra/ingress/tests/exposure_test.yaml
@@ -249,3 +249,17 @@ tests:
           path: spec.values.ingress-nginx.controller.service.externalIPs
           value:
             - 192.0.2.10
+
+  - it: loadBalancer mode accepts pre-CIDR input without double-suffixing
+    set:
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10/32,2001:db8::1/128"
+        expose-mode: loadBalancer
+    asserts:
+      - template: templates/cilium-lb-pool.yaml
+        equal:
+          path: spec.blocks
+          value:
+            - cidr: 192.0.2.10/32
+            - cidr: 2001:db8::1/128

From 9b87bda06af20d7c1ca8d96b8f338f3bc937d0c5 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Fri, 24 Apr 2026 03:14:41 +0300
Subject: [PATCH 598/666] fix(postgres-operator): block HelmRelease Ready until
 the cnpg webhook actually serves
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The cnpg admission webhook's controller pod passes readinessProbe as soon
as the local HTTPS server binds to :9443. The HelmRelease marks itself
Ready right after that via helm install --wait. But the Service
cnpg-webhook-service needs its EndpointSlice populated and the data plane
(kube-proxy / cilium) programmed before kube-apiserver can reach the
webhook through the Service ClusterIP. That gap is short but not zero,
and any HelmRelease that depends on postgres-operator (cozy-keycloak,
tenant Postgres apps) can fire its own install inside the window and hit

  Internal error occurred: failed calling webhook "mcluster.cnpg.io":
  failed to call webhook: Post "https://cnpg-webhook-service.cozy-postgres-operator.svc:443/...":
  dial tcp <svc-ip>:443: connect: connection refused

which fails the install of the downstream release. Seen on cozystack/cozystack#2470
E2E run 24862782568.

Add a post-install,post-upgrade Helm hook Job that blocks the release
from reporting Ready until the webhook answers /readyz through the
apiserver service proxy. Apiserver proxy routes the call over the same
Service IP → EndpointSlice → pod path the admission webhook uses, so
once it responds, the webhook admission path is also working.

RBAC is minimal: a dedicated ServiceAccount with a ClusterRole that only
grants get on services/proxy scoped to https:cnpg-webhook-service:webhook-server.
The Job times out after 120s with 60 attempts at 2s intervals — longer
than any data-plane programming delay seen on E2E, but bounded.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/postgres-operator/Makefile    |   3 +
 .../templates/webhook-ready-hook.yaml         | 139 ++++++++
 .../tests/webhook-ready-hook_test.yaml        | 308 ++++++++++++++++++
 packages/system/postgres-operator/values.yaml |  25 ++
 4 files changed, 475 insertions(+)
 create mode 100644 packages/system/postgres-operator/templates/webhook-ready-hook.yaml
 create mode 100644 packages/system/postgres-operator/tests/webhook-ready-hook_test.yaml

diff --git a/packages/system/postgres-operator/Makefile b/packages/system/postgres-operator/Makefile
index f6d7ddaa..5279f8a7 100644
--- a/packages/system/postgres-operator/Makefile
+++ b/packages/system/postgres-operator/Makefile
@@ -3,6 +3,9 @@ export NAMESPACE=cozy-$(NAME)
 
 include ../../../hack/package.mk
 
+test:
+	helm unittest .
+
 update:
 	rm -rf charts
 	helm repo add cnpg https://cloudnative-pg.github.io/charts
diff --git a/packages/system/postgres-operator/templates/webhook-ready-hook.yaml b/packages/system/postgres-operator/templates/webhook-ready-hook.yaml
new file mode 100644
index 00000000..2ad4e7c9
--- /dev/null
+++ b/packages/system/postgres-operator/templates/webhook-ready-hook.yaml
@@ -0,0 +1,139 @@
+{{- /*
+  Post-install gate: block the HelmRelease from reporting Ready until the
+  cnpg admission webhook actually serves through the cluster Service. Helm
+  --wait on the controller pod passes once its readinessProbe passes, but
+  EndpointSlice propagation and kube-proxy/cilium data-plane programming
+  can lag by a second or two — long enough for any HelmRelease that
+  depends on postgres-operator (e.g. cozy-keycloak, tenant Postgres apps)
+  to fire its own install and have kube-apiserver hit the mcluster.cnpg.io
+  mutating webhook with "dial tcp <svc-ip>:443: connect: connection refused".
+
+  The Job uses the apiserver service proxy, which exercises the same
+  endpoint-resolution and apiserver-initiated pod dial that the admission
+  webhook path uses. Once /readyz answers through the proxy the data-plane
+  race is resolved. It does not verify the webhook's TLS CA bundle, so
+  this gate is scoped to reachability regressions, not cert rotation.
+
+  The service name and port name are hardcoded literals. Upstream cnpg
+  pins the service name in charts/cloudnative-pg/values.yaml with a
+  comment "DO NOT CHANGE THE SERVICE NAME as it is currently used to
+  generate the certificate and can not be configured". The port name is
+  fixed in charts/cloudnative-pg/templates/service.yaml (ports[0].name:
+  webhook-server). If a future `make update` ever changes either literal
+  upstream, the sync-check helm-unittest test
+  (tests/webhook-ready-hook_test.yaml) renders the subchart Service and
+  fails if the literal drifts — forcing this template to be updated in
+  the same change.
+*/}}
+{{- $_ := required "webhookReady.image.repository must be set to the container image providing kubectl for the post-install readiness Job" .Values.webhookReady.image.repository -}}
+{{- $_ := required "webhookReady.image.tag must be set for the post-install readiness Job" .Values.webhookReady.image.tag -}}
+{{- /* $svcName and $portName are hardcoded literals; see header comment. */ -}}
+{{- $svcName := "cnpg-webhook-service" -}}
+{{- /* $portName is the service port NAME, not number — matches ports[0].name in the vendored subchart's Service. */ -}}
+{{- $portName := "webhook-server" -}}
+{{- $resourceName := printf "https:%s:%s" $svcName $portName -}}
+{{- $maxAttempts := .Values.webhookReady.maxAttempts | default 60 -}}
+{{- $sleepSeconds := .Values.webhookReady.sleepSeconds | default 2 -}}
+{{- /* Derive activeDeadlineSeconds from retries + 60s slack so a values override that raises maxAttempts doesn't get silently cut. */ -}}
+{{- $deadline := add (mul (int $maxAttempts) (int $sleepSeconds)) 60 -}}
+{{- $image := printf "%s:%s" .Values.webhookReady.image.repository .Values.webhookReady.image.tag -}}
+{{- if .Values.webhookReady.image.digest }}
+{{- $image = printf "%s@%s" $image .Values.webhookReady.image.digest -}}
+{{- end }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Release.Name }}-webhook-ready
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-weight: "0"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-webhook-ready
+  annotations:
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-weight: "0"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+rules:
+  - apiGroups: [""]
+    resources: ["services/proxy"]
+    resourceNames: [{{ $resourceName | quote }}]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ .Release.Name }}-webhook-ready
+  annotations:
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-weight: "0"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Release.Name }}-webhook-ready
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Release.Name }}-webhook-ready
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ .Release.Name }}-webhook-ready
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-weight: "10"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: {{ .Values.webhookReady.backoffLimit | default 2 }}
+  activeDeadlineSeconds: {{ $deadline }}
+  template:
+    spec:
+      restartPolicy: Never
+      serviceAccountName: {{ .Release.Name }}-webhook-ready
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: wait
+          image: {{ $image }}
+          imagePullPolicy: {{ if .Values.webhookReady.image.digest }}IfNotPresent{{ else }}Always{{ end }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          command:
+            - sh
+            - -c
+            - |
+              set -e
+              ns={{ .Release.Namespace }}
+              proxy="/api/v1/namespaces/${ns}/services/{{ $resourceName }}/proxy/readyz"
+              max_attempts={{ $maxAttempts }}
+              sleep_seconds={{ $sleepSeconds }}
+              i=0
+              last_err=""
+              until last_err=$(kubectl get --raw "$proxy" 2>&1 >/dev/null); do
+                i=$((i + 1))
+                if [ $i -gt $max_attempts ]; then
+                  echo "timeout: cnpg webhook did not respond through the apiserver proxy after ${max_attempts} attempts (${sleep_seconds}s each)"
+                  echo "last error: ${last_err}"
+                  exit 1
+                fi
+                if [ $((i % 10)) -eq 1 ]; then
+                  echo "attempt $i/${max_attempts}: ${last_err}"
+                fi
+                sleep "$sleep_seconds"
+              done
+              echo "cnpg webhook is ready"
diff --git a/packages/system/postgres-operator/tests/webhook-ready-hook_test.yaml b/packages/system/postgres-operator/tests/webhook-ready-hook_test.yaml
new file mode 100644
index 00000000..69f5a6b5
--- /dev/null
+++ b/packages/system/postgres-operator/tests/webhook-ready-hook_test.yaml
@@ -0,0 +1,308 @@
+suite: cnpg webhook post-install readiness gate
+
+templates:
+  - templates/webhook-ready-hook.yaml
+  - charts/cloudnative-pg/templates/service.yaml
+
+release:
+  name: postgres-operator
+  namespace: cozy-postgres-operator
+
+tests:
+  - it: renders four hook objects (SA + ClusterRole + ClusterRoleBinding + Job)
+    template: templates/webhook-ready-hook.yaml
+    asserts:
+      - hasDocuments:
+          count: 4
+
+  - it: every rendered object carries post-install and post-upgrade hook annotations
+    template: templates/webhook-ready-hook.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: metadata.annotations["helm.sh/hook"]
+          value: post-install,post-upgrade
+      - documentIndex: 1
+        equal:
+          path: metadata.annotations["helm.sh/hook"]
+          value: post-install,post-upgrade
+      - documentIndex: 2
+        equal:
+          path: metadata.annotations["helm.sh/hook"]
+          value: post-install,post-upgrade
+      - documentIndex: 3
+        equal:
+          path: metadata.annotations["helm.sh/hook"]
+          value: post-install,post-upgrade
+
+  - it: RBAC is created before the Job (hook-weight ordering)
+    template: templates/webhook-ready-hook.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: kind
+          value: ServiceAccount
+      - documentIndex: 0
+        equal:
+          path: metadata.annotations["helm.sh/hook-weight"]
+          value: "0"
+      - documentIndex: 1
+        equal:
+          path: kind
+          value: ClusterRole
+      - documentIndex: 1
+        equal:
+          path: metadata.annotations["helm.sh/hook-weight"]
+          value: "0"
+      - documentIndex: 2
+        equal:
+          path: kind
+          value: ClusterRoleBinding
+      - documentIndex: 2
+        equal:
+          path: metadata.annotations["helm.sh/hook-weight"]
+          value: "0"
+      - documentIndex: 3
+        equal:
+          path: kind
+          value: Job
+      - documentIndex: 3
+        equal:
+          path: metadata.annotations["helm.sh/hook-weight"]
+          value: "10"
+
+  - it: RBAC resourceName matches the exact proxy URL segment the Job probes
+    template: templates/webhook-ready-hook.yaml
+    asserts:
+      - documentIndex: 1
+        equal:
+          path: rules[0].resources[0]
+          value: services/proxy
+      - documentIndex: 1
+        equal:
+          path: rules[0].resourceNames[0]
+          value: https:cnpg-webhook-service:webhook-server
+      - documentIndex: 3
+        matchRegex:
+          path: spec.template.spec.containers[0].command[2]
+          pattern: "/api/v1/namespaces/\\$\\{ns\\}/services/https:cnpg-webhook-service:webhook-server/proxy/readyz"
+
+  - it: hardcoded service name in the hook matches the vendored cnpg subchart Service (drift guard for make update)
+    template: charts/cloudnative-pg/templates/service.yaml
+    asserts:
+      - equal:
+          path: metadata.name
+          value: cnpg-webhook-service
+      - equal:
+          path: spec.ports[0].name
+          value: webhook-server
+
+  - it: Job calls kubectl get --raw on the proxy path
+    template: templates/webhook-ready-hook.yaml
+    asserts:
+      - documentIndex: 3
+        matchRegex:
+          path: spec.template.spec.containers[0].command[2]
+          pattern: "kubectl get --raw"
+
+  - it: Job image is digest-pinned when webhookReady.image.digest is set
+    template: templates/webhook-ready-hook.yaml
+    set:
+      webhookReady:
+        image:
+          repository: docker.io/clastix/kubectl
+          tag: v1.32
+          digest: sha256:b9ef7d8dbe65bcc81a46c09b8dc7543103055021c4f43287bf59e92a8f4fe05c
+    asserts:
+      - documentIndex: 3
+        equal:
+          path: spec.template.spec.containers[0].image
+          value: docker.io/clastix/kubectl:v1.32@sha256:b9ef7d8dbe65bcc81a46c09b8dc7543103055021c4f43287bf59e92a8f4fe05c
+
+  - it: Job image falls back to tag-only when digest is not configured
+    template: templates/webhook-ready-hook.yaml
+    set:
+      webhookReady:
+        image:
+          repository: docker.io/clastix/kubectl
+          tag: v1.32
+          digest: ""
+    asserts:
+      - documentIndex: 3
+        equal:
+          path: spec.template.spec.containers[0].image
+          value: docker.io/clastix/kubectl:v1.32
+
+  - it: backoffLimit defaults to 2 so transient pod-level failures retry instead of killing the HelmRelease
+    template: templates/webhook-ready-hook.yaml
+    asserts:
+      - documentIndex: 3
+        equal:
+          path: spec.backoffLimit
+          value: 2
+
+  - it: backoffLimit is overridable
+    template: templates/webhook-ready-hook.yaml
+    set:
+      webhookReady:
+        backoffLimit: 5
+    asserts:
+      - documentIndex: 3
+        equal:
+          path: spec.backoffLimit
+          value: 5
+
+  - it: chart render fails when webhookReady.image.repository is empty
+    template: templates/webhook-ready-hook.yaml
+    set:
+      webhookReady:
+        image:
+          repository: ""
+          tag: v1.32
+    asserts:
+      - failedTemplate:
+          errorMessage: "webhookReady.image.repository must be set to the container image providing kubectl for the post-install readiness Job"
+
+  - it: chart render fails when webhookReady.image.tag is empty
+    template: templates/webhook-ready-hook.yaml
+    set:
+      webhookReady:
+        image:
+          repository: docker.io/clastix/kubectl
+          tag: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: "webhookReady.image.tag must be set for the post-install readiness Job"
+
+  - it: retry loop bounds default when blanked so a wiped override still produces a working Job
+    template: templates/webhook-ready-hook.yaml
+    set:
+      webhookReady:
+        image:
+          repository: docker.io/clastix/kubectl
+          tag: v1.32
+        maxAttempts: null
+        sleepSeconds: null
+    asserts:
+      - documentIndex: 3
+        matchRegex:
+          path: spec.template.spec.containers[0].command[2]
+          pattern: "max_attempts=60"
+      - documentIndex: 3
+        matchRegex:
+          path: spec.template.spec.containers[0].command[2]
+          pattern: "sleep_seconds=2"
+
+  - it: Job pod runs non-root with seccomp RuntimeDefault for restricted-PSA clusters
+    template: templates/webhook-ready-hook.yaml
+    asserts:
+      - documentIndex: 3
+        equal:
+          path: spec.template.spec.securityContext.runAsNonRoot
+          value: true
+      - documentIndex: 3
+        equal:
+          path: spec.template.spec.securityContext.seccompProfile.type
+          value: RuntimeDefault
+
+  - it: Job container drops all capabilities and runs read-only rootfs
+    template: templates/webhook-ready-hook.yaml
+    asserts:
+      - documentIndex: 3
+        equal:
+          path: spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation
+          value: false
+      - documentIndex: 3
+        equal:
+          path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
+          value: true
+      - documentIndex: 3
+        equal:
+          path: spec.template.spec.containers[0].securityContext.capabilities.drop[0]
+          value: ALL
+
+  - it: imagePullPolicy is IfNotPresent when digest-pinned, Always when tag-only
+    template: templates/webhook-ready-hook.yaml
+    set:
+      webhookReady:
+        image:
+          repository: docker.io/clastix/kubectl
+          tag: v1.32
+          digest: sha256:b9ef7d8dbe65bcc81a46c09b8dc7543103055021c4f43287bf59e92a8f4fe05c
+    asserts:
+      - documentIndex: 3
+        equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: IfNotPresent
+
+  - it: imagePullPolicy is Always when no digest is configured
+    template: templates/webhook-ready-hook.yaml
+    set:
+      webhookReady:
+        image:
+          repository: docker.io/clastix/kubectl
+          tag: v1.32
+          digest: ""
+    asserts:
+      - documentIndex: 3
+        equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: Always
+
+  - it: retry loop captures and surfaces the last kubectl error message on timeout
+    template: templates/webhook-ready-hook.yaml
+    asserts:
+      - documentIndex: 3
+        matchRegex:
+          path: spec.template.spec.containers[0].command[2]
+          pattern: 'last_err=\$\(kubectl get --raw'
+      - documentIndex: 3
+        matchRegex:
+          path: spec.template.spec.containers[0].command[2]
+          pattern: 'last error: \$\{last_err\}'
+
+  - it: retry loop error message stays in sync when maxAttempts is bumped
+    template: templates/webhook-ready-hook.yaml
+    set:
+      webhookReady:
+        image:
+          repository: docker.io/clastix/kubectl
+          tag: v1.32
+        maxAttempts: 90
+        sleepSeconds: 3
+    asserts:
+      - documentIndex: 3
+        matchRegex:
+          path: spec.template.spec.containers[0].command[2]
+          pattern: "max_attempts=90"
+      - documentIndex: 3
+        matchRegex:
+          path: spec.template.spec.containers[0].command[2]
+          pattern: "sleep_seconds=3"
+      - documentIndex: 3
+        matchRegex:
+          path: spec.template.spec.containers[0].command[2]
+          pattern: 'after \$\{max_attempts\} attempts'
+
+  - it: activeDeadlineSeconds scales with retry bounds so an override raise does not silently cut
+    template: templates/webhook-ready-hook.yaml
+    set:
+      webhookReady:
+        image:
+          repository: docker.io/clastix/kubectl
+          tag: v1.32
+        maxAttempts: 180
+        sleepSeconds: 3
+    asserts:
+      - documentIndex: 3
+        equal:
+          path: spec.activeDeadlineSeconds
+          value: 600
+
+  - it: activeDeadlineSeconds defaults include 60s slack over the default retry window
+    template: templates/webhook-ready-hook.yaml
+    asserts:
+      - documentIndex: 3
+        equal:
+          path: spec.activeDeadlineSeconds
+          value: 180
diff --git a/packages/system/postgres-operator/values.yaml b/packages/system/postgres-operator/values.yaml
index cae3dc53..854a3ac6 100644
--- a/packages/system/postgres-operator/values.yaml
+++ b/packages/system/postgres-operator/values.yaml
@@ -3,3 +3,28 @@ cloudnative-pg:
     create: true
   image:
     tag: "1.27.3"
+# Image used by the post-install webhook-readiness Job (see templates/webhook-ready-hook.yaml).
+# Any image with kubectl on PATH works; the Job calls the apiserver service proxy with the
+# hook ServiceAccount's token to confirm the mcluster.cnpg.io webhook is reachable end-to-end
+# before the HelmRelease reports Ready, closing the "connection refused" bootstrap race.
+#
+# The tag is digest-pinned so an upstream retag does not change what runs on every install
+# and upgrade across the fleet. Refresh by resolving the current manifest-list digest
+# (`docker manifest inspect docker.io/clastix/kubectl:v1.32`) and updating `digest` below.
+# renovate: datasource=docker depName=docker.io/clastix/kubectl
+webhookReady:
+  image:
+    repository: docker.io/clastix/kubectl
+    tag: v1.32
+    digest: sha256:b9ef7d8dbe65bcc81a46c09b8dc7543103055021c4f43287bf59e92a8f4fe05c
+  # Retry loop bounds for the readiness probe. Defaults total ~120s wall clock.
+  # Both are `default`-coerced in the template so an override that blanks them still
+  # produces a working Job.
+  maxAttempts: 60
+  sleepSeconds: 2
+  # Pod-level retry budget for transient node/registry failures (image pull rate limit,
+  # OOM, CNI hiccup). The shell loop inside the container only covers reachability retries.
+  # Pod retries and activeDeadlineSeconds (wall-clock bound on the whole Job across all
+  # pod retries) are ANDed: a 5-minute ImagePullBackOff on attempt 0 leaves only ~60s for
+  # subsequent retries before the Job is cut.
+  backoffLimit: 2

From 3b3540448975391ad7582db58d83ce5b18b15129 Mon Sep 17 00:00:00 2001
From: Denis Chernosov <denis0.ru@gmail.com>
Date: Fri, 24 Apr 2026 11:32:20 +0400
Subject: [PATCH 599/666] fix(cozystack-engine): add managed Kubernetes without
 visible control-plane nodes support to lineage-controller-webhook (#2417)

Signed-off-by: Denis Chernosov <denis0.ru@gmail.com>
---
 .../templates/daemonset.yaml                  |  2 +
 .../templates/deployment.yaml                 | 49 +++++++++++++++++++
 .../templates/pdb.yaml                        | 11 +++++
 .../lineage-controller-webhook/values.yaml    |  5 ++
 4 files changed, 67 insertions(+)
 create mode 100644 packages/system/lineage-controller-webhook/templates/deployment.yaml
 create mode 100644 packages/system/lineage-controller-webhook/templates/pdb.yaml

diff --git a/packages/system/lineage-controller-webhook/templates/daemonset.yaml b/packages/system/lineage-controller-webhook/templates/daemonset.yaml
index 860aee6e..536ea24a 100644
--- a/packages/system/lineage-controller-webhook/templates/daemonset.yaml
+++ b/packages/system/lineage-controller-webhook/templates/daemonset.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.lineageControllerWebhook.deployment.enabled }}
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
@@ -51,3 +52,4 @@ spec:
           secret:
             secretName: lineage-controller-webhook-cert
             defaultMode: 0400
+{{- end }}
\ No newline at end of file
diff --git a/packages/system/lineage-controller-webhook/templates/deployment.yaml b/packages/system/lineage-controller-webhook/templates/deployment.yaml
new file mode 100644
index 00000000..87717fd3
--- /dev/null
+++ b/packages/system/lineage-controller-webhook/templates/deployment.yaml
@@ -0,0 +1,49 @@
+{{- if .Values.lineageControllerWebhook.deployment.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: lineage-controller-webhook
+  labels:
+    app: lineage-controller-webhook
+spec:
+  replicas: {{ .Values.lineageControllerWebhook.deployment.replicas }}
+  selector:
+    matchLabels:
+      app: lineage-controller-webhook
+  template:
+    metadata:
+      labels:
+        app: lineage-controller-webhook
+    spec:
+      serviceAccountName: lineage-controller-webhook
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                topologyKey: kubernetes.io/hostname
+                labelSelector:
+                  matchLabels:
+                    app: lineage-controller-webhook
+      containers:
+      - name: lineage-controller-webhook
+        image: "{{ .Values.lineageControllerWebhook.image }}"
+        args:
+        {{- if .Values.lineageControllerWebhook.debug }}
+        - --zap-log-level=debug
+        {{- else }}
+        - --zap-log-level=info
+        {{- end }}
+        ports:
+        - name: webhook
+          containerPort: 9443
+        volumeMounts:
+          - name: webhook-certs
+            mountPath: /tmp/k8s-webhook-server/serving-certs
+            readOnly: true
+      volumes:
+        - name: webhook-certs
+          secret:
+            secretName: lineage-controller-webhook-cert
+            defaultMode: 0400
+{{- end }}
\ No newline at end of file
diff --git a/packages/system/lineage-controller-webhook/templates/pdb.yaml b/packages/system/lineage-controller-webhook/templates/pdb.yaml
new file mode 100644
index 00000000..b0a9d4e4
--- /dev/null
+++ b/packages/system/lineage-controller-webhook/templates/pdb.yaml
@@ -0,0 +1,11 @@
+{{- if .Values.lineageControllerWebhook.deployment.enabled }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: lineage-controller-webhook
+spec:
+  minAvailable: {{ if gt (int .Values.lineageControllerWebhook.deployment.replicas) 1 }}1{{ else }}0{{ end }}
+  selector:
+    matchLabels:
+      app: lineage-controller-webhook
+{{- end }}
\ No newline at end of file
diff --git a/packages/system/lineage-controller-webhook/values.yaml b/packages/system/lineage-controller-webhook/values.yaml
index c5671548..2b84f4e1 100644
--- a/packages/system/lineage-controller-webhook/values.yaml
+++ b/packages/system/lineage-controller-webhook/values.yaml
@@ -2,9 +2,14 @@ lineageControllerWebhook:
   image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.3.0@sha256:e8984709686a5eaf19b89da378d7b8c688ea5607e0783a88d9c9e4ccfca96fb0
   debug: false
   localK8sAPIEndpoint:
+    # incompatable with Deployment mode
     enabled: true
   # nodeSelector for the DaemonSet
   # Talos uses empty value: "node-role.kubernetes.io/control-plane": ""
   # Generic k8s (k3s, kubeadm) uses: "node-role.kubernetes.io/control-plane": "true"
   nodeSelector:
     node-role.kubernetes.io/control-plane: ""
+  # if enabled, replace DaemonSet by Deployment
+  deployment:
+    enabled: false
+    replicas: 1

From ab7deb2b055c2a677c4c84c1bb22271306ebf372 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Fri, 24 Apr 2026 13:03:49 +0300
Subject: [PATCH 600/666] chore(kubernetes): regenerate after HAMi addon
 integration

Run make generate to update generated types, schema, README,
and CRD definitions for the new HAMi addon.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 api/apps/v1alpha1/kubernetes/types.go                | 12 ++++++++++++
 packages/apps/kubernetes/README.md                   |  3 +++
 packages/apps/kubernetes/values.schema.json          |  4 ++--
 .../system/kubernetes-rd/cozyrds/kubernetes.yaml     |  4 ++--
 4 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/api/apps/v1alpha1/kubernetes/types.go b/api/apps/v1alpha1/kubernetes/types.go
index 774fcdc5..39a05567 100644
--- a/api/apps/v1alpha1/kubernetes/types.go
+++ b/api/apps/v1alpha1/kubernetes/types.go
@@ -66,6 +66,9 @@ type Addons struct {
 	// NVIDIA GPU Operator.
 	// +kubebuilder:default:={}
 	GpuOperator GPUOperatorAddon `json:"gpuOperator"`
+	// HAMi GPU virtualization middleware.
+	// +kubebuilder:default:={}
+	Hami HAMiAddon `json:"hami"`
 	// Ingress-NGINX controller.
 	// +kubebuilder:default:={}
 	IngressNginx IngressNginxAddon `json:"ingressNginx"`
@@ -157,6 +160,15 @@ type GatewayAPIAddon struct {
 	Enabled bool `json:"enabled"`
 }
 
+type HAMiAddon struct {
+	// Enable HAMi (requires GPU Operator).
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Custom Helm values overrides.
+	// +kubebuilder:default:={}
+	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
+}
+
 type IngressNginxAddon struct {
 	// Enable the controller (requires nodes labeled `ingress-nginx`).
 	// +kubebuilder:default:=false
diff --git a/packages/apps/kubernetes/README.md b/packages/apps/kubernetes/README.md
index d62d3a39..d705af64 100644
--- a/packages/apps/kubernetes/README.md
+++ b/packages/apps/kubernetes/README.md
@@ -128,6 +128,9 @@ See the reference for components utilized in this service:
 | `addons.gpuOperator`                          | NVIDIA GPU Operator.                                                        | `object`   | `{}`      |
 | `addons.gpuOperator.enabled`                  | Enable GPU Operator.                                                        | `bool`     | `false`   |
 | `addons.gpuOperator.valuesOverride`           | Custom Helm values overrides.                                               | `object`   | `{}`      |
+| `addons.hami`                                 | HAMi GPU virtualization middleware.                                         | `object`   | `{}`      |
+| `addons.hami.enabled`                         | Enable HAMi (requires GPU Operator).                                        | `bool`     | `false`   |
+| `addons.hami.valuesOverride`                  | Custom Helm values overrides.                                               | `object`   | `{}`      |
 | `addons.fluxcd`                               | FluxCD GitOps operator.                                                     | `object`   | `{}`      |
 | `addons.fluxcd.enabled`                       | Enable FluxCD.                                                              | `bool`     | `false`   |
 | `addons.fluxcd.valuesOverride`                | Custom Helm values overrides.                                               | `object`   | `{}`      |
diff --git a/packages/apps/kubernetes/values.schema.json b/packages/apps/kubernetes/values.schema.json
index 3d7a17dd..1e457f1f 100644
--- a/packages/apps/kubernetes/values.schema.json
+++ b/packages/apps/kubernetes/values.schema.json
@@ -270,7 +270,7 @@
           }
         },
         "hami": {
-          "description": "HAMi GPU virtualization middleware. Enables fractional GPU sharing (memory and compute isolation) for workloads. Requires GPU Operator. Note: workload containers must use glibc < 2.34 (not musl/Alpine) for full compute isolation.",
+          "description": "HAMi GPU virtualization middleware.",
           "type": "object",
           "default": {},
           "required": [
@@ -279,7 +279,7 @@
           ],
           "properties": {
             "enabled": {
-              "description": "Enable HAMi.",
+              "description": "Enable HAMi (requires GPU Operator).",
               "type": "boolean",
               "default": false
             },
diff --git a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
index 5e9e8f94..cdf900e1 100644
--- a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
+++ b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
@@ -8,7 +8,7 @@ spec:
     singular: kubernetes
     plural: kuberneteses
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"},"nodeGroups":{"description":"Worker nodes configuration map.","type":"object","default":{"md0":{"ephemeralStorage":"20Gi","gpus":[],"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":["ingress-nginx"]}},"additionalProperties":{"type":"object","required":["ephemeralStorage","instanceType","maxReplicas","minReplicas","resources"],"properties":{"ephemeralStorage":{"description":"Ephemeral storage size.","default":"20Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"description":"Name of GPU, such as \"nvidia.com/AD102GL_L40S\".","type":"string"}}}},"instanceType":{"description":"Virtual machine instance type.","type":"string","default":"u1.medium"},"maxReplicas":{"description":"Maximum number of replicas.","type":"integer","default":10},"minReplicas":{"description":"Minimum number of replicas.","type":"integer","default":0},"resources":{"description":"CPU and memory resources for each worker node.","type":"object","properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"roles":{"description":"List of node roles.","type":"array","items":{"type":"string"}}}}},"version":{"description":"Kubernetes major.minor version to deploy","type":"string","default":"v1.35","enum":["v1.35","v1.34","v1.33","v1.32","v1.31","v1.30"]},"host":{"description":"External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.","type":"string","default":""},"addons":{"description":"Cluster addons configuration.","type":"object","default":{},"required":["certManager","cilium","coredns","fluxcd","gatewayAPI","gpuOperator","ingressNginx","monitoringAgents","velero","verticalPodAutoscaler"],"properties":{"certManager":{"description":"Cert-manager addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable cert-manager.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"cilium":{"description":"Cilium CNI plugin.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"coredns":{"description":"CoreDNS addon.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"fluxcd":{"description":"FluxCD GitOps operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable FluxCD.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"gatewayAPI":{"description":"Gateway API addon.","type":"object","default":{},"required":["enabled"],"properties":{"enabled":{"description":"Enable Gateway API.","type":"boolean","default":false}}},"gpuOperator":{"description":"NVIDIA GPU Operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable GPU Operator.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"ingressNginx":{"description":"Ingress-NGINX controller.","type":"object","default":{},"required":["enabled","exposeMethod","valuesOverride"],"properties":{"enabled":{"description":"Enable the controller (requires nodes labeled `ingress-nginx`).","type":"boolean","default":false},"exposeMethod":{"description":"Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.","type":"string","default":"Proxied","enum":["Proxied","LoadBalancer"]},"hosts":{"description":"Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.","type":"array","default":[],"items":{"type":"string"}},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"monitoringAgents":{"description":"Monitoring agents.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable monitoring agents.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"velero":{"description":"Velero backup/restore addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable Velero.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"verticalPodAutoscaler":{"description":"Vertical Pod Autoscaler.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}}}},"controlPlane":{"description":"Kubernetes control-plane configuration.","type":"object","default":{},"required":["apiServer","controllerManager","konnectivity","replicas","scheduler"],"properties":{"apiServer":{"description":"API Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for API Server.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"controllerManager":{"description":"Controller Manager configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Controller Manager.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"konnectivity":{"description":"Konnectivity configuration.","type":"object","default":{},"required":["server"],"properties":{"server":{"description":"Konnectivity Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Konnectivity.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"replicas":{"description":"Number of control-plane replicas.","type":"integer","default":2},"scheduler":{"description":"Scheduler configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Scheduler.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}}}}
+      {"title":"Chart Values","type":"object","properties":{"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"},"nodeGroups":{"description":"Worker nodes configuration map.","type":"object","default":{"md0":{"ephemeralStorage":"20Gi","gpus":[],"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":["ingress-nginx"]}},"additionalProperties":{"type":"object","required":["ephemeralStorage","instanceType","maxReplicas","minReplicas","resources"],"properties":{"ephemeralStorage":{"description":"Ephemeral storage size.","default":"20Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"description":"Name of GPU, such as \"nvidia.com/AD102GL_L40S\".","type":"string"}}}},"instanceType":{"description":"Virtual machine instance type.","type":"string","default":"u1.medium"},"maxReplicas":{"description":"Maximum number of replicas.","type":"integer","default":10},"minReplicas":{"description":"Minimum number of replicas.","type":"integer","default":0},"resources":{"description":"CPU and memory resources for each worker node.","type":"object","properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"roles":{"description":"List of node roles.","type":"array","items":{"type":"string"}}}}},"version":{"description":"Kubernetes major.minor version to deploy","type":"string","default":"v1.35","enum":["v1.35","v1.34","v1.33","v1.32","v1.31","v1.30"]},"host":{"description":"External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.","type":"string","default":""},"addons":{"description":"Cluster addons configuration.","type":"object","default":{},"required":["certManager","cilium","coredns","fluxcd","gatewayAPI","gpuOperator","hami","ingressNginx","monitoringAgents","velero","verticalPodAutoscaler"],"properties":{"certManager":{"description":"Cert-manager addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable cert-manager.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"cilium":{"description":"Cilium CNI plugin.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"coredns":{"description":"CoreDNS addon.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"fluxcd":{"description":"FluxCD GitOps operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable FluxCD.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"gatewayAPI":{"description":"Gateway API addon.","type":"object","default":{},"required":["enabled"],"properties":{"enabled":{"description":"Enable Gateway API.","type":"boolean","default":false}}},"gpuOperator":{"description":"NVIDIA GPU Operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable GPU Operator.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"hami":{"description":"HAMi GPU virtualization middleware.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable HAMi (requires GPU Operator).","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"ingressNginx":{"description":"Ingress-NGINX controller.","type":"object","default":{},"required":["enabled","exposeMethod","valuesOverride"],"properties":{"enabled":{"description":"Enable the controller (requires nodes labeled `ingress-nginx`).","type":"boolean","default":false},"exposeMethod":{"description":"Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.","type":"string","default":"Proxied","enum":["Proxied","LoadBalancer"]},"hosts":{"description":"Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.","type":"array","default":[],"items":{"type":"string"}},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"monitoringAgents":{"description":"Monitoring agents.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable monitoring agents.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"velero":{"description":"Velero backup/restore addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable Velero.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"verticalPodAutoscaler":{"description":"Vertical Pod Autoscaler.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}}}},"controlPlane":{"description":"Kubernetes control-plane configuration.","type":"object","default":{},"required":["apiServer","controllerManager","konnectivity","replicas","scheduler"],"properties":{"apiServer":{"description":"API Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for API Server.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"controllerManager":{"description":"Controller Manager configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Controller Manager.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"konnectivity":{"description":"Konnectivity configuration.","type":"object","default":{},"required":["server"],"properties":{"server":{"description":"Konnectivity Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Konnectivity.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"replicas":{"description":"Number of control-plane replicas.","type":"integer","default":2},"scheduler":{"description":"Scheduler configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Scheduler.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}}}}
   release:
     prefix: kubernetes-
     labels:
@@ -26,7 +26,7 @@ spec:
     tags:
       - compute
     icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl82ODFfMjg0NSkiLz4KPHBhdGggZD0iTTcxLjk5NjggMTlDNzAuMzAzOSAxOS4wMDAyIDY4LjkzMTIgMjAuNTMyMiA2OC45MzE0IDIyLjQyMjFDNjguOTMxNCAyMi40NTExIDY4LjkzNzMgMjIuNDc4OCA2OC45Mzc5IDIyLjUwNzZDNjguOTM1NCAyMi43NjQ0IDY4LjkyMzEgMjMuMDczNyA2OC45MzE0IDIzLjI5NzNDNjguOTcxNyAyNC4zODczIDY5LjIwODIgMjUuMjIxNiA2OS4zNTA2IDI2LjIyNThDNjkuNjA4NCAyOC4zNzUyIDY5LjgyNDUgMzAuMTU2OSA2OS42OTEyIDMxLjgxM0M2OS41NjE1IDMyLjQzNzUgNjkuMTAzNyAzMy4wMDg2IDY4LjY5NTYgMzMuNDA1Nkw2OC42MjM1IDM0LjcwODZDNjYuNzgzOSAzNC44NjE3IDY0LjkzMTkgMzUuMTQyMSA2My4wODIxIDM1LjU2NDFDNTUuMTIyNiAzNy4zNzk4IDQ4LjI2OTUgNDEuNDk5MSA0My4wNTIgNDcuMDYwOUM0Mi43MTM0IDQ2LjgyODggNDIuMTIxMSA0Ni40MDE5IDQxLjk0NSA0Ni4yNzEyQzQxLjM5NzcgNDYuMzQ1NCA0MC44NDQ1IDQ2LjUxNTEgNDAuMTI0MSA0Ni4wOTM1QzM4Ljc1MjIgNDUuMTY1NyAzNy41MDI4IDQzLjg4NTEgMzUuOTkxIDQyLjM0MjRDMzUuMjk4MiA0MS42MDQ0IDM0Ljc5NjYgNDAuOTAxOCAzMy45NzM1IDQwLjE5MDRDMzMuNzg2NiA0MC4wMjg5IDMzLjUwMTQgMzkuODEwNCAzMy4yOTIzIDM5LjY0NDJDMzIuNjQ4OSAzOS4xMjg4IDMxLjg5IDM4Ljg2IDMxLjE1NyAzOC44MzQ4QzMwLjIxNDcgMzguODAyNCAyOS4zMDc1IDM5LjE3MjUgMjguNzEzOCAzOS45MjA2QzI3LjY1ODQgNDEuMjUwNiAyNy45OTYzIDQzLjI4MzMgMjkuNDY3MSA0NC40NjE0QzI5LjQ4MiA0NC40NzM0IDI5LjQ5NzkgNDQuNDgyNyAyOS41MTI5IDQ0LjQ5NDNDMjkuNzE1IDQ0LjY1ODkgMjkuOTYyNSA0NC44Njk4IDMwLjE0ODMgNDUuMDA3NkMzMS4wMjE3IDQ1LjY1NTUgMzEuODE5NSA0NS45ODcyIDMyLjY4OTcgNDYuNTAxNUMzNC41MjMxIDQ3LjYzOTEgMzYuMDQzIDQ4LjU4MjMgMzcuMjQ4NiA0OS43MTk2QzM3LjcxOTQgNTAuMjIzNyAzNy44MDE2IDUxLjExMjIgMzcuODY0MyA1MS40OTY0TDM4Ljg0NjggNTIuMzc4MkMzMy41ODcyIDYwLjMzMDggMzEuMTUzIDcwLjE1MzkgMzIuNTkxNSA4MC4xNjI3TDMxLjMwNzcgODAuNTM3OEMzMC45NjkzIDgwLjk3NjggMzAuNDkxMiA4MS42Njc2IDI5Ljk5MTEgODEuODczOEMyOC40MTM4IDgyLjM3MjkgMjYuNjM4NyA4Mi41NTYyIDI0LjQ5NTYgODIuNzgxOUMyMy40ODk0IDgyLjg2NiAyMi42MjEzIDgyLjgxNTggMjEuNTU0NiA4My4wMTg4QzIxLjMxOTggODMuMDYzNSAyMC45OTI3IDgzLjE0OTEgMjAuNzM1OCA4My4yMDk3QzIwLjcyNjkgODMuMjExNiAyMC43MTg2IDgzLjIxNDIgMjAuNzA5NiA4My4yMTYyQzIwLjY5NTYgODMuMjE5NSAyMC42NzcyIDgzLjIyNjMgMjAuNjYzOCA4My4yMjk0QzE4Ljg1NyA4My42NjggMTcuNjk2MyA4NS4zMzY1IDE4LjA2OTkgODYuOTgwNUMxOC40NDM3IDg4LjYyNDggMjAuMjA4NiA4OS42MjQ4IDIyLjAyNjIgODkuMjMxMkMyMi4wMzkzIDg5LjIyODIgMjIuMDU4NCA4OS4yMjc3IDIyLjA3MiA4OS4yMjQ2QzIyLjA5MjYgODkuMjE5OSAyMi4xMTA2IDg5LjIwOTkgMjIuMTMxIDg5LjIwNDlDMjIuMzg0NCA4OS4xNDkgMjIuNzAxOSA4OS4wODY4IDIyLjkyMzYgODkuMDI3MkMyMy45NzIzIDg4Ljc0NTEgMjQuNzMxOCA4OC4zMzA2IDI1LjY3NDYgODcuOTY3N0MyNy43MDI5IDg3LjIzNjggMjkuMzgyOCA4Ni42MjYyIDMxLjAxOTUgODYuMzg4M0MzMS43MDMgODYuMzM0NSAzMi40MjMyIDg2LjgxMiAzMi43ODE0IDg3LjAxMzRMMzQuMTE3NyA4Ni43ODMxQzM3LjE5MjYgOTYuMzYxMyA0My42MzY2IDEwNC4xMDMgNTEuNzk2MyAxMDguOTYxTDUxLjIzOTYgMTEwLjMwM0M1MS40NDAzIDExMC44MjQgNTEuNjYxNiAxMTEuNTMgNTEuNTEyMSAxMTIuMDQ1QzUwLjkxNzEgMTEzLjU5NSA0OS44OTggMTE1LjIzMSA0OC43Mzc0IDExNy4wNTVDNDguMTc1NSAxMTcuODk4IDQ3LjYwMDQgMTE4LjU1MiA0Ny4wOTM0IDExOS41MTZDNDYuOTcyIDExOS43NDcgNDYuODE3NSAxMjAuMTAyIDQ2LjcwMDQgMTIwLjM0NkM0NS45MTI1IDEyMi4wMzkgNDYuNDkwNCAxMjMuOTkgNDguMDAzOCAxMjQuNzIyQzQ5LjUyNjggMTI1LjQ1OSA1MS40MTcxIDEyNC42ODIgNTIuMjM1MiAxMjIuOTg1QzUyLjIzNjQgMTIyLjk4MiA1Mi4yNDA2IDEyMi45OCA1Mi4yNDE3IDEyMi45NzhDNTIuMjQyNiAxMjIuOTc2IDUyLjI0MDkgMTIyLjk3MyA1Mi4yNDE3IDEyMi45NzFDNTIuMzU4MiAxMjIuNzMxIDUyLjUyMzMgMTIyLjQxNSA1Mi42MjE2IDEyMi4xODhDNTMuMDU2IDEyMS4xODkgNTMuMjAwNSAxMjAuMzMyIDUzLjUwNTkgMTE5LjM2NUM1NC4zMTcgMTE3LjMxOCA1NC43NjI2IDExNS4xNyA1NS44NzkxIDExMy44MzJDNTYuMTg0OSAxMTMuNDY2IDU2LjY4MzMgMTEzLjMyNSA1Ny4yMDAxIDExMy4xODZMNTcuODk0NCAxMTEuOTIyQzY1LjAwOCAxMTQuNjY1IDcyLjk3MDUgMTE1LjQwMiA4MC45MjQ1IDExMy41ODdDODIuNzM5MSAxMTMuMTczIDg0LjQ5MDggMTEyLjYzNyA4Ni4xODQzIDExMS45OTRDODYuMzc5NCAxMTIuMzQyIDg2Ljc0MiAxMTMuMDExIDg2LjgzOTMgMTEzLjE3OUM4Ny4zNjQ0IDExMy4zNTEgODcuOTM3NyAxMTMuNDM5IDg4LjQwNDcgMTE0LjEzM0M4OS4yNDAxIDExNS41NjcgODkuODExNCAxMTcuMjYzIDkwLjUwNzMgMTE5LjMxMkM5MC44MTI4IDEyMC4yNzkgOTAuOTYzOCAxMjEuMTM2IDkxLjM5ODEgMTIyLjEzNkM5MS40OTcxIDEyMi4zNjMgOTEuNjYxNCAxMjIuNjg0IDkxLjc3OCAxMjIuOTI1QzkyLjU5NDQgMTI0LjYyOCA5NC40OTA3IDEyNS40MDcgOTYuMDE1OSAxMjQuNjY5Qzk3LjUyOTIgMTIzLjkzNyA5OC4xMDc3IDEyMS45ODYgOTcuMzE5NCAxMjAuMjkzQzk3LjIwMjMgMTIwLjA0OSA5Ny4wNDEyIDExOS42OTUgOTYuOTE5OCAxMTkuNDY0Qzk2LjQxMjcgMTE4LjQ5OSA5NS44Mzc3IDExNy44NTIgOTUuMjc1OCAxMTcuMDA5Qzk0LjExNTIgMTE1LjE4NSA5My4xNTI2IDExMy42NyA5Mi41NTc1IDExMi4xMkM5Mi4zMDg3IDExMS4zMiA5Mi41OTk1IDExMC44MjMgOTIuNzkzMyAxMTAuMzAzQzkyLjY3NzIgMTEwLjE3IDkyLjQyODggMTA5LjQxNCA5Mi4yODI0IDEwOS4wNTlDMTAwLjc2MiAxMDQuMDI5IDEwNy4wMTcgOTUuOTk4NSAxMDkuOTU1IDg2LjcyMzlDMTEwLjM1MSA4Ni43ODY1IDExMS4wNDEgODYuOTA5MSAxMTEuMjY1IDg2Ljk1NDJDMTExLjcyNiA4Ni42NDg3IDExMi4xNDkgODYuMjUwMSAxMTIuOTgxIDg2LjMxNTlDMTE0LjYxNyA4Ni41NTM3IDExNi4yOTcgODcuMTY0NSAxMTguMzI2IDg3Ljg5NTNDMTE5LjI2OCA4OC4yNTgxIDEyMC4wMjggODguNjc5MyAxMjEuMDc3IDg4Ljk2MTRDMTIxLjI5OCA4OS4wMjEgMTIxLjYxNiA4OS4wNzY2IDEyMS44NjkgODkuMTMyNUMxMjEuODg5IDg5LjEzNzUgMTIxLjkwOCA4OS4xNDc1IDEyMS45MjggODkuMTUyMkMxMjEuOTQyIDg5LjE1NTMgMTIxLjk2MSA4OS4xNTU4IDEyMS45NzQgODkuMTU4OEMxMjMuNzkyIDg5LjU1MiAxMjUuNTU3IDg4LjU1MjYgMTI1LjkzIDg2LjkwODFDMTI2LjMwMyA4NS4yNjQxIDEyNS4xNDMgODMuNTk1MiAxMjMuMzM2IDgzLjE1N0MxMjMuMDc0IDgzLjA5NyAxMjIuNzAxIDgyLjk5NSAxMjIuNDQ2IDgyLjk0NjVDMTIxLjM3OSA4Mi43NDM1IDEyMC41MTEgODIuNzkzNSAxMTkuNTA1IDgyLjcwOTVDMTE3LjM2MSA4Mi40ODM5IDExNS41ODYgODIuMzAwNCAxMTQuMDA5IDgxLjgwMTRDMTEzLjM2NiA4MS41NTA3IDExMi45MDggODAuNzgxOSAxMTIuNjg2IDgwLjQ2NTVMMTExLjQ0OCA4MC4xMDM1QzExMi4wOSA3NS40MzggMTExLjkxNyA3MC41ODI1IDExMC44MDYgNjUuNzI0M0MxMDkuNjg1IDYwLjgyMDggMTA3LjcwNCA1Ni4zMzYxIDEwNS4wNjIgNTIuMzg0OEMxMDUuMzc5IDUyLjA5NDggMTA1Ljk3OSA1MS41NjEyIDEwNi4xNDkgNTEuNDA0M0MxMDYuMTk5IDUwLjg1MTcgMTA2LjE1NiA1MC4yNzIyIDEwNi43MjUgNDkuNjYwM0MxMDcuOTMxIDQ4LjUyMyAxMDkuNDUxIDQ3LjU3OTkgMTExLjI4NCA0Ni40NDIzQzExMi4xNTQgNDUuOTI3OSAxMTIuOTU5IDQ1LjU5NjQgMTEzLjgzMiA0NC45NDg0QzExNC4wMyA0NC44MDE5IDExNC4yOTkgNDQuNTY5OSAxMTQuNTA3IDQ0LjQwMjJDMTE1Ljk3NyA0My4yMjM3IDExNi4zMTYgNDEuMTkxMSAxMTUuMjYgMzkuODYxNEMxMTQuMjA0IDM4LjUzMTcgMTEyLjE1OSAzOC40MDY1IDExMC42ODggMzkuNTg1QzExMC40NzkgMzkuNzUxNiAxMTAuMTk1IDM5Ljk2ODggMTEwLjAwNyA0MC4xMzEyQzEwOS4xODQgNDAuODQyNiAxMDguNjc2IDQxLjU0NTIgMTA3Ljk4MyA0Mi4yODMyQzEwNi40NzEgNDMuODI1OSAxMDUuMjIyIDQ1LjExMyAxMDMuODUgNDYuMDQwOUMxMDMuMjU1IDQ2LjM4ODUgMTAyLjM4NSA0Ni4yNjgyIDEwMS45OSA0Ni4yNDQ5TDEwMC44MjQgNDcuMDgwNkM5NC4xNzUzIDQwLjA3NjMgODUuMTIzNSAzNS41OTgyIDc1LjM3NjYgMzQuNzI4M0M3NS4zNDk0IDM0LjMxNzkgNzUuMzEzNyAzMy41NzYxIDc1LjMwNDYgMzMuMzUyOUM3NC45MDU2IDMyLjk2OTMgNzQuNDIzNSAzMi42NDE4IDc0LjMwMjQgMzEuODEzQzc0LjE2OTEgMzAuMTU2OSA3NC4zOTE3IDI4LjM3NTIgNzQuNjQ5NiAyNi4yMjU4Qzc0Ljc5MTkgMjUuMjIxNiA3NS4wMjg0IDI0LjM4NzMgNzUuMDY4OCAyMy4yOTczQzc1LjA3OCAyMy4wNDk1IDc1LjA2MzIgMjIuNjkgNzUuMDYyMiAyMi40MjIxQzc1LjA2MiAyMC41MzIyIDczLjY4OTggMTguOTk5OCA3MS45OTY4IDE5Wk02OC4xNTg1IDQyLjg4ODZMNjcuMjQ4IDU5LjA0NDdMNjcuMTgyNSA1OS4wNzc2QzY3LjEyMTQgNjAuNTIyOSA2NS45Mzc1IDYxLjY3NyA2NC40ODM5IDYxLjY3N0M2My44ODg0IDYxLjY3NyA2My4zMzg4IDYxLjQ4NDkgNjIuODkyMiA2MS4xNTcxTDYyLjg2NiA2MS4xNzAzTDQ5LjY4MDcgNTEuNzc5NEM1My43MzMxIDQ3Ljc3NTkgNTguOTE2NCA0NC44MTcyIDY0Ljg5IDQzLjQ1NDZDNjUuOTgxMiA0My4yMDU2IDY3LjA3MTkgNDMuMDIwOSA2OC4xNTg1IDQyLjg4ODZaTTc1Ljg0MTcgNDIuODg4NkM4Mi44MTU5IDQzLjc1MDQgODkuMjY1NyA0Ni45MjMyIDk0LjIwODEgNTEuNzg2TDgxLjEwOCA2MS4xMTc2TDgxLjA2MjEgNjEuMDk3OUM3OS44OTk0IDYxLjk1MTIgNzguMjYxMSA2MS43Mzk0IDc3LjM1NDggNjAuNTk3OEM3Ni45ODM1IDYwLjEzMDEgNzYuNzg4NyA1OS41ODAxIDc2Ljc2NTMgNTkuMDI0OUw3Ni43NTIyIDU5LjAxODRMNzUuODQxNyA0Mi44ODg2Wk00NC44OTkxIDU3LjgxNEw1Ni45MzgyIDY4LjYzM0w1Ni45MjUxIDY4LjY5ODhDNTguMDExNyA2OS42NDc5IDU4LjE3MiA3MS4yOTQ5IDU3LjI2NTcgNzIuNDM2OEM1Ni44OTQ0IDcyLjkwNDUgNTYuMzk3NSA3My4yMTgyIDU1Ljg2MzkgNzMuMzY0N0w1NS44NTA4IDczLjQxNzNMNDAuNDE4OCA3Ny44OTIzQzM5LjYzMzQgNzAuNjc2NSA0MS4zMjYxIDYzLjY2MjEgNDQuODk5MSA1Ny44MTRaTTk5LjAwOTQgNTcuODIwNkMxMDAuNzk4IDYwLjczMzYgMTAyLjE1MyA2My45ODcxIDEwMi45NTkgNjcuNTE0M0MxMDMuNzU2IDcwLjk5OTEgMTAzLjk1NiA3NC40Nzc4IDEwMy42MjcgNzcuODM5N0w4OC4xMTY2IDczLjM1MTVMODguMTAzNSA3My4yODU3Qzg2LjcxNDUgNzIuOTA0MyA4NS44NjA5IDcxLjQ4NDggODYuMTg0MyA3MC4wNjExQzg2LjMxNjggNjkuNDc3OCA4Ni42MjQ5IDY4Ljk4NDQgODcuMDQyMyA2OC42MTk4TDg3LjAzNTggNjguNTg2OUw5OS4wMDk0IDU3LjgyMDZaTTY5LjUyNzQgNjkuNDY4OEg3NC40NTk2TDc3LjUyNTEgNzMuMzE4Nkw3Ni40MjQ3IDc4LjEyMjZMNzEuOTk2OCA4MC4yNjE0TDY3LjU1NTggNzguMTE2MUw2Ni40NTU0IDczLjMxMkw2OS41Mjc0IDY5LjQ2ODhaTTg1LjMzOTMgODIuNjQzN0M4NS41NDg5IDgyLjYzMzEgODUuNzU3NiA4Mi42NTIgODUuOTYxNiA4Mi42ODk4TDg1Ljk4NzggODIuNjU2OUwxMDEuOTUgODUuMzY4MkM5OS42MTQyIDkxLjk2MjQgOTUuMTQ0IDk3LjY3NSA4OS4xNzExIDEwMS40OThMODIuOTc0NyA4Ni40NjA2TDgyLjk5NDQgODYuNDM0M0M4Mi40MjUyIDg1LjEwNTUgODIuOTk0OCA4My41NDcyIDg0LjMwNDQgODIuOTEzNUM4NC42Mzk3IDgyLjc1MTMgODQuOTkgODIuNjYxNCA4NS4zMzkzIDgyLjY0MzdaTTU4LjUyOTggODIuNzA5NUM1OS43NDggODIuNzI2NyA2MC44NDA2IDgzLjU3NjEgNjEuMTIzNyA4NC44MjJDNjEuMjU2MiA4NS40MDUyIDYxLjE5MTcgODUuOTgzMSA2MC45NzMgODYuNDkzNUw2MS4wMTg5IDg2LjU1MjdMNTQuODg4IDEwMS40MzlDNDkuMTU1OSA5Ny43NDMyIDQ0LjU5MDQgOTIuMjA5OSA0Mi4xNDgxIDg1LjQyMDhMNTcuOTczMSA4Mi43MjI3TDU3Ljk5OTMgODIuNzU1NkM1OC4xNzYzIDgyLjcyMjkgNTguMzU1OCA4Mi43MDcxIDU4LjUyOTggODIuNzA5NVpNNzEuODk4NiA4OS4yMzEyQzcyLjMyMjkgODkuMjE1NSA3Mi43NTM0IDg5LjMwMyA3My4xNjI3IDg5LjUwMUM3My42OTkyIDg5Ljc2MDYgNzQuMTEzNiA5MC4xNjkyIDc0LjM3NDUgOTAuNjU5Mkg3NC40MzM0TDgyLjIzNDYgMTA0LjgyMUM4MS4yMjIxIDEwNS4xNjIgODAuMTgxMyAxMDUuNDU0IDc5LjExNjcgMTA1LjY5N0M3My4xNTA1IDEwNy4wNTggNjcuMjAzMiAxMDYuNjQ1IDYxLjgxOCAxMDQuODAyTDY5LjU5OTUgOTAuNjY1OEg2OS42MTI2QzcwLjA3OTUgODkuNzg4OCA3MC45NjUgODkuMjY1NiA3MS44OTg2IDg5LjIzMTJaIiBmaWxsPSJ3aGl0ZSIgc3Ryb2tlPSJ3aGl0ZSIgc3Ryb2tlLXdpZHRoPSIwLjI1Ii8+CjxkZWZzPgo8bGluZWFyR3JhZGllbnQgaWQ9InBhaW50MF9saW5lYXJfNjgxXzI4NDUiIHgxPSIxMCIgeTE9IjE1LjUiIHgyPSIxNDQiIHkyPSIxMzEuNSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPgo8c3RvcCBzdG9wLWNvbG9yPSIjNEQ4N0ZGIi8+CjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iIzA1NDdEMCIvPgo8L2xpbmVhckdyYWRpZW50Pgo8L2RlZnM+Cjwvc3ZnPgo=
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "storageClass"], ["spec", "nodeGroups"], ["spec", "nodeGroups", "md0"], ["spec", "nodeGroups", "md0", "minReplicas"], ["spec", "nodeGroups", "md0", "maxReplicas"], ["spec", "nodeGroups", "md0", "instanceType"], ["spec", "nodeGroups", "md0", "ephemeralStorage"], ["spec", "nodeGroups", "md0", "roles"], ["spec", "nodeGroups", "md0", "resources"], ["spec", "nodeGroups", "md0", "gpus"], ["spec", "version"], ["spec", "host"], ["spec", "addons"], ["spec", "addons", "certManager"], ["spec", "addons", "certManager", "enabled"], ["spec", "addons", "certManager", "valuesOverride"], ["spec", "addons", "cilium"], ["spec", "addons", "cilium", "valuesOverride"], ["spec", "addons", "gatewayAPI"], ["spec", "addons", "gatewayAPI", "enabled"], ["spec", "addons", "ingressNginx"], ["spec", "addons", "ingressNginx", "enabled"], ["spec", "addons", "ingressNginx", "exposeMethod"], ["spec", "addons", "ingressNginx", "hosts"], ["spec", "addons", "ingressNginx", "valuesOverride"], ["spec", "addons", "gpuOperator"], ["spec", "addons", "gpuOperator", "enabled"], ["spec", "addons", "gpuOperator", "valuesOverride"], ["spec", "addons", "fluxcd"], ["spec", "addons", "fluxcd", "enabled"], ["spec", "addons", "fluxcd", "valuesOverride"], ["spec", "addons", "monitoringAgents"], ["spec", "addons", "monitoringAgents", "enabled"], ["spec", "addons", "monitoringAgents", "valuesOverride"], ["spec", "addons", "verticalPodAutoscaler"], ["spec", "addons", "verticalPodAutoscaler", "valuesOverride"], ["spec", "addons", "velero"], ["spec", "addons", "velero", "enabled"], ["spec", "addons", "velero", "valuesOverride"], ["spec", "addons", "coredns"], ["spec", "addons", "coredns", "valuesOverride"], ["spec", "controlPlane"], ["spec", "controlPlane", "replicas"], ["spec", "controlPlane", "apiServer"], ["spec", "controlPlane", "apiServer", "resources"], ["spec", "controlPlane", "apiServer", "resourcesPreset"], ["spec", "controlPlane", "controllerManager"], ["spec", "controlPlane", "controllerManager", "resources"], ["spec", "controlPlane", "controllerManager", "resourcesPreset"], ["spec", "controlPlane", "scheduler"], ["spec", "controlPlane", "scheduler", "resources"], ["spec", "controlPlane", "scheduler", "resourcesPreset"], ["spec", "controlPlane", "konnectivity"], ["spec", "controlPlane", "konnectivity", "server"], ["spec", "controlPlane", "konnectivity", "server", "resources"], ["spec", "controlPlane", "konnectivity", "server", "resourcesPreset"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "storageClass"], ["spec", "nodeGroups"], ["spec", "nodeGroups", "md0"], ["spec", "nodeGroups", "md0", "minReplicas"], ["spec", "nodeGroups", "md0", "maxReplicas"], ["spec", "nodeGroups", "md0", "instanceType"], ["spec", "nodeGroups", "md0", "ephemeralStorage"], ["spec", "nodeGroups", "md0", "roles"], ["spec", "nodeGroups", "md0", "resources"], ["spec", "nodeGroups", "md0", "gpus"], ["spec", "version"], ["spec", "host"], ["spec", "addons"], ["spec", "addons", "certManager"], ["spec", "addons", "certManager", "enabled"], ["spec", "addons", "certManager", "valuesOverride"], ["spec", "addons", "cilium"], ["spec", "addons", "cilium", "valuesOverride"], ["spec", "addons", "gatewayAPI"], ["spec", "addons", "gatewayAPI", "enabled"], ["spec", "addons", "ingressNginx"], ["spec", "addons", "ingressNginx", "enabled"], ["spec", "addons", "ingressNginx", "exposeMethod"], ["spec", "addons", "ingressNginx", "hosts"], ["spec", "addons", "ingressNginx", "valuesOverride"], ["spec", "addons", "gpuOperator"], ["spec", "addons", "gpuOperator", "enabled"], ["spec", "addons", "gpuOperator", "valuesOverride"], ["spec", "addons", "hami"], ["spec", "addons", "hami", "enabled"], ["spec", "addons", "hami", "valuesOverride"], ["spec", "addons", "fluxcd"], ["spec", "addons", "fluxcd", "enabled"], ["spec", "addons", "fluxcd", "valuesOverride"], ["spec", "addons", "monitoringAgents"], ["spec", "addons", "monitoringAgents", "enabled"], ["spec", "addons", "monitoringAgents", "valuesOverride"], ["spec", "addons", "verticalPodAutoscaler"], ["spec", "addons", "verticalPodAutoscaler", "valuesOverride"], ["spec", "addons", "velero"], ["spec", "addons", "velero", "enabled"], ["spec", "addons", "velero", "valuesOverride"], ["spec", "addons", "coredns"], ["spec", "addons", "coredns", "valuesOverride"], ["spec", "controlPlane"], ["spec", "controlPlane", "replicas"], ["spec", "controlPlane", "apiServer"], ["spec", "controlPlane", "apiServer", "resources"], ["spec", "controlPlane", "apiServer", "resourcesPreset"], ["spec", "controlPlane", "controllerManager"], ["spec", "controlPlane", "controllerManager", "resources"], ["spec", "controlPlane", "controllerManager", "resourcesPreset"], ["spec", "controlPlane", "scheduler"], ["spec", "controlPlane", "scheduler", "resources"], ["spec", "controlPlane", "scheduler", "resourcesPreset"], ["spec", "controlPlane", "konnectivity"], ["spec", "controlPlane", "konnectivity", "server"], ["spec", "controlPlane", "konnectivity", "server", "resources"], ["spec", "controlPlane", "konnectivity", "server", "resourcesPreset"]]
   secrets:
     exclude: []
     include:

From 648ad82dd3283076cf85f6b4b8953ceda8199476 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Fri, 24 Apr 2026 13:31:57 +0300
Subject: [PATCH 601/666] refactor(postgres-operator): scope webhook-ready RBAC
 to release namespace

Address review feedback from gemini-code-assist on
packages/system/postgres-operator/templates/webhook-ready-hook.yaml:83.

The Job targets the cnpg-webhook-service/services/proxy subresource, which
is namespaced and lives in the release namespace. A namespaced Role and
RoleBinding grant the exact permission needed without creating global
RBAC for a namespaced probe, which is the principle of least privilege.

Also update the kind assertions in tests/webhook-ready-hook_test.yaml so
the unittest suite tracks the new Role/RoleBinding objects.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../postgres-operator/templates/webhook-ready-hook.yaml   | 8 +++++---
 .../postgres-operator/tests/webhook-ready-hook_test.yaml  | 6 +++---
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/packages/system/postgres-operator/templates/webhook-ready-hook.yaml b/packages/system/postgres-operator/templates/webhook-ready-hook.yaml
index 2ad4e7c9..70e51621 100644
--- a/packages/system/postgres-operator/templates/webhook-ready-hook.yaml
+++ b/packages/system/postgres-operator/templates/webhook-ready-hook.yaml
@@ -52,9 +52,10 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
+kind: Role
 metadata:
   name: {{ .Release.Name }}-webhook-ready
+  namespace: {{ .Release.Namespace }}
   annotations:
     helm.sh/hook: post-install,post-upgrade
     helm.sh/hook-weight: "0"
@@ -66,16 +67,17 @@ rules:
     verbs: ["get"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
+kind: RoleBinding
 metadata:
   name: {{ .Release.Name }}-webhook-ready
+  namespace: {{ .Release.Namespace }}
   annotations:
     helm.sh/hook: post-install,post-upgrade
     helm.sh/hook-weight: "0"
     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
+  kind: Role
   name: {{ .Release.Name }}-webhook-ready
 subjects:
   - kind: ServiceAccount
diff --git a/packages/system/postgres-operator/tests/webhook-ready-hook_test.yaml b/packages/system/postgres-operator/tests/webhook-ready-hook_test.yaml
index 69f5a6b5..eb7863da 100644
--- a/packages/system/postgres-operator/tests/webhook-ready-hook_test.yaml
+++ b/packages/system/postgres-operator/tests/webhook-ready-hook_test.yaml
@@ -9,7 +9,7 @@ release:
   namespace: cozy-postgres-operator
 
 tests:
-  - it: renders four hook objects (SA + ClusterRole + ClusterRoleBinding + Job)
+  - it: renders four hook objects (SA + Role + RoleBinding + Job)
     template: templates/webhook-ready-hook.yaml
     asserts:
       - hasDocuments:
@@ -49,7 +49,7 @@ tests:
       - documentIndex: 1
         equal:
           path: kind
-          value: ClusterRole
+          value: Role
       - documentIndex: 1
         equal:
           path: metadata.annotations["helm.sh/hook-weight"]
@@ -57,7 +57,7 @@ tests:
       - documentIndex: 2
         equal:
           path: kind
-          value: ClusterRoleBinding
+          value: RoleBinding
       - documentIndex: 2
         equal:
           path: metadata.annotations["helm.sh/hook-weight"]

From fc057c039385e7b40cca3f2b6ca77a8f80bab49a Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Fri, 24 Apr 2026 13:32:33 +0300
Subject: [PATCH 602/666] fix(postgres-operator): set resources on
 webhook-ready wait container

Address review feedback from gemini-code-assist on
packages/system/postgres-operator/templates/webhook-ready-hook.yaml:115.

The wait container had no resource requests or limits, so schedulers
treated it as BestEffort and downstream quota enforcement had no signal.
Set small requests (10m CPU, 32Mi memory) and conservative limits
(100m CPU, 64Mi memory) matching the actual footprint of the kubectl
polling loop.

Add a matching unittest assertion so the values stay in sync if anyone
touches the template.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../templates/webhook-ready-hook.yaml         |  7 +++++++
 .../tests/webhook-ready-hook_test.yaml        | 20 +++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/packages/system/postgres-operator/templates/webhook-ready-hook.yaml b/packages/system/postgres-operator/templates/webhook-ready-hook.yaml
index 70e51621..51a8ba81 100644
--- a/packages/system/postgres-operator/templates/webhook-ready-hook.yaml
+++ b/packages/system/postgres-operator/templates/webhook-ready-hook.yaml
@@ -110,6 +110,13 @@ spec:
         - name: wait
           image: {{ $image }}
           imagePullPolicy: {{ if .Values.webhookReady.image.digest }}IfNotPresent{{ else }}Always{{ end }}
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/packages/system/postgres-operator/tests/webhook-ready-hook_test.yaml b/packages/system/postgres-operator/tests/webhook-ready-hook_test.yaml
index eb7863da..3253c663 100644
--- a/packages/system/postgres-operator/tests/webhook-ready-hook_test.yaml
+++ b/packages/system/postgres-operator/tests/webhook-ready-hook_test.yaml
@@ -205,6 +205,26 @@ tests:
           path: spec.template.spec.securityContext.seccompProfile.type
           value: RuntimeDefault
 
+  - it: wait container declares resource requests and limits for predictable scheduling
+    template: templates/webhook-ready-hook.yaml
+    asserts:
+      - documentIndex: 3
+        equal:
+          path: spec.template.spec.containers[0].resources.requests.cpu
+          value: 10m
+      - documentIndex: 3
+        equal:
+          path: spec.template.spec.containers[0].resources.requests.memory
+          value: 32Mi
+      - documentIndex: 3
+        equal:
+          path: spec.template.spec.containers[0].resources.limits.cpu
+          value: 100m
+      - documentIndex: 3
+        equal:
+          path: spec.template.spec.containers[0].resources.limits.memory
+          value: 64Mi
+
   - it: Job container drops all capabilities and runs read-only rootfs
     template: templates/webhook-ready-hook.yaml
     asserts:

From 7da29afe6e1f33b69d6040fd1051924d7937a13b Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Fri, 24 Apr 2026 13:33:07 +0300
Subject: [PATCH 603/666] docs(postgres-operator): fix
 backoffLimit/activeDeadlineSeconds comment math

Address review feedback from coderabbitai on
packages/system/postgres-operator/values.yaml:30.

The old comment's 5-minute ImagePullBackOff scenario conflicted with
the 180s activeDeadlineSeconds that the default maxAttempts/sleepSeconds
resolve to, so the numbers could not both be taken at face value.

Rewrite the comment to state the actual deadline math and frame the two
gates as an AND with activeDeadlineSeconds being the shorter one under
defaults, so readers understand why backoffLimit has little headroom
without an accompanying maxAttempts/sleepSeconds bump.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/system/postgres-operator/values.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/packages/system/postgres-operator/values.yaml b/packages/system/postgres-operator/values.yaml
index 854a3ac6..c408220e 100644
--- a/packages/system/postgres-operator/values.yaml
+++ b/packages/system/postgres-operator/values.yaml
@@ -25,6 +25,8 @@ webhookReady:
   # Pod-level retry budget for transient node/registry failures (image pull rate limit,
   # OOM, CNI hiccup). The shell loop inside the container only covers reachability retries.
   # Pod retries and activeDeadlineSeconds (wall-clock bound on the whole Job across all
-  # pod retries) are ANDed: a 5-minute ImagePullBackOff on attempt 0 leaves only ~60s for
-  # subsequent retries before the Job is cut.
+  # pod retries) are ANDed, so activeDeadlineSeconds is the shorter of the two gates with
+  # the defaults above: the 60*2+60 = 180s deadline cuts the Job before backoffLimit=2
+  # ever matters if pod-level failures eat more than ~60s of the budget. Raise
+  # maxAttempts/sleepSeconds alongside backoffLimit when tuning for slow image pulls.
   backoffLimit: 2

From 2734dc0bcb96aaa087cbff6b2ee261e1bde8bffa Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Fri, 24 Apr 2026 14:00:48 +0300
Subject: [PATCH 604/666] fix(hami): clean up leftover hami-dra references and
 harden defaults

Remove broken hami-dra subchart dependency from vendored chart
(Chart.yaml, Chart.lock, values.yaml) and strip DRA condition guards
from all templates since the subchart was already deleted. Override
devicePlugin updateStrategy to OnDelete to prevent destructive rolling
updates of GPU workloads. Align gpu-operator template with project
pattern (unconditional values emission). Add nodeConfiguration format
documentation and test for conflicting valuesOverride scenario.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../templates/helmreleases/gpu-operator.yaml  |  6 ++---
 .../tests/gpu_operator_hami_test.yaml         | 25 ++++++++++++++++++-
 packages/system/hami/charts/hami/Chart.lock   |  6 -----
 packages/system/hami/charts/hami/Chart.yaml   |  6 +----
 .../templates/device-plugin/configmap.yaml    |  2 +-
 .../device-plugin/daemonsetnvidia.yaml        |  2 +-
 .../templates/device-plugin/monitorrole.yaml  |  2 +-
 .../device-plugin/monitorrolebinding.yaml     |  2 +-
 .../device-plugin/monitorservice.yaml         |  2 +-
 .../device-plugin/monitorserviceaccount.yaml  |  2 +-
 .../device-plugin/runtime-class.yaml          |  4 +--
 .../hami/templates/scheduler/certmanager.yaml |  2 +-
 .../hami/templates/scheduler/clusterrole.yaml |  2 --
 .../scheduler/clusterrolebinding.yaml         |  4 +--
 .../hami/templates/scheduler/configmap.yaml   |  2 +-
 .../templates/scheduler/configmapnew.yaml     |  2 +-
 .../hami/templates/scheduler/deployment.yaml  |  4 +--
 .../templates/scheduler/device-configmap.yaml |  4 +--
 .../scheduler/job-patch/clusterrole.yaml      |  4 +--
 .../job-patch/clusterrolebinding.yaml         |  4 +--
 .../scheduler/job-patch/job-createSecret.yaml |  4 +--
 .../scheduler/job-patch/job-patchWebhook.yaml |  4 +--
 .../templates/scheduler/job-patch/psp.yaml    |  4 +--
 .../templates/scheduler/job-patch/role.yaml   |  4 +--
 .../scheduler/job-patch/rolebinding.yaml      |  4 +--
 .../scheduler/job-patch/serviceaccount.yaml   |  4 +--
 .../charts/hami/templates/scheduler/role.yaml |  4 +--
 .../hami/templates/scheduler/rolebinding.yaml |  2 --
 .../hami/templates/scheduler/service.yaml     |  4 +--
 .../templates/scheduler/serviceaccount.yaml   |  2 --
 .../hami/templates/scheduler/webhook.yaml     |  2 +-
 packages/system/hami/charts/hami/values.yaml  | 18 -------------
 packages/system/hami/values.yaml              |  4 +++
 33 files changed, 55 insertions(+), 92 deletions(-)
 delete mode 100644 packages/system/hami/charts/hami/Chart.lock

diff --git a/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml b/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml
index 995aa430..7a5ecaf1 100644
--- a/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml
@@ -1,5 +1,5 @@
 {{- define "cozystack.defaultGpuOperatorValues" -}}
-{{- if and (hasKey .Values.addons "hami") .Values.addons.hami.enabled }}
+{{- if .Values.addons.hami.enabled }}
 gpu-operator:
   devicePlugin:
     enabled: false
@@ -40,10 +40,8 @@ spec:
   {{- $defaults := fromYaml (include "cozystack.defaultGpuOperatorValues" .) }}
   {{- $overrides := deepCopy (default (dict) .Values.addons.gpuOperator.valuesOverride) }}
   {{- $merged := mergeOverwrite (default (dict) $defaults) $overrides }}
-  {{- with $merged }}
   values:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
+    {{- if $merged }}{{ toYaml $merged | nindent 4 }}{{ end }}
 
   dependsOn:
   {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
diff --git a/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml b/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml
index 33256ae6..11de743a 100644
--- a/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml
+++ b/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml
@@ -26,8 +26,9 @@ tests:
           enabled: false
           valuesOverride: {}
     asserts:
-      - notExists:
+      - equal:
           path: spec.values
+          value: null
 
   - it: should allow user overrides to merge with hami defaults
     set:
@@ -66,6 +67,28 @@ tests:
           path: spec.values.gpu-operator.devicePlugin.enabled
           value: true
 
+  - it: should let user explicitly override devicePlugin.enabled to true with hami enabled
+    set:
+      addons:
+        gpuOperator:
+          enabled: true
+          valuesOverride:
+            gpu-operator:
+              devicePlugin:
+                enabled: true
+              driver:
+                enabled: false
+        hami:
+          enabled: true
+          valuesOverride: {}
+    asserts:
+      - equal:
+          path: spec.values.gpu-operator.devicePlugin.enabled
+          value: true
+      - equal:
+          path: spec.values.gpu-operator.driver.enabled
+          value: false
+
   - it: should not render when gpuOperator is disabled
     set:
       addons:
diff --git a/packages/system/hami/charts/hami/Chart.lock b/packages/system/hami/charts/hami/Chart.lock
deleted file mode 100644
index 25856c07..00000000
--- a/packages/system/hami/charts/hami/Chart.lock
+++ /dev/null
@@ -1,6 +0,0 @@
-dependencies:
-- name: hami-dra
-  repository: https://project-hami.github.io/HAMi-DRA/
-  version: 0.1.0
-digest: sha256:374551539570bcee82c1c4dea93eac59e6f410b6d5967d188efd630e203d43bb
-generated: "2026-04-17T04:06:47.689117678Z"
diff --git a/packages/system/hami/charts/hami/Chart.yaml b/packages/system/hami/charts/hami/Chart.yaml
index aba7e95c..55f32ab6 100644
--- a/packages/system/hami/charts/hami/Chart.yaml
+++ b/packages/system/hami/charts/hami/Chart.yaml
@@ -1,10 +1,6 @@
 apiVersion: v2
 appVersion: 2.8.1
-dependencies:
-- condition: dra.enabled
-  name: hami-dra
-  repository: https://project-hami.github.io/HAMi-DRA/
-  version: 0.1.0
+dependencies: []
 description: Heterogeneous AI Computing Virtualization Middleware
 keywords:
 - vgpu
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/configmap.yaml b/packages/system/hami/charts/hami/templates/device-plugin/configmap.yaml
index b36347f2..db2ddacb 100644
--- a/packages/system/hami/charts/hami/templates/device-plugin/configmap.yaml
+++ b/packages/system/hami/charts/hami/templates/device-plugin/configmap.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.devicePlugin.enabled (not .Values.devicePlugin.nodeConfiguration.externalConfigName) (not .Values.dra.enabled) -}}
+{{- if and .Values.devicePlugin.enabled (not .Values.devicePlugin.nodeConfiguration.externalConfigName) -}}
 apiVersion: v1
 kind: ConfigMap
 metadata:
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/daemonsetnvidia.yaml b/packages/system/hami/charts/hami/templates/device-plugin/daemonsetnvidia.yaml
index 577dc0f9..1f4c24f3 100644
--- a/packages/system/hami/charts/hami/templates/device-plugin/daemonsetnvidia.yaml
+++ b/packages/system/hami/charts/hami/templates/device-plugin/daemonsetnvidia.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.devicePlugin.enabled (not .Values.dra.enabled) }}
+{{- if .Values.devicePlugin.enabled }}
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/monitorrole.yaml b/packages/system/hami/charts/hami/templates/device-plugin/monitorrole.yaml
index c51ff6c6..377f6a86 100644
--- a/packages/system/hami/charts/hami/templates/device-plugin/monitorrole.yaml
+++ b/packages/system/hami/charts/hami/templates/device-plugin/monitorrole.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.devicePlugin.enabled (not .Values.dra.enabled) -}}
+{{- if .Values.devicePlugin.enabled -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/monitorrolebinding.yaml b/packages/system/hami/charts/hami/templates/device-plugin/monitorrolebinding.yaml
index 93a118dd..2f0a14ba 100644
--- a/packages/system/hami/charts/hami/templates/device-plugin/monitorrolebinding.yaml
+++ b/packages/system/hami/charts/hami/templates/device-plugin/monitorrolebinding.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.devicePlugin.enabled (not .Values.dra.enabled) -}}
+{{- if .Values.devicePlugin.enabled -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml b/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml
index 24daca9b..0fb156cc 100644
--- a/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml
+++ b/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.devicePlugin.enabled (not .Values.dra.enabled) -}}
+{{- if .Values.devicePlugin.enabled -}}
 apiVersion: v1
 kind: Service
 metadata:
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/monitorserviceaccount.yaml b/packages/system/hami/charts/hami/templates/device-plugin/monitorserviceaccount.yaml
index b10d2cb9..6e3c2a44 100644
--- a/packages/system/hami/charts/hami/templates/device-plugin/monitorserviceaccount.yaml
+++ b/packages/system/hami/charts/hami/templates/device-plugin/monitorserviceaccount.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.devicePlugin.enabled (not .Values.dra.enabled) -}}
+{{- if .Values.devicePlugin.enabled -}}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/runtime-class.yaml b/packages/system/hami/charts/hami/templates/device-plugin/runtime-class.yaml
index cd3d14cc..ebcc2c9c 100644
--- a/packages/system/hami/charts/hami/templates/device-plugin/runtime-class.yaml
+++ b/packages/system/hami/charts/hami/templates/device-plugin/runtime-class.yaml
@@ -1,5 +1,4 @@
-{{- if and .Values.devicePlugin.enabled (not .Values.dra.enabled) -}}
-{{- if and .Values.devicePlugin.createRuntimeClass .Values.devicePlugin.runtimeClassName }}
+{{- if and .Values.devicePlugin.enabled .Values.devicePlugin.createRuntimeClass .Values.devicePlugin.runtimeClassName -}}
 apiVersion: node.k8s.io/v1
 kind: RuntimeClass
 metadata:
@@ -7,5 +6,4 @@ metadata:
   annotations:
     helm.sh/hook: pre-install,pre-upgrade
 handler: nvidia
-{{- end }}
 {{- end -}}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/certmanager.yaml b/packages/system/hami/charts/hami/templates/scheduler/certmanager.yaml
index b6edb605..e6d28721 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/certmanager.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/certmanager.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) -}}
+{{- if .Values.scheduler.admissionWebhook.enabled -}}
 {{- if .Values.scheduler.certManager.enabled }}
 apiVersion: cert-manager.io/v1
 kind: Certificate
diff --git a/packages/system/hami/charts/hami/templates/scheduler/clusterrole.yaml b/packages/system/hami/charts/hami/templates/scheduler/clusterrole.yaml
index 9c510c00..81c4fddf 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/clusterrole.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/clusterrole.yaml
@@ -1,4 +1,3 @@
-{{- if not .Values.dra.enabled -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -33,4 +32,3 @@ rules:
     resources: ["nodes"]
     verbs: ["get", "update", "list", "patch"]
 {{- end -}}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/clusterrolebinding.yaml b/packages/system/hami/charts/hami/templates/scheduler/clusterrolebinding.yaml
index 69d75986..aa0f3c66 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/clusterrolebinding.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/clusterrolebinding.yaml
@@ -1,4 +1,3 @@
-{{- if not .Values.dra.enabled -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -45,5 +44,4 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: {{ include "hami-vgpu.scheduler" . }}
-    namespace: {{ include "hami-vgpu.namespace" . }}
-{{- end }}
\ No newline at end of file
+    namespace: {{ include "hami-vgpu.namespace" . }}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/templates/scheduler/configmap.yaml b/packages/system/hami/charts/hami/templates/scheduler/configmap.yaml
index 75889146..109ecbce 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/configmap.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/configmap.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.scheduler.kubeScheduler.enabled (not .Values.dra.enabled) -}}
+{{- if .Values.scheduler.kubeScheduler.enabled -}}
 apiVersion: v1
 kind: ConfigMap
 metadata:
diff --git a/packages/system/hami/charts/hami/templates/scheduler/configmapnew.yaml b/packages/system/hami/charts/hami/templates/scheduler/configmapnew.yaml
index e2a91d8b..6f6db097 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/configmapnew.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/configmapnew.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.scheduler.kubeScheduler.enabled (not .Values.dra.enabled) -}}
+{{- if .Values.scheduler.kubeScheduler.enabled -}}
 apiVersion: v1
 kind: ConfigMap
 metadata:
diff --git a/packages/system/hami/charts/hami/templates/scheduler/deployment.yaml b/packages/system/hami/charts/hami/templates/scheduler/deployment.yaml
index 6364cae3..12911a42 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/deployment.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/deployment.yaml
@@ -1,4 +1,3 @@
-{{- if not .Values.dra.enabled -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -223,5 +222,4 @@ spec:
       {{- end }}
       {{- if .Values.scheduler.nodeName }}
       nodeName: {{ .Values.scheduler.nodeName }}
-      {{- end }}
-{{- end }}
\ No newline at end of file
+      {{- end }}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/templates/scheduler/device-configmap.yaml b/packages/system/hami/charts/hami/templates/scheduler/device-configmap.yaml
index ccb945ac..8738a06f 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/device-configmap.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/device-configmap.yaml
@@ -1,4 +1,3 @@
-{{- if not .Values.dra.enabled -}}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -406,5 +405,4 @@ data:
           memory: 12288
           aiCore: 4
           aiCPU: 4
-  {{ end }}
-{{- end }}
\ No newline at end of file
+  {{ end }}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrole.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrole.yaml
index b089ae82..412b1094 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrole.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrole.yaml
@@ -1,5 +1,4 @@
-{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) -}}
-{{- if and (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) }}
+{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -27,4 +26,3 @@ rules:
     - {{ include "hami-vgpu.fullname" . }}-admission
 {{- end }}
 {{- end }}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrolebinding.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrolebinding.yaml
index 64f01ecf..2b82f926 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrolebinding.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrolebinding.yaml
@@ -1,5 +1,4 @@
-{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) -}}
-{{- if and (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) }}
+{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -19,4 +18,3 @@ subjects:
     name: {{ include "hami-vgpu.fullname" . }}-admission
     namespace: {{ include "hami-vgpu.namespace" . }}
 {{- end }}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-createSecret.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-createSecret.yaml
index 400168a7..0e36d95f 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-createSecret.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-createSecret.yaml
@@ -1,5 +1,4 @@
-{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) -}}
-{{- if and (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) }}
+{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}}
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -67,4 +66,3 @@ spec:
         runAsNonRoot: true
         runAsUser: {{ .Values.scheduler.patch.runAsUser }}
 {{- end }}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-patchWebhook.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-patchWebhook.yaml
index 71e97f6b..ce52042c 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-patchWebhook.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-patchWebhook.yaml
@@ -1,5 +1,4 @@
-{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) -}}
-{{- if and (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) }}
+{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}}
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -62,4 +61,3 @@ spec:
         runAsNonRoot: true
         runAsUser: {{ .Values.scheduler.patch.runAsUser }}
 {{- end }}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/psp.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/psp.yaml
index a48270e7..1e9cd7da 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/psp.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/job-patch/psp.yaml
@@ -1,5 +1,4 @@
-{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) -}}
-{{- if and (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) }}
+{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}}
 {{- if .Values.podSecurityPolicy.enabled }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
@@ -37,4 +36,3 @@ spec:
   - downwardAPI
 {{- end }}
 {{- end }}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/role.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/role.yaml
index 74e45681..56682f8e 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/role.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/job-patch/role.yaml
@@ -1,5 +1,4 @@
-{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) -}}
-{{- if and (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) }}
+{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -20,4 +19,3 @@ rules:
       - get
       - create
 {{- end }}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/rolebinding.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/rolebinding.yaml
index 32da5ba4..7239b128 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/rolebinding.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/job-patch/rolebinding.yaml
@@ -1,5 +1,4 @@
-{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) -}}
-{{- if and (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) }}
+{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
@@ -20,4 +19,3 @@ subjects:
     name: {{ include "hami-vgpu.fullname" . }}-admission
     namespace: {{ include "hami-vgpu.namespace" . }}
 {{- end }}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/serviceaccount.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/serviceaccount.yaml
index d2eb41de..857c6a8d 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/serviceaccount.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/job-patch/serviceaccount.yaml
@@ -1,5 +1,4 @@
-{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) }}
-{{- if and (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) }}
+{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -12,4 +11,3 @@ metadata:
     {{- include "hami-vgpu.labels" . | nindent 4 }}
     app.kubernetes.io/component: admission-webhook
 {{- end }}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/role.yaml b/packages/system/hami/charts/hami/templates/scheduler/role.yaml
index 6e681967..90987a4f 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/role.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/role.yaml
@@ -1,4 +1,3 @@
-{{- if not .Values.dra.enabled -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -10,5 +9,4 @@ metadata:
 rules:
   - apiGroups: ["coordination.k8s.io"]
     resources: ["leases"]
-    verbs: ["create", "list", "watch", "get", "update", "patch"]
-{{- end }}
\ No newline at end of file
+    verbs: ["create", "list", "watch", "get", "update", "patch"]
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/templates/scheduler/rolebinding.yaml b/packages/system/hami/charts/hami/templates/scheduler/rolebinding.yaml
index 934f8223..96e175a1 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/rolebinding.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/rolebinding.yaml
@@ -1,4 +1,3 @@
-{{- if not .Values.dra.enabled -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
@@ -30,4 +29,3 @@ subjects:
     name: {{ include "hami-vgpu.mock-device-plugin" . }}
     namespace: {{ include "hami-vgpu.namespace" . }}
 {{- end -}}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/service.yaml b/packages/system/hami/charts/hami/templates/scheduler/service.yaml
index 3e18bc98..70378c5c 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/service.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/service.yaml
@@ -1,4 +1,3 @@
-{{- if not .Values.dra.enabled }}
 apiVersion: v1
 kind: Service
 metadata:
@@ -32,5 +31,4 @@ spec:
       protocol: TCP
   selector:
     app.kubernetes.io/component: hami-scheduler
-    {{- include "hami-vgpu.selectorLabels" . | nindent 4 }}
-{{- end }}
\ No newline at end of file
+    {{- include "hami-vgpu.selectorLabels" . | nindent 4 }}
\ No newline at end of file
diff --git a/packages/system/hami/charts/hami/templates/scheduler/serviceaccount.yaml b/packages/system/hami/charts/hami/templates/scheduler/serviceaccount.yaml
index 929bf59a..0435c003 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/serviceaccount.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/serviceaccount.yaml
@@ -1,4 +1,3 @@
-{{- if not .Values.dra.enabled -}}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -15,4 +14,3 @@ metadata:
   name: {{ include "hami-vgpu.mock-device-plugin" . }}
   namespace: {{ include "hami-vgpu.namespace" . }}
 {{- end -}}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/webhook.yaml b/packages/system/hami/charts/hami/templates/scheduler/webhook.yaml
index 148feb5c..7296eb4e 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/webhook.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/webhook.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.scheduler.admissionWebhook.enabled (not .Values.dra.enabled) -}}
+{{- if .Values.scheduler.admissionWebhook.enabled -}}
 apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
 metadata:
diff --git a/packages/system/hami/charts/hami/values.yaml b/packages/system/hami/charts/hami/values.yaml
index 9fbeca70..02feeada 100644
--- a/packages/system/hami/charts/hami/values.yaml
+++ b/packages/system/hami/charts/hami/values.yaml
@@ -392,24 +392,6 @@ mockDevicePlugin:
     ##   - myRegistryKeySecretName
     ##
     pullSecrets: []
-# If this option is enabled, the DRA will be installed and the scheduler extender will not be installed.
-dra:
-  enabled: false
-
-# Configuration for the hami-dra subchart, which includes DRA drivers.
-# This is part of config for DRA, please refer to the DRA documentation for more details.
-hami-dra:
-  monitor:
-    enabled: true
-  drivers:
-    nvidia:
-      enabled: true
-      # If you are using gpu driver on host, you need to set this to false
-      containerDriver: true
-      image:
-        repository: projecthami/k8s-dra-driver
-        tag: "v0.0.1-dev"
-
 devices:
   amd:
     customresources:
diff --git a/packages/system/hami/values.yaml b/packages/system/hami/values.yaml
index 1155e2cb..1d1407b7 100644
--- a/packages/system/hami/values.yaml
+++ b/packages/system/hami/values.yaml
@@ -1,6 +1,10 @@
 hami:
   devicePlugin:
     runtimeClassName: nvidia
+    updateStrategy:
+      type: OnDelete
+    # See upstream charts/hami/values.yaml for nodeConfiguration format.
+    # Each entry: {"name": "node-name", "operatingmode": "hami-core", "devicesplitcount": N, ...}
     nodeConfiguration:
       config: |
         {

From 37d5ff0c6f0566ca18495e871c5ad626f7976ca1 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Fri, 24 Apr 2026 14:07:17 +0300
Subject: [PATCH 605/666] fix(hami): align templates with project patterns and
 clean dead code

Unconditionally emit values in hami.yaml matching the project pattern.
Remove duplicate test case and add coverage for omitted valuesOverride key.
Delete dead PSP template and RBAC rules (policy/v1beta1 removed in K8s
1.25). Override kube-scheduler image registry to registry.k8s.io to avoid
Chinese registry for international users.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../templates/helmreleases/hami.yaml          |  4 +-
 .../tests/gpu_operator_hami_test.yaml         | 29 ++++++--------
 .../scheduler/job-patch/clusterrole.yaml      |  7 ----
 .../templates/scheduler/job-patch/psp.yaml    | 38 -------------------
 packages/system/hami/charts/hami/values.yaml  |  3 --
 packages/system/hami/values.yaml              |  5 +++
 6 files changed, 18 insertions(+), 68 deletions(-)
 delete mode 100644 packages/system/hami/charts/hami/templates/scheduler/job-patch/psp.yaml

diff --git a/packages/apps/kubernetes/templates/helmreleases/hami.yaml b/packages/apps/kubernetes/templates/helmreleases/hami.yaml
index 1f7a5358..ac4714da 100644
--- a/packages/apps/kubernetes/templates/helmreleases/hami.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/hami.yaml
@@ -32,10 +32,8 @@ spec:
     force: true
     remediation:
       retries: -1
-  {{- with .Values.addons.hami.valuesOverride }}
   values:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
+    {{- if .Values.addons.hami.valuesOverride }}{{ toYaml .Values.addons.hami.valuesOverride | nindent 4 }}{{ end }}
 
   dependsOn:
   {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
diff --git a/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml b/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml
index 11de743a..c3ec30f2 100644
--- a/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml
+++ b/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml
@@ -30,6 +30,18 @@ tests:
           path: spec.values
           value: null
 
+  - it: should apply hami defaults when valuesOverride key is omitted
+    set:
+      addons:
+        gpuOperator:
+          enabled: true
+        hami:
+          enabled: true
+    asserts:
+      - equal:
+          path: spec.values.gpu-operator.devicePlugin.enabled
+          value: false
+
   - it: should allow user overrides to merge with hami defaults
     set:
       addons:
@@ -50,23 +62,6 @@ tests:
           path: spec.values.gpu-operator.driver.enabled
           value: false
 
-  - it: should let user override devicePlugin back to true if needed
-    set:
-      addons:
-        gpuOperator:
-          enabled: true
-          valuesOverride:
-            gpu-operator:
-              devicePlugin:
-                enabled: true
-        hami:
-          enabled: true
-          valuesOverride: {}
-    asserts:
-      - equal:
-          path: spec.values.gpu-operator.devicePlugin.enabled
-          value: true
-
   - it: should let user explicitly override devicePlugin.enabled to true with hami enabled
     set:
       addons:
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrole.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrole.yaml
index 412b1094..77e891cc 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrole.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrole.yaml
@@ -18,11 +18,4 @@ rules:
     verbs:
       - get
       - update
-{{- if .Values.podSecurityPolicy.enabled }}
-  - apiGroups: ['extensions']
-    resources: ['podsecuritypolicies']
-    verbs:     ['use']
-    resourceNames:
-    - {{ include "hami-vgpu.fullname" . }}-admission
-{{- end }}
 {{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/psp.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/psp.yaml
deleted file mode 100644
index 1e9cd7da..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/psp.yaml
+++ /dev/null
@@ -1,38 +0,0 @@
-{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}}
-{{- if .Values.podSecurityPolicy.enabled }}
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
-  name: {{ include "hami-vgpu.fullname" . }}-admission
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-    app.kubernetes.io/component: admission-webhook
-spec:
-  allowPrivilegeEscalation: false
-  fsGroup:
-    ranges:
-    - max: 65535
-      min: 1
-    rule: MustRunAs
-  requiredDropCapabilities:
-  - ALL
-  runAsUser:
-    rule: MustRunAsNonRoot
-  seLinux:
-    rule: RunAsAny
-  supplementalGroups:
-    ranges:
-    - max: 65535
-      min: 1
-    rule: MustRunAs
-  volumes:
-  - configMap
-  - emptyDir
-  - projected
-  - secret
-  - downwardAPI
-{{- end }}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/values.yaml b/packages/system/hami/charts/hami/values.yaml
index 02feeada..01caca0b 100644
--- a/packages/system/hami/charts/hami/values.yaml
+++ b/packages/system/hami/charts/hami/values.yaml
@@ -55,9 +55,6 @@ kunlunResourceVMemoryName: "kunlunxin.com/vxpu-memory"
 
 schedulerName: "hami-scheduler"
 
-podSecurityPolicy:
-  enabled: false
-
 scheduler:
   # @param nodeName defines the node name and the nvidia-vgpu-scheduler-scheduler will schedule to the node.
   # if we install the nvidia-vgpu-scheduler-scheduler as default scheduler, we need to remove the k8s default
diff --git a/packages/system/hami/values.yaml b/packages/system/hami/values.yaml
index 1d1407b7..f45d2998 100644
--- a/packages/system/hami/values.yaml
+++ b/packages/system/hami/values.yaml
@@ -1,4 +1,9 @@
 hami:
+  scheduler:
+    kubeScheduler:
+      image:
+        registry: registry.k8s.io
+        repository: kube-scheduler
   devicePlugin:
     runtimeClassName: nvidia
     updateStrategy:

From 6a9c310a4bfdb8bab3cd4f52724205adfbd2219e Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Fri, 24 Apr 2026 15:31:24 +0300
Subject: [PATCH 606/666] fix(hami): conditional values emission and cosmetic
 template cleanup

Only emit values key in hami.yaml when valuesOverride has content,
matching gpu-operator pattern. Add test verifying empty valuesOverride
does not produce spec.values. Fix trailing whitespace and missing
newlines in vendored chart templates.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../kubernetes/templates/helmreleases/hami.yaml   |  4 +++-
 packages/apps/kubernetes/tests/hami_test.yaml     | 15 +++++++++++++++
 .../hami/charts/hami/templates/_commons.tpl       |  2 +-
 .../hami/templates/device-plugin/configmap.yaml   |  2 +-
 .../hami/templates/device-plugin/monitorrole.yaml |  3 +--
 .../templates/device-plugin/monitorservice.yaml   |  2 +-
 .../templates/scheduler/clusterrolebinding.yaml   |  2 +-
 .../hami/templates/scheduler/deployment.yaml      |  2 +-
 .../templates/scheduler/device-configmap.yaml     |  2 +-
 .../charts/hami/templates/scheduler/role.yaml     |  2 +-
 .../charts/hami/templates/scheduler/service.yaml  |  2 +-
 .../charts/hami/templates/scheduler/webhook.yaml  |  2 +-
 12 files changed, 28 insertions(+), 12 deletions(-)

diff --git a/packages/apps/kubernetes/templates/helmreleases/hami.yaml b/packages/apps/kubernetes/templates/helmreleases/hami.yaml
index ac4714da..8733e675 100644
--- a/packages/apps/kubernetes/templates/helmreleases/hami.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/hami.yaml
@@ -32,8 +32,10 @@ spec:
     force: true
     remediation:
       retries: -1
+  {{- if .Values.addons.hami.valuesOverride }}
   values:
-    {{- if .Values.addons.hami.valuesOverride }}{{ toYaml .Values.addons.hami.valuesOverride | nindent 4 }}{{ end }}
+    {{- toYaml .Values.addons.hami.valuesOverride | nindent 4 }}
+  {{- end }}
 
   dependsOn:
   {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
diff --git a/packages/apps/kubernetes/tests/hami_test.yaml b/packages/apps/kubernetes/tests/hami_test.yaml
index e9d32236..bdbe990f 100644
--- a/packages/apps/kubernetes/tests/hami_test.yaml
+++ b/packages/apps/kubernetes/tests/hami_test.yaml
@@ -118,6 +118,21 @@ tests:
             name: test-gpu-operator
             namespace: test-ns
 
+  - it: should not render spec.values when valuesOverride is empty
+    set:
+      addons:
+        hami:
+          enabled: true
+          valuesOverride: {}
+        gpuOperator:
+          enabled: true
+          valuesOverride: {}
+    asserts:
+      - hasDocuments:
+          count: 1
+      - notExists:
+          path: spec.values
+
   - it: should pass through valuesOverride
     set:
       addons:
diff --git a/packages/system/hami/charts/hami/templates/_commons.tpl b/packages/system/hami/charts/hami/templates/_commons.tpl
index 78a262c9..b68018e4 100644
--- a/packages/system/hami/charts/hami/templates/_commons.tpl
+++ b/packages/system/hami/charts/hami/templates/_commons.tpl
@@ -46,4 +46,4 @@ imagePullSecrets:
   - name: {{ . }}
     {{- end }}
   {{- end }}
-{{- end -}}
\ No newline at end of file
+{{- end -}}
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/configmap.yaml b/packages/system/hami/charts/hami/templates/device-plugin/configmap.yaml
index db2ddacb..74631e24 100644
--- a/packages/system/hami/charts/hami/templates/device-plugin/configmap.yaml
+++ b/packages/system/hami/charts/hami/templates/device-plugin/configmap.yaml
@@ -10,4 +10,4 @@ metadata:
 data:
   config.json: |
 {{- .Values.devicePlugin.nodeConfiguration.config | nindent 4 }}
-{{- end }}
\ No newline at end of file
+{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/monitorrole.yaml b/packages/system/hami/charts/hami/templates/device-plugin/monitorrole.yaml
index 377f6a86..6ac757f2 100644
--- a/packages/system/hami/charts/hami/templates/device-plugin/monitorrole.yaml
+++ b/packages/system/hami/charts/hami/templates/device-plugin/monitorrole.yaml
@@ -25,5 +25,4 @@ rules:
       - list
       - patch
 {{- end -}}
-    
-    
+
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml b/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml
index 0fb156cc..104664ea 100644
--- a/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml
+++ b/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml
@@ -26,4 +26,4 @@ spec:
   selector:
     app.kubernetes.io/component: hami-device-plugin
     {{- include "hami-vgpu.selectorLabels" . | nindent 4 }}
-{{- end -}}
\ No newline at end of file
+{{- end -}}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/clusterrolebinding.yaml b/packages/system/hami/charts/hami/templates/scheduler/clusterrolebinding.yaml
index aa0f3c66..a81d425c 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/clusterrolebinding.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/clusterrolebinding.yaml
@@ -44,4 +44,4 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: {{ include "hami-vgpu.scheduler" . }}
-    namespace: {{ include "hami-vgpu.namespace" . }}
\ No newline at end of file
+    namespace: {{ include "hami-vgpu.namespace" . }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/deployment.yaml b/packages/system/hami/charts/hami/templates/scheduler/deployment.yaml
index 12911a42..1d89e189 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/deployment.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/deployment.yaml
@@ -222,4 +222,4 @@ spec:
       {{- end }}
       {{- if .Values.scheduler.nodeName }}
       nodeName: {{ .Values.scheduler.nodeName }}
-      {{- end }}
\ No newline at end of file
+      {{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/device-configmap.yaml b/packages/system/hami/charts/hami/templates/scheduler/device-configmap.yaml
index 8738a06f..873b813b 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/device-configmap.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/device-configmap.yaml
@@ -405,4 +405,4 @@ data:
           memory: 12288
           aiCore: 4
           aiCPU: 4
-  {{ end }}
\ No newline at end of file
+  {{ end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/role.yaml b/packages/system/hami/charts/hami/templates/scheduler/role.yaml
index 90987a4f..5f7d7e44 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/role.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/role.yaml
@@ -9,4 +9,4 @@ metadata:
 rules:
   - apiGroups: ["coordination.k8s.io"]
     resources: ["leases"]
-    verbs: ["create", "list", "watch", "get", "update", "patch"]
\ No newline at end of file
+    verbs: ["create", "list", "watch", "get", "update", "patch"]
diff --git a/packages/system/hami/charts/hami/templates/scheduler/service.yaml b/packages/system/hami/charts/hami/templates/scheduler/service.yaml
index 70378c5c..d7538fed 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/service.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/service.yaml
@@ -31,4 +31,4 @@ spec:
       protocol: TCP
   selector:
     app.kubernetes.io/component: hami-scheduler
-    {{- include "hami-vgpu.selectorLabels" . | nindent 4 }}
\ No newline at end of file
+    {{- include "hami-vgpu.selectorLabels" . | nindent 4 }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/webhook.yaml b/packages/system/hami/charts/hami/templates/scheduler/webhook.yaml
index 7296eb4e..db9f8029 100644
--- a/packages/system/hami/charts/hami/templates/scheduler/webhook.yaml
+++ b/packages/system/hami/charts/hami/templates/scheduler/webhook.yaml
@@ -54,4 +54,4 @@ webhooks:
         scope: '*'
     sideEffects: None
     timeoutSeconds: 10
-{{- end }}
\ No newline at end of file
+{{- end }}

From 1131e2f113a8fda8402bf9c92014bff9aaf29f25 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Fri, 24 Apr 2026 15:33:07 +0300
Subject: [PATCH 607/666] docs(hami): reference upstream repo for
 nodeConfiguration format

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/system/hami/values.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/system/hami/values.yaml b/packages/system/hami/values.yaml
index f45d2998..64b372a6 100644
--- a/packages/system/hami/values.yaml
+++ b/packages/system/hami/values.yaml
@@ -8,7 +8,7 @@ hami:
     runtimeClassName: nvidia
     updateStrategy:
       type: OnDelete
-    # See upstream charts/hami/values.yaml for nodeConfiguration format.
+    # See https://github.com/Project-HAMi/HAMi/blob/v2.8.1/deployments/charts/hami/values.yaml
     # Each entry: {"name": "node-name", "operatingmode": "hami-core", "devicesplitcount": N, ...}
     nodeConfiguration:
       config: |

From 3eeda2ba3596851393fd62d3d352cdd1017be267 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Fri, 24 Apr 2026 16:12:34 +0300
Subject: [PATCH 608/666] chore(kubernetes): regenerate code after hami addon
 addition

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../kubernetes/zz_generated.deepcopy.go         | 17 +++++++++++++++++
 api/backups/v1alpha1/zz_generated.deepcopy.go   |  5 +++++
 2 files changed, 22 insertions(+)

diff --git a/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go b/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go
index 2cbe3ba1..3f1cb5ce 100644
--- a/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go
@@ -49,6 +49,7 @@ func (in *Addons) DeepCopyInto(out *Addons) {
 	in.Fluxcd.DeepCopyInto(&out.Fluxcd)
 	out.GatewayAPI = in.GatewayAPI
 	in.GpuOperator.DeepCopyInto(&out.GpuOperator)
+	in.Hami.DeepCopyInto(&out.Hami)
 	in.IngressNginx.DeepCopyInto(&out.IngressNginx)
 	in.MonitoringAgents.DeepCopyInto(&out.MonitoringAgents)
 	in.Velero.DeepCopyInto(&out.Velero)
@@ -260,6 +261,22 @@ func (in *GatewayAPIAddon) DeepCopy() *GatewayAPIAddon {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HAMiAddon) DeepCopyInto(out *HAMiAddon) {
+	*out = *in
+	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HAMiAddon.
+func (in *HAMiAddon) DeepCopy() *HAMiAddon {
+	if in == nil {
+		return nil
+	}
+	out := new(HAMiAddon)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *IngressNginxAddon) DeepCopyInto(out *IngressNginxAddon) {
 	*out = *in
diff --git a/api/backups/v1alpha1/zz_generated.deepcopy.go b/api/backups/v1alpha1/zz_generated.deepcopy.go
index 89f6171f..61b8f839 100644
--- a/api/backups/v1alpha1/zz_generated.deepcopy.go
+++ b/api/backups/v1alpha1/zz_generated.deepcopy.go
@@ -620,6 +620,11 @@ func (in *RestoreJobSpec) DeepCopyInto(out *RestoreJobSpec) {
 		*out = new(v1.TypedLocalObjectReference)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.Options != nil {
+		in, out := &in.Options, &out.Options
+		*out = new(runtime.RawExtension)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RestoreJobSpec.

From 500816b71b1ad3f916e11ff3ddb1fd6dee9fcc76 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Fri, 24 Apr 2026 16:44:46 +0300
Subject: [PATCH 609/666] refactor(ingress): move CiliumLoadBalancerIPPool to
 tenant chart
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The pool is now rendered from packages/apps/tenant/templates/cilium-lb-pool.yaml instead of packages/extra/ingress/templates/cilium-lb-pool.yaml. Cilium LB IPAM forbids overlapping CIDRs across pools regardless of serviceSelector, so both the ingress-loadBalancer path and the upcoming per-tenant Gateway in #2470 cannot each own their own pool on the same publishing.externalIPs range. The tenant chart is the natural per-tenant owner — it already creates the Namespace, the cozystack-values Secret, and the HelmReleases for both ingress and gateway.

The new pool uses a namespace-only serviceSelector (io.kubernetes.service.namespace: <ns>), which matches any LoadBalancer Service in the tenant namespace. The metadata.name changed from <trim>-ingress to <trim>-exposure to reflect that the pool is not ingress-specific.

Only the ingress-loadBalancer signal is wired in this commit (_cluster.expose-mode=loadBalancer plus .Values.ingress=true on the publishing tenant). The gateway branch is added in #2470 on top of this commit — it rebases, drops its own packages/extra/gateway/templates/cilium-lb-pool.yaml, and adds an OR branch for .Values.gateway in the tenant template.

Pool-rendering unit tests moved from packages/extra/ingress/tests/ to packages/apps/tenant/tests/. The ingress chart tests keep the Service-level asserts. packages/apps/tenant/Makefile gains a test target so hack/helm-unit-tests.sh picks up the new suite.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/apps/tenant/Makefile                 |   3 +
 .../tenant}/templates/cilium-lb-pool.yaml     |  21 +--
 packages/apps/tenant/tests/exposure_test.yaml | 141 ++++++++++++++++++
 .../extra/ingress/tests/exposure_test.yaml    | 104 +------------
 4 files changed, 158 insertions(+), 111 deletions(-)
 rename packages/{extra/ingress => apps/tenant}/templates/cilium-lb-pool.yaml (54%)
 create mode 100644 packages/apps/tenant/tests/exposure_test.yaml

diff --git a/packages/apps/tenant/Makefile b/packages/apps/tenant/Makefile
index 3fe3810d..2f51d836 100644
--- a/packages/apps/tenant/Makefile
+++ b/packages/apps/tenant/Makefile
@@ -3,3 +3,6 @@ include ../../../hack/package.mk
 generate:
 	cozyvalues-gen -m 'tenant' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/tenant/types.go
 	../../../hack/update-crd.sh
+
+test:
+	helm unittest .
diff --git a/packages/extra/ingress/templates/cilium-lb-pool.yaml b/packages/apps/tenant/templates/cilium-lb-pool.yaml
similarity index 54%
rename from packages/extra/ingress/templates/cilium-lb-pool.yaml
rename to packages/apps/tenant/templates/cilium-lb-pool.yaml
index 048eb58b..63dbcaca 100644
--- a/packages/extra/ingress/templates/cilium-lb-pool.yaml
+++ b/packages/apps/tenant/templates/cilium-lb-pool.yaml
@@ -1,25 +1,28 @@
-{{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
 {{- $exposeMode := (index .Values._cluster "expose-mode") | default "externalIPs" }}
-{{- $exposeExternalIPs := (index .Values._cluster "expose-external-ips") | default "" | nospace }}
-{{- $exposeIPsList := list }}
-{{- range splitList "," $exposeExternalIPs }}
+{{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
+{{- $exposeIPs := (index .Values._cluster "expose-external-ips") | default "" | nospace }}
+{{- $ipsList := list }}
+{{- range splitList "," $exposeIPs }}
   {{- $ip := . | trim }}
   {{- if $ip }}
-    {{- $exposeIPsList = append $exposeIPsList $ip }}
+    {{- $ipsList = append $ipsList $ip }}
   {{- end }}
 {{- end }}
-{{- if and (eq $exposeMode "loadBalancer") (eq $exposeIngress .Release.Namespace) $exposeIPsList }}
+{{- $isPublishingIngressLB := and
+      (eq $exposeMode "loadBalancer")
+      (eq $exposeIngress .Release.Namespace)
+      .Values.ingress }}
+{{- if and $isPublishingIngressLB $ipsList }}
 apiVersion: cilium.io/v2
 kind: CiliumLoadBalancerIPPool
 metadata:
-  name: {{ trimPrefix "tenant-" .Release.Namespace }}-ingress
+  name: {{ trimPrefix "tenant-" .Release.Namespace }}-exposure
 spec:
   blocks:
-  {{- range $exposeIPsList }}
+  {{- range $ipsList }}
   - cidr: {{ . }}{{ if not (contains "/" .) }}/{{ if contains ":" . }}128{{ else }}32{{ end }}{{ end }}
   {{- end }}
   serviceSelector:
     matchLabels:
       "io.kubernetes.service.namespace": {{ .Release.Namespace | quote }}
-      "app.kubernetes.io/name": ingress-nginx
 {{- end }}
diff --git a/packages/apps/tenant/tests/exposure_test.yaml b/packages/apps/tenant/tests/exposure_test.yaml
new file mode 100644
index 00000000..e86fab5b
--- /dev/null
+++ b/packages/apps/tenant/tests/exposure_test.yaml
@@ -0,0 +1,141 @@
+suite: tenant CiliumLoadBalancerIPPool rendering for publishing.exposure=loadBalancer
+templates:
+  - templates/cilium-lb-pool.yaml
+
+release:
+  name: tenant-root
+  namespace: tenant-root
+
+tests:
+  - it: default exposure (externalIPs) renders no pool
+    set:
+      ingress: true
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10,192.0.2.11"
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: loadBalancer mode in publishing tenant with ingress=true renders v2 pool with namespace-only selector
+    set:
+      ingress: true
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10,192.0.2.11"
+        expose-mode: loadBalancer
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: apiVersion
+          value: cilium.io/v2
+      - equal:
+          path: kind
+          value: CiliumLoadBalancerIPPool
+      - equal:
+          path: metadata.name
+          value: root-exposure
+      - equal:
+          path: spec.blocks
+          value:
+            - cidr: 192.0.2.10/32
+            - cidr: 192.0.2.11/32
+      - equal:
+          path: spec.serviceSelector.matchLabels["io.kubernetes.service.namespace"]
+          value: tenant-root
+      - notExists:
+          path: spec.serviceSelector.matchLabels["app.kubernetes.io/name"]
+
+  - it: loadBalancer mode with IPv6 emits /128 CIDR
+    set:
+      ingress: true
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "2001:db8::1"
+        expose-mode: loadBalancer
+    asserts:
+      - equal:
+          path: spec.blocks
+          value:
+            - cidr: 2001:db8::1/128
+
+  - it: loadBalancer mode with mixed IPv4 and IPv6 emits correct CIDR per family
+    set:
+      ingress: true
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10,2001:db8::1"
+        expose-mode: loadBalancer
+    asserts:
+      - equal:
+          path: spec.blocks
+          value:
+            - cidr: 192.0.2.10/32
+            - cidr: 2001:db8::1/128
+
+  - it: loadBalancer mode accepts pre-CIDR input without double-suffixing
+    set:
+      ingress: true
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10/32,2001:db8::1/128"
+        expose-mode: loadBalancer
+    asserts:
+      - equal:
+          path: spec.blocks
+          value:
+            - cidr: 192.0.2.10/32
+            - cidr: 2001:db8::1/128
+
+  - it: loadBalancer mode filters out empty entries from externalIPs (trailing, leading, repeated commas)
+    set:
+      ingress: true
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10,,192.0.2.11,"
+        expose-mode: loadBalancer
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: spec.blocks
+          value:
+            - cidr: 192.0.2.10/32
+            - cidr: 192.0.2.11/32
+
+  - it: loadBalancer mode with ingress=false in publishing tenant renders no pool
+    set:
+      ingress: false
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10"
+        expose-mode: loadBalancer
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: loadBalancer mode in a non-publishing tenant renders no pool
+    set:
+      ingress: true
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10"
+        expose-mode: loadBalancer
+    release:
+      name: tenant-u1
+      namespace: tenant-u1
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: loadBalancer mode in publishing tenant with empty externalIPs renders no pool
+    set:
+      ingress: true
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: ""
+        expose-mode: loadBalancer
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/packages/extra/ingress/tests/exposure_test.yaml b/packages/extra/ingress/tests/exposure_test.yaml
index 323c8e68..1c76b3da 100644
--- a/packages/extra/ingress/tests/exposure_test.yaml
+++ b/packages/extra/ingress/tests/exposure_test.yaml
@@ -1,14 +1,13 @@
 suite: ingress exposure modes
 templates:
   - templates/nginx-ingress.yaml
-  - templates/cilium-lb-pool.yaml
 
 release:
   name: ingress
   namespace: tenant-root
 
 tests:
-  - it: default exposure (externalIPs) renders ClusterIP Service with spec.externalIPs and no CiliumLoadBalancerIPPool
+  - it: default exposure (externalIPs) renders ClusterIP Service with spec.externalIPs
     set:
       _cluster:
         expose-ingress: tenant-root
@@ -31,9 +30,6 @@ tests:
       - template: templates/nginx-ingress.yaml
         notExists:
           path: spec.values.ingress-nginx.controller.service.labels
-      - template: templates/cilium-lb-pool.yaml
-        hasDocuments:
-          count: 0
 
   - it: legacy config without expose-mode falls back to externalIPs behavior
     set:
@@ -45,9 +41,6 @@ tests:
         equal:
           path: spec.values.ingress-nginx.controller.service.type
           value: ClusterIP
-      - template: templates/cilium-lb-pool.yaml
-        hasDocuments:
-          count: 0
 
   - it: externalIPs mode in a namespace other than publishing.ingressName renders LoadBalancer fallback without externalIPs
     set:
@@ -68,11 +61,8 @@ tests:
       - template: templates/nginx-ingress.yaml
         notExists:
           path: spec.values.ingress-nginx.controller.service.externalIPs
-      - template: templates/cilium-lb-pool.yaml
-        hasDocuments:
-          count: 0
 
-  - it: loadBalancer mode renders LoadBalancer Service with lb-pool label and a v2 CiliumLoadBalancerIPPool
+  - it: loadBalancer mode renders LoadBalancer Service without externalIPs on the Service
     set:
       _cluster:
         expose-ingress: tenant-root
@@ -93,62 +83,6 @@ tests:
       - template: templates/nginx-ingress.yaml
         notExists:
           path: spec.values.ingress-nginx.controller.service.externalIPs
-      - template: templates/cilium-lb-pool.yaml
-        hasDocuments:
-          count: 1
-      - template: templates/cilium-lb-pool.yaml
-        equal:
-          path: apiVersion
-          value: cilium.io/v2
-      - template: templates/cilium-lb-pool.yaml
-        equal:
-          path: kind
-          value: CiliumLoadBalancerIPPool
-      - template: templates/cilium-lb-pool.yaml
-        equal:
-          path: metadata.name
-          value: root-ingress
-      - template: templates/cilium-lb-pool.yaml
-        equal:
-          path: spec.blocks
-          value:
-            - cidr: 192.0.2.10/32
-            - cidr: 192.0.2.11/32
-      - template: templates/cilium-lb-pool.yaml
-        equal:
-          path: spec.serviceSelector.matchLabels["io.kubernetes.service.namespace"]
-          value: tenant-root
-      - template: templates/cilium-lb-pool.yaml
-        equal:
-          path: spec.serviceSelector.matchLabels["app.kubernetes.io/name"]
-          value: ingress-nginx
-
-  - it: loadBalancer mode with IPv6 address emits /128 CIDR
-    set:
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "2001:db8::1"
-        expose-mode: loadBalancer
-    asserts:
-      - template: templates/cilium-lb-pool.yaml
-        equal:
-          path: spec.blocks
-          value:
-            - cidr: 2001:db8::1/128
-
-  - it: loadBalancer mode with mixed IPv4 and IPv6 emits correct CIDR per family
-    set:
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "192.0.2.10,2001:db8::1"
-        expose-mode: loadBalancer
-    asserts:
-      - template: templates/cilium-lb-pool.yaml
-        equal:
-          path: spec.blocks
-          value:
-            - cidr: 192.0.2.10/32
-            - cidr: 2001:db8::1/128
 
   - it: loadBalancer mode without externalIPs fails chart render with explicit message
     set:
@@ -206,26 +140,6 @@ tests:
       - template: templates/nginx-ingress.yaml
         notExists:
           path: spec.values.ingress-nginx.controller.service.externalIPs
-      - template: templates/cilium-lb-pool.yaml
-        hasDocuments:
-          count: 0
-
-  - it: loadBalancer mode filters out empty entries from externalIPs (trailing comma, leading comma)
-    set:
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "192.0.2.10,,192.0.2.11,"
-        expose-mode: loadBalancer
-    asserts:
-      - template: templates/cilium-lb-pool.yaml
-        hasDocuments:
-          count: 1
-      - template: templates/cilium-lb-pool.yaml
-        equal:
-          path: spec.blocks
-          value:
-            - cidr: 192.0.2.10/32
-            - cidr: 192.0.2.11/32
 
   - it: loadBalancer mode with only-empty externalIPs fails chart render (comma-only input)
     set:
@@ -249,17 +163,3 @@ tests:
           path: spec.values.ingress-nginx.controller.service.externalIPs
           value:
             - 192.0.2.10
-
-  - it: loadBalancer mode accepts pre-CIDR input without double-suffixing
-    set:
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "192.0.2.10/32,2001:db8::1/128"
-        expose-mode: loadBalancer
-    asserts:
-      - template: templates/cilium-lb-pool.yaml
-        equal:
-          path: spec.blocks
-          value:
-            - cidr: 192.0.2.10/32
-            - cidr: 2001:db8::1/128

From c8ed1c652cbd3d442036251358c68e7b25ec64a1 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 27 Apr 2026 02:35:52 +0300
Subject: [PATCH 612/666] chore(ci): adopt CNCF/k8s label conventions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add .github/labels.yml as the canonical label set, synced into the
repository by .github/workflows/labels.yaml using EndBug/label-sync.

Conventions follow the Kubernetes scheme:
https://github.com/kubernetes/test-infra/blob/master/label_sync/labels.md

Six namespaced groups: kind/, priority/, triage/, lifecycle/, area/,
do-not-merge/. Cozystack-specific labels preserved (epic, community,
security/*, size:*).

Migration via aliases keeps references on existing issues and PRs:
- bug           -> kind/bug
- enhancement   -> kind/feature
- documentation -> kind/documentation
- question      -> kind/support
- frozen        -> lifecycle/frozen
- stale         -> lifecycle/stale
- do-not-merge  -> do-not-merge/work-in-progress

delete-other-labels is false on the initial rollout; redundant labels
("do not merge", duplicate, invalid, wontfix) stay until a follow-up
PR removes them after stabilisation.

The labels workflow has a validate job (python3 schema check) that
runs on PR. Sync runs only on push to main, weekly cron, and manual
dispatch. Schema invariants:
- description <= 100 chars (GitHub REST API limit)
- color is 6-char hex without leading #
- unique top-level names
- aliases do not collide with top-level names

PR auto-labeling (.github/workflows/pr-labeler.yaml):
- Parses PR title as Conventional Commits header (type, scope, !).
- type -> kind/* (feat -> kind/feature, fix -> kind/bug, docs ->
  kind/documentation, chore/refactor -> kind/cleanup; style, perf,
  test, build, ci, revert -> no kind label).
- scope -> area/* via embedded mapping; composite scopes split on
  comma. Bracket-style fallback ([scope] description) maps area/*
  but cannot infer kind/*.
- '[Backport release-1.x]' prefix is stripped; area/release and
  backport labels are added.
- '!' after type or 'BREAKING CHANGE:' footer in body adds
  kind/breaking-change.
- Unmapped scope or non-conventional title adds area/uncategorized
  to flag for human review.
- Additive only — never removes existing labels.

Hardcoded label references updated:
- .github/ISSUE_TEMPLATE/bug_report.md (bug -> kind/bug)
- .github/workflows/tags.yaml (documentation -> kind/documentation)

AGENTS.md gains an Activation entry pointing agents to labels.yml
as the source of truth and to contributing.md for the title
auto-labeling table.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .github/ISSUE_TEMPLATE/bug_report.md |   2 +-
 .github/labels.yml                   | 371 +++++++++++++++++++++++++++
 .github/workflows/labels.yaml        |  84 ++++++
 .github/workflows/pr-labeler.yaml    | 199 ++++++++++++++
 .github/workflows/tags.yaml          |   6 +-
 AGENTS.md                            |   6 +
 docs/agents/contributing.md          |  43 ++++
 7 files changed, 707 insertions(+), 4 deletions(-)
 create mode 100644 .github/labels.yml
 create mode 100644 .github/workflows/labels.yaml
 create mode 100644 .github/workflows/pr-labeler.yaml

diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index 1a119259..fefdab82 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -1,7 +1,7 @@
 ---
 name: Bug report
 about: Create a report to help us improve
-labels: 'bug'
+labels: 'kind/bug'
 assignees: ''
 
 ---
diff --git a/.github/labels.yml b/.github/labels.yml
new file mode 100644
index 00000000..1369aa48
--- /dev/null
+++ b/.github/labels.yml
@@ -0,0 +1,371 @@
+# Cozystack repository labels
+#
+# Label conventions follow the Kubernetes scheme:
+# https://github.com/kubernetes/test-infra/blob/master/label_sync/labels.md
+#
+# Synced into the repository by .github/workflows/labels.yaml
+# (EndBug/label-sync@v2). Edit this file via pull request — UI changes
+# will be overwritten on the next sync.
+#
+# Constraints (enforced by the validate job in labels.yaml):
+#   - description ≤ 100 characters (GitHub REST API limit)
+#   - color is a 6-character hex string (no leading #)
+#   - label names are unique
+#   - aliases do not collide with top-level names
+#
+# Categories:
+#   kind/         issue or PR type
+#   priority/     urgency
+#   triage/       review state
+#   lifecycle/    issue or PR lifecycle
+#   area/         subsystem; extensible — add when 3+ open issues exist
+#   do-not-merge/ PR merge blockers
+#   security/     security-finding severity and status (Cozystack-specific)
+#   size:         PR size (auto-applied)
+#
+# `aliases:` lets EndBug/label-sync rename existing labels without losing
+# references on already-tagged issues and PRs.
+#
+# GitHub-default labels not migrated here (`wontfix`, `invalid`) currently
+# carry zero issues/PRs in this repo and will be removed in a follow-up
+# cleanup PR rather than aliased to a different namespace.
+
+# ──────────────────────────────────────────────
+# kind/ — issue or PR type
+# ──────────────────────────────────────────────
+
+- name: kind/bug
+  color: 'd73a4a'
+  description: Categorizes issue or PR as related to a bug
+  aliases: ['bug']
+
+- name: kind/feature
+  color: 'a2eeef'
+  description: Categorizes issue or PR as related to a new feature
+  aliases: ['enhancement']
+
+- name: kind/documentation
+  color: '0075ca'
+  description: Categorizes issue or PR as related to documentation
+  aliases: ['documentation']
+
+- name: kind/support
+  color: 'd876e3'
+  description: Categorizes issue as a support question
+  aliases: ['question']
+
+- name: kind/cleanup
+  color: 'c7def8'
+  description: Categorizes issue or PR as related to cleanup of code, process, or technical debt
+
+- name: kind/regression
+  color: 'e11d21'
+  description: Categorizes issue or PR as related to a regression from a prior release
+
+- name: kind/flake
+  color: 'f7c6c7'
+  description: Categorizes issue or PR as related to a flaky test
+
+- name: kind/failing-test
+  color: 'e11d21'
+  description: Categorizes issue or PR as related to a consistently or frequently failing test
+
+- name: kind/api-change
+  color: 'c7def8'
+  description: Categorizes issue or PR as related to adding, removing, or otherwise changing an API
+
+- name: kind/breaking-change
+  color: 'e11d21'
+  description: Indicates the change introduces a breaking API or behaviour change
+
+# ──────────────────────────────────────────────
+# priority/ — urgency
+# ──────────────────────────────────────────────
+
+- name: priority/critical-urgent
+  color: 'e11d21'
+  description: Highest priority. Must be actively worked on as someone's top priority right now
+
+- name: priority/important-soon
+  color: 'eb6420'
+  description: Must be staffed and worked on either currently, or very soon, ideally in time for the next release
+
+- name: priority/important-longterm
+  color: 'fbca04'
+  description: Important over the long term, but may not be staffed and/or may need multiple releases to complete
+
+- name: priority/backlog
+  color: 'fef2c0'
+  description: General backlog priority. Lower than priority/important-longterm
+
+# ──────────────────────────────────────────────
+# triage/ — review state
+# ──────────────────────────────────────────────
+
+- name: triage/needs-triage
+  color: 'ededed'
+  description: Indicates an issue needs triage by a maintainer
+
+- name: triage/accepted
+  color: '0e8a16'
+  description: Indicates an issue is ready to be actively worked on
+
+- name: triage/needs-information
+  color: 'fbca04'
+  description: Indicates an issue needs more information in order to work on it
+
+- name: triage/not-reproducible
+  color: 'fbca04'
+  description: Indicates an issue can not be reproduced as described
+
+- name: triage/duplicate
+  color: 'cfd3d7'
+  description: Indicates an issue is a duplicate of another issue
+  aliases: ['duplicate']
+
+- name: triage/unresolved
+  color: 'cfd3d7'
+  description: Indicates an issue that can not or will not be resolved
+
+# ──────────────────────────────────────────────
+# lifecycle/ — issue or PR lifecycle
+# ──────────────────────────────────────────────
+
+- name: lifecycle/active
+  color: '1d76db'
+  description: Indicates that an issue or PR is actively being worked on by a contributor
+
+- name: lifecycle/frozen
+  color: 'db5dd6'
+  description: Indicates that an issue or PR should not be auto-closed due to staleness
+  aliases: ['frozen']
+
+- name: lifecycle/stale
+  color: 'dadada'
+  description: Denotes an issue or PR has remained open with no activity and has become stale
+  aliases: ['stale']
+
+- name: lifecycle/rotten
+  color: '795548'
+  description: Denotes an issue or PR that has aged beyond stale and will be auto-closed
+
+# ──────────────────────────────────────────────
+# area/ — subsystem (extensible)
+# Add a new area/* when there are 3+ open issues on the topic.
+# ──────────────────────────────────────────────
+
+- name: area/api
+  color: 'bfd4f2'
+  description: Issues or PRs related to the cozystack-api aggregated API server
+
+- name: area/ai
+  color: 'bfd4f2'
+  description: Issues or PRs related to AI agent guides, AGENTS.md, docs/agents/
+
+- name: area/build
+  color: 'bfd4f2'
+  description: Issues or PRs related to image build infrastructure, multi-arch support
+
+- name: area/ci
+  color: 'bfd4f2'
+  description: Issues or PRs related to CI workflows, GitHub Actions, automation
+
+- name: area/dashboard
+  color: 'bfd4f2'
+  description: Issues or PRs related to the dashboard / UI
+
+- name: area/extra
+  color: 'bfd4f2'
+  description: Issues or PRs related to tenant-specific modules (packages/extra/)
+
+- name: area/database
+  color: 'bfd4f2'
+  description: Issues or PRs related to managed databases (postgres, mariadb, redis, etcd, kafka, clickhouse)
+
+- name: area/kubernetes
+  color: 'bfd4f2'
+  description: Issues or PRs related to the tenant Kubernetes app
+
+- name: area/monitoring
+  color: 'bfd4f2'
+  description: Issues or PRs related to the monitoring stack (vlogs, vmstack, grafana, workloadmonitor)
+
+- name: area/networking
+  color: 'bfd4f2'
+  description: Issues or PRs related to networking (ingress, gateway, vpn, metallb, cilium, kube-ovn)
+
+- name: area/platform
+  color: 'bfd4f2'
+  description: Issues or PRs related to platform infrastructure (bundle, flux, talos, installer)
+
+- name: area/release
+  color: 'bfd4f2'
+  description: Issues or PRs related to release tooling (changelog, backport, release pipeline)
+
+- name: area/storage
+  color: 'bfd4f2'
+  description: Issues or PRs related to storage (linstor, seaweedfs, bucket, velero, harbor)
+
+- name: area/testing
+  color: 'bfd4f2'
+  description: Issues or PRs related to testing (e2e, bats, unit tests)
+
+- name: area/virtualization
+  color: 'bfd4f2'
+  description: Issues or PRs related to virtualization (kubevirt, cdi, vmi, vm-import)
+
+- name: area/uncategorized
+  color: 'fbca04'
+  description: PR auto-labeler could not map title scope to a known area/*; please review
+
+# ──────────────────────────────────────────────
+# do-not-merge/ — PR merge blockers (Prow convention)
+# ──────────────────────────────────────────────
+
+- name: do-not-merge/work-in-progress
+  color: 'e11d21'
+  description: Indicates that a PR should not merge because it is a work in progress
+  # Both legacy spellings collapse here. EndBug processes aliases sequentially;
+  # the second rename hits a name collision and logs a warning — the legacy
+  # label survives and gets cleaned up in the follow-up dedup PR.
+  aliases: ['do-not-merge', 'do not merge']
+
+- name: do-not-merge/hold
+  color: 'e11d21'
+  description: Indicates that a PR should not merge because someone has issued /hold
+
+# ──────────────────────────────────────────────
+# Cozystack-specific (preserved)
+# ──────────────────────────────────────────────
+
+- name: epic
+  color: 'A335EE'
+  description: A large development increment that brings definite value to Cozystack users
+
+- name: community
+  color: '97458A'
+  description: Community contributions are welcome in this issue
+
+- name: help wanted
+  color: '008672'
+  description: Extra attention is needed
+
+- name: good first issue
+  color: '7057ff'
+  description: Good for newcomers
+
+- name: quality-of-life
+  color: 'aaaaaa'
+  description: QoL improvements
+
+- name: upstream-issue
+  color: 'aaaaaa'
+  description: Requires resolving an issue in an upstream project
+
+- name: backport
+  color: 'FBCA04'
+  description: Should change be backported on previous release
+
+- name: backport-previous
+  color: 'fbd876'
+  description: Backport target — previous release line
+
+- name: release
+  color: 'aaaaaa'
+  description: Releasing a new Cozystack version
+
+- name: automated
+  color: 'ededed'
+  description: Created by automation
+
+- name: debug
+  color: '704479'
+  description: Debugging in progress
+
+- name: sponsored
+  color: '00FF00'
+  description: Sponsored work
+
+- name: lgtm
+  color: '238636'
+  description: This PR has been approved by a maintainer
+
+- name: ok-to-test
+  color: '00FF00'
+  description: Indicates a non-member PR is safe to run CI on
+
+# ──────────────────────────────────────────────
+# size: — PR size (auto-applied by sizing bot)
+# ──────────────────────────────────────────────
+
+- name: 'size:XS'
+  color: '00ff00'
+  description: This PR changes 0-9 lines, ignoring generated files
+
+- name: 'size:S'
+  color: '77b800'
+  description: This PR changes 10-29 lines, ignoring generated files
+
+- name: 'size:M'
+  color: 'ebb800'
+  description: This PR changes 30-99 lines, ignoring generated files
+
+- name: 'size:L'
+  color: 'eb9500'
+  description: This PR changes 100-499 lines, ignoring generated files
+
+- name: 'size:XL'
+  color: 'ff823f'
+  description: This PR changes 500-999 lines, ignoring generated files
+
+- name: 'size:XXL'
+  color: 'ffb8b8'
+  description: This PR changes 1000+ lines, ignoring generated files
+
+# ──────────────────────────────────────────────
+# security/ — security-finding severity and status
+# ──────────────────────────────────────────────
+
+- name: security
+  color: 'aaaaaa'
+  description: Security-related issues and features
+
+- name: security/critical
+  color: 'd73a4a'
+  description: Critical security vulnerability
+
+- name: security/high
+  color: 'e99695'
+  description: High severity security finding
+
+- name: security/medium
+  color: 'f9c513'
+  description: Medium severity security finding
+
+- name: security/low
+  color: '0e8a16'
+  description: Low severity security finding
+
+- name: security/triage-needed
+  color: 'fbca04'
+  description: Needs security triage
+
+- name: security/confirmed
+  color: '1d76db'
+  description: Confirmed vulnerability
+
+- name: security/false-positive
+  color: 'c5def5'
+  description: Triaged as false positive
+
+- name: security/accepted-risk
+  color: 'bfd4f2'
+  description: Risk accepted with justification
+
+- name: security/in-progress
+  color: '0075ca'
+  description: Fix in progress
+
+- name: security/fixed
+  color: '0e8a16'
+  description: Fix released
diff --git a/.github/workflows/labels.yaml b/.github/workflows/labels.yaml
new file mode 100644
index 00000000..69c18329
--- /dev/null
+++ b/.github/workflows/labels.yaml
@@ -0,0 +1,84 @@
+name: Labels
+
+on:
+  pull_request:
+    paths:
+      - .github/labels.yml
+      - .github/workflows/labels.yaml
+  push:
+    branches: [main]
+    paths:
+      - .github/labels.yml
+      - .github/workflows/labels.yaml
+  workflow_dispatch:
+  schedule:
+    - cron: '17 4 * * 1'  # Mondays at 04:17 UTC
+
+permissions:
+  contents: read
+
+concurrency:
+  group: labels-sync
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate labels.yml schema
+        run: |
+          python3 - <<'PY'
+          import re, sys, yaml
+
+          path = '.github/labels.yml'
+          data = yaml.safe_load(open(path))
+          errors = []
+
+          # 1. description ≤ 100 chars (GitHub REST API limit)
+          for label in data:
+              desc = label.get('description', '') or ''
+              if len(desc) > 100:
+                  errors.append(f"{label['name']}: description {len(desc)} chars (max 100)")
+
+          # 2. color is 6-char hex without leading #
+          for label in data:
+              color = label.get('color', '') or ''
+              if not re.match(r'^[0-9A-Fa-f]{6}$', color):
+                  errors.append(f"{label['name']}: bad color {color!r} (must be 6-char hex without #)")
+
+          # 3. unique top-level names
+          names = [label['name'] for label in data]
+          dups = sorted({n for n in names if names.count(n) > 1})
+          for n in dups:
+              errors.append(f"duplicate name: {n}")
+
+          # 4. aliases do not collide with any top-level name
+          name_set = set(names)
+          for label in data:
+              for alias in (label.get('aliases') or []):
+                  if alias in name_set:
+                      errors.append(f"alias {alias!r} (under {label['name']!r}) collides with a top-level name")
+
+          if errors:
+              for err in errors:
+                  print(f"::error::{err}")
+              sys.exit(1)
+
+          print(f"labels.yml schema OK ({len(data)} labels)")
+          PY
+
+  sync:
+    needs: validate
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: EndBug/label-sync@v2
+        with:
+          config-file: .github/labels.yml
+          delete-other-labels: false
diff --git a/.github/workflows/pr-labeler.yaml b/.github/workflows/pr-labeler.yaml
new file mode 100644
index 00000000..d882bc50
--- /dev/null
+++ b/.github/workflows/pr-labeler.yaml
@@ -0,0 +1,199 @@
+name: PR Auto-Label
+
+on:
+  pull_request_target:
+    types: [opened, edited, reopened, synchronize]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Apply labels from PR title
+        uses: actions/github-script@v7
+        with:
+          script: |
+            // Conventional Commits types accepted by Cozystack (per docs/agents/contributing.md):
+            //   feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert
+            // Mapping below maps a subset to kind/* — types not listed do not produce a kind/*.
+            const typeToKind = {
+              feat:     'kind/feature',
+              fix:      'kind/bug',
+              docs:     'kind/documentation',
+              chore:    'kind/cleanup',
+              refactor: 'kind/cleanup',
+              // style, perf, test, build, ci, revert — no kind mapping
+            };
+
+            // scope -> area/* mapping. Keys are the scopes observed in cozystack issues
+            // and PRs. Add new entries when a scope recurs (3+ times).
+            const scopeToArea = {
+              // area/api
+              'api':                 'area/api',
+              'cozystack-api':       'area/api',
+
+              // area/ai
+              'agents':              'area/ai',
+              'ai':                  'area/ai',
+
+              // area/build
+              'build':               'area/build',
+
+              // area/ci
+              'ci':                  'area/ci',
+
+              // area/dashboard
+              'dashboard':           'area/dashboard',
+
+              // area/database
+              'postgres':            'area/database',
+              'postgres-operator':   'area/database',
+              'mariadb':             'area/database',
+              'mariadb-operator':    'area/database',
+              'redis':               'area/database',
+              'etcd':                'area/database',
+              'kafka':               'area/database',
+              'clickhouse':          'area/database',
+
+              // area/extra
+              'extra':               'area/extra',
+
+              // area/kubernetes
+              'kubernetes':          'area/kubernetes',
+              'apps/kubernetes':     'area/kubernetes',
+
+              // area/monitoring
+              'monitoring':          'area/monitoring',
+              'vlogs':               'area/monitoring',
+              'vmstack':             'area/monitoring',
+              'grafana':             'area/monitoring',
+              'workloadmonitor':     'area/monitoring',
+
+              // area/networking
+              'ingress':             'area/networking',
+              'ingress-nginx':       'area/networking',
+              'gateway':             'area/networking',
+              'vpn':                 'area/networking',
+              'metallb':             'area/networking',
+              'cilium':              'area/networking',
+              'kube-ovn':            'area/networking',
+              'tcp-balancer':        'area/networking',
+              'securitygroups':      'area/networking',
+              'cozy-proxy':          'area/networking',
+
+              // area/platform
+              'platform':            'area/platform',
+              'bundle':              'area/platform',
+              'flux':                'area/platform',
+              'fluxcd':              'area/platform',
+              'cluster-api':         'area/platform',
+              'talos':               'area/platform',
+              'installer':           'area/platform',
+              'cozyctl':             'area/platform',
+              'cozystack-engine':    'area/platform',
+              'cozy-lib':            'area/platform',
+
+              // area/release
+              'backport':            'area/release',
+              'release':             'area/release',
+
+              // area/storage
+              'seaweedfs':           'area/storage',
+              'seaweedfs-cosi-driver': 'area/storage',
+              'bucket':              'area/storage',
+              'linstor':             'area/storage',
+              'velero':              'area/storage',
+              'harbor':              'area/storage',
+              'backups':             'area/storage',
+
+              // area/testing
+              'tests':               'area/testing',
+              'e2e':                 'area/testing',
+
+              // area/virtualization
+              'kubevirt':            'area/virtualization',
+              'cdi':                 'area/virtualization',
+              'vmi':                 'area/virtualization',
+              'vm-import':           'area/virtualization',
+              'virtual-machine':     'area/virtualization',
+              'hami':                'area/virtualization',
+              'gpu-operator':        'area/virtualization',
+            };
+
+            const pr = context.payload.pull_request;
+            const title = pr.title || '';
+            const body  = pr.body  || '';
+            const existing = new Set(pr.labels.map(l => l.name));
+            const toAdd = new Set();
+
+            // 1. Strip "[Backport release-1.x]" prefix if present.
+            const backportMatch = title.match(/^\[Backport ([^\]]+)\]\s+(.+)$/);
+            const cleanTitle = backportMatch ? backportMatch[2] : title;
+            if (backportMatch) {
+              toAdd.add('area/release');
+              toAdd.add('backport');
+            }
+
+            // 2. Try Conventional Commits form: type(scope)?(!)?: description
+            const conv = cleanTitle.match(/^([a-z]+)(?:\(([^)]+)\))?(!)?:\s*.+$/);
+            // 3. Fall back to bracket form: [scope] description
+            const bracket = !conv && cleanTitle.match(/^\[([^\]]+)\]\s+.+$/);
+
+            let type = null, scopeStr = null, breaking = false;
+            if (conv) {
+              type = conv[1];
+              scopeStr = conv[2] || null;
+              breaking = !!conv[3];
+            } else if (bracket) {
+              scopeStr = bracket[1];
+            }
+
+            // 4. Detect BREAKING CHANGE: footer in body.
+            if (/^BREAKING CHANGE:/m.test(body)) {
+              breaking = true;
+            }
+
+            // 5. Apply kind/* from type.
+            if (type && typeToKind[type]) {
+              toAdd.add(typeToKind[type]);
+            }
+
+            // 6. Apply area/* from scope. Composite scopes split on comma.
+            const scopes = (scopeStr || '')
+              .split(/,\s*/)
+              .map(s => s.trim())
+              .filter(Boolean);
+            for (const s of scopes) {
+              if (scopeToArea[s]) {
+                toAdd.add(scopeToArea[s]);
+              }
+            }
+
+            // 7. kind/breaking-change.
+            if (breaking) {
+              toAdd.add('kind/breaking-change');
+            }
+
+            // 8. Fallback: no area/* applied -> area/uncategorized.
+            const hasArea = [...toAdd].some(l => l.startsWith('area/'));
+            if (!hasArea) {
+              toAdd.add('area/uncategorized');
+            }
+
+            // 9. Additive only — never remove existing labels.
+            const newLabels = [...toAdd].filter(l => !existing.has(l));
+            if (newLabels.length === 0) {
+              core.info('No new labels to apply');
+              return;
+            }
+
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: pr.number,
+              labels: newLabels,
+            });
+            core.info(`Applied labels: ${newLabels.join(', ')}`);
diff --git a/.github/workflows/tags.yaml b/.github/workflows/tags.yaml
index 90f04829..1b68ee32 100644
--- a/.github/workflows/tags.yaml
+++ b/.github/workflows/tags.yaml
@@ -223,7 +223,7 @@ jobs:
                 repo:  context.repo.repo,
                 head,
                 base,
-                title: `Release v${version}`,
+                title: `chore(release): cut v${version}`,
                 body:  `This PR prepares the release \`v${version}\`.`,
                 draft: false
               });
@@ -411,7 +411,7 @@ jobs:
                 repo:  context.repo.repo,
                 head:  changelogBranch,
                 base:  baseBranch,
-                title: `docs: add changelog for v${version}`,
+                title: `docs(release): add changelog for v${version}`,
                 body:  `This PR adds the changelog for release \`v${version}\`.\n\n✅ Changelog has been automatically generated in \`docs/changelogs/v${version}.md\`.`,
                 draft: false
               });
@@ -421,7 +421,7 @@ jobs:
                 owner: context.repo.owner,
                 repo:  context.repo.repo,
                 issue_number: pr.data.number,
-                labels: ['documentation', 'automated']
+                labels: ['kind/documentation', 'automated']
               });
               
               console.log(`Created PR #${pr.data.number} for changelog`);
diff --git a/AGENTS.md b/AGENTS.md
index fe9aa8e1..5298f6fd 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -27,6 +27,12 @@ working with the **Cozystack** project.
   - Read: [`contributing.md`](./docs/agents/contributing.md)
   - Action: Read the file to understand git workflow, commit format, PR process
 
+- **Issue and PR labeling, triage** (e.g., "label this issue", "what label should I use", "triage this", "categorize")
+  - Read: [`.github/labels.yml`](./.github/labels.yml)
+  - Action: Use labels defined there. Conventions follow the Kubernetes scheme — `kind/*` (type), `area/*` (subsystem), `priority/*` (urgency), `triage/*` (review state), `lifecycle/*` (auto-close), `do-not-merge/*` (PR blockers), `security/*` (severity)
+  - For `area/*`: accuracy outweighs reuse. If no existing `area/*` truly fits the change, propose a new one via PR (extend `labels.yml` and the scope mapping in `pr-labeler.yaml`) — do not shoehorn the change into a wrong area. `area/uncategorized` is the auto-labeler fallback; treat it as a signal to pick a fit, create a new area, or correct the PR title
+  - PR titles: a Conventional Commits header (`type(scope): description`, types from [`contributing.md`](./docs/agents/contributing.md)) auto-applies `kind/*` and `area/*` via `.github/workflows/pr-labeler.yaml`. Append `!` (or add a `BREAKING CHANGE:` footer) to apply `kind/breaking-change`
+
 **Important rules:**
 - ✅ **ONLY read the file if the task matches the documented process scope** - do not read files for tasks that don't match their purpose
 - ✅ **ALWAYS read the file FIRST** before starting the task (when applicable)
diff --git a/docs/agents/contributing.md b/docs/agents/contributing.md
index 658dab74..6ff6eef1 100644
--- a/docs/agents/contributing.md
+++ b/docs/agents/contributing.md
@@ -57,6 +57,49 @@ git commit --signoff -m "fix(postgres): update operator to version 1.2.3"
 git commit --signoff -m "docs(contributing): add installation guide"
 ```
 
+## PR Title Auto-Labeling
+
+`.github/workflows/pr-labeler.yaml` parses the PR title on `opened`, `edited`, `reopened`, and `synchronize` events and applies labels additively (never removes). The title is expected to follow Conventional Commits — same format as commit messages above.
+
+**Type → `kind/*`:**
+
+| type      | label              |
+| --------- | ------------------ |
+| feat      | kind/feature       |
+| fix       | kind/bug           |
+| docs      | kind/documentation |
+| chore     | kind/cleanup       |
+| refactor  | kind/cleanup       |
+| style, perf, test, build, ci, revert | (no kind label)|
+
+**Scope → `area/*`** (full mapping in `.github/workflows/pr-labeler.yaml`):
+
+| scope (examples) | label |
+| --- | --- |
+| agents, ai | area/ai |
+| api, cozystack-api | area/api |
+| build | area/build |
+| ci | area/ci |
+| dashboard | area/dashboard |
+| postgres, mariadb, redis, etcd, kafka, clickhouse, postgres-operator, mariadb-operator | area/database |
+| extra | area/extra |
+| kubernetes | area/kubernetes |
+| monitoring, vlogs, vmstack, grafana, workloadmonitor | area/monitoring |
+| ingress, gateway, vpn, metallb, cilium, kube-ovn, cozy-proxy, … | area/networking |
+| platform, bundle, flux, fluxcd, cluster-api, talos, installer, cozyctl, cozystack-engine, cozy-lib | area/platform |
+| backport, release | area/release |
+| seaweedfs, bucket, linstor, velero, harbor, backups | area/storage |
+| tests, e2e | area/testing |
+| kubevirt, cdi, vmi, vm-import, virtual-machine, hami, gpu-operator | area/virtualization |
+
+**Special handling:**
+
+- `[Backport release-1.x]` prefix is stripped before parsing; `area/release` and `backport` labels are added.
+- Composite scope (`feat(platform, system, apps): …`) — each comma-separated part is mapped independently.
+- `!` after type or `BREAKING CHANGE:` footer in the body → `kind/breaking-change`.
+- Unmapped scope or non-conventional title → `area/uncategorized` (signals the PR needs manual area selection).
+- Bracket-style fallback (`[scope] description`) maps `scope` → `area/*` but cannot infer `kind/*`.
+
 ### AI Agent Attribution
 
 When an AI agent authors or materially assists with a commit, add an `Assisted-By:` trailer naming the model:

From 91188702a678c445bf42dafcbc3b697b1377b086 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 27 Apr 2026 03:30:09 +0300
Subject: [PATCH 613/666] chore(ci): normalize hex color case in labels.yml

Address review feedback from gemini-code-assist on .github/labels.yml:242:
all hex color values use lowercase characters for consistency.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .github/labels.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/labels.yml b/.github/labels.yml
index 1369aa48..2ce04130 100644
--- a/.github/labels.yml
+++ b/.github/labels.yml
@@ -239,11 +239,11 @@
 # ──────────────────────────────────────────────
 
 - name: epic
-  color: 'A335EE'
+  color: 'a335ee'
   description: A large development increment that brings definite value to Cozystack users
 
 - name: community
-  color: '97458A'
+  color: '97458a'
   description: Community contributions are welcome in this issue
 
 - name: help wanted
@@ -263,7 +263,7 @@
   description: Requires resolving an issue in an upstream project
 
 - name: backport
-  color: 'FBCA04'
+  color: 'fbca04'
   description: Should change be backported on previous release
 
 - name: backport-previous
@@ -283,7 +283,7 @@
   description: Debugging in progress
 
 - name: sponsored
-  color: '00FF00'
+  color: '00ff00'
   description: Sponsored work
 
 - name: lgtm
@@ -291,7 +291,7 @@
   description: This PR has been approved by a maintainer
 
 - name: ok-to-test
-  color: '00FF00'
+  color: '00ff00'
   description: Indicates a non-member PR is safe to run CI on
 
 # ──────────────────────────────────────────────

From 31f4435eb0d02f905b6d0ba2f06c22034fc437d9 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 27 Apr 2026 03:30:29 +0300
Subject: [PATCH 614/666] docs(agents): replace Unicode ellipsis with ASCII in
 contributing.md
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Address review feedback from gemini-code-assist on docs/agents/contributing.md:88:
… replaced with ... for compatibility across editors and tools.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 docs/agents/contributing.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/agents/contributing.md b/docs/agents/contributing.md
index 6ff6eef1..ac6aaf90 100644
--- a/docs/agents/contributing.md
+++ b/docs/agents/contributing.md
@@ -85,7 +85,7 @@ git commit --signoff -m "docs(contributing): add installation guide"
 | extra | area/extra |
 | kubernetes | area/kubernetes |
 | monitoring, vlogs, vmstack, grafana, workloadmonitor | area/monitoring |
-| ingress, gateway, vpn, metallb, cilium, kube-ovn, cozy-proxy, … | area/networking |
+| ingress, gateway, vpn, metallb, cilium, kube-ovn, cozy-proxy, ... | area/networking |
 | platform, bundle, flux, fluxcd, cluster-api, talos, installer, cozyctl, cozystack-engine, cozy-lib | area/platform |
 | backport, release | area/release |
 | seaweedfs, bucket, linstor, velero, harbor, backups | area/storage |
@@ -95,7 +95,7 @@ git commit --signoff -m "docs(contributing): add installation guide"
 **Special handling:**
 
 - `[Backport release-1.x]` prefix is stripped before parsing; `area/release` and `backport` labels are added.
-- Composite scope (`feat(platform, system, apps): …`) — each comma-separated part is mapped independently.
+- Composite scope (`feat(platform, system, apps): ...`) — each comma-separated part is mapped independently.
 - `!` after type or `BREAKING CHANGE:` footer in the body → `kind/breaking-change`.
 - Unmapped scope or non-conventional title → `area/uncategorized` (signals the PR needs manual area selection).
 - Bracket-style fallback (`[scope] description`) maps `scope` → `area/*` but cannot infer `kind/*`.

From 10b98ceb62308808aefbaa1ebdd4b1f07d713779 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 27 Apr 2026 03:30:43 +0300
Subject: [PATCH 615/666] docs(agents): use full path .github/labels.yml in
 AGENTS.md

Address review feedback from gemini-code-assist on AGENTS.md:33:
expand bare labels.yml and pr-labeler.yaml to .github/labels.yml and
.github/workflows/pr-labeler.yaml for consistency with surrounding refs.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 AGENTS.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/AGENTS.md b/AGENTS.md
index 5298f6fd..1e9c4d15 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -30,7 +30,7 @@ working with the **Cozystack** project.
 - **Issue and PR labeling, triage** (e.g., "label this issue", "what label should I use", "triage this", "categorize")
   - Read: [`.github/labels.yml`](./.github/labels.yml)
   - Action: Use labels defined there. Conventions follow the Kubernetes scheme — `kind/*` (type), `area/*` (subsystem), `priority/*` (urgency), `triage/*` (review state), `lifecycle/*` (auto-close), `do-not-merge/*` (PR blockers), `security/*` (severity)
-  - For `area/*`: accuracy outweighs reuse. If no existing `area/*` truly fits the change, propose a new one via PR (extend `labels.yml` and the scope mapping in `pr-labeler.yaml`) — do not shoehorn the change into a wrong area. `area/uncategorized` is the auto-labeler fallback; treat it as a signal to pick a fit, create a new area, or correct the PR title
+  - For `area/*`: accuracy outweighs reuse. If no existing `area/*` truly fits the change, propose a new one via PR (extend `.github/labels.yml` and the scope mapping in `.github/workflows/pr-labeler.yaml`) — do not shoehorn the change into a wrong area. `area/uncategorized` is the auto-labeler fallback; treat it as a signal to pick a fit, create a new area, or correct the PR title
   - PR titles: a Conventional Commits header (`type(scope): description`, types from [`contributing.md`](./docs/agents/contributing.md)) auto-applies `kind/*` and `area/*` via `.github/workflows/pr-labeler.yaml`. Append `!` (or add a `BREAKING CHANGE:` footer) to apply `kind/breaking-change`
 
 **Important rules:**

From 738762994e10f878cab27a685a5dbf116ccc43fd Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 27 Apr 2026 03:30:52 +0300
Subject: [PATCH 616/666] docs(agents): fix markdown table cell spacing in
 contributing.md

Address review feedback from gemini-code-assist on docs/agents/contributing.md:73:
add space before closing pipe in the type to kind mapping table for
consistency with other rows.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 docs/agents/contributing.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/agents/contributing.md b/docs/agents/contributing.md
index ac6aaf90..d2ff94e2 100644
--- a/docs/agents/contributing.md
+++ b/docs/agents/contributing.md
@@ -70,7 +70,7 @@ git commit --signoff -m "docs(contributing): add installation guide"
 | docs      | kind/documentation |
 | chore     | kind/cleanup       |
 | refactor  | kind/cleanup       |
-| style, perf, test, build, ci, revert | (no kind label)|
+| style, perf, test, build, ci, revert | (no kind label) |
 
 **Scope → `area/*`** (full mapping in `.github/workflows/pr-labeler.yaml`):
 

From 104b3b3d2b1c25cc06a86669238cad3b744c86d3 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 20 Apr 2026 18:43:02 +0300
Subject: [PATCH 617/666] feat(operator): add per-package upgradeCRDs policy
 for HelmRelease

Add an opt-in UpgradeCRDs field to ComponentInstall that maps to
HelmRelease.Spec.Upgrade.CRDs, allowing a PackageSource component to
declare how Flux should handle CRDs from the chart's crds/ directory
on upgrade.

The helm-controller default on upgrade is Skip, which means new CRDs
added between chart versions never reach existing clusters and must be
applied manually. Setting upgradeCRDs: CreateReplace makes Flux apply
new CRDs declaratively with the chart.

Allowed values are restricted to Skip, Create, CreateReplace via a
kubebuilder enum marker. Empty / unset preserves the existing Flux
default, so all existing PackageSource resources keep working.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 api/v1alpha1/packagesource_types.go           |  10 ++
 .../cozystack.io_packagesources.yaml          |  13 ++
 internal/operator/package_reconciler.go       |  11 ++
 internal/operator/package_reconciler_test.go  | 138 ++++++++++++++++++
 4 files changed, 172 insertions(+)
 create mode 100644 internal/operator/package_reconciler_test.go

diff --git a/api/v1alpha1/packagesource_types.go b/api/v1alpha1/packagesource_types.go
index c0b943e8..75bf217b 100644
--- a/api/v1alpha1/packagesource_types.go
+++ b/api/v1alpha1/packagesource_types.go
@@ -132,6 +132,16 @@ type ComponentInstall struct {
 	// DependsOn is a list of component names that must be installed before this component
 	// +optional
 	DependsOn []string `json:"dependsOn,omitempty"`
+
+	// UpgradeCRDs controls how CRDs from the chart's crds/ directory are
+	// handled on HelmRelease upgrades. Maps to HelmRelease.Spec.Upgrade.CRDs.
+	// Empty string (default) preserves the helm-controller default (Skip).
+	// Use "CreateReplace" for operators that evolve their CRD set between
+	// versions. Warning: CreateReplace overwrites CRDs and may cause data
+	// loss if upstream drops fields from a CRD with live objects.
+	// +optional
+	// +kubebuilder:validation:Enum=Skip;Create;CreateReplace
+	UpgradeCRDs string `json:"upgradeCRDs,omitempty"`
 }
 
 // Component defines a single Helm release component within a package source
diff --git a/internal/crdinstall/manifests/cozystack.io_packagesources.yaml b/internal/crdinstall/manifests/cozystack.io_packagesources.yaml
index 0acfcdd2..1d0037df 100644
--- a/internal/crdinstall/manifests/cozystack.io_packagesources.yaml
+++ b/internal/crdinstall/manifests/cozystack.io_packagesources.yaml
@@ -118,6 +118,19 @@ spec:
                                   ReleaseName is the name of the HelmRelease resource that will be created
                                   If not specified, defaults to the component Name field
                                 type: string
+                              upgradeCRDs:
+                                description: |-
+                                  UpgradeCRDs controls how CRDs from the chart's crds/ directory are
+                                  handled on HelmRelease upgrades. Maps to HelmRelease.Spec.Upgrade.CRDs.
+                                  Empty string (default) preserves the helm-controller default (Skip).
+                                  Use "CreateReplace" for operators that evolve their CRD set between
+                                  versions. Warning: CreateReplace overwrites CRDs and may cause data
+                                  loss if upstream drops fields from a CRD with live objects.
+                                enum:
+                                - Skip
+                                - Create
+                                - CreateReplace
+                                type: string
                             type: object
                           libraries:
                             description: |-
diff --git a/internal/operator/package_reconciler.go b/internal/operator/package_reconciler.go
index 32e667e4..0e724e49 100644
--- a/internal/operator/package_reconciler.go
+++ b/internal/operator/package_reconciler.go
@@ -45,6 +45,16 @@ const (
 	SecretCozystackValues = "cozystack-values"
 )
 
+// parseCRDPolicy maps ComponentInstall.UpgradeCRDs to a helmv2.CRDsPolicy.
+// Empty / nil preserves the helm-controller default (Skip on upgrade);
+// the CRD enum marker restricts the string to Skip/Create/CreateReplace.
+func parseCRDPolicy(install *cozyv1alpha1.ComponentInstall) helmv2.CRDsPolicy {
+	if install == nil || install.UpgradeCRDs == "" {
+		return ""
+	}
+	return helmv2.CRDsPolicy(install.UpgradeCRDs)
+}
+
 // PackageReconciler reconciles Package resources
 type PackageReconciler struct {
 	client.Client
@@ -221,6 +231,7 @@ func (r *PackageReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
 					Remediation: &helmv2.UpgradeRemediation{
 						Retries: -1,
 					},
+					CRDs: parseCRDPolicy(component.Install),
 				},
 			},
 		}
diff --git a/internal/operator/package_reconciler_test.go b/internal/operator/package_reconciler_test.go
new file mode 100644
index 00000000..f0ee2c19
--- /dev/null
+++ b/internal/operator/package_reconciler_test.go
@@ -0,0 +1,138 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package operator
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+	helmv2 "github.com/fluxcd/helm-controller/api/v2"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	"sigs.k8s.io/yaml"
+)
+
+func TestParseCRDPolicy(t *testing.T) {
+	tests := []struct {
+		name    string
+		install *cozyv1alpha1.ComponentInstall
+		want    helmv2.CRDsPolicy
+	}{
+		{
+			name:    "nil install leaves flux default",
+			install: nil,
+			want:    "",
+		},
+		{
+			name:    "empty upgradeCRDs leaves flux default",
+			install: &cozyv1alpha1.ComponentInstall{},
+			want:    "",
+		},
+		{
+			name:    "Skip is passed through",
+			install: &cozyv1alpha1.ComponentInstall{UpgradeCRDs: "Skip"},
+			want:    helmv2.Skip,
+		},
+		{
+			name:    "Create is passed through",
+			install: &cozyv1alpha1.ComponentInstall{UpgradeCRDs: "Create"},
+			want:    helmv2.Create,
+		},
+		{
+			name:    "CreateReplace is passed through",
+			install: &cozyv1alpha1.ComponentInstall{UpgradeCRDs: "CreateReplace"},
+			want:    helmv2.CreateReplace,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := parseCRDPolicy(tc.install)
+			if got != tc.want {
+				t.Errorf("parseCRDPolicy() = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+// TestPackageSourceCRDHasUpgradeCRDsEnum guards the generated CRD schema: the
+// invalid-value case from the spec is enforced at the API server via a
+// kubebuilder enum marker, not in the reconciler. If someone drops the marker
+// and forgets to regenerate, this test catches it.
+func TestPackageSourceCRDHasUpgradeCRDsEnum(t *testing.T) {
+	path := filepath.Join("..", "crdinstall", "manifests", "cozystack.io_packagesources.yaml")
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read %s: %v", path, err)
+	}
+
+	var crd apiextensionsv1.CustomResourceDefinition
+	if err := yaml.Unmarshal(data, &crd); err != nil {
+		t.Fatalf("unmarshal CRD: %v", err)
+	}
+
+	var field *apiextensionsv1.JSONSchemaProps
+	for i := range crd.Spec.Versions {
+		v := &crd.Spec.Versions[i]
+		if v.Schema == nil || v.Schema.OpenAPIV3Schema == nil {
+			continue
+		}
+		spec, ok := v.Schema.OpenAPIV3Schema.Properties["spec"]
+		if !ok {
+			continue
+		}
+		variants, ok := spec.Properties["variants"]
+		if !ok || variants.Items == nil || variants.Items.Schema == nil {
+			continue
+		}
+		components, ok := variants.Items.Schema.Properties["components"]
+		if !ok || components.Items == nil || components.Items.Schema == nil {
+			continue
+		}
+		install, ok := components.Items.Schema.Properties["install"]
+		if !ok {
+			continue
+		}
+		f, ok := install.Properties["upgradeCRDs"]
+		if !ok {
+			continue
+		}
+		field = &f
+		break
+	}
+
+	if field == nil {
+		t.Fatal("upgradeCRDs field not found in PackageSource CRD schema")
+	}
+
+	got := map[string]bool{}
+	for _, e := range field.Enum {
+		var s string
+		if err := json.Unmarshal(e.Raw, &s); err != nil {
+			t.Fatalf("unmarshal enum value %q: %v", e.Raw, err)
+		}
+		got[s] = true
+	}
+
+	for _, want := range []string{"Skip", "Create", "CreateReplace"} {
+		if !got[want] {
+			t.Errorf("enum value %q missing from upgradeCRDs; got %v", want, got)
+		}
+	}
+}

From d86bc7760a77c93c6fd837ef5e23c3df3b9b5898 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 20 Apr 2026 18:43:18 +0300
Subject: [PATCH 618/666] docs(agents): document PackageSource upgradeCRDs
 field

Describe when to set upgradeCRDs: CreateReplace (operators that evolve
their CRD set additively between versions) and the data-loss risk of
enabling it on operators that drop fields.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 docs/agents/overview.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/docs/agents/overview.md b/docs/agents/overview.md
index 35798961..ae0fd1c4 100644
--- a/docs/agents/overview.md
+++ b/docs/agents/overview.md
@@ -83,6 +83,14 @@ packages/<category>/<package-name>/
 - Reference PR numbers when available
 - Keep commits atomic and focused
 
+### PackageSource CRD upgrade policy
+
+Each component in a `PackageSource` may set `install.upgradeCRDs` to control how CRDs from the chart's `crds/` directory are handled on `HelmRelease` upgrades. Allowed values: `Skip` (default — helm-controller does not touch CRDs on upgrade), `Create` (create new CRDs only), `CreateReplace` (create new and overwrite existing).
+
+Set `upgradeCRDs: CreateReplace` for operators whose upstream regularly adds new CRDs between versions (etcd-operator, cnpg, kubevirt, kamaji). Without it, new CRDs from a chart bump do not land on existing clusters — only fresh installs get them.
+
+Do **not** set `CreateReplace` blindly: it overwrites every CRD in `crds/` and can cause silent data loss if upstream drops a field from a CRD that has live objects. Only enable it for operators whose schema evolution is additive-only. When in doubt, leave it unset and apply new CRDs manually.
+
 ### Documentation
 
 Documentation is organized as follows:

From f527ce683b28401c62cdc420188392b32367401f Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 20 Apr 2026 19:08:11 +0300
Subject: [PATCH 619/666] docs(agents): clarify that Scopes list is
 illustrative

The Scopes section was read as an exhaustive enumeration, which led to
review feedback flagging any scope outside the list as invalid. The
intent has always been that contributors pick the most specific scope
for the change and extend the list when a genuinely new area appears.
Reword the section accordingly and add operator as an example scope.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 docs/agents/contributing.md | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/docs/agents/contributing.md b/docs/agents/contributing.md
index 658dab74..9f3ff779 100644
--- a/docs/agents/contributing.md
+++ b/docs/agents/contributing.md
@@ -43,10 +43,11 @@ git commit --signoff -m "type(scope): brief description"
 
 **Types:** `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `build`, `ci`, `chore`
 
-**Scopes** (e.g., not exhaustive — use any scope that names the component you are touching):
-- System: `dashboard`, `platform`, `cilium`, `kube-ovn`, `linstor`, `fluxcd`, `cluster-api`
-- Apps: `postgres`, `mariadb`, `redis`, `kafka`, `clickhouse`, `virtual-machine`, `kubernetes`
-- Other: `api`, `hack`, `tests`, `ci`, `docs`, `agents`, `maintenance`
+**Scopes** (examples — not an exhaustive list; pick the most specific scope that describes the change, and introduce a new one if a genuinely new area needs its own):
+
+- System, e.g.: `dashboard`, `platform`, `operator`, `cilium`, `kube-ovn`, `linstor`, `fluxcd`, `cluster-api`
+- Apps, e.g.: `postgres`, `mariadb`, `redis`, `kafka`, `clickhouse`, `virtual-machine`, `kubernetes`
+- Other, e.g.: `api`, `hack`, `tests`, `ci`, `docs`, `agents`, `maintenance`
 
 Breaking changes: append `!` after type/scope (`feat(api)!: ...`) or add a `BREAKING CHANGE:` footer.
 

From 32ae993d3ebb51a34ece2b6bbe8e6626c72ac300 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 20 Apr 2026 19:13:06 +0300
Subject: [PATCH 620/666] docs(maintenance): mirror illustrative-scopes wording
 in PR template

Match the wording adopted in docs/agents/contributing.md so that human
contributors and AI agents see the same guidance in both places.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .github/PULL_REQUEST_TEMPLATE.md | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index b9475846..044dd6a0 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -1,9 +1,10 @@
 <!-- Thank you for making a contribution! Here are some tips for you:
 - Use Conventional Commits for the PR title: `type(scope): description`
   - Types: feat, fix, docs, style, refactor, perf, test, build, ci, chore
-  - Scopes for system components: dashboard, platform, cilium, kube-ovn, linstor, fluxcd, cluster-api
-  - Scopes for managed apps: postgres, mariadb, redis, kafka, clickhouse, virtual-machine, kubernetes
-  - Scopes for development and maintenance: api, hack, tests, ci, docs, maintenance
+  - Scopes are not an exhaustive list — pick the most specific scope for the change and extend the list when a genuinely new area appears. Examples:
+    - System components: dashboard, platform, operator, cilium, kube-ovn, linstor, fluxcd, cluster-api
+    - Managed apps: postgres, mariadb, redis, kafka, clickhouse, virtual-machine, kubernetes
+    - Development and maintenance: api, hack, tests, ci, docs, maintenance
   - Breaking changes: append `!` after type/scope (`feat(api)!: ...`) or add a `BREAKING CHANGE:` footer
 - If it's a work in progress, consider creating this PR as a draft.
 - Don't hesistate to ask for opinion and review in the community chats, even if it's still a draft.

From 27225f9e8337ae9f11473273aa1939b04cd68a9e Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Mon, 27 Apr 2026 12:46:20 +0300
Subject: [PATCH 621/666] fix(monitoring): use node-level GPU metrics instead
 of namespace-level

DCGM exporter metrics carry the exporter's own namespace
(cozy-gpu-operator), not the workload namespace. Recording rules that
filtered namespace!~"cozy-.*" silently dropped all DCGM series,
producing empty dashboard panels.

Replace namespace-level hardware aggregations with node-level
equivalents (grouped by Hostname), keep namespace-level allocation
rules that use kube_pod_container_resource_requests (which carries the
real workload namespace), and rename pod-level efficiency rules to
gpu-level since DCGM cannot attribute hardware metrics to individual
pods.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-efficiency.json            |  68 +++---
 dashboards/gpu/gpu-performance.json           |  12 +-
 dashboards/gpu/gpu-tenants.json               | 202 +++---------------
 .../alerts/gpu-recording.rules.yaml           |  94 ++++----
 4 files changed, 110 insertions(+), 266 deletions(-)

diff --git a/dashboards/gpu/gpu-efficiency.json b/dashboards/gpu/gpu-efficiency.json
index 3bd59bc0..f351c964 100644
--- a/dashboards/gpu/gpu-efficiency.json
+++ b/dashboards/gpu/gpu-efficiency.json
@@ -35,12 +35,12 @@
       "id": 2,
       "targets": [
         {
-          "expr": "avg(pod:tensor_saturation:avg5m{namespace=~\"$namespace\"}) * 100",
+          "expr": "avg(gpu:tensor_saturation:avg5m) * 100",
           "refId": "A"
         }
       ],
       "title": "Avg Tensor Saturation",
-      "description": "Mean tensor core saturation across selected namespaces. \u003c10% means GPUs are used inefficiently (tenants could move to CPU or optimize their code).",
+      "description": "Mean tensor core saturation across all GPUs. \u003c10% means GPUs are used inefficiently (workloads could move to CPU or optimize their code). Cluster-wide — DCGM metrics cannot be attributed to workload namespaces.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -103,12 +103,12 @@
       "id": 3,
       "targets": [
         {
-          "expr": "avg(pod:util_per_watt:avg5m{namespace=~\"$namespace\"})",
+          "expr": "avg(gpu:util_per_watt:avg5m)",
           "refId": "A"
         }
       ],
       "title": "Avg Utilization per Watt",
-      "description": "NVML utilization % per watt across selected namespaces. Higher value = more efficient workload.",
+      "description": "NVML utilization % per watt across all GPUs. Higher value = more efficient workload. Cluster-wide — DCGM metrics cannot be attributed to workload namespaces.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -242,13 +242,13 @@
       "id": 11,
       "targets": [
         {
-          "expr": "DCGM_FI_DEV_GPU_UTIL{namespace=~\"$namespace\", namespace!=\"\"}",
-          "legendFormat": "{{namespace}}/{{pod}}",
+          "expr": "DCGM_FI_DEV_GPU_UTIL",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
           "refId": "A"
         }
       ],
       "title": "NVML GPU Utilization",
-      "description": "Classic utilization metric. Shows activity of any engine (SM, copy, encoder).",
+      "description": "Classic utilization metric. Shows activity of any engine (SM, copy, encoder). Cluster-wide — DCGM namespace is the exporter's own namespace, not the workload namespace.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -296,13 +296,13 @@
       "id": 12,
       "targets": [
         {
-          "expr": "DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{namespace=~\"$namespace\", namespace!=\"\"} * 100",
-          "legendFormat": "{{namespace}}/{{pod}}",
+          "expr": "DCGM_FI_PROF_PIPE_TENSOR_ACTIVE * 100",
+          "legendFormat": "{{Hostname}}/{{gpu}}",
           "refId": "A"
         }
       ],
       "title": "Tensor Pipe Active",
-      "description": "Real tensor core load (HMMA). For AI/LLM inference it should be ≥20%, otherwise the workload is unoptimized.",
+      "description": "Real tensor core load (HMMA). For AI/LLM inference it should be ≥20%, otherwise the workload is unoptimized. Cluster-wide — DCGM namespace is the exporter's own namespace, not the workload namespace.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -348,7 +348,7 @@
     {
       "type": "row",
       "collapsed": false,
-      "title": "Per-pod ranking",
+      "title": "Per-GPU ranking",
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -363,15 +363,15 @@
       "id": 21,
       "targets": [
         {
-          "expr": "topk(20, pod:tensor_saturation:avg5m{namespace=~\"$namespace\"} * 100)",
+          "expr": "topk(20, gpu:tensor_saturation:avg5m * 100)",
           "instant": true,
           "range": false,
           "format": "table",
           "refId": "A"
         }
       ],
-      "title": "Tensor Saturation per pod (5m avg)",
-      "description": "Who is exercising tensor cores and who is not. Sorted descending.",
+      "title": "Tensor Saturation per GPU (5m avg)",
+      "description": "Which GPUs are exercising tensor cores and which are not. Sorted descending. Grouped by Hostname/gpu/UUID — DCGM metrics cannot be attributed to workload namespaces.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -390,20 +390,19 @@
           "options": {
             "excludeByName": {
               "DCGM_FI_DRIVER_VERSION": true,
-              "Hostname": true,
               "Time": true,
-              "UUID": true,
               "__name__": true,
               "cluster": true,
               "container": true,
               "device": true,
               "endpoint": true,
-              "gpu": true,
               "gpu_driver_version": true,
               "instance": true,
               "job": true,
               "modelName": true,
+              "namespace": true,
               "pci_bus_id": true,
+              "pod": true,
               "prometheus": true,
               "service": true,
               "tenant": true,
@@ -412,14 +411,16 @@
               "unit": true
             },
             "indexByName": {
-              "Value": 2,
-              "namespace": 0,
-              "pod": 1
+              "Hostname": 0,
+              "UUID": 2,
+              "Value": 3,
+              "gpu": 1
             },
             "renameByName": {
+              "Hostname": "Node",
+              "UUID": "UUID",
               "Value": "Saturation",
-              "namespace": "Namespace",
-              "pod": "Pod"
+              "gpu": "GPU"
             }
           }
         }
@@ -501,15 +502,15 @@
       "id": 22,
       "targets": [
         {
-          "expr": "topk(20, pod:util_per_watt:avg5m{namespace=~\"$namespace\"})",
+          "expr": "topk(20, gpu:util_per_watt:avg5m)",
           "instant": true,
           "range": false,
           "format": "table",
           "refId": "A"
         }
       ],
-      "title": "Utilization / Watt per pod (5m avg)",
-      "description": "How efficiently each pod spends watts. Low value = poor optimization.",
+      "title": "Utilization / Watt per GPU (5m avg)",
+      "description": "How efficiently each GPU spends watts. Low value = poor optimization. Grouped by Hostname/gpu/UUID — DCGM metrics cannot be attributed to workload namespaces.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -528,20 +529,19 @@
           "options": {
             "excludeByName": {
               "DCGM_FI_DRIVER_VERSION": true,
-              "Hostname": true,
               "Time": true,
-              "UUID": true,
               "__name__": true,
               "cluster": true,
               "container": true,
               "device": true,
               "endpoint": true,
-              "gpu": true,
               "gpu_driver_version": true,
               "instance": true,
               "job": true,
               "modelName": true,
+              "namespace": true,
               "pci_bus_id": true,
+              "pod": true,
               "prometheus": true,
               "service": true,
               "tenant": true,
@@ -550,14 +550,16 @@
               "unit": true
             },
             "indexByName": {
-              "Value": 2,
-              "namespace": 0,
-              "pod": 1
+              "Hostname": 0,
+              "UUID": 2,
+              "Value": 3,
+              "gpu": 1
             },
             "renameByName": {
+              "Hostname": "Node",
+              "UUID": "UUID",
               "Value": "Util/Watt",
-              "namespace": "Namespace",
-              "pod": "Pod"
+              "gpu": "GPU"
             }
           }
         }
diff --git a/dashboards/gpu/gpu-performance.json b/dashboards/gpu/gpu-performance.json
index e581a76b..f9951577 100644
--- a/dashboards/gpu/gpu-performance.json
+++ b/dashboards/gpu/gpu-performance.json
@@ -273,7 +273,7 @@
       "id": 11,
       "targets": [
         {
-          "expr": "DCGM_FI_DEV_GPU_UTIL{Hostname=~\"$Hostname\", namespace=~\"$namespace\"}",
+          "expr": "DCGM_FI_DEV_GPU_UTIL{Hostname=~\"$Hostname\"}",
           "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
           "refId": "A"
         }
@@ -327,7 +327,7 @@
       "id": 12,
       "targets": [
         {
-          "expr": "DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{Hostname=~\"$Hostname\", namespace=~\"$namespace\"} * 100",
+          "expr": "DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{Hostname=~\"$Hostname\"} * 100",
           "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
           "refId": "A"
         }
@@ -381,7 +381,7 @@
       "id": 13,
       "targets": [
         {
-          "expr": "DCGM_FI_PROF_GR_ENGINE_ACTIVE{Hostname=~\"$Hostname\", namespace=~\"$namespace\"} * 100",
+          "expr": "DCGM_FI_PROF_GR_ENGINE_ACTIVE{Hostname=~\"$Hostname\"} * 100",
           "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
           "refId": "A"
         }
@@ -435,7 +435,7 @@
       "id": 14,
       "targets": [
         {
-          "expr": "DCGM_FI_DEV_MEM_COPY_UTIL{Hostname=~\"$Hostname\", namespace=~\"$namespace\"}",
+          "expr": "DCGM_FI_DEV_MEM_COPY_UTIL{Hostname=~\"$Hostname\"}",
           "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
           "refId": "A"
         }
@@ -502,7 +502,7 @@
       "id": 21,
       "targets": [
         {
-          "expr": "DCGM_FI_DEV_FB_USED{Hostname=~\"$Hostname\", namespace=~\"$namespace\"} * 1048576",
+          "expr": "DCGM_FI_DEV_FB_USED{Hostname=~\"$Hostname\"} * 1048576",
           "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
           "refId": "A"
         }
@@ -553,7 +553,7 @@
       "id": 22,
       "targets": [
         {
-          "expr": "DCGM_FI_DEV_FB_FREE{Hostname=~\"$Hostname\", namespace=~\"$namespace\"} * 1048576",
+          "expr": "DCGM_FI_DEV_FB_FREE{Hostname=~\"$Hostname\"} * 1048576",
           "legendFormat": "{{Hostname}}/{{gpu}}",
           "refId": "A"
         }
diff --git a/dashboards/gpu/gpu-tenants.json b/dashboards/gpu/gpu-tenants.json
index d0265c0d..e2c400a8 100644
--- a/dashboards/gpu/gpu-tenants.json
+++ b/dashboards/gpu/gpu-tenants.json
@@ -147,12 +147,12 @@
       "id": 4,
       "targets": [
         {
-          "expr": "avg(namespace:gpu_util:avg{namespace=~\"$namespace\"})",
+          "expr": "cluster:gpu_util:avg",
           "refId": "A"
         }
       ],
-      "title": "Avg tenant util",
-      "description": "Average NVML utilization across all tenant GPUs.",
+      "title": "Avg cluster GPU util",
+      "description": "Average NVML utilization across all GPUs in the cluster. Cluster-wide — DCGM hardware metrics cannot be attributed to workload namespaces.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -211,12 +211,12 @@
       "id": 5,
       "targets": [
         {
-          "expr": "sum(namespace:power_watts:sum{namespace=~\"$namespace\"})",
+          "expr": "cluster:gpu_power_watts:sum",
           "refId": "A"
         }
       ],
-      "title": "Total tenant power",
-      "description": "Live power draw summed across tenant workloads.",
+      "title": "Total GPU power",
+      "description": "Live power draw summed across all GPUs in the cluster. Cluster-wide — DCGM hardware metrics cannot be attributed to workload namespaces.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -266,12 +266,12 @@
       "id": 6,
       "targets": [
         {
-          "expr": "sum(sum_over_time(namespace:power_watts:sum{namespace=~\"$namespace\"}[24h:1m])) / 60 / 1000",
+          "expr": "sum(sum_over_time(node:power_watts:sum[24h:1m])) / 60 / 1000",
           "refId": "A"
         }
       ],
       "title": "Energy (last 24h)",
-      "description": "Integrated power draw over 24h. Feed into billing/chargeback as kWh.",
+      "description": "Integrated cluster-wide GPU power draw over 24h. Cluster-wide — DCGM hardware metrics cannot be attributed to workload namespaces.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -452,13 +452,13 @@
       "id": 12,
       "targets": [
         {
-          "expr": "namespace:fb_used_bytes:sum{namespace=~\"$namespace\"}",
-          "legendFormat": "{{namespace}}",
+          "expr": "node:fb_used_bytes:sum",
+          "legendFormat": "{{Hostname}}",
           "refId": "A"
         }
       ],
-      "title": "VRAM used per namespace",
-      "description": "FB memory actively used by tenant workloads.",
+      "title": "VRAM used per node",
+      "description": "FB memory actively used per node. DCGM hardware metrics cannot be attributed to workload namespaces — shown per-node instead.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -513,7 +513,7 @@
     {
       "type": "row",
       "collapsed": false,
-      "title": "Utilization",
+      "title": "Utilization (per-node)",
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -528,13 +528,13 @@
       "id": 21,
       "targets": [
         {
-          "expr": "namespace:gpu_util:avg{namespace=~\"$namespace\"}",
-          "legendFormat": "{{namespace}}",
+          "expr": "node:gpu_util:avg",
+          "legendFormat": "{{node}}",
           "refId": "A"
         }
       ],
-      "title": "NVML utilization per namespace",
-      "description": "Per-tenant NVML utilization. Stacked to show fleet-wide pressure over time.",
+      "title": "NVML utilization per node",
+      "description": "Per-node NVML utilization. Stacked to show fleet-wide pressure over time. DCGM hardware metrics cannot be attributed to workload namespaces — shown per-node instead.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -584,13 +584,13 @@
       "id": 22,
       "targets": [
         {
-          "expr": "namespace:tensor_active:avg{namespace=~\"$namespace\"} * 100",
-          "legendFormat": "{{namespace}}",
+          "expr": "node:tensor_active:avg * 100",
+          "legendFormat": "{{node}}",
           "refId": "A"
         }
       ],
-      "title": "Tensor saturation per namespace",
-      "description": "Real tensor core load per tenant. Useful to find AI tenants that claim GPUs but leave tensor cores idle.",
+      "title": "Tensor saturation per node",
+      "description": "Real tensor core load per node. Useful to spot nodes with idle tensor cores. DCGM hardware metrics cannot be attributed to workload namespaces — shown per-node instead.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -653,13 +653,13 @@
       "id": 31,
       "targets": [
         {
-          "expr": "namespace:power_watts:sum{namespace=~\"$namespace\"}",
-          "legendFormat": "{{namespace}}",
+          "expr": "node:power_watts:sum",
+          "legendFormat": "{{node}}",
           "refId": "A"
         }
       ],
-      "title": "Power draw per namespace",
-      "description": "Per-tenant power draw. Stacked to see cluster-wide energy burn over time.",
+      "title": "Power draw per node",
+      "description": "Per-node GPU power draw. Stacked to see cluster-wide energy burn over time. DCGM hardware metrics cannot be attributed to workload namespaces — shown per-node instead.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -783,38 +783,10 @@
           "range": false,
           "format": "table",
           "refId": "gpus"
-        },
-        {
-          "expr": "namespace:gpu_util:avg{namespace=~\"$namespace\"}",
-          "instant": true,
-          "range": false,
-          "format": "table",
-          "refId": "util"
-        },
-        {
-          "expr": "namespace:tensor_active:avg{namespace=~\"$namespace\"} * 100",
-          "instant": true,
-          "range": false,
-          "format": "table",
-          "refId": "tensor"
-        },
-        {
-          "expr": "namespace:power_watts:sum{namespace=~\"$namespace\"}",
-          "instant": true,
-          "range": false,
-          "format": "table",
-          "refId": "power"
-        },
-        {
-          "expr": "namespace:fb_used_bytes:sum{namespace=~\"$namespace\"}",
-          "instant": true,
-          "range": false,
-          "format": "table",
-          "refId": "vram"
         }
       ],
-      "title": "Top consumers",
-      "description": "Live ranking of tenants by power draw. Columns joined from namespace recording rules.",
+      "title": "Top consumers (allocation)",
+      "description": "Live ranking of tenants by GPU allocation. Hardware metrics (util, tensor, power, VRAM) cannot be attributed to workload namespaces — see Fleet and Performance dashboards for per-node/per-GPU hardware views.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -828,13 +800,6 @@
       },
       "repeatDirection": "h",
       "transformations": [
-        {
-          "id": "joinByField",
-          "options": {
-            "byField": "namespace",
-            "mode": "outer"
-          }
-        },
         {
           "id": "organize",
           "options": {
@@ -914,18 +879,10 @@
             },
             "indexByName": {
               "Value #gpus": 1,
-              "Value #power": 4,
-              "Value #tensor": 3,
-              "Value #util": 2,
-              "Value #vram": 5,
               "namespace": 0
             },
             "renameByName": {
               "Value #gpus": "GPUs",
-              "Value #power": "Power",
-              "Value #tensor": "Tensor %",
-              "Value #util": "Util %",
-              "Value #vram": "VRAM",
               "namespace": "Namespace"
             }
           }
@@ -937,7 +894,7 @@
         "showTypeIcons": false,
         "sortBy": [
           {
-            "displayName": "Power",
+            "displayName": "GPUs",
             "desc": true
           }
         ],
@@ -946,101 +903,6 @@
           "reducer": []
         },
         "cellHeight": "sm"
-      },
-      "fieldConfig": {
-        "defaults": {},
-        "overrides": [
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "Util %"
-            },
-            "properties": [
-              {
-                "id": "unit",
-                "value": "percent"
-              },
-              {
-                "id": "min",
-                "value": 0
-              },
-              {
-                "id": "max",
-                "value": 100
-              },
-              {
-                "id": "decimals",
-                "value": 1
-              },
-              {
-                "id": "custom.cellOptions",
-                "value": {
-                  "mode": "gradient",
-                  "type": "gauge"
-                }
-              }
-            ]
-          },
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "Tensor %"
-            },
-            "properties": [
-              {
-                "id": "unit",
-                "value": "percent"
-              },
-              {
-                "id": "min",
-                "value": 0
-              },
-              {
-                "id": "max",
-                "value": 100
-              },
-              {
-                "id": "decimals",
-                "value": 1
-              },
-              {
-                "id": "custom.cellOptions",
-                "value": {
-                  "mode": "gradient",
-                  "type": "gauge"
-                }
-              }
-            ]
-          },
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "Power"
-            },
-            "properties": [
-              {
-                "id": "unit",
-                "value": "watt"
-              },
-              {
-                "id": "decimals",
-                "value": 0
-              }
-            ]
-          },
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "VRAM"
-            },
-            "properties": [
-              {
-                "id": "unit",
-                "value": "bytes"
-              }
-            ]
-          }
-        ]
       }
     },
     {
@@ -1125,13 +987,13 @@
       "id": 52,
       "targets": [
         {
-          "expr": "sum_over_time(namespace:power_watts:sum{namespace=~\"$namespace\"}[24h:1m]) / 60 / 1000",
-          "legendFormat": "{{namespace}}",
+          "expr": "sum_over_time(node:power_watts:sum[24h:1m]) / 60 / 1000",
+          "legendFormat": "{{node}}",
           "refId": "A"
         }
       ],
-      "title": "Energy per namespace (last 24h)",
-      "description": "kWh consumed per tenant over the last 24h. Integrated from 1-minute power samples.",
+      "title": "Energy per node (last 24h)",
+      "description": "kWh consumed per node over the last 24h. Integrated from 1-minute power samples. DCGM hardware metrics cannot be attributed to workload namespaces — shown per-node instead.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
diff --git a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
index 093a2939..b046edf5 100644
--- a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
+++ b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
@@ -42,46 +42,23 @@ spec:
         #     excluding infra pods would under-report raw capacity and
         #     break capacity-planning math.
         #
-        #   * cluster:gpu_util:avg DOES filter infra namespaces because it
-        #     is a tenant-oriented KPI. Admins want to see the mean
-        #     utilization of tenant workloads, not have it diluted by
-        #     GPU Operator DaemonSet pods whose containers hold a GPU
-        #     handle but do no useful compute.
-        #
-        # Do not "normalize" by adding the filter to the hardware rules —
-        # downstream consumers (capacity planning, billing) rely on the
-        # raw totals.
+        # No namespace filter — DCGM exporter metrics carry the exporter's
+        # own namespace, not the workload namespace. Filtering by namespace
+        # here would silently drop all series.
         - record: cluster:gpu_util:avg
-          expr: avg(DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"})
+          expr: avg(DCGM_FI_DEV_GPU_UTIL)
         - record: cluster:gpu_power_watts:sum
           expr: sum(DCGM_FI_DEV_POWER_USAGE)
 
-    - name: gpu.recording.namespace.1m
+    - name: gpu.recording.node.1m
       interval: 1m
       params: {}
       rules:
-        # Kube-requested GPU count per namespace — billable view, includes
-        # Pending pods. Use this for GPU-hour reporting via
-        # sum_over_time(...[1h:1m])/60.
-        #
-        # Filters cozy-*/kube-* so the namespace set here matches every
-        # other namespace:* rule below. This keeps the $namespace variable
-        # in the tenant dashboard consistent with panels that read filtered
-        # rules — otherwise picking a system ns from the dropdown leaves
-        # half the panels empty while others show values.
-        #
-        # Trade-off: per-namespace GPU accounting for system workloads is
-        # no longer available here. If it's ever needed (e.g. operator
-        # pods pinning tenant GPUs), add a separate rule like
-        # system:gpu_count:allocated rather than widening this one — the
-        # "billable tenant view" invariant is relied on by tenants.json
-        # and keeping it narrow protects consumers from the asymmetry
-        # that triggered this filter in the first place.
-        #
-        # Note: sum(namespace:gpu_count:allocated) no longer equals
-        # cluster:gpu_count:allocated — the cluster-level rule intentionally
-        # keeps system pods to stay aligned with cluster:gpu_count:total
-        # when computing :free.
+        # Kube-requested GPU count per namespace — billable/allocation view.
+        # This is the only namespace-level rule that works correctly because
+        # kube_pod_container_resource_requests carries the real workload
+        # namespace, unlike DCGM exporter metrics which carry the exporter's
+        # own namespace (cozy-gpu-operator).
         - record: namespace:gpu_count:allocated
           expr: |
             sum by (namespace) (
@@ -90,14 +67,18 @@ spec:
                 kube_pod_status_phase{phase=~"Pending|Running"} == 1
               )
             )
-        - record: namespace:gpu_util:avg
-          expr: avg by (namespace) (DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"})
-        - record: namespace:tensor_active:avg
-          expr: avg by (namespace) (DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{namespace!="", namespace!~"cozy-.*|kube-.*"})
-        - record: namespace:fb_used_bytes:sum
-          expr: sum by (namespace) (DCGM_FI_DEV_FB_USED{namespace!="", namespace!~"cozy-.*|kube-.*"}) * 1048576
-        - record: namespace:power_watts:sum
-          expr: sum by (namespace) (DCGM_FI_DEV_POWER_USAGE{namespace!="", namespace!~"cozy-.*|kube-.*"})
+        # Hardware metrics aggregated per node (Hostname). DCGM exporter
+        # metrics carry a capital-H "Hostname" label identifying the node
+        # but no usable workload namespace — so hardware telemetry is
+        # aggregated at node/GPU granularity, not namespace.
+        - record: node:gpu_util:avg
+          expr: avg by (Hostname) (DCGM_FI_DEV_GPU_UTIL)
+        - record: node:tensor_active:avg
+          expr: avg by (Hostname) (DCGM_FI_PROF_PIPE_TENSOR_ACTIVE)
+        - record: node:fb_used_bytes:sum
+          expr: sum by (Hostname) (DCGM_FI_DEV_FB_USED) * 1048576
+        - record: node:power_watts:sum
+          expr: sum by (Hostname) (DCGM_FI_DEV_POWER_USAGE)
 
     # Known gap: there is no lower-bound sanity alert for under-reporting.
     # If DCGM ever switches POWER/THERMAL_VIOLATION counter units the other
@@ -113,27 +94,26 @@ spec:
       interval: 1m
       params: {}
       rules:
-        # Tensor hardware saturation — the honest "am I using the GPU" metric
-        # for AI/LLM workloads. Unlike NVML, idle tensor cores are visible.
-        # Stored as a 0..1 ratio to stay consistent with namespace:tensor_active:avg
-        # and DCGM's native units. Consumers multiply by 100 at display time.
-        - record: pod:tensor_saturation:avg5m
+        # Tensor hardware saturation per GPU — the honest "am I using the GPU"
+        # metric for AI/LLM workloads. Aggregated at GPU level (Hostname +
+        # gpu + UUID) because DCGM metrics don't carry workload namespace.
+        # Stored as a 0..1 ratio; consumers multiply by 100 at display time.
+        - record: gpu:tensor_saturation:avg5m
           expr: |
-            avg by (Hostname, gpu, UUID, namespace, pod) (
-              avg_over_time(DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{namespace!="", namespace!~"cozy-.*|kube-.*"}[5m])
+            avg by (Hostname, gpu, UUID) (
+              avg_over_time(DCGM_FI_PROF_PIPE_TENSOR_ACTIVE[5m])
             )
 
-        # Power efficiency — utilization per watt, reveals unoptimized clients.
-        # Explicit on(...) pins the bigop matching set to the labels we
-        # group by — protects against empty results if dcgm-exporter
-        # relabeling ever diverges between the two metrics.
-        - record: pod:util_per_watt:avg5m
+        # Power efficiency per GPU — utilization per watt, reveals
+        # unoptimized workloads. Explicit on(...) pins the matching set
+        # to GPU-identifying labels.
+        - record: gpu:util_per_watt:avg5m
           expr: |
-            avg by (Hostname, gpu, UUID, namespace, pod) (
-              avg_over_time(DCGM_FI_DEV_GPU_UTIL{namespace!="", namespace!~"cozy-.*|kube-.*"}[5m])
-              / on (Hostname, gpu, UUID, namespace, pod)
+            avg by (Hostname, gpu, UUID) (
+              avg_over_time(DCGM_FI_DEV_GPU_UTIL[5m])
+              / on (Hostname, gpu, UUID)
               clamp_min(
-                avg_over_time(DCGM_FI_DEV_POWER_USAGE{namespace!="", namespace!~"cozy-.*|kube-.*"}[5m]),
+                avg_over_time(DCGM_FI_DEV_POWER_USAGE[5m]),
                 1
               )
             )

From f866c71b684c742ac47e66ceedcca1d7158d6363 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Mon, 27 Apr 2026 12:51:31 +0300
Subject: [PATCH 622/666] fix(gpu-operator): add node relabel to example
 serviceMonitor values

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../system/gpu-operator/examples/values-native-talos.yaml     | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/packages/system/gpu-operator/examples/values-native-talos.yaml b/packages/system/gpu-operator/examples/values-native-talos.yaml
index 5a3d7786..ef7b2891 100644
--- a/packages/system/gpu-operator/examples/values-native-talos.yaml
+++ b/packages/system/gpu-operator/examples/values-native-talos.yaml
@@ -44,5 +44,9 @@ spec:
               # documented overhead concerns below 1s; 15s is safe.
               interval: "15s"
               honorLabels: true
+              relabelings:
+                - sourceLabels: [__meta_kubernetes_pod_node_name]
+                  targetLabel: node
+                  action: replace
             config:
               name: dcgm-custom-metrics

From 1baadd75a72ec75921df438671b5e186aed063e2 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 27 Apr 2026 13:07:04 +0300
Subject: [PATCH 623/666] fix(ci): guard pr.labels access in pr-labeler
 workflow

Address review feedback from myasnikovdaniil on .github/workflows/pr-labeler.yaml:129:
defensive (pr.labels || []) avoids TypeError if the webhook payload
arrives without the labels field on edge cases like stripped edited
events.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .github/workflows/pr-labeler.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pr-labeler.yaml b/.github/workflows/pr-labeler.yaml
index d882bc50..ca3023fd 100644
--- a/.github/workflows/pr-labeler.yaml
+++ b/.github/workflows/pr-labeler.yaml
@@ -126,7 +126,7 @@ jobs:
             const pr = context.payload.pull_request;
             const title = pr.title || '';
             const body  = pr.body  || '';
-            const existing = new Set(pr.labels.map(l => l.name));
+            const existing = new Set((pr.labels || []).map(l => l.name));
             const toAdd = new Set();
 
             // 1. Strip "[Backport release-1.x]" prefix if present.

From 86a1e811ccde200d5206b98df70c4cc29a891ccc Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 27 Apr 2026 13:07:21 +0300
Subject: [PATCH 624/666] fix(ci): accept hyphenated BREAKING-CHANGE footer in
 pr-labeler

Address review feedback from myasnikovdaniil on .github/workflows/pr-labeler.yaml:155:
Conventional Commits 1.0 spec item 16 treats BREAKING CHANGE: and
BREAKING-CHANGE: as synonymous footers. The hyphen form was silently
ignored before, so PRs that use it would miss kind/breaking-change.

https://www.conventionalcommits.org/en/v1.0.0/#specification

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .github/workflows/pr-labeler.yaml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/pr-labeler.yaml b/.github/workflows/pr-labeler.yaml
index ca3023fd..5a6564a9 100644
--- a/.github/workflows/pr-labeler.yaml
+++ b/.github/workflows/pr-labeler.yaml
@@ -151,8 +151,9 @@ jobs:
               scopeStr = bracket[1];
             }
 
-            // 4. Detect BREAKING CHANGE: footer in body.
-            if (/^BREAKING CHANGE:/m.test(body)) {
+            // 4. Detect BREAKING CHANGE: or BREAKING-CHANGE: footer in body.
+            // Conventional Commits 1.0 spec item 16 treats them as synonymous.
+            if (/^BREAKING[ -]CHANGE:/m.test(body)) {
               breaking = true;
             }
 

From 79744099f63cfa3498362b15f9d2d30024602d0c Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 27 Apr 2026 13:07:39 +0300
Subject: [PATCH 625/666] chore(ci): warn on unmapped type or scope in
 pr-labeler

Address review feedback from myasnikovdaniil on .github/workflows/pr-labeler.yaml:160,173:
emit core.warning when a Conventional Commits type has no kind/*
mapping or a scope has no area/* mapping. Without the warning, typos
(e.g., "hotfix" instead of "fix") and recurring new scopes silently
fall through to area/uncategorized, masking that the mapping has
drifted.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .github/workflows/pr-labeler.yaml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/pr-labeler.yaml b/.github/workflows/pr-labeler.yaml
index 5a6564a9..6e6f3017 100644
--- a/.github/workflows/pr-labeler.yaml
+++ b/.github/workflows/pr-labeler.yaml
@@ -158,8 +158,12 @@ jobs:
             }
 
             // 5. Apply kind/* from type.
-            if (type && typeToKind[type]) {
-              toAdd.add(typeToKind[type]);
+            if (type) {
+              if (typeToKind[type]) {
+                toAdd.add(typeToKind[type]);
+              } else {
+                core.warning(`type "${type}" has no kind/* mapping — typo or new type? See .github/workflows/pr-labeler.yaml typeToKind`);
+              }
             }
 
             // 6. Apply area/* from scope. Composite scopes split on comma.
@@ -170,6 +174,8 @@ jobs:
             for (const s of scopes) {
               if (scopeToArea[s]) {
                 toAdd.add(scopeToArea[s]);
+              } else {
+                core.warning(`scope "${s}" has no area/* mapping — consider extending scopeToArea in .github/workflows/pr-labeler.yaml if it recurs`);
               }
             }
 

From d8d870cc2af73925561ae2f9aa936613b47ad0fe Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Mon, 27 Apr 2026 13:24:27 +0300
Subject: [PATCH 626/666] fix(hami): use RollingUpdate strategy for device
 plugin DaemonSet

OnDelete requires manual pod deletion to apply updates. RollingUpdate
with maxUnavailable constraint matches upstream default and is consistent
with all other system packages.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/system/hami/values.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/system/hami/values.yaml b/packages/system/hami/values.yaml
index 64b372a6..76e8d631 100644
--- a/packages/system/hami/values.yaml
+++ b/packages/system/hami/values.yaml
@@ -7,7 +7,7 @@ hami:
   devicePlugin:
     runtimeClassName: nvidia
     updateStrategy:
-      type: OnDelete
+      type: RollingUpdate
     # See https://github.com/Project-HAMi/HAMi/blob/v2.8.1/deployments/charts/hami/values.yaml
     # Each entry: {"name": "node-name", "operatingmode": "hami-core", "devicesplitcount": N, ...}
     nodeConfiguration:

From 36852548e576e153981eab0146614442b5bc9a15 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Mon, 27 Apr 2026 13:29:15 +0300
Subject: [PATCH 627/666] fix(hami): correct label indentation in device-plugin
 monitorservice

Use nindent instead of indent with leading whitespace to prevent
broken YAML rendering when devicePlugin.service.labels is set.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../charts/hami/templates/device-plugin/monitorservice.yaml   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml b/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml
index 104664ea..88f1b214 100644
--- a/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml
+++ b/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml
@@ -7,8 +7,8 @@ metadata:
   labels:
     app.kubernetes.io/component: hami-device-plugin
     {{- include "hami-vgpu.labels" . | nindent 4 }}
-    {{- if .Values.devicePlugin.service.labels }}  # Use devicePlugin instead of scheduler
-    {{ toYaml .Values.devicePlugin.service.labels | indent 4 }}
+    {{- with .Values.devicePlugin.service.labels }}
+    {{- toYaml . | nindent 4 }}
     {{- end }}
   {{- if .Values.devicePlugin.service.annotations }}  # Use devicePlugin instead of scheduler
   annotations: {{ toYaml .Values.devicePlugin.service.annotations | nindent 4 }}

From f0e033ebcb2fc727bc8fb473507de34edacbf898 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Mon, 27 Apr 2026 13:44:08 +0300
Subject: [PATCH 628/666] style(kubernetes): use with instead of if for hami
 valuesOverride

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/apps/kubernetes/templates/helmreleases/hami.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/apps/kubernetes/templates/helmreleases/hami.yaml b/packages/apps/kubernetes/templates/helmreleases/hami.yaml
index 8733e675..1f7a5358 100644
--- a/packages/apps/kubernetes/templates/helmreleases/hami.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/hami.yaml
@@ -32,9 +32,9 @@ spec:
     force: true
     remediation:
       retries: -1
-  {{- if .Values.addons.hami.valuesOverride }}
+  {{- with .Values.addons.hami.valuesOverride }}
   values:
-    {{- toYaml .Values.addons.hami.valuesOverride | nindent 4 }}
+    {{- toYaml . | nindent 4 }}
   {{- end }}
 
   dependsOn:

From c53f10475025c6675e5270f359f97f619db7c80f Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Mon, 27 Apr 2026 13:44:12 +0300
Subject: [PATCH 629/666] docs(hami): clarify that parameter defaults come from
 upstream chart

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/system/hami/README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/packages/system/hami/README.md b/packages/system/hami/README.md
index 283f9e80..d648364d 100644
--- a/packages/system/hami/README.md
+++ b/packages/system/hami/README.md
@@ -72,6 +72,8 @@ resources:
 
 ## Parameters
 
+Default values shown below are inherited from the upstream HAMi chart and may change with upstream updates.
+
 | Name | Description | Default |
 | --- | --- | --- |
 | `hami.devicePlugin.runtimeClassName` | RuntimeClass for device plugin pods | `nvidia` |

From 9ba5e587810f44d522d5876e38f12f87c3dde3bb Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Mon, 27 Apr 2026 13:44:17 +0300
Subject: [PATCH 630/666] fix(kubernetes): avoid rendering empty values key in
 gpu-operator HelmRelease

Wrap the values: block in a conditional so the key is omitted entirely
when no defaults or overrides produce content. Previously the template
always emitted values: null, triggering unnecessary FluxCD reconciliation.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../apps/kubernetes/templates/helmreleases/gpu-operator.yaml  | 4 +++-
 packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml    | 3 +--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml b/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml
index 7a5ecaf1..15849495 100644
--- a/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml
@@ -40,8 +40,10 @@ spec:
   {{- $defaults := fromYaml (include "cozystack.defaultGpuOperatorValues" .) }}
   {{- $overrides := deepCopy (default (dict) .Values.addons.gpuOperator.valuesOverride) }}
   {{- $merged := mergeOverwrite (default (dict) $defaults) $overrides }}
+  {{- if $merged }}
   values:
-    {{- if $merged }}{{ toYaml $merged | nindent 4 }}{{ end }}
+    {{- toYaml $merged | nindent 4 }}
+  {{- end }}
 
   dependsOn:
   {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
diff --git a/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml b/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml
index c3ec30f2..4fa754fb 100644
--- a/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml
+++ b/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml
@@ -26,9 +26,8 @@ tests:
           enabled: false
           valuesOverride: {}
     asserts:
-      - equal:
+      - notExists:
           path: spec.values
-          value: null
 
   - it: should apply hami defaults when valuesOverride key is omitted
     set:

From 37ecd7b3af9f96ef8cbcb097b8b88a4ffbcef548 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 27 Apr 2026 13:50:08 +0300
Subject: [PATCH 631/666] feat(kubernetes): make wait-for-kubeconfig image
 overridable for air-gapped registries

Operators in air-gapped or rate-limited environments cannot reach
docker.io and the bundled busybox digest pin gives them no escape
hatch. Add an optional images.waitForKubeconfig chart value that, when
set, replaces the helper's image reference with any registry path
kubelet can pull. Empty value falls back to images/busybox.tag, so the
prior digest-pinned default is preserved.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 api/apps/v1alpha1/kubernetes/types.go         |  9 ++++
 packages/apps/kubernetes/README.md            | 52 ++++++++++---------
 .../apps/kubernetes/templates/_helpers.tpl    | 12 +++--
 .../tests/admin_kubeconfig_wait_test.yaml     | 23 ++++++++
 packages/apps/kubernetes/values.schema.json   | 12 +++++
 packages/apps/kubernetes/values.yaml          |  7 +++
 .../kubernetes-rd/cozyrds/kubernetes.yaml     |  4 +-
 7 files changed, 87 insertions(+), 32 deletions(-)

diff --git a/api/apps/v1alpha1/kubernetes/types.go b/api/apps/v1alpha1/kubernetes/types.go
index 774fcdc5..ea4a2b64 100644
--- a/api/apps/v1alpha1/kubernetes/types.go
+++ b/api/apps/v1alpha1/kubernetes/types.go
@@ -36,6 +36,9 @@ type ConfigSpec struct {
 	// Kubernetes control-plane configuration.
 	// +kubebuilder:default:={}
 	ControlPlane ControlPlane `json:"controlPlane"`
+	// Optional image overrides for air-gapped or rate-limited registries.
+	// +kubebuilder:default:={}
+	Images Images `json:"images"`
 }
 
 type APIServer struct {
@@ -157,6 +160,12 @@ type GatewayAPIAddon struct {
 	Enabled bool `json:"enabled"`
 }
 
+type Images struct {
+	// Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag.
+	// +kubebuilder:default:=""
+	WaitForKubeconfig string `json:"waitForKubeconfig,omitempty"`
+}
+
 type IngressNginxAddon struct {
 	// Enable the controller (requires nodes labeled `ingress-nginx`).
 	// +kubebuilder:default:=false
diff --git a/packages/apps/kubernetes/README.md b/packages/apps/kubernetes/README.md
index d62d3a39..ecbbc31b 100644
--- a/packages/apps/kubernetes/README.md
+++ b/packages/apps/kubernetes/README.md
@@ -145,31 +145,33 @@ See the reference for components utilized in this service:
 
 ### Kubernetes Control Plane Configuration
 
-| Name                                                | Description                                      | Type       | Value   |
-| --------------------------------------------------- | ------------------------------------------------ | ---------- | ------- |
-| `controlPlane`                                      | Kubernetes control-plane configuration.          | `object`   | `{}`    |
-| `controlPlane.replicas`                             | Number of control-plane replicas.                | `int`      | `2`     |
-| `controlPlane.apiServer`                            | API Server configuration.                        | `object`   | `{}`    |
-| `controlPlane.apiServer.resources`                  | CPU and memory resources for API Server.         | `object`   | `{}`    |
-| `controlPlane.apiServer.resources.cpu`              | CPU available.                                   | `quantity` | `""`    |
-| `controlPlane.apiServer.resources.memory`           | Memory (RAM) available.                          | `quantity` | `""`    |
-| `controlPlane.apiServer.resourcesPreset`            | Preset if `resources` omitted.                   | `string`   | `large` |
-| `controlPlane.controllerManager`                    | Controller Manager configuration.                | `object`   | `{}`    |
-| `controlPlane.controllerManager.resources`          | CPU and memory resources for Controller Manager. | `object`   | `{}`    |
-| `controlPlane.controllerManager.resources.cpu`      | CPU available.                                   | `quantity` | `""`    |
-| `controlPlane.controllerManager.resources.memory`   | Memory (RAM) available.                          | `quantity` | `""`    |
-| `controlPlane.controllerManager.resourcesPreset`    | Preset if `resources` omitted.                   | `string`   | `micro` |
-| `controlPlane.scheduler`                            | Scheduler configuration.                         | `object`   | `{}`    |
-| `controlPlane.scheduler.resources`                  | CPU and memory resources for Scheduler.          | `object`   | `{}`    |
-| `controlPlane.scheduler.resources.cpu`              | CPU available.                                   | `quantity` | `""`    |
-| `controlPlane.scheduler.resources.memory`           | Memory (RAM) available.                          | `quantity` | `""`    |
-| `controlPlane.scheduler.resourcesPreset`            | Preset if `resources` omitted.                   | `string`   | `micro` |
-| `controlPlane.konnectivity`                         | Konnectivity configuration.                      | `object`   | `{}`    |
-| `controlPlane.konnectivity.server`                  | Konnectivity Server configuration.               | `object`   | `{}`    |
-| `controlPlane.konnectivity.server.resources`        | CPU and memory resources for Konnectivity.       | `object`   | `{}`    |
-| `controlPlane.konnectivity.server.resources.cpu`    | CPU available.                                   | `quantity` | `""`    |
-| `controlPlane.konnectivity.server.resources.memory` | Memory (RAM) available.                          | `quantity` | `""`    |
-| `controlPlane.konnectivity.server.resourcesPreset`  | Preset if `resources` omitted.                   | `string`   | `micro` |
+| Name                                                | Description                                                                                   | Type       | Value   |
+| --------------------------------------------------- | --------------------------------------------------------------------------------------------- | ---------- | ------- |
+| `controlPlane`                                      | Kubernetes control-plane configuration.                                                       | `object`   | `{}`    |
+| `controlPlane.replicas`                             | Number of control-plane replicas.                                                             | `int`      | `2`     |
+| `controlPlane.apiServer`                            | API Server configuration.                                                                     | `object`   | `{}`    |
+| `controlPlane.apiServer.resources`                  | CPU and memory resources for API Server.                                                      | `object`   | `{}`    |
+| `controlPlane.apiServer.resources.cpu`              | CPU available.                                                                                | `quantity` | `""`    |
+| `controlPlane.apiServer.resources.memory`           | Memory (RAM) available.                                                                       | `quantity` | `""`    |
+| `controlPlane.apiServer.resourcesPreset`            | Preset if `resources` omitted.                                                                | `string`   | `large` |
+| `controlPlane.controllerManager`                    | Controller Manager configuration.                                                             | `object`   | `{}`    |
+| `controlPlane.controllerManager.resources`          | CPU and memory resources for Controller Manager.                                              | `object`   | `{}`    |
+| `controlPlane.controllerManager.resources.cpu`      | CPU available.                                                                                | `quantity` | `""`    |
+| `controlPlane.controllerManager.resources.memory`   | Memory (RAM) available.                                                                       | `quantity` | `""`    |
+| `controlPlane.controllerManager.resourcesPreset`    | Preset if `resources` omitted.                                                                | `string`   | `micro` |
+| `controlPlane.scheduler`                            | Scheduler configuration.                                                                      | `object`   | `{}`    |
+| `controlPlane.scheduler.resources`                  | CPU and memory resources for Scheduler.                                                       | `object`   | `{}`    |
+| `controlPlane.scheduler.resources.cpu`              | CPU available.                                                                                | `quantity` | `""`    |
+| `controlPlane.scheduler.resources.memory`           | Memory (RAM) available.                                                                       | `quantity` | `""`    |
+| `controlPlane.scheduler.resourcesPreset`            | Preset if `resources` omitted.                                                                | `string`   | `micro` |
+| `controlPlane.konnectivity`                         | Konnectivity configuration.                                                                   | `object`   | `{}`    |
+| `controlPlane.konnectivity.server`                  | Konnectivity Server configuration.                                                            | `object`   | `{}`    |
+| `controlPlane.konnectivity.server.resources`        | CPU and memory resources for Konnectivity.                                                    | `object`   | `{}`    |
+| `controlPlane.konnectivity.server.resources.cpu`    | CPU available.                                                                                | `quantity` | `""`    |
+| `controlPlane.konnectivity.server.resources.memory` | Memory (RAM) available.                                                                       | `quantity` | `""`    |
+| `controlPlane.konnectivity.server.resourcesPreset`  | Preset if `resources` omitted.                                                                | `string`   | `micro` |
+| `images`                                            | Optional image overrides for air-gapped or rate-limited registries.                           | `object`   | `{}`    |
+| `images.waitForKubeconfig`                          | Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag. | `string`   | `""`    |
 
 
 ## Parameter examples and reference
diff --git a/packages/apps/kubernetes/templates/_helpers.tpl b/packages/apps/kubernetes/templates/_helpers.tpl
index e6ad9dcf..40a8ae7a 100644
--- a/packages/apps/kubernetes/templates/_helpers.tpl
+++ b/packages/apps/kubernetes/templates/_helpers.tpl
@@ -65,18 +65,20 @@ release.cozystack.io/helm-install-timeout annotation) so the
 CrashLoopBackOff surfaces before flux remediation fires and uninstalls
 the Cluster CR.
 
-The pinned busybox image in images/busybox.tag points directly at
+The default image lives in images/busybox.tag and points directly at
 docker.io by digest (not mirrored to ghcr.io like the other .tag files
-here): the payload is a one-shot sh loop, the digest pin makes the
-pull immutable, and the cost of maintaining a private mirror of a tiny
-upstream image that does not move often is not worth it.
+here): the payload is a one-shot sh loop and the digest pin makes the
+pull immutable. Operators in air-gapped or rate-limited environments
+can override it via .Values.images.waitForKubeconfig (any registry
+reference kubelet can pull). When the value is empty the chart falls
+back to the bundled digest pin, preserving the prior default.
 
 Call site owns the surrounding volumes block; the kubeconfig volume
 must exist on the pod and mount at /etc/kubernetes/kubeconfig.
 */}}
 {{- define "kubernetes.waitForAdminKubeconfig" -}}
 - name: wait-for-kubeconfig
-  image: "{{ .Files.Get "images/busybox.tag" | trim }}"
+  image: "{{ default (.Files.Get "images/busybox.tag" | trim) .Values.images.waitForKubeconfig }}"
   command:
   - sh
   - -c
diff --git a/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml b/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
index e7c03bd1..507e00af 100644
--- a/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
+++ b/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
@@ -95,6 +95,29 @@ tests:
             mountPath: /etc/kubernetes/kubeconfig
             readOnly: true
 
+  - it: wait-for-kubeconfig defaults to bundled busybox digest pin
+    template: templates/cluster-autoscaler/deployment.yaml
+    documentSelector:
+      path: kind
+      value: Deployment
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[0].image
+          pattern: '^docker\.io/library/busybox:[^@]+@sha256:[0-9a-f]{64}$'
+
+  - it: wait-for-kubeconfig honours images.waitForKubeconfig override
+    template: templates/cluster-autoscaler/deployment.yaml
+    documentSelector:
+      path: kind
+      value: Deployment
+    set:
+      images:
+        waitForKubeconfig: "registry.example.test/library/busybox:1.37.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[0].image
+          value: "registry.example.test/library/busybox:1.37.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+
   - it: cluster.yaml renders and wires dataStoreName when tenant has etcd
     template: templates/cluster.yaml
     documentSelector:
diff --git a/packages/apps/kubernetes/values.schema.json b/packages/apps/kubernetes/values.schema.json
index 1beeff9c..81e9e2b8 100644
--- a/packages/apps/kubernetes/values.schema.json
+++ b/packages/apps/kubernetes/values.schema.json
@@ -630,6 +630,18 @@
           }
         }
       }
+    },
+    "images": {
+      "description": "Optional image overrides for air-gapped or rate-limited registries.",
+      "type": "object",
+      "default": {},
+      "properties": {
+        "waitForKubeconfig": {
+          "description": "Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag.",
+          "type": "string",
+          "default": ""
+        }
+      }
     }
   }
 }
diff --git a/packages/apps/kubernetes/values.yaml b/packages/apps/kubernetes/values.yaml
index a67b5d69..68ba07b0 100644
--- a/packages/apps/kubernetes/values.yaml
+++ b/packages/apps/kubernetes/values.yaml
@@ -197,3 +197,10 @@ controlPlane:
     server:
       resources: {}
       resourcesPreset: "micro"
+
+## @typedef {struct} Images - Optional image overrides for chart-internal helpers.
+## @field {string} [waitForKubeconfig] - Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag.
+
+## @param {Images} images - Optional image overrides for air-gapped or rate-limited registries.
+images:
+  waitForKubeconfig: ""
diff --git a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
index aaa01247..1631c86e 100644
--- a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
+++ b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
@@ -22,7 +22,7 @@ spec:
     singular: kubernetes
     plural: kuberneteses
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"},"nodeGroups":{"description":"Worker nodes configuration map.","type":"object","default":{"md0":{"ephemeralStorage":"20Gi","gpus":[],"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":["ingress-nginx"]}},"additionalProperties":{"type":"object","required":["ephemeralStorage","instanceType","maxReplicas","minReplicas","resources"],"properties":{"ephemeralStorage":{"description":"Ephemeral storage size.","default":"20Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"description":"Name of GPU, such as \"nvidia.com/AD102GL_L40S\".","type":"string"}}}},"instanceType":{"description":"Virtual machine instance type.","type":"string","default":"u1.medium"},"maxReplicas":{"description":"Maximum number of replicas.","type":"integer","default":10},"minReplicas":{"description":"Minimum number of replicas.","type":"integer","default":0},"resources":{"description":"CPU and memory resources for each worker node.","type":"object","properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"roles":{"description":"List of node roles.","type":"array","items":{"type":"string"}}}}},"version":{"description":"Kubernetes major.minor version to deploy","type":"string","default":"v1.35","enum":["v1.35","v1.34","v1.33","v1.32","v1.31","v1.30"]},"host":{"description":"External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.","type":"string","default":""},"addons":{"description":"Cluster addons configuration.","type":"object","default":{},"required":["certManager","cilium","coredns","fluxcd","gatewayAPI","gpuOperator","ingressNginx","monitoringAgents","velero","verticalPodAutoscaler"],"properties":{"certManager":{"description":"Cert-manager addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable cert-manager.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"cilium":{"description":"Cilium CNI plugin.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"coredns":{"description":"CoreDNS addon.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"fluxcd":{"description":"FluxCD GitOps operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable FluxCD.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"gatewayAPI":{"description":"Gateway API addon.","type":"object","default":{},"required":["enabled"],"properties":{"enabled":{"description":"Enable Gateway API.","type":"boolean","default":false}}},"gpuOperator":{"description":"NVIDIA GPU Operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable GPU Operator.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"ingressNginx":{"description":"Ingress-NGINX controller.","type":"object","default":{},"required":["enabled","exposeMethod","valuesOverride"],"properties":{"enabled":{"description":"Enable the controller (requires nodes labeled `ingress-nginx`).","type":"boolean","default":false},"exposeMethod":{"description":"Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.","type":"string","default":"Proxied","enum":["Proxied","LoadBalancer"]},"hosts":{"description":"Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.","type":"array","default":[],"items":{"type":"string"}},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"monitoringAgents":{"description":"Monitoring agents.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable monitoring agents.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"velero":{"description":"Velero backup/restore addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable Velero.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"verticalPodAutoscaler":{"description":"Vertical Pod Autoscaler.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}}}},"controlPlane":{"description":"Kubernetes control-plane configuration.","type":"object","default":{},"required":["apiServer","controllerManager","konnectivity","replicas","scheduler"],"properties":{"apiServer":{"description":"API Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for API Server.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"controllerManager":{"description":"Controller Manager configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Controller Manager.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"konnectivity":{"description":"Konnectivity configuration.","type":"object","default":{},"required":["server"],"properties":{"server":{"description":"Konnectivity Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Konnectivity.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"replicas":{"description":"Number of control-plane replicas.","type":"integer","default":2},"scheduler":{"description":"Scheduler configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Scheduler.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}}}}
+      {"title":"Chart Values","type":"object","properties":{"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"},"nodeGroups":{"description":"Worker nodes configuration map.","type":"object","default":{"md0":{"ephemeralStorage":"20Gi","gpus":[],"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":["ingress-nginx"]}},"additionalProperties":{"type":"object","required":["ephemeralStorage","instanceType","maxReplicas","minReplicas","resources"],"properties":{"ephemeralStorage":{"description":"Ephemeral storage size.","default":"20Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"description":"Name of GPU, such as \"nvidia.com/AD102GL_L40S\".","type":"string"}}}},"instanceType":{"description":"Virtual machine instance type.","type":"string","default":"u1.medium"},"maxReplicas":{"description":"Maximum number of replicas.","type":"integer","default":10},"minReplicas":{"description":"Minimum number of replicas.","type":"integer","default":0},"resources":{"description":"CPU and memory resources for each worker node.","type":"object","properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"roles":{"description":"List of node roles.","type":"array","items":{"type":"string"}}}}},"version":{"description":"Kubernetes major.minor version to deploy","type":"string","default":"v1.35","enum":["v1.35","v1.34","v1.33","v1.32","v1.31","v1.30"]},"host":{"description":"External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.","type":"string","default":""},"addons":{"description":"Cluster addons configuration.","type":"object","default":{},"required":["certManager","cilium","coredns","fluxcd","gatewayAPI","gpuOperator","ingressNginx","monitoringAgents","velero","verticalPodAutoscaler"],"properties":{"certManager":{"description":"Cert-manager addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable cert-manager.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"cilium":{"description":"Cilium CNI plugin.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"coredns":{"description":"CoreDNS addon.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"fluxcd":{"description":"FluxCD GitOps operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable FluxCD.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"gatewayAPI":{"description":"Gateway API addon.","type":"object","default":{},"required":["enabled"],"properties":{"enabled":{"description":"Enable Gateway API.","type":"boolean","default":false}}},"gpuOperator":{"description":"NVIDIA GPU Operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable GPU Operator.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"ingressNginx":{"description":"Ingress-NGINX controller.","type":"object","default":{},"required":["enabled","exposeMethod","valuesOverride"],"properties":{"enabled":{"description":"Enable the controller (requires nodes labeled `ingress-nginx`).","type":"boolean","default":false},"exposeMethod":{"description":"Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.","type":"string","default":"Proxied","enum":["Proxied","LoadBalancer"]},"hosts":{"description":"Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.","type":"array","default":[],"items":{"type":"string"}},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"monitoringAgents":{"description":"Monitoring agents.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable monitoring agents.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"velero":{"description":"Velero backup/restore addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable Velero.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"verticalPodAutoscaler":{"description":"Vertical Pod Autoscaler.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}}}},"controlPlane":{"description":"Kubernetes control-plane configuration.","type":"object","default":{},"required":["apiServer","controllerManager","konnectivity","replicas","scheduler"],"properties":{"apiServer":{"description":"API Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for API Server.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"controllerManager":{"description":"Controller Manager configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Controller Manager.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"konnectivity":{"description":"Konnectivity configuration.","type":"object","default":{},"required":["server"],"properties":{"server":{"description":"Konnectivity Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Konnectivity.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"replicas":{"description":"Number of control-plane replicas.","type":"integer","default":2},"scheduler":{"description":"Scheduler configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Scheduler.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"images":{"description":"Optional image overrides for air-gapped or rate-limited registries.","type":"object","default":{},"properties":{"waitForKubeconfig":{"description":"Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag.","type":"string","default":""}}}}}
   release:
     prefix: kubernetes-
     labels:
@@ -40,7 +40,7 @@ spec:
     tags:
       - compute
     icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl82ODFfMjg0NSkiLz4KPHBhdGggZD0iTTcxLjk5NjggMTlDNzAuMzAzOSAxOS4wMDAyIDY4LjkzMTIgMjAuNTMyMiA2OC45MzE0IDIyLjQyMjFDNjguOTMxNCAyMi40NTExIDY4LjkzNzMgMjIuNDc4OCA2OC45Mzc5IDIyLjUwNzZDNjguOTM1NCAyMi43NjQ0IDY4LjkyMzEgMjMuMDczNyA2OC45MzE0IDIzLjI5NzNDNjguOTcxNyAyNC4zODczIDY5LjIwODIgMjUuMjIxNiA2OS4zNTA2IDI2LjIyNThDNjkuNjA4NCAyOC4zNzUyIDY5LjgyNDUgMzAuMTU2OSA2OS42OTEyIDMxLjgxM0M2OS41NjE1IDMyLjQzNzUgNjkuMTAzNyAzMy4wMDg2IDY4LjY5NTYgMzMuNDA1Nkw2OC42MjM1IDM0LjcwODZDNjYuNzgzOSAzNC44NjE3IDY0LjkzMTkgMzUuMTQyMSA2My4wODIxIDM1LjU2NDFDNTUuMTIyNiAzNy4zNzk4IDQ4LjI2OTUgNDEuNDk5MSA0My4wNTIgNDcuMDYwOUM0Mi43MTM0IDQ2LjgyODggNDIuMTIxMSA0Ni40MDE5IDQxLjk0NSA0Ni4yNzEyQzQxLjM5NzcgNDYuMzQ1NCA0MC44NDQ1IDQ2LjUxNTEgNDAuMTI0MSA0Ni4wOTM1QzM4Ljc1MjIgNDUuMTY1NyAzNy41MDI4IDQzLjg4NTEgMzUuOTkxIDQyLjM0MjRDMzUuMjk4MiA0MS42MDQ0IDM0Ljc5NjYgNDAuOTAxOCAzMy45NzM1IDQwLjE5MDRDMzMuNzg2NiA0MC4wMjg5IDMzLjUwMTQgMzkuODEwNCAzMy4yOTIzIDM5LjY0NDJDMzIuNjQ4OSAzOS4xMjg4IDMxLjg5IDM4Ljg2IDMxLjE1NyAzOC44MzQ4QzMwLjIxNDcgMzguODAyNCAyOS4zMDc1IDM5LjE3MjUgMjguNzEzOCAzOS45MjA2QzI3LjY1ODQgNDEuMjUwNiAyNy45OTYzIDQzLjI4MzMgMjkuNDY3MSA0NC40NjE0QzI5LjQ4MiA0NC40NzM0IDI5LjQ5NzkgNDQuNDgyNyAyOS41MTI5IDQ0LjQ5NDNDMjkuNzE1IDQ0LjY1ODkgMjkuOTYyNSA0NC44Njk4IDMwLjE0ODMgNDUuMDA3NkMzMS4wMjE3IDQ1LjY1NTUgMzEuODE5NSA0NS45ODcyIDMyLjY4OTcgNDYuNTAxNUMzNC41MjMxIDQ3LjYzOTEgMzYuMDQzIDQ4LjU4MjMgMzcuMjQ4NiA0OS43MTk2QzM3LjcxOTQgNTAuMjIzNyAzNy44MDE2IDUxLjExMjIgMzcuODY0MyA1MS40OTY0TDM4Ljg0NjggNTIuMzc4MkMzMy41ODcyIDYwLjMzMDggMzEuMTUzIDcwLjE1MzkgMzIuNTkxNSA4MC4xNjI3TDMxLjMwNzcgODAuNTM3OEMzMC45NjkzIDgwLjk3NjggMzAuNDkxMiA4MS42Njc2IDI5Ljk5MTEgODEuODczOEMyOC40MTM4IDgyLjM3MjkgMjYuNjM4NyA4Mi41NTYyIDI0LjQ5NTYgODIuNzgxOUMyMy40ODk0IDgyLjg2NiAyMi42MjEzIDgyLjgxNTggMjEuNTU0NiA4My4wMTg4QzIxLjMxOTggODMuMDYzNSAyMC45OTI3IDgzLjE0OTEgMjAuNzM1OCA4My4yMDk3QzIwLjcyNjkgODMuMjExNiAyMC43MTg2IDgzLjIxNDIgMjAuNzA5NiA4My4yMTYyQzIwLjY5NTYgODMuMjE5NSAyMC42NzcyIDgzLjIyNjMgMjAuNjYzOCA4My4yMjk0QzE4Ljg1NyA4My42NjggMTcuNjk2MyA4NS4zMzY1IDE4LjA2OTkgODYuOTgwNUMxOC40NDM3IDg4LjYyNDggMjAuMjA4NiA4OS42MjQ4IDIyLjAyNjIgODkuMjMxMkMyMi4wMzkzIDg5LjIyODIgMjIuMDU4NCA4OS4yMjc3IDIyLjA3MiA4OS4yMjQ2QzIyLjA5MjYgODkuMjE5OSAyMi4xMTA2IDg5LjIwOTkgMjIuMTMxIDg5LjIwNDlDMjIuMzg0NCA4OS4xNDkgMjIuNzAxOSA4OS4wODY4IDIyLjkyMzYgODkuMDI3MkMyMy45NzIzIDg4Ljc0NTEgMjQuNzMxOCA4OC4zMzA2IDI1LjY3NDYgODcuOTY3N0MyNy43MDI5IDg3LjIzNjggMjkuMzgyOCA4Ni42MjYyIDMxLjAxOTUgODYuMzg4M0MzMS43MDMgODYuMzM0NSAzMi40MjMyIDg2LjgxMiAzMi43ODE0IDg3LjAxMzRMMzQuMTE3NyA4Ni43ODMxQzM3LjE5MjYgOTYuMzYxMyA0My42MzY2IDEwNC4xMDMgNTEuNzk2MyAxMDguOTYxTDUxLjIzOTYgMTEwLjMwM0M1MS40NDAzIDExMC44MjQgNTEuNjYxNiAxMTEuNTMgNTEuNTEyMSAxMTIuMDQ1QzUwLjkxNzEgMTEzLjU5NSA0OS44OTggMTE1LjIzMSA0OC43Mzc0IDExNy4wNTVDNDguMTc1NSAxMTcuODk4IDQ3LjYwMDQgMTE4LjU1MiA0Ny4wOTM0IDExOS41MTZDNDYuOTcyIDExOS43NDcgNDYuODE3NSAxMjAuMTAyIDQ2LjcwMDQgMTIwLjM0NkM0NS45MTI1IDEyMi4wMzkgNDYuNDkwNCAxMjMuOTkgNDguMDAzOCAxMjQuNzIyQzQ5LjUyNjggMTI1LjQ1OSA1MS40MTcxIDEyNC42ODIgNTIuMjM1MiAxMjIuOTg1QzUyLjIzNjQgMTIyLjk4MiA1Mi4yNDA2IDEyMi45OCA1Mi4yNDE3IDEyMi45NzhDNTIuMjQyNiAxMjIuOTc2IDUyLjI0MDkgMTIyLjk3MyA1Mi4yNDE3IDEyMi45NzFDNTIuMzU4MiAxMjIuNzMxIDUyLjUyMzMgMTIyLjQxNSA1Mi42MjE2IDEyMi4xODhDNTMuMDU2IDEyMS4xODkgNTMuMjAwNSAxMjAuMzMyIDUzLjUwNTkgMTE5LjM2NUM1NC4zMTcgMTE3LjMxOCA1NC43NjI2IDExNS4xNyA1NS44NzkxIDExMy44MzJDNTYuMTg0OSAxMTMuNDY2IDU2LjY4MzMgMTEzLjMyNSA1Ny4yMDAxIDExMy4xODZMNTcuODk0NCAxMTEuOTIyQzY1LjAwOCAxMTQuNjY1IDcyLjk3MDUgMTE1LjQwMiA4MC45MjQ1IDExMy41ODdDODIuNzM5MSAxMTMuMTczIDg0LjQ5MDggMTEyLjYzNyA4Ni4xODQzIDExMS45OTRDODYuMzc5NCAxMTIuMzQyIDg2Ljc0MiAxMTMuMDExIDg2LjgzOTMgMTEzLjE3OUM4Ny4zNjQ0IDExMy4zNTEgODcuOTM3NyAxMTMuNDM5IDg4LjQwNDcgMTE0LjEzM0M4OS4yNDAxIDExNS41NjcgODkuODExNCAxMTcuMjYzIDkwLjUwNzMgMTE5LjMxMkM5MC44MTI4IDEyMC4yNzkgOTAuOTYzOCAxMjEuMTM2IDkxLjM5ODEgMTIyLjEzNkM5MS40OTcxIDEyMi4zNjMgOTEuNjYxNCAxMjIuNjg0IDkxLjc3OCAxMjIuOTI1QzkyLjU5NDQgMTI0LjYyOCA5NC40OTA3IDEyNS40MDcgOTYuMDE1OSAxMjQuNjY5Qzk3LjUyOTIgMTIzLjkzNyA5OC4xMDc3IDEyMS45ODYgOTcuMzE5NCAxMjAuMjkzQzk3LjIwMjMgMTIwLjA0OSA5Ny4wNDEyIDExOS42OTUgOTYuOTE5OCAxMTkuNDY0Qzk2LjQxMjcgMTE4LjQ5OSA5NS44Mzc3IDExNy44NTIgOTUuMjc1OCAxMTcuMDA5Qzk0LjExNTIgMTE1LjE4NSA5My4xNTI2IDExMy42NyA5Mi41NTc1IDExMi4xMkM5Mi4zMDg3IDExMS4zMiA5Mi41OTk1IDExMC44MjMgOTIuNzkzMyAxMTAuMzAzQzkyLjY3NzIgMTEwLjE3IDkyLjQyODggMTA5LjQxNCA5Mi4yODI0IDEwOS4wNTlDMTAwLjc2MiAxMDQuMDI5IDEwNy4wMTcgOTUuOTk4NSAxMDkuOTU1IDg2LjcyMzlDMTEwLjM1MSA4Ni43ODY1IDExMS4wNDEgODYuOTA5MSAxMTEuMjY1IDg2Ljk1NDJDMTExLjcyNiA4Ni42NDg3IDExMi4xNDkgODYuMjUwMSAxMTIuOTgxIDg2LjMxNTlDMTE0LjYxNyA4Ni41NTM3IDExNi4yOTcgODcuMTY0NSAxMTguMzI2IDg3Ljg5NTNDMTE5LjI2OCA4OC4yNTgxIDEyMC4wMjggODguNjc5MyAxMjEuMDc3IDg4Ljk2MTRDMTIxLjI5OCA4OS4wMjEgMTIxLjYxNiA4OS4wNzY2IDEyMS44NjkgODkuMTMyNUMxMjEuODg5IDg5LjEzNzUgMTIxLjkwOCA4OS4xNDc1IDEyMS45MjggODkuMTUyMkMxMjEuOTQyIDg5LjE1NTMgMTIxLjk2MSA4OS4xNTU4IDEyMS45NzQgODkuMTU4OEMxMjMuNzkyIDg5LjU1MiAxMjUuNTU3IDg4LjU1MjYgMTI1LjkzIDg2LjkwODFDMTI2LjMwMyA4NS4yNjQxIDEyNS4xNDMgODMuNTk1MiAxMjMuMzM2IDgzLjE1N0MxMjMuMDc0IDgzLjA5NyAxMjIuNzAxIDgyLjk5NSAxMjIuNDQ2IDgyLjk0NjVDMTIxLjM3OSA4Mi43NDM1IDEyMC41MTEgODIuNzkzNSAxMTkuNTA1IDgyLjcwOTVDMTE3LjM2MSA4Mi40ODM5IDExNS41ODYgODIuMzAwNCAxMTQuMDA5IDgxLjgwMTRDMTEzLjM2NiA4MS41NTA3IDExMi45MDggODAuNzgxOSAxMTIuNjg2IDgwLjQ2NTVMMTExLjQ0OCA4MC4xMDM1QzExMi4wOSA3NS40MzggMTExLjkxNyA3MC41ODI1IDExMC44MDYgNjUuNzI0M0MxMDkuNjg1IDYwLjgyMDggMTA3LjcwNCA1Ni4zMzYxIDEwNS4wNjIgNTIuMzg0OEMxMDUuMzc5IDUyLjA5NDggMTA1Ljk3OSA1MS41NjEyIDEwNi4xNDkgNTEuNDA0M0MxMDYuMTk5IDUwLjg1MTcgMTA2LjE1NiA1MC4yNzIyIDEwNi43MjUgNDkuNjYwM0MxMDcuOTMxIDQ4LjUyMyAxMDkuNDUxIDQ3LjU3OTkgMTExLjI4NCA0Ni40NDIzQzExMi4xNTQgNDUuOTI3OSAxMTIuOTU5IDQ1LjU5NjQgMTEzLjgzMiA0NC45NDg0QzExNC4wMyA0NC44MDE5IDExNC4yOTkgNDQuNTY5OSAxMTQuNTA3IDQ0LjQwMjJDMTE1Ljk3NyA0My4yMjM3IDExNi4zMTYgNDEuMTkxMSAxMTUuMjYgMzkuODYxNEMxMTQuMjA0IDM4LjUzMTcgMTEyLjE1OSAzOC40MDY1IDExMC42ODggMzkuNTg1QzExMC40NzkgMzkuNzUxNiAxMTAuMTk1IDM5Ljk2ODggMTEwLjAwNyA0MC4xMzEyQzEwOS4xODQgNDAuODQyNiAxMDguNjc2IDQxLjU0NTIgMTA3Ljk4MyA0Mi4yODMyQzEwNi40NzEgNDMuODI1OSAxMDUuMjIyIDQ1LjExMyAxMDMuODUgNDYuMDQwOUMxMDMuMjU1IDQ2LjM4ODUgMTAyLjM4NSA0Ni4yNjgyIDEwMS45OSA0Ni4yNDQ5TDEwMC44MjQgNDcuMDgwNkM5NC4xNzUzIDQwLjA3NjMgODUuMTIzNSAzNS41OTgyIDc1LjM3NjYgMzQuNzI4M0M3NS4zNDk0IDM0LjMxNzkgNzUuMzEzNyAzMy41NzYxIDc1LjMwNDYgMzMuMzUyOUM3NC45MDU2IDMyLjk2OTMgNzQuNDIzNSAzMi42NDE4IDc0LjMwMjQgMzEuODEzQzc0LjE2OTEgMzAuMTU2OSA3NC4zOTE3IDI4LjM3NTIgNzQuNjQ5NiAyNi4yMjU4Qzc0Ljc5MTkgMjUuMjIxNiA3NS4wMjg0IDI0LjM4NzMgNzUuMDY4OCAyMy4yOTczQzc1LjA3OCAyMy4wNDk1IDc1LjA2MzIgMjIuNjkgNzUuMDYyMiAyMi40MjIxQzc1LjA2MiAyMC41MzIyIDczLjY4OTggMTguOTk5OCA3MS45OTY4IDE5Wk02OC4xNTg1IDQyLjg4ODZMNjcuMjQ4IDU5LjA0NDdMNjcuMTgyNSA1OS4wNzc2QzY3LjEyMTQgNjAuNTIyOSA2NS45Mzc1IDYxLjY3NyA2NC40ODM5IDYxLjY3N0M2My44ODg0IDYxLjY3NyA2My4zMzg4IDYxLjQ4NDkgNjIuODkyMiA2MS4xNTcxTDYyLjg2NiA2MS4xNzAzTDQ5LjY4MDcgNTEuNzc5NEM1My43MzMxIDQ3Ljc3NTkgNTguOTE2NCA0NC44MTcyIDY0Ljg5IDQzLjQ1NDZDNjUuOTgxMiA0My4yMDU2IDY3LjA3MTkgNDMuMDIwOSA2OC4xNTg1IDQyLjg4ODZaTTc1Ljg0MTcgNDIuODg4NkM4Mi44MTU5IDQzLjc1MDQgODkuMjY1NyA0Ni45MjMyIDk0LjIwODEgNTEuNzg2TDgxLjEwOCA2MS4xMTc2TDgxLjA2MjEgNjEuMDk3OUM3OS44OTk0IDYxLjk1MTIgNzguMjYxMSA2MS43Mzk0IDc3LjM1NDggNjAuNTk3OEM3Ni45ODM1IDYwLjEzMDEgNzYuNzg4NyA1OS41ODAxIDc2Ljc2NTMgNTkuMDI0OUw3Ni43NTIyIDU5LjAxODRMNzUuODQxNyA0Mi44ODg2Wk00NC44OTkxIDU3LjgxNEw1Ni45MzgyIDY4LjYzM0w1Ni45MjUxIDY4LjY5ODhDNTguMDExNyA2OS42NDc5IDU4LjE3MiA3MS4yOTQ5IDU3LjI2NTcgNzIuNDM2OEM1Ni44OTQ0IDcyLjkwNDUgNTYuMzk3NSA3My4yMTgyIDU1Ljg2MzkgNzMuMzY0N0w1NS44NTA4IDczLjQxNzNMNDAuNDE4OCA3Ny44OTIzQzM5LjYzMzQgNzAuNjc2NSA0MS4zMjYxIDYzLjY2MjEgNDQuODk5MSA1Ny44MTRaTTk5LjAwOTQgNTcuODIwNkMxMDAuNzk4IDYwLjczMzYgMTAyLjE1MyA2My45ODcxIDEwMi45NTkgNjcuNTE0M0MxMDMuNzU2IDcwLjk5OTEgMTAzLjk1NiA3NC40Nzc4IDEwMy42MjcgNzcuODM5N0w4OC4xMTY2IDczLjM1MTVMODguMTAzNSA3My4yODU3Qzg2LjcxNDUgNzIuOTA0MyA4NS44NjA5IDcxLjQ4NDggODYuMTg0MyA3MC4wNjExQzg2LjMxNjggNjkuNDc3OCA4Ni42MjQ5IDY4Ljk4NDQgODcuMDQyMyA2OC42MTk4TDg3LjAzNTggNjguNTg2OUw5OS4wMDk0IDU3LjgyMDZaTTY5LjUyNzQgNjkuNDY4OEg3NC40NTk2TDc3LjUyNTEgNzMuMzE4Nkw3Ni40MjQ3IDc4LjEyMjZMNzEuOTk2OCA4MC4yNjE0TDY3LjU1NTggNzguMTE2MUw2Ni40NTU0IDczLjMxMkw2OS41Mjc0IDY5LjQ2ODhaTTg1LjMzOTMgODIuNjQzN0M4NS41NDg5IDgyLjYzMzEgODUuNzU3NiA4Mi42NTIgODUuOTYxNiA4Mi42ODk4TDg1Ljk4NzggODIuNjU2OUwxMDEuOTUgODUuMzY4MkM5OS42MTQyIDkxLjk2MjQgOTUuMTQ0IDk3LjY3NSA4OS4xNzExIDEwMS40OThMODIuOTc0NyA4Ni40NjA2TDgyLjk5NDQgODYuNDM0M0M4Mi40MjUyIDg1LjEwNTUgODIuOTk0OCA4My41NDcyIDg0LjMwNDQgODIuOTEzNUM4NC42Mzk3IDgyLjc1MTMgODQuOTkgODIuNjYxNCA4NS4zMzkzIDgyLjY0MzdaTTU4LjUyOTggODIuNzA5NUM1OS43NDggODIuNzI2NyA2MC44NDA2IDgzLjU3NjEgNjEuMTIzNyA4NC44MjJDNjEuMjU2MiA4NS40MDUyIDYxLjE5MTcgODUuOTgzMSA2MC45NzMgODYuNDkzNUw2MS4wMTg5IDg2LjU1MjdMNTQuODg4IDEwMS40MzlDNDkuMTU1OSA5Ny43NDMyIDQ0LjU5MDQgOTIuMjA5OSA0Mi4xNDgxIDg1LjQyMDhMNTcuOTczMSA4Mi43MjI3TDU3Ljk5OTMgODIuNzU1NkM1OC4xNzYzIDgyLjcyMjkgNTguMzU1OCA4Mi43MDcxIDU4LjUyOTggODIuNzA5NVpNNzEuODk4NiA4OS4yMzEyQzcyLjMyMjkgODkuMjE1NSA3Mi43NTM0IDg5LjMwMyA3My4xNjI3IDg5LjUwMUM3My42OTkyIDg5Ljc2MDYgNzQuMTEzNiA5MC4xNjkyIDc0LjM3NDUgOTAuNjU5Mkg3NC40MzM0TDgyLjIzNDYgMTA0LjgyMUM4MS4yMjIxIDEwNS4xNjIgODAuMTgxMyAxMDUuNDU0IDc5LjExNjcgMTA1LjY5N0M3My4xNTA1IDEwNy4wNTggNjcuMjAzMiAxMDYuNjQ1IDYxLjgxOCAxMDQuODAyTDY5LjU5OTUgOTAuNjY1OEg2OS42MTI2QzcwLjA3OTUgODkuNzg4OCA3MC45NjUgODkuMjY1NiA3MS44OTg2IDg5LjIzMTJaIiBmaWxsPSJ3aGl0ZSIgc3Ryb2tlPSJ3aGl0ZSIgc3Ryb2tlLXdpZHRoPSIwLjI1Ii8+CjxkZWZzPgo8bGluZWFyR3JhZGllbnQgaWQ9InBhaW50MF9saW5lYXJfNjgxXzI4NDUiIHgxPSIxMCIgeTE9IjE1LjUiIHgyPSIxNDQiIHkyPSIxMzEuNSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPgo8c3RvcCBzdG9wLWNvbG9yPSIjNEQ4N0ZGIi8+CjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iIzA1NDdEMCIvPgo8L2xpbmVhckdyYWRpZW50Pgo8L2RlZnM+Cjwvc3ZnPgo=
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "storageClass"], ["spec", "nodeGroups"], ["spec", "nodeGroups", "md0"], ["spec", "nodeGroups", "md0", "minReplicas"], ["spec", "nodeGroups", "md0", "maxReplicas"], ["spec", "nodeGroups", "md0", "instanceType"], ["spec", "nodeGroups", "md0", "ephemeralStorage"], ["spec", "nodeGroups", "md0", "roles"], ["spec", "nodeGroups", "md0", "resources"], ["spec", "nodeGroups", "md0", "gpus"], ["spec", "version"], ["spec", "host"], ["spec", "addons"], ["spec", "addons", "certManager"], ["spec", "addons", "certManager", "enabled"], ["spec", "addons", "certManager", "valuesOverride"], ["spec", "addons", "cilium"], ["spec", "addons", "cilium", "valuesOverride"], ["spec", "addons", "gatewayAPI"], ["spec", "addons", "gatewayAPI", "enabled"], ["spec", "addons", "ingressNginx"], ["spec", "addons", "ingressNginx", "enabled"], ["spec", "addons", "ingressNginx", "exposeMethod"], ["spec", "addons", "ingressNginx", "hosts"], ["spec", "addons", "ingressNginx", "valuesOverride"], ["spec", "addons", "gpuOperator"], ["spec", "addons", "gpuOperator", "enabled"], ["spec", "addons", "gpuOperator", "valuesOverride"], ["spec", "addons", "fluxcd"], ["spec", "addons", "fluxcd", "enabled"], ["spec", "addons", "fluxcd", "valuesOverride"], ["spec", "addons", "monitoringAgents"], ["spec", "addons", "monitoringAgents", "enabled"], ["spec", "addons", "monitoringAgents", "valuesOverride"], ["spec", "addons", "verticalPodAutoscaler"], ["spec", "addons", "verticalPodAutoscaler", "valuesOverride"], ["spec", "addons", "velero"], ["spec", "addons", "velero", "enabled"], ["spec", "addons", "velero", "valuesOverride"], ["spec", "addons", "coredns"], ["spec", "addons", "coredns", "valuesOverride"], ["spec", "controlPlane"], ["spec", "controlPlane", "replicas"], ["spec", "controlPlane", "apiServer"], ["spec", "controlPlane", "apiServer", "resources"], ["spec", "controlPlane", "apiServer", "resourcesPreset"], ["spec", "controlPlane", "controllerManager"], ["spec", "controlPlane", "controllerManager", "resources"], ["spec", "controlPlane", "controllerManager", "resourcesPreset"], ["spec", "controlPlane", "scheduler"], ["spec", "controlPlane", "scheduler", "resources"], ["spec", "controlPlane", "scheduler", "resourcesPreset"], ["spec", "controlPlane", "konnectivity"], ["spec", "controlPlane", "konnectivity", "server"], ["spec", "controlPlane", "konnectivity", "server", "resources"], ["spec", "controlPlane", "konnectivity", "server", "resourcesPreset"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "storageClass"], ["spec", "nodeGroups"], ["spec", "nodeGroups", "md0"], ["spec", "nodeGroups", "md0", "minReplicas"], ["spec", "nodeGroups", "md0", "maxReplicas"], ["spec", "nodeGroups", "md0", "instanceType"], ["spec", "nodeGroups", "md0", "ephemeralStorage"], ["spec", "nodeGroups", "md0", "roles"], ["spec", "nodeGroups", "md0", "resources"], ["spec", "nodeGroups", "md0", "gpus"], ["spec", "version"], ["spec", "host"], ["spec", "addons"], ["spec", "addons", "certManager"], ["spec", "addons", "certManager", "enabled"], ["spec", "addons", "certManager", "valuesOverride"], ["spec", "addons", "cilium"], ["spec", "addons", "cilium", "valuesOverride"], ["spec", "addons", "gatewayAPI"], ["spec", "addons", "gatewayAPI", "enabled"], ["spec", "addons", "ingressNginx"], ["spec", "addons", "ingressNginx", "enabled"], ["spec", "addons", "ingressNginx", "exposeMethod"], ["spec", "addons", "ingressNginx", "hosts"], ["spec", "addons", "ingressNginx", "valuesOverride"], ["spec", "addons", "gpuOperator"], ["spec", "addons", "gpuOperator", "enabled"], ["spec", "addons", "gpuOperator", "valuesOverride"], ["spec", "addons", "fluxcd"], ["spec", "addons", "fluxcd", "enabled"], ["spec", "addons", "fluxcd", "valuesOverride"], ["spec", "addons", "monitoringAgents"], ["spec", "addons", "monitoringAgents", "enabled"], ["spec", "addons", "monitoringAgents", "valuesOverride"], ["spec", "addons", "verticalPodAutoscaler"], ["spec", "addons", "verticalPodAutoscaler", "valuesOverride"], ["spec", "addons", "velero"], ["spec", "addons", "velero", "enabled"], ["spec", "addons", "velero", "valuesOverride"], ["spec", "addons", "coredns"], ["spec", "addons", "coredns", "valuesOverride"], ["spec", "controlPlane"], ["spec", "controlPlane", "replicas"], ["spec", "controlPlane", "apiServer"], ["spec", "controlPlane", "apiServer", "resources"], ["spec", "controlPlane", "apiServer", "resourcesPreset"], ["spec", "controlPlane", "controllerManager"], ["spec", "controlPlane", "controllerManager", "resources"], ["spec", "controlPlane", "controllerManager", "resourcesPreset"], ["spec", "controlPlane", "scheduler"], ["spec", "controlPlane", "scheduler", "resources"], ["spec", "controlPlane", "scheduler", "resourcesPreset"], ["spec", "controlPlane", "konnectivity"], ["spec", "controlPlane", "konnectivity", "server"], ["spec", "controlPlane", "konnectivity", "server", "resources"], ["spec", "controlPlane", "konnectivity", "server", "resourcesPreset"], ["spec", "images"], ["spec", "images", "waitForKubeconfig"]]
   secrets:
     exclude: []
     include:

From fb1ef59287114fe9ef6eec2351875139d4d84e97 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Mon, 27 Apr 2026 13:50:18 +0300
Subject: [PATCH 632/666] fix(kubernetes): drop undocumented status-beacon
 annotation from awaiting-etcd ConfigMap

The cozystack.io/status-beacon: "true" annotation had no consumer in
the chart, no documented contract, and no convention defined for other
charts to follow. It would have become accidental precedent for
contributors copying the pattern without understanding it.

The ConfigMap itself is self-explanatory: the name <release>-awaiting-etcd,
data.status: "awaiting-etcd", and the human-readable message in
data.message all surface the same operator signal via kubectl get cm.
Drop the annotation; keep the ConfigMap.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 packages/apps/kubernetes/templates/cluster.yaml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/packages/apps/kubernetes/templates/cluster.yaml b/packages/apps/kubernetes/templates/cluster.yaml
index 12da9818..e1494e64 100644
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -106,8 +106,6 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/name: kubernetes
     app.kubernetes.io/instance: {{ .Release.Name }}
-  annotations:
-    cozystack.io/status-beacon: "true"
 data:
   status: "awaiting-etcd"
   message: |

From 7443e223453032d0a907311f3b5865889b713299 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 27 Apr 2026 17:18:45 +0500
Subject: [PATCH 633/666] build(linstor): include linstor-gui in root image
 build target

The linstor-gui package was added in #2382 with its own per-package
Makefile and Dockerfile, but the root Makefile's `build:` target was
not updated to invoke it. As a result `ghcr.io/cozystack/cozystack/
linstor-gui` has never been published (registry returns NAME_UNKNOWN)
and the chart's `image.tag` was never digest-pinned. Any cluster
deploying the chart hits ImagePullBackOff.

Wire the package into the root build alongside the other system
images. The next CI build will publish the image and the per-package
Makefile will rewrite values.yaml `image.repository`/`image.tag` to a
digest-pinned reference automatically.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Makefile b/Makefile
index 0e94c5e6..5041ac64 100644
--- a/Makefile
+++ b/Makefile
@@ -22,6 +22,7 @@ build: build-deps
 	make -C packages/system/lineage-controller-webhook image
 	make -C packages/system/cilium image
 	make -C packages/system/linstor image
+	make -C packages/system/linstor-gui image
 	make -C packages/system/kubeovn-webhook image
 	make -C packages/system/kubeovn-plunger image
 	make -C packages/system/dashboard image

From a9a66bf066360c340203508fd6072977ff4eb8ea Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 27 Apr 2026 17:31:07 +0500
Subject: [PATCH 634/666] build(linstor): use shared BUILDX_ARGS for
 linstor-gui image build

The per-package Makefile added in #2382 hardcoded buildx flags
(--provenance, --builder, --platform=linux/amd64,linux/arm64,
--push, --load, --label) instead of using the shared $(BUILDX_ARGS)
macro from hack/common-envs.mk.

This broke CI: the runner's default docker driver does not support
multi-platform builds, and the hardcoded multi-arch platform list
crashed `make build` with "Multi-platform build is not supported for
the docker driver."

Replace the hardcoded flags with $(BUILDX_ARGS) to match every other
package (e.g. linstor, dashboard, cilium). $(BUILDX_ARGS) injects
--push, --load, --label, --provenance=false, and only sets --builder
or --platform when the operator explicitly exports BUILDER/PLATFORM.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 packages/system/linstor-gui/Makefile | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/packages/system/linstor-gui/Makefile b/packages/system/linstor-gui/Makefile
index e202f4cc..b408491d 100644
--- a/packages/system/linstor-gui/Makefile
+++ b/packages/system/linstor-gui/Makefile
@@ -12,18 +12,13 @@ image: image-linstor-gui
 
 image-linstor-gui:
 	docker buildx build images/linstor-gui \
-		--provenance false \
-		--builder=$(BUILDER) \
-		--platform=linux/amd64,linux/arm64 \
 		--build-arg LINSTOR_GUI_VERSION=$(LINSTOR_GUI_VERSION) \
 		--tag $(REGISTRY)/linstor-gui:$(call settag,$(LINSTOR_GUI_VERSION)) \
 		--tag $(REGISTRY)/linstor-gui:$(call settag,$(LINSTOR_GUI_VERSION)-$(TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/linstor-gui:latest \
 		--cache-to type=inline \
 		--metadata-file images/linstor-gui.json \
-		--push=$(PUSH) \
-		--label "org.opencontainers.image.source=https://github.com/cozystack/cozystack" \
-		--load=$(LOAD)
+		$(BUILDX_ARGS)
 	REPOSITORY="$(REGISTRY)/linstor-gui" \
 		yq -i '.image.repository = strenv(REPOSITORY)' values.yaml
 	TAG="$(call settag,$(LINSTOR_GUI_VERSION))@$$(yq e '."containerimage.digest"' images/linstor-gui.json -o json -r)" \

From 073fb1630d67ace6655deb262d1734fab98e8ce4 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Mon, 27 Apr 2026 11:32:17 +0200
Subject: [PATCH 635/666] feat(linstor): bump linstor-csi to v1.10.6 with
 Protocol-C dual-attach fix

Bump linstor-csi to v1.10.6 and add an out-of-tree patch that overrides
DrbdOptions/Net/protocol to C on the resource-definition whenever a
volume is attached to a second node with allow-two-primaries (the
live-migration flow), and reverts it on detach.

Without the patch, any KubeVirt live migration of a VM whose volume
sits on a Protocol-A/B resource (for example a "replicated-async"
StorageClass) ends up in a permanent evacuation loop: drbdadm adjust
on the satellite rejects allow-two-primaries with "Protocol C
required" (errno 139), the migration fails, and KubeVirt retries
until manual intervention.

The override is set at the resource-definition level so it covers
every connection, including diskless TieBreaker peers, and is tagged
with an Aux marker so Detach reverts only the override we installed.
The 001 relocate-after-clone patch was regenerated against v1.10.6
(context shift only, no logic change).

Verified end-to-end on dev5: live migration of a KubeVirt VM whose
PVC sits on a Protocol-A resource-group now succeeds in a single
Attach.

Patch is upstreamed as draft PR piraeusdatastore/linstor-csi#435.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/system/linstor/Makefile              |   2 +-
 .../linstor/images/linstor-csi/Dockerfile     |   2 +-
 .../001-relocate-after-clone-restore.diff     |  62 +-------
 ...2-protocol-c-override-for-dual-attach.diff | 132 ++++++++++++++++++
 4 files changed, 140 insertions(+), 58 deletions(-)
 create mode 100644 packages/system/linstor/images/linstor-csi/patches/002-protocol-c-override-for-dual-attach.diff

diff --git a/packages/system/linstor/Makefile b/packages/system/linstor/Makefile
index 2ad4def9..8d566678 100644
--- a/packages/system/linstor/Makefile
+++ b/packages/system/linstor/Makefile
@@ -5,7 +5,7 @@ include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
 LINSTOR_VERSION ?= 1.33.2
-LINSTOR_CSI_VERSION ?= v1.10.5
+LINSTOR_CSI_VERSION ?= v1.10.6
 
 image: image-piraeus-server image-linstor-csi
 
diff --git a/packages/system/linstor/images/linstor-csi/Dockerfile b/packages/system/linstor/images/linstor-csi/Dockerfile
index 6cfd44aa..df5d179d 100644
--- a/packages/system/linstor/images/linstor-csi/Dockerfile
+++ b/packages/system/linstor/images/linstor-csi/Dockerfile
@@ -1,6 +1,6 @@
 FROM golang:1.25 AS builder
 
-ARG VERSION=v1.10.5
+ARG VERSION=v1.10.6
 ARG LINSTOR_WAIT_UNTIL_VERSION=v0.3.1
 ARG TARGETARCH
 ARG TARGETOS
diff --git a/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff b/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
index ff0aec0c..0e272670 100644
--- a/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
+++ b/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
@@ -1,25 +1,7 @@
 diff --git a/pkg/client/linstor.go b/pkg/client/linstor.go
-index f544493..98e7fde 100644
+index ac4651d..46d565d 100644
 --- a/pkg/client/linstor.go
 +++ b/pkg/client/linstor.go
-@@ -181,7 +181,7 @@ func LogLevel(s string) func(*Linstor) error {
- func (s *Linstor) ListAllWithStatus(ctx context.Context) ([]volume.VolumeStatus, error) {
- 	var vols []volume.VolumeStatus
- 
--	resourcesByName := make(map[string][]lapi.Resource)
-+	resourcesByName := make(map[string][]lapi.ResourceWithVolumes)
- 
- 	resDefs, err := s.client.ResourceDefinitions.GetAll(ctx, lapi.RDGetAllRequest{WithVolumeDefinitions: true})
- 	if err != nil {
-@@ -194,7 +194,7 @@ func (s *Linstor) ListAllWithStatus(ctx context.Context) ([]volume.VolumeStatus,
- 	}
- 
- 	for i := range allResources {
--		resourcesByName[allResources[i].Name] = append(resourcesByName[allResources[i].Name], allResources[i].Resource)
-+		resourcesByName[allResources[i].Name] = append(resourcesByName[allResources[i].Name], allResources[i])
- 	}
- 
- 	for _, rd := range resDefs {
 @@ -462,6 +462,14 @@ func (s *Linstor) Clone(ctx context.Context, vol, src *volume.Info, params *volu
  		return err
  	}
@@ -35,7 +17,7 @@ index f544493..98e7fde 100644
  	logger.Debug("reconcile extra properties")
  
  	err = s.client.ResourceDefinitions.Modify(ctx, vol.ID, lapi.GenericPropsModify{OverrideProps: vol.Properties})
-@@ -1280,6 +1288,14 @@ func (s *Linstor) VolFromSnap(ctx context.Context, snap *volume.Snapshot, vol *v
+@@ -1297,6 +1305,14 @@ func (s *Linstor) VolFromSnap(ctx context.Context, snap *volume.Snapshot, vol *v
  		return err
  	}
  
@@ -50,7 +32,7 @@ index f544493..98e7fde 100644
  	logger.Debug("reconcile extra properties")
  
  	err = s.client.ResourceDefinitions.Modify(ctx, vol.ID, lapi.GenericPropsModify{OverrideProps: vol.Properties})
-@@ -1470,9 +1486,8 @@ func (s *Linstor) reconcileSnapshotResources(ctx context.Context, snapshot *volu
+@@ -1487,9 +1503,8 @@ func (s *Linstor) reconcileSnapshotResources(ctx context.Context, snapshot *volu
  		return fmt.Errorf("snapshot '%s' not deployed on any node", snap.Name)
  	}
  
@@ -62,7 +44,7 @@ index f544493..98e7fde 100644
  	for _, snapNode := range snap.Nodes {
  		if err := s.NodeAvailable(ctx, snapNode); err != nil {
  			logger.WithField("selected node candidate", snapNode).WithError(err).Debug("node is not available")
-@@ -1480,13 +1495,23 @@ func (s *Linstor) reconcileSnapshotResources(ctx context.Context, snapshot *volu
+@@ -1497,13 +1512,23 @@ func (s *Linstor) reconcileSnapshotResources(ctx context.Context, snapshot *volu
  		}
  
  		if slices.Contains(preferredNodes, snapNode) {
@@ -92,7 +74,7 @@ index f544493..98e7fde 100644
  	}
  
  	if selectedNode == "" {
-@@ -1679,6 +1704,114 @@ func (s *Linstor) reconcileResourcePlacement(ctx context.Context, vol *volume.In
+@@ -1696,6 +1721,114 @@ func (s *Linstor) reconcileResourcePlacement(ctx context.Context, vol *volume.In
  	return nil
  }
  
@@ -207,40 +189,8 @@ index f544493..98e7fde 100644
  // FindSnapsByID searches the snapshot in the backend
  func (s *Linstor) FindSnapsByID(ctx context.Context, id string) ([]*volume.Snapshot, error) {
  	snapshotId, err := volume.ParseSnapshotId(id)
-@@ -2173,7 +2306,7 @@ func (s *Linstor) Status(ctx context.Context, volId string) ([]string, *csi.Volu
- 		"volume": volId,
- 	}).Debug("getting assignments")
- 
--	ress, err := s.client.Resources.GetAll(ctx, volId)
-+	ress, err := s.client.Resources.GetResourceView(ctx, &lapi.ListOpts{Resource: []string{volId}})
- 	if err != nil {
- 		return nil, nil, fmt.Errorf("failed to list resources for '%s': %w", volId, err)
- 	}
-@@ -2261,13 +2394,20 @@ func GetSnapshotRemoteAndReadiness(snap *lapi.Snapshot) (string, bool, error) {
- 	return "", slices.Contains(snap.Flags, lapiconsts.FlagSuccessful), nil
- }
- 
--func NodesAndConditionFromResources(ress []lapi.Resource) ([]string, *csi.VolumeCondition) {
-+func NodesAndConditionFromResources(ress []lapi.ResourceWithVolumes) ([]string, *csi.VolumeCondition) {
- 	var allNodes, abnormalNodes []string
- 
- 	for i := range ress {
- 		res := &ress[i]
- 
--		allNodes = append(allNodes, res.NodeName)
-+		// A resource is a CSI publish target if any of its volumes were created
-+		// by ControllerPublishVolume, identified by the temporary-diskless-attach property.
-+		if slices.ContainsFunc(res.Volumes, func(v lapi.Volume) bool {
-+			createdFor, ok := v.Props[linstor.PropertyCreatedFor]
-+			return ok && createdFor == linstor.CreatedForTemporaryDisklessAttach
-+		}) {
-+			allNodes = append(allNodes, res.NodeName)
-+		}
- 
- 		if res.State == nil {
- 			abnormalNodes = append(abnormalNodes, res.NodeName)
 diff --git a/pkg/volume/parameter.go b/pkg/volume/parameter.go
-index 39acd95..aed18ab 100644
+index 39acd95..54d1dfb 100644
 --- a/pkg/volume/parameter.go
 +++ b/pkg/volume/parameter.go
 @@ -50,6 +50,7 @@ const (
diff --git a/packages/system/linstor/images/linstor-csi/patches/002-protocol-c-override-for-dual-attach.diff b/packages/system/linstor/images/linstor-csi/patches/002-protocol-c-override-for-dual-attach.diff
new file mode 100644
index 00000000..279c636b
--- /dev/null
+++ b/packages/system/linstor/images/linstor-csi/patches/002-protocol-c-override-for-dual-attach.diff
@@ -0,0 +1,132 @@
+diff --git a/pkg/client/linstor.go b/pkg/client/linstor.go
+index ac4651d..9d75c79 100644
+--- a/pkg/client/linstor.go
++++ b/pkg/client/linstor.go
+@@ -653,11 +653,35 @@ func (s *Linstor) Attach(ctx context.Context, volId, node string, rwxBlock bool)
+ 	}
+ 
+ 	if otherResInUse > 0 && rwxBlock {
+-		rdPropsModify := lapi.GenericPropsModify{OverrideProps: map[string]string{
++		rdProps := map[string]string{
+ 			linstor.PropertyAllowTwoPrimaries: "yes",
+-		}}
++		}
+ 
+-		err = s.client.ResourceDefinitions.Modify(ctx, volId, rdPropsModify)
++		// DRBD requires Protocol C whenever allow-two-primaries is enabled.
++		// If the resource is configured with Protocol A or B (typically
++		// through its resource-group), drbdadm adjust on the satellites
++		// fails with "Protocol C required" (errno 139) and live migration
++		// cannot proceed. Override Protocol to C on the resource-definition
++		// itself so it applies to every connection (including diskless
++		// peers, e.g. a TieBreaker). The marker lets Detach revert exactly
++		// the override we installed without disturbing operator-set props.
++		proto, protoErr := s.getEffectiveDrbdProtocol(ctx, volId)
++		if protoErr != nil {
++			s.log.WithError(protoErr).WithField("volume", volId).
++				Warn("failed to determine effective DRBD protocol; skipping Protocol=C override for dual-attach")
++		} else if proto == "A" || proto == "B" {
++			s.log.WithFields(logrus.Fields{
++				"volume":   volId,
++				"protocol": proto,
++			}).Info("installing Protocol=C override on resource-definition for dual-attach")
++
++			rdProps[linstor.PropertyDrbdNetProtocol] = "C"
++			rdProps[linstor.PropertyCsiProtocolOverride] = "yes"
++		}
++
++		err = s.client.ResourceDefinitions.Modify(ctx, volId, lapi.GenericPropsModify{
++			OverrideProps: rdProps,
++		})
+ 		if err != nil {
+ 			return "", err
+ 		}
+@@ -774,11 +798,26 @@ func (s *Linstor) Detach(ctx context.Context, volId, node string) error {
+ 	}
+ 
+ 	if resInUse == 1 {
+-		rdPropsModify := lapi.GenericPropsModify{DeleteProps: []string{
+-			linstor.PropertyAllowTwoPrimaries,
+-		}}
++		deleteProps := []string{linstor.PropertyAllowTwoPrimaries}
++
++		// Drop the Protocol=C override only if Attach installed it (gated by
++		// our marker), so an operator-set Protocol property on the
++		// resource-definition is preserved.
++		rd, getErr := s.client.ResourceDefinitions.Get(ctx, volId)
++		if getErr != nil {
++			log.WithError(getErr).Warn("failed to fetch resource-definition props; skipping Protocol=C override removal")
++		} else if rd.Props[linstor.PropertyCsiProtocolOverride] != "" {
++			log.Info("removing Protocol=C override from resource-definition")
+ 
+-		err = s.client.ResourceDefinitions.Modify(ctx, volId, rdPropsModify)
++			deleteProps = append(deleteProps,
++				linstor.PropertyDrbdNetProtocol,
++				linstor.PropertyCsiProtocolOverride,
++			)
++		}
++
++		err = s.client.ResourceDefinitions.Modify(ctx, volId, lapi.GenericPropsModify{
++			DeleteProps: deleteProps,
++		})
+ 		if err != nil {
+ 			return nil404(err)
+ 		}
+@@ -805,6 +844,33 @@ func (s *Linstor) Detach(ctx context.Context, volId, node string) error {
+ 	return nil404(s.client.Resources.Delete(ctx, volId, node))
+ }
+ 
++// getEffectiveDrbdProtocol returns the DRBD network protocol ("A", "B" or "C")
++// that LINSTOR will hand to drbdadm for the given resource. Resource-definition
++// properties take precedence; otherwise the value is inherited from the
++// resource-group. An empty string is returned when neither level sets the
++// property (LINSTOR's compiled-in default is "C").
++func (s *Linstor) getEffectiveDrbdProtocol(ctx context.Context, volId string) (string, error) {
++	rd, err := s.client.ResourceDefinitions.Get(ctx, volId)
++	if err != nil {
++		return "", err
++	}
++
++	if v, ok := rd.Props[linstor.PropertyDrbdNetProtocol]; ok {
++		return v, nil
++	}
++
++	if rd.ResourceGroupName == "" {
++		return "", nil
++	}
++
++	rg, err := s.client.ResourceGroups.Get(ctx, rd.ResourceGroupName)
++	if err != nil {
++		return "", err
++	}
++
++	return rg.Props[linstor.PropertyDrbdNetProtocol], nil
++}
++
+ // CapacityBytes returns the amount of free space in the storage pool specified by the params and topology.
+ func (s *Linstor) CapacityBytes(ctx context.Context, storagePools []string, overProvision *float64, segments map[string]string) (int64, error) {
+ 	log := s.log.WithField("storage-pools", storagePools).WithField("segments", segments)
+diff --git a/pkg/linstor/const.go b/pkg/linstor/const.go
+index 9a5f79c..c8bc9c3 100644
+--- a/pkg/linstor/const.go
++++ b/pkg/linstor/const.go
+@@ -44,6 +44,19 @@ const (
+ 	// PropertyAllowTwoPrimaries is DRBD option to allow second primary. Mainly used for live-migration.
+ 	PropertyAllowTwoPrimaries = lc.NamespcDrbdNetOptions + "/allow-two-primaries"
+ 
++	// PropertyDrbdNetProtocol is the DRBD network replication protocol option
++	// (A = async, B = semi-sync, C = sync). DRBD requires Protocol C whenever
++	// allow-two-primaries is enabled, otherwise drbdadm adjust fails with
++	// "Protocol C required" (errno 139).
++	PropertyDrbdNetProtocol = lc.NamespcDrbdNetOptions + "/protocol"
++
++	// PropertyCsiProtocolOverride marks a resource-connection where this driver
++	// has installed a temporary Protocol=C override to make a Protocol-A/B
++	// resource compatible with allow-two-primaries during live migration. The
++	// marker lets us safely remove only the overrides we set, without touching
++	// connection-level overrides installed by the operator.
++	PropertyCsiProtocolOverride = lc.NamespcAuxiliary + "/csi-protocol-override"
++
+ 	// CreatedForTemporaryDisklessAttach marks a resource as temporary, i.e. it should be removed after it is no longer
+ 	// needed.
+ 	CreatedForTemporaryDisklessAttach = "temporary-diskless-attach"

From 80631bc9160a4567cce8facdf781799f15455497 Mon Sep 17 00:00:00 2001
From: mattia-eleuteri <mattia@hidora.io>
Date: Mon, 27 Apr 2026 16:29:05 +0200
Subject: [PATCH 636/666] [vm-instance] Set wholeIP annotation conditionally on
 externalMethod
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Render `networking.cozystack.io/wholeIP: "false"` on the Service when
`externalMethod: PortList` is configured (was always `"true"` before).
Combined with cozy-proxy v0.3.0+ which adds per-port filtering for
"false"-annotated services, this makes `externalMethod: PortList`
behave as documented: only ports listed in `externalPorts` are
reachable from the LoadBalancer IP.

Backward-compatible: existing services with `externalMethod: WholeIP`
continue to set `wholeIP: "true"` and behave identically. cozy-proxy
versions older than v0.3.0 ignore Services with `wholeIP: "false"`,
which means PortList Services on older cozy-proxy will lose their
egress IP preservation — but that path was already non-functional
ingress-wise, so this is not a regression for users actually relying
on PortList.

Signed-off-by: mattia-eleuteri <mattia@hidora.io>
---
 docs/changelogs/v1.3.1.md                        | 11 +++++++++++
 packages/apps/vm-instance/templates/service.yaml |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)
 create mode 100644 docs/changelogs/v1.3.1.md

diff --git a/docs/changelogs/v1.3.1.md b/docs/changelogs/v1.3.1.md
new file mode 100644
index 00000000..7f9ecfab
--- /dev/null
+++ b/docs/changelogs/v1.3.1.md
@@ -0,0 +1,11 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.3.1
+-->
+
+## Bug Fixes
+
+* **[vm-instance] Fix `externalMethod: PortList` not filtering ingress ports**: The `vm-instance` chart now sets `networking.cozystack.io/wholeIP: "false"` on the rendered Service when `externalMethod: PortList` is configured, signaling cozy-proxy to install per-port ingress filtering based on `Service.spec.ports`. Previously the annotation was always `"true"`, which kept cozy-proxy in whole-IP passthrough mode and made `PortList` non-functional. **Requires cozy-proxy v0.3.0 or later** (bundled with this chart). ([@mattia-eleuteri](https://github.com/mattia-eleuteri) in #<TBD>).
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.3.0...v1.3.1
diff --git a/packages/apps/vm-instance/templates/service.yaml b/packages/apps/vm-instance/templates/service.yaml
index b7e3a420..4607ffcf 100644
--- a/packages/apps/vm-instance/templates/service.yaml
+++ b/packages/apps/vm-instance/templates/service.yaml
@@ -9,7 +9,7 @@ metadata:
 {{- if .Values.external }}
     service.kubernetes.io/service-proxy-name: "cozy-proxy"
   annotations:
-    networking.cozystack.io/wholeIP: "true"
+    networking.cozystack.io/wholeIP: {{ ternary "true" "false" (eq .Values.externalMethod "WholeIP") | quote }}
 {{- end }}
 spec:
   type: {{ ternary "LoadBalancer" "ClusterIP" .Values.external }}

From b0afc9a07c8a842915af1fa98ff1e7d17ccb39c8 Mon Sep 17 00:00:00 2001
From: mattia-eleuteri <mattia@hidora.io>
Date: Tue, 28 Apr 2026 08:37:13 +0200
Subject: [PATCH 637/666] [vm-instance] Add externalAllowICMP knob, drop in-PR
 changelog

- Add `externalAllowICMP` value (default true) propagated as
  `networking.cozystack.io/allowICMP` annotation on the rendered Service
  when `externalMethod: PortList`. The cozy-proxy companion (released as
  part of cozystack/cozy-proxy#11 + #12) drops ICMP by default in
  port-filter mode, which breaks ping and PMTU discovery; defaulting the
  chart to "true" preserves user expectations while still allowing
  operators to opt out by setting `externalAllowICMP: false`.

- Remove the v1.3.1.md changelog entry. Project convention is to add
  changelogs in a dedicated "docs: add changelog for vX.Y.Z" commit at
  release time, not as part of feature/fix PRs.

Signed-off-by: mattia-eleuteri <mattia@hidora.io>
---
 api/apps/v1alpha1/vminstance/types.go         |  3 ++
 docs/changelogs/v1.3.1.md                     | 11 ----
 packages/apps/vm-instance/README.md           | 51 ++++++++++---------
 .../apps/vm-instance/templates/service.yaml   |  3 ++
 packages/apps/vm-instance/values.schema.json  |  5 ++
 packages/apps/vm-instance/values.yaml         |  3 ++
 .../vm-instance-rd/cozyrds/vm-instance.yaml   |  4 +-
 7 files changed, 42 insertions(+), 38 deletions(-)
 delete mode 100644 docs/changelogs/v1.3.1.md

diff --git a/api/apps/v1alpha1/vminstance/types.go b/api/apps/v1alpha1/vminstance/types.go
index 2bb059c6..9c48724a 100644
--- a/api/apps/v1alpha1/vminstance/types.go
+++ b/api/apps/v1alpha1/vminstance/types.go
@@ -26,6 +26,9 @@ type ConfigSpec struct {
 	// Ports to forward from outside the cluster.
 	// +kubebuilder:default:={22}
 	ExternalPorts []int `json:"externalPorts,omitempty"`
+	// Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect.
+	// +kubebuilder:default:=true
+	ExternalAllowICMP bool `json:"externalAllowICMP"`
 	// Requested running state of the VirtualMachineInstance
 	// +kubebuilder:default:="Always"
 	RunStrategy RunStrategy `json:"runStrategy"`
diff --git a/docs/changelogs/v1.3.1.md b/docs/changelogs/v1.3.1.md
deleted file mode 100644
index 7f9ecfab..00000000
--- a/docs/changelogs/v1.3.1.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v1.3.1
--->
-
-## Bug Fixes
-
-* **[vm-instance] Fix `externalMethod: PortList` not filtering ingress ports**: The `vm-instance` chart now sets `networking.cozystack.io/wholeIP: "false"` on the rendered Service when `externalMethod: PortList` is configured, signaling cozy-proxy to install per-port ingress filtering based on `Service.spec.ports`. Previously the annotation was always `"true"`, which kept cozy-proxy in whole-IP passthrough mode and made `PortList` non-functional. **Requires cozy-proxy v0.3.0 or later** (bundled with this chart). ([@mattia-eleuteri](https://github.com/mattia-eleuteri) in #<TBD>).
-
----
-
-**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.3.0...v1.3.1
diff --git a/packages/apps/vm-instance/README.md b/packages/apps/vm-instance/README.md
index a2b6603e..9d6a52b2 100644
--- a/packages/apps/vm-instance/README.md
+++ b/packages/apps/vm-instance/README.md
@@ -36,31 +36,32 @@ virtctl ssh <user>@<vm>
 
 ### Common parameters
 
-| Name                | Description                                                                                                                       | Type       | Value       |
-| ------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ---------- | ----------- |
-| `external`          | Enable external access from outside the cluster.                                                                                  | `bool`     | `false`     |
-| `externalMethod`    | Method to pass through traffic to the VM.                                                                                         | `string`   | `PortList`  |
-| `externalPorts`     | Ports to forward from outside the cluster.                                                                                        | `[]int`    | `[22]`      |
-| `runStrategy`       | Requested running state of the VirtualMachineInstance                                                                             | `string`   | `Always`    |
-| `instanceType`      | Virtual Machine instance type.                                                                                                    | `string`   | `u1.medium` |
-| `instanceProfile`   | Virtual Machine preferences profile.                                                                                              | `string`   | `ubuntu`    |
-| `disks`             | List of disks to attach.                                                                                                          | `[]object` | `[]`        |
-| `disks[i].name`     | Disk name.                                                                                                                        | `string`   | `""`        |
-| `disks[i].bus`      | Disk bus type (e.g. "sata").                                                                                                      | `string`   | `""`        |
-| `networks`          | Networks to attach the VM to.                                                                                                     | `[]object` | `[]`        |
-| `networks[i].name`  | Network attachment name.                                                                                                          | `string`   | `""`        |
-| `subnets`           | Deprecated: use networks instead.                                                                                                 | `[]object` | `[]`        |
-| `subnets[i].name`   | Network attachment name.                                                                                                          | `string`   | `""`        |
-| `gpus`              | List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).                                                               | `[]object` | `[]`        |
-| `gpus[i].name`      | The name of the GPU resource to attach.                                                                                           | `string`   | `""`        |
-| `cpuModel`          | Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map | `string`   | `""`        |
-| `resources`         | Resource configuration for the virtual machine.                                                                                   | `object`   | `{}`        |
-| `resources.cpu`     | Number of CPU cores allocated.                                                                                                    | `quantity` | `""`        |
-| `resources.memory`  | Amount of memory allocated.                                                                                                       | `quantity` | `""`        |
-| `resources.sockets` | Number of CPU sockets (vCPU topology).                                                                                            | `quantity` | `""`        |
-| `sshKeys`           | List of SSH public keys for authentication.                                                                                       | `[]string` | `[]`        |
-| `cloudInit`         | Cloud-init user data.                                                                                                             | `string`   | `""`        |
-| `cloudInitSeed`     | Seed string to generate SMBIOS UUID for the VM.                                                                                   | `string`   | `""`        |
+| Name                | Description                                                                                                                                                                                                   | Type       | Value       |
+| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | ----------- |
+| `external`          | Enable external access from outside the cluster.                                                                                                                                                              | `bool`     | `false`     |
+| `externalMethod`    | Method to pass through traffic to the VM.                                                                                                                                                                     | `string`   | `PortList`  |
+| `externalPorts`     | Ports to forward from outside the cluster.                                                                                                                                                                    | `[]int`    | `[22]`      |
+| `externalAllowICMP` | Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect. | `bool`     | `true`      |
+| `runStrategy`       | Requested running state of the VirtualMachineInstance                                                                                                                                                         | `string`   | `Always`    |
+| `instanceType`      | Virtual Machine instance type.                                                                                                                                                                                | `string`   | `u1.medium` |
+| `instanceProfile`   | Virtual Machine preferences profile.                                                                                                                                                                          | `string`   | `ubuntu`    |
+| `disks`             | List of disks to attach.                                                                                                                                                                                      | `[]object` | `[]`        |
+| `disks[i].name`     | Disk name.                                                                                                                                                                                                    | `string`   | `""`        |
+| `disks[i].bus`      | Disk bus type (e.g. "sata").                                                                                                                                                                                  | `string`   | `""`        |
+| `networks`          | Networks to attach the VM to.                                                                                                                                                                                 | `[]object` | `[]`        |
+| `networks[i].name`  | Network attachment name.                                                                                                                                                                                      | `string`   | `""`        |
+| `subnets`           | Deprecated: use networks instead.                                                                                                                                                                             | `[]object` | `[]`        |
+| `subnets[i].name`   | Network attachment name.                                                                                                                                                                                      | `string`   | `""`        |
+| `gpus`              | List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).                                                                                                                                           | `[]object` | `[]`        |
+| `gpus[i].name`      | The name of the GPU resource to attach.                                                                                                                                                                       | `string`   | `""`        |
+| `cpuModel`          | Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map                                                                             | `string`   | `""`        |
+| `resources`         | Resource configuration for the virtual machine.                                                                                                                                                               | `object`   | `{}`        |
+| `resources.cpu`     | Number of CPU cores allocated.                                                                                                                                                                                | `quantity` | `""`        |
+| `resources.memory`  | Amount of memory allocated.                                                                                                                                                                                   | `quantity` | `""`        |
+| `resources.sockets` | Number of CPU sockets (vCPU topology).                                                                                                                                                                        | `quantity` | `""`        |
+| `sshKeys`           | List of SSH public keys for authentication.                                                                                                                                                                   | `[]string` | `[]`        |
+| `cloudInit`         | Cloud-init user data.                                                                                                                                                                                         | `string`   | `""`        |
+| `cloudInitSeed`     | Seed string to generate SMBIOS UUID for the VM.                                                                                                                                                               | `string`   | `""`        |
 
 
 ## U Series
diff --git a/packages/apps/vm-instance/templates/service.yaml b/packages/apps/vm-instance/templates/service.yaml
index 4607ffcf..cfeffa81 100644
--- a/packages/apps/vm-instance/templates/service.yaml
+++ b/packages/apps/vm-instance/templates/service.yaml
@@ -10,6 +10,9 @@ metadata:
     service.kubernetes.io/service-proxy-name: "cozy-proxy"
   annotations:
     networking.cozystack.io/wholeIP: {{ ternary "true" "false" (eq .Values.externalMethod "WholeIP") | quote }}
+    {{- if eq .Values.externalMethod "PortList" }}
+    networking.cozystack.io/allowICMP: {{ ternary "true" "false" (ne .Values.externalAllowICMP false) | quote }}
+    {{- end }}
 {{- end }}
 spec:
   type: {{ ternary "LoadBalancer" "ClusterIP" .Values.external }}
diff --git a/packages/apps/vm-instance/values.schema.json b/packages/apps/vm-instance/values.schema.json
index 34f7f634..01bd30a9 100644
--- a/packages/apps/vm-instance/values.schema.json
+++ b/packages/apps/vm-instance/values.schema.json
@@ -26,6 +26,11 @@
         "type": "integer"
       }
     },
+    "externalAllowICMP": {
+      "description": "Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect.",
+      "type": "boolean",
+      "default": true
+    },
     "runStrategy": {
       "description": "Requested running state of the VirtualMachineInstance",
       "type": "string",
diff --git a/packages/apps/vm-instance/values.yaml b/packages/apps/vm-instance/values.yaml
index f07b75d3..92e399c2 100644
--- a/packages/apps/vm-instance/values.yaml
+++ b/packages/apps/vm-instance/values.yaml
@@ -31,6 +31,9 @@ externalMethod: PortList
 externalPorts:
 - 22
 
+## @param {bool} externalAllowICMP - Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect.
+externalAllowICMP: true
+
 ## @enum {string} RunStrategy - Requested running state of the VirtualMachineInstance
 ## @value Always - VMI should always be running
 ## @value Halted - VMI should never be running
diff --git a/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml b/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml
index e93fa86b..e56bd9dd 100644
--- a/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml
+++ b/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml
@@ -8,7 +8,7 @@ spec:
     singular: vminstance
     plural: vminstances
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"externalMethod":{"description":"Method to pass through traffic to the VM.","type":"string","default":"PortList","enum":["PortList","WholeIP"]},"externalPorts":{"description":"Ports to forward from outside the cluster.","type":"array","default":[22],"items":{"type":"integer"}},"runStrategy":{"description":"Requested running state of the VirtualMachineInstance","type":"string","default":"Always","enum":["Always","Halted","Manual","RerunOnFailure","Once"]},"instanceType":{"description":"Virtual Machine instance type.","type":"string","default":"u1.medium"},"instanceProfile":{"description":"Virtual Machine preferences profile.","type":"string","default":"ubuntu","enum":["alpine","centos.7","centos.7.desktop","centos.stream10","centos.stream10.desktop","centos.stream8","centos.stream8.desktop","centos.stream8.dpdk","centos.stream9","centos.stream9.desktop","centos.stream9.dpdk","cirros","fedora","fedora.arm64","opensuse.leap","opensuse.tumbleweed","rhel.10","rhel.10.arm64","rhel.7","rhel.7.desktop","rhel.8","rhel.8.desktop","rhel.8.dpdk","rhel.9","rhel.9.arm64","rhel.9.desktop","rhel.9.dpdk","rhel.9.realtime","sles","ubuntu","windows.10","windows.10.virtio","windows.11","windows.11.virtio","windows.2k16","windows.2k16.virtio","windows.2k19","windows.2k19.virtio","windows.2k22","windows.2k22.virtio","windows.2k25","windows.2k25.virtio",""]},"disks":{"description":"List of disks to attach.","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"bus":{"description":"Disk bus type (e.g. \"sata\").","type":"string"},"name":{"description":"Disk name.","type":"string"}}}},"networks":{"description":"Networks to attach the VM to.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"subnets":{"description":"Deprecated: use networks instead.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"name":{"description":"The name of the GPU resource to attach.","type":"string"}}}},"cpuModel":{"description":"Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map","type":"string","default":""},"resources":{"description":"Resource configuration for the virtual machine.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"sockets":{"description":"Number of CPU sockets (vCPU topology).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"sshKeys":{"description":"List of SSH public keys for authentication.","type":"array","default":[],"items":{"type":"string"}},"cloudInit":{"description":"Cloud-init user data.","type":"string","default":""},"cloudInitSeed":{"description":"Seed string to generate SMBIOS UUID for the VM.","type":"string","default":""}}}
+      {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"externalMethod":{"description":"Method to pass through traffic to the VM.","type":"string","default":"PortList","enum":["PortList","WholeIP"]},"externalPorts":{"description":"Ports to forward from outside the cluster.","type":"array","default":[22],"items":{"type":"integer"}},"externalAllowICMP":{"description":"Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect.","type":"boolean","default":true},"runStrategy":{"description":"Requested running state of the VirtualMachineInstance","type":"string","default":"Always","enum":["Always","Halted","Manual","RerunOnFailure","Once"]},"instanceType":{"description":"Virtual Machine instance type.","type":"string","default":"u1.medium"},"instanceProfile":{"description":"Virtual Machine preferences profile.","type":"string","default":"ubuntu","enum":["alpine","centos.7","centos.7.desktop","centos.stream10","centos.stream10.desktop","centos.stream8","centos.stream8.desktop","centos.stream8.dpdk","centos.stream9","centos.stream9.desktop","centos.stream9.dpdk","cirros","fedora","fedora.arm64","opensuse.leap","opensuse.tumbleweed","rhel.10","rhel.10.arm64","rhel.7","rhel.7.desktop","rhel.8","rhel.8.desktop","rhel.8.dpdk","rhel.9","rhel.9.arm64","rhel.9.desktop","rhel.9.dpdk","rhel.9.realtime","sles","ubuntu","windows.10","windows.10.virtio","windows.11","windows.11.virtio","windows.2k16","windows.2k16.virtio","windows.2k19","windows.2k19.virtio","windows.2k22","windows.2k22.virtio","windows.2k25","windows.2k25.virtio",""]},"disks":{"description":"List of disks to attach.","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"bus":{"description":"Disk bus type (e.g. \"sata\").","type":"string"},"name":{"description":"Disk name.","type":"string"}}}},"networks":{"description":"Networks to attach the VM to.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"subnets":{"description":"Deprecated: use networks instead.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"name":{"description":"The name of the GPU resource to attach.","type":"string"}}}},"cpuModel":{"description":"Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map","type":"string","default":""},"resources":{"description":"Resource configuration for the virtual machine.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"sockets":{"description":"Number of CPU sockets (vCPU topology).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"sshKeys":{"description":"List of SSH public keys for authentication.","type":"array","default":[],"items":{"type":"string"}},"cloudInit":{"description":"Cloud-init user data.","type":"string","default":""},"cloudInitSeed":{"description":"Seed string to generate SMBIOS UUID for the VM.","type":"string","default":""}}}
   release:
     prefix: vm-instance-
     labels:
@@ -26,7 +26,7 @@ spec:
     tags:
       - compute
     icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl82ODdfMzQ1NCkiLz4KPGcgY2xpcC1wYXRoPSJ1cmwoI2NsaXAwXzY4N18zNDU0KSI+CjxwYXRoIGQ9Ik04OS41MDM5IDExMS43MDdINTQuNDk3QzU0LjE3MjcgMTExLjcwNyA1NC4wMTA4IDExMS4yMjEgNTQuMzM0OSAxMTEuMDU5TDU3LjI1MjIgMTA4Ljk1MkM2MC4zMzE0IDEwNi42ODMgNjEuOTUyMiAxMDIuNjMxIDYwLjk3OTcgOTguNzQxMkg4My4wMjFDODIuMDQ4NSAxMDIuNjMxIDgzLjY2OTMgMTA2LjY4MyA4Ni43NDg1IDEwOC45NTJMODkuNjY1OCAxMTEuMDU5Qzg5Ljk5IDExMS4yMjEgODkuODI3OSAxMTEuNzA3IDg5LjUwMzkgMTExLjcwN1oiIGZpbGw9IiNCMEI2QkIiLz4KPHBhdGggZD0iTTExMy4zMjggOTguNzQxSDMwLjY3MjVDMjcuNTkzMSA5OC43NDEgMjUgOTYuMTQ4IDI1IDkzLjA2ODdWMzMuMTAzMkMyNSAzMC4wMjM5IDI3LjU5MzEgMjcuNDMwNyAzMC42NzI1IDI3LjQzMDdIMTEzLjMyOEMxMTYuNDA3IDI3LjQzMDcgMTE5IDMwLjAyMzcgMTE5IDMzLjEwMzJWOTMuMDY4N0MxMTkgOTYuMTQ4IDExNi40MDcgOTguNzQxIDExMy4zMjggOTguNzQxWiIgZmlsbD0iI0U4RURFRSIvPgo8cGF0aCBkPSJNMTE5IDg0LjE1NDlIMjVWMzMuMTAzMkMyNSAzMC4wMjM5IDI3LjU5MzEgMjcuNDMwNyAzMC42NzI1IDI3LjQzMDdIMTEzLjMyOEMxMTYuNDA3IDI3LjQzMDcgMTE5IDMwLjAyMzcgMTE5IDMzLjEwMzJMMTE5IDg0LjE1NDlaIiBmaWxsPSIjMDBCM0ZGIi8+CjxwYXRoIGQ9Ik05MC42Mzc0IDExNi41NjlINTMuMzYxNkM1Mi4wNjUxIDExNi41NjkgNTAuOTMwNyAxMTUuNDM1IDUwLjkzMDcgMTE0LjEzOEM1MC45MzA3IDExMi44NDEgNTIuMDY1MSAxMTEuNzA3IDUzLjM2MTYgMTExLjcwN0g5MC42Mzc0QzkxLjkzMzkgMTExLjcwNyA5My4wNjg0IDExMi44NDEgOTMuMDY4NCAxMTQuMTM4QzkzLjA2ODQgMTE1LjQzNSA5MS45MzM5IDExNi41NjkgOTAuNjM3NCAxMTYuNTY5WiIgZmlsbD0iI0U4RURFRSIvPgo8L2c+CjxwYXRoIGQ9Ik03Mi41Mjc1IDUzLjgzNjdDNzIuNDQzMSA1My44MzUxIDcyLjM2MDUgNTMuODEyMiA3Mi4yODczIDUzLjc3MDFMNTYuNDY5OSA0NC43OTM0QzU2LjM5ODMgNDQuNzUxOSA1Ni4zMzg4IDQ0LjY5MjMgNTYuMjk3MyA0NC42MjA3QzU2LjI1NTkgNDQuNTQ5IDU2LjIzMzggNDQuNDY3OCA1Ni4yMzM0IDQ0LjM4NUM1Ni4yMzM0IDQ0LjIxNjkgNTYuMzI1OCA0NC4wNjE3IDU2LjQ2OTkgNDMuOTc4NUw3Mi4xOTEyIDM1LjA2MDlDNzIuMjYzNyAzNS4wMjEgNzIuMzQ1IDM1IDcyLjQyNzcgMzVDNzIuNTEwNSAzNSA3Mi41OTE4IDM1LjAyMSA3Mi42NjQzIDM1LjA2MDlMODguNDg3MiA0NC4wMzk1Qzg4LjU1OTEgNDQuMDgwMSA4OC42MTg4IDQ0LjEzOTIgODguNjYgNDQuMjEwN0M4OC43MDEzIDQ0LjI4MjIgODguNzIyNyA0NC4zNjM1IDg4LjcyMTkgNDQuNDQ2Qzg4LjcyMjUgNDQuNTI4NSA4OC43MDEgNDQuNjA5NyA4OC42NTk4IDQ0LjY4MTJDODguNjE4NSA0NC43NTI2IDg4LjU1ODkgNDQuODExOCA4OC40ODcyIDQ0Ljg1MjVMNzIuNzcxNCA1My43NjgzQzcyLjY5NzIgNTMuODExNCA3Mi42MTMzIDUzLjgzNDkgNzIuNTI3NSA1My44MzY3IiBmaWxsPSJ3aGl0ZSIvPgo8cGF0aCBvcGFjaXR5PSIwLjciIGQ9Ik03MC4yNTUzIDc1LjY1MTdDNzAuMTcxIDc1LjY1MzUgNzAuMDg3OCA3NS42MzE3IDcwLjAxNTEgNzUuNTg4OEw1NC4yNDU4IDY2LjY0MTdDNTQuMTcxNSA2Ni42MDI0IDU0LjEwOTUgNjYuNTQzNiA1NC4wNjYxIDY2LjQ3MTZDNTQuMDIyOCA2Ni4zOTk3IDU0IDY2LjMxNzMgNTQgNjYuMjMzM1Y0OC4yNzhDNTQgNDguMTA4IDU0LjA5MjQgNDcuOTU0NiA1NC4yNDM5IDQ3Ljg2OTZDNTQuMzE3MiA0Ny44MjcxIDU0LjQwMDQgNDcuODA0NyA1NC40ODUxIDQ3LjgwNDdDNTQuNTY5NyA0Ny44MDQ3IDU0LjY1MjkgNDcuODI3MSA1NC43MjYyIDQ3Ljg2OTZMNzAuNDkzNyA1Ni44MTMxQzcwLjU2NDIgNTYuODU2NSA3MC42MjI1IDU2LjkxNyA3MC42NjMyIDU2Ljk4OTFDNzAuNzAzOSA1Ny4wNjEyIDcwLjcyNTcgNTcuMTQyNCA3MC43MjY1IDU3LjIyNTFWNzUuMTgwNUM3MC43MjU5IDc1LjI2MjggNzAuNzA0MiA3NS4zNDM2IDcwLjY2MzUgNzUuNDE1MUM3MC42MjI3IDc1LjQ4NjYgNzAuNTY0MiA3NS41NDY0IDcwLjQ5MzcgNzUuNTg4OEM3MC40MjA2IDc1LjYyOTEgNzAuMzM4NyA3NS42NTA3IDcwLjI1NTMgNzUuNjUxNyIgZmlsbD0id2hpdGUiLz4KPHBhdGggb3BhY2l0eT0iMC40IiBkPSJNNzQuNzE5OCA3NS42NTExQzc0LjYzMzMgNzUuNjUxMiA3NC41NDgyIDc1LjYyOTYgNzQuNDcyMiA3NS41ODgzQzc0LjQwMTYgNzUuNTQ2MSA3NC4zNDMyIDc1LjQ4NjIgNzQuMzAyNyA3NS40MTQ3Qzc0LjI2MjMgNzUuMzQzMSA3NC4yNDExIDc1LjI2MjIgNzQuMjQxMiA3NS4xOFY1Ny4zMzczQzc0LjI0MTIgNTcuMTcxIDc0LjMzMzYgNTcuMDE1OCA3NC40NzIyIDU2LjkyOUw5MC4yMzk3IDQ3Ljk4NTVDOTAuMzExOSA0Ny45NDM4IDkwLjM5MzggNDcuOTIxOSA5MC40NzcxIDQ3LjkyMTlDOTAuNTYwNSA0Ny45MjE5IDkwLjY0MjQgNDcuOTQzOCA5MC43MTQ2IDQ3Ljk4NTVDOTAuNzg3NiA0OC4wMjU1IDkwLjg0ODUgNDguMDg0MiA5MC44OTExIDQ4LjE1NTdDOTAuOTMzNyA0OC4yMjcyIDkwLjk1NjMgNDguMzA4OCA5MC45NTY2IDQ4LjM5MlY2Ni4yMzI4QzkwLjk1NyA2Ni4zMTY0IDkwLjkzNDcgNjYuMzk4NSA5MC44OTIxIDY2LjQ3MDRDOTAuODQ5NSA2Ni41NDI0IDkwLjc4ODEgNjYuNjAxNCA5MC43MTQ2IDY2LjY0MTFMNzQuOTUyNiA3NS41ODgzQzc0Ljg4MjUgNzUuNjMwNyA3NC44MDE4IDc1LjY1MjUgNzQuNzE5OCA3NS42NTExIiBmaWxsPSJ3aGl0ZSIvPgo8ZGVmcz4KPGxpbmVhckdyYWRpZW50IGlkPSJwYWludDBfbGluZWFyXzY4N18zNDU0IiB4MT0iMTYxIiB5MT0iMTgwIiB4Mj0iMy41OTI4NGUtMDciIHkyPSI0Ljk5OTk4IiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+CjxzdG9wLz4KPHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjNTk1NjU2Ii8+CjwvbGluZWFyR3JhZGllbnQ+CjxjbGlwUGF0aCBpZD0iY2xpcDBfNjg3XzM0NTQiPgo8cmVjdCB3aWR0aD0iOTQiIGhlaWdodD0iOTQiIGZpbGw9IndoaXRlIiB0cmFuc2Zvcm09InRyYW5zbGF0ZSgyNSAyNSkiLz4KPC9jbGlwUGF0aD4KPC9kZWZzPgo8L3N2Zz4K
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "external"], ["spec", "externalMethod"], ["spec", "externalPorts"], ["spec", "runStrategy"], ["spec", "instanceType"], ["spec", "instanceProfile"], ["spec", "disks"], ["spec", "networks"], ["spec", "subnets"], ["spec", "gpus"], ["spec", "cpuModel"], ["spec", "resources"], ["spec", "sshKeys"], ["spec", "cloudInit"], ["spec", "cloudInitSeed"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "external"], ["spec", "externalMethod"], ["spec", "externalPorts"], ["spec", "externalAllowICMP"], ["spec", "runStrategy"], ["spec", "instanceType"], ["spec", "instanceProfile"], ["spec", "disks"], ["spec", "networks"], ["spec", "subnets"], ["spec", "gpus"], ["spec", "cpuModel"], ["spec", "resources"], ["spec", "sshKeys"], ["spec", "cloudInit"], ["spec", "cloudInitSeed"]]
   secrets:
     exclude: []
     include: []

From bb51c88f7817c1d862fdb7947deef7798f717d82 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Tue, 28 Apr 2026 11:18:59 +0300
Subject: [PATCH 638/666] fix(monitoring): remove unused namespace variable
 from GPU efficiency dashboard

Address review feedback from coderabbitai on dashboards/gpu/gpu-efficiency.json:839

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-efficiency.json | 24 ------------------------
 1 file changed, 24 deletions(-)

diff --git a/dashboards/gpu/gpu-efficiency.json b/dashboards/gpu/gpu-efficiency.json
index f351c964..28a24568 100644
--- a/dashboards/gpu/gpu-efficiency.json
+++ b/dashboards/gpu/gpu-efficiency.json
@@ -812,30 +812,6 @@
         "auto": false,
         "auto_min": "10s",
         "auto_count": 30
-      },
-      {
-        "type": "query",
-        "name": "namespace",
-        "label": "Namespace",
-        "skipUrlSync": false,
-        "query": "label_values(DCGM_FI_DEV_GPU_UTIL{namespace!=\"\",namespace!~\"cozy-.*|kube-.*\"}, namespace)",
-        "datasource": {
-          "type": "prometheus",
-          "uid": "$ds_prometheus"
-        },
-        "current": {
-          "selected": true,
-          "text": "All",
-          "value": "$__all"
-        },
-        "multi": true,
-        "allowCustomValue": true,
-        "refresh": 2,
-        "sort": 1,
-        "includeAll": true,
-        "auto": false,
-        "auto_min": "10s",
-        "auto_count": 30
       }
     ]
   },

From 452bff45675c55e0c8e01d290dfbb3b1e7f59196 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Tue, 28 Apr 2026 11:19:56 +0300
Subject: [PATCH 639/666] fix(monitoring): remove unused namespace variable
 from GPU performance dashboard

Address review feedback from coderabbitai on dashboards/gpu/gpu-performance.json:277

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-performance.json | 24 ------------------------
 1 file changed, 24 deletions(-)

diff --git a/dashboards/gpu/gpu-performance.json b/dashboards/gpu/gpu-performance.json
index f9951577..aed9c69a 100644
--- a/dashboards/gpu/gpu-performance.json
+++ b/dashboards/gpu/gpu-performance.json
@@ -950,30 +950,6 @@
         "auto": false,
         "auto_min": "10s",
         "auto_count": 30
-      },
-      {
-        "type": "query",
-        "name": "namespace",
-        "label": "Namespace",
-        "skipUrlSync": false,
-        "query": "label_values(DCGM_FI_DEV_GPU_UTIL{namespace!=\"\",namespace!~\"cozy-.*|kube-.*\"}, namespace)",
-        "datasource": {
-          "type": "prometheus",
-          "uid": "$ds_prometheus"
-        },
-        "current": {
-          "selected": true,
-          "text": "All",
-          "value": "$__all"
-        },
-        "multi": true,
-        "allowCustomValue": true,
-        "refresh": 2,
-        "sort": 1,
-        "includeAll": true,
-        "auto": false,
-        "auto_min": "10s",
-        "auto_count": 30
       }
     ]
   },

From 4c697982b284a9d1f1b47d9cbbdbeab6314d253d Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Tue, 28 Apr 2026 11:20:19 +0300
Subject: [PATCH 640/666] fix(monitoring): use Hostname label in GPU tenants
 dashboard legends

Address review feedback from coderabbitai and gemini-code-assist on dashboards/gpu/gpu-tenants.json:532

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-tenants.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/dashboards/gpu/gpu-tenants.json b/dashboards/gpu/gpu-tenants.json
index e2c400a8..6194a15e 100644
--- a/dashboards/gpu/gpu-tenants.json
+++ b/dashboards/gpu/gpu-tenants.json
@@ -529,7 +529,7 @@
       "targets": [
         {
           "expr": "node:gpu_util:avg",
-          "legendFormat": "{{node}}",
+          "legendFormat": "{{Hostname}}",
           "refId": "A"
         }
       ],
@@ -585,7 +585,7 @@
       "targets": [
         {
           "expr": "node:tensor_active:avg * 100",
-          "legendFormat": "{{node}}",
+          "legendFormat": "{{Hostname}}",
           "refId": "A"
         }
       ],
@@ -654,7 +654,7 @@
       "targets": [
         {
           "expr": "node:power_watts:sum",
-          "legendFormat": "{{node}}",
+          "legendFormat": "{{Hostname}}",
           "refId": "A"
         }
       ],
@@ -988,7 +988,7 @@
       "targets": [
         {
           "expr": "sum_over_time(node:power_watts:sum[24h:1m]) / 60 / 1000",
-          "legendFormat": "{{node}}",
+          "legendFormat": "{{Hostname}}",
           "refId": "A"
         }
       ],

From bbf338a57d4dca0286bef4dab991ccbce6a2caa2 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Tue, 28 Apr 2026 11:20:41 +0300
Subject: [PATCH 641/666] fix(gpu-operator): fail fast on missing artifacts in
 driver-compat example

Address review feedback from coderabbitai on packages/system/gpu-operator/examples/nvidia-driver-compat.yaml:77

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../examples/nvidia-driver-compat.yaml        | 23 +++++++++++--------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml b/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml
index 7706b221..fc9d5981 100644
--- a/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml
+++ b/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml
@@ -61,16 +61,21 @@ spec:
 
               mkdir -p "$DST/bin"
 
-              if [ -f "$GLIBC_LIB/libnvidia-ml.so.1" ]; then
-                cp -f "$GLIBC_LIB/libnvidia-ml.so.1" "$DST/libnvidia-ml.so.1"
-                echo "Copied libnvidia-ml.so.1"
-              fi
+              [ -f "$GLIBC_LIB/libnvidia-ml.so.1" ] || {
+                echo "missing $GLIBC_LIB/libnvidia-ml.so.1" >&2
+                exit 1
+              }
+              [ -f "$SRC_BIN/nvidia-smi" ] || {
+                echo "missing $SRC_BIN/nvidia-smi" >&2
+                exit 1
+              }
 
-              if [ -f "$SRC_BIN/nvidia-smi" ]; then
-                cp -f "$SRC_BIN/nvidia-smi" "$DST/bin/nvidia-smi"
-                chmod +x "$DST/bin/nvidia-smi"
-                echo "Copied nvidia-smi"
-              fi
+              cp -f "$GLIBC_LIB/libnvidia-ml.so.1" "$DST/libnvidia-ml.so.1"
+              echo "Copied libnvidia-ml.so.1"
+
+              cp -f "$SRC_BIN/nvidia-smi" "$DST/bin/nvidia-smi"
+              chmod +x "$DST/bin/nvidia-smi"
+              echo "Copied nvidia-smi"
 
               mkdir -p /host/run/nvidia/validations
               touch /host/run/nvidia/validations/.driver-ctr-ready

From 5718740ae3edddd9112e483426ebfebba423ed92 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Tue, 28 Apr 2026 11:20:57 +0300
Subject: [PATCH 642/666] docs(gpu-operator): correct gpu-quotas dashboard
 dependencies in README

Address review feedback from coderabbitai on packages/system/gpu-operator/examples/README.md:85

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/system/gpu-operator/examples/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/system/gpu-operator/examples/README.md b/packages/system/gpu-operator/examples/README.md
index f9094549..b6f170c8 100644
--- a/packages/system/gpu-operator/examples/README.md
+++ b/packages/system/gpu-operator/examples/README.md
@@ -81,7 +81,7 @@ What each dashboard needs on top of the upstream DCGM Exporter
 | `gpu-performance` | Per-node, per-GPU deep dive        | `DCGM_FI_DEV_POWER_VIOLATION`, `DCGM_FI_DEV_THERMAL_VIOLATION`          |
 | `gpu-efficiency`  | Per-workload util vs tensor active | `DCGM_FI_DEV_POWER_VIOLATION`, `DCGM_FI_DEV_THERMAL_VIOLATION` (via `gpu:*_throttle_fraction:rate5m` recording rules) |
 | `gpu-fleet`       | Cluster-wide admin inventory       | `DCGM_FI_DEV_POWER_MGMT_LIMIT` (for the TDP vs draw panel)              |
-| `gpu-quotas`      | Kube-quota vs live usage           | `kube_pod_container_resource_requests`, `kube_pod_status_phase`, `DCGM_FI_DEV_GPU_UTIL` (via `namespace:gpu_count:allocated` / `cluster:gpu_count:*` recording rules) |
+| `gpu-quotas`      | Kube-quota vs live usage           | `kube_pod_container_resource_requests`, `kube_pod_status_phase`, `kube_node_status_allocatable` (via `namespace:gpu_count:allocated` / `cluster:gpu_count:*` recording rules) |
 | `gpu-tenants`     | Per-namespace tenant view          | nothing (works on default counters)                                     |
 
 `DCGM_FI_PROF_PIPE_TENSOR_ACTIVE` and `DCGM_FI_PROF_GR_ENGINE_ACTIVE`

From aba5ae3fcd0f4f4fdceae05f24e9371550076731 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Tue, 28 Apr 2026 11:21:12 +0300
Subject: [PATCH 643/666] fix(monitoring): prevent many-to-many match in
 util-per-watt recording rule

Address review feedback from coderabbitai on packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml:119

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../alerts/gpu-recording.rules.yaml                | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
index b046edf5..5e0f9ea0 100644
--- a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
+++ b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
@@ -109,13 +109,15 @@ spec:
         # to GPU-identifying labels.
         - record: gpu:util_per_watt:avg5m
           expr: |
-            avg by (Hostname, gpu, UUID) (
+            max by (Hostname, gpu, UUID) (
               avg_over_time(DCGM_FI_DEV_GPU_UTIL[5m])
-              / on (Hostname, gpu, UUID)
-              clamp_min(
-                avg_over_time(DCGM_FI_DEV_POWER_USAGE[5m]),
-                1
-              )
+            )
+            / on (Hostname, gpu, UUID)
+            clamp_min(
+              max by (Hostname, gpu, UUID) (
+                avg_over_time(DCGM_FI_DEV_POWER_USAGE[5m])
+              ),
+              1
             )
 
         # Fraction of time power-throttled (TDP cap) — 1.0 = fully throttled.

From 8e6266703da78b28109ec34ed6fd030612dc8c68 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Tue, 28 Apr 2026 11:43:30 +0300
Subject: [PATCH 644/666] Revert "chore: ignore CLAUDE.local.md"

This reverts commit 11f7d3589b3284fca96d0df21a02a5e967dadce7.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .gitignore | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 64470222..61003de5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -84,4 +84,3 @@ tmp/
 # build revision marker (generated by make image-packages)
 packages/core/platform/.build-revision
 .claude/
-CLAUDE.local.md

From 31de9989f62b2f286fc3e6bf58ca85b1b96e54ad Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Tue, 28 Apr 2026 11:44:04 +0300
Subject: [PATCH 645/666] fix(gpu-operator): add DCGM_FI_DRIVER_VERSION to
 custom metrics CSV

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml b/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml
index 8e57788b..5b82fd44 100644
--- a/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml
+++ b/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml
@@ -16,6 +16,9 @@ data:
     # If line starts with a '#' it is considered a comment
     # DCGM FIELD, Prometheus metric type, help message
 
+    # Identity
+    DCGM_FI_DRIVER_VERSION, label, Driver version.
+
     # Clocks
     DCGM_FI_DEV_SM_CLOCK,  gauge, SM clock frequency (in MHz).
     DCGM_FI_DEV_MEM_CLOCK, gauge, Memory clock frequency (in MHz).

From cacd3714bd24d7a3ec7182b8ec7b1057041fcf0a Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Tue, 28 Apr 2026 11:44:08 +0300
Subject: [PATCH 646/666] fix(monitoring): include phase label in GPU limits
 query for consistency

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-quotas.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dashboards/gpu/gpu-quotas.json b/dashboards/gpu/gpu-quotas.json
index ce1e387e..62928b56 100644
--- a/dashboards/gpu/gpu-quotas.json
+++ b/dashboards/gpu/gpu-quotas.json
@@ -430,7 +430,7 @@
           "refId": "requested"
         },
         {
-          "expr": "kube_pod_container_resource_limits{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"} * on(namespace, pod) group_left() (kube_pod_status_phase{phase=~\"Running|Pending\"} == 1)",
+          "expr": "kube_pod_container_resource_limits{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"} * on(namespace, pod) group_left(phase) (kube_pod_status_phase{phase=~\"Running|Pending\"} == 1)",
           "instant": true,
           "range": false,
           "format": "table",

From b0784c0d33d55fefeaaf60cdeabca4bebec1c069 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Tue, 28 Apr 2026 11:44:11 +0300
Subject: [PATCH 647/666] fix(monitoring): generalize GPU temperature
 description in fleet dashboard

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-fleet.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dashboards/gpu/gpu-fleet.json b/dashboards/gpu/gpu-fleet.json
index a7d3f085..60c12bfb 100644
--- a/dashboards/gpu/gpu-fleet.json
+++ b/dashboards/gpu/gpu-fleet.json
@@ -860,7 +860,7 @@
         }
       ],
       "title": "Max GPU temperature",
-      "description": "Hottest GPU in the fleet right now. A10 sustained target \u003c83°C.",
+      "description": "Hottest GPU in the fleet right now. Adjust thresholds to match your GPU model specifications.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",

From ed6f9bbd1da5d0daeea5fbe38e5aa42e3a528496 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Tue, 28 Apr 2026 12:02:18 +0300
Subject: [PATCH 648/666] fix(monitoring): regenerate gpu-quotas dashboard from
 SDK

Align dashboard JSON with the SDK source of truth.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-quotas.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dashboards/gpu/gpu-quotas.json b/dashboards/gpu/gpu-quotas.json
index 62928b56..ce1e387e 100644
--- a/dashboards/gpu/gpu-quotas.json
+++ b/dashboards/gpu/gpu-quotas.json
@@ -430,7 +430,7 @@
           "refId": "requested"
         },
         {
-          "expr": "kube_pod_container_resource_limits{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"} * on(namespace, pod) group_left(phase) (kube_pod_status_phase{phase=~\"Running|Pending\"} == 1)",
+          "expr": "kube_pod_container_resource_limits{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"} * on(namespace, pod) group_left() (kube_pod_status_phase{phase=~\"Running|Pending\"} == 1)",
           "instant": true,
           "range": false,
           "format": "table",

From 84f506116f452889011c9d31c0cd48628265d448 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Tue, 28 Apr 2026 12:07:31 +0300
Subject: [PATCH 649/666] docs(gpu-operator): clarify violation counter unit
 ambiguity in DCGM CSV

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../gpu-operator/examples/dcgm-custom-metrics.yaml   | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml b/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml
index 5b82fd44..ef2b0b88 100644
--- a/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml
+++ b/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml
@@ -66,12 +66,12 @@ data:
     DCGM_FI_DEV_ROW_REMAP_FAILURE,           gauge,   Whether remapping of rows has failed.
 
     # Throttle / violation counters (crucial for SLA and tenant monitoring)
-    DCGM_FI_DEV_POWER_VIOLATION,       counter, Throttling duration due to power constraints (in us).
-    DCGM_FI_DEV_THERMAL_VIOLATION,     counter, Throttling duration due to thermal constraints (in us).
-    DCGM_FI_DEV_SYNC_BOOST_VIOLATION,  counter, Throttling duration due to sync-boost constraints (in us).
-    DCGM_FI_DEV_BOARD_LIMIT_VIOLATION, counter, Throttling duration due to board limit constraints (in us).
-    DCGM_FI_DEV_LOW_UTIL_VIOLATION,    counter, Throttling duration due to low utilization (in us).
-    DCGM_FI_DEV_RELIABILITY_VIOLATION, counter, Throttling duration due to reliability constraints (in us).
+    DCGM_FI_DEV_POWER_VIOLATION,       counter, Throttling duration due to power constraints (us per docs; ns on DCGM 3.x).
+    DCGM_FI_DEV_THERMAL_VIOLATION,     counter, Throttling duration due to thermal constraints (us per docs; ns on DCGM 3.x).
+    DCGM_FI_DEV_SYNC_BOOST_VIOLATION,  counter, Throttling duration due to sync-boost constraints (us per docs; ns on DCGM 3.x).
+    DCGM_FI_DEV_BOARD_LIMIT_VIOLATION, counter, Throttling duration due to board limit constraints (us per docs; ns on DCGM 3.x).
+    DCGM_FI_DEV_LOW_UTIL_VIOLATION,    counter, Throttling duration due to low utilization (us per docs; ns on DCGM 3.x).
+    DCGM_FI_DEV_RELIABILITY_VIOLATION, counter, Throttling duration due to reliability constraints (us per docs; ns on DCGM 3.x).
 
     # NVLink — DCGM silently drops this metric on GPUs without NVLink, so
     # enabling it unconditionally is safe and keeps this file reusable

From 2a6653e11ae6a97d992f80e4ae0731995deea08a Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Tue, 28 Apr 2026 12:08:15 +0300
Subject: [PATCH 650/666] docs(monitoring): add panel descriptions to GPU
 quotas dashboard

Regenerated from SDK source.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-quotas.json | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/dashboards/gpu/gpu-quotas.json b/dashboards/gpu/gpu-quotas.json
index ce1e387e..865fb95c 100644
--- a/dashboards/gpu/gpu-quotas.json
+++ b/dashboards/gpu/gpu-quotas.json
@@ -38,6 +38,7 @@
         }
       ],
       "title": "GPU allocatable",
+      "description": "Total GPU capacity the cluster can schedule to pods.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -91,6 +92,7 @@
         }
       ],
       "title": "GPU requested",
+      "description": "Sum of GPU requests across all pods cluster-wide, including system namespaces.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -148,6 +150,7 @@
         }
       ],
       "title": "Allocation ratio",
+      "description": "Percentage of allocatable GPUs currently requested by pods.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -213,6 +216,7 @@
         }
       ],
       "title": "Pending pods (GPU)",
+      "description": "Pods requesting GPUs that are stuck in Pending state — indicates capacity shortage.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -284,6 +288,7 @@
         }
       ],
       "title": "GPU requested per namespace",
+      "description": "GPU allocation breakdown by namespace — spot top consumers at a glance.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -352,6 +357,7 @@
         }
       ],
       "title": "GPU allocated over time",
+      "description": "Requested vs allocatable GPUs over time — shows allocation pressure trends.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",
@@ -438,6 +444,7 @@
         }
       ],
       "title": "Pods requesting GPU",
+      "description": "Per-pod GPU requests and limits with scheduling status — Running or Pending.",
       "transparent": false,
       "datasource": {
         "type": "prometheus",

From d20285836cede23c3d7cfe091e5444359bac4320 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 28 Apr 2026 11:14:27 +0200
Subject: [PATCH 651/666] feat(cozy-proxy): bump to v0.3.0

Pulls in the per-port filtering and allowICMP support that the companion
vm-instance chart fix in #2501 relies on. cozy-proxy v0.3.0 also tightens
the selector to the standard service.kubernetes.io/service-proxy-name=cozy-proxy
label and switches the default ingress mode to port-filter; both are
already covered by the vm-instance chart (label landed in #2357,
wholeIP/allowICMP wired explicitly in #2501), so VM workloads upgrade
transparently.

Out-of-tree consumers using cozy-proxy annotations directly (without the
label, or relying on the absent-annotation passthrough default) are
called out in the upstream v0.3.0 release notes:
https://github.com/cozystack/cozy-proxy/releases/tag/v0.3.0

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/system/cozy-proxy/charts/cozy-proxy/Chart.yaml  | 4 ++--
 packages/system/cozy-proxy/charts/cozy-proxy/values.yaml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/system/cozy-proxy/charts/cozy-proxy/Chart.yaml b/packages/system/cozy-proxy/charts/cozy-proxy/Chart.yaml
index 13352680..58f166f6 100644
--- a/packages/system/cozy-proxy/charts/cozy-proxy/Chart.yaml
+++ b/packages/system/cozy-proxy/charts/cozy-proxy/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: cozy-proxy
 description: A simple kube-proxy addon for 1:1 NAT services in Kubernetes using an NFT backend
 type: application
-version: 0.2.0
-appVersion: 0.2.0
+version: 0.3.0
+appVersion: 0.3.0
diff --git a/packages/system/cozy-proxy/charts/cozy-proxy/values.yaml b/packages/system/cozy-proxy/charts/cozy-proxy/values.yaml
index 8cde5bed..e143e926 100644
--- a/packages/system/cozy-proxy/charts/cozy-proxy/values.yaml
+++ b/packages/system/cozy-proxy/charts/cozy-proxy/values.yaml
@@ -1,6 +1,6 @@
 image:
   repository: ghcr.io/cozystack/cozystack/cozy-proxy
-  tag: v0.2.0
+  tag: v0.3.0
   pullPolicy: IfNotPresent
 
 daemonset:

From b2a8cca3bb8960ab2f058051deb03f0b7cab0dca Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Tue, 28 Apr 2026 12:15:32 +0300
Subject: [PATCH 652/666] fix(monitoring): filter zero-valued series from
 active tenants count

Address review feedback from coderabbitai on dashboards/gpu/gpu-tenants.json:39

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 dashboards/gpu/gpu-tenants.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dashboards/gpu/gpu-tenants.json b/dashboards/gpu/gpu-tenants.json
index 6194a15e..7fef321d 100644
--- a/dashboards/gpu/gpu-tenants.json
+++ b/dashboards/gpu/gpu-tenants.json
@@ -35,7 +35,7 @@
       "id": 2,
       "targets": [
         {
-          "expr": "count(namespace:gpu_count:allocated{namespace=~\"$namespace\"})",
+          "expr": "count(namespace:gpu_count:allocated{namespace=~\"$namespace\"} \u003e 0)",
           "refId": "A"
         }
       ],

From 7257b6aed4bb2b6499168eab467a400196f2e625 Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Tue, 28 Apr 2026 12:26:57 +0300
Subject: [PATCH 653/666] fix(api): address review feedback on TenantNamespace
 RBAC

Address review feedback from sircthulhu and CodeRabbit:

1. Return Forbidden instead of NotFound for unauthorized access
   - Get() now returns 403 Forbidden to follow standard K8s RBAC behavior
   - Previously returned 404 NotFound for security-by-obscurity
   - Updated test expectations to match new behavior

2. Propagate field and label selectors in Watch handler
   - Pass opts.FieldSelector and opts.LabelSelector to upstream Watch
   - Add defensive filtering before authorization to prevent RBAC bypass
   - Fixes potential issue with resourceNames restrictions

3. Refactor subject-matching logic to eliminate duplication
   - Extract matchesSubject() helper for Group/User/ServiceAccount checks
   - Remove duplicated code from filterAccessible and hasAccessToNamespace
   - Consolidates ServiceAccount namespace fallback logic

All tests pass successfully.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 pkg/registry/core/tenantnamespace/rest.go     | 94 +++++++++++--------
 .../core/tenantnamespace/rest_test.go         |  6 +-
 2 files changed, 56 insertions(+), 44 deletions(-)

diff --git a/pkg/registry/core/tenantnamespace/rest.go b/pkg/registry/core/tenantnamespace/rest.go
index 7724c0e1..223a6925 100644
--- a/pkg/registry/core/tenantnamespace/rest.go
+++ b/pkg/registry/core/tenantnamespace/rest.go
@@ -17,6 +17,8 @@ import (
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metainternal "k8s.io/apimachinery/pkg/apis/meta/internalversion"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
@@ -130,8 +132,8 @@ func (r *REST) Get(
 		return nil, err
 	}
 	if !hasAccess {
-		// Return NotFound instead of Forbidden to prevent enumeration
-		return nil, apierrors.NewNotFound(r.gvr.GroupResource(), name)
+		// Return Forbidden to follow standard K8s RBAC behavior
+		return nil, apierrors.NewForbidden(r.gvr.GroupResource(), name, fmt.Errorf("access denied"))
 	}
 
 	ns := &corev1.Namespace{}
@@ -155,10 +157,20 @@ func (r *REST) Get(
 
 func (r *REST) Watch(ctx context.Context, opts *metainternal.ListOptions) (watch.Interface, error) {
 	nsList := &corev1.NamespaceList{}
-	nsWatch, err := r.w.Watch(ctx, nsList, &client.ListOptions{Raw: &metav1.ListOptions{
+
+	// Build upstream watch options with field and label selectors
+	rawOpts := &metav1.ListOptions{
 		Watch:           true,
 		ResourceVersion: opts.ResourceVersion,
-	}})
+	}
+	if opts.FieldSelector != nil {
+		rawOpts.FieldSelector = opts.FieldSelector.String()
+	}
+	if opts.LabelSelector != nil {
+		rawOpts.LabelSelector = opts.LabelSelector.String()
+	}
+
+	nsWatch, err := r.w.Watch(ctx, nsList, &client.ListOptions{Raw: rawOpts})
 	if err != nil {
 		return nil, err
 	}
@@ -200,6 +212,18 @@ func (r *REST) Watch(ctx context.Context, opts *metainternal.ListOptions) (watch
 				continue
 			}
 
+			// Apply defensive filtering for field and label selectors
+			if opts.FieldSelector != nil {
+				if !opts.FieldSelector.Matches(fields.Set{"metadata.name": ns.Name}) {
+					continue
+				}
+			}
+			if opts.LabelSelector != nil {
+				if !opts.LabelSelector.Matches(labels.Set(ns.Labels)) {
+					continue
+				}
+			}
+
 			// Check if user has access to this namespace
 			hasAccess, err := r.hasAccessToNamespace(ctx, ns.Name)
 			if err != nil {
@@ -331,6 +355,26 @@ func (r *REST) makeList(src *corev1.NamespaceList, allowed []string) *corev1alph
 	return out
 }
 
+// matchesSubject checks if a RoleBinding subject matches the user's identity.
+// It handles Group, User, and ServiceAccount subjects with proper namespace fallback.
+func matchesSubject(subj rbacv1.Subject, bindingNamespace, username string, groups map[string]struct{}) bool {
+	switch subj.Kind {
+	case "Group":
+		_, ok := groups[subj.Name]
+		return ok
+	case "User":
+		return subj.Name == username
+	case "ServiceAccount":
+		saNamespace := subj.Namespace
+		if saNamespace == "" {
+			saNamespace = bindingNamespace
+		}
+		return username == fmt.Sprintf("system:serviceaccount:%s:%s", saNamespace, subj.Name)
+	default:
+		return false
+	}
+}
+
 func (r *REST) filterAccessible(
 	ctx context.Context,
 	names []string,
@@ -369,26 +413,9 @@ func (r *REST) filterAccessible(
 	subjectLoop:
 		for j := range rbs.Items[i].Subjects {
 			subj := rbs.Items[i].Subjects[j]
-			switch subj.Kind {
-			case "Group":
-				if _, ok = groups[subj.Name]; ok {
-					allowedNameSet[rbs.Items[i].Namespace] = struct{}{}
-					break subjectLoop
-				}
-			case "User":
-				if subj.Name == u.GetName() {
-					allowedNameSet[rbs.Items[i].Namespace] = struct{}{}
-					break subjectLoop
-				}
-			case "ServiceAccount":
-				saNamespace := subj.Namespace
-				if saNamespace == "" {
-					saNamespace = rbs.Items[i].Namespace
-				}
-				if u.GetName() == fmt.Sprintf("system:serviceaccount:%s:%s", saNamespace, subj.Name) {
-					allowedNameSet[rbs.Items[i].Namespace] = struct{}{}
-					break subjectLoop
-				}
+			if matchesSubject(subj, rbs.Items[i].Namespace, u.GetName(), groups) {
+				allowedNameSet[rbs.Items[i].Namespace] = struct{}{}
+				break subjectLoop
 			}
 		}
 	}
@@ -434,23 +461,8 @@ func (r *REST) hasAccessToNamespace(
 	for i := range rbs.Items {
 		for j := range rbs.Items[i].Subjects {
 			subj := rbs.Items[i].Subjects[j]
-			switch subj.Kind {
-			case "Group":
-				if _, ok := groups[subj.Name]; ok {
-					return true, nil
-				}
-			case "User":
-				if subj.Name == u.GetName() {
-					return true, nil
-				}
-			case "ServiceAccount":
-				saNamespace := subj.Namespace
-				if saNamespace == "" {
-					saNamespace = rbs.Items[i].Namespace
-				}
-				if u.GetName() == fmt.Sprintf("system:serviceaccount:%s:%s", saNamespace, subj.Name) {
-					return true, nil
-				}
+			if matchesSubject(subj, rbs.Items[i].Namespace, u.GetName(), groups) {
+				return true, nil
 			}
 		}
 	}
diff --git a/pkg/registry/core/tenantnamespace/rest_test.go b/pkg/registry/core/tenantnamespace/rest_test.go
index eb678949..e1fb1e85 100644
--- a/pkg/registry/core/tenantnamespace/rest_test.go
+++ b/pkg/registry/core/tenantnamespace/rest_test.go
@@ -462,9 +462,9 @@ func TestGet_WithoutAccess(t *testing.T) {
 		t.Errorf("expected nil object, got %v", obj)
 	}
 
-	// Verify it returns NotFound (not Forbidden) to prevent enumeration
-	if !apierrors.IsNotFound(err) {
-		t.Errorf("expected NotFound error, got %v", err)
+	// Verify it returns Forbidden to follow standard K8s RBAC behavior
+	if !apierrors.IsForbidden(err) {
+		t.Errorf("expected Forbidden error, got %v", err)
 	}
 }
 

From 61ed7ad89c0bff66236e6884e6b6cd6038383718 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Tue, 28 Apr 2026 16:33:37 +0500
Subject: [PATCH 654/666] fix(api): address review feedback on TenantNamespace
 watch path

- Hoist user identity extraction out of the Watch goroutine; reuse a
  cached username and groups map across events instead of re-fetching
  them per event. Watch now returns Unauthorized up front when no user
  is present in the context, rather than failing silently per event.
- Switch the per-event access-check error log to structured klog.ErrorS
  to comply with the project Go style guide.
- Strengthen TestGet_WithAccess to assert the concrete *TenantNamespace
  type plus Name, Kind, and APIVersion, so type or metadata regressions
  fail fast.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 pkg/registry/core/tenantnamespace/rest.go     | 35 +++++++++++++++----
 .../core/tenantnamespace/rest_test.go         | 16 +++++++--
 2 files changed, 43 insertions(+), 8 deletions(-)

diff --git a/pkg/registry/core/tenantnamespace/rest.go b/pkg/registry/core/tenantnamespace/rest.go
index 223a6925..4ee97eb0 100644
--- a/pkg/registry/core/tenantnamespace/rest.go
+++ b/pkg/registry/core/tenantnamespace/rest.go
@@ -156,6 +156,18 @@ func (r *REST) Get(
 // -----------------------------------------------------------------------------
 
 func (r *REST) Watch(ctx context.Context, opts *metainternal.ListOptions) (watch.Interface, error) {
+	// Extract user identity once for the lifetime of the watch — it does not
+	// change between events and rebuilding it per event is wasteful.
+	u, ok := request.UserFrom(ctx)
+	if !ok {
+		return nil, apierrors.NewUnauthorized("user missing in context")
+	}
+	username := u.GetName()
+	groups := make(map[string]struct{})
+	for _, group := range u.GetGroups() {
+		groups[group] = struct{}{}
+	}
+
 	nsList := &corev1.NamespaceList{}
 
 	// Build upstream watch options with field and label selectors
@@ -224,10 +236,11 @@ func (r *REST) Watch(ctx context.Context, opts *metainternal.ListOptions) (watch
 				}
 			}
 
-			// Check if user has access to this namespace
-			hasAccess, err := r.hasAccessToNamespace(ctx, ns.Name)
+			// Check if user has access to this namespace using the cached
+			// identity — avoids re-extracting user/groups on every event.
+			hasAccess, err := r.hasAccessToNamespaceForUser(ctx, ns.Name, username, groups)
 			if err != nil {
-				klog.Errorf("Failed to check access for namespace %s in watch: %v", ns.Name, err)
+				klog.ErrorS(err, "Failed to check access for namespace in watch", "namespace", ns.Name)
 				continue
 			}
 			if !hasAccess {
@@ -437,12 +450,22 @@ func (r *REST) hasAccessToNamespace(
 	if !ok {
 		return false, fmt.Errorf("user missing in context")
 	}
-
-	// Check privileged groups
 	groups := make(map[string]struct{})
 	for _, group := range u.GetGroups() {
 		groups[group] = struct{}{}
 	}
+	return r.hasAccessToNamespaceForUser(ctx, namespace, u.GetName(), groups)
+}
+
+// hasAccessToNamespaceForUser is the inner check that does not re-extract user
+// identity from context. Use this in hot paths (e.g. the Watch loop) where the
+// caller has already cached the user name and groups.
+func (r *REST) hasAccessToNamespaceForUser(
+	ctx context.Context,
+	namespace, username string,
+	groups map[string]struct{},
+) (bool, error) {
+	// Check privileged groups
 	if _, ok := groups["system:masters"]; ok {
 		return true, nil
 	}
@@ -461,7 +484,7 @@ func (r *REST) hasAccessToNamespace(
 	for i := range rbs.Items {
 		for j := range rbs.Items[i].Subjects {
 			subj := rbs.Items[i].Subjects[j]
-			if matchesSubject(subj, rbs.Items[i].Namespace, u.GetName(), groups) {
+			if matchesSubject(subj, rbs.Items[i].Namespace, username, groups) {
 				return true, nil
 			}
 		}
diff --git a/pkg/registry/core/tenantnamespace/rest_test.go b/pkg/registry/core/tenantnamespace/rest_test.go
index e1fb1e85..52d2a075 100644
--- a/pkg/registry/core/tenantnamespace/rest_test.go
+++ b/pkg/registry/core/tenantnamespace/rest_test.go
@@ -15,6 +15,8 @@ import (
 	"k8s.io/apiserver/pkg/authentication/user"
 	"k8s.io/apiserver/pkg/endpoints/request"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/cozystack/cozystack/pkg/apis/core/v1alpha1"
 )
 
 func TestMakeListSortsAlphabetically(t *testing.T) {
@@ -408,8 +410,18 @@ func TestGet_WithAccess(t *testing.T) {
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	if obj == nil {
-		t.Fatal("expected object, got nil")
+	tn, ok := obj.(*corev1alpha1.TenantNamespace)
+	if !ok {
+		t.Fatalf("expected *TenantNamespace, got %T", obj)
+	}
+	if tn.Name != "tenant-test" {
+		t.Errorf("expected name %q, got %q", "tenant-test", tn.Name)
+	}
+	if tn.Kind != "TenantNamespace" {
+		t.Errorf("expected Kind=TenantNamespace, got %q", tn.Kind)
+	}
+	if tn.APIVersion != corev1alpha1.SchemeGroupVersion.String() {
+		t.Errorf("expected APIVersion=%q, got %q", corev1alpha1.SchemeGroupVersion.String(), tn.APIVersion)
 	}
 }
 

From 1dc02d44f4ea15253ffd799e85a54ed79ae87fd1 Mon Sep 17 00:00:00 2001
From: Timofei Larkin <lllamnyp@gmail.com>
Date: Mon, 27 Apr 2026 10:27:46 +0300
Subject: [PATCH 655/666] refactor(lineage-controller-webhook): align with
 cozystack-api shape
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Collapse the chart to a single Deployment shape that mirrors
cozystack-api: 2 replicas, soft (preferred) nodeAffinity to
node-role.kubernetes.io/control-plane via Exists, permissive
tolerations, soft podAntiAffinity on hostname, an unconditional
PodDisruptionBudget with maxUnavailable: 1, and a Service with
spec.trafficDistribution: PreferClose. The same shape works on
Talos / kubeadm / k3s and on managed Kubernetes / Cozy-in-Cozy
tenant clusters without per-distro overrides — fixing #2417 by
making the soft control-plane affinity gracefully fall back to
worker scheduling when no control-plane nodes are visible.

Drop the DaemonSet path entirely. The previous PR's deployment.enabled
toggle, the workload-kind switch in templates/workload.yaml, the
fail-guard for localK8sAPIEndpoint+nodeAffinity=[], the conditional
PDB, and the values-shape knobs for nodeAffinity and tolerations all
go away as a consequence. Override the standard Deployment fields
through the usual component-values mechanism if a non-default topology
is ever needed.

Mark localK8sAPIEndpoint.enabled deprecated and flip the default to
false. The flag injects KUBERNETES_SERVICE_HOST=status.hostIP, which
is only valid when the pod is actually scheduled on an apiserver-
bearing node. With the new soft control-plane affinity, the pod can
land off-control-plane and crash-loop. The latency motivation for the
flag is real but pending separate webhook performance work; once
addressed, the flag can be removed.

Revert all changes to packages/core/platform/images/migrations/migrations/20.
The earlier ds/...-or-deploy/... fallback was over-engineered: per
run-migrations.sh, migration 20 fires only when CURRENT < 20 (i.e.
direct upgrades from pre-0.37 to 1.3+), and that path is unsupported
anyway. The original ds/... rollout-status line is dead code on every
supported install and upgrade path.

Add helm-unittest coverage for: the default Deployment shape (replicas,
soft nodeAffinity, soft podAntiAffinity, tolerations); no env vars at
the default localK8sAPIEndpoint.enabled=false; PDB rendered
unconditionally with maxUnavailable: 1, including at replicas=1 (the
no-op case); replicas value drives spec.replicas; and that
localK8sAPIEndpoint.enabled=true does inject the env vars. The Service
test continues to assert trafficDistribution: PreferClose with no
internalTrafficPolicy.

Add a slim README documenting the topology, parameters, and the
deprecation note for localK8sAPIEndpoint.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
---
 .../platform/templates/bundles/system.yaml    |  3 -
 .../lineage-controller-webhook/Makefile       |  5 +
 .../lineage-controller-webhook/README.md      | 67 +++++++++++++
 .../templates/deployment.yaml                 | 49 ---------
 .../templates/pdb.yaml                        |  4 +-
 .../templates/service.yaml                    |  2 +-
 .../{daemonset.yaml => workload.yaml}         | 27 +++--
 .../tests/service_test.yaml                   | 30 ++++++
 .../tests/workload_test.yaml                  | 99 +++++++++++++++++++
 .../lineage-controller-webhook/values.yaml    | 18 ++--
 10 files changed, 230 insertions(+), 74 deletions(-)
 create mode 100644 packages/system/lineage-controller-webhook/README.md
 delete mode 100644 packages/system/lineage-controller-webhook/templates/deployment.yaml
 rename packages/system/lineage-controller-webhook/templates/{daemonset.yaml => workload.yaml} (67%)
 create mode 100644 packages/system/lineage-controller-webhook/tests/service_test.yaml
 create mode 100644 packages/system/lineage-controller-webhook/tests/workload_test.yaml

diff --git a/packages/core/platform/templates/bundles/system.yaml b/packages/core/platform/templates/bundles/system.yaml
index 43ea7266..6c587c82 100644
--- a/packages/core/platform/templates/bundles/system.yaml
+++ b/packages/core/platform/templates/bundles/system.yaml
@@ -105,9 +105,6 @@
 {{- /* cozystack-api DaemonSet */ -}}
 {{- $apiValues := dict "cozystackAPI" (dict "nodeSelector" $genericNodeSelector) -}}
 {{- $_ := set $cozystackEngineComponents "cozystack-api" (dict "values" $apiValues) -}}
-{{- /* lineage-controller-webhook DaemonSet */ -}}
-{{- $lineageValues := dict "lineageControllerWebhook" (dict "nodeSelector" $genericNodeSelector) -}}
-{{- $_ := set $cozystackEngineComponents "lineage-controller-webhook" (dict "values" $lineageValues) -}}
 {{- end -}}
 {{- if .Values.authentication.oidc.enabled }}
 {{include "cozystack.platform.package" (list "cozystack.cozystack-engine" "oidc" $ $cozystackEngineComponents) }}
diff --git a/packages/system/lineage-controller-webhook/Makefile b/packages/system/lineage-controller-webhook/Makefile
index d5bada31..cdc1cf01 100644
--- a/packages/system/lineage-controller-webhook/Makefile
+++ b/packages/system/lineage-controller-webhook/Makefile
@@ -4,8 +4,13 @@ NAMESPACE=cozy-system
 include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
+.PHONY: test
+
 image: image-lineage-controller-webhook
 
+test:
+	helm unittest .
+
 image-lineage-controller-webhook:
 	docker buildx build -f images/lineage-controller-webhook/Dockerfile ../../.. \
 		--tag $(REGISTRY)/lineage-controller-webhook:$(call settag,$(TAG)) \
diff --git a/packages/system/lineage-controller-webhook/README.md b/packages/system/lineage-controller-webhook/README.md
new file mode 100644
index 00000000..1e43c9c8
--- /dev/null
+++ b/packages/system/lineage-controller-webhook/README.md
@@ -0,0 +1,67 @@
+# lineage-controller-webhook
+
+Cozystack system package for the **lineage controller webhook** — a mutating
+admission webhook that stamps "lineage" labels onto tenant workloads, linking
+each resource back to the Cozystack `Application` that ultimately owns it.
+
+The webhook intercepts CREATE and UPDATE on `pods`, `secrets`, `services`,
+`persistentvolumeclaims`, `ingresses.networking.k8s.io`, and
+`workloadmonitors.cozystack.io` outside system namespaces. For each request it
+walks the ownership graph upward (Kubernetes `ownerReferences`, then the
+`HelmRelease` Flux installed the resource with, then the Cozystack
+`Application`-derived CRD that produced the HelmRelease) and writes the
+discovered application's group, kind and name as labels
+(`apps.cozystack.io/application.{group,kind,name}`) on the incoming object.
+Those labels let the aggregated API server, the Cozystack dashboard, and other
+lineage-aware consumers reason about which application a resource belongs to.
+
+The webhook serves TLS on port 9443 with a cert-manager issued certificate, and
+runs with `failurePolicy: Fail` — every CREATE/UPDATE on the resources above
+is gated on the webhook being reachable.
+
+## Topology
+
+The chart ships a single shape, modelled on `cozystack-api`:
+
+- **Deployment** with two replicas (override via `replicas`).
+- **Soft `nodeAffinity`** preferring `node-role.kubernetes.io/control-plane`
+  (`Exists`, so it matches both Talos's empty value and k3s/kubeadm's `"true"`).
+  Soft means: the pod lands on a control-plane node when one is reachable, and
+  on any worker otherwise — no override needed for managed Kubernetes,
+  Cozy-in-Cozy tenants, or any other cluster where control-plane nodes aren't
+  visible.
+- **Permissive `tolerations`** (`[{operator: Exists}]`) so the pod can land on
+  tainted control-plane nodes when the soft affinity is satisfiable.
+- **Soft `podAntiAffinity`** on `kubernetes.io/hostname` so replicas spread
+  across nodes when possible (best-effort).
+- **`PodDisruptionBudget`** with `maxUnavailable: 1`, unconditional. At
+  `replicas: 1` it's a useful no-op (allows full drain); at `replicas >= 2`
+  it caps disruption to one pod.
+- **`Service` with `spec.trafficDistribution: PreferClose`** so the apiserver
+  prefers a webhook endpoint on its own node when one exists, and transparently
+  falls over to a remote endpoint otherwise. Requires Kubernetes ≥ 1.31; on
+  older clusters the field is silently ignored and traffic uses default
+  cluster-wide distribution.
+
+## Parameters
+
+All keys live under the top-level `lineageControllerWebhook:` map.
+
+| Name                          | Description                                               | Value                                                                            |
+| ----------------------------- | --------------------------------------------------------- | -------------------------------------------------------------------------------- |
+| `image`                       | Container image (digest-pinned)                           | `ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.3.0@sha256:e898…6fb0` |
+| `debug`                       | Enable `--zap-log-level=debug` instead of `info`          | `false`                                                                          |
+| `replicas`                    | Deployment replica count                                  | `2`                                                                              |
+| `localK8sAPIEndpoint.enabled` | **Deprecated.** See note below.                           | `false`                                                                          |
+
+### `localK8sAPIEndpoint.enabled` (deprecated)
+
+When enabled, this injects `KUBERNETES_SERVICE_HOST=status.hostIP` and
+`KUBERNETES_SERVICE_PORT=6443` so the webhook talks to the kube-apiserver on
+its own node. It was originally added to avoid latency on the
+webhook-to-apiserver path, but it is only valid when the pod is actually
+scheduled on an apiserver-bearing node — which the chart's soft control-plane
+affinity no longer guarantees. With this flag enabled and the pod scheduled
+off a control-plane node, the controller will crash-loop dialing a non-
+apiserver hostIP. Slated for removal once the latency motivation is addressed
+in the webhook itself; **leave disabled**.
diff --git a/packages/system/lineage-controller-webhook/templates/deployment.yaml b/packages/system/lineage-controller-webhook/templates/deployment.yaml
deleted file mode 100644
index 87717fd3..00000000
--- a/packages/system/lineage-controller-webhook/templates/deployment.yaml
+++ /dev/null
@@ -1,49 +0,0 @@
-{{- if .Values.lineageControllerWebhook.deployment.enabled }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: lineage-controller-webhook
-  labels:
-    app: lineage-controller-webhook
-spec:
-  replicas: {{ .Values.lineageControllerWebhook.deployment.replicas }}
-  selector:
-    matchLabels:
-      app: lineage-controller-webhook
-  template:
-    metadata:
-      labels:
-        app: lineage-controller-webhook
-    spec:
-      serviceAccountName: lineage-controller-webhook
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              podAffinityTerm:
-                topologyKey: kubernetes.io/hostname
-                labelSelector:
-                  matchLabels:
-                    app: lineage-controller-webhook
-      containers:
-      - name: lineage-controller-webhook
-        image: "{{ .Values.lineageControllerWebhook.image }}"
-        args:
-        {{- if .Values.lineageControllerWebhook.debug }}
-        - --zap-log-level=debug
-        {{- else }}
-        - --zap-log-level=info
-        {{- end }}
-        ports:
-        - name: webhook
-          containerPort: 9443
-        volumeMounts:
-          - name: webhook-certs
-            mountPath: /tmp/k8s-webhook-server/serving-certs
-            readOnly: true
-      volumes:
-        - name: webhook-certs
-          secret:
-            secretName: lineage-controller-webhook-cert
-            defaultMode: 0400
-{{- end }}
\ No newline at end of file
diff --git a/packages/system/lineage-controller-webhook/templates/pdb.yaml b/packages/system/lineage-controller-webhook/templates/pdb.yaml
index b0a9d4e4..0786c8ff 100644
--- a/packages/system/lineage-controller-webhook/templates/pdb.yaml
+++ b/packages/system/lineage-controller-webhook/templates/pdb.yaml
@@ -1,11 +1,9 @@
-{{- if .Values.lineageControllerWebhook.deployment.enabled }}
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: lineage-controller-webhook
 spec:
-  minAvailable: {{ if gt (int .Values.lineageControllerWebhook.deployment.replicas) 1 }}1{{ else }}0{{ end }}
+  maxUnavailable: 1
   selector:
     matchLabels:
       app: lineage-controller-webhook
-{{- end }}
\ No newline at end of file
diff --git a/packages/system/lineage-controller-webhook/templates/service.yaml b/packages/system/lineage-controller-webhook/templates/service.yaml
index c5df90fb..fbb3ad54 100644
--- a/packages/system/lineage-controller-webhook/templates/service.yaml
+++ b/packages/system/lineage-controller-webhook/templates/service.yaml
@@ -5,7 +5,7 @@ metadata:
   labels:
     app: lineage-controller-webhook
 spec:
-  internalTrafficPolicy: Local
+  trafficDistribution: PreferClose
   type: ClusterIP
   ports:
     - port: 443
diff --git a/packages/system/lineage-controller-webhook/templates/daemonset.yaml b/packages/system/lineage-controller-webhook/templates/workload.yaml
similarity index 67%
rename from packages/system/lineage-controller-webhook/templates/daemonset.yaml
rename to packages/system/lineage-controller-webhook/templates/workload.yaml
index 536ea24a..097919c6 100644
--- a/packages/system/lineage-controller-webhook/templates/daemonset.yaml
+++ b/packages/system/lineage-controller-webhook/templates/workload.yaml
@@ -1,11 +1,11 @@
-{{- if not .Values.lineageControllerWebhook.deployment.enabled }}
 apiVersion: apps/v1
-kind: DaemonSet
+kind: Deployment
 metadata:
   name: lineage-controller-webhook
   labels:
     app: lineage-controller-webhook
 spec:
+  replicas: {{ .Values.lineageControllerWebhook.replicas }}
   selector:
     matchLabels:
       app: lineage-controller-webhook
@@ -14,13 +14,25 @@ spec:
       labels:
         app: lineage-controller-webhook
     spec:
-      {{- with .Values.lineageControllerWebhook.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+      serviceAccountName: lineage-controller-webhook
       tolerations:
       - operator: Exists
-      serviceAccountName: lineage-controller-webhook
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            preference:
+              matchExpressions:
+              - key: node-role.kubernetes.io/control-plane
+                operator: Exists
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            podAffinityTerm:
+              topologyKey: kubernetes.io/hostname
+              labelSelector:
+                matchLabels:
+                  app: lineage-controller-webhook
       containers:
       - name: lineage-controller-webhook
         image: "{{ .Values.lineageControllerWebhook.image }}"
@@ -52,4 +64,3 @@ spec:
           secret:
             secretName: lineage-controller-webhook-cert
             defaultMode: 0400
-{{- end }}
\ No newline at end of file
diff --git a/packages/system/lineage-controller-webhook/tests/service_test.yaml b/packages/system/lineage-controller-webhook/tests/service_test.yaml
new file mode 100644
index 00000000..3cdbddd8
--- /dev/null
+++ b/packages/system/lineage-controller-webhook/tests/service_test.yaml
@@ -0,0 +1,30 @@
+suite: lineage-controller-webhook service
+templates:
+  - templates/service.yaml
+
+release:
+  name: lineage-controller-webhook
+  namespace: cozy-system
+
+tests:
+  - it: renders a ClusterIP service on 443 -> 9443 with PreferClose traffic distribution
+    asserts:
+      - isKind:
+          of: Service
+      - equal:
+          path: spec.type
+          value: ClusterIP
+      - equal:
+          path: spec.trafficDistribution
+          value: PreferClose
+      - notExists:
+          path: spec.internalTrafficPolicy
+      - equal:
+          path: spec.ports[0].port
+          value: 443
+      - equal:
+          path: spec.ports[0].targetPort
+          value: 9443
+      - equal:
+          path: spec.selector.app
+          value: lineage-controller-webhook
diff --git a/packages/system/lineage-controller-webhook/tests/workload_test.yaml b/packages/system/lineage-controller-webhook/tests/workload_test.yaml
new file mode 100644
index 00000000..bcb24014
--- /dev/null
+++ b/packages/system/lineage-controller-webhook/tests/workload_test.yaml
@@ -0,0 +1,99 @@
+suite: lineage-controller-webhook workload + PDB
+templates:
+  - templates/workload.yaml
+  - templates/pdb.yaml
+
+release:
+  name: lineage-controller-webhook
+  namespace: cozy-system
+
+tests:
+  # ---- Default Deployment shape ----------------------------------------------
+
+  - it: defaults render a 2-replica Deployment with soft control-plane nodeAffinity, soft podAntiAffinity, and Exists tolerations
+    template: templates/workload.yaml
+    asserts:
+      - isKind:
+          of: Deployment
+      - equal:
+          path: spec.replicas
+          value: 2
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - operator: Exists
+      - equal:
+          path: spec.template.spec.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution
+          value:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: Exists
+      - notExists:
+          path: spec.template.spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution
+      - equal:
+          path: spec.template.spec.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[0].podAffinityTerm.topologyKey
+          value: kubernetes.io/hostname
+
+  - it: defaults inject no localK8sAPIEndpoint env vars (knob is opt-in)
+    template: templates/workload.yaml
+    asserts:
+      - notExists:
+          path: spec.template.spec.containers[0].env
+
+  # ---- PDB --------------------------------------------------------------------
+
+  - it: PDB renders unconditionally with maxUnavailable=1 at the default replica count
+    template: templates/pdb.yaml
+    asserts:
+      - isKind:
+          of: PodDisruptionBudget
+      - equal:
+          path: spec.maxUnavailable
+          value: 1
+      - notExists:
+          path: spec.minAvailable
+
+  - it: PDB still renders at replicas=1 (no-op, but consistent shape)
+    set:
+      lineageControllerWebhook.replicas: 1
+    template: templates/pdb.yaml
+    asserts:
+      - isKind:
+          of: PodDisruptionBudget
+      - equal:
+          path: spec.maxUnavailable
+          value: 1
+
+  # ---- Replica override -------------------------------------------------------
+
+  - it: replicas value drives spec.replicas
+    set:
+      lineageControllerWebhook.replicas: 5
+    template: templates/workload.yaml
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 5
+
+  # ---- Deprecated localK8sAPIEndpoint knob -----------------------------------
+
+  - it: localK8sAPIEndpoint.enabled=true injects KUBERNETES_SERVICE_HOST and PORT env vars
+    set:
+      lineageControllerWebhook.localK8sAPIEndpoint.enabled: true
+    template: templates/workload.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: KUBERNETES_SERVICE_HOST
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: status.hostIP
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: KUBERNETES_SERVICE_PORT
+            value: "6443"
diff --git a/packages/system/lineage-controller-webhook/values.yaml b/packages/system/lineage-controller-webhook/values.yaml
index 2b84f4e1..e56d332d 100644
--- a/packages/system/lineage-controller-webhook/values.yaml
+++ b/packages/system/lineage-controller-webhook/values.yaml
@@ -1,15 +1,13 @@
 lineageControllerWebhook:
   image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.3.0@sha256:e8984709686a5eaf19b89da378d7b8c688ea5607e0783a88d9c9e4ccfca96fb0
   debug: false
+  replicas: 2
+  # DEPRECATED. Injects KUBERNETES_SERVICE_HOST=status.hostIP and
+  # KUBERNETES_SERVICE_PORT=6443 so the webhook talks to the apiserver on its
+  # own node — only valid when the pod is actually scheduled on an apiserver-
+  # bearing node. Now that the chart's nodeAffinity to control-plane is soft
+  # (preferred, not required), the pod can land off-control-plane and crash-
+  # loop dialing a non-apiserver hostIP. Slated for removal once webhook
+  # performance work obviates the locality motivation. Leave disabled.
   localK8sAPIEndpoint:
-    # incompatable with Deployment mode
-    enabled: true
-  # nodeSelector for the DaemonSet
-  # Talos uses empty value: "node-role.kubernetes.io/control-plane": ""
-  # Generic k8s (k3s, kubeadm) uses: "node-role.kubernetes.io/control-plane": "true"
-  nodeSelector:
-    node-role.kubernetes.io/control-plane: ""
-  # if enabled, replace DaemonSet by Deployment
-  deployment:
     enabled: false
-    replicas: 1

From 3a8359fa73f5cd96d8363c48d31414d8cadf3447 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Tue, 28 Apr 2026 18:59:43 +0300
Subject: [PATCH 656/666] chore(kubernetes): regenerate deepcopy after merge

Run `make generate` to pick up the Images type added in main.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../v1alpha1/kubernetes/zz_generated.deepcopy.go | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go b/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go
index 3f1cb5ce..e021fbaa 100644
--- a/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go
@@ -136,6 +136,7 @@ func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	}
 	in.Addons.DeepCopyInto(&out.Addons)
 	in.ControlPlane.DeepCopyInto(&out.ControlPlane)
+	out.Images = in.Images
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
@@ -277,6 +278,21 @@ func (in *HAMiAddon) DeepCopy() *HAMiAddon {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Images) DeepCopyInto(out *Images) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Images.
+func (in *Images) DeepCopy() *Images {
+	if in == nil {
+		return nil
+	}
+	out := new(Images)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *IngressNginxAddon) DeepCopyInto(out *IngressNginxAddon) {
 	*out = *in

From 80b86b0c1a39266488b84473724a54b0d3ad7d9c Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Tue, 28 Apr 2026 19:02:35 +0300
Subject: [PATCH 657/666] chore(kubernetes): regenerate CRD after merge
 conflict resolution

Per-package `make generate` corrects keysOrder placement and
openAPISchema formatting in the kubernetes CRD definition.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 api/apps/v1alpha1/kubernetes/types.go                 | 2 +-
 packages/system/kubernetes-rd/cozyrds/kubernetes.yaml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/api/apps/v1alpha1/kubernetes/types.go b/api/apps/v1alpha1/kubernetes/types.go
index e0143445..88a3c97e 100644
--- a/api/apps/v1alpha1/kubernetes/types.go
+++ b/api/apps/v1alpha1/kubernetes/types.go
@@ -6,7 +6,7 @@ package kubernetes
 
 import (
 	resource "k8s.io/apimachinery/pkg/api/resource"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
 	k8sRuntime "k8s.io/apimachinery/pkg/runtime"
 )
 
diff --git a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
index b4ada238..f81eaff0 100644
--- a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
+++ b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
@@ -22,7 +22,7 @@ spec:
     singular: kubernetes
     plural: kuberneteses
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"},"nodeGroups":{"description":"Worker nodes configuration map.","type":"object","default":{"md0":{"ephemeralStorage":"20Gi","gpus":[],"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":["ingress-nginx"]}},"additionalProperties":{"type":"object","required":["ephemeralStorage","instanceType","maxReplicas","minReplicas","resources"],"properties":{"ephemeralStorage":{"description":"Ephemeral storage size.","default":"20Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"description":"Name of GPU, such as \"nvidia.com/AD102GL_L40S\".","type":"string"}}}},"instanceType":{"description":"Virtual machine instance type.","type":"string","default":"u1.medium"},"maxReplicas":{"description":"Maximum number of replicas.","type":"integer","default":10},"minReplicas":{"description":"Minimum number of replicas.","type":"integer","default":0},"resources":{"description":"CPU and memory resources for each worker node.","type":"object","properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"roles":{"description":"List of node roles.","type":"array","items":{"type":"string"}}}}},"version":{"description":"Kubernetes major.minor version to deploy","type":"string","default":"v1.35","enum":["v1.35","v1.34","v1.33","v1.32","v1.31","v1.30"]},"host":{"description":"External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.","type":"string","default":""},"addons":{"description":"Cluster addons configuration.","type":"object","default":{},"required":["certManager","cilium","coredns","fluxcd","gatewayAPI","gpuOperator","hami","ingressNginx","monitoringAgents","velero","verticalPodAutoscaler"],"properties":{"certManager":{"description":"Cert-manager addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable cert-manager.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"cilium":{"description":"Cilium CNI plugin.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"coredns":{"description":"CoreDNS addon.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"fluxcd":{"description":"FluxCD GitOps operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable FluxCD.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"gatewayAPI":{"description":"Gateway API addon.","type":"object","default":{},"required":["enabled"],"properties":{"enabled":{"description":"Enable Gateway API.","type":"boolean","default":false}}},"gpuOperator":{"description":"NVIDIA GPU Operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable GPU Operator.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"ingressNginx":{"description":"Ingress-NGINX controller.","type":"object","default":{},"required":["enabled","exposeMethod","valuesOverride"],"properties":{"enabled":{"description":"Enable the controller (requires nodes labeled `ingress-nginx`).","type":"boolean","default":false},"exposeMethod":{"description":"Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.","type":"string","default":"Proxied","enum":["Proxied","LoadBalancer"]},"hosts":{"description":"Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.","type":"array","default":[],"items":{"type":"string"}},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"monitoringAgents":{"description":"Monitoring agents.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable monitoring agents.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"velero":{"description":"Velero backup/restore addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable Velero.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"verticalPodAutoscaler":{"description":"Vertical Pod Autoscaler.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"hami":{"description":"HAMi GPU virtualization middleware.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable HAMi (requires GPU Operator).","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}}}},"controlPlane":{"description":"Kubernetes control-plane configuration.","type":"object","default":{},"required":["apiServer","controllerManager","konnectivity","replicas","scheduler"],"properties":{"apiServer":{"description":"API Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for API Server.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"controllerManager":{"description":"Controller Manager configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Controller Manager.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"konnectivity":{"description":"Konnectivity configuration.","type":"object","default":{},"required":["server"],"properties":{"server":{"description":"Konnectivity Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Konnectivity.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"replicas":{"description":"Number of control-plane replicas.","type":"integer","default":2},"scheduler":{"description":"Scheduler configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Scheduler.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"images":{"description":"Optional image overrides for air-gapped or rate-limited registries.","type":"object","default":{},"properties":{"waitForKubeconfig":{"description":"Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag.","type":"string","default":""}}}}}
+      {"title":"Chart Values","type":"object","properties":{"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"},"nodeGroups":{"description":"Worker nodes configuration map.","type":"object","default":{"md0":{"ephemeralStorage":"20Gi","gpus":[],"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":["ingress-nginx"]}},"additionalProperties":{"type":"object","required":["ephemeralStorage","instanceType","maxReplicas","minReplicas","resources"],"properties":{"ephemeralStorage":{"description":"Ephemeral storage size.","default":"20Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"description":"Name of GPU, such as \"nvidia.com/AD102GL_L40S\".","type":"string"}}}},"instanceType":{"description":"Virtual machine instance type.","type":"string","default":"u1.medium"},"maxReplicas":{"description":"Maximum number of replicas.","type":"integer","default":10},"minReplicas":{"description":"Minimum number of replicas.","type":"integer","default":0},"resources":{"description":"CPU and memory resources for each worker node.","type":"object","properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"roles":{"description":"List of node roles.","type":"array","items":{"type":"string"}}}}},"version":{"description":"Kubernetes major.minor version to deploy","type":"string","default":"v1.35","enum":["v1.35","v1.34","v1.33","v1.32","v1.31","v1.30"]},"host":{"description":"External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.","type":"string","default":""},"addons":{"description":"Cluster addons configuration.","type":"object","default":{},"required":["certManager","cilium","coredns","fluxcd","gatewayAPI","gpuOperator","hami","ingressNginx","monitoringAgents","velero","verticalPodAutoscaler"],"properties":{"certManager":{"description":"Cert-manager addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable cert-manager.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"cilium":{"description":"Cilium CNI plugin.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"coredns":{"description":"CoreDNS addon.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"fluxcd":{"description":"FluxCD GitOps operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable FluxCD.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"gatewayAPI":{"description":"Gateway API addon.","type":"object","default":{},"required":["enabled"],"properties":{"enabled":{"description":"Enable Gateway API.","type":"boolean","default":false}}},"gpuOperator":{"description":"NVIDIA GPU Operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable GPU Operator.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"hami":{"description":"HAMi GPU virtualization middleware.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable HAMi (requires GPU Operator).","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"ingressNginx":{"description":"Ingress-NGINX controller.","type":"object","default":{},"required":["enabled","exposeMethod","valuesOverride"],"properties":{"enabled":{"description":"Enable the controller (requires nodes labeled `ingress-nginx`).","type":"boolean","default":false},"exposeMethod":{"description":"Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.","type":"string","default":"Proxied","enum":["Proxied","LoadBalancer"]},"hosts":{"description":"Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.","type":"array","default":[],"items":{"type":"string"}},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"monitoringAgents":{"description":"Monitoring agents.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable monitoring agents.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"velero":{"description":"Velero backup/restore addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable Velero.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"verticalPodAutoscaler":{"description":"Vertical Pod Autoscaler.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}}}},"controlPlane":{"description":"Kubernetes control-plane configuration.","type":"object","default":{},"required":["apiServer","controllerManager","konnectivity","replicas","scheduler"],"properties":{"apiServer":{"description":"API Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for API Server.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"controllerManager":{"description":"Controller Manager configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Controller Manager.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"konnectivity":{"description":"Konnectivity configuration.","type":"object","default":{},"required":["server"],"properties":{"server":{"description":"Konnectivity Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Konnectivity.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"replicas":{"description":"Number of control-plane replicas.","type":"integer","default":2},"scheduler":{"description":"Scheduler configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Scheduler.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"images":{"description":"Optional image overrides for air-gapped or rate-limited registries.","type":"object","default":{},"properties":{"waitForKubeconfig":{"description":"Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag.","type":"string","default":""}}}}}
   release:
     prefix: kubernetes-
     labels:
@@ -40,7 +40,7 @@ spec:
     tags:
       - compute
     icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl82ODFfMjg0NSkiLz4KPHBhdGggZD0iTTcxLjk5NjggMTlDNzAuMzAzOSAxOS4wMDAyIDY4LjkzMTIgMjAuNTMyMiA2OC45MzE0IDIyLjQyMjFDNjguOTMxNCAyMi40NTExIDY4LjkzNzMgMjIuNDc4OCA2OC45Mzc5IDIyLjUwNzZDNjguOTM1NCAyMi43NjQ0IDY4LjkyMzEgMjMuMDczNyA2OC45MzE0IDIzLjI5NzNDNjguOTcxNyAyNC4zODczIDY5LjIwODIgMjUuMjIxNiA2OS4zNTA2IDI2LjIyNThDNjkuNjA4NCAyOC4zNzUyIDY5LjgyNDUgMzAuMTU2OSA2OS42OTEyIDMxLjgxM0M2OS41NjE1IDMyLjQzNzUgNjkuMTAzNyAzMy4wMDg2IDY4LjY5NTYgMzMuNDA1Nkw2OC42MjM1IDM0LjcwODZDNjYuNzgzOSAzNC44NjE3IDY0LjkzMTkgMzUuMTQyMSA2My4wODIxIDM1LjU2NDFDNTUuMTIyNiAzNy4zNzk4IDQ4LjI2OTUgNDEuNDk5MSA0My4wNTIgNDcuMDYwOUM0Mi43MTM0IDQ2LjgyODggNDIuMTIxMSA0Ni40MDE5IDQxLjk0NSA0Ni4yNzEyQzQxLjM5NzcgNDYuMzQ1NCA0MC44NDQ1IDQ2LjUxNTEgNDAuMTI0MSA0Ni4wOTM1QzM4Ljc1MjIgNDUuMTY1NyAzNy41MDI4IDQzLjg4NTEgMzUuOTkxIDQyLjM0MjRDMzUuMjk4MiA0MS42MDQ0IDM0Ljc5NjYgNDAuOTAxOCAzMy45NzM1IDQwLjE5MDRDMzMuNzg2NiA0MC4wMjg5IDMzLjUwMTQgMzkuODEwNCAzMy4yOTIzIDM5LjY0NDJDMzIuNjQ4OSAzOS4xMjg4IDMxLjg5IDM4Ljg2IDMxLjE1NyAzOC44MzQ4QzMwLjIxNDcgMzguODAyNCAyOS4zMDc1IDM5LjE3MjUgMjguNzEzOCAzOS45MjA2QzI3LjY1ODQgNDEuMjUwNiAyNy45OTYzIDQzLjI4MzMgMjkuNDY3MSA0NC40NjE0QzI5LjQ4MiA0NC40NzM0IDI5LjQ5NzkgNDQuNDgyNyAyOS41MTI5IDQ0LjQ5NDNDMjkuNzE1IDQ0LjY1ODkgMjkuOTYyNSA0NC44Njk4IDMwLjE0ODMgNDUuMDA3NkMzMS4wMjE3IDQ1LjY1NTUgMzEuODE5NSA0NS45ODcyIDMyLjY4OTcgNDYuNTAxNUMzNC41MjMxIDQ3LjYzOTEgMzYuMDQzIDQ4LjU4MjMgMzcuMjQ4NiA0OS43MTk2QzM3LjcxOTQgNTAuMjIzNyAzNy44MDE2IDUxLjExMjIgMzcuODY0MyA1MS40OTY0TDM4Ljg0NjggNTIuMzc4MkMzMy41ODcyIDYwLjMzMDggMzEuMTUzIDcwLjE1MzkgMzIuNTkxNSA4MC4xNjI3TDMxLjMwNzcgODAuNTM3OEMzMC45NjkzIDgwLjk3NjggMzAuNDkxMiA4MS42Njc2IDI5Ljk5MTEgODEuODczOEMyOC40MTM4IDgyLjM3MjkgMjYuNjM4NyA4Mi41NTYyIDI0LjQ5NTYgODIuNzgxOUMyMy40ODk0IDgyLjg2NiAyMi42MjEzIDgyLjgxNTggMjEuNTU0NiA4My4wMTg4QzIxLjMxOTggODMuMDYzNSAyMC45OTI3IDgzLjE0OTEgMjAuNzM1OCA4My4yMDk3QzIwLjcyNjkgODMuMjExNiAyMC43MTg2IDgzLjIxNDIgMjAuNzA5NiA4My4yMTYyQzIwLjY5NTYgODMuMjE5NSAyMC42NzcyIDgzLjIyNjMgMjAuNjYzOCA4My4yMjk0QzE4Ljg1NyA4My42NjggMTcuNjk2MyA4NS4zMzY1IDE4LjA2OTkgODYuOTgwNUMxOC40NDM3IDg4LjYyNDggMjAuMjA4NiA4OS42MjQ4IDIyLjAyNjIgODkuMjMxMkMyMi4wMzkzIDg5LjIyODIgMjIuMDU4NCA4OS4yMjc3IDIyLjA3MiA4OS4yMjQ2QzIyLjA5MjYgODkuMjE5OSAyMi4xMTA2IDg5LjIwOTkgMjIuMTMxIDg5LjIwNDlDMjIuMzg0NCA4OS4xNDkgMjIuNzAxOSA4OS4wODY4IDIyLjkyMzYgODkuMDI3MkMyMy45NzIzIDg4Ljc0NTEgMjQuNzMxOCA4OC4zMzA2IDI1LjY3NDYgODcuOTY3N0MyNy43MDI5IDg3LjIzNjggMjkuMzgyOCA4Ni42MjYyIDMxLjAxOTUgODYuMzg4M0MzMS43MDMgODYuMzM0NSAzMi40MjMyIDg2LjgxMiAzMi43ODE0IDg3LjAxMzRMMzQuMTE3NyA4Ni43ODMxQzM3LjE5MjYgOTYuMzYxMyA0My42MzY2IDEwNC4xMDMgNTEuNzk2MyAxMDguOTYxTDUxLjIzOTYgMTEwLjMwM0M1MS40NDAzIDExMC44MjQgNTEuNjYxNiAxMTEuNTMgNTEuNTEyMSAxMTIuMDQ1QzUwLjkxNzEgMTEzLjU5NSA0OS44OTggMTE1LjIzMSA0OC43Mzc0IDExNy4wNTVDNDguMTc1NSAxMTcuODk4IDQ3LjYwMDQgMTE4LjU1MiA0Ny4wOTM0IDExOS41MTZDNDYuOTcyIDExOS43NDcgNDYuODE3NSAxMjAuMTAyIDQ2LjcwMDQgMTIwLjM0NkM0NS45MTI1IDEyMi4wMzkgNDYuNDkwNCAxMjMuOTkgNDguMDAzOCAxMjQuNzIyQzQ5LjUyNjggMTI1LjQ1OSA1MS40MTcxIDEyNC42ODIgNTIuMjM1MiAxMjIuOTg1QzUyLjIzNjQgMTIyLjk4MiA1Mi4yNDA2IDEyMi45OCA1Mi4yNDE3IDEyMi45NzhDNTIuMjQyNiAxMjIuOTc2IDUyLjI0MDkgMTIyLjk3MyA1Mi4yNDE3IDEyMi45NzFDNTIuMzU4MiAxMjIuNzMxIDUyLjUyMzMgMTIyLjQxNSA1Mi42MjE2IDEyMi4xODhDNTMuMDU2IDEyMS4xODkgNTMuMjAwNSAxMjAuMzMyIDUzLjUwNTkgMTE5LjM2NUM1NC4zMTcgMTE3LjMxOCA1NC43NjI2IDExNS4xNyA1NS44NzkxIDExMy44MzJDNTYuMTg0OSAxMTMuNDY2IDU2LjY4MzMgMTEzLjMyNSA1Ny4yMDAxIDExMy4xODZMNTcuODk0NCAxMTEuOTIyQzY1LjAwOCAxMTQuNjY1IDcyLjk3MDUgMTE1LjQwMiA4MC45MjQ1IDExMy41ODdDODIuNzM5MSAxMTMuMTczIDg0LjQ5MDggMTEyLjYzNyA4Ni4xODQzIDExMS45OTRDODYuMzc5NCAxMTIuMzQyIDg2Ljc0MiAxMTMuMDExIDg2LjgzOTMgMTEzLjE3OUM4Ny4zNjQ0IDExMy4zNTEgODcuOTM3NyAxMTMuNDM5IDg4LjQwNDcgMTE0LjEzM0M4OS4yNDAxIDExNS41NjcgODkuODExNCAxMTcuMjYzIDkwLjUwNzMgMTE5LjMxMkM5MC44MTI4IDEyMC4yNzkgOTAuOTYzOCAxMjEuMTM2IDkxLjM5ODEgMTIyLjEzNkM5MS40OTcxIDEyMi4zNjMgOTEuNjYxNCAxMjIuNjg0IDkxLjc3OCAxMjIuOTI1QzkyLjU5NDQgMTI0LjYyOCA5NC40OTA3IDEyNS40MDcgOTYuMDE1OSAxMjQuNjY5Qzk3LjUyOTIgMTIzLjkzNyA5OC4xMDc3IDEyMS45ODYgOTcuMzE5NCAxMjAuMjkzQzk3LjIwMjMgMTIwLjA0OSA5Ny4wNDEyIDExOS42OTUgOTYuOTE5OCAxMTkuNDY0Qzk2LjQxMjcgMTE4LjQ5OSA5NS44Mzc3IDExNy44NTIgOTUuMjc1OCAxMTcuMDA5Qzk0LjExNTIgMTE1LjE4NSA5My4xNTI2IDExMy42NyA5Mi41NTc1IDExMi4xMkM5Mi4zMDg3IDExMS4zMiA5Mi41OTk1IDExMC44MjMgOTIuNzkzMyAxMTAuMzAzQzkyLjY3NzIgMTEwLjE3IDkyLjQyODggMTA5LjQxNCA5Mi4yODI0IDEwOS4wNTlDMTAwLjc2MiAxMDQuMDI5IDEwNy4wMTcgOTUuOTk4NSAxMDkuOTU1IDg2LjcyMzlDMTEwLjM1MSA4Ni43ODY1IDExMS4wNDEgODYuOTA5MSAxMTEuMjY1IDg2Ljk1NDJDMTExLjcyNiA4Ni42NDg3IDExMi4xNDkgODYuMjUwMSAxMTIuOTgxIDg2LjMxNTlDMTE0LjYxNyA4Ni41NTM3IDExNi4yOTcgODcuMTY0NSAxMTguMzI2IDg3Ljg5NTNDMTE5LjI2OCA4OC4yNTgxIDEyMC4wMjggODguNjc5MyAxMjEuMDc3IDg4Ljk2MTRDMTIxLjI5OCA4OS4wMjEgMTIxLjYxNiA4OS4wNzY2IDEyMS44NjkgODkuMTMyNUMxMjEuODg5IDg5LjEzNzUgMTIxLjkwOCA4OS4xNDc1IDEyMS45MjggODkuMTUyMkMxMjEuOTQyIDg5LjE1NTMgMTIxLjk2MSA4OS4xNTU4IDEyMS45NzQgODkuMTU4OEMxMjMuNzkyIDg5LjU1MiAxMjUuNTU3IDg4LjU1MjYgMTI1LjkzIDg2LjkwODFDMTI2LjMwMyA4NS4yNjQxIDEyNS4xNDMgODMuNTk1MiAxMjMuMzM2IDgzLjE1N0MxMjMuMDc0IDgzLjA5NyAxMjIuNzAxIDgyLjk5NSAxMjIuNDQ2IDgyLjk0NjVDMTIxLjM3OSA4Mi43NDM1IDEyMC41MTEgODIuNzkzNSAxMTkuNTA1IDgyLjcwOTVDMTE3LjM2MSA4Mi40ODM5IDExNS41ODYgODIuMzAwNCAxMTQuMDA5IDgxLjgwMTRDMTEzLjM2NiA4MS41NTA3IDExMi45MDggODAuNzgxOSAxMTIuNjg2IDgwLjQ2NTVMMTExLjQ0OCA4MC4xMDM1QzExMi4wOSA3NS40MzggMTExLjkxNyA3MC41ODI1IDExMC44MDYgNjUuNzI0M0MxMDkuNjg1IDYwLjgyMDggMTA3LjcwNCA1Ni4zMzYxIDEwNS4wNjIgNTIuMzg0OEMxMDUuMzc5IDUyLjA5NDggMTA1Ljk3OSA1MS41NjEyIDEwNi4xNDkgNTEuNDA0M0MxMDYuMTk5IDUwLjg1MTcgMTA2LjE1NiA1MC4yNzIyIDEwNi43MjUgNDkuNjYwM0MxMDcuOTMxIDQ4LjUyMyAxMDkuNDUxIDQ3LjU3OTkgMTExLjI4NCA0Ni40NDIzQzExMi4xNTQgNDUuOTI3OSAxMTIuOTU5IDQ1LjU5NjQgMTEzLjgzMiA0NC45NDg0QzExNC4wMyA0NC44MDE5IDExNC4yOTkgNDQuNTY5OSAxMTQuNTA3IDQ0LjQwMjJDMTE1Ljk3NyA0My4yMjM3IDExNi4zMTYgNDEuMTkxMSAxMTUuMjYgMzkuODYxNEMxMTQuMjA0IDM4LjUzMTcgMTEyLjE1OSAzOC40MDY1IDExMC42ODggMzkuNTg1QzExMC40NzkgMzkuNzUxNiAxMTAuMTk1IDM5Ljk2ODggMTEwLjAwNyA0MC4xMzEyQzEwOS4xODQgNDAuODQyNiAxMDguNjc2IDQxLjU0NTIgMTA3Ljk4MyA0Mi4yODMyQzEwNi40NzEgNDMuODI1OSAxMDUuMjIyIDQ1LjExMyAxMDMuODUgNDYuMDQwOUMxMDMuMjU1IDQ2LjM4ODUgMTAyLjM4NSA0Ni4yNjgyIDEwMS45OSA0Ni4yNDQ5TDEwMC44MjQgNDcuMDgwNkM5NC4xNzUzIDQwLjA3NjMgODUuMTIzNSAzNS41OTgyIDc1LjM3NjYgMzQuNzI4M0M3NS4zNDk0IDM0LjMxNzkgNzUuMzEzNyAzMy41NzYxIDc1LjMwNDYgMzMuMzUyOUM3NC45MDU2IDMyLjk2OTMgNzQuNDIzNSAzMi42NDE4IDc0LjMwMjQgMzEuODEzQzc0LjE2OTEgMzAuMTU2OSA3NC4zOTE3IDI4LjM3NTIgNzQuNjQ5NiAyNi4yMjU4Qzc0Ljc5MTkgMjUuMjIxNiA3NS4wMjg0IDI0LjM4NzMgNzUuMDY4OCAyMy4yOTczQzc1LjA3OCAyMy4wNDk1IDc1LjA2MzIgMjIuNjkgNzUuMDYyMiAyMi40MjIxQzc1LjA2MiAyMC41MzIyIDczLjY4OTggMTguOTk5OCA3MS45OTY4IDE5Wk02OC4xNTg1IDQyLjg4ODZMNjcuMjQ4IDU5LjA0NDdMNjcuMTgyNSA1OS4wNzc2QzY3LjEyMTQgNjAuNTIyOSA2NS45Mzc1IDYxLjY3NyA2NC40ODM5IDYxLjY3N0M2My44ODg0IDYxLjY3NyA2My4zMzg4IDYxLjQ4NDkgNjIuODkyMiA2MS4xNTcxTDYyLjg2NiA2MS4xNzAzTDQ5LjY4MDcgNTEuNzc5NEM1My43MzMxIDQ3Ljc3NTkgNTguOTE2NCA0NC44MTcyIDY0Ljg5IDQzLjQ1NDZDNjUuOTgxMiA0My4yMDU2IDY3LjA3MTkgNDMuMDIwOSA2OC4xNTg1IDQyLjg4ODZaTTc1Ljg0MTcgNDIuODg4NkM4Mi44MTU5IDQzLjc1MDQgODkuMjY1NyA0Ni45MjMyIDk0LjIwODEgNTEuNzg2TDgxLjEwOCA2MS4xMTc2TDgxLjA2MjEgNjEuMDk3OUM3OS44OTk0IDYxLjk1MTIgNzguMjYxMSA2MS43Mzk0IDc3LjM1NDggNjAuNTk3OEM3Ni45ODM1IDYwLjEzMDEgNzYuNzg4NyA1OS41ODAxIDc2Ljc2NTMgNTkuMDI0OUw3Ni43NTIyIDU5LjAxODRMNzUuODQxNyA0Mi44ODg2Wk00NC44OTkxIDU3LjgxNEw1Ni45MzgyIDY4LjYzM0w1Ni45MjUxIDY4LjY5ODhDNTguMDExNyA2OS42NDc5IDU4LjE3MiA3MS4yOTQ5IDU3LjI2NTcgNzIuNDM2OEM1Ni44OTQ0IDcyLjkwNDUgNTYuMzk3NSA3My4yMTgyIDU1Ljg2MzkgNzMuMzY0N0w1NS44NTA4IDczLjQxNzNMNDAuNDE4OCA3Ny44OTIzQzM5LjYzMzQgNzAuNjc2NSA0MS4zMjYxIDYzLjY2MjEgNDQuODk5MSA1Ny44MTRaTTk5LjAwOTQgNTcuODIwNkMxMDAuNzk4IDYwLjczMzYgMTAyLjE1MyA2My45ODcxIDEwMi45NTkgNjcuNTE0M0MxMDMuNzU2IDcwLjk5OTEgMTAzLjk1NiA3NC40Nzc4IDEwMy42MjcgNzcuODM5N0w4OC4xMTY2IDczLjM1MTVMODguMTAzNSA3My4yODU3Qzg2LjcxNDUgNzIuOTA0MyA4NS44NjA5IDcxLjQ4NDggODYuMTg0MyA3MC4wNjExQzg2LjMxNjggNjkuNDc3OCA4Ni42MjQ5IDY4Ljk4NDQgODcuMDQyMyA2OC42MTk4TDg3LjAzNTggNjguNTg2OUw5OS4wMDk0IDU3LjgyMDZaTTY5LjUyNzQgNjkuNDY4OEg3NC40NTk2TDc3LjUyNTEgNzMuMzE4Nkw3Ni40MjQ3IDc4LjEyMjZMNzEuOTk2OCA4MC4yNjE0TDY3LjU1NTggNzguMTE2MUw2Ni40NTU0IDczLjMxMkw2OS41Mjc0IDY5LjQ2ODhaTTg1LjMzOTMgODIuNjQzN0M4NS41NDg5IDgyLjYzMzEgODUuNzU3NiA4Mi42NTIgODUuOTYxNiA4Mi42ODk4TDg1Ljk4NzggODIuNjU2OUwxMDEuOTUgODUuMzY4MkM5OS42MTQyIDkxLjk2MjQgOTUuMTQ0IDk3LjY3NSA4OS4xNzExIDEwMS40OThMODIuOTc0NyA4Ni40NjA2TDgyLjk5NDQgODYuNDM0M0M4Mi40MjUyIDg1LjEwNTUgODIuOTk0OCA4My41NDcyIDg0LjMwNDQgODIuOTEzNUM4NC42Mzk3IDgyLjc1MTMgODQuOTkgODIuNjYxNCA4NS4zMzkzIDgyLjY0MzdaTTU4LjUyOTggODIuNzA5NUM1OS43NDggODIuNzI2NyA2MC44NDA2IDgzLjU3NjEgNjEuMTIzNyA4NC44MjJDNjEuMjU2MiA4NS40MDUyIDYxLjE5MTcgODUuOTgzMSA2MC45NzMgODYuNDkzNUw2MS4wMTg5IDg2LjU1MjdMNTQuODg4IDEwMS40MzlDNDkuMTU1OSA5Ny43NDMyIDQ0LjU5MDQgOTIuMjA5OSA0Mi4xNDgxIDg1LjQyMDhMNTcuOTczMSA4Mi43MjI3TDU3Ljk5OTMgODIuNzU1NkM1OC4xNzYzIDgyLjcyMjkgNTguMzU1OCA4Mi43MDcxIDU4LjUyOTggODIuNzA5NVpNNzEuODk4NiA4OS4yMzEyQzcyLjMyMjkgODkuMjE1NSA3Mi43NTM0IDg5LjMwMyA3My4xNjI3IDg5LjUwMUM3My42OTkyIDg5Ljc2MDYgNzQuMTEzNiA5MC4xNjkyIDc0LjM3NDUgOTAuNjU5Mkg3NC40MzM0TDgyLjIzNDYgMTA0LjgyMUM4MS4yMjIxIDEwNS4xNjIgODAuMTgxMyAxMDUuNDU0IDc5LjExNjcgMTA1LjY5N0M3My4xNTA1IDEwNy4wNTggNjcuMjAzMiAxMDYuNjQ1IDYxLjgxOCAxMDQuODAyTDY5LjU5OTUgOTAuNjY1OEg2OS42MTI2QzcwLjA3OTUgODkuNzg4OCA3MC45NjUgODkuMjY1NiA3MS44OTg2IDg5LjIzMTJaIiBmaWxsPSJ3aGl0ZSIgc3Ryb2tlPSJ3aGl0ZSIgc3Ryb2tlLXdpZHRoPSIwLjI1Ii8+CjxkZWZzPgo8bGluZWFyR3JhZGllbnQgaWQ9InBhaW50MF9saW5lYXJfNjgxXzI4NDUiIHgxPSIxMCIgeTE9IjE1LjUiIHgyPSIxNDQiIHkyPSIxMzEuNSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPgo8c3RvcCBzdG9wLWNvbG9yPSIjNEQ4N0ZGIi8+CjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iIzA1NDdEMCIvPgo8L2xpbmVhckdyYWRpZW50Pgo8L2RlZnM+Cjwvc3ZnPgo=
-    keysOrder: [["apiVersion"],["appVersion"],["kind"],["metadata"],["metadata","name"],["spec","storageClass"],["spec","nodeGroups"],["spec","nodeGroups","md0"],["spec","nodeGroups","md0","minReplicas"],["spec","nodeGroups","md0","maxReplicas"],["spec","nodeGroups","md0","instanceType"],["spec","nodeGroups","md0","ephemeralStorage"],["spec","nodeGroups","md0","roles"],["spec","nodeGroups","md0","resources"],["spec","nodeGroups","md0","gpus"],["spec","version"],["spec","host"],["spec","addons"],["spec","addons","certManager"],["spec","addons","certManager","enabled"],["spec","addons","certManager","valuesOverride"],["spec","addons","cilium"],["spec","addons","cilium","valuesOverride"],["spec","addons","gatewayAPI"],["spec","addons","gatewayAPI","enabled"],["spec","addons","ingressNginx"],["spec","addons","ingressNginx","enabled"],["spec","addons","ingressNginx","exposeMethod"],["spec","addons","ingressNginx","hosts"],["spec","addons","ingressNginx","valuesOverride"],["spec","addons","gpuOperator"],["spec","addons","gpuOperator","enabled"],["spec","addons","gpuOperator","valuesOverride"],["spec","addons","fluxcd"],["spec","addons","fluxcd","enabled"],["spec","addons","fluxcd","valuesOverride"],["spec","addons","monitoringAgents"],["spec","addons","monitoringAgents","enabled"],["spec","addons","monitoringAgents","valuesOverride"],["spec","addons","verticalPodAutoscaler"],["spec","addons","verticalPodAutoscaler","valuesOverride"],["spec","addons","velero"],["spec","addons","velero","enabled"],["spec","addons","velero","valuesOverride"],["spec","addons","coredns"],["spec","addons","coredns","valuesOverride"],["spec","controlPlane"],["spec","controlPlane","replicas"],["spec","controlPlane","apiServer"],["spec","controlPlane","apiServer","resources"],["spec","controlPlane","apiServer","resourcesPreset"],["spec","controlPlane","controllerManager"],["spec","controlPlane","controllerManager","resources"],["spec","controlPlane","controllerManager","resourcesPreset"],["spec","controlPlane","scheduler"],["spec","controlPlane","scheduler","resources"],["spec","controlPlane","scheduler","resourcesPreset"],["spec","controlPlane","konnectivity"],["spec","controlPlane","konnectivity","server"],["spec","controlPlane","konnectivity","server","resources"],["spec","controlPlane","konnectivity","server","resourcesPreset"],["spec","addons","hami"],["spec","addons","hami","enabled"],["spec","addons","hami","valuesOverride"],["spec","images"],["spec","images","waitForKubeconfig"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "storageClass"], ["spec", "nodeGroups"], ["spec", "nodeGroups", "md0"], ["spec", "nodeGroups", "md0", "minReplicas"], ["spec", "nodeGroups", "md0", "maxReplicas"], ["spec", "nodeGroups", "md0", "instanceType"], ["spec", "nodeGroups", "md0", "ephemeralStorage"], ["spec", "nodeGroups", "md0", "roles"], ["spec", "nodeGroups", "md0", "resources"], ["spec", "nodeGroups", "md0", "gpus"], ["spec", "version"], ["spec", "host"], ["spec", "addons"], ["spec", "addons", "certManager"], ["spec", "addons", "certManager", "enabled"], ["spec", "addons", "certManager", "valuesOverride"], ["spec", "addons", "cilium"], ["spec", "addons", "cilium", "valuesOverride"], ["spec", "addons", "gatewayAPI"], ["spec", "addons", "gatewayAPI", "enabled"], ["spec", "addons", "ingressNginx"], ["spec", "addons", "ingressNginx", "enabled"], ["spec", "addons", "ingressNginx", "exposeMethod"], ["spec", "addons", "ingressNginx", "hosts"], ["spec", "addons", "ingressNginx", "valuesOverride"], ["spec", "addons", "gpuOperator"], ["spec", "addons", "gpuOperator", "enabled"], ["spec", "addons", "gpuOperator", "valuesOverride"], ["spec", "addons", "hami"], ["spec", "addons", "hami", "enabled"], ["spec", "addons", "hami", "valuesOverride"], ["spec", "addons", "fluxcd"], ["spec", "addons", "fluxcd", "enabled"], ["spec", "addons", "fluxcd", "valuesOverride"], ["spec", "addons", "monitoringAgents"], ["spec", "addons", "monitoringAgents", "enabled"], ["spec", "addons", "monitoringAgents", "valuesOverride"], ["spec", "addons", "verticalPodAutoscaler"], ["spec", "addons", "verticalPodAutoscaler", "valuesOverride"], ["spec", "addons", "velero"], ["spec", "addons", "velero", "enabled"], ["spec", "addons", "velero", "valuesOverride"], ["spec", "addons", "coredns"], ["spec", "addons", "coredns", "valuesOverride"], ["spec", "controlPlane"], ["spec", "controlPlane", "replicas"], ["spec", "controlPlane", "apiServer"], ["spec", "controlPlane", "apiServer", "resources"], ["spec", "controlPlane", "apiServer", "resourcesPreset"], ["spec", "controlPlane", "controllerManager"], ["spec", "controlPlane", "controllerManager", "resources"], ["spec", "controlPlane", "controllerManager", "resourcesPreset"], ["spec", "controlPlane", "scheduler"], ["spec", "controlPlane", "scheduler", "resources"], ["spec", "controlPlane", "scheduler", "resourcesPreset"], ["spec", "controlPlane", "konnectivity"], ["spec", "controlPlane", "konnectivity", "server"], ["spec", "controlPlane", "konnectivity", "server", "resources"], ["spec", "controlPlane", "konnectivity", "server", "resourcesPreset"], ["spec", "images"], ["spec", "images", "waitForKubeconfig"]]
   secrets:
     exclude: []
     include:

From 805b3b17cbc4d89206203bc24b45c1412c29a2c8 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Tue, 28 Apr 2026 19:11:26 +0300
Subject: [PATCH 658/666] fix(kubernetes): add CI values to GPU Operator HAMi
 tests

Tests need _namespace.etcd from values-ci.yaml after the merge
introduced an etcd-namespace guard on the gpu-operator HelmRelease
condition.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml b/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml
index 4fa754fb..44528470 100644
--- a/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml
+++ b/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml
@@ -1,6 +1,8 @@
 suite: GPU Operator HelmRelease HAMi integration tests
 templates:
   - templates/helmreleases/gpu-operator.yaml
+values:
+  - values-ci.yaml
 tests:
   - it: should disable devicePlugin when hami is enabled
     set:

From 4541c20e3403a5eda85a15ae3a02b80e6cc2ebbd Mon Sep 17 00:00:00 2001
From: "cozystack-ci[bot]"
 <274107086+cozystack-ci[bot]@users.noreply.github.com>
Date: Wed, 29 Apr 2026 04:38:30 +0000
Subject: [PATCH 659/666] docs: add changelog for v1.3.1

Signed-off-by: cozystack-ci[bot] <274107086+cozystack-ci[bot]@users.noreply.github.com>
---
 docs/changelogs/v1.3.1.md | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 docs/changelogs/v1.3.1.md

diff --git a/docs/changelogs/v1.3.1.md b/docs/changelogs/v1.3.1.md
new file mode 100644
index 00000000..55e6a796
--- /dev/null
+++ b/docs/changelogs/v1.3.1.md
@@ -0,0 +1,38 @@
+# v1.3.1 (2026-04-29)
+
+This is a patch release containing fixes and minor improvements.
+
+## Fixes and Improvements
+
+* **[linstor-gui] Add package for LINBIT linstor-gui web UI**: [linstor-gui] Add package for LINBIT linstor-gui web UI ([**@myasnikovdaniil**](https://github.com/cozystack/cozystack/pull/2382) in #2382)
+* **fix(kamaji): increase memory limits and add startup probe**: fix(kamaji): increase memory limits and add startup probe ([**@IvanHunters**](https://github.com/cozystack/cozystack/pull/2421) in #2421)
+* **fix(backups): move velero-configmap Role to velero chart**: fix(backups): move velero-configmap Role to velero chart ([**@myasnikovdaniil**](https://github.com/cozystack/cozystack/pull/2459) in #2459)
+* **fix(etcd): remove destructive post-upgrade cert-regeneration hook**: fix(etcd): remove destructive post-upgrade cert-regeneration hook ([**@myasnikovdaniil**](https://github.com/cozystack/cozystack/pull/2462) in #2462)
+* **[Backport release-1.3] fix(backups): move velero-configmap Role to velero chart**: [Backport release-1.3] fix(backups): move velero-configmap Role to velero chart ([**@IvanHunters**](https://github.com/cozystack/cozystack/pull/2467) in #2467)
+* **fix(api): prevent IDOR in TenantNamespace Get and Watch handlers**: fix(api): prevent IDOR in TenantNamespace Get and Watch handlers ([**@IvanHunters**](https://github.com/cozystack/cozystack/pull/2471) in #2471)
+* **[Backport release-1.3] fix(kamaji): increase memory limits and add startup probe**: [Backport release-1.3] fix(kamaji): increase memory limits and add startup probe ([**@app/github-actions**](https://github.com/cozystack/cozystack/pull/2491) in #2491)
+* **feat(linstor): bump linstor-csi to v1.10.6 with Protocol-C dual-attach fix**: feat(linstor): bump linstor-csi to v1.10.6 with Protocol-C dual-attach fix ([**@kvaps**](https://github.com/cozystack/cozystack/pull/2496) in #2496)
+* **build(linstor): include linstor-gui in root image build target**: build(linstor): include linstor-gui in root image build target ([**@myasnikovdaniil**](https://github.com/cozystack/cozystack/pull/2498) in #2498)
+* **[Backport release-1.3] feat(linstor): bump linstor-csi to v1.10.6 with Protocol-C dual-attach fix**: [Backport release-1.3] feat(linstor): bump linstor-csi to v1.10.6 with Protocol-C dual-attach fix ([**@app/github-actions**](https://github.com/cozystack/cozystack/pull/2505) in #2505)
+* **[Backport release-1.3] fix(etcd): remove destructive post-upgrade cert-regeneration hook**: [Backport release-1.3] fix(etcd): remove destructive post-upgrade cert-regeneration hook ([**@app/github-actions**](https://github.com/cozystack/cozystack/pull/2511) in #2511)
+* **[Backport release-1.3] build(linstor): include linstor-gui in root image build target**: [Backport release-1.3] build(linstor): include linstor-gui in root image build target ([**@app/github-actions**](https://github.com/cozystack/cozystack/pull/2518) in #2518)
+* **[Backport release-1.3] fix(api): prevent IDOR in TenantNamespace Get and Watch handlers**: [Backport release-1.3] fix(api): prevent IDOR in TenantNamespace Get and Watch handlers ([**@app/github-actions**](https://github.com/cozystack/cozystack/pull/2524) in #2524)
+* **fix namespaces creation**: fix namespaces creation ([**@kvaps**](https://github.com/cozystack/cozystack/pull/435) in #435)
+
+## Documentation
+
+* **[website] [docs] Update managed apps reference for v1.3.0**: Documentation updates ([**@myasnikovdaniil**](https://github.com/cozystack/website/pull/507) in cozystack/website#507)
+* **[website] feat(blog): add Cozystack 1.3 release announcement**: Documentation updates ([**@tym83**](https://github.com/cozystack/website/pull/512) in cozystack/website#512)
+* **[website] fix(telemetry): use April 2026 data as placeholder for quarter and year periods**: Documentation updates ([**@tym83**](https://github.com/cozystack/website/pull/511) in cozystack/website#511)
+* **[website] fix(oss-health): correct April 2026 telemetry snapshot and pause fetch cron**: Documentation updates ([**@tym83**](https://github.com/cozystack/website/pull/508) in cozystack/website#508)
+
+## Contributors
+
+We thank the following contributors for this release:
+
+* [**@IvanHunters**](https://github.com/IvanHunters)
+* [**@app/github-actions**](https://github.com/app/github-actions)
+* [**@kvaps**](https://github.com/kvaps)
+* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.3.0...v1.3.1

From 875a940033fea97a4800797989b0e004bbb8eca4 Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Wed, 29 Apr 2026 12:22:08 +0500
Subject: [PATCH 660/666] docs(changelog): rewrite v1.3.1 with the actual
 release contents

The AI-generated v1.3.1 changelog (#2480) was generated from
git log v1.3.0..main rather than git log v1.3.0..v1.3.1, because
the workflow checked out main while the v1.3.1 tag points to
release-1.3. As a result the changelog included:

- 8 PRs that were merged to main but never shipped in v1.3.1
- 6 backport PRs that were merged to release-1.3 *after* v1.3.1
  was tagged
- Both originals and their backports as separate duplicate entries
- A 2024 PR (#435) that has nothing to do with this range
- Generic "Documentation updates" placeholders for website entries
- Title duplicated as both the bold label and the description
  (`* **fix(...): X**: fix(...): X (...)`)
- The cozystack-ci bot listed as a human contributor

The actual v1.3.1 release range (v1.3.0..v1.3.1) contains exactly
one user-facing change:

  41bcb0be [Backport release-1.3] fix(backups): move
           velero-configmap Role to velero chart (#2467)

which is the backport of #2459 (myasnikovdaniil) shipped via
#2467 (IvanHunters). This commit replaces the contents of
docs/changelogs/v1.3.1.md with that one entry, the matching
two-person contributors list, and the standard footer.

The workflow + docs fixes that prevent this regression for future
patch releases will land in a separate PR against main.

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 docs/changelogs/v1.3.1.md | 34 ++++++++--------------------------
 1 file changed, 8 insertions(+), 26 deletions(-)

diff --git a/docs/changelogs/v1.3.1.md b/docs/changelogs/v1.3.1.md
index 55e6a796..e8318ff4 100644
--- a/docs/changelogs/v1.3.1.md
+++ b/docs/changelogs/v1.3.1.md
@@ -1,38 +1,20 @@
-# v1.3.1 (2026-04-29)
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.3.1
+-->
 
-This is a patch release containing fixes and minor improvements.
+# v1.3.1 (2026-04-23)
 
-## Fixes and Improvements
+A patch release with a single bug fix in the backup subsystem.
 
-* **[linstor-gui] Add package for LINBIT linstor-gui web UI**: [linstor-gui] Add package for LINBIT linstor-gui web UI ([**@myasnikovdaniil**](https://github.com/cozystack/cozystack/pull/2382) in #2382)
-* **fix(kamaji): increase memory limits and add startup probe**: fix(kamaji): increase memory limits and add startup probe ([**@IvanHunters**](https://github.com/cozystack/cozystack/pull/2421) in #2421)
-* **fix(backups): move velero-configmap Role to velero chart**: fix(backups): move velero-configmap Role to velero chart ([**@myasnikovdaniil**](https://github.com/cozystack/cozystack/pull/2459) in #2459)
-* **fix(etcd): remove destructive post-upgrade cert-regeneration hook**: fix(etcd): remove destructive post-upgrade cert-regeneration hook ([**@myasnikovdaniil**](https://github.com/cozystack/cozystack/pull/2462) in #2462)
-* **[Backport release-1.3] fix(backups): move velero-configmap Role to velero chart**: [Backport release-1.3] fix(backups): move velero-configmap Role to velero chart ([**@IvanHunters**](https://github.com/cozystack/cozystack/pull/2467) in #2467)
-* **fix(api): prevent IDOR in TenantNamespace Get and Watch handlers**: fix(api): prevent IDOR in TenantNamespace Get and Watch handlers ([**@IvanHunters**](https://github.com/cozystack/cozystack/pull/2471) in #2471)
-* **[Backport release-1.3] fix(kamaji): increase memory limits and add startup probe**: [Backport release-1.3] fix(kamaji): increase memory limits and add startup probe ([**@app/github-actions**](https://github.com/cozystack/cozystack/pull/2491) in #2491)
-* **feat(linstor): bump linstor-csi to v1.10.6 with Protocol-C dual-attach fix**: feat(linstor): bump linstor-csi to v1.10.6 with Protocol-C dual-attach fix ([**@kvaps**](https://github.com/cozystack/cozystack/pull/2496) in #2496)
-* **build(linstor): include linstor-gui in root image build target**: build(linstor): include linstor-gui in root image build target ([**@myasnikovdaniil**](https://github.com/cozystack/cozystack/pull/2498) in #2498)
-* **[Backport release-1.3] feat(linstor): bump linstor-csi to v1.10.6 with Protocol-C dual-attach fix**: [Backport release-1.3] feat(linstor): bump linstor-csi to v1.10.6 with Protocol-C dual-attach fix ([**@app/github-actions**](https://github.com/cozystack/cozystack/pull/2505) in #2505)
-* **[Backport release-1.3] fix(etcd): remove destructive post-upgrade cert-regeneration hook**: [Backport release-1.3] fix(etcd): remove destructive post-upgrade cert-regeneration hook ([**@app/github-actions**](https://github.com/cozystack/cozystack/pull/2511) in #2511)
-* **[Backport release-1.3] build(linstor): include linstor-gui in root image build target**: [Backport release-1.3] build(linstor): include linstor-gui in root image build target ([**@app/github-actions**](https://github.com/cozystack/cozystack/pull/2518) in #2518)
-* **[Backport release-1.3] fix(api): prevent IDOR in TenantNamespace Get and Watch handlers**: [Backport release-1.3] fix(api): prevent IDOR in TenantNamespace Get and Watch handlers ([**@app/github-actions**](https://github.com/cozystack/cozystack/pull/2524) in #2524)
-* **fix namespaces creation**: fix namespaces creation ([**@kvaps**](https://github.com/cozystack/cozystack/pull/435) in #435)
+## Fixes
 
-## Documentation
-
-* **[website] [docs] Update managed apps reference for v1.3.0**: Documentation updates ([**@myasnikovdaniil**](https://github.com/cozystack/website/pull/507) in cozystack/website#507)
-* **[website] feat(blog): add Cozystack 1.3 release announcement**: Documentation updates ([**@tym83**](https://github.com/cozystack/website/pull/512) in cozystack/website#512)
-* **[website] fix(telemetry): use April 2026 data as placeholder for quarter and year periods**: Documentation updates ([**@tym83**](https://github.com/cozystack/website/pull/511) in cozystack/website#511)
-* **[website] fix(oss-health): correct April 2026 telemetry snapshot and pause fetch cron**: Documentation updates ([**@tym83**](https://github.com/cozystack/website/pull/508) in cozystack/website#508)
+* **fix(backups): move velero-configmap Role to velero chart**: The `backupstrategy-controller` (a default package) declared a Role/RoleBinding scoped to the `cozy-velero` namespace for managing `ResourceModifier` ConfigMaps. On bundles where Velero was not enabled, that namespace did not exist and the HelmRelease failed with `namespaces "cozy-velero" not found`, blocking installation. The Role/RoleBinding now lives in the velero chart, so it is created only when velero is actually deployed. ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2459, backport #2467)
 
 ## Contributors
 
-We thank the following contributors for this release:
+Thanks to everyone who contributed to this patch release:
 
 * [**@IvanHunters**](https://github.com/IvanHunters)
-* [**@app/github-actions**](https://github.com/app/github-actions)
-* [**@kvaps**](https://github.com/kvaps)
 * [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
 
 **Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.3.0...v1.3.1

From 1e0d8acb3553e0702a4c96a5775d4aadd6338c6b Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Wed, 29 Apr 2026 12:46:18 +0500
Subject: [PATCH 661/666] docs(changelog): add 1.3.1 entries for backports
 landed after auto-gen

The auto-generated changelog only listed #2459/#2467 (velero-configmap
Role move). Five additional PRs were backported and merged into
release-1.3 between then and the v1.3.1 tag (2026-04-28):

- #2471/#2524 - fix(api): IDOR in TenantNamespace Get/Watch
- #2496/#2505 - feat(linstor): linstor-csi v1.10.6 (Protocol-C dual-attach)
- #2462/#2511 - fix(etcd): remove destructive post-upgrade hook
- #2421/#2491 - fix(kamaji): memory limits + startup probe
- #2498/#2518 - build(linstor): wire linstor-gui into root build target

Update the release date to match the actual tag (2026-04-28), rewrite
the intro paragraph, and add @kvaps to contributors.

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 docs/changelogs/v1.3.1.md | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/docs/changelogs/v1.3.1.md b/docs/changelogs/v1.3.1.md
index e8318ff4..0f149d0d 100644
--- a/docs/changelogs/v1.3.1.md
+++ b/docs/changelogs/v1.3.1.md
@@ -2,19 +2,36 @@
 https://github.com/cozystack/cozystack/releases/tag/v1.3.1
 -->
 
-# v1.3.1 (2026-04-23)
+# v1.3.1 (2026-04-28)
 
-A patch release with a single bug fix in the backup subsystem.
+Patch release covering a TenantNamespace IDOR fix in the API, a destructive `post-upgrade` hook removed from the etcd chart, kamaji controller stability, a `linstor-csi` bump that fixes live migration on Protocol-A/B DRBD resources, the missing `linstor-gui` build wiring, and a velero RBAC fix that unblocked installs on bundles without Velero.
+
+## Security
+
+* **fix(api): prevent IDOR in TenantNamespace Get and Watch handlers**: Two IDOR (Insecure Direct Object Reference) vulnerabilities allowed authenticated users to read TenantNamespace metadata they had no RoleBinding for. The `Get` and `Watch` handlers now go through a new `hasAccessToNamespace()` helper that lists RoleBindings scoped only to the target namespace (orders of magnitude faster than the previous all-cluster scan), returns `NotFound` instead of leaking existence on unauthorized access, and applies the same check on the `Watch` filter path. Includes regression tests for the unauthorized paths. ([**@IvanHunters**](https://github.com/IvanHunters) in #2471, backport #2524)
+
+## Features
+
+* **feat(linstor): bump linstor-csi to v1.10.6 with Protocol-C dual-attach fix**: Live migration of KubeVirt VMs on Protocol-A/B (async) DRBD volumes no longer fails with `Protocol C required`. `linstor-csi` v1.10.6 now installs a `Protocol=C` override on the resource-definition during dual-attach and reverts it on detach, so `replicated-async` StorageClasses and other Protocol-A/B resource groups support live migration without manual `drbdadm adjust` intervention. ([**@kvaps**](https://github.com/kvaps) in #2496, backport #2505)
 
 ## Fixes
 
 * **fix(backups): move velero-configmap Role to velero chart**: The `backupstrategy-controller` (a default package) declared a Role/RoleBinding scoped to the `cozy-velero` namespace for managing `ResourceModifier` ConfigMaps. On bundles where Velero was not enabled, that namespace did not exist and the HelmRelease failed with `namespaces "cozy-velero" not found`, blocking installation. The Role/RoleBinding now lives in the velero chart, so it is created only when velero is actually deployed. ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2459, backport #2467)
 
+* **fix(etcd): remove destructive post-upgrade cert-regeneration hook**: The etcd chart ran a `post-upgrade` Helm hook on every upgrade that deleted etcd TLS Secrets (`etcd-ca-tls`, `etcd-peer-ca-tls`, `etcd-client-tls`, `etcd-peer-tls`, `etcd-server-tls`) and then deleted etcd pods, forcing cert-manager to re-issue the entire etcd CA chain. On clusters with Kamaji-managed tenant control planes this put every tenant `kube-apiserver` into CrashLoopBackOff until each DataStore was manually re-reconciled. The hook was a one-shot `2.6.0 → 2.6.1` migration that became a permanent footgun once chart versioning moved to `0.0.0+<git-hash>` (always `< 2.6.1` per semver) and after the underlying `rotationPolicy: Always` issue was fixed in `47d81f70`. The hook is now removed entirely. ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2462, backport #2511)
+
+* **fix(kamaji): increase memory limits and add startup probe**: The kamaji controller frequently entered CrashLoopBackOff due to OOMKills (exit 137) within ~20–25 seconds of startup, with the readiness probe failing while the controller was still finishing initialization. Memory limit raised from 500Mi to 512Mi, request from 100Mi to 256Mi, and a 60-second startup probe (12 attempts × 5s periods) is added so the controller has room to boot before liveness/readiness probes engage. ([**@IvanHunters**](https://github.com/IvanHunters) in #2421, backport #2491)
+
+## Build
+
+* **build(linstor): include linstor-gui in root image build target**: The `linstor-gui` package (added in #2382) was never wired into the root `Makefile`'s `build:` target, so CI never built or published the image. `ghcr.io/cozystack/cozystack/linstor-gui` returned `NAME_UNKNOWN` and `values.yaml` stayed pinned to `tag: 2.3.0` without a digest. The missing build line is added so the next CI run publishes the image and the per-package `Makefile` digest-pins `values.yaml` automatically. ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2498, backport #2518)
+
 ## Contributors
 
 Thanks to everyone who contributed to this patch release:
 
 * [**@IvanHunters**](https://github.com/IvanHunters)
+* [**@kvaps**](https://github.com/kvaps)
 * [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
 
 **Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.3.0...v1.3.1

From ba8c1a0535d2e0462fb8269df0750ea6f57fdd0b Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Wed, 29 Apr 2026 11:13:12 +0300
Subject: [PATCH 662/666] docs(hami): drop HAMi#173 reference from glibc
 tracking issues
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

HAMi#173 was closed as "not planned" and only suggests a typo fix
(< 2.3.0 → < 2.30); it does not establish the actual 2.34 boundary.
HAMi-core#174 (symbol-level cause) and HAMi#1190 (empirical per-glibc
behavior) cover the same ground accurately.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/system/hami/README.md | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/packages/system/hami/README.md b/packages/system/hami/README.md
index d648364d..aa80d48a 100644
--- a/packages/system/hami/README.md
+++ b/packages/system/hami/README.md
@@ -38,9 +38,8 @@ Most modern ML/AI base images (CUDA 12.x, PyTorch 2.x, TensorFlow 2.x) use Ubunt
 
 **Upstream tracking issues:**
 
-- [HAMi-core#174](https://github.com/Project-HAMi/HAMi-core/issues/174) — `_dl_sym` removal breaks HAMi-core on glibc >= 2.34
-- [HAMi#1190](https://github.com/Project-HAMi/HAMi/issues/1190) — degraded isolation across glibc versions
-- [HAMi#173](https://github.com/Project-HAMi/HAMi/issues/173) — documentation incorrectly states glibc < 2.30 (actual boundary is 2.34)
+- [HAMi-core#174](https://github.com/Project-HAMi/HAMi-core/issues/174) — `_dl_sym` removal in glibc 2.34 breaks HAMi-core's CUDA symbol resolution at the symbol level
+- [HAMi#1190](https://github.com/Project-HAMi/HAMi/issues/1190) — maintainer thread confirming the empirical per-glibc-version isolation behavior shown in the table above
 
 ### musl libc (Alpine) incompatibility
 

From 9876acec2fafbadeb09741f70e01250171a42a48 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Wed, 29 Apr 2026 11:13:24 +0300
Subject: [PATCH 663/666] docs(hami): clarify gpu-operator devicePlugin
 override behavior

The HAMi-driven default of disabling gpu-operator's device plugin is
applied via valuesOverride and can be re-enabled by users for advanced
topologies (mixed HAMi / vanilla NVIDIA device plugin pools). Document
this explicitly so the README aligns with the existing template merge
order.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/system/hami/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/system/hami/README.md b/packages/system/hami/README.md
index aa80d48a..68669ac7 100644
--- a/packages/system/hami/README.md
+++ b/packages/system/hami/README.md
@@ -57,7 +57,7 @@ addons:
     enabled: true
 ```
 
-When HAMi is enabled, GPU Operator's built-in device plugin is automatically disabled to avoid conflicts.
+When HAMi is enabled, GPU Operator's built-in device plugin is automatically disabled to avoid conflicts. This default is preserved by setting `addons.gpuOperator.valuesOverride.gpu-operator.devicePlugin.enabled: false`; advanced topologies that partition GPU pools (e.g. some nodes use HAMi while others run the standard NVIDIA device plugin via node selectors) can re-enable it explicitly through `valuesOverride`.
 
 ### Requesting fractional GPU resources
 

From d5caffcc8de0177b248899b03391c312d20dde54 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Wed, 29 Apr 2026 11:13:42 +0300
Subject: [PATCH 664/666] fix(kubernetes): gate HAMi HelmRelease on
 _namespace.etcd

Match the pattern used by every other tenant-cluster addon HelmRelease
(gpu-operator, cilium, fluxcd, ...): only render when the upstream etcd
namespace is ready, not just when the addon is enabled. Add values-ci.yaml
to the HAMi test suite so the new gate has the fixture it needs.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/apps/kubernetes/templates/helmreleases/hami.yaml | 2 +-
 packages/apps/kubernetes/tests/hami_test.yaml             | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/packages/apps/kubernetes/templates/helmreleases/hami.yaml b/packages/apps/kubernetes/templates/helmreleases/hami.yaml
index 1f7a5358..f1538c7c 100644
--- a/packages/apps/kubernetes/templates/helmreleases/hami.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/hami.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.addons.hami.enabled }}
+{{- if and .Values.addons.hami.enabled .Values._namespace.etcd }}
 {{- if not .Values.addons.gpuOperator.enabled }}
 {{- fail "addons.hami requires addons.gpuOperator to be enabled" }}
 {{- end }}
diff --git a/packages/apps/kubernetes/tests/hami_test.yaml b/packages/apps/kubernetes/tests/hami_test.yaml
index bdbe990f..27f7c75b 100644
--- a/packages/apps/kubernetes/tests/hami_test.yaml
+++ b/packages/apps/kubernetes/tests/hami_test.yaml
@@ -1,6 +1,8 @@
 suite: HAMi HelmRelease tests
 templates:
   - templates/helmreleases/hami.yaml
+values:
+  - values-ci.yaml
 tests:
   - it: should not render when hami is disabled
     set:

From 9b5848ed268bfe3bc04b42bae38cc724c00a3bf0 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Wed, 29 Apr 2026 11:13:55 +0300
Subject: [PATCH 665/666] fix(platform): register HAMi as
 kubernetes-application component
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The HelmRelease at packages/apps/kubernetes/templates/helmreleases/hami.yaml
references chartRef.name 'cozystack-kubernetes-application-kubevirt-kubernetes-hami',
but that component was missing from the kubernetes-application PackageSource.
The HelmRelease would sit in Stalled: ArtifactNotFound at install time.

Add kubernetes-hami next to kubernetes-gpu-operator under variant kubevirt,
mirroring the existing pattern for every other tenant-cluster addon. The
standalone cozystack.hami PackageSource is retained — same shape as
gpu-operator, which is registered both standalone (for bundles/iaas) and
as a kubernetes-application component (for tenant-cluster HelmReleases).

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/core/platform/sources/kubernetes-application.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/packages/core/platform/sources/kubernetes-application.yaml b/packages/core/platform/sources/kubernetes-application.yaml
index 9787cb19..088383ad 100644
--- a/packages/core/platform/sources/kubernetes-application.yaml
+++ b/packages/core/platform/sources/kubernetes-application.yaml
@@ -52,6 +52,8 @@ spec:
           path: system/cilium
         - name: kubernetes-gpu-operator
           path: system/gpu-operator
+        - name: kubernetes-hami
+          path: system/hami
         - name: kubernetes-vertical-pod-autoscaler
           path: system/vertical-pod-autoscaler
         - name: kubernetes-prometheus-operator-crds

From 5d58d0f340f7157370305cc469317f4fa21944af Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Wed, 29 Apr 2026 11:14:41 +0300
Subject: [PATCH 666/666] chore(hami): document and partially automate vendor
 patches in Makefile
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `update:` recipe now reproduces the top-level vendoring overrides
(remove broken hami-dra subchart, clear Chart.yaml dependencies, strip
dra/hami-dra/podSecurityPolicy from upstream values.yaml) after
`helm pull`, so they no longer silently disappear on the next bump.

Template-level patches (DRA guards in scheduler/*, indent fix in
device-plugin/monitorservice.yaml) are documented with rationale and
commit references — they remain a manual step because automating them
would be fragile across upstream template restructures.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/system/hami/Makefile | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/packages/system/hami/Makefile b/packages/system/hami/Makefile
index b7a169c2..83663a66 100644
--- a/packages/system/hami/Makefile
+++ b/packages/system/hami/Makefile
@@ -4,8 +4,40 @@ export NAMESPACE=cozy-$(NAME)
 include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
+# When bumping the HAMi version, run `make update` and then review
+# the resulting diff in `charts/hami/`. The recipe below reproduces the
+# top-level vendoring overrides automatically:
+#
+#   1. Removes the broken hami-dra subchart. Upstream's NVIDIA DRA driver
+#      path requires kubelet DRA support that cozystack does not enable
+#      and has no upstream fix tracked. See commit 3c5521e.
+#   2. Empties Chart.yaml dependencies and drops Chart.lock so Helm does
+#      not try to re-pull hami-dra at build time. See commit 2734dc0.
+#   3. Strips dra/hami-dra/podSecurityPolicy blocks from the upstream
+#      values.yaml since the corresponding code paths are gone. PSP is
+#      removed from Kubernetes 1.25+ and is unused by cozystack.
+#
+# Template-level patches are NOT reproduced automatically:
+#
+#   * Scheduler templates have `{{- if .Values.dra.enabled }}` blocks
+#     that need to be removed because the dra value is gone (commit
+#     2734dc0 stripped them).
+#   * device-plugin/monitorservice.yaml uses `indent` with leading
+#     whitespace; it must be rewritten to `nindent` for the labels block
+#     to render correctly when devicePlugin.service.labels is set
+#     (commit 3685254).
+#
+# After `make update`, run `git diff -- charts/hami/templates/` and
+# replay these template patches against the new upstream version, then
+# verify with `helm unittest`. If upstream restructured the affected
+# files, the patches may need to be redesigned rather than reapplied.
+
 update:
 	rm -rf charts
 	helm repo add hami-charts https://project-hami.github.io/HAMi/
 	helm repo update hami-charts
 	helm pull hami-charts/hami --untar --untardir charts
+	rm -rf charts/hami/charts/hami-dra
+	yq --inplace '.dependencies = []' charts/hami/Chart.yaml
+	rm -f charts/hami/Chart.lock
+	yq --inplace 'del(.dra) | del(.["hami-dra"]) | del(.podSecurityPolicy)' charts/hami/values.yaml